From 3e13627b7d931efd34c2e12c4e96cf85effda337 Mon Sep 17 00:00:00 2001 From: "Anthony G. Basile" Date: Mon, 9 Jul 2012 21:35:39 -0400 Subject: Add linux patch for 3.2.21 -> 3.2.22 --- 3.2.22/0000_README | 4 + 3.2.22/1021_linux-3.2.22.patch | 1245 +++++++++++++++++++++++ 3.2.22/4450_grsec-kconfig-default-gids.patch | 12 +- 3.2.22/4465_selinux-avc_audit-log-curr_ip.patch | 2 +- 3.4.4/4450_grsec-kconfig-default-gids.patch | 2 +- 5 files changed, 1257 insertions(+), 8 deletions(-) create mode 100644 3.2.22/1021_linux-3.2.22.patch diff --git a/3.2.22/0000_README b/3.2.22/0000_README index ccfefdd..7a8a57c 100644 --- a/3.2.22/0000_README +++ b/3.2.22/0000_README @@ -2,6 +2,10 @@ README ----------------------------------------------------------------------------- Individual Patch Descriptions: ----------------------------------------------------------------------------- +Patch: 1021_linux-3.2.22.patch +From: http://www.kernel.org +Desc: Linux 3.2.22 + Patch: 4420_grsecurity-2.9.1-3.2.22-201207080924.patch From: http://www.grsecurity.net Desc: hardened-sources base patch from upstream grsecurity diff --git a/3.2.22/1021_linux-3.2.22.patch b/3.2.22/1021_linux-3.2.22.patch new file mode 100644 index 0000000..e6ad93a --- /dev/null +++ b/3.2.22/1021_linux-3.2.22.patch @@ -0,0 +1,1245 @@ +diff --git a/Documentation/stable_kernel_rules.txt b/Documentation/stable_kernel_rules.txt +index 21fd05c..e1f856b 100644 +--- a/Documentation/stable_kernel_rules.txt ++++ b/Documentation/stable_kernel_rules.txt +@@ -12,6 +12,12 @@ Rules on what kind of patches are accepted, and which ones are not, into the + marked CONFIG_BROKEN), an oops, a hang, data corruption, a real + security issue, or some "oh, that's not good" issue. In short, something + critical. ++ - Serious issues as reported by a user of a distribution kernel may also ++ be considered if they fix a notable performance or interactivity issue. ++ As these fixes are not as obvious and have a higher risk of a subtle ++ regression they should only be submitted by a distribution kernel ++ maintainer and include an addendum linking to a bugzilla entry if it ++ exists and additional information on the user-visible impact. + - New device IDs and quirks are also accepted. + - No "theoretical race condition" issues, unless an explanation of how the + race can be exploited is also provided. +diff --git a/Makefile b/Makefile +index 7eb465e..9a7d921 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 2 +-SUBLEVEL = 21 ++SUBLEVEL = 22 + EXTRAVERSION = + NAME = Saber-toothed Squirrel + +diff --git a/arch/arm/plat-samsung/include/plat/map-s3c.h b/arch/arm/plat-samsung/include/plat/map-s3c.h +index 7d04875..c0c70a8 100644 +--- a/arch/arm/plat-samsung/include/plat/map-s3c.h ++++ b/arch/arm/plat-samsung/include/plat/map-s3c.h +@@ -22,7 +22,7 @@ + #define S3C24XX_VA_WATCHDOG S3C_VA_WATCHDOG + + #define S3C2412_VA_SSMC S3C_ADDR_CPU(0x00000000) +-#define S3C2412_VA_EBI S3C_ADDR_CPU(0x00010000) ++#define S3C2412_VA_EBI S3C_ADDR_CPU(0x00100000) + + #define S3C2410_PA_UART (0x50000000) + #define S3C24XX_PA_UART S3C2410_PA_UART +diff --git a/arch/arm/plat-samsung/include/plat/watchdog-reset.h b/arch/arm/plat-samsung/include/plat/watchdog-reset.h +index 40dbb2b..11b19ea 100644 +--- a/arch/arm/plat-samsung/include/plat/watchdog-reset.h ++++ b/arch/arm/plat-samsung/include/plat/watchdog-reset.h +@@ -24,7 +24,7 @@ static inline void arch_wdt_reset(void) + + __raw_writel(0, S3C2410_WTCON); /* disable watchdog, to be safe */ + +- if (s3c2410_wdtclk) ++ if (!IS_ERR(s3c2410_wdtclk)) + clk_enable(s3c2410_wdtclk); + + /* put initial values into count and data */ +diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h +index f3444f7..0c3b775 100644 +--- a/arch/x86/include/asm/cpufeature.h ++++ b/arch/x86/include/asm/cpufeature.h +@@ -175,7 +175,7 @@ + #define X86_FEATURE_XSAVEOPT (7*32+ 4) /* Optimized Xsave */ + #define X86_FEATURE_PLN (7*32+ 5) /* Intel Power Limit Notification */ + #define X86_FEATURE_PTS (7*32+ 6) /* Intel Package Thermal Status */ +-#define X86_FEATURE_DTS (7*32+ 7) /* Digital Thermal Sensor */ ++#define X86_FEATURE_DTHERM (7*32+ 7) /* Digital Thermal Sensor */ + + /* Virtualization flags: Linux defined, word 8 */ + #define X86_FEATURE_TPR_SHADOW (8*32+ 0) /* Intel TPR Shadow */ +diff --git a/arch/x86/include/asm/pgtable-3level.h b/arch/x86/include/asm/pgtable-3level.h +index effff47..cb00ccc 100644 +--- a/arch/x86/include/asm/pgtable-3level.h ++++ b/arch/x86/include/asm/pgtable-3level.h +@@ -31,6 +31,60 @@ static inline void native_set_pte(pte_t *ptep, pte_t pte) + ptep->pte_low = pte.pte_low; + } + ++#define pmd_read_atomic pmd_read_atomic ++/* ++ * pte_offset_map_lock on 32bit PAE kernels was reading the pmd_t with ++ * a "*pmdp" dereference done by gcc. Problem is, in certain places ++ * where pte_offset_map_lock is called, concurrent page faults are ++ * allowed, if the mmap_sem is hold for reading. An example is mincore ++ * vs page faults vs MADV_DONTNEED. On the page fault side ++ * pmd_populate rightfully does a set_64bit, but if we're reading the ++ * pmd_t with a "*pmdp" on the mincore side, a SMP race can happen ++ * because gcc will not read the 64bit of the pmd atomically. To fix ++ * this all places running pmd_offset_map_lock() while holding the ++ * mmap_sem in read mode, shall read the pmdp pointer using this ++ * function to know if the pmd is null nor not, and in turn to know if ++ * they can run pmd_offset_map_lock or pmd_trans_huge or other pmd ++ * operations. ++ * ++ * Without THP if the mmap_sem is hold for reading, the pmd can only ++ * transition from null to not null while pmd_read_atomic runs. So ++ * we can always return atomic pmd values with this function. ++ * ++ * With THP if the mmap_sem is hold for reading, the pmd can become ++ * trans_huge or none or point to a pte (and in turn become "stable") ++ * at any time under pmd_read_atomic. We could read it really ++ * atomically here with a atomic64_read for the THP enabled case (and ++ * it would be a whole lot simpler), but to avoid using cmpxchg8b we ++ * only return an atomic pmdval if the low part of the pmdval is later ++ * found stable (i.e. pointing to a pte). And we're returning a none ++ * pmdval if the low part of the pmd is none. In some cases the high ++ * and low part of the pmdval returned may not be consistent if THP is ++ * enabled (the low part may point to previously mapped hugepage, ++ * while the high part may point to a more recently mapped hugepage), ++ * but pmd_none_or_trans_huge_or_clear_bad() only needs the low part ++ * of the pmd to be read atomically to decide if the pmd is unstable ++ * or not, with the only exception of when the low part of the pmd is ++ * zero in which case we return a none pmd. ++ */ ++static inline pmd_t pmd_read_atomic(pmd_t *pmdp) ++{ ++ pmdval_t ret; ++ u32 *tmp = (u32 *)pmdp; ++ ++ ret = (pmdval_t) (*tmp); ++ if (ret) { ++ /* ++ * If the low part is null, we must not read the high part ++ * or we can end up with a partial pmd. ++ */ ++ smp_rmb(); ++ ret |= ((pmdval_t)*(tmp + 1)) << 32; ++ } ++ ++ return (pmd_t) { ret }; ++} ++ + static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte) + { + set_64bit((unsigned long long *)(ptep), native_pte_val(pte)); +diff --git a/arch/x86/kernel/cpu/scattered.c b/arch/x86/kernel/cpu/scattered.c +index c7f64e6..ea6106c 100644 +--- a/arch/x86/kernel/cpu/scattered.c ++++ b/arch/x86/kernel/cpu/scattered.c +@@ -31,7 +31,7 @@ void __cpuinit init_scattered_cpuid_features(struct cpuinfo_x86 *c) + const struct cpuid_bit *cb; + + static const struct cpuid_bit __cpuinitconst cpuid_bits[] = { +- { X86_FEATURE_DTS, CR_EAX, 0, 0x00000006, 0 }, ++ { X86_FEATURE_DTHERM, CR_EAX, 0, 0x00000006, 0 }, + { X86_FEATURE_IDA, CR_EAX, 1, 0x00000006, 0 }, + { X86_FEATURE_ARAT, CR_EAX, 2, 0x00000006, 0 }, + { X86_FEATURE_PLN, CR_EAX, 4, 0x00000006, 0 }, +diff --git a/drivers/acpi/acpi_pad.c b/drivers/acpi/acpi_pad.c +index a43fa1a..1502c502 100644 +--- a/drivers/acpi/acpi_pad.c ++++ b/drivers/acpi/acpi_pad.c +@@ -36,6 +36,7 @@ + #define ACPI_PROCESSOR_AGGREGATOR_DEVICE_NAME "Processor Aggregator" + #define ACPI_PROCESSOR_AGGREGATOR_NOTIFY 0x80 + static DEFINE_MUTEX(isolated_cpus_lock); ++static DEFINE_MUTEX(round_robin_lock); + + static unsigned long power_saving_mwait_eax; + +@@ -107,7 +108,7 @@ static void round_robin_cpu(unsigned int tsk_index) + if (!alloc_cpumask_var(&tmp, GFP_KERNEL)) + return; + +- mutex_lock(&isolated_cpus_lock); ++ mutex_lock(&round_robin_lock); + cpumask_clear(tmp); + for_each_cpu(cpu, pad_busy_cpus) + cpumask_or(tmp, tmp, topology_thread_cpumask(cpu)); +@@ -116,7 +117,7 @@ static void round_robin_cpu(unsigned int tsk_index) + if (cpumask_empty(tmp)) + cpumask_andnot(tmp, cpu_online_mask, pad_busy_cpus); + if (cpumask_empty(tmp)) { +- mutex_unlock(&isolated_cpus_lock); ++ mutex_unlock(&round_robin_lock); + return; + } + for_each_cpu(cpu, tmp) { +@@ -131,7 +132,7 @@ static void round_robin_cpu(unsigned int tsk_index) + tsk_in_cpu[tsk_index] = preferred_cpu; + cpumask_set_cpu(preferred_cpu, pad_busy_cpus); + cpu_weight[preferred_cpu]++; +- mutex_unlock(&isolated_cpus_lock); ++ mutex_unlock(&round_robin_lock); + + set_cpus_allowed_ptr(current, cpumask_of(preferred_cpu)); + } +diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c +index c3d2dfc..b96544a 100644 +--- a/drivers/base/power/main.c ++++ b/drivers/base/power/main.c +@@ -869,7 +869,7 @@ static int __device_suspend(struct device *dev, pm_message_t state, bool async) + dpm_wait_for_children(dev, async); + + if (async_error) +- return 0; ++ goto Complete; + + pm_runtime_get_noresume(dev); + if (pm_runtime_barrier(dev) && device_may_wakeup(dev)) +@@ -878,7 +878,7 @@ static int __device_suspend(struct device *dev, pm_message_t state, bool async) + if (pm_wakeup_pending()) { + pm_runtime_put_sync(dev); + async_error = -EBUSY; +- return 0; ++ goto Complete; + } + + device_lock(dev); +@@ -926,6 +926,8 @@ static int __device_suspend(struct device *dev, pm_message_t state, bool async) + } + + device_unlock(dev); ++ ++ Complete: + complete_all(&dev->power.completion); + + if (error) { +diff --git a/drivers/char/hw_random/atmel-rng.c b/drivers/char/hw_random/atmel-rng.c +index 0477982..1b5675b 100644 +--- a/drivers/char/hw_random/atmel-rng.c ++++ b/drivers/char/hw_random/atmel-rng.c +@@ -34,7 +34,7 @@ static int atmel_trng_read(struct hwrng *rng, void *buf, size_t max, + u32 *data = buf; + + /* data ready? */ +- if (readl(trng->base + TRNG_ODATA) & 1) { ++ if (readl(trng->base + TRNG_ISR) & 1) { + *data = readl(trng->base + TRNG_ODATA); + /* + ensure data ready is only set again AFTER the next data +diff --git a/drivers/edac/i7core_edac.c b/drivers/edac/i7core_edac.c +index 70ad892..b3ccefa 100644 +--- a/drivers/edac/i7core_edac.c ++++ b/drivers/edac/i7core_edac.c +@@ -1932,12 +1932,6 @@ static int i7core_mce_check_error(struct notifier_block *nb, unsigned long val, + if (mce->bank != 8) + return NOTIFY_DONE; + +-#ifdef CONFIG_SMP +- /* Only handle if it is the right mc controller */ +- if (mce->socketid != pvt->i7core_dev->socket) +- return NOTIFY_DONE; +-#endif +- + smp_rmb(); + if ((pvt->mce_out + 1) % MCE_LOG_LEN == pvt->mce_in) { + smp_wmb(); +@@ -2234,8 +2228,6 @@ static void i7core_unregister_mci(struct i7core_dev *i7core_dev) + if (pvt->enable_scrub) + disable_sdram_scrub_setting(mci); + +- atomic_notifier_chain_unregister(&x86_mce_decoder_chain, &i7_mce_dec); +- + /* Disable EDAC polling */ + i7core_pci_ctl_release(pvt); + +@@ -2336,8 +2328,6 @@ static int i7core_register_mci(struct i7core_dev *i7core_dev) + /* DCLK for scrub rate setting */ + pvt->dclk_freq = get_dclk_freq(); + +- atomic_notifier_chain_register(&x86_mce_decoder_chain, &i7_mce_dec); +- + return 0; + + fail0: +@@ -2481,8 +2471,10 @@ static int __init i7core_init(void) + + pci_rc = pci_register_driver(&i7core_driver); + +- if (pci_rc >= 0) ++ if (pci_rc >= 0) { ++ atomic_notifier_chain_register(&x86_mce_decoder_chain, &i7_mce_dec); + return 0; ++ } + + i7core_printk(KERN_ERR, "Failed to register device with error %d.\n", + pci_rc); +@@ -2498,6 +2490,7 @@ static void __exit i7core_exit(void) + { + debugf2("MC: " __FILE__ ": %s()\n", __func__); + pci_unregister_driver(&i7core_driver); ++ atomic_notifier_chain_unregister(&x86_mce_decoder_chain, &i7_mce_dec); + } + + module_init(i7core_init); +diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c +index 7a402bf..18a1293 100644 +--- a/drivers/edac/sb_edac.c ++++ b/drivers/edac/sb_edac.c +@@ -1661,9 +1661,6 @@ static void sbridge_unregister_mci(struct sbridge_dev *sbridge_dev) + debugf0("MC: " __FILE__ ": %s(): mci = %p, dev = %p\n", + __func__, mci, &sbridge_dev->pdev[0]->dev); + +- atomic_notifier_chain_unregister(&x86_mce_decoder_chain, +- &sbridge_mce_dec); +- + /* Remove MC sysfs nodes */ + edac_mc_del_mc(mci->dev); + +@@ -1731,8 +1728,6 @@ static int sbridge_register_mci(struct sbridge_dev *sbridge_dev) + goto fail0; + } + +- atomic_notifier_chain_register(&x86_mce_decoder_chain, +- &sbridge_mce_dec); + return 0; + + fail0: +@@ -1861,8 +1856,10 @@ static int __init sbridge_init(void) + + pci_rc = pci_register_driver(&sbridge_driver); + +- if (pci_rc >= 0) ++ if (pci_rc >= 0) { ++ atomic_notifier_chain_register(&x86_mce_decoder_chain, &sbridge_mce_dec); + return 0; ++ } + + sbridge_printk(KERN_ERR, "Failed to register device with error %d.\n", + pci_rc); +@@ -1878,6 +1875,7 @@ static void __exit sbridge_exit(void) + { + debugf2("MC: " __FILE__ ": %s()\n", __func__); + pci_unregister_driver(&sbridge_driver); ++ atomic_notifier_chain_unregister(&x86_mce_decoder_chain, &sbridge_mce_dec); + } + + module_init(sbridge_init); +diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c +index 3e927ce..a1ee634 100644 +--- a/drivers/gpu/drm/drm_edid.c ++++ b/drivers/gpu/drm/drm_edid.c +@@ -585,7 +585,7 @@ static bool + drm_monitor_supports_rb(struct edid *edid) + { + if (edid->revision >= 4) { +- bool ret; ++ bool ret = false; + drm_for_each_detailed_block((u8 *)edid, is_rb, &ret); + return ret; + } +diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c +index 3e7c478..3e2edc6 100644 +--- a/drivers/gpu/drm/i915/i915_gem.c ++++ b/drivers/gpu/drm/i915/i915_gem.c +@@ -3312,6 +3312,10 @@ i915_gem_ring_throttle(struct drm_device *dev, struct drm_file *file) + + if (ret == 0 && atomic_read(&dev_priv->mm.wedged)) + ret = -EIO; ++ } else if (wait_for(i915_seqno_passed(ring->get_seqno(ring), ++ seqno) || ++ atomic_read(&dev_priv->mm.wedged), 3000)) { ++ ret = -EBUSY; + } + } + +diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c +index d3820c2..578ddfc 100644 +--- a/drivers/gpu/drm/i915/i915_irq.c ++++ b/drivers/gpu/drm/i915/i915_irq.c +@@ -424,6 +424,30 @@ static void gen6_pm_rps_work(struct work_struct *work) + mutex_unlock(&dev_priv->dev->struct_mutex); + } + ++static void gen6_queue_rps_work(struct drm_i915_private *dev_priv, ++ u32 pm_iir) ++{ ++ unsigned long flags; ++ ++ /* ++ * IIR bits should never already be set because IMR should ++ * prevent an interrupt from being shown in IIR. The warning ++ * displays a case where we've unsafely cleared ++ * dev_priv->pm_iir. Although missing an interrupt of the same ++ * type is not a problem, it displays a problem in the logic. ++ * ++ * The mask bit in IMR is cleared by rps_work. ++ */ ++ ++ spin_lock_irqsave(&dev_priv->rps_lock, flags); ++ dev_priv->pm_iir |= pm_iir; ++ I915_WRITE(GEN6_PMIMR, dev_priv->pm_iir); ++ POSTING_READ(GEN6_PMIMR); ++ spin_unlock_irqrestore(&dev_priv->rps_lock, flags); ++ ++ queue_work(dev_priv->wq, &dev_priv->rps_work); ++} ++ + static void pch_irq_handler(struct drm_device *dev, u32 pch_iir) + { + drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private; +@@ -529,16 +553,8 @@ static irqreturn_t ivybridge_irq_handler(DRM_IRQ_ARGS) + pch_irq_handler(dev, pch_iir); + } + +- if (pm_iir & GEN6_PM_DEFERRED_EVENTS) { +- unsigned long flags; +- spin_lock_irqsave(&dev_priv->rps_lock, flags); +- WARN(dev_priv->pm_iir & pm_iir, "Missed a PM interrupt\n"); +- dev_priv->pm_iir |= pm_iir; +- I915_WRITE(GEN6_PMIMR, dev_priv->pm_iir); +- POSTING_READ(GEN6_PMIMR); +- spin_unlock_irqrestore(&dev_priv->rps_lock, flags); +- queue_work(dev_priv->wq, &dev_priv->rps_work); +- } ++ if (pm_iir & GEN6_PM_DEFERRED_EVENTS) ++ gen6_queue_rps_work(dev_priv, pm_iir); + + /* should clear PCH hotplug event before clear CPU irq */ + I915_WRITE(SDEIIR, pch_iir); +@@ -634,25 +650,8 @@ static irqreturn_t ironlake_irq_handler(DRM_IRQ_ARGS) + i915_handle_rps_change(dev); + } + +- if (IS_GEN6(dev) && pm_iir & GEN6_PM_DEFERRED_EVENTS) { +- /* +- * IIR bits should never already be set because IMR should +- * prevent an interrupt from being shown in IIR. The warning +- * displays a case where we've unsafely cleared +- * dev_priv->pm_iir. Although missing an interrupt of the same +- * type is not a problem, it displays a problem in the logic. +- * +- * The mask bit in IMR is cleared by rps_work. +- */ +- unsigned long flags; +- spin_lock_irqsave(&dev_priv->rps_lock, flags); +- WARN(dev_priv->pm_iir & pm_iir, "Missed a PM interrupt\n"); +- dev_priv->pm_iir |= pm_iir; +- I915_WRITE(GEN6_PMIMR, dev_priv->pm_iir); +- POSTING_READ(GEN6_PMIMR); +- spin_unlock_irqrestore(&dev_priv->rps_lock, flags); +- queue_work(dev_priv->wq, &dev_priv->rps_work); +- } ++ if (IS_GEN6(dev) && pm_iir & GEN6_PM_DEFERRED_EVENTS) ++ gen6_queue_rps_work(dev_priv, pm_iir); + + /* should clear PCH hotplug event before clear CPU irq */ + I915_WRITE(SDEIIR, pch_iir); +diff --git a/drivers/gpu/drm/i915/i915_suspend.c b/drivers/gpu/drm/i915/i915_suspend.c +index a1eb83d..f38d196 100644 +--- a/drivers/gpu/drm/i915/i915_suspend.c ++++ b/drivers/gpu/drm/i915/i915_suspend.c +@@ -739,8 +739,11 @@ static void i915_restore_display(struct drm_device *dev) + if (HAS_PCH_SPLIT(dev)) { + I915_WRITE(BLC_PWM_PCH_CTL1, dev_priv->saveBLC_PWM_CTL); + I915_WRITE(BLC_PWM_PCH_CTL2, dev_priv->saveBLC_PWM_CTL2); +- I915_WRITE(BLC_PWM_CPU_CTL, dev_priv->saveBLC_CPU_PWM_CTL); ++ /* NOTE: BLC_PWM_CPU_CTL must be written after BLC_PWM_CPU_CTL2; ++ * otherwise we get blank eDP screen after S3 on some machines ++ */ + I915_WRITE(BLC_PWM_CPU_CTL2, dev_priv->saveBLC_CPU_PWM_CTL2); ++ I915_WRITE(BLC_PWM_CPU_CTL, dev_priv->saveBLC_CPU_PWM_CTL); + I915_WRITE(PCH_PP_ON_DELAYS, dev_priv->savePP_ON_DELAYS); + I915_WRITE(PCH_PP_OFF_DELAYS, dev_priv->savePP_OFF_DELAYS); + I915_WRITE(PCH_PP_DIVISOR, dev_priv->savePP_DIVISOR); +diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c +index 5c1cdb8..6aa7716 100644 +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -2187,6 +2187,33 @@ intel_pipe_set_base_atomic(struct drm_crtc *crtc, struct drm_framebuffer *fb, + } + + static int ++intel_finish_fb(struct drm_framebuffer *old_fb) ++{ ++ struct drm_i915_gem_object *obj = to_intel_framebuffer(old_fb)->obj; ++ struct drm_i915_private *dev_priv = obj->base.dev->dev_private; ++ bool was_interruptible = dev_priv->mm.interruptible; ++ int ret; ++ ++ wait_event(dev_priv->pending_flip_queue, ++ atomic_read(&dev_priv->mm.wedged) || ++ atomic_read(&obj->pending_flip) == 0); ++ ++ /* Big Hammer, we also need to ensure that any pending ++ * MI_WAIT_FOR_EVENT inside a user batch buffer on the ++ * current scanout is retired before unpinning the old ++ * framebuffer. ++ * ++ * This should only fail upon a hung GPU, in which case we ++ * can safely continue. ++ */ ++ dev_priv->mm.interruptible = false; ++ ret = i915_gem_object_finish_gpu(obj); ++ dev_priv->mm.interruptible = was_interruptible; ++ ++ return ret; ++} ++ ++static int + intel_pipe_set_base(struct drm_crtc *crtc, int x, int y, + struct drm_framebuffer *old_fb) + { +@@ -2224,25 +2251,8 @@ intel_pipe_set_base(struct drm_crtc *crtc, int x, int y, + return ret; + } + +- if (old_fb) { +- struct drm_i915_private *dev_priv = dev->dev_private; +- struct drm_i915_gem_object *obj = to_intel_framebuffer(old_fb)->obj; +- +- wait_event(dev_priv->pending_flip_queue, +- atomic_read(&dev_priv->mm.wedged) || +- atomic_read(&obj->pending_flip) == 0); +- +- /* Big Hammer, we also need to ensure that any pending +- * MI_WAIT_FOR_EVENT inside a user batch buffer on the +- * current scanout is retired before unpinning the old +- * framebuffer. +- * +- * This should only fail upon a hung GPU, in which case we +- * can safely continue. +- */ +- ret = i915_gem_object_finish_gpu(obj); +- (void) ret; +- } ++ if (old_fb) ++ intel_finish_fb(old_fb); + + ret = intel_pipe_set_base_atomic(crtc, crtc->fb, x, y, + LEAVE_ATOMIC_MODE_SET); +@@ -3312,6 +3322,23 @@ static void intel_crtc_disable(struct drm_crtc *crtc) + struct drm_crtc_helper_funcs *crtc_funcs = crtc->helper_private; + struct drm_device *dev = crtc->dev; + ++ /* Flush any pending WAITs before we disable the pipe. Note that ++ * we need to drop the struct_mutex in order to acquire it again ++ * during the lowlevel dpms routines around a couple of the ++ * operations. It does not look trivial nor desirable to move ++ * that locking higher. So instead we leave a window for the ++ * submission of further commands on the fb before we can actually ++ * disable it. This race with userspace exists anyway, and we can ++ * only rely on the pipe being disabled by userspace after it ++ * receives the hotplug notification and has flushed any pending ++ * batches. ++ */ ++ if (crtc->fb) { ++ mutex_lock(&dev->struct_mutex); ++ intel_finish_fb(crtc->fb); ++ mutex_unlock(&dev->struct_mutex); ++ } ++ + crtc_funcs->dpms(crtc, DRM_MODE_DPMS_OFF); + + if (crtc->fb) { +diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c +index 933e66b..f6613dc 100644 +--- a/drivers/gpu/drm/i915/intel_ringbuffer.c ++++ b/drivers/gpu/drm/i915/intel_ringbuffer.c +@@ -306,7 +306,7 @@ static int init_ring_common(struct intel_ring_buffer *ring) + + I915_WRITE_CTL(ring, + ((ring->size - PAGE_SIZE) & RING_NR_PAGES) +- | RING_REPORT_64K | RING_VALID); ++ | RING_VALID); + + /* If the head is still not zero, the ring is dead */ + if ((I915_READ_CTL(ring) & RING_VALID) == 0 || +@@ -1157,18 +1157,6 @@ int intel_wait_ring_buffer(struct intel_ring_buffer *ring, int n) + struct drm_device *dev = ring->dev; + struct drm_i915_private *dev_priv = dev->dev_private; + unsigned long end; +- u32 head; +- +- /* If the reported head position has wrapped or hasn't advanced, +- * fallback to the slow and accurate path. +- */ +- head = intel_read_status_page(ring, 4); +- if (head > ring->head) { +- ring->head = head; +- ring->space = ring_space(ring); +- if (ring->space >= n) +- return 0; +- } + + trace_i915_ring_wait_begin(ring); + end = jiffies + 3 * HZ; +diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c +index 3a4cc32..cc0801d 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c ++++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c +@@ -499,7 +499,7 @@ int nouveau_fbcon_init(struct drm_device *dev) + nfbdev->helper.funcs = &nouveau_fbcon_helper_funcs; + + ret = drm_fb_helper_init(dev, &nfbdev->helper, +- nv_two_heads(dev) ? 2 : 1, 4); ++ dev->mode_config.num_crtc, 4); + if (ret) { + kfree(nfbdev); + return ret; +diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c +index 4c07436..d99aa84 100644 +--- a/drivers/hwmon/applesmc.c ++++ b/drivers/hwmon/applesmc.c +@@ -215,7 +215,7 @@ static int read_smc(u8 cmd, const char *key, u8 *buffer, u8 len) + int i; + + if (send_command(cmd) || send_argument(key)) { +- pr_warn("%s: read arg fail\n", key); ++ pr_warn("%.4s: read arg fail\n", key); + return -EIO; + } + +@@ -223,7 +223,7 @@ static int read_smc(u8 cmd, const char *key, u8 *buffer, u8 len) + + for (i = 0; i < len; i++) { + if (__wait_status(0x05)) { +- pr_warn("%s: read data fail\n", key); ++ pr_warn("%.4s: read data fail\n", key); + return -EIO; + } + buffer[i] = inb(APPLESMC_DATA_PORT); +diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c +index 427468f..0790c98 100644 +--- a/drivers/hwmon/coretemp.c ++++ b/drivers/hwmon/coretemp.c +@@ -660,7 +660,7 @@ static void __cpuinit get_core_online(unsigned int cpu) + * sensors. We check this bit only, all the early CPUs + * without thermal sensors will be filtered out. + */ +- if (!cpu_has(c, X86_FEATURE_DTS)) ++ if (!cpu_has(c, X86_FEATURE_DTHERM)) + return; + + if (!pdev) { +diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c +index da2f021..532a902 100644 +--- a/drivers/md/dm-thin.c ++++ b/drivers/md/dm-thin.c +@@ -288,8 +288,10 @@ static void __cell_release(struct cell *cell, struct bio_list *inmates) + + hlist_del(&cell->list); + +- bio_list_add(inmates, cell->holder); +- bio_list_merge(inmates, &cell->bios); ++ if (inmates) { ++ bio_list_add(inmates, cell->holder); ++ bio_list_merge(inmates, &cell->bios); ++ } + + mempool_free(cell, prison->cell_pool); + } +@@ -312,9 +314,10 @@ static void cell_release(struct cell *cell, struct bio_list *bios) + */ + static void __cell_release_singleton(struct cell *cell, struct bio *bio) + { +- hlist_del(&cell->list); + BUG_ON(cell->holder != bio); + BUG_ON(!bio_list_empty(&cell->bios)); ++ ++ __cell_release(cell, NULL); + } + + static void cell_release_singleton(struct cell *cell, struct bio *bio) +diff --git a/drivers/media/dvb/siano/smsusb.c b/drivers/media/dvb/siano/smsusb.c +index b7d1e3e..fb68805 100644 +--- a/drivers/media/dvb/siano/smsusb.c ++++ b/drivers/media/dvb/siano/smsusb.c +@@ -544,6 +544,8 @@ static const struct usb_device_id smsusb_id_table[] __devinitconst = { + .driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM }, + { USB_DEVICE(0x2040, 0xc0a0), + .driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM }, ++ { USB_DEVICE(0x2040, 0xf5a0), ++ .driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM }, + { } /* Terminating entry */ + }; + +diff --git a/drivers/media/video/gspca/gspca.c b/drivers/media/video/gspca/gspca.c +index 2ca10df..981501f 100644 +--- a/drivers/media/video/gspca/gspca.c ++++ b/drivers/media/video/gspca/gspca.c +@@ -1697,7 +1697,7 @@ static int vidioc_streamoff(struct file *file, void *priv, + enum v4l2_buf_type buf_type) + { + struct gspca_dev *gspca_dev = priv; +- int ret; ++ int i, ret; + + if (buf_type != V4L2_BUF_TYPE_VIDEO_CAPTURE) + return -EINVAL; +@@ -1728,6 +1728,8 @@ static int vidioc_streamoff(struct file *file, void *priv, + wake_up_interruptible(&gspca_dev->wq); + + /* empty the transfer queues */ ++ for (i = 0; i < gspca_dev->nframes; i++) ++ gspca_dev->frame[i].v4l2_buf.flags &= ~BUF_ALL_FLAGS; + atomic_set(&gspca_dev->fr_q, 0); + atomic_set(&gspca_dev->fr_i, 0); + gspca_dev->fr_o = 0; +diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c +index 8dc84d6..86cd532 100644 +--- a/drivers/net/can/c_can/c_can.c ++++ b/drivers/net/can/c_can/c_can.c +@@ -590,8 +590,8 @@ static void c_can_chip_config(struct net_device *dev) + priv->write_reg(priv, &priv->regs->control, + CONTROL_ENABLE_AR); + +- if (priv->can.ctrlmode & (CAN_CTRLMODE_LISTENONLY & +- CAN_CTRLMODE_LOOPBACK)) { ++ if ((priv->can.ctrlmode & CAN_CTRLMODE_LISTENONLY) && ++ (priv->can.ctrlmode & CAN_CTRLMODE_LOOPBACK)) { + /* loopback + silent mode : useful for hot self-test */ + priv->write_reg(priv, &priv->regs->control, CONTROL_EIE | + CONTROL_SIE | CONTROL_IE | CONTROL_TEST); +diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c +index e023379..e59d006 100644 +--- a/drivers/net/can/flexcan.c ++++ b/drivers/net/can/flexcan.c +@@ -933,12 +933,12 @@ static int __devinit flexcan_probe(struct platform_device *pdev) + u32 clock_freq = 0; + + if (pdev->dev.of_node) { +- const u32 *clock_freq_p; ++ const __be32 *clock_freq_p; + + clock_freq_p = of_get_property(pdev->dev.of_node, + "clock-frequency", NULL); + if (clock_freq_p) +- clock_freq = *clock_freq_p; ++ clock_freq = be32_to_cpup(clock_freq_p); + } + + if (!clock_freq) { +diff --git a/drivers/net/ethernet/intel/e1000e/82571.c b/drivers/net/ethernet/intel/e1000e/82571.c +index a3e65fd..e556fc3 100644 +--- a/drivers/net/ethernet/intel/e1000e/82571.c ++++ b/drivers/net/ethernet/intel/e1000e/82571.c +@@ -2080,8 +2080,9 @@ const struct e1000_info e1000_82574_info = { + | FLAG_HAS_SMART_POWER_DOWN + | FLAG_HAS_AMT + | FLAG_HAS_CTRLEXT_ON_LOAD, +- .flags2 = FLAG2_CHECK_PHY_HANG ++ .flags2 = FLAG2_CHECK_PHY_HANG + | FLAG2_DISABLE_ASPM_L0S ++ | FLAG2_DISABLE_ASPM_L1 + | FLAG2_NO_DISABLE_RX, + .pba = 32, + .max_hw_frame_size = DEFAULT_JUMBO, +diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c +index 4e933d1..64d3f98 100644 +--- a/drivers/net/ethernet/intel/e1000e/netdev.c ++++ b/drivers/net/ethernet/intel/e1000e/netdev.c +@@ -5132,14 +5132,6 @@ static int e1000_change_mtu(struct net_device *netdev, int new_mtu) + return -EINVAL; + } + +- /* 82573 Errata 17 */ +- if (((adapter->hw.mac.type == e1000_82573) || +- (adapter->hw.mac.type == e1000_82574)) && +- (max_frame > ETH_FRAME_LEN + ETH_FCS_LEN)) { +- adapter->flags2 |= FLAG2_DISABLE_ASPM_L1; +- e1000e_disable_aspm(adapter->pdev, PCIE_LINK_STATE_L1); +- } +- + while (test_and_set_bit(__E1000_RESETTING, &adapter->state)) + usleep_range(1000, 2000); + /* e1000e_down -> e1000e_reset dependent on max_frame_size & mtu */ +diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c +index 8b0c2ca..6973620 100644 +--- a/drivers/net/wireless/ath/ath9k/hw.c ++++ b/drivers/net/wireless/ath/ath9k/hw.c +@@ -718,13 +718,25 @@ static void ath9k_hw_init_qos(struct ath_hw *ah) + + u32 ar9003_get_pll_sqsum_dvc(struct ath_hw *ah) + { ++ struct ath_common *common = ath9k_hw_common(ah); ++ int i = 0; ++ + REG_CLR_BIT(ah, PLL3, PLL3_DO_MEAS_MASK); + udelay(100); + REG_SET_BIT(ah, PLL3, PLL3_DO_MEAS_MASK); + +- while ((REG_READ(ah, PLL4) & PLL4_MEAS_DONE) == 0) ++ while ((REG_READ(ah, PLL4) & PLL4_MEAS_DONE) == 0) { ++ + udelay(100); + ++ if (WARN_ON_ONCE(i >= 100)) { ++ ath_err(common, "PLL4 meaurement not done\n"); ++ break; ++ } ++ ++ i++; ++ } ++ + return (REG_READ(ah, PLL3) & SQSUM_DVC_MASK) >> 3; + } + EXPORT_SYMBOL(ar9003_get_pll_sqsum_dvc); +diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c +index f76a814..95437fc 100644 +--- a/drivers/net/wireless/ath/ath9k/main.c ++++ b/drivers/net/wireless/ath/ath9k/main.c +@@ -1042,6 +1042,15 @@ void ath_hw_pll_work(struct work_struct *work) + hw_pll_work.work); + u32 pll_sqsum; + ++ /* ++ * ensure that the PLL WAR is executed only ++ * after the STA is associated (or) if the ++ * beaconing had started in interfaces that ++ * uses beacons. ++ */ ++ if (!(sc->sc_flags & SC_OP_BEACONS)) ++ return; ++ + if (AR_SREV_9485(sc->sc_ah)) { + + ath9k_ps_wakeup(sc); +@@ -1486,15 +1495,6 @@ static int ath9k_add_interface(struct ieee80211_hw *hw, + } + } + +- if ((ah->opmode == NL80211_IFTYPE_ADHOC) || +- ((vif->type == NL80211_IFTYPE_ADHOC) && +- sc->nvifs > 0)) { +- ath_err(common, "Cannot create ADHOC interface when other" +- " interfaces already exist.\n"); +- ret = -EINVAL; +- goto out; +- } +- + ath_dbg(common, ATH_DBG_CONFIG, + "Attach a VIF of type: %d\n", vif->type); + +diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c +index 76fd277..c59c592 100644 +--- a/drivers/net/wireless/ath/ath9k/xmit.c ++++ b/drivers/net/wireless/ath/ath9k/xmit.c +@@ -936,13 +936,13 @@ static void ath_buf_set_rate(struct ath_softc *sc, struct ath_buf *bf, + } + + /* legacy rates */ ++ rate = &sc->sbands[tx_info->band].bitrates[rates[i].idx]; + if ((tx_info->band == IEEE80211_BAND_2GHZ) && + !(rate->flags & IEEE80211_RATE_ERP_G)) + phy = WLAN_RC_PHY_CCK; + else + phy = WLAN_RC_PHY_OFDM; + +- rate = &sc->sbands[tx_info->band].bitrates[rates[i].idx]; + info->rates[i].Rate = rate->hw_value; + if (rate->hw_value_short) { + if (rates[i].flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE) +diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c b/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c +index 5815cf5..4661a64 100644 +--- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c ++++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c +@@ -1777,6 +1777,7 @@ static ssize_t iwl_dbgfs_rx_queue_read(struct file *file, + return simple_read_from_buffer(user_buf, count, ppos, buf, pos); + } + ++#ifdef CONFIG_IWLWIFI_DEBUG + static ssize_t iwl_dbgfs_log_event_read(struct file *file, + char __user *user_buf, + size_t count, loff_t *ppos) +@@ -1814,6 +1815,7 @@ static ssize_t iwl_dbgfs_log_event_write(struct file *file, + + return count; + } ++#endif + + static ssize_t iwl_dbgfs_interrupt_read(struct file *file, + char __user *user_buf, +@@ -1941,7 +1943,9 @@ static ssize_t iwl_dbgfs_fh_reg_read(struct file *file, + return ret; + } + ++#ifdef CONFIG_IWLWIFI_DEBUG + DEBUGFS_READ_WRITE_FILE_OPS(log_event); ++#endif + DEBUGFS_READ_WRITE_FILE_OPS(interrupt); + DEBUGFS_READ_FILE_OPS(fh_reg); + DEBUGFS_READ_FILE_OPS(rx_queue); +@@ -1957,7 +1961,9 @@ static int iwl_trans_pcie_dbgfs_register(struct iwl_trans *trans, + { + DEBUGFS_ADD_FILE(rx_queue, dir, S_IRUSR); + DEBUGFS_ADD_FILE(tx_queue, dir, S_IRUSR); ++#ifdef CONFIG_IWLWIFI_DEBUG + DEBUGFS_ADD_FILE(log_event, dir, S_IWUSR | S_IRUSR); ++#endif + DEBUGFS_ADD_FILE(interrupt, dir, S_IWUSR | S_IRUSR); + DEBUGFS_ADD_FILE(csr, dir, S_IWUSR); + DEBUGFS_ADD_FILE(fh_reg, dir, S_IRUSR); +diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c +index 226faab..fc35308 100644 +--- a/drivers/net/xen-netfront.c ++++ b/drivers/net/xen-netfront.c +@@ -1922,14 +1922,14 @@ static int __devexit xennet_remove(struct xenbus_device *dev) + + dev_dbg(&dev->dev, "%s\n", dev->nodename); + +- unregister_netdev(info->netdev); +- + xennet_disconnect_backend(info); + +- del_timer_sync(&info->rx_refill_timer); +- + xennet_sysfs_delif(info->netdev); + ++ unregister_netdev(info->netdev); ++ ++ del_timer_sync(&info->rx_refill_timer); ++ + free_percpu(info->stats); + + free_netdev(info->netdev); +diff --git a/drivers/oprofile/oprofile_perf.c b/drivers/oprofile/oprofile_perf.c +index da14432..efc4b7f 100644 +--- a/drivers/oprofile/oprofile_perf.c ++++ b/drivers/oprofile/oprofile_perf.c +@@ -25,7 +25,7 @@ static int oprofile_perf_enabled; + static DEFINE_MUTEX(oprofile_perf_mutex); + + static struct op_counter_config *counter_config; +-static struct perf_event **perf_events[nr_cpumask_bits]; ++static struct perf_event **perf_events[NR_CPUS]; + static int num_counters; + + /* +diff --git a/drivers/staging/iio/adc/ad7606_core.c b/drivers/staging/iio/adc/ad7606_core.c +index 54423ab..2ee187f 100644 +--- a/drivers/staging/iio/adc/ad7606_core.c ++++ b/drivers/staging/iio/adc/ad7606_core.c +@@ -241,6 +241,7 @@ static const struct attribute_group ad7606_attribute_group = { + .indexed = 1, \ + .channel = num, \ + .address = num, \ ++ .info_mask = (1 << IIO_CHAN_INFO_SCALE_SHARED), \ + .scan_index = num, \ + .scan_type = IIO_ST('s', 16, 16, 0), \ + } +diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c +index ec41d38..f4b738f 100644 +--- a/drivers/staging/rtl8712/usb_intf.c ++++ b/drivers/staging/rtl8712/usb_intf.c +@@ -102,6 +102,8 @@ static struct usb_device_id rtl871x_usb_id_tbl[] = { + /* - */ + {USB_DEVICE(0x20F4, 0x646B)}, + {USB_DEVICE(0x083A, 0xC512)}, ++ {USB_DEVICE(0x25D4, 0x4CA1)}, ++ {USB_DEVICE(0x25D4, 0x4CAB)}, + + /* RTL8191SU */ + /* Realtek */ +diff --git a/drivers/staging/rts_pstor/rtsx_transport.c b/drivers/staging/rts_pstor/rtsx_transport.c +index 4e3d2c1..9b2e5c9 100644 +--- a/drivers/staging/rts_pstor/rtsx_transport.c ++++ b/drivers/staging/rts_pstor/rtsx_transport.c +@@ -335,6 +335,7 @@ static int rtsx_transfer_sglist_adma_partial(struct rtsx_chip *chip, u8 card, + int sg_cnt, i, resid; + int err = 0; + long timeleft; ++ struct scatterlist *sg_ptr; + u32 val = TRIG_DMA; + + if ((sg == NULL) || (num_sg <= 0) || !offset || !index) +@@ -371,7 +372,7 @@ static int rtsx_transfer_sglist_adma_partial(struct rtsx_chip *chip, u8 card, + sg_cnt = dma_map_sg(&(rtsx->pci->dev), sg, num_sg, dma_dir); + + resid = size; +- ++ sg_ptr = sg; + chip->sgi = 0; + /* Usually the next entry will be @sg@ + 1, but if this sg element + * is part of a chained scatterlist, it could jump to the start of +@@ -379,14 +380,14 @@ static int rtsx_transfer_sglist_adma_partial(struct rtsx_chip *chip, u8 card, + * the proper sg + */ + for (i = 0; i < *index; i++) +- sg = sg_next(sg); ++ sg_ptr = sg_next(sg_ptr); + for (i = *index; i < sg_cnt; i++) { + dma_addr_t addr; + unsigned int len; + u8 option; + +- addr = sg_dma_address(sg); +- len = sg_dma_len(sg); ++ addr = sg_dma_address(sg_ptr); ++ len = sg_dma_len(sg_ptr); + + RTSX_DEBUGP("DMA addr: 0x%x, Len: 0x%x\n", + (unsigned int)addr, len); +@@ -415,7 +416,7 @@ static int rtsx_transfer_sglist_adma_partial(struct rtsx_chip *chip, u8 card, + if (!resid) + break; + +- sg = sg_next(sg); ++ sg_ptr = sg_next(sg_ptr); + } + + RTSX_DEBUGP("SG table count = %d\n", chip->sgi); +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index aa0c43f..35e6b5f 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -93,6 +93,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x10C4, 0x814B) }, /* West Mountain Radio RIGtalk */ + { USB_DEVICE(0x10C4, 0x8156) }, /* B&G H3000 link cable */ + { USB_DEVICE(0x10C4, 0x815E) }, /* Helicomm IP-Link 1220-DVM */ ++ { USB_DEVICE(0x10C4, 0x815F) }, /* Timewave HamLinkUSB */ + { USB_DEVICE(0x10C4, 0x818B) }, /* AVIT Research USB to TTL */ + { USB_DEVICE(0x10C4, 0x819F) }, /* MJS USB Toslink Switcher */ + { USB_DEVICE(0x10C4, 0x81A6) }, /* ThinkOptics WavIt */ +@@ -134,7 +135,13 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x10CE, 0xEA6A) }, /* Silicon Labs MobiData GPRS USB Modem 100EU */ + { USB_DEVICE(0x13AD, 0x9999) }, /* Baltech card reader */ + { USB_DEVICE(0x1555, 0x0004) }, /* Owen AC4 USB-RS485 Converter */ ++ { USB_DEVICE(0x166A, 0x0201) }, /* Clipsal 5500PACA C-Bus Pascal Automation Controller */ ++ { USB_DEVICE(0x166A, 0x0301) }, /* Clipsal 5800PC C-Bus Wireless PC Interface */ + { USB_DEVICE(0x166A, 0x0303) }, /* Clipsal 5500PCU C-Bus USB interface */ ++ { USB_DEVICE(0x166A, 0x0304) }, /* Clipsal 5000CT2 C-Bus Black and White Touchscreen */ ++ { USB_DEVICE(0x166A, 0x0305) }, /* Clipsal C-5000CT2 C-Bus Spectrum Colour Touchscreen */ ++ { USB_DEVICE(0x166A, 0x0401) }, /* Clipsal L51xx C-Bus Architectural Dimmer */ ++ { USB_DEVICE(0x166A, 0x0101) }, /* Clipsal 5560884 C-Bus Multi-room Audio Matrix Switcher */ + { USB_DEVICE(0x16D6, 0x0001) }, /* Jablotron serial interface */ + { USB_DEVICE(0x16DC, 0x0010) }, /* W-IE-NE-R Plein & Baus GmbH PL512 Power Supply */ + { USB_DEVICE(0x16DC, 0x0011) }, /* W-IE-NE-R Plein & Baus GmbH RCM Remote Control for MARATON Power Supply */ +@@ -146,7 +153,11 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */ + { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */ + { USB_DEVICE(0x1BE3, 0x07A6) }, /* WAGO 750-923 USB Service Cable */ ++ { USB_DEVICE(0x1E29, 0x0102) }, /* Festo CPX-USB */ ++ { USB_DEVICE(0x1E29, 0x0501) }, /* Festo CMSP */ + { USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */ ++ { USB_DEVICE(0x3195, 0xF280) }, /* Link Instruments MSO-28 */ ++ { USB_DEVICE(0x3195, 0xF281) }, /* Link Instruments MSO-28 */ + { USB_DEVICE(0x413C, 0x9500) }, /* DW700 GPS USB interface */ + { } /* Terminating Entry */ + }; +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 61d6c31..21a4734 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -235,6 +235,7 @@ static void option_instat_callback(struct urb *urb); + #define NOVATELWIRELESS_PRODUCT_G1 0xA001 + #define NOVATELWIRELESS_PRODUCT_G1_M 0xA002 + #define NOVATELWIRELESS_PRODUCT_G2 0xA010 ++#define NOVATELWIRELESS_PRODUCT_MC551 0xB001 + + /* AMOI PRODUCTS */ + #define AMOI_VENDOR_ID 0x1614 +@@ -496,6 +497,10 @@ static void option_instat_callback(struct urb *urb); + /* MediaTek products */ + #define MEDIATEK_VENDOR_ID 0x0e8d + ++/* Cellient products */ ++#define CELLIENT_VENDOR_ID 0x2692 ++#define CELLIENT_PRODUCT_MEN200 0x9005 ++ + /* some devices interfaces need special handling due to a number of reasons */ + enum option_blacklist_reason { + OPTION_BLACKLIST_NONE = 0, +@@ -730,6 +735,8 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_G1) }, + { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_G1_M) }, + { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_G2) }, ++ /* Novatel Ovation MC551 a.k.a. Verizon USB551L */ ++ { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC551, 0xff, 0xff, 0xff) }, + + { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01) }, + { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01A) }, +@@ -1227,6 +1234,7 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, 0x00a1, 0xff, 0x02, 0x01) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, 0x00a2, 0xff, 0x00, 0x00) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, 0x00a2, 0xff, 0x02, 0x01) }, /* MediaTek MT6276M modem & app port */ ++ { USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MEN200) }, + { } /* Terminating entry */ + }; + MODULE_DEVICE_TABLE(usb, option_ids); +diff --git a/fs/nilfs2/gcinode.c b/fs/nilfs2/gcinode.c +index 08a07a2..57ceaf3 100644 +--- a/fs/nilfs2/gcinode.c ++++ b/fs/nilfs2/gcinode.c +@@ -191,6 +191,8 @@ void nilfs_remove_all_gcinodes(struct the_nilfs *nilfs) + while (!list_empty(head)) { + ii = list_first_entry(head, struct nilfs_inode_info, i_dirty); + list_del_init(&ii->i_dirty); ++ truncate_inode_pages(&ii->vfs_inode.i_data, 0); ++ nilfs_btnode_cache_clear(&ii->i_btnode_cache); + iput(&ii->vfs_inode); + } + } +diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c +index bb24ab6..6f24e67 100644 +--- a/fs/nilfs2/segment.c ++++ b/fs/nilfs2/segment.c +@@ -2309,6 +2309,8 @@ nilfs_remove_written_gcinodes(struct the_nilfs *nilfs, struct list_head *head) + if (!test_bit(NILFS_I_UPDATED, &ii->i_state)) + continue; + list_del_init(&ii->i_dirty); ++ truncate_inode_pages(&ii->vfs_inode.i_data, 0); ++ nilfs_btnode_cache_clear(&ii->i_btnode_cache); + iput(&ii->vfs_inode); + } + } +diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h +index a03c098..bc00876 100644 +--- a/include/asm-generic/pgtable.h ++++ b/include/asm-generic/pgtable.h +@@ -445,6 +445,18 @@ static inline int pmd_write(pmd_t pmd) + #endif /* __HAVE_ARCH_PMD_WRITE */ + #endif /* CONFIG_TRANSPARENT_HUGEPAGE */ + ++#ifndef pmd_read_atomic ++static inline pmd_t pmd_read_atomic(pmd_t *pmdp) ++{ ++ /* ++ * Depend on compiler for an atomic pmd read. NOTE: this is ++ * only going to work, if the pmdval_t isn't larger than ++ * an unsigned long. ++ */ ++ return *pmdp; ++} ++#endif ++ + /* + * This function is meant to be used by sites walking pagetables with + * the mmap_sem hold in read mode to protect against MADV_DONTNEED and +@@ -458,14 +470,30 @@ static inline int pmd_write(pmd_t pmd) + * undefined so behaving like if the pmd was none is safe (because it + * can return none anyway). The compiler level barrier() is critically + * important to compute the two checks atomically on the same pmdval. ++ * ++ * For 32bit kernels with a 64bit large pmd_t this automatically takes ++ * care of reading the pmd atomically to avoid SMP race conditions ++ * against pmd_populate() when the mmap_sem is hold for reading by the ++ * caller (a special atomic read not done by "gcc" as in the generic ++ * version above, is also needed when THP is disabled because the page ++ * fault can populate the pmd from under us). + */ + static inline int pmd_none_or_trans_huge_or_clear_bad(pmd_t *pmd) + { +- /* depend on compiler for an atomic pmd read */ +- pmd_t pmdval = *pmd; ++ pmd_t pmdval = pmd_read_atomic(pmd); + /* + * The barrier will stabilize the pmdval in a register or on + * the stack so that it will stop changing under the code. ++ * ++ * When CONFIG_TRANSPARENT_HUGEPAGE=y on x86 32bit PAE, ++ * pmd_read_atomic is allowed to return a not atomic pmdval ++ * (for example pointing to an hugepage that has never been ++ * mapped in the pmd). The below checks will only care about ++ * the low part of the pmd with 32bit PAE x86 anyway, with the ++ * exception of pmd_none(). So the important thing is that if ++ * the low part of the pmd is found null, the high part will ++ * be also null or the pmd_none() check below would be ++ * confused. + */ + #ifdef CONFIG_TRANSPARENT_HUGEPAGE + barrier(); +diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c +index f961cc5..da587ad 100644 +--- a/net/batman-adv/routing.c ++++ b/net/batman-adv/routing.c +@@ -619,6 +619,8 @@ int recv_tt_query(struct sk_buff *skb, struct hard_iface *recv_if) + /* packet needs to be linearized to access the TT changes */ + if (skb_linearize(skb) < 0) + goto out; ++ /* skb_linearize() possibly changed skb->data */ ++ tt_query = (struct tt_query_packet *)skb->data; + + if (is_my_mac(tt_query->dst)) + handle_tt_response(bat_priv, tt_query); +diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c +index 5f09a57..088af45 100644 +--- a/net/batman-adv/translation-table.c ++++ b/net/batman-adv/translation-table.c +@@ -1816,10 +1816,10 @@ bool is_ap_isolated(struct bat_priv *bat_priv, uint8_t *src, uint8_t *dst) + { + struct tt_local_entry *tt_local_entry = NULL; + struct tt_global_entry *tt_global_entry = NULL; +- bool ret = true; ++ bool ret = false; + + if (!atomic_read(&bat_priv->ap_isolation)) +- return false; ++ goto out; + + tt_local_entry = tt_local_hash_find(bat_priv, dst); + if (!tt_local_entry) +@@ -1829,10 +1829,10 @@ bool is_ap_isolated(struct bat_priv *bat_priv, uint8_t *src, uint8_t *dst) + if (!tt_global_entry) + goto out; + +- if (_is_ap_isolated(tt_local_entry, tt_global_entry)) ++ if (!_is_ap_isolated(tt_local_entry, tt_global_entry)) + goto out; + +- ret = false; ++ ret = true; + + out: + if (tt_global_entry) +diff --git a/net/wireless/reg.c b/net/wireless/reg.c +index c1c99dd..d57d05b 100644 +--- a/net/wireless/reg.c ++++ b/net/wireless/reg.c +@@ -1369,7 +1369,7 @@ static void reg_set_request_processed(void) + spin_unlock(®_requests_lock); + + if (last_request->initiator == NL80211_REGDOM_SET_BY_USER) +- cancel_delayed_work_sync(®_timeout); ++ cancel_delayed_work(®_timeout); + + if (need_more_processing) + schedule_work(®_work); +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 0005bde..5f096a5 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5988,6 +5988,7 @@ static const struct hda_codec_preset snd_hda_preset_realtek[] = { + { .id = 0x10ec0272, .name = "ALC272", .patch = patch_alc662 }, + { .id = 0x10ec0275, .name = "ALC275", .patch = patch_alc269 }, + { .id = 0x10ec0276, .name = "ALC276", .patch = patch_alc269 }, ++ { .id = 0x10ec0280, .name = "ALC280", .patch = patch_alc269 }, + { .id = 0x10ec0861, .rev = 0x100340, .name = "ALC660", + .patch = patch_alc861 }, + { .id = 0x10ec0660, .name = "ALC660-VD", .patch = patch_alc861vd }, +diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c +index 11224ed..323d4d9 100644 +--- a/tools/hv/hv_kvp_daemon.c ++++ b/tools/hv/hv_kvp_daemon.c +@@ -384,14 +384,18 @@ int main(void) + pfd.fd = fd; + + while (1) { ++ struct sockaddr *addr_p = (struct sockaddr *) &addr; ++ socklen_t addr_l = sizeof(addr); + pfd.events = POLLIN; + pfd.revents = 0; + poll(&pfd, 1, -1); + +- len = recv(fd, kvp_recv_buffer, sizeof(kvp_recv_buffer), 0); ++ len = recvfrom(fd, kvp_recv_buffer, sizeof(kvp_recv_buffer), 0, ++ addr_p, &addr_l); + +- if (len < 0) { +- syslog(LOG_ERR, "recv failed; error:%d", len); ++ if (len < 0 || addr.nl_pid) { ++ syslog(LOG_ERR, "recvfrom failed; pid:%u error:%d %s", ++ addr.nl_pid, errno, strerror(errno)); + close(fd); + return -1; + } diff --git a/3.2.22/4450_grsec-kconfig-default-gids.patch b/3.2.22/4450_grsec-kconfig-default-gids.patch index 123f877..545e82e 100644 --- a/3.2.22/4450_grsec-kconfig-default-gids.patch +++ b/3.2.22/4450_grsec-kconfig-default-gids.patch @@ -21,7 +21,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig config GRKERNSEC_PROC_ADD bool "Additional restrictions" -@@ -671,7 +671,7 @@ +@@ -520,7 +520,7 @@ config GRKERNSEC_AUDIT_GID int "GID for auditing" depends on GRKERNSEC_AUDIT_GROUP @@ -30,7 +30,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig config GRKERNSEC_EXECLOG bool "Exec logging" -@@ -875,7 +875,7 @@ +@@ -735,7 +735,7 @@ config GRKERNSEC_TPE_GID int "GID for untrusted users" depends on GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT @@ -39,7 +39,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig help Setting this GID determines what group TPE restrictions will be *enabled* for. If the sysctl option is enabled, a sysctl option -@@ -884,7 +884,7 @@ +@@ -744,7 +744,7 @@ config GRKERNSEC_TPE_GID int "GID for trusted users" depends on GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT @@ -48,7 +48,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig help Setting this GID determines what group TPE restrictions will be *disabled* for. If the sysctl option is enabled, a sysctl option -@@ -957,7 +957,7 @@ +@@ -819,7 +819,7 @@ config GRKERNSEC_SOCKET_ALL_GID int "GID to deny all sockets for" depends on GRKERNSEC_SOCKET_ALL @@ -57,7 +57,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig help Here you can choose the GID to disable socket access for. Remember to add the users you want socket access disabled for to the GID -@@ -978,7 +978,7 @@ +@@ -840,7 +840,7 @@ config GRKERNSEC_SOCKET_CLIENT_GID int "GID to deny client sockets for" depends on GRKERNSEC_SOCKET_CLIENT @@ -66,7 +66,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig help Here you can choose the GID to disable client socket access for. Remember to add the users you want client socket access disabled for to -@@ -996,7 +996,7 @@ +@@ -858,7 +858,7 @@ config GRKERNSEC_SOCKET_SERVER_GID int "GID to deny server sockets for" depends on GRKERNSEC_SOCKET_SERVER diff --git a/3.2.22/4465_selinux-avc_audit-log-curr_ip.patch b/3.2.22/4465_selinux-avc_audit-log-curr_ip.patch index 5a9d80c..48acad7 100644 --- a/3.2.22/4465_selinux-avc_audit-log-curr_ip.patch +++ b/3.2.22/4465_selinux-avc_audit-log-curr_ip.patch @@ -28,7 +28,7 @@ Signed-off-by: Lorenzo Hernandez Garcia-Hierro diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig --- a/grsecurity/Kconfig 2011-04-17 19:25:54.000000000 -0400 +++ b/grsecurity/Kconfig 2011-04-17 19:32:53.000000000 -0400 -@@ -1309,6 +1309,27 @@ +@@ -917,6 +917,27 @@ menu "Logging Options" depends on GRKERNSEC diff --git a/3.4.4/4450_grsec-kconfig-default-gids.patch b/3.4.4/4450_grsec-kconfig-default-gids.patch index bb24abe..6d092db 100644 --- a/3.4.4/4450_grsec-kconfig-default-gids.patch +++ b/3.4.4/4450_grsec-kconfig-default-gids.patch @@ -73,7 +73,7 @@ diff -Nuar a/grsecurity/Kconfig b/Kconfig diff -Nuar a/security/Kconfig b/security/Kconfig --- a/security/Kconfig 2012-07-01 12:51:41.000000000 -0400 +++ b/security/Kconfig 2012-07-01 13:00:23.000000000 -0400 -@@ -167,7 +167,7 @@ +@@ -186,7 +186,7 @@ config GRKERNSEC_PROC_GID int "GID exempted from /proc restrictions" -- cgit v1.2.3-65-gdbad