Annotation of /trunk/kernel26-magellan-server/patches-2.6.25-r5/0100-2.6.25.1-all-fixes.patch
Parent Directory | Revision Log
Revision 677 -
(hide annotations)
(download)
Wed Sep 10 21:27:27 2008 UTC (16 years ago) by niro
File size: 36826 byte(s)
Wed Sep 10 21:27:27 2008 UTC (16 years ago) by niro
File size: 36826 byte(s)
2.6.25-magellan-r5: - updated to linux-2.6.25.17
1 | niro | 677 | diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c |
2 | index 8c71daf..9fee37e 100644 | ||
3 | --- a/arch/alpha/kernel/osf_sys.c | ||
4 | +++ b/arch/alpha/kernel/osf_sys.c | ||
5 | @@ -75,6 +75,7 @@ osf_set_program_attributes(unsigned long text_start, unsigned long text_len, | ||
6 | lock_kernel(); | ||
7 | mm = current->mm; | ||
8 | mm->end_code = bss_start + bss_len; | ||
9 | + mm->start_brk = bss_start + bss_len; | ||
10 | mm->brk = bss_start + bss_len; | ||
11 | #if 0 | ||
12 | printk("set_program_attributes(%lx %lx %lx %lx)\n", | ||
13 | diff --git a/arch/x86/kernel/io_apic_32.c b/arch/x86/kernel/io_apic_32.c | ||
14 | index 4ca5486..f239b30 100644 | ||
15 | --- a/arch/x86/kernel/io_apic_32.c | ||
16 | +++ b/arch/x86/kernel/io_apic_32.c | ||
17 | @@ -2477,6 +2477,7 @@ void destroy_irq(unsigned int irq) | ||
18 | dynamic_irq_cleanup(irq); | ||
19 | |||
20 | spin_lock_irqsave(&vector_lock, flags); | ||
21 | + clear_bit(irq_vector[irq], used_vectors); | ||
22 | irq_vector[irq] = 0; | ||
23 | spin_unlock_irqrestore(&vector_lock, flags); | ||
24 | } | ||
25 | diff --git a/arch/x86/pci/irq.c b/arch/x86/pci/irq.c | ||
26 | index a871586..579745c 100644 | ||
27 | --- a/arch/x86/pci/irq.c | ||
28 | +++ b/arch/x86/pci/irq.c | ||
29 | @@ -200,7 +200,7 @@ static int pirq_ali_get(struct pci_dev *router, struct pci_dev *dev, int pirq) | ||
30 | { | ||
31 | static const unsigned char irqmap[16] = { 0, 9, 3, 10, 4, 5, 7, 6, 1, 11, 0, 12, 0, 14, 0, 15 }; | ||
32 | |||
33 | - WARN_ON_ONCE(pirq >= 16); | ||
34 | + WARN_ON_ONCE(pirq > 16); | ||
35 | return irqmap[read_config_nybble(router, 0x48, pirq-1)]; | ||
36 | } | ||
37 | |||
38 | @@ -209,7 +209,7 @@ static int pirq_ali_set(struct pci_dev *router, struct pci_dev *dev, int pirq, i | ||
39 | static const unsigned char irqmap[16] = { 0, 8, 0, 2, 4, 5, 7, 6, 0, 1, 3, 9, 11, 0, 13, 15 }; | ||
40 | unsigned int val = irqmap[irq]; | ||
41 | |||
42 | - WARN_ON_ONCE(pirq >= 16); | ||
43 | + WARN_ON_ONCE(pirq > 16); | ||
44 | if (val) { | ||
45 | write_config_nybble(router, 0x48, pirq-1, val); | ||
46 | return 1; | ||
47 | @@ -260,7 +260,7 @@ static int pirq_via586_get(struct pci_dev *router, struct pci_dev *dev, int pirq | ||
48 | { | ||
49 | static const unsigned int pirqmap[5] = { 3, 2, 5, 1, 1 }; | ||
50 | |||
51 | - WARN_ON_ONCE(pirq >= 5); | ||
52 | + WARN_ON_ONCE(pirq > 5); | ||
53 | return read_config_nybble(router, 0x55, pirqmap[pirq-1]); | ||
54 | } | ||
55 | |||
56 | @@ -268,7 +268,7 @@ static int pirq_via586_set(struct pci_dev *router, struct pci_dev *dev, int pirq | ||
57 | { | ||
58 | static const unsigned int pirqmap[5] = { 3, 2, 5, 1, 1 }; | ||
59 | |||
60 | - WARN_ON_ONCE(pirq >= 5); | ||
61 | + WARN_ON_ONCE(pirq > 5); | ||
62 | write_config_nybble(router, 0x55, pirqmap[pirq-1], irq); | ||
63 | return 1; | ||
64 | } | ||
65 | @@ -282,7 +282,7 @@ static int pirq_ite_get(struct pci_dev *router, struct pci_dev *dev, int pirq) | ||
66 | { | ||
67 | static const unsigned char pirqmap[4] = { 1, 0, 2, 3 }; | ||
68 | |||
69 | - WARN_ON_ONCE(pirq >= 4); | ||
70 | + WARN_ON_ONCE(pirq > 4); | ||
71 | return read_config_nybble(router,0x43, pirqmap[pirq-1]); | ||
72 | } | ||
73 | |||
74 | @@ -290,7 +290,7 @@ static int pirq_ite_set(struct pci_dev *router, struct pci_dev *dev, int pirq, i | ||
75 | { | ||
76 | static const unsigned char pirqmap[4] = { 1, 0, 2, 3 }; | ||
77 | |||
78 | - WARN_ON_ONCE(pirq >= 4); | ||
79 | + WARN_ON_ONCE(pirq > 4); | ||
80 | write_config_nybble(router, 0x43, pirqmap[pirq-1], irq); | ||
81 | return 1; | ||
82 | } | ||
83 | diff --git a/drivers/infiniband/hw/nes/nes.c b/drivers/infiniband/hw/nes/nes.c | ||
84 | index b2112f5..a3b2374 100644 | ||
85 | --- a/drivers/infiniband/hw/nes/nes.c | ||
86 | +++ b/drivers/infiniband/hw/nes/nes.c | ||
87 | @@ -751,13 +751,13 @@ static void __devexit nes_remove(struct pci_dev *pcidev) | ||
88 | |||
89 | list_del(&nesdev->list); | ||
90 | nes_destroy_cqp(nesdev); | ||
91 | + | ||
92 | + free_irq(pcidev->irq, nesdev); | ||
93 | tasklet_kill(&nesdev->dpc_tasklet); | ||
94 | |||
95 | /* Deallocate the Adapter Structure */ | ||
96 | nes_destroy_adapter(nesdev->nesadapter); | ||
97 | |||
98 | - free_irq(pcidev->irq, nesdev); | ||
99 | - | ||
100 | if (nesdev->msi_enabled) { | ||
101 | pci_disable_msi(pcidev); | ||
102 | } | ||
103 | diff --git a/drivers/infiniband/hw/nes/nes_cm.c b/drivers/infiniband/hw/nes/nes_cm.c | ||
104 | index 0bef878..96b1a0e 100644 | ||
105 | --- a/drivers/infiniband/hw/nes/nes_cm.c | ||
106 | +++ b/drivers/infiniband/hw/nes/nes_cm.c | ||
107 | @@ -1834,8 +1834,10 @@ int mini_cm_recv_pkt(struct nes_cm_core *cm_core, struct nes_vnic *nesvnic, | ||
108 | nfo.rem_addr = ntohl(iph->saddr); | ||
109 | nfo.rem_port = ntohs(tcph->source); | ||
110 | |||
111 | - nes_debug(NES_DBG_CM, "Received packet: dest=0x%08X:0x%04X src=0x%08X:0x%04X\n", | ||
112 | - iph->daddr, tcph->dest, iph->saddr, tcph->source); | ||
113 | + nes_debug(NES_DBG_CM, "Received packet: dest=" NIPQUAD_FMT | ||
114 | + ":0x%04X src=" NIPQUAD_FMT ":0x%04X\n", | ||
115 | + NIPQUAD(iph->daddr), tcph->dest, | ||
116 | + NIPQUAD(iph->saddr), tcph->source); | ||
117 | |||
118 | /* note: this call is going to increment cm_node ref count */ | ||
119 | cm_node = find_node(cm_core, | ||
120 | diff --git a/drivers/infiniband/hw/nes/nes_hw.c b/drivers/infiniband/hw/nes/nes_hw.c | ||
121 | index 49e53e4..496655e 100644 | ||
122 | --- a/drivers/infiniband/hw/nes/nes_hw.c | ||
123 | +++ b/drivers/infiniband/hw/nes/nes_hw.c | ||
124 | @@ -625,6 +625,15 @@ unsigned int nes_reset_adapter_ne020(struct nes_device *nesdev, u8 *OneG_Mode) | ||
125 | nes_debug(NES_DBG_INIT, "Did not see full soft reset done.\n"); | ||
126 | return 0; | ||
127 | } | ||
128 | + | ||
129 | + i = 0; | ||
130 | + while ((nes_read_indexed(nesdev, NES_IDX_INT_CPU_STATUS) != 0x80) && i++ < 10000) | ||
131 | + mdelay(1); | ||
132 | + if (i >= 10000) { | ||
133 | + printk(KERN_ERR PFX "Internal CPU not ready, status = %02X\n", | ||
134 | + nes_read_indexed(nesdev, NES_IDX_INT_CPU_STATUS)); | ||
135 | + return 0; | ||
136 | + } | ||
137 | } | ||
138 | |||
139 | /* port reset */ | ||
140 | @@ -673,17 +682,6 @@ unsigned int nes_reset_adapter_ne020(struct nes_device *nesdev, u8 *OneG_Mode) | ||
141 | } | ||
142 | } | ||
143 | |||
144 | - | ||
145 | - | ||
146 | - i = 0; | ||
147 | - while ((nes_read_indexed(nesdev, NES_IDX_INT_CPU_STATUS) != 0x80) && i++ < 10000) | ||
148 | - mdelay(1); | ||
149 | - if (i >= 10000) { | ||
150 | - printk(KERN_ERR PFX "Internal CPU not ready, status = %02X\n", | ||
151 | - nes_read_indexed(nesdev, NES_IDX_INT_CPU_STATUS)); | ||
152 | - return 0; | ||
153 | - } | ||
154 | - | ||
155 | return port_count; | ||
156 | } | ||
157 | |||
158 | diff --git a/drivers/md/dm-exception-store.c b/drivers/md/dm-exception-store.c | ||
159 | index 5bbce29..c7d305b 100644 | ||
160 | --- a/drivers/md/dm-exception-store.c | ||
161 | +++ b/drivers/md/dm-exception-store.c | ||
162 | @@ -131,7 +131,7 @@ struct pstore { | ||
163 | |||
164 | static unsigned sectors_to_pages(unsigned sectors) | ||
165 | { | ||
166 | - return sectors / (PAGE_SIZE >> 9); | ||
167 | + return DIV_ROUND_UP(sectors, PAGE_SIZE >> 9); | ||
168 | } | ||
169 | |||
170 | static int alloc_area(struct pstore *ps) | ||
171 | diff --git a/drivers/media/video/cx88/cx88-cards.c b/drivers/media/video/cx88/cx88-cards.c | ||
172 | index 8c9a8ad..8bf5596 100644 | ||
173 | --- a/drivers/media/video/cx88/cx88-cards.c | ||
174 | +++ b/drivers/media/video/cx88/cx88-cards.c | ||
175 | @@ -1354,6 +1354,10 @@ static const struct cx88_board cx88_boards[] = { | ||
176 | }}, | ||
177 | /* fixme: Add radio support */ | ||
178 | .mpeg = CX88_MPEG_DVB | CX88_MPEG_BLACKBIRD, | ||
179 | + .radio = { | ||
180 | + .type = CX88_RADIO, | ||
181 | + .gpio0 = 0xe780, | ||
182 | + }, | ||
183 | }, | ||
184 | [CX88_BOARD_ADSTECH_PTV_390] = { | ||
185 | .name = "ADS Tech Instant Video PCI", | ||
186 | diff --git a/drivers/media/video/ivtv/ivtv-ioctl.c b/drivers/media/video/ivtv/ivtv-ioctl.c | ||
187 | index edef2a5..1e6f36e 100644 | ||
188 | --- a/drivers/media/video/ivtv/ivtv-ioctl.c | ||
189 | +++ b/drivers/media/video/ivtv/ivtv-ioctl.c | ||
190 | @@ -741,7 +741,8 @@ int ivtv_v4l2_ioctls(struct ivtv *itv, struct file *filp, unsigned int cmd, void | ||
191 | |||
192 | memset(vcap, 0, sizeof(*vcap)); | ||
193 | strcpy(vcap->driver, IVTV_DRIVER_NAME); /* driver name */ | ||
194 | - strcpy(vcap->card, itv->card_name); /* card type */ | ||
195 | + strncpy(vcap->card, itv->card_name, | ||
196 | + sizeof(vcap->card)-1); /* card type */ | ||
197 | strcpy(vcap->bus_info, pci_name(itv->dev)); /* bus info... */ | ||
198 | vcap->version = IVTV_DRIVER_VERSION; /* version */ | ||
199 | vcap->capabilities = itv->v4l2_cap; /* capabilities */ | ||
200 | diff --git a/drivers/media/video/tea5761.c b/drivers/media/video/tea5761.c | ||
201 | index 5326eec..de7e060 100644 | ||
202 | --- a/drivers/media/video/tea5761.c | ||
203 | +++ b/drivers/media/video/tea5761.c | ||
204 | @@ -249,14 +249,19 @@ int tea5761_autodetection(struct i2c_adapter* i2c_adap, u8 i2c_addr) | ||
205 | |||
206 | if (16 != (rc = tuner_i2c_xfer_recv(&i2c, buffer, 16))) { | ||
207 | printk(KERN_WARNING "it is not a TEA5761. Received %i chars.\n", rc); | ||
208 | - return EINVAL; | ||
209 | + return -EINVAL; | ||
210 | } | ||
211 | |||
212 | - if (!((buffer[13] != 0x2b) || (buffer[14] != 0x57) || (buffer[15] != 0x061))) { | ||
213 | - printk(KERN_WARNING "Manufacturer ID= 0x%02x, Chip ID = %02x%02x. It is not a TEA5761\n",buffer[13],buffer[14],buffer[15]); | ||
214 | - return EINVAL; | ||
215 | + if ((buffer[13] != 0x2b) || (buffer[14] != 0x57) || (buffer[15] != 0x061)) { | ||
216 | + printk(KERN_WARNING "Manufacturer ID= 0x%02x, Chip ID = %02x%02x." | ||
217 | + " It is not a TEA5761\n", | ||
218 | + buffer[13], buffer[14], buffer[15]); | ||
219 | + return -EINVAL; | ||
220 | } | ||
221 | - printk(KERN_WARNING "TEA5761 detected.\n"); | ||
222 | + printk(KERN_WARNING "tea5761: TEA%02x%02x detected. " | ||
223 | + "Manufacturer ID= 0x%02x\n", | ||
224 | + buffer[14], buffer[15], buffer[13]); | ||
225 | + | ||
226 | return 0; | ||
227 | } | ||
228 | |||
229 | diff --git a/drivers/media/video/tuner-core.c b/drivers/media/video/tuner-core.c | ||
230 | index 78a09a2..8cdbdd0 100644 | ||
231 | --- a/drivers/media/video/tuner-core.c | ||
232 | +++ b/drivers/media/video/tuner-core.c | ||
233 | @@ -1112,8 +1112,8 @@ static int tuner_probe(struct i2c_client *client) | ||
234 | if (!no_autodetect) { | ||
235 | switch (client->addr) { | ||
236 | case 0x10: | ||
237 | - if (tea5761_autodetection(t->i2c->adapter, t->i2c->addr) | ||
238 | - != EINVAL) { | ||
239 | + if (tea5761_autodetection(t->i2c->adapter, | ||
240 | + t->i2c->addr) >= 0) { | ||
241 | t->type = TUNER_TEA5761; | ||
242 | t->mode_mask = T_RADIO; | ||
243 | t->mode = T_STANDBY; | ||
244 | @@ -1125,7 +1125,7 @@ static int tuner_probe(struct i2c_client *client) | ||
245 | |||
246 | goto register_client; | ||
247 | } | ||
248 | - break; | ||
249 | + return -ENODEV; | ||
250 | case 0x42: | ||
251 | case 0x43: | ||
252 | case 0x4a: | ||
253 | diff --git a/drivers/net/s2io.c b/drivers/net/s2io.c | ||
254 | index c082cf0..de11039 100644 | ||
255 | --- a/drivers/net/s2io.c | ||
256 | +++ b/drivers/net/s2io.c | ||
257 | @@ -84,7 +84,7 @@ | ||
258 | #include "s2io.h" | ||
259 | #include "s2io-regs.h" | ||
260 | |||
261 | -#define DRV_VERSION "2.0.26.20" | ||
262 | +#define DRV_VERSION "2.0.26.22" | ||
263 | |||
264 | /* S2io Driver name & version. */ | ||
265 | static char s2io_driver_name[] = "Neterion"; | ||
266 | @@ -2339,7 +2339,7 @@ static void free_tx_buffers(struct s2io_nic *nic) | ||
267 | for (i = 0; i < config->tx_fifo_num; i++) { | ||
268 | unsigned long flags; | ||
269 | spin_lock_irqsave(&mac_control->fifos[i].tx_lock, flags); | ||
270 | - for (j = 0; j < config->tx_cfg[i].fifo_len - 1; j++) { | ||
271 | + for (j = 0; j < config->tx_cfg[i].fifo_len; j++) { | ||
272 | txdp = (struct TxD *) \ | ||
273 | mac_control->fifos[i].list_info[j].list_virt_addr; | ||
274 | skb = s2io_txdl_getskb(&mac_control->fifos[i], txdp, j); | ||
275 | diff --git a/drivers/net/tehuti.c b/drivers/net/tehuti.c | ||
276 | index 17585e5..432e837 100644 | ||
277 | --- a/drivers/net/tehuti.c | ||
278 | +++ b/drivers/net/tehuti.c | ||
279 | @@ -625,6 +625,12 @@ static void __init bdx_firmware_endianess(void) | ||
280 | s_firmLoad[i] = CPU_CHIP_SWAP32(s_firmLoad[i]); | ||
281 | } | ||
282 | |||
283 | +static int bdx_range_check(struct bdx_priv *priv, u32 offset) | ||
284 | +{ | ||
285 | + return (offset > (u32) (BDX_REGS_SIZE / priv->nic->port_num)) ? | ||
286 | + -EINVAL : 0; | ||
287 | +} | ||
288 | + | ||
289 | static int bdx_ioctl_priv(struct net_device *ndev, struct ifreq *ifr, int cmd) | ||
290 | { | ||
291 | struct bdx_priv *priv = ndev->priv; | ||
292 | @@ -643,9 +649,15 @@ static int bdx_ioctl_priv(struct net_device *ndev, struct ifreq *ifr, int cmd) | ||
293 | DBG("%d 0x%x 0x%x\n", data[0], data[1], data[2]); | ||
294 | } | ||
295 | |||
296 | + if (!capable(CAP_SYS_RAWIO)) | ||
297 | + return -EPERM; | ||
298 | + | ||
299 | switch (data[0]) { | ||
300 | |||
301 | case BDX_OP_READ: | ||
302 | + error = bdx_range_check(priv, data[1]); | ||
303 | + if (error < 0) | ||
304 | + return error; | ||
305 | data[2] = READ_REG(priv, data[1]); | ||
306 | DBG("read_reg(0x%x)=0x%x (dec %d)\n", data[1], data[2], | ||
307 | data[2]); | ||
308 | @@ -655,6 +667,9 @@ static int bdx_ioctl_priv(struct net_device *ndev, struct ifreq *ifr, int cmd) | ||
309 | break; | ||
310 | |||
311 | case BDX_OP_WRITE: | ||
312 | + error = bdx_range_check(priv, data[1]); | ||
313 | + if (error < 0) | ||
314 | + return error; | ||
315 | WRITE_REG(priv, data[1], data[2]); | ||
316 | DBG("write_reg(0x%x, 0x%x)\n", data[1], data[2]); | ||
317 | break; | ||
318 | diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c | ||
319 | index 96043c5..bc4c62b 100644 | ||
320 | --- a/drivers/net/tg3.c | ||
321 | +++ b/drivers/net/tg3.c | ||
322 | @@ -64,8 +64,8 @@ | ||
323 | |||
324 | #define DRV_MODULE_NAME "tg3" | ||
325 | #define PFX DRV_MODULE_NAME ": " | ||
326 | -#define DRV_MODULE_VERSION "3.90" | ||
327 | -#define DRV_MODULE_RELDATE "April 12, 2008" | ||
328 | +#define DRV_MODULE_VERSION "3.91" | ||
329 | +#define DRV_MODULE_RELDATE "April 18, 2008" | ||
330 | |||
331 | #define TG3_DEF_MAC_MODE 0 | ||
332 | #define TG3_DEF_RX_MODE 0 | ||
333 | @@ -4135,11 +4135,21 @@ static int tigon3_dma_hwbug_workaround(struct tg3 *tp, struct sk_buff *skb, | ||
334 | u32 last_plus_one, u32 *start, | ||
335 | u32 base_flags, u32 mss) | ||
336 | { | ||
337 | - struct sk_buff *new_skb = skb_copy(skb, GFP_ATOMIC); | ||
338 | + struct sk_buff *new_skb; | ||
339 | dma_addr_t new_addr = 0; | ||
340 | u32 entry = *start; | ||
341 | int i, ret = 0; | ||
342 | |||
343 | + if (GET_ASIC_REV(tp->pci_chip_rev_id) != ASIC_REV_5701) | ||
344 | + new_skb = skb_copy(skb, GFP_ATOMIC); | ||
345 | + else { | ||
346 | + int more_headroom = 4 - ((unsigned long)skb->data & 3); | ||
347 | + | ||
348 | + new_skb = skb_copy_expand(skb, | ||
349 | + skb_headroom(skb) + more_headroom, | ||
350 | + skb_tailroom(skb), GFP_ATOMIC); | ||
351 | + } | ||
352 | + | ||
353 | if (!new_skb) { | ||
354 | ret = -1; | ||
355 | } else { | ||
356 | @@ -4462,7 +4472,9 @@ static int tg3_start_xmit_dma_bug(struct sk_buff *skb, struct net_device *dev) | ||
357 | |||
358 | would_hit_hwbug = 0; | ||
359 | |||
360 | - if (tg3_4g_overflow_test(mapping, len)) | ||
361 | + if (tp->tg3_flags3 & TG3_FLG3_5701_DMA_BUG) | ||
362 | + would_hit_hwbug = 1; | ||
363 | + else if (tg3_4g_overflow_test(mapping, len)) | ||
364 | would_hit_hwbug = 1; | ||
365 | |||
366 | tg3_set_txd(tp, entry, mapping, len, base_flags, | ||
367 | @@ -11339,6 +11351,38 @@ static int __devinit tg3_get_invariants(struct tg3 *tp) | ||
368 | } | ||
369 | } | ||
370 | |||
371 | + if ((GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5701)) { | ||
372 | + static struct tg3_dev_id { | ||
373 | + u32 vendor; | ||
374 | + u32 device; | ||
375 | + } bridge_chipsets[] = { | ||
376 | + { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_PXH_0 }, | ||
377 | + { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_PXH_1 }, | ||
378 | + { }, | ||
379 | + }; | ||
380 | + struct tg3_dev_id *pci_id = &bridge_chipsets[0]; | ||
381 | + struct pci_dev *bridge = NULL; | ||
382 | + | ||
383 | + while (pci_id->vendor != 0) { | ||
384 | + bridge = pci_get_device(pci_id->vendor, | ||
385 | + pci_id->device, | ||
386 | + bridge); | ||
387 | + if (!bridge) { | ||
388 | + pci_id++; | ||
389 | + continue; | ||
390 | + } | ||
391 | + if (bridge->subordinate && | ||
392 | + (bridge->subordinate->number <= | ||
393 | + tp->pdev->bus->number) && | ||
394 | + (bridge->subordinate->subordinate >= | ||
395 | + tp->pdev->bus->number)) { | ||
396 | + tp->tg3_flags3 |= TG3_FLG3_5701_DMA_BUG; | ||
397 | + pci_dev_put(bridge); | ||
398 | + break; | ||
399 | + } | ||
400 | + } | ||
401 | + } | ||
402 | + | ||
403 | /* The EPB bridge inside 5714, 5715, and 5780 cannot support | ||
404 | * DMA addresses > 40-bit. This bridge may have other additional | ||
405 | * 57xx devices behind it in some 4-port NIC designs for example. | ||
406 | diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h | ||
407 | index c1075a7..c688c3a 100644 | ||
408 | --- a/drivers/net/tg3.h | ||
409 | +++ b/drivers/net/tg3.h | ||
410 | @@ -2476,6 +2476,7 @@ struct tg3 { | ||
411 | #define TG3_FLG3_NO_NVRAM_ADDR_TRANS 0x00000001 | ||
412 | #define TG3_FLG3_ENABLE_APE 0x00000002 | ||
413 | #define TG3_FLG3_5761_5784_AX_FIXES 0x00000004 | ||
414 | +#define TG3_FLG3_5701_DMA_BUG 0x00000008 | ||
415 | |||
416 | struct timer_list timer; | ||
417 | u16 timer_counter; | ||
418 | diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c | ||
419 | index 48e9124..4ec1915 100644 | ||
420 | --- a/drivers/net/wireless/b43/dma.c | ||
421 | +++ b/drivers/net/wireless/b43/dma.c | ||
422 | @@ -822,6 +822,18 @@ static u64 supported_dma_mask(struct b43_wldev *dev) | ||
423 | return DMA_30BIT_MASK; | ||
424 | } | ||
425 | |||
426 | +static enum b43_dmatype dma_mask_to_engine_type(u64 dmamask) | ||
427 | +{ | ||
428 | + if (dmamask == DMA_30BIT_MASK) | ||
429 | + return B43_DMA_30BIT; | ||
430 | + if (dmamask == DMA_32BIT_MASK) | ||
431 | + return B43_DMA_32BIT; | ||
432 | + if (dmamask == DMA_64BIT_MASK) | ||
433 | + return B43_DMA_64BIT; | ||
434 | + B43_WARN_ON(1); | ||
435 | + return B43_DMA_30BIT; | ||
436 | +} | ||
437 | + | ||
438 | /* Main initialization function. */ | ||
439 | static | ||
440 | struct b43_dmaring *b43_setup_dmaring(struct b43_wldev *dev, | ||
441 | @@ -982,6 +994,42 @@ void b43_dma_free(struct b43_wldev *dev) | ||
442 | dma->tx_ring0 = NULL; | ||
443 | } | ||
444 | |||
445 | +static int b43_dma_set_mask(struct b43_wldev *dev, u64 mask) | ||
446 | +{ | ||
447 | + u64 orig_mask = mask; | ||
448 | + bool fallback = 0; | ||
449 | + int err; | ||
450 | + | ||
451 | + /* Try to set the DMA mask. If it fails, try falling back to a | ||
452 | + * lower mask, as we can always also support a lower one. */ | ||
453 | + while (1) { | ||
454 | + err = ssb_dma_set_mask(dev->dev, mask); | ||
455 | + if (!err) | ||
456 | + break; | ||
457 | + if (mask == DMA_64BIT_MASK) { | ||
458 | + mask = DMA_32BIT_MASK; | ||
459 | + fallback = 1; | ||
460 | + continue; | ||
461 | + } | ||
462 | + if (mask == DMA_32BIT_MASK) { | ||
463 | + mask = DMA_30BIT_MASK; | ||
464 | + fallback = 1; | ||
465 | + continue; | ||
466 | + } | ||
467 | + b43err(dev->wl, "The machine/kernel does not support " | ||
468 | + "the required %u-bit DMA mask\n", | ||
469 | + (unsigned int)dma_mask_to_engine_type(orig_mask)); | ||
470 | + return -EOPNOTSUPP; | ||
471 | + } | ||
472 | + if (fallback) { | ||
473 | + b43info(dev->wl, "DMA mask fallback from %u-bit to %u-bit\n", | ||
474 | + (unsigned int)dma_mask_to_engine_type(orig_mask), | ||
475 | + (unsigned int)dma_mask_to_engine_type(mask)); | ||
476 | + } | ||
477 | + | ||
478 | + return 0; | ||
479 | +} | ||
480 | + | ||
481 | int b43_dma_init(struct b43_wldev *dev) | ||
482 | { | ||
483 | struct b43_dma *dma = &dev->dma; | ||
484 | @@ -991,27 +1039,10 @@ int b43_dma_init(struct b43_wldev *dev) | ||
485 | enum b43_dmatype type; | ||
486 | |||
487 | dmamask = supported_dma_mask(dev); | ||
488 | - switch (dmamask) { | ||
489 | - default: | ||
490 | - B43_WARN_ON(1); | ||
491 | - case DMA_30BIT_MASK: | ||
492 | - type = B43_DMA_30BIT; | ||
493 | - break; | ||
494 | - case DMA_32BIT_MASK: | ||
495 | - type = B43_DMA_32BIT; | ||
496 | - break; | ||
497 | - case DMA_64BIT_MASK: | ||
498 | - type = B43_DMA_64BIT; | ||
499 | - break; | ||
500 | - } | ||
501 | - err = ssb_dma_set_mask(dev->dev, dmamask); | ||
502 | - if (err) { | ||
503 | - b43err(dev->wl, "The machine/kernel does not support " | ||
504 | - "the required DMA mask (0x%08X%08X)\n", | ||
505 | - (unsigned int)((dmamask & 0xFFFFFFFF00000000ULL) >> 32), | ||
506 | - (unsigned int)(dmamask & 0x00000000FFFFFFFFULL)); | ||
507 | - return -EOPNOTSUPP; | ||
508 | - } | ||
509 | + type = dma_mask_to_engine_type(dmamask); | ||
510 | + err = b43_dma_set_mask(dev, dmamask); | ||
511 | + if (err) | ||
512 | + return err; | ||
513 | |||
514 | err = -ENOMEM; | ||
515 | /* setup TX DMA channels. */ | ||
516 | diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c | ||
517 | index c73a75b..f23317e 100644 | ||
518 | --- a/drivers/net/wireless/b43/main.c | ||
519 | +++ b/drivers/net/wireless/b43/main.c | ||
520 | @@ -78,6 +78,11 @@ static int modparam_nohwcrypt; | ||
521 | module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444); | ||
522 | MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption."); | ||
523 | |||
524 | +static int modparam_btcoex = 1; | ||
525 | +module_param_named(btcoex, modparam_btcoex, int, 0444); | ||
526 | +MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistance (default on)"); | ||
527 | + | ||
528 | + | ||
529 | static const struct ssb_device_id b43_ssb_tbl[] = { | ||
530 | SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5), | ||
531 | SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6), | ||
532 | @@ -3339,6 +3344,8 @@ static void b43_bluetooth_coext_enable(struct b43_wldev *dev) | ||
533 | struct ssb_sprom *sprom = &dev->dev->bus->sprom; | ||
534 | u32 hf; | ||
535 | |||
536 | + if (!modparam_btcoex) | ||
537 | + return; | ||
538 | if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST)) | ||
539 | return; | ||
540 | if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode) | ||
541 | @@ -3350,11 +3357,13 @@ static void b43_bluetooth_coext_enable(struct b43_wldev *dev) | ||
542 | else | ||
543 | hf |= B43_HF_BTCOEX; | ||
544 | b43_hf_write(dev, hf); | ||
545 | - //TODO | ||
546 | } | ||
547 | |||
548 | static void b43_bluetooth_coext_disable(struct b43_wldev *dev) | ||
549 | -{ //TODO | ||
550 | +{ | ||
551 | + if (!modparam_btcoex) | ||
552 | + return; | ||
553 | + //TODO | ||
554 | } | ||
555 | |||
556 | static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev) | ||
557 | @@ -4000,8 +4009,16 @@ static int b43_one_core_attach(struct ssb_device *dev, struct b43_wl *wl) | ||
558 | return err; | ||
559 | } | ||
560 | |||
561 | +#define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice) ( \ | ||
562 | + (pdev->vendor == PCI_VENDOR_ID_##_vendor) && \ | ||
563 | + (pdev->device == _device) && \ | ||
564 | + (pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) && \ | ||
565 | + (pdev->subsystem_device == _subdevice) ) | ||
566 | + | ||
567 | static void b43_sprom_fixup(struct ssb_bus *bus) | ||
568 | { | ||
569 | + struct pci_dev *pdev; | ||
570 | + | ||
571 | /* boardflags workarounds */ | ||
572 | if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL && | ||
573 | bus->chip_id == 0x4301 && bus->boardinfo.rev == 0x74) | ||
574 | @@ -4009,6 +4026,13 @@ static void b43_sprom_fixup(struct ssb_bus *bus) | ||
575 | if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE && | ||
576 | bus->boardinfo.type == 0x4E && bus->boardinfo.rev > 0x40) | ||
577 | bus->sprom.boardflags_lo |= B43_BFL_PACTRL; | ||
578 | + if (bus->bustype == SSB_BUSTYPE_PCI) { | ||
579 | + pdev = bus->host_pci; | ||
580 | + if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) || | ||
581 | + IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) || | ||
582 | + IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013)) | ||
583 | + bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST; | ||
584 | + } | ||
585 | } | ||
586 | |||
587 | static void b43_wireless_exit(struct ssb_device *dev, struct b43_wl *wl) | ||
588 | diff --git a/drivers/rtc/rtc-pcf8583.c b/drivers/rtc/rtc-pcf8583.c | ||
589 | index 8b39970..3d09d8f 100644 | ||
590 | --- a/drivers/rtc/rtc-pcf8583.c | ||
591 | +++ b/drivers/rtc/rtc-pcf8583.c | ||
592 | @@ -15,7 +15,7 @@ | ||
593 | #include <linux/i2c.h> | ||
594 | #include <linux/slab.h> | ||
595 | #include <linux/string.h> | ||
596 | -#include <linux/mc146818rtc.h> | ||
597 | +#include <linux/rtc.h> | ||
598 | #include <linux/init.h> | ||
599 | #include <linux/errno.h> | ||
600 | #include <linux/bcd.h> | ||
601 | diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c | ||
602 | index 3c1b433..0e8e092 100644 | ||
603 | --- a/drivers/scsi/qla2xxx/qla_os.c | ||
604 | +++ b/drivers/scsi/qla2xxx/qla_os.c | ||
605 | @@ -2357,7 +2357,7 @@ qla2x00_do_dpc(void *data) | ||
606 | } else { | ||
607 | fcport->login_retry = 0; | ||
608 | } | ||
609 | - if (fcport->login_retry == 0) | ||
610 | + if (fcport->login_retry == 0 && status != QLA_SUCCESS) | ||
611 | fcport->loop_id = FC_NO_LOOP_ID; | ||
612 | } | ||
613 | if (test_bit(LOOP_RESYNC_NEEDED, &ha->dpc_flags)) | ||
614 | diff --git a/drivers/serial/dz.c b/drivers/serial/dz.c | ||
615 | index 116211f..0dddd68 100644 | ||
616 | --- a/drivers/serial/dz.c | ||
617 | +++ b/drivers/serial/dz.c | ||
618 | @@ -819,7 +819,7 @@ static void dz_console_putchar(struct uart_port *uport, int ch) | ||
619 | dz_out(dport, DZ_TCR, mask); | ||
620 | iob(); | ||
621 | udelay(2); | ||
622 | - } while (loops--); | ||
623 | + } while (--loops); | ||
624 | |||
625 | if (loops) /* Cannot send otherwise. */ | ||
626 | dz_out(dport, DZ_TDR, ch); | ||
627 | diff --git a/drivers/ssb/pci.c b/drivers/ssb/pci.c | ||
628 | index b434df7..274a448 100644 | ||
629 | --- a/drivers/ssb/pci.c | ||
630 | +++ b/drivers/ssb/pci.c | ||
631 | @@ -482,6 +482,11 @@ static int sprom_extract(struct ssb_bus *bus, struct ssb_sprom *out, | ||
632 | goto unsupported; | ||
633 | } | ||
634 | |||
635 | + if (out->boardflags_lo == 0xFFFF) | ||
636 | + out->boardflags_lo = 0; /* per specs */ | ||
637 | + if (out->boardflags_hi == 0xFFFF) | ||
638 | + out->boardflags_hi = 0; /* per specs */ | ||
639 | + | ||
640 | return 0; | ||
641 | unsupported: | ||
642 | ssb_printk(KERN_WARNING PFX "Unsupported SPROM revision %d " | ||
643 | diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c | ||
644 | index 68fc521..7f1bc97 100644 | ||
645 | --- a/drivers/usb/core/hub.c | ||
646 | +++ b/drivers/usb/core/hub.c | ||
647 | @@ -2664,6 +2664,7 @@ loop: | ||
648 | if ((status == -ENOTCONN) || (status == -ENOTSUPP)) | ||
649 | break; | ||
650 | } | ||
651 | + dev_err(hub_dev, "unable to enumerate USB device on port %d\n", port1); | ||
652 | |||
653 | done: | ||
654 | hub_port_disable(hub, port1, 1); | ||
655 | diff --git a/drivers/usb/host/ohci-pci.c b/drivers/usb/host/ohci-pci.c | ||
656 | index d0360f6..b0e2275 100644 | ||
657 | --- a/drivers/usb/host/ohci-pci.c | ||
658 | +++ b/drivers/usb/host/ohci-pci.c | ||
659 | @@ -312,11 +312,13 @@ static int ohci_pci_suspend (struct usb_hcd *hcd, pm_message_t message) | ||
660 | |||
661 | static int ohci_pci_resume (struct usb_hcd *hcd) | ||
662 | { | ||
663 | + struct ohci_hcd *ohci = hcd_to_ohci(hcd); | ||
664 | + | ||
665 | set_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags); | ||
666 | |||
667 | /* FIXME: we should try to detect loss of VBUS power here */ | ||
668 | prepare_for_handover(hcd); | ||
669 | - | ||
670 | + ohci_writel(ohci, OHCI_INTR_MIE, &ohci->regs->intrenable); | ||
671 | return 0; | ||
672 | } | ||
673 | |||
674 | diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c | ||
675 | index ed67881..7b02a4a 100644 | ||
676 | --- a/drivers/usb/serial/sierra.c | ||
677 | +++ b/drivers/usb/serial/sierra.c | ||
678 | @@ -164,6 +164,7 @@ static struct usb_device_id id_table [] = { | ||
679 | { USB_DEVICE(0x1199, 0x6812) }, /* Sierra Wireless MC8775 & AC 875U */ | ||
680 | { USB_DEVICE(0x1199, 0x6813) }, /* Sierra Wireless MC8775 (Thinkpad internal) */ | ||
681 | { USB_DEVICE(0x1199, 0x6815) }, /* Sierra Wireless MC8775 */ | ||
682 | + { USB_DEVICE(0x03f0, 0x1e1d) }, /* HP hs2300 a.k.a MC8775 */ | ||
683 | { USB_DEVICE(0x1199, 0x6820) }, /* Sierra Wireless AirCard 875 */ | ||
684 | { USB_DEVICE(0x1199, 0x6832) }, /* Sierra Wireless MC8780*/ | ||
685 | { USB_DEVICE(0x1199, 0x6833) }, /* Sierra Wireless MC8781*/ | ||
686 | diff --git a/fs/aio.c b/fs/aio.c | ||
687 | index 2283686..ae94e1d 100644 | ||
688 | --- a/fs/aio.c | ||
689 | +++ b/fs/aio.c | ||
690 | @@ -1166,7 +1166,10 @@ retry: | ||
691 | break; | ||
692 | if (min_nr <= i) | ||
693 | break; | ||
694 | - ret = 0; | ||
695 | + if (unlikely(ctx->dead)) { | ||
696 | + ret = -EINVAL; | ||
697 | + break; | ||
698 | + } | ||
699 | if (to.timed_out) /* Only check after read evt */ | ||
700 | break; | ||
701 | /* Try to only show up in io wait if there are ops | ||
702 | @@ -1231,6 +1234,13 @@ static void io_destroy(struct kioctx *ioctx) | ||
703 | |||
704 | aio_cancel_all(ioctx); | ||
705 | wait_for_all_aios(ioctx); | ||
706 | + | ||
707 | + /* | ||
708 | + * Wake up any waiters. The setting of ctx->dead must be seen | ||
709 | + * by other CPUs at this point. Right now, we rely on the | ||
710 | + * locking done by the above calls to ensure this consistency. | ||
711 | + */ | ||
712 | + wake_up(&ioctx->wait); | ||
713 | put_ioctx(ioctx); /* once for the lookup */ | ||
714 | } | ||
715 | |||
716 | diff --git a/fs/dnotify.c b/fs/dnotify.c | ||
717 | index 28d01ed..eaecc4c 100644 | ||
718 | --- a/fs/dnotify.c | ||
719 | +++ b/fs/dnotify.c | ||
720 | @@ -20,6 +20,7 @@ | ||
721 | #include <linux/init.h> | ||
722 | #include <linux/spinlock.h> | ||
723 | #include <linux/slab.h> | ||
724 | +#include <linux/file.h> | ||
725 | |||
726 | int dir_notify_enable __read_mostly = 1; | ||
727 | |||
728 | @@ -66,6 +67,7 @@ int fcntl_dirnotify(int fd, struct file *filp, unsigned long arg) | ||
729 | struct dnotify_struct **prev; | ||
730 | struct inode *inode; | ||
731 | fl_owner_t id = current->files; | ||
732 | + struct file *f; | ||
733 | int error = 0; | ||
734 | |||
735 | if ((arg & ~DN_MULTISHOT) == 0) { | ||
736 | @@ -92,6 +94,15 @@ int fcntl_dirnotify(int fd, struct file *filp, unsigned long arg) | ||
737 | prev = &odn->dn_next; | ||
738 | } | ||
739 | |||
740 | + rcu_read_lock(); | ||
741 | + f = fcheck(fd); | ||
742 | + rcu_read_unlock(); | ||
743 | + /* we'd lost the race with close(), sod off silently */ | ||
744 | + /* note that inode->i_lock prevents reordering problems | ||
745 | + * between accesses to descriptor table and ->i_dnotify */ | ||
746 | + if (f != filp) | ||
747 | + goto out_free; | ||
748 | + | ||
749 | error = __f_setown(filp, task_pid(current), PIDTYPE_PID, 0); | ||
750 | if (error) | ||
751 | goto out_free; | ||
752 | diff --git a/fs/jffs2/erase.c b/fs/jffs2/erase.c | ||
753 | index a1db918..4c895f3 100644 | ||
754 | --- a/fs/jffs2/erase.c | ||
755 | +++ b/fs/jffs2/erase.c | ||
756 | @@ -419,9 +419,6 @@ static void jffs2_mark_erased_block(struct jffs2_sb_info *c, struct jffs2_eraseb | ||
757 | if (jffs2_write_nand_cleanmarker(c, jeb)) | ||
758 | goto filebad; | ||
759 | } | ||
760 | - | ||
761 | - /* Everything else got zeroed before the erase */ | ||
762 | - jeb->free_size = c->sector_size; | ||
763 | } else { | ||
764 | |||
765 | struct kvec vecs[1]; | ||
766 | @@ -449,18 +446,19 @@ static void jffs2_mark_erased_block(struct jffs2_sb_info *c, struct jffs2_eraseb | ||
767 | |||
768 | goto filebad; | ||
769 | } | ||
770 | - | ||
771 | - /* Everything else got zeroed before the erase */ | ||
772 | - jeb->free_size = c->sector_size; | ||
773 | - /* FIXME Special case for cleanmarker in empty block */ | ||
774 | - jffs2_link_node_ref(c, jeb, jeb->offset | REF_NORMAL, c->cleanmarker_size, NULL); | ||
775 | } | ||
776 | + /* Everything else got zeroed before the erase */ | ||
777 | + jeb->free_size = c->sector_size; | ||
778 | |||
779 | down(&c->erase_free_sem); | ||
780 | spin_lock(&c->erase_completion_lock); | ||
781 | + | ||
782 | c->erasing_size -= c->sector_size; | ||
783 | - c->free_size += jeb->free_size; | ||
784 | - c->used_size += jeb->used_size; | ||
785 | + c->free_size += c->sector_size; | ||
786 | + | ||
787 | + /* Account for cleanmarker now, if it's in-band */ | ||
788 | + if (c->cleanmarker_size && !jffs2_cleanmarker_oob(c)) | ||
789 | + jffs2_link_node_ref(c, jeb, jeb->offset | REF_NORMAL, c->cleanmarker_size, NULL); | ||
790 | |||
791 | jffs2_dbg_acct_sanity_check_nolock(c,jeb); | ||
792 | jffs2_dbg_acct_paranoia_check_nolock(c, jeb); | ||
793 | diff --git a/include/linux/rtnetlink.h b/include/linux/rtnetlink.h | ||
794 | index b9e1740..44c81c7 100644 | ||
795 | --- a/include/linux/rtnetlink.h | ||
796 | +++ b/include/linux/rtnetlink.h | ||
797 | @@ -740,13 +740,13 @@ extern void rtmsg_ifinfo(int type, struct net_device *dev, unsigned change); | ||
798 | extern void rtnl_lock(void); | ||
799 | extern void rtnl_unlock(void); | ||
800 | extern int rtnl_trylock(void); | ||
801 | +extern int rtnl_is_locked(void); | ||
802 | |||
803 | extern void rtnetlink_init(void); | ||
804 | extern void __rtnl_unlock(void); | ||
805 | |||
806 | #define ASSERT_RTNL() do { \ | ||
807 | - if (unlikely(rtnl_trylock())) { \ | ||
808 | - rtnl_unlock(); \ | ||
809 | + if (unlikely(!rtnl_is_locked())) { \ | ||
810 | printk(KERN_ERR "RTNL: assertion failed at %s (%d)\n", \ | ||
811 | __FILE__, __LINE__); \ | ||
812 | dump_stack(); \ | ||
813 | diff --git a/include/net/tcp.h b/include/net/tcp.h | ||
814 | index 4fd3eb2..d69d12e 100644 | ||
815 | --- a/include/net/tcp.h | ||
816 | +++ b/include/net/tcp.h | ||
817 | @@ -776,11 +776,14 @@ extern void tcp_enter_cwr(struct sock *sk, const int set_ssthresh); | ||
818 | extern __u32 tcp_init_cwnd(struct tcp_sock *tp, struct dst_entry *dst); | ||
819 | |||
820 | /* Slow start with delack produces 3 packets of burst, so that | ||
821 | - * it is safe "de facto". | ||
822 | + * it is safe "de facto". This will be the default - same as | ||
823 | + * the default reordering threshold - but if reordering increases, | ||
824 | + * we must be able to allow cwnd to burst at least this much in order | ||
825 | + * to not pull it back when holes are filled. | ||
826 | */ | ||
827 | static __inline__ __u32 tcp_max_burst(const struct tcp_sock *tp) | ||
828 | { | ||
829 | - return 3; | ||
830 | + return tp->reordering; | ||
831 | } | ||
832 | |||
833 | /* Returns end sequence number of the receiver's advertised window */ | ||
834 | diff --git a/include/net/xfrm.h b/include/net/xfrm.h | ||
835 | index 0d255ae..97577de 100644 | ||
836 | --- a/include/net/xfrm.h | ||
837 | +++ b/include/net/xfrm.h | ||
838 | @@ -435,6 +435,9 @@ struct xfrm_tmpl | ||
839 | /* May skip this transfomration if no SA is found */ | ||
840 | __u8 optional; | ||
841 | |||
842 | +/* Skip aalgos/ealgos/calgos checks. */ | ||
843 | + __u8 allalgs; | ||
844 | + | ||
845 | /* Bit mask of algos allowed for acquisition */ | ||
846 | __u32 aalgos; | ||
847 | __u32 ealgos; | ||
848 | diff --git a/kernel/cgroup.c b/kernel/cgroup.c | ||
849 | index 2727f92..6d8de05 100644 | ||
850 | --- a/kernel/cgroup.c | ||
851 | +++ b/kernel/cgroup.c | ||
852 | @@ -1722,7 +1722,12 @@ void cgroup_enable_task_cg_lists(void) | ||
853 | use_task_css_set_links = 1; | ||
854 | do_each_thread(g, p) { | ||
855 | task_lock(p); | ||
856 | - if (list_empty(&p->cg_list)) | ||
857 | + /* | ||
858 | + * We should check if the process is exiting, otherwise | ||
859 | + * it will race with cgroup_exit() in that the list | ||
860 | + * entry won't be deleted though the process has exited. | ||
861 | + */ | ||
862 | + if (!(p->flags & PF_EXITING) && list_empty(&p->cg_list)) | ||
863 | list_add(&p->cg_list, &p->cgroups->tasks); | ||
864 | task_unlock(p); | ||
865 | } while_each_thread(g, p); | ||
866 | diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c | ||
867 | index 98bee01..c15a359 100644 | ||
868 | --- a/kernel/hrtimer.c | ||
869 | +++ b/kernel/hrtimer.c | ||
870 | @@ -590,7 +590,6 @@ static inline int hrtimer_enqueue_reprogram(struct hrtimer *timer, | ||
871 | list_add_tail(&timer->cb_entry, | ||
872 | &base->cpu_base->cb_pending); | ||
873 | timer->state = HRTIMER_STATE_PENDING; | ||
874 | - raise_softirq(HRTIMER_SOFTIRQ); | ||
875 | return 1; | ||
876 | default: | ||
877 | BUG(); | ||
878 | @@ -633,6 +632,11 @@ static int hrtimer_switch_to_hres(void) | ||
879 | return 1; | ||
880 | } | ||
881 | |||
882 | +static inline void hrtimer_raise_softirq(void) | ||
883 | +{ | ||
884 | + raise_softirq(HRTIMER_SOFTIRQ); | ||
885 | +} | ||
886 | + | ||
887 | #else | ||
888 | |||
889 | static inline int hrtimer_hres_active(void) { return 0; } | ||
890 | @@ -651,6 +655,7 @@ static inline int hrtimer_reprogram(struct hrtimer *timer, | ||
891 | { | ||
892 | return 0; | ||
893 | } | ||
894 | +static inline void hrtimer_raise_softirq(void) { } | ||
895 | |||
896 | #endif /* CONFIG_HIGH_RES_TIMERS */ | ||
897 | |||
898 | @@ -850,7 +855,7 @@ hrtimer_start(struct hrtimer *timer, ktime_t tim, const enum hrtimer_mode mode) | ||
899 | { | ||
900 | struct hrtimer_clock_base *base, *new_base; | ||
901 | unsigned long flags; | ||
902 | - int ret; | ||
903 | + int ret, raise; | ||
904 | |||
905 | base = lock_hrtimer_base(timer, &flags); | ||
906 | |||
907 | @@ -884,8 +889,18 @@ hrtimer_start(struct hrtimer *timer, ktime_t tim, const enum hrtimer_mode mode) | ||
908 | enqueue_hrtimer(timer, new_base, | ||
909 | new_base->cpu_base == &__get_cpu_var(hrtimer_bases)); | ||
910 | |||
911 | + /* | ||
912 | + * The timer may be expired and moved to the cb_pending | ||
913 | + * list. We can not raise the softirq with base lock held due | ||
914 | + * to a possible deadlock with runqueue lock. | ||
915 | + */ | ||
916 | + raise = timer->state == HRTIMER_STATE_PENDING; | ||
917 | + | ||
918 | unlock_hrtimer_base(timer, &flags); | ||
919 | |||
920 | + if (raise) | ||
921 | + hrtimer_raise_softirq(); | ||
922 | + | ||
923 | return ret; | ||
924 | } | ||
925 | EXPORT_SYMBOL_GPL(hrtimer_start); | ||
926 | @@ -1080,8 +1095,19 @@ static void run_hrtimer_pending(struct hrtimer_cpu_base *cpu_base) | ||
927 | * If the timer was rearmed on another CPU, reprogram | ||
928 | * the event device. | ||
929 | */ | ||
930 | - if (timer->base->first == &timer->node) | ||
931 | - hrtimer_reprogram(timer, timer->base); | ||
932 | + struct hrtimer_clock_base *base = timer->base; | ||
933 | + | ||
934 | + if (base->first == &timer->node && | ||
935 | + hrtimer_reprogram(timer, base)) { | ||
936 | + /* | ||
937 | + * Timer is expired. Thus move it from tree to | ||
938 | + * pending list again. | ||
939 | + */ | ||
940 | + __remove_hrtimer(timer, base, | ||
941 | + HRTIMER_STATE_PENDING, 0); | ||
942 | + list_add_tail(&timer->cb_entry, | ||
943 | + &base->cpu_base->cb_pending); | ||
944 | + } | ||
945 | } | ||
946 | } | ||
947 | spin_unlock_irq(&cpu_base->lock); | ||
948 | diff --git a/mm/pagewalk.c b/mm/pagewalk.c | ||
949 | index 1cf1417..0afd238 100644 | ||
950 | --- a/mm/pagewalk.c | ||
951 | +++ b/mm/pagewalk.c | ||
952 | @@ -9,11 +9,15 @@ static int walk_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end, | ||
953 | int err = 0; | ||
954 | |||
955 | pte = pte_offset_map(pmd, addr); | ||
956 | - do { | ||
957 | + for (;;) { | ||
958 | err = walk->pte_entry(pte, addr, addr + PAGE_SIZE, private); | ||
959 | if (err) | ||
960 | break; | ||
961 | - } while (pte++, addr += PAGE_SIZE, addr != end); | ||
962 | + addr += PAGE_SIZE; | ||
963 | + if (addr == end) | ||
964 | + break; | ||
965 | + pte++; | ||
966 | + } | ||
967 | |||
968 | pte_unmap(pte); | ||
969 | return err; | ||
970 | diff --git a/net/can/raw.c b/net/can/raw.c | ||
971 | index 94cd7f2..c92cb8e 100644 | ||
972 | --- a/net/can/raw.c | ||
973 | +++ b/net/can/raw.c | ||
974 | @@ -573,7 +573,8 @@ static int raw_getsockopt(struct socket *sock, int level, int optname, | ||
975 | int fsize = ro->count * sizeof(struct can_filter); | ||
976 | if (len > fsize) | ||
977 | len = fsize; | ||
978 | - err = copy_to_user(optval, ro->filter, len); | ||
979 | + if (copy_to_user(optval, ro->filter, len)) | ||
980 | + err = -EFAULT; | ||
981 | } else | ||
982 | len = 0; | ||
983 | release_sock(sk); | ||
984 | diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c | ||
985 | index 2bd9c5f..0cb2772 100644 | ||
986 | --- a/net/core/rtnetlink.c | ||
987 | +++ b/net/core/rtnetlink.c | ||
988 | @@ -82,6 +82,11 @@ int rtnl_trylock(void) | ||
989 | return mutex_trylock(&rtnl_mutex); | ||
990 | } | ||
991 | |||
992 | +int rtnl_is_locked(void) | ||
993 | +{ | ||
994 | + return mutex_is_locked(&rtnl_mutex); | ||
995 | +} | ||
996 | + | ||
997 | static struct rtnl_link *rtnl_msg_handlers[NPROTO]; | ||
998 | |||
999 | static inline int rtm_msgindex(int msgtype) | ||
1000 | @@ -1389,6 +1394,7 @@ EXPORT_SYMBOL(rtnetlink_put_metrics); | ||
1001 | EXPORT_SYMBOL(rtnl_lock); | ||
1002 | EXPORT_SYMBOL(rtnl_trylock); | ||
1003 | EXPORT_SYMBOL(rtnl_unlock); | ||
1004 | +EXPORT_SYMBOL(rtnl_is_locked); | ||
1005 | EXPORT_SYMBOL(rtnl_unicast); | ||
1006 | EXPORT_SYMBOL(rtnl_notify); | ||
1007 | EXPORT_SYMBOL(rtnl_set_sk_err); | ||
1008 | diff --git a/net/dccp/probe.c b/net/dccp/probe.c | ||
1009 | index 7053bb8..44eddcf 100644 | ||
1010 | --- a/net/dccp/probe.c | ||
1011 | +++ b/net/dccp/probe.c | ||
1012 | @@ -145,7 +145,7 @@ static ssize_t dccpprobe_read(struct file *file, char __user *buf, | ||
1013 | goto out_free; | ||
1014 | |||
1015 | cnt = kfifo_get(dccpw.fifo, tbuf, len); | ||
1016 | - error = copy_to_user(buf, tbuf, cnt); | ||
1017 | + error = copy_to_user(buf, tbuf, cnt) ? -EFAULT : 0; | ||
1018 | |||
1019 | out_free: | ||
1020 | vfree(tbuf); | ||
1021 | diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c | ||
1022 | index 87dd5bf..a79a547 100644 | ||
1023 | --- a/net/ipv4/tcp_probe.c | ||
1024 | +++ b/net/ipv4/tcp_probe.c | ||
1025 | @@ -190,19 +190,18 @@ static ssize_t tcpprobe_read(struct file *file, char __user *buf, | ||
1026 | |||
1027 | width = tcpprobe_sprint(tbuf, sizeof(tbuf)); | ||
1028 | |||
1029 | - if (width < len) | ||
1030 | + if (cnt + width < len) | ||
1031 | tcp_probe.tail = (tcp_probe.tail + 1) % bufsize; | ||
1032 | |||
1033 | spin_unlock_bh(&tcp_probe.lock); | ||
1034 | |||
1035 | /* if record greater than space available | ||
1036 | return partial buffer (so far) */ | ||
1037 | - if (width >= len) | ||
1038 | + if (cnt + width >= len) | ||
1039 | break; | ||
1040 | |||
1041 | - error = copy_to_user(buf + cnt, tbuf, width); | ||
1042 | - if (error) | ||
1043 | - break; | ||
1044 | + if (copy_to_user(buf + cnt, tbuf, width)) | ||
1045 | + return -EFAULT; | ||
1046 | cnt += width; | ||
1047 | } | ||
1048 | |||
1049 | diff --git a/net/key/af_key.c b/net/key/af_key.c | ||
1050 | index e9ef9af..5ceab25 100644 | ||
1051 | --- a/net/key/af_key.c | ||
1052 | +++ b/net/key/af_key.c | ||
1053 | @@ -1856,7 +1856,7 @@ parse_ipsecrequest(struct xfrm_policy *xp, struct sadb_x_ipsecrequest *rq) | ||
1054 | t->encap_family = xp->family; | ||
1055 | |||
1056 | /* No way to set this via kame pfkey */ | ||
1057 | - t->aalgos = t->ealgos = t->calgos = ~0; | ||
1058 | + t->allalgs = 1; | ||
1059 | xp->xfrm_nr++; | ||
1060 | return 0; | ||
1061 | } | ||
1062 | diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c | ||
1063 | index 063cbc5..f9293c7 100644 | ||
1064 | --- a/net/rose/af_rose.c | ||
1065 | +++ b/net/rose/af_rose.c | ||
1066 | @@ -760,8 +760,10 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le | ||
1067 | |||
1068 | rose->neighbour = rose_get_neigh(&addr->srose_addr, &cause, | ||
1069 | &diagnostic); | ||
1070 | - if (!rose->neighbour) | ||
1071 | - return -ENETUNREACH; | ||
1072 | + if (!rose->neighbour) { | ||
1073 | + err = -ENETUNREACH; | ||
1074 | + goto out_release; | ||
1075 | + } | ||
1076 | |||
1077 | rose->lci = rose_new_lci(rose->neighbour); | ||
1078 | if (!rose->lci) { | ||
1079 | diff --git a/net/tipc/socket.c b/net/tipc/socket.c | ||
1080 | index 2290903..ac04733 100644 | ||
1081 | --- a/net/tipc/socket.c | ||
1082 | +++ b/net/tipc/socket.c | ||
1083 | @@ -1600,8 +1600,8 @@ static int getsockopt(struct socket *sock, | ||
1084 | else if (len < sizeof(value)) { | ||
1085 | res = -EINVAL; | ||
1086 | } | ||
1087 | - else if ((res = copy_to_user(ov, &value, sizeof(value)))) { | ||
1088 | - /* couldn't return value */ | ||
1089 | + else if (copy_to_user(ov, &value, sizeof(value))) { | ||
1090 | + res = -EFAULT; | ||
1091 | } | ||
1092 | else { | ||
1093 | res = put_user(sizeof(value), ol); | ||
1094 | diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c | ||
1095 | index 9fc4c31..c44076c 100644 | ||
1096 | --- a/net/xfrm/xfrm_policy.c | ||
1097 | +++ b/net/xfrm/xfrm_policy.c | ||
1098 | @@ -1772,7 +1772,7 @@ xfrm_state_ok(struct xfrm_tmpl *tmpl, struct xfrm_state *x, | ||
1099 | (x->id.spi == tmpl->id.spi || !tmpl->id.spi) && | ||
1100 | (x->props.reqid == tmpl->reqid || !tmpl->reqid) && | ||
1101 | x->props.mode == tmpl->mode && | ||
1102 | - ((tmpl->aalgos & (1<<x->props.aalgo)) || | ||
1103 | + (tmpl->allalgs || (tmpl->aalgos & (1<<x->props.aalgo)) || | ||
1104 | !(xfrm_id_proto_match(tmpl->id.proto, IPSEC_PROTO_ANY))) && | ||
1105 | !(x->props.mode != XFRM_MODE_TRANSPORT && | ||
1106 | xfrm_state_addr_cmp(tmpl, x, family)); | ||
1107 | diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c | ||
1108 | index 019d21d..12f19be 100644 | ||
1109 | --- a/net/xfrm/xfrm_user.c | ||
1110 | +++ b/net/xfrm/xfrm_user.c | ||
1111 | @@ -975,6 +975,8 @@ static void copy_templates(struct xfrm_policy *xp, struct xfrm_user_tmpl *ut, | ||
1112 | t->aalgos = ut->aalgos; | ||
1113 | t->ealgos = ut->ealgos; | ||
1114 | t->calgos = ut->calgos; | ||
1115 | + /* If all masks are ~0, then we allow all algorithms. */ | ||
1116 | + t->allalgs = !~(t->aalgos & t->ealgos & t->calgos); | ||
1117 | t->encap_family = ut->family; | ||
1118 | } | ||
1119 | } | ||
1120 | diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c | ||
1121 | index d39b59c..f4fa982 100644 | ||
1122 | --- a/security/selinux/hooks.c | ||
1123 | +++ b/security/selinux/hooks.c | ||
1124 | @@ -756,9 +756,18 @@ static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb, | ||
1125 | int set_context = (oldsbsec->flags & CONTEXT_MNT); | ||
1126 | int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT); | ||
1127 | |||
1128 | - /* we can't error, we can't save the info, this shouldn't get called | ||
1129 | - * this early in the boot process. */ | ||
1130 | - BUG_ON(!ss_initialized); | ||
1131 | + /* | ||
1132 | + * if the parent was able to be mounted it clearly had no special lsm | ||
1133 | + * mount options. thus we can safely put this sb on the list and deal | ||
1134 | + * with it later | ||
1135 | + */ | ||
1136 | + if (!ss_initialized) { | ||
1137 | + spin_lock(&sb_security_lock); | ||
1138 | + if (list_empty(&newsbsec->list)) | ||
1139 | + list_add(&newsbsec->list, &superblock_security_head); | ||
1140 | + spin_unlock(&sb_security_lock); | ||
1141 | + return; | ||
1142 | + } | ||
1143 | |||
1144 | /* how can we clone if the old one wasn't set up?? */ | ||
1145 | BUG_ON(!oldsbsec->initialized); |