diff options
author | Anthony G. Basile <blueness@gentoo.org> | 2011-06-09 14:02:57 -0400 |
---|---|---|
committer | Anthony G. Basile <blueness@gentoo.org> | 2011-06-09 14:02:57 -0400 |
commit | 1e4e7c2449c05587041f04d16a841cac2dc67d26 (patch) | |
tree | d93e9aec77ff58ae029682e374749ff5216f8edc | |
parent | Update Grsec/PaX (diff) | |
download | hardened-patchset-1e4e7c2449c05587041f04d16a841cac2dc67d26.tar.gz hardened-patchset-1e4e7c2449c05587041f04d16a841cac2dc67d26.tar.bz2 hardened-patchset-1e4e7c2449c05587041f04d16a841cac2dc67d26.zip |
Update Grsec/PaX20110607
2.2.2-2.6.32.41-201106071941
2.2.2-2.6.39.1-201106071941
-rw-r--r-- | 2.6.32/0000_README | 2 | ||||
-rw-r--r-- | 2.6.32/4420_grsecurity-2.2.2-2.6.32.41-201106071941.patch (renamed from 2.6.32/4420_grsecurity-2.2.2-2.6.32.41-201106061735.patch) | 106 | ||||
-rw-r--r-- | 2.6.39/0000_README | 6 | ||||
-rw-r--r-- | 2.6.39/1000_linux-2.6.39.1.patch | 6469 | ||||
-rw-r--r-- | 2.6.39/4420_grsecurity-2.2.2-2.6.39.1-201106071941.patch (renamed from 2.6.39/4420_grsecurity-2.2.2-2.6.39.1-201106061957.patch) | 135 |
5 files changed, 125 insertions, 6593 deletions
diff --git a/2.6.32/0000_README b/2.6.32/0000_README index f6eac50..3c6c9f7 100644 --- a/2.6.32/0000_README +++ b/2.6.32/0000_README @@ -3,7 +3,7 @@ README Individual Patch Descriptions: ----------------------------------------------------------------------------- -Patch: 4420_grsecurity-2.2.2-2.6.32.41-201106061735.patch +Patch: 4420_grsecurity-2.2.2-2.6.32.41-201106071941.patch From: http://www.grsecurity.net Desc: hardened-sources base patch from upstream grsecurity diff --git a/2.6.32/4420_grsecurity-2.2.2-2.6.32.41-201106061735.patch b/2.6.32/4420_grsecurity-2.2.2-2.6.32.41-201106071941.patch index fe17a6f..3d01c9c 100644 --- a/2.6.32/4420_grsecurity-2.2.2-2.6.32.41-201106061735.patch +++ b/2.6.32/4420_grsecurity-2.2.2-2.6.32.41-201106071941.patch @@ -21000,7 +21000,7 @@ diff -urNp linux-2.6.32.41/arch/x86/mm/init_64.c linux-2.6.32.41/arch/x86/mm/ini return "[vsyscall]"; diff -urNp linux-2.6.32.41/arch/x86/mm/init.c linux-2.6.32.41/arch/x86/mm/init.c --- linux-2.6.32.41/arch/x86/mm/init.c 2011-04-17 17:00:52.000000000 -0400 -+++ linux-2.6.32.41/arch/x86/mm/init.c 2011-05-23 19:02:20.000000000 -0400 ++++ linux-2.6.32.41/arch/x86/mm/init.c 2011-06-07 19:06:09.000000000 -0400 @@ -69,11 +69,7 @@ static void __init find_early_table_spac * cause a hotspot and fill up ZONE_DMA. The page tables * need roughly 0.5KB per GB. @@ -21023,28 +21023,35 @@ diff -urNp linux-2.6.32.41/arch/x86/mm/init.c linux-2.6.32.41/arch/x86/mm/init.c printk(KERN_INFO "NX (Execute Disable) protection: active\n"); /* Enable PSE if available */ -@@ -331,7 +327,19 @@ unsigned long __init_refok init_memory_m +@@ -329,10 +325,27 @@ unsigned long __init_refok init_memory_m + * Access has to be given to non-kernel-ram areas as well, these contain the PCI + * mmio resources as well as potential bios/acpi data regions. */ ++ int devmem_is_allowed(unsigned long pagenr) { -- if (pagenr <= 256) -+#ifndef CONFIG_GRKERNSEC_KMEM ++#ifdef CONFIG_GRKERNSEC_KMEM ++ /* allow BDA */ + if (!pagenr) + return 1; -+#ifdef CONFIG_VM86 -+ if (pagenr < (ISA_START_ADDRESS >> PAGE_SHIFT)) ++ /* allow EBDA */ ++ if ((0x9f000 >> PAGE_SHIFT) == pagenr) + return 1; -+#endif -+#else -+ if (pagenr < (ISA_START_ADDRESS >> PAGE_SHIFT)) ++ /* allow ISA/video mem */ ++ if ((ISA_START_ADDRESS >> PAGE_SHIFT) <= pagenr && pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT)) ++ return 1; ++ /* throw out everything else below 1MB */ ++ if (pagenr <= 256) + return 0; ++#else + if (pagenr <= 256) + return 1; +#endif + -+ if ((ISA_START_ADDRESS >> PAGE_SHIFT) <= pagenr && pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT)) - return 1; if (iomem_is_exclusive(pagenr << PAGE_SHIFT)) return 0; -@@ -379,6 +387,86 @@ void free_init_pages(char *what, unsigne + if (!page_is_ram(pagenr)) +@@ -379,6 +392,86 @@ void free_init_pages(char *what, unsigne void free_initmem(void) { @@ -40282,6 +40289,18 @@ diff -urNp linux-2.6.32.41/fs/jffs2/xattr.c linux-2.6.32.41/fs/jffs2/xattr.c /* Phase.1 : Merge same xref */ for (i=0; i < XREF_TMPHASH_SIZE; i++) xref_tmphash[i] = NULL; +diff -urNp linux-2.6.32.41/fs/jfs/super.c linux-2.6.32.41/fs/jfs/super.c +--- linux-2.6.32.41/fs/jfs/super.c 2011-03-27 14:31:47.000000000 -0400 ++++ linux-2.6.32.41/fs/jfs/super.c 2011-06-07 18:06:04.000000000 -0400 +@@ -793,7 +793,7 @@ static int __init init_jfs_fs(void) + + jfs_inode_cachep = + kmem_cache_create("jfs_ip", sizeof(struct jfs_inode_info), 0, +- SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD, ++ SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD|SLAB_USERCOPY, + init_once); + if (jfs_inode_cachep == NULL) + return -ENOMEM; diff -urNp linux-2.6.32.41/fs/Kconfig.binfmt linux-2.6.32.41/fs/Kconfig.binfmt --- linux-2.6.32.41/fs/Kconfig.binfmt 2011-03-27 14:31:47.000000000 -0400 +++ linux-2.6.32.41/fs/Kconfig.binfmt 2011-04-17 15:56:46.000000000 -0400 @@ -62865,7 +62884,7 @@ diff -urNp linux-2.6.32.41/localversion-grsec linux-2.6.32.41/localversion-grsec +-grsec diff -urNp linux-2.6.32.41/Makefile linux-2.6.32.41/Makefile --- linux-2.6.32.41/Makefile 2011-05-23 16:56:59.000000000 -0400 -+++ linux-2.6.32.41/Makefile 2011-06-04 20:35:20.000000000 -0400 ++++ linux-2.6.32.41/Makefile 2011-06-07 18:06:04.000000000 -0400 @@ -221,8 +221,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" HOSTCC = gcc @@ -62891,6 +62910,15 @@ diff -urNp linux-2.6.32.41/Makefile linux-2.6.32.41/Makefile KBUILD_AFLAGS := -D__ASSEMBLY__ # Read KERNELRELEASE from include/config/kernel.release (if it exists) +@@ -403,7 +406,7 @@ endif + # of make so .config is not included in this case either (for *config). + + no-dot-config-targets := clean mrproper distclean \ +- cscope TAGS tags help %docs check% \ ++ cscope gtags TAGS tags help %docs check% \ + include/linux/version.h headers_% \ + kernelrelease kernelversion + @@ -644,7 +647,7 @@ export mod_strip_cmd @@ -62930,6 +62958,32 @@ diff -urNp linux-2.6.32.41/Makefile linux-2.6.32.41/Makefile prepare1: prepare2 include/linux/version.h include/linux/utsrelease.h \ include/asm include/config/auto.conf +@@ -1198,7 +1213,7 @@ MRPROPER_FILES += .config .config.old in + include/linux/autoconf.h include/linux/version.h \ + include/linux/utsrelease.h \ + include/linux/bounds.h include/asm*/asm-offsets.h \ +- Module.symvers Module.markers tags TAGS cscope* ++ Module.symvers Module.markers tags TAGS cscope* GPATH GTAGS GRTAGS GSYMS + + # clean - Delete most, but leave enough to build external modules + # +@@ -1289,6 +1304,7 @@ help: + @echo ' modules_prepare - Set up for building external modules' + @echo ' tags/TAGS - Generate tags file for editors' + @echo ' cscope - Generate cscope index' ++ @echo ' gtags - Generate GNU GLOBAL index' + @echo ' kernelrelease - Output the release version string' + @echo ' kernelversion - Output the version stored in Makefile' + @echo ' headers_install - Install sanitised kernel headers to INSTALL_HDR_PATH'; \ +@@ -1445,7 +1461,7 @@ endif # KBUILD_EXTMOD + quiet_cmd_tags = GEN $@ + cmd_tags = $(CONFIG_SHELL) $(srctree)/scripts/tags.sh $@ + +-tags TAGS cscope: FORCE ++tags TAGS cscope gtags: FORCE + $(call cmd,tags) + + # Scripts to check various things for consistency diff -urNp linux-2.6.32.41/mm/backing-dev.c linux-2.6.32.41/mm/backing-dev.c --- linux-2.6.32.41/mm/backing-dev.c 2011-03-27 14:31:47.000000000 -0400 +++ linux-2.6.32.41/mm/backing-dev.c 2011-05-04 17:56:28.000000000 -0400 @@ -70151,6 +70205,32 @@ diff -urNp linux-2.6.32.41/scripts/pnmtologo.c linux-2.6.32.41/scripts/pnmtologo logoname); write_hex_cnt = 0; for (i = 0; i < logo_clutsize; i++) { +diff -urNp linux-2.6.32.41/scripts/tags.sh linux-2.6.32.41/scripts/tags.sh +--- linux-2.6.32.41/scripts/tags.sh 2011-03-27 14:31:47.000000000 -0400 ++++ linux-2.6.32.41/scripts/tags.sh 2011-06-07 18:06:04.000000000 -0400 +@@ -93,6 +93,11 @@ docscope() + cscope -b -f cscope.out + } + ++dogtags() ++{ ++ all_sources | gtags -f - ++} ++ + exuberant() + { + all_sources | xargs $1 -a \ +@@ -164,6 +169,10 @@ case "$1" in + docscope + ;; + ++ "gtags") ++ dogtags ++ ;; ++ + "tags") + rm -f tags + xtags ctags diff -urNp linux-2.6.32.41/security/capability.c linux-2.6.32.41/security/capability.c --- linux-2.6.32.41/security/capability.c 2011-03-27 14:31:47.000000000 -0400 +++ linux-2.6.32.41/security/capability.c 2011-04-17 15:56:46.000000000 -0400 diff --git a/2.6.39/0000_README b/2.6.39/0000_README index 4d1ac37..e431fc5 100644 --- a/2.6.39/0000_README +++ b/2.6.39/0000_README @@ -3,11 +3,7 @@ README Individual Patch Descriptions: ----------------------------------------------------------------------------- -Patch: 1000_linux-2.6.39.1.patch -From: http://www.kernel.org -Desc: Linux 2.6.39.1 - -Patch: 4420_grsecurity-2.2.2-2.6.39.1-201106061957.patch +Patch: 4420_grsecurity-2.2.2-2.6.39.1-201106071941.patch From: http://www.grsecurity.net Desc: hardened-sources base patch from upstream grsecurity diff --git a/2.6.39/1000_linux-2.6.39.1.patch b/2.6.39/1000_linux-2.6.39.1.patch deleted file mode 100644 index 776c2f6..0000000 --- a/2.6.39/1000_linux-2.6.39.1.patch +++ /dev/null @@ -1,6469 +0,0 @@ -diff --git a/Documentation/i2c/writing-clients b/Documentation/i2c/writing-clients -index 5ebf5af..5aa5337 100644 ---- a/Documentation/i2c/writing-clients -+++ b/Documentation/i2c/writing-clients -@@ -38,7 +38,7 @@ static struct i2c_driver foo_driver = { - .name = "foo", - }, - -- .id_table = foo_ids, -+ .id_table = foo_idtable, - .probe = foo_probe, - .remove = foo_remove, - /* if device autodetection is needed: */ -diff --git a/Documentation/usb/linux-cdc-acm.inf b/Documentation/usb/linux-cdc-acm.inf -index 612e722..37a02ce 100644 ---- a/Documentation/usb/linux-cdc-acm.inf -+++ b/Documentation/usb/linux-cdc-acm.inf -@@ -90,10 +90,10 @@ ServiceBinary=%12%\USBSER.sys - [SourceDisksFiles] - [SourceDisksNames] - [DeviceList] --%DESCRIPTION%=DriverInstall, USB\VID_0525&PID_A4A7, USB\VID_0525&PID_A4AB&MI_02 -+%DESCRIPTION%=DriverInstall, USB\VID_0525&PID_A4A7, USB\VID_1D6B&PID_0104&MI_02 - - [DeviceList.NTamd64] --%DESCRIPTION%=DriverInstall, USB\VID_0525&PID_A4A7, USB\VID_0525&PID_A4AB&MI_02 -+%DESCRIPTION%=DriverInstall, USB\VID_0525&PID_A4A7, USB\VID_1D6B&PID_0104&MI_02 - - - ;------------------------------------------------------------------------------ -diff --git a/Documentation/usb/linux.inf b/Documentation/usb/linux.inf -index 4dee958..4ffa715b0 100644 ---- a/Documentation/usb/linux.inf -+++ b/Documentation/usb/linux.inf -@@ -18,15 +18,15 @@ DriverVer = 06/21/2006,6.0.6000.16384 - - ; Decoration for x86 architecture - [LinuxDevices.NTx86] --%LinuxDevice% = RNDIS.NT.5.1, USB\VID_0525&PID_a4a2, USB\VID_0525&PID_a4ab&MI_00 -+%LinuxDevice% = RNDIS.NT.5.1, USB\VID_0525&PID_a4a2, USB\VID_1d6b&PID_0104&MI_00 - - ; Decoration for x64 architecture - [LinuxDevices.NTamd64] --%LinuxDevice% = RNDIS.NT.5.1, USB\VID_0525&PID_a4a2, USB\VID_0525&PID_a4ab&MI_00 -+%LinuxDevice% = RNDIS.NT.5.1, USB\VID_0525&PID_a4a2, USB\VID_1d6b&PID_0104&MI_00 - - ; Decoration for ia64 architecture - [LinuxDevices.NTia64] --%LinuxDevice% = RNDIS.NT.5.1, USB\VID_0525&PID_a4a2, USB\VID_0525&PID_a4ab&MI_00 -+%LinuxDevice% = RNDIS.NT.5.1, USB\VID_0525&PID_a4a2, USB\VID_1d6b&PID_0104&MI_00 - - ;@@@ This is the common setting for setup - [ControlFlags] -diff --git a/Makefile b/Makefile -index 123d858..045b186 100644 ---- a/Makefile -+++ b/Makefile -@@ -1378,7 +1378,7 @@ endif # KBUILD_EXTMOD - clean: $(clean-dirs) - $(call cmd,rmdirs) - $(call cmd,rmfiles) -- @find $(or $(KBUILD_EXTMOD), .) $(RCS_FIND_IGNORE) \ -+ @find $(if $(KBUILD_EXTMOD), $(KBUILD_EXTMOD), .) $(RCS_FIND_IGNORE) \ - \( -name '*.[oas]' -o -name '*.ko' -o -name '.*.cmd' \ - -o -name '.*.d' -o -name '.*.tmp' -o -name '*.mod.c' \ - -o -name '*.symtypes' -o -name 'modules.order' \ -diff --git a/arch/arm/mm/cache-v6.S b/arch/arm/mm/cache-v6.S -index c96fa1b..73b4a8b 100644 ---- a/arch/arm/mm/cache-v6.S -+++ b/arch/arm/mm/cache-v6.S -@@ -176,6 +176,7 @@ ENDPROC(v6_coherent_kern_range) - */ - ENTRY(v6_flush_kern_dcache_area) - add r1, r0, r1 -+ bic r0, r0, #D_CACHE_LINE_SIZE - 1 - 1: - #ifdef HARVARD_CACHE - mcr p15, 0, r0, c7, c14, 1 @ clean & invalidate D line -diff --git a/arch/arm/mm/cache-v7.S b/arch/arm/mm/cache-v7.S -index dc18d81..d32f02b 100644 ---- a/arch/arm/mm/cache-v7.S -+++ b/arch/arm/mm/cache-v7.S -@@ -221,6 +221,8 @@ ENDPROC(v7_coherent_user_range) - ENTRY(v7_flush_kern_dcache_area) - dcache_line_size r2, r3 - add r1, r0, r1 -+ sub r3, r2, #1 -+ bic r0, r0, r3 - 1: - mcr p15, 0, r0, c7, c14, 1 @ clean & invalidate D line / unified line - add r0, r0, r2 -diff --git a/arch/m68k/kernel/syscalltable.S b/arch/m68k/kernel/syscalltable.S -index 9b8393d..c54cca87 100644 ---- a/arch/m68k/kernel/syscalltable.S -+++ b/arch/m68k/kernel/syscalltable.S -@@ -319,8 +319,8 @@ ENTRY(sys_call_table) - .long sys_readlinkat - .long sys_fchmodat - .long sys_faccessat /* 300 */ -- .long sys_ni_syscall /* Reserved for pselect6 */ -- .long sys_ni_syscall /* Reserved for ppoll */ -+ .long sys_pselect6 -+ .long sys_ppoll - .long sys_unshare - .long sys_set_robust_list - .long sys_get_robust_list /* 305 */ -diff --git a/arch/parisc/include/asm/unistd.h b/arch/parisc/include/asm/unistd.h -index 3eb82c2..9cbc2c3 100644 ---- a/arch/parisc/include/asm/unistd.h -+++ b/arch/parisc/include/asm/unistd.h -@@ -814,8 +814,14 @@ - #define __NR_recvmmsg (__NR_Linux + 319) - #define __NR_accept4 (__NR_Linux + 320) - #define __NR_prlimit64 (__NR_Linux + 321) -- --#define __NR_Linux_syscalls (__NR_prlimit64 + 1) -+#define __NR_fanotify_init (__NR_Linux + 322) -+#define __NR_fanotify_mark (__NR_Linux + 323) -+#define __NR_clock_adjtime (__NR_Linux + 324) -+#define __NR_name_to_handle_at (__NR_Linux + 325) -+#define __NR_open_by_handle_at (__NR_Linux + 326) -+#define __NR_syncfs (__NR_Linux + 327) -+ -+#define __NR_Linux_syscalls (__NR_syncfs + 1) - - - #define __IGNORE_select /* newselect */ -diff --git a/arch/parisc/kernel/sys_parisc32.c b/arch/parisc/kernel/sys_parisc32.c -index 88a0ad1..dc9a624 100644 ---- a/arch/parisc/kernel/sys_parisc32.c -+++ b/arch/parisc/kernel/sys_parisc32.c -@@ -228,3 +228,11 @@ asmlinkage long compat_sys_fallocate(int fd, int mode, u32 offhi, u32 offlo, - return sys_fallocate(fd, mode, ((loff_t)offhi << 32) | offlo, - ((loff_t)lenhi << 32) | lenlo); - } -+ -+asmlinkage long compat_sys_fanotify_mark(int fan_fd, int flags, u32 mask_hi, -+ u32 mask_lo, int fd, -+ const char __user *pathname) -+{ -+ return sys_fanotify_mark(fan_fd, flags, ((u64)mask_hi << 32) | mask_lo, -+ fd, pathname); -+} -diff --git a/arch/parisc/kernel/syscall_table.S b/arch/parisc/kernel/syscall_table.S -index 4be85ee..a5b02ce 100644 ---- a/arch/parisc/kernel/syscall_table.S -+++ b/arch/parisc/kernel/syscall_table.S -@@ -420,6 +420,12 @@ - ENTRY_COMP(recvmmsg) - ENTRY_SAME(accept4) /* 320 */ - ENTRY_SAME(prlimit64) -+ ENTRY_SAME(fanotify_init) -+ ENTRY_COMP(fanotify_mark) -+ ENTRY_COMP(clock_adjtime) -+ ENTRY_SAME(name_to_handle_at) /* 325 */ -+ ENTRY_COMP(open_by_handle_at) -+ ENTRY_SAME(syncfs) - - /* Nothing yet */ - -diff --git a/arch/powerpc/kernel/crash.c b/arch/powerpc/kernel/crash.c -index 5b5e1f0..c37ff6b 100644 ---- a/arch/powerpc/kernel/crash.c -+++ b/arch/powerpc/kernel/crash.c -@@ -170,7 +170,7 @@ static void crash_kexec_wait_realmode(int cpu) - int i; - - msecs = 10000; -- for (i=0; i < NR_CPUS && msecs > 0; i++) { -+ for (i=0; i < nr_cpu_ids && msecs > 0; i++) { - if (i == cpu) - continue; - -diff --git a/arch/powerpc/kernel/misc_64.S b/arch/powerpc/kernel/misc_64.S -index 206a321..e89df59 100644 ---- a/arch/powerpc/kernel/misc_64.S -+++ b/arch/powerpc/kernel/misc_64.S -@@ -462,7 +462,8 @@ _GLOBAL(disable_kernel_fp) - * wait for the flag to change, indicating this kernel is going away but - * the slave code for the next one is at addresses 0 to 100. - * -- * This is used by all slaves. -+ * This is used by all slaves, even those that did not find a matching -+ * paca in the secondary startup code. - * - * Physical (hardware) cpu id should be in r3. - */ -@@ -471,10 +472,6 @@ _GLOBAL(kexec_wait) - 1: mflr r5 - addi r5,r5,kexec_flag-1b - -- li r4,KEXEC_STATE_REAL_MODE -- stb r4,PACAKEXECSTATE(r13) -- SYNC -- - 99: HMT_LOW - #ifdef CONFIG_KEXEC /* use no memory without kexec */ - lwz r4,0(r5) -@@ -499,11 +496,17 @@ kexec_flag: - * - * get phys id from paca - * switch to real mode -+ * mark the paca as no longer used - * join other cpus in kexec_wait(phys_id) - */ - _GLOBAL(kexec_smp_wait) - lhz r3,PACAHWCPUID(r13) - bl real_mode -+ -+ li r4,KEXEC_STATE_REAL_MODE -+ stb r4,PACAKEXECSTATE(r13) -+ SYNC -+ - b .kexec_wait - - /* -diff --git a/arch/powerpc/oprofile/op_model_power4.c b/arch/powerpc/oprofile/op_model_power4.c -index 8ee51a2..e6bec74 100644 ---- a/arch/powerpc/oprofile/op_model_power4.c -+++ b/arch/powerpc/oprofile/op_model_power4.c -@@ -261,6 +261,28 @@ static int get_kernel(unsigned long pc, unsigned long mmcra) - return is_kernel; - } - -+static bool pmc_overflow(unsigned long val) -+{ -+ if ((int)val < 0) -+ return true; -+ -+ /* -+ * Events on POWER7 can roll back if a speculative event doesn't -+ * eventually complete. Unfortunately in some rare cases they will -+ * raise a performance monitor exception. We need to catch this to -+ * ensure we reset the PMC. In all cases the PMC will be 256 or less -+ * cycles from overflow. -+ * -+ * We only do this if the first pass fails to find any overflowing -+ * PMCs because a user might set a period of less than 256 and we -+ * don't want to mistakenly reset them. -+ */ -+ if (__is_processor(PV_POWER7) && ((0x80000000 - val) <= 256)) -+ return true; -+ -+ return false; -+} -+ - static void power4_handle_interrupt(struct pt_regs *regs, - struct op_counter_config *ctr) - { -@@ -281,7 +303,7 @@ static void power4_handle_interrupt(struct pt_regs *regs, - - for (i = 0; i < cur_cpu_spec->num_pmcs; ++i) { - val = classic_ctr_read(i); -- if (val < 0) { -+ if (pmc_overflow(val)) { - if (oprofile_running && ctr[i].enabled) { - oprofile_add_ext_sample(pc, regs, i, is_kernel); - classic_ctr_write(i, reset_value[i]); -diff --git a/arch/sh/kernel/cpu/Makefile b/arch/sh/kernel/cpu/Makefile -index d49c213..ae95935 100644 ---- a/arch/sh/kernel/cpu/Makefile -+++ b/arch/sh/kernel/cpu/Makefile -@@ -17,7 +17,5 @@ obj-$(CONFIG_ARCH_SHMOBILE) += shmobile/ - - obj-$(CONFIG_SH_ADC) += adc.o - obj-$(CONFIG_SH_CLK_CPG_LEGACY) += clock-cpg.o --obj-$(CONFIG_SH_FPU) += fpu.o --obj-$(CONFIG_SH_FPU_EMU) += fpu.o - --obj-y += irq/ init.o clock.o hwblk.o proc.o -+obj-y += irq/ init.o clock.o fpu.o hwblk.o proc.o -diff --git a/arch/um/Kconfig.x86 b/arch/um/Kconfig.x86 -index a9da516..795ea8e 100644 ---- a/arch/um/Kconfig.x86 -+++ b/arch/um/Kconfig.x86 -@@ -29,10 +29,10 @@ config X86_64 - def_bool 64BIT - - config RWSEM_XCHGADD_ALGORITHM -- def_bool X86_XADD -+ def_bool X86_XADD && 64BIT - - config RWSEM_GENERIC_SPINLOCK -- def_bool !X86_XADD -+ def_bool !RWSEM_XCHGADD_ALGORITHM - - config 3_LEVEL_PGTABLES - bool "Three-level pagetables (EXPERIMENTAL)" if !64BIT -diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h -index 91f3e087..cc5b052 100644 ---- a/arch/x86/include/asm/cpufeature.h -+++ b/arch/x86/include/asm/cpufeature.h -@@ -125,7 +125,7 @@ - #define X86_FEATURE_OSXSAVE (4*32+27) /* "" XSAVE enabled in the OS */ - #define X86_FEATURE_AVX (4*32+28) /* Advanced Vector Extensions */ - #define X86_FEATURE_F16C (4*32+29) /* 16-bit fp conversions */ --#define X86_FEATURE_RDRND (4*32+30) /* The RDRAND instruction */ -+#define X86_FEATURE_RDRAND (4*32+30) /* The RDRAND instruction */ - #define X86_FEATURE_HYPERVISOR (4*32+31) /* Running on a hypervisor */ - - /* VIA/Cyrix/Centaur-defined CPU features, CPUID level 0xC0000001, word 5 */ -diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h -index abd3e0e..99f0ad7 100644 ---- a/arch/x86/include/asm/uaccess.h -+++ b/arch/x86/include/asm/uaccess.h -@@ -42,7 +42,7 @@ - * Returns 0 if the range is valid, nonzero otherwise. - * - * This is equivalent to the following test: -- * (u33)addr + (u33)size >= (u33)current->addr_limit.seg (u65 for x86_64) -+ * (u33)addr + (u33)size > (u33)current->addr_limit.seg (u65 for x86_64) - * - * This needs 33-bit (65-bit for x86_64) arithmetic. We have a carry... - */ -diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c -index 45fd33d..df63620 100644 ---- a/arch/x86/kernel/apic/io_apic.c -+++ b/arch/x86/kernel/apic/io_apic.c -@@ -621,14 +621,14 @@ struct IO_APIC_route_entry **alloc_ioapic_entries(void) - struct IO_APIC_route_entry **ioapic_entries; - - ioapic_entries = kzalloc(sizeof(*ioapic_entries) * nr_ioapics, -- GFP_KERNEL); -+ GFP_ATOMIC); - if (!ioapic_entries) - return 0; - - for (apic = 0; apic < nr_ioapics; apic++) { - ioapic_entries[apic] = - kzalloc(sizeof(struct IO_APIC_route_entry) * -- nr_ioapic_registers[apic], GFP_KERNEL); -+ nr_ioapic_registers[apic], GFP_ATOMIC); - if (!ioapic_entries[apic]) - goto nomem; - } -diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c -index 6f9d1f6..b13ed39 100644 ---- a/arch/x86/kernel/cpu/amd.c -+++ b/arch/x86/kernel/cpu/amd.c -@@ -612,8 +612,11 @@ static void __cpuinit init_amd(struct cpuinfo_x86 *c) - } - #endif - -- /* As a rule processors have APIC timer running in deep C states */ -- if (c->x86 > 0xf && !cpu_has_amd_erratum(amd_erratum_400)) -+ /* -+ * Family 0x12 and above processors have APIC timer -+ * running in deep C states. -+ */ -+ if (c->x86 > 0x11) - set_cpu_cap(c, X86_FEATURE_ARAT); - - /* -@@ -629,10 +632,13 @@ static void __cpuinit init_amd(struct cpuinfo_x86 *c) - * Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=33012 - */ - u64 mask; -+ int err; - -- rdmsrl(MSR_AMD64_MCx_MASK(4), mask); -- mask |= (1 << 10); -- wrmsrl(MSR_AMD64_MCx_MASK(4), mask); -+ err = rdmsrl_safe(MSR_AMD64_MCx_MASK(4), &mask); -+ if (err == 0) { -+ mask |= (1 << 10); -+ checking_wrmsrl(MSR_AMD64_MCx_MASK(4), mask); -+ } - } - } - -diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c -index e2ced00..173f3a3 100644 ---- a/arch/x86/kernel/cpu/common.c -+++ b/arch/x86/kernel/cpu/common.c -@@ -565,8 +565,7 @@ void __cpuinit get_cpu_cap(struct cpuinfo_x86 *c) - - cpuid_count(0x00000007, 0, &eax, &ebx, &ecx, &edx); - -- if (eax > 0) -- c->x86_capability[9] = ebx; -+ c->x86_capability[9] = ebx; - } - - /* AMD-defined flags: level 0x80000001 */ -diff --git a/arch/x86/kernel/cpu/cpufreq/pcc-cpufreq.c b/arch/x86/kernel/cpu/cpufreq/pcc-cpufreq.c -index 755a31e..907c8e6 100644 ---- a/arch/x86/kernel/cpu/cpufreq/pcc-cpufreq.c -+++ b/arch/x86/kernel/cpu/cpufreq/pcc-cpufreq.c -@@ -39,7 +39,7 @@ - - #include <acpi/processor.h> - --#define PCC_VERSION "1.00.00" -+#define PCC_VERSION "1.10.00" - #define POLL_LOOPS 300 - - #define CMD_COMPLETE 0x1 -@@ -102,7 +102,7 @@ static struct acpi_generic_address doorbell; - static u64 doorbell_preserve; - static u64 doorbell_write; - --static u8 OSC_UUID[16] = {0x63, 0x9B, 0x2C, 0x9F, 0x70, 0x91, 0x49, 0x1f, -+static u8 OSC_UUID[16] = {0x9F, 0x2C, 0x9B, 0x63, 0x91, 0x70, 0x1f, 0x49, - 0xBB, 0x4F, 0xA5, 0x98, 0x2F, 0xA1, 0xB5, 0x46}; - - struct pcc_cpu { -diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c -index 4be9b39..c6724e4 100644 ---- a/arch/x86/kernel/setup.c -+++ b/arch/x86/kernel/setup.c -@@ -912,6 +912,13 @@ void __init setup_arch(char **cmdline_p) - memblock.current_limit = get_max_mapped(); - memblock_x86_fill(); - -+ /* -+ * The EFI specification says that boot service code won't be called -+ * after ExitBootServices(). This is, in fact, a lie. -+ */ -+ if (efi_enabled) -+ efi_reserve_boot_services(); -+ - /* preallocate 4k for mptable mpc */ - early_reserve_e820_mpc_new(); - -diff --git a/arch/x86/lib/copy_user_64.S b/arch/x86/lib/copy_user_64.S -index 99e4826..a73397f 100644 ---- a/arch/x86/lib/copy_user_64.S -+++ b/arch/x86/lib/copy_user_64.S -@@ -72,7 +72,7 @@ ENTRY(_copy_to_user) - addq %rdx,%rcx - jc bad_to_user - cmpq TI_addr_limit(%rax),%rcx -- jae bad_to_user -+ ja bad_to_user - ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string - CFI_ENDPROC - ENDPROC(_copy_to_user) -@@ -85,7 +85,7 @@ ENTRY(_copy_from_user) - addq %rdx,%rcx - jc bad_from_user - cmpq TI_addr_limit(%rax),%rcx -- jae bad_from_user -+ ja bad_from_user - ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string - CFI_ENDPROC - ENDPROC(_copy_from_user) -diff --git a/arch/x86/oprofile/op_model_amd.c b/arch/x86/oprofile/op_model_amd.c -index c3b8e24..9fd8a56 100644 ---- a/arch/x86/oprofile/op_model_amd.c -+++ b/arch/x86/oprofile/op_model_amd.c -@@ -316,16 +316,23 @@ static void op_amd_stop_ibs(void) - wrmsrl(MSR_AMD64_IBSOPCTL, 0); - } - --static inline int eilvt_is_available(int offset) -+static inline int get_eilvt(int offset) - { -- /* check if we may assign a vector */ - return !setup_APIC_eilvt(offset, 0, APIC_EILVT_MSG_NMI, 1); - } - -+static inline int put_eilvt(int offset) -+{ -+ return !setup_APIC_eilvt(offset, 0, 0, 1); -+} -+ - static inline int ibs_eilvt_valid(void) - { - int offset; - u64 val; -+ int valid = 0; -+ -+ preempt_disable(); - - rdmsrl(MSR_AMD64_IBSCTL, val); - offset = val & IBSCTL_LVT_OFFSET_MASK; -@@ -333,16 +340,20 @@ static inline int ibs_eilvt_valid(void) - if (!(val & IBSCTL_LVT_OFFSET_VALID)) { - pr_err(FW_BUG "cpu %d, invalid IBS interrupt offset %d (MSR%08X=0x%016llx)\n", - smp_processor_id(), offset, MSR_AMD64_IBSCTL, val); -- return 0; -+ goto out; - } - -- if (!eilvt_is_available(offset)) { -+ if (!get_eilvt(offset)) { - pr_err(FW_BUG "cpu %d, IBS interrupt offset %d not available (MSR%08X=0x%016llx)\n", - smp_processor_id(), offset, MSR_AMD64_IBSCTL, val); -- return 0; -+ goto out; - } - -- return 1; -+ valid = 1; -+out: -+ preempt_enable(); -+ -+ return valid; - } - - static inline int get_ibs_offset(void) -@@ -600,67 +611,69 @@ static int setup_ibs_ctl(int ibs_eilvt_off) - - static int force_ibs_eilvt_setup(void) - { -- int i; -+ int offset; - int ret; - -- /* find the next free available EILVT entry */ -- for (i = 1; i < 4; i++) { -- if (!eilvt_is_available(i)) -- continue; -- ret = setup_ibs_ctl(i); -- if (ret) -- return ret; -- pr_err(FW_BUG "using offset %d for IBS interrupts\n", i); -- return 0; -+ /* -+ * find the next free available EILVT entry, skip offset 0, -+ * pin search to this cpu -+ */ -+ preempt_disable(); -+ for (offset = 1; offset < APIC_EILVT_NR_MAX; offset++) { -+ if (get_eilvt(offset)) -+ break; - } -+ preempt_enable(); - -- printk(KERN_DEBUG "No EILVT entry available\n"); -- -- return -EBUSY; --} -- --static int __init_ibs_nmi(void) --{ -- int ret; -- -- if (ibs_eilvt_valid()) -- return 0; -+ if (offset == APIC_EILVT_NR_MAX) { -+ printk(KERN_DEBUG "No EILVT entry available\n"); -+ return -EBUSY; -+ } - -- ret = force_ibs_eilvt_setup(); -+ ret = setup_ibs_ctl(offset); - if (ret) -- return ret; -+ goto out; - -- if (!ibs_eilvt_valid()) -- return -EFAULT; -+ if (!ibs_eilvt_valid()) { -+ ret = -EFAULT; -+ goto out; -+ } - -+ pr_err(FW_BUG "using offset %d for IBS interrupts\n", offset); - pr_err(FW_BUG "workaround enabled for IBS LVT offset\n"); - - return 0; -+out: -+ preempt_disable(); -+ put_eilvt(offset); -+ preempt_enable(); -+ return ret; - } - - /* - * check and reserve APIC extended interrupt LVT offset for IBS if - * available -- * -- * init_ibs() preforms implicitly cpu-local operations, so pin this -- * thread to its current CPU - */ - - static void init_ibs(void) - { -- preempt_disable(); -- - ibs_caps = get_ibs_caps(); -+ - if (!ibs_caps) -+ return; -+ -+ if (ibs_eilvt_valid()) - goto out; - -- if (__init_ibs_nmi() < 0) -- ibs_caps = 0; -- else -- printk(KERN_INFO "oprofile: AMD IBS detected (0x%08x)\n", ibs_caps); -+ if (!force_ibs_eilvt_setup()) -+ goto out; -+ -+ /* Failed to setup ibs */ -+ ibs_caps = 0; -+ return; - - out: -- preempt_enable(); -+ printk(KERN_INFO "oprofile: AMD IBS detected (0x%08x)\n", ibs_caps); - } - - static int (*create_arch_files)(struct super_block *sb, struct dentry *root); -diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c -index 0fe27d7..b00c4ea 100644 ---- a/arch/x86/platform/efi/efi.c -+++ b/arch/x86/platform/efi/efi.c -@@ -315,6 +315,40 @@ static void __init print_efi_memmap(void) - } - #endif /* EFI_DEBUG */ - -+void __init efi_reserve_boot_services(void) -+{ -+ void *p; -+ -+ for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) { -+ efi_memory_desc_t *md = p; -+ unsigned long long start = md->phys_addr; -+ unsigned long long size = md->num_pages << EFI_PAGE_SHIFT; -+ -+ if (md->type != EFI_BOOT_SERVICES_CODE && -+ md->type != EFI_BOOT_SERVICES_DATA) -+ continue; -+ -+ memblock_x86_reserve_range(start, start + size, "EFI Boot"); -+ } -+} -+ -+static void __init efi_free_boot_services(void) -+{ -+ void *p; -+ -+ for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) { -+ efi_memory_desc_t *md = p; -+ unsigned long long start = md->phys_addr; -+ unsigned long long size = md->num_pages << EFI_PAGE_SHIFT; -+ -+ if (md->type != EFI_BOOT_SERVICES_CODE && -+ md->type != EFI_BOOT_SERVICES_DATA) -+ continue; -+ -+ free_bootmem_late(start, size); -+ } -+} -+ - void __init efi_init(void) - { - efi_config_table_t *config_tables; -@@ -507,7 +541,9 @@ void __init efi_enter_virtual_mode(void) - efi.systab = NULL; - for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) { - md = p; -- if (!(md->attribute & EFI_MEMORY_RUNTIME)) -+ if (!(md->attribute & EFI_MEMORY_RUNTIME) && -+ md->type != EFI_BOOT_SERVICES_CODE && -+ md->type != EFI_BOOT_SERVICES_DATA) - continue; - - size = md->num_pages << EFI_PAGE_SHIFT; -@@ -558,6 +594,13 @@ void __init efi_enter_virtual_mode(void) - } - - /* -+ * Thankfully, it does seem that no runtime services other than -+ * SetVirtualAddressMap() will touch boot services code, so we can -+ * get rid of it all at this point -+ */ -+ efi_free_boot_services(); -+ -+ /* - * Now that EFI is in virtual mode, update the function - * pointers in the runtime service table to the new virtual addresses. - * -diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c -index ac0621a..641264c 100644 ---- a/arch/x86/platform/efi/efi_64.c -+++ b/arch/x86/platform/efi/efi_64.c -@@ -64,10 +64,11 @@ static void __init early_runtime_code_mapping_set_exec(int executable) - if (!(__supported_pte_mask & _PAGE_NX)) - return; - -- /* Make EFI runtime service code area executable */ -+ /* Make EFI service code area executable */ - for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) { - md = p; -- if (md->type == EFI_RUNTIME_SERVICES_CODE) { -+ if (md->type == EFI_RUNTIME_SERVICES_CODE || -+ md->type == EFI_BOOT_SERVICES_CODE) { - unsigned long end; - end = md->phys_addr + (md->num_pages << EFI_PAGE_SHIFT); - early_mapping_set_exec(md->phys_addr, end, executable); -diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c -index 0684f3c..f298bd7 100644 ---- a/arch/x86/xen/mmu.c -+++ b/arch/x86/xen/mmu.c -@@ -1187,7 +1187,7 @@ static void drop_other_mm_ref(void *info) - - active_mm = percpu_read(cpu_tlbstate.active_mm); - -- if (active_mm == mm) -+ if (active_mm == mm && percpu_read(cpu_tlbstate.state) != TLBSTATE_OK) - leave_mm(smp_processor_id()); - - /* If this cpu still has a stale cr3 reference, then make sure -diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c -index 141eb0d..c881ae4 100644 ---- a/arch/x86/xen/p2m.c -+++ b/arch/x86/xen/p2m.c -@@ -522,11 +522,20 @@ static bool __init __early_alloc_p2m(unsigned long pfn) - /* Boundary cross-over for the edges: */ - if (idx) { - unsigned long *p2m = extend_brk(PAGE_SIZE, PAGE_SIZE); -+ unsigned long *mid_mfn_p; - - p2m_init(p2m); - - p2m_top[topidx][mididx] = p2m; - -+ /* For save/restore we need to MFN of the P2M saved */ -+ -+ mid_mfn_p = p2m_top_mfn_p[topidx]; -+ WARN(mid_mfn_p[mididx] != virt_to_mfn(p2m_missing), -+ "P2M_TOP_P[%d][%d] != MFN of p2m_missing!\n", -+ topidx, mididx); -+ mid_mfn_p[mididx] = virt_to_mfn(p2m); -+ - } - return idx != 0; - } -@@ -549,12 +558,29 @@ unsigned long __init set_phys_range_identity(unsigned long pfn_s, - pfn += P2M_MID_PER_PAGE * P2M_PER_PAGE) - { - unsigned topidx = p2m_top_index(pfn); -- if (p2m_top[topidx] == p2m_mid_missing) { -- unsigned long **mid = extend_brk(PAGE_SIZE, PAGE_SIZE); -+ unsigned long *mid_mfn_p; -+ unsigned long **mid; -+ -+ mid = p2m_top[topidx]; -+ mid_mfn_p = p2m_top_mfn_p[topidx]; -+ if (mid == p2m_mid_missing) { -+ mid = extend_brk(PAGE_SIZE, PAGE_SIZE); - - p2m_mid_init(mid); - - p2m_top[topidx] = mid; -+ -+ BUG_ON(mid_mfn_p != p2m_mid_missing_mfn); -+ } -+ /* And the save/restore P2M tables.. */ -+ if (mid_mfn_p == p2m_mid_missing_mfn) { -+ mid_mfn_p = extend_brk(PAGE_SIZE, PAGE_SIZE); -+ p2m_mid_mfn_init(mid_mfn_p); -+ -+ p2m_top_mfn_p[topidx] = mid_mfn_p; -+ p2m_top_mfn[topidx] = virt_to_mfn(mid_mfn_p); -+ /* Note: we don't set mid_mfn_p[midix] here, -+ * look in __early_alloc_p2m */ - } - } - -diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c -index 90bac0a..ca6297b 100644 ---- a/arch/x86/xen/setup.c -+++ b/arch/x86/xen/setup.c -@@ -166,7 +166,7 @@ static unsigned long __init xen_set_identity(const struct e820entry *list, - if (last > end) - continue; - -- if (entry->type == E820_RAM) { -+ if ((entry->type == E820_RAM) || (entry->type == E820_UNUSABLE)) { - if (start > start_pci) - identity += set_phys_range_identity( - PFN_UP(start_pci), PFN_DOWN(start)); -@@ -227,7 +227,11 @@ char * __init xen_memory_setup(void) - - memcpy(map_raw, map, sizeof(map)); - e820.nr_map = 0; -+#ifdef CONFIG_X86_32 -+ xen_extra_mem_start = mem_end; -+#else - xen_extra_mem_start = max((1ULL << 32), mem_end); -+#endif - for (i = 0; i < memmap.nr_entries; i++) { - unsigned long long end; - -diff --git a/block/blk-flush.c b/block/blk-flush.c -index 6c9b5e1..bb21e4c 100644 ---- a/block/blk-flush.c -+++ b/block/blk-flush.c -@@ -212,13 +212,19 @@ static void flush_end_io(struct request *flush_rq, int error) - } - - /* -- * Moving a request silently to empty queue_head may stall the -- * queue. Kick the queue in those cases. This function is called -- * from request completion path and calling directly into -- * request_fn may confuse the driver. Always use kblockd. -+ * Kick the queue to avoid stall for two cases: -+ * 1. Moving a request silently to empty queue_head may stall the -+ * queue. -+ * 2. When flush request is running in non-queueable queue, the -+ * queue is hold. Restart the queue after flush request is finished -+ * to avoid stall. -+ * This function is called from request completion path and calling -+ * directly into request_fn may confuse the driver. Always use -+ * kblockd. - */ -- if (queued) -+ if (queued || q->flush_queue_delayed) - blk_run_queue_async(q); -+ q->flush_queue_delayed = 0; - } - - /** -diff --git a/block/blk-settings.c b/block/blk-settings.c -index 1fa7692..fa1eb04 100644 ---- a/block/blk-settings.c -+++ b/block/blk-settings.c -@@ -120,7 +120,7 @@ void blk_set_default_limits(struct queue_limits *lim) - lim->discard_granularity = 0; - lim->discard_alignment = 0; - lim->discard_misaligned = 0; -- lim->discard_zeroes_data = -1; -+ lim->discard_zeroes_data = 1; - lim->logical_block_size = lim->physical_block_size = lim->io_min = 512; - lim->bounce_pfn = (unsigned long)(BLK_BOUNCE_ANY >> PAGE_SHIFT); - lim->alignment_offset = 0; -@@ -166,6 +166,7 @@ void blk_queue_make_request(struct request_queue *q, make_request_fn *mfn) - - blk_set_default_limits(&q->limits); - blk_queue_max_hw_sectors(q, BLK_SAFE_MAX_SECTORS); -+ q->limits.discard_zeroes_data = 0; - - /* - * by default assume old behaviour and bounce for any highmem page -@@ -790,6 +791,12 @@ void blk_queue_flush(struct request_queue *q, unsigned int flush) - } - EXPORT_SYMBOL_GPL(blk_queue_flush); - -+void blk_queue_flush_queueable(struct request_queue *q, bool queueable) -+{ -+ q->flush_not_queueable = !queueable; -+} -+EXPORT_SYMBOL_GPL(blk_queue_flush_queueable); -+ - static int __init blk_settings_init(void) - { - blk_max_low_pfn = max_low_pfn - 1; -diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c -index bd23631..d935bd8 100644 ---- a/block/blk-sysfs.c -+++ b/block/blk-sysfs.c -@@ -152,7 +152,8 @@ static ssize_t queue_discard_granularity_show(struct request_queue *q, char *pag - - static ssize_t queue_discard_max_show(struct request_queue *q, char *page) - { -- return queue_var_show(q->limits.max_discard_sectors << 9, page); -+ return sprintf(page, "%llu\n", -+ (unsigned long long)q->limits.max_discard_sectors << 9); - } - - static ssize_t queue_discard_zeroes_data_show(struct request_queue *q, char *page) -diff --git a/block/blk.h b/block/blk.h -index 6126346..1566e8d 100644 ---- a/block/blk.h -+++ b/block/blk.h -@@ -61,8 +61,28 @@ static inline struct request *__elv_next_request(struct request_queue *q) - rq = list_entry_rq(q->queue_head.next); - return rq; - } -- -- if (!q->elevator->ops->elevator_dispatch_fn(q, 0)) -+ /* -+ * Flush request is running and flush request isn't queueable -+ * in the drive, we can hold the queue till flush request is -+ * finished. Even we don't do this, driver can't dispatch next -+ * requests and will requeue them. And this can improve -+ * throughput too. For example, we have request flush1, write1, -+ * flush 2. flush1 is dispatched, then queue is hold, write1 -+ * isn't inserted to queue. After flush1 is finished, flush2 -+ * will be dispatched. Since disk cache is already clean, -+ * flush2 will be finished very soon, so looks like flush2 is -+ * folded to flush1. -+ * Since the queue is hold, a flag is set to indicate the queue -+ * should be restarted later. Please see flush_end_io() for -+ * details. -+ */ -+ if (q->flush_pending_idx != q->flush_running_idx && -+ !queue_flush_queueable(q)) { -+ q->flush_queue_delayed = 1; -+ return NULL; -+ } -+ if (test_bit(QUEUE_FLAG_DEAD, &q->queue_flags) || -+ !q->elevator->ops->elevator_dispatch_fn(q, 0)) - return NULL; - } - } -diff --git a/block/genhd.c b/block/genhd.c -index 2dd9887..95822ae 100644 ---- a/block/genhd.c -+++ b/block/genhd.c -@@ -1728,7 +1728,7 @@ static void disk_add_events(struct gendisk *disk) - { - struct disk_events *ev; - -- if (!disk->fops->check_events || !(disk->events | disk->async_events)) -+ if (!disk->fops->check_events) - return; - - ev = kzalloc(sizeof(*ev), GFP_KERNEL); -diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c -index e2f57e9e..d51f979 100644 ---- a/drivers/ata/libata-scsi.c -+++ b/drivers/ata/libata-scsi.c -@@ -1089,21 +1089,21 @@ static int atapi_drain_needed(struct request *rq) - static int ata_scsi_dev_config(struct scsi_device *sdev, - struct ata_device *dev) - { -+ struct request_queue *q = sdev->request_queue; -+ - if (!ata_id_has_unload(dev->id)) - dev->flags |= ATA_DFLAG_NO_UNLOAD; - - /* configure max sectors */ -- blk_queue_max_hw_sectors(sdev->request_queue, dev->max_sectors); -+ blk_queue_max_hw_sectors(q, dev->max_sectors); - - if (dev->class == ATA_DEV_ATAPI) { -- struct request_queue *q = sdev->request_queue; - void *buf; - - sdev->sector_size = ATA_SECT_SIZE; - - /* set DMA padding */ -- blk_queue_update_dma_pad(sdev->request_queue, -- ATA_DMA_PAD_SZ - 1); -+ blk_queue_update_dma_pad(q, ATA_DMA_PAD_SZ - 1); - - /* configure draining */ - buf = kmalloc(ATAPI_MAX_DRAIN, q->bounce_gfp | GFP_KERNEL); -@@ -1131,8 +1131,7 @@ static int ata_scsi_dev_config(struct scsi_device *sdev, - "sector_size=%u > PAGE_SIZE, PIO may malfunction\n", - sdev->sector_size); - -- blk_queue_update_dma_alignment(sdev->request_queue, -- sdev->sector_size - 1); -+ blk_queue_update_dma_alignment(q, sdev->sector_size - 1); - - if (dev->flags & ATA_DFLAG_AN) - set_bit(SDEV_EVT_MEDIA_CHANGE, sdev->supported_events); -@@ -1145,6 +1144,8 @@ static int ata_scsi_dev_config(struct scsi_device *sdev, - scsi_adjust_queue_depth(sdev, MSG_SIMPLE_TAG, depth); - } - -+ blk_queue_flush_queueable(q, false); -+ - dev->sdev = sdev; - return 0; - } -@@ -2138,7 +2139,7 @@ static unsigned int ata_scsiop_inq_b0(struct ata_scsi_args *args, u8 *rbuf) - * with the unmap bit set. - */ - if (ata_id_has_trim(args->id)) { -- put_unaligned_be32(65535 * 512 / 8, &rbuf[20]); -+ put_unaligned_be64(65535 * 512 / 8, &rbuf[36]); - put_unaligned_be32(1, &rbuf[28]); - } - -diff --git a/drivers/ata/pata_cmd64x.c b/drivers/ata/pata_cmd64x.c -index 905ff76..635a759 100644 ---- a/drivers/ata/pata_cmd64x.c -+++ b/drivers/ata/pata_cmd64x.c -@@ -41,6 +41,9 @@ - enum { - CFR = 0x50, - CFR_INTR_CH0 = 0x04, -+ CNTRL = 0x51, -+ CNTRL_CH0 = 0x04, -+ CNTRL_CH1 = 0x08, - CMDTIM = 0x52, - ARTTIM0 = 0x53, - DRWTIM0 = 0x54, -@@ -328,9 +331,19 @@ static int cmd64x_init_one(struct pci_dev *pdev, const struct pci_device_id *id) - .port_ops = &cmd648_port_ops - } - }; -- const struct ata_port_info *ppi[] = { &cmd_info[id->driver_data], NULL }; -- u8 mrdmode; -+ const struct ata_port_info *ppi[] = { -+ &cmd_info[id->driver_data], -+ &cmd_info[id->driver_data], -+ NULL -+ }; -+ u8 mrdmode, reg; - int rc; -+ struct pci_dev *bridge = pdev->bus->self; -+ /* mobility split bridges don't report enabled ports correctly */ -+ int port_ok = !(bridge && bridge->vendor == -+ PCI_VENDOR_ID_MOBILITY_ELECTRONICS); -+ /* all (with exceptions below) apart from 643 have CNTRL_CH0 bit */ -+ int cntrl_ch0_ok = (id->driver_data != 0); - - rc = pcim_enable_device(pdev); - if (rc) -@@ -341,11 +354,18 @@ static int cmd64x_init_one(struct pci_dev *pdev, const struct pci_device_id *id) - - if (pdev->device == PCI_DEVICE_ID_CMD_646) { - /* Does UDMA work ? */ -- if (pdev->revision > 4) -+ if (pdev->revision > 4) { - ppi[0] = &cmd_info[2]; -+ ppi[1] = &cmd_info[2]; -+ } - /* Early rev with other problems ? */ -- else if (pdev->revision == 1) -+ else if (pdev->revision == 1) { - ppi[0] = &cmd_info[3]; -+ ppi[1] = &cmd_info[3]; -+ } -+ /* revs 1,2 have no CNTRL_CH0 */ -+ if (pdev->revision < 3) -+ cntrl_ch0_ok = 0; - } - - pci_write_config_byte(pdev, PCI_LATENCY_TIMER, 64); -@@ -354,6 +374,20 @@ static int cmd64x_init_one(struct pci_dev *pdev, const struct pci_device_id *id) - mrdmode |= 0x02; /* Memory read line enable */ - pci_write_config_byte(pdev, MRDMODE, mrdmode); - -+ /* check for enabled ports */ -+ pci_read_config_byte(pdev, CNTRL, ®); -+ if (!port_ok) -+ dev_printk(KERN_NOTICE, &pdev->dev, "Mobility Bridge detected, ignoring CNTRL port enable/disable\n"); -+ if (port_ok && cntrl_ch0_ok && !(reg & CNTRL_CH0)) { -+ dev_printk(KERN_NOTICE, &pdev->dev, "Primary port is disabled\n"); -+ ppi[0] = &ata_dummy_port_info; -+ -+ } -+ if (port_ok && !(reg & CNTRL_CH1)) { -+ dev_printk(KERN_NOTICE, &pdev->dev, "Secondary port is disabled\n"); -+ ppi[1] = &ata_dummy_port_info; -+ } -+ - /* Force PIO 0 here.. */ - - /* PPC specific fixup copied from old driver */ -diff --git a/drivers/block/brd.c b/drivers/block/brd.c -index b7f51e4..c94bc48 100644 ---- a/drivers/block/brd.c -+++ b/drivers/block/brd.c -@@ -552,7 +552,7 @@ static struct kobject *brd_probe(dev_t dev, int *part, void *data) - struct kobject *kobj; - - mutex_lock(&brd_devices_mutex); -- brd = brd_init_one(dev & MINORMASK); -+ brd = brd_init_one(MINOR(dev) >> part_shift); - kobj = brd ? get_disk(brd->brd_disk) : ERR_PTR(-ENOMEM); - mutex_unlock(&brd_devices_mutex); - -@@ -585,15 +585,18 @@ static int __init brd_init(void) - if (max_part > 0) - part_shift = fls(max_part); - -+ if ((1UL << part_shift) > DISK_MAX_PARTS) -+ return -EINVAL; -+ - if (rd_nr > 1UL << (MINORBITS - part_shift)) - return -EINVAL; - - if (rd_nr) { - nr = rd_nr; -- range = rd_nr; -+ range = rd_nr << part_shift; - } else { - nr = CONFIG_BLK_DEV_RAM_COUNT; -- range = 1UL << (MINORBITS - part_shift); -+ range = 1UL << MINORBITS; - } - - if (register_blkdev(RAMDISK_MAJOR, "ramdisk")) -@@ -632,7 +635,7 @@ static void __exit brd_exit(void) - unsigned long range; - struct brd_device *brd, *next; - -- range = rd_nr ? rd_nr : 1UL << (MINORBITS - part_shift); -+ range = rd_nr ? rd_nr << part_shift : 1UL << MINORBITS; - - list_for_each_entry_safe(brd, next, &brd_devices, brd_list) - brd_del_one(brd); -diff --git a/drivers/block/loop.c b/drivers/block/loop.c -index a076a14..c59a672 100644 ---- a/drivers/block/loop.c -+++ b/drivers/block/loop.c -@@ -1658,7 +1658,7 @@ static struct kobject *loop_probe(dev_t dev, int *part, void *data) - struct kobject *kobj; - - mutex_lock(&loop_devices_mutex); -- lo = loop_init_one(dev & MINORMASK); -+ lo = loop_init_one(MINOR(dev) >> part_shift); - kobj = lo ? get_disk(lo->lo_disk) : ERR_PTR(-ENOMEM); - mutex_unlock(&loop_devices_mutex); - -@@ -1691,15 +1691,18 @@ static int __init loop_init(void) - if (max_part > 0) - part_shift = fls(max_part); - -+ if ((1UL << part_shift) > DISK_MAX_PARTS) -+ return -EINVAL; -+ - if (max_loop > 1UL << (MINORBITS - part_shift)) - return -EINVAL; - - if (max_loop) { - nr = max_loop; -- range = max_loop; -+ range = max_loop << part_shift; - } else { - nr = 8; -- range = 1UL << (MINORBITS - part_shift); -+ range = 1UL << MINORBITS; - } - - if (register_blkdev(LOOP_MAJOR, "loop")) -@@ -1738,7 +1741,7 @@ static void __exit loop_exit(void) - unsigned long range; - struct loop_device *lo, *next; - -- range = max_loop ? max_loop : 1UL << (MINORBITS - part_shift); -+ range = max_loop ? max_loop << part_shift : 1UL << MINORBITS; - - list_for_each_entry_safe(lo, next, &loop_devices, lo_list) - loop_del_one(lo); -diff --git a/drivers/block/paride/pcd.c b/drivers/block/paride/pcd.c -index 8690e31..46b8136 100644 ---- a/drivers/block/paride/pcd.c -+++ b/drivers/block/paride/pcd.c -@@ -320,6 +320,7 @@ static void pcd_init_units(void) - disk->first_minor = unit; - strcpy(disk->disk_name, cd->name); /* umm... */ - disk->fops = &pcd_bdops; -+ disk->flags = GENHD_FL_BLOCK_EVENTS_ON_EXCL_WRITE; - } - } - -diff --git a/drivers/cdrom/viocd.c b/drivers/cdrom/viocd.c -index e427fbe..7878da8 100644 ---- a/drivers/cdrom/viocd.c -+++ b/drivers/cdrom/viocd.c -@@ -625,7 +625,8 @@ static int viocd_probe(struct vio_dev *vdev, const struct vio_device_id *id) - blk_queue_max_hw_sectors(q, 4096 / 512); - gendisk->queue = q; - gendisk->fops = &viocd_fops; -- gendisk->flags = GENHD_FL_CD|GENHD_FL_REMOVABLE; -+ gendisk->flags = GENHD_FL_CD | GENHD_FL_REMOVABLE | -+ GENHD_FL_BLOCK_EVENTS_ON_EXCL_WRITE; - set_capacity(gendisk, 0); - gendisk->private_data = d; - d->viocd_disk = gendisk; -diff --git a/drivers/char/i8k.c b/drivers/char/i8k.c -index d72433f..ee01716 100644 ---- a/drivers/char/i8k.c -+++ b/drivers/char/i8k.c -@@ -139,8 +139,8 @@ static int i8k_smm(struct smm_regs *regs) - "movl %%edi,20(%%rax)\n\t" - "popq %%rdx\n\t" - "movl %%edx,0(%%rax)\n\t" -- "lahf\n\t" -- "shrl $8,%%eax\n\t" -+ "pushfq\n\t" -+ "popq %%rax\n\t" - "andl $1,%%eax\n" - :"=a"(rc) - : "a"(regs) -diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c -index 2dafc5c..7c10f96 100644 ---- a/drivers/cpufreq/cpufreq.c -+++ b/drivers/cpufreq/cpufreq.c -@@ -1208,12 +1208,28 @@ static int __cpufreq_remove_dev(struct sys_device *sys_dev) - cpufreq_driver->exit(data); - unlock_policy_rwsem_write(cpu); - -+ cpufreq_debug_enable_ratelimit(); -+ -+#ifdef CONFIG_HOTPLUG_CPU -+ /* when the CPU which is the parent of the kobj is hotplugged -+ * offline, check for siblings, and create cpufreq sysfs interface -+ * and symlinks -+ */ -+ if (unlikely(cpumask_weight(data->cpus) > 1)) { -+ /* first sibling now owns the new sysfs dir */ -+ cpumask_clear_cpu(cpu, data->cpus); -+ cpufreq_add_dev(get_cpu_sysdev(cpumask_first(data->cpus))); -+ -+ /* finally remove our own symlink */ -+ lock_policy_rwsem_write(cpu); -+ __cpufreq_remove_dev(sys_dev); -+ } -+#endif -+ - free_cpumask_var(data->related_cpus); - free_cpumask_var(data->cpus); - kfree(data); -- per_cpu(cpufreq_cpu_data, cpu) = NULL; - -- cpufreq_debug_enable_ratelimit(); - return 0; - } - -diff --git a/drivers/cpufreq/cpufreq_stats.c b/drivers/cpufreq/cpufreq_stats.c -index 00d73fc..4f1b8de 100644 ---- a/drivers/cpufreq/cpufreq_stats.c -+++ b/drivers/cpufreq/cpufreq_stats.c -@@ -165,17 +165,27 @@ static int freq_table_get_index(struct cpufreq_stats *stat, unsigned int freq) - return -1; - } - -+/* should be called late in the CPU removal sequence so that the stats -+ * memory is still available in case someone tries to use it. -+ */ - static void cpufreq_stats_free_table(unsigned int cpu) - { - struct cpufreq_stats *stat = per_cpu(cpufreq_stats_table, cpu); -- struct cpufreq_policy *policy = cpufreq_cpu_get(cpu); -- if (policy && policy->cpu == cpu) -- sysfs_remove_group(&policy->kobj, &stats_attr_group); - if (stat) { - kfree(stat->time_in_state); - kfree(stat); - } - per_cpu(cpufreq_stats_table, cpu) = NULL; -+} -+ -+/* must be called early in the CPU removal sequence (before -+ * cpufreq_remove_dev) so that policy is still valid. -+ */ -+static void cpufreq_stats_free_sysfs(unsigned int cpu) -+{ -+ struct cpufreq_policy *policy = cpufreq_cpu_get(cpu); -+ if (policy && policy->cpu == cpu) -+ sysfs_remove_group(&policy->kobj, &stats_attr_group); - if (policy) - cpufreq_cpu_put(policy); - } -@@ -316,6 +326,9 @@ static int __cpuinit cpufreq_stat_cpu_callback(struct notifier_block *nfb, - case CPU_ONLINE_FROZEN: - cpufreq_update_policy(cpu); - break; -+ case CPU_DOWN_PREPARE: -+ cpufreq_stats_free_sysfs(cpu); -+ break; - case CPU_DEAD: - case CPU_DEAD_FROZEN: - cpufreq_stats_free_table(cpu); -@@ -324,9 +337,11 @@ static int __cpuinit cpufreq_stat_cpu_callback(struct notifier_block *nfb, - return NOTIFY_OK; - } - -+/* priority=1 so this will get called before cpufreq_remove_dev */ - static struct notifier_block cpufreq_stat_cpu_notifier __refdata = - { - .notifier_call = cpufreq_stat_cpu_callback, -+ .priority = 1, - }; - - static struct notifier_block notifier_policy_block = { -diff --git a/drivers/cpuidle/governors/menu.c b/drivers/cpuidle/governors/menu.c -index f508690..c47f3d0 100644 ---- a/drivers/cpuidle/governors/menu.c -+++ b/drivers/cpuidle/governors/menu.c -@@ -237,6 +237,7 @@ static int menu_select(struct cpuidle_device *dev) - unsigned int power_usage = -1; - int i; - int multiplier; -+ struct timespec t; - - if (data->needs_update) { - menu_update(dev); -@@ -251,8 +252,9 @@ static int menu_select(struct cpuidle_device *dev) - return 0; - - /* determine the expected residency time, round up */ -+ t = ktime_to_timespec(tick_nohz_get_sleep_length()); - data->expected_us = -- DIV_ROUND_UP((u32)ktime_to_ns(tick_nohz_get_sleep_length()), 1000); -+ t.tv_sec * USEC_PER_SEC + t.tv_nsec / NSEC_PER_USEC; - - - data->bucket = which_bucket(data->expected_us); -diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c -index e9e6f71..c4504a2 100644 ---- a/drivers/gpu/drm/i915/intel_ringbuffer.c -+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c -@@ -666,12 +666,37 @@ gen6_ring_put_irq(struct intel_ring_buffer *ring, u32 gflag, u32 rflag) - static bool - bsd_ring_get_irq(struct intel_ring_buffer *ring) - { -- return ring_get_irq(ring, GT_BSD_USER_INTERRUPT); -+ struct drm_device *dev = ring->dev; -+ drm_i915_private_t *dev_priv = dev->dev_private; -+ -+ if (!dev->irq_enabled) -+ return false; -+ -+ spin_lock(&ring->irq_lock); -+ if (ring->irq_refcount++ == 0) { -+ if (IS_G4X(dev)) -+ i915_enable_irq(dev_priv, I915_BSD_USER_INTERRUPT); -+ else -+ ironlake_enable_irq(dev_priv, GT_BSD_USER_INTERRUPT); -+ } -+ spin_unlock(&ring->irq_lock); -+ -+ return true; - } - static void - bsd_ring_put_irq(struct intel_ring_buffer *ring) - { -- ring_put_irq(ring, GT_BSD_USER_INTERRUPT); -+ struct drm_device *dev = ring->dev; -+ drm_i915_private_t *dev_priv = dev->dev_private; -+ -+ spin_lock(&ring->irq_lock); -+ if (--ring->irq_refcount == 0) { -+ if (IS_G4X(dev)) -+ i915_disable_irq(dev_priv, I915_BSD_USER_INTERRUPT); -+ else -+ ironlake_disable_irq(dev_priv, GT_BSD_USER_INTERRUPT); -+ } -+ spin_unlock(&ring->irq_lock); - } - - static int -diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c -index 9073e3b..296e6ec 100644 ---- a/drivers/gpu/drm/radeon/evergreen.c -+++ b/drivers/gpu/drm/radeon/evergreen.c -@@ -1578,7 +1578,7 @@ static void evergreen_gpu_init(struct radeon_device *rdev) - u32 sq_stack_resource_mgmt_2; - u32 sq_stack_resource_mgmt_3; - u32 vgt_cache_invalidation; -- u32 hdp_host_path_cntl; -+ u32 hdp_host_path_cntl, tmp; - int i, j, num_shader_engines, ps_thread_count; - - switch (rdev->family) { -@@ -2141,6 +2141,10 @@ static void evergreen_gpu_init(struct radeon_device *rdev) - for (i = SQ_ALU_CONST_BUFFER_SIZE_HS_0; i < 0x29000; i += 4) - WREG32(i, 0); - -+ tmp = RREG32(HDP_MISC_CNTL); -+ tmp |= HDP_FLUSH_INVALIDATE_CACHE; -+ WREG32(HDP_MISC_CNTL, tmp); -+ - hdp_host_path_cntl = RREG32(HDP_HOST_PATH_CNTL); - WREG32(HDP_HOST_PATH_CNTL, hdp_host_path_cntl); - -diff --git a/drivers/gpu/drm/radeon/evergreend.h b/drivers/gpu/drm/radeon/evergreend.h -index fc40e0c..f37e91e 100644 ---- a/drivers/gpu/drm/radeon/evergreend.h -+++ b/drivers/gpu/drm/radeon/evergreend.h -@@ -64,6 +64,8 @@ - #define GB_BACKEND_MAP 0x98FC - #define DMIF_ADDR_CONFIG 0xBD4 - #define HDP_ADDR_CONFIG 0x2F48 -+#define HDP_MISC_CNTL 0x2F4C -+#define HDP_FLUSH_INVALIDATE_CACHE (1 << 0) - - #define CC_SYS_RB_BACKEND_DISABLE 0x3F88 - #define GC_USER_RB_BACKEND_DISABLE 0x9B7C -diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c -index 3d8a763..b205ba1 100644 ---- a/drivers/gpu/drm/radeon/ni.c -+++ b/drivers/gpu/drm/radeon/ni.c -@@ -417,7 +417,7 @@ static u32 cayman_get_tile_pipe_to_backend_map(struct radeon_device *rdev, - num_shader_engines = 1; - if (num_shader_engines > rdev->config.cayman.max_shader_engines) - num_shader_engines = rdev->config.cayman.max_shader_engines; -- if (num_backends_per_asic > num_shader_engines) -+ if (num_backends_per_asic < num_shader_engines) - num_backends_per_asic = num_shader_engines; - if (num_backends_per_asic > (rdev->config.cayman.max_backends_per_se * num_shader_engines)) - num_backends_per_asic = rdev->config.cayman.max_backends_per_se * num_shader_engines; -@@ -829,7 +829,7 @@ static void cayman_gpu_init(struct radeon_device *rdev) - rdev->config.cayman.tile_config |= - ((mc_arb_ramcfg & NOOFBANK_MASK) >> NOOFBANK_SHIFT) << 4; - rdev->config.cayman.tile_config |= -- (gb_addr_config & PIPE_INTERLEAVE_SIZE_MASK) >> PIPE_INTERLEAVE_SIZE_SHIFT; -+ ((gb_addr_config & PIPE_INTERLEAVE_SIZE_MASK) >> PIPE_INTERLEAVE_SIZE_SHIFT) << 8; - rdev->config.cayman.tile_config |= - ((gb_addr_config & ROW_SIZE_MASK) >> ROW_SIZE_SHIFT) << 12; - -@@ -931,6 +931,10 @@ static void cayman_gpu_init(struct radeon_device *rdev) - WREG32(CB_PERF_CTR3_SEL_0, 0); - WREG32(CB_PERF_CTR3_SEL_1, 0); - -+ tmp = RREG32(HDP_MISC_CNTL); -+ tmp |= HDP_FLUSH_INVALIDATE_CACHE; -+ WREG32(HDP_MISC_CNTL, tmp); -+ - hdp_host_path_cntl = RREG32(HDP_HOST_PATH_CNTL); - WREG32(HDP_HOST_PATH_CNTL, hdp_host_path_cntl); - -diff --git a/drivers/gpu/drm/radeon/nid.h b/drivers/gpu/drm/radeon/nid.h -index 0f9a08b..b2088c1 100644 ---- a/drivers/gpu/drm/radeon/nid.h -+++ b/drivers/gpu/drm/radeon/nid.h -@@ -136,6 +136,8 @@ - #define HDP_NONSURFACE_INFO 0x2C08 - #define HDP_NONSURFACE_SIZE 0x2C0C - #define HDP_ADDR_CONFIG 0x2F48 -+#define HDP_MISC_CNTL 0x2F4C -+#define HDP_FLUSH_INVALIDATE_CACHE (1 << 0) - - #define CC_SYS_RB_BACKEND_DISABLE 0x3F88 - #define GC_USER_SYS_RB_BACKEND_DISABLE 0x3F8C -diff --git a/drivers/gpu/drm/radeon/radeon_asic.c b/drivers/gpu/drm/radeon/radeon_asic.c -index ca57619..d948265 100644 ---- a/drivers/gpu/drm/radeon/radeon_asic.c -+++ b/drivers/gpu/drm/radeon/radeon_asic.c -@@ -782,6 +782,7 @@ static struct radeon_asic evergreen_asic = { - .hpd_fini = &evergreen_hpd_fini, - .hpd_sense = &evergreen_hpd_sense, - .hpd_set_polarity = &evergreen_hpd_set_polarity, -+ .ioctl_wait_idle = r600_ioctl_wait_idle, - .gui_idle = &r600_gui_idle, - .pm_misc = &evergreen_pm_misc, - .pm_prepare = &evergreen_pm_prepare, -@@ -828,6 +829,7 @@ static struct radeon_asic sumo_asic = { - .hpd_fini = &evergreen_hpd_fini, - .hpd_sense = &evergreen_hpd_sense, - .hpd_set_polarity = &evergreen_hpd_set_polarity, -+ .ioctl_wait_idle = r600_ioctl_wait_idle, - .gui_idle = &r600_gui_idle, - .pm_misc = &evergreen_pm_misc, - .pm_prepare = &evergreen_pm_prepare, -@@ -874,6 +876,7 @@ static struct radeon_asic btc_asic = { - .hpd_fini = &evergreen_hpd_fini, - .hpd_sense = &evergreen_hpd_sense, - .hpd_set_polarity = &evergreen_hpd_set_polarity, -+ .ioctl_wait_idle = r600_ioctl_wait_idle, - .gui_idle = &r600_gui_idle, - .pm_misc = &evergreen_pm_misc, - .pm_prepare = &evergreen_pm_prepare, -@@ -920,6 +923,7 @@ static struct radeon_asic cayman_asic = { - .hpd_fini = &evergreen_hpd_fini, - .hpd_sense = &evergreen_hpd_sense, - .hpd_set_polarity = &evergreen_hpd_set_polarity, -+ .ioctl_wait_idle = r600_ioctl_wait_idle, - .gui_idle = &r600_gui_idle, - .pm_misc = &evergreen_pm_misc, - .pm_prepare = &evergreen_pm_prepare, -diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c -index 0ec91c1..a5eda4c 100644 ---- a/drivers/hid/hid-magicmouse.c -+++ b/drivers/hid/hid-magicmouse.c -@@ -501,9 +501,17 @@ static int magicmouse_probe(struct hid_device *hdev, - } - report->size = 6; - -+ /* -+ * The device reponds with 'invalid report id' when feature -+ * report switching it into multitouch mode is sent to it. -+ * -+ * This results in -EIO from the _raw low-level transport callback, -+ * but there seems to be no other way of switching the mode. -+ * Thus the super-ugly hacky success check below. -+ */ - ret = hdev->hid_output_raw_report(hdev, feature, sizeof(feature), - HID_FEATURE_REPORT); -- if (ret != sizeof(feature)) { -+ if (ret != -EIO) { - hid_err(hdev, "unable to request touch data (%d)\n", ret); - goto err_stop_hw; - } -diff --git a/drivers/hwmon/pmbus_core.c b/drivers/hwmon/pmbus_core.c -index 196ffaf..7df490e 100644 ---- a/drivers/hwmon/pmbus_core.c -+++ b/drivers/hwmon/pmbus_core.c -@@ -700,6 +700,7 @@ do { \ - struct sensor_device_attribute *a \ - = &data->_type##s[data->num_##_type##s].attribute; \ - BUG_ON(data->num_attributes >= data->max_attributes); \ -+ sysfs_attr_init(&a->dev_attr.attr); \ - a->dev_attr.attr.name = _name; \ - a->dev_attr.attr.mode = _mode; \ - a->dev_attr.show = _show; \ -diff --git a/drivers/i2c/busses/i2c-tegra.c b/drivers/i2c/busses/i2c-tegra.c -index b4ab39b..5f1b92c 100644 ---- a/drivers/i2c/busses/i2c-tegra.c -+++ b/drivers/i2c/busses/i2c-tegra.c -@@ -330,6 +330,11 @@ static int tegra_i2c_init(struct tegra_i2c_dev *i2c_dev) - i2c_writel(i2c_dev, 0, I2C_INT_MASK); - clk_set_rate(i2c_dev->clk, i2c_dev->bus_clk_rate * 8); - -+ if (!i2c_dev->is_dvc) { -+ u32 sl_cfg = i2c_readl(i2c_dev, I2C_SL_CNFG); -+ i2c_writel(i2c_dev, sl_cfg | I2C_SL_CNFG_NEWSL, I2C_SL_CNFG); -+ } -+ - val = 7 << I2C_FIFO_CONTROL_TX_TRIG_SHIFT | - 0 << I2C_FIFO_CONTROL_RX_TRIG_SHIFT; - i2c_writel(i2c_dev, val, I2C_FIFO_CONTROL); -diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c -index a5ec5a7..9560822 100644 ---- a/drivers/ide/ide-cd.c -+++ b/drivers/ide/ide-cd.c -@@ -1773,7 +1773,8 @@ static int ide_cd_probe(ide_drive_t *drive) - - g->minors = 1; - g->driverfs_dev = &drive->gendev; -- g->flags = GENHD_FL_CD | GENHD_FL_REMOVABLE; -+ g->flags = GENHD_FL_CD | GENHD_FL_REMOVABLE | -+ GENHD_FL_BLOCK_EVENTS_ON_EXCL_WRITE; - if (ide_cdrom_setup(drive)) { - put_device(&info->dev); - goto failed; -diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c -index 5c93627..70bd738 100644 ---- a/drivers/md/bitmap.c -+++ b/drivers/md/bitmap.c -@@ -493,11 +493,11 @@ void bitmap_update_sb(struct bitmap *bitmap) - spin_unlock_irqrestore(&bitmap->lock, flags); - sb = kmap_atomic(bitmap->sb_page, KM_USER0); - sb->events = cpu_to_le64(bitmap->mddev->events); -- if (bitmap->mddev->events < bitmap->events_cleared) { -+ if (bitmap->mddev->events < bitmap->events_cleared) - /* rocking back to read-only */ - bitmap->events_cleared = bitmap->mddev->events; -- sb->events_cleared = cpu_to_le64(bitmap->events_cleared); -- } -+ sb->events_cleared = cpu_to_le64(bitmap->events_cleared); -+ sb->state = cpu_to_le32(bitmap->flags); - /* Just in case these have been changed via sysfs: */ - sb->daemon_sleep = cpu_to_le32(bitmap->mddev->bitmap_info.daemon_sleep/HZ); - sb->write_behind = cpu_to_le32(bitmap->mddev->bitmap_info.max_write_behind); -@@ -618,7 +618,7 @@ success: - if (le32_to_cpu(sb->version) == BITMAP_MAJOR_HOSTENDIAN) - bitmap->flags |= BITMAP_HOSTENDIAN; - bitmap->events_cleared = le64_to_cpu(sb->events_cleared); -- if (sb->state & cpu_to_le32(BITMAP_STALE)) -+ if (bitmap->flags & BITMAP_STALE) - bitmap->events_cleared = bitmap->mddev->events; - err = 0; - out: -@@ -652,9 +652,11 @@ static int bitmap_mask_state(struct bitmap *bitmap, enum bitmap_state bits, - switch (op) { - case MASK_SET: - sb->state |= cpu_to_le32(bits); -+ bitmap->flags |= bits; - break; - case MASK_UNSET: - sb->state &= cpu_to_le32(~bits); -+ bitmap->flags &= ~bits; - break; - default: - BUG(); -diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c -index a550a05..aa4e570 100644 ---- a/drivers/md/dm-mpath.c -+++ b/drivers/md/dm-mpath.c -@@ -1290,7 +1290,7 @@ static int do_end_io(struct multipath *m, struct request *clone, - if (!error && !clone->errors) - return 0; /* I/O complete */ - -- if (error == -EOPNOTSUPP || error == -EREMOTEIO) -+ if (error == -EOPNOTSUPP || error == -EREMOTEIO || error == -EILSEQ) - return error; - - if (mpio->pgpath) -diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c -index cb8380c..53e603b 100644 ---- a/drivers/md/dm-table.c -+++ b/drivers/md/dm-table.c -@@ -362,6 +362,7 @@ static void close_dev(struct dm_dev_internal *d, struct mapped_device *md) - static int device_area_is_invalid(struct dm_target *ti, struct dm_dev *dev, - sector_t start, sector_t len, void *data) - { -+ struct request_queue *q; - struct queue_limits *limits = data; - struct block_device *bdev = dev->bdev; - sector_t dev_size = -@@ -370,6 +371,22 @@ static int device_area_is_invalid(struct dm_target *ti, struct dm_dev *dev, - limits->logical_block_size >> SECTOR_SHIFT; - char b[BDEVNAME_SIZE]; - -+ /* -+ * Some devices exist without request functions, -+ * such as loop devices not yet bound to backing files. -+ * Forbid the use of such devices. -+ */ -+ q = bdev_get_queue(bdev); -+ if (!q || !q->make_request_fn) { -+ DMWARN("%s: %s is not yet initialised: " -+ "start=%llu, len=%llu, dev_size=%llu", -+ dm_device_name(ti->table->md), bdevname(bdev, b), -+ (unsigned long long)start, -+ (unsigned long long)len, -+ (unsigned long long)dev_size); -+ return 1; -+ } -+ - if (!dev_size) - return 0; - -diff --git a/drivers/md/md.c b/drivers/md/md.c -index 7d6f7f1..4a4c0f8 100644 ---- a/drivers/md/md.c -+++ b/drivers/md/md.c -@@ -4347,13 +4347,19 @@ static int md_alloc(dev_t dev, char *name) - disk->fops = &md_fops; - disk->private_data = mddev; - disk->queue = mddev->queue; -+ blk_queue_flush(mddev->queue, REQ_FLUSH | REQ_FUA); - /* Allow extended partitions. This makes the - * 'mdp' device redundant, but we can't really - * remove it now. - */ - disk->flags |= GENHD_FL_EXT_DEVT; -- add_disk(disk); - mddev->gendisk = disk; -+ /* As soon as we call add_disk(), another thread could get -+ * through to md_open, so make sure it doesn't get too far -+ */ -+ mutex_lock(&mddev->open_mutex); -+ add_disk(disk); -+ - error = kobject_init_and_add(&mddev->kobj, &md_ktype, - &disk_to_dev(disk)->kobj, "%s", "md"); - if (error) { -@@ -4367,8 +4373,7 @@ static int md_alloc(dev_t dev, char *name) - if (mddev->kobj.sd && - sysfs_create_group(&mddev->kobj, &md_bitmap_group)) - printk(KERN_DEBUG "pointless warning\n"); -- -- blk_queue_flush(mddev->queue, REQ_FLUSH | REQ_FUA); -+ mutex_unlock(&mddev->open_mutex); - abort: - mutex_unlock(&disks_mutex); - if (!error && mddev->kobj.sd) { -diff --git a/drivers/media/dvb/frontends/dib0070.c b/drivers/media/dvb/frontends/dib0070.c -index d4e466a..1d47d4d 100644 ---- a/drivers/media/dvb/frontends/dib0070.c -+++ b/drivers/media/dvb/frontends/dib0070.c -@@ -73,27 +73,47 @@ struct dib0070_state { - - u8 wbd_gain_current; - u16 wbd_offset_3_3[2]; -+ -+ /* for the I2C transfer */ -+ struct i2c_msg msg[2]; -+ u8 i2c_write_buffer[3]; -+ u8 i2c_read_buffer[2]; - }; - - static uint16_t dib0070_read_reg(struct dib0070_state *state, u8 reg) - { -- u8 b[2]; -- struct i2c_msg msg[2] = { -- { .addr = state->cfg->i2c_address, .flags = 0, .buf = ®, .len = 1 }, -- { .addr = state->cfg->i2c_address, .flags = I2C_M_RD, .buf = b, .len = 2 }, -- }; -- if (i2c_transfer(state->i2c, msg, 2) != 2) { -+ state->i2c_write_buffer[0] = reg; -+ -+ memset(state->msg, 0, 2 * sizeof(struct i2c_msg)); -+ state->msg[0].addr = state->cfg->i2c_address; -+ state->msg[0].flags = 0; -+ state->msg[0].buf = state->i2c_write_buffer; -+ state->msg[0].len = 1; -+ state->msg[1].addr = state->cfg->i2c_address; -+ state->msg[1].flags = I2C_M_RD; -+ state->msg[1].buf = state->i2c_read_buffer; -+ state->msg[1].len = 2; -+ -+ if (i2c_transfer(state->i2c, state->msg, 2) != 2) { - printk(KERN_WARNING "DiB0070 I2C read failed\n"); - return 0; - } -- return (b[0] << 8) | b[1]; -+ return (state->i2c_read_buffer[0] << 8) | state->i2c_read_buffer[1]; - } - - static int dib0070_write_reg(struct dib0070_state *state, u8 reg, u16 val) - { -- u8 b[3] = { reg, val >> 8, val & 0xff }; -- struct i2c_msg msg = { .addr = state->cfg->i2c_address, .flags = 0, .buf = b, .len = 3 }; -- if (i2c_transfer(state->i2c, &msg, 1) != 1) { -+ state->i2c_write_buffer[0] = reg; -+ state->i2c_write_buffer[1] = val >> 8; -+ state->i2c_write_buffer[2] = val & 0xff; -+ -+ memset(state->msg, 0, sizeof(struct i2c_msg)); -+ state->msg[0].addr = state->cfg->i2c_address; -+ state->msg[0].flags = 0; -+ state->msg[0].buf = state->i2c_write_buffer; -+ state->msg[0].len = 3; -+ -+ if (i2c_transfer(state->i2c, state->msg, 1) != 1) { - printk(KERN_WARNING "DiB0070 I2C write failed\n"); - return -EREMOTEIO; - } -diff --git a/drivers/media/dvb/frontends/dib0090.c b/drivers/media/dvb/frontends/dib0090.c -index 52ff1a2..c9c935a 100644 ---- a/drivers/media/dvb/frontends/dib0090.c -+++ b/drivers/media/dvb/frontends/dib0090.c -@@ -191,6 +191,11 @@ struct dib0090_state { - u8 wbd_calibration_gain; - const struct dib0090_wbd_slope *current_wbd_table; - u16 wbdmux; -+ -+ /* for the I2C transfer */ -+ struct i2c_msg msg[2]; -+ u8 i2c_write_buffer[3]; -+ u8 i2c_read_buffer[2]; - }; - - struct dib0090_fw_state { -@@ -198,27 +203,48 @@ struct dib0090_fw_state { - struct dvb_frontend *fe; - struct dib0090_identity identity; - const struct dib0090_config *config; -+ -+ /* for the I2C transfer */ -+ struct i2c_msg msg; -+ u8 i2c_write_buffer[2]; -+ u8 i2c_read_buffer[2]; - }; - - static u16 dib0090_read_reg(struct dib0090_state *state, u8 reg) - { -- u8 b[2]; -- struct i2c_msg msg[2] = { -- {.addr = state->config->i2c_address, .flags = 0, .buf = ®, .len = 1}, -- {.addr = state->config->i2c_address, .flags = I2C_M_RD, .buf = b, .len = 2}, -- }; -- if (i2c_transfer(state->i2c, msg, 2) != 2) { -+ state->i2c_write_buffer[0] = reg; -+ -+ memset(state->msg, 0, 2 * sizeof(struct i2c_msg)); -+ state->msg[0].addr = state->config->i2c_address; -+ state->msg[0].flags = 0; -+ state->msg[0].buf = state->i2c_write_buffer; -+ state->msg[0].len = 1; -+ state->msg[1].addr = state->config->i2c_address; -+ state->msg[1].flags = I2C_M_RD; -+ state->msg[1].buf = state->i2c_read_buffer; -+ state->msg[1].len = 2; -+ -+ if (i2c_transfer(state->i2c, state->msg, 2) != 2) { - printk(KERN_WARNING "DiB0090 I2C read failed\n"); - return 0; - } -- return (b[0] << 8) | b[1]; -+ -+ return (state->i2c_read_buffer[0] << 8) | state->i2c_read_buffer[1]; - } - - static int dib0090_write_reg(struct dib0090_state *state, u32 reg, u16 val) - { -- u8 b[3] = { reg & 0xff, val >> 8, val & 0xff }; -- struct i2c_msg msg = {.addr = state->config->i2c_address, .flags = 0, .buf = b, .len = 3 }; -- if (i2c_transfer(state->i2c, &msg, 1) != 1) { -+ state->i2c_write_buffer[0] = reg & 0xff; -+ state->i2c_write_buffer[1] = val >> 8; -+ state->i2c_write_buffer[2] = val & 0xff; -+ -+ memset(state->msg, 0, sizeof(struct i2c_msg)); -+ state->msg[0].addr = state->config->i2c_address; -+ state->msg[0].flags = 0; -+ state->msg[0].buf = state->i2c_write_buffer; -+ state->msg[0].len = 3; -+ -+ if (i2c_transfer(state->i2c, state->msg, 1) != 1) { - printk(KERN_WARNING "DiB0090 I2C write failed\n"); - return -EREMOTEIO; - } -@@ -227,20 +253,31 @@ static int dib0090_write_reg(struct dib0090_state *state, u32 reg, u16 val) - - static u16 dib0090_fw_read_reg(struct dib0090_fw_state *state, u8 reg) - { -- u8 b[2]; -- struct i2c_msg msg = {.addr = reg, .flags = I2C_M_RD, .buf = b, .len = 2 }; -- if (i2c_transfer(state->i2c, &msg, 1) != 1) { -+ state->i2c_write_buffer[0] = reg; -+ -+ memset(&state->msg, 0, sizeof(struct i2c_msg)); -+ state->msg.addr = reg; -+ state->msg.flags = I2C_M_RD; -+ state->msg.buf = state->i2c_read_buffer; -+ state->msg.len = 2; -+ if (i2c_transfer(state->i2c, &state->msg, 1) != 1) { - printk(KERN_WARNING "DiB0090 I2C read failed\n"); - return 0; - } -- return (b[0] << 8) | b[1]; -+ return (state->i2c_read_buffer[0] << 8) | state->i2c_read_buffer[1]; - } - - static int dib0090_fw_write_reg(struct dib0090_fw_state *state, u8 reg, u16 val) - { -- u8 b[2] = { val >> 8, val & 0xff }; -- struct i2c_msg msg = {.addr = reg, .flags = 0, .buf = b, .len = 2 }; -- if (i2c_transfer(state->i2c, &msg, 1) != 1) { -+ state->i2c_write_buffer[0] = val >> 8; -+ state->i2c_write_buffer[1] = val & 0xff; -+ -+ memset(&state->msg, 0, sizeof(struct i2c_msg)); -+ state->msg.addr = reg; -+ state->msg.flags = 0; -+ state->msg.buf = state->i2c_write_buffer; -+ state->msg.len = 2; -+ if (i2c_transfer(state->i2c, &state->msg, 1) != 1) { - printk(KERN_WARNING "DiB0090 I2C write failed\n"); - return -EREMOTEIO; - } -diff --git a/drivers/media/dvb/frontends/dib7000m.c b/drivers/media/dvb/frontends/dib7000m.c -index 289a798..79cb1c2 100644 ---- a/drivers/media/dvb/frontends/dib7000m.c -+++ b/drivers/media/dvb/frontends/dib7000m.c -@@ -50,6 +50,11 @@ struct dib7000m_state { - u16 revision; - - u8 agc_state; -+ -+ /* for the I2C transfer */ -+ struct i2c_msg msg[2]; -+ u8 i2c_write_buffer[4]; -+ u8 i2c_read_buffer[2]; - }; - - enum dib7000m_power_mode { -@@ -64,29 +69,39 @@ enum dib7000m_power_mode { - - static u16 dib7000m_read_word(struct dib7000m_state *state, u16 reg) - { -- u8 wb[2] = { (reg >> 8) | 0x80, reg & 0xff }; -- u8 rb[2]; -- struct i2c_msg msg[2] = { -- { .addr = state->i2c_addr >> 1, .flags = 0, .buf = wb, .len = 2 }, -- { .addr = state->i2c_addr >> 1, .flags = I2C_M_RD, .buf = rb, .len = 2 }, -- }; -- -- if (i2c_transfer(state->i2c_adap, msg, 2) != 2) -+ state->i2c_write_buffer[0] = (reg >> 8) | 0x80; -+ state->i2c_write_buffer[1] = reg & 0xff; -+ -+ memset(state->msg, 0, 2 * sizeof(struct i2c_msg)); -+ state->msg[0].addr = state->i2c_addr >> 1; -+ state->msg[0].flags = 0; -+ state->msg[0].buf = state->i2c_write_buffer; -+ state->msg[0].len = 2; -+ state->msg[1].addr = state->i2c_addr >> 1; -+ state->msg[1].flags = I2C_M_RD; -+ state->msg[1].buf = state->i2c_read_buffer; -+ state->msg[1].len = 2; -+ -+ if (i2c_transfer(state->i2c_adap, state->msg, 2) != 2) - dprintk("i2c read error on %d",reg); - -- return (rb[0] << 8) | rb[1]; -+ return (state->i2c_read_buffer[0] << 8) | state->i2c_read_buffer[1]; - } - - static int dib7000m_write_word(struct dib7000m_state *state, u16 reg, u16 val) - { -- u8 b[4] = { -- (reg >> 8) & 0xff, reg & 0xff, -- (val >> 8) & 0xff, val & 0xff, -- }; -- struct i2c_msg msg = { -- .addr = state->i2c_addr >> 1, .flags = 0, .buf = b, .len = 4 -- }; -- return i2c_transfer(state->i2c_adap, &msg, 1) != 1 ? -EREMOTEIO : 0; -+ state->i2c_write_buffer[0] = (reg >> 8) & 0xff; -+ state->i2c_write_buffer[1] = reg & 0xff; -+ state->i2c_write_buffer[2] = (val >> 8) & 0xff; -+ state->i2c_write_buffer[3] = val & 0xff; -+ -+ memset(&state->msg[0], 0, sizeof(struct i2c_msg)); -+ state->msg[0].addr = state->i2c_addr >> 1; -+ state->msg[0].flags = 0; -+ state->msg[0].buf = state->i2c_write_buffer; -+ state->msg[0].len = 4; -+ -+ return i2c_transfer(state->i2c_adap, state->msg, 1) != 1 ? -EREMOTEIO : 0; - } - static void dib7000m_write_tab(struct dib7000m_state *state, u16 *buf) - { -diff --git a/drivers/media/dvb/frontends/dib7000p.c b/drivers/media/dvb/frontends/dib7000p.c -index 900af60..0c9f40c 100644 ---- a/drivers/media/dvb/frontends/dib7000p.c -+++ b/drivers/media/dvb/frontends/dib7000p.c -@@ -63,6 +63,11 @@ struct dib7000p_state { - - u16 tuner_enable; - struct i2c_adapter dib7090_tuner_adap; -+ -+ /* for the I2C transfer */ -+ struct i2c_msg msg[2]; -+ u8 i2c_write_buffer[4]; -+ u8 i2c_read_buffer[2]; - }; - - enum dib7000p_power_mode { -@@ -76,29 +81,39 @@ static int dib7090_set_diversity_in(struct dvb_frontend *fe, int onoff); - - static u16 dib7000p_read_word(struct dib7000p_state *state, u16 reg) - { -- u8 wb[2] = { reg >> 8, reg & 0xff }; -- u8 rb[2]; -- struct i2c_msg msg[2] = { -- {.addr = state->i2c_addr >> 1, .flags = 0, .buf = wb, .len = 2}, -- {.addr = state->i2c_addr >> 1, .flags = I2C_M_RD, .buf = rb, .len = 2}, -- }; -+ state->i2c_write_buffer[0] = reg >> 8; -+ state->i2c_write_buffer[1] = reg & 0xff; -+ -+ memset(state->msg, 0, 2 * sizeof(struct i2c_msg)); -+ state->msg[0].addr = state->i2c_addr >> 1; -+ state->msg[0].flags = 0; -+ state->msg[0].buf = state->i2c_write_buffer; -+ state->msg[0].len = 2; -+ state->msg[1].addr = state->i2c_addr >> 1; -+ state->msg[1].flags = I2C_M_RD; -+ state->msg[1].buf = state->i2c_read_buffer; -+ state->msg[1].len = 2; - -- if (i2c_transfer(state->i2c_adap, msg, 2) != 2) -+ if (i2c_transfer(state->i2c_adap, state->msg, 2) != 2) - dprintk("i2c read error on %d", reg); - -- return (rb[0] << 8) | rb[1]; -+ return (state->i2c_read_buffer[0] << 8) | state->i2c_read_buffer[1]; - } - - static int dib7000p_write_word(struct dib7000p_state *state, u16 reg, u16 val) - { -- u8 b[4] = { -- (reg >> 8) & 0xff, reg & 0xff, -- (val >> 8) & 0xff, val & 0xff, -- }; -- struct i2c_msg msg = { -- .addr = state->i2c_addr >> 1, .flags = 0, .buf = b, .len = 4 -- }; -- return i2c_transfer(state->i2c_adap, &msg, 1) != 1 ? -EREMOTEIO : 0; -+ state->i2c_write_buffer[0] = (reg >> 8) & 0xff; -+ state->i2c_write_buffer[1] = reg & 0xff; -+ state->i2c_write_buffer[2] = (val >> 8) & 0xff; -+ state->i2c_write_buffer[3] = val & 0xff; -+ -+ memset(&state->msg[0], 0, sizeof(struct i2c_msg)); -+ state->msg[0].addr = state->i2c_addr >> 1; -+ state->msg[0].flags = 0; -+ state->msg[0].buf = state->i2c_write_buffer; -+ state->msg[0].len = 4; -+ -+ return i2c_transfer(state->i2c_adap, state->msg, 1) != 1 ? -EREMOTEIO : 0; - } - - static void dib7000p_write_tab(struct dib7000p_state *state, u16 * buf) -@@ -1550,11 +1565,24 @@ static void dib7000p_release(struct dvb_frontend *demod) - - int dib7000pc_detection(struct i2c_adapter *i2c_adap) - { -- u8 tx[2], rx[2]; -+ u8 *tx, *rx; - struct i2c_msg msg[2] = { -- {.addr = 18 >> 1, .flags = 0, .buf = tx, .len = 2}, -- {.addr = 18 >> 1, .flags = I2C_M_RD, .buf = rx, .len = 2}, -+ {.addr = 18 >> 1, .flags = 0, .len = 2}, -+ {.addr = 18 >> 1, .flags = I2C_M_RD, .len = 2}, - }; -+ int ret = 0; -+ -+ tx = kzalloc(2*sizeof(u8), GFP_KERNEL); -+ if (!tx) -+ return -ENOMEM; -+ rx = kzalloc(2*sizeof(u8), GFP_KERNEL); -+ if (!rx) { -+ goto rx_memory_error; -+ ret = -ENOMEM; -+ } -+ -+ msg[0].buf = tx; -+ msg[1].buf = rx; - - tx[0] = 0x03; - tx[1] = 0x00; -@@ -1574,7 +1602,11 @@ int dib7000pc_detection(struct i2c_adapter *i2c_adap) - } - - dprintk("-D- DiB7000PC not detected"); -- return 0; -+ -+ kfree(rx); -+rx_memory_error: -+ kfree(tx); -+ return ret; - } - EXPORT_SYMBOL(dib7000pc_detection); - -diff --git a/drivers/media/dvb/frontends/dib8000.c b/drivers/media/dvb/frontends/dib8000.c -index c1c3e26..7d2ea11 100644 ---- a/drivers/media/dvb/frontends/dib8000.c -+++ b/drivers/media/dvb/frontends/dib8000.c -@@ -35,6 +35,8 @@ MODULE_PARM_DESC(debug, "turn on debugging (default: 0)"); - struct i2c_device { - struct i2c_adapter *adap; - u8 addr; -+ u8 *i2c_write_buffer; -+ u8 *i2c_read_buffer; - }; - - struct dib8000_state { -@@ -70,6 +72,11 @@ struct dib8000_state { - u32 status; - - struct dvb_frontend *fe[MAX_NUMBER_OF_FRONTENDS]; -+ -+ /* for the I2C transfer */ -+ struct i2c_msg msg[2]; -+ u8 i2c_write_buffer[4]; -+ u8 i2c_read_buffer[2]; - }; - - enum dib8000_power_mode { -@@ -79,22 +86,41 @@ enum dib8000_power_mode { - - static u16 dib8000_i2c_read16(struct i2c_device *i2c, u16 reg) - { -- u8 wb[2] = { reg >> 8, reg & 0xff }; -- u8 rb[2]; - struct i2c_msg msg[2] = { -- {.addr = i2c->addr >> 1,.flags = 0,.buf = wb,.len = 2}, -- {.addr = i2c->addr >> 1,.flags = I2C_M_RD,.buf = rb,.len = 2}, -+ {.addr = i2c->addr >> 1, .flags = 0, -+ .buf = i2c->i2c_write_buffer, .len = 2}, -+ {.addr = i2c->addr >> 1, .flags = I2C_M_RD, -+ .buf = i2c->i2c_read_buffer, .len = 2}, - }; - -+ msg[0].buf[0] = reg >> 8; -+ msg[0].buf[1] = reg & 0xff; -+ - if (i2c_transfer(i2c->adap, msg, 2) != 2) - dprintk("i2c read error on %d", reg); - -- return (rb[0] << 8) | rb[1]; -+ return (msg[1].buf[0] << 8) | msg[1].buf[1]; - } - - static u16 dib8000_read_word(struct dib8000_state *state, u16 reg) - { -- return dib8000_i2c_read16(&state->i2c, reg); -+ state->i2c_write_buffer[0] = reg >> 8; -+ state->i2c_write_buffer[1] = reg & 0xff; -+ -+ memset(state->msg, 0, 2 * sizeof(struct i2c_msg)); -+ state->msg[0].addr = state->i2c.addr >> 1; -+ state->msg[0].flags = 0; -+ state->msg[0].buf = state->i2c_write_buffer; -+ state->msg[0].len = 2; -+ state->msg[1].addr = state->i2c.addr >> 1; -+ state->msg[1].flags = I2C_M_RD; -+ state->msg[1].buf = state->i2c_read_buffer; -+ state->msg[1].len = 2; -+ -+ if (i2c_transfer(state->i2c.adap, state->msg, 2) != 2) -+ dprintk("i2c read error on %d", reg); -+ -+ return (state->i2c_read_buffer[0] << 8) | state->i2c_read_buffer[1]; - } - - static u32 dib8000_read32(struct dib8000_state *state, u16 reg) -@@ -109,19 +135,34 @@ static u32 dib8000_read32(struct dib8000_state *state, u16 reg) - - static int dib8000_i2c_write16(struct i2c_device *i2c, u16 reg, u16 val) - { -- u8 b[4] = { -- (reg >> 8) & 0xff, reg & 0xff, -- (val >> 8) & 0xff, val & 0xff, -- }; -- struct i2c_msg msg = { -- .addr = i2c->addr >> 1,.flags = 0,.buf = b,.len = 4 -- }; -- return i2c_transfer(i2c->adap, &msg, 1) != 1 ? -EREMOTEIO : 0; -+ struct i2c_msg msg = {.addr = i2c->addr >> 1, .flags = 0, -+ .buf = i2c->i2c_write_buffer, .len = 4}; -+ int ret = 0; -+ -+ msg.buf[0] = (reg >> 8) & 0xff; -+ msg.buf[1] = reg & 0xff; -+ msg.buf[2] = (val >> 8) & 0xff; -+ msg.buf[3] = val & 0xff; -+ -+ ret = i2c_transfer(i2c->adap, &msg, 1) != 1 ? -EREMOTEIO : 0; -+ -+ return ret; - } - - static int dib8000_write_word(struct dib8000_state *state, u16 reg, u16 val) - { -- return dib8000_i2c_write16(&state->i2c, reg, val); -+ state->i2c_write_buffer[0] = (reg >> 8) & 0xff; -+ state->i2c_write_buffer[1] = reg & 0xff; -+ state->i2c_write_buffer[2] = (val >> 8) & 0xff; -+ state->i2c_write_buffer[3] = val & 0xff; -+ -+ memset(&state->msg[0], 0, sizeof(struct i2c_msg)); -+ state->msg[0].addr = state->i2c.addr >> 1; -+ state->msg[0].flags = 0; -+ state->msg[0].buf = state->i2c_write_buffer; -+ state->msg[0].len = 4; -+ -+ return i2c_transfer(state->i2c.adap, state->msg, 1) != 1 ? -EREMOTEIO : 0; - } - - static const s16 coeff_2k_sb_1seg_dqpsk[8] = { -@@ -980,30 +1021,31 @@ static void dib8000_update_timf(struct dib8000_state *state) - dprintk("Updated timing frequency: %d (default: %d)", state->timf, state->timf_default); - } - -+static const u16 adc_target_16dB[11] = { -+ (1 << 13) - 825 - 117, -+ (1 << 13) - 837 - 117, -+ (1 << 13) - 811 - 117, -+ (1 << 13) - 766 - 117, -+ (1 << 13) - 737 - 117, -+ (1 << 13) - 693 - 117, -+ (1 << 13) - 648 - 117, -+ (1 << 13) - 619 - 117, -+ (1 << 13) - 575 - 117, -+ (1 << 13) - 531 - 117, -+ (1 << 13) - 501 - 117 -+}; -+static const u8 permu_seg[] = { 6, 5, 7, 4, 8, 3, 9, 2, 10, 1, 11, 0, 12 }; -+ - static void dib8000_set_channel(struct dib8000_state *state, u8 seq, u8 autosearching) - { - u16 mode, max_constellation, seg_diff_mask = 0, nbseg_diff = 0; - u8 guard, crate, constellation, timeI; -- u8 permu_seg[] = { 6, 5, 7, 4, 8, 3, 9, 2, 10, 1, 11, 0, 12 }; - u16 i, coeff[4], P_cfr_left_edge = 0, P_cfr_right_edge = 0, seg_mask13 = 0x1fff; // All 13 segments enabled - const s16 *ncoeff = NULL, *ana_fe; - u16 tmcc_pow = 0; - u16 coff_pow = 0x2800; - u16 init_prbs = 0xfff; - u16 ana_gain = 0; -- u16 adc_target_16dB[11] = { -- (1 << 13) - 825 - 117, -- (1 << 13) - 837 - 117, -- (1 << 13) - 811 - 117, -- (1 << 13) - 766 - 117, -- (1 << 13) - 737 - 117, -- (1 << 13) - 693 - 117, -- (1 << 13) - 648 - 117, -- (1 << 13) - 619 - 117, -- (1 << 13) - 575 - 117, -- (1 << 13) - 531 - 117, -- (1 << 13) - 501 - 117 -- }; - - if (state->ber_monitored_layer != LAYER_ALL) - dib8000_write_word(state, 285, (dib8000_read_word(state, 285) & 0x60) | state->ber_monitored_layer); -@@ -2379,10 +2421,22 @@ EXPORT_SYMBOL(dib8000_get_slave_frontend); - - int dib8000_i2c_enumeration(struct i2c_adapter *host, int no_of_demods, u8 default_addr, u8 first_addr) - { -- int k = 0; -+ int k = 0, ret = 0; - u8 new_addr = 0; - struct i2c_device client = {.adap = host }; - -+ client.i2c_write_buffer = kzalloc(4 * sizeof(u8), GFP_KERNEL); -+ if (!client.i2c_write_buffer) { -+ dprintk("%s: not enough memory", __func__); -+ return -ENOMEM; -+ } -+ client.i2c_read_buffer = kzalloc(4 * sizeof(u8), GFP_KERNEL); -+ if (!client.i2c_read_buffer) { -+ dprintk("%s: not enough memory", __func__); -+ ret = -ENOMEM; -+ goto error_memory; -+ } -+ - for (k = no_of_demods - 1; k >= 0; k--) { - /* designated i2c address */ - new_addr = first_addr + (k << 1); -@@ -2394,7 +2448,8 @@ int dib8000_i2c_enumeration(struct i2c_adapter *host, int no_of_demods, u8 defau - client.addr = default_addr; - if (dib8000_identify(&client) == 0) { - dprintk("#%d: not identified", k); -- return -EINVAL; -+ ret = -EINVAL; -+ goto error; - } - } - -@@ -2420,7 +2475,12 @@ int dib8000_i2c_enumeration(struct i2c_adapter *host, int no_of_demods, u8 defau - dib8000_i2c_write16(&client, 1286, 0); - } - -- return 0; -+error: -+ kfree(client.i2c_read_buffer); -+error_memory: -+ kfree(client.i2c_write_buffer); -+ -+ return ret; - } - - EXPORT_SYMBOL(dib8000_i2c_enumeration); -@@ -2519,6 +2579,8 @@ struct dvb_frontend *dib8000_attach(struct i2c_adapter *i2c_adap, u8 i2c_addr, s - memcpy(&state->cfg, cfg, sizeof(struct dib8000_config)); - state->i2c.adap = i2c_adap; - state->i2c.addr = i2c_addr; -+ state->i2c.i2c_write_buffer = state->i2c_write_buffer; -+ state->i2c.i2c_read_buffer = state->i2c_read_buffer; - state->gpio_val = cfg->gpio_val; - state->gpio_dir = cfg->gpio_dir; - -diff --git a/drivers/media/dvb/frontends/dib9000.c b/drivers/media/dvb/frontends/dib9000.c -index 9151876..451ffa2 100644 ---- a/drivers/media/dvb/frontends/dib9000.c -+++ b/drivers/media/dvb/frontends/dib9000.c -@@ -27,6 +27,8 @@ MODULE_PARM_DESC(debug, "turn on debugging (default: 0)"); - struct i2c_device { - struct i2c_adapter *i2c_adap; - u8 i2c_addr; -+ u8 *i2c_read_buffer; -+ u8 *i2c_write_buffer; - }; - - /* lock */ -@@ -92,11 +94,16 @@ struct dib9000_state { - - struct dvb_frontend *fe[MAX_NUMBER_OF_FRONTENDS]; - u16 component_bus_speed; -+ -+ /* for the I2C transfer */ -+ struct i2c_msg msg[2]; -+ u8 i2c_write_buffer[255]; -+ u8 i2c_read_buffer[255]; - }; - --u32 fe_info[44] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, -+static const u32 fe_info[44] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, - 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, -- 0, 0, 0 -+ 0, 0, 0, 0, 0, 0, 0, 0 - }; - - enum dib9000_power_mode { -@@ -217,25 +224,33 @@ static u16 dib9000_read16_attr(struct dib9000_state *state, u16 reg, u8 * b, u32 - u32 chunk_size = 126; - u32 l; - int ret; -- u8 wb[2] = { reg >> 8, reg & 0xff }; -- struct i2c_msg msg[2] = { -- {.addr = state->i2c.i2c_addr >> 1, .flags = 0, .buf = wb, .len = 2}, -- {.addr = state->i2c.i2c_addr >> 1, .flags = I2C_M_RD, .buf = b, .len = len}, -- }; - - if (state->platform.risc.fw_is_running && (reg < 1024)) - return dib9000_risc_apb_access_read(state, reg, attribute, NULL, 0, b, len); - -+ memset(state->msg, 0, 2 * sizeof(struct i2c_msg)); -+ state->msg[0].addr = state->i2c.i2c_addr >> 1; -+ state->msg[0].flags = 0; -+ state->msg[0].buf = state->i2c_write_buffer; -+ state->msg[0].len = 2; -+ state->msg[1].addr = state->i2c.i2c_addr >> 1; -+ state->msg[1].flags = I2C_M_RD; -+ state->msg[1].buf = b; -+ state->msg[1].len = len; -+ -+ state->i2c_write_buffer[0] = reg >> 8; -+ state->i2c_write_buffer[1] = reg & 0xff; -+ - if (attribute & DATA_BUS_ACCESS_MODE_8BIT) -- wb[0] |= (1 << 5); -+ state->i2c_write_buffer[0] |= (1 << 5); - if (attribute & DATA_BUS_ACCESS_MODE_NO_ADDRESS_INCREMENT) -- wb[0] |= (1 << 4); -+ state->i2c_write_buffer[0] |= (1 << 4); - - do { - l = len < chunk_size ? len : chunk_size; -- msg[1].len = l; -- msg[1].buf = b; -- ret = i2c_transfer(state->i2c.i2c_adap, msg, 2) != 2 ? -EREMOTEIO : 0; -+ state->msg[1].len = l; -+ state->msg[1].buf = b; -+ ret = i2c_transfer(state->i2c.i2c_adap, state->msg, 2) != 2 ? -EREMOTEIO : 0; - if (ret != 0) { - dprintk("i2c read error on %d", reg); - return -EREMOTEIO; -@@ -253,50 +268,47 @@ static u16 dib9000_read16_attr(struct dib9000_state *state, u16 reg, u8 * b, u32 - - static u16 dib9000_i2c_read16(struct i2c_device *i2c, u16 reg) - { -- u8 b[2]; -- u8 wb[2] = { reg >> 8, reg & 0xff }; - struct i2c_msg msg[2] = { -- {.addr = i2c->i2c_addr >> 1, .flags = 0, .buf = wb, .len = 2}, -- {.addr = i2c->i2c_addr >> 1, .flags = I2C_M_RD, .buf = b, .len = 2}, -+ {.addr = i2c->i2c_addr >> 1, .flags = 0, -+ .buf = i2c->i2c_write_buffer, .len = 2}, -+ {.addr = i2c->i2c_addr >> 1, .flags = I2C_M_RD, -+ .buf = i2c->i2c_read_buffer, .len = 2}, - }; - -+ i2c->i2c_write_buffer[0] = reg >> 8; -+ i2c->i2c_write_buffer[1] = reg & 0xff; -+ - if (i2c_transfer(i2c->i2c_adap, msg, 2) != 2) { - dprintk("read register %x error", reg); - return 0; - } - -- return (b[0] << 8) | b[1]; -+ return (i2c->i2c_read_buffer[0] << 8) | i2c->i2c_read_buffer[1]; - } - - static inline u16 dib9000_read_word(struct dib9000_state *state, u16 reg) - { -- u8 b[2]; -- if (dib9000_read16_attr(state, reg, b, 2, 0) != 0) -+ if (dib9000_read16_attr(state, reg, state->i2c_read_buffer, 2, 0) != 0) - return 0; -- return (b[0] << 8 | b[1]); -+ return (state->i2c_read_buffer[0] << 8) | state->i2c_read_buffer[1]; - } - - static inline u16 dib9000_read_word_attr(struct dib9000_state *state, u16 reg, u16 attribute) - { -- u8 b[2]; -- if (dib9000_read16_attr(state, reg, b, 2, attribute) != 0) -+ if (dib9000_read16_attr(state, reg, state->i2c_read_buffer, 2, -+ attribute) != 0) - return 0; -- return (b[0] << 8 | b[1]); -+ return (state->i2c_read_buffer[0] << 8) | state->i2c_read_buffer[1]; - } - - #define dib9000_read16_noinc_attr(state, reg, b, len, attribute) dib9000_read16_attr(state, reg, b, len, (attribute) | DATA_BUS_ACCESS_MODE_NO_ADDRESS_INCREMENT) - - static u16 dib9000_write16_attr(struct dib9000_state *state, u16 reg, const u8 * buf, u32 len, u16 attribute) - { -- u8 b[255]; - u32 chunk_size = 126; - u32 l; - int ret; - -- struct i2c_msg msg = { -- .addr = state->i2c.i2c_addr >> 1, .flags = 0, .buf = b, .len = len + 2 -- }; -- - if (state->platform.risc.fw_is_running && (reg < 1024)) { - if (dib9000_risc_apb_access_write - (state, reg, DATA_BUS_ACCESS_MODE_16BIT | DATA_BUS_ACCESS_MODE_NO_ADDRESS_INCREMENT | attribute, buf, len) != 0) -@@ -304,20 +316,26 @@ static u16 dib9000_write16_attr(struct dib9000_state *state, u16 reg, const u8 * - return 0; - } - -- b[0] = (reg >> 8) & 0xff; -- b[1] = (reg) & 0xff; -+ memset(&state->msg[0], 0, sizeof(struct i2c_msg)); -+ state->msg[0].addr = state->i2c.i2c_addr >> 1; -+ state->msg[0].flags = 0; -+ state->msg[0].buf = state->i2c_write_buffer; -+ state->msg[0].len = len + 2; -+ -+ state->i2c_write_buffer[0] = (reg >> 8) & 0xff; -+ state->i2c_write_buffer[1] = (reg) & 0xff; - - if (attribute & DATA_BUS_ACCESS_MODE_8BIT) -- b[0] |= (1 << 5); -+ state->i2c_write_buffer[0] |= (1 << 5); - if (attribute & DATA_BUS_ACCESS_MODE_NO_ADDRESS_INCREMENT) -- b[0] |= (1 << 4); -+ state->i2c_write_buffer[0] |= (1 << 4); - - do { - l = len < chunk_size ? len : chunk_size; -- msg.len = l + 2; -- memcpy(&b[2], buf, l); -+ state->msg[0].len = l + 2; -+ memcpy(&state->i2c_write_buffer[2], buf, l); - -- ret = i2c_transfer(state->i2c.i2c_adap, &msg, 1) != 1 ? -EREMOTEIO : 0; -+ ret = i2c_transfer(state->i2c.i2c_adap, state->msg, 1) != 1 ? -EREMOTEIO : 0; - - buf += l; - len -= l; -@@ -331,11 +349,16 @@ static u16 dib9000_write16_attr(struct dib9000_state *state, u16 reg, const u8 * - - static int dib9000_i2c_write16(struct i2c_device *i2c, u16 reg, u16 val) - { -- u8 b[4] = { (reg >> 8) & 0xff, reg & 0xff, (val >> 8) & 0xff, val & 0xff }; - struct i2c_msg msg = { -- .addr = i2c->i2c_addr >> 1, .flags = 0, .buf = b, .len = 4 -+ .addr = i2c->i2c_addr >> 1, .flags = 0, -+ .buf = i2c->i2c_write_buffer, .len = 4 - }; - -+ i2c->i2c_write_buffer[0] = (reg >> 8) & 0xff; -+ i2c->i2c_write_buffer[1] = reg & 0xff; -+ i2c->i2c_write_buffer[2] = (val >> 8) & 0xff; -+ i2c->i2c_write_buffer[3] = val & 0xff; -+ - return i2c_transfer(i2c->i2c_adap, &msg, 1) != 1 ? -EREMOTEIO : 0; - } - -@@ -1015,8 +1038,8 @@ static int dib9000_fw_memmbx_sync(struct dib9000_state *state, u8 i) - return 0; - dib9000_risc_mem_write(state, FE_MM_RW_SYNC, &i); - do { -- dib9000_risc_mem_read(state, FE_MM_RW_SYNC, &i, 1); -- } while (i && index_loop--); -+ dib9000_risc_mem_read(state, FE_MM_RW_SYNC, state->i2c_read_buffer, 1); -+ } while (state->i2c_read_buffer[0] && index_loop--); - - if (index_loop > 0) - return 0; -@@ -1139,7 +1162,7 @@ static int dib9000_fw_get_channel(struct dvb_frontend *fe, struct dvb_frontend_p - - s8 intlv_native; - }; -- struct dibDVBTChannel ch; -+ struct dibDVBTChannel *ch; - int ret = 0; - - DibAcquireLock(&state->platform.risc.mem_mbx_lock); -@@ -1148,9 +1171,12 @@ static int dib9000_fw_get_channel(struct dvb_frontend *fe, struct dvb_frontend_p - ret = -EIO; - } - -- dib9000_risc_mem_read(state, FE_MM_R_CHANNEL_UNION, (u8 *) &ch, sizeof(struct dibDVBTChannel)); -+ dib9000_risc_mem_read(state, FE_MM_R_CHANNEL_UNION, -+ state->i2c_read_buffer, sizeof(struct dibDVBTChannel)); -+ ch = (struct dibDVBTChannel *)state->i2c_read_buffer; -+ - -- switch (ch.spectrum_inversion & 0x7) { -+ switch (ch->spectrum_inversion & 0x7) { - case 1: - state->fe[0]->dtv_property_cache.inversion = INVERSION_ON; - break; -@@ -1162,7 +1188,7 @@ static int dib9000_fw_get_channel(struct dvb_frontend *fe, struct dvb_frontend_p - state->fe[0]->dtv_property_cache.inversion = INVERSION_AUTO; - break; - } -- switch (ch.nfft) { -+ switch (ch->nfft) { - case 0: - state->fe[0]->dtv_property_cache.transmission_mode = TRANSMISSION_MODE_2K; - break; -@@ -1177,7 +1203,7 @@ static int dib9000_fw_get_channel(struct dvb_frontend *fe, struct dvb_frontend_p - state->fe[0]->dtv_property_cache.transmission_mode = TRANSMISSION_MODE_AUTO; - break; - } -- switch (ch.guard) { -+ switch (ch->guard) { - case 0: - state->fe[0]->dtv_property_cache.guard_interval = GUARD_INTERVAL_1_32; - break; -@@ -1195,7 +1221,7 @@ static int dib9000_fw_get_channel(struct dvb_frontend *fe, struct dvb_frontend_p - state->fe[0]->dtv_property_cache.guard_interval = GUARD_INTERVAL_AUTO; - break; - } -- switch (ch.constellation) { -+ switch (ch->constellation) { - case 2: - state->fe[0]->dtv_property_cache.modulation = QAM_64; - break; -@@ -1210,7 +1236,7 @@ static int dib9000_fw_get_channel(struct dvb_frontend *fe, struct dvb_frontend_p - state->fe[0]->dtv_property_cache.modulation = QAM_AUTO; - break; - } -- switch (ch.hrch) { -+ switch (ch->hrch) { - case 0: - state->fe[0]->dtv_property_cache.hierarchy = HIERARCHY_NONE; - break; -@@ -1222,7 +1248,7 @@ static int dib9000_fw_get_channel(struct dvb_frontend *fe, struct dvb_frontend_p - state->fe[0]->dtv_property_cache.hierarchy = HIERARCHY_AUTO; - break; - } -- switch (ch.code_rate_hp) { -+ switch (ch->code_rate_hp) { - case 1: - state->fe[0]->dtv_property_cache.code_rate_HP = FEC_1_2; - break; -@@ -1243,7 +1269,7 @@ static int dib9000_fw_get_channel(struct dvb_frontend *fe, struct dvb_frontend_p - state->fe[0]->dtv_property_cache.code_rate_HP = FEC_AUTO; - break; - } -- switch (ch.code_rate_lp) { -+ switch (ch->code_rate_lp) { - case 1: - state->fe[0]->dtv_property_cache.code_rate_LP = FEC_1_2; - break; -@@ -1439,9 +1465,10 @@ static int dib9000_fw_tune(struct dvb_frontend *fe, struct dvb_frontend_paramete - break; - case CT_DEMOD_STEP_1: - if (search) -- dib9000_risc_mem_read(state, FE_MM_R_CHANNEL_SEARCH_STATE, (u8 *) &i, 1); -+ dib9000_risc_mem_read(state, FE_MM_R_CHANNEL_SEARCH_STATE, state->i2c_read_buffer, 1); - else -- dib9000_risc_mem_read(state, FE_MM_R_CHANNEL_TUNE_STATE, (u8 *) &i, 1); -+ dib9000_risc_mem_read(state, FE_MM_R_CHANNEL_TUNE_STATE, state->i2c_read_buffer, 1); -+ i = (s8)state->i2c_read_buffer[0]; - switch (i) { /* something happened */ - case 0: - break; -@@ -2038,14 +2065,17 @@ static int dib9000_read_status(struct dvb_frontend *fe, fe_status_t * stat) - static int dib9000_read_ber(struct dvb_frontend *fe, u32 * ber) - { - struct dib9000_state *state = fe->demodulator_priv; -- u16 c[16]; -+ u16 *c; - - DibAcquireLock(&state->platform.risc.mem_mbx_lock); - if (dib9000_fw_memmbx_sync(state, FE_SYNC_CHANNEL) < 0) - return -EIO; -- dib9000_risc_mem_read(state, FE_MM_R_FE_MONITOR, (u8 *) c, sizeof(c)); -+ dib9000_risc_mem_read(state, FE_MM_R_FE_MONITOR, -+ state->i2c_read_buffer, 16 * 2); - DibReleaseLock(&state->platform.risc.mem_mbx_lock); - -+ c = (u16 *)state->i2c_read_buffer; -+ - *ber = c[10] << 16 | c[11]; - return 0; - } -@@ -2054,7 +2084,7 @@ static int dib9000_read_signal_strength(struct dvb_frontend *fe, u16 * strength) - { - struct dib9000_state *state = fe->demodulator_priv; - u8 index_frontend; -- u16 c[16]; -+ u16 *c = (u16 *)state->i2c_read_buffer; - u16 val; - - *strength = 0; -@@ -2069,7 +2099,7 @@ static int dib9000_read_signal_strength(struct dvb_frontend *fe, u16 * strength) - DibAcquireLock(&state->platform.risc.mem_mbx_lock); - if (dib9000_fw_memmbx_sync(state, FE_SYNC_CHANNEL) < 0) - return -EIO; -- dib9000_risc_mem_read(state, FE_MM_R_FE_MONITOR, (u8 *) c, sizeof(c)); -+ dib9000_risc_mem_read(state, FE_MM_R_FE_MONITOR, (u8 *) c, 16 * 2); - DibReleaseLock(&state->platform.risc.mem_mbx_lock); - - val = 65535 - c[4]; -@@ -2083,14 +2113,14 @@ static int dib9000_read_signal_strength(struct dvb_frontend *fe, u16 * strength) - static u32 dib9000_get_snr(struct dvb_frontend *fe) - { - struct dib9000_state *state = fe->demodulator_priv; -- u16 c[16]; -+ u16 *c = (u16 *)state->i2c_read_buffer; - u32 n, s, exp; - u16 val; - - DibAcquireLock(&state->platform.risc.mem_mbx_lock); - if (dib9000_fw_memmbx_sync(state, FE_SYNC_CHANNEL) < 0) - return -EIO; -- dib9000_risc_mem_read(state, FE_MM_R_FE_MONITOR, (u8 *) c, sizeof(c)); -+ dib9000_risc_mem_read(state, FE_MM_R_FE_MONITOR, (u8 *) c, 16 * 2); - DibReleaseLock(&state->platform.risc.mem_mbx_lock); - - val = c[7]; -@@ -2137,12 +2167,12 @@ static int dib9000_read_snr(struct dvb_frontend *fe, u16 * snr) - static int dib9000_read_unc_blocks(struct dvb_frontend *fe, u32 * unc) - { - struct dib9000_state *state = fe->demodulator_priv; -- u16 c[16]; -+ u16 *c = (u16 *)state->i2c_read_buffer; - - DibAcquireLock(&state->platform.risc.mem_mbx_lock); - if (dib9000_fw_memmbx_sync(state, FE_SYNC_CHANNEL) < 0) - return -EIO; -- dib9000_risc_mem_read(state, FE_MM_R_FE_MONITOR, (u8 *) c, sizeof(c)); -+ dib9000_risc_mem_read(state, FE_MM_R_FE_MONITOR, (u8 *) c, 16 * 2); - DibReleaseLock(&state->platform.risc.mem_mbx_lock); - - *unc = c[12]; -@@ -2151,10 +2181,22 @@ static int dib9000_read_unc_blocks(struct dvb_frontend *fe, u32 * unc) - - int dib9000_i2c_enumeration(struct i2c_adapter *i2c, int no_of_demods, u8 default_addr, u8 first_addr) - { -- int k = 0; -+ int k = 0, ret = 0; - u8 new_addr = 0; - struct i2c_device client = {.i2c_adap = i2c }; - -+ client.i2c_write_buffer = kzalloc(4 * sizeof(u8), GFP_KERNEL); -+ if (!client.i2c_write_buffer) { -+ dprintk("%s: not enough memory", __func__); -+ return -ENOMEM; -+ } -+ client.i2c_read_buffer = kzalloc(4 * sizeof(u8), GFP_KERNEL); -+ if (!client.i2c_read_buffer) { -+ dprintk("%s: not enough memory", __func__); -+ ret = -ENOMEM; -+ goto error_memory; -+ } -+ - client.i2c_addr = default_addr + 16; - dib9000_i2c_write16(&client, 1796, 0x0); - -@@ -2178,7 +2220,8 @@ int dib9000_i2c_enumeration(struct i2c_adapter *i2c, int no_of_demods, u8 defaul - client.i2c_addr = default_addr; - if (dib9000_identify(&client) == 0) { - dprintk("DiB9000 #%d: not identified", k); -- return -EIO; -+ ret = -EIO; -+ goto error; - } - } - -@@ -2196,7 +2239,12 @@ int dib9000_i2c_enumeration(struct i2c_adapter *i2c, int no_of_demods, u8 defaul - dib9000_i2c_write16(&client, 1795, 0); - } - -- return 0; -+error: -+ kfree(client.i2c_read_buffer); -+error_memory: -+ kfree(client.i2c_write_buffer); -+ -+ return ret; - } - EXPORT_SYMBOL(dib9000_i2c_enumeration); - -@@ -2261,6 +2309,8 @@ struct dvb_frontend *dib9000_attach(struct i2c_adapter *i2c_adap, u8 i2c_addr, c - memcpy(&st->chip.d9.cfg, cfg, sizeof(struct dib9000_config)); - st->i2c.i2c_adap = i2c_adap; - st->i2c.i2c_addr = i2c_addr; -+ st->i2c.i2c_write_buffer = st->i2c_write_buffer; -+ st->i2c.i2c_read_buffer = st->i2c_read_buffer; - - st->gpio_dir = DIB9000_GPIO_DEFAULT_DIRECTIONS; - st->gpio_val = DIB9000_GPIO_DEFAULT_VALUES; -diff --git a/drivers/media/dvb/frontends/dibx000_common.c b/drivers/media/dvb/frontends/dibx000_common.c -index f6938f9..dc5d17a 100644 ---- a/drivers/media/dvb/frontends/dibx000_common.c -+++ b/drivers/media/dvb/frontends/dibx000_common.c -@@ -10,30 +10,39 @@ MODULE_PARM_DESC(debug, "turn on debugging (default: 0)"); - - static int dibx000_write_word(struct dibx000_i2c_master *mst, u16 reg, u16 val) - { -- u8 b[4] = { -- (reg >> 8) & 0xff, reg & 0xff, -- (val >> 8) & 0xff, val & 0xff, -- }; -- struct i2c_msg msg = { -- .addr = mst->i2c_addr,.flags = 0,.buf = b,.len = 4 -- }; -- -- return i2c_transfer(mst->i2c_adap, &msg, 1) != 1 ? -EREMOTEIO : 0; -+ mst->i2c_write_buffer[0] = (reg >> 8) & 0xff; -+ mst->i2c_write_buffer[1] = reg & 0xff; -+ mst->i2c_write_buffer[2] = (val >> 8) & 0xff; -+ mst->i2c_write_buffer[3] = val & 0xff; -+ -+ memset(mst->msg, 0, sizeof(struct i2c_msg)); -+ mst->msg[0].addr = mst->i2c_addr; -+ mst->msg[0].flags = 0; -+ mst->msg[0].buf = mst->i2c_write_buffer; -+ mst->msg[0].len = 4; -+ -+ return i2c_transfer(mst->i2c_adap, mst->msg, 1) != 1 ? -EREMOTEIO : 0; - } - - static u16 dibx000_read_word(struct dibx000_i2c_master *mst, u16 reg) - { -- u8 wb[2] = { reg >> 8, reg & 0xff }; -- u8 rb[2]; -- struct i2c_msg msg[2] = { -- {.addr = mst->i2c_addr, .flags = 0, .buf = wb, .len = 2}, -- {.addr = mst->i2c_addr, .flags = I2C_M_RD, .buf = rb, .len = 2}, -- }; -- -- if (i2c_transfer(mst->i2c_adap, msg, 2) != 2) -+ mst->i2c_write_buffer[0] = reg >> 8; -+ mst->i2c_write_buffer[1] = reg & 0xff; -+ -+ memset(mst->msg, 0, 2 * sizeof(struct i2c_msg)); -+ mst->msg[0].addr = mst->i2c_addr; -+ mst->msg[0].flags = 0; -+ mst->msg[0].buf = mst->i2c_write_buffer; -+ mst->msg[0].len = 2; -+ mst->msg[1].addr = mst->i2c_addr; -+ mst->msg[1].flags = I2C_M_RD; -+ mst->msg[1].buf = mst->i2c_read_buffer; -+ mst->msg[1].len = 2; -+ -+ if (i2c_transfer(mst->i2c_adap, mst->msg, 2) != 2) - dprintk("i2c read error on %d", reg); - -- return (rb[0] << 8) | rb[1]; -+ return (mst->i2c_read_buffer[0] << 8) | mst->i2c_read_buffer[1]; - } - - static int dibx000_is_i2c_done(struct dibx000_i2c_master *mst) -@@ -248,26 +257,32 @@ static int dibx000_i2c_gated_gpio67_xfer(struct i2c_adapter *i2c_adap, - struct i2c_msg msg[], int num) - { - struct dibx000_i2c_master *mst = i2c_get_adapdata(i2c_adap); -- struct i2c_msg m[2 + num]; -- u8 tx_open[4], tx_close[4]; - -- memset(m, 0, sizeof(struct i2c_msg) * (2 + num)); -+ if (num > 32) { -+ dprintk("%s: too much I2C message to be transmitted (%i).\ -+ Maximum is 32", __func__, num); -+ return -ENOMEM; -+ } -+ -+ memset(mst->msg, 0, sizeof(struct i2c_msg) * (2 + num)); - - dibx000_i2c_select_interface(mst, DIBX000_I2C_INTERFACE_GPIO_6_7); - -- dibx000_i2c_gate_ctrl(mst, tx_open, msg[0].addr, 1); -- m[0].addr = mst->i2c_addr; -- m[0].buf = tx_open; -- m[0].len = 4; -+ /* open the gate */ -+ dibx000_i2c_gate_ctrl(mst, &mst->i2c_write_buffer[0], msg[0].addr, 1); -+ mst->msg[0].addr = mst->i2c_addr; -+ mst->msg[0].buf = &mst->i2c_write_buffer[0]; -+ mst->msg[0].len = 4; - -- memcpy(&m[1], msg, sizeof(struct i2c_msg) * num); -+ memcpy(&mst->msg[1], msg, sizeof(struct i2c_msg) * num); - -- dibx000_i2c_gate_ctrl(mst, tx_close, 0, 0); -- m[num + 1].addr = mst->i2c_addr; -- m[num + 1].buf = tx_close; -- m[num + 1].len = 4; -+ /* close the gate */ -+ dibx000_i2c_gate_ctrl(mst, &mst->i2c_write_buffer[4], 0, 0); -+ mst->msg[num + 1].addr = mst->i2c_addr; -+ mst->msg[num + 1].buf = &mst->i2c_write_buffer[4]; -+ mst->msg[num + 1].len = 4; - -- return i2c_transfer(mst->i2c_adap, m, 2 + num) == 2 + num ? num : -EIO; -+ return i2c_transfer(mst->i2c_adap, mst->msg, 2 + num) == 2 + num ? num : -EIO; - } - - static struct i2c_algorithm dibx000_i2c_gated_gpio67_algo = { -@@ -279,26 +294,32 @@ static int dibx000_i2c_gated_tuner_xfer(struct i2c_adapter *i2c_adap, - struct i2c_msg msg[], int num) - { - struct dibx000_i2c_master *mst = i2c_get_adapdata(i2c_adap); -- struct i2c_msg m[2 + num]; -- u8 tx_open[4], tx_close[4]; - -- memset(m, 0, sizeof(struct i2c_msg) * (2 + num)); -+ if (num > 32) { -+ dprintk("%s: too much I2C message to be transmitted (%i).\ -+ Maximum is 32", __func__, num); -+ return -ENOMEM; -+ } -+ -+ memset(mst->msg, 0, sizeof(struct i2c_msg) * (2 + num)); - - dibx000_i2c_select_interface(mst, DIBX000_I2C_INTERFACE_TUNER); - -- dibx000_i2c_gate_ctrl(mst, tx_open, msg[0].addr, 1); -- m[0].addr = mst->i2c_addr; -- m[0].buf = tx_open; -- m[0].len = 4; -+ /* open the gate */ -+ dibx000_i2c_gate_ctrl(mst, &mst->i2c_write_buffer[0], msg[0].addr, 1); -+ mst->msg[0].addr = mst->i2c_addr; -+ mst->msg[0].buf = &mst->i2c_write_buffer[0]; -+ mst->msg[0].len = 4; - -- memcpy(&m[1], msg, sizeof(struct i2c_msg) * num); -+ memcpy(&mst->msg[1], msg, sizeof(struct i2c_msg) * num); - -- dibx000_i2c_gate_ctrl(mst, tx_close, 0, 0); -- m[num + 1].addr = mst->i2c_addr; -- m[num + 1].buf = tx_close; -- m[num + 1].len = 4; -+ /* close the gate */ -+ dibx000_i2c_gate_ctrl(mst, &mst->i2c_write_buffer[4], 0, 0); -+ mst->msg[num + 1].addr = mst->i2c_addr; -+ mst->msg[num + 1].buf = &mst->i2c_write_buffer[4]; -+ mst->msg[num + 1].len = 4; - -- return i2c_transfer(mst->i2c_adap, m, 2 + num) == 2 + num ? num : -EIO; -+ return i2c_transfer(mst->i2c_adap, mst->msg, 2 + num) == 2 + num ? num : -EIO; - } - - static struct i2c_algorithm dibx000_i2c_gated_tuner_algo = { -diff --git a/drivers/media/dvb/frontends/dibx000_common.h b/drivers/media/dvb/frontends/dibx000_common.h -index 977d343..f031165 100644 ---- a/drivers/media/dvb/frontends/dibx000_common.h -+++ b/drivers/media/dvb/frontends/dibx000_common.h -@@ -28,6 +28,11 @@ struct dibx000_i2c_master { - u8 i2c_addr; - - u16 base_reg; -+ -+ /* for the I2C transfer */ -+ struct i2c_msg msg[34]; -+ u8 i2c_write_buffer[8]; -+ u8 i2c_read_buffer[2]; - }; - - extern int dibx000_init_i2c_master(struct dibx000_i2c_master *mst, -diff --git a/drivers/media/video/cx88/cx88-blackbird.c b/drivers/media/video/cx88/cx88-blackbird.c -index bca307e..f637d34 100644 ---- a/drivers/media/video/cx88/cx88-blackbird.c -+++ b/drivers/media/video/cx88/cx88-blackbird.c -@@ -1122,7 +1122,6 @@ static int mpeg_release(struct file *file) - mutex_lock(&dev->core->lock); - file->private_data = NULL; - kfree(fh); -- mutex_unlock(&dev->core->lock); - - /* Make sure we release the hardware */ - drv = cx8802_get_driver(dev, CX88_MPEG_BLACKBIRD); -@@ -1131,6 +1130,8 @@ static int mpeg_release(struct file *file) - - atomic_dec(&dev->core->mpeg_users); - -+ mutex_unlock(&dev->core->lock); -+ - return 0; - } - -@@ -1334,11 +1335,9 @@ static int cx8802_blackbird_probe(struct cx8802_driver *drv) - blackbird_register_video(dev); - - /* initial device configuration: needed ? */ -- mutex_lock(&dev->core->lock); - // init_controls(core); - cx88_set_tvnorm(core,core->tvnorm); - cx88_video_mux(core,0); -- mutex_unlock(&dev->core->lock); - - return 0; - -diff --git a/drivers/media/video/cx88/cx88-dvb.c b/drivers/media/video/cx88/cx88-dvb.c -index 7b8c9d3..c69df7e 100644 ---- a/drivers/media/video/cx88/cx88-dvb.c -+++ b/drivers/media/video/cx88/cx88-dvb.c -@@ -133,6 +133,7 @@ static int cx88_dvb_bus_ctrl(struct dvb_frontend* fe, int acquire) - return -EINVAL; - } - -+ mutex_lock(&dev->core->lock); - drv = cx8802_get_driver(dev, CX88_MPEG_DVB); - if (drv) { - if (acquire){ -@@ -143,6 +144,7 @@ static int cx88_dvb_bus_ctrl(struct dvb_frontend* fe, int acquire) - dev->frontends.active_fe_id = 0; - } - } -+ mutex_unlock(&dev->core->lock); - - return ret; - } -diff --git a/drivers/media/video/cx88/cx88-mpeg.c b/drivers/media/video/cx88/cx88-mpeg.c -index addf954..497f26f 100644 ---- a/drivers/media/video/cx88/cx88-mpeg.c -+++ b/drivers/media/video/cx88/cx88-mpeg.c -@@ -624,13 +624,11 @@ static int cx8802_request_acquire(struct cx8802_driver *drv) - - if (drv->advise_acquire) - { -- mutex_lock(&drv->core->lock); - core->active_ref++; - if (core->active_type_id == CX88_BOARD_NONE) { - core->active_type_id = drv->type_id; - drv->advise_acquire(drv); - } -- mutex_unlock(&drv->core->lock); - - mpeg_dbg(1,"%s() Post acquire GPIO=%x\n", __func__, cx_read(MO_GP0_IO)); - } -@@ -643,14 +641,12 @@ static int cx8802_request_release(struct cx8802_driver *drv) - { - struct cx88_core *core = drv->core; - -- mutex_lock(&drv->core->lock); - if (drv->advise_release && --core->active_ref == 0) - { - drv->advise_release(drv); - core->active_type_id = CX88_BOARD_NONE; - mpeg_dbg(1,"%s() Post release GPIO=%x\n", __func__, cx_read(MO_GP0_IO)); - } -- mutex_unlock(&drv->core->lock); - - return 0; - } -@@ -713,18 +709,17 @@ int cx8802_register_driver(struct cx8802_driver *drv) - drv->request_release = cx8802_request_release; - memcpy(driver, drv, sizeof(*driver)); - -+ mutex_lock(&drv->core->lock); - err = drv->probe(driver); - if (err == 0) { - i++; -- mutex_lock(&drv->core->lock); - list_add_tail(&driver->drvlist, &dev->drvlist); -- mutex_unlock(&drv->core->lock); - } else { - printk(KERN_ERR - "%s/2: cx8802 probe failed, err = %d\n", - dev->core->name, err); - } -- -+ mutex_unlock(&drv->core->lock); - } - - return i ? 0 : -ENODEV; -@@ -748,6 +743,8 @@ int cx8802_unregister_driver(struct cx8802_driver *drv) - dev->pci->subsystem_device, dev->core->board.name, - dev->core->boardnr); - -+ mutex_lock(&dev->core->lock); -+ - list_for_each_entry_safe(d, dtmp, &dev->drvlist, drvlist) { - /* only unregister the correct driver type */ - if (d->type_id != drv->type_id) -@@ -755,15 +752,14 @@ int cx8802_unregister_driver(struct cx8802_driver *drv) - - err = d->remove(d); - if (err == 0) { -- mutex_lock(&drv->core->lock); - list_del(&d->drvlist); -- mutex_unlock(&drv->core->lock); - kfree(d); - } else - printk(KERN_ERR "%s/2: cx8802 driver remove " - "failed (%d)\n", dev->core->name, err); - } - -+ mutex_unlock(&dev->core->lock); - } - - return err; -@@ -827,6 +823,8 @@ static void __devexit cx8802_remove(struct pci_dev *pci_dev) - - flush_request_modules(dev); - -+ mutex_lock(&dev->core->lock); -+ - if (!list_empty(&dev->drvlist)) { - struct cx8802_driver *drv, *tmp; - int err; -@@ -838,9 +836,7 @@ static void __devexit cx8802_remove(struct pci_dev *pci_dev) - list_for_each_entry_safe(drv, tmp, &dev->drvlist, drvlist) { - err = drv->remove(drv); - if (err == 0) { -- mutex_lock(&drv->core->lock); - list_del(&drv->drvlist); -- mutex_unlock(&drv->core->lock); - } else - printk(KERN_ERR "%s/2: cx8802 driver remove " - "failed (%d)\n", dev->core->name, err); -@@ -848,6 +844,8 @@ static void __devexit cx8802_remove(struct pci_dev *pci_dev) - } - } - -+ mutex_unlock(&dev->core->lock); -+ - /* Destroy any 8802 reference. */ - dev->core->dvbdev = NULL; - -diff --git a/drivers/media/video/cx88/cx88.h b/drivers/media/video/cx88/cx88.h -index 9b3742a..3d32f4a 100644 ---- a/drivers/media/video/cx88/cx88.h -+++ b/drivers/media/video/cx88/cx88.h -@@ -505,6 +505,8 @@ struct cx8802_driver { - int (*suspend)(struct pci_dev *pci_dev, pm_message_t state); - int (*resume)(struct pci_dev *pci_dev); - -+ /* Callers to the following functions must hold core->lock */ -+ - /* MPEG 8802 -> mini driver - Driver probe and configuration */ - int (*probe)(struct cx8802_driver *drv); - int (*remove)(struct cx8802_driver *drv); -@@ -561,8 +563,9 @@ struct cx8802_dev { - /* for switching modulation types */ - unsigned char ts_gen_cntrl; - -- /* List of attached drivers */ -+ /* List of attached drivers; must hold core->lock to access */ - struct list_head drvlist; -+ - struct work_struct request_module_wk; - }; - -@@ -685,6 +688,8 @@ int cx88_audio_thread(void *data); - - int cx8802_register_driver(struct cx8802_driver *drv); - int cx8802_unregister_driver(struct cx8802_driver *drv); -+ -+/* Caller must hold core->lock */ - struct cx8802_driver * cx8802_get_driver(struct cx8802_dev *dev, enum cx88_board_type btype); - - /* ----------------------------------------------------------- */ -diff --git a/drivers/mfd/omap-usb-host.c b/drivers/mfd/omap-usb-host.c -index 3ab9ffa..55c5d47 100644 ---- a/drivers/mfd/omap-usb-host.c -+++ b/drivers/mfd/omap-usb-host.c -@@ -994,22 +994,33 @@ static void usbhs_disable(struct device *dev) - dev_dbg(dev, "operation timed out\n"); - } - -- if (pdata->ehci_data->phy_reset) { -- if (gpio_is_valid(pdata->ehci_data->reset_gpio_port[0])) -- gpio_free(pdata->ehci_data->reset_gpio_port[0]); -- -- if (gpio_is_valid(pdata->ehci_data->reset_gpio_port[1])) -- gpio_free(pdata->ehci_data->reset_gpio_port[1]); -+ if (is_omap_usbhs_rev2(omap)) { -+ if (is_ehci_tll_mode(pdata->port_mode[0])) -+ clk_enable(omap->usbtll_p1_fck); -+ if (is_ehci_tll_mode(pdata->port_mode[1])) -+ clk_enable(omap->usbtll_p2_fck); -+ clk_disable(omap->utmi_p2_fck); -+ clk_disable(omap->utmi_p1_fck); - } - -- clk_disable(omap->utmi_p2_fck); -- clk_disable(omap->utmi_p1_fck); - clk_disable(omap->usbtll_ick); - clk_disable(omap->usbtll_fck); - clk_disable(omap->usbhost_fs_fck); - clk_disable(omap->usbhost_hs_fck); - clk_disable(omap->usbhost_ick); - -+ /* The gpio_free migh sleep; so unlock the spinlock */ -+ spin_unlock_irqrestore(&omap->lock, flags); -+ -+ if (pdata->ehci_data->phy_reset) { -+ if (gpio_is_valid(pdata->ehci_data->reset_gpio_port[0])) -+ gpio_free(pdata->ehci_data->reset_gpio_port[0]); -+ -+ if (gpio_is_valid(pdata->ehci_data->reset_gpio_port[1])) -+ gpio_free(pdata->ehci_data->reset_gpio_port[1]); -+ } -+ return; -+ - end_disble: - spin_unlock_irqrestore(&omap->lock, flags); - } -diff --git a/drivers/mtd/mtdconcat.c b/drivers/mtd/mtdconcat.c -index 5060e60..e601672 100644 ---- a/drivers/mtd/mtdconcat.c -+++ b/drivers/mtd/mtdconcat.c -@@ -319,7 +319,7 @@ concat_write_oob(struct mtd_info *mtd, loff_t to, struct mtd_oob_ops *ops) - if (!(mtd->flags & MTD_WRITEABLE)) - return -EROFS; - -- ops->retlen = 0; -+ ops->retlen = ops->oobretlen = 0; - - for (i = 0; i < concat->num_subdev; i++) { - struct mtd_info *subdev = concat->subdev[i]; -@@ -334,7 +334,7 @@ concat_write_oob(struct mtd_info *mtd, loff_t to, struct mtd_oob_ops *ops) - devops.len = subdev->size - to; - - err = subdev->write_oob(subdev, to, &devops); -- ops->retlen += devops.retlen; -+ ops->retlen += devops.oobretlen; - if (err) - return err; - -diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c -index c54a4cb..d1345fc 100644 ---- a/drivers/mtd/nand/nand_base.c -+++ b/drivers/mtd/nand/nand_base.c -@@ -3112,6 +3112,8 @@ ident_done: - chip->chip_shift += 32 - 1; - } - -+ chip->badblockbits = 8; -+ - /* Set the bad block position */ - if (mtd->writesize > 512 || (busw & NAND_BUSWIDTH_16)) - chip->badblockpos = NAND_LARGE_BADBLOCK_POS; -diff --git a/drivers/mtd/nand/omap2.c b/drivers/mtd/nand/omap2.c -index da9a351..2c8040f 100644 ---- a/drivers/mtd/nand/omap2.c -+++ b/drivers/mtd/nand/omap2.c -@@ -263,11 +263,10 @@ static void omap_read_buf_pref(struct mtd_info *mtd, u_char *buf, int len) - if (ret) { - /* PFPW engine is busy, use cpu copy method */ - if (info->nand.options & NAND_BUSWIDTH_16) -- omap_read_buf16(mtd, buf, len); -+ omap_read_buf16(mtd, (u_char *)p, len); - else -- omap_read_buf8(mtd, buf, len); -+ omap_read_buf8(mtd, (u_char *)p, len); - } else { -- p = (u32 *) buf; - do { - r_count = gpmc_read_status(GPMC_PREFETCH_FIFO_CNT); - r_count = r_count >> 2; -@@ -293,7 +292,7 @@ static void omap_write_buf_pref(struct mtd_info *mtd, - struct omap_nand_info, mtd); - uint32_t w_count = 0; - int i = 0, ret = 0; -- u16 *p; -+ u16 *p = (u16 *)buf; - unsigned long tim, limit; - - /* take care of subpage writes */ -@@ -309,11 +308,10 @@ static void omap_write_buf_pref(struct mtd_info *mtd, - if (ret) { - /* PFPW engine is busy, use cpu copy method */ - if (info->nand.options & NAND_BUSWIDTH_16) -- omap_write_buf16(mtd, buf, len); -+ omap_write_buf16(mtd, (u_char *)p, len); - else -- omap_write_buf8(mtd, buf, len); -+ omap_write_buf8(mtd, (u_char *)p, len); - } else { -- p = (u16 *) buf; - while (len) { - w_count = gpmc_read_status(GPMC_PREFETCH_FIFO_CNT); - w_count = w_count >> 1; -diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c -index ba71582..a20bfef 100644 ---- a/drivers/net/bonding/bond_alb.c -+++ b/drivers/net/bonding/bond_alb.c -@@ -163,8 +163,6 @@ static int tlb_initialize(struct bonding *bond) - struct tlb_client_info *new_hashtbl; - int i; - -- spin_lock_init(&(bond_info->tx_hashtbl_lock)); -- - new_hashtbl = kzalloc(size, GFP_KERNEL); - if (!new_hashtbl) { - pr_err("%s: Error: Failed to allocate TLB hash table\n", -@@ -764,8 +762,6 @@ static int rlb_initialize(struct bonding *bond) - int size = RLB_HASH_TABLE_SIZE * sizeof(struct rlb_client_info); - int i; - -- spin_lock_init(&(bond_info->rx_hashtbl_lock)); -- - new_hashtbl = kmalloc(size, GFP_KERNEL); - if (!new_hashtbl) { - pr_err("%s: Error: Failed to allocate RLB hash table\n", -diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c -index 16d6fe9..ffb0fde 100644 ---- a/drivers/net/bonding/bond_main.c -+++ b/drivers/net/bonding/bond_main.c -@@ -1535,12 +1535,6 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev) - bond_dev->name, slave_dev->name); - } - -- /* bond must be initialized by bond_open() before enslaving */ -- if (!(bond_dev->flags & IFF_UP)) { -- pr_warning("%s: master_dev is not up in bond_enslave\n", -- bond_dev->name); -- } -- - /* already enslaved */ - if (slave_dev->flags & IFF_SLAVE) { - pr_debug("Error, Device was already enslaved\n"); -@@ -4975,9 +4969,19 @@ static int bond_init(struct net_device *bond_dev) - { - struct bonding *bond = netdev_priv(bond_dev); - struct bond_net *bn = net_generic(dev_net(bond_dev), bond_net_id); -+ struct alb_bond_info *bond_info = &(BOND_ALB_INFO(bond)); - - pr_debug("Begin bond_init for %s\n", bond_dev->name); - -+ /* -+ * Initialize locks that may be required during -+ * en/deslave operations. All of the bond_open work -+ * (of which this is part) should really be moved to -+ * a phase prior to dev_open -+ */ -+ spin_lock_init(&(bond_info->tx_hashtbl_lock)); -+ spin_lock_init(&(bond_info->rx_hashtbl_lock)); -+ - bond->wq = create_singlethread_workqueue(bond_dev->name); - if (!bond->wq) - return -ENOMEM; -diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c -index de87aea..8a2717e 100644 ---- a/drivers/net/bonding/bond_sysfs.c -+++ b/drivers/net/bonding/bond_sysfs.c -@@ -227,12 +227,6 @@ static ssize_t bonding_store_slaves(struct device *d, - struct net_device *dev; - struct bonding *bond = to_bond(d); - -- /* Quick sanity check -- is the bond interface up? */ -- if (!(bond->dev->flags & IFF_UP)) { -- pr_warning("%s: doing slave updates when interface is down.\n", -- bond->dev->name); -- } -- - if (!rtnl_trylock()) - return restart_syscall(); - -diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c -index 78e34e9..6d357d6 100644 ---- a/drivers/net/macvlan.c -+++ b/drivers/net/macvlan.c -@@ -598,8 +598,8 @@ static int macvlan_port_create(struct net_device *dev) - err = netdev_rx_handler_register(dev, macvlan_handle_frame, port); - if (err) - kfree(port); -- -- dev->priv_flags |= IFF_MACVLAN_PORT; -+ else -+ dev->priv_flags |= IFF_MACVLAN_PORT; - return err; - } - -diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c -index 6eadf97..37af3f4 100644 ---- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c -+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c -@@ -652,7 +652,7 @@ static const struct ar9300_eeprom ar9300_x113 = { - .regDmn = { LE16(0), LE16(0x1f) }, - .txrxMask = 0x77, /* 4 bits tx and 4 bits rx */ - .opCapFlags = { -- .opFlags = AR5416_OPFLAGS_11G | AR5416_OPFLAGS_11A, -+ .opFlags = AR5416_OPFLAGS_11A, - .eepMisc = 0, - }, - .rfSilent = 0, -@@ -922,7 +922,7 @@ static const struct ar9300_eeprom ar9300_x113 = { - .db_stage2 = {3, 3, 3}, /* 3 chain */ - .db_stage3 = {3, 3, 3}, /* doesn't exist for 2G */ - .db_stage4 = {3, 3, 3}, /* don't exist for 2G */ -- .xpaBiasLvl = 0, -+ .xpaBiasLvl = 0xf, - .txFrameToDataStart = 0x0e, - .txFrameToPaOn = 0x0e, - .txClip = 3, /* 4 bits tx_clip, 4 bits dac_scale_cck */ -@@ -3994,6 +3994,16 @@ static int ar9003_hw_tx_power_regwrite(struct ath_hw *ah, u8 * pPwrArray) - POW_SM(pPwrArray[ALL_TARGET_LEGACY_1L_5L], 0) - ); - -+ /* Write the power for duplicated frames - HT40 */ -+ -+ /* dup40_cck (LSB), dup40_ofdm, ext20_cck, ext20_ofdm (MSB) */ -+ REG_WRITE(ah, 0xa3e0, -+ POW_SM(pPwrArray[ALL_TARGET_LEGACY_6_24], 24) | -+ POW_SM(pPwrArray[ALL_TARGET_LEGACY_1L_5L], 16) | -+ POW_SM(pPwrArray[ALL_TARGET_LEGACY_6_24], 8) | -+ POW_SM(pPwrArray[ALL_TARGET_LEGACY_1L_5L], 0) -+ ); -+ - /* Write the HT20 power per rate set */ - - /* 0/8/16 (LSB), 1-3/9-11/17-19, 4, 5 (MSB) */ -diff --git a/drivers/net/wireless/ath/ath9k/calib.c b/drivers/net/wireless/ath/ath9k/calib.c -index 8649581..fe3c10e 100644 ---- a/drivers/net/wireless/ath/ath9k/calib.c -+++ b/drivers/net/wireless/ath/ath9k/calib.c -@@ -69,15 +69,21 @@ static void ath9k_hw_update_nfcal_hist_buffer(struct ath_hw *ah, - int16_t *nfarray) - { - struct ath_common *common = ath9k_hw_common(ah); -+ struct ieee80211_conf *conf = &common->hw->conf; - struct ath_nf_limits *limit; - struct ath9k_nfcal_hist *h; - bool high_nf_mid = false; -+ u8 chainmask = (ah->rxchainmask << 3) | ah->rxchainmask; - int i; - - h = cal->nfCalHist; - limit = ath9k_hw_get_nf_limits(ah, ah->curchan); - - for (i = 0; i < NUM_NF_READINGS; i++) { -+ if (!(chainmask & (1 << i)) || -+ ((i >= AR5416_MAX_CHAINS) && !conf_is_ht40(conf))) -+ continue; -+ - h[i].nfCalBuffer[h[i].currIndex] = nfarray[i]; - - if (++h[i].currIndex >= ATH9K_NF_CAL_HIST_MAX) -@@ -225,6 +231,7 @@ void ath9k_hw_loadnf(struct ath_hw *ah, struct ath9k_channel *chan) - int32_t val; - u8 chainmask = (ah->rxchainmask << 3) | ah->rxchainmask; - struct ath_common *common = ath9k_hw_common(ah); -+ struct ieee80211_conf *conf = &common->hw->conf; - s16 default_nf = ath9k_hw_get_default_nf(ah, chan); - - if (ah->caldata) -@@ -234,6 +241,9 @@ void ath9k_hw_loadnf(struct ath_hw *ah, struct ath9k_channel *chan) - if (chainmask & (1 << i)) { - s16 nfval; - -+ if ((i >= AR5416_MAX_CHAINS) && !conf_is_ht40(conf)) -+ continue; -+ - if (h) - nfval = h[i].privNF; - else -@@ -293,6 +303,9 @@ void ath9k_hw_loadnf(struct ath_hw *ah, struct ath9k_channel *chan) - ENABLE_REGWRITE_BUFFER(ah); - for (i = 0; i < NUM_NF_READINGS; i++) { - if (chainmask & (1 << i)) { -+ if ((i >= AR5416_MAX_CHAINS) && !conf_is_ht40(conf)) -+ continue; -+ - val = REG_READ(ah, ah->nf_regs[i]); - val &= 0xFFFFFE00; - val |= (((u32) (-50) << 1) & 0x1ff); -diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c -index bafbe57..1755729 100644 ---- a/drivers/net/wireless/iwlwifi/iwl-core.c -+++ b/drivers/net/wireless/iwlwifi/iwl-core.c -@@ -1783,6 +1783,15 @@ int iwl_mac_change_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif, - - mutex_lock(&priv->mutex); - -+ if (!ctx->vif || !iwl_is_ready_rf(priv)) { -+ /* -+ * Huh? But wait ... this can maybe happen when -+ * we're in the middle of a firmware restart! -+ */ -+ err = -EBUSY; -+ goto out; -+ } -+ - interface_modes = ctx->interface_modes | ctx->exclusive_interface_modes; - - if (!(interface_modes & BIT(newtype))) { -@@ -1810,6 +1819,7 @@ int iwl_mac_change_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif, - /* success */ - iwl_teardown_interface(priv, vif, true); - vif->type = newtype; -+ vif->p2p = newp2p; - err = iwl_setup_interface(priv, ctx); - WARN_ON(err); - /* -diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h -index 68b953f..c0a4cfb 100644 ---- a/drivers/net/wireless/iwlwifi/iwl-dev.h -+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h -@@ -1658,21 +1658,24 @@ iwl_rxon_ctx_from_vif(struct ieee80211_vif *vif) - ctx < &priv->contexts[NUM_IWL_RXON_CTX]; ctx++) \ - if (priv->valid_contexts & BIT(ctx->ctxid)) - --static inline int iwl_is_associated(struct iwl_priv *priv, -- enum iwl_rxon_context_id ctxid) -+static inline int iwl_is_associated_ctx(struct iwl_rxon_context *ctx) - { -- return (priv->contexts[ctxid].active.filter_flags & -- RXON_FILTER_ASSOC_MSK) ? 1 : 0; -+ return (ctx->active.filter_flags & RXON_FILTER_ASSOC_MSK) ? 1 : 0; - } - --static inline int iwl_is_any_associated(struct iwl_priv *priv) -+static inline int iwl_is_associated(struct iwl_priv *priv, -+ enum iwl_rxon_context_id ctxid) - { -- return iwl_is_associated(priv, IWL_RXON_CTX_BSS); -+ return iwl_is_associated_ctx(&priv->contexts[ctxid]); - } - --static inline int iwl_is_associated_ctx(struct iwl_rxon_context *ctx) -+static inline int iwl_is_any_associated(struct iwl_priv *priv) - { -- return (ctx->active.filter_flags & RXON_FILTER_ASSOC_MSK) ? 1 : 0; -+ struct iwl_rxon_context *ctx; -+ for_each_context(priv, ctx) -+ if (iwl_is_associated_ctx(ctx)) -+ return true; -+ return false; - } - - static inline int is_channel_valid(const struct iwl_channel_info *ch_info) -diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c -index e183587..a8f3bc7 100644 ---- a/drivers/net/wireless/p54/p54usb.c -+++ b/drivers/net/wireless/p54/p54usb.c -@@ -82,6 +82,7 @@ static struct usb_device_id p54u_table[] __devinitdata = { - {USB_DEVICE(0x06b9, 0x0121)}, /* Thomson SpeedTouch 121g */ - {USB_DEVICE(0x0707, 0xee13)}, /* SMC 2862W-G version 2 */ - {USB_DEVICE(0x083a, 0x4521)}, /* Siemens Gigaset USB Adapter 54 version 2 */ -+ {USB_DEVICE(0x083a, 0xc501)}, /* Zoom Wireless-G 4410 */ - {USB_DEVICE(0x083a, 0xf503)}, /* Accton FD7050E ver 1010ec */ - {USB_DEVICE(0x0846, 0x4240)}, /* Netgear WG111 (v2) */ - {USB_DEVICE(0x0915, 0x2000)}, /* Cohiba Proto board */ -diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c -index 5129ed6..4b2bbe8 100644 ---- a/drivers/pci/quirks.c -+++ b/drivers/pci/quirks.c -@@ -2784,6 +2784,16 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x342e, vtd_mask_spec_errors); - DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x3c28, vtd_mask_spec_errors); - #endif - -+static void __devinit fixup_ti816x_class(struct pci_dev* dev) -+{ -+ /* TI 816x devices do not have class code set when in PCIe boot mode */ -+ if (dev->class == PCI_CLASS_NOT_DEFINED) { -+ dev_info(&dev->dev, "Setting PCI class for 816x PCIe device\n"); -+ dev->class = PCI_CLASS_MULTIMEDIA_VIDEO; -+ } -+} -+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_TI, 0xb800, fixup_ti816x_class); -+ - static void pci_do_fixups(struct pci_dev *dev, struct pci_fixup *f, - struct pci_fixup *end) - { -diff --git a/drivers/scsi/bnx2i/bnx2i_hwi.c b/drivers/scsi/bnx2i/bnx2i_hwi.c -index f0b8951..a8a2b6b 100644 ---- a/drivers/scsi/bnx2i/bnx2i_hwi.c -+++ b/drivers/scsi/bnx2i/bnx2i_hwi.c -@@ -1274,6 +1274,7 @@ int bnx2i_send_fw_iscsi_init_msg(struct bnx2i_hba *hba) - iscsi_init.dummy_buffer_addr_hi = - (u32) ((u64) hba->dummy_buf_dma >> 32); - -+ hba->num_ccell = hba->max_sqes >> 1; - hba->ctx_ccell_tasks = - ((hba->num_ccell & 0xFFFF) | (hba->max_sqes << 16)); - iscsi_init.num_ccells_per_conn = hba->num_ccell; -diff --git a/drivers/scsi/bnx2i/bnx2i_init.c b/drivers/scsi/bnx2i/bnx2i_init.c -index 1d24a28..6adbdc3 100644 ---- a/drivers/scsi/bnx2i/bnx2i_init.c -+++ b/drivers/scsi/bnx2i/bnx2i_init.c -@@ -244,7 +244,7 @@ void bnx2i_stop(void *handle) - wait_event_interruptible_timeout(hba->eh_wait, - (list_empty(&hba->ep_ofld_list) && - list_empty(&hba->ep_destroy_list)), -- 10 * HZ); -+ 2 * HZ); - /* Wait for all endpoints to be torn down, Chip will be reset once - * control returns to network driver. So it is required to cleanup and - * release all connection resources before returning from this routine. -diff --git a/drivers/scsi/bnx2i/bnx2i_iscsi.c b/drivers/scsi/bnx2i/bnx2i_iscsi.c -index 1809f9c..51a970f 100644 ---- a/drivers/scsi/bnx2i/bnx2i_iscsi.c -+++ b/drivers/scsi/bnx2i/bnx2i_iscsi.c -@@ -858,7 +858,7 @@ struct bnx2i_hba *bnx2i_alloc_hba(struct cnic_dev *cnic) - mutex_init(&hba->net_dev_lock); - init_waitqueue_head(&hba->eh_wait); - if (test_bit(BNX2I_NX2_DEV_57710, &hba->cnic_dev_type)) { -- hba->hba_shutdown_tmo = 20 * HZ; -+ hba->hba_shutdown_tmo = 30 * HZ; - hba->conn_teardown_tmo = 20 * HZ; - hba->conn_ctx_destroy_tmo = 6 * HZ; - } else { /* 5706/5708/5709 */ -@@ -1208,6 +1208,9 @@ static int bnx2i_task_xmit(struct iscsi_task *task) - struct bnx2i_cmd *cmd = task->dd_data; - struct iscsi_cmd *hdr = (struct iscsi_cmd *) task->hdr; - -+ if (bnx2i_conn->ep->num_active_cmds + 1 > hba->max_sqes) -+ return -ENOMEM; -+ - /* - * If there is no scsi_cmnd this must be a mgmt task - */ -diff --git a/drivers/scsi/mpt2sas/mpt2sas_scsih.c b/drivers/scsi/mpt2sas/mpt2sas_scsih.c -index d2064a0..9aab26a 100644 ---- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c -+++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c -@@ -113,6 +113,7 @@ struct sense_info { - }; - - -+#define MPT2SAS_TURN_ON_FAULT_LED (0xFFFC) - #define MPT2SAS_RESCAN_AFTER_HOST_RESET (0xFFFF) - - /** -@@ -121,6 +122,7 @@ struct sense_info { - * @work: work object (ioc->fault_reset_work_q) - * @cancel_pending_work: flag set during reset handling - * @ioc: per adapter object -+ * @device_handle: device handle - * @VF_ID: virtual function id - * @VP_ID: virtual port id - * @ignore: flag meaning this event has been marked to ignore -@@ -134,6 +136,7 @@ struct fw_event_work { - u8 cancel_pending_work; - struct delayed_work delayed_work; - struct MPT2SAS_ADAPTER *ioc; -+ u16 device_handle; - u8 VF_ID; - u8 VP_ID; - u8 ignore; -@@ -3708,17 +3711,75 @@ _scsih_scsi_ioc_info(struct MPT2SAS_ADAPTER *ioc, struct scsi_cmnd *scmd, - #endif - - /** -- * _scsih_smart_predicted_fault - illuminate Fault LED -+ * _scsih_turn_on_fault_led - illuminate Fault LED - * @ioc: per adapter object - * @handle: device handle -+ * Context: process - * - * Return nothing. - */ - static void --_scsih_smart_predicted_fault(struct MPT2SAS_ADAPTER *ioc, u16 handle) -+_scsih_turn_on_fault_led(struct MPT2SAS_ADAPTER *ioc, u16 handle) - { - Mpi2SepReply_t mpi_reply; - Mpi2SepRequest_t mpi_request; -+ -+ memset(&mpi_request, 0, sizeof(Mpi2SepRequest_t)); -+ mpi_request.Function = MPI2_FUNCTION_SCSI_ENCLOSURE_PROCESSOR; -+ mpi_request.Action = MPI2_SEP_REQ_ACTION_WRITE_STATUS; -+ mpi_request.SlotStatus = -+ cpu_to_le32(MPI2_SEP_REQ_SLOTSTATUS_PREDICTED_FAULT); -+ mpi_request.DevHandle = cpu_to_le16(handle); -+ mpi_request.Flags = MPI2_SEP_REQ_FLAGS_DEVHANDLE_ADDRESS; -+ if ((mpt2sas_base_scsi_enclosure_processor(ioc, &mpi_reply, -+ &mpi_request)) != 0) { -+ printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n", ioc->name, -+ __FILE__, __LINE__, __func__); -+ return; -+ } -+ -+ if (mpi_reply.IOCStatus || mpi_reply.IOCLogInfo) { -+ dewtprintk(ioc, printk(MPT2SAS_INFO_FMT "enclosure_processor: " -+ "ioc_status (0x%04x), loginfo(0x%08x)\n", ioc->name, -+ le16_to_cpu(mpi_reply.IOCStatus), -+ le32_to_cpu(mpi_reply.IOCLogInfo))); -+ return; -+ } -+} -+ -+/** -+ * _scsih_send_event_to_turn_on_fault_led - fire delayed event -+ * @ioc: per adapter object -+ * @handle: device handle -+ * Context: interrupt. -+ * -+ * Return nothing. -+ */ -+static void -+_scsih_send_event_to_turn_on_fault_led(struct MPT2SAS_ADAPTER *ioc, u16 handle) -+{ -+ struct fw_event_work *fw_event; -+ -+ fw_event = kzalloc(sizeof(struct fw_event_work), GFP_ATOMIC); -+ if (!fw_event) -+ return; -+ fw_event->event = MPT2SAS_TURN_ON_FAULT_LED; -+ fw_event->device_handle = handle; -+ fw_event->ioc = ioc; -+ _scsih_fw_event_add(ioc, fw_event); -+} -+ -+/** -+ * _scsih_smart_predicted_fault - process smart errors -+ * @ioc: per adapter object -+ * @handle: device handle -+ * Context: interrupt. -+ * -+ * Return nothing. -+ */ -+static void -+_scsih_smart_predicted_fault(struct MPT2SAS_ADAPTER *ioc, u16 handle) -+{ - struct scsi_target *starget; - struct MPT2SAS_TARGET *sas_target_priv_data; - Mpi2EventNotificationReply_t *event_reply; -@@ -3745,30 +3806,8 @@ _scsih_smart_predicted_fault(struct MPT2SAS_ADAPTER *ioc, u16 handle) - starget_printk(KERN_WARNING, starget, "predicted fault\n"); - spin_unlock_irqrestore(&ioc->sas_device_lock, flags); - -- if (ioc->pdev->subsystem_vendor == PCI_VENDOR_ID_IBM) { -- memset(&mpi_request, 0, sizeof(Mpi2SepRequest_t)); -- mpi_request.Function = MPI2_FUNCTION_SCSI_ENCLOSURE_PROCESSOR; -- mpi_request.Action = MPI2_SEP_REQ_ACTION_WRITE_STATUS; -- mpi_request.SlotStatus = -- cpu_to_le32(MPI2_SEP_REQ_SLOTSTATUS_PREDICTED_FAULT); -- mpi_request.DevHandle = cpu_to_le16(handle); -- mpi_request.Flags = MPI2_SEP_REQ_FLAGS_DEVHANDLE_ADDRESS; -- if ((mpt2sas_base_scsi_enclosure_processor(ioc, &mpi_reply, -- &mpi_request)) != 0) { -- printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n", -- ioc->name, __FILE__, __LINE__, __func__); -- return; -- } -- -- if (mpi_reply.IOCStatus || mpi_reply.IOCLogInfo) { -- dewtprintk(ioc, printk(MPT2SAS_INFO_FMT -- "enclosure_processor: ioc_status (0x%04x), " -- "loginfo(0x%08x)\n", ioc->name, -- le16_to_cpu(mpi_reply.IOCStatus), -- le32_to_cpu(mpi_reply.IOCLogInfo))); -- return; -- } -- } -+ if (ioc->pdev->subsystem_vendor == PCI_VENDOR_ID_IBM) -+ _scsih_send_event_to_turn_on_fault_led(ioc, handle); - - /* insert into event log */ - sz = offsetof(Mpi2EventNotificationReply_t, EventData) + -@@ -6330,6 +6369,9 @@ _firmware_event_work(struct work_struct *work) - } - - switch (fw_event->event) { -+ case MPT2SAS_TURN_ON_FAULT_LED: -+ _scsih_turn_on_fault_led(ioc, fw_event->device_handle); -+ break; - case MPI2_EVENT_SAS_TOPOLOGY_CHANGE_LIST: - _scsih_sas_topology_change_event(ioc, fw_event); - break; -diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c -index d3e58d7..c52a0a2 100644 ---- a/drivers/scsi/qla2xxx/qla_attr.c -+++ b/drivers/scsi/qla2xxx/qla_attr.c -@@ -1877,14 +1877,15 @@ qla24xx_vport_delete(struct fc_vport *fc_vport) - - scsi_remove_host(vha->host); - -+ /* Allow timer to run to drain queued items, when removing vp */ -+ qla24xx_deallocate_vp_id(vha); -+ - if (vha->timer_active) { - qla2x00_vp_stop_timer(vha); - DEBUG15(printk(KERN_INFO "scsi(%ld): timer for the vport[%d]" - " = %p has stopped\n", vha->host_no, vha->vp_idx, vha)); - } - -- qla24xx_deallocate_vp_id(vha); -- - /* No pending activities shall be there on the vha now */ - DEBUG(msleep(random32()%10)); /* Just to see if something falls on - * the net we have placed below */ -diff --git a/drivers/scsi/qla2xxx/qla_fw.h b/drivers/scsi/qla2xxx/qla_fw.h -index f5ba09c..5223c1d 100644 ---- a/drivers/scsi/qla2xxx/qla_fw.h -+++ b/drivers/scsi/qla2xxx/qla_fw.h -@@ -416,8 +416,7 @@ struct cmd_type_6 { - uint8_t vp_index; - - uint32_t fcp_data_dseg_address[2]; /* Data segment address. */ -- uint16_t fcp_data_dseg_len; /* Data segment length. */ -- uint16_t reserved_1; /* MUST be set to 0. */ -+ uint32_t fcp_data_dseg_len; /* Data segment length. */ - }; - - #define COMMAND_TYPE_7 0x18 /* Command Type 7 entry */ -diff --git a/drivers/scsi/qla2xxx/qla_nx.c b/drivers/scsi/qla2xxx/qla_nx.c -index 455fe13..eb31213 100644 ---- a/drivers/scsi/qla2xxx/qla_nx.c -+++ b/drivers/scsi/qla2xxx/qla_nx.c -@@ -2548,11 +2548,11 @@ qla2xx_build_scsi_type_6_iocbs(srb_t *sp, struct cmd_type_6 *cmd_pkt, - dsd_seg = (uint32_t *)&cmd_pkt->fcp_data_dseg_address; - *dsd_seg++ = cpu_to_le32(LSD(dsd_ptr->dsd_list_dma)); - *dsd_seg++ = cpu_to_le32(MSD(dsd_ptr->dsd_list_dma)); -- cmd_pkt->fcp_data_dseg_len = dsd_list_len; -+ *dsd_seg++ = cpu_to_le32(dsd_list_len); - } else { - *cur_dsd++ = cpu_to_le32(LSD(dsd_ptr->dsd_list_dma)); - *cur_dsd++ = cpu_to_le32(MSD(dsd_ptr->dsd_list_dma)); -- *cur_dsd++ = dsd_list_len; -+ *cur_dsd++ = cpu_to_le32(dsd_list_len); - } - cur_dsd = (uint32_t *)next_dsd; - while (avail_dsds) { -diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c -index aa77475..4c3f5e8 100644 ---- a/drivers/scsi/qla2xxx/qla_os.c -+++ b/drivers/scsi/qla2xxx/qla_os.c -@@ -2360,21 +2360,26 @@ qla2x00_remove_one(struct pci_dev *pdev) - base_vha = pci_get_drvdata(pdev); - ha = base_vha->hw; - -- spin_lock_irqsave(&ha->vport_slock, flags); -- list_for_each_entry(vha, &ha->vp_list, list) { -- atomic_inc(&vha->vref_count); -+ mutex_lock(&ha->vport_lock); -+ while (ha->cur_vport_count) { -+ struct Scsi_Host *scsi_host; - -- if (vha->fc_vport) { -- spin_unlock_irqrestore(&ha->vport_slock, flags); -+ spin_lock_irqsave(&ha->vport_slock, flags); - -- fc_vport_terminate(vha->fc_vport); -+ BUG_ON(base_vha->list.next == &ha->vp_list); -+ /* This assumes first entry in ha->vp_list is always base vha */ -+ vha = list_first_entry(&base_vha->list, scsi_qla_host_t, list); -+ scsi_host = scsi_host_get(vha->host); - -- spin_lock_irqsave(&ha->vport_slock, flags); -- } -+ spin_unlock_irqrestore(&ha->vport_slock, flags); -+ mutex_unlock(&ha->vport_lock); -+ -+ fc_vport_terminate(vha->fc_vport); -+ scsi_host_put(vha->host); - -- atomic_dec(&vha->vref_count); -+ mutex_lock(&ha->vport_lock); - } -- spin_unlock_irqrestore(&ha->vport_slock, flags); -+ mutex_unlock(&ha->vport_lock); - - set_bit(UNLOADING, &base_vha->dpc_flags); - -@@ -3604,7 +3609,8 @@ qla2x00_timer(scsi_qla_host_t *vha) - if (!pci_channel_offline(ha->pdev)) - pci_read_config_word(ha->pdev, PCI_VENDOR_ID, &w); - -- if (IS_QLA82XX(ha)) { -+ /* Make sure qla82xx_watchdog is run only for physical port */ -+ if (!vha->vp_idx && IS_QLA82XX(ha)) { - if (test_bit(ISP_QUIESCE_NEEDED, &vha->dpc_flags)) - start_dpc++; - qla82xx_watchdog(vha); -@@ -3675,8 +3681,8 @@ qla2x00_timer(scsi_qla_host_t *vha) - atomic_read(&vha->loop_down_timer))); - } - -- /* Check if beacon LED needs to be blinked */ -- if (ha->beacon_blink_led == 1) { -+ /* Check if beacon LED needs to be blinked for physical host only */ -+ if (!vha->vp_idx && (ha->beacon_blink_led == 1)) { - set_bit(BEACON_BLINK_NEEDED, &vha->dpc_flags); - start_dpc++; - } -diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c -index 95019c7..4778e27 100644 ---- a/drivers/scsi/sr.c -+++ b/drivers/scsi/sr.c -@@ -636,7 +636,7 @@ static int sr_probe(struct device *dev) - disk->first_minor = minor; - sprintf(disk->disk_name, "sr%d", minor); - disk->fops = &sr_bdops; -- disk->flags = GENHD_FL_CD; -+ disk->flags = GENHD_FL_CD | GENHD_FL_BLOCK_EVENTS_ON_EXCL_WRITE; - disk->events = DISK_EVENT_MEDIA_CHANGE | DISK_EVENT_EJECT_REQUEST; - - blk_queue_rq_timeout(sdev->request_queue, SR_TIMEOUT); -diff --git a/drivers/scsi/ultrastor.c b/drivers/scsi/ultrastor.c -index 9f4b58b..7e22b73 100644 ---- a/drivers/scsi/ultrastor.c -+++ b/drivers/scsi/ultrastor.c -@@ -307,7 +307,7 @@ static inline int find_and_clear_bit_16(unsigned long *field) - "0: bsfw %1,%w0\n\t" - "btr %0,%1\n\t" - "jnc 0b" -- : "=&r" (rv), "=m" (*field) :); -+ : "=&r" (rv), "+m" (*field) :); - - return rv; - } -diff --git a/drivers/sh/clk/cpg.c b/drivers/sh/clk/cpg.c -index 6172335..82dd6fb 100644 ---- a/drivers/sh/clk/cpg.c -+++ b/drivers/sh/clk/cpg.c -@@ -105,7 +105,7 @@ static int sh_clk_div6_set_parent(struct clk *clk, struct clk *parent) - - /* Rebuild the frequency table */ - clk_rate_table_build(clk, clk->freq_table, table->nr_divisors, -- table, &clk->arch_flags); -+ table, NULL); - - return 0; - } -diff --git a/drivers/staging/brcm80211/brcmsmac/wlc_ampdu.c b/drivers/staging/brcm80211/brcmsmac/wlc_ampdu.c -index f008659..f7bff4e 100644 ---- a/drivers/staging/brcm80211/brcmsmac/wlc_ampdu.c -+++ b/drivers/staging/brcm80211/brcmsmac/wlc_ampdu.c -@@ -1123,21 +1123,12 @@ wlc_ampdu_dotxstatus_complete(struct ampdu_info *ampdu, struct scb *scb, - ini->txretry[index] = 0; - - /* ampdu_ack_len: number of acked aggregated frames */ -- /* ampdu_ack_map: block ack bit map for the aggregation */ - /* ampdu_len: number of aggregated frames */ - rate_status(wlc, tx_info, txs, mcs); - tx_info->flags |= IEEE80211_TX_STAT_ACK; - tx_info->flags |= IEEE80211_TX_STAT_AMPDU; -- -- /* XXX TODO: Make these accurate. */ - tx_info->status.ampdu_ack_len = -- (txs-> -- status & TX_STATUS_FRM_RTX_MASK) >> -- TX_STATUS_FRM_RTX_SHIFT; -- tx_info->status.ampdu_len = -- (txs-> -- status & TX_STATUS_FRM_RTX_MASK) >> -- TX_STATUS_FRM_RTX_SHIFT; -+ tx_info->status.ampdu_len = 1; - - skb_pull(p, D11_PHY_HDR_LEN); - skb_pull(p, D11_TXH_LEN); -@@ -1163,6 +1154,8 @@ wlc_ampdu_dotxstatus_complete(struct ampdu_info *ampdu, struct scb *scb, - /* Retry timeout */ - ini->tx_in_transit--; - ieee80211_tx_info_clear_status(tx_info); -+ tx_info->status.ampdu_ack_len = 0; -+ tx_info->status.ampdu_len = 1; - tx_info->flags |= - IEEE80211_TX_STAT_AMPDU_NO_BACK; - skb_pull(p, D11_PHY_HDR_LEN); -diff --git a/drivers/staging/rtl8712/rtl871x_ioctl_set.c b/drivers/staging/rtl8712/rtl871x_ioctl_set.c -index 8b1451d..8486eb1 100644 ---- a/drivers/staging/rtl8712/rtl871x_ioctl_set.c -+++ b/drivers/staging/rtl8712/rtl871x_ioctl_set.c -@@ -68,7 +68,10 @@ static u8 do_join(struct _adapter *padapter) - pmlmepriv->fw_state |= _FW_UNDER_LINKING; - pmlmepriv->pscanned = plist; - pmlmepriv->to_join = true; -- if (_queue_empty(queue) == true) { -+ -+ /* adhoc mode will start with an empty queue, but skip checking */ -+ if (!check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) && -+ _queue_empty(queue)) { - if (pmlmepriv->fw_state & _FW_UNDER_LINKING) - pmlmepriv->fw_state ^= _FW_UNDER_LINKING; - /* when set_ssid/set_bssid for do_join(), but scanning queue -diff --git a/drivers/staging/usbip/usbip_common.c b/drivers/staging/usbip/usbip_common.c -index 7b1fe45..37b650b 100644 ---- a/drivers/staging/usbip/usbip_common.c -+++ b/drivers/staging/usbip/usbip_common.c -@@ -604,7 +604,7 @@ static void correct_endian_ret_submit(struct usbip_header_ret_submit *pdu, - be32_to_cpus(&pdu->status); - be32_to_cpus(&pdu->actual_length); - be32_to_cpus(&pdu->start_frame); -- cpu_to_be32s(&pdu->number_of_packets); -+ be32_to_cpus(&pdu->number_of_packets); - be32_to_cpus(&pdu->error_count); - } - } -diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c -index d25e208..fc10ed4 100644 ---- a/drivers/target/target_core_device.c -+++ b/drivers/target/target_core_device.c -@@ -150,13 +150,13 @@ out: - - { - struct se_device *dev = se_lun->lun_se_dev; -- spin_lock(&dev->stats_lock); -+ spin_lock_irq(&dev->stats_lock); - dev->num_cmds++; - if (se_cmd->data_direction == DMA_TO_DEVICE) - dev->write_bytes += se_cmd->data_length; - else if (se_cmd->data_direction == DMA_FROM_DEVICE) - dev->read_bytes += se_cmd->data_length; -- spin_unlock(&dev->stats_lock); -+ spin_unlock_irq(&dev->stats_lock); - } - - /* -diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c -index 4a10983..59b8b9c 100644 ---- a/drivers/target/target_core_tmr.c -+++ b/drivers/target/target_core_tmr.c -@@ -55,7 +55,8 @@ struct se_tmr_req *core_tmr_alloc_req( - { - struct se_tmr_req *tmr; - -- tmr = kmem_cache_zalloc(se_tmr_req_cache, GFP_KERNEL); -+ tmr = kmem_cache_zalloc(se_tmr_req_cache, (in_interrupt()) ? -+ GFP_ATOMIC : GFP_KERNEL); - if (!(tmr)) { - printk(KERN_ERR "Unable to allocate struct se_tmr_req\n"); - return ERR_PTR(-ENOMEM); -@@ -398,9 +399,9 @@ int core_tmr_lun_reset( - printk(KERN_INFO "LUN_RESET: SCSI-2 Released reservation\n"); - } - -- spin_lock(&dev->stats_lock); -+ spin_lock_irq(&dev->stats_lock); - dev->num_resets++; -- spin_unlock(&dev->stats_lock); -+ spin_unlock_irq(&dev->stats_lock); - - DEBUG_LR("LUN_RESET: %s for [%s] Complete\n", - (preempt_and_abort_list) ? "Preempt" : "TMR", -diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c -index 9583b23..beaf8fa 100644 ---- a/drivers/target/target_core_transport.c -+++ b/drivers/target/target_core_transport.c -@@ -762,7 +762,6 @@ static void transport_lun_remove_cmd(struct se_cmd *cmd) - transport_all_task_dev_remove_state(cmd); - spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags); - -- transport_free_dev_tasks(cmd); - - check_lun: - spin_lock_irqsave(&lun->lun_cmd_lock, flags); -@@ -1195,6 +1194,7 @@ transport_get_task_from_execute_queue(struct se_device *dev) - break; - - list_del(&task->t_execute_list); -+ atomic_set(&task->task_execute_queue, 0); - atomic_dec(&dev->execute_tasks); - - return task; -@@ -1210,8 +1210,14 @@ void transport_remove_task_from_execute_queue( - { - unsigned long flags; - -+ if (atomic_read(&task->task_execute_queue) == 0) { -+ dump_stack(); -+ return; -+ } -+ - spin_lock_irqsave(&dev->execute_task_lock, flags); - list_del(&task->t_execute_list); -+ atomic_set(&task->task_execute_queue, 0); - atomic_dec(&dev->execute_tasks); - spin_unlock_irqrestore(&dev->execute_task_lock, flags); - } -@@ -2058,6 +2064,13 @@ int transport_generic_handle_tmr( - } - EXPORT_SYMBOL(transport_generic_handle_tmr); - -+void transport_generic_free_cmd_intr( -+ struct se_cmd *cmd) -+{ -+ transport_add_cmd_to_queue(cmd, TRANSPORT_FREE_CMD_INTR); -+} -+EXPORT_SYMBOL(transport_generic_free_cmd_intr); -+ - static int transport_stop_tasks_for_cmd(struct se_cmd *cmd) - { - struct se_task *task, *task_tmp; -@@ -4776,18 +4789,20 @@ void transport_do_task_sg_chain(struct se_cmd *cmd) - sg_end_cur->page_link &= ~0x02; - - sg_chain(sg_head, task_sg_num, sg_head_cur); -- sg_count += (task->task_sg_num + 1); -- } else - sg_count += task->task_sg_num; -+ task_sg_num = (task->task_sg_num + 1); -+ } else { -+ sg_chain(sg_head, task_sg_num, sg_head_cur); -+ sg_count += task->task_sg_num; -+ task_sg_num = task->task_sg_num; -+ } - - sg_head = sg_head_cur; - sg_link = sg_link_cur; -- task_sg_num = task->task_sg_num; - continue; - } - sg_head = sg_first = &task->task_sg[0]; - sg_link = &task->task_sg[task->task_sg_num]; -- task_sg_num = task->task_sg_num; - /* - * Check for single task.. - */ -@@ -4798,9 +4813,12 @@ void transport_do_task_sg_chain(struct se_cmd *cmd) - */ - sg_end = &task->task_sg[task->task_sg_num - 1]; - sg_end->page_link &= ~0x02; -- sg_count += (task->task_sg_num + 1); -- } else - sg_count += task->task_sg_num; -+ task_sg_num = (task->task_sg_num + 1); -+ } else { -+ sg_count += task->task_sg_num; -+ task_sg_num = task->task_sg_num; -+ } - } - /* - * Setup the starting pointer and total t_tasks_sg_linked_no including -@@ -4809,21 +4827,20 @@ void transport_do_task_sg_chain(struct se_cmd *cmd) - T_TASK(cmd)->t_tasks_sg_chained = sg_first; - T_TASK(cmd)->t_tasks_sg_chained_no = sg_count; - -- DEBUG_CMD_M("Setup T_TASK(cmd)->t_tasks_sg_chained: %p and" -- " t_tasks_sg_chained_no: %u\n", T_TASK(cmd)->t_tasks_sg_chained, -+ DEBUG_CMD_M("Setup cmd: %p T_TASK(cmd)->t_tasks_sg_chained: %p and" -+ " t_tasks_sg_chained_no: %u\n", cmd, T_TASK(cmd)->t_tasks_sg_chained, - T_TASK(cmd)->t_tasks_sg_chained_no); - - for_each_sg(T_TASK(cmd)->t_tasks_sg_chained, sg, - T_TASK(cmd)->t_tasks_sg_chained_no, i) { - -- DEBUG_CMD_M("SG: %p page: %p length: %d offset: %d\n", -- sg, sg_page(sg), sg->length, sg->offset); -+ DEBUG_CMD_M("SG[%d]: %p page: %p length: %d offset: %d, magic: 0x%08x\n", -+ i, sg, sg_page(sg), sg->length, sg->offset, sg->sg_magic); - if (sg_is_chain(sg)) - DEBUG_CMD_M("SG: %p sg_is_chain=1\n", sg); - if (sg_is_last(sg)) - DEBUG_CMD_M("SG: %p sg_is_last=1\n", sg); - } -- - } - EXPORT_SYMBOL(transport_do_task_sg_chain); - -@@ -5297,6 +5314,8 @@ void transport_generic_free_cmd( - if (wait_for_tasks && cmd->transport_wait_for_tasks) - cmd->transport_wait_for_tasks(cmd, 0, 0); - -+ transport_free_dev_tasks(cmd); -+ - transport_generic_remove(cmd, release_to_pool, - session_reinstatement); - } -@@ -6132,6 +6151,9 @@ get_cmd: - case TRANSPORT_REMOVE: - transport_generic_remove(cmd, 1, 0); - break; -+ case TRANSPORT_FREE_CMD_INTR: -+ transport_generic_free_cmd(cmd, 0, 1, 0); -+ break; - case TRANSPORT_PROCESS_TMR: - transport_generic_do_tmr(cmd); - break; -diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c -index e057e53..caa2535 100644 ---- a/drivers/usb/class/cdc-acm.c -+++ b/drivers/usb/class/cdc-acm.c -@@ -946,7 +946,7 @@ static int acm_probe(struct usb_interface *intf, - u8 ac_management_function = 0; - u8 call_management_function = 0; - int call_interface_num = -1; -- int data_interface_num; -+ int data_interface_num = -1; - unsigned long quirks; - int num_rx_buf; - int i; -@@ -1030,7 +1030,11 @@ next_desc: - if (!union_header) { - if (call_interface_num > 0) { - dev_dbg(&intf->dev, "No union descriptor, using call management descriptor\n"); -- data_interface = usb_ifnum_to_if(usb_dev, (data_interface_num = call_interface_num)); -+ /* quirks for Droids MuIn LCD */ -+ if (quirks & NO_DATA_INTERFACE) -+ data_interface = usb_ifnum_to_if(usb_dev, 0); -+ else -+ data_interface = usb_ifnum_to_if(usb_dev, (data_interface_num = call_interface_num)); - control_interface = intf; - } else { - if (intf->cur_altsetting->desc.bNumEndpoints != 3) { -@@ -1622,6 +1626,11 @@ static const struct usb_device_id acm_ids[] = { - .driver_info = NOT_A_MODEM, - }, - -+ /* Support for Droids MuIn LCD */ -+ { USB_DEVICE(0x04d8, 0x000b), -+ .driver_info = NO_DATA_INTERFACE, -+ }, -+ - /* control interfaces without any protocol set */ - { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM, - USB_CDC_PROTO_NONE) }, -diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h -index b4ea54d..683104a 100644 ---- a/drivers/usb/class/cdc-acm.h -+++ b/drivers/usb/class/cdc-acm.h -@@ -137,3 +137,4 @@ struct acm { - #define SINGLE_RX_URB 2 - #define NO_CAP_LINE 4 - #define NOT_A_MODEM 8 -+#define NO_DATA_INTERFACE 16 -diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c -index 77a7fae..cddc533 100644 ---- a/drivers/usb/core/hcd.c -+++ b/drivers/usb/core/hcd.c -@@ -986,7 +986,7 @@ static int register_root_hub(struct usb_hcd *hcd) - spin_unlock_irq (&hcd_root_hub_lock); - - /* Did the HC die before the root hub was registered? */ -- if (HCD_DEAD(hcd) || hcd->state == HC_STATE_HALT) -+ if (HCD_DEAD(hcd)) - usb_hc_died (hcd); /* This time clean up */ - } - -@@ -2128,9 +2128,6 @@ irqreturn_t usb_hcd_irq (int irq, void *__hcd) - set_bit(HCD_FLAG_SAW_IRQ, &hcd->flags); - if (hcd->shared_hcd) - set_bit(HCD_FLAG_SAW_IRQ, &hcd->shared_hcd->flags); -- -- if (unlikely(hcd->state == HC_STATE_HALT)) -- usb_hc_died(hcd); - rc = IRQ_HANDLED; - } - -diff --git a/drivers/usb/gadget/at91_udc.c b/drivers/usb/gadget/at91_udc.c -index 9b7cdb1..41dc093 100644 ---- a/drivers/usb/gadget/at91_udc.c -+++ b/drivers/usb/gadget/at91_udc.c -@@ -1767,7 +1767,7 @@ static int __init at91udc_probe(struct platform_device *pdev) - } - - /* newer chips have more FIFO memory than rm9200 */ -- if (cpu_is_at91sam9260()) { -+ if (cpu_is_at91sam9260() || cpu_is_at91sam9g20()) { - udc->ep[0].maxpacket = 64; - udc->ep[3].maxpacket = 64; - udc->ep[4].maxpacket = 512; -diff --git a/drivers/usb/gadget/f_rndis.c b/drivers/usb/gadget/f_rndis.c -index 882484a..fa12ec8 100644 ---- a/drivers/usb/gadget/f_rndis.c -+++ b/drivers/usb/gadget/f_rndis.c -@@ -420,8 +420,7 @@ rndis_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl) - */ - case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8) - | USB_CDC_SEND_ENCAPSULATED_COMMAND: -- if (w_length > req->length || w_value -- || w_index != rndis->ctrl_id) -+ if (w_value || w_index != rndis->ctrl_id) - goto invalid; - /* read the request; process it later */ - value = w_length; -diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c -index 78561d1..c606b02 100644 ---- a/drivers/usb/host/ehci-hcd.c -+++ b/drivers/usb/host/ehci-hcd.c -@@ -777,8 +777,9 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd) - goto dead; - } - -+ /* Shared IRQ? */ - masked_status = status & INTR_MASK; -- if (!masked_status) { /* irq sharing? */ -+ if (!masked_status || unlikely(hcd->state == HC_STATE_HALT)) { - spin_unlock(&ehci->lock); - return IRQ_NONE; - } -@@ -873,6 +874,7 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd) - dead: - ehci_reset(ehci); - ehci_writel(ehci, 0, &ehci->regs->configured_flag); -+ usb_hc_died(hcd); - /* generic layer kills/unlinks all urbs, then - * uses ehci_stop to clean up the rest - */ -diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c -index 1543c83..d12426f 100644 ---- a/drivers/usb/host/ehci-sched.c -+++ b/drivers/usb/host/ehci-sched.c -@@ -471,8 +471,10 @@ static int enable_periodic (struct ehci_hcd *ehci) - */ - status = handshake_on_error_set_halt(ehci, &ehci->regs->status, - STS_PSS, 0, 9 * 125); -- if (status) -+ if (status) { -+ usb_hc_died(ehci_to_hcd(ehci)); - return status; -+ } - - cmd = ehci_readl(ehci, &ehci->regs->command) | CMD_PSE; - ehci_writel(ehci, cmd, &ehci->regs->command); -@@ -510,8 +512,10 @@ static int disable_periodic (struct ehci_hcd *ehci) - */ - status = handshake_on_error_set_halt(ehci, &ehci->regs->status, - STS_PSS, STS_PSS, 9 * 125); -- if (status) -+ if (status) { -+ usb_hc_died(ehci_to_hcd(ehci)); - return status; -+ } - - cmd = ehci_readl(ehci, &ehci->regs->command) & ~CMD_PSE; - ehci_writel(ehci, cmd, &ehci->regs->command); -diff --git a/drivers/usb/host/isp116x-hcd.c b/drivers/usb/host/isp116x-hcd.c -index c0e22f2..baae4cc 100644 ---- a/drivers/usb/host/isp116x-hcd.c -+++ b/drivers/usb/host/isp116x-hcd.c -@@ -612,6 +612,7 @@ static irqreturn_t isp116x_irq(struct usb_hcd *hcd) - /* IRQ's are off, we do no DMA, - perfectly ready to die ... */ - hcd->state = HC_STATE_HALT; -+ usb_hc_died(hcd); - ret = IRQ_HANDLED; - goto done; - } -diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c -index d557235..c001fff 100644 ---- a/drivers/usb/host/ohci-hcd.c -+++ b/drivers/usb/host/ohci-hcd.c -@@ -764,6 +764,7 @@ static irqreturn_t ohci_irq (struct usb_hcd *hcd) - if (ints == ~(u32)0) { - disable (ohci); - ohci_dbg (ohci, "device removed!\n"); -+ usb_hc_died(hcd); - return IRQ_HANDLED; - } - -@@ -771,7 +772,7 @@ static irqreturn_t ohci_irq (struct usb_hcd *hcd) - ints &= ohci_readl(ohci, ®s->intrenable); - - /* interrupt for some other device? */ -- if (ints == 0) -+ if (ints == 0 || unlikely(hcd->state == HC_STATE_HALT)) - return IRQ_NOTMINE; - - if (ints & OHCI_INTR_UE) { -@@ -788,6 +789,7 @@ static irqreturn_t ohci_irq (struct usb_hcd *hcd) - } else { - disable (ohci); - ohci_err (ohci, "OHCI Unrecoverable Error, disabled\n"); -+ usb_hc_died(hcd); - } - - ohci_dump (ohci, 1); -diff --git a/drivers/usb/host/ohci-pci.c b/drivers/usb/host/ohci-pci.c -index d84d6f0..ad8166c 100644 ---- a/drivers/usb/host/ohci-pci.c -+++ b/drivers/usb/host/ohci-pci.c -@@ -181,10 +181,18 @@ static int ohci_quirk_amd700(struct usb_hcd *hcd) - */ - static int ohci_quirk_nvidia_shutdown(struct usb_hcd *hcd) - { -+ struct pci_dev *pdev = to_pci_dev(hcd->self.controller); - struct ohci_hcd *ohci = hcd_to_ohci(hcd); - -- ohci->flags |= OHCI_QUIRK_SHUTDOWN; -- ohci_dbg(ohci, "enabled nVidia shutdown quirk\n"); -+ /* Evidently nVidia fixed their later hardware; this is a guess at -+ * the changeover point. -+ */ -+#define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP51_USB 0x026d -+ -+ if (pdev->device < PCI_DEVICE_ID_NVIDIA_NFORCE_MCP51_USB) { -+ ohci->flags |= OHCI_QUIRK_SHUTDOWN; -+ ohci_dbg(ohci, "enabled nVidia shutdown quirk\n"); -+ } - - return 0; - } -diff --git a/drivers/usb/host/oxu210hp-hcd.c b/drivers/usb/host/oxu210hp-hcd.c -index 4a771f6..5fbe997 100644 ---- a/drivers/usb/host/oxu210hp-hcd.c -+++ b/drivers/usb/host/oxu210hp-hcd.c -@@ -1884,6 +1884,7 @@ static int enable_periodic(struct oxu_hcd *oxu) - status = handshake(oxu, &oxu->regs->status, STS_PSS, 0, 9 * 125); - if (status != 0) { - oxu_to_hcd(oxu)->state = HC_STATE_HALT; -+ usb_hc_died(oxu_to_hcd(oxu)); - return status; - } - -@@ -1909,6 +1910,7 @@ static int disable_periodic(struct oxu_hcd *oxu) - status = handshake(oxu, &oxu->regs->status, STS_PSS, STS_PSS, 9 * 125); - if (status != 0) { - oxu_to_hcd(oxu)->state = HC_STATE_HALT; -+ usb_hc_died(oxu_to_hcd(oxu)); - return status; - } - -@@ -2449,8 +2451,9 @@ static irqreturn_t oxu210_hcd_irq(struct usb_hcd *hcd) - goto dead; - } - -+ /* Shared IRQ? */ - status &= INTR_MASK; -- if (!status) { /* irq sharing? */ -+ if (!status || unlikely(hcd->state == HC_STATE_HALT)) { - spin_unlock(&oxu->lock); - return IRQ_NONE; - } -@@ -2516,6 +2519,7 @@ static irqreturn_t oxu210_hcd_irq(struct usb_hcd *hcd) - dead: - ehci_reset(oxu); - writel(0, &oxu->regs->configured_flag); -+ usb_hc_died(hcd); - /* generic layer kills/unlinks all urbs, then - * uses oxu_stop to clean up the rest - */ -diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c -index 627f343..783e5e0 100644 ---- a/drivers/usb/host/xhci-mem.c -+++ b/drivers/usb/host/xhci-mem.c -@@ -207,14 +207,13 @@ void xhci_free_or_cache_endpoint_ring(struct xhci_hcd *xhci, - - rings_cached = virt_dev->num_rings_cached; - if (rings_cached < XHCI_MAX_RINGS_CACHED) { -- virt_dev->num_rings_cached++; -- rings_cached = virt_dev->num_rings_cached; - virt_dev->ring_cache[rings_cached] = - virt_dev->eps[ep_index].ring; -+ virt_dev->num_rings_cached++; - xhci_dbg(xhci, "Cached old ring, " - "%d ring%s cached\n", -- rings_cached, -- (rings_cached > 1) ? "s" : ""); -+ virt_dev->num_rings_cached, -+ (virt_dev->num_rings_cached > 1) ? "s" : ""); - } else { - xhci_ring_free(xhci, virt_dev->eps[ep_index].ring); - xhci_dbg(xhci, "Ring cache full (%d rings), " -@@ -1046,12 +1045,12 @@ static unsigned int xhci_get_endpoint_interval(struct usb_device *udev, - break; - - case USB_SPEED_FULL: -- if (usb_endpoint_xfer_int(&ep->desc)) { -+ if (usb_endpoint_xfer_isoc(&ep->desc)) { - interval = xhci_parse_exponent_interval(udev, ep); - break; - } - /* -- * Fall through for isochronous endpoint interval decoding -+ * Fall through for interrupt endpoint interval decoding - * since it uses the same rules as low speed interrupt - * endpoints. - */ -diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c -index 7437386..078b566 100644 ---- a/drivers/usb/host/xhci-ring.c -+++ b/drivers/usb/host/xhci-ring.c -@@ -1632,6 +1632,9 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td, - else - *status = 0; - break; -+ case COMP_STOP_INVAL: -+ case COMP_STOP: -+ return finish_td(xhci, td, event_trb, event, ep, status, false); - default: - if (!xhci_requires_manual_halt_cleanup(xhci, - ep_ctx, trb_comp_code)) -@@ -1676,15 +1679,12 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td, - } - } else { - /* Maybe the event was for the data stage? */ -- if (trb_comp_code != COMP_STOP_INVAL) { -- /* We didn't stop on a link TRB in the middle */ -- td->urb->actual_length = -- td->urb->transfer_buffer_length - -- TRB_LEN(event->transfer_len); -- xhci_dbg(xhci, "Waiting for status " -- "stage event\n"); -- return 0; -- } -+ td->urb->actual_length = -+ td->urb->transfer_buffer_length - -+ TRB_LEN(le32_to_cpu(event->transfer_len)); -+ xhci_dbg(xhci, "Waiting for status " -+ "stage event\n"); -+ return 0; - } - } - -diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c -index 81b976e..d2cd3ce 100644 ---- a/drivers/usb/host/xhci.c -+++ b/drivers/usb/host/xhci.c -@@ -1692,8 +1692,17 @@ int xhci_check_bandwidth(struct usb_hcd *hcd, struct usb_device *udev) - xhci_dbg_ctx(xhci, virt_dev->out_ctx, - LAST_CTX_TO_EP_NUM(slot_ctx->dev_info)); - -+ /* Free any rings that were dropped, but not changed. */ -+ for (i = 1; i < 31; ++i) { -+ if ((ctrl_ctx->drop_flags & (1 << (i + 1))) && -+ !(ctrl_ctx->add_flags & (1 << (i + 1)))) -+ xhci_free_or_cache_endpoint_ring(xhci, virt_dev, i); -+ } - xhci_zero_in_ctx(xhci, virt_dev); -- /* Install new rings and free or cache any old rings */ -+ /* -+ * Install any rings for completely new endpoints or changed endpoints, -+ * and free or cache any old rings from changed endpoints. -+ */ - for (i = 1; i < 31; ++i) { - if (!virt_dev->eps[i].new_ring) - continue; -diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c -index 0f11afd..ebeccb7 100644 ---- a/drivers/usb/serial/cp210x.c -+++ b/drivers/usb/serial/cp210x.c -@@ -112,6 +112,10 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(0x10C4, 0x8418) }, /* IRZ Automation Teleport SG-10 GSM/GPRS Modem */ - { USB_DEVICE(0x10C4, 0x846E) }, /* BEI USB Sensor Interface (VCP) */ - { USB_DEVICE(0x10C4, 0x8477) }, /* Balluff RFID */ -+ { USB_DEVICE(0x10C4, 0x85EA) }, /* AC-Services IBUS-IF */ -+ { USB_DEVICE(0x10C4, 0x85EB) }, /* AC-Services CIS-IBUS */ -+ { USB_DEVICE(0x10C4, 0x8664) }, /* AC-Services CAN-IF */ -+ { USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */ - { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */ - { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */ - { USB_DEVICE(0x10C4, 0xEA71) }, /* Infinity GPS-MIC-1 Radio Monophone */ -diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c -index 4de6ef0..e8dbde5 100644 ---- a/drivers/usb/serial/ftdi_sio.c -+++ b/drivers/usb/serial/ftdi_sio.c -@@ -566,6 +566,7 @@ static struct usb_device_id id_table_combined [] = { - { USB_DEVICE(FTDI_VID, FTDI_IBS_APP70_PID) }, - { USB_DEVICE(FTDI_VID, FTDI_IBS_PEDO_PID) }, - { USB_DEVICE(FTDI_VID, FTDI_IBS_PROD_PID) }, -+ { USB_DEVICE(FTDI_VID, FTDI_TAVIR_STK500_PID) }, - /* - * ELV devices: - */ -diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h -index efffc23..1d946cd 100644 ---- a/drivers/usb/serial/ftdi_sio_ids.h -+++ b/drivers/usb/serial/ftdi_sio_ids.h -@@ -491,6 +491,11 @@ - /* www.canusb.com Lawicel CANUSB device (FTDI_VID) */ - #define FTDI_CANUSB_PID 0xFFA8 /* Product Id */ - -+/* -+ * TavIR AVR product ids (FTDI_VID) -+ */ -+#define FTDI_TAVIR_STK500_PID 0xFA33 /* STK500 AVR programmer */ -+ - - - /********************************/ -diff --git a/drivers/usb/serial/garmin_gps.c b/drivers/usb/serial/garmin_gps.c -index 26710b1..456447e033 100644 ---- a/drivers/usb/serial/garmin_gps.c -+++ b/drivers/usb/serial/garmin_gps.c -@@ -1,7 +1,7 @@ - /* - * Garmin GPS driver - * -- * Copyright (C) 2006-2009 Hermann Kneissel herkne@users.sourceforge.net -+ * Copyright (C) 2006-2011 Hermann Kneissel herkne@gmx.de - * - * The latest version of the driver can be found at - * http://sourceforge.net/projects/garmin-gps/ -@@ -51,7 +51,7 @@ static int debug; - */ - - #define VERSION_MAJOR 0 --#define VERSION_MINOR 33 -+#define VERSION_MINOR 36 - - #define _STR(s) #s - #define _DRIVER_VERSION(a, b) "v" _STR(a) "." _STR(b) -@@ -410,6 +410,7 @@ static int gsp_send_ack(struct garmin_data *garmin_data_p, __u8 pkt_id) - */ - static int gsp_rec_packet(struct garmin_data *garmin_data_p, int count) - { -+ unsigned long flags; - const __u8 *recpkt = garmin_data_p->inbuffer+GSP_INITIAL_OFFSET; - __le32 *usbdata = (__le32 *) garmin_data_p->inbuffer; - -@@ -458,7 +459,9 @@ static int gsp_rec_packet(struct garmin_data *garmin_data_p, int count) - /* if this was an abort-transfer command, flush all - queued data. */ - if (isAbortTrfCmnd(garmin_data_p->inbuffer)) { -+ spin_lock_irqsave(&garmin_data_p->lock, flags); - garmin_data_p->flags |= FLAGS_DROP_DATA; -+ spin_unlock_irqrestore(&garmin_data_p->lock, flags); - pkt_clear(garmin_data_p); - } - -@@ -943,7 +946,7 @@ static int garmin_open(struct tty_struct *tty, struct usb_serial_port *port) - spin_lock_irqsave(&garmin_data_p->lock, flags); - garmin_data_p->mode = initial_mode; - garmin_data_p->count = 0; -- garmin_data_p->flags = 0; -+ garmin_data_p->flags &= FLAGS_SESSION_REPLY1_SEEN; - spin_unlock_irqrestore(&garmin_data_p->lock, flags); - - /* shutdown any bulk reads that might be going on */ -@@ -1178,7 +1181,8 @@ static int garmin_write_room(struct tty_struct *tty) - - - static void garmin_read_process(struct garmin_data *garmin_data_p, -- unsigned char *data, unsigned data_length) -+ unsigned char *data, unsigned data_length, -+ int bulk_data) - { - unsigned long flags; - -@@ -1193,7 +1197,8 @@ static void garmin_read_process(struct garmin_data *garmin_data_p, - send it directly to the tty port */ - if (garmin_data_p->flags & FLAGS_QUEUING) { - pkt_add(garmin_data_p, data, data_length); -- } else if (getLayerId(data) == GARMIN_LAYERID_APPL) { -+ } else if (bulk_data || -+ getLayerId(data) == GARMIN_LAYERID_APPL) { - - spin_lock_irqsave(&garmin_data_p->lock, flags); - garmin_data_p->flags |= APP_RESP_SEEN; -@@ -1237,7 +1242,7 @@ static void garmin_read_bulk_callback(struct urb *urb) - usb_serial_debug_data(debug, &port->dev, - __func__, urb->actual_length, data); - -- garmin_read_process(garmin_data_p, data, urb->actual_length); -+ garmin_read_process(garmin_data_p, data, urb->actual_length, 1); - - if (urb->actual_length == 0 && - 0 != (garmin_data_p->flags & FLAGS_BULK_IN_RESTART)) { -@@ -1346,7 +1351,7 @@ static void garmin_read_int_callback(struct urb *urb) - __func__, garmin_data_p->serial_num); - } - -- garmin_read_process(garmin_data_p, data, urb->actual_length); -+ garmin_read_process(garmin_data_p, data, urb->actual_length, 0); - - port->interrupt_in_urb->dev = port->serial->dev; - retval = usb_submit_urb(urb, GFP_ATOMIC); -@@ -1461,6 +1466,7 @@ static int garmin_attach(struct usb_serial *serial) - garmin_data_p->timer.function = timeout_handler; - garmin_data_p->port = port; - garmin_data_p->state = 0; -+ garmin_data_p->flags = 0; - garmin_data_p->count = 0; - usb_set_serial_port_data(port, garmin_data_p); - -diff --git a/drivers/usb/serial/moto_modem.c b/drivers/usb/serial/moto_modem.c -index 653465f..e2bfecc 100644 ---- a/drivers/usb/serial/moto_modem.c -+++ b/drivers/usb/serial/moto_modem.c -@@ -25,6 +25,7 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(0x05c6, 0x3197) }, /* unknown Motorola phone */ - { USB_DEVICE(0x0c44, 0x0022) }, /* unknown Mororola phone */ - { USB_DEVICE(0x22b8, 0x2a64) }, /* Motorola KRZR K1m */ -+ { USB_DEVICE(0x22b8, 0x2c84) }, /* Motorola VE240 phone */ - { USB_DEVICE(0x22b8, 0x2c64) }, /* Motorola V950 phone */ - { }, - }; -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index d77ff04..318dd00 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -149,6 +149,7 @@ static void option_instat_callback(struct urb *urb); - #define HUAWEI_PRODUCT_K3765 0x1465 - #define HUAWEI_PRODUCT_E14AC 0x14AC - #define HUAWEI_PRODUCT_ETS1220 0x1803 -+#define HUAWEI_PRODUCT_E353 0x1506 - - #define QUANTA_VENDOR_ID 0x0408 - #define QUANTA_PRODUCT_Q101 0xEA02 -@@ -532,6 +533,7 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3765, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_ETS1220, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E14AC, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E353, 0xff, 0x01, 0x01) }, - { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V640) }, - { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V620) }, - { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V740) }, -@@ -972,7 +974,7 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) }, - { USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */ - { USB_DEVICE(ONDA_VENDOR_ID, ONDA_MT825UP) }, /* ONDA MT825UP modem */ -- { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730/GT-B3710 LTE USB modem.*/ -+ { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/ - { } /* Terminating entry */ - }; - MODULE_DEVICE_TABLE(usb, option_ids); -@@ -1109,6 +1111,12 @@ static int option_probe(struct usb_serial *serial, - serial->interface->cur_altsetting->desc.bInterfaceNumber == 1) - return -ENODEV; - -+ /* Don't bind network interface on Samsung GT-B3730, it is handled by a separate module */ -+ if (serial->dev->descriptor.idVendor == SAMSUNG_VENDOR_ID && -+ serial->dev->descriptor.idProduct == SAMSUNG_PRODUCT_GT_B3730 && -+ serial->interface->cur_altsetting->desc.bInterfaceClass != USB_CLASS_CDC_DATA) -+ return -ENODEV; -+ - data = serial->private = kzalloc(sizeof(struct usb_wwan_intf_private), GFP_KERNEL); - - if (!data) -diff --git a/drivers/usb/storage/unusual_realtek.h b/drivers/usb/storage/unusual_realtek.h -index 3236e03..e41f50c 100644 ---- a/drivers/usb/storage/unusual_realtek.h -+++ b/drivers/usb/storage/unusual_realtek.h -@@ -23,19 +23,19 @@ - #if defined(CONFIG_USB_STORAGE_REALTEK) || \ - defined(CONFIG_USB_STORAGE_REALTEK_MODULE) - --UNUSUAL_DEV(0x0bda, 0x0159, 0x0000, 0x9999, -+UNUSUAL_DEV(0x0bda, 0x0138, 0x0000, 0x9999, - "Realtek", - "USB Card Reader", -- USB_SC_SCSI, USB_PR_BULK, init_realtek_cr, 0), -+ USB_SC_DEVICE, USB_PR_DEVICE, init_realtek_cr, 0), - - UNUSUAL_DEV(0x0bda, 0x0158, 0x0000, 0x9999, - "Realtek", - "USB Card Reader", -- USB_SC_SCSI, USB_PR_BULK, init_realtek_cr, 0), -+ USB_SC_DEVICE, USB_PR_DEVICE, init_realtek_cr, 0), - --UNUSUAL_DEV(0x0bda, 0x0138, 0x0000, 0x9999, -+UNUSUAL_DEV(0x0bda, 0x0159, 0x0000, 0x9999, - "Realtek", - "USB Card Reader", -- USB_SC_SCSI, USB_PR_BULK, init_realtek_cr, 0), -+ USB_SC_DEVICE, USB_PR_DEVICE, init_realtek_cr, 0), - - #endif /* defined(CONFIG_USB_STORAGE_REALTEK) || ... */ -diff --git a/fs/block_dev.c b/fs/block_dev.c -index 257b00e..1f2b199 100644 ---- a/fs/block_dev.c -+++ b/fs/block_dev.c -@@ -1120,6 +1120,15 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part) - goto restart; - } - } -+ -+ if (!ret && !bdev->bd_openers) { -+ bd_set_size(bdev,(loff_t)get_capacity(disk)<<9); -+ bdi = blk_get_backing_dev_info(bdev); -+ if (bdi == NULL) -+ bdi = &default_backing_dev_info; -+ bdev_inode_switch_bdi(bdev->bd_inode, bdi); -+ } -+ - /* - * If the device is invalidated, rescan partition - * if open succeeded or failed with -ENOMEDIUM. -@@ -1130,14 +1139,6 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part) - rescan_partitions(disk, bdev); - if (ret) - goto out_clear; -- -- if (!bdev->bd_openers) { -- bd_set_size(bdev,(loff_t)get_capacity(disk)<<9); -- bdi = blk_get_backing_dev_info(bdev); -- if (bdi == NULL) -- bdi = &default_backing_dev_info; -- bdev_inode_switch_bdi(bdev->bd_inode, bdi); -- } - } else { - struct block_device *whole; - whole = bdget_disk(disk, 0); -@@ -1237,6 +1238,8 @@ int blkdev_get(struct block_device *bdev, fmode_t mode, void *holder) - res = __blkdev_get(bdev, mode, 0); - - if (whole) { -+ struct gendisk *disk = whole->bd_disk; -+ - /* finish claiming */ - mutex_lock(&bdev->bd_mutex); - spin_lock(&bdev_lock); -@@ -1263,15 +1266,16 @@ int blkdev_get(struct block_device *bdev, fmode_t mode, void *holder) - spin_unlock(&bdev_lock); - - /* -- * Block event polling for write claims. Any write -- * holder makes the write_holder state stick until all -- * are released. This is good enough and tracking -- * individual writeable reference is too fragile given -- * the way @mode is used in blkdev_get/put(). -+ * Block event polling for write claims if requested. Any -+ * write holder makes the write_holder state stick until -+ * all are released. This is good enough and tracking -+ * individual writeable reference is too fragile given the -+ * way @mode is used in blkdev_get/put(). - */ -- if (!res && (mode & FMODE_WRITE) && !bdev->bd_write_holder) { -+ if ((disk->flags & GENHD_FL_BLOCK_EVENTS_ON_EXCL_WRITE) && -+ !res && (mode & FMODE_WRITE) && !bdev->bd_write_holder) { - bdev->bd_write_holder = true; -- disk_block_events(bdev->bd_disk); -+ disk_block_events(disk); - } - - mutex_unlock(&bdev->bd_mutex); -diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c -index 277262a..29fac128 100644 ---- a/fs/cifs/connect.c -+++ b/fs/cifs/connect.c -@@ -2447,7 +2447,7 @@ void reset_cifs_unix_caps(int xid, struct cifsTconInfo *tcon, - - if (!CIFSSMBQFSUnixInfo(xid, tcon)) { - __u64 cap = le64_to_cpu(tcon->fsUnixInfo.Capability); -- -+ cFYI(1, "unix caps which server supports %lld", cap); - /* check for reconnect case in which we do not - want to change the mount behavior if we can avoid it */ - if (vol_info == NULL) { -@@ -2465,6 +2465,9 @@ void reset_cifs_unix_caps(int xid, struct cifsTconInfo *tcon, - } - } - -+ if (cap & CIFS_UNIX_TRANSPORT_ENCRYPTION_MANDATORY_CAP) -+ cERROR(1, "per-share encryption not supported yet"); -+ - cap &= CIFS_UNIX_CAP_MASK; - if (vol_info && vol_info->no_psx_acl) - cap &= ~CIFS_UNIX_POSIX_ACL_CAP; -@@ -2513,6 +2516,10 @@ void reset_cifs_unix_caps(int xid, struct cifsTconInfo *tcon, - cFYI(1, "very large read cap"); - if (cap & CIFS_UNIX_LARGE_WRITE_CAP) - cFYI(1, "very large write cap"); -+ if (cap & CIFS_UNIX_TRANSPORT_ENCRYPTION_CAP) -+ cFYI(1, "transport encryption cap"); -+ if (cap & CIFS_UNIX_TRANSPORT_ENCRYPTION_MANDATORY_CAP) -+ cFYI(1, "mandatory transport encryption cap"); - #endif /* CIFS_DEBUG2 */ - if (CIFSSMBSetFSUnixInfo(xid, tcon, cap)) { - if (vol_info == NULL) { -@@ -2831,20 +2838,26 @@ try_mount_again: - goto remote_path_check; - } - -- /* do not care if following two calls succeed - informational */ -- if (!tcon->ipc) { -- CIFSSMBQFSDeviceInfo(xid, tcon); -- CIFSSMBQFSAttributeInfo(xid, tcon); -- } -- - /* tell server which Unix caps we support */ -- if (tcon->ses->capabilities & CAP_UNIX) -+ if (tcon->ses->capabilities & CAP_UNIX) { - /* reset of caps checks mount to see if unix extensions - disabled for just this mount */ - reset_cifs_unix_caps(xid, tcon, sb, volume_info); -- else -+ if ((tcon->ses->server->tcpStatus == CifsNeedReconnect) && -+ (le64_to_cpu(tcon->fsUnixInfo.Capability) & -+ CIFS_UNIX_TRANSPORT_ENCRYPTION_MANDATORY_CAP)) { -+ rc = -EACCES; -+ goto mount_fail_check; -+ } -+ } else - tcon->unix_ext = 0; /* server does not support them */ - -+ /* do not care if following two calls succeed - informational */ -+ if (!tcon->ipc) { -+ CIFSSMBQFSDeviceInfo(xid, tcon); -+ CIFSSMBQFSAttributeInfo(xid, tcon); -+ } -+ - /* convert forward to back slashes in prepath here if needed */ - if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS) == 0) - convert_delimiter(cifs_sb->prepath, CIFS_DIR_SEP(cifs_sb)); -diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c -index 4d4cc6a..94ab3c0 100644 ---- a/fs/ecryptfs/inode.c -+++ b/fs/ecryptfs/inode.c -@@ -527,6 +527,8 @@ static int ecryptfs_rmdir(struct inode *dir, struct dentry *dentry) - dget(lower_dentry); - rc = vfs_rmdir(lower_dir_dentry->d_inode, lower_dentry); - dput(lower_dentry); -+ if (!rc && dentry->d_inode) -+ clear_nlink(dentry->d_inode); - fsstack_copy_attr_times(dir, lower_dir_dentry->d_inode); - dir->i_nlink = lower_dir_dentry->d_inode->i_nlink; - unlock_dir(lower_dir_dentry); -diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c -index 03e609c..27a7fef 100644 ---- a/fs/ecryptfs/keystore.c -+++ b/fs/ecryptfs/keystore.c -@@ -599,8 +599,8 @@ struct ecryptfs_write_tag_70_packet_silly_stack { - struct mutex *tfm_mutex; - char *block_aligned_filename; - struct ecryptfs_auth_tok *auth_tok; -- struct scatterlist src_sg; -- struct scatterlist dst_sg; -+ struct scatterlist src_sg[2]; -+ struct scatterlist dst_sg[2]; - struct blkcipher_desc desc; - char iv[ECRYPTFS_MAX_IV_BYTES]; - char hash[ECRYPTFS_TAG_70_DIGEST_SIZE]; -@@ -816,23 +816,21 @@ ecryptfs_write_tag_70_packet(char *dest, size_t *remaining_bytes, - memcpy(&s->block_aligned_filename[s->num_rand_bytes], filename, - filename_size); - rc = virt_to_scatterlist(s->block_aligned_filename, -- s->block_aligned_filename_size, &s->src_sg, 1); -- if (rc != 1) { -+ s->block_aligned_filename_size, s->src_sg, 2); -+ if (rc < 1) { - printk(KERN_ERR "%s: Internal error whilst attempting to " -- "convert filename memory to scatterlist; " -- "expected rc = 1; got rc = [%d]. " -+ "convert filename memory to scatterlist; rc = [%d]. " - "block_aligned_filename_size = [%zd]\n", __func__, rc, - s->block_aligned_filename_size); - goto out_release_free_unlock; - } - rc = virt_to_scatterlist(&dest[s->i], s->block_aligned_filename_size, -- &s->dst_sg, 1); -- if (rc != 1) { -+ s->dst_sg, 2); -+ if (rc < 1) { - printk(KERN_ERR "%s: Internal error whilst attempting to " - "convert encrypted filename memory to scatterlist; " -- "expected rc = 1; got rc = [%d]. " -- "block_aligned_filename_size = [%zd]\n", __func__, rc, -- s->block_aligned_filename_size); -+ "rc = [%d]. block_aligned_filename_size = [%zd]\n", -+ __func__, rc, s->block_aligned_filename_size); - goto out_release_free_unlock; - } - /* The characters in the first block effectively do the job -@@ -855,7 +853,7 @@ ecryptfs_write_tag_70_packet(char *dest, size_t *remaining_bytes, - mount_crypt_stat->global_default_fn_cipher_key_bytes); - goto out_release_free_unlock; - } -- rc = crypto_blkcipher_encrypt_iv(&s->desc, &s->dst_sg, &s->src_sg, -+ rc = crypto_blkcipher_encrypt_iv(&s->desc, s->dst_sg, s->src_sg, - s->block_aligned_filename_size); - if (rc) { - printk(KERN_ERR "%s: Error attempting to encrypt filename; " -@@ -891,8 +889,8 @@ struct ecryptfs_parse_tag_70_packet_silly_stack { - struct mutex *tfm_mutex; - char *decrypted_filename; - struct ecryptfs_auth_tok *auth_tok; -- struct scatterlist src_sg; -- struct scatterlist dst_sg; -+ struct scatterlist src_sg[2]; -+ struct scatterlist dst_sg[2]; - struct blkcipher_desc desc; - char fnek_sig_hex[ECRYPTFS_SIG_SIZE_HEX + 1]; - char iv[ECRYPTFS_MAX_IV_BYTES]; -@@ -1008,13 +1006,12 @@ ecryptfs_parse_tag_70_packet(char **filename, size_t *filename_size, - } - mutex_lock(s->tfm_mutex); - rc = virt_to_scatterlist(&data[(*packet_size)], -- s->block_aligned_filename_size, &s->src_sg, 1); -- if (rc != 1) { -+ s->block_aligned_filename_size, s->src_sg, 2); -+ if (rc < 1) { - printk(KERN_ERR "%s: Internal error whilst attempting to " - "convert encrypted filename memory to scatterlist; " -- "expected rc = 1; got rc = [%d]. " -- "block_aligned_filename_size = [%zd]\n", __func__, rc, -- s->block_aligned_filename_size); -+ "rc = [%d]. block_aligned_filename_size = [%zd]\n", -+ __func__, rc, s->block_aligned_filename_size); - goto out_unlock; - } - (*packet_size) += s->block_aligned_filename_size; -@@ -1028,13 +1025,12 @@ ecryptfs_parse_tag_70_packet(char **filename, size_t *filename_size, - goto out_unlock; - } - rc = virt_to_scatterlist(s->decrypted_filename, -- s->block_aligned_filename_size, &s->dst_sg, 1); -- if (rc != 1) { -+ s->block_aligned_filename_size, s->dst_sg, 2); -+ if (rc < 1) { - printk(KERN_ERR "%s: Internal error whilst attempting to " - "convert decrypted filename memory to scatterlist; " -- "expected rc = 1; got rc = [%d]. " -- "block_aligned_filename_size = [%zd]\n", __func__, rc, -- s->block_aligned_filename_size); -+ "rc = [%d]. block_aligned_filename_size = [%zd]\n", -+ __func__, rc, s->block_aligned_filename_size); - goto out_free_unlock; - } - /* The characters in the first block effectively do the job of -@@ -1065,7 +1061,7 @@ ecryptfs_parse_tag_70_packet(char **filename, size_t *filename_size, - mount_crypt_stat->global_default_fn_cipher_key_bytes); - goto out_free_unlock; - } -- rc = crypto_blkcipher_decrypt_iv(&s->desc, &s->dst_sg, &s->src_sg, -+ rc = crypto_blkcipher_decrypt_iv(&s->desc, s->dst_sg, s->src_sg, - s->block_aligned_filename_size); - if (rc) { - printk(KERN_ERR "%s: Error attempting to decrypt filename; " -diff --git a/fs/ext3/namei.c b/fs/ext3/namei.c -index 32f3b86..93f9fd0 100644 ---- a/fs/ext3/namei.c -+++ b/fs/ext3/namei.c -@@ -1416,10 +1416,19 @@ static int make_indexed_dir(handle_t *handle, struct dentry *dentry, - frame->at = entries; - frame->bh = bh; - bh = bh2; -+ /* -+ * Mark buffers dirty here so that if do_split() fails we write a -+ * consistent set of buffers to disk. -+ */ -+ ext3_journal_dirty_metadata(handle, frame->bh); -+ ext3_journal_dirty_metadata(handle, bh); - de = do_split(handle,dir, &bh, frame, &hinfo, &retval); -- dx_release (frames); -- if (!(de)) -+ if (!de) { -+ ext3_mark_inode_dirty(handle, dir); -+ dx_release(frames); - return retval; -+ } -+ dx_release(frames); - - return add_dirent_to_buf(handle, dentry, inode, de, bh); - } -diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h -index 4daaf2b..1e37c09 100644 ---- a/fs/ext4/ext4.h -+++ b/fs/ext4/ext4.h -@@ -1590,12 +1590,8 @@ void ext4_get_group_no_and_offset(struct super_block *sb, ext4_fsblk_t blocknr, - */ - struct ext4_lazy_init { - unsigned long li_state; -- -- wait_queue_head_t li_wait_daemon; - wait_queue_head_t li_wait_task; -- struct timer_list li_timer; - struct task_struct *li_task; -- - struct list_head li_request_list; - struct mutex li_list_mtx; - }; -diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c -index d8a16ee..15bfa44 100644 ---- a/fs/ext4/mballoc.c -+++ b/fs/ext4/mballoc.c -@@ -1273,6 +1273,8 @@ repeat_load_buddy: - return 0; - - err: -+ if (page) -+ page_cache_release(page); - if (e4b->bd_bitmap_page) - page_cache_release(e4b->bd_bitmap_page); - if (e4b->bd_buddy_page) -diff --git a/fs/ext4/page-io.c b/fs/ext4/page-io.c -index b6dbd05..7bb8f76 100644 ---- a/fs/ext4/page-io.c -+++ b/fs/ext4/page-io.c -@@ -203,46 +203,29 @@ static void ext4_end_bio(struct bio *bio, int error) - for (i = 0; i < io_end->num_io_pages; i++) { - struct page *page = io_end->pages[i]->p_page; - struct buffer_head *bh, *head; -- int partial_write = 0; -+ loff_t offset; -+ loff_t io_end_offset; - -- head = page_buffers(page); -- if (error) -+ if (error) { - SetPageError(page); -- BUG_ON(!head); -- if (head->b_size != PAGE_CACHE_SIZE) { -- loff_t offset; -- loff_t io_end_offset = io_end->offset + io_end->size; -+ set_bit(AS_EIO, &page->mapping->flags); -+ head = page_buffers(page); -+ BUG_ON(!head); -+ -+ io_end_offset = io_end->offset + io_end->size; - - offset = (sector_t) page->index << PAGE_CACHE_SHIFT; - bh = head; - do { - if ((offset >= io_end->offset) && -- (offset+bh->b_size <= io_end_offset)) { -- if (error) -- buffer_io_error(bh); -- -- } -- if (buffer_delay(bh)) -- partial_write = 1; -- else if (!buffer_mapped(bh)) -- clear_buffer_dirty(bh); -- else if (buffer_dirty(bh)) -- partial_write = 1; -+ (offset+bh->b_size <= io_end_offset)) -+ buffer_io_error(bh); -+ - offset += bh->b_size; - bh = bh->b_this_page; - } while (bh != head); - } - -- /* -- * If this is a partial write which happened to make -- * all buffers uptodate then we can optimize away a -- * bogus readpage() for the next read(). Here we -- * 'discover' whether the page went uptodate as a -- * result of this (potentially partial) write. -- */ -- if (!partial_write) -- SetPageUptodate(page); -- - put_io_page(io_end->pages[i]); - } - io_end->num_io_pages = 0; -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index 8553dfb..e28c0f2 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -2659,12 +2659,6 @@ static void print_daily_error_info(unsigned long arg) - mod_timer(&sbi->s_err_report, jiffies + 24*60*60*HZ); /* Once a day */ - } - --static void ext4_lazyinode_timeout(unsigned long data) --{ -- struct task_struct *p = (struct task_struct *)data; -- wake_up_process(p); --} -- - /* Find next suitable group and run ext4_init_inode_table */ - static int ext4_run_li_request(struct ext4_li_request *elr) - { -@@ -2712,7 +2706,7 @@ static int ext4_run_li_request(struct ext4_li_request *elr) - - /* - * Remove lr_request from the list_request and free the -- * request tructure. Should be called with li_list_mtx held -+ * request structure. Should be called with li_list_mtx held - */ - static void ext4_remove_li_request(struct ext4_li_request *elr) - { -@@ -2730,14 +2724,16 @@ static void ext4_remove_li_request(struct ext4_li_request *elr) - - static void ext4_unregister_li_request(struct super_block *sb) - { -- struct ext4_li_request *elr = EXT4_SB(sb)->s_li_request; -- -- if (!ext4_li_info) -+ mutex_lock(&ext4_li_mtx); -+ if (!ext4_li_info) { -+ mutex_unlock(&ext4_li_mtx); - return; -+ } - - mutex_lock(&ext4_li_info->li_list_mtx); -- ext4_remove_li_request(elr); -+ ext4_remove_li_request(EXT4_SB(sb)->s_li_request); - mutex_unlock(&ext4_li_info->li_list_mtx); -+ mutex_unlock(&ext4_li_mtx); - } - - static struct task_struct *ext4_lazyinit_task; -@@ -2756,14 +2752,10 @@ static int ext4_lazyinit_thread(void *arg) - struct ext4_lazy_init *eli = (struct ext4_lazy_init *)arg; - struct list_head *pos, *n; - struct ext4_li_request *elr; -- unsigned long next_wakeup; -- DEFINE_WAIT(wait); -+ unsigned long next_wakeup, cur; - - BUG_ON(NULL == eli); - -- eli->li_timer.data = (unsigned long)current; -- eli->li_timer.function = ext4_lazyinode_timeout; -- - eli->li_task = current; - wake_up(&eli->li_wait_task); - -@@ -2797,19 +2789,15 @@ cont_thread: - if (freezing(current)) - refrigerator(); - -- if ((time_after_eq(jiffies, next_wakeup)) || -+ cur = jiffies; -+ if ((time_after_eq(cur, next_wakeup)) || - (MAX_JIFFY_OFFSET == next_wakeup)) { - cond_resched(); - continue; - } - -- eli->li_timer.expires = next_wakeup; -- add_timer(&eli->li_timer); -- prepare_to_wait(&eli->li_wait_daemon, &wait, -- TASK_INTERRUPTIBLE); -- if (time_before(jiffies, next_wakeup)) -- schedule(); -- finish_wait(&eli->li_wait_daemon, &wait); -+ schedule_timeout_interruptible(next_wakeup - cur); -+ - if (kthread_should_stop()) { - ext4_clear_request_list(); - goto exit_thread; -@@ -2833,12 +2821,10 @@ exit_thread: - goto cont_thread; - } - mutex_unlock(&eli->li_list_mtx); -- del_timer_sync(&ext4_li_info->li_timer); - eli->li_task = NULL; - wake_up(&eli->li_wait_task); - - kfree(ext4_li_info); -- ext4_lazyinit_task = NULL; - ext4_li_info = NULL; - mutex_unlock(&ext4_li_mtx); - -@@ -2866,7 +2852,6 @@ static int ext4_run_lazyinit_thread(void) - if (IS_ERR(ext4_lazyinit_task)) { - int err = PTR_ERR(ext4_lazyinit_task); - ext4_clear_request_list(); -- del_timer_sync(&ext4_li_info->li_timer); - kfree(ext4_li_info); - ext4_li_info = NULL; - printk(KERN_CRIT "EXT4: error %d creating inode table " -@@ -2915,9 +2900,7 @@ static int ext4_li_info_new(void) - INIT_LIST_HEAD(&eli->li_request_list); - mutex_init(&eli->li_list_mtx); - -- init_waitqueue_head(&eli->li_wait_daemon); - init_waitqueue_head(&eli->li_wait_task); -- init_timer(&eli->li_timer); - eli->li_state |= EXT4_LAZYINIT_QUIT; - - ext4_li_info = eli; -diff --git a/fs/jbd/commit.c b/fs/jbd/commit.c -index 69b1804..f486ff6 100644 ---- a/fs/jbd/commit.c -+++ b/fs/jbd/commit.c -@@ -722,8 +722,13 @@ wait_for_iobuf: - required. */ - JBUFFER_TRACE(jh, "file as BJ_Forget"); - journal_file_buffer(jh, commit_transaction, BJ_Forget); -- /* Wake up any transactions which were waiting for this -- IO to complete */ -+ /* -+ * Wake up any transactions which were waiting for this -+ * IO to complete. The barrier must be here so that changes -+ * by journal_file_buffer() take effect before wake_up_bit() -+ * does the waitqueue check. -+ */ -+ smp_mb(); - wake_up_bit(&bh->b_state, BH_Unshadow); - JBUFFER_TRACE(jh, "brelse shadowed buffer"); - __brelse(bh); -diff --git a/fs/jbd/journal.c b/fs/jbd/journal.c -index b3713af..e2d4285 100644 ---- a/fs/jbd/journal.c -+++ b/fs/jbd/journal.c -@@ -437,9 +437,12 @@ int __log_space_left(journal_t *journal) - int __log_start_commit(journal_t *journal, tid_t target) - { - /* -- * Are we already doing a recent enough commit? -+ * The only transaction we can possibly wait upon is the -+ * currently running transaction (if it exists). Otherwise, -+ * the target tid must be an old one. - */ -- if (!tid_geq(journal->j_commit_request, target)) { -+ if (journal->j_running_transaction && -+ journal->j_running_transaction->t_tid == target) { - /* - * We want a new commit: OK, mark the request and wakeup the - * commit thread. We do _not_ do the commit ourselves. -@@ -451,7 +454,14 @@ int __log_start_commit(journal_t *journal, tid_t target) - journal->j_commit_sequence); - wake_up(&journal->j_wait_commit); - return 1; -- } -+ } else if (!tid_geq(journal->j_commit_request, target)) -+ /* This should never happen, but if it does, preserve -+ the evidence before kjournald goes into a loop and -+ increments j_commit_sequence beyond all recognition. */ -+ WARN_ONCE(1, "jbd: bad log_start_commit: %u %u %u %u\n", -+ journal->j_commit_request, journal->j_commit_sequence, -+ target, journal->j_running_transaction ? -+ journal->j_running_transaction->t_tid : 0); - return 0; - } - -diff --git a/fs/namei.c b/fs/namei.c -index e3c4f11..6ff858c 100644 ---- a/fs/namei.c -+++ b/fs/namei.c -@@ -1378,12 +1378,12 @@ static inline int nested_symlink(struct path *path, struct nameidata *nd) - { - int res; - -- BUG_ON(nd->depth >= MAX_NESTED_LINKS); - if (unlikely(current->link_count >= MAX_NESTED_LINKS)) { - path_put_conditional(path, nd); - path_put(&nd->path); - return -ELOOP; - } -+ BUG_ON(nd->depth >= MAX_NESTED_LINKS); - - nd->depth++; - current->link_count++; -diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c -index cf1b339..d0e15db 100644 ---- a/fs/nfs/nfs4proc.c -+++ b/fs/nfs/nfs4proc.c -@@ -267,9 +267,11 @@ static int nfs4_handle_exception(struct nfs_server *server, int errorcode, struc - break; - nfs4_schedule_stateid_recovery(server, state); - goto wait_on_recovery; -+ case -NFS4ERR_EXPIRED: -+ if (state != NULL) -+ nfs4_schedule_stateid_recovery(server, state); - case -NFS4ERR_STALE_STATEID: - case -NFS4ERR_STALE_CLIENTID: -- case -NFS4ERR_EXPIRED: - nfs4_schedule_lease_recovery(clp); - goto wait_on_recovery; - #if defined(CONFIG_NFS_V4_1) -@@ -3670,9 +3672,11 @@ nfs4_async_handle_error(struct rpc_task *task, const struct nfs_server *server, - break; - nfs4_schedule_stateid_recovery(server, state); - goto wait_on_recovery; -+ case -NFS4ERR_EXPIRED: -+ if (state != NULL) -+ nfs4_schedule_stateid_recovery(server, state); - case -NFS4ERR_STALE_STATEID: - case -NFS4ERR_STALE_CLIENTID: -- case -NFS4ERR_EXPIRED: - nfs4_schedule_lease_recovery(clp); - goto wait_on_recovery; - #if defined(CONFIG_NFS_V4_1) -@@ -4543,6 +4547,7 @@ int nfs4_lock_delegation_recall(struct nfs4_state *state, struct file_lock *fl) - case -ESTALE: - goto out; - case -NFS4ERR_EXPIRED: -+ nfs4_schedule_stateid_recovery(server, state); - case -NFS4ERR_STALE_CLIENTID: - case -NFS4ERR_STALE_STATEID: - nfs4_schedule_lease_recovery(server->nfs_client); -diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c -index 036f5ad..e97dd21 100644 ---- a/fs/nfs/nfs4state.c -+++ b/fs/nfs/nfs4state.c -@@ -1466,7 +1466,10 @@ static int nfs4_reclaim_lease(struct nfs_client *clp) - #ifdef CONFIG_NFS_V4_1 - void nfs4_schedule_session_recovery(struct nfs4_session *session) - { -- nfs4_schedule_lease_recovery(session->clp); -+ struct nfs_client *clp = session->clp; -+ -+ set_bit(NFS4CLNT_SESSION_RESET, &clp->cl_state); -+ nfs4_schedule_lease_recovery(clp); - } - EXPORT_SYMBOL_GPL(nfs4_schedule_session_recovery); - -@@ -1549,6 +1552,7 @@ static int nfs4_reset_session(struct nfs_client *clp) - status = nfs4_recovery_handle_error(clp, status); - goto out; - } -+ clear_bit(NFS4CLNT_SESSION_RESET, &clp->cl_state); - /* create_session negotiated new slot table */ - clear_bit(NFS4CLNT_RECALL_SLOT, &clp->cl_state); - -diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c -index f57f528..101c85a 100644 ---- a/fs/nfs/pnfs.c -+++ b/fs/nfs/pnfs.c -@@ -1009,7 +1009,7 @@ void - pnfs_set_layoutcommit(struct nfs_write_data *wdata) - { - struct nfs_inode *nfsi = NFS_I(wdata->inode); -- loff_t end_pos = wdata->args.offset + wdata->res.count; -+ loff_t end_pos = wdata->mds_offset + wdata->res.count; - bool mark_as_dirty = false; - - spin_lock(&nfsi->vfs_inode.i_lock); -diff --git a/fs/partitions/ldm.c b/fs/partitions/ldm.c -index ce4f624..a29d5cc 100644 ---- a/fs/partitions/ldm.c -+++ b/fs/partitions/ldm.c -@@ -1335,6 +1335,11 @@ static bool ldm_frag_add (const u8 *data, int size, struct list_head *frags) - - list_add_tail (&f->list, frags); - found: -+ if (rec >= f->num) { -+ ldm_error("REC value (%d) exceeds NUM value (%d)", rec, f->num); -+ return false; -+ } -+ - if (f->map & (1 << rec)) { - ldm_error ("Duplicate VBLK, part %d.", rec); - f->map &= 0x7F; /* Mark the group as broken */ -diff --git a/fs/ubifs/sb.c b/fs/ubifs/sb.c -index bf31b47..cad60b5 100644 ---- a/fs/ubifs/sb.c -+++ b/fs/ubifs/sb.c -@@ -475,7 +475,8 @@ failed: - * @c: UBIFS file-system description object - * - * This function returns a pointer to the superblock node or a negative error -- * code. -+ * code. Note, the user of this function is responsible of kfree()'ing the -+ * returned superblock buffer. - */ - struct ubifs_sb_node *ubifs_read_sb_node(struct ubifs_info *c) - { -diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c -index 04ad07f..328e6fc 100644 ---- a/fs/ubifs/super.c -+++ b/fs/ubifs/super.c -@@ -1584,6 +1584,7 @@ static int ubifs_remount_rw(struct ubifs_info *c) - } - sup->leb_cnt = cpu_to_le32(c->leb_cnt); - err = ubifs_write_sb_node(c, sup); -+ kfree(sup); - if (err) - goto out; - } -diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h -index 2ad95fa..ae9091a 100644 ---- a/include/linux/blkdev.h -+++ b/include/linux/blkdev.h -@@ -257,7 +257,7 @@ struct queue_limits { - unsigned char misaligned; - unsigned char discard_misaligned; - unsigned char cluster; -- signed char discard_zeroes_data; -+ unsigned char discard_zeroes_data; - }; - - struct request_queue -@@ -364,6 +364,8 @@ struct request_queue - * for flush operations - */ - unsigned int flush_flags; -+ unsigned int flush_not_queueable:1; -+ unsigned int flush_queue_delayed:1; - unsigned int flush_pending_idx:1; - unsigned int flush_running_idx:1; - unsigned long flush_pending_since; -@@ -843,6 +845,7 @@ extern void blk_queue_softirq_done(struct request_queue *, softirq_done_fn *); - extern void blk_queue_rq_timed_out(struct request_queue *, rq_timed_out_fn *); - extern void blk_queue_rq_timeout(struct request_queue *, unsigned int); - extern void blk_queue_flush(struct request_queue *q, unsigned int flush); -+extern void blk_queue_flush_queueable(struct request_queue *q, bool queueable); - extern struct backing_dev_info *blk_get_backing_dev_info(struct block_device *bdev); - - extern int blk_rq_map_sg(struct request_queue *, struct request *, struct scatterlist *); -@@ -1066,13 +1069,16 @@ static inline int queue_limit_discard_alignment(struct queue_limits *lim, sector - { - unsigned int alignment = (sector << 9) & (lim->discard_granularity - 1); - -+ if (!lim->max_discard_sectors) -+ return 0; -+ - return (lim->discard_granularity + lim->discard_alignment - alignment) - & (lim->discard_granularity - 1); - } - - static inline unsigned int queue_discard_zeroes_data(struct request_queue *q) - { -- if (q->limits.discard_zeroes_data == 1) -+ if (q->limits.max_discard_sectors && q->limits.discard_zeroes_data == 1) - return 1; - - return 0; -@@ -1111,6 +1117,11 @@ static inline unsigned int block_size(struct block_device *bdev) - return bdev->bd_block_size; - } - -+static inline bool queue_flush_queueable(struct request_queue *q) -+{ -+ return !q->flush_not_queueable; -+} -+ - typedef struct {struct page *v;} Sector; - - unsigned char *read_dev_sector(struct block_device *, sector_t, Sector *); -diff --git a/include/linux/efi.h b/include/linux/efi.h -index 33fa120..e376270 100644 ---- a/include/linux/efi.h -+++ b/include/linux/efi.h -@@ -299,6 +299,7 @@ extern void efi_initialize_iomem_resources(struct resource *code_resource, - struct resource *data_resource, struct resource *bss_resource); - extern unsigned long efi_get_time(void); - extern int efi_set_rtc_mmss(unsigned long nowtime); -+extern void efi_reserve_boot_services(void); - extern struct efi_memory_map memmap; - - /** -diff --git a/include/linux/genhd.h b/include/linux/genhd.h -index d764a42..300d758 100644 ---- a/include/linux/genhd.h -+++ b/include/linux/genhd.h -@@ -127,6 +127,7 @@ struct hd_struct { - #define GENHD_FL_SUPPRESS_PARTITION_INFO 32 - #define GENHD_FL_EXT_DEVT 64 /* allow extended devt */ - #define GENHD_FL_NATIVE_CAPACITY 128 -+#define GENHD_FL_BLOCK_EVENTS_ON_EXCL_WRITE 256 - - enum { - DISK_EVENT_MEDIA_CHANGE = 1 << 0, /* media changed */ -diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h -index 8abe8d7..8652a4f 100644 ---- a/include/linux/pci_ids.h -+++ b/include/linux/pci_ids.h -@@ -608,6 +608,8 @@ - #define PCI_DEVICE_ID_MATROX_G550 0x2527 - #define PCI_DEVICE_ID_MATROX_VIA 0x4536 - -+#define PCI_VENDOR_ID_MOBILITY_ELECTRONICS 0x14f2 -+ - #define PCI_VENDOR_ID_CT 0x102c - #define PCI_DEVICE_ID_CT_69000 0x00c0 - #define PCI_DEVICE_ID_CT_65545 0x00d8 -diff --git a/include/linux/pm_qos_params.h b/include/linux/pm_qos_params.h -index 77cbddb..a7d87f9 100644 ---- a/include/linux/pm_qos_params.h -+++ b/include/linux/pm_qos_params.h -@@ -16,6 +16,10 @@ - #define PM_QOS_NUM_CLASSES 4 - #define PM_QOS_DEFAULT_VALUE -1 - -+#define PM_QOS_CPU_DMA_LAT_DEFAULT_VALUE (2000 * USEC_PER_SEC) -+#define PM_QOS_NETWORK_LAT_DEFAULT_VALUE (2000 * USEC_PER_SEC) -+#define PM_QOS_NETWORK_THROUGHPUT_DEFAULT_VALUE 0 -+ - struct pm_qos_request_list { - struct plist_node list; - int pm_qos_class; -diff --git a/include/linux/seqlock.h b/include/linux/seqlock.h -index e98cd2e..06d6964 100644 ---- a/include/linux/seqlock.h -+++ b/include/linux/seqlock.h -@@ -88,12 +88,12 @@ static __always_inline unsigned read_seqbegin(const seqlock_t *sl) - unsigned ret; - - repeat: -- ret = sl->sequence; -- smp_rmb(); -+ ret = ACCESS_ONCE(sl->sequence); - if (unlikely(ret & 1)) { - cpu_relax(); - goto repeat; - } -+ smp_rmb(); - - return ret; - } -diff --git a/include/net/dst.h b/include/net/dst.h -index 75b95df..b3ad020 100644 ---- a/include/net/dst.h -+++ b/include/net/dst.h -@@ -120,6 +120,8 @@ static inline u32 *dst_metrics_write_ptr(struct dst_entry *dst) - { - unsigned long p = dst->_metrics; - -+ BUG_ON(!p); -+ - if (p & DST_METRICS_READ_ONLY) - return dst->ops->cow_metrics(dst, p); - return __DST_METRICS_PTR(p); -diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h -index 1d3b5b2..561ac99 100644 ---- a/include/target/target_core_base.h -+++ b/include/target/target_core_base.h -@@ -98,6 +98,7 @@ enum transport_state_table { - TRANSPORT_REMOVE = 14, - TRANSPORT_FREE = 15, - TRANSPORT_NEW_CMD_MAP = 16, -+ TRANSPORT_FREE_CMD_INTR = 17, - }; - - /* Used for struct se_cmd->se_cmd_flags */ -diff --git a/include/target/target_core_transport.h b/include/target/target_core_transport.h -index 59aa464..24a1c6c 100644 ---- a/include/target/target_core_transport.h -+++ b/include/target/target_core_transport.h -@@ -172,6 +172,7 @@ extern int transport_generic_handle_cdb_map(struct se_cmd *); - extern int transport_generic_handle_data(struct se_cmd *); - extern void transport_new_cmd_failure(struct se_cmd *); - extern int transport_generic_handle_tmr(struct se_cmd *); -+extern void transport_generic_free_cmd_intr(struct se_cmd *); - extern void __transport_stop_task_timer(struct se_task *, unsigned long *); - extern unsigned char transport_asciihex_to_binaryhex(unsigned char val[2]); - extern int transport_generic_map_mem_to_cmd(struct se_cmd *cmd, struct scatterlist *, u32, -diff --git a/init/main.c b/init/main.c -index 4a9479e..48df882 100644 ---- a/init/main.c -+++ b/init/main.c -@@ -580,8 +580,8 @@ asmlinkage void __init start_kernel(void) - #endif - page_cgroup_init(); - enable_debug_pagealloc(); -- kmemleak_init(); - debug_objects_mem_init(); -+ kmemleak_init(); - setup_per_cpu_pageset(); - numa_policy_init(); - if (late_time_init) -diff --git a/kernel/pm_qos_params.c b/kernel/pm_qos_params.c -index 0da058b..a9582ef 100644 ---- a/kernel/pm_qos_params.c -+++ b/kernel/pm_qos_params.c -@@ -53,11 +53,17 @@ enum pm_qos_type { - PM_QOS_MIN /* return the smallest value */ - }; - -+/* -+ * Note: The lockless read path depends on the CPU accessing -+ * target_value atomically. Atomic access is only guaranteed on all CPU -+ * types linux supports for 32 bit quantites -+ */ - struct pm_qos_object { - struct plist_head requests; - struct blocking_notifier_head *notifiers; - struct miscdevice pm_qos_power_miscdev; - char *name; -+ s32 target_value; /* Do not change to 64 bit */ - s32 default_value; - enum pm_qos_type type; - }; -@@ -70,7 +76,8 @@ static struct pm_qos_object cpu_dma_pm_qos = { - .requests = PLIST_HEAD_INIT(cpu_dma_pm_qos.requests, pm_qos_lock), - .notifiers = &cpu_dma_lat_notifier, - .name = "cpu_dma_latency", -- .default_value = 2000 * USEC_PER_SEC, -+ .target_value = PM_QOS_CPU_DMA_LAT_DEFAULT_VALUE, -+ .default_value = PM_QOS_CPU_DMA_LAT_DEFAULT_VALUE, - .type = PM_QOS_MIN, - }; - -@@ -79,7 +86,8 @@ static struct pm_qos_object network_lat_pm_qos = { - .requests = PLIST_HEAD_INIT(network_lat_pm_qos.requests, pm_qos_lock), - .notifiers = &network_lat_notifier, - .name = "network_latency", -- .default_value = 2000 * USEC_PER_SEC, -+ .target_value = PM_QOS_NETWORK_LAT_DEFAULT_VALUE, -+ .default_value = PM_QOS_NETWORK_LAT_DEFAULT_VALUE, - .type = PM_QOS_MIN - }; - -@@ -89,7 +97,8 @@ static struct pm_qos_object network_throughput_pm_qos = { - .requests = PLIST_HEAD_INIT(network_throughput_pm_qos.requests, pm_qos_lock), - .notifiers = &network_throughput_notifier, - .name = "network_throughput", -- .default_value = 0, -+ .target_value = PM_QOS_NETWORK_THROUGHPUT_DEFAULT_VALUE, -+ .default_value = PM_QOS_NETWORK_THROUGHPUT_DEFAULT_VALUE, - .type = PM_QOS_MAX, - }; - -@@ -135,6 +144,16 @@ static inline int pm_qos_get_value(struct pm_qos_object *o) - } - } - -+static inline s32 pm_qos_read_value(struct pm_qos_object *o) -+{ -+ return o->target_value; -+} -+ -+static inline void pm_qos_set_value(struct pm_qos_object *o, s32 value) -+{ -+ o->target_value = value; -+} -+ - static void update_target(struct pm_qos_object *o, struct plist_node *node, - int del, int value) - { -@@ -159,6 +178,7 @@ static void update_target(struct pm_qos_object *o, struct plist_node *node, - plist_add(node, &o->requests); - } - curr_value = pm_qos_get_value(o); -+ pm_qos_set_value(o, curr_value); - spin_unlock_irqrestore(&pm_qos_lock, flags); - - if (prev_value != curr_value) -@@ -193,18 +213,11 @@ static int find_pm_qos_object_by_minor(int minor) - * pm_qos_request - returns current system wide qos expectation - * @pm_qos_class: identification of which qos value is requested - * -- * This function returns the current target value in an atomic manner. -+ * This function returns the current target value. - */ - int pm_qos_request(int pm_qos_class) - { -- unsigned long flags; -- int value; -- -- spin_lock_irqsave(&pm_qos_lock, flags); -- value = pm_qos_get_value(pm_qos_array[pm_qos_class]); -- spin_unlock_irqrestore(&pm_qos_lock, flags); -- -- return value; -+ return pm_qos_read_value(pm_qos_array[pm_qos_class]); - } - EXPORT_SYMBOL_GPL(pm_qos_request); - -diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c -index ee24fa1..666880d 100644 ---- a/kernel/trace/ftrace.c -+++ b/kernel/trace/ftrace.c -@@ -2413,14 +2413,16 @@ ftrace_regex_release(struct inode *inode, struct file *file, int enable) - ftrace_match_records(parser->buffer, parser->idx, enable); - } - -- mutex_lock(&ftrace_lock); -- if (ftrace_start_up && ftrace_enabled) -- ftrace_run_update_code(FTRACE_ENABLE_CALLS); -- mutex_unlock(&ftrace_lock); -- - trace_parser_put(parser); - kfree(iter); - -+ if (file->f_mode & FMODE_WRITE) { -+ mutex_lock(&ftrace_lock); -+ if (ftrace_start_up && ftrace_enabled) -+ ftrace_run_update_code(FTRACE_ENABLE_CALLS); -+ mutex_unlock(&ftrace_lock); -+ } -+ - mutex_unlock(&ftrace_regex_lock); - return 0; - } -diff --git a/lib/locking-selftest.c b/lib/locking-selftest.c -index 619313e..507a22f 100644 ---- a/lib/locking-selftest.c -+++ b/lib/locking-selftest.c -@@ -144,7 +144,7 @@ static void init_shared_classes(void) - - #define HARDIRQ_ENTER() \ - local_irq_disable(); \ -- irq_enter(); \ -+ __irq_enter(); \ - WARN_ON(!in_irq()); - - #define HARDIRQ_EXIT() \ -diff --git a/mm/kmemleak.c b/mm/kmemleak.c -index c1d5867..aacee45 100644 ---- a/mm/kmemleak.c -+++ b/mm/kmemleak.c -@@ -1414,9 +1414,12 @@ static void *kmemleak_seq_next(struct seq_file *seq, void *v, loff_t *pos) - ++(*pos); - - list_for_each_continue_rcu(n, &object_list) { -- next_obj = list_entry(n, struct kmemleak_object, object_list); -- if (get_object(next_obj)) -+ struct kmemleak_object *obj = -+ list_entry(n, struct kmemleak_object, object_list); -+ if (get_object(obj)) { -+ next_obj = obj; - break; -+ } - } - - put_object(prev_obj); -diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index 3f8bce2..e78b324 100644 ---- a/mm/page_alloc.c -+++ b/mm/page_alloc.c -@@ -2064,6 +2064,7 @@ restart: - first_zones_zonelist(zonelist, high_zoneidx, NULL, - &preferred_zone); - -+rebalance: - /* This is the last chance, in general, before the goto nopage. */ - page = get_page_from_freelist(gfp_mask, nodemask, order, zonelist, - high_zoneidx, alloc_flags & ~ALLOC_NO_WATERMARKS, -@@ -2071,7 +2072,6 @@ restart: - if (page) - goto got_pg; - --rebalance: - /* Allocate without watermarks if the context allows */ - if (alloc_flags & ALLOC_NO_WATERMARKS) { - page = __alloc_pages_high_priority(gfp_mask, order, -diff --git a/mm/shmem.c b/mm/shmem.c -index dfc7069..ba12be4 100644 ---- a/mm/shmem.c -+++ b/mm/shmem.c -@@ -916,11 +916,12 @@ static int shmem_unuse_inode(struct shmem_inode_info *info, swp_entry_t entry, s - if (size > ENTRIES_PER_PAGE) - size = ENTRIES_PER_PAGE; - offset = shmem_find_swp(entry, ptr, ptr+size); -+ shmem_swp_unmap(ptr); - if (offset >= 0) { - shmem_dir_unmap(dir); -+ ptr = shmem_swp_map(subdir); - goto found; - } -- shmem_swp_unmap(ptr); - } - } - lost1: -@@ -1100,8 +1101,8 @@ static int shmem_writepage(struct page *page, struct writeback_control *wbc) - delete_from_page_cache(page); - shmem_swp_set(info, entry, swap.val); - shmem_swp_unmap(entry); -- spin_unlock(&info->lock); - swap_shmem_alloc(swap); -+ spin_unlock(&info->lock); - BUG_ON(page_mapped(page)); - swap_writepage(page, wbc); - return 0; -diff --git a/mm/slub.c b/mm/slub.c -index 9d2e5e4..f6cb6cd 100644 ---- a/mm/slub.c -+++ b/mm/slub.c -@@ -261,6 +261,18 @@ static inline void *get_freepointer(struct kmem_cache *s, void *object) - return *(void **)(object + s->offset); - } - -+static inline void *get_freepointer_safe(struct kmem_cache *s, void *object) -+{ -+ void *p; -+ -+#ifdef CONFIG_DEBUG_PAGEALLOC -+ probe_kernel_read(&p, (void **)(object + s->offset), sizeof(p)); -+#else -+ p = get_freepointer(s, object); -+#endif -+ return p; -+} -+ - static inline void set_freepointer(struct kmem_cache *s, void *object, void *fp) - { - *(void **)(object + s->offset) = fp; -@@ -1943,7 +1955,7 @@ redo: - if (unlikely(!irqsafe_cpu_cmpxchg_double( - s->cpu_slab->freelist, s->cpu_slab->tid, - object, tid, -- get_freepointer(s, object), next_tid(tid)))) { -+ get_freepointer_safe(s, object), next_tid(tid)))) { - - note_cmpxchg_failure("slab_alloc", s, tid); - goto redo; -diff --git a/mm/vmscan.c b/mm/vmscan.c -index 8bfd450..cc1470b 100644 ---- a/mm/vmscan.c -+++ b/mm/vmscan.c -@@ -230,8 +230,11 @@ unsigned long shrink_slab(unsigned long scanned, gfp_t gfp_mask, - if (scanned == 0) - scanned = SWAP_CLUSTER_MAX; - -- if (!down_read_trylock(&shrinker_rwsem)) -- return 1; /* Assume we'll be able to shrink next time */ -+ if (!down_read_trylock(&shrinker_rwsem)) { -+ /* Assume we'll be able to shrink next time */ -+ ret = 1; -+ goto out; -+ } - - list_for_each_entry(shrinker, &shrinker_list, list) { - unsigned long long delta; -@@ -282,6 +285,8 @@ unsigned long shrink_slab(unsigned long scanned, gfp_t gfp_mask, - shrinker->nr += total_scan; - } - up_read(&shrinker_rwsem); -+out: -+ cond_resched(); - return ret; - } - -@@ -2286,7 +2291,7 @@ static bool sleeping_prematurely(pg_data_t *pgdat, int order, long remaining, - * must be balanced - */ - if (order) -- return pgdat_balanced(pgdat, balanced, classzone_idx); -+ return !pgdat_balanced(pgdat, balanced, classzone_idx); - else - return !all_zones_ok; - } -diff --git a/net/atm/atm_sysfs.c b/net/atm/atm_sysfs.c -index f7fa67c..f49da58 100644 ---- a/net/atm/atm_sysfs.c -+++ b/net/atm/atm_sysfs.c -@@ -59,6 +59,14 @@ static ssize_t show_atmaddress(struct device *cdev, - return pos - buf; - } - -+static ssize_t show_atmindex(struct device *cdev, -+ struct device_attribute *attr, char *buf) -+{ -+ struct atm_dev *adev = to_atm_dev(cdev); -+ -+ return sprintf(buf, "%d\n", adev->number); -+} -+ - static ssize_t show_carrier(struct device *cdev, - struct device_attribute *attr, char *buf) - { -@@ -99,6 +107,7 @@ static ssize_t show_link_rate(struct device *cdev, - - static DEVICE_ATTR(address, S_IRUGO, show_address, NULL); - static DEVICE_ATTR(atmaddress, S_IRUGO, show_atmaddress, NULL); -+static DEVICE_ATTR(atmindex, S_IRUGO, show_atmindex, NULL); - static DEVICE_ATTR(carrier, S_IRUGO, show_carrier, NULL); - static DEVICE_ATTR(type, S_IRUGO, show_type, NULL); - static DEVICE_ATTR(link_rate, S_IRUGO, show_link_rate, NULL); -@@ -106,6 +115,7 @@ static DEVICE_ATTR(link_rate, S_IRUGO, show_link_rate, NULL); - static struct device_attribute *atm_attrs[] = { - &dev_attr_atmaddress, - &dev_attr_address, -+ &dev_attr_atmindex, - &dev_attr_carrier, - &dev_attr_type, - &dev_attr_link_rate, -diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c -index 74ef4d4..5f9c091 100644 ---- a/net/bridge/br_netfilter.c -+++ b/net/bridge/br_netfilter.c -@@ -117,6 +117,10 @@ static struct dst_ops fake_dst_ops = { - * ipt_REJECT needs it. Future netfilter modules might - * require us to fill additional fields. - */ -+static const u32 br_dst_default_metrics[RTAX_MAX] = { -+ [RTAX_MTU - 1] = 1500, -+}; -+ - void br_netfilter_rtable_init(struct net_bridge *br) - { - struct rtable *rt = &br->fake_rtable; -@@ -124,7 +128,7 @@ void br_netfilter_rtable_init(struct net_bridge *br) - atomic_set(&rt->dst.__refcnt, 1); - rt->dst.dev = br->dev; - rt->dst.path = &rt->dst; -- dst_metric_set(&rt->dst, RTAX_MTU, 1500); -+ dst_init_metrics(&rt->dst, br_dst_default_metrics, true); - rt->dst.flags = DST_NOXFRM; - rt->dst.ops = &fake_dst_ops; - } -diff --git a/net/core/dev.c b/net/core/dev.c -index b624fe4..acd7423 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -1007,7 +1007,7 @@ rollback: - } - - write_lock_bh(&dev_base_lock); -- hlist_del(&dev->name_hlist); -+ hlist_del_rcu(&dev->name_hlist); - write_unlock_bh(&dev_base_lock); - - synchronize_rcu(); -@@ -5258,7 +5258,7 @@ void netdev_update_features(struct net_device *dev) - if (dev->features == features) - return; - -- netdev_info(dev, "Features changed: 0x%08x -> 0x%08x\n", -+ netdev_dbg(dev, "Features changed: 0x%08x -> 0x%08x\n", - dev->features, features); - - if (dev->netdev_ops->ndo_set_features) -diff --git a/net/core/dst.c b/net/core/dst.c -index 91104d3..b71b7a3 100644 ---- a/net/core/dst.c -+++ b/net/core/dst.c -@@ -314,7 +314,7 @@ void __dst_destroy_metrics_generic(struct dst_entry *dst, unsigned long old) - { - unsigned long prev, new; - -- new = (unsigned long) dst_default_metrics; -+ new = ((unsigned long) dst_default_metrics) | DST_METRICS_READ_ONLY; - prev = cmpxchg(&dst->_metrics, old, new); - if (prev == old) - kfree(__DST_METRICS_PTR(old)); -diff --git a/net/core/ethtool.c b/net/core/ethtool.c -index 74ead9e..f337525 100644 ---- a/net/core/ethtool.c -+++ b/net/core/ethtool.c -@@ -330,7 +330,7 @@ static const char netdev_features_strings[ETHTOOL_DEV_FEATURE_WORDS * 32][ETH_GS - /* NETIF_F_IP_CSUM */ "tx-checksum-ipv4", - /* NETIF_F_NO_CSUM */ "tx-checksum-unneeded", - /* NETIF_F_HW_CSUM */ "tx-checksum-ip-generic", -- /* NETIF_F_IPV6_CSUM */ "tx_checksum-ipv6", -+ /* NETIF_F_IPV6_CSUM */ "tx-checksum-ipv6", - /* NETIF_F_HIGHDMA */ "highdma", - /* NETIF_F_FRAGLIST */ "tx-scatter-gather-fraglist", - /* NETIF_F_HW_VLAN_TX */ "tx-vlan-hw-insert", -diff --git a/net/core/skbuff.c b/net/core/skbuff.c -index 7ebeed0..3e934fe 100644 ---- a/net/core/skbuff.c -+++ b/net/core/skbuff.c -@@ -2993,6 +2993,9 @@ int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb) - skb->destructor = sock_rmem_free; - atomic_add(skb->truesize, &sk->sk_rmem_alloc); - -+ /* before exiting rcu section, make sure dst is refcounted */ -+ skb_dst_force(skb); -+ - skb_queue_tail(&sk->sk_error_queue, skb); - if (!sock_flag(sk, SOCK_DEAD)) - sk->sk_data_ready(sk, skb->len); -diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c -index 1fd3d9c..57ca93a 100644 ---- a/net/ipv4/igmp.c -+++ b/net/ipv4/igmp.c -@@ -1169,20 +1169,18 @@ static void igmp_group_dropped(struct ip_mc_list *im) - - if (!in_dev->dead) { - if (IGMP_V1_SEEN(in_dev)) -- goto done; -+ return; - if (IGMP_V2_SEEN(in_dev)) { - if (reporter) - igmp_send_report(in_dev, im, IGMP_HOST_LEAVE_MESSAGE); -- goto done; -+ return; - } - /* IGMPv3 */ - igmpv3_add_delrec(in_dev, im); - - igmp_ifc_event(in_dev); - } --done: - #endif -- ip_mc_clear_src(im); - } - - static void igmp_group_added(struct ip_mc_list *im) -@@ -1319,6 +1317,7 @@ void ip_mc_dec_group(struct in_device *in_dev, __be32 addr) - *ip = i->next_rcu; - in_dev->mc_count--; - igmp_group_dropped(i); -+ ip_mc_clear_src(i); - - if (!in_dev->dead) - ip_rt_multicast_event(in_dev); -@@ -1428,7 +1427,8 @@ void ip_mc_destroy_dev(struct in_device *in_dev) - in_dev->mc_list = i->next_rcu; - in_dev->mc_count--; - -- igmp_group_dropped(i); -+ /* We've dropped the groups in ip_mc_down already */ -+ ip_mc_clear_src(i); - ip_ma_put(i); - } - } -diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c -index 4404973..3740403 100644 ---- a/net/mac80211/cfg.c -+++ b/net/mac80211/cfg.c -@@ -228,11 +228,11 @@ static int ieee80211_get_key(struct wiphy *wiphy, struct net_device *dev, - goto out; - - if (pairwise) -- key = sta->ptk; -+ key = rcu_dereference(sta->ptk); - else if (key_idx < NUM_DEFAULT_KEYS) -- key = sta->gtk[key_idx]; -+ key = rcu_dereference(sta->gtk[key_idx]); - } else -- key = sdata->keys[key_idx]; -+ key = rcu_dereference(sdata->keys[key_idx]); - - if (!key) - goto out; -@@ -921,8 +921,10 @@ static int ieee80211_change_mpath(struct wiphy *wiphy, - static void mpath_set_pinfo(struct mesh_path *mpath, u8 *next_hop, - struct mpath_info *pinfo) - { -- if (mpath->next_hop) -- memcpy(next_hop, mpath->next_hop->sta.addr, ETH_ALEN); -+ struct sta_info *next_hop_sta = rcu_dereference(mpath->next_hop); -+ -+ if (next_hop_sta) -+ memcpy(next_hop, next_hop_sta->sta.addr, ETH_ALEN); - else - memset(next_hop, 0, ETH_ALEN); - -diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c -index 64d92d5..7ffcb55 100644 ---- a/net/mac80211/mlme.c -+++ b/net/mac80211/mlme.c -@@ -789,7 +789,7 @@ void ieee80211_dynamic_ps_enable_work(struct work_struct *work) - ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS); - } - -- netif_tx_start_all_queues(sdata->dev); -+ netif_tx_wake_all_queues(sdata->dev); - } - - void ieee80211_dynamic_ps_timer(unsigned long data) -diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c -index 237cc19..cb5a285 100644 ---- a/net/netfilter/nf_conntrack_sip.c -+++ b/net/netfilter/nf_conntrack_sip.c -@@ -1419,6 +1419,7 @@ static int sip_help_tcp(struct sk_buff *skb, unsigned int protoff, - const char *dptr, *end; - s16 diff, tdiff = 0; - int ret = NF_ACCEPT; -+ bool term; - typeof(nf_nat_sip_seq_adjust_hook) nf_nat_sip_seq_adjust; - - if (ctinfo != IP_CT_ESTABLISHED && -@@ -1453,14 +1454,21 @@ static int sip_help_tcp(struct sk_buff *skb, unsigned int protoff, - if (dptr + matchoff == end) - break; - -- if (end + strlen("\r\n\r\n") > dptr + datalen) -- break; -- if (end[0] != '\r' || end[1] != '\n' || -- end[2] != '\r' || end[3] != '\n') -+ term = false; -+ for (; end + strlen("\r\n\r\n") <= dptr + datalen; end++) { -+ if (end[0] == '\r' && end[1] == '\n' && -+ end[2] == '\r' && end[3] == '\n') { -+ term = true; -+ break; -+ } -+ } -+ if (!term) - break; - end += strlen("\r\n\r\n") + clen; - - msglen = origlen = end - dptr; -+ if (msglen > datalen) -+ return NF_DROP; - - ret = process_sip_msg(skb, ct, dataoff, &dptr, &msglen); - if (ret != NF_ACCEPT) -diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c -index c2e628d..6d96275 100644 ---- a/net/sched/sch_sfq.c -+++ b/net/sched/sch_sfq.c -@@ -361,7 +361,7 @@ sfq_enqueue(struct sk_buff *skb, struct Qdisc *sch) - { - struct sfq_sched_data *q = qdisc_priv(sch); - unsigned int hash; -- sfq_index x; -+ sfq_index x, qlen; - struct sfq_slot *slot; - int uninitialized_var(ret); - -@@ -405,20 +405,12 @@ sfq_enqueue(struct sk_buff *skb, struct Qdisc *sch) - if (++sch->q.qlen <= q->limit) - return NET_XMIT_SUCCESS; - -+ qlen = slot->qlen; - sfq_drop(sch); -- return NET_XMIT_CN; --} -- --static struct sk_buff * --sfq_peek(struct Qdisc *sch) --{ -- struct sfq_sched_data *q = qdisc_priv(sch); -- -- /* No active slots */ -- if (q->tail == NULL) -- return NULL; -- -- return q->slots[q->tail->next].skblist_next; -+ /* Return Congestion Notification only if we dropped a packet -+ * from this flow. -+ */ -+ return (qlen != slot->qlen) ? NET_XMIT_CN : NET_XMIT_SUCCESS; - } - - static struct sk_buff * -@@ -702,7 +694,7 @@ static struct Qdisc_ops sfq_qdisc_ops __read_mostly = { - .priv_size = sizeof(struct sfq_sched_data), - .enqueue = sfq_enqueue, - .dequeue = sfq_dequeue, -- .peek = sfq_peek, -+ .peek = qdisc_peek_dequeued, - .drop = sfq_drop, - .init = sfq_init, - .reset = sfq_reset, -diff --git a/net/sctp/associola.c b/net/sctp/associola.c -index 1a21c57..525f97c 100644 ---- a/net/sctp/associola.c -+++ b/net/sctp/associola.c -@@ -64,6 +64,7 @@ - /* Forward declarations for internal functions. */ - static void sctp_assoc_bh_rcv(struct work_struct *work); - static void sctp_assoc_free_asconf_acks(struct sctp_association *asoc); -+static void sctp_assoc_free_asconf_queue(struct sctp_association *asoc); - - /* Keep track of the new idr low so that we don't re-use association id - * numbers too fast. It is protected by they idr spin lock is in the -@@ -446,6 +447,9 @@ void sctp_association_free(struct sctp_association *asoc) - /* Free any cached ASCONF_ACK chunk. */ - sctp_assoc_free_asconf_acks(asoc); - -+ /* Free the ASCONF queue. */ -+ sctp_assoc_free_asconf_queue(asoc); -+ - /* Free any cached ASCONF chunk. */ - if (asoc->addip_last_asconf) - sctp_chunk_free(asoc->addip_last_asconf); -@@ -1578,6 +1582,18 @@ retry: - return error; - } - -+/* Free the ASCONF queue */ -+static void sctp_assoc_free_asconf_queue(struct sctp_association *asoc) -+{ -+ struct sctp_chunk *asconf; -+ struct sctp_chunk *tmp; -+ -+ list_for_each_entry_safe(asconf, tmp, &asoc->addip_chunk_list, list) { -+ list_del_init(&asconf->list); -+ sctp_chunk_free(asconf); -+ } -+} -+ - /* Free asconf_ack cache */ - static void sctp_assoc_free_asconf_acks(struct sctp_association *asoc) - { -diff --git a/net/sctp/bind_addr.c b/net/sctp/bind_addr.c -index faf71d1..6150ac5 100644 ---- a/net/sctp/bind_addr.c -+++ b/net/sctp/bind_addr.c -@@ -140,14 +140,12 @@ void sctp_bind_addr_init(struct sctp_bind_addr *bp, __u16 port) - /* Dispose of the address list. */ - static void sctp_bind_addr_clean(struct sctp_bind_addr *bp) - { -- struct sctp_sockaddr_entry *addr; -- struct list_head *pos, *temp; -+ struct sctp_sockaddr_entry *addr, *temp; - - /* Empty the bind address list. */ -- list_for_each_safe(pos, temp, &bp->address_list) { -- addr = list_entry(pos, struct sctp_sockaddr_entry, list); -- list_del(pos); -- kfree(addr); -+ list_for_each_entry_safe(addr, temp, &bp->address_list, list) { -+ list_del_rcu(&addr->list); -+ call_rcu(&addr->rcu, sctp_local_addr_free); - SCTP_DBG_OBJCNT_DEC(addr); - } - } -diff --git a/net/socket.c b/net/socket.c -index 310d16b..65b2310 100644 ---- a/net/socket.c -+++ b/net/socket.c -@@ -2122,14 +2122,16 @@ int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen, - */ - if (MSG_CMSG_COMPAT & flags) { - err = __sys_recvmsg(sock, (struct msghdr __user *)compat_entry, -- &msg_sys, flags, datagrams); -+ &msg_sys, flags & ~MSG_WAITFORONE, -+ datagrams); - if (err < 0) - break; - err = __put_user(err, &compat_entry->msg_len); - ++compat_entry; - } else { - err = __sys_recvmsg(sock, (struct msghdr __user *)entry, -- &msg_sys, flags, datagrams); -+ &msg_sys, flags & ~MSG_WAITFORONE, -+ datagrams); - if (err < 0) - break; - err = put_user(err, &entry->msg_len); -diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c -index bf005d3..f34f5ab 100644 ---- a/net/sunrpc/xprtsock.c -+++ b/net/sunrpc/xprtsock.c -@@ -1344,7 +1344,6 @@ static void xs_tcp_state_change(struct sock *sk) - case TCP_CLOSE_WAIT: - /* The server initiated a shutdown of the socket */ - xprt_force_disconnect(xprt); -- case TCP_SYN_SENT: - xprt->connect_cookie++; - case TCP_CLOSING: - /* -@@ -1758,6 +1757,7 @@ static void xs_tcp_reuse_connection(struct sock_xprt *transport) - static int xs_tcp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock) - { - struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt); -+ int ret = -ENOTCONN; - - if (!transport->inet) { - struct sock *sk = sock->sk; -@@ -1789,12 +1789,22 @@ static int xs_tcp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock) - } - - if (!xprt_bound(xprt)) -- return -ENOTCONN; -+ goto out; - - /* Tell the socket layer to start connecting... */ - xprt->stat.connect_count++; - xprt->stat.connect_start = jiffies; -- return kernel_connect(sock, xs_addr(xprt), xprt->addrlen, O_NONBLOCK); -+ ret = kernel_connect(sock, xs_addr(xprt), xprt->addrlen, O_NONBLOCK); -+ switch (ret) { -+ case 0: -+ case -EINPROGRESS: -+ /* SYN_SENT! */ -+ xprt->connect_cookie++; -+ if (xprt->reestablish_timeout < XS_TCP_INIT_REEST_TO) -+ xprt->reestablish_timeout = XS_TCP_INIT_REEST_TO; -+ } -+out: -+ return ret; - } - - /** -diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c -index 4ebce42..2c70a1e 100644 ---- a/net/wireless/nl80211.c -+++ b/net/wireless/nl80211.c -@@ -1679,14 +1679,6 @@ static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info) - if (err) - goto out; - -- if (!(rdev->wiphy.flags & -- WIPHY_FLAG_SUPPORTS_SEPARATE_DEFAULT_KEYS)) { -- if (!key.def_uni || !key.def_multi) { -- err = -EOPNOTSUPP; -- goto out; -- } -- } -- - err = rdev->ops->set_default_key(&rdev->wiphy, dev, key.idx, - key.def_uni, key.def_multi); - -diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c -index ae3a698..ec1bcec 100644 ---- a/security/apparmor/lsm.c -+++ b/security/apparmor/lsm.c -@@ -593,7 +593,8 @@ static int apparmor_setprocattr(struct task_struct *task, char *name, - sa.aad.op = OP_SETPROCATTR; - sa.aad.info = name; - sa.aad.error = -EINVAL; -- return aa_audit(AUDIT_APPARMOR_DENIED, NULL, GFP_KERNEL, -+ return aa_audit(AUDIT_APPARMOR_DENIED, -+ __aa_current_profile(), GFP_KERNEL, - &sa, NULL); - } - } else if (strcmp(name, "exec") == 0) { -diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c -index 930634e..7a0c586 100644 ---- a/security/keys/process_keys.c -+++ b/security/keys/process_keys.c -@@ -845,6 +845,7 @@ void key_replace_session_keyring(void) - new-> sgid = old-> sgid; - new->fsgid = old->fsgid; - new->user = get_uid(old->user); -+ new->user_ns = new->user->user_ns; - new->group_info = get_group_info(old->group_info); - - new->securebits = old->securebits; -diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c -index 70a9d32..f5cad7c 100644 ---- a/sound/pci/hda/hda_intel.c -+++ b/sound/pci/hda/hda_intel.c -@@ -2349,9 +2349,16 @@ static int __devinit check_position_fix(struct azx *chip, int fix) - /* Check VIA/ATI HD Audio Controller exist */ - switch (chip->driver_type) { - case AZX_DRIVER_VIA: -- case AZX_DRIVER_ATI: - /* Use link position directly, avoid any transfer problem. */ - return POS_FIX_VIACOMBO; -+ case AZX_DRIVER_ATI: -+ /* ATI chipsets don't work well with position-buffer */ -+ return POS_FIX_LPIB; -+ case AZX_DRIVER_GENERIC: -+ /* AMD chipsets also don't work with position-buffer */ -+ if (chip->pci->vendor == PCI_VENDOR_ID_AMD) -+ return POS_FIX_LPIB; -+ break; - } - - return POS_FIX_AUTO; -diff --git a/sound/pci/hda/patch_analog.c b/sound/pci/hda/patch_analog.c -index 2942d2a..9f886bf 100644 ---- a/sound/pci/hda/patch_analog.c -+++ b/sound/pci/hda/patch_analog.c -@@ -3070,6 +3070,7 @@ static void ad1988_auto_init_analog_input(struct hda_codec *codec) - - for (i = 0; i < cfg->num_inputs; i++) { - hda_nid_t nid = cfg->inputs[i].pin; -+ int type = cfg->inputs[i].type; - switch (nid) { - case 0x15: /* port-C */ - snd_hda_codec_write(codec, 0x33, 0, AC_VERB_SET_CONNECT_SEL, 0x0); -@@ -3079,7 +3080,7 @@ static void ad1988_auto_init_analog_input(struct hda_codec *codec) - break; - } - snd_hda_codec_write(codec, nid, 0, AC_VERB_SET_PIN_WIDGET_CONTROL, -- i == AUTO_PIN_MIC ? PIN_VREF80 : PIN_IN); -+ type == AUTO_PIN_MIC ? PIN_VREF80 : PIN_IN); - if (nid != AD1988_PIN_CD_NID) - snd_hda_codec_write(codec, nid, 0, AC_VERB_SET_AMP_GAIN_MUTE, - AMP_OUT_MUTE); -diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c -index ad97d93..15b9d16 100644 ---- a/sound/pci/hda/patch_conexant.c -+++ b/sound/pci/hda/patch_conexant.c -@@ -3036,6 +3036,7 @@ static struct snd_pci_quirk cxt5066_cfg_tbl[] = { - SND_PCI_QUIRK(0x17aa, 0x215e, "Lenovo Thinkpad", CXT5066_THINKPAD), - SND_PCI_QUIRK(0x17aa, 0x21da, "Lenovo X220", CXT5066_THINKPAD), - SND_PCI_QUIRK(0x17aa, 0x21db, "Lenovo X220-tablet", CXT5066_THINKPAD), -+ SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo U350", CXT5066_ASUS), - SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo G560", CXT5066_ASUS), - SND_PCI_QUIRK_VENDOR(0x17aa, "Lenovo", CXT5066_IDEAPAD), /* Fallback for Lenovos without dock mic */ - {} -diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c -index 94d19c0..1e32235 100644 ---- a/sound/pci/hda/patch_sigmatel.c -+++ b/sound/pci/hda/patch_sigmatel.c -@@ -1600,7 +1600,7 @@ static struct snd_pci_quirk stac92hd73xx_cfg_tbl[] = { - SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x02fe, - "Dell Studio XPS 1645", STAC_DELL_M6_BOTH), - SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0413, -- "Dell Studio 1558", STAC_DELL_M6_BOTH), -+ "Dell Studio 1558", STAC_DELL_M6_DMIC), - {} /* terminator */ - }; - -diff --git a/sound/soc/codecs/wm_hubs.c b/sound/soc/codecs/wm_hubs.c -index 4005e9a..e55b298 100644 ---- a/sound/soc/codecs/wm_hubs.c -+++ b/sound/soc/codecs/wm_hubs.c -@@ -787,17 +787,17 @@ static const struct snd_soc_dapm_route analogue_routes[] = { - static const struct snd_soc_dapm_route lineout1_diff_routes[] = { - { "LINEOUT1 Mixer", "IN1L Switch", "IN1L PGA" }, - { "LINEOUT1 Mixer", "IN1R Switch", "IN1R PGA" }, -- { "LINEOUT1 Mixer", "Output Switch", "Left Output Mixer" }, -+ { "LINEOUT1 Mixer", "Output Switch", "Left Output PGA" }, - - { "LINEOUT1N Driver", NULL, "LINEOUT1 Mixer" }, - { "LINEOUT1P Driver", NULL, "LINEOUT1 Mixer" }, - }; - - static const struct snd_soc_dapm_route lineout1_se_routes[] = { -- { "LINEOUT1N Mixer", "Left Output Switch", "Left Output Mixer" }, -- { "LINEOUT1N Mixer", "Right Output Switch", "Left Output Mixer" }, -+ { "LINEOUT1N Mixer", "Left Output Switch", "Left Output PGA" }, -+ { "LINEOUT1N Mixer", "Right Output Switch", "Right Output PGA" }, - -- { "LINEOUT1P Mixer", "Left Output Switch", "Left Output Mixer" }, -+ { "LINEOUT1P Mixer", "Left Output Switch", "Left Output PGA" }, - - { "LINEOUT1N Driver", NULL, "LINEOUT1N Mixer" }, - { "LINEOUT1P Driver", NULL, "LINEOUT1P Mixer" }, -@@ -806,17 +806,17 @@ static const struct snd_soc_dapm_route lineout1_se_routes[] = { - static const struct snd_soc_dapm_route lineout2_diff_routes[] = { - { "LINEOUT2 Mixer", "IN2L Switch", "IN2L PGA" }, - { "LINEOUT2 Mixer", "IN2R Switch", "IN2R PGA" }, -- { "LINEOUT2 Mixer", "Output Switch", "Right Output Mixer" }, -+ { "LINEOUT2 Mixer", "Output Switch", "Right Output PGA" }, - - { "LINEOUT2N Driver", NULL, "LINEOUT2 Mixer" }, - { "LINEOUT2P Driver", NULL, "LINEOUT2 Mixer" }, - }; - - static const struct snd_soc_dapm_route lineout2_se_routes[] = { -- { "LINEOUT2N Mixer", "Left Output Switch", "Left Output Mixer" }, -- { "LINEOUT2N Mixer", "Right Output Switch", "Left Output Mixer" }, -+ { "LINEOUT2N Mixer", "Left Output Switch", "Left Output PGA" }, -+ { "LINEOUT2N Mixer", "Right Output Switch", "Right Output PGA" }, - -- { "LINEOUT2P Mixer", "Right Output Switch", "Right Output Mixer" }, -+ { "LINEOUT2P Mixer", "Right Output Switch", "Right Output PGA" }, - - { "LINEOUT2N Driver", NULL, "LINEOUT2N Mixer" }, - { "LINEOUT2P Driver", NULL, "LINEOUT2P Mixer" }, -@@ -836,17 +836,21 @@ int wm_hubs_add_analogue_controls(struct snd_soc_codec *codec) - snd_soc_update_bits(codec, WM8993_RIGHT_LINE_INPUT_3_4_VOLUME, - WM8993_IN2_VU, WM8993_IN2_VU); - -+ snd_soc_update_bits(codec, WM8993_SPEAKER_VOLUME_LEFT, -+ WM8993_SPKOUT_VU, WM8993_SPKOUT_VU); - snd_soc_update_bits(codec, WM8993_SPEAKER_VOLUME_RIGHT, - WM8993_SPKOUT_VU, WM8993_SPKOUT_VU); - - snd_soc_update_bits(codec, WM8993_LEFT_OUTPUT_VOLUME, -- WM8993_HPOUT1L_ZC, WM8993_HPOUT1L_ZC); -+ WM8993_HPOUT1_VU | WM8993_HPOUT1L_ZC, -+ WM8993_HPOUT1_VU | WM8993_HPOUT1L_ZC); - snd_soc_update_bits(codec, WM8993_RIGHT_OUTPUT_VOLUME, - WM8993_HPOUT1_VU | WM8993_HPOUT1R_ZC, - WM8993_HPOUT1_VU | WM8993_HPOUT1R_ZC); - - snd_soc_update_bits(codec, WM8993_LEFT_OPGA_VOLUME, -- WM8993_MIXOUTL_ZC, WM8993_MIXOUTL_ZC); -+ WM8993_MIXOUTL_ZC | WM8993_MIXOUT_VU, -+ WM8993_MIXOUTL_ZC | WM8993_MIXOUT_VU); - snd_soc_update_bits(codec, WM8993_RIGHT_OPGA_VOLUME, - WM8993_MIXOUTR_ZC | WM8993_MIXOUT_VU, - WM8993_MIXOUTR_ZC | WM8993_MIXOUT_VU); -diff --git a/sound/soc/pxa/raumfeld.c b/sound/soc/pxa/raumfeld.c -index 2afabaf..1a591f1 100644 ---- a/sound/soc/pxa/raumfeld.c -+++ b/sound/soc/pxa/raumfeld.c -@@ -151,13 +151,13 @@ static struct snd_soc_ops raumfeld_cs4270_ops = { - .hw_params = raumfeld_cs4270_hw_params, - }; - --static int raumfeld_line_suspend(struct snd_soc_card *card) -+static int raumfeld_analog_suspend(struct snd_soc_card *card) - { - raumfeld_enable_audio(false); - return 0; - } - --static int raumfeld_line_resume(struct snd_soc_card *card) -+static int raumfeld_analog_resume(struct snd_soc_card *card) - { - raumfeld_enable_audio(true); - return 0; -@@ -225,32 +225,53 @@ static struct snd_soc_ops raumfeld_ak4104_ops = { - .hw_params = raumfeld_ak4104_hw_params, - }; - --static struct snd_soc_dai_link raumfeld_dai[] = { -+#define DAI_LINK_CS4270 \ -+{ \ -+ .name = "CS4270", \ -+ .stream_name = "CS4270", \ -+ .cpu_dai_name = "pxa-ssp-dai.0", \ -+ .platform_name = "pxa-pcm-audio", \ -+ .codec_dai_name = "cs4270-hifi", \ -+ .codec_name = "cs4270-codec.0-0048", \ -+ .ops = &raumfeld_cs4270_ops, \ -+} -+ -+#define DAI_LINK_AK4104 \ -+{ \ -+ .name = "ak4104", \ -+ .stream_name = "Playback", \ -+ .cpu_dai_name = "pxa-ssp-dai.1", \ -+ .codec_dai_name = "ak4104-hifi", \ -+ .platform_name = "pxa-pcm-audio", \ -+ .ops = &raumfeld_ak4104_ops, \ -+ .codec_name = "spi0.0", \ -+} -+ -+static struct snd_soc_dai_link snd_soc_raumfeld_connector_dai[] = - { -- .name = "ak4104", -- .stream_name = "Playback", -- .cpu_dai_name = "pxa-ssp-dai.1", -- .codec_dai_name = "ak4104-hifi", -- .platform_name = "pxa-pcm-audio", -- .ops = &raumfeld_ak4104_ops, -- .codec_name = "ak4104-codec.0", --}, -+ DAI_LINK_CS4270, -+ DAI_LINK_AK4104, -+}; -+ -+static struct snd_soc_dai_link snd_soc_raumfeld_speaker_dai[] = - { -- .name = "CS4270", -- .stream_name = "CS4270", -- .cpu_dai_name = "pxa-ssp-dai.0", -- .platform_name = "pxa-pcm-audio", -- .codec_dai_name = "cs4270-hifi", -- .codec_name = "cs4270-codec.0-0048", -- .ops = &raumfeld_cs4270_ops, --},}; -- --static struct snd_soc_card snd_soc_raumfeld = { -- .name = "Raumfeld", -- .dai_link = raumfeld_dai, -- .suspend_post = raumfeld_line_suspend, -- .resume_pre = raumfeld_line_resume, -- .num_links = ARRAY_SIZE(raumfeld_dai), -+ DAI_LINK_CS4270, -+}; -+ -+static struct snd_soc_card snd_soc_raumfeld_connector = { -+ .name = "Raumfeld Connector", -+ .dai_link = snd_soc_raumfeld_connector_dai, -+ .num_links = ARRAY_SIZE(snd_soc_raumfeld_connector_dai), -+ .suspend_post = raumfeld_analog_suspend, -+ .resume_pre = raumfeld_analog_resume, -+}; -+ -+static struct snd_soc_card snd_soc_raumfeld_speaker = { -+ .name = "Raumfeld Speaker", -+ .dai_link = snd_soc_raumfeld_speaker_dai, -+ .num_links = ARRAY_SIZE(snd_soc_raumfeld_speaker_dai), -+ .suspend_post = raumfeld_analog_suspend, -+ .resume_pre = raumfeld_analog_resume, - }; - - static struct platform_device *raumfeld_audio_device; -@@ -271,22 +292,25 @@ static int __init raumfeld_audio_init(void) - - set_max9485_clk(MAX9485_MCLK_FREQ_122880); - -- /* Register LINE and SPDIF */ -+ /* Register analog device */ - raumfeld_audio_device = platform_device_alloc("soc-audio", 0); - if (!raumfeld_audio_device) - return -ENOMEM; - -- platform_set_drvdata(raumfeld_audio_device, -- &snd_soc_raumfeld); -- ret = platform_device_add(raumfeld_audio_device); -- -- /* no S/PDIF on Speakers */ - if (machine_is_raumfeld_speaker()) -+ platform_set_drvdata(raumfeld_audio_device, -+ &snd_soc_raumfeld_speaker); -+ -+ if (machine_is_raumfeld_connector()) -+ platform_set_drvdata(raumfeld_audio_device, -+ &snd_soc_raumfeld_connector); -+ -+ ret = platform_device_add(raumfeld_audio_device); -+ if (ret < 0) - return ret; - - raumfeld_enable_audio(true); -- -- return ret; -+ return 0; - } - - static void __exit raumfeld_audio_exit(void) diff --git a/2.6.39/4420_grsecurity-2.2.2-2.6.39.1-201106061957.patch b/2.6.39/4420_grsecurity-2.2.2-2.6.39.1-201106071941.patch index 8e4787c..3621970 100644 --- a/2.6.39/4420_grsecurity-2.2.2-2.6.39.1-201106061957.patch +++ b/2.6.39/4420_grsecurity-2.2.2-2.6.39.1-201106071941.patch @@ -22222,7 +22222,7 @@ diff -urNp linux-2.6.39.1/arch/x86/mm/init_64.c linux-2.6.39.1/arch/x86/mm/init_ return "[vsyscall]"; diff -urNp linux-2.6.39.1/arch/x86/mm/init.c linux-2.6.39.1/arch/x86/mm/init.c --- linux-2.6.39.1/arch/x86/mm/init.c 2011-05-19 00:06:34.000000000 -0400 -+++ linux-2.6.39.1/arch/x86/mm/init.c 2011-05-23 19:01:08.000000000 -0400 ++++ linux-2.6.39.1/arch/x86/mm/init.c 2011-06-07 19:41:11.000000000 -0400 @@ -33,7 +33,7 @@ int direct_gbpages static void __init find_early_table_space(unsigned long end, int use_pse, int use_gbpages) @@ -22232,25 +22232,34 @@ diff -urNp linux-2.6.39.1/arch/x86/mm/init.c linux-2.6.39.1/arch/x86/mm/init.c phys_addr_t base; puds = (end + PUD_SIZE - 1) >> PUD_SHIFT; -@@ -315,12 +315,25 @@ unsigned long __init_refok init_memory_m +@@ -315,12 +315,34 @@ unsigned long __init_refok init_memory_m */ int devmem_is_allowed(unsigned long pagenr) { - if (pagenr <= 256) -+#ifndef CONFIG_GRKERNSEC_KMEM ++#ifdef CONFIG_GRKERNSEC_KMEM ++ /* allow BDA */ ++ if (!pagenr) ++ return 1; ++ /* allow EBDA */ ++ if ((0x9f000 >> PAGE_SHIFT) == pagenr) ++ return 1; ++#else + if (!pagenr) + return 1; +#ifdef CONFIG_VM86 + if (pagenr < (ISA_START_ADDRESS >> PAGE_SHIFT)) + return 1; +#endif -+#else -+ if (pagenr < (ISA_START_ADDRESS >> PAGE_SHIFT)) -+ return 0; +#endif + + if ((ISA_START_ADDRESS >> PAGE_SHIFT) <= pagenr && pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT)) return 1; ++#ifdef CONFIG_GRKERNSEC_KMEM ++ /* throw out everything else below 1MB */ ++ if (pagenr <= 256) ++ return 0; ++#endif if (iomem_is_exclusive(pagenr << PAGE_SHIFT)) return 0; if (!page_is_ram(pagenr)) @@ -22259,7 +22268,7 @@ diff -urNp linux-2.6.39.1/arch/x86/mm/init.c linux-2.6.39.1/arch/x86/mm/init.c return 0; } -@@ -375,6 +388,86 @@ void free_init_pages(char *what, unsigne +@@ -375,6 +397,86 @@ void free_init_pages(char *what, unsigne void free_initmem(void) { @@ -29260,7 +29269,7 @@ diff -urNp linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_acpi.c linux-2.6.39.1/ .init = nouveau_dsm_init, diff -urNp linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_drv.h linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_drv.h --- linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_drv.h 2011-05-19 00:06:34.000000000 -0400 -+++ linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_drv.h 2011-05-23 17:07:00.000000000 -0400 ++++ linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_drv.h 2011-06-07 18:07:24.000000000 -0400 @@ -228,7 +228,7 @@ struct nouveau_channel { struct list_head pending; uint32_t sequence; @@ -29270,26 +29279,6 @@ diff -urNp linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_drv.h linux-2.6.39.1/d } fence; /* DMA push buffer */ -@@ -520,8 +520,8 @@ struct nouveau_vram_engine { - - struct nouveau_engine { - struct nouveau_instmem_engine instmem; -- struct nouveau_mc_engine mc; -- struct nouveau_timer_engine timer; -+ struct nouveau_mc_engine mc; -+ struct nouveau_timer_engine timer; - struct nouveau_fb_engine fb; - struct nouveau_pgraph_engine graph; - struct nouveau_fifo_engine fifo; -@@ -529,7 +529,7 @@ struct nouveau_engine { - struct nouveau_gpio_engine gpio; - struct nouveau_pm_engine pm; - struct nouveau_crypt_engine crypt; -- struct nouveau_vram_engine vram; -+ struct nouveau_vram_engine vram; - }; - - struct nouveau_pll_vals { @@ -662,7 +662,7 @@ struct drm_nouveau_private { struct drm_global_reference mem_global_ref; struct ttm_bo_global_ref bo_global_ref; @@ -32491,18 +32480,6 @@ diff -urNp linux-2.6.39.1/drivers/media/rc/rc-main.c linux-2.6.39.1/drivers/medi dev_set_name(&dev->dev, "rc%ld", dev->devno); dev_set_drvdata(&dev->dev, dev); rc = device_add(&dev->dev); -diff -urNp linux-2.6.39.1/drivers/media/video/au0828/au0828.h linux-2.6.39.1/drivers/media/video/au0828/au0828.h ---- linux-2.6.39.1/drivers/media/video/au0828/au0828.h 2011-05-19 00:06:34.000000000 -0400 -+++ linux-2.6.39.1/drivers/media/video/au0828/au0828.h 2011-05-22 19:36:31.000000000 -0400 -@@ -191,7 +191,7 @@ struct au0828_dev { - - /* I2C */ - struct i2c_adapter i2c_adap; -- struct i2c_algorithm i2c_algo; -+ struct i2c_algorithm i2c_algo; - struct i2c_client i2c_client; - u32 i2c_rc; - diff -urNp linux-2.6.39.1/drivers/media/video/cafe_ccic.c linux-2.6.39.1/drivers/media/video/cafe_ccic.c --- linux-2.6.39.1/drivers/media/video/cafe_ccic.c 2011-05-19 00:06:34.000000000 -0400 +++ linux-2.6.39.1/drivers/media/video/cafe_ccic.c 2011-05-22 19:36:31.000000000 -0400 @@ -34850,36 +34827,6 @@ diff -urNp linux-2.6.39.1/drivers/net/ixgbe/ixgbe.h linux-2.6.39.1/drivers/net/i #ifdef CONFIG_IXGBE_DCB extern const struct dcbnl_rtnl_ops dcbnl_ops; extern int ixgbe_copy_dcb_cfg(struct ixgbe_dcb_config *src_dcb_cfg, -diff -urNp linux-2.6.39.1/drivers/net/ixgbe/ixgbe_type.h linux-2.6.39.1/drivers/net/ixgbe/ixgbe_type.h ---- linux-2.6.39.1/drivers/net/ixgbe/ixgbe_type.h 2011-05-19 00:06:34.000000000 -0400 -+++ linux-2.6.39.1/drivers/net/ixgbe/ixgbe_type.h 2011-05-22 19:36:31.000000000 -0400 -@@ -2572,7 +2572,7 @@ struct ixgbe_phy_operations { - }; - - struct ixgbe_eeprom_info { -- struct ixgbe_eeprom_operations ops; -+ struct ixgbe_eeprom_operations ops; - enum ixgbe_eeprom_type type; - u32 semaphore_delay; - u16 word_size; -@@ -2581,7 +2581,7 @@ struct ixgbe_eeprom_info { - - #define IXGBE_FLAGS_DOUBLE_RESET_REQUIRED 0x01 - struct ixgbe_mac_info { -- struct ixgbe_mac_operations ops; -+ struct ixgbe_mac_operations ops; - enum ixgbe_mac_type type; - u8 addr[IXGBE_ETH_LENGTH_OF_ADDRESS]; - u8 perm_addr[IXGBE_ETH_LENGTH_OF_ADDRESS]; -@@ -2608,7 +2608,7 @@ struct ixgbe_mac_info { - }; - - struct ixgbe_phy_info { -- struct ixgbe_phy_operations ops; -+ struct ixgbe_phy_operations ops; - struct mdio_if_info mdio; - enum ixgbe_phy_type type; - u32 id; diff -urNp linux-2.6.39.1/drivers/net/ixgbe/ixgbe_x540.c linux-2.6.39.1/drivers/net/ixgbe/ixgbe_x540.c --- linux-2.6.39.1/drivers/net/ixgbe/ixgbe_x540.c 2011-05-19 00:06:34.000000000 -0400 +++ linux-2.6.39.1/drivers/net/ixgbe/ixgbe_x540.c 2011-05-22 19:36:31.000000000 -0400 @@ -35580,18 +35527,6 @@ diff -urNp linux-2.6.39.1/drivers/net/vmxnet3/vmxnet3_ethtool.c linux-2.6.39.1/d return -EINVAL; } -diff -urNp linux-2.6.39.1/drivers/net/vxge/vxge-config.h linux-2.6.39.1/drivers/net/vxge/vxge-config.h ---- linux-2.6.39.1/drivers/net/vxge/vxge-config.h 2011-05-19 00:06:34.000000000 -0400 -+++ linux-2.6.39.1/drivers/net/vxge/vxge-config.h 2011-05-22 19:36:31.000000000 -0400 -@@ -834,7 +834,7 @@ struct vxge_hw_device_hw_info { - struct vxge_hw_device_attr { - void __iomem *bar0; - struct pci_dev *pdev; -- struct vxge_hw_uld_cbs uld_callbacks; -+ struct vxge_hw_uld_cbs uld_callbacks; - }; - - #define VXGE_HW_DEVICE_LINK_STATE_SET(hldev, ls) (hldev->link_state = ls) diff -urNp linux-2.6.39.1/drivers/net/vxge/vxge-main.c linux-2.6.39.1/drivers/net/vxge/vxge-main.c --- linux-2.6.39.1/drivers/net/vxge/vxge-main.c 2011-05-19 00:06:34.000000000 -0400 +++ linux-2.6.39.1/drivers/net/vxge/vxge-main.c 2011-05-22 19:36:31.000000000 -0400 @@ -35889,20 +35824,6 @@ diff -urNp linux-2.6.39.1/drivers/net/wireless/ath/ath9k/htc.h linux-2.6.39.1/dr extern int htc_modparam_nohwcrypt; enum htc_phymode { -diff -urNp linux-2.6.39.1/drivers/net/wireless/ath/ath9k/hw.h linux-2.6.39.1/drivers/net/wireless/ath/ath9k/hw.h ---- linux-2.6.39.1/drivers/net/wireless/ath/ath9k/hw.h 2011-05-19 00:06:34.000000000 -0400 -+++ linux-2.6.39.1/drivers/net/wireless/ath/ath9k/hw.h 2011-05-22 19:36:31.000000000 -0400 -@@ -753,9 +753,7 @@ struct ath_hw { - } enable_32kHz_clock; - - /* Private to hardware code */ -- struct ath_hw_private_ops private_ops; -- /* Accessed by the lower level driver */ -- struct ath_hw_ops ops; -+ struct ath_hw_private_ops private_ops;struct ath_hw_ops ops; - - /* Used to program the radio on non single-chip devices */ - u32 *analogBank0Data; diff -urNp linux-2.6.39.1/drivers/net/wireless/b43/debugfs.c linux-2.6.39.1/drivers/net/wireless/b43/debugfs.c --- linux-2.6.39.1/drivers/net/wireless/b43/debugfs.c 2011-05-19 00:06:34.000000000 -0400 +++ linux-2.6.39.1/drivers/net/wireless/b43/debugfs.c 2011-05-22 19:36:31.000000000 -0400 @@ -47963,6 +47884,18 @@ diff -urNp linux-2.6.39.1/fs/jffs2/xattr.c linux-2.6.39.1/fs/jffs2/xattr.c /* Phase.1 : Merge same xref */ for (i=0; i < XREF_TMPHASH_SIZE; i++) xref_tmphash[i] = NULL; +diff -urNp linux-2.6.39.1/fs/jfs/super.c linux-2.6.39.1/fs/jfs/super.c +--- linux-2.6.39.1/fs/jfs/super.c 2011-05-19 00:06:34.000000000 -0400 ++++ linux-2.6.39.1/fs/jfs/super.c 2011-06-07 18:07:24.000000000 -0400 +@@ -803,7 +803,7 @@ static int __init init_jfs_fs(void) + + jfs_inode_cachep = + kmem_cache_create("jfs_ip", sizeof(struct jfs_inode_info), 0, +- SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD, ++ SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD|SLAB_USERCOPY, + init_once); + if (jfs_inode_cachep == NULL) + return -ENOMEM; diff -urNp linux-2.6.39.1/fs/Kconfig.binfmt linux-2.6.39.1/fs/Kconfig.binfmt --- linux-2.6.39.1/fs/Kconfig.binfmt 2011-05-19 00:06:34.000000000 -0400 +++ linux-2.6.39.1/fs/Kconfig.binfmt 2011-05-22 19:36:32.000000000 -0400 @@ -48994,7 +48927,7 @@ diff -urNp linux-2.6.39.1/fs/ocfs2/stackglue.h linux-2.6.39.1/fs/ocfs2/stackglue /* These are managed by the stackglue code. */ diff -urNp linux-2.6.39.1/fs/ocfs2/stack_o2cb.c linux-2.6.39.1/fs/ocfs2/stack_o2cb.c --- linux-2.6.39.1/fs/ocfs2/stack_o2cb.c 2011-05-19 00:06:34.000000000 -0400 -+++ linux-2.6.39.1/fs/ocfs2/stack_o2cb.c 2011-05-22 19:36:32.000000000 -0400 ++++ linux-2.6.39.1/fs/ocfs2/stack_o2cb.c 2011-06-07 18:07:24.000000000 -0400 @@ -358,7 +358,7 @@ static int o2cb_cluster_this_node(unsign return 0; } @@ -49004,14 +48937,6 @@ diff -urNp linux-2.6.39.1/fs/ocfs2/stack_o2cb.c linux-2.6.39.1/fs/ocfs2/stack_o2 .connect = o2cb_cluster_connect, .disconnect = o2cb_cluster_disconnect, .this_node = o2cb_cluster_this_node, -@@ -369,7 +369,6 @@ static struct ocfs2_stack_operations o2c - .lock_lvb = o2cb_dlm_lvb, - .dump_lksb = o2cb_dump_lksb, - }; -- - static struct ocfs2_stack_plugin o2cb_stack = { - .sp_name = "o2cb", - .sp_ops = &o2cb_stack_ops, diff -urNp linux-2.6.39.1/fs/ocfs2/stack_user.c linux-2.6.39.1/fs/ocfs2/stack_user.c --- linux-2.6.39.1/fs/ocfs2/stack_user.c 2011-05-19 00:06:34.000000000 -0400 +++ linux-2.6.39.1/fs/ocfs2/stack_user.c 2011-05-22 19:36:32.000000000 -0400 |