diff options
Diffstat (limited to '3.2.46/1039_linux-3.2.40.patch')
| -rw-r--r-- | 3.2.46/1039_linux-3.2.40.patch | 6295 |
1 files changed, 6295 insertions, 0 deletions
diff --git a/3.2.46/1039_linux-3.2.40.patch b/3.2.46/1039_linux-3.2.40.patch new file mode 100644 index 0000000..f26b39c --- /dev/null +++ b/3.2.46/1039_linux-3.2.40.patch @@ -0,0 +1,6295 @@ +diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt +index 81c287f..ddbf18e 100644 +--- a/Documentation/kernel-parameters.txt ++++ b/Documentation/kernel-parameters.txt +@@ -552,6 +552,8 @@ bytes respectively. Such letter suffixes can also be entirely omitted. + UART at the specified I/O port or MMIO address, + switching to the matching ttyS device later. The + options are the same as for ttyS, above. ++ hvc<n> Use the hypervisor console device <n>. This is for ++ both Xen and PowerPC hypervisors. + + If the device connected to the port is not a TTY but a braille + device, prepend "brl," before the device type, for instance +@@ -703,6 +705,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted. + + earlyprintk= [X86,SH,BLACKFIN] + earlyprintk=vga ++ earlyprintk=xen + earlyprintk=serial[,ttySn[,baudrate]] + earlyprintk=ttySn[,baudrate] + earlyprintk=dbgp[debugController#] +@@ -720,6 +723,8 @@ bytes respectively. Such letter suffixes can also be entirely omitted. + The VGA output is eventually overwritten by the real + console. + ++ The xen output can only be used by Xen PV guests. ++ + ekgdboc= [X86,KGDB] Allow early kernel console debugging + ekgdboc=kbd + +diff --git a/Makefile b/Makefile +index 0fceb8b..47af1e9 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 2 +-SUBLEVEL = 39 ++SUBLEVEL = 40 + EXTRAVERSION = + NAME = Saber-toothed Squirrel + +diff --git a/arch/arm/mach-pxa/include/mach/smemc.h b/arch/arm/mach-pxa/include/mach/smemc.h +index b7de471..b802f28 100644 +--- a/arch/arm/mach-pxa/include/mach/smemc.h ++++ b/arch/arm/mach-pxa/include/mach/smemc.h +@@ -37,6 +37,7 @@ + #define CSADRCFG1 (SMEMC_VIRT + 0x84) /* Address Configuration Register for CS1 */ + #define CSADRCFG2 (SMEMC_VIRT + 0x88) /* Address Configuration Register for CS2 */ + #define CSADRCFG3 (SMEMC_VIRT + 0x8C) /* Address Configuration Register for CS3 */ ++#define CSMSADRCFG (SMEMC_VIRT + 0xA0) /* Chip Select Configuration Register */ + + /* + * More handy macros for PCMCIA +diff --git a/arch/arm/mach-pxa/smemc.c b/arch/arm/mach-pxa/smemc.c +index 7992305..f38aa89 100644 +--- a/arch/arm/mach-pxa/smemc.c ++++ b/arch/arm/mach-pxa/smemc.c +@@ -40,6 +40,8 @@ static void pxa3xx_smemc_resume(void) + __raw_writel(csadrcfg[1], CSADRCFG1); + __raw_writel(csadrcfg[2], CSADRCFG2); + __raw_writel(csadrcfg[3], CSADRCFG3); ++ /* CSMSADRCFG wakes up in its default state (0), so we need to set it */ ++ __raw_writel(0x2, CSMSADRCFG); + } + + static struct syscore_ops smemc_syscore_ops = { +@@ -49,8 +51,19 @@ static struct syscore_ops smemc_syscore_ops = { + + static int __init smemc_init(void) + { +- if (cpu_is_pxa3xx()) ++ if (cpu_is_pxa3xx()) { ++ /* ++ * The only documentation we have on the ++ * Chip Select Configuration Register (CSMSADRCFG) is that ++ * it must be programmed to 0x2. ++ * Moreover, in the bit definitions, the second bit ++ * (CSMSADRCFG[1]) is called "SETALWAYS". ++ * Other bits are reserved in this register. ++ */ ++ __raw_writel(0x2, CSMSADRCFG); ++ + register_syscore_ops(&smemc_syscore_ops); ++ } + + return 0; + } +diff --git a/arch/arm/mach-s3c2410/include/mach/debug-macro.S b/arch/arm/mach-s3c2410/include/mach/debug-macro.S +index 4135de8..13ed33c 100644 +--- a/arch/arm/mach-s3c2410/include/mach/debug-macro.S ++++ b/arch/arm/mach-s3c2410/include/mach/debug-macro.S +@@ -40,17 +40,17 @@ + addeq \rd, \rx, #(S3C24XX_PA_GPIO - S3C24XX_PA_UART) + addne \rd, \rx, #(S3C24XX_VA_GPIO - S3C24XX_VA_UART) + bic \rd, \rd, #0xff000 +- ldr \rd, [ \rd, # S3C2410_GSTATUS1 - S3C2410_GPIOREG(0) ] ++ ldr \rd, [\rd, # S3C2410_GSTATUS1 - S3C2410_GPIOREG(0)] + and \rd, \rd, #0x00ff0000 + teq \rd, #0x00440000 @ is it 2440? + 1004: +- ldr \rd, [ \rx, # S3C2410_UFSTAT ] ++ ldr \rd, [\rx, # S3C2410_UFSTAT] + moveq \rd, \rd, lsr #SHIFT_2440TXF + tst \rd, #S3C2410_UFSTAT_TXFULL + .endm + + .macro fifo_full_s3c2410 rd, rx +- ldr \rd, [ \rx, # S3C2410_UFSTAT ] ++ ldr \rd, [\rx, # S3C2410_UFSTAT] + tst \rd, #S3C2410_UFSTAT_TXFULL + .endm + +@@ -68,18 +68,18 @@ + addeq \rd, \rx, #(S3C24XX_PA_GPIO - S3C24XX_PA_UART) + addne \rd, \rx, #(S3C24XX_VA_GPIO - S3C24XX_VA_UART) + bic \rd, \rd, #0xff000 +- ldr \rd, [ \rd, # S3C2410_GSTATUS1 - S3C2410_GPIOREG(0) ] ++ ldr \rd, [\rd, # S3C2410_GSTATUS1 - S3C2410_GPIOREG(0)] + and \rd, \rd, #0x00ff0000 + teq \rd, #0x00440000 @ is it 2440? + + 10000: +- ldr \rd, [ \rx, # S3C2410_UFSTAT ] ++ ldr \rd, [\rx, # S3C2410_UFSTAT] + andne \rd, \rd, #S3C2410_UFSTAT_TXMASK + andeq \rd, \rd, #S3C2440_UFSTAT_TXMASK + .endm + + .macro fifo_level_s3c2410 rd, rx +- ldr \rd, [ \rx, # S3C2410_UFSTAT ] ++ ldr \rd, [\rx, # S3C2410_UFSTAT] + and \rd, \rd, #S3C2410_UFSTAT_TXMASK + .endm + +diff --git a/arch/arm/mach-s3c2410/include/mach/entry-macro.S b/arch/arm/mach-s3c2410/include/mach/entry-macro.S +index 473b3cd..ef2287b 100644 +--- a/arch/arm/mach-s3c2410/include/mach/entry-macro.S ++++ b/arch/arm/mach-s3c2410/include/mach/entry-macro.S +@@ -34,10 +34,10 @@ + + @@ try the interrupt offset register, since it is there + +- ldr \irqstat, [ \base, #INTPND ] ++ ldr \irqstat, [\base, #INTPND ] + teq \irqstat, #0 + beq 1002f +- ldr \irqnr, [ \base, #INTOFFSET ] ++ ldr \irqnr, [\base, #INTOFFSET ] + mov \tmp, #1 + tst \irqstat, \tmp, lsl \irqnr + bne 1001f +diff --git a/arch/arm/mach-s3c2410/pm-h1940.S b/arch/arm/mach-s3c2410/pm-h1940.S +index c93bf2d..6183a68 100644 +--- a/arch/arm/mach-s3c2410/pm-h1940.S ++++ b/arch/arm/mach-s3c2410/pm-h1940.S +@@ -30,4 +30,4 @@ + + h1940_pm_return: + mov r0, #S3C2410_PA_GPIO +- ldr pc, [ r0, #S3C2410_GSTATUS3 - S3C24XX_VA_GPIO ] ++ ldr pc, [r0, #S3C2410_GSTATUS3 - S3C24XX_VA_GPIO] +diff --git a/arch/arm/mach-s3c2410/sleep.S b/arch/arm/mach-s3c2410/sleep.S +index dd5b638..65200ae 100644 +--- a/arch/arm/mach-s3c2410/sleep.S ++++ b/arch/arm/mach-s3c2410/sleep.S +@@ -45,9 +45,9 @@ ENTRY(s3c2410_cpu_suspend) + ldr r4, =S3C2410_REFRESH + ldr r5, =S3C24XX_MISCCR + ldr r6, =S3C2410_CLKCON +- ldr r7, [ r4 ] @ get REFRESH (and ensure in TLB) +- ldr r8, [ r5 ] @ get MISCCR (and ensure in TLB) +- ldr r9, [ r6 ] @ get CLKCON (and ensure in TLB) ++ ldr r7, [r4] @ get REFRESH (and ensure in TLB) ++ ldr r8, [r5] @ get MISCCR (and ensure in TLB) ++ ldr r9, [r6] @ get CLKCON (and ensure in TLB) + + orr r7, r7, #S3C2410_REFRESH_SELF @ SDRAM sleep command + orr r8, r8, #S3C2410_MISCCR_SDSLEEP @ SDRAM power-down signals +@@ -61,8 +61,8 @@ ENTRY(s3c2410_cpu_suspend) + @@ align next bit of code to cache line + .align 5 + s3c2410_do_sleep: +- streq r7, [ r4 ] @ SDRAM sleep command +- streq r8, [ r5 ] @ SDRAM power-down config +- streq r9, [ r6 ] @ CPU sleep ++ streq r7, [r4] @ SDRAM sleep command ++ streq r8, [r5] @ SDRAM power-down config ++ streq r9, [r6] @ CPU sleep + 1: beq 1b + mov pc, r14 +diff --git a/arch/arm/mach-s3c2412/sleep.S b/arch/arm/mach-s3c2412/sleep.S +index c82418e..5adaceb 100644 +--- a/arch/arm/mach-s3c2412/sleep.S ++++ b/arch/arm/mach-s3c2412/sleep.S +@@ -57,12 +57,12 @@ s3c2412_sleep_enter1: + * retry, as simply returning causes the system to lock. + */ + +- ldrne r9, [ r1 ] +- strne r9, [ r1 ] +- ldrne r9, [ r2 ] +- strne r9, [ r2 ] +- ldrne r9, [ r3 ] +- strne r9, [ r3 ] ++ ldrne r9, [r1] ++ strne r9, [r1] ++ ldrne r9, [r2] ++ strne r9, [r2] ++ ldrne r9, [r3] ++ strne r9, [r3] + bne s3c2412_sleep_enter1 + + mov pc, r14 +diff --git a/arch/arm/mach-w90x900/include/mach/entry-macro.S b/arch/arm/mach-w90x900/include/mach/entry-macro.S +index d39aca5..08436cf 100644 +--- a/arch/arm/mach-w90x900/include/mach/entry-macro.S ++++ b/arch/arm/mach-w90x900/include/mach/entry-macro.S +@@ -22,8 +22,8 @@ + + mov \base, #AIC_BA + +- ldr \irqnr, [ \base, #AIC_IPER] +- ldr \irqnr, [ \base, #AIC_ISNR] ++ ldr \irqnr, [\base, #AIC_IPER] ++ ldr \irqnr, [\base, #AIC_ISNR] + cmp \irqnr, #0 + + .endm +diff --git a/arch/arm/plat-samsung/include/plat/debug-macro.S b/arch/arm/plat-samsung/include/plat/debug-macro.S +index 207e275..f3a9cff 100644 +--- a/arch/arm/plat-samsung/include/plat/debug-macro.S ++++ b/arch/arm/plat-samsung/include/plat/debug-macro.S +@@ -14,12 +14,12 @@ + /* The S5PV210/S5PC110 implementations are as belows. */ + + .macro fifo_level_s5pv210 rd, rx +- ldr \rd, [ \rx, # S3C2410_UFSTAT ] ++ ldr \rd, [\rx, # S3C2410_UFSTAT] + and \rd, \rd, #S5PV210_UFSTAT_TXMASK + .endm + + .macro fifo_full_s5pv210 rd, rx +- ldr \rd, [ \rx, # S3C2410_UFSTAT ] ++ ldr \rd, [\rx, # S3C2410_UFSTAT] + tst \rd, #S5PV210_UFSTAT_TXFULL + .endm + +@@ -27,7 +27,7 @@ + * most widely re-used */ + + .macro fifo_level_s3c2440 rd, rx +- ldr \rd, [ \rx, # S3C2410_UFSTAT ] ++ ldr \rd, [\rx, # S3C2410_UFSTAT] + and \rd, \rd, #S3C2440_UFSTAT_TXMASK + .endm + +@@ -36,7 +36,7 @@ + #endif + + .macro fifo_full_s3c2440 rd, rx +- ldr \rd, [ \rx, # S3C2410_UFSTAT ] ++ ldr \rd, [\rx, # S3C2410_UFSTAT] + tst \rd, #S3C2440_UFSTAT_TXFULL + .endm + +@@ -45,11 +45,11 @@ + #endif + + .macro senduart,rd,rx +- strb \rd, [\rx, # S3C2410_UTXH ] ++ strb \rd, [\rx, # S3C2410_UTXH] + .endm + + .macro busyuart, rd, rx +- ldr \rd, [ \rx, # S3C2410_UFCON ] ++ ldr \rd, [\rx, # S3C2410_UFCON] + tst \rd, #S3C2410_UFCON_FIFOMODE @ fifo enabled? + beq 1001f @ + @ FIFO enabled... +@@ -60,7 +60,7 @@ + + 1001: + @ busy waiting for non fifo +- ldr \rd, [ \rx, # S3C2410_UTRSTAT ] ++ ldr \rd, [\rx, # S3C2410_UTRSTAT] + tst \rd, #S3C2410_UTRSTAT_TXFE + beq 1001b + +@@ -68,7 +68,7 @@ + .endm + + .macro waituart,rd,rx +- ldr \rd, [ \rx, # S3C2410_UFCON ] ++ ldr \rd, [\rx, # S3C2410_UFCON] + tst \rd, #S3C2410_UFCON_FIFOMODE @ fifo enabled? + beq 1001f @ + @ FIFO enabled... +@@ -79,7 +79,7 @@ + b 1002f + 1001: + @ idle waiting for non fifo +- ldr \rd, [ \rx, # S3C2410_UTRSTAT ] ++ ldr \rd, [\rx, # S3C2410_UTRSTAT] + tst \rd, #S3C2410_UTRSTAT_TXFE + beq 1001b + +diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h +index 22dadeb..9d35a3e 100644 +--- a/arch/parisc/include/asm/pgtable.h ++++ b/arch/parisc/include/asm/pgtable.h +@@ -12,11 +12,10 @@ + + #include <linux/bitops.h> + #include <linux/spinlock.h> ++#include <linux/mm_types.h> + #include <asm/processor.h> + #include <asm/cache.h> + +-struct vm_area_struct; +- + /* + * kern_addr_valid(ADDR) tests if ADDR is pointing to valid kernel + * memory. For the return value to be meaningful, ADDR must be >= +@@ -40,7 +39,14 @@ struct vm_area_struct; + do{ \ + *(pteptr) = (pteval); \ + } while(0) +-#define set_pte_at(mm,addr,ptep,pteval) set_pte(ptep,pteval) ++ ++extern void purge_tlb_entries(struct mm_struct *, unsigned long); ++ ++#define set_pte_at(mm, addr, ptep, pteval) \ ++ do { \ ++ set_pte(ptep, pteval); \ ++ purge_tlb_entries(mm, addr); \ ++ } while (0) + + #endif /* !__ASSEMBLY__ */ + +@@ -464,6 +470,7 @@ static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addr, + old = pte_val(*ptep); + new = pte_val(pte_wrprotect(__pte (old))); + } while (cmpxchg((unsigned long *) ptep, old, new) != old); ++ purge_tlb_entries(mm, addr); + #else + pte_t old_pte = *ptep; + set_pte_at(mm, addr, ptep, pte_wrprotect(old_pte)); +diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c +index 83335f3..5241698 100644 +--- a/arch/parisc/kernel/cache.c ++++ b/arch/parisc/kernel/cache.c +@@ -421,6 +421,24 @@ void kunmap_parisc(void *addr) + EXPORT_SYMBOL(kunmap_parisc); + #endif + ++void purge_tlb_entries(struct mm_struct *mm, unsigned long addr) ++{ ++ unsigned long flags; ++ ++ /* Note: purge_tlb_entries can be called at startup with ++ no context. */ ++ ++ /* Disable preemption while we play with %sr1. */ ++ preempt_disable(); ++ mtsp(mm->context, 1); ++ purge_tlb_start(flags); ++ pdtlb(addr); ++ pitlb(addr); ++ purge_tlb_end(flags); ++ preempt_enable(); ++} ++EXPORT_SYMBOL(purge_tlb_entries); ++ + void __flush_tlb_range(unsigned long sid, unsigned long start, + unsigned long end) + { +diff --git a/arch/powerpc/include/asm/eeh.h b/arch/powerpc/include/asm/eeh.h +index 66ea9b8..21165a4 100644 +--- a/arch/powerpc/include/asm/eeh.h ++++ b/arch/powerpc/include/asm/eeh.h +@@ -61,6 +61,7 @@ void __init pci_addr_cache_build(void); + */ + void eeh_add_device_tree_early(struct device_node *); + void eeh_add_device_tree_late(struct pci_bus *); ++void eeh_add_sysfs_files(struct pci_bus *); + + /** + * eeh_remove_device_recursive - undo EEH for device & children. +@@ -105,6 +106,8 @@ static inline void eeh_add_device_tree_early(struct device_node *dn) { } + + static inline void eeh_add_device_tree_late(struct pci_bus *bus) { } + ++static inline void eeh_add_sysfs_files(struct pci_bus *bus) { } ++ + static inline void eeh_remove_bus_device(struct pci_dev *dev) { } + #define EEH_POSSIBLE_ERROR(val, type) (0) + #define EEH_IO_ERROR_VALUE(size) (-1UL) +diff --git a/arch/powerpc/kernel/machine_kexec_64.c b/arch/powerpc/kernel/machine_kexec_64.c +index 26ccbf7..4c0908d 100644 +--- a/arch/powerpc/kernel/machine_kexec_64.c ++++ b/arch/powerpc/kernel/machine_kexec_64.c +@@ -162,6 +162,8 @@ static int kexec_all_irq_disabled = 0; + static void kexec_smp_down(void *arg) + { + local_irq_disable(); ++ hard_irq_disable(); ++ + mb(); /* make sure our irqs are disabled before we say they are */ + get_paca()->kexec_state = KEXEC_STATE_IRQS_OFF; + while(kexec_all_irq_disabled == 0) +@@ -244,6 +246,8 @@ static void kexec_prepare_cpus(void) + wake_offline_cpus(); + smp_call_function(kexec_smp_down, NULL, /* wait */0); + local_irq_disable(); ++ hard_irq_disable(); ++ + mb(); /* make sure IRQs are disabled before we say they are */ + get_paca()->kexec_state = KEXEC_STATE_IRQS_OFF; + +@@ -281,6 +285,7 @@ static void kexec_prepare_cpus(void) + if (ppc_md.kexec_cpu_down) + ppc_md.kexec_cpu_down(0, 0); + local_irq_disable(); ++ hard_irq_disable(); + } + + #endif /* SMP */ +diff --git a/arch/powerpc/kernel/of_platform.c b/arch/powerpc/kernel/of_platform.c +index e1612df..b10beef 100644 +--- a/arch/powerpc/kernel/of_platform.c ++++ b/arch/powerpc/kernel/of_platform.c +@@ -91,6 +91,9 @@ static int __devinit of_pci_phb_probe(struct platform_device *dev) + /* Add probed PCI devices to the device model */ + pci_bus_add_devices(phb->bus); + ++ /* sysfs files should only be added after devices are added */ ++ eeh_add_sysfs_files(phb->bus); ++ + return 0; + } + +diff --git a/arch/powerpc/kernel/pci-common.c b/arch/powerpc/kernel/pci-common.c +index 458ed3b..a3cd949 100644 +--- a/arch/powerpc/kernel/pci-common.c ++++ b/arch/powerpc/kernel/pci-common.c +@@ -1536,11 +1536,14 @@ void pcibios_finish_adding_to_bus(struct pci_bus *bus) + pcibios_allocate_bus_resources(bus); + pcibios_claim_one_bus(bus); + ++ /* Fixup EEH */ ++ eeh_add_device_tree_late(bus); ++ + /* Add new devices to global lists. Register in proc, sysfs. */ + pci_bus_add_devices(bus); + +- /* Fixup EEH */ +- eeh_add_device_tree_late(bus); ++ /* sysfs files should only be added after devices are added */ ++ eeh_add_sysfs_files(bus); + } + EXPORT_SYMBOL_GPL(pcibios_finish_adding_to_bus); + +diff --git a/arch/powerpc/platforms/pseries/eeh.c b/arch/powerpc/platforms/pseries/eeh.c +index 5658690..389e06b 100644 +--- a/arch/powerpc/platforms/pseries/eeh.c ++++ b/arch/powerpc/platforms/pseries/eeh.c +@@ -1238,7 +1238,6 @@ static void eeh_add_device_late(struct pci_dev *dev) + pdn->pcidev = dev; + + pci_addr_cache_insert_device(dev); +- eeh_sysfs_add_device(dev); + } + + void eeh_add_device_tree_late(struct pci_bus *bus) +@@ -1257,6 +1256,29 @@ void eeh_add_device_tree_late(struct pci_bus *bus) + EXPORT_SYMBOL_GPL(eeh_add_device_tree_late); + + /** ++ * eeh_add_sysfs_files - Add EEH sysfs files for the indicated PCI bus ++ * @bus: PCI bus ++ * ++ * This routine must be used to add EEH sysfs files for PCI ++ * devices which are attached to the indicated PCI bus. The PCI bus ++ * is added after system boot through hotplug or dlpar. ++ */ ++void eeh_add_sysfs_files(struct pci_bus *bus) ++{ ++ struct pci_dev *dev; ++ ++ list_for_each_entry(dev, &bus->devices, bus_list) { ++ eeh_sysfs_add_device(dev); ++ if (dev->hdr_type == PCI_HEADER_TYPE_BRIDGE) { ++ struct pci_bus *subbus = dev->subordinate; ++ if (subbus) ++ eeh_add_sysfs_files(subbus); ++ } ++ } ++} ++EXPORT_SYMBOL_GPL(eeh_add_sysfs_files); ++ ++/** + * eeh_remove_device - undo EEH setup for the indicated pci device + * @dev: pci device to be removed + * +diff --git a/arch/s390/kernel/time.c b/arch/s390/kernel/time.c +index 8644366..b2f44de 100644 +--- a/arch/s390/kernel/time.c ++++ b/arch/s390/kernel/time.c +@@ -121,6 +121,9 @@ static int s390_next_ktime(ktime_t expires, + nsecs = ktime_to_ns(ktime_add(timespec_to_ktime(ts), expires)); + do_div(nsecs, 125); + S390_lowcore.clock_comparator = sched_clock_base_cc + (nsecs << 9); ++ /* Program the maximum value if we have an overflow (== year 2042) */ ++ if (unlikely(S390_lowcore.clock_comparator < sched_clock_base_cc)) ++ S390_lowcore.clock_comparator = -1ULL; + set_clock_comparator(S390_lowcore.clock_comparator); + return 0; + } +diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c +index dffcaa4..4db9b1e 100644 +--- a/arch/s390/kvm/kvm-s390.c ++++ b/arch/s390/kvm/kvm-s390.c +@@ -597,6 +597,14 @@ int kvm_s390_vcpu_store_status(struct kvm_vcpu *vcpu, unsigned long addr) + } else + prefix = 0; + ++ /* ++ * The guest FPRS and ACRS are in the host FPRS/ACRS due to the lazy ++ * copying in vcpu load/put. Lets update our copies before we save ++ * it into the save area ++ */ ++ save_fp_regs(&vcpu->arch.guest_fpregs); ++ save_access_regs(vcpu->arch.guest_acrs); ++ + if (__guestcopy(vcpu, addr + offsetof(struct save_area, fp_regs), + vcpu->arch.guest_fpregs.fprs, 128, prefix)) + return -EFAULT; +diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig +index efb4294..9a42703 100644 +--- a/arch/x86/Kconfig ++++ b/arch/x86/Kconfig +@@ -1150,7 +1150,7 @@ config DIRECT_GBPAGES + config NUMA + bool "Numa Memory Allocation and Scheduler Support" + depends on SMP +- depends on X86_64 || (X86_32 && HIGHMEM64G && (X86_NUMAQ || X86_BIGSMP || X86_SUMMIT && ACPI) && EXPERIMENTAL) ++ depends on X86_64 || (X86_32 && HIGHMEM64G && (X86_NUMAQ || X86_BIGSMP || X86_SUMMIT && ACPI) && BROKEN) + default y if (X86_NUMAQ || X86_SUMMIT || X86_BIGSMP) + ---help--- + Enable NUMA (Non Uniform Memory Access) support. +diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h +index 884507e..6be9909 100644 +--- a/arch/x86/include/asm/pgtable.h ++++ b/arch/x86/include/asm/pgtable.h +@@ -142,6 +142,11 @@ static inline unsigned long pmd_pfn(pmd_t pmd) + return (pmd_val(pmd) & PTE_PFN_MASK) >> PAGE_SHIFT; + } + ++static inline unsigned long pud_pfn(pud_t pud) ++{ ++ return (pud_val(pud) & PTE_PFN_MASK) >> PAGE_SHIFT; ++} ++ + #define pte_page(pte) pfn_to_page(pte_pfn(pte)) + + static inline int pmd_large(pmd_t pte) +diff --git a/arch/x86/kernel/apic/x2apic_phys.c b/arch/x86/kernel/apic/x2apic_phys.c +index f5373df..db4f704 100644 +--- a/arch/x86/kernel/apic/x2apic_phys.c ++++ b/arch/x86/kernel/apic/x2apic_phys.c +@@ -20,12 +20,19 @@ static int set_x2apic_phys_mode(char *arg) + } + early_param("x2apic_phys", set_x2apic_phys_mode); + ++static bool x2apic_fadt_phys(void) ++{ ++ if ((acpi_gbl_FADT.header.revision >= FADT2_REVISION_ID) && ++ (acpi_gbl_FADT.flags & ACPI_FADT_APIC_PHYSICAL)) { ++ printk(KERN_DEBUG "System requires x2apic physical mode\n"); ++ return true; ++ } ++ return false; ++} ++ + static int x2apic_acpi_madt_oem_check(char *oem_id, char *oem_table_id) + { +- if (x2apic_phys) +- return x2apic_enabled(); +- else +- return 0; ++ return x2apic_enabled() && (x2apic_phys || x2apic_fadt_phys()); + } + + static void +@@ -108,7 +115,7 @@ static void init_x2apic_ldr(void) + + static int x2apic_phys_probe(void) + { +- if (x2apic_mode && x2apic_phys) ++ if (x2apic_mode && (x2apic_phys || x2apic_fadt_phys())) + return 1; + + return apic == &apic_x2apic_phys; +diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c +index 0a630dd..646d192 100644 +--- a/arch/x86/kernel/cpu/mshyperv.c ++++ b/arch/x86/kernel/cpu/mshyperv.c +@@ -68,7 +68,8 @@ static void __init ms_hyperv_init_platform(void) + printk(KERN_INFO "HyperV: features 0x%x, hints 0x%x\n", + ms_hyperv.features, ms_hyperv.hints); + +- clocksource_register_hz(&hyperv_cs, NSEC_PER_SEC/100); ++ if (ms_hyperv.features & HV_X64_MSR_TIME_REF_COUNT_AVAILABLE) ++ clocksource_register_hz(&hyperv_cs, NSEC_PER_SEC/100); + } + + const __refconst struct hypervisor_x86 x86_hyper_ms_hyperv = { +diff --git a/arch/x86/kernel/head.c b/arch/x86/kernel/head.c +index af0699b..f6c4674 100644 +--- a/arch/x86/kernel/head.c ++++ b/arch/x86/kernel/head.c +@@ -5,8 +5,6 @@ + #include <asm/setup.h> + #include <asm/bios_ebda.h> + +-#define BIOS_LOWMEM_KILOBYTES 0x413 +- + /* + * The BIOS places the EBDA/XBDA at the top of conventional + * memory, and usually decreases the reported amount of +@@ -16,17 +14,30 @@ + * chipset: reserve a page before VGA to prevent PCI prefetch + * into it (errata #56). Usually the page is reserved anyways, + * unless you have no PS/2 mouse plugged in. ++ * ++ * This functions is deliberately very conservative. Losing ++ * memory in the bottom megabyte is rarely a problem, as long ++ * as we have enough memory to install the trampoline. Using ++ * memory that is in use by the BIOS or by some DMA device ++ * the BIOS didn't shut down *is* a big problem. + */ ++ ++#define BIOS_LOWMEM_KILOBYTES 0x413 ++#define LOWMEM_CAP 0x9f000U /* Absolute maximum */ ++#define INSANE_CUTOFF 0x20000U /* Less than this = insane */ ++ + void __init reserve_ebda_region(void) + { + unsigned int lowmem, ebda_addr; + +- /* To determine the position of the EBDA and the */ +- /* end of conventional memory, we need to look at */ +- /* the BIOS data area. In a paravirtual environment */ +- /* that area is absent. We'll just have to assume */ +- /* that the paravirt case can handle memory setup */ +- /* correctly, without our help. */ ++ /* ++ * To determine the position of the EBDA and the ++ * end of conventional memory, we need to look at ++ * the BIOS data area. In a paravirtual environment ++ * that area is absent. We'll just have to assume ++ * that the paravirt case can handle memory setup ++ * correctly, without our help. ++ */ + if (paravirt_enabled()) + return; + +@@ -37,19 +48,23 @@ void __init reserve_ebda_region(void) + /* start of EBDA area */ + ebda_addr = get_bios_ebda(); + +- /* Fixup: bios puts an EBDA in the top 64K segment */ +- /* of conventional memory, but does not adjust lowmem. */ +- if ((lowmem - ebda_addr) <= 0x10000) +- lowmem = ebda_addr; ++ /* ++ * Note: some old Dells seem to need 4k EBDA without ++ * reporting so, so just consider the memory above 0x9f000 ++ * to be off limits (bugzilla 2990). ++ */ ++ ++ /* If the EBDA address is below 128K, assume it is bogus */ ++ if (ebda_addr < INSANE_CUTOFF) ++ ebda_addr = LOWMEM_CAP; + +- /* Fixup: bios does not report an EBDA at all. */ +- /* Some old Dells seem to need 4k anyhow (bugzilla 2990) */ +- if ((ebda_addr == 0) && (lowmem >= 0x9f000)) +- lowmem = 0x9f000; ++ /* If lowmem is less than 128K, assume it is bogus */ ++ if (lowmem < INSANE_CUTOFF) ++ lowmem = LOWMEM_CAP; + +- /* Paranoia: should never happen, but... */ +- if ((lowmem == 0) || (lowmem >= 0x100000)) +- lowmem = 0x9f000; ++ /* Use the lower of the lowmem and EBDA markers as the cutoff */ ++ lowmem = min(lowmem, ebda_addr); ++ lowmem = min(lowmem, LOWMEM_CAP); /* Absolute cap */ + + /* reserve all memory between lowmem and the 1MB mark */ + memblock_x86_reserve_range(lowmem, 0x100000, "* BIOS reserved"); +diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c +index 5db0490..7b73c88 100644 +--- a/arch/x86/mm/fault.c ++++ b/arch/x86/mm/fault.c +@@ -738,13 +738,15 @@ __bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code, + return; + } + #endif ++ /* Kernel addresses are always protection faults: */ ++ if (address >= TASK_SIZE) ++ error_code |= PF_PROT; + +- if (unlikely(show_unhandled_signals)) ++ if (likely(show_unhandled_signals)) + show_signal_msg(regs, error_code, address, tsk); + +- /* Kernel addresses are always protection faults: */ + tsk->thread.cr2 = address; +- tsk->thread.error_code = error_code | (address >= TASK_SIZE); ++ tsk->thread.error_code = error_code; + tsk->thread.trap_no = 14; + + force_sig_info_fault(SIGSEGV, si_code, address, tsk, 0); +diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c +index bbaaa00..44b93da 100644 +--- a/arch/x86/mm/init_64.c ++++ b/arch/x86/mm/init_64.c +@@ -831,6 +831,9 @@ int kern_addr_valid(unsigned long addr) + if (pud_none(*pud)) + return 0; + ++ if (pud_large(*pud)) ++ return pfn_valid(pud_pfn(*pud)); ++ + pmd = pmd_offset(pud, addr); + if (pmd_none(*pmd)) + return 0; +diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c +index bef9991..1de542b 100644 +--- a/arch/x86/platform/efi/efi.c ++++ b/arch/x86/platform/efi/efi.c +@@ -83,9 +83,10 @@ int efi_enabled(int facility) + } + EXPORT_SYMBOL(efi_enabled); + ++static bool disable_runtime = false; + static int __init setup_noefi(char *arg) + { +- clear_bit(EFI_BOOT, &x86_efi_facility); ++ disable_runtime = true; + return 0; + } + early_param("noefi", setup_noefi); +@@ -549,35 +550,37 @@ void __init efi_init(void) + + set_bit(EFI_CONFIG_TABLES, &x86_efi_facility); + +- /* +- * Check out the runtime services table. We need to map +- * the runtime services table so that we can grab the physical +- * address of several of the EFI runtime functions, needed to +- * set the firmware into virtual mode. +- */ +- runtime = early_ioremap((unsigned long)efi.systab->runtime, +- sizeof(efi_runtime_services_t)); +- if (runtime != NULL) { +- /* +- * We will only need *early* access to the following +- * two EFI runtime services before set_virtual_address_map +- * is invoked. +- */ +- efi_phys.get_time = (efi_get_time_t *)runtime->get_time; +- efi_phys.set_virtual_address_map = +- (efi_set_virtual_address_map_t *) +- runtime->set_virtual_address_map; ++ if (!disable_runtime) { + /* +- * Make efi_get_time can be called before entering +- * virtual mode. ++ * Check out the runtime services table. We need to map ++ * the runtime services table so that we can grab the physical ++ * address of several of the EFI runtime functions, needed to ++ * set the firmware into virtual mode. + */ +- efi.get_time = phys_efi_get_time; +- +- set_bit(EFI_RUNTIME_SERVICES, &x86_efi_facility); +- } else +- printk(KERN_ERR "Could not map the EFI runtime service " +- "table!\n"); +- early_iounmap(runtime, sizeof(efi_runtime_services_t)); ++ runtime = early_ioremap((unsigned long)efi.systab->runtime, ++ sizeof(efi_runtime_services_t)); ++ if (runtime != NULL) { ++ /* ++ * We will only need *early* access to the following ++ * two EFI runtime services before set_virtual_address_map ++ * is invoked. ++ */ ++ efi_phys.get_time = (efi_get_time_t *)runtime->get_time; ++ efi_phys.set_virtual_address_map = ++ (efi_set_virtual_address_map_t *) ++ runtime->set_virtual_address_map; ++ /* ++ * Make efi_get_time can be called before entering ++ * virtual mode. ++ */ ++ efi.get_time = phys_efi_get_time; ++ ++ set_bit(EFI_RUNTIME_SERVICES, &x86_efi_facility); ++ } else ++ printk(KERN_ERR "Could not map the EFI runtime service " ++ "table!\n"); ++ early_iounmap(runtime, sizeof(efi_runtime_services_t)); ++ } + + /* Map the EFI memory map */ + memmap.map = early_ioremap((unsigned long)memmap.phys_map, +diff --git a/arch/x86/xen/spinlock.c b/arch/x86/xen/spinlock.c +index d69cc6c..67bc7ba 100644 +--- a/arch/x86/xen/spinlock.c ++++ b/arch/x86/xen/spinlock.c +@@ -328,7 +328,6 @@ static noinline void xen_spin_unlock_slow(struct xen_spinlock *xl) + if (per_cpu(lock_spinners, cpu) == xl) { + ADD_STATS(released_slow_kicked, 1); + xen_send_IPI_one(cpu, XEN_SPIN_UNLOCK_VECTOR); +- break; + } + } + } +diff --git a/block/genhd.c b/block/genhd.c +index 4927476..6edf228 100644 +--- a/block/genhd.c ++++ b/block/genhd.c +@@ -26,7 +26,7 @@ static DEFINE_MUTEX(block_class_lock); + struct kobject *block_depr; + + /* for extended dynamic devt allocation, currently only one major is used */ +-#define MAX_EXT_DEVT (1 << MINORBITS) ++#define NR_EXT_DEVT (1 << MINORBITS) + + /* For extended devt allocation. ext_devt_mutex prevents look up + * results from going away underneath its user. +@@ -421,17 +421,18 @@ int blk_alloc_devt(struct hd_struct *part, dev_t *devt) + do { + if (!idr_pre_get(&ext_devt_idr, GFP_KERNEL)) + return -ENOMEM; ++ mutex_lock(&ext_devt_mutex); + rc = idr_get_new(&ext_devt_idr, part, &idx); ++ if (!rc && idx >= NR_EXT_DEVT) { ++ idr_remove(&ext_devt_idr, idx); ++ rc = -EBUSY; ++ } ++ mutex_unlock(&ext_devt_mutex); + } while (rc == -EAGAIN); + + if (rc) + return rc; + +- if (idx > MAX_EXT_DEVT) { +- idr_remove(&ext_devt_idr, idx); +- return -EBUSY; +- } +- + *devt = MKDEV(BLOCK_EXT_MAJOR, blk_mangle_minor(idx)); + return 0; + } +@@ -645,7 +646,6 @@ void del_gendisk(struct gendisk *disk) + disk_part_iter_exit(&piter); + + invalidate_partition(disk, 0); +- blk_free_devt(disk_to_dev(disk)->devt); + set_capacity(disk, 0); + disk->flags &= ~GENHD_FL_UP; + +@@ -663,6 +663,7 @@ void del_gendisk(struct gendisk *disk) + if (!sysfs_deprecated) + sysfs_remove_link(block_depr, dev_name(disk_to_dev(disk))); + device_del(disk_to_dev(disk)); ++ blk_free_devt(disk_to_dev(disk)->devt); + } + EXPORT_SYMBOL(del_gendisk); + +diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c +index d790791..cc9d020 100644 +--- a/drivers/acpi/sleep.c ++++ b/drivers/acpi/sleep.c +@@ -156,6 +156,14 @@ static struct dmi_system_id __initdata acpisleep_dmi_table[] = { + }, + { + .callback = init_nvs_nosave, ++ .ident = "Sony Vaio VGN-FW41E_H", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "VGN-FW41E_H"), ++ }, ++ }, ++ { ++ .callback = init_nvs_nosave, + .ident = "Sony Vaio VGN-FW21E", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"), +diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c +index 69ac373..df47397 100644 +--- a/drivers/ata/ata_piix.c ++++ b/drivers/ata/ata_piix.c +@@ -321,6 +321,41 @@ static const struct pci_device_id piix_pci_tbl[] = { + { 0x8086, 0x1e08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata }, + /* SATA Controller IDE (Panther Point) */ + { 0x8086, 0x1e09, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata }, ++ /* SATA Controller IDE (Lynx Point) */ ++ { 0x8086, 0x8c00, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb }, ++ /* SATA Controller IDE (Lynx Point) */ ++ { 0x8086, 0x8c01, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb }, ++ /* SATA Controller IDE (Lynx Point) */ ++ { 0x8086, 0x8c08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata }, ++ /* SATA Controller IDE (Lynx Point) */ ++ { 0x8086, 0x8c09, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata }, ++ /* SATA Controller IDE (Lynx Point-LP) */ ++ { 0x8086, 0x9c00, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb }, ++ /* SATA Controller IDE (Lynx Point-LP) */ ++ { 0x8086, 0x9c01, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb }, ++ /* SATA Controller IDE (Lynx Point-LP) */ ++ { 0x8086, 0x9c08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata }, ++ /* SATA Controller IDE (Lynx Point-LP) */ ++ { 0x8086, 0x9c09, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata }, ++ /* SATA Controller IDE (DH89xxCC) */ ++ { 0x8086, 0x2326, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata }, ++ /* SATA Controller IDE (Avoton) */ ++ { 0x8086, 0x1f20, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb }, ++ /* SATA Controller IDE (Avoton) */ ++ { 0x8086, 0x1f21, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb }, ++ /* SATA Controller IDE (Avoton) */ ++ { 0x8086, 0x1f30, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata }, ++ /* SATA Controller IDE (Avoton) */ ++ { 0x8086, 0x1f31, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata }, ++ /* SATA Controller IDE (Wellsburg) */ ++ { 0x8086, 0x8d00, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb }, ++ /* SATA Controller IDE (Wellsburg) */ ++ { 0x8086, 0x8d08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata }, ++ /* SATA Controller IDE (Wellsburg) */ ++ { 0x8086, 0x8d60, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb }, ++ /* SATA Controller IDE (Wellsburg) */ ++ { 0x8086, 0x8d68, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata }, ++ + { } /* terminate list */ + }; + +diff --git a/drivers/base/bus.c b/drivers/base/bus.c +index 000e7b2..8b8e8c0 100644 +--- a/drivers/base/bus.c ++++ b/drivers/base/bus.c +@@ -289,7 +289,7 @@ int bus_for_each_dev(struct bus_type *bus, struct device *start, + struct device *dev; + int error = 0; + +- if (!bus) ++ if (!bus || !bus->p) + return -EINVAL; + + klist_iter_init_node(&bus->p->klist_devices, &i, +@@ -323,7 +323,7 @@ struct device *bus_find_device(struct bus_type *bus, + struct klist_iter i; + struct device *dev; + +- if (!bus) ++ if (!bus || !bus->p) + return NULL; + + klist_iter_init_node(&bus->p->klist_devices, &i, +diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c +index 86848c6..40a0fcb 100644 +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -584,12 +584,20 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *lo, + struct request sreq; + + dev_info(disk_to_dev(lo->disk), "NBD_DISCONNECT\n"); ++ if (!lo->sock) ++ return -EINVAL; + ++ mutex_unlock(&lo->tx_lock); ++ fsync_bdev(bdev); ++ mutex_lock(&lo->tx_lock); + blk_rq_init(NULL, &sreq); + sreq.cmd_type = REQ_TYPE_SPECIAL; + nbd_cmd(&sreq) = NBD_CMD_DISC; ++ ++ /* Check again after getting mutex back. */ + if (!lo->sock) + return -EINVAL; ++ + nbd_send_req(lo, &sreq); + return 0; + } +@@ -603,6 +611,7 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *lo, + nbd_clear_que(lo); + BUG_ON(!list_empty(&lo->queue_head)); + BUG_ON(!list_empty(&lo->waiting_queue)); ++ kill_bdev(bdev); + if (file) + fput(file); + return 0; +@@ -683,6 +692,7 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *lo, + lo->file = NULL; + nbd_clear_que(lo); + dev_warn(disk_to_dev(lo->disk), "queue cleared\n"); ++ kill_bdev(bdev); + if (file) + fput(file); + lo->bytesize = 0; +diff --git a/drivers/block/sunvdc.c b/drivers/block/sunvdc.c +index 48e8fee..94f6ae2 100644 +--- a/drivers/block/sunvdc.c ++++ b/drivers/block/sunvdc.c +@@ -461,7 +461,7 @@ static int generic_request(struct vdc_port *port, u8 op, void *buf, int len) + int op_len, err; + void *req_buf; + +- if (!(((u64)1 << ((u64)op - 1)) & port->operations)) ++ if (!(((u64)1 << (u64)op) & port->operations)) + return -EOPNOTSUPP; + + switch (op) { +diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c +index f759ad4..674e3c2 100644 +--- a/drivers/block/xen-blkback/xenbus.c ++++ b/drivers/block/xen-blkback/xenbus.c +@@ -364,6 +364,7 @@ static int xen_blkbk_remove(struct xenbus_device *dev) + be->blkif = NULL; + } + ++ kfree(be->mode); + kfree(be); + dev_set_drvdata(&dev->dev, NULL); + return 0; +@@ -513,6 +514,7 @@ static void backend_changed(struct xenbus_watch *watch, + = container_of(watch, struct backend_info, backend_watch); + struct xenbus_device *dev = be->dev; + int cdrom = 0; ++ unsigned long handle; + char *device_type; + + DPRINTK(""); +@@ -532,10 +534,10 @@ static void backend_changed(struct xenbus_watch *watch, + return; + } + +- if ((be->major || be->minor) && +- ((be->major != major) || (be->minor != minor))) { +- pr_warn(DRV_PFX "changing physical device (from %x:%x to %x:%x) not supported.\n", +- be->major, be->minor, major, minor); ++ if (be->major | be->minor) { ++ if (be->major != major || be->minor != minor) ++ pr_warn(DRV_PFX "changing physical device (from %x:%x to %x:%x) not supported.\n", ++ be->major, be->minor, major, minor); + return; + } + +@@ -553,36 +555,33 @@ static void backend_changed(struct xenbus_watch *watch, + kfree(device_type); + } + +- if (be->major == 0 && be->minor == 0) { +- /* Front end dir is a number, which is used as the handle. */ +- +- char *p = strrchr(dev->otherend, '/') + 1; +- long handle; +- err = strict_strtoul(p, 0, &handle); +- if (err) +- return; ++ /* Front end dir is a number, which is used as the handle. */ ++ err = strict_strtoul(strrchr(dev->otherend, '/') + 1, 0, &handle); ++ if (err) ++ return; + +- be->major = major; +- be->minor = minor; ++ be->major = major; ++ be->minor = minor; + +- err = xen_vbd_create(be->blkif, handle, major, minor, +- (NULL == strchr(be->mode, 'w')), cdrom); +- if (err) { +- be->major = 0; +- be->minor = 0; +- xenbus_dev_fatal(dev, err, "creating vbd structure"); +- return; +- } ++ err = xen_vbd_create(be->blkif, handle, major, minor, ++ !strchr(be->mode, 'w'), cdrom); + ++ if (err) ++ xenbus_dev_fatal(dev, err, "creating vbd structure"); ++ else { + err = xenvbd_sysfs_addif(dev); + if (err) { + xen_vbd_free(&be->blkif->vbd); +- be->major = 0; +- be->minor = 0; + xenbus_dev_fatal(dev, err, "creating sysfs entries"); +- return; + } ++ } + ++ if (err) { ++ kfree(be->mode); ++ be->mode = NULL; ++ be->major = 0; ++ be->minor = 0; ++ } else { + /* We're potentially connected now */ + xen_update_blkif_status(be->blkif); + } +diff --git a/drivers/dca/dca-core.c b/drivers/dca/dca-core.c +index bc6f5fa..819dfda 100644 +--- a/drivers/dca/dca-core.c ++++ b/drivers/dca/dca-core.c +@@ -420,6 +420,11 @@ void unregister_dca_provider(struct dca_provider *dca, struct device *dev) + + raw_spin_lock_irqsave(&dca_lock, flags); + ++ if (list_empty(&dca_domains)) { ++ raw_spin_unlock_irqrestore(&dca_lock, flags); ++ return; ++ } ++ + list_del(&dca->node); + + pci_rc = dca_pci_rc_from_dev(dev); +diff --git a/drivers/firewire/core-device.c b/drivers/firewire/core-device.c +index f3b890d..1f3dd51 100644 +--- a/drivers/firewire/core-device.c ++++ b/drivers/firewire/core-device.c +@@ -995,6 +995,10 @@ static void fw_device_init(struct work_struct *work) + ret = idr_pre_get(&fw_device_idr, GFP_KERNEL) ? + idr_get_new(&fw_device_idr, device, &minor) : + -ENOMEM; ++ if (minor >= 1 << MINORBITS) { ++ idr_remove(&fw_device_idr, minor); ++ minor = -ENOSPC; ++ } + up_write(&fw_device_rwsem); + + if (ret < 0) +diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c +index bb95d59..9080eb7 100644 +--- a/drivers/gpu/drm/drm_edid.c ++++ b/drivers/gpu/drm/drm_edid.c +@@ -87,9 +87,6 @@ static struct edid_quirk { + int product_id; + u32 quirks; + } edid_quirk_list[] = { +- /* ASUS VW222S */ +- { "ACI", 0x22a2, EDID_QUIRK_FORCE_REDUCED_BLANKING }, +- + /* Acer AL1706 */ + { "ACR", 44358, EDID_QUIRK_PREFER_LARGE_60 }, + /* Acer F51 */ +@@ -1743,7 +1740,8 @@ int drm_add_edid_modes(struct drm_connector *connector, struct edid *edid) + num_modes += add_cvt_modes(connector, edid); + num_modes += add_standard_modes(connector, edid); + num_modes += add_established_modes(connector, edid); +- num_modes += add_inferred_modes(connector, edid); ++ if (edid->features & DRM_EDID_FEATURE_DEFAULT_GTF) ++ num_modes += add_inferred_modes(connector, edid); + + if (quirks & (EDID_QUIRK_PREFER_LARGE_60 | EDID_QUIRK_PREFER_LARGE_75)) + edid_fixup_preferred(connector, quirks); +diff --git a/drivers/gpu/drm/drm_usb.c b/drivers/gpu/drm/drm_usb.c +index 445003f..471f453 100644 +--- a/drivers/gpu/drm/drm_usb.c ++++ b/drivers/gpu/drm/drm_usb.c +@@ -19,7 +19,7 @@ int drm_get_usb_dev(struct usb_interface *interface, + + usbdev = interface_to_usbdev(interface); + dev->usbdev = usbdev; +- dev->dev = &usbdev->dev; ++ dev->dev = &interface->dev; + + mutex_lock(&drm_global_mutex); + +diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c +index 10fe480..5620192 100644 +--- a/drivers/gpu/drm/i915/i915_debugfs.c ++++ b/drivers/gpu/drm/i915/i915_debugfs.c +@@ -756,7 +756,7 @@ static int i915_error_state(struct seq_file *m, void *unused) + + seq_printf(m, "Time: %ld s %ld us\n", error->time.tv_sec, + error->time.tv_usec); +- seq_printf(m, "Kernel: " UTS_RELEASE); ++ seq_printf(m, "Kernel: " UTS_RELEASE "\n"); + seq_printf(m, "PCI ID: 0x%04x\n", dev->pci_device); + seq_printf(m, "EIR: 0x%08x\n", error->eir); + seq_printf(m, "PGTBL_ER: 0x%08x\n", error->pgtbl_er); +diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c +index 7817429..2303c2b 100644 +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -138,8 +138,8 @@ static const intel_limit_t intel_limits_i9xx_sdvo = { + .vco = { .min = 1400000, .max = 2800000 }, + .n = { .min = 1, .max = 6 }, + .m = { .min = 70, .max = 120 }, +- .m1 = { .min = 10, .max = 22 }, +- .m2 = { .min = 5, .max = 9 }, ++ .m1 = { .min = 8, .max = 18 }, ++ .m2 = { .min = 3, .max = 7 }, + .p = { .min = 5, .max = 80 }, + .p1 = { .min = 1, .max = 8 }, + .p2 = { .dot_limit = 200000, +@@ -3242,6 +3242,7 @@ static void i9xx_crtc_disable(struct drm_crtc *crtc) + struct intel_crtc *intel_crtc = to_intel_crtc(crtc); + int pipe = intel_crtc->pipe; + int plane = intel_crtc->plane; ++ u32 pctl; + + if (!intel_crtc->active) + return; +@@ -3257,6 +3258,13 @@ static void i9xx_crtc_disable(struct drm_crtc *crtc) + + intel_disable_plane(dev_priv, plane, pipe); + intel_disable_pipe(dev_priv, pipe); ++ ++ /* Disable pannel fitter if it is on this pipe. */ ++ pctl = I915_READ(PFIT_CONTROL); ++ if ((pctl & PFIT_ENABLE) && ++ ((pctl & PFIT_PIPE_MASK) >> PFIT_PIPE_SHIFT) == pipe) ++ I915_WRITE(PFIT_CONTROL, 0); ++ + intel_disable_pll(dev_priv, pipe); + + intel_crtc->active = false; +diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c +index 0977849..60d13fe 100644 +--- a/drivers/gpu/drm/radeon/evergreen.c ++++ b/drivers/gpu/drm/radeon/evergreen.c +@@ -1137,6 +1137,8 @@ void evergreen_mc_stop(struct radeon_device *rdev, struct evergreen_mc_save *sav + blackout &= ~BLACKOUT_MODE_MASK; + WREG32(MC_SHARED_BLACKOUT_CNTL, blackout | 1); + } ++ /* wait for the MC to settle */ ++ udelay(100); + } + + void evergreen_mc_resume(struct radeon_device *rdev, struct evergreen_mc_save *save) +diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c +index 279b863d..a23b63a 100644 +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -1900,6 +1900,7 @@ static const struct hid_device_id hid_ignore_list[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_HYBRID) }, + { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_HEATCONTROL) }, + { HID_USB_DEVICE(USB_VENDOR_ID_MADCATZ, USB_DEVICE_ID_MADCATZ_BEATPAD) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_MASTERKIT, USB_DEVICE_ID_MASTERKIT_MA901RADIO) }, + { HID_USB_DEVICE(USB_VENDOR_ID_MCC, USB_DEVICE_ID_MCC_PMD1024LS) }, + { HID_USB_DEVICE(USB_VENDOR_ID_MCC, USB_DEVICE_ID_MCC_PMD1208LS) }, + { HID_USB_DEVICE(USB_VENDOR_ID_MICROCHIP, USB_DEVICE_ID_PICKIT1) }, +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index c15c38e..25f3290 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -506,6 +506,9 @@ + #define USB_VENDOR_ID_MADCATZ 0x0738 + #define USB_DEVICE_ID_MADCATZ_BEATPAD 0x4540 + ++#define USB_VENDOR_ID_MASTERKIT 0x16c0 ++#define USB_DEVICE_ID_MASTERKIT_MA901RADIO 0x05df ++ + #define USB_VENDOR_ID_MCC 0x09db + #define USB_DEVICE_ID_MCC_PMD1024LS 0x0076 + #define USB_DEVICE_ID_MCC_PMD1208LS 0x007a +diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c +index dffdca8..f44a067 100644 +--- a/drivers/iommu/intel-iommu.c ++++ b/drivers/iommu/intel-iommu.c +@@ -4140,13 +4140,19 @@ static void __devinit quirk_iommu_rwbf(struct pci_dev *dev) + { + /* + * Mobile 4 Series Chipset neglects to set RWBF capability, +- * but needs it: ++ * but needs it. Same seems to hold for the desktop versions. + */ + printk(KERN_INFO "DMAR: Forcing write-buffer flush capability\n"); + rwbf_quirk = 1; + } + + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2a40, quirk_iommu_rwbf); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e00, quirk_iommu_rwbf); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e10, quirk_iommu_rwbf); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e20, quirk_iommu_rwbf); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e30, quirk_iommu_rwbf); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e40, quirk_iommu_rwbf); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e90, quirk_iommu_rwbf); + + #define GGC 0x52 + #define GGC_MEMORY_SIZE_MASK (0xf << 8) +diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c +index 29f9000..a47ba33 100644 +--- a/drivers/media/rc/rc-main.c ++++ b/drivers/media/rc/rc-main.c +@@ -774,9 +774,12 @@ static ssize_t show_protocols(struct device *device, + if (dev->driver_type == RC_DRIVER_SCANCODE) { + enabled = dev->rc_map.rc_type; + allowed = dev->allowed_protos; +- } else { ++ } else if (dev->raw) { + enabled = dev->raw->enabled_protocols; + allowed = ir_raw_get_allowed_protocols(); ++ } else { ++ mutex_unlock(&dev->lock); ++ return -ENODEV; + } + + IR_dprintk(1, "allowed - 0x%llx, enabled - 0x%llx\n", +diff --git a/drivers/media/video/omap/omap_vout.c b/drivers/media/video/omap/omap_vout.c +index ee0d0b3..d345215 100644 +--- a/drivers/media/video/omap/omap_vout.c ++++ b/drivers/media/video/omap/omap_vout.c +@@ -206,19 +206,21 @@ static u32 omap_vout_uservirt_to_phys(u32 virtp) + struct vm_area_struct *vma; + struct mm_struct *mm = current->mm; + +- vma = find_vma(mm, virtp); + /* For kernel direct-mapped memory, take the easy way */ +- if (virtp >= PAGE_OFFSET) { +- physp = virt_to_phys((void *) virtp); +- } else if (vma && (vma->vm_flags & VM_IO) && vma->vm_pgoff) { ++ if (virtp >= PAGE_OFFSET) ++ return virt_to_phys((void *) virtp); ++ ++ down_read(¤t->mm->mmap_sem); ++ vma = find_vma(mm, virtp); ++ if (vma && (vma->vm_flags & VM_IO) && vma->vm_pgoff) { + /* this will catch, kernel-allocated, mmaped-to-usermode + addresses */ + physp = (vma->vm_pgoff << PAGE_SHIFT) + (virtp - vma->vm_start); ++ up_read(¤t->mm->mmap_sem); + } else { + /* otherwise, use get_user_pages() for general userland pages */ + int res, nr_pages = 1; + struct page *pages; +- down_read(¤t->mm->mmap_sem); + + res = get_user_pages(current, current->mm, virtp, nr_pages, 1, + 0, &pages, NULL); +diff --git a/drivers/media/video/v4l2-device.c b/drivers/media/video/v4l2-device.c +index 0edd618..8b0777f 100644 +--- a/drivers/media/video/v4l2-device.c ++++ b/drivers/media/video/v4l2-device.c +@@ -159,31 +159,21 @@ int v4l2_device_register_subdev(struct v4l2_device *v4l2_dev, + sd->v4l2_dev = v4l2_dev; + if (sd->internal_ops && sd->internal_ops->registered) { + err = sd->internal_ops->registered(sd); +- if (err) { +- module_put(sd->owner); +- return err; +- } ++ if (err) ++ goto error_module; + } + + /* This just returns 0 if either of the two args is NULL */ + err = v4l2_ctrl_add_handler(v4l2_dev->ctrl_handler, sd->ctrl_handler); +- if (err) { +- if (sd->internal_ops && sd->internal_ops->unregistered) +- sd->internal_ops->unregistered(sd); +- module_put(sd->owner); +- return err; +- } ++ if (err) ++ goto error_unregister; + + #if defined(CONFIG_MEDIA_CONTROLLER) + /* Register the entity. */ + if (v4l2_dev->mdev) { + err = media_device_register_entity(v4l2_dev->mdev, entity); +- if (err < 0) { +- if (sd->internal_ops && sd->internal_ops->unregistered) +- sd->internal_ops->unregistered(sd); +- module_put(sd->owner); +- return err; +- } ++ if (err < 0) ++ goto error_unregister; + } + #endif + +@@ -192,6 +182,14 @@ int v4l2_device_register_subdev(struct v4l2_device *v4l2_dev, + spin_unlock(&v4l2_dev->lock); + + return 0; ++ ++error_unregister: ++ if (sd->internal_ops && sd->internal_ops->unregistered) ++ sd->internal_ops->unregistered(sd); ++error_module: ++ module_put(sd->owner); ++ sd->v4l2_dev = NULL; ++ return err; + } + EXPORT_SYMBOL_GPL(v4l2_device_register_subdev); + +diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c +index 1b47937..85a074f 100644 +--- a/drivers/mmc/host/sdhci-esdhc-imx.c ++++ b/drivers/mmc/host/sdhci-esdhc-imx.c +@@ -232,15 +232,18 @@ static void esdhc_writel_le(struct sdhci_host *host, u32 val, int reg) + + static u16 esdhc_readw_le(struct sdhci_host *host, int reg) + { ++ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); ++ struct pltfm_imx_data *imx_data = pltfm_host->priv; ++ + if (unlikely(reg == SDHCI_HOST_VERSION)) { +- u16 val = readw(host->ioaddr + (reg ^ 2)); +- /* +- * uSDHC supports SDHCI v3.0, but it's encoded as value +- * 0x3 in host controller version register, which violates +- * SDHCI_SPEC_300 definition. Work it around here. +- */ +- if ((val & SDHCI_SPEC_VER_MASK) == 3) +- return --val; ++ reg ^= 2; ++ if (is_imx6q_usdhc(imx_data)) { ++ /* ++ * The usdhc register returns a wrong host version. ++ * Correct it here. ++ */ ++ return SDHCI_SPEC_300; ++ } + } + + return readw(host->ioaddr + reg); +diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c +index cf177b8..df5a09a 100644 +--- a/drivers/net/ethernet/intel/igb/igb_main.c ++++ b/drivers/net/ethernet/intel/igb/igb_main.c +@@ -4559,11 +4559,13 @@ void igb_update_stats(struct igb_adapter *adapter, + bytes = 0; + packets = 0; + for (i = 0; i < adapter->num_rx_queues; i++) { +- u32 rqdpc_tmp = rd32(E1000_RQDPC(i)) & 0x0FFF; ++ u32 rqdpc = rd32(E1000_RQDPC(i)); + struct igb_ring *ring = adapter->rx_ring[i]; + +- ring->rx_stats.drops += rqdpc_tmp; +- net_stats->rx_fifo_errors += rqdpc_tmp; ++ if (rqdpc) { ++ ring->rx_stats.drops += rqdpc; ++ net_stats->rx_fifo_errors += rqdpc; ++ } + + do { + start = u64_stats_fetch_begin_bh(&ring->rx_syncp); +diff --git a/drivers/net/wireless/b43/dma.h b/drivers/net/wireless/b43/dma.h +index 315b96e..9fdd198 100644 +--- a/drivers/net/wireless/b43/dma.h ++++ b/drivers/net/wireless/b43/dma.h +@@ -169,7 +169,7 @@ struct b43_dmadesc_generic { + + /* DMA engine tuning knobs */ + #define B43_TXRING_SLOTS 256 +-#define B43_RXRING_SLOTS 64 ++#define B43_RXRING_SLOTS 256 + #define B43_DMA0_RX_FW598_BUFSIZE (B43_DMA0_RX_FW598_FO + IEEE80211_MAX_FRAME_LEN) + #define B43_DMA0_RX_FW351_BUFSIZE (B43_DMA0_RX_FW351_FO + IEEE80211_MAX_FRAME_LEN) + +diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c +index 7ca84c3..564218c 100644 +--- a/drivers/net/wireless/p54/p54usb.c ++++ b/drivers/net/wireless/p54/p54usb.c +@@ -84,8 +84,8 @@ static struct usb_device_id p54u_table[] = { + {USB_DEVICE(0x06b9, 0x0121)}, /* Thomson SpeedTouch 121g */ + {USB_DEVICE(0x0707, 0xee13)}, /* SMC 2862W-G version 2 */ + {USB_DEVICE(0x0803, 0x4310)}, /* Zoom 4410a */ +- {USB_DEVICE(0x083a, 0x4503)}, /* T-Com Sinus 154 data II */ + {USB_DEVICE(0x083a, 0x4521)}, /* Siemens Gigaset USB Adapter 54 version 2 */ ++ {USB_DEVICE(0x083a, 0x4531)}, /* T-Com Sinus 154 data II */ + {USB_DEVICE(0x083a, 0xc501)}, /* Zoom Wireless-G 4410 */ + {USB_DEVICE(0x083a, 0xf503)}, /* Accton FD7050E ver 1010ec */ + {USB_DEVICE(0x0846, 0x4240)}, /* Netgear WG111 (v2) */ +diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c +index a99be2d0..0984dcf 100644 +--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c +@@ -295,6 +295,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = { + {RTL_USB_DEVICE(USB_VENDER_ID_REALTEK, 0x817f, rtl92cu_hal_cfg)}, + /* RTL8188CUS-VL */ + {RTL_USB_DEVICE(USB_VENDER_ID_REALTEK, 0x818a, rtl92cu_hal_cfg)}, ++ {RTL_USB_DEVICE(USB_VENDER_ID_REALTEK, 0x819a, rtl92cu_hal_cfg)}, + /* 8188 Combo for BC4 */ + {RTL_USB_DEVICE(USB_VENDER_ID_REALTEK, 0x8754, rtl92cu_hal_cfg)}, + +@@ -372,9 +373,15 @@ static struct usb_device_id rtl8192c_usb_ids[] = { + + MODULE_DEVICE_TABLE(usb, rtl8192c_usb_ids); + ++static int rtl8192cu_probe(struct usb_interface *intf, ++ const struct usb_device_id *id) ++{ ++ return rtl_usb_probe(intf, id, &rtl92cu_hal_cfg); ++} ++ + static struct usb_driver rtl8192cu_driver = { + .name = "rtl8192cu", +- .probe = rtl_usb_probe, ++ .probe = rtl8192cu_probe, + .disconnect = rtl_usb_disconnect, + .id_table = rtl8192c_usb_ids, + +diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c +index 30dd0a9..c04ee92 100644 +--- a/drivers/net/wireless/rtlwifi/usb.c ++++ b/drivers/net/wireless/rtlwifi/usb.c +@@ -44,8 +44,12 @@ + + static void usbctrl_async_callback(struct urb *urb) + { +- if (urb) +- kfree(urb->context); ++ if (urb) { ++ /* free dr */ ++ kfree(urb->setup_packet); ++ /* free databuf */ ++ kfree(urb->transfer_buffer); ++ } + } + + static int _usbctrl_vendorreq_async_write(struct usb_device *udev, u8 request, +@@ -57,38 +61,46 @@ static int _usbctrl_vendorreq_async_write(struct usb_device *udev, u8 request, + u8 reqtype; + struct usb_ctrlrequest *dr; + struct urb *urb; +- struct rtl819x_async_write_data { +- u8 data[REALTEK_USB_VENQT_MAX_BUF_SIZE]; +- struct usb_ctrlrequest dr; +- } *buf; ++ const u16 databuf_maxlen = REALTEK_USB_VENQT_MAX_BUF_SIZE; ++ u8 *databuf; ++ ++ if (WARN_ON_ONCE(len > databuf_maxlen)) ++ len = databuf_maxlen; + + pipe = usb_sndctrlpipe(udev, 0); /* write_out */ + reqtype = REALTEK_USB_VENQT_WRITE; + +- buf = kmalloc(sizeof(*buf), GFP_ATOMIC); +- if (!buf) ++ dr = kmalloc(sizeof(*dr), GFP_ATOMIC); ++ if (!dr) + return -ENOMEM; + ++ databuf = kmalloc(databuf_maxlen, GFP_ATOMIC); ++ if (!databuf) { ++ kfree(dr); ++ return -ENOMEM; ++ } ++ + urb = usb_alloc_urb(0, GFP_ATOMIC); + if (!urb) { +- kfree(buf); ++ kfree(databuf); ++ kfree(dr); + return -ENOMEM; + } + +- dr = &buf->dr; +- + dr->bRequestType = reqtype; + dr->bRequest = request; + dr->wValue = cpu_to_le16(value); + dr->wIndex = cpu_to_le16(index); + dr->wLength = cpu_to_le16(len); +- memcpy(buf, pdata, len); ++ memcpy(databuf, pdata, len); + usb_fill_control_urb(urb, udev, pipe, +- (unsigned char *)dr, buf, len, +- usbctrl_async_callback, buf); ++ (unsigned char *)dr, databuf, len, ++ usbctrl_async_callback, NULL); + rc = usb_submit_urb(urb, GFP_ATOMIC); +- if (rc < 0) +- kfree(buf); ++ if (rc < 0) { ++ kfree(databuf); ++ kfree(dr); ++ } + usb_free_urb(urb); + return rc; + } +@@ -894,7 +906,8 @@ static struct rtl_intf_ops rtl_usb_ops = { + }; + + int __devinit rtl_usb_probe(struct usb_interface *intf, +- const struct usb_device_id *id) ++ const struct usb_device_id *id, ++ struct rtl_hal_cfg *rtl_hal_cfg) + { + int err; + struct ieee80211_hw *hw = NULL; +@@ -928,7 +941,7 @@ int __devinit rtl_usb_probe(struct usb_interface *intf, + usb_set_intfdata(intf, hw); + /* init cfg & intf_ops */ + rtlpriv->rtlhal.interface = INTF_USB; +- rtlpriv->cfg = (struct rtl_hal_cfg *)(id->driver_info); ++ rtlpriv->cfg = rtl_hal_cfg; + rtlpriv->intf_ops = &rtl_usb_ops; + rtl_dbgp_flag_init(hw); + /* Init IO handler */ +diff --git a/drivers/net/wireless/rtlwifi/usb.h b/drivers/net/wireless/rtlwifi/usb.h +index d2a63fb..4dc4b1c 100644 +--- a/drivers/net/wireless/rtlwifi/usb.h ++++ b/drivers/net/wireless/rtlwifi/usb.h +@@ -158,7 +158,8 @@ struct rtl_usb_priv { + + + int __devinit rtl_usb_probe(struct usb_interface *intf, +- const struct usb_device_id *id); ++ const struct usb_device_id *id, ++ struct rtl_hal_cfg *rtl92cu_hal_cfg); + void rtl_usb_disconnect(struct usb_interface *intf); + int rtl_usb_suspend(struct usb_interface *pusb_intf, pm_message_t message); + int rtl_usb_resume(struct usb_interface *pusb_intf); +diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c +index 5925e0b..8eaf0e2 100644 +--- a/drivers/net/xen-netback/interface.c ++++ b/drivers/net/xen-netback/interface.c +@@ -132,6 +132,7 @@ static void xenvif_up(struct xenvif *vif) + static void xenvif_down(struct xenvif *vif) + { + disable_irq(vif->irq); ++ del_timer_sync(&vif->credit_timeout); + xen_netbk_deschedule_xenvif(vif); + xen_netbk_remove_xenvif(vif); + } +@@ -362,8 +363,6 @@ void xenvif_disconnect(struct xenvif *vif) + atomic_dec(&vif->refcnt); + wait_event(vif->waiting_to_free, atomic_read(&vif->refcnt) == 0); + +- del_timer_sync(&vif->credit_timeout); +- + if (vif->irq) + unbind_from_irqhandler(vif->irq, vif); + +diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c +index b802bb3..185a0eb 100644 +--- a/drivers/net/xen-netback/netback.c ++++ b/drivers/net/xen-netback/netback.c +@@ -883,13 +883,13 @@ static int netbk_count_requests(struct xenvif *vif, + if (frags >= work_to_do) { + netdev_err(vif->dev, "Need more frags\n"); + netbk_fatal_tx_err(vif); +- return -frags; ++ return -ENODATA; + } + + if (unlikely(frags >= MAX_SKB_FRAGS)) { + netdev_err(vif->dev, "Too many frags\n"); + netbk_fatal_tx_err(vif); +- return -frags; ++ return -E2BIG; + } + + memcpy(txp, RING_GET_REQUEST(&vif->tx, cons + frags), +@@ -897,7 +897,7 @@ static int netbk_count_requests(struct xenvif *vif, + if (txp->size > first->size) { + netdev_err(vif->dev, "Frag is bigger than frame.\n"); + netbk_fatal_tx_err(vif); +- return -frags; ++ return -EIO; + } + + first->size -= txp->size; +@@ -907,7 +907,7 @@ static int netbk_count_requests(struct xenvif *vif, + netdev_err(vif->dev, "txp->offset: %x, size: %u\n", + txp->offset, txp->size); + netbk_fatal_tx_err(vif); +- return -frags; ++ return -EINVAL; + } + } while ((txp++)->flags & XEN_NETTXF_more_data); + return frags; +diff --git a/drivers/pci/remove.c b/drivers/pci/remove.c +index 7f87bee..f53da9e 100644 +--- a/drivers/pci/remove.c ++++ b/drivers/pci/remove.c +@@ -19,6 +19,8 @@ static void pci_free_resources(struct pci_dev *dev) + + static void pci_stop_dev(struct pci_dev *dev) + { ++ pci_pme_active(dev, false); ++ + if (dev->is_added) { + pci_proc_detach_device(dev); + pci_remove_sysfs_dev_files(dev); +diff --git a/drivers/pcmcia/vrc4171_card.c b/drivers/pcmcia/vrc4171_card.c +index 86e4a1a..6bb02ab 100644 +--- a/drivers/pcmcia/vrc4171_card.c ++++ b/drivers/pcmcia/vrc4171_card.c +@@ -246,6 +246,7 @@ static int pccard_init(struct pcmcia_socket *sock) + socket = &vrc4171_sockets[slot]; + socket->csc_irq = search_nonuse_irq(); + socket->io_irq = search_nonuse_irq(); ++ spin_lock_init(&socket->lock); + + return 0; + } +diff --git a/drivers/platform/x86/asus-laptop.c b/drivers/platform/x86/asus-laptop.c +index f75a4c8..3a09460 100644 +--- a/drivers/platform/x86/asus-laptop.c ++++ b/drivers/platform/x86/asus-laptop.c +@@ -820,8 +820,10 @@ static ssize_t show_infos(struct device *dev, + /* + * The HWRS method return informations about the hardware. + * 0x80 bit is for WLAN, 0x100 for Bluetooth. ++ * 0x40 for WWAN, 0x10 for WIMAX. + * The significance of others is yet to be found. +- * If we don't find the method, we assume the device are present. ++ * We don't currently use this for device detection, and it ++ * takes several seconds to run on some systems. + */ + rv = acpi_evaluate_integer(asus->handle, "HWRS", NULL, &temp); + if (!ACPI_FAILURE(rv)) +@@ -1591,7 +1593,7 @@ static int asus_laptop_get_info(struct asus_laptop *asus) + { + struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL }; + union acpi_object *model = NULL; +- unsigned long long bsts_result, hwrs_result; ++ unsigned long long bsts_result; + char *string = NULL; + acpi_status status; + +@@ -1653,17 +1655,6 @@ static int asus_laptop_get_info(struct asus_laptop *asus) + if (*string) + pr_notice(" %s model detected\n", string); + +- /* +- * The HWRS method return informations about the hardware. +- * 0x80 bit is for WLAN, 0x100 for Bluetooth, +- * 0x40 for WWAN, 0x10 for WIMAX. +- * The significance of others is yet to be found. +- */ +- status = +- acpi_evaluate_integer(asus->handle, "HWRS", NULL, &hwrs_result); +- if (!ACPI_FAILURE(status)) +- pr_notice(" HWRS returned %x", (int)hwrs_result); +- + if (!acpi_check_handle(asus->handle, METHOD_WL_STATUS, NULL)) + asus->have_rsts = true; + +diff --git a/drivers/pps/clients/pps-ldisc.c b/drivers/pps/clients/pps-ldisc.c +index 79451f2..60cee9e 100644 +--- a/drivers/pps/clients/pps-ldisc.c ++++ b/drivers/pps/clients/pps-ldisc.c +@@ -31,7 +31,7 @@ + static void pps_tty_dcd_change(struct tty_struct *tty, unsigned int status, + struct pps_event_time *ts) + { +- struct pps_device *pps = (struct pps_device *)tty->disc_data; ++ struct pps_device *pps = pps_lookup_dev(tty); + + BUG_ON(pps == NULL); + +@@ -67,9 +67,9 @@ static int pps_tty_open(struct tty_struct *tty) + pr_err("cannot register PPS source \"%s\"\n", info.path); + return -ENOMEM; + } +- tty->disc_data = pps; ++ pps->lookup_cookie = tty; + +- /* Should open N_TTY ldisc too */ ++ /* Now open the base class N_TTY ldisc */ + ret = alias_n_tty_open(tty); + if (ret < 0) { + pr_err("cannot open tty ldisc \"%s\"\n", info.path); +@@ -81,7 +81,6 @@ static int pps_tty_open(struct tty_struct *tty) + return 0; + + err_unregister: +- tty->disc_data = NULL; + pps_unregister_source(pps); + return ret; + } +@@ -90,11 +89,10 @@ static void (*alias_n_tty_close)(struct tty_struct *tty); + + static void pps_tty_close(struct tty_struct *tty) + { +- struct pps_device *pps = (struct pps_device *)tty->disc_data; ++ struct pps_device *pps = pps_lookup_dev(tty); + + alias_n_tty_close(tty); + +- tty->disc_data = NULL; + dev_info(pps->dev, "removed\n"); + pps_unregister_source(pps); + } +diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c +index 2baadd2..e83669f 100644 +--- a/drivers/pps/pps.c ++++ b/drivers/pps/pps.c +@@ -247,12 +247,15 @@ static int pps_cdev_open(struct inode *inode, struct file *file) + struct pps_device *pps = container_of(inode->i_cdev, + struct pps_device, cdev); + file->private_data = pps; +- ++ kobject_get(&pps->dev->kobj); + return 0; + } + + static int pps_cdev_release(struct inode *inode, struct file *file) + { ++ struct pps_device *pps = container_of(inode->i_cdev, ++ struct pps_device, cdev); ++ kobject_put(&pps->dev->kobj); + return 0; + } + +@@ -274,8 +277,10 @@ static void pps_device_destruct(struct device *dev) + { + struct pps_device *pps = dev_get_drvdata(dev); + +- /* release id here to protect others from using it while it's +- * still in use */ ++ cdev_del(&pps->cdev); ++ ++ /* Now we can release the ID for re-use */ ++ pr_debug("deallocating pps%d\n", pps->id); + mutex_lock(&pps_idr_lock); + idr_remove(&pps_idr, pps->id); + mutex_unlock(&pps_idr_lock); +@@ -330,6 +335,7 @@ int pps_register_cdev(struct pps_device *pps) + if (IS_ERR(pps->dev)) + goto del_cdev; + ++ /* Override the release function with our own */ + pps->dev->release = pps_device_destruct; + + pr_debug("source %s got cdev (%d:%d)\n", pps->info.name, +@@ -350,11 +356,44 @@ free_idr: + + void pps_unregister_cdev(struct pps_device *pps) + { ++ pr_debug("unregistering pps%d\n", pps->id); ++ pps->lookup_cookie = NULL; + device_destroy(pps_class, pps->dev->devt); +- cdev_del(&pps->cdev); + } + + /* ++ * Look up a pps device by magic cookie. ++ * The cookie is usually a pointer to some enclosing device, but this ++ * code doesn't care; you should never be dereferencing it. ++ * ++ * This is a bit of a kludge that is currently used only by the PPS ++ * serial line discipline. It may need to be tweaked when a second user ++ * is found. ++ * ++ * There is no function interface for setting the lookup_cookie field. ++ * It's initialized to NULL when the pps device is created, and if a ++ * client wants to use it, just fill it in afterward. ++ * ++ * The cookie is automatically set to NULL in pps_unregister_source() ++ * so that it will not be used again, even if the pps device cannot ++ * be removed from the idr due to pending references holding the minor ++ * number in use. ++ */ ++struct pps_device *pps_lookup_dev(void const *cookie) ++{ ++ struct pps_device *pps; ++ unsigned id; ++ ++ rcu_read_lock(); ++ idr_for_each_entry(&pps_idr, pps, id) ++ if (cookie == pps->lookup_cookie) ++ break; ++ rcu_read_unlock(); ++ return pps; ++} ++EXPORT_SYMBOL(pps_lookup_dev); ++ ++/* + * Module stuff + */ + +diff --git a/drivers/rtc/rtc-pl031.c b/drivers/rtc/rtc-pl031.c +index 73816d8..1f94073 100644 +--- a/drivers/rtc/rtc-pl031.c ++++ b/drivers/rtc/rtc-pl031.c +@@ -344,7 +344,9 @@ static int pl031_probe(struct amba_device *adev, const struct amba_id *id) + /* Enable the clockwatch on ST Variants */ + if (ldata->hw_designer == AMBA_VENDOR_ST) + data |= RTC_CR_CWEN; +- writel(data | RTC_CR_EN, ldata->base + RTC_CR); ++ else ++ data |= RTC_CR_EN; ++ writel(data, ldata->base + RTC_CR); + + /* + * On ST PL031 variants, the RTC reset value does not provide correct +diff --git a/drivers/s390/kvm/kvm_virtio.c b/drivers/s390/kvm/kvm_virtio.c +index 94f49ff..b1e8f6c 100644 +--- a/drivers/s390/kvm/kvm_virtio.c ++++ b/drivers/s390/kvm/kvm_virtio.c +@@ -414,6 +414,26 @@ static void kvm_extint_handler(unsigned int ext_int_code, + } + + /* ++ * For s390-virtio, we expect a page above main storage containing ++ * the virtio configuration. Try to actually load from this area ++ * in order to figure out if the host provides this page. ++ */ ++static int __init test_devices_support(unsigned long addr) ++{ ++ int ret = -EIO; ++ ++ asm volatile( ++ "0: lura 0,%1\n" ++ "1: xgr %0,%0\n" ++ "2:\n" ++ EX_TABLE(0b,2b) ++ EX_TABLE(1b,2b) ++ : "+d" (ret) ++ : "a" (addr) ++ : "0", "cc"); ++ return ret; ++} ++/* + * Init function for virtio + * devices are in a single page above top of "normal" mem + */ +@@ -424,21 +444,23 @@ static int __init kvm_devices_init(void) + if (!MACHINE_IS_KVM) + return -ENODEV; + ++ if (test_devices_support(real_memory_size) < 0) ++ return -ENODEV; ++ ++ rc = vmem_add_mapping(real_memory_size, PAGE_SIZE); ++ if (rc) ++ return rc; ++ ++ kvm_devices = (void *) real_memory_size; ++ + kvm_root = root_device_register("kvm_s390"); + if (IS_ERR(kvm_root)) { + rc = PTR_ERR(kvm_root); + printk(KERN_ERR "Could not register kvm_s390 root device"); ++ vmem_remove_mapping(real_memory_size, PAGE_SIZE); + return rc; + } + +- rc = vmem_add_mapping(real_memory_size, PAGE_SIZE); +- if (rc) { +- root_device_unregister(kvm_root); +- return rc; +- } +- +- kvm_devices = (void *) real_memory_size; +- + INIT_WORK(&hotplug_work, hotplug_devices); + + service_subclass_irq_register(); +diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c +index ab9f5ed..a023f52 100644 +--- a/drivers/staging/comedi/comedi_fops.c ++++ b/drivers/staging/comedi/comedi_fops.c +@@ -136,6 +136,11 @@ static long comedi_unlocked_ioctl(struct file *file, unsigned int cmd, + /* Device config is special, because it must work on + * an unconfigured device. */ + if (cmd == COMEDI_DEVCONFIG) { ++ if (minor >= COMEDI_NUM_BOARD_MINORS) { ++ /* Device config not appropriate on non-board minors. */ ++ rc = -ENOTTY; ++ goto done; ++ } + rc = do_devconfig_ioctl(dev, + (struct comedi_devconfig __user *)arg); + goto done; +@@ -1569,7 +1574,7 @@ static unsigned int comedi_poll(struct file *file, poll_table * wait) + + mask = 0; + read_subdev = comedi_get_read_subdevice(dev_file_info); +- if (read_subdev) { ++ if (read_subdev && read_subdev->async) { + poll_wait(file, &read_subdev->async->wait_head, wait); + if (!read_subdev->busy + || comedi_buf_read_n_available(read_subdev->async) > 0 +@@ -1579,7 +1584,7 @@ static unsigned int comedi_poll(struct file *file, poll_table * wait) + } + } + write_subdev = comedi_get_write_subdevice(dev_file_info); +- if (write_subdev) { ++ if (write_subdev && write_subdev->async) { + poll_wait(file, &write_subdev->async->wait_head, wait); + comedi_buf_write_alloc(write_subdev->async, + write_subdev->async->prealloc_bufsz); +@@ -1621,7 +1626,7 @@ static ssize_t comedi_write(struct file *file, const char __user *buf, + } + + s = comedi_get_write_subdevice(dev_file_info); +- if (s == NULL) { ++ if (s == NULL || s->async == NULL) { + retval = -EIO; + goto done; + } +@@ -1732,7 +1737,7 @@ static ssize_t comedi_read(struct file *file, char __user *buf, size_t nbytes, + } + + s = comedi_get_read_subdevice(dev_file_info); +- if (s == NULL) { ++ if (s == NULL || s->async == NULL) { + retval = -EIO; + goto done; + } +diff --git a/drivers/staging/comedi/drivers/ni_labpc.c b/drivers/staging/comedi/drivers/ni_labpc.c +index 721b2be..0517a23 100644 +--- a/drivers/staging/comedi/drivers/ni_labpc.c ++++ b/drivers/staging/comedi/drivers/ni_labpc.c +@@ -1264,7 +1264,9 @@ static int labpc_ai_cmd(struct comedi_device *dev, struct comedi_subdevice *s) + else + channel = CR_CHAN(cmd->chanlist[0]); + /* munge channel bits for differential / scan disabled mode */ +- if (labpc_ai_scan_mode(cmd) != MODE_SINGLE_CHAN && aref == AREF_DIFF) ++ if ((labpc_ai_scan_mode(cmd) == MODE_SINGLE_CHAN || ++ labpc_ai_scan_mode(cmd) == MODE_SINGLE_CHAN_INTERVAL) && ++ aref == AREF_DIFF) + channel *= 2; + devpriv->command1_bits |= ADC_CHAN_BITS(channel); + devpriv->command1_bits |= thisboard->ai_range_code[range]; +@@ -1280,21 +1282,6 @@ static int labpc_ai_cmd(struct comedi_device *dev, struct comedi_subdevice *s) + devpriv->write_byte(devpriv->command1_bits, + dev->iobase + COMMAND1_REG); + } +- /* setup any external triggering/pacing (command4 register) */ +- devpriv->command4_bits = 0; +- if (cmd->convert_src != TRIG_EXT) +- devpriv->command4_bits |= EXT_CONVERT_DISABLE_BIT; +- /* XXX should discard first scan when using interval scanning +- * since manual says it is not synced with scan clock */ +- if (labpc_use_continuous_mode(cmd) == 0) { +- devpriv->command4_bits |= INTERVAL_SCAN_EN_BIT; +- if (cmd->scan_begin_src == TRIG_EXT) +- devpriv->command4_bits |= EXT_SCAN_EN_BIT; +- } +- /* single-ended/differential */ +- if (aref == AREF_DIFF) +- devpriv->command4_bits |= ADC_DIFF_BIT; +- devpriv->write_byte(devpriv->command4_bits, dev->iobase + COMMAND4_REG); + + devpriv->write_byte(cmd->chanlist_len, + dev->iobase + INTERVAL_COUNT_REG); +@@ -1374,6 +1361,22 @@ static int labpc_ai_cmd(struct comedi_device *dev, struct comedi_subdevice *s) + devpriv->command3_bits &= ~ADC_FNE_INTR_EN_BIT; + devpriv->write_byte(devpriv->command3_bits, dev->iobase + COMMAND3_REG); + ++ /* setup any external triggering/pacing (command4 register) */ ++ devpriv->command4_bits = 0; ++ if (cmd->convert_src != TRIG_EXT) ++ devpriv->command4_bits |= EXT_CONVERT_DISABLE_BIT; ++ /* XXX should discard first scan when using interval scanning ++ * since manual says it is not synced with scan clock */ ++ if (labpc_use_continuous_mode(cmd) == 0) { ++ devpriv->command4_bits |= INTERVAL_SCAN_EN_BIT; ++ if (cmd->scan_begin_src == TRIG_EXT) ++ devpriv->command4_bits |= EXT_SCAN_EN_BIT; ++ } ++ /* single-ended/differential */ ++ if (aref == AREF_DIFF) ++ devpriv->command4_bits |= ADC_DIFF_BIT; ++ devpriv->write_byte(devpriv->command4_bits, dev->iobase + COMMAND4_REG); ++ + /* startup acquisition */ + + /* command2 reg */ +diff --git a/drivers/staging/speakup/speakup_soft.c b/drivers/staging/speakup/speakup_soft.c +index b5130c8..e2f5c81 100644 +--- a/drivers/staging/speakup/speakup_soft.c ++++ b/drivers/staging/speakup/speakup_soft.c +@@ -46,7 +46,7 @@ static int misc_registered; + static struct var_t vars[] = { + { CAPS_START, .u.s = {"\x01+3p" } }, + { CAPS_STOP, .u.s = {"\x01-3p" } }, +- { RATE, .u.n = {"\x01%ds", 5, 0, 9, 0, 0, NULL } }, ++ { RATE, .u.n = {"\x01%ds", 2, 0, 9, 0, 0, NULL } }, + { PITCH, .u.n = {"\x01%dp", 5, 0, 9, 0, 0, NULL } }, + { VOL, .u.n = {"\x01%dv", 5, 0, 9, 0, 0, NULL } }, + { TONE, .u.n = {"\x01%dx", 1, 0, 2, 0, 0, NULL } }, +diff --git a/drivers/staging/zram/zram_drv.c b/drivers/staging/zram/zram_drv.c +index 09de99f..2594a31 100644 +--- a/drivers/staging/zram/zram_drv.c ++++ b/drivers/staging/zram/zram_drv.c +@@ -242,7 +242,7 @@ static int zram_bvec_read(struct zram *zram, struct bio_vec *bvec, + + if (is_partial_io(bvec)) { + /* Use a temporary buffer to decompress the page */ +- uncmem = kmalloc(PAGE_SIZE, GFP_KERNEL); ++ uncmem = kmalloc(PAGE_SIZE, GFP_NOIO); + if (!uncmem) { + pr_info("Error allocating temp memory!\n"); + return -ENOMEM; +@@ -338,7 +338,7 @@ static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index, + * This is a partial IO. We need to read the full page + * before to write the changes. + */ +- uncmem = kmalloc(PAGE_SIZE, GFP_KERNEL); ++ uncmem = kmalloc(PAGE_SIZE, GFP_NOIO); + if (!uncmem) { + pr_info("Error allocating temp memory!\n"); + ret = -ENOMEM; +diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c +index a0143a0..5def359 100644 +--- a/drivers/target/target_core_device.c ++++ b/drivers/target/target_core_device.c +@@ -1439,24 +1439,18 @@ static struct se_lun *core_dev_get_lun(struct se_portal_group *tpg, u32 unpacked + + struct se_lun_acl *core_dev_init_initiator_node_lun_acl( + struct se_portal_group *tpg, ++ struct se_node_acl *nacl, + u32 mapped_lun, +- char *initiatorname, + int *ret) + { + struct se_lun_acl *lacl; +- struct se_node_acl *nacl; + +- if (strlen(initiatorname) >= TRANSPORT_IQN_LEN) { ++ if (strlen(nacl->initiatorname) >= TRANSPORT_IQN_LEN) { + pr_err("%s InitiatorName exceeds maximum size.\n", + tpg->se_tpg_tfo->get_fabric_name()); + *ret = -EOVERFLOW; + return NULL; + } +- nacl = core_tpg_get_initiator_node_acl(tpg, initiatorname); +- if (!nacl) { +- *ret = -EINVAL; +- return NULL; +- } + lacl = kzalloc(sizeof(struct se_lun_acl), GFP_KERNEL); + if (!lacl) { + pr_err("Unable to allocate memory for struct se_lun_acl.\n"); +@@ -1467,7 +1461,8 @@ struct se_lun_acl *core_dev_init_initiator_node_lun_acl( + INIT_LIST_HEAD(&lacl->lacl_list); + lacl->mapped_lun = mapped_lun; + lacl->se_lun_nacl = nacl; +- snprintf(lacl->initiatorname, TRANSPORT_IQN_LEN, "%s", initiatorname); ++ snprintf(lacl->initiatorname, TRANSPORT_IQN_LEN, "%s", ++ nacl->initiatorname); + + return lacl; + } +diff --git a/drivers/target/target_core_fabric_configfs.c b/drivers/target/target_core_fabric_configfs.c +index 09b6f87..60009bd 100644 +--- a/drivers/target/target_core_fabric_configfs.c ++++ b/drivers/target/target_core_fabric_configfs.c +@@ -354,9 +354,17 @@ static struct config_group *target_fabric_make_mappedlun( + ret = -EINVAL; + goto out; + } ++ if (mapped_lun > (TRANSPORT_MAX_LUNS_PER_TPG-1)) { ++ pr_err("Mapped LUN: %lu exceeds TRANSPORT_MAX_LUNS_PER_TPG" ++ "-1: %u for Target Portal Group: %u\n", mapped_lun, ++ TRANSPORT_MAX_LUNS_PER_TPG-1, ++ se_tpg->se_tpg_tfo->tpg_get_tag(se_tpg)); ++ ret = -EINVAL; ++ goto out; ++ } + +- lacl = core_dev_init_initiator_node_lun_acl(se_tpg, mapped_lun, +- config_item_name(acl_ci), &ret); ++ lacl = core_dev_init_initiator_node_lun_acl(se_tpg, se_nacl, ++ mapped_lun, &ret); + if (!lacl) { + ret = -EINVAL; + goto out; +diff --git a/drivers/target/target_core_tpg.c b/drivers/target/target_core_tpg.c +index d91fe44..d048e33 100644 +--- a/drivers/target/target_core_tpg.c ++++ b/drivers/target/target_core_tpg.c +@@ -117,16 +117,10 @@ struct se_node_acl *core_tpg_get_initiator_node_acl( + struct se_node_acl *acl; + + spin_lock_irq(&tpg->acl_node_lock); +- list_for_each_entry(acl, &tpg->acl_node_list, acl_list) { +- if (!strcmp(acl->initiatorname, initiatorname) && +- !acl->dynamic_node_acl) { +- spin_unlock_irq(&tpg->acl_node_lock); +- return acl; +- } +- } ++ acl = __core_tpg_get_initiator_node_acl(tpg, initiatorname); + spin_unlock_irq(&tpg->acl_node_lock); + +- return NULL; ++ return acl; + } + + /* core_tpg_add_node_to_devs(): +diff --git a/drivers/tty/serial/8250.c b/drivers/tty/serial/8250.c +index 90dad17..6748568 100644 +--- a/drivers/tty/serial/8250.c ++++ b/drivers/tty/serial/8250.c +@@ -2695,7 +2695,7 @@ serial8250_verify_port(struct uart_port *port, struct serial_struct *ser) + if (ser->irq >= nr_irqs || ser->irq < 0 || + ser->baud_base < 9600 || ser->type < PORT_UNKNOWN || + ser->type >= ARRAY_SIZE(uart_config) || ser->type == PORT_CIRRUS || +- ser->type == PORT_STARTECH) ++ ser->type == PORT_STARTECH || uart_config[ser->type].name == NULL) + return -EINVAL; + return 0; + } +@@ -2705,7 +2705,7 @@ serial8250_type(struct uart_port *port) + { + int type = port->type; + +- if (type >= ARRAY_SIZE(uart_config)) ++ if (type >= ARRAY_SIZE(uart_config) || uart_config[type].name == NULL) + type = 0; + return uart_config[type].name; + } +diff --git a/drivers/tty/tty_ioctl.c b/drivers/tty/tty_ioctl.c +index 9314d93..937f927 100644 +--- a/drivers/tty/tty_ioctl.c ++++ b/drivers/tty/tty_ioctl.c +@@ -618,7 +618,7 @@ static int set_termios(struct tty_struct *tty, void __user *arg, int opt) + if (opt & TERMIOS_WAIT) { + tty_wait_until_sent(tty, 0); + if (signal_pending(current)) +- return -EINTR; ++ return -ERESTARTSYS; + } + + tty_set_termios(tty, &tmp_termios); +@@ -685,7 +685,7 @@ static int set_termiox(struct tty_struct *tty, void __user *arg, int opt) + if (opt & TERMIOS_WAIT) { + tty_wait_until_sent(tty, 0); + if (signal_pending(current)) +- return -EINTR; ++ return -ERESTARTSYS; + } + + mutex_lock(&tty->termios_mutex); +diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c +index e716839..632df54 100644 +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -657,7 +657,7 @@ static inline void save_screen(struct vc_data *vc) + * Redrawing of screen + */ + +-static void clear_buffer_attributes(struct vc_data *vc) ++void clear_buffer_attributes(struct vc_data *vc) + { + unsigned short *p = (unsigned short *)vc->vc_origin; + int count = vc->vc_screenbuf_size / 2; +@@ -3016,7 +3016,7 @@ int __init vty_init(const struct file_operations *console_fops) + + static struct class *vtconsole_class; + +-static int bind_con_driver(const struct consw *csw, int first, int last, ++static int do_bind_con_driver(const struct consw *csw, int first, int last, + int deflt) + { + struct module *owner = csw->owner; +@@ -3027,7 +3027,7 @@ static int bind_con_driver(const struct consw *csw, int first, int last, + if (!try_module_get(owner)) + return -ENODEV; + +- console_lock(); ++ WARN_CONSOLE_UNLOCKED(); + + /* check if driver is registered */ + for (i = 0; i < MAX_NR_CON_DRIVER; i++) { +@@ -3112,11 +3112,22 @@ static int bind_con_driver(const struct consw *csw, int first, int last, + + retval = 0; + err: +- console_unlock(); + module_put(owner); + return retval; + }; + ++ ++static int bind_con_driver(const struct consw *csw, int first, int last, ++ int deflt) ++{ ++ int ret; ++ ++ console_lock(); ++ ret = do_bind_con_driver(csw, first, last, deflt); ++ console_unlock(); ++ return ret; ++} ++ + #ifdef CONFIG_VT_HW_CONSOLE_BINDING + static int con_is_graphics(const struct consw *csw, int first, int last) + { +@@ -3153,6 +3164,18 @@ static int con_is_graphics(const struct consw *csw, int first, int last) + */ + int unbind_con_driver(const struct consw *csw, int first, int last, int deflt) + { ++ int retval; ++ ++ console_lock(); ++ retval = do_unbind_con_driver(csw, first, last, deflt); ++ console_unlock(); ++ return retval; ++} ++EXPORT_SYMBOL(unbind_con_driver); ++ ++/* unlocked version of unbind_con_driver() */ ++int do_unbind_con_driver(const struct consw *csw, int first, int last, int deflt) ++{ + struct module *owner = csw->owner; + const struct consw *defcsw = NULL; + struct con_driver *con_driver = NULL, *con_back = NULL; +@@ -3161,7 +3184,7 @@ int unbind_con_driver(const struct consw *csw, int first, int last, int deflt) + if (!try_module_get(owner)) + return -ENODEV; + +- console_lock(); ++ WARN_CONSOLE_UNLOCKED(); + + /* check if driver is registered and if it is unbindable */ + for (i = 0; i < MAX_NR_CON_DRIVER; i++) { +@@ -3174,10 +3197,8 @@ int unbind_con_driver(const struct consw *csw, int first, int last, int deflt) + } + } + +- if (retval) { +- console_unlock(); ++ if (retval) + goto err; +- } + + retval = -ENODEV; + +@@ -3193,15 +3214,11 @@ int unbind_con_driver(const struct consw *csw, int first, int last, int deflt) + } + } + +- if (retval) { +- console_unlock(); ++ if (retval) + goto err; +- } + +- if (!con_is_bound(csw)) { +- console_unlock(); ++ if (!con_is_bound(csw)) + goto err; +- } + + first = max(first, con_driver->first); + last = min(last, con_driver->last); +@@ -3228,15 +3245,14 @@ int unbind_con_driver(const struct consw *csw, int first, int last, int deflt) + if (!con_is_bound(csw)) + con_driver->flag &= ~CON_DRIVER_FLAG_INIT; + +- console_unlock(); + /* ignore return value, binding should not fail */ +- bind_con_driver(defcsw, first, last, deflt); ++ do_bind_con_driver(defcsw, first, last, deflt); + err: + module_put(owner); + return retval; + + } +-EXPORT_SYMBOL(unbind_con_driver); ++EXPORT_SYMBOL_GPL(do_unbind_con_driver); + + static int vt_bind(struct con_driver *con) + { +@@ -3508,28 +3524,18 @@ int con_debug_leave(void) + } + EXPORT_SYMBOL_GPL(con_debug_leave); + +-/** +- * register_con_driver - register console driver to console layer +- * @csw: console driver +- * @first: the first console to take over, minimum value is 0 +- * @last: the last console to take over, maximum value is MAX_NR_CONSOLES -1 +- * +- * DESCRIPTION: This function registers a console driver which can later +- * bind to a range of consoles specified by @first and @last. It will +- * also initialize the console driver by calling con_startup(). +- */ +-int register_con_driver(const struct consw *csw, int first, int last) ++static int do_register_con_driver(const struct consw *csw, int first, int last) + { + struct module *owner = csw->owner; + struct con_driver *con_driver; + const char *desc; + int i, retval = 0; + ++ WARN_CONSOLE_UNLOCKED(); ++ + if (!try_module_get(owner)) + return -ENODEV; + +- console_lock(); +- + for (i = 0; i < MAX_NR_CON_DRIVER; i++) { + con_driver = ®istered_con_driver[i]; + +@@ -3582,10 +3588,29 @@ int register_con_driver(const struct consw *csw, int first, int last) + } + + err: +- console_unlock(); + module_put(owner); + return retval; + } ++ ++/** ++ * register_con_driver - register console driver to console layer ++ * @csw: console driver ++ * @first: the first console to take over, minimum value is 0 ++ * @last: the last console to take over, maximum value is MAX_NR_CONSOLES -1 ++ * ++ * DESCRIPTION: This function registers a console driver which can later ++ * bind to a range of consoles specified by @first and @last. It will ++ * also initialize the console driver by calling con_startup(). ++ */ ++int register_con_driver(const struct consw *csw, int first, int last) ++{ ++ int retval; ++ ++ console_lock(); ++ retval = do_register_con_driver(csw, first, last); ++ console_unlock(); ++ return retval; ++} + EXPORT_SYMBOL(register_con_driver); + + /** +@@ -3601,9 +3626,18 @@ EXPORT_SYMBOL(register_con_driver); + */ + int unregister_con_driver(const struct consw *csw) + { +- int i, retval = -ENODEV; ++ int retval; + + console_lock(); ++ retval = do_unregister_con_driver(csw); ++ console_unlock(); ++ return retval; ++} ++EXPORT_SYMBOL(unregister_con_driver); ++ ++int do_unregister_con_driver(const struct consw *csw) ++{ ++ int i, retval = -ENODEV; + + /* cannot unregister a bound driver */ + if (con_is_bound(csw)) +@@ -3629,27 +3663,53 @@ int unregister_con_driver(const struct consw *csw) + } + } + err: +- console_unlock(); + return retval; + } +-EXPORT_SYMBOL(unregister_con_driver); ++EXPORT_SYMBOL_GPL(do_unregister_con_driver); + + /* + * If we support more console drivers, this function is used + * when a driver wants to take over some existing consoles + * and become default driver for newly opened ones. + * +- * take_over_console is basically a register followed by unbind ++ * take_over_console is basically a register followed by unbind ++ */ ++int do_take_over_console(const struct consw *csw, int first, int last, int deflt) ++{ ++ int err; ++ ++ err = do_register_con_driver(csw, first, last); ++ /* ++ * If we get an busy error we still want to bind the console driver ++ * and return success, as we may have unbound the console driver ++ * but not unregistered it. ++ */ ++ if (err == -EBUSY) ++ err = 0; ++ if (!err) ++ do_bind_con_driver(csw, first, last, deflt); ++ ++ return err; ++} ++EXPORT_SYMBOL_GPL(do_take_over_console); ++ ++/* ++ * If we support more console drivers, this function is used ++ * when a driver wants to take over some existing consoles ++ * and become default driver for newly opened ones. ++ * ++ * take_over_console is basically a register followed by unbind + */ + int take_over_console(const struct consw *csw, int first, int last, int deflt) + { + int err; + + err = register_con_driver(csw, first, last); +- /* if we get an busy error we still want to bind the console driver ++ /* ++ * If we get an busy error we still want to bind the console driver + * and return success, as we may have unbound the console driver +- Â * but not unregistered it. +- */ ++ * but not unregistered it. ++ */ + if (err == -EBUSY) + err = 0; + if (!err) +diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c +index c77f0d6..9f3003e 100644 +--- a/drivers/usb/core/driver.c ++++ b/drivers/usb/core/driver.c +@@ -541,22 +541,10 @@ int usb_match_device(struct usb_device *dev, const struct usb_device_id *id) + } + + /* returns 0 if no match, 1 if match */ +-int usb_match_one_id(struct usb_interface *interface, +- const struct usb_device_id *id) ++int usb_match_one_id_intf(struct usb_device *dev, ++ struct usb_host_interface *intf, ++ const struct usb_device_id *id) + { +- struct usb_host_interface *intf; +- struct usb_device *dev; +- +- /* proc_connectinfo in devio.c may call us with id == NULL. */ +- if (id == NULL) +- return 0; +- +- intf = interface->cur_altsetting; +- dev = interface_to_usbdev(interface); +- +- if (!usb_match_device(dev, id)) +- return 0; +- + /* The interface class, subclass, and protocol should never be + * checked for a match if the device class is Vendor Specific, + * unless the match record specifies the Vendor ID. */ +@@ -581,6 +569,26 @@ int usb_match_one_id(struct usb_interface *interface, + + return 1; + } ++ ++/* returns 0 if no match, 1 if match */ ++int usb_match_one_id(struct usb_interface *interface, ++ const struct usb_device_id *id) ++{ ++ struct usb_host_interface *intf; ++ struct usb_device *dev; ++ ++ /* proc_connectinfo in devio.c may call us with id == NULL. */ ++ if (id == NULL) ++ return 0; ++ ++ intf = interface->cur_altsetting; ++ dev = interface_to_usbdev(interface); ++ ++ if (!usb_match_device(dev, id)) ++ return 0; ++ ++ return usb_match_one_id_intf(dev, intf, id); ++} + EXPORT_SYMBOL_GPL(usb_match_one_id); + + /** +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index 0ff8e9a..2564d8d 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -1883,7 +1883,7 @@ static int usb_enumerate_device(struct usb_device *udev) + if (err < 0) { + dev_err(&udev->dev, "can't read configurations, error %d\n", + err); +- goto fail; ++ return err; + } + } + if (udev->wusb == 1 && udev->authorized == 0) { +@@ -1899,8 +1899,12 @@ static int usb_enumerate_device(struct usb_device *udev) + udev->serial = usb_cache_string(udev, udev->descriptor.iSerialNumber); + } + err = usb_enumerate_device_otg(udev); +-fail: +- return err; ++ if (err < 0) ++ return err; ++ ++ usb_detect_interface_quirks(udev); ++ ++ return 0; + } + + +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index 3f08c09..0aaa4f1 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -15,17 +15,22 @@ + #include <linux/usb/quirks.h> + #include "usb.h" + +-/* List of quirky USB devices. Please keep this list ordered by: ++/* Lists of quirky USB devices, split in device quirks and interface quirks. ++ * Device quirks are applied at the very beginning of the enumeration process, ++ * right after reading the device descriptor. They can thus only match on device ++ * information. ++ * ++ * Interface quirks are applied after reading all the configuration descriptors. ++ * They can match on both device and interface information. ++ * ++ * Note that the DELAY_INIT and HONOR_BNUMINTERFACES quirks do not make sense as ++ * interface quirks, as they only influence the enumeration process which is run ++ * before processing the interface quirks. ++ * ++ * Please keep the lists ordered by: + * 1) Vendor ID + * 2) Product ID + * 3) Class ID +- * +- * as we want specific devices to be overridden first, and only after that, any +- * class specific quirks. +- * +- * Right now the logic aborts if it finds a valid device in the table, we might +- * want to change that in the future if it turns out that a whole class of +- * devices is broken... + */ + static const struct usb_device_id usb_quirk_list[] = { + /* CBM - Flash disk */ +@@ -41,53 +46,23 @@ static const struct usb_device_id usb_quirk_list[] = { + /* Microsoft LifeCam-VX700 v2.0 */ + { USB_DEVICE(0x045e, 0x0770), .driver_info = USB_QUIRK_RESET_RESUME }, + +- /* Logitech Webcam C200 */ +- { USB_DEVICE(0x046d, 0x0802), .driver_info = USB_QUIRK_RESET_RESUME }, +- +- /* Logitech Webcam C250 */ +- { USB_DEVICE(0x046d, 0x0804), .driver_info = USB_QUIRK_RESET_RESUME }, +- +- /* Logitech Webcam C300 */ +- { USB_DEVICE(0x046d, 0x0805), .driver_info = USB_QUIRK_RESET_RESUME }, +- +- /* Logitech Webcam B/C500 */ +- { USB_DEVICE(0x046d, 0x0807), .driver_info = USB_QUIRK_RESET_RESUME }, +- +- /* Logitech Webcam C600 */ +- { USB_DEVICE(0x046d, 0x0808), .driver_info = USB_QUIRK_RESET_RESUME }, +- +- /* Logitech Webcam Pro 9000 */ +- { USB_DEVICE(0x046d, 0x0809), .driver_info = USB_QUIRK_RESET_RESUME }, ++ /* Logitech Quickcam Fusion */ ++ { USB_DEVICE(0x046d, 0x08c1), .driver_info = USB_QUIRK_RESET_RESUME }, + +- /* Logitech Webcam C905 */ +- { USB_DEVICE(0x046d, 0x080a), .driver_info = USB_QUIRK_RESET_RESUME }, ++ /* Logitech Quickcam Orbit MP */ ++ { USB_DEVICE(0x046d, 0x08c2), .driver_info = USB_QUIRK_RESET_RESUME }, + +- /* Logitech Webcam C210 */ +- { USB_DEVICE(0x046d, 0x0819), .driver_info = USB_QUIRK_RESET_RESUME }, ++ /* Logitech Quickcam Pro for Notebook */ ++ { USB_DEVICE(0x046d, 0x08c3), .driver_info = USB_QUIRK_RESET_RESUME }, + +- /* Logitech Webcam C260 */ +- { USB_DEVICE(0x046d, 0x081a), .driver_info = USB_QUIRK_RESET_RESUME }, ++ /* Logitech Quickcam Pro 5000 */ ++ { USB_DEVICE(0x046d, 0x08c5), .driver_info = USB_QUIRK_RESET_RESUME }, + +- /* Logitech Webcam C310 */ +- { USB_DEVICE(0x046d, 0x081b), .driver_info = USB_QUIRK_RESET_RESUME }, ++ /* Logitech Quickcam OEM Dell Notebook */ ++ { USB_DEVICE(0x046d, 0x08c6), .driver_info = USB_QUIRK_RESET_RESUME }, + +- /* Logitech Webcam C910 */ +- { USB_DEVICE(0x046d, 0x0821), .driver_info = USB_QUIRK_RESET_RESUME }, +- +- /* Logitech Webcam C160 */ +- { USB_DEVICE(0x046d, 0x0824), .driver_info = USB_QUIRK_RESET_RESUME }, +- +- /* Logitech Webcam C270 */ +- { USB_DEVICE(0x046d, 0x0825), .driver_info = USB_QUIRK_RESET_RESUME }, +- +- /* Logitech Quickcam Pro 9000 */ +- { USB_DEVICE(0x046d, 0x0990), .driver_info = USB_QUIRK_RESET_RESUME }, +- +- /* Logitech Quickcam E3500 */ +- { USB_DEVICE(0x046d, 0x09a4), .driver_info = USB_QUIRK_RESET_RESUME }, +- +- /* Logitech Quickcam Vision Pro */ +- { USB_DEVICE(0x046d, 0x09a6), .driver_info = USB_QUIRK_RESET_RESUME }, ++ /* Logitech Quickcam OEM Cisco VT Camera II */ ++ { USB_DEVICE(0x046d, 0x08c7), .driver_info = USB_QUIRK_RESET_RESUME }, + + /* Logitech Harmony 700-series */ + { USB_DEVICE(0x046d, 0xc122), .driver_info = USB_QUIRK_DELAY_INIT }, +@@ -163,16 +138,57 @@ static const struct usb_device_id usb_quirk_list[] = { + { } /* terminating entry must be last */ + }; + +-static const struct usb_device_id *find_id(struct usb_device *udev) ++static const struct usb_device_id usb_interface_quirk_list[] = { ++ /* Logitech UVC Cameras */ ++ { USB_VENDOR_AND_INTERFACE_INFO(0x046d, USB_CLASS_VIDEO, 1, 0), ++ .driver_info = USB_QUIRK_RESET_RESUME }, ++ ++ { } /* terminating entry must be last */ ++}; ++ ++static bool usb_match_any_interface(struct usb_device *udev, ++ const struct usb_device_id *id) + { +- const struct usb_device_id *id = usb_quirk_list; ++ unsigned int i; + +- for (; id->idVendor || id->bDeviceClass || id->bInterfaceClass || +- id->driver_info; id++) { +- if (usb_match_device(udev, id)) +- return id; ++ for (i = 0; i < udev->descriptor.bNumConfigurations; ++i) { ++ struct usb_host_config *cfg = &udev->config[i]; ++ unsigned int j; ++ ++ for (j = 0; j < cfg->desc.bNumInterfaces; ++j) { ++ struct usb_interface_cache *cache; ++ struct usb_host_interface *intf; ++ ++ cache = cfg->intf_cache[j]; ++ if (cache->num_altsetting == 0) ++ continue; ++ ++ intf = &cache->altsetting[0]; ++ if (usb_match_one_id_intf(udev, intf, id)) ++ return true; ++ } ++ } ++ ++ return false; ++} ++ ++static u32 __usb_detect_quirks(struct usb_device *udev, ++ const struct usb_device_id *id) ++{ ++ u32 quirks = 0; ++ ++ for (; id->match_flags; id++) { ++ if (!usb_match_device(udev, id)) ++ continue; ++ ++ if ((id->match_flags & USB_DEVICE_ID_MATCH_INT_INFO) && ++ !usb_match_any_interface(udev, id)) ++ continue; ++ ++ quirks |= (u32)(id->driver_info); + } +- return NULL; ++ ++ return quirks; + } + + /* +@@ -180,14 +196,10 @@ static const struct usb_device_id *find_id(struct usb_device *udev) + */ + void usb_detect_quirks(struct usb_device *udev) + { +- const struct usb_device_id *id = usb_quirk_list; +- +- id = find_id(udev); +- if (id) +- udev->quirks = (u32)(id->driver_info); ++ udev->quirks = __usb_detect_quirks(udev, usb_quirk_list); + if (udev->quirks) + dev_dbg(&udev->dev, "USB quirks for this device: %x\n", +- udev->quirks); ++ udev->quirks); + + /* For the present, all devices default to USB-PERSIST enabled */ + #if 0 /* was: #ifdef CONFIG_PM */ +@@ -204,3 +216,16 @@ void usb_detect_quirks(struct usb_device *udev) + udev->persist_enabled = 1; + #endif /* CONFIG_PM */ + } ++ ++void usb_detect_interface_quirks(struct usb_device *udev) ++{ ++ u32 quirks; ++ ++ quirks = __usb_detect_quirks(udev, usb_interface_quirk_list); ++ if (quirks == 0) ++ return; ++ ++ dev_dbg(&udev->dev, "USB interface quirks for this device: %x\n", ++ quirks); ++ udev->quirks |= quirks; ++} +diff --git a/drivers/usb/core/usb.h b/drivers/usb/core/usb.h +index 45e8479..3e1159b 100644 +--- a/drivers/usb/core/usb.h ++++ b/drivers/usb/core/usb.h +@@ -24,6 +24,7 @@ extern void usb_disable_device(struct usb_device *dev, int skip_ep0); + extern int usb_deauthorize_device(struct usb_device *); + extern int usb_authorize_device(struct usb_device *); + extern void usb_detect_quirks(struct usb_device *udev); ++extern void usb_detect_interface_quirks(struct usb_device *udev); + extern int usb_remove_device(struct usb_device *udev); + + extern int usb_get_device_descriptor(struct usb_device *dev, +@@ -35,6 +36,9 @@ extern int usb_set_configuration(struct usb_device *dev, int configuration); + extern int usb_choose_configuration(struct usb_device *udev); + + extern void usb_kick_khubd(struct usb_device *dev); ++extern int usb_match_one_id_intf(struct usb_device *dev, ++ struct usb_host_interface *intf, ++ const struct usb_device_id *id); + extern int usb_match_device(struct usb_device *dev, + const struct usb_device_id *id); + extern void usb_forced_unbind_intf(struct usb_interface *intf); +diff --git a/drivers/usb/host/ehci-omap.c b/drivers/usb/host/ehci-omap.c +index e39b029..d4159b8 100644 +--- a/drivers/usb/host/ehci-omap.c ++++ b/drivers/usb/host/ehci-omap.c +@@ -337,7 +337,7 @@ static const struct hc_driver ehci_omap_hc_driver = { + .clear_tt_buffer_complete = ehci_clear_tt_buffer_complete, + }; + +-MODULE_ALIAS("platform:omap-ehci"); ++MODULE_ALIAS("platform:ehci-omap"); + MODULE_AUTHOR("Texas Instruments, Inc."); + MODULE_AUTHOR("Felipe Balbi <felipe.balbi@nokia.com>"); + +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index d644a66..71c4696 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -1916,24 +1916,22 @@ static void ftdi_dtr_rts(struct usb_serial_port *port, int on) + { + struct ftdi_private *priv = usb_get_serial_port_data(port); + +- mutex_lock(&port->serial->disc_mutex); +- if (!port->serial->disconnected) { +- /* Disable flow control */ +- if (!on && usb_control_msg(port->serial->dev, ++ /* Disable flow control */ ++ if (!on) { ++ if (usb_control_msg(port->serial->dev, + usb_sndctrlpipe(port->serial->dev, 0), + FTDI_SIO_SET_FLOW_CTRL_REQUEST, + FTDI_SIO_SET_FLOW_CTRL_REQUEST_TYPE, + 0, priv->interface, NULL, 0, + WDR_TIMEOUT) < 0) { +- dev_err(&port->dev, "error from flowcontrol urb\n"); ++ dev_err(&port->dev, "error from flowcontrol urb\n"); + } +- /* drop RTS and DTR */ +- if (on) +- set_mctrl(port, TIOCM_DTR | TIOCM_RTS); +- else +- clear_mctrl(port, TIOCM_DTR | TIOCM_RTS); + } +- mutex_unlock(&port->serial->disc_mutex); ++ /* drop RTS and DTR */ ++ if (on) ++ set_mctrl(port, TIOCM_DTR | TIOCM_RTS); ++ else ++ clear_mctrl(port, TIOCM_DTR | TIOCM_RTS); + } + + /* +diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c +index d3addb2..de0bb8e 100644 +--- a/drivers/usb/serial/mct_u232.c ++++ b/drivers/usb/serial/mct_u232.c +@@ -558,19 +558,15 @@ static void mct_u232_dtr_rts(struct usb_serial_port *port, int on) + unsigned int control_state; + struct mct_u232_private *priv = usb_get_serial_port_data(port); + +- mutex_lock(&port->serial->disc_mutex); +- if (!port->serial->disconnected) { +- /* drop DTR and RTS */ +- spin_lock_irq(&priv->lock); +- if (on) +- priv->control_state |= TIOCM_DTR | TIOCM_RTS; +- else +- priv->control_state &= ~(TIOCM_DTR | TIOCM_RTS); +- control_state = priv->control_state; +- spin_unlock_irq(&priv->lock); +- mct_u232_set_modem_ctrl(port->serial, control_state); +- } +- mutex_unlock(&port->serial->disc_mutex); ++ spin_lock_irq(&priv->lock); ++ if (on) ++ priv->control_state |= TIOCM_DTR | TIOCM_RTS; ++ else ++ priv->control_state &= ~(TIOCM_DTR | TIOCM_RTS); ++ control_state = priv->control_state; ++ spin_unlock_irq(&priv->lock); ++ ++ mct_u232_set_modem_ctrl(port->serial, control_state); + } + + static void mct_u232_close(struct usb_serial_port *port) +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 52cd814..24a3ea6 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -479,6 +479,7 @@ static const struct option_blacklist_info four_g_w14_blacklist = { + + static const struct option_blacklist_info alcatel_x200_blacklist = { + .sendsetup = BIT(0) | BIT(1), ++ .reserved = BIT(4), + }; + + static const struct option_blacklist_info zte_0037_blacklist = { +@@ -575,8 +576,14 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE(QUANTA_VENDOR_ID, QUANTA_PRODUCT_GLX) }, + { USB_DEVICE(QUANTA_VENDOR_ID, QUANTA_PRODUCT_GKE) }, + { USB_DEVICE(QUANTA_VENDOR_ID, QUANTA_PRODUCT_GLE) }, ++ { USB_DEVICE(QUANTA_VENDOR_ID, 0xea42), ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, ++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1c05, USB_CLASS_COMM, 0x02, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1c23, USB_CLASS_COMM, 0x02, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E173, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t) &net_intf1_blacklist }, ++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1441, USB_CLASS_COMM, 0x02, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1442, USB_CLASS_COMM, 0x02, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4505, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t) &huawei_cdc12_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3765, 0xff, 0xff, 0xff), +@@ -1215,7 +1222,14 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200), + .driver_info = (kernel_ulong_t)&alcatel_x200_blacklist + }, +- { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X220_X500D) }, ++ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X220_X500D), ++ .driver_info = (kernel_ulong_t)&net_intf6_blacklist }, ++ { USB_DEVICE(ALCATEL_VENDOR_ID, 0x0052), ++ .driver_info = (kernel_ulong_t)&net_intf6_blacklist }, ++ { USB_DEVICE(ALCATEL_VENDOR_ID, 0x00b6), ++ .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, ++ { USB_DEVICE(ALCATEL_VENDOR_ID, 0x00b7), ++ .driver_info = (kernel_ulong_t)&net_intf5_blacklist }, + { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_L100V), + .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) }, +diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c +index e1f1ebd..a7fa673 100644 +--- a/drivers/usb/serial/sierra.c ++++ b/drivers/usb/serial/sierra.c +@@ -891,19 +891,13 @@ static int sierra_open(struct tty_struct *tty, struct usb_serial_port *port) + + static void sierra_dtr_rts(struct usb_serial_port *port, int on) + { +- struct usb_serial *serial = port->serial; + struct sierra_port_private *portdata; + + portdata = usb_get_serial_port_data(port); + portdata->rts_state = on; + portdata->dtr_state = on; + +- if (serial->dev) { +- mutex_lock(&serial->disc_mutex); +- if (!serial->disconnected) +- sierra_send_setup(port); +- mutex_unlock(&serial->disc_mutex); +- } ++ sierra_send_setup(port); + } + + static int sierra_startup(struct usb_serial *serial) +diff --git a/drivers/usb/serial/ssu100.c b/drivers/usb/serial/ssu100.c +index 87362e4..fff7f17 100644 +--- a/drivers/usb/serial/ssu100.c ++++ b/drivers/usb/serial/ssu100.c +@@ -533,19 +533,16 @@ static void ssu100_dtr_rts(struct usb_serial_port *port, int on) + + dbg("%s\n", __func__); + +- mutex_lock(&port->serial->disc_mutex); +- if (!port->serial->disconnected) { +- /* Disable flow control */ +- if (!on && +- ssu100_setregister(dev, 0, UART_MCR, 0) < 0) ++ /* Disable flow control */ ++ if (!on) { ++ if (ssu100_setregister(dev, 0, UART_MCR, 0) < 0) + dev_err(&port->dev, "error from flowcontrol urb\n"); +- /* drop RTS and DTR */ +- if (on) +- set_mctrl(dev, TIOCM_DTR | TIOCM_RTS); +- else +- clear_mctrl(dev, TIOCM_DTR | TIOCM_RTS); + } +- mutex_unlock(&port->serial->disc_mutex); ++ /* drop RTS and DTR */ ++ if (on) ++ set_mctrl(dev, TIOCM_DTR | TIOCM_RTS); ++ else ++ clear_mctrl(dev, TIOCM_DTR | TIOCM_RTS); + } + + static void ssu100_update_msr(struct usb_serial_port *port, u8 msr) +diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c +index e5206de..dc1ce62 100644 +--- a/drivers/usb/serial/usb-serial.c ++++ b/drivers/usb/serial/usb-serial.c +@@ -697,9 +697,20 @@ static int serial_carrier_raised(struct tty_port *port) + static void serial_dtr_rts(struct tty_port *port, int on) + { + struct usb_serial_port *p = container_of(port, struct usb_serial_port, port); +- struct usb_serial_driver *drv = p->serial->type; +- if (drv->dtr_rts) ++ struct usb_serial *serial = p->serial; ++ struct usb_serial_driver *drv = serial->type; ++ ++ if (!drv->dtr_rts) ++ return; ++ /* ++ * Work-around bug in the tty-layer which can result in dtr_rts ++ * being called after a disconnect (and tty_unregister_device ++ * has returned). Remove once bug has been squashed. ++ */ ++ mutex_lock(&serial->disc_mutex); ++ if (!serial->disconnected) + drv->dtr_rts(p, on); ++ mutex_unlock(&serial->disc_mutex); + } + + static const struct tty_port_operations serial_port_ops = { +diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c +index d555ca9..6c92301 100644 +--- a/drivers/usb/serial/usb_wwan.c ++++ b/drivers/usb/serial/usb_wwan.c +@@ -41,7 +41,6 @@ static int debug; + + void usb_wwan_dtr_rts(struct usb_serial_port *port, int on) + { +- struct usb_serial *serial = port->serial; + struct usb_wwan_port_private *portdata; + + struct usb_wwan_intf_private *intfdata; +@@ -54,12 +53,11 @@ void usb_wwan_dtr_rts(struct usb_serial_port *port, int on) + return; + + portdata = usb_get_serial_port_data(port); +- mutex_lock(&serial->disc_mutex); ++ /* FIXME: locking */ + portdata->rts_state = on; + portdata->dtr_state = on; +- if (serial->dev) +- intfdata->send_setup(port); +- mutex_unlock(&serial->disc_mutex); ++ ++ intfdata->send_setup(port); + } + EXPORT_SYMBOL(usb_wwan_dtr_rts); + +diff --git a/drivers/usb/storage/initializers.c b/drivers/usb/storage/initializers.c +index 16b0bf0..7ab9046 100644 +--- a/drivers/usb/storage/initializers.c ++++ b/drivers/usb/storage/initializers.c +@@ -147,7 +147,7 @@ static int usb_stor_huawei_dongles_pid(struct us_data *us) + int idProduct; + + idesc = &us->pusb_intf->cur_altsetting->desc; +- idProduct = us->pusb_dev->descriptor.idProduct; ++ idProduct = le16_to_cpu(us->pusb_dev->descriptor.idProduct); + /* The first port is CDROM, + * means the dongle in the single port mode, + * and a switch command is required to be sent. */ +@@ -169,7 +169,7 @@ int usb_stor_huawei_init(struct us_data *us) + int result = 0; + + if (usb_stor_huawei_dongles_pid(us)) { +- if (us->pusb_dev->descriptor.idProduct >= 0x1446) ++ if (le16_to_cpu(us->pusb_dev->descriptor.idProduct) >= 0x1446) + result = usb_stor_huawei_scsi_init(us); + else + result = usb_stor_huawei_feature_init(us); +diff --git a/drivers/usb/storage/unusual_cypress.h b/drivers/usb/storage/unusual_cypress.h +index 2c85530..65a6a75 100644 +--- a/drivers/usb/storage/unusual_cypress.h ++++ b/drivers/usb/storage/unusual_cypress.h +@@ -31,7 +31,7 @@ UNUSUAL_DEV( 0x04b4, 0x6831, 0x0000, 0x9999, + "Cypress ISD-300LP", + USB_SC_CYP_ATACB, USB_PR_DEVICE, NULL, 0), + +-UNUSUAL_DEV( 0x14cd, 0x6116, 0x0000, 0x9999, ++UNUSUAL_DEV( 0x14cd, 0x6116, 0x0000, 0x0219, + "Super Top", + "USB 2.0 SATA BRIDGE", + USB_SC_CYP_ATACB, USB_PR_DEVICE, NULL, 0), +diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c +index ae66278..be32b1b 100644 +--- a/drivers/vhost/vhost.c ++++ b/drivers/vhost/vhost.c +@@ -1073,7 +1073,7 @@ static int translate_desc(struct vhost_dev *dev, u64 addr, u32 len, + } + _iov = iov + ret; + size = reg->memory_size - addr + reg->guest_phys_addr; +- _iov->iov_len = min((u64)len, size); ++ _iov->iov_len = min((u64)len - s, size); + _iov->iov_base = (void __user *)(unsigned long) + (reg->userspace_addr + addr - reg->guest_phys_addr); + s += size; +diff --git a/drivers/video/backlight/adp8860_bl.c b/drivers/video/backlight/adp8860_bl.c +index 66bc74d..b35c857 100644 +--- a/drivers/video/backlight/adp8860_bl.c ++++ b/drivers/video/backlight/adp8860_bl.c +@@ -791,7 +791,7 @@ static int adp8860_i2c_suspend(struct i2c_client *client, pm_message_t message) + + static int adp8860_i2c_resume(struct i2c_client *client) + { +- adp8860_set_bits(client, ADP8860_MDCR, NSTBY); ++ adp8860_set_bits(client, ADP8860_MDCR, NSTBY | BLEN); + + return 0; + } +diff --git a/drivers/video/backlight/adp8870_bl.c b/drivers/video/backlight/adp8870_bl.c +index 6c68a68..25a9b3a 100644 +--- a/drivers/video/backlight/adp8870_bl.c ++++ b/drivers/video/backlight/adp8870_bl.c +@@ -965,7 +965,7 @@ static int adp8870_i2c_suspend(struct i2c_client *client, pm_message_t message) + + static int adp8870_i2c_resume(struct i2c_client *client) + { +- adp8870_set_bits(client, ADP8870_MDCR, NSTBY); ++ adp8870_set_bits(client, ADP8870_MDCR, NSTBY | BLEN); + + return 0; + } +diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c +index bf9a9b7..9b8bcab 100644 +--- a/drivers/video/console/fbcon.c ++++ b/drivers/video/console/fbcon.c +@@ -530,6 +530,33 @@ static int search_for_mapped_con(void) + return retval; + } + ++static int do_fbcon_takeover(int show_logo) ++{ ++ int err, i; ++ ++ if (!num_registered_fb) ++ return -ENODEV; ++ ++ if (!show_logo) ++ logo_shown = FBCON_LOGO_DONTSHOW; ++ ++ for (i = first_fb_vc; i <= last_fb_vc; i++) ++ con2fb_map[i] = info_idx; ++ ++ err = do_take_over_console(&fb_con, first_fb_vc, last_fb_vc, ++ fbcon_is_default); ++ ++ if (err) { ++ for (i = first_fb_vc; i <= last_fb_vc; i++) ++ con2fb_map[i] = -1; ++ info_idx = -1; ++ } else { ++ fbcon_has_console_bind = 1; ++ } ++ ++ return err; ++} ++ + static int fbcon_takeover(int show_logo) + { + int err, i; +@@ -991,7 +1018,7 @@ static const char *fbcon_startup(void) + } + + /* Setup default font */ +- if (!p->fontdata) { ++ if (!p->fontdata && !vc->vc_font.data) { + if (!fontname[0] || !(font = find_font(fontname))) + font = get_default_font(info->var.xres, + info->var.yres, +@@ -1001,6 +1028,8 @@ static const char *fbcon_startup(void) + vc->vc_font.height = font->height; + vc->vc_font.data = (void *)(p->fontdata = font->data); + vc->vc_font.charcount = 256; /* FIXME Need to support more fonts */ ++ } else { ++ p->fontdata = vc->vc_font.data; + } + + cols = FBCON_SWAP(ops->rotate, info->var.xres, info->var.yres); +@@ -1160,9 +1189,9 @@ static void fbcon_init(struct vc_data *vc, int init) + ops->p = &fb_display[fg_console]; + } + +-static void fbcon_free_font(struct display *p) ++static void fbcon_free_font(struct display *p, bool freefont) + { +- if (p->userfont && p->fontdata && (--REFCOUNT(p->fontdata) == 0)) ++ if (freefont && p->userfont && p->fontdata && (--REFCOUNT(p->fontdata) == 0)) + kfree(p->fontdata - FONT_EXTRA_WORDS * sizeof(int)); + p->fontdata = NULL; + p->userfont = 0; +@@ -1174,8 +1203,8 @@ static void fbcon_deinit(struct vc_data *vc) + struct fb_info *info; + struct fbcon_ops *ops; + int idx; ++ bool free_font = true; + +- fbcon_free_font(p); + idx = con2fb_map[vc->vc_num]; + + if (idx == -1) +@@ -1186,6 +1215,8 @@ static void fbcon_deinit(struct vc_data *vc) + if (!info) + goto finished; + ++ if (info->flags & FBINFO_MISC_FIRMWARE) ++ free_font = false; + ops = info->fbcon_par; + + if (!ops) +@@ -1197,6 +1228,8 @@ static void fbcon_deinit(struct vc_data *vc) + ops->flags &= ~FBCON_FLAGS_INIT; + finished: + ++ fbcon_free_font(p, free_font); ++ + if (!con_is_bound(&fb_con)) + fbcon_exit(); + +@@ -2978,7 +3011,7 @@ static int fbcon_unbind(void) + { + int ret; + +- ret = unbind_con_driver(&fb_con, first_fb_vc, last_fb_vc, ++ ret = do_unbind_con_driver(&fb_con, first_fb_vc, last_fb_vc, + fbcon_is_default); + + if (!ret) +@@ -3051,7 +3084,7 @@ static int fbcon_fb_unregistered(struct fb_info *info) + primary_device = -1; + + if (!num_registered_fb) +- unregister_con_driver(&fb_con); ++ do_unregister_con_driver(&fb_con); + + return 0; + } +@@ -3116,7 +3149,7 @@ static int fbcon_fb_registered(struct fb_info *info) + } + + if (info_idx != -1) +- ret = fbcon_takeover(1); ++ ret = do_fbcon_takeover(1); + } else { + for (i = first_fb_vc; i <= last_fb_vc; i++) { + if (con2fb_map_boot[i] == idx) +diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c +index d449a74..5855d17 100644 +--- a/drivers/video/console/vgacon.c ++++ b/drivers/video/console/vgacon.c +@@ -1064,7 +1064,7 @@ static int vgacon_do_font_op(struct vgastate *state,char *arg,int set,int ch512) + unsigned short video_port_status = vga_video_port_reg + 6; + int font_select = 0x00, beg, i; + char *charmap; +- ++ bool clear_attribs = false; + if (vga_video_type != VIDEO_TYPE_EGAM) { + charmap = (char *) VGA_MAP_MEM(colourmap, 0); + beg = 0x0e; +@@ -1169,12 +1169,6 @@ static int vgacon_do_font_op(struct vgastate *state,char *arg,int set,int ch512) + + /* if 512 char mode is already enabled don't re-enable it. */ + if ((set) && (ch512 != vga_512_chars)) { +- /* attribute controller */ +- for (i = 0; i < MAX_NR_CONSOLES; i++) { +- struct vc_data *c = vc_cons[i].d; +- if (c && c->vc_sw == &vga_con) +- c->vc_hi_font_mask = ch512 ? 0x0800 : 0; +- } + vga_512_chars = ch512; + /* 256-char: enable intensity bit + 512-char: disable intensity bit */ +@@ -1185,8 +1179,22 @@ static int vgacon_do_font_op(struct vgastate *state,char *arg,int set,int ch512) + it means, but it works, and it appears necessary */ + inb_p(video_port_status); + vga_wattr(state->vgabase, VGA_AR_ENABLE_DISPLAY, 0); ++ clear_attribs = true; + } + raw_spin_unlock_irq(&vga_lock); ++ ++ if (clear_attribs) { ++ for (i = 0; i < MAX_NR_CONSOLES; i++) { ++ struct vc_data *c = vc_cons[i].d; ++ if (c && c->vc_sw == &vga_con) { ++ /* force hi font mask to 0, so we always clear ++ the bit on either transition */ ++ c->vc_hi_font_mask = 0x00; ++ clear_buffer_attributes(c); ++ c->vc_hi_font_mask = ch512 ? 0x0800 : 0; ++ } ++ } ++ } + return 0; + } + +diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c +index 7a41220..c133dde 100644 +--- a/drivers/video/fbmem.c ++++ b/drivers/video/fbmem.c +@@ -1628,7 +1628,9 @@ static int do_register_framebuffer(struct fb_info *fb_info) + event.info = fb_info; + if (!lock_fb_info(fb_info)) + return -ENODEV; ++ console_lock(); + fb_notifier_call_chain(FB_EVENT_FB_REGISTERED, &event); ++ console_unlock(); + unlock_fb_info(fb_info); + return 0; + } +@@ -1644,8 +1646,10 @@ static int do_unregister_framebuffer(struct fb_info *fb_info) + + if (!lock_fb_info(fb_info)) + return -ENODEV; ++ console_lock(); + event.info = fb_info; + ret = fb_notifier_call_chain(FB_EVENT_FB_UNBIND, &event); ++ console_unlock(); + unlock_fb_info(fb_info); + + if (ret) +@@ -1660,7 +1664,9 @@ static int do_unregister_framebuffer(struct fb_info *fb_info) + num_registered_fb--; + fb_cleanup_device(fb_info); + event.info = fb_info; ++ console_lock(); + fb_notifier_call_chain(FB_EVENT_FB_UNREGISTERED, &event); ++ console_unlock(); + + /* this may free fb info */ + put_fb_info(fb_info); +@@ -1831,11 +1837,8 @@ int fb_new_modelist(struct fb_info *info) + err = 1; + + if (!list_empty(&info->modelist)) { +- if (!lock_fb_info(info)) +- return -ENODEV; + event.info = info; + err = fb_notifier_call_chain(FB_EVENT_NEW_MODELIST, &event); +- unlock_fb_info(info); + } + + return err; +diff --git a/drivers/video/fbsysfs.c b/drivers/video/fbsysfs.c +index 67afa9c..303fb9f 100644 +--- a/drivers/video/fbsysfs.c ++++ b/drivers/video/fbsysfs.c +@@ -175,6 +175,8 @@ static ssize_t store_modes(struct device *device, + if (i * sizeof(struct fb_videomode) != count) + return -EINVAL; + ++ if (!lock_fb_info(fb_info)) ++ return -ENODEV; + console_lock(); + list_splice(&fb_info->modelist, &old_list); + fb_videomode_to_modelist((const struct fb_videomode *)buf, i, +@@ -186,6 +188,7 @@ static ssize_t store_modes(struct device *device, + fb_destroy_modelist(&old_list); + + console_unlock(); ++ unlock_fb_info(fb_info); + + return 0; + } +diff --git a/drivers/xen/evtchn.c b/drivers/xen/evtchn.c +index dbc13e9..c93d59e 100644 +--- a/drivers/xen/evtchn.c ++++ b/drivers/xen/evtchn.c +@@ -269,6 +269,14 @@ static int evtchn_bind_to_user(struct per_user_data *u, int port) + u->name, (void *)(unsigned long)port); + if (rc >= 0) + rc = 0; ++ else { ++ /* bind failed, should close the port now */ ++ struct evtchn_close close; ++ close.port = port; ++ if (HYPERVISOR_event_channel_op(EVTCHNOP_close, &close) != 0) ++ BUG(); ++ set_port_user(port, NULL); ++ } + + return rc; + } +@@ -277,6 +285,8 @@ static void evtchn_unbind_from_user(struct per_user_data *u, int port) + { + int irq = irq_from_evtchn(port); + ++ BUG_ON(irq < 0); ++ + unbind_from_irqhandler(irq, (void *)(unsigned long)port); + + set_port_user(port, NULL); +diff --git a/drivers/xen/xen-pciback/pciback_ops.c b/drivers/xen/xen-pciback/pciback_ops.c +index 63616d7..d07c4cd 100644 +--- a/drivers/xen/xen-pciback/pciback_ops.c ++++ b/drivers/xen/xen-pciback/pciback_ops.c +@@ -8,6 +8,7 @@ + #include <linux/bitops.h> + #include <xen/events.h> + #include <linux/sched.h> ++#include <linux/ratelimit.h> + #include "pciback.h" + + int verbose_request; +@@ -135,7 +136,6 @@ int xen_pcibk_enable_msi(struct xen_pcibk_device *pdev, + struct pci_dev *dev, struct xen_pci_op *op) + { + struct xen_pcibk_dev_data *dev_data; +- int otherend = pdev->xdev->otherend_id; + int status; + + if (unlikely(verbose_request)) +@@ -144,8 +144,9 @@ int xen_pcibk_enable_msi(struct xen_pcibk_device *pdev, + status = pci_enable_msi(dev); + + if (status) { +- printk(KERN_ERR "error enable msi for guest %x status %x\n", +- otherend, status); ++ pr_warn_ratelimited(DRV_NAME ": %s: error enabling MSI for guest %u: err %d\n", ++ pci_name(dev), pdev->xdev->otherend_id, ++ status); + op->value = 0; + return XEN_PCI_ERR_op_failed; + } +@@ -223,10 +224,10 @@ int xen_pcibk_enable_msix(struct xen_pcibk_device *pdev, + pci_name(dev), i, + op->msix_entries[i].vector); + } +- } else { +- printk(KERN_WARNING DRV_NAME ": %s: failed to enable MSI-X: err %d!\n", +- pci_name(dev), result); +- } ++ } else ++ pr_warn_ratelimited(DRV_NAME ": %s: error enabling MSI-X for guest %u: err %d!\n", ++ pci_name(dev), pdev->xdev->otherend_id, ++ result); + kfree(entries); + + op->value = result; +diff --git a/fs/binfmt_em86.c b/fs/binfmt_em86.c +index b8e8b0a..4a1b984 100644 +--- a/fs/binfmt_em86.c ++++ b/fs/binfmt_em86.c +@@ -42,7 +42,6 @@ static int load_em86(struct linux_binprm *bprm,struct pt_regs *regs) + return -ENOEXEC; + } + +- bprm->recursion_depth++; /* Well, the bang-shell is implicit... */ + allow_write_access(bprm->file); + fput(bprm->file); + bprm->file = NULL; +diff --git a/fs/binfmt_misc.c b/fs/binfmt_misc.c +index ca52e92..7423cb9 100644 +--- a/fs/binfmt_misc.c ++++ b/fs/binfmt_misc.c +@@ -116,10 +116,6 @@ static int load_misc_binary(struct linux_binprm *bprm, struct pt_regs *regs) + if (!enabled) + goto _ret; + +- retval = -ENOEXEC; +- if (bprm->recursion_depth > BINPRM_MAX_RECURSION) +- goto _ret; +- + /* to keep locking time low, we copy the interpreter string */ + read_lock(&entries_lock); + fmt = check_file(bprm); +@@ -199,8 +195,6 @@ static int load_misc_binary(struct linux_binprm *bprm, struct pt_regs *regs) + if (retval < 0) + goto _error; + +- bprm->recursion_depth++; +- + retval = search_binary_handler (bprm, regs); + if (retval < 0) + goto _error; +diff --git a/fs/binfmt_script.c b/fs/binfmt_script.c +index e39c18a..211ede0 100644 +--- a/fs/binfmt_script.c ++++ b/fs/binfmt_script.c +@@ -22,15 +22,13 @@ static int load_script(struct linux_binprm *bprm,struct pt_regs *regs) + char interp[BINPRM_BUF_SIZE]; + int retval; + +- if ((bprm->buf[0] != '#') || (bprm->buf[1] != '!') || +- (bprm->recursion_depth > BINPRM_MAX_RECURSION)) ++ if ((bprm->buf[0] != '#') || (bprm->buf[1] != '!')) + return -ENOEXEC; + /* + * This section does the #! interpretation. + * Sorta complicated, but hopefully it will work. -TYT + */ + +- bprm->recursion_depth++; + allow_write_access(bprm->file); + fput(bprm->file); + bprm->file = NULL; +diff --git a/fs/block_dev.c b/fs/block_dev.c +index 9b98987..613edd8 100644 +--- a/fs/block_dev.c ++++ b/fs/block_dev.c +@@ -82,13 +82,14 @@ sector_t blkdev_max_block(struct block_device *bdev) + } + + /* Kill _all_ buffers and pagecache , dirty or not.. */ +-static void kill_bdev(struct block_device *bdev) ++void kill_bdev(struct block_device *bdev) + { + if (bdev->bd_inode->i_mapping->nrpages == 0) + return; + invalidate_bh_lrus(); + truncate_inode_pages(bdev->bd_inode->i_mapping, 0); + } ++EXPORT_SYMBOL(kill_bdev); + + int set_blocksize(struct block_device *bdev, int size) + { +@@ -1024,6 +1025,7 @@ int revalidate_disk(struct gendisk *disk) + + mutex_lock(&bdev->bd_mutex); + check_disk_size_change(disk, bdev); ++ bdev->bd_invalidated = 0; + mutex_unlock(&bdev->bd_mutex); + bdput(bdev); + return ret; +diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c +index 0e3c092..b4d2438 100644 +--- a/fs/cachefiles/rdwr.c ++++ b/fs/cachefiles/rdwr.c +@@ -918,7 +918,7 @@ int cachefiles_write_page(struct fscache_storage *op, struct page *page) + * own time */ + dget(object->backer); + mntget(cache->mnt); +- file = dentry_open(object->backer, cache->mnt, O_RDWR, ++ file = dentry_open(object->backer, cache->mnt, O_RDWR | O_LARGEFILE, + cache->cache_cred); + if (IS_ERR(file)) { + ret = PTR_ERR(file); +diff --git a/fs/direct-io.c b/fs/direct-io.c +index d740ab6..ac401d2 100644 +--- a/fs/direct-io.c ++++ b/fs/direct-io.c +@@ -304,9 +304,9 @@ static ssize_t dio_complete(struct dio *dio, loff_t offset, ssize_t ret, bool is + dio->end_io(dio->iocb, offset, transferred, + dio->private, ret, is_async); + } else { ++ inode_dio_done(dio->inode); + if (is_async) + aio_complete(dio->iocb, ret, 0); +- inode_dio_done(dio->inode); + } + + return ret; +diff --git a/fs/exec.c b/fs/exec.c +index c27fa0d..312e297 100644 +--- a/fs/exec.c ++++ b/fs/exec.c +@@ -1385,6 +1385,10 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs) + struct linux_binfmt *fmt; + pid_t old_pid; + ++ /* This allows 4 levels of binfmt rewrites before failing hard. */ ++ if (depth > 5) ++ return -ELOOP; ++ + retval = security_bprm_check(bprm); + if (retval) + return retval; +@@ -1408,12 +1412,8 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs) + if (!try_module_get(fmt->module)) + continue; + read_unlock(&binfmt_lock); ++ bprm->recursion_depth = depth + 1; + retval = fn(bprm, regs); +- /* +- * Restore the depth counter to its starting value +- * in this call, so we don't have to rely on every +- * load_binary function to restore it on return. +- */ + bprm->recursion_depth = depth; + if (retval >= 0) { + if (depth == 0) +diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c +index d6970f7..484ffee 100644 +--- a/fs/ext4/balloc.c ++++ b/fs/ext4/balloc.c +@@ -420,11 +420,16 @@ static int ext4_has_free_clusters(struct ext4_sb_info *sbi, + + free_clusters = percpu_counter_read_positive(fcc); + dirty_clusters = percpu_counter_read_positive(dcc); +- root_clusters = EXT4_B2C(sbi, ext4_r_blocks_count(sbi->s_es)); ++ ++ /* ++ * r_blocks_count should always be multiple of the cluster ratio so ++ * we are safe to do a plane bit shift only. ++ */ ++ root_clusters = ext4_r_blocks_count(sbi->s_es) >> sbi->s_cluster_bits; + + if (free_clusters - (nclusters + root_clusters + dirty_clusters) < + EXT4_FREECLUSTERS_WATERMARK) { +- free_clusters = EXT4_C2B(sbi, percpu_counter_sum_positive(fcc)); ++ free_clusters = percpu_counter_sum_positive(fcc); + dirty_clusters = percpu_counter_sum_positive(dcc); + } + /* Check whether we have space after accounting for current +diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c +index fbb92e6..b48e0dc 100644 +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -45,6 +45,17 @@ + + #include <trace/events/ext4.h> + ++/* ++ * used by extent splitting. ++ */ ++#define EXT4_EXT_MAY_ZEROOUT 0x1 /* safe to zeroout if split fails \ ++ due to ENOSPC */ ++#define EXT4_EXT_MARK_UNINIT1 0x2 /* mark first half uninitialized */ ++#define EXT4_EXT_MARK_UNINIT2 0x4 /* mark second half uninitialized */ ++ ++#define EXT4_EXT_DATA_VALID1 0x8 /* first half contains valid data */ ++#define EXT4_EXT_DATA_VALID2 0x10 /* second half contains valid data */ ++ + static int ext4_split_extent(handle_t *handle, + struct inode *inode, + struct ext4_ext_path *path, +@@ -52,6 +63,13 @@ static int ext4_split_extent(handle_t *handle, + int split_flag, + int flags); + ++static int ext4_split_extent_at(handle_t *handle, ++ struct inode *inode, ++ struct ext4_ext_path *path, ++ ext4_lblk_t split, ++ int split_flag, ++ int flags); ++ + static int ext4_ext_truncate_extend_restart(handle_t *handle, + struct inode *inode, + int needed) +@@ -636,6 +654,7 @@ ext4_ext_find_extent(struct inode *inode, ext4_lblk_t block, + struct ext4_extent_header *eh; + struct buffer_head *bh; + short int depth, i, ppos = 0, alloc = 0; ++ int ret; + + eh = ext_inode_hdr(inode); + depth = ext_depth(inode); +@@ -665,12 +684,15 @@ ext4_ext_find_extent(struct inode *inode, ext4_lblk_t block, + path[ppos].p_ext = NULL; + + bh = sb_getblk(inode->i_sb, path[ppos].p_block); +- if (unlikely(!bh)) ++ if (unlikely(!bh)) { ++ ret = -ENOMEM; + goto err; ++ } + if (!bh_uptodate_or_lock(bh)) { + trace_ext4_ext_load_extent(inode, block, + path[ppos].p_block); +- if (bh_submit_read(bh) < 0) { ++ ret = bh_submit_read(bh); ++ if (ret < 0) { + put_bh(bh); + goto err; + } +@@ -683,13 +705,15 @@ ext4_ext_find_extent(struct inode *inode, ext4_lblk_t block, + put_bh(bh); + EXT4_ERROR_INODE(inode, + "ppos %d > depth %d", ppos, depth); ++ ret = -EIO; + goto err; + } + path[ppos].p_bh = bh; + path[ppos].p_hdr = eh; + i--; + +- if (need_to_validate && ext4_ext_check(inode, eh, i)) ++ ret = need_to_validate ? ext4_ext_check(inode, eh, i) : 0; ++ if (ret < 0) + goto err; + } + +@@ -711,7 +735,7 @@ err: + ext4_ext_drop_refs(path); + if (alloc) + kfree(path); +- return ERR_PTR(-EIO); ++ return ERR_PTR(ret); + } + + /* +@@ -866,7 +890,7 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode, + } + bh = sb_getblk(inode->i_sb, newblock); + if (!bh) { +- err = -EIO; ++ err = -ENOMEM; + goto cleanup; + } + lock_buffer(bh); +@@ -938,7 +962,7 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode, + newblock = ablocks[--a]; + bh = sb_getblk(inode->i_sb, newblock); + if (!bh) { +- err = -EIO; ++ err = -ENOMEM; + goto cleanup; + } + lock_buffer(bh); +@@ -1049,11 +1073,8 @@ static int ext4_ext_grow_indepth(handle_t *handle, struct inode *inode, + return err; + + bh = sb_getblk(inode->i_sb, newblock); +- if (!bh) { +- err = -EIO; +- ext4_std_error(inode->i_sb, err); +- return err; +- } ++ if (!bh) ++ return -ENOMEM; + lock_buffer(bh); + + err = ext4_journal_get_create_access(handle, bh); +@@ -2321,7 +2342,7 @@ ext4_ext_rm_leaf(handle_t *handle, struct inode *inode, + struct ext4_extent *ex; + + /* the header must be checked already in ext4_ext_remove_space() */ +- ext_debug("truncate since %u in leaf\n", start); ++ ext_debug("truncate since %u in leaf to %u\n", start, end); + if (!path[depth].p_hdr) + path[depth].p_hdr = ext_block_hdr(path[depth].p_bh); + eh = path[depth].p_hdr; +@@ -2356,7 +2377,7 @@ ext4_ext_rm_leaf(handle_t *handle, struct inode *inode, + ext_debug(" border %u:%u\n", a, b); + + /* If this extent is beyond the end of the hole, skip it */ +- if (end <= ex_ee_block) { ++ if (end < ex_ee_block) { + ex--; + ex_ee_block = le32_to_cpu(ex->ee_block); + ex_ee_len = ext4_ext_get_actual_len(ex); +@@ -2495,16 +2516,17 @@ ext4_ext_more_to_rm(struct ext4_ext_path *path) + return 1; + } + +-static int ext4_ext_remove_space(struct inode *inode, ext4_lblk_t start) ++static int ext4_ext_remove_space(struct inode *inode, ext4_lblk_t start, ++ ext4_lblk_t end) + { + struct super_block *sb = inode->i_sb; + int depth = ext_depth(inode); +- struct ext4_ext_path *path; ++ struct ext4_ext_path *path = NULL; + ext4_fsblk_t partial_cluster = 0; + handle_t *handle; +- int i, err; ++ int i = 0, err; + +- ext_debug("truncate since %u\n", start); ++ ext_debug("truncate since %u to %u\n", start, end); + + /* probably first extent we're gonna free will be last in block */ + handle = ext4_journal_start(inode, depth + 1); +@@ -2517,29 +2539,96 @@ again: + trace_ext4_ext_remove_space(inode, start, depth); + + /* ++ * Check if we are removing extents inside the extent tree. If that ++ * is the case, we are going to punch a hole inside the extent tree ++ * so we have to check whether we need to split the extent covering ++ * the last block to remove so we can easily remove the part of it ++ * in ext4_ext_rm_leaf(). ++ */ ++ if (end < EXT_MAX_BLOCKS - 1) { ++ struct ext4_extent *ex; ++ ext4_lblk_t ee_block; ++ ++ /* find extent for this block */ ++ path = ext4_ext_find_extent(inode, end, NULL); ++ if (IS_ERR(path)) { ++ ext4_journal_stop(handle); ++ return PTR_ERR(path); ++ } ++ depth = ext_depth(inode); ++ ex = path[depth].p_ext; ++ if (!ex) { ++ ext4_ext_drop_refs(path); ++ kfree(path); ++ path = NULL; ++ goto cont; ++ } ++ ++ ee_block = le32_to_cpu(ex->ee_block); ++ ++ /* ++ * See if the last block is inside the extent, if so split ++ * the extent at 'end' block so we can easily remove the ++ * tail of the first part of the split extent in ++ * ext4_ext_rm_leaf(). ++ */ ++ if (end >= ee_block && ++ end < ee_block + ext4_ext_get_actual_len(ex) - 1) { ++ int split_flag = 0; ++ ++ if (ext4_ext_is_uninitialized(ex)) ++ split_flag = EXT4_EXT_MARK_UNINIT1 | ++ EXT4_EXT_MARK_UNINIT2; ++ ++ /* ++ * Split the extent in two so that 'end' is the last ++ * block in the first new extent ++ */ ++ err = ext4_split_extent_at(handle, inode, path, ++ end + 1, split_flag, ++ EXT4_GET_BLOCKS_PRE_IO | ++ EXT4_GET_BLOCKS_PUNCH_OUT_EXT); ++ ++ if (err < 0) ++ goto out; ++ } ++ } ++cont: ++ ++ /* + * We start scanning from right side, freeing all the blocks + * after i_size and walking into the tree depth-wise. + */ + depth = ext_depth(inode); +- path = kzalloc(sizeof(struct ext4_ext_path) * (depth + 1), GFP_NOFS); +- if (path == NULL) { +- ext4_journal_stop(handle); +- return -ENOMEM; +- } +- path[0].p_depth = depth; +- path[0].p_hdr = ext_inode_hdr(inode); +- if (ext4_ext_check(inode, path[0].p_hdr, depth)) { +- err = -EIO; +- goto out; ++ if (path) { ++ int k = i = depth; ++ while (--k > 0) ++ path[k].p_block = ++ le16_to_cpu(path[k].p_hdr->eh_entries)+1; ++ } else { ++ path = kzalloc(sizeof(struct ext4_ext_path) * (depth + 1), ++ GFP_NOFS); ++ if (path == NULL) { ++ ext4_journal_stop(handle); ++ return -ENOMEM; ++ } ++ path[0].p_depth = depth; ++ path[0].p_hdr = ext_inode_hdr(inode); ++ i = 0; ++ ++ if (ext4_ext_check(inode, path[0].p_hdr, depth)) { ++ err = -EIO; ++ goto out; ++ } + } +- i = err = 0; ++ err = 0; + + while (i >= 0 && err == 0) { + if (i == depth) { + /* this is leaf block */ + err = ext4_ext_rm_leaf(handle, inode, path, + &partial_cluster, start, +- EXT_MAX_BLOCKS - 1); ++ end); + /* root level has p_bh == NULL, brelse() eats this */ + brelse(path[i].p_bh); + path[i].p_bh = NULL; +@@ -2646,8 +2735,10 @@ again: + out: + ext4_ext_drop_refs(path); + kfree(path); +- if (err == -EAGAIN) ++ if (err == -EAGAIN) { ++ path = NULL; + goto again; ++ } + ext4_journal_stop(handle); + + return err; +@@ -2722,17 +2813,6 @@ static int ext4_ext_zeroout(struct inode *inode, struct ext4_extent *ex) + } + + /* +- * used by extent splitting. +- */ +-#define EXT4_EXT_MAY_ZEROOUT 0x1 /* safe to zeroout if split fails \ +- due to ENOSPC */ +-#define EXT4_EXT_MARK_UNINIT1 0x2 /* mark first half uninitialized */ +-#define EXT4_EXT_MARK_UNINIT2 0x4 /* mark second half uninitialized */ +- +-#define EXT4_EXT_DATA_VALID1 0x8 /* first half contains valid data */ +-#define EXT4_EXT_DATA_VALID2 0x10 /* second half contains valid data */ +- +-/* + * ext4_split_extent_at() splits an extent at given block. + * + * @handle: the journal handle +@@ -4274,7 +4354,7 @@ void ext4_ext_truncate(struct inode *inode) + + last_block = (inode->i_size + sb->s_blocksize - 1) + >> EXT4_BLOCK_SIZE_BITS(sb); +- err = ext4_ext_remove_space(inode, last_block); ++ err = ext4_ext_remove_space(inode, last_block, EXT_MAX_BLOCKS - 1); + + /* In a multi-transaction truncate, we only make the final + * transaction synchronous. +@@ -4751,14 +4831,12 @@ int ext4_ext_punch_hole(struct file *file, loff_t offset, loff_t length) + { + struct inode *inode = file->f_path.dentry->d_inode; + struct super_block *sb = inode->i_sb; +- struct ext4_ext_cache cache_ex; +- ext4_lblk_t first_block, last_block, num_blocks, iblock, max_blocks; ++ ext4_lblk_t first_block, stop_block; + struct address_space *mapping = inode->i_mapping; +- struct ext4_map_blocks map; + handle_t *handle; + loff_t first_page, last_page, page_len; + loff_t first_page_offset, last_page_offset; +- int ret, credits, blocks_released, err = 0; ++ int credits, err = 0; + + /* No need to punch hole beyond i_size */ + if (offset >= inode->i_size) +@@ -4774,10 +4852,6 @@ int ext4_ext_punch_hole(struct file *file, loff_t offset, loff_t length) + offset; + } + +- first_block = (offset + sb->s_blocksize - 1) >> +- EXT4_BLOCK_SIZE_BITS(sb); +- last_block = (offset + length) >> EXT4_BLOCK_SIZE_BITS(sb); +- + first_page = (offset + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT; + last_page = (offset + length) >> PAGE_CACHE_SHIFT; + +@@ -4856,7 +4930,6 @@ int ext4_ext_punch_hole(struct file *file, loff_t offset, loff_t length) + } + } + +- + /* + * If i_size is contained in the last page, we need to + * unmap and zero the partial page after i_size +@@ -4876,73 +4949,22 @@ int ext4_ext_punch_hole(struct file *file, loff_t offset, loff_t length) + } + } + ++ first_block = (offset + sb->s_blocksize - 1) >> ++ EXT4_BLOCK_SIZE_BITS(sb); ++ stop_block = (offset + length) >> EXT4_BLOCK_SIZE_BITS(sb); ++ + /* If there are no blocks to remove, return now */ +- if (first_block >= last_block) ++ if (first_block >= stop_block) + goto out; + + down_write(&EXT4_I(inode)->i_data_sem); + ext4_ext_invalidate_cache(inode); + ext4_discard_preallocations(inode); + +- /* +- * Loop over all the blocks and identify blocks +- * that need to be punched out +- */ +- iblock = first_block; +- blocks_released = 0; +- while (iblock < last_block) { +- max_blocks = last_block - iblock; +- num_blocks = 1; +- memset(&map, 0, sizeof(map)); +- map.m_lblk = iblock; +- map.m_len = max_blocks; +- ret = ext4_ext_map_blocks(handle, inode, &map, +- EXT4_GET_BLOCKS_PUNCH_OUT_EXT); +- +- if (ret > 0) { +- blocks_released += ret; +- num_blocks = ret; +- } else if (ret == 0) { +- /* +- * If map blocks could not find the block, +- * then it is in a hole. If the hole was +- * not already cached, then map blocks should +- * put it in the cache. So we can get the hole +- * out of the cache +- */ +- memset(&cache_ex, 0, sizeof(cache_ex)); +- if ((ext4_ext_check_cache(inode, iblock, &cache_ex)) && +- !cache_ex.ec_start) { +- +- /* The hole is cached */ +- num_blocks = cache_ex.ec_block + +- cache_ex.ec_len - iblock; ++ err = ext4_ext_remove_space(inode, first_block, stop_block - 1); + +- } else { +- /* The block could not be identified */ +- err = -EIO; +- break; +- } +- } else { +- /* Map blocks error */ +- err = ret; +- break; +- } +- +- if (num_blocks == 0) { +- /* This condition should never happen */ +- ext_debug("Block lookup failed"); +- err = -EIO; +- break; +- } +- +- iblock += num_blocks; +- } +- +- if (blocks_released > 0) { +- ext4_ext_invalidate_cache(inode); +- ext4_discard_preallocations(inode); +- } ++ ext4_ext_invalidate_cache(inode); ++ ext4_discard_preallocations(inode); + + if (IS_SYNC(inode)) + ext4_handle_sync(handle); +diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c +index 3cfc73f..26d6dbf 100644 +--- a/fs/ext4/indirect.c ++++ b/fs/ext4/indirect.c +@@ -146,6 +146,7 @@ static Indirect *ext4_get_branch(struct inode *inode, int depth, + struct super_block *sb = inode->i_sb; + Indirect *p = chain; + struct buffer_head *bh; ++ int ret = -EIO; + + *err = 0; + /* i_data is not going away, no lock needed */ +@@ -154,8 +155,10 @@ static Indirect *ext4_get_branch(struct inode *inode, int depth, + goto no_block; + while (--depth) { + bh = sb_getblk(sb, le32_to_cpu(p->key)); +- if (unlikely(!bh)) ++ if (unlikely(!bh)) { ++ ret = -ENOMEM; + goto failure; ++ } + + if (!bh_uptodate_or_lock(bh)) { + if (bh_submit_read(bh) < 0) { +@@ -177,7 +180,7 @@ static Indirect *ext4_get_branch(struct inode *inode, int depth, + return NULL; + + failure: +- *err = -EIO; ++ *err = ret; + no_block: + return p; + } +@@ -471,7 +474,7 @@ static int ext4_alloc_branch(handle_t *handle, struct inode *inode, + */ + bh = sb_getblk(inode->i_sb, new_blocks[n-1]); + if (unlikely(!bh)) { +- err = -EIO; ++ err = -ENOMEM; + goto failed; + } + +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index 8424dda..4b2bb75 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -661,7 +661,7 @@ struct buffer_head *ext4_getblk(handle_t *handle, struct inode *inode, + + bh = sb_getblk(inode->i_sb, map.m_pblk); + if (!bh) { +- *errp = -EIO; ++ *errp = -ENOMEM; + return NULL; + } + if (map.m_flags & EXT4_MAP_NEW) { +@@ -2795,9 +2795,9 @@ static void ext4_end_io_dio(struct kiocb *iocb, loff_t offset, + if (!(io_end->flag & EXT4_IO_END_UNWRITTEN)) { + ext4_free_io_end(io_end); + out: ++ inode_dio_done(inode); + if (is_async) + aio_complete(iocb, ret, 0); +- inode_dio_done(inode); + return; + } + +@@ -3575,11 +3575,8 @@ static int __ext4_get_inode_loc(struct inode *inode, + iloc->offset = (inode_offset % inodes_per_block) * EXT4_INODE_SIZE(sb); + + bh = sb_getblk(sb, block); +- if (!bh) { +- EXT4_ERROR_INODE_BLOCK(inode, block, +- "unable to read itable block"); +- return -EIO; +- } ++ if (!bh) ++ return -ENOMEM; + if (!buffer_uptodate(bh)) { + lock_buffer(bh); + +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index 1d07c12..553ff71 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -4178,7 +4178,7 @@ static void ext4_mb_add_n_trim(struct ext4_allocation_context *ac) + /* The max size of hash table is PREALLOC_TB_SIZE */ + order = PREALLOC_TB_SIZE - 1; + /* Add the prealloc space to lg */ +- rcu_read_lock(); ++ spin_lock(&lg->lg_prealloc_lock); + list_for_each_entry_rcu(tmp_pa, &lg->lg_prealloc_list[order], + pa_inode_list) { + spin_lock(&tmp_pa->pa_lock); +@@ -4202,12 +4202,12 @@ static void ext4_mb_add_n_trim(struct ext4_allocation_context *ac) + if (!added) + list_add_tail_rcu(&pa->pa_inode_list, + &lg->lg_prealloc_list[order]); +- rcu_read_unlock(); ++ spin_unlock(&lg->lg_prealloc_lock); + + /* Now trim the list to be not more than 8 elements */ + if (lg_prealloc_count > 8) { + ext4_mb_discard_lg_preallocations(sb, lg, +- order, lg_prealloc_count); ++ order, lg_prealloc_count); + return; + } + return ; +diff --git a/fs/ext4/mmp.c b/fs/ext4/mmp.c +index 7ea4ba4..f3358ab 100644 +--- a/fs/ext4/mmp.c ++++ b/fs/ext4/mmp.c +@@ -41,6 +41,8 @@ static int read_mmp_block(struct super_block *sb, struct buffer_head **bh, + * is not blocked in the elevator. */ + if (!*bh) + *bh = sb_getblk(sb, mmp_block); ++ if (!*bh) ++ return -ENOMEM; + if (*bh) { + get_bh(*bh); + lock_buffer(*bh); +diff --git a/fs/ext4/page-io.c b/fs/ext4/page-io.c +index 24feb1c..54f566d 100644 +--- a/fs/ext4/page-io.c ++++ b/fs/ext4/page-io.c +@@ -108,14 +108,13 @@ int ext4_end_io_nolock(ext4_io_end_t *io) + inode->i_ino, offset, size, ret); + } + +- if (io->iocb) +- aio_complete(io->iocb, io->result, 0); +- +- if (io->flag & EXT4_IO_END_DIRECT) +- inode_dio_done(inode); + /* Wake up anyone waiting on unwritten extent conversion */ + if (atomic_dec_and_test(&EXT4_I(inode)->i_aiodio_unwritten)) + wake_up_all(ext4_ioend_wq(io->inode)); ++ if (io->flag & EXT4_IO_END_DIRECT) ++ inode_dio_done(inode); ++ if (io->iocb) ++ aio_complete(io->iocb, io->result, 0); + return ret; + } + +diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c +index 4eac337..33129c0 100644 +--- a/fs/ext4/resize.c ++++ b/fs/ext4/resize.c +@@ -142,7 +142,7 @@ static struct buffer_head *bclean(handle_t *handle, struct super_block *sb, + + bh = sb_getblk(sb, blk); + if (!bh) +- return ERR_PTR(-EIO); ++ return ERR_PTR(-ENOMEM); + if ((err = ext4_journal_get_write_access(handle, bh))) { + brelse(bh); + bh = ERR_PTR(err); +@@ -220,7 +220,7 @@ static int setup_new_group_blocks(struct super_block *sb, + + gdb = sb_getblk(sb, block); + if (!gdb) { +- err = -EIO; ++ err = -ENOMEM; + goto exit_journal; + } + if ((err = ext4_journal_get_write_access(handle, gdb))) { +@@ -694,7 +694,7 @@ static void update_backups(struct super_block *sb, + + bh = sb_getblk(sb, group * bpg + blk_off); + if (!bh) { +- err = -EIO; ++ err = -ENOMEM; + break; + } + ext4_debug("update metadata backup %#04lx\n", +diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c +index 4410ae7..d5498b2 100644 +--- a/fs/ext4/xattr.c ++++ b/fs/ext4/xattr.c +@@ -496,7 +496,7 @@ ext4_xattr_release_block(handle_t *handle, struct inode *inode, + error = ext4_handle_dirty_metadata(handle, inode, bh); + if (IS_SYNC(inode)) + ext4_handle_sync(handle); +- dquot_free_block(inode, 1); ++ dquot_free_block(inode, EXT4_C2B(EXT4_SB(inode->i_sb), 1)); + ea_bdebug(bh, "refcount now=%d; releasing", + le32_to_cpu(BHDR(bh)->h_refcount)); + } +@@ -785,7 +785,8 @@ inserted: + else { + /* The old block is released after updating + the inode. */ +- error = dquot_alloc_block(inode, 1); ++ error = dquot_alloc_block(inode, ++ EXT4_C2B(EXT4_SB(sb), 1)); + if (error) + goto cleanup; + error = ext4_journal_get_write_access(handle, +@@ -839,16 +840,17 @@ inserted: + + new_bh = sb_getblk(sb, block); + if (!new_bh) { ++ error = -ENOMEM; + getblk_failed: + ext4_free_blocks(handle, inode, NULL, block, 1, + EXT4_FREE_BLOCKS_METADATA); +- error = -EIO; + goto cleanup; + } + lock_buffer(new_bh); + error = ext4_journal_get_create_access(handle, new_bh); + if (error) { + unlock_buffer(new_bh); ++ error = -EIO; + goto getblk_failed; + } + memcpy(new_bh->b_data, s->base, new_bh->b_size); +@@ -880,7 +882,7 @@ cleanup: + return error; + + cleanup_dquot: +- dquot_free_block(inode, 1); ++ dquot_free_block(inode, EXT4_C2B(EXT4_SB(sb), 1)); + goto cleanup; + + bad_block: +diff --git a/fs/lockd/clntproc.c b/fs/lockd/clntproc.c +index 8392cb8..a3a0987 100644 +--- a/fs/lockd/clntproc.c ++++ b/fs/lockd/clntproc.c +@@ -551,6 +551,9 @@ again: + status = nlmclnt_block(block, req, NLMCLNT_POLL_TIMEOUT); + if (status < 0) + break; ++ /* Resend the blocking lock request after a server reboot */ ++ if (resp->status == nlm_lck_denied_grace_period) ++ continue; + if (resp->status != nlm_lck_blocked) + break; + } +diff --git a/fs/nfs/blocklayout/blocklayout.c b/fs/nfs/blocklayout/blocklayout.c +index 1aaa0ee..b17a81c 100644 +--- a/fs/nfs/blocklayout/blocklayout.c ++++ b/fs/nfs/blocklayout/blocklayout.c +@@ -1101,6 +1101,7 @@ static const struct nfs_pageio_ops bl_pg_write_ops = { + static struct pnfs_layoutdriver_type blocklayout_type = { + .id = LAYOUT_BLOCK_VOLUME, + .name = "LAYOUT_BLOCK_VOLUME", ++ .owner = THIS_MODULE, + .read_pagelist = bl_read_pagelist, + .write_pagelist = bl_write_pagelist, + .alloc_layout_hdr = bl_alloc_layout_hdr, +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 2f98c53..6d7c53d 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -5891,7 +5891,8 @@ int nfs4_proc_layoutget(struct nfs4_layoutget *lgp, gfp_t gfp_flags) + status = nfs4_wait_for_completion_rpc_task(task); + if (status == 0) + status = task->tk_status; +- if (status == 0) ++ /* if layoutp->len is 0, nfs4_layoutget_prepare called rpc_exit */ ++ if (status == 0 && lgp->res.layoutp->len) + status = pnfs_layout_process(lgp); + rpc_put_task(task); + dprintk("<-- %s status=%d\n", __func__, status); +diff --git a/fs/nfs/objlayout/objio_osd.c b/fs/nfs/objlayout/objio_osd.c +index a03ee52..c1897f7 100644 +--- a/fs/nfs/objlayout/objio_osd.c ++++ b/fs/nfs/objlayout/objio_osd.c +@@ -569,6 +569,7 @@ static struct pnfs_layoutdriver_type objlayout_type = { + .flags = PNFS_LAYOUTRET_ON_SETATTR | + PNFS_LAYOUTRET_ON_ERROR, + ++ .owner = THIS_MODULE, + .alloc_layout_hdr = objlayout_alloc_layout_hdr, + .free_layout_hdr = objlayout_free_layout_hdr, + +diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c +index 8b197d2..7d189dc 100644 +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -1009,6 +1009,8 @@ free_client(struct nfs4_client *clp) + put_group_info(clp->cl_cred.cr_group_info); + kfree(clp->cl_principal); + kfree(clp->cl_name.data); ++ idr_remove_all(&clp->cl_stateids); ++ idr_destroy(&clp->cl_stateids); + kfree(clp); + } + +diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c +index 8445fbc..6f292dd 100644 +--- a/fs/notify/inotify/inotify_user.c ++++ b/fs/notify/inotify/inotify_user.c +@@ -579,8 +579,6 @@ static int inotify_update_existing_watch(struct fsnotify_group *group, + + /* don't allow invalid bits: we don't want flags set */ + mask = inotify_arg_to_mask(arg); +- if (unlikely(!(mask & IN_ALL_EVENTS))) +- return -EINVAL; + + fsn_mark = fsnotify_find_inode_mark(group, inode); + if (!fsn_mark) +@@ -632,8 +630,6 @@ static int inotify_new_watch(struct fsnotify_group *group, + + /* don't allow invalid bits: we don't want flags set */ + mask = inotify_arg_to_mask(arg); +- if (unlikely(!(mask & IN_ALL_EVENTS))) +- return -EINVAL; + + tmp_i_mark = kmem_cache_alloc(inotify_inode_mark_cachep, GFP_KERNEL); + if (unlikely(!tmp_i_mark)) +diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c +index 78b68af..4402b18 100644 +--- a/fs/ocfs2/aops.c ++++ b/fs/ocfs2/aops.c +@@ -593,9 +593,9 @@ static void ocfs2_dio_end_io(struct kiocb *iocb, + level = ocfs2_iocb_rw_locked_level(iocb); + ocfs2_rw_unlock(inode, level); + ++ inode_dio_done(inode); + if (is_async) + aio_complete(iocb, ret, 0); +- inode_dio_done(inode); + } + + /* +diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c +index 81a4cd2..231eab2 100644 +--- a/fs/ocfs2/dlmglue.c ++++ b/fs/ocfs2/dlmglue.c +@@ -2545,6 +2545,7 @@ int ocfs2_super_lock(struct ocfs2_super *osb, + * everything is up to the caller :) */ + status = ocfs2_should_refresh_lock_res(lockres); + if (status < 0) { ++ ocfs2_cluster_unlock(osb, lockres, level); + mlog_errno(status); + goto bail; + } +@@ -2553,8 +2554,10 @@ int ocfs2_super_lock(struct ocfs2_super *osb, + + ocfs2_complete_lock_res_refresh(lockres, status); + +- if (status < 0) ++ if (status < 0) { ++ ocfs2_cluster_unlock(osb, lockres, level); + mlog_errno(status); ++ } + ocfs2_track_lock_refresh(lockres); + } + bail: +diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c +index f169da4..b7e74b5 100644 +--- a/fs/ocfs2/suballoc.c ++++ b/fs/ocfs2/suballoc.c +@@ -642,7 +642,7 @@ ocfs2_block_group_alloc_discontig(handle_t *handle, + * cluster groups will be staying in cache for the duration of + * this operation. + */ +- ac->ac_allow_chain_relink = 0; ++ ac->ac_disable_chain_relink = 1; + + /* Claim the first region */ + status = ocfs2_block_group_claim_bits(osb, handle, ac, min_bits, +@@ -1823,7 +1823,7 @@ static int ocfs2_search_chain(struct ocfs2_alloc_context *ac, + * Do this *after* figuring out how many bits we're taking out + * of our target group. + */ +- if (ac->ac_allow_chain_relink && ++ if (!ac->ac_disable_chain_relink && + (prev_group_bh) && + (ocfs2_block_group_reasonably_empty(bg, res->sr_bits))) { + status = ocfs2_relink_block_group(handle, alloc_inode, +@@ -1928,7 +1928,6 @@ static int ocfs2_claim_suballoc_bits(struct ocfs2_alloc_context *ac, + + victim = ocfs2_find_victim_chain(cl); + ac->ac_chain = victim; +- ac->ac_allow_chain_relink = 1; + + status = ocfs2_search_chain(ac, handle, bits_wanted, min_bits, + res, &bits_left); +@@ -1947,7 +1946,7 @@ static int ocfs2_claim_suballoc_bits(struct ocfs2_alloc_context *ac, + * searching each chain in order. Don't allow chain relinking + * because we only calculate enough journal credits for one + * relink per alloc. */ +- ac->ac_allow_chain_relink = 0; ++ ac->ac_disable_chain_relink = 1; + for (i = 0; i < le16_to_cpu(cl->cl_next_free_rec); i ++) { + if (i == victim) + continue; +diff --git a/fs/ocfs2/suballoc.h b/fs/ocfs2/suballoc.h +index b8afabf..a36d0aa 100644 +--- a/fs/ocfs2/suballoc.h ++++ b/fs/ocfs2/suballoc.h +@@ -49,7 +49,7 @@ struct ocfs2_alloc_context { + + /* these are used by the chain search */ + u16 ac_chain; +- int ac_allow_chain_relink; ++ int ac_disable_chain_relink; + group_search_t *ac_group_search; + + u64 ac_last_group; +diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c +index aa9e877..0d5ea9c 100644 +--- a/fs/ocfs2/xattr.c ++++ b/fs/ocfs2/xattr.c +@@ -7189,7 +7189,7 @@ int ocfs2_init_security_and_acl(struct inode *dir, + struct buffer_head *dir_bh = NULL; + + ret = ocfs2_init_security_get(inode, dir, qstr, NULL); +- if (!ret) { ++ if (ret) { + mlog_errno(ret); + goto leave; + } +diff --git a/fs/partitions/check.c b/fs/partitions/check.c +index 6b5fcc5..1ef15cc 100644 +--- a/fs/partitions/check.c ++++ b/fs/partitions/check.c +@@ -399,11 +399,11 @@ void delete_partition(struct gendisk *disk, int partno) + if (!part) + return; + +- blk_free_devt(part_devt(part)); + rcu_assign_pointer(ptbl->part[partno], NULL); + rcu_assign_pointer(ptbl->last_lookup, NULL); + kobject_put(part->holder_dir); + device_del(part_to_dev(part)); ++ blk_free_devt(part_devt(part)); + + hd_struct_put(part); + } +diff --git a/fs/pstore/platform.c b/fs/pstore/platform.c +index 57bbf90..45d18d1 100644 +--- a/fs/pstore/platform.c ++++ b/fs/pstore/platform.c +@@ -72,6 +72,27 @@ static char *reason_str[] = { + "Oops", "Panic", "Kexec", "Restart", "Halt", "Poweroff", "Emergency" + }; + ++bool pstore_cannot_block_path(enum kmsg_dump_reason reason) ++{ ++ /* ++ * In case of NMI path, pstore shouldn't be blocked ++ * regardless of reason. ++ */ ++ if (in_nmi()) ++ return true; ++ ++ switch (reason) { ++ /* In panic case, other cpus are stopped by smp_send_stop(). */ ++ case KMSG_DUMP_PANIC: ++ /* Emergency restart shouldn't be blocked by spin lock. */ ++ case KMSG_DUMP_EMERG: ++ return true; ++ default: ++ return false; ++ } ++} ++EXPORT_SYMBOL_GPL(pstore_cannot_block_path); ++ + /* + * callback from kmsg_dump. (s2,l2) has the most recently + * written bytes, older bytes are in (s1,l1). Save as much +@@ -97,10 +118,12 @@ static void pstore_dump(struct kmsg_dumper *dumper, + else + why = "Unknown"; + +- if (in_nmi()) { +- is_locked = spin_trylock(&psinfo->buf_lock); +- if (!is_locked) +- pr_err("pstore dump routine blocked in NMI, may corrupt error record\n"); ++ if (pstore_cannot_block_path(reason)) { ++ is_locked = spin_trylock_irqsave(&psinfo->buf_lock, flags); ++ if (!is_locked) { ++ pr_err("pstore dump routine blocked in %s path, may corrupt error record\n" ++ , in_nmi() ? "NMI" : why); ++ } + } else + spin_lock_irqsave(&psinfo->buf_lock, flags); + oopscount++; +@@ -131,9 +154,9 @@ static void pstore_dump(struct kmsg_dumper *dumper, + total += l1_cpy + l2_cpy; + part++; + } +- if (in_nmi()) { ++ if (pstore_cannot_block_path(reason)) { + if (is_locked) +- spin_unlock(&psinfo->buf_lock); ++ spin_unlock_irqrestore(&psinfo->buf_lock, flags); + } else + spin_unlock_irqrestore(&psinfo->buf_lock, flags); + } +diff --git a/fs/ubifs/orphan.c b/fs/ubifs/orphan.c +index c542c73..f9c90b5 100644 +--- a/fs/ubifs/orphan.c ++++ b/fs/ubifs/orphan.c +@@ -130,13 +130,14 @@ void ubifs_delete_orphan(struct ubifs_info *c, ino_t inum) + else if (inum > o->inum) + p = p->rb_right; + else { +- if (o->dnext) { ++ if (o->del) { + spin_unlock(&c->orphan_lock); + dbg_gen("deleted twice ino %lu", + (unsigned long)inum); + return; + } + if (o->cnext) { ++ o->del = 1; + o->dnext = c->orph_dnext; + c->orph_dnext = o; + spin_unlock(&c->orphan_lock); +@@ -447,6 +448,7 @@ static void erase_deleted(struct ubifs_info *c) + orphan = dnext; + dnext = orphan->dnext; + ubifs_assert(!orphan->new); ++ ubifs_assert(orphan->del); + rb_erase(&orphan->rb, &c->orph_tree); + list_del(&orphan->list); + c->tot_orphans -= 1; +@@ -536,6 +538,7 @@ static int insert_dead_orphan(struct ubifs_info *c, ino_t inum) + rb_link_node(&orphan->rb, parent, p); + rb_insert_color(&orphan->rb, &c->orph_tree); + list_add_tail(&orphan->list, &c->orph_list); ++ orphan->del = 1; + orphan->dnext = c->orph_dnext; + c->orph_dnext = orphan; + dbg_mnt("ino %lu, new %d, tot %d", (unsigned long)inum, +diff --git a/fs/ubifs/ubifs.h b/fs/ubifs/ubifs.h +index 8bbc99e..a39fce5 100644 +--- a/fs/ubifs/ubifs.h ++++ b/fs/ubifs/ubifs.h +@@ -908,6 +908,7 @@ struct ubifs_budget_req { + * @dnext: next orphan to delete + * @inum: inode number + * @new: %1 => added since the last commit, otherwise %0 ++ * @del: %1 => delete pending, otherwise %0 + */ + struct ubifs_orphan { + struct rb_node rb; +@@ -917,6 +918,7 @@ struct ubifs_orphan { + struct ubifs_orphan *dnext; + ino_t inum; + int new; ++ unsigned del:1; + }; + + /** +diff --git a/include/linux/auto_fs.h b/include/linux/auto_fs.h +index da64e15..6cdabb4 100644 +--- a/include/linux/auto_fs.h ++++ b/include/linux/auto_fs.h +@@ -31,25 +31,16 @@ + #define AUTOFS_MIN_PROTO_VERSION AUTOFS_PROTO_VERSION + + /* +- * Architectures where both 32- and 64-bit binaries can be executed +- * on 64-bit kernels need this. This keeps the structure format +- * uniform, and makes sure the wait_queue_token isn't too big to be +- * passed back down to the kernel. +- * +- * This assumes that on these architectures: +- * mode 32 bit 64 bit +- * ------------------------- +- * int 32 bit 32 bit +- * long 32 bit 64 bit +- * +- * If so, 32-bit user-space code should be backwards compatible. ++ * The wait_queue_token (autofs_wqt_t) is part of a structure which is passed ++ * back to the kernel via ioctl from userspace. On architectures where 32- and ++ * 64-bit userspace binaries can be executed it's important that the size of ++ * autofs_wqt_t stays constant between 32- and 64-bit Linux kernels so that we ++ * do not break the binary ABI interface by changing the structure size. + */ +- +-#if defined(__sparc__) || defined(__mips__) || defined(__x86_64__) \ +- || defined(__powerpc__) || defined(__s390__) +-typedef unsigned int autofs_wqt_t; +-#else ++#if defined(__ia64__) || defined(__alpha__) /* pure 64bit architectures */ + typedef unsigned long autofs_wqt_t; ++#else ++typedef unsigned int autofs_wqt_t; + #endif + + /* Packet types */ +diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h +index f606406..acd8d4b 100644 +--- a/include/linux/binfmts.h ++++ b/include/linux/binfmts.h +@@ -67,8 +67,6 @@ struct linux_binprm { + #define BINPRM_FLAGS_EXECFD_BIT 1 + #define BINPRM_FLAGS_EXECFD (1 << BINPRM_FLAGS_EXECFD_BIT) + +-#define BINPRM_MAX_RECURSION 4 +- + /* Function parameter for binfmt->coredump */ + struct coredump_params { + long signr; +diff --git a/include/linux/console.h b/include/linux/console.h +index 7453cfd..6ae6a15 100644 +--- a/include/linux/console.h ++++ b/include/linux/console.h +@@ -77,7 +77,9 @@ extern const struct consw prom_con; /* SPARC PROM console */ + int con_is_bound(const struct consw *csw); + int register_con_driver(const struct consw *csw, int first, int last); + int unregister_con_driver(const struct consw *csw); ++int do_unregister_con_driver(const struct consw *csw); + int take_over_console(const struct consw *sw, int first, int last, int deflt); ++int do_take_over_console(const struct consw *sw, int first, int last, int deflt); + void give_up_console(const struct consw *sw); + #ifdef CONFIG_HW_CONSOLE + int con_debug_enter(struct vc_data *vc); +diff --git a/include/linux/fs.h b/include/linux/fs.h +index 29b6353..a276817 100644 +--- a/include/linux/fs.h ++++ b/include/linux/fs.h +@@ -2103,6 +2103,7 @@ extern void bd_forget(struct inode *inode); + extern void bdput(struct block_device *); + extern void invalidate_bdev(struct block_device *); + extern int sync_blockdev(struct block_device *bdev); ++extern void kill_bdev(struct block_device *); + extern struct super_block *freeze_bdev(struct block_device *); + extern void emergency_thaw_all(void); + extern int thaw_bdev(struct block_device *bdev, struct super_block *sb); +@@ -2110,6 +2111,7 @@ extern int fsync_bdev(struct block_device *); + #else + static inline void bd_forget(struct inode *inode) {} + static inline int sync_blockdev(struct block_device *bdev) { return 0; } ++static inline void kill_bdev(struct block_device *bdev) {} + static inline void invalidate_bdev(struct block_device *bdev) {} + + static inline struct super_block *freeze_bdev(struct block_device *sb) +diff --git a/include/linux/idr.h b/include/linux/idr.h +index 255491c..52a9da2 100644 +--- a/include/linux/idr.h ++++ b/include/linux/idr.h +@@ -152,4 +152,15 @@ void ida_simple_remove(struct ida *ida, unsigned int id); + + void __init idr_init_cache(void); + ++/** ++ * idr_for_each_entry - iterate over an idr's elements of a given type ++ * @idp: idr handle ++ * @entry: the type * to use as cursor ++ * @id: id entry's key ++ */ ++#define idr_for_each_entry(idp, entry, id) \ ++ for (id = 0, entry = (typeof(entry))idr_get_next((idp), &(id)); \ ++ entry != NULL; \ ++ ++id, entry = (typeof(entry))idr_get_next((idp), &(id))) ++ + #endif /* __IDR_H__ */ +diff --git a/include/linux/kmod.h b/include/linux/kmod.h +index b16f653..f8d4b27 100644 +--- a/include/linux/kmod.h ++++ b/include/linux/kmod.h +@@ -54,6 +54,8 @@ enum umh_wait { + UMH_WAIT_PROC = 1, /* wait for the process to complete */ + }; + ++#define UMH_KILLABLE 4 /* wait for EXEC/PROC killable */ ++ + struct subprocess_info { + struct work_struct work; + struct completion *complete; +diff --git a/include/linux/mmu_notifier.h b/include/linux/mmu_notifier.h +index 1d1b1e1..ee2baf0 100644 +--- a/include/linux/mmu_notifier.h ++++ b/include/linux/mmu_notifier.h +@@ -4,6 +4,7 @@ + #include <linux/list.h> + #include <linux/spinlock.h> + #include <linux/mm_types.h> ++#include <linux/srcu.h> + + struct mmu_notifier; + struct mmu_notifier_ops; +diff --git a/include/linux/pps_kernel.h b/include/linux/pps_kernel.h +index 9404854..ce2ab3d 100644 +--- a/include/linux/pps_kernel.h ++++ b/include/linux/pps_kernel.h +@@ -43,7 +43,7 @@ struct pps_source_info { + int event, void *data); /* PPS echo function */ + + struct module *owner; +- struct device *dev; ++ struct device *dev; /* Parent device for device_create */ + }; + + struct pps_event_time { +@@ -69,6 +69,7 @@ struct pps_device { + wait_queue_head_t queue; /* PPS event queue */ + + unsigned int id; /* PPS source unique ID */ ++ void const *lookup_cookie; /* pps_lookup_dev only */ + struct cdev cdev; + struct device *dev; + struct fasync_struct *async_queue; /* fasync method */ +@@ -82,16 +83,26 @@ struct pps_device { + extern struct device_attribute pps_attrs[]; + + /* ++ * Internal functions. ++ * ++ * These are not actually part of the exported API, but this is a ++ * convenient header file to put them in. ++ */ ++ ++extern int pps_register_cdev(struct pps_device *pps); ++extern void pps_unregister_cdev(struct pps_device *pps); ++ ++/* + * Exported functions + */ + + extern struct pps_device *pps_register_source( + struct pps_source_info *info, int default_params); + extern void pps_unregister_source(struct pps_device *pps); +-extern int pps_register_cdev(struct pps_device *pps); +-extern void pps_unregister_cdev(struct pps_device *pps); + extern void pps_event(struct pps_device *pps, + struct pps_event_time *ts, int event, void *data); ++/* Look up a pps device by magic cookie */ ++struct pps_device *pps_lookup_dev(void const *cookie); + + static inline void timespec_to_pps_ktime(struct pps_ktime *kt, + struct timespec ts) +diff --git a/include/linux/pstore.h b/include/linux/pstore.h +index 2ca8cde..9b16969 100644 +--- a/include/linux/pstore.h ++++ b/include/linux/pstore.h +@@ -22,6 +22,8 @@ + #ifndef _LINUX_PSTORE_H + #define _LINUX_PSTORE_H + ++#include <linux/kmsg_dump.h> ++ + /* types */ + enum pstore_type_id { + PSTORE_TYPE_DMESG = 0, +@@ -50,6 +52,7 @@ struct pstore_info { + + #ifdef CONFIG_PSTORE + extern int pstore_register(struct pstore_info *); ++extern bool pstore_cannot_block_path(enum kmsg_dump_reason reason); + extern int pstore_write(enum pstore_type_id type, char *buf, size_t size); + #else + static inline int +@@ -57,6 +60,11 @@ pstore_register(struct pstore_info *psi) + { + return -ENODEV; + } ++static inline bool ++pstore_cannot_block_path(enum kmsg_dump_reason reason) ++{ ++ return false; ++} + static inline int + pstore_write(enum pstore_type_id type, char *buf, size_t size) + { +diff --git a/include/linux/quota.h b/include/linux/quota.h +index cb78556..1162580 100644 +--- a/include/linux/quota.h ++++ b/include/linux/quota.h +@@ -413,6 +413,7 @@ struct quota_module_name { + #define INIT_QUOTA_MODULE_NAMES {\ + {QFMT_VFS_OLD, "quota_v1"},\ + {QFMT_VFS_V0, "quota_v2"},\ ++ {QFMT_VFS_V1, "quota_v2"},\ + {0, NULL}} + + #endif /* __KERNEL__ */ +diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h +index 8bec265..bae516e 100644 +--- a/include/linux/serial_core.h ++++ b/include/linux/serial_core.h +@@ -47,8 +47,8 @@ + #define PORT_U6_16550A 19 /* ST-Ericsson U6xxx internal UART */ + #define PORT_TEGRA 20 /* NVIDIA Tegra internal UART */ + #define PORT_XR17D15X 21 /* Exar XR17D15x UART */ +-#define PORT_BRCM_TRUMANAGE 22 +-#define PORT_MAX_8250 22 /* max port ID */ ++#define PORT_BRCM_TRUMANAGE 25 ++#define PORT_MAX_8250 25 /* max port ID */ + + /* + * ARM specific type numbers. These are not currently guaranteed +diff --git a/include/linux/usb/audio.h b/include/linux/usb/audio.h +index a54b825..6f8b026 100644 +--- a/include/linux/usb/audio.h ++++ b/include/linux/usb/audio.h +@@ -384,14 +384,16 @@ static inline __u8 uac_processing_unit_iProcessing(struct uac_processing_unit_de + int protocol) + { + __u8 control_size = uac_processing_unit_bControlSize(desc, protocol); +- return desc->baSourceID[desc->bNrInPins + control_size]; ++ return *(uac_processing_unit_bmControls(desc, protocol) ++ + control_size); + } + + static inline __u8 *uac_processing_unit_specific(struct uac_processing_unit_descriptor *desc, + int protocol) + { + __u8 control_size = uac_processing_unit_bControlSize(desc, protocol); +- return &desc->baSourceID[desc->bNrInPins + control_size + 1]; ++ return uac_processing_unit_bmControls(desc, protocol) ++ + control_size + 1; + } + + /* 4.5.2 Class-Specific AS Interface Descriptor */ +diff --git a/include/linux/vt_kern.h b/include/linux/vt_kern.h +index c2164fa..644921f 100644 +--- a/include/linux/vt_kern.h ++++ b/include/linux/vt_kern.h +@@ -47,6 +47,7 @@ int con_set_cmap(unsigned char __user *cmap); + int con_get_cmap(unsigned char __user *cmap); + void scrollback(struct vc_data *vc, int lines); + void scrollfront(struct vc_data *vc, int lines); ++void clear_buffer_attributes(struct vc_data *vc); + void update_region(struct vc_data *vc, unsigned long start, int count); + void redraw_screen(struct vc_data *vc, int is_switch); + #define update_screen(x) redraw_screen(x, 0) +@@ -131,6 +132,8 @@ void vt_event_post(unsigned int event, unsigned int old, unsigned int new); + int vt_waitactive(int n); + void change_console(struct vc_data *new_vc); + void reset_vc(struct vc_data *vc); ++extern int do_unbind_con_driver(const struct consw *csw, int first, int last, ++ int deflt); + extern int unbind_con_driver(const struct consw *csw, int first, int last, + int deflt); + int vty_init(const struct file_operations *console_fops); +diff --git a/include/net/inet6_hashtables.h b/include/net/inet6_hashtables.h +index e46674d..f9ce2fa 100644 +--- a/include/net/inet6_hashtables.h ++++ b/include/net/inet6_hashtables.h +@@ -28,16 +28,16 @@ + + struct inet_hashinfo; + +-/* I have no idea if this is a good hash for v6 or not. -DaveM */ + static inline unsigned int inet6_ehashfn(struct net *net, + const struct in6_addr *laddr, const u16 lport, + const struct in6_addr *faddr, const __be16 fport) + { +- u32 ports = (lport ^ (__force u16)fport); ++ u32 ports = (((u32)lport) << 16) | (__force u32)fport; + + return jhash_3words((__force u32)laddr->s6_addr32[3], +- (__force u32)faddr->s6_addr32[3], +- ports, inet_ehash_secret + net_hash_mix(net)); ++ ipv6_addr_jhash(faddr), ++ ports, ++ inet_ehash_secret + net_hash_mix(net)); + } + + static inline int inet6_sk_ehashfn(const struct sock *sk) +diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h +index f941964..ee4ee91 100644 +--- a/include/net/inet_sock.h ++++ b/include/net/inet_sock.h +@@ -199,6 +199,7 @@ static inline void inet_sk_copy_descendant(struct sock *sk_to, + extern int inet_sk_rebuild_header(struct sock *sk); + + extern u32 inet_ehash_secret; ++extern u32 ipv6_hash_secret; + extern void build_ehash_secret(void); + + static inline unsigned int inet_ehashfn(struct net *net, +diff --git a/include/net/ipv6.h b/include/net/ipv6.h +index a366a8a..4d549cf 100644 +--- a/include/net/ipv6.h ++++ b/include/net/ipv6.h +@@ -15,6 +15,7 @@ + + #include <linux/ipv6.h> + #include <linux/hardirq.h> ++#include <linux/jhash.h> + #include <net/if_inet6.h> + #include <net/ndisc.h> + #include <net/flow.h> +@@ -386,6 +387,17 @@ struct ip6_create_arg { + void ip6_frag_init(struct inet_frag_queue *q, void *a); + int ip6_frag_match(struct inet_frag_queue *q, void *a); + ++/* more secured version of ipv6_addr_hash() */ ++static inline u32 ipv6_addr_jhash(const struct in6_addr *a) ++{ ++ u32 v = (__force u32)a->s6_addr32[0] ^ (__force u32)a->s6_addr32[1]; ++ ++ return jhash_3words(v, ++ (__force u32)a->s6_addr32[2], ++ (__force u32)a->s6_addr32[3], ++ ipv6_hash_secret); ++} ++ + static inline int ipv6_addr_any(const struct in6_addr *a) + { + return (a->s6_addr32[0] | a->s6_addr32[1] | +diff --git a/include/target/target_core_device.h b/include/target/target_core_device.h +index 2be31ff..6f30e70 100644 +--- a/include/target/target_core_device.h ++++ b/include/target/target_core_device.h +@@ -50,7 +50,7 @@ extern struct se_lun *core_dev_add_lun(struct se_portal_group *, struct se_hba * + extern int core_dev_del_lun(struct se_portal_group *, u32); + extern struct se_lun *core_get_lun_from_tpg(struct se_portal_group *, u32); + extern struct se_lun_acl *core_dev_init_initiator_node_lun_acl(struct se_portal_group *, +- u32, char *, int *); ++ struct se_node_acl *, u32, int *); + extern int core_dev_add_initiator_node_lun_acl(struct se_portal_group *, + struct se_lun_acl *, u32, u32); + extern int core_dev_del_initiator_node_lun_acl(struct se_portal_group *, +diff --git a/kernel/cgroup.c b/kernel/cgroup.c +index b6cacf1..c0739f8 100644 +--- a/kernel/cgroup.c ++++ b/kernel/cgroup.c +@@ -361,12 +361,20 @@ static void __put_css_set(struct css_set *cg, int taskexit) + struct cgroup *cgrp = link->cgrp; + list_del(&link->cg_link_list); + list_del(&link->cgrp_link_list); ++ ++ /* ++ * We may not be holding cgroup_mutex, and if cgrp->count is ++ * dropped to 0 the cgroup can be destroyed at any time, hence ++ * rcu_read_lock is used to keep it alive. ++ */ ++ rcu_read_lock(); + if (atomic_dec_and_test(&cgrp->count) && + notify_on_release(cgrp)) { + if (taskexit) + set_bit(CGRP_RELEASABLE, &cgrp->flags); + check_for_release(cgrp); + } ++ rcu_read_unlock(); + + kfree(link); + } +diff --git a/kernel/cpuset.c b/kernel/cpuset.c +index 84a524b..835eee6 100644 +--- a/kernel/cpuset.c ++++ b/kernel/cpuset.c +@@ -2507,8 +2507,16 @@ void cpuset_print_task_mems_allowed(struct task_struct *tsk) + + dentry = task_cs(tsk)->css.cgroup->dentry; + spin_lock(&cpuset_buffer_lock); +- snprintf(cpuset_name, CPUSET_NAME_LEN, +- dentry ? (const char *)dentry->d_name.name : "/"); ++ ++ if (!dentry) { ++ strcpy(cpuset_name, "/"); ++ } else { ++ spin_lock(&dentry->d_lock); ++ strlcpy(cpuset_name, (const char *)dentry->d_name.name, ++ CPUSET_NAME_LEN); ++ spin_unlock(&dentry->d_lock); ++ } ++ + nodelist_scnprintf(cpuset_nodelist, CPUSET_NODELIST_LEN, + tsk->mems_allowed); + printk(KERN_INFO "%s cpuset=%s mems_allowed=%s\n", +diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c +index 6db7a5e..cdd5607 100644 +--- a/kernel/hrtimer.c ++++ b/kernel/hrtimer.c +@@ -640,21 +640,9 @@ static inline void hrtimer_init_hres(struct hrtimer_cpu_base *base) + * and expiry check is done in the hrtimer_interrupt or in the softirq. + */ + static inline int hrtimer_enqueue_reprogram(struct hrtimer *timer, +- struct hrtimer_clock_base *base, +- int wakeup) ++ struct hrtimer_clock_base *base) + { +- if (base->cpu_base->hres_active && hrtimer_reprogram(timer, base)) { +- if (wakeup) { +- raw_spin_unlock(&base->cpu_base->lock); +- raise_softirq_irqoff(HRTIMER_SOFTIRQ); +- raw_spin_lock(&base->cpu_base->lock); +- } else +- __raise_softirq_irqoff(HRTIMER_SOFTIRQ); +- +- return 1; +- } +- +- return 0; ++ return base->cpu_base->hres_active && hrtimer_reprogram(timer, base); + } + + static inline ktime_t hrtimer_update_base(struct hrtimer_cpu_base *base) +@@ -735,8 +723,7 @@ static inline int hrtimer_switch_to_hres(void) { return 0; } + static inline void + hrtimer_force_reprogram(struct hrtimer_cpu_base *base, int skip_equal) { } + static inline int hrtimer_enqueue_reprogram(struct hrtimer *timer, +- struct hrtimer_clock_base *base, +- int wakeup) ++ struct hrtimer_clock_base *base) + { + return 0; + } +@@ -995,8 +982,21 @@ int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim, + * + * XXX send_remote_softirq() ? + */ +- if (leftmost && new_base->cpu_base == &__get_cpu_var(hrtimer_bases)) +- hrtimer_enqueue_reprogram(timer, new_base, wakeup); ++ if (leftmost && new_base->cpu_base == &__get_cpu_var(hrtimer_bases) ++ && hrtimer_enqueue_reprogram(timer, new_base)) { ++ if (wakeup) { ++ /* ++ * We need to drop cpu_base->lock to avoid a ++ * lock ordering issue vs. rq->lock. ++ */ ++ raw_spin_unlock(&new_base->cpu_base->lock); ++ raise_softirq_irqoff(HRTIMER_SOFTIRQ); ++ local_irq_restore(flags); ++ return ret; ++ } else { ++ __raise_softirq_irqoff(HRTIMER_SOFTIRQ); ++ } ++ } + + unlock_hrtimer_base(timer, &flags); + +diff --git a/kernel/irq/spurious.c b/kernel/irq/spurious.c +index dc813a9..63633a3 100644 +--- a/kernel/irq/spurious.c ++++ b/kernel/irq/spurious.c +@@ -80,13 +80,11 @@ static int try_one_irq(int irq, struct irq_desc *desc, bool force) + + /* + * All handlers must agree on IRQF_SHARED, so we test just the +- * first. Check for action->next as well. ++ * first. + */ + action = desc->action; + if (!action || !(action->flags & IRQF_SHARED) || +- (action->flags & __IRQF_TIMER) || +- (action->handler(irq, action->dev_id) == IRQ_HANDLED) || +- !action->next) ++ (action->flags & __IRQF_TIMER)) + goto out; + + /* Already running on another processor */ +@@ -104,6 +102,7 @@ static int try_one_irq(int irq, struct irq_desc *desc, bool force) + do { + if (handle_irq_event(desc) == IRQ_HANDLED) + ret = IRQ_HANDLED; ++ /* Make sure that there is still a valid action */ + action = desc->action; + } while ((desc->istate & IRQS_PENDING) && action); + desc->istate &= ~IRQS_POLL_INPROGRESS; +diff --git a/kernel/kmod.c b/kernel/kmod.c +index a4bea97..d6fe08a 100644 +--- a/kernel/kmod.c ++++ b/kernel/kmod.c +@@ -58,6 +58,43 @@ static DEFINE_SPINLOCK(umh_sysctl_lock); + */ + char modprobe_path[KMOD_PATH_LEN] = "/sbin/modprobe"; + ++static void free_modprobe_argv(struct subprocess_info *info) ++{ ++ kfree(info->argv[3]); /* check call_modprobe() */ ++ kfree(info->argv); ++} ++ ++static int call_modprobe(char *module_name, int wait) ++{ ++ static char *envp[] = { ++ "HOME=/", ++ "TERM=linux", ++ "PATH=/sbin:/usr/sbin:/bin:/usr/bin", ++ NULL ++ }; ++ ++ char **argv = kmalloc(sizeof(char *[5]), GFP_KERNEL); ++ if (!argv) ++ goto out; ++ ++ module_name = kstrdup(module_name, GFP_KERNEL); ++ if (!module_name) ++ goto free_argv; ++ ++ argv[0] = modprobe_path; ++ argv[1] = "-q"; ++ argv[2] = "--"; ++ argv[3] = module_name; /* check free_modprobe_argv() */ ++ argv[4] = NULL; ++ ++ return call_usermodehelper_fns(modprobe_path, argv, envp, ++ wait | UMH_KILLABLE, NULL, free_modprobe_argv, NULL); ++free_argv: ++ kfree(argv); ++out: ++ return -ENOMEM; ++} ++ + /** + * __request_module - try to load a kernel module + * @wait: wait (or not) for the operation to complete +@@ -79,11 +116,6 @@ int __request_module(bool wait, const char *fmt, ...) + char module_name[MODULE_NAME_LEN]; + unsigned int max_modprobes; + int ret; +- char *argv[] = { modprobe_path, "-q", "--", module_name, NULL }; +- static char *envp[] = { "HOME=/", +- "TERM=linux", +- "PATH=/sbin:/usr/sbin:/bin:/usr/bin", +- NULL }; + static atomic_t kmod_concurrent = ATOMIC_INIT(0); + #define MAX_KMOD_CONCURRENT 50 /* Completely arbitrary value - KAO */ + static int kmod_loop_msg; +@@ -126,9 +158,7 @@ int __request_module(bool wait, const char *fmt, ...) + + trace_module_request(module_name, wait, _RET_IP_); + +- ret = call_usermodehelper_fns(modprobe_path, argv, envp, +- wait ? UMH_WAIT_PROC : UMH_WAIT_EXEC, +- NULL, NULL, NULL); ++ ret = call_modprobe(module_name, wait ? UMH_WAIT_PROC : UMH_WAIT_EXEC); + + atomic_dec(&kmod_concurrent); + return ret; +@@ -186,7 +216,7 @@ static int ____call_usermodehelper(void *data) + /* Exec failed? */ + fail: + sub_info->retval = retval; +- do_exit(0); ++ return 0; + } + + void call_usermodehelper_freeinfo(struct subprocess_info *info) +@@ -197,6 +227,19 @@ void call_usermodehelper_freeinfo(struct subprocess_info *info) + } + EXPORT_SYMBOL(call_usermodehelper_freeinfo); + ++static void umh_complete(struct subprocess_info *sub_info) ++{ ++ struct completion *comp = xchg(&sub_info->complete, NULL); ++ /* ++ * See call_usermodehelper_exec(). If xchg() returns NULL ++ * we own sub_info, the UMH_KILLABLE caller has gone away. ++ */ ++ if (comp) ++ complete(comp); ++ else ++ call_usermodehelper_freeinfo(sub_info); ++} ++ + /* Keventd can't block, but this (a child) can. */ + static int wait_for_helper(void *data) + { +@@ -233,7 +276,7 @@ static int wait_for_helper(void *data) + sub_info->retval = ret; + } + +- complete(sub_info->complete); ++ umh_complete(sub_info); + return 0; + } + +@@ -245,6 +288,9 @@ static void __call_usermodehelper(struct work_struct *work) + enum umh_wait wait = sub_info->wait; + pid_t pid; + ++ if (wait != UMH_NO_WAIT) ++ wait &= ~UMH_KILLABLE; ++ + /* CLONE_VFORK: wait until the usermode helper has execve'd + * successfully We need the data structures to stay around + * until that is done. */ +@@ -267,7 +313,7 @@ static void __call_usermodehelper(struct work_struct *work) + case UMH_WAIT_EXEC: + if (pid < 0) + sub_info->retval = pid; +- complete(sub_info->complete); ++ umh_complete(sub_info); + } + } + +@@ -435,9 +481,21 @@ int call_usermodehelper_exec(struct subprocess_info *sub_info, + queue_work(khelper_wq, &sub_info->work); + if (wait == UMH_NO_WAIT) /* task has freed sub_info */ + goto unlock; ++ ++ if (wait & UMH_KILLABLE) { ++ retval = wait_for_completion_killable(&done); ++ if (!retval) ++ goto wait_done; ++ ++ /* umh_complete() will see NULL and free sub_info */ ++ if (xchg(&sub_info->complete, NULL)) ++ goto unlock; ++ /* fallthrough, umh_complete() was already called */ ++ } ++ + wait_for_completion(&done); ++wait_done: + retval = sub_info->retval; +- + out: + call_usermodehelper_freeinfo(sub_info); + unlock: +diff --git a/kernel/posix-cpu-timers.c b/kernel/posix-cpu-timers.c +index e7cb76d..962c291 100644 +--- a/kernel/posix-cpu-timers.c ++++ b/kernel/posix-cpu-timers.c +@@ -1450,8 +1450,10 @@ static int do_cpu_nanosleep(const clockid_t which_clock, int flags, + while (!signal_pending(current)) { + if (timer.it.cpu.expires.sched == 0) { + /* +- * Our timer fired and was reset. ++ * Our timer fired and was reset, below ++ * deletion can not fail. + */ ++ posix_cpu_timer_del(&timer); + spin_unlock_irq(&timer.it_lock); + return 0; + } +@@ -1469,9 +1471,26 @@ static int do_cpu_nanosleep(const clockid_t which_clock, int flags, + * We were interrupted by a signal. + */ + sample_to_timespec(which_clock, timer.it.cpu.expires, rqtp); +- posix_cpu_timer_set(&timer, 0, &zero_it, it); ++ error = posix_cpu_timer_set(&timer, 0, &zero_it, it); ++ if (!error) { ++ /* ++ * Timer is now unarmed, deletion can not fail. ++ */ ++ posix_cpu_timer_del(&timer); ++ } + spin_unlock_irq(&timer.it_lock); + ++ while (error == TIMER_RETRY) { ++ /* ++ * We need to handle case when timer was or is in the ++ * middle of firing. In other cases we already freed ++ * resources. ++ */ ++ spin_lock_irq(&timer.it_lock); ++ error = posix_cpu_timer_del(&timer); ++ spin_unlock_irq(&timer.it_lock); ++ } ++ + if ((it->it_value.tv_sec | it->it_value.tv_nsec) == 0) { + /* + * It actually did fire already. +diff --git a/kernel/posix-timers.c b/kernel/posix-timers.c +index 69185ae..e885be1 100644 +--- a/kernel/posix-timers.c ++++ b/kernel/posix-timers.c +@@ -639,6 +639,13 @@ static struct k_itimer *__lock_timer(timer_t timer_id, unsigned long *flags) + { + struct k_itimer *timr; + ++ /* ++ * timer_t could be any type >= int and we want to make sure any ++ * @timer_id outside positive int range fails lookup. ++ */ ++ if ((unsigned long long)timer_id > INT_MAX) ++ return NULL; ++ + rcu_read_lock(); + timr = idr_find(&posix_timers_id, (int)timer_id); + if (timr) { +diff --git a/kernel/sysctl_binary.c b/kernel/sysctl_binary.c +index a650694..9f9aa32 100644 +--- a/kernel/sysctl_binary.c ++++ b/kernel/sysctl_binary.c +@@ -1194,9 +1194,10 @@ static ssize_t bin_dn_node_address(struct file *file, + + /* Convert the decnet address to binary */ + result = -EIO; +- nodep = strchr(buf, '.') + 1; ++ nodep = strchr(buf, '.'); + if (!nodep) + goto out; ++ ++nodep; + + area = simple_strtoul(buf, NULL, 10); + node = simple_strtoul(nodep, NULL, 10); +diff --git a/kernel/timeconst.pl b/kernel/timeconst.pl +index eb51d76..3f42652 100644 +--- a/kernel/timeconst.pl ++++ b/kernel/timeconst.pl +@@ -369,10 +369,8 @@ if ($hz eq '--can') { + die "Usage: $0 HZ\n"; + } + +- @val = @{$canned_values{$hz}}; +- if (!defined(@val)) { +- @val = compute_values($hz); +- } ++ $cv = $canned_values{$hz}; ++ @val = defined($cv) ? @$cv : compute_values($hz); + output($hz, @val); + } + exit 0; +diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c +index 4b1a96b..6c880e8 100644 +--- a/kernel/trace/ftrace.c ++++ b/kernel/trace/ftrace.c +@@ -3454,37 +3454,51 @@ static void ftrace_init_module(struct module *mod, + ftrace_process_locs(mod, start, end); + } + +-static int ftrace_module_notify(struct notifier_block *self, +- unsigned long val, void *data) ++static int ftrace_module_notify_enter(struct notifier_block *self, ++ unsigned long val, void *data) + { + struct module *mod = data; + +- switch (val) { +- case MODULE_STATE_COMING: ++ if (val == MODULE_STATE_COMING) + ftrace_init_module(mod, mod->ftrace_callsites, + mod->ftrace_callsites + + mod->num_ftrace_callsites); +- break; +- case MODULE_STATE_GOING: ++ return 0; ++} ++ ++static int ftrace_module_notify_exit(struct notifier_block *self, ++ unsigned long val, void *data) ++{ ++ struct module *mod = data; ++ ++ if (val == MODULE_STATE_GOING) + ftrace_release_mod(mod); +- break; +- } + + return 0; + } + #else +-static int ftrace_module_notify(struct notifier_block *self, +- unsigned long val, void *data) ++static int ftrace_module_notify_enter(struct notifier_block *self, ++ unsigned long val, void *data) ++{ ++ return 0; ++} ++static int ftrace_module_notify_exit(struct notifier_block *self, ++ unsigned long val, void *data) + { + return 0; + } + #endif /* CONFIG_MODULES */ + +-struct notifier_block ftrace_module_nb = { +- .notifier_call = ftrace_module_notify, ++struct notifier_block ftrace_module_enter_nb = { ++ .notifier_call = ftrace_module_notify_enter, + .priority = INT_MAX, /* Run before anything that can use kprobes */ + }; + ++struct notifier_block ftrace_module_exit_nb = { ++ .notifier_call = ftrace_module_notify_exit, ++ .priority = INT_MIN, /* Run after anything that can remove kprobes */ ++}; ++ + extern unsigned long __start_mcount_loc[]; + extern unsigned long __stop_mcount_loc[]; + +@@ -3516,9 +3530,13 @@ void __init ftrace_init(void) + __start_mcount_loc, + __stop_mcount_loc); + +- ret = register_module_notifier(&ftrace_module_nb); ++ ret = register_module_notifier(&ftrace_module_enter_nb); ++ if (ret) ++ pr_warning("Failed to register trace ftrace module enter notifier\n"); ++ ++ ret = register_module_notifier(&ftrace_module_exit_nb); + if (ret) +- pr_warning("Failed to register trace ftrace module notifier\n"); ++ pr_warning("Failed to register trace ftrace module exit notifier\n"); + + set_ftrace_early_filters(); + +diff --git a/kernel/workqueue.c b/kernel/workqueue.c +index 7bf068a..0ad2420 100644 +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -128,6 +128,7 @@ struct worker { + }; + + struct work_struct *current_work; /* L: work being processed */ ++ work_func_t current_func; /* L: current_work's fn */ + struct cpu_workqueue_struct *current_cwq; /* L: current_work's cwq */ + struct list_head scheduled; /* L: scheduled works */ + struct task_struct *task; /* I: worker task */ +@@ -843,7 +844,8 @@ static struct worker *__find_worker_executing_work(struct global_cwq *gcwq, + struct hlist_node *tmp; + + hlist_for_each_entry(worker, tmp, bwh, hentry) +- if (worker->current_work == work) ++ if (worker->current_work == work && ++ worker->current_func == work->func) + return worker; + return NULL; + } +@@ -853,9 +855,27 @@ static struct worker *__find_worker_executing_work(struct global_cwq *gcwq, + * @gcwq: gcwq of interest + * @work: work to find worker for + * +- * Find a worker which is executing @work on @gcwq. This function is +- * identical to __find_worker_executing_work() except that this +- * function calculates @bwh itself. ++ * Find a worker which is executing @work on @gcwq by searching ++ * @gcwq->busy_hash which is keyed by the address of @work. For a worker ++ * to match, its current execution should match the address of @work and ++ * its work function. This is to avoid unwanted dependency between ++ * unrelated work executions through a work item being recycled while still ++ * being executed. ++ * ++ * This is a bit tricky. A work item may be freed once its execution ++ * starts and nothing prevents the freed area from being recycled for ++ * another work item. If the same work item address ends up being reused ++ * before the original execution finishes, workqueue will identify the ++ * recycled work item as currently executing and make it wait until the ++ * current execution finishes, introducing an unwanted dependency. ++ * ++ * This function checks the work item address, work function and workqueue ++ * to avoid false positives. Note that this isn't complete as one may ++ * construct a work function which can introduce dependency onto itself ++ * through a recycled work item. Well, if somebody wants to shoot oneself ++ * in the foot that badly, there's only so much we can do, and if such ++ * deadlock actually occurs, it should be easy to locate the culprit work ++ * function. + * + * CONTEXT: + * spin_lock_irq(gcwq->lock). +@@ -1816,7 +1836,6 @@ __acquires(&gcwq->lock) + struct global_cwq *gcwq = cwq->gcwq; + struct hlist_head *bwh = busy_worker_head(gcwq, work); + bool cpu_intensive = cwq->wq->flags & WQ_CPU_INTENSIVE; +- work_func_t f = work->func; + int work_color; + struct worker *collision; + #ifdef CONFIG_LOCKDEP +@@ -1845,6 +1864,7 @@ __acquires(&gcwq->lock) + debug_work_deactivate(work); + hlist_add_head(&worker->hentry, bwh); + worker->current_work = work; ++ worker->current_func = work->func; + worker->current_cwq = cwq; + work_color = get_work_color(work); + +@@ -1882,7 +1902,7 @@ __acquires(&gcwq->lock) + lock_map_acquire_read(&cwq->wq->lockdep_map); + lock_map_acquire(&lockdep_map); + trace_workqueue_execute_start(work); +- f(work); ++ worker->current_func(work); + /* + * While we must be careful to not use "work" after this, the trace + * point will only record its address. +@@ -1892,11 +1912,10 @@ __acquires(&gcwq->lock) + lock_map_release(&cwq->wq->lockdep_map); + + if (unlikely(in_atomic() || lockdep_depth(current) > 0)) { +- printk(KERN_ERR "BUG: workqueue leaked lock or atomic: " +- "%s/0x%08x/%d\n", +- current->comm, preempt_count(), task_pid_nr(current)); +- printk(KERN_ERR " last function: "); +- print_symbol("%s\n", (unsigned long)f); ++ pr_err("BUG: workqueue leaked lock or atomic: %s/0x%08x/%d\n" ++ " last function: %pf\n", ++ current->comm, preempt_count(), task_pid_nr(current), ++ worker->current_func); + debug_show_held_locks(current); + dump_stack(); + } +@@ -1910,6 +1929,7 @@ __acquires(&gcwq->lock) + /* we're done with it, release */ + hlist_del_init(&worker->hentry); + worker->current_work = NULL; ++ worker->current_func = NULL; + worker->current_cwq = NULL; + cwq_dec_nr_in_flight(cwq, work_color, false); + } +diff --git a/lib/idr.c b/lib/idr.c +index ed055b2..aadc525 100644 +--- a/lib/idr.c ++++ b/lib/idr.c +@@ -39,6 +39,14 @@ + static struct kmem_cache *idr_layer_cache; + static DEFINE_SPINLOCK(simple_ida_lock); + ++/* the maximum ID which can be allocated given idr->layers */ ++static int idr_max(int layers) ++{ ++ int bits = min_t(int, layers * IDR_BITS, MAX_ID_SHIFT); ++ ++ return (1 << bits) - 1; ++} ++ + static struct idr_layer *get_from_free_list(struct idr *idp) + { + struct idr_layer *p; +@@ -223,7 +231,7 @@ build_up: + * Add a new layer to the top of the tree if the requested + * id is larger than the currently allocated space. + */ +- while ((layers < (MAX_LEVEL - 1)) && (id >= (1 << (layers*IDR_BITS)))) { ++ while (id > idr_max(layers)) { + layers++; + if (!p->count) { + /* special case: if the tree is currently empty, +@@ -265,7 +273,7 @@ build_up: + + static int idr_get_new_above_int(struct idr *idp, void *ptr, int starting_id) + { +- struct idr_layer *pa[MAX_LEVEL]; ++ struct idr_layer *pa[MAX_LEVEL + 1]; + int id; + + id = idr_get_empty_slot(idp, starting_id, pa); +@@ -357,7 +365,7 @@ static void idr_remove_warning(int id) + static void sub_remove(struct idr *idp, int shift, int id) + { + struct idr_layer *p = idp->top; +- struct idr_layer **pa[MAX_LEVEL]; ++ struct idr_layer **pa[MAX_LEVEL + 1]; + struct idr_layer ***paa = &pa[0]; + struct idr_layer *to_free; + int n; +@@ -451,16 +459,16 @@ void idr_remove_all(struct idr *idp) + int n, id, max; + int bt_mask; + struct idr_layer *p; +- struct idr_layer *pa[MAX_LEVEL]; ++ struct idr_layer *pa[MAX_LEVEL + 1]; + struct idr_layer **paa = &pa[0]; + + n = idp->layers * IDR_BITS; + p = idp->top; + rcu_assign_pointer(idp->top, NULL); +- max = 1 << n; ++ max = idr_max(idp->layers); + + id = 0; +- while (id < max) { ++ while (id >= 0 && id <= max) { + while (n > IDR_BITS && p) { + n -= IDR_BITS; + *paa++ = p; +@@ -519,7 +527,7 @@ void *idr_find(struct idr *idp, int id) + /* Mask off upper bits we don't use for the search. */ + id &= MAX_ID_MASK; + +- if (id >= (1 << n)) ++ if (id > idr_max(p->layer + 1)) + return NULL; + BUG_ON(n == 0); + +@@ -555,15 +563,15 @@ int idr_for_each(struct idr *idp, + { + int n, id, max, error = 0; + struct idr_layer *p; +- struct idr_layer *pa[MAX_LEVEL]; ++ struct idr_layer *pa[MAX_LEVEL + 1]; + struct idr_layer **paa = &pa[0]; + + n = idp->layers * IDR_BITS; + p = rcu_dereference_raw(idp->top); +- max = 1 << n; ++ max = idr_max(idp->layers); + + id = 0; +- while (id < max) { ++ while (id >= 0 && id <= max) { + while (n > 0 && p) { + n -= IDR_BITS; + *paa++ = p; +@@ -595,23 +603,25 @@ EXPORT_SYMBOL(idr_for_each); + * Returns pointer to registered object with id, which is next number to + * given id. After being looked up, *@nextidp will be updated for the next + * iteration. ++ * ++ * This function can be called under rcu_read_lock(), given that the leaf ++ * pointers lifetimes are correctly managed. + */ +- + void *idr_get_next(struct idr *idp, int *nextidp) + { +- struct idr_layer *p, *pa[MAX_LEVEL]; ++ struct idr_layer *p, *pa[MAX_LEVEL + 1]; + struct idr_layer **paa = &pa[0]; + int id = *nextidp; + int n, max; + + /* find first ent */ +- n = idp->layers * IDR_BITS; +- max = 1 << n; + p = rcu_dereference_raw(idp->top); + if (!p) + return NULL; ++ n = (p->layer + 1) * IDR_BITS; ++ max = idr_max(p->layer + 1); + +- while (id < max) { ++ while (id >= 0 && id <= max) { + while (n > 0 && p) { + n -= IDR_BITS; + *paa++ = p; +@@ -623,7 +633,14 @@ void *idr_get_next(struct idr *idp, int *nextidp) + return p; + } + +- id += 1 << n; ++ /* ++ * Proceed to the next layer at the current level. Unlike ++ * idr_for_each(), @id isn't guaranteed to be aligned to ++ * layer boundary at this point and adding 1 << n may ++ * incorrectly skip IDs. Make sure we jump to the ++ * beginning of the next layer using round_up(). ++ */ ++ id = round_up(id + 1, 1 << n); + while (n < fls(id)) { + n += IDR_BITS; + p = *--paa; +@@ -778,7 +795,7 @@ EXPORT_SYMBOL(ida_pre_get); + */ + int ida_get_new_above(struct ida *ida, int starting_id, int *p_id) + { +- struct idr_layer *pa[MAX_LEVEL]; ++ struct idr_layer *pa[MAX_LEVEL + 1]; + struct ida_bitmap *bitmap; + unsigned long flags; + int idr_id = starting_id / IDA_BITMAP_BITS; +diff --git a/mm/fadvise.c b/mm/fadvise.c +index 8d723c9..35b2bb0 100644 +--- a/mm/fadvise.c ++++ b/mm/fadvise.c +@@ -17,6 +17,7 @@ + #include <linux/fadvise.h> + #include <linux/writeback.h> + #include <linux/syscalls.h> ++#include <linux/swap.h> + + #include <asm/unistd.h> + +@@ -123,9 +124,22 @@ SYSCALL_DEFINE(fadvise64_64)(int fd, loff_t offset, loff_t len, int advice) + start_index = (offset+(PAGE_CACHE_SIZE-1)) >> PAGE_CACHE_SHIFT; + end_index = (endbyte >> PAGE_CACHE_SHIFT); + +- if (end_index >= start_index) +- invalidate_mapping_pages(mapping, start_index, ++ if (end_index >= start_index) { ++ unsigned long count = invalidate_mapping_pages(mapping, ++ start_index, end_index); ++ ++ /* ++ * If fewer pages were invalidated than expected then ++ * it is possible that some of the pages were on ++ * a per-cpu pagevec for a remote CPU. Drain all ++ * pagevecs and try again. ++ */ ++ if (count < (end_index - start_index + 1)) { ++ lru_add_drain_all(); ++ invalidate_mapping_pages(mapping, start_index, + end_index); ++ } ++ } + break; + default: + ret = -EINVAL; +diff --git a/mm/mmu_notifier.c b/mm/mmu_notifier.c +index 862b608..8d1ca2d 100644 +--- a/mm/mmu_notifier.c ++++ b/mm/mmu_notifier.c +@@ -14,10 +14,14 @@ + #include <linux/export.h> + #include <linux/mm.h> + #include <linux/err.h> ++#include <linux/srcu.h> + #include <linux/rcupdate.h> + #include <linux/sched.h> + #include <linux/slab.h> + ++/* global SRCU for all MMs */ ++static struct srcu_struct srcu; ++ + /* + * This function can't run concurrently against mmu_notifier_register + * because mm->mm_users > 0 during mmu_notifier_register and exit_mmap +@@ -25,58 +29,61 @@ + * in parallel despite there being no task using this mm any more, + * through the vmas outside of the exit_mmap context, such as with + * vmtruncate. This serializes against mmu_notifier_unregister with +- * the mmu_notifier_mm->lock in addition to RCU and it serializes +- * against the other mmu notifiers with RCU. struct mmu_notifier_mm ++ * the mmu_notifier_mm->lock in addition to SRCU and it serializes ++ * against the other mmu notifiers with SRCU. struct mmu_notifier_mm + * can't go away from under us as exit_mmap holds an mm_count pin + * itself. + */ + void __mmu_notifier_release(struct mm_struct *mm) + { + struct mmu_notifier *mn; +- struct hlist_node *n; ++ int id; + + /* +- * RCU here will block mmu_notifier_unregister until +- * ->release returns. ++ * srcu_read_lock() here will block synchronize_srcu() in ++ * mmu_notifier_unregister() until all registered ++ * ->release() callouts this function makes have ++ * returned. + */ +- rcu_read_lock(); +- hlist_for_each_entry_rcu(mn, n, &mm->mmu_notifier_mm->list, hlist) +- /* +- * if ->release runs before mmu_notifier_unregister it +- * must be handled as it's the only way for the driver +- * to flush all existing sptes and stop the driver +- * from establishing any more sptes before all the +- * pages in the mm are freed. +- */ +- if (mn->ops->release) +- mn->ops->release(mn, mm); +- rcu_read_unlock(); +- ++ id = srcu_read_lock(&srcu); + spin_lock(&mm->mmu_notifier_mm->lock); + while (unlikely(!hlist_empty(&mm->mmu_notifier_mm->list))) { + mn = hlist_entry(mm->mmu_notifier_mm->list.first, + struct mmu_notifier, + hlist); ++ + /* +- * We arrived before mmu_notifier_unregister so +- * mmu_notifier_unregister will do nothing other than +- * to wait ->release to finish and +- * mmu_notifier_unregister to return. ++ * Unlink. This will prevent mmu_notifier_unregister() ++ * from also making the ->release() callout. + */ + hlist_del_init_rcu(&mn->hlist); ++ spin_unlock(&mm->mmu_notifier_mm->lock); ++ ++ /* ++ * Clear sptes. (see 'release' description in mmu_notifier.h) ++ */ ++ if (mn->ops->release) ++ mn->ops->release(mn, mm); ++ ++ spin_lock(&mm->mmu_notifier_mm->lock); + } + spin_unlock(&mm->mmu_notifier_mm->lock); + + /* +- * synchronize_rcu here prevents mmu_notifier_release to +- * return to exit_mmap (which would proceed freeing all pages +- * in the mm) until the ->release method returns, if it was +- * invoked by mmu_notifier_unregister. +- * +- * The mmu_notifier_mm can't go away from under us because one +- * mm_count is hold by exit_mmap. ++ * All callouts to ->release() which we have done are complete. ++ * Allow synchronize_srcu() in mmu_notifier_unregister() to complete ++ */ ++ srcu_read_unlock(&srcu, id); ++ ++ /* ++ * mmu_notifier_unregister() may have unlinked a notifier and may ++ * still be calling out to it. Additionally, other notifiers ++ * may have been active via vmtruncate() et. al. Block here ++ * to ensure that all notifier callouts for this mm have been ++ * completed and the sptes are really cleaned up before returning ++ * to exit_mmap(). + */ +- synchronize_rcu(); ++ synchronize_srcu(&srcu); + } + + /* +@@ -89,14 +96,14 @@ int __mmu_notifier_clear_flush_young(struct mm_struct *mm, + { + struct mmu_notifier *mn; + struct hlist_node *n; +- int young = 0; ++ int young = 0, id; + +- rcu_read_lock(); ++ id = srcu_read_lock(&srcu); + hlist_for_each_entry_rcu(mn, n, &mm->mmu_notifier_mm->list, hlist) { + if (mn->ops->clear_flush_young) + young |= mn->ops->clear_flush_young(mn, mm, address); + } +- rcu_read_unlock(); ++ srcu_read_unlock(&srcu, id); + + return young; + } +@@ -106,9 +113,9 @@ int __mmu_notifier_test_young(struct mm_struct *mm, + { + struct mmu_notifier *mn; + struct hlist_node *n; +- int young = 0; ++ int young = 0, id; + +- rcu_read_lock(); ++ id = srcu_read_lock(&srcu); + hlist_for_each_entry_rcu(mn, n, &mm->mmu_notifier_mm->list, hlist) { + if (mn->ops->test_young) { + young = mn->ops->test_young(mn, mm, address); +@@ -116,7 +123,7 @@ int __mmu_notifier_test_young(struct mm_struct *mm, + break; + } + } +- rcu_read_unlock(); ++ srcu_read_unlock(&srcu, id); + + return young; + } +@@ -126,8 +133,9 @@ void __mmu_notifier_change_pte(struct mm_struct *mm, unsigned long address, + { + struct mmu_notifier *mn; + struct hlist_node *n; ++ int id; + +- rcu_read_lock(); ++ id = srcu_read_lock(&srcu); + hlist_for_each_entry_rcu(mn, n, &mm->mmu_notifier_mm->list, hlist) { + if (mn->ops->change_pte) + mn->ops->change_pte(mn, mm, address, pte); +@@ -138,7 +146,7 @@ void __mmu_notifier_change_pte(struct mm_struct *mm, unsigned long address, + else if (mn->ops->invalidate_page) + mn->ops->invalidate_page(mn, mm, address); + } +- rcu_read_unlock(); ++ srcu_read_unlock(&srcu, id); + } + + void __mmu_notifier_invalidate_page(struct mm_struct *mm, +@@ -146,13 +154,14 @@ void __mmu_notifier_invalidate_page(struct mm_struct *mm, + { + struct mmu_notifier *mn; + struct hlist_node *n; ++ int id; + +- rcu_read_lock(); ++ id = srcu_read_lock(&srcu); + hlist_for_each_entry_rcu(mn, n, &mm->mmu_notifier_mm->list, hlist) { + if (mn->ops->invalidate_page) + mn->ops->invalidate_page(mn, mm, address); + } +- rcu_read_unlock(); ++ srcu_read_unlock(&srcu, id); + } + + void __mmu_notifier_invalidate_range_start(struct mm_struct *mm, +@@ -160,13 +169,14 @@ void __mmu_notifier_invalidate_range_start(struct mm_struct *mm, + { + struct mmu_notifier *mn; + struct hlist_node *n; ++ int id; + +- rcu_read_lock(); ++ id = srcu_read_lock(&srcu); + hlist_for_each_entry_rcu(mn, n, &mm->mmu_notifier_mm->list, hlist) { + if (mn->ops->invalidate_range_start) + mn->ops->invalidate_range_start(mn, mm, start, end); + } +- rcu_read_unlock(); ++ srcu_read_unlock(&srcu, id); + } + + void __mmu_notifier_invalidate_range_end(struct mm_struct *mm, +@@ -174,13 +184,14 @@ void __mmu_notifier_invalidate_range_end(struct mm_struct *mm, + { + struct mmu_notifier *mn; + struct hlist_node *n; ++ int id; + +- rcu_read_lock(); ++ id = srcu_read_lock(&srcu); + hlist_for_each_entry_rcu(mn, n, &mm->mmu_notifier_mm->list, hlist) { + if (mn->ops->invalidate_range_end) + mn->ops->invalidate_range_end(mn, mm, start, end); + } +- rcu_read_unlock(); ++ srcu_read_unlock(&srcu, id); + } + + static int do_mmu_notifier_register(struct mmu_notifier *mn, +@@ -192,6 +203,12 @@ static int do_mmu_notifier_register(struct mmu_notifier *mn, + + BUG_ON(atomic_read(&mm->mm_users) <= 0); + ++ /* ++ * Verify that mmu_notifier_init() already run and the global srcu is ++ * initialized. ++ */ ++ BUG_ON(!srcu.per_cpu_ref); ++ + ret = -ENOMEM; + mmu_notifier_mm = kmalloc(sizeof(struct mmu_notifier_mm), GFP_KERNEL); + if (unlikely(!mmu_notifier_mm)) +@@ -274,8 +291,8 @@ void __mmu_notifier_mm_destroy(struct mm_struct *mm) + /* + * This releases the mm_count pin automatically and frees the mm + * structure if it was the last user of it. It serializes against +- * running mmu notifiers with RCU and against mmu_notifier_unregister +- * with the unregister lock + RCU. All sptes must be dropped before ++ * running mmu notifiers with SRCU and against mmu_notifier_unregister ++ * with the unregister lock + SRCU. All sptes must be dropped before + * calling mmu_notifier_unregister. ->release or any other notifier + * method may be invoked concurrently with mmu_notifier_unregister, + * and only after mmu_notifier_unregister returned we're guaranteed +@@ -285,35 +302,43 @@ void mmu_notifier_unregister(struct mmu_notifier *mn, struct mm_struct *mm) + { + BUG_ON(atomic_read(&mm->mm_count) <= 0); + ++ spin_lock(&mm->mmu_notifier_mm->lock); + if (!hlist_unhashed(&mn->hlist)) { +- /* +- * RCU here will force exit_mmap to wait ->release to finish +- * before freeing the pages. +- */ +- rcu_read_lock(); ++ int id; + + /* +- * exit_mmap will block in mmu_notifier_release to +- * guarantee ->release is called before freeing the +- * pages. ++ * Ensure we synchronize up with __mmu_notifier_release(). + */ ++ id = srcu_read_lock(&srcu); ++ ++ hlist_del_rcu(&mn->hlist); ++ spin_unlock(&mm->mmu_notifier_mm->lock); ++ + if (mn->ops->release) + mn->ops->release(mn, mm); +- rcu_read_unlock(); + +- spin_lock(&mm->mmu_notifier_mm->lock); +- hlist_del_rcu(&mn->hlist); ++ /* ++ * Allow __mmu_notifier_release() to complete. ++ */ ++ srcu_read_unlock(&srcu, id); ++ } else + spin_unlock(&mm->mmu_notifier_mm->lock); +- } + + /* +- * Wait any running method to finish, of course including +- * ->release if it was run by mmu_notifier_relase instead of us. ++ * Wait for any running method to finish, including ->release() if it ++ * was run by __mmu_notifier_release() instead of us. + */ +- synchronize_rcu(); ++ synchronize_srcu(&srcu); + + BUG_ON(atomic_read(&mm->mm_count) <= 0); + + mmdrop(mm); + } + EXPORT_SYMBOL_GPL(mmu_notifier_unregister); ++ ++static int __init mmu_notifier_init(void) ++{ ++ return init_srcu_struct(&srcu); ++} ++ ++module_init(mmu_notifier_init); +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index 4d3a697..5c028e2 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -4253,10 +4253,11 @@ static void __meminit calculate_node_totalpages(struct pglist_data *pgdat, + * round what is now in bits to nearest long in bits, then return it in + * bytes. + */ +-static unsigned long __init usemap_size(unsigned long zonesize) ++static unsigned long __init usemap_size(unsigned long zone_start_pfn, unsigned long zonesize) + { + unsigned long usemapsize; + ++ zonesize += zone_start_pfn & (pageblock_nr_pages-1); + usemapsize = roundup(zonesize, pageblock_nr_pages); + usemapsize = usemapsize >> pageblock_order; + usemapsize *= NR_PAGEBLOCK_BITS; +@@ -4266,17 +4267,19 @@ static unsigned long __init usemap_size(unsigned long zonesize) + } + + static void __init setup_usemap(struct pglist_data *pgdat, +- struct zone *zone, unsigned long zonesize) ++ struct zone *zone, ++ unsigned long zone_start_pfn, ++ unsigned long zonesize) + { +- unsigned long usemapsize = usemap_size(zonesize); ++ unsigned long usemapsize = usemap_size(zone_start_pfn, zonesize); + zone->pageblock_flags = NULL; + if (usemapsize) + zone->pageblock_flags = alloc_bootmem_node_nopanic(pgdat, + usemapsize); + } + #else +-static inline void setup_usemap(struct pglist_data *pgdat, +- struct zone *zone, unsigned long zonesize) {} ++static inline void setup_usemap(struct pglist_data *pgdat, struct zone *zone, ++ unsigned long zone_start_pfn, unsigned long zonesize) {} + #endif /* CONFIG_SPARSEMEM */ + + #ifdef CONFIG_HUGETLB_PAGE_SIZE_VARIABLE +@@ -4401,7 +4404,7 @@ static void __paginginit free_area_init_core(struct pglist_data *pgdat, + continue; + + set_pageblock_order(); +- setup_usemap(pgdat, zone, size); ++ setup_usemap(pgdat, zone, zone_start_pfn, size); + ret = init_currently_empty_zone(zone, zone_start_pfn, + size, MEMMAP_EARLY); + BUG_ON(ret); +diff --git a/mm/shmem.c b/mm/shmem.c +index 12b9e80..a78acf0 100644 +--- a/mm/shmem.c ++++ b/mm/shmem.c +@@ -2121,6 +2121,7 @@ static int shmem_remount_fs(struct super_block *sb, int *flags, char *data) + unsigned long inodes; + int error = -EINVAL; + ++ config.mpol = NULL; + if (shmem_parse_options(data, &config, true)) + return error; + +@@ -2145,8 +2146,13 @@ static int shmem_remount_fs(struct super_block *sb, int *flags, char *data) + sbinfo->max_inodes = config.max_inodes; + sbinfo->free_inodes = config.max_inodes - inodes; + +- mpol_put(sbinfo->mpol); +- sbinfo->mpol = config.mpol; /* transfers initial ref */ ++ /* ++ * Preserve previous mempolicy unless mpol remount option was specified. ++ */ ++ if (config.mpol) { ++ mpol_put(sbinfo->mpol); ++ sbinfo->mpol = config.mpol; /* transfers initial ref */ ++ } + out: + spin_unlock(&sbinfo->stat_lock); + return error; +diff --git a/net/bridge/br_stp_bpdu.c b/net/bridge/br_stp_bpdu.c +index e16aade..718cbe8 100644 +--- a/net/bridge/br_stp_bpdu.c ++++ b/net/bridge/br_stp_bpdu.c +@@ -16,6 +16,7 @@ + #include <linux/etherdevice.h> + #include <linux/llc.h> + #include <linux/slab.h> ++#include <linux/pkt_sched.h> + #include <net/net_namespace.h> + #include <net/llc.h> + #include <net/llc_pdu.h> +@@ -40,6 +41,7 @@ static void br_send_bpdu(struct net_bridge_port *p, + + skb->dev = p->dev; + skb->protocol = htons(ETH_P_802_2); ++ skb->priority = TC_PRIO_CONTROL; + + skb_reserve(skb, LLC_RESERVE); + memcpy(__skb_put(skb, length), data, length); +diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c +index 1b5096a..5d228de 100644 +--- a/net/ipv4/af_inet.c ++++ b/net/ipv4/af_inet.c +@@ -226,8 +226,12 @@ EXPORT_SYMBOL(inet_listen); + u32 inet_ehash_secret __read_mostly; + EXPORT_SYMBOL(inet_ehash_secret); + ++u32 ipv6_hash_secret __read_mostly; ++EXPORT_SYMBOL(ipv6_hash_secret); ++ + /* +- * inet_ehash_secret must be set exactly once ++ * inet_ehash_secret must be set exactly once, and to a non nul value ++ * ipv6_hash_secret must be set exactly once. + */ + void build_ehash_secret(void) + { +@@ -237,7 +241,8 @@ void build_ehash_secret(void) + get_random_bytes(&rnd, sizeof(rnd)); + } while (rnd == 0); + +- cmpxchg(&inet_ehash_secret, 0, rnd); ++ if (cmpxchg(&inet_ehash_secret, 0, rnd) == 0) ++ get_random_bytes(&ipv6_hash_secret, sizeof(ipv6_hash_secret)); + } + EXPORT_SYMBOL(build_ehash_secret); + +diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c +index 43d4c3b..294a380 100644 +--- a/net/ipv4/ping.c ++++ b/net/ipv4/ping.c +@@ -321,8 +321,8 @@ void ping_err(struct sk_buff *skb, u32 info) + struct iphdr *iph = (struct iphdr *)skb->data; + struct icmphdr *icmph = (struct icmphdr *)(skb->data+(iph->ihl<<2)); + struct inet_sock *inet_sock; +- int type = icmph->type; +- int code = icmph->code; ++ int type = icmp_hdr(skb)->type; ++ int code = icmp_hdr(skb)->code; + struct net *net = dev_net(skb->dev); + struct sock *sk; + int harderr; +diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c +index 3282453..9acee9d 100644 +--- a/net/sunrpc/svc_xprt.c ++++ b/net/sunrpc/svc_xprt.c +@@ -816,7 +816,6 @@ static void svc_age_temp_xprts(unsigned long closure) + struct svc_serv *serv = (struct svc_serv *)closure; + struct svc_xprt *xprt; + struct list_head *le, *next; +- LIST_HEAD(to_be_aged); + + dprintk("svc_age_temp_xprts\n"); + +@@ -837,25 +836,15 @@ static void svc_age_temp_xprts(unsigned long closure) + if (atomic_read(&xprt->xpt_ref.refcount) > 1 || + test_bit(XPT_BUSY, &xprt->xpt_flags)) + continue; +- svc_xprt_get(xprt); +- list_move(le, &to_be_aged); ++ list_del_init(le); + set_bit(XPT_CLOSE, &xprt->xpt_flags); + set_bit(XPT_DETACHED, &xprt->xpt_flags); +- } +- spin_unlock_bh(&serv->sv_lock); +- +- while (!list_empty(&to_be_aged)) { +- le = to_be_aged.next; +- /* fiddling the xpt_list node is safe 'cos we're XPT_DETACHED */ +- list_del_init(le); +- xprt = list_entry(le, struct svc_xprt, xpt_list); +- + dprintk("queuing xprt %p for closing\n", xprt); + + /* a thread will dequeue and close it soon */ + svc_xprt_enqueue(xprt); +- svc_xprt_put(xprt); + } ++ spin_unlock_bh(&serv->sv_lock); + + mod_timer(&serv->sv_temptimer, jiffies + svc_conn_age_period * HZ); + } +diff --git a/sound/drivers/aloop.c b/sound/drivers/aloop.c +index 193ce81..42b876d 100644 +--- a/sound/drivers/aloop.c ++++ b/sound/drivers/aloop.c +@@ -287,12 +287,14 @@ static int loopback_trigger(struct snd_pcm_substream *substream, int cmd) + loopback_active_notify(dpcm); + break; + case SNDRV_PCM_TRIGGER_PAUSE_PUSH: ++ case SNDRV_PCM_TRIGGER_SUSPEND: + spin_lock(&cable->lock); + cable->pause |= stream; + spin_unlock(&cable->lock); + loopback_timer_stop(dpcm); + break; + case SNDRV_PCM_TRIGGER_PAUSE_RELEASE: ++ case SNDRV_PCM_TRIGGER_RESUME: + spin_lock(&cable->lock); + dpcm->last_jiffies = jiffies; + cable->pause &= ~stream; +@@ -552,7 +554,8 @@ static snd_pcm_uframes_t loopback_pointer(struct snd_pcm_substream *substream) + static struct snd_pcm_hardware loopback_pcm_hardware = + { + .info = (SNDRV_PCM_INFO_INTERLEAVED | SNDRV_PCM_INFO_MMAP | +- SNDRV_PCM_INFO_MMAP_VALID | SNDRV_PCM_INFO_PAUSE), ++ SNDRV_PCM_INFO_MMAP_VALID | SNDRV_PCM_INFO_PAUSE | ++ SNDRV_PCM_INFO_RESUME), + .formats = (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S16_BE | + SNDRV_PCM_FMTBIT_S32_LE | SNDRV_PCM_FMTBIT_S32_BE | + SNDRV_PCM_FMTBIT_FLOAT_LE | SNDRV_PCM_FMTBIT_FLOAT_BE), +diff --git a/sound/pci/ali5451/ali5451.c b/sound/pci/ali5451/ali5451.c +index ef85ac5..be662c9 100644 +--- a/sound/pci/ali5451/ali5451.c ++++ b/sound/pci/ali5451/ali5451.c +@@ -1435,7 +1435,7 @@ static snd_pcm_uframes_t snd_ali_pointer(struct snd_pcm_substream *substream) + + spin_lock(&codec->reg_lock); + if (!pvoice->running) { +- spin_unlock_irq(&codec->reg_lock); ++ spin_unlock(&codec->reg_lock); + return 0; + } + outb(pvoice->number, ALI_REG(codec, ALI_GC_CIR)); +diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c +index bde2615..3c8bc6e 100644 +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -918,8 +918,12 @@ static int hdmi_pcm_open(struct hda_pcm_stream *hinfo, + if (!static_hdmi_pcm && eld->eld_valid) { + snd_hdmi_eld_update_pcm_info(eld, hinfo); + if (hinfo->channels_min > hinfo->channels_max || +- !hinfo->rates || !hinfo->formats) ++ !hinfo->rates || !hinfo->formats) { ++ per_cvt->assigned = 0; ++ hinfo->nid = 0; ++ snd_hda_spdif_ctls_unassign(codec, pin_idx); + return -ENODEV; ++ } + } + + /* Store the updated parameters */ +@@ -983,6 +987,7 @@ static void hdmi_present_sense(struct hdmi_spec_per_pin *per_pin, int repoll) + "HDMI status: Codec=%d Pin=%d Presence_Detect=%d ELD_Valid=%d\n", + codec->addr, pin_nid, eld->monitor_present, eld_valid); + ++ eld->eld_valid = false; + if (eld_valid) { + if (!snd_hdmi_get_eld(eld, codec, pin_nid)) + snd_hdmi_show_eld(eld); +diff --git a/sound/pci/rme32.c b/sound/pci/rme32.c +index 21bcb47..62075a5 100644 +--- a/sound/pci/rme32.c ++++ b/sound/pci/rme32.c +@@ -1017,7 +1017,7 @@ static int snd_rme32_capture_close(struct snd_pcm_substream *substream) + spin_lock_irq(&rme32->lock); + rme32->capture_substream = NULL; + rme32->capture_periodsize = 0; +- spin_unlock(&rme32->lock); ++ spin_unlock_irq(&rme32->lock); + return 0; + } + +diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h +index 32d2a21..4e25148 100644 +--- a/sound/usb/quirks-table.h ++++ b/sound/usb/quirks-table.h +@@ -1624,7 +1624,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), + .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { + /* .vendor_name = "Roland", */ + /* .product_name = "A-PRO", */ +- .ifnum = 1, ++ .ifnum = 0, + .type = QUIRK_MIDI_FIXED_ENDPOINT, + .data = & (const struct snd_usb_midi_endpoint_info) { + .out_cables = 0x0003, |