diff options
Diffstat (limited to '3.2.70/1069_linux-3.2.70.patch')
| -rw-r--r-- | 3.2.70/1069_linux-3.2.70.patch | 5879 |
1 files changed, 5879 insertions, 0 deletions
diff --git a/3.2.70/1069_linux-3.2.70.patch b/3.2.70/1069_linux-3.2.70.patch new file mode 100644 index 0000000..b694627 --- /dev/null +++ b/3.2.70/1069_linux-3.2.70.patch @@ -0,0 +1,5879 @@ +diff --git a/Documentation/networking/rds.txt b/Documentation/networking/rds.txt +index c67077c..e1a3d59 100644 +--- a/Documentation/networking/rds.txt ++++ b/Documentation/networking/rds.txt +@@ -62,11 +62,10 @@ Socket Interface + ================ + + AF_RDS, PF_RDS, SOL_RDS +- These constants haven't been assigned yet, because RDS isn't in +- mainline yet. Currently, the kernel module assigns some constant +- and publishes it to user space through two sysctl files +- /proc/sys/net/rds/pf_rds +- /proc/sys/net/rds/sol_rds ++ AF_RDS and PF_RDS are the domain type to be used with socket(2) ++ to create RDS sockets. SOL_RDS is the socket-level to be used ++ with setsockopt(2) and getsockopt(2) for RDS specific socket ++ options. + + fd = socket(PF_RDS, SOCK_SEQPACKET, 0); + This creates a new, unbound RDS socket. +diff --git a/Documentation/pinctrl.txt b/Documentation/pinctrl.txt +index b04cb7d..074da62 100644 +--- a/Documentation/pinctrl.txt ++++ b/Documentation/pinctrl.txt +@@ -164,8 +164,8 @@ static const char *foo_get_group_name(struct pinctrl_dev *pctldev, + } + + static int foo_get_group_pins(struct pinctrl_dev *pctldev, unsigned selector, +- unsigned ** const pins, +- unsigned * const num_pins) ++ const unsigned **pins, ++ unsigned *num_pins) + { + *pins = (unsigned *) foo_groups[selector].pins; + *num_pins = foo_groups[selector].num_pins; +diff --git a/Makefile b/Makefile +index 8071888..41a626b 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 2 +-SUBLEVEL = 69 ++SUBLEVEL = 70 + EXTRAVERSION = + NAME = Saber-toothed Squirrel + +diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h +index 0e9ce8d..a4b1186 100644 +--- a/arch/arm/include/asm/elf.h ++++ b/arch/arm/include/asm/elf.h +@@ -116,7 +116,7 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs); + the loader. We need to make sure that it is out of the way of the program + that it will "exec", and that there is sufficient room for the brk. */ + +-#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3) ++#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2) + + /* When the program starts, a1 contains a pointer to a function to be + registered with atexit, as per the SVR4 ABI. A value of 0 means we +diff --git a/arch/mips/include/asm/cacheflush.h b/arch/mips/include/asm/cacheflush.h +index 69468de..484c5bc 100644 +--- a/arch/mips/include/asm/cacheflush.h ++++ b/arch/mips/include/asm/cacheflush.h +@@ -29,6 +29,20 @@ + * - flush_icache_all() flush the entire instruction cache + * - flush_data_cache_page() flushes a page from the data cache + */ ++ ++ /* ++ * This flag is used to indicate that the page pointed to by a pte ++ * is dirty and requires cleaning before returning it to the user. ++ */ ++#define PG_dcache_dirty PG_arch_1 ++ ++#define Page_dcache_dirty(page) \ ++ test_bit(PG_dcache_dirty, &(page)->flags) ++#define SetPageDcacheDirty(page) \ ++ set_bit(PG_dcache_dirty, &(page)->flags) ++#define ClearPageDcacheDirty(page) \ ++ clear_bit(PG_dcache_dirty, &(page)->flags) ++ + extern void (*flush_cache_all)(void); + extern void (*__flush_cache_all)(void); + extern void (*flush_cache_mm)(struct mm_struct *mm); +@@ -37,13 +51,15 @@ extern void (*flush_cache_range)(struct vm_area_struct *vma, + unsigned long start, unsigned long end); + extern void (*flush_cache_page)(struct vm_area_struct *vma, unsigned long page, unsigned long pfn); + extern void __flush_dcache_page(struct page *page); ++extern void __flush_icache_page(struct vm_area_struct *vma, struct page *page); + + #define ARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE 1 + static inline void flush_dcache_page(struct page *page) + { +- if (cpu_has_dc_aliases || !cpu_has_ic_fills_f_dc) ++ if (cpu_has_dc_aliases) + __flush_dcache_page(page); +- ++ else if (!cpu_has_ic_fills_f_dc) ++ SetPageDcacheDirty(page); + } + + #define flush_dcache_mmap_lock(mapping) do { } while (0) +@@ -61,6 +77,11 @@ static inline void flush_anon_page(struct vm_area_struct *vma, + static inline void flush_icache_page(struct vm_area_struct *vma, + struct page *page) + { ++ if (!cpu_has_ic_fills_f_dc && (vma->vm_flags & VM_EXEC) && ++ Page_dcache_dirty(page)) { ++ __flush_icache_page(vma, page); ++ ClearPageDcacheDirty(page); ++ } + } + + extern void (*flush_icache_range)(unsigned long start, unsigned long end); +@@ -95,19 +116,6 @@ extern void (*flush_icache_all)(void); + extern void (*local_flush_data_cache_page)(void * addr); + extern void (*flush_data_cache_page)(unsigned long addr); + +-/* +- * This flag is used to indicate that the page pointed to by a pte +- * is dirty and requires cleaning before returning it to the user. +- */ +-#define PG_dcache_dirty PG_arch_1 +- +-#define Page_dcache_dirty(page) \ +- test_bit(PG_dcache_dirty, &(page)->flags) +-#define SetPageDcacheDirty(page) \ +- set_bit(PG_dcache_dirty, &(page)->flags) +-#define ClearPageDcacheDirty(page) \ +- clear_bit(PG_dcache_dirty, &(page)->flags) +- + /* Run kernel code uncached, useful for cache probing functions. */ + unsigned long run_uncached(void *func); + +diff --git a/arch/mips/include/asm/cpu-features.h b/arch/mips/include/asm/cpu-features.h +index ca400f7..0f4991b 100644 +--- a/arch/mips/include/asm/cpu-features.h ++++ b/arch/mips/include/asm/cpu-features.h +@@ -153,8 +153,32 @@ + #define cpu_has_mips_r (cpu_has_mips32r1 | cpu_has_mips32r2 | \ + cpu_has_mips64r1 | cpu_has_mips64r2) + ++/* ++ * cpu_has_mips_r2_exec_hazard - return if IHB is required on current processor ++ * ++ * Returns non-zero value if the current processor implementation requires ++ * an IHB instruction to deal with an instruction hazard as per MIPS R2 ++ * architecture specification, zero otherwise. ++ */ + #ifndef cpu_has_mips_r2_exec_hazard +-#define cpu_has_mips_r2_exec_hazard cpu_has_mips_r2 ++#define cpu_has_mips_r2_exec_hazard \ ++({ \ ++ int __res; \ ++ \ ++ switch (current_cpu_type()) { \ ++ case CPU_74K: \ ++ case CPU_CAVIUM_OCTEON: \ ++ case CPU_CAVIUM_OCTEON_PLUS: \ ++ case CPU_CAVIUM_OCTEON2: \ ++ __res = 0; \ ++ break; \ ++ \ ++ default: \ ++ __res = 1; \ ++ } \ ++ \ ++ __res; \ ++}) + #endif + + /* +diff --git a/arch/mips/include/asm/mach-cavium-octeon/cpu-feature-overrides.h b/arch/mips/include/asm/mach-cavium-octeon/cpu-feature-overrides.h +index a58addb..6ae8e3c 100644 +--- a/arch/mips/include/asm/mach-cavium-octeon/cpu-feature-overrides.h ++++ b/arch/mips/include/asm/mach-cavium-octeon/cpu-feature-overrides.h +@@ -51,7 +51,6 @@ + #define cpu_has_mips32r2 0 + #define cpu_has_mips64r1 0 + #define cpu_has_mips64r2 1 +-#define cpu_has_mips_r2_exec_hazard 0 + #define cpu_has_dsp 0 + #define cpu_has_mipsmt 0 + #define cpu_has_vint 0 +diff --git a/arch/mips/include/asm/octeon/pci-octeon.h b/arch/mips/include/asm/octeon/pci-octeon.h +index fba2ba2..ac83283 100644 +--- a/arch/mips/include/asm/octeon/pci-octeon.h ++++ b/arch/mips/include/asm/octeon/pci-octeon.h +@@ -11,9 +11,6 @@ + + #include <linux/pci.h> + +-/* Some PCI cards require delays when accessing config space. */ +-#define PCI_CONFIG_SPACE_DELAY 10000 +- + /* + * The physical memory base mapped by BAR1. 256MB at the end of the + * first 4GB. +diff --git a/arch/mips/kernel/irq.c b/arch/mips/kernel/irq.c +index 7f50318..6e489e5 100644 +--- a/arch/mips/kernel/irq.c ++++ b/arch/mips/kernel/irq.c +@@ -111,7 +111,7 @@ void __init init_IRQ(void) + #endif + } + +-#ifdef DEBUG_STACKOVERFLOW ++#ifdef CONFIG_DEBUG_STACKOVERFLOW + static inline void check_stack_overflow(void) + { + unsigned long sp; +diff --git a/arch/mips/mm/cache.c b/arch/mips/mm/cache.c +index 829320c..0f8839b 100644 +--- a/arch/mips/mm/cache.c ++++ b/arch/mips/mm/cache.c +@@ -118,6 +118,18 @@ void __flush_anon_page(struct page *page, unsigned long vmaddr) + + EXPORT_SYMBOL(__flush_anon_page); + ++void __flush_icache_page(struct vm_area_struct *vma, struct page *page) ++{ ++ unsigned long addr; ++ ++ if (PageHighMem(page)) ++ return; ++ ++ addr = (unsigned long) page_address(page); ++ flush_data_cache_page(addr); ++} ++EXPORT_SYMBOL_GPL(__flush_icache_page); ++ + void __update_cache(struct vm_area_struct *vma, unsigned long address, + pte_t pte) + { +diff --git a/arch/mips/pci/pci-octeon.c b/arch/mips/pci/pci-octeon.c +index ed1c542..66d3c38 100644 +--- a/arch/mips/pci/pci-octeon.c ++++ b/arch/mips/pci/pci-octeon.c +@@ -279,9 +279,6 @@ static int octeon_read_config(struct pci_bus *bus, unsigned int devfn, + pci_addr.s.func = devfn & 0x7; + pci_addr.s.reg = reg; + +-#if PCI_CONFIG_SPACE_DELAY +- udelay(PCI_CONFIG_SPACE_DELAY); +-#endif + switch (size) { + case 4: + *val = le32_to_cpu(cvmx_read64_uint32(pci_addr.u64)); +@@ -316,9 +313,6 @@ static int octeon_write_config(struct pci_bus *bus, unsigned int devfn, + pci_addr.s.func = devfn & 0x7; + pci_addr.s.reg = reg; + +-#if PCI_CONFIG_SPACE_DELAY +- udelay(PCI_CONFIG_SPACE_DELAY); +-#endif + switch (size) { + case 4: + cvmx_write64_uint32(pci_addr.u64, cpu_to_le32(val)); +diff --git a/arch/mips/pci/pcie-octeon.c b/arch/mips/pci/pcie-octeon.c +index 0583c463..37a8790 100644 +--- a/arch/mips/pci/pcie-octeon.c ++++ b/arch/mips/pci/pcie-octeon.c +@@ -1219,9 +1219,6 @@ static inline int octeon_pcie_write_config(int pcie_port, struct pci_bus *bus, + devfn & 0x7, reg, val); + return PCIBIOS_SUCCESSFUL; + } +-#if PCI_CONFIG_SPACE_DELAY +- udelay(PCI_CONFIG_SPACE_DELAY); +-#endif + return PCIBIOS_FUNC_NOT_SUPPORTED; + } + +diff --git a/arch/mips/power/hibernate.S b/arch/mips/power/hibernate.S +index 5bf34ec..2ca1735 100644 +--- a/arch/mips/power/hibernate.S ++++ b/arch/mips/power/hibernate.S +@@ -31,6 +31,8 @@ LEAF(swsusp_arch_suspend) + END(swsusp_arch_suspend) + + LEAF(swsusp_arch_resume) ++ /* Avoid TLB mismatch during and after kernel resume */ ++ jal local_flush_tlb_all + PTR_L t0, restore_pblist + 0: + PTR_L t1, PBE_ADDRESS(t0) /* source */ +@@ -44,7 +46,6 @@ LEAF(swsusp_arch_resume) + bne t1, t3, 1b + PTR_L t0, PBE_NEXT(t0) + bnez t0, 0b +- jal local_flush_tlb_all /* Avoid TLB mismatch after kernel resume */ + PTR_LA t0, saved_regs + PTR_L ra, PT_R31(t0) + PTR_L sp, PT_R29(t0) +diff --git a/arch/parisc/kernel/parisc_ksyms.c b/arch/parisc/kernel/parisc_ksyms.c +index a7bb757..c3f1be95 100644 +--- a/arch/parisc/kernel/parisc_ksyms.c ++++ b/arch/parisc/kernel/parisc_ksyms.c +@@ -121,11 +121,13 @@ extern void __ashrdi3(void); + extern void __ashldi3(void); + extern void __lshrdi3(void); + extern void __muldi3(void); ++extern void __ucmpdi2(void); + + EXPORT_SYMBOL(__ashrdi3); + EXPORT_SYMBOL(__ashldi3); + EXPORT_SYMBOL(__lshrdi3); + EXPORT_SYMBOL(__muldi3); ++EXPORT_SYMBOL(__ucmpdi2); + + asmlinkage void * __canonicalize_funcptr_for_compare(void *); + EXPORT_SYMBOL(__canonicalize_funcptr_for_compare); +diff --git a/arch/parisc/lib/Makefile b/arch/parisc/lib/Makefile +index 5f2e690..5651536 100644 +--- a/arch/parisc/lib/Makefile ++++ b/arch/parisc/lib/Makefile +@@ -2,6 +2,7 @@ + # Makefile for parisc-specific library files + # + +-lib-y := lusercopy.o bitops.o checksum.o io.o memset.o fixup.o memcpy.o ++lib-y := lusercopy.o bitops.o checksum.o io.o memset.o fixup.o memcpy.o \ ++ ucmpdi2.o + + obj-y := iomap.o +diff --git a/arch/parisc/lib/ucmpdi2.c b/arch/parisc/lib/ucmpdi2.c +new file mode 100644 +index 0000000..149c016 +--- /dev/null ++++ b/arch/parisc/lib/ucmpdi2.c +@@ -0,0 +1,25 @@ ++#include <linux/module.h> ++ ++union ull_union { ++ unsigned long long ull; ++ struct { ++ unsigned int high; ++ unsigned int low; ++ } ui; ++}; ++ ++int __ucmpdi2(unsigned long long a, unsigned long long b) ++{ ++ union ull_union au = {.ull = a}; ++ union ull_union bu = {.ull = b}; ++ ++ if (au.ui.high < bu.ui.high) ++ return 0; ++ else if (au.ui.high > bu.ui.high) ++ return 2; ++ if (au.ui.low < bu.ui.low) ++ return 0; ++ else if (au.ui.low > bu.ui.low) ++ return 2; ++ return 1; ++} +diff --git a/arch/powerpc/kernel/cacheinfo.c b/arch/powerpc/kernel/cacheinfo.c +index 02ebe1a..4f15565 100644 +--- a/arch/powerpc/kernel/cacheinfo.c ++++ b/arch/powerpc/kernel/cacheinfo.c +@@ -62,12 +62,22 @@ struct cache_type_info { + }; + + /* These are used to index the cache_type_info array. */ +-#define CACHE_TYPE_UNIFIED 0 +-#define CACHE_TYPE_INSTRUCTION 1 +-#define CACHE_TYPE_DATA 2 ++#define CACHE_TYPE_UNIFIED 0 /* cache-size, cache-block-size, etc. */ ++#define CACHE_TYPE_UNIFIED_D 1 /* d-cache-size, d-cache-block-size, etc */ ++#define CACHE_TYPE_INSTRUCTION 2 ++#define CACHE_TYPE_DATA 3 + + static const struct cache_type_info cache_type_info[] = { + { ++ /* Embedded systems that use cache-size, cache-block-size, ++ * etc. for the Unified (typically L2) cache. */ ++ .name = "Unified", ++ .size_prop = "cache-size", ++ .line_size_props = { "cache-line-size", ++ "cache-block-size", }, ++ .nr_sets_prop = "cache-sets", ++ }, ++ { + /* PowerPC Processor binding says the [di]-cache-* + * must be equal on unified caches, so just use + * d-cache properties. */ +@@ -293,7 +303,8 @@ static struct cache *cache_find_first_sibling(struct cache *cache) + { + struct cache *iter; + +- if (cache->type == CACHE_TYPE_UNIFIED) ++ if (cache->type == CACHE_TYPE_UNIFIED || ++ cache->type == CACHE_TYPE_UNIFIED_D) + return cache; + + list_for_each_entry(iter, &cache_list, list) +@@ -324,15 +335,29 @@ static bool cache_node_is_unified(const struct device_node *np) + return of_get_property(np, "cache-unified", NULL); + } + +-static struct cache *__cpuinit cache_do_one_devnode_unified(struct device_node *node, int level) ++/* ++ * Unified caches can have two different sets of tags. Most embedded ++ * use cache-size, etc. for the unified cache size, but open firmware systems ++ * use d-cache-size, etc. Check on initialization for which type we have, and ++ * return the appropriate structure type. Assume it's embedded if it isn't ++ * open firmware. If it's yet a 3rd type, then there will be missing entries ++ * in /sys/devices/system/cpu/cpu0/cache/index2/, and this code will need ++ * to be extended further. ++ */ ++static int cache_is_unified_d(const struct device_node *np) + { +- struct cache *cache; ++ return of_get_property(np, ++ cache_type_info[CACHE_TYPE_UNIFIED_D].size_prop, NULL) ? ++ CACHE_TYPE_UNIFIED_D : CACHE_TYPE_UNIFIED; ++} + ++/* ++ */ ++static struct cache *__cpuinit cache_do_one_devnode_unified(struct device_node *node, int level) ++{ + pr_debug("creating L%d ucache for %s\n", level, node->full_name); + +- cache = new_cache(CACHE_TYPE_UNIFIED, level, node); +- +- return cache; ++ return new_cache(cache_is_unified_d(node), level, node); + } + + static struct cache *__cpuinit cache_do_one_devnode_split(struct device_node *node, int level) +diff --git a/arch/powerpc/kernel/perf_callchain.c b/arch/powerpc/kernel/perf_callchain.c +index 564c1d8..e80026c 100644 +--- a/arch/powerpc/kernel/perf_callchain.c ++++ b/arch/powerpc/kernel/perf_callchain.c +@@ -243,7 +243,7 @@ static void perf_callchain_user_64(struct perf_callchain_entry *entry, + sp = regs->gpr[1]; + perf_callchain_store(entry, next_ip); + +- for (;;) { ++ while (entry->nr < PERF_MAX_STACK_DEPTH) { + fp = (unsigned long __user *) sp; + if (!valid_user_sp(sp, 1) || read_user_stack_64(fp, &next_sp)) + return; +diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c +index 82288e9..83940d7 100644 +--- a/arch/powerpc/kernel/setup-common.c ++++ b/arch/powerpc/kernel/setup-common.c +@@ -428,7 +428,7 @@ void __init smp_setup_cpu_maps(void) + DBG("smp_setup_cpu_maps()\n"); + + while ((dn = of_find_node_by_type(dn, "cpu")) && cpu < nr_cpu_ids) { +- const int *intserv; ++ const __be32 *intserv; + int j, len; + + DBG(" * %s...\n", dn->full_name); +@@ -447,10 +447,18 @@ void __init smp_setup_cpu_maps(void) + } + + for (j = 0; j < nthreads && cpu < nr_cpu_ids; j++) { ++ bool avail; ++ + DBG(" thread %d -> cpu %d (hard id %d)\n", +- j, cpu, intserv[j]); +- set_cpu_present(cpu, of_device_is_available(dn)); +- set_hard_smp_processor_id(cpu, intserv[j]); ++ j, cpu, be32_to_cpu(intserv[j])); ++ ++ avail = of_device_is_available(dn); ++ if (!avail) ++ avail = !of_property_match_string(dn, ++ "enable-method", "spin-table"); ++ ++ set_cpu_present(cpu, avail); ++ set_hard_smp_processor_id(cpu, be32_to_cpu(intserv[j])); + set_cpu_possible(cpu, true); + cpu++; + } +diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S +index 3e8fe4b..cec664a 100644 +--- a/arch/powerpc/kernel/vmlinux.lds.S ++++ b/arch/powerpc/kernel/vmlinux.lds.S +@@ -212,6 +212,7 @@ SECTIONS + *(.opd) + } + ++ . = ALIGN(256); + .got : AT(ADDR(.got) - LOAD_OFFSET) { + __toc_start = .; + *(.got) +diff --git a/arch/powerpc/mm/mmap_64.c b/arch/powerpc/mm/mmap_64.c +index 5a783d8..67a42ed 100644 +--- a/arch/powerpc/mm/mmap_64.c ++++ b/arch/powerpc/mm/mmap_64.c +@@ -53,14 +53,6 @@ static inline int mmap_is_legacy(void) + return sysctl_legacy_va_layout; + } + +-/* +- * Since get_random_int() returns the same value within a 1 jiffy window, +- * we will almost always get the same randomisation for the stack and mmap +- * region. This will mean the relative distance between stack and mmap will +- * be the same. +- * +- * To avoid this we can shift the randomness by 1 bit. +- */ + static unsigned long mmap_rnd(void) + { + unsigned long rnd = 0; +@@ -68,11 +60,11 @@ static unsigned long mmap_rnd(void) + if (current->flags & PF_RANDOMIZE) { + /* 8MB for 32bit, 1GB for 64bit */ + if (is_32bit_task()) +- rnd = (long)(get_random_int() % (1<<(22-PAGE_SHIFT))); ++ rnd = (long)(get_random_int() % (1<<(23-PAGE_SHIFT))); + else +- rnd = (long)(get_random_int() % (1<<(29-PAGE_SHIFT))); ++ rnd = (long)(get_random_int() % (1<<(30-PAGE_SHIFT))); + } +- return (rnd << PAGE_SHIFT) * 2; ++ return rnd << PAGE_SHIFT; + } + + static inline unsigned long mmap_base(void) +diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c +index 0f1b706..2767276 100644 +--- a/arch/powerpc/platforms/pseries/dlpar.c ++++ b/arch/powerpc/platforms/pseries/dlpar.c +@@ -416,6 +416,12 @@ static ssize_t dlpar_cpu_probe(const char *buf, size_t count) + goto out; + } + ++ rc = dlpar_acquire_drc(drc_index); ++ if (rc) { ++ rc = -EINVAL; ++ goto out; ++ } ++ + dn = dlpar_configure_connector(drc_index); + if (!dn) { + rc = -EINVAL; +@@ -436,13 +442,6 @@ static ssize_t dlpar_cpu_probe(const char *buf, size_t count) + kfree(dn->full_name); + dn->full_name = cpu_name; + +- rc = dlpar_acquire_drc(drc_index); +- if (rc) { +- dlpar_free_cc_nodes(dn); +- rc = -EINVAL; +- goto out; +- } +- + rc = dlpar_attach_node(dn); + if (rc) { + dlpar_release_drc(drc_index); +diff --git a/arch/s390/crypto/ghash_s390.c b/arch/s390/crypto/ghash_s390.c +index 31086ea..568521a 100644 +--- a/arch/s390/crypto/ghash_s390.c ++++ b/arch/s390/crypto/ghash_s390.c +@@ -16,11 +16,12 @@ + #define GHASH_DIGEST_SIZE 16 + + struct ghash_ctx { +- u8 icv[16]; +- u8 key[16]; ++ u8 key[GHASH_BLOCK_SIZE]; + }; + + struct ghash_desc_ctx { ++ u8 icv[GHASH_BLOCK_SIZE]; ++ u8 key[GHASH_BLOCK_SIZE]; + u8 buffer[GHASH_BLOCK_SIZE]; + u32 bytes; + }; +@@ -28,8 +29,10 @@ struct ghash_desc_ctx { + static int ghash_init(struct shash_desc *desc) + { + struct ghash_desc_ctx *dctx = shash_desc_ctx(desc); ++ struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm); + + memset(dctx, 0, sizeof(*dctx)); ++ memcpy(dctx->key, ctx->key, GHASH_BLOCK_SIZE); + + return 0; + } +@@ -45,7 +48,6 @@ static int ghash_setkey(struct crypto_shash *tfm, + } + + memcpy(ctx->key, key, GHASH_BLOCK_SIZE); +- memset(ctx->icv, 0, GHASH_BLOCK_SIZE); + + return 0; + } +@@ -54,7 +56,6 @@ static int ghash_update(struct shash_desc *desc, + const u8 *src, unsigned int srclen) + { + struct ghash_desc_ctx *dctx = shash_desc_ctx(desc); +- struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm); + unsigned int n; + u8 *buf = dctx->buffer; + int ret; +@@ -70,7 +71,7 @@ static int ghash_update(struct shash_desc *desc, + src += n; + + if (!dctx->bytes) { +- ret = crypt_s390_kimd(KIMD_GHASH, ctx, buf, ++ ret = crypt_s390_kimd(KIMD_GHASH, dctx, buf, + GHASH_BLOCK_SIZE); + if (ret != GHASH_BLOCK_SIZE) + return -EIO; +@@ -79,7 +80,7 @@ static int ghash_update(struct shash_desc *desc, + + n = srclen & ~(GHASH_BLOCK_SIZE - 1); + if (n) { +- ret = crypt_s390_kimd(KIMD_GHASH, ctx, src, n); ++ ret = crypt_s390_kimd(KIMD_GHASH, dctx, src, n); + if (ret != n) + return -EIO; + src += n; +@@ -94,7 +95,7 @@ static int ghash_update(struct shash_desc *desc, + return 0; + } + +-static int ghash_flush(struct ghash_ctx *ctx, struct ghash_desc_ctx *dctx) ++static int ghash_flush(struct ghash_desc_ctx *dctx) + { + u8 *buf = dctx->buffer; + int ret; +@@ -104,24 +105,24 @@ static int ghash_flush(struct ghash_ctx *ctx, struct ghash_desc_ctx *dctx) + + memset(pos, 0, dctx->bytes); + +- ret = crypt_s390_kimd(KIMD_GHASH, ctx, buf, GHASH_BLOCK_SIZE); ++ ret = crypt_s390_kimd(KIMD_GHASH, dctx, buf, GHASH_BLOCK_SIZE); + if (ret != GHASH_BLOCK_SIZE) + return -EIO; ++ ++ dctx->bytes = 0; + } + +- dctx->bytes = 0; + return 0; + } + + static int ghash_final(struct shash_desc *desc, u8 *dst) + { + struct ghash_desc_ctx *dctx = shash_desc_ctx(desc); +- struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm); + int ret; + +- ret = ghash_flush(ctx, dctx); ++ ret = ghash_flush(dctx); + if (!ret) +- memcpy(dst, ctx->icv, GHASH_BLOCK_SIZE); ++ memcpy(dst, dctx->icv, GHASH_BLOCK_SIZE); + return ret; + } + +diff --git a/arch/s390/kernel/suspend.c b/arch/s390/kernel/suspend.c +index 47df775..ba17092 100644 +--- a/arch/s390/kernel/suspend.c ++++ b/arch/s390/kernel/suspend.c +@@ -9,6 +9,8 @@ + #include <linux/pfn.h> + #include <linux/suspend.h> + #include <linux/mm.h> ++#include <asm/ipl.h> ++#include <asm/sections.h> + #include <asm/system.h> + + /* +@@ -137,6 +139,8 @@ int pfn_is_nosave(unsigned long pfn) + { + unsigned long nosave_begin_pfn = PFN_DOWN(__pa(&__nosave_begin)); + unsigned long nosave_end_pfn = PFN_DOWN(__pa(&__nosave_end)); ++ unsigned long eshared_pfn = PFN_DOWN(__pa(&_eshared)) - 1; ++ unsigned long stext_pfn = PFN_DOWN(__pa(&_stext)); + + /* Always save lowcore pages (LC protection might be enabled). */ + if (pfn <= LC_PAGES) +@@ -144,6 +148,8 @@ int pfn_is_nosave(unsigned long pfn) + if (pfn >= nosave_begin_pfn && pfn < nosave_end_pfn) + return 1; + /* Skip memory holes and read-only pages (NSS, DCSS, ...). */ ++ if (pfn >= stext_pfn && pfn <= eshared_pfn) ++ return ipl_info.type == IPL_TYPE_NSS ? 1 : 0; + if (tprot(PFN_PHYS(pfn))) + return 1; + return 0; +diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c +index d026389..c593e1e 100644 +--- a/arch/s390/kvm/priv.c ++++ b/arch/s390/kvm/priv.c +@@ -219,6 +219,7 @@ static void handle_stsi_3_2_2(struct kvm_vcpu *vcpu, struct sysinfo_3_2_2 *mem) + for (n = mem->count - 1; n > 0 ; n--) + memcpy(&mem->vm[n], &mem->vm[n - 1], sizeof(mem->vm[0])); + ++ memset(&mem->vm[0], 0, sizeof(mem->vm[0])); + mem->vm[0].cpus_total = cpus; + mem->vm[0].cpus_configured = cpus; + mem->vm[0].cpus_standby = 0; +diff --git a/arch/sparc/kernel/leon_pci.c b/arch/sparc/kernel/leon_pci.c +index f1cf6ef..a0ef32e 100644 +--- a/arch/sparc/kernel/leon_pci.c ++++ b/arch/sparc/kernel/leon_pci.c +@@ -78,7 +78,6 @@ EXPORT_SYMBOL(pcibios_bus_to_resource); + + void __devinit pcibios_fixup_bus(struct pci_bus *pbus) + { +- struct leon_pci_info *info = pbus->sysdata; + struct pci_dev *dev; + int i, has_io, has_mem; + u16 cmd; +@@ -153,18 +152,6 @@ int pcibios_enable_device(struct pci_dev *dev, int mask) + return pci_enable_resources(dev, mask); + } + +-struct device_node *pci_device_to_OF_node(struct pci_dev *pdev) +-{ +- /* +- * Currently the OpenBoot nodes are not connected with the PCI device, +- * this is because the LEON PROM does not create PCI nodes. Eventually +- * this will change and the same approach as pcic.c can be used to +- * match PROM nodes with pci devices. +- */ +- return NULL; +-} +-EXPORT_SYMBOL(pci_device_to_OF_node); +- + void __devinit pcibios_update_irq(struct pci_dev *dev, int irq) + { + #ifdef CONFIG_PCI_DEBUG +diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c +index 5e4252b..0ff682d 100644 +--- a/arch/sparc/kernel/sys_sparc_64.c ++++ b/arch/sparc/kernel/sys_sparc_64.c +@@ -368,11 +368,11 @@ static unsigned long mmap_rnd(void) + if (current->flags & PF_RANDOMIZE) { + unsigned long val = get_random_int(); + if (test_thread_flag(TIF_32BIT)) +- rnd = (val % (1UL << (22UL-PAGE_SHIFT))); ++ rnd = (val % (1UL << (23UL-PAGE_SHIFT))); + else +- rnd = (val % (1UL << (29UL-PAGE_SHIFT))); ++ rnd = (val % (1UL << (30UL-PAGE_SHIFT))); + } +- return (rnd << PAGE_SHIFT) * 2; ++ return rnd << PAGE_SHIFT; + } + + void arch_pick_mmap_layout(struct mm_struct *mm) +diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig +index 28a1bca..d720208 100644 +--- a/arch/x86/Kconfig ++++ b/arch/x86/Kconfig +@@ -133,7 +133,8 @@ config SBUS + bool + + config NEED_DMA_MAP_STATE +- def_bool (X86_64 || INTEL_IOMMU || DMA_API_DEBUG) ++ def_bool y ++ depends on X86_64 || INTEL_IOMMU || DMA_API_DEBUG || SWIOTLB + + config NEED_SG_DMA_LENGTH + def_bool y +diff --git a/arch/x86/include/asm/iommu_table.h b/arch/x86/include/asm/iommu_table.h +index f229b13..0c54822 100644 +--- a/arch/x86/include/asm/iommu_table.h ++++ b/arch/x86/include/asm/iommu_table.h +@@ -79,11 +79,12 @@ struct iommu_table_entry { + * d). Similar to the 'init', except that this gets called from pci_iommu_init + * where we do have a memory allocator. + * +- * The standard vs the _FINISH differs in that the _FINISH variant will +- * continue detecting other IOMMUs in the call list after the +- * the detection routine returns a positive number. The _FINISH will +- * stop the execution chain. Both will still call the 'init' and +- * 'late_init' functions if they are set. ++ * The standard IOMMU_INIT differs from the IOMMU_INIT_FINISH variant ++ * in that the former will continue detecting other IOMMUs in the call ++ * list after the detection routine returns a positive number, while the ++ * latter will stop the execution chain upon first successful detection. ++ * Both variants will still call the 'init' and 'late_init' functions if ++ * they are set. + */ + #define IOMMU_INIT_FINISH(_detect, _depend, _init, _late_init) \ + __IOMMU_INIT(_detect, _depend, _init, _late_init, 1) +diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c +index 41b2f57..78842ce 100644 +--- a/arch/x86/kernel/reboot.c ++++ b/arch/x86/kernel/reboot.c +@@ -700,9 +700,12 @@ void native_machine_shutdown(void) + /* Make certain I only run on the appropriate processor */ + set_cpus_allowed_ptr(current, cpumask_of(reboot_cpu_id)); + +- /* O.K Now that I'm on the appropriate processor, +- * stop all of the others. ++ /* ++ * O.K Now that I'm on the appropriate processor, stop all of the ++ * others. Also disable the local irq to not receive the per-cpu ++ * timer interrupt which may trigger scheduler's load balance. + */ ++ local_irq_disable(); + stop_other_cpus(); + #endif + +diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c +index bfc9507..4a949c7 100644 +--- a/arch/x86/kvm/mmu.c ++++ b/arch/x86/kvm/mmu.c +@@ -3609,7 +3609,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa, + } + } + +- mask.cr0_wp = mask.cr4_pae = mask.nxe = 1; ++ mask.cr0_wp = mask.cr4_pae = mask.nxe = mask.smep_andnot_wp = 1; + for_each_gfn_indirect_valid_sp(vcpu->kvm, sp, gfn, node) { + pte_size = sp->role.cr4_pae ? 8 : 4; + misaligned = (offset ^ (offset + bytes - 1)) & ~(pte_size - 1); +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index 8831c43..421958f 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -3032,8 +3032,16 @@ static void vmx_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3) + + static int vmx_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4) + { +- unsigned long hw_cr4 = cr4 | (to_vmx(vcpu)->rmode.vm86_active ? +- KVM_RMODE_VM_CR4_ALWAYS_ON : KVM_PMODE_VM_CR4_ALWAYS_ON); ++ /* ++ * Pass through host's Machine Check Enable value to hw_cr4, which ++ * is in force while we are in guest mode. Do not let guests control ++ * this bit, even if host CR4.MCE == 0. ++ */ ++ unsigned long hw_cr4 = ++ (read_cr4() & X86_CR4_MCE) | ++ (cr4 & ~X86_CR4_MCE) | ++ (to_vmx(vcpu)->rmode.vm86_active ? ++ KVM_RMODE_VM_CR4_ALWAYS_ON : KVM_PMODE_VM_CR4_ALWAYS_ON); + + if (cr4 & X86_CR4_VMXE) { + /* +diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c +index 554b7b5..433b21d 100644 +--- a/arch/x86/lib/usercopy_64.c ++++ b/arch/x86/lib/usercopy_64.c +@@ -113,7 +113,7 @@ long __strnlen_user(const char __user *s, long n) + char c; + + while (1) { +- if (res>n) ++ if (res >= n) + return n+1; + if (__get_user(c, s)) + return 0; +diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c +index 5a5b6e4..11e3100 100644 +--- a/arch/x86/net/bpf_jit_comp.c ++++ b/arch/x86/net/bpf_jit_comp.c +@@ -150,7 +150,12 @@ void bpf_jit_compile(struct sk_filter *fp) + } + cleanup_addr = proglen; /* epilogue address */ + +- for (pass = 0; pass < 10; pass++) { ++ /* JITed image shrinks with every pass and the loop iterates ++ * until the image stops shrinking. Very large bpf programs ++ * may converge on the last pass. In such case do one more ++ * pass to emit the final image ++ */ ++ for (pass = 0; pass < 10 || image; pass++) { + u8 seen_or_pass0 = (pass == 0) ? (SEEN_XREG | SEEN_DATAREF | SEEN_MEM) : seen; + /* no prologue/epilogue for trivial filters (RET something) */ + proglen = 0; +diff --git a/drivers/acpi/acpica/acmacros.h b/drivers/acpi/acpica/acmacros.h +index b7491ee..6454fe6 100644 +--- a/drivers/acpi/acpica/acmacros.h ++++ b/drivers/acpi/acpica/acmacros.h +@@ -59,19 +59,15 @@ + #define ACPI_SET64(ptr) *ACPI_CAST_PTR (u64, ptr) + + /* +- * printf() format helpers ++ * printf() format helper. This macros is a workaround for the difficulties ++ * with emitting 64-bit integers and 64-bit pointers with the same code ++ * for both 32-bit and 64-bit hosts. + */ + + /* Split 64-bit integer into two 32-bit values. Use with %8.8_x%8.8_x */ + + #define ACPI_FORMAT_UINT64(i) ACPI_HIDWORD(i), ACPI_LODWORD(i) + +-#if ACPI_MACHINE_WIDTH == 64 +-#define ACPI_FORMAT_NATIVE_UINT(i) ACPI_FORMAT_UINT64(i) +-#else +-#define ACPI_FORMAT_NATIVE_UINT(i) 0, (i) +-#endif +- + /* + * Macros for moving data around to/from buffers that are possibly unaligned. + * If the hardware supports the transfer of unaligned data, just do the store. +diff --git a/drivers/acpi/acpica/dsopcode.c b/drivers/acpi/acpica/dsopcode.c +index c627a28..9d19587 100644 +--- a/drivers/acpi/acpica/dsopcode.c ++++ b/drivers/acpi/acpica/dsopcode.c +@@ -446,7 +446,7 @@ acpi_ds_eval_region_operands(struct acpi_walk_state *walk_state, + + ACPI_DEBUG_PRINT((ACPI_DB_EXEC, "RgnObj %p Addr %8.8X%8.8X Len %X\n", + obj_desc, +- ACPI_FORMAT_NATIVE_UINT(obj_desc->region.address), ++ ACPI_FORMAT_UINT64(obj_desc->region.address), + obj_desc->region.length)); + + /* Now the address and length are valid for this opregion */ +@@ -545,7 +545,7 @@ acpi_ds_eval_table_region_operands(struct acpi_walk_state *walk_state, + + ACPI_DEBUG_PRINT((ACPI_DB_EXEC, "RgnObj %p Addr %8.8X%8.8X Len %X\n", + obj_desc, +- ACPI_FORMAT_NATIVE_UINT(obj_desc->region.address), ++ ACPI_FORMAT_UINT64(obj_desc->region.address), + obj_desc->region.length)); + + /* Now the address and length are valid for this opregion */ +diff --git a/drivers/acpi/acpica/evregion.c b/drivers/acpi/acpica/evregion.c +index f0edf5c..cb18ab4 100644 +--- a/drivers/acpi/acpica/evregion.c ++++ b/drivers/acpi/acpica/evregion.c +@@ -450,8 +450,8 @@ acpi_ev_address_space_dispatch(union acpi_operand_object *region_obj, + ACPI_DEBUG_PRINT((ACPI_DB_OPREGION, + "Handler %p (@%p) Address %8.8X%8.8X [%s]\n", + ®ion_obj->region.handler->address_space, handler, +- ACPI_FORMAT_NATIVE_UINT(region_obj->region.address + +- region_offset), ++ ACPI_FORMAT_UINT64(region_obj->region.address + ++ region_offset), + acpi_ut_get_region_name(region_obj->region. + space_id))); + +diff --git a/drivers/acpi/acpica/exdump.c b/drivers/acpi/acpica/exdump.c +index 61b8c0e..c572fa0 100644 +--- a/drivers/acpi/acpica/exdump.c ++++ b/drivers/acpi/acpica/exdump.c +@@ -613,8 +613,8 @@ void acpi_ex_dump_operand(union acpi_operand_object *obj_desc, u32 depth) + acpi_os_printf("\n"); + } else { + acpi_os_printf(" base %8.8X%8.8X Length %X\n", +- ACPI_FORMAT_NATIVE_UINT(obj_desc->region. +- address), ++ ACPI_FORMAT_UINT64(obj_desc->region. ++ address), + obj_desc->region.length); + } + break; +diff --git a/drivers/acpi/acpica/exfldio.c b/drivers/acpi/acpica/exfldio.c +index b334f54..be22142 100644 +--- a/drivers/acpi/acpica/exfldio.c ++++ b/drivers/acpi/acpica/exfldio.c +@@ -257,17 +257,15 @@ acpi_ex_access_region(union acpi_operand_object *obj_desc, + } + + ACPI_DEBUG_PRINT_RAW((ACPI_DB_BFIELD, +- " Region [%s:%X], Width %X, ByteBase %X, Offset %X at %p\n", ++ " Region [%s:%X], Width %X, ByteBase %X, Offset %X at %8.8X%8.8X\n", + acpi_ut_get_region_name(rgn_desc->region. + space_id), + rgn_desc->region.space_id, + obj_desc->common_field.access_byte_width, + obj_desc->common_field.base_byte_offset, +- field_datum_byte_offset, ACPI_CAST_PTR(void, +- (rgn_desc-> +- region. +- address + +- region_offset)))); ++ field_datum_byte_offset, ++ ACPI_FORMAT_UINT64(rgn_desc->region.address + ++ region_offset))); + + /* Invoke the appropriate address_space/op_region handler */ + +diff --git a/drivers/acpi/acpica/exregion.c b/drivers/acpi/acpica/exregion.c +index f0d5e14..dd5e930 100644 +--- a/drivers/acpi/acpica/exregion.c ++++ b/drivers/acpi/acpica/exregion.c +@@ -174,7 +174,7 @@ acpi_ex_system_memory_space_handler(u32 function, + if (!mem_info->mapped_logical_address) { + ACPI_ERROR((AE_INFO, + "Could not map memory at 0x%8.8X%8.8X, size %u", +- ACPI_FORMAT_NATIVE_UINT(address), ++ ACPI_FORMAT_UINT64(address), + (u32) map_length)); + mem_info->mapped_length = 0; + return_ACPI_STATUS(AE_NO_MEMORY); +@@ -195,8 +195,7 @@ acpi_ex_system_memory_space_handler(u32 function, + + ACPI_DEBUG_PRINT((ACPI_DB_INFO, + "System-Memory (width %u) R/W %u Address=%8.8X%8.8X\n", +- bit_width, function, +- ACPI_FORMAT_NATIVE_UINT(address))); ++ bit_width, function, ACPI_FORMAT_UINT64(address))); + + /* + * Perform the memory read or write +@@ -298,8 +297,7 @@ acpi_ex_system_io_space_handler(u32 function, + + ACPI_DEBUG_PRINT((ACPI_DB_INFO, + "System-IO (width %u) R/W %u Address=%8.8X%8.8X\n", +- bit_width, function, +- ACPI_FORMAT_NATIVE_UINT(address))); ++ bit_width, function, ACPI_FORMAT_UINT64(address))); + + /* Decode the function parameter */ + +diff --git a/drivers/acpi/acpica/hwvalid.c b/drivers/acpi/acpica/hwvalid.c +index 5f16058..d43b8af 100644 +--- a/drivers/acpi/acpica/hwvalid.c ++++ b/drivers/acpi/acpica/hwvalid.c +@@ -141,17 +141,17 @@ acpi_hw_validate_io_request(acpi_io_address address, u32 bit_width) + byte_width = ACPI_DIV_8(bit_width); + last_address = address + byte_width - 1; + +- ACPI_DEBUG_PRINT((ACPI_DB_IO, "Address %p LastAddress %p Length %X", +- ACPI_CAST_PTR(void, address), ACPI_CAST_PTR(void, +- last_address), +- byte_width)); ++ ACPI_DEBUG_PRINT((ACPI_DB_IO, ++ "Address %8.8X%8.8X LastAddress %8.8X%8.8X Length %X", ++ ACPI_FORMAT_UINT64(address), ++ ACPI_FORMAT_UINT64(last_address), byte_width)); + + /* Maximum 16-bit address in I/O space */ + + if (last_address > ACPI_UINT16_MAX) { + ACPI_ERROR((AE_INFO, +- "Illegal I/O port address/length above 64K: %p/0x%X", +- ACPI_CAST_PTR(void, address), byte_width)); ++ "Illegal I/O port address/length above 64K: %8.8X%8.8X/0x%X", ++ ACPI_FORMAT_UINT64(address), byte_width)); + return_ACPI_STATUS(AE_LIMIT); + } + +@@ -180,8 +180,8 @@ acpi_hw_validate_io_request(acpi_io_address address, u32 bit_width) + + if (acpi_gbl_osi_data >= port_info->osi_dependency) { + ACPI_DEBUG_PRINT((ACPI_DB_IO, +- "Denied AML access to port 0x%p/%X (%s 0x%.4X-0x%.4X)", +- ACPI_CAST_PTR(void, address), ++ "Denied AML access to port 0x%8.8X%8.8X/%X (%s 0x%.4X-0x%.4X)", ++ ACPI_FORMAT_UINT64(address), + byte_width, port_info->name, + port_info->start, + port_info->end)); +diff --git a/drivers/acpi/acpica/nsdump.c b/drivers/acpi/acpica/nsdump.c +index b683cc2..0a68c73 100644 +--- a/drivers/acpi/acpica/nsdump.c ++++ b/drivers/acpi/acpica/nsdump.c +@@ -251,12 +251,11 @@ acpi_ns_dump_one_object(acpi_handle obj_handle, + switch (type) { + case ACPI_TYPE_PROCESSOR: + +- acpi_os_printf("ID %X Len %.4X Addr %p\n", ++ acpi_os_printf("ID %02X Len %02X Addr %8.8X%8.8X\n", + obj_desc->processor.proc_id, + obj_desc->processor.length, +- ACPI_CAST_PTR(void, +- obj_desc->processor. +- address)); ++ ACPI_FORMAT_UINT64(obj_desc->processor. ++ address)); + break; + + case ACPI_TYPE_DEVICE: +@@ -327,8 +326,9 @@ acpi_ns_dump_one_object(acpi_handle obj_handle, + space_id)); + if (obj_desc->region.flags & AOPOBJ_DATA_VALID) { + acpi_os_printf(" Addr %8.8X%8.8X Len %.4X\n", +- ACPI_FORMAT_NATIVE_UINT +- (obj_desc->region.address), ++ ACPI_FORMAT_UINT64(obj_desc-> ++ region. ++ address), + obj_desc->region.length); + } else { + acpi_os_printf +diff --git a/drivers/acpi/acpica/tbinstal.c b/drivers/acpi/acpica/tbinstal.c +index 62365f6..08a3380 100644 +--- a/drivers/acpi/acpica/tbinstal.c ++++ b/drivers/acpi/acpica/tbinstal.c +@@ -228,9 +228,9 @@ acpi_tb_add_table(struct acpi_table_desc *table_desc, u32 *table_index) + status = acpi_os_table_override(table_desc->pointer, &override_table); + if (ACPI_SUCCESS(status) && override_table) { + ACPI_INFO((AE_INFO, +- "%4.4s @ 0x%p Table override, replaced with:", ++ "%4.4s @ 0x%8.8X%8.8X Table override, replaced with:", + table_desc->pointer->signature, +- ACPI_CAST_PTR(void, table_desc->address))); ++ ACPI_FORMAT_UINT64(table_desc->address))); + + /* We can delete the table that was passed as a parameter */ + +diff --git a/drivers/acpi/acpica/tbutils.c b/drivers/acpi/acpica/tbutils.c +index 0f2d395..24de78fe 100644 +--- a/drivers/acpi/acpica/tbutils.c ++++ b/drivers/acpi/acpica/tbutils.c +@@ -237,16 +237,12 @@ acpi_tb_print_table_header(acpi_physical_address address, + { + struct acpi_table_header local_header; + +- /* +- * The reason that the Address is cast to a void pointer is so that we +- * can use %p which will work properly on both 32-bit and 64-bit hosts. +- */ + if (ACPI_COMPARE_NAME(header->signature, ACPI_SIG_FACS)) { + + /* FACS only has signature and length fields */ + +- ACPI_INFO((AE_INFO, "%4.4s %p %05X", +- header->signature, ACPI_CAST_PTR(void, address), ++ ACPI_INFO((AE_INFO, "%4.4s 0x%8.8X%8.8X %05X", ++ header->signature, ACPI_FORMAT_UINT64(address), + header->length)); + } else if (ACPI_COMPARE_NAME(header->signature, ACPI_SIG_RSDP)) { + +@@ -257,8 +253,8 @@ acpi_tb_print_table_header(acpi_physical_address address, + header)->oem_id, ACPI_OEM_ID_SIZE); + acpi_tb_fix_string(local_header.oem_id, ACPI_OEM_ID_SIZE); + +- ACPI_INFO((AE_INFO, "RSDP %p %05X (v%.2d %6.6s)", +- ACPI_CAST_PTR (void, address), ++ ACPI_INFO((AE_INFO, "RSDP 0x%8.8X%8.8X %05X (v%.2d %6.6s)", ++ ACPI_FORMAT_UINT64(address), + (ACPI_CAST_PTR(struct acpi_table_rsdp, header)-> + revision > + 0) ? ACPI_CAST_PTR(struct acpi_table_rsdp, +@@ -272,8 +268,8 @@ acpi_tb_print_table_header(acpi_physical_address address, + acpi_tb_cleanup_table_header(&local_header, header); + + ACPI_INFO((AE_INFO, +- "%4.4s %p %05X (v%.2d %6.6s %8.8s %08X %4.4s %08X)", +- local_header.signature, ACPI_CAST_PTR(void, address), ++ "%-4.4s 0x%8.8X%8.8X %05X (v%.2d %-6.6s %-8.8s %08X %-4.4s %08X)", ++ local_header.signature, ACPI_FORMAT_UINT64(address), + local_header.length, local_header.revision, + local_header.oem_id, local_header.oem_table_id, + local_header.oem_revision, +@@ -488,9 +484,8 @@ acpi_tb_install_table(acpi_physical_address address, + status = acpi_os_table_override(mapped_table, &override_table); + if (ACPI_SUCCESS(status) && override_table) { + ACPI_INFO((AE_INFO, +- "%4.4s @ 0x%p Table override, replaced with:", +- mapped_table->signature, ACPI_CAST_PTR(void, +- address))); ++ "%4.4s @ 0x%8.8X%8.8X Table override, replaced with:", ++ mapped_table->signature, ACPI_FORMAT_UINT64(address))); + + acpi_gbl_root_table_list.tables[table_index].pointer = + override_table; +diff --git a/drivers/acpi/acpica/tbxfroot.c b/drivers/acpi/acpica/tbxfroot.c +index 7eb6c6c..0272fbe 100644 +--- a/drivers/acpi/acpica/tbxfroot.c ++++ b/drivers/acpi/acpica/tbxfroot.c +@@ -119,7 +119,7 @@ static acpi_status acpi_tb_validate_rsdp(struct acpi_table_rsdp *rsdp) + * + ******************************************************************************/ + +-acpi_status acpi_find_root_pointer(acpi_size *table_address) ++acpi_status acpi_find_root_pointer(acpi_physical_address * table_address) + { + u8 *table_ptr; + u8 *mem_rover; +@@ -177,7 +177,8 @@ acpi_status acpi_find_root_pointer(acpi_size *table_address) + physical_address += + (u32) ACPI_PTR_DIFF(mem_rover, table_ptr); + +- *table_address = physical_address; ++ *table_address = ++ (acpi_physical_address) physical_address; + return_ACPI_STATUS(AE_OK); + } + } +@@ -210,7 +211,7 @@ acpi_status acpi_find_root_pointer(acpi_size *table_address) + (ACPI_HI_RSDP_WINDOW_BASE + + ACPI_PTR_DIFF(mem_rover, table_ptr)); + +- *table_address = physical_address; ++ *table_address = (acpi_physical_address) physical_address; + return_ACPI_STATUS(AE_OK); + } + +diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c +index a6664d2..7be7aa6 100644 +--- a/drivers/acpi/osl.c ++++ b/drivers/acpi/osl.c +@@ -179,7 +179,7 @@ static void __init acpi_request_region (struct acpi_generic_address *addr, + request_mem_region(addr->address, length, desc); + } + +-static int __init acpi_reserve_resources(void) ++static void __init acpi_reserve_resources(void) + { + acpi_request_region(&acpi_gbl_FADT.xpm1a_event_block, acpi_gbl_FADT.pm1_event_length, + "ACPI PM1a_EVT_BLK"); +@@ -208,10 +208,7 @@ static int __init acpi_reserve_resources(void) + if (!(acpi_gbl_FADT.gpe1_block_length & 0x1)) + acpi_request_region(&acpi_gbl_FADT.xgpe1_block, + acpi_gbl_FADT.gpe1_block_length, "ACPI GPE1_BLK"); +- +- return 0; + } +-device_initcall(acpi_reserve_resources); + + void acpi_os_printf(const char *fmt, ...) + { +@@ -1630,6 +1627,7 @@ acpi_status __init acpi_os_initialize(void) + + acpi_status __init acpi_os_initialize1(void) + { ++ acpi_reserve_resources(); + kacpid_wq = alloc_workqueue("kacpid", 0, 1); + kacpi_notify_wq = alloc_workqueue("kacpi_notify", 0, 1); + kacpi_hotplug_wq = alloc_workqueue("kacpi_hotplug", 0, 1); +diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c +index 81f32e5..e2958aa 100644 +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -67,6 +67,7 @@ enum board_ids { + board_ahci_yes_fbs, + + /* board IDs for specific chipsets in alphabetical order */ ++ board_ahci_avn, + board_ahci_mcp65, + board_ahci_mcp77, + board_ahci_mcp89, +@@ -85,6 +86,8 @@ enum board_ids { + static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent); + static int ahci_vt8251_hardreset(struct ata_link *link, unsigned int *class, + unsigned long deadline); ++static int ahci_avn_hardreset(struct ata_link *link, unsigned int *class, ++ unsigned long deadline); + static int ahci_p5wdh_hardreset(struct ata_link *link, unsigned int *class, + unsigned long deadline); + #ifdef CONFIG_PM +@@ -108,6 +111,11 @@ static struct ata_port_operations ahci_p5wdh_ops = { + + #define AHCI_HFLAGS(flags) .private_data = (void *)(flags) + ++static struct ata_port_operations ahci_avn_ops = { ++ .inherits = &ahci_ops, ++ .hardreset = ahci_avn_hardreset, ++}; ++ + static const struct ata_port_info ahci_port_info[] = { + /* by features */ + [board_ahci] = +@@ -156,6 +164,12 @@ static const struct ata_port_info ahci_port_info[] = { + .port_ops = &ahci_ops, + }, + /* by chipsets */ ++ [board_ahci_avn] = { ++ .flags = AHCI_FLAG_COMMON, ++ .pio_mask = ATA_PIO4, ++ .udma_mask = ATA_UDMA6, ++ .port_ops = &ahci_avn_ops, ++ }, + [board_ahci_mcp65] = + { + AHCI_HFLAGS (AHCI_HFLAG_NO_FPDMA_AA | AHCI_HFLAG_NO_PMP | +@@ -302,14 +316,14 @@ static const struct pci_device_id ahci_pci_tbl[] = { + { PCI_VDEVICE(INTEL, 0x1f27), board_ahci }, /* Avoton RAID */ + { PCI_VDEVICE(INTEL, 0x1f2e), board_ahci }, /* Avoton RAID */ + { PCI_VDEVICE(INTEL, 0x1f2f), board_ahci }, /* Avoton RAID */ +- { PCI_VDEVICE(INTEL, 0x1f32), board_ahci }, /* Avoton AHCI */ +- { PCI_VDEVICE(INTEL, 0x1f33), board_ahci }, /* Avoton AHCI */ +- { PCI_VDEVICE(INTEL, 0x1f34), board_ahci }, /* Avoton RAID */ +- { PCI_VDEVICE(INTEL, 0x1f35), board_ahci }, /* Avoton RAID */ +- { PCI_VDEVICE(INTEL, 0x1f36), board_ahci }, /* Avoton RAID */ +- { PCI_VDEVICE(INTEL, 0x1f37), board_ahci }, /* Avoton RAID */ +- { PCI_VDEVICE(INTEL, 0x1f3e), board_ahci }, /* Avoton RAID */ +- { PCI_VDEVICE(INTEL, 0x1f3f), board_ahci }, /* Avoton RAID */ ++ { PCI_VDEVICE(INTEL, 0x1f32), board_ahci_avn }, /* Avoton AHCI */ ++ { PCI_VDEVICE(INTEL, 0x1f33), board_ahci_avn }, /* Avoton AHCI */ ++ { PCI_VDEVICE(INTEL, 0x1f34), board_ahci_avn }, /* Avoton RAID */ ++ { PCI_VDEVICE(INTEL, 0x1f35), board_ahci_avn }, /* Avoton RAID */ ++ { PCI_VDEVICE(INTEL, 0x1f36), board_ahci_avn }, /* Avoton RAID */ ++ { PCI_VDEVICE(INTEL, 0x1f37), board_ahci_avn }, /* Avoton RAID */ ++ { PCI_VDEVICE(INTEL, 0x1f3e), board_ahci_avn }, /* Avoton RAID */ ++ { PCI_VDEVICE(INTEL, 0x1f3f), board_ahci_avn }, /* Avoton RAID */ + { PCI_VDEVICE(INTEL, 0x8d02), board_ahci }, /* Wellsburg AHCI */ + { PCI_VDEVICE(INTEL, 0x8d04), board_ahci }, /* Wellsburg RAID */ + { PCI_VDEVICE(INTEL, 0x8d06), board_ahci }, /* Wellsburg RAID */ +@@ -680,6 +694,78 @@ static int ahci_p5wdh_hardreset(struct ata_link *link, unsigned int *class, + return rc; + } + ++/* ++ * ahci_avn_hardreset - attempt more aggressive recovery of Avoton ports. ++ * ++ * It has been observed with some SSDs that the timing of events in the ++ * link synchronization phase can leave the port in a state that can not ++ * be recovered by a SATA-hard-reset alone. The failing signature is ++ * SStatus.DET stuck at 1 ("Device presence detected but Phy ++ * communication not established"). It was found that unloading and ++ * reloading the driver when this problem occurs allows the drive ++ * connection to be recovered (DET advanced to 0x3). The critical ++ * component of reloading the driver is that the port state machines are ++ * reset by bouncing "port enable" in the AHCI PCS configuration ++ * register. So, reproduce that effect by bouncing a port whenever we ++ * see DET==1 after a reset. ++ */ ++static int ahci_avn_hardreset(struct ata_link *link, unsigned int *class, ++ unsigned long deadline) ++{ ++ const unsigned long *timing = sata_ehc_deb_timing(&link->eh_context); ++ struct ata_port *ap = link->ap; ++ struct ahci_port_priv *pp = ap->private_data; ++ u8 *d2h_fis = pp->rx_fis + RX_FIS_D2H_REG; ++ unsigned long tmo = deadline - jiffies; ++ struct ata_taskfile tf; ++ bool online; ++ int rc, i; ++ ++ DPRINTK("ENTER\n"); ++ ++ ahci_stop_engine(ap); ++ ++ for (i = 0; i < 2; i++) { ++ u16 val; ++ u32 sstatus; ++ int port = ap->port_no; ++ struct ata_host *host = ap->host; ++ struct pci_dev *pdev = to_pci_dev(host->dev); ++ ++ /* clear D2H reception area to properly wait for D2H FIS */ ++ ata_tf_init(link->device, &tf); ++ tf.command = ATA_BUSY; ++ ata_tf_to_fis(&tf, 0, 0, d2h_fis); ++ ++ rc = sata_link_hardreset(link, timing, deadline, &online, ++ ahci_check_ready); ++ ++ if (sata_scr_read(link, SCR_STATUS, &sstatus) != 0 || ++ (sstatus & 0xf) != 1) ++ break; ++ ++ ata_link_printk(link, KERN_INFO, "avn bounce port%d\n", ++ port); ++ ++ pci_read_config_word(pdev, 0x92, &val); ++ val &= ~(1 << port); ++ pci_write_config_word(pdev, 0x92, val); ++ ata_msleep(ap, 1000); ++ val |= 1 << port; ++ pci_write_config_word(pdev, 0x92, val); ++ deadline += tmo; ++ } ++ ++ ahci_start_engine(ap); ++ ++ if (online) ++ *class = ahci_dev_classify(ap); ++ ++ DPRINTK("EXIT, rc=%d, class=%u\n", rc, *class); ++ return rc; ++} ++ ++ + #ifdef CONFIG_PM + static int ahci_pci_device_suspend(struct pci_dev *pdev, pm_message_t mesg) + { +diff --git a/drivers/ata/ahci.h b/drivers/ata/ahci.h +index b175000..cdf58f7 100644 +--- a/drivers/ata/ahci.h ++++ b/drivers/ata/ahci.h +@@ -314,6 +314,7 @@ extern struct device_attribute *ahci_sdev_attrs[]; + extern struct ata_port_operations ahci_ops; + extern struct ata_port_operations ahci_pmp_retry_srst_ops; + ++unsigned int ahci_dev_classify(struct ata_port *ap); + void ahci_fill_cmd_slot(struct ahci_port_priv *pp, unsigned int tag, + u32 opts); + void ahci_save_initial_config(struct device *dev, +diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c +index de2802c..41ffb8c 100644 +--- a/drivers/ata/libahci.c ++++ b/drivers/ata/libahci.c +@@ -1137,7 +1137,7 @@ static void ahci_dev_config(struct ata_device *dev) + } + } + +-static unsigned int ahci_dev_classify(struct ata_port *ap) ++unsigned int ahci_dev_classify(struct ata_port *ap) + { + void __iomem *port_mmio = ahci_port_base(ap); + struct ata_taskfile tf; +@@ -1151,6 +1151,7 @@ static unsigned int ahci_dev_classify(struct ata_port *ap) + + return ata_dev_classify(&tf); + } ++EXPORT_SYMBOL_GPL(ahci_dev_classify); + + void ahci_fill_cmd_slot(struct ahci_port_priv *pp, unsigned int tag, + u32 opts) +@@ -1668,8 +1669,7 @@ static void ahci_port_intr(struct ata_port *ap) + if (unlikely(resetting)) + status &= ~PORT_IRQ_BAD_PMP; + +- /* if LPM is enabled, PHYRDY doesn't mean anything */ +- if (ap->link.lpm_policy > ATA_LPM_MAX_POWER) { ++ if (sata_lpm_ignore_phy_events(&ap->link)) { + status &= ~PORT_IRQ_PHYRDY; + ahci_scr_write(&ap->link, SCR_ERROR, SERR_PHYRDY_CHG); + } +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index 5d8fc3d..fcd8586 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -6615,6 +6615,38 @@ u32 ata_wait_register(struct ata_port *ap, void __iomem *reg, u32 mask, u32 val, + return tmp; + } + ++/** ++ * sata_lpm_ignore_phy_events - test if PHY event should be ignored ++ * @link: Link receiving the event ++ * ++ * Test whether the received PHY event has to be ignored or not. ++ * ++ * LOCKING: ++ * None: ++ * ++ * RETURNS: ++ * True if the event has to be ignored. ++ */ ++bool sata_lpm_ignore_phy_events(struct ata_link *link) ++{ ++ unsigned long lpm_timeout = link->last_lpm_change + ++ msecs_to_jiffies(ATA_TMOUT_SPURIOUS_PHY); ++ ++ /* if LPM is enabled, PHYRDY doesn't mean anything */ ++ if (link->lpm_policy > ATA_LPM_MAX_POWER) ++ return true; ++ ++ /* ignore the first PHY event after the LPM policy changed ++ * as it is might be spurious ++ */ ++ if ((link->flags & ATA_LFLAG_CHANGED) && ++ time_before(jiffies, lpm_timeout)) ++ return true; ++ ++ return false; ++} ++EXPORT_SYMBOL_GPL(sata_lpm_ignore_phy_events); ++ + /* + * Dummy port_ops + */ +diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c +index 7d1a478..f54b0775 100644 +--- a/drivers/ata/libata-eh.c ++++ b/drivers/ata/libata-eh.c +@@ -3423,6 +3423,9 @@ static int ata_eh_set_lpm(struct ata_link *link, enum ata_lpm_policy policy, + } + } + ++ link->last_lpm_change = jiffies; ++ link->flags |= ATA_LFLAG_CHANGED; ++ + return 0; + + fail: +diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c +index 3eb6ad2..9f32f43 100644 +--- a/drivers/bluetooth/ath3k.c ++++ b/drivers/bluetooth/ath3k.c +@@ -63,6 +63,7 @@ static struct usb_device_id ath3k_table[] = { + /* Atheros AR3011 with sflash firmware*/ + { USB_DEVICE(0x0489, 0xE027) }, + { USB_DEVICE(0x0489, 0xE03D) }, ++ { USB_DEVICE(0x04F2, 0xAFF1) }, + { USB_DEVICE(0x0930, 0x0215) }, + { USB_DEVICE(0x0CF3, 0x3002) }, + { USB_DEVICE(0x0CF3, 0xE019) }, +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 5c385e5..92973a3 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -148,6 +148,7 @@ static struct usb_device_id blacklist_table[] = { + /* Atheros 3011 with sflash firmware */ + { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE }, + { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE }, ++ { USB_DEVICE(0x04f2, 0xaff1), .driver_info = BTUSB_IGNORE }, + { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE }, + { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE }, + { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE }, +diff --git a/drivers/edac/Kconfig b/drivers/edac/Kconfig +index 5948a21..203361e 100644 +--- a/drivers/edac/Kconfig ++++ b/drivers/edac/Kconfig +@@ -214,7 +214,7 @@ config EDAC_I7300 + + config EDAC_SBRIDGE + tristate "Intel Sandy-Bridge Integrated MC" +- depends on EDAC_MM_EDAC && PCI && X86_64 && X86_MCE_INTEL ++ depends on EDAC_MM_EDAC && PCI && X86 && X86_MCE_INTEL + depends on EXPERIMENTAL + help + Support for error detection and correction the Intel +diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c +index da71881..f8f790c 100644 +--- a/drivers/edac/sb_edac.c ++++ b/drivers/edac/sb_edac.c +@@ -20,6 +20,7 @@ + #include <linux/mmzone.h> + #include <linux/smp.h> + #include <linux/bitmap.h> ++#include <linux/math64.h> + #include <asm/processor.h> + #include <asm/mce.h> + +@@ -671,6 +672,7 @@ static void get_memory_layout(const struct mem_ctl_info *mci) + u32 reg; + u64 limit, prv = 0; + u64 tmp_mb; ++ u32 gb, mb; + u32 rir_way; + + /* +@@ -683,8 +685,9 @@ static void get_memory_layout(const struct mem_ctl_info *mci) + pvt->tolm = GET_TOLM(reg); + tmp_mb = (1 + pvt->tolm) >> 20; + +- debugf0("TOLM: %Lu.%03Lu GB (0x%016Lx)\n", +- tmp_mb / 1000, tmp_mb % 1000, (u64)pvt->tolm); ++ gb = div_u64_rem(tmp_mb, 1024, &mb); ++ debugf0("TOHM: %u.%03u GB (0x%016Lx)\n", ++ gb, (mb*1000)/1024, (u64)pvt->tohm); + + /* Address range is already 45:25 */ + pci_read_config_dword(pvt->pci_sad1, TOHM, +@@ -692,8 +695,9 @@ static void get_memory_layout(const struct mem_ctl_info *mci) + pvt->tohm = GET_TOHM(reg); + tmp_mb = (1 + pvt->tohm) >> 20; + +- debugf0("TOHM: %Lu.%03Lu GB (0x%016Lx)", +- tmp_mb / 1000, tmp_mb % 1000, (u64)pvt->tohm); ++ gb = div_u64_rem(tmp_mb, 1024, &mb); ++ debugf0("TOHM: %u.%03u GB (0x%016Lx)", ++ gb, (mb*1000)/1024, (u64)pvt->tohm); + + /* + * Step 2) Get SAD range and SAD Interleave list +@@ -715,10 +719,11 @@ static void get_memory_layout(const struct mem_ctl_info *mci) + break; + + tmp_mb = (limit + 1) >> 20; +- debugf0("SAD#%d %s up to %Lu.%03Lu GB (0x%016Lx) %s reg=0x%08x\n", ++ gb = div_u64_rem(tmp_mb, 1000, &mb); ++ debugf0("SAD#%d %s up to %u.%03u GB (0x%016Lx) %s reg=0x%08x\n", + n_sads, + get_dram_attr(reg), +- tmp_mb / 1000, tmp_mb % 1000, ++ gb, (mb*1000)/1024, + ((u64)tmp_mb) << 20L, + INTERLEAVE_MODE(reg) ? "Interleave: 8:6" : "Interleave: [8:6]XOR[18:16]", + reg); +@@ -748,8 +753,9 @@ static void get_memory_layout(const struct mem_ctl_info *mci) + break; + tmp_mb = (limit + 1) >> 20; + +- debugf0("TAD#%d: up to %Lu.%03Lu GB (0x%016Lx), socket interleave %d, memory interleave %d, TGT: %d, %d, %d, %d, reg=0x%08x\n", +- n_tads, tmp_mb / 1000, tmp_mb % 1000, ++ gb = div_u64_rem(tmp_mb, 1000, &mb); ++ debugf0("TAD#%d: up to %u.%03u GB (0x%016Lx), socket interleave %d, memory interleave %d, TGT: %d, %d, %d, %d, reg=0x%08x\n", ++ n_tads, gb, (mb*1000)/1024, + ((u64)tmp_mb) << 20L, + (u32)TAD_SOCK(reg), + (u32)TAD_CH(reg), +@@ -772,9 +778,10 @@ static void get_memory_layout(const struct mem_ctl_info *mci) + tad_ch_nilv_offset[j], + ®); + tmp_mb = TAD_OFFSET(reg) >> 20; +- debugf0("TAD CH#%d, offset #%d: %Lu.%03Lu GB (0x%016Lx), reg=0x%08x\n", ++ gb = div_u64_rem(tmp_mb, 1024, &mb); ++ debugf0("TAD CH#%d, offset #%d: %u.%03u GB (0x%016Lx), reg=0x%08x\n", + i, j, +- tmp_mb / 1000, tmp_mb % 1000, ++ gb, (mb*1000)/1024, + ((u64)tmp_mb) << 20L, + reg); + } +@@ -796,9 +803,10 @@ static void get_memory_layout(const struct mem_ctl_info *mci) + + tmp_mb = RIR_LIMIT(reg) >> 20; + rir_way = 1 << RIR_WAY(reg); +- debugf0("CH#%d RIR#%d, limit: %Lu.%03Lu GB (0x%016Lx), way: %d, reg=0x%08x\n", ++ gb = div_u64_rem(tmp_mb, 1024, &mb); ++ debugf0("CH#%d RIR#%d, limit: %u.%03u GB (0x%016Lx), way: %d, reg=0x%08x\n", + i, j, +- tmp_mb / 1000, tmp_mb % 1000, ++ gb, (mb*1000)/1024, + ((u64)tmp_mb) << 20L, + rir_way, + reg); +@@ -809,9 +817,10 @@ static void get_memory_layout(const struct mem_ctl_info *mci) + ®); + tmp_mb = RIR_OFFSET(reg) << 6; + +- debugf0("CH#%d RIR#%d INTL#%d, offset %Lu.%03Lu GB (0x%016Lx), tgt: %d, reg=0x%08x\n", ++ gb = div_u64_rem(tmp_mb, 1024, &mb); ++ debugf0("CH#%d RIR#%d INTL#%d, offset %u.%03u GB (0x%016Lx), tgt: %d, reg=0x%08x\n", + i, j, k, +- tmp_mb / 1000, tmp_mb % 1000, ++ gb, (mb*1000)/1024, + ((u64)tmp_mb) << 20L, + (u32)RIR_RNK_TGT(reg), + reg); +@@ -849,6 +858,7 @@ static int get_memory_error_data(struct mem_ctl_info *mci, + u8 ch_way,sck_way; + u32 tad_offset; + u32 rir_way; ++ u32 gb, mb; + u64 ch_addr, offset, limit, prv = 0; + + +@@ -859,7 +869,7 @@ static int get_memory_error_data(struct mem_ctl_info *mci, + * range (e. g. VGA addresses). It is unlikely, however, that the + * memory controller would generate an error on that range. + */ +- if ((addr > (u64) pvt->tolm) && (addr < (1L << 32))) { ++ if ((addr > (u64) pvt->tolm) && (addr < (1LL << 32))) { + sprintf(msg, "Error at TOLM area, on addr 0x%08Lx", addr); + edac_mc_handle_ce_no_info(mci, msg); + return -EINVAL; +@@ -1054,7 +1064,7 @@ static int get_memory_error_data(struct mem_ctl_info *mci, + ch_addr = addr & 0x7f; + /* Remove socket wayness and remove 6 bits */ + addr >>= 6; +- addr /= sck_xch; ++ addr = div_u64(addr, sck_xch); + #if 0 + /* Divide by channel way */ + addr = addr / ch_way; +@@ -1074,10 +1084,10 @@ static int get_memory_error_data(struct mem_ctl_info *mci, + continue; + + limit = RIR_LIMIT(reg); +- +- debugf0("RIR#%d, limit: %Lu.%03Lu GB (0x%016Lx), way: %d\n", ++ gb = div_u64_rem(limit >> 20, 1024, &mb); ++ debugf0("RIR#%d, limit: %u.%03u GB (0x%016Lx), way: %d\n", + n_rir, +- (limit >> 20) / 1000, (limit >> 20) % 1000, ++ gb, (mb*1000)/1024, + limit, + 1 << RIR_WAY(reg)); + if (ch_addr <= limit) +diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c +index 2861ef4..20f7daa 100644 +--- a/drivers/firmware/dmi_scan.c ++++ b/drivers/firmware/dmi_scan.c +@@ -410,24 +410,48 @@ static void __init dmi_dump_ids(void) + printk(KERN_CONT "\n"); + } + +-static int __init dmi_present(const char __iomem *p) ++static int __init dmi_present(const u8 *buf) + { +- u8 buf[15]; ++ int smbios_ver; + +- memcpy_fromio(buf, p, 15); +- if (dmi_checksum(buf, 15)) { ++ if (memcmp(buf, "_SM_", 4) == 0 && ++ buf[5] < 32 && dmi_checksum(buf, buf[5])) { ++ smbios_ver = (buf[6] << 8) + buf[7]; ++ ++ /* Some BIOS report weird SMBIOS version, fix that up */ ++ switch (smbios_ver) { ++ case 0x021F: ++ case 0x0221: ++ pr_debug("SMBIOS version fixup(2.%d->2.%d)\n", ++ smbios_ver & 0xFF, 3); ++ smbios_ver = 0x0203; ++ break; ++ case 0x0233: ++ pr_debug("SMBIOS version fixup(2.%d->2.%d)\n", 51, 6); ++ smbios_ver = 0x0206; ++ break; ++ } ++ } else { ++ smbios_ver = 0; ++ } ++ ++ buf += 16; ++ ++ if (memcmp(buf, "_DMI_", 5) == 0 && dmi_checksum(buf, 15)) { ++ if (smbios_ver) ++ dmi_ver = smbios_ver; ++ else ++ dmi_ver = (buf[14] & 0xF0) << 4 | (buf[14] & 0x0F); + dmi_num = (buf[13] << 8) | buf[12]; + dmi_len = (buf[7] << 8) | buf[6]; + dmi_base = (buf[11] << 24) | (buf[10] << 16) | + (buf[9] << 8) | buf[8]; + + if (dmi_walk_early(dmi_decode) == 0) { +- if (dmi_ver) ++ if (smbios_ver) { + pr_info("SMBIOS %d.%d present.\n", + dmi_ver >> 8, dmi_ver & 0xFF); +- else { +- dmi_ver = (buf[14] & 0xF0) << 4 | +- (buf[14] & 0x0F); ++ } else { + pr_info("Legacy DMI %d.%d present.\n", + dmi_ver >> 8, dmi_ver & 0xFF); + } +@@ -435,40 +459,14 @@ static int __init dmi_present(const char __iomem *p) + return 0; + } + } +- dmi_ver = 0; +- return 1; +-} + +-static int __init smbios_present(const char __iomem *p) +-{ +- u8 buf[32]; +- +- memcpy_fromio(buf, p, 32); +- if ((buf[5] < 32) && dmi_checksum(buf, buf[5])) { +- dmi_ver = (buf[6] << 8) + buf[7]; +- +- /* Some BIOS report weird SMBIOS version, fix that up */ +- switch (dmi_ver) { +- case 0x021F: +- case 0x0221: +- pr_debug("SMBIOS version fixup(2.%d->2.%d)\n", +- dmi_ver & 0xFF, 3); +- dmi_ver = 0x0203; +- break; +- case 0x0233: +- pr_debug("SMBIOS version fixup(2.%d->2.%d)\n", 51, 6); +- dmi_ver = 0x0206; +- break; +- } +- return memcmp(p + 16, "_DMI_", 5) || dmi_present(p + 16); +- } + return 1; + } + + void __init dmi_scan_machine(void) + { + char __iomem *p, *q; +- int rc; ++ char buf[32]; + + if (efi_enabled(EFI_CONFIG_TABLES)) { + if (efi.smbios == EFI_INVALID_TABLE_ADDR) +@@ -481,10 +479,10 @@ void __init dmi_scan_machine(void) + p = dmi_ioremap(efi.smbios, 32); + if (p == NULL) + goto error; +- +- rc = smbios_present(p); ++ memcpy_fromio(buf, p, 32); + dmi_iounmap(p, 32); +- if (!rc) { ++ ++ if (!dmi_present(buf)) { + dmi_available = 1; + goto out; + } +@@ -499,18 +497,15 @@ void __init dmi_scan_machine(void) + if (p == NULL) + goto error; + ++ memset(buf, 0, 16); + for (q = p; q < p + 0x10000; q += 16) { +- if (memcmp(q, "_SM_", 4) == 0 && q - p <= 0xFFE0) +- rc = smbios_present(q); +- else if (memcmp(q, "_DMI_", 5) == 0) +- rc = dmi_present(q); +- else +- continue; +- if (!rc) { ++ memcpy_fromio(buf + 16, q, 16); ++ if (!dmi_present(buf)) { + dmi_available = 1; + dmi_iounmap(p, 0x10000); + goto out; + } ++ memcpy(buf, buf + 16, 16); + } + dmi_iounmap(p, 0x10000); + } +diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c +index 36ae055..e901fef 100644 +--- a/drivers/gpio/gpiolib.c ++++ b/drivers/gpio/gpiolib.c +@@ -726,6 +726,7 @@ static struct class gpio_class = { + */ + int gpio_export(unsigned gpio, bool direction_may_change) + { ++ struct gpio_chip *chip; + unsigned long flags; + struct gpio_desc *desc; + int status; +@@ -743,10 +744,18 @@ int gpio_export(unsigned gpio, bool direction_may_change) + return -EINVAL; + } + ++ desc = &gpio_desc[gpio]; ++ chip = desc->chip; ++ + mutex_lock(&sysfs_lock); + ++ /* check if chip is being removed */ ++ if (!chip || !chip->exported) { ++ status = -ENODEV; ++ goto fail_unlock; ++ } ++ + spin_lock_irqsave(&gpio_lock, flags); +- desc = &gpio_desc[gpio]; + if (!test_bit(FLAG_REQUESTED, &desc->flags) || + test_bit(FLAG_EXPORT, &desc->flags)) { + spin_unlock_irqrestore(&gpio_lock, flags); +@@ -973,12 +982,15 @@ static void gpiochip_unexport(struct gpio_chip *chip) + { + int status; + struct device *dev; ++ struct gpio_desc *desc; ++ unsigned int i; + + mutex_lock(&sysfs_lock); + dev = class_find_device(&gpio_class, NULL, chip, match_export); + if (dev) { + put_device(dev); + device_unregister(dev); ++ /* prevent further gpiod exports */ + chip->exported = 0; + status = 0; + } else +@@ -988,6 +1000,13 @@ static void gpiochip_unexport(struct gpio_chip *chip) + if (status) + pr_debug("%s: chip %s status %d\n", __func__, + chip->label, status); ++ ++ /* unregister gpio class devices owned by sysfs */ ++ for (i = 0; i < chip->ngpio; i++) { ++ desc = &gpio_desc[chip->base + i]; ++ if (test_and_clear_bit(FLAG_SYSFS, &desc->flags)) ++ gpio_free(chip->base + i); ++ } + } + + static int __init gpiolib_sysfs_init(void) +@@ -1137,6 +1156,8 @@ int gpiochip_remove(struct gpio_chip *chip) + int status = 0; + unsigned id; + ++ gpiochip_unexport(chip); ++ + spin_lock_irqsave(&gpio_lock, flags); + + of_gpiochip_remove(chip); +@@ -1154,9 +1175,6 @@ int gpiochip_remove(struct gpio_chip *chip) + + spin_unlock_irqrestore(&gpio_lock, flags); + +- if (status == 0) +- gpiochip_unexport(chip); +- + return status; + } + EXPORT_SYMBOL_GPL(gpiochip_remove); +diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c +index 927d170..76c4f2a 100644 +--- a/drivers/gpu/drm/radeon/atombios_crtc.c ++++ b/drivers/gpu/drm/radeon/atombios_crtc.c +@@ -302,8 +302,10 @@ atombios_set_crtc_dtd_timing(struct drm_crtc *crtc, + misc |= ATOM_COMPOSITESYNC; + if (mode->flags & DRM_MODE_FLAG_INTERLACE) + misc |= ATOM_INTERLACE; +- if (mode->flags & DRM_MODE_FLAG_DBLSCAN) ++ if (mode->flags & DRM_MODE_FLAG_DBLCLK) + misc |= ATOM_DOUBLE_CLOCK_MODE; ++ if (mode->flags & DRM_MODE_FLAG_DBLSCAN) ++ misc |= ATOM_H_REPLICATIONBY2 | ATOM_V_REPLICATIONBY2; + + args.susModeMiscInfo.usAccess = cpu_to_le16(misc); + args.ucCRTC = radeon_crtc->crtc_id; +@@ -346,8 +348,10 @@ static void atombios_crtc_set_timing(struct drm_crtc *crtc, + misc |= ATOM_COMPOSITESYNC; + if (mode->flags & DRM_MODE_FLAG_INTERLACE) + misc |= ATOM_INTERLACE; +- if (mode->flags & DRM_MODE_FLAG_DBLSCAN) ++ if (mode->flags & DRM_MODE_FLAG_DBLCLK) + misc |= ATOM_DOUBLE_CLOCK_MODE; ++ if (mode->flags & DRM_MODE_FLAG_DBLSCAN) ++ misc |= ATOM_H_REPLICATIONBY2 | ATOM_V_REPLICATIONBY2; + + args.susModeMiscInfo.usAccess = cpu_to_le16(misc); + args.ucCRTC = radeon_crtc->crtc_id; +diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c +index 44a1ea4..a7e6f03 100644 +--- a/drivers/hv/channel.c ++++ b/drivers/hv/channel.c +@@ -177,7 +177,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size, + GFP_KERNEL); + if (!open_info) { + err = -ENOMEM; +- goto error0; ++ goto error_gpadl; + } + + init_completion(&open_info->waitevent); +@@ -193,7 +193,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size, + + if (userdatalen > MAX_USER_DEFINED_BYTES) { + err = -EINVAL; +- goto error0; ++ goto error_gpadl; + } + + if (userdatalen) +@@ -234,6 +234,9 @@ error1: + list_del(&open_info->msglistentry); + spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags); + ++error_gpadl: ++ vmbus_teardown_gpadl(newchannel, newchannel->ringbuffer_gpadlhandle); ++ + error0: + free_pages((unsigned long)out, + get_order(send_ringbuffer_size + recv_ringbuffer_size)); +diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c +index 12b85ff..7f963328b 100644 +--- a/drivers/hv/channel_mgmt.c ++++ b/drivers/hv/channel_mgmt.c +@@ -606,7 +606,7 @@ int vmbus_request_offers(void) + { + struct vmbus_channel_message_header *msg; + struct vmbus_channel_msginfo *msginfo; +- int ret, t; ++ int ret; + + msginfo = kmalloc(sizeof(*msginfo) + + sizeof(struct vmbus_channel_message_header), +@@ -614,8 +614,6 @@ int vmbus_request_offers(void) + if (!msginfo) + return -ENOMEM; + +- init_completion(&msginfo->waitevent); +- + msg = (struct vmbus_channel_message_header *)msginfo->msg; + + msg->msgtype = CHANNELMSG_REQUESTOFFERS; +@@ -629,14 +627,6 @@ int vmbus_request_offers(void) + goto cleanup; + } + +- t = wait_for_completion_timeout(&msginfo->waitevent, 5*HZ); +- if (t == 0) { +- ret = -ETIMEDOUT; +- goto cleanup; +- } +- +- +- + cleanup: + kfree(msginfo); + +diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c +index 055ebeb..c1fef27 100644 +--- a/drivers/infiniband/core/umem.c ++++ b/drivers/infiniband/core/umem.c +@@ -94,12 +94,15 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr, + if (dmasync) + dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs); + ++ if (!size) ++ return ERR_PTR(-EINVAL); ++ + /* + * If the combination of the addr and size requested for this memory + * region causes an integer overflow, return error. + */ +- if ((PAGE_ALIGN(addr + size) <= size) || +- (PAGE_ALIGN(addr + size) <= addr)) ++ if (((addr + size) < addr) || ++ PAGE_ALIGN(addr + size) < (addr + size)) + return ERR_PTR(-EINVAL); + + if (!can_do_mlock()) +diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c +index a16f0c8..2ed14a7 100644 +--- a/drivers/infiniband/hw/mlx4/qp.c ++++ b/drivers/infiniband/hw/mlx4/qp.c +@@ -1670,8 +1670,7 @@ static int build_lso_seg(struct mlx4_wqe_lso_seg *wqe, struct ib_send_wr *wr, + + memcpy(wqe->header, wr->wr.ud.header, wr->wr.ud.hlen); + +- *lso_hdr_sz = cpu_to_be32((wr->wr.ud.mss - wr->wr.ud.hlen) << 16 | +- wr->wr.ud.hlen); ++ *lso_hdr_sz = cpu_to_be32(wr->wr.ud.mss << 16 | wr->wr.ud.hlen); + *lso_seg_len = halign; + return 0; + } +diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c +index 2d5bb5b..548ea99 100644 +--- a/drivers/input/mouse/elantech.c ++++ b/drivers/input/mouse/elantech.c +@@ -296,7 +296,7 @@ static void elantech_report_semi_mt_data(struct input_dev *dev, + unsigned int x2, unsigned int y2) + { + elantech_set_slot(dev, 0, num_fingers != 0, x1, y1); +- elantech_set_slot(dev, 1, num_fingers == 2, x2, y2); ++ elantech_set_slot(dev, 1, num_fingers >= 2, x2, y2); + } + + /* +@@ -692,18 +692,18 @@ static int elantech_packet_check_v3(struct psmouse *psmouse) + static int elantech_packet_check_v4(struct psmouse *psmouse) + { + unsigned char *packet = psmouse->packet; ++ unsigned char packet_type = packet[3] & 0x03; + +- if ((packet[0] & 0x0c) == 0x04 && +- (packet[3] & 0x1f) == 0x11) ++ switch (packet_type) { ++ case 0: ++ return PACKET_V4_STATUS; ++ ++ case 1: + return PACKET_V4_HEAD; + +- if ((packet[0] & 0x0c) == 0x04 && +- (packet[3] & 0x1f) == 0x12) ++ case 2: + return PACKET_V4_MOTION; +- +- if ((packet[0] & 0x0c) == 0x04 && +- (packet[3] & 0x1f) == 0x10) +- return PACKET_V4_STATUS; ++ } + + return PACKET_UNKNOWN; + } +@@ -766,6 +766,21 @@ static psmouse_ret_t elantech_process_byte(struct psmouse *psmouse) + } + + /* ++ * This writes the reg_07 value again to the hardware at the end of every ++ * set_rate call because the register loses its value. reg_07 allows setting ++ * absolute mode on v4 hardware ++ */ ++static void elantech_set_rate_restore_reg_07(struct psmouse *psmouse, ++ unsigned int rate) ++{ ++ struct elantech_data *etd = psmouse->private; ++ ++ etd->original_set_rate(psmouse, rate); ++ if (elantech_write_reg(psmouse, 0x07, etd->reg_07)) ++ psmouse_err(psmouse, "restoring reg_07 failed\n"); ++} ++ ++/* + * Put the touchpad into absolute mode + */ + static int elantech_set_absolute_mode(struct psmouse *psmouse) +@@ -1131,10 +1146,11 @@ static bool elantech_is_signature_valid(const unsigned char *param) + return true; + + /* +- * Some models have a revision higher then 20. Meaning param[2] may +- * be 10 or 20, skip the rates check for these. ++ * Some hw_version >= 4 models have a revision higher then 20. Meaning ++ * that param[2] may be 10 or 20, skip the rates check for these. + */ +- if (param[0] == 0x46 && (param[1] & 0xef) == 0x0f && param[2] < 40) ++ if ((param[0] & 0x0f) >= 0x06 && (param[1] & 0xaf) == 0x0f && ++ param[2] < 40) + return true; + + for (i = 0; i < ARRAY_SIZE(rates); i++) +@@ -1269,6 +1285,12 @@ static int elantech_set_properties(struct elantech_data *etd) + etd->hw_version = 3; + break; + case 6: ++ case 7: ++ case 8: ++ case 9: ++ case 10: ++ case 13: ++ case 14: + etd->hw_version = 4; + break; + default: +@@ -1353,6 +1375,11 @@ int elantech_init(struct psmouse *psmouse) + goto init_fail; + } + ++ if (etd->fw_version == 0x381f17) { ++ etd->original_set_rate = psmouse->set_rate; ++ psmouse->set_rate = elantech_set_rate_restore_reg_07; ++ } ++ + if (elantech_set_input_params(psmouse)) { + psmouse_err(psmouse, "failed to query touchpad range.\n"); + goto init_fail; +diff --git a/drivers/input/mouse/elantech.h b/drivers/input/mouse/elantech.h +index 3569bed..092ac72 100644 +--- a/drivers/input/mouse/elantech.h ++++ b/drivers/input/mouse/elantech.h +@@ -136,6 +136,7 @@ struct elantech_data { + unsigned int width; + struct finger_pos mt[ETP_MAX_FINGERS]; + unsigned char parity[256]; ++ void (*original_set_rate)(struct psmouse *psmouse, unsigned int rate); + }; + + #ifdef CONFIG_MOUSE_PS2_ELANTECH +diff --git a/drivers/lguest/core.c b/drivers/lguest/core.c +index b5fdcb7..34842e5 100644 +--- a/drivers/lguest/core.c ++++ b/drivers/lguest/core.c +@@ -171,7 +171,7 @@ static void unmap_switcher(void) + bool lguest_address_ok(const struct lguest *lg, + unsigned long addr, unsigned long len) + { +- return (addr+len) / PAGE_SIZE < lg->pfn_limit && (addr+len >= addr); ++ return addr+len <= lg->pfn_limit * PAGE_SIZE && (addr+len >= addr); + } + + /* +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index c293d9c..6056ee7 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -1554,7 +1554,8 @@ static int resize_stripes(struct r5conf *conf, int newsize) + + conf->slab_cache = sc; + conf->active_name = 1-conf->active_name; +- conf->pool_size = newsize; ++ if (!err) ++ conf->pool_size = newsize; + return err; + } + +diff --git a/drivers/memstick/core/mspro_block.c b/drivers/memstick/core/mspro_block.c +index 9729b92..f8449d5 100644 +--- a/drivers/memstick/core/mspro_block.c ++++ b/drivers/memstick/core/mspro_block.c +@@ -760,7 +760,7 @@ static int mspro_block_complete_req(struct memstick_dev *card, int error) + + if (error || (card->current_mrq.tpc == MSPRO_CMD_STOP)) { + if (msb->data_dir == READ) { +- for (cnt = 0; cnt < msb->current_seg; cnt++) ++ for (cnt = 0; cnt < msb->current_seg; cnt++) { + t_len += msb->req_sg[cnt].length + / msb->page_size; + +@@ -768,6 +768,7 @@ static int mspro_block_complete_req(struct memstick_dev *card, int error) + t_len += msb->current_page - 1; + + t_len *= msb->page_size; ++ } + } + } else + t_len = blk_rq_bytes(msb->block_req); +diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c +index 411a994..fc7386e 100644 +--- a/drivers/mmc/core/core.c ++++ b/drivers/mmc/core/core.c +@@ -2424,6 +2424,7 @@ int mmc_pm_notify(struct notifier_block *notify_block, + switch (mode) { + case PM_HIBERNATION_PREPARE: + case PM_SUSPEND_PREPARE: ++ case PM_RESTORE_PREPARE: + + spin_lock_irqsave(&host->lock, flags); + host->rescan_disable = 1; +diff --git a/drivers/mtd/ubi/cdev.c b/drivers/mtd/ubi/cdev.c +index ad76592..7ac2c05 100644 +--- a/drivers/mtd/ubi/cdev.c ++++ b/drivers/mtd/ubi/cdev.c +@@ -475,7 +475,7 @@ static long vol_cdev_ioctl(struct file *file, unsigned int cmd, + /* Validate the request */ + err = -EINVAL; + if (req.lnum < 0 || req.lnum >= vol->reserved_pebs || +- req.bytes < 0 || req.lnum >= vol->usable_leb_size) ++ req.bytes < 0 || req.bytes > vol->usable_leb_size) + break; + if (req.dtype != UBI_LONGTERM && req.dtype != UBI_SHORTTERM && + req.dtype != UBI_UNKNOWN) +diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c +index cd26da8..22b3636 100644 +--- a/drivers/mtd/ubi/eba.c ++++ b/drivers/mtd/ubi/eba.c +@@ -1261,7 +1261,8 @@ int ubi_eba_init_scan(struct ubi_device *ubi, struct ubi_scan_info *si) + * during re-size. + */ + ubi_scan_move_to_list(sv, seb, &si->erase); +- vol->eba_tbl[seb->lnum] = seb->pnum; ++ else ++ vol->eba_tbl[seb->lnum] = seb->pnum; + } + } + +diff --git a/drivers/mtd/ubi/misc.c b/drivers/mtd/ubi/misc.c +index f6a7d7a..b14ab43 100644 +--- a/drivers/mtd/ubi/misc.c ++++ b/drivers/mtd/ubi/misc.c +@@ -74,6 +74,8 @@ int ubi_check_volume(struct ubi_device *ubi, int vol_id) + for (i = 0; i < vol->used_ebs; i++) { + int size; + ++ cond_resched(); ++ + if (i == vol->used_ebs - 1) + size = vol->last_eb_bytes; + else +diff --git a/drivers/mtd/ubi/scan.c b/drivers/mtd/ubi/scan.c +index b2b62de..c5b2357 100644 +--- a/drivers/mtd/ubi/scan.c ++++ b/drivers/mtd/ubi/scan.c +@@ -408,7 +408,7 @@ static int compare_lebs(struct ubi_device *ubi, const struct ubi_scan_leb *seb, + second_is_newer = !second_is_newer; + } else { + dbg_bld("PEB %d CRC is OK", pnum); +- bitflips = !!err; ++ bitflips |= !!err; + } + + vfree(buf); +diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c +index cf42971..422e5be 100644 +--- a/drivers/mtd/ubi/wl.c ++++ b/drivers/mtd/ubi/wl.c +@@ -665,7 +665,7 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk, + int cancel) + { + int err, scrubbing = 0, torture = 0, protect = 0, erroneous = 0; +- int vol_id = -1, uninitialized_var(lnum); ++ int vol_id = -1, lnum = -1; + struct ubi_wl_entry *e1, *e2; + struct ubi_vid_hdr *vid_hdr; + +diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c +index 6546191..bd4e598 100644 +--- a/drivers/net/ethernet/intel/e1000/e1000_main.c ++++ b/drivers/net/ethernet/intel/e1000/e1000_main.c +@@ -149,6 +149,11 @@ static bool e1000_clean_rx_irq(struct e1000_adapter *adapter, + static bool e1000_clean_jumbo_rx_irq(struct e1000_adapter *adapter, + struct e1000_rx_ring *rx_ring, + int *work_done, int work_to_do); ++static void e1000_alloc_dummy_rx_buffers(struct e1000_adapter *adapter, ++ struct e1000_rx_ring *rx_ring, ++ int cleaned_count) ++{ ++} + static void e1000_alloc_rx_buffers(struct e1000_adapter *adapter, + struct e1000_rx_ring *rx_ring, + int cleaned_count); +@@ -3322,8 +3327,11 @@ static int e1000_change_mtu(struct net_device *netdev, int new_mtu) + msleep(1); + /* e1000_down has a dependency on max_frame_size */ + hw->max_frame_size = max_frame; +- if (netif_running(netdev)) ++ if (netif_running(netdev)) { ++ /* prevent buffers from being reallocated */ ++ adapter->alloc_rx_buf = e1000_alloc_dummy_rx_buffers; + e1000_down(adapter); ++ } + + /* NOTE: netdev_alloc_skb reserves 16 bytes, and typically NET_IP_ALIGN + * means we reserve 2 more, this pushes us to allocate from the next +diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c +index 9663e0b..bb335ab 100644 +--- a/drivers/net/phy/dp83640.c ++++ b/drivers/net/phy/dp83640.c +@@ -42,7 +42,7 @@ + #define PSF_TX 0x1000 + #define EXT_EVENT 1 + #define CAL_EVENT 7 +-#define CAL_TRIGGER 7 ++#define CAL_TRIGGER 1 + #define PER_TRIGGER 6 + + /* phyter seems to miss the mark by 16 ns */ +diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c +index 1644b1f..ec347d2 100644 +--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c +@@ -367,6 +367,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = { + {RTL_USB_DEVICE(0x2001, 0x3307, rtl92cu_hal_cfg)}, /*D-Link-Cameo*/ + {RTL_USB_DEVICE(0x2001, 0x3309, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/ + {RTL_USB_DEVICE(0x2001, 0x330a, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/ ++ {RTL_USB_DEVICE(0x2001, 0x330d, rtl92cu_hal_cfg)}, /*D-Link DWA-131 */ + {RTL_USB_DEVICE(0x2019, 0xab2b, rtl92cu_hal_cfg)}, /*Planex -Abocom*/ + {RTL_USB_DEVICE(0x20f4, 0x624d, rtl92cu_hal_cfg)}, /*TRENDNet*/ + {RTL_USB_DEVICE(0x2357, 0x0100, rtl92cu_hal_cfg)}, /*TP-Link WN8200ND*/ +diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c +index e5fe956..17e6429 100644 +--- a/drivers/net/wireless/rtlwifi/usb.c ++++ b/drivers/net/wireless/rtlwifi/usb.c +@@ -117,7 +117,7 @@ static int _usbctrl_vendorreq_sync_read(struct usb_device *udev, u8 request, + reqtype = REALTEK_USB_VENQT_READ; + + status = usb_control_msg(udev, pipe, request, reqtype, value, index, +- pdata, len, 0); /* max. timeout */ ++ pdata, len, 1000); + + if (status < 0) + pr_err("reg 0x%x, usbctrl_vendorreq TimeOut! status:0x%x value=0x%x\n", +diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c +index 1ce729d..b7d782f 100644 +--- a/drivers/net/xen-netback/xenbus.c ++++ b/drivers/net/xen-netback/xenbus.c +@@ -27,6 +27,8 @@ struct backend_info { + enum xenbus_state frontend_state; + struct xenbus_watch hotplug_status_watch; + u8 have_hotplug_status_watch:1; ++ ++ const char *hotplug_script; + }; + + static int connect_rings(struct backend_info *); +@@ -45,6 +47,7 @@ static int netback_remove(struct xenbus_device *dev) + xenvif_disconnect(be->vif); + be->vif = NULL; + } ++ kfree(be->hotplug_script); + kfree(be); + dev_set_drvdata(&dev->dev, NULL); + return 0; +@@ -62,6 +65,7 @@ static int netback_probe(struct xenbus_device *dev, + struct xenbus_transaction xbt; + int err; + int sg; ++ const char *script; + struct backend_info *be = kzalloc(sizeof(struct backend_info), + GFP_KERNEL); + if (!be) { +@@ -122,6 +126,15 @@ static int netback_probe(struct xenbus_device *dev, + goto fail; + } + ++ script = xenbus_read(XBT_NIL, dev->nodename, "script", NULL); ++ if (IS_ERR(script)) { ++ err = PTR_ERR(script); ++ xenbus_dev_fatal(dev, err, "reading script"); ++ goto fail; ++ } ++ ++ be->hotplug_script = script; ++ + err = xenbus_switch_state(dev, XenbusStateInitWait); + if (err) + goto fail; +@@ -150,22 +163,14 @@ static int netback_uevent(struct xenbus_device *xdev, + struct kobj_uevent_env *env) + { + struct backend_info *be = dev_get_drvdata(&xdev->dev); +- char *val; + +- val = xenbus_read(XBT_NIL, xdev->nodename, "script", NULL); +- if (IS_ERR(val)) { +- int err = PTR_ERR(val); +- xenbus_dev_fatal(xdev, err, "reading script"); +- return err; +- } else { +- if (add_uevent_var(env, "script=%s", val)) { +- kfree(val); +- return -ENOMEM; +- } +- kfree(val); +- } ++ if (!be) ++ return 0; ++ ++ if (add_uevent_var(env, "script=%s", be->hotplug_script)) ++ return -ENOMEM; + +- if (!be || !be->vif) ++ if (!be->vif) + return 0; + + return add_uevent_var(env, "vif=%s", be->vif->dev->name); +diff --git a/drivers/of/base.c b/drivers/of/base.c +index 37639a6..21935580 100644 +--- a/drivers/of/base.c ++++ b/drivers/of/base.c +@@ -761,6 +761,42 @@ int of_property_read_string_index(struct device_node *np, const char *propname, + } + EXPORT_SYMBOL_GPL(of_property_read_string_index); + ++/** ++ * of_property_match_string() - Find string in a list and return index ++ * @np: pointer to node containing string list property ++ * @propname: string list property name ++ * @string: pointer to string to search for in string list ++ * ++ * This function searches a string list property and returns the index ++ * of a specific string value. ++ */ ++int of_property_match_string(struct device_node *np, const char *propname, ++ const char *string) ++{ ++ struct property *prop = of_find_property(np, propname, NULL); ++ size_t l; ++ int i; ++ const char *p, *end; ++ ++ if (!prop) ++ return -EINVAL; ++ if (!prop->value) ++ return -ENODATA; ++ ++ p = prop->value; ++ end = p + prop->length; ++ ++ for (i = 0; p < end; i++, p += l) { ++ l = strlen(p) + 1; ++ if (p + l > end) ++ return -EILSEQ; ++ pr_debug("comparing %s with %s\n", string, p); ++ if (strcmp(string, p) == 0) ++ return i; /* Found it; return index */ ++ } ++ return -ENODATA; ++} ++EXPORT_SYMBOL_GPL(of_property_match_string); + + /** + * of_property_count_strings - Find and return the number of strings from a +diff --git a/drivers/platform/x86/compal-laptop.c b/drivers/platform/x86/compal-laptop.c +index 8877b83..ba3638e 100644 +--- a/drivers/platform/x86/compal-laptop.c ++++ b/drivers/platform/x86/compal-laptop.c +@@ -1046,7 +1046,14 @@ static int __devinit compal_probe(struct platform_device *pdev) + + /* Power supply */ + initialize_power_supply_data(data); +- power_supply_register(&compal_device->dev, &data->psy); ++ err = power_supply_register(&compal_device->dev, &data->psy); ++ if (err < 0) { ++ hwmon_device_unregister(data->hwmon_dev); ++ sysfs_remove_group(&pdev->dev.kobj, ++ &compal_attribute_group); ++ kfree(data); ++ return err; ++ } + + platform_set_drvdata(pdev, data); + +diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c +index 3868ab2..fb37df6 100644 +--- a/drivers/scsi/3w-9xxx.c ++++ b/drivers/scsi/3w-9xxx.c +@@ -149,7 +149,6 @@ static int twa_reset_sequence(TW_Device_Extension *tw_dev, int soft_reset); + static int twa_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, char *cdb, int use_sg, TW_SG_Entry *sglistarg); + static void twa_scsiop_execute_scsi_complete(TW_Device_Extension *tw_dev, int request_id); + static char *twa_string_lookup(twa_message_type *table, unsigned int aen_code); +-static void twa_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id); + + /* Functions */ + +@@ -1352,11 +1351,11 @@ static irqreturn_t twa_interrupt(int irq, void *dev_instance) + } + + /* Now complete the io */ ++ scsi_dma_unmap(cmd); ++ cmd->scsi_done(cmd); + tw_dev->state[request_id] = TW_S_COMPLETED; + twa_free_request_id(tw_dev, request_id); + tw_dev->posted_request_count--; +- tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]); +- twa_unmap_scsi_data(tw_dev, request_id); + } + + /* Check for valid status after each drain */ +@@ -1414,26 +1413,6 @@ static void twa_load_sgl(TW_Device_Extension *tw_dev, TW_Command_Full *full_comm + } + } /* End twa_load_sgl() */ + +-/* This function will perform a pci-dma mapping for a scatter gather list */ +-static int twa_map_scsi_sg_data(TW_Device_Extension *tw_dev, int request_id) +-{ +- int use_sg; +- struct scsi_cmnd *cmd = tw_dev->srb[request_id]; +- +- use_sg = scsi_dma_map(cmd); +- if (!use_sg) +- return 0; +- else if (use_sg < 0) { +- TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1c, "Failed to map scatter gather list"); +- return 0; +- } +- +- cmd->SCp.phase = TW_PHASE_SGLIST; +- cmd->SCp.have_data_in = use_sg; +- +- return use_sg; +-} /* End twa_map_scsi_sg_data() */ +- + /* This function will poll for a response interrupt of a request */ + static int twa_poll_response(TW_Device_Extension *tw_dev, int request_id, int seconds) + { +@@ -1612,9 +1591,11 @@ static int twa_reset_device_extension(TW_Device_Extension *tw_dev) + (tw_dev->state[i] != TW_S_INITIAL) && + (tw_dev->state[i] != TW_S_COMPLETED)) { + if (tw_dev->srb[i]) { +- tw_dev->srb[i]->result = (DID_RESET << 16); +- tw_dev->srb[i]->scsi_done(tw_dev->srb[i]); +- twa_unmap_scsi_data(tw_dev, i); ++ struct scsi_cmnd *cmd = tw_dev->srb[i]; ++ ++ cmd->result = (DID_RESET << 16); ++ scsi_dma_unmap(cmd); ++ cmd->scsi_done(cmd); + } + } + } +@@ -1793,21 +1774,18 @@ static int twa_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_ + /* Save the scsi command for use by the ISR */ + tw_dev->srb[request_id] = SCpnt; + +- /* Initialize phase to zero */ +- SCpnt->SCp.phase = TW_PHASE_INITIAL; +- + retval = twa_scsiop_execute_scsi(tw_dev, request_id, NULL, 0, NULL); + switch (retval) { + case SCSI_MLQUEUE_HOST_BUSY: ++ scsi_dma_unmap(SCpnt); + twa_free_request_id(tw_dev, request_id); +- twa_unmap_scsi_data(tw_dev, request_id); + break; + case 1: +- tw_dev->state[request_id] = TW_S_COMPLETED; +- twa_free_request_id(tw_dev, request_id); +- twa_unmap_scsi_data(tw_dev, request_id); + SCpnt->result = (DID_ERROR << 16); ++ scsi_dma_unmap(SCpnt); + done(SCpnt); ++ tw_dev->state[request_id] = TW_S_COMPLETED; ++ twa_free_request_id(tw_dev, request_id); + retval = 0; + } + out: +@@ -1875,8 +1853,8 @@ static int twa_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, + command_packet->sg_list[0].address = TW_CPU_TO_SGL(tw_dev->generic_buffer_phys[request_id]); + command_packet->sg_list[0].length = cpu_to_le32(TW_MIN_SGL_LENGTH); + } else { +- sg_count = twa_map_scsi_sg_data(tw_dev, request_id); +- if (sg_count == 0) ++ sg_count = scsi_dma_map(srb); ++ if (sg_count < 0) + goto out; + + scsi_for_each_sg(srb, sg, sg_count, i) { +@@ -1991,15 +1969,6 @@ static char *twa_string_lookup(twa_message_type *table, unsigned int code) + return(table[index].text); + } /* End twa_string_lookup() */ + +-/* This function will perform a pci-dma unmap */ +-static void twa_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id) +-{ +- struct scsi_cmnd *cmd = tw_dev->srb[request_id]; +- +- if (cmd->SCp.phase == TW_PHASE_SGLIST) +- scsi_dma_unmap(cmd); +-} /* End twa_unmap_scsi_data() */ +- + /* This function gets called when a disk is coming on-line */ + static int twa_slave_configure(struct scsi_device *sdev) + { +diff --git a/drivers/scsi/3w-9xxx.h b/drivers/scsi/3w-9xxx.h +index 040f721..0fdc83c 100644 +--- a/drivers/scsi/3w-9xxx.h ++++ b/drivers/scsi/3w-9xxx.h +@@ -324,11 +324,6 @@ static twa_message_type twa_error_table[] = { + #define TW_CURRENT_DRIVER_BUILD 0 + #define TW_CURRENT_DRIVER_BRANCH 0 + +-/* Phase defines */ +-#define TW_PHASE_INITIAL 0 +-#define TW_PHASE_SINGLE 1 +-#define TW_PHASE_SGLIST 2 +- + /* Misc defines */ + #define TW_9550SX_DRAIN_COMPLETED 0xFFFF + #define TW_SECTOR_SIZE 512 +diff --git a/drivers/scsi/3w-sas.c b/drivers/scsi/3w-sas.c +index 13e39e1..c555ccb 100644 +--- a/drivers/scsi/3w-sas.c ++++ b/drivers/scsi/3w-sas.c +@@ -303,26 +303,6 @@ static int twl_post_command_packet(TW_Device_Extension *tw_dev, int request_id) + return 0; + } /* End twl_post_command_packet() */ + +-/* This function will perform a pci-dma mapping for a scatter gather list */ +-static int twl_map_scsi_sg_data(TW_Device_Extension *tw_dev, int request_id) +-{ +- int use_sg; +- struct scsi_cmnd *cmd = tw_dev->srb[request_id]; +- +- use_sg = scsi_dma_map(cmd); +- if (!use_sg) +- return 0; +- else if (use_sg < 0) { +- TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1, "Failed to map scatter gather list"); +- return 0; +- } +- +- cmd->SCp.phase = TW_PHASE_SGLIST; +- cmd->SCp.have_data_in = use_sg; +- +- return use_sg; +-} /* End twl_map_scsi_sg_data() */ +- + /* This function hands scsi cdb's to the firmware */ + static int twl_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, char *cdb, int use_sg, TW_SG_Entry_ISO *sglistarg) + { +@@ -370,8 +350,8 @@ static int twl_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, + if (!sglistarg) { + /* Map sglist from scsi layer to cmd packet */ + if (scsi_sg_count(srb)) { +- sg_count = twl_map_scsi_sg_data(tw_dev, request_id); +- if (sg_count == 0) ++ sg_count = scsi_dma_map(srb); ++ if (sg_count <= 0) + goto out; + + scsi_for_each_sg(srb, sg, sg_count, i) { +@@ -1116,15 +1096,6 @@ out: + return retval; + } /* End twl_initialize_device_extension() */ + +-/* This function will perform a pci-dma unmap */ +-static void twl_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id) +-{ +- struct scsi_cmnd *cmd = tw_dev->srb[request_id]; +- +- if (cmd->SCp.phase == TW_PHASE_SGLIST) +- scsi_dma_unmap(cmd); +-} /* End twl_unmap_scsi_data() */ +- + /* This function will handle attention interrupts */ + static int twl_handle_attention_interrupt(TW_Device_Extension *tw_dev) + { +@@ -1265,11 +1236,11 @@ static irqreturn_t twl_interrupt(int irq, void *dev_instance) + } + + /* Now complete the io */ ++ scsi_dma_unmap(cmd); ++ cmd->scsi_done(cmd); + tw_dev->state[request_id] = TW_S_COMPLETED; + twl_free_request_id(tw_dev, request_id); + tw_dev->posted_request_count--; +- tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]); +- twl_unmap_scsi_data(tw_dev, request_id); + } + + /* Check for another response interrupt */ +@@ -1414,10 +1385,12 @@ static int twl_reset_device_extension(TW_Device_Extension *tw_dev, int ioctl_res + if ((tw_dev->state[i] != TW_S_FINISHED) && + (tw_dev->state[i] != TW_S_INITIAL) && + (tw_dev->state[i] != TW_S_COMPLETED)) { +- if (tw_dev->srb[i]) { +- tw_dev->srb[i]->result = (DID_RESET << 16); +- tw_dev->srb[i]->scsi_done(tw_dev->srb[i]); +- twl_unmap_scsi_data(tw_dev, i); ++ struct scsi_cmnd *cmd = tw_dev->srb[i]; ++ ++ if (cmd) { ++ cmd->result = (DID_RESET << 16); ++ scsi_dma_unmap(cmd); ++ cmd->scsi_done(cmd); + } + } + } +@@ -1521,9 +1494,6 @@ static int twl_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_ + /* Save the scsi command for use by the ISR */ + tw_dev->srb[request_id] = SCpnt; + +- /* Initialize phase to zero */ +- SCpnt->SCp.phase = TW_PHASE_INITIAL; +- + retval = twl_scsiop_execute_scsi(tw_dev, request_id, NULL, 0, NULL); + if (retval) { + tw_dev->state[request_id] = TW_S_COMPLETED; +diff --git a/drivers/scsi/3w-sas.h b/drivers/scsi/3w-sas.h +index d474892..fec6449 100644 +--- a/drivers/scsi/3w-sas.h ++++ b/drivers/scsi/3w-sas.h +@@ -103,10 +103,6 @@ static char *twl_aen_severity_table[] = + #define TW_CURRENT_DRIVER_BUILD 0 + #define TW_CURRENT_DRIVER_BRANCH 0 + +-/* Phase defines */ +-#define TW_PHASE_INITIAL 0 +-#define TW_PHASE_SGLIST 2 +- + /* Misc defines */ + #define TW_SECTOR_SIZE 512 + #define TW_MAX_UNITS 32 +diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c +index 7fe96ff..86bc5f9 100644 +--- a/drivers/scsi/3w-xxxx.c ++++ b/drivers/scsi/3w-xxxx.c +@@ -1283,32 +1283,6 @@ static int tw_initialize_device_extension(TW_Device_Extension *tw_dev) + return 0; + } /* End tw_initialize_device_extension() */ + +-static int tw_map_scsi_sg_data(struct pci_dev *pdev, struct scsi_cmnd *cmd) +-{ +- int use_sg; +- +- dprintk(KERN_WARNING "3w-xxxx: tw_map_scsi_sg_data()\n"); +- +- use_sg = scsi_dma_map(cmd); +- if (use_sg < 0) { +- printk(KERN_WARNING "3w-xxxx: tw_map_scsi_sg_data(): pci_map_sg() failed.\n"); +- return 0; +- } +- +- cmd->SCp.phase = TW_PHASE_SGLIST; +- cmd->SCp.have_data_in = use_sg; +- +- return use_sg; +-} /* End tw_map_scsi_sg_data() */ +- +-static void tw_unmap_scsi_data(struct pci_dev *pdev, struct scsi_cmnd *cmd) +-{ +- dprintk(KERN_WARNING "3w-xxxx: tw_unmap_scsi_data()\n"); +- +- if (cmd->SCp.phase == TW_PHASE_SGLIST) +- scsi_dma_unmap(cmd); +-} /* End tw_unmap_scsi_data() */ +- + /* This function will reset a device extension */ + static int tw_reset_device_extension(TW_Device_Extension *tw_dev) + { +@@ -1331,8 +1305,8 @@ static int tw_reset_device_extension(TW_Device_Extension *tw_dev) + srb = tw_dev->srb[i]; + if (srb != NULL) { + srb->result = (DID_RESET << 16); +- tw_dev->srb[i]->scsi_done(tw_dev->srb[i]); +- tw_unmap_scsi_data(tw_dev->tw_pci_dev, tw_dev->srb[i]); ++ scsi_dma_unmap(srb); ++ srb->scsi_done(srb); + } + } + } +@@ -1779,8 +1753,8 @@ static int tw_scsiop_read_write(TW_Device_Extension *tw_dev, int request_id) + command_packet->byte8.io.lba = lba; + command_packet->byte6.block_count = num_sectors; + +- use_sg = tw_map_scsi_sg_data(tw_dev->tw_pci_dev, tw_dev->srb[request_id]); +- if (!use_sg) ++ use_sg = scsi_dma_map(srb); ++ if (use_sg <= 0) + return 1; + + scsi_for_each_sg(tw_dev->srb[request_id], sg, use_sg, i) { +@@ -1967,9 +1941,6 @@ static int tw_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_c + /* Save the scsi command for use by the ISR */ + tw_dev->srb[request_id] = SCpnt; + +- /* Initialize phase to zero */ +- SCpnt->SCp.phase = TW_PHASE_INITIAL; +- + switch (*command) { + case READ_10: + case READ_6: +@@ -2196,12 +2167,11 @@ static irqreturn_t tw_interrupt(int irq, void *dev_instance) + + /* Now complete the io */ + if ((error != TW_ISR_DONT_COMPLETE)) { ++ scsi_dma_unmap(tw_dev->srb[request_id]); ++ tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]); + tw_dev->state[request_id] = TW_S_COMPLETED; + tw_state_request_finish(tw_dev, request_id); + tw_dev->posted_request_count--; +- tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]); +- +- tw_unmap_scsi_data(tw_dev->tw_pci_dev, tw_dev->srb[request_id]); + } + } + +diff --git a/drivers/scsi/3w-xxxx.h b/drivers/scsi/3w-xxxx.h +index 49dcf03..1d31858 100644 +--- a/drivers/scsi/3w-xxxx.h ++++ b/drivers/scsi/3w-xxxx.h +@@ -195,11 +195,6 @@ static unsigned char tw_sense_table[][4] = + #define TW_AEN_SMART_FAIL 0x000F + #define TW_AEN_SBUF_FAIL 0x0024 + +-/* Phase defines */ +-#define TW_PHASE_INITIAL 0 +-#define TW_PHASE_SINGLE 1 +-#define TW_PHASE_SGLIST 2 +- + /* Misc defines */ + #define TW_ALIGNMENT_6000 64 /* 64 bytes */ + #define TW_ALIGNMENT_7000 4 /* 4 bytes */ +diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c +index bfd87fa..3e0f71c 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c ++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c +@@ -1426,11 +1426,11 @@ megasas_build_ldio_fusion(struct megasas_instance *instance, + fp_possible = io_info.fpOkForIo; + } + +- /* Use smp_processor_id() for now until cmd->request->cpu is CPU ++ /* Use raw_smp_processor_id() for now until cmd->request->cpu is CPU + id by default, not CPU group id, otherwise all MSI-X queues won't + be utilized */ + cmd->request_desc->SCSIIO.MSIxIndex = instance->msix_vectors ? +- smp_processor_id() % instance->msix_vectors : 0; ++ raw_smp_processor_id() % instance->msix_vectors : 0; + + if (fp_possible) { + megasas_set_pd_lba(io_request, scp->cmd_len, &io_info, scp, +diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c +index 5c6b5f5..a50825b 100644 +--- a/drivers/scsi/sd.c ++++ b/drivers/scsi/sd.c +@@ -1338,6 +1338,7 @@ static unsigned int sd_completed_bytes(struct scsi_cmnd *scmd) + { + u64 start_lba = blk_rq_pos(scmd->request); + u64 end_lba = blk_rq_pos(scmd->request) + (scsi_bufflen(scmd) / 512); ++ u64 factor = scmd->device->sector_size / 512; + u64 bad_lba; + int info_valid; + /* +@@ -1359,16 +1360,9 @@ static unsigned int sd_completed_bytes(struct scsi_cmnd *scmd) + if (scsi_bufflen(scmd) <= scmd->device->sector_size) + return 0; + +- if (scmd->device->sector_size < 512) { +- /* only legitimate sector_size here is 256 */ +- start_lba <<= 1; +- end_lba <<= 1; +- } else { +- /* be careful ... don't want any overflows */ +- u64 factor = scmd->device->sector_size / 512; +- do_div(start_lba, factor); +- do_div(end_lba, factor); +- } ++ /* be careful ... don't want any overflows */ ++ do_div(start_lba, factor); ++ do_div(end_lba, factor); + + /* The bad lba was reported incorrectly, we have no idea where + * the error is. +@@ -1895,8 +1889,7 @@ got_data: + if (sector_size != 512 && + sector_size != 1024 && + sector_size != 2048 && +- sector_size != 4096 && +- sector_size != 256) { ++ sector_size != 4096) { + sd_printk(KERN_NOTICE, sdkp, "Unsupported sector size %d.\n", + sector_size); + /* +@@ -1945,8 +1938,6 @@ got_data: + sdkp->capacity <<= 2; + else if (sector_size == 1024) + sdkp->capacity <<= 1; +- else if (sector_size == 256) +- sdkp->capacity >>= 1; + + blk_queue_physical_block_size(sdp->request_queue, + sdkp->physical_block_size); +diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c +index 2d25616..b4cac39 100644 +--- a/drivers/scsi/sg.c ++++ b/drivers/scsi/sg.c +@@ -1687,6 +1687,9 @@ static int sg_start_req(Sg_request *srp, unsigned char *cmd) + md->from_user = 0; + } + ++ if (unlikely(iov_count > UIO_MAXIOV)) ++ return -EINVAL; ++ + if (iov_count) { + int len, size = sizeof(struct sg_iovec) * iov_count; + struct iovec *iov; +diff --git a/drivers/staging/hv/storvsc_drv.c b/drivers/staging/hv/storvsc_drv.c +index c43a9e8..54ef3d4 100644 +--- a/drivers/staging/hv/storvsc_drv.c ++++ b/drivers/staging/hv/storvsc_drv.c +@@ -940,23 +940,24 @@ static unsigned int copy_to_bounce_buffer(struct scatterlist *orig_sgl, + if (bounce_sgl[j].length == PAGE_SIZE) { + /* full..move to next entry */ + kunmap_atomic((void *)bounce_addr, KM_IRQ0); ++ bounce_addr = 0; + j++; ++ } + +- /* if we need to use another bounce buffer */ +- if (srclen || i != orig_sgl_count - 1) +- bounce_addr = ++ /* if we need to use another bounce buffer */ ++ if (srclen && bounce_addr == 0) ++ bounce_addr = + (unsigned long)kmap_atomic( + sg_page((&bounce_sgl[j])), KM_IRQ0); + +- } else if (srclen == 0 && i == orig_sgl_count - 1) { +- /* unmap the last bounce that is < PAGE_SIZE */ +- kunmap_atomic((void *)bounce_addr, KM_IRQ0); +- } + } + + kunmap_atomic((void *)(src_addr - orig_sgl[i].offset), KM_IRQ0); + } + ++ if (bounce_addr) ++ kunmap_atomic((void *)bounce_addr, KM_IRQ0); ++ + local_irq_restore(flags); + + return total_copied; +diff --git a/drivers/staging/line6/pcm.c b/drivers/staging/line6/pcm.c +index 2d3a420..955c6de 100644 +--- a/drivers/staging/line6/pcm.c ++++ b/drivers/staging/line6/pcm.c +@@ -88,10 +88,13 @@ static DEVICE_ATTR(impulse_period, S_IWUSR | S_IRUGO, pcm_get_impulse_period, + + int line6_pcm_start(struct snd_line6_pcm *line6pcm, int channels) + { +- unsigned long flags_old = +- __sync_fetch_and_or(&line6pcm->flags, channels); +- unsigned long flags_new = flags_old | channels; +- int err = 0; ++ unsigned long flags_old, flags_new; ++ int err; ++ ++ do { ++ flags_old = ACCESS_ONCE(line6pcm->flags); ++ flags_new = flags_old | channels; ++ } while (cmpxchg(&line6pcm->flags, flags_old, flags_new) != flags_old); + + #if LINE6_BACKUP_MONITOR_SIGNAL + if (!(line6pcm->line6->properties->capabilities & LINE6_BIT_HWMON)) { +@@ -133,10 +136,8 @@ int line6_pcm_start(struct snd_line6_pcm *line6pcm, int channels) + line6pcm->prev_fsize = 0; + err = line6_submit_audio_in_all_urbs(line6pcm); + +- if (err < 0) { +- __sync_fetch_and_and(&line6pcm->flags, ~channels); +- return err; +- } ++ if (err < 0) ++ goto fail; + } + + if (((flags_old & MASK_PLAYBACK) == 0) && +@@ -160,20 +161,29 @@ int line6_pcm_start(struct snd_line6_pcm *line6pcm, int channels) + line6pcm->count_out = 0; + err = line6_submit_audio_out_all_urbs(line6pcm); + +- if (err < 0) { +- __sync_fetch_and_and(&line6pcm->flags, ~channels); +- return err; +- } ++ if (err < 0) ++ goto fail; + } + + return 0; ++ ++fail: ++ do { ++ flags_old = ACCESS_ONCE(line6pcm->flags); ++ flags_new = flags_old & ~channels; ++ } while (cmpxchg(&line6pcm->flags, flags_old, flags_new) != flags_old); ++ ++ return err; + } + + int line6_pcm_stop(struct snd_line6_pcm *line6pcm, int channels) + { +- unsigned long flags_old = +- __sync_fetch_and_and(&line6pcm->flags, ~channels); +- unsigned long flags_new = flags_old & ~channels; ++ unsigned long flags_old, flags_new; ++ ++ do { ++ flags_old = ACCESS_ONCE(line6pcm->flags); ++ flags_new = flags_old & ~channels; ++ } while (cmpxchg(&line6pcm->flags, flags_old, flags_new) != flags_old); + + if (((flags_old & MASK_CAPTURE) != 0) && + ((flags_new & MASK_CAPTURE) == 0)) { +diff --git a/drivers/staging/panel/panel.c b/drivers/staging/panel/panel.c +index 4683d5f..9a584da 100644 +--- a/drivers/staging/panel/panel.c ++++ b/drivers/staging/panel/panel.c +@@ -274,11 +274,11 @@ static unsigned char lcd_bits[LCD_PORTS][LCD_BITS][BIT_STATES]; + * LCD types + */ + #define LCD_TYPE_NONE 0 +-#define LCD_TYPE_OLD 1 +-#define LCD_TYPE_KS0074 2 +-#define LCD_TYPE_HANTRONIX 3 +-#define LCD_TYPE_NEXCOM 4 +-#define LCD_TYPE_CUSTOM 5 ++#define LCD_TYPE_CUSTOM 1 ++#define LCD_TYPE_OLD 2 ++#define LCD_TYPE_KS0074 3 ++#define LCD_TYPE_HANTRONIX 4 ++#define LCD_TYPE_NEXCOM 5 + + /* + * keypad types +@@ -456,8 +456,7 @@ MODULE_PARM_DESC(keypad_enabled, "Deprecated option, use keypad_type instead"); + static int lcd_type = -1; + module_param(lcd_type, int, 0000); + MODULE_PARM_DESC(lcd_type, +- "LCD type: 0=none, 1=old //, 2=serial ks0074, " +- "3=hantronix //, 4=nexcom //, 5=compiled-in"); ++ "LCD type: 0=none, 1=compiled-in, 2=old, 3=serial ks0074, 4=hantronix, 5=nexcom"); + + static int lcd_proto = -1; + module_param(lcd_proto, int, 0000); +diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c +index ebf9b60..1fb9e58 100644 +--- a/drivers/target/target_core_pscsi.c ++++ b/drivers/target/target_core_pscsi.c +@@ -569,6 +569,7 @@ static struct se_device *pscsi_create_virtdevice( + " pdv_host_id: %d\n", pdv->pdv_host_id); + return ERR_PTR(-EINVAL); + } ++ pdv->pdv_lld_host = sh; + } + } else { + if (phv->phv_mode == PHV_VIRUTAL_HOST_ID) { +@@ -655,6 +656,8 @@ static void pscsi_free_device(void *p) + if ((phv->phv_mode == PHV_LLD_SCSI_HOST_NO) && + (phv->phv_lld_host != NULL)) + scsi_host_put(phv->phv_lld_host); ++ else if (pdv->pdv_lld_host) ++ scsi_host_put(pdv->pdv_lld_host); + + if ((sd->type == TYPE_DISK) || (sd->type == TYPE_ROM)) + scsi_device_put(sd); +diff --git a/drivers/target/target_core_pscsi.h b/drivers/target/target_core_pscsi.h +index fdc17b6..8b0a336 100644 +--- a/drivers/target/target_core_pscsi.h ++++ b/drivers/target/target_core_pscsi.h +@@ -46,6 +46,7 @@ struct pscsi_dev_virt { + struct block_device *pdv_bd; + struct scsi_device *pdv_sd; + struct se_hba *pdv_se_hba; ++ struct Scsi_Host *pdv_lld_host; + } ____cacheline_aligned; + + typedef enum phv_modes { +diff --git a/drivers/tty/hvc/hvc_xen.c b/drivers/tty/hvc/hvc_xen.c +index 52fdf60..df8f8e0 100644 +--- a/drivers/tty/hvc/hvc_xen.c ++++ b/drivers/tty/hvc/hvc_xen.c +@@ -167,7 +167,7 @@ static int __init xen_hvc_init(void) + + if (xen_initial_domain()) { + ops = &dom0_hvc_ops; +- xencons_irq = bind_virq_to_irq(VIRQ_CONSOLE, 0); ++ xencons_irq = bind_virq_to_irq(VIRQ_CONSOLE, 0, false); + } else { + if (!xen_start_info->console.domU.evtchn) + return -ENODEV; +diff --git a/drivers/tty/serial/of_serial.c b/drivers/tty/serial/of_serial.c +index 6563cad..746e771 100644 +--- a/drivers/tty/serial/of_serial.c ++++ b/drivers/tty/serial/of_serial.c +@@ -192,7 +192,6 @@ static struct of_device_id __devinitdata of_platform_serial_table[] = { + { .compatible = "ibm,qpace-nwp-serial", + .data = (void *)PORT_NWPSERIAL, }, + #endif +- { .type = "serial", .data = (void *)PORT_UNKNOWN, }, + { /* end of list */ }, + }; + +diff --git a/drivers/tty/serial/uartlite.c b/drivers/tty/serial/uartlite.c +index 6cd4143..d9706e7 100644 +--- a/drivers/tty/serial/uartlite.c ++++ b/drivers/tty/serial/uartlite.c +@@ -573,7 +573,8 @@ MODULE_DEVICE_TABLE(of, ulite_of_match); + + static int __devinit ulite_probe(struct platform_device *pdev) + { +- struct resource *res, *res2; ++ struct resource *res; ++ int irq; + int id = pdev->id; + #ifdef CONFIG_OF + const __be32 *prop; +@@ -587,11 +588,11 @@ static int __devinit ulite_probe(struct platform_device *pdev) + if (!res) + return -ENODEV; + +- res2 = platform_get_resource(pdev, IORESOURCE_IRQ, 0); +- if (!res2) +- return -ENODEV; ++ irq = platform_get_irq(pdev, 0); ++ if (irq <= 0) ++ return -ENXIO; + +- return ulite_assign(&pdev->dev, id, res->start, res2->start); ++ return ulite_assign(&pdev->dev, id, res->start, irq); + } + + static int __devexit ulite_remove(struct platform_device *pdev) +diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c +index b627363..778c39a 100644 +--- a/drivers/tty/serial/xilinx_uartps.c ++++ b/drivers/tty/serial/xilinx_uartps.c +@@ -941,9 +941,9 @@ static struct uart_driver xuartps_uart_driver = { + **/ + static int __devinit xuartps_probe(struct platform_device *pdev) + { +- int rc; ++ int rc, irq; + struct uart_port *port; +- struct resource *res, *res2; ++ struct resource *res; + int clk = 0; + + #ifdef CONFIG_OF +@@ -964,9 +964,9 @@ static int __devinit xuartps_probe(struct platform_device *pdev) + if (!res) + return -ENODEV; + +- res2 = platform_get_resource(pdev, IORESOURCE_IRQ, 0); +- if (!res2) +- return -ENODEV; ++ irq = platform_get_irq(pdev, 0); ++ if (irq <= 0) ++ return -ENXIO; + + /* Initialize the port structure */ + port = xuartps_get_port(); +@@ -980,7 +980,7 @@ static int __devinit xuartps_probe(struct platform_device *pdev) + * and triggers invocation of the config_port() entry point. + */ + port->mapbase = res->start; +- port->irq = res2->start; ++ port->irq = irq; + port->dev = &pdev->dev; + port->uartclk = clk; + dev_set_drvdata(&pdev->dev, port); +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index 360ddb5..57d6302 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -947,11 +947,16 @@ static int acm_probe(struct usb_interface *intf, + } + + while (buflen > 0) { ++ elength = buffer[0]; ++ if (!elength) { ++ dev_err(&intf->dev, "skipping garbage byte\n"); ++ elength = 1; ++ goto next_desc; ++ } + if (buffer[1] != USB_DT_CS_INTERFACE) { + dev_err(&intf->dev, "skipping garbage\n"); + goto next_desc; + } +- elength = buffer[0]; + + switch (buffer[2]) { + case USB_CDC_UNION_TYPE: /* we've found it */ +diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c +index 06dfb4f..d34005b 100644 +--- a/drivers/usb/class/cdc-wdm.c ++++ b/drivers/usb/class/cdc-wdm.c +@@ -224,7 +224,7 @@ static void wdm_int_callback(struct urb *urb) + case USB_CDC_NOTIFY_RESPONSE_AVAILABLE: + dev_dbg(&desc->intf->dev, + "NOTIFY_RESPONSE_AVAILABLE received: index %d len %d", +- dr->wIndex, dr->wLength); ++ le16_to_cpu(dr->wIndex), le16_to_cpu(dr->wLength)); + break; + + case USB_CDC_NOTIFY_NETWORK_CONNECTION: +@@ -237,14 +237,16 @@ static void wdm_int_callback(struct urb *urb) + clear_bit(WDM_POLL_RUNNING, &desc->flags); + dev_err(&desc->intf->dev, + "unknown notification %d received: index %d len %d\n", +- dr->bNotificationType, dr->wIndex, dr->wLength); ++ dr->bNotificationType, ++ le16_to_cpu(dr->wIndex), ++ le16_to_cpu(dr->wLength)); + goto exit; + } + + req->bRequestType = (USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE); + req->bRequest = USB_CDC_GET_ENCAPSULATED_RESPONSE; + req->wValue = 0; +- req->wIndex = desc->inum; ++ req->wIndex = desc->inum; /* already converted */ + req->wLength = cpu_to_le16(desc->wMaxCommand); + + usb_fill_control_urb( +@@ -401,7 +403,7 @@ static ssize_t wdm_write + USB_RECIP_INTERFACE); + req->bRequest = USB_CDC_SEND_ENCAPSULATED_COMMAND; + req->wValue = 0; +- req->wIndex = desc->inum; ++ req->wIndex = desc->inum; /* already converted */ + req->wLength = cpu_to_le16(count); + set_bit(WDM_IN_USE, &desc->flags); + desc->outbuf = buf; +@@ -414,7 +416,7 @@ static ssize_t wdm_write + dev_err(&desc->intf->dev, "Tx URB error: %d\n", rv); + } else { + dev_dbg(&desc->intf->dev, "Tx URB has been submitted index=%d", +- req->wIndex); ++ le16_to_cpu(req->wIndex)); + } + out: + usb_autopm_put_interface(desc->intf); +diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c +index 25e9eb4..a47e29a 100644 +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -2060,8 +2060,13 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td, + break; + case COMP_DEV_ERR: + case COMP_STALL: ++ frame->status = -EPROTO; ++ skip_td = true; ++ break; + case COMP_TX_ERR: + frame->status = -EPROTO; ++ if (event_trb != td->last_trb) ++ return 0; + skip_td = true; + break; + case COMP_STOP: +@@ -2646,7 +2651,7 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd) + xhci_halt(xhci); + hw_died: + spin_unlock(&xhci->lock); +- return -ESHUTDOWN; ++ return IRQ_HANDLED; + } + + /* +diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h +index efbdf83..d676ae0 100644 +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -1231,7 +1231,7 @@ union xhci_trb { + * since the command ring is 64-byte aligned. + * It must also be greater than 16. + */ +-#define TRBS_PER_SEGMENT 64 ++#define TRBS_PER_SEGMENT 256 + /* Allow two commands + a link TRB, along with any reserved command TRBs */ + #define MAX_RSVD_CMD_TRBS (TRBS_PER_SEGMENT - 3) + #define SEGMENT_SIZE (TRBS_PER_SEGMENT*16) +diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c +index 641caf8..6f7d84e 100644 +--- a/drivers/usb/musb/musb_core.c ++++ b/drivers/usb/musb/musb_core.c +@@ -1524,16 +1524,30 @@ irqreturn_t musb_interrupt(struct musb *musb) + (devctl & MUSB_DEVCTL_HM) ? "host" : "peripheral", + musb->int_usb, musb->int_tx, musb->int_rx); + +- /* the core can interrupt us for multiple reasons; docs have +- * a generic interrupt flowchart to follow ++ /** ++ * According to Mentor Graphics' documentation, flowchart on page 98, ++ * IRQ should be handled as follows: ++ * ++ * . Resume IRQ ++ * . Session Request IRQ ++ * . VBUS Error IRQ ++ * . Suspend IRQ ++ * . Connect IRQ ++ * . Disconnect IRQ ++ * . Reset/Babble IRQ ++ * . SOF IRQ (we're not using this one) ++ * . Endpoint 0 IRQ ++ * . TX Endpoints ++ * . RX Endpoints ++ * ++ * We will be following that flowchart in order to avoid any problems ++ * that might arise with internal Finite State Machine. + */ ++ + if (musb->int_usb) + retval |= musb_stage0_irq(musb, musb->int_usb, + devctl, power); + +- /* "stage 1" is handling endpoint irqs */ +- +- /* handle endpoint 0 first */ + if (musb->int_tx & 1) { + if (devctl & MUSB_DEVCTL_HM) + retval |= musb_h_ep0_irq(musb); +@@ -1541,43 +1555,37 @@ irqreturn_t musb_interrupt(struct musb *musb) + retval |= musb_g_ep0_irq(musb); + } + +- /* RX on endpoints 1-15 */ +- reg = musb->int_rx >> 1; ++ reg = musb->int_tx >> 1; + ep_num = 1; + while (reg) { + if (reg & 1) { +- /* musb_ep_select(musb->mregs, ep_num); */ +- /* REVISIT just retval = ep->rx_irq(...) */ + retval = IRQ_HANDLED; + if (devctl & MUSB_DEVCTL_HM) { + if (is_host_capable()) +- musb_host_rx(musb, ep_num); ++ musb_host_tx(musb, ep_num); + } else { + if (is_peripheral_capable()) +- musb_g_rx(musb, ep_num); ++ musb_g_tx(musb, ep_num); + } + } +- + reg >>= 1; + ep_num++; + } + +- /* TX on endpoints 1-15 */ +- reg = musb->int_tx >> 1; ++ reg = musb->int_rx >> 1; + ep_num = 1; + while (reg) { + if (reg & 1) { +- /* musb_ep_select(musb->mregs, ep_num); */ +- /* REVISIT just retval |= ep->tx_irq(...) */ + retval = IRQ_HANDLED; + if (devctl & MUSB_DEVCTL_HM) { + if (is_host_capable()) +- musb_host_tx(musb, ep_num); ++ musb_host_rx(musb, ep_num); + } else { + if (is_peripheral_capable()) +- musb_g_tx(musb, ep_num); ++ musb_g_rx(musb, ep_num); + } + } ++ + reg >>= 1; + ep_num++; + } +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index 7f32c74..073a0f98 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -133,6 +133,8 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */ + { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */ + { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */ ++ { USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */ ++ { USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */ + { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */ + { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */ + { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */ +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index e13ebb0..8257d3b 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -723,6 +723,7 @@ static struct usb_device_id id_table_combined [] = { + { USB_DEVICE(XSENS_VID, XSENS_AWINDA_DONGLE_PID) }, + { USB_DEVICE(XSENS_VID, XSENS_AWINDA_STATION_PID) }, + { USB_DEVICE(XSENS_VID, XSENS_CONVERTER_PID) }, ++ { USB_DEVICE(XSENS_VID, XSENS_MTDEVBOARD_PID) }, + { USB_DEVICE(XSENS_VID, XSENS_MTW_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_OMNI1509) }, + { USB_DEVICE(MOBILITY_VID, MOBILITY_USB_SERIAL_PID) }, +diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h +index 361192c..e4a57bb 100644 +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -155,6 +155,7 @@ + #define XSENS_AWINDA_STATION_PID 0x0101 + #define XSENS_AWINDA_DONGLE_PID 0x0102 + #define XSENS_MTW_PID 0x0200 /* Xsens MTw */ ++#define XSENS_MTDEVBOARD_PID 0x0300 /* Motion Tracker Development Board */ + #define XSENS_CONVERTER_PID 0xD00D /* Xsens USB-serial converter */ + + /* Xsens devices using FTDI VID */ +diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c +index 7ba38ea..a440387 100644 +--- a/drivers/usb/serial/pl2303.c ++++ b/drivers/usb/serial/pl2303.c +@@ -67,7 +67,6 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(DCU10_VENDOR_ID, DCU10_PRODUCT_ID) }, + { USB_DEVICE(SITECOM_VENDOR_ID, SITECOM_PRODUCT_ID) }, + { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_ID) }, +- { USB_DEVICE(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_ID) }, + { USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_SX1) }, + { USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_X65) }, + { USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_X75) }, +diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h +index 71fd9da..e3b7af8 100644 +--- a/drivers/usb/serial/pl2303.h ++++ b/drivers/usb/serial/pl2303.h +@@ -62,10 +62,6 @@ + #define ALCATEL_VENDOR_ID 0x11f7 + #define ALCATEL_PRODUCT_ID 0x02df + +-/* Samsung I330 phone cradle */ +-#define SAMSUNG_VENDOR_ID 0x04e8 +-#define SAMSUNG_PRODUCT_ID 0x8001 +- + #define SIEMENS_VENDOR_ID 0x11f5 + #define SIEMENS_PRODUCT_ID_SX1 0x0001 + #define SIEMENS_PRODUCT_ID_X65 0x0003 +diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h +index 0e2c2de..68e8552 100644 +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -752,6 +752,13 @@ UNUSUAL_DEV( 0x059f, 0x0643, 0x0000, 0x0000, + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_GO_SLOW ), + ++/* Reported by Christian Schaller <cschalle@redhat.com> */ ++UNUSUAL_DEV( 0x059f, 0x0651, 0x0000, 0x0000, ++ "LaCie", ++ "External HDD", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_NO_WP_DETECT ), ++ + /* Submitted by Joel Bourquard <numlock@freesurf.ch> + * Some versions of this device need the SubClass and Protocol overrides + * while others don't. +diff --git a/drivers/xen/events.c b/drivers/xen/events.c +index f6227cc..bcf7711 100644 +--- a/drivers/xen/events.c ++++ b/drivers/xen/events.c +@@ -895,7 +895,7 @@ static int find_virq(unsigned int virq, unsigned int cpu) + return rc; + } + +-int bind_virq_to_irq(unsigned int virq, unsigned int cpu) ++int bind_virq_to_irq(unsigned int virq, unsigned int cpu, bool percpu) + { + struct evtchn_bind_virq bind_virq; + int evtchn, irq, ret; +@@ -909,8 +909,12 @@ int bind_virq_to_irq(unsigned int virq, unsigned int cpu) + if (irq == -1) + goto out; + +- irq_set_chip_and_handler_name(irq, &xen_percpu_chip, +- handle_percpu_irq, "virq"); ++ if (percpu) ++ irq_set_chip_and_handler_name(irq, &xen_percpu_chip, ++ handle_percpu_irq, "virq"); ++ else ++ irq_set_chip_and_handler_name(irq, &xen_dynamic_chip, ++ handle_edge_irq, "virq"); + + bind_virq.virq = virq; + bind_virq.vcpu = cpu; +@@ -1023,7 +1027,7 @@ int bind_virq_to_irqhandler(unsigned int virq, unsigned int cpu, + { + int irq, retval; + +- irq = bind_virq_to_irq(virq, cpu); ++ irq = bind_virq_to_irq(virq, cpu, irqflags & IRQF_PERCPU); + if (irq < 0) + return irq; + retval = request_irq(irq, handler, irqflags, devname, dev_id); +diff --git a/drivers/xen/xen-pciback/conf_space.c b/drivers/xen/xen-pciback/conf_space.c +index 82ab1c3..bb8cb69 100644 +--- a/drivers/xen/xen-pciback/conf_space.c ++++ b/drivers/xen/xen-pciback/conf_space.c +@@ -16,8 +16,8 @@ + #include "conf_space.h" + #include "conf_space_quirks.h" + +-bool permissive; +-module_param(permissive, bool, 0644); ++bool xen_pcibk_permissive; ++module_param_named(permissive, xen_pcibk_permissive, bool, 0644); + + /* This is where xen_pcibk_read_config_byte, xen_pcibk_read_config_word, + * xen_pcibk_write_config_word, and xen_pcibk_write_config_byte are created. */ +@@ -262,7 +262,7 @@ int xen_pcibk_config_write(struct pci_dev *dev, int offset, int size, u32 value) + * This means that some fields may still be read-only because + * they have entries in the config_field list that intercept + * the write and do nothing. */ +- if (dev_data->permissive || permissive) { ++ if (dev_data->permissive || xen_pcibk_permissive) { + switch (size) { + case 1: + err = pci_write_config_byte(dev, offset, +diff --git a/drivers/xen/xen-pciback/conf_space.h b/drivers/xen/xen-pciback/conf_space.h +index 2e1d73d..62461a8 100644 +--- a/drivers/xen/xen-pciback/conf_space.h ++++ b/drivers/xen/xen-pciback/conf_space.h +@@ -64,7 +64,7 @@ struct config_field_entry { + void *data; + }; + +-extern bool permissive; ++extern bool xen_pcibk_permissive; + + #define OFFSET(cfg_entry) ((cfg_entry)->base_offset+(cfg_entry)->field->offset) + +diff --git a/drivers/xen/xen-pciback/conf_space_header.c b/drivers/xen/xen-pciback/conf_space_header.c +index a5bb81a..1667a90 100644 +--- a/drivers/xen/xen-pciback/conf_space_header.c ++++ b/drivers/xen/xen-pciback/conf_space_header.c +@@ -105,7 +105,7 @@ static int command_write(struct pci_dev *dev, int offset, u16 value, void *data) + + cmd->val = value; + +- if (!permissive && (!dev_data || !dev_data->permissive)) ++ if (!xen_pcibk_permissive && (!dev_data || !dev_data->permissive)) + return 0; + + /* Only allow the guest to control certain bits. */ +diff --git a/firmware/ihex2fw.c b/firmware/ihex2fw.c +index cf38e15..08d90e2 100644 +--- a/firmware/ihex2fw.c ++++ b/firmware/ihex2fw.c +@@ -86,6 +86,7 @@ int main(int argc, char **argv) + case 'j': + include_jump = 1; + break; ++ default: + return usage(); + } + } +diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c +index 2aed667..d252462 100644 +--- a/fs/binfmt_elf.c ++++ b/fs/binfmt_elf.c +@@ -746,6 +746,7 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs) + i < loc->elf_ex.e_phnum; i++, elf_ppnt++) { + int elf_prot = 0, elf_flags; + unsigned long k, vaddr; ++ unsigned long total_size = 0; + + if (elf_ppnt->p_type != PT_LOAD) + continue; +@@ -809,10 +810,16 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs) + #else + load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr); + #endif ++ total_size = total_mapping_size(elf_phdata, ++ loc->elf_ex.e_phnum); ++ if (!total_size) { ++ retval = -EINVAL; ++ goto out_free_dentry; ++ } + } + + error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt, +- elf_prot, elf_flags, 0); ++ elf_prot, elf_flags, total_size); + if (BAD_ADDR(error)) { + send_sig(SIGKILL, current, 0); + retval = IS_ERR((void *)error) ? +diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c +index a694317..da528f8 100644 +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -5678,12 +5678,11 @@ static int __btrfs_free_reserved_extent(struct btrfs_root *root, + return -ENOSPC; + } + +- if (btrfs_test_opt(root, DISCARD)) +- ret = btrfs_discard_extent(root, start, len, NULL); +- + if (pin) + pin_down_extent(root, cache, start, len, 1); + else { ++ if (btrfs_test_opt(root, DISCARD)) ++ ret = btrfs_discard_extent(root, start, len, NULL); + btrfs_add_free_space(cache, start, len); + btrfs_update_reserved_bytes(cache, len, RESERVE_FREE); + } +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index 7cbe2f8..52bacff 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -2263,6 +2263,11 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd, + if (off + len == src->i_size) + len = ALIGN(src->i_size, bs) - off; + ++ if (len == 0) { ++ ret = 0; ++ goto out_unlock; ++ } ++ + /* verify the end result is block aligned */ + if (!IS_ALIGNED(off, bs) || !IS_ALIGNED(off + len, bs) || + !IS_ALIGNED(destoff, bs)) +diff --git a/fs/btrfs/xattr.c b/fs/btrfs/xattr.c +index 3848b04..60ff45e 100644 +--- a/fs/btrfs/xattr.c ++++ b/fs/btrfs/xattr.c +@@ -310,21 +310,40 @@ const struct xattr_handler *btrfs_xattr_handlers[] = { + /* + * Check if the attribute is in a supported namespace. + * +- * This applied after the check for the synthetic attributes in the system ++ * This is applied after the check for the synthetic attributes in the system + * namespace. + */ +-static bool btrfs_is_valid_xattr(const char *name) ++static int btrfs_is_valid_xattr(const char *name) + { +- return !strncmp(name, XATTR_SECURITY_PREFIX, +- XATTR_SECURITY_PREFIX_LEN) || +- !strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN) || +- !strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN) || +- !strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN); ++ int len = strlen(name); ++ int prefixlen = 0; ++ ++ if (!strncmp(name, XATTR_SECURITY_PREFIX, ++ XATTR_SECURITY_PREFIX_LEN)) ++ prefixlen = XATTR_SECURITY_PREFIX_LEN; ++ else if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN)) ++ prefixlen = XATTR_SYSTEM_PREFIX_LEN; ++ else if (!strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN)) ++ prefixlen = XATTR_TRUSTED_PREFIX_LEN; ++ else if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN)) ++ prefixlen = XATTR_USER_PREFIX_LEN; ++ else ++ return -EOPNOTSUPP; ++ ++ /* ++ * The name cannot consist of just prefix ++ */ ++ if (len <= prefixlen) ++ return -EINVAL; ++ ++ return 0; + } + + ssize_t btrfs_getxattr(struct dentry *dentry, const char *name, + void *buffer, size_t size) + { ++ int ret; ++ + /* + * If this is a request for a synthetic attribute in the system.* + * namespace use the generic infrastructure to resolve a handler +@@ -333,8 +352,9 @@ ssize_t btrfs_getxattr(struct dentry *dentry, const char *name, + if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN)) + return generic_getxattr(dentry, name, buffer, size); + +- if (!btrfs_is_valid_xattr(name)) +- return -EOPNOTSUPP; ++ ret = btrfs_is_valid_xattr(name); ++ if (ret) ++ return ret; + return __btrfs_getxattr(dentry->d_inode, name, buffer, size); + } + +@@ -342,6 +362,7 @@ int btrfs_setxattr(struct dentry *dentry, const char *name, const void *value, + size_t size, int flags) + { + struct btrfs_root *root = BTRFS_I(dentry->d_inode)->root; ++ int ret; + + /* + * The permission on security.* and system.* is not checked +@@ -358,8 +379,9 @@ int btrfs_setxattr(struct dentry *dentry, const char *name, const void *value, + if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN)) + return generic_setxattr(dentry, name, value, size, flags); + +- if (!btrfs_is_valid_xattr(name)) +- return -EOPNOTSUPP; ++ ret = btrfs_is_valid_xattr(name); ++ if (ret) ++ return ret; + + if (size == 0) + value = ""; /* empty EA, do not remove */ +@@ -371,6 +393,7 @@ int btrfs_setxattr(struct dentry *dentry, const char *name, const void *value, + int btrfs_removexattr(struct dentry *dentry, const char *name) + { + struct btrfs_root *root = BTRFS_I(dentry->d_inode)->root; ++ int ret; + + /* + * The permission on security.* and system.* is not checked +@@ -387,8 +410,9 @@ int btrfs_removexattr(struct dentry *dentry, const char *name) + if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN)) + return generic_removexattr(dentry, name); + +- if (!btrfs_is_valid_xattr(name)) +- return -EOPNOTSUPP; ++ ret = btrfs_is_valid_xattr(name); ++ if (ret) ++ return ret; + + return __btrfs_setxattr(NULL, dentry->d_inode, name, NULL, 0, + XATTR_REPLACE); +diff --git a/fs/dcache.c b/fs/dcache.c +index 8bc98af..8a35300 100644 +--- a/fs/dcache.c ++++ b/fs/dcache.c +@@ -1016,13 +1016,13 @@ ascend: + /* might go back up the wrong parent if we have had a rename */ + if (!locked && read_seqretry(&rename_lock, seq)) + goto rename_retry; +- next = child->d_child.next; +- while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) { ++ /* go into the first sibling still alive */ ++ do { ++ next = child->d_child.next; + if (next == &this_parent->d_subdirs) + goto ascend; + child = list_entry(next, struct dentry, d_child); +- next = next->next; +- } ++ } while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)); + rcu_read_unlock(); + goto resume; + } +@@ -1142,13 +1142,13 @@ ascend: + /* might go back up the wrong parent if we have had a rename */ + if (!locked && read_seqretry(&rename_lock, seq)) + goto rename_retry; +- next = child->d_child.next; +- while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) { ++ /* go into the first sibling still alive */ ++ do { ++ next = child->d_child.next; + if (next == &this_parent->d_subdirs) + goto ascend; + child = list_entry(next, struct dentry, d_child); +- next = next->next; +- } ++ } while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)); + rcu_read_unlock(); + goto resume; + } +@@ -2938,13 +2938,13 @@ ascend: + /* might go back up the wrong parent if we have had a rename */ + if (!locked && read_seqretry(&rename_lock, seq)) + goto rename_retry; +- next = child->d_child.next; +- while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) { ++ /* go into the first sibling still alive */ ++ do { ++ next = child->d_child.next; + if (next == &this_parent->d_subdirs) + goto ascend; + child = list_entry(next, struct dentry, d_child); +- next = next->next; +- } ++ } while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)); + rcu_read_unlock(); + goto resume; + } +diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c +index a15f1e2..74f03b5 100644 +--- a/fs/debugfs/inode.c ++++ b/fs/debugfs/inode.c +@@ -135,6 +135,7 @@ static void debugfs_evict_inode(struct inode *inode) + + static const struct super_operations debugfs_super_operations = { + .evict_inode = debugfs_evict_inode, ++ .statfs = simple_statfs, + }; + + static int debug_fill_super(struct super_block *sb, void *data, int silent) +diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c +index 834d9a1..2da63ab 100644 +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -321,7 +321,7 @@ static int ext4_valid_extent(struct inode *inode, struct ext4_extent *ext) + ext4_lblk_t lblock = le32_to_cpu(ext->ee_block); + ext4_lblk_t last = lblock + len - 1; + +- if (lblock > last) ++ if (len == 0 || lblock > last) + return 0; + return ext4_data_block_valid(EXT4_SB(inode->i_sb), block, len); + } +@@ -4470,13 +4470,6 @@ long ext4_fallocate(struct file *file, int mode, loff_t offset, loff_t len) + struct ext4_map_blocks map; + unsigned int credits, blkbits = inode->i_blkbits; + +- /* +- * currently supporting (pre)allocate mode for extent-based +- * files _only_ +- */ +- if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))) +- return -EOPNOTSUPP; +- + /* Return error if mode is not supported */ + if (mode & ~(FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE)) + return -EOPNOTSUPP; +@@ -4497,6 +4490,15 @@ long ext4_fallocate(struct file *file, int mode, loff_t offset, loff_t len) + */ + credits = ext4_chunk_trans_blocks(inode, max_blocks); + mutex_lock(&inode->i_mutex); ++ ++ /* ++ * We only support preallocation for extent-based files only ++ */ ++ if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))) { ++ ret = -EOPNOTSUPP; ++ goto out; ++ } ++ + ret = inode_newsize_ok(inode, (len + offset)); + if (ret) { + mutex_unlock(&inode->i_mutex); +@@ -4553,6 +4555,7 @@ retry: + ret = 0; + goto retry; + } ++out: + mutex_unlock(&inode->i_mutex); + trace_ext4_fallocate_exit(inode, offset, max_blocks, + ret > 0 ? ret2 : ret); +diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c +index c9f2e3d..cd1dd49 100644 +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -1456,7 +1456,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry, + struct inode *inode) + { + struct inode *dir = dentry->d_parent->d_inode; +- struct buffer_head *bh; ++ struct buffer_head *bh = NULL; + struct ext4_dir_entry_2 *de; + struct super_block *sb; + int retval; +@@ -1471,7 +1471,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry, + if (is_dx(dir)) { + retval = ext4_dx_add_entry(handle, dentry, inode); + if (!retval || (retval != ERR_BAD_DX_DIR)) +- return retval; ++ goto out; + ext4_clear_inode_flag(dir, EXT4_INODE_INDEX); + dx_fallback++; + ext4_mark_inode_dirty(handle, dir); +@@ -1482,14 +1482,15 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry, + if(!bh) + return retval; + retval = add_dirent_to_buf(handle, dentry, inode, NULL, bh); +- if (retval != -ENOSPC) { +- brelse(bh); +- return retval; +- } ++ if (retval != -ENOSPC) ++ goto out; + + if (blocks == 1 && !dx_fallback && +- EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX)) +- return make_indexed_dir(handle, dentry, inode, bh); ++ EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX)) { ++ retval = make_indexed_dir(handle, dentry, inode, bh); ++ bh = NULL; /* make_indexed_dir releases bh */ ++ goto out; ++ } + brelse(bh); + } + bh = ext4_append(handle, dir, &block, &retval); +@@ -1499,6 +1500,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry, + de->inode = 0; + de->rec_len = ext4_rec_len_to_disk(blocksize, blocksize); + retval = add_dirent_to_buf(handle, dentry, inode, de, bh); ++out: + brelse(bh); + if (retval == 0) + ext4_set_inode_state(inode, EXT4_STATE_NEWENTRY); +diff --git a/fs/fhandle.c b/fs/fhandle.c +index 6b08864..c9e18f3 100644 +--- a/fs/fhandle.c ++++ b/fs/fhandle.c +@@ -196,8 +196,9 @@ static int handle_to_path(int mountdirfd, struct file_handle __user *ufh, + goto out_err; + } + /* copy the full handle */ +- if (copy_from_user(handle, ufh, +- sizeof(struct file_handle) + ++ *handle = f_handle; ++ if (copy_from_user(&handle->f_handle, ++ &ufh->f_handle, + f_handle.handle_bytes)) { + retval = -EFAULT; + goto out_handle; +diff --git a/fs/jbd2/recovery.c b/fs/jbd2/recovery.c +index da6d7ba..421834b 100644 +--- a/fs/jbd2/recovery.c ++++ b/fs/jbd2/recovery.c +@@ -711,11 +711,16 @@ static int scan_revoke_records(journal_t *journal, struct buffer_head *bh, + { + jbd2_journal_revoke_header_t *header; + int offset, max; ++ __u32 rcount; + int record_len = 4; + + header = (jbd2_journal_revoke_header_t *) bh->b_data; + offset = sizeof(jbd2_journal_revoke_header_t); +- max = be32_to_cpu(header->r_count); ++ rcount = be32_to_cpu(header->r_count); ++ ++ if (rcount > journal->j_blocksize) ++ return -EINVAL; ++ max = rcount; + + if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT)) + record_len = 8; +diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c +index 6e91f8b..d455ea0 100644 +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -3272,10 +3272,17 @@ static int check_stateid_generation(stateid_t *in, stateid_t *ref, bool has_sess + return nfserr_old_stateid; + } + ++static __be32 nfsd4_check_openowner_confirmed(struct nfs4_ol_stateid *ols) ++{ ++ if (ols->st_stateowner->so_is_open_owner && ++ !(openowner(ols->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED)) ++ return nfserr_bad_stateid; ++ return nfs_ok; ++} ++ + __be32 nfs4_validate_stateid(struct nfs4_client *cl, stateid_t *stateid) + { + struct nfs4_stid *s; +- struct nfs4_ol_stateid *ols; + __be32 status; + + if (STALE_STATEID(stateid)) +@@ -3289,11 +3296,7 @@ __be32 nfs4_validate_stateid(struct nfs4_client *cl, stateid_t *stateid) + return status; + if (!(s->sc_type & (NFS4_OPEN_STID | NFS4_LOCK_STID))) + return nfs_ok; +- ols = openlockstateid(s); +- if (ols->st_stateowner->so_is_open_owner +- && !(openowner(ols->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED)) +- return nfserr_bad_stateid; +- return nfs_ok; ++ return nfsd4_check_openowner_confirmed(openlockstateid(s)); + } + + static __be32 nfsd4_lookup_stateid(stateid_t *stateid, unsigned char typemask, struct nfs4_stid **s) +@@ -3360,8 +3363,8 @@ nfs4_preprocess_stateid_op(struct nfsd4_compound_state *cstate, + status = nfs4_check_fh(current_fh, stp); + if (status) + goto out; +- if (stp->st_stateowner->so_is_open_owner +- && !(openowner(stp->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED)) ++ status = nfsd4_check_openowner_confirmed(stp); ++ if (status) + goto out; + status = nfs4_check_openmode(stp, flags); + if (status) +diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c +index ecdbae1..090d8ce 100644 +--- a/fs/nilfs2/btree.c ++++ b/fs/nilfs2/btree.c +@@ -388,7 +388,7 @@ static int nilfs_btree_root_broken(const struct nilfs_btree_node *node, + nchildren = nilfs_btree_node_get_nchildren(node); + + if (unlikely(level < NILFS_BTREE_LEVEL_NODE_MIN || +- level > NILFS_BTREE_LEVEL_MAX || ++ level >= NILFS_BTREE_LEVEL_MAX || + nchildren < 0 || + nchildren > NILFS_BTREE_ROOT_NCHILDREN_MAX)) { + pr_crit("NILFS: bad btree root (inode number=%lu): level = %d, flags = 0x%x, nchildren = %d\n", +diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c +index dbc372e..7ba6ac1 100644 +--- a/fs/ocfs2/dlm/dlmmaster.c ++++ b/fs/ocfs2/dlm/dlmmaster.c +@@ -729,6 +729,19 @@ lookup: + if (tmpres) { + spin_unlock(&dlm->spinlock); + spin_lock(&tmpres->spinlock); ++ ++ /* ++ * Right after dlm spinlock was released, dlm_thread could have ++ * purged the lockres. Check if lockres got unhashed. If so ++ * start over. ++ */ ++ if (hlist_unhashed(&tmpres->hash_node)) { ++ spin_unlock(&tmpres->spinlock); ++ dlm_lockres_put(tmpres); ++ tmpres = NULL; ++ goto lookup; ++ } ++ + /* Wait on the thread that is mastering the resource */ + if (tmpres->owner == DLM_LOCK_RES_OWNER_UNKNOWN) { + __dlm_wait_on_lockres(tmpres); +diff --git a/fs/omfs/inode.c b/fs/omfs/inode.c +index e043c4c..f58f1c4 100644 +--- a/fs/omfs/inode.c ++++ b/fs/omfs/inode.c +@@ -361,7 +361,7 @@ nomem: + } + + enum { +- Opt_uid, Opt_gid, Opt_umask, Opt_dmask, Opt_fmask ++ Opt_uid, Opt_gid, Opt_umask, Opt_dmask, Opt_fmask, Opt_err + }; + + static const match_table_t tokens = { +@@ -370,6 +370,7 @@ static const match_table_t tokens = { + {Opt_umask, "umask=%o"}, + {Opt_dmask, "dmask=%o"}, + {Opt_fmask, "fmask=%o"}, ++ {Opt_err, NULL}, + }; + + static int parse_options(char *options, struct omfs_sb_info *sbi) +diff --git a/fs/pipe.c b/fs/pipe.c +index 8ca88fc..d2cbeff 100644 +--- a/fs/pipe.c ++++ b/fs/pipe.c +@@ -103,25 +103,27 @@ void pipe_wait(struct pipe_inode_info *pipe) + } + + static int +-pipe_iov_copy_from_user(void *to, struct iovec *iov, unsigned long len, +- int atomic) ++pipe_iov_copy_from_user(void *addr, int *offset, struct iovec *iov, ++ size_t *remaining, int atomic) + { + unsigned long copy; + +- while (len > 0) { ++ while (*remaining > 0) { + while (!iov->iov_len) + iov++; +- copy = min_t(unsigned long, len, iov->iov_len); ++ copy = min_t(unsigned long, *remaining, iov->iov_len); + + if (atomic) { +- if (__copy_from_user_inatomic(to, iov->iov_base, copy)) ++ if (__copy_from_user_inatomic(addr + *offset, ++ iov->iov_base, copy)) + return -EFAULT; + } else { +- if (copy_from_user(to, iov->iov_base, copy)) ++ if (copy_from_user(addr + *offset, ++ iov->iov_base, copy)) + return -EFAULT; + } +- to += copy; +- len -= copy; ++ *offset += copy; ++ *remaining -= copy; + iov->iov_base += copy; + iov->iov_len -= copy; + } +@@ -129,25 +131,27 @@ pipe_iov_copy_from_user(void *to, struct iovec *iov, unsigned long len, + } + + static int +-pipe_iov_copy_to_user(struct iovec *iov, const void *from, unsigned long len, +- int atomic) ++pipe_iov_copy_to_user(struct iovec *iov, void *addr, int *offset, ++ size_t *remaining, int atomic) + { + unsigned long copy; + +- while (len > 0) { ++ while (*remaining > 0) { + while (!iov->iov_len) + iov++; +- copy = min_t(unsigned long, len, iov->iov_len); ++ copy = min_t(unsigned long, *remaining, iov->iov_len); + + if (atomic) { +- if (__copy_to_user_inatomic(iov->iov_base, from, copy)) ++ if (__copy_to_user_inatomic(iov->iov_base, ++ addr + *offset, copy)) + return -EFAULT; + } else { +- if (copy_to_user(iov->iov_base, from, copy)) ++ if (copy_to_user(iov->iov_base, ++ addr + *offset, copy)) + return -EFAULT; + } +- from += copy; +- len -= copy; ++ *offset += copy; ++ *remaining -= copy; + iov->iov_base += copy; + iov->iov_len -= copy; + } +@@ -383,7 +387,7 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov, + struct pipe_buffer *buf = pipe->bufs + curbuf; + const struct pipe_buf_operations *ops = buf->ops; + void *addr; +- size_t chars = buf->len; ++ size_t chars = buf->len, remaining; + int error, atomic; + + if (chars > total_len) +@@ -397,9 +401,11 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov, + } + + atomic = !iov_fault_in_pages_write(iov, chars); ++ remaining = chars; + redo: + addr = ops->map(pipe, buf, atomic); +- error = pipe_iov_copy_to_user(iov, addr + buf->offset, chars, atomic); ++ error = pipe_iov_copy_to_user(iov, addr, &buf->offset, ++ &remaining, atomic); + ops->unmap(pipe, buf, addr); + if (unlikely(error)) { + /* +@@ -414,7 +420,6 @@ redo: + break; + } + ret += chars; +- buf->offset += chars; + buf->len -= chars; + + /* Was it a packet buffer? Clean up and exit */ +@@ -521,6 +526,7 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov, + if (ops->can_merge && offset + chars <= PAGE_SIZE) { + int error, atomic = 1; + void *addr; ++ size_t remaining = chars; + + error = ops->confirm(pipe, buf); + if (error) +@@ -529,8 +535,8 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov, + iov_fault_in_pages_read(iov, chars); + redo1: + addr = ops->map(pipe, buf, atomic); +- error = pipe_iov_copy_from_user(offset + addr, iov, +- chars, atomic); ++ error = pipe_iov_copy_from_user(addr, &offset, iov, ++ &remaining, atomic); + ops->unmap(pipe, buf, addr); + ret = error; + do_wakeup = 1; +@@ -565,6 +571,8 @@ redo1: + struct page *page = pipe->tmp_page; + char *src; + int error, atomic = 1; ++ int offset = 0; ++ size_t remaining; + + if (!page) { + page = alloc_page(GFP_HIGHUSER); +@@ -585,14 +593,15 @@ redo1: + chars = total_len; + + iov_fault_in_pages_read(iov, chars); ++ remaining = chars; + redo2: + if (atomic) + src = kmap_atomic(page, KM_USER0); + else + src = kmap(page); + +- error = pipe_iov_copy_from_user(src, iov, chars, +- atomic); ++ error = pipe_iov_copy_from_user(src, &offset, iov, ++ &remaining, atomic); + if (atomic) + kunmap_atomic(src, KM_USER0); + else +diff --git a/include/acpi/acpixf.h b/include/acpi/acpixf.h +index f554a93..2ba218e 100644 +--- a/include/acpi/acpixf.h ++++ b/include/acpi/acpixf.h +@@ -125,7 +125,7 @@ void acpi_free(void *address); + */ + acpi_status acpi_reallocate_root_table(void); + +-acpi_status acpi_find_root_pointer(acpi_size *rsdp_address); ++acpi_status acpi_find_root_pointer(acpi_physical_address *rsdp_address); + + acpi_status acpi_load_tables(void); + +diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h +index ed73f67..b0d7ef8 100644 +--- a/include/acpi/actypes.h ++++ b/include/acpi/actypes.h +@@ -198,9 +198,29 @@ typedef int INT32; + typedef s32 acpi_native_int; + + typedef u32 acpi_size; ++ ++#ifdef ACPI_32BIT_PHYSICAL_ADDRESS ++ ++/* ++ * OSPMs can define this to shrink the size of the structures for 32-bit ++ * none PAE environment. ASL compiler may always define this to generate ++ * 32-bit OSPM compliant tables. ++ */ + typedef u32 acpi_io_address; + typedef u32 acpi_physical_address; + ++#else /* ACPI_32BIT_PHYSICAL_ADDRESS */ ++ ++/* ++ * It is reported that, after some calculations, the physical addresses can ++ * wrap over the 32-bit boundary on 32-bit PAE environment. ++ * https://bugzilla.kernel.org/show_bug.cgi?id=87971 ++ */ ++typedef u64 acpi_io_address; ++typedef u64 acpi_physical_address; ++ ++#endif /* ACPI_32BIT_PHYSICAL_ADDRESS */ ++ + #define ACPI_MAX_PTR ACPI_UINT32_MAX + #define ACPI_SIZE_MAX ACPI_UINT32_MAX + +diff --git a/include/acpi/platform/acenv.h b/include/acpi/platform/acenv.h +index 5af3ed5..b9f9210 100644 +--- a/include/acpi/platform/acenv.h ++++ b/include/acpi/platform/acenv.h +@@ -75,6 +75,7 @@ + #define ACPI_CONSTANT_EVAL_ONLY + #define ACPI_LARGE_NAMESPACE_NODE + #define ACPI_DATA_TABLE_DISASSEMBLY ++#define ACPI_32BIT_PHYSICAL_ADDRESS + #endif + + #ifdef ACPI_EXEC_APP +diff --git a/include/linux/jhash.h b/include/linux/jhash.h +index 47cb09e..348c6f4 100644 +--- a/include/linux/jhash.h ++++ b/include/linux/jhash.h +@@ -145,11 +145,11 @@ static inline u32 jhash2(const u32 *k, u32 length, u32 initval) + } + + +-/* jhash_3words - hash exactly 3, 2 or 1 word(s) */ +-static inline u32 jhash_3words(u32 a, u32 b, u32 c, u32 initval) ++/* __jhash_nwords - hash exactly 3, 2 or 1 word(s) */ ++static inline u32 __jhash_nwords(u32 a, u32 b, u32 c, u32 initval) + { +- a += JHASH_INITVAL; +- b += JHASH_INITVAL; ++ a += initval; ++ b += initval; + c += initval; + + __jhash_final(a, b, c); +@@ -157,14 +157,19 @@ static inline u32 jhash_3words(u32 a, u32 b, u32 c, u32 initval) + return c; + } + ++static inline u32 jhash_3words(u32 a, u32 b, u32 c, u32 initval) ++{ ++ return __jhash_nwords(a, b, c, initval + JHASH_INITVAL + (3 << 2)); ++} ++ + static inline u32 jhash_2words(u32 a, u32 b, u32 initval) + { +- return jhash_3words(a, b, 0, initval); ++ return __jhash_nwords(a, b, 0, initval + JHASH_INITVAL + (2 << 2)); + } + + static inline u32 jhash_1word(u32 a, u32 initval) + { +- return jhash_3words(a, 0, 0, initval); ++ return __jhash_nwords(a, 0, 0, initval + JHASH_INITVAL + (1 << 2)); + } + + #endif /* _LINUX_JHASH_H */ +diff --git a/include/linux/libata.h b/include/linux/libata.h +index 42ac6ad..3d4b5b6 100644 +--- a/include/linux/libata.h ++++ b/include/linux/libata.h +@@ -182,6 +182,7 @@ enum { + ATA_LFLAG_DISABLED = (1 << 6), /* link is disabled */ + ATA_LFLAG_SW_ACTIVITY = (1 << 7), /* keep activity stats */ + ATA_LFLAG_NO_LPM = (1 << 8), /* disable LPM on this link */ ++ ATA_LFLAG_CHANGED = (1 << 10), /* LPM state changed on this link */ + + /* struct ata_port flags */ + ATA_FLAG_SLAVE_POSS = (1 << 0), /* host supports slave dev */ +@@ -284,6 +285,12 @@ enum { + */ + ATA_TMOUT_PMP_SRST_WAIT = 5000, + ++ /* When the LPM policy is set to ATA_LPM_MAX_POWER, there might ++ * be a spurious PHY event, so ignore the first PHY event that ++ * occurs within 10s after the policy change. ++ */ ++ ATA_TMOUT_SPURIOUS_PHY = 10000, ++ + /* ATA bus states */ + BUS_UNKNOWN = 0, + BUS_DMA = 1, +@@ -728,6 +735,8 @@ struct ata_link { + struct ata_eh_context eh_context; + + struct ata_device device[ATA_MAX_DEVICES]; ++ ++ unsigned long last_lpm_change; /* when last LPM change happened */ + }; + #define ATA_LINK_CLEAR_BEGIN offsetof(struct ata_link, active_tag) + #define ATA_LINK_CLEAR_END offsetof(struct ata_link, device[0]) +@@ -1064,6 +1073,7 @@ extern struct ata_device *ata_dev_pair(struct ata_device *adev); + extern int ata_do_set_mode(struct ata_link *link, struct ata_device **r_failed_dev); + extern void ata_scsi_port_error_handler(struct Scsi_Host *host, struct ata_port *ap); + extern void ata_scsi_cmd_error_handler(struct Scsi_Host *host, struct ata_port *ap, struct list_head *eh_q); ++extern bool sata_lpm_ignore_phy_events(struct ata_link *link); + + extern int ata_cable_40wire(struct ata_port *ap); + extern int ata_cable_80wire(struct ata_port *ap); +diff --git a/include/linux/nilfs2_fs.h b/include/linux/nilfs2_fs.h +index 7454ad7..d4d512f 100644 +--- a/include/linux/nilfs2_fs.h ++++ b/include/linux/nilfs2_fs.h +@@ -457,7 +457,7 @@ struct nilfs_btree_node { + /* level */ + #define NILFS_BTREE_LEVEL_DATA 0 + #define NILFS_BTREE_LEVEL_NODE_MIN (NILFS_BTREE_LEVEL_DATA + 1) +-#define NILFS_BTREE_LEVEL_MAX 14 ++#define NILFS_BTREE_LEVEL_MAX 14 /* Max level (exclusive) */ + + /** + * struct nilfs_palloc_group_desc - block group descriptor +diff --git a/include/linux/of.h b/include/linux/of.h +index 9bf9611..c81ef31 100644 +--- a/include/linux/of.h ++++ b/include/linux/of.h +@@ -211,6 +211,9 @@ extern int of_property_read_string(struct device_node *np, + extern int of_property_read_string_index(struct device_node *np, + const char *propname, + int index, const char **output); ++extern int of_property_match_string(struct device_node *np, ++ const char *propname, ++ const char *string); + extern int of_property_count_strings(struct device_node *np, + const char *propname); + extern int of_device_is_compatible(const struct device_node *device, +@@ -315,6 +318,13 @@ static inline int of_property_read_u64(const struct device_node *np, + return -ENOSYS; + } + ++static inline int of_property_match_string(struct device_node *np, ++ const char *propname, ++ const char *string) ++{ ++ return -ENOSYS; ++} ++ + static inline struct device_node *of_parse_phandle(struct device_node *np, + const char *phandle_name, + int index) +diff --git a/include/linux/sched.h b/include/linux/sched.h +index cb34ff4..44e5f47 100644 +--- a/include/linux/sched.h ++++ b/include/linux/sched.h +@@ -2347,15 +2347,15 @@ static inline bool thread_group_leader(struct task_struct *p) + * all we care about is that we have a task with the appropriate + * pid, we don't actually care if we have the right task. + */ +-static inline int has_group_leader_pid(struct task_struct *p) ++static inline bool has_group_leader_pid(struct task_struct *p) + { +- return p->pid == p->tgid; ++ return task_pid(p) == p->signal->leader_pid; + } + + static inline +-int same_thread_group(struct task_struct *p1, struct task_struct *p2) ++bool same_thread_group(struct task_struct *p1, struct task_struct *p2) + { +- return p1->tgid == p2->tgid; ++ return p1->signal == p2->signal; + } + + static inline struct task_struct *next_thread(const struct task_struct *p) +diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h +index 416dcb0..b8b2e50 100644 +--- a/include/net/ip_vs.h ++++ b/include/net/ip_vs.h +@@ -1202,6 +1202,8 @@ ip_vs_lookup_real_service(struct net *net, int af, __u16 protocol, + + extern int ip_vs_use_count_inc(void); + extern void ip_vs_use_count_dec(void); ++extern int ip_vs_register_nl_ioctl(void); ++extern void ip_vs_unregister_nl_ioctl(void); + extern int ip_vs_control_init(void); + extern void ip_vs_control_cleanup(void); + extern struct ip_vs_dest * +diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h +index a15432da..2cccd82 100644 +--- a/include/net/sctp/structs.h ++++ b/include/net/sctp/structs.h +@@ -209,6 +209,7 @@ extern struct sctp_globals { + struct list_head addr_waitq; + struct timer_list addr_wq_timer; + struct list_head auto_asconf_splist; ++ /* Lock that protects both addr_waitq and auto_asconf_splist */ + spinlock_t addr_wq_lock; + + /* Lock that protects the local_addr_list writers */ +@@ -355,6 +356,10 @@ struct sctp_sock { + atomic_t pd_mode; + /* Receive to here while partial delivery is in effect. */ + struct sk_buff_head pd_lobby; ++ ++ /* These must be the last fields, as they will skipped on copies, ++ * like on accept and peeloff operations ++ */ + struct list_head auto_asconf_list; + int do_auto_asconf; + }; +diff --git a/include/sound/emu10k1.h b/include/sound/emu10k1.h +index 4f865df..7ee55e3 100644 +--- a/include/sound/emu10k1.h ++++ b/include/sound/emu10k1.h +@@ -43,7 +43,8 @@ + + #define EMUPAGESIZE 4096 + #define MAXREQVOICES 8 +-#define MAXPAGES 8192 ++#define MAXPAGES0 4096 /* 32 bit mode */ ++#define MAXPAGES1 8192 /* 31 bit mode */ + #define RESERVED 0 + #define NUM_MIDI 16 + #define NUM_G 64 /* use all channels */ +@@ -52,8 +53,7 @@ + + /* FIXME? - according to the OSS driver the EMU10K1 needs a 29 bit DMA mask */ + #define EMU10K1_DMA_MASK 0x7fffffffUL /* 31bit */ +-#define AUDIGY_DMA_MASK 0x7fffffffUL /* 31bit FIXME - 32 should work? */ +- /* See ALSA bug #1276 - rlrevell */ ++#define AUDIGY_DMA_MASK 0xffffffffUL /* 32bit mode */ + + #define TMEMSIZE 256*1024 + #define TMEMSIZEREG 4 +@@ -470,8 +470,11 @@ + + #define MAPB 0x0d /* Cache map B */ + +-#define MAP_PTE_MASK 0xffffe000 /* The 19 MSBs of the PTE indexed by the PTI */ +-#define MAP_PTI_MASK 0x00001fff /* The 13 bit index to one of the 8192 PTE dwords */ ++#define MAP_PTE_MASK0 0xfffff000 /* The 20 MSBs of the PTE indexed by the PTI */ ++#define MAP_PTI_MASK0 0x00000fff /* The 12 bit index to one of the 4096 PTE dwords */ ++ ++#define MAP_PTE_MASK1 0xffffe000 /* The 19 MSBs of the PTE indexed by the PTI */ ++#define MAP_PTI_MASK1 0x00001fff /* The 13 bit index to one of the 8192 PTE dwords */ + + /* 0x0e, 0x0f: Not used */ + +@@ -1708,6 +1711,7 @@ struct snd_emu10k1 { + unsigned short model; /* subsystem id */ + unsigned int card_type; /* EMU10K1_CARD_* */ + unsigned int ecard_ctrl; /* ecard control bits */ ++ unsigned int address_mode; /* address mode */ + unsigned long dma_mask; /* PCI DMA mask */ + unsigned int delay_pcm_irq; /* in samples */ + int max_cache_pages; /* max memory size / PAGE_SIZE */ +diff --git a/include/xen/events.h b/include/xen/events.h +index 8f3d622..89b672d 100644 +--- a/include/xen/events.h ++++ b/include/xen/events.h +@@ -12,7 +12,7 @@ int bind_evtchn_to_irqhandler(unsigned int evtchn, + irq_handler_t handler, + unsigned long irqflags, const char *devname, + void *dev_id); +-int bind_virq_to_irq(unsigned int virq, unsigned int cpu); ++int bind_virq_to_irq(unsigned int virq, unsigned int cpu, bool percpu); + int bind_virq_to_irqhandler(unsigned int virq, unsigned int cpu, + irq_handler_t handler, + unsigned long irqflags, const char *devname, +diff --git a/kernel/ptrace.c b/kernel/ptrace.c +index f79803a..f07c144 100644 +--- a/kernel/ptrace.c ++++ b/kernel/ptrace.c +@@ -225,7 +225,7 @@ int __ptrace_may_access(struct task_struct *task, unsigned int mode) + */ + int dumpable = 0; + /* Don't let security modules deny introspection */ +- if (task == current) ++ if (same_thread_group(task, current)) + return 0; + rcu_read_lock(); + tcred = __task_cred(task); +@@ -640,6 +640,8 @@ static int ptrace_setsiginfo(struct task_struct *child, const siginfo_t *info) + static int ptrace_resume(struct task_struct *child, long request, + unsigned long data) + { ++ bool need_siglock; ++ + if (!valid_signal(data)) + return -EIO; + +@@ -667,8 +669,26 @@ static int ptrace_resume(struct task_struct *child, long request, + user_disable_single_step(child); + } + ++ /* ++ * Change ->exit_code and ->state under siglock to avoid the race ++ * with wait_task_stopped() in between; a non-zero ->exit_code will ++ * wrongly look like another report from tracee. ++ * ++ * Note that we need siglock even if ->exit_code == data and/or this ++ * status was not reported yet, the new status must not be cleared by ++ * wait_task_stopped() after resume. ++ * ++ * If data == 0 we do not care if wait_task_stopped() reports the old ++ * status and clears the code too; this can't race with the tracee, it ++ * takes siglock after resume. ++ */ ++ need_siglock = data && !thread_group_empty(current); ++ if (need_siglock) ++ spin_lock_irq(&child->sighand->siglock); + child->exit_code = data; + wake_up_state(child, __TASK_TRACED); ++ if (need_siglock) ++ spin_unlock_irq(&child->sighand->siglock); + + return 0; + } +diff --git a/kernel/softirq.c b/kernel/softirq.c +index 2c71d91..44bc103 100644 +--- a/kernel/softirq.c ++++ b/kernel/softirq.c +@@ -194,22 +194,28 @@ void local_bh_enable_ip(unsigned long ip) + EXPORT_SYMBOL(local_bh_enable_ip); + + /* +- * We restart softirq processing MAX_SOFTIRQ_RESTART times, +- * and we fall back to softirqd after that. ++ * We restart softirq processing for at most MAX_SOFTIRQ_RESTART times, ++ * but break the loop if need_resched() is set or after 2 ms. ++ * The MAX_SOFTIRQ_TIME provides a nice upper bound in most cases, but in ++ * certain cases, such as stop_machine(), jiffies may cease to ++ * increment and so we need the MAX_SOFTIRQ_RESTART limit as ++ * well to make sure we eventually return from this method. + * +- * This number has been established via experimentation. ++ * These limits have been established via experimentation. + * The two things to balance is latency against fairness - + * we want to handle softirqs as soon as possible, but they + * should not be able to lock up the box. + */ ++#define MAX_SOFTIRQ_TIME msecs_to_jiffies(2) + #define MAX_SOFTIRQ_RESTART 10 + + asmlinkage void __do_softirq(void) + { + struct softirq_action *h; + __u32 pending; +- int max_restart = MAX_SOFTIRQ_RESTART; ++ unsigned long end = jiffies + MAX_SOFTIRQ_TIME; + int cpu; ++ int max_restart = MAX_SOFTIRQ_RESTART; + + pending = local_softirq_pending(); + account_system_vtime(current); +@@ -255,11 +261,13 @@ restart: + local_irq_disable(); + + pending = local_softirq_pending(); +- if (pending && --max_restart) +- goto restart; ++ if (pending) { ++ if (time_before(jiffies, end) && !need_resched() && ++ --max_restart) ++ goto restart; + +- if (pending) + wakeup_softirqd(); ++ } + + lockdep_softirq_exit(); + +diff --git a/kernel/trace/ring_buffer_benchmark.c b/kernel/trace/ring_buffer_benchmark.c +index a5457d5..6ad2e2d 100644 +--- a/kernel/trace/ring_buffer_benchmark.c ++++ b/kernel/trace/ring_buffer_benchmark.c +@@ -455,7 +455,7 @@ static int __init ring_buffer_benchmark_init(void) + + if (producer_fifo >= 0) { + struct sched_param param = { +- .sched_priority = consumer_fifo ++ .sched_priority = producer_fifo + }; + sched_setscheduler(producer, SCHED_FIFO, ¶m); + } else +diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c +index b0996c1..47343cc 100644 +--- a/kernel/trace/trace_events_filter.c ++++ b/kernel/trace/trace_events_filter.c +@@ -1343,19 +1343,25 @@ static int check_preds(struct filter_parse_state *ps) + { + int n_normal_preds = 0, n_logical_preds = 0; + struct postfix_elt *elt; ++ int cnt = 0; + + list_for_each_entry(elt, &ps->postfix, list) { +- if (elt->op == OP_NONE) ++ if (elt->op == OP_NONE) { ++ cnt++; + continue; ++ } + + if (elt->op == OP_AND || elt->op == OP_OR) { + n_logical_preds++; ++ cnt--; + continue; + } ++ cnt--; + n_normal_preds++; ++ WARN_ON_ONCE(cnt < 0); + } + +- if (!n_normal_preds || n_logical_preds >= n_normal_preds) { ++ if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) { + parse_error(ps, FILT_ERR_INVALID_FILTER, 0); + return -EINVAL; + } +diff --git a/lib/string.c b/lib/string.c +index 40136f6..dcbe695 100644 +--- a/lib/string.c ++++ b/lib/string.c +@@ -595,7 +595,7 @@ EXPORT_SYMBOL(memset); + void memzero_explicit(void *s, size_t count) + { + memset(s, 0, count); +- OPTIMIZER_HIDE_VAR(s); ++ barrier(); + } + EXPORT_SYMBOL(memzero_explicit); + +diff --git a/mm/page-writeback.c b/mm/page-writeback.c +index 1bf1f74..62bfbd9 100644 +--- a/mm/page-writeback.c ++++ b/mm/page-writeback.c +@@ -560,7 +560,7 @@ static unsigned long bdi_position_ratio(struct backing_dev_info *bdi, + */ + setpoint = (freerun + limit) / 2; + x = div64_s64(((s64)setpoint - (s64)dirty) << RATELIMIT_CALC_SHIFT, +- limit - setpoint + 1); ++ (limit - setpoint) | 1); + pos_ratio = x; + pos_ratio = pos_ratio * x >> RATELIMIT_CALC_SHIFT; + pos_ratio = pos_ratio * x >> RATELIMIT_CALC_SHIFT; +@@ -611,7 +611,7 @@ static unsigned long bdi_position_ratio(struct backing_dev_info *bdi, + * scale global setpoint to bdi's: + * bdi_setpoint = setpoint * bdi_thresh / thresh + */ +- x = div_u64((u64)bdi_thresh << 16, thresh + 1); ++ x = div_u64((u64)bdi_thresh << 16, thresh | 1); + bdi_setpoint = setpoint * (u64)x >> 16; + /* + * Use span=(8*write_bw) in single bdi case as indicated by +@@ -626,7 +626,7 @@ static unsigned long bdi_position_ratio(struct backing_dev_info *bdi, + + if (bdi_dirty < x_intercept - span / 4) { + pos_ratio = div64_u64(pos_ratio * (x_intercept - bdi_dirty), +- x_intercept - bdi_setpoint + 1); ++ (x_intercept - bdi_setpoint) | 1); + } else + pos_ratio /= 4; + +diff --git a/mm/slub.c b/mm/slub.c +index 6a4c2fb..60c6969 100644 +--- a/mm/slub.c ++++ b/mm/slub.c +@@ -1873,18 +1873,24 @@ redo: + /* Unfreeze all the cpu partial slabs */ + static void unfreeze_partials(struct kmem_cache *s) + { +- struct kmem_cache_node *n = NULL; ++ struct kmem_cache_node *n = NULL, *n2 = NULL; + struct kmem_cache_cpu *c = this_cpu_ptr(s->cpu_slab); + struct page *page, *discard_page = NULL; + + while ((page = c->partial)) { +- enum slab_modes { M_PARTIAL, M_FREE }; +- enum slab_modes l, m; + struct page new; + struct page old; + + c->partial = page->next; +- l = M_FREE; ++ ++ n2 = get_node(s, page_to_nid(page)); ++ if (n != n2) { ++ if (n) ++ spin_unlock(&n->list_lock); ++ ++ n = n2; ++ spin_lock(&n->list_lock); ++ } + + do { + +@@ -1897,40 +1903,17 @@ static void unfreeze_partials(struct kmem_cache *s) + + new.frozen = 0; + +- if (!new.inuse && (!n || n->nr_partial > s->min_partial)) +- m = M_FREE; +- else { +- struct kmem_cache_node *n2 = get_node(s, +- page_to_nid(page)); +- +- m = M_PARTIAL; +- if (n != n2) { +- if (n) +- spin_unlock(&n->list_lock); +- +- n = n2; +- spin_lock(&n->list_lock); +- } +- } +- +- if (l != m) { +- if (l == M_PARTIAL) +- remove_partial(n, page); +- else +- add_partial(n, page, +- DEACTIVATE_TO_TAIL); +- +- l = m; +- } +- + } while (!cmpxchg_double_slab(s, page, + old.freelist, old.counters, + new.freelist, new.counters, + "unfreezing slab")); + +- if (m == M_FREE) { ++ if (unlikely(!new.inuse && n->nr_partial > s->min_partial)) { + page->next = discard_page; + discard_page = page; ++ } else { ++ add_partial(n, page, DEACTIVATE_TO_TAIL); ++ stat(s, FREE_ADD_PARTIAL); + } + } + +diff --git a/net/bridge/br_ioctl.c b/net/bridge/br_ioctl.c +index 7222fe1..ea0e15c 100644 +--- a/net/bridge/br_ioctl.c ++++ b/net/bridge/br_ioctl.c +@@ -246,9 +246,7 @@ static int old_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd) + if (!capable(CAP_NET_ADMIN)) + return -EPERM; + +- spin_lock_bh(&br->lock); + br_stp_set_bridge_priority(br, args[1]); +- spin_unlock_bh(&br->lock); + return 0; + + case BRCTL_SET_PORT_PRIORITY: +diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c +index 398a297..1bd197f 100644 +--- a/net/bridge/br_multicast.c ++++ b/net/bridge/br_multicast.c +@@ -972,7 +972,7 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br, + } + + err = br_ip6_multicast_add_group(br, port, &grec->grec_mca); +- if (!err) ++ if (err) + break; + } + +@@ -991,6 +991,9 @@ static void br_multicast_add_router(struct net_bridge *br, + struct net_bridge_port *p; + struct hlist_node *n, *slot = NULL; + ++ if (!hlist_unhashed(&port->rlist)) ++ return; ++ + hlist_for_each_entry(p, n, &br->router_list, rlist) { + if ((unsigned long) port >= (unsigned long) p) + break; +@@ -1018,12 +1021,8 @@ static void br_multicast_mark_router(struct net_bridge *br, + if (port->multicast_router != 1) + return; + +- if (!hlist_unhashed(&port->rlist)) +- goto timer; +- + br_multicast_add_router(br, port); + +-timer: + mod_timer(&port->multicast_router_timer, + now + br->multicast_querier_interval); + } +diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c +index 19308e3..0f7dc60 100644 +--- a/net/bridge/br_stp_if.c ++++ b/net/bridge/br_stp_if.c +@@ -235,12 +235,13 @@ bool br_stp_recalculate_bridge_id(struct net_bridge *br) + return true; + } + +-/* called under bridge lock */ ++/* Acquires and releases bridge lock */ + void br_stp_set_bridge_priority(struct net_bridge *br, u16 newprio) + { + struct net_bridge_port *p; + int wasroot; + ++ spin_lock_bh(&br->lock); + wasroot = br_is_root_bridge(br); + + list_for_each_entry(p, &br->port_list, list) { +@@ -258,6 +259,7 @@ void br_stp_set_bridge_priority(struct net_bridge *br, u16 newprio) + br_port_state_selection(br); + if (br_is_root_bridge(br) && !wasroot) + br_become_root_bridge(br); ++ spin_unlock_bh(&br->lock); + } + + /* called under bridge lock */ +diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c +index 7eed9eb..7e4b4b4 100644 +--- a/net/caif/caif_socket.c ++++ b/net/caif/caif_socket.c +@@ -366,6 +366,10 @@ static long caif_stream_data_wait(struct sock *sk, long timeo) + release_sock(sk); + timeo = schedule_timeout(timeo); + lock_sock(sk); ++ ++ if (sock_flag(sk, SOCK_DEAD)) ++ break; ++ + clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags); + } + +@@ -410,6 +414,10 @@ static int caif_stream_recvmsg(struct kiocb *iocb, struct socket *sock, + struct sk_buff *skb; + + lock_sock(sk); ++ if (sock_flag(sk, SOCK_DEAD)) { ++ err = -ECONNRESET; ++ goto unlock; ++ } + skb = skb_dequeue(&sk->sk_receive_queue); + caif_check_flow_release(sk); + +diff --git a/net/core/neighbour.c b/net/core/neighbour.c +index 0ea3fd3..c8c2645 100644 +--- a/net/core/neighbour.c ++++ b/net/core/neighbour.c +@@ -955,6 +955,8 @@ int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb) + rc = 0; + if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE)) + goto out_unlock_bh; ++ if (neigh->dead) ++ goto out_dead; + + if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) { + if (neigh->parms->mcast_probes + neigh->parms->app_probes) { +@@ -1003,6 +1005,13 @@ out_unlock_bh: + write_unlock(&neigh->lock); + local_bh_enable(); + return rc; ++ ++out_dead: ++ if (neigh->nud_state & NUD_STALE) ++ goto out_unlock_bh; ++ write_unlock_bh(&neigh->lock); ++ kfree_skb(skb); ++ return 1; + } + EXPORT_SYMBOL(__neigh_event_send); + +@@ -1066,6 +1075,8 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new, + if (!(flags & NEIGH_UPDATE_F_ADMIN) && + (old & (NUD_NOARP | NUD_PERMANENT))) + goto out; ++ if (neigh->dead) ++ goto out; + + if (!(new & NUD_VALID)) { + neigh_del_timer(neigh); +diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c +index 8c2e259..5e92043 100644 +--- a/net/ipv4/udp.c ++++ b/net/ipv4/udp.c +@@ -1248,10 +1248,8 @@ csum_copy_err: + UDP_INC_STATS_USER(sock_net(sk), UDP_MIB_INERRORS, is_udplite); + unlock_sock_fast(sk, slow); + +- if (noblock) +- return -EAGAIN; +- +- /* starting over for a new packet */ ++ /* starting over for a new packet, but check if we need to yield */ ++ cond_resched(); + msg->msg_flags &= ~MSG_TRUNC; + goto try_again; + } +diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c +index d131a95..dc08afd 100644 +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -451,10 +451,8 @@ csum_copy_err: + } + unlock_sock_fast(sk, slow); + +- if (noblock) +- return -EAGAIN; +- +- /* starting over for a new packet */ ++ /* starting over for a new packet, but check if we need to yield */ ++ cond_resched(); + msg->msg_flags &= ~MSG_TRUNC; + goto try_again; + } +diff --git a/net/mac80211/wep.c b/net/mac80211/wep.c +index a1c6bfd..34583c5 100644 +--- a/net/mac80211/wep.c ++++ b/net/mac80211/wep.c +@@ -97,8 +97,7 @@ static u8 *ieee80211_wep_add_iv(struct ieee80211_local *local, + + hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED); + +- if (WARN_ON(skb_tailroom(skb) < WEP_ICV_LEN || +- skb_headroom(skb) < WEP_IV_LEN)) ++ if (WARN_ON(skb_headroom(skb) < WEP_IV_LEN)) + return NULL; + + hdrlen = ieee80211_hdrlen(hdr->frame_control); +@@ -160,6 +159,9 @@ int ieee80211_wep_encrypt(struct ieee80211_local *local, + size_t len; + u8 rc4key[3 + WLAN_KEY_LEN_WEP104]; + ++ if (WARN_ON(skb_tailroom(skb) < WEP_ICV_LEN)) ++ return -1; ++ + iv = ieee80211_wep_add_iv(local, skb, keylen, keyidx); + if (!iv) + return -1; +diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c +index d864aaf..197ed93 100644 +--- a/net/netfilter/ipvs/ip_vs_core.c ++++ b/net/netfilter/ipvs/ip_vs_core.c +@@ -2003,10 +2003,18 @@ static int __init ip_vs_init(void) + goto cleanup_dev; + } + ++ ret = ip_vs_register_nl_ioctl(); ++ if (ret < 0) { ++ pr_err("can't register netlink/ioctl.\n"); ++ goto cleanup_hooks; ++ } ++ + pr_info("ipvs loaded.\n"); + + return ret; + ++cleanup_hooks: ++ nf_unregister_hooks(ip_vs_ops, ARRAY_SIZE(ip_vs_ops)); + cleanup_dev: + unregister_pernet_device(&ipvs_core_dev_ops); + cleanup_sub: +@@ -2022,6 +2030,7 @@ exit: + + static void __exit ip_vs_cleanup(void) + { ++ ip_vs_unregister_nl_ioctl(); + nf_unregister_hooks(ip_vs_ops, ARRAY_SIZE(ip_vs_ops)); + unregister_pernet_device(&ipvs_core_dev_ops); + unregister_pernet_subsys(&ipvs_core_ops); /* free ip_vs struct */ +diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c +index 93acfa1..1e27a1f 100644 +--- a/net/netfilter/ipvs/ip_vs_ctl.c ++++ b/net/netfilter/ipvs/ip_vs_ctl.c +@@ -3689,6 +3689,9 @@ void __net_init ip_vs_control_net_cleanup_sysctl(struct net *net) + cancel_work_sync(&ipvs->defense_work.work); + unregister_net_sysctl_table(ipvs->sysctl_hdr); + ip_vs_stop_estimator(net, &ipvs->tot_stats); ++ ++ if (!net_eq(net, &init_net)) ++ kfree(ipvs->sysctl_tbl); + } + + #else +@@ -3751,21 +3754,10 @@ void __net_exit ip_vs_control_net_cleanup(struct net *net) + free_percpu(ipvs->tot_stats.cpustats); + } + +-int __init ip_vs_control_init(void) ++int __init ip_vs_register_nl_ioctl(void) + { +- int idx; + int ret; + +- EnterFunction(2); +- +- /* Initialize svc_table, ip_vs_svc_fwm_table, rs_table */ +- for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) { +- INIT_LIST_HEAD(&ip_vs_svc_table[idx]); +- INIT_LIST_HEAD(&ip_vs_svc_fwm_table[idx]); +- } +- +- smp_wmb(); /* Do we really need it now ? */ +- + ret = nf_register_sockopt(&ip_vs_sockopts); + if (ret) { + pr_err("cannot register sockopt.\n"); +@@ -3777,28 +3769,47 @@ int __init ip_vs_control_init(void) + pr_err("cannot register Generic Netlink interface.\n"); + goto err_genl; + } +- +- ret = register_netdevice_notifier(&ip_vs_dst_notifier); +- if (ret < 0) +- goto err_notf; +- +- LeaveFunction(2); + return 0; + +-err_notf: +- ip_vs_genl_unregister(); + err_genl: + nf_unregister_sockopt(&ip_vs_sockopts); + err_sock: + return ret; + } + ++void ip_vs_unregister_nl_ioctl(void) ++{ ++ ip_vs_genl_unregister(); ++ nf_unregister_sockopt(&ip_vs_sockopts); ++} ++ ++int __init ip_vs_control_init(void) ++{ ++ int idx; ++ int ret; ++ ++ EnterFunction(2); ++ ++ /* Initialize svc_table, ip_vs_svc_fwm_table, rs_table */ ++ for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) { ++ INIT_LIST_HEAD(&ip_vs_svc_table[idx]); ++ INIT_LIST_HEAD(&ip_vs_svc_fwm_table[idx]); ++ } ++ ++ smp_wmb(); /* Do we really need it now ? */ ++ ++ ret = register_netdevice_notifier(&ip_vs_dst_notifier); ++ if (ret < 0) ++ return ret; ++ ++ LeaveFunction(2); ++ return 0; ++} ++ + + void ip_vs_control_cleanup(void) + { + EnterFunction(2); + unregister_netdevice_notifier(&ip_vs_dst_notifier); +- ip_vs_genl_unregister(); +- nf_unregister_sockopt(&ip_vs_sockopts); + LeaveFunction(2); + } +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 4f19bf2..0c21f06 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -1170,16 +1170,6 @@ static void packet_sock_destruct(struct sock *sk) + sk_refcnt_debug_dec(sk); + } + +-static int fanout_rr_next(struct packet_fanout *f, unsigned int num) +-{ +- int x = atomic_read(&f->rr_cur) + 1; +- +- if (x >= num) +- x = 0; +- +- return x; +-} +- + static struct sock *fanout_demux_hash(struct packet_fanout *f, struct sk_buff *skb, unsigned int num) + { + u32 idx, hash = skb->rxhash; +@@ -1191,13 +1181,9 @@ static struct sock *fanout_demux_hash(struct packet_fanout *f, struct sk_buff *s + + static struct sock *fanout_demux_lb(struct packet_fanout *f, struct sk_buff *skb, unsigned int num) + { +- int cur, old; ++ unsigned int val = atomic_inc_return(&f->rr_cur); + +- cur = atomic_read(&f->rr_cur); +- while ((old = atomic_cmpxchg(&f->rr_cur, cur, +- fanout_rr_next(f, num))) != cur) +- cur = old; +- return f->arr[cur]; ++ return f->arr[val % num]; + } + + static struct sock *fanout_demux_cpu(struct packet_fanout *f, struct sk_buff *skb, unsigned int num) +@@ -1211,7 +1197,7 @@ static int packet_rcv_fanout(struct sk_buff *skb, struct net_device *dev, + struct packet_type *pt, struct net_device *orig_dev) + { + struct packet_fanout *f = pt->af_packet_priv; +- unsigned int num = f->num_members; ++ unsigned int num = ACCESS_ONCE(f->num_members); + struct packet_sock *po; + struct sock *sk; + +diff --git a/net/sctp/output.c b/net/sctp/output.c +index c3b8549..6d56eec 100644 +--- a/net/sctp/output.c ++++ b/net/sctp/output.c +@@ -587,7 +587,9 @@ out: + return err; + no_route: + kfree_skb(nskb); +- IP_INC_STATS(&init_net, IPSTATS_MIB_OUTNOROUTES); ++ ++ if (asoc) ++ IP_INC_STATS(&init_net, IPSTATS_MIB_OUTNOROUTES); + + /* FIXME: Returning the 'err' will effect all the associations + * associated with a socket, although only one of the paths of the +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index fc63664..24e88af 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -1539,8 +1539,10 @@ SCTP_STATIC void sctp_close(struct sock *sk, long timeout) + + /* Supposedly, no process has access to the socket, but + * the net layers still may. ++ * Also, sctp_destroy_sock() needs to be called with addr_wq_lock ++ * held and that should be grabbed before socket lock. + */ +- sctp_local_bh_disable(); ++ spin_lock_bh(&sctp_globals.addr_wq_lock); + sctp_bh_lock_sock(sk); + + /* Hold the sock, since sk_common_release() will put sock_put() +@@ -1550,7 +1552,7 @@ SCTP_STATIC void sctp_close(struct sock *sk, long timeout) + sk_common_release(sk); + + sctp_bh_unlock_sock(sk); +- sctp_local_bh_enable(); ++ spin_unlock_bh(&sctp_globals.addr_wq_lock); + + sock_put(sk); + +@@ -3499,6 +3501,7 @@ static int sctp_setsockopt_auto_asconf(struct sock *sk, char __user *optval, + if ((val && sp->do_auto_asconf) || (!val && !sp->do_auto_asconf)) + return 0; + ++ spin_lock_bh(&sctp_globals.addr_wq_lock); + if (val == 0 && sp->do_auto_asconf) { + list_del(&sp->auto_asconf_list); + sp->do_auto_asconf = 0; +@@ -3507,6 +3510,7 @@ static int sctp_setsockopt_auto_asconf(struct sock *sk, char __user *optval, + &sctp_auto_asconf_splist); + sp->do_auto_asconf = 1; + } ++ spin_unlock_bh(&sctp_globals.addr_wq_lock); + return 0; + } + +@@ -3942,18 +3946,28 @@ SCTP_STATIC int sctp_init_sock(struct sock *sk) + local_bh_disable(); + percpu_counter_inc(&sctp_sockets_allocated); + sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1); ++ ++ /* Nothing can fail after this block, otherwise ++ * sctp_destroy_sock() will be called without addr_wq_lock held ++ */ + if (sctp_default_auto_asconf) { ++ spin_lock(&sctp_globals.addr_wq_lock); + list_add_tail(&sp->auto_asconf_list, + &sctp_auto_asconf_splist); + sp->do_auto_asconf = 1; +- } else ++ spin_unlock(&sctp_globals.addr_wq_lock); ++ } else { + sp->do_auto_asconf = 0; ++ } ++ + local_bh_enable(); + + return 0; + } + +-/* Cleanup any SCTP per socket resources. */ ++/* Cleanup any SCTP per socket resources. Must be called with ++ * sctp_globals.addr_wq_lock held if sp->do_auto_asconf is true ++ */ + SCTP_STATIC void sctp_destroy_sock(struct sock *sk) + { + struct sctp_sock *sp; +@@ -6719,6 +6733,19 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk, + newinet->mc_list = NULL; + } + ++static inline void sctp_copy_descendant(struct sock *sk_to, ++ const struct sock *sk_from) ++{ ++ int ancestor_size = sizeof(struct inet_sock) + ++ sizeof(struct sctp_sock) - ++ offsetof(struct sctp_sock, auto_asconf_list); ++ ++ if (sk_from->sk_family == PF_INET6) ++ ancestor_size += sizeof(struct ipv6_pinfo); ++ ++ __inet_sk_copy_descendant(sk_to, sk_from, ancestor_size); ++} ++ + /* Populate the fields of the newsk from the oldsk and migrate the assoc + * and its messages to the newsk. + */ +@@ -6733,7 +6760,6 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk, + struct sk_buff *skb, *tmp; + struct sctp_ulpevent *event; + struct sctp_bind_hashbucket *head; +- struct list_head tmplist; + + /* Migrate socket buffer sizes and all the socket level options to the + * new socket. +@@ -6741,12 +6767,7 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk, + newsk->sk_sndbuf = oldsk->sk_sndbuf; + newsk->sk_rcvbuf = oldsk->sk_rcvbuf; + /* Brute force copy old sctp opt. */ +- if (oldsp->do_auto_asconf) { +- memcpy(&tmplist, &newsp->auto_asconf_list, sizeof(tmplist)); +- inet_sk_copy_descendant(newsk, oldsk); +- memcpy(&newsp->auto_asconf_list, &tmplist, sizeof(tmplist)); +- } else +- inet_sk_copy_descendant(newsk, oldsk); ++ sctp_copy_descendant(newsk, oldsk); + + /* Restore the ep value that was overwritten with the above structure + * copy. +diff --git a/net/socket.c b/net/socket.c +index 116cf9d..10ea25a 100644 +--- a/net/socket.c ++++ b/net/socket.c +@@ -1911,14 +1911,12 @@ static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg, + int err, ctl_len, iov_size, total_len; + + err = -EFAULT; +- if (MSG_CMSG_COMPAT & flags) { +- if (get_compat_msghdr(msg_sys, msg_compat)) +- return -EFAULT; +- } else { ++ if (MSG_CMSG_COMPAT & flags) ++ err = get_compat_msghdr(msg_sys, msg_compat); ++ else + err = copy_msghdr_from_user(msg_sys, msg); +- if (err) +- return err; +- } ++ if (err) ++ return err; + + /* do not move before msg_sys is valid */ + err = -EMSGSIZE; +@@ -2130,14 +2128,12 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg, + struct sockaddr __user *uaddr; + int __user *uaddr_len; + +- if (MSG_CMSG_COMPAT & flags) { +- if (get_compat_msghdr(msg_sys, msg_compat)) +- return -EFAULT; +- } else { ++ if (MSG_CMSG_COMPAT & flags) ++ err = get_compat_msghdr(msg_sys, msg_compat); ++ else + err = copy_msghdr_from_user(msg_sys, msg); +- if (err) +- return err; +- } ++ if (err) ++ return err; + + err = -EMSGSIZE; + if (msg_sys->msg_iovlen > UIO_MAXIOV) +diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c +index 8705ee3..9b1f371 100644 +--- a/net/unix/af_unix.c ++++ b/net/unix/af_unix.c +@@ -1870,6 +1870,10 @@ static long unix_stream_data_wait(struct sock *sk, long timeo) + unix_state_unlock(sk); + timeo = schedule_timeout(timeo); + unix_state_lock(sk); ++ ++ if (sock_flag(sk, SOCK_DEAD)) ++ break; ++ + clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags); + } + +@@ -1930,6 +1934,10 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock, + struct sk_buff *skb; + + unix_state_lock(sk); ++ if (sock_flag(sk, SOCK_DEAD)) { ++ err = -ECONNRESET; ++ goto unlock; ++ } + skb = skb_peek(&sk->sk_receive_queue); + if (skb == NULL) { + unix_sk(sk)->recursion_level = 0; +diff --git a/security/selinux/nlmsgtab.c b/security/selinux/nlmsgtab.c +index 0920ea3..5776921 100644 +--- a/security/selinux/nlmsgtab.c ++++ b/security/selinux/nlmsgtab.c +@@ -100,6 +100,12 @@ static struct nlmsg_perm nlmsg_xfrm_perms[] = + { XFRM_MSG_FLUSHPOLICY, NETLINK_XFRM_SOCKET__NLMSG_WRITE }, + { XFRM_MSG_NEWAE, NETLINK_XFRM_SOCKET__NLMSG_WRITE }, + { XFRM_MSG_GETAE, NETLINK_XFRM_SOCKET__NLMSG_READ }, ++ { XFRM_MSG_REPORT, NETLINK_XFRM_SOCKET__NLMSG_READ }, ++ { XFRM_MSG_MIGRATE, NETLINK_XFRM_SOCKET__NLMSG_WRITE }, ++ { XFRM_MSG_NEWSADINFO, NETLINK_XFRM_SOCKET__NLMSG_READ }, ++ { XFRM_MSG_GETSADINFO, NETLINK_XFRM_SOCKET__NLMSG_READ }, ++ { XFRM_MSG_GETSPDINFO, NETLINK_XFRM_SOCKET__NLMSG_READ }, ++ { XFRM_MSG_MAPPING, NETLINK_XFRM_SOCKET__NLMSG_READ }, + }; + + static struct nlmsg_perm nlmsg_audit_perms[] = +diff --git a/sound/pci/emu10k1/emu10k1.c b/sound/pci/emu10k1/emu10k1.c +index eaa198e..f33e3cc 100644 +--- a/sound/pci/emu10k1/emu10k1.c ++++ b/sound/pci/emu10k1/emu10k1.c +@@ -181,8 +181,10 @@ static int __devinit snd_card_emu10k1_probe(struct pci_dev *pci, + } + #endif + +- strcpy(card->driver, emu->card_capabilities->driver); +- strcpy(card->shortname, emu->card_capabilities->name); ++ strlcpy(card->driver, emu->card_capabilities->driver, ++ sizeof(card->driver)); ++ strlcpy(card->shortname, emu->card_capabilities->name, ++ sizeof(card->shortname)); + snprintf(card->longname, sizeof(card->longname), + "%s (rev.%d, serial:0x%x) at 0x%lx, irq %i", + card->shortname, emu->revision, emu->serial, emu->port, emu->irq); +diff --git a/sound/pci/emu10k1/emu10k1_callback.c b/sound/pci/emu10k1/emu10k1_callback.c +index f35284b..8295950 100644 +--- a/sound/pci/emu10k1/emu10k1_callback.c ++++ b/sound/pci/emu10k1/emu10k1_callback.c +@@ -415,7 +415,7 @@ start_voice(struct snd_emux_voice *vp) + snd_emu10k1_ptr_write(hw, Z2, ch, 0); + + /* invalidate maps */ +- temp = (hw->silent_page.addr << 1) | MAP_PTI_MASK; ++ temp = (hw->silent_page.addr << hw->address_mode) | (hw->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0); + snd_emu10k1_ptr_write(hw, MAPA, ch, temp); + snd_emu10k1_ptr_write(hw, MAPB, ch, temp); + #if 0 +@@ -436,7 +436,7 @@ start_voice(struct snd_emux_voice *vp) + snd_emu10k1_ptr_write(hw, CDF, ch, sample); + + /* invalidate maps */ +- temp = ((unsigned int)hw->silent_page.addr << 1) | MAP_PTI_MASK; ++ temp = ((unsigned int)hw->silent_page.addr << hw_address_mode) | (hw->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0); + snd_emu10k1_ptr_write(hw, MAPA, ch, temp); + snd_emu10k1_ptr_write(hw, MAPB, ch, temp); + +diff --git a/sound/pci/emu10k1/emu10k1_main.c b/sound/pci/emu10k1/emu10k1_main.c +index d37b946..705e73e 100644 +--- a/sound/pci/emu10k1/emu10k1_main.c ++++ b/sound/pci/emu10k1/emu10k1_main.c +@@ -282,7 +282,7 @@ static int snd_emu10k1_init(struct snd_emu10k1 *emu, int enable_ir, int resume) + snd_emu10k1_ptr_write(emu, TCB, 0, 0); /* taken from original driver */ + snd_emu10k1_ptr_write(emu, TCBS, 0, 4); /* taken from original driver */ + +- silent_page = (emu->silent_page.addr << 1) | MAP_PTI_MASK; ++ silent_page = (emu->silent_page.addr << emu->address_mode) | (emu->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0); + for (ch = 0; ch < NUM_G; ch++) { + snd_emu10k1_ptr_write(emu, MAPA, ch, silent_page); + snd_emu10k1_ptr_write(emu, MAPB, ch, silent_page); +@@ -348,6 +348,11 @@ static int snd_emu10k1_init(struct snd_emu10k1 *emu, int enable_ir, int resume) + outl(reg | A_IOCFG_GPOUT0, emu->port + A_IOCFG); + } + ++ if (emu->address_mode == 0) { ++ /* use 16M in 4G */ ++ outl(inl(emu->port + HCFG) | HCFG_EXPANDED_MEM, emu->port + HCFG); ++ } ++ + return 0; + } + +@@ -1390,7 +1395,7 @@ static struct snd_emu_chip_details emu_chip_details[] = { + * + */ + {.vendor = 0x1102, .device = 0x0008, .subsystem = 0x20011102, +- .driver = "Audigy2", .name = "SB Audigy 2 ZS Notebook [SB0530]", ++ .driver = "Audigy2", .name = "Audigy 2 ZS Notebook [SB0530]", + .id = "Audigy2", + .emu10k2_chip = 1, + .ca0108_chip = 1, +@@ -1528,7 +1533,7 @@ static struct snd_emu_chip_details emu_chip_details[] = { + .adc_1361t = 1, /* 24 bit capture instead of 16bit */ + .ac97_chip = 1} , + {.vendor = 0x1102, .device = 0x0004, .subsystem = 0x10051102, +- .driver = "Audigy2", .name = "SB Audigy 2 Platinum EX [SB0280]", ++ .driver = "Audigy2", .name = "Audigy 2 Platinum EX [SB0280]", + .id = "Audigy2", + .emu10k2_chip = 1, + .ca0102_chip = 1, +@@ -1832,8 +1837,10 @@ int __devinit snd_emu10k1_create(struct snd_card *card, + + is_audigy = emu->audigy = c->emu10k2_chip; + ++ /* set addressing mode */ ++ emu->address_mode = is_audigy ? 0 : 1; + /* set the DMA transfer mask */ +- emu->dma_mask = is_audigy ? AUDIGY_DMA_MASK : EMU10K1_DMA_MASK; ++ emu->dma_mask = emu->address_mode ? EMU10K1_DMA_MASK : AUDIGY_DMA_MASK; + if (pci_set_dma_mask(pci, emu->dma_mask) < 0 || + pci_set_consistent_dma_mask(pci, emu->dma_mask) < 0) { + snd_printk(KERN_ERR "architecture does not support PCI busmaster DMA with mask 0x%lx\n", emu->dma_mask); +@@ -1856,7 +1863,7 @@ int __devinit snd_emu10k1_create(struct snd_card *card, + + emu->max_cache_pages = max_cache_bytes >> PAGE_SHIFT; + if (snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV, snd_dma_pci_data(pci), +- 32 * 1024, &emu->ptb_pages) < 0) { ++ (emu->address_mode ? 32 : 16) * 1024, &emu->ptb_pages) < 0) { + err = -ENOMEM; + goto error; + } +@@ -1955,8 +1962,8 @@ int __devinit snd_emu10k1_create(struct snd_card *card, + + /* Clear silent pages and set up pointers */ + memset(emu->silent_page.area, 0, PAGE_SIZE); +- silent_page = emu->silent_page.addr << 1; +- for (idx = 0; idx < MAXPAGES; idx++) ++ silent_page = emu->silent_page.addr << emu->address_mode; ++ for (idx = 0; idx < (emu->address_mode ? MAXPAGES1 : MAXPAGES0); idx++) + ((u32 *)emu->ptb_pages.area)[idx] = cpu_to_le32(silent_page | idx); + + /* set up voice indices */ +diff --git a/sound/pci/emu10k1/emupcm.c b/sound/pci/emu10k1/emupcm.c +index e22b8e2..c673d2b 100644 +--- a/sound/pci/emu10k1/emupcm.c ++++ b/sound/pci/emu10k1/emupcm.c +@@ -379,7 +379,7 @@ static void snd_emu10k1_pcm_init_voice(struct snd_emu10k1 *emu, + snd_emu10k1_ptr_write(emu, Z1, voice, 0); + snd_emu10k1_ptr_write(emu, Z2, voice, 0); + /* invalidate maps */ +- silent_page = ((unsigned int)emu->silent_page.addr << 1) | MAP_PTI_MASK; ++ silent_page = ((unsigned int)emu->silent_page.addr << emu->address_mode) | (emu->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0); + snd_emu10k1_ptr_write(emu, MAPA, voice, silent_page); + snd_emu10k1_ptr_write(emu, MAPB, voice, silent_page); + /* modulation envelope */ +diff --git a/sound/pci/emu10k1/emuproc.c b/sound/pci/emu10k1/emuproc.c +index bc38dd4..9c499e6 100644 +--- a/sound/pci/emu10k1/emuproc.c ++++ b/sound/pci/emu10k1/emuproc.c +@@ -241,31 +241,22 @@ static void snd_emu10k1_proc_spdif_read(struct snd_info_entry *entry, + struct snd_emu10k1 *emu = entry->private_data; + u32 value; + u32 value2; +- unsigned long flags; + u32 rate; + + if (emu->card_capabilities->emu_model) { +- spin_lock_irqsave(&emu->emu_lock, flags); + snd_emu1010_fpga_read(emu, 0x38, &value); +- spin_unlock_irqrestore(&emu->emu_lock, flags); + if ((value & 0x1) == 0) { +- spin_lock_irqsave(&emu->emu_lock, flags); + snd_emu1010_fpga_read(emu, 0x2a, &value); + snd_emu1010_fpga_read(emu, 0x2b, &value2); +- spin_unlock_irqrestore(&emu->emu_lock, flags); + rate = 0x1770000 / (((value << 5) | value2)+1); + snd_iprintf(buffer, "ADAT Locked : %u\n", rate); + } else { + snd_iprintf(buffer, "ADAT Unlocked\n"); + } +- spin_lock_irqsave(&emu->emu_lock, flags); + snd_emu1010_fpga_read(emu, 0x20, &value); +- spin_unlock_irqrestore(&emu->emu_lock, flags); + if ((value & 0x4) == 0) { +- spin_lock_irqsave(&emu->emu_lock, flags); + snd_emu1010_fpga_read(emu, 0x28, &value); + snd_emu1010_fpga_read(emu, 0x29, &value2); +- spin_unlock_irqrestore(&emu->emu_lock, flags); + rate = 0x1770000 / (((value << 5) | value2)+1); + snd_iprintf(buffer, "SPDIF Locked : %d\n", rate); + } else { +@@ -410,14 +401,11 @@ static void snd_emu_proc_emu1010_reg_read(struct snd_info_entry *entry, + { + struct snd_emu10k1 *emu = entry->private_data; + u32 value; +- unsigned long flags; + int i; + snd_iprintf(buffer, "EMU1010 Registers:\n\n"); + + for(i = 0; i < 0x40; i+=1) { +- spin_lock_irqsave(&emu->emu_lock, flags); + snd_emu1010_fpga_read(emu, i, &value); +- spin_unlock_irqrestore(&emu->emu_lock, flags); + snd_iprintf(buffer, "%02X: %08X, %02X\n", i, value, (value >> 8) & 0x7f); + } + } +diff --git a/sound/pci/emu10k1/memory.c b/sound/pci/emu10k1/memory.c +index 4f502a2..87b7c65 100644 +--- a/sound/pci/emu10k1/memory.c ++++ b/sound/pci/emu10k1/memory.c +@@ -34,10 +34,11 @@ + * aligned pages in others + */ + #define __set_ptb_entry(emu,page,addr) \ +- (((u32 *)(emu)->ptb_pages.area)[page] = cpu_to_le32(((addr) << 1) | (page))) ++ (((u32 *)(emu)->ptb_pages.area)[page] = cpu_to_le32(((addr) << (emu->address_mode)) | (page))) + + #define UNIT_PAGES (PAGE_SIZE / EMUPAGESIZE) +-#define MAX_ALIGN_PAGES (MAXPAGES / UNIT_PAGES) ++#define MAX_ALIGN_PAGES0 (MAXPAGES0 / UNIT_PAGES) ++#define MAX_ALIGN_PAGES1 (MAXPAGES1 / UNIT_PAGES) + /* get aligned page from offset address */ + #define get_aligned_page(offset) ((offset) >> PAGE_SHIFT) + /* get offset address from aligned page */ +@@ -124,7 +125,7 @@ static int search_empty_map_area(struct snd_emu10k1 *emu, int npages, struct lis + } + page = blk->mapped_page + blk->pages; + } +- size = MAX_ALIGN_PAGES - page; ++ size = (emu->address_mode ? MAX_ALIGN_PAGES1 : MAX_ALIGN_PAGES0) - page; + if (size >= max_size) { + *nextp = pos; + return page; +@@ -181,7 +182,7 @@ static int unmap_memblk(struct snd_emu10k1 *emu, struct snd_emu10k1_memblk *blk) + q = get_emu10k1_memblk(p, mapped_link); + end_page = q->mapped_page; + } else +- end_page = MAX_ALIGN_PAGES; ++ end_page = (emu->address_mode ? MAX_ALIGN_PAGES1 : MAX_ALIGN_PAGES0); + + /* remove links */ + list_del(&blk->mapped_link); +@@ -305,7 +306,7 @@ snd_emu10k1_alloc_pages(struct snd_emu10k1 *emu, struct snd_pcm_substream *subst + if (snd_BUG_ON(!emu)) + return NULL; + if (snd_BUG_ON(runtime->dma_bytes <= 0 || +- runtime->dma_bytes >= MAXPAGES * EMUPAGESIZE)) ++ runtime->dma_bytes >= (emu->address_mode ? MAXPAGES1 : MAXPAGES0) * EMUPAGESIZE)) + return NULL; + hdr = emu->memhdr; + if (snd_BUG_ON(!hdr)) +diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c +index 843d9f3..6a524fb 100644 +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -4598,6 +4598,14 @@ static const struct hda_codec_preset snd_hda_preset_conexant[] = { + .patch = patch_conexant_auto }, + { .id = 0x14f150b9, .name = "CX20665", + .patch = patch_conexant_auto }, ++ { .id = 0x14f150f1, .name = "CX20721", ++ .patch = patch_conexant_auto }, ++ { .id = 0x14f150f2, .name = "CX20722", ++ .patch = patch_conexant_auto }, ++ { .id = 0x14f150f3, .name = "CX20723", ++ .patch = patch_conexant_auto }, ++ { .id = 0x14f150f4, .name = "CX20724", ++ .patch = patch_conexant_auto }, + { .id = 0x14f1510f, .name = "CX20751/2", + .patch = patch_conexant_auto }, + { .id = 0x14f15110, .name = "CX20751/2", +@@ -4632,6 +4640,10 @@ MODULE_ALIAS("snd-hda-codec-id:14f150ab"); + MODULE_ALIAS("snd-hda-codec-id:14f150ac"); + MODULE_ALIAS("snd-hda-codec-id:14f150b8"); + MODULE_ALIAS("snd-hda-codec-id:14f150b9"); ++MODULE_ALIAS("snd-hda-codec-id:14f150f1"); ++MODULE_ALIAS("snd-hda-codec-id:14f150f2"); ++MODULE_ALIAS("snd-hda-codec-id:14f150f3"); ++MODULE_ALIAS("snd-hda-codec-id:14f150f4"); + MODULE_ALIAS("snd-hda-codec-id:14f1510f"); + MODULE_ALIAS("snd-hda-codec-id:14f15110"); + MODULE_ALIAS("snd-hda-codec-id:14f15111"); +diff --git a/sound/soc/codecs/cs4271.c b/sound/soc/codecs/cs4271.c +index 561d5e0..e99c10b 100644 +--- a/sound/soc/codecs/cs4271.c ++++ b/sound/soc/codecs/cs4271.c +@@ -475,10 +475,10 @@ static int cs4271_probe(struct snd_soc_codec *codec) + if (gpio_nreset >= 0) { + /* Reset codec */ + gpio_direction_output(gpio_nreset, 0); +- udelay(1); ++ mdelay(1); + gpio_set_value(gpio_nreset, 1); + /* Give the codec time to wake up */ +- udelay(1); ++ mdelay(1); + } + + cs4271->gpio_nreset = gpio_nreset; +diff --git a/sound/soc/codecs/wm8741.c b/sound/soc/codecs/wm8741.c +index 57ad22a..6ab4f27 100644 +--- a/sound/soc/codecs/wm8741.c ++++ b/sound/soc/codecs/wm8741.c +@@ -117,7 +117,7 @@ static struct { + }; + + static unsigned int rates_11289[] = { +- 44100, 88235, ++ 44100, 88200, + }; + + static struct snd_pcm_hw_constraint_list constraints_11289 = { +@@ -144,7 +144,7 @@ static struct snd_pcm_hw_constraint_list constraints_16384 = { + }; + + static unsigned int rates_16934[] = { +- 44100, 88235, ++ 44100, 88200, + }; + + static struct snd_pcm_hw_constraint_list constraints_16934 = { +@@ -162,7 +162,7 @@ static struct snd_pcm_hw_constraint_list constraints_18432 = { + }; + + static unsigned int rates_22579[] = { +- 44100, 88235, 1764000 ++ 44100, 88200, 176400 + }; + + static struct snd_pcm_hw_constraint_list constraints_22579 = { +@@ -180,7 +180,7 @@ static struct snd_pcm_hw_constraint_list constraints_24576 = { + }; + + static unsigned int rates_36864[] = { +- 48000, 96000, 19200 ++ 48000, 96000, 192000 + }; + + static struct snd_pcm_hw_constraint_list constraints_36864 = { +diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c +index b2abe93..8d26104 100644 +--- a/sound/soc/codecs/wm8960.c ++++ b/sound/soc/codecs/wm8960.c +@@ -336,7 +336,7 @@ static const struct snd_soc_dapm_route audio_paths[] = { + { "Right Input Mixer", "Boost Switch", "Right Boost Mixer", }, + { "Right Input Mixer", NULL, "RINPUT1", }, /* Really Boost Switch */ + { "Right Input Mixer", NULL, "RINPUT2" }, +- { "Right Input Mixer", NULL, "LINPUT3" }, ++ { "Right Input Mixer", NULL, "RINPUT3" }, + + { "Left ADC", NULL, "Left Input Mixer" }, + { "Right ADC", NULL, "Right Input Mixer" }, +diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c +index b73f226..9a56798 100644 +--- a/sound/soc/codecs/wm8994.c ++++ b/sound/soc/codecs/wm8994.c +@@ -2449,7 +2449,7 @@ static struct { + }; + + static int fs_ratios[] = { +- 64, 128, 192, 256, 348, 512, 768, 1024, 1408, 1536 ++ 64, 128, 192, 256, 384, 512, 768, 1024, 1408, 1536 + }; + + static int bclk_divs[] = { +diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c +index 1d83a40..3dc1b8a 100644 +--- a/sound/soc/soc-dapm.c ++++ b/sound/soc/soc-dapm.c +@@ -2675,12 +2675,18 @@ int snd_soc_dapm_new_control(struct snd_soc_dapm_context *dapm, + kfree(w); + return -ENOMEM; + } +- if (dapm->codec && dapm->codec->name_prefix) ++ if (dapm->codec && dapm->codec->name_prefix) { + snprintf(w->name, name_len, "%s %s", + dapm->codec->name_prefix, widget->name); +- else ++ if (widget->sname) ++ w->sname = kasprintf(GFP_KERNEL, "%s %s", ++ dapm->codec->name_prefix, ++ widget->sname); ++ } else { + snprintf(w->name, name_len, "%s", widget->name); +- ++ if (widget->sname) ++ w->sname = kasprintf(GFP_KERNEL, "%s", widget->sname); ++ } + switch (w->id) { + case snd_soc_dapm_switch: + case snd_soc_dapm_mixer: +diff --git a/sound/synth/emux/emux_oss.c b/sound/synth/emux/emux_oss.c +index 319754c..daf61ab 100644 +--- a/sound/synth/emux/emux_oss.c ++++ b/sound/synth/emux/emux_oss.c +@@ -118,12 +118,8 @@ snd_emux_open_seq_oss(struct snd_seq_oss_arg *arg, void *closure) + if (snd_BUG_ON(!arg || !emu)) + return -ENXIO; + +- mutex_lock(&emu->register_mutex); +- +- if (!snd_emux_inc_count(emu)) { +- mutex_unlock(&emu->register_mutex); ++ if (!snd_emux_inc_count(emu)) + return -EFAULT; +- } + + memset(&callback, 0, sizeof(callback)); + callback.owner = THIS_MODULE; +@@ -135,7 +131,6 @@ snd_emux_open_seq_oss(struct snd_seq_oss_arg *arg, void *closure) + if (p == NULL) { + snd_printk(KERN_ERR "can't create port\n"); + snd_emux_dec_count(emu); +- mutex_unlock(&emu->register_mutex); + return -ENOMEM; + } + +@@ -148,8 +143,6 @@ snd_emux_open_seq_oss(struct snd_seq_oss_arg *arg, void *closure) + reset_port_mode(p, arg->seq_mode); + + snd_emux_reset_port(p); +- +- mutex_unlock(&emu->register_mutex); + return 0; + } + +@@ -195,13 +188,11 @@ snd_emux_close_seq_oss(struct snd_seq_oss_arg *arg) + if (snd_BUG_ON(!emu)) + return -ENXIO; + +- mutex_lock(&emu->register_mutex); + snd_emux_sounds_off_all(p); + snd_soundfont_close_check(emu->sflist, SF_CLIENT_NO(p->chset.port)); + snd_seq_event_port_detach(p->chset.client, p->chset.port); + snd_emux_dec_count(emu); + +- mutex_unlock(&emu->register_mutex); + return 0; + } + +diff --git a/sound/synth/emux/emux_seq.c b/sound/synth/emux/emux_seq.c +index 7778b8e..a020920 100644 +--- a/sound/synth/emux/emux_seq.c ++++ b/sound/synth/emux/emux_seq.c +@@ -124,12 +124,10 @@ snd_emux_detach_seq(struct snd_emux *emu) + if (emu->voices) + snd_emux_terminate_all(emu); + +- mutex_lock(&emu->register_mutex); + if (emu->client >= 0) { + snd_seq_delete_kernel_client(emu->client); + emu->client = -1; + } +- mutex_unlock(&emu->register_mutex); + } + + +@@ -269,8 +267,8 @@ snd_emux_event_input(struct snd_seq_event *ev, int direct, void *private_data, + /* + * increment usage count + */ +-int +-snd_emux_inc_count(struct snd_emux *emu) ++static int ++__snd_emux_inc_count(struct snd_emux *emu) + { + emu->used++; + if (!try_module_get(emu->ops.owner)) +@@ -284,12 +282,21 @@ snd_emux_inc_count(struct snd_emux *emu) + return 1; + } + ++int snd_emux_inc_count(struct snd_emux *emu) ++{ ++ int ret; ++ ++ mutex_lock(&emu->register_mutex); ++ ret = __snd_emux_inc_count(emu); ++ mutex_unlock(&emu->register_mutex); ++ return ret; ++} + + /* + * decrease usage count + */ +-void +-snd_emux_dec_count(struct snd_emux *emu) ++static void ++__snd_emux_dec_count(struct snd_emux *emu) + { + module_put(emu->card->module); + emu->used--; +@@ -298,6 +305,12 @@ snd_emux_dec_count(struct snd_emux *emu) + module_put(emu->ops.owner); + } + ++void snd_emux_dec_count(struct snd_emux *emu) ++{ ++ mutex_lock(&emu->register_mutex); ++ __snd_emux_dec_count(emu); ++ mutex_unlock(&emu->register_mutex); ++} + + /* + * Routine that is called upon a first use of a particular port +@@ -317,7 +330,7 @@ snd_emux_use(void *private_data, struct snd_seq_port_subscribe *info) + + mutex_lock(&emu->register_mutex); + snd_emux_init_port(p); +- snd_emux_inc_count(emu); ++ __snd_emux_inc_count(emu); + mutex_unlock(&emu->register_mutex); + return 0; + } +@@ -340,7 +353,7 @@ snd_emux_unuse(void *private_data, struct snd_seq_port_subscribe *info) + + mutex_lock(&emu->register_mutex); + snd_emux_sounds_off_all(p); +- snd_emux_dec_count(emu); ++ __snd_emux_dec_count(emu); + mutex_unlock(&emu->register_mutex); + return 0; + } +diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c +index 88160b7..488e531 100644 +--- a/sound/usb/mixer.c ++++ b/sound/usb/mixer.c +@@ -838,6 +838,8 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval, + case USB_ID(0x046d, 0x081b): /* HD Webcam c310 */ + case USB_ID(0x046d, 0x081d): /* HD Webcam c510 */ + case USB_ID(0x046d, 0x0825): /* HD Webcam c270 */ ++ case USB_ID(0x046d, 0x0826): /* HD Webcam c525 */ ++ case USB_ID(0x046d, 0x08ca): /* Logitech Quickcam Fusion */ + case USB_ID(0x046d, 0x0991): + /* Most audio usb devices lie about volume resolution. + * Most Logitech webcams have res = 384. +@@ -1423,11 +1425,6 @@ static int parse_audio_mixer_unit(struct mixer_build *state, int unitid, void *r + snd_printk(KERN_ERR "invalid MIXER UNIT descriptor %d\n", unitid); + return -EINVAL; + } +- /* no bmControls field (e.g. Maya44) -> ignore */ +- if (desc->bLength <= 10 + input_pins) { +- snd_printdd(KERN_INFO "MU %d has no bmControls field\n", unitid); +- return 0; +- } + + num_ins = 0; + ich = 0; +@@ -1435,6 +1432,9 @@ static int parse_audio_mixer_unit(struct mixer_build *state, int unitid, void *r + err = parse_audio_unit(state, desc->baSourceID[pin]); + if (err < 0) + return err; ++ /* no bmControls field (e.g. Maya44) -> ignore */ ++ if (desc->bLength <= 10 + input_pins) ++ continue; + err = check_input_term(state, desc->baSourceID[pin], &iterm); + if (err < 0) + return err; +diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c +index 1e0798f..851786f 100644 +--- a/sound/usb/mixer_maps.c ++++ b/sound/usb/mixer_maps.c +@@ -380,6 +380,11 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = { + .ignore_ctl_error = 1, + }, + { ++ /* MAYA44 USB+ */ ++ .id = USB_ID(0x2573, 0x0008), ++ .map = maya44_map, ++ }, ++ { + /* KEF X300A */ + .id = USB_ID(0x27ac, 0x1000), + .map = scms_usb3318_map, |