diff options
| -rw-r--r-- | 2.6.32/0000_README | 2 | ||||
| -rw-r--r-- | 2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201305082213.patch (renamed from 2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201304292054.patch) | 56 | ||||
| -rw-r--r-- | 3.2.44/0000_README | 2 | ||||
| -rw-r--r-- | 3.2.44/4420_grsecurity-2.9.1-3.2.44-201305082214.patch (renamed from 3.2.44/4420_grsecurity-2.9.1-3.2.44-201304292055.patch) | 153 | ||||
| -rw-r--r-- | 3.8.12/0000_README (renamed from 3.8.11/0000_README) | 6 | ||||
| -rw-r--r-- | 3.8.12/1010_linux-3.8.11.patch (renamed from 3.8.11/1010_linux-3.8.11.patch) | 0 | ||||
| -rw-r--r-- | 3.8.12/1011_linux-3.8.12.patch | 3136 | ||||
| -rw-r--r-- | 3.8.12/4420_grsecurity-2.9.1-3.8.12-201305082215.patch (renamed from 3.8.11/4420_grsecurity-2.9.1-3.8.11-201305011917.patch) | 365 | ||||
| -rw-r--r-- | 3.8.12/4425_grsec_remove_EI_PAX.patch (renamed from 3.8.11/4425_grsec_remove_EI_PAX.patch) | 0 | ||||
| -rw-r--r-- | 3.8.12/4430_grsec-remove-localversion-grsec.patch (renamed from 3.8.11/4430_grsec-remove-localversion-grsec.patch) | 0 | ||||
| -rw-r--r-- | 3.8.12/4435_grsec-mute-warnings.patch (renamed from 3.8.11/4435_grsec-mute-warnings.patch) | 0 | ||||
| -rw-r--r-- | 3.8.12/4440_grsec-remove-protected-paths.patch (renamed from 3.8.11/4440_grsec-remove-protected-paths.patch) | 0 | ||||
| -rw-r--r-- | 3.8.12/4450_grsec-kconfig-default-gids.patch (renamed from 3.8.11/4450_grsec-kconfig-default-gids.patch) | 0 | ||||
| -rw-r--r-- | 3.8.12/4465_selinux-avc_audit-log-curr_ip.patch (renamed from 3.8.11/4465_selinux-avc_audit-log-curr_ip.patch) | 0 | ||||
| -rw-r--r-- | 3.8.12/4470_disable-compat_vdso.patch (renamed from 3.8.11/4470_disable-compat_vdso.patch) | 0 |
15 files changed, 3547 insertions, 173 deletions
diff --git a/2.6.32/0000_README b/2.6.32/0000_README index 3b25af8..ec404fe 100644 --- a/2.6.32/0000_README +++ b/2.6.32/0000_README @@ -34,7 +34,7 @@ Patch: 1059_linux-2.6.32.60.patch From: http://www.kernel.org Desc: Linux 2.6.32.59 -Patch: 4420_grsecurity-2.9.1-2.6.32.60-201304292054.patch +Patch: 4420_grsecurity-2.9.1-2.6.32.60-201305082213.patch From: http://www.grsecurity.net Desc: hardened-sources base patch from upstream grsecurity diff --git a/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201304292054.patch b/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201305082213.patch index 31c0020..08033a1 100644 --- a/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201304292054.patch +++ b/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201305082213.patch @@ -85406,10 +85406,10 @@ index e89734e..5e84d8d 100644 return 0; diff --git a/grsecurity/Kconfig b/grsecurity/Kconfig new file mode 100644 -index 0000000..23e4fc1 +index 0000000..9351296 --- /dev/null +++ b/grsecurity/Kconfig -@@ -0,0 +1,1003 @@ +@@ -0,0 +1,1013 @@ +# +# grecurity configuration +# @@ -85956,6 +85956,16 @@ index 0000000..23e4fc1 + tasks. If the sysctl option is enabled, a sysctl option with + name "chroot_caps" is created. + ++config GRKERNSEC_CHROOT_INITRD ++ bool "Exempt initrd tasks from restrictions" ++ default y if GRKERNSEC_CONFIG_AUTO ++ depends on GRKERNSEC_CHROOT && BLK_DEV_RAM ++ help ++ If you say Y here, tasks started prior to init will be exempted from ++ grsecurity's chroot restrictions. This option is mainly meant to ++ resolve Plymouth's performing privileged operations unnecessarily ++ in a chroot. ++ +endmenu +menu "Kernel Auditing" +depends on GRKERNSEC @@ -92363,10 +92373,10 @@ index 0000000..bc0be01 +} diff --git a/grsecurity/grsec_chroot.c b/grsecurity/grsec_chroot.c new file mode 100644 -index 0000000..80a3a4b +index 0000000..bc7b363 --- /dev/null +++ b/grsecurity/grsec_chroot.c -@@ -0,0 +1,375 @@ +@@ -0,0 +1,388 @@ +#include <linux/kernel.h> +#include <linux/module.h> +#include <linux/sched.h> @@ -92378,14 +92388,27 @@ index 0000000..80a3a4b +#include <linux/grsecurity.h> +#include <linux/grinternal.h> + ++#ifdef CONFIG_GRKERNSEC_CHROOT_INITRD ++static int gr_init_ran; ++#endif ++ +void gr_set_chroot_entries(struct task_struct *task, struct path *path) +{ +#ifdef CONFIG_GRKERNSEC + if (task->pid > 1 && path->dentry != init_task.fs->root.dentry && -+ path->dentry != task->nsproxy->mnt_ns->root->mnt_root) ++ path->dentry != task->nsproxy->mnt_ns->root->mnt_root ++#ifdef CONFIG_GRKERNSEC_CHROOT_INITRD ++ && gr_init_ran ++#endif ++ ) + task->gr_is_chrooted = 1; -+ else ++ else { ++#ifdef CONFIG_GRKERNSEC_CHROOT_INITRD ++ if (task->pid == 1 && !gr_init_ran) ++ gr_init_ran = 1; ++#endif + task->gr_is_chrooted = 0; ++ } + + task->gr_chroot_dentry = path->dentry; +#endif @@ -107819,7 +107842,7 @@ index 04a0252..4ee2bbb 100644 struct tasklet_struct *list; diff --git a/kernel/sys.c b/kernel/sys.c -index e9512b1..b436660 100644 +index e9512b1..b6c0a2e 100644 --- a/kernel/sys.c +++ b/kernel/sys.c @@ -133,6 +133,12 @@ static int set_one_prio(struct task_struct *p, int niceval, int error) @@ -107981,7 +108004,22 @@ index e9512b1..b436660 100644 if (gid != old_fsgid) { new->fsgid = gid; goto change_okay; -@@ -1282,7 +1323,7 @@ SYSCALL_DEFINE2(setrlimit, unsigned int, resource, struct rlimit __user *, rlim) +@@ -1273,6 +1314,14 @@ SYSCALL_DEFINE2(setrlimit, unsigned int, resource, struct rlimit __user *, rlim) + if (resource != RLIMIT_CPU) + goto out; + ++ /* Handle the case where a fork and setuid occur and then RLIMIT_NPROC ++ is changed to a lower value. Since tasks can be created by the same ++ user in between this limit change and an execve by this task, force ++ a recheck only for this task by setting PF_NPROC_EXCEEDED ++ */ ++ if (resource == RLIMIT_NPROC) ++ current->flags |= PF_NPROC_EXCEEDED; ++ + /* + * RLIMIT_CPU handling. Note that the kernel fails to return an error + * code if it rejected the user's attempt to set RLIMIT_CPU. This is a +@@ -1282,7 +1331,7 @@ SYSCALL_DEFINE2(setrlimit, unsigned int, resource, struct rlimit __user *, rlim) if (new_rlim.rlim_cur == RLIM_INFINITY) goto out; @@ -107990,7 +108028,7 @@ index e9512b1..b436660 100644 out: return 0; } -@@ -1454,7 +1495,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3, +@@ -1454,7 +1503,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3, error = get_dumpable(me->mm); break; case PR_SET_DUMPABLE: diff --git a/3.2.44/0000_README b/3.2.44/0000_README index 1b7cbd6..cc13ddf 100644 --- a/3.2.44/0000_README +++ b/3.2.44/0000_README @@ -94,7 +94,7 @@ Patch: 1043_linux-3.2.44.patch From: http://www.kernel.org Desc: Linux 3.2.44 -Patch: 4420_grsecurity-2.9.1-3.2.44-201304292055.patch +Patch: 4420_grsecurity-2.9.1-3.2.44-201305082214.patch From: http://www.grsecurity.net Desc: hardened-sources base patch from upstream grsecurity diff --git a/3.2.44/4420_grsecurity-2.9.1-3.2.44-201304292055.patch b/3.2.44/4420_grsecurity-2.9.1-3.2.44-201305082214.patch index 258f868..b2ac53e 100644 --- a/3.2.44/4420_grsecurity-2.9.1-3.2.44-201304292055.patch +++ b/3.2.44/4420_grsecurity-2.9.1-3.2.44-201305082214.patch @@ -5713,7 +5713,7 @@ index ef9e555..331bd29 100644 #define __read_mostly __attribute__((__section__(".data..read_mostly"))) diff --git a/arch/sh/kernel/cpu/sh4a/smp-shx3.c b/arch/sh/kernel/cpu/sh4a/smp-shx3.c -index 03f2b55..b027032 100644 +index 03f2b55..b0270327 100644 --- a/arch/sh/kernel/cpu/sh4a/smp-shx3.c +++ b/arch/sh/kernel/cpu/sh4a/smp-shx3.c @@ -143,7 +143,7 @@ shx3_cpu_callback(struct notifier_block *nfb, unsigned long action, void *hcpu) @@ -56585,10 +56585,10 @@ index 8a89949..6776861 100644 xfs_init_zones(void) diff --git a/grsecurity/Kconfig b/grsecurity/Kconfig new file mode 100644 -index 0000000..52786fd +index 0000000..aef8e91 --- /dev/null +++ b/grsecurity/Kconfig -@@ -0,0 +1,1021 @@ +@@ -0,0 +1,1031 @@ +# +# grecurity configuration +# @@ -57153,6 +57153,16 @@ index 0000000..52786fd + tasks. If the sysctl option is enabled, a sysctl option with + name "chroot_caps" is created. + ++config GRKERNSEC_CHROOT_INITRD ++ bool "Exempt initrd tasks from restrictions" ++ default y if GRKERNSEC_CONFIG_AUTO ++ depends on GRKERNSEC_CHROOT && BLK_DEV_RAM ++ help ++ If you say Y here, tasks started prior to init will be exempted from ++ grsecurity's chroot restrictions. This option is mainly meant to ++ resolve Plymouth's performing privileged operations unnecessarily ++ in a chroot. ++ +endmenu +menu "Kernel Auditing" +depends on GRKERNSEC @@ -63589,10 +63599,10 @@ index 0000000..bc0be01 +} diff --git a/grsecurity/grsec_chroot.c b/grsecurity/grsec_chroot.c new file mode 100644 -index 0000000..9ab3ba3 +index 0000000..8124c0d --- /dev/null +++ b/grsecurity/grsec_chroot.c -@@ -0,0 +1,340 @@ +@@ -0,0 +1,353 @@ +#include <linux/kernel.h> +#include <linux/module.h> +#include <linux/sched.h> @@ -63604,14 +63614,27 @@ index 0000000..9ab3ba3 +#include <linux/grsecurity.h> +#include <linux/grinternal.h> + ++#ifdef CONFIG_GRKERNSEC_CHROOT_INITRD ++static int gr_init_ran; ++#endif ++ +void gr_set_chroot_entries(struct task_struct *task, struct path *path) +{ +#ifdef CONFIG_GRKERNSEC + if (task->pid > 1 && path->dentry != init_task.fs->root.dentry && -+ path->dentry != task->nsproxy->mnt_ns->root->mnt_root) ++ path->dentry != task->nsproxy->mnt_ns->root->mnt_root ++#ifdef CONFIG_GRKERNSEC_CHROOT_INITRD ++ && gr_init_ran ++#endif ++ ) + task->gr_is_chrooted = 1; -+ else ++ else { ++#ifdef CONFIG_GRKERNSEC_CHROOT_INITRD ++ if (task->pid == 1 && !gr_init_ran) ++ gr_init_ran = 1; ++#endif + task->gr_is_chrooted = 0; ++ } + + task->gr_chroot_dentry = path->dentry; +#endif @@ -72956,6 +72979,18 @@ index a15432da..9459dcc 100644 /* Structure to track chunk fragments that have been acked, but peer +diff --git a/include/net/secure_seq.h b/include/net/secure_seq.h +index c2e542b..6ca975b 100644 +--- a/include/net/secure_seq.h ++++ b/include/net/secure_seq.h +@@ -3,6 +3,7 @@ + + #include <linux/types.h> + ++extern void net_secret_init(void); + extern __u32 secure_ip_id(__be32 daddr); + extern __u32 secure_ipv6_id(const __be32 daddr[4]); + extern u32 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport); diff --git a/include/net/sock.h b/include/net/sock.h index ddf523c..1f06685 100644 --- a/include/net/sock.h @@ -78156,7 +78191,7 @@ index 2f194e9..2c05ea9 100644 .priority = 10, }; diff --git a/kernel/sys.c b/kernel/sys.c -index be5fa8b..3f10c33 100644 +index be5fa8b..bb69d33 100644 --- a/kernel/sys.c +++ b/kernel/sys.c @@ -158,6 +158,12 @@ static int set_one_prio(struct task_struct *p, int niceval, int error) @@ -78304,7 +78339,21 @@ index be5fa8b..3f10c33 100644 __OLD_UTS_LEN); error |= __put_user(0, name->machine + __OLD_UTS_LEN); up_read(&uts_sem); -@@ -1724,7 +1760,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3, +@@ -1461,6 +1497,13 @@ int do_prlimit(struct task_struct *tsk, unsigned int resource, + */ + new_rlim->rlim_cur = 1; + } ++ /* Handle the case where a fork and setuid occur and then RLIMIT_NPROC ++ is changed to a lower value. Since tasks can be created by the same ++ user in between this limit change and an execve by this task, force ++ a recheck only for this task by setting PF_NPROC_EXCEEDED ++ */ ++ if (resource == RLIMIT_NPROC) ++ tsk->flags |= PF_NPROC_EXCEEDED; + } + if (!retval) { + if (old_rlim) +@@ -1724,7 +1767,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3, error = get_dumpable(me->mm); break; case PR_SET_DUMPABLE: @@ -83536,7 +83585,7 @@ index ea3f83b..001a216 100644 .next = NULL, }; diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index 5c028e2..83e69ea 100644 +index 5c028e2..a3e026d 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -57,6 +57,7 @@ @@ -83631,20 +83680,6 @@ index 5c028e2..83e69ea 100644 if (order && (gfp_flags & __GFP_COMP)) prep_compound_page(page, order); -@@ -3395,7 +3434,13 @@ static int pageblock_is_reserved(unsigned long start_pfn, unsigned long end_pfn) - unsigned long pfn; - - for (pfn = start_pfn; pfn < end_pfn; pfn++) { -+#ifdef CONFIG_X86_32 -+ /* boot failures in VMware 8 on 32bit vanilla since -+ this change */ -+ if (!pfn_valid(pfn) || PageReserved(pfn_to_page(pfn))) -+#else - if (!pfn_valid_within(pfn) || PageReserved(pfn_to_page(pfn))) -+#endif - return 1; - } - return 0; diff --git a/mm/percpu.c b/mm/percpu.c index 5c29750..99f6386 100644 --- a/mm/percpu.c @@ -86450,6 +86485,24 @@ index ff52ad0..aff1c0f 100644 i++, cmfptr++) { int new_fd; +diff --git a/net/core/secure_seq.c b/net/core/secure_seq.c +index 925991a..209a505 100644 +--- a/net/core/secure_seq.c ++++ b/net/core/secure_seq.c +@@ -12,12 +12,10 @@ + + static u32 net_secret[MD5_MESSAGE_BYTES / 4] ____cacheline_aligned; + +-static int __init net_secret_init(void) ++void net_secret_init(void) + { + get_random_bytes(net_secret, sizeof(net_secret)); +- return 0; + } +-late_initcall(net_secret_init); + + #ifdef CONFIG_INET + static u32 seq_scale(u32 seq) diff --git a/net/core/sock.c b/net/core/sock.c index 2c73adf..d7698ef 100644 --- a/net/core/sock.c @@ -86688,10 +86741,30 @@ index 39a2d29..f39c0fe 100644 Econet is a fairly old and slow networking protocol mainly used by Acorn computers to access file and print servers. It uses native diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c -index 5d228de..27dfa3c 100644 +index 5d228de..91bdee5 100644 --- a/net/ipv4/af_inet.c +++ b/net/ipv4/af_inet.c -@@ -1612,7 +1612,7 @@ static __net_exit void ipv4_mib_exit_net(struct net *net) +@@ -114,6 +114,7 @@ + #include <net/inet_common.h> + #include <net/xfrm.h> + #include <net/net_namespace.h> ++#include <net/secure_seq.h> + #ifdef CONFIG_IP_MROUTE + #include <linux/mroute.h> + #endif +@@ -241,8 +242,10 @@ void build_ehash_secret(void) + get_random_bytes(&rnd, sizeof(rnd)); + } while (rnd == 0); + +- if (cmpxchg(&inet_ehash_secret, 0, rnd) == 0) ++ if (cmpxchg(&inet_ehash_secret, 0, rnd) == 0) { + get_random_bytes(&ipv6_hash_secret, sizeof(ipv6_hash_secret)); ++ net_secret_init(); ++ } + } + EXPORT_SYMBOL(build_ehash_secret); + +@@ -1612,7 +1615,7 @@ static __net_exit void ipv4_mib_exit_net(struct net *net) snmp_mib_free((void __percpu **)net->mib.tcp_statistics); } @@ -86700,7 +86773,7 @@ index 5d228de..27dfa3c 100644 .init = ipv4_mib_init_net, .exit = ipv4_mib_exit_net, }; -@@ -1646,13 +1646,9 @@ static int __init inet_init(void) +@@ -1646,13 +1649,9 @@ static int __init inet_init(void) BUILD_BUG_ON(sizeof(struct inet_skb_parm) > sizeof(dummy_skb->cb)); @@ -86715,7 +86788,7 @@ index 5d228de..27dfa3c 100644 rc = proto_register(&udp_prot, 1); if (rc) -@@ -1759,8 +1755,6 @@ out_unregister_udp_proto: +@@ -1759,8 +1758,6 @@ out_unregister_udp_proto: proto_unregister(&udp_prot); out_unregister_tcp_proto: proto_unregister(&tcp_prot); @@ -89533,18 +89606,9 @@ index 835fcea..d9fb2db 100644 return 0; } diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c -index d65f699..05aa6ce 100644 +index d65f699..855d175 100644 --- a/net/phonet/af_phonet.c +++ b/net/phonet/af_phonet.c -@@ -41,7 +41,7 @@ static struct phonet_protocol *phonet_proto_get(unsigned int protocol) - { - struct phonet_protocol *pp; - -- if (protocol >= PHONET_NPROTO) -+ if (protocol < 0 || protocol >= PHONET_NPROTO) - return NULL; - - rcu_read_lock(); @@ -469,7 +469,7 @@ int __init_or_module phonet_proto_register(unsigned int protocol, { int err = 0; @@ -90110,6 +90174,19 @@ index 8104278..300d89d 100644 } /* Initialize IPv6 support and register with socket layer. */ +diff --git a/net/sctp/probe.c b/net/sctp/probe.c +index bc6cd75..749e4eb 100644 +--- a/net/sctp/probe.c ++++ b/net/sctp/probe.c +@@ -63,7 +63,7 @@ static struct { + struct timespec tstart; + } sctpw; + +-static void printl(const char *fmt, ...) ++static __printf(1, 2) void printl(const char *fmt, ...) + { + va_list args; + int len; diff --git a/net/sctp/proc.c b/net/sctp/proc.c index 1e2eee8..ce3967e 100644 --- a/net/sctp/proc.c diff --git a/3.8.11/0000_README b/3.8.12/0000_README index 40dc014..00ed718 100644 --- a/3.8.11/0000_README +++ b/3.8.12/0000_README @@ -6,7 +6,11 @@ Patch: 1010_linux-3.8.11.patch From: http://www.kernel.org Desc: Linux 3.8.11 -Patch: 4420_grsecurity-2.9.1-3.8.11-201305011917.patch +Patch: 1011_linux-3.8.12.patch +From: http://www.kernel.org +Desc: Linux 3.8.12 + +Patch: 4420_grsecurity-2.9.1-3.8.12-201305082215.patch From: http://www.grsecurity.net Desc: hardened-sources base patch from upstream grsecurity diff --git a/3.8.11/1010_linux-3.8.11.patch b/3.8.12/1010_linux-3.8.11.patch index 244c734..244c734 100644 --- a/3.8.11/1010_linux-3.8.11.patch +++ b/3.8.12/1010_linux-3.8.11.patch diff --git a/3.8.12/1011_linux-3.8.12.patch b/3.8.12/1011_linux-3.8.12.patch new file mode 100644 index 0000000..4fb38f8 --- /dev/null +++ b/3.8.12/1011_linux-3.8.12.patch @@ -0,0 +1,3136 @@ +diff --git a/Makefile b/Makefile +index 7e4eee5..902974f 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 8 +-SUBLEVEL = 11 ++SUBLEVEL = 12 + EXTRAVERSION = + NAME = Displaced Humerus Anterior + +diff --git a/arch/arm/boot/dts/at91sam9260.dtsi b/arch/arm/boot/dts/at91sam9260.dtsi +index cb7bcc5..02b70a4 100644 +--- a/arch/arm/boot/dts/at91sam9260.dtsi ++++ b/arch/arm/boot/dts/at91sam9260.dtsi +@@ -158,8 +158,8 @@ + usart1 { + pinctrl_usart1: usart1-0 { + atmel,pins = +- <2 6 0x1 0x1 /* PB6 periph A with pullup */ +- 2 7 0x1 0x0>; /* PB7 periph A */ ++ <1 6 0x1 0x1 /* PB6 periph A with pullup */ ++ 1 7 0x1 0x0>; /* PB7 periph A */ + }; + + pinctrl_usart1_rts: usart1_rts-0 { +@@ -194,18 +194,18 @@ + usart3 { + pinctrl_usart3: usart3-0 { + atmel,pins = +- <2 10 0x1 0x1 /* PB10 periph A with pullup */ +- 2 11 0x1 0x0>; /* PB11 periph A */ ++ <1 10 0x1 0x1 /* PB10 periph A with pullup */ ++ 1 11 0x1 0x0>; /* PB11 periph A */ + }; + + pinctrl_usart3_rts: usart3_rts-0 { + atmel,pins = +- <3 8 0x2 0x0>; /* PB8 periph B */ ++ <2 8 0x2 0x0>; /* PC8 periph B */ + }; + + pinctrl_usart3_cts: usart3_cts-0 { + atmel,pins = +- <3 10 0x2 0x0>; /* PB10 periph B */ ++ <2 10 0x2 0x0>; /* PC10 periph B */ + }; + }; + +@@ -220,8 +220,8 @@ + uart1 { + pinctrl_uart1: uart1-0 { + atmel,pins = +- <2 12 0x1 0x1 /* PB12 periph A with pullup */ +- 2 13 0x1 0x0>; /* PB13 periph A */ ++ <1 12 0x1 0x1 /* PB12 periph A with pullup */ ++ 1 13 0x1 0x0>; /* PB13 periph A */ + }; + }; + +diff --git a/arch/arm/boot/dts/at91sam9g15.dtsi b/arch/arm/boot/dts/at91sam9g15.dtsi +index fbe7a70..28467fd 100644 +--- a/arch/arm/boot/dts/at91sam9g15.dtsi ++++ b/arch/arm/boot/dts/at91sam9g15.dtsi +@@ -10,7 +10,7 @@ + + / { + model = "Atmel AT91SAM9G15 SoC"; +- compatible = "atmel, at91sam9g15, atmel,at91sam9x5"; ++ compatible = "atmel,at91sam9g15", "atmel,at91sam9x5"; + + ahb { + apb { +diff --git a/arch/arm/boot/dts/at91sam9g15ek.dts b/arch/arm/boot/dts/at91sam9g15ek.dts +index 86dd3f6..5427b2d 100644 +--- a/arch/arm/boot/dts/at91sam9g15ek.dts ++++ b/arch/arm/boot/dts/at91sam9g15ek.dts +@@ -11,6 +11,6 @@ + /include/ "at91sam9x5ek.dtsi" + + / { +- model = "Atmel AT91SAM9G25-EK"; ++ model = "Atmel AT91SAM9G15-EK"; + compatible = "atmel,at91sam9g15ek", "atmel,at91sam9x5ek", "atmel,at91sam9x5", "atmel,at91sam9"; + }; +diff --git a/arch/arm/boot/dts/at91sam9g25.dtsi b/arch/arm/boot/dts/at91sam9g25.dtsi +index 05a718f..5fd32df 100644 +--- a/arch/arm/boot/dts/at91sam9g25.dtsi ++++ b/arch/arm/boot/dts/at91sam9g25.dtsi +@@ -10,7 +10,7 @@ + + / { + model = "Atmel AT91SAM9G25 SoC"; +- compatible = "atmel, at91sam9g25, atmel,at91sam9x5"; ++ compatible = "atmel,at91sam9g25", "atmel,at91sam9x5"; + + ahb { + apb { +diff --git a/arch/arm/boot/dts/at91sam9g35.dtsi b/arch/arm/boot/dts/at91sam9g35.dtsi +index f9d14a7..d6fa8af 100644 +--- a/arch/arm/boot/dts/at91sam9g35.dtsi ++++ b/arch/arm/boot/dts/at91sam9g35.dtsi +@@ -10,7 +10,7 @@ + + / { + model = "Atmel AT91SAM9G35 SoC"; +- compatible = "atmel, at91sam9g35, atmel,at91sam9x5"; ++ compatible = "atmel,at91sam9g35", "atmel,at91sam9x5"; + + ahb { + apb { +diff --git a/arch/arm/boot/dts/at91sam9x25.dtsi b/arch/arm/boot/dts/at91sam9x25.dtsi +index 54eb33b..9ac2bc2 100644 +--- a/arch/arm/boot/dts/at91sam9x25.dtsi ++++ b/arch/arm/boot/dts/at91sam9x25.dtsi +@@ -10,7 +10,7 @@ + + / { + model = "Atmel AT91SAM9X25 SoC"; +- compatible = "atmel, at91sam9x25, atmel,at91sam9x5"; ++ compatible = "atmel,at91sam9x25", "atmel,at91sam9x5"; + + ahb { + apb { +diff --git a/arch/arm/boot/dts/at91sam9x35.dtsi b/arch/arm/boot/dts/at91sam9x35.dtsi +index fb102d6..ba67d83 100644 +--- a/arch/arm/boot/dts/at91sam9x35.dtsi ++++ b/arch/arm/boot/dts/at91sam9x35.dtsi +@@ -10,7 +10,7 @@ + + / { + model = "Atmel AT91SAM9X35 SoC"; +- compatible = "atmel, at91sam9x35, atmel,at91sam9x5"; ++ compatible = "atmel,at91sam9x35", "atmel,at91sam9x5"; + + ahb { + apb { +diff --git a/arch/arm/boot/dts/at91sam9x5ek.dtsi b/arch/arm/boot/dts/at91sam9x5ek.dtsi +index 8a7cf1d..ccab256 100644 +--- a/arch/arm/boot/dts/at91sam9x5ek.dtsi ++++ b/arch/arm/boot/dts/at91sam9x5ek.dtsi +@@ -13,7 +13,7 @@ + compatible = "atmel,at91sam9x5ek", "atmel,at91sam9x5", "atmel,at91sam9"; + + chosen { +- bootargs = "128M console=ttyS0,115200 root=/dev/mtdblock1 rw rootfstype=ubifs ubi.mtd=1 root=ubi0:rootfs"; ++ bootargs = "console=ttyS0,115200 root=/dev/mtdblock1 rw rootfstype=ubifs ubi.mtd=1 root=ubi0:rootfs"; + }; + + ahb { +diff --git a/arch/arm/configs/at91sam9g45_defconfig b/arch/arm/configs/at91sam9g45_defconfig +index 606d48f..8aab786 100644 +--- a/arch/arm/configs/at91sam9g45_defconfig ++++ b/arch/arm/configs/at91sam9g45_defconfig +@@ -173,7 +173,6 @@ CONFIG_MMC=y + # CONFIG_MMC_BLOCK_BOUNCE is not set + CONFIG_SDIO_UART=m + CONFIG_MMC_ATMELMCI=y +-CONFIG_MMC_ATMELMCI_DMA=y + CONFIG_LEDS_ATMEL_PWM=y + CONFIG_LEDS_GPIO=y + CONFIG_LEDS_TRIGGER_TIMER=y +diff --git a/arch/arm/include/asm/pgtable.h b/arch/arm/include/asm/pgtable.h +index c094749..26e9ce4 100644 +--- a/arch/arm/include/asm/pgtable.h ++++ b/arch/arm/include/asm/pgtable.h +@@ -61,6 +61,15 @@ extern void __pgd_error(const char *file, int line, pgd_t); + #define FIRST_USER_ADDRESS PAGE_SIZE + + /* ++ * Use TASK_SIZE as the ceiling argument for free_pgtables() and ++ * free_pgd_range() to avoid freeing the modules pmd when LPAE is enabled (pmd ++ * page shared between user and kernel). ++ */ ++#ifdef CONFIG_ARM_LPAE ++#define USER_PGTABLES_CEILING TASK_SIZE ++#endif ++ ++/* + * The pgprot_* and protection_map entries will be fixed up in runtime + * to include the cachable and bufferable bits based on memory policy, + * as well as any architecture dependent bits like global/ASID and SMP +diff --git a/arch/arm/mach-at91/setup.c b/arch/arm/mach-at91/setup.c +index 4b67847..6b4608d 100644 +--- a/arch/arm/mach-at91/setup.c ++++ b/arch/arm/mach-at91/setup.c +@@ -333,7 +333,7 @@ static void at91_dt_rstc(void) + + of_id = of_match_node(rstc_ids, np); + if (!of_id) +- panic("AT91: rtsc no restart function availlable\n"); ++ panic("AT91: rtsc no restart function available\n"); + + arm_pm_restart = of_id->data; + +diff --git a/arch/arm/mach-omap2/cpuidle34xx.c b/arch/arm/mach-omap2/cpuidle34xx.c +index 22590db..aa20002 100644 +--- a/arch/arm/mach-omap2/cpuidle34xx.c ++++ b/arch/arm/mach-omap2/cpuidle34xx.c +@@ -265,8 +265,9 @@ static int omap3_enter_idle_bm(struct cpuidle_device *dev, + static DEFINE_PER_CPU(struct cpuidle_device, omap3_idle_dev); + + static struct cpuidle_driver omap3_idle_driver = { +- .name = "omap3_idle", +- .owner = THIS_MODULE, ++ .name = "omap3_idle", ++ .owner = THIS_MODULE, ++ .en_core_tk_irqen = 1, + .states = { + { + .enter = omap3_enter_idle_bm, +diff --git a/arch/arm/mach-u300/include/mach/u300-regs.h b/arch/arm/mach-u300/include/mach/u300-regs.h +index 1e49d90..0320495 100644 +--- a/arch/arm/mach-u300/include/mach/u300-regs.h ++++ b/arch/arm/mach-u300/include/mach/u300-regs.h +@@ -95,7 +95,7 @@ + #define U300_SPI_BASE (U300_FAST_PER_PHYS_BASE+0x6000) + + /* Fast UART1 on U335 only */ +-#define U300_UART1_BASE (U300_SLOW_PER_PHYS_BASE+0x7000) ++#define U300_UART1_BASE (U300_FAST_PER_PHYS_BASE+0x7000) + + /* + * SLOW peripherals +diff --git a/arch/avr32/configs/favr-32_defconfig b/arch/avr32/configs/favr-32_defconfig +index 0421498..9791820 100644 +--- a/arch/avr32/configs/favr-32_defconfig ++++ b/arch/avr32/configs/favr-32_defconfig +@@ -122,7 +122,6 @@ CONFIG_USB_G_SERIAL=m + CONFIG_USB_CDC_COMPOSITE=m + CONFIG_MMC=y + CONFIG_MMC_ATMELMCI=y +-CONFIG_MMC_ATMELMCI_DMA=y + CONFIG_NEW_LEDS=y + CONFIG_LEDS_CLASS=y + CONFIG_LEDS_ATMEL_PWM=m +diff --git a/arch/avr32/configs/merisc_defconfig b/arch/avr32/configs/merisc_defconfig +index 3befab9..65de443 100644 +--- a/arch/avr32/configs/merisc_defconfig ++++ b/arch/avr32/configs/merisc_defconfig +@@ -102,7 +102,6 @@ CONFIG_FRAMEBUFFER_CONSOLE=y + CONFIG_LOGO=y + CONFIG_MMC=y + CONFIG_MMC_ATMELMCI=y +-CONFIG_MMC_ATMELMCI_DMA=y + CONFIG_NEW_LEDS=y + CONFIG_LEDS_CLASS=y + CONFIG_LEDS_ATMEL_PWM=y +diff --git a/arch/ia64/include/asm/futex.h b/arch/ia64/include/asm/futex.h +index d2bf1fd..76acbcd 100644 +--- a/arch/ia64/include/asm/futex.h ++++ b/arch/ia64/include/asm/futex.h +@@ -106,16 +106,15 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, + return -EFAULT; + + { +- register unsigned long r8 __asm ("r8"); ++ register unsigned long r8 __asm ("r8") = 0; + unsigned long prev; + __asm__ __volatile__( + " mf;; \n" +- " mov %0=r0 \n" + " mov ar.ccv=%4;; \n" + "[1:] cmpxchg4.acq %1=[%2],%3,ar.ccv \n" + " .xdata4 \"__ex_table\", 1b-., 2f-. \n" + "[2:]" +- : "=r" (r8), "=r" (prev) ++ : "+r" (r8), "=&r" (prev) + : "r" (uaddr), "r" (newval), + "rO" ((long) (unsigned) oldval) + : "memory"); +diff --git a/arch/ia64/include/asm/mca.h b/arch/ia64/include/asm/mca.h +index 43f96ab..8c70961 100644 +--- a/arch/ia64/include/asm/mca.h ++++ b/arch/ia64/include/asm/mca.h +@@ -143,6 +143,7 @@ extern unsigned long __per_cpu_mca[NR_CPUS]; + extern int cpe_vector; + extern int ia64_cpe_irq; + extern void ia64_mca_init(void); ++extern void ia64_mca_irq_init(void); + extern void ia64_mca_cpu_init(void *); + extern void ia64_os_mca_dispatch(void); + extern void ia64_os_mca_dispatch_end(void); +diff --git a/arch/ia64/kernel/irq.c b/arch/ia64/kernel/irq.c +index ad69606..f2c41828 100644 +--- a/arch/ia64/kernel/irq.c ++++ b/arch/ia64/kernel/irq.c +@@ -23,6 +23,8 @@ + #include <linux/interrupt.h> + #include <linux/kernel_stat.h> + ++#include <asm/mca.h> ++ + /* + * 'what should we do if we get a hw irq event on an illegal vector'. + * each architecture has to answer this themselves. +@@ -83,6 +85,12 @@ bool is_affinity_mask_valid(const struct cpumask *cpumask) + + #endif /* CONFIG_SMP */ + ++int __init arch_early_irq_init(void) ++{ ++ ia64_mca_irq_init(); ++ return 0; ++} ++ + #ifdef CONFIG_HOTPLUG_CPU + unsigned int vectors_in_migration[NR_IRQS]; + +diff --git a/arch/ia64/kernel/mca.c b/arch/ia64/kernel/mca.c +index 65bf9cd..d7396db 100644 +--- a/arch/ia64/kernel/mca.c ++++ b/arch/ia64/kernel/mca.c +@@ -2074,22 +2074,16 @@ ia64_mca_init(void) + printk(KERN_INFO "MCA related initialization done\n"); + } + ++ + /* +- * ia64_mca_late_init +- * +- * Opportunity to setup things that require initialization later +- * than ia64_mca_init. Setup a timer to poll for CPEs if the +- * platform doesn't support an interrupt driven mechanism. +- * +- * Inputs : None +- * Outputs : Status ++ * These pieces cannot be done in ia64_mca_init() because it is called before ++ * early_irq_init() which would wipe out our percpu irq registrations. But we ++ * cannot leave them until ia64_mca_late_init() because by then all the other ++ * processors have been brought online and have set their own CMC vectors to ++ * point at a non-existant action. Called from arch_early_irq_init(). + */ +-static int __init +-ia64_mca_late_init(void) ++void __init ia64_mca_irq_init(void) + { +- if (!mca_init) +- return 0; +- + /* + * Configure the CMCI/P vector and handler. Interrupts for CMC are + * per-processor, so AP CMC interrupts are setup in smp_callin() (smpboot.c). +@@ -2108,6 +2102,23 @@ ia64_mca_late_init(void) + /* Setup the CPEI/P handler */ + register_percpu_irq(IA64_CPEP_VECTOR, &mca_cpep_irqaction); + #endif ++} ++ ++/* ++ * ia64_mca_late_init ++ * ++ * Opportunity to setup things that require initialization later ++ * than ia64_mca_init. Setup a timer to poll for CPEs if the ++ * platform doesn't support an interrupt driven mechanism. ++ * ++ * Inputs : None ++ * Outputs : Status ++ */ ++static int __init ++ia64_mca_late_init(void) ++{ ++ if (!mca_init) ++ return 0; + + register_hotcpu_notifier(&mca_cpu_notifier); + +diff --git a/arch/ia64/kvm/vtlb.c b/arch/ia64/kvm/vtlb.c +index 4332f7e..a7869f8 100644 +--- a/arch/ia64/kvm/vtlb.c ++++ b/arch/ia64/kvm/vtlb.c +@@ -256,7 +256,7 @@ u64 guest_vhpt_lookup(u64 iha, u64 *pte) + "srlz.d;;" + "ssm psr.i;;" + "srlz.d;;" +- : "=r"(ret) : "r"(iha), "r"(pte):"memory"); ++ : "=&r"(ret) : "r"(iha), "r"(pte) : "memory"); + + return ret; + } +diff --git a/arch/powerpc/kernel/cpu_setup_power.S b/arch/powerpc/kernel/cpu_setup_power.S +index 57cf140..0c0fc7b 100644 +--- a/arch/powerpc/kernel/cpu_setup_power.S ++++ b/arch/powerpc/kernel/cpu_setup_power.S +@@ -64,6 +64,7 @@ _GLOBAL(__restore_cpu_power8) + mflr r11 + mfmsr r3 + rldicl. r0,r3,4,63 ++ mtlr r11 + beqlr + li r0,0 + mtspr SPRN_LPID,r0 +diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S +index 3684cbd..bb11075 100644 +--- a/arch/powerpc/kernel/exceptions-64s.S ++++ b/arch/powerpc/kernel/exceptions-64s.S +@@ -740,7 +740,7 @@ hardware_interrupt_relon_hv: + _MASKABLE_RELON_EXCEPTION_PSERIES(0x502, hardware_interrupt, EXC_HV, SOFTEN_TEST_HV) + FTR_SECTION_ELSE + _MASKABLE_RELON_EXCEPTION_PSERIES(0x500, hardware_interrupt, EXC_STD, SOFTEN_TEST_PR) +- ALT_FTR_SECTION_END_IFSET(CPU_FTR_ARCH_206) ++ ALT_FTR_SECTION_END_IFSET(CPU_FTR_HVMODE) + STD_RELON_EXCEPTION_PSERIES(0x4600, 0x600, alignment) + STD_RELON_EXCEPTION_PSERIES(0x4700, 0x700, program_check) + STD_RELON_EXCEPTION_PSERIES(0x4800, 0x800, fp_unavailable) +diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S +index 116f086..1a63feb 100644 +--- a/arch/powerpc/kernel/head_64.S ++++ b/arch/powerpc/kernel/head_64.S +@@ -490,6 +490,7 @@ _GLOBAL(copy_and_flush) + sync + addi r5,r5,8 + addi r6,r6,8 ++ isync + blr + + .align 8 +diff --git a/arch/powerpc/platforms/cell/spufs/inode.c b/arch/powerpc/platforms/cell/spufs/inode.c +index dba1ce2..506dc9f 100644 +--- a/arch/powerpc/platforms/cell/spufs/inode.c ++++ b/arch/powerpc/platforms/cell/spufs/inode.c +@@ -99,6 +99,7 @@ spufs_new_inode(struct super_block *sb, umode_t mode) + if (!inode) + goto out; + ++ inode->i_ino = get_next_ino(); + inode->i_mode = mode; + inode->i_uid = current_fsuid(); + inode->i_gid = current_fsgid(); +diff --git a/arch/x86/crypto/crc32c-pcl-intel-asm_64.S b/arch/x86/crypto/crc32c-pcl-intel-asm_64.S +index 93c6d39..b0f7d39 100644 +--- a/arch/x86/crypto/crc32c-pcl-intel-asm_64.S ++++ b/arch/x86/crypto/crc32c-pcl-intel-asm_64.S +@@ -42,6 +42,8 @@ + * SOFTWARE. + */ + ++#include <asm/inst.h> ++ + ## ISCSI CRC 32 Implementation with crc32 and pclmulqdq Instruction + + .macro LABEL prefix n +@@ -224,10 +226,10 @@ LABEL crc_ %i + movdqa (bufp), %xmm0 # 2 consts: K1:K2 + + movq crc_init, %xmm1 # CRC for block 1 +- pclmulqdq $0x00,%xmm0,%xmm1 # Multiply by K2 ++ PCLMULQDQ 0x00,%xmm0,%xmm1 # Multiply by K2 + + movq crc1, %xmm2 # CRC for block 2 +- pclmulqdq $0x10, %xmm0, %xmm2 # Multiply by K1 ++ PCLMULQDQ 0x10, %xmm0, %xmm2 # Multiply by K1 + + pxor %xmm2,%xmm1 + movq %xmm1, %rax +diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c +index e4595f1..84b7789 100644 +--- a/arch/x86/kernel/irq.c ++++ b/arch/x86/kernel/irq.c +@@ -165,10 +165,6 @@ u64 arch_irq_stat_cpu(unsigned int cpu) + u64 arch_irq_stat(void) + { + u64 sum = atomic_read(&irq_err_count); +- +-#ifdef CONFIG_X86_IO_APIC +- sum += atomic_read(&irq_mis_count); +-#endif + return sum; + } + +diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c +index a27e763..d330b3c 100644 +--- a/arch/x86/kvm/emulate.c ++++ b/arch/x86/kvm/emulate.c +@@ -4030,6 +4030,10 @@ static int decode_operand(struct x86_emulate_ctxt *ctxt, struct operand *op, + break; + case OpMem8: + ctxt->memop.bytes = 1; ++ if (ctxt->memop.type == OP_REG) { ++ ctxt->memop.addr.reg = decode_register(ctxt, ctxt->modrm_rm, 1); ++ fetch_register_operand(&ctxt->memop); ++ } + goto mem_common; + case OpMem16: + ctxt->memop.bytes = 2; +diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c +index 2262003..08c6511 100644 +--- a/arch/x86/xen/enlighten.c ++++ b/arch/x86/xen/enlighten.c +@@ -1589,8 +1589,11 @@ static int __cpuinit xen_hvm_cpu_notify(struct notifier_block *self, + switch (action) { + case CPU_UP_PREPARE: + xen_vcpu_setup(cpu); +- if (xen_have_vector_callback) ++ if (xen_have_vector_callback) { + xen_init_lock_cpu(cpu); ++ if (xen_feature(XENFEAT_hvm_safe_pvclock)) ++ xen_setup_timer(cpu); ++ } + break; + default: + break; +diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c +index 34bc4ce..48d7b2c 100644 +--- a/arch/x86/xen/smp.c ++++ b/arch/x86/xen/smp.c +@@ -658,6 +658,8 @@ static void xen_hvm_cpu_die(unsigned int cpu) + unbind_from_irqhandler(per_cpu(xen_debug_irq, cpu), NULL); + unbind_from_irqhandler(per_cpu(xen_callfuncsingle_irq, cpu), NULL); + unbind_from_irqhandler(per_cpu(xen_irq_work, cpu), NULL); ++ xen_uninit_lock_cpu(cpu); ++ xen_teardown_timer(cpu); + native_cpu_die(cpu); + } + +diff --git a/arch/x86/xen/time.c b/arch/x86/xen/time.c +index 0296a95..054cc01 100644 +--- a/arch/x86/xen/time.c ++++ b/arch/x86/xen/time.c +@@ -497,7 +497,11 @@ static void xen_hvm_setup_cpu_clockevents(void) + { + int cpu = smp_processor_id(); + xen_setup_runstate_info(cpu); +- xen_setup_timer(cpu); ++ /* ++ * xen_setup_timer(cpu) - snprintf is bad in atomic context. Hence ++ * doing it xen_hvm_cpu_notify (which gets called by smp_init during ++ * early bootup and also during CPU hotplug events). ++ */ + xen_setup_cpu_clockevents(); + } + +diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c +index bd22f86..2999966 100644 +--- a/drivers/acpi/osl.c ++++ b/drivers/acpi/osl.c +@@ -642,7 +642,7 @@ void __init acpi_initrd_override(void *data, size_t size) + * Both memblock_reserve and e820_add_region (via arch_reserve_mem_area) + * works fine. + */ +- memblock_reserve(acpi_tables_addr, acpi_tables_addr + all_tables_size); ++ memblock_reserve(acpi_tables_addr, all_tables_size); + arch_reserve_mem_area(acpi_tables_addr, all_tables_size); + + p = early_ioremap(acpi_tables_addr, all_tables_size); +diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c +index eb73798..77c9a92 100644 +--- a/drivers/acpi/pci_root.c ++++ b/drivers/acpi/pci_root.c +@@ -240,8 +240,8 @@ static acpi_status acpi_pci_query_osc(struct acpi_pci_root *root, + *control &= OSC_PCI_CONTROL_MASKS; + capbuf[OSC_CONTROL_TYPE] = *control | root->osc_control_set; + } else { +- /* Run _OSC query for all possible controls. */ +- capbuf[OSC_CONTROL_TYPE] = OSC_PCI_CONTROL_MASKS; ++ /* Run _OSC query only with existing controls. */ ++ capbuf[OSC_CONTROL_TYPE] = root->osc_control_set; + } + + status = acpi_pci_run_osc(root->device->handle, capbuf, &result); +diff --git a/drivers/acpi/thermal.c b/drivers/acpi/thermal.c +index 506fbd4..25246e8 100644 +--- a/drivers/acpi/thermal.c ++++ b/drivers/acpi/thermal.c +@@ -719,9 +719,19 @@ static int thermal_get_trend(struct thermal_zone_device *thermal, + return -EINVAL; + + if (type == THERMAL_TRIP_ACTIVE) { +- /* aggressive active cooling */ +- *trend = THERMAL_TREND_RAISING; +- return 0; ++ unsigned long trip_temp; ++ unsigned long temp = KELVIN_TO_MILLICELSIUS(tz->temperature, ++ tz->kelvin_offset); ++ if (thermal_get_trip_temp(thermal, trip, &trip_temp)) ++ return -EINVAL; ++ ++ if (temp > trip_temp) { ++ *trend = THERMAL_TREND_RAISING; ++ return 0; ++ } else { ++ /* Fall back on default trend */ ++ return -EINVAL; ++ } + } + + /* +diff --git a/drivers/ata/libata-acpi.c b/drivers/ata/libata-acpi.c +index ef01ac0..cc8aa9e 100644 +--- a/drivers/ata/libata-acpi.c ++++ b/drivers/ata/libata-acpi.c +@@ -60,7 +60,8 @@ acpi_handle ata_ap_acpi_handle(struct ata_port *ap) + if (ap->flags & ATA_FLAG_ACPI_SATA) + return NULL; + +- return acpi_get_child(DEVICE_ACPI_HANDLE(ap->host->dev), ap->port_no); ++ return ap->scsi_host ? ++ DEVICE_ACPI_HANDLE(&ap->scsi_host->shost_gendev) : NULL; + } + EXPORT_SYMBOL(ata_ap_acpi_handle); + +@@ -239,28 +240,15 @@ void ata_acpi_dissociate(struct ata_host *host) + } + } + +-/** +- * ata_acpi_gtm - execute _GTM +- * @ap: target ATA port +- * @gtm: out parameter for _GTM result +- * +- * Evaluate _GTM and store the result in @gtm. +- * +- * LOCKING: +- * EH context. +- * +- * RETURNS: +- * 0 on success, -ENOENT if _GTM doesn't exist, -errno on failure. +- */ +-int ata_acpi_gtm(struct ata_port *ap, struct ata_acpi_gtm *gtm) ++static int __ata_acpi_gtm(struct ata_port *ap, acpi_handle handle, ++ struct ata_acpi_gtm *gtm) + { + struct acpi_buffer output = { .length = ACPI_ALLOCATE_BUFFER }; + union acpi_object *out_obj; + acpi_status status; + int rc = 0; + +- status = acpi_evaluate_object(ata_ap_acpi_handle(ap), "_GTM", NULL, +- &output); ++ status = acpi_evaluate_object(handle, "_GTM", NULL, &output); + + rc = -ENOENT; + if (status == AE_NOT_FOUND) +@@ -294,6 +282,27 @@ int ata_acpi_gtm(struct ata_port *ap, struct ata_acpi_gtm *gtm) + return rc; + } + ++/** ++ * ata_acpi_gtm - execute _GTM ++ * @ap: target ATA port ++ * @gtm: out parameter for _GTM result ++ * ++ * Evaluate _GTM and store the result in @gtm. ++ * ++ * LOCKING: ++ * EH context. ++ * ++ * RETURNS: ++ * 0 on success, -ENOENT if _GTM doesn't exist, -errno on failure. ++ */ ++int ata_acpi_gtm(struct ata_port *ap, struct ata_acpi_gtm *gtm) ++{ ++ if (ata_ap_acpi_handle(ap)) ++ return __ata_acpi_gtm(ap, ata_ap_acpi_handle(ap), gtm); ++ else ++ return -EINVAL; ++} ++ + EXPORT_SYMBOL_GPL(ata_acpi_gtm); + + /** +@@ -1095,7 +1104,7 @@ static int ata_acpi_bind_host(struct ata_port *ap, acpi_handle *handle) + if (!*handle) + return -ENODEV; + +- if (ata_acpi_gtm(ap, &ap->__acpi_init_gtm) == 0) ++ if (__ata_acpi_gtm(ap, *handle, &ap->__acpi_init_gtm) == 0) + ap->pflags |= ATA_PFLAG_INIT_GTM_VALID; + + return 0; +diff --git a/drivers/ata/sata_highbank.c b/drivers/ata/sata_highbank.c +index 5dba77c..b1a664a 100644 +--- a/drivers/ata/sata_highbank.c ++++ b/drivers/ata/sata_highbank.c +@@ -251,7 +251,7 @@ static const struct ata_port_info ahci_highbank_port_info = { + }; + + static struct scsi_host_template ahci_highbank_platform_sht = { +- AHCI_SHT("highbank-ahci"), ++ AHCI_SHT("sata_highbank"), + }; + + static const struct of_device_id ahci_of_match[] = { +diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c +index 93211df..ba780b7 100644 +--- a/drivers/char/tpm/tpm.c ++++ b/drivers/char/tpm/tpm.c +@@ -1291,7 +1291,7 @@ int tpm_pm_suspend(struct device *dev) + { + struct tpm_chip *chip = dev_get_drvdata(dev); + struct tpm_cmd_t cmd; +- int rc; ++ int rc, try; + + u8 dummy_hash[TPM_DIGEST_SIZE] = { 0 }; + +@@ -1309,9 +1309,32 @@ int tpm_pm_suspend(struct device *dev) + } + + /* now do the actual savestate */ +- cmd.header.in = savestate_header; +- rc = transmit_cmd(chip, &cmd, SAVESTATE_RESULT_SIZE, +- "sending savestate before suspend"); ++ for (try = 0; try < TPM_RETRY; try++) { ++ cmd.header.in = savestate_header; ++ rc = transmit_cmd(chip, &cmd, SAVESTATE_RESULT_SIZE, NULL); ++ ++ /* ++ * If the TPM indicates that it is too busy to respond to ++ * this command then retry before giving up. It can take ++ * several seconds for this TPM to be ready. ++ * ++ * This can happen if the TPM has already been sent the ++ * SaveState command before the driver has loaded. TCG 1.2 ++ * specification states that any communication after SaveState ++ * may cause the TPM to invalidate previously saved state. ++ */ ++ if (rc != TPM_WARN_RETRY) ++ break; ++ msleep(TPM_TIMEOUT_RETRY); ++ } ++ ++ if (rc) ++ dev_err(chip->dev, ++ "Error (%d) sending savestate before suspend\n", rc); ++ else if (try > 0) ++ dev_warn(chip->dev, "TPM savestate took %dms\n", ++ try * TPM_TIMEOUT_RETRY); ++ + return rc; + } + EXPORT_SYMBOL_GPL(tpm_pm_suspend); +diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h +index 8ef7649..9c12a52 100644 +--- a/drivers/char/tpm/tpm.h ++++ b/drivers/char/tpm/tpm.h +@@ -32,10 +32,12 @@ enum tpm_const { + TPM_MINOR = 224, /* officially assigned */ + TPM_BUFSIZE = 4096, + TPM_NUM_DEVICES = 256, ++ TPM_RETRY = 50, /* 5 seconds */ + }; + + enum tpm_timeout { + TPM_TIMEOUT = 5, /* msecs */ ++ TPM_TIMEOUT_RETRY = 100 /* msecs */ + }; + + /* TPM addresses */ +@@ -44,6 +46,7 @@ enum tpm_addr { + TPM_ADDR = 0x4E, + }; + ++#define TPM_WARN_RETRY 0x800 + #define TPM_WARN_DOING_SELFTEST 0x802 + #define TPM_ERR_DEACTIVATED 0x6 + #define TPM_ERR_DISABLED 0x7 +diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c +index f042f6d..fd7d66d 100644 +--- a/drivers/i2c/busses/i2c-xiic.c ++++ b/drivers/i2c/busses/i2c-xiic.c +@@ -312,10 +312,8 @@ static void xiic_fill_tx_fifo(struct xiic_i2c *i2c) + /* last message in transfer -> STOP */ + data |= XIIC_TX_DYN_STOP_MASK; + dev_dbg(i2c->adap.dev.parent, "%s TX STOP\n", __func__); +- +- xiic_setreg16(i2c, XIIC_DTR_REG_OFFSET, data); +- } else +- xiic_setreg8(i2c, XIIC_DTR_REG_OFFSET, data); ++ } ++ xiic_setreg16(i2c, XIIC_DTR_REG_OFFSET, data); + } + } + +diff --git a/drivers/md/md.c b/drivers/md/md.c +index f363135..0411bde 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -1564,8 +1564,8 @@ static int super_1_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor_ + sector, count, 1) == 0) + return -EINVAL; + } +- } else if (sb->bblog_offset == 0) +- rdev->badblocks.shift = -1; ++ } else if (sb->bblog_offset != 0) ++ rdev->badblocks.shift = 0; + + if (!refdev) { + ret = 1; +@@ -3221,7 +3221,7 @@ int md_rdev_init(struct md_rdev *rdev) + * be used - I wonder if that matters + */ + rdev->badblocks.count = 0; +- rdev->badblocks.shift = 0; ++ rdev->badblocks.shift = -1; /* disabled until explicitly enabled */ + rdev->badblocks.page = kmalloc(PAGE_SIZE, GFP_KERNEL); + seqlock_init(&rdev->badblocks.lock); + if (rdev->badblocks.page == NULL) +@@ -3293,9 +3293,6 @@ static struct md_rdev *md_import_device(dev_t newdev, int super_format, int supe + goto abort_free; + } + } +- if (super_format == -1) +- /* hot-add for 0.90, or non-persistent: so no badblocks */ +- rdev->badblocks.shift = -1; + + return rdev; + +diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c +index fd86b37..6af167f 100644 +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -981,7 +981,12 @@ static void raid1_unplug(struct blk_plug_cb *cb, bool from_schedule) + while (bio) { /* submit pending writes */ + struct bio *next = bio->bi_next; + bio->bi_next = NULL; +- generic_make_request(bio); ++ if (unlikely((bio->bi_rw & REQ_DISCARD) && ++ !blk_queue_discard(bdev_get_queue(bio->bi_bdev)))) ++ /* Just ignore it */ ++ bio_endio(bio, 0); ++ else ++ generic_make_request(bio); + bio = next; + } + kfree(plug); +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index b3898d4..61ab219 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -1087,7 +1087,12 @@ static void raid10_unplug(struct blk_plug_cb *cb, bool from_schedule) + while (bio) { /* submit pending writes */ + struct bio *next = bio->bi_next; + bio->bi_next = NULL; +- generic_make_request(bio); ++ if (unlikely((bio->bi_rw & REQ_DISCARD) && ++ !blk_queue_discard(bdev_get_queue(bio->bi_bdev)))) ++ /* Just ignore it */ ++ bio_endio(bio, 0); ++ else ++ generic_make_request(bio); + bio = next; + } + kfree(plug); +diff --git a/drivers/mfd/adp5520.c b/drivers/mfd/adp5520.c +index 210dd03..6b40e0c 100644 +--- a/drivers/mfd/adp5520.c ++++ b/drivers/mfd/adp5520.c +@@ -36,6 +36,7 @@ struct adp5520_chip { + struct blocking_notifier_head notifier_list; + int irq; + unsigned long id; ++ uint8_t mode; + }; + + static int __adp5520_read(struct i2c_client *client, +@@ -326,7 +327,10 @@ static int adp5520_suspend(struct device *dev) + struct i2c_client *client = to_i2c_client(dev); + struct adp5520_chip *chip = dev_get_drvdata(&client->dev); + +- adp5520_clr_bits(chip->dev, ADP5520_MODE_STATUS, ADP5520_nSTNBY); ++ adp5520_read(chip->dev, ADP5520_MODE_STATUS, &chip->mode); ++ /* All other bits are W1C */ ++ chip->mode &= ADP5520_BL_EN | ADP5520_DIM_EN | ADP5520_nSTNBY; ++ adp5520_write(chip->dev, ADP5520_MODE_STATUS, 0); + return 0; + } + +@@ -335,7 +339,7 @@ static int adp5520_resume(struct device *dev) + struct i2c_client *client = to_i2c_client(dev); + struct adp5520_chip *chip = dev_get_drvdata(&client->dev); + +- adp5520_set_bits(chip->dev, ADP5520_MODE_STATUS, ADP5520_nSTNBY); ++ adp5520_write(chip->dev, ADP5520_MODE_STATUS, chip->mode); + return 0; + } + #endif +diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c +index 089e8ea..2743b7d 100644 +--- a/drivers/mmc/core/mmc.c ++++ b/drivers/mmc/core/mmc.c +@@ -368,13 +368,13 @@ static int mmc_read_ext_csd(struct mmc_card *card, u8 *ext_csd) + ext_csd[EXT_CSD_SEC_FEATURE_SUPPORT]; + card->ext_csd.raw_trim_mult = + ext_csd[EXT_CSD_TRIM_MULT]; ++ card->ext_csd.raw_partition_support = ext_csd[EXT_CSD_PARTITION_SUPPORT]; + if (card->ext_csd.rev >= 4) { + /* + * Enhanced area feature support -- check whether the eMMC + * card has the Enhanced area enabled. If so, export enhanced + * area offset and size to user by adding sysfs interface. + */ +- card->ext_csd.raw_partition_support = ext_csd[EXT_CSD_PARTITION_SUPPORT]; + if ((ext_csd[EXT_CSD_PARTITION_SUPPORT] & 0x2) && + (ext_csd[EXT_CSD_PARTITION_ATTRIBUTE] & 0x1)) { + hc_erase_grp_sz = +diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig +index 8d13c65..009dabd 100644 +--- a/drivers/mmc/host/Kconfig ++++ b/drivers/mmc/host/Kconfig +@@ -292,16 +292,6 @@ config MMC_ATMELMCI + + If unsure, say N. + +-config MMC_ATMELMCI_DMA +- bool "Atmel MCI DMA support" +- depends on MMC_ATMELMCI && (AVR32 || ARCH_AT91SAM9G45) && DMA_ENGINE +- help +- Say Y here to have the Atmel MCI driver use a DMA engine to +- do data transfers and thus increase the throughput and +- reduce the CPU utilization. +- +- If unsure, say N. +- + config MMC_MSM + tristate "Qualcomm SDCC Controller Support" + depends on MMC && ARCH_MSM +diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c +index 722af1d..e75774f 100644 +--- a/drivers/mmc/host/atmel-mci.c ++++ b/drivers/mmc/host/atmel-mci.c +@@ -178,6 +178,7 @@ struct atmel_mci { + void __iomem *regs; + + struct scatterlist *sg; ++ unsigned int sg_len; + unsigned int pio_offset; + unsigned int *buffer; + unsigned int buf_size; +@@ -892,6 +893,7 @@ static u32 atmci_prepare_data(struct atmel_mci *host, struct mmc_data *data) + data->error = -EINPROGRESS; + + host->sg = data->sg; ++ host->sg_len = data->sg_len; + host->data = data; + host->data_chan = NULL; + +@@ -1826,7 +1828,8 @@ static void atmci_read_data_pio(struct atmel_mci *host) + if (offset == sg->length) { + flush_dcache_page(sg_page(sg)); + host->sg = sg = sg_next(sg); +- if (!sg) ++ host->sg_len--; ++ if (!sg || !host->sg_len) + goto done; + + offset = 0; +@@ -1839,7 +1842,8 @@ static void atmci_read_data_pio(struct atmel_mci *host) + + flush_dcache_page(sg_page(sg)); + host->sg = sg = sg_next(sg); +- if (!sg) ++ host->sg_len--; ++ if (!sg || !host->sg_len) + goto done; + + offset = 4 - remaining; +@@ -1890,7 +1894,8 @@ static void atmci_write_data_pio(struct atmel_mci *host) + nbytes += 4; + if (offset == sg->length) { + host->sg = sg = sg_next(sg); +- if (!sg) ++ host->sg_len--; ++ if (!sg || !host->sg_len) + goto done; + + offset = 0; +@@ -1904,7 +1909,8 @@ static void atmci_write_data_pio(struct atmel_mci *host) + nbytes += remaining; + + host->sg = sg = sg_next(sg); +- if (!sg) { ++ host->sg_len--; ++ if (!sg || !host->sg_len) { + atmci_writel(host, ATMCI_TDR, value); + goto done; + } +@@ -2487,10 +2493,8 @@ static int __exit atmci_remove(struct platform_device *pdev) + atmci_readl(host, ATMCI_SR); + clk_disable(host->mck); + +-#ifdef CONFIG_MMC_ATMELMCI_DMA + if (host->dma.chan) + dma_release_channel(host->dma.chan); +-#endif + + free_irq(platform_get_irq(pdev, 0), host); + iounmap(host->regs); +diff --git a/drivers/net/ethernet/freescale/gianfar_ptp.c b/drivers/net/ethernet/freescale/gianfar_ptp.c +index 2e5daee..a3f8a25 100644 +--- a/drivers/net/ethernet/freescale/gianfar_ptp.c ++++ b/drivers/net/ethernet/freescale/gianfar_ptp.c +@@ -127,7 +127,6 @@ struct gianfar_ptp_registers { + + #define DRIVER "gianfar_ptp" + #define DEFAULT_CKSEL 1 +-#define N_ALARM 1 /* first alarm is used internally to reset fipers */ + #define N_EXT_TS 2 + #define REG_SIZE sizeof(struct gianfar_ptp_registers) + +@@ -410,7 +409,7 @@ static struct ptp_clock_info ptp_gianfar_caps = { + .owner = THIS_MODULE, + .name = "gianfar clock", + .max_adj = 512000, +- .n_alarm = N_ALARM, ++ .n_alarm = 0, + .n_ext_ts = N_EXT_TS, + .n_per_out = 0, + .pps = 1, +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +index 0d03d38..911956e 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +@@ -2407,6 +2407,16 @@ static irqreturn_t ixgbe_msix_other(int irq, void *data) + * with the write to EICR. + */ + eicr = IXGBE_READ_REG(hw, IXGBE_EICS); ++ ++ /* The lower 16bits of the EICR register are for the queue interrupts ++ * which should be masked here in order to not accidently clear them if ++ * the bits are high when ixgbe_msix_other is called. There is a race ++ * condition otherwise which results in possible performance loss ++ * especially if the ixgbe_msix_other interrupt is triggering ++ * consistently (as it would when PPS is turned on for the X540 device) ++ */ ++ eicr &= 0xFFFF0000; ++ + IXGBE_WRITE_REG(hw, IXGBE_EICR, eicr); + + if (eicr & IXGBE_EICR_LSC) +diff --git a/drivers/net/wireless/iwlwifi/dvm/debugfs.c b/drivers/net/wireless/iwlwifi/dvm/debugfs.c +index 5b9533e..2c056b1 100644 +--- a/drivers/net/wireless/iwlwifi/dvm/debugfs.c ++++ b/drivers/net/wireless/iwlwifi/dvm/debugfs.c +@@ -2237,15 +2237,15 @@ static ssize_t iwl_dbgfs_log_event_read(struct file *file, + size_t count, loff_t *ppos) + { + struct iwl_priv *priv = file->private_data; +- char *buf; +- int pos = 0; +- ssize_t ret = -ENOMEM; ++ char *buf = NULL; ++ ssize_t ret; + +- ret = pos = iwl_dump_nic_event_log(priv, true, &buf, true); +- if (buf) { +- ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos); +- kfree(buf); +- } ++ ret = iwl_dump_nic_event_log(priv, true, &buf, true); ++ if (ret < 0) ++ goto err; ++ ret = simple_read_from_buffer(user_buf, count, ppos, buf, ret); ++err: ++ kfree(buf); + return ret; + } + +diff --git a/drivers/net/wireless/iwlwifi/dvm/sta.c b/drivers/net/wireless/iwlwifi/dvm/sta.c +index bdba954..a8632a4 100644 +--- a/drivers/net/wireless/iwlwifi/dvm/sta.c ++++ b/drivers/net/wireless/iwlwifi/dvm/sta.c +@@ -707,6 +707,7 @@ void iwl_clear_ucode_stations(struct iwl_priv *priv, + void iwl_restore_stations(struct iwl_priv *priv, struct iwl_rxon_context *ctx) + { + struct iwl_addsta_cmd sta_cmd; ++ static const struct iwl_link_quality_cmd zero_lq = {}; + struct iwl_link_quality_cmd lq; + int i; + bool found = false; +@@ -745,7 +746,9 @@ void iwl_restore_stations(struct iwl_priv *priv, struct iwl_rxon_context *ctx) + else + memcpy(&lq, priv->stations[i].lq, + sizeof(struct iwl_link_quality_cmd)); +- send_lq = true; ++ ++ if (!memcmp(&lq, &zero_lq, sizeof(lq))) ++ send_lq = true; + } + spin_unlock_bh(&priv->sta_lock); + ret = iwl_send_add_sta(priv, &sta_cmd, CMD_SYNC); +diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c +index 0bbea88..b7a5387 100644 +--- a/drivers/net/wireless/mwifiex/pcie.c ++++ b/drivers/net/wireless/mwifiex/pcie.c +@@ -1831,9 +1831,9 @@ static void mwifiex_pcie_cleanup(struct mwifiex_adapter *adapter) + if (pdev) { + pci_iounmap(pdev, card->pci_mmap); + pci_iounmap(pdev, card->pci_mmap1); +- +- pci_release_regions(pdev); + pci_disable_device(pdev); ++ pci_release_region(pdev, 2); ++ pci_release_region(pdev, 0); + pci_set_drvdata(pdev, NULL); + } + } +diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c +index 197b446..0b55706 100644 +--- a/drivers/net/wireless/rt2x00/rt2800lib.c ++++ b/drivers/net/wireless/rt2x00/rt2800lib.c +@@ -4386,6 +4386,8 @@ static int rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev) + + if (!rt2x00_rt(rt2x00dev, RT5390) && + !rt2x00_rt(rt2x00dev, RT5392)) { ++ u8 min_gain = rt2x00_rt(rt2x00dev, RT3070) ? 1 : 2; ++ + rt2800_rfcsr_read(rt2x00dev, 17, &rfcsr); + rt2x00_set_field8(&rfcsr, RFCSR17_TX_LO1_EN, 0); + if (rt2x00_rt(rt2x00dev, RT3070) || +@@ -4396,8 +4398,10 @@ static int rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev) + &rt2x00dev->cap_flags)) + rt2x00_set_field8(&rfcsr, RFCSR17_R, 1); + } +- rt2x00_set_field8(&rfcsr, RFCSR17_TXMIXER_GAIN, +- drv_data->txmixer_gain_24g); ++ if (drv_data->txmixer_gain_24g >= min_gain) { ++ rt2x00_set_field8(&rfcsr, RFCSR17_TXMIXER_GAIN, ++ drv_data->txmixer_gain_24g); ++ } + rt2800_rfcsr_write(rt2x00dev, 17, rfcsr); + } + +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index 5cb5820..d1b4e00 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -651,15 +651,11 @@ static int pci_platform_power_transition(struct pci_dev *dev, pci_power_t state) + error = platform_pci_set_power_state(dev, state); + if (!error) + pci_update_current_state(dev, state); +- /* Fall back to PCI_D0 if native PM is not supported */ +- if (!dev->pm_cap) +- dev->current_state = PCI_D0; +- } else { ++ } else + error = -ENODEV; +- /* Fall back to PCI_D0 if native PM is not supported */ +- if (!dev->pm_cap) +- dev->current_state = PCI_D0; +- } ++ ++ if (error && !dev->pm_cap) /* Fall back to PCI_D0 */ ++ dev->current_state = PCI_D0; + + return error; + } +diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c +index 16630aa..1c77423 100644 +--- a/drivers/rtc/rtc-cmos.c ++++ b/drivers/rtc/rtc-cmos.c +@@ -805,9 +805,8 @@ static int cmos_suspend(struct device *dev) + mask = RTC_IRQMASK; + tmp &= ~mask; + CMOS_WRITE(tmp, RTC_CONTROL); ++ hpet_mask_rtc_irq_bit(mask); + +- /* shut down hpet emulation - we don't need it for alarm */ +- hpet_mask_rtc_irq_bit(RTC_PIE|RTC_AIE|RTC_UIE); + cmos_checkintr(cmos, tmp); + } + spin_unlock_irq(&rtc_lock); +@@ -872,6 +871,7 @@ static int cmos_resume(struct device *dev) + rtc_update_irq(cmos->rtc, 1, mask); + tmp &= ~RTC_AIE; + hpet_mask_rtc_irq_bit(RTC_AIE); ++ hpet_rtc_timer_init(); + } while (mask & RTC_AIE); + spin_unlock_irq(&rtc_lock); + } +diff --git a/drivers/s390/char/sclp_cmd.c b/drivers/s390/char/sclp_cmd.c +index c44d13f..56dcd7c 100644 +--- a/drivers/s390/char/sclp_cmd.c ++++ b/drivers/s390/char/sclp_cmd.c +@@ -567,6 +567,8 @@ static void __init sclp_add_standby_memory(void) + add_memory_merged(0); + } + ++#define MEM_SCT_SIZE (1UL << SECTION_SIZE_BITS) ++ + static void __init insert_increment(u16 rn, int standby, int assigned) + { + struct memory_increment *incr, *new_incr; +@@ -579,7 +581,7 @@ static void __init insert_increment(u16 rn, int standby, int assigned) + new_incr->rn = rn; + new_incr->standby = standby; + if (!standby) +- new_incr->usecount = 1; ++ new_incr->usecount = rzm > MEM_SCT_SIZE ? rzm/MEM_SCT_SIZE : 1; + last_rn = 0; + prev = &sclp_mem_list; + list_for_each_entry(incr, &sclp_mem_list, list) { +diff --git a/drivers/staging/zsmalloc/Kconfig b/drivers/staging/zsmalloc/Kconfig +index 9084565..7fab032 100644 +--- a/drivers/staging/zsmalloc/Kconfig ++++ b/drivers/staging/zsmalloc/Kconfig +@@ -1,5 +1,5 @@ + config ZSMALLOC +- tristate "Memory allocator for compressed pages" ++ bool "Memory allocator for compressed pages" + default n + help + zsmalloc is a slab-based memory allocator designed to store +diff --git a/drivers/staging/zsmalloc/zsmalloc-main.c b/drivers/staging/zsmalloc/zsmalloc-main.c +index 223c736..851a2ff 100644 +--- a/drivers/staging/zsmalloc/zsmalloc-main.c ++++ b/drivers/staging/zsmalloc/zsmalloc-main.c +@@ -657,11 +657,8 @@ static inline void __zs_unmap_object(struct mapping_area *area, + struct page *pages[2], int off, int size) + { + unsigned long addr = (unsigned long)area->vm_addr; +- unsigned long end = addr + (PAGE_SIZE * 2); + +- flush_cache_vunmap(addr, end); +- unmap_kernel_range_noflush(addr, PAGE_SIZE * 2); +- flush_tlb_kernel_range(addr, end); ++ unmap_kernel_range(addr, PAGE_SIZE * 2); + } + + #else /* USE_PGTABLE_MAPPING */ +diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c +index ac35c90..c830b60 100644 +--- a/drivers/tty/pty.c ++++ b/drivers/tty/pty.c +@@ -675,6 +675,9 @@ static int ptmx_open(struct inode *inode, struct file *filp) + + nonseekable_open(inode, filp); + ++ /* We refuse fsnotify events on ptmx, since it's a shared resource */ ++ filp->f_mode |= FMODE_NONOTIFY; ++ + retval = tty_alloc_file(filp); + if (retval) + return retval; +diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c +index 2c7230a..4293a3e 100644 +--- a/drivers/tty/serial/serial_core.c ++++ b/drivers/tty/serial/serial_core.c +@@ -1940,6 +1940,8 @@ int uart_suspend_port(struct uart_driver *drv, struct uart_port *uport) + mutex_unlock(&port->mutex); + return 0; + } ++ put_device(tty_dev); ++ + if (console_suspend_enabled || !uart_console(uport)) + uport->suspended = 1; + +@@ -2005,9 +2007,11 @@ int uart_resume_port(struct uart_driver *drv, struct uart_port *uport) + disable_irq_wake(uport->irq); + uport->irq_wake = 0; + } ++ put_device(tty_dev); + mutex_unlock(&port->mutex); + return 0; + } ++ put_device(tty_dev); + uport->suspended = 0; + + /* +diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c +index 892ecda..f34f98d 100644 +--- a/drivers/tty/tty_io.c ++++ b/drivers/tty/tty_io.c +@@ -941,10 +941,10 @@ void start_tty(struct tty_struct *tty) + + EXPORT_SYMBOL(start_tty); + ++/* We limit tty time update visibility to every 8 seconds or so. */ + static void tty_update_time(struct timespec *time) + { +- unsigned long sec = get_seconds(); +- sec -= sec % 60; ++ unsigned long sec = get_seconds() & ~7; + if ((long)(sec - time->tv_sec) > 0) + time->tv_sec = sec; + } +diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c +index 2f45bba..c0f4066 100644 +--- a/drivers/usb/chipidea/udc.c ++++ b/drivers/usb/chipidea/udc.c +@@ -461,6 +461,8 @@ static int _hardware_enqueue(struct ci13xxx_ep *mEp, struct ci13xxx_req *mReq) + mReq->ptr->page[i] = + (mReq->req.dma + i * CI13XXX_PAGE_SIZE) & ~TD_RESERVED_MASK; + ++ wmb(); ++ + if (!list_empty(&mEp->qh.queue)) { + struct ci13xxx_req *mReqPrev; + int n = hw_ep_bit(mEp->num, mEp->dir); +@@ -561,6 +563,12 @@ __acquires(mEp->lock) + struct ci13xxx_req *mReq = \ + list_entry(mEp->qh.queue.next, + struct ci13xxx_req, queue); ++ ++ if (mReq->zptr) { ++ dma_pool_free(mEp->td_pool, mReq->zptr, mReq->zdma); ++ mReq->zptr = NULL; ++ } ++ + list_del_init(&mReq->queue); + mReq->req.status = -ESHUTDOWN; + +diff --git a/drivers/usb/chipidea/udc.h b/drivers/usb/chipidea/udc.h +index 4ff2384d..d12e8b5 100644 +--- a/drivers/usb/chipidea/udc.h ++++ b/drivers/usb/chipidea/udc.h +@@ -40,7 +40,7 @@ struct ci13xxx_td { + #define TD_CURR_OFFSET (0x0FFFUL << 0) + #define TD_FRAME_NUM (0x07FFUL << 0) + #define TD_RESERVED_MASK (0x0FFFUL << 0) +-} __attribute__ ((packed)); ++} __attribute__ ((packed, aligned(4))); + + /* DMA layout of queue heads */ + struct ci13xxx_qh { +@@ -57,7 +57,7 @@ struct ci13xxx_qh { + /* 9 */ + u32 RESERVED; + struct usb_ctrlrequest setup; +-} __attribute__ ((packed)); ++} __attribute__ ((packed, aligned(4))); + + /** + * struct ci13xxx_req - usb request representation +diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c +index b78fbe2..ea0a9a1 100644 +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -738,6 +738,8 @@ static int check_ctrlrecip(struct dev_state *ps, unsigned int requesttype, + index &= 0xff; + switch (requesttype & USB_RECIP_MASK) { + case USB_RECIP_ENDPOINT: ++ if ((index & ~USB_DIR_IN) == 0) ++ return 0; + ret = findintfep(ps->dev, index); + if (ret >= 0) + ret = checkintf(ps, ret); +diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c +index 416a6dc..83b5a172 100644 +--- a/drivers/usb/host/ehci-hcd.c ++++ b/drivers/usb/host/ehci-hcd.c +@@ -670,9 +670,6 @@ int ehci_setup(struct usb_hcd *hcd) + if (retval) + return retval; + +- if (ehci_is_TDI(ehci)) +- tdi_reset(ehci); +- + ehci_reset(ehci); + + return 0; +diff --git a/drivers/usb/misc/appledisplay.c b/drivers/usb/misc/appledisplay.c +index 0fc6e5f..ba6a5d6 100644 +--- a/drivers/usb/misc/appledisplay.c ++++ b/drivers/usb/misc/appledisplay.c +@@ -63,6 +63,7 @@ static const struct usb_device_id appledisplay_table[] = { + { APPLEDISPLAY_DEVICE(0x9219) }, + { APPLEDISPLAY_DEVICE(0x921c) }, + { APPLEDISPLAY_DEVICE(0x921d) }, ++ { APPLEDISPLAY_DEVICE(0x9236) }, + + /* Terminating entry */ + { } +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index 8e4f40b..77f78ad 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -189,6 +189,7 @@ static struct usb_device_id id_table_combined [] = { + { USB_DEVICE(FTDI_VID, FTDI_OPENDCC_THROTTLE_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_OPENDCC_GATEWAY_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_OPENDCC_GBM_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_OPENDCC_GBM_BOOST_PID) }, + { USB_DEVICE(NEWPORT_VID, NEWPORT_AGILIS_PID) }, + { USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_IOBOARD_PID) }, + { USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_MINI_IOBOARD_PID) }, +@@ -870,7 +871,9 @@ static struct usb_device_id id_table_combined [] = { + { USB_DEVICE(FTDI_VID, FTDI_DOTEC_PID) }, + { USB_DEVICE(QIHARDWARE_VID, MILKYMISTONE_JTAGSERIAL_PID), + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, +- { USB_DEVICE(ST_VID, ST_STMCLT1030_PID), ++ { USB_DEVICE(ST_VID, ST_STMCLT_2232_PID), ++ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, ++ { USB_DEVICE(ST_VID, ST_STMCLT_4232_PID), + .driver_info = (kernel_ulong_t)&ftdi_stmclite_quirk }, + { USB_DEVICE(FTDI_VID, FTDI_RF_R106) }, + { USB_DEVICE(FTDI_VID, FTDI_DISTORTEC_JTAG_LOCK_PICK_PID), +@@ -1792,20 +1795,24 @@ static int ftdi_8u2232c_probe(struct usb_serial *serial) + } + + /* +- * First and second port on STMCLiteadaptors is reserved for JTAG interface +- * and the forth port for pio ++ * First two ports on JTAG adaptors using an FT4232 such as STMicroelectronics's ++ * ST Micro Connect Lite are reserved for JTAG or other non-UART interfaces and ++ * can be accessed from userspace. ++ * The next two ports are enabled as UARTs by default, where port 2 is ++ * a conventional RS-232 UART. + */ + static int ftdi_stmclite_probe(struct usb_serial *serial) + { + struct usb_device *udev = serial->dev; + struct usb_interface *interface = serial->interface; + +- if (interface == udev->actconfig->interface[2]) +- return 0; +- +- dev_info(&udev->dev, "Ignoring serial port reserved for JTAG\n"); ++ if (interface == udev->actconfig->interface[0] || ++ interface == udev->actconfig->interface[1]) { ++ dev_info(&udev->dev, "Ignoring serial port reserved for JTAG\n"); ++ return -ENODEV; ++ } + +- return -ENODEV; ++ return 0; + } + + /* +diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h +index e79861e..9852827 100644 +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -74,6 +74,7 @@ + #define FTDI_OPENDCC_THROTTLE_PID 0xBFDA + #define FTDI_OPENDCC_GATEWAY_PID 0xBFDB + #define FTDI_OPENDCC_GBM_PID 0xBFDC ++#define FTDI_OPENDCC_GBM_BOOST_PID 0xBFDD + + /* NZR SEM 16+ USB (http://www.nzr.de) */ + #define FTDI_NZR_SEM_USB_PID 0xC1E0 /* NZR SEM-LOG16+ */ +@@ -1150,7 +1151,8 @@ + * STMicroelectonics + */ + #define ST_VID 0x0483 +-#define ST_STMCLT1030_PID 0x3747 /* ST Micro Connect Lite STMCLT1030 */ ++#define ST_STMCLT_2232_PID 0x3746 ++#define ST_STMCLT_4232_PID 0x3747 + + /* + * Papouch products (http://www.papouch.com/) +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 558adfc..bff059a 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -347,6 +347,7 @@ static void option_instat_callback(struct urb *urb); + /* Olivetti products */ + #define OLIVETTI_VENDOR_ID 0x0b3c + #define OLIVETTI_PRODUCT_OLICARD100 0xc000 ++#define OLIVETTI_PRODUCT_OLICARD145 0xc003 + + /* Celot products */ + #define CELOT_VENDOR_ID 0x211f +@@ -1273,6 +1274,7 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) }, + + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) }, ++ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD145) }, + { USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */ + { USB_DEVICE(ONDA_VENDOR_ID, ONDA_MT825UP) }, /* ONDA MT825UP modem */ + { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/ +@@ -1350,6 +1352,12 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE(TPLINK_VENDOR_ID, TPLINK_PRODUCT_MA180), + .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE(CHANGHONG_VENDOR_ID, CHANGHONG_PRODUCT_CH690) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d01, 0xff, 0x02, 0x01) }, /* D-Link DWM-156 (variant) */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d01, 0xff, 0x00, 0x00) }, /* D-Link DWM-156 (variant) */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d02, 0xff, 0x02, 0x01) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d02, 0xff, 0x00, 0x00) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x02, 0x01) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) }, + { } /* Terminating entry */ + }; + MODULE_DEVICE_TABLE(usb, option_ids); +diff --git a/drivers/usb/storage/cypress_atacb.c b/drivers/usb/storage/cypress_atacb.c +index 070b5c0..d944088 100644 +--- a/drivers/usb/storage/cypress_atacb.c ++++ b/drivers/usb/storage/cypress_atacb.c +@@ -248,14 +248,26 @@ static int cypress_probe(struct usb_interface *intf, + { + struct us_data *us; + int result; ++ struct usb_device *device; + + result = usb_stor_probe1(&us, intf, id, + (id - cypress_usb_ids) + cypress_unusual_dev_list); + if (result) + return result; + +- us->protocol_name = "Transparent SCSI with Cypress ATACB"; +- us->proto_handler = cypress_atacb_passthrough; ++ /* Among CY7C68300 chips, the A revision does not support Cypress ATACB ++ * Filter out this revision from EEPROM default descriptor values ++ */ ++ device = interface_to_usbdev(intf); ++ if (device->descriptor.iManufacturer != 0x38 || ++ device->descriptor.iProduct != 0x4e || ++ device->descriptor.iSerialNumber != 0x64) { ++ us->protocol_name = "Transparent SCSI with Cypress ATACB"; ++ us->proto_handler = cypress_atacb_passthrough; ++ } else { ++ us->protocol_name = "Transparent SCSI"; ++ us->proto_handler = usb_stor_transparent_scsi_command; ++ } + + result = usb_stor_probe2(us); + return result; +diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c +index 501c599..6e696e6 100644 +--- a/drivers/video/console/fbcon.c ++++ b/drivers/video/console/fbcon.c +@@ -1228,6 +1228,8 @@ static void fbcon_deinit(struct vc_data *vc) + finished: + + fbcon_free_font(p, free_font); ++ if (free_font) ++ vc->vc_font.data = NULL; + + if (!con_is_bound(&fb_con)) + fbcon_exit(); +diff --git a/fs/dcache.c b/fs/dcache.c +index c3bbf85..de73da2 100644 +--- a/fs/dcache.c ++++ b/fs/dcache.c +@@ -1232,8 +1232,10 @@ void shrink_dcache_parent(struct dentry * parent) + LIST_HEAD(dispose); + int found; + +- while ((found = select_parent(parent, &dispose)) != 0) ++ while ((found = select_parent(parent, &dispose)) != 0) { + shrink_dentry_list(&dispose); ++ cond_resched(); ++ } + } + EXPORT_SYMBOL(shrink_dcache_parent); + +diff --git a/fs/exec.c b/fs/exec.c +index 20df02c..ac014f1 100644 +--- a/fs/exec.c ++++ b/fs/exec.c +@@ -613,7 +613,7 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift) + * when the old and new regions overlap clear from new_end. + */ + free_pgd_range(&tlb, new_end, old_end, new_end, +- vma->vm_next ? vma->vm_next->vm_start : 0); ++ vma->vm_next ? vma->vm_next->vm_start : USER_PGTABLES_CEILING); + } else { + /* + * otherwise, clean from old_start; this is done to not touch +@@ -622,7 +622,7 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift) + * for the others its just a little faster. + */ + free_pgd_range(&tlb, old_start, old_end, new_end, +- vma->vm_next ? vma->vm_next->vm_start : 0); ++ vma->vm_next ? vma->vm_next->vm_start : USER_PGTABLES_CEILING); + } + tlb_finish_mmu(&tlb, new_end, old_end); + +@@ -898,11 +898,13 @@ static int de_thread(struct task_struct *tsk) + + sig->notify_count = -1; /* for exit_notify() */ + for (;;) { ++ threadgroup_change_begin(tsk); + write_lock_irq(&tasklist_lock); + if (likely(leader->exit_state)) + break; + __set_current_state(TASK_KILLABLE); + write_unlock_irq(&tasklist_lock); ++ threadgroup_change_end(tsk); + schedule(); + if (unlikely(__fatal_signal_pending(tsk))) + goto killed; +@@ -960,6 +962,7 @@ static int de_thread(struct task_struct *tsk) + if (unlikely(leader->ptrace)) + __wake_up_parent(leader, leader->parent); + write_unlock_irq(&tasklist_lock); ++ threadgroup_change_end(tsk); + + release_task(leader); + } +diff --git a/fs/ext4/Kconfig b/fs/ext4/Kconfig +index 9873587..efea5d5 100644 +--- a/fs/ext4/Kconfig ++++ b/fs/ext4/Kconfig +@@ -71,4 +71,5 @@ config EXT4_DEBUG + Enables run-time debugging support for the ext4 filesystem. + + If you select Y here, then you will be able to turn on debugging +- with a command such as "echo 1 > /sys/kernel/debug/ext4/mballoc-debug" ++ with a command such as: ++ echo 1 > /sys/module/ext4/parameters/mballoc_debug +diff --git a/fs/ext4/ext4_jbd2.h b/fs/ext4/ext4_jbd2.h +index 7177f9b..dbd9ae1 100644 +--- a/fs/ext4/ext4_jbd2.h ++++ b/fs/ext4/ext4_jbd2.h +@@ -170,16 +170,20 @@ static inline void ext4_journal_callback_add(handle_t *handle, + * ext4_journal_callback_del: delete a registered callback + * @handle: active journal transaction handle on which callback was registered + * @jce: registered journal callback entry to unregister ++ * Return true if object was sucessfully removed + */ +-static inline void ext4_journal_callback_del(handle_t *handle, ++static inline bool ext4_journal_callback_try_del(handle_t *handle, + struct ext4_journal_cb_entry *jce) + { ++ bool deleted; + struct ext4_sb_info *sbi = + EXT4_SB(handle->h_transaction->t_journal->j_private); + + spin_lock(&sbi->s_md_lock); ++ deleted = !list_empty(&jce->jce_list); + list_del_init(&jce->jce_list); + spin_unlock(&sbi->s_md_lock); ++ return deleted; + } + + int +diff --git a/fs/ext4/fsync.c b/fs/ext4/fsync.c +index 3278e64..e0ba8a4 100644 +--- a/fs/ext4/fsync.c ++++ b/fs/ext4/fsync.c +@@ -166,8 +166,7 @@ int ext4_sync_file(struct file *file, loff_t start, loff_t end, int datasync) + if (journal->j_flags & JBD2_BARRIER && + !jbd2_trans_will_send_data_barrier(journal, commit_tid)) + needs_barrier = true; +- jbd2_log_start_commit(journal, commit_tid); +- ret = jbd2_log_wait_commit(journal, commit_tid); ++ ret = jbd2_complete_transaction(journal, commit_tid); + if (needs_barrier) { + err = blkdev_issue_flush(inode->i_sb->s_bdev, GFP_KERNEL, NULL); + if (!ret) +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index 22c5c67..c0fbd96 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -55,21 +55,21 @@ static __u32 ext4_inode_csum(struct inode *inode, struct ext4_inode *raw, + __u16 csum_hi = 0; + __u32 csum; + +- csum_lo = raw->i_checksum_lo; ++ csum_lo = le16_to_cpu(raw->i_checksum_lo); + raw->i_checksum_lo = 0; + if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE && + EXT4_FITS_IN_INODE(raw, ei, i_checksum_hi)) { +- csum_hi = raw->i_checksum_hi; ++ csum_hi = le16_to_cpu(raw->i_checksum_hi); + raw->i_checksum_hi = 0; + } + + csum = ext4_chksum(sbi, ei->i_csum_seed, (__u8 *)raw, + EXT4_INODE_SIZE(inode->i_sb)); + +- raw->i_checksum_lo = csum_lo; ++ raw->i_checksum_lo = cpu_to_le16(csum_lo); + if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE && + EXT4_FITS_IN_INODE(raw, ei, i_checksum_hi)) +- raw->i_checksum_hi = csum_hi; ++ raw->i_checksum_hi = cpu_to_le16(csum_hi); + + return csum; + } +@@ -216,8 +216,7 @@ void ext4_evict_inode(struct inode *inode) + journal_t *journal = EXT4_SB(inode->i_sb)->s_journal; + tid_t commit_tid = EXT4_I(inode)->i_datasync_tid; + +- jbd2_log_start_commit(journal, commit_tid); +- jbd2_log_wait_commit(journal, commit_tid); ++ jbd2_complete_transaction(journal, commit_tid); + filemap_write_and_wait(&inode->i_data); + } + truncate_inode_pages(&inode->i_data, 0); +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index 82f8c2d..b443e62 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -4449,11 +4449,11 @@ ext4_mb_free_metadata(handle_t *handle, struct ext4_buddy *e4b, + node = rb_prev(new_node); + if (node) { + entry = rb_entry(node, struct ext4_free_data, efd_node); +- if (can_merge(entry, new_entry)) { ++ if (can_merge(entry, new_entry) && ++ ext4_journal_callback_try_del(handle, &entry->efd_jce)) { + new_entry->efd_start_cluster = entry->efd_start_cluster; + new_entry->efd_count += entry->efd_count; + rb_erase(node, &(db->bb_free_root)); +- ext4_journal_callback_del(handle, &entry->efd_jce); + kmem_cache_free(ext4_free_data_cachep, entry); + } + } +@@ -4461,10 +4461,10 @@ ext4_mb_free_metadata(handle_t *handle, struct ext4_buddy *e4b, + node = rb_next(new_node); + if (node) { + entry = rb_entry(node, struct ext4_free_data, efd_node); +- if (can_merge(new_entry, entry)) { ++ if (can_merge(new_entry, entry) && ++ ext4_journal_callback_try_del(handle, &entry->efd_jce)) { + new_entry->efd_count += entry->efd_count; + rb_erase(node, &(db->bb_free_root)); +- ext4_journal_callback_del(handle, &entry->efd_jce); + kmem_cache_free(ext4_free_data_cachep, entry); + } + } +diff --git a/fs/ext4/mmp.c b/fs/ext4/mmp.c +index 44734f1..fe201c6 100644 +--- a/fs/ext4/mmp.c ++++ b/fs/ext4/mmp.c +@@ -7,7 +7,7 @@ + #include "ext4.h" + + /* Checksumming functions */ +-static __u32 ext4_mmp_csum(struct super_block *sb, struct mmp_struct *mmp) ++static __le32 ext4_mmp_csum(struct super_block *sb, struct mmp_struct *mmp) + { + struct ext4_sb_info *sbi = EXT4_SB(sb); + int offset = offsetof(struct mmp_struct, mmp_checksum); +diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c +index 9eace36..a2fe9f5 100644 +--- a/fs/ext4/resize.c ++++ b/fs/ext4/resize.c +@@ -1341,6 +1341,8 @@ static void ext4_update_super(struct super_block *sb, + + /* Update the global fs size fields */ + sbi->s_groups_count += flex_gd->count; ++ sbi->s_blockfile_groups = min_t(ext4_group_t, sbi->s_groups_count, ++ (EXT4_MAX_BLOCK_FILE_PHYS / EXT4_BLOCKS_PER_GROUP(sb))); + + /* Update the reserved block counts only once the new group is + * active. */ +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 24c767d..5575a45 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -452,10 +452,13 @@ static void ext4_journal_commit_callback(journal_t *journal, transaction_t *txn) + struct super_block *sb = journal->j_private; + struct ext4_sb_info *sbi = EXT4_SB(sb); + int error = is_journal_aborted(journal); +- struct ext4_journal_cb_entry *jce, *tmp; ++ struct ext4_journal_cb_entry *jce; + ++ BUG_ON(txn->t_state == T_FINISHED); + spin_lock(&sbi->s_md_lock); +- list_for_each_entry_safe(jce, tmp, &txn->t_private_list, jce_list) { ++ while (!list_empty(&txn->t_private_list)) { ++ jce = list_entry(txn->t_private_list.next, ++ struct ext4_journal_cb_entry, jce_list); + list_del_init(&jce->jce_list); + spin_unlock(&sbi->s_md_lock); + jce->jce_func(sb, jce, error); +diff --git a/fs/fscache/stats.c b/fs/fscache/stats.c +index 8179e8b..40d13c7 100644 +--- a/fs/fscache/stats.c ++++ b/fs/fscache/stats.c +@@ -287,5 +287,5 @@ const struct file_operations fscache_stats_fops = { + .open = fscache_stats_open, + .read = seq_read, + .llseek = seq_lseek, +- .release = seq_release, ++ .release = single_release, + }; +diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c +index 3091d42..069bf58 100644 +--- a/fs/jbd2/commit.c ++++ b/fs/jbd2/commit.c +@@ -382,7 +382,7 @@ void jbd2_journal_commit_transaction(journal_t *journal) + int space_left = 0; + int first_tag = 0; + int tag_flag; +- int i, to_free = 0; ++ int i; + int tag_bytes = journal_tag_bytes(journal); + struct buffer_head *cbh = NULL; /* For transactional checksums */ + __u32 crc32_sum = ~0; +@@ -1126,7 +1126,7 @@ restart_loop: + journal->j_stats.run.rs_blocks_logged += stats.run.rs_blocks_logged; + spin_unlock(&journal->j_history_lock); + +- commit_transaction->t_state = T_FINISHED; ++ commit_transaction->t_state = T_COMMIT_CALLBACK; + J_ASSERT(commit_transaction == journal->j_committing_transaction); + journal->j_commit_sequence = commit_transaction->t_tid; + journal->j_committing_transaction = NULL; +@@ -1141,38 +1141,44 @@ restart_loop: + journal->j_average_commit_time*3) / 4; + else + journal->j_average_commit_time = commit_time; ++ + write_unlock(&journal->j_state_lock); + +- if (commit_transaction->t_checkpoint_list == NULL && +- commit_transaction->t_checkpoint_io_list == NULL) { +- __jbd2_journal_drop_transaction(journal, commit_transaction); +- to_free = 1; ++ if (journal->j_checkpoint_transactions == NULL) { ++ journal->j_checkpoint_transactions = commit_transaction; ++ commit_transaction->t_cpnext = commit_transaction; ++ commit_transaction->t_cpprev = commit_transaction; + } else { +- if (journal->j_checkpoint_transactions == NULL) { +- journal->j_checkpoint_transactions = commit_transaction; +- commit_transaction->t_cpnext = commit_transaction; +- commit_transaction->t_cpprev = commit_transaction; +- } else { +- commit_transaction->t_cpnext = +- journal->j_checkpoint_transactions; +- commit_transaction->t_cpprev = +- commit_transaction->t_cpnext->t_cpprev; +- commit_transaction->t_cpnext->t_cpprev = +- commit_transaction; +- commit_transaction->t_cpprev->t_cpnext = ++ commit_transaction->t_cpnext = ++ journal->j_checkpoint_transactions; ++ commit_transaction->t_cpprev = ++ commit_transaction->t_cpnext->t_cpprev; ++ commit_transaction->t_cpnext->t_cpprev = ++ commit_transaction; ++ commit_transaction->t_cpprev->t_cpnext = + commit_transaction; +- } + } + spin_unlock(&journal->j_list_lock); +- ++ /* Drop all spin_locks because commit_callback may be block. ++ * __journal_remove_checkpoint() can not destroy transaction ++ * under us because it is not marked as T_FINISHED yet */ + if (journal->j_commit_callback) + journal->j_commit_callback(journal, commit_transaction); + + trace_jbd2_end_commit(journal, commit_transaction); + jbd_debug(1, "JBD2: commit %d complete, head %d\n", + journal->j_commit_sequence, journal->j_tail_sequence); +- if (to_free) +- jbd2_journal_free_transaction(commit_transaction); + ++ write_lock(&journal->j_state_lock); ++ spin_lock(&journal->j_list_lock); ++ commit_transaction->t_state = T_FINISHED; ++ /* Recheck checkpoint lists after j_list_lock was dropped */ ++ if (commit_transaction->t_checkpoint_list == NULL && ++ commit_transaction->t_checkpoint_io_list == NULL) { ++ __jbd2_journal_drop_transaction(journal, commit_transaction); ++ jbd2_journal_free_transaction(commit_transaction); ++ } ++ spin_unlock(&journal->j_list_lock); ++ write_unlock(&journal->j_state_lock); + wake_up(&journal->j_wait_done_commit); + } +diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c +index dbf41f9..42f8cf6c 100644 +--- a/fs/jbd2/journal.c ++++ b/fs/jbd2/journal.c +@@ -698,6 +698,37 @@ int jbd2_log_wait_commit(journal_t *journal, tid_t tid) + } + + /* ++ * When this function returns the transaction corresponding to tid ++ * will be completed. If the transaction has currently running, start ++ * committing that transaction before waiting for it to complete. If ++ * the transaction id is stale, it is by definition already completed, ++ * so just return SUCCESS. ++ */ ++int jbd2_complete_transaction(journal_t *journal, tid_t tid) ++{ ++ int need_to_wait = 1; ++ ++ read_lock(&journal->j_state_lock); ++ if (journal->j_running_transaction && ++ journal->j_running_transaction->t_tid == tid) { ++ if (journal->j_commit_request != tid) { ++ /* transaction not yet started, so request it */ ++ read_unlock(&journal->j_state_lock); ++ jbd2_log_start_commit(journal, tid); ++ goto wait_commit; ++ } ++ } else if (!(journal->j_committing_transaction && ++ journal->j_committing_transaction->t_tid == tid)) ++ need_to_wait = 0; ++ read_unlock(&journal->j_state_lock); ++ if (!need_to_wait) ++ return 0; ++wait_commit: ++ return jbd2_log_wait_commit(journal, tid); ++} ++EXPORT_SYMBOL(jbd2_complete_transaction); ++ ++/* + * Log buffer allocation routines: + */ + +diff --git a/fs/lockd/clntlock.c b/fs/lockd/clntlock.c +index ca0a080..193f04c 100644 +--- a/fs/lockd/clntlock.c ++++ b/fs/lockd/clntlock.c +@@ -144,6 +144,9 @@ int nlmclnt_block(struct nlm_wait *block, struct nlm_rqst *req, long timeout) + timeout); + if (ret < 0) + return -ERESTARTSYS; ++ /* Reset the lock status after a server reboot so we resend */ ++ if (block->b_status == nlm_lck_denied_grace_period) ++ block->b_status = nlm_lck_blocked; + req->a_res.status = block->b_status; + return 0; + } +diff --git a/fs/lockd/clntproc.c b/fs/lockd/clntproc.c +index 52e5120..54f9e6c 100644 +--- a/fs/lockd/clntproc.c ++++ b/fs/lockd/clntproc.c +@@ -550,9 +550,6 @@ again: + status = nlmclnt_block(block, req, NLMCLNT_POLL_TIMEOUT); + if (status < 0) + break; +- /* Resend the blocking lock request after a server reboot */ +- if (resp->status == nlm_lck_denied_grace_period) +- continue; + if (resp->status != nlm_lck_blocked) + break; + } +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 3d905e3..51d53a4 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -1374,6 +1374,12 @@ int nfs4_open_delegation_recall(struct nfs_open_context *ctx, struct nfs4_state + case -ENOMEM: + err = 0; + goto out; ++ case -NFS4ERR_DELAY: ++ case -NFS4ERR_GRACE: ++ set_bit(NFS_DELEGATED_STATE, &state->flags); ++ ssleep(1); ++ err = -EAGAIN; ++ goto out; + } + err = nfs4_handle_exception(server, err, &exception); + } while (exception.retry); +diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c +index 9d1c5db..ec668e1 100644 +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -931,14 +931,14 @@ nfsd4_write(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, + nfs4_lock_state(); + status = nfs4_preprocess_stateid_op(SVC_NET(rqstp), + cstate, stateid, WR_STATE, &filp); +- if (filp) +- get_file(filp); +- nfs4_unlock_state(); +- + if (status) { ++ nfs4_unlock_state(); + dprintk("NFSD: nfsd4_write: couldn't process stateid!\n"); + return status; + } ++ if (filp) ++ get_file(filp); ++ nfs4_unlock_state(); + + cnt = write->wr_buflen; + write->wr_how_written = write->wr_stable_how; +diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c +index a8309c6..53a7c64 100644 +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -210,13 +210,7 @@ static void __nfs4_file_put_access(struct nfs4_file *fp, int oflag) + { + if (atomic_dec_and_test(&fp->fi_access[oflag])) { + nfs4_file_put_fd(fp, oflag); +- /* +- * It's also safe to get rid of the RDWR open *if* +- * we no longer have need of the other kind of access +- * or if we already have the other kind of open: +- */ +- if (fp->fi_fds[1-oflag] +- || atomic_read(&fp->fi_access[1 - oflag]) == 0) ++ if (atomic_read(&fp->fi_access[1 - oflag]) == 0) + nfs4_file_put_fd(fp, O_RDWR); + } + } +diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c +index d1dd710..cd5e6c1 100644 +--- a/fs/nfsd/nfs4xdr.c ++++ b/fs/nfsd/nfs4xdr.c +@@ -344,10 +344,7 @@ nfsd4_decode_fattr(struct nfsd4_compoundargs *argp, u32 *bmval, + all 32 bits of 'nseconds'. */ + READ_BUF(12); + len += 12; +- READ32(dummy32); +- if (dummy32) +- return nfserr_inval; +- READ32(iattr->ia_atime.tv_sec); ++ READ64(iattr->ia_atime.tv_sec); + READ32(iattr->ia_atime.tv_nsec); + if (iattr->ia_atime.tv_nsec >= (u32)1000000000) + return nfserr_inval; +@@ -370,10 +367,7 @@ nfsd4_decode_fattr(struct nfsd4_compoundargs *argp, u32 *bmval, + all 32 bits of 'nseconds'. */ + READ_BUF(12); + len += 12; +- READ32(dummy32); +- if (dummy32) +- return nfserr_inval; +- READ32(iattr->ia_mtime.tv_sec); ++ READ64(iattr->ia_mtime.tv_sec); + READ32(iattr->ia_mtime.tv_nsec); + if (iattr->ia_mtime.tv_nsec >= (u32)1000000000) + return nfserr_inval; +@@ -2386,8 +2380,7 @@ out_acl: + if (bmval1 & FATTR4_WORD1_TIME_ACCESS) { + if ((buflen -= 12) < 0) + goto out_resource; +- WRITE32(0); +- WRITE32(stat.atime.tv_sec); ++ WRITE64((s64)stat.atime.tv_sec); + WRITE32(stat.atime.tv_nsec); + } + if (bmval1 & FATTR4_WORD1_TIME_DELTA) { +@@ -2400,15 +2393,13 @@ out_acl: + if (bmval1 & FATTR4_WORD1_TIME_METADATA) { + if ((buflen -= 12) < 0) + goto out_resource; +- WRITE32(0); +- WRITE32(stat.ctime.tv_sec); ++ WRITE64((s64)stat.ctime.tv_sec); + WRITE32(stat.ctime.tv_nsec); + } + if (bmval1 & FATTR4_WORD1_TIME_MODIFY) { + if ((buflen -= 12) < 0) + goto out_resource; +- WRITE32(0); +- WRITE32(stat.mtime.tv_sec); ++ WRITE64((s64)stat.mtime.tv_sec); + WRITE32(stat.mtime.tv_nsec); + } + if (bmval1 & FATTR4_WORD1_MOUNTED_ON_FILEID) { +diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c +index 07f7a92..595343e 100644 +--- a/fs/notify/inotify/inotify_user.c ++++ b/fs/notify/inotify/inotify_user.c +@@ -574,7 +574,6 @@ static int inotify_update_existing_watch(struct fsnotify_group *group, + int add = (arg & IN_MASK_ADD); + int ret; + +- /* don't allow invalid bits: we don't want flags set */ + mask = inotify_arg_to_mask(arg); + + fsn_mark = fsnotify_find_inode_mark(group, inode); +@@ -625,7 +624,6 @@ static int inotify_new_watch(struct fsnotify_group *group, + struct idr *idr = &group->inotify_data.idr; + spinlock_t *idr_lock = &group->inotify_data.idr_lock; + +- /* don't allow invalid bits: we don't want flags set */ + mask = inotify_arg_to_mask(arg); + + tmp_i_mark = kmem_cache_alloc(inotify_inode_mark_cachep, GFP_KERNEL); +@@ -753,6 +751,10 @@ SYSCALL_DEFINE3(inotify_add_watch, int, fd, const char __user *, pathname, + int ret; + unsigned flags = 0; + ++ /* don't allow invalid bits: we don't want flags set */ ++ if (unlikely(!(mask & ALL_INOTIFY_BITS))) ++ return -EINVAL; ++ + f = fdget(fd); + if (unlikely(!f.file)) + return -EBADF; +diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c +index 1f8c823..d924812 100644 +--- a/fs/sysfs/dir.c ++++ b/fs/sysfs/dir.c +@@ -1012,6 +1012,7 @@ static int sysfs_readdir(struct file * filp, void * dirent, filldir_t filldir) + enum kobj_ns_type type; + const void *ns; + ino_t ino; ++ loff_t off; + + type = sysfs_ns_type(parent_sd); + ns = sysfs_info(dentry->d_sb)->ns[type]; +@@ -1034,6 +1035,7 @@ static int sysfs_readdir(struct file * filp, void * dirent, filldir_t filldir) + return 0; + } + mutex_lock(&sysfs_mutex); ++ off = filp->f_pos; + for (pos = sysfs_dir_pos(ns, parent_sd, filp->f_pos, pos); + pos; + pos = sysfs_dir_next_pos(ns, parent_sd, filp->f_pos, pos)) { +@@ -1045,19 +1047,24 @@ static int sysfs_readdir(struct file * filp, void * dirent, filldir_t filldir) + len = strlen(name); + ino = pos->s_ino; + type = dt_type(pos); +- filp->f_pos = pos->s_hash; ++ off = filp->f_pos = pos->s_hash; + filp->private_data = sysfs_get(pos); + + mutex_unlock(&sysfs_mutex); +- ret = filldir(dirent, name, len, filp->f_pos, ino, type); ++ ret = filldir(dirent, name, len, off, ino, type); + mutex_lock(&sysfs_mutex); + if (ret < 0) + break; + } + mutex_unlock(&sysfs_mutex); +- if ((filp->f_pos > 1) && !pos) { /* EOF */ +- filp->f_pos = INT_MAX; ++ ++ /* don't reference last entry if its refcount is dropped */ ++ if (!pos) { + filp->private_data = NULL; ++ ++ /* EOF and not changed as 0 or 1 in read/write path */ ++ if (off == filp->f_pos && off > 1) ++ filp->f_pos = INT_MAX; + } + return 0; + } +diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h +index 5cf680a..f50a87d 100644 +--- a/include/asm-generic/pgtable.h ++++ b/include/asm-generic/pgtable.h +@@ -7,6 +7,16 @@ + #include <linux/mm_types.h> + #include <linux/bug.h> + ++/* ++ * On almost all architectures and configurations, 0 can be used as the ++ * upper ceiling to free_pgtables(): on many architectures it has the same ++ * effect as using TASK_SIZE. However, there is one configuration which ++ * must impose a more careful limit, to avoid freeing kernel pgtables. ++ */ ++#ifndef USER_PGTABLES_CEILING ++#define USER_PGTABLES_CEILING 0UL ++#endif ++ + #ifndef __HAVE_ARCH_PTEP_SET_ACCESS_FLAGS + extern int ptep_set_access_flags(struct vm_area_struct *vma, + unsigned long address, pte_t *ptep, +diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h +index 7d73905..2322df7 100644 +--- a/include/linux/cgroup.h ++++ b/include/linux/cgroup.h +@@ -303,9 +303,6 @@ struct cftype { + /* CFTYPE_* flags */ + unsigned int flags; + +- /* file xattrs */ +- struct simple_xattrs xattrs; +- + int (*open)(struct inode *inode, struct file *file); + ssize_t (*read)(struct cgroup *cgrp, struct cftype *cft, + struct file *file, +diff --git a/include/linux/ipc_namespace.h b/include/linux/ipc_namespace.h +index ae221a7..c4d870b 100644 +--- a/include/linux/ipc_namespace.h ++++ b/include/linux/ipc_namespace.h +@@ -43,8 +43,8 @@ struct ipc_namespace { + + size_t shm_ctlmax; + size_t shm_ctlall; ++ unsigned long shm_tot; + int shm_ctlmni; +- int shm_tot; + /* + * Defines whether IPC_RMID is forced for _all_ shm segments regardless + * of shmctl() +diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h +index e30b663..383bef0 100644 +--- a/include/linux/jbd2.h ++++ b/include/linux/jbd2.h +@@ -498,6 +498,7 @@ struct transaction_s + T_COMMIT, + T_COMMIT_DFLUSH, + T_COMMIT_JFLUSH, ++ T_COMMIT_CALLBACK, + T_FINISHED + } t_state; + +@@ -1210,6 +1211,7 @@ int __jbd2_log_start_commit(journal_t *journal, tid_t tid); + int jbd2_journal_start_commit(journal_t *journal, tid_t *tid); + int jbd2_journal_force_commit_nested(journal_t *journal); + int jbd2_log_wait_commit(journal_t *journal, tid_t tid); ++int jbd2_complete_transaction(journal_t *journal, tid_t tid); + int jbd2_log_do_checkpoint(journal_t *journal); + int jbd2_trans_will_send_data_barrier(journal_t *journal, tid_t tid); + +diff --git a/include/linux/sched.h b/include/linux/sched.h +index 7e49270..f5ad26e 100644 +--- a/include/linux/sched.h ++++ b/include/linux/sched.h +@@ -2486,27 +2486,18 @@ static inline void threadgroup_change_end(struct task_struct *tsk) + * + * Lock the threadgroup @tsk belongs to. No new task is allowed to enter + * and member tasks aren't allowed to exit (as indicated by PF_EXITING) or +- * perform exec. This is useful for cases where the threadgroup needs to +- * stay stable across blockable operations. ++ * change ->group_leader/pid. This is useful for cases where the threadgroup ++ * needs to stay stable across blockable operations. + * + * fork and exit paths explicitly call threadgroup_change_{begin|end}() for + * synchronization. While held, no new task will be added to threadgroup + * and no existing live task will have its PF_EXITING set. + * +- * During exec, a task goes and puts its thread group through unusual +- * changes. After de-threading, exclusive access is assumed to resources +- * which are usually shared by tasks in the same group - e.g. sighand may +- * be replaced with a new one. Also, the exec'ing task takes over group +- * leader role including its pid. Exclude these changes while locked by +- * grabbing cred_guard_mutex which is used to synchronize exec path. ++ * de_thread() does threadgroup_change_{begin|end}() when a non-leader ++ * sub-thread becomes a new leader. + */ + static inline void threadgroup_lock(struct task_struct *tsk) + { +- /* +- * exec uses exit for de-threading nesting group_rwsem inside +- * cred_guard_mutex. Grab cred_guard_mutex first. +- */ +- mutex_lock(&tsk->signal->cred_guard_mutex); + down_write(&tsk->signal->group_rwsem); + } + +@@ -2519,7 +2510,6 @@ static inline void threadgroup_lock(struct task_struct *tsk) + static inline void threadgroup_unlock(struct task_struct *tsk) + { + up_write(&tsk->signal->group_rwsem); +- mutex_unlock(&tsk->signal->cred_guard_mutex); + } + #else + static inline void threadgroup_change_begin(struct task_struct *tsk) {} +diff --git a/include/sound/emu10k1.h b/include/sound/emu10k1.h +index f841ba4..dfb42ca 100644 +--- a/include/sound/emu10k1.h ++++ b/include/sound/emu10k1.h +@@ -1787,6 +1787,7 @@ struct snd_emu10k1 { + unsigned int next_free_voice; + + const struct firmware *firmware; ++ const struct firmware *dock_fw; + + #ifdef CONFIG_PM_SLEEP + unsigned int *saved_ptr; +diff --git a/ipc/shm.c b/ipc/shm.c +index 4fa6d8f..9bab650 100644 +--- a/ipc/shm.c ++++ b/ipc/shm.c +@@ -462,7 +462,7 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params) + size_t size = params->u.size; + int error; + struct shmid_kernel *shp; +- int numpages = (size + PAGE_SIZE -1) >> PAGE_SHIFT; ++ size_t numpages = (size + PAGE_SIZE - 1) >> PAGE_SHIFT; + struct file * file; + char name[13]; + int id; +diff --git a/kernel/cgroup.c b/kernel/cgroup.c +index 1e23664..cddf1d9 100644 +--- a/kernel/cgroup.c ++++ b/kernel/cgroup.c +@@ -162,6 +162,9 @@ struct cfent { + struct list_head node; + struct dentry *dentry; + struct cftype *type; ++ ++ /* file xattrs */ ++ struct simple_xattrs xattrs; + }; + + /* +@@ -908,13 +911,12 @@ static void cgroup_diput(struct dentry *dentry, struct inode *inode) + } else { + struct cfent *cfe = __d_cfe(dentry); + struct cgroup *cgrp = dentry->d_parent->d_fsdata; +- struct cftype *cft = cfe->type; + + WARN_ONCE(!list_empty(&cfe->node) && + cgrp != &cgrp->root->top_cgroup, + "cfe still linked for %s\n", cfe->type->name); ++ simple_xattrs_free(&cfe->xattrs); + kfree(cfe); +- simple_xattrs_free(&cft->xattrs); + } + iput(inode); + } +@@ -2066,7 +2068,7 @@ static int cgroup_attach_proc(struct cgroup *cgrp, struct task_struct *leader) + if (!group) + return -ENOMEM; + /* pre-allocate to guarantee space while iterating in rcu read-side. */ +- retval = flex_array_prealloc(group, 0, group_size - 1, GFP_KERNEL); ++ retval = flex_array_prealloc(group, 0, group_size, GFP_KERNEL); + if (retval) + goto out_free_group_list; + +@@ -2553,7 +2555,7 @@ static struct simple_xattrs *__d_xattrs(struct dentry *dentry) + if (S_ISDIR(dentry->d_inode->i_mode)) + return &__d_cgrp(dentry)->xattrs; + else +- return &__d_cft(dentry)->xattrs; ++ return &__d_cfe(dentry)->xattrs; + } + + static inline int xattr_enabled(struct dentry *dentry) +@@ -2729,8 +2731,6 @@ static int cgroup_add_file(struct cgroup *cgrp, struct cgroup_subsys *subsys, + umode_t mode; + char name[MAX_CGROUP_TYPE_NAMELEN + MAX_CFTYPE_NAME + 2] = { 0 }; + +- simple_xattrs_init(&cft->xattrs); +- + if (subsys && !test_bit(ROOT_NOPREFIX, &cgrp->root->flags)) { + strcpy(name, subsys->name); + strcat(name, "."); +@@ -2755,6 +2755,7 @@ static int cgroup_add_file(struct cgroup *cgrp, struct cgroup_subsys *subsys, + cfe->type = (void *)cft; + cfe->dentry = dentry; + dentry->d_fsdata = cfe; ++ simple_xattrs_init(&cfe->xattrs); + list_add_tail(&cfe->node, &parent->files); + cfe = NULL; + } +diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c +index e4cee8d..60f7e32 100644 +--- a/kernel/hrtimer.c ++++ b/kernel/hrtimer.c +@@ -298,6 +298,10 @@ ktime_t ktime_sub_ns(const ktime_t kt, u64 nsec) + } else { + unsigned long rem = do_div(nsec, NSEC_PER_SEC); + ++ /* Make sure nsec fits into long */ ++ if (unlikely(nsec > KTIME_SEC_MAX)) ++ return (ktime_t){ .tv64 = KTIME_MAX }; ++ + tmp = ktime_set((long)nsec, rem); + } + +@@ -1308,6 +1312,8 @@ retry: + + expires = ktime_sub(hrtimer_get_expires(timer), + base->offset); ++ if (expires.tv64 < 0) ++ expires.tv64 = KTIME_MAX; + if (expires.tv64 < expires_next.tv64) + expires_next = expires; + break; +diff --git a/kernel/rcutree_trace.c b/kernel/rcutree_trace.c +index 0d095dc..93f8e8f 100644 +--- a/kernel/rcutree_trace.c ++++ b/kernel/rcutree_trace.c +@@ -97,7 +97,7 @@ static const struct file_operations rcubarrier_fops = { + .open = rcubarrier_open, + .read = seq_read, + .llseek = no_llseek, +- .release = seq_release, ++ .release = single_release, + }; + + #ifdef CONFIG_RCU_BOOST +@@ -208,7 +208,7 @@ static const struct file_operations rcuexp_fops = { + .open = rcuexp_open, + .read = seq_read, + .llseek = no_llseek, +- .release = seq_release, ++ .release = single_release, + }; + + #ifdef CONFIG_RCU_BOOST +@@ -308,7 +308,7 @@ static const struct file_operations rcuhier_fops = { + .open = rcuhier_open, + .read = seq_read, + .llseek = no_llseek, +- .release = seq_release, ++ .release = single_release, + }; + + static void show_one_rcugp(struct seq_file *m, struct rcu_state *rsp) +@@ -350,7 +350,7 @@ static const struct file_operations rcugp_fops = { + .open = rcugp_open, + .read = seq_read, + .llseek = no_llseek, +- .release = seq_release, ++ .release = single_release, + }; + + static void print_one_rcu_pending(struct seq_file *m, struct rcu_data *rdp) +diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c +index a13987a..239a323 100644 +--- a/kernel/time/tick-broadcast.c ++++ b/kernel/time/tick-broadcast.c +@@ -66,6 +66,8 @@ static void tick_broadcast_start_periodic(struct clock_event_device *bc) + */ + int tick_check_broadcast_device(struct clock_event_device *dev) + { ++ struct clock_event_device *cur = tick_broadcast_device.evtdev; ++ + if ((dev->features & CLOCK_EVT_FEAT_DUMMY) || + (tick_broadcast_device.evtdev && + tick_broadcast_device.evtdev->rating >= dev->rating) || +@@ -73,6 +75,8 @@ int tick_check_broadcast_device(struct clock_event_device *dev) + return 0; + + clockevents_exchange_device(tick_broadcast_device.evtdev, dev); ++ if (cur) ++ cur->event_handler = clockevents_handle_noop; + tick_broadcast_device.evtdev = dev; + if (!cpumask_empty(tick_get_broadcast_mask())) + tick_broadcast_start_periodic(dev); +diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c +index b1600a6..7076b3f 100644 +--- a/kernel/time/tick-common.c ++++ b/kernel/time/tick-common.c +@@ -323,6 +323,7 @@ static void tick_shutdown(unsigned int *cpup) + */ + dev->mode = CLOCK_EVT_MODE_UNUSED; + clockevents_exchange_device(dev, NULL); ++ dev->event_handler = clockevents_handle_noop; + td->evtdev = NULL; + } + raw_spin_unlock_irqrestore(&tick_device_lock, flags); +diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c +index 35cc3a8..03dbc77 100644 +--- a/kernel/trace/ftrace.c ++++ b/kernel/trace/ftrace.c +@@ -650,7 +650,7 @@ int ftrace_profile_pages_init(struct ftrace_profile_stat *stat) + + pages = DIV_ROUND_UP(functions, PROFILES_PER_PAGE); + +- for (i = 0; i < pages; i++) { ++ for (i = 1; i < pages; i++) { + pg->next = (void *)get_zeroed_page(GFP_KERNEL); + if (!pg->next) + goto out_free; +@@ -3714,7 +3714,8 @@ out: + if (fail) + return -EINVAL; + +- ftrace_graph_filter_enabled = 1; ++ ftrace_graph_filter_enabled = !!(*idx); ++ + return 0; + } + +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index fe1d581..1c82852 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -4885,6 +4885,8 @@ static __init int tracer_init_debugfs(void) + trace_access_lock_init(); + + d_tracer = tracing_init_dentry(); ++ if (!d_tracer) ++ return 0; + + trace_create_file("trace_options", 0644, d_tracer, + NULL, &tracing_iter_fops); +diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c +index 83a8b5b..b20428c 100644 +--- a/kernel/trace/trace_stack.c ++++ b/kernel/trace/trace_stack.c +@@ -20,13 +20,24 @@ + + #define STACK_TRACE_ENTRIES 500 + ++#ifdef CC_USING_FENTRY ++# define fentry 1 ++#else ++# define fentry 0 ++#endif ++ + static unsigned long stack_dump_trace[STACK_TRACE_ENTRIES+1] = + { [0 ... (STACK_TRACE_ENTRIES)] = ULONG_MAX }; + static unsigned stack_dump_index[STACK_TRACE_ENTRIES]; + ++/* ++ * Reserve one entry for the passed in ip. This will allow ++ * us to remove most or all of the stack size overhead ++ * added by the stack tracer itself. ++ */ + static struct stack_trace max_stack_trace = { +- .max_entries = STACK_TRACE_ENTRIES, +- .entries = stack_dump_trace, ++ .max_entries = STACK_TRACE_ENTRIES - 1, ++ .entries = &stack_dump_trace[1], + }; + + static unsigned long max_stack_size; +@@ -39,25 +50,34 @@ static DEFINE_MUTEX(stack_sysctl_mutex); + int stack_tracer_enabled; + static int last_stack_tracer_enabled; + +-static inline void check_stack(void) ++static inline void ++check_stack(unsigned long ip, unsigned long *stack) + { + unsigned long this_size, flags; + unsigned long *p, *top, *start; ++ static int tracer_frame; ++ int frame_size = ACCESS_ONCE(tracer_frame); + int i; + +- this_size = ((unsigned long)&this_size) & (THREAD_SIZE-1); ++ this_size = ((unsigned long)stack) & (THREAD_SIZE-1); + this_size = THREAD_SIZE - this_size; ++ /* Remove the frame of the tracer */ ++ this_size -= frame_size; + + if (this_size <= max_stack_size) + return; + + /* we do not handle interrupt stacks yet */ +- if (!object_is_on_stack(&this_size)) ++ if (!object_is_on_stack(stack)) + return; + + local_irq_save(flags); + arch_spin_lock(&max_stack_lock); + ++ /* In case another CPU set the tracer_frame on us */ ++ if (unlikely(!frame_size)) ++ this_size -= tracer_frame; ++ + /* a race could have already updated it */ + if (this_size <= max_stack_size) + goto out; +@@ -70,10 +90,18 @@ static inline void check_stack(void) + save_stack_trace(&max_stack_trace); + + /* ++ * Add the passed in ip from the function tracer. ++ * Searching for this on the stack will skip over ++ * most of the overhead from the stack tracer itself. ++ */ ++ stack_dump_trace[0] = ip; ++ max_stack_trace.nr_entries++; ++ ++ /* + * Now find where in the stack these are. + */ + i = 0; +- start = &this_size; ++ start = stack; + top = (unsigned long *) + (((unsigned long)start & ~(THREAD_SIZE-1)) + THREAD_SIZE); + +@@ -97,6 +125,18 @@ static inline void check_stack(void) + found = 1; + /* Start the search from here */ + start = p + 1; ++ /* ++ * We do not want to show the overhead ++ * of the stack tracer stack in the ++ * max stack. If we haven't figured ++ * out what that is, then figure it out ++ * now. ++ */ ++ if (unlikely(!tracer_frame) && i == 1) { ++ tracer_frame = (p - stack) * ++ sizeof(unsigned long); ++ max_stack_size -= tracer_frame; ++ } + } + } + +@@ -113,6 +153,7 @@ static void + stack_trace_call(unsigned long ip, unsigned long parent_ip, + struct ftrace_ops *op, struct pt_regs *pt_regs) + { ++ unsigned long stack; + int cpu; + + preempt_disable_notrace(); +@@ -122,7 +163,26 @@ stack_trace_call(unsigned long ip, unsigned long parent_ip, + if (per_cpu(trace_active, cpu)++ != 0) + goto out; + +- check_stack(); ++ /* ++ * When fentry is used, the traced function does not get ++ * its stack frame set up, and we lose the parent. ++ * The ip is pretty useless because the function tracer ++ * was called before that function set up its stack frame. ++ * In this case, we use the parent ip. ++ * ++ * By adding the return address of either the parent ip ++ * or the current ip we can disregard most of the stack usage ++ * caused by the stack tracer itself. ++ * ++ * The function tracer always reports the address of where the ++ * mcount call was, but the stack will hold the return address. ++ */ ++ if (fentry) ++ ip = parent_ip; ++ else ++ ip += MCOUNT_INSN_SIZE; ++ ++ check_stack(ip, &stack); + + out: + per_cpu(trace_active, cpu)--; +@@ -371,6 +431,8 @@ static __init int stack_trace_init(void) + struct dentry *d_tracer; + + d_tracer = tracing_init_dentry(); ++ if (!d_tracer) ++ return 0; + + trace_create_file("stack_max_size", 0644, d_tracer, + &max_stack_size, &stack_max_size_fops); +diff --git a/kernel/trace/trace_stat.c b/kernel/trace/trace_stat.c +index 96cffb2..847f88a 100644 +--- a/kernel/trace/trace_stat.c ++++ b/kernel/trace/trace_stat.c +@@ -307,6 +307,8 @@ static int tracing_stat_init(void) + struct dentry *d_tracing; + + d_tracing = tracing_init_dentry(); ++ if (!d_tracing) ++ return 0; + + stat_dir = debugfs_create_dir("trace_stat", d_tracing); + if (!stat_dir) +diff --git a/lib/oid_registry.c b/lib/oid_registry.c +index d8de11f..318f382 100644 +--- a/lib/oid_registry.c ++++ b/lib/oid_registry.c +@@ -9,6 +9,7 @@ + * 2 of the Licence, or (at your option) any later version. + */ + ++#include <linux/module.h> + #include <linux/export.h> + #include <linux/oid_registry.h> + #include <linux/kernel.h> +@@ -16,6 +17,10 @@ + #include <linux/bug.h> + #include "oid_registry_data.c" + ++MODULE_DESCRIPTION("OID Registry"); ++MODULE_AUTHOR("Red Hat, Inc."); ++MODULE_LICENSE("GPL"); ++ + /** + * look_up_OID - Find an OID registration for the specified data + * @data: Binary representation of the OID +diff --git a/mm/mmap.c b/mm/mmap.c +index 90db251..32f3372 100644 +--- a/mm/mmap.c ++++ b/mm/mmap.c +@@ -2289,7 +2289,7 @@ static void unmap_region(struct mm_struct *mm, + update_hiwater_rss(mm); + unmap_vmas(&tlb, vma, start, end); + free_pgtables(&tlb, vma, prev ? prev->vm_end : FIRST_USER_ADDRESS, +- next ? next->vm_start : 0); ++ next ? next->vm_start : USER_PGTABLES_CEILING); + tlb_finish_mmu(&tlb, start, end); + } + +@@ -2667,7 +2667,7 @@ void exit_mmap(struct mm_struct *mm) + /* Use -1 here to ensure all VMAs in the mm are unmapped */ + unmap_vmas(&tlb, vma, 0, -1); + +- free_pgtables(&tlb, vma, FIRST_USER_ADDRESS, 0); ++ free_pgtables(&tlb, vma, FIRST_USER_ADDRESS, USER_PGTABLES_CEILING); + tlb_finish_mmu(&tlb, 0, -1); + + /* +diff --git a/mm/page_io.c b/mm/page_io.c +index 78eee32..6182870 100644 +--- a/mm/page_io.c ++++ b/mm/page_io.c +@@ -214,6 +214,7 @@ int swap_writepage(struct page *page, struct writeback_control *wbc) + kiocb.ki_left = PAGE_SIZE; + kiocb.ki_nbytes = PAGE_SIZE; + ++ set_page_writeback(page); + unlock_page(page); + ret = mapping->a_ops->direct_IO(KERNEL_WRITE, + &kiocb, &iov, +@@ -222,7 +223,23 @@ int swap_writepage(struct page *page, struct writeback_control *wbc) + if (ret == PAGE_SIZE) { + count_vm_event(PSWPOUT); + ret = 0; ++ } else { ++ /* ++ * In the case of swap-over-nfs, this can be a ++ * temporary failure if the system has limited ++ * memory for allocating transmit buffers. ++ * Mark the page dirty and avoid ++ * rotate_reclaimable_page but rate-limit the ++ * messages but do not flag PageError like ++ * the normal direct-to-bio case as it could ++ * be temporary. ++ */ ++ set_page_dirty(page); ++ ClearPageReclaim(page); ++ pr_err_ratelimited("Write error on dio swapfile (%Lu)\n", ++ page_file_offset(page)); + } ++ end_page_writeback(page); + return ret; + } + +diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c +index 79a48f3..64619f4 100644 +--- a/net/mac80211/pm.c ++++ b/net/mac80211/pm.c +@@ -52,8 +52,8 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan) + ieee80211_stop_queues_by_reason(hw, + IEEE80211_QUEUE_STOP_REASON_SUSPEND); + +- /* flush out all packets */ +- synchronize_net(); ++ /* flush out all packets and station cleanup call_rcu()s */ ++ rcu_barrier(); + + drv_flush(local, false); + +diff --git a/net/wireless/reg.c b/net/wireless/reg.c +index 82c4fc7..91ef82b 100644 +--- a/net/wireless/reg.c ++++ b/net/wireless/reg.c +@@ -883,7 +883,7 @@ static void handle_channel(struct wiphy *wiphy, + return; + + REG_DBG_PRINT("Disabling freq %d MHz\n", chan->center_freq); +- chan->flags = IEEE80211_CHAN_DISABLED; ++ chan->flags |= IEEE80211_CHAN_DISABLED; + return; + } + +diff --git a/scripts/kconfig/streamline_config.pl b/scripts/kconfig/streamline_config.pl +index 3368939..68b85e1 100644 +--- a/scripts/kconfig/streamline_config.pl ++++ b/scripts/kconfig/streamline_config.pl +@@ -156,7 +156,6 @@ sub read_kconfig { + + my $state = "NONE"; + my $config; +- my @kconfigs; + + my $cont = 0; + my $line; +@@ -190,7 +189,13 @@ sub read_kconfig { + + # collect any Kconfig sources + if (/^source\s*"(.*)"/) { +- $kconfigs[$#kconfigs+1] = $1; ++ my $kconfig = $1; ++ # prevent reading twice. ++ if (!defined($read_kconfigs{$kconfig})) { ++ $read_kconfigs{$kconfig} = 1; ++ read_kconfig($kconfig); ++ } ++ next; + } + + # configs found +@@ -250,14 +255,6 @@ sub read_kconfig { + } + } + close($kinfile); +- +- # read in any configs that were found. +- foreach my $kconfig (@kconfigs) { +- if (!defined($read_kconfigs{$kconfig})) { +- $read_kconfigs{$kconfig} = 1; +- read_kconfig($kconfig); +- } +- } + } + + if ($kconfig) { +diff --git a/sound/pci/emu10k1/emu10k1_main.c b/sound/pci/emu10k1/emu10k1_main.c +index e6b0166..bdd888e 100644 +--- a/sound/pci/emu10k1/emu10k1_main.c ++++ b/sound/pci/emu10k1/emu10k1_main.c +@@ -657,14 +657,14 @@ static int snd_emu10k1_cardbus_init(struct snd_emu10k1 *emu) + return 0; + } + +-static int snd_emu1010_load_firmware(struct snd_emu10k1 *emu) ++static int snd_emu1010_load_firmware(struct snd_emu10k1 *emu, ++ const struct firmware *fw_entry) + { + int n, i; + int reg; + int value; + unsigned int write_post; + unsigned long flags; +- const struct firmware *fw_entry = emu->firmware; + + if (!fw_entry) + return -EIO; +@@ -725,9 +725,34 @@ static int emu1010_firmware_thread(void *data) + /* Return to Audio Dock programming mode */ + snd_printk(KERN_INFO "emu1010: Loading Audio Dock Firmware\n"); + snd_emu1010_fpga_write(emu, EMU_HANA_FPGA_CONFIG, EMU_HANA_FPGA_CONFIG_AUDIODOCK); +- err = snd_emu1010_load_firmware(emu); +- if (err != 0) +- continue; ++ ++ if (!emu->dock_fw) { ++ const char *filename = NULL; ++ switch (emu->card_capabilities->emu_model) { ++ case EMU_MODEL_EMU1010: ++ filename = DOCK_FILENAME; ++ break; ++ case EMU_MODEL_EMU1010B: ++ filename = MICRO_DOCK_FILENAME; ++ break; ++ case EMU_MODEL_EMU1616: ++ filename = MICRO_DOCK_FILENAME; ++ break; ++ } ++ if (filename) { ++ err = request_firmware(&emu->dock_fw, ++ filename, ++ &emu->pci->dev); ++ if (err) ++ continue; ++ } ++ } ++ ++ if (emu->dock_fw) { ++ err = snd_emu1010_load_firmware(emu, emu->dock_fw); ++ if (err) ++ continue; ++ } + + snd_emu1010_fpga_write(emu, EMU_HANA_FPGA_CONFIG, 0); + snd_emu1010_fpga_read(emu, EMU_HANA_IRQ_STATUS, ®); +@@ -862,7 +887,7 @@ static int snd_emu10k1_emu1010_init(struct snd_emu10k1 *emu) + filename, emu->firmware->size); + } + +- err = snd_emu1010_load_firmware(emu); ++ err = snd_emu1010_load_firmware(emu, emu->firmware); + if (err != 0) { + snd_printk(KERN_INFO "emu1010: Loading Firmware failed\n"); + return err; +@@ -1253,6 +1278,8 @@ static int snd_emu10k1_free(struct snd_emu10k1 *emu) + kthread_stop(emu->emu1010.firmware_thread); + if (emu->firmware) + release_firmware(emu->firmware); ++ if (emu->dock_fw) ++ release_firmware(emu->dock_fw); + if (emu->irq >= 0) + free_irq(emu->irq, emu); + /* remove reserved page */ +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index ee975a2..7f45d48 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5823,6 +5823,7 @@ enum { + ALC269_TYPE_ALC280, + ALC269_TYPE_ALC282, + ALC269_TYPE_ALC284, ++ ALC269_TYPE_ALC286, + }; + + /* +@@ -5846,6 +5847,7 @@ static int alc269_parse_auto_config(struct hda_codec *codec) + case ALC269_TYPE_ALC269VB: + case ALC269_TYPE_ALC269VD: + case ALC269_TYPE_ALC282: ++ case ALC269_TYPE_ALC286: + ssids = alc269_ssids; + break; + default: +@@ -6451,6 +6453,9 @@ static int patch_alc269(struct hda_codec *codec) + case 0x10ec0292: + spec->codec_variant = ALC269_TYPE_ALC284; + break; ++ case 0x10ec0286: ++ spec->codec_variant = ALC269_TYPE_ALC286; ++ break; + } + + /* automatic parse from the BIOS config */ +@@ -7157,6 +7162,7 @@ static const struct hda_codec_preset snd_hda_preset_realtek[] = { + { .id = 0x10ec0282, .name = "ALC282", .patch = patch_alc269 }, + { .id = 0x10ec0283, .name = "ALC283", .patch = patch_alc269 }, + { .id = 0x10ec0284, .name = "ALC284", .patch = patch_alc269 }, ++ { .id = 0x10ec0286, .name = "ALC286", .patch = patch_alc269 }, + { .id = 0x10ec0290, .name = "ALC290", .patch = patch_alc269 }, + { .id = 0x10ec0292, .name = "ALC292", .patch = patch_alc269 }, + { .id = 0x10ec0861, .rev = 0x100340, .name = "ALC660", +diff --git a/sound/soc/codecs/max98088.c b/sound/soc/codecs/max98088.c +index a4c16fd..5d36319 100644 +--- a/sound/soc/codecs/max98088.c ++++ b/sound/soc/codecs/max98088.c +@@ -2006,7 +2006,7 @@ static int max98088_probe(struct snd_soc_codec *codec) + ret); + goto err_access; + } +- dev_info(codec->dev, "revision %c\n", ret + 'A'); ++ dev_info(codec->dev, "revision %c\n", ret - 0x40 + 'A'); + + snd_soc_write(codec, M98088_REG_51_PWR_SYS, M98088_PWRSV); + +diff --git a/sound/usb/6fire/pcm.c b/sound/usb/6fire/pcm.c +index e2ca12f..40dd50a 100644 +--- a/sound/usb/6fire/pcm.c ++++ b/sound/usb/6fire/pcm.c +@@ -575,7 +575,6 @@ static void usb6fire_pcm_init_urb(struct pcm_urb *urb, + urb->instance.pipe = in ? usb_rcvisocpipe(chip->dev, ep) + : usb_sndisocpipe(chip->dev, ep); + urb->instance.interval = 1; +- urb->instance.transfer_flags = URB_ISO_ASAP; + urb->instance.complete = handler; + urb->instance.context = urb; + urb->instance.number_of_packets = PCM_N_PACKETS_PER_URB; +diff --git a/sound/usb/caiaq/audio.c b/sound/usb/caiaq/audio.c +index fde9a7a..b45e29b 100644 +--- a/sound/usb/caiaq/audio.c ++++ b/sound/usb/caiaq/audio.c +@@ -670,7 +670,6 @@ static void read_completed(struct urb *urb) + + if (send_it) { + out->number_of_packets = outframe; +- out->transfer_flags = URB_ISO_ASAP; + usb_submit_urb(out, GFP_ATOMIC); + } else { + struct snd_usb_caiaq_cb_info *oinfo = out->context; +@@ -686,7 +685,6 @@ requeue: + } + + urb->number_of_packets = FRAMES_PER_URB; +- urb->transfer_flags = URB_ISO_ASAP; + usb_submit_urb(urb, GFP_ATOMIC); + } + +@@ -751,7 +749,6 @@ static struct urb **alloc_urbs(struct snd_usb_caiaqdev *dev, int dir, int *ret) + * BYTES_PER_FRAME; + urbs[i]->context = &dev->data_cb_info[i]; + urbs[i]->interval = 1; +- urbs[i]->transfer_flags = URB_ISO_ASAP; + urbs[i]->number_of_packets = FRAMES_PER_URB; + urbs[i]->complete = (dir == SNDRV_PCM_STREAM_CAPTURE) ? + read_completed : write_completed; +diff --git a/sound/usb/card.c b/sound/usb/card.c +index ccf95cf..a9d5779 100644 +--- a/sound/usb/card.c ++++ b/sound/usb/card.c +@@ -612,7 +612,9 @@ int snd_usb_autoresume(struct snd_usb_audio *chip) + int err = -ENODEV; + + down_read(&chip->shutdown_rwsem); +- if (!chip->shutdown && !chip->probing) ++ if (chip->probing) ++ err = 0; ++ else if (!chip->shutdown) + err = usb_autopm_get_interface(chip->pm_intf); + up_read(&chip->shutdown_rwsem); + +diff --git a/sound/usb/card.h b/sound/usb/card.h +index 8a751b4..d32ea41 100644 +--- a/sound/usb/card.h ++++ b/sound/usb/card.h +@@ -116,6 +116,7 @@ struct snd_usb_substream { + unsigned int altset_idx; /* USB data format: index of alternate setting */ + unsigned int txfr_quirk:1; /* allow sub-frame alignment */ + unsigned int fmt_type; /* USB audio format type (1-3) */ ++ unsigned int pkt_offset_adj; /* Bytes to drop from beginning of packets (for non-compliant devices) */ + + unsigned int running: 1; /* running status */ + +diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c +index 21049b8..63cca3a 100644 +--- a/sound/usb/endpoint.c ++++ b/sound/usb/endpoint.c +@@ -677,7 +677,7 @@ static int data_ep_set_params(struct snd_usb_endpoint *ep, + if (!u->urb->transfer_buffer) + goto out_of_memory; + u->urb->pipe = ep->pipe; +- u->urb->transfer_flags = URB_ISO_ASAP | URB_NO_TRANSFER_DMA_MAP; ++ u->urb->transfer_flags = URB_NO_TRANSFER_DMA_MAP; + u->urb->interval = 1 << ep->datainterval; + u->urb->context = u; + u->urb->complete = snd_complete_urb; +@@ -716,8 +716,7 @@ static int sync_ep_set_params(struct snd_usb_endpoint *ep, + u->urb->transfer_dma = ep->sync_dma + i * 4; + u->urb->transfer_buffer_length = 4; + u->urb->pipe = ep->pipe; +- u->urb->transfer_flags = URB_ISO_ASAP | +- URB_NO_TRANSFER_DMA_MAP; ++ u->urb->transfer_flags = URB_NO_TRANSFER_DMA_MAP; + u->urb->number_of_packets = 1; + u->urb->interval = 1 << ep->syncinterval; + u->urb->context = u; +diff --git a/sound/usb/midi.c b/sound/usb/midi.c +index 34b9bb7..e5fee18 100644 +--- a/sound/usb/midi.c ++++ b/sound/usb/midi.c +@@ -126,7 +126,6 @@ struct snd_usb_midi { + struct snd_usb_midi_in_endpoint *in; + } endpoints[MIDI_MAX_ENDPOINTS]; + unsigned long input_triggered; +- bool autopm_reference; + unsigned int opened[2]; + unsigned char disconnected; + unsigned char input_running; +@@ -1040,7 +1039,6 @@ static int substream_open(struct snd_rawmidi_substream *substream, int dir, + { + struct snd_usb_midi* umidi = substream->rmidi->private_data; + struct snd_kcontrol *ctl; +- int err; + + down_read(&umidi->disc_rwsem); + if (umidi->disconnected) { +@@ -1051,13 +1049,6 @@ static int substream_open(struct snd_rawmidi_substream *substream, int dir, + mutex_lock(&umidi->mutex); + if (open) { + if (!umidi->opened[0] && !umidi->opened[1]) { +- err = usb_autopm_get_interface(umidi->iface); +- umidi->autopm_reference = err >= 0; +- if (err < 0 && err != -EACCES) { +- mutex_unlock(&umidi->mutex); +- up_read(&umidi->disc_rwsem); +- return -EIO; +- } + if (umidi->roland_load_ctl) { + ctl = umidi->roland_load_ctl; + ctl->vd[0].access |= SNDRV_CTL_ELEM_ACCESS_INACTIVE; +@@ -1080,8 +1071,6 @@ static int substream_open(struct snd_rawmidi_substream *substream, int dir, + snd_ctl_notify(umidi->card, + SNDRV_CTL_EVENT_MASK_INFO, &ctl->id); + } +- if (umidi->autopm_reference) +- usb_autopm_put_interface(umidi->iface); + } + } + mutex_unlock(&umidi->mutex); +@@ -2256,6 +2245,8 @@ int snd_usbmidi_create(struct snd_card *card, + return err; + } + ++ usb_autopm_get_interface_no_resume(umidi->iface); ++ + list_add_tail(&umidi->list, midi_list); + return 0; + } +diff --git a/sound/usb/misc/ua101.c b/sound/usb/misc/ua101.c +index 8b81cb5..6ad617b 100644 +--- a/sound/usb/misc/ua101.c ++++ b/sound/usb/misc/ua101.c +@@ -1120,8 +1120,7 @@ static int alloc_stream_urbs(struct ua101 *ua, struct ua101_stream *stream, + usb_init_urb(&urb->urb); + urb->urb.dev = ua->dev; + urb->urb.pipe = stream->usb_pipe; +- urb->urb.transfer_flags = URB_ISO_ASAP | +- URB_NO_TRANSFER_DMA_MAP; ++ urb->urb.transfer_flags = URB_NO_TRANSFER_DMA_MAP; + urb->urb.transfer_buffer = addr; + urb->urb.transfer_dma = dma; + urb->urb.transfer_buffer_length = max_packet_size; +diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c +index d82e378..bcc50ed 100644 +--- a/sound/usb/pcm.c ++++ b/sound/usb/pcm.c +@@ -1161,7 +1161,7 @@ static void retire_capture_urb(struct snd_usb_substream *subs, + stride = runtime->frame_bits >> 3; + + for (i = 0; i < urb->number_of_packets; i++) { +- cp = (unsigned char *)urb->transfer_buffer + urb->iso_frame_desc[i].offset; ++ cp = (unsigned char *)urb->transfer_buffer + urb->iso_frame_desc[i].offset + subs->pkt_offset_adj; + if (urb->iso_frame_desc[i].status && printk_ratelimit()) { + snd_printdd(KERN_ERR "frame %d active: %d\n", i, urb->iso_frame_desc[i].status); + // continue; +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index b9ca776..f581c3e 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -837,6 +837,7 @@ static void set_format_emu_quirk(struct snd_usb_substream *subs, + break; + } + snd_emuusb_set_samplerate(subs->stream->chip, emu_samplerate_id); ++ subs->pkt_offset_adj = (emu_samplerate_id >= EMU_QUIRK_SR_176400HZ) ? 4 : 0; + } + + void snd_usb_set_format_quirk(struct snd_usb_substream *subs, +diff --git a/sound/usb/stream.c b/sound/usb/stream.c +index ad181d5..cfc4d4e 100644 +--- a/sound/usb/stream.c ++++ b/sound/usb/stream.c +@@ -94,6 +94,7 @@ static void snd_usb_init_substream(struct snd_usb_stream *as, + subs->dev = as->chip->dev; + subs->txfr_quirk = as->chip->txfr_quirk; + subs->speed = snd_usb_get_speed(subs->dev); ++ subs->pkt_offset_adj = 0; + + snd_usb_set_pcm_ops(as->pcm, stream); + +@@ -396,6 +397,14 @@ static int parse_uac_endpoint_attributes(struct snd_usb_audio *chip, + if (!csep && altsd->bNumEndpoints >= 2) + csep = snd_usb_find_desc(alts->endpoint[1].extra, alts->endpoint[1].extralen, NULL, USB_DT_CS_ENDPOINT); + ++ /* ++ * If we can't locate the USB_DT_CS_ENDPOINT descriptor in the extra ++ * bytes after the first endpoint, go search the entire interface. ++ * Some devices have it directly *before* the standard endpoint. ++ */ ++ if (!csep) ++ csep = snd_usb_find_desc(alts->extra, alts->extralen, NULL, USB_DT_CS_ENDPOINT); ++ + if (!csep || csep->bLength < 7 || + csep->bDescriptorSubtype != UAC_EP_GENERAL) { + snd_printk(KERN_WARNING "%d:%u:%d : no or invalid" +diff --git a/sound/usb/usx2y/usb_stream.c b/sound/usb/usx2y/usb_stream.c +index 1e7a47a..bf618e1 100644 +--- a/sound/usb/usx2y/usb_stream.c ++++ b/sound/usb/usx2y/usb_stream.c +@@ -69,7 +69,6 @@ static void init_pipe_urbs(struct usb_stream_kernel *sk, unsigned use_packsize, + ++u, transfer += transfer_length) { + struct urb *urb = urbs[u]; + struct usb_iso_packet_descriptor *desc; +- urb->transfer_flags = URB_ISO_ASAP; + urb->transfer_buffer = transfer; + urb->dev = dev; + urb->pipe = pipe; +diff --git a/sound/usb/usx2y/usbusx2yaudio.c b/sound/usb/usx2y/usbusx2yaudio.c +index 520ef96..b376532 100644 +--- a/sound/usb/usx2y/usbusx2yaudio.c ++++ b/sound/usb/usx2y/usbusx2yaudio.c +@@ -503,7 +503,6 @@ static int usX2Y_urbs_start(struct snd_usX2Y_substream *subs) + if (0 == i) + atomic_set(&subs->state, state_STARTING3); + urb->dev = usX2Y->dev; +- urb->transfer_flags = URB_ISO_ASAP; + for (pack = 0; pack < nr_of_packs(); pack++) { + urb->iso_frame_desc[pack].offset = subs->maxpacksize * pack; + urb->iso_frame_desc[pack].length = subs->maxpacksize; +diff --git a/sound/usb/usx2y/usx2yhwdeppcm.c b/sound/usb/usx2y/usx2yhwdeppcm.c +index cc56007..f2a1acd 100644 +--- a/sound/usb/usx2y/usx2yhwdeppcm.c ++++ b/sound/usb/usx2y/usx2yhwdeppcm.c +@@ -443,7 +443,6 @@ static int usX2Y_usbpcm_urbs_start(struct snd_usX2Y_substream *subs) + if (0 == u) + atomic_set(&subs->state, state_STARTING3); + urb->dev = usX2Y->dev; +- urb->transfer_flags = URB_ISO_ASAP; + for (pack = 0; pack < nr_of_packs(); pack++) { + urb->iso_frame_desc[pack].offset = subs->maxpacksize * (pack + u * nr_of_packs()); + urb->iso_frame_desc[pack].length = subs->maxpacksize; diff --git a/3.8.11/4420_grsecurity-2.9.1-3.8.11-201305011917.patch b/3.8.12/4420_grsecurity-2.9.1-3.8.12-201305082215.patch index 3b5ee11..7f22cfc 100644 --- a/3.8.11/4420_grsecurity-2.9.1-3.8.11-201305011917.patch +++ b/3.8.12/4420_grsecurity-2.9.1-3.8.12-201305082215.patch @@ -259,7 +259,7 @@ index 986614d..e8bfedc 100644 pcd. [PARIDE] diff --git a/Makefile b/Makefile -index 7e4eee5..271e75e 100644 +index 902974f..3a7c75c 100644 --- a/Makefile +++ b/Makefile @@ -241,8 +241,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \ @@ -2001,7 +2001,7 @@ index a3f3792..7b932a6 100644 #define L_PTE_DIRTY_HIGH (1 << (55 - 32)) diff --git a/arch/arm/include/asm/pgtable.h b/arch/arm/include/asm/pgtable.h -index c094749..a6ff605 100644 +index 26e9ce4..461ed7f 100644 --- a/arch/arm/include/asm/pgtable.h +++ b/arch/arm/include/asm/pgtable.h @@ -30,6 +30,9 @@ @@ -2075,7 +2075,7 @@ index c094749..a6ff605 100644 /* * This is the lowest virtual address we can permit any user space * mapping to be mapped at. This is particularly important for -@@ -63,8 +113,8 @@ extern void __pgd_error(const char *file, int line, pgd_t); +@@ -72,8 +122,8 @@ extern void __pgd_error(const char *file, int line, pgd_t); /* * The pgprot_* and protection_map entries will be fixed up in runtime * to include the cachable and bufferable bits based on memory policy, @@ -2086,7 +2086,7 @@ index c094749..a6ff605 100644 */ #define _L_PTE_DEFAULT L_PTE_PRESENT | L_PTE_YOUNG -@@ -241,7 +291,7 @@ static inline pte_t pte_mkspecial(pte_t pte) { return pte; } +@@ -250,7 +300,7 @@ static inline pte_t pte_mkspecial(pte_t pte) { return pte; } static inline pte_t pte_modify(pte_t pte, pgprot_t newprot) { const pteval_t mask = L_PTE_XN | L_PTE_RDONLY | L_PTE_USER | @@ -5042,7 +5042,7 @@ index 2d67317..07d8bfa 100644 .notifier_call = err_inject_cpu_callback, }; diff --git a/arch/ia64/kernel/mca.c b/arch/ia64/kernel/mca.c -index 65bf9cd..794f06b 100644 +index d7396db..b33e873 100644 --- a/arch/ia64/kernel/mca.c +++ b/arch/ia64/kernel/mca.c @@ -1922,7 +1922,7 @@ static int __cpuinit mca_cpu_callback(struct notifier_block *nfb, @@ -6972,7 +6972,7 @@ index 4684e33..acc4d19e 100644 ld r4,_DAR(r1) bl .bad_page_fault diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S -index 3684cbd..bc89eab 100644 +index bb11075..2d00a2a 100644 --- a/arch/powerpc/kernel/exceptions-64s.S +++ b/arch/powerpc/kernel/exceptions-64s.S @@ -1206,10 +1206,10 @@ handle_page_fault: @@ -7894,7 +7894,7 @@ index ef9e555..331bd29 100644 #define __read_mostly __attribute__((__section__(".data..read_mostly"))) diff --git a/arch/sh/kernel/cpu/sh4a/smp-shx3.c b/arch/sh/kernel/cpu/sh4a/smp-shx3.c -index 03f2b55..b027032 100644 +index 03f2b55..b0270327 100644 --- a/arch/sh/kernel/cpu/sh4a/smp-shx3.c +++ b/arch/sh/kernel/cpu/sh4a/smp-shx3.c @@ -143,7 +143,7 @@ shx3_cpu_callback(struct notifier_block *nfb, unsigned long action, void *hcpu) @@ -18028,6 +18028,52 @@ index 70602f8..9d9edb7 100644 } intel_ds_init(); +diff --git a/arch/x86/kernel/cpu/perf_event_intel_lbr.c b/arch/x86/kernel/cpu/perf_event_intel_lbr.c +index da02e9c..94db951 100644 +--- a/arch/x86/kernel/cpu/perf_event_intel_lbr.c ++++ b/arch/x86/kernel/cpu/perf_event_intel_lbr.c +@@ -310,7 +310,7 @@ void intel_pmu_lbr_read(void) + * - in case there is no HW filter + * - in case the HW filter has errata or limitations + */ +-static void intel_pmu_setup_sw_lbr_filter(struct perf_event *event) ++static int intel_pmu_setup_sw_lbr_filter(struct perf_event *event) + { + u64 br_type = event->attr.branch_sample_type; + int mask = 0; +@@ -318,8 +318,11 @@ static void intel_pmu_setup_sw_lbr_filter(struct perf_event *event) + if (br_type & PERF_SAMPLE_BRANCH_USER) + mask |= X86_BR_USER; + +- if (br_type & PERF_SAMPLE_BRANCH_KERNEL) ++ if (br_type & PERF_SAMPLE_BRANCH_KERNEL) { ++ if (perf_paranoid_kernel() && !capable(CAP_SYS_ADMIN)) ++ return -EACCES; + mask |= X86_BR_KERNEL; ++ } + + /* we ignore BRANCH_HV here */ + +@@ -339,6 +342,8 @@ static void intel_pmu_setup_sw_lbr_filter(struct perf_event *event) + * be used by fixup code for some CPU + */ + event->hw.branch_reg.reg = mask; ++ ++ return 0; + } + + /* +@@ -386,7 +391,9 @@ int intel_pmu_setup_lbr_filter(struct perf_event *event) + /* + * setup SW LBR filter + */ +- intel_pmu_setup_sw_lbr_filter(event); ++ ret = intel_pmu_setup_sw_lbr_filter(event); ++ if (ret) ++ return ret; + + /* + * setup HW LBR filter, if any diff --git a/arch/x86/kernel/cpu/perf_event_intel_uncore.c b/arch/x86/kernel/cpu/perf_event_intel_uncore.c index b43200d..d235b3e 100644 --- a/arch/x86/kernel/cpu/perf_event_intel_uncore.c @@ -21290,7 +21336,7 @@ index 8c96897..be66bfa 100644 return -EPERM; } diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c -index e4595f1..ee3bfb8 100644 +index 84b7789..e65e8be 100644 --- a/arch/x86/kernel/irq.c +++ b/arch/x86/kernel/irq.c @@ -18,7 +18,7 @@ @@ -21314,19 +21360,15 @@ index e4595f1..ee3bfb8 100644 #endif return 0; } -@@ -164,10 +164,10 @@ u64 arch_irq_stat_cpu(unsigned int cpu) +@@ -164,7 +164,7 @@ u64 arch_irq_stat_cpu(unsigned int cpu) u64 arch_irq_stat(void) { - u64 sum = atomic_read(&irq_err_count); + u64 sum = atomic_read_unchecked(&irq_err_count); - - #ifdef CONFIG_X86_IO_APIC -- sum += atomic_read(&irq_mis_count); -+ sum += atomic_read_unchecked(&irq_mis_count); - #endif return sum; } + diff --git a/arch/x86/kernel/irq_32.c b/arch/x86/kernel/irq_32.c index 344faf8..355f60d 100644 --- a/arch/x86/kernel/irq_32.c @@ -24285,7 +24327,7 @@ index a20ecb5..d0e2194 100644 out: diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c -index a27e763..54bfe43 100644 +index d330b3c..101a42b 100644 --- a/arch/x86/kvm/emulate.c +++ b/arch/x86/kvm/emulate.c @@ -292,6 +292,7 @@ static void invalidate_registers(struct x86_emulate_ctxt *ctxt) @@ -31441,7 +31483,7 @@ index 431e875..cbb23f3 100644 -} -__setup("vdso=", vdso_setup); diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c -index 2262003..3ee61cf 100644 +index 08c6511..d946c4a 100644 --- a/arch/x86/xen/enlighten.c +++ b/arch/x86/xen/enlighten.c @@ -100,8 +100,6 @@ EXPORT_SYMBOL_GPL(xen_start_info); @@ -31562,7 +31604,7 @@ index 2262003..3ee61cf 100644 xen_smp_init(); #ifdef CONFIG_ACPI_NUMA -@@ -1598,7 +1597,7 @@ static int __cpuinit xen_hvm_cpu_notify(struct notifier_block *self, +@@ -1601,7 +1600,7 @@ static int __cpuinit xen_hvm_cpu_notify(struct notifier_block *self, return NOTIFY_OK; } @@ -31651,7 +31693,7 @@ index cab96b6..8c629ba 100644 .alloc_pud = xen_alloc_pmd_init, .release_pud = xen_release_pmd_init, diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c -index 34bc4ce..c34aa24 100644 +index 48d7b2c..20fed27 100644 --- a/arch/x86/xen/smp.c +++ b/arch/x86/xen/smp.c @@ -229,11 +229,6 @@ static void __init xen_smp_prepare_boot_cpu(void) @@ -34429,7 +34471,7 @@ index d780295..b29f3a8 100644 return 0; diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c -index 93211df..c7805f7 100644 +index ba780b7..cdb8a9c 100644 --- a/drivers/char/tpm/tpm.c +++ b/drivers/char/tpm/tpm.c @@ -410,7 +410,7 @@ static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf, @@ -38261,7 +38303,7 @@ index 0d8f086..f5a91d5 100644 void dm_uevent_add(struct mapped_device *md, struct list_head *elist) diff --git a/drivers/md/md.c b/drivers/md/md.c -index f363135..9b38815 100644 +index 0411bde..5a023ff 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -240,10 +240,10 @@ EXPORT_SYMBOL_GPL(md_trim_bio); @@ -38333,7 +38375,7 @@ index f363135..9b38815 100644 INIT_LIST_HEAD(&rdev->same_set); init_waitqueue_head(&rdev->blocked_wait); -@@ -6987,7 +6987,7 @@ static int md_seq_show(struct seq_file *seq, void *v) +@@ -6984,7 +6984,7 @@ static int md_seq_show(struct seq_file *seq, void *v) spin_unlock(&pers_lock); seq_printf(seq, "\n"); @@ -38342,7 +38384,7 @@ index f363135..9b38815 100644 return 0; } if (v == (void*)2) { -@@ -7090,7 +7090,7 @@ static int md_seq_open(struct inode *inode, struct file *file) +@@ -7087,7 +7087,7 @@ static int md_seq_open(struct inode *inode, struct file *file) return error; seq = file->private_data; @@ -38351,7 +38393,7 @@ index f363135..9b38815 100644 return error; } -@@ -7104,7 +7104,7 @@ static unsigned int mdstat_poll(struct file *filp, poll_table *wait) +@@ -7101,7 +7101,7 @@ static unsigned int mdstat_poll(struct file *filp, poll_table *wait) /* always allow read */ mask = POLLIN | POLLRDNORM; @@ -38360,7 +38402,7 @@ index f363135..9b38815 100644 mask |= POLLERR | POLLPRI; return mask; } -@@ -7148,7 +7148,7 @@ static int is_mddev_idle(struct mddev *mddev, int init) +@@ -7145,7 +7145,7 @@ static int is_mddev_idle(struct mddev *mddev, int init) struct gendisk *disk = rdev->bdev->bd_contains->bd_disk; curr_events = (int)part_stat_read(&disk->part0, sectors[0]) + (int)part_stat_read(&disk->part0, sectors[1]) - @@ -38411,10 +38453,10 @@ index 1cbfc6b..56e1dbb 100644 /*----------------------------------------------------------------*/ diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c -index fd86b37..a5389ef 100644 +index 6af167f..40c25a1 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c -@@ -1821,7 +1821,7 @@ static int fix_sync_read_error(struct r1bio *r1_bio) +@@ -1826,7 +1826,7 @@ static int fix_sync_read_error(struct r1bio *r1_bio) if (r1_sync_page_io(rdev, sect, s, bio->bi_io_vec[idx].bv_page, READ) != 0) @@ -38423,7 +38465,7 @@ index fd86b37..a5389ef 100644 } sectors -= s; sect += s; -@@ -2043,7 +2043,7 @@ static void fix_read_error(struct r1conf *conf, int read_disk, +@@ -2048,7 +2048,7 @@ static void fix_read_error(struct r1conf *conf, int read_disk, test_bit(In_sync, &rdev->flags)) { if (r1_sync_page_io(rdev, sect, s, conf->tmppage, READ)) { @@ -38433,10 +38475,10 @@ index fd86b37..a5389ef 100644 "md/raid1:%s: read error corrected " "(%d sectors at %llu on %s)\n", diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c -index b3898d4..23a462b 100644 +index 61ab219..7b232b3 100644 --- a/drivers/md/raid10.c +++ b/drivers/md/raid10.c -@@ -1881,7 +1881,7 @@ static void end_sync_read(struct bio *bio, int error) +@@ -1886,7 +1886,7 @@ static void end_sync_read(struct bio *bio, int error) /* The write handler will notice the lack of * R10BIO_Uptodate and record any errors etc */ @@ -38445,7 +38487,7 @@ index b3898d4..23a462b 100644 &conf->mirrors[d].rdev->corrected_errors); /* for reconstruct, we always reschedule after a read. -@@ -2230,7 +2230,7 @@ static void check_decay_read_errors(struct mddev *mddev, struct md_rdev *rdev) +@@ -2235,7 +2235,7 @@ static void check_decay_read_errors(struct mddev *mddev, struct md_rdev *rdev) { struct timespec cur_time_mon; unsigned long hours_since_last; @@ -38454,7 +38496,7 @@ index b3898d4..23a462b 100644 ktime_get_ts(&cur_time_mon); -@@ -2252,9 +2252,9 @@ static void check_decay_read_errors(struct mddev *mddev, struct md_rdev *rdev) +@@ -2257,9 +2257,9 @@ static void check_decay_read_errors(struct mddev *mddev, struct md_rdev *rdev) * overflowing the shift of read_errors by hours_since_last. */ if (hours_since_last >= 8 * sizeof(read_errors)) @@ -38466,7 +38508,7 @@ index b3898d4..23a462b 100644 } static int r10_sync_page_io(struct md_rdev *rdev, sector_t sector, -@@ -2308,8 +2308,8 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10 +@@ -2313,8 +2313,8 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10 return; check_decay_read_errors(mddev, rdev); @@ -38477,7 +38519,7 @@ index b3898d4..23a462b 100644 char b[BDEVNAME_SIZE]; bdevname(rdev->bdev, b); -@@ -2317,7 +2317,7 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10 +@@ -2322,7 +2322,7 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10 "md/raid10:%s: %s: Raid device exceeded " "read_error threshold [cur %d:max %d]\n", mdname(mddev), b, @@ -38486,7 +38528,7 @@ index b3898d4..23a462b 100644 printk(KERN_NOTICE "md/raid10:%s: %s: Failing raid device\n", mdname(mddev), b); -@@ -2472,7 +2472,7 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10 +@@ -2477,7 +2477,7 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10 sect + choose_data_offset(r10_bio, rdev)), bdevname(rdev->bdev, b)); @@ -40716,7 +40758,7 @@ index 3726cd6..b655808 100644 D_INFO("*** LOAD DRIVER ***\n"); diff --git a/drivers/net/wireless/iwlwifi/dvm/debugfs.c b/drivers/net/wireless/iwlwifi/dvm/debugfs.c -index 5b9533e..7733880 100644 +index 2c056b1..698efa9 100644 --- a/drivers/net/wireless/iwlwifi/dvm/debugfs.c +++ b/drivers/net/wireless/iwlwifi/dvm/debugfs.c @@ -203,7 +203,7 @@ static ssize_t iwl_dbgfs_sram_write(struct file *file, @@ -41828,7 +41870,7 @@ index 0d84b1f..c2da6ac 100644 mc13xxx_data = mc13xxx_parse_regulators_dt(pdev, mc13892_regulators, ARRAY_SIZE(mc13892_regulators)); diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c -index 16630aa..6afc992 100644 +index 1c77423..2971d18 100644 --- a/drivers/rtc/rtc-cmos.c +++ b/drivers/rtc/rtc-cmos.c @@ -724,7 +724,9 @@ cmos_do_probe(struct device *dev, struct resource *ports, int rtc_irq) @@ -43685,10 +43727,10 @@ index 19083ef..6e34e97 100644 } EXPORT_SYMBOL_GPL(n_tty_inherit_ops); diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c -index ac35c90..c47deac 100644 +index c830b60..b239698 100644 --- a/drivers/tty/pty.c +++ b/drivers/tty/pty.c -@@ -790,8 +790,10 @@ static void __init unix98_pty_init(void) +@@ -793,8 +793,10 @@ static void __init unix98_pty_init(void) panic("Couldn't register Unix98 pts driver"); /* Now create the /dev/ptmx special device */ @@ -43870,7 +43912,7 @@ index e514b3a..c73d614 100644 if (cfg->uart_flags & UPF_CONS_FLOW) { diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c -index 2c7230a..2104f16 100644 +index 4293a3e..7227e42 100644 --- a/drivers/tty/serial/serial_core.c +++ b/drivers/tty/serial/serial_core.c @@ -1455,7 +1455,7 @@ static void uart_hangup(struct tty_struct *tty) @@ -44312,7 +44354,7 @@ index b3c4a25..723916f 100644 if (get_user(c, buf)) diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c -index 892ecda..90cbf36 100644 +index f34f98d..73c6c42 100644 --- a/drivers/tty/tty_io.c +++ b/drivers/tty/tty_io.c @@ -3401,7 +3401,7 @@ EXPORT_SYMBOL_GPL(get_current_tty); @@ -50661,10 +50703,10 @@ index 1774932..5812106 100644 EXPORT_SYMBOL(dump_write); diff --git a/fs/dcache.c b/fs/dcache.c -index c3bbf85..5b71101 100644 +index de73da2..2ed907b 100644 --- a/fs/dcache.c +++ b/fs/dcache.c -@@ -3139,7 +3139,7 @@ void __init vfs_caches_init(unsigned long mempages) +@@ -3141,7 +3141,7 @@ void __init vfs_caches_init(unsigned long mempages) mempages -= reserve; names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0, @@ -50796,7 +50838,7 @@ index b2a34a1..162fa69 100644 return rc; } diff --git a/fs/exec.c b/fs/exec.c -index 20df02c..9a87617 100644 +index ac014f1..0bfe729 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -55,8 +55,20 @@ @@ -51098,7 +51140,7 @@ index 20df02c..9a87617 100644 set_fs(old_fs); return result; } -@@ -1247,7 +1322,7 @@ static int check_unsafe_exec(struct linux_binprm *bprm) +@@ -1250,7 +1325,7 @@ static int check_unsafe_exec(struct linux_binprm *bprm) } rcu_read_unlock(); @@ -51107,7 +51149,7 @@ index 20df02c..9a87617 100644 bprm->unsafe |= LSM_UNSAFE_SHARE; } else { res = -EAGAIN; -@@ -1447,6 +1522,31 @@ int search_binary_handler(struct linux_binprm *bprm) +@@ -1450,6 +1525,31 @@ int search_binary_handler(struct linux_binprm *bprm) EXPORT_SYMBOL(search_binary_handler); @@ -51139,7 +51181,7 @@ index 20df02c..9a87617 100644 /* * sys_execve() executes a new program. */ -@@ -1454,6 +1554,11 @@ static int do_execve_common(const char *filename, +@@ -1457,6 +1557,11 @@ static int do_execve_common(const char *filename, struct user_arg_ptr argv, struct user_arg_ptr envp) { @@ -51151,7 +51193,7 @@ index 20df02c..9a87617 100644 struct linux_binprm *bprm; struct file *file; struct files_struct *displaced; -@@ -1461,6 +1566,8 @@ static int do_execve_common(const char *filename, +@@ -1464,6 +1569,8 @@ static int do_execve_common(const char *filename, int retval; const struct cred *cred = current_cred(); @@ -51160,7 +51202,7 @@ index 20df02c..9a87617 100644 /* * We move the actual failure in case of RLIMIT_NPROC excess from * set*uid() to execve() because too many poorly written programs -@@ -1501,12 +1608,27 @@ static int do_execve_common(const char *filename, +@@ -1504,12 +1611,27 @@ static int do_execve_common(const char *filename, if (IS_ERR(file)) goto out_unmark; @@ -51188,7 +51230,7 @@ index 20df02c..9a87617 100644 retval = bprm_mm_init(bprm); if (retval) goto out_file; -@@ -1523,24 +1645,65 @@ static int do_execve_common(const char *filename, +@@ -1526,24 +1648,65 @@ static int do_execve_common(const char *filename, if (retval < 0) goto out; @@ -51258,7 +51300,7 @@ index 20df02c..9a87617 100644 current->fs->in_exec = 0; current->in_execve = 0; acct_update_integrals(current); -@@ -1549,6 +1712,14 @@ static int do_execve_common(const char *filename, +@@ -1552,6 +1715,14 @@ static int do_execve_common(const char *filename, put_files_struct(displaced); return retval; @@ -51273,7 +51315,7 @@ index 20df02c..9a87617 100644 out: if (bprm->mm) { acct_arg_size(bprm, 0); -@@ -1697,3 +1868,278 @@ asmlinkage long compat_sys_execve(const char __user * filename, +@@ -1700,3 +1871,278 @@ asmlinkage long compat_sys_execve(const char __user * filename, return error; } #endif @@ -51636,7 +51678,7 @@ index bbcd6a0..2824592 100644 /* locality groups */ diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c -index 82f8c2d..ce7c889 100644 +index b443e62..a2109f6 100644 --- a/fs/ext4/mballoc.c +++ b/fs/ext4/mballoc.c @@ -1747,7 +1747,7 @@ void ext4_mb_simple_scan_group(struct ext4_allocation_context *ac, @@ -51753,10 +51795,10 @@ index 82f8c2d..ce7c889 100644 return 0; diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index 24c767d..893aa55 100644 +index 5575a45..12f7424 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c -@@ -2429,7 +2429,7 @@ struct ext4_attr { +@@ -2432,7 +2432,7 @@ struct ext4_attr { ssize_t (*store)(struct ext4_attr *, struct ext4_sb_info *, const char *, size_t); int offset; @@ -53020,7 +53062,7 @@ index ff000e5..c44ec6d 100644 _debug("- mark %p{%lx}", page, page->index); diff --git a/fs/fscache/stats.c b/fs/fscache/stats.c -index 8179e8b..5072cc7 100644 +index 40d13c7..ddf52b9 100644 --- a/fs/fscache/stats.c +++ b/fs/fscache/stats.c @@ -18,99 +18,99 @@ @@ -53614,7 +53656,7 @@ index 916da8c..1588998 100644 next->d_inode->i_ino, dt_type(next->d_inode)) < 0) diff --git a/fs/lockd/clntproc.c b/fs/lockd/clntproc.c -index 52e5120..808936e 100644 +index 54f9e6c..9ed908c 100644 --- a/fs/lockd/clntproc.c +++ b/fs/lockd/clntproc.c @@ -36,11 +36,11 @@ static const struct rpc_call_ops nlmclnt_cancel_ops; @@ -54349,7 +54391,7 @@ index ebeb94c..ff35337 100644 void nfs_fattr_init(struct nfs_fattr *fattr) diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c -index 9d1c5db..1e13db8 100644 +index ec668e1..831ae05 100644 --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -1097,7 +1097,7 @@ struct nfsd4_operation { @@ -54362,10 +54404,10 @@ index 9d1c5db..1e13db8 100644 static struct nfsd4_operation nfsd4_ops[]; diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c -index d1dd710..32ac0e8 100644 +index cd5e6c1..4183d56 100644 --- a/fs/nfsd/nfs4xdr.c +++ b/fs/nfsd/nfs4xdr.c -@@ -1456,7 +1456,7 @@ nfsd4_decode_notsupp(struct nfsd4_compoundargs *argp, void *p) +@@ -1450,7 +1450,7 @@ nfsd4_decode_notsupp(struct nfsd4_compoundargs *argp, void *p) typedef __be32(*nfsd4_dec)(struct nfsd4_compoundargs *argp, void *); @@ -54374,7 +54416,7 @@ index d1dd710..32ac0e8 100644 [OP_ACCESS] = (nfsd4_dec)nfsd4_decode_access, [OP_CLOSE] = (nfsd4_dec)nfsd4_decode_close, [OP_COMMIT] = (nfsd4_dec)nfsd4_decode_commit, -@@ -1496,7 +1496,7 @@ static nfsd4_dec nfsd4_dec_ops[] = { +@@ -1490,7 +1490,7 @@ static nfsd4_dec nfsd4_dec_ops[] = { [OP_RELEASE_LOCKOWNER] = (nfsd4_dec)nfsd4_decode_release_lockowner, }; @@ -54383,7 +54425,7 @@ index d1dd710..32ac0e8 100644 [OP_ACCESS] = (nfsd4_dec)nfsd4_decode_access, [OP_CLOSE] = (nfsd4_dec)nfsd4_decode_close, [OP_COMMIT] = (nfsd4_dec)nfsd4_decode_commit, -@@ -1558,7 +1558,7 @@ static nfsd4_dec nfsd41_dec_ops[] = { +@@ -1552,7 +1552,7 @@ static nfsd4_dec nfsd41_dec_ops[] = { }; struct nfsd4_minorversion_ops { @@ -56733,7 +56775,7 @@ index 614b2b5..4d321e6 100644 if (!bb->vm_ops) return -EINVAL; diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c -index 1f8c823..ed57cfe 100644 +index d924812..97a74e3 100644 --- a/fs/sysfs/dir.c +++ b/fs/sysfs/dir.c @@ -40,7 +40,7 @@ static DEFINE_IDA(sysfs_ino_ida); @@ -57053,10 +57095,10 @@ index d82efaa..0904a8e 100644 kfree(s); diff --git a/grsecurity/Kconfig b/grsecurity/Kconfig new file mode 100644 -index 0000000..92247e4 +index 0000000..829d8fb --- /dev/null +++ b/grsecurity/Kconfig -@@ -0,0 +1,1021 @@ +@@ -0,0 +1,1031 @@ +# +# grecurity configuration +# @@ -57621,6 +57663,16 @@ index 0000000..92247e4 + tasks. If the sysctl option is enabled, a sysctl option with + name "chroot_caps" is created. + ++config GRKERNSEC_CHROOT_INITRD ++ bool "Exempt initrd tasks from restrictions" ++ default y if GRKERNSEC_CONFIG_AUTO ++ depends on GRKERNSEC_CHROOT && BLK_DEV_RAM ++ help ++ If you say Y here, tasks started prior to init will be exempted from ++ grsecurity's chroot restrictions. This option is mainly meant to ++ resolve Plymouth's performing privileged operations unnecessarily ++ in a chroot. ++ +endmenu +menu "Kernel Auditing" +depends on GRKERNSEC @@ -63925,10 +63977,10 @@ index 0000000..bc0be01 +} diff --git a/grsecurity/grsec_chroot.c b/grsecurity/grsec_chroot.c new file mode 100644 -index 0000000..6d2de57 +index 0000000..8b4c803 --- /dev/null +++ b/grsecurity/grsec_chroot.c -@@ -0,0 +1,357 @@ +@@ -0,0 +1,370 @@ +#include <linux/kernel.h> +#include <linux/module.h> +#include <linux/sched.h> @@ -63940,14 +63992,27 @@ index 0000000..6d2de57 +#include <linux/grsecurity.h> +#include <linux/grinternal.h> + ++#ifdef CONFIG_GRKERNSEC_CHROOT_INITRD ++static int gr_init_ran; ++#endif ++ +void gr_set_chroot_entries(struct task_struct *task, struct path *path) +{ +#ifdef CONFIG_GRKERNSEC + if (task_pid_nr(task) > 1 && path->dentry != init_task.fs->root.dentry && -+ path->dentry != task->nsproxy->mnt_ns->root->mnt.mnt_root) ++ path->dentry != task->nsproxy->mnt_ns->root->mnt.mnt_root ++#ifdef CONFIG_GRKERNSEC_CHROOT_INITRD ++ && gr_init_ran ++#endif ++ ) + task->gr_is_chrooted = 1; -+ else ++ else { ++#ifdef CONFIG_GRKERNSEC_CHROOT_INITRD ++ if (task_pid_nr(task) == 1 && !gr_init_ran) ++ gr_init_ran = 1; ++#endif + task->gr_is_chrooted = 0; ++ } + + task->gr_chroot_dentry = path->dentry; +#endif @@ -67545,10 +67610,10 @@ index 810431d..0ec4804f 100644 * (puds are folded into pgds so this doesn't get actually called, * but the define is needed for a generic inline function.) diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h -index 5cf680a..4b74d62 100644 +index f50a87d..3860a22 100644 --- a/include/asm-generic/pgtable.h +++ b/include/asm-generic/pgtable.h -@@ -688,6 +688,14 @@ static inline pmd_t pmd_mknuma(pmd_t pmd) +@@ -698,6 +698,14 @@ static inline pmd_t pmd_mknuma(pmd_t pmd) } #endif /* CONFIG_NUMA_BALANCING */ @@ -71275,7 +71340,7 @@ index c20635c..2f5def4 100644 static inline void anon_vma_merge(struct vm_area_struct *vma, struct vm_area_struct *next) diff --git a/include/linux/sched.h b/include/linux/sched.h -index 7e49270..835d8d9 100644 +index f5ad26e..aa97a06 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -61,6 +61,7 @@ struct bio_list; @@ -71525,7 +71590,7 @@ index 7e49270..835d8d9 100644 extern int allow_signal(int); extern int disallow_signal(int); -@@ -2546,9 +2652,9 @@ static inline unsigned long *end_of_stack(struct task_struct *p) +@@ -2536,9 +2642,9 @@ static inline unsigned long *end_of_stack(struct task_struct *p) #endif @@ -73125,6 +73190,18 @@ index fdeb85a..1329d95 100644 /* Structure to track chunk fragments that have been acked, but peer +diff --git a/include/net/secure_seq.h b/include/net/secure_seq.h +index c2e542b..6ca975b 100644 +--- a/include/net/secure_seq.h ++++ b/include/net/secure_seq.h +@@ -3,6 +3,7 @@ + + #include <linux/types.h> + ++extern void net_secret_init(void); + extern __u32 secure_ip_id(__be32 daddr); + extern __u32 secure_ipv6_id(const __be32 daddr[4]); + extern u32 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport); diff --git a/include/net/sock.h b/include/net/sock.h index 25afaa0..8bb0070 100644 --- a/include/net/sock.h @@ -74323,7 +74400,7 @@ index 58d31f1..cce7a55 100644 sem_params.flg = semflg; sem_params.u.nsems = nsems; diff --git a/ipc/shm.c b/ipc/shm.c -index 4fa6d8f..55cff14 100644 +index 9bab650..1ce68a5 100644 --- a/ipc/shm.c +++ b/ipc/shm.c @@ -69,6 +69,14 @@ static void shm_destroy (struct ipc_namespace *ns, struct shmid_kernel *shp); @@ -74588,10 +74665,10 @@ index f6c2ce5..982c0f9 100644 + return ns_capable_nolog(ns, cap) && kuid_has_mapping(ns, inode->i_uid); +} diff --git a/kernel/cgroup.c b/kernel/cgroup.c -index 1e23664..570a83d 100644 +index cddf1d9..34e9721 100644 --- a/kernel/cgroup.c +++ b/kernel/cgroup.c -@@ -5543,7 +5543,7 @@ static int cgroup_css_links_read(struct cgroup *cont, +@@ -5544,7 +5544,7 @@ static int cgroup_css_links_read(struct cgroup *cont, struct css_set *cg = link->cg; struct task_struct *task; int count = 0; @@ -75585,10 +75662,10 @@ index 9b22d03..6295b62 100644 prev->next = info->next; else diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c -index e4cee8d..f31f503 100644 +index 60f7e32..76ccd96 100644 --- a/kernel/hrtimer.c +++ b/kernel/hrtimer.c -@@ -1408,7 +1408,7 @@ void hrtimer_peek_ahead_timers(void) +@@ -1414,7 +1414,7 @@ void hrtimer_peek_ahead_timers(void) local_irq_restore(flags); } @@ -75597,7 +75674,7 @@ index e4cee8d..f31f503 100644 { struct hrtimer_cpu_base *cpu_base = &__get_cpu_var(hrtimer_bases); -@@ -1750,7 +1750,7 @@ static int __cpuinit hrtimer_cpu_notify(struct notifier_block *self, +@@ -1756,7 +1756,7 @@ static int __cpuinit hrtimer_cpu_notify(struct notifier_block *self, return NOTIFY_OK; } @@ -78067,7 +78144,7 @@ index c1cc7e1..f62e436 100644 } diff --git a/kernel/rcutree_trace.c b/kernel/rcutree_trace.c -index 0d095dc..1985b19 100644 +index 93f8e8f..cf812ae 100644 --- a/kernel/rcutree_trace.c +++ b/kernel/rcutree_trace.c @@ -123,7 +123,7 @@ static void print_one_rcu_data(struct seq_file *m, struct rcu_data *rdp) @@ -78779,7 +78856,7 @@ index 2f194e9..2c05ea9 100644 .priority = 10, }; diff --git a/kernel/sys.c b/kernel/sys.c -index 47f1d1b..04c769e 100644 +index 47f1d1b..8651bd9 100644 --- a/kernel/sys.c +++ b/kernel/sys.c @@ -157,6 +157,12 @@ static int set_one_prio(struct task_struct *p, int niceval, int error) @@ -78927,7 +79004,21 @@ index 47f1d1b..04c769e 100644 __OLD_UTS_LEN); error |= __put_user(0, name->machine + __OLD_UTS_LEN); up_read(&uts_sem); -@@ -2027,7 +2063,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3, +@@ -1555,6 +1591,13 @@ int do_prlimit(struct task_struct *tsk, unsigned int resource, + */ + new_rlim->rlim_cur = 1; + } ++ /* Handle the case where a fork and setuid occur and then RLIMIT_NPROC ++ is changed to a lower value. Since tasks can be created by the same ++ user in between this limit change and an execve by this task, force ++ a recheck only for this task by setting PF_NPROC_EXCEEDED ++ */ ++ if (resource == RLIMIT_NPROC) ++ tsk->flags |= PF_NPROC_EXCEEDED; + } + if (!retval) { + if (old_rlim) +@@ -2027,7 +2070,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3, error = get_dumpable(me->mm); break; case PR_SET_DUMPABLE: @@ -79274,10 +79365,10 @@ index f11d83b..d016d91 100644 .clock_get = alarm_clock_get, .timer_create = alarm_timer_create, diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c -index a13987a..36cd791 100644 +index 239a323..2c78cf0 100644 --- a/kernel/time/tick-broadcast.c +++ b/kernel/time/tick-broadcast.c -@@ -116,7 +116,7 @@ int tick_device_uses_broadcast(struct clock_event_device *dev, int cpu) +@@ -120,7 +120,7 @@ int tick_device_uses_broadcast(struct clock_event_device *dev, int cpu) * then clear the broadcast bit. */ if (!(dev->features & CLOCK_EVT_FEAT_C3STOP)) { @@ -79488,7 +79579,7 @@ index c0bd030..62a1927 100644 ret = -EIO; bt->dropped_file = debugfs_create_file("dropped", 0444, dir, bt, diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c -index 35cc3a8..2a47da3 100644 +index 03dbc77..e6bd484 100644 --- a/kernel/trace/ftrace.c +++ b/kernel/trace/ftrace.c @@ -1886,12 +1886,17 @@ ftrace_code_disable(struct module *mod, struct dyn_ftrace *rec) @@ -79520,7 +79611,7 @@ index 35cc3a8..2a47da3 100644 { struct ftrace_func_probe *entry; struct ftrace_page *pg; -@@ -3831,8 +3836,10 @@ static int ftrace_process_locs(struct module *mod, +@@ -3832,8 +3837,10 @@ static int ftrace_process_locs(struct module *mod, if (!count) return 0; @@ -79531,7 +79622,7 @@ index 35cc3a8..2a47da3 100644 start_pg = ftrace_allocate_pages(count); if (!start_pg) -@@ -4554,8 +4561,6 @@ ftrace_enable_sysctl(struct ctl_table *table, int write, +@@ -4555,8 +4562,6 @@ ftrace_enable_sysctl(struct ctl_table *table, int write, #ifdef CONFIG_FUNCTION_GRAPH_TRACER static int ftrace_graph_active; @@ -79540,7 +79631,7 @@ index 35cc3a8..2a47da3 100644 int ftrace_graph_entry_stub(struct ftrace_graph_ent *trace) { return 0; -@@ -4699,6 +4704,10 @@ ftrace_suspend_notifier_call(struct notifier_block *bl, unsigned long state, +@@ -4700,6 +4705,10 @@ ftrace_suspend_notifier_call(struct notifier_block *bl, unsigned long state, return NOTIFY_DONE; } @@ -79551,7 +79642,7 @@ index 35cc3a8..2a47da3 100644 int register_ftrace_graph(trace_func_graph_ret_t retfunc, trace_func_graph_ent_t entryfunc) { -@@ -4712,7 +4721,6 @@ int register_ftrace_graph(trace_func_graph_ret_t retfunc, +@@ -4713,7 +4722,6 @@ int register_ftrace_graph(trace_func_graph_ret_t retfunc, goto out; } @@ -79838,7 +79929,7 @@ index ce8514f..8233573 100644 *data_page = bpage; diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index fe1d581..ea543f1b 100644 +index 1c82852..1cd5af2 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -2845,7 +2845,7 @@ int trace_keep_overwrite(struct tracer *tracer, u32 mask, int set) @@ -80012,15 +80103,15 @@ index 194d796..76edb8f 100644 key = event->type & (EVENT_HASHSIZE - 1); diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c -index 83a8b5b..0bf39a9 100644 +index b20428c..4845a10 100644 --- a/kernel/trace/trace_stack.c +++ b/kernel/trace/trace_stack.c -@@ -52,7 +52,7 @@ static inline void check_stack(void) +@@ -68,7 +68,7 @@ check_stack(unsigned long ip, unsigned long *stack) return; /* we do not handle interrupt stacks yet */ -- if (!object_is_on_stack(&this_size)) -+ if (!object_starts_on_stack(&this_size)) +- if (!object_is_on_stack(stack)) ++ if (!object_starts_on_stack(stack)) return; local_irq_save(flags); @@ -82071,7 +82162,7 @@ index c9bd528..da8d069 100644 capable(CAP_IPC_LOCK)) ret = do_mlockall(flags); diff --git a/mm/mmap.c b/mm/mmap.c -index 90db251..04240d1 100644 +index 32f3372..254d5f3 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -32,6 +32,7 @@ @@ -83702,7 +83793,7 @@ index 0713bfb..b95bb87 100644 .next = NULL, }; diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index 6a83cd3..3ab04ef 100644 +index 6a83cd3..4cc7b16 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -58,6 +58,7 @@ @@ -83797,20 +83888,6 @@ index 6a83cd3..3ab04ef 100644 if (order && (gfp_flags & __GFP_COMP)) prep_compound_page(page, order); -@@ -3752,7 +3791,13 @@ static int pageblock_is_reserved(unsigned long start_pfn, unsigned long end_pfn) - unsigned long pfn; - - for (pfn = start_pfn; pfn < end_pfn; pfn++) { -+#ifdef CONFIG_X86_32 -+ /* boot failures in VMware 8 on 32bit vanilla since -+ this change */ -+ if (!pfn_valid(pfn) || PageReserved(pfn_to_page(pfn))) -+#else - if (!pfn_valid_within(pfn) || PageReserved(pfn_to_page(pfn))) -+#endif - return 1; - } - return 0; diff --git a/mm/percpu.c b/mm/percpu.c index 8c8e08f..73a5cda 100644 --- a/mm/percpu.c @@ -86372,6 +86449,24 @@ index 2dc6cda..2159524 100644 i++, cmfptr++) { struct socket *sock; +diff --git a/net/core/secure_seq.c b/net/core/secure_seq.c +index e61a8bb..6a2f13c 100644 +--- a/net/core/secure_seq.c ++++ b/net/core/secure_seq.c +@@ -12,12 +12,10 @@ + + static u32 net_secret[MD5_MESSAGE_BYTES / 4] ____cacheline_aligned; + +-static int __init net_secret_init(void) ++void net_secret_init(void) + { + get_random_bytes(net_secret, sizeof(net_secret)); +- return 0; + } +-late_initcall(net_secret_init); + + #ifdef CONFIG_INET + static u32 seq_scale(u32 seq) diff --git a/net/core/sock.c b/net/core/sock.c index bc131d4..029e378 100644 --- a/net/core/sock.c @@ -86665,10 +86760,30 @@ index a55eecc..dd8428c 100644 *lenp = len; diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c -index fcf104e..95552d4 100644 +index fcf104e..6b748ea 100644 --- a/net/ipv4/af_inet.c +++ b/net/ipv4/af_inet.c -@@ -1717,13 +1717,9 @@ static int __init inet_init(void) +@@ -115,6 +115,7 @@ + #include <net/inet_common.h> + #include <net/xfrm.h> + #include <net/net_namespace.h> ++#include <net/secure_seq.h> + #ifdef CONFIG_IP_MROUTE + #include <linux/mroute.h> + #endif +@@ -263,8 +264,10 @@ void build_ehash_secret(void) + get_random_bytes(&rnd, sizeof(rnd)); + } while (rnd == 0); + +- if (cmpxchg(&inet_ehash_secret, 0, rnd) == 0) ++ if (cmpxchg(&inet_ehash_secret, 0, rnd) == 0) { + get_random_bytes(&ipv6_hash_secret, sizeof(ipv6_hash_secret)); ++ net_secret_init(); ++ } + } + EXPORT_SYMBOL(build_ehash_secret); + +@@ -1717,13 +1720,9 @@ static int __init inet_init(void) BUILD_BUG_ON(sizeof(struct inet_skb_parm) > sizeof(dummy_skb->cb)); @@ -86683,7 +86798,7 @@ index fcf104e..95552d4 100644 rc = proto_register(&udp_prot, 1); if (rc) -@@ -1832,8 +1828,6 @@ out_unregister_udp_proto: +@@ -1832,8 +1831,6 @@ out_unregister_udp_proto: proto_unregister(&udp_prot); out_unregister_tcp_proto: proto_unregister(&tcp_prot); @@ -88491,7 +88606,7 @@ index 1b087ff..bf600e9 100644 /* * Goal: diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c -index 79a48f3..5e185c9 100644 +index 64619f4..c497f0f 100644 --- a/net/mac80211/pm.c +++ b/net/mac80211/pm.c @@ -35,7 +35,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan) @@ -89251,18 +89366,9 @@ index c111bd0..7788ff7 100644 return 0; } diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c -index 5a940db..f0b9c12 100644 +index 5a940db..d6a502d 100644 --- a/net/phonet/af_phonet.c +++ b/net/phonet/af_phonet.c -@@ -41,7 +41,7 @@ static struct phonet_protocol *phonet_proto_get(unsigned int protocol) - { - struct phonet_protocol *pp; - -- if (protocol >= PHONET_NPROTO) -+ if (protocol < 0 || protocol >= PHONET_NPROTO) - return NULL; - - rcu_read_lock(); @@ -469,7 +469,7 @@ int __init_or_module phonet_proto_register(unsigned int protocol, { int err = 0; @@ -89786,6 +89892,19 @@ index 391a245..296b3d7 100644 } /* Initialize IPv6 support and register with socket layer. */ +diff --git a/net/sctp/probe.c b/net/sctp/probe.c +index 5f7518d..9b91f6c 100644 +--- a/net/sctp/probe.c ++++ b/net/sctp/probe.c +@@ -63,7 +63,7 @@ static struct { + struct timespec tstart; + } sctpw; + +-static void printl(const char *fmt, ...) ++static __printf(1, 2) void printl(const char *fmt, ...) + { + va_list args; + int len; diff --git a/net/sctp/proc.c b/net/sctp/proc.c index 8c19e97..16264b8 100644 --- a/net/sctp/proc.c diff --git a/3.8.11/4425_grsec_remove_EI_PAX.patch b/3.8.12/4425_grsec_remove_EI_PAX.patch index 7d06ac2..7d06ac2 100644 --- a/3.8.11/4425_grsec_remove_EI_PAX.patch +++ b/3.8.12/4425_grsec_remove_EI_PAX.patch diff --git a/3.8.11/4430_grsec-remove-localversion-grsec.patch b/3.8.12/4430_grsec-remove-localversion-grsec.patch index 31cf878..31cf878 100644 --- a/3.8.11/4430_grsec-remove-localversion-grsec.patch +++ b/3.8.12/4430_grsec-remove-localversion-grsec.patch diff --git a/3.8.11/4435_grsec-mute-warnings.patch b/3.8.12/4435_grsec-mute-warnings.patch index ed941d5..ed941d5 100644 --- a/3.8.11/4435_grsec-mute-warnings.patch +++ b/3.8.12/4435_grsec-mute-warnings.patch diff --git a/3.8.11/4440_grsec-remove-protected-paths.patch b/3.8.12/4440_grsec-remove-protected-paths.patch index 637934a..637934a 100644 --- a/3.8.11/4440_grsec-remove-protected-paths.patch +++ b/3.8.12/4440_grsec-remove-protected-paths.patch diff --git a/3.8.11/4450_grsec-kconfig-default-gids.patch b/3.8.12/4450_grsec-kconfig-default-gids.patch index 7c20c40..7c20c40 100644 --- a/3.8.11/4450_grsec-kconfig-default-gids.patch +++ b/3.8.12/4450_grsec-kconfig-default-gids.patch diff --git a/3.8.11/4465_selinux-avc_audit-log-curr_ip.patch b/3.8.12/4465_selinux-avc_audit-log-curr_ip.patch index 0a309c8..0a309c8 100644 --- a/3.8.11/4465_selinux-avc_audit-log-curr_ip.patch +++ b/3.8.12/4465_selinux-avc_audit-log-curr_ip.patch diff --git a/3.8.11/4470_disable-compat_vdso.patch b/3.8.12/4470_disable-compat_vdso.patch index 3ef36aa..3ef36aa 100644 --- a/3.8.11/4470_disable-compat_vdso.patch +++ b/3.8.12/4470_disable-compat_vdso.patch |