Contents of /trunk/kernel26-magellan/patches-2.6.29-r8/0100-2.6.29.1-all-fixes.patch
Parent Directory | Revision Log
Revision 1114 -
(show annotations)
(download)
Sun Aug 22 17:59:15 2010 UTC (14 years, 1 month ago) by niro
File size: 42037 byte(s)
Sun Aug 22 17:59:15 2010 UTC (14 years, 1 month ago) by niro
File size: 42037 byte(s)
-added
1 | diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h |
2 | index a58378c..ce3b36e 100644 |
3 | --- a/arch/arm/include/asm/elf.h |
4 | +++ b/arch/arm/include/asm/elf.h |
5 | @@ -50,6 +50,7 @@ typedef struct user_fp elf_fpregset_t; |
6 | #define R_ARM_ABS32 2 |
7 | #define R_ARM_CALL 28 |
8 | #define R_ARM_JUMP24 29 |
9 | +#define R_ARM_V4BX 40 |
10 | |
11 | /* |
12 | * These are used to set parameters in the core dumps. |
13 | diff --git a/arch/arm/kernel/module.c b/arch/arm/kernel/module.c |
14 | index dab48f2..9f509fd 100644 |
15 | --- a/arch/arm/kernel/module.c |
16 | +++ b/arch/arm/kernel/module.c |
17 | @@ -132,6 +132,15 @@ apply_relocate(Elf32_Shdr *sechdrs, const char *strtab, unsigned int symindex, |
18 | *(u32 *)loc |= offset & 0x00ffffff; |
19 | break; |
20 | |
21 | + case R_ARM_V4BX: |
22 | + /* Preserve Rm and the condition code. Alter |
23 | + * other bits to re-code instruction as |
24 | + * MOV PC,Rm. |
25 | + */ |
26 | + *(u32 *)loc &= 0xf000000f; |
27 | + *(u32 *)loc |= 0x01a0f000; |
28 | + break; |
29 | + |
30 | default: |
31 | printk(KERN_ERR "%s: unknown relocation: %u\n", |
32 | module->name, ELF32_R_TYPE(rel->r_info)); |
33 | diff --git a/arch/arm/mach-iop13xx/pci.c b/arch/arm/mach-iop13xx/pci.c |
34 | index 673b0db..4873f26 100644 |
35 | --- a/arch/arm/mach-iop13xx/pci.c |
36 | +++ b/arch/arm/mach-iop13xx/pci.c |
37 | @@ -1026,8 +1026,10 @@ int iop13xx_pci_setup(int nr, struct pci_sys_data *sys) |
38 | which_atu = 0; |
39 | } |
40 | |
41 | - if (!which_atu) |
42 | + if (!which_atu) { |
43 | + kfree(res); |
44 | return 0; |
45 | + } |
46 | |
47 | switch(which_atu) { |
48 | case IOP13XX_INIT_ATU_ATUX: |
49 | @@ -1074,6 +1076,7 @@ int iop13xx_pci_setup(int nr, struct pci_sys_data *sys) |
50 | sys->map_irq = iop13xx_pcie_map_irq; |
51 | break; |
52 | default: |
53 | + kfree(res); |
54 | return 0; |
55 | } |
56 | |
57 | diff --git a/arch/arm/mach-omap2/mmc-twl4030.c b/arch/arm/mach-omap2/mmc-twl4030.c |
58 | index 437f520..e1dadf7 100644 |
59 | --- a/arch/arm/mach-omap2/mmc-twl4030.c |
60 | +++ b/arch/arm/mach-omap2/mmc-twl4030.c |
61 | @@ -397,6 +397,7 @@ void __init twl4030_mmc_init(struct twl4030_hsmmc_info *controllers) |
62 | break; |
63 | default: |
64 | pr_err("MMC%d configuration not supported!\n", c->mmc); |
65 | + kfree(mmc); |
66 | continue; |
67 | } |
68 | hsmmc_data[c->mmc - 1] = mmc; |
69 | diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c |
70 | index d4d082c..5a89e57 100644 |
71 | --- a/arch/arm/mm/mmu.c |
72 | +++ b/arch/arm/mm/mmu.c |
73 | @@ -694,7 +694,7 @@ static void __init sanity_check_meminfo(void) |
74 | * the vmalloc area. |
75 | */ |
76 | if (__va(bank->start) >= VMALLOC_MIN || |
77 | - __va(bank->start) < PAGE_OFFSET) { |
78 | + __va(bank->start) < (void *)PAGE_OFFSET) { |
79 | printk(KERN_NOTICE "Ignoring RAM at %.8lx-%.8lx " |
80 | "(vmalloc region overlap).\n", |
81 | bank->start, bank->start + bank->size - 1); |
82 | diff --git a/arch/sparc/include/asm/tlb_64.h b/arch/sparc/include/asm/tlb_64.h |
83 | index ec81cde..0aaa086 100644 |
84 | --- a/arch/sparc/include/asm/tlb_64.h |
85 | +++ b/arch/sparc/include/asm/tlb_64.h |
86 | @@ -58,6 +58,8 @@ static inline struct mmu_gather *tlb_gather_mmu(struct mm_struct *mm, unsigned i |
87 | static inline void tlb_flush_mmu(struct mmu_gather *mp) |
88 | { |
89 | if (mp->need_flush) { |
90 | + if (!mp->fullmm) |
91 | + flush_tlb_pending(); |
92 | free_pages_and_swap_cache(mp->pages, mp->pages_nr); |
93 | mp->pages_nr = 0; |
94 | mp->need_flush = 0; |
95 | @@ -78,8 +80,6 @@ static inline void tlb_finish_mmu(struct mmu_gather *mp, unsigned long start, un |
96 | |
97 | if (mp->fullmm) |
98 | mp->fullmm = 0; |
99 | - else |
100 | - flush_tlb_pending(); |
101 | |
102 | /* keep the page table cache within bounds */ |
103 | check_pgt_cache(); |
104 | diff --git a/arch/sparc/kernel/nmi.c b/arch/sparc/kernel/nmi.c |
105 | index f357722..2c0cc72 100644 |
106 | --- a/arch/sparc/kernel/nmi.c |
107 | +++ b/arch/sparc/kernel/nmi.c |
108 | @@ -13,6 +13,7 @@ |
109 | #include <linux/module.h> |
110 | #include <linux/kprobes.h> |
111 | #include <linux/kernel_stat.h> |
112 | +#include <linux/reboot.h> |
113 | #include <linux/slab.h> |
114 | #include <linux/kdebug.h> |
115 | #include <linux/delay.h> |
116 | @@ -206,13 +207,33 @@ void nmi_adjust_hz(unsigned int new_hz) |
117 | } |
118 | EXPORT_SYMBOL_GPL(nmi_adjust_hz); |
119 | |
120 | +static int nmi_shutdown(struct notifier_block *nb, unsigned long cmd, void *p) |
121 | +{ |
122 | + on_each_cpu(stop_watchdog, NULL, 1); |
123 | + return 0; |
124 | +} |
125 | + |
126 | +static struct notifier_block nmi_reboot_notifier = { |
127 | + .notifier_call = nmi_shutdown, |
128 | +}; |
129 | + |
130 | int __init nmi_init(void) |
131 | { |
132 | + int err; |
133 | + |
134 | nmi_usable = 1; |
135 | |
136 | on_each_cpu(start_watchdog, NULL, 1); |
137 | |
138 | - return check_nmi_watchdog(); |
139 | + err = check_nmi_watchdog(); |
140 | + if (!err) { |
141 | + err = register_reboot_notifier(&nmi_reboot_notifier); |
142 | + if (err) { |
143 | + nmi_usable = 0; |
144 | + on_each_cpu(stop_watchdog, NULL, 1); |
145 | + } |
146 | + } |
147 | + return err; |
148 | } |
149 | |
150 | static int __init setup_nmi_watchdog(char *str) |
151 | diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c |
152 | index 6cd1a5b..79457f6 100644 |
153 | --- a/arch/sparc/kernel/smp_64.c |
154 | +++ b/arch/sparc/kernel/smp_64.c |
155 | @@ -1031,7 +1031,7 @@ void smp_fetch_global_regs(void) |
156 | * If the address space is non-shared (ie. mm->count == 1) we avoid |
157 | * cross calls when we want to flush the currently running process's |
158 | * tlb state. This is done by clearing all cpu bits except the current |
159 | - * processor's in current->active_mm->cpu_vm_mask and performing the |
160 | + * processor's in current->mm->cpu_vm_mask and performing the |
161 | * flush locally only. This will force any subsequent cpus which run |
162 | * this task to flush the context from the local tlb if the process |
163 | * migrates to another cpu (again). |
164 | @@ -1074,7 +1074,7 @@ void smp_flush_tlb_pending(struct mm_struct *mm, unsigned long nr, unsigned long |
165 | u32 ctx = CTX_HWBITS(mm->context); |
166 | int cpu = get_cpu(); |
167 | |
168 | - if (mm == current->active_mm && atomic_read(&mm->mm_users) == 1) |
169 | + if (mm == current->mm && atomic_read(&mm->mm_users) == 1) |
170 | mm->cpu_vm_mask = cpumask_of_cpu(cpu); |
171 | else |
172 | smp_cross_call_masked(&xcall_flush_tlb_pending, |
173 | diff --git a/arch/x86/kernel/check.c b/arch/x86/kernel/check.c |
174 | index 2ac0ab7..a7a50b2 100644 |
175 | --- a/arch/x86/kernel/check.c |
176 | +++ b/arch/x86/kernel/check.c |
177 | @@ -86,12 +86,12 @@ void __init setup_bios_corruption_check(void) |
178 | if (addr == 0) |
179 | break; |
180 | |
181 | + if (addr >= corruption_check_size) |
182 | + break; |
183 | + |
184 | if ((addr + size) > corruption_check_size) |
185 | size = corruption_check_size - addr; |
186 | |
187 | - if (size == 0) |
188 | - break; |
189 | - |
190 | e820_update_range(addr, size, E820_RAM, E820_RESERVED); |
191 | scan_areas[num_scan_areas].addr = addr; |
192 | scan_areas[num_scan_areas].size = size; |
193 | diff --git a/arch/x86/kernel/cpu/mtrr/generic.c b/arch/x86/kernel/cpu/mtrr/generic.c |
194 | index 0c0a455..6f557e0 100644 |
195 | --- a/arch/x86/kernel/cpu/mtrr/generic.c |
196 | +++ b/arch/x86/kernel/cpu/mtrr/generic.c |
197 | @@ -41,6 +41,32 @@ static int __init mtrr_debug(char *opt) |
198 | } |
199 | early_param("mtrr.show", mtrr_debug); |
200 | |
201 | +/** |
202 | + * BIOS is expected to clear MtrrFixDramModEn bit, see for example |
203 | + * "BIOS and Kernel Developer's Guide for the AMD Athlon 64 and AMD |
204 | + * Opteron Processors" (26094 Rev. 3.30 February 2006), section |
205 | + * "13.2.1.2 SYSCFG Register": "The MtrrFixDramModEn bit should be set |
206 | + * to 1 during BIOS initalization of the fixed MTRRs, then cleared to |
207 | + * 0 for operation." |
208 | + */ |
209 | +static inline void k8_check_syscfg_dram_mod_en(void) |
210 | +{ |
211 | + u32 lo, hi; |
212 | + |
213 | + if (!((boot_cpu_data.x86_vendor == X86_VENDOR_AMD) && |
214 | + (boot_cpu_data.x86 >= 0x0f))) |
215 | + return; |
216 | + |
217 | + rdmsr(MSR_K8_SYSCFG, lo, hi); |
218 | + if (lo & K8_MTRRFIXRANGE_DRAM_MODIFY) { |
219 | + printk(KERN_ERR FW_WARN "MTRR: CPU %u: SYSCFG[MtrrFixDramModEn]" |
220 | + " not cleared by BIOS, clearing this bit\n", |
221 | + smp_processor_id()); |
222 | + lo &= ~K8_MTRRFIXRANGE_DRAM_MODIFY; |
223 | + mtrr_wrmsr(MSR_K8_SYSCFG, lo, hi); |
224 | + } |
225 | +} |
226 | + |
227 | /* |
228 | * Returns the effective MTRR type for the region |
229 | * Error returns: |
230 | @@ -174,6 +200,8 @@ get_fixed_ranges(mtrr_type * frs) |
231 | unsigned int *p = (unsigned int *) frs; |
232 | int i; |
233 | |
234 | + k8_check_syscfg_dram_mod_en(); |
235 | + |
236 | rdmsr(MTRRfix64K_00000_MSR, p[0], p[1]); |
237 | |
238 | for (i = 0; i < 2; i++) |
239 | @@ -308,27 +336,10 @@ void mtrr_wrmsr(unsigned msr, unsigned a, unsigned b) |
240 | } |
241 | |
242 | /** |
243 | - * Enable and allow read/write of extended fixed-range MTRR bits on K8 CPUs |
244 | - * see AMD publication no. 24593, chapter 3.2.1 for more information |
245 | - */ |
246 | -static inline void k8_enable_fixed_iorrs(void) |
247 | -{ |
248 | - unsigned lo, hi; |
249 | - |
250 | - rdmsr(MSR_K8_SYSCFG, lo, hi); |
251 | - mtrr_wrmsr(MSR_K8_SYSCFG, lo |
252 | - | K8_MTRRFIXRANGE_DRAM_ENABLE |
253 | - | K8_MTRRFIXRANGE_DRAM_MODIFY, hi); |
254 | -} |
255 | - |
256 | -/** |
257 | * set_fixed_range - checks & updates a fixed-range MTRR if it differs from the value it should have |
258 | * @msr: MSR address of the MTTR which should be checked and updated |
259 | * @changed: pointer which indicates whether the MTRR needed to be changed |
260 | * @msrwords: pointer to the MSR values which the MSR should have |
261 | - * |
262 | - * If K8 extentions are wanted, update the K8 SYSCFG MSR also. |
263 | - * See AMD publication no. 24593, chapter 7.8.1, page 233 for more information. |
264 | */ |
265 | static void set_fixed_range(int msr, bool *changed, unsigned int *msrwords) |
266 | { |
267 | @@ -337,10 +348,6 @@ static void set_fixed_range(int msr, bool *changed, unsigned int *msrwords) |
268 | rdmsr(msr, lo, hi); |
269 | |
270 | if (lo != msrwords[0] || hi != msrwords[1]) { |
271 | - if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD && |
272 | - (boot_cpu_data.x86 >= 0x0f && boot_cpu_data.x86 <= 0x11) && |
273 | - ((msrwords[0] | msrwords[1]) & K8_MTRR_RDMEM_WRMEM_MASK)) |
274 | - k8_enable_fixed_iorrs(); |
275 | mtrr_wrmsr(msr, msrwords[0], msrwords[1]); |
276 | *changed = true; |
277 | } |
278 | @@ -419,6 +426,8 @@ static int set_fixed_ranges(mtrr_type * frs) |
279 | bool changed = false; |
280 | int block=-1, range; |
281 | |
282 | + k8_check_syscfg_dram_mod_en(); |
283 | + |
284 | while (fixed_range_blocks[++block].ranges) |
285 | for (range=0; range < fixed_range_blocks[block].ranges; range++) |
286 | set_fixed_range(fixed_range_blocks[block].base_msr + range, |
287 | diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c |
288 | index 06ca07f..f7d38d6 100644 |
289 | --- a/arch/x86/kernel/ptrace.c |
290 | +++ b/arch/x86/kernel/ptrace.c |
291 | @@ -690,9 +690,8 @@ static int ptrace_bts_config(struct task_struct *child, |
292 | if (!cfg.signal) |
293 | return -EINVAL; |
294 | |
295 | - return -EOPNOTSUPP; |
296 | - |
297 | child->thread.bts_ovfl_signal = cfg.signal; |
298 | + return -EOPNOTSUPP; |
299 | } |
300 | |
301 | if ((cfg.flags & PTRACE_BTS_O_ALLOC) && |
302 | diff --git a/arch/x86/kernel/tlb_uv.c b/arch/x86/kernel/tlb_uv.c |
303 | index 6812b82..16e505a 100644 |
304 | --- a/arch/x86/kernel/tlb_uv.c |
305 | +++ b/arch/x86/kernel/tlb_uv.c |
306 | @@ -742,7 +742,7 @@ static int __init uv_bau_init(void) |
307 | int node; |
308 | int nblades; |
309 | int last_blade; |
310 | - int cur_cpu = 0; |
311 | + int cur_cpu; |
312 | |
313 | if (!is_uv_system()) |
314 | return 0; |
315 | @@ -752,6 +752,7 @@ static int __init uv_bau_init(void) |
316 | uv_mmask = (1UL << uv_hub_info->n_val) - 1; |
317 | nblades = 0; |
318 | last_blade = -1; |
319 | + cur_cpu = 0; |
320 | for_each_online_node(node) { |
321 | blade = uv_node_to_blade_id(node); |
322 | if (blade == last_blade) |
323 | diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h |
324 | index 9fd78b6..c95a67d 100644 |
325 | --- a/arch/x86/kvm/paging_tmpl.h |
326 | +++ b/arch/x86/kvm/paging_tmpl.h |
327 | @@ -314,9 +314,9 @@ static int FNAME(shadow_walk_entry)(struct kvm_shadow_walk *_sw, |
328 | return 0; |
329 | |
330 | if (is_large_pte(*sptep)) { |
331 | + rmap_remove(vcpu->kvm, sptep); |
332 | set_shadow_pte(sptep, shadow_trap_nonpresent_pte); |
333 | kvm_flush_remote_tlbs(vcpu->kvm); |
334 | - rmap_remove(vcpu->kvm, sptep); |
335 | } |
336 | |
337 | if (level == PT_DIRECTORY_LEVEL && gw->level == PT_DIRECTORY_LEVEL) { |
338 | diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c |
339 | index a9e769e..da56821 100644 |
340 | --- a/arch/x86/kvm/svm.c |
341 | +++ b/arch/x86/kvm/svm.c |
342 | @@ -760,20 +760,37 @@ static void svm_get_segment(struct kvm_vcpu *vcpu, |
343 | var->db = (s->attrib >> SVM_SELECTOR_DB_SHIFT) & 1; |
344 | var->g = (s->attrib >> SVM_SELECTOR_G_SHIFT) & 1; |
345 | |
346 | - /* |
347 | - * SVM always stores 0 for the 'G' bit in the CS selector in |
348 | - * the VMCB on a VMEXIT. This hurts cross-vendor migration: |
349 | - * Intel's VMENTRY has a check on the 'G' bit. |
350 | - */ |
351 | - if (seg == VCPU_SREG_CS) |
352 | + switch (seg) { |
353 | + case VCPU_SREG_CS: |
354 | + /* |
355 | + * SVM always stores 0 for the 'G' bit in the CS selector in |
356 | + * the VMCB on a VMEXIT. This hurts cross-vendor migration: |
357 | + * Intel's VMENTRY has a check on the 'G' bit. |
358 | + */ |
359 | var->g = s->limit > 0xfffff; |
360 | - |
361 | - /* |
362 | - * Work around a bug where the busy flag in the tr selector |
363 | - * isn't exposed |
364 | - */ |
365 | - if (seg == VCPU_SREG_TR) |
366 | + break; |
367 | + case VCPU_SREG_TR: |
368 | + /* |
369 | + * Work around a bug where the busy flag in the tr selector |
370 | + * isn't exposed |
371 | + */ |
372 | var->type |= 0x2; |
373 | + break; |
374 | + case VCPU_SREG_DS: |
375 | + case VCPU_SREG_ES: |
376 | + case VCPU_SREG_FS: |
377 | + case VCPU_SREG_GS: |
378 | + /* |
379 | + * The accessed bit must always be set in the segment |
380 | + * descriptor cache, although it can be cleared in the |
381 | + * descriptor, the cached bit always remains at 1. Since |
382 | + * Intel has a check on this, set it here to support |
383 | + * cross-vendor migration. |
384 | + */ |
385 | + if (!var->unusable) |
386 | + var->type |= 0x1; |
387 | + break; |
388 | + } |
389 | |
390 | var->unusable = !var->present; |
391 | } |
392 | diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c |
393 | index 7611af5..90de444 100644 |
394 | --- a/arch/x86/kvm/vmx.c |
395 | +++ b/arch/x86/kvm/vmx.c |
396 | @@ -928,11 +928,11 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, u32 msr_index, u64 data) |
397 | int ret = 0; |
398 | |
399 | switch (msr_index) { |
400 | -#ifdef CONFIG_X86_64 |
401 | case MSR_EFER: |
402 | vmx_load_host_state(vmx); |
403 | ret = kvm_set_msr_common(vcpu, msr_index, data); |
404 | break; |
405 | +#ifdef CONFIG_X86_64 |
406 | case MSR_FS_BASE: |
407 | vmcs_writel(GUEST_FS_BASE, data); |
408 | break; |
409 | diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c |
410 | index 960a8d9..4175cb4 100644 |
411 | --- a/arch/x86/lguest/boot.c |
412 | +++ b/arch/x86/lguest/boot.c |
413 | @@ -485,11 +485,17 @@ static void lguest_write_cr4(unsigned long val) |
414 | * into a process' address space. We set the entry then tell the Host the |
415 | * toplevel and address this corresponds to. The Guest uses one pagetable per |
416 | * process, so we need to tell the Host which one we're changing (mm->pgd). */ |
417 | +static void lguest_pte_update(struct mm_struct *mm, unsigned long addr, |
418 | + pte_t *ptep) |
419 | +{ |
420 | + lazy_hcall(LHCALL_SET_PTE, __pa(mm->pgd), addr, ptep->pte_low); |
421 | +} |
422 | + |
423 | static void lguest_set_pte_at(struct mm_struct *mm, unsigned long addr, |
424 | pte_t *ptep, pte_t pteval) |
425 | { |
426 | *ptep = pteval; |
427 | - lazy_hcall(LHCALL_SET_PTE, __pa(mm->pgd), addr, pteval.pte_low); |
428 | + lguest_pte_update(mm, addr, ptep); |
429 | } |
430 | |
431 | /* The Guest calls this to set a top-level entry. Again, we set the entry then |
432 | @@ -1034,6 +1040,8 @@ __init void lguest_init(void) |
433 | pv_mmu_ops.read_cr3 = lguest_read_cr3; |
434 | pv_mmu_ops.lazy_mode.enter = paravirt_enter_lazy_mmu; |
435 | pv_mmu_ops.lazy_mode.leave = lguest_leave_lazy_mode; |
436 | + pv_mmu_ops.pte_update = lguest_pte_update; |
437 | + pv_mmu_ops.pte_update_defer = lguest_pte_update; |
438 | |
439 | #ifdef CONFIG_X86_LOCAL_APIC |
440 | /* apic read/write intercepts */ |
441 | diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c |
442 | index e0ab173..21bc1f7 100644 |
443 | --- a/arch/x86/mm/pat.c |
444 | +++ b/arch/x86/mm/pat.c |
445 | @@ -641,10 +641,11 @@ static int reserve_pfn_range(u64 paddr, unsigned long size, pgprot_t *vma_prot, |
446 | is_ram = pat_pagerange_is_ram(paddr, paddr + size); |
447 | |
448 | /* |
449 | - * reserve_pfn_range() doesn't support RAM pages. |
450 | + * reserve_pfn_range() doesn't support RAM pages. Maintain the current |
451 | + * behavior with RAM pages by returning success. |
452 | */ |
453 | if (is_ram != 0) |
454 | - return -EINVAL; |
455 | + return 0; |
456 | |
457 | ret = reserve_memtype(paddr, paddr + size, want_flags, &flags); |
458 | if (ret) |
459 | diff --git a/arch/x86/pci/i386.c b/arch/x86/pci/i386.c |
460 | index 5ead808..f234a37 100644 |
461 | --- a/arch/x86/pci/i386.c |
462 | +++ b/arch/x86/pci/i386.c |
463 | @@ -319,6 +319,9 @@ int pci_mmap_page_range(struct pci_dev *dev, struct vm_area_struct *vma, |
464 | return -EINVAL; |
465 | } |
466 | flags = new_flags; |
467 | + vma->vm_page_prot = __pgprot( |
468 | + (pgprot_val(vma->vm_page_prot) & ~_PAGE_CACHE_MASK) | |
469 | + flags); |
470 | } |
471 | |
472 | if (((vma->vm_pgoff < max_low_pfn_mapped) || |
473 | diff --git a/drivers/char/raw.c b/drivers/char/raw.c |
474 | index 96adf28..20d90e6 100644 |
475 | --- a/drivers/char/raw.c |
476 | +++ b/drivers/char/raw.c |
477 | @@ -90,6 +90,7 @@ out1: |
478 | blkdev_put(bdev, filp->f_mode); |
479 | out: |
480 | mutex_unlock(&raw_mutex); |
481 | + unlock_kernel(); |
482 | return err; |
483 | } |
484 | |
485 | diff --git a/drivers/lguest/page_tables.c b/drivers/lguest/page_tables.c |
486 | index 576a831..82ff484 100644 |
487 | --- a/drivers/lguest/page_tables.c |
488 | +++ b/drivers/lguest/page_tables.c |
489 | @@ -373,8 +373,10 @@ unsigned long guest_pa(struct lg_cpu *cpu, unsigned long vaddr) |
490 | /* First step: get the top-level Guest page table entry. */ |
491 | gpgd = lgread(cpu, gpgd_addr(cpu, vaddr), pgd_t); |
492 | /* Toplevel not present? We can't map it in. */ |
493 | - if (!(pgd_flags(gpgd) & _PAGE_PRESENT)) |
494 | + if (!(pgd_flags(gpgd) & _PAGE_PRESENT)) { |
495 | kill_guest(cpu, "Bad address %#lx", vaddr); |
496 | + return -1UL; |
497 | + } |
498 | |
499 | gpte = lgread(cpu, gpte_addr(gpgd, vaddr), pte_t); |
500 | if (!(pte_flags(gpte) & _PAGE_PRESENT)) |
501 | diff --git a/drivers/media/dvb/firewire/firedtv-avc.c b/drivers/media/dvb/firewire/firedtv-avc.c |
502 | index b55d9cc..adc2ce9 100644 |
503 | --- a/drivers/media/dvb/firewire/firedtv-avc.c |
504 | +++ b/drivers/media/dvb/firewire/firedtv-avc.c |
505 | @@ -135,6 +135,7 @@ static const char *debug_fcp_opcode(unsigned int opcode, |
506 | case SFE_VENDOR_OPCODE_REGISTER_REMOTE_CONTROL: return "RegisterRC"; |
507 | case SFE_VENDOR_OPCODE_LNB_CONTROL: return "LNBControl"; |
508 | case SFE_VENDOR_OPCODE_TUNE_QPSK: return "TuneQPSK"; |
509 | + case SFE_VENDOR_OPCODE_TUNE_QPSK2: return "TuneQPSK2"; |
510 | case SFE_VENDOR_OPCODE_HOST2CA: return "Host2CA"; |
511 | case SFE_VENDOR_OPCODE_CA2HOST: return "CA2Host"; |
512 | } |
513 | @@ -266,7 +267,10 @@ static void avc_tuner_tuneqpsk(struct firedtv *fdtv, |
514 | c->operand[0] = SFE_VENDOR_DE_COMPANYID_0; |
515 | c->operand[1] = SFE_VENDOR_DE_COMPANYID_1; |
516 | c->operand[2] = SFE_VENDOR_DE_COMPANYID_2; |
517 | - c->operand[3] = SFE_VENDOR_OPCODE_TUNE_QPSK; |
518 | + if (fdtv->type == FIREDTV_DVB_S2) |
519 | + c->operand[3] = SFE_VENDOR_OPCODE_TUNE_QPSK2; |
520 | + else |
521 | + c->operand[3] = SFE_VENDOR_OPCODE_TUNE_QPSK; |
522 | |
523 | c->operand[4] = (params->frequency >> 24) & 0xff; |
524 | c->operand[5] = (params->frequency >> 16) & 0xff; |
525 | diff --git a/drivers/media/video/v4l2-common.c b/drivers/media/video/v4l2-common.c |
526 | index b8f2be8..907cd02 100644 |
527 | --- a/drivers/media/video/v4l2-common.c |
528 | +++ b/drivers/media/video/v4l2-common.c |
529 | @@ -910,10 +910,10 @@ struct v4l2_subdev *v4l2_i2c_new_subdev(struct i2c_adapter *adapter, |
530 | struct i2c_board_info info; |
531 | |
532 | BUG_ON(!dev); |
533 | -#ifdef MODULE |
534 | + |
535 | if (module_name) |
536 | request_module(module_name); |
537 | -#endif |
538 | + |
539 | /* Setup the i2c board info with the device type and |
540 | the device address. */ |
541 | memset(&info, 0, sizeof(info)); |
542 | @@ -958,10 +958,10 @@ struct v4l2_subdev *v4l2_i2c_new_probed_subdev(struct i2c_adapter *adapter, |
543 | struct i2c_board_info info; |
544 | |
545 | BUG_ON(!dev); |
546 | -#ifdef MODULE |
547 | + |
548 | if (module_name) |
549 | request_module(module_name); |
550 | -#endif |
551 | + |
552 | /* Setup the i2c board info with the device type and |
553 | the device address. */ |
554 | memset(&info, 0, sizeof(info)); |
555 | diff --git a/drivers/net/dnet.c b/drivers/net/dnet.c |
556 | index 1b40632..edf23c9 100644 |
557 | --- a/drivers/net/dnet.c |
558 | +++ b/drivers/net/dnet.c |
559 | @@ -9,6 +9,7 @@ |
560 | * published by the Free Software Foundation. |
561 | */ |
562 | #include <linux/version.h> |
563 | +#include <linux/io.h> |
564 | #include <linux/module.h> |
565 | #include <linux/moduleparam.h> |
566 | #include <linux/kernel.h> |
567 | diff --git a/drivers/net/wireless/ath5k/base.c b/drivers/net/wireless/ath5k/base.c |
568 | index 1d77ee9..6cf69d3 100644 |
569 | --- a/drivers/net/wireless/ath5k/base.c |
570 | +++ b/drivers/net/wireless/ath5k/base.c |
571 | @@ -1090,8 +1090,18 @@ ath5k_mode_setup(struct ath5k_softc *sc) |
572 | static inline int |
573 | ath5k_hw_to_driver_rix(struct ath5k_softc *sc, int hw_rix) |
574 | { |
575 | - WARN_ON(hw_rix < 0 || hw_rix > AR5K_MAX_RATES); |
576 | - return sc->rate_idx[sc->curband->band][hw_rix]; |
577 | + int rix; |
578 | + |
579 | + /* return base rate on errors */ |
580 | + if (WARN(hw_rix < 0 || hw_rix >= AR5K_MAX_RATES, |
581 | + "hw_rix out of bounds: %x\n", hw_rix)) |
582 | + return 0; |
583 | + |
584 | + rix = sc->rate_idx[sc->curband->band][hw_rix]; |
585 | + if (WARN(rix < 0, "invalid hw_rix: %x\n", hw_rix)) |
586 | + rix = 0; |
587 | + |
588 | + return rix; |
589 | } |
590 | |
591 | /***************\ |
592 | @@ -1668,7 +1678,6 @@ ath5k_check_ibss_tsf(struct ath5k_softc *sc, struct sk_buff *skb, |
593 | } |
594 | } |
595 | |
596 | - |
597 | static void |
598 | ath5k_tasklet_rx(unsigned long data) |
599 | { |
600 | @@ -2188,6 +2197,7 @@ static void |
601 | ath5k_beacon_config(struct ath5k_softc *sc) |
602 | { |
603 | struct ath5k_hw *ah = sc->ah; |
604 | + unsigned long flags; |
605 | |
606 | ath5k_hw_set_imr(ah, 0); |
607 | sc->bmisscount = 0; |
608 | @@ -2211,9 +2221,9 @@ ath5k_beacon_config(struct ath5k_softc *sc) |
609 | |
610 | if (sc->opmode == NL80211_IFTYPE_ADHOC) { |
611 | if (ath5k_hw_hasveol(ah)) { |
612 | - spin_lock(&sc->block); |
613 | + spin_lock_irqsave(&sc->block, flags); |
614 | ath5k_beacon_send(sc); |
615 | - spin_unlock(&sc->block); |
616 | + spin_unlock_irqrestore(&sc->block, flags); |
617 | } |
618 | } else |
619 | ath5k_beacon_update_timers(sc, -1); |
620 | @@ -2259,7 +2269,7 @@ ath5k_init(struct ath5k_softc *sc, bool is_resume) |
621 | sc->curband = &sc->sbands[sc->curchan->band]; |
622 | sc->imask = AR5K_INT_RXOK | AR5K_INT_RXERR | AR5K_INT_RXEOL | |
623 | AR5K_INT_RXORN | AR5K_INT_TXDESC | AR5K_INT_TXEOL | |
624 | - AR5K_INT_FATAL | AR5K_INT_GLOBAL | AR5K_INT_MIB; |
625 | + AR5K_INT_FATAL | AR5K_INT_GLOBAL; |
626 | ret = ath5k_reset(sc, false, false); |
627 | if (ret) |
628 | goto done; |
629 | diff --git a/drivers/net/wireless/ath5k/base.h b/drivers/net/wireless/ath5k/base.h |
630 | index facc60d..d86ab39 100644 |
631 | --- a/drivers/net/wireless/ath5k/base.h |
632 | +++ b/drivers/net/wireless/ath5k/base.h |
633 | @@ -112,7 +112,7 @@ struct ath5k_softc { |
634 | struct ieee80211_supported_band sbands[IEEE80211_NUM_BANDS]; |
635 | struct ieee80211_channel channels[ATH_CHAN_MAX]; |
636 | struct ieee80211_rate rates[IEEE80211_NUM_BANDS][AR5K_MAX_RATES]; |
637 | - u8 rate_idx[IEEE80211_NUM_BANDS][AR5K_MAX_RATES]; |
638 | + s8 rate_idx[IEEE80211_NUM_BANDS][AR5K_MAX_RATES]; |
639 | enum nl80211_iftype opmode; |
640 | struct ath5k_hw *ah; /* Atheros HW */ |
641 | |
642 | diff --git a/drivers/net/wireless/ath9k/recv.c b/drivers/net/wireless/ath9k/recv.c |
643 | index 462e08c..c114cb7 100644 |
644 | --- a/drivers/net/wireless/ath9k/recv.c |
645 | +++ b/drivers/net/wireless/ath9k/recv.c |
646 | @@ -322,8 +322,13 @@ void ath_rx_cleanup(struct ath_softc *sc) |
647 | |
648 | list_for_each_entry(bf, &sc->rx.rxbuf, list) { |
649 | skb = bf->bf_mpdu; |
650 | - if (skb) |
651 | + if (skb) { |
652 | + pci_unmap_single(sc->pdev, |
653 | + bf->bf_buf_addr, |
654 | + sc->rx.bufsize, |
655 | + DMA_FROM_DEVICE); |
656 | dev_kfree_skb(skb); |
657 | + } |
658 | } |
659 | |
660 | if (sc->rx.rxdma.dd_desc_len != 0) |
661 | diff --git a/drivers/net/wireless/ath9k/xmit.c b/drivers/net/wireless/ath9k/xmit.c |
662 | index c92f0c6..80af54e 100644 |
663 | --- a/drivers/net/wireless/ath9k/xmit.c |
664 | +++ b/drivers/net/wireless/ath9k/xmit.c |
665 | @@ -2035,7 +2035,7 @@ struct ath_txq *ath_test_get_txq(struct ath_softc *sc, struct sk_buff *skb) |
666 | |
667 | /* Try to avoid running out of descriptors */ |
668 | if (txq->axq_depth >= (ATH_TXBUF - 20)) { |
669 | - DPRINTF(sc, ATH_DBG_FATAL, |
670 | + DPRINTF(sc, ATH_DBG_XMIT, |
671 | "TX queue: %d is full, depth: %d\n", |
672 | qnum, txq->axq_depth); |
673 | ieee80211_stop_queue(sc->hw, skb_get_queue_mapping(skb)); |
674 | diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c |
675 | index eae9b80..12069e5 100644 |
676 | --- a/drivers/net/wireless/b43/xmit.c |
677 | +++ b/drivers/net/wireless/b43/xmit.c |
678 | @@ -50,7 +50,7 @@ static int b43_plcp_get_bitrate_idx_cck(struct b43_plcp_hdr6 *plcp) |
679 | } |
680 | |
681 | /* Extract the bitrate index out of an OFDM PLCP header. */ |
682 | -static u8 b43_plcp_get_bitrate_idx_ofdm(struct b43_plcp_hdr6 *plcp, bool aphy) |
683 | +static int b43_plcp_get_bitrate_idx_ofdm(struct b43_plcp_hdr6 *plcp, bool aphy) |
684 | { |
685 | int base = aphy ? 0 : 4; |
686 | |
687 | diff --git a/drivers/scsi/arm/cumana_2.c b/drivers/scsi/arm/cumana_2.c |
688 | index 68a6412..ed502b7 100644 |
689 | --- a/drivers/scsi/arm/cumana_2.c |
690 | +++ b/drivers/scsi/arm/cumana_2.c |
691 | @@ -318,7 +318,7 @@ cumanascsi_2_set_proc_info(struct Scsi_Host *host, char *buffer, int length) |
692 | { |
693 | int ret = length; |
694 | |
695 | - if (length >= 11 && strcmp(buffer, "CUMANASCSI2") == 0) { |
696 | + if (length >= 11 && strncmp(buffer, "CUMANASCSI2", 11) == 0) { |
697 | buffer += 11; |
698 | length -= 11; |
699 | |
700 | diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c |
701 | index 49e7f56..3922fa9 100644 |
702 | --- a/drivers/usb/core/message.c |
703 | +++ b/drivers/usb/core/message.c |
704 | @@ -1719,7 +1719,8 @@ free_interfaces: |
705 | } |
706 | kfree(new_interfaces); |
707 | |
708 | - if (cp->string == NULL) |
709 | + if (cp->string == NULL && |
710 | + !(dev->quirks & USB_QUIRK_CONFIG_INTF_STRINGS)) |
711 | cp->string = usb_cache_string(dev, cp->desc.iConfiguration); |
712 | |
713 | /* Now that all the interfaces are set up, register them |
714 | diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c |
715 | index c070b34..ab93918 100644 |
716 | --- a/drivers/usb/core/quirks.c |
717 | +++ b/drivers/usb/core/quirks.c |
718 | @@ -54,6 +54,10 @@ static const struct usb_device_id usb_quirk_list[] = { |
719 | { USB_DEVICE(0x0638, 0x0a13), .driver_info = |
720 | USB_QUIRK_STRING_FETCH_255 }, |
721 | |
722 | + /* Saitek Cyborg Gold Joystick */ |
723 | + { USB_DEVICE(0x06a3, 0x0006), .driver_info = |
724 | + USB_QUIRK_CONFIG_INTF_STRINGS }, |
725 | + |
726 | /* M-Systems Flash Disk Pioneers */ |
727 | { USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME }, |
728 | |
729 | diff --git a/drivers/usb/core/sysfs.c b/drivers/usb/core/sysfs.c |
730 | index 4cc2456..c667891 100644 |
731 | --- a/drivers/usb/core/sysfs.c |
732 | +++ b/drivers/usb/core/sysfs.c |
733 | @@ -13,6 +13,7 @@ |
734 | #include <linux/kernel.h> |
735 | #include <linux/string.h> |
736 | #include <linux/usb.h> |
737 | +#include <linux/usb/quirks.h> |
738 | #include "usb.h" |
739 | |
740 | /* Active configuration fields */ |
741 | @@ -813,7 +814,8 @@ int usb_create_sysfs_intf_files(struct usb_interface *intf) |
742 | if (intf->sysfs_files_created || intf->unregistering) |
743 | return 0; |
744 | |
745 | - if (alt->string == NULL) |
746 | + if (alt->string == NULL && |
747 | + !(udev->quirks & USB_QUIRK_CONFIG_INTF_STRINGS)) |
748 | alt->string = usb_cache_string(udev, alt->desc.iInterface); |
749 | if (alt->string) |
750 | retval = device_create_file(&intf->dev, &dev_attr_interface); |
751 | diff --git a/drivers/usb/gadget/f_rndis.c b/drivers/usb/gadget/f_rndis.c |
752 | index 3a8bb53..fd7b356 100644 |
753 | --- a/drivers/usb/gadget/f_rndis.c |
754 | +++ b/drivers/usb/gadget/f_rndis.c |
755 | @@ -437,7 +437,7 @@ invalid: |
756 | DBG(cdev, "rndis req%02x.%02x v%04x i%04x l%d\n", |
757 | ctrl->bRequestType, ctrl->bRequest, |
758 | w_value, w_index, w_length); |
759 | - req->zero = 0; |
760 | + req->zero = (value < w_length); |
761 | req->length = value; |
762 | value = usb_ep_queue(cdev->gadget->ep0, req, GFP_ATOMIC); |
763 | if (value < 0) |
764 | diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c |
765 | index ecc9b66..01132ac 100644 |
766 | --- a/drivers/usb/host/ehci-q.c |
767 | +++ b/drivers/usb/host/ehci-q.c |
768 | @@ -333,12 +333,40 @@ qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh) |
769 | token = hc32_to_cpu(ehci, qtd->hw_token); |
770 | |
771 | /* always clean up qtds the hc de-activated */ |
772 | + retry_xacterr: |
773 | if ((token & QTD_STS_ACTIVE) == 0) { |
774 | |
775 | /* on STALL, error, and short reads this urb must |
776 | * complete and all its qtds must be recycled. |
777 | */ |
778 | if ((token & QTD_STS_HALT) != 0) { |
779 | + |
780 | + /* retry transaction errors until we |
781 | + * reach the software xacterr limit |
782 | + */ |
783 | + if ((token & QTD_STS_XACT) && |
784 | + QTD_CERR(token) == 0 && |
785 | + --qh->xacterrs > 0 && |
786 | + !urb->unlinked) { |
787 | + ehci_dbg(ehci, |
788 | + "detected XactErr len %d/%d retry %d\n", |
789 | + qtd->length - QTD_LENGTH(token), qtd->length, |
790 | + QH_XACTERR_MAX - qh->xacterrs); |
791 | + |
792 | + /* reset the token in the qtd and the |
793 | + * qh overlay (which still contains |
794 | + * the qtd) so that we pick up from |
795 | + * where we left off |
796 | + */ |
797 | + token &= ~QTD_STS_HALT; |
798 | + token |= QTD_STS_ACTIVE | |
799 | + (EHCI_TUNE_CERR << 10); |
800 | + qtd->hw_token = cpu_to_hc32(ehci, |
801 | + token); |
802 | + wmb(); |
803 | + qh->hw_token = cpu_to_hc32(ehci, token); |
804 | + goto retry_xacterr; |
805 | + } |
806 | stopped = 1; |
807 | |
808 | /* magic dummy for some short reads; qh won't advance. |
809 | @@ -421,6 +449,9 @@ halt: |
810 | /* remove qtd; it's recycled after possible urb completion */ |
811 | list_del (&qtd->qtd_list); |
812 | last = qtd; |
813 | + |
814 | + /* reinit the xacterr counter for the next qtd */ |
815 | + qh->xacterrs = QH_XACTERR_MAX; |
816 | } |
817 | |
818 | /* last urb's completion might still need calling */ |
819 | @@ -862,6 +893,7 @@ static void qh_link_async (struct ehci_hcd *ehci, struct ehci_qh *qh) |
820 | head->qh_next.qh = qh; |
821 | head->hw_next = dma; |
822 | |
823 | + qh->xacterrs = QH_XACTERR_MAX; |
824 | qh->qh_state = QH_STATE_LINKED; |
825 | /* qtd completions reported later by interrupt */ |
826 | } |
827 | diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h |
828 | index 262b00c..c7385f2 100644 |
829 | --- a/drivers/usb/host/ehci.h |
830 | +++ b/drivers/usb/host/ehci.h |
831 | @@ -376,6 +376,9 @@ struct ehci_qh { |
832 | #define QH_STATE_UNLINK_WAIT 4 /* LINKED and on reclaim q */ |
833 | #define QH_STATE_COMPLETING 5 /* don't touch token.HALT */ |
834 | |
835 | + u8 xacterrs; /* XactErr retry counter */ |
836 | +#define QH_XACTERR_MAX 32 /* XactErr retry limit */ |
837 | + |
838 | /* periodic schedule info */ |
839 | u8 usecs; /* intr bandwidth */ |
840 | u8 gap_uf; /* uframes split/csplit gap */ |
841 | diff --git a/drivers/usb/storage/cypress_atacb.c b/drivers/usb/storage/cypress_atacb.c |
842 | index 898e67d..9466a99 100644 |
843 | --- a/drivers/usb/storage/cypress_atacb.c |
844 | +++ b/drivers/usb/storage/cypress_atacb.c |
845 | @@ -133,19 +133,18 @@ void cypress_atacb_passthrough(struct scsi_cmnd *srb, struct us_data *us) |
846 | |
847 | /* build the command for |
848 | * reading the ATA registers */ |
849 | - scsi_eh_prep_cmnd(srb, &ses, NULL, 0, 0); |
850 | - srb->sdb.length = sizeof(regs); |
851 | - sg_init_one(&ses.sense_sgl, regs, srb->sdb.length); |
852 | - srb->sdb.table.sgl = &ses.sense_sgl; |
853 | - srb->sc_data_direction = DMA_FROM_DEVICE; |
854 | - srb->sdb.table.nents = 1; |
855 | + scsi_eh_prep_cmnd(srb, &ses, NULL, 0, sizeof(regs)); |
856 | + |
857 | /* we use the same command as before, but we set |
858 | * the read taskfile bit, for not executing atacb command, |
859 | * but reading register selected in srb->cmnd[4] |
860 | */ |
861 | + srb->cmd_len = 16; |
862 | + srb->cmnd = ses.cmnd; |
863 | srb->cmnd[2] = 1; |
864 | |
865 | usb_stor_transparent_scsi_command(srb, us); |
866 | + memcpy(regs, srb->sense_buffer, sizeof(regs)); |
867 | tmp_result = srb->result; |
868 | scsi_eh_restore_cmnd(srb, &ses); |
869 | /* we fail to get registers, report invalid command */ |
870 | @@ -162,8 +161,8 @@ void cypress_atacb_passthrough(struct scsi_cmnd *srb, struct us_data *us) |
871 | |
872 | /* XXX we should generate sk, asc, ascq from status and error |
873 | * regs |
874 | - * (see 11.1 Error translation ATA device error to SCSI error map) |
875 | - * and ata_to_sense_error from libata. |
876 | + * (see 11.1 Error translation ATA device error to SCSI error |
877 | + * map, and ata_to_sense_error from libata.) |
878 | */ |
879 | |
880 | /* Sense data is current and format is descriptor. */ |
881 | diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c |
882 | index 727c506..ed710bc 100644 |
883 | --- a/drivers/usb/storage/scsiglue.c |
884 | +++ b/drivers/usb/storage/scsiglue.c |
885 | @@ -135,6 +135,12 @@ static int slave_configure(struct scsi_device *sdev) |
886 | if (sdev->request_queue->max_sectors > max_sectors) |
887 | blk_queue_max_sectors(sdev->request_queue, |
888 | max_sectors); |
889 | + } else if (sdev->type == TYPE_TAPE) { |
890 | + /* Tapes need much higher max_sector limits, so just |
891 | + * raise it to the maximum possible (4 GB / 512) and |
892 | + * let the queue segment size sort out the real limit. |
893 | + */ |
894 | + blk_queue_max_sectors(sdev->request_queue, 0x7FFFFF); |
895 | } |
896 | |
897 | /* Some USB host controllers can't do DMA; they have to use PIO. |
898 | diff --git a/drivers/video/pxafb.c b/drivers/video/pxafb.c |
899 | index 2552b9f..642c1d4 100644 |
900 | --- a/drivers/video/pxafb.c |
901 | +++ b/drivers/video/pxafb.c |
902 | @@ -883,10 +883,21 @@ static void __devinit init_pxafb_overlay(struct pxafb_info *fbi, |
903 | init_completion(&ofb->branch_done); |
904 | } |
905 | |
906 | +static inline int pxafb_overlay_supported(void) |
907 | +{ |
908 | + if (cpu_is_pxa27x() || cpu_is_pxa3xx()) |
909 | + return 1; |
910 | + |
911 | + return 0; |
912 | +} |
913 | + |
914 | static int __devinit pxafb_overlay_init(struct pxafb_info *fbi) |
915 | { |
916 | int i, ret; |
917 | |
918 | + if (!pxafb_overlay_supported()) |
919 | + return 0; |
920 | + |
921 | for (i = 0; i < 2; i++) { |
922 | init_pxafb_overlay(fbi, &fbi->overlay[i], i); |
923 | ret = register_framebuffer(&fbi->overlay[i].fb); |
924 | @@ -909,6 +920,9 @@ static void __devexit pxafb_overlay_exit(struct pxafb_info *fbi) |
925 | { |
926 | int i; |
927 | |
928 | + if (!pxafb_overlay_supported()) |
929 | + return; |
930 | + |
931 | for (i = 0; i < 2; i++) |
932 | unregister_framebuffer(&fbi->overlay[i].fb); |
933 | } |
934 | diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES |
935 | index 851388f..6562eb0 100644 |
936 | --- a/fs/cifs/CHANGES |
937 | +++ b/fs/cifs/CHANGES |
938 | @@ -7,6 +7,9 @@ are authenticated as guest, as reconnections, invalidating the earlier |
939 | user's smb session. This fix allows cifs to mount multiple times to the |
940 | same server with different userids without risking invalidating earlier |
941 | established security contexts. |
942 | +Fix "redzone overwritten" bug in cifs_put_tcon (CIFSTcon may allocate too |
943 | +little memory for the "nativeFileSystem" field returned by the server |
944 | +during mount). |
945 | |
946 | Version 1.56 |
947 | ------------ |
948 | diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c |
949 | index 939e2f7..71ae000 100644 |
950 | --- a/fs/cifs/cifssmb.c |
951 | +++ b/fs/cifs/cifssmb.c |
952 | @@ -2356,8 +2356,10 @@ winCreateHardLinkRetry: |
953 | PATH_MAX, nls_codepage, remap); |
954 | name_len++; /* trailing null */ |
955 | name_len *= 2; |
956 | - pSMB->OldFileName[name_len] = 0; /* pad */ |
957 | - pSMB->OldFileName[name_len + 1] = 0x04; |
958 | + |
959 | + /* protocol specifies ASCII buffer format (0x04) for unicode */ |
960 | + pSMB->OldFileName[name_len] = 0x04; |
961 | + pSMB->OldFileName[name_len + 1] = 0x00; /* pad */ |
962 | name_len2 = |
963 | cifsConvertToUCS((__le16 *)&pSMB->OldFileName[name_len + 2], |
964 | toName, PATH_MAX, nls_codepage, remap); |
965 | diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c |
966 | index da0f4ff..4b64f39 100644 |
967 | --- a/fs/cifs/connect.c |
968 | +++ b/fs/cifs/connect.c |
969 | @@ -3667,7 +3667,7 @@ CIFSTCon(unsigned int xid, struct cifsSesInfo *ses, |
970 | BCC(smb_buffer_response)) { |
971 | kfree(tcon->nativeFileSystem); |
972 | tcon->nativeFileSystem = |
973 | - kzalloc(length + 2, GFP_KERNEL); |
974 | + kzalloc(2*(length + 1), GFP_KERNEL); |
975 | if (tcon->nativeFileSystem) |
976 | cifs_strfromUCS_le( |
977 | tcon->nativeFileSystem, |
978 | diff --git a/fs/fuse/file.c b/fs/fuse/file.c |
979 | index d9fdb7c..821d10f 100644 |
980 | --- a/fs/fuse/file.c |
981 | +++ b/fs/fuse/file.c |
982 | @@ -1465,7 +1465,7 @@ static loff_t fuse_file_llseek(struct file *file, loff_t offset, int origin) |
983 | case SEEK_END: |
984 | retval = fuse_update_attributes(inode, NULL, file, NULL); |
985 | if (retval) |
986 | - return retval; |
987 | + goto exit; |
988 | offset += i_size_read(inode); |
989 | break; |
990 | case SEEK_CUR: |
991 | @@ -1479,6 +1479,7 @@ static loff_t fuse_file_llseek(struct file *file, loff_t offset, int origin) |
992 | } |
993 | retval = offset; |
994 | } |
995 | +exit: |
996 | mutex_unlock(&inode->i_mutex); |
997 | return retval; |
998 | } |
999 | diff --git a/include/linux/mm.h b/include/linux/mm.h |
1000 | index 065cdf8..3daa05f 100644 |
1001 | --- a/include/linux/mm.h |
1002 | +++ b/include/linux/mm.h |
1003 | @@ -98,7 +98,7 @@ extern unsigned int kobjsize(const void *objp); |
1004 | #define VM_HUGETLB 0x00400000 /* Huge TLB Page VM */ |
1005 | #define VM_NONLINEAR 0x00800000 /* Is non-linear (remap_file_pages) */ |
1006 | #define VM_MAPPED_COPY 0x01000000 /* T if mapped copy of data (nommu mmap) */ |
1007 | -#define VM_INSERTPAGE 0x02000000 /* The vma has had "vm_insert_page()" done on it */ |
1008 | +#define VM_INSERTPAGE 0x02000000 /* The vma has had "vm_insert_page()" done on it. Refer note in VM_PFNMAP_AT_MMAP below */ |
1009 | #define VM_ALWAYSDUMP 0x04000000 /* Always include in core dumps */ |
1010 | |
1011 | #define VM_CAN_NONLINEAR 0x08000000 /* Has ->fault & does nonlinear pages */ |
1012 | @@ -127,6 +127,17 @@ extern unsigned int kobjsize(const void *objp); |
1013 | #define VM_SPECIAL (VM_IO | VM_DONTEXPAND | VM_RESERVED | VM_PFNMAP) |
1014 | |
1015 | /* |
1016 | + * pfnmap vmas that are fully mapped at mmap time (not mapped on fault). |
1017 | + * Used by x86 PAT to identify such PFNMAP mappings and optimize their handling. |
1018 | + * Note VM_INSERTPAGE flag is overloaded here. i.e, |
1019 | + * VM_INSERTPAGE && !VM_PFNMAP implies |
1020 | + * The vma has had "vm_insert_page()" done on it |
1021 | + * VM_INSERTPAGE && VM_PFNMAP implies |
1022 | + * The vma is PFNMAP with full mapping at mmap time |
1023 | + */ |
1024 | +#define VM_PFNMAP_AT_MMAP (VM_INSERTPAGE | VM_PFNMAP) |
1025 | + |
1026 | +/* |
1027 | * mapping from the currently active vm_flags protection bits (the |
1028 | * low four bits) to a page protection mask.. |
1029 | */ |
1030 | @@ -145,7 +156,7 @@ extern pgprot_t protection_map[16]; |
1031 | */ |
1032 | static inline int is_linear_pfn_mapping(struct vm_area_struct *vma) |
1033 | { |
1034 | - return ((vma->vm_flags & VM_PFNMAP) && vma->vm_pgoff); |
1035 | + return ((vma->vm_flags & VM_PFNMAP_AT_MMAP) == VM_PFNMAP_AT_MMAP); |
1036 | } |
1037 | |
1038 | static inline int is_pfn_mapping(struct vm_area_struct *vma) |
1039 | diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h |
1040 | index 7f6c603..2526f3b 100644 |
1041 | --- a/include/linux/usb/quirks.h |
1042 | +++ b/include/linux/usb/quirks.h |
1043 | @@ -16,4 +16,7 @@ |
1044 | /* device can't handle Set-Interface requests */ |
1045 | #define USB_QUIRK_NO_SET_INTF 0x00000004 |
1046 | |
1047 | +/* device can't handle its Configuration or Interface strings */ |
1048 | +#define USB_QUIRK_CONFIG_INTF_STRINGS 0x00000008 |
1049 | + |
1050 | #endif /* __LINUX_USB_QUIRKS_H */ |
1051 | diff --git a/mm/memory.c b/mm/memory.c |
1052 | index baa999e..d7df5ba 100644 |
1053 | --- a/mm/memory.c |
1054 | +++ b/mm/memory.c |
1055 | @@ -1665,9 +1665,10 @@ int remap_pfn_range(struct vm_area_struct *vma, unsigned long addr, |
1056 | * behaviour that some programs depend on. We mark the "original" |
1057 | * un-COW'ed pages by matching them up with "vma->vm_pgoff". |
1058 | */ |
1059 | - if (addr == vma->vm_start && end == vma->vm_end) |
1060 | + if (addr == vma->vm_start && end == vma->vm_end) { |
1061 | vma->vm_pgoff = pfn; |
1062 | - else if (is_cow_mapping(vma->vm_flags)) |
1063 | + vma->vm_flags |= VM_PFNMAP_AT_MMAP; |
1064 | + } else if (is_cow_mapping(vma->vm_flags)) |
1065 | return -EINVAL; |
1066 | |
1067 | vma->vm_flags |= VM_IO | VM_RESERVED | VM_PFNMAP; |
1068 | @@ -1679,6 +1680,7 @@ int remap_pfn_range(struct vm_area_struct *vma, unsigned long addr, |
1069 | * needed from higher level routine calling unmap_vmas |
1070 | */ |
1071 | vma->vm_flags &= ~(VM_IO | VM_RESERVED | VM_PFNMAP); |
1072 | + vma->vm_flags &= ~VM_PFNMAP_AT_MMAP; |
1073 | return -EINVAL; |
1074 | } |
1075 | |
1076 | diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c |
1077 | index 727c5c5..8a96672 100644 |
1078 | --- a/net/bridge/br_if.c |
1079 | +++ b/net/bridge/br_if.c |
1080 | @@ -426,7 +426,6 @@ err2: |
1081 | err1: |
1082 | kobject_del(&p->kobj); |
1083 | err0: |
1084 | - kobject_put(&p->kobj); |
1085 | dev_set_promiscuity(dev, -1); |
1086 | put_back: |
1087 | dev_put(dev); |
1088 | diff --git a/net/core/dev.c b/net/core/dev.c |
1089 | index e3fe5c7..e438f54 100644 |
1090 | --- a/net/core/dev.c |
1091 | +++ b/net/core/dev.c |
1092 | @@ -2588,18 +2588,15 @@ static int process_backlog(struct napi_struct *napi, int quota) |
1093 | local_irq_disable(); |
1094 | skb = __skb_dequeue(&queue->input_pkt_queue); |
1095 | if (!skb) { |
1096 | + __napi_complete(napi); |
1097 | local_irq_enable(); |
1098 | - napi_complete(napi); |
1099 | - goto out; |
1100 | + break; |
1101 | } |
1102 | local_irq_enable(); |
1103 | |
1104 | - napi_gro_receive(napi, skb); |
1105 | + netif_receive_skb(skb); |
1106 | } while (++work < quota && jiffies == start_time); |
1107 | |
1108 | - napi_gro_flush(napi); |
1109 | - |
1110 | -out: |
1111 | return work; |
1112 | } |
1113 | |
1114 | diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c |
1115 | index c47c989..c8bee18 100644 |
1116 | --- a/net/ipv4/udp.c |
1117 | +++ b/net/ipv4/udp.c |
1118 | @@ -1614,7 +1614,8 @@ static struct sock *udp_get_next(struct seq_file *seq, struct sock *sk) |
1119 | } while (sk && (!net_eq(sock_net(sk), net) || sk->sk_family != state->family)); |
1120 | |
1121 | if (!sk) { |
1122 | - spin_unlock_bh(&state->udp_table->hash[state->bucket].lock); |
1123 | + if (state->bucket < UDP_HTABLE_SIZE) |
1124 | + spin_unlock_bh(&state->udp_table->hash[state->bucket].lock); |
1125 | return udp_get_first(seq, state->bucket + 1); |
1126 | } |
1127 | return sk; |
1128 | @@ -1632,6 +1633,9 @@ static struct sock *udp_get_idx(struct seq_file *seq, loff_t pos) |
1129 | |
1130 | static void *udp_seq_start(struct seq_file *seq, loff_t *pos) |
1131 | { |
1132 | + struct udp_iter_state *state = seq->private; |
1133 | + state->bucket = UDP_HTABLE_SIZE; |
1134 | + |
1135 | return *pos ? udp_get_idx(seq, *pos-1) : SEQ_START_TOKEN; |
1136 | } |
1137 | |
1138 | diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c |
1139 | index f171e8d..8f04bd9 100644 |
1140 | --- a/net/ipv6/ip6_input.c |
1141 | +++ b/net/ipv6/ip6_input.c |
1142 | @@ -75,8 +75,7 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt |
1143 | if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL || |
1144 | !idev || unlikely(idev->cnf.disable_ipv6)) { |
1145 | IP6_INC_STATS_BH(net, idev, IPSTATS_MIB_INDISCARDS); |
1146 | - rcu_read_unlock(); |
1147 | - goto out; |
1148 | + goto drop; |
1149 | } |
1150 | |
1151 | memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm)); |
1152 | @@ -147,7 +146,6 @@ err: |
1153 | drop: |
1154 | rcu_read_unlock(); |
1155 | kfree_skb(skb); |
1156 | -out: |
1157 | return 0; |
1158 | } |
1159 | |
1160 | diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c |
1161 | index f3fd154..56ac4ee 100644 |
1162 | --- a/net/netfilter/nf_conntrack_proto_tcp.c |
1163 | +++ b/net/netfilter/nf_conntrack_proto_tcp.c |
1164 | @@ -15,6 +15,7 @@ |
1165 | #include <linux/skbuff.h> |
1166 | #include <linux/ipv6.h> |
1167 | #include <net/ip6_checksum.h> |
1168 | +#include <asm/unaligned.h> |
1169 | |
1170 | #include <net/tcp.h> |
1171 | |
1172 | @@ -466,7 +467,7 @@ static void tcp_sack(const struct sk_buff *skb, unsigned int dataoff, |
1173 | for (i = 0; |
1174 | i < (opsize - TCPOLEN_SACK_BASE); |
1175 | i += TCPOLEN_SACK_PERBLOCK) { |
1176 | - tmp = ntohl(*((__be32 *)(ptr+i)+1)); |
1177 | + tmp = get_unaligned_be32((__be32 *)(ptr+i)+1); |
1178 | |
1179 | if (after(tmp, *sack)) |
1180 | *sack = tmp; |
1181 | diff --git a/net/wireless/reg.c b/net/wireless/reg.c |
1182 | index bd0a16c..4f9ff2a 100644 |
1183 | --- a/net/wireless/reg.c |
1184 | +++ b/net/wireless/reg.c |
1185 | @@ -1083,6 +1083,8 @@ EXPORT_SYMBOL(regulatory_hint); |
1186 | static bool reg_same_country_ie_hint(struct wiphy *wiphy, |
1187 | u32 country_ie_checksum) |
1188 | { |
1189 | + if (unlikely(last_request->initiator != REGDOM_SET_BY_COUNTRY_IE)) |
1190 | + return false; |
1191 | if (!last_request->wiphy) |
1192 | return false; |
1193 | if (likely(last_request->wiphy != wiphy)) |
1194 | @@ -1133,7 +1135,9 @@ void regulatory_hint_11d(struct wiphy *wiphy, |
1195 | /* We will run this for *every* beacon processed for the BSSID, so |
1196 | * we optimize an early check to exit out early if we don't have to |
1197 | * do anything */ |
1198 | - if (likely(last_request->wiphy)) { |
1199 | + if (likely(last_request->initiator == |
1200 | + REGDOM_SET_BY_COUNTRY_IE && |
1201 | + likely(last_request->wiphy))) { |
1202 | struct cfg80211_registered_device *drv_last_ie; |
1203 | |
1204 | drv_last_ie = wiphy_to_dev(last_request->wiphy); |
1205 | @@ -1469,13 +1473,20 @@ int regulatory_init(void) |
1206 | |
1207 | printk(KERN_INFO "cfg80211: Using static regulatory domain info\n"); |
1208 | print_regdomain_info(cfg80211_regdomain); |
1209 | - /* The old code still requests for a new regdomain and if |
1210 | + /* |
1211 | + * The old code still requests for a new regdomain and if |
1212 | * you have CRDA you get it updated, otherwise you get |
1213 | * stuck with the static values. We ignore "EU" code as |
1214 | - * that is not a valid ISO / IEC 3166 alpha2 */ |
1215 | - if (ieee80211_regdom[0] != 'E' || ieee80211_regdom[1] != 'U') |
1216 | - err = __regulatory_hint(NULL, REGDOM_SET_BY_CORE, |
1217 | - ieee80211_regdom, 0, ENVIRON_ANY); |
1218 | + * that is not a valid ISO / IEC 3166 alpha2 |
1219 | + * stuck with the static values. Since "EU" is not a valid |
1220 | + * ISO / IEC 3166 alpha2 code we can't expect userpace to |
1221 | + * give us a regulatory domain for it. We need last_request |
1222 | + * iniitalized though so lets just send a request which we |
1223 | + * know will be ignored... this crap will be removed once |
1224 | + * OLD_REG dies. |
1225 | + */ |
1226 | + err = __regulatory_hint(NULL, REGDOM_SET_BY_CORE, |
1227 | + ieee80211_regdom, 0, ENVIRON_ANY); |
1228 | #else |
1229 | cfg80211_regdomain = cfg80211_world_regdom; |
1230 | |
1231 | diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c |
1232 | index 62a5425..8227172 100644 |
1233 | --- a/net/xfrm/xfrm_state.c |
1234 | +++ b/net/xfrm/xfrm_state.c |
1235 | @@ -1615,7 +1615,7 @@ void xfrm_state_walk_done(struct xfrm_state_walk *walk) |
1236 | |
1237 | spin_lock_bh(&xfrm_state_lock); |
1238 | list_del(&walk->all); |
1239 | - spin_lock_bh(&xfrm_state_lock); |
1240 | + spin_unlock_bh(&xfrm_state_lock); |
1241 | } |
1242 | EXPORT_SYMBOL(xfrm_state_walk_done); |
1243 |