3.6.7-5.fc18.gnu

8 files changed, 1061 insertions, 1 deletions

diff --git a/freed-ora/current/f18/Bluetooth-Add-support-for-BCM20702A0.patch b/freed-ora/current/f18/Bluetooth-Add-support-for-BCM20702A0.patch
new file mode 100644
index 000000000..73f00fc43
--- /dev/null
+++ b/freed-ora/current/f18/Bluetooth-Add-support-for-BCM20702A0.patch
@@ -0,0 +1,107 @@
+From 7f198e1cc6d4fda9c84c0da4fc3aafb441342f78 Mon Sep 17 00:00:00 2001
+From: Jaroslav Resler <resler@cs.cas.cz>
+Date: Tue, 11 Sep 2012 17:25:32 +0800
+Subject: [PATCH 1/2] Bluetooth: Add support for BCM20702A0 [04ca, 2003]
+
+Add another vendor specific ID for BCM20702A0.
+
+output of usb-devices:
+T:  Bus=01 Lev=02 Prnt=02 Port=03 Cnt=02 Dev#=  4 Spd=12   MxCh= 0
+D:  Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
+P:  Vendor=04ca ProdID=2003 Rev= 1.12
+S:  Manufacturer=Broadcom Corp
+S:  Product=BCM20702A0
+S:  SerialNumber=446D57861623
+C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=  0mA
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
+E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
+E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
+E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
+I:  If#= 1 Alt= 1 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
+I:  If#= 1 Alt= 2 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
+I:  If#= 1 Alt= 3 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
+I:  If#= 1 Alt= 4 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
+I:  If#= 1 Alt= 5 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
+I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
+E:  Ad=84(I) Atr=02(Bulk) MxPS=  32 Ivl=0ms
+E:  Ad=04(O) Atr=02(Bulk) MxPS=  32 Ivl=0ms
+I:* If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none)
+
+Signed-off-by: Cho, Yu-Chen <acho@suse.com>
+Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
+---
+ drivers/bluetooth/btusb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 654e248..b167944 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -96,6 +96,7 @@ static struct usb_device_id btusb_table[] = {
+ 	{ USB_DEVICE(0x0c10, 0x0000) },
+ 
+ 	/* Broadcom BCM20702A0 */
++	{ USB_DEVICE(0x04ca, 0x2003) },
+ 	{ USB_DEVICE(0x0489, 0xe042) },
+ 	{ USB_DEVICE(0x413c, 0x8197) },
+ 
+-- 
+1.8.0
+
+
+From a5f86c3423428c8e28b6501d0e9c3929ca91f07d Mon Sep 17 00:00:00 2001
+From: Jeff Cook <jeff@deserettechnology.com>
+Date: Fri, 9 Nov 2012 16:39:48 -0700
+Subject: [PATCH 2/2] Bluetooth: Add support for BCM20702A0 [0b05, 17b5]
+
+Vendor-specific ID for BCM20702A0.
+Support for bluetooth over Asus Wi-Fi GO!, included with Asus P8Z77-V
+Deluxe.
+
+T:  Bus=07 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#=  3 Spd=12  MxCh= 0
+D:  Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
+P:  Vendor=0b05 ProdID=17b5 Rev=01.12
+S:  Manufacturer=Broadcom Corp
+S:  Product=BCM20702A0
+S:  SerialNumber=94DBC98AC113
+C:  #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=0mA
+I:  If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
+I:  If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
+I:  If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
+I:  If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none)
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Jeff Cook <jeff@deserettechnology.com>
+Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
+---
+ drivers/bluetooth/btusb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index b167944..6dc44ff 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -96,6 +96,7 @@ static struct usb_device_id btusb_table[] = {
+ 	{ USB_DEVICE(0x0c10, 0x0000) },
+ 
+ 	/* Broadcom BCM20702A0 */
++	{ USB_DEVICE(0x0b05, 0x17b5) },
+ 	{ USB_DEVICE(0x04ca, 0x2003) },
+ 	{ USB_DEVICE(0x0489, 0xe042) },
+ 	{ USB_DEVICE(0x413c, 0x8197) },
+-- 
+1.8.0
+
diff --git a/freed-ora/current/f18/KVM-x86-invalid-opcode-oops-on-SET_SREGS-with-OSXSAV.patch b/freed-ora/current/f18/KVM-x86-invalid-opcode-oops-on-SET_SREGS-with-OSXSAV.patch
new file mode 100644
index 000000000..890bf495e
--- /dev/null
+++ b/freed-ora/current/f18/KVM-x86-invalid-opcode-oops-on-SET_SREGS-with-OSXSAV.patch
@@ -0,0 +1,83 @@
+From 6d1068b3a98519247d8ba4ec85cd40ac136dbdf9 Mon Sep 17 00:00:00 2001
+From: Petr Matousek <pmatouse@redhat.com>
+Date: Tue, 6 Nov 2012 19:24:07 +0100
+Subject: [PATCH] KVM: x86: invalid opcode oops on SET_SREGS with OSXSAVE bit
+ set (CVE-2012-4461)
+
+On hosts without the XSAVE support unprivileged local user can trigger
+oops similar to the one below by setting X86_CR4_OSXSAVE bit in guest
+cr4 register using KVM_SET_SREGS ioctl and later issuing KVM_RUN
+ioctl.
+
+invalid opcode: 0000 [#2] SMP
+Modules linked in: tun ip6table_filter ip6_tables ebtable_nat ebtables
+...
+Pid: 24935, comm: zoog_kvm_monito Tainted: G      D      3.2.0-3-686-pae
+EIP: 0060:[<f8b9550c>] EFLAGS: 00210246 CPU: 0
+EIP is at kvm_arch_vcpu_ioctl_run+0x92a/0xd13 [kvm]
+EAX: 00000001 EBX: 000f387e ECX: 00000000 EDX: 00000000
+ESI: 00000000 EDI: 00000000 EBP: ef5a0060 ESP: d7c63e70
+ DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
+Process zoog_kvm_monito (pid: 24935, ti=d7c62000 task=ed84a0c0
+task.ti=d7c62000)
+Stack:
+ 00000001 f70a1200 f8b940a9 ef5a0060 00000000 00200202 f8769009 00000000
+ ef5a0060 000f387e eda5c020 8722f9c8 00015bae 00000000 ed84a0c0 ed84a0c0
+ c12bf02d 0000ae80 ef7f8740 fffffffb f359b740 ef5a0060 f8b85dc1 0000ae80
+Call Trace:
+ [<f8b940a9>] ? kvm_arch_vcpu_ioctl_set_sregs+0x2fe/0x308 [kvm]
+...
+ [<c12bfb44>] ? syscall_call+0x7/0xb
+Code: 89 e8 e8 14 ee ff ff ba 00 00 04 00 89 e8 e8 98 48 ff ff 85 c0 74
+1e 83 7d 48 00 75 18 8b 85 08 07 00 00 31 c9 8b 95 0c 07 00 00 <0f> 01
+d1 c7 45 48 01 00 00 00 c7 45 1c 01 00 00 00 0f ae f0 89
+EIP: [<f8b9550c>] kvm_arch_vcpu_ioctl_run+0x92a/0xd13 [kvm] SS:ESP
+0068:d7c63e70
+
+QEMU first retrieves the supported features via KVM_GET_SUPPORTED_CPUID
+and then sets them later. So guest's X86_FEATURE_XSAVE should be masked
+out on hosts without X86_FEATURE_XSAVE, making kvm_set_cr4 with
+X86_CR4_OSXSAVE fail. Userspaces that allow specifying guest cpuid with
+X86_FEATURE_XSAVE even on hosts that do not support it, might be
+susceptible to this attack from inside the guest as well.
+
+Allow setting X86_CR4_OSXSAVE bit only if host has XSAVE support.
+
+Signed-off-by: Petr Matousek <pmatouse@redhat.com>
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+---
+ arch/x86/kvm/cpuid.h | 3 +++
+ arch/x86/kvm/x86.c   | 3 +++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/arch/x86/kvm/cpuid.h b/arch/x86/kvm/cpuid.h
+index a10e460..58fc514 100644
+--- a/arch/x86/kvm/cpuid.h
++++ b/arch/x86/kvm/cpuid.h
+@@ -24,6 +24,9 @@ static inline bool guest_cpuid_has_xsave(struct kvm_vcpu *vcpu)
+ {
+ 	struct kvm_cpuid_entry2 *best;
+ 
++	if (!static_cpu_has(X86_FEATURE_XSAVE))
++		return 0;
++
+ 	best = kvm_find_cpuid_entry(vcpu, 1, 0);
+ 	return best && (best->ecx & bit(X86_FEATURE_XSAVE));
+ }
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 224a7e7..4f76417 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -5781,6 +5781,9 @@ int kvm_arch_vcpu_ioctl_set_sregs(struct kvm_vcpu *vcpu,
+ 	int pending_vec, max_bits, idx;
+ 	struct desc_ptr dt;
+ 
++	if (!guest_cpuid_has_xsave(vcpu) && (sregs->cr4 & X86_CR4_OSXSAVE))
++		return -EINVAL;
++
+ 	dt.size = sregs->idt.limit;
+ 	dt.address = sregs->idt.base;
+ 	kvm_x86_ops->set_idt(vcpu, &dt);
+-- 
+1.8.0
+
diff --git a/freed-ora/current/f18/block-fix-a-crash-when-block-device-is.patch b/freed-ora/current/f18/block-fix-a-crash-when-block-device-is.patch
new file mode 100644
index 000000000..af992830e
--- /dev/null
+++ b/freed-ora/current/f18/block-fix-a-crash-when-block-device-is.patch
@@ -0,0 +1,214 @@
+Fix a crash when block device is read and block size is changed at the same time
+
+commit b87570f5d349661814b262dd5fc40787700f80d6
+Author: Mikulas Patocka <mpatocka@redhat.com>
+Date:   Wed Sep 26 07:46:40 2012 +0200
+
+    Fix a crash when block device is read and block size is changed at the same time
+    
+    The kernel may crash when block size is changed and I/O is issued
+    simultaneously.
+    
+    Because some subsystems (udev or lvm) may read any block device anytime,
+    the bug actually puts any code that changes a block device size in
+    jeopardy.
+    
+    The crash can be reproduced if you place "msleep(1000)" to
+    blkdev_get_blocks just before "bh->b_size = max_blocks <<
+    inode->i_blkbits;".
+    Then, run "dd if=/dev/ram0 of=/dev/null bs=4k count=1 iflag=direct"
+    While it is waiting in msleep, run "blockdev --setbsz 2048 /dev/ram0"
+    You get a BUG.
+    
+    The direct and non-direct I/O is written with the assumption that block
+    size does not change. It doesn't seem practical to fix these crashes
+    one-by-one there may be many crash possibilities when block size changes
+    at a certain place and it is impossible to find them all and verify the
+    code.
+    
+    This patch introduces a new rw-lock bd_block_size_semaphore. The lock is
+    taken for read during I/O. It is taken for write when changing block
+    size. Consequently, block size can't be changed while I/O is being
+    submitted.
+    
+    For asynchronous I/O, the patch only prevents block size change while
+    the I/O is being submitted. The block size can change when the I/O is in
+    progress or when the I/O is being finished. This is acceptable because
+    there are no accesses to block size when asynchronous I/O is being
+    finished.
+    
+    The patch prevents block size changing while the device is mapped with
+    mmap.
+    
+    Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+    Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+Index: linux-3.6.x86_64/drivers/char/raw.c
+===================================================================
+--- linux-3.6.x86_64.orig/drivers/char/raw.c	2012-11-16 17:12:35.127010280 -0500
++++ linux-3.6.x86_64/drivers/char/raw.c	2012-11-16 17:12:37.381002516 -0500
+@@ -285,7 +285,7 @@
+ 
+ static const struct file_operations raw_fops = {
+ 	.read		= do_sync_read,
+-	.aio_read	= generic_file_aio_read,
++	.aio_read	= blkdev_aio_read,
+ 	.write		= do_sync_write,
+ 	.aio_write	= blkdev_aio_write,
+ 	.fsync		= blkdev_fsync,
+Index: linux-3.6.x86_64/fs/block_dev.c
+===================================================================
+--- linux-3.6.x86_64.orig/fs/block_dev.c	2012-11-16 17:12:35.127010280 -0500
++++ linux-3.6.x86_64/fs/block_dev.c	2012-11-16 17:12:37.381002516 -0500
+@@ -116,6 +116,8 @@
+ 
+ int set_blocksize(struct block_device *bdev, int size)
+ {
++	struct address_space *mapping;
++
+ 	/* Size must be a power of two, and between 512 and PAGE_SIZE */
+ 	if (size > PAGE_SIZE || size < 512 || !is_power_of_2(size))
+ 		return -EINVAL;
+@@ -124,6 +126,20 @@
+ 	if (size < bdev_logical_block_size(bdev))
+ 		return -EINVAL;
+ 
++	/* Prevent starting I/O or mapping the device */
++	down_write(&bdev->bd_block_size_semaphore);
++
++	/* Check that the block device is not memory mapped */
++	mapping = bdev->bd_inode->i_mapping;
++	mutex_lock(&mapping->i_mmap_mutex);
++	if (!prio_tree_empty(&mapping->i_mmap) ||
++	    !list_empty(&mapping->i_mmap_nonlinear)) {
++		mutex_unlock(&mapping->i_mmap_mutex);
++		up_write(&bdev->bd_block_size_semaphore);
++		return -EBUSY;
++	}
++	mutex_unlock(&mapping->i_mmap_mutex);
++
+ 	/* Don't change the size if it is same as current */
+ 	if (bdev->bd_block_size != size) {
+ 		sync_blockdev(bdev);
+@@ -131,6 +147,9 @@
+ 		bdev->bd_inode->i_blkbits = blksize_bits(size);
+ 		kill_bdev(bdev);
+ 	}
++
++	up_write(&bdev->bd_block_size_semaphore);
++
+ 	return 0;
+ }
+ 
+@@ -472,6 +491,7 @@
+ 	inode_init_once(&ei->vfs_inode);
+ 	/* Initialize mutex for freeze. */
+ 	mutex_init(&bdev->bd_fsfreeze_mutex);
++	init_rwsem(&bdev->bd_block_size_semaphore);
+ }
+ 
+ static inline void __bd_forget(struct inode *inode)
+@@ -1567,6 +1587,22 @@
+ 	return blkdev_ioctl(bdev, mode, cmd, arg);
+ }
+ 
++ssize_t blkdev_aio_read(struct kiocb *iocb, const struct iovec *iov,
++			unsigned long nr_segs, loff_t pos)
++{
++	ssize_t ret;
++	struct block_device *bdev = I_BDEV(iocb->ki_filp->f_mapping->host);
++
++	down_read(&bdev->bd_block_size_semaphore);
++
++	ret = generic_file_aio_read(iocb, iov, nr_segs, pos);
++
++	up_read(&bdev->bd_block_size_semaphore);
++
++	return ret;
++}
++EXPORT_SYMBOL_GPL(blkdev_aio_read);
++
+ /*
+  * Write data to the block device.  Only intended for the block device itself
+  * and the raw driver which basically is a fake block device.
+@@ -1578,12 +1614,16 @@
+ 			 unsigned long nr_segs, loff_t pos)
+ {
+ 	struct file *file = iocb->ki_filp;
++	struct block_device *bdev = I_BDEV(file->f_mapping->host);
+ 	struct blk_plug plug;
+ 	ssize_t ret;
+ 
+ 	BUG_ON(iocb->ki_pos != pos);
+ 
+ 	blk_start_plug(&plug);
++
++	down_read(&bdev->bd_block_size_semaphore);
++
+ 	ret = __generic_file_aio_write(iocb, iov, nr_segs, &iocb->ki_pos);
+ 	if (ret > 0 || ret == -EIOCBQUEUED) {
+ 		ssize_t err;
+@@ -1592,11 +1632,29 @@
+ 		if (err < 0 && ret > 0)
+ 			ret = err;
+ 	}
++
++	up_read(&bdev->bd_block_size_semaphore);
++
+ 	blk_finish_plug(&plug);
++
+ 	return ret;
+ }
+ EXPORT_SYMBOL_GPL(blkdev_aio_write);
+ 
++int blkdev_mmap(struct file *file, struct vm_area_struct *vma)
++{
++	int ret;
++	struct block_device *bdev = I_BDEV(file->f_mapping->host);
++
++	down_read(&bdev->bd_block_size_semaphore);
++
++	ret = generic_file_mmap(file, vma);
++
++	up_read(&bdev->bd_block_size_semaphore);
++
++	return ret;
++}
++
+ /*
+  * Try to release a page associated with block device when the system
+  * is under memory pressure.
+@@ -1627,9 +1685,9 @@
+ 	.llseek		= block_llseek,
+ 	.read		= do_sync_read,
+ 	.write		= do_sync_write,
+-  	.aio_read	= generic_file_aio_read,
++  	.aio_read	= blkdev_aio_read,
+ 	.aio_write	= blkdev_aio_write,
+-	.mmap		= generic_file_mmap,
++	.mmap		= blkdev_mmap,
+ 	.fsync		= blkdev_fsync,
+ 	.unlocked_ioctl	= block_ioctl,
+ #ifdef CONFIG_COMPAT
+Index: linux-3.6.x86_64/include/linux/fs.h
+===================================================================
+--- linux-3.6.x86_64.orig/include/linux/fs.h	2012-11-16 17:12:35.127010280 -0500
++++ linux-3.6.x86_64/include/linux/fs.h	2012-11-16 17:12:37.424002387 -0500
+@@ -724,6 +724,8 @@
+ 	int			bd_fsfreeze_count;
+ 	/* Mutex for freeze */
+ 	struct mutex		bd_fsfreeze_mutex;
++	/* A semaphore that prevents I/O while block size is being changed */
++	struct rw_semaphore	bd_block_size_semaphore;
+ };
+ 
+ /*
+@@ -2564,6 +2566,8 @@
+ 		unsigned long *nr_segs, size_t *count, int access_flags);
+ 
+ /* fs/block_dev.c */
++extern ssize_t blkdev_aio_read(struct kiocb *iocb, const struct iovec *iov,
++			       unsigned long nr_segs, loff_t pos);
+ extern ssize_t blkdev_aio_write(struct kiocb *iocb, const struct iovec *iov,
+ 				unsigned long nr_segs, loff_t pos);
+ extern int blkdev_fsync(struct file *filp, loff_t start, loff_t end,
diff --git a/freed-ora/current/f18/blockdev-turn-a-rw-semaphore-into-a-percpu-rw-sem.patch b/freed-ora/current/f18/blockdev-turn-a-rw-semaphore-into-a-percpu-rw-sem.patch
new file mode 100644
index 000000000..82caa6b76
--- /dev/null
+++ b/freed-ora/current/f18/blockdev-turn-a-rw-semaphore-into-a-percpu-rw-sem.patch
@@ -0,0 +1,290 @@
+blockdev: turn a rw semaphore into a percpu rw semaphore
+
+commit 62ac665ff9fc07497ca524bd20d6a96893d11071
+Author: Mikulas Patocka <mpatocka@redhat.com>
+Date:   Wed Sep 26 07:46:43 2012 +0200
+
+    blockdev: turn a rw semaphore into a percpu rw semaphore
+    
+    This avoids cache line bouncing when many processes lock the semaphore
+    for read.
+    
+    New percpu lock implementation
+    
+    The lock consists of an array of percpu unsigned integers, a boolean
+    variable and a mutex.
+    
+    When we take the lock for read, we enter rcu read section, check for a
+    "locked" variable. If it is false, we increase a percpu counter on the
+    current cpu and exit the rcu section. If "locked" is true, we exit the
+    rcu section, take the mutex and drop it (this waits until a writer
+    finished) and retry.
+    
+    Unlocking for read just decreases percpu variable. Note that we can
+    unlock on a difference cpu than where we locked, in this case the
+    counter underflows. The sum of all percpu counters represents the number
+    of processes that hold the lock for read.
+    
+    When we need to lock for write, we take the mutex, set "locked" variable
+    to true and synchronize rcu. Since RCU has been synchronized, no
+    processes can create new read locks. We wait until the sum of percpu
+    counters is zero - when it is, there are no readers in the critical
+    section.
+    
+    Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+    Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+Index: linux-3.6.x86_64/Documentation/percpu-rw-semaphore.txt
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ linux-3.6.x86_64/Documentation/percpu-rw-semaphore.txt	2012-11-16 17:12:57.351936583 -0500
+@@ -0,0 +1,27 @@
++Percpu rw semaphores
++--------------------
++
++Percpu rw semaphores is a new read-write semaphore design that is
++optimized for locking for reading.
++
++The problem with traditional read-write semaphores is that when multiple
++cores take the lock for reading, the cache line containing the semaphore
++is bouncing between L1 caches of the cores, causing performance
++degradation.
++
++Locking for reading it very fast, it uses RCU and it avoids any atomic
++instruction in the lock and unlock path. On the other hand, locking for
++writing is very expensive, it calls synchronize_rcu() that can take
++hundreds of microseconds.
++
++The lock is declared with "struct percpu_rw_semaphore" type.
++The lock is initialized percpu_init_rwsem, it returns 0 on success and
++-ENOMEM on allocation failure.
++The lock must be freed with percpu_free_rwsem to avoid memory leak.
++
++The lock is locked for read with percpu_down_read, percpu_up_read and
++for write with percpu_down_write, percpu_up_write.
++
++The idea of using RCU for optimized rw-lock was introduced by
++Eric Dumazet <eric.dumazet@gmail.com>.
++The code was written by Mikulas Patocka <mpatocka@redhat.com>
+Index: linux-3.6.x86_64/fs/block_dev.c
+===================================================================
+--- linux-3.6.x86_64.orig/fs/block_dev.c	2012-11-16 17:12:37.381002516 -0500
++++ linux-3.6.x86_64/fs/block_dev.c	2012-11-16 17:27:41.217005828 -0500
+@@ -127,7 +127,7 @@
+ 		return -EINVAL;
+ 
+ 	/* Prevent starting I/O or mapping the device */
+-	down_write(&bdev->bd_block_size_semaphore);
++	percpu_down_write(&bdev->bd_block_size_semaphore);
+ 
+ 	/* Check that the block device is not memory mapped */
+ 	mapping = bdev->bd_inode->i_mapping;
+@@ -135,7 +135,7 @@
+ 	if (!prio_tree_empty(&mapping->i_mmap) ||
+ 	    !list_empty(&mapping->i_mmap_nonlinear)) {
+ 		mutex_unlock(&mapping->i_mmap_mutex);
+-		up_write(&bdev->bd_block_size_semaphore);
++		percpu_up_write(&bdev->bd_block_size_semaphore);
+ 		return -EBUSY;
+ 	}
+ 	mutex_unlock(&mapping->i_mmap_mutex);
+@@ -148,7 +148,7 @@
+ 		kill_bdev(bdev);
+ 	}
+ 
+-	up_write(&bdev->bd_block_size_semaphore);
++	percpu_up_write(&bdev->bd_block_size_semaphore);
+ 
+ 	return 0;
+ }
+@@ -460,6 +460,12 @@
+ 	struct bdev_inode *ei = kmem_cache_alloc(bdev_cachep, GFP_KERNEL);
+ 	if (!ei)
+ 		return NULL;
++
++	if (unlikely(percpu_init_rwsem(&ei->bdev.bd_block_size_semaphore))) {
++		kmem_cache_free(bdev_cachep, ei);
++		return NULL;
++	}
++
+ 	return &ei->vfs_inode;
+ }
+ 
+@@ -468,6 +474,8 @@
+ 	struct inode *inode = container_of(head, struct inode, i_rcu);
+ 	struct bdev_inode *bdi = BDEV_I(inode);
+ 
++	percpu_free_rwsem(&bdi->bdev.bd_block_size_semaphore);
++
+ 	kmem_cache_free(bdev_cachep, bdi);
+ }
+ 
+@@ -491,7 +499,6 @@
+ 	inode_init_once(&ei->vfs_inode);
+ 	/* Initialize mutex for freeze. */
+ 	mutex_init(&bdev->bd_fsfreeze_mutex);
+-	init_rwsem(&bdev->bd_block_size_semaphore);
+ }
+ 
+ static inline void __bd_forget(struct inode *inode)
+@@ -1593,11 +1600,11 @@
+ 	ssize_t ret;
+ 	struct block_device *bdev = I_BDEV(iocb->ki_filp->f_mapping->host);
+ 
+-	down_read(&bdev->bd_block_size_semaphore);
++	percpu_down_read(&bdev->bd_block_size_semaphore);
+ 
+ 	ret = generic_file_aio_read(iocb, iov, nr_segs, pos);
+ 
+-	up_read(&bdev->bd_block_size_semaphore);
++	percpu_up_read(&bdev->bd_block_size_semaphore);
+ 
+ 	return ret;
+ }
+@@ -1622,7 +1629,7 @@
+ 
+ 	blk_start_plug(&plug);
+ 
+-	down_read(&bdev->bd_block_size_semaphore);
++	percpu_down_read(&bdev->bd_block_size_semaphore);
+ 
+ 	ret = __generic_file_aio_write(iocb, iov, nr_segs, &iocb->ki_pos);
+ 	if (ret > 0 || ret == -EIOCBQUEUED) {
+@@ -1633,7 +1640,7 @@
+ 			ret = err;
+ 	}
+ 
+-	up_read(&bdev->bd_block_size_semaphore);
++	percpu_up_read(&bdev->bd_block_size_semaphore);
+ 
+ 	blk_finish_plug(&plug);
+ 
+@@ -1646,11 +1653,11 @@
+ 	int ret;
+ 	struct block_device *bdev = I_BDEV(file->f_mapping->host);
+ 
+-	down_read(&bdev->bd_block_size_semaphore);
++	percpu_down_read(&bdev->bd_block_size_semaphore);
+ 
+ 	ret = generic_file_mmap(file, vma);
+ 
+-	up_read(&bdev->bd_block_size_semaphore);
++	percpu_up_read(&bdev->bd_block_size_semaphore);
+ 
+ 	return ret;
+ }
+Index: linux-3.6.x86_64/include/linux/fs.h
+===================================================================
+--- linux-3.6.x86_64.orig/include/linux/fs.h	2012-11-16 17:12:37.424002387 -0500
++++ linux-3.6.x86_64/include/linux/fs.h	2012-11-16 17:28:12.578901349 -0500
+@@ -415,6 +415,7 @@
+ #include <linux/migrate_mode.h>
+ #include <linux/uidgid.h>
+ #include <linux/lockdep.h>
++#include <linux/percpu-rwsem.h>
+ 
+ #include <asm/byteorder.h>
+ 
+@@ -725,7 +726,7 @@
+ 	/* Mutex for freeze */
+ 	struct mutex		bd_fsfreeze_mutex;
+ 	/* A semaphore that prevents I/O while block size is being changed */
+-	struct rw_semaphore	bd_block_size_semaphore;
++	struct percpu_rw_semaphore	bd_block_size_semaphore;
+ };
+ 
+ /*
+Index: linux-3.6.x86_64/include/linux/percpu-rwsem.h
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ linux-3.6.x86_64/include/linux/percpu-rwsem.h	2012-11-16 17:12:57.354936574 -0500
+@@ -0,0 +1,89 @@
++#ifndef _LINUX_PERCPU_RWSEM_H
++#define _LINUX_PERCPU_RWSEM_H
++
++#include <linux/mutex.h>
++#include <linux/percpu.h>
++#include <linux/rcupdate.h>
++#include <linux/delay.h>
++
++struct percpu_rw_semaphore {
++	unsigned __percpu *counters;
++	bool locked;
++	struct mutex mtx;
++};
++
++static inline void percpu_down_read(struct percpu_rw_semaphore *p)
++{
++	rcu_read_lock();
++	if (unlikely(p->locked)) {
++		rcu_read_unlock();
++		mutex_lock(&p->mtx);
++		this_cpu_inc(*p->counters);
++		mutex_unlock(&p->mtx);
++		return;
++	}
++	this_cpu_inc(*p->counters);
++	rcu_read_unlock();
++}
++
++static inline void percpu_up_read(struct percpu_rw_semaphore *p)
++{
++	/*
++	 * On X86, write operation in this_cpu_dec serves as a memory unlock
++	 * barrier (i.e. memory accesses may be moved before the write, but
++	 * no memory accesses are moved past the write).
++	 * On other architectures this may not be the case, so we need smp_mb()
++	 * there.
++	 */
++#if defined(CONFIG_X86) && (!defined(CONFIG_X86_PPRO_FENCE) && !defined(CONFIG_X86_OOSTORE))
++	barrier();
++#else
++	smp_mb();
++#endif
++	this_cpu_dec(*p->counters);
++}
++
++static inline unsigned __percpu_count(unsigned __percpu *counters)
++{
++	unsigned total = 0;
++	int cpu;
++
++	for_each_possible_cpu(cpu)
++		total += ACCESS_ONCE(*per_cpu_ptr(counters, cpu));
++
++	return total;
++}
++
++static inline void percpu_down_write(struct percpu_rw_semaphore *p)
++{
++	mutex_lock(&p->mtx);
++	p->locked = true;
++	synchronize_rcu();
++	while (__percpu_count(p->counters))
++		msleep(1);
++	smp_rmb(); /* paired with smp_mb() in percpu_sem_up_read() */
++}
++
++static inline void percpu_up_write(struct percpu_rw_semaphore *p)
++{
++	p->locked = false;
++	mutex_unlock(&p->mtx);
++}
++
++static inline int percpu_init_rwsem(struct percpu_rw_semaphore *p)
++{
++	p->counters = alloc_percpu(unsigned);
++	if (unlikely(!p->counters))
++		return -ENOMEM;
++	p->locked = false;
++	mutex_init(&p->mtx);
++	return 0;
++}
++
++static inline void percpu_free_rwsem(struct percpu_rw_semaphore *p)
++{
++	free_percpu(p->counters);
++	p->counters = NULL; /* catch use after free bugs */
++}
++
++#endif
diff --git a/freed-ora/current/f18/config-arm-generic b/freed-ora/current/f18/config-arm-generic
index e0507a0f1..625c61111 100644
--- a/freed-ora/current/f18/config-arm-generic
+++ b/freed-ora/current/f18/config-arm-generic
@@ -63,6 +63,9 @@ CONFIG_CPU_IDLE=y
 # CONFIG_CPU_IDLE_GOV_LADDER is not set
 CONFIG_CPU_IDLE_GOV_MENU=y
 
+CONFIG_DEFAULT_MMAP_MIN_ADDR=32768
+CONFIG_LSM_MMAP_MIN_ADDR=32768
+
 CONFIG_NO_HZ=y
 CONFIG_HIGH_RES_TIMERS=y
 
diff --git a/freed-ora/current/f18/fs-lock-splice_read-and-splice_write-functions.patch b/freed-ora/current/f18/fs-lock-splice_read-and-splice_write-functions.patch
new file mode 100644
index 000000000..938cbd9f5
--- /dev/null
+++ b/freed-ora/current/f18/fs-lock-splice_read-and-splice_write-functions.patch
@@ -0,0 +1,74 @@
+Lock splice_read and splice_write functions
+
+commit 1a25b1c4ce189e3926f2981f3302352a930086db
+Author: Mikulas Patocka <mpatocka@redhat.com>
+Date:   Mon Oct 15 17:20:17 2012 -0400
+
+    Lock splice_read and splice_write functions
+    
+    Functions generic_file_splice_read and generic_file_splice_write access
+    the pagecache directly. For block devices these functions must be locked
+    so that block size is not changed while they are in progress.
+    
+    This patch is an additional fix for commit b87570f5d349 ("Fix a crash
+    when block device is read and block size is changed at the same time")
+    that locked aio_read, aio_write and mmap against block size change.
+    
+    Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+
+Index: linux-3.6.x86_64/fs/block_dev.c
+===================================================================
+--- linux-3.6.x86_64.orig/fs/block_dev.c	2012-11-16 17:12:57.352936580 -0500
++++ linux-3.6.x86_64/fs/block_dev.c	2012-11-16 17:13:11.908887989 -0500
+@@ -1662,6 +1662,39 @@
+ 	return ret;
+ }
+ 
++static ssize_t blkdev_splice_read(struct file *file, loff_t *ppos,
++				  struct pipe_inode_info *pipe, size_t len,
++				  unsigned int flags)
++{
++	ssize_t ret;
++	struct block_device *bdev = I_BDEV(file->f_mapping->host);
++
++	percpu_down_read(&bdev->bd_block_size_semaphore);
++
++	ret = generic_file_splice_read(file, ppos, pipe, len, flags);
++
++	percpu_up_read(&bdev->bd_block_size_semaphore);
++
++	return ret;
++}
++
++static ssize_t blkdev_splice_write(struct pipe_inode_info *pipe,
++				   struct file *file, loff_t *ppos, size_t len,
++				   unsigned int flags)
++{
++	ssize_t ret;
++	struct block_device *bdev = I_BDEV(file->f_mapping->host);
++
++	percpu_down_read(&bdev->bd_block_size_semaphore);
++
++	ret = generic_file_splice_write(pipe, file, ppos, len, flags);
++
++	percpu_up_read(&bdev->bd_block_size_semaphore);
++
++	return ret;
++}
++
++
+ /*
+  * Try to release a page associated with block device when the system
+  * is under memory pressure.
+@@ -1700,8 +1733,8 @@
+ #ifdef CONFIG_COMPAT
+ 	.compat_ioctl	= compat_blkdev_ioctl,
+ #endif
+-	.splice_read	= generic_file_splice_read,
+-	.splice_write	= generic_file_splice_write,
++	.splice_read	= blkdev_splice_read,
++	.splice_write	= blkdev_splice_write,
+ };
+ 
+ int ioctl_by_bdev(struct block_device *bdev, unsigned cmd, unsigned long arg)
diff --git a/freed-ora/current/f18/kernel.spec b/freed-ora/current/f18/kernel.spec
index b3657e90c..43ca0d201 100644
--- a/freed-ora/current/f18/kernel.spec
+++ b/freed-ora/current/f18/kernel.spec
@@ -62,7 +62,7 @@ Summary: The Linux kernel
 # For non-released -rc kernels, this will be appended after the rcX and
 # gitX tags, so a 3 here would become part of release "0.rcX.gitX.3"
 #
-%global baserelease 1
+%global baserelease 5
 %global fedora_build %{baserelease}
 
 # base_sublevel is the kernel version we're starting with and patching
@@ -860,6 +860,20 @@ Patch22114: iwlwifi-remove-queue-empty-warn-3.6.patch
 #rhbz 870562
 Patch22115: keyspan.patch
 
+#rhbz 812129
+Patch22120: block-fix-a-crash-when-block-device-is.patch
+Patch22121: blockdev-turn-a-rw-semaphore-into-a-percpu-rw-sem.patch
+Patch22122: fs-lock-splice_read-and-splice_write-functions.patch
+
+#rhbz 874791
+Patch22125: Bluetooth-Add-support-for-BCM20702A0.patch
+
+#rhbz 859485
+Patch21226: vt-Drop-K_OFF-for-VC_MUTE.patch
+
+#rhbz CVE-2012-4461 862900 878518
+Patch21227: KVM-x86-invalid-opcode-oops-on-SET_SREGS-with-OSXSAV.patch
+
 # END OF PATCH DEFINITIONS
 
 %endif
@@ -1673,6 +1687,20 @@ ApplyPatch iwlwifi-remove-queue-empty-warn-3.6.patch
 #rhbz 870562
 ApplyPatch keyspan.patch
 
+#rhbz 812129
+ApplyPatch block-fix-a-crash-when-block-device-is.patch
+ApplyPatch blockdev-turn-a-rw-semaphore-into-a-percpu-rw-sem.patch
+ApplyPatch fs-lock-splice_read-and-splice_write-functions.patch
+
+#rhbz 874791
+ApplyPatch Bluetooth-Add-support-for-BCM20702A0.patch
+
+#rhbz 859485
+ApplyPatch vt-Drop-K_OFF-for-VC_MUTE.patch
+
+#rhbz CVE-2012-4461 862900 878518
+ApplyPatch KVM-x86-invalid-opcode-oops-on-SET_SREGS-with-OSXSAV.patch
+
 # END OF PATCH APPLICATIONS
 
 %endif
@@ -2549,6 +2577,17 @@ fi
 #                 ||----w |
 #                 ||     ||
 %changelog
+* Tue Nov 20 2012 Josh Boyer <jwboyer@redhat.com> - 3.6.7-5
+- CVE-2012-4461: kvm: invalid opcode oops on SET_SREGS with OSXSAVE bit set (rhbz 878518 862900)
+- Add VC_MUTE ioctl (rhbz 859485)
+- Add support for BCM20702A0 (rhbz 874791)
+
+* Tue Nov 20 2012 Peter Robinson <pbrobinson@fedoraproject.org>
+- Change the minimum mmap address back to 32768 on ARM systems (thanks to Jon Masters)
+
+* Mon Nov 19 2012 Josh Boyer <jwboyer@redhat.com>
+- Apply patches from Jeff Moyer to fix direct-io oops (rhbz 812129)
+
 * Mon Nov 19 2012 Alexandre Oliva <lxoliva@fsfla.org> -libre
 - GNU Linux-libre 3.6.7-gnu.
 
diff --git a/freed-ora/current/f18/vt-Drop-K_OFF-for-VC_MUTE.patch b/freed-ora/current/f18/vt-Drop-K_OFF-for-VC_MUTE.patch
new file mode 100644
index 000000000..ab85411cb
--- /dev/null
+++ b/freed-ora/current/f18/vt-Drop-K_OFF-for-VC_MUTE.patch
@@ -0,0 +1,250 @@
+Path: news.gmane.org!not-for-mail
+From: Adam Jackson <ajax@redhat.com>
+Newsgroups: gmane.linux.kernel
+Subject: [PATCH] vt: Drop K_OFF for VC_MUTE
+Date: Fri, 16 Nov 2012 13:32:34 -0500
+Lines: 205
+Approved: news@gmane.org
+Message-ID: <1353090754-30233-1-git-send-email-ajax@redhat.com>
+NNTP-Posting-Host: plane.gmane.org
+X-Trace: ger.gmane.org 1353090772 20663 80.91.229.3 (16 Nov 2012 18:32:52 GMT)
+X-Complaints-To: usenet@ger.gmane.org
+NNTP-Posting-Date: Fri, 16 Nov 2012 18:32:52 +0000 (UTC)
+Cc: Arthur Taylor <art@ified.ca>,
+	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+To: linux-kernel@vger.kernel.org
+Original-X-From: linux-kernel-owner@vger.kernel.org Fri Nov 16 19:33:03 2012
+Return-path: <linux-kernel-owner@vger.kernel.org>
+Envelope-to: glk-linux-kernel-3@plane.gmane.org
+Original-Received: from vger.kernel.org ([209.132.180.67])
+	by plane.gmane.org with esmtp (Exim 4.69)
+	(envelope-from <linux-kernel-owner@vger.kernel.org>)
+	id 1TZQim-0000aG-BI
+	for glk-linux-kernel-3@plane.gmane.org; Fri, 16 Nov 2012 19:32:56 +0100
+Original-Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
+	id S1753232Ab2KPSck (ORCPT <rfc822;glk-linux-kernel-3@m.gmane.org>);
+	Fri, 16 Nov 2012 13:32:40 -0500
+Original-Received: from mx1.redhat.com ([209.132.183.28]:32172 "EHLO mx1.redhat.com"
+	rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
+	id S1752810Ab2KPSci (ORCPT <rfc822;linux-kernel@vger.kernel.org>);
+	Fri, 16 Nov 2012 13:32:38 -0500
+Original-Received: from int-mx01.intmail.prod.int.phx2.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11])
+	by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id qAGIWaM7020116
+	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK);
+	Fri, 16 Nov 2012 13:32:36 -0500
+Original-Received: from ihatethathostname.lab.bos.redhat.com (ihatethathostname.lab.bos.redhat.com [10.16.43.238])
+	by int-mx01.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id qAGIWZD7010099;
+	Fri, 16 Nov 2012 13:32:35 -0500
+X-Scanned-By: MIMEDefang 2.67 on 10.5.11.11
+Original-Sender: linux-kernel-owner@vger.kernel.org
+Precedence: bulk
+List-ID: <linux-kernel.vger.kernel.org>
+X-Mailing-List: linux-kernel@vger.kernel.org
+Xref: news.gmane.org gmane.linux.kernel:1395620
+Archived-At: <http://permalink.gmane.org/gmane.linux.kernel/1395620>
+
+The "don't enqueue stuff" semantics of K_OFF shouldn't be a function of
+the keyboard map state; we should be able to switch among cooked/raw/
+unicode without changing whether events are delivered.  Otherwise - if
+changing to K_UNICODE undoes K_OFF - then suddenly Alt-F2 under
+Gnome will switch VT instead of summoning the "run command" dialog.
+
+Drop the K_OFF handling and replace it with a new "mute" ioctl pair.
+Anybody using K_OFF would already need to be prepared to handle it
+throwing -EINVAL for old kernel compatibility, so userspace will degrade
+gracefully.
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=859485
+Cc: Arthur Taylor <art@ified.ca>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Tested-by: Josh Boyer <jwboyer@redhat.com>
+Signed-off-by: Adam Jackson <ajax@redhat.com>
+---
+ drivers/tty/vt/keyboard.c | 40 +++++++++++++++++++++++++++++++++-------
+ drivers/tty/vt/vt_ioctl.c | 13 +++++++++++++
+ include/linux/kbd_kern.h  |  6 +++---
+ include/linux/vt_kern.h   |  2 ++
+ include/linux/kd.h   |  5 +++++
+ 5 files changed, 56 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
+index 681765b..08d1d57 100644
+--- a/drivers/tty/vt/keyboard.c
++++ b/drivers/tty/vt/keyboard.c
+@@ -657,7 +657,7 @@ static void k_spec(struct vc_data *vc, unsigned char value, char up_flag)
+ 		return;
+ 	if ((kbd->kbdmode == VC_RAW ||
+ 	     kbd->kbdmode == VC_MEDIUMRAW ||
+-	     kbd->kbdmode == VC_OFF) &&
++	     vc_kbd_mode(kbd, VC_MUTE)) &&
+ 	     value != KVAL(K_SAK))
+ 		return;		/* SAK is allowed even in raw mode */
+ 	fn_handler[value](vc);
+@@ -1381,7 +1381,7 @@ static void kbd_keycode(unsigned int keycode, int down, int hw_raw)
+ 	if (rc == NOTIFY_STOP)
+ 		return;
+ 
+-	if ((raw_mode || kbd->kbdmode == VC_OFF) && type != KT_SPEC && type != KT_SHIFT)
++	if ((raw_mode || vc_kbd_mode(kbd, VC_MUTE)) && type != KT_SPEC && type != KT_SHIFT)
+ 		return;
+ 
+ 	(*k_handler[type])(vc, keysym & 0xff, !down);
+@@ -1731,9 +1731,6 @@ int vt_do_kdskbmode(int console, unsigned int arg)
+ 		kbd->kbdmode = VC_UNICODE;
+ 		do_compute_shiftstate();
+ 		break;
+-	case K_OFF:
+-		kbd->kbdmode = VC_OFF;
+-		break;
+ 	default:
+ 		ret = -EINVAL;
+ 	}
+@@ -1742,6 +1739,30 @@ int vt_do_kdskbmode(int console, unsigned int arg)
+ }
+ 
+ /**
++ *	vt_do_kdskbmute		-	set keyboard event mute
++ *	@console: the console to use
++ *	@arg: the requested mode
++ *
++ *	Update the keyboard mute state while holding the correct locks.
++ *	Return 0 for success or an error code.
++ */
++int vt_do_kdskbmute(int console, unsigned int arg)
++{
++	struct kbd_struct * kbd = kbd_table + console;
++	int ret = 0;
++	unsigned long flags;
++
++	spin_lock_irqsave(&kbd_event_lock, flags);
++	if (arg)
++		set_vc_kbd_mode(kbd, VC_MUTE);
++	else
++		clr_vc_kbd_mode(kbd, VC_MUTE);
++	spin_unlock_irqrestore(&kbd_event_lock, flags);
++	return ret;
++}
++
++
++/**
+  *	vt_do_kdskbmeta		-	set keyboard meta state
+  *	@console: the console to use
+  *	@arg: the requested meta state
+@@ -2068,13 +2089,18 @@ int vt_do_kdgkbmode(int console)
+ 		return K_MEDIUMRAW;
+ 	case VC_UNICODE:
+ 		return K_UNICODE;
+-	case VC_OFF:
+-		return K_OFF;
+ 	default:
+ 		return K_XLATE;
+ 	}
+ }
+ 
++int vt_do_kdgkbmute(int console)
++{
++	struct kbd_struct * kbd = kbd_table + console;
++	/* This is a spot read so needs no locking */
++	return vc_kbd_mode(kbd, VC_MUTE);
++}
++
+ /**
+  *	vt_do_kdgkbmeta		-	report meta status
+  *	@console: console to report
+diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c
+index b841f56..f0951e2 100644
+--- a/drivers/tty/vt/vt_ioctl.c
++++ b/drivers/tty/vt/vt_ioctl.c
+@@ -477,6 +477,19 @@ int vt_ioctl(struct tty_struct *tty,
+ 		ret = put_user(uival, (int __user *)arg);
+ 		break;
+ 
++	case KDSKBMUTE:
++		if (!perm)
++			return -EPERM;
++		ret = vt_do_kdskbmute(console, arg);
++		if (ret == 0)
++			tty_ldisc_flush(tty);
++		break;
++
++	case KDGKBMUTE:
++		uival = vt_do_kdgkbmute(console);
++		ret = put_user(uival, (int __user *)arg);
++		break;
++
+ 	/* this could be folded into KDSKBMODE, but for compatibility
+ 	   reasons it is not so easy to fold KDGKBMETA into KDGKBMODE */
+ 	case KDSKBMETA:
+diff --git a/include/linux/kbd_kern.h b/include/linux/kbd_kern.h
+index b7c8cdc..9386143 100644
+--- a/include/linux/kbd_kern.h
++++ b/include/linux/kbd_kern.h
+@@ -48,19 +48,19 @@ struct kbd_struct {
+ #define VC_CAPSLOCK	2	/* capslock mode */
+ #define VC_KANALOCK	3	/* kanalock mode */
+ 
+-	unsigned char kbdmode:3;	/* one 3-bit value */
++	unsigned char kbdmode:2;	/* one 2-bit value */
+ #define VC_XLATE	0	/* translate keycodes using keymap */
+ #define VC_MEDIUMRAW	1	/* medium raw (keycode) mode */
+ #define VC_RAW		2	/* raw (scancode) mode */
+ #define VC_UNICODE	3	/* Unicode mode */
+-#define VC_OFF		4	/* disabled mode */
+ 
+-	unsigned char modeflags:5;
++	unsigned char modeflags:6;
+ #define VC_APPLIC	0	/* application key mode */
+ #define VC_CKMODE	1	/* cursor key mode */
+ #define VC_REPEAT	2	/* keyboard repeat */
+ #define VC_CRLF		3	/* 0 - enter sends CR, 1 - enter sends CRLF */
+ #define VC_META		4	/* 0 - meta, 1 - meta=prefix with ESC */
++#define VC_MUTE		5	/* don't generate events */
+ };
+ 
+ extern int kbd_init(void);
+diff --git a/include/linux/vt_kern.h b/include/linux/vt_kern.h
+index 50ae7d0..a886915 100644
+--- a/include/linux/vt_kern.h
++++ b/include/linux/vt_kern.h
+@@ -168,6 +168,7 @@ extern void hide_boot_cursor(bool hide);
+ 
+ /* keyboard  provided interfaces */
+ extern int vt_do_diacrit(unsigned int cmd, void __user *up, int eperm);
++extern int vt_do_kdskbmute(int console, unsigned int arg);
+ extern int vt_do_kdskbmode(int console, unsigned int arg);
+ extern int vt_do_kdskbmeta(int console, unsigned int arg);
+ extern int vt_do_kbkeycode_ioctl(int cmd, struct kbkeycode __user *user_kbkc,
+@@ -177,6 +178,7 @@ extern int vt_do_kdsk_ioctl(int cmd, struct kbentry __user *user_kbe,
+ extern int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb,
+                                         int perm);
+ extern int vt_do_kdskled(int console, int cmd, unsigned long arg, int perm);
++extern int vt_do_kdgkbmute(int console);
+ extern int vt_do_kdgkbmode(int console);
+ extern int vt_do_kdgkbmeta(int console);
+ extern void vt_reset_unicode(int console);
+diff --git a/include/linux/kd.h b/include/linux/kd.h
+index 87b7cc4..c3de63c 100644
+--- a/include/linux/kd.h
++++ b/include/linux/kd.h
+@@ -81,6 +81,7 @@ struct unimapinit {
+ #define		K_XLATE		0x01
+ #define		K_MEDIUMRAW	0x02
+ #define		K_UNICODE	0x03
++/* K_OFF is no longer implemented, but preserved for source compatibility */
+ #define		K_OFF		0x04
+ #define KDGKBMODE	0x4B44	/* gets current keyboard mode */
+ #define KDSKBMODE	0x4B45	/* sets current keyboard mode */
+@@ -150,6 +151,10 @@ struct kbd_repeat {
+ 			/* earlier this field was misnamed "rate" */
+ };
+ 
++/* get/set event mute */
++#define KDGKBMUTE	0x4B50
++#define KDSKBMUTE	0x4B51
++
+ #define KDKBDREP        0x4B52  /* set keyboard delay/repeat rate;
+ 				 * actually used values are returned */
+ 
+-- 
+1.7.11.7
+