lkml.org 
[lkml]   [2015]   [Jun]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    SubjectRe: [PATCH 3.4 000/172] 3.4.108-rc1 review
    Date
    From: Zefan Li <lizefan@huawei.com>

    This is the combined patch for 3.4.106-rc1 relative to 3.4.105.

    ---

    diff --git a/Makefile b/Makefile
    index f53f41a..22e3c17 100644
    --- a/Makefile
    +++ b/Makefile
    @@ -1,7 +1,7 @@
    VERSION = 3
    PATCHLEVEL = 4
    -SUBLEVEL = 107
    -EXTRAVERSION =
    +SUBLEVEL = 108
    +EXTRAVERSION = -rc1
    NAME = Saber-toothed Squirrel

    # *DOCUMENTATION*
    diff --git a/arch/alpha/kernel/pci-sysfs.c b/arch/alpha/kernel/pci-sysfs.c
    index 53649c7..1a33355 100644
    --- a/arch/alpha/kernel/pci-sysfs.c
    +++ b/arch/alpha/kernel/pci-sysfs.c
    @@ -84,7 +84,7 @@ static int pci_mmap_resource(struct kobject *kobj,
    if (iomem_is_exclusive(res->start))
    return -EINVAL;

    - pcibios_resource_to_bus(pdev, &bar, res);
    + pcibios_resource_to_bus(pdev->bus, &bar, res);
    vma->vm_pgoff += bar.start >> (PAGE_SHIFT - (sparse ? 5 : 0));
    mmap_type = res->flags & IORESOURCE_MEM ? pci_mmap_mem : pci_mmap_io;

    @@ -140,7 +140,7 @@ static int sparse_mem_mmap_fits(struct pci_dev *pdev, int num)
    long dense_offset;
    unsigned long sparse_size;

    - pcibios_resource_to_bus(pdev, &bar, &pdev->resource[num]);
    + pcibios_resource_to_bus(pdev->bus, &bar, &pdev->resource[num]);

    /* All core logic chips have 4G sparse address space, except
    CIA which has 16G (see xxx_SPARSE_MEM and xxx_DENSE_MEM
    diff --git a/arch/arm/mach-at91/pm.h b/arch/arm/mach-at91/pm.h
    index 89f56f3..8c3f8e8 100644
    --- a/arch/arm/mach-at91/pm.h
    +++ b/arch/arm/mach-at91/pm.h
    @@ -38,7 +38,7 @@ static inline void at91rm9200_standby(void)
    " mcr p15, 0, %0, c7, c0, 4\n\t"
    " str %5, [%1, %2]"
    :
    - : "r" (0), "r" (AT91_BASE_SYS), "r" (AT91RM9200_SDRAMC_LPR),
    + : "r" (0), "r" (at91_ramc_base[0]), "r" (AT91RM9200_SDRAMC_LPR),
    "r" (1), "r" (AT91RM9200_SDRAMC_SRR),
    "r" (lpr));
    }
    diff --git a/arch/arm/mach-pxa/corgi.c b/arch/arm/mach-pxa/corgi.c
    index c1fe32d..f801fe8 100644
    --- a/arch/arm/mach-pxa/corgi.c
    +++ b/arch/arm/mach-pxa/corgi.c
    @@ -26,6 +26,7 @@
    #include <linux/i2c.h>
    #include <linux/i2c/pxa-i2c.h>
    #include <linux/io.h>
    +#include <linux/regulator/machine.h>
    #include <linux/spi/spi.h>
    #include <linux/spi/ads7846.h>
    #include <linux/spi/corgi_lcd.h>
    @@ -711,6 +712,8 @@ static void __init corgi_init(void)
    sharpsl_nand_partitions[1].size = 53 * 1024 * 1024;

    platform_add_devices(devices, ARRAY_SIZE(devices));
    +
    + regulator_has_full_constraints();
    }

    static void __init fixup_corgi(struct tag *tags, char **cmdline,
    diff --git a/arch/arm/mach-pxa/hx4700.c b/arch/arm/mach-pxa/hx4700.c
    index b83b95a..f35a30f 100644
    --- a/arch/arm/mach-pxa/hx4700.c
    +++ b/arch/arm/mach-pxa/hx4700.c
    @@ -881,6 +881,8 @@ static void __init hx4700_init(void)
    mdelay(10);
    gpio_set_value(GPIO71_HX4700_ASIC3_nRESET, 1);
    mdelay(10);
    +
    + regulator_has_full_constraints();
    }

    MACHINE_START(H4700, "HP iPAQ HX4700")
    diff --git a/arch/arm/mach-pxa/poodle.c b/arch/arm/mach-pxa/poodle.c
    index 89d98c8..39d1068 100644
    --- a/arch/arm/mach-pxa/poodle.c
    +++ b/arch/arm/mach-pxa/poodle.c
    @@ -25,6 +25,7 @@
    #include <linux/gpio.h>
    #include <linux/i2c.h>
    #include <linux/i2c/pxa-i2c.h>
    +#include <linux/regulator/machine.h>
    #include <linux/spi/spi.h>
    #include <linux/spi/ads7846.h>
    #include <linux/spi/pxa2xx_spi.h>
    @@ -452,6 +453,7 @@ static void __init poodle_init(void)
    pxa_set_i2c_info(NULL);
    i2c_register_board_info(0, ARRAY_AND_SIZE(poodle_i2c_devices));
    poodle_init_spi();
    + regulator_has_full_constraints();
    }

    static void __init fixup_poodle(struct tag *tags, char **cmdline,
    diff --git a/arch/arm/mach-pxa/spitz.c b/arch/arm/mach-pxa/spitz.c
    index df2ab0f..a1647d0 100644
    --- a/arch/arm/mach-pxa/spitz.c
    +++ b/arch/arm/mach-pxa/spitz.c
    @@ -968,6 +968,8 @@ static void __init spitz_init(void)
    spitz_nor_init();
    spitz_nand_init();
    spitz_i2c_init();
    +
    + regulator_has_full_constraints();
    }

    static void __init spitz_fixup(struct tag *tags, char **cmdline,
    diff --git a/arch/arm/mach-sa1100/pm.c b/arch/arm/mach-sa1100/pm.c
    index 2fa499e..69bbe4e 100644
    --- a/arch/arm/mach-sa1100/pm.c
    +++ b/arch/arm/mach-sa1100/pm.c
    @@ -80,6 +80,7 @@ static int sa11x0_pm_enter(suspend_state_t state)
    /*
    * Ensure not to come back here if it wasn't intended
    */
    + RCSR = RCSR_SMR;
    PSPR = 0;

    /*
    diff --git a/arch/powerpc/boot/dts/fsl/pq3-etsec2-0.dtsi b/arch/powerpc/boot/dts/fsl/pq3-etsec2-0.dtsi
    index 1382fec..7fcb1ac 100644
    --- a/arch/powerpc/boot/dts/fsl/pq3-etsec2-0.dtsi
    +++ b/arch/powerpc/boot/dts/fsl/pq3-etsec2-0.dtsi
    @@ -50,6 +50,7 @@ ethernet@b0000 {
    fsl,num_tx_queues = <0x8>;
    fsl,magic-packet;
    local-mac-address = [ 00 00 00 00 00 00 ];
    + ranges;

    queue-group@b0000 {
    #address-cells = <1>;
    diff --git a/arch/powerpc/boot/dts/fsl/pq3-etsec2-1.dtsi b/arch/powerpc/boot/dts/fsl/pq3-etsec2-1.dtsi
    index 221cd2e..9f25427 100644
    --- a/arch/powerpc/boot/dts/fsl/pq3-etsec2-1.dtsi
    +++ b/arch/powerpc/boot/dts/fsl/pq3-etsec2-1.dtsi
    @@ -50,6 +50,7 @@ ethernet@b1000 {
    fsl,num_tx_queues = <0x8>;
    fsl,magic-packet;
    local-mac-address = [ 00 00 00 00 00 00 ];
    + ranges;

    queue-group@b1000 {
    #address-cells = <1>;
    diff --git a/arch/powerpc/boot/dts/fsl/pq3-etsec2-2.dtsi b/arch/powerpc/boot/dts/fsl/pq3-etsec2-2.dtsi
    index 61456c3..cd7c318 100644
    --- a/arch/powerpc/boot/dts/fsl/pq3-etsec2-2.dtsi
    +++ b/arch/powerpc/boot/dts/fsl/pq3-etsec2-2.dtsi
    @@ -49,6 +49,7 @@ ethernet@b2000 {
    fsl,num_tx_queues = <0x8>;
    fsl,magic-packet;
    local-mac-address = [ 00 00 00 00 00 00 ];
    + ranges;

    queue-group@b2000 {
    #address-cells = <1>;
    diff --git a/arch/powerpc/kernel/pci_of_scan.c b/arch/powerpc/kernel/pci_of_scan.c
    index 89dde17..55551a8 100644
    --- a/arch/powerpc/kernel/pci_of_scan.c
    +++ b/arch/powerpc/kernel/pci_of_scan.c
    @@ -111,7 +111,7 @@ static void of_pci_parse_addrs(struct device_node *node, struct pci_dev *dev)
    res->name = pci_name(dev);
    region.start = base;
    region.end = base + size - 1;
    - pcibios_bus_to_resource(dev, res, &region);
    + pcibios_bus_to_resource(dev->bus, res, &region);
    }
    }

    @@ -276,7 +276,7 @@ void __devinit of_scan_pci_bridge(struct pci_dev *dev)
    res->flags = flags;
    region.start = of_read_number(&ranges[1], 2);
    region.end = region.start + size - 1;
    - pcibios_bus_to_resource(dev, res, &region);
    + pcibios_bus_to_resource(dev->bus, res, &region);
    }
    sprintf(bus->name, "PCI Bus %04x:%02x", pci_domain_nr(bus),
    bus->number);
    diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
    index 5da8e8d..79a17f7 100644
    --- a/arch/powerpc/platforms/powernv/pci-ioda.c
    +++ b/arch/powerpc/platforms/powernv/pci-ioda.c
    @@ -392,7 +392,7 @@ static void __devinit pnv_ioda_setup_pe_segments(struct pci_dev *dev)

    /* Setup IO segments */
    if (io_res.start < io_res.end) {
    - pcibios_resource_to_bus(dev, &region, &io_res);
    + pcibios_resource_to_bus(dev->bus, &region, &io_res);
    pos = region.start;
    i = pos / phb->ioda.io_segsize;
    while(i < phb->ioda.total_pe && pos <= region.end) {
    @@ -422,7 +422,7 @@ static void __devinit pnv_ioda_setup_pe_segments(struct pci_dev *dev)

    /* Setup M32 segments */
    if (m32_res.start < m32_res.end) {
    - pcibios_resource_to_bus(dev, &region, &m32_res);
    + pcibios_resource_to_bus(dev->bus, &region, &m32_res);
    pos = region.start;
    i = pos / phb->ioda.m32_segsize;
    while(i < phb->ioda.total_pe && pos <= region.end) {
    diff --git a/arch/powerpc/sysdev/axonram.c b/arch/powerpc/sysdev/axonram.c
    index 1c16141..1fea249 100644
    --- a/arch/powerpc/sysdev/axonram.c
    +++ b/arch/powerpc/sysdev/axonram.c
    @@ -155,7 +155,7 @@ axon_ram_direct_access(struct block_device *device, sector_t sector,
    }

    *kaddr = (void *)(bank->ph_addr + offset);
    - *pfn = virt_to_phys(kaddr) >> PAGE_SHIFT;
    + *pfn = virt_to_phys(*kaddr) >> PAGE_SHIFT;

    return 0;
    }
    diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
    index 0f250d1..7e6ac1f 100644
    --- a/arch/s390/kvm/kvm-s390.c
    +++ b/arch/s390/kvm/kvm-s390.c
    @@ -347,7 +347,7 @@ int kvm_arch_vcpu_setup(struct kvm_vcpu *vcpu)
    vcpu->arch.sie_block->ecb = 6;
    vcpu->arch.sie_block->eca = 0xC1002001U;
    vcpu->arch.sie_block->fac = (int) (long) facilities;
    - hrtimer_init(&vcpu->arch.ckc_timer, CLOCK_REALTIME, HRTIMER_MODE_ABS);
    + hrtimer_init(&vcpu->arch.ckc_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
    tasklet_init(&vcpu->arch.tasklet, kvm_s390_tasklet,
    (unsigned long) vcpu);
    vcpu->arch.ckc_timer.function = kvm_s390_idle_wakeup;
    diff --git a/arch/sparc/kernel/pci.c b/arch/sparc/kernel/pci.c
    index 8c5c9a5..ab5f471 100644
    --- a/arch/sparc/kernel/pci.c
    +++ b/arch/sparc/kernel/pci.c
    @@ -409,7 +409,7 @@ static void __devinit pci_cfg_fake_ranges(struct pci_dev *dev,
    res2.flags = res->flags;
    region.start = base;
    region.end = limit + 0xfff;
    - pcibios_bus_to_resource(dev, &res2, &region);
    + pcibios_bus_to_resource(dev->bus, &res2, &region);
    if (!res->start)
    res->start = res2.start;
    if (!res->end)
    @@ -427,7 +427,7 @@ static void __devinit pci_cfg_fake_ranges(struct pci_dev *dev,
    IORESOURCE_MEM);
    region.start = base;
    region.end = limit + 0xfffff;
    - pcibios_bus_to_resource(dev, res, &region);
    + pcibios_bus_to_resource(dev->bus, res, &region);
    }

    pci_read_config_word(dev, PCI_PREF_MEMORY_BASE, &mem_base_lo);
    @@ -458,7 +458,7 @@ static void __devinit pci_cfg_fake_ranges(struct pci_dev *dev,
    IORESOURCE_MEM | IORESOURCE_PREFETCH);
    region.start = base;
    region.end = limit + 0xfffff;
    - pcibios_bus_to_resource(dev, res, &region);
    + pcibios_bus_to_resource(dev->bus, res, &region);
    }
    }

    @@ -480,7 +480,7 @@ static void __devinit apb_fake_ranges(struct pci_dev *dev,
    res->flags = IORESOURCE_IO;
    region.start = (first << 21);
    region.end = (last << 21) + ((1 << 21) - 1);
    - pcibios_bus_to_resource(dev, res, &region);
    + pcibios_bus_to_resource(dev->bus, res, &region);

    pci_read_config_byte(dev, APB_MEM_ADDRESS_MAP, &map);
    apb_calc_first_last(map, &first, &last);
    @@ -488,7 +488,7 @@ static void __devinit apb_fake_ranges(struct pci_dev *dev,
    res->flags = IORESOURCE_MEM;
    region.start = (first << 29);
    region.end = (last << 29) + ((1 << 29) - 1);
    - pcibios_bus_to_resource(dev, res, &region);
    + pcibios_bus_to_resource(dev->bus, res, &region);
    }

    static void __devinit pci_of_scan_bus(struct pci_pbm_info *pbm,
    @@ -579,7 +579,7 @@ static void __devinit of_scan_pci_bridge(struct pci_pbm_info *pbm,
    res->flags = flags;
    region.start = GET_64BIT(ranges, 1);
    region.end = region.start + size - 1;
    - pcibios_bus_to_resource(dev, res, &region);
    + pcibios_bus_to_resource(dev->bus, res, &region);
    }
    after_ranges:
    sprintf(bus->name, "PCI Bus %04x:%02x", pci_domain_nr(bus),
    diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
    index 917c109..eda8cb9 100644
    --- a/arch/x86/Kconfig
    +++ b/arch/x86/Kconfig
    @@ -129,7 +129,7 @@ config SBUS
    bool

    config NEED_DMA_MAP_STATE
    - def_bool (X86_64 || INTEL_IOMMU || DMA_API_DEBUG)
    + def_bool (X86_64 || INTEL_IOMMU || DMA_API_DEBUG || SWIOTLB)

    config NEED_SG_DMA_LENGTH
    def_bool y
    diff --git a/arch/x86/crypto/aesni-intel_glue.c b/arch/x86/crypto/aesni-intel_glue.c
    index c799352..51afabd 100644
    --- a/arch/x86/crypto/aesni-intel_glue.c
    +++ b/arch/x86/crypto/aesni-intel_glue.c
    @@ -1203,7 +1203,7 @@ static int __driver_rfc4106_decrypt(struct aead_request *req)
    src = kmalloc(req->cryptlen + req->assoclen, GFP_ATOMIC);
    if (!src)
    return -ENOMEM;
    - assoc = (src + req->cryptlen + auth_tag_len);
    + assoc = (src + req->cryptlen);
    scatterwalk_map_and_copy(src, req->src, 0, req->cryptlen, 0);
    scatterwalk_map_and_copy(assoc, req->assoc, 0,
    req->assoclen, 0);
    @@ -1228,7 +1228,7 @@ static int __driver_rfc4106_decrypt(struct aead_request *req)
    scatterwalk_done(&src_sg_walk, 0, 0);
    scatterwalk_done(&assoc_sg_walk, 0, 0);
    } else {
    - scatterwalk_map_and_copy(dst, req->dst, 0, req->cryptlen, 1);
    + scatterwalk_map_and_copy(dst, req->dst, 0, tempCipherLen, 1);
    kfree(src);
    }
    return retval;
    diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
    index 45f9c70..8b49131 100644
    --- a/arch/x86/kernel/entry_64.S
    +++ b/arch/x86/kernel/entry_64.S
    @@ -414,11 +414,14 @@ ENTRY(ret_from_fork)
    testl $3, CS-ARGOFFSET(%rsp) # from kernel_thread?
    jz retint_restore_args

    - testl $_TIF_IA32, TI_flags(%rcx) # 32-bit compat task needs IRET
    - jnz int_ret_from_sys_call
    -
    - RESTORE_TOP_OF_STACK %rdi, -ARGOFFSET
    - jmp ret_from_sys_call # go to the SYSRET fastpath
    + /*
    + * By the time we get here, we have no idea whether our pt_regs,
    + * ti flags, and ti status came from the 64-bit SYSCALL fast path,
    + * the slow path, or one of the ia32entry paths.
    + * Use int_ret_from_sys_call to return, since it can safely handle
    + * all of the above.
    + */
    + jmp int_ret_from_sys_call

    CFI_ENDPROC
    END(ret_from_fork)
    diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
    index d398f31..310cb01 100644
    --- a/arch/x86/kernel/reboot.c
    +++ b/arch/x86/kernel/reboot.c
    @@ -439,6 +439,17 @@ static struct dmi_system_id __initdata pci_reboot_dmi_table[] = {
    DMI_MATCH(DMI_PRODUCT_NAME, "iMac9,1"),
    },
    },
    +
    + /* ASRock */
    + { /* Handle problems with rebooting on ASRock Q1900DC-ITX */
    + .callback = set_pci_reboot,
    + .ident = "ASRock Q1900DC-ITX",
    + .matches = {
    + DMI_MATCH(DMI_BOARD_VENDOR, "ASRock"),
    + DMI_MATCH(DMI_BOARD_NAME, "Q1900DC-ITX"),
    + },
    + },
    +
    { /* Handle problems with rebooting on the Latitude E6320. */
    .callback = set_pci_reboot,
    .ident = "Dell Latitude E6320",
    @@ -690,9 +701,12 @@ void native_machine_shutdown(void)
    /* Make certain I only run on the appropriate processor */
    set_cpus_allowed_ptr(current, cpumask_of(reboot_cpu_id));

    - /* O.K Now that I'm on the appropriate processor,
    - * stop all of the others.
    + /*
    + * O.K Now that I'm on the appropriate processor, stop all of the
    + * others. Also disable the local irq to not receive the per-cpu
    + * timer interrupt which may trigger scheduler's load balance.
    */
    + local_irq_disable();
    stop_other_cpus();
    #endif

    diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
    index 9bfe95f..adc049f 100644
    --- a/arch/x86/kernel/traps.c
    +++ b/arch/x86/kernel/traps.c
    @@ -435,7 +435,7 @@ dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code)
    * then it's very likely the result of an icebp/int01 trap.
    * User wants a sigtrap for that.
    */
    - if (!dr6 && user_mode(regs))
    + if (!dr6 && user_mode_vm(regs))
    user_icebp = 1;

    /* Catch kmemcheck conditions first of all! */
    diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
    index 91e8680..db08e66 100644
    --- a/arch/x86/kvm/emulate.c
    +++ b/arch/x86/kvm/emulate.c
    @@ -4246,7 +4246,8 @@ int x86_emulate_insn(struct x86_emulate_ctxt *ctxt)
    if (rc != X86EMUL_CONTINUE)
    goto done;
    }
    - ctxt->dst.orig_val = ctxt->dst.val;
    + /* Copy full 64-bit value for CMPXCHG8B. */
    + ctxt->dst.orig_val64 = ctxt->dst.val64;

    special_insn:

    diff --git a/arch/x86/vdso/vdso32/sigreturn.S b/arch/x86/vdso/vdso32/sigreturn.S
    index 31776d0..d7ec4e2 100644
    --- a/arch/x86/vdso/vdso32/sigreturn.S
    +++ b/arch/x86/vdso/vdso32/sigreturn.S
    @@ -17,6 +17,7 @@
    .text
    .globl __kernel_sigreturn
    .type __kernel_sigreturn,@function
    + nop /* this guy is needed for .LSTARTFDEDLSI1 below (watch for HACK) */
    ALIGN
    __kernel_sigreturn:
    .LSTART_sigreturn:
    diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
    index 8c5ad89..89cff37 100644
    --- a/drivers/acpi/video.c
    +++ b/drivers/acpi/video.c
    @@ -1872,6 +1872,17 @@ EXPORT_SYMBOL(acpi_video_unregister);

    static int __init acpi_video_init(void)
    {
    + /*
    + * Let the module load even if ACPI is disabled (e.g. due to
    + * a broken BIOS) so that i915.ko can still be loaded on such
    + * old systems without an AcpiOpRegion.
    + *
    + * acpi_video_register() will report -ENODEV later as well due
    + * to acpi_disabled when i915.ko tries to register itself afterwards.
    + */
    + if (acpi_disabled)
    + return 0;
    +
    dmi_check_system(video_dmi_table);

    if (intel_opregion_present())
    diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
    index 35fc569..eac3705 100644
    --- a/drivers/block/nbd.c
    +++ b/drivers/block/nbd.c
    @@ -773,10 +773,6 @@ static int __init nbd_init(void)
    return -EINVAL;
    }

    - nbd_dev = kcalloc(nbds_max, sizeof(*nbd_dev), GFP_KERNEL);
    - if (!nbd_dev)
    - return -ENOMEM;
    -
    part_shift = 0;
    if (max_part > 0) {
    part_shift = fls(max_part);
    @@ -798,6 +794,10 @@ static int __init nbd_init(void)
    if (nbds_max > 1UL << (MINORBITS - part_shift))
    return -EINVAL;

    + nbd_dev = kcalloc(nbds_max, sizeof(*nbd_dev), GFP_KERNEL);
    + if (!nbd_dev)
    + return -ENOMEM;
    +
    for (i = 0; i < nbds_max; i++) {
    struct gendisk *disk = alloc_disk(1 << part_shift);
    if (!disk)
    diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
    index 02fbbf7..8a084bf 100644
    --- a/drivers/bluetooth/ath3k.c
    +++ b/drivers/bluetooth/ath3k.c
    @@ -101,6 +101,7 @@ static struct usb_device_id ath3k_table[] = {
    { USB_DEVICE(0x13d3, 0x3393) },
    { USB_DEVICE(0x13d3, 0x3402) },
    { USB_DEVICE(0x13d3, 0x3408) },
    + { USB_DEVICE(0x13d3, 0x3423) },
    { USB_DEVICE(0x13d3, 0x3432) },

    /* Atheros AR5BBU12 with sflash firmware */
    @@ -149,6 +150,7 @@ static struct usb_device_id ath3k_blist_tbl[] = {
    { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
    { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
    { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
    { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },

    /* Atheros AR5BBU22 with sflash firmware */
    diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
    index ddb2b87..7c0b21e 100644
    --- a/drivers/bluetooth/btusb.c
    +++ b/drivers/bluetooth/btusb.c
    @@ -179,6 +179,7 @@ static struct usb_device_id blacklist_table[] = {
    { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
    { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
    { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
    + { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
    { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },

    /* Atheros AR5BBU12 with sflash firmware */
    diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
    index a81f469..96f4a50 100644
    --- a/drivers/char/virtio_console.c
    +++ b/drivers/char/virtio_console.c
    @@ -124,6 +124,7 @@ struct ports_device {
    * notification
    */
    struct work_struct control_work;
    + struct work_struct config_work;

    struct list_head ports;

    @@ -1555,10 +1556,21 @@ static void config_intr(struct virtio_device *vdev)

    portdev = vdev->priv;

    + if (!use_multiport(portdev))
    + schedule_work(&portdev->config_work);
    +}
    +
    +static void config_work_handler(struct work_struct *work)
    +{
    + struct ports_device *portdev;
    +
    + portdev = container_of(work, struct ports_device, control_work);
    if (!use_multiport(portdev)) {
    + struct virtio_device *vdev;
    struct port *port;
    u16 rows, cols;

    + vdev = portdev->vdev;
    vdev->config->get(vdev,
    offsetof(struct virtio_console_config, cols),
    &cols, sizeof(u16));
    @@ -1752,12 +1764,14 @@ static int __devinit virtcons_probe(struct virtio_device *vdev)
    spin_lock_init(&portdev->ports_lock);
    INIT_LIST_HEAD(&portdev->ports);

    + INIT_WORK(&portdev->config_work, &config_work_handler);
    + INIT_WORK(&portdev->control_work, &control_work_handler);
    +
    if (multiport) {
    unsigned int nr_added_bufs;

    spin_lock_init(&portdev->c_ivq_lock);
    spin_lock_init(&portdev->c_ovq_lock);
    - INIT_WORK(&portdev->control_work, &control_work_handler);

    nr_added_bufs = fill_queue(portdev->c_ivq,
    &portdev->c_ivq_lock);
    @@ -1825,6 +1839,8 @@ static void virtcons_remove(struct virtio_device *vdev)
    /* Finish up work that's lined up */
    if (use_multiport(portdev))
    cancel_work_sync(&portdev->control_work);
    + else
    + cancel_work_sync(&portdev->config_work);

    list_for_each_entry_safe(port, port2, &portdev->ports, list)
    unplug_port(port);
    @@ -1866,6 +1882,7 @@ static int virtcons_freeze(struct virtio_device *vdev)

    virtqueue_disable_cb(portdev->c_ivq);
    cancel_work_sync(&portdev->control_work);
    + cancel_work_sync(&portdev->config_work);
    /*
    * Once more: if control_work_handler() was running, it would
    * enable the cb as the last step.
    diff --git a/drivers/cpufreq/speedstep-lib.c b/drivers/cpufreq/speedstep-lib.c
    index 7047821..4ab7a21 100644
    --- a/drivers/cpufreq/speedstep-lib.c
    +++ b/drivers/cpufreq/speedstep-lib.c
    @@ -400,6 +400,7 @@ unsigned int speedstep_get_freqs(enum speedstep_processor processor,

    pr_debug("previous speed is %u\n", prev_speed);

    + preempt_disable();
    local_irq_save(flags);

    /* switch to low state */
    @@ -464,6 +465,8 @@ unsigned int speedstep_get_freqs(enum speedstep_processor processor,

    out:
    local_irq_restore(flags);
    + preempt_enable();
    +
    return ret;
    }
    EXPORT_SYMBOL_GPL(speedstep_get_freqs);
    diff --git a/drivers/cpufreq/speedstep-smi.c b/drivers/cpufreq/speedstep-smi.c
    index 6a457fc..b01926d 100644
    --- a/drivers/cpufreq/speedstep-smi.c
    +++ b/drivers/cpufreq/speedstep-smi.c
    @@ -188,6 +188,7 @@ static void speedstep_set_state(unsigned int state)
    return;

    /* Disable IRQs */
    + preempt_disable();
    local_irq_save(flags);

    command = (smi_sig & 0xffffff00) | (smi_cmd & 0xff);
    @@ -198,9 +199,19 @@ static void speedstep_set_state(unsigned int state)

    do {
    if (retry) {
    + /*
    + * We need to enable interrupts, otherwise the blockage
    + * won't resolve.
    + *
    + * We disable preemption so that other processes don't
    + * run. If other processes were running, they could
    + * submit more DMA requests, making the blockage worse.
    + */
    pr_debug("retry %u, previous result %u, waiting...\n",
    retry, result);
    + local_irq_enable();
    mdelay(retry * 50);
    + local_irq_disable();
    }
    retry++;
    __asm__ __volatile__(
    @@ -217,6 +228,7 @@ static void speedstep_set_state(unsigned int state)

    /* enable IRQs */
    local_irq_restore(flags);
    + preempt_enable();

    if (new_state == state)
    pr_debug("change to %u MHz succeeded after %u tries "
    diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
    index 0924c30..593ff71 100644
    --- a/drivers/edac/sb_edac.c
    +++ b/drivers/edac/sb_edac.c
    @@ -672,7 +672,7 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
    u32 reg;
    u64 limit, prv = 0;
    u64 tmp_mb;
    - u32 mb, kb;
    + u32 gb, mb;
    u32 rir_way;

    /*
    @@ -685,9 +685,9 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
    pvt->tolm = GET_TOLM(reg);
    tmp_mb = (1 + pvt->tolm) >> 20;

    - mb = div_u64_rem(tmp_mb, 1000, &kb);
    - debugf0("TOLM: %u.%03u GB (0x%016Lx)\n",
    - mb, kb, (u64)pvt->tolm);
    + gb = div_u64_rem(tmp_mb, 1024, &mb);
    + debugf0("TOHM: %u.%03u GB (0x%016Lx)\n",
    + gb, (mb*1000)/1024, (u64)pvt->tohm);

    /* Address range is already 45:25 */
    pci_read_config_dword(pvt->pci_sad1, TOHM,
    @@ -695,9 +695,9 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
    pvt->tohm = GET_TOHM(reg);
    tmp_mb = (1 + pvt->tohm) >> 20;

    - mb = div_u64_rem(tmp_mb, 1000, &kb);
    + gb = div_u64_rem(tmp_mb, 1024, &mb);
    debugf0("TOHM: %u.%03u GB (0x%016Lx)",
    - mb, kb, (u64)pvt->tohm);
    + gb, (mb*1000)/1024, (u64)pvt->tohm);

    /*
    * Step 2) Get SAD range and SAD Interleave list
    @@ -719,11 +719,11 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
    break;

    tmp_mb = (limit + 1) >> 20;
    - mb = div_u64_rem(tmp_mb, 1000, &kb);
    + gb = div_u64_rem(tmp_mb, 1000, &mb);
    debugf0("SAD#%d %s up to %u.%03u GB (0x%016Lx) %s reg=0x%08x\n",
    n_sads,
    get_dram_attr(reg),
    - mb, kb,
    + gb, (mb*1000)/1024,
    ((u64)tmp_mb) << 20L,
    INTERLEAVE_MODE(reg) ? "Interleave: 8:6" : "Interleave: [8:6]XOR[18:16]",
    reg);
    @@ -753,9 +753,9 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
    break;
    tmp_mb = (limit + 1) >> 20;

    - mb = div_u64_rem(tmp_mb, 1000, &kb);
    + gb = div_u64_rem(tmp_mb, 1000, &mb);
    debugf0("TAD#%d: up to %u.%03u GB (0x%016Lx), socket interleave %d, memory interleave %d, TGT: %d, %d, %d, %d, reg=0x%08x\n",
    - n_tads, mb, kb,
    + n_tads, gb, (mb*1000)/1024,
    ((u64)tmp_mb) << 20L,
    (u32)TAD_SOCK(reg),
    (u32)TAD_CH(reg),
    @@ -778,10 +778,10 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
    tad_ch_nilv_offset[j],
    &reg);
    tmp_mb = TAD_OFFSET(reg) >> 20;
    - mb = div_u64_rem(tmp_mb, 1000, &kb);
    + gb = div_u64_rem(tmp_mb, 1024, &mb);
    debugf0("TAD CH#%d, offset #%d: %u.%03u GB (0x%016Lx), reg=0x%08x\n",
    i, j,
    - mb, kb,
    + gb, (mb*1000)/1024,
    ((u64)tmp_mb) << 20L,
    reg);
    }
    @@ -803,10 +803,10 @@ static void get_memory_layout(const struct mem_ctl_info *mci)

    tmp_mb = RIR_LIMIT(reg) >> 20;
    rir_way = 1 << RIR_WAY(reg);
    - mb = div_u64_rem(tmp_mb, 1000, &kb);
    + gb = div_u64_rem(tmp_mb, 1024, &mb);
    debugf0("CH#%d RIR#%d, limit: %u.%03u GB (0x%016Lx), way: %d, reg=0x%08x\n",
    i, j,
    - mb, kb,
    + gb, (mb*1000)/1024,
    ((u64)tmp_mb) << 20L,
    rir_way,
    reg);
    @@ -817,10 +817,10 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
    &reg);
    tmp_mb = RIR_OFFSET(reg) << 6;

    - mb = div_u64_rem(tmp_mb, 1000, &kb);
    + gb = div_u64_rem(tmp_mb, 1024, &mb);
    debugf0("CH#%d RIR#%d INTL#%d, offset %u.%03u GB (0x%016Lx), tgt: %d, reg=0x%08x\n",
    i, j, k,
    - mb, kb,
    + gb, (mb*1000)/1024,
    ((u64)tmp_mb) << 20L,
    (u32)RIR_RNK_TGT(reg),
    reg);
    @@ -858,7 +858,7 @@ static int get_memory_error_data(struct mem_ctl_info *mci,
    u8 ch_way,sck_way;
    u32 tad_offset;
    u32 rir_way;
    - u32 mb, kb;
    + u32 gb, mb;
    u64 ch_addr, offset, limit, prv = 0;


    @@ -1084,10 +1084,10 @@ static int get_memory_error_data(struct mem_ctl_info *mci,
    continue;

    limit = RIR_LIMIT(reg);
    - mb = div_u64_rem(limit >> 20, 1000, &kb);
    + gb = div_u64_rem(limit >> 20, 1024, &mb);
    debugf0("RIR#%d, limit: %u.%03u GB (0x%016Lx), way: %d\n",
    n_rir,
    - mb, kb,
    + gb, (mb*1000)/1024,
    limit,
    1 << RIR_WAY(reg));
    if (ch_addr <= limit)
    diff --git a/drivers/gpio/gpio-tps65912.c b/drivers/gpio/gpio-tps65912.c
    index 79e66c0..2712680 100644
    --- a/drivers/gpio/gpio-tps65912.c
    +++ b/drivers/gpio/gpio-tps65912.c
    @@ -26,9 +26,12 @@ struct tps65912_gpio_data {
    struct gpio_chip gpio_chip;
    };

    +#define to_tgd(gc) container_of(gc, struct tps65912_gpio_data, gpio_chip)
    +
    static int tps65912_gpio_get(struct gpio_chip *gc, unsigned offset)
    {
    - struct tps65912 *tps65912 = container_of(gc, struct tps65912, gpio);
    + struct tps65912_gpio_data *tps65912_gpio = to_tgd(gc);
    + struct tps65912 *tps65912 = tps65912_gpio->tps65912;
    int val;

    val = tps65912_reg_read(tps65912, TPS65912_GPIO1 + offset);
    @@ -42,7 +45,8 @@ static int tps65912_gpio_get(struct gpio_chip *gc, unsigned offset)
    static void tps65912_gpio_set(struct gpio_chip *gc, unsigned offset,
    int value)
    {
    - struct tps65912 *tps65912 = container_of(gc, struct tps65912, gpio);
    + struct tps65912_gpio_data *tps65912_gpio = to_tgd(gc);
    + struct tps65912 *tps65912 = tps65912_gpio->tps65912;

    if (value)
    tps65912_set_bits(tps65912, TPS65912_GPIO1 + offset,
    @@ -55,7 +59,8 @@ static void tps65912_gpio_set(struct gpio_chip *gc, unsigned offset,
    static int tps65912_gpio_output(struct gpio_chip *gc, unsigned offset,
    int value)
    {
    - struct tps65912 *tps65912 = container_of(gc, struct tps65912, gpio);
    + struct tps65912_gpio_data *tps65912_gpio = to_tgd(gc);
    + struct tps65912 *tps65912 = tps65912_gpio->tps65912;

    /* Set the initial value */
    tps65912_gpio_set(gc, offset, value);
    @@ -66,7 +71,8 @@ static int tps65912_gpio_output(struct gpio_chip *gc, unsigned offset,

    static int tps65912_gpio_input(struct gpio_chip *gc, unsigned offset)
    {
    - struct tps65912 *tps65912 = container_of(gc, struct tps65912, gpio);
    + struct tps65912_gpio_data *tps65912_gpio = to_tgd(gc);
    + struct tps65912 *tps65912 = tps65912_gpio->tps65912;

    return tps65912_clear_bits(tps65912, TPS65912_GPIO1 + offset,
    GPIO_CFG_MASK);
    diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
    index 8d1724c..5325c20 100644
    --- a/drivers/gpu/drm/radeon/atombios_dp.c
    +++ b/drivers/gpu/drm/radeon/atombios_dp.c
    @@ -777,10 +777,8 @@ static int radeon_dp_link_train_init(struct radeon_dp_link_train_info *dp_info)
    radeon_write_dpcd_reg(dp_info->radeon_connector,
    DP_DOWNSPREAD_CTRL, 0);

    - if ((dp_info->connector->connector_type == DRM_MODE_CONNECTOR_eDP) &&
    - (dig->panel_mode == DP_PANEL_MODE_INTERNAL_DP2_MODE)) {
    + if (dig->panel_mode == DP_PANEL_MODE_INTERNAL_DP2_MODE)
    radeon_write_dpcd_reg(dp_info->radeon_connector, DP_EDP_CONFIGURATION_SET, 1);
    - }

    /* set the lane count on the sink */
    tmp = dp_info->dp_lane_count;
    diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
    index 01434ef..c5fe79e 100644
    --- a/drivers/gpu/drm/radeon/evergreen.c
    +++ b/drivers/gpu/drm/radeon/evergreen.c
    @@ -3474,6 +3474,9 @@ int evergreen_init(struct radeon_device *rdev)
    }
    }

    + /* posting read */
    + RREG32(SRBM_STATUS);
    +
    return 0;
    }

    diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
    index 40ed0e5..8ec5b85 100644
    --- a/drivers/gpu/drm/radeon/r100.c
    +++ b/drivers/gpu/drm/radeon/r100.c
    @@ -726,6 +726,10 @@ int r100_irq_set(struct radeon_device *rdev)
    tmp |= RADEON_FP2_DETECT_MASK;
    }
    WREG32(RADEON_GEN_INT_CNTL, tmp);
    +
    + /* read back to post the write */
    + RREG32(RADEON_GEN_INT_CNTL);
    +
    return 0;
    }

    diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
    index 1555cd6..9c7062d 100644
    --- a/drivers/gpu/drm/radeon/r600.c
    +++ b/drivers/gpu/drm/radeon/r600.c
    @@ -3184,6 +3184,9 @@ int r600_irq_set(struct radeon_device *rdev)
    WREG32(DC_HOT_PLUG_DETECT3_INT_CONTROL, hpd3);
    }

    + /* posting read */
    + RREG32(R_000E50_SRBM_STATUS);
    +
    return 0;
    }

    diff --git a/drivers/gpu/drm/radeon/radeon_bios.c b/drivers/gpu/drm/radeon/radeon_bios.c
    index d306cc8..ef56e4e 100644
    --- a/drivers/gpu/drm/radeon/radeon_bios.c
    +++ b/drivers/gpu/drm/radeon/radeon_bios.c
    @@ -76,7 +76,7 @@ static bool igp_read_bios_from_vram(struct radeon_device *rdev)

    static bool radeon_read_bios(struct radeon_device *rdev)
    {
    - uint8_t __iomem *bios;
    + uint8_t __iomem *bios, val1, val2;
    size_t size;

    rdev->bios = NULL;
    @@ -86,15 +86,19 @@ static bool radeon_read_bios(struct radeon_device *rdev)
    return false;
    }

    - if (size == 0 || bios[0] != 0x55 || bios[1] != 0xaa) {
    + val1 = readb(&bios[0]);
    + val2 = readb(&bios[1]);
    +
    + if (size == 0 || val1 != 0x55 || val2 != 0xaa) {
    pci_unmap_rom(rdev->pdev, bios);
    return false;
    }
    - rdev->bios = kmemdup(bios, size, GFP_KERNEL);
    + rdev->bios = kzalloc(size, GFP_KERNEL);
    if (rdev->bios == NULL) {
    pci_unmap_rom(rdev->pdev, bios);
    return false;
    }
    + memcpy_fromio(rdev->bios, bios, size);
    pci_unmap_rom(rdev->pdev, bios);
    return true;
    }
    diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
    index cf723c4..f3ee360 100644
    --- a/drivers/gpu/drm/radeon/radeon_cs.c
    +++ b/drivers/gpu/drm/radeon/radeon_cs.c
    @@ -167,11 +167,13 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data)
    u32 ring = RADEON_CS_RING_GFX;
    s32 priority = 0;

    + INIT_LIST_HEAD(&p->validated);
    +
    if (!cs->num_chunks) {
    return 0;
    }
    +
    /* get chunks */
    - INIT_LIST_HEAD(&p->validated);
    p->idx = 0;
    p->chunk_ib_idx = -1;
    p->chunk_relocs_idx = -1;
    diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
    index 739eb0d..07b6dbf 100644
    --- a/drivers/gpu/drm/radeon/rs600.c
    +++ b/drivers/gpu/drm/radeon/rs600.c
    @@ -585,6 +585,10 @@ int rs600_irq_set(struct radeon_device *rdev)
    WREG32(R_006540_DxMODE_INT_MASK, mode_int);
    WREG32(R_007D08_DC_HOT_PLUG_DETECT1_INT_CONTROL, hpd1);
    WREG32(R_007D18_DC_HOT_PLUG_DETECT2_INT_CONTROL, hpd2);
    +
    + /* posting read */
    + RREG32(R_000040_GEN_INT_CNTL);
    +
    return 0;
    }

    diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
    index e710073..068b21f 100644
    --- a/drivers/gpu/drm/radeon/si.c
    +++ b/drivers/gpu/drm/radeon/si.c
    @@ -4126,6 +4126,9 @@ int si_init(struct radeon_device *rdev)
    return -EINVAL;
    }

    + /* posting read */
    + RREG32(SRBM_STATUS);
    +
    return 0;
    }

    diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
    index db50604..e43341a 100644
    --- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
    +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
    @@ -547,21 +547,6 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
    goto out_err1;
    }

    - ret = ttm_bo_init_mm(&dev_priv->bdev, TTM_PL_VRAM,
    - (dev_priv->vram_size >> PAGE_SHIFT));
    - if (unlikely(ret != 0)) {
    - DRM_ERROR("Failed initializing memory manager for VRAM.\n");
    - goto out_err2;
    - }
    -
    - dev_priv->has_gmr = true;
    - if (ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_GMR,
    - dev_priv->max_gmr_ids) != 0) {
    - DRM_INFO("No GMR memory available. "
    - "Graphics memory resources are very limited.\n");
    - dev_priv->has_gmr = false;
    - }
    -
    dev_priv->mmio_mtrr = drm_mtrr_add(dev_priv->mmio_start,
    dev_priv->mmio_size, DRM_MTRR_WC);

    @@ -618,6 +603,22 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
    ret = vmw_3d_resource_inc(dev_priv, true);
    if (unlikely(ret != 0))
    goto out_no_fifo;
    +
    + ret = ttm_bo_init_mm(&dev_priv->bdev, TTM_PL_VRAM,
    + (dev_priv->vram_size >> PAGE_SHIFT));
    + if (unlikely(ret != 0)) {
    + DRM_ERROR("Failed initializing memory manager for VRAM.\n");
    + goto out_no_vram;
    + }
    +
    + dev_priv->has_gmr = true;
    + if (ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_GMR,
    + dev_priv->max_gmr_ids) != 0) {
    + DRM_INFO("No GMR memory available. "
    + "Graphics memory resources are very limited.\n");
    + dev_priv->has_gmr = false;
    + }
    +
    vmw_kms_save_vga(dev_priv);

    /* Start kms and overlay systems, needs fifo. */
    @@ -663,6 +664,10 @@ out_no_kms:
    vmw_kms_restore_vga(dev_priv);
    vmw_3d_resource_dec(dev_priv, false);
    }
    +out_no_vram:
    + if (dev_priv->has_gmr)
    + (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
    + (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
    out_no_fifo:
    vmw_fence_manager_takedown(dev_priv->fman);
    out_no_fman:
    @@ -677,9 +682,6 @@ out_err4:
    out_err3:
    drm_mtrr_del(dev_priv->mmio_mtrr, dev_priv->mmio_start,
    dev_priv->mmio_size, DRM_MTRR_WC);
    - if (dev_priv->has_gmr)
    - (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
    - (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
    out_err2:
    (void)ttm_bo_device_release(&dev_priv->bdev);
    out_err1:
    @@ -709,6 +711,11 @@ static int vmw_driver_unload(struct drm_device *dev)
    }
    vmw_kms_close(dev_priv);
    vmw_overlay_close(dev_priv);
    +
    + if (dev_priv->has_gmr)
    + (void)ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
    + (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
    +
    vmw_fence_manager_takedown(dev_priv->fman);
    if (dev_priv->stealth)
    pci_release_region(dev->pdev, 2);
    @@ -719,9 +726,6 @@ static int vmw_driver_unload(struct drm_device *dev)
    iounmap(dev_priv->mmio_virt);
    drm_mtrr_del(dev_priv->mmio_mtrr, dev_priv->mmio_start,
    dev_priv->mmio_size, DRM_MTRR_WC);
    - if (dev_priv->has_gmr)
    - (void)ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
    - (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
    (void)ttm_bo_device_release(&dev_priv->bdev);
    vmw_ttm_global_release(dev_priv);
    idr_destroy(&dev_priv->surface_idr);
    diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
    index a841123..d0254be 100644
    --- a/drivers/infiniband/core/umem.c
    +++ b/drivers/infiniband/core/umem.c
    @@ -94,6 +94,14 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
    if (dmasync)
    dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs);

    + /*
    + * If the combination of the addr and size requested for this memory
    + * region causes an integer overflow, return error.
    + */
    + if (((addr + size) < addr) ||
    + PAGE_ALIGN(addr + size) < (addr + size))
    + return ERR_PTR(-EINVAL);
    +
    if (!can_do_mlock())
    return ERR_PTR(-EPERM);

    diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
    index 604556d..5b51e4e 100644
    --- a/drivers/infiniband/core/uverbs_main.c
    +++ b/drivers/infiniband/core/uverbs_main.c
    @@ -451,6 +451,7 @@ static void ib_uverbs_async_handler(struct ib_uverbs_file *file,

    entry->desc.async.element = element;
    entry->desc.async.event_type = event;
    + entry->desc.async.reserved = 0;
    entry->counter = counter;

    list_add_tail(&entry->list, &file->async_file->event_list);
    diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
    index 259b067..df76538 100644
    --- a/drivers/infiniband/hw/mlx4/mad.c
    +++ b/drivers/infiniband/hw/mlx4/mad.c
    @@ -44,6 +44,14 @@ enum {
    MLX4_IB_VENDOR_CLASS2 = 0xa
    };

    +/* Counters should be saturate once they reach their maximum value */
    +#define ASSIGN_32BIT_COUNTER(counter, value) do {\
    + if ((value) > (u32)~0U) \
    + counter = cpu_to_be32((u32)~0U); \
    + else \
    + counter = cpu_to_be32(value); \
    +} while (0)
    +
    int mlx4_MAD_IFC(struct mlx4_ib_dev *dev, int ignore_mkey, int ignore_bkey,
    int port, struct ib_wc *in_wc, struct ib_grh *in_grh,
    void *in_mad, void *response_mad)
    @@ -304,10 +312,14 @@ static int ib_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
    static void edit_counter(struct mlx4_counter *cnt,
    struct ib_pma_portcounters *pma_cnt)
    {
    - pma_cnt->port_xmit_data = cpu_to_be32((be64_to_cpu(cnt->tx_bytes)>>2));
    - pma_cnt->port_rcv_data = cpu_to_be32((be64_to_cpu(cnt->rx_bytes)>>2));
    - pma_cnt->port_xmit_packets = cpu_to_be32(be64_to_cpu(cnt->tx_frames));
    - pma_cnt->port_rcv_packets = cpu_to_be32(be64_to_cpu(cnt->rx_frames));
    + ASSIGN_32BIT_COUNTER(pma_cnt->port_xmit_data,
    + (be64_to_cpu(cnt->tx_bytes) >> 2));
    + ASSIGN_32BIT_COUNTER(pma_cnt->port_rcv_data,
    + (be64_to_cpu(cnt->rx_bytes) >> 2));
    + ASSIGN_32BIT_COUNTER(pma_cnt->port_xmit_packets,
    + be64_to_cpu(cnt->tx_frames));
    + ASSIGN_32BIT_COUNTER(pma_cnt->port_rcv_packets,
    + be64_to_cpu(cnt->rx_frames));
    }

    static int iboe_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
    diff --git a/drivers/infiniband/hw/qib/qib.h b/drivers/infiniband/hw/qib/qib.h
    index 6b811e3..c7d4ef1 100644
    --- a/drivers/infiniband/hw/qib/qib.h
    +++ b/drivers/infiniband/hw/qib/qib.h
    @@ -1013,12 +1013,6 @@ struct qib_devdata {
    /* control high-level access to EEPROM */
    struct mutex eep_lock;
    uint64_t traffic_wds;
    - /* active time is kept in seconds, but logged in hours */
    - atomic_t active_time;
    - /* Below are nominal shadow of EEPROM, new since last EEPROM update */
    - uint8_t eep_st_errs[QIB_EEP_LOG_CNT];
    - uint8_t eep_st_new_errs[QIB_EEP_LOG_CNT];
    - uint16_t eep_hrs;
    /*
    * masks for which bits of errs, hwerrs that cause
    * each of the counters to increment.
    @@ -1235,8 +1229,7 @@ int qib_twsi_blk_rd(struct qib_devdata *dd, int dev, int addr, void *buffer,
    int qib_twsi_blk_wr(struct qib_devdata *dd, int dev, int addr,
    const void *buffer, int len);
    void qib_get_eeprom_info(struct qib_devdata *);
    -int qib_update_eeprom_log(struct qib_devdata *dd);
    -void qib_inc_eeprom_err(struct qib_devdata *dd, u32 eidx, u32 incr);
    +#define qib_inc_eeprom_err(dd, eidx, incr)
    void qib_dump_lookup_output_queue(struct qib_devdata *);
    void qib_force_pio_avail_update(struct qib_devdata *);
    void qib_clear_symerror_on_linkup(unsigned long opaque);
    diff --git a/drivers/infiniband/hw/qib/qib_eeprom.c b/drivers/infiniband/hw/qib/qib_eeprom.c
    index 92d9cfe..161ef71 100644
    --- a/drivers/infiniband/hw/qib/qib_eeprom.c
    +++ b/drivers/infiniband/hw/qib/qib_eeprom.c
    @@ -263,189 +263,8 @@ void qib_get_eeprom_info(struct qib_devdata *dd)
    qib_dev_err(dd, "Board SN %s did not pass functional "
    "test: %s\n", dd->serial, ifp->if_comment);

    - memcpy(&dd->eep_st_errs, &ifp->if_errcntp, QIB_EEP_LOG_CNT);
    - /*
    - * Power-on (actually "active") hours are kept as little-endian value
    - * in EEPROM, but as seconds in a (possibly as small as 24-bit)
    - * atomic_t while running.
    - */
    - atomic_set(&dd->active_time, 0);
    - dd->eep_hrs = ifp->if_powerhour[0] | (ifp->if_powerhour[1] << 8);
    -
    done:
    vfree(buf);

    bail:;
    }
    -
    -/**
    - * qib_update_eeprom_log - copy active-time and error counters to eeprom
    - * @dd: the qlogic_ib device
    - *
    - * Although the time is kept as seconds in the qib_devdata struct, it is
    - * rounded to hours for re-write, as we have only 16 bits in EEPROM.
    - * First-cut code reads whole (expected) struct qib_flash, modifies,
    - * re-writes. Future direction: read/write only what we need, assuming
    - * that the EEPROM had to have been "good enough" for driver init, and
    - * if not, we aren't making it worse.
    - *
    - */
    -int qib_update_eeprom_log(struct qib_devdata *dd)
    -{
    - void *buf;
    - struct qib_flash *ifp;
    - int len, hi_water;
    - uint32_t new_time, new_hrs;
    - u8 csum;
    - int ret, idx;
    - unsigned long flags;
    -
    - /* first, check if we actually need to do anything. */
    - ret = 0;
    - for (idx = 0; idx < QIB_EEP_LOG_CNT; ++idx) {
    - if (dd->eep_st_new_errs[idx]) {
    - ret = 1;
    - break;
    - }
    - }
    - new_time = atomic_read(&dd->active_time);
    -
    - if (ret == 0 && new_time < 3600)
    - goto bail;
    -
    - /*
    - * The quick-check above determined that there is something worthy
    - * of logging, so get current contents and do a more detailed idea.
    - * read full flash, not just currently used part, since it may have
    - * been written with a newer definition
    - */
    - len = sizeof(struct qib_flash);
    - buf = vmalloc(len);
    - ret = 1;
    - if (!buf) {
    - qib_dev_err(dd, "Couldn't allocate memory to read %u "
    - "bytes from eeprom for logging\n", len);
    - goto bail;
    - }
    -
    - /* Grab semaphore and read current EEPROM. If we get an
    - * error, let go, but if not, keep it until we finish write.
    - */
    - ret = mutex_lock_interruptible(&dd->eep_lock);
    - if (ret) {
    - qib_dev_err(dd, "Unable to acquire EEPROM for logging\n");
    - goto free_bail;
    - }
    - ret = qib_twsi_blk_rd(dd, dd->twsi_eeprom_dev, 0, buf, len);
    - if (ret) {
    - mutex_unlock(&dd->eep_lock);
    - qib_dev_err(dd, "Unable read EEPROM for logging\n");
    - goto free_bail;
    - }
    - ifp = (struct qib_flash *)buf;
    -
    - csum = flash_csum(ifp, 0);
    - if (csum != ifp->if_csum) {
    - mutex_unlock(&dd->eep_lock);
    - qib_dev_err(dd, "EEPROM cks err (0x%02X, S/B 0x%02X)\n",
    - csum, ifp->if_csum);
    - ret = 1;
    - goto free_bail;
    - }
    - hi_water = 0;
    - spin_lock_irqsave(&dd->eep_st_lock, flags);
    - for (idx = 0; idx < QIB_EEP_LOG_CNT; ++idx) {
    - int new_val = dd->eep_st_new_errs[idx];
    - if (new_val) {
    - /*
    - * If we have seen any errors, add to EEPROM values
    - * We need to saturate at 0xFF (255) and we also
    - * would need to adjust the checksum if we were
    - * trying to minimize EEPROM traffic
    - * Note that we add to actual current count in EEPROM,
    - * in case it was altered while we were running.
    - */
    - new_val += ifp->if_errcntp[idx];
    - if (new_val > 0xFF)
    - new_val = 0xFF;
    - if (ifp->if_errcntp[idx] != new_val) {
    - ifp->if_errcntp[idx] = new_val;
    - hi_water = offsetof(struct qib_flash,
    - if_errcntp) + idx;
    - }
    - /*
    - * update our shadow (used to minimize EEPROM
    - * traffic), to match what we are about to write.
    - */
    - dd->eep_st_errs[idx] = new_val;
    - dd->eep_st_new_errs[idx] = 0;
    - }
    - }
    - /*
    - * Now update active-time. We would like to round to the nearest hour
    - * but unless atomic_t are sure to be proper signed ints we cannot,
    - * because we need to account for what we "transfer" to EEPROM and
    - * if we log an hour at 31 minutes, then we would need to set
    - * active_time to -29 to accurately count the _next_ hour.
    - */
    - if (new_time >= 3600) {
    - new_hrs = new_time / 3600;
    - atomic_sub((new_hrs * 3600), &dd->active_time);
    - new_hrs += dd->eep_hrs;
    - if (new_hrs > 0xFFFF)
    - new_hrs = 0xFFFF;
    - dd->eep_hrs = new_hrs;
    - if ((new_hrs & 0xFF) != ifp->if_powerhour[0]) {
    - ifp->if_powerhour[0] = new_hrs & 0xFF;
    - hi_water = offsetof(struct qib_flash, if_powerhour);
    - }
    - if ((new_hrs >> 8) != ifp->if_powerhour[1]) {
    - ifp->if_powerhour[1] = new_hrs >> 8;
    - hi_water = offsetof(struct qib_flash, if_powerhour) + 1;
    - }
    - }
    - /*
    - * There is a tiny possibility that we could somehow fail to write
    - * the EEPROM after updating our shadows, but problems from holding
    - * the spinlock too long are a much bigger issue.
    - */
    - spin_unlock_irqrestore(&dd->eep_st_lock, flags);
    - if (hi_water) {
    - /* we made some change to the data, uopdate cksum and write */
    - csum = flash_csum(ifp, 1);
    - ret = eeprom_write_with_enable(dd, 0, buf, hi_water + 1);
    - }
    - mutex_unlock(&dd->eep_lock);
    - if (ret)
    - qib_dev_err(dd, "Failed updating EEPROM\n");
    -
    -free_bail:
    - vfree(buf);
    -bail:
    - return ret;
    -}
    -
    -/**
    - * qib_inc_eeprom_err - increment one of the four error counters
    - * that are logged to EEPROM.
    - * @dd: the qlogic_ib device
    - * @eidx: 0..3, the counter to increment
    - * @incr: how much to add
    - *
    - * Each counter is 8-bits, and saturates at 255 (0xFF). They
    - * are copied to the EEPROM (aka flash) whenever qib_update_eeprom_log()
    - * is called, but it can only be called in a context that allows sleep.
    - * This function can be called even at interrupt level.
    - */
    -void qib_inc_eeprom_err(struct qib_devdata *dd, u32 eidx, u32 incr)
    -{
    - uint new_val;
    - unsigned long flags;
    -
    - spin_lock_irqsave(&dd->eep_st_lock, flags);
    - new_val = dd->eep_st_new_errs[eidx] + incr;
    - if (new_val > 255)
    - new_val = 255;
    - dd->eep_st_new_errs[eidx] = new_val;
    - spin_unlock_irqrestore(&dd->eep_st_lock, flags);
    -}
    diff --git a/drivers/infiniband/hw/qib/qib_iba6120.c b/drivers/infiniband/hw/qib/qib_iba6120.c
    index d0c64d5..eb60abd 100644
    --- a/drivers/infiniband/hw/qib/qib_iba6120.c
    +++ b/drivers/infiniband/hw/qib/qib_iba6120.c
    @@ -2674,8 +2674,6 @@ static void qib_get_6120_faststats(unsigned long opaque)
    spin_lock_irqsave(&dd->eep_st_lock, flags);
    traffic_wds -= dd->traffic_wds;
    dd->traffic_wds += traffic_wds;
    - if (traffic_wds >= QIB_TRAFFIC_ACTIVE_THRESHOLD)
    - atomic_add(5, &dd->active_time); /* S/B #define */
    spin_unlock_irqrestore(&dd->eep_st_lock, flags);

    qib_chk_6120_errormask(dd);
    diff --git a/drivers/infiniband/hw/qib/qib_iba7220.c b/drivers/infiniband/hw/qib/qib_iba7220.c
    index 3c722f7..b62c7f2 100644
    --- a/drivers/infiniband/hw/qib/qib_iba7220.c
    +++ b/drivers/infiniband/hw/qib/qib_iba7220.c
    @@ -3292,8 +3292,6 @@ static void qib_get_7220_faststats(unsigned long opaque)
    spin_lock_irqsave(&dd->eep_st_lock, flags);
    traffic_wds -= dd->traffic_wds;
    dd->traffic_wds += traffic_wds;
    - if (traffic_wds >= QIB_TRAFFIC_ACTIVE_THRESHOLD)
    - atomic_add(5, &dd->active_time); /* S/B #define */
    spin_unlock_irqrestore(&dd->eep_st_lock, flags);
    done:
    mod_timer(&dd->stats_timer, jiffies + HZ * ACTIVITY_TIMER);
    diff --git a/drivers/infiniband/hw/qib/qib_iba7322.c b/drivers/infiniband/hw/qib/qib_iba7322.c
    index d252053..0d8e348 100644
    --- a/drivers/infiniband/hw/qib/qib_iba7322.c
    +++ b/drivers/infiniband/hw/qib/qib_iba7322.c
    @@ -4841,8 +4841,6 @@ static void qib_get_7322_faststats(unsigned long opaque)
    spin_lock_irqsave(&ppd->dd->eep_st_lock, flags);
    traffic_wds -= ppd->dd->traffic_wds;
    ppd->dd->traffic_wds += traffic_wds;
    - if (traffic_wds >= QIB_TRAFFIC_ACTIVE_THRESHOLD)
    - atomic_add(ACTIVITY_TIMER, &ppd->dd->active_time);
    spin_unlock_irqrestore(&ppd->dd->eep_st_lock, flags);
    if (ppd->cpspec->qdr_dfe_on && (ppd->link_speed_active &
    QIB_IB_QDR) &&
    diff --git a/drivers/infiniband/hw/qib/qib_init.c b/drivers/infiniband/hw/qib/qib_init.c
    index cf0cd30..0776dd0 100644
    --- a/drivers/infiniband/hw/qib/qib_init.c
    +++ b/drivers/infiniband/hw/qib/qib_init.c
    @@ -765,7 +765,6 @@ static void qib_shutdown_device(struct qib_devdata *dd)
    dd->f_quiet_serdes(ppd);
    }

    - qib_update_eeprom_log(dd);
    }

    /**
    diff --git a/drivers/infiniband/hw/qib/qib_sysfs.c b/drivers/infiniband/hw/qib/qib_sysfs.c
    index dae5160..c01cb11 100644
    --- a/drivers/infiniband/hw/qib/qib_sysfs.c
    +++ b/drivers/infiniband/hw/qib/qib_sysfs.c
    @@ -550,28 +550,6 @@ bail:
    return ret < 0 ? ret : count;
    }

    -static ssize_t show_logged_errs(struct device *device,
    - struct device_attribute *attr, char *buf)
    -{
    - struct qib_ibdev *dev =
    - container_of(device, struct qib_ibdev, ibdev.dev);
    - struct qib_devdata *dd = dd_from_dev(dev);
    - int idx, count;
    -
    - /* force consistency with actual EEPROM */
    - if (qib_update_eeprom_log(dd) != 0)
    - return -ENXIO;
    -
    - count = 0;
    - for (idx = 0; idx < QIB_EEP_LOG_CNT; ++idx) {
    - count += scnprintf(buf + count, PAGE_SIZE - count, "%d%c",
    - dd->eep_st_errs[idx],
    - idx == (QIB_EEP_LOG_CNT - 1) ? '\n' : ' ');
    - }
    -
    - return count;
    -}
    -
    /*
    * Dump tempsense regs. in decimal, to ease shell-scripts.
    */
    @@ -618,7 +596,6 @@ static DEVICE_ATTR(nctxts, S_IRUGO, show_nctxts, NULL);
    static DEVICE_ATTR(nfreectxts, S_IRUGO, show_nfreectxts, NULL);
    static DEVICE_ATTR(serial, S_IRUGO, show_serial, NULL);
    static DEVICE_ATTR(boardversion, S_IRUGO, show_boardversion, NULL);
    -static DEVICE_ATTR(logged_errors, S_IRUGO, show_logged_errs, NULL);
    static DEVICE_ATTR(tempsense, S_IRUGO, show_tempsense, NULL);
    static DEVICE_ATTR(localbus_info, S_IRUGO, show_localbus_info, NULL);
    static DEVICE_ATTR(chip_reset, S_IWUSR, NULL, store_chip_reset);
    @@ -632,7 +609,6 @@ static struct device_attribute *qib_attributes[] = {
    &dev_attr_nfreectxts,
    &dev_attr_serial,
    &dev_attr_boardversion,
    - &dev_attr_logged_errors,
    &dev_attr_tempsense,
    &dev_attr_localbus_info,
    &dev_attr_chip_reset,
    diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
    index 97e5f6f..6d6198a 100644
    --- a/drivers/input/mouse/synaptics.c
    +++ b/drivers/input/mouse/synaptics.c
    @@ -274,8 +274,14 @@ static int synaptics_resolution(struct psmouse *psmouse)
    }
    }

    - if (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 7 &&
    - SYN_CAP_MIN_DIMENSIONS(priv->ext_cap_0c)) {
    + if (SYN_CAP_MIN_DIMENSIONS(priv->ext_cap_0c) &&
    + (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 7 ||
    + /*
    + * Firmware v8.1 does not report proper number of extended
    + * capabilities, but has been proven to report correct min
    + * coordinates.
    + */
    + SYN_ID_FULL(priv->identity) == 0x801)) {
    if (synaptics_send_cmd(psmouse, SYN_QUE_EXT_MIN_COORDS, resp)) {
    psmouse_warn(psmouse,
    "device claims to have min coordinates query, but I'm not able to read it.\n");
    @@ -506,6 +512,18 @@ static void synaptics_parse_agm(const unsigned char buf[],
    priv->agm_pending = true;
    }

    +static void synaptics_parse_ext_buttons(const unsigned char buf[],
    + struct synaptics_data *priv,
    + struct synaptics_hw_state *hw)
    +{
    + unsigned int ext_bits =
    + (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) + 1) >> 1;
    + unsigned int ext_mask = (1U << ext_bits) - 1;
    +
    + hw->ext_buttons = buf[4] & ext_mask;
    + hw->ext_buttons |= (buf[5] & ext_mask) << ext_bits;
    +}
    +
    static bool is_forcepad;

    static int synaptics_parse_hw_state(const unsigned char buf[],
    @@ -592,28 +610,9 @@ static int synaptics_parse_hw_state(const unsigned char buf[],
    hw->down = ((buf[0] ^ buf[3]) & 0x02) ? 1 : 0;
    }

    - if (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) &&
    + if (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) > 0 &&
    ((buf[0] ^ buf[3]) & 0x02)) {
    - switch (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) & ~0x01) {
    - default:
    - /*
    - * if nExtBtn is greater than 8 it should be
    - * considered invalid and treated as 0
    - */
    - break;
    - case 8:
    - hw->ext_buttons |= ((buf[5] & 0x08)) ? 0x80 : 0;
    - hw->ext_buttons |= ((buf[4] & 0x08)) ? 0x40 : 0;
    - case 6:
    - hw->ext_buttons |= ((buf[5] & 0x04)) ? 0x20 : 0;
    - hw->ext_buttons |= ((buf[4] & 0x04)) ? 0x10 : 0;
    - case 4:
    - hw->ext_buttons |= ((buf[5] & 0x02)) ? 0x08 : 0;
    - hw->ext_buttons |= ((buf[4] & 0x02)) ? 0x04 : 0;
    - case 2:
    - hw->ext_buttons |= ((buf[5] & 0x01)) ? 0x02 : 0;
    - hw->ext_buttons |= ((buf[4] & 0x01)) ? 0x01 : 0;
    - }
    + synaptics_parse_ext_buttons(buf, priv, hw);
    }
    } else {
    hw->x = (((buf[1] & 0x1f) << 8) | buf[2]);
    @@ -675,12 +674,35 @@ static void synaptics_report_semi_mt_data(struct input_dev *dev,
    }
    }

    +static void synaptics_report_ext_buttons(struct psmouse *psmouse,
    + const struct synaptics_hw_state *hw)
    +{
    + struct input_dev *dev = psmouse->dev;
    + struct synaptics_data *priv = psmouse->private;
    + int ext_bits = (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) + 1) >> 1;
    + int i;
    +
    + if (!SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap))
    + return;
    +
    + /* Bug in FW 8.1, buttons are reported only when ExtBit is 1 */
    + if (SYN_ID_FULL(priv->identity) == 0x801 &&
    + !((psmouse->packet[0] ^ psmouse->packet[3]) & 0x02))
    + return;
    +
    + for (i = 0; i < ext_bits; i++) {
    + input_report_key(dev, BTN_0 + 2 * i,
    + hw->ext_buttons & (1 << i));
    + input_report_key(dev, BTN_1 + 2 * i,
    + hw->ext_buttons & (1 << (i + ext_bits)));
    + }
    +}
    +
    static void synaptics_report_buttons(struct psmouse *psmouse,
    const struct synaptics_hw_state *hw)
    {
    struct input_dev *dev = psmouse->dev;
    struct synaptics_data *priv = psmouse->private;
    - int i;

    input_report_key(dev, BTN_LEFT, hw->left);
    input_report_key(dev, BTN_RIGHT, hw->right);
    @@ -693,8 +715,7 @@ static void synaptics_report_buttons(struct psmouse *psmouse,
    input_report_key(dev, BTN_BACK, hw->down);
    }

    - for (i = 0; i < SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap); i++)
    - input_report_key(dev, BTN_0 + i, hw->ext_buttons & (1 << i));
    + synaptics_report_ext_buttons(psmouse, hw);
    }

    static void synaptics_report_slot(struct input_dev *dev, int slot,
    diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c
    index ea5dd28..489d7fb 100644
    --- a/drivers/md/dm-io.c
    +++ b/drivers/md/dm-io.c
    @@ -298,6 +298,18 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
    sector_t remaining = where->count;
    struct request_queue *q = bdev_get_queue(where->bdev);
    sector_t discard_sectors;
    + unsigned int uninitialized_var(special_cmd_max_sectors);
    +
    + /*
    + * Reject unsupported discard and write same requests.
    + */
    + if (rw & REQ_DISCARD) {
    + special_cmd_max_sectors = q->limits.max_discard_sectors;
    + if (special_cmd_max_sectors == 0) {
    + dec_count(io, region, -EOPNOTSUPP);
    + return;
    + }
    + }

    /*
    * where->count may be zero if rw holds a flush and we need to
    @@ -321,7 +333,7 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
    store_io_and_region_in_bio(bio, io, region);

    if (rw & REQ_DISCARD) {
    - discard_sectors = min_t(sector_t, q->limits.max_discard_sectors, remaining);
    + discard_sectors = min_t(sector_t, special_cmd_max_sectors, remaining);
    bio->bi_size = discard_sectors << SECTOR_SHIFT;
    remaining -= discard_sectors;
    } else while (remaining) {
    diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
    index a3cf259..3afb9cd 100644
    --- a/drivers/md/dm-raid1.c
    +++ b/drivers/md/dm-raid1.c
    @@ -603,6 +603,15 @@ static void write_callback(unsigned long error, void *context)
    return;
    }

    + /*
    + * If the bio is discard, return an error, but do not
    + * degrade the array.
    + */
    + if (bio->bi_rw & REQ_DISCARD) {
    + bio_endio(bio, -EOPNOTSUPP);
    + return;
    + }
    +
    for (i = 0; i < ms->nr_mirrors; i++)
    if (test_bit(i, &error))
    fail_mirror(ms->mirror + i, DM_RAID1_WRITE_ERROR);
    diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
    index b092338..696a16b 100644
    --- a/drivers/md/dm-snap.c
    +++ b/drivers/md/dm-snap.c
    @@ -1444,8 +1444,6 @@ out:
    full_bio->bi_end_io = pe->full_bio_end_io;
    full_bio->bi_private = pe->full_bio_private;
    }
    - free_pending_exception(pe);
    -
    increment_pending_exceptions_done_count();

    up_write(&s->lock);
    @@ -1462,6 +1460,8 @@ out:
    }

    retry_origin_bios(s, origin_bios);
    +
    + free_pending_exception(pe);
    }

    static void commit_callback(void *context, int success)
    diff --git a/drivers/md/dm.c b/drivers/md/dm.c
    index 0cf8c51..3bfbccc 100644
    --- a/drivers/md/dm.c
    +++ b/drivers/md/dm.c
    @@ -2232,7 +2232,7 @@ int dm_setup_md_queue(struct mapped_device *md)
    return 0;
    }

    -static struct mapped_device *dm_find_md(dev_t dev)
    +struct mapped_device *dm_get_md(dev_t dev)
    {
    struct mapped_device *md;
    unsigned minor = MINOR(dev);
    @@ -2243,12 +2243,15 @@ static struct mapped_device *dm_find_md(dev_t dev)
    spin_lock(&_minor_lock);

    md = idr_find(&_minor_idr, minor);
    - if (md && (md == MINOR_ALLOCED ||
    - (MINOR(disk_devt(dm_disk(md))) != minor) ||
    - dm_deleting_md(md) ||
    - test_bit(DMF_FREEING, &md->flags))) {
    - md = NULL;
    - goto out;
    + if (md) {
    + if ((md == MINOR_ALLOCED ||
    + (MINOR(disk_devt(dm_disk(md))) != minor) ||
    + dm_deleting_md(md) ||
    + test_bit(DMF_FREEING, &md->flags))) {
    + md = NULL;
    + goto out;
    + }
    + dm_get(md);
    }

    out:
    @@ -2256,16 +2259,6 @@ out:

    return md;
    }
    -
    -struct mapped_device *dm_get_md(dev_t dev)
    -{
    - struct mapped_device *md = dm_find_md(dev);
    -
    - if (md)
    - dm_get(md);
    -
    - return md;
    -}
    EXPORT_SYMBOL_GPL(dm_get_md);

    void *dm_get_mdptr(struct mapped_device *md)
    @@ -2302,10 +2295,16 @@ static void __dm_destroy(struct mapped_device *md, bool wait)
    set_bit(DMF_FREEING, &md->flags);
    spin_unlock(&_minor_lock);

    + /*
    + * Take suspend_lock so that presuspend and postsuspend methods
    + * do not race with internal suspend.
    + */
    + mutex_lock(&md->suspend_lock);
    if (!dm_suspended_md(md)) {
    dm_table_presuspend_targets(map);
    dm_table_postsuspend_targets(map);
    }
    + mutex_unlock(&md->suspend_lock);

    /*
    * Rare, but there may be I/O requests still going to complete,
    diff --git a/drivers/mtd/ubi/misc.c b/drivers/mtd/ubi/misc.c
    index f6a7d7a..b14ab43 100644
    --- a/drivers/mtd/ubi/misc.c
    +++ b/drivers/mtd/ubi/misc.c
    @@ -74,6 +74,8 @@ int ubi_check_volume(struct ubi_device *ubi, int vol_id)
    for (i = 0; i < vol->used_ebs; i++) {
    int size;

    + cond_resched();
    +
    if (i == vol->used_ebs - 1)
    size = vol->last_eb_bytes;
    else
    diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
    index 88c39e4..81a00e4 100644
    --- a/drivers/net/can/dev.c
    +++ b/drivers/net/can/dev.c
    @@ -475,6 +475,11 @@ struct sk_buff *alloc_can_skb(struct net_device *dev, struct can_frame **cf)
    skb->protocol = htons(ETH_P_CAN);
    skb->pkt_type = PACKET_BROADCAST;
    skb->ip_summed = CHECKSUM_UNNECESSARY;
    +
    + skb_reset_mac_header(skb);
    + skb_reset_network_header(skb);
    + skb_reset_transport_header(skb);
    +
    *cf = (struct can_frame *)skb_put(skb, sizeof(struct can_frame));
    memset(*cf, 0, sizeof(struct can_frame));

    diff --git a/drivers/net/ethernet/amd/pcnet32.c b/drivers/net/ethernet/amd/pcnet32.c
    index 86b6d8e..d63b322 100644
    --- a/drivers/net/ethernet/amd/pcnet32.c
    +++ b/drivers/net/ethernet/amd/pcnet32.c
    @@ -1526,7 +1526,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
    {
    struct pcnet32_private *lp;
    int i, media;
    - int fdx, mii, fset, dxsuflo;
    + int fdx, mii, fset, dxsuflo, sram;
    int chip_version;
    char *chipname;
    struct net_device *dev;
    @@ -1563,7 +1563,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
    }

    /* initialize variables */
    - fdx = mii = fset = dxsuflo = 0;
    + fdx = mii = fset = dxsuflo = sram = 0;
    chip_version = (chip_version >> 12) & 0xffff;

    switch (chip_version) {
    @@ -1596,6 +1596,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
    chipname = "PCnet/FAST III 79C973"; /* PCI */
    fdx = 1;
    mii = 1;
    + sram = 1;
    break;
    case 0x2626:
    chipname = "PCnet/Home 79C978"; /* PCI */
    @@ -1619,6 +1620,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
    chipname = "PCnet/FAST III 79C975"; /* PCI */
    fdx = 1;
    mii = 1;
    + sram = 1;
    break;
    case 0x2628:
    chipname = "PCnet/PRO 79C976";
    @@ -1647,6 +1649,31 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
    dxsuflo = 1;
    }

    + /*
    + * The Am79C973/Am79C975 controllers come with 12K of SRAM
    + * which we can use for the Tx/Rx buffers but most importantly,
    + * the use of SRAM allow us to use the BCR18:NOUFLO bit to avoid
    + * Tx fifo underflows.
    + */
    + if (sram) {
    + /*
    + * The SRAM is being configured in two steps. First we
    + * set the SRAM size in the BCR25:SRAM_SIZE bits. According
    + * to the datasheet, each bit corresponds to a 512-byte
    + * page so we can have at most 24 pages. The SRAM_SIZE
    + * holds the value of the upper 8 bits of the 16-bit SRAM size.
    + * The low 8-bits start at 0x00 and end at 0xff. So the
    + * address range is from 0x0000 up to 0x17ff. Therefore,
    + * the SRAM_SIZE is set to 0x17. The next step is to set
    + * the BCR26:SRAM_BND midway through so the Tx and Rx
    + * buffers can share the SRAM equally.
    + */
    + a->write_bcr(ioaddr, 25, 0x17);
    + a->write_bcr(ioaddr, 26, 0xc);
    + /* And finally enable the NOUFLO bit */
    + a->write_bcr(ioaddr, 18, a->read_bcr(ioaddr, 18) | (1 << 11));
    + }
    +
    dev = alloc_etherdev(sizeof(*lp));
    if (!dev) {
    ret = -ENOMEM;
    diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
    index b8e7f3e..1e274e7 100644
    --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
    +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
    @@ -10934,6 +10934,10 @@ static int __devinit bnx2x_init_dev(struct pci_dev *pdev,
    /* clean indirect addresses */
    pci_write_config_dword(bp->pdev, PCICFG_GRC_ADDRESS,
    PCICFG_VENDOR_ID_OFFSET);
    +
    + /* Set PCIe reset type to fundamental for EEH recovery */
    + pdev->needs_freset = 1;
    +
    /*
    * Clean the following indirect addresses for all functions since it
    * is not used by the driver.
    diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
    index d16800f..56299e9 100644
    --- a/drivers/net/team/team.c
    +++ b/drivers/net/team/team.c
    @@ -39,9 +39,7 @@

    static struct team_port *team_port_get_rcu(const struct net_device *dev)
    {
    - struct team_port *port = rcu_dereference(dev->rx_handler_data);
    -
    - return team_port_exists(dev) ? port : NULL;
    + return rcu_dereference(dev->rx_handler_data);
    }

    static struct team_port *team_port_get_rtnl(const struct net_device *dev)
    diff --git a/drivers/net/wireless/ath/ath5k/reset.c b/drivers/net/wireless/ath/ath5k/reset.c
    index 200f165..2cc3f41 100644
    --- a/drivers/net/wireless/ath/ath5k/reset.c
    +++ b/drivers/net/wireless/ath/ath5k/reset.c
    @@ -476,7 +476,7 @@ ath5k_hw_wisoc_reset(struct ath5k_hw *ah, u32 flags)
    regval = ioread32(reg);
    iowrite32(regval | val, reg);
    regval = ioread32(reg);
    - usleep_range(100, 150);
    + udelay(100); /* NB: should be atomic */

    /* Bring BB/MAC out of reset */
    iowrite32(regval & ~val, reg);
    diff --git a/drivers/pci/hotplug.c b/drivers/pci/hotplug.c
    index 2b5352a..3b70f5c 100644
    --- a/drivers/pci/hotplug.c
    +++ b/drivers/pci/hotplug.c
    @@ -27,7 +27,7 @@ int pci_uevent(struct device *dev, struct kobj_uevent_env *env)
    if (add_uevent_var(env, "PCI_SLOT_NAME=%s", pci_name(pdev)))
    return -ENOMEM;

    - if (add_uevent_var(env, "MODALIAS=pci:v%08Xd%08Xsv%08Xsd%08Xbc%02Xsc%02Xi%02x",
    + if (add_uevent_var(env, "MODALIAS=pci:v%08Xd%08Xsv%08Xsd%08Xbc%02Xsc%02Xi%02X",
    pdev->vendor, pdev->device,
    pdev->subsystem_vendor, pdev->subsystem_device,
    (u8)(pdev->class >> 16), (u8)(pdev->class >> 8),
    diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
    index d62ad0b..868440f 100644
    --- a/drivers/pci/probe.c
    +++ b/drivers/pci/probe.c
    @@ -44,12 +44,10 @@ int no_pci_devices(void)
    }
    EXPORT_SYMBOL(no_pci_devices);

    -static struct pci_host_bridge *pci_host_bridge(struct pci_dev *dev)
    +static struct pci_host_bridge *pci_host_bridge(struct pci_bus *bus)
    {
    - struct pci_bus *bus;
    struct pci_host_bridge *bridge;

    - bus = dev->bus;
    while (bus->parent)
    bus = bus->parent;

    @@ -66,10 +64,10 @@ static bool resource_contains(struct resource *res1, struct resource *res2)
    return res1->start <= res2->start && res1->end >= res2->end;
    }

    -void pcibios_resource_to_bus(struct pci_dev *dev, struct pci_bus_region *region,
    +void pcibios_resource_to_bus(struct pci_bus *bus, struct pci_bus_region *region,
    struct resource *res)
    {
    - struct pci_host_bridge *bridge = pci_host_bridge(dev);
    + struct pci_host_bridge *bridge = pci_host_bridge(bus);
    struct pci_host_bridge_window *window;
    resource_size_t offset = 0;

    @@ -94,10 +92,10 @@ static bool region_contains(struct pci_bus_region *region1,
    return region1->start <= region2->start && region1->end >= region2->end;
    }

    -void pcibios_bus_to_resource(struct pci_dev *dev, struct resource *res,
    +void pcibios_bus_to_resource(struct pci_bus *bus, struct resource *res,
    struct pci_bus_region *region)
    {
    - struct pci_host_bridge *bridge = pci_host_bridge(dev);
    + struct pci_host_bridge *bridge = pci_host_bridge(bus);
    struct pci_host_bridge_window *window;
    struct pci_bus_region bus_region;
    resource_size_t offset = 0;
    @@ -298,11 +296,11 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
    pci_write_config_dword(dev, pos + 4, 0);
    region.start = 0;
    region.end = sz64;
    - pcibios_bus_to_resource(dev, res, &region);
    + pcibios_bus_to_resource(dev->bus, res, &region);
    } else {
    region.start = l64;
    region.end = l64 + sz64;
    - pcibios_bus_to_resource(dev, res, &region);
    + pcibios_bus_to_resource(dev->bus, res, &region);
    dev_printk(KERN_DEBUG, &dev->dev, "reg %x: %pR\n",
    pos, res);
    }
    @@ -314,7 +312,7 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,

    region.start = l;
    region.end = l + sz;
    - pcibios_bus_to_resource(dev, res, &region);
    + pcibios_bus_to_resource(dev->bus, res, &region);

    dev_printk(KERN_DEBUG, &dev->dev, "reg %x: %pR\n", pos, res);
    }
    @@ -373,7 +371,7 @@ static void __devinit pci_read_bridge_io(struct pci_bus *child)
    res2.flags = res->flags;
    region.start = base;
    region.end = limit + 0xfff;
    - pcibios_bus_to_resource(dev, &res2, &region);
    + pcibios_bus_to_resource(dev->bus, &res2, &region);
    if (!res->start)
    res->start = res2.start;
    if (!res->end)
    @@ -399,7 +397,7 @@ static void __devinit pci_read_bridge_mmio(struct pci_bus *child)
    res->flags = (mem_base_lo & PCI_MEMORY_RANGE_TYPE_MASK) | IORESOURCE_MEM;
    region.start = base;
    region.end = limit + 0xfffff;
    - pcibios_bus_to_resource(dev, res, &region);
    + pcibios_bus_to_resource(dev->bus, res, &region);
    dev_printk(KERN_DEBUG, &dev->dev, " bridge window %pR\n", res);
    }
    }
    @@ -448,7 +446,7 @@ static void __devinit pci_read_bridge_mmio_pref(struct pci_bus *child)
    res->flags |= IORESOURCE_MEM_64;
    region.start = base;
    region.end = limit + 0xfffff;
    - pcibios_bus_to_resource(dev, res, &region);
    + pcibios_bus_to_resource(dev->bus, res, &region);
    dev_printk(KERN_DEBUG, &dev->dev, " bridge window %pR\n", res);
    }
    }
    @@ -1063,24 +1061,24 @@ int pci_setup_device(struct pci_dev *dev)
    region.end = 0x1F7;
    res = &dev->resource[0];
    res->flags = LEGACY_IO_RESOURCE;
    - pcibios_bus_to_resource(dev, res, &region);
    + pcibios_bus_to_resource(dev->bus, res, &region);
    region.start = 0x3F6;
    region.end = 0x3F6;
    res = &dev->resource[1];
    res->flags = LEGACY_IO_RESOURCE;
    - pcibios_bus_to_resource(dev, res, &region);
    + pcibios_bus_to_resource(dev->bus, res, &region);
    }
    if ((progif & 4) == 0) {
    region.start = 0x170;
    region.end = 0x177;
    res = &dev->resource[2];
    res->flags = LEGACY_IO_RESOURCE;
    - pcibios_bus_to_resource(dev, res, &region);
    + pcibios_bus_to_resource(dev->bus, res, &region);
    region.start = 0x376;
    region.end = 0x376;
    res = &dev->resource[3];
    res->flags = LEGACY_IO_RESOURCE;
    - pcibios_bus_to_resource(dev, res, &region);
    + pcibios_bus_to_resource(dev->bus, res, &region);
    }
    }
    break;
    diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
    index ffde183..c030024 100644
    --- a/drivers/pci/quirks.c
    +++ b/drivers/pci/quirks.c
    @@ -393,7 +393,7 @@ static void __devinit quirk_io_region(struct pci_dev *dev, unsigned region,
    /* Convert from PCI bus to resource space. */
    bus_region.start = res->start;
    bus_region.end = res->end;
    - pcibios_bus_to_resource(dev, res, &bus_region);
    + pcibios_bus_to_resource(dev->bus, res, &bus_region);

    if (pci_claim_resource(dev, nr) == 0)
    dev_info(&dev->dev, "quirk: %pR claimed by %s\n",
    diff --git a/drivers/pci/rom.c b/drivers/pci/rom.c
    index 48ebdb2..336b999 100644
    --- a/drivers/pci/rom.c
    +++ b/drivers/pci/rom.c
    @@ -31,7 +31,7 @@ int pci_enable_rom(struct pci_dev *pdev)
    if (!res->flags)
    return -1;

    - pcibios_resource_to_bus(pdev, &region, res);
    + pcibios_resource_to_bus(pdev->bus, &region, res);
    pci_read_config_dword(pdev, pdev->rom_base_reg, &rom_addr);
    rom_addr &= ~PCI_ROM_ADDRESS_MASK;
    rom_addr |= region.start | PCI_ROM_ADDRESS_ENABLE;
    @@ -69,6 +69,7 @@ size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, size_t size)
    {
    void __iomem *image;
    int last_image;
    + unsigned length;

    image = rom;
    do {
    @@ -91,9 +92,9 @@ size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, size_t size)
    if (readb(pds + 3) != 'R')
    break;
    last_image = readb(pds + 21) & 0x80;
    - /* this length is reliable */
    - image += readw(pds + 16) * 512;
    - } while (!last_image);
    + length = readw(pds + 16);
    + image += length * 512;
    + } while (length && !last_image);

    /* never return a size larger than the PCI resource window */
    /* there are known ROMs that get the size wrong */
    diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
    index 8fa2d4b..244ada4 100644
    --- a/drivers/pci/setup-bus.c
    +++ b/drivers/pci/setup-bus.c
    @@ -408,7 +408,7 @@ void pci_setup_cardbus(struct pci_bus *bus)
    bus->secondary, bus->subordinate);

    res = bus->resource[0];
    - pcibios_resource_to_bus(bridge, &region, res);
    + pcibios_resource_to_bus(bridge->bus, &region, res);
    if (res->flags & IORESOURCE_IO) {
    /*
    * The IO resource is allocated a range twice as large as it
    @@ -422,7 +422,7 @@ void pci_setup_cardbus(struct pci_bus *bus)
    }

    res = bus->resource[1];
    - pcibios_resource_to_bus(bridge, &region, res);
    + pcibios_resource_to_bus(bridge->bus, &region, res);
    if (res->flags & IORESOURCE_IO) {
    dev_info(&bridge->dev, " bridge window %pR\n", res);
    pci_write_config_dword(bridge, PCI_CB_IO_BASE_1,
    @@ -432,7 +432,7 @@ void pci_setup_cardbus(struct pci_bus *bus)
    }

    res = bus->resource[2];
    - pcibios_resource_to_bus(bridge, &region, res);
    + pcibios_resource_to_bus(bridge->bus, &region, res);
    if (res->flags & IORESOURCE_MEM) {
    dev_info(&bridge->dev, " bridge window %pR\n", res);
    pci_write_config_dword(bridge, PCI_CB_MEMORY_BASE_0,
    @@ -442,7 +442,7 @@ void pci_setup_cardbus(struct pci_bus *bus)
    }

    res = bus->resource[3];
    - pcibios_resource_to_bus(bridge, &region, res);
    + pcibios_resource_to_bus(bridge->bus, &region, res);
    if (res->flags & IORESOURCE_MEM) {
    dev_info(&bridge->dev, " bridge window %pR\n", res);
    pci_write_config_dword(bridge, PCI_CB_MEMORY_BASE_1,
    @@ -473,7 +473,7 @@ static void pci_setup_bridge_io(struct pci_bus *bus)

    /* Set up the top and bottom of the PCI I/O segment for this bus. */
    res = bus->resource[0];
    - pcibios_resource_to_bus(bridge, &region, res);
    + pcibios_resource_to_bus(bridge->bus, &region, res);
    if (res->flags & IORESOURCE_IO) {
    pci_read_config_dword(bridge, PCI_IO_BASE, &l);
    l &= 0xffff0000;
    @@ -504,7 +504,7 @@ static void pci_setup_bridge_mmio(struct pci_bus *bus)

    /* Set up the top and bottom of the PCI Memory segment for this bus. */
    res = bus->resource[1];
    - pcibios_resource_to_bus(bridge, &region, res);
    + pcibios_resource_to_bus(bridge->bus, &region, res);
    if (res->flags & IORESOURCE_MEM) {
    l = (region.start >> 16) & 0xfff0;
    l |= region.end & 0xfff00000;
    @@ -530,7 +530,7 @@ static void pci_setup_bridge_mmio_pref(struct pci_bus *bus)
    /* Set up PREF base/limit. */
    bu = lu = 0;
    res = bus->resource[2];
    - pcibios_resource_to_bus(bridge, &region, res);
    + pcibios_resource_to_bus(bridge->bus, &region, res);
    if (res->flags & IORESOURCE_PREFETCH) {
    l = (region.start >> 16) & 0xfff0;
    l |= region.end & 0xfff00000;
    diff --git a/drivers/pci/setup-res.c b/drivers/pci/setup-res.c
    index be76eba..d427277 100644
    --- a/drivers/pci/setup-res.c
    +++ b/drivers/pci/setup-res.c
    @@ -50,7 +50,7 @@ void pci_update_resource(struct pci_dev *dev, int resno)
    if (res->flags & IORESOURCE_PCI_FIXED)
    return;

    - pcibios_resource_to_bus(dev, &region, res);
    + pcibios_resource_to_bus(dev->bus, &region, res);

    new = region.start | (res->flags & PCI_REGION_FLAG_MASK);
    if (res->flags & IORESOURCE_IO)
    diff --git a/drivers/pcmcia/i82092.c b/drivers/pcmcia/i82092.c
    index 4e8831b..099034b 100644
    --- a/drivers/pcmcia/i82092.c
    +++ b/drivers/pcmcia/i82092.c
    @@ -610,7 +610,7 @@ static int i82092aa_set_mem_map(struct pcmcia_socket *socket, struct pccard_mem_

    enter("i82092aa_set_mem_map");

    - pcibios_resource_to_bus(sock_info->dev, &region, mem->res);
    + pcibios_resource_to_bus(sock_info->dev->bus, &region, mem->res);

    map = mem->map;
    if (map > 4) {
    diff --git a/drivers/pcmcia/yenta_socket.c b/drivers/pcmcia/yenta_socket.c
    index d07f9ac..13e76f9 100644
    --- a/drivers/pcmcia/yenta_socket.c
    +++ b/drivers/pcmcia/yenta_socket.c
    @@ -445,7 +445,7 @@ static int yenta_set_mem_map(struct pcmcia_socket *sock, struct pccard_mem_map *
    unsigned int start, stop, card_start;
    unsigned short word;

    - pcibios_resource_to_bus(socket->dev, &region, mem->res);
    + pcibios_resource_to_bus(socket->dev->bus, &region, mem->res);

    map = mem->map;
    start = region.start;
    @@ -709,7 +709,7 @@ static int yenta_allocate_res(struct yenta_socket *socket, int nr, unsigned type
    region.start = config_readl(socket, addr_start) & mask;
    region.end = config_readl(socket, addr_end) | ~mask;
    if (region.start && region.end > region.start && !override_bios) {
    - pcibios_bus_to_resource(dev, res, &region);
    + pcibios_bus_to_resource(dev->bus, res, &region);
    if (pci_claim_resource(dev, PCI_BRIDGE_RESOURCES + nr) == 0)
    return 0;
    dev_printk(KERN_INFO, &dev->dev,
    @@ -1033,7 +1033,7 @@ static void yenta_config_init(struct yenta_socket *socket)
    struct pci_dev *dev = socket->dev;
    struct pci_bus_region region;

    - pcibios_resource_to_bus(socket->dev, &region, &dev->resource[0]);
    + pcibios_resource_to_bus(socket->dev->bus, &region, &dev->resource[0]);

    config_writel(socket, CB_LEGACY_MODE_BASE, 0);
    config_writel(socket, PCI_BASE_ADDRESS_0, region.start);
    diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
    index 375756f..348560a 100644
    --- a/drivers/scsi/be2iscsi/be_main.c
    +++ b/drivers/scsi/be2iscsi/be_main.c
    @@ -424,7 +424,6 @@ static struct beiscsi_hba *beiscsi_hba_alloc(struct pci_dev *pcidev)
    "iscsi_host_alloc failed\n");
    return NULL;
    }
    - shost->dma_boundary = pcidev->dma_mask;
    shost->max_id = BE2_MAX_SESSIONS;
    shost->max_channel = 0;
    shost->max_cmd_len = BEISCSI_MAX_CMD_LEN;
    @@ -4399,9 +4398,9 @@ free_port:
    hba_free:
    if (phba->msix_enabled)
    pci_disable_msix(phba->pcidev);
    - iscsi_host_remove(phba->shost);
    pci_dev_put(phba->pcidev);
    iscsi_host_free(phba->shost);
    + pci_set_drvdata(pcidev, NULL);
    disable_pci:
    pci_disable_device(pcidev);
    return ret;
    diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
    index bc88cab..f5ccdcdf 100644
    --- a/drivers/scsi/hpsa.c
    +++ b/drivers/scsi/hpsa.c
    @@ -3507,10 +3507,6 @@ static __devinit int hpsa_kdump_hard_reset_controller(struct pci_dev *pdev)

    /* Save the PCI command register */
    pci_read_config_word(pdev, 4, &command_register);
    - /* Turn the board off. This is so that later pci_restore_state()
    - * won't turn the board on before the rest of config space is ready.
    - */
    - pci_disable_device(pdev);
    pci_save_state(pdev);

    /* find the first memory BAR, so we can find the cfg table */
    @@ -3534,7 +3530,7 @@ static __devinit int hpsa_kdump_hard_reset_controller(struct pci_dev *pdev)
    }
    rc = write_driver_ver_to_cfgtable(cfgtable);
    if (rc)
    - goto unmap_vaddr;
    + goto unmap_cfgtable;

    /* If reset via doorbell register is supported, use that.
    * There are two such methods. Favor the newest method.
    @@ -3558,11 +3554,6 @@ static __devinit int hpsa_kdump_hard_reset_controller(struct pci_dev *pdev)
    goto unmap_cfgtable;

    pci_restore_state(pdev);
    - rc = pci_enable_device(pdev);
    - if (rc) {
    - dev_warn(&pdev->dev, "failed to enable device.\n");
    - goto unmap_cfgtable;
    - }
    pci_write_config_word(pdev, 4, command_register);

    /* Some devices (notably the HP Smart Array 5i Controller)
    @@ -4064,10 +4055,37 @@ static void __devinit hpsa_hba_inquiry(struct ctlr_info *h)
    static __devinit int hpsa_init_reset_devices(struct pci_dev *pdev)
    {
    int rc, i;
    + void __iomem *vaddr;

    if (!reset_devices)
    return 0;

    + /* kdump kernel is loading, we don't know in which state is
    + * the pci interface. The dev->enable_cnt is equal zero
    + * so we call enable+disable, wait a while and switch it on.
    + */
    + rc = pci_enable_device(pdev);
    + if (rc) {
    + dev_warn(&pdev->dev, "Failed to enable PCI device\n");
    + return -ENODEV;
    + }
    + pci_disable_device(pdev);
    + msleep(260); /* a randomly chosen number */
    + rc = pci_enable_device(pdev);
    + if (rc) {
    + dev_warn(&pdev->dev, "failed to enable device.\n");
    + return -ENODEV;
    + }
    + pci_set_master(pdev);
    +
    + vaddr = pci_ioremap_bar(pdev, 0);
    + if (vaddr == NULL) {
    + rc = -ENOMEM;
    + goto out_disable;
    + }
    + writel(SA5_INTR_OFF, vaddr + SA5_REPLY_INTR_MASK_OFFSET);
    + iounmap(vaddr);
    +
    /* Reset the controller with a PCI power-cycle or via doorbell */
    rc = hpsa_kdump_hard_reset_controller(pdev);

    @@ -4076,10 +4094,11 @@ static __devinit int hpsa_init_reset_devices(struct pci_dev *pdev)
    * "performant mode". Or, it might be 640x, which can't reset
    * due to concerns about shared bbwc between 6402/6404 pair.
    */
    - if (rc == -ENOTSUPP)
    - return rc; /* just try to do the kdump anyhow. */
    - if (rc)
    - return -ENODEV;
    + if (rc) {
    + if (rc != -ENOTSUPP) /* just try to do the kdump anyhow. */
    + rc = -ENODEV;
    + goto out_disable;
    + }

    /* Now try to get the controller to respond to a no-op */
    dev_warn(&pdev->dev, "Waiting for controller to respond to no-op\n");
    @@ -4090,7 +4109,11 @@ static __devinit int hpsa_init_reset_devices(struct pci_dev *pdev)
    dev_warn(&pdev->dev, "no-op failed%s\n",
    (i < 11 ? "; re-trying" : ""));
    }
    - return 0;
    +
    +out_disable:
    +
    + pci_disable_device(pdev);
    + return rc;
    }

    static __devinit int hpsa_allocate_cmd_pool(struct ctlr_info *h)
    @@ -4191,6 +4214,7 @@ static void hpsa_undo_allocations_after_kdump_soft_reset(struct ctlr_info *h)
    iounmap(h->transtable);
    if (h->cfgtable)
    iounmap(h->cfgtable);
    + pci_disable_device(h->pdev);
    pci_release_regions(h->pdev);
    kfree(h);
    }
    diff --git a/drivers/scsi/libsas/sas_discover.c b/drivers/scsi/libsas/sas_discover.c
    index 629a086..5fbacde 100644
    --- a/drivers/scsi/libsas/sas_discover.c
    +++ b/drivers/scsi/libsas/sas_discover.c
    @@ -446,6 +446,7 @@ static void sas_revalidate_domain(struct work_struct *work)
    struct sas_discovery_event *ev = to_sas_discovery_event(work);
    struct asd_sas_port *port = ev->port;
    struct sas_ha_struct *ha = port->ha;
    + struct domain_device *ddev = port->port_dev;

    /* prevent revalidation from finding sata links in recovery */
    mutex_lock(&ha->disco_mutex);
    @@ -460,8 +461,9 @@ static void sas_revalidate_domain(struct work_struct *work)
    SAS_DPRINTK("REVALIDATING DOMAIN on port %d, pid:%d\n", port->id,
    task_pid_nr(current));

    - if (port->port_dev)
    - res = sas_ex_revalidate_domain(port->port_dev);
    + if (ddev && (ddev->dev_type == SAS_FANOUT_EXPANDER_DEVICE ||
    + ddev->dev_type == SAS_EDGE_EXPANDER_DEVICE))
    + res = sas_ex_revalidate_domain(ddev);

    SAS_DPRINTK("done REVALIDATING DOMAIN on port %d, pid:%d, res 0x%x\n",
    port->id, task_pid_nr(current), res);
    diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
    index ac99b46..a30f7a0 100644
    --- a/drivers/scsi/scsi_lib.c
    +++ b/drivers/scsi/scsi_lib.c
    @@ -1209,9 +1209,11 @@ int scsi_prep_state_check(struct scsi_device *sdev, struct request *req)
    "rejecting I/O to dead device\n");
    ret = BLKPREP_KILL;
    break;
    - case SDEV_QUIESCE:
    case SDEV_BLOCK:
    case SDEV_CREATED_BLOCK:
    + ret = BLKPREP_DEFER;
    + break;
    + case SDEV_QUIESCE:
    /*
    * If the devices is blocked we defer normal commands.
    */
    diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
    index eacd46b..fb119ce 100644
    --- a/drivers/scsi/sg.c
    +++ b/drivers/scsi/sg.c
    @@ -498,7 +498,7 @@ static ssize_t
    sg_new_read(Sg_fd * sfp, char __user *buf, size_t count, Sg_request * srp)
    {
    sg_io_hdr_t *hp = &srp->header;
    - int err = 0;
    + int err = 0, err2;
    int len;

    if (count < SZ_SG_IO_HDR) {
    @@ -527,8 +527,8 @@ sg_new_read(Sg_fd * sfp, char __user *buf, size_t count, Sg_request * srp)
    goto err_out;
    }
    err_out:
    - err = sg_finish_rem_req(srp);
    - return (0 == err) ? count : err;
    + err2 = sg_finish_rem_req(srp);
    + return err ? : err2 ? : count;
    }

    static ssize_t
    diff --git a/drivers/scsi/sym53c8xx_2/sym_glue.c b/drivers/scsi/sym53c8xx_2/sym_glue.c
    index 36d1ed7..1e3d789 100644
    --- a/drivers/scsi/sym53c8xx_2/sym_glue.c
    +++ b/drivers/scsi/sym53c8xx_2/sym_glue.c
    @@ -1609,7 +1609,7 @@ sym_iomap_device(struct sym_device *device)
    struct pci_bus_region bus_addr;
    int i = 2;

    - pcibios_resource_to_bus(pdev, &bus_addr, &pdev->resource[1]);
    + pcibios_resource_to_bus(pdev->bus, &bus_addr, &pdev->resource[1]);
    device->mmio_base = bus_addr.start;

    if (device->chip.features & FE_RAM) {
    @@ -1619,7 +1619,8 @@ sym_iomap_device(struct sym_device *device)
    */
    if (!pdev->resource[i].flags)
    i++;
    - pcibios_resource_to_bus(pdev, &bus_addr, &pdev->resource[i]);
    + pcibios_resource_to_bus(pdev->bus, &bus_addr,
    + &pdev->resource[i]);
    device->ram_base = bus_addr.start;
    }

    diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
    index 830adbe..1556db9 100644
    --- a/drivers/spi/spidev.c
    +++ b/drivers/spi/spidev.c
    @@ -241,7 +241,10 @@ static int spidev_message(struct spidev_data *spidev,
    k_tmp->len = u_tmp->len;

    total += k_tmp->len;
    - if (total > bufsiz) {
    + /* Check total length of transfers. Also check each
    + * transfer length to avoid arithmetic overflow.
    + */
    + if (total > bufsiz || k_tmp->len > bufsiz) {
    status = -EMSGSIZE;
    goto done;
    }
    diff --git a/drivers/staging/comedi/comedi_compat32.c b/drivers/staging/comedi/comedi_compat32.c
    index 41a7a62..a8a0c0f 100644
    --- a/drivers/staging/comedi/comedi_compat32.c
    +++ b/drivers/staging/comedi/comedi_compat32.c
    @@ -271,7 +271,7 @@ static int compat_cmd(struct file *file, unsigned long arg)
    {
    struct comedi_cmd __user *cmd;
    struct comedi32_cmd_struct __user *cmd32;
    - int rc;
    + int rc, err;

    cmd32 = compat_ptr(arg);
    cmd = compat_alloc_user_space(sizeof(*cmd));
    @@ -280,7 +280,15 @@ static int compat_cmd(struct file *file, unsigned long arg)
    if (rc)
    return rc;

    - return translated_ioctl(file, COMEDI_CMD, (unsigned long)cmd);
    + rc = translated_ioctl(file, COMEDI_CMD, (unsigned long)cmd);
    + if (rc == -EAGAIN) {
    + /* Special case: copy cmd back to user. */
    + err = put_compat_cmd(cmd32, cmd);
    + if (err)
    + rc = err;
    + }
    +
    + return rc;
    }

    /* Handle 32-bit COMEDI_CMDTEST ioctl. */
    diff --git a/drivers/staging/vt6655/rf.c b/drivers/staging/vt6655/rf.c
    index b8ec783..3003363 100644
    --- a/drivers/staging/vt6655/rf.c
    +++ b/drivers/staging/vt6655/rf.c
    @@ -1029,6 +1029,7 @@ unsigned char byPwrdBm = 0;
    break;
    case RATE_6M:
    case RATE_9M:
    + case RATE_12M:
    case RATE_18M:
    byPwr = pDevice->abyOFDMPwrTbl[uCH];
    if (pDevice->byRFType == RF_UW2452) {
    diff --git a/drivers/target/iscsi/iscsi_target_tq.c b/drivers/target/iscsi/iscsi_target_tq.c
    index 977e1cf..4f447fd 100644
    --- a/drivers/target/iscsi/iscsi_target_tq.c
    +++ b/drivers/target/iscsi/iscsi_target_tq.c
    @@ -26,36 +26,22 @@
    #include "iscsi_target_tq.h"
    #include "iscsi_target.h"

    -static LIST_HEAD(active_ts_list);
    static LIST_HEAD(inactive_ts_list);
    -static DEFINE_SPINLOCK(active_ts_lock);
    static DEFINE_SPINLOCK(inactive_ts_lock);
    static DEFINE_SPINLOCK(ts_bitmap_lock);

    -static void iscsi_add_ts_to_active_list(struct iscsi_thread_set *ts)
    -{
    - spin_lock(&active_ts_lock);
    - list_add_tail(&ts->ts_list, &active_ts_list);
    - iscsit_global->active_ts++;
    - spin_unlock(&active_ts_lock);
    -}
    -
    extern void iscsi_add_ts_to_inactive_list(struct iscsi_thread_set *ts)
    {
    + if (!list_empty(&ts->ts_list)) {
    + WARN_ON(1);
    + return;
    + }
    spin_lock(&inactive_ts_lock);
    list_add_tail(&ts->ts_list, &inactive_ts_list);
    iscsit_global->inactive_ts++;
    spin_unlock(&inactive_ts_lock);
    }

    -static void iscsi_del_ts_from_active_list(struct iscsi_thread_set *ts)
    -{
    - spin_lock(&active_ts_lock);
    - list_del(&ts->ts_list);
    - iscsit_global->active_ts--;
    - spin_unlock(&active_ts_lock);
    -}
    -
    static struct iscsi_thread_set *iscsi_get_ts_from_inactive_list(void)
    {
    struct iscsi_thread_set *ts;
    @@ -69,7 +55,7 @@ static struct iscsi_thread_set *iscsi_get_ts_from_inactive_list(void)
    list_for_each_entry(ts, &inactive_ts_list, ts_list)
    break;

    - list_del(&ts->ts_list);
    + list_del_init(&ts->ts_list);
    iscsit_global->inactive_ts--;
    spin_unlock(&inactive_ts_lock);

    @@ -220,8 +206,6 @@ static void iscsi_deallocate_extra_thread_sets(void)

    void iscsi_activate_thread_set(struct iscsi_conn *conn, struct iscsi_thread_set *ts)
    {
    - iscsi_add_ts_to_active_list(ts);
    -
    spin_lock_bh(&ts->ts_state_lock);
    conn->thread_set = ts;
    ts->conn = conn;
    @@ -424,7 +408,6 @@ struct iscsi_conn *iscsi_rx_thread_pre_handler(struct iscsi_thread_set *ts)

    if (ts->delay_inactive && (--ts->thread_count == 0)) {
    spin_unlock_bh(&ts->ts_state_lock);
    - iscsi_del_ts_from_active_list(ts);

    if (!iscsit_global->in_shutdown)
    iscsi_deallocate_extra_thread_sets();
    @@ -477,7 +460,6 @@ struct iscsi_conn *iscsi_tx_thread_pre_handler(struct iscsi_thread_set *ts)

    if (ts->delay_inactive && (--ts->thread_count == 0)) {
    spin_unlock_bh(&ts->ts_state_lock);
    - iscsi_del_ts_from_active_list(ts);

    if (!iscsit_global->in_shutdown)
    iscsi_deallocate_extra_thread_sets();
    diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
    index d34577d..8082674 100644
    --- a/drivers/target/target_core_pscsi.c
    +++ b/drivers/target/target_core_pscsi.c
    @@ -1165,7 +1165,7 @@ static u32 pscsi_get_device_type(struct se_device *dev)
    struct pscsi_dev_virt *pdv = dev->dev_ptr;
    struct scsi_device *sd = pdv->pdv_sd;

    - return sd->type;
    + return (sd) ? sd->type : TYPE_NO_LUN;
    }

    static sector_t pscsi_get_blocks(struct se_device *dev)
    diff --git a/drivers/target/tcm_fc/tfc_io.c b/drivers/target/tcm_fc/tfc_io.c
    index dc7c0db..8d5cf53 100644
    --- a/drivers/target/tcm_fc/tfc_io.c
    +++ b/drivers/target/tcm_fc/tfc_io.c
    @@ -330,7 +330,7 @@ void ft_invl_hw_context(struct ft_cmd *cmd)
    ep = fc_seq_exch(seq);
    if (ep) {
    lport = ep->lp;
    - if (lport && (ep->xid <= lport->lro_xid))
    + if (lport && (ep->xid <= lport->lro_xid)) {
    /*
    * "ddp_done" trigger invalidation of HW
    * specific DDP context
    @@ -345,6 +345,7 @@ void ft_invl_hw_context(struct ft_cmd *cmd)
    * identified using ep->xid)
    */
    cmd->was_ddp_setup = 0;
    + }
    }
    }
    }
    diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
    index cf9a191..bc955d7 100644
    --- a/drivers/tty/pty.c
    +++ b/drivers/tty/pty.c
    @@ -173,6 +173,9 @@ static int pty_signal(struct tty_struct *tty, int sig)
    unsigned long flags;
    struct pid *pgrp;

    + if (sig != SIGINT && sig != SIGQUIT && sig != SIGTSTP)
    + return -EINVAL;
    +
    if (tty->link) {
    spin_lock_irqsave(&tty->link->ctrl_lock, flags);
    pgrp = get_pid(tty->link->pgrp);
    diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
    index 6f8f985..e4aada5 100644
    --- a/drivers/tty/serial/8250/8250_pci.c
    +++ b/drivers/tty/serial/8250/8250_pci.c
    @@ -67,7 +67,7 @@ static void moan_device(const char *str, struct pci_dev *dev)
    "Please send the output of lspci -vv, this\n"
    "message (0x%04x,0x%04x,0x%04x,0x%04x), the\n"
    "manufacturer and name of serial board or\n"
    - "modem board to rmk+serial@arm.linux.org.uk.\n",
    + "modem board to <linux-serial@vger.kernel.org>.\n",
    pci_name(dev), str, dev->vendor, dev->device,
    dev->subsystem_vendor, dev->subsystem_device);
    }
    diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
    index a07eb4c..5f0b4a4 100644
    --- a/drivers/tty/tty_io.c
    +++ b/drivers/tty/tty_io.c
    @@ -941,8 +941,8 @@ EXPORT_SYMBOL(start_tty);
    /* We limit tty time update visibility to every 8 seconds or so. */
    static void tty_update_time(struct timespec *time)
    {
    - unsigned long sec = get_seconds() & ~7;
    - if ((long)(sec - time->tv_sec) > 0)
    + unsigned long sec = get_seconds();
    + if (abs(sec - time->tv_sec) & ~7)
    time->tv_sec = sec;
    }

    diff --git a/drivers/tty/tty_ioctl.c b/drivers/tty/tty_ioctl.c
    index f8d03da..9ab33c7 100644
    --- a/drivers/tty/tty_ioctl.c
    +++ b/drivers/tty/tty_ioctl.c
    @@ -153,11 +153,17 @@ void tty_wait_until_sent(struct tty_struct *tty, long timeout)
    #endif
    if (!timeout)
    timeout = MAX_SCHEDULE_TIMEOUT;
    +
    if (wait_event_interruptible_timeout(tty->write_wait,
    - !tty_chars_in_buffer(tty), timeout) >= 0) {
    - if (tty->ops->wait_until_sent)
    - tty->ops->wait_until_sent(tty, timeout);
    + !tty_chars_in_buffer(tty), timeout) < 0) {
    + return;
    }
    +
    + if (timeout == MAX_SCHEDULE_TIMEOUT)
    + timeout = 0;
    +
    + if (tty->ops->wait_until_sent)
    + tty->ops->wait_until_sent(tty, timeout);
    }
    EXPORT_SYMBOL(tty_wait_until_sent);

    diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
    index 268294c..334a7b2 100644
    --- a/drivers/tty/vt/vt.c
    +++ b/drivers/tty/vt/vt.c
    @@ -498,6 +498,7 @@ void invert_screen(struct vc_data *vc, int offset, int count, int viewed)
    #endif
    if (DO_UPDATE(vc))
    do_update_region(vc, (unsigned long) p, count);
    + notify_update(vc);
    }

    /* used by selection: complement pointer position */
    @@ -514,6 +515,7 @@ void complement_pos(struct vc_data *vc, int offset)
    scr_writew(old, screenpos(vc, old_offset, 1));
    if (DO_UPDATE(vc))
    vc->vc_sw->con_putc(vc, old, oldy, oldx);
    + notify_update(vc);
    }

    old_offset = offset;
    @@ -531,8 +533,8 @@ void complement_pos(struct vc_data *vc, int offset)
    oldy = (offset >> 1) / vc->vc_cols;
    vc->vc_sw->con_putc(vc, new, oldy, oldx);
    }
    + notify_update(vc);
    }
    -
    }

    static void insert_char(struct vc_data *vc, unsigned int nr)
    diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
    index 0532577..25bc1d6 100644
    --- a/drivers/usb/class/cdc-acm.c
    +++ b/drivers/usb/class/cdc-acm.c
    @@ -1008,6 +1008,7 @@ static int acm_probe(struct usb_interface *intf,
    unsigned long quirks;
    int num_rx_buf;
    int i;
    + unsigned int elength = 0;
    int combined_interfaces = 0;

    /* normal quirks */
    @@ -1043,6 +1044,12 @@ static int acm_probe(struct usb_interface *intf,
    }

    while (buflen > 0) {
    + elength = buffer[0];
    + if (!elength) {
    + dev_err(&intf->dev, "skipping garbage byte\n");
    + elength = 1;
    + goto next_desc;
    + }
    if (buffer[1] != USB_DT_CS_INTERFACE) {
    dev_err(&intf->dev, "skipping garbage\n");
    goto next_desc;
    @@ -1050,6 +1057,8 @@ static int acm_probe(struct usb_interface *intf,

    switch (buffer[2]) {
    case USB_CDC_UNION_TYPE: /* we've found it */
    + if (elength < sizeof(struct usb_cdc_union_desc))
    + goto next_desc;
    if (union_header) {
    dev_err(&intf->dev, "More than one "
    "union descriptor, skipping ...\n");
    @@ -1058,31 +1067,38 @@ static int acm_probe(struct usb_interface *intf,
    union_header = (struct usb_cdc_union_desc *)buffer;
    break;
    case USB_CDC_COUNTRY_TYPE: /* export through sysfs*/
    + if (elength < sizeof(struct usb_cdc_country_functional_desc))
    + goto next_desc;
    cfd = (struct usb_cdc_country_functional_desc *)buffer;
    break;
    case USB_CDC_HEADER_TYPE: /* maybe check version */
    break; /* for now we ignore it */
    case USB_CDC_ACM_TYPE:
    + if (elength < 4)
    + goto next_desc;
    ac_management_function = buffer[3];
    break;
    case USB_CDC_CALL_MANAGEMENT_TYPE:
    + if (elength < 5)
    + goto next_desc;
    call_management_function = buffer[3];
    call_interface_num = buffer[4];
    if ( (quirks & NOT_A_MODEM) == 0 && (call_management_function & 3) != 3)
    dev_err(&intf->dev, "This device cannot do calls on its own. It is not a modem.\n");
    break;
    default:
    - /* there are LOTS more CDC descriptors that
    + /*
    + * there are LOTS more CDC descriptors that
    * could legitimately be found here.
    */
    dev_dbg(&intf->dev, "Ignoring descriptor: "
    - "type %02x, length %d\n",
    - buffer[2], buffer[0]);
    + "type %02x, length %ud\n",
    + buffer[2], elength);
    break;
    }
    next_desc:
    - buflen -= buffer[0];
    - buffer += buffer[0];
    + buflen -= elength;
    + buffer += elength;
    }

    if (!union_header) {
    diff --git a/drivers/usb/core/buffer.c b/drivers/usb/core/buffer.c
    index b0585e6..19fa68a 100644
    --- a/drivers/usb/core/buffer.c
    +++ b/drivers/usb/core/buffer.c
    @@ -22,17 +22,25 @@
    */

    /* FIXME tune these based on pool statistics ... */
    -static const size_t pool_max[HCD_BUFFER_POOLS] = {
    - /* platforms without dma-friendly caches might need to
    - * prevent cacheline sharing...
    - */
    - 32,
    - 128,
    - 512,
    - PAGE_SIZE / 2
    - /* bigger --> allocate pages */
    +static size_t pool_max[HCD_BUFFER_POOLS] = {
    + 32, 128, 512, 2048,
    };

    +void __init usb_init_pool_max(void)
    +{
    + /*
    + * The pool_max values must never be smaller than
    + * ARCH_KMALLOC_MINALIGN.
    + */
    + if (ARCH_KMALLOC_MINALIGN <= 32)
    + ; /* Original value is okay */
    + else if (ARCH_KMALLOC_MINALIGN <= 64)
    + pool_max[0] = 64;
    + else if (ARCH_KMALLOC_MINALIGN <= 128)
    + pool_max[0] = 0; /* Don't use this pool */
    + else
    + BUILD_BUG(); /* We don't allow this */
    +}

    /* SETUP primitives */

    diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
    index 371fe69..d2ae3d9 100644
    --- a/drivers/usb/core/devio.c
    +++ b/drivers/usb/core/devio.c
    @@ -444,6 +444,7 @@ static void async_completed(struct urb *urb)
    as->status = urb->status;
    signr = as->signr;
    if (signr) {
    + memset(&sinfo, 0, sizeof(sinfo));
    sinfo.si_signo = as->signr;
    sinfo.si_errno = as->status;
    sinfo.si_code = SI_ASYNCIO;
    @@ -2091,6 +2092,7 @@ static void usbdev_remove(struct usb_device *udev)
    wake_up_all(&ps->wait);
    list_del_init(&ps->list);
    if (ps->discsignr) {
    + memset(&sinfo, 0, sizeof(sinfo));
    sinfo.si_signo = ps->discsignr;
    sinfo.si_errno = EPIPE;
    sinfo.si_code = SI_ASYNCIO;
    diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
    index 35bc3ba..621ea00 100644
    --- a/drivers/usb/core/driver.c
    +++ b/drivers/usb/core/driver.c
    @@ -1686,6 +1686,18 @@ static int autosuspend_check(struct usb_device *udev)
    dev_dbg(&udev->dev, "remote wakeup needed for autosuspend\n");
    return -EOPNOTSUPP;
    }
    +
    + /*
    + * If the device is a direct child of the root hub and the HCD
    + * doesn't handle wakeup requests, don't allow autosuspend when
    + * wakeup is needed.
    + */
    + if (w && udev->parent == udev->bus->root_hub &&
    + bus_to_hcd(udev->bus)->cant_recv_wakeups) {
    + dev_dbg(&udev->dev, "HCD doesn't handle wakeup requests\n");
    + return -EOPNOTSUPP;
    + }
    +
    udev->do_remote_wakeup = w;
    return 0;
    }
    diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
    index 6baeada..f1d0e3c 100644
    --- a/drivers/usb/core/hcd.c
    +++ b/drivers/usb/core/hcd.c
    @@ -1528,6 +1528,7 @@ static int unlink1(struct usb_hcd *hcd, struct urb *urb, int status)
    int usb_hcd_unlink_urb (struct urb *urb, int status)
    {
    struct usb_hcd *hcd;
    + struct usb_device *udev = urb->dev;
    int retval = -EIDRM;
    unsigned long flags;

    @@ -1539,20 +1540,19 @@ int usb_hcd_unlink_urb (struct urb *urb, int status)
    spin_lock_irqsave(&hcd_urb_unlink_lock, flags);
    if (atomic_read(&urb->use_count) > 0) {
    retval = 0;
    - usb_get_dev(urb->dev);
    + usb_get_dev(udev);
    }
    spin_unlock_irqrestore(&hcd_urb_unlink_lock, flags);
    if (retval == 0) {
    hcd = bus_to_hcd(urb->dev->bus);
    retval = unlink1(hcd, urb, status);
    - usb_put_dev(urb->dev);
    + if (retval == 0)
    + retval = -EINPROGRESS;
    + else if (retval != -EIDRM && retval != -EBUSY)
    + dev_dbg(&udev->dev, "hcd_unlink_urb %p fail %d\n",
    + urb, retval);
    + usb_put_dev(udev);
    }
    -
    - if (retval == 0)
    - retval = -EINPROGRESS;
    - else if (retval != -EIDRM && retval != -EBUSY)
    - dev_dbg(&urb->dev->dev, "hcd_unlink_urb %p fail %d\n",
    - urb, retval);
    return retval;
    }

    diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
    index c74ba7b..8966960 100644
    --- a/drivers/usb/core/usb.c
    +++ b/drivers/usb/core/usb.c
    @@ -1010,6 +1010,7 @@ static int __init usb_init(void)
    pr_info("%s: USB support disabled\n", usbcore_name);
    return 0;
    }
    + usb_init_pool_max();

    retval = usb_debugfs_init();
    if (retval)
    diff --git a/drivers/usb/gadget/inode.c b/drivers/usb/gadget/inode.c
    index d9eaaa3..093e907 100644
    --- a/drivers/usb/gadget/inode.c
    +++ b/drivers/usb/gadget/inode.c
    @@ -570,6 +570,7 @@ static ssize_t ep_aio_read_retry(struct kiocb *iocb)
    break;
    }
    kfree(priv->buf);
    + kfree(priv->iv);
    kfree(priv);
    return len;
    }
    @@ -591,6 +592,7 @@ static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req)
    */
    if (priv->iv == NULL || unlikely(req->actual == 0)) {
    kfree(req->buf);
    + kfree(priv->iv);
    kfree(priv);
    iocb->private = NULL;
    /* aio_complete() reports bytes-transferred _and_ faults */
    @@ -626,7 +628,7 @@ ep_aio_rwtail(
    struct usb_request *req;
    ssize_t value;

    - priv = kmalloc(sizeof *priv, GFP_KERNEL);
    + priv = kzalloc(sizeof *priv, GFP_KERNEL);
    if (!priv) {
    value = -ENOMEM;
    fail:
    @@ -634,11 +636,19 @@ fail:
    return value;
    }
    iocb->private = priv;
    - priv->iv = iv;
    + if (iv) {
    + priv->iv = kmemdup(iv, nr_segs * sizeof(struct iovec),
    + GFP_KERNEL);
    + if (!priv->iv) {
    + kfree(priv);
    + goto fail;
    + }
    + }
    priv->nr_segs = nr_segs;

    value = get_ready_ep(iocb->ki_filp->f_flags, epdata);
    if (unlikely(value < 0)) {
    + kfree(priv->iv);
    kfree(priv);
    goto fail;
    }
    @@ -672,6 +682,7 @@ fail:
    mutex_unlock(&epdata->lock);

    if (unlikely(value)) {
    + kfree(priv->iv);
    kfree(priv);
    put_ep(epdata);
    } else
    diff --git a/drivers/usb/host/isp1760-hcd.c b/drivers/usb/host/isp1760-hcd.c
    index fc72d44..949303f 100644
    --- a/drivers/usb/host/isp1760-hcd.c
    +++ b/drivers/usb/host/isp1760-hcd.c
    @@ -2242,6 +2242,9 @@ struct usb_hcd *isp1760_register(phys_addr_t res_start, resource_size_t res_len,
    hcd->rsrc_start = res_start;
    hcd->rsrc_len = res_len;

    + /* This driver doesn't support wakeup requests */
    + hcd->cant_recv_wakeups = 1;
    +
    ret = usb_add_hcd(hcd, irq, irqflags);
    if (ret)
    goto err_unmap;
    diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
    index 56ec28b..a6d4393 100644
    --- a/drivers/usb/host/xhci-hub.c
    +++ b/drivers/usb/host/xhci-hub.c
    @@ -383,6 +383,10 @@ static void xhci_clear_port_change_bit(struct xhci_hcd *xhci, u16 wValue,
    status = PORT_PLC;
    port_change_bit = "link state";
    break;
    + case USB_PORT_FEAT_C_PORT_CONFIG_ERROR:
    + status = PORT_CEC;
    + port_change_bit = "config error";
    + break;
    default:
    /* Should never happen */
    return;
    @@ -617,6 +621,8 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
    status |= USB_PORT_STAT_C_LINK_STATE << 16;
    if ((temp & PORT_WRC))
    status |= USB_PORT_STAT_C_BH_RESET << 16;
    + if ((temp & PORT_CEC))
    + status |= USB_PORT_STAT_C_CONFIG_ERROR << 16;
    }

    if (hcd->speed != HCD_USB3) {
    @@ -904,6 +910,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
    case USB_PORT_FEAT_C_OVER_CURRENT:
    case USB_PORT_FEAT_C_ENABLE:
    case USB_PORT_FEAT_C_PORT_LINK_STATE:
    + case USB_PORT_FEAT_C_PORT_CONFIG_ERROR:
    xhci_clear_port_change_bit(xhci, wValue, wIndex,
    port_array[wIndex], temp);
    break;
    @@ -957,7 +964,7 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf)
    */
    status = bus_state->resuming_ports;

    - mask = PORT_CSC | PORT_PEC | PORT_OCC | PORT_PLC | PORT_WRC;
    + mask = PORT_CSC | PORT_PEC | PORT_OCC | PORT_PLC | PORT_WRC | PORT_CEC;

    spin_lock_irqsave(&xhci->lock, flags);
    /* For each port, did anything change? If so, set that bit in buf. */
    diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
    index c9e39d4..710b2e9 100644
    --- a/drivers/usb/host/xhci-pci.c
    +++ b/drivers/usb/host/xhci-pci.c
    @@ -36,6 +36,9 @@

    #define PCI_DEVICE_ID_INTEL_LYNXPOINT_XHCI 0x8c31
    #define PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI 0x9c31
    +#define PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI 0x22b5
    +#define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI 0xa12f
    +#define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI 0x9d2f

    static const char hcd_name[] = "xhci_hcd";

    @@ -102,6 +105,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
    if (pdev->vendor == PCI_VENDOR_ID_AMD)
    xhci->quirks |= XHCI_TRUST_TX_LENGTH;

    + if (pdev->vendor == PCI_VENDOR_ID_INTEL)
    + xhci->quirks |= XHCI_AVOID_BEI;
    if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
    pdev->device == PCI_DEVICE_ID_INTEL_PANTHERPOINT_XHCI) {
    xhci->quirks |= XHCI_EP_LIMIT_QUIRK;
    @@ -116,7 +121,12 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
    * PPT chipsets.
    */
    xhci->quirks |= XHCI_SPURIOUS_REBOOT;
    - xhci->quirks |= XHCI_AVOID_BEI;
    + }
    + if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
    + (pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI ||
    + pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI ||
    + pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI)) {
    + xhci->quirks |= XHCI_PME_STUCK_QUIRK;
    }
    if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
    pdev->device == PCI_DEVICE_ID_ASROCK_P67) {
    @@ -131,6 +141,21 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
    xhci->quirks |= XHCI_RESET_ON_RESUME;
    }

    +/*
    + * Make sure PME works on some Intel xHCI controllers by writing 1 to clear
    + * the Internal PME flag bit in vendor specific PMCTRL register at offset 0x80a4
    + */
    +static void xhci_pme_quirk(struct xhci_hcd *xhci)
    +{
    + u32 val;
    + void __iomem *reg;
    +
    + reg = (void __iomem *) xhci->cap_regs + 0x80a4;
    + val = readl(reg);
    + writel(val | BIT(28), reg);
    + readl(reg);
    +}
    +
    /* called during probe() after chip reset completes */
    static int xhci_pci_setup(struct usb_hcd *hcd)
    {
    @@ -238,6 +263,9 @@ static int xhci_pci_suspend(struct usb_hcd *hcd, bool do_wakeup)
    xhci->shared_hcd->state != HC_STATE_SUSPENDED)
    return -EINVAL;

    + if (xhci->quirks & XHCI_PME_STUCK_QUIRK)
    + xhci_pme_quirk(xhci);
    +
    retval = xhci_suspend(xhci, do_wakeup);

    return retval;
    @@ -268,6 +296,9 @@ static int xhci_pci_resume(struct usb_hcd *hcd, bool hibernated)
    if (usb_is_intel_switchable_xhci(pdev))
    usb_enable_xhci_ports(pdev);

    + if (xhci->quirks & XHCI_PME_STUCK_QUIRK)
    + xhci_pme_quirk(xhci);
    +
    retval = xhci_resume(xhci, hibernated);
    return retval;
    }
    diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
    index 950edeb..e47a4e1 100644
    --- a/drivers/usb/host/xhci-ring.c
    +++ b/drivers/usb/host/xhci-ring.c
    @@ -2049,7 +2049,7 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
    if (event_trb != ep_ring->dequeue) {
    /* The event was for the status stage */
    if (event_trb == td->last_trb) {
    - if (td->urb->actual_length != 0) {
    + if (td->urb_length_set) {
    /* Don't overwrite a previously set error code
    */
    if ((*status == -EINPROGRESS || *status == 0) &&
    @@ -2063,7 +2063,13 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
    td->urb->transfer_buffer_length;
    }
    } else {
    - /* Maybe the event was for the data stage? */
    + /*
    + * Maybe the event was for the data stage? If so, update
    + * already the actual_length of the URB and flag it as
    + * set, so that it is not overwritten in the event for
    + * the last TRB.
    + */
    + td->urb_length_set = true;
    td->urb->actual_length =
    td->urb->transfer_buffer_length -
    EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
    diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
    index 6c809350..80b3d85 100644
    --- a/drivers/usb/host/xhci.h
    +++ b/drivers/usb/host/xhci.h
    @@ -1,3 +1,4 @@
    +
    /*
    * xHCI host controller driver
    *
    @@ -88,9 +89,10 @@ struct xhci_cap_regs {
    #define HCS_IST(p) (((p) >> 0) & 0xf)
    /* bits 4:7, max number of Event Ring segments */
    #define HCS_ERST_MAX(p) (((p) >> 4) & 0xf)
    +/* bits 21:25 Hi 5 bits of Scratchpad buffers SW must allocate for the HW */
    /* bit 26 Scratchpad restore - for save/restore HW state - not used yet */
    -/* bits 27:31 number of Scratchpad buffers SW must allocate for the HW */
    -#define HCS_MAX_SCRATCHPAD(p) (((p) >> 27) & 0x1f)
    +/* bits 27:31 Lo 5 bits of Scratchpad buffers SW must allocate for the HW */
    +#define HCS_MAX_SCRATCHPAD(p) ((((p) >> 16) & 0x3e0) | (((p) >> 27) & 0x1f))

    /* HCSPARAMS3 - hcs_params3 - bitmasks */
    /* bits 0:7, Max U1 to U0 latency for the roothub ports */
    @@ -1254,6 +1256,8 @@ struct xhci_td {
    struct xhci_segment *start_seg;
    union xhci_trb *first_trb;
    union xhci_trb *last_trb;
    + /* actual_length of the URB has already been set */
    + bool urb_length_set;
    };

    /* xHCI command default timeout value */
    @@ -1511,6 +1515,7 @@ struct xhci_hcd {
    #define XHCI_PLAT (1 << 16)
    #define XHCI_SLOW_SUSPEND (1 << 17)
    #define XHCI_SPURIOUS_WAKEUP (1 << 18)
    +#define XHCI_PME_STUCK_QUIRK (1 << 20)
    unsigned int num_active_eps;
    unsigned int limit_active_eps;
    /* There are two roothubs to keep track of bus suspend info for */
    diff --git a/drivers/usb/serial/bus.c b/drivers/usb/serial/bus.c
    index ed8adb0..358d2d6 100644
    --- a/drivers/usb/serial/bus.c
    +++ b/drivers/usb/serial/bus.c
    @@ -52,6 +52,7 @@ static int usb_serial_device_probe(struct device *dev)
    {
    struct usb_serial_driver *driver;
    struct usb_serial_port *port;
    + struct device *tty_dev;
    int retval = 0;
    int minor;

    @@ -71,12 +72,20 @@ static int usb_serial_device_probe(struct device *dev)
    retval = device_create_file(dev, &dev_attr_port_number);
    if (retval) {
    if (driver->port_remove)
    - retval = driver->port_remove(port);
    + driver->port_remove(port);
    goto exit;
    }

    minor = port->number;
    - tty_register_device(usb_serial_tty_driver, minor, dev);
    + tty_dev = tty_register_device(usb_serial_tty_driver, minor, dev);
    + if (IS_ERR(tty_dev)) {
    + retval = PTR_ERR(tty_dev);
    + device_remove_file(dev, &dev_attr_port_number);
    + if (driver->port_remove)
    + driver->port_remove(port);
    + goto exit;
    + }
    +
    dev_info(&port->serial->dev->dev,
    "%s converter now attached to ttyUSB%d\n",
    driver->description, minor);
    diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
    index 8137937..5c289fc 100644
    --- a/drivers/usb/serial/cp210x.c
    +++ b/drivers/usb/serial/cp210x.c
    @@ -63,6 +63,7 @@ static const struct usb_device_id id_table[] = {
    { USB_DEVICE(0x0846, 0x1100) }, /* NetGear Managed Switch M4100 series, M5300 series, M7100 series */
    { USB_DEVICE(0x08e6, 0x5501) }, /* Gemalto Prox-PU/CU contactless smartcard reader */
    { USB_DEVICE(0x08FD, 0x000A) }, /* Digianswer A/S , ZigBee/802.15.4 MAC Device */
    + { USB_DEVICE(0x0908, 0x01FF) }, /* Siemens RUGGEDCOM USB Serial Console */
    { USB_DEVICE(0x0BED, 0x1100) }, /* MEI (TM) Cashflow-SC Bill/Voucher Acceptor */
    { USB_DEVICE(0x0BED, 0x1101) }, /* MEI series 2000 Combo Acceptor */
    { USB_DEVICE(0x0FCF, 0x1003) }, /* Dynastream ANT development board */
    @@ -152,6 +153,8 @@ static const struct usb_device_id id_table[] = {
    { USB_DEVICE(0x166A, 0x0305) }, /* Clipsal C-5000CT2 C-Bus Spectrum Colour Touchscreen */
    { USB_DEVICE(0x166A, 0x0401) }, /* Clipsal L51xx C-Bus Architectural Dimmer */
    { USB_DEVICE(0x166A, 0x0101) }, /* Clipsal 5560884 C-Bus Multi-room Audio Matrix Switcher */
    + { USB_DEVICE(0x16C0, 0x09B0) }, /* Lunatico Seletek */
    + { USB_DEVICE(0x16C0, 0x09B1) }, /* Lunatico Seletek */
    { USB_DEVICE(0x16D6, 0x0001) }, /* Jablotron serial interface */
    { USB_DEVICE(0x16DC, 0x0010) }, /* W-IE-NE-R Plein & Baus GmbH PL512 Power Supply */
    { USB_DEVICE(0x16DC, 0x0011) }, /* W-IE-NE-R Plein & Baus GmbH RCM Remote Control for MARATON Power Supply */
    diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
    index 4bfcfa7..06abee6 100644
    --- a/drivers/usb/serial/ftdi_sio.c
    +++ b/drivers/usb/serial/ftdi_sio.c
    @@ -628,6 +628,7 @@ static struct usb_device_id id_table_combined [] = {
    .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
    { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID),
    .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
    + { USB_DEVICE(FTDI_VID, FTDI_SYNAPSE_SS200_PID) },
    /*
    * ELV devices:
    */
    @@ -823,6 +824,8 @@ static struct usb_device_id id_table_combined [] = {
    { USB_DEVICE(FTDI_VID, FTDI_ELSTER_UNICOM_PID) },
    { USB_DEVICE(FTDI_VID, FTDI_PROPOX_JTAGCABLEII_PID) },
    { USB_DEVICE(FTDI_VID, FTDI_PROPOX_ISPCABLEIII_PID) },
    + { USB_DEVICE(FTDI_VID, CYBER_CORTEX_AV_PID),
    + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
    { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_PID),
    .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
    { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_H_PID),
    @@ -1000,6 +1003,23 @@ static struct usb_device_id id_table_combined [] = {
    { USB_DEVICE(FTDI_VID, FTDI_EKEY_CONV_USB_PID) },
    /* GE Healthcare devices */
    { USB_DEVICE(GE_HEALTHCARE_VID, GE_HEALTHCARE_NEMO_TRACKER_PID) },
    + /* Active Research (Actisense) devices */
    + { USB_DEVICE(FTDI_VID, ACTISENSE_NDC_PID) },
    + { USB_DEVICE(FTDI_VID, ACTISENSE_USG_PID) },
    + { USB_DEVICE(FTDI_VID, ACTISENSE_NGT_PID) },
    + { USB_DEVICE(FTDI_VID, ACTISENSE_NGW_PID) },
    + { USB_DEVICE(FTDI_VID, ACTISENSE_D9AC_PID) },
    + { USB_DEVICE(FTDI_VID, ACTISENSE_D9AD_PID) },
    + { USB_DEVICE(FTDI_VID, ACTISENSE_D9AE_PID) },
    + { USB_DEVICE(FTDI_VID, ACTISENSE_D9AF_PID) },
    + { USB_DEVICE(FTDI_VID, CHETCO_SEAGAUGE_PID) },
    + { USB_DEVICE(FTDI_VID, CHETCO_SEASWITCH_PID) },
    + { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_NMEA2000_PID) },
    + { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_ETHERNET_PID) },
    + { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_WIFI_PID) },
    + { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_DISPLAY_PID) },
    + { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_LITE_PID) },
    + { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_ANALOG_PID) },
    { }, /* Optional parameter entry */
    { } /* Terminating entry */
    };
    @@ -1930,8 +1950,12 @@ static int ftdi_8u2232c_probe(struct usb_serial *serial)

    dbg("%s", __func__);

    - if ((udev->manufacturer && !strcmp(udev->manufacturer, "CALAO Systems")) ||
    - (udev->product && !strcmp(udev->product, "BeagleBone/XDS100V2")))
    + if (udev->manufacturer && !strcmp(udev->manufacturer, "CALAO Systems"))
    + return ftdi_jtag_probe(serial);
    +
    + if (udev->product &&
    + (!strcmp(udev->product, "BeagleBone/XDS100V2") ||
    + !strcmp(udev->product, "SNAP Connect E10")))
    return ftdi_jtag_probe(serial);

    return 0;
    diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
    index ecb4dee..105b982 100644
    --- a/drivers/usb/serial/ftdi_sio_ids.h
    +++ b/drivers/usb/serial/ftdi_sio_ids.h
    @@ -38,6 +38,9 @@

    #define FTDI_LUMEL_PD12_PID 0x6002

    +/* Cyber Cortex AV by Fabulous Silicon (http://fabuloussilicon.com) */
    +#define CYBER_CORTEX_AV_PID 0x8698
    +
    /*
    * Marvell OpenRD Base, Client
    * http://www.open-rd.org
    @@ -558,6 +561,12 @@
    */
    #define FTDI_NT_ORIONLXM_PID 0x7c90 /* OrionLXm Substation Automation Platform */

    +/*
    + * Synapse Wireless product ids (FTDI_VID)
    + * http://www.synapse-wireless.com
    + */
    +#define FTDI_SYNAPSE_SS200_PID 0x9090 /* SS200 - SNAP Stick 200 */
    +

    /********************************/
    /** third-party VID/PID combos **/
    @@ -1432,3 +1441,23 @@
    */
    #define GE_HEALTHCARE_VID 0x1901
    #define GE_HEALTHCARE_NEMO_TRACKER_PID 0x0015
    +
    +/*
    + * Active Research (Actisense) devices
    + */
    +#define ACTISENSE_NDC_PID 0xD9A8 /* NDC USB Serial Adapter */
    +#define ACTISENSE_USG_PID 0xD9A9 /* USG USB Serial Adapter */
    +#define ACTISENSE_NGT_PID 0xD9AA /* NGT NMEA2000 Interface */
    +#define ACTISENSE_NGW_PID 0xD9AB /* NGW NMEA2000 Gateway */
    +#define ACTISENSE_D9AC_PID 0xD9AC /* Actisense Reserved */
    +#define ACTISENSE_D9AD_PID 0xD9AD /* Actisense Reserved */
    +#define ACTISENSE_D9AE_PID 0xD9AE /* Actisense Reserved */
    +#define ACTISENSE_D9AF_PID 0xD9AF /* Actisense Reserved */
    +#define CHETCO_SEAGAUGE_PID 0xA548 /* SeaGauge USB Adapter */
    +#define CHETCO_SEASWITCH_PID 0xA549 /* SeaSwitch USB Adapter */
    +#define CHETCO_SEASMART_NMEA2000_PID 0xA54A /* SeaSmart NMEA2000 Gateway */
    +#define CHETCO_SEASMART_ETHERNET_PID 0xA54B /* SeaSmart Ethernet Gateway */
    +#define CHETCO_SEASMART_WIFI_PID 0xA5AC /* SeaSmart Wifi Gateway */
    +#define CHETCO_SEASMART_DISPLAY_PID 0xA5AD /* SeaSmart NMEA2000 Display */
    +#define CHETCO_SEASMART_LITE_PID 0xA5AE /* SeaSmart Lite USB Adapter */
    +#define CHETCO_SEASMART_ANALOG_PID 0xA5AF /* SeaSmart Analog Adapter */
    diff --git a/drivers/video/arkfb.c b/drivers/video/arkfb.c
    index 555dd4c..65196fe 100644
    --- a/drivers/video/arkfb.c
    +++ b/drivers/video/arkfb.c
    @@ -1014,7 +1014,7 @@ static int __devinit ark_pci_probe(struct pci_dev *dev, const struct pci_device_

    vga_res.flags = IORESOURCE_IO;

    - pcibios_bus_to_resource(dev, &vga_res, &bus_reg);
    + pcibios_bus_to_resource(dev->bus, &vga_res, &bus_reg);

    par->state.vgabase = (void __iomem *) vga_res.start;

    diff --git a/drivers/video/s3fb.c b/drivers/video/s3fb.c
    index 2c80246..7b7af8c 100644
    --- a/drivers/video/s3fb.c
    +++ b/drivers/video/s3fb.c
    @@ -1172,7 +1172,7 @@ static int __devinit s3_pci_probe(struct pci_dev *dev, const struct pci_device_i

    vga_res.flags = IORESOURCE_IO;

    - pcibios_bus_to_resource(dev, &vga_res, &bus_reg);
    + pcibios_bus_to_resource(dev->bus, &vga_res, &bus_reg);

    par->state.vgabase = (void __iomem *) vga_res.start;

    diff --git a/drivers/video/vt8623fb.c b/drivers/video/vt8623fb.c
    index 4e74d26..dfecf02 100644
    --- a/drivers/video/vt8623fb.c
    +++ b/drivers/video/vt8623fb.c
    @@ -727,7 +727,7 @@ static int __devinit vt8623_pci_probe(struct pci_dev *dev, const struct pci_devi

    vga_res.flags = IORESOURCE_IO;

    - pcibios_bus_to_resource(dev, &vga_res, &bus_reg);
    + pcibios_bus_to_resource(dev->bus, &vga_res, &bus_reg);

    par->state.vgabase = (void __iomem *) vga_res.start;

    diff --git a/drivers/xen/xen-pciback/conf_space.c b/drivers/xen/xen-pciback/conf_space.c
    index 30d7be0..bb8cb69 100644
    --- a/drivers/xen/xen-pciback/conf_space.c
    +++ b/drivers/xen/xen-pciback/conf_space.c
    @@ -16,8 +16,8 @@
    #include "conf_space.h"
    #include "conf_space_quirks.h"

    -static bool permissive;
    -module_param(permissive, bool, 0644);
    +bool xen_pcibk_permissive;
    +module_param_named(permissive, xen_pcibk_permissive, bool, 0644);

    /* This is where xen_pcibk_read_config_byte, xen_pcibk_read_config_word,
    * xen_pcibk_write_config_word, and xen_pcibk_write_config_byte are created. */
    @@ -262,7 +262,7 @@ int xen_pcibk_config_write(struct pci_dev *dev, int offset, int size, u32 value)
    * This means that some fields may still be read-only because
    * they have entries in the config_field list that intercept
    * the write and do nothing. */
    - if (dev_data->permissive || permissive) {
    + if (dev_data->permissive || xen_pcibk_permissive) {
    switch (size) {
    case 1:
    err = pci_write_config_byte(dev, offset,
    diff --git a/drivers/xen/xen-pciback/conf_space.h b/drivers/xen/xen-pciback/conf_space.h
    index e56c934..62461a8 100644
    --- a/drivers/xen/xen-pciback/conf_space.h
    +++ b/drivers/xen/xen-pciback/conf_space.h
    @@ -64,6 +64,8 @@ struct config_field_entry {
    void *data;
    };

    +extern bool xen_pcibk_permissive;
    +
    #define OFFSET(cfg_entry) ((cfg_entry)->base_offset+(cfg_entry)->field->offset)

    /* Add fields to a device - the add_fields macro expects to get a pointer to
    diff --git a/drivers/xen/xen-pciback/conf_space_header.c b/drivers/xen/xen-pciback/conf_space_header.c
    index 3daf862..1667a90 100644
    --- a/drivers/xen/xen-pciback/conf_space_header.c
    +++ b/drivers/xen/xen-pciback/conf_space_header.c
    @@ -9,6 +9,10 @@
    #include "pciback.h"
    #include "conf_space.h"

    +struct pci_cmd_info {
    + u16 val;
    +};
    +
    struct pci_bar_info {
    u32 val;
    u32 len_val;
    @@ -18,22 +22,36 @@ struct pci_bar_info {
    #define is_enable_cmd(value) ((value)&(PCI_COMMAND_MEMORY|PCI_COMMAND_IO))
    #define is_master_cmd(value) ((value)&PCI_COMMAND_MASTER)

    -static int command_read(struct pci_dev *dev, int offset, u16 *value, void *data)
    +/* Bits guests are allowed to control in permissive mode. */
    +#define PCI_COMMAND_GUEST (PCI_COMMAND_MASTER|PCI_COMMAND_SPECIAL| \
    + PCI_COMMAND_INVALIDATE|PCI_COMMAND_VGA_PALETTE| \
    + PCI_COMMAND_WAIT|PCI_COMMAND_FAST_BACK)
    +
    +static void *command_init(struct pci_dev *dev, int offset)
    {
    - int i;
    - int ret;
    -
    - ret = xen_pcibk_read_config_word(dev, offset, value, data);
    - if (!pci_is_enabled(dev))
    - return ret;
    -
    - for (i = 0; i < PCI_ROM_RESOURCE; i++) {
    - if (dev->resource[i].flags & IORESOURCE_IO)
    - *value |= PCI_COMMAND_IO;
    - if (dev->resource[i].flags & IORESOURCE_MEM)
    - *value |= PCI_COMMAND_MEMORY;
    + struct pci_cmd_info *cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
    + int err;
    +
    + if (!cmd)
    + return ERR_PTR(-ENOMEM);
    +
    + err = pci_read_config_word(dev, PCI_COMMAND, &cmd->val);
    + if (err) {
    + kfree(cmd);
    + return ERR_PTR(err);
    }

    + return cmd;
    +}
    +
    +static int command_read(struct pci_dev *dev, int offset, u16 *value, void *data)
    +{
    + int ret = pci_read_config_word(dev, offset, value);
    + const struct pci_cmd_info *cmd = data;
    +
    + *value &= PCI_COMMAND_GUEST;
    + *value |= cmd->val & ~PCI_COMMAND_GUEST;
    +
    return ret;
    }

    @@ -41,6 +59,8 @@ static int command_write(struct pci_dev *dev, int offset, u16 value, void *data)
    {
    struct xen_pcibk_dev_data *dev_data;
    int err;
    + u16 val;
    + struct pci_cmd_info *cmd = data;

    dev_data = pci_get_drvdata(dev);
    if (!pci_is_enabled(dev) && is_enable_cmd(value)) {
    @@ -83,6 +103,19 @@ static int command_write(struct pci_dev *dev, int offset, u16 value, void *data)
    }
    }

    + cmd->val = value;
    +
    + if (!xen_pcibk_permissive && (!dev_data || !dev_data->permissive))
    + return 0;
    +
    + /* Only allow the guest to control certain bits. */
    + err = pci_read_config_word(dev, offset, &val);
    + if (err || val == value)
    + return err;
    +
    + value &= PCI_COMMAND_GUEST;
    + value |= val & ~PCI_COMMAND_GUEST;
    +
    return pci_write_config_word(dev, offset, value);
    }

    @@ -282,6 +315,8 @@ static const struct config_field header_common[] = {
    {
    .offset = PCI_COMMAND,
    .size = 2,
    + .init = command_init,
    + .release = bar_release,
    .u.w.read = command_read,
    .u.w.write = command_write,
    },
    diff --git a/fs/autofs4/dev-ioctl.c b/fs/autofs4/dev-ioctl.c
    index aa9103f..ace3eea 100644
    --- a/fs/autofs4/dev-ioctl.c
    +++ b/fs/autofs4/dev-ioctl.c
    @@ -95,7 +95,7 @@ static int check_dev_ioctl_version(int cmd, struct autofs_dev_ioctl *param)
    */
    static struct autofs_dev_ioctl *copy_dev_ioctl(struct autofs_dev_ioctl __user *in)
    {
    - struct autofs_dev_ioctl tmp;
    + struct autofs_dev_ioctl tmp, *res;

    if (copy_from_user(&tmp, in, sizeof(tmp)))
    return ERR_PTR(-EFAULT);
    @@ -103,7 +103,14 @@ static struct autofs_dev_ioctl *copy_dev_ioctl(struct autofs_dev_ioctl __user *i
    if (tmp.size < sizeof(tmp))
    return ERR_PTR(-EINVAL);

    - return memdup_user(in, tmp.size);
    + if (tmp.size > (PATH_MAX + sizeof(tmp)))
    + return ERR_PTR(-ENAMETOOLONG);
    +
    + res = memdup_user(in, tmp.size);
    + if (!IS_ERR(res))
    + res->size = tmp.size;
    +
    + return res;
    }

    static inline void free_dev_ioctl(struct autofs_dev_ioctl *param)
    diff --git a/fs/cifs/file.c b/fs/cifs/file.c
    index 0898d99..f069765 100644
    --- a/fs/cifs/file.c
    +++ b/fs/cifs/file.c
    @@ -1613,6 +1613,7 @@ refind_writable:
    cifsFileInfo_put(inv_file);
    spin_lock(&cifs_file_list_lock);
    ++refind;
    + inv_file = NULL;
    goto refind_writable;
    }
    }
    diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
    index 47d64e9..7b65755 100644
    --- a/fs/debugfs/inode.c
    +++ b/fs/debugfs/inode.c
    @@ -238,10 +238,19 @@ static int debugfs_show_options(struct seq_file *m, struct dentry *root)
    return 0;
    }

    +static void debugfs_evict_inode(struct inode *inode)
    +{
    + truncate_inode_pages(&inode->i_data, 0);
    + end_writeback(inode);
    + if (S_ISLNK(inode->i_mode))
    + kfree(inode->i_private);
    +}
    +
    static const struct super_operations debugfs_super_operations = {
    .statfs = simple_statfs,
    .remount_fs = debugfs_remount,
    .show_options = debugfs_show_options,
    + .evict_inode = debugfs_evict_inode,
    };

    static int debug_fill_super(struct super_block *sb, void *data, int silent)
    @@ -459,23 +468,14 @@ static int __debugfs_remove(struct dentry *dentry, struct dentry *parent)
    int ret = 0;

    if (debugfs_positive(dentry)) {
    - if (dentry->d_inode) {
    - dget(dentry);
    - switch (dentry->d_inode->i_mode & S_IFMT) {
    - case S_IFDIR:
    - ret = simple_rmdir(parent->d_inode, dentry);
    - break;
    - case S_IFLNK:
    - kfree(dentry->d_inode->i_private);
    - /* fall through */
    - default:
    - simple_unlink(parent->d_inode, dentry);
    - break;
    - }
    - if (!ret)
    - d_delete(dentry);
    - dput(dentry);
    - }
    + dget(dentry);
    + if (S_ISDIR(dentry->d_inode->i_mode))
    + ret = simple_rmdir(parent->d_inode, dentry);
    + else
    + simple_unlink(parent->d_inode, dentry);
    + if (!ret)
    + d_delete(dentry);
    + dput(dentry);
    }
    return ret;
    }
    diff --git a/fs/ecryptfs/file.c b/fs/ecryptfs/file.c
    index f04aa33..e33e0e4 100644
    --- a/fs/ecryptfs/file.c
    +++ b/fs/ecryptfs/file.c
    @@ -306,9 +306,22 @@ ecryptfs_unlocked_ioctl(struct file *file, unsigned int cmd, unsigned long arg)

    if (ecryptfs_file_to_private(file))
    lower_file = ecryptfs_file_to_lower(file);
    - if (lower_file && lower_file->f_op && lower_file->f_op->unlocked_ioctl)
    + if (!(lower_file && lower_file->f_op && lower_file->f_op->unlocked_ioctl))
    + return rc;
    +
    + switch (cmd) {
    + case FITRIM:
    + case FS_IOC_GETFLAGS:
    + case FS_IOC_SETFLAGS:
    + case FS_IOC_GETVERSION:
    + case FS_IOC_SETVERSION:
    rc = lower_file->f_op->unlocked_ioctl(lower_file, cmd, arg);
    - return rc;
    + fsstack_copy_attr_all(file->f_path.dentry->d_inode,
    + lower_file->f_path.dentry->d_inode);
    + return rc;
    + default:
    + return rc;
    + }
    }

    #ifdef CONFIG_COMPAT
    @@ -320,9 +333,22 @@ ecryptfs_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)

    if (ecryptfs_file_to_private(file))
    lower_file = ecryptfs_file_to_lower(file);
    - if (lower_file && lower_file->f_op && lower_file->f_op->compat_ioctl)
    + if (!(lower_file && lower_file->f_op && lower_file->f_op->compat_ioctl))
    + return rc;
    +
    + switch (cmd) {
    + case FITRIM:
    + case FS_IOC32_GETFLAGS:
    + case FS_IOC32_SETFLAGS:
    + case FS_IOC32_GETVERSION:
    + case FS_IOC32_SETVERSION:
    rc = lower_file->f_op->compat_ioctl(lower_file, cmd, arg);
    - return rc;
    + fsstack_copy_attr_all(file->f_path.dentry->d_inode,
    + lower_file->f_path.dentry->d_inode);
    + return rc;
    + default:
    + return rc;
    + }
    }
    #endif

    diff --git a/fs/exec.c b/fs/exec.c
    index 5b9dfbe..91d238f 100644
    --- a/fs/exec.c
    +++ b/fs/exec.c
    @@ -1248,6 +1248,45 @@ void install_exec_creds(struct linux_binprm *bprm)
    }
    EXPORT_SYMBOL(install_exec_creds);

    +static void bprm_fill_uid(struct linux_binprm *bprm)
    +{
    + struct inode *inode;
    + unsigned int mode;
    + uid_t uid;
    + gid_t gid;
    +
    + /* clear any previous set[ug]id data from a previous binary */
    + bprm->cred->euid = current_euid();
    + bprm->cred->egid = current_egid();
    +
    + if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
    + return;
    +
    + inode = bprm->file->f_path.dentry->d_inode;
    + mode = ACCESS_ONCE(inode->i_mode);
    + if (!(mode & (S_ISUID|S_ISGID)))
    + return;
    +
    + /* Be careful if suid/sgid is set */
    + mutex_lock(&inode->i_mutex);
    +
    + /* reload atomically mode/uid/gid now that lock held */
    + mode = inode->i_mode;
    + uid = inode->i_uid;
    + gid = inode->i_gid;
    + mutex_unlock(&inode->i_mutex);
    +
    + if (mode & S_ISUID) {
    + bprm->per_clear |= PER_CLEAR_ON_SETID;
    + bprm->cred->euid = uid;
    + }
    +
    + if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
    + bprm->per_clear |= PER_CLEAR_ON_SETID;
    + bprm->cred->egid = gid;
    + }
    +}
    +
    /*
    * determine how safe it is to execute the proposed program
    * - the caller must hold ->cred_guard_mutex to protect against
    @@ -1297,36 +1336,12 @@ static int check_unsafe_exec(struct linux_binprm *bprm)
    */
    int prepare_binprm(struct linux_binprm *bprm)
    {
    - umode_t mode;
    - struct inode * inode = bprm->file->f_path.dentry->d_inode;
    int retval;

    - mode = inode->i_mode;
    if (bprm->file->f_op == NULL)
    return -EACCES;

    - /* clear any previous set[ug]id data from a previous binary */
    - bprm->cred->euid = current_euid();
    - bprm->cred->egid = current_egid();
    -
    - if (!(bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)) {
    - /* Set-uid? */
    - if (mode & S_ISUID) {
    - bprm->per_clear |= PER_CLEAR_ON_SETID;
    - bprm->cred->euid = inode->i_uid;
    - }
    -
    - /* Set-gid? */
    - /*
    - * If setgid is set but no group execute bit then this
    - * is a candidate for mandatory locking, not a setgid
    - * executable.
    - */
    - if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
    - bprm->per_clear |= PER_CLEAR_ON_SETID;
    - bprm->cred->egid = inode->i_gid;
    - }
    - }
    + bprm_fill_uid(bprm);

    /* fill in binprm security blob */
    retval = security_bprm_set_creds(bprm);
    diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
    index f4246cf..0949b83 100644
    --- a/fs/fuse/dev.c
    +++ b/fs/fuse/dev.c
    @@ -717,8 +717,8 @@ static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep)

    newpage = buf->page;

    - if (WARN_ON(!PageUptodate(newpage)))
    - return -EIO;
    + if (!PageUptodate(newpage))
    + SetPageUptodate(newpage);

    ClearPageMappedToDisk(newpage);

    @@ -1634,6 +1634,9 @@ copy_finish:
    static int fuse_notify(struct fuse_conn *fc, enum fuse_notify_code code,
    unsigned int size, struct fuse_copy_state *cs)
    {
    + /* Don't try to move pages (yet) */
    + cs->move_pages = 0;
    +
    switch (code) {
    case FUSE_NOTIFY_POLL:
    return fuse_notify_poll(fc, size, cs);
    diff --git a/fs/hfsplus/brec.c b/fs/hfsplus/brec.c
    index 2a734cf..7429c40 100644
    --- a/fs/hfsplus/brec.c
    +++ b/fs/hfsplus/brec.c
    @@ -130,13 +130,16 @@ skip:
    hfs_bnode_write(node, entry, data_off + key_len, entry_len);
    hfs_bnode_dump(node);

    - if (new_node) {
    - /* update parent key if we inserted a key
    - * at the start of the first node
    - */
    - if (!rec && new_node != node)
    - hfs_brec_update_parent(fd);
    + /*
    + * update parent key if we inserted a key
    + * at the start of the node and it is not the new node
    + */
    + if (!rec && new_node != node) {
    + hfs_bnode_read_key(node, fd->search_key, data_off + size);
    + hfs_brec_update_parent(fd);
    + }

    + if (new_node) {
    hfs_bnode_put(fd->bnode);
    if (!new_node->parent) {
    hfs_btree_inc_height(tree);
    @@ -166,9 +169,6 @@ skip:
    goto again;
    }

    - if (!rec)
    - hfs_brec_update_parent(fd);
    -
    return 0;
    }

    @@ -368,6 +368,8 @@ again:
    if (IS_ERR(parent))
    return PTR_ERR(parent);
    __hfs_brec_find(parent, fd);
    + if (fd->record < 0)
    + return -ENOENT;
    hfs_bnode_dump(parent);
    rec = fd->record;

    diff --git a/fs/jffs2/scan.c b/fs/jffs2/scan.c
    index 7654e87..9ad5ba4 100644
    --- a/fs/jffs2/scan.c
    +++ b/fs/jffs2/scan.c
    @@ -510,6 +510,10 @@ static int jffs2_scan_eraseblock (struct jffs2_sb_info *c, struct jffs2_eraseblo
    sumlen = c->sector_size - je32_to_cpu(sm->offset);
    sumptr = buf + buf_size - sumlen;

    + /* sm->offset maybe wrong but MAGIC maybe right */
    + if (sumlen > c->sector_size)
    + goto full_scan;
    +
    /* Now, make sure the summary itself is available */
    if (sumlen > buf_size) {
    /* Need to kmalloc for this. */
    @@ -544,6 +548,7 @@ static int jffs2_scan_eraseblock (struct jffs2_sb_info *c, struct jffs2_eraseblo
    }
    }

    +full_scan:
    buf_ofs = jeb->offset;

    if (!buf_size) {
    diff --git a/fs/namei.c b/fs/namei.c
    index 5974fb5..bdcd705 100644
    --- a/fs/namei.c
    +++ b/fs/namei.c
    @@ -579,7 +579,8 @@ static __always_inline int __vfs_follow_link(struct nameidata *nd, const char *l
    goto fail;

    if (*link == '/') {
    - set_root(nd);
    + if (!nd->root.mnt)
    + set_root(nd);
    path_put(&nd->path);
    nd->path = nd->root;
    path_get(&nd->root);
    diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
    index 27c2969..3abfd5a 100644
    --- a/fs/nfs/callback_xdr.c
    +++ b/fs/nfs/callback_xdr.c
    @@ -463,8 +463,10 @@ static __be32 decode_cb_sequence_args(struct svc_rqst *rqstp,

    for (i = 0; i < args->csa_nrclists; i++) {
    status = decode_rc_list(xdr, &args->csa_rclists[i]);
    - if (status)
    + if (status) {
    + args->csa_nrclists = i;
    goto out_free;
    + }
    }
    }
    status = 0;
    diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
    index 16d16e5..62261de 100644
    --- a/fs/nfs/delegation.c
    +++ b/fs/nfs/delegation.c
    @@ -148,8 +148,8 @@ void nfs_inode_reclaim_delegation(struct inode *inode, struct rpc_cred *cred,
    &delegation->flags);
    NFS_I(inode)->delegation_state = delegation->type;
    spin_unlock(&delegation->lock);
    - put_rpccred(oldcred);
    rcu_read_unlock();
    + put_rpccred(oldcred);
    } else {
    /* We appear to have raced with a delegation return. */
    spin_unlock(&delegation->lock);
    diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c
    index b2e3ff3..ecdbae1 100644
    --- a/fs/nilfs2/btree.c
    +++ b/fs/nilfs2/btree.c
    @@ -31,6 +31,8 @@
    #include "alloc.h"
    #include "dat.h"

    +static void __nilfs_btree_init(struct nilfs_bmap *bmap);
    +
    static struct nilfs_btree_path *nilfs_btree_alloc_path(void)
    {
    struct nilfs_btree_path *path;
    @@ -368,6 +370,34 @@ static int nilfs_btree_node_broken(const struct nilfs_btree_node *node,
    return ret;
    }

    +/**
    + * nilfs_btree_root_broken - verify consistency of btree root node
    + * @node: btree root node to be examined
    + * @ino: inode number
    + *
    + * Return Value: If node is broken, 1 is returned. Otherwise, 0 is returned.
    + */
    +static int nilfs_btree_root_broken(const struct nilfs_btree_node *node,
    + unsigned long ino)
    +{
    + int level, flags, nchildren;
    + int ret = 0;
    +
    + level = nilfs_btree_node_get_level(node);
    + flags = nilfs_btree_node_get_flags(node);
    + nchildren = nilfs_btree_node_get_nchildren(node);
    +
    + if (unlikely(level < NILFS_BTREE_LEVEL_NODE_MIN ||
    + level > NILFS_BTREE_LEVEL_MAX ||
    + nchildren < 0 ||
    + nchildren > NILFS_BTREE_ROOT_NCHILDREN_MAX)) {
    + pr_crit("NILFS: bad btree root (inode number=%lu): level = %d, flags = 0x%x, nchildren = %d\n",
    + ino, level, flags, nchildren);
    + ret = 1;
    + }
    + return ret;
    +}
    +
    int nilfs_btree_broken_node_block(struct buffer_head *bh)
    {
    int ret;
    @@ -1713,7 +1743,7 @@ nilfs_btree_commit_convert_and_insert(struct nilfs_bmap *btree,

    /* convert and insert */
    dat = NILFS_BMAP_USE_VBN(btree) ? nilfs_bmap_get_dat(btree) : NULL;
    - nilfs_btree_init(btree);
    + __nilfs_btree_init(btree);
    if (nreq != NULL) {
    nilfs_bmap_commit_alloc_ptr(btree, dreq, dat);
    nilfs_bmap_commit_alloc_ptr(btree, nreq, dat);
    @@ -2294,12 +2324,23 @@ static const struct nilfs_bmap_operations nilfs_btree_ops_gc = {
    .bop_gather_data = NULL,
    };

    -int nilfs_btree_init(struct nilfs_bmap *bmap)
    +static void __nilfs_btree_init(struct nilfs_bmap *bmap)
    {
    bmap->b_ops = &nilfs_btree_ops;
    bmap->b_nchildren_per_block =
    NILFS_BTREE_NODE_NCHILDREN_MAX(nilfs_btree_node_size(bmap));
    - return 0;
    +}
    +
    +int nilfs_btree_init(struct nilfs_bmap *bmap)
    +{
    + int ret = 0;
    +
    + __nilfs_btree_init(bmap);
    +
    + if (nilfs_btree_root_broken(nilfs_btree_get_root(bmap),
    + bmap->b_inode->i_ino))
    + ret = -EIO;
    + return ret;
    }

    void nilfs_btree_init_gc(struct nilfs_bmap *bmap)
    diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
    index 8021098..dc79934 100644
    --- a/fs/ocfs2/file.c
    +++ b/fs/ocfs2/file.c
    @@ -2387,10 +2387,14 @@ out_dio:
    /* buffered aio wouldn't have proper lock coverage today */
    BUG_ON(ret == -EIOCBQUEUED && !(file->f_flags & O_DIRECT));

    + if (unlikely(written <= 0))
    + goto no_sync;
    +
    if (((file->f_flags & O_DSYNC) && !direct_io) || IS_SYNC(inode) ||
    ((file->f_flags & O_DIRECT) && !direct_io)) {
    - ret = filemap_fdatawrite_range(file->f_mapping, *ppos,
    - *ppos + count - 1);
    + ret = filemap_fdatawrite_range(file->f_mapping,
    + iocb->ki_pos - written,
    + iocb->ki_pos - 1);
    if (ret < 0)
    written = ret;

    @@ -2403,10 +2407,12 @@ out_dio:
    }

    if (!ret)
    - ret = filemap_fdatawait_range(file->f_mapping, *ppos,
    - *ppos + count - 1);
    + ret = filemap_fdatawait_range(file->f_mapping,
    + iocb->ki_pos - written,
    + iocb->ki_pos - 1);
    }

    +no_sync:
    /*
    * deep in g_f_a_w_n()->ocfs2_direct_IO we pass in a ocfs2_dio_end_io
    * function pointer which is called when o_direct io completes so that
    @@ -2468,9 +2474,7 @@ static ssize_t ocfs2_file_splice_write(struct pipe_inode_info *pipe,
    struct address_space *mapping = out->f_mapping;
    struct inode *inode = mapping->host;
    struct splice_desc sd = {
    - .total_len = len,
    .flags = flags,
    - .pos = *ppos,
    .u.file = out,
    };

    @@ -2480,6 +2484,12 @@ static ssize_t ocfs2_file_splice_write(struct pipe_inode_info *pipe,
    out->f_path.dentry->d_name.len,
    out->f_path.dentry->d_name.name, len);

    + ret = generic_write_checks(out, ppos, &len, 0);
    + if (ret)
    + return ret;
    + sd.total_len = len;
    + sd.pos = *ppos;
    +
    if (pipe->inode)
    mutex_lock_nested(&pipe->inode->i_mutex, I_MUTEX_PARENT);

    diff --git a/fs/splice.c b/fs/splice.c
    index bed6a3c..67c5210 100644
    --- a/fs/splice.c
    +++ b/fs/splice.c
    @@ -991,13 +991,17 @@ generic_file_splice_write(struct pipe_inode_info *pipe, struct file *out,
    struct address_space *mapping = out->f_mapping;
    struct inode *inode = mapping->host;
    struct splice_desc sd = {
    - .total_len = len,
    .flags = flags,
    - .pos = *ppos,
    .u.file = out,
    };
    ssize_t ret;

    + ret = generic_write_checks(out, ppos, &len, S_ISBLK(inode->i_mode));
    + if (ret)
    + return ret;
    + sd.total_len = len;
    + sd.pos = *ppos;
    +
    pipe_lock(pipe);

    splice_from_pipe_begin(&sd);
    diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h
    index 4053cbd..ddce23d 100644
    --- a/include/linux/blk_types.h
    +++ b/include/linux/blk_types.h
    @@ -144,7 +144,9 @@ enum rq_flag_bits {
    __REQ_ELVPRIV, /* elevator private data attached */
    __REQ_FAILED, /* set if the request failed */
    __REQ_QUIET, /* don't worry about errors */
    - __REQ_PREEMPT, /* set for "ide_preempt" requests */
    + __REQ_PREEMPT, /* set for "ide_preempt" requests and also
    + for requests for which the SCSI "quiesce"
    + state must be ignored. */
    __REQ_ALLOCED, /* request came from our alloc pool */
    __REQ_COPY_USER, /* contains copies of user pages */
    __REQ_FLUSH_SEQ, /* request for flush sequence */
    diff --git a/include/linux/fsnotify.h b/include/linux/fsnotify.h
    index a6dfe69..fac26cb 100644
    --- a/include/linux/fsnotify.h
    +++ b/include/linux/fsnotify.h
    @@ -101,8 +101,10 @@ static inline void fsnotify_move(struct inode *old_dir, struct inode *new_dir,
    new_dir_mask |= FS_ISDIR;
    }

    - fsnotify(old_dir, old_dir_mask, old_dir, FSNOTIFY_EVENT_INODE, old_name, fs_cookie);
    - fsnotify(new_dir, new_dir_mask, new_dir, FSNOTIFY_EVENT_INODE, new_name, fs_cookie);
    + fsnotify(old_dir, old_dir_mask, source, FSNOTIFY_EVENT_INODE, old_name,
    + fs_cookie);
    + fsnotify(new_dir, new_dir_mask, source, FSNOTIFY_EVENT_INODE, new_name,
    + fs_cookie);

    if (target)
    fsnotify_link_count(target);
    diff --git a/include/linux/pci.h b/include/linux/pci.h
    index e444f5b..469c953 100644
    --- a/include/linux/pci.h
    +++ b/include/linux/pci.h
    @@ -648,9 +648,9 @@ void pci_fixup_cardbus(struct pci_bus *);

    /* Generic PCI functions used internally */

    -void pcibios_resource_to_bus(struct pci_dev *dev, struct pci_bus_region *region,
    +void pcibios_resource_to_bus(struct pci_bus *bus, struct pci_bus_region *region,
    struct resource *res);
    -void pcibios_bus_to_resource(struct pci_dev *dev, struct resource *res,
    +void pcibios_bus_to_resource(struct pci_bus *bus, struct resource *res,
    struct pci_bus_region *region);
    void pcibios_scan_specific_bus(int busn);
    extern struct pci_bus *pci_find_bus(int domain, int busnr);
    diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h
    index 815cc4b..feb77716 100644
    --- a/include/linux/usb/hcd.h
    +++ b/include/linux/usb/hcd.h
    @@ -126,6 +126,7 @@ struct usb_hcd {
    unsigned wireless:1; /* Wireless USB HCD */
    unsigned authorized_default:1;
    unsigned has_tt:1; /* Integrated TT in root hub */
    + unsigned cant_recv_wakeups:1;

    unsigned int irq; /* irq allocated */
    void __iomem *regs; /* device memory/io */
    @@ -399,6 +400,7 @@ extern const struct dev_pm_ops usb_hcd_pci_pm_ops;
    #endif /* CONFIG_PCI */

    /* pci-ish (pdev null is ok) buffer alloc/mapping support */
    +void usb_init_pool_max(void);
    int hcd_buffer_create(struct usb_hcd *hcd);
    void hcd_buffer_destroy(struct usb_hcd *hcd);

    diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
    index 67b847d..d1342c2 100644
    --- a/kernel/debug/kdb/kdb_main.c
    +++ b/kernel/debug/kdb/kdb_main.c
    @@ -2598,7 +2598,7 @@ static int kdb_summary(int argc, const char **argv)
    #define K(x) ((x) << (PAGE_SHIFT - 10))
    kdb_printf("\nMemTotal: %8lu kB\nMemFree: %8lu kB\n"
    "Buffers: %8lu kB\n",
    - val.totalram, val.freeram, val.bufferram);
    + K(val.totalram), K(val.freeram), K(val.bufferram));
    return 0;
    }

    diff --git a/kernel/events/core.c b/kernel/events/core.c
    index 0466297..461b6e0 100644
    --- a/kernel/events/core.c
    +++ b/kernel/events/core.c
    @@ -3877,6 +3877,13 @@ static void perf_pending_event(struct irq_work *entry)
    {
    struct perf_event *event = container_of(entry,
    struct perf_event, pending);
    + int rctx;
    +
    + rctx = perf_swevent_get_recursion_context();
    + /*
    + * If we 'fail' here, that's OK, it means recursion is already disabled
    + * and we won't recurse 'further'.
    + */

    if (event->pending_disable) {
    event->pending_disable = 0;
    @@ -3887,6 +3894,9 @@ static void perf_pending_event(struct irq_work *entry)
    event->pending_wakeup = 0;
    perf_event_wakeup(event);
    }
    +
    + if (rctx >= 0)
    + perf_swevent_put_recursion_context(rctx);
    }

    /*
    diff --git a/kernel/printk.c b/kernel/printk.c
    index 544c021..cb72d9c 100644
    --- a/kernel/printk.c
    +++ b/kernel/printk.c
    @@ -126,7 +126,7 @@ static struct console *exclusive_console;
    */
    struct console_cmdline
    {
    - char name[8]; /* Name of the driver */
    + char name[16]; /* Name of the driver */
    int index; /* Minor dev. to use */
    char *options; /* Options for the driver */
    #ifdef CONFIG_A11Y_BRAILLE_CONSOLE
    @@ -1498,6 +1498,7 @@ void register_console(struct console *newcon)
    */
    for (i = 0; i < MAX_CMDLINECONSOLES && console_cmdline[i].name[0];
    i++) {
    + BUILD_BUG_ON(sizeof(console_cmdline[i].name) != sizeof(newcon->name));
    if (strcmp(console_cmdline[i].name, newcon->name) != 0)
    continue;
    if (newcon->index >= 0 &&
    diff --git a/kernel/sched/core.c b/kernel/sched/core.c
    index 5701cb9..2f8363e 100644
    --- a/kernel/sched/core.c
    +++ b/kernel/sched/core.c
    @@ -4031,10 +4031,13 @@ void rt_mutex_setprio(struct task_struct *p, int prio)
    if (running)
    p->sched_class->put_prev_task(rq, p);

    - if (rt_prio(prio))
    + if (rt_prio(prio)) {
    p->sched_class = &rt_sched_class;
    - else
    + } else {
    + if (rt_prio(oldprio))
    + p->rt.timeout = 0;
    p->sched_class = &fair_sched_class;
    + }

    p->prio = prio;

    diff --git a/kernel/softirq.c b/kernel/softirq.c
    index 671f959..5cc401e 100644
    --- a/kernel/softirq.c
    +++ b/kernel/softirq.c
    @@ -194,22 +194,28 @@ void local_bh_enable_ip(unsigned long ip)
    EXPORT_SYMBOL(local_bh_enable_ip);

    /*
    - * We restart softirq processing MAX_SOFTIRQ_RESTART times,
    - * and we fall back to softirqd after that.
    + * We restart softirq processing for at most MAX_SOFTIRQ_RESTART times,
    + * but break the loop if need_resched() is set or after 2 ms.
    + * The MAX_SOFTIRQ_TIME provides a nice upper bound in most cases, but in
    + * certain cases, such as stop_machine(), jiffies may cease to
    + * increment and so we need the MAX_SOFTIRQ_RESTART limit as
    + * well to make sure we eventually return from this method.
    *
    - * This number has been established via experimentation.
    + * These limits have been established via experimentation.
    * The two things to balance is latency against fairness -
    * we want to handle softirqs as soon as possible, but they
    * should not be able to lock up the box.
    */
    +#define MAX_SOFTIRQ_TIME msecs_to_jiffies(2)
    #define MAX_SOFTIRQ_RESTART 10

    asmlinkage void __do_softirq(void)
    {
    struct softirq_action *h;
    __u32 pending;
    - int max_restart = MAX_SOFTIRQ_RESTART;
    + unsigned long end = jiffies + MAX_SOFTIRQ_TIME;
    int cpu;
    + int max_restart = MAX_SOFTIRQ_RESTART;

    pending = local_softirq_pending();
    account_system_vtime(current);
    @@ -255,11 +261,13 @@ restart:
    local_irq_disable();

    pending = local_softirq_pending();
    - if (pending && --max_restart)
    - goto restart;
    + if (pending) {
    + if (time_before(jiffies, end) && !need_resched() &&
    + --max_restart)
    + goto restart;

    - if (pending)
    wakeup_softirqd();
    + }

    lockdep_softirq_exit();

    diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
    index 5b6bd45..ffea326 100644
    --- a/kernel/trace/ftrace.c
    +++ b/kernel/trace/ftrace.c
    @@ -1014,6 +1014,12 @@ ftrace_filter_lseek(struct file *file, loff_t offset, int whence)
    return ret;
    }

    +#ifdef CONFIG_FUNCTION_GRAPH_TRACER
    +static int ftrace_graph_active;
    +#else
    +# define ftrace_graph_active 0
    +#endif
    +
    #ifdef CONFIG_DYNAMIC_FTRACE

    #ifndef CONFIG_FTRACE_MCOUNT_RECORD
    @@ -2056,24 +2062,36 @@ static int ftrace_shutdown(struct ftrace_ops *ops, int command)

    static void ftrace_startup_sysctl(void)
    {
    + int command;
    +
    if (unlikely(ftrace_disabled))
    return;

    /* Force update next time */
    saved_ftrace_func = NULL;
    /* ftrace_start_up is true if we want ftrace running */
    - if (ftrace_start_up)
    - ftrace_run_update_code(FTRACE_UPDATE_CALLS);
    + if (ftrace_start_up) {
    + command = FTRACE_UPDATE_CALLS;
    + if (ftrace_graph_active)
    + command |= FTRACE_START_FUNC_RET;
    + ftrace_startup_enable(command);
    + }
    }

    static void ftrace_shutdown_sysctl(void)
    {
    + int command;
    +
    if (unlikely(ftrace_disabled))
    return;

    /* ftrace_start_up is true if ftrace is running */
    - if (ftrace_start_up)
    - ftrace_run_update_code(FTRACE_DISABLE_CALLS);
    + if (ftrace_start_up) {
    + command = FTRACE_DISABLE_CALLS;
    + if (ftrace_graph_active)
    + command |= FTRACE_STOP_FUNC_RET;
    + ftrace_run_update_code(command);
    + }
    }

    static cycle_t ftrace_update_time;
    @@ -4445,12 +4463,12 @@ ftrace_enable_sysctl(struct ctl_table *table, int write,

    if (ftrace_enabled) {

    - ftrace_startup_sysctl();
    -
    /* we are starting ftrace again */
    if (ftrace_ops_list != &ftrace_list_end)
    update_ftrace_function();

    + ftrace_startup_sysctl();
    +
    } else {
    /* stopping ftrace calls (just send to ftrace_stub) */
    ftrace_trace_function = ftrace_stub;
    @@ -4465,7 +4483,6 @@ ftrace_enable_sysctl(struct ctl_table *table, int write,

    #ifdef CONFIG_FUNCTION_GRAPH_TRACER

    -static int ftrace_graph_active;
    static struct notifier_block ftrace_suspend_notifier;

    int ftrace_graph_entry_stub(struct ftrace_graph_ent *trace)
    diff --git a/mm/hugetlb.c b/mm/hugetlb.c
    index efd6820..bc36e28 100644
    --- a/mm/hugetlb.c
    +++ b/mm/hugetlb.c
    @@ -2401,9 +2401,10 @@ void __unmap_hugepage_range(struct vm_area_struct *vma, unsigned long start,
    continue;

    /*
    - * HWPoisoned hugepage is already unmapped and dropped reference
    + * Migrating hugepage or HWPoisoned hugepage is already
    + * unmapped and its refcount is dropped
    */
    - if (unlikely(is_hugetlb_entry_hwpoisoned(pte)))
    + if (unlikely(!pte_present(pte)))
    continue;

    page = pte_page(pte);
    @@ -2813,6 +2814,7 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
    struct page *pagecache_page = NULL;
    static DEFINE_MUTEX(hugetlb_instantiation_mutex);
    struct hstate *h = hstate_vma(vma);
    + int need_wait_lock = 0;

    address &= huge_page_mask(h);

    @@ -2846,6 +2848,16 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
    ret = 0;

    /*
    + * entry could be a migration/hwpoison entry at this point, so this
    + * check prevents the kernel from going below assuming that we have
    + * a active hugepage in pagecache. This goto expects the 2nd page fault,
    + * and is_hugetlb_entry_(migration|hwpoisoned) check will properly
    + * handle it.
    + */
    + if (!pte_present(entry))
    + goto out_mutex;
    +
    + /*
    * If we are going to COW the mapping later, we examine the pending
    * reservations for this page now. This will ensure that any
    * allocations necessary to record that reservation occur outside the
    @@ -2864,29 +2876,32 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
    vma, address);
    }

    + spin_lock(&mm->page_table_lock);
    +
    + /* Check for a racing update before calling hugetlb_cow */
    + if (unlikely(!pte_same(entry, huge_ptep_get(ptep))))
    + goto out_page_table_lock;
    +
    /*
    * hugetlb_cow() requires page locks of pte_page(entry) and
    * pagecache_page, so here we need take the former one
    * when page != pagecache_page or !pagecache_page.
    - * Note that locking order is always pagecache_page -> page,
    - * so no worry about deadlock.
    */
    page = pte_page(entry);
    - get_page(page);
    if (page != pagecache_page)
    - lock_page(page);
    + if (!trylock_page(page)) {
    + need_wait_lock = 1;
    + goto out_page_table_lock;
    + }

    - spin_lock(&mm->page_table_lock);
    - /* Check for a racing update before calling hugetlb_cow */
    - if (unlikely(!pte_same(entry, huge_ptep_get(ptep))))
    - goto out_page_table_lock;
    + get_page(page);


    if (flags & FAULT_FLAG_WRITE) {
    if (!pte_write(entry)) {
    ret = hugetlb_cow(mm, vma, address, ptep, entry,
    pagecache_page);
    - goto out_page_table_lock;
    + goto out_put_page;
    }
    entry = pte_mkdirty(entry);
    }
    @@ -2895,6 +2910,10 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
    flags & FAULT_FLAG_WRITE))
    update_mmu_cache(vma, address, ptep);

    +out_put_page:
    + if (page != pagecache_page)
    + unlock_page(page);
    + put_page(page);
    out_page_table_lock:
    spin_unlock(&mm->page_table_lock);

    @@ -3034,7 +3053,22 @@ void hugetlb_change_protection(struct vm_area_struct *vma,
    continue;
    if (huge_pmd_unshare(mm, &address, ptep))
    continue;
    - if (!huge_pte_none(huge_ptep_get(ptep))) {
    + pte = huge_ptep_get(ptep);
    + if (unlikely(is_hugetlb_entry_hwpoisoned(pte)))
    + continue;
    + if (unlikely(is_hugetlb_entry_migration(pte))) {
    + swp_entry_t entry = pte_to_swp_entry(pte);
    +
    + if (is_write_migration_entry(entry)) {
    + pte_t newpte;
    +
    + make_migration_entry_read(&entry);
    + newpte = swp_entry_to_pte(entry);
    + set_huge_pte_at(mm, address, ptep, newpte);
    + }
    + continue;
    + }
    + if (!huge_pte_none(pte)) {
    pte = huge_ptep_get_and_clear(mm, address, ptep);
    pte = pte_mkhuge(pte_modify(pte, newprot));
    set_huge_pte_at(mm, address, ptep, pte);
    diff --git a/mm/memory.c b/mm/memory.c
    index 45cd14f..02aef93 100644
    --- a/mm/memory.c
    +++ b/mm/memory.c
    @@ -3845,7 +3845,7 @@ int generic_access_phys(struct vm_area_struct *vma, unsigned long addr,
    if (follow_phys(vma, addr, write, &prot, &phys_addr))
    return -EINVAL;

    - maddr = ioremap_prot(phys_addr, PAGE_SIZE, prot);
    + maddr = ioremap_prot(phys_addr, PAGE_ALIGN(len + offset), prot);
    if (write)
    memcpy_toio(maddr + offset, buf, len);
    else
    diff --git a/mm/mmap.c b/mm/mmap.c
    index 208e70f..cb6456d 100644
    --- a/mm/mmap.c
    +++ b/mm/mmap.c
    @@ -112,7 +112,7 @@ struct percpu_counter vm_committed_as ____cacheline_aligned_in_smp;
    */
    int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin)
    {
    - unsigned long free, allowed;
    + long free, allowed;

    vm_acct_memory(pages);

    diff --git a/mm/nommu.c b/mm/nommu.c
    index d3afb47..3f282f9 100644
    --- a/mm/nommu.c
    +++ b/mm/nommu.c
    @@ -1916,7 +1916,7 @@ EXPORT_SYMBOL(unmap_mapping_range);
    */
    int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin)
    {
    - unsigned long free, allowed;
    + long free, allowed;

    vm_acct_memory(pages);

    diff --git a/mm/page-writeback.c b/mm/page-writeback.c
    index 057884c..ecd1c4c 100644
    --- a/mm/page-writeback.c
    +++ b/mm/page-writeback.c
    @@ -716,7 +716,7 @@ static unsigned long bdi_position_ratio(struct backing_dev_info *bdi,
    * scale global setpoint to bdi's:
    * bdi_setpoint = setpoint * bdi_thresh / thresh
    */
    - x = div_u64((u64)bdi_thresh << 16, thresh + 1);
    + x = div_u64((u64)bdi_thresh << 16, thresh | 1);
    bdi_setpoint = setpoint * (u64)x >> 16;
    /*
    * Use span=(8*write_bw) in single bdi case as indicated by
    @@ -766,8 +766,11 @@ static void bdi_update_write_bandwidth(struct backing_dev_info *bdi,
    * bw * elapsed + write_bandwidth * (period - elapsed)
    * write_bandwidth = ---------------------------------------------------
    * period
    + *
    + * @written may have decreased due to account_page_redirty().
    + * Avoid underflowing @bw calculation.
    */
    - bw = written - bdi->written_stamp;
    + bw = written - min(written, bdi->written_stamp);
    bw *= HZ;
    if (unlikely(elapsed > period)) {
    do_div(bw, elapsed);
    @@ -831,7 +834,7 @@ static void global_update_bandwidth(unsigned long thresh,
    unsigned long now)
    {
    static DEFINE_SPINLOCK(dirty_lock);
    - static unsigned long update_time;
    + static unsigned long update_time = INITIAL_JIFFIES;

    /*
    * check locklessly first to optimize away locking for the most time
    diff --git a/mm/slub.c b/mm/slub.c
    index 54ac6e9..aff0637 100644
    --- a/mm/slub.c
    +++ b/mm/slub.c
    @@ -1882,18 +1882,24 @@ redo:
    /* Unfreeze all the cpu partial slabs */
    static void unfreeze_partials(struct kmem_cache *s)
    {
    - struct kmem_cache_node *n = NULL;
    + struct kmem_cache_node *n = NULL, *n2 = NULL;
    struct kmem_cache_cpu *c = this_cpu_ptr(s->cpu_slab);
    struct page *page, *discard_page = NULL;

    while ((page = c->partial)) {
    - enum slab_modes { M_PARTIAL, M_FREE };
    - enum slab_modes l, m;
    struct page new;
    struct page old;

    c->partial = page->next;
    - l = M_FREE;
    +
    + n2 = get_node(s, page_to_nid(page));
    + if (n != n2) {
    + if (n)
    + spin_unlock(&n->list_lock);
    +
    + n = n2;
    + spin_lock(&n->list_lock);
    + }

    do {

    @@ -1906,43 +1912,17 @@ static void unfreeze_partials(struct kmem_cache *s)

    new.frozen = 0;

    - if (!new.inuse && (!n || n->nr_partial > s->min_partial))
    - m = M_FREE;
    - else {
    - struct kmem_cache_node *n2 = get_node(s,
    - page_to_nid(page));
    -
    - m = M_PARTIAL;
    - if (n != n2) {
    - if (n)
    - spin_unlock(&n->list_lock);
    -
    - n = n2;
    - spin_lock(&n->list_lock);
    - }
    - }
    -
    - if (l != m) {
    - if (l == M_PARTIAL) {
    - remove_partial(n, page);
    - stat(s, FREE_REMOVE_PARTIAL);
    - } else {
    - add_partial(n, page,
    - DEACTIVATE_TO_TAIL);
    - stat(s, FREE_ADD_PARTIAL);
    - }
    -
    - l = m;
    - }
    -
    } while (!cmpxchg_double_slab(s, page,
    old.freelist, old.counters,
    new.freelist, new.counters,
    "unfreezing slab"));

    - if (m == M_FREE) {
    + if (unlikely(!new.inuse && n->nr_partial > s->min_partial)) {
    page->next = discard_page;
    discard_page = page;
    + } else {
    + add_partial(n, page, DEACTIVATE_TO_TAIL);
    + stat(s, FREE_ADD_PARTIAL);
    }
    }

    diff --git a/net/can/af_can.c b/net/can/af_can.c
    index 0ce2ad0..7d9dff222 100644
    --- a/net/can/af_can.c
    +++ b/net/can/af_can.c
    @@ -244,6 +244,9 @@ int can_send(struct sk_buff *skb, int loop)
    }

    skb->protocol = htons(ETH_P_CAN);
    + skb->ip_summed = CHECKSUM_UNNECESSARY;
    +
    + skb_reset_mac_header(skb);
    skb_reset_network_header(skb);
    skb_reset_transport_header(skb);

    diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
    index 3cd37e9..43c6dd8 100644
    --- a/net/core/rtnetlink.c
    +++ b/net/core/rtnetlink.c
    @@ -1144,14 +1144,10 @@ static const struct nla_policy ifla_vfinfo_policy[IFLA_VF_INFO_MAX+1] = {
    };

    static const struct nla_policy ifla_vf_policy[IFLA_VF_MAX+1] = {
    - [IFLA_VF_MAC] = { .type = NLA_BINARY,
    - .len = sizeof(struct ifla_vf_mac) },
    - [IFLA_VF_VLAN] = { .type = NLA_BINARY,
    - .len = sizeof(struct ifla_vf_vlan) },
    - [IFLA_VF_TX_RATE] = { .type = NLA_BINARY,
    - .len = sizeof(struct ifla_vf_tx_rate) },
    - [IFLA_VF_SPOOFCHK] = { .type = NLA_BINARY,
    - .len = sizeof(struct ifla_vf_spoofchk) },
    + [IFLA_VF_MAC] = { .len = sizeof(struct ifla_vf_mac) },
    + [IFLA_VF_VLAN] = { .len = sizeof(struct ifla_vf_vlan) },
    + [IFLA_VF_TX_RATE] = { .len = sizeof(struct ifla_vf_tx_rate) },
    + [IFLA_VF_SPOOFCHK] = { .len = sizeof(struct ifla_vf_spoofchk) },
    };

    static const struct nla_policy ifla_port_policy[IFLA_PORT_MAX+1] = {
    @@ -1698,10 +1694,10 @@ static int rtnl_group_changelink(struct net *net, int group,
    struct ifinfomsg *ifm,
    struct nlattr **tb)
    {
    - struct net_device *dev;
    + struct net_device *dev, *aux;
    int err;

    - for_each_netdev(net, dev) {
    + for_each_netdev_safe(net, dev, aux) {
    if (dev->group == group) {
    err = do_setlink(dev, ifm, tb, NULL, 0);
    if (err < 0)
    diff --git a/net/ipv6/route.c b/net/ipv6/route.c
    index c8643a3..4cfba3d 100644
    --- a/net/ipv6/route.c
    +++ b/net/ipv6/route.c
    @@ -95,7 +95,7 @@ static u32 *ipv6_cow_metrics(struct dst_entry *dst, unsigned long old)
    u32 *p = NULL;

    if (!(rt->dst.flags & DST_HOST))
    - return NULL;
    + return dst_cow_metrics_generic(dst, old);

    if (!rt->rt6i_peer)
    rt6_bind_peer(rt, 1);
    diff --git a/net/irda/ircomm/ircomm_tty.c b/net/irda/ircomm/ircomm_tty.c
    index 6b9d5a0..20fec0d 100644
    --- a/net/irda/ircomm/ircomm_tty.c
    +++ b/net/irda/ircomm/ircomm_tty.c
    @@ -843,7 +843,9 @@ static void ircomm_tty_wait_until_sent(struct tty_struct *tty, int timeout)
    orig_jiffies = jiffies;

    /* Set poll time to 200 ms */
    - poll_time = IRDA_MIN(timeout, msecs_to_jiffies(200));
    + poll_time = msecs_to_jiffies(200);
    + if (timeout)
    + poll_time = min_t(unsigned long, timeout, poll_time);

    spin_lock_irqsave(&self->spinlock, flags);
    while (self->tx_skb && self->tx_skb->len) {
    diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
    index 64d3ce5..df2b6ac 100644
    --- a/net/mac80211/agg-rx.c
    +++ b/net/mac80211/agg-rx.c
    @@ -49,8 +49,6 @@ static void ieee80211_free_tid_rx(struct rcu_head *h)
    container_of(h, struct tid_ampdu_rx, rcu_head);
    int i;

    - del_timer_sync(&tid_rx->reorder_timer);
    -
    for (i = 0; i < tid_rx->buf_size; i++)
    dev_kfree_skb(tid_rx->reorder_buf[i]);
    kfree(tid_rx->reorder_buf);
    @@ -94,6 +92,12 @@ void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,

    del_timer_sync(&tid_rx->session_timer);

    + /* make sure ieee80211_sta_reorder_release() doesn't re-arm the timer */
    + spin_lock_bh(&tid_rx->reorder_lock);
    + tid_rx->removed = true;
    + spin_unlock_bh(&tid_rx->reorder_lock);
    + del_timer_sync(&tid_rx->reorder_timer);
    +
    call_rcu(&tid_rx->rcu_head, ieee80211_free_tid_rx);
    }

    diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
    index 226be13..ca07c5e 100644
    --- a/net/mac80211/ieee80211_i.h
    +++ b/net/mac80211/ieee80211_i.h
    @@ -54,11 +54,25 @@ struct ieee80211_local;

    #define TU_TO_EXP_TIME(x) (jiffies + usecs_to_jiffies((x) * 1024))

    -#define IEEE80211_DEFAULT_UAPSD_QUEUES \
    - (IEEE80211_WMM_IE_STA_QOSINFO_AC_BK | \
    - IEEE80211_WMM_IE_STA_QOSINFO_AC_BE | \
    - IEEE80211_WMM_IE_STA_QOSINFO_AC_VI | \
    - IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
    +/*
    + * Some APs experience problems when working with U-APSD. Decreasing the
    + * probability of that happening by using legacy mode for all ACs but VO isn't
    + * enough.
    + *
    + * Cisco 4410N originally forced us to enable VO by default only because it
    + * treated non-VO ACs as legacy.
    + *
    + * However some APs (notably Netgear R7000) silently reclassify packets to
    + * different ACs. Since u-APSD ACs require trigger frames for frame retrieval
    + * clients would never see some frames (e.g. ARP responses) or would fetch them
    + * accidentally after a long time.
    + *
    + * It makes little sense to enable u-APSD queues by default because it needs
    + * userspace applications to be aware of it to actually take advantage of the
    + * possible additional powersavings. Implicitly depending on driver autotrigger
    + * frame support doesn't make much sense.
    + */
    +#define IEEE80211_DEFAULT_UAPSD_QUEUES 0

    #define IEEE80211_DEFAULT_MAX_SP_LEN \
    IEEE80211_WMM_IE_STA_QOSINFO_SP_ALL
    diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
    index 24f2a41..6202d05 100644
    --- a/net/mac80211/rx.c
    +++ b/net/mac80211/rx.c
    @@ -668,9 +668,10 @@ static void ieee80211_sta_reorder_release(struct ieee80211_hw *hw,

    set_release_timer:

    - mod_timer(&tid_agg_rx->reorder_timer,
    - tid_agg_rx->reorder_time[j] + 1 +
    - HT_RX_REORDER_BUF_TIMEOUT);
    + if (!tid_agg_rx->removed)
    + mod_timer(&tid_agg_rx->reorder_timer,
    + tid_agg_rx->reorder_time[j] + 1 +
    + HT_RX_REORDER_BUF_TIMEOUT);
    } else {
    del_timer(&tid_agg_rx->reorder_timer);
    }
    @@ -1926,6 +1927,9 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
    hdr = (struct ieee80211_hdr *) skb->data;
    mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);

    + if (ieee80211_drop_unencrypted(rx, hdr->frame_control))
    + return RX_DROP_MONITOR;
    +
    /* frame is in RMC, don't forward */
    if (ieee80211_is_data(hdr->frame_control) &&
    is_multicast_ether_addr(hdr->addr1) &&
    diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
    index 249f4d0..4e6ece8 100644
    --- a/net/mac80211/sta_info.h
    +++ b/net/mac80211/sta_info.h
    @@ -106,6 +106,7 @@ enum ieee80211_sta_info_flags {
    * @buf_size: reorder buffer size at receiver
    * @failed_bar_ssn: ssn of the last failed BAR tx attempt
    * @bar_pending: BAR needs to be re-sent
    + * @removed: this session is removed (but might have been found due to RCU)
    *
    * This structure's lifetime is managed by RCU, assignments to
    * the array holding it must hold the aggregation mutex.
    @@ -169,6 +170,7 @@ struct tid_ampdu_rx {
    u16 buf_size;
    u16 timeout;
    u8 dialog_token;
    + bool removed;
    };

    /**
    diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
    index b7fc3dd..f4f24be 100644
    --- a/net/mac80211/tx.c
    +++ b/net/mac80211/tx.c
    @@ -544,9 +544,11 @@ ieee80211_tx_h_check_control_port_protocol(struct ieee80211_tx_data *tx)
    {
    struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);

    - if (unlikely(tx->sdata->control_port_protocol == tx->skb->protocol &&
    - tx->sdata->control_port_no_encrypt))
    - info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
    + if (unlikely(tx->sdata->control_port_protocol == tx->skb->protocol)) {
    + if (tx->sdata->control_port_no_encrypt)
    + info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
    + info->flags |= IEEE80211_TX_CTL_USE_MINRATE;
    + }

    return TX_CONTINUE;
    }
    diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c
    index e39f693..fe3c8d7 100644
    --- a/net/netfilter/ipvs/ip_vs_ftp.c
    +++ b/net/netfilter/ipvs/ip_vs_ftp.c
    @@ -183,6 +183,8 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp,
    struct nf_conn *ct;
    struct net *net;

    + *diff = 0;
    +
    #ifdef CONFIG_IP_VS_IPV6
    /* This application helper doesn't work with IPv6 yet,
    * so turn this into a no-op for IPv6 packets
    @@ -191,8 +193,6 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp,
    return 1;
    #endif

    - *diff = 0;
    -
    /* Only useful for established sessions */
    if (cp->state != IP_VS_TCP_S_ESTABLISHED)
    return 1;
    @@ -318,6 +318,9 @@ static int ip_vs_ftp_in(struct ip_vs_app *app, struct ip_vs_conn *cp,
    struct ip_vs_conn *n_cp;
    struct net *net;

    + /* no diff required for incoming packets */
    + *diff = 0;
    +
    #ifdef CONFIG_IP_VS_IPV6
    /* This application helper doesn't work with IPv6 yet,
    * so turn this into a no-op for IPv6 packets
    @@ -326,9 +329,6 @@ static int ip_vs_ftp_in(struct ip_vs_app *app, struct ip_vs_conn *cp,
    return 1;
    #endif

    - /* no diff required for incoming packets */
    - *diff = 0;
    -
    /* Only useful for established sessions */
    if (cp->state != IP_VS_TCP_S_ESTABLISHED)
    return 1;
    diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
    index 8a0d6d6..6a5555c 100644
    --- a/net/netfilter/ipvs/ip_vs_sync.c
    +++ b/net/netfilter/ipvs/ip_vs_sync.c
    @@ -763,6 +763,8 @@ static void ip_vs_proc_conn(struct net *net, struct ip_vs_conn_param *param,
    IP_VS_DBG(2, "BACKUP, add new conn. failed\n");
    return;
    }
    + if (!(flags & IP_VS_CONN_F_TEMPLATE))
    + kfree(param->pe_data);
    } else if (!cp->dest) {
    dest = ip_vs_try_bind_dest(cp);
    if (dest)
    @@ -1064,6 +1066,7 @@ static inline int ip_vs_proc_sync_conn(struct net *net, __u8 *p, __u8 *msg_end)
    (opt_flags & IPVS_OPT_F_SEQ_DATA ? &opt : NULL)
    );
    #endif
    + ip_vs_pe_put(param.pe);
    return 0;
    /* Error exit */
    out:
    diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
    index ce60cf0..9139a26 100644
    --- a/net/netfilter/nf_queue.c
    +++ b/net/netfilter/nf_queue.c
    @@ -255,7 +255,7 @@ int nf_queue(struct sk_buff *skb,
    * returned by nf_queue. For instance, callers rely on -ECANCELED to mean
    * 'ignore this hook'.
    */
    - if (IS_ERR(segs))
    + if (IS_ERR_OR_NULL(segs))
    goto out_err;
    queued = 0;
    err = 0;
    diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
    index 72bb07f..eb5086c 100644
    --- a/net/netfilter/xt_socket.c
    +++ b/net/netfilter/xt_socket.c
    @@ -205,12 +205,13 @@ static int
    extract_icmp6_fields(const struct sk_buff *skb,
    unsigned int outside_hdrlen,
    int *protocol,
    - struct in6_addr **raddr,
    - struct in6_addr **laddr,
    + const struct in6_addr **raddr,
    + const struct in6_addr **laddr,
    __be16 *rport,
    - __be16 *lport)
    + __be16 *lport,
    + struct ipv6hdr *ipv6_var)
    {
    - struct ipv6hdr *inside_iph, _inside_iph;
    + const struct ipv6hdr *inside_iph;
    struct icmp6hdr *icmph, _icmph;
    __be16 *ports, _ports[2];
    u8 inside_nexthdr;
    @@ -225,12 +226,14 @@ extract_icmp6_fields(const struct sk_buff *skb,
    if (icmph->icmp6_type & ICMPV6_INFOMSG_MASK)
    return 1;

    - inside_iph = skb_header_pointer(skb, outside_hdrlen + sizeof(_icmph), sizeof(_inside_iph), &_inside_iph);
    + inside_iph = skb_header_pointer(skb, outside_hdrlen + sizeof(_icmph),
    + sizeof(*ipv6_var), ipv6_var);
    if (inside_iph == NULL)
    return 1;
    inside_nexthdr = inside_iph->nexthdr;

    - inside_hdrlen = ipv6_skip_exthdr(skb, outside_hdrlen + sizeof(_icmph) + sizeof(_inside_iph),
    + inside_hdrlen = ipv6_skip_exthdr(skb, outside_hdrlen + sizeof(_icmph) +
    + sizeof(*ipv6_var),
    &inside_nexthdr, &inside_fragoff);
    if (inside_hdrlen < 0)
    return 1; /* hjm: Packet has no/incomplete transport layer headers. */
    @@ -258,10 +261,10 @@ extract_icmp6_fields(const struct sk_buff *skb,
    static bool
    socket_mt6_v1(const struct sk_buff *skb, struct xt_action_param *par)
    {
    - struct ipv6hdr *iph = ipv6_hdr(skb);
    + struct ipv6hdr ipv6_var, *iph = ipv6_hdr(skb);
    struct udphdr _hdr, *hp = NULL;
    struct sock *sk;
    - struct in6_addr *daddr, *saddr;
    + const struct in6_addr *daddr, *saddr;
    __be16 dport, sport;
    int thoff, tproto;
    const struct xt_socket_mtinfo1 *info = (struct xt_socket_mtinfo1 *) par->matchinfo;
    @@ -285,7 +288,7 @@ socket_mt6_v1(const struct sk_buff *skb, struct xt_action_param *par)

    } else if (tproto == IPPROTO_ICMPV6) {
    if (extract_icmp6_fields(skb, thoff, &tproto, &saddr, &daddr,
    - &sport, &dport))
    + &sport, &dport, &ipv6_var))
    return false;
    } else {
    return false;
    diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
    index e66341e..a92d635 100644
    --- a/net/openvswitch/datapath.c
    +++ b/net/openvswitch/datapath.c
    @@ -269,8 +269,10 @@ static int queue_gso_packets(int dp_ifindex, struct sk_buff *skb,
    int err;

    segs = skb_gso_segment(skb, NETIF_F_SG | NETIF_F_HW_CSUM);
    - if (IS_ERR(skb))
    - return PTR_ERR(skb);
    + if (IS_ERR(segs))
    + return PTR_ERR(segs);
    + if (segs == NULL)
    + return -EINVAL;

    /* Queue all of the segments. */
    skb = segs;
    diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
    index 76cb304..af4dd9e 100644
    --- a/net/sunrpc/cache.c
    +++ b/net/sunrpc/cache.c
    @@ -911,7 +911,7 @@ static unsigned int cache_poll(struct file *filp, poll_table *wait,
    poll_wait(filp, &queue_wait, wait);

    /* alway allow write */
    - mask = POLL_OUT | POLLWRNORM;
    + mask = POLLOUT | POLLWRNORM;

    if (!rp)
    return mask;
    diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
    index 745973b..5547bd8 100644
    --- a/net/sunrpc/xprtrdma/verbs.c
    +++ b/net/sunrpc/xprtrdma/verbs.c
    @@ -485,7 +485,7 @@ rpcrdma_ia_open(struct rpcrdma_xprt *xprt, struct sockaddr *addr, int memreg)
    if (rc) {
    dprintk("RPC: %s: ib_query_device failed %d\n",
    __func__, rc);
    - goto out2;
    + goto out3;
    }

    if (devattr.device_cap_flags & IB_DEVICE_LOCAL_DMA_LKEY) {
    @@ -587,7 +587,7 @@ rpcrdma_ia_open(struct rpcrdma_xprt *xprt, struct sockaddr *addr, int memreg)
    printk(KERN_ERR "%s: invalid memory registration mode %d\n",
    __func__, memreg);
    rc = -EINVAL;
    - goto out2;
    + goto out3;
    }
    dprintk("RPC: %s: memory registration strategy is %d\n",
    __func__, memreg);
    @@ -596,6 +596,10 @@ rpcrdma_ia_open(struct rpcrdma_xprt *xprt, struct sockaddr *addr, int memreg)
    ia->ri_memreg_strategy = memreg;

    return 0;
    +
    +out3:
    + ib_dealloc_pd(ia->ri_pd);
    + ia->ri_pd = NULL;
    out2:
    rdma_destroy_id(ia->ri_id);
    ia->ri_id = NULL;
    diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
    index 63c1807..263cbd8 100644
    --- a/net/wireless/nl80211.c
    +++ b/net/wireless/nl80211.c
    @@ -2810,6 +2810,14 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
    if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
    return -EINVAL;

    + /* HT requires QoS, but if we don't have that just ignore HT/VHT
    + * as userspace might just pass through the capabilities from the IEs
    + * directly, rather than enforcing this restriction and returning an
    + * error in this case.
    + */
    + if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
    + params.ht_capa = NULL;
    +
    switch (dev->ieee80211_ptr->iftype) {
    case NL80211_IFTYPE_AP:
    case NL80211_IFTYPE_AP_VLAN:
    diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
    index 95a338c..11dd2fb 100644
    --- a/net/xfrm/xfrm_output.c
    +++ b/net/xfrm/xfrm_output.c
    @@ -151,6 +151,8 @@ static int xfrm_output_gso(struct sk_buff *skb)
    kfree_skb(skb);
    if (IS_ERR(segs))
    return PTR_ERR(segs);
    + if (segs == NULL)
    + return -EINVAL;

    do {
    struct sk_buff *nskb = segs->next;
    diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
    index 0a9891e..3bf9045 100644
    --- a/security/selinux/selinuxfs.c
    +++ b/security/selinux/selinuxfs.c
    @@ -150,7 +150,7 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf,
    goto out;

    /* No partial writes. */
    - length = EINVAL;
    + length = -EINVAL;
    if (*ppos != 0)
    goto out;

    diff --git a/security/smack/smack.h b/security/smack/smack.h
    index 4ede719..cde4cc1 100644
    --- a/security/smack/smack.h
    +++ b/security/smack/smack.h
    @@ -298,6 +298,16 @@ static inline char *smk_of_current(void)
    return smk_of_task(current_security());
    }

    +static inline char *smk_of_task_struct(const struct task_struct *t)
    +{
    + char *skp;
    +
    + rcu_read_lock();
    + skp = smk_of_task(__task_cred(t)->security);
    + rcu_read_unlock();
    + return skp;
    +}
    +
    /*
    * logging functions
    */
    diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
    index 45c32f0..82df24d 100644
    --- a/security/smack/smack_lsm.c
    +++ b/security/smack/smack_lsm.c
    @@ -41,8 +41,6 @@
    #include <linux/binfmts.h>
    #include "smack.h"

    -#define task_security(task) (task_cred_xxx((task), security))
    -
    #define TRANS_TRUE "TRUE"
    #define TRANS_TRUE_SIZE 4

    @@ -164,7 +162,7 @@ static int smack_ptrace_access_check(struct task_struct *ctp, unsigned int mode)
    if (rc != 0)
    return rc;

    - tsp = smk_of_task(task_security(ctp));
    + tsp = smk_of_task_struct(ctp);
    smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
    smk_ad_setfield_u_tsk(&ad, ctp);

    @@ -190,7 +188,7 @@ static int smack_ptrace_traceme(struct task_struct *ptp)
    if (rc != 0)
    return rc;

    - tsp = smk_of_task(task_security(ptp));
    + tsp = smk_of_task_struct(ptp);
    smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
    smk_ad_setfield_u_tsk(&ad, ptp);

    @@ -1518,7 +1516,7 @@ static int smk_curacc_on_task(struct task_struct *p, int access,

    smk_ad_init(&ad, caller, LSM_AUDIT_DATA_TASK);
    smk_ad_setfield_u_tsk(&ad, p);
    - return smk_curacc(smk_of_task(task_security(p)), access, &ad);
    + return smk_curacc(smk_of_task_struct(p), access, &ad);
    }

    /**
    @@ -1564,7 +1562,7 @@ static int smack_task_getsid(struct task_struct *p)
    */
    static void smack_task_getsecid(struct task_struct *p, u32 *secid)
    {
    - *secid = smack_to_secid(smk_of_task(task_security(p)));
    + *secid = smack_to_secid(smk_of_task_struct(p));
    }

    /**
    @@ -1676,7 +1674,7 @@ static int smack_task_kill(struct task_struct *p, struct siginfo *info,
    * can write the receiver.
    */
    if (secid == 0)
    - return smk_curacc(smk_of_task(task_security(p)), MAY_WRITE,
    + return smk_curacc(smk_of_task_struct(p), MAY_WRITE,
    &ad);
    /*
    * If the secid isn't 0 we're dealing with some USB IO
    @@ -1684,7 +1682,7 @@ static int smack_task_kill(struct task_struct *p, struct siginfo *info,
    * we can't take privilege into account.
    */
    return smk_access(smack_from_secid(secid),
    - smk_of_task(task_security(p)), MAY_WRITE, &ad);
    + smk_of_task_struct(p), MAY_WRITE, &ad);
    }

    /**
    @@ -1697,9 +1695,13 @@ static int smack_task_wait(struct task_struct *p)
    {
    struct smk_audit_info ad;
    char *sp = smk_of_current();
    - char *tsp = smk_of_forked(task_security(p));
    + char *tsp;
    int rc;

    + rcu_read_lock();
    + tsp = smk_of_forked(__task_cred(p)->security);
    + rcu_read_unlock();
    +
    /* we don't log here, we can be overriden */
    rc = smk_access(tsp, sp, MAY_WRITE, NULL);
    if (rc == 0)
    @@ -1736,7 +1738,7 @@ static int smack_task_wait(struct task_struct *p)
    static void smack_task_to_inode(struct task_struct *p, struct inode *inode)
    {
    struct inode_smack *isp = inode->i_security;
    - isp->smk_inode = smk_of_task(task_security(p));
    + isp->smk_inode = smk_of_task_struct(p);
    }

    /*
    @@ -2719,7 +2721,7 @@ static int smack_getprocattr(struct task_struct *p, char *name, char **value)
    if (strcmp(name, "current") != 0)
    return -EINVAL;

    - cp = kstrdup(smk_of_task(task_security(p)), GFP_KERNEL);
    + cp = kstrdup(smk_of_task_struct(p), GFP_KERNEL);
    if (cp == NULL)
    return -ENOMEM;

    diff --git a/sound/core/control.c b/sound/core/control.c
    index e773d5e..8fb4d24 100644
    --- a/sound/core/control.c
    +++ b/sound/core/control.c
    @@ -1164,6 +1164,10 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file,

    if (info->count < 1)
    return -EINVAL;
    + if (!*info->id.name)
    + return -EINVAL;
    + if (strnlen(info->id.name, sizeof(info->id.name)) >= sizeof(info->id.name))
    + return -EINVAL;
    access = info->access == 0 ? SNDRV_CTL_ELEM_ACCESS_READWRITE :
    (info->access & (SNDRV_CTL_ELEM_ACCESS_READWRITE|
    SNDRV_CTL_ELEM_ACCESS_INACTIVE|
    diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
    index 3a90793..65195a1 100644
    --- a/sound/core/pcm_native.c
    +++ b/sound/core/pcm_native.c
    @@ -1382,6 +1382,8 @@ static int snd_pcm_do_drain_init(struct snd_pcm_substream *substream, int state)
    if (! snd_pcm_playback_empty(substream)) {
    snd_pcm_do_start(substream, SNDRV_PCM_STATE_DRAINING);
    snd_pcm_post_start(substream, SNDRV_PCM_STATE_DRAINING);
    + } else {
    + runtime->status->state = SNDRV_PCM_STATE_SETUP;
    }
    break;
    case SNDRV_PCM_STATE_RUNNING:
    diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
    index 9461a00..b16a37f 100644
    --- a/sound/pci/hda/patch_realtek.c
    +++ b/sound/pci/hda/patch_realtek.c
    @@ -759,7 +759,7 @@ static void alc_auto_setup_eapd(struct hda_codec *codec, bool on)
    {
    /* We currently only handle front, HP */
    static hda_nid_t pins[] = {
    - 0x0f, 0x10, 0x14, 0x15, 0
    + 0x0f, 0x10, 0x14, 0x15, 0x17, 0
    };
    hda_nid_t *p;
    for (p = pins; *p; p++)
    diff --git a/sound/pci/riptide/riptide.c b/sound/pci/riptide/riptide.c
    index 0481d94..c1cdd02 100644
    --- a/sound/pci/riptide/riptide.c
    +++ b/sound/pci/riptide/riptide.c
    @@ -2026,32 +2026,43 @@ snd_riptide_joystick_probe(struct pci_dev *pci, const struct pci_device_id *id)
    {
    static int dev;
    struct gameport *gameport;
    + int ret;

    if (dev >= SNDRV_CARDS)
    return -ENODEV;
    +
    if (!enable[dev]) {
    - dev++;
    - return -ENOENT;
    + ret = -ENOENT;
    + goto inc_dev;
    }

    - if (!joystick_port[dev++])
    - return 0;
    + if (!joystick_port[dev]) {
    + ret = 0;
    + goto inc_dev;
    + }

    gameport = gameport_allocate_port();
    - if (!gameport)
    - return -ENOMEM;
    + if (!gameport) {
    + ret = -ENOMEM;
    + goto inc_dev;
    + }
    if (!request_region(joystick_port[dev], 8, "Riptide gameport")) {
    snd_printk(KERN_WARNING
    "Riptide: cannot grab gameport 0x%x\n",
    joystick_port[dev]);
    gameport_free_port(gameport);
    - return -EBUSY;
    + ret = -EBUSY;
    + goto inc_dev;
    }

    gameport->io = joystick_port[dev];
    gameport_register_port(gameport);
    pci_set_drvdata(pci, gameport);
    - return 0;
    +
    + ret = 0;
    +inc_dev:
    + dev++;
    + return ret;
    }

    static void __devexit snd_riptide_joystick_remove(struct pci_dev *pci)
    diff --git a/sound/pci/rme9652/hdspm.c b/sound/pci/rme9652/hdspm.c
    index bc030a2..0627ffe 100644
    --- a/sound/pci/rme9652/hdspm.c
    +++ b/sound/pci/rme9652/hdspm.c
    @@ -6042,6 +6042,12 @@ static int snd_hdspm_capture_open(struct snd_pcm_substream *substream)
    snd_pcm_hw_constraint_minmax(runtime,
    SNDRV_PCM_HW_PARAM_PERIOD_SIZE,
    64, 8192);
    + snd_pcm_hw_constraint_minmax(runtime,
    + SNDRV_PCM_HW_PARAM_PERIODS,
    + 2, 2);
    + snd_pcm_hw_constraint_minmax(runtime,
    + SNDRV_PCM_HW_PARAM_PERIODS,
    + 2, 2);
    break;
    }

    diff --git a/sound/soc/codecs/adav80x.c b/sound/soc/codecs/adav80x.c
    index ebd7b37..81e0e27 100644
    --- a/sound/soc/codecs/adav80x.c
    +++ b/sound/soc/codecs/adav80x.c
    @@ -307,7 +307,7 @@ static int adav80x_put_deemph(struct snd_kcontrol *kcontrol,
    {
    struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
    struct adav80x *adav80x = snd_soc_codec_get_drvdata(codec);
    - unsigned int deemph = ucontrol->value.enumerated.item[0];
    + unsigned int deemph = ucontrol->value.integer.value[0];

    if (deemph > 1)
    return -EINVAL;
    @@ -323,7 +323,7 @@ static int adav80x_get_deemph(struct snd_kcontrol *kcontrol,
    struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
    struct adav80x *adav80x = snd_soc_codec_get_drvdata(codec);

    - ucontrol->value.enumerated.item[0] = adav80x->deemph;
    + ucontrol->value.integer.value[0] = adav80x->deemph;
    return 0;
    };

    diff --git a/sound/soc/codecs/ak4641.c b/sound/soc/codecs/ak4641.c
    index c4d165a..e1773e0 100644
    --- a/sound/soc/codecs/ak4641.c
    +++ b/sound/soc/codecs/ak4641.c
    @@ -74,7 +74,7 @@ static int ak4641_put_deemph(struct snd_kcontrol *kcontrol,
    {
    struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
    struct ak4641_priv *ak4641 = snd_soc_codec_get_drvdata(codec);
    - int deemph = ucontrol->value.enumerated.item[0];
    + int deemph = ucontrol->value.integer.value[0];

    if (deemph > 1)
    return -EINVAL;
    @@ -90,7 +90,7 @@ static int ak4641_get_deemph(struct snd_kcontrol *kcontrol,
    struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
    struct ak4641_priv *ak4641 = snd_soc_codec_get_drvdata(codec);

    - ucontrol->value.enumerated.item[0] = ak4641->deemph;
    + ucontrol->value.integer.value[0] = ak4641->deemph;
    return 0;
    };

    diff --git a/sound/soc/codecs/cs4271.c b/sound/soc/codecs/cs4271.c
    index bf71412..f9e2bda 100644
    --- a/sound/soc/codecs/cs4271.c
    +++ b/sound/soc/codecs/cs4271.c
    @@ -261,7 +261,7 @@ static int cs4271_get_deemph(struct snd_kcontrol *kcontrol,
    struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
    struct cs4271_private *cs4271 = snd_soc_codec_get_drvdata(codec);

    - ucontrol->value.enumerated.item[0] = cs4271->deemph;
    + ucontrol->value.integer.value[0] = cs4271->deemph;
    return 0;
    }

    @@ -271,7 +271,7 @@ static int cs4271_put_deemph(struct snd_kcontrol *kcontrol,
    struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
    struct cs4271_private *cs4271 = snd_soc_codec_get_drvdata(codec);

    - cs4271->deemph = ucontrol->value.enumerated.item[0];
    + cs4271->deemph = ucontrol->value.integer.value[0];
    return cs4271_set_deemph(codec);
    }

    diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
    index 87cbf14..e8a7608f 100644
    --- a/sound/soc/codecs/sgtl5000.c
    +++ b/sound/soc/codecs/sgtl5000.c
    @@ -1107,13 +1107,7 @@ static int sgtl5000_set_power_regs(struct snd_soc_codec *codec)
    /* Enable VDDC charge pump */
    ana_pwr |= SGTL5000_VDDC_CHRGPMP_POWERUP;
    } else if (vddio >= 3100 && vdda >= 3100) {
    - /*
    - * if vddio and vddd > 3.1v,
    - * charge pump should be clean before set ana_pwr
    - */
    - snd_soc_update_bits(codec, SGTL5000_CHIP_ANA_POWER,
    - SGTL5000_VDDC_CHRGPMP_POWERUP, 0);
    -
    + ana_pwr &= ~SGTL5000_VDDC_CHRGPMP_POWERUP;
    /* VDDC use VDDIO rail */
    lreg_ctrl |= SGTL5000_VDDC_ASSN_OVRD;
    lreg_ctrl |= SGTL5000_VDDC_MAN_ASSN_VDDIO <<
    diff --git a/sound/soc/codecs/wm2000.c b/sound/soc/codecs/wm2000.c
    index bb9f070..fb1f0a7 100644
    --- a/sound/soc/codecs/wm2000.c
    +++ b/sound/soc/codecs/wm2000.c
    @@ -581,7 +581,7 @@ static int wm2000_anc_mode_get(struct snd_kcontrol *kcontrol,
    struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
    struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);

    - ucontrol->value.enumerated.item[0] = wm2000->anc_active;
    + ucontrol->value.integer.value[0] = wm2000->anc_active;

    return 0;
    }
    @@ -591,7 +591,7 @@ static int wm2000_anc_mode_put(struct snd_kcontrol *kcontrol,
    {
    struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
    struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);
    - int anc_active = ucontrol->value.enumerated.item[0];
    + int anc_active = ucontrol->value.integer.value[0];

    if (anc_active > 1)
    return -EINVAL;
    @@ -607,7 +607,7 @@ static int wm2000_speaker_get(struct snd_kcontrol *kcontrol,
    struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
    struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);

    - ucontrol->value.enumerated.item[0] = wm2000->spk_ena;
    + ucontrol->value.integer.value[0] = wm2000->spk_ena;

    return 0;
    }
    @@ -617,7 +617,7 @@ static int wm2000_speaker_put(struct snd_kcontrol *kcontrol,
    {
    struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
    struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);
    - int val = ucontrol->value.enumerated.item[0];
    + int val = ucontrol->value.integer.value[0];

    if (val > 1)
    return -EINVAL;
    diff --git a/sound/soc/codecs/wm8731.c b/sound/soc/codecs/wm8731.c
    index 8b5afc1..3616b5b 100644
    --- a/sound/soc/codecs/wm8731.c
    +++ b/sound/soc/codecs/wm8731.c
    @@ -120,7 +120,7 @@ static int wm8731_get_deemph(struct snd_kcontrol *kcontrol,
    struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
    struct wm8731_priv *wm8731 = snd_soc_codec_get_drvdata(codec);

    - ucontrol->value.enumerated.item[0] = wm8731->deemph;
    + ucontrol->value.integer.value[0] = wm8731->deemph;

    return 0;
    }
    @@ -130,7 +130,7 @@ static int wm8731_put_deemph(struct snd_kcontrol *kcontrol,
    {
    struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
    struct wm8731_priv *wm8731 = snd_soc_codec_get_drvdata(codec);
    - int deemph = ucontrol->value.enumerated.item[0];
    + int deemph = ucontrol->value.integer.value[0];
    int ret = 0;

    if (deemph > 1)
    diff --git a/sound/soc/codecs/wm8903.c b/sound/soc/codecs/wm8903.c
    index 77758542..776653d 100644
    --- a/sound/soc/codecs/wm8903.c
    +++ b/sound/soc/codecs/wm8903.c
    @@ -445,7 +445,7 @@ static int wm8903_get_deemph(struct snd_kcontrol *kcontrol,
    struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
    struct wm8903_priv *wm8903 = snd_soc_codec_get_drvdata(codec);

    - ucontrol->value.enumerated.item[0] = wm8903->deemph;
    + ucontrol->value.integer.value[0] = wm8903->deemph;

    return 0;
    }
    @@ -455,7 +455,7 @@ static int wm8903_put_deemph(struct snd_kcontrol *kcontrol,
    {
    struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
    struct wm8903_priv *wm8903 = snd_soc_codec_get_drvdata(codec);
    - int deemph = ucontrol->value.enumerated.item[0];
    + int deemph = ucontrol->value.integer.value[0];
    int ret = 0;

    if (deemph > 1)
    diff --git a/sound/soc/codecs/wm8904.c b/sound/soc/codecs/wm8904.c
    index c93e360..19f3040 100644
    --- a/sound/soc/codecs/wm8904.c
    +++ b/sound/soc/codecs/wm8904.c
    @@ -528,7 +528,7 @@ static int wm8904_get_deemph(struct snd_kcontrol *kcontrol,
    struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
    struct wm8904_priv *wm8904 = snd_soc_codec_get_drvdata(codec);

    - ucontrol->value.enumerated.item[0] = wm8904->deemph;
    + ucontrol->value.integer.value[0] = wm8904->deemph;
    return 0;
    }

    @@ -537,7 +537,7 @@ static int wm8904_put_deemph(struct snd_kcontrol *kcontrol,
    {
    struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
    struct wm8904_priv *wm8904 = snd_soc_codec_get_drvdata(codec);
    - int deemph = ucontrol->value.enumerated.item[0];
    + int deemph = ucontrol->value.integer.value[0];

    if (deemph > 1)
    return -EINVAL;
    diff --git a/sound/soc/codecs/wm8955.c b/sound/soc/codecs/wm8955.c
    index 61fe974..4696f66 100644
    --- a/sound/soc/codecs/wm8955.c
    +++ b/sound/soc/codecs/wm8955.c
    @@ -393,7 +393,7 @@ static int wm8955_get_deemph(struct snd_kcontrol *kcontrol,
    struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
    struct wm8955_priv *wm8955 = snd_soc_codec_get_drvdata(codec);

    - ucontrol->value.enumerated.item[0] = wm8955->deemph;
    + ucontrol->value.integer.value[0] = wm8955->deemph;
    return 0;
    }

    @@ -402,7 +402,7 @@ static int wm8955_put_deemph(struct snd_kcontrol *kcontrol,
    {
    struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
    struct wm8955_priv *wm8955 = snd_soc_codec_get_drvdata(codec);
    - int deemph = ucontrol->value.enumerated.item[0];
    + int deemph = ucontrol->value.integer.value[0];

    if (deemph > 1)
    return -EINVAL;
    diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
    index a09d7eb..a3e4831 100644
    --- a/sound/soc/codecs/wm8960.c
    +++ b/sound/soc/codecs/wm8960.c
    @@ -132,7 +132,7 @@ static int wm8960_get_deemph(struct snd_kcontrol *kcontrol,
    struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
    struct wm8960_priv *wm8960 = snd_soc_codec_get_drvdata(codec);

    - ucontrol->value.enumerated.item[0] = wm8960->deemph;
    + ucontrol->value.integer.value[0] = wm8960->deemph;
    return 0;
    }

    @@ -141,7 +141,7 @@ static int wm8960_put_deemph(struct snd_kcontrol *kcontrol,
    {
    struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
    struct wm8960_priv *wm8960 = snd_soc_codec_get_drvdata(codec);
    - int deemph = ucontrol->value.enumerated.item[0];
    + int deemph = ucontrol->value.integer.value[0];

    if (deemph > 1)
    return -EINVAL;
    diff --git a/sound/soc/omap/omap-pcm.c b/sound/soc/omap/omap-pcm.c
    index 5a649da..96bce55a 100644
    --- a/sound/soc/omap/omap-pcm.c
    +++ b/sound/soc/omap/omap-pcm.c
    @@ -333,7 +333,7 @@ static struct snd_pcm_ops omap_pcm_ops = {
    .mmap = omap_pcm_mmap,
    };

    -static u64 omap_pcm_dmamask = DMA_BIT_MASK(64);
    +static u64 omap_pcm_dmamask = DMA_BIT_MASK(32);

    static int omap_pcm_preallocate_dma_buffer(struct snd_pcm *pcm,
    int stream)
    @@ -384,7 +384,7 @@ static int omap_pcm_new(struct snd_soc_pcm_runtime *rtd)
    if (!card->dev->dma_mask)
    card->dev->dma_mask = &omap_pcm_dmamask;
    if (!card->dev->coherent_dma_mask)
    - card->dev->coherent_dma_mask = DMA_BIT_MASK(64);
    + card->dev->coherent_dma_mask = DMA_BIT_MASK(32);

    if (pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream) {
    ret = omap_pcm_preallocate_dma_buffer(pcm,
    diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
    index fb95069..040d101 100644
    --- a/sound/usb/mixer_quirks.c
    +++ b/sound/usb/mixer_quirks.c
    @@ -64,6 +64,7 @@ static const struct rc_config {
    { USB_ID(0x041e, 0x3040), 2, 2, 6, 6, 2, 0x6e91 }, /* Live! 24-bit */
    { USB_ID(0x041e, 0x3042), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 */
    { USB_ID(0x041e, 0x30df), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 Pro */
    + { USB_ID(0x041e, 0x3237), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 Pro */
    { USB_ID(0x041e, 0x3048), 2, 2, 6, 6, 2, 0x6e91 }, /* Toshiba SB0500 */
    };

    diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
    index 5ef3579..2ad5d77 100644
    --- a/sound/usb/quirks-table.h
    +++ b/sound/usb/quirks-table.h
    @@ -1871,6 +1871,36 @@ YAMAHA_DEVICE(0x7010, "UB99"),
    }
    }
    },
    +{
    + USB_DEVICE(0x0582, 0x0159),
    + .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
    + /* .vendor_name = "Roland", */
    + /* .product_name = "UA-22", */
    + .ifnum = QUIRK_ANY_INTERFACE,
    + .type = QUIRK_COMPOSITE,
    + .data = (const struct snd_usb_audio_quirk[]) {
    + {
    + .ifnum = 0,
    + .type = QUIRK_AUDIO_STANDARD_INTERFACE
    + },
    + {
    + .ifnum = 1,
    + .type = QUIRK_AUDIO_STANDARD_INTERFACE
    + },
    + {
    + .ifnum = 2,
    + .type = QUIRK_MIDI_FIXED_ENDPOINT,
    + .data = & (const struct snd_usb_midi_endpoint_info) {
    + .out_cables = 0x0001,
    + .in_cables = 0x0001
    + }
    + },
    + {
    + .ifnum = -1
    + }
    + }
    + }
    +},

    /* Guillemot devices */
    {
    diff --git a/tools/perf/Makefile b/tools/perf/Makefile
    index 2db7ba0..331647c 100644
    --- a/tools/perf/Makefile
    +++ b/tools/perf/Makefile
    @@ -816,10 +816,10 @@ $(OUTPUT)util/rbtree.o: ../../lib/rbtree.c $(OUTPUT)PERF-CFLAGS
    $(QUIET_CC)$(CC) -o $@ -c $(ALL_CFLAGS) -DETC_PERFCONFIG='"$(ETC_PERFCONFIG_SQ)"' $<

    $(OUTPUT)util/scripting-engines/trace-event-perl.o: util/scripting-engines/trace-event-perl.c $(OUTPUT)PERF-CFLAGS
    - $(QUIET_CC)$(CC) -o $@ -c $(ALL_CFLAGS) $(PERL_EMBED_CCOPTS) -Wno-redundant-decls -Wno-strict-prototypes -Wno-unused-parameter -Wno-shadow $<
    + $(QUIET_CC)$(CC) -o $@ -c $(ALL_CFLAGS) $(PERL_EMBED_CCOPTS) -Wno-redundant-decls -Wno-strict-prototypes -Wno-unused-parameter -Wno-shadow -Wno-undef -Wno-switch-default $<

    $(OUTPUT)scripts/perl/Perf-Trace-Util/Context.o: scripts/perl/Perf-Trace-Util/Context.c $(OUTPUT)PERF-CFLAGS
    - $(QUIET_CC)$(CC) -o $@ -c $(ALL_CFLAGS) $(PERL_EMBED_CCOPTS) -Wno-redundant-decls -Wno-strict-prototypes -Wno-unused-parameter -Wno-nested-externs $<
    + $(QUIET_CC)$(CC) -o $@ -c $(ALL_CFLAGS) $(PERL_EMBED_CCOPTS) -Wno-redundant-decls -Wno-strict-prototypes -Wno-unused-parameter -Wno-nested-externs -Wno-undef -Wno-switch-default $<

    $(OUTPUT)util/scripting-engines/trace-event-python.o: util/scripting-engines/trace-event-python.c $(OUTPUT)PERF-CFLAGS
    $(QUIET_CC)$(CC) -o $@ -c $(ALL_CFLAGS) $(PYTHON_EMBED_CCOPTS) -Wno-redundant-decls -Wno-strict-prototypes -Wno-unused-parameter -Wno-shadow $<

    \
     
     \ /
      Last update: 2015-06-16 11:21    [W:4.522 / U:0.052 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site