Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel26-magellan/patches-2.6.29-r8/0100-2.6.29.1-all-fixes.patch

    Contents of /trunk/kernel26-magellan/patches-2.6.29-r8/0100-2.6.29.1-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 1114 - (show annotations) (download)
    Sun Aug 22 17:59:15 2010 UTC (13 years, 8 months ago) by niro
    File size: 42037 byte(s) 
    -added
    1 diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h
    2 index a58378c..ce3b36e 100644
    3 --- a/arch/arm/include/asm/elf.h
    4 +++ b/arch/arm/include/asm/elf.h
    5 @@ -50,6 +50,7 @@ typedef struct user_fp elf_fpregset_t;
    6 #define R_ARM_ABS32 2
    7 #define R_ARM_CALL 28
    8 #define R_ARM_JUMP24 29
    9 +#define R_ARM_V4BX 40
    10
    11 /*
    12 * These are used to set parameters in the core dumps.
    13 diff --git a/arch/arm/kernel/module.c b/arch/arm/kernel/module.c
    14 index dab48f2..9f509fd 100644
    15 --- a/arch/arm/kernel/module.c
    16 +++ b/arch/arm/kernel/module.c
    17 @@ -132,6 +132,15 @@ apply_relocate(Elf32_Shdr *sechdrs, const char *strtab, unsigned int symindex,
    18 *(u32 *)loc |= offset & 0x00ffffff;
    19 break;
    20
    21 + case R_ARM_V4BX:
    22 + /* Preserve Rm and the condition code. Alter
    23 + * other bits to re-code instruction as
    24 + * MOV PC,Rm.
    25 + */
    26 + *(u32 *)loc &= 0xf000000f;
    27 + *(u32 *)loc |= 0x01a0f000;
    28 + break;
    29 +
    30 default:
    31 printk(KERN_ERR "%s: unknown relocation: %u\n",
    32 module->name, ELF32_R_TYPE(rel->r_info));
    33 diff --git a/arch/arm/mach-iop13xx/pci.c b/arch/arm/mach-iop13xx/pci.c
    34 index 673b0db..4873f26 100644
    35 --- a/arch/arm/mach-iop13xx/pci.c
    36 +++ b/arch/arm/mach-iop13xx/pci.c
    37 @@ -1026,8 +1026,10 @@ int iop13xx_pci_setup(int nr, struct pci_sys_data *sys)
    38 which_atu = 0;
    39 }
    40
    41 - if (!which_atu)
    42 + if (!which_atu) {
    43 + kfree(res);
    44 return 0;
    45 + }
    46
    47 switch(which_atu) {
    48 case IOP13XX_INIT_ATU_ATUX:
    49 @@ -1074,6 +1076,7 @@ int iop13xx_pci_setup(int nr, struct pci_sys_data *sys)
    50 sys->map_irq = iop13xx_pcie_map_irq;
    51 break;
    52 default:
    53 + kfree(res);
    54 return 0;
    55 }
    56
    57 diff --git a/arch/arm/mach-omap2/mmc-twl4030.c b/arch/arm/mach-omap2/mmc-twl4030.c
    58 index 437f520..e1dadf7 100644
    59 --- a/arch/arm/mach-omap2/mmc-twl4030.c
    60 +++ b/arch/arm/mach-omap2/mmc-twl4030.c
    61 @@ -397,6 +397,7 @@ void __init twl4030_mmc_init(struct twl4030_hsmmc_info *controllers)
    62 break;
    63 default:
    64 pr_err("MMC%d configuration not supported!\n", c->mmc);
    65 + kfree(mmc);
    66 continue;
    67 }
    68 hsmmc_data[c->mmc - 1] = mmc;
    69 diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
    70 index d4d082c..5a89e57 100644
    71 --- a/arch/arm/mm/mmu.c
    72 +++ b/arch/arm/mm/mmu.c
    73 @@ -694,7 +694,7 @@ static void __init sanity_check_meminfo(void)
    74 * the vmalloc area.
    75 */
    76 if (__va(bank->start) >= VMALLOC_MIN ||
    77 - __va(bank->start) < PAGE_OFFSET) {
    78 + __va(bank->start) < (void *)PAGE_OFFSET) {
    79 printk(KERN_NOTICE "Ignoring RAM at %.8lx-%.8lx "
    80 "(vmalloc region overlap).\n",
    81 bank->start, bank->start + bank->size - 1);
    82 diff --git a/arch/sparc/include/asm/tlb_64.h b/arch/sparc/include/asm/tlb_64.h
    83 index ec81cde..0aaa086 100644
    84 --- a/arch/sparc/include/asm/tlb_64.h
    85 +++ b/arch/sparc/include/asm/tlb_64.h
    86 @@ -58,6 +58,8 @@ static inline struct mmu_gather *tlb_gather_mmu(struct mm_struct *mm, unsigned i
    87 static inline void tlb_flush_mmu(struct mmu_gather *mp)
    88 {
    89 if (mp->need_flush) {
    90 + if (!mp->fullmm)
    91 + flush_tlb_pending();
    92 free_pages_and_swap_cache(mp->pages, mp->pages_nr);
    93 mp->pages_nr = 0;
    94 mp->need_flush = 0;
    95 @@ -78,8 +80,6 @@ static inline void tlb_finish_mmu(struct mmu_gather *mp, unsigned long start, un
    96
    97 if (mp->fullmm)
    98 mp->fullmm = 0;
    99 - else
    100 - flush_tlb_pending();
    101
    102 /* keep the page table cache within bounds */
    103 check_pgt_cache();
    104 diff --git a/arch/sparc/kernel/nmi.c b/arch/sparc/kernel/nmi.c
    105 index f357722..2c0cc72 100644
    106 --- a/arch/sparc/kernel/nmi.c
    107 +++ b/arch/sparc/kernel/nmi.c
    108 @@ -13,6 +13,7 @@
    109 #include <linux/module.h>
    110 #include <linux/kprobes.h>
    111 #include <linux/kernel_stat.h>
    112 +#include <linux/reboot.h>
    113 #include <linux/slab.h>
    114 #include <linux/kdebug.h>
    115 #include <linux/delay.h>
    116 @@ -206,13 +207,33 @@ void nmi_adjust_hz(unsigned int new_hz)
    117 }
    118 EXPORT_SYMBOL_GPL(nmi_adjust_hz);
    119
    120 +static int nmi_shutdown(struct notifier_block *nb, unsigned long cmd, void *p)
    121 +{
    122 + on_each_cpu(stop_watchdog, NULL, 1);
    123 + return 0;
    124 +}
    125 +
    126 +static struct notifier_block nmi_reboot_notifier = {
    127 + .notifier_call = nmi_shutdown,
    128 +};
    129 +
    130 int __init nmi_init(void)
    131 {
    132 + int err;
    133 +
    134 nmi_usable = 1;
    135
    136 on_each_cpu(start_watchdog, NULL, 1);
    137
    138 - return check_nmi_watchdog();
    139 + err = check_nmi_watchdog();
    140 + if (!err) {
    141 + err = register_reboot_notifier(&nmi_reboot_notifier);
    142 + if (err) {
    143 + nmi_usable = 0;
    144 + on_each_cpu(stop_watchdog, NULL, 1);
    145 + }
    146 + }
    147 + return err;
    148 }
    149
    150 static int __init setup_nmi_watchdog(char *str)
    151 diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
    152 index 6cd1a5b..79457f6 100644
    153 --- a/arch/sparc/kernel/smp_64.c
    154 +++ b/arch/sparc/kernel/smp_64.c
    155 @@ -1031,7 +1031,7 @@ void smp_fetch_global_regs(void)
    156 * If the address space is non-shared (ie. mm->count == 1) we avoid
    157 * cross calls when we want to flush the currently running process's
    158 * tlb state. This is done by clearing all cpu bits except the current
    159 - * processor's in current->active_mm->cpu_vm_mask and performing the
    160 + * processor's in current->mm->cpu_vm_mask and performing the
    161 * flush locally only. This will force any subsequent cpus which run
    162 * this task to flush the context from the local tlb if the process
    163 * migrates to another cpu (again).
    164 @@ -1074,7 +1074,7 @@ void smp_flush_tlb_pending(struct mm_struct *mm, unsigned long nr, unsigned long
    165 u32 ctx = CTX_HWBITS(mm->context);
    166 int cpu = get_cpu();
    167
    168 - if (mm == current->active_mm && atomic_read(&mm->mm_users) == 1)
    169 + if (mm == current->mm && atomic_read(&mm->mm_users) == 1)
    170 mm->cpu_vm_mask = cpumask_of_cpu(cpu);
    171 else
    172 smp_cross_call_masked(&xcall_flush_tlb_pending,
    173 diff --git a/arch/x86/kernel/check.c b/arch/x86/kernel/check.c
    174 index 2ac0ab7..a7a50b2 100644
    175 --- a/arch/x86/kernel/check.c
    176 +++ b/arch/x86/kernel/check.c
    177 @@ -86,12 +86,12 @@ void __init setup_bios_corruption_check(void)
    178 if (addr == 0)
    179 break;
    180
    181 + if (addr >= corruption_check_size)
    182 + break;
    183 +
    184 if ((addr + size) > corruption_check_size)
    185 size = corruption_check_size - addr;
    186
    187 - if (size == 0)
    188 - break;
    189 -
    190 e820_update_range(addr, size, E820_RAM, E820_RESERVED);
    191 scan_areas[num_scan_areas].addr = addr;
    192 scan_areas[num_scan_areas].size = size;
    193 diff --git a/arch/x86/kernel/cpu/mtrr/generic.c b/arch/x86/kernel/cpu/mtrr/generic.c
    194 index 0c0a455..6f557e0 100644
    195 --- a/arch/x86/kernel/cpu/mtrr/generic.c
    196 +++ b/arch/x86/kernel/cpu/mtrr/generic.c
    197 @@ -41,6 +41,32 @@ static int __init mtrr_debug(char *opt)
    198 }
    199 early_param("mtrr.show", mtrr_debug);
    200
    201 +/**
    202 + * BIOS is expected to clear MtrrFixDramModEn bit, see for example
    203 + * "BIOS and Kernel Developer's Guide for the AMD Athlon 64 and AMD
    204 + * Opteron Processors" (26094 Rev. 3.30 February 2006), section
    205 + * "13.2.1.2 SYSCFG Register": "The MtrrFixDramModEn bit should be set
    206 + * to 1 during BIOS initalization of the fixed MTRRs, then cleared to
    207 + * 0 for operation."
    208 + */
    209 +static inline void k8_check_syscfg_dram_mod_en(void)
    210 +{
    211 + u32 lo, hi;
    212 +
    213 + if (!((boot_cpu_data.x86_vendor == X86_VENDOR_AMD) &&
    214 + (boot_cpu_data.x86 >= 0x0f)))
    215 + return;
    216 +
    217 + rdmsr(MSR_K8_SYSCFG, lo, hi);
    218 + if (lo & K8_MTRRFIXRANGE_DRAM_MODIFY) {
    219 + printk(KERN_ERR FW_WARN "MTRR: CPU %u: SYSCFG[MtrrFixDramModEn]"
    220 + " not cleared by BIOS, clearing this bit\n",
    221 + smp_processor_id());
    222 + lo &= ~K8_MTRRFIXRANGE_DRAM_MODIFY;
    223 + mtrr_wrmsr(MSR_K8_SYSCFG, lo, hi);
    224 + }
    225 +}
    226 +
    227 /*
    228 * Returns the effective MTRR type for the region
    229 * Error returns:
    230 @@ -174,6 +200,8 @@ get_fixed_ranges(mtrr_type * frs)
    231 unsigned int *p = (unsigned int *) frs;
    232 int i;
    233
    234 + k8_check_syscfg_dram_mod_en();
    235 +
    236 rdmsr(MTRRfix64K_00000_MSR, p[0], p[1]);
    237
    238 for (i = 0; i < 2; i++)
    239 @@ -308,27 +336,10 @@ void mtrr_wrmsr(unsigned msr, unsigned a, unsigned b)
    240 }
    241
    242 /**
    243 - * Enable and allow read/write of extended fixed-range MTRR bits on K8 CPUs
    244 - * see AMD publication no. 24593, chapter 3.2.1 for more information
    245 - */
    246 -static inline void k8_enable_fixed_iorrs(void)
    247 -{
    248 - unsigned lo, hi;
    249 -
    250 - rdmsr(MSR_K8_SYSCFG, lo, hi);
    251 - mtrr_wrmsr(MSR_K8_SYSCFG, lo
    252 - | K8_MTRRFIXRANGE_DRAM_ENABLE
    253 - | K8_MTRRFIXRANGE_DRAM_MODIFY, hi);
    254 -}
    255 -
    256 -/**
    257 * set_fixed_range - checks & updates a fixed-range MTRR if it differs from the value it should have
    258 * @msr: MSR address of the MTTR which should be checked and updated
    259 * @changed: pointer which indicates whether the MTRR needed to be changed
    260 * @msrwords: pointer to the MSR values which the MSR should have
    261 - *
    262 - * If K8 extentions are wanted, update the K8 SYSCFG MSR also.
    263 - * See AMD publication no. 24593, chapter 7.8.1, page 233 for more information.
    264 */
    265 static void set_fixed_range(int msr, bool *changed, unsigned int *msrwords)
    266 {
    267 @@ -337,10 +348,6 @@ static void set_fixed_range(int msr, bool *changed, unsigned int *msrwords)
    268 rdmsr(msr, lo, hi);
    269
    270 if (lo != msrwords[0] || hi != msrwords[1]) {
    271 - if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD &&
    272 - (boot_cpu_data.x86 >= 0x0f && boot_cpu_data.x86 <= 0x11) &&
    273 - ((msrwords[0] | msrwords[1]) & K8_MTRR_RDMEM_WRMEM_MASK))
    274 - k8_enable_fixed_iorrs();
    275 mtrr_wrmsr(msr, msrwords[0], msrwords[1]);
    276 *changed = true;
    277 }
    278 @@ -419,6 +426,8 @@ static int set_fixed_ranges(mtrr_type * frs)
    279 bool changed = false;
    280 int block=-1, range;
    281
    282 + k8_check_syscfg_dram_mod_en();
    283 +
    284 while (fixed_range_blocks[++block].ranges)
    285 for (range=0; range < fixed_range_blocks[block].ranges; range++)
    286 set_fixed_range(fixed_range_blocks[block].base_msr + range,
    287 diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
    288 index 06ca07f..f7d38d6 100644
    289 --- a/arch/x86/kernel/ptrace.c
    290 +++ b/arch/x86/kernel/ptrace.c
    291 @@ -690,9 +690,8 @@ static int ptrace_bts_config(struct task_struct *child,
    292 if (!cfg.signal)
    293 return -EINVAL;
    294
    295 - return -EOPNOTSUPP;
    296 -
    297 child->thread.bts_ovfl_signal = cfg.signal;
    298 + return -EOPNOTSUPP;
    299 }
    300
    301 if ((cfg.flags & PTRACE_BTS_O_ALLOC) &&
    302 diff --git a/arch/x86/kernel/tlb_uv.c b/arch/x86/kernel/tlb_uv.c
    303 index 6812b82..16e505a 100644
    304 --- a/arch/x86/kernel/tlb_uv.c
    305 +++ b/arch/x86/kernel/tlb_uv.c
    306 @@ -742,7 +742,7 @@ static int __init uv_bau_init(void)
    307 int node;
    308 int nblades;
    309 int last_blade;
    310 - int cur_cpu = 0;
    311 + int cur_cpu;
    312
    313 if (!is_uv_system())
    314 return 0;
    315 @@ -752,6 +752,7 @@ static int __init uv_bau_init(void)
    316 uv_mmask = (1UL << uv_hub_info->n_val) - 1;
    317 nblades = 0;
    318 last_blade = -1;
    319 + cur_cpu = 0;
    320 for_each_online_node(node) {
    321 blade = uv_node_to_blade_id(node);
    322 if (blade == last_blade)
    323 diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
    324 index 9fd78b6..c95a67d 100644
    325 --- a/arch/x86/kvm/paging_tmpl.h
    326 +++ b/arch/x86/kvm/paging_tmpl.h
    327 @@ -314,9 +314,9 @@ static int FNAME(shadow_walk_entry)(struct kvm_shadow_walk *_sw,
    328 return 0;
    329
    330 if (is_large_pte(*sptep)) {
    331 + rmap_remove(vcpu->kvm, sptep);
    332 set_shadow_pte(sptep, shadow_trap_nonpresent_pte);
    333 kvm_flush_remote_tlbs(vcpu->kvm);
    334 - rmap_remove(vcpu->kvm, sptep);
    335 }
    336
    337 if (level == PT_DIRECTORY_LEVEL && gw->level == PT_DIRECTORY_LEVEL) {
    338 diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
    339 index a9e769e..da56821 100644
    340 --- a/arch/x86/kvm/svm.c
    341 +++ b/arch/x86/kvm/svm.c
    342 @@ -760,20 +760,37 @@ static void svm_get_segment(struct kvm_vcpu *vcpu,
    343 var->db = (s->attrib >> SVM_SELECTOR_DB_SHIFT) & 1;
    344 var->g = (s->attrib >> SVM_SELECTOR_G_SHIFT) & 1;
    345
    346 - /*
    347 - * SVM always stores 0 for the 'G' bit in the CS selector in
    348 - * the VMCB on a VMEXIT. This hurts cross-vendor migration:
    349 - * Intel's VMENTRY has a check on the 'G' bit.
    350 - */
    351 - if (seg == VCPU_SREG_CS)
    352 + switch (seg) {
    353 + case VCPU_SREG_CS:
    354 + /*
    355 + * SVM always stores 0 for the 'G' bit in the CS selector in
    356 + * the VMCB on a VMEXIT. This hurts cross-vendor migration:
    357 + * Intel's VMENTRY has a check on the 'G' bit.
    358 + */
    359 var->g = s->limit > 0xfffff;
    360 -
    361 - /*
    362 - * Work around a bug where the busy flag in the tr selector
    363 - * isn't exposed
    364 - */
    365 - if (seg == VCPU_SREG_TR)
    366 + break;
    367 + case VCPU_SREG_TR:
    368 + /*
    369 + * Work around a bug where the busy flag in the tr selector
    370 + * isn't exposed
    371 + */
    372 var->type |= 0x2;
    373 + break;
    374 + case VCPU_SREG_DS:
    375 + case VCPU_SREG_ES:
    376 + case VCPU_SREG_FS:
    377 + case VCPU_SREG_GS:
    378 + /*
    379 + * The accessed bit must always be set in the segment
    380 + * descriptor cache, although it can be cleared in the
    381 + * descriptor, the cached bit always remains at 1. Since
    382 + * Intel has a check on this, set it here to support
    383 + * cross-vendor migration.
    384 + */
    385 + if (!var->unusable)
    386 + var->type |= 0x1;
    387 + break;
    388 + }
    389
    390 var->unusable = !var->present;
    391 }
    392 diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
    393 index 7611af5..90de444 100644
    394 --- a/arch/x86/kvm/vmx.c
    395 +++ b/arch/x86/kvm/vmx.c
    396 @@ -928,11 +928,11 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, u32 msr_index, u64 data)
    397 int ret = 0;
    398
    399 switch (msr_index) {
    400 -#ifdef CONFIG_X86_64
    401 case MSR_EFER:
    402 vmx_load_host_state(vmx);
    403 ret = kvm_set_msr_common(vcpu, msr_index, data);
    404 break;
    405 +#ifdef CONFIG_X86_64
    406 case MSR_FS_BASE:
    407 vmcs_writel(GUEST_FS_BASE, data);
    408 break;
    409 diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c
    410 index 960a8d9..4175cb4 100644
    411 --- a/arch/x86/lguest/boot.c
    412 +++ b/arch/x86/lguest/boot.c
    413 @@ -485,11 +485,17 @@ static void lguest_write_cr4(unsigned long val)
    414 * into a process' address space. We set the entry then tell the Host the
    415 * toplevel and address this corresponds to. The Guest uses one pagetable per
    416 * process, so we need to tell the Host which one we're changing (mm->pgd). */
    417 +static void lguest_pte_update(struct mm_struct *mm, unsigned long addr,
    418 + pte_t *ptep)
    419 +{
    420 + lazy_hcall(LHCALL_SET_PTE, __pa(mm->pgd), addr, ptep->pte_low);
    421 +}
    422 +
    423 static void lguest_set_pte_at(struct mm_struct *mm, unsigned long addr,
    424 pte_t *ptep, pte_t pteval)
    425 {
    426 *ptep = pteval;
    427 - lazy_hcall(LHCALL_SET_PTE, __pa(mm->pgd), addr, pteval.pte_low);
    428 + lguest_pte_update(mm, addr, ptep);
    429 }
    430
    431 /* The Guest calls this to set a top-level entry. Again, we set the entry then
    432 @@ -1034,6 +1040,8 @@ __init void lguest_init(void)
    433 pv_mmu_ops.read_cr3 = lguest_read_cr3;
    434 pv_mmu_ops.lazy_mode.enter = paravirt_enter_lazy_mmu;
    435 pv_mmu_ops.lazy_mode.leave = lguest_leave_lazy_mode;
    436 + pv_mmu_ops.pte_update = lguest_pte_update;
    437 + pv_mmu_ops.pte_update_defer = lguest_pte_update;
    438
    439 #ifdef CONFIG_X86_LOCAL_APIC
    440 /* apic read/write intercepts */
    441 diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
    442 index e0ab173..21bc1f7 100644
    443 --- a/arch/x86/mm/pat.c
    444 +++ b/arch/x86/mm/pat.c
    445 @@ -641,10 +641,11 @@ static int reserve_pfn_range(u64 paddr, unsigned long size, pgprot_t *vma_prot,
    446 is_ram = pat_pagerange_is_ram(paddr, paddr + size);
    447
    448 /*
    449 - * reserve_pfn_range() doesn't support RAM pages.
    450 + * reserve_pfn_range() doesn't support RAM pages. Maintain the current
    451 + * behavior with RAM pages by returning success.
    452 */
    453 if (is_ram != 0)
    454 - return -EINVAL;
    455 + return 0;
    456
    457 ret = reserve_memtype(paddr, paddr + size, want_flags, &flags);
    458 if (ret)
    459 diff --git a/arch/x86/pci/i386.c b/arch/x86/pci/i386.c
    460 index 5ead808..f234a37 100644
    461 --- a/arch/x86/pci/i386.c
    462 +++ b/arch/x86/pci/i386.c
    463 @@ -319,6 +319,9 @@ int pci_mmap_page_range(struct pci_dev *dev, struct vm_area_struct *vma,
    464 return -EINVAL;
    465 }
    466 flags = new_flags;
    467 + vma->vm_page_prot = __pgprot(
    468 + (pgprot_val(vma->vm_page_prot) & ~_PAGE_CACHE_MASK) |
    469 + flags);
    470 }
    471
    472 if (((vma->vm_pgoff < max_low_pfn_mapped) ||
    473 diff --git a/drivers/char/raw.c b/drivers/char/raw.c
    474 index 96adf28..20d90e6 100644
    475 --- a/drivers/char/raw.c
    476 +++ b/drivers/char/raw.c
    477 @@ -90,6 +90,7 @@ out1:
    478 blkdev_put(bdev, filp->f_mode);
    479 out:
    480 mutex_unlock(&raw_mutex);
    481 + unlock_kernel();
    482 return err;
    483 }
    484
    485 diff --git a/drivers/lguest/page_tables.c b/drivers/lguest/page_tables.c
    486 index 576a831..82ff484 100644
    487 --- a/drivers/lguest/page_tables.c
    488 +++ b/drivers/lguest/page_tables.c
    489 @@ -373,8 +373,10 @@ unsigned long guest_pa(struct lg_cpu *cpu, unsigned long vaddr)
    490 /* First step: get the top-level Guest page table entry. */
    491 gpgd = lgread(cpu, gpgd_addr(cpu, vaddr), pgd_t);
    492 /* Toplevel not present? We can't map it in. */
    493 - if (!(pgd_flags(gpgd) & _PAGE_PRESENT))
    494 + if (!(pgd_flags(gpgd) & _PAGE_PRESENT)) {
    495 kill_guest(cpu, "Bad address %#lx", vaddr);
    496 + return -1UL;
    497 + }
    498
    499 gpte = lgread(cpu, gpte_addr(gpgd, vaddr), pte_t);
    500 if (!(pte_flags(gpte) & _PAGE_PRESENT))
    501 diff --git a/drivers/media/dvb/firewire/firedtv-avc.c b/drivers/media/dvb/firewire/firedtv-avc.c
    502 index b55d9cc..adc2ce9 100644
    503 --- a/drivers/media/dvb/firewire/firedtv-avc.c
    504 +++ b/drivers/media/dvb/firewire/firedtv-avc.c
    505 @@ -135,6 +135,7 @@ static const char *debug_fcp_opcode(unsigned int opcode,
    506 case SFE_VENDOR_OPCODE_REGISTER_REMOTE_CONTROL: return "RegisterRC";
    507 case SFE_VENDOR_OPCODE_LNB_CONTROL: return "LNBControl";
    508 case SFE_VENDOR_OPCODE_TUNE_QPSK: return "TuneQPSK";
    509 + case SFE_VENDOR_OPCODE_TUNE_QPSK2: return "TuneQPSK2";
    510 case SFE_VENDOR_OPCODE_HOST2CA: return "Host2CA";
    511 case SFE_VENDOR_OPCODE_CA2HOST: return "CA2Host";
    512 }
    513 @@ -266,7 +267,10 @@ static void avc_tuner_tuneqpsk(struct firedtv *fdtv,
    514 c->operand[0] = SFE_VENDOR_DE_COMPANYID_0;
    515 c->operand[1] = SFE_VENDOR_DE_COMPANYID_1;
    516 c->operand[2] = SFE_VENDOR_DE_COMPANYID_2;
    517 - c->operand[3] = SFE_VENDOR_OPCODE_TUNE_QPSK;
    518 + if (fdtv->type == FIREDTV_DVB_S2)
    519 + c->operand[3] = SFE_VENDOR_OPCODE_TUNE_QPSK2;
    520 + else
    521 + c->operand[3] = SFE_VENDOR_OPCODE_TUNE_QPSK;
    522
    523 c->operand[4] = (params->frequency >> 24) & 0xff;
    524 c->operand[5] = (params->frequency >> 16) & 0xff;
    525 diff --git a/drivers/media/video/v4l2-common.c b/drivers/media/video/v4l2-common.c
    526 index b8f2be8..907cd02 100644
    527 --- a/drivers/media/video/v4l2-common.c
    528 +++ b/drivers/media/video/v4l2-common.c
    529 @@ -910,10 +910,10 @@ struct v4l2_subdev *v4l2_i2c_new_subdev(struct i2c_adapter *adapter,
    530 struct i2c_board_info info;
    531
    532 BUG_ON(!dev);
    533 -#ifdef MODULE
    534 +
    535 if (module_name)
    536 request_module(module_name);
    537 -#endif
    538 +
    539 /* Setup the i2c board info with the device type and
    540 the device address. */
    541 memset(&info, 0, sizeof(info));
    542 @@ -958,10 +958,10 @@ struct v4l2_subdev *v4l2_i2c_new_probed_subdev(struct i2c_adapter *adapter,
    543 struct i2c_board_info info;
    544
    545 BUG_ON(!dev);
    546 -#ifdef MODULE
    547 +
    548 if (module_name)
    549 request_module(module_name);
    550 -#endif
    551 +
    552 /* Setup the i2c board info with the device type and
    553 the device address. */
    554 memset(&info, 0, sizeof(info));
    555 diff --git a/drivers/net/dnet.c b/drivers/net/dnet.c
    556 index 1b40632..edf23c9 100644
    557 --- a/drivers/net/dnet.c
    558 +++ b/drivers/net/dnet.c
    559 @@ -9,6 +9,7 @@
    560 * published by the Free Software Foundation.
    561 */
    562 #include <linux/version.h>
    563 +#include <linux/io.h>
    564 #include <linux/module.h>
    565 #include <linux/moduleparam.h>
    566 #include <linux/kernel.h>
    567 diff --git a/drivers/net/wireless/ath5k/base.c b/drivers/net/wireless/ath5k/base.c
    568 index 1d77ee9..6cf69d3 100644
    569 --- a/drivers/net/wireless/ath5k/base.c
    570 +++ b/drivers/net/wireless/ath5k/base.c
    571 @@ -1090,8 +1090,18 @@ ath5k_mode_setup(struct ath5k_softc *sc)
    572 static inline int
    573 ath5k_hw_to_driver_rix(struct ath5k_softc *sc, int hw_rix)
    574 {
    575 - WARN_ON(hw_rix < 0 || hw_rix > AR5K_MAX_RATES);
    576 - return sc->rate_idx[sc->curband->band][hw_rix];
    577 + int rix;
    578 +
    579 + /* return base rate on errors */
    580 + if (WARN(hw_rix < 0 || hw_rix >= AR5K_MAX_RATES,
    581 + "hw_rix out of bounds: %x\n", hw_rix))
    582 + return 0;
    583 +
    584 + rix = sc->rate_idx[sc->curband->band][hw_rix];
    585 + if (WARN(rix < 0, "invalid hw_rix: %x\n", hw_rix))
    586 + rix = 0;
    587 +
    588 + return rix;
    589 }
    590
    591 /***************\
    592 @@ -1668,7 +1678,6 @@ ath5k_check_ibss_tsf(struct ath5k_softc *sc, struct sk_buff *skb,
    593 }
    594 }
    595
    596 -
    597 static void
    598 ath5k_tasklet_rx(unsigned long data)
    599 {
    600 @@ -2188,6 +2197,7 @@ static void
    601 ath5k_beacon_config(struct ath5k_softc *sc)
    602 {
    603 struct ath5k_hw *ah = sc->ah;
    604 + unsigned long flags;
    605
    606 ath5k_hw_set_imr(ah, 0);
    607 sc->bmisscount = 0;
    608 @@ -2211,9 +2221,9 @@ ath5k_beacon_config(struct ath5k_softc *sc)
    609
    610 if (sc->opmode == NL80211_IFTYPE_ADHOC) {
    611 if (ath5k_hw_hasveol(ah)) {
    612 - spin_lock(&sc->block);
    613 + spin_lock_irqsave(&sc->block, flags);
    614 ath5k_beacon_send(sc);
    615 - spin_unlock(&sc->block);
    616 + spin_unlock_irqrestore(&sc->block, flags);
    617 }
    618 } else
    619 ath5k_beacon_update_timers(sc, -1);
    620 @@ -2259,7 +2269,7 @@ ath5k_init(struct ath5k_softc *sc, bool is_resume)
    621 sc->curband = &sc->sbands[sc->curchan->band];
    622 sc->imask = AR5K_INT_RXOK | AR5K_INT_RXERR | AR5K_INT_RXEOL |
    623 AR5K_INT_RXORN | AR5K_INT_TXDESC | AR5K_INT_TXEOL |
    624 - AR5K_INT_FATAL | AR5K_INT_GLOBAL | AR5K_INT_MIB;
    625 + AR5K_INT_FATAL | AR5K_INT_GLOBAL;
    626 ret = ath5k_reset(sc, false, false);
    627 if (ret)
    628 goto done;
    629 diff --git a/drivers/net/wireless/ath5k/base.h b/drivers/net/wireless/ath5k/base.h
    630 index facc60d..d86ab39 100644
    631 --- a/drivers/net/wireless/ath5k/base.h
    632 +++ b/drivers/net/wireless/ath5k/base.h
    633 @@ -112,7 +112,7 @@ struct ath5k_softc {
    634 struct ieee80211_supported_band sbands[IEEE80211_NUM_BANDS];
    635 struct ieee80211_channel channels[ATH_CHAN_MAX];
    636 struct ieee80211_rate rates[IEEE80211_NUM_BANDS][AR5K_MAX_RATES];
    637 - u8 rate_idx[IEEE80211_NUM_BANDS][AR5K_MAX_RATES];
    638 + s8 rate_idx[IEEE80211_NUM_BANDS][AR5K_MAX_RATES];
    639 enum nl80211_iftype opmode;
    640 struct ath5k_hw *ah; /* Atheros HW */
    641
    642 diff --git a/drivers/net/wireless/ath9k/recv.c b/drivers/net/wireless/ath9k/recv.c
    643 index 462e08c..c114cb7 100644
    644 --- a/drivers/net/wireless/ath9k/recv.c
    645 +++ b/drivers/net/wireless/ath9k/recv.c
    646 @@ -322,8 +322,13 @@ void ath_rx_cleanup(struct ath_softc *sc)
    647
    648 list_for_each_entry(bf, &sc->rx.rxbuf, list) {
    649 skb = bf->bf_mpdu;
    650 - if (skb)
    651 + if (skb) {
    652 + pci_unmap_single(sc->pdev,
    653 + bf->bf_buf_addr,
    654 + sc->rx.bufsize,
    655 + DMA_FROM_DEVICE);
    656 dev_kfree_skb(skb);
    657 + }
    658 }
    659
    660 if (sc->rx.rxdma.dd_desc_len != 0)
    661 diff --git a/drivers/net/wireless/ath9k/xmit.c b/drivers/net/wireless/ath9k/xmit.c
    662 index c92f0c6..80af54e 100644
    663 --- a/drivers/net/wireless/ath9k/xmit.c
    664 +++ b/drivers/net/wireless/ath9k/xmit.c
    665 @@ -2035,7 +2035,7 @@ struct ath_txq *ath_test_get_txq(struct ath_softc *sc, struct sk_buff *skb)
    666
    667 /* Try to avoid running out of descriptors */
    668 if (txq->axq_depth >= (ATH_TXBUF - 20)) {
    669 - DPRINTF(sc, ATH_DBG_FATAL,
    670 + DPRINTF(sc, ATH_DBG_XMIT,
    671 "TX queue: %d is full, depth: %d\n",
    672 qnum, txq->axq_depth);
    673 ieee80211_stop_queue(sc->hw, skb_get_queue_mapping(skb));
    674 diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c
    675 index eae9b80..12069e5 100644
    676 --- a/drivers/net/wireless/b43/xmit.c
    677 +++ b/drivers/net/wireless/b43/xmit.c
    678 @@ -50,7 +50,7 @@ static int b43_plcp_get_bitrate_idx_cck(struct b43_plcp_hdr6 *plcp)
    679 }
    680
    681 /* Extract the bitrate index out of an OFDM PLCP header. */
    682 -static u8 b43_plcp_get_bitrate_idx_ofdm(struct b43_plcp_hdr6 *plcp, bool aphy)
    683 +static int b43_plcp_get_bitrate_idx_ofdm(struct b43_plcp_hdr6 *plcp, bool aphy)
    684 {
    685 int base = aphy ? 0 : 4;
    686
    687 diff --git a/drivers/scsi/arm/cumana_2.c b/drivers/scsi/arm/cumana_2.c
    688 index 68a6412..ed502b7 100644
    689 --- a/drivers/scsi/arm/cumana_2.c
    690 +++ b/drivers/scsi/arm/cumana_2.c
    691 @@ -318,7 +318,7 @@ cumanascsi_2_set_proc_info(struct Scsi_Host *host, char *buffer, int length)
    692 {
    693 int ret = length;
    694
    695 - if (length >= 11 && strcmp(buffer, "CUMANASCSI2") == 0) {
    696 + if (length >= 11 && strncmp(buffer, "CUMANASCSI2", 11) == 0) {
    697 buffer += 11;
    698 length -= 11;
    699
    700 diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
    701 index 49e7f56..3922fa9 100644
    702 --- a/drivers/usb/core/message.c
    703 +++ b/drivers/usb/core/message.c
    704 @@ -1719,7 +1719,8 @@ free_interfaces:
    705 }
    706 kfree(new_interfaces);
    707
    708 - if (cp->string == NULL)
    709 + if (cp->string == NULL &&
    710 + !(dev->quirks & USB_QUIRK_CONFIG_INTF_STRINGS))
    711 cp->string = usb_cache_string(dev, cp->desc.iConfiguration);
    712
    713 /* Now that all the interfaces are set up, register them
    714 diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
    715 index c070b34..ab93918 100644
    716 --- a/drivers/usb/core/quirks.c
    717 +++ b/drivers/usb/core/quirks.c
    718 @@ -54,6 +54,10 @@ static const struct usb_device_id usb_quirk_list[] = {
    719 { USB_DEVICE(0x0638, 0x0a13), .driver_info =
    720 USB_QUIRK_STRING_FETCH_255 },
    721
    722 + /* Saitek Cyborg Gold Joystick */
    723 + { USB_DEVICE(0x06a3, 0x0006), .driver_info =
    724 + USB_QUIRK_CONFIG_INTF_STRINGS },
    725 +
    726 /* M-Systems Flash Disk Pioneers */
    727 { USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME },
    728
    729 diff --git a/drivers/usb/core/sysfs.c b/drivers/usb/core/sysfs.c
    730 index 4cc2456..c667891 100644
    731 --- a/drivers/usb/core/sysfs.c
    732 +++ b/drivers/usb/core/sysfs.c
    733 @@ -13,6 +13,7 @@
    734 #include <linux/kernel.h>
    735 #include <linux/string.h>
    736 #include <linux/usb.h>
    737 +#include <linux/usb/quirks.h>
    738 #include "usb.h"
    739
    740 /* Active configuration fields */
    741 @@ -813,7 +814,8 @@ int usb_create_sysfs_intf_files(struct usb_interface *intf)
    742 if (intf->sysfs_files_created || intf->unregistering)
    743 return 0;
    744
    745 - if (alt->string == NULL)
    746 + if (alt->string == NULL &&
    747 + !(udev->quirks & USB_QUIRK_CONFIG_INTF_STRINGS))
    748 alt->string = usb_cache_string(udev, alt->desc.iInterface);
    749 if (alt->string)
    750 retval = device_create_file(&intf->dev, &dev_attr_interface);
    751 diff --git a/drivers/usb/gadget/f_rndis.c b/drivers/usb/gadget/f_rndis.c
    752 index 3a8bb53..fd7b356 100644
    753 --- a/drivers/usb/gadget/f_rndis.c
    754 +++ b/drivers/usb/gadget/f_rndis.c
    755 @@ -437,7 +437,7 @@ invalid:
    756 DBG(cdev, "rndis req%02x.%02x v%04x i%04x l%d\n",
    757 ctrl->bRequestType, ctrl->bRequest,
    758 w_value, w_index, w_length);
    759 - req->zero = 0;
    760 + req->zero = (value < w_length);
    761 req->length = value;
    762 value = usb_ep_queue(cdev->gadget->ep0, req, GFP_ATOMIC);
    763 if (value < 0)
    764 diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
    765 index ecc9b66..01132ac 100644
    766 --- a/drivers/usb/host/ehci-q.c
    767 +++ b/drivers/usb/host/ehci-q.c
    768 @@ -333,12 +333,40 @@ qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh)
    769 token = hc32_to_cpu(ehci, qtd->hw_token);
    770
    771 /* always clean up qtds the hc de-activated */
    772 + retry_xacterr:
    773 if ((token & QTD_STS_ACTIVE) == 0) {
    774
    775 /* on STALL, error, and short reads this urb must
    776 * complete and all its qtds must be recycled.
    777 */
    778 if ((token & QTD_STS_HALT) != 0) {
    779 +
    780 + /* retry transaction errors until we
    781 + * reach the software xacterr limit
    782 + */
    783 + if ((token & QTD_STS_XACT) &&
    784 + QTD_CERR(token) == 0 &&
    785 + --qh->xacterrs > 0 &&
    786 + !urb->unlinked) {
    787 + ehci_dbg(ehci,
    788 + "detected XactErr len %d/%d retry %d\n",
    789 + qtd->length - QTD_LENGTH(token), qtd->length,
    790 + QH_XACTERR_MAX - qh->xacterrs);
    791 +
    792 + /* reset the token in the qtd and the
    793 + * qh overlay (which still contains
    794 + * the qtd) so that we pick up from
    795 + * where we left off
    796 + */
    797 + token &= ~QTD_STS_HALT;
    798 + token |= QTD_STS_ACTIVE |
    799 + (EHCI_TUNE_CERR << 10);
    800 + qtd->hw_token = cpu_to_hc32(ehci,
    801 + token);
    802 + wmb();
    803 + qh->hw_token = cpu_to_hc32(ehci, token);
    804 + goto retry_xacterr;
    805 + }
    806 stopped = 1;
    807
    808 /* magic dummy for some short reads; qh won't advance.
    809 @@ -421,6 +449,9 @@ halt:
    810 /* remove qtd; it's recycled after possible urb completion */
    811 list_del (&qtd->qtd_list);
    812 last = qtd;
    813 +
    814 + /* reinit the xacterr counter for the next qtd */
    815 + qh->xacterrs = QH_XACTERR_MAX;
    816 }
    817
    818 /* last urb's completion might still need calling */
    819 @@ -862,6 +893,7 @@ static void qh_link_async (struct ehci_hcd *ehci, struct ehci_qh *qh)
    820 head->qh_next.qh = qh;
    821 head->hw_next = dma;
    822
    823 + qh->xacterrs = QH_XACTERR_MAX;
    824 qh->qh_state = QH_STATE_LINKED;
    825 /* qtd completions reported later by interrupt */
    826 }
    827 diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
    828 index 262b00c..c7385f2 100644
    829 --- a/drivers/usb/host/ehci.h
    830 +++ b/drivers/usb/host/ehci.h
    831 @@ -376,6 +376,9 @@ struct ehci_qh {
    832 #define QH_STATE_UNLINK_WAIT 4 /* LINKED and on reclaim q */
    833 #define QH_STATE_COMPLETING 5 /* don't touch token.HALT */
    834
    835 + u8 xacterrs; /* XactErr retry counter */
    836 +#define QH_XACTERR_MAX 32 /* XactErr retry limit */
    837 +
    838 /* periodic schedule info */
    839 u8 usecs; /* intr bandwidth */
    840 u8 gap_uf; /* uframes split/csplit gap */
    841 diff --git a/drivers/usb/storage/cypress_atacb.c b/drivers/usb/storage/cypress_atacb.c
    842 index 898e67d..9466a99 100644
    843 --- a/drivers/usb/storage/cypress_atacb.c
    844 +++ b/drivers/usb/storage/cypress_atacb.c
    845 @@ -133,19 +133,18 @@ void cypress_atacb_passthrough(struct scsi_cmnd *srb, struct us_data *us)
    846
    847 /* build the command for
    848 * reading the ATA registers */
    849 - scsi_eh_prep_cmnd(srb, &ses, NULL, 0, 0);
    850 - srb->sdb.length = sizeof(regs);
    851 - sg_init_one(&ses.sense_sgl, regs, srb->sdb.length);
    852 - srb->sdb.table.sgl = &ses.sense_sgl;
    853 - srb->sc_data_direction = DMA_FROM_DEVICE;
    854 - srb->sdb.table.nents = 1;
    855 + scsi_eh_prep_cmnd(srb, &ses, NULL, 0, sizeof(regs));
    856 +
    857 /* we use the same command as before, but we set
    858 * the read taskfile bit, for not executing atacb command,
    859 * but reading register selected in srb->cmnd[4]
    860 */
    861 + srb->cmd_len = 16;
    862 + srb->cmnd = ses.cmnd;
    863 srb->cmnd[2] = 1;
    864
    865 usb_stor_transparent_scsi_command(srb, us);
    866 + memcpy(regs, srb->sense_buffer, sizeof(regs));
    867 tmp_result = srb->result;
    868 scsi_eh_restore_cmnd(srb, &ses);
    869 /* we fail to get registers, report invalid command */
    870 @@ -162,8 +161,8 @@ void cypress_atacb_passthrough(struct scsi_cmnd *srb, struct us_data *us)
    871
    872 /* XXX we should generate sk, asc, ascq from status and error
    873 * regs
    874 - * (see 11.1 Error translation ­ ATA device error to SCSI error map)
    875 - * and ata_to_sense_error from libata.
    876 + * (see 11.1 Error translation ATA device error to SCSI error
    877 + * map, and ata_to_sense_error from libata.)
    878 */
    879
    880 /* Sense data is current and format is descriptor. */
    881 diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c
    882 index 727c506..ed710bc 100644
    883 --- a/drivers/usb/storage/scsiglue.c
    884 +++ b/drivers/usb/storage/scsiglue.c
    885 @@ -135,6 +135,12 @@ static int slave_configure(struct scsi_device *sdev)
    886 if (sdev->request_queue->max_sectors > max_sectors)
    887 blk_queue_max_sectors(sdev->request_queue,
    888 max_sectors);
    889 + } else if (sdev->type == TYPE_TAPE) {
    890 + /* Tapes need much higher max_sector limits, so just
    891 + * raise it to the maximum possible (4 GB / 512) and
    892 + * let the queue segment size sort out the real limit.
    893 + */
    894 + blk_queue_max_sectors(sdev->request_queue, 0x7FFFFF);
    895 }
    896
    897 /* Some USB host controllers can't do DMA; they have to use PIO.
    898 diff --git a/drivers/video/pxafb.c b/drivers/video/pxafb.c
    899 index 2552b9f..642c1d4 100644
    900 --- a/drivers/video/pxafb.c
    901 +++ b/drivers/video/pxafb.c
    902 @@ -883,10 +883,21 @@ static void __devinit init_pxafb_overlay(struct pxafb_info *fbi,
    903 init_completion(&ofb->branch_done);
    904 }
    905
    906 +static inline int pxafb_overlay_supported(void)
    907 +{
    908 + if (cpu_is_pxa27x() || cpu_is_pxa3xx())
    909 + return 1;
    910 +
    911 + return 0;
    912 +}
    913 +
    914 static int __devinit pxafb_overlay_init(struct pxafb_info *fbi)
    915 {
    916 int i, ret;
    917
    918 + if (!pxafb_overlay_supported())
    919 + return 0;
    920 +
    921 for (i = 0; i < 2; i++) {
    922 init_pxafb_overlay(fbi, &fbi->overlay[i], i);
    923 ret = register_framebuffer(&fbi->overlay[i].fb);
    924 @@ -909,6 +920,9 @@ static void __devexit pxafb_overlay_exit(struct pxafb_info *fbi)
    925 {
    926 int i;
    927
    928 + if (!pxafb_overlay_supported())
    929 + return;
    930 +
    931 for (i = 0; i < 2; i++)
    932 unregister_framebuffer(&fbi->overlay[i].fb);
    933 }
    934 diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
    935 index 851388f..6562eb0 100644
    936 --- a/fs/cifs/CHANGES
    937 +++ b/fs/cifs/CHANGES
    938 @@ -7,6 +7,9 @@ are authenticated as guest, as reconnections, invalidating the earlier
    939 user's smb session. This fix allows cifs to mount multiple times to the
    940 same server with different userids without risking invalidating earlier
    941 established security contexts.
    942 +Fix "redzone overwritten" bug in cifs_put_tcon (CIFSTcon may allocate too
    943 +little memory for the "nativeFileSystem" field returned by the server
    944 +during mount).
    945
    946 Version 1.56
    947 ------------
    948 diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
    949 index 939e2f7..71ae000 100644
    950 --- a/fs/cifs/cifssmb.c
    951 +++ b/fs/cifs/cifssmb.c
    952 @@ -2356,8 +2356,10 @@ winCreateHardLinkRetry:
    953 PATH_MAX, nls_codepage, remap);
    954 name_len++; /* trailing null */
    955 name_len *= 2;
    956 - pSMB->OldFileName[name_len] = 0; /* pad */
    957 - pSMB->OldFileName[name_len + 1] = 0x04;
    958 +
    959 + /* protocol specifies ASCII buffer format (0x04) for unicode */
    960 + pSMB->OldFileName[name_len] = 0x04;
    961 + pSMB->OldFileName[name_len + 1] = 0x00; /* pad */
    962 name_len2 =
    963 cifsConvertToUCS((__le16 *)&pSMB->OldFileName[name_len + 2],
    964 toName, PATH_MAX, nls_codepage, remap);
    965 diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
    966 index da0f4ff..4b64f39 100644
    967 --- a/fs/cifs/connect.c
    968 +++ b/fs/cifs/connect.c
    969 @@ -3667,7 +3667,7 @@ CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
    970 BCC(smb_buffer_response)) {
    971 kfree(tcon->nativeFileSystem);
    972 tcon->nativeFileSystem =
    973 - kzalloc(length + 2, GFP_KERNEL);
    974 + kzalloc(2*(length + 1), GFP_KERNEL);
    975 if (tcon->nativeFileSystem)
    976 cifs_strfromUCS_le(
    977 tcon->nativeFileSystem,
    978 diff --git a/fs/fuse/file.c b/fs/fuse/file.c
    979 index d9fdb7c..821d10f 100644
    980 --- a/fs/fuse/file.c
    981 +++ b/fs/fuse/file.c
    982 @@ -1465,7 +1465,7 @@ static loff_t fuse_file_llseek(struct file *file, loff_t offset, int origin)
    983 case SEEK_END:
    984 retval = fuse_update_attributes(inode, NULL, file, NULL);
    985 if (retval)
    986 - return retval;
    987 + goto exit;
    988 offset += i_size_read(inode);
    989 break;
    990 case SEEK_CUR:
    991 @@ -1479,6 +1479,7 @@ static loff_t fuse_file_llseek(struct file *file, loff_t offset, int origin)
    992 }
    993 retval = offset;
    994 }
    995 +exit:
    996 mutex_unlock(&inode->i_mutex);
    997 return retval;
    998 }
    999 diff --git a/include/linux/mm.h b/include/linux/mm.h
    1000 index 065cdf8..3daa05f 100644
    1001 --- a/include/linux/mm.h
    1002 +++ b/include/linux/mm.h
    1003 @@ -98,7 +98,7 @@ extern unsigned int kobjsize(const void *objp);
    1004 #define VM_HUGETLB 0x00400000 /* Huge TLB Page VM */
    1005 #define VM_NONLINEAR 0x00800000 /* Is non-linear (remap_file_pages) */
    1006 #define VM_MAPPED_COPY 0x01000000 /* T if mapped copy of data (nommu mmap) */
    1007 -#define VM_INSERTPAGE 0x02000000 /* The vma has had "vm_insert_page()" done on it */
    1008 +#define VM_INSERTPAGE 0x02000000 /* The vma has had "vm_insert_page()" done on it. Refer note in VM_PFNMAP_AT_MMAP below */
    1009 #define VM_ALWAYSDUMP 0x04000000 /* Always include in core dumps */
    1010
    1011 #define VM_CAN_NONLINEAR 0x08000000 /* Has ->fault & does nonlinear pages */
    1012 @@ -127,6 +127,17 @@ extern unsigned int kobjsize(const void *objp);
    1013 #define VM_SPECIAL (VM_IO | VM_DONTEXPAND | VM_RESERVED | VM_PFNMAP)
    1014
    1015 /*
    1016 + * pfnmap vmas that are fully mapped at mmap time (not mapped on fault).
    1017 + * Used by x86 PAT to identify such PFNMAP mappings and optimize their handling.
    1018 + * Note VM_INSERTPAGE flag is overloaded here. i.e,
    1019 + * VM_INSERTPAGE && !VM_PFNMAP implies
    1020 + * The vma has had "vm_insert_page()" done on it
    1021 + * VM_INSERTPAGE && VM_PFNMAP implies
    1022 + * The vma is PFNMAP with full mapping at mmap time
    1023 + */
    1024 +#define VM_PFNMAP_AT_MMAP (VM_INSERTPAGE | VM_PFNMAP)
    1025 +
    1026 +/*
    1027 * mapping from the currently active vm_flags protection bits (the
    1028 * low four bits) to a page protection mask..
    1029 */
    1030 @@ -145,7 +156,7 @@ extern pgprot_t protection_map[16];
    1031 */
    1032 static inline int is_linear_pfn_mapping(struct vm_area_struct *vma)
    1033 {
    1034 - return ((vma->vm_flags & VM_PFNMAP) && vma->vm_pgoff);
    1035 + return ((vma->vm_flags & VM_PFNMAP_AT_MMAP) == VM_PFNMAP_AT_MMAP);
    1036 }
    1037
    1038 static inline int is_pfn_mapping(struct vm_area_struct *vma)
    1039 diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h
    1040 index 7f6c603..2526f3b 100644
    1041 --- a/include/linux/usb/quirks.h
    1042 +++ b/include/linux/usb/quirks.h
    1043 @@ -16,4 +16,7 @@
    1044 /* device can't handle Set-Interface requests */
    1045 #define USB_QUIRK_NO_SET_INTF 0x00000004
    1046
    1047 +/* device can't handle its Configuration or Interface strings */
    1048 +#define USB_QUIRK_CONFIG_INTF_STRINGS 0x00000008
    1049 +
    1050 #endif /* __LINUX_USB_QUIRKS_H */
    1051 diff --git a/mm/memory.c b/mm/memory.c
    1052 index baa999e..d7df5ba 100644
    1053 --- a/mm/memory.c
    1054 +++ b/mm/memory.c
    1055 @@ -1665,9 +1665,10 @@ int remap_pfn_range(struct vm_area_struct *vma, unsigned long addr,
    1056 * behaviour that some programs depend on. We mark the "original"
    1057 * un-COW'ed pages by matching them up with "vma->vm_pgoff".
    1058 */
    1059 - if (addr == vma->vm_start && end == vma->vm_end)
    1060 + if (addr == vma->vm_start && end == vma->vm_end) {
    1061 vma->vm_pgoff = pfn;
    1062 - else if (is_cow_mapping(vma->vm_flags))
    1063 + vma->vm_flags |= VM_PFNMAP_AT_MMAP;
    1064 + } else if (is_cow_mapping(vma->vm_flags))
    1065 return -EINVAL;
    1066
    1067 vma->vm_flags |= VM_IO | VM_RESERVED | VM_PFNMAP;
    1068 @@ -1679,6 +1680,7 @@ int remap_pfn_range(struct vm_area_struct *vma, unsigned long addr,
    1069 * needed from higher level routine calling unmap_vmas
    1070 */
    1071 vma->vm_flags &= ~(VM_IO | VM_RESERVED | VM_PFNMAP);
    1072 + vma->vm_flags &= ~VM_PFNMAP_AT_MMAP;
    1073 return -EINVAL;
    1074 }
    1075
    1076 diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
    1077 index 727c5c5..8a96672 100644
    1078 --- a/net/bridge/br_if.c
    1079 +++ b/net/bridge/br_if.c
    1080 @@ -426,7 +426,6 @@ err2:
    1081 err1:
    1082 kobject_del(&p->kobj);
    1083 err0:
    1084 - kobject_put(&p->kobj);
    1085 dev_set_promiscuity(dev, -1);
    1086 put_back:
    1087 dev_put(dev);
    1088 diff --git a/net/core/dev.c b/net/core/dev.c
    1089 index e3fe5c7..e438f54 100644
    1090 --- a/net/core/dev.c
    1091 +++ b/net/core/dev.c
    1092 @@ -2588,18 +2588,15 @@ static int process_backlog(struct napi_struct *napi, int quota)
    1093 local_irq_disable();
    1094 skb = __skb_dequeue(&queue->input_pkt_queue);
    1095 if (!skb) {
    1096 + __napi_complete(napi);
    1097 local_irq_enable();
    1098 - napi_complete(napi);
    1099 - goto out;
    1100 + break;
    1101 }
    1102 local_irq_enable();
    1103
    1104 - napi_gro_receive(napi, skb);
    1105 + netif_receive_skb(skb);
    1106 } while (++work < quota && jiffies == start_time);
    1107
    1108 - napi_gro_flush(napi);
    1109 -
    1110 -out:
    1111 return work;
    1112 }
    1113
    1114 diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
    1115 index c47c989..c8bee18 100644
    1116 --- a/net/ipv4/udp.c
    1117 +++ b/net/ipv4/udp.c
    1118 @@ -1614,7 +1614,8 @@ static struct sock *udp_get_next(struct seq_file *seq, struct sock *sk)
    1119 } while (sk && (!net_eq(sock_net(sk), net) || sk->sk_family != state->family));
    1120
    1121 if (!sk) {
    1122 - spin_unlock_bh(&state->udp_table->hash[state->bucket].lock);
    1123 + if (state->bucket < UDP_HTABLE_SIZE)
    1124 + spin_unlock_bh(&state->udp_table->hash[state->bucket].lock);
    1125 return udp_get_first(seq, state->bucket + 1);
    1126 }
    1127 return sk;
    1128 @@ -1632,6 +1633,9 @@ static struct sock *udp_get_idx(struct seq_file *seq, loff_t pos)
    1129
    1130 static void *udp_seq_start(struct seq_file *seq, loff_t *pos)
    1131 {
    1132 + struct udp_iter_state *state = seq->private;
    1133 + state->bucket = UDP_HTABLE_SIZE;
    1134 +
    1135 return *pos ? udp_get_idx(seq, *pos-1) : SEQ_START_TOKEN;
    1136 }
    1137
    1138 diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
    1139 index f171e8d..8f04bd9 100644
    1140 --- a/net/ipv6/ip6_input.c
    1141 +++ b/net/ipv6/ip6_input.c
    1142 @@ -75,8 +75,7 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
    1143 if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL ||
    1144 !idev || unlikely(idev->cnf.disable_ipv6)) {
    1145 IP6_INC_STATS_BH(net, idev, IPSTATS_MIB_INDISCARDS);
    1146 - rcu_read_unlock();
    1147 - goto out;
    1148 + goto drop;
    1149 }
    1150
    1151 memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
    1152 @@ -147,7 +146,6 @@ err:
    1153 drop:
    1154 rcu_read_unlock();
    1155 kfree_skb(skb);
    1156 -out:
    1157 return 0;
    1158 }
    1159
    1160 diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
    1161 index f3fd154..56ac4ee 100644
    1162 --- a/net/netfilter/nf_conntrack_proto_tcp.c
    1163 +++ b/net/netfilter/nf_conntrack_proto_tcp.c
    1164 @@ -15,6 +15,7 @@
    1165 #include <linux/skbuff.h>
    1166 #include <linux/ipv6.h>
    1167 #include <net/ip6_checksum.h>
    1168 +#include <asm/unaligned.h>
    1169
    1170 #include <net/tcp.h>
    1171
    1172 @@ -466,7 +467,7 @@ static void tcp_sack(const struct sk_buff *skb, unsigned int dataoff,
    1173 for (i = 0;
    1174 i < (opsize - TCPOLEN_SACK_BASE);
    1175 i += TCPOLEN_SACK_PERBLOCK) {
    1176 - tmp = ntohl(*((__be32 *)(ptr+i)+1));
    1177 + tmp = get_unaligned_be32((__be32 *)(ptr+i)+1);
    1178
    1179 if (after(tmp, *sack))
    1180 *sack = tmp;
    1181 diff --git a/net/wireless/reg.c b/net/wireless/reg.c
    1182 index bd0a16c..4f9ff2a 100644
    1183 --- a/net/wireless/reg.c
    1184 +++ b/net/wireless/reg.c
    1185 @@ -1083,6 +1083,8 @@ EXPORT_SYMBOL(regulatory_hint);
    1186 static bool reg_same_country_ie_hint(struct wiphy *wiphy,
    1187 u32 country_ie_checksum)
    1188 {
    1189 + if (unlikely(last_request->initiator != REGDOM_SET_BY_COUNTRY_IE))
    1190 + return false;
    1191 if (!last_request->wiphy)
    1192 return false;
    1193 if (likely(last_request->wiphy != wiphy))
    1194 @@ -1133,7 +1135,9 @@ void regulatory_hint_11d(struct wiphy *wiphy,
    1195 /* We will run this for *every* beacon processed for the BSSID, so
    1196 * we optimize an early check to exit out early if we don't have to
    1197 * do anything */
    1198 - if (likely(last_request->wiphy)) {
    1199 + if (likely(last_request->initiator ==
    1200 + REGDOM_SET_BY_COUNTRY_IE &&
    1201 + likely(last_request->wiphy))) {
    1202 struct cfg80211_registered_device *drv_last_ie;
    1203
    1204 drv_last_ie = wiphy_to_dev(last_request->wiphy);
    1205 @@ -1469,13 +1473,20 @@ int regulatory_init(void)
    1206
    1207 printk(KERN_INFO "cfg80211: Using static regulatory domain info\n");
    1208 print_regdomain_info(cfg80211_regdomain);
    1209 - /* The old code still requests for a new regdomain and if
    1210 + /*
    1211 + * The old code still requests for a new regdomain and if
    1212 * you have CRDA you get it updated, otherwise you get
    1213 * stuck with the static values. We ignore "EU" code as
    1214 - * that is not a valid ISO / IEC 3166 alpha2 */
    1215 - if (ieee80211_regdom[0] != 'E' || ieee80211_regdom[1] != 'U')
    1216 - err = __regulatory_hint(NULL, REGDOM_SET_BY_CORE,
    1217 - ieee80211_regdom, 0, ENVIRON_ANY);
    1218 + * that is not a valid ISO / IEC 3166 alpha2
    1219 + * stuck with the static values. Since "EU" is not a valid
    1220 + * ISO / IEC 3166 alpha2 code we can't expect userpace to
    1221 + * give us a regulatory domain for it. We need last_request
    1222 + * iniitalized though so lets just send a request which we
    1223 + * know will be ignored... this crap will be removed once
    1224 + * OLD_REG dies.
    1225 + */
    1226 + err = __regulatory_hint(NULL, REGDOM_SET_BY_CORE,
    1227 + ieee80211_regdom, 0, ENVIRON_ANY);
    1228 #else
    1229 cfg80211_regdomain = cfg80211_world_regdom;
    1230
    1231 diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
    1232 index 62a5425..8227172 100644
    1233 --- a/net/xfrm/xfrm_state.c
    1234 +++ b/net/xfrm/xfrm_state.c
    1235 @@ -1615,7 +1615,7 @@ void xfrm_state_walk_done(struct xfrm_state_walk *walk)
    1236
    1237 spin_lock_bh(&xfrm_state_lock);
    1238 list_del(&walk->all);
    1239 - spin_lock_bh(&xfrm_state_lock);
    1240 + spin_unlock_bh(&xfrm_state_lock);
    1241 }
    1242 EXPORT_SYMBOL(xfrm_state_walk_done);
    1243