Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel26-magellan/patches-2.6.29-r8/0100-2.6.29.1-all-fixes.patch

    Annotation of /trunk/kernel26-magellan/patches-2.6.29-r8/0100-2.6.29.1-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 1114 - (hide annotations) (download)
    Sun Aug 22 17:59:15 2010 UTC (13 years, 8 months ago) by niro
    File size: 42037 byte(s) 
    -added
    1 niro 1114 diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h
    2     index a58378c..ce3b36e 100644
    3     --- a/arch/arm/include/asm/elf.h
    4     +++ b/arch/arm/include/asm/elf.h
    5     @@ -50,6 +50,7 @@ typedef struct user_fp elf_fpregset_t;
    6     #define R_ARM_ABS32 2
    7     #define R_ARM_CALL 28
    8     #define R_ARM_JUMP24 29
    9     +#define R_ARM_V4BX 40
    10    
    11     /*
    12     * These are used to set parameters in the core dumps.
    13     diff --git a/arch/arm/kernel/module.c b/arch/arm/kernel/module.c
    14     index dab48f2..9f509fd 100644
    15     --- a/arch/arm/kernel/module.c
    16     +++ b/arch/arm/kernel/module.c
    17     @@ -132,6 +132,15 @@ apply_relocate(Elf32_Shdr *sechdrs, const char *strtab, unsigned int symindex,
    18     *(u32 *)loc |= offset & 0x00ffffff;
    19     break;
    20    
    21     + case R_ARM_V4BX:
    22     + /* Preserve Rm and the condition code. Alter
    23     + * other bits to re-code instruction as
    24     + * MOV PC,Rm.
    25     + */
    26     + *(u32 *)loc &= 0xf000000f;
    27     + *(u32 *)loc |= 0x01a0f000;
    28     + break;
    29     +
    30     default:
    31     printk(KERN_ERR "%s: unknown relocation: %u\n",
    32     module->name, ELF32_R_TYPE(rel->r_info));
    33     diff --git a/arch/arm/mach-iop13xx/pci.c b/arch/arm/mach-iop13xx/pci.c
    34     index 673b0db..4873f26 100644
    35     --- a/arch/arm/mach-iop13xx/pci.c
    36     +++ b/arch/arm/mach-iop13xx/pci.c
    37     @@ -1026,8 +1026,10 @@ int iop13xx_pci_setup(int nr, struct pci_sys_data *sys)
    38     which_atu = 0;
    39     }
    40    
    41     - if (!which_atu)
    42     + if (!which_atu) {
    43     + kfree(res);
    44     return 0;
    45     + }
    46    
    47     switch(which_atu) {
    48     case IOP13XX_INIT_ATU_ATUX:
    49     @@ -1074,6 +1076,7 @@ int iop13xx_pci_setup(int nr, struct pci_sys_data *sys)
    50     sys->map_irq = iop13xx_pcie_map_irq;
    51     break;
    52     default:
    53     + kfree(res);
    54     return 0;
    55     }
    56    
    57     diff --git a/arch/arm/mach-omap2/mmc-twl4030.c b/arch/arm/mach-omap2/mmc-twl4030.c
    58     index 437f520..e1dadf7 100644
    59     --- a/arch/arm/mach-omap2/mmc-twl4030.c
    60     +++ b/arch/arm/mach-omap2/mmc-twl4030.c
    61     @@ -397,6 +397,7 @@ void __init twl4030_mmc_init(struct twl4030_hsmmc_info *controllers)
    62     break;
    63     default:
    64     pr_err("MMC%d configuration not supported!\n", c->mmc);
    65     + kfree(mmc);
    66     continue;
    67     }
    68     hsmmc_data[c->mmc - 1] = mmc;
    69     diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
    70     index d4d082c..5a89e57 100644
    71     --- a/arch/arm/mm/mmu.c
    72     +++ b/arch/arm/mm/mmu.c
    73     @@ -694,7 +694,7 @@ static void __init sanity_check_meminfo(void)
    74     * the vmalloc area.
    75     */
    76     if (__va(bank->start) >= VMALLOC_MIN ||
    77     - __va(bank->start) < PAGE_OFFSET) {
    78     + __va(bank->start) < (void *)PAGE_OFFSET) {
    79     printk(KERN_NOTICE "Ignoring RAM at %.8lx-%.8lx "
    80     "(vmalloc region overlap).\n",
    81     bank->start, bank->start + bank->size - 1);
    82     diff --git a/arch/sparc/include/asm/tlb_64.h b/arch/sparc/include/asm/tlb_64.h
    83     index ec81cde..0aaa086 100644
    84     --- a/arch/sparc/include/asm/tlb_64.h
    85     +++ b/arch/sparc/include/asm/tlb_64.h
    86     @@ -58,6 +58,8 @@ static inline struct mmu_gather *tlb_gather_mmu(struct mm_struct *mm, unsigned i
    87     static inline void tlb_flush_mmu(struct mmu_gather *mp)
    88     {
    89     if (mp->need_flush) {
    90     + if (!mp->fullmm)
    91     + flush_tlb_pending();
    92     free_pages_and_swap_cache(mp->pages, mp->pages_nr);
    93     mp->pages_nr = 0;
    94     mp->need_flush = 0;
    95     @@ -78,8 +80,6 @@ static inline void tlb_finish_mmu(struct mmu_gather *mp, unsigned long start, un
    96    
    97     if (mp->fullmm)
    98     mp->fullmm = 0;
    99     - else
    100     - flush_tlb_pending();
    101    
    102     /* keep the page table cache within bounds */
    103     check_pgt_cache();
    104     diff --git a/arch/sparc/kernel/nmi.c b/arch/sparc/kernel/nmi.c
    105     index f357722..2c0cc72 100644
    106     --- a/arch/sparc/kernel/nmi.c
    107     +++ b/arch/sparc/kernel/nmi.c
    108     @@ -13,6 +13,7 @@
    109     #include <linux/module.h>
    110     #include <linux/kprobes.h>
    111     #include <linux/kernel_stat.h>
    112     +#include <linux/reboot.h>
    113     #include <linux/slab.h>
    114     #include <linux/kdebug.h>
    115     #include <linux/delay.h>
    116     @@ -206,13 +207,33 @@ void nmi_adjust_hz(unsigned int new_hz)
    117     }
    118     EXPORT_SYMBOL_GPL(nmi_adjust_hz);
    119    
    120     +static int nmi_shutdown(struct notifier_block *nb, unsigned long cmd, void *p)
    121     +{
    122     + on_each_cpu(stop_watchdog, NULL, 1);
    123     + return 0;
    124     +}
    125     +
    126     +static struct notifier_block nmi_reboot_notifier = {
    127     + .notifier_call = nmi_shutdown,
    128     +};
    129     +
    130     int __init nmi_init(void)
    131     {
    132     + int err;
    133     +
    134     nmi_usable = 1;
    135    
    136     on_each_cpu(start_watchdog, NULL, 1);
    137    
    138     - return check_nmi_watchdog();
    139     + err = check_nmi_watchdog();
    140     + if (!err) {
    141     + err = register_reboot_notifier(&nmi_reboot_notifier);
    142     + if (err) {
    143     + nmi_usable = 0;
    144     + on_each_cpu(stop_watchdog, NULL, 1);
    145     + }
    146     + }
    147     + return err;
    148     }
    149    
    150     static int __init setup_nmi_watchdog(char *str)
    151     diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
    152     index 6cd1a5b..79457f6 100644
    153     --- a/arch/sparc/kernel/smp_64.c
    154     +++ b/arch/sparc/kernel/smp_64.c
    155     @@ -1031,7 +1031,7 @@ void smp_fetch_global_regs(void)
    156     * If the address space is non-shared (ie. mm->count == 1) we avoid
    157     * cross calls when we want to flush the currently running process's
    158     * tlb state. This is done by clearing all cpu bits except the current
    159     - * processor's in current->active_mm->cpu_vm_mask and performing the
    160     + * processor's in current->mm->cpu_vm_mask and performing the
    161     * flush locally only. This will force any subsequent cpus which run
    162     * this task to flush the context from the local tlb if the process
    163     * migrates to another cpu (again).
    164     @@ -1074,7 +1074,7 @@ void smp_flush_tlb_pending(struct mm_struct *mm, unsigned long nr, unsigned long
    165     u32 ctx = CTX_HWBITS(mm->context);
    166     int cpu = get_cpu();
    167    
    168     - if (mm == current->active_mm && atomic_read(&mm->mm_users) == 1)
    169     + if (mm == current->mm && atomic_read(&mm->mm_users) == 1)
    170     mm->cpu_vm_mask = cpumask_of_cpu(cpu);
    171     else
    172     smp_cross_call_masked(&xcall_flush_tlb_pending,
    173     diff --git a/arch/x86/kernel/check.c b/arch/x86/kernel/check.c
    174     index 2ac0ab7..a7a50b2 100644
    175     --- a/arch/x86/kernel/check.c
    176     +++ b/arch/x86/kernel/check.c
    177     @@ -86,12 +86,12 @@ void __init setup_bios_corruption_check(void)
    178     if (addr == 0)
    179     break;
    180    
    181     + if (addr >= corruption_check_size)
    182     + break;
    183     +
    184     if ((addr + size) > corruption_check_size)
    185     size = corruption_check_size - addr;
    186    
    187     - if (size == 0)
    188     - break;
    189     -
    190     e820_update_range(addr, size, E820_RAM, E820_RESERVED);
    191     scan_areas[num_scan_areas].addr = addr;
    192     scan_areas[num_scan_areas].size = size;
    193     diff --git a/arch/x86/kernel/cpu/mtrr/generic.c b/arch/x86/kernel/cpu/mtrr/generic.c
    194     index 0c0a455..6f557e0 100644
    195     --- a/arch/x86/kernel/cpu/mtrr/generic.c
    196     +++ b/arch/x86/kernel/cpu/mtrr/generic.c
    197     @@ -41,6 +41,32 @@ static int __init mtrr_debug(char *opt)
    198     }
    199     early_param("mtrr.show", mtrr_debug);
    200    
    201     +/**
    202     + * BIOS is expected to clear MtrrFixDramModEn bit, see for example
    203     + * "BIOS and Kernel Developer's Guide for the AMD Athlon 64 and AMD
    204     + * Opteron Processors" (26094 Rev. 3.30 February 2006), section
    205     + * "13.2.1.2 SYSCFG Register": "The MtrrFixDramModEn bit should be set
    206     + * to 1 during BIOS initalization of the fixed MTRRs, then cleared to
    207     + * 0 for operation."
    208     + */
    209     +static inline void k8_check_syscfg_dram_mod_en(void)
    210     +{
    211     + u32 lo, hi;
    212     +
    213     + if (!((boot_cpu_data.x86_vendor == X86_VENDOR_AMD) &&
    214     + (boot_cpu_data.x86 >= 0x0f)))
    215     + return;
    216     +
    217     + rdmsr(MSR_K8_SYSCFG, lo, hi);
    218     + if (lo & K8_MTRRFIXRANGE_DRAM_MODIFY) {
    219     + printk(KERN_ERR FW_WARN "MTRR: CPU %u: SYSCFG[MtrrFixDramModEn]"
    220     + " not cleared by BIOS, clearing this bit\n",
    221     + smp_processor_id());
    222     + lo &= ~K8_MTRRFIXRANGE_DRAM_MODIFY;
    223     + mtrr_wrmsr(MSR_K8_SYSCFG, lo, hi);
    224     + }
    225     +}
    226     +
    227     /*
    228     * Returns the effective MTRR type for the region
    229     * Error returns:
    230     @@ -174,6 +200,8 @@ get_fixed_ranges(mtrr_type * frs)
    231     unsigned int *p = (unsigned int *) frs;
    232     int i;
    233    
    234     + k8_check_syscfg_dram_mod_en();
    235     +
    236     rdmsr(MTRRfix64K_00000_MSR, p[0], p[1]);
    237    
    238     for (i = 0; i < 2; i++)
    239     @@ -308,27 +336,10 @@ void mtrr_wrmsr(unsigned msr, unsigned a, unsigned b)
    240     }
    241    
    242     /**
    243     - * Enable and allow read/write of extended fixed-range MTRR bits on K8 CPUs
    244     - * see AMD publication no. 24593, chapter 3.2.1 for more information
    245     - */
    246     -static inline void k8_enable_fixed_iorrs(void)
    247     -{
    248     - unsigned lo, hi;
    249     -
    250     - rdmsr(MSR_K8_SYSCFG, lo, hi);
    251     - mtrr_wrmsr(MSR_K8_SYSCFG, lo
    252     - | K8_MTRRFIXRANGE_DRAM_ENABLE
    253     - | K8_MTRRFIXRANGE_DRAM_MODIFY, hi);
    254     -}
    255     -
    256     -/**
    257     * set_fixed_range - checks & updates a fixed-range MTRR if it differs from the value it should have
    258     * @msr: MSR address of the MTTR which should be checked and updated
    259     * @changed: pointer which indicates whether the MTRR needed to be changed
    260     * @msrwords: pointer to the MSR values which the MSR should have
    261     - *
    262     - * If K8 extentions are wanted, update the K8 SYSCFG MSR also.
    263     - * See AMD publication no. 24593, chapter 7.8.1, page 233 for more information.
    264     */
    265     static void set_fixed_range(int msr, bool *changed, unsigned int *msrwords)
    266     {
    267     @@ -337,10 +348,6 @@ static void set_fixed_range(int msr, bool *changed, unsigned int *msrwords)
    268     rdmsr(msr, lo, hi);
    269    
    270     if (lo != msrwords[0] || hi != msrwords[1]) {
    271     - if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD &&
    272     - (boot_cpu_data.x86 >= 0x0f && boot_cpu_data.x86 <= 0x11) &&
    273     - ((msrwords[0] | msrwords[1]) & K8_MTRR_RDMEM_WRMEM_MASK))
    274     - k8_enable_fixed_iorrs();
    275     mtrr_wrmsr(msr, msrwords[0], msrwords[1]);
    276     *changed = true;
    277     }
    278     @@ -419,6 +426,8 @@ static int set_fixed_ranges(mtrr_type * frs)
    279     bool changed = false;
    280     int block=-1, range;
    281    
    282     + k8_check_syscfg_dram_mod_en();
    283     +
    284     while (fixed_range_blocks[++block].ranges)
    285     for (range=0; range < fixed_range_blocks[block].ranges; range++)
    286     set_fixed_range(fixed_range_blocks[block].base_msr + range,
    287     diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
    288     index 06ca07f..f7d38d6 100644
    289     --- a/arch/x86/kernel/ptrace.c
    290     +++ b/arch/x86/kernel/ptrace.c
    291     @@ -690,9 +690,8 @@ static int ptrace_bts_config(struct task_struct *child,
    292     if (!cfg.signal)
    293     return -EINVAL;
    294    
    295     - return -EOPNOTSUPP;
    296     -
    297     child->thread.bts_ovfl_signal = cfg.signal;
    298     + return -EOPNOTSUPP;
    299     }
    300    
    301     if ((cfg.flags & PTRACE_BTS_O_ALLOC) &&
    302     diff --git a/arch/x86/kernel/tlb_uv.c b/arch/x86/kernel/tlb_uv.c
    303     index 6812b82..16e505a 100644
    304     --- a/arch/x86/kernel/tlb_uv.c
    305     +++ b/arch/x86/kernel/tlb_uv.c
    306     @@ -742,7 +742,7 @@ static int __init uv_bau_init(void)
    307     int node;
    308     int nblades;
    309     int last_blade;
    310     - int cur_cpu = 0;
    311     + int cur_cpu;
    312    
    313     if (!is_uv_system())
    314     return 0;
    315     @@ -752,6 +752,7 @@ static int __init uv_bau_init(void)
    316     uv_mmask = (1UL << uv_hub_info->n_val) - 1;
    317     nblades = 0;
    318     last_blade = -1;
    319     + cur_cpu = 0;
    320     for_each_online_node(node) {
    321     blade = uv_node_to_blade_id(node);
    322     if (blade == last_blade)
    323     diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
    324     index 9fd78b6..c95a67d 100644
    325     --- a/arch/x86/kvm/paging_tmpl.h
    326     +++ b/arch/x86/kvm/paging_tmpl.h
    327     @@ -314,9 +314,9 @@ static int FNAME(shadow_walk_entry)(struct kvm_shadow_walk *_sw,
    328     return 0;
    329    
    330     if (is_large_pte(*sptep)) {
    331     + rmap_remove(vcpu->kvm, sptep);
    332     set_shadow_pte(sptep, shadow_trap_nonpresent_pte);
    333     kvm_flush_remote_tlbs(vcpu->kvm);
    334     - rmap_remove(vcpu->kvm, sptep);
    335     }
    336    
    337     if (level == PT_DIRECTORY_LEVEL && gw->level == PT_DIRECTORY_LEVEL) {
    338     diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
    339     index a9e769e..da56821 100644
    340     --- a/arch/x86/kvm/svm.c
    341     +++ b/arch/x86/kvm/svm.c
    342     @@ -760,20 +760,37 @@ static void svm_get_segment(struct kvm_vcpu *vcpu,
    343     var->db = (s->attrib >> SVM_SELECTOR_DB_SHIFT) & 1;
    344     var->g = (s->attrib >> SVM_SELECTOR_G_SHIFT) & 1;
    345    
    346     - /*
    347     - * SVM always stores 0 for the 'G' bit in the CS selector in
    348     - * the VMCB on a VMEXIT. This hurts cross-vendor migration:
    349     - * Intel's VMENTRY has a check on the 'G' bit.
    350     - */
    351     - if (seg == VCPU_SREG_CS)
    352     + switch (seg) {
    353     + case VCPU_SREG_CS:
    354     + /*
    355     + * SVM always stores 0 for the 'G' bit in the CS selector in
    356     + * the VMCB on a VMEXIT. This hurts cross-vendor migration:
    357     + * Intel's VMENTRY has a check on the 'G' bit.
    358     + */
    359     var->g = s->limit > 0xfffff;
    360     -
    361     - /*
    362     - * Work around a bug where the busy flag in the tr selector
    363     - * isn't exposed
    364     - */
    365     - if (seg == VCPU_SREG_TR)
    366     + break;
    367     + case VCPU_SREG_TR:
    368     + /*
    369     + * Work around a bug where the busy flag in the tr selector
    370     + * isn't exposed
    371     + */
    372     var->type |= 0x2;
    373     + break;
    374     + case VCPU_SREG_DS:
    375     + case VCPU_SREG_ES:
    376     + case VCPU_SREG_FS:
    377     + case VCPU_SREG_GS:
    378     + /*
    379     + * The accessed bit must always be set in the segment
    380     + * descriptor cache, although it can be cleared in the
    381     + * descriptor, the cached bit always remains at 1. Since
    382     + * Intel has a check on this, set it here to support
    383     + * cross-vendor migration.
    384     + */
    385     + if (!var->unusable)
    386     + var->type |= 0x1;
    387     + break;
    388     + }
    389    
    390     var->unusable = !var->present;
    391     }
    392     diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
    393     index 7611af5..90de444 100644
    394     --- a/arch/x86/kvm/vmx.c
    395     +++ b/arch/x86/kvm/vmx.c
    396     @@ -928,11 +928,11 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, u32 msr_index, u64 data)
    397     int ret = 0;
    398    
    399     switch (msr_index) {
    400     -#ifdef CONFIG_X86_64
    401     case MSR_EFER:
    402     vmx_load_host_state(vmx);
    403     ret = kvm_set_msr_common(vcpu, msr_index, data);
    404     break;
    405     +#ifdef CONFIG_X86_64
    406     case MSR_FS_BASE:
    407     vmcs_writel(GUEST_FS_BASE, data);
    408     break;
    409     diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c
    410     index 960a8d9..4175cb4 100644
    411     --- a/arch/x86/lguest/boot.c
    412     +++ b/arch/x86/lguest/boot.c
    413     @@ -485,11 +485,17 @@ static void lguest_write_cr4(unsigned long val)
    414     * into a process' address space. We set the entry then tell the Host the
    415     * toplevel and address this corresponds to. The Guest uses one pagetable per
    416     * process, so we need to tell the Host which one we're changing (mm->pgd). */
    417     +static void lguest_pte_update(struct mm_struct *mm, unsigned long addr,
    418     + pte_t *ptep)
    419     +{
    420     + lazy_hcall(LHCALL_SET_PTE, __pa(mm->pgd), addr, ptep->pte_low);
    421     +}
    422     +
    423     static void lguest_set_pte_at(struct mm_struct *mm, unsigned long addr,
    424     pte_t *ptep, pte_t pteval)
    425     {
    426     *ptep = pteval;
    427     - lazy_hcall(LHCALL_SET_PTE, __pa(mm->pgd), addr, pteval.pte_low);
    428     + lguest_pte_update(mm, addr, ptep);
    429     }
    430    
    431     /* The Guest calls this to set a top-level entry. Again, we set the entry then
    432     @@ -1034,6 +1040,8 @@ __init void lguest_init(void)
    433     pv_mmu_ops.read_cr3 = lguest_read_cr3;
    434     pv_mmu_ops.lazy_mode.enter = paravirt_enter_lazy_mmu;
    435     pv_mmu_ops.lazy_mode.leave = lguest_leave_lazy_mode;
    436     + pv_mmu_ops.pte_update = lguest_pte_update;
    437     + pv_mmu_ops.pte_update_defer = lguest_pte_update;
    438    
    439     #ifdef CONFIG_X86_LOCAL_APIC
    440     /* apic read/write intercepts */
    441     diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
    442     index e0ab173..21bc1f7 100644
    443     --- a/arch/x86/mm/pat.c
    444     +++ b/arch/x86/mm/pat.c
    445     @@ -641,10 +641,11 @@ static int reserve_pfn_range(u64 paddr, unsigned long size, pgprot_t *vma_prot,
    446     is_ram = pat_pagerange_is_ram(paddr, paddr + size);
    447    
    448     /*
    449     - * reserve_pfn_range() doesn't support RAM pages.
    450     + * reserve_pfn_range() doesn't support RAM pages. Maintain the current
    451     + * behavior with RAM pages by returning success.
    452     */
    453     if (is_ram != 0)
    454     - return -EINVAL;
    455     + return 0;
    456    
    457     ret = reserve_memtype(paddr, paddr + size, want_flags, &flags);
    458     if (ret)
    459     diff --git a/arch/x86/pci/i386.c b/arch/x86/pci/i386.c
    460     index 5ead808..f234a37 100644
    461     --- a/arch/x86/pci/i386.c
    462     +++ b/arch/x86/pci/i386.c
    463     @@ -319,6 +319,9 @@ int pci_mmap_page_range(struct pci_dev *dev, struct vm_area_struct *vma,
    464     return -EINVAL;
    465     }
    466     flags = new_flags;
    467     + vma->vm_page_prot = __pgprot(
    468     + (pgprot_val(vma->vm_page_prot) & ~_PAGE_CACHE_MASK) |
    469     + flags);
    470     }
    471    
    472     if (((vma->vm_pgoff < max_low_pfn_mapped) ||
    473     diff --git a/drivers/char/raw.c b/drivers/char/raw.c
    474     index 96adf28..20d90e6 100644
    475     --- a/drivers/char/raw.c
    476     +++ b/drivers/char/raw.c
    477     @@ -90,6 +90,7 @@ out1:
    478     blkdev_put(bdev, filp->f_mode);
    479     out:
    480     mutex_unlock(&raw_mutex);
    481     + unlock_kernel();
    482     return err;
    483     }
    484    
    485     diff --git a/drivers/lguest/page_tables.c b/drivers/lguest/page_tables.c
    486     index 576a831..82ff484 100644
    487     --- a/drivers/lguest/page_tables.c
    488     +++ b/drivers/lguest/page_tables.c
    489     @@ -373,8 +373,10 @@ unsigned long guest_pa(struct lg_cpu *cpu, unsigned long vaddr)
    490     /* First step: get the top-level Guest page table entry. */
    491     gpgd = lgread(cpu, gpgd_addr(cpu, vaddr), pgd_t);
    492     /* Toplevel not present? We can't map it in. */
    493     - if (!(pgd_flags(gpgd) & _PAGE_PRESENT))
    494     + if (!(pgd_flags(gpgd) & _PAGE_PRESENT)) {
    495     kill_guest(cpu, "Bad address %#lx", vaddr);
    496     + return -1UL;
    497     + }
    498    
    499     gpte = lgread(cpu, gpte_addr(gpgd, vaddr), pte_t);
    500     if (!(pte_flags(gpte) & _PAGE_PRESENT))
    501     diff --git a/drivers/media/dvb/firewire/firedtv-avc.c b/drivers/media/dvb/firewire/firedtv-avc.c
    502     index b55d9cc..adc2ce9 100644
    503     --- a/drivers/media/dvb/firewire/firedtv-avc.c
    504     +++ b/drivers/media/dvb/firewire/firedtv-avc.c
    505     @@ -135,6 +135,7 @@ static const char *debug_fcp_opcode(unsigned int opcode,
    506     case SFE_VENDOR_OPCODE_REGISTER_REMOTE_CONTROL: return "RegisterRC";
    507     case SFE_VENDOR_OPCODE_LNB_CONTROL: return "LNBControl";
    508     case SFE_VENDOR_OPCODE_TUNE_QPSK: return "TuneQPSK";
    509     + case SFE_VENDOR_OPCODE_TUNE_QPSK2: return "TuneQPSK2";
    510     case SFE_VENDOR_OPCODE_HOST2CA: return "Host2CA";
    511     case SFE_VENDOR_OPCODE_CA2HOST: return "CA2Host";
    512     }
    513     @@ -266,7 +267,10 @@ static void avc_tuner_tuneqpsk(struct firedtv *fdtv,
    514     c->operand[0] = SFE_VENDOR_DE_COMPANYID_0;
    515     c->operand[1] = SFE_VENDOR_DE_COMPANYID_1;
    516     c->operand[2] = SFE_VENDOR_DE_COMPANYID_2;
    517     - c->operand[3] = SFE_VENDOR_OPCODE_TUNE_QPSK;
    518     + if (fdtv->type == FIREDTV_DVB_S2)
    519     + c->operand[3] = SFE_VENDOR_OPCODE_TUNE_QPSK2;
    520     + else
    521     + c->operand[3] = SFE_VENDOR_OPCODE_TUNE_QPSK;
    522    
    523     c->operand[4] = (params->frequency >> 24) & 0xff;
    524     c->operand[5] = (params->frequency >> 16) & 0xff;
    525     diff --git a/drivers/media/video/v4l2-common.c b/drivers/media/video/v4l2-common.c
    526     index b8f2be8..907cd02 100644
    527     --- a/drivers/media/video/v4l2-common.c
    528     +++ b/drivers/media/video/v4l2-common.c
    529     @@ -910,10 +910,10 @@ struct v4l2_subdev *v4l2_i2c_new_subdev(struct i2c_adapter *adapter,
    530     struct i2c_board_info info;
    531    
    532     BUG_ON(!dev);
    533     -#ifdef MODULE
    534     +
    535     if (module_name)
    536     request_module(module_name);
    537     -#endif
    538     +
    539     /* Setup the i2c board info with the device type and
    540     the device address. */
    541     memset(&info, 0, sizeof(info));
    542     @@ -958,10 +958,10 @@ struct v4l2_subdev *v4l2_i2c_new_probed_subdev(struct i2c_adapter *adapter,
    543     struct i2c_board_info info;
    544    
    545     BUG_ON(!dev);
    546     -#ifdef MODULE
    547     +
    548     if (module_name)
    549     request_module(module_name);
    550     -#endif
    551     +
    552     /* Setup the i2c board info with the device type and
    553     the device address. */
    554     memset(&info, 0, sizeof(info));
    555     diff --git a/drivers/net/dnet.c b/drivers/net/dnet.c
    556     index 1b40632..edf23c9 100644
    557     --- a/drivers/net/dnet.c
    558     +++ b/drivers/net/dnet.c
    559     @@ -9,6 +9,7 @@
    560     * published by the Free Software Foundation.
    561     */
    562     #include <linux/version.h>
    563     +#include <linux/io.h>
    564     #include <linux/module.h>
    565     #include <linux/moduleparam.h>
    566     #include <linux/kernel.h>
    567     diff --git a/drivers/net/wireless/ath5k/base.c b/drivers/net/wireless/ath5k/base.c
    568     index 1d77ee9..6cf69d3 100644
    569     --- a/drivers/net/wireless/ath5k/base.c
    570     +++ b/drivers/net/wireless/ath5k/base.c
    571     @@ -1090,8 +1090,18 @@ ath5k_mode_setup(struct ath5k_softc *sc)
    572     static inline int
    573     ath5k_hw_to_driver_rix(struct ath5k_softc *sc, int hw_rix)
    574     {
    575     - WARN_ON(hw_rix < 0 || hw_rix > AR5K_MAX_RATES);
    576     - return sc->rate_idx[sc->curband->band][hw_rix];
    577     + int rix;
    578     +
    579     + /* return base rate on errors */
    580     + if (WARN(hw_rix < 0 || hw_rix >= AR5K_MAX_RATES,
    581     + "hw_rix out of bounds: %x\n", hw_rix))
    582     + return 0;
    583     +
    584     + rix = sc->rate_idx[sc->curband->band][hw_rix];
    585     + if (WARN(rix < 0, "invalid hw_rix: %x\n", hw_rix))
    586     + rix = 0;
    587     +
    588     + return rix;
    589     }
    590    
    591     /***************\
    592     @@ -1668,7 +1678,6 @@ ath5k_check_ibss_tsf(struct ath5k_softc *sc, struct sk_buff *skb,
    593     }
    594     }
    595    
    596     -
    597     static void
    598     ath5k_tasklet_rx(unsigned long data)
    599     {
    600     @@ -2188,6 +2197,7 @@ static void
    601     ath5k_beacon_config(struct ath5k_softc *sc)
    602     {
    603     struct ath5k_hw *ah = sc->ah;
    604     + unsigned long flags;
    605    
    606     ath5k_hw_set_imr(ah, 0);
    607     sc->bmisscount = 0;
    608     @@ -2211,9 +2221,9 @@ ath5k_beacon_config(struct ath5k_softc *sc)
    609    
    610     if (sc->opmode == NL80211_IFTYPE_ADHOC) {
    611     if (ath5k_hw_hasveol(ah)) {
    612     - spin_lock(&sc->block);
    613     + spin_lock_irqsave(&sc->block, flags);
    614     ath5k_beacon_send(sc);
    615     - spin_unlock(&sc->block);
    616     + spin_unlock_irqrestore(&sc->block, flags);
    617     }
    618     } else
    619     ath5k_beacon_update_timers(sc, -1);
    620     @@ -2259,7 +2269,7 @@ ath5k_init(struct ath5k_softc *sc, bool is_resume)
    621     sc->curband = &sc->sbands[sc->curchan->band];
    622     sc->imask = AR5K_INT_RXOK | AR5K_INT_RXERR | AR5K_INT_RXEOL |
    623     AR5K_INT_RXORN | AR5K_INT_TXDESC | AR5K_INT_TXEOL |
    624     - AR5K_INT_FATAL | AR5K_INT_GLOBAL | AR5K_INT_MIB;
    625     + AR5K_INT_FATAL | AR5K_INT_GLOBAL;
    626     ret = ath5k_reset(sc, false, false);
    627     if (ret)
    628     goto done;
    629     diff --git a/drivers/net/wireless/ath5k/base.h b/drivers/net/wireless/ath5k/base.h
    630     index facc60d..d86ab39 100644
    631     --- a/drivers/net/wireless/ath5k/base.h
    632     +++ b/drivers/net/wireless/ath5k/base.h
    633     @@ -112,7 +112,7 @@ struct ath5k_softc {
    634     struct ieee80211_supported_band sbands[IEEE80211_NUM_BANDS];
    635     struct ieee80211_channel channels[ATH_CHAN_MAX];
    636     struct ieee80211_rate rates[IEEE80211_NUM_BANDS][AR5K_MAX_RATES];
    637     - u8 rate_idx[IEEE80211_NUM_BANDS][AR5K_MAX_RATES];
    638     + s8 rate_idx[IEEE80211_NUM_BANDS][AR5K_MAX_RATES];
    639     enum nl80211_iftype opmode;
    640     struct ath5k_hw *ah; /* Atheros HW */
    641    
    642     diff --git a/drivers/net/wireless/ath9k/recv.c b/drivers/net/wireless/ath9k/recv.c
    643     index 462e08c..c114cb7 100644
    644     --- a/drivers/net/wireless/ath9k/recv.c
    645     +++ b/drivers/net/wireless/ath9k/recv.c
    646     @@ -322,8 +322,13 @@ void ath_rx_cleanup(struct ath_softc *sc)
    647    
    648     list_for_each_entry(bf, &sc->rx.rxbuf, list) {
    649     skb = bf->bf_mpdu;
    650     - if (skb)
    651     + if (skb) {
    652     + pci_unmap_single(sc->pdev,
    653     + bf->bf_buf_addr,
    654     + sc->rx.bufsize,
    655     + DMA_FROM_DEVICE);
    656     dev_kfree_skb(skb);
    657     + }
    658     }
    659    
    660     if (sc->rx.rxdma.dd_desc_len != 0)
    661     diff --git a/drivers/net/wireless/ath9k/xmit.c b/drivers/net/wireless/ath9k/xmit.c
    662     index c92f0c6..80af54e 100644
    663     --- a/drivers/net/wireless/ath9k/xmit.c
    664     +++ b/drivers/net/wireless/ath9k/xmit.c
    665     @@ -2035,7 +2035,7 @@ struct ath_txq *ath_test_get_txq(struct ath_softc *sc, struct sk_buff *skb)
    666    
    667     /* Try to avoid running out of descriptors */
    668     if (txq->axq_depth >= (ATH_TXBUF - 20)) {
    669     - DPRINTF(sc, ATH_DBG_FATAL,
    670     + DPRINTF(sc, ATH_DBG_XMIT,
    671     "TX queue: %d is full, depth: %d\n",
    672     qnum, txq->axq_depth);
    673     ieee80211_stop_queue(sc->hw, skb_get_queue_mapping(skb));
    674     diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c
    675     index eae9b80..12069e5 100644
    676     --- a/drivers/net/wireless/b43/xmit.c
    677     +++ b/drivers/net/wireless/b43/xmit.c
    678     @@ -50,7 +50,7 @@ static int b43_plcp_get_bitrate_idx_cck(struct b43_plcp_hdr6 *plcp)
    679     }
    680    
    681     /* Extract the bitrate index out of an OFDM PLCP header. */
    682     -static u8 b43_plcp_get_bitrate_idx_ofdm(struct b43_plcp_hdr6 *plcp, bool aphy)
    683     +static int b43_plcp_get_bitrate_idx_ofdm(struct b43_plcp_hdr6 *plcp, bool aphy)
    684     {
    685     int base = aphy ? 0 : 4;
    686    
    687     diff --git a/drivers/scsi/arm/cumana_2.c b/drivers/scsi/arm/cumana_2.c
    688     index 68a6412..ed502b7 100644
    689     --- a/drivers/scsi/arm/cumana_2.c
    690     +++ b/drivers/scsi/arm/cumana_2.c
    691     @@ -318,7 +318,7 @@ cumanascsi_2_set_proc_info(struct Scsi_Host *host, char *buffer, int length)
    692     {
    693     int ret = length;
    694    
    695     - if (length >= 11 && strcmp(buffer, "CUMANASCSI2") == 0) {
    696     + if (length >= 11 && strncmp(buffer, "CUMANASCSI2", 11) == 0) {
    697     buffer += 11;
    698     length -= 11;
    699    
    700     diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
    701     index 49e7f56..3922fa9 100644
    702     --- a/drivers/usb/core/message.c
    703     +++ b/drivers/usb/core/message.c
    704     @@ -1719,7 +1719,8 @@ free_interfaces:
    705     }
    706     kfree(new_interfaces);
    707    
    708     - if (cp->string == NULL)
    709     + if (cp->string == NULL &&
    710     + !(dev->quirks & USB_QUIRK_CONFIG_INTF_STRINGS))
    711     cp->string = usb_cache_string(dev, cp->desc.iConfiguration);
    712    
    713     /* Now that all the interfaces are set up, register them
    714     diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
    715     index c070b34..ab93918 100644
    716     --- a/drivers/usb/core/quirks.c
    717     +++ b/drivers/usb/core/quirks.c
    718     @@ -54,6 +54,10 @@ static const struct usb_device_id usb_quirk_list[] = {
    719     { USB_DEVICE(0x0638, 0x0a13), .driver_info =
    720     USB_QUIRK_STRING_FETCH_255 },
    721    
    722     + /* Saitek Cyborg Gold Joystick */
    723     + { USB_DEVICE(0x06a3, 0x0006), .driver_info =
    724     + USB_QUIRK_CONFIG_INTF_STRINGS },
    725     +
    726     /* M-Systems Flash Disk Pioneers */
    727     { USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME },
    728    
    729     diff --git a/drivers/usb/core/sysfs.c b/drivers/usb/core/sysfs.c
    730     index 4cc2456..c667891 100644
    731     --- a/drivers/usb/core/sysfs.c
    732     +++ b/drivers/usb/core/sysfs.c
    733     @@ -13,6 +13,7 @@
    734     #include <linux/kernel.h>
    735     #include <linux/string.h>
    736     #include <linux/usb.h>
    737     +#include <linux/usb/quirks.h>
    738     #include "usb.h"
    739    
    740     /* Active configuration fields */
    741     @@ -813,7 +814,8 @@ int usb_create_sysfs_intf_files(struct usb_interface *intf)
    742     if (intf->sysfs_files_created || intf->unregistering)
    743     return 0;
    744    
    745     - if (alt->string == NULL)
    746     + if (alt->string == NULL &&
    747     + !(udev->quirks & USB_QUIRK_CONFIG_INTF_STRINGS))
    748     alt->string = usb_cache_string(udev, alt->desc.iInterface);
    749     if (alt->string)
    750     retval = device_create_file(&intf->dev, &dev_attr_interface);
    751     diff --git a/drivers/usb/gadget/f_rndis.c b/drivers/usb/gadget/f_rndis.c
    752     index 3a8bb53..fd7b356 100644
    753     --- a/drivers/usb/gadget/f_rndis.c
    754     +++ b/drivers/usb/gadget/f_rndis.c
    755     @@ -437,7 +437,7 @@ invalid:
    756     DBG(cdev, "rndis req%02x.%02x v%04x i%04x l%d\n",
    757     ctrl->bRequestType, ctrl->bRequest,
    758     w_value, w_index, w_length);
    759     - req->zero = 0;
    760     + req->zero = (value < w_length);
    761     req->length = value;
    762     value = usb_ep_queue(cdev->gadget->ep0, req, GFP_ATOMIC);
    763     if (value < 0)
    764     diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
    765     index ecc9b66..01132ac 100644
    766     --- a/drivers/usb/host/ehci-q.c
    767     +++ b/drivers/usb/host/ehci-q.c
    768     @@ -333,12 +333,40 @@ qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh)
    769     token = hc32_to_cpu(ehci, qtd->hw_token);
    770    
    771     /* always clean up qtds the hc de-activated */
    772     + retry_xacterr:
    773     if ((token & QTD_STS_ACTIVE) == 0) {
    774    
    775     /* on STALL, error, and short reads this urb must
    776     * complete and all its qtds must be recycled.
    777     */
    778     if ((token & QTD_STS_HALT) != 0) {
    779     +
    780     + /* retry transaction errors until we
    781     + * reach the software xacterr limit
    782     + */
    783     + if ((token & QTD_STS_XACT) &&
    784     + QTD_CERR(token) == 0 &&
    785     + --qh->xacterrs > 0 &&
    786     + !urb->unlinked) {
    787     + ehci_dbg(ehci,
    788     + "detected XactErr len %d/%d retry %d\n",
    789     + qtd->length - QTD_LENGTH(token), qtd->length,
    790     + QH_XACTERR_MAX - qh->xacterrs);
    791     +
    792     + /* reset the token in the qtd and the
    793     + * qh overlay (which still contains
    794     + * the qtd) so that we pick up from
    795     + * where we left off
    796     + */
    797     + token &= ~QTD_STS_HALT;
    798     + token |= QTD_STS_ACTIVE |
    799     + (EHCI_TUNE_CERR << 10);
    800     + qtd->hw_token = cpu_to_hc32(ehci,
    801     + token);
    802     + wmb();
    803     + qh->hw_token = cpu_to_hc32(ehci, token);
    804     + goto retry_xacterr;
    805     + }
    806     stopped = 1;
    807    
    808     /* magic dummy for some short reads; qh won't advance.
    809     @@ -421,6 +449,9 @@ halt:
    810     /* remove qtd; it's recycled after possible urb completion */
    811     list_del (&qtd->qtd_list);
    812     last = qtd;
    813     +
    814     + /* reinit the xacterr counter for the next qtd */
    815     + qh->xacterrs = QH_XACTERR_MAX;
    816     }
    817    
    818     /* last urb's completion might still need calling */
    819     @@ -862,6 +893,7 @@ static void qh_link_async (struct ehci_hcd *ehci, struct ehci_qh *qh)
    820     head->qh_next.qh = qh;
    821     head->hw_next = dma;
    822    
    823     + qh->xacterrs = QH_XACTERR_MAX;
    824     qh->qh_state = QH_STATE_LINKED;
    825     /* qtd completions reported later by interrupt */
    826     }
    827     diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
    828     index 262b00c..c7385f2 100644
    829     --- a/drivers/usb/host/ehci.h
    830     +++ b/drivers/usb/host/ehci.h
    831     @@ -376,6 +376,9 @@ struct ehci_qh {
    832     #define QH_STATE_UNLINK_WAIT 4 /* LINKED and on reclaim q */
    833     #define QH_STATE_COMPLETING 5 /* don't touch token.HALT */
    834    
    835     + u8 xacterrs; /* XactErr retry counter */
    836     +#define QH_XACTERR_MAX 32 /* XactErr retry limit */
    837     +
    838     /* periodic schedule info */
    839     u8 usecs; /* intr bandwidth */
    840     u8 gap_uf; /* uframes split/csplit gap */
    841     diff --git a/drivers/usb/storage/cypress_atacb.c b/drivers/usb/storage/cypress_atacb.c
    842     index 898e67d..9466a99 100644
    843     --- a/drivers/usb/storage/cypress_atacb.c
    844     +++ b/drivers/usb/storage/cypress_atacb.c
    845     @@ -133,19 +133,18 @@ void cypress_atacb_passthrough(struct scsi_cmnd *srb, struct us_data *us)
    846    
    847     /* build the command for
    848     * reading the ATA registers */
    849     - scsi_eh_prep_cmnd(srb, &ses, NULL, 0, 0);
    850     - srb->sdb.length = sizeof(regs);
    851     - sg_init_one(&ses.sense_sgl, regs, srb->sdb.length);
    852     - srb->sdb.table.sgl = &ses.sense_sgl;
    853     - srb->sc_data_direction = DMA_FROM_DEVICE;
    854     - srb->sdb.table.nents = 1;
    855     + scsi_eh_prep_cmnd(srb, &ses, NULL, 0, sizeof(regs));
    856     +
    857     /* we use the same command as before, but we set
    858     * the read taskfile bit, for not executing atacb command,
    859     * but reading register selected in srb->cmnd[4]
    860     */
    861     + srb->cmd_len = 16;
    862     + srb->cmnd = ses.cmnd;
    863     srb->cmnd[2] = 1;
    864    
    865     usb_stor_transparent_scsi_command(srb, us);
    866     + memcpy(regs, srb->sense_buffer, sizeof(regs));
    867     tmp_result = srb->result;
    868     scsi_eh_restore_cmnd(srb, &ses);
    869     /* we fail to get registers, report invalid command */
    870     @@ -162,8 +161,8 @@ void cypress_atacb_passthrough(struct scsi_cmnd *srb, struct us_data *us)
    871    
    872     /* XXX we should generate sk, asc, ascq from status and error
    873     * regs
    874     - * (see 11.1 Error translation ­ ATA device error to SCSI error map)
    875     - * and ata_to_sense_error from libata.
    876     + * (see 11.1 Error translation ATA device error to SCSI error
    877     + * map, and ata_to_sense_error from libata.)
    878     */
    879    
    880     /* Sense data is current and format is descriptor. */
    881     diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c
    882     index 727c506..ed710bc 100644
    883     --- a/drivers/usb/storage/scsiglue.c
    884     +++ b/drivers/usb/storage/scsiglue.c
    885     @@ -135,6 +135,12 @@ static int slave_configure(struct scsi_device *sdev)
    886     if (sdev->request_queue->max_sectors > max_sectors)
    887     blk_queue_max_sectors(sdev->request_queue,
    888     max_sectors);
    889     + } else if (sdev->type == TYPE_TAPE) {
    890     + /* Tapes need much higher max_sector limits, so just
    891     + * raise it to the maximum possible (4 GB / 512) and
    892     + * let the queue segment size sort out the real limit.
    893     + */
    894     + blk_queue_max_sectors(sdev->request_queue, 0x7FFFFF);
    895     }
    896    
    897     /* Some USB host controllers can't do DMA; they have to use PIO.
    898     diff --git a/drivers/video/pxafb.c b/drivers/video/pxafb.c
    899     index 2552b9f..642c1d4 100644
    900     --- a/drivers/video/pxafb.c
    901     +++ b/drivers/video/pxafb.c
    902     @@ -883,10 +883,21 @@ static void __devinit init_pxafb_overlay(struct pxafb_info *fbi,
    903     init_completion(&ofb->branch_done);
    904     }
    905    
    906     +static inline int pxafb_overlay_supported(void)
    907     +{
    908     + if (cpu_is_pxa27x() || cpu_is_pxa3xx())
    909     + return 1;
    910     +
    911     + return 0;
    912     +}
    913     +
    914     static int __devinit pxafb_overlay_init(struct pxafb_info *fbi)
    915     {
    916     int i, ret;
    917    
    918     + if (!pxafb_overlay_supported())
    919     + return 0;
    920     +
    921     for (i = 0; i < 2; i++) {
    922     init_pxafb_overlay(fbi, &fbi->overlay[i], i);
    923     ret = register_framebuffer(&fbi->overlay[i].fb);
    924     @@ -909,6 +920,9 @@ static void __devexit pxafb_overlay_exit(struct pxafb_info *fbi)
    925     {
    926     int i;
    927    
    928     + if (!pxafb_overlay_supported())
    929     + return;
    930     +
    931     for (i = 0; i < 2; i++)
    932     unregister_framebuffer(&fbi->overlay[i].fb);
    933     }
    934     diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
    935     index 851388f..6562eb0 100644
    936     --- a/fs/cifs/CHANGES
    937     +++ b/fs/cifs/CHANGES
    938     @@ -7,6 +7,9 @@ are authenticated as guest, as reconnections, invalidating the earlier
    939     user's smb session. This fix allows cifs to mount multiple times to the
    940     same server with different userids without risking invalidating earlier
    941     established security contexts.
    942     +Fix "redzone overwritten" bug in cifs_put_tcon (CIFSTcon may allocate too
    943     +little memory for the "nativeFileSystem" field returned by the server
    944     +during mount).
    945    
    946     Version 1.56
    947     ------------
    948     diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
    949     index 939e2f7..71ae000 100644
    950     --- a/fs/cifs/cifssmb.c
    951     +++ b/fs/cifs/cifssmb.c
    952     @@ -2356,8 +2356,10 @@ winCreateHardLinkRetry:
    953     PATH_MAX, nls_codepage, remap);
    954     name_len++; /* trailing null */
    955     name_len *= 2;
    956     - pSMB->OldFileName[name_len] = 0; /* pad */
    957     - pSMB->OldFileName[name_len + 1] = 0x04;
    958     +
    959     + /* protocol specifies ASCII buffer format (0x04) for unicode */
    960     + pSMB->OldFileName[name_len] = 0x04;
    961     + pSMB->OldFileName[name_len + 1] = 0x00; /* pad */
    962     name_len2 =
    963     cifsConvertToUCS((__le16 *)&pSMB->OldFileName[name_len + 2],
    964     toName, PATH_MAX, nls_codepage, remap);
    965     diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
    966     index da0f4ff..4b64f39 100644
    967     --- a/fs/cifs/connect.c
    968     +++ b/fs/cifs/connect.c
    969     @@ -3667,7 +3667,7 @@ CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
    970     BCC(smb_buffer_response)) {
    971     kfree(tcon->nativeFileSystem);
    972     tcon->nativeFileSystem =
    973     - kzalloc(length + 2, GFP_KERNEL);
    974     + kzalloc(2*(length + 1), GFP_KERNEL);
    975     if (tcon->nativeFileSystem)
    976     cifs_strfromUCS_le(
    977     tcon->nativeFileSystem,
    978     diff --git a/fs/fuse/file.c b/fs/fuse/file.c
    979     index d9fdb7c..821d10f 100644
    980     --- a/fs/fuse/file.c
    981     +++ b/fs/fuse/file.c
    982     @@ -1465,7 +1465,7 @@ static loff_t fuse_file_llseek(struct file *file, loff_t offset, int origin)
    983     case SEEK_END:
    984     retval = fuse_update_attributes(inode, NULL, file, NULL);
    985     if (retval)
    986     - return retval;
    987     + goto exit;
    988     offset += i_size_read(inode);
    989     break;
    990     case SEEK_CUR:
    991     @@ -1479,6 +1479,7 @@ static loff_t fuse_file_llseek(struct file *file, loff_t offset, int origin)
    992     }
    993     retval = offset;
    994     }
    995     +exit:
    996     mutex_unlock(&inode->i_mutex);
    997     return retval;
    998     }
    999     diff --git a/include/linux/mm.h b/include/linux/mm.h
    1000     index 065cdf8..3daa05f 100644
    1001     --- a/include/linux/mm.h
    1002     +++ b/include/linux/mm.h
    1003     @@ -98,7 +98,7 @@ extern unsigned int kobjsize(const void *objp);
    1004     #define VM_HUGETLB 0x00400000 /* Huge TLB Page VM */
    1005     #define VM_NONLINEAR 0x00800000 /* Is non-linear (remap_file_pages) */
    1006     #define VM_MAPPED_COPY 0x01000000 /* T if mapped copy of data (nommu mmap) */
    1007     -#define VM_INSERTPAGE 0x02000000 /* The vma has had "vm_insert_page()" done on it */
    1008     +#define VM_INSERTPAGE 0x02000000 /* The vma has had "vm_insert_page()" done on it. Refer note in VM_PFNMAP_AT_MMAP below */
    1009     #define VM_ALWAYSDUMP 0x04000000 /* Always include in core dumps */
    1010    
    1011     #define VM_CAN_NONLINEAR 0x08000000 /* Has ->fault & does nonlinear pages */
    1012     @@ -127,6 +127,17 @@ extern unsigned int kobjsize(const void *objp);
    1013     #define VM_SPECIAL (VM_IO | VM_DONTEXPAND | VM_RESERVED | VM_PFNMAP)
    1014    
    1015     /*
    1016     + * pfnmap vmas that are fully mapped at mmap time (not mapped on fault).
    1017     + * Used by x86 PAT to identify such PFNMAP mappings and optimize their handling.
    1018     + * Note VM_INSERTPAGE flag is overloaded here. i.e,
    1019     + * VM_INSERTPAGE && !VM_PFNMAP implies
    1020     + * The vma has had "vm_insert_page()" done on it
    1021     + * VM_INSERTPAGE && VM_PFNMAP implies
    1022     + * The vma is PFNMAP with full mapping at mmap time
    1023     + */
    1024     +#define VM_PFNMAP_AT_MMAP (VM_INSERTPAGE | VM_PFNMAP)
    1025     +
    1026     +/*
    1027     * mapping from the currently active vm_flags protection bits (the
    1028     * low four bits) to a page protection mask..
    1029     */
    1030     @@ -145,7 +156,7 @@ extern pgprot_t protection_map[16];
    1031     */
    1032     static inline int is_linear_pfn_mapping(struct vm_area_struct *vma)
    1033     {
    1034     - return ((vma->vm_flags & VM_PFNMAP) && vma->vm_pgoff);
    1035     + return ((vma->vm_flags & VM_PFNMAP_AT_MMAP) == VM_PFNMAP_AT_MMAP);
    1036     }
    1037    
    1038     static inline int is_pfn_mapping(struct vm_area_struct *vma)
    1039     diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h
    1040     index 7f6c603..2526f3b 100644
    1041     --- a/include/linux/usb/quirks.h
    1042     +++ b/include/linux/usb/quirks.h
    1043     @@ -16,4 +16,7 @@
    1044     /* device can't handle Set-Interface requests */
    1045     #define USB_QUIRK_NO_SET_INTF 0x00000004
    1046    
    1047     +/* device can't handle its Configuration or Interface strings */
    1048     +#define USB_QUIRK_CONFIG_INTF_STRINGS 0x00000008
    1049     +
    1050     #endif /* __LINUX_USB_QUIRKS_H */
    1051     diff --git a/mm/memory.c b/mm/memory.c
    1052     index baa999e..d7df5ba 100644
    1053     --- a/mm/memory.c
    1054     +++ b/mm/memory.c
    1055     @@ -1665,9 +1665,10 @@ int remap_pfn_range(struct vm_area_struct *vma, unsigned long addr,
    1056     * behaviour that some programs depend on. We mark the "original"
    1057     * un-COW'ed pages by matching them up with "vma->vm_pgoff".
    1058     */
    1059     - if (addr == vma->vm_start && end == vma->vm_end)
    1060     + if (addr == vma->vm_start && end == vma->vm_end) {
    1061     vma->vm_pgoff = pfn;
    1062     - else if (is_cow_mapping(vma->vm_flags))
    1063     + vma->vm_flags |= VM_PFNMAP_AT_MMAP;
    1064     + } else if (is_cow_mapping(vma->vm_flags))
    1065     return -EINVAL;
    1066    
    1067     vma->vm_flags |= VM_IO | VM_RESERVED | VM_PFNMAP;
    1068     @@ -1679,6 +1680,7 @@ int remap_pfn_range(struct vm_area_struct *vma, unsigned long addr,
    1069     * needed from higher level routine calling unmap_vmas
    1070     */
    1071     vma->vm_flags &= ~(VM_IO | VM_RESERVED | VM_PFNMAP);
    1072     + vma->vm_flags &= ~VM_PFNMAP_AT_MMAP;
    1073     return -EINVAL;
    1074     }
    1075    
    1076     diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
    1077     index 727c5c5..8a96672 100644
    1078     --- a/net/bridge/br_if.c
    1079     +++ b/net/bridge/br_if.c
    1080     @@ -426,7 +426,6 @@ err2:
    1081     err1:
    1082     kobject_del(&p->kobj);
    1083     err0:
    1084     - kobject_put(&p->kobj);
    1085     dev_set_promiscuity(dev, -1);
    1086     put_back:
    1087     dev_put(dev);
    1088     diff --git a/net/core/dev.c b/net/core/dev.c
    1089     index e3fe5c7..e438f54 100644
    1090     --- a/net/core/dev.c
    1091     +++ b/net/core/dev.c
    1092     @@ -2588,18 +2588,15 @@ static int process_backlog(struct napi_struct *napi, int quota)
    1093     local_irq_disable();
    1094     skb = __skb_dequeue(&queue->input_pkt_queue);
    1095     if (!skb) {
    1096     + __napi_complete(napi);
    1097     local_irq_enable();
    1098     - napi_complete(napi);
    1099     - goto out;
    1100     + break;
    1101     }
    1102     local_irq_enable();
    1103    
    1104     - napi_gro_receive(napi, skb);
    1105     + netif_receive_skb(skb);
    1106     } while (++work < quota && jiffies == start_time);
    1107    
    1108     - napi_gro_flush(napi);
    1109     -
    1110     -out:
    1111     return work;
    1112     }
    1113    
    1114     diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
    1115     index c47c989..c8bee18 100644
    1116     --- a/net/ipv4/udp.c
    1117     +++ b/net/ipv4/udp.c
    1118     @@ -1614,7 +1614,8 @@ static struct sock *udp_get_next(struct seq_file *seq, struct sock *sk)
    1119     } while (sk && (!net_eq(sock_net(sk), net) || sk->sk_family != state->family));
    1120    
    1121     if (!sk) {
    1122     - spin_unlock_bh(&state->udp_table->hash[state->bucket].lock);
    1123     + if (state->bucket < UDP_HTABLE_SIZE)
    1124     + spin_unlock_bh(&state->udp_table->hash[state->bucket].lock);
    1125     return udp_get_first(seq, state->bucket + 1);
    1126     }
    1127     return sk;
    1128     @@ -1632,6 +1633,9 @@ static struct sock *udp_get_idx(struct seq_file *seq, loff_t pos)
    1129    
    1130     static void *udp_seq_start(struct seq_file *seq, loff_t *pos)
    1131     {
    1132     + struct udp_iter_state *state = seq->private;
    1133     + state->bucket = UDP_HTABLE_SIZE;
    1134     +
    1135     return *pos ? udp_get_idx(seq, *pos-1) : SEQ_START_TOKEN;
    1136     }
    1137    
    1138     diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
    1139     index f171e8d..8f04bd9 100644
    1140     --- a/net/ipv6/ip6_input.c
    1141     +++ b/net/ipv6/ip6_input.c
    1142     @@ -75,8 +75,7 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
    1143     if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL ||
    1144     !idev || unlikely(idev->cnf.disable_ipv6)) {
    1145     IP6_INC_STATS_BH(net, idev, IPSTATS_MIB_INDISCARDS);
    1146     - rcu_read_unlock();
    1147     - goto out;
    1148     + goto drop;
    1149     }
    1150    
    1151     memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
    1152     @@ -147,7 +146,6 @@ err:
    1153     drop:
    1154     rcu_read_unlock();
    1155     kfree_skb(skb);
    1156     -out:
    1157     return 0;
    1158     }
    1159    
    1160     diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
    1161     index f3fd154..56ac4ee 100644
    1162     --- a/net/netfilter/nf_conntrack_proto_tcp.c
    1163     +++ b/net/netfilter/nf_conntrack_proto_tcp.c
    1164     @@ -15,6 +15,7 @@
    1165     #include <linux/skbuff.h>
    1166     #include <linux/ipv6.h>
    1167     #include <net/ip6_checksum.h>
    1168     +#include <asm/unaligned.h>
    1169    
    1170     #include <net/tcp.h>
    1171    
    1172     @@ -466,7 +467,7 @@ static void tcp_sack(const struct sk_buff *skb, unsigned int dataoff,
    1173     for (i = 0;
    1174     i < (opsize - TCPOLEN_SACK_BASE);
    1175     i += TCPOLEN_SACK_PERBLOCK) {
    1176     - tmp = ntohl(*((__be32 *)(ptr+i)+1));
    1177     + tmp = get_unaligned_be32((__be32 *)(ptr+i)+1);
    1178    
    1179     if (after(tmp, *sack))
    1180     *sack = tmp;
    1181     diff --git a/net/wireless/reg.c b/net/wireless/reg.c
    1182     index bd0a16c..4f9ff2a 100644
    1183     --- a/net/wireless/reg.c
    1184     +++ b/net/wireless/reg.c
    1185     @@ -1083,6 +1083,8 @@ EXPORT_SYMBOL(regulatory_hint);
    1186     static bool reg_same_country_ie_hint(struct wiphy *wiphy,
    1187     u32 country_ie_checksum)
    1188     {
    1189     + if (unlikely(last_request->initiator != REGDOM_SET_BY_COUNTRY_IE))
    1190     + return false;
    1191     if (!last_request->wiphy)
    1192     return false;
    1193     if (likely(last_request->wiphy != wiphy))
    1194     @@ -1133,7 +1135,9 @@ void regulatory_hint_11d(struct wiphy *wiphy,
    1195     /* We will run this for *every* beacon processed for the BSSID, so
    1196     * we optimize an early check to exit out early if we don't have to
    1197     * do anything */
    1198     - if (likely(last_request->wiphy)) {
    1199     + if (likely(last_request->initiator ==
    1200     + REGDOM_SET_BY_COUNTRY_IE &&
    1201     + likely(last_request->wiphy))) {
    1202     struct cfg80211_registered_device *drv_last_ie;
    1203    
    1204     drv_last_ie = wiphy_to_dev(last_request->wiphy);
    1205     @@ -1469,13 +1473,20 @@ int regulatory_init(void)
    1206    
    1207     printk(KERN_INFO "cfg80211: Using static regulatory domain info\n");
    1208     print_regdomain_info(cfg80211_regdomain);
    1209     - /* The old code still requests for a new regdomain and if
    1210     + /*
    1211     + * The old code still requests for a new regdomain and if
    1212     * you have CRDA you get it updated, otherwise you get
    1213     * stuck with the static values. We ignore "EU" code as
    1214     - * that is not a valid ISO / IEC 3166 alpha2 */
    1215     - if (ieee80211_regdom[0] != 'E' || ieee80211_regdom[1] != 'U')
    1216     - err = __regulatory_hint(NULL, REGDOM_SET_BY_CORE,
    1217     - ieee80211_regdom, 0, ENVIRON_ANY);
    1218     + * that is not a valid ISO / IEC 3166 alpha2
    1219     + * stuck with the static values. Since "EU" is not a valid
    1220     + * ISO / IEC 3166 alpha2 code we can't expect userpace to
    1221     + * give us a regulatory domain for it. We need last_request
    1222     + * iniitalized though so lets just send a request which we
    1223     + * know will be ignored... this crap will be removed once
    1224     + * OLD_REG dies.
    1225     + */
    1226     + err = __regulatory_hint(NULL, REGDOM_SET_BY_CORE,
    1227     + ieee80211_regdom, 0, ENVIRON_ANY);
    1228     #else
    1229     cfg80211_regdomain = cfg80211_world_regdom;
    1230    
    1231     diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
    1232     index 62a5425..8227172 100644
    1233     --- a/net/xfrm/xfrm_state.c
    1234     +++ b/net/xfrm/xfrm_state.c
    1235     @@ -1615,7 +1615,7 @@ void xfrm_state_walk_done(struct xfrm_state_walk *walk)
    1236    
    1237     spin_lock_bh(&xfrm_state_lock);
    1238     list_del(&walk->all);
    1239     - spin_lock_bh(&xfrm_state_lock);
    1240     + spin_unlock_bh(&xfrm_state_lock);
    1241     }
    1242     EXPORT_SYMBOL(xfrm_state_walk_done);
    1243