diff options
Diffstat (limited to '3.2.65/1055_linux-3.2.56.patch')
| -rw-r--r-- | 3.2.65/1055_linux-3.2.56.patch | 6904 |
1 files changed, 6904 insertions, 0 deletions
diff --git a/3.2.65/1055_linux-3.2.56.patch b/3.2.65/1055_linux-3.2.56.patch new file mode 100644 index 0000000..2e8239c --- /dev/null +++ b/3.2.65/1055_linux-3.2.56.patch @@ -0,0 +1,6904 @@ +diff --git a/Documentation/filesystems/proc.txt b/Documentation/filesystems/proc.txt +index 0ec91f0..404a097 100644 +--- a/Documentation/filesystems/proc.txt ++++ b/Documentation/filesystems/proc.txt +@@ -1293,8 +1293,8 @@ may allocate from based on an estimation of its current memory and swap use. + For example, if a task is using all allowed memory, its badness score will be + 1000. If it is using half of its allowed memory, its score will be 500. + +-There is an additional factor included in the badness score: root +-processes are given 3% extra memory over other tasks. ++There is an additional factor included in the badness score: the current memory ++and swap usage is discounted by 3% for root processes. + + The amount of "allowed" memory depends on the context in which the oom killer + was called. If it is due to the memory assigned to the allocating task's cpuset +diff --git a/Documentation/i2c/busses/i2c-piix4 b/Documentation/i2c/busses/i2c-piix4 +index 65da157..0982e72 100644 +--- a/Documentation/i2c/busses/i2c-piix4 ++++ b/Documentation/i2c/busses/i2c-piix4 +@@ -8,7 +8,7 @@ Supported adapters: + Datasheet: Only available via NDA from ServerWorks + * ATI IXP200, IXP300, IXP400, SB600, SB700 and SB800 southbridges + Datasheet: Not publicly available +- * AMD Hudson-2, CZ ++ * AMD Hudson-2, ML, CZ + Datasheet: Not publicly available + * Standard Microsystems (SMSC) SLC90E66 (Victory66) southbridge + Datasheet: Publicly available at the SMSC website http://www.smsc.com +diff --git a/Makefile b/Makefile +index 538463e..ec90bfb 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 2 +-SUBLEVEL = 55 ++SUBLEVEL = 56 + EXTRAVERSION = + NAME = Saber-toothed Squirrel + +diff --git a/arch/alpha/lib/csum_partial_copy.c b/arch/alpha/lib/csum_partial_copy.c +index 40736da..1d2ef5a 100644 +--- a/arch/alpha/lib/csum_partial_copy.c ++++ b/arch/alpha/lib/csum_partial_copy.c +@@ -373,6 +373,11 @@ csum_partial_copy_from_user(const void __user *src, void *dst, int len, + __wsum + csum_partial_copy_nocheck(const void *src, void *dst, int len, __wsum sum) + { +- return csum_partial_copy_from_user((__force const void __user *)src, +- dst, len, sum, NULL); ++ __wsum checksum; ++ mm_segment_t oldfs = get_fs(); ++ set_fs(KERNEL_DS); ++ checksum = csum_partial_copy_from_user((__force const void __user *)src, ++ dst, len, sum, NULL); ++ set_fs(oldfs); ++ return checksum; + } +diff --git a/arch/arm/include/asm/cacheflush.h b/arch/arm/include/asm/cacheflush.h +index 1397408..b1e0e07 100644 +--- a/arch/arm/include/asm/cacheflush.h ++++ b/arch/arm/include/asm/cacheflush.h +@@ -202,6 +202,7 @@ extern void copy_to_user_page(struct vm_area_struct *, struct page *, + static inline void __flush_icache_all(void) + { + __flush_icache_preferred(); ++ dsb(); + } + + #define flush_cache_all() __cpuc_flush_kern_all() +diff --git a/arch/arm/include/asm/spinlock.h b/arch/arm/include/asm/spinlock.h +index 65fa3c8..095a9a3 100644 +--- a/arch/arm/include/asm/spinlock.h ++++ b/arch/arm/include/asm/spinlock.h +@@ -44,18 +44,9 @@ + + static inline void dsb_sev(void) + { +-#if __LINUX_ARM_ARCH__ >= 7 +- __asm__ __volatile__ ( +- "dsb\n" +- SEV +- ); +-#else +- __asm__ __volatile__ ( +- "mcr p15, 0, %0, c7, c10, 4\n" +- SEV +- : : "r" (0) +- ); +-#endif ++ ++ dsb(); ++ __asm__(SEV); + } + + /* +diff --git a/arch/arm/mm/proc-v6.S b/arch/arm/mm/proc-v6.S +index 8168d99..85a5348 100644 +--- a/arch/arm/mm/proc-v6.S ++++ b/arch/arm/mm/proc-v6.S +@@ -199,7 +199,6 @@ __v6_setup: + mcr p15, 0, r0, c7, c14, 0 @ clean+invalidate D cache + mcr p15, 0, r0, c7, c5, 0 @ invalidate I cache + mcr p15, 0, r0, c7, c15, 0 @ clean+invalidate cache +- mcr p15, 0, r0, c7, c10, 4 @ drain write buffer + #ifdef CONFIG_MMU + mcr p15, 0, r0, c8, c7, 0 @ invalidate I + D TLBs + mcr p15, 0, r0, c2, c0, 2 @ TTB control register +@@ -209,6 +208,8 @@ __v6_setup: + ALT_UP(orr r8, r8, #TTB_FLAGS_UP) + mcr p15, 0, r8, c2, c0, 1 @ load TTB1 + #endif /* CONFIG_MMU */ ++ mcr p15, 0, r0, c7, c10, 4 @ drain write buffer and ++ @ complete invalidations + adr r5, v6_crval + ldmia r5, {r5, r6} + #ifdef CONFIG_CPU_ENDIAN_BE8 +diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S +index 785365e..19d21ff 100644 +--- a/arch/arm/mm/proc-v7.S ++++ b/arch/arm/mm/proc-v7.S +@@ -368,7 +368,6 @@ __v7_setup: + + 3: mov r10, #0 + mcr p15, 0, r10, c7, c5, 0 @ I+BTB cache invalidate +- dsb + #ifdef CONFIG_MMU + mcr p15, 0, r10, c8, c7, 0 @ invalidate I + D TLBs + mcr p15, 0, r10, c2, c0, 2 @ TTB control register +@@ -382,6 +381,7 @@ __v7_setup: + mcr p15, 0, r5, c10, c2, 0 @ write PRRR + mcr p15, 0, r6, c10, c2, 1 @ write NMRR + #endif ++ dsb @ Complete invalidations + #ifndef CONFIG_ARM_THUMBEE + mrc p15, 0, r0, c0, c1, 0 @ read ID_PFR0 for ThumbEE + and r0, r0, #(0xf << 12) @ ThumbEE enabled field +diff --git a/arch/avr32/Makefile b/arch/avr32/Makefile +index 22fb665..dba48a5 100644 +--- a/arch/avr32/Makefile ++++ b/arch/avr32/Makefile +@@ -11,7 +11,7 @@ all: uImage vmlinux.elf + + KBUILD_DEFCONFIG := atstk1002_defconfig + +-KBUILD_CFLAGS += -pipe -fno-builtin -mno-pic ++KBUILD_CFLAGS += -pipe -fno-builtin -mno-pic -D__linux__ + KBUILD_AFLAGS += -mrelax -mno-pic + KBUILD_CFLAGS_MODULE += -mno-relax + LDFLAGS_vmlinux += --relax +diff --git a/arch/avr32/boards/mimc200/fram.c b/arch/avr32/boards/mimc200/fram.c +index 9764a1a..c1466a8 100644 +--- a/arch/avr32/boards/mimc200/fram.c ++++ b/arch/avr32/boards/mimc200/fram.c +@@ -11,6 +11,7 @@ + #define FRAM_VERSION "1.0" + + #include <linux/miscdevice.h> ++#include <linux/module.h> + #include <linux/proc_fs.h> + #include <linux/mm.h> + #include <linux/io.h> +diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c +index a79fe9a..7d5ac0b 100644 +--- a/arch/mips/mm/c-r4k.c ++++ b/arch/mips/mm/c-r4k.c +@@ -633,9 +633,6 @@ static void r4k_dma_cache_inv(unsigned long addr, unsigned long size) + if (size >= scache_size) + r4k_blast_scache(); + else { +- unsigned long lsize = cpu_scache_line_size(); +- unsigned long almask = ~(lsize - 1); +- + /* + * There is no clearly documented alignment requirement + * for the cache instruction on MIPS processors and +@@ -644,9 +641,6 @@ static void r4k_dma_cache_inv(unsigned long addr, unsigned long size) + * hit ops with insufficient alignment. Solved by + * aligning the address to cache line size. + */ +- cache_op(Hit_Writeback_Inv_SD, addr & almask); +- cache_op(Hit_Writeback_Inv_SD, +- (addr + size - 1) & almask); + blast_inv_scache_range(addr, addr + size); + } + __sync(); +@@ -656,12 +650,7 @@ static void r4k_dma_cache_inv(unsigned long addr, unsigned long size) + if (cpu_has_safe_index_cacheops && size >= dcache_size) { + r4k_blast_dcache(); + } else { +- unsigned long lsize = cpu_dcache_line_size(); +- unsigned long almask = ~(lsize - 1); +- + R4600_HIT_CACHEOP_WAR_IMPL; +- cache_op(Hit_Writeback_Inv_D, addr & almask); +- cache_op(Hit_Writeback_Inv_D, (addr + size - 1) & almask); + blast_inv_dcache_range(addr, addr + size); + } + +diff --git a/arch/powerpc/kernel/cacheinfo.c b/arch/powerpc/kernel/cacheinfo.c +index a3c684b..02ebe1a 100644 +--- a/arch/powerpc/kernel/cacheinfo.c ++++ b/arch/powerpc/kernel/cacheinfo.c +@@ -788,6 +788,9 @@ static void remove_cache_dir(struct cache_dir *cache_dir) + { + remove_index_dirs(cache_dir); + ++ /* Remove cache dir from sysfs */ ++ kobject_del(cache_dir->kobj); ++ + kobject_put(cache_dir->kobj); + + kfree(cache_dir); +diff --git a/arch/powerpc/kernel/crash_dump.c b/arch/powerpc/kernel/crash_dump.c +index 424afb6..39787c9 100644 +--- a/arch/powerpc/kernel/crash_dump.c ++++ b/arch/powerpc/kernel/crash_dump.c +@@ -108,17 +108,19 @@ ssize_t copy_oldmem_page(unsigned long pfn, char *buf, + size_t csize, unsigned long offset, int userbuf) + { + void *vaddr; ++ phys_addr_t paddr; + + if (!csize) + return 0; + + csize = min_t(size_t, csize, PAGE_SIZE); ++ paddr = pfn << PAGE_SHIFT; + +- if ((min_low_pfn < pfn) && (pfn < max_pfn)) { +- vaddr = __va(pfn << PAGE_SHIFT); ++ if (memblock_is_region_memory(paddr, csize)) { ++ vaddr = __va(paddr); + csize = copy_oldmem_vaddr(vaddr, buf, csize, offset, userbuf); + } else { +- vaddr = __ioremap(pfn << PAGE_SHIFT, PAGE_SIZE, 0); ++ vaddr = __ioremap(paddr, PAGE_SIZE, 0); + csize = copy_oldmem_vaddr(vaddr, buf, csize, offset, userbuf); + iounmap(vaddr); + } +diff --git a/arch/powerpc/kernel/reloc_64.S b/arch/powerpc/kernel/reloc_64.S +index b47a0e1..c712ece 100644 +--- a/arch/powerpc/kernel/reloc_64.S ++++ b/arch/powerpc/kernel/reloc_64.S +@@ -81,6 +81,7 @@ _GLOBAL(relocate) + + 6: blr + ++.balign 8 + p_dyn: .llong __dynamic_start - 0b + p_rela: .llong __rela_dyn_start - 0b + p_st: .llong _stext - 0b +diff --git a/arch/powerpc/kvm/e500_tlb.c b/arch/powerpc/kvm/e500_tlb.c +index 13c432e..844fc83 100644 +--- a/arch/powerpc/kvm/e500_tlb.c ++++ b/arch/powerpc/kvm/e500_tlb.c +@@ -481,7 +481,7 @@ static inline void kvmppc_e500_priv_release(struct tlbe_priv *priv) + } + + static inline void kvmppc_e500_deliver_tlb_miss(struct kvm_vcpu *vcpu, +- unsigned int eaddr, int as) ++ gva_t eaddr, int as) + { + struct kvmppc_vcpu_e500 *vcpu_e500 = to_e500(vcpu); + unsigned int victim, pidsel, tsized; +diff --git a/arch/s390/crypto/aes_s390.c b/arch/s390/crypto/aes_s390.c +index 3ec8b39..51fb1ef 100644 +--- a/arch/s390/crypto/aes_s390.c ++++ b/arch/s390/crypto/aes_s390.c +@@ -25,6 +25,7 @@ + #include <linux/err.h> + #include <linux/module.h> + #include <linux/init.h> ++#include <linux/spinlock.h> + #include "crypt_s390.h" + + #define AES_KEYLEN_128 1 +@@ -32,6 +33,7 @@ + #define AES_KEYLEN_256 4 + + static u8 *ctrblk; ++static DEFINE_SPINLOCK(ctrblk_lock); + static char keylen_flag; + + struct s390_aes_ctx { +@@ -324,7 +326,8 @@ static int ecb_aes_crypt(struct blkcipher_desc *desc, long func, void *param, + u8 *in = walk->src.virt.addr; + + ret = crypt_s390_km(func, param, out, in, n); +- BUG_ON((ret < 0) || (ret != n)); ++ if (ret < 0 || ret != n) ++ return -EIO; + + nbytes &= AES_BLOCK_SIZE - 1; + ret = blkcipher_walk_done(desc, walk, nbytes); +@@ -463,7 +466,8 @@ static int cbc_aes_crypt(struct blkcipher_desc *desc, long func, + u8 *in = walk->src.virt.addr; + + ret = crypt_s390_kmc(func, ¶m, out, in, n); +- BUG_ON((ret < 0) || (ret != n)); ++ if (ret < 0 || ret != n) ++ return -EIO; + + nbytes &= AES_BLOCK_SIZE - 1; + ret = blkcipher_walk_done(desc, walk, nbytes); +@@ -636,7 +640,8 @@ static int xts_aes_crypt(struct blkcipher_desc *desc, long func, + memcpy(pcc_param.tweak, walk->iv, sizeof(pcc_param.tweak)); + memcpy(pcc_param.key, xts_ctx->pcc_key, 32); + ret = crypt_s390_pcc(func, &pcc_param.key[offset]); +- BUG_ON(ret < 0); ++ if (ret < 0) ++ return -EIO; + + memcpy(xts_param.key, xts_ctx->key, 32); + memcpy(xts_param.init, pcc_param.xts, 16); +@@ -647,7 +652,8 @@ static int xts_aes_crypt(struct blkcipher_desc *desc, long func, + in = walk->src.virt.addr; + + ret = crypt_s390_km(func, &xts_param.key[offset], out, in, n); +- BUG_ON(ret < 0 || ret != n); ++ if (ret < 0 || ret != n) ++ return -EIO; + + nbytes &= AES_BLOCK_SIZE - 1; + ret = blkcipher_walk_done(desc, walk, nbytes); +@@ -756,42 +762,67 @@ static int ctr_aes_set_key(struct crypto_tfm *tfm, const u8 *in_key, + return aes_set_key(tfm, in_key, key_len); + } + ++static unsigned int __ctrblk_init(u8 *ctrptr, unsigned int nbytes) ++{ ++ unsigned int i, n; ++ ++ /* only use complete blocks, max. PAGE_SIZE */ ++ n = (nbytes > PAGE_SIZE) ? PAGE_SIZE : nbytes & ~(AES_BLOCK_SIZE - 1); ++ for (i = AES_BLOCK_SIZE; i < n; i += AES_BLOCK_SIZE) { ++ memcpy(ctrptr + i, ctrptr + i - AES_BLOCK_SIZE, ++ AES_BLOCK_SIZE); ++ crypto_inc(ctrptr + i, AES_BLOCK_SIZE); ++ } ++ return n; ++} ++ + static int ctr_aes_crypt(struct blkcipher_desc *desc, long func, + struct s390_aes_ctx *sctx, struct blkcipher_walk *walk) + { + int ret = blkcipher_walk_virt_block(desc, walk, AES_BLOCK_SIZE); +- unsigned int i, n, nbytes; +- u8 buf[AES_BLOCK_SIZE]; +- u8 *out, *in; ++ unsigned int n, nbytes; ++ u8 buf[AES_BLOCK_SIZE], ctrbuf[AES_BLOCK_SIZE]; ++ u8 *out, *in, *ctrptr = ctrbuf; + + if (!walk->nbytes) + return ret; + +- memcpy(ctrblk, walk->iv, AES_BLOCK_SIZE); ++ if (spin_trylock(&ctrblk_lock)) ++ ctrptr = ctrblk; ++ ++ memcpy(ctrptr, walk->iv, AES_BLOCK_SIZE); + while ((nbytes = walk->nbytes) >= AES_BLOCK_SIZE) { + out = walk->dst.virt.addr; + in = walk->src.virt.addr; + while (nbytes >= AES_BLOCK_SIZE) { +- /* only use complete blocks, max. PAGE_SIZE */ +- n = (nbytes > PAGE_SIZE) ? PAGE_SIZE : +- nbytes & ~(AES_BLOCK_SIZE - 1); +- for (i = AES_BLOCK_SIZE; i < n; i += AES_BLOCK_SIZE) { +- memcpy(ctrblk + i, ctrblk + i - AES_BLOCK_SIZE, +- AES_BLOCK_SIZE); +- crypto_inc(ctrblk + i, AES_BLOCK_SIZE); ++ if (ctrptr == ctrblk) ++ n = __ctrblk_init(ctrptr, nbytes); ++ else ++ n = AES_BLOCK_SIZE; ++ ret = crypt_s390_kmctr(func, sctx->key, out, in, ++ n, ctrptr); ++ if (ret < 0 || ret != n) { ++ if (ctrptr == ctrblk) ++ spin_unlock(&ctrblk_lock); ++ return -EIO; + } +- ret = crypt_s390_kmctr(func, sctx->key, out, in, n, ctrblk); +- BUG_ON(ret < 0 || ret != n); + if (n > AES_BLOCK_SIZE) +- memcpy(ctrblk, ctrblk + n - AES_BLOCK_SIZE, ++ memcpy(ctrptr, ctrptr + n - AES_BLOCK_SIZE, + AES_BLOCK_SIZE); +- crypto_inc(ctrblk, AES_BLOCK_SIZE); ++ crypto_inc(ctrptr, AES_BLOCK_SIZE); + out += n; + in += n; + nbytes -= n; + } + ret = blkcipher_walk_done(desc, walk, nbytes); + } ++ if (ctrptr == ctrblk) { ++ if (nbytes) ++ memcpy(ctrbuf, ctrptr, AES_BLOCK_SIZE); ++ else ++ memcpy(walk->iv, ctrptr, AES_BLOCK_SIZE); ++ spin_unlock(&ctrblk_lock); ++ } + /* + * final block may be < AES_BLOCK_SIZE, copy only nbytes + */ +@@ -799,13 +830,15 @@ static int ctr_aes_crypt(struct blkcipher_desc *desc, long func, + out = walk->dst.virt.addr; + in = walk->src.virt.addr; + ret = crypt_s390_kmctr(func, sctx->key, buf, in, +- AES_BLOCK_SIZE, ctrblk); +- BUG_ON(ret < 0 || ret != AES_BLOCK_SIZE); ++ AES_BLOCK_SIZE, ctrbuf); ++ if (ret < 0 || ret != AES_BLOCK_SIZE) ++ return -EIO; + memcpy(out, buf, nbytes); +- crypto_inc(ctrblk, AES_BLOCK_SIZE); ++ crypto_inc(ctrbuf, AES_BLOCK_SIZE); + ret = blkcipher_walk_done(desc, walk, 0); ++ memcpy(walk->iv, ctrbuf, AES_BLOCK_SIZE); + } +- memcpy(walk->iv, ctrblk, AES_BLOCK_SIZE); ++ + return ret; + } + +diff --git a/arch/s390/crypto/des_s390.c b/arch/s390/crypto/des_s390.c +index a52bfd1..991fb7d 100644 +--- a/arch/s390/crypto/des_s390.c ++++ b/arch/s390/crypto/des_s390.c +@@ -25,6 +25,7 @@ + #define DES3_KEY_SIZE (3 * DES_KEY_SIZE) + + static u8 *ctrblk; ++static DEFINE_SPINLOCK(ctrblk_lock); + + struct s390_des_ctx { + u8 iv[DES_BLOCK_SIZE]; +@@ -95,7 +96,8 @@ static int ecb_desall_crypt(struct blkcipher_desc *desc, long func, + u8 *in = walk->src.virt.addr; + + ret = crypt_s390_km(func, key, out, in, n); +- BUG_ON((ret < 0) || (ret != n)); ++ if (ret < 0 || ret != n) ++ return -EIO; + + nbytes &= DES_BLOCK_SIZE - 1; + ret = blkcipher_walk_done(desc, walk, nbytes); +@@ -105,28 +107,35 @@ static int ecb_desall_crypt(struct blkcipher_desc *desc, long func, + } + + static int cbc_desall_crypt(struct blkcipher_desc *desc, long func, +- u8 *iv, struct blkcipher_walk *walk) ++ struct blkcipher_walk *walk) + { ++ struct s390_des_ctx *ctx = crypto_blkcipher_ctx(desc->tfm); + int ret = blkcipher_walk_virt(desc, walk); + unsigned int nbytes = walk->nbytes; ++ struct { ++ u8 iv[DES_BLOCK_SIZE]; ++ u8 key[DES3_KEY_SIZE]; ++ } param; + + if (!nbytes) + goto out; + +- memcpy(iv, walk->iv, DES_BLOCK_SIZE); ++ memcpy(param.iv, walk->iv, DES_BLOCK_SIZE); ++ memcpy(param.key, ctx->key, DES3_KEY_SIZE); + do { + /* only use complete blocks */ + unsigned int n = nbytes & ~(DES_BLOCK_SIZE - 1); + u8 *out = walk->dst.virt.addr; + u8 *in = walk->src.virt.addr; + +- ret = crypt_s390_kmc(func, iv, out, in, n); +- BUG_ON((ret < 0) || (ret != n)); ++ ret = crypt_s390_kmc(func, ¶m, out, in, n); ++ if (ret < 0 || ret != n) ++ return -EIO; + + nbytes &= DES_BLOCK_SIZE - 1; + ret = blkcipher_walk_done(desc, walk, nbytes); + } while ((nbytes = walk->nbytes)); +- memcpy(walk->iv, iv, DES_BLOCK_SIZE); ++ memcpy(walk->iv, param.iv, DES_BLOCK_SIZE); + + out: + return ret; +@@ -179,22 +188,20 @@ static int cbc_des_encrypt(struct blkcipher_desc *desc, + struct scatterlist *dst, struct scatterlist *src, + unsigned int nbytes) + { +- struct s390_des_ctx *ctx = crypto_blkcipher_ctx(desc->tfm); + struct blkcipher_walk walk; + + blkcipher_walk_init(&walk, dst, src, nbytes); +- return cbc_desall_crypt(desc, KMC_DEA_ENCRYPT, ctx->iv, &walk); ++ return cbc_desall_crypt(desc, KMC_DEA_ENCRYPT, &walk); + } + + static int cbc_des_decrypt(struct blkcipher_desc *desc, + struct scatterlist *dst, struct scatterlist *src, + unsigned int nbytes) + { +- struct s390_des_ctx *ctx = crypto_blkcipher_ctx(desc->tfm); + struct blkcipher_walk walk; + + blkcipher_walk_init(&walk, dst, src, nbytes); +- return cbc_desall_crypt(desc, KMC_DEA_DECRYPT, ctx->iv, &walk); ++ return cbc_desall_crypt(desc, KMC_DEA_DECRYPT, &walk); + } + + static struct crypto_alg cbc_des_alg = { +@@ -331,22 +338,20 @@ static int cbc_des3_encrypt(struct blkcipher_desc *desc, + struct scatterlist *dst, struct scatterlist *src, + unsigned int nbytes) + { +- struct s390_des_ctx *ctx = crypto_blkcipher_ctx(desc->tfm); + struct blkcipher_walk walk; + + blkcipher_walk_init(&walk, dst, src, nbytes); +- return cbc_desall_crypt(desc, KMC_TDEA_192_ENCRYPT, ctx->iv, &walk); ++ return cbc_desall_crypt(desc, KMC_TDEA_192_ENCRYPT, &walk); + } + + static int cbc_des3_decrypt(struct blkcipher_desc *desc, + struct scatterlist *dst, struct scatterlist *src, + unsigned int nbytes) + { +- struct s390_des_ctx *ctx = crypto_blkcipher_ctx(desc->tfm); + struct blkcipher_walk walk; + + blkcipher_walk_init(&walk, dst, src, nbytes); +- return cbc_desall_crypt(desc, KMC_TDEA_192_DECRYPT, ctx->iv, &walk); ++ return cbc_desall_crypt(desc, KMC_TDEA_192_DECRYPT, &walk); + } + + static struct crypto_alg cbc_des3_alg = { +@@ -372,52 +377,80 @@ static struct crypto_alg cbc_des3_alg = { + } + }; + ++static unsigned int __ctrblk_init(u8 *ctrptr, unsigned int nbytes) ++{ ++ unsigned int i, n; ++ ++ /* align to block size, max. PAGE_SIZE */ ++ n = (nbytes > PAGE_SIZE) ? PAGE_SIZE : nbytes & ~(DES_BLOCK_SIZE - 1); ++ for (i = DES_BLOCK_SIZE; i < n; i += DES_BLOCK_SIZE) { ++ memcpy(ctrptr + i, ctrptr + i - DES_BLOCK_SIZE, DES_BLOCK_SIZE); ++ crypto_inc(ctrptr + i, DES_BLOCK_SIZE); ++ } ++ return n; ++} ++ + static int ctr_desall_crypt(struct blkcipher_desc *desc, long func, +- struct s390_des_ctx *ctx, struct blkcipher_walk *walk) ++ struct s390_des_ctx *ctx, ++ struct blkcipher_walk *walk) + { + int ret = blkcipher_walk_virt_block(desc, walk, DES_BLOCK_SIZE); +- unsigned int i, n, nbytes; +- u8 buf[DES_BLOCK_SIZE]; +- u8 *out, *in; ++ unsigned int n, nbytes; ++ u8 buf[DES_BLOCK_SIZE], ctrbuf[DES_BLOCK_SIZE]; ++ u8 *out, *in, *ctrptr = ctrbuf; ++ ++ if (!walk->nbytes) ++ return ret; ++ ++ if (spin_trylock(&ctrblk_lock)) ++ ctrptr = ctrblk; + +- memcpy(ctrblk, walk->iv, DES_BLOCK_SIZE); ++ memcpy(ctrptr, walk->iv, DES_BLOCK_SIZE); + while ((nbytes = walk->nbytes) >= DES_BLOCK_SIZE) { + out = walk->dst.virt.addr; + in = walk->src.virt.addr; + while (nbytes >= DES_BLOCK_SIZE) { +- /* align to block size, max. PAGE_SIZE */ +- n = (nbytes > PAGE_SIZE) ? PAGE_SIZE : +- nbytes & ~(DES_BLOCK_SIZE - 1); +- for (i = DES_BLOCK_SIZE; i < n; i += DES_BLOCK_SIZE) { +- memcpy(ctrblk + i, ctrblk + i - DES_BLOCK_SIZE, +- DES_BLOCK_SIZE); +- crypto_inc(ctrblk + i, DES_BLOCK_SIZE); ++ if (ctrptr == ctrblk) ++ n = __ctrblk_init(ctrptr, nbytes); ++ else ++ n = DES_BLOCK_SIZE; ++ ret = crypt_s390_kmctr(func, ctx->key, out, in, ++ n, ctrptr); ++ if (ret < 0 || ret != n) { ++ if (ctrptr == ctrblk) ++ spin_unlock(&ctrblk_lock); ++ return -EIO; + } +- ret = crypt_s390_kmctr(func, ctx->key, out, in, n, ctrblk); +- BUG_ON((ret < 0) || (ret != n)); + if (n > DES_BLOCK_SIZE) +- memcpy(ctrblk, ctrblk + n - DES_BLOCK_SIZE, ++ memcpy(ctrptr, ctrptr + n - DES_BLOCK_SIZE, + DES_BLOCK_SIZE); +- crypto_inc(ctrblk, DES_BLOCK_SIZE); ++ crypto_inc(ctrptr, DES_BLOCK_SIZE); + out += n; + in += n; + nbytes -= n; + } + ret = blkcipher_walk_done(desc, walk, nbytes); + } +- ++ if (ctrptr == ctrblk) { ++ if (nbytes) ++ memcpy(ctrbuf, ctrptr, DES_BLOCK_SIZE); ++ else ++ memcpy(walk->iv, ctrptr, DES_BLOCK_SIZE); ++ spin_unlock(&ctrblk_lock); ++ } + /* final block may be < DES_BLOCK_SIZE, copy only nbytes */ + if (nbytes) { + out = walk->dst.virt.addr; + in = walk->src.virt.addr; + ret = crypt_s390_kmctr(func, ctx->key, buf, in, +- DES_BLOCK_SIZE, ctrblk); +- BUG_ON(ret < 0 || ret != DES_BLOCK_SIZE); ++ DES_BLOCK_SIZE, ctrbuf); ++ if (ret < 0 || ret != DES_BLOCK_SIZE) ++ return -EIO; + memcpy(out, buf, nbytes); +- crypto_inc(ctrblk, DES_BLOCK_SIZE); ++ crypto_inc(ctrbuf, DES_BLOCK_SIZE); + ret = blkcipher_walk_done(desc, walk, 0); ++ memcpy(walk->iv, ctrbuf, DES_BLOCK_SIZE); + } +- memcpy(walk->iv, ctrblk, DES_BLOCK_SIZE); + return ret; + } + +diff --git a/arch/s390/crypto/ghash_s390.c b/arch/s390/crypto/ghash_s390.c +index b1bd170..f6373f0 100644 +--- a/arch/s390/crypto/ghash_s390.c ++++ b/arch/s390/crypto/ghash_s390.c +@@ -72,14 +72,16 @@ static int ghash_update(struct shash_desc *desc, + if (!dctx->bytes) { + ret = crypt_s390_kimd(KIMD_GHASH, ctx, buf, + GHASH_BLOCK_SIZE); +- BUG_ON(ret != GHASH_BLOCK_SIZE); ++ if (ret != GHASH_BLOCK_SIZE) ++ return -EIO; + } + } + + n = srclen & ~(GHASH_BLOCK_SIZE - 1); + if (n) { + ret = crypt_s390_kimd(KIMD_GHASH, ctx, src, n); +- BUG_ON(ret != n); ++ if (ret != n) ++ return -EIO; + src += n; + srclen -= n; + } +@@ -92,7 +94,7 @@ static int ghash_update(struct shash_desc *desc, + return 0; + } + +-static void ghash_flush(struct ghash_ctx *ctx, struct ghash_desc_ctx *dctx) ++static int ghash_flush(struct ghash_ctx *ctx, struct ghash_desc_ctx *dctx) + { + u8 *buf = dctx->buffer; + int ret; +@@ -103,21 +105,24 @@ static void ghash_flush(struct ghash_ctx *ctx, struct ghash_desc_ctx *dctx) + memset(pos, 0, dctx->bytes); + + ret = crypt_s390_kimd(KIMD_GHASH, ctx, buf, GHASH_BLOCK_SIZE); +- BUG_ON(ret != GHASH_BLOCK_SIZE); ++ if (ret != GHASH_BLOCK_SIZE) ++ return -EIO; + } + + dctx->bytes = 0; ++ return 0; + } + + static int ghash_final(struct shash_desc *desc, u8 *dst) + { + struct ghash_desc_ctx *dctx = shash_desc_ctx(desc); + struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm); ++ int ret; + +- ghash_flush(ctx, dctx); +- memcpy(dst, ctx->icv, GHASH_BLOCK_SIZE); +- +- return 0; ++ ret = ghash_flush(ctx, dctx); ++ if (!ret) ++ memcpy(dst, ctx->icv, GHASH_BLOCK_SIZE); ++ return ret; + } + + static struct shash_alg ghash_alg = { +diff --git a/arch/s390/crypto/sha_common.c b/arch/s390/crypto/sha_common.c +index bd37d09..8620b0e 100644 +--- a/arch/s390/crypto/sha_common.c ++++ b/arch/s390/crypto/sha_common.c +@@ -36,7 +36,8 @@ int s390_sha_update(struct shash_desc *desc, const u8 *data, unsigned int len) + if (index) { + memcpy(ctx->buf + index, data, bsize - index); + ret = crypt_s390_kimd(ctx->func, ctx->state, ctx->buf, bsize); +- BUG_ON(ret != bsize); ++ if (ret != bsize) ++ return -EIO; + data += bsize - index; + len -= bsize - index; + index = 0; +@@ -46,7 +47,8 @@ int s390_sha_update(struct shash_desc *desc, const u8 *data, unsigned int len) + if (len >= bsize) { + ret = crypt_s390_kimd(ctx->func, ctx->state, data, + len & ~(bsize - 1)); +- BUG_ON(ret != (len & ~(bsize - 1))); ++ if (ret != (len & ~(bsize - 1))) ++ return -EIO; + data += ret; + len -= ret; + } +@@ -88,7 +90,8 @@ int s390_sha_final(struct shash_desc *desc, u8 *out) + memcpy(ctx->buf + end - 8, &bits, sizeof(bits)); + + ret = crypt_s390_kimd(ctx->func, ctx->state, ctx->buf, end); +- BUG_ON(ret != end); ++ if (ret != end) ++ return -EIO; + + /* copy digest to out */ + memcpy(out, ctx->state, crypto_shash_digestsize(desc->tfm)); +diff --git a/arch/s390/mm/page-states.c b/arch/s390/mm/page-states.c +index a90d45e..27c50f4 100644 +--- a/arch/s390/mm/page-states.c ++++ b/arch/s390/mm/page-states.c +@@ -12,6 +12,8 @@ + #include <linux/mm.h> + #include <linux/gfp.h> + #include <linux/init.h> ++#include <asm/setup.h> ++#include <asm/ipl.h> + + #define ESSA_SET_STABLE 1 + #define ESSA_SET_UNUSED 2 +@@ -41,6 +43,14 @@ void __init cmma_init(void) + + if (!cmma_flag) + return; ++ /* ++ * Disable CMM for dump, otherwise the tprot based memory ++ * detection can fail because of unstable pages. ++ */ ++ if (OLDMEM_BASE || ipl_info.type == IPL_TYPE_FCP_DUMP) { ++ cmma_flag = 0; ++ return; ++ } + asm volatile( + " .insn rrf,0xb9ab0000,%1,%1,0,0\n" + "0: la %0,0\n" +diff --git a/arch/x86/include/asm/irq.h b/arch/x86/include/asm/irq.h +index ba870bb..f97134a 100644 +--- a/arch/x86/include/asm/irq.h ++++ b/arch/x86/include/asm/irq.h +@@ -25,6 +25,7 @@ extern void irq_ctx_init(int cpu); + + #ifdef CONFIG_HOTPLUG_CPU + #include <linux/cpumask.h> ++extern int check_irq_vectors_for_cpu_disable(void); + extern void fixup_irqs(void); + extern void irq_force_complete_move(int); + #endif +diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c +index 2bda212..1c041e0 100644 +--- a/arch/x86/kernel/cpu/perf_event.c ++++ b/arch/x86/kernel/cpu/perf_event.c +@@ -971,6 +971,9 @@ static void x86_pmu_del(struct perf_event *event, int flags) + for (i = 0; i < cpuc->n_events; i++) { + if (event == cpuc->event_list[i]) { + ++ if (i >= cpuc->n_events - cpuc->n_added) ++ --cpuc->n_added; ++ + if (x86_pmu.put_event_constraints) + x86_pmu.put_event_constraints(cpuc, event); + +diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c +index fb2eb32..687637b 100644 +--- a/arch/x86/kernel/irq.c ++++ b/arch/x86/kernel/irq.c +@@ -222,6 +222,76 @@ void smp_x86_platform_ipi(struct pt_regs *regs) + EXPORT_SYMBOL_GPL(vector_used_by_percpu_irq); + + #ifdef CONFIG_HOTPLUG_CPU ++/* ++ * This cpu is going to be removed and its vectors migrated to the remaining ++ * online cpus. Check to see if there are enough vectors in the remaining cpus. ++ * This function is protected by stop_machine(). ++ */ ++int check_irq_vectors_for_cpu_disable(void) ++{ ++ int irq, cpu; ++ unsigned int this_cpu, vector, this_count, count; ++ struct irq_desc *desc; ++ struct irq_data *data; ++ struct cpumask affinity_new, online_new; ++ ++ this_cpu = smp_processor_id(); ++ cpumask_copy(&online_new, cpu_online_mask); ++ cpu_clear(this_cpu, online_new); ++ ++ this_count = 0; ++ for (vector = FIRST_EXTERNAL_VECTOR; vector < NR_VECTORS; vector++) { ++ irq = __this_cpu_read(vector_irq[vector]); ++ if (irq >= 0) { ++ desc = irq_to_desc(irq); ++ data = irq_desc_get_irq_data(desc); ++ cpumask_copy(&affinity_new, data->affinity); ++ cpu_clear(this_cpu, affinity_new); ++ ++ /* Do not count inactive or per-cpu irqs. */ ++ if (!irq_has_action(irq) || irqd_is_per_cpu(data)) ++ continue; ++ ++ /* ++ * A single irq may be mapped to multiple ++ * cpu's vector_irq[] (for example IOAPIC cluster ++ * mode). In this case we have two ++ * possibilities: ++ * ++ * 1) the resulting affinity mask is empty; that is ++ * this the down'd cpu is the last cpu in the irq's ++ * affinity mask, or ++ * ++ * 2) the resulting affinity mask is no longer ++ * a subset of the online cpus but the affinity ++ * mask is not zero; that is the down'd cpu is the ++ * last online cpu in a user set affinity mask. ++ */ ++ if (cpumask_empty(&affinity_new) || ++ !cpumask_subset(&affinity_new, &online_new)) ++ this_count++; ++ } ++ } ++ ++ count = 0; ++ for_each_online_cpu(cpu) { ++ if (cpu == this_cpu) ++ continue; ++ for (vector = FIRST_EXTERNAL_VECTOR; vector < NR_VECTORS; ++ vector++) { ++ if (per_cpu(vector_irq, cpu)[vector] < 0) ++ count++; ++ } ++ } ++ ++ if (count < this_count) { ++ pr_warn("CPU %d disable failed: CPU has %u vectors assigned and there are only %u available.\n", ++ this_cpu, this_count, count); ++ return -ERANGE; ++ } ++ return 0; ++} ++ + /* A cpu has been removed from cpu_online_mask. Reset irq affinities. */ + void fixup_irqs(void) + { +diff --git a/arch/x86/kernel/quirks.c b/arch/x86/kernel/quirks.c +index 03920a1..28a3e62 100644 +--- a/arch/x86/kernel/quirks.c ++++ b/arch/x86/kernel/quirks.c +@@ -525,7 +525,7 @@ static void __init quirk_amd_nb_node(struct pci_dev *dev) + return; + + pci_read_config_dword(nb_ht, 0x60, &val); +- node = val & 7; ++ node = pcibus_to_node(dev->bus) | (val & 7); + /* + * Some hardware may return an invalid node ID, + * so check it first: +diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c +index 9f548cb..b88eadb 100644 +--- a/arch/x86/kernel/smpboot.c ++++ b/arch/x86/kernel/smpboot.c +@@ -1278,6 +1278,7 @@ void cpu_disable_common(void) + int native_cpu_disable(void) + { + int cpu = smp_processor_id(); ++ int ret; + + /* + * Perhaps use cpufreq to drop frequency, but that could go +@@ -1290,6 +1291,10 @@ int native_cpu_disable(void) + if (cpu == 0) + return -EBUSY; + ++ ret = check_irq_vectors_for_cpu_disable(); ++ if (ret) ++ return ret; ++ + clear_local_APIC(); + + cpu_disable_common(); +diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c +index 405f262..139415e 100644 +--- a/arch/x86/kvm/i8254.c ++++ b/arch/x86/kvm/i8254.c +@@ -38,6 +38,7 @@ + + #include "irq.h" + #include "i8254.h" ++#include "x86.h" + + #ifndef CONFIG_X86_64 + #define mod_64(x, y) ((x) - (y) * div64_u64(x, y)) +@@ -364,6 +365,23 @@ static void create_pit_timer(struct kvm *kvm, u32 val, int is_period) + atomic_set(&pt->pending, 0); + ps->irq_ack = 1; + ++ /* ++ * Do not allow the guest to program periodic timers with small ++ * interval, since the hrtimers are not throttled by the host ++ * scheduler. ++ */ ++ if (ps->is_periodic) { ++ s64 min_period = min_timer_period_us * 1000LL; ++ ++ if (pt->period < min_period) { ++ pr_info_ratelimited( ++ "kvm: requested %lld ns " ++ "i8254 timer period limited to %lld ns\n", ++ pt->period, min_period); ++ pt->period = min_period; ++ } ++ } ++ + hrtimer_start(&pt->timer, ktime_add_ns(ktime_get(), interval), + HRTIMER_MODE_ABS); + } +diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c +index 757c716..176205a 100644 +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -68,9 +68,6 @@ + #define VEC_POS(v) ((v) & (32 - 1)) + #define REG_POS(v) (((v) >> 5) << 4) + +-static unsigned int min_timer_period_us = 500; +-module_param(min_timer_period_us, uint, S_IRUGO | S_IWUSR); +- + static inline u32 apic_get_reg(struct kvm_lapic *apic, int reg_off) + { + return *((u32 *) (apic->regs + reg_off)); +diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c +index 94a4672..2102a17 100644 +--- a/arch/x86/kvm/svm.c ++++ b/arch/x86/kvm/svm.c +@@ -2904,10 +2904,8 @@ static int cr8_write_interception(struct vcpu_svm *svm) + u8 cr8_prev = kvm_get_cr8(&svm->vcpu); + /* instruction emulation calls kvm_set_cr8() */ + r = cr_interception(svm); +- if (irqchip_in_kernel(svm->vcpu.kvm)) { +- clr_cr_intercept(svm, INTERCEPT_CR8_WRITE); ++ if (irqchip_in_kernel(svm->vcpu.kvm)) + return r; +- } + if (cr8_prev <= kvm_get_cr8(&svm->vcpu)) + return r; + kvm_run->exit_reason = KVM_EXIT_SET_TPR; +@@ -3462,6 +3460,8 @@ static void update_cr8_intercept(struct kvm_vcpu *vcpu, int tpr, int irr) + if (is_guest_mode(vcpu) && (vcpu->arch.hflags & HF_VINTR_MASK)) + return; + ++ clr_cr_intercept(svm, INTERCEPT_CR8_WRITE); ++ + if (irr == -1) + return; + +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 7774cca..b9fefaf 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -92,6 +92,9 @@ EXPORT_SYMBOL_GPL(kvm_x86_ops); + int ignore_msrs = 0; + module_param_named(ignore_msrs, ignore_msrs, bool, S_IRUGO | S_IWUSR); + ++unsigned int min_timer_period_us = 500; ++module_param(min_timer_period_us, uint, S_IRUGO | S_IWUSR); ++ + bool kvm_has_tsc_control; + EXPORT_SYMBOL_GPL(kvm_has_tsc_control); + u32 kvm_max_guest_tsc_khz; +diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h +index d36fe23..0e22f64 100644 +--- a/arch/x86/kvm/x86.h ++++ b/arch/x86/kvm/x86.h +@@ -125,4 +125,6 @@ int kvm_write_guest_virt_system(struct x86_emulate_ctxt *ctxt, + gva_t addr, void *val, unsigned int bytes, + struct x86_exception *exception); + ++extern unsigned int min_timer_period_us; ++ + #endif +diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c +index bee75a6..e56da77 100644 +--- a/arch/x86/platform/efi/efi.c ++++ b/arch/x86/platform/efi/efi.c +@@ -424,7 +424,7 @@ void __init efi_reserve_boot_services(void) + * - Not within any part of the kernel + * - Not the bios reserved area + */ +- if ((start+size >= virt_to_phys(_text) ++ if ((start + size > virt_to_phys(_text) + && start <= virt_to_phys(_end)) || + !e820_all_mapped(start, start+size, E820_RAM) || + memblock_x86_check_reserved_size(&start, &size, +diff --git a/block/blk-lib.c b/block/blk-lib.c +index 2b461b4..36751e2 100644 +--- a/block/blk-lib.c ++++ b/block/blk-lib.c +@@ -101,6 +101,14 @@ int blkdev_issue_discard(struct block_device *bdev, sector_t sector, + + atomic_inc(&bb.done); + submit_bio(type, bio); ++ ++ /* ++ * We can loop for a long time in here, if someone does ++ * full device discards (like mkfs). Be nice and allow ++ * us to schedule out to avoid softlocking if preempt ++ * is disabled. ++ */ ++ cond_resched(); + } + + /* Wait for bios in-flight */ +diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c +index 5016de5..f324429 100644 +--- a/drivers/acpi/bus.c ++++ b/drivers/acpi/bus.c +@@ -33,6 +33,7 @@ + #include <linux/proc_fs.h> + #include <linux/acpi.h> + #include <linux/slab.h> ++#include <linux/regulator/machine.h> + #ifdef CONFIG_X86 + #include <asm/mpspec.h> + #endif +@@ -917,6 +918,14 @@ void __init acpi_early_init(void) + goto error0; + } + ++ /* ++ * If the system is using ACPI then we can be reasonably ++ * confident that any regulators are managed by the firmware ++ * so tell the regulator core it has everything it needs to ++ * know. ++ */ ++ regulator_has_full_constraints(); ++ + return; + + error0: +diff --git a/drivers/acpi/processor_throttling.c b/drivers/acpi/processor_throttling.c +index 605a295..abe45cb 100644 +--- a/drivers/acpi/processor_throttling.c ++++ b/drivers/acpi/processor_throttling.c +@@ -59,6 +59,12 @@ struct throttling_tstate { + int target_state; /* target T-state */ + }; + ++struct acpi_processor_throttling_arg { ++ struct acpi_processor *pr; ++ int target_state; ++ bool force; ++}; ++ + #define THROTTLING_PRECHANGE (1) + #define THROTTLING_POSTCHANGE (2) + +@@ -1063,16 +1069,24 @@ static int acpi_processor_set_throttling_ptc(struct acpi_processor *pr, + return 0; + } + ++static long acpi_processor_throttling_fn(void *data) ++{ ++ struct acpi_processor_throttling_arg *arg = data; ++ struct acpi_processor *pr = arg->pr; ++ ++ return pr->throttling.acpi_processor_set_throttling(pr, ++ arg->target_state, arg->force); ++} ++ + int acpi_processor_set_throttling(struct acpi_processor *pr, + int state, bool force) + { +- cpumask_var_t saved_mask; + int ret = 0; + unsigned int i; + struct acpi_processor *match_pr; + struct acpi_processor_throttling *p_throttling; ++ struct acpi_processor_throttling_arg arg; + struct throttling_tstate t_state; +- cpumask_var_t online_throttling_cpus; + + if (!pr) + return -EINVAL; +@@ -1083,14 +1097,6 @@ int acpi_processor_set_throttling(struct acpi_processor *pr, + if ((state < 0) || (state > (pr->throttling.state_count - 1))) + return -EINVAL; + +- if (!alloc_cpumask_var(&saved_mask, GFP_KERNEL)) +- return -ENOMEM; +- +- if (!alloc_cpumask_var(&online_throttling_cpus, GFP_KERNEL)) { +- free_cpumask_var(saved_mask); +- return -ENOMEM; +- } +- + if (cpu_is_offline(pr->id)) { + /* + * the cpu pointed by pr->id is offline. Unnecessary to change +@@ -1099,17 +1105,15 @@ int acpi_processor_set_throttling(struct acpi_processor *pr, + return -ENODEV; + } + +- cpumask_copy(saved_mask, ¤t->cpus_allowed); + t_state.target_state = state; + p_throttling = &(pr->throttling); +- cpumask_and(online_throttling_cpus, cpu_online_mask, +- p_throttling->shared_cpu_map); ++ + /* + * The throttling notifier will be called for every + * affected cpu in order to get one proper T-state. + * The notifier event is THROTTLING_PRECHANGE. + */ +- for_each_cpu(i, online_throttling_cpus) { ++ for_each_cpu_and(i, cpu_online_mask, p_throttling->shared_cpu_map) { + t_state.cpu = i; + acpi_processor_throttling_notifier(THROTTLING_PRECHANGE, + &t_state); +@@ -1121,21 +1125,18 @@ int acpi_processor_set_throttling(struct acpi_processor *pr, + * it can be called only for the cpu pointed by pr. + */ + if (p_throttling->shared_type == DOMAIN_COORD_TYPE_SW_ANY) { +- /* FIXME: use work_on_cpu() */ +- if (set_cpus_allowed_ptr(current, cpumask_of(pr->id))) { +- /* Can't migrate to the pr->id CPU. Exit */ +- ret = -ENODEV; +- goto exit; +- } +- ret = p_throttling->acpi_processor_set_throttling(pr, +- t_state.target_state, force); ++ arg.pr = pr; ++ arg.target_state = state; ++ arg.force = force; ++ ret = work_on_cpu(pr->id, acpi_processor_throttling_fn, &arg); + } else { + /* + * When the T-state coordination is SW_ALL or HW_ALL, + * it is necessary to set T-state for every affected + * cpus. + */ +- for_each_cpu(i, online_throttling_cpus) { ++ for_each_cpu_and(i, cpu_online_mask, ++ p_throttling->shared_cpu_map) { + match_pr = per_cpu(processors, i); + /* + * If the pointer is invalid, we will report the +@@ -1156,13 +1157,12 @@ int acpi_processor_set_throttling(struct acpi_processor *pr, + "on CPU %d\n", i)); + continue; + } +- t_state.cpu = i; +- /* FIXME: use work_on_cpu() */ +- if (set_cpus_allowed_ptr(current, cpumask_of(i))) +- continue; +- ret = match_pr->throttling. +- acpi_processor_set_throttling( +- match_pr, t_state.target_state, force); ++ ++ arg.pr = match_pr; ++ arg.target_state = state; ++ arg.force = force; ++ ret = work_on_cpu(pr->id, acpi_processor_throttling_fn, ++ &arg); + } + } + /* +@@ -1171,17 +1171,12 @@ int acpi_processor_set_throttling(struct acpi_processor *pr, + * affected cpu to update the T-states. + * The notifier event is THROTTLING_POSTCHANGE + */ +- for_each_cpu(i, online_throttling_cpus) { ++ for_each_cpu_and(i, cpu_online_mask, p_throttling->shared_cpu_map) { + t_state.cpu = i; + acpi_processor_throttling_notifier(THROTTLING_POSTCHANGE, + &t_state); + } +- /* restore the previous state */ +- /* FIXME: use work_on_cpu() */ +- set_cpus_allowed_ptr(current, saved_mask); +-exit: +- free_cpumask_var(online_throttling_cpus); +- free_cpumask_var(saved_mask); ++ + return ret; + } + +diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c +index e19898d..2ebfdd2 100644 +--- a/drivers/acpi/video.c ++++ b/drivers/acpi/video.c +@@ -646,6 +646,7 @@ acpi_video_init_brightness(struct acpi_video_device *device) + union acpi_object *o; + struct acpi_video_device_brightness *br = NULL; + int result = -EINVAL; ++ u32 value; + + if (!ACPI_SUCCESS(acpi_video_device_lcd_query_levels(device, &obj))) { + ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Could not query available " +@@ -676,7 +677,12 @@ acpi_video_init_brightness(struct acpi_video_device *device) + printk(KERN_ERR PREFIX "Invalid data\n"); + continue; + } +- br->levels[count] = (u32) o->integer.value; ++ value = (u32) o->integer.value; ++ /* Skip duplicate entries */ ++ if (count > 2 && br->levels[count - 1] == value) ++ continue; ++ ++ br->levels[count] = value; + + if (br->levels[count] > max_level) + max_level = br->levels[count]; +diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c +index f4000ee..0feffc3 100644 +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -61,6 +61,7 @@ enum board_ids { + /* board IDs by feature in alphabetical order */ + board_ahci, + board_ahci_ign_iferr, ++ board_ahci_noncq, + board_ahci_nosntf, + board_ahci_yes_fbs, + +@@ -123,6 +124,13 @@ static const struct ata_port_info ahci_port_info[] = { + .udma_mask = ATA_UDMA6, + .port_ops = &ahci_ops, + }, ++ [board_ahci_noncq] = { ++ AHCI_HFLAGS (AHCI_HFLAG_NO_NCQ), ++ .flags = AHCI_FLAG_COMMON, ++ .pio_mask = ATA_PIO4, ++ .udma_mask = ATA_UDMA6, ++ .port_ops = &ahci_ops, ++ }, + [board_ahci_nosntf] = + { + AHCI_HFLAGS (AHCI_HFLAG_NO_SNTF), +@@ -458,6 +466,12 @@ static const struct pci_device_id ahci_pci_tbl[] = { + { PCI_VDEVICE(ASMEDIA, 0x0611), board_ahci }, /* ASM1061 */ + { PCI_VDEVICE(ASMEDIA, 0x0612), board_ahci }, /* ASM1062 */ + ++ /* ++ * Samsung SSDs found on some macbooks. NCQ times out. ++ * https://bugzilla.kernel.org/show_bug.cgi?id=60731 ++ */ ++ { PCI_VDEVICE(SAMSUNG, 0x1600), board_ahci_noncq }, ++ + /* Enmotus */ + { PCI_DEVICE(0x1c44, 0x8000), board_ahci }, + +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index 72bbb5e..b3f0f5a 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -2188,6 +2188,16 @@ int ata_dev_configure(struct ata_device *dev) + if (rc) + return rc; + ++ /* some WD SATA-1 drives have issues with LPM, turn on NOLPM for them */ ++ if ((dev->horkage & ATA_HORKAGE_WD_BROKEN_LPM) && ++ (id[76] & 0xe) == 0x2) ++ dev->horkage |= ATA_HORKAGE_NOLPM; ++ ++ if (dev->horkage & ATA_HORKAGE_NOLPM) { ++ ata_dev_warn(dev, "LPM support broken, forcing max_power\n"); ++ dev->link->ap->target_lpm_policy = ATA_LPM_MAX_POWER; ++ } ++ + /* let ACPI work its magic */ + rc = ata_acpi_on_devcfg(dev); + if (rc) +@@ -4099,6 +4109,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { + + /* Seagate Momentus SpinPoint M8 seem to have FPMDA_AA issues */ + { "ST1000LM024 HN-M101MBB", "2AR10001", ATA_HORKAGE_BROKEN_FPDMA_AA }, ++ { "ST1000LM024 HN-M101MBB", "2BA30001", ATA_HORKAGE_BROKEN_FPDMA_AA }, + + /* Blacklist entries taken from Silicon Image 3124/3132 + Windows driver .inf file - also several Linux problem reports */ +@@ -4143,6 +4154,23 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { + { "PIONEER DVD-RW DVR-212D", NULL, ATA_HORKAGE_NOSETXFER }, + { "PIONEER DVD-RW DVR-216D", NULL, ATA_HORKAGE_NOSETXFER }, + ++ /* ++ * Some WD SATA-I drives spin up and down erratically when the link ++ * is put into the slumber mode. We don't have full list of the ++ * affected devices. Disable LPM if the device matches one of the ++ * known prefixes and is SATA-1. As a side effect LPM partial is ++ * lost too. ++ * ++ * https://bugzilla.kernel.org/show_bug.cgi?id=57211 ++ */ ++ { "WDC WD800JD-*", NULL, ATA_HORKAGE_WD_BROKEN_LPM }, ++ { "WDC WD1200JD-*", NULL, ATA_HORKAGE_WD_BROKEN_LPM }, ++ { "WDC WD1600JD-*", NULL, ATA_HORKAGE_WD_BROKEN_LPM }, ++ { "WDC WD2000JD-*", NULL, ATA_HORKAGE_WD_BROKEN_LPM }, ++ { "WDC WD2500JD-*", NULL, ATA_HORKAGE_WD_BROKEN_LPM }, ++ { "WDC WD3000JD-*", NULL, ATA_HORKAGE_WD_BROKEN_LPM }, ++ { "WDC WD3200JD-*", NULL, ATA_HORKAGE_WD_BROKEN_LPM }, ++ + /* End Marker */ + { } + }; +diff --git a/drivers/ata/libata-pmp.c b/drivers/ata/libata-pmp.c +index f5c35be..0ba32fe 100644 +--- a/drivers/ata/libata-pmp.c ++++ b/drivers/ata/libata-pmp.c +@@ -447,8 +447,11 @@ static void sata_pmp_quirks(struct ata_port *ap) + * otherwise. Don't try hard to recover it. + */ + ap->pmp_link[ap->nr_pmp_links - 1].flags |= ATA_LFLAG_NO_RETRY; +- } else if (vendor == 0x197b && devid == 0x2352) { +- /* chip found in Thermaltake BlackX Duet, jmicron JMB350? */ ++ } else if (vendor == 0x197b && (devid == 0x2352 || devid == 0x0325)) { ++ /* ++ * 0x2352: found in Thermaltake BlackX Duet, jmicron JMB350? ++ * 0x0325: jmicron JMB394. ++ */ + ata_for_each_link(link, ap, EDGE) { + /* SRST breaks detection and disks get misclassified + * LPM disabled to avoid potential problems +diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c +index dd332e5..8460e62 100644 +--- a/drivers/ata/libata-scsi.c ++++ b/drivers/ata/libata-scsi.c +@@ -111,12 +111,14 @@ static const char *ata_lpm_policy_names[] = { + [ATA_LPM_MIN_POWER] = "min_power", + }; + +-static ssize_t ata_scsi_lpm_store(struct device *dev, ++static ssize_t ata_scsi_lpm_store(struct device *device, + struct device_attribute *attr, + const char *buf, size_t count) + { +- struct Scsi_Host *shost = class_to_shost(dev); ++ struct Scsi_Host *shost = class_to_shost(device); + struct ata_port *ap = ata_shost_to_port(shost); ++ struct ata_link *link; ++ struct ata_device *dev; + enum ata_lpm_policy policy; + unsigned long flags; + +@@ -132,10 +134,20 @@ static ssize_t ata_scsi_lpm_store(struct device *dev, + return -EINVAL; + + spin_lock_irqsave(ap->lock, flags); ++ ++ ata_for_each_link(link, ap, EDGE) { ++ ata_for_each_dev(dev, &ap->link, ENABLED) { ++ if (dev->horkage & ATA_HORKAGE_NOLPM) { ++ count = -EOPNOTSUPP; ++ goto out_unlock; ++ } ++ } ++ } ++ + ap->target_lpm_policy = policy; + ata_port_schedule_eh(ap); ++out_unlock: + spin_unlock_irqrestore(ap->lock, flags); +- + return count; + } + +diff --git a/drivers/ata/sata_sil.c b/drivers/ata/sata_sil.c +index 9dfb40b..0c4ed89 100644 +--- a/drivers/ata/sata_sil.c ++++ b/drivers/ata/sata_sil.c +@@ -157,6 +157,7 @@ static const struct sil_drivelist { + { "ST380011ASL", SIL_QUIRK_MOD15WRITE }, + { "ST3120022ASL", SIL_QUIRK_MOD15WRITE }, + { "ST3160021ASL", SIL_QUIRK_MOD15WRITE }, ++ { "TOSHIBA MK2561GSYN", SIL_QUIRK_MOD15WRITE }, + { "Maxtor 4D060H3", SIL_QUIRK_UDMA5MAX }, + { } + }; +diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c +index 7b2ec59..96b8cb7 100644 +--- a/drivers/block/xen-blkfront.c ++++ b/drivers/block/xen-blkfront.c +@@ -1281,13 +1281,16 @@ static void blkback_changed(struct xenbus_device *dev, + case XenbusStateReconfiguring: + case XenbusStateReconfigured: + case XenbusStateUnknown: +- case XenbusStateClosed: + break; + + case XenbusStateConnected: + blkfront_connect(info); + break; + ++ case XenbusStateClosed: ++ if (dev->state == XenbusStateClosed) ++ break; ++ /* Missed the backend's Closing state -- fallthrough */ + case XenbusStateClosing: + blkfront_closing(info); + break; +diff --git a/drivers/char/raw.c b/drivers/char/raw.c +index b6de2c0..5ded1a5 100644 +--- a/drivers/char/raw.c ++++ b/drivers/char/raw.c +@@ -190,7 +190,7 @@ static int bind_get(int number, dev_t *dev) + struct raw_device_data *rawdev; + struct block_device *bdev; + +- if (number <= 0 || number >= MAX_RAW_MINORS) ++ if (number <= 0 || number >= max_raw_minors) + return -EINVAL; + + rawdev = &raw_devices[number]; +diff --git a/drivers/dma/ioat/dma.c b/drivers/dma/ioat/dma.c +index 6595180..3f89386 100644 +--- a/drivers/dma/ioat/dma.c ++++ b/drivers/dma/ioat/dma.c +@@ -75,7 +75,8 @@ static irqreturn_t ioat_dma_do_interrupt(int irq, void *data) + attnstatus = readl(instance->reg_base + IOAT_ATTNSTATUS_OFFSET); + for_each_set_bit(bit, &attnstatus, BITS_PER_LONG) { + chan = ioat_chan_by_index(instance, bit); +- tasklet_schedule(&chan->cleanup_task); ++ if (test_bit(IOAT_RUN, &chan->state)) ++ tasklet_schedule(&chan->cleanup_task); + } + + writeb(intrctrl, instance->reg_base + IOAT_INTRCTRL_OFFSET); +@@ -91,7 +92,8 @@ static irqreturn_t ioat_dma_do_interrupt_msix(int irq, void *data) + { + struct ioat_chan_common *chan = data; + +- tasklet_schedule(&chan->cleanup_task); ++ if (test_bit(IOAT_RUN, &chan->state)) ++ tasklet_schedule(&chan->cleanup_task); + + return IRQ_HANDLED; + } +@@ -113,7 +115,6 @@ void ioat_init_channel(struct ioatdma_device *device, struct ioat_chan_common *c + chan->timer.function = device->timer_fn; + chan->timer.data = data; + tasklet_init(&chan->cleanup_task, device->cleanup_fn, data); +- tasklet_disable(&chan->cleanup_task); + } + + /** +@@ -356,13 +357,43 @@ static int ioat1_dma_alloc_chan_resources(struct dma_chan *c) + writel(((u64) chan->completion_dma) >> 32, + chan->reg_base + IOAT_CHANCMP_OFFSET_HIGH); + +- tasklet_enable(&chan->cleanup_task); ++ set_bit(IOAT_RUN, &chan->state); + ioat1_dma_start_null_desc(ioat); /* give chain to dma device */ + dev_dbg(to_dev(chan), "%s: allocated %d descriptors\n", + __func__, ioat->desccount); + return ioat->desccount; + } + ++void ioat_stop(struct ioat_chan_common *chan) ++{ ++ struct ioatdma_device *device = chan->device; ++ struct pci_dev *pdev = device->pdev; ++ int chan_id = chan_num(chan); ++ ++ /* 1/ stop irq from firing tasklets ++ * 2/ stop the tasklet from re-arming irqs ++ */ ++ clear_bit(IOAT_RUN, &chan->state); ++ ++ /* flush inflight interrupts */ ++#ifdef CONFIG_PCI_MSI ++ if (pdev->msix_enabled) { ++ struct msix_entry *msix = &device->msix_entries[chan_id]; ++ synchronize_irq(msix->vector); ++ } else ++#endif ++ synchronize_irq(pdev->irq); ++ ++ /* flush inflight timers */ ++ del_timer_sync(&chan->timer); ++ ++ /* flush inflight tasklet runs */ ++ tasklet_kill(&chan->cleanup_task); ++ ++ /* final cleanup now that everything is quiesced and can't re-arm */ ++ device->cleanup_fn((unsigned long) &chan->common); ++} ++ + /** + * ioat1_dma_free_chan_resources - release all the descriptors + * @chan: the channel to be cleaned +@@ -381,9 +412,7 @@ static void ioat1_dma_free_chan_resources(struct dma_chan *c) + if (ioat->desccount == 0) + return; + +- tasklet_disable(&chan->cleanup_task); +- del_timer_sync(&chan->timer); +- ioat1_cleanup(ioat); ++ ioat_stop(chan); + + /* Delay 100ms after reset to allow internal DMA logic to quiesce + * before removing DMA descriptor resources. +@@ -528,8 +557,11 @@ ioat1_dma_prep_memcpy(struct dma_chan *c, dma_addr_t dma_dest, + static void ioat1_cleanup_event(unsigned long data) + { + struct ioat_dma_chan *ioat = to_ioat_chan((void *) data); ++ struct ioat_chan_common *chan = &ioat->base; + + ioat1_cleanup(ioat); ++ if (!test_bit(IOAT_RUN, &chan->state)) ++ return; + writew(IOAT_CHANCTRL_RUN, ioat->base.reg_base + IOAT_CHANCTRL_OFFSET); + } + +diff --git a/drivers/dma/ioat/dma.h b/drivers/dma/ioat/dma.h +index 8bebddd..466e0f34c 100644 +--- a/drivers/dma/ioat/dma.h ++++ b/drivers/dma/ioat/dma.h +@@ -344,6 +344,7 @@ bool ioat_cleanup_preamble(struct ioat_chan_common *chan, + dma_addr_t *phys_complete); + void ioat_kobject_add(struct ioatdma_device *device, struct kobj_type *type); + void ioat_kobject_del(struct ioatdma_device *device); ++void ioat_stop(struct ioat_chan_common *chan); + extern const struct sysfs_ops ioat_sysfs_ops; + extern struct ioat_sysfs_entry ioat_version_attr; + extern struct ioat_sysfs_entry ioat_cap_attr; +diff --git a/drivers/dma/ioat/dma_v2.c b/drivers/dma/ioat/dma_v2.c +index cb8864d..e60933e 100644 +--- a/drivers/dma/ioat/dma_v2.c ++++ b/drivers/dma/ioat/dma_v2.c +@@ -189,8 +189,11 @@ static void ioat2_cleanup(struct ioat2_dma_chan *ioat) + void ioat2_cleanup_event(unsigned long data) + { + struct ioat2_dma_chan *ioat = to_ioat2_chan((void *) data); ++ struct ioat_chan_common *chan = &ioat->base; + + ioat2_cleanup(ioat); ++ if (!test_bit(IOAT_RUN, &chan->state)) ++ return; + writew(IOAT_CHANCTRL_RUN, ioat->base.reg_base + IOAT_CHANCTRL_OFFSET); + } + +@@ -542,10 +545,10 @@ int ioat2_alloc_chan_resources(struct dma_chan *c) + ioat->issued = 0; + ioat->tail = 0; + ioat->alloc_order = order; ++ set_bit(IOAT_RUN, &chan->state); + spin_unlock_bh(&ioat->prep_lock); + spin_unlock_bh(&chan->cleanup_lock); + +- tasklet_enable(&chan->cleanup_task); + ioat2_start_null_desc(ioat); + + /* check that we got off the ground */ +@@ -555,7 +558,6 @@ int ioat2_alloc_chan_resources(struct dma_chan *c) + } while (i++ < 20 && !is_ioat_active(status) && !is_ioat_idle(status)); + + if (is_ioat_active(status) || is_ioat_idle(status)) { +- set_bit(IOAT_RUN, &chan->state); + return 1 << ioat->alloc_order; + } else { + u32 chanerr = readl(chan->reg_base + IOAT_CHANERR_OFFSET); +@@ -798,11 +800,8 @@ void ioat2_free_chan_resources(struct dma_chan *c) + if (!ioat->ring) + return; + +- tasklet_disable(&chan->cleanup_task); +- del_timer_sync(&chan->timer); +- device->cleanup_fn((unsigned long) c); ++ ioat_stop(chan); + device->reset_hw(chan); +- clear_bit(IOAT_RUN, &chan->state); + + spin_lock_bh(&chan->cleanup_lock); + spin_lock_bh(&ioat->prep_lock); +diff --git a/drivers/dma/ioat/dma_v3.c b/drivers/dma/ioat/dma_v3.c +index 714560f..8680031 100644 +--- a/drivers/dma/ioat/dma_v3.c ++++ b/drivers/dma/ioat/dma_v3.c +@@ -325,8 +325,11 @@ static void ioat3_cleanup(struct ioat2_dma_chan *ioat) + static void ioat3_cleanup_event(unsigned long data) + { + struct ioat2_dma_chan *ioat = to_ioat2_chan((void *) data); ++ struct ioat_chan_common *chan = &ioat->base; + + ioat3_cleanup(ioat); ++ if (!test_bit(IOAT_RUN, &chan->state)) ++ return; + writew(IOAT_CHANCTRL_RUN, ioat->base.reg_base + IOAT_CHANCTRL_OFFSET); + } + +diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c +index 13259ca..4b27c54 100644 +--- a/drivers/dma/ste_dma40.c ++++ b/drivers/dma/ste_dma40.c +@@ -1202,6 +1202,7 @@ static void dma_tasklet(unsigned long data) + struct d40_chan *d40c = (struct d40_chan *) data; + struct d40_desc *d40d; + unsigned long flags; ++ bool callback_active; + dma_async_tx_callback callback; + void *callback_param; + +@@ -1225,6 +1226,7 @@ static void dma_tasklet(unsigned long data) + } + + /* Callback to client */ ++ callback_active = !!(d40d->txd.flags & DMA_PREP_INTERRUPT); + callback = d40d->txd.callback; + callback_param = d40d->txd.callback_param; + +@@ -1249,7 +1251,7 @@ static void dma_tasklet(unsigned long data) + + spin_unlock_irqrestore(&d40c->lock, flags); + +- if (callback && (d40d->txd.flags & DMA_PREP_INTERRUPT)) ++ if (callback_active && callback) + callback(callback_param); + + return; +diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c +index d69144a..7db101b 100644 +--- a/drivers/edac/edac_mc.c ++++ b/drivers/edac/edac_mc.c +@@ -323,7 +323,8 @@ static void edac_mc_workq_function(struct work_struct *work_req) + * + * called with the mem_ctls_mutex held + */ +-static void edac_mc_workq_setup(struct mem_ctl_info *mci, unsigned msec) ++static void edac_mc_workq_setup(struct mem_ctl_info *mci, unsigned msec, ++ bool init) + { + debugf0("%s()\n", __func__); + +@@ -331,7 +332,9 @@ static void edac_mc_workq_setup(struct mem_ctl_info *mci, unsigned msec) + if (mci->op_state != OP_RUNNING_POLL) + return; + +- INIT_DELAYED_WORK(&mci->work, edac_mc_workq_function); ++ if (init) ++ INIT_DELAYED_WORK(&mci->work, edac_mc_workq_function); ++ + queue_delayed_work(edac_workqueue, &mci->work, msecs_to_jiffies(msec)); + } + +@@ -391,7 +394,7 @@ void edac_mc_reset_delay_period(int value) + list_for_each(item, &mc_devices) { + mci = list_entry(item, struct mem_ctl_info, link); + +- edac_mc_workq_setup(mci, (unsigned long) value); ++ edac_mc_workq_setup(mci, value, false); + } + + mutex_unlock(&mem_ctls_mutex); +@@ -539,7 +542,7 @@ int edac_mc_add_mc(struct mem_ctl_info *mci) + /* This instance is NOW RUNNING */ + mci->op_state = OP_RUNNING_POLL; + +- edac_mc_workq_setup(mci, edac_mc_get_poll_msec()); ++ edac_mc_workq_setup(mci, edac_mc_get_poll_msec(), true); + } else { + mci->op_state = OP_RUNNING_INTERRUPT; + } +diff --git a/drivers/edac/i7300_edac.c b/drivers/edac/i7300_edac.c +index 2244df0..1e08426 100644 +--- a/drivers/edac/i7300_edac.c ++++ b/drivers/edac/i7300_edac.c +@@ -962,33 +962,35 @@ static int __devinit i7300_get_devices(struct mem_ctl_info *mci) + + /* Attempt to 'get' the MCH register we want */ + pdev = NULL; +- while (!pvt->pci_dev_16_1_fsb_addr_map || +- !pvt->pci_dev_16_2_fsb_err_regs) { +- pdev = pci_get_device(PCI_VENDOR_ID_INTEL, +- PCI_DEVICE_ID_INTEL_I7300_MCH_ERR, pdev); +- if (!pdev) { +- /* End of list, leave */ +- i7300_printk(KERN_ERR, +- "'system address,Process Bus' " +- "device not found:" +- "vendor 0x%x device 0x%x ERR funcs " +- "(broken BIOS?)\n", +- PCI_VENDOR_ID_INTEL, +- PCI_DEVICE_ID_INTEL_I7300_MCH_ERR); +- goto error; +- } +- ++ while ((pdev = pci_get_device(PCI_VENDOR_ID_INTEL, ++ PCI_DEVICE_ID_INTEL_I7300_MCH_ERR, ++ pdev))) { + /* Store device 16 funcs 1 and 2 */ + switch (PCI_FUNC(pdev->devfn)) { + case 1: +- pvt->pci_dev_16_1_fsb_addr_map = pdev; ++ if (!pvt->pci_dev_16_1_fsb_addr_map) ++ pvt->pci_dev_16_1_fsb_addr_map = ++ pci_dev_get(pdev); + break; + case 2: +- pvt->pci_dev_16_2_fsb_err_regs = pdev; ++ if (!pvt->pci_dev_16_2_fsb_err_regs) ++ pvt->pci_dev_16_2_fsb_err_regs = ++ pci_dev_get(pdev); + break; + } + } + ++ if (!pvt->pci_dev_16_1_fsb_addr_map || ++ !pvt->pci_dev_16_2_fsb_err_regs) { ++ /* At least one device was not found */ ++ i7300_printk(KERN_ERR, ++ "'system address,Process Bus' device not found:" ++ "vendor 0x%x device 0x%x ERR funcs (broken BIOS?)\n", ++ PCI_VENDOR_ID_INTEL, ++ PCI_DEVICE_ID_INTEL_I7300_MCH_ERR); ++ goto error; ++ } ++ + debugf1("System Address, processor bus- PCI Bus ID: %s %x:%x\n", + pci_name(pvt->pci_dev_16_0_fsb_ctlr), + pvt->pci_dev_16_0_fsb_ctlr->vendor, +diff --git a/drivers/edac/i7core_edac.c b/drivers/edac/i7core_edac.c +index b3ccefa..4c18b3c 100644 +--- a/drivers/edac/i7core_edac.c ++++ b/drivers/edac/i7core_edac.c +@@ -1365,14 +1365,19 @@ static int i7core_get_onedevice(struct pci_dev **prev, + * is at addr 8086:2c40, instead of 8086:2c41. So, we need + * to probe for the alternate address in case of failure + */ +- if (dev_descr->dev_id == PCI_DEVICE_ID_INTEL_I7_NONCORE && !pdev) ++ if (dev_descr->dev_id == PCI_DEVICE_ID_INTEL_I7_NONCORE && !pdev) { ++ pci_dev_get(*prev); /* pci_get_device will put it */ + pdev = pci_get_device(PCI_VENDOR_ID_INTEL, + PCI_DEVICE_ID_INTEL_I7_NONCORE_ALT, *prev); ++ } + +- if (dev_descr->dev_id == PCI_DEVICE_ID_INTEL_LYNNFIELD_NONCORE && !pdev) ++ if (dev_descr->dev_id == PCI_DEVICE_ID_INTEL_LYNNFIELD_NONCORE && ++ !pdev) { ++ pci_dev_get(*prev); /* pci_get_device will put it */ + pdev = pci_get_device(PCI_VENDOR_ID_INTEL, + PCI_DEVICE_ID_INTEL_LYNNFIELD_NONCORE_ALT, + *prev); ++ } + + if (!pdev) { + if (*prev) { +diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c +index 61b708b..2ea8a96 100644 +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -7252,6 +7252,20 @@ static int intel_gen7_queue_flip(struct drm_device *dev, + goto err_unpin; + } + ++ /* ++ * BSpec MI_DISPLAY_FLIP for IVB: ++ * "The full packet must be contained within the same cache line." ++ * ++ * Currently the LRI+SRM+MI_DISPLAY_FLIP all fit within the same ++ * cacheline, if we ever start emitting more commands before ++ * the MI_DISPLAY_FLIP we may need to first emit everything else, ++ * then do the cacheline alignment, and finally emit the ++ * MI_DISPLAY_FLIP. ++ */ ++ ret = intel_ring_cacheline_align(ring); ++ if (ret) ++ goto err_unpin; ++ + ret = intel_ring_begin(ring, 4); + if (ret) + goto err_unpin; +diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c +index 72163e8..ca75076 100644 +--- a/drivers/gpu/drm/i915/intel_dp.c ++++ b/drivers/gpu/drm/i915/intel_dp.c +@@ -483,6 +483,7 @@ intel_dp_aux_native_write(struct intel_dp *intel_dp, + uint8_t msg[20]; + int msg_bytes; + uint8_t ack; ++ int retry; + + intel_dp_check_edp(intel_dp); + if (send_bytes > 16) +@@ -493,18 +494,20 @@ intel_dp_aux_native_write(struct intel_dp *intel_dp, + msg[3] = send_bytes - 1; + memcpy(&msg[4], send, send_bytes); + msg_bytes = send_bytes + 4; +- for (;;) { ++ for (retry = 0; retry < 7; retry++) { + ret = intel_dp_aux_ch(intel_dp, msg, msg_bytes, &ack, 1); + if (ret < 0) + return ret; + if ((ack & AUX_NATIVE_REPLY_MASK) == AUX_NATIVE_REPLY_ACK) +- break; ++ return send_bytes; + else if ((ack & AUX_NATIVE_REPLY_MASK) == AUX_NATIVE_REPLY_DEFER) +- udelay(100); ++ usleep_range(400, 500); + else + return -EIO; + } +- return send_bytes; ++ ++ DRM_ERROR("too many retries, giving up\n"); ++ return -EIO; + } + + /* Write a single byte to the aux channel in native mode */ +@@ -526,6 +529,7 @@ intel_dp_aux_native_read(struct intel_dp *intel_dp, + int reply_bytes; + uint8_t ack; + int ret; ++ int retry; + + intel_dp_check_edp(intel_dp); + msg[0] = AUX_NATIVE_READ << 4; +@@ -536,7 +540,7 @@ intel_dp_aux_native_read(struct intel_dp *intel_dp, + msg_bytes = 4; + reply_bytes = recv_bytes + 1; + +- for (;;) { ++ for (retry = 0; retry < 7; retry++) { + ret = intel_dp_aux_ch(intel_dp, msg, msg_bytes, + reply, reply_bytes); + if (ret == 0) +@@ -549,10 +553,13 @@ intel_dp_aux_native_read(struct intel_dp *intel_dp, + return ret - 1; + } + else if ((ack & AUX_NATIVE_REPLY_MASK) == AUX_NATIVE_REPLY_DEFER) +- udelay(100); ++ usleep_range(400, 500); + else + return -EIO; + } ++ ++ DRM_ERROR("too many retries, giving up\n"); ++ return -EIO; + } + + static int +diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c +index 3c55cf6..8ee068e 100644 +--- a/drivers/gpu/drm/i915/intel_ringbuffer.c ++++ b/drivers/gpu/drm/i915/intel_ringbuffer.c +@@ -1213,6 +1213,27 @@ int intel_ring_begin(struct intel_ring_buffer *ring, + return 0; + } + ++/* Align the ring tail to a cacheline boundary */ ++int intel_ring_cacheline_align(struct intel_ring_buffer *ring) ++{ ++ int num_dwords = (64 - (ring->tail & 63)) / sizeof(uint32_t); ++ int ret; ++ ++ if (num_dwords == 0) ++ return 0; ++ ++ ret = intel_ring_begin(ring, num_dwords); ++ if (ret) ++ return ret; ++ ++ while (num_dwords--) ++ intel_ring_emit(ring, MI_NOOP); ++ ++ intel_ring_advance(ring); ++ ++ return 0; ++} ++ + void intel_ring_advance(struct intel_ring_buffer *ring) + { + ring->tail &= ring->size - 1; +diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.h b/drivers/gpu/drm/i915/intel_ringbuffer.h +index 68281c9..d83cc97 100644 +--- a/drivers/gpu/drm/i915/intel_ringbuffer.h ++++ b/drivers/gpu/drm/i915/intel_ringbuffer.h +@@ -174,6 +174,7 @@ static inline int intel_wait_ring_idle(struct intel_ring_buffer *ring) + } + + int __must_check intel_ring_begin(struct intel_ring_buffer *ring, int n); ++int __must_check intel_ring_cacheline_align(struct intel_ring_buffer *ring); + + static inline void intel_ring_emit(struct intel_ring_buffer *ring, + u32 data) +diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c +index 038570a..cd98c06 100644 +--- a/drivers/gpu/drm/radeon/atombios_crtc.c ++++ b/drivers/gpu/drm/radeon/atombios_crtc.c +@@ -956,10 +956,13 @@ static void atombios_crtc_set_pll(struct drm_crtc *crtc, struct drm_display_mode + ss_enabled = + radeon_atombios_get_ppll_ss_info(rdev, &ss, + ATOM_DP_SS_ID1); +- } else ++ } else { + ss_enabled = + radeon_atombios_get_ppll_ss_info(rdev, &ss, + ATOM_DP_SS_ID1); ++ } ++ /* disable spread spectrum on DCE3 DP */ ++ ss_enabled = false; + } + break; + case ATOM_ENCODER_MODE_LVDS: +diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c +index 57e45c6..f7e3cc0 100644 +--- a/drivers/gpu/drm/radeon/r600.c ++++ b/drivers/gpu/drm/radeon/r600.c +@@ -2315,14 +2315,18 @@ int r600_ring_test(struct radeon_device *rdev) + void r600_fence_ring_emit(struct radeon_device *rdev, + struct radeon_fence *fence) + { ++ u32 cp_coher_cntl = PACKET3_TC_ACTION_ENA | PACKET3_VC_ACTION_ENA | ++ PACKET3_SH_ACTION_ENA; ++ ++ if (rdev->family >= CHIP_RV770) ++ cp_coher_cntl |= PACKET3_FULL_CACHE_ENA; ++ + if (rdev->wb.use_event) { + u64 addr = rdev->wb.gpu_addr + R600_WB_EVENT_OFFSET + + (u64)(rdev->fence_drv.scratch_reg - rdev->scratch.reg_base); + /* flush read cache over gart */ + radeon_ring_write(rdev, PACKET3(PACKET3_SURFACE_SYNC, 3)); +- radeon_ring_write(rdev, PACKET3_TC_ACTION_ENA | +- PACKET3_VC_ACTION_ENA | +- PACKET3_SH_ACTION_ENA); ++ radeon_ring_write(rdev, cp_coher_cntl); + radeon_ring_write(rdev, 0xFFFFFFFF); + radeon_ring_write(rdev, 0); + radeon_ring_write(rdev, 10); /* poll interval */ +@@ -2336,9 +2340,7 @@ void r600_fence_ring_emit(struct radeon_device *rdev, + } else { + /* flush read cache over gart */ + radeon_ring_write(rdev, PACKET3(PACKET3_SURFACE_SYNC, 3)); +- radeon_ring_write(rdev, PACKET3_TC_ACTION_ENA | +- PACKET3_VC_ACTION_ENA | +- PACKET3_SH_ACTION_ENA); ++ radeon_ring_write(rdev, cp_coher_cntl); + radeon_ring_write(rdev, 0xFFFFFFFF); + radeon_ring_write(rdev, 0); + radeon_ring_write(rdev, 10); /* poll interval */ +diff --git a/drivers/gpu/drm/radeon/r600d.h b/drivers/gpu/drm/radeon/r600d.h +index d4d23a8d..cb29480 100644 +--- a/drivers/gpu/drm/radeon/r600d.h ++++ b/drivers/gpu/drm/radeon/r600d.h +@@ -838,6 +838,7 @@ + #define PACKET3_INDIRECT_BUFFER 0x32 + #define PACKET3_SURFACE_SYNC 0x43 + # define PACKET3_CB0_DEST_BASE_ENA (1 << 6) ++# define PACKET3_FULL_CACHE_ENA (1 << 20) /* r7xx+ only */ + # define PACKET3_TC_ACTION_ENA (1 << 23) + # define PACKET3_VC_ACTION_ENA (1 << 24) + # define PACKET3_CB_ACTION_ENA (1 << 25) +diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c +index cda89c6b..e4e455e 100644 +--- a/drivers/gpu/drm/radeon/radeon_atombios.c ++++ b/drivers/gpu/drm/radeon/radeon_atombios.c +@@ -2735,6 +2735,10 @@ void radeon_atom_initialize_bios_scratch_regs(struct drm_device *dev) + /* tell the bios not to handle mode switching */ + bios_6_scratch |= ATOM_S6_ACC_BLOCK_DISPLAY_SWITCH; + ++ /* clear the vbios dpms state */ ++ if (ASIC_IS_DCE4(rdev)) ++ bios_2_scratch &= ~ATOM_S2_DEVICE_DPMS_STATE; ++ + if (rdev->family >= CHIP_R600) { + WREG32(R600_BIOS_2_SCRATCH, bios_2_scratch); + WREG32(R600_BIOS_6_SCRATCH, bios_6_scratch); +diff --git a/drivers/gpu/drm/radeon/radeon_i2c.c b/drivers/gpu/drm/radeon/radeon_i2c.c +index cf20351..894b5f0 100644 +--- a/drivers/gpu/drm/radeon/radeon_i2c.c ++++ b/drivers/gpu/drm/radeon/radeon_i2c.c +@@ -998,6 +998,9 @@ void radeon_i2c_destroy(struct radeon_i2c_chan *i2c) + /* Add the default buses */ + void radeon_i2c_init(struct radeon_device *rdev) + { ++ if (radeon_hw_i2c) ++ DRM_INFO("hw_i2c forced on, you may experience display detection problems!\n"); ++ + if (rdev->is_atom_bios) + radeon_atombios_i2c_init(rdev); + else +diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c +index d58eccb..b0a0ee4 100644 +--- a/drivers/gpu/drm/radeon/radeon_pm.c ++++ b/drivers/gpu/drm/radeon/radeon_pm.c +@@ -573,8 +573,10 @@ void radeon_pm_resume(struct radeon_device *rdev) + rdev->pm.current_clock_mode_index = 0; + rdev->pm.current_sclk = rdev->pm.default_sclk; + rdev->pm.current_mclk = rdev->pm.default_mclk; +- rdev->pm.current_vddc = rdev->pm.power_state[rdev->pm.default_power_state_index].clock_info[0].voltage.voltage; +- rdev->pm.current_vddci = rdev->pm.power_state[rdev->pm.default_power_state_index].clock_info[0].voltage.vddci; ++ if (rdev->pm.power_state) { ++ rdev->pm.current_vddc = rdev->pm.power_state[rdev->pm.default_power_state_index].clock_info[0].voltage.voltage; ++ rdev->pm.current_vddci = rdev->pm.power_state[rdev->pm.default_power_state_index].clock_info[0].voltage.vddci; ++ } + if (rdev->pm.pm_method == PM_METHOD_DYNPM + && rdev->pm.dynpm_state == DYNPM_STATE_SUSPENDED) { + rdev->pm.dynpm_state = DYNPM_STATE_ACTIVE; +diff --git a/drivers/hv/connection.c b/drivers/hv/connection.c +index 650c9f0..d7f3df9 100644 +--- a/drivers/hv/connection.c ++++ b/drivers/hv/connection.c +@@ -45,7 +45,6 @@ struct vmbus_connection vmbus_connection = { + int vmbus_connect(void) + { + int ret = 0; +- int t; + struct vmbus_channel_msginfo *msginfo = NULL; + struct vmbus_channel_initiate_contact *msg; + unsigned long flags; +@@ -132,16 +131,7 @@ int vmbus_connect(void) + } + + /* Wait for the connection response */ +- t = wait_for_completion_timeout(&msginfo->waitevent, 5*HZ); +- if (t == 0) { +- spin_lock_irqsave(&vmbus_connection.channelmsg_lock, +- flags); +- list_del(&msginfo->msglistentry); +- spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, +- flags); +- ret = -ETIMEDOUT; +- goto cleanup; +- } ++ wait_for_completion(&msginfo->waitevent); + + spin_lock_irqsave(&vmbus_connection.channelmsg_lock, flags); + list_del(&msginfo->msglistentry); +diff --git a/drivers/hwmon/max1668.c b/drivers/hwmon/max1668.c +index 20d1b2d..e19fef7 100644 +--- a/drivers/hwmon/max1668.c ++++ b/drivers/hwmon/max1668.c +@@ -243,7 +243,7 @@ static ssize_t set_temp_min(struct device *dev, + data->temp_min[index] = SENSORS_LIMIT(temp/1000, -128, 127); + if (i2c_smbus_write_byte_data(client, + MAX1668_REG_LIML_WR(index), +- data->temp_max[index])) ++ data->temp_min[index])) + count = -EIO; + mutex_unlock(&data->update_lock); + +diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig +index dbd4fa5..949ea640 100644 +--- a/drivers/i2c/busses/Kconfig ++++ b/drivers/i2c/busses/Kconfig +@@ -137,6 +137,7 @@ config I2C_PIIX4 + ATI SB700 + ATI SB800 + AMD Hudson-2 ++ AMD ML + AMD CZ + Serverworks OSB4 + Serverworks CSB5 +diff --git a/drivers/i2c/busses/i2c-piix4.c b/drivers/i2c/busses/i2c-piix4.c +index 14b588c..c60f8e1 100644 +--- a/drivers/i2c/busses/i2c-piix4.c ++++ b/drivers/i2c/busses/i2c-piix4.c +@@ -22,7 +22,7 @@ + Intel PIIX4, 440MX + Serverworks OSB4, CSB5, CSB6, HT-1000, HT-1100 + ATI IXP200, IXP300, IXP400, SB600, SB700, SB800 +- AMD Hudson-2, CZ ++ AMD Hudson-2, ML, CZ + SMSC Victory66 + + Note: we assume there can only be one device, with one SMBus interface. +@@ -231,7 +231,8 @@ static int __devinit piix4_setup_sb800(struct pci_dev *PIIX4_dev, + const struct pci_device_id *id) + { + unsigned short smba_idx = 0xcd6; +- u8 smba_en_lo, smba_en_hi, i2ccfg, i2ccfg_offset = 0x10, smb_en = 0x2c; ++ u8 smba_en_lo, smba_en_hi, smb_en, smb_en_status; ++ u8 i2ccfg, i2ccfg_offset = 0x10; + + /* SB800 and later SMBus does not support forcing address */ + if (force || force_addr) { +@@ -241,6 +242,16 @@ static int __devinit piix4_setup_sb800(struct pci_dev *PIIX4_dev, + } + + /* Determine the address of the SMBus areas */ ++ if ((PIIX4_dev->vendor == PCI_VENDOR_ID_AMD && ++ PIIX4_dev->device == PCI_DEVICE_ID_AMD_HUDSON2_SMBUS && ++ PIIX4_dev->revision >= 0x41) || ++ (PIIX4_dev->vendor == PCI_VENDOR_ID_AMD && ++ PIIX4_dev->device == 0x790b && ++ PIIX4_dev->revision >= 0x49)) ++ smb_en = 0x00; ++ else ++ smb_en = 0x2c; ++ + if (!request_region(smba_idx, 2, "smba_idx")) { + dev_err(&PIIX4_dev->dev, "SMBus base address index region " + "0x%x already in use!\n", smba_idx); +@@ -252,13 +263,20 @@ static int __devinit piix4_setup_sb800(struct pci_dev *PIIX4_dev, + smba_en_hi = inb_p(smba_idx + 1); + release_region(smba_idx, 2); + +- if ((smba_en_lo & 1) == 0) { ++ if (!smb_en) { ++ smb_en_status = smba_en_lo & 0x10; ++ piix4_smba = smba_en_hi << 8; ++ } else { ++ smb_en_status = smba_en_lo & 0x01; ++ piix4_smba = ((smba_en_hi << 8) | smba_en_lo) & 0xffe0; ++ } ++ ++ if (!smb_en_status) { + dev_err(&PIIX4_dev->dev, + "Host SMBus controller not enabled!\n"); + return -ENODEV; + } + +- piix4_smba = ((smba_en_hi << 8) | smba_en_lo) & 0xffe0; + if (acpi_check_region(piix4_smba, SMBIOSIZE, piix4_driver.name)) + return -ENODEV; + +diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c +index 4fa2b11..44fde43 100644 +--- a/drivers/idle/intel_idle.c ++++ b/drivers/idle/intel_idle.c +@@ -584,8 +584,9 @@ static int __init intel_idle_init(void) + intel_idle_cpuidle_driver_init(); + retval = cpuidle_register_driver(&intel_idle_driver); + if (retval) { ++ struct cpuidle_driver *drv = cpuidle_get_driver(); + printk(KERN_DEBUG PREFIX "intel_idle yielding to %s", +- cpuidle_get_driver()->name); ++ drv ? drv->name : "none"); + return retval; + } + +diff --git a/drivers/infiniband/hw/qib/qib_iba7322.c b/drivers/infiniband/hw/qib/qib_iba7322.c +index 5a070e8..d8517fc 100644 +--- a/drivers/infiniband/hw/qib/qib_iba7322.c ++++ b/drivers/infiniband/hw/qib/qib_iba7322.c +@@ -2279,6 +2279,11 @@ static int qib_7322_bringup_serdes(struct qib_pportdata *ppd) + qib_write_kreg_port(ppd, krp_ibcctrl_a, ppd->cpspec->ibcctrl_a); + qib_write_kreg(dd, kr_scratch, 0ULL); + ++ /* ensure previous Tx parameters are not still forced */ ++ qib_write_kreg_port(ppd, krp_tx_deemph_override, ++ SYM_MASK(IBSD_TX_DEEMPHASIS_OVERRIDE_0, ++ reset_tx_deemphasis_override)); ++ + if (qib_compat_ddr_negotiate) { + ppd->cpspec->ibdeltainprog = 1; + ppd->cpspec->ibsymsnap = read_7322_creg32_port(ppd, +diff --git a/drivers/infiniband/hw/qib/qib_ud.c b/drivers/infiniband/hw/qib/qib_ud.c +index 828609f..c0d93d4 100644 +--- a/drivers/infiniband/hw/qib/qib_ud.c ++++ b/drivers/infiniband/hw/qib/qib_ud.c +@@ -57,13 +57,20 @@ static void qib_ud_loopback(struct qib_qp *sqp, struct qib_swqe *swqe) + struct qib_sge *sge; + struct ib_wc wc; + u32 length; ++ enum ib_qp_type sqptype, dqptype; + + qp = qib_lookup_qpn(ibp, swqe->wr.wr.ud.remote_qpn); + if (!qp) { + ibp->n_pkt_drops++; + return; + } +- if (qp->ibqp.qp_type != sqp->ibqp.qp_type || ++ ++ sqptype = sqp->ibqp.qp_type == IB_QPT_GSI ? ++ IB_QPT_UD : sqp->ibqp.qp_type; ++ dqptype = qp->ibqp.qp_type == IB_QPT_GSI ? ++ IB_QPT_UD : qp->ibqp.qp_type; ++ ++ if (dqptype != sqptype || + !(ib_qib_state_ops[qp->state] & QIB_PROCESS_RECV_OK)) { + ibp->n_pkt_drops++; + goto drop; +diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c +index b4a4aaf..1a51b3d 100644 +--- a/drivers/iommu/intel-iommu.c ++++ b/drivers/iommu/intel-iommu.c +@@ -884,7 +884,7 @@ static void dma_pte_free_level(struct dmar_domain *domain, int level, + + /* If range covers entire pagetable, free it */ + if (!(start_pfn > level_pfn || +- last_pfn < level_pfn + level_size(level))) { ++ last_pfn < level_pfn + level_size(level) - 1)) { + dma_clear_pte(pte); + domain_flush_cache(domain, pte, sizeof(*pte)); + free_pgtable_page(level_pte); +diff --git a/drivers/md/Kconfig b/drivers/md/Kconfig +index faa4741..e10b6bb 100644 +--- a/drivers/md/Kconfig ++++ b/drivers/md/Kconfig +@@ -185,8 +185,12 @@ config MD_FAULTY + + In unsure, say N. + ++config BLK_DEV_DM_BUILTIN ++ boolean ++ + config BLK_DEV_DM + tristate "Device mapper support" ++ select BLK_DEV_DM_BUILTIN + ---help--- + Device-mapper is a low level volume manager. It works by allowing + people to specify mappings for ranges of logical sectors. Various +diff --git a/drivers/md/Makefile b/drivers/md/Makefile +index 046860c..f67dec3 100644 +--- a/drivers/md/Makefile ++++ b/drivers/md/Makefile +@@ -28,6 +28,7 @@ obj-$(CONFIG_MD_MULTIPATH) += multipath.o + obj-$(CONFIG_MD_FAULTY) += faulty.o + obj-$(CONFIG_BLK_DEV_MD) += md-mod.o + obj-$(CONFIG_BLK_DEV_DM) += dm-mod.o ++obj-$(CONFIG_BLK_DEV_DM_BUILTIN) += dm-builtin.o + obj-$(CONFIG_DM_BUFIO) += dm-bufio.o + obj-$(CONFIG_DM_CRYPT) += dm-crypt.o + obj-$(CONFIG_DM_DELAY) += dm-delay.o +diff --git a/drivers/md/dm-builtin.c b/drivers/md/dm-builtin.c +new file mode 100644 +index 0000000..8b82788 +--- /dev/null ++++ b/drivers/md/dm-builtin.c +@@ -0,0 +1,49 @@ ++#include <linux/export.h> ++#include "dm.h" ++ ++/* ++ * The kobject release method must not be placed in the module itself, ++ * otherwise we are subject to module unload races. ++ * ++ * The release method is called when the last reference to the kobject is ++ * dropped. It may be called by any other kernel code that drops the last ++ * reference. ++ * ++ * The release method suffers from module unload race. We may prevent the ++ * module from being unloaded at the start of the release method (using ++ * increased module reference count or synchronizing against the release ++ * method), however there is no way to prevent the module from being ++ * unloaded at the end of the release method. ++ * ++ * If this code were placed in the dm module, the following race may ++ * happen: ++ * 1. Some other process takes a reference to dm kobject ++ * 2. The user issues ioctl function to unload the dm device ++ * 3. dm_sysfs_exit calls kobject_put, however the object is not released ++ * because of the other reference taken at step 1 ++ * 4. dm_sysfs_exit waits on the completion ++ * 5. The other process that took the reference in step 1 drops it, ++ * dm_kobject_release is called from this process ++ * 6. dm_kobject_release calls complete() ++ * 7. a reschedule happens before dm_kobject_release returns ++ * 8. dm_sysfs_exit continues, the dm device is unloaded, module reference ++ * count is decremented ++ * 9. The user unloads the dm module ++ * 10. The other process that was rescheduled in step 7 continues to run, ++ * it is now executing code in unloaded module, so it crashes ++ * ++ * Note that if the process that takes the foreign reference to dm kobject ++ * has a low priority and the system is sufficiently loaded with ++ * higher-priority processes that prevent the low-priority process from ++ * being scheduled long enough, this bug may really happen. ++ * ++ * In order to fix this module unload race, we place the release method ++ * into a helper code that is compiled directly into the kernel. ++ */ ++ ++void dm_kobject_release(struct kobject *kobj) ++{ ++ complete(dm_get_completion_from_kobject(kobj)); ++} ++ ++EXPORT_SYMBOL(dm_kobject_release); +diff --git a/drivers/md/dm-sysfs.c b/drivers/md/dm-sysfs.c +index 84d2b91..c62c5ab 100644 +--- a/drivers/md/dm-sysfs.c ++++ b/drivers/md/dm-sysfs.c +@@ -86,6 +86,7 @@ static const struct sysfs_ops dm_sysfs_ops = { + static struct kobj_type dm_ktype = { + .sysfs_ops = &dm_sysfs_ops, + .default_attrs = dm_attrs, ++ .release = dm_kobject_release, + }; + + /* +@@ -104,5 +105,7 @@ int dm_sysfs_init(struct mapped_device *md) + */ + void dm_sysfs_exit(struct mapped_device *md) + { +- kobject_put(dm_kobject(md)); ++ struct kobject *kobj = dm_kobject(md); ++ kobject_put(kobj); ++ wait_for_completion(dm_get_completion_from_kobject(kobj)); + } +diff --git a/drivers/md/dm.c b/drivers/md/dm.c +index 8953630..7ead065 100644 +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -192,8 +192,8 @@ struct mapped_device { + /* forced geometry settings */ + struct hd_geometry geometry; + +- /* sysfs handle */ +- struct kobject kobj; ++ /* kobject and completion */ ++ struct dm_kobject_holder kobj_holder; + + /* zero-length flush that will be cloned and submitted to targets */ + struct bio flush_bio; +@@ -1891,6 +1891,7 @@ static struct mapped_device *alloc_dev(int minor) + init_waitqueue_head(&md->wait); + INIT_WORK(&md->work, dm_wq_work); + init_waitqueue_head(&md->eventq); ++ init_completion(&md->kobj_holder.completion); + + md->disk->major = _major; + md->disk->first_minor = minor; +@@ -2682,7 +2683,7 @@ struct gendisk *dm_disk(struct mapped_device *md) + + struct kobject *dm_kobject(struct mapped_device *md) + { +- return &md->kobj; ++ return &md->kobj_holder.kobj; + } + + /* +@@ -2693,9 +2694,7 @@ struct mapped_device *dm_get_from_kobject(struct kobject *kobj) + { + struct mapped_device *md; + +- md = container_of(kobj, struct mapped_device, kobj); +- if (&md->kobj != kobj) +- return NULL; ++ md = container_of(kobj, struct mapped_device, kobj_holder.kobj); + + if (test_bit(DMF_FREEING, &md->flags) || + dm_deleting_md(md)) +diff --git a/drivers/md/dm.h b/drivers/md/dm.h +index b7dacd5..9db80c9 100644 +--- a/drivers/md/dm.h ++++ b/drivers/md/dm.h +@@ -15,6 +15,8 @@ + #include <linux/list.h> + #include <linux/blkdev.h> + #include <linux/hdreg.h> ++#include <linux/completion.h> ++#include <linux/kobject.h> + + /* + * Suspend feature flags +@@ -119,12 +121,27 @@ void dm_interface_exit(void); + /* + * sysfs interface + */ ++struct dm_kobject_holder { ++ struct kobject kobj; ++ struct completion completion; ++}; ++ ++static inline struct completion *dm_get_completion_from_kobject(struct kobject *kobj) ++{ ++ return &container_of(kobj, struct dm_kobject_holder, kobj)->completion; ++} ++ + int dm_sysfs_init(struct mapped_device *md); + void dm_sysfs_exit(struct mapped_device *md); + struct kobject *dm_kobject(struct mapped_device *md); + struct mapped_device *dm_get_from_kobject(struct kobject *kobj); + + /* ++ * The kobject helper ++ */ ++void dm_kobject_release(struct kobject *kobj); ++ ++/* + * Targets for linear and striped mappings + */ + int dm_linear_init(void); +diff --git a/drivers/md/persistent-data/dm-space-map-common.c b/drivers/md/persistent-data/dm-space-map-common.c +index df2494c..8c5b824 100644 +--- a/drivers/md/persistent-data/dm-space-map-common.c ++++ b/drivers/md/persistent-data/dm-space-map-common.c +@@ -244,6 +244,10 @@ int sm_ll_extend(struct ll_disk *ll, dm_block_t extra_blocks) + return -EINVAL; + } + ++ /* ++ * We need to set this before the dm_tm_new_block() call below. ++ */ ++ ll->nr_blocks = nr_blocks; + for (i = old_blocks; i < blocks; i++) { + struct dm_block *b; + struct disk_index_entry idx; +@@ -251,6 +255,7 @@ int sm_ll_extend(struct ll_disk *ll, dm_block_t extra_blocks) + r = dm_tm_new_block(ll->tm, &dm_sm_bitmap_validator, &b); + if (r < 0) + return r; ++ + idx.blocknr = cpu_to_le64(dm_block_location(b)); + + r = dm_tm_unlock(ll->tm, b); +@@ -265,7 +270,6 @@ int sm_ll_extend(struct ll_disk *ll, dm_block_t extra_blocks) + return r; + } + +- ll->nr_blocks = nr_blocks; + return 0; + } + +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index fb67833..7c963c4 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -1693,6 +1693,7 @@ static void raid5_end_write_request(struct bio *bi, int error) + } + + if (!uptodate) { ++ set_bit(STRIPE_DEGRADED, &sh->state); + set_bit(WriteErrorSeen, &conf->disks[i].rdev->flags); + set_bit(R5_WriteError, &sh->dev[i].flags); + } else if (is_badblock(conf->disks[i].rdev, sh->sector, STRIPE_SECTORS, +@@ -4449,23 +4450,43 @@ raid5_size(struct mddev *mddev, sector_t sectors, int raid_disks) + return sectors * (raid_disks - conf->max_degraded); + } + ++static void free_scratch_buffer(struct r5conf *conf, struct raid5_percpu *percpu) ++{ ++ safe_put_page(percpu->spare_page); ++ kfree(percpu->scribble); ++ percpu->spare_page = NULL; ++ percpu->scribble = NULL; ++} ++ ++static int alloc_scratch_buffer(struct r5conf *conf, struct raid5_percpu *percpu) ++{ ++ if (conf->level == 6 && !percpu->spare_page) ++ percpu->spare_page = alloc_page(GFP_KERNEL); ++ if (!percpu->scribble) ++ percpu->scribble = kmalloc(conf->scribble_len, GFP_KERNEL); ++ ++ if (!percpu->scribble || (conf->level == 6 && !percpu->spare_page)) { ++ free_scratch_buffer(conf, percpu); ++ return -ENOMEM; ++ } ++ ++ return 0; ++} ++ + static void raid5_free_percpu(struct r5conf *conf) + { +- struct raid5_percpu *percpu; + unsigned long cpu; + + if (!conf->percpu) + return; + +- get_online_cpus(); +- for_each_possible_cpu(cpu) { +- percpu = per_cpu_ptr(conf->percpu, cpu); +- safe_put_page(percpu->spare_page); +- kfree(percpu->scribble); +- } + #ifdef CONFIG_HOTPLUG_CPU + unregister_cpu_notifier(&conf->cpu_notify); + #endif ++ ++ get_online_cpus(); ++ for_each_possible_cpu(cpu) ++ free_scratch_buffer(conf, per_cpu_ptr(conf->percpu, cpu)); + put_online_cpus(); + + free_percpu(conf->percpu); +@@ -4491,15 +4512,7 @@ static int raid456_cpu_notify(struct notifier_block *nfb, unsigned long action, + switch (action) { + case CPU_UP_PREPARE: + case CPU_UP_PREPARE_FROZEN: +- if (conf->level == 6 && !percpu->spare_page) +- percpu->spare_page = alloc_page(GFP_KERNEL); +- if (!percpu->scribble) +- percpu->scribble = kmalloc(conf->scribble_len, GFP_KERNEL); +- +- if (!percpu->scribble || +- (conf->level == 6 && !percpu->spare_page)) { +- safe_put_page(percpu->spare_page); +- kfree(percpu->scribble); ++ if (alloc_scratch_buffer(conf, percpu)) { + pr_err("%s: failed memory allocation for cpu%ld\n", + __func__, cpu); + return notifier_from_errno(-ENOMEM); +@@ -4507,10 +4520,7 @@ static int raid456_cpu_notify(struct notifier_block *nfb, unsigned long action, + break; + case CPU_DEAD: + case CPU_DEAD_FROZEN: +- safe_put_page(percpu->spare_page); +- kfree(percpu->scribble); +- percpu->spare_page = NULL; +- percpu->scribble = NULL; ++ free_scratch_buffer(conf, per_cpu_ptr(conf->percpu, cpu)); + break; + default: + break; +@@ -4522,40 +4532,29 @@ static int raid456_cpu_notify(struct notifier_block *nfb, unsigned long action, + static int raid5_alloc_percpu(struct r5conf *conf) + { + unsigned long cpu; +- struct page *spare_page; +- struct raid5_percpu __percpu *allcpus; +- void *scribble; +- int err; ++ int err = 0; + +- allcpus = alloc_percpu(struct raid5_percpu); +- if (!allcpus) ++ conf->percpu = alloc_percpu(struct raid5_percpu); ++ if (!conf->percpu) + return -ENOMEM; +- conf->percpu = allcpus; ++ ++#ifdef CONFIG_HOTPLUG_CPU ++ conf->cpu_notify.notifier_call = raid456_cpu_notify; ++ conf->cpu_notify.priority = 0; ++ err = register_cpu_notifier(&conf->cpu_notify); ++ if (err) ++ return err; ++#endif + + get_online_cpus(); +- err = 0; + for_each_present_cpu(cpu) { +- if (conf->level == 6) { +- spare_page = alloc_page(GFP_KERNEL); +- if (!spare_page) { +- err = -ENOMEM; +- break; +- } +- per_cpu_ptr(conf->percpu, cpu)->spare_page = spare_page; +- } +- scribble = kmalloc(conf->scribble_len, GFP_KERNEL); +- if (!scribble) { +- err = -ENOMEM; ++ err = alloc_scratch_buffer(conf, per_cpu_ptr(conf->percpu, cpu)); ++ if (err) { ++ pr_err("%s: failed memory allocation for cpu%ld\n", ++ __func__, cpu); + break; + } +- per_cpu_ptr(conf->percpu, cpu)->scribble = scribble; + } +-#ifdef CONFIG_HOTPLUG_CPU +- conf->cpu_notify.notifier_call = raid456_cpu_notify; +- conf->cpu_notify.priority = 0; +- if (err == 0) +- err = register_cpu_notifier(&conf->cpu_notify); +-#endif + put_online_cpus(); + + return err; +diff --git a/drivers/media/dvb/dvb-usb/mxl111sf-tuner.h b/drivers/media/dvb/dvb-usb/mxl111sf-tuner.h +index ff33396..10b93c4 100644 +--- a/drivers/media/dvb/dvb-usb/mxl111sf-tuner.h ++++ b/drivers/media/dvb/dvb-usb/mxl111sf-tuner.h +@@ -69,7 +69,7 @@ struct dvb_frontend *mxl111sf_tuner_attach(struct dvb_frontend *fe, + #else + static inline + struct dvb_frontend *mxl111sf_tuner_attach(struct dvb_frontend *fe, +- struct mxl111sf_state *mxl_state ++ struct mxl111sf_state *mxl_state, + struct mxl111sf_tuner_config *cfg) + { + printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __func__); +diff --git a/drivers/media/dvb/frontends/dib8000.c b/drivers/media/dvb/frontends/dib8000.c +index fe284d5..a542db1 100644 +--- a/drivers/media/dvb/frontends/dib8000.c ++++ b/drivers/media/dvb/frontends/dib8000.c +@@ -114,15 +114,10 @@ static u16 dib8000_i2c_read16(struct i2c_device *i2c, u16 reg) + return ret; + } + +-static u16 dib8000_read_word(struct dib8000_state *state, u16 reg) ++static u16 __dib8000_read_word(struct dib8000_state *state, u16 reg) + { + u16 ret; + +- if (mutex_lock_interruptible(&state->i2c_buffer_lock) < 0) { +- dprintk("could not acquire lock"); +- return 0; +- } +- + state->i2c_write_buffer[0] = reg >> 8; + state->i2c_write_buffer[1] = reg & 0xff; + +@@ -140,6 +135,21 @@ static u16 dib8000_read_word(struct dib8000_state *state, u16 reg) + dprintk("i2c read error on %d", reg); + + ret = (state->i2c_read_buffer[0] << 8) | state->i2c_read_buffer[1]; ++ ++ return ret; ++} ++ ++static u16 dib8000_read_word(struct dib8000_state *state, u16 reg) ++{ ++ u16 ret; ++ ++ if (mutex_lock_interruptible(&state->i2c_buffer_lock) < 0) { ++ dprintk("could not acquire lock"); ++ return 0; ++ } ++ ++ ret = __dib8000_read_word(state, reg); ++ + mutex_unlock(&state->i2c_buffer_lock); + + return ret; +@@ -149,8 +159,15 @@ static u32 dib8000_read32(struct dib8000_state *state, u16 reg) + { + u16 rw[2]; + +- rw[0] = dib8000_read_word(state, reg + 0); +- rw[1] = dib8000_read_word(state, reg + 1); ++ if (mutex_lock_interruptible(&state->i2c_buffer_lock) < 0) { ++ dprintk("could not acquire lock"); ++ return 0; ++ } ++ ++ rw[0] = __dib8000_read_word(state, reg + 0); ++ rw[1] = __dib8000_read_word(state, reg + 1); ++ ++ mutex_unlock(&state->i2c_buffer_lock); + + return ((rw[0] << 16) | (rw[1])); + } +diff --git a/drivers/media/video/saa7134/saa7134-alsa.c b/drivers/media/video/saa7134/saa7134-alsa.c +index 10460fd..dbcdfbf 100644 +--- a/drivers/media/video/saa7134/saa7134-alsa.c ++++ b/drivers/media/video/saa7134/saa7134-alsa.c +@@ -172,7 +172,9 @@ static void saa7134_irq_alsa_done(struct saa7134_dev *dev, + dprintk("irq: overrun [full=%d/%d] - Blocks in %d\n",dev->dmasound.read_count, + dev->dmasound.bufsize, dev->dmasound.blocks); + spin_unlock(&dev->slock); ++ snd_pcm_stream_lock(dev->dmasound.substream); + snd_pcm_stop(dev->dmasound.substream,SNDRV_PCM_STATE_XRUN); ++ snd_pcm_stream_unlock(dev->dmasound.substream); + return; + } + +diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c +index 83790f2..fd61f63 100644 +--- a/drivers/mmc/host/atmel-mci.c ++++ b/drivers/mmc/host/atmel-mci.c +@@ -1014,11 +1014,22 @@ static void atmci_start_request(struct atmel_mci *host, + iflags |= ATMCI_CMDRDY; + cmd = mrq->cmd; + cmdflags = atmci_prepare_command(slot->mmc, cmd); +- atmci_send_command(host, cmd, cmdflags); ++ ++ /* ++ * DMA transfer should be started before sending the command to avoid ++ * unexpected errors especially for read operations in SDIO mode. ++ * Unfortunately, in PDC mode, command has to be sent before starting ++ * the transfer. ++ */ ++ if (host->submit_data != &atmci_submit_data_dma) ++ atmci_send_command(host, cmd, cmdflags); + + if (data) + host->submit_data(host, data); + ++ if (host->submit_data == &atmci_submit_data_dma) ++ atmci_send_command(host, cmd, cmdflags); ++ + if (mrq->stop) { + host->stop_cmdr = atmci_prepare_command(slot->mmc, mrq->stop); + host->stop_cmdr |= ATMCI_CMDR_STOP_XFER; +diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c +index aaeaff2..9f68b82 100644 +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -1670,12 +1670,12 @@ static int sdhci_execute_tuning(struct mmc_host *mmc) + int tuning_loop_counter = MAX_TUNING_LOOP; + unsigned long timeout; + int err = 0; ++ unsigned long flags; + + host = mmc_priv(mmc); + + sdhci_runtime_pm_get(host); +- disable_irq(host->irq); +- spin_lock(&host->lock); ++ spin_lock_irqsave(&host->lock, flags); + + ctrl = sdhci_readw(host, SDHCI_HOST_CONTROL2); + +@@ -1689,8 +1689,7 @@ static int sdhci_execute_tuning(struct mmc_host *mmc) + (host->flags & SDHCI_SDR50_NEEDS_TUNING))) + ctrl |= SDHCI_CTRL_EXEC_TUNING; + else { +- spin_unlock(&host->lock); +- enable_irq(host->irq); ++ spin_unlock_irqrestore(&host->lock, flags); + sdhci_runtime_pm_put(host); + return 0; + } +@@ -1752,15 +1751,12 @@ static int sdhci_execute_tuning(struct mmc_host *mmc) + host->cmd = NULL; + host->mrq = NULL; + +- spin_unlock(&host->lock); +- enable_irq(host->irq); +- ++ spin_unlock_irqrestore(&host->lock, flags); + /* Wait for Buffer Read Ready interrupt */ + wait_event_interruptible_timeout(host->buf_ready_int, + (host->tuning_done == 1), + msecs_to_jiffies(50)); +- disable_irq(host->irq); +- spin_lock(&host->lock); ++ spin_lock_irqsave(&host->lock, flags); + + if (!host->tuning_done) { + pr_info(DRIVER_NAME ": Timeout waiting for " +@@ -1833,8 +1829,7 @@ out: + err = 0; + + sdhci_clear_set_irqs(host, SDHCI_INT_DATA_AVAIL, ier); +- spin_unlock(&host->lock); +- enable_irq(host->irq); ++ spin_unlock_irqrestore(&host->lock, flags); + sdhci_runtime_pm_put(host); + + return err; +diff --git a/drivers/mtd/nand/mxc_nand.c b/drivers/mtd/nand/mxc_nand.c +index 74a43b8..baf8356 100644 +--- a/drivers/mtd/nand/mxc_nand.c ++++ b/drivers/mtd/nand/mxc_nand.c +@@ -596,7 +596,6 @@ static int mxc_nand_correct_data_v2_v3(struct mtd_info *mtd, u_char *dat, + ecc_stat >>= 4; + } while (--no_subpages); + +- mtd->ecc_stats.corrected += ret; + pr_debug("%d Symbol Correctable RS-ECC Error\n", ret); + + return ret; +diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c +index 0ae0d7c..aaa7999 100644 +--- a/drivers/net/bonding/bond_3ad.c ++++ b/drivers/net/bonding/bond_3ad.c +@@ -1854,8 +1854,6 @@ void bond_3ad_initiate_agg_selection(struct bonding *bond, int timeout) + BOND_AD_INFO(bond).agg_select_timer = timeout; + } + +-static u16 aggregator_identifier; +- + /** + * bond_3ad_initialize - initialize a bond's 802.3ad parameters and structures + * @bond: bonding struct to work on +@@ -1869,7 +1867,7 @@ void bond_3ad_initialize(struct bonding *bond, u16 tick_resolution) + if (MAC_ADDRESS_COMPARE(&(BOND_AD_INFO(bond).system.sys_mac_addr), + bond->dev->dev_addr)) { + +- aggregator_identifier = 0; ++ BOND_AD_INFO(bond).aggregator_identifier = 0; + + BOND_AD_INFO(bond).system.sys_priority = 0xFFFF; + BOND_AD_INFO(bond).system.sys_mac_addr = *((struct mac_addr *)bond->dev->dev_addr); +@@ -1941,7 +1939,7 @@ int bond_3ad_bind_slave(struct slave *slave) + ad_initialize_agg(aggregator); + + aggregator->aggregator_mac_address = *((struct mac_addr *)bond->dev->dev_addr); +- aggregator->aggregator_identifier = (++aggregator_identifier); ++ aggregator->aggregator_identifier = ++BOND_AD_INFO(bond).aggregator_identifier; + aggregator->slave = slave; + aggregator->is_active = 0; + aggregator->num_of_ports = 0; +diff --git a/drivers/net/bonding/bond_3ad.h b/drivers/net/bonding/bond_3ad.h +index 235b2cc..20d9c78 100644 +--- a/drivers/net/bonding/bond_3ad.h ++++ b/drivers/net/bonding/bond_3ad.h +@@ -253,6 +253,7 @@ struct ad_system { + struct ad_bond_info { + struct ad_system system; /* 802.3ad system structure */ + u32 agg_select_timer; // Timer to select aggregator after all adapter's hand shakes ++ u16 aggregator_identifier; + }; + + struct ad_slave_info { +diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c +index bb828c2..7c6bb5a 100644 +--- a/drivers/net/can/flexcan.c ++++ b/drivers/net/can/flexcan.c +@@ -777,14 +777,16 @@ static void flexcan_chip_stop(struct net_device *dev) + struct flexcan_regs __iomem *regs = priv->base; + u32 reg; + +- /* Disable all interrupts */ +- flexcan_write(0, ®s->imask1); +- + /* Disable + halt module */ + reg = flexcan_read(®s->mcr); + reg |= FLEXCAN_MCR_MDIS | FLEXCAN_MCR_HALT; + flexcan_write(reg, ®s->mcr); + ++ /* Disable all interrupts */ ++ flexcan_write(0, ®s->imask1); ++ flexcan_write(priv->reg_ctrl_default & ~FLEXCAN_CTRL_ERR_ALL, ++ ®s->ctrl); ++ + flexcan_transceiver_switch(priv, 0); + priv->can.state = CAN_STATE_STOPPED; + +@@ -809,12 +811,14 @@ static int flexcan_open(struct net_device *dev) + /* start chip and queuing */ + err = flexcan_chip_start(dev); + if (err) +- goto out_close; ++ goto out_free_irq; + napi_enable(&priv->napi); + netif_start_queue(dev); + + return 0; + ++ out_free_irq: ++ free_irq(dev->irq, dev); + out_close: + close_candev(dev); + out: +@@ -1023,6 +1027,7 @@ static int __devexit flexcan_remove(struct platform_device *pdev) + struct resource *mem; + + unregister_flexcandev(dev); ++ netif_napi_del(&priv->napi); + platform_set_drvdata(pdev, NULL); + iounmap(priv->base); + +diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c +index d5793d3..c77c462 100644 +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -5637,8 +5637,7 @@ static int tg3_rx(struct tg3_napi *tnapi, int budget) + + work_mask |= opaque_key; + +- if ((desc->err_vlan & RXD_ERR_MASK) != 0 && +- (desc->err_vlan != RXD_ERR_ODD_NIBBLE_RCVD_MII)) { ++ if (desc->err_vlan & RXD_ERR_MASK) { + drop_it: + tg3_recycle_rx(tnapi, tpr, opaque_key, + desc_idx, *post_ptr); +@@ -7103,12 +7102,12 @@ static int tg3_change_mtu(struct net_device *dev, int new_mtu) + + tg3_netif_stop(tp); + ++ tg3_set_mtu(dev, tp, new_mtu); ++ + tg3_full_lock(tp, 1); + + tg3_halt(tp, RESET_KIND_SHUTDOWN, 1); + +- tg3_set_mtu(dev, tp, new_mtu); +- + err = tg3_restart_hw(tp, 0); + + if (!err) +diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h +index da90ba5..a398a6f 100644 +--- a/drivers/net/ethernet/broadcom/tg3.h ++++ b/drivers/net/ethernet/broadcom/tg3.h +@@ -2477,7 +2477,11 @@ struct tg3_rx_buffer_desc { + #define RXD_ERR_TOO_SMALL 0x00400000 + #define RXD_ERR_NO_RESOURCES 0x00800000 + #define RXD_ERR_HUGE_FRAME 0x01000000 +-#define RXD_ERR_MASK 0xffff0000 ++ ++#define RXD_ERR_MASK (RXD_ERR_BAD_CRC | RXD_ERR_COLLISION | \ ++ RXD_ERR_LINK_LOST | RXD_ERR_PHY_DECODE | \ ++ RXD_ERR_MAC_ABRT | RXD_ERR_TOO_SMALL | \ ++ RXD_ERR_NO_RESOURCES | RXD_ERR_HUGE_FRAME) + + u32 reserved; + u32 opaque; +diff --git a/drivers/net/usb/gl620a.c b/drivers/net/usb/gl620a.c +index c4cfd1d..75d9040 100644 +--- a/drivers/net/usb/gl620a.c ++++ b/drivers/net/usb/gl620a.c +@@ -86,6 +86,10 @@ static int genelink_rx_fixup(struct usbnet *dev, struct sk_buff *skb) + u32 size; + u32 count; + ++ /* This check is no longer done by usbnet */ ++ if (skb->len < dev->net->hard_header_len) ++ return 0; ++ + header = (struct gl_header *) skb->data; + + // get the packet count of the received skb +diff --git a/drivers/net/usb/mcs7830.c b/drivers/net/usb/mcs7830.c +index db2cb74..a2f7579 100644 +--- a/drivers/net/usb/mcs7830.c ++++ b/drivers/net/usb/mcs7830.c +@@ -601,8 +601,9 @@ static int mcs7830_rx_fixup(struct usbnet *dev, struct sk_buff *skb) + { + u8 status; + +- if (skb->len == 0) { +- dev_err(&dev->udev->dev, "unexpected empty rx frame\n"); ++ /* This check is no longer done by usbnet */ ++ if (skb->len < dev->net->hard_header_len) { ++ dev_err(&dev->udev->dev, "unexpected tiny rx frame\n"); + return 0; + } + +diff --git a/drivers/net/usb/net1080.c b/drivers/net/usb/net1080.c +index 01db460..c9e3278 100644 +--- a/drivers/net/usb/net1080.c ++++ b/drivers/net/usb/net1080.c +@@ -419,6 +419,10 @@ static int net1080_rx_fixup(struct usbnet *dev, struct sk_buff *skb) + struct nc_trailer *trailer; + u16 hdr_len, packet_len; + ++ /* This check is no longer done by usbnet */ ++ if (skb->len < dev->net->hard_header_len) ++ return 0; ++ + if (!(skb->len & 0x01)) { + #ifdef DEBUG + struct net_device *net = dev->net; +diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c +index 255d6a4..13b40e3 100644 +--- a/drivers/net/usb/rndis_host.c ++++ b/drivers/net/usb/rndis_host.c +@@ -490,6 +490,10 @@ EXPORT_SYMBOL_GPL(rndis_unbind); + */ + int rndis_rx_fixup(struct usbnet *dev, struct sk_buff *skb) + { ++ /* This check is no longer done by usbnet */ ++ if (skb->len < dev->net->hard_header_len) ++ return 0; ++ + /* peripheral may have batched packets to us... */ + while (likely(skb->len)) { + struct rndis_data_hdr *hdr = (void *)skb->data; +diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c +index a8e4640..c41b42b 100644 +--- a/drivers/net/usb/smsc75xx.c ++++ b/drivers/net/usb/smsc75xx.c +@@ -1079,6 +1079,10 @@ static void smsc75xx_rx_csum_offload(struct usbnet *dev, struct sk_buff *skb, + + static int smsc75xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb) + { ++ /* This check is no longer done by usbnet */ ++ if (skb->len < dev->net->hard_header_len) ++ return 0; ++ + while (skb->len > 0) { + u32 rx_cmd_a, rx_cmd_b, align_count, size; + struct sk_buff *ax_skb; +diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c +index 55b3218..6617325 100644 +--- a/drivers/net/usb/smsc95xx.c ++++ b/drivers/net/usb/smsc95xx.c +@@ -1039,6 +1039,10 @@ static void smsc95xx_rx_csum_offload(struct sk_buff *skb) + + static int smsc95xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb) + { ++ /* This check is no longer done by usbnet */ ++ if (skb->len < dev->net->hard_header_len) ++ return 0; ++ + while (skb->len > 0) { + u32 header, align_count; + struct sk_buff *ax_skb; +diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c +index dc53a8f..3d21742 100644 +--- a/drivers/net/usb/usbnet.c ++++ b/drivers/net/usb/usbnet.c +@@ -414,17 +414,19 @@ static inline void rx_process (struct usbnet *dev, struct sk_buff *skb) + } + // else network stack removes extra byte if we forced a short packet + +- if (skb->len) { +- /* all data was already cloned from skb inside the driver */ +- if (dev->driver_info->flags & FLAG_MULTI_PACKET) +- dev_kfree_skb_any(skb); +- else +- usbnet_skb_return(dev, skb); ++ /* all data was already cloned from skb inside the driver */ ++ if (dev->driver_info->flags & FLAG_MULTI_PACKET) ++ goto done; ++ ++ if (skb->len < ETH_HLEN) { ++ dev->net->stats.rx_errors++; ++ dev->net->stats.rx_length_errors++; ++ netif_dbg(dev, rx_err, dev->net, "rx length %d\n", skb->len); ++ } else { ++ usbnet_skb_return(dev, skb); + return; + } + +- netif_dbg(dev, rx_err, dev->net, "drop\n"); +- dev->net->stats.rx_errors++; + done: + skb_queue_tail(&dev->done, skb); + } +@@ -446,13 +448,6 @@ static void rx_complete (struct urb *urb) + switch (urb_status) { + /* success */ + case 0: +- if (skb->len < dev->net->hard_header_len) { +- state = rx_cleanup; +- dev->net->stats.rx_errors++; +- dev->net->stats.rx_length_errors++; +- netif_dbg(dev, rx_err, dev->net, +- "rx length %d\n", skb->len); +- } + break; + + /* stalls need manual reset. this is rare ... except that +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index 43a6a11..f13a673 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -1029,7 +1029,8 @@ static int virtnet_probe(struct virtio_device *vdev) + /* If we can receive ANY GSO packets, we must allocate large ones. */ + if (virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO4) || + virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO6) || +- virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_ECN)) ++ virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_ECN) || ++ virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_UFO)) + vi->big_packets = true; + + if (virtio_has_feature(vdev, VIRTIO_NET_F_MRG_RXBUF)) +diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c +index d426261..28ceef2 100644 +--- a/drivers/net/vmxnet3/vmxnet3_drv.c ++++ b/drivers/net/vmxnet3/vmxnet3_drv.c +@@ -1734,11 +1734,20 @@ vmxnet3_netpoll(struct net_device *netdev) + { + struct vmxnet3_adapter *adapter = netdev_priv(netdev); + +- if (adapter->intr.mask_mode == VMXNET3_IMM_ACTIVE) +- vmxnet3_disable_all_intrs(adapter); +- +- vmxnet3_do_poll(adapter, adapter->rx_queue[0].rx_ring[0].size); +- vmxnet3_enable_all_intrs(adapter); ++ switch (adapter->intr.type) { ++#ifdef CONFIG_PCI_MSI ++ case VMXNET3_IT_MSIX: { ++ int i; ++ for (i = 0; i < adapter->num_rx_queues; i++) ++ vmxnet3_msix_rx(0, &adapter->rx_queue[i]); ++ break; ++ } ++#endif ++ case VMXNET3_IT_MSI: ++ default: ++ vmxnet3_intr(0, adapter->netdev); ++ break; ++ } + + } + #endif /* CONFIG_NET_POLL_CONTROLLER */ +diff --git a/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h b/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h +index 9c51b39..eabf374 100644 +--- a/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h ++++ b/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h +@@ -55,7 +55,7 @@ static const u32 ar9462_2p0_baseband_postamble[][5] = { + {0x00009e14, 0x37b95d5e, 0x37b9605e, 0x3039605e, 0x33795d5e}, + {0x00009e18, 0x00000000, 0x00000000, 0x00000000, 0x00000000}, + {0x00009e1c, 0x0001cf9c, 0x0001cf9c, 0x00021f9c, 0x00021f9c}, +- {0x00009e20, 0x000003b5, 0x000003b5, 0x000003ce, 0x000003ce}, ++ {0x00009e20, 0x000003a5, 0x000003a5, 0x000003a5, 0x000003a5}, + {0x00009e2c, 0x0000001c, 0x0000001c, 0x00000021, 0x00000021}, + {0x00009e3c, 0xcf946220, 0xcf946220, 0xcfd5c782, 0xcfd5c782}, + {0x00009e44, 0xfe321e27, 0xfe321e27, 0xfe291e27, 0xfe291e27}, +@@ -85,7 +85,7 @@ static const u32 ar9462_2p0_baseband_postamble[][5] = { + {0x0000ae04, 0x001c0000, 0x001c0000, 0x001c0000, 0x00100000}, + {0x0000ae18, 0x00000000, 0x00000000, 0x00000000, 0x00000000}, + {0x0000ae1c, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c}, +- {0x0000ae20, 0x000001b5, 0x000001b5, 0x000001ce, 0x000001ce}, ++ {0x0000ae20, 0x000001a6, 0x000001a6, 0x000001aa, 0x000001aa}, + {0x0000b284, 0x00000000, 0x00000000, 0x00000550, 0x00000550}, + }; + +diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c +index ef921e1..c6c3e1c 100644 +--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c ++++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c +@@ -28,6 +28,10 @@ int htc_modparam_nohwcrypt; + module_param_named(nohwcrypt, htc_modparam_nohwcrypt, int, 0444); + MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption"); + ++static int ath9k_ps_enable; ++module_param_named(ps_enable, ath9k_ps_enable, int, 0444); ++MODULE_PARM_DESC(ps_enable, "Enable WLAN PowerSave"); ++ + #define CHAN2G(_freq, _idx) { \ + .center_freq = (_freq), \ + .hw_value = (_idx), \ +@@ -729,11 +733,13 @@ static void ath9k_set_hw_capab(struct ath9k_htc_priv *priv, + IEEE80211_HW_SPECTRUM_MGMT | + IEEE80211_HW_HAS_RATE_CONTROL | + IEEE80211_HW_RX_INCLUDES_FCS | +- IEEE80211_HW_SUPPORTS_PS | + IEEE80211_HW_PS_NULLFUNC_STACK | + IEEE80211_HW_REPORTS_TX_ACK_STATUS | + IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING; + ++ if (ath9k_ps_enable) ++ hw->flags |= IEEE80211_HW_SUPPORTS_PS; ++ + hw->wiphy->interface_modes = + BIT(NL80211_IFTYPE_STATION) | + BIT(NL80211_IFTYPE_ADHOC) | +diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c +index ba6a49c..1355d71 100644 +--- a/drivers/net/wireless/ath/ath9k/init.c ++++ b/drivers/net/wireless/ath/ath9k/init.c +@@ -44,6 +44,10 @@ static int ath9k_btcoex_enable; + module_param_named(btcoex_enable, ath9k_btcoex_enable, int, 0444); + MODULE_PARM_DESC(btcoex_enable, "Enable wifi-BT coexistence"); + ++static int ath9k_ps_enable; ++module_param_named(ps_enable, ath9k_ps_enable, int, 0444); ++MODULE_PARM_DESC(ps_enable, "Enable WLAN PowerSave"); ++ + bool is_ath9k_unloaded; + /* We use the hw_value as an index into our private channel structure */ + +@@ -671,11 +675,13 @@ void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw) + hw->flags = IEEE80211_HW_RX_INCLUDES_FCS | + IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING | + IEEE80211_HW_SIGNAL_DBM | +- IEEE80211_HW_SUPPORTS_PS | + IEEE80211_HW_PS_NULLFUNC_STACK | + IEEE80211_HW_SPECTRUM_MGMT | + IEEE80211_HW_REPORTS_TX_ACK_STATUS; + ++ if (ath9k_ps_enable) ++ hw->flags |= IEEE80211_HW_SUPPORTS_PS; ++ + if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT) + hw->flags |= IEEE80211_HW_AMPDU_AGGREGATION; + +diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c +index 126ed31..2e88af1 100644 +--- a/drivers/net/wireless/ath/ath9k/xmit.c ++++ b/drivers/net/wireless/ath/ath9k/xmit.c +@@ -1176,14 +1176,16 @@ void ath_tx_aggr_sleep(struct ieee80211_sta *sta, struct ath_softc *sc, + for (tidno = 0, tid = &an->tid[tidno]; + tidno < WME_NUM_TID; tidno++, tid++) { + +- if (!tid->sched) +- continue; +- + ac = tid->ac; + txq = ac->txq; + + spin_lock_bh(&txq->axq_lock); + ++ if (!tid->sched) { ++ spin_unlock_bh(&txq->axq_lock); ++ continue; ++ } ++ + buffered = !skb_queue_empty(&tid->buf_q); + + tid->sched = false; +diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c +index 5f77cbe..c6c34bf 100644 +--- a/drivers/net/wireless/b43/xmit.c ++++ b/drivers/net/wireless/b43/xmit.c +@@ -819,10 +819,10 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr) + * channel number in b43. */ + if (chanstat & B43_RX_CHAN_5GHZ) { + status.band = IEEE80211_BAND_5GHZ; +- status.freq = b43_freq_to_channel_5ghz(chanid); ++ status.freq = b43_channel_to_freq_5ghz(chanid); + } else { + status.band = IEEE80211_BAND_2GHZ; +- status.freq = b43_freq_to_channel_2ghz(chanid); ++ status.freq = b43_channel_to_freq_2ghz(chanid); + } + break; + default: +diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c +index df1540c..5fe4602 100644 +--- a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c ++++ b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c +@@ -854,8 +854,6 @@ int iwlagn_rx_reply_compressed_ba(struct iwl_priv *priv, + struct iwl_compressed_ba_resp *ba_resp = &pkt->u.compressed_ba; + struct iwl_ht_agg *agg; + struct sk_buff_head reclaimed_skbs; +- struct ieee80211_tx_info *info; +- struct ieee80211_hdr *hdr; + struct sk_buff *skb; + unsigned long flags; + int sta_id; +@@ -941,24 +939,32 @@ int iwlagn_rx_reply_compressed_ba(struct iwl_priv *priv, + 0, &reclaimed_skbs); + freed = 0; + while (!skb_queue_empty(&reclaimed_skbs)) { ++ struct ieee80211_hdr *hdr; ++ struct ieee80211_tx_info *info; + + skb = __skb_dequeue(&reclaimed_skbs); +- hdr = (struct ieee80211_hdr *)skb->data; ++ hdr = (void *)skb->data; ++ info = IEEE80211_SKB_CB(skb); + + if (ieee80211_is_data_qos(hdr->frame_control)) + freed++; + else + WARN_ON_ONCE(1); + +- info = IEEE80211_SKB_CB(skb); + kmem_cache_free(priv->tx_cmd_pool, (info->driver_data[1])); + ++ memset(&info->status, 0, sizeof(info->status)); ++ /* Packet was transmitted successfully, failures come as single ++ * frames because before failing a frame the firmware transmits ++ * it without aggregation at least once. ++ */ ++ info->flags |= IEEE80211_TX_STAT_ACK; ++ + if (freed == 1) { + /* this is the first skb we deliver in this batch */ + /* put the rate scaling data there */ + info = IEEE80211_SKB_CB(skb); + memset(&info->status, 0, sizeof(info->status)); +- info->flags |= IEEE80211_TX_STAT_ACK; + info->flags |= IEEE80211_TX_STAT_AMPDU; + info->status.ampdu_ack_len = ba_resp->txed_2_done; + info->status.ampdu_len = ba_resp->txed; +diff --git a/drivers/net/wireless/mwifiex/11n.c b/drivers/net/wireless/mwifiex/11n.c +index 34bba52..6543f4f 100644 +--- a/drivers/net/wireless/mwifiex/11n.c ++++ b/drivers/net/wireless/mwifiex/11n.c +@@ -343,8 +343,7 @@ mwifiex_cmd_append_11n_tlv(struct mwifiex_private *priv, + ht_cap->header.len = + cpu_to_le16(sizeof(struct ieee80211_ht_cap)); + memcpy((u8 *) ht_cap + sizeof(struct mwifiex_ie_types_header), +- (u8 *) bss_desc->bcn_ht_cap + +- sizeof(struct ieee_types_header), ++ (u8 *)bss_desc->bcn_ht_cap, + le16_to_cpu(ht_cap->header.len)); + + mwifiex_fill_cap_info(priv, radio_type, ht_cap); +diff --git a/drivers/net/wireless/rtl818x/rtl8187/rtl8187.h b/drivers/net/wireless/rtl818x/rtl8187/rtl8187.h +index f1cc907..6d3d653 100644 +--- a/drivers/net/wireless/rtl818x/rtl8187/rtl8187.h ++++ b/drivers/net/wireless/rtl818x/rtl8187/rtl8187.h +@@ -15,6 +15,8 @@ + #ifndef RTL8187_H + #define RTL8187_H + ++#include <linux/cache.h> ++ + #include "rtl818x.h" + #include "leds.h" + +@@ -131,7 +133,10 @@ struct rtl8187_priv { + u8 aifsn[4]; + u8 rfkill_mask; + struct { +- __le64 buf; ++ union { ++ __le64 buf; ++ u8 dummy1[L1_CACHE_BYTES]; ++ } ____cacheline_aligned; + struct sk_buff_head queue; + } b_tx_status; /* This queue is used by both -b and non-b devices */ + struct mutex io_mutex; +@@ -139,7 +144,8 @@ struct rtl8187_priv { + u8 bits8; + __le16 bits16; + __le32 bits32; +- } *io_dmabuf; ++ u8 dummy2[L1_CACHE_BYTES]; ++ } *io_dmabuf ____cacheline_aligned; + bool rfkill_off; + }; + +diff --git a/drivers/net/wireless/rtlwifi/core.c b/drivers/net/wireless/rtlwifi/core.c +index 3f0f056..4fa987b 100644 +--- a/drivers/net/wireless/rtlwifi/core.c ++++ b/drivers/net/wireless/rtlwifi/core.c +@@ -131,6 +131,7 @@ static int rtl_op_add_interface(struct ieee80211_hw *hw, + rtlpriv->cfg->maps + [RTL_IBSS_INT_MASKS]); + } ++ mac->link_state = MAC80211_LINKED; + break; + case NL80211_IFTYPE_ADHOC: + RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, +diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c +index cb480d8..ce1fdbe 100644 +--- a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c +@@ -905,14 +905,26 @@ int rtl92ce_hw_init(struct ieee80211_hw *hw) + bool is92c; + int err; + u8 tmp_u1b; ++ unsigned long flags; + + rtlpci->being_init_adapter = true; ++ ++ /* Since this function can take a very long time (up to 350 ms) ++ * and can be called with irqs disabled, reenable the irqs ++ * to let the other devices continue being serviced. ++ * ++ * It is safe doing so since our own interrupts will only be enabled ++ * in a subsequent step. ++ */ ++ local_save_flags(flags); ++ local_irq_enable(); ++ + rtlpriv->intf_ops->disable_aspm(hw); + rtstatus = _rtl92ce_init_mac(hw); + if (rtstatus != true) { + RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, ("Init MAC failed\n")); + err = 1; +- return err; ++ goto exit; + } + + err = rtl92c_download_fw(hw); +@@ -922,7 +934,7 @@ int rtl92ce_hw_init(struct ieee80211_hw *hw) + "without FW now..\n")); + err = 1; + rtlhal->fw_ready = false; +- return err; ++ goto exit; + } else { + rtlhal->fw_ready = true; + } +@@ -985,6 +997,8 @@ int rtl92ce_hw_init(struct ieee80211_hw *hw) + RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE, ("under 1.5V\n")); + } + rtl92c_dm_init(hw); ++exit: ++ local_irq_restore(flags); + rtlpci->being_init_adapter = false; + return err; + } +diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c b/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c +index 17a8e96..d984867 100644 +--- a/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c +@@ -85,17 +85,15 @@ void rtl92cu_phy_rf6052_set_cck_txpower(struct ieee80211_hw *hw, + if (mac->act_scanning) { + tx_agc[RF90_PATH_A] = 0x3f3f3f3f; + tx_agc[RF90_PATH_B] = 0x3f3f3f3f; +- if (turbo_scanoff) { +- for (idx1 = RF90_PATH_A; idx1 <= RF90_PATH_B; idx1++) { +- tx_agc[idx1] = ppowerlevel[idx1] | +- (ppowerlevel[idx1] << 8) | +- (ppowerlevel[idx1] << 16) | +- (ppowerlevel[idx1] << 24); +- if (rtlhal->interface == INTF_USB) { +- if (tx_agc[idx1] > 0x20 && +- rtlefuse->external_pa) +- tx_agc[idx1] = 0x20; +- } ++ for (idx1 = RF90_PATH_A; idx1 <= RF90_PATH_B; idx1++) { ++ tx_agc[idx1] = ppowerlevel[idx1] | ++ (ppowerlevel[idx1] << 8) | ++ (ppowerlevel[idx1] << 16) | ++ (ppowerlevel[idx1] << 24); ++ if (rtlhal->interface == INTF_USB) { ++ if (tx_agc[idx1] > 0x20 && ++ rtlefuse->external_pa) ++ tx_agc[idx1] = 0x20; + } + } + } else { +@@ -107,7 +105,7 @@ void rtl92cu_phy_rf6052_set_cck_txpower(struct ieee80211_hw *hw, + TXHIGHPWRLEVEL_LEVEL2) { + tx_agc[RF90_PATH_A] = 0x00000000; + tx_agc[RF90_PATH_B] = 0x00000000; +- } else{ ++ } else { + for (idx1 = RF90_PATH_A; idx1 <= RF90_PATH_B; idx1++) { + tx_agc[idx1] = ppowerlevel[idx1] | + (ppowerlevel[idx1] << 8) | +@@ -380,7 +378,12 @@ static void _rtl92c_write_ofdm_power_reg(struct ieee80211_hw *hw, + regoffset == RTXAGC_B_MCS07_MCS04) + regoffset = 0xc98; + for (i = 0; i < 3; i++) { +- writeVal = (writeVal > 6) ? (writeVal - 6) : 0; ++ if (i != 2) ++ writeVal = (writeVal > 8) ? ++ (writeVal - 8) : 0; ++ else ++ writeVal = (writeVal > 6) ? ++ (writeVal - 6) : 0; + rtl_write_byte(rtlpriv, (u32)(regoffset + i), + (u8)writeVal); + } +diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c +index 016ef86..c184253 100644 +--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c +@@ -316,6 +316,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = { + {RTL_USB_DEVICE(0x0bda, 0x5088, rtl92cu_hal_cfg)}, /*Thinkware-CC&C*/ + {RTL_USB_DEVICE(0x0df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/ + {RTL_USB_DEVICE(0x0df6, 0x005c, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/ ++ {RTL_USB_DEVICE(0x0df6, 0x0077, rtl92cu_hal_cfg)}, /*Sitecom-WLA2100V2*/ + {RTL_USB_DEVICE(0x0eb0, 0x9071, rtl92cu_hal_cfg)}, /*NO Brand - Etop*/ + {RTL_USB_DEVICE(0x4856, 0x0091, rtl92cu_hal_cfg)}, /*NetweeN - Feixun*/ + /* HP - Lite-On ,8188CUS Slim Combo */ +diff --git a/drivers/of/address.c b/drivers/of/address.c +index 72c33fb..45c1727 100644 +--- a/drivers/of/address.c ++++ b/drivers/of/address.c +@@ -97,8 +97,13 @@ static unsigned int of_bus_default_get_flags(const __be32 *addr) + + static int of_bus_pci_match(struct device_node *np) + { +- /* "vci" is for the /chaos bridge on 1st-gen PCI powermacs */ +- return !strcmp(np->type, "pci") || !strcmp(np->type, "vci"); ++ /* ++ * "pciex" is PCI Express ++ * "vci" is for the /chaos bridge on 1st-gen PCI powermacs ++ * "ht" is hypertransport ++ */ ++ return !strcmp(np->type, "pci") || !strcmp(np->type, "pciex") || ++ !strcmp(np->type, "vci") || !strcmp(np->type, "ht"); + } + + static void of_bus_pci_count_cells(struct device_node *np, +diff --git a/drivers/parport/parport_pc.c b/drivers/parport/parport_pc.c +index d0b597b..5a4432d 100644 +--- a/drivers/parport/parport_pc.c ++++ b/drivers/parport/parport_pc.c +@@ -2875,8 +2875,6 @@ enum parport_pc_pci_cards { + syba_2p_epp, + syba_1p_ecp, + titan_010l, +- titan_1284p1, +- titan_1284p2, + avlab_1p, + avlab_2p, + oxsemi_952, +@@ -2935,8 +2933,6 @@ static struct parport_pc_pci { + /* syba_2p_epp AP138B */ { 2, { { 0, 0x078 }, { 0, 0x178 }, } }, + /* syba_1p_ecp W83787 */ { 1, { { 0, 0x078 }, } }, + /* titan_010l */ { 1, { { 3, -1 }, } }, +- /* titan_1284p1 */ { 1, { { 0, 1 }, } }, +- /* titan_1284p2 */ { 2, { { 0, 1 }, { 2, 3 }, } }, + /* avlab_1p */ { 1, { { 0, 1}, } }, + /* avlab_2p */ { 2, { { 0, 1}, { 2, 3 },} }, + /* The Oxford Semi cards are unusual: 954 doesn't support ECP, +@@ -2952,8 +2948,8 @@ static struct parport_pc_pci { + /* netmos_9705 */ { 1, { { 0, -1 }, } }, + /* netmos_9715 */ { 2, { { 0, 1 }, { 2, 3 },} }, + /* netmos_9755 */ { 2, { { 0, 1 }, { 2, 3 },} }, +- /* netmos_9805 */ { 1, { { 0, -1 }, } }, +- /* netmos_9815 */ { 2, { { 0, -1 }, { 2, -1 }, } }, ++ /* netmos_9805 */ { 1, { { 0, 1 }, } }, ++ /* netmos_9815 */ { 2, { { 0, 1 }, { 2, 3 }, } }, + /* netmos_9901 */ { 1, { { 0, -1 }, } }, + /* netmos_9865 */ { 1, { { 0, -1 }, } }, + /* quatech_sppxp100 */ { 1, { { 0, 1 }, } }, +@@ -2997,8 +2993,6 @@ static const struct pci_device_id parport_pc_pci_tbl[] = { + PCI_ANY_ID, PCI_ANY_ID, 0, 0, syba_1p_ecp }, + { PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_010L, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, titan_010l }, +- { 0x9710, 0x9805, 0x1000, 0x0010, 0, 0, titan_1284p1 }, +- { 0x9710, 0x9815, 0x1000, 0x0020, 0, 0, titan_1284p2 }, + /* PCI_VENDOR_ID_AVLAB/Intek21 has another bunch of cards ...*/ + /* AFAVLAB_TK9902 */ + { 0x14db, 0x2120, PCI_ANY_ID, PCI_ANY_ID, 0, 0, avlab_1p}, +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index 9f1fec1..4c3a9e9 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -1078,6 +1078,8 @@ EXPORT_SYMBOL_GPL(pci_load_and_free_saved_state); + static int do_pci_enable_device(struct pci_dev *dev, int bars) + { + int err; ++ u16 cmd; ++ u8 pin; + + err = pci_set_power_state(dev, PCI_D0); + if (err < 0 && err != -EIO) +@@ -1087,6 +1089,17 @@ static int do_pci_enable_device(struct pci_dev *dev, int bars) + return err; + pci_fixup_device(pci_fixup_enable, dev); + ++ if (dev->msi_enabled || dev->msix_enabled) ++ return 0; ++ ++ pci_read_config_byte(dev, PCI_INTERRUPT_PIN, &pin); ++ if (pin) { ++ pci_read_config_word(dev, PCI_COMMAND, &cmd); ++ if (cmd & PCI_COMMAND_INTX_DISABLE) ++ pci_write_config_word(dev, PCI_COMMAND, ++ cmd & ~PCI_COMMAND_INTX_DISABLE); ++ } ++ + return 0; + } + +diff --git a/drivers/platform/x86/hp_accel.c b/drivers/platform/x86/hp_accel.c +index fdacfce..0076fea 100644 +--- a/drivers/platform/x86/hp_accel.c ++++ b/drivers/platform/x86/hp_accel.c +@@ -77,6 +77,7 @@ static inline void delayed_sysfs_set(struct led_classdev *led_cdev, + static struct acpi_device_id lis3lv02d_device_ids[] = { + {"HPQ0004", 0}, /* HP Mobile Data Protection System PNP */ + {"HPQ6000", 0}, /* HP Mobile Data Protection System PNP */ ++ {"HPQ6007", 0}, /* HP Mobile Data Protection System PNP */ + {"", 0}, + }; + MODULE_DEVICE_TABLE(acpi, lis3lv02d_device_ids); +diff --git a/drivers/power/max17040_battery.c b/drivers/power/max17040_battery.c +index 2f2f9a6..39d3697 100644 +--- a/drivers/power/max17040_battery.c ++++ b/drivers/power/max17040_battery.c +@@ -148,7 +148,7 @@ static void max17040_get_online(struct i2c_client *client) + { + struct max17040_chip *chip = i2c_get_clientdata(client); + +- if (chip->pdata->battery_online) ++ if (chip->pdata && chip->pdata->battery_online) + chip->online = chip->pdata->battery_online(); + else + chip->online = 1; +@@ -158,7 +158,8 @@ static void max17040_get_status(struct i2c_client *client) + { + struct max17040_chip *chip = i2c_get_clientdata(client); + +- if (!chip->pdata->charger_online || !chip->pdata->charger_enable) { ++ if (!chip->pdata || !chip->pdata->charger_online ++ || !chip->pdata->charger_enable) { + chip->status = POWER_SUPPLY_STATUS_UNKNOWN; + return; + } +diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c +index e3eed18..cae8985 100644 +--- a/drivers/rtc/rtc-cmos.c ++++ b/drivers/rtc/rtc-cmos.c +@@ -34,11 +34,11 @@ + #include <linux/interrupt.h> + #include <linux/spinlock.h> + #include <linux/platform_device.h> +-#include <linux/mod_devicetable.h> + #include <linux/log2.h> + #include <linux/pm.h> + #include <linux/of.h> + #include <linux/of_platform.h> ++#include <linux/dmi.h> + + /* this is for "generic access to PC-style RTC" using CMOS_READ/CMOS_WRITE */ + #include <asm-generic/rtc.h> +@@ -377,6 +377,51 @@ static int cmos_set_alarm(struct device *dev, struct rtc_wkalrm *t) + return 0; + } + ++/* ++ * Do not disable RTC alarm on shutdown - workaround for b0rked BIOSes. ++ */ ++static bool alarm_disable_quirk; ++ ++static int __init set_alarm_disable_quirk(const struct dmi_system_id *id) ++{ ++ alarm_disable_quirk = true; ++ pr_info("rtc-cmos: BIOS has alarm-disable quirk. "); ++ pr_info("RTC alarms disabled\n"); ++ return 0; ++} ++ ++static const struct dmi_system_id rtc_quirks[] __initconst = { ++ /* https://bugzilla.novell.com/show_bug.cgi?id=805740 */ ++ { ++ .callback = set_alarm_disable_quirk, ++ .ident = "IBM Truman", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "4852570"), ++ }, ++ }, ++ /* https://bugzilla.novell.com/show_bug.cgi?id=812592 */ ++ { ++ .callback = set_alarm_disable_quirk, ++ .ident = "Gigabyte GA-990XA-UD3", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, ++ "Gigabyte Technology Co., Ltd."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "GA-990XA-UD3"), ++ }, ++ }, ++ /* http://permalink.gmane.org/gmane.linux.kernel/1604474 */ ++ { ++ .callback = set_alarm_disable_quirk, ++ .ident = "Toshiba Satellite L300", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Satellite L300"), ++ }, ++ }, ++ {} ++}; ++ + static int cmos_alarm_irq_enable(struct device *dev, unsigned int enabled) + { + struct cmos_rtc *cmos = dev_get_drvdata(dev); +@@ -385,6 +430,9 @@ static int cmos_alarm_irq_enable(struct device *dev, unsigned int enabled) + if (!is_valid_irq(cmos->irq)) + return -EINVAL; + ++ if (alarm_disable_quirk) ++ return 0; ++ + spin_lock_irqsave(&rtc_lock, flags); + + if (enabled) +@@ -1166,6 +1214,8 @@ static int __init cmos_init(void) + platform_driver_registered = true; + } + ++ dmi_check_system(rtc_quirks); ++ + if (retval == 0) + return 0; + +diff --git a/drivers/scsi/bfa/bfad.c b/drivers/scsi/bfa/bfad.c +index 66fb725..633048b 100644 +--- a/drivers/scsi/bfa/bfad.c ++++ b/drivers/scsi/bfa/bfad.c +@@ -1613,7 +1613,7 @@ out: + static u32 * + bfad_load_fwimg(struct pci_dev *pdev) + { +- if (pdev->device == BFA_PCI_DEVICE_ID_CT2) { ++ if (bfa_asic_id_ct2(pdev->device)) { + if (bfi_image_ct2_size == 0) + bfad_read_firmware(pdev, &bfi_image_ct2, + &bfi_image_ct2_size, BFAD_FW_FILE_CT2); +@@ -1623,12 +1623,14 @@ bfad_load_fwimg(struct pci_dev *pdev) + bfad_read_firmware(pdev, &bfi_image_ct, + &bfi_image_ct_size, BFAD_FW_FILE_CT); + return bfi_image_ct; +- } else { ++ } else if (bfa_asic_id_cb(pdev->device)) { + if (bfi_image_cb_size == 0) + bfad_read_firmware(pdev, &bfi_image_cb, + &bfi_image_cb_size, BFAD_FW_FILE_CB); + return bfi_image_cb; + } ++ ++ return NULL; + } + + static void +diff --git a/drivers/scsi/isci/host.h b/drivers/scsi/isci/host.h +index 646051a..ef84778 100644 +--- a/drivers/scsi/isci/host.h ++++ b/drivers/scsi/isci/host.h +@@ -309,9 +309,8 @@ static inline struct isci_pci_info *to_pci_info(struct pci_dev *pdev) + } + + #define for_each_isci_host(id, ihost, pdev) \ +- for (id = 0, ihost = to_pci_info(pdev)->hosts[id]; \ +- id < ARRAY_SIZE(to_pci_info(pdev)->hosts) && ihost; \ +- ihost = to_pci_info(pdev)->hosts[++id]) ++ for (id = 0; id < SCI_MAX_CONTROLLERS && \ ++ (ihost = to_pci_info(pdev)->hosts[id]); id++) + + static inline enum isci_status isci_host_get_state(struct isci_host *isci_host) + { +diff --git a/drivers/scsi/isci/port_config.c b/drivers/scsi/isci/port_config.c +index 38a99d2..21a6769 100644 +--- a/drivers/scsi/isci/port_config.c ++++ b/drivers/scsi/isci/port_config.c +@@ -610,13 +610,6 @@ static void sci_apc_agent_link_up(struct isci_host *ihost, + sci_apc_agent_configure_ports(ihost, port_agent, iphy, true); + } else { + /* the phy is already the part of the port */ +- u32 port_state = iport->sm.current_state_id; +- +- /* if the PORT'S state is resetting then the link up is from +- * port hard reset in this case, we need to tell the port +- * that link up is recieved +- */ +- BUG_ON(port_state != SCI_PORT_RESETTING); + port_agent->phy_ready_mask |= 1 << phy_index; + sci_port_link_up(iport, iphy); + } +diff --git a/drivers/scsi/isci/task.c b/drivers/scsi/isci/task.c +index e294d11..60a530f 100644 +--- a/drivers/scsi/isci/task.c ++++ b/drivers/scsi/isci/task.c +@@ -1390,7 +1390,7 @@ int isci_task_I_T_nexus_reset(struct domain_device *dev) + spin_unlock_irqrestore(&ihost->scic_lock, flags); + + if (!idev || !test_bit(IDEV_EH, &idev->flags)) { +- ret = TMF_RESP_FUNC_COMPLETE; ++ ret = -ENODEV; + goto out; + } + +diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h +index fcf052c..c491a94 100644 +--- a/drivers/scsi/qla2xxx/qla_def.h ++++ b/drivers/scsi/qla2xxx/qla_def.h +@@ -2568,8 +2568,7 @@ struct qla_hw_data { + IS_QLA25XX(ha) || IS_QLA81XX(ha) || \ + IS_QLA82XX(ha)) + #define IS_MSIX_NACK_CAPABLE(ha) (IS_QLA81XX(ha)) +-#define IS_NOPOLLING_TYPE(ha) ((IS_QLA25XX(ha) || IS_QLA81XX(ha)) && \ +- (ha)->flags.msix_enabled) ++#define IS_NOPOLLING_TYPE(ha) (IS_QLA81XX(ha) && (ha)->flags.msix_enabled) + #define IS_FAC_REQUIRED(ha) (IS_QLA81XX(ha)) + #define IS_NOCACHE_VPD_TYPE(ha) (IS_QLA81XX(ha)) + #define IS_ALOGIO_CAPABLE(ha) (IS_QLA23XX(ha) || IS_FWI2_CAPABLE(ha)) +diff --git a/drivers/staging/comedi/drivers/adv_pci1710.c b/drivers/staging/comedi/drivers/adv_pci1710.c +index da2b75b..672538e 100644 +--- a/drivers/staging/comedi/drivers/adv_pci1710.c ++++ b/drivers/staging/comedi/drivers/adv_pci1710.c +@@ -414,6 +414,7 @@ static int pci171x_insn_write_ao(struct comedi_device *dev, + struct comedi_subdevice *s, + struct comedi_insn *insn, unsigned int *data) + { ++ unsigned int val; + int n, chan, range, ofs; + + chan = CR_CHAN(insn->chanspec); +@@ -429,11 +430,14 @@ static int pci171x_insn_write_ao(struct comedi_device *dev, + outw(devpriv->da_ranges, dev->iobase + PCI171x_DAREF); + ofs = PCI171x_DA1; + } ++ val = devpriv->ao_data[chan]; + +- for (n = 0; n < insn->n; n++) +- outw(data[n], dev->iobase + ofs); ++ for (n = 0; n < insn->n; n++) { ++ val = data[n]; ++ outw(val, dev->iobase + ofs); ++ } + +- devpriv->ao_data[chan] = data[n]; ++ devpriv->ao_data[chan] = val; + + return n; + +@@ -582,6 +586,7 @@ static int pci1720_insn_write_ao(struct comedi_device *dev, + struct comedi_subdevice *s, + struct comedi_insn *insn, unsigned int *data) + { ++ unsigned int val; + int n, rangereg, chan; + + chan = CR_CHAN(insn->chanspec); +@@ -591,13 +596,15 @@ static int pci1720_insn_write_ao(struct comedi_device *dev, + outb(rangereg, dev->iobase + PCI1720_RANGE); + devpriv->da_ranges = rangereg; + } ++ val = devpriv->ao_data[chan]; + + for (n = 0; n < insn->n; n++) { +- outw(data[n], dev->iobase + PCI1720_DA0 + (chan << 1)); ++ val = data[n]; ++ outw(val, dev->iobase + PCI1720_DA0 + (chan << 1)); + outb(0, dev->iobase + PCI1720_SYNCOUT); /* update outputs */ + } + +- devpriv->ao_data[chan] = data[n]; ++ devpriv->ao_data[chan] = val; + + return n; + } +diff --git a/drivers/staging/comedi/drivers/pcmuio.c b/drivers/staging/comedi/drivers/pcmuio.c +index b2c2c89..6c25bd3 100644 +--- a/drivers/staging/comedi/drivers/pcmuio.c ++++ b/drivers/staging/comedi/drivers/pcmuio.c +@@ -464,13 +464,13 @@ static int pcmuio_detach(struct comedi_device *dev) + if (dev->iobase) + release_region(dev->iobase, ASIC_IOSIZE * thisboard->num_asics); + +- for (i = 0; i < MAX_ASICS; ++i) { +- if (devpriv->asics[i].irq) +- free_irq(devpriv->asics[i].irq, dev); +- } +- +- if (devpriv && devpriv->sprivs) ++ if (devpriv) { ++ for (i = 0; i < MAX_ASICS; ++i) { ++ if (devpriv->asics[i].irq) ++ free_irq(devpriv->asics[i].irq, dev); ++ } + kfree(devpriv->sprivs); ++ } + + return 0; + } +diff --git a/drivers/staging/comedi/drivers/ssv_dnp.c b/drivers/staging/comedi/drivers/ssv_dnp.c +index 526de2e..0316780 100644 +--- a/drivers/staging/comedi/drivers/ssv_dnp.c ++++ b/drivers/staging/comedi/drivers/ssv_dnp.c +@@ -251,11 +251,11 @@ static int dnp_dio_insn_bits(struct comedi_device *dev, + + /* on return, data[1] contains the value of the digital input lines. */ + outb(PADR, CSCIR); +- data[0] = inb(CSCDR); ++ data[1] = inb(CSCDR); + outb(PBDR, CSCIR); +- data[0] += inb(CSCDR) << 8; ++ data[1] += inb(CSCDR) << 8; + outb(PCDR, CSCIR); +- data[0] += ((inb(CSCDR) & 0xF0) << 12); ++ data[1] += ((inb(CSCDR) & 0xF0) << 12); + + return 2; + +diff --git a/drivers/staging/iio/adc/ad799x_core.c b/drivers/staging/iio/adc/ad799x_core.c +index ee6cd79..f79d0cb 100644 +--- a/drivers/staging/iio/adc/ad799x_core.c ++++ b/drivers/staging/iio/adc/ad799x_core.c +@@ -873,7 +873,8 @@ static int __devinit ad799x_probe(struct i2c_client *client, + return 0; + + error_free_irq: +- free_irq(client->irq, indio_dev); ++ if (client->irq > 0) ++ free_irq(client->irq, indio_dev); + error_cleanup_ring: + ad799x_ring_cleanup(indio_dev); + error_disable_reg: +diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c +index 88d1d35..a74e83d 100644 +--- a/drivers/staging/rtl8712/usb_intf.c ++++ b/drivers/staging/rtl8712/usb_intf.c +@@ -363,6 +363,10 @@ static u8 key_2char2num(u8 hch, u8 lch) + return (hex_to_bin(hch) << 4) | hex_to_bin(lch); + } + ++static const struct device_type wlan_type = { ++ .name = "wlan", ++}; ++ + /* + * drv_init() - a device potentially for us + * +@@ -398,6 +402,7 @@ static int r871xu_drv_init(struct usb_interface *pusb_intf, + padapter->pusb_intf = pusb_intf; + usb_set_intfdata(pusb_intf, pnetdev); + SET_NETDEV_DEV(pnetdev, &pusb_intf->dev); ++ pnetdev->dev.type = &wlan_type; + /* step 2. */ + padapter->dvobj_init = &r8712_usb_dvobj_init; + padapter->dvobj_deinit = &r8712_usb_dvobj_deinit; +diff --git a/drivers/staging/vt6656/baseband.c b/drivers/staging/vt6656/baseband.c +index 0d11147..59cf674 100644 +--- a/drivers/staging/vt6656/baseband.c ++++ b/drivers/staging/vt6656/baseband.c +@@ -1656,7 +1656,6 @@ BBvUpdatePreEDThreshold( + + if( bScanning ) + { // need Max sensitivity //RSSI -69, -70,.... +- if(pDevice->byBBPreEDIndex == 0) break; + pDevice->byBBPreEDIndex = 0; + ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xC9, 0x00); //CR201(0xC9) + ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xCE, 0x30); //CR206(0xCE) +@@ -1799,7 +1798,6 @@ BBvUpdatePreEDThreshold( + + if( bScanning ) + { // need Max sensitivity //RSSI -69, -70, ... +- if(pDevice->byBBPreEDIndex == 0) break; + pDevice->byBBPreEDIndex = 0; + ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xC9, 0x00); //CR201(0xC9) + ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xCE, 0x24); //CR206(0xCE) +@@ -1951,7 +1949,6 @@ BBvUpdatePreEDThreshold( + case RF_VT3342A0: //RobertYu:20060627, testing table + if( bScanning ) + { // need Max sensitivity //RSSI -67, -68, ... +- if(pDevice->byBBPreEDIndex == 0) break; + pDevice->byBBPreEDIndex = 0; + ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xC9, 0x00); //CR201(0xC9) + ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xCE, 0x38); //CR206(0xCE) +diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c +index 45c13a6..4a88eea 100644 +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -50,7 +50,7 @@ + static LIST_HEAD(g_tiqn_list); + static LIST_HEAD(g_np_list); + static DEFINE_SPINLOCK(tiqn_lock); +-static DEFINE_SPINLOCK(np_lock); ++static DEFINE_MUTEX(np_lock); + + static struct idr tiqn_idr; + struct idr sess_idr; +@@ -262,6 +262,9 @@ int iscsit_deaccess_np(struct iscsi_np *np, struct iscsi_portal_group *tpg) + return 0; + } + ++/* ++ * Called with mutex np_lock held ++ */ + static struct iscsi_np *iscsit_get_np( + struct __kernel_sockaddr_storage *sockaddr, + int network_transport) +@@ -272,11 +275,10 @@ static struct iscsi_np *iscsit_get_np( + int ip_match = 0; + u16 port; + +- spin_lock_bh(&np_lock); + list_for_each_entry(np, &g_np_list, np_list) { +- spin_lock(&np->np_thread_lock); ++ spin_lock_bh(&np->np_thread_lock); + if (np->np_thread_state != ISCSI_NP_THREAD_ACTIVE) { +- spin_unlock(&np->np_thread_lock); ++ spin_unlock_bh(&np->np_thread_lock); + continue; + } + +@@ -309,13 +311,11 @@ static struct iscsi_np *iscsit_get_np( + * while iscsi_tpg_add_network_portal() is called. + */ + np->np_exports++; +- spin_unlock(&np->np_thread_lock); +- spin_unlock_bh(&np_lock); ++ spin_unlock_bh(&np->np_thread_lock); + return np; + } +- spin_unlock(&np->np_thread_lock); ++ spin_unlock_bh(&np->np_thread_lock); + } +- spin_unlock_bh(&np_lock); + + return NULL; + } +@@ -329,16 +329,22 @@ struct iscsi_np *iscsit_add_np( + struct sockaddr_in6 *sock_in6; + struct iscsi_np *np; + int ret; ++ ++ mutex_lock(&np_lock); ++ + /* + * Locate the existing struct iscsi_np if already active.. + */ + np = iscsit_get_np(sockaddr, network_transport); +- if (np) ++ if (np) { ++ mutex_unlock(&np_lock); + return np; ++ } + + np = kzalloc(sizeof(struct iscsi_np), GFP_KERNEL); + if (!np) { + pr_err("Unable to allocate memory for struct iscsi_np\n"); ++ mutex_unlock(&np_lock); + return ERR_PTR(-ENOMEM); + } + +@@ -361,6 +367,7 @@ struct iscsi_np *iscsit_add_np( + ret = iscsi_target_setup_login_socket(np, sockaddr); + if (ret != 0) { + kfree(np); ++ mutex_unlock(&np_lock); + return ERR_PTR(ret); + } + +@@ -369,6 +376,7 @@ struct iscsi_np *iscsit_add_np( + pr_err("Unable to create kthread: iscsi_np\n"); + ret = PTR_ERR(np->np_thread); + kfree(np); ++ mutex_unlock(&np_lock); + return ERR_PTR(ret); + } + /* +@@ -379,10 +387,10 @@ struct iscsi_np *iscsit_add_np( + * point because iscsi_np has not been added to g_np_list yet. + */ + np->np_exports = 1; ++ np->np_thread_state = ISCSI_NP_THREAD_ACTIVE; + +- spin_lock_bh(&np_lock); + list_add_tail(&np->np_list, &g_np_list); +- spin_unlock_bh(&np_lock); ++ mutex_unlock(&np_lock); + + pr_debug("CORE[0] - Added Network Portal: %s:%hu on %s\n", + np->np_ip, np->np_port, (np->np_network_transport == ISCSI_TCP) ? +@@ -453,9 +461,9 @@ int iscsit_del_np(struct iscsi_np *np) + } + iscsit_del_np_comm(np); + +- spin_lock_bh(&np_lock); ++ mutex_lock(&np_lock); + list_del(&np->np_list); +- spin_unlock_bh(&np_lock); ++ mutex_unlock(&np_lock); + + pr_debug("CORE[0] - Removed Network Portal: %s:%hu on %s\n", + np->np_ip, np->np_port, (np->np_network_transport == ISCSI_TCP) ? +diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c +index d190269..643a0a0 100644 +--- a/drivers/tty/n_gsm.c ++++ b/drivers/tty/n_gsm.c +@@ -1090,6 +1090,7 @@ static void gsm_control_modem(struct gsm_mux *gsm, u8 *data, int clen) + { + unsigned int addr = 0; + unsigned int modem = 0; ++ unsigned int brk = 0; + struct gsm_dlci *dlci; + int len = clen; + u8 *dp = data; +@@ -1116,6 +1117,16 @@ static void gsm_control_modem(struct gsm_mux *gsm, u8 *data, int clen) + if (len == 0) + return; + } ++ len--; ++ if (len > 0) { ++ while (gsm_read_ea(&brk, *dp++) == 0) { ++ len--; ++ if (len == 0) ++ return; ++ } ++ modem <<= 7; ++ modem |= (brk & 0x7f); ++ } + tty = tty_port_tty_get(&dlci->port); + gsm_process_modem(tty, dlci, modem, clen); + if (tty) { +diff --git a/drivers/tty/serial/8250.c b/drivers/tty/serial/8250.c +index cff03e5..33601f8 100644 +--- a/drivers/tty/serial/8250.c ++++ b/drivers/tty/serial/8250.c +@@ -2701,6 +2701,10 @@ static void serial8250_config_port(struct uart_port *port, int flags) + if (up->port.type == PORT_16550A && up->port.iotype == UPIO_AU) + up->bugs |= UART_BUG_NOMSR; + ++ /* HW bugs may trigger IRQ while IIR == NO_INT */ ++ if (up->port.type == PORT_TEGRA) ++ up->bugs |= UART_BUG_NOMSR; ++ + if (up->port.type != PORT_UNKNOWN && flags & UART_CONFIG_IRQ) + autoconfig_irq(up); + +diff --git a/drivers/tty/serial/8250_pci.c b/drivers/tty/serial/8250_pci.c +index 6c9bcdf..ef24e96 100644 +--- a/drivers/tty/serial/8250_pci.c ++++ b/drivers/tty/serial/8250_pci.c +@@ -1147,6 +1147,11 @@ pci_xr17c154_setup(struct serial_private *priv, + #define PCI_DEVICE_ID_TITAN_800E 0xA014 + #define PCI_DEVICE_ID_TITAN_200EI 0xA016 + #define PCI_DEVICE_ID_TITAN_200EISI 0xA017 ++#define PCI_DEVICE_ID_TITAN_200V3 0xA306 ++#define PCI_DEVICE_ID_TITAN_400V3 0xA310 ++#define PCI_DEVICE_ID_TITAN_410V3 0xA312 ++#define PCI_DEVICE_ID_TITAN_800V3 0xA314 ++#define PCI_DEVICE_ID_TITAN_800V3B 0xA315 + #define PCI_DEVICE_ID_OXSEMI_16PCI958 0x9538 + #define PCIE_DEVICE_ID_NEO_2_OX_IBM 0x00F6 + #define PCI_DEVICE_ID_PLX_CRONYX_OMEGA 0xc001 +@@ -3465,6 +3470,21 @@ static struct pci_device_id serial_pci_tbl[] = { + { PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_200EISI, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, + pbn_oxsemi_2_4000000 }, ++ { PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_200V3, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_b0_bt_2_921600 }, ++ { PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_400V3, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_b0_4_921600 }, ++ { PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_410V3, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_b0_4_921600 }, ++ { PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_800V3, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_b0_4_921600 }, ++ { PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_800V3B, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_b0_4_921600 }, + + { PCI_VENDOR_ID_SIIG, PCI_DEVICE_ID_SIIG_1S_10x_550, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, +diff --git a/drivers/tty/serial/pmac_zilog.c b/drivers/tty/serial/pmac_zilog.c +index 086f7fe..a6caf62 100644 +--- a/drivers/tty/serial/pmac_zilog.c ++++ b/drivers/tty/serial/pmac_zilog.c +@@ -2198,6 +2198,9 @@ static int __init pmz_console_init(void) + /* Probe ports */ + pmz_probe(); + ++ if (pmz_ports_count == 0) ++ return -ENODEV; ++ + /* TODO: Autoprobe console based on OF */ + /* pmz_console.index = i; */ + register_console(&pmz_console); +diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c +index 78609d3..1e3e211 100644 +--- a/drivers/usb/core/config.c ++++ b/drivers/usb/core/config.c +@@ -722,6 +722,10 @@ int usb_get_configuration(struct usb_device *dev) + result = -ENOMEM; + goto err; + } ++ ++ if (dev->quirks & USB_QUIRK_DELAY_INIT) ++ msleep(100); ++ + result = usb_get_descriptor(dev, USB_DT_CONFIG, cfgno, + bigbuffer, length); + if (result < 0) { +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index bcde6f6..3677d22 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -46,6 +46,10 @@ static const struct usb_device_id usb_quirk_list[] = { + /* Microsoft LifeCam-VX700 v2.0 */ + { USB_DEVICE(0x045e, 0x0770), .driver_info = USB_QUIRK_RESET_RESUME }, + ++ /* Logitech HD Pro Webcams C920 and C930e */ ++ { USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT }, ++ { USB_DEVICE(0x046d, 0x0843), .driver_info = USB_QUIRK_DELAY_INIT }, ++ + /* Logitech Quickcam Fusion */ + { USB_DEVICE(0x046d, 0x08c1), .driver_info = USB_QUIRK_RESET_RESUME }, + +diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c +index 339be10..2abdad6 100644 +--- a/drivers/usb/host/ehci-hcd.c ++++ b/drivers/usb/host/ehci-hcd.c +@@ -807,8 +807,15 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd) + struct ehci_hcd *ehci = hcd_to_ehci (hcd); + u32 status, masked_status, pcd_status = 0, cmd; + int bh; ++ unsigned long flags; + +- spin_lock (&ehci->lock); ++ /* ++ * For threadirqs option we use spin_lock_irqsave() variant to prevent ++ * deadlock with ehci hrtimer callback, because hrtimer callbacks run ++ * in interrupt context even when threadirqs is specified. We can go ++ * back to spin_lock() variant when hrtimer callbacks become threaded. ++ */ ++ spin_lock_irqsave(&ehci->lock, flags); + + status = ehci_readl(ehci, &ehci->regs->status); + +@@ -826,7 +833,7 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd) + + /* Shared IRQ? */ + if (!masked_status || unlikely(ehci->rh_state == EHCI_RH_HALTED)) { +- spin_unlock(&ehci->lock); ++ spin_unlock_irqrestore(&ehci->lock, flags); + return IRQ_NONE; + } + +@@ -929,7 +936,7 @@ dead: + + if (bh) + ehci_work (ehci); +- spin_unlock (&ehci->lock); ++ spin_unlock_irqrestore(&ehci->lock, flags); + if (pcd_status) + usb_hcd_poll_rh_status(hcd); + return IRQ_HANDLED; +diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c +index 77bbb23..4527b90 100644 +--- a/drivers/usb/host/ehci-hub.c ++++ b/drivers/usb/host/ehci-hub.c +@@ -207,6 +207,7 @@ static int ehci_bus_suspend (struct usb_hcd *hcd) + int port; + int mask; + int changed; ++ bool fs_idle_delay; + + ehci_dbg(ehci, "suspend root hub\n"); + +@@ -249,6 +250,7 @@ static int ehci_bus_suspend (struct usb_hcd *hcd) + ehci->bus_suspended = 0; + ehci->owned_ports = 0; + changed = 0; ++ fs_idle_delay = false; + port = HCS_N_PORTS(ehci->hcs_params); + while (port--) { + u32 __iomem *reg = &ehci->regs->port_status [port]; +@@ -279,16 +281,34 @@ static int ehci_bus_suspend (struct usb_hcd *hcd) + if (t1 != t2) { + ehci_vdbg (ehci, "port %d, %08x -> %08x\n", + port + 1, t1, t2); ++ /* ++ * On some controllers, Wake-On-Disconnect will ++ * generate false wakeup signals until the bus ++ * switches over to full-speed idle. For their ++ * sake, add a delay if we need one. ++ */ ++ if ((t2 & PORT_WKDISC_E) && ++ ehci_port_speed(ehci, t2) == ++ USB_PORT_STAT_HIGH_SPEED) ++ fs_idle_delay = true; + ehci_writel(ehci, t2, reg); + changed = 1; + } + } ++ spin_unlock_irq(&ehci->lock); ++ ++ if ((changed && ehci->has_hostpc) || fs_idle_delay) { ++ /* ++ * Wait for HCD to enter low-power mode or for the bus ++ * to switch to full-speed idle. ++ */ ++ usleep_range(5000, 5500); ++ } ++ ++ spin_lock_irq(&ehci->lock); + + if (changed && ehci->has_hostpc) { +- spin_unlock_irq(&ehci->lock); +- msleep(5); /* 5 ms for HCD to enter low-power mode */ + spin_lock_irq(&ehci->lock); +- + port = HCS_N_PORTS(ehci->hcs_params); + while (port--) { + u32 __iomem *hostpc_reg; +diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h +index 0a5fda7..b65912d 100644 +--- a/drivers/usb/host/ehci.h ++++ b/drivers/usb/host/ehci.h +@@ -147,6 +147,7 @@ struct ehci_hcd { /* one per controller */ + unsigned use_dummy_qh:1; /* AMD Frame List table quirk*/ + unsigned has_synopsys_hc_bug:1; /* Synopsys HC */ + unsigned frame_index_bug:1; /* MosChip (AKA NetMos) */ ++ unsigned imx28_write_fix:1; /* For Freescale i.MX28 */ + + /* required for usb32 quirk */ + #define OHCI_CTRL_HCFS (3 << 6) +@@ -654,6 +655,18 @@ static inline unsigned int ehci_readl(const struct ehci_hcd *ehci, + #endif + } + ++#ifdef CONFIG_SOC_IMX28 ++static inline void imx28_ehci_writel(const unsigned int val, ++ volatile __u32 __iomem *addr) ++{ ++ __asm__ ("swp %0, %0, [%1]" : : "r"(val), "r"(addr)); ++} ++#else ++static inline void imx28_ehci_writel(const unsigned int val, ++ volatile __u32 __iomem *addr) ++{ ++} ++#endif + static inline void ehci_writel(const struct ehci_hcd *ehci, + const unsigned int val, __u32 __iomem *regs) + { +@@ -662,7 +675,10 @@ static inline void ehci_writel(const struct ehci_hcd *ehci, + writel_be(val, regs) : + writel(val, regs); + #else +- writel(val, regs); ++ if (ehci->imx28_write_fix) ++ imx28_ehci_writel(val, regs); ++ else ++ writel(val, regs); + #endif + } + +diff --git a/drivers/usb/serial/cypress_m8.h b/drivers/usb/serial/cypress_m8.h +index b461311..ce13e61 100644 +--- a/drivers/usb/serial/cypress_m8.h ++++ b/drivers/usb/serial/cypress_m8.h +@@ -63,7 +63,7 @@ + #define UART_DSR 0x20 /* data set ready - flow control - device to host */ + #define CONTROL_RTS 0x10 /* request to send - flow control - host to device */ + #define UART_CTS 0x10 /* clear to send - flow control - device to host */ +-#define UART_RI 0x10 /* ring indicator - modem - device to host */ ++#define UART_RI 0x80 /* ring indicator - modem - device to host */ + #define UART_CD 0x40 /* carrier detect - modem - device to host */ + #define CYP_ERROR 0x08 /* received from input report - device to host */ + /* Note - the below has nothing to do with the "feature report" reset */ +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index 85504bb..5c97d9f 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -163,6 +163,7 @@ static struct usb_device_id id_table_combined [] = { + { USB_DEVICE(FTDI_VID, FTDI_CANUSB_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_CANDAPTER_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_NXTCAM_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_EV3CON_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_0_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_1_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_2_PID) }, +@@ -202,6 +203,8 @@ static struct usb_device_id id_table_combined [] = { + { USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_IOBOARD_PID) }, + { USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_MINI_IOBOARD_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_SPROG_II) }, ++ { USB_DEVICE(FTDI_VID, FTDI_TAGSYS_LP101_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_TAGSYS_P200X_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_LENZ_LIUSB_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_XF_632_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_XF_634_PID) }, +@@ -914,6 +917,9 @@ static struct usb_device_id id_table_combined [] = { + { USB_DEVICE(FTDI_VID, FTDI_LUMEL_PD12_PID) }, + /* Crucible Devices */ + { USB_DEVICE(FTDI_VID, FTDI_CT_COMET_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_Z3X_PID) }, ++ /* Cressi Devices */ ++ { USB_DEVICE(FTDI_VID, FTDI_CRESSI_PID) }, + { }, /* Optional parameter entry */ + { } /* Terminating entry */ + }; +@@ -2193,10 +2199,20 @@ static void ftdi_set_termios(struct tty_struct *tty, + } + + /* +- * All FTDI UART chips are limited to CS7/8. We won't pretend to ++ * All FTDI UART chips are limited to CS7/8. We shouldn't pretend to + * support CS5/6 and revert the CSIZE setting instead. ++ * ++ * CS5 however is used to control some smartcard readers which abuse ++ * this limitation to switch modes. Original FTDI chips fall back to ++ * eight data bits. ++ * ++ * TODO: Implement a quirk to only allow this with mentioned ++ * readers. One I know of (Argolis Smartreader V1) ++ * returns "USB smartcard server" as iInterface string. ++ * The vendor didn't bother with a custom VID/PID of ++ * course. + */ +- if ((C_CSIZE(tty) != CS8) && (C_CSIZE(tty) != CS7)) { ++ if (C_CSIZE(tty) == CS6) { + dev_warn(&port->dev, "requested CSIZE setting not supported\n"); + + termios->c_cflag &= ~CSIZE; +@@ -2243,6 +2259,9 @@ no_skip: + urb_value |= FTDI_SIO_SET_DATA_PARITY_NONE; + } + switch (cflag & CSIZE) { ++ case CS5: ++ dev_dbg(&port->dev, "Setting CS5 quirk\n"); ++ break; + case CS7: + urb_value |= 7; + dev_dbg(&port->dev, "Setting CS7\n"); +diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h +index 61685ed..71fe2de 100644 +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -50,6 +50,7 @@ + #define TI_XDS100V2_PID 0xa6d0 + + #define FTDI_NXTCAM_PID 0xABB8 /* NXTCam for Mindstorms NXT */ ++#define FTDI_EV3CON_PID 0xABB9 /* Mindstorms EV3 Console Adapter */ + + /* US Interface Navigator (http://www.usinterface.com/) */ + #define FTDI_USINT_CAT_PID 0xb810 /* Navigator CAT and 2nd PTT lines */ +@@ -363,6 +364,12 @@ + /* Sprog II (Andrew Crosland's SprogII DCC interface) */ + #define FTDI_SPROG_II 0xF0C8 + ++/* ++ * Two of the Tagsys RFID Readers ++ */ ++#define FTDI_TAGSYS_LP101_PID 0xF0E9 /* Tagsys L-P101 RFID*/ ++#define FTDI_TAGSYS_P200X_PID 0xF0EE /* Tagsys Medio P200x RFID*/ ++ + /* an infrared receiver for user access control with IR tags */ + #define FTDI_PIEGROUP_PID 0xF208 /* Product Id */ + +@@ -1307,3 +1314,15 @@ + * Manufacturer: Crucible Technologies + */ + #define FTDI_CT_COMET_PID 0x8e08 ++ ++/* ++ * Product: Z3X Box ++ * Manufacturer: Smart GSM Team ++ */ ++#define FTDI_Z3X_PID 0x0011 ++ ++/* ++ * Product: Cressi PC Interface ++ * Manufacturer: Cressi ++ */ ++#define FTDI_CRESSI_PID 0x87d0 +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index d6d0fb4..5f5047f 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -325,6 +325,9 @@ static void option_instat_callback(struct urb *urb); + * It seems to contain a Qualcomm QSC6240/6290 chipset */ + #define FOUR_G_SYSTEMS_PRODUCT_W14 0x9603 + ++/* iBall 3.5G connect wireless modem */ ++#define IBALL_3_5G_CONNECT 0x9605 ++ + /* Zoom */ + #define ZOOM_PRODUCT_4597 0x9607 + +@@ -1373,7 +1376,8 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1267, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1268, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1269, 0xff, 0xff, 0xff) }, +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1270, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1270, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&net_intf5_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1271, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1272, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1273, 0xff, 0xff, 0xff) }, +@@ -1461,6 +1465,17 @@ static const struct usb_device_id option_ids[] = { + .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0178, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffe9, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8b, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8c, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8d, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8e, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8f, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff90, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff91, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff92, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff93, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff94, 0xff, 0xff, 0xff) }, + + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710, 0xff, 0xff, 0xff) }, +@@ -1509,6 +1524,7 @@ static const struct usb_device_id option_ids[] = { + .driver_info = (kernel_ulong_t)&four_g_w14_blacklist + }, + { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) }, ++ { USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) }, + { USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) }, + /* Pirelli */ + { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_C100_1)}, +@@ -1530,7 +1546,8 @@ static const struct usb_device_id option_ids[] = { + /* Cinterion */ + { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_E) }, + { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_P) }, +- { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8) }, ++ { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8), ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX) }, + { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PLXX), + .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, +diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c +index e3936c1..7b29317 100644 +--- a/drivers/usb/serial/pl2303.c ++++ b/drivers/usb/serial/pl2303.c +@@ -153,6 +153,8 @@ struct pl2303_private { + u8 line_control; + u8 line_status; + enum pl2303_type type; ++ ++ u8 line_settings[7]; + }; + + static int pl2303_vendor_read(__u16 value, __u16 index, +@@ -266,10 +268,6 @@ static void pl2303_set_termios(struct tty_struct *tty, + + dbg("%s - port %d", __func__, port->number); + +- /* The PL2303 is reported to lose bytes if you change +- serial settings even to the same values as before. Thus +- we actually need to filter in this specific case */ +- + if (old_termios && !tty_termios_hw_change(tty->termios, old_termios)) + return; + +@@ -407,10 +405,29 @@ static void pl2303_set_termios(struct tty_struct *tty, + dbg("%s - parity = none", __func__); + } + +- i = usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0), +- SET_LINE_REQUEST, SET_LINE_REQUEST_TYPE, +- 0, 0, buf, 7, 100); +- dbg("0x21:0x20:0:0 %d", i); ++ /* ++ * Some PL2303 are known to lose bytes if you change serial settings ++ * even to the same values as before. Thus we actually need to filter ++ * in this specific case. ++ * ++ * Note that the tty_termios_hw_change check above is not sufficient ++ * as a previously requested baud rate may differ from the one ++ * actually used (and stored in old_termios). ++ * ++ * NOTE: No additional locking needed for line_settings as it is ++ * only used in set_termios, which is serialised against itself. ++ */ ++ if (!old_termios || memcmp(buf, priv->line_settings, 7)) { ++ i = usb_control_msg(serial->dev, ++ usb_sndctrlpipe(serial->dev, 0), ++ SET_LINE_REQUEST, SET_LINE_REQUEST_TYPE, ++ 0, 0, buf, 7, 100); ++ ++ dbg("0x21:0x20:0:0 %d", i); ++ ++ if (i == 7) ++ memcpy(priv->line_settings, buf, 7); ++ } + + /* change control lines if we are switching to or from B0 */ + spin_lock_irqsave(&priv->lock, flags); +diff --git a/drivers/usb/storage/Kconfig b/drivers/usb/storage/Kconfig +index 303c34b..3460ee8 100644 +--- a/drivers/usb/storage/Kconfig ++++ b/drivers/usb/storage/Kconfig +@@ -19,7 +19,9 @@ config USB_STORAGE + + This option depends on 'SCSI' support being enabled, but you + probably also need 'SCSI device support: SCSI disk support' +- (BLK_DEV_SD) for most USB storage devices. ++ (BLK_DEV_SD) for most USB storage devices. Some devices also ++ will require 'Probe all LUNs on each SCSI device' ++ (SCSI_MULTI_LUN). + + To compile this driver as a module, choose M here: the + module will be called usb-storage. +diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c +index 13b8bcd..eb660bb 100644 +--- a/drivers/usb/storage/scsiglue.c ++++ b/drivers/usb/storage/scsiglue.c +@@ -116,6 +116,10 @@ static int slave_alloc (struct scsi_device *sdev) + if (us->subclass == USB_SC_UFI) + sdev->sdev_target->pdt_1f_for_no_lun = 1; + ++ /* Tell the SCSI layer if we know there is more than one LUN */ ++ if (us->protocol == USB_PR_BULK && us->max_lun > 0) ++ sdev->sdev_bflags |= BLIST_FORCELUN; ++ + return 0; + } + +diff --git a/drivers/usb/storage/unusual_cypress.h b/drivers/usb/storage/unusual_cypress.h +index 65a6a75..82e8ed0 100644 +--- a/drivers/usb/storage/unusual_cypress.h ++++ b/drivers/usb/storage/unusual_cypress.h +@@ -31,7 +31,7 @@ UNUSUAL_DEV( 0x04b4, 0x6831, 0x0000, 0x9999, + "Cypress ISD-300LP", + USB_SC_CYP_ATACB, USB_PR_DEVICE, NULL, 0), + +-UNUSUAL_DEV( 0x14cd, 0x6116, 0x0000, 0x0219, ++UNUSUAL_DEV( 0x14cd, 0x6116, 0x0160, 0x0160, + "Super Top", + "USB 2.0 SATA BRIDGE", + USB_SC_CYP_ATACB, USB_PR_DEVICE, NULL, 0), +diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h +index 8a3b531..08711bc 100644 +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -226,6 +226,13 @@ UNUSUAL_DEV( 0x0421, 0x0495, 0x0370, 0x0370, + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_MAX_SECTORS_64 ), + ++/* Patch submitted by Mikhail Zolotaryov <lebon@lebon.org.ua> */ ++UNUSUAL_DEV( 0x0421, 0x06aa, 0x1110, 0x1110, ++ "Nokia", ++ "502", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_MAX_SECTORS_64 ), ++ + #ifdef NO_SDDR09 + UNUSUAL_DEV( 0x0436, 0x0005, 0x0100, 0x0100, + "Microtech", +@@ -1434,6 +1441,13 @@ UNUSUAL_DEV( 0x0f88, 0x042e, 0x0100, 0x0100, + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_FIX_CAPACITY ), + ++/* Reported by Moritz Moeller-Herrmann <moritz-kernel@moeller-herrmann.de> */ ++UNUSUAL_DEV( 0x0fca, 0x8004, 0x0201, 0x0201, ++ "Research In Motion", ++ "BlackBerry Bold 9000", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_MAX_SECTORS_64 ), ++ + /* Reported by Michael Stattmann <michael@stattmann.com> */ + UNUSUAL_DEV( 0x0fce, 0xd008, 0x0000, 0x0000, + "Sony Ericsson", +diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c +index 49eefdb..f63719a 100644 +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -6725,7 +6725,7 @@ out: + */ + if (root_dropped == false) + btrfs_add_dead_root(root); +- if (err) ++ if (err && err != -EAGAIN) + btrfs_std_error(root->fs_info, err); + return; + } +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index 1372634..622d322 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -56,7 +56,7 @@ + #include "inode-map.h" + + struct btrfs_iget_args { +- u64 ino; ++ struct btrfs_key *location; + struct btrfs_root *root; + }; + +@@ -3847,7 +3847,9 @@ again: + static int btrfs_init_locked_inode(struct inode *inode, void *p) + { + struct btrfs_iget_args *args = p; +- inode->i_ino = args->ino; ++ inode->i_ino = args->location->objectid; ++ memcpy(&BTRFS_I(inode)->location, args->location, ++ sizeof(*args->location)); + BTRFS_I(inode)->root = args->root; + btrfs_set_inode_space_info(args->root, inode); + return 0; +@@ -3856,20 +3858,20 @@ static int btrfs_init_locked_inode(struct inode *inode, void *p) + static int btrfs_find_actor(struct inode *inode, void *opaque) + { + struct btrfs_iget_args *args = opaque; +- return args->ino == btrfs_ino(inode) && ++ return args->location->objectid == BTRFS_I(inode)->location.objectid && + args->root == BTRFS_I(inode)->root; + } + + static struct inode *btrfs_iget_locked(struct super_block *s, +- u64 objectid, ++ struct btrfs_key *location, + struct btrfs_root *root) + { + struct inode *inode; + struct btrfs_iget_args args; +- args.ino = objectid; ++ args.location = location; + args.root = root; + +- inode = iget5_locked(s, objectid, btrfs_find_actor, ++ inode = iget5_locked(s, location->objectid, btrfs_find_actor, + btrfs_init_locked_inode, + (void *)&args); + return inode; +@@ -3883,13 +3885,11 @@ struct inode *btrfs_iget(struct super_block *s, struct btrfs_key *location, + { + struct inode *inode; + +- inode = btrfs_iget_locked(s, location->objectid, root); ++ inode = btrfs_iget_locked(s, location, root); + if (!inode) + return ERR_PTR(-ENOMEM); + + if (inode->i_state & I_NEW) { +- BTRFS_I(inode)->root = root; +- memcpy(&BTRFS_I(inode)->location, location, sizeof(*location)); + btrfs_read_locked_inode(inode); + if (!is_bad_inode(inode)) { + inode_tree_add(inode); +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index 618ae6f..7cbe2f8 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -1327,12 +1327,17 @@ static noinline int btrfs_ioctl_snap_create_transid(struct file *file, + printk(KERN_INFO "btrfs: Snapshot src from " + "another FS\n"); + ret = -EINVAL; +- fput(src_file); +- goto out; ++ } else if (!inode_owner_or_capable(src_inode)) { ++ /* ++ * Subvolume creation is not restricted, but snapshots ++ * are limited to own subvolumes only ++ */ ++ ret = -EPERM; ++ } else { ++ ret = btrfs_mksubvol(&file->f_path, name, namelen, ++ BTRFS_I(src_inode)->root, ++ transid, readonly); + } +- ret = btrfs_mksubvol(&file->f_path, name, namelen, +- BTRFS_I(src_inode)->root, +- transid, readonly); + fput(src_file); + } + out: +diff --git a/fs/buffer.c b/fs/buffer.c +index 19a4f0b..5f4bde2 100644 +--- a/fs/buffer.c ++++ b/fs/buffer.c +@@ -663,14 +663,16 @@ EXPORT_SYMBOL(mark_buffer_dirty_inode); + static void __set_page_dirty(struct page *page, + struct address_space *mapping, int warn) + { +- spin_lock_irq(&mapping->tree_lock); ++ unsigned long flags; ++ ++ spin_lock_irqsave(&mapping->tree_lock, flags); + if (page->mapping) { /* Race with truncate? */ + WARN_ON_ONCE(warn && !PageUptodate(page)); + account_page_dirtied(page, mapping); + radix_tree_tag_set(&mapping->page_tree, + page_index(page), PAGECACHE_TAG_DIRTY); + } +- spin_unlock_irq(&mapping->tree_lock); ++ spin_unlock_irqrestore(&mapping->tree_lock, flags); + __mark_inode_dirty(mapping->host, I_DIRTY_PAGES); + } + +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index 56c152d..49d6e21 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -1113,7 +1113,8 @@ cifs_parse_mount_options(const char *mountdata, const char *devname, + cERROR(1, "Krb5 cifs privacy not supported"); + goto cifs_parse_mount_err; + } else if (strnicmp(value, "krb5", 4) == 0) { +- vol->secFlg |= CIFSSEC_MAY_KRB5; ++ vol->secFlg |= CIFSSEC_MAY_KRB5 | ++ CIFSSEC_MAY_SIGN; + } else if (strnicmp(value, "ntlmsspi", 8) == 0) { + vol->secFlg |= CIFSSEC_MAY_NTLMSSP | + CIFSSEC_MUST_SIGN; +diff --git a/fs/exofs/ore.c b/fs/exofs/ore.c +index 26bb512..df4a10f 100644 +--- a/fs/exofs/ore.c ++++ b/fs/exofs/ore.c +@@ -103,7 +103,7 @@ int ore_verify_layout(unsigned total_comps, struct ore_layout *layout) + + layout->max_io_length = + (BIO_MAX_PAGES_KMALLOC * PAGE_SIZE - layout->stripe_unit) * +- layout->group_width; ++ (layout->group_width - layout->parity); + if (layout->parity) { + unsigned stripe_length = + (layout->group_width - layout->parity) * +@@ -286,7 +286,8 @@ int ore_get_rw_state(struct ore_layout *layout, struct ore_components *oc, + if (length) { + ore_calc_stripe_info(layout, offset, length, &ios->si); + ios->length = ios->si.length; +- ios->nr_pages = (ios->length + PAGE_SIZE - 1) / PAGE_SIZE; ++ ios->nr_pages = ((ios->offset & (PAGE_SIZE - 1)) + ++ ios->length + PAGE_SIZE - 1) / PAGE_SIZE; + if (layout->parity) + _ore_post_alloc_raid_stuff(ios); + } +@@ -536,6 +537,7 @@ void ore_calc_stripe_info(struct ore_layout *layout, u64 file_offset, + u64 H = LmodS - G * T; + + u32 N = div_u64(H, U); ++ u32 Nlast; + + /* "H - (N * U)" is just "H % U" so it's bound to u32 */ + u32 C = (u32)(H - (N * U)) / stripe_unit + G * group_width; +@@ -568,6 +570,10 @@ void ore_calc_stripe_info(struct ore_layout *layout, u64 file_offset, + si->length = T - H; + if (si->length > length) + si->length = length; ++ ++ Nlast = div_u64(H + si->length + U - 1, U); ++ si->maxdevUnits = Nlast - N; ++ + si->M = M; + } + EXPORT_SYMBOL(ore_calc_stripe_info); +@@ -583,13 +589,16 @@ int _ore_add_stripe_unit(struct ore_io_state *ios, unsigned *cur_pg, + int ret; + + if (per_dev->bio == NULL) { +- unsigned pages_in_stripe = ios->layout->group_width * +- (ios->layout->stripe_unit / PAGE_SIZE); +- unsigned nr_pages = ios->nr_pages * ios->layout->group_width / +- (ios->layout->group_width - +- ios->layout->parity); +- unsigned bio_size = (nr_pages + pages_in_stripe) / +- ios->layout->group_width; ++ unsigned bio_size; ++ ++ if (!ios->reading) { ++ bio_size = ios->si.maxdevUnits; ++ } else { ++ bio_size = (ios->si.maxdevUnits + 1) * ++ (ios->layout->group_width - ios->layout->parity) / ++ ios->layout->group_width; ++ } ++ bio_size *= (ios->layout->stripe_unit / PAGE_SIZE); + + per_dev->bio = bio_kmalloc(GFP_KERNEL, bio_size); + if (unlikely(!per_dev->bio)) { +@@ -609,8 +618,12 @@ int _ore_add_stripe_unit(struct ore_io_state *ios, unsigned *cur_pg, + added_len = bio_add_pc_page(q, per_dev->bio, pages[pg], + pglen, pgbase); + if (unlikely(pglen != added_len)) { +- ORE_DBGMSG("Failed bio_add_pc_page bi_vcnt=%u\n", +- per_dev->bio->bi_vcnt); ++ /* If bi_vcnt == bi_max then this is a SW BUG */ ++ ORE_DBGMSG("Failed bio_add_pc_page bi_vcnt=0x%x " ++ "bi_max=0x%x BIO_MAX=0x%x cur_len=0x%x\n", ++ per_dev->bio->bi_vcnt, ++ per_dev->bio->bi_max_vecs, ++ BIO_MAX_PAGES_KMALLOC, cur_len); + ret = -ENOMEM; + goto out; + } +@@ -1099,7 +1112,7 @@ int ore_truncate(struct ore_layout *layout, struct ore_components *oc, + size_attr->attr = g_attr_logical_length; + size_attr->attr.val_ptr = &size_attr->newsize; + +- ORE_DBGMSG("trunc(0x%llx) obj_offset=0x%llx dev=%d\n", ++ ORE_DBGMSG2("trunc(0x%llx) obj_offset=0x%llx dev=%d\n", + _LLU(oc->comps->obj.id), _LLU(obj_size), i); + ret = _truncate_mirrors(ios, i * ios->layout->mirrors_p1, + &size_attr->attr); +diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h +index 68b1602..40f4d06 100644 +--- a/fs/ext4/ext4.h ++++ b/fs/ext4/ext4.h +@@ -745,6 +745,8 @@ do { \ + if (EXT4_FITS_IN_INODE(raw_inode, einode, xtime)) \ + (einode)->xtime.tv_sec = \ + (signed)le32_to_cpu((raw_inode)->xtime); \ ++ else \ ++ (einode)->xtime.tv_sec = 0; \ + if (EXT4_FITS_IN_INODE(raw_inode, einode, xtime ## _extra)) \ + ext4_decode_extra_time(&(einode)->xtime, \ + raw_inode->xtime ## _extra); \ +diff --git a/fs/file.c b/fs/file.c +index 4c6992d..30bfc99 100644 +--- a/fs/file.c ++++ b/fs/file.c +@@ -47,7 +47,7 @@ static void *alloc_fdmem(unsigned int size) + * vmalloc() if the allocation size will be considered "large" by the VM. + */ + if (size <= (PAGE_SIZE << PAGE_ALLOC_COSTLY_ORDER)) { +- void *data = kmalloc(size, GFP_KERNEL|__GFP_NOWARN); ++ void *data = kmalloc(size, GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY); + if (data != NULL) + return data; + } +diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c +index 5c029fb..cf0098d 100644 +--- a/fs/fuse/dev.c ++++ b/fs/fuse/dev.c +@@ -1199,22 +1199,6 @@ static ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov, + return fuse_dev_do_read(fc, file, &cs, iov_length(iov, nr_segs)); + } + +-static int fuse_dev_pipe_buf_steal(struct pipe_inode_info *pipe, +- struct pipe_buffer *buf) +-{ +- return 1; +-} +- +-static const struct pipe_buf_operations fuse_dev_pipe_buf_ops = { +- .can_merge = 0, +- .map = generic_pipe_buf_map, +- .unmap = generic_pipe_buf_unmap, +- .confirm = generic_pipe_buf_confirm, +- .release = generic_pipe_buf_release, +- .steal = fuse_dev_pipe_buf_steal, +- .get = generic_pipe_buf_get, +-}; +- + static ssize_t fuse_dev_splice_read(struct file *in, loff_t *ppos, + struct pipe_inode_info *pipe, + size_t len, unsigned int flags) +@@ -1261,7 +1245,11 @@ static ssize_t fuse_dev_splice_read(struct file *in, loff_t *ppos, + buf->page = bufs[page_nr].page; + buf->offset = bufs[page_nr].offset; + buf->len = bufs[page_nr].len; +- buf->ops = &fuse_dev_pipe_buf_ops; ++ /* ++ * Need to be careful about this. Having buf->ops in module ++ * code can Oops if the buffer persists after module unload. ++ */ ++ buf->ops = &nosteal_pipe_buf_ops; + + pipe->nrbufs++; + page_nr++; +diff --git a/fs/hpfs/alloc.c b/fs/hpfs/alloc.c +index 7a5eb2c..e0d57c0 100644 +--- a/fs/hpfs/alloc.c ++++ b/fs/hpfs/alloc.c +@@ -8,6 +8,58 @@ + + #include "hpfs_fn.h" + ++static void hpfs_claim_alloc(struct super_block *s, secno sec) ++{ ++ struct hpfs_sb_info *sbi = hpfs_sb(s); ++ if (sbi->sb_n_free != (unsigned)-1) { ++ if (unlikely(!sbi->sb_n_free)) { ++ hpfs_error(s, "free count underflow, allocating sector %08x", sec); ++ sbi->sb_n_free = -1; ++ return; ++ } ++ sbi->sb_n_free--; ++ } ++} ++ ++static void hpfs_claim_free(struct super_block *s, secno sec) ++{ ++ struct hpfs_sb_info *sbi = hpfs_sb(s); ++ if (sbi->sb_n_free != (unsigned)-1) { ++ if (unlikely(sbi->sb_n_free >= sbi->sb_fs_size)) { ++ hpfs_error(s, "free count overflow, freeing sector %08x", sec); ++ sbi->sb_n_free = -1; ++ return; ++ } ++ sbi->sb_n_free++; ++ } ++} ++ ++static void hpfs_claim_dirband_alloc(struct super_block *s, secno sec) ++{ ++ struct hpfs_sb_info *sbi = hpfs_sb(s); ++ if (sbi->sb_n_free_dnodes != (unsigned)-1) { ++ if (unlikely(!sbi->sb_n_free_dnodes)) { ++ hpfs_error(s, "dirband free count underflow, allocating sector %08x", sec); ++ sbi->sb_n_free_dnodes = -1; ++ return; ++ } ++ sbi->sb_n_free_dnodes--; ++ } ++} ++ ++static void hpfs_claim_dirband_free(struct super_block *s, secno sec) ++{ ++ struct hpfs_sb_info *sbi = hpfs_sb(s); ++ if (sbi->sb_n_free_dnodes != (unsigned)-1) { ++ if (unlikely(sbi->sb_n_free_dnodes >= sbi->sb_dirband_size / 4)) { ++ hpfs_error(s, "dirband free count overflow, freeing sector %08x", sec); ++ sbi->sb_n_free_dnodes = -1; ++ return; ++ } ++ sbi->sb_n_free_dnodes++; ++ } ++} ++ + /* + * Check if a sector is allocated in bitmap + * This is really slow. Turned on only if chk==2 +@@ -203,9 +255,15 @@ secno hpfs_alloc_sector(struct super_block *s, secno near, unsigned n, int forwa + } + sec = 0; + ret: ++ if (sec) { ++ i = 0; ++ do ++ hpfs_claim_alloc(s, sec + i); ++ while (unlikely(++i < n)); ++ } + if (sec && f_p) { + for (i = 0; i < forward; i++) { +- if (!hpfs_alloc_if_possible(s, sec + i + 1)) { ++ if (!hpfs_alloc_if_possible(s, sec + n + i)) { + hpfs_error(s, "Prealloc doesn't work! Wanted %d, allocated at %08x, can't allocate %d", forward, sec, i); + sec = 0; + break; +@@ -228,6 +286,7 @@ static secno alloc_in_dirband(struct super_block *s, secno near) + nr >>= 2; + sec = alloc_in_bmp(s, (~0x3fff) | nr, 1, 0); + if (!sec) return 0; ++ hpfs_claim_dirband_alloc(s, sec); + return ((sec & 0x3fff) << 2) + sbi->sb_dirband_start; + } + +@@ -242,6 +301,7 @@ int hpfs_alloc_if_possible(struct super_block *s, secno sec) + bmp[(sec & 0x3fff) >> 5] &= cpu_to_le32(~(1 << (sec & 0x1f))); + hpfs_mark_4buffers_dirty(&qbh); + hpfs_brelse4(&qbh); ++ hpfs_claim_alloc(s, sec); + return 1; + } + hpfs_brelse4(&qbh); +@@ -275,6 +335,7 @@ void hpfs_free_sectors(struct super_block *s, secno sec, unsigned n) + return; + } + bmp[(sec & 0x3fff) >> 5] |= cpu_to_le32(1 << (sec & 0x1f)); ++ hpfs_claim_free(s, sec); + if (!--n) { + hpfs_mark_4buffers_dirty(&qbh); + hpfs_brelse4(&qbh); +@@ -359,6 +420,7 @@ void hpfs_free_dnode(struct super_block *s, dnode_secno dno) + bmp[ssec >> 5] |= cpu_to_le32(1 << (ssec & 0x1f)); + hpfs_mark_4buffers_dirty(&qbh); + hpfs_brelse4(&qbh); ++ hpfs_claim_dirband_free(s, dno); + } + } + +@@ -366,7 +428,7 @@ struct dnode *hpfs_alloc_dnode(struct super_block *s, secno near, + dnode_secno *dno, struct quad_buffer_head *qbh) + { + struct dnode *d; +- if (hpfs_count_one_bitmap(s, hpfs_sb(s)->sb_dmap) > FREE_DNODES_ADD) { ++ if (hpfs_get_free_dnodes(s) > FREE_DNODES_ADD) { + if (!(*dno = alloc_in_dirband(s, near))) + if (!(*dno = hpfs_alloc_sector(s, near, 4, 0))) return NULL; + } else { +diff --git a/fs/hpfs/dir.c b/fs/hpfs/dir.c +index 2fa0089..46549c7 100644 +--- a/fs/hpfs/dir.c ++++ b/fs/hpfs/dir.c +@@ -33,25 +33,27 @@ static loff_t hpfs_dir_lseek(struct file *filp, loff_t off, int whence) + if (whence == SEEK_DATA || whence == SEEK_HOLE) + return -EINVAL; + ++ mutex_lock(&i->i_mutex); + hpfs_lock(s); + + /*printk("dir lseek\n");*/ + if (new_off == 0 || new_off == 1 || new_off == 11 || new_off == 12 || new_off == 13) goto ok; +- mutex_lock(&i->i_mutex); + pos = ((loff_t) hpfs_de_as_down_as_possible(s, hpfs_inode->i_dno) << 4) + 1; + while (pos != new_off) { + if (map_pos_dirent(i, &pos, &qbh)) hpfs_brelse4(&qbh); + else goto fail; + if (pos == 12) goto fail; + } +- mutex_unlock(&i->i_mutex); ++ hpfs_add_pos(i, &filp->f_pos); + ok: ++ filp->f_pos = new_off; + hpfs_unlock(s); +- return filp->f_pos = new_off; +-fail: + mutex_unlock(&i->i_mutex); ++ return new_off; ++fail: + /*printk("illegal lseek: %016llx\n", new_off);*/ + hpfs_unlock(s); ++ mutex_unlock(&i->i_mutex); + return -ESPIPE; + } + +diff --git a/fs/hpfs/hpfs_fn.h b/fs/hpfs/hpfs_fn.h +index de94617..f1f2ca7 100644 +--- a/fs/hpfs/hpfs_fn.h ++++ b/fs/hpfs/hpfs_fn.h +@@ -314,7 +314,7 @@ static inline struct hpfs_sb_info *hpfs_sb(struct super_block *sb) + __printf(2, 3) + void hpfs_error(struct super_block *, const char *, ...); + int hpfs_stop_cycles(struct super_block *, int, int *, int *, char *); +-unsigned hpfs_count_one_bitmap(struct super_block *, secno); ++unsigned hpfs_get_free_dnodes(struct super_block *); + + /* + * local time (HPFS) to GMT (Unix) +diff --git a/fs/hpfs/super.c b/fs/hpfs/super.c +index f760c15..b03e766 100644 +--- a/fs/hpfs/super.c ++++ b/fs/hpfs/super.c +@@ -115,7 +115,7 @@ static void hpfs_put_super(struct super_block *s) + kfree(sbi); + } + +-unsigned hpfs_count_one_bitmap(struct super_block *s, secno secno) ++static unsigned hpfs_count_one_bitmap(struct super_block *s, secno secno) + { + struct quad_buffer_head qbh; + unsigned long *bits; +@@ -123,7 +123,7 @@ unsigned hpfs_count_one_bitmap(struct super_block *s, secno secno) + + bits = hpfs_map_4sectors(s, secno, &qbh, 4); + if (!bits) +- return 0; ++ return (unsigned)-1; + count = bitmap_weight(bits, 2048 * BITS_PER_BYTE); + hpfs_brelse4(&qbh); + return count; +@@ -134,29 +134,45 @@ static unsigned count_bitmaps(struct super_block *s) + unsigned n, count, n_bands; + n_bands = (hpfs_sb(s)->sb_fs_size + 0x3fff) >> 14; + count = 0; +- for (n = 0; n < n_bands; n++) +- count += hpfs_count_one_bitmap(s, le32_to_cpu(hpfs_sb(s)->sb_bmp_dir[n])); ++ for (n = 0; n < n_bands; n++) { ++ unsigned c; ++ c = hpfs_count_one_bitmap(s, le32_to_cpu(hpfs_sb(s)->sb_bmp_dir[n])); ++ if (c != (unsigned)-1) ++ count += c; ++ } + return count; + } + ++unsigned hpfs_get_free_dnodes(struct super_block *s) ++{ ++ struct hpfs_sb_info *sbi = hpfs_sb(s); ++ if (sbi->sb_n_free_dnodes == (unsigned)-1) { ++ unsigned c = hpfs_count_one_bitmap(s, sbi->sb_dmap); ++ if (c == (unsigned)-1) ++ return 0; ++ sbi->sb_n_free_dnodes = c; ++ } ++ return sbi->sb_n_free_dnodes; ++} ++ + static int hpfs_statfs(struct dentry *dentry, struct kstatfs *buf) + { + struct super_block *s = dentry->d_sb; + struct hpfs_sb_info *sbi = hpfs_sb(s); + u64 id = huge_encode_dev(s->s_bdev->bd_dev); ++ + hpfs_lock(s); + +- /*if (sbi->sb_n_free == -1) {*/ ++ if (sbi->sb_n_free == (unsigned)-1) + sbi->sb_n_free = count_bitmaps(s); +- sbi->sb_n_free_dnodes = hpfs_count_one_bitmap(s, sbi->sb_dmap); +- /*}*/ ++ + buf->f_type = s->s_magic; + buf->f_bsize = 512; + buf->f_blocks = sbi->sb_fs_size; + buf->f_bfree = sbi->sb_n_free; + buf->f_bavail = sbi->sb_n_free; + buf->f_files = sbi->sb_dirband_size / 4; +- buf->f_ffree = sbi->sb_n_free_dnodes; ++ buf->f_ffree = hpfs_get_free_dnodes(s); + buf->f_fsid.val[0] = (u32)id; + buf->f_fsid.val[1] = (u32)(id >> 32); + buf->f_namelen = 254; +diff --git a/fs/lockd/svclock.c b/fs/lockd/svclock.c +index cd8703d..cb7b186 100644 +--- a/fs/lockd/svclock.c ++++ b/fs/lockd/svclock.c +@@ -741,6 +741,7 @@ nlmsvc_grant_blocked(struct nlm_block *block) + struct nlm_file *file = block->b_file; + struct nlm_lock *lock = &block->b_call->a_args.lock; + int error; ++ loff_t fl_start, fl_end; + + dprintk("lockd: grant blocked lock %p\n", block); + +@@ -758,9 +759,16 @@ nlmsvc_grant_blocked(struct nlm_block *block) + } + + /* Try the lock operation again */ ++ /* vfs_lock_file() can mangle fl_start and fl_end, but we need ++ * them unchanged for the GRANT_MSG ++ */ + lock->fl.fl_flags |= FL_SLEEP; ++ fl_start = lock->fl.fl_start; ++ fl_end = lock->fl.fl_end; + error = vfs_lock_file(file->f_file, F_SETLK, &lock->fl, NULL); + lock->fl.fl_flags &= ~FL_SLEEP; ++ lock->fl.fl_start = fl_start; ++ lock->fl.fl_end = fl_end; + + switch (error) { + case 0: +diff --git a/fs/nfs/blocklayout/extents.c b/fs/nfs/blocklayout/extents.c +index 4e2ee99..bb15ccc 100644 +--- a/fs/nfs/blocklayout/extents.c ++++ b/fs/nfs/blocklayout/extents.c +@@ -44,7 +44,7 @@ + static inline sector_t normalize(sector_t s, int base) + { + sector_t tmp = s; /* Since do_div modifies its argument */ +- return s - do_div(tmp, base); ++ return s - sector_div(tmp, base); + } + + static inline sector_t normalize_up(sector_t s, int base) +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 3d02931..5aea30a 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -6197,7 +6197,7 @@ nfs41_proc_secinfo_no_name(struct nfs_server *server, struct nfs_fh *fhandle, + switch (err) { + case 0: + case -NFS4ERR_WRONGSEC: +- case -NFS4ERR_NOTSUPP: ++ case -ENOTSUPP: + goto out; + default: + err = nfs4_handle_exception(server, err, &exception); +@@ -6229,7 +6229,7 @@ nfs41_find_root_sec(struct nfs_server *server, struct nfs_fh *fhandle, + * Fall back on "guess and check" method if + * the server doesn't support SECINFO_NO_NAME + */ +- if (err == -NFS4ERR_WRONGSEC || err == -NFS4ERR_NOTSUPP) { ++ if (err == -NFS4ERR_WRONGSEC || err == -ENOTSUPP) { + err = nfs4_find_root_sec(server, fhandle, info); + goto out_freepage; + } +diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c +index 00818c8..4479f66 100644 +--- a/fs/nfs/nfs4xdr.c ++++ b/fs/nfs/nfs4xdr.c +@@ -3056,7 +3056,8 @@ out_overflow: + return -EIO; + } + +-static int decode_op_hdr(struct xdr_stream *xdr, enum nfs_opnum4 expected) ++static bool __decode_op_hdr(struct xdr_stream *xdr, enum nfs_opnum4 expected, ++ int *nfs_retval) + { + __be32 *p; + uint32_t opnum; +@@ -3066,19 +3067,32 @@ static int decode_op_hdr(struct xdr_stream *xdr, enum nfs_opnum4 expected) + if (unlikely(!p)) + goto out_overflow; + opnum = be32_to_cpup(p++); +- if (opnum != expected) { +- dprintk("nfs: Server returned operation" +- " %d but we issued a request for %d\n", +- opnum, expected); +- return -EIO; +- } ++ if (unlikely(opnum != expected)) ++ goto out_bad_operation; + nfserr = be32_to_cpup(p); +- if (nfserr != NFS_OK) +- return nfs4_stat_to_errno(nfserr); +- return 0; ++ if (nfserr == NFS_OK) ++ *nfs_retval = 0; ++ else ++ *nfs_retval = nfs4_stat_to_errno(nfserr); ++ return true; ++out_bad_operation: ++ dprintk("nfs: Server returned operation" ++ " %d but we issued a request for %d\n", ++ opnum, expected); ++ *nfs_retval = -EREMOTEIO; ++ return false; + out_overflow: + print_overflow_msg(__func__, xdr); +- return -EIO; ++ *nfs_retval = -EIO; ++ return false; ++} ++ ++static int decode_op_hdr(struct xdr_stream *xdr, enum nfs_opnum4 expected) ++{ ++ int retval; ++ ++ __decode_op_hdr(xdr, expected, &retval); ++ return retval; + } + + /* Dummy routine */ +@@ -4744,11 +4758,12 @@ static int decode_open(struct xdr_stream *xdr, struct nfs_openres *res) + uint32_t savewords, bmlen, i; + int status; + +- status = decode_op_hdr(xdr, OP_OPEN); +- if (status != -EIO) +- nfs_increment_open_seqid(status, res->seqid); +- if (!status) +- status = decode_stateid(xdr, &res->stateid); ++ if (!__decode_op_hdr(xdr, OP_OPEN, &status)) ++ return status; ++ nfs_increment_open_seqid(status, res->seqid); ++ if (status) ++ return status; ++ status = decode_stateid(xdr, &res->stateid); + if (unlikely(status)) + return status; + +diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c +index 1c7d45e..d20d64c 100644 +--- a/fs/ocfs2/file.c ++++ b/fs/ocfs2/file.c +@@ -2389,8 +2389,8 @@ out_dio: + + if (((file->f_flags & O_DSYNC) && !direct_io) || IS_SYNC(inode) || + ((file->f_flags & O_DIRECT) && !direct_io)) { +- ret = filemap_fdatawrite_range(file->f_mapping, pos, +- pos + count - 1); ++ ret = filemap_fdatawrite_range(file->f_mapping, *ppos, ++ *ppos + count - 1); + if (ret < 0) + written = ret; + +@@ -2403,8 +2403,8 @@ out_dio: + } + + if (!ret) +- ret = filemap_fdatawait_range(file->f_mapping, pos, +- pos + count - 1); ++ ret = filemap_fdatawait_range(file->f_mapping, *ppos, ++ *ppos + count - 1); + } + + /* +diff --git a/fs/ocfs2/quota_global.c b/fs/ocfs2/quota_global.c +index 92fcd57..a40e5ce 100644 +--- a/fs/ocfs2/quota_global.c ++++ b/fs/ocfs2/quota_global.c +@@ -712,6 +712,12 @@ static int ocfs2_release_dquot(struct dquot *dquot) + */ + if (status < 0) + mlog_errno(status); ++ /* ++ * Clear dq_off so that we search for the structure in quota file next ++ * time we acquire it. The structure might be deleted and reallocated ++ * elsewhere by another node while our dquot structure is on freelist. ++ */ ++ dquot->dq_off = 0; + clear_bit(DQ_ACTIVE_B, &dquot->dq_flags); + out_trans: + ocfs2_commit_trans(osb, handle); +@@ -750,16 +756,17 @@ static int ocfs2_acquire_dquot(struct dquot *dquot) + status = ocfs2_lock_global_qf(info, 1); + if (status < 0) + goto out; +- if (!test_bit(DQ_READ_B, &dquot->dq_flags)) { +- status = ocfs2_qinfo_lock(info, 0); +- if (status < 0) +- goto out_dq; +- status = qtree_read_dquot(&info->dqi_gi, dquot); +- ocfs2_qinfo_unlock(info, 0); +- if (status < 0) +- goto out_dq; +- } +- set_bit(DQ_READ_B, &dquot->dq_flags); ++ status = ocfs2_qinfo_lock(info, 0); ++ if (status < 0) ++ goto out_dq; ++ /* ++ * We always want to read dquot structure from disk because we don't ++ * know what happened with it while it was on freelist. ++ */ ++ status = qtree_read_dquot(&info->dqi_gi, dquot); ++ ocfs2_qinfo_unlock(info, 0); ++ if (status < 0) ++ goto out_dq; + + OCFS2_DQUOT(dquot)->dq_use_count++; + OCFS2_DQUOT(dquot)->dq_origspace = dquot->dq_dqb.dqb_curspace; +diff --git a/fs/ocfs2/quota_local.c b/fs/ocfs2/quota_local.c +index f100bf7..b6cfcf2 100644 +--- a/fs/ocfs2/quota_local.c ++++ b/fs/ocfs2/quota_local.c +@@ -1300,10 +1300,6 @@ int ocfs2_local_release_dquot(handle_t *handle, struct dquot *dquot) + ocfs2_journal_dirty(handle, od->dq_chunk->qc_headerbh); + + out: +- /* Clear the read bit so that next time someone uses this +- * dquot he reads fresh info from disk and allocates local +- * dquot structure */ +- clear_bit(DQ_READ_B, &dquot->dq_flags); + return status; + } + +diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c +index 5b572c8..3d5d717 100644 +--- a/fs/quota/dquot.c ++++ b/fs/quota/dquot.c +@@ -580,9 +580,17 @@ int dquot_scan_active(struct super_block *sb, + dqstats_inc(DQST_LOOKUPS); + dqput(old_dquot); + old_dquot = dquot; +- ret = fn(dquot, priv); +- if (ret < 0) +- goto out; ++ /* ++ * ->release_dquot() can be racing with us. Our reference ++ * protects us from new calls to it so just wait for any ++ * outstanding call and recheck the DQ_ACTIVE_B after that. ++ */ ++ wait_on_dquot(dquot); ++ if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) { ++ ret = fn(dquot, priv); ++ if (ret < 0) ++ goto out; ++ } + spin_lock(&dq_list_lock); + /* We are safe to continue now because our dquot could not + * be moved out of the inuse list while we hold the reference */ +diff --git a/fs/splice.c b/fs/splice.c +index 58ab918..714471d 100644 +--- a/fs/splice.c ++++ b/fs/splice.c +@@ -554,6 +554,24 @@ static const struct pipe_buf_operations default_pipe_buf_ops = { + .get = generic_pipe_buf_get, + }; + ++static int generic_pipe_buf_nosteal(struct pipe_inode_info *pipe, ++ struct pipe_buffer *buf) ++{ ++ return 1; ++} ++ ++/* Pipe buffer operations for a socket and similar. */ ++const struct pipe_buf_operations nosteal_pipe_buf_ops = { ++ .can_merge = 0, ++ .map = generic_pipe_buf_map, ++ .unmap = generic_pipe_buf_unmap, ++ .confirm = generic_pipe_buf_confirm, ++ .release = generic_pipe_buf_release, ++ .steal = generic_pipe_buf_nosteal, ++ .get = generic_pipe_buf_get, ++}; ++EXPORT_SYMBOL(nosteal_pipe_buf_ops); ++ + static ssize_t kernel_readv(struct file *file, const struct iovec *vec, + unsigned long vlen, loff_t offset) + { +diff --git a/include/linux/compiler-gcc4.h b/include/linux/compiler-gcc4.h +index 643d6c4..e2a360a 100644 +--- a/include/linux/compiler-gcc4.h ++++ b/include/linux/compiler-gcc4.h +@@ -39,11 +39,7 @@ + * + * (asm goto is automatically volatile - the naming reflects this.) + */ +-#if GCC_VERSION <= 40801 +-# define asm_volatile_goto(x...) do { asm goto(x); asm (""); } while (0) +-#else +-# define asm_volatile_goto(x...) do { asm goto(x); } while (0) +-#endif ++#define asm_volatile_goto(x...) do { asm goto(x); asm (""); } while (0) + + #if __GNUC_MINOR__ >= 5 + /* +diff --git a/include/linux/jiffies.h b/include/linux/jiffies.h +index 265e2c3..f5df3dc 100644 +--- a/include/linux/jiffies.h ++++ b/include/linux/jiffies.h +@@ -106,13 +106,13 @@ static inline u64 get_jiffies_64(void) + #define time_after(a,b) \ + (typecheck(unsigned long, a) && \ + typecheck(unsigned long, b) && \ +- ((long)(b) - (long)(a) < 0)) ++ ((long)((b) - (a)) < 0)) + #define time_before(a,b) time_after(b,a) + + #define time_after_eq(a,b) \ + (typecheck(unsigned long, a) && \ + typecheck(unsigned long, b) && \ +- ((long)(a) - (long)(b) >= 0)) ++ ((long)((a) - (b)) >= 0)) + #define time_before_eq(a,b) time_after_eq(b,a) + + /* +@@ -135,13 +135,13 @@ static inline u64 get_jiffies_64(void) + #define time_after64(a,b) \ + (typecheck(__u64, a) && \ + typecheck(__u64, b) && \ +- ((__s64)(b) - (__s64)(a) < 0)) ++ ((__s64)((b) - (a)) < 0)) + #define time_before64(a,b) time_after64(b,a) + + #define time_after_eq64(a,b) \ + (typecheck(__u64, a) && \ + typecheck(__u64, b) && \ +- ((__s64)(a) - (__s64)(b) >= 0)) ++ ((__s64)((a) - (b)) >= 0)) + #define time_before_eq64(a,b) time_after_eq64(b,a) + + /* +diff --git a/include/linux/libata.h b/include/linux/libata.h +index 62467ca..b1fcdba 100644 +--- a/include/linux/libata.h ++++ b/include/linux/libata.h +@@ -393,6 +393,8 @@ enum { + ATA_HORKAGE_BROKEN_FPDMA_AA = (1 << 15), /* skip AA */ + ATA_HORKAGE_DUMP_ID = (1 << 16), /* dump IDENTIFY data */ + ATA_HORKAGE_MAX_SEC_LBA48 = (1 << 17), /* Set max sects to 65535 */ ++ ATA_HORKAGE_NOLPM = (1 << 20), /* don't use LPM */ ++ ATA_HORKAGE_WD_BROKEN_LPM = (1 << 21), /* some WDs have broken LPM */ + + /* DMA mask for user DMA control: User visible values; DO NOT + renumber */ +diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h +index 0072a53..8778c26 100644 +--- a/include/linux/pipe_fs_i.h ++++ b/include/linux/pipe_fs_i.h +@@ -160,6 +160,8 @@ int generic_pipe_buf_confirm(struct pipe_inode_info *, struct pipe_buffer *); + int generic_pipe_buf_steal(struct pipe_inode_info *, struct pipe_buffer *); + void generic_pipe_buf_release(struct pipe_inode_info *, struct pipe_buffer *); + ++extern const struct pipe_buf_operations nosteal_pipe_buf_ops; ++ + /* for F_SETPIPE_SZ and F_GETPIPE_SZ */ + long pipe_fcntl(struct file *, unsigned int, unsigned long arg); + struct pipe_inode_info *get_pipe_info(struct file *file); +diff --git a/include/linux/tracepoint.h b/include/linux/tracepoint.h +index df0a779..f3680aa 100644 +--- a/include/linux/tracepoint.h ++++ b/include/linux/tracepoint.h +@@ -60,6 +60,12 @@ struct tp_module { + unsigned int num_tracepoints; + struct tracepoint * const *tracepoints_ptrs; + }; ++bool trace_module_has_bad_taint(struct module *mod); ++#else ++static inline bool trace_module_has_bad_taint(struct module *mod) ++{ ++ return false; ++} + #endif /* CONFIG_MODULES */ + + struct tracepoint_iter { +diff --git a/include/scsi/osd_ore.h b/include/scsi/osd_ore.h +index f05fa82..47b458c 100644 +--- a/include/scsi/osd_ore.h ++++ b/include/scsi/osd_ore.h +@@ -101,6 +101,7 @@ struct ore_striping_info { + unsigned unit_off; + unsigned cur_pg; + unsigned cur_comp; ++ unsigned maxdevUnits; + }; + + struct ore_io_state; +diff --git a/include/xen/Kbuild b/include/xen/Kbuild +index 84ad8f0..563161a 100644 +--- a/include/xen/Kbuild ++++ b/include/xen/Kbuild +@@ -1,2 +1,4 @@ + header-y += evtchn.h ++header-y += gntalloc.h ++header-y += gntdev.h + header-y += privcmd.h +diff --git a/kernel/cgroup.c b/kernel/cgroup.c +index 2a1ffb7..93fc15e 100644 +--- a/kernel/cgroup.c ++++ b/kernel/cgroup.c +@@ -2785,9 +2785,14 @@ static void cgroup_enable_task_cg_lists(void) + * We should check if the process is exiting, otherwise + * it will race with cgroup_exit() in that the list + * entry won't be deleted though the process has exited. ++ * Do it while holding siglock so that we don't end up ++ * racing against cgroup_exit(). + */ ++ spin_lock_irq(&p->sighand->siglock); + if (!(p->flags & PF_EXITING) && list_empty(&p->cg_list)) + list_add(&p->cg_list, &p->cgroups->tasks); ++ spin_unlock_irq(&p->sighand->siglock); ++ + task_unlock(p); + } while_each_thread(g, p); + write_unlock(&css_set_lock); +diff --git a/kernel/cpuset.c b/kernel/cpuset.c +index 57eb98d..1e2c5f0 100644 +--- a/kernel/cpuset.c ++++ b/kernel/cpuset.c +@@ -2366,9 +2366,9 @@ int __cpuset_node_allowed_softwall(int node, gfp_t gfp_mask) + + task_lock(current); + cs = nearest_hardwall_ancestor(task_cs(current)); ++ allowed = node_isset(node, cs->mems_allowed); + task_unlock(current); + +- allowed = node_isset(node, cs->mems_allowed); + mutex_unlock(&callback_mutex); + return allowed; + } +diff --git a/kernel/events/core.c b/kernel/events/core.c +index 83d5621..b15b4f7 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -7101,14 +7101,14 @@ static void perf_pmu_rotate_stop(struct pmu *pmu) + static void __perf_event_exit_context(void *__info) + { + struct perf_event_context *ctx = __info; +- struct perf_event *event, *tmp; ++ struct perf_event *event; + + perf_pmu_rotate_stop(ctx->pmu); + +- list_for_each_entry_safe(event, tmp, &ctx->pinned_groups, group_entry) +- __perf_remove_from_context(event); +- list_for_each_entry_safe(event, tmp, &ctx->flexible_groups, group_entry) ++ rcu_read_lock(); ++ list_for_each_entry_rcu(event, &ctx->event_list, event_entry) + __perf_remove_from_context(event); ++ rcu_read_unlock(); + } + + static void perf_event_exit_cpu_context(int cpu) +@@ -7132,11 +7132,11 @@ static void perf_event_exit_cpu(int cpu) + { + struct swevent_htable *swhash = &per_cpu(swevent_htable, cpu); + ++ perf_event_exit_cpu_context(cpu); ++ + mutex_lock(&swhash->hlist_mutex); + swevent_hlist_release(swhash); + mutex_unlock(&swhash->hlist_mutex); +- +- perf_event_exit_cpu_context(cpu); + } + #else + static inline void perf_event_exit_cpu(int cpu) { } +diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c +index 52bdd58..4775229 100644 +--- a/kernel/irq/manage.c ++++ b/kernel/irq/manage.c +@@ -819,7 +819,7 @@ static int irq_thread(void *data) + + wake = atomic_dec_and_test(&desc->threads_active); + +- if (wake && waitqueue_active(&desc->wait_for_threads)) ++ if (wake) + wake_up(&desc->wait_for_threads); + } + +diff --git a/kernel/printk.c b/kernel/printk.c +index 16688ec..8fac434 100644 +--- a/kernel/printk.c ++++ b/kernel/printk.c +@@ -1165,7 +1165,6 @@ static int __cpuinit console_cpu_notify(struct notifier_block *self, + switch (action) { + case CPU_ONLINE: + case CPU_DEAD: +- case CPU_DYING: + case CPU_DOWN_FAILED: + case CPU_UP_CANCELED: + console_lock(); +diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c +index 37f3f39..4c6dae1 100644 +--- a/kernel/sched_fair.c ++++ b/kernel/sched_fair.c +@@ -4953,15 +4953,15 @@ static void switched_from_fair(struct rq *rq, struct task_struct *p) + struct cfs_rq *cfs_rq = cfs_rq_of(se); + + /* +- * Ensure the task's vruntime is normalized, so that when its ++ * Ensure the task's vruntime is normalized, so that when it's + * switched back to the fair class the enqueue_entity(.flags=0) will + * do the right thing. + * +- * If it was on_rq, then the dequeue_entity(.flags=0) will already +- * have normalized the vruntime, if it was !on_rq, then only when ++ * If it's on_rq, then the dequeue_entity(.flags=0) will already ++ * have normalized the vruntime, if it's !on_rq, then only when + * the task is sleeping will it still have non-normalized vruntime. + */ +- if (!se->on_rq && p->state != TASK_RUNNING) { ++ if (!p->on_rq && p->state != TASK_RUNNING) { + /* + * Fix up our vruntime so that the current sleep doesn't + * cause 'unlimited' sleep bonus. +diff --git a/kernel/time/jiffies.c b/kernel/time/jiffies.c +index a470154..955560e 100644 +--- a/kernel/time/jiffies.c ++++ b/kernel/time/jiffies.c +@@ -51,7 +51,13 @@ + * HZ shrinks, so values greater than 8 overflow 32bits when + * HZ=100. + */ ++#if HZ < 34 ++#define JIFFIES_SHIFT 6 ++#elif HZ < 67 ++#define JIFFIES_SHIFT 7 ++#else + #define JIFFIES_SHIFT 8 ++#endif + + static cycle_t jiffies_read(struct clocksource *cs) + { +diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c +index cb7f33e..068c092 100644 +--- a/kernel/time/timekeeping.c ++++ b/kernel/time/timekeeping.c +@@ -1161,7 +1161,7 @@ void get_monotonic_boottime(struct timespec *ts) + } while (read_seqretry(&xtime_lock, seq)); + + set_normalized_timespec(ts, ts->tv_sec + tomono.tv_sec + sleep.tv_sec, +- ts->tv_nsec + tomono.tv_nsec + sleep.tv_nsec + nsecs); ++ (s64)ts->tv_nsec + tomono.tv_nsec + sleep.tv_nsec + nsecs); + } + EXPORT_SYMBOL_GPL(get_monotonic_boottime); + +diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c +index cf8b439..a65fa36 100644 +--- a/kernel/trace/ftrace.c ++++ b/kernel/trace/ftrace.c +@@ -190,6 +190,12 @@ static void update_global_ops(void) + global_ops.func = func; + } + ++#ifdef CONFIG_FUNCTION_GRAPH_TRACER ++static void update_function_graph_func(void); ++#else ++static inline void update_function_graph_func(void) { } ++#endif ++ + static void update_ftrace_function(void) + { + ftrace_func_t func; +@@ -237,6 +243,8 @@ static int remove_ftrace_ops(struct ftrace_ops **list, struct ftrace_ops *ops) + { + struct ftrace_ops **p; + ++ update_function_graph_func(); ++ + /* + * If we are removing the last function, then simply point + * to the ftrace_stub. +@@ -283,6 +291,17 @@ static int __register_ftrace_function(struct ftrace_ops *ops) + return 0; + } + ++static void ftrace_sync(struct work_struct *work) ++{ ++ /* ++ * This function is just a stub to implement a hard force ++ * of synchronize_sched(). This requires synchronizing ++ * tasks even in userspace and idle. ++ * ++ * Yes, function tracing is rude. ++ */ ++} ++ + static int __unregister_ftrace_function(struct ftrace_ops *ops) + { + int ret; +@@ -308,13 +327,6 @@ static int __unregister_ftrace_function(struct ftrace_ops *ops) + if (ftrace_enabled) + update_ftrace_function(); + +- /* +- * Dynamic ops may be freed, we must make sure that all +- * callers are done before leaving this function. +- */ +- if (ops->flags & FTRACE_OPS_FL_DYNAMIC) +- synchronize_sched(); +- + return 0; + } + +@@ -1775,6 +1787,24 @@ static int ftrace_shutdown(struct ftrace_ops *ops, int command) + return 0; + + ftrace_run_update_code(command); ++ ++ /* ++ * Dynamic ops may be freed, we must make sure that all ++ * callers are done before leaving this function. ++ * The same goes for freeing the per_cpu data of the control ++ * ops. ++ * ++ * Again, normal synchronize_sched() is not good enough. ++ * We need to do a hard force of sched synchronization. ++ * This is because we use preempt_disable() to do RCU, but ++ * the function tracers can be called where RCU is not watching ++ * (like before user_exit()). We can not rely on the RCU ++ * infrastructure to do the synchronization, thus we must do it ++ * ourselves. ++ */ ++ if (ops->flags & (FTRACE_OPS_FL_DYNAMIC)) ++ schedule_on_each_cpu(ftrace_sync); ++ + return 0; + } + +@@ -4045,6 +4075,7 @@ int ftrace_graph_entry_stub(struct ftrace_graph_ent *trace) + trace_func_graph_ret_t ftrace_graph_return = + (trace_func_graph_ret_t)ftrace_stub; + trace_func_graph_ent_t ftrace_graph_entry = ftrace_graph_entry_stub; ++static trace_func_graph_ent_t __ftrace_graph_entry = ftrace_graph_entry_stub; + + /* Try to assign a return stack array on FTRACE_RETSTACK_ALLOC_SIZE tasks. */ + static int alloc_retstack_tasklist(struct ftrace_ret_stack **ret_stack_list) +@@ -4185,6 +4216,30 @@ static struct ftrace_ops fgraph_ops __read_mostly = { + .flags = FTRACE_OPS_FL_GLOBAL, + }; + ++static int ftrace_graph_entry_test(struct ftrace_graph_ent *trace) ++{ ++ if (!ftrace_ops_test(&global_ops, trace->func)) ++ return 0; ++ return __ftrace_graph_entry(trace); ++} ++ ++/* ++ * The function graph tracer should only trace the functions defined ++ * by set_ftrace_filter and set_ftrace_notrace. If another function ++ * tracer ops is registered, the graph tracer requires testing the ++ * function against the global ops, and not just trace any function ++ * that any ftrace_ops registered. ++ */ ++static void update_function_graph_func(void) ++{ ++ if (ftrace_ops_list == &ftrace_list_end || ++ (ftrace_ops_list == &global_ops && ++ global_ops.next == &ftrace_list_end)) ++ ftrace_graph_entry = __ftrace_graph_entry; ++ else ++ ftrace_graph_entry = ftrace_graph_entry_test; ++} ++ + int register_ftrace_graph(trace_func_graph_ret_t retfunc, + trace_func_graph_ent_t entryfunc) + { +@@ -4209,7 +4264,16 @@ int register_ftrace_graph(trace_func_graph_ret_t retfunc, + } + + ftrace_graph_return = retfunc; +- ftrace_graph_entry = entryfunc; ++ ++ /* ++ * Update the indirect function to the entryfunc, and the ++ * function that gets called to the entry_test first. Then ++ * call the update fgraph entry function to determine if ++ * the entryfunc should be called directly or not. ++ */ ++ __ftrace_graph_entry = entryfunc; ++ ftrace_graph_entry = ftrace_graph_entry_test; ++ update_function_graph_func(); + + ret = ftrace_startup(&fgraph_ops, FTRACE_START_FUNC_RET); + +@@ -4228,6 +4292,7 @@ void unregister_ftrace_graph(void) + ftrace_graph_active--; + ftrace_graph_return = (trace_func_graph_ret_t)ftrace_stub; + ftrace_graph_entry = ftrace_graph_entry_stub; ++ __ftrace_graph_entry = ftrace_graph_entry_stub; + ftrace_shutdown(&fgraph_ops, FTRACE_STOP_FUNC_RET); + unregister_pm_notifier(&ftrace_suspend_notifier); + unregister_trace_sched_switch(ftrace_graph_probe_sched_switch, NULL); +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index 6fdc629..648f25a 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -2040,6 +2040,13 @@ __rb_reserve_next(struct ring_buffer_per_cpu *cpu_buffer, + write &= RB_WRITE_MASK; + tail = write - length; + ++ /* ++ * If this is the first commit on the page, then it has the same ++ * timestamp as the page itself. ++ */ ++ if (!tail) ++ delta = 0; ++ + /* See if we shot pass the end of this buffer page */ + if (unlikely(write > BUF_PAGE_SIZE)) + return rb_move_tail(cpu_buffer, length, tail, +diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c +index c212a7f..875fed4 100644 +--- a/kernel/trace/trace_events.c ++++ b/kernel/trace/trace_events.c +@@ -1345,6 +1345,16 @@ static void trace_module_add_events(struct module *mod) + struct ftrace_module_file_ops *file_ops = NULL; + struct ftrace_event_call **call, **start, **end; + ++ if (!mod->num_trace_events) ++ return; ++ ++ /* Don't add infrastructure for mods without tracepoints */ ++ if (trace_module_has_bad_taint(mod)) { ++ pr_err("%s: module has bad taint, not creating trace events\n", ++ mod->name); ++ return; ++ } ++ + start = mod->trace_events; + end = mod->trace_events + mod->num_trace_events; + +diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c +index f1539de..41b25a0 100644 +--- a/kernel/tracepoint.c ++++ b/kernel/tracepoint.c +@@ -628,6 +628,11 @@ void tracepoint_iter_reset(struct tracepoint_iter *iter) + EXPORT_SYMBOL_GPL(tracepoint_iter_reset); + + #ifdef CONFIG_MODULES ++bool trace_module_has_bad_taint(struct module *mod) ++{ ++ return mod->taints & ~((1 << TAINT_OOT_MODULE) | (1 << TAINT_CRAP)); ++} ++ + static int tracepoint_module_coming(struct module *mod) + { + struct tp_module *tp_mod, *iter; +@@ -638,7 +643,7 @@ static int tracepoint_module_coming(struct module *mod) + * module headers (for forced load), to make sure we don't cause a crash. + * Staging and out-of-tree GPL modules are fine. + */ +- if (mod->taints & ~((1 << TAINT_OOT_MODULE) | (1 << TAINT_CRAP))) ++ if (trace_module_has_bad_taint(mod)) + return 0; + mutex_lock(&tracepoints_mutex); + tp_mod = kmalloc(sizeof(struct tp_module), GFP_KERNEL); +diff --git a/kernel/workqueue.c b/kernel/workqueue.c +index 0bc9ff0..563820c 100644 +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -1474,12 +1474,19 @@ static void destroy_worker(struct worker *worker) + if (worker->flags & WORKER_IDLE) + gcwq->nr_idle--; + ++ /* ++ * Once WORKER_DIE is set, the kworker may destroy itself at any ++ * point. Pin to ensure the task stays until we're done with it. ++ */ ++ get_task_struct(worker->task); ++ + list_del_init(&worker->entry); + worker->flags |= WORKER_DIE; + + spin_unlock_irq(&gcwq->lock); + + kthread_stop(worker->task); ++ put_task_struct(worker->task); + kfree(worker); + + spin_lock_irq(&gcwq->lock); +diff --git a/lib/Makefile b/lib/Makefile +index a4da283..c06efca 100644 +--- a/lib/Makefile ++++ b/lib/Makefile +@@ -40,6 +40,7 @@ obj-$(CONFIG_DEBUG_SPINLOCK) += spinlock_debug.o + lib-$(CONFIG_RWSEM_GENERIC_SPINLOCK) += rwsem-spinlock.o + lib-$(CONFIG_RWSEM_XCHGADD_ALGORITHM) += rwsem.o + ++GCOV_PROFILE_hweight.o := n + CFLAGS_hweight.o = $(subst $(quote),,$(CONFIG_ARCH_HWEIGHT_CFLAGS)) + obj-$(CONFIG_GENERIC_HWEIGHT) += hweight.o + +diff --git a/mm/oom_kill.c b/mm/oom_kill.c +index 069b64e..4dda948 100644 +--- a/mm/oom_kill.c ++++ b/mm/oom_kill.c +@@ -213,7 +213,7 @@ unsigned int oom_badness(struct task_struct *p, struct mem_cgroup *mem, + * implementation used by LSMs. + */ + if (has_capability_noaudit(p, CAP_SYS_ADMIN)) +- points -= 30; ++ points -= (points * 3) / 100; + + /* + * /proc/pid/oom_score_adj ranges from -1000 to +1000 such that it may +diff --git a/mm/page-writeback.c b/mm/page-writeback.c +index ea3f83b..b5cd796 100644 +--- a/mm/page-writeback.c ++++ b/mm/page-writeback.c +@@ -1776,11 +1776,12 @@ int __set_page_dirty_nobuffers(struct page *page) + if (!TestSetPageDirty(page)) { + struct address_space *mapping = page_mapping(page); + struct address_space *mapping2; ++ unsigned long flags; + + if (!mapping) + return 1; + +- spin_lock_irq(&mapping->tree_lock); ++ spin_lock_irqsave(&mapping->tree_lock, flags); + mapping2 = page_mapping(page); + if (mapping2) { /* Race with truncate? */ + BUG_ON(mapping2 != mapping); +@@ -1789,7 +1790,7 @@ int __set_page_dirty_nobuffers(struct page *page) + radix_tree_tag_set(&mapping->page_tree, + page_index(page), PAGECACHE_TAG_DIRTY); + } +- spin_unlock_irq(&mapping->tree_lock); ++ spin_unlock_irqrestore(&mapping->tree_lock, flags); + if (mapping->host) { + /* !PageAnon && !swapper_space */ + __mark_inode_dirty(mapping->host, I_DIRTY_PAGES); +diff --git a/mm/rmap.c b/mm/rmap.c +index 8685697..52a2f36 100644 +--- a/mm/rmap.c ++++ b/mm/rmap.c +@@ -581,7 +581,11 @@ pte_t *__page_check_address(struct page *page, struct mm_struct *mm, + spinlock_t *ptl; + + if (unlikely(PageHuge(page))) { ++ /* when pud is not present, pte will be NULL */ + pte = huge_pte_offset(mm, address); ++ if (!pte) ++ return NULL; ++ + ptl = &mm->page_table_lock; + goto check; + } +diff --git a/mm/slub.c b/mm/slub.c +index 5710788..fc719f7 100644 +--- a/mm/slub.c ++++ b/mm/slub.c +@@ -4483,7 +4483,13 @@ static ssize_t show_slab_objects(struct kmem_cache *s, + page = c->partial; + + if (page) { +- x = page->pobjects; ++ node = page_to_nid(page); ++ if (flags & SO_TOTAL) ++ WARN_ON_ONCE(1); ++ else if (flags & SO_OBJECTS) ++ WARN_ON_ONCE(1); ++ else ++ x = page->pages; + total += x; + nodes[node] += x; + } +diff --git a/mm/swapfile.c b/mm/swapfile.c +index fad1830..dbd2b67 100644 +--- a/mm/swapfile.c ++++ b/mm/swapfile.c +@@ -1649,7 +1649,6 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile) + p->max = 0; + swap_map = p->swap_map; + p->swap_map = NULL; +- p->flags = 0; + spin_unlock(&swap_lock); + mutex_unlock(&swapon_mutex); + vfree(swap_map); +@@ -1667,6 +1666,16 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile) + mutex_unlock(&inode->i_mutex); + } + filp_close(swap_file, NULL); ++ ++ /* ++ * Clear the SWP_USED flag after all resources are freed so that swapon ++ * can reuse this swap_info in alloc_swap_info() safely. It is ok to ++ * not hold p->lock after we cleared its SWP_WRITEOK. ++ */ ++ spin_lock(&swap_lock); ++ p->flags = 0; ++ spin_unlock(&swap_lock); ++ + err = 0; + atomic_inc(&proc_poll_event); + wake_up_interruptible(&proc_poll_wait); +diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c +index c0c21b1..6af54f2 100644 +--- a/net/core/fib_rules.c ++++ b/net/core/fib_rules.c +@@ -718,6 +718,13 @@ static int fib_rules_event(struct notifier_block *this, unsigned long event, + attach_rules(&ops->rules_list, dev); + break; + ++ case NETDEV_CHANGENAME: ++ list_for_each_entry(ops, &net->rules_ops, list) { ++ detach_rules(&ops->rules_list, dev); ++ attach_rules(&ops->rules_list, dev); ++ } ++ break; ++ + case NETDEV_UNREGISTER: + list_for_each_entry(ops, &net->rules_ops, list) + detach_rules(&ops->rules_list, dev); +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index af9c3c6..5d6cb54 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -74,36 +74,6 @@ + static struct kmem_cache *skbuff_head_cache __read_mostly; + static struct kmem_cache *skbuff_fclone_cache __read_mostly; + +-static void sock_pipe_buf_release(struct pipe_inode_info *pipe, +- struct pipe_buffer *buf) +-{ +- put_page(buf->page); +-} +- +-static void sock_pipe_buf_get(struct pipe_inode_info *pipe, +- struct pipe_buffer *buf) +-{ +- get_page(buf->page); +-} +- +-static int sock_pipe_buf_steal(struct pipe_inode_info *pipe, +- struct pipe_buffer *buf) +-{ +- return 1; +-} +- +- +-/* Pipe buffer operations for a socket. */ +-static const struct pipe_buf_operations sock_pipe_buf_ops = { +- .can_merge = 0, +- .map = generic_pipe_buf_map, +- .unmap = generic_pipe_buf_unmap, +- .confirm = generic_pipe_buf_confirm, +- .release = sock_pipe_buf_release, +- .steal = sock_pipe_buf_steal, +- .get = sock_pipe_buf_get, +-}; +- + /* + * Keep out-of-line to prevent kernel bloat. + * __builtin_return_address is not used because it is not always +@@ -1665,7 +1635,7 @@ int skb_splice_bits(struct sk_buff *skb, unsigned int offset, + .partial = partial, + .nr_pages_max = MAX_SKB_FRAGS, + .flags = flags, +- .ops = &sock_pipe_buf_ops, ++ .ops = &nosteal_pipe_buf_ops, + .spd_release = sock_spd_release, + }; + struct sk_buff *frag_iter; +diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c +index 488600c..1914f5a 100644 +--- a/net/mac80211/sta_info.c ++++ b/net/mac80211/sta_info.c +@@ -292,6 +292,7 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata, + return NULL; + + spin_lock_init(&sta->lock); ++ spin_lock_init(&sta->ps_lock); + INIT_WORK(&sta->drv_unblock_wk, sta_unblock); + INIT_WORK(&sta->ampdu_mlme.work, ieee80211_ba_session_work); + mutex_init(&sta->ampdu_mlme.mtx); +@@ -1141,6 +1142,8 @@ void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta) + + skb_queue_head_init(&pending); + ++ /* sync with ieee80211_tx_h_unicast_ps_buf */ ++ spin_lock(&sta->ps_lock); + /* Send all buffered frames to the station */ + for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) { + int count = skb_queue_len(&pending), tmp; +@@ -1160,6 +1163,7 @@ void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta) + } + + ieee80211_add_pending_skbs_fn(local, &pending, clear_sta_ps_flags, sta); ++ spin_unlock(&sta->ps_lock); + + local->total_ps_buffered -= buffered; + +@@ -1207,6 +1211,7 @@ static void ieee80211_send_null_response(struct ieee80211_sub_if_data *sdata, + memcpy(nullfunc->addr1, sta->sta.addr, ETH_ALEN); + memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN); + memcpy(nullfunc->addr3, sdata->vif.addr, ETH_ALEN); ++ nullfunc->seq_ctrl = 0; + + skb->priority = tid; + skb_set_queue_mapping(skb, ieee802_1d_to_ac[tid]); +diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h +index 8c8ce05..a68155f 100644 +--- a/net/mac80211/sta_info.h ++++ b/net/mac80211/sta_info.h +@@ -216,6 +216,7 @@ struct sta_ampdu_mlme { + * @drv_unblock_wk: used for driver PS unblocking + * @listen_interval: listen interval of this station, when we're acting as AP + * @_flags: STA flags, see &enum ieee80211_sta_info_flags, do not use directly ++ * @ps_lock: used for powersave (when mac80211 is the AP) related locking + * @ps_tx_buf: buffers (per AC) of frames to transmit to this station + * when it leaves power saving state or polls + * @tx_filtered: buffers (per AC) of frames we already tried to +@@ -284,10 +285,8 @@ struct sta_info { + /* use the accessors defined below */ + unsigned long _flags; + +- /* +- * STA powersave frame queues, no more than the internal +- * locking required. +- */ ++ /* STA powersave lock and frame queues */ ++ spinlock_t ps_lock; + struct sk_buff_head ps_tx_buf[IEEE80211_NUM_ACS]; + struct sk_buff_head tx_filtered[IEEE80211_NUM_ACS]; + unsigned long driver_buffered_tids; +diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c +index 4ff35bf..25bbb2e 100644 +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -464,6 +464,20 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx) + #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */ + if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER) + purge_old_ps_buffers(tx->local); ++ ++ /* sync with ieee80211_sta_ps_deliver_wakeup */ ++ spin_lock(&sta->ps_lock); ++ /* ++ * STA woke up the meantime and all the frames on ps_tx_buf have ++ * been queued to pending queue. No reordering can happen, go ++ * ahead and Tx the packet. ++ */ ++ if (!test_sta_flag(sta, WLAN_STA_PS_STA) && ++ !test_sta_flag(sta, WLAN_STA_PS_DRIVER)) { ++ spin_unlock(&sta->ps_lock); ++ return TX_CONTINUE; ++ } ++ + if (skb_queue_len(&sta->ps_tx_buf[ac]) >= STA_MAX_TX_BUFFER) { + struct sk_buff *old = skb_dequeue(&sta->ps_tx_buf[ac]); + #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG +@@ -480,6 +494,7 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx) + info->control.vif = &tx->sdata->vif; + info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING; + skb_queue_tail(&sta->ps_tx_buf[ac], tx->skb); ++ spin_unlock(&sta->ps_lock); + + if (!timer_pending(&local->sta_cleanup)) + mod_timer(&local->sta_cleanup, +@@ -884,7 +899,7 @@ static int ieee80211_fragment(struct ieee80211_local *local, + pos += fraglen; + } + +- skb->len = hdrlen + per_fragm; ++ skb_trim(skb, hdrlen + per_fragm); + return 0; + } + +diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c +index cb1c430..f131caf 100644 +--- a/net/sctp/sm_statefuns.c ++++ b/net/sctp/sm_statefuns.c +@@ -747,6 +747,13 @@ sctp_disposition_t sctp_sf_do_5_1D_ce(const struct sctp_endpoint *ep, + struct sctp_chunk auth; + sctp_ierror_t ret; + ++ /* Make sure that we and the peer are AUTH capable */ ++ if (!sctp_auth_enable || !new_asoc->peer.auth_capable) { ++ kfree_skb(chunk->auth_chunk); ++ sctp_association_free(new_asoc); ++ return sctp_sf_pdiscard(ep, asoc, type, arg, commands); ++ } ++ + /* set-up our fake chunk so that we can process it */ + auth.skb = chunk->auth_chunk; + auth.asoc = chunk->asoc; +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index c53d01e..c28eb7b 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -70,6 +70,7 @@ + #include <linux/init.h> + #include <linux/crypto.h> + #include <linux/slab.h> ++#include <linux/compat.h> + + #include <net/ip.h> + #include <net/icmp.h> +@@ -1376,11 +1377,19 @@ SCTP_STATIC int sctp_setsockopt_connectx(struct sock* sk, + /* + * New (hopefully final) interface for the API. + * We use the sctp_getaddrs_old structure so that use-space library +- * can avoid any unnecessary allocations. The only defferent part ++ * can avoid any unnecessary allocations. The only different part + * is that we store the actual length of the address buffer into the +- * addrs_num structure member. That way we can re-use the existing ++ * addrs_num structure member. That way we can re-use the existing + * code. + */ ++#ifdef CONFIG_COMPAT ++struct compat_sctp_getaddrs_old { ++ sctp_assoc_t assoc_id; ++ s32 addr_num; ++ compat_uptr_t addrs; /* struct sockaddr * */ ++}; ++#endif ++ + SCTP_STATIC int sctp_getsockopt_connectx3(struct sock* sk, int len, + char __user *optval, + int __user *optlen) +@@ -1389,16 +1398,30 @@ SCTP_STATIC int sctp_getsockopt_connectx3(struct sock* sk, int len, + sctp_assoc_t assoc_id = 0; + int err = 0; + +- if (len < sizeof(param)) +- return -EINVAL; ++#ifdef CONFIG_COMPAT ++ if (is_compat_task()) { ++ struct compat_sctp_getaddrs_old param32; + +- if (copy_from_user(¶m, optval, sizeof(param))) +- return -EFAULT; ++ if (len < sizeof(param32)) ++ return -EINVAL; ++ if (copy_from_user(¶m32, optval, sizeof(param32))) ++ return -EFAULT; + +- err = __sctp_setsockopt_connectx(sk, +- (struct sockaddr __user *)param.addrs, +- param.addr_num, &assoc_id); ++ param.assoc_id = param32.assoc_id; ++ param.addr_num = param32.addr_num; ++ param.addrs = compat_ptr(param32.addrs); ++ } else ++#endif ++ { ++ if (len < sizeof(param)) ++ return -EINVAL; ++ if (copy_from_user(¶m, optval, sizeof(param))) ++ return -EFAULT; ++ } + ++ err = __sctp_setsockopt_connectx(sk, (struct sockaddr __user *) ++ param.addrs, param.addr_num, ++ &assoc_id); + if (err == 0 || err == -EINPROGRESS) { + if (copy_to_user(optval, &assoc_id, sizeof(assoc_id))) + return -EFAULT; +diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c +index b2250da..a0e55e5 100644 +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -1002,9 +1002,13 @@ call_refreshresult(struct rpc_task *task) + task->tk_action = call_refresh; + switch (status) { + case 0: +- if (rpcauth_uptodatecred(task)) ++ if (rpcauth_uptodatecred(task)) { + task->tk_action = call_allocate; +- return; ++ return; ++ } ++ /* Use rate-limiting and a max number of retries if refresh ++ * had status 0 but failed to update the cred. ++ */ + case -ETIMEDOUT: + rpc_delay(task, 3*HZ); + case -EAGAIN: +diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c +index bfb78fa..d77a4f0 100644 +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -501,6 +501,7 @@ static int xs_nospace(struct rpc_task *task) + struct rpc_rqst *req = task->tk_rqstp; + struct rpc_xprt *xprt = req->rq_xprt; + struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt); ++ struct sock *sk = transport->inet; + int ret = -EAGAIN; + + dprintk("RPC: %5u xmit incomplete (%u left of %u)\n", +@@ -518,7 +519,7 @@ static int xs_nospace(struct rpc_task *task) + * window size + */ + set_bit(SOCK_NOSPACE, &transport->sock->flags); +- transport->inet->sk_write_pending++; ++ sk->sk_write_pending++; + /* ...and wait for more buffer space */ + xprt_wait_for_buffer_space(task, xs_nospace_callback); + } +@@ -528,6 +529,9 @@ static int xs_nospace(struct rpc_task *task) + } + + spin_unlock_bh(&xprt->transport_lock); ++ ++ /* Race breaker in case memory is freed before above code is called */ ++ sk->sk_write_space(sk); + return ret; + } + +diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c +index eddfdec..54fc90b 100644 +--- a/net/unix/af_unix.c ++++ b/net/unix/af_unix.c +@@ -149,8 +149,8 @@ static inline void unix_set_secdata(struct scm_cookie *scm, struct sk_buff *skb) + + static inline unsigned unix_hash_fold(__wsum n) + { +- unsigned hash = (__force unsigned)n; +- hash ^= hash>>16; ++ unsigned int hash = (__force unsigned int)csum_fold(n); ++ + hash ^= hash>>8; + return hash&(UNIX_HASH_SIZE-1); + } +diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c +index d1d0ae8..98ff331 100644 +--- a/scripts/mod/file2alias.c ++++ b/scripts/mod/file2alias.c +@@ -130,8 +130,8 @@ static void do_usb_entry(struct usb_device_id *id, + range_lo < 0x9 ? "[%X-9" : "[%X", + range_lo); + sprintf(alias + strlen(alias), +- range_hi > 0xA ? "a-%X]" : "%X]", +- range_lo); ++ range_hi > 0xA ? "A-%X]" : "%X]", ++ range_hi); + } + } + if (bcdDevice_initial_digits < (sizeof(id->bcdDevice_lo) * 2 - 1)) +diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c +index bcf1d73..4fa7939 100644 +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -4676,22 +4676,31 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex, + * as fast and as clean as possible. */ + if (!selinux_policycap_netpeer) + return selinux_ip_postroute_compat(skb, ifindex, family); ++ ++ secmark_active = selinux_secmark_enabled(); ++ peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled(); ++ if (!secmark_active && !peerlbl_active) ++ return NF_ACCEPT; ++ ++ sk = skb->sk; ++ + #ifdef CONFIG_XFRM + /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec + * packet transformation so allow the packet to pass without any checks + * since we'll have another chance to perform access control checks + * when the packet is on it's final way out. + * NOTE: there appear to be some IPv6 multicast cases where skb->dst +- * is NULL, in this case go ahead and apply access control. */ +- if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL) ++ * is NULL, in this case go ahead and apply access control. ++ * NOTE: if this is a local socket (skb->sk != NULL) that is in the ++ * TCP listening state we cannot wait until the XFRM processing ++ * is done as we will miss out on the SA label if we do; ++ * unfortunately, this means more work, but it is only once per ++ * connection. */ ++ if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL && ++ !(sk != NULL && sk->sk_state == TCP_LISTEN)) + return NF_ACCEPT; + #endif +- secmark_active = selinux_secmark_enabled(); +- peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled(); +- if (!secmark_active && !peerlbl_active) +- return NF_ACCEPT; + +- sk = skb->sk; + if (sk == NULL) { + /* Without an associated socket the packet is either coming + * from the kernel or it is being forwarded; check the packet +@@ -4719,6 +4728,25 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex, + struct sk_security_struct *sksec = sk->sk_security; + if (selinux_skb_peerlbl_sid(skb, family, &skb_sid)) + return NF_DROP; ++ /* At this point, if the returned skb peerlbl is SECSID_NULL ++ * and the packet has been through at least one XFRM ++ * transformation then we must be dealing with the "final" ++ * form of labeled IPsec packet; since we've already applied ++ * all of our access controls on this packet we can safely ++ * pass the packet. */ ++ if (skb_sid == SECSID_NULL) { ++ switch (family) { ++ case PF_INET: ++ if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) ++ return NF_ACCEPT; ++ break; ++ case PF_INET6: ++ if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) ++ return NF_ACCEPT; ++ default: ++ return NF_DROP_ERR(-ECONNREFUSED); ++ } ++ } + if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid)) + return NF_DROP; + secmark_perm = PACKET__SEND; +diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c +index a7f61d5..23e9cba 100644 +--- a/security/selinux/ss/policydb.c ++++ b/security/selinux/ss/policydb.c +@@ -1914,7 +1914,19 @@ static int filename_trans_read(struct policydb *p, void *fp) + if (rc) + goto out; + +- hashtab_insert(p->filename_trans, ft, otype); ++ rc = hashtab_insert(p->filename_trans, ft, otype); ++ if (rc) { ++ /* ++ * Do not return -EEXIST to the caller, or the system ++ * will not boot. ++ */ ++ if (rc != -EEXIST) ++ goto out; ++ /* But free memory to avoid memory leak. */ ++ kfree(ft); ++ kfree(name); ++ kfree(otype); ++ } + } + hash_eval(p->filename_trans, "filenametr"); + return 0; +@@ -3202,10 +3214,10 @@ static int filename_write_helper(void *key, void *data, void *ptr) + if (rc) + return rc; + +- buf[0] = ft->stype; +- buf[1] = ft->ttype; +- buf[2] = ft->tclass; +- buf[3] = otype->otype; ++ buf[0] = cpu_to_le32(ft->stype); ++ buf[1] = cpu_to_le32(ft->ttype); ++ buf[2] = cpu_to_le32(ft->tclass); ++ buf[3] = cpu_to_le32(otype->otype); + + rc = put_entry(buf, sizeof(u32), 4, fp); + if (rc) +diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c +index 185f849..72b20b1 100644 +--- a/security/selinux/ss/services.c ++++ b/security/selinux/ss/services.c +@@ -1229,6 +1229,10 @@ static int security_context_to_sid_core(const char *scontext, u32 scontext_len, + struct context context; + int rc = 0; + ++ /* An empty security context is never valid. */ ++ if (!scontext_len) ++ return -EINVAL; ++ + if (!ss_initialized) { + int i; + +diff --git a/sound/pci/Kconfig b/sound/pci/Kconfig +index 8816804..e7244ac 100644 +--- a/sound/pci/Kconfig ++++ b/sound/pci/Kconfig +@@ -30,6 +30,7 @@ config SND_ALS300 + select SND_PCM + select SND_AC97_CODEC + select SND_OPL3_LIB ++ select ZONE_DMA + help + Say 'Y' or 'M' to include support for Avance Logic ALS300/ALS300+ + +@@ -54,6 +55,7 @@ config SND_ALI5451 + tristate "ALi M5451 PCI Audio Controller" + select SND_MPU401_UART + select SND_AC97_CODEC ++ select ZONE_DMA + help + Say Y here to include support for the integrated AC97 sound + device on motherboards using the ALi M5451 Audio Controller +@@ -158,6 +160,7 @@ config SND_AZT3328 + select SND_PCM + select SND_RAWMIDI + select SND_AC97_CODEC ++ select ZONE_DMA + help + Say Y here to include support for Aztech AZF3328 (PCI168) + soundcards. +@@ -463,6 +466,7 @@ config SND_EMU10K1 + select SND_HWDEP + select SND_RAWMIDI + select SND_AC97_CODEC ++ select ZONE_DMA + help + Say Y to include support for Sound Blaster PCI 512, Live!, + Audigy and E-mu APS (partially supported) soundcards. +@@ -478,6 +482,7 @@ config SND_EMU10K1X + tristate "Emu10k1X (Dell OEM Version)" + select SND_AC97_CODEC + select SND_RAWMIDI ++ select ZONE_DMA + help + Say Y here to include support for the Dell OEM version of the + Sound Blaster Live!. +@@ -511,6 +516,7 @@ config SND_ES1938 + select SND_OPL3_LIB + select SND_MPU401_UART + select SND_AC97_CODEC ++ select ZONE_DMA + help + Say Y here to include support for soundcards based on ESS Solo-1 + (ES1938, ES1946, ES1969) chips. +@@ -522,6 +528,7 @@ config SND_ES1968 + tristate "ESS ES1968/1978 (Maestro-1/2/2E)" + select SND_MPU401_UART + select SND_AC97_CODEC ++ select ZONE_DMA + help + Say Y here to include support for soundcards based on ESS Maestro + 1/2/2E chips. +@@ -602,6 +609,7 @@ config SND_ICE1712 + select SND_MPU401_UART + select SND_AC97_CODEC + select BITREVERSE ++ select ZONE_DMA + help + Say Y here to include support for soundcards based on the + ICE1712 (Envy24) chip. +@@ -688,6 +696,7 @@ config SND_LX6464ES + config SND_MAESTRO3 + tristate "ESS Allegro/Maestro3" + select SND_AC97_CODEC ++ select ZONE_DMA + help + Say Y here to include support for soundcards based on ESS Maestro 3 + (Allegro) chips. +@@ -782,6 +791,7 @@ config SND_SIS7019 + tristate "SiS 7019 Audio Accelerator" + depends on X86 && !X86_64 + select SND_AC97_CODEC ++ select ZONE_DMA + help + Say Y here to include support for the SiS 7019 Audio Accelerator. + +@@ -793,6 +803,7 @@ config SND_SONICVIBES + select SND_OPL3_LIB + select SND_MPU401_UART + select SND_AC97_CODEC ++ select ZONE_DMA + help + Say Y here to include support for soundcards based on the S3 + SonicVibes chip. +@@ -804,6 +815,7 @@ config SND_TRIDENT + tristate "Trident 4D-Wave DX/NX; SiS 7018" + select SND_MPU401_UART + select SND_AC97_CODEC ++ select ZONE_DMA + help + Say Y here to include support for soundcards based on Trident + 4D-Wave DX/NX or SiS 7018 chips. +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 1f78ca6..36bce68 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5157,6 +5157,9 @@ static int alc269_fill_coef(struct hda_codec *codec) + + if (spec->codec_variant != ALC269_TYPE_ALC269VB) + return 0; ++ /* ALC271X doesn't seem to support these COEFs (bko#52181) */ ++ if (!strcmp(codec->chip_name, "ALC271X")) ++ return 0; + + if ((alc_get_coef0(codec) & 0x00ff) < 0x015) { + alc_write_coef_idx(codec, 0xf, 0x960b); +diff --git a/sound/pci/oxygen/xonar_dg.c b/sound/pci/oxygen/xonar_dg.c +index bc6eb58..59eda0a 100644 +--- a/sound/pci/oxygen/xonar_dg.c ++++ b/sound/pci/oxygen/xonar_dg.c +@@ -294,6 +294,16 @@ static int output_switch_put(struct snd_kcontrol *ctl, + oxygen_write16_masked(chip, OXYGEN_GPIO_DATA, + data->output_sel == 1 ? GPIO_HP_REAR : 0, + GPIO_HP_REAR); ++ oxygen_write8_masked(chip, OXYGEN_PLAY_ROUTING, ++ data->output_sel == 0 ? ++ OXYGEN_PLAY_MUTE01 : ++ OXYGEN_PLAY_MUTE23 | ++ OXYGEN_PLAY_MUTE45 | ++ OXYGEN_PLAY_MUTE67, ++ OXYGEN_PLAY_MUTE01 | ++ OXYGEN_PLAY_MUTE23 | ++ OXYGEN_PLAY_MUTE45 | ++ OXYGEN_PLAY_MUTE67); + } + mutex_unlock(&chip->mutex); + return changed; +@@ -597,7 +607,7 @@ struct oxygen_model model_xonar_dg = { + .model_data_size = sizeof(struct dg), + .device_config = PLAYBACK_0_TO_I2S | + PLAYBACK_1_TO_SPDIF | +- CAPTURE_0_FROM_I2S_2, ++ CAPTURE_0_FROM_I2S_1, + .dac_channels_pcm = 6, + .dac_channels_mixer = 0, + .function_flags = OXYGEN_FUNCTION_SPI, +diff --git a/sound/pci/rme9652/rme9652.c b/sound/pci/rme9652/rme9652.c +index 732c5e8..1b35864 100644 +--- a/sound/pci/rme9652/rme9652.c ++++ b/sound/pci/rme9652/rme9652.c +@@ -285,7 +285,7 @@ static char channel_map_9636_ds[26] = { + /* ADAT channels are remapped */ + 1, 3, 5, 7, 9, 11, 13, 15, + /* channels 8 and 9 are S/PDIF */ +- 24, 25 ++ 24, 25, + /* others don't exist */ + -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1 + }; +diff --git a/sound/soc/codecs/adau1701.c b/sound/soc/codecs/adau1701.c +index 8b7e1c5..3cca558 100644 +--- a/sound/soc/codecs/adau1701.c ++++ b/sound/soc/codecs/adau1701.c +@@ -64,7 +64,7 @@ + + #define ADAU1701_SEROCTL_WORD_LEN_24 0x0000 + #define ADAU1701_SEROCTL_WORD_LEN_20 0x0001 +-#define ADAU1701_SEROCTL_WORD_LEN_16 0x0010 ++#define ADAU1701_SEROCTL_WORD_LEN_16 0x0002 + #define ADAU1701_SEROCTL_WORD_LEN_MASK 0x0003 + + #define ADAU1701_AUXNPOW_VBPD 0x40 +diff --git a/sound/soc/codecs/sta32x.c b/sound/soc/codecs/sta32x.c +index d2f3715..25ae059 100644 +--- a/sound/soc/codecs/sta32x.c ++++ b/sound/soc/codecs/sta32x.c +@@ -143,42 +143,42 @@ static const unsigned int sta32x_limiter_drc_release_tlv[] = { + 13, 16, TLV_DB_SCALE_ITEM(-1500, 300, 0), + }; + +-static const struct soc_enum sta32x_drc_ac_enum = +- SOC_ENUM_SINGLE(STA32X_CONFD, STA32X_CONFD_DRC_SHIFT, +- 2, sta32x_drc_ac); +-static const struct soc_enum sta32x_auto_eq_enum = +- SOC_ENUM_SINGLE(STA32X_AUTO1, STA32X_AUTO1_AMEQ_SHIFT, +- 3, sta32x_auto_eq_mode); +-static const struct soc_enum sta32x_auto_gc_enum = +- SOC_ENUM_SINGLE(STA32X_AUTO1, STA32X_AUTO1_AMGC_SHIFT, +- 4, sta32x_auto_gc_mode); +-static const struct soc_enum sta32x_auto_xo_enum = +- SOC_ENUM_SINGLE(STA32X_AUTO2, STA32X_AUTO2_XO_SHIFT, +- 16, sta32x_auto_xo_mode); +-static const struct soc_enum sta32x_preset_eq_enum = +- SOC_ENUM_SINGLE(STA32X_AUTO3, STA32X_AUTO3_PEQ_SHIFT, +- 32, sta32x_preset_eq_mode); +-static const struct soc_enum sta32x_limiter_ch1_enum = +- SOC_ENUM_SINGLE(STA32X_C1CFG, STA32X_CxCFG_LS_SHIFT, +- 3, sta32x_limiter_select); +-static const struct soc_enum sta32x_limiter_ch2_enum = +- SOC_ENUM_SINGLE(STA32X_C2CFG, STA32X_CxCFG_LS_SHIFT, +- 3, sta32x_limiter_select); +-static const struct soc_enum sta32x_limiter_ch3_enum = +- SOC_ENUM_SINGLE(STA32X_C3CFG, STA32X_CxCFG_LS_SHIFT, +- 3, sta32x_limiter_select); +-static const struct soc_enum sta32x_limiter1_attack_rate_enum = +- SOC_ENUM_SINGLE(STA32X_L1AR, STA32X_LxA_SHIFT, +- 16, sta32x_limiter_attack_rate); +-static const struct soc_enum sta32x_limiter2_attack_rate_enum = +- SOC_ENUM_SINGLE(STA32X_L2AR, STA32X_LxA_SHIFT, +- 16, sta32x_limiter_attack_rate); +-static const struct soc_enum sta32x_limiter1_release_rate_enum = +- SOC_ENUM_SINGLE(STA32X_L1AR, STA32X_LxR_SHIFT, +- 16, sta32x_limiter_release_rate); +-static const struct soc_enum sta32x_limiter2_release_rate_enum = +- SOC_ENUM_SINGLE(STA32X_L2AR, STA32X_LxR_SHIFT, +- 16, sta32x_limiter_release_rate); ++static SOC_ENUM_SINGLE_DECL(sta32x_drc_ac_enum, ++ STA32X_CONFD, STA32X_CONFD_DRC_SHIFT, ++ sta32x_drc_ac); ++static SOC_ENUM_SINGLE_DECL(sta32x_auto_eq_enum, ++ STA32X_AUTO1, STA32X_AUTO1_AMEQ_SHIFT, ++ sta32x_auto_eq_mode); ++static SOC_ENUM_SINGLE_DECL(sta32x_auto_gc_enum, ++ STA32X_AUTO1, STA32X_AUTO1_AMGC_SHIFT, ++ sta32x_auto_gc_mode); ++static SOC_ENUM_SINGLE_DECL(sta32x_auto_xo_enum, ++ STA32X_AUTO2, STA32X_AUTO2_XO_SHIFT, ++ sta32x_auto_xo_mode); ++static SOC_ENUM_SINGLE_DECL(sta32x_preset_eq_enum, ++ STA32X_AUTO3, STA32X_AUTO3_PEQ_SHIFT, ++ sta32x_preset_eq_mode); ++static SOC_ENUM_SINGLE_DECL(sta32x_limiter_ch1_enum, ++ STA32X_C1CFG, STA32X_CxCFG_LS_SHIFT, ++ sta32x_limiter_select); ++static SOC_ENUM_SINGLE_DECL(sta32x_limiter_ch2_enum, ++ STA32X_C2CFG, STA32X_CxCFG_LS_SHIFT, ++ sta32x_limiter_select); ++static SOC_ENUM_SINGLE_DECL(sta32x_limiter_ch3_enum, ++ STA32X_C3CFG, STA32X_CxCFG_LS_SHIFT, ++ sta32x_limiter_select); ++static SOC_ENUM_SINGLE_DECL(sta32x_limiter1_attack_rate_enum, ++ STA32X_L1AR, STA32X_LxA_SHIFT, ++ sta32x_limiter_attack_rate); ++static SOC_ENUM_SINGLE_DECL(sta32x_limiter2_attack_rate_enum, ++ STA32X_L2AR, STA32X_LxA_SHIFT, ++ sta32x_limiter_attack_rate); ++static SOC_ENUM_SINGLE_DECL(sta32x_limiter1_release_rate_enum, ++ STA32X_L1AR, STA32X_LxR_SHIFT, ++ sta32x_limiter_release_rate); ++static SOC_ENUM_SINGLE_DECL(sta32x_limiter2_release_rate_enum, ++ STA32X_L2AR, STA32X_LxR_SHIFT, ++ sta32x_limiter_release_rate); + + /* byte array controls for setting biquad, mixer, scaling coefficients; + * for biquads all five coefficients need to be set in one go, +@@ -350,7 +350,7 @@ SOC_SINGLE_TLV("Treble Tone Control", STA32X_TONE, STA32X_TONE_TTC_SHIFT, 15, 0, + SOC_ENUM("Limiter1 Attack Rate (dB/ms)", sta32x_limiter1_attack_rate_enum), + SOC_ENUM("Limiter2 Attack Rate (dB/ms)", sta32x_limiter2_attack_rate_enum), + SOC_ENUM("Limiter1 Release Rate (dB/ms)", sta32x_limiter1_release_rate_enum), +-SOC_ENUM("Limiter2 Release Rate (dB/ms)", sta32x_limiter1_release_rate_enum), ++SOC_ENUM("Limiter2 Release Rate (dB/ms)", sta32x_limiter2_release_rate_enum), + + /* depending on mode, the attack/release thresholds have + * two different enum definitions; provide both +diff --git a/sound/soc/codecs/wm8770.c b/sound/soc/codecs/wm8770.c +index aa05e65..d5f7d8d 100644 +--- a/sound/soc/codecs/wm8770.c ++++ b/sound/soc/codecs/wm8770.c +@@ -163,8 +163,8 @@ static const char *ain_text[] = { + "AIN5", "AIN6", "AIN7", "AIN8" + }; + +-static const struct soc_enum ain_enum = +- SOC_ENUM_DOUBLE(WM8770_ADCMUX, 0, 4, 8, ain_text); ++static SOC_ENUM_DOUBLE_DECL(ain_enum, ++ WM8770_ADCMUX, 0, 4, ain_text); + + static const struct snd_kcontrol_new ain_mux = + SOC_DAPM_ENUM("Capture Mux", ain_enum); +diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c +index 41b9fe0..4f7b330 100644 +--- a/sound/usb/mixer.c ++++ b/sound/usb/mixer.c +@@ -831,6 +831,7 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval, + } + break; + ++ case USB_ID(0x046d, 0x0807): /* Logitech Webcam C500 */ + case USB_ID(0x046d, 0x0808): + case USB_ID(0x046d, 0x0809): + case USB_ID(0x046d, 0x081b): /* HD Webcam c310 */ +diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c +index f1324c4..0e4e909 100644 +--- a/sound/usb/mixer_maps.c ++++ b/sound/usb/mixer_maps.c +@@ -304,6 +304,11 @@ static struct usbmix_name_map hercules_usb51_map[] = { + { 0 } /* terminator */ + }; + ++static const struct usbmix_name_map kef_x300a_map[] = { ++ { 10, NULL }, /* firmware locks up (?) when we try to access this FU */ ++ { 0 } ++}; ++ + /* + * Control map entries + */ +@@ -371,6 +376,10 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = { + .map = scratch_live_map, + .ignore_ctl_error = 1, + }, ++ { ++ .id = USB_ID(0x27ac, 0x1000), ++ .map = kef_x300a_map, ++ }, + { 0 } /* terminator */ + }; + +diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c +index 3c6f780..279a2f1 100644 +--- a/tools/power/x86/turbostat/turbostat.c ++++ b/tools/power/x86/turbostat/turbostat.c +@@ -32,6 +32,7 @@ + #include <dirent.h> + #include <string.h> + #include <ctype.h> ++#include <cpuid.h> + + #define MSR_TSC 0x10 + #define MSR_NEHALEM_PLATFORM_INFO 0xCE +@@ -847,7 +848,7 @@ void check_cpuid() + + eax = ebx = ecx = edx = 0; + +- asm("cpuid" : "=a" (max_level), "=b" (ebx), "=c" (ecx), "=d" (edx) : "a" (0)); ++ __get_cpuid(0, &max_level, &ebx, &ecx, &edx); + + if (ebx == 0x756e6547 && edx == 0x49656e69 && ecx == 0x6c65746e) + genuine_intel = 1; +@@ -856,7 +857,7 @@ void check_cpuid() + fprintf(stderr, "%.4s%.4s%.4s ", + (char *)&ebx, (char *)&edx, (char *)&ecx); + +- asm("cpuid" : "=a" (fms), "=c" (ecx), "=d" (edx) : "a" (1) : "ebx"); ++ __get_cpuid(1, &fms, &ebx, &ecx, &edx); + family = (fms >> 8) & 0xf; + model = (fms >> 4) & 0xf; + stepping = fms & 0xf; +@@ -878,7 +879,7 @@ void check_cpuid() + * This check is valid for both Intel and AMD. + */ + ebx = ecx = edx = 0; +- asm("cpuid" : "=a" (max_level), "=b" (ebx), "=c" (ecx), "=d" (edx) : "a" (0x80000000)); ++ __get_cpuid(0x80000000, &max_level, &ebx, &ecx, &edx); + + if (max_level < 0x80000007) { + fprintf(stderr, "CPUID: no invariant TSC (max_level 0x%x)\n", max_level); +@@ -889,7 +890,7 @@ void check_cpuid() + * Non-Stop TSC is advertised by CPUID.EAX=0x80000007: EDX.bit8 + * this check is valid for both Intel and AMD + */ +- asm("cpuid" : "=a" (eax), "=b" (ebx), "=c" (ecx), "=d" (edx) : "a" (0x80000007)); ++ __get_cpuid(0x80000007, &eax, &ebx, &ecx, &edx); + has_invariant_tsc = edx & (1 << 8); + + if (!has_invariant_tsc) { +@@ -902,7 +903,7 @@ void check_cpuid() + * this check is valid for both Intel and AMD + */ + +- asm("cpuid" : "=a" (eax), "=b" (ebx), "=c" (ecx), "=d" (edx) : "a" (0x6)); ++ __get_cpuid(0x6, &eax, &ebx, &ecx, &edx); + has_aperf = ecx & (1 << 0); + if (!has_aperf) { + fprintf(stderr, "No APERF MSR\n"); +diff --git a/virt/kvm/coalesced_mmio.c b/virt/kvm/coalesced_mmio.c +index a6ec206..e56b240 100644 +--- a/virt/kvm/coalesced_mmio.c ++++ b/virt/kvm/coalesced_mmio.c +@@ -148,17 +148,13 @@ int kvm_vm_ioctl_register_coalesced_mmio(struct kvm *kvm, + list_add_tail(&dev->list, &kvm->coalesced_zones); + mutex_unlock(&kvm->slots_lock); + +- return ret; ++ return 0; + + out_free_dev: + mutex_unlock(&kvm->slots_lock); +- + kfree(dev); + +- if (dev == NULL) +- return -ENXIO; +- +- return 0; ++ return ret; + } + + int kvm_vm_ioctl_unregister_coalesced_mmio(struct kvm *kvm, |