Linux 3.5

2012-10-16 14:00:18 -04:00 · 2012-10-16 14:00:18 -04:00 · f692e37cf5
parent 6bedaf46ce
commit f692e37cf5
18 changed files with 1908 additions and 11852 deletions
--- a/atl1c_net_next_update-3.4.patch
+++ b/atl1c_net_next_update-3.4.patch
--- a/87
+++ b/87
@ -169,6 +169,7 @@ CONFIG_MLX4_INFINIBAND=m
 CONFIG_INFINIBAND_NES=m
 # CONFIG_INFINIBAND_NES_DEBUG is not set
 CONFIG_INFINIBAND_QIB=m
+# CONFIG_INFINIBAND_OCRDMA is not set

 #
 # Executable file formats
@ -189,6 +190,8 @@ CONFIG_FW_LOADER=y
 # CONFIG_FIRMWARE_IN_KERNEL is not set
 CONFIG_EXTRA_FIRMWARE=""

+# CONFIG_CMA is not set
+
 # CONFIG_SPI is not set

 #
@ -446,6 +449,7 @@ CONFIG_VIRTIO_BLK=m
 CONFIG_VIRTIO_PCI=y
 CONFIG_VIRTIO_BALLOON=m
 CONFIG_VIRTIO_MMIO=m
+# CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES is not set
 CONFIG_VIRTIO_NET=m
 CONFIG_VMXNET3=m
 CONFIG_HW_RANDOM_VIRTIO=m
@ -589,6 +593,7 @@ CONFIG_SCSI_DC395x=m
 CONFIG_SCSI_DEBUG=m
 CONFIG_SCSI_DC390T=m
 CONFIG_SCSI_QLA_FC=m
+CONFIG_TCM_QLA2XXX=m
 CONFIG_SCSI_QLA_ISCSI=m
 # CONFIG_SCSI_IPR is not set
 # CONFIG_SCSI_DPT_I2O is not set
@ -914,6 +919,7 @@ CONFIG_NETFILTER_XT_TARGET_CONNMARK=m
 CONFIG_NETFILTER_XT_TARGET_CONNSECMARK=m
 CONFIG_NETFILTER_XT_TARGET_CT=m
 CONFIG_NETFILTER_XT_TARGET_DSCP=m
+CONFIG_NETFILTER_XT_TARGET_HMARK=m
 CONFIG_NETFILTER_XT_TARGET_IDLETIMER=m
 CONFIG_NETFILTER_XT_TARGET_LED=m
 CONFIG_NETFILTER_XT_TARGET_LOG=m
@ -1168,6 +1174,8 @@ CONFIG_NET_SCH_MQPRIO=m
 CONFIG_NET_SCH_MULTIQ=m
 CONFIG_NET_SCH_CHOKE=m
 CONFIG_NET_SCH_QFQ=m
+CONFIG_NET_SCH_CODEL=m
+CONFIG_NET_SCH_FQ_CODEL=m
 CONFIG_NET_SCH_PLUG=m
 CONFIG_NET_CLS=y
 CONFIG_NET_CLS_ACT=y
@ -1225,6 +1233,7 @@ CONFIG_IFB=m
 CONFIG_NET_TEAM=m
 CONFIG_NET_TEAM_MODE_ROUNDROBIN=m
 CONFIG_NET_TEAM_MODE_ACTIVEBACKUP=m
+CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_DUMMY=m
 CONFIG_BONDING=m
 CONFIG_MACVLAN=m
@ -1371,12 +1380,15 @@ CONFIG_E1000=m
 CONFIG_E1000E=m
 CONFIG_IGB=m
 CONFIG_IGB_DCA=y
+CONFIG_IGB_PTP=y
 CONFIG_IGBVF=m
 CONFIG_IXGB=m
 CONFIG_IXGBEVF=m
 CONFIG_IXGBE=m
 CONFIG_IXGBE_DCA=y
 CONFIG_IXGBE_DCB=y
+CONFIG_IXGBE_HWMON=y
+CONFIG_IXGBE_PTP=y

 # CONFIG_NET_VENDOR_I825XX is not set
 CONFIG_NET_VENDOR_MARVELL=y
@ -1477,6 +1489,10 @@ CONFIG_VIA_RHINE=m
 CONFIG_VIA_RHINE_MMIO=y
 CONFIG_VIA_VELOCITY=m

+CONFIG_NET_VENDOR_WIZNET=y
+CONFIG_WIZNET_W5100=m
+CONFIG_WIZNET_W5300=m
+
 CONFIG_NET_VENDOR_XIRCOM=y
 CONFIG_PCMCIA_XIRC2PS=m

@ -1529,6 +1545,7 @@ CONFIG_JME=m
 #
 CONFIG_IP1000=m
 CONFIG_MLX4_EN=m
+CONFIG_MLX4_EN_DCB=y
 # CONFIG_MLX4_DEBUG is not set
 CONFIG_SFC=m
 CONFIG_SFC_MCDI_MON=y
@ -1645,6 +1662,7 @@ CONFIG_B43LEGACY_DMA_AND_PIO_MODE=y
 CONFIG_BRCMSMAC=m
 CONFIG_BRCMFMAC=m
 CONFIG_BRCMFMAC_SDIO=y
+CONFIG_BRCMFMAC_SDIO_OOB=y
 CONFIG_BRCMFMAC_USB=y
 # CONFIG_BRCMDBG is not set
 CONFIG_HERMES=m
@ -1727,6 +1745,7 @@ CONFIG_USB_NET_RNDIS_WLAN=m
 CONFIG_USB_NET_KALMIA=m
 CONFIG_USB_NET_QMI_WWAN=m
 CONFIG_USB_NET_SMSC75XX=m
+# CONFIG_WL_TI is not set
 CONFIG_ZD1211RW=m
 # CONFIG_ZD1211RW_DEBUG is not set

@ -1749,6 +1768,7 @@ CONFIG_RTL8192DE=m
 CONFIG_MWIFIEX=m
 CONFIG_MWIFIEX_SDIO=m
 CONFIG_MWIFIEX_PCIE=m
+CONFIG_MWIFIEX_USB=m

 #
 # Token Ring devices
@ -2012,6 +2032,7 @@ CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
 CONFIG_INPUT_JOYDEV=m
 CONFIG_INPUT_EVDEV=y
 # CONFIG_INPUT_EVBUG is not set
+# CONFIG_INPUT_MATRIXKMAP is not set

 CONFIG_INPUT_TABLET=y
 CONFIG_TABLET_USB_ACECAD=m
@ -2062,6 +2083,7 @@ CONFIG_KEYBOARD_ATKBD=y
 # CONFIG_KEYBOARD_STOWAWAY is not set
 # CONFIG_KEYBOARD_LKKBD is not set
 # CONFIG_KEYBOARD_LM8323 is not set
+# CONFIG_KEYBOARD_LM8333 is not set
 # CONFIG_KEYBOARD_ADP5588 is not set
 # CONFIG_KEYBOARD_MAX7359 is not set
 # CONFIG_KEYBOARD_ADP5589 is not set
@ -2145,6 +2167,7 @@ CONFIG_TOUCHSCREEN_TOUCHWIN=m
 CONFIG_TOUCHSCREEN_PIXCIR=m
 CONFIG_TOUCHSCREEN_UCB1400=m
 CONFIG_TOUCHSCREEN_WACOM_W8001=m
+CONFIG_TOUCHSCREEN_WACOM_I2C=m
 CONFIG_TOUCHSCREEN_USB_E2I=y
 CONFIG_TOUCHSCREEN_USB_COMPOSITE=m
 # CONFIG_TOUCHSCREEN_WM97XX is not set
@ -2401,6 +2424,7 @@ CONFIG_SENSORS_WM8350=m
 CONFIG_SENSORS_WM831X=m
 CONFIG_SENSORS_LM73=m
 CONFIG_SENSORS_AMC6821=m
+CONFIG_SENSORS_INA2XX=m
 CONFIG_SENSORS_ADT7411=m
 CONFIG_SENSORS_ASC7621=m
 CONFIG_SENSORS_EMC1403=m
@ -2440,6 +2464,7 @@ CONFIG_SENSORS_MAX1668=m

 # CONFIG_HMC6352 is not set
 # CONFIG_BMP085 is not set
+# CONFIG_BMP085_I2C is not set
 # CONFIG_PCH_PHUB is not set
 # CONFIG_SERIAL_PCH_UART is not set
 # CONFIG_USB_SWITCH_FSA9480 is not set
@ -2583,10 +2608,13 @@ CONFIG_DRM=m
 # CONFIG_DRM_LOAD_EDID_FIRMWARE is not set
 CONFIG_DRM_TDFX=m
 CONFIG_DRM_R128=m
+# CONFIG_DRM_AST is not set
+# CONFIG_DRM_CIRRUS_QEMU is not set
 CONFIG_DRM_RADEON=m
 CONFIG_DRM_RADEON_KMS=y
 CONFIG_DRM_I810=m
 CONFIG_DRM_MGA=m
+# CONFIG_DRM_MGAG200 is not set
 CONFIG_DRM_SIS=m
 CONFIG_DRM_SAVAGE=m
 CONFIG_DRM_I915=m
@ -2866,6 +2894,7 @@ CONFIG_FB=y
 # CONFIG_FB_ATY_CT is not set
 # CONFIG_FB_ATY_GX is not set
 # CONFIG_FB_ASILIANT is not set
+# CONFIG_FB_AUO_K190X is not set
 # CONFIG_FB_CARMINE is not set
 # CONFIG_FB_CIRRUS is not set
 # CONFIG_FB_CYBER2000 is not set
@ -3192,7 +3221,8 @@ CONFIG_USB_HID=y

 CONFIG_HID_SUPPORT=y

-CONFIG_HID=m
+CONFIG_HID=ym
+CONFIG_HID_BATTERY_STRENGTH=y
 # debugging default is y upstream now
 CONFIG_HIDRAW=y
 CONFIG_HID_PID=y
@ -3257,6 +3287,9 @@ CONFIG_HID_WIIMOTE_EXT=y
 CONFIG_HID_KYE=m
 CONFIG_HID_SAITEK=m
 CONFIG_HID_TIVO=m
+CONFIG_HID_GENERIC=y
+CONFIG_HID_AUREAL=m
+

 #
 # USB Imaging devices
@ -3368,6 +3401,7 @@ CONFIG_USB_EPSON2888=y
 CONFIG_USB_KC2190=y

 # CONFIG_USB_MUSB_HDRC is not set
+# CONFIG_USB_CHIPIDEA is not set

 #
 # USB port drivers
@ -3444,6 +3478,7 @@ CONFIG_USB_SERIAL_QCAUX=m
 CONFIG_USB_SERIAL_VIVOPAY_SERIAL=m
 CONFIG_USB_SERIAL_DEBUG=m
 CONFIG_USB_SERIAL_SSU100=m
+CONFIG_USB_SERIAL_QT2=m

 CONFIG_USB_SERIAL_CONSOLE=y

@ -3505,6 +3540,8 @@ CONFIG_USB_ZERO=m

 CONFIG_USB_ANNOUNCE_NEW_DEVICES=y

+# CONFIG_USB_ISP1301 is not set
+
 # CONFIG_USB_OTG is not set

 #
@ -3543,6 +3580,7 @@ CONFIG_MFD_WM8400=m
 # CONFIG_MFD_WM8994 is not set
 # CONFIG_MFD_88PM860X is not set
 # CONFIG_LPC_SCH is not set
+# CONFIG_LPC_ICH is not set
 # CONFIG_HTC_I2CPLD is not set
 # CONFIG_MFD_MAX8925 is not set
 # CONFIG_MFD_ASIC3 is not set
@ -3559,6 +3597,8 @@ CONFIG_MFD_WM8400=m
 # CONFIG_MFD_TC3589X is not set
 # CONFIG_MFD_WL1273_CORE is not set
 # CONFIG_MFD_TPS65217 is not set
+# CONFIG_MFD_LM3533 is not set
+# CONFIG_MFD_MC13XXX_I2C is not set

 #
 # File systems
@ -3695,6 +3735,7 @@ CONFIG_CUSE=m
 #
 CONFIG_NETWORK_FILESYSTEMS=y
 CONFIG_NFS_FS=m
+CONFIG_NFS_V2=y
 CONFIG_NFS_V3=y
 CONFIG_NFS_V3_ACL=y
 CONFIG_NFS_V4=y
@ -3827,6 +3868,17 @@ CONFIG_NLS_ISO8859_14=m
 CONFIG_NLS_ISO8859_15=m
 CONFIG_NLS_KOI8_R=m
 CONFIG_NLS_KOI8_U=m
+CONFIG_NLS_MAC_ROMAN=m
+CONFIG_NLS_MAC_CELTIC=m
+CONFIG_NLS_MAC_CENTEURO=m
+CONFIG_NLS_MAC_CROATIAN=m
+CONFIG_NLS_MAC_CYRILLIC=m
+CONFIG_NLS_MAC_GAELIC=m
+CONFIG_NLS_MAC_GREEK=m
+CONFIG_NLS_MAC_ICELAND=m
+CONFIG_NLS_MAC_INUIT=m
+CONFIG_NLS_MAC_ROMANIAN=m
+CONFIG_NLS_MAC_TURKISH=m
 CONFIG_NLS_UTF8=m
 CONFIG_NLS_ASCII=y

@ -3849,6 +3901,7 @@ CONFIG_FRAME_POINTER=y
 # CONFIG_DEBUG_DRIVER is not set
 CONFIG_HEADERS_CHECK=y
 # CONFIG_LKDTM is not set
+# CONFIG_READABLE_ASM is not set

 # CONFIG_RT_MUTEX_TESTER is not set
 # CONFIG_DEBUG_LOCKDEP is not set
@ -3884,6 +3937,7 @@ CONFIG_LOCKUP_DETECTOR=y
 CONFIG_ATOMIC64_SELFTEST=y
 CONFIG_MEMORY_FAILURE=y
 CONFIG_HWPOISON_INJECT=m
+CONFIG_CROSS_MEMORY_ATTACH=y
 # CONFIG_DEBUG_SECTION_MISMATCH is not set
 # CONFIG_BACKTRACE_SELF_TEST is not set
 CONFIG_LATENCYTOP=y
@ -4016,6 +4070,7 @@ CONFIG_CRC_T10DIF=m
 CONFIG_CRC8=m
 # CONFIG_CRC7 is not set
 CONFIG_CORDIC=m
+# CONFIG_DDR is not set

 CONFIG_CRYPTO_ZLIB=m
 CONFIG_ZLIB_INFLATE=y
@ -4102,6 +4157,8 @@ CONFIG_PM_TRACE_RTC=y
 # CONFIG_PM_TEST_SUSPEND is not set
 CONFIG_PM_RUNTIME=y
 # CONFIG_PM_OPP is not set
+# CONFIG_PM_AUTOSLEEP is not set
+# CONFIG_PM_WAKELOCKS is not set

 CONFIG_CPU_FREQ=y
 CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
@ -4250,6 +4307,7 @@ CONFIG_LEDS_TRIGGER_IDE_DISK=y
 CONFIG_LEDS_TRIGGER_HEARTBEAT=m
 CONFIG_LEDS_TRIGGER_BACKLIGHT=m
 CONFIG_LEDS_TRIGGER_DEFAULT_ON=m
+CONFIG_LEDS_TRIGGER_TRANSIENT=m
 CONFIG_LEDS_ALIX2=m
 CONFIG_LEDS_CLEVO_MAIL=m
 CONFIG_LEDS_INTEL_SS4200=m
@ -4310,7 +4368,7 @@ CONFIG_CFAG12864B_RATE=20
 # CONFIG_PHANTOM is not set
 # CONFIG_INTEL_MID_PTI is not set

-CONFIG_POWER_SUPPLY=m
+CONFIG_POWER_SUPPLY=y
 # CONFIG_POWER_SUPPLY_DEBUG is not set

 # CONFIG_TEST_POWER is not set
@ -4401,10 +4459,10 @@ CONFIG_OPTIMIZE_INLINING=y
 # CONFIG_GPIOLIB is not set
 # CONFIG_PINCTRL is not set

-CONFIG_NET_DSA=y
-CONFIG_NET_DSA_MV88E6060=y
-CONFIG_NET_DSA_MV88E6131=y
-CONFIG_NET_DSA_MV88E6123_61_65=y
+CONFIG_NET_DSA=m
+CONFIG_NET_DSA_MV88E6060=m
+CONFIG_NET_DSA_MV88E6131=m
+CONFIG_NET_DSA_MV88E6123_61_65=m

 # Used by Maemo, we don't care.
 # CONFIG_PHONET is not set
@ -4425,6 +4483,8 @@ CONFIG_USB_WUSB_CBAF=m
 # CONFIG_USB_WUSB_CBAF_DEBUG is not set
 CONFIG_USB_WHCI_HCD=m
 CONFIG_USB_HWA_HCD=m
+# CONFIG_USB_HCD_BCMA is not set
+# CONFIG_USB_HCD_SSB is not set

 CONFIG_UWB=m
 CONFIG_UWB_HWA=m
@ -4473,7 +4533,8 @@ CONFIG_USB_ATMEL=m
 # CONFIG_EASYCAP is not set
 # CONFIG_SOLO6X10 is not set
 # CONFIG_ACPI_QUICKSTART is not set
-# CONFIG_R8712U is not set
+CONFIG_R8712U=m # Larry Finger maintains this (rhbz 699618)
+# CONFIG_R8712_AP is not set
 # CONFIG_ATH6K_LEGACY is not set
 # CONFIG_USB_ENESTORAGE is not set
 # CONFIG_BCM_WIMAX is not set
@ -4494,6 +4555,8 @@ CONFIG_ALTERA_STAPL=m
 # CONFIG_ZSMALLOC is not set
 # CONFIG_RAMSTER is not set
 # CONFIG_USB_WPAN_HCD is not set
+# CONFIG_WIMAX_GDM72XX is not set 
+# CONFIG_IPACK_BUS is not set
 #
 # END OF STAGING

@ -4534,6 +4597,12 @@ CONFIG_IEEE802154=m
 CONFIG_IEEE802154_6LOWPAN=m
 CONFIG_IEEE802154_DRIVERS=m
 CONFIG_IEEE802154_FAKEHARD=m
+CONFIG_IEEE802154_FAKELB=m
+
+CONFIG_MAC802154=m
+
+# CONFIG_EXTCON is not set
+# CONFIG_MEMORY is not set

 CONFIG_PPS=m
 # CONFIG_PPS_CLIENT_KTIMER is not set
@ -4548,6 +4617,7 @@ CONFIG_PTP_1588_CLOCK=m
 CONFIG_PTP_1588_CLOCK_PCH=m

 CONFIG_CLEANCACHE=y
+CONFIG_FRONTSWAP=y

 # CONFIG_MDIO_GPIO is not set
 # CONFIG_KEYBOARD_GPIO is not set
@ -4589,6 +4659,7 @@ CONFIG_TEST_KSTRTOX=y
 CONFIG_TARGET_CORE=m
 CONFIG_ISCSI_TARGET=m
 CONFIG_LOOPBACK_TARGET=m
+CONFIG_SBP_TARGET=m
 CONFIG_TCM_IBLOCK=m
 CONFIG_TCM_FILEIO=m
 CONFIG_TCM_PSCSI=m
@ -4597,6 +4668,7 @@ CONFIG_TCM_FC=m
 CONFIG_HWSPINLOCK=m

 CONFIG_PSTORE=y
+CONFIG_PSTORE_RAM=m

 # CONFIG_AVERAGE is not set

@ -4616,3 +4688,4 @@ CONFIG_IOMMU_SUPPORT=y
 # CONFIG_HSI is not set

 # CONFIG_PM_DEVFREQ is not set
+
--- a/4
+++ b/4
@ -359,7 +359,11 @@ CONFIG_RFKILL_GPIO=m
 # CONFIG_INPUT_GPIO_TILT_POLLED is not set
 # CONFIG_CPU_IDLE is not set
 CONFIG_STRICT_DEVMEM=y
+
+CONFIG_RCU_FANOUT_LEAF=16
+
 # CONFIG_V4L_RADIO_ISA_DRIVERS is not set
 # CONFIG_IRQ_DOMAIN_DEBUG is not set
 # CONFIG_MPIC_MSGR is not set
 # CONFIG_FA_DUMP is not set
+# CONFIG_MDIO_BUS_MUX_GPIO is not set
--- a/5
+++ b/5
@ -1,6 +1,8 @@
+CONFIG_WINDFARM_PM72=y
 CONFIG_WINDFARM_PM81=y
 CONFIG_WINDFARM_PM91=y
 CONFIG_WINDFARM_PM121=y
+CONFIG_WINDFARM_RM31=y
 CONFIG_PPC_PMAC64=y
 CONFIG_PPC_MAPLE=y
 # CONFIG_PPC_CELL is not set
@ -158,6 +160,9 @@ CONFIG_PPC_ICSWX=y
 CONFIG_IO_EVENT_IRQ=y
 CONFIG_HW_RANDOM_AMD=m

+CONFIG_HW_RANDOM_PSERIES=m
+CONFIG_CRYPTO_DEV_NX=m
+
 CONFIG_BPF_JIT=y

 # CONFIG_PPC_ICSWX_PID is not set
--- a/1
+++ b/1
@ -211,6 +211,7 @@ CONFIG_CHSC_SCH=m
 CONFIG_HVC_IUCV=y

 CONFIG_RCU_FANOUT=64
+CONFIG_RCU_FANOUT_LEAF=8

 CONFIG_SECCOMP=y

--- a/3
+++ b/3
@ -173,6 +173,7 @@ CONFIG_LEDS_SUNFIRE=m
 CONFIG_TADPOLE_TS102_UCTRL=m

 CONFIG_RCU_FANOUT=64
+CONFIG_RCU_FANOUT_LEAF=16

 CONFIG_LIRC_ENE0100=m
 # CONFIG_BATTERY_DS2782 is not set
@ -196,3 +197,5 @@ CONFIG_CRYPTO_DEV_NIAGARA2=y
 # CONFIG_MTD_PHYSMAP_OF is not set
 # CONFIG_MMC_SDHCI_OF is not set
 # CONFIG_OF_SELFTEST is not set
+
+CONFIG_BPF_JIT=y
--- a/4
+++ b/4
@ -211,5 +211,9 @@ CONFIG_I2O_BUS=m
 # CONFIG_INPUT_GPIO_TILT_POLLED is not set
 # CONFIG_GEOS is not set
 # CONFIG_NET5501 is not set
+# CONFIG_MDIO_BUS_MUX_GPIO is not set
 # CONFIG_GPIO_SODAVILLE is not set
 # CONFIG_BACKLIGHT_OT200 is not set
+
+# CONFIG_STA2X11 is not set
+
--- a/5
+++ b/5
@ -218,6 +218,7 @@ CONFIG_XO15_EBOOK=m
 # CONFIG_SMSC37B787_WDT is not set
 CONFIG_W83697HF_WDT=m
 CONFIG_VIA_WDT=m
+CONFIG_IE6XX_WDT=m

 CONFIG_CRASH_DUMP=y
 CONFIG_PROC_VMCORE=y
@ -351,6 +352,8 @@ CONFIG_TOSHIBA_BT_RFKILL=m
 CONFIG_VGA_SWITCHEROO=y
 CONFIG_LPC_SCH=m

+CONFIG_GPIO_ICH=m
+
 CONFIG_PCI_CNB20LE_QUIRK=y

 CONFIG_ACPI_EC_DEBUGFS=m
@ -405,6 +408,8 @@ CONFIG_DRM_GMA500=m
 # CONFIG_DRM_GMA600 is not set
 # CONFIG_DRM_GMA3600 is not set

+CONFIG_RCU_FANOUT_LEAF=16
+
 # Maybe enable in debug kernels?
 # CONFIG_DEBUG_NMI_SELFTEST is not set

--- a/drm-i915-fbc-stfu.patch
+++ b/drm-i915-fbc-stfu.patch
@ -1,102 +0,0 @@
-From c5d1455d9340c63e5c5d987e2d816e77538caa90 Mon Sep 17 00:00:00 2001
-From: Adam Jackson <ajax@redhat.com>
-Date: Tue, 13 Sep 2011 12:07:37 -0400
-Subject: [PATCH] drm/i915: Shut the fbc messages up
-
-FB compression enable/disable fires on pretty much every pageflip now,
-which is just uncredibly excessive.  Hush that noise.
-
-Signed-off-by: Adam Jackson <ajax@redhat.com>
---
- drivers/gpu/drm/i915/intel_display.c |   19 -------------------
- 1 files changed, 0 insertions(+), 19 deletions(-)
-
-diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index 56a8554..a6d14eb 100644
--- a/drivers/gpu/drm/i915/intel_display.c
-+++ b/drivers/gpu/drm/i915/intel_display.c
-@@ -1474,8 +1474,6 @@ static void i8xx_disable_fbc(struct drm_device *dev)
- 		DRM_DEBUG_KMS("FBC idle timed out\n");
- 		return;
- 	}
-
-	DRM_DEBUG_KMS("disabled FBC\n");
- }
- 
- static void i8xx_enable_fbc(struct drm_crtc *crtc, unsigned long interval)
-@@ -1516,9 +1514,6 @@ static void i8xx_enable_fbc(struct drm_crtc *crtc, unsigned long interval)
- 	fbc_ctl |= (interval & 0x2fff) << FBC_CTL_INTERVAL_SHIFT;
- 	fbc_ctl |= obj->fence_reg;
- 	I915_WRITE(FBC_CONTROL, fbc_ctl);
-
-	DRM_DEBUG_KMS("enabled FBC, pitch %d, yoff %d, plane %d, ",
-		      cfb_pitch, crtc->y, intel_crtc->plane);
- }
- 
- static bool i8xx_fbc_enabled(struct drm_device *dev)
-@@ -1551,8 +1546,6 @@ static void g4x_enable_fbc(struct drm_crtc *crtc, unsigned long interval)
- 
- 	/* enable it... */
- 	I915_WRITE(DPFC_CONTROL, I915_READ(DPFC_CONTROL) | DPFC_CTL_EN);
-
-	DRM_DEBUG_KMS("enabled fbc on plane %d\n", intel_crtc->plane);
- }
- 
- static void g4x_disable_fbc(struct drm_device *dev)
-@@ -1565,8 +1558,6 @@ static void g4x_disable_fbc(struct drm_device *dev)
- 	if (dpfc_ctl & DPFC_CTL_EN) {
- 		dpfc_ctl &= ~DPFC_CTL_EN;
- 		I915_WRITE(DPFC_CONTROL, dpfc_ctl);
-
-		DRM_DEBUG_KMS("disabled FBC\n");
- 	}
- }
- 
-@@ -1631,8 +1622,6 @@ static void ironlake_enable_fbc(struct drm_crtc *crtc, unsigned long interval)
- 		I915_WRITE(DPFC_CPU_FENCE_OFFSET, crtc->y);
- 		sandybridge_blit_fbc_update(dev);
- 	}
-
-	DRM_DEBUG_KMS("enabled fbc on plane %d\n", intel_crtc->plane);
- }
- 
- static void ironlake_disable_fbc(struct drm_device *dev)
-@@ -1645,8 +1634,6 @@ static void ironlake_disable_fbc(struct drm_device *dev)
- 	if (dpfc_ctl & DPFC_CTL_EN) {
- 		dpfc_ctl &= ~DPFC_CTL_EN;
- 		I915_WRITE(ILK_DPFC_CONTROL, dpfc_ctl);
-
-		DRM_DEBUG_KMS("disabled FBC\n");
- 	}
- }
- 
-@@ -1701,8 +1688,6 @@ static void intel_cancel_fbc_work(struct drm_i915_private *dev_priv)
- 	if (dev_priv->fbc_work == NULL)
- 		return;
- 
-	DRM_DEBUG_KMS("cancelling pending FBC enable\n");
-
- 	/* Synchronisation is provided by struct_mutex and checking of
- 	 * dev_priv->fbc_work, so we can perform the cancellation
- 	 * entirely asynchronously.
-@@ -1743,8 +1728,6 @@ static void intel_enable_fbc(struct drm_crtc *crtc, unsigned long interval)
- 
- 	dev_priv->fbc_work = work;
- 
-	DRM_DEBUG_KMS("scheduling delayed FBC enable\n");
-
- 	/* Delay the actual enabling to let pageflipping cease and the
- 	 * display to settle before starting the compression. Note that
- 	 * this delay also serves a second purpose: it allows for a
-@@ -1800,8 +1783,6 @@ static void intel_update_fbc(struct drm_device *dev)
- 	struct drm_i915_gem_object *obj;
- 	int enable_fbc;
- 
-	DRM_DEBUG_KMS("\n");
-
- 	if (!i915_powersave)
- 		return;
- 
-- 
-1.7.6
-
--- a/jbd-jbd2-validate-sb-s_first-in-journal_get_superblo.patch
+++ b/jbd-jbd2-validate-sb-s_first-in-journal_get_superblo.patch
@ -1,95 +0,0 @@
-From 8762202dd0d6e46854f786bdb6fb3780a1625efe Mon Sep 17 00:00:00 2001
-From: Eryu Guan <guaneryu@gmail.com>
-Date: Tue, 1 Nov 2011 19:04:59 -0400
-Subject: [PATCH] jbd/jbd2: validate sb->s_first in journal_get_superblock()
-
-I hit a J_ASSERT(blocknr != 0) failure in cleanup_journal_tail() when
-mounting a fsfuzzed ext3 image. It turns out that the corrupted ext3
-image has s_first = 0 in journal superblock, and the 0 is passed to
-journal->j_head in journal_reset(), then to blocknr in
-cleanup_journal_tail(), in the end the J_ASSERT failed.
-
-So validate s_first after reading journal superblock from disk in
-journal_get_superblock() to ensure s_first is valid.
-
-The following script could reproduce it:
-
-fstype=ext3
-blocksize=1024
-img=$fstype.img
-offset=0
-found=0
-magic="c0 3b 39 98"
-
-dd if=/dev/zero of=$img bs=1M count=8
-mkfs -t $fstype -b $blocksize -F $img
-filesize=`stat -c %s $img`
-while [ $offset -lt $filesize ]
-do
-        if od -j $offset -N 4 -t x1 $img | grep -i "$magic";then
-                echo "Found journal: $offset"
-                found=1
-                break
-        fi
-        offset=`echo "$offset+$blocksize" | bc`
-done
-
-if [ $found -ne 1 ];then
-        echo "Magic \"$magic\" not found"
-        exit 1
-fi
-
-dd if=/dev/zero of=$img seek=$(($offset+23)) conv=notrunc bs=1 count=1
-
-mkdir -p ./mnt
-mount -o loop $img ./mnt
-
-Cc: Jan Kara <jack@suse.cz>
-Signed-off-by: Eryu Guan <guaneryu@gmail.com>
-Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
---
- fs/jbd/journal.c  |    8 ++++++++
- fs/jbd2/journal.c |    8 ++++++++
- 2 files changed, 16 insertions(+), 0 deletions(-)
-
-diff --git a/fs/jbd/journal.c b/fs/jbd/journal.c
-index 9fe061f..fea8dd6 100644
--- a/fs/jbd/journal.c
-+++ b/fs/jbd/journal.c
-@@ -1135,6 +1135,14 @@ static int journal_get_superblock(journal_t *journal)
- 		goto out;
- 	}
- 
-+	if (be32_to_cpu(sb->s_first) == 0 ||
-+	    be32_to_cpu(sb->s_first) >= journal->j_maxlen) {
-+		printk(KERN_WARNING
-+			"JBD: Invalid start block of journal: %u\n",
-+			be32_to_cpu(sb->s_first));
-+		goto out;
-+	}
-+
- 	return 0;
- 
- out:
-diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
-index f24df13..d6e93d0 100644
--- a/fs/jbd2/journal.c
-+++ b/fs/jbd2/journal.c
-@@ -1251,6 +1251,14 @@ static int journal_get_superblock(journal_t *journal)
- 		goto out;
- 	}
- 
-+	if (be32_to_cpu(sb->s_first) == 0 ||
-+	    be32_to_cpu(sb->s_first) >= journal->j_maxlen) {
-+		printk(KERN_WARNING
-+			"JBD2: Invalid start block of journal: %u\n",
-+			be32_to_cpu(sb->s_first));
-+		goto out;
-+	}
-+
- 	return 0;
- 
- out:
-- 
-1.7.7.1
-
--- a/kernel.spec
+++ b/kernel.spec
@ -60,13 +60,13 @@ Summary: The Linux kernel
 # base_sublevel is the kernel version we're starting with and patching
 # on top of -- for example, 2.6.22-rc7-git1 starts with a 2.6.21 base,
 # which yields a base_sublevel of 21.
-%define base_sublevel 4
+%define base_sublevel 5

 ## If this is a released kernel ##
 %if 0%{?released_kernel}

 # Do we have a -stable update to apply?
-%define stable_update 14
+%define stable_update 0
 # Is it a -stable RC?
 %define stable_rc 0
 # Set rpm version accordingly
@ -643,9 +643,6 @@ Patch800: linux-2.6-crash-driver.patch
 Patch1824: drm-intel-next.patch
 Patch1825: drm-i915-dp-stfu.patch

-# hush the i915 fbc noise
-Patch1826: drm-i915-fbc-stfu.patch
-
 Patch1900: linux-2.6-intel-iommu-igfx.patch

 # Quiet boot fixes
@ -657,9 +654,6 @@ Patch2901: drivers-media-update.patch

 # fs fixes

-#rhbz 753346
-Patch3500: jbd-jbd2-validate-sb-s_first-in-journal_get_superblo.patch
-
 # NFSv4

 # patches headed upstream
@ -675,9 +669,7 @@ Patch14010: lis3-improve-handling-of-null-rate.patch
 Patch19000: ips-noirq.patch

 # Uprobes (rhbz 832083)
-Patch20000: uprobes-3.4-backport.patch
-Patch20001: uprobes-3.4-tip.patch
-Patch20002: uprobes-task_work_add-generic-process-context-callbacks.patch
+Patch20000: uprobes-backport.patch

 #rhbz 769766
 Patch21072: mac80211-fix-rx-key-NULL-ptr-deref-in-promiscuous-mode.patch
@ -696,9 +688,6 @@ Patch21306: shlib_base_randomize.patch
 Patch30000: weird-root-dentry-name-debug.patch
 Patch30010: debug-808990.patch

-#rhbz 749276
-Patch22018: atl1c_net_next_update-3.4.patch
-
 #Fix FIPS for aesni hardare
 Patch22055: crypto-testmgr-allow-aesni-intel-and-ghash_clmulni-intel.patch
 Patch22056: crypto-aesni-intel-fix-wrong-kfree-pointer.patch
@ -1199,10 +1188,6 @@ ApplyPatch taint-vbox.patch
 # bugfixes to drivers and filesystems
 #

-# ext4
-#rhbz 753346
-ApplyPatch jbd-jbd2-validate-sb-s_first-in-journal_get_superblo.patch
-
 # xfs

 # btrfs
@ -1274,7 +1259,6 @@ ApplyPatch linux-2.6-e1000-ich9-montevina.patch
 # Intel DRM
 ApplyOptionalPatch drm-intel-next.patch
 ApplyPatch drm-i915-dp-stfu.patch
-ApplyPatch drm-i915-fbc-stfu.patch

 ApplyPatch linux-2.6-intel-iommu-igfx.patch

@ -1302,9 +1286,7 @@ ApplyPatch ips-noirq.patch
 #ApplyPatch pci-crs-blacklist.patch

 # Uprobes (rhbz 832083)
-ApplyPatch uprobes-3.4-backport.patch
-ApplyPatch uprobes-3.4-tip.patch
-ApplyPatch uprobes-task_work_add-generic-process-context-callbacks.patch
+ApplyPatch uprobes-backport.patch

 #rhbz 754518
 #ApplyPatch scsi-sd_revalidate_disk-prevent-NULL-ptr-deref.patch
@ -1315,9 +1297,6 @@ ApplyPatch unhandled-irqs-switch-to-polling.patch
 ApplyPatch weird-root-dentry-name-debug.patch
 ApplyPatch debug-808990.patch

-#rhbz 749276
-ApplyPatch atl1c_net_next_update-3.4.patch
-
 #Fix FIPS for aesni hardare
 ApplyPatch crypto-testmgr-allow-aesni-intel-and-ghash_clmulni-intel.patch
 ApplyPatch crypto-aesni-intel-fix-wrong-kfree-pointer.patch
@ -2022,6 +2001,9 @@ fi
 # and build.

 %changelog
+* Tue Oct 16 2012 Dave Jones <davej@redhat.com> 3.5.0-1
+- Linux 3.5
+
 * Tue Oct 16 2012 Dave Jones <davej@redhat.com> 3.4.14-1
 - Linux 3.4.14

--- a/linux-2.6-input-kill-stupid-messages.patch
+++ b/linux-2.6-input-kill-stupid-messages.patch
@ -1,32 +1,20 @@
-From b2c6d55b2351152696aafb8c9bf3ec8968acf77c Mon Sep 17 00:00:00 2001
-From: Kyle McMartin <kyle@phobos.i.jkkm.org>
-Date: Mon, 29 Mar 2010 23:59:58 -0400
-Subject: linux-2.6-input-kill-stupid-messages
-
---
- drivers/input/keyboard/atkbd.c |    5 +++++
- 1 files changed, 5 insertions(+), 0 deletions(-)
-
 diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
-index d358ef8..38db098 100644
+index add5ffd..5eb2f03 100644
 --- a/drivers/input/keyboard/atkbd.c
 +++ b/drivers/input/keyboard/atkbd.c
-@@ -425,11 +426,15 @@ static irqreturn_t atkbd_interrupt(struct serio *serio, unsigned char data,
+@@ -430,11 +430,15 @@ static irqreturn_t atkbd_interrupt(struct serio *serio, unsigned char data,
 		goto out;
 	case ATKBD_RET_ACK:
 	case ATKBD_RET_NAK:
-+#if 0
+# if 0
 +		/* Quite a few key switchers and other tools trigger this
 +		 * and it confuses people who can do nothing about it */
 		if (printk_ratelimit())
 			dev_warn(&serio->dev,
 				 "Spurious %s on %s. "
- 				 "Some program might be trying access hardware directly.\n",
+ 				 "Some program might be trying to access hardware directly.\n",
 				 data == ATKBD_RET_ACK ? "ACK" : "NAK", serio->phys);
 +#endif
 		goto out;
 	case ATKBD_RET_ERR:
 		atkbd->err_count++;
-- 
-1.7.0.1
-
--- a/linux-2.6-makefile-after_link.patch
+++ b/linux-2.6-makefile-after_link.patch
@ -1,4 +1,4 @@
-From f072f7db2194c8255c003d985b61ad2f97ebbee0 Mon Sep 17 00:00:00 2001
+From b707aea6a4947c3806ced2c23e889943a0f36876 Mon Sep 17 00:00:00 2001
 From: Roland McGrath <roland@redhat.com>
 Date: Mon, 6 Oct 2008 23:03:03 -0700
 Subject: [PATCH] kbuild: AFTER_LINK
@ -7,24 +7,9 @@ If the make variable AFTER_LINK is set, it is a command line to run
 after each final link.  This includes vmlinux itself and vDSO images.

 Signed-off-by: Roland McGrath <roland@redhat.com>
---
-diff --git a/Makefile b/Makefile
-index f908acc..960ff6f 100644
--- a/Makefile
-+++ b/Makefile
-@@ -746,6 +746,10 @@ quiet_cmd_vmlinux__ ?= LD      $@
-       --start-group $(vmlinux-main) --end-group                  \
-       $(filter-out $(vmlinux-lds) $(vmlinux-init) $(vmlinux-main) vmlinux.o FORCE ,$^)
- 
-+ifdef AFTER_LINK
-+cmd_vmlinux__ += ; $(AFTER_LINK)
-+endif
-+
- # Generate new vmlinux version
- quiet_cmd_vmlinux_version = GEN     .version
-       cmd_vmlinux_version = set -e;                     \
+
 diff --git a/arch/powerpc/kernel/vdso32/Makefile b/arch/powerpc/kernel/vdso32/Makefile
-index 51ead52..ad21273 100644
+index 9a7946c..28d6765 100644
 --- a/arch/powerpc/kernel/vdso32/Makefile
 +++ b/arch/powerpc/kernel/vdso32/Makefile
@@ -41,7 +41,8 @@ $(obj-vdso32): %.o: %.S
@ -38,7 +23,7 @@ index 51ead52..ad21273 100644
       cmd_vdso32as = $(CROSS32CC) $(a_flags) -c -o $@ $<
 
 diff --git a/arch/powerpc/kernel/vdso64/Makefile b/arch/powerpc/kernel/vdso64/Makefile
-index 79da65d..f11c21b 100644
+index 8c500d8..d27737b 100644
 --- a/arch/powerpc/kernel/vdso64/Makefile
 +++ b/arch/powerpc/kernel/vdso64/Makefile
@@ -36,7 +36,8 @@ $(obj-vdso64): %.o: %.S
@ -51,11 +36,39 @@ index 79da65d..f11c21b 100644
 quiet_cmd_vdso64as = VDSO64A $@
       cmd_vdso64as = $(CC) $(a_flags) -c -o $@ $<
 
+diff --git a/arch/s390/kernel/vdso32/Makefile b/arch/s390/kernel/vdso32/Makefile
+index 8ad2b34..e153572 100644
+--- a/arch/s390/kernel/vdso32/Makefile
+++ b/arch/s390/kernel/vdso32/Makefile
+@@ -43,7 +43,8 @@ $(obj-vdso32): %.o: %.S
+ 
+ # actual build commands
+ quiet_cmd_vdso32ld = VDSO32L $@
+-      cmd_vdso32ld = $(CC) $(c_flags) -Wl,-T $^ -o $@
+      cmd_vdso32ld = $(CC) $(c_flags) -Wl,-T $^ -o $@ \
+		     $(if $(AFTER_LINK),; $(AFTER_LINK))
+ quiet_cmd_vdso32as = VDSO32A $@
+       cmd_vdso32as = $(CC) $(a_flags) -c -o $@ $<
+ 
+diff --git a/arch/s390/kernel/vdso64/Makefile b/arch/s390/kernel/vdso64/Makefile
+index 2a8ddfd..452ca53 100644
+--- a/arch/s390/kernel/vdso64/Makefile
+++ b/arch/s390/kernel/vdso64/Makefile
+@@ -43,7 +43,8 @@ $(obj-vdso64): %.o: %.S
+ 
+ # actual build commands
+ quiet_cmd_vdso64ld = VDSO64L $@
+-      cmd_vdso64ld = $(CC) $(c_flags) -Wl,-T $^ -o $@
+      cmd_vdso64ld = $(CC) $(c_flags) -Wl,-T $^ -o $@ \
+		     $(if $(AFTER_LINK),; $(AFTER_LINK))
+ quiet_cmd_vdso64as = VDSO64A $@
+       cmd_vdso64as = $(CC) $(a_flags) -c -o $@ $<
+ 
 diff --git a/arch/x86/vdso/Makefile b/arch/x86/vdso/Makefile
-index 4a2afa1..12ad9f7 100644
+index fd14be1..1f3eb19 100644
 --- a/arch/x86/vdso/Makefile
 +++ b/arch/x86/vdso/Makefile
-@@ -120,8 +120,9 @@ $(obj)/vdso32-syms.lds: $(vdso32.so-y:%=$(obj)/vdso32-%-syms.lds) FORCE
+@@ -178,8 +178,9 @@ $(obj)/vdso32-syms.lds: $(vdso32.so-y:%=$(obj)/vdso32-%-syms.lds) FORCE
 quiet_cmd_vdso = VDSO    $@
       cmd_vdso = $(CC) -nostdlib -o $@ \
 		       $(VDSO_LDFLAGS) $(VDSO_LDFLAGS_$(filter %.lds,$(^F))) \
@ -67,32 +80,21 @@ index 4a2afa1..12ad9f7 100644
 
 VDSO_LDFLAGS = -fPIC -shared $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
 GCOV_PROFILE := n
+diff --git a/scripts/link-vmlinux.sh b/scripts/link-vmlinux.sh
+index cd9c6c6..3edf048 100644
+--- a/scripts/link-vmlinux.sh
+++ b/scripts/link-vmlinux.sh
+@@ -65,6 +65,10 @@ vmlinux_link()
+ 			-lutil ${1}
+ 		rm -f linux
+ 	fi
+	if [ -n "${AFTER_LINK}" ]; then
+		/usr/lib/rpm/debugedit -b ${RPM_BUILD_DIR} -d /usr/src/debug -i ${2} \
+			> ${2}.id
+	fi
+ }
+ 
+ 
+-- 
+1.7.7.6

-diff --git a/arch/s390/kernel/vdso32/Makefile b/arch/s390/kernel/vdso32/Makefile
-index d13e875..28a3e1ad 100644
--- a/arch/s390/kernel/vdso32/Makefile
-+++ b/arch/s390/kernel/vdso32/Makefile
-@@ -40,7 +40,8 @@ $(obj-vdso32): %.o: %.S
- 
- # actual build commands
- quiet_cmd_vdso32ld = VDSO32L $@
-      cmd_vdso32ld = $(CC) $(c_flags) -Wl,-T $^ -o $@
-+      cmd_vdso32ld = $(CC) $(c_flags) -Wl,-T $^ -o $@ \
-+		     $(if $(AFTER_LINK),; $(AFTER_LINK))
- quiet_cmd_vdso32as = VDSO32A $@
-       cmd_vdso32as = $(CC) $(a_flags) -c -o $@ $<
- 
-diff --git a/arch/s390/kernel/vdso64/Makefile b/arch/s390/kernel/vdso64/Makefile
-index 449352d..e90e656 100644
--- a/arch/s390/kernel/vdso64/Makefile
-+++ b/arch/s390/kernel/vdso64/Makefile
-@@ -40,7 +40,8 @@ $(obj-vdso64): %.o: %.S
- 
- # actual build commands
- quiet_cmd_vdso64ld = VDSO64L $@
-      cmd_vdso64ld = $(CC) $(c_flags) -Wl,-T $^ -o $@
-+      cmd_vdso64ld = $(CC) $(c_flags) -Wl,-T $^ -o $@ \
-+		     $(if $(AFTER_LINK),; $(AFTER_LINK))
- quiet_cmd_vdso64as = VDSO64A $@
-       cmd_vdso64as = $(CC) $(a_flags) -c -o $@ $<
- 
--- a/scsi-sd_revalidate_disk-prevent-NULL-ptr-deref.patch
+++ b/scsi-sd_revalidate_disk-prevent-NULL-ptr-deref.patch
@ -12,7 +12,7 @@
 	SCSI_LOG_HLQUEUE(3, sd_printk(KERN_INFO, sdkp,
 				      "sd_revalidate_disk\n"));
 
-+	if (!sdkp)
+	if (WARN_ONCE((!sdkp), "Invalid scsi_disk from %p\n", disk))
 +		goto out;
 +
 +	sdp = sdkp->device;
--- a/3
+++ b/3
@ -1,2 +1 @@
-967f72983655e2479f951195953e8480  linux-3.4.tar.xz
-c3225a0538db8486d991c1af70f5f0a4  patch-3.4.14.xz
+24153eaaa81dedc9481ada8cd9c3b83d  linux-3.5.tar.xz
--- a/uprobes-3.4-backport.patch
+++ b/uprobes-3.4-backport.patch
--- a/uprobes-3.4-tip.patch
+++ b/uprobes-3.4-tip.patch
@ -1,915 +0,0 @@
-The split-out series is available in the git repository at:
-
-  git://fedorapeople.org/home/fedora/aarapov/public_git/kernel-uprobes.git tags/f17_exported
-
-Ananth N Mavinakayanahalli (1):
-      uprobes: Pass probed vaddr to arch_uprobe_analyze_insn()
-
-Josh Stone (1):
-      uprobes: add exports necessary for uprobes use by modules
-
-Oleg Nesterov (21):
-      uprobes: Optimize is_swbp_at_addr() for current->mm
-      uprobes: Change read_opcode() to use FOLL_FORCE
-      uprobes: Introduce find_active_uprobe() helper
-      uprobes: Teach find_active_uprobe() to provide the "is_swbp" info
-      uprobes: Change register_for_each_vma() to take mm->mmap_sem for writing
-      uprobes: Teach handle_swbp() to rely on "is_swbp" rather than uprobes_srcu
-      uprobes: Kill uprobes_srcu/uprobe_srcu_id
-      uprobes: Valid_vma() should reject VM_HUGETLB
-      uprobes: __copy_insn() should ensure a_ops->readpage != NULL
-      uprobes: Write_opcode()->__replace_page() can race with try_to_unmap()
-      uprobes: Install_breakpoint() should fail if is_swbp_insn() == T
-      uprobes: Rework register_for_each_vma() to make it O(n)
-      uprobes: Change build_map_info() to try kmalloc(GFP_NOWAIT) first
-      uprobes: Copy_insn() shouldn't depend on mm/vma/vaddr
-      uprobes: Copy_insn() should not return -ENOMEM if __copy_insn() fails
-      uprobes: No need to re-check vma_address() in write_opcode()
-      uprobes: Simplify the usage of uprobe->pending_list
-      uprobes: Don't use loff_t for the valid virtual address
-      uprobes: __copy_insn() needs "loff_t offset"
-      uprobes: Remove the unnecessary initialization in add_utask()
-      uprobes: Move BUG_ON(UPROBE_SWBP_INSN_SIZE) from write_opcode() to install_breakpoint()
-
-Peter Zijlstra (1):
-      uprobes: Document uprobe_register() vs uprobe_mmap() race
-
-Signed-off-by: Anton Arapov <anton@redhat.com>
---
- arch/x86/include/asm/uprobes.h |    2 +-
- arch/x86/kernel/ptrace.c       |    6 +
- arch/x86/kernel/uprobes.c      |    3 +-
- include/linux/sched.h          |    1 -
- kernel/events/uprobes.c        |  464 ++++++++++++++++++++--------------------
- 5 files changed, 240 insertions(+), 236 deletions(-)
-
-diff --git a/arch/x86/include/asm/uprobes.h b/arch/x86/include/asm/uprobes.h
-index 1e9bed1..f3971bb 100644
--- a/arch/x86/include/asm/uprobes.h
-+++ b/arch/x86/include/asm/uprobes.h
-@@ -48,7 +48,7 @@ struct arch_uprobe_task {
- #endif
- };
- 
-extern int  arch_uprobe_analyze_insn(struct arch_uprobe *aup, struct mm_struct *mm);
-+extern int  arch_uprobe_analyze_insn(struct arch_uprobe *aup, struct mm_struct *mm, unsigned long addr);
- extern int  arch_uprobe_pre_xol(struct arch_uprobe *aup, struct pt_regs *regs);
- extern int  arch_uprobe_post_xol(struct arch_uprobe *aup, struct pt_regs *regs);
- extern bool arch_uprobe_xol_was_trapped(struct task_struct *tsk);
-diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
-index cf11783..4609190 100644
--- a/arch/x86/kernel/ptrace.c
-+++ b/arch/x86/kernel/ptrace.c
-@@ -1415,6 +1415,12 @@ const struct user_regset_view *task_user_regset_view(struct task_struct *task)
- #endif
- }
- 
-+/*
-+ * This is declared in linux/regset.h and defined in machine-dependent
-+ * code.  We put the export here to ensure no machine forgets it.
-+ */
-+EXPORT_SYMBOL_GPL(task_user_regset_view);
-+
- static void fill_sigtrap_info(struct task_struct *tsk,
- 				struct pt_regs *regs,
- 				int error_code, int si_code,
-diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
-index dc4e910..36fd420 100644
--- a/arch/x86/kernel/uprobes.c
-+++ b/arch/x86/kernel/uprobes.c
-@@ -409,9 +409,10 @@ static int validate_insn_bits(struct arch_uprobe *auprobe, struct mm_struct *mm,
-  * arch_uprobe_analyze_insn - instruction analysis including validity and fixups.
-  * @mm: the probed address space.
-  * @arch_uprobe: the probepoint information.
-+ * @addr: virtual address at which to install the probepoint
-  * Return 0 on success or a -ve number on error.
-  */
-int arch_uprobe_analyze_insn(struct arch_uprobe *auprobe, struct mm_struct *mm)
-+int arch_uprobe_analyze_insn(struct arch_uprobe *auprobe, struct mm_struct *mm, unsigned long addr)
- {
- 	int ret;
- 	struct insn insn;
-diff --git a/include/linux/sched.h b/include/linux/sched.h
-index cff94cd..6869c60 100644
--- a/include/linux/sched.h
-+++ b/include/linux/sched.h
-@@ -1619,7 +1619,6 @@ struct task_struct {
- #endif
- #ifdef CONFIG_UPROBES
- 	struct uprobe_task *utask;
-	int uprobe_srcu_id;
- #endif
- };
- 
-diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
-index 985be4d..d9e5ba5 100644
--- a/kernel/events/uprobes.c
-+++ b/kernel/events/uprobes.c
-@@ -34,17 +34,34 @@
- #include <linux/kdebug.h>	/* notifier mechanism */
- 
- #include <linux/uprobes.h>
-+#include <linux/export.h>
- 
- #define UINSNS_PER_PAGE			(PAGE_SIZE/UPROBE_XOL_SLOT_BYTES)
- #define MAX_UPROBE_XOL_SLOTS		UINSNS_PER_PAGE
- 
-static struct srcu_struct uprobes_srcu;
- static struct rb_root uprobes_tree = RB_ROOT;
- 
- static DEFINE_SPINLOCK(uprobes_treelock);	/* serialize rbtree access */
- 
- #define UPROBES_HASH_SZ	13
- 
-+/*
-+ * We need separate register/unregister and mmap/munmap lock hashes because
-+ * of mmap_sem nesting.
-+ *
-+ * uprobe_register() needs to install probes on (potentially) all processes
-+ * and thus needs to acquire multiple mmap_sems (consequtively, not
-+ * concurrently), whereas uprobe_mmap() is called while holding mmap_sem
-+ * for the particular process doing the mmap.
-+ *
-+ * uprobe_register()->register_for_each_vma() needs to drop/acquire mmap_sem
-+ * because of lock order against i_mmap_mutex. This means there's a hole in
-+ * the register vma iteration where a mmap() can happen.
-+ *
-+ * Thus uprobe_register() can race with uprobe_mmap() and we can try and
-+ * install a probe where one is already installed.
-+ */
-+
- /* serialize (un)register */
- static struct mutex uprobes_mutex[UPROBES_HASH_SZ];
- 
-@@ -61,17 +78,6 @@ static struct mutex uprobes_mmap_mutex[UPROBES_HASH_SZ];
-  */
- static atomic_t uprobe_events = ATOMIC_INIT(0);
- 
-/*
- * Maintain a temporary per vma info that can be used to search if a vma
- * has already been handled. This structure is introduced since extending
- * vm_area_struct wasnt recommended.
- */
-struct vma_info {
-	struct list_head	probe_list;
-	struct mm_struct	*mm;
-	loff_t			vaddr;
-};
-
- struct uprobe {
- 	struct rb_node		rb_node;	/* node in the rb tree */
- 	atomic_t		ref;
-@@ -100,7 +106,8 @@ static bool valid_vma(struct vm_area_struct *vma, bool is_register)
- 	if (!is_register)
- 		return true;
- 
-	if ((vma->vm_flags & (VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)) == (VM_READ|VM_EXEC))
-+	if ((vma->vm_flags & (VM_HUGETLB|VM_READ|VM_WRITE|VM_EXEC|VM_SHARED))
-+				== (VM_READ|VM_EXEC))
- 		return true;
- 
- 	return false;
-@@ -129,33 +136,17 @@ static loff_t vma_address(struct vm_area_struct *vma, loff_t offset)
- static int __replace_page(struct vm_area_struct *vma, struct page *page, struct page *kpage)
- {
- 	struct mm_struct *mm = vma->vm_mm;
-	pgd_t *pgd;
-	pud_t *pud;
-	pmd_t *pmd;
-	pte_t *ptep;
-	spinlock_t *ptl;
- 	unsigned long addr;
-	int err = -EFAULT;
-+	spinlock_t *ptl;
-+	pte_t *ptep;
- 
- 	addr = page_address_in_vma(page, vma);
- 	if (addr == -EFAULT)
-		goto out;
-
-	pgd = pgd_offset(mm, addr);
-	if (!pgd_present(*pgd))
-		goto out;
-
-	pud = pud_offset(pgd, addr);
-	if (!pud_present(*pud))
-		goto out;
-
-	pmd = pmd_offset(pud, addr);
-	if (!pmd_present(*pmd))
-		goto out;
-+		return -EFAULT;
- 
-	ptep = pte_offset_map_lock(mm, pmd, addr, &ptl);
-+	ptep = page_check_address(page, mm, addr, &ptl, 0);
- 	if (!ptep)
-		goto out;
-+		return -EAGAIN;
- 
- 	get_page(kpage);
- 	page_add_new_anon_rmap(kpage, vma, addr);
-@@ -174,10 +165,8 @@ static int __replace_page(struct vm_area_struct *vma, struct page *page, struct
- 		try_to_free_swap(page);
- 	put_page(page);
- 	pte_unmap_unlock(ptep, ptl);
-	err = 0;
- 
-out:
-	return err;
-+	return 0;
- }
- 
- /**
-@@ -222,9 +211,8 @@ static int write_opcode(struct arch_uprobe *auprobe, struct mm_struct *mm,
- 	void *vaddr_old, *vaddr_new;
- 	struct vm_area_struct *vma;
- 	struct uprobe *uprobe;
-	loff_t addr;
- 	int ret;
-
-+retry:
- 	/* Read the page with vaddr into memory */
- 	ret = get_user_pages(NULL, mm, vaddr, 1, 0, 0, &old_page, &vma);
- 	if (ret <= 0)
-@@ -246,10 +234,6 @@ static int write_opcode(struct arch_uprobe *auprobe, struct mm_struct *mm,
- 	if (mapping != vma->vm_file->f_mapping)
- 		goto put_out;
- 
-	addr = vma_address(vma, uprobe->offset);
-	if (vaddr != (unsigned long)addr)
-		goto put_out;
-
- 	ret = -ENOMEM;
- 	new_page = alloc_page_vma(GFP_HIGHUSER_MOVABLE, vma, vaddr);
- 	if (!new_page)
-@@ -267,11 +251,7 @@ static int write_opcode(struct arch_uprobe *auprobe, struct mm_struct *mm,
- 	vaddr_new = kmap_atomic(new_page);
- 
- 	memcpy(vaddr_new, vaddr_old, PAGE_SIZE);
-
-	/* poke the new insn in, ASSUMES we don't cross page boundary */
-	vaddr &= ~PAGE_MASK;
-	BUG_ON(vaddr + UPROBE_SWBP_INSN_SIZE > PAGE_SIZE);
-	memcpy(vaddr_new + vaddr, &opcode, UPROBE_SWBP_INSN_SIZE);
-+	memcpy(vaddr_new + (vaddr & ~PAGE_MASK), &opcode, UPROBE_SWBP_INSN_SIZE);
- 
- 	kunmap_atomic(vaddr_new);
- 	kunmap_atomic(vaddr_old);
-@@ -291,6 +271,8 @@ unlock_out:
- put_out:
- 	put_page(old_page);
- 
-+	if (unlikely(ret == -EAGAIN))
-+		goto retry;
- 	return ret;
- }
- 
-@@ -312,7 +294,7 @@ static int read_opcode(struct mm_struct *mm, unsigned long vaddr, uprobe_opcode_
- 	void *vaddr_new;
- 	int ret;
- 
-	ret = get_user_pages(NULL, mm, vaddr, 1, 0, 0, &page, NULL);
-+	ret = get_user_pages(NULL, mm, vaddr, 1, 0, 1, &page, NULL);
- 	if (ret <= 0)
- 		return ret;
- 
-@@ -333,10 +315,20 @@ static int is_swbp_at_addr(struct mm_struct *mm, unsigned long vaddr)
- 	uprobe_opcode_t opcode;
- 	int result;
- 
-+	if (current->mm == mm) {
-+		pagefault_disable();
-+		result = __copy_from_user_inatomic(&opcode, (void __user*)vaddr,
-+								sizeof(opcode));
-+		pagefault_enable();
-+
-+		if (likely(result == 0))
-+			goto out;
-+	}
-+
- 	result = read_opcode(mm, vaddr, &opcode);
- 	if (result)
- 		return result;
-
-+out:
- 	if (is_swbp_insn(&opcode))
- 		return 1;
- 
-@@ -355,7 +347,9 @@ static int is_swbp_at_addr(struct mm_struct *mm, unsigned long vaddr)
- int __weak set_swbp(struct arch_uprobe *auprobe, struct mm_struct *mm, unsigned long vaddr)
- {
- 	int result;
-
-+	/*
-+	 * See the comment near uprobes_hash().
-+	 */
- 	result = is_swbp_at_addr(mm, vaddr);
- 	if (result == 1)
- 		return -EEXIST;
-@@ -520,7 +514,6 @@ static struct uprobe *alloc_uprobe(struct inode *inode, loff_t offset)
- 	uprobe->inode = igrab(inode);
- 	uprobe->offset = offset;
- 	init_rwsem(&uprobe->consumer_rwsem);
-	INIT_LIST_HEAD(&uprobe->pending_list);
- 
- 	/* add to uprobes_tree, sorted on inode:offset */
- 	cur_uprobe = insert_uprobe(uprobe);
-@@ -588,20 +581,22 @@ static bool consumer_del(struct uprobe *uprobe, struct uprobe_consumer *uc)
- }
- 
- static int
-__copy_insn(struct address_space *mapping, struct vm_area_struct *vma, char *insn,
-			unsigned long nbytes, unsigned long offset)
-+__copy_insn(struct address_space *mapping, struct file *filp, char *insn,
-+			unsigned long nbytes, loff_t offset)
- {
-	struct file *filp = vma->vm_file;
- 	struct page *page;
- 	void *vaddr;
-	unsigned long off1;
-	unsigned long idx;
-+	unsigned long off;
-+	pgoff_t idx;
- 
- 	if (!filp)
- 		return -EINVAL;
- 
-	idx = (unsigned long)(offset >> PAGE_CACHE_SHIFT);
-	off1 = offset &= ~PAGE_MASK;
-+	if (!mapping->a_ops->readpage)
-+		return -EIO;
-+
-+	idx = offset >> PAGE_CACHE_SHIFT;
-+	off = offset & ~PAGE_MASK;
- 
- 	/*
- 	 * Ensure that the page that has the original instruction is
-@@ -612,22 +607,20 @@ __copy_insn(struct address_space *mapping, struct vm_area_struct *vma, char *ins
- 		return PTR_ERR(page);
- 
- 	vaddr = kmap_atomic(page);
-	memcpy(insn, vaddr + off1, nbytes);
-+	memcpy(insn, vaddr + off, nbytes);
- 	kunmap_atomic(vaddr);
- 	page_cache_release(page);
- 
- 	return 0;
- }
- 
-static int
-copy_insn(struct uprobe *uprobe, struct vm_area_struct *vma, unsigned long addr)
-+static int copy_insn(struct uprobe *uprobe, struct file *filp)
- {
- 	struct address_space *mapping;
- 	unsigned long nbytes;
- 	int bytes;
- 
-	addr &= ~PAGE_MASK;
-	nbytes = PAGE_SIZE - addr;
-+	nbytes = PAGE_SIZE - (uprobe->offset & ~PAGE_MASK);
- 	mapping = uprobe->inode->i_mapping;
- 
- 	/* Instruction at end of binary; copy only available bytes */
-@@ -638,13 +631,13 @@ copy_insn(struct uprobe *uprobe, struct vm_area_struct *vma, unsigned long addr)
- 
- 	/* Instruction at the page-boundary; copy bytes in second page */
- 	if (nbytes < bytes) {
-		if (__copy_insn(mapping, vma, uprobe->arch.insn + nbytes,
-				bytes - nbytes, uprobe->offset + nbytes))
-			return -ENOMEM;
-
-+		int err = __copy_insn(mapping, filp, uprobe->arch.insn + nbytes,
-+				bytes - nbytes, uprobe->offset + nbytes);
-+		if (err)
-+			return err;
- 		bytes = nbytes;
- 	}
-	return __copy_insn(mapping, vma, uprobe->arch.insn, bytes, uprobe->offset);
-+	return __copy_insn(mapping, filp, uprobe->arch.insn, bytes, uprobe->offset);
- }
- 
- /*
-@@ -672,9 +665,8 @@ copy_insn(struct uprobe *uprobe, struct vm_area_struct *vma, unsigned long addr)
-  */
- static int
- install_breakpoint(struct uprobe *uprobe, struct mm_struct *mm,
-			struct vm_area_struct *vma, loff_t vaddr)
-+			struct vm_area_struct *vma, unsigned long vaddr)
- {
-	unsigned long addr;
- 	int ret;
- 
- 	/*
-@@ -687,20 +679,22 @@ install_breakpoint(struct uprobe *uprobe, struct mm_struct *mm,
- 	if (!uprobe->consumers)
- 		return -EEXIST;
- 
-	addr = (unsigned long)vaddr;
-
- 	if (!(uprobe->flags & UPROBE_COPY_INSN)) {
-		ret = copy_insn(uprobe, vma, addr);
-+		ret = copy_insn(uprobe, vma->vm_file);
- 		if (ret)
- 			return ret;
- 
- 		if (is_swbp_insn((uprobe_opcode_t *)uprobe->arch.insn))
-			return -EEXIST;
-+			return -ENOTSUPP;
- 
-		ret = arch_uprobe_analyze_insn(&uprobe->arch, mm);
-+		ret = arch_uprobe_analyze_insn(&uprobe->arch, mm, vaddr);
- 		if (ret)
- 			return ret;
- 
-+		/* write_opcode() assumes we don't cross page boundary */
-+		BUG_ON((uprobe->offset & ~PAGE_MASK) +
-+				UPROBE_SWBP_INSN_SIZE > PAGE_SIZE);
-+
- 		uprobe->flags |= UPROBE_COPY_INSN;
- 	}
- 
-@@ -713,7 +707,7 @@ install_breakpoint(struct uprobe *uprobe, struct mm_struct *mm,
- 	 * Hence increment before and decrement on failure.
- 	 */
- 	atomic_inc(&mm->uprobes_state.count);
-	ret = set_swbp(&uprobe->arch, mm, addr);
-+	ret = set_swbp(&uprobe->arch, mm, vaddr);
- 	if (ret)
- 		atomic_dec(&mm->uprobes_state.count);
- 
-@@ -721,27 +715,21 @@ install_breakpoint(struct uprobe *uprobe, struct mm_struct *mm,
- }
- 
- static void
-remove_breakpoint(struct uprobe *uprobe, struct mm_struct *mm, loff_t vaddr)
-+remove_breakpoint(struct uprobe *uprobe, struct mm_struct *mm, unsigned long vaddr)
- {
-	if (!set_orig_insn(&uprobe->arch, mm, (unsigned long)vaddr, true))
-+	if (!set_orig_insn(&uprobe->arch, mm, vaddr, true))
- 		atomic_dec(&mm->uprobes_state.count);
- }
- 
- /*
- * There could be threads that have hit the breakpoint and are entering the
- * notifier code and trying to acquire the uprobes_treelock. The thread
- * calling delete_uprobe() that is removing the uprobe from the rb_tree can
- * race with these threads and might acquire the uprobes_treelock compared
- * to some of the breakpoint hit threads. In such a case, the breakpoint
- * hit threads will not find the uprobe. The current unregistering thread
- * waits till all other threads have hit a breakpoint, to acquire the
- * uprobes_treelock before the uprobe is removed from the rbtree.
-+ * There could be threads that have already hit the breakpoint. They
-+ * will recheck the current insn and restart if find_uprobe() fails.
-+ * See find_active_uprobe().
-  */
- static void delete_uprobe(struct uprobe *uprobe)
- {
- 	unsigned long flags;
- 
-	synchronize_srcu(&uprobes_srcu);
- 	spin_lock_irqsave(&uprobes_treelock, flags);
- 	rb_erase(&uprobe->rb_node, &uprobes_tree);
- 	spin_unlock_irqrestore(&uprobes_treelock, flags);
-@@ -750,139 +738,135 @@ static void delete_uprobe(struct uprobe *uprobe)
- 	atomic_dec(&uprobe_events);
- }
- 
-static struct vma_info *
-__find_next_vma_info(struct address_space *mapping, struct list_head *head,
-			struct vma_info *vi, loff_t offset, bool is_register)
-+struct map_info {
-+	struct map_info *next;
-+	struct mm_struct *mm;
-+	unsigned long vaddr;
-+};
-+
-+static inline struct map_info *free_map_info(struct map_info *info)
-+{
-+	struct map_info *next = info->next;
-+	kfree(info);
-+	return next;
-+}
-+
-+static struct map_info *
-+build_map_info(struct address_space *mapping, loff_t offset, bool is_register)
- {
-+	unsigned long pgoff = offset >> PAGE_SHIFT;
- 	struct prio_tree_iter iter;
- 	struct vm_area_struct *vma;
-	struct vma_info *tmpvi;
-	unsigned long pgoff;
-	int existing_vma;
-	loff_t vaddr;
-
-	pgoff = offset >> PAGE_SHIFT;
-+	struct map_info *curr = NULL;
-+	struct map_info *prev = NULL;
-+	struct map_info *info;
-+	int more = 0;
- 
-+ again:
-+	mutex_lock(&mapping->i_mmap_mutex);
- 	vma_prio_tree_foreach(vma, &iter, &mapping->i_mmap, pgoff, pgoff) {
- 		if (!valid_vma(vma, is_register))
- 			continue;
- 
-		existing_vma = 0;
-		vaddr = vma_address(vma, offset);
-
-		list_for_each_entry(tmpvi, head, probe_list) {
-			if (tmpvi->mm == vma->vm_mm && tmpvi->vaddr == vaddr) {
-				existing_vma = 1;
-				break;
-			}
-+		if (!prev && !more) {
-+			/*
-+			 * Needs GFP_NOWAIT to avoid i_mmap_mutex recursion through
-+			 * reclaim. This is optimistic, no harm done if it fails.
-+			 */
-+			prev = kmalloc(sizeof(struct map_info),
-+					GFP_NOWAIT | __GFP_NOMEMALLOC | __GFP_NOWARN);
-+			if (prev)
-+				prev->next = NULL;
- 		}
-
-		/*
-		 * Another vma needs a probe to be installed. However skip
-		 * installing the probe if the vma is about to be unlinked.
-		 */
-		if (!existing_vma && atomic_inc_not_zero(&vma->vm_mm->mm_users)) {
-			vi->mm = vma->vm_mm;
-			vi->vaddr = vaddr;
-			list_add(&vi->probe_list, head);
-
-			return vi;
-+		if (!prev) {
-+			more++;
-+			continue;
- 		}
-	}
- 
-	return NULL;
-}
-
-/*
- * Iterate in the rmap prio tree  and find a vma where a probe has not
- * yet been inserted.
- */
-static struct vma_info *
-find_next_vma_info(struct address_space *mapping, struct list_head *head,
-		loff_t offset, bool is_register)
-{
-	struct vma_info *vi, *retvi;
-+		if (!atomic_inc_not_zero(&vma->vm_mm->mm_users))
-+			continue;
- 
-	vi = kzalloc(sizeof(struct vma_info), GFP_KERNEL);
-	if (!vi)
-		return ERR_PTR(-ENOMEM);
-+		info = prev;
-+		prev = prev->next;
-+		info->next = curr;
-+		curr = info;
- 
-	mutex_lock(&mapping->i_mmap_mutex);
-	retvi = __find_next_vma_info(mapping, head, vi, offset, is_register);
-+		info->mm = vma->vm_mm;
-+		info->vaddr = vma_address(vma, offset);
-+	}
- 	mutex_unlock(&mapping->i_mmap_mutex);
- 
-	if (!retvi)
-		kfree(vi);
-+	if (!more)
-+		goto out;
-+
-+	prev = curr;
-+	while (curr) {
-+		mmput(curr->mm);
-+		curr = curr->next;
-+	}
- 
-	return retvi;
-+	do {
-+		info = kmalloc(sizeof(struct map_info), GFP_KERNEL);
-+		if (!info) {
-+			curr = ERR_PTR(-ENOMEM);
-+			goto out;
-+		}
-+		info->next = prev;
-+		prev = info;
-+	} while (--more);
-+
-+	goto again;
-+ out:
-+	while (prev)
-+		prev = free_map_info(prev);
-+	return curr;
- }
- 
- static int register_for_each_vma(struct uprobe *uprobe, bool is_register)
- {
-	struct list_head try_list;
-	struct vm_area_struct *vma;
-	struct address_space *mapping;
-	struct vma_info *vi, *tmpvi;
-	struct mm_struct *mm;
-	loff_t vaddr;
-	int ret;
-+	struct map_info *info;
-+	int err = 0;
- 
-	mapping = uprobe->inode->i_mapping;
-	INIT_LIST_HEAD(&try_list);
-+	info = build_map_info(uprobe->inode->i_mapping,
-+					uprobe->offset, is_register);
-+	if (IS_ERR(info))
-+		return PTR_ERR(info);
- 
-	ret = 0;
-+	while (info) {
-+		struct mm_struct *mm = info->mm;
-+		struct vm_area_struct *vma;
- 
-	for (;;) {
-		vi = find_next_vma_info(mapping, &try_list, uprobe->offset, is_register);
-		if (!vi)
-			break;
-+		if (err)
-+			goto free;
- 
-		if (IS_ERR(vi)) {
-			ret = PTR_ERR(vi);
-			break;
-		}
-+		down_write(&mm->mmap_sem);
-+		vma = find_vma(mm, (unsigned long)info->vaddr);
-+		if (!vma || !valid_vma(vma, is_register))
-+			goto unlock;
- 
-		mm = vi->mm;
-		down_read(&mm->mmap_sem);
-		vma = find_vma(mm, (unsigned long)vi->vaddr);
-		if (!vma || !valid_vma(vma, is_register)) {
-			list_del(&vi->probe_list);
-			kfree(vi);
-			up_read(&mm->mmap_sem);
-			mmput(mm);
-			continue;
-		}
-		vaddr = vma_address(vma, uprobe->offset);
- 		if (vma->vm_file->f_mapping->host != uprobe->inode ||
-						vaddr != vi->vaddr) {
-			list_del(&vi->probe_list);
-			kfree(vi);
-			up_read(&mm->mmap_sem);
-			mmput(mm);
-			continue;
-		}
-
-		if (is_register)
-			ret = install_breakpoint(uprobe, mm, vma, vi->vaddr);
-		else
-			remove_breakpoint(uprobe, mm, vi->vaddr);
-+		    vma_address(vma, uprobe->offset) != info->vaddr)
-+			goto unlock;
- 
-		up_read(&mm->mmap_sem);
-		mmput(mm);
- 		if (is_register) {
-			if (ret && ret == -EEXIST)
-				ret = 0;
-			if (ret)
-				break;
-+			err = install_breakpoint(uprobe, mm, vma, info->vaddr);
-+			/*
-+			 * We can race against uprobe_mmap(), see the
-+			 * comment near uprobe_hash().
-+			 */
-+			if (err == -EEXIST)
-+				err = 0;
-+		} else {
-+			remove_breakpoint(uprobe, mm, info->vaddr);
- 		}
-+ unlock:
-+		up_write(&mm->mmap_sem);
-+ free:
-+		mmput(mm);
-+		info = free_map_info(info);
- 	}
- 
-	list_for_each_entry_safe(vi, tmpvi, &try_list, probe_list) {
-		list_del(&vi->probe_list);
-		kfree(vi);
-	}
-
-	return ret;
-+	return err;
- }
- 
- static int __uprobe_register(struct uprobe *uprobe)
-@@ -945,6 +929,7 @@ int uprobe_register(struct inode *inode, loff_t offset, struct uprobe_consumer *
- 
- 	return ret;
- }
-+EXPORT_SYMBOL_GPL(uprobe_register);
- 
- /*
-  * uprobe_unregister - unregister a already registered probe.
-@@ -976,6 +961,7 @@ void uprobe_unregister(struct inode *inode, loff_t offset, struct uprobe_consume
- 	if (uprobe)
- 		put_uprobe(uprobe);
- }
-+EXPORT_SYMBOL_GPL(uprobe_unregister);
- 
- /*
-  * Of all the nodes that correspond to the given inode, return the node
-@@ -1048,7 +1034,7 @@ static void build_probe_list(struct inode *inode, struct list_head *head)
- int uprobe_mmap(struct vm_area_struct *vma)
- {
- 	struct list_head tmp_list;
-	struct uprobe *uprobe, *u;
-+	struct uprobe *uprobe;
- 	struct inode *inode;
- 	int ret, count;
- 
-@@ -1066,12 +1052,9 @@ int uprobe_mmap(struct vm_area_struct *vma)
- 	ret = 0;
- 	count = 0;
- 
-	list_for_each_entry_safe(uprobe, u, &tmp_list, pending_list) {
-		loff_t vaddr;
-
-		list_del(&uprobe->pending_list);
-+	list_for_each_entry(uprobe, &tmp_list, pending_list) {
- 		if (!ret) {
-			vaddr = vma_address(vma, uprobe->offset);
-+			loff_t vaddr = vma_address(vma, uprobe->offset);
- 
- 			if (vaddr < vma->vm_start || vaddr >= vma->vm_end) {
- 				put_uprobe(uprobe);
-@@ -1079,8 +1062,10 @@ int uprobe_mmap(struct vm_area_struct *vma)
- 			}
- 
- 			ret = install_breakpoint(uprobe, vma->vm_mm, vma, vaddr);
-
-			/* Ignore double add: */
-+			/*
-+			 * We can race against uprobe_register(), see the
-+			 * comment near uprobe_hash().
-+			 */
- 			if (ret == -EEXIST) {
- 				ret = 0;
- 
-@@ -1115,7 +1100,7 @@ int uprobe_mmap(struct vm_area_struct *vma)
- void uprobe_munmap(struct vm_area_struct *vma, unsigned long start, unsigned long end)
- {
- 	struct list_head tmp_list;
-	struct uprobe *uprobe, *u;
-+	struct uprobe *uprobe;
- 	struct inode *inode;
- 
- 	if (!atomic_read(&uprobe_events) || !valid_vma(vma, false))
-@@ -1132,11 +1117,8 @@ void uprobe_munmap(struct vm_area_struct *vma, unsigned long start, unsigned lon
- 	mutex_lock(uprobes_mmap_hash(inode));
- 	build_probe_list(inode, &tmp_list);
- 
-	list_for_each_entry_safe(uprobe, u, &tmp_list, pending_list) {
-		loff_t vaddr;
-
-		list_del(&uprobe->pending_list);
-		vaddr = vma_address(vma, uprobe->offset);
-+	list_for_each_entry(uprobe, &tmp_list, pending_list) {
-+		loff_t vaddr = vma_address(vma, uprobe->offset);
- 
- 		if (vaddr >= start && vaddr < end) {
- 			/*
-@@ -1378,9 +1360,6 @@ void uprobe_free_utask(struct task_struct *t)
- {
- 	struct uprobe_task *utask = t->utask;
- 
-	if (t->uprobe_srcu_id != -1)
-		srcu_read_unlock_raw(&uprobes_srcu, t->uprobe_srcu_id);
-
- 	if (!utask)
- 		return;
- 
-@@ -1398,7 +1377,6 @@ void uprobe_free_utask(struct task_struct *t)
- void uprobe_copy_process(struct task_struct *t)
- {
- 	t->utask = NULL;
-	t->uprobe_srcu_id = -1;
- }
- 
- /*
-@@ -1417,7 +1395,6 @@ static struct uprobe_task *add_utask(void)
- 	if (unlikely(!utask))
- 		return NULL;
- 
-	utask->active_uprobe = NULL;
- 	current->utask = utask;
- 	return utask;
- }
-@@ -1479,41 +1456,64 @@ static bool can_skip_sstep(struct uprobe *uprobe, struct pt_regs *regs)
- 	return false;
- }
- 
-+static struct uprobe *find_active_uprobe(unsigned long bp_vaddr, int *is_swbp)
-+{
-+	struct mm_struct *mm = current->mm;
-+	struct uprobe *uprobe = NULL;
-+	struct vm_area_struct *vma;
-+
-+	down_read(&mm->mmap_sem);
-+	vma = find_vma(mm, bp_vaddr);
-+	if (vma && vma->vm_start <= bp_vaddr) {
-+		if (valid_vma(vma, false)) {
-+			struct inode *inode;
-+			loff_t offset;
-+
-+			inode = vma->vm_file->f_mapping->host;
-+			offset = bp_vaddr - vma->vm_start;
-+			offset += (vma->vm_pgoff << PAGE_SHIFT);
-+			uprobe = find_uprobe(inode, offset);
-+		}
-+
-+		if (!uprobe)
-+			*is_swbp = is_swbp_at_addr(mm, bp_vaddr);
-+	} else {
-+		*is_swbp = -EFAULT;
-+	}
-+	up_read(&mm->mmap_sem);
-+
-+	return uprobe;
-+}
-+
- /*
-  * Run handler and ask thread to singlestep.
-  * Ensure all non-fatal signals cannot interrupt thread while it singlesteps.
-  */
- static void handle_swbp(struct pt_regs *regs)
- {
-	struct vm_area_struct *vma;
- 	struct uprobe_task *utask;
- 	struct uprobe *uprobe;
-	struct mm_struct *mm;
- 	unsigned long bp_vaddr;
-+	int uninitialized_var(is_swbp);
- 
-	uprobe = NULL;
- 	bp_vaddr = uprobe_get_swbp_addr(regs);
-	mm = current->mm;
-	down_read(&mm->mmap_sem);
-	vma = find_vma(mm, bp_vaddr);
-
-	if (vma && vma->vm_start <= bp_vaddr && valid_vma(vma, false)) {
-		struct inode *inode;
-		loff_t offset;
-
-		inode = vma->vm_file->f_mapping->host;
-		offset = bp_vaddr - vma->vm_start;
-		offset += (vma->vm_pgoff << PAGE_SHIFT);
-		uprobe = find_uprobe(inode, offset);
-	}
-
-	srcu_read_unlock_raw(&uprobes_srcu, current->uprobe_srcu_id);
-	current->uprobe_srcu_id = -1;
-	up_read(&mm->mmap_sem);
-+	uprobe = find_active_uprobe(bp_vaddr, &is_swbp);
- 
- 	if (!uprobe) {
-		/* No matching uprobe; signal SIGTRAP. */
-		send_sig(SIGTRAP, current, 0);
-+		if (is_swbp > 0) {
-+			/* No matching uprobe; signal SIGTRAP. */
-+			send_sig(SIGTRAP, current, 0);
-+		} else {
-+			/*
-+			 * Either we raced with uprobe_unregister() or we can't
-+			 * access this memory. The latter is only possible if
-+			 * another thread plays with our ->mm. In both cases
-+			 * we can simply restart. If this vma was unmapped we
-+			 * can pretend this insn was not executed yet and get
-+			 * the (correct) SIGSEGV after restart.
-+			 */
-+			instruction_pointer_set(regs, bp_vaddr);
-+		}
- 		return;
- 	}
- 
-@@ -1620,7 +1620,6 @@ int uprobe_pre_sstep_notifier(struct pt_regs *regs)
- 		utask->state = UTASK_BP_HIT;
- 
- 	set_thread_flag(TIF_UPROBE);
-	current->uprobe_srcu_id = srcu_read_lock_raw(&uprobes_srcu);
- 
- 	return 1;
- }
-@@ -1655,7 +1654,6 @@ static int __init init_uprobes(void)
- 		mutex_init(&uprobes_mutex[i]);
- 		mutex_init(&uprobes_mmap_mutex[i]);
- 	}
-	init_srcu_struct(&uprobes_srcu);
- 
- 	return register_die_notifier(&uprobe_exception_nb);
- }
--- a/uprobes-backport.patch
+++ b/uprobes-backport.patch