diff options
| author |   Mike Pagano <mpagano@gentoo.org> | 2015-09-21 11:57:15 -0400 |
|---|---|---|
| committer | Mike Pagano <mpagano@gentoo.org> | 2015-09-21 11:57:15 -0400 |
| commit | 37749aac60489f971a0be77982f7550a80209d39 (patch) | |
| tree | b28dcaa5de758918fc364e1b3d1f5195ebbc29b3 | |
| parent | Linux patch 3.4.108 (diff) | |
| download | linux-patches-37749aac60489f971a0be77982f7550a80209d39.tar.gz linux-patches-37749aac60489f971a0be77982f7550a80209d39.tar.bz2 linux-patches-37749aac60489f971a0be77982f7550a80209d39.zip | |
Linux patch 3.4.1093.4-92
| -rw-r--r-- | 0000_README | 4 | ||||
| -rw-r--r-- | 1108_linux-3.4.109.patch | 5116 |
2 files changed, 5120 insertions, 0 deletions
diff --git a/0000_README b/0000_README index 98c0230c..0fcce0d7 100644 --- a/0000_README +++ b/0000_README @@ -471,6 +471,10 @@ Patch: 1107_linux-3.4.108.patch From: http://www.kernel.org Desc: Linux 3.4.108 +Patch: 1108_linux-3.4.109.patch +From: http://www.kernel.org +Desc: Linux 3.4.109 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1108_linux-3.4.109.patch b/1108_linux-3.4.109.patch new file mode 100644 index 00000000..47549c8f --- /dev/null +++ b/1108_linux-3.4.109.patch @@ -0,0 +1,5116 @@ +diff --git a/Documentation/networking/rds.txt b/Documentation/networking/rds.txt +index c67077cbeb80..e1a3d59bbe0f 100644 +--- a/Documentation/networking/rds.txt ++++ b/Documentation/networking/rds.txt +@@ -62,11 +62,10 @@ Socket Interface + ================ + + AF_RDS, PF_RDS, SOL_RDS +- These constants haven't been assigned yet, because RDS isn't in +- mainline yet. Currently, the kernel module assigns some constant +- and publishes it to user space through two sysctl files +- /proc/sys/net/rds/pf_rds +- /proc/sys/net/rds/sol_rds ++ AF_RDS and PF_RDS are the domain type to be used with socket(2) ++ to create RDS sockets. SOL_RDS is the socket-level to be used ++ with setsockopt(2) and getsockopt(2) for RDS specific socket ++ options. + + fd = socket(PF_RDS, SOCK_SEQPACKET, 0); + This creates a new, unbound RDS socket. +diff --git a/Documentation/pinctrl.txt b/Documentation/pinctrl.txt +index d97bccf46147..d4647168eba0 100644 +--- a/Documentation/pinctrl.txt ++++ b/Documentation/pinctrl.txt +@@ -72,7 +72,6 @@ static struct pinctrl_desc foo_desc = { + .name = "foo", + .pins = foo_pins, + .npins = ARRAY_SIZE(foo_pins), +- .maxpin = 63, + .owner = THIS_MODULE, + }; + +@@ -166,8 +165,8 @@ static const char *foo_get_group_name(struct pinctrl_dev *pctldev, + } + + static int foo_get_group_pins(struct pinctrl_dev *pctldev, unsigned selector, +- unsigned ** const pins, +- unsigned * const num_pins) ++ const unsigned **pins, ++ unsigned *num_pins) + { + *pins = (unsigned *) foo_groups[selector].pins; + *num_pins = foo_groups[selector].num_pins; +@@ -1043,7 +1042,7 @@ The semantics of the pinctrl APIs are: + + Usually the pin control core handled the get/put pair and call out to the + device drivers bookkeeping operations, like checking available functions and +-the associated pins, whereas the enable/disable pass on to the pin controller ++the associated pins, whereas select_state pass on to the pin controller + driver which takes care of activating and/or deactivating the mux setting by + quickly poking some registers. + +@@ -1089,8 +1088,9 @@ function, but with different named in the mapping as described under + "Advanced mapping" above. So that for an SPI device, we have two states named + "pos-A" and "pos-B". + +-This snippet first muxes the function in the pins defined by group A, enables +-it, disables and releases it, and muxes it in on the pins defined by group B: ++This snippet first initializes a state object for both groups (in foo_probe()), ++then muxes the function in the pins defined by group A, and finally muxes it in ++on the pins defined by group B: + + #include <linux/pinctrl/consumer.h> + +diff --git a/Makefile b/Makefile +index 5056e1bba7e8..7337720d6599 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 4 +-SUBLEVEL = 108 ++SUBLEVEL = 109 + EXTRAVERSION = + NAME = Saber-toothed Squirrel + +diff --git a/arch/arm/boot/dts/imx27.dtsi b/arch/arm/boot/dts/imx27.dtsi +index bc5e7d5ddd54..9cc8ed2310e7 100644 +--- a/arch/arm/boot/dts/imx27.dtsi ++++ b/arch/arm/boot/dts/imx27.dtsi +@@ -208,7 +208,7 @@ + + fec: fec@1002b000 { + compatible = "fsl,imx27-fec"; +- reg = <0x1002b000 0x4000>; ++ reg = <0x1002b000 0x1000>; + interrupts = <50>; + status = "disabled"; + }; +diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h +index 38050b1c4800..dfc980ba7416 100644 +--- a/arch/arm/include/asm/elf.h ++++ b/arch/arm/include/asm/elf.h +@@ -116,7 +116,7 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs); + the loader. We need to make sure that it is out of the way of the program + that it will "exec", and that there is sufficient room for the brk. */ + +-#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3) ++#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2) + + /* When the program starts, a1 contains a pointer to a function to be + registered with atexit, as per the SVR4 ABI. A value of 0 means we +diff --git a/arch/arm/mach-pxa/Kconfig b/arch/arm/mach-pxa/Kconfig +index fe2d1f80ef50..2f8b17163a51 100644 +--- a/arch/arm/mach-pxa/Kconfig ++++ b/arch/arm/mach-pxa/Kconfig +@@ -718,4 +718,13 @@ config PXA_HAVE_ISA_IRQS + config PXA310_ULPI + bool + ++config PXA_SYSTEMS_CPLDS ++ tristate "Motherboard cplds" ++ default ARCH_LUBBOCK || MACH_MAINSTONE ++ help ++ This driver supports the Lubbock and Mainstone multifunction chip ++ found on the pxa25x development platform system (Lubbock) and pxa27x ++ development platform system (Mainstone). This IO board supports the ++ interrupts handling, ethernet controller, flash chips, etc ... ++ + endif +diff --git a/arch/arm/mach-pxa/Makefile b/arch/arm/mach-pxa/Makefile +index be0f7df8685c..318c0d756bc7 100644 +--- a/arch/arm/mach-pxa/Makefile ++++ b/arch/arm/mach-pxa/Makefile +@@ -103,4 +103,5 @@ led-$(CONFIG_ARCH_PXA_IDP) += leds-idp.o + + obj-$(CONFIG_LEDS) += $(led-y) + ++obj-$(CONFIG_PXA_SYSTEMS_CPLDS) += pxa_cplds_irqs.o + obj-$(CONFIG_TOSA_BT) += tosa-bt.o +diff --git a/arch/arm/mach-pxa/include/mach/lubbock.h b/arch/arm/mach-pxa/include/mach/lubbock.h +index 2a086e8373eb..b20b97e1df4c 100644 +--- a/arch/arm/mach-pxa/include/mach/lubbock.h ++++ b/arch/arm/mach-pxa/include/mach/lubbock.h +@@ -35,7 +35,9 @@ + #define LUB_GP __LUB_REG(LUBBOCK_FPGA_PHYS + 0x100) + + /* Board specific IRQs */ +-#define LUBBOCK_IRQ(x) (IRQ_BOARD_START + (x)) ++#define LUBBOCK_NR_IRQS IRQ_BOARD_START ++ ++#define LUBBOCK_IRQ(x) (LUBBOCK_NR_IRQS + (x)) + #define LUBBOCK_SD_IRQ LUBBOCK_IRQ(0) + #define LUBBOCK_SA1111_IRQ LUBBOCK_IRQ(1) + #define LUBBOCK_USB_IRQ LUBBOCK_IRQ(2) /* usb connect */ +@@ -45,8 +47,7 @@ + #define LUBBOCK_USB_DISC_IRQ LUBBOCK_IRQ(6) /* usb disconnect */ + #define LUBBOCK_LAST_IRQ LUBBOCK_IRQ(6) + +-#define LUBBOCK_SA1111_IRQ_BASE (IRQ_BOARD_START + 16) +-#define LUBBOCK_NR_IRQS (IRQ_BOARD_START + 16 + 55) ++#define LUBBOCK_SA1111_IRQ_BASE (LUBBOCK_NR_IRQS + 32) + + #ifndef __ASSEMBLY__ + extern void lubbock_set_misc_wr(unsigned int mask, unsigned int set); +diff --git a/arch/arm/mach-pxa/include/mach/mainstone.h b/arch/arm/mach-pxa/include/mach/mainstone.h +index 1bfc4e822a41..e82a7d31104e 100644 +--- a/arch/arm/mach-pxa/include/mach/mainstone.h ++++ b/arch/arm/mach-pxa/include/mach/mainstone.h +@@ -120,7 +120,9 @@ + #define MST_PCMCIA_PWR_VCC_50 0x4 /* voltage VCC = 5.0V */ + + /* board specific IRQs */ +-#define MAINSTONE_IRQ(x) (IRQ_BOARD_START + (x)) ++#define MAINSTONE_NR_IRQS IRQ_BOARD_START ++ ++#define MAINSTONE_IRQ(x) (MAINSTONE_NR_IRQS + (x)) + #define MAINSTONE_MMC_IRQ MAINSTONE_IRQ(0) + #define MAINSTONE_USIM_IRQ MAINSTONE_IRQ(1) + #define MAINSTONE_USBC_IRQ MAINSTONE_IRQ(2) +@@ -136,6 +138,4 @@ + #define MAINSTONE_S1_STSCHG_IRQ MAINSTONE_IRQ(14) + #define MAINSTONE_S1_IRQ MAINSTONE_IRQ(15) + +-#define MAINSTONE_NR_IRQS (IRQ_BOARD_START + 16) +- + #endif +diff --git a/arch/arm/mach-pxa/lubbock.c b/arch/arm/mach-pxa/lubbock.c +index 6bb3f47b1f14..799f31f2c7ff 100644 +--- a/arch/arm/mach-pxa/lubbock.c ++++ b/arch/arm/mach-pxa/lubbock.c +@@ -12,6 +12,7 @@ + * published by the Free Software Foundation. + */ + #include <linux/gpio.h> ++#include <linux/gpio/machine.h> + #include <linux/module.h> + #include <linux/kernel.h> + #include <linux/init.h> +@@ -120,84 +121,6 @@ void lubbock_set_misc_wr(unsigned int mask, unsigned int set) + } + EXPORT_SYMBOL(lubbock_set_misc_wr); + +-static unsigned long lubbock_irq_enabled; +- +-static void lubbock_mask_irq(struct irq_data *d) +-{ +- int lubbock_irq = (d->irq - LUBBOCK_IRQ(0)); +- LUB_IRQ_MASK_EN = (lubbock_irq_enabled &= ~(1 << lubbock_irq)); +-} +- +-static void lubbock_unmask_irq(struct irq_data *d) +-{ +- int lubbock_irq = (d->irq - LUBBOCK_IRQ(0)); +- /* the irq can be acknowledged only if deasserted, so it's done here */ +- LUB_IRQ_SET_CLR &= ~(1 << lubbock_irq); +- LUB_IRQ_MASK_EN = (lubbock_irq_enabled |= (1 << lubbock_irq)); +-} +- +-static struct irq_chip lubbock_irq_chip = { +- .name = "FPGA", +- .irq_ack = lubbock_mask_irq, +- .irq_mask = lubbock_mask_irq, +- .irq_unmask = lubbock_unmask_irq, +-}; +- +-static void lubbock_irq_handler(unsigned int irq, struct irq_desc *desc) +-{ +- unsigned long pending = LUB_IRQ_SET_CLR & lubbock_irq_enabled; +- do { +- /* clear our parent irq */ +- desc->irq_data.chip->irq_ack(&desc->irq_data); +- if (likely(pending)) { +- irq = LUBBOCK_IRQ(0) + __ffs(pending); +- generic_handle_irq(irq); +- } +- pending = LUB_IRQ_SET_CLR & lubbock_irq_enabled; +- } while (pending); +-} +- +-static void __init lubbock_init_irq(void) +-{ +- int irq; +- +- pxa25x_init_irq(); +- +- /* setup extra lubbock irqs */ +- for (irq = LUBBOCK_IRQ(0); irq <= LUBBOCK_LAST_IRQ; irq++) { +- irq_set_chip_and_handler(irq, &lubbock_irq_chip, +- handle_level_irq); +- set_irq_flags(irq, IRQF_VALID | IRQF_PROBE); +- } +- +- irq_set_chained_handler(PXA_GPIO_TO_IRQ(0), lubbock_irq_handler); +- irq_set_irq_type(PXA_GPIO_TO_IRQ(0), IRQ_TYPE_EDGE_FALLING); +-} +- +-#ifdef CONFIG_PM +- +-static void lubbock_irq_resume(void) +-{ +- LUB_IRQ_MASK_EN = lubbock_irq_enabled; +-} +- +-static struct syscore_ops lubbock_irq_syscore_ops = { +- .resume = lubbock_irq_resume, +-}; +- +-static int __init lubbock_irq_device_init(void) +-{ +- if (machine_is_lubbock()) { +- register_syscore_ops(&lubbock_irq_syscore_ops); +- return 0; +- } +- return -ENODEV; +-} +- +-device_initcall(lubbock_irq_device_init); +- +-#endif +- + static int lubbock_udc_is_connected(void) + { + return (LUB_MISC_RD & (1 << 9)) == 0; +@@ -380,11 +303,38 @@ static struct platform_device lubbock_flash_device[2] = { + }, + }; + ++static struct resource lubbock_cplds_resources[] = { ++ [0] = { ++ .start = LUBBOCK_FPGA_PHYS + 0xc0, ++ .end = LUBBOCK_FPGA_PHYS + 0xe0 - 1, ++ .flags = IORESOURCE_MEM, ++ }, ++ [1] = { ++ .start = PXA_GPIO_TO_IRQ(0), ++ .end = PXA_GPIO_TO_IRQ(0), ++ .flags = IORESOURCE_IRQ | IORESOURCE_IRQ_LOWEDGE, ++ }, ++ [2] = { ++ .start = LUBBOCK_IRQ(0), ++ .end = LUBBOCK_IRQ(6), ++ .flags = IORESOURCE_IRQ, ++ }, ++}; ++ ++static struct platform_device lubbock_cplds_device = { ++ .name = "pxa_cplds_irqs", ++ .id = -1, ++ .resource = &lubbock_cplds_resources[0], ++ .num_resources = 3, ++}; ++ ++ + static struct platform_device *devices[] __initdata = { + &sa1111_device, + &smc91x_device, + &lubbock_flash_device[0], + &lubbock_flash_device[1], ++ &lubbock_cplds_device, + }; + + static struct pxafb_mode_info sharp_lm8v31_mode = { +@@ -553,7 +503,7 @@ MACHINE_START(LUBBOCK, "Intel DBPXA250 Development Platform (aka Lubbock)") + /* Maintainer: MontaVista Software Inc. */ + .map_io = lubbock_map_io, + .nr_irqs = LUBBOCK_NR_IRQS, +- .init_irq = lubbock_init_irq, ++ .init_irq = pxa25x_init_irq, + .handle_irq = pxa25x_handle_irq, + .timer = &pxa_timer, + .init_machine = lubbock_init, +diff --git a/arch/arm/mach-pxa/mainstone.c b/arch/arm/mach-pxa/mainstone.c +index 1aebaf719462..3d679dbc3cc6 100644 +--- a/arch/arm/mach-pxa/mainstone.c ++++ b/arch/arm/mach-pxa/mainstone.c +@@ -13,6 +13,7 @@ + * published by the Free Software Foundation. + */ + #include <linux/gpio.h> ++#include <linux/gpio/machine.h> + #include <linux/init.h> + #include <linux/platform_device.h> + #include <linux/syscore_ops.h> +@@ -120,92 +121,6 @@ static unsigned long mainstone_pin_config[] = { + GPIO1_GPIO | WAKEUP_ON_EDGE_BOTH, + }; + +-static unsigned long mainstone_irq_enabled; +- +-static void mainstone_mask_irq(struct irq_data *d) +-{ +- int mainstone_irq = (d->irq - MAINSTONE_IRQ(0)); +- MST_INTMSKENA = (mainstone_irq_enabled &= ~(1 << mainstone_irq)); +-} +- +-static void mainstone_unmask_irq(struct irq_data *d) +-{ +- int mainstone_irq = (d->irq - MAINSTONE_IRQ(0)); +- /* the irq can be acknowledged only if deasserted, so it's done here */ +- MST_INTSETCLR &= ~(1 << mainstone_irq); +- MST_INTMSKENA = (mainstone_irq_enabled |= (1 << mainstone_irq)); +-} +- +-static struct irq_chip mainstone_irq_chip = { +- .name = "FPGA", +- .irq_ack = mainstone_mask_irq, +- .irq_mask = mainstone_mask_irq, +- .irq_unmask = mainstone_unmask_irq, +-}; +- +-static void mainstone_irq_handler(unsigned int irq, struct irq_desc *desc) +-{ +- unsigned long pending = MST_INTSETCLR & mainstone_irq_enabled; +- do { +- /* clear useless edge notification */ +- desc->irq_data.chip->irq_ack(&desc->irq_data); +- if (likely(pending)) { +- irq = MAINSTONE_IRQ(0) + __ffs(pending); +- generic_handle_irq(irq); +- } +- pending = MST_INTSETCLR & mainstone_irq_enabled; +- } while (pending); +-} +- +-static void __init mainstone_init_irq(void) +-{ +- int irq; +- +- pxa27x_init_irq(); +- +- /* setup extra Mainstone irqs */ +- for(irq = MAINSTONE_IRQ(0); irq <= MAINSTONE_IRQ(15); irq++) { +- irq_set_chip_and_handler(irq, &mainstone_irq_chip, +- handle_level_irq); +- if (irq == MAINSTONE_IRQ(10) || irq == MAINSTONE_IRQ(14)) +- set_irq_flags(irq, IRQF_VALID | IRQF_PROBE | IRQF_NOAUTOEN); +- else +- set_irq_flags(irq, IRQF_VALID | IRQF_PROBE); +- } +- set_irq_flags(MAINSTONE_IRQ(8), 0); +- set_irq_flags(MAINSTONE_IRQ(12), 0); +- +- MST_INTMSKENA = 0; +- MST_INTSETCLR = 0; +- +- irq_set_chained_handler(PXA_GPIO_TO_IRQ(0), mainstone_irq_handler); +- irq_set_irq_type(PXA_GPIO_TO_IRQ(0), IRQ_TYPE_EDGE_FALLING); +-} +- +-#ifdef CONFIG_PM +- +-static void mainstone_irq_resume(void) +-{ +- MST_INTMSKENA = mainstone_irq_enabled; +-} +- +-static struct syscore_ops mainstone_irq_syscore_ops = { +- .resume = mainstone_irq_resume, +-}; +- +-static int __init mainstone_irq_device_init(void) +-{ +- if (machine_is_mainstone()) +- register_syscore_ops(&mainstone_irq_syscore_ops); +- +- return 0; +-} +- +-device_initcall(mainstone_irq_device_init); +- +-#endif +- +- + static struct resource smc91x_resources[] = { + [0] = { + .start = (MST_ETH_PHYS + 0x300), +@@ -483,11 +398,37 @@ static struct platform_device mst_gpio_keys_device = { + }, + }; + ++static struct resource mst_cplds_resources[] = { ++ [0] = { ++ .start = MST_FPGA_PHYS + 0xc0, ++ .end = MST_FPGA_PHYS + 0xe0 - 1, ++ .flags = IORESOURCE_MEM, ++ }, ++ [1] = { ++ .start = PXA_GPIO_TO_IRQ(0), ++ .end = PXA_GPIO_TO_IRQ(0), ++ .flags = IORESOURCE_IRQ | IORESOURCE_IRQ_LOWEDGE, ++ }, ++ [2] = { ++ .start = MAINSTONE_IRQ(0), ++ .end = MAINSTONE_IRQ(15), ++ .flags = IORESOURCE_IRQ, ++ }, ++}; ++ ++static struct platform_device mst_cplds_device = { ++ .name = "pxa_cplds_irqs", ++ .id = -1, ++ .resource = &mst_cplds_resources[0], ++ .num_resources = 3, ++}; ++ + static struct platform_device *platform_devices[] __initdata = { + &smc91x_device, + &mst_flash_device[0], + &mst_flash_device[1], + &mst_gpio_keys_device, ++ &mst_cplds_device, + }; + + static struct pxaohci_platform_data mainstone_ohci_platform_data = { +@@ -618,7 +559,7 @@ MACHINE_START(MAINSTONE, "Intel HCDDBBVA0 Development Platform (aka Mainstone)") + .atag_offset = 0x100, /* BLOB boot parameter setting */ + .map_io = mainstone_map_io, + .nr_irqs = MAINSTONE_NR_IRQS, +- .init_irq = mainstone_init_irq, ++ .init_irq = pxa27x_init_irq, + .handle_irq = pxa27x_handle_irq, + .timer = &pxa_timer, + .init_machine = mainstone_init, +diff --git a/arch/arm/mach-pxa/pxa_cplds_irqs.c b/arch/arm/mach-pxa/pxa_cplds_irqs.c +new file mode 100644 +index 000000000000..f1aeb54fabe3 +--- /dev/null ++++ b/arch/arm/mach-pxa/pxa_cplds_irqs.c +@@ -0,0 +1,200 @@ ++/* ++ * Intel Reference Systems cplds ++ * ++ * Copyright (C) 2014 Robert Jarzmik ++ * ++ * This program is free software; you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License as published by ++ * the Free Software Foundation; either version 2 of the License, or ++ * (at your option) any later version. ++ * ++ * Cplds motherboard driver, supporting lubbock and mainstone SoC board. ++ */ ++ ++#include <linux/bitops.h> ++#include <linux/gpio.h> ++#include <linux/gpio/consumer.h> ++#include <linux/interrupt.h> ++#include <linux/io.h> ++#include <linux/irq.h> ++#include <linux/irqdomain.h> ++#include <linux/mfd/core.h> ++#include <linux/module.h> ++#include <linux/of_platform.h> ++ ++#define FPGA_IRQ_MASK_EN 0x0 ++#define FPGA_IRQ_SET_CLR 0x10 ++ ++#define CPLDS_NB_IRQ 32 ++ ++struct cplds { ++ void __iomem *base; ++ int irq; ++ unsigned int irq_mask; ++ struct gpio_desc *gpio0; ++ struct irq_domain *irqdomain; ++}; ++ ++static irqreturn_t cplds_irq_handler(int in_irq, void *d) ++{ ++ struct cplds *fpga = d; ++ unsigned long pending; ++ unsigned int bit; ++ ++ pending = readl(fpga->base + FPGA_IRQ_SET_CLR) & fpga->irq_mask; ++ for_each_set_bit(bit, &pending, CPLDS_NB_IRQ) ++ generic_handle_irq(irq_find_mapping(fpga->irqdomain, bit)); ++ ++ return IRQ_HANDLED; ++} ++ ++static void cplds_irq_mask_ack(struct irq_data *d) ++{ ++ struct cplds *fpga = irq_data_get_irq_chip_data(d); ++ unsigned int cplds_irq = irqd_to_hwirq(d); ++ unsigned int set, bit = BIT(cplds_irq); ++ ++ fpga->irq_mask &= ~bit; ++ writel(fpga->irq_mask, fpga->base + FPGA_IRQ_MASK_EN); ++ set = readl(fpga->base + FPGA_IRQ_SET_CLR); ++ writel(set & ~bit, fpga->base + FPGA_IRQ_SET_CLR); ++} ++ ++static void cplds_irq_unmask(struct irq_data *d) ++{ ++ struct cplds *fpga = irq_data_get_irq_chip_data(d); ++ unsigned int cplds_irq = irqd_to_hwirq(d); ++ unsigned int bit = BIT(cplds_irq); ++ ++ fpga->irq_mask |= bit; ++ writel(fpga->irq_mask, fpga->base + FPGA_IRQ_MASK_EN); ++} ++ ++static struct irq_chip cplds_irq_chip = { ++ .name = "pxa_cplds", ++ .irq_mask_ack = cplds_irq_mask_ack, ++ .irq_unmask = cplds_irq_unmask, ++ .flags = IRQCHIP_MASK_ON_SUSPEND | IRQCHIP_SKIP_SET_WAKE, ++}; ++ ++static int cplds_irq_domain_map(struct irq_domain *d, unsigned int irq, ++ irq_hw_number_t hwirq) ++{ ++ struct cplds *fpga = d->host_data; ++ ++ irq_set_chip_and_handler(irq, &cplds_irq_chip, handle_level_irq); ++ irq_set_chip_data(irq, fpga); ++ ++ return 0; ++} ++ ++static const struct irq_domain_ops cplds_irq_domain_ops = { ++ .xlate = irq_domain_xlate_twocell, ++ .map = cplds_irq_domain_map, ++}; ++ ++static int cplds_resume(struct platform_device *pdev) ++{ ++ struct cplds *fpga = platform_get_drvdata(pdev); ++ ++ writel(fpga->irq_mask, fpga->base + FPGA_IRQ_MASK_EN); ++ ++ return 0; ++} ++ ++static int cplds_probe(struct platform_device *pdev) ++{ ++ struct resource *res; ++ struct cplds *fpga; ++ int ret; ++ unsigned int base_irq = 0; ++ unsigned long irqflags = 0; ++ ++ fpga = devm_kzalloc(&pdev->dev, sizeof(*fpga), GFP_KERNEL); ++ if (!fpga) ++ return -ENOMEM; ++ ++ res = platform_get_resource(pdev, IORESOURCE_IRQ, 0); ++ if (res) { ++ fpga->irq = (unsigned int)res->start; ++ irqflags = res->flags; ++ } ++ if (!fpga->irq) ++ return -ENODEV; ++ ++ base_irq = platform_get_irq(pdev, 1); ++ if (base_irq < 0) ++ base_irq = 0; ++ ++ res = platform_get_resource(pdev, IORESOURCE_MEM, 0); ++ fpga->base = devm_ioremap_resource(&pdev->dev, res); ++ if (IS_ERR(fpga->base)) ++ return PTR_ERR(fpga->base); ++ ++ platform_set_drvdata(pdev, fpga); ++ ++ writel(fpga->irq_mask, fpga->base + FPGA_IRQ_MASK_EN); ++ writel(0, fpga->base + FPGA_IRQ_SET_CLR); ++ ++ ret = devm_request_irq(&pdev->dev, fpga->irq, cplds_irq_handler, ++ irqflags, dev_name(&pdev->dev), fpga); ++ if (ret == -ENOSYS) ++ return -EPROBE_DEFER; ++ ++ if (ret) { ++ dev_err(&pdev->dev, "couldn't request main irq%d: %d\n", ++ fpga->irq, ret); ++ return ret; ++ } ++ ++ irq_set_irq_wake(fpga->irq, 1); ++ fpga->irqdomain = irq_domain_add_linear(pdev->dev.of_node, ++ CPLDS_NB_IRQ, ++ &cplds_irq_domain_ops, fpga); ++ if (!fpga->irqdomain) ++ return -ENODEV; ++ ++ if (base_irq) { ++ ret = irq_create_strict_mappings(fpga->irqdomain, base_irq, 0, ++ CPLDS_NB_IRQ); ++ if (ret) { ++ dev_err(&pdev->dev, "couldn't create the irq mapping %d..%d\n", ++ base_irq, base_irq + CPLDS_NB_IRQ); ++ return ret; ++ } ++ } ++ ++ return 0; ++} ++ ++static int cplds_remove(struct platform_device *pdev) ++{ ++ struct cplds *fpga = platform_get_drvdata(pdev); ++ ++ irq_set_chip_and_handler(fpga->irq, NULL, NULL); ++ ++ return 0; ++} ++ ++static const struct of_device_id cplds_id_table[] = { ++ { .compatible = "intel,lubbock-cplds-irqs", }, ++ { .compatible = "intel,mainstone-cplds-irqs", }, ++ { } ++}; ++MODULE_DEVICE_TABLE(of, cplds_id_table); ++ ++static struct platform_driver cplds_driver = { ++ .driver = { ++ .name = "pxa_cplds_irqs", ++ .of_match_table = of_match_ptr(cplds_id_table), ++ }, ++ .probe = cplds_probe, ++ .remove = cplds_remove, ++ .resume = cplds_resume, ++}; ++ ++module_platform_driver(cplds_driver); ++ ++MODULE_DESCRIPTION("PXA Cplds interrupts driver"); ++MODULE_AUTHOR("Robert Jarzmik <robert.jarzmik@free.fr>"); ++MODULE_LICENSE("GPL"); +diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c +index 62135849f48b..ad941453340a 100644 +--- a/arch/arm/net/bpf_jit_32.c ++++ b/arch/arm/net/bpf_jit_32.c +@@ -52,6 +52,7 @@ + #define SEEN_DATA (1 << (BPF_MEMWORDS + 3)) + + #define FLAG_NEED_X_RESET (1 << 0) ++#define FLAG_IMM_OVERFLOW (1 << 1) + + struct jit_ctx { + const struct sk_filter *skf; +@@ -286,6 +287,15 @@ static u16 imm_offset(u32 k, struct jit_ctx *ctx) + /* PC in ARM mode == address of the instruction + 8 */ + imm = offset - (8 + ctx->idx * 4); + ++ if (imm & ~0xfff) { ++ /* ++ * literal pool is too far, signal it into flags. we ++ * can only detect it on the second pass unfortunately. ++ */ ++ ctx->flags |= FLAG_IMM_OVERFLOW; ++ return 0; ++ } ++ + return imm; + } + +@@ -817,6 +827,14 @@ b_epilogue: + default: + return -1; + } ++ ++ if (ctx->flags & FLAG_IMM_OVERFLOW) ++ /* ++ * this instruction generated an overflow when ++ * trying to access the literal pool, so ++ * delegate this filter to the kernel interpreter. ++ */ ++ return -1; + } + + /* compute offsets only during the first pass */ +@@ -876,7 +894,14 @@ void bpf_jit_compile(struct sk_filter *fp) + + ctx.idx = 0; + build_prologue(&ctx); +- build_body(&ctx); ++ if (build_body(&ctx) < 0) { ++#if __LINUX_ARM_ARCH__ < 7 ++ if (ctx.imm_count) ++ kfree(ctx.imms); ++#endif ++ bpf_jit_binary_free(header); ++ goto out; ++ } + build_epilogue(&ctx); + + flush_icache_range((u32)ctx.target, (u32)(ctx.target + ctx.idx)); +diff --git a/arch/c6x/kernel/time.c b/arch/c6x/kernel/time.c +index 356ee84cad95..04845aaf5985 100644 +--- a/arch/c6x/kernel/time.c ++++ b/arch/c6x/kernel/time.c +@@ -49,7 +49,7 @@ u64 sched_clock(void) + return (tsc * sched_clock_multiplier) >> SCHED_CLOCK_SHIFT; + } + +-void time_init(void) ++void __init time_init(void) + { + u64 tmp = (u64)NSEC_PER_SEC << SCHED_CLOCK_SHIFT; + +diff --git a/arch/mips/kernel/irq.c b/arch/mips/kernel/irq.c +index a5aa43d07c8e..9cd8cbf9bd43 100644 +--- a/arch/mips/kernel/irq.c ++++ b/arch/mips/kernel/irq.c +@@ -110,7 +110,7 @@ void __init init_IRQ(void) + #endif + } + +-#ifdef DEBUG_STACKOVERFLOW ++#ifdef CONFIG_DEBUG_STACKOVERFLOW + static inline void check_stack_overflow(void) + { + unsigned long sp; +diff --git a/arch/mips/power/hibernate.S b/arch/mips/power/hibernate.S +index 5bf34ec89669..2ca17353fc0c 100644 +--- a/arch/mips/power/hibernate.S ++++ b/arch/mips/power/hibernate.S +@@ -31,6 +31,8 @@ LEAF(swsusp_arch_suspend) + END(swsusp_arch_suspend) + + LEAF(swsusp_arch_resume) ++ /* Avoid TLB mismatch during and after kernel resume */ ++ jal local_flush_tlb_all + PTR_L t0, restore_pblist + 0: + PTR_L t1, PBE_ADDRESS(t0) /* source */ +@@ -44,7 +46,6 @@ LEAF(swsusp_arch_resume) + bne t1, t3, 1b + PTR_L t0, PBE_NEXT(t0) + bnez t0, 0b +- jal local_flush_tlb_all /* Avoid TLB mismatch after kernel resume */ + PTR_LA t0, saved_regs + PTR_L ra, PT_R31(t0) + PTR_L sp, PT_R29(t0) +diff --git a/arch/powerpc/kernel/cacheinfo.c b/arch/powerpc/kernel/cacheinfo.c +index b4437e8a7a8f..334254c5292e 100644 +--- a/arch/powerpc/kernel/cacheinfo.c ++++ b/arch/powerpc/kernel/cacheinfo.c +@@ -62,12 +62,22 @@ struct cache_type_info { + }; + + /* These are used to index the cache_type_info array. */ +-#define CACHE_TYPE_UNIFIED 0 +-#define CACHE_TYPE_INSTRUCTION 1 +-#define CACHE_TYPE_DATA 2 ++#define CACHE_TYPE_UNIFIED 0 /* cache-size, cache-block-size, etc. */ ++#define CACHE_TYPE_UNIFIED_D 1 /* d-cache-size, d-cache-block-size, etc */ ++#define CACHE_TYPE_INSTRUCTION 2 ++#define CACHE_TYPE_DATA 3 + + static const struct cache_type_info cache_type_info[] = { + { ++ /* Embedded systems that use cache-size, cache-block-size, ++ * etc. for the Unified (typically L2) cache. */ ++ .name = "Unified", ++ .size_prop = "cache-size", ++ .line_size_props = { "cache-line-size", ++ "cache-block-size", }, ++ .nr_sets_prop = "cache-sets", ++ }, ++ { + /* PowerPC Processor binding says the [di]-cache-* + * must be equal on unified caches, so just use + * d-cache properties. */ +@@ -293,7 +303,8 @@ static struct cache *cache_find_first_sibling(struct cache *cache) + { + struct cache *iter; + +- if (cache->type == CACHE_TYPE_UNIFIED) ++ if (cache->type == CACHE_TYPE_UNIFIED || ++ cache->type == CACHE_TYPE_UNIFIED_D) + return cache; + + list_for_each_entry(iter, &cache_list, list) +@@ -324,15 +335,27 @@ static bool cache_node_is_unified(const struct device_node *np) + return of_get_property(np, "cache-unified", NULL); + } + +-static struct cache *__cpuinit cache_do_one_devnode_unified(struct device_node *node, int level) ++/* ++ * Unified caches can have two different sets of tags. Most embedded ++ * use cache-size, etc. for the unified cache size, but open firmware systems ++ * use d-cache-size, etc. Check on initialization for which type we have, and ++ * return the appropriate structure type. Assume it's embedded if it isn't ++ * open firmware. If it's yet a 3rd type, then there will be missing entries ++ * in /sys/devices/system/cpu/cpu0/cache/index2/, and this code will need ++ * to be extended further. ++ */ ++static int cache_is_unified_d(const struct device_node *np) + { +- struct cache *cache; ++ return of_get_property(np, ++ cache_type_info[CACHE_TYPE_UNIFIED_D].size_prop, NULL) ? ++ CACHE_TYPE_UNIFIED_D : CACHE_TYPE_UNIFIED; ++} + ++static struct cache *__cpuinit cache_do_one_devnode_unified(struct device_node *node, int level) ++{ + pr_debug("creating L%d ucache for %s\n", level, node->full_name); + +- cache = new_cache(CACHE_TYPE_UNIFIED, level, node); +- +- return cache; ++ return new_cache(cache_is_unified_d(node), level, node); + } + + static struct cache *__cpuinit cache_do_one_devnode_split(struct device_node *node, int level) +diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S +index 7703569b5d4f..6be807d29b1d 100644 +--- a/arch/powerpc/kernel/vmlinux.lds.S ++++ b/arch/powerpc/kernel/vmlinux.lds.S +@@ -213,6 +213,7 @@ SECTIONS + *(.opd) + } + ++ . = ALIGN(256); + .got : AT(ADDR(.got) - LOAD_OFFSET) { + __toc_start = .; + *(.got) +diff --git a/arch/powerpc/perf/callchain.c b/arch/powerpc/perf/callchain.c +index e8a18d1cc7c9..a9bd794652c9 100644 +--- a/arch/powerpc/perf/callchain.c ++++ b/arch/powerpc/perf/callchain.c +@@ -243,7 +243,7 @@ static void perf_callchain_user_64(struct perf_callchain_entry *entry, + sp = regs->gpr[1]; + perf_callchain_store(entry, next_ip); + +- for (;;) { ++ while (entry->nr < PERF_MAX_STACK_DEPTH) { + fp = (unsigned long __user *) sp; + if (!valid_user_sp(sp, 1) || read_user_stack_64(fp, &next_sp)) + return; +diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c +index 0f1b706506ed..27672762746b 100644 +--- a/arch/powerpc/platforms/pseries/dlpar.c ++++ b/arch/powerpc/platforms/pseries/dlpar.c +@@ -416,6 +416,12 @@ static ssize_t dlpar_cpu_probe(const char *buf, size_t count) + goto out; + } + ++ rc = dlpar_acquire_drc(drc_index); ++ if (rc) { ++ rc = -EINVAL; ++ goto out; ++ } ++ + dn = dlpar_configure_connector(drc_index); + if (!dn) { + rc = -EINVAL; +@@ -436,13 +442,6 @@ static ssize_t dlpar_cpu_probe(const char *buf, size_t count) + kfree(dn->full_name); + dn->full_name = cpu_name; + +- rc = dlpar_acquire_drc(drc_index); +- if (rc) { +- dlpar_free_cc_nodes(dn); +- rc = -EINVAL; +- goto out; +- } +- + rc = dlpar_attach_node(dn); + if (rc) { + dlpar_release_drc(drc_index); +diff --git a/arch/s390/crypto/ghash_s390.c b/arch/s390/crypto/ghash_s390.c +index b1bd170f24b1..c2dac2e0e56a 100644 +--- a/arch/s390/crypto/ghash_s390.c ++++ b/arch/s390/crypto/ghash_s390.c +@@ -16,11 +16,12 @@ + #define GHASH_DIGEST_SIZE 16 + + struct ghash_ctx { +- u8 icv[16]; +- u8 key[16]; ++ u8 key[GHASH_BLOCK_SIZE]; + }; + + struct ghash_desc_ctx { ++ u8 icv[GHASH_BLOCK_SIZE]; ++ u8 key[GHASH_BLOCK_SIZE]; + u8 buffer[GHASH_BLOCK_SIZE]; + u32 bytes; + }; +@@ -28,8 +29,10 @@ struct ghash_desc_ctx { + static int ghash_init(struct shash_desc *desc) + { + struct ghash_desc_ctx *dctx = shash_desc_ctx(desc); ++ struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm); + + memset(dctx, 0, sizeof(*dctx)); ++ memcpy(dctx->key, ctx->key, GHASH_BLOCK_SIZE); + + return 0; + } +@@ -45,7 +48,6 @@ static int ghash_setkey(struct crypto_shash *tfm, + } + + memcpy(ctx->key, key, GHASH_BLOCK_SIZE); +- memset(ctx->icv, 0, GHASH_BLOCK_SIZE); + + return 0; + } +@@ -54,7 +56,6 @@ static int ghash_update(struct shash_desc *desc, + const u8 *src, unsigned int srclen) + { + struct ghash_desc_ctx *dctx = shash_desc_ctx(desc); +- struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm); + unsigned int n; + u8 *buf = dctx->buffer; + int ret; +@@ -70,7 +71,7 @@ static int ghash_update(struct shash_desc *desc, + src += n; + + if (!dctx->bytes) { +- ret = crypt_s390_kimd(KIMD_GHASH, ctx, buf, ++ ret = crypt_s390_kimd(KIMD_GHASH, dctx, buf, + GHASH_BLOCK_SIZE); + BUG_ON(ret != GHASH_BLOCK_SIZE); + } +@@ -78,7 +79,7 @@ static int ghash_update(struct shash_desc *desc, + + n = srclen & ~(GHASH_BLOCK_SIZE - 1); + if (n) { +- ret = crypt_s390_kimd(KIMD_GHASH, ctx, src, n); ++ ret = crypt_s390_kimd(KIMD_GHASH, dctx, src, n); + BUG_ON(ret != n); + src += n; + srclen -= n; +@@ -92,7 +93,7 @@ static int ghash_update(struct shash_desc *desc, + return 0; + } + +-static void ghash_flush(struct ghash_ctx *ctx, struct ghash_desc_ctx *dctx) ++static int ghash_flush(struct ghash_desc_ctx *dctx) + { + u8 *buf = dctx->buffer; + int ret; +@@ -102,20 +103,19 @@ static void ghash_flush(struct ghash_ctx *ctx, struct ghash_desc_ctx *dctx) + + memset(pos, 0, dctx->bytes); + +- ret = crypt_s390_kimd(KIMD_GHASH, ctx, buf, GHASH_BLOCK_SIZE); ++ ret = crypt_s390_kimd(KIMD_GHASH, dctx, buf, GHASH_BLOCK_SIZE); + BUG_ON(ret != GHASH_BLOCK_SIZE); +- } + +- dctx->bytes = 0; ++ dctx->bytes = 0; ++ } + } + + static int ghash_final(struct shash_desc *desc, u8 *dst) + { + struct ghash_desc_ctx *dctx = shash_desc_ctx(desc); +- struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm); + +- ghash_flush(ctx, dctx); +- memcpy(dst, ctx->icv, GHASH_BLOCK_SIZE); ++ ghash_flush(dctx); ++ memcpy(dst, dtx->icv, GHASH_BLOCK_SIZE); + + return 0; + } +diff --git a/arch/s390/kernel/suspend.c b/arch/s390/kernel/suspend.c +index aa1494d0e380..42068041733c 100644 +--- a/arch/s390/kernel/suspend.c ++++ b/arch/s390/kernel/suspend.c +@@ -9,6 +9,8 @@ + #include <linux/pfn.h> + #include <linux/suspend.h> + #include <linux/mm.h> ++#include <asm/ipl.h> ++#include <asm/sections.h> + #include <asm/ctl_reg.h> + + /* +@@ -137,6 +139,8 @@ int pfn_is_nosave(unsigned long pfn) + { + unsigned long nosave_begin_pfn = PFN_DOWN(__pa(&__nosave_begin)); + unsigned long nosave_end_pfn = PFN_DOWN(__pa(&__nosave_end)); ++ unsigned long eshared_pfn = PFN_DOWN(__pa(&_eshared)) - 1; ++ unsigned long stext_pfn = PFN_DOWN(__pa(&_stext)); + + /* Always save lowcore pages (LC protection might be enabled). */ + if (pfn <= LC_PAGES) +@@ -144,6 +148,8 @@ int pfn_is_nosave(unsigned long pfn) + if (pfn >= nosave_begin_pfn && pfn < nosave_end_pfn) + return 1; + /* Skip memory holes and read-only pages (NSS, DCSS, ...). */ ++ if (pfn >= stext_pfn && pfn <= eshared_pfn) ++ return ipl_info.type == IPL_TYPE_NSS ? 1 : 0; + if (tprot(PFN_PHYS(pfn))) + return 1; + return 0; +diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c +index e5a45dbd26ac..f641458e86b4 100644 +--- a/arch/s390/kvm/priv.c ++++ b/arch/s390/kvm/priv.c +@@ -218,6 +218,7 @@ static void handle_stsi_3_2_2(struct kvm_vcpu *vcpu, struct sysinfo_3_2_2 *mem) + for (n = mem->count - 1; n > 0 ; n--) + memcpy(&mem->vm[n], &mem->vm[n - 1], sizeof(mem->vm[0])); + ++ memset(&mem->vm[0], 0, sizeof(mem->vm[0])); + mem->vm[0].cpus_total = cpus; + mem->vm[0].cpus_configured = cpus; + mem->vm[0].cpus_standby = 0; +diff --git a/arch/x86/include/asm/i387.h b/arch/x86/include/asm/i387.h +index 257d9cca214f..1262fb6a9df6 100644 +--- a/arch/x86/include/asm/i387.h ++++ b/arch/x86/include/asm/i387.h +@@ -23,8 +23,32 @@ extern int dump_fpu(struct pt_regs *, struct user_i387_struct *); + extern void math_state_restore(void); + + extern bool irq_fpu_usable(void); +-extern void kernel_fpu_begin(void); +-extern void kernel_fpu_end(void); ++ ++/* ++ * Careful: __kernel_fpu_begin/end() must be called with preempt disabled ++ * and they don't touch the preempt state on their own. ++ * If you enable preemption after __kernel_fpu_begin(), preempt notifier ++ * should call the __kernel_fpu_end() to prevent the kernel/user FPU ++ * state from getting corrupted. KVM for example uses this model. ++ * ++ * All other cases use kernel_fpu_begin/end() which disable preemption ++ * during kernel FPU usage. ++ */ ++extern void __kernel_fpu_begin(void); ++extern void __kernel_fpu_end(void); ++ ++static inline void kernel_fpu_begin(void) ++{ ++ WARN_ON_ONCE(!irq_fpu_usable()); ++ preempt_disable(); ++ __kernel_fpu_begin(); ++} ++ ++static inline void kernel_fpu_end(void) ++{ ++ __kernel_fpu_end(); ++ preempt_enable(); ++} + + /* + * Some instructions like VIA's padlock instructions generate a spurious +diff --git a/arch/x86/include/asm/iommu_table.h b/arch/x86/include/asm/iommu_table.h +index f229b13a5f30..0c5482257fc3 100644 +--- a/arch/x86/include/asm/iommu_table.h ++++ b/arch/x86/include/asm/iommu_table.h +@@ -79,11 +79,12 @@ struct iommu_table_entry { + * d). Similar to the 'init', except that this gets called from pci_iommu_init + * where we do have a memory allocator. + * +- * The standard vs the _FINISH differs in that the _FINISH variant will +- * continue detecting other IOMMUs in the call list after the +- * the detection routine returns a positive number. The _FINISH will +- * stop the execution chain. Both will still call the 'init' and +- * 'late_init' functions if they are set. ++ * The standard IOMMU_INIT differs from the IOMMU_INIT_FINISH variant ++ * in that the former will continue detecting other IOMMUs in the call ++ * list after the detection routine returns a positive number, while the ++ * latter will stop the execution chain upon first successful detection. ++ * Both variants will still call the 'init' and 'late_init' functions if ++ * they are set. + */ + #define IOMMU_INIT_FINISH(_detect, _depend, _init, _late_init) \ + __IOMMU_INIT(_detect, _depend, _init, _late_init, 1) +diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c +index 0d2db0e7caf4..9eeaed48d0bf 100644 +--- a/arch/x86/kernel/cpu/mcheck/mce.c ++++ b/arch/x86/kernel/cpu/mcheck/mce.c +@@ -652,11 +652,14 @@ EXPORT_SYMBOL_GPL(machine_check_poll); + static int mce_no_way_out(struct mce *m, char **msg) + { + int i; ++ char *tmp; + + for (i = 0; i < banks; i++) { + m->status = mce_rdmsrl(MSR_IA32_MCx_STATUS(i)); +- if (mce_severity(m, tolerant, msg) >= MCE_PANIC_SEVERITY) ++ if (mce_severity(m, tolerant, &tmp) >= MCE_PANIC_SEVERITY) { ++ *msg = tmp; + return 1; ++ } + } + return 0; + } +diff --git a/arch/x86/kernel/i387.c b/arch/x86/kernel/i387.c +index 6610e811fb39..7aa728d72b60 100644 +--- a/arch/x86/kernel/i387.c ++++ b/arch/x86/kernel/i387.c +@@ -77,29 +77,26 @@ bool irq_fpu_usable(void) + } + EXPORT_SYMBOL(irq_fpu_usable); + +-void kernel_fpu_begin(void) ++void __kernel_fpu_begin(void) + { + struct task_struct *me = current; + +- WARN_ON_ONCE(!irq_fpu_usable()); +- preempt_disable(); + if (__thread_has_fpu(me)) { + __save_init_fpu(me); + __thread_clear_has_fpu(me); +- /* We do 'stts()' in kernel_fpu_end() */ ++ /* We do 'stts()' in __kernel_fpu_end() */ + } else { + percpu_write(fpu_owner_task, NULL); + clts(); + } + } +-EXPORT_SYMBOL(kernel_fpu_begin); ++EXPORT_SYMBOL(__kernel_fpu_begin); + +-void kernel_fpu_end(void) ++void __kernel_fpu_end(void) + { + stts(); +- preempt_enable(); + } +-EXPORT_SYMBOL(kernel_fpu_end); ++EXPORT_SYMBOL(__kernel_fpu_end); + + void unlazy_fpu(struct task_struct *tsk) + { +diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c +index 84f4bca0ca2c..2da1a8c9173e 100644 +--- a/arch/x86/kvm/mmu.c ++++ b/arch/x86/kvm/mmu.c +@@ -3658,7 +3658,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa, + ++vcpu->kvm->stat.mmu_pte_write; + kvm_mmu_audit(vcpu, AUDIT_PRE_PTE_WRITE); + +- mask.cr0_wp = mask.cr4_pae = mask.nxe = 1; ++ mask.cr0_wp = mask.cr4_pae = mask.nxe = mask.smep_andnot_wp = 1; + for_each_gfn_indirect_valid_sp(vcpu->kvm, sp, gfn, node) { + if (detect_write_misaligned(sp, gpa, bytes) || + detect_write_flooding(sp)) { +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index 2eb4e5af8816..4ad0d7171d6c 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -1455,8 +1455,12 @@ static void __vmx_load_host_state(struct vcpu_vmx *vmx) + #ifdef CONFIG_X86_64 + wrmsrl(MSR_KERNEL_GS_BASE, vmx->msr_host_kernel_gs_base); + #endif +- if (user_has_fpu()) +- clts(); ++ /* ++ * If the FPU is not active (through the host task or ++ * the guest vcpu), then restore the cr0.TS bit. ++ */ ++ if (!user_has_fpu() && !vmx->vcpu.guest_fpu_loaded) ++ stts(); + load_gdt(&__get_cpu_var(host_gdt)); + } + +@@ -3633,7 +3637,7 @@ static void vmx_set_constant_host_state(struct vcpu_vmx *vmx) + struct desc_ptr dt; + unsigned long cr4; + +- vmcs_writel(HOST_CR0, read_cr0() | X86_CR0_TS); /* 22.2.3 */ ++ vmcs_writel(HOST_CR0, read_cr0() & ~X86_CR0_TS); /* 22.2.3 */ + vmcs_writel(HOST_CR3, read_cr3()); /* 22.2.3 FIXME: shadow tables */ + + /* Save the most likely value for this task's CR4 in the VMCS. */ +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 318a2454366f..4ad2b7bb382e 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -5907,7 +5907,7 @@ void kvm_load_guest_fpu(struct kvm_vcpu *vcpu) + */ + kvm_put_guest_xcr0(vcpu); + vcpu->guest_fpu_loaded = 1; +- unlazy_fpu(current); ++ __kernel_fpu_begin(); + fpu_restore_checking(&vcpu->arch.guest_fpu); + trace_kvm_fpu(1); + } +@@ -5921,6 +5921,7 @@ void kvm_put_guest_fpu(struct kvm_vcpu *vcpu) + + vcpu->guest_fpu_loaded = 0; + fpu_save_init(&vcpu->arch.guest_fpu); ++ __kernel_fpu_end(); + ++vcpu->stat.fpu_reload; + kvm_make_request(KVM_REQ_DEACTIVATE_FPU, vcpu); + trace_kvm_fpu(0); +diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c +index 0597f95b6da6..95f9934e8050 100644 +--- a/arch/x86/net/bpf_jit_comp.c ++++ b/arch/x86/net/bpf_jit_comp.c +@@ -155,7 +155,12 @@ void bpf_jit_compile(struct sk_filter *fp) + } + cleanup_addr = proglen; /* epilogue address */ + +- for (pass = 0; pass < 10; pass++) { ++ /* JITed image shrinks with every pass and the loop iterates ++ * until the image stops shrinking. Very large bpf programs ++ * may converge on the last pass. In such case do one more ++ * pass to emit the final image ++ */ ++ for (pass = 0; pass < 10 || image; pass++) { + u8 seen_or_pass0 = (pass == 0) ? (SEEN_XREG | SEEN_DATAREF | SEEN_MEM) : seen; + /* no prologue/epilogue for trivial filters (RET something) */ + proglen = 0; +diff --git a/block/genhd.c b/block/genhd.c +index 7a2a8dc9bc5f..618ca1aaa858 100644 +--- a/block/genhd.c ++++ b/block/genhd.c +@@ -420,13 +420,13 @@ int blk_alloc_devt(struct hd_struct *part, dev_t *devt) + do { + if (!idr_pre_get(&ext_devt_idr, GFP_KERNEL)) + return -ENOMEM; +- spin_lock(&ext_devt_lock); ++ spin_lock_bh(&ext_devt_lock); + rc = idr_get_new(&ext_devt_idr, part, &idx); + if (!rc && idx >= NR_EXT_DEVT) { + idr_remove(&ext_devt_idr, idx); + rc = -EBUSY; + } +- spin_unlock(&ext_devt_lock); ++ spin_unlock_bh(&ext_devt_lock); + } while (rc == -EAGAIN); + + if (rc) +@@ -451,9 +451,9 @@ void blk_free_devt(dev_t devt) + return; + + if (MAJOR(devt) == BLOCK_EXT_MAJOR) { +- spin_lock(&ext_devt_lock); ++ spin_lock_bh(&ext_devt_lock); + idr_remove(&ext_devt_idr, blk_mangle_minor(MINOR(devt))); +- spin_unlock(&ext_devt_lock); ++ spin_unlock_bh(&ext_devt_lock); + } + } + +@@ -684,13 +684,13 @@ struct gendisk *get_gendisk(dev_t devt, int *partno) + } else { + struct hd_struct *part; + +- spin_lock(&ext_devt_lock); ++ spin_lock_bh(&ext_devt_lock); + part = idr_find(&ext_devt_idr, blk_mangle_minor(MINOR(devt))); + if (part && get_disk(part_to_disk(part))) { + *partno = part->partno; + disk = part_to_disk(part); + } +- spin_unlock(&ext_devt_lock); ++ spin_unlock_bh(&ext_devt_lock); + } + + return disk; +diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c +index 6fc61eb07b7b..1338f1f79582 100644 +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -67,6 +67,7 @@ enum board_ids { + board_ahci_yes_fbs, + + /* board IDs for specific chipsets in alphabetical order */ ++ board_ahci_avn, + board_ahci_mcp65, + board_ahci_mcp77, + board_ahci_mcp89, +@@ -85,6 +86,8 @@ enum board_ids { + static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent); + static int ahci_vt8251_hardreset(struct ata_link *link, unsigned int *class, + unsigned long deadline); ++static int ahci_avn_hardreset(struct ata_link *link, unsigned int *class, ++ unsigned long deadline); + static int ahci_p5wdh_hardreset(struct ata_link *link, unsigned int *class, + unsigned long deadline); + #ifdef CONFIG_PM +@@ -106,6 +109,11 @@ static struct ata_port_operations ahci_p5wdh_ops = { + .hardreset = ahci_p5wdh_hardreset, + }; + ++static struct ata_port_operations ahci_avn_ops = { ++ .inherits = &ahci_ops, ++ .hardreset = ahci_avn_hardreset, ++}; ++ + static const struct ata_port_info ahci_port_info[] = { + /* by features */ + [board_ahci] = +@@ -154,6 +162,12 @@ static const struct ata_port_info ahci_port_info[] = { + .port_ops = &ahci_ops, + }, + /* by chipsets */ ++ [board_ahci_avn] = { ++ .flags = AHCI_FLAG_COMMON, ++ .pio_mask = ATA_PIO4, ++ .udma_mask = ATA_UDMA6, ++ .port_ops = &ahci_avn_ops, ++ }, + [board_ahci_mcp65] = + { + AHCI_HFLAGS (AHCI_HFLAG_NO_FPDMA_AA | AHCI_HFLAG_NO_PMP | +@@ -300,14 +314,14 @@ static const struct pci_device_id ahci_pci_tbl[] = { + { PCI_VDEVICE(INTEL, 0x1f27), board_ahci }, /* Avoton RAID */ + { PCI_VDEVICE(INTEL, 0x1f2e), board_ahci }, /* Avoton RAID */ + { PCI_VDEVICE(INTEL, 0x1f2f), board_ahci }, /* Avoton RAID */ +- { PCI_VDEVICE(INTEL, 0x1f32), board_ahci }, /* Avoton AHCI */ +- { PCI_VDEVICE(INTEL, 0x1f33), board_ahci }, /* Avoton AHCI */ +- { PCI_VDEVICE(INTEL, 0x1f34), board_ahci }, /* Avoton RAID */ +- { PCI_VDEVICE(INTEL, 0x1f35), board_ahci }, /* Avoton RAID */ +- { PCI_VDEVICE(INTEL, 0x1f36), board_ahci }, /* Avoton RAID */ +- { PCI_VDEVICE(INTEL, 0x1f37), board_ahci }, /* Avoton RAID */ +- { PCI_VDEVICE(INTEL, 0x1f3e), board_ahci }, /* Avoton RAID */ +- { PCI_VDEVICE(INTEL, 0x1f3f), board_ahci }, /* Avoton RAID */ ++ { PCI_VDEVICE(INTEL, 0x1f32), board_ahci_avn }, /* Avoton AHCI */ ++ { PCI_VDEVICE(INTEL, 0x1f33), board_ahci_avn }, /* Avoton AHCI */ ++ { PCI_VDEVICE(INTEL, 0x1f34), board_ahci_avn }, /* Avoton RAID */ ++ { PCI_VDEVICE(INTEL, 0x1f35), board_ahci_avn }, /* Avoton RAID */ ++ { PCI_VDEVICE(INTEL, 0x1f36), board_ahci_avn }, /* Avoton RAID */ ++ { PCI_VDEVICE(INTEL, 0x1f37), board_ahci_avn }, /* Avoton RAID */ ++ { PCI_VDEVICE(INTEL, 0x1f3e), board_ahci_avn }, /* Avoton RAID */ ++ { PCI_VDEVICE(INTEL, 0x1f3f), board_ahci_avn }, /* Avoton RAID */ + { PCI_VDEVICE(INTEL, 0x8d02), board_ahci }, /* Wellsburg AHCI */ + { PCI_VDEVICE(INTEL, 0x8d04), board_ahci }, /* Wellsburg RAID */ + { PCI_VDEVICE(INTEL, 0x8d06), board_ahci }, /* Wellsburg RAID */ +@@ -671,6 +685,78 @@ static int ahci_p5wdh_hardreset(struct ata_link *link, unsigned int *class, + return rc; + } + ++/* ++ * ahci_avn_hardreset - attempt more aggressive recovery of Avoton ports. ++ * ++ * It has been observed with some SSDs that the timing of events in the ++ * link synchronization phase can leave the port in a state that can not ++ * be recovered by a SATA-hard-reset alone. The failing signature is ++ * SStatus.DET stuck at 1 ("Device presence detected but Phy ++ * communication not established"). It was found that unloading and ++ * reloading the driver when this problem occurs allows the drive ++ * connection to be recovered (DET advanced to 0x3). The critical ++ * component of reloading the driver is that the port state machines are ++ * reset by bouncing "port enable" in the AHCI PCS configuration ++ * register. So, reproduce that effect by bouncing a port whenever we ++ * see DET==1 after a reset. ++ */ ++static int ahci_avn_hardreset(struct ata_link *link, unsigned int *class, ++ unsigned long deadline) ++{ ++ const unsigned long *timing = sata_ehc_deb_timing(&link->eh_context); ++ struct ata_port *ap = link->ap; ++ struct ahci_port_priv *pp = ap->private_data; ++ u8 *d2h_fis = pp->rx_fis + RX_FIS_D2H_REG; ++ unsigned long tmo = deadline - jiffies; ++ struct ata_taskfile tf; ++ bool online; ++ int rc, i; ++ ++ DPRINTK("ENTER\n"); ++ ++ ahci_stop_engine(ap); ++ ++ for (i = 0; i < 2; i++) { ++ u16 val; ++ u32 sstatus; ++ int port = ap->port_no; ++ struct ata_host *host = ap->host; ++ struct pci_dev *pdev = to_pci_dev(host->dev); ++ ++ /* clear D2H reception area to properly wait for D2H FIS */ ++ ata_tf_init(link->device, &tf); ++ tf.command = ATA_BUSY; ++ ata_tf_to_fis(&tf, 0, 0, d2h_fis); ++ ++ rc = sata_link_hardreset(link, timing, deadline, &online, ++ ahci_check_ready); ++ ++ if (sata_scr_read(link, SCR_STATUS, &sstatus) != 0 || ++ (sstatus & 0xf) != 1) ++ break; ++ ++ ata_link_printk(link, KERN_INFO, "avn bounce port%d\n", ++ port); ++ ++ pci_read_config_word(pdev, 0x92, &val); ++ val &= ~(1 << port); ++ pci_write_config_word(pdev, 0x92, val); ++ ata_msleep(ap, 1000); ++ val |= 1 << port; ++ pci_write_config_word(pdev, 0x92, val); ++ deadline += tmo; ++ } ++ ++ ahci_start_engine(ap); ++ ++ if (online) ++ *class = ahci_dev_classify(ap); ++ ++ DPRINTK("EXIT, rc=%d, class=%u\n", rc, *class); ++ return rc; ++} ++ ++ + #ifdef CONFIG_PM + static int ahci_pci_device_suspend(struct pci_dev *pdev, pm_message_t mesg) + { +diff --git a/drivers/ata/ahci.h b/drivers/ata/ahci.h +index c2594ddf25b0..57eb1c212a4c 100644 +--- a/drivers/ata/ahci.h ++++ b/drivers/ata/ahci.h +@@ -320,6 +320,7 @@ extern struct device_attribute *ahci_sdev_attrs[]; + extern struct ata_port_operations ahci_ops; + extern struct ata_port_operations ahci_pmp_retry_srst_ops; + ++unsigned int ahci_dev_classify(struct ata_port *ap); + void ahci_fill_cmd_slot(struct ahci_port_priv *pp, unsigned int tag, + u32 opts); + void ahci_save_initial_config(struct device *dev, +diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c +index 60f41cd2c330..30cdba79d7ae 100644 +--- a/drivers/ata/libahci.c ++++ b/drivers/ata/libahci.c +@@ -1139,7 +1139,7 @@ static void ahci_dev_config(struct ata_device *dev) + } + } + +-static unsigned int ahci_dev_classify(struct ata_port *ap) ++unsigned int ahci_dev_classify(struct ata_port *ap) + { + void __iomem *port_mmio = ahci_port_base(ap); + struct ata_taskfile tf; +@@ -1153,6 +1153,7 @@ static unsigned int ahci_dev_classify(struct ata_port *ap) + + return ata_dev_classify(&tf); + } ++EXPORT_SYMBOL_GPL(ahci_dev_classify); + + void ahci_fill_cmd_slot(struct ahci_port_priv *pp, unsigned int tag, + u32 opts) +@@ -1670,8 +1671,7 @@ static void ahci_port_intr(struct ata_port *ap) + if (unlikely(resetting)) + status &= ~PORT_IRQ_BAD_PMP; + +- /* if LPM is enabled, PHYRDY doesn't mean anything */ +- if (ap->link.lpm_policy > ATA_LPM_MAX_POWER) { ++ if (sata_lpm_ignore_phy_events(&ap->link)) { + status &= ~PORT_IRQ_PHYRDY; + ahci_scr_write(&ap->link, SCR_ERROR, SERR_PHYRDY_CHG); + } +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index adaf994abb79..0a6767b9939c 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -6657,6 +6657,38 @@ u32 ata_wait_register(struct ata_port *ap, void __iomem *reg, u32 mask, u32 val, + return tmp; + } + ++/** ++ * sata_lpm_ignore_phy_events - test if PHY event should be ignored ++ * @link: Link receiving the event ++ * ++ * Test whether the received PHY event has to be ignored or not. ++ * ++ * LOCKING: ++ * None: ++ * ++ * RETURNS: ++ * True if the event has to be ignored. ++ */ ++bool sata_lpm_ignore_phy_events(struct ata_link *link) ++{ ++ unsigned long lpm_timeout = link->last_lpm_change + ++ msecs_to_jiffies(ATA_TMOUT_SPURIOUS_PHY); ++ ++ /* if LPM is enabled, PHYRDY doesn't mean anything */ ++ if (link->lpm_policy > ATA_LPM_MAX_POWER) ++ return true; ++ ++ /* ignore the first PHY event after the LPM policy changed ++ * as it is might be spurious ++ */ ++ if ((link->flags & ATA_LFLAG_CHANGED) && ++ time_before(jiffies, lpm_timeout)) ++ return true; ++ ++ return false; ++} ++EXPORT_SYMBOL_GPL(sata_lpm_ignore_phy_events); ++ + /* + * Dummy port_ops + */ +diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c +index 37fb4d6069a2..033b8cd497ac 100644 +--- a/drivers/ata/libata-eh.c ++++ b/drivers/ata/libata-eh.c +@@ -3424,6 +3424,9 @@ static int ata_eh_set_lpm(struct ata_link *link, enum ata_lpm_policy policy, + } + } + ++ link->last_lpm_change = jiffies; ++ link->flags |= ATA_LFLAG_CHANGED; ++ + return 0; + + fail: +diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c +index 8a084bffd068..52be498c2d1c 100644 +--- a/drivers/bluetooth/ath3k.c ++++ b/drivers/bluetooth/ath3k.c +@@ -64,6 +64,7 @@ static struct usb_device_id ath3k_table[] = { + /* Atheros AR3011 with sflash firmware*/ + { USB_DEVICE(0x0489, 0xE027) }, + { USB_DEVICE(0x0489, 0xE03D) }, ++ { USB_DEVICE(0x04F2, 0xAFF1) }, + { USB_DEVICE(0x0930, 0x0215) }, + { USB_DEVICE(0x0CF3, 0x3002) }, + { USB_DEVICE(0x0CF3, 0xE019) }, +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 7c0b21ebd33b..f8a58db55055 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -142,6 +142,7 @@ static struct usb_device_id blacklist_table[] = { + /* Atheros 3011 with sflash firmware */ + { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE }, + { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE }, ++ { USB_DEVICE(0x04f2, 0xaff1), .driver_info = BTUSB_IGNORE }, + { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE }, + { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE }, + { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE }, +diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c +index bdecba5de3a4..e53994978ce8 100644 +--- a/drivers/char/ipmi/ipmi_si_intf.c ++++ b/drivers/char/ipmi/ipmi_si_intf.c +@@ -2668,7 +2668,7 @@ static int wait_for_msg_done(struct smi_info *smi_info) + smi_result == SI_SM_CALL_WITH_TICK_DELAY) { + schedule_timeout_uninterruptible(1); + smi_result = smi_info->handlers->event( +- smi_info->si_sm, 100); ++ smi_info->si_sm, jiffies_to_usecs(1)); + } else if (smi_result == SI_SM_CALL_WITHOUT_DELAY) { + smi_result = smi_info->handlers->event( + smi_info->si_sm, 0); +diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c +index b1f1d105e8c7..e1c744d7370a 100644 +--- a/drivers/gpu/drm/i915/i915_gem.c ++++ b/drivers/gpu/drm/i915/i915_gem.c +@@ -1779,9 +1779,6 @@ i915_gem_retire_requests_ring(struct intel_ring_buffer *ring) + uint32_t seqno; + int i; + +- if (list_empty(&ring->request_list)) +- return; +- + WARN_ON(i915_verify_lists(ring->dev)); + + seqno = ring->get_seqno(ring); +diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c +index d51c08da3f69..af6790ccb8a9 100644 +--- a/drivers/gpu/drm/radeon/atombios_crtc.c ++++ b/drivers/gpu/drm/radeon/atombios_crtc.c +@@ -318,8 +318,10 @@ atombios_set_crtc_dtd_timing(struct drm_crtc *crtc, + misc |= ATOM_COMPOSITESYNC; + if (mode->flags & DRM_MODE_FLAG_INTERLACE) + misc |= ATOM_INTERLACE; +- if (mode->flags & DRM_MODE_FLAG_DBLSCAN) ++ if (mode->flags & DRM_MODE_FLAG_DBLCLK) + misc |= ATOM_DOUBLE_CLOCK_MODE; ++ if (mode->flags & DRM_MODE_FLAG_DBLSCAN) ++ misc |= ATOM_H_REPLICATIONBY2 | ATOM_V_REPLICATIONBY2; + + args.susModeMiscInfo.usAccess = cpu_to_le16(misc); + args.ucCRTC = radeon_crtc->crtc_id; +@@ -362,8 +364,10 @@ static void atombios_crtc_set_timing(struct drm_crtc *crtc, + misc |= ATOM_COMPOSITESYNC; + if (mode->flags & DRM_MODE_FLAG_INTERLACE) + misc |= ATOM_INTERLACE; +- if (mode->flags & DRM_MODE_FLAG_DBLSCAN) ++ if (mode->flags & DRM_MODE_FLAG_DBLCLK) + misc |= ATOM_DOUBLE_CLOCK_MODE; ++ if (mode->flags & DRM_MODE_FLAG_DBLSCAN) ++ misc |= ATOM_H_REPLICATIONBY2 | ATOM_V_REPLICATIONBY2; + + args.susModeMiscInfo.usAccess = cpu_to_le16(misc); + args.ucCRTC = radeon_crtc->crtc_id; +diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c +index c5fe79e67ed9..db4df97b7872 100644 +--- a/drivers/gpu/drm/radeon/evergreen.c ++++ b/drivers/gpu/drm/radeon/evergreen.c +@@ -1079,7 +1079,7 @@ int evergreen_pcie_gart_enable(struct radeon_device *rdev) + WREG32(MC_VM_MB_L1_TLB2_CNTL, tmp); + WREG32(MC_VM_MB_L1_TLB3_CNTL, tmp); + WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12); +- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12); ++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1); + WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12); + WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) | + RANGE_PROTECTION_FAULT_ENABLE_DEFAULT); +diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c +index 461262eee79a..1f451796407b 100644 +--- a/drivers/gpu/drm/radeon/ni.c ++++ b/drivers/gpu/drm/radeon/ni.c +@@ -1075,7 +1075,7 @@ int cayman_pcie_gart_enable(struct radeon_device *rdev) + L2_CACHE_BIGK_FRAGMENT_SIZE(6)); + /* setup context0 */ + WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12); +- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12); ++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1); + WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12); + WREG32(VM_CONTEXT0_PROTECTION_FAULT_DEFAULT_ADDR, + (u32)(rdev->dummy_page.addr >> 12)); +diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c +index 9c7062d970ee..d441aed782ad 100644 +--- a/drivers/gpu/drm/radeon/r600.c ++++ b/drivers/gpu/drm/radeon/r600.c +@@ -930,7 +930,7 @@ int r600_pcie_gart_enable(struct radeon_device *rdev) + WREG32(MC_VM_L1_TLB_MCB_RD_SEM_CNTL, tmp | ENABLE_SEMAPHORE_MODE); + WREG32(MC_VM_L1_TLB_MCB_WR_SEM_CNTL, tmp | ENABLE_SEMAPHORE_MODE); + WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12); +- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12); ++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1); + WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12); + WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) | + RANGE_PROTECTION_FAULT_ENABLE_DEFAULT); +diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c +index f3ee36036487..d66d2cdf4f0a 100644 +--- a/drivers/gpu/drm/radeon/radeon_cs.c ++++ b/drivers/gpu/drm/radeon/radeon_cs.c +@@ -49,7 +49,7 @@ int radeon_cs_parser_relocs(struct radeon_cs_parser *p) + if (p->relocs_ptr == NULL) { + return -ENOMEM; + } +- p->relocs = kcalloc(p->nrelocs, sizeof(struct radeon_cs_reloc), GFP_KERNEL); ++ p->relocs = drm_calloc_large(p->nrelocs, sizeof(struct radeon_bo_list)); + if (p->relocs == NULL) { + return -ENOMEM; + } +@@ -324,7 +324,7 @@ static void radeon_cs_parser_fini(struct radeon_cs_parser *parser, int error) + } + } + kfree(parser->track); +- kfree(parser->relocs); ++ drm_free_large(parser->relocs); + kfree(parser->relocs_ptr); + for (i = 0; i < parser->nchunks; i++) { + kfree(parser->chunks[i].kdata); +diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c +index 1ec1255520ad..3358730be78b 100644 +--- a/drivers/gpu/drm/radeon/rv770.c ++++ b/drivers/gpu/drm/radeon/rv770.c +@@ -158,7 +158,7 @@ int rv770_pcie_gart_enable(struct radeon_device *rdev) + WREG32(MC_VM_MB_L1_TLB2_CNTL, tmp); + WREG32(MC_VM_MB_L1_TLB3_CNTL, tmp); + WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12); +- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12); ++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1); + WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12); + WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) | + RANGE_PROTECTION_FAULT_ENABLE_DEFAULT); +diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c +index 068b21f0d7df..3b6e641decd0 100644 +--- a/drivers/gpu/drm/radeon/si.c ++++ b/drivers/gpu/drm/radeon/si.c +@@ -2537,7 +2537,7 @@ int si_pcie_gart_enable(struct radeon_device *rdev) + L2_CACHE_BIGK_FRAGMENT_SIZE(0)); + /* setup context0 */ + WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12); +- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12); ++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1); + WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12); + WREG32(VM_CONTEXT0_PROTECTION_FAULT_DEFAULT_ADDR, + (u32)(rdev->dummy_page.addr >> 12)); +@@ -2555,7 +2555,7 @@ int si_pcie_gart_enable(struct radeon_device *rdev) + */ + /* set vm size, must be a multiple of 4 */ + WREG32(VM_CONTEXT1_PAGE_TABLE_START_ADDR, 0); +- WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn); ++ WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn - 1); + for (i = 1; i < 16; i++) { + if (i < 8) + WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR + (i << 2), +diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c +index 3c8b2c473b81..980ef7e174fb 100644 +--- a/drivers/hv/channel.c ++++ b/drivers/hv/channel.c +@@ -177,7 +177,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size, + GFP_KERNEL); + if (!open_info) { + err = -ENOMEM; +- goto error0; ++ goto error_gpadl; + } + + init_completion(&open_info->waitevent); +@@ -193,7 +193,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size, + + if (userdatalen > MAX_USER_DEFINED_BYTES) { + err = -EINVAL; +- goto error0; ++ goto error_gpadl; + } + + if (userdatalen) +@@ -234,6 +234,9 @@ error1: + list_del(&open_info->msglistentry); + spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags); + ++error_gpadl: ++ vmbus_teardown_gpadl(newchannel, newchannel->ringbuffer_gpadlhandle); ++ + error0: + free_pages((unsigned long)out, + get_order(send_ringbuffer_size + recv_ringbuffer_size)); +diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c +index 9ffbfc575a0c..bcf67af0a07c 100644 +--- a/drivers/hv/channel_mgmt.c ++++ b/drivers/hv/channel_mgmt.c +@@ -531,7 +531,7 @@ int vmbus_request_offers(void) + { + struct vmbus_channel_message_header *msg; + struct vmbus_channel_msginfo *msginfo; +- int ret, t; ++ int ret; + + msginfo = kmalloc(sizeof(*msginfo) + + sizeof(struct vmbus_channel_message_header), +@@ -539,8 +539,6 @@ int vmbus_request_offers(void) + if (!msginfo) + return -ENOMEM; + +- init_completion(&msginfo->waitevent); +- + msg = (struct vmbus_channel_message_header *)msginfo->msg; + + msg->msgtype = CHANNELMSG_REQUESTOFFERS; +@@ -554,14 +552,6 @@ int vmbus_request_offers(void) + goto cleanup; + } + +- t = wait_for_completion_timeout(&msginfo->waitevent, 5*HZ); +- if (t == 0) { +- ret = -ETIMEDOUT; +- goto cleanup; +- } +- +- +- + cleanup: + kfree(msginfo); + +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index 67432e200c63..8987a9ac0309 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -759,36 +759,43 @@ static int cma_get_net_info(void *hdr, enum rdma_port_space ps, + return 0; + } + ++static __be16 ss_get_port(const struct sockaddr_storage *ss) ++{ ++ if (ss->ss_family == AF_INET) ++ return ((struct sockaddr_in *)ss)->sin_port; ++ else if (ss->ss_family == AF_INET6) ++ return ((struct sockaddr_in6 *)ss)->sin6_port; ++ BUG(); ++} ++ + static void cma_save_net_info(struct rdma_addr *addr, + struct rdma_addr *listen_addr, + u8 ip_ver, __be16 port, + union cma_ip_addr *src, union cma_ip_addr *dst) + { +- struct sockaddr_in *listen4, *ip4; +- struct sockaddr_in6 *listen6, *ip6; ++ struct sockaddr_in *ip4; ++ struct sockaddr_in6 *ip6; + + switch (ip_ver) { + case 4: +- listen4 = (struct sockaddr_in *) &listen_addr->src_addr; + ip4 = (struct sockaddr_in *) &addr->src_addr; +- ip4->sin_family = listen4->sin_family; ++ ip4->sin_family = AF_INET;; + ip4->sin_addr.s_addr = dst->ip4.addr; +- ip4->sin_port = listen4->sin_port; ++ ip4->sin_port = ss_get_port(&listen_addr->src_addr); + + ip4 = (struct sockaddr_in *) &addr->dst_addr; +- ip4->sin_family = listen4->sin_family; ++ ip4->sin_family = AF_INET; + ip4->sin_addr.s_addr = src->ip4.addr; + ip4->sin_port = port; + break; + case 6: +- listen6 = (struct sockaddr_in6 *) &listen_addr->src_addr; + ip6 = (struct sockaddr_in6 *) &addr->src_addr; +- ip6->sin6_family = listen6->sin6_family; ++ ip6->sin6_family = AF_INET6; + ip6->sin6_addr = dst->ip6; +- ip6->sin6_port = listen6->sin6_port; ++ ip6->sin6_port = ss_get_port(&listen_addr->src_addr); + + ip6 = (struct sockaddr_in6 *) &addr->dst_addr; +- ip6->sin6_family = listen6->sin6_family; ++ ip6->sin6_family = AF_INET6; + ip6->sin6_addr = src->ip6; + ip6->sin6_port = port; + break; +diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c +index d0254beb6d90..c1fef27010d4 100644 +--- a/drivers/infiniband/core/umem.c ++++ b/drivers/infiniband/core/umem.c +@@ -94,6 +94,9 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr, + if (dmasync) + dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs); + ++ if (!size) ++ return ERR_PTR(-EINVAL); ++ + /* + * If the combination of the addr and size requested for this memory + * region causes an integer overflow, return error. +diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c +index 3a7848966627..b53548c153be 100644 +--- a/drivers/infiniband/hw/mlx4/qp.c ++++ b/drivers/infiniband/hw/mlx4/qp.c +@@ -1670,8 +1670,7 @@ static int build_lso_seg(struct mlx4_wqe_lso_seg *wqe, struct ib_send_wr *wr, + + memcpy(wqe->header, wr->wr.ud.header, wr->wr.ud.hlen); + +- *lso_hdr_sz = cpu_to_be32((wr->wr.ud.mss - wr->wr.ud.hlen) << 16 | +- wr->wr.ud.hlen); ++ *lso_hdr_sz = cpu_to_be32(wr->wr.ud.mss << 16 | wr->wr.ud.hlen); + *lso_seg_len = halign; + return 0; + } +diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c +index f2c2ffedeff5..8eeff9e13319 100644 +--- a/drivers/input/mouse/elantech.c ++++ b/drivers/input/mouse/elantech.c +@@ -313,7 +313,7 @@ static void elantech_report_semi_mt_data(struct input_dev *dev, + unsigned int x2, unsigned int y2) + { + elantech_set_slot(dev, 0, num_fingers != 0, x1, y1); +- elantech_set_slot(dev, 1, num_fingers == 2, x2, y2); ++ elantech_set_slot(dev, 1, num_fingers >= 2, x2, y2); + } + + /* +@@ -783,6 +783,21 @@ static psmouse_ret_t elantech_process_byte(struct psmouse *psmouse) + } + + /* ++ * This writes the reg_07 value again to the hardware at the end of every ++ * set_rate call because the register loses its value. reg_07 allows setting ++ * absolute mode on v4 hardware ++ */ ++static void elantech_set_rate_restore_reg_07(struct psmouse *psmouse, ++ unsigned int rate) ++{ ++ struct elantech_data *etd = psmouse->private; ++ ++ etd->original_set_rate(psmouse, rate); ++ if (elantech_write_reg(psmouse, 0x07, etd->reg_07)) ++ psmouse_err(psmouse, "restoring reg_07 failed\n"); ++} ++ ++/* + * Put the touchpad into absolute mode + */ + static int elantech_set_absolute_mode(struct psmouse *psmouse) +@@ -980,6 +995,8 @@ static int elantech_get_resolution_v4(struct psmouse *psmouse, + * Asus K53SV 0x450f01 78, 15, 0c 2 hw buttons + * Asus G46VW 0x460f02 00, 18, 0c 2 hw buttons + * Asus G750JX 0x360f00 00, 16, 0c 2 hw buttons ++ * Asus TP500LN 0x381f17 10, 14, 0e clickpad ++ * Asus X750JN 0x381f17 10, 14, 0e clickpad + * Asus UX31 0x361f00 20, 15, 0e clickpad + * Asus UX32VD 0x361f02 00, 15, 0e clickpad + * Avatar AVIU-145A2 0x361f00 ? clickpad +@@ -1219,10 +1236,11 @@ static bool elantech_is_signature_valid(const unsigned char *param) + return true; + + /* +- * Some models have a revision higher then 20. Meaning param[2] may +- * be 10 or 20, skip the rates check for these. ++ * Some hw_version >= 4 models have a revision higher then 20. Meaning ++ * that param[2] may be 10 or 20, skip the rates check for these. + */ +- if (param[0] == 0x46 && (param[1] & 0xef) == 0x0f && param[2] < 40) ++ if ((param[0] & 0x0f) >= 0x06 && (param[1] & 0xaf) == 0x0f && ++ param[2] < 40) + return true; + + for (i = 0; i < ARRAY_SIZE(rates); i++) +@@ -1427,6 +1445,11 @@ int elantech_init(struct psmouse *psmouse) + goto init_fail; + } + ++ if (etd->fw_version == 0x381f17) { ++ etd->original_set_rate = psmouse->set_rate; ++ psmouse->set_rate = elantech_set_rate_restore_reg_07; ++ } ++ + if (elantech_set_input_params(psmouse)) { + psmouse_err(psmouse, "failed to query touchpad range.\n"); + goto init_fail; +diff --git a/drivers/input/mouse/elantech.h b/drivers/input/mouse/elantech.h +index 46db3be45ac9..4d1b220cbdfc 100644 +--- a/drivers/input/mouse/elantech.h ++++ b/drivers/input/mouse/elantech.h +@@ -137,6 +137,7 @@ struct elantech_data { + struct finger_pos mt[ETP_MAX_FINGERS]; + unsigned char parity[256]; + int (*send_cmd)(struct psmouse *psmouse, unsigned char c, unsigned char *param); ++ void (*original_set_rate)(struct psmouse *psmouse, unsigned int rate); + }; + + #ifdef CONFIG_MOUSE_PS2_ELANTECH +diff --git a/drivers/lguest/core.c b/drivers/lguest/core.c +index b5fdcb78a75b..34842e5e8b55 100644 +--- a/drivers/lguest/core.c ++++ b/drivers/lguest/core.c +@@ -171,7 +171,7 @@ static void unmap_switcher(void) + bool lguest_address_ok(const struct lguest *lg, + unsigned long addr, unsigned long len) + { +- return (addr+len) / PAGE_SIZE < lg->pfn_limit && (addr+len >= addr); ++ return addr+len <= lg->pfn_limit * PAGE_SIZE && (addr+len >= addr); + } + + /* +diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c +index 926989d6419f..a1bd68885c7c 100644 +--- a/drivers/md/dm-crypt.c ++++ b/drivers/md/dm-crypt.c +@@ -782,11 +782,10 @@ static int crypt_convert(struct crypt_config *cc, + + switch (r) { + /* async */ ++ case -EINPROGRESS: + case -EBUSY: + wait_for_completion(&ctx->restart); + INIT_COMPLETION(ctx->restart); +- /* fall through*/ +- case -EINPROGRESS: + this_cc->req = NULL; + ctx->sector++; + continue; +@@ -1195,10 +1194,8 @@ static void kcryptd_async_done(struct crypto_async_request *async_req, + struct dm_crypt_io *io = container_of(ctx, struct dm_crypt_io, ctx); + struct crypt_config *cc = io->target->private; + +- if (error == -EINPROGRESS) { +- complete(&ctx->restart); ++ if (error == -EINPROGRESS) + return; +- } + + if (!error && cc->iv_gen_ops && cc->iv_gen_ops->post) + error = cc->iv_gen_ops->post(cc, iv_of_dmreq(cc, dmreq), dmreq); +@@ -1209,12 +1206,15 @@ static void kcryptd_async_done(struct crypto_async_request *async_req, + mempool_free(req_of_dmreq(cc, dmreq), cc->req_pool); + + if (!atomic_dec_and_test(&ctx->pending)) +- return; ++ goto done; + + if (bio_data_dir(io->base_bio) == READ) + kcryptd_crypt_read_done(io); + else + kcryptd_crypt_write_io_submit(io, 1); ++done: ++ if (!completion_done(&ctx->restart)) ++ complete(&ctx->restart); + } + + static void kcryptd_crypt(struct work_struct *work) +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 17e2f526457c..83dba060525b 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -5431,9 +5431,9 @@ static int get_bitmap_file(struct mddev * mddev, void __user * arg) + int err = -ENOMEM; + + if (md_allow_write(mddev)) +- file = kmalloc(sizeof(*file), GFP_NOIO); ++ file = kzalloc(sizeof(*file), GFP_NOIO); + else +- file = kmalloc(sizeof(*file), GFP_KERNEL); ++ file = kzalloc(sizeof(*file), GFP_KERNEL); + + if (!file) + goto out; +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index c276ad09ace9..7a218e81eb39 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -1622,7 +1622,8 @@ static int resize_stripes(struct r5conf *conf, int newsize) + + conf->slab_cache = sc; + conf->active_name = 1-conf->active_name; +- conf->pool_size = newsize; ++ if (!err) ++ conf->pool_size = newsize; + return err; + } + +diff --git a/drivers/memstick/core/mspro_block.c b/drivers/memstick/core/mspro_block.c +index 9729b92fbfdd..f8449d534a25 100644 +--- a/drivers/memstick/core/mspro_block.c ++++ b/drivers/memstick/core/mspro_block.c +@@ -760,7 +760,7 @@ static int mspro_block_complete_req(struct memstick_dev *card, int error) + + if (error || (card->current_mrq.tpc == MSPRO_CMD_STOP)) { + if (msb->data_dir == READ) { +- for (cnt = 0; cnt < msb->current_seg; cnt++) ++ for (cnt = 0; cnt < msb->current_seg; cnt++) { + t_len += msb->req_sg[cnt].length + / msb->page_size; + +@@ -768,6 +768,7 @@ static int mspro_block_complete_req(struct memstick_dev *card, int error) + t_len += msb->current_page - 1; + + t_len *= msb->page_size; ++ } + } + } else + t_len = blk_rq_bytes(msb->block_req); +diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c +index ba821fe70bca..eef126126478 100644 +--- a/drivers/mmc/core/core.c ++++ b/drivers/mmc/core/core.c +@@ -2370,6 +2370,7 @@ int mmc_pm_notify(struct notifier_block *notify_block, + switch (mode) { + case PM_HIBERNATION_PREPARE: + case PM_SUSPEND_PREPARE: ++ case PM_RESTORE_PREPARE: + + spin_lock_irqsave(&host->lock, flags); + host->rescan_disable = 1; +diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c +index e6f08d945709..c300cc4dcda0 100644 +--- a/drivers/mmc/host/atmel-mci.c ++++ b/drivers/mmc/host/atmel-mci.c +@@ -1125,7 +1125,7 @@ static void atmci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios) + + if (ios->clock) { + unsigned int clock_min = ~0U; +- u32 clkdiv; ++ int clkdiv; + + spin_lock_bh(&host->lock); + if (!host->mode_reg) { +@@ -1150,7 +1150,12 @@ static void atmci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios) + /* Calculate clock divider */ + if (host->caps.has_odd_clk_div) { + clkdiv = DIV_ROUND_UP(host->bus_hz, clock_min) - 2; +- if (clkdiv > 511) { ++ if (clkdiv < 0) { ++ dev_warn(&mmc->class_dev, ++ "clock %u too fast; using %lu\n", ++ clock_min, host->bus_hz / 2); ++ clkdiv = 0; ++ } else if (clkdiv > 511) { + dev_warn(&mmc->class_dev, + "clock %u too slow; using %lu\n", + clock_min, host->bus_hz / (511 + 2)); +diff --git a/drivers/mtd/ubi/cdev.c b/drivers/mtd/ubi/cdev.c +index ad76592fb2f4..7ac2c05783f3 100644 +--- a/drivers/mtd/ubi/cdev.c ++++ b/drivers/mtd/ubi/cdev.c +@@ -475,7 +475,7 @@ static long vol_cdev_ioctl(struct file *file, unsigned int cmd, + /* Validate the request */ + err = -EINVAL; + if (req.lnum < 0 || req.lnum >= vol->reserved_pebs || +- req.bytes < 0 || req.lnum >= vol->usable_leb_size) ++ req.bytes < 0 || req.bytes > vol->usable_leb_size) + break; + if (req.dtype != UBI_LONGTERM && req.dtype != UBI_SHORTTERM && + req.dtype != UBI_UNKNOWN) +diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c +index 2455d620d96b..9abc0ea6702e 100644 +--- a/drivers/mtd/ubi/eba.c ++++ b/drivers/mtd/ubi/eba.c +@@ -1261,7 +1261,8 @@ int ubi_eba_init_scan(struct ubi_device *ubi, struct ubi_scan_info *si) + * during re-size. + */ + ubi_scan_move_to_list(sv, seb, &si->erase); +- vol->eba_tbl[seb->lnum] = seb->pnum; ++ else ++ vol->eba_tbl[seb->lnum] = seb->pnum; + } + } + +diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c +index 7c1a9bf8ac86..284d144ff5a6 100644 +--- a/drivers/mtd/ubi/wl.c ++++ b/drivers/mtd/ubi/wl.c +@@ -666,7 +666,7 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk, + int cancel) + { + int err, scrubbing = 0, torture = 0, protect = 0, erroneous = 0; +- int vol_id = -1, uninitialized_var(lnum); ++ int vol_id = -1, lnum = -1; + struct ubi_wl_entry *e1, *e2; + struct ubi_vid_hdr *vid_hdr; + +diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c +index 8d8908d2a9b1..b7a7524c8693 100644 +--- a/drivers/net/ethernet/intel/e1000/e1000_main.c ++++ b/drivers/net/ethernet/intel/e1000/e1000_main.c +@@ -144,6 +144,11 @@ static bool e1000_clean_rx_irq(struct e1000_adapter *adapter, + static bool e1000_clean_jumbo_rx_irq(struct e1000_adapter *adapter, + struct e1000_rx_ring *rx_ring, + int *work_done, int work_to_do); ++static void e1000_alloc_dummy_rx_buffers(struct e1000_adapter *adapter, ++ struct e1000_rx_ring *rx_ring, ++ int cleaned_count) ++{ ++} + static void e1000_alloc_rx_buffers(struct e1000_adapter *adapter, + struct e1000_rx_ring *rx_ring, + int cleaned_count); +@@ -3545,8 +3550,11 @@ static int e1000_change_mtu(struct net_device *netdev, int new_mtu) + msleep(1); + /* e1000_down has a dependency on max_frame_size */ + hw->max_frame_size = max_frame; +- if (netif_running(netdev)) ++ if (netif_running(netdev)) { ++ /* prevent buffers from being reallocated */ ++ adapter->alloc_rx_buf = e1000_alloc_dummy_rx_buffers; + e1000_down(adapter); ++ } + + /* NOTE: netdev_alloc_skb reserves 16 bytes, and typically NET_IP_ALIGN + * means we reserve 2 more, this pushes us to allocate from the next +diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c +index 2c4cdcecbe39..091c85f461a1 100644 +--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c +@@ -357,6 +357,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = { + {RTL_USB_DEVICE(0x2001, 0x3307, rtl92cu_hal_cfg)}, /*D-Link-Cameo*/ + {RTL_USB_DEVICE(0x2001, 0x3309, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/ + {RTL_USB_DEVICE(0x2001, 0x330a, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/ ++ {RTL_USB_DEVICE(0x2001, 0x330d, rtl92cu_hal_cfg)}, /*D-Link DWA-131 */ + {RTL_USB_DEVICE(0x2019, 0xab2b, rtl92cu_hal_cfg)}, /*Planex -Abocom*/ + {RTL_USB_DEVICE(0x20f4, 0x624d, rtl92cu_hal_cfg)}, /*TRENDNet*/ + {RTL_USB_DEVICE(0x2357, 0x0100, rtl92cu_hal_cfg)}, /*TP-Link WN8200ND*/ +diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c +index 2b6faa069e9a..9b6cb583883a 100644 +--- a/drivers/net/wireless/rtlwifi/usb.c ++++ b/drivers/net/wireless/rtlwifi/usb.c +@@ -119,7 +119,7 @@ static int _usbctrl_vendorreq_sync_read(struct usb_device *udev, u8 request, + + do { + status = usb_control_msg(udev, pipe, request, reqtype, value, +- index, pdata, len, 0); /*max. timeout*/ ++ index, pdata, len, 1000); + if (status < 0) { + /* firmware download is checksumed, don't retry */ + if ((value >= FW_8192C_START_ADDRESS && +diff --git a/drivers/platform/x86/compal-laptop.c b/drivers/platform/x86/compal-laptop.c +index 1887e2f166a4..67938889f5b6 100644 +--- a/drivers/platform/x86/compal-laptop.c ++++ b/drivers/platform/x86/compal-laptop.c +@@ -1047,7 +1047,13 @@ static int __devinit compal_probe(struct platform_device *pdev) + + /* Power supply */ + initialize_power_supply_data(data); +- power_supply_register(&compal_device->dev, &data->psy); ++ err = power_supply_register(&compal_device->dev, &data->psy); ++ if (err < 0) { ++ hwmon_device_unregister(data->hwmon_dev); ++ sysfs_remove_group(&pdev->dev.kobj, ++ &compal_attribute_group); ++ kfree(data); ++ } + + platform_set_drvdata(pdev, data); + +diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c +index 3868ab2397c6..fb37df690b9a 100644 +--- a/drivers/scsi/3w-9xxx.c ++++ b/drivers/scsi/3w-9xxx.c +@@ -149,7 +149,6 @@ static int twa_reset_sequence(TW_Device_Extension *tw_dev, int soft_reset); + static int twa_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, char *cdb, int use_sg, TW_SG_Entry *sglistarg); + static void twa_scsiop_execute_scsi_complete(TW_Device_Extension *tw_dev, int request_id); + static char *twa_string_lookup(twa_message_type *table, unsigned int aen_code); +-static void twa_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id); + + /* Functions */ + +@@ -1352,11 +1351,11 @@ static irqreturn_t twa_interrupt(int irq, void *dev_instance) + } + + /* Now complete the io */ ++ scsi_dma_unmap(cmd); ++ cmd->scsi_done(cmd); + tw_dev->state[request_id] = TW_S_COMPLETED; + twa_free_request_id(tw_dev, request_id); + tw_dev->posted_request_count--; +- tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]); +- twa_unmap_scsi_data(tw_dev, request_id); + } + + /* Check for valid status after each drain */ +@@ -1414,26 +1413,6 @@ static void twa_load_sgl(TW_Device_Extension *tw_dev, TW_Command_Full *full_comm + } + } /* End twa_load_sgl() */ + +-/* This function will perform a pci-dma mapping for a scatter gather list */ +-static int twa_map_scsi_sg_data(TW_Device_Extension *tw_dev, int request_id) +-{ +- int use_sg; +- struct scsi_cmnd *cmd = tw_dev->srb[request_id]; +- +- use_sg = scsi_dma_map(cmd); +- if (!use_sg) +- return 0; +- else if (use_sg < 0) { +- TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1c, "Failed to map scatter gather list"); +- return 0; +- } +- +- cmd->SCp.phase = TW_PHASE_SGLIST; +- cmd->SCp.have_data_in = use_sg; +- +- return use_sg; +-} /* End twa_map_scsi_sg_data() */ +- + /* This function will poll for a response interrupt of a request */ + static int twa_poll_response(TW_Device_Extension *tw_dev, int request_id, int seconds) + { +@@ -1612,9 +1591,11 @@ static int twa_reset_device_extension(TW_Device_Extension *tw_dev) + (tw_dev->state[i] != TW_S_INITIAL) && + (tw_dev->state[i] != TW_S_COMPLETED)) { + if (tw_dev->srb[i]) { +- tw_dev->srb[i]->result = (DID_RESET << 16); +- tw_dev->srb[i]->scsi_done(tw_dev->srb[i]); +- twa_unmap_scsi_data(tw_dev, i); ++ struct scsi_cmnd *cmd = tw_dev->srb[i]; ++ ++ cmd->result = (DID_RESET << 16); ++ scsi_dma_unmap(cmd); ++ cmd->scsi_done(cmd); + } + } + } +@@ -1793,21 +1774,18 @@ static int twa_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_ + /* Save the scsi command for use by the ISR */ + tw_dev->srb[request_id] = SCpnt; + +- /* Initialize phase to zero */ +- SCpnt->SCp.phase = TW_PHASE_INITIAL; +- + retval = twa_scsiop_execute_scsi(tw_dev, request_id, NULL, 0, NULL); + switch (retval) { + case SCSI_MLQUEUE_HOST_BUSY: ++ scsi_dma_unmap(SCpnt); + twa_free_request_id(tw_dev, request_id); +- twa_unmap_scsi_data(tw_dev, request_id); + break; + case 1: +- tw_dev->state[request_id] = TW_S_COMPLETED; +- twa_free_request_id(tw_dev, request_id); +- twa_unmap_scsi_data(tw_dev, request_id); + SCpnt->result = (DID_ERROR << 16); ++ scsi_dma_unmap(SCpnt); + done(SCpnt); ++ tw_dev->state[request_id] = TW_S_COMPLETED; ++ twa_free_request_id(tw_dev, request_id); + retval = 0; + } + out: +@@ -1875,8 +1853,8 @@ static int twa_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, + command_packet->sg_list[0].address = TW_CPU_TO_SGL(tw_dev->generic_buffer_phys[request_id]); + command_packet->sg_list[0].length = cpu_to_le32(TW_MIN_SGL_LENGTH); + } else { +- sg_count = twa_map_scsi_sg_data(tw_dev, request_id); +- if (sg_count == 0) ++ sg_count = scsi_dma_map(srb); ++ if (sg_count < 0) + goto out; + + scsi_for_each_sg(srb, sg, sg_count, i) { +@@ -1991,15 +1969,6 @@ static char *twa_string_lookup(twa_message_type *table, unsigned int code) + return(table[index].text); + } /* End twa_string_lookup() */ + +-/* This function will perform a pci-dma unmap */ +-static void twa_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id) +-{ +- struct scsi_cmnd *cmd = tw_dev->srb[request_id]; +- +- if (cmd->SCp.phase == TW_PHASE_SGLIST) +- scsi_dma_unmap(cmd); +-} /* End twa_unmap_scsi_data() */ +- + /* This function gets called when a disk is coming on-line */ + static int twa_slave_configure(struct scsi_device *sdev) + { +diff --git a/drivers/scsi/3w-9xxx.h b/drivers/scsi/3w-9xxx.h +index 040f7214e5b7..0fdc83cfa0e1 100644 +--- a/drivers/scsi/3w-9xxx.h ++++ b/drivers/scsi/3w-9xxx.h +@@ -324,11 +324,6 @@ static twa_message_type twa_error_table[] = { + #define TW_CURRENT_DRIVER_BUILD 0 + #define TW_CURRENT_DRIVER_BRANCH 0 + +-/* Phase defines */ +-#define TW_PHASE_INITIAL 0 +-#define TW_PHASE_SINGLE 1 +-#define TW_PHASE_SGLIST 2 +- + /* Misc defines */ + #define TW_9550SX_DRAIN_COMPLETED 0xFFFF + #define TW_SECTOR_SIZE 512 +diff --git a/drivers/scsi/3w-sas.c b/drivers/scsi/3w-sas.c +index 13e39e1fdfe2..c555ccb119d1 100644 +--- a/drivers/scsi/3w-sas.c ++++ b/drivers/scsi/3w-sas.c +@@ -303,26 +303,6 @@ static int twl_post_command_packet(TW_Device_Extension *tw_dev, int request_id) + return 0; + } /* End twl_post_command_packet() */ + +-/* This function will perform a pci-dma mapping for a scatter gather list */ +-static int twl_map_scsi_sg_data(TW_Device_Extension *tw_dev, int request_id) +-{ +- int use_sg; +- struct scsi_cmnd *cmd = tw_dev->srb[request_id]; +- +- use_sg = scsi_dma_map(cmd); +- if (!use_sg) +- return 0; +- else if (use_sg < 0) { +- TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1, "Failed to map scatter gather list"); +- return 0; +- } +- +- cmd->SCp.phase = TW_PHASE_SGLIST; +- cmd->SCp.have_data_in = use_sg; +- +- return use_sg; +-} /* End twl_map_scsi_sg_data() */ +- + /* This function hands scsi cdb's to the firmware */ + static int twl_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, char *cdb, int use_sg, TW_SG_Entry_ISO *sglistarg) + { +@@ -370,8 +350,8 @@ static int twl_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, + if (!sglistarg) { + /* Map sglist from scsi layer to cmd packet */ + if (scsi_sg_count(srb)) { +- sg_count = twl_map_scsi_sg_data(tw_dev, request_id); +- if (sg_count == 0) ++ sg_count = scsi_dma_map(srb); ++ if (sg_count <= 0) + goto out; + + scsi_for_each_sg(srb, sg, sg_count, i) { +@@ -1116,15 +1096,6 @@ out: + return retval; + } /* End twl_initialize_device_extension() */ + +-/* This function will perform a pci-dma unmap */ +-static void twl_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id) +-{ +- struct scsi_cmnd *cmd = tw_dev->srb[request_id]; +- +- if (cmd->SCp.phase == TW_PHASE_SGLIST) +- scsi_dma_unmap(cmd); +-} /* End twl_unmap_scsi_data() */ +- + /* This function will handle attention interrupts */ + static int twl_handle_attention_interrupt(TW_Device_Extension *tw_dev) + { +@@ -1265,11 +1236,11 @@ static irqreturn_t twl_interrupt(int irq, void *dev_instance) + } + + /* Now complete the io */ ++ scsi_dma_unmap(cmd); ++ cmd->scsi_done(cmd); + tw_dev->state[request_id] = TW_S_COMPLETED; + twl_free_request_id(tw_dev, request_id); + tw_dev->posted_request_count--; +- tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]); +- twl_unmap_scsi_data(tw_dev, request_id); + } + + /* Check for another response interrupt */ +@@ -1414,10 +1385,12 @@ static int twl_reset_device_extension(TW_Device_Extension *tw_dev, int ioctl_res + if ((tw_dev->state[i] != TW_S_FINISHED) && + (tw_dev->state[i] != TW_S_INITIAL) && + (tw_dev->state[i] != TW_S_COMPLETED)) { +- if (tw_dev->srb[i]) { +- tw_dev->srb[i]->result = (DID_RESET << 16); +- tw_dev->srb[i]->scsi_done(tw_dev->srb[i]); +- twl_unmap_scsi_data(tw_dev, i); ++ struct scsi_cmnd *cmd = tw_dev->srb[i]; ++ ++ if (cmd) { ++ cmd->result = (DID_RESET << 16); ++ scsi_dma_unmap(cmd); ++ cmd->scsi_done(cmd); + } + } + } +@@ -1521,9 +1494,6 @@ static int twl_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_ + /* Save the scsi command for use by the ISR */ + tw_dev->srb[request_id] = SCpnt; + +- /* Initialize phase to zero */ +- SCpnt->SCp.phase = TW_PHASE_INITIAL; +- + retval = twl_scsiop_execute_scsi(tw_dev, request_id, NULL, 0, NULL); + if (retval) { + tw_dev->state[request_id] = TW_S_COMPLETED; +diff --git a/drivers/scsi/3w-sas.h b/drivers/scsi/3w-sas.h +index d474892701d4..fec6449c7595 100644 +--- a/drivers/scsi/3w-sas.h ++++ b/drivers/scsi/3w-sas.h +@@ -103,10 +103,6 @@ static char *twl_aen_severity_table[] = + #define TW_CURRENT_DRIVER_BUILD 0 + #define TW_CURRENT_DRIVER_BRANCH 0 + +-/* Phase defines */ +-#define TW_PHASE_INITIAL 0 +-#define TW_PHASE_SGLIST 2 +- + /* Misc defines */ + #define TW_SECTOR_SIZE 512 + #define TW_MAX_UNITS 32 +diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c +index 7fe96ff60c58..86bc5f9212d6 100644 +--- a/drivers/scsi/3w-xxxx.c ++++ b/drivers/scsi/3w-xxxx.c +@@ -1283,32 +1283,6 @@ static int tw_initialize_device_extension(TW_Device_Extension *tw_dev) + return 0; + } /* End tw_initialize_device_extension() */ + +-static int tw_map_scsi_sg_data(struct pci_dev *pdev, struct scsi_cmnd *cmd) +-{ +- int use_sg; +- +- dprintk(KERN_WARNING "3w-xxxx: tw_map_scsi_sg_data()\n"); +- +- use_sg = scsi_dma_map(cmd); +- if (use_sg < 0) { +- printk(KERN_WARNING "3w-xxxx: tw_map_scsi_sg_data(): pci_map_sg() failed.\n"); +- return 0; +- } +- +- cmd->SCp.phase = TW_PHASE_SGLIST; +- cmd->SCp.have_data_in = use_sg; +- +- return use_sg; +-} /* End tw_map_scsi_sg_data() */ +- +-static void tw_unmap_scsi_data(struct pci_dev *pdev, struct scsi_cmnd *cmd) +-{ +- dprintk(KERN_WARNING "3w-xxxx: tw_unmap_scsi_data()\n"); +- +- if (cmd->SCp.phase == TW_PHASE_SGLIST) +- scsi_dma_unmap(cmd); +-} /* End tw_unmap_scsi_data() */ +- + /* This function will reset a device extension */ + static int tw_reset_device_extension(TW_Device_Extension *tw_dev) + { +@@ -1331,8 +1305,8 @@ static int tw_reset_device_extension(TW_Device_Extension *tw_dev) + srb = tw_dev->srb[i]; + if (srb != NULL) { + srb->result = (DID_RESET << 16); +- tw_dev->srb[i]->scsi_done(tw_dev->srb[i]); +- tw_unmap_scsi_data(tw_dev->tw_pci_dev, tw_dev->srb[i]); ++ scsi_dma_unmap(srb); ++ srb->scsi_done(srb); + } + } + } +@@ -1779,8 +1753,8 @@ static int tw_scsiop_read_write(TW_Device_Extension *tw_dev, int request_id) + command_packet->byte8.io.lba = lba; + command_packet->byte6.block_count = num_sectors; + +- use_sg = tw_map_scsi_sg_data(tw_dev->tw_pci_dev, tw_dev->srb[request_id]); +- if (!use_sg) ++ use_sg = scsi_dma_map(srb); ++ if (use_sg <= 0) + return 1; + + scsi_for_each_sg(tw_dev->srb[request_id], sg, use_sg, i) { +@@ -1967,9 +1941,6 @@ static int tw_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_c + /* Save the scsi command for use by the ISR */ + tw_dev->srb[request_id] = SCpnt; + +- /* Initialize phase to zero */ +- SCpnt->SCp.phase = TW_PHASE_INITIAL; +- + switch (*command) { + case READ_10: + case READ_6: +@@ -2196,12 +2167,11 @@ static irqreturn_t tw_interrupt(int irq, void *dev_instance) + + /* Now complete the io */ + if ((error != TW_ISR_DONT_COMPLETE)) { ++ scsi_dma_unmap(tw_dev->srb[request_id]); ++ tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]); + tw_dev->state[request_id] = TW_S_COMPLETED; + tw_state_request_finish(tw_dev, request_id); + tw_dev->posted_request_count--; +- tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]); +- +- tw_unmap_scsi_data(tw_dev->tw_pci_dev, tw_dev->srb[request_id]); + } + } + +diff --git a/drivers/scsi/3w-xxxx.h b/drivers/scsi/3w-xxxx.h +index 49dcf03c631a..1d31858766ce 100644 +--- a/drivers/scsi/3w-xxxx.h ++++ b/drivers/scsi/3w-xxxx.h +@@ -195,11 +195,6 @@ static unsigned char tw_sense_table[][4] = + #define TW_AEN_SMART_FAIL 0x000F + #define TW_AEN_SBUF_FAIL 0x0024 + +-/* Phase defines */ +-#define TW_PHASE_INITIAL 0 +-#define TW_PHASE_SINGLE 1 +-#define TW_PHASE_SGLIST 2 +- + /* Misc defines */ + #define TW_ALIGNMENT_6000 64 /* 64 bytes */ + #define TW_ALIGNMENT_7000 4 /* 4 bytes */ +diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c +index bfd87fab39aa..3e0f71c155a3 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c ++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c +@@ -1426,11 +1426,11 @@ megasas_build_ldio_fusion(struct megasas_instance *instance, + fp_possible = io_info.fpOkForIo; + } + +- /* Use smp_processor_id() for now until cmd->request->cpu is CPU ++ /* Use raw_smp_processor_id() for now until cmd->request->cpu is CPU + id by default, not CPU group id, otherwise all MSI-X queues won't + be utilized */ + cmd->request_desc->SCSIIO.MSIxIndex = instance->msix_vectors ? +- smp_processor_id() % instance->msix_vectors : 0; ++ raw_smp_processor_id() % instance->msix_vectors : 0; + + if (fp_possible) { + megasas_set_pd_lba(io_request, scp->cmd_len, &io_info, scp, +diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c +index cf8dfab9489f..28a635c66f3e 100644 +--- a/drivers/scsi/scsi_devinfo.c ++++ b/drivers/scsi/scsi_devinfo.c +@@ -222,6 +222,7 @@ static struct { + {"PIONEER", "CD-ROM DRM-604X", NULL, BLIST_FORCELUN | BLIST_SINGLELUN}, + {"PIONEER", "CD-ROM DRM-624X", NULL, BLIST_FORCELUN | BLIST_SINGLELUN}, + {"Promise", "", NULL, BLIST_SPARSELUN}, ++ {"QNAP", "iSCSI Storage", NULL, BLIST_MAX_1024}, + {"QUANTUM", "XP34301", "1071", BLIST_NOTQ}, + {"REGAL", "CDC-4X", NULL, BLIST_MAX5LUN | BLIST_SINGLELUN}, + {"SanDisk", "ImageMate CF-SD1", NULL, BLIST_FORCELUN}, +diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c +index 348840e80921..37abf4fdc8d7 100644 +--- a/drivers/scsi/scsi_scan.c ++++ b/drivers/scsi/scsi_scan.c +@@ -888,6 +888,12 @@ static int scsi_add_lun(struct scsi_device *sdev, unsigned char *inq_result, + */ + if (*bflags & BLIST_MAX_512) + blk_queue_max_hw_sectors(sdev->request_queue, 512); ++ /* ++ * Max 1024 sector transfer length for targets that report incorrect ++ * max/optimal lengths and relied on the old block layer safe default ++ */ ++ else if (*bflags & BLIST_MAX_1024) ++ blk_queue_max_hw_sectors(sdev->request_queue, 1024); + + /* + * Some devices may not want to have a start command automatically +diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c +index 7f6746a642e6..97aa6c647da9 100644 +--- a/drivers/scsi/sd.c ++++ b/drivers/scsi/sd.c +@@ -1423,6 +1423,7 @@ static unsigned int sd_completed_bytes(struct scsi_cmnd *scmd) + { + u64 start_lba = blk_rq_pos(scmd->request); + u64 end_lba = blk_rq_pos(scmd->request) + (scsi_bufflen(scmd) / 512); ++ u64 factor = scmd->device->sector_size / 512; + u64 bad_lba; + int info_valid; + /* +@@ -1444,16 +1445,10 @@ static unsigned int sd_completed_bytes(struct scsi_cmnd *scmd) + if (scsi_bufflen(scmd) <= scmd->device->sector_size) + return 0; + +- if (scmd->device->sector_size < 512) { +- /* only legitimate sector_size here is 256 */ +- start_lba <<= 1; +- end_lba <<= 1; +- } else { +- /* be careful ... don't want any overflows */ +- u64 factor = scmd->device->sector_size / 512; +- do_div(start_lba, factor); +- do_div(end_lba, factor); +- } ++ /* be careful ... don't want any overflows */ ++ factor = scmd->device->sector_size / 512; ++ do_div(start_lba, factor); ++ do_div(end_lba, factor); + + /* The bad lba was reported incorrectly, we have no idea where + * the error is. +@@ -1984,8 +1979,7 @@ got_data: + if (sector_size != 512 && + sector_size != 1024 && + sector_size != 2048 && +- sector_size != 4096 && +- sector_size != 256) { ++ sector_size != 4096) { + sd_printk(KERN_NOTICE, sdkp, "Unsupported sector size %d.\n", + sector_size); + /* +@@ -2034,8 +2028,6 @@ got_data: + sdkp->capacity <<= 2; + else if (sector_size == 1024) + sdkp->capacity <<= 1; +- else if (sector_size == 256) +- sdkp->capacity >>= 1; + + blk_queue_physical_block_size(sdp->request_queue, + sdkp->physical_block_size); +diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c +index a0df0fbf2db9..4ae776995e2a 100644 +--- a/drivers/scsi/storvsc_drv.c ++++ b/drivers/scsi/storvsc_drv.c +@@ -610,21 +610,22 @@ static unsigned int copy_to_bounce_buffer(struct scatterlist *orig_sgl, + if (bounce_sgl[j].length == PAGE_SIZE) { + /* full..move to next entry */ + sg_kunmap_atomic(bounce_addr); ++ bounce_addr = 0; + j++; ++ } + +- /* if we need to use another bounce buffer */ +- if (srclen || i != orig_sgl_count - 1) +- bounce_addr = sg_kmap_atomic(bounce_sgl,j); ++ /* if we need to use another bounce buffer */ ++ if (srclen && bounce_addr == 0) ++ bounce_addr = sg_kmap_atomic(bounce_sgl, j); + +- } else if (srclen == 0 && i == orig_sgl_count - 1) { +- /* unmap the last bounce that is < PAGE_SIZE */ +- sg_kunmap_atomic(bounce_addr); +- } + } + + sg_kunmap_atomic(src_addr - orig_sgl[i].offset); + } + ++ if (bounce_addr) ++ sg_kunmap_atomic(bounce_addr); ++ + local_irq_restore(flags); + + return total_copied; +diff --git a/drivers/staging/ozwpan/ozusbsvc1.c b/drivers/staging/ozwpan/ozusbsvc1.c +index 66bd576bb5e9..ca61576dc46a 100644 +--- a/drivers/staging/ozwpan/ozusbsvc1.c ++++ b/drivers/staging/ozwpan/ozusbsvc1.c +@@ -314,7 +314,11 @@ void oz_usb_handle_ep_data(struct oz_usb_ctx *usb_ctx, + struct oz_multiple_fixed *body = + (struct oz_multiple_fixed *)data_hdr; + u8 *data = body->data; +- int n = (len - sizeof(struct oz_multiple_fixed)+1) ++ unsigned int n; ++ if (!body->unit_size || ++ len < sizeof(struct oz_multiple_fixed) - 1) ++ break; ++ n = (len - (sizeof(struct oz_multiple_fixed) - 1)) + / body->unit_size; + while (n--) { + oz_hcd_data_ind(usb_ctx->hport, body->endpoint, +@@ -376,10 +380,15 @@ void oz_usb_rx(struct oz_pd *pd, struct oz_elt *elt) + case OZ_GET_DESC_RSP: { + struct oz_get_desc_rsp *body = + (struct oz_get_desc_rsp *)usb_hdr; +- int data_len = elt->length - +- sizeof(struct oz_get_desc_rsp) + 1; +- u16 offs = le16_to_cpu(get_unaligned(&body->offset)); +- u16 total_size = ++ u16 offs, total_size; ++ u8 data_len; ++ ++ if (elt->length < sizeof(struct oz_get_desc_rsp) - 1) ++ break; ++ data_len = elt->length - ++ (sizeof(struct oz_get_desc_rsp) - 1); ++ offs = le16_to_cpu(get_unaligned(&body->offset)); ++ total_size = + le16_to_cpu(get_unaligned(&body->total_size)); + oz_trace("USB_REQ_GET_DESCRIPTOR - cnf\n"); + oz_hcd_get_desc_cnf(usb_ctx->hport, body->req_id, +diff --git a/drivers/staging/panel/panel.c b/drivers/staging/panel/panel.c +index 6183573f112f..5d4b4f07f4b8 100644 +--- a/drivers/staging/panel/panel.c ++++ b/drivers/staging/panel/panel.c +@@ -273,11 +273,11 @@ static unsigned char lcd_bits[LCD_PORTS][LCD_BITS][BIT_STATES]; + * LCD types + */ + #define LCD_TYPE_NONE 0 +-#define LCD_TYPE_OLD 1 +-#define LCD_TYPE_KS0074 2 +-#define LCD_TYPE_HANTRONIX 3 +-#define LCD_TYPE_NEXCOM 4 +-#define LCD_TYPE_CUSTOM 5 ++#define LCD_TYPE_CUSTOM 1 ++#define LCD_TYPE_OLD 2 ++#define LCD_TYPE_KS0074 3 ++#define LCD_TYPE_HANTRONIX 4 ++#define LCD_TYPE_NEXCOM 5 + + /* + * keypad types +@@ -455,8 +455,7 @@ MODULE_PARM_DESC(keypad_enabled, "Deprecated option, use keypad_type instead"); + static int lcd_type = -1; + module_param(lcd_type, int, 0000); + MODULE_PARM_DESC(lcd_type, +- "LCD type: 0=none, 1=old //, 2=serial ks0074, " +- "3=hantronix //, 4=nexcom //, 5=compiled-in"); ++ "LCD type: 0=none, 1=compiled-in, 2=old, 3=serial ks0074, 4=hantronix, 5=nexcom"); + + static int lcd_proto = -1; + module_param(lcd_proto, int, 0000); +diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c +index 808267456eed..ec7e71c1e86c 100644 +--- a/drivers/target/target_core_pscsi.c ++++ b/drivers/target/target_core_pscsi.c +@@ -567,6 +567,7 @@ static struct se_device *pscsi_create_virtdevice( + " pdv_host_id: %d\n", pdv->pdv_host_id); + return ERR_PTR(-EINVAL); + } ++ pdv->pdv_lld_host = sh; + } + } else { + if (phv->phv_mode == PHV_VIRTUAL_HOST_ID) { +@@ -653,6 +654,8 @@ static void pscsi_free_device(void *p) + if ((phv->phv_mode == PHV_LLD_SCSI_HOST_NO) && + (phv->phv_lld_host != NULL)) + scsi_host_put(phv->phv_lld_host); ++ else if (pdv->pdv_lld_host) ++ scsi_host_put(pdv->pdv_lld_host); + + if ((sd->type == TYPE_DISK) || (sd->type == TYPE_ROM)) + scsi_device_put(sd); +diff --git a/drivers/target/target_core_pscsi.h b/drivers/target/target_core_pscsi.h +index 43f1c419e8e5..6c23c9443dd4 100644 +--- a/drivers/target/target_core_pscsi.h ++++ b/drivers/target/target_core_pscsi.h +@@ -45,6 +45,7 @@ struct pscsi_dev_virt { + int pdv_lun_id; + struct block_device *pdv_bd; + struct scsi_device *pdv_sd; ++ struct Scsi_Host *pdv_lld_host; + struct se_hba *pdv_se_hba; + } ____cacheline_aligned; + +diff --git a/drivers/tty/hvc/hvc_xen.c b/drivers/tty/hvc/hvc_xen.c +index 944eaeb8e0cf..160b1f38c5df 100644 +--- a/drivers/tty/hvc/hvc_xen.c ++++ b/drivers/tty/hvc/hvc_xen.c +@@ -290,7 +290,7 @@ static int xen_initial_domain_console_init(void) + return -ENOMEM; + } + +- info->irq = bind_virq_to_irq(VIRQ_CONSOLE, 0); ++ info->irq = bind_virq_to_irq(VIRQ_CONSOLE, 0, false); + info->vtermno = HVC_COOKIE; + + spin_lock(&xencons_lock); +@@ -300,11 +300,27 @@ static int xen_initial_domain_console_init(void) + return 0; + } + ++static void xen_console_update_evtchn(struct xencons_info *info) ++{ ++ if (xen_hvm_domain()) { ++ uint64_t v; ++ int err; ++ ++ err = hvm_get_parameter(HVM_PARAM_CONSOLE_EVTCHN, &v); ++ if (!err && v) ++ info->evtchn = v; ++ } else ++ info->evtchn = xen_start_info->console.domU.evtchn; ++} ++ + void xen_console_resume(void) + { + struct xencons_info *info = vtermno_to_xencons(HVC_COOKIE); +- if (info != NULL && info->irq) ++ if (info != NULL && info->irq) { ++ if (!xen_initial_domain()) ++ xen_console_update_evtchn(info); + rebind_evtchn_irq(info->evtchn, info->irq); ++ } + } + + static void xencons_disconnect_backend(struct xencons_info *info) +diff --git a/drivers/tty/serial/of_serial.c b/drivers/tty/serial/of_serial.c +index 6563cad09293..746e771c2789 100644 +--- a/drivers/tty/serial/of_serial.c ++++ b/drivers/tty/serial/of_serial.c +@@ -192,7 +192,6 @@ static struct of_device_id __devinitdata of_platform_serial_table[] = { + { .compatible = "ibm,qpace-nwp-serial", + .data = (void *)PORT_NWPSERIAL, }, + #endif +- { .type = "serial", .data = (void *)PORT_UNKNOWN, }, + { /* end of list */ }, + }; + +diff --git a/drivers/tty/serial/uartlite.c b/drivers/tty/serial/uartlite.c +index 6cd414341d5e..d9706e734b76 100644 +--- a/drivers/tty/serial/uartlite.c ++++ b/drivers/tty/serial/uartlite.c +@@ -573,7 +573,8 @@ MODULE_DEVICE_TABLE(of, ulite_of_match); + + static int __devinit ulite_probe(struct platform_device *pdev) + { +- struct resource *res, *res2; ++ struct resource *res; ++ int irq; + int id = pdev->id; + #ifdef CONFIG_OF + const __be32 *prop; +@@ -587,11 +588,11 @@ static int __devinit ulite_probe(struct platform_device *pdev) + if (!res) + return -ENODEV; + +- res2 = platform_get_resource(pdev, IORESOURCE_IRQ, 0); +- if (!res2) +- return -ENODEV; ++ irq = platform_get_irq(pdev, 0); ++ if (irq <= 0) ++ return -ENXIO; + +- return ulite_assign(&pdev->dev, id, res->start, res2->start); ++ return ulite_assign(&pdev->dev, id, res->start, irq); + } + + static int __devexit ulite_remove(struct platform_device *pdev) +diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c +index b627363352e5..778c39a85962 100644 +--- a/drivers/tty/serial/xilinx_uartps.c ++++ b/drivers/tty/serial/xilinx_uartps.c +@@ -941,9 +941,9 @@ static struct uart_driver xuartps_uart_driver = { + **/ + static int __devinit xuartps_probe(struct platform_device *pdev) + { +- int rc; ++ int rc, irq; + struct uart_port *port; +- struct resource *res, *res2; ++ struct resource *res; + int clk = 0; + + #ifdef CONFIG_OF +@@ -964,9 +964,9 @@ static int __devinit xuartps_probe(struct platform_device *pdev) + if (!res) + return -ENODEV; + +- res2 = platform_get_resource(pdev, IORESOURCE_IRQ, 0); +- if (!res2) +- return -ENODEV; ++ irq = platform_get_irq(pdev, 0); ++ if (irq <= 0) ++ return -ENXIO; + + /* Initialize the port structure */ + port = xuartps_get_port(); +@@ -980,7 +980,7 @@ static int __devinit xuartps_probe(struct platform_device *pdev) + * and triggers invocation of the config_port() entry point. + */ + port->mapbase = res->start; +- port->irq = res2->start; ++ port->irq = irq; + port->dev = &pdev->dev; + port->uartclk = clk; + dev_set_drvdata(&pdev->dev, port); +diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c +index e5fa34e5423f..c65c93959f89 100644 +--- a/drivers/usb/class/cdc-wdm.c ++++ b/drivers/usb/class/cdc-wdm.c +@@ -268,7 +268,7 @@ static void wdm_int_callback(struct urb *urb) + case USB_CDC_NOTIFY_RESPONSE_AVAILABLE: + dev_dbg(&desc->intf->dev, + "NOTIFY_RESPONSE_AVAILABLE received: index %d len %d", +- dr->wIndex, dr->wLength); ++ le16_to_cpu(dr->wIndex), le16_to_cpu(dr->wLength)); + break; + + case USB_CDC_NOTIFY_NETWORK_CONNECTION: +@@ -281,7 +281,9 @@ static void wdm_int_callback(struct urb *urb) + clear_bit(WDM_POLL_RUNNING, &desc->flags); + dev_err(&desc->intf->dev, + "unknown notification %d received: index %d len %d\n", +- dr->bNotificationType, dr->wIndex, dr->wLength); ++ dr->bNotificationType, ++ le16_to_cpu(dr->wIndex), ++ le16_to_cpu(dr->wLength)); + goto exit; + } + +@@ -425,7 +427,7 @@ static ssize_t wdm_write + USB_RECIP_INTERFACE); + req->bRequest = USB_CDC_SEND_ENCAPSULATED_COMMAND; + req->wValue = 0; +- req->wIndex = desc->inum; ++ req->wIndex = desc->inum; /* already converted */ + req->wLength = cpu_to_le16(count); + set_bit(WDM_IN_USE, &desc->flags); + desc->outbuf = buf; +@@ -438,7 +440,7 @@ static ssize_t wdm_write + dev_err(&desc->intf->dev, "Tx URB error: %d\n", rv); + } else { + dev_dbg(&desc->intf->dev, "Tx URB has been submitted index=%d", +- req->wIndex); ++ le16_to_cpu(req->wIndex)); + } + out: + usb_autopm_put_interface(desc->intf); +@@ -782,7 +784,7 @@ static int wdm_create(struct usb_interface *intf, struct usb_endpoint_descriptor + desc->irq->bRequestType = (USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE); + desc->irq->bRequest = USB_CDC_GET_ENCAPSULATED_RESPONSE; + desc->irq->wValue = 0; +- desc->irq->wIndex = desc->inum; ++ desc->irq->wIndex = desc->inum; /* already converted */ + desc->irq->wLength = cpu_to_le16(desc->wMaxCommand); + + usb_fill_control_urb( +diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c +index e47a4e12b297..5e93425424f6 100644 +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -2129,8 +2129,13 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td, + break; + case COMP_DEV_ERR: + case COMP_STALL: ++ frame->status = -EPROTO; ++ skip_td = true; ++ break; + case COMP_TX_ERR: + frame->status = -EPROTO; ++ if (event_trb != td->last_trb) ++ return 0; + skip_td = true; + break; + case COMP_STOP: +@@ -2738,7 +2743,7 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd) + xhci_halt(xhci); + hw_died: + spin_unlock(&xhci->lock); +- return -ESHUTDOWN; ++ return IRQ_HANDLED; + } + + /* +diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h +index 80b3d8559b09..855f084a9a32 100644 +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -1233,7 +1233,7 @@ union xhci_trb { + * since the command ring is 64-byte aligned. + * It must also be greater than 16. + */ +-#define TRBS_PER_SEGMENT 64 ++#define TRBS_PER_SEGMENT 256 + /* Allow two commands + a link TRB, along with any reserved command TRBs */ + #define MAX_RSVD_CMD_TRBS (TRBS_PER_SEGMENT - 3) + #define SEGMENT_SIZE (TRBS_PER_SEGMENT*16) +diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c +index a2b4008dc069..d3481c497be9 100644 +--- a/drivers/usb/musb/musb_core.c ++++ b/drivers/usb/musb/musb_core.c +@@ -1544,16 +1544,30 @@ irqreturn_t musb_interrupt(struct musb *musb) + (devctl & MUSB_DEVCTL_HM) ? "host" : "peripheral", + musb->int_usb, musb->int_tx, musb->int_rx); + +- /* the core can interrupt us for multiple reasons; docs have +- * a generic interrupt flowchart to follow ++ /** ++ * According to Mentor Graphics' documentation, flowchart on page 98, ++ * IRQ should be handled as follows: ++ * ++ * . Resume IRQ ++ * . Session Request IRQ ++ * . VBUS Error IRQ ++ * . Suspend IRQ ++ * . Connect IRQ ++ * . Disconnect IRQ ++ * . Reset/Babble IRQ ++ * . SOF IRQ (we're not using this one) ++ * . Endpoint 0 IRQ ++ * . TX Endpoints ++ * . RX Endpoints ++ * ++ * We will be following that flowchart in order to avoid any problems ++ * that might arise with internal Finite State Machine. + */ ++ + if (musb->int_usb) + retval |= musb_stage0_irq(musb, musb->int_usb, + devctl, power); + +- /* "stage 1" is handling endpoint irqs */ +- +- /* handle endpoint 0 first */ + if (musb->int_tx & 1) { + if (devctl & MUSB_DEVCTL_HM) + retval |= musb_h_ep0_irq(musb); +@@ -1561,43 +1575,37 @@ irqreturn_t musb_interrupt(struct musb *musb) + retval |= musb_g_ep0_irq(musb); + } + +- /* RX on endpoints 1-15 */ +- reg = musb->int_rx >> 1; ++ reg = musb->int_tx >> 1; + ep_num = 1; + while (reg) { + if (reg & 1) { +- /* musb_ep_select(musb->mregs, ep_num); */ +- /* REVISIT just retval = ep->rx_irq(...) */ + retval = IRQ_HANDLED; + if (devctl & MUSB_DEVCTL_HM) { + if (is_host_capable()) +- musb_host_rx(musb, ep_num); ++ musb_host_tx(musb, ep_num); + } else { + if (is_peripheral_capable()) +- musb_g_rx(musb, ep_num); ++ musb_g_tx(musb, ep_num); + } + } +- + reg >>= 1; + ep_num++; + } + +- /* TX on endpoints 1-15 */ +- reg = musb->int_tx >> 1; ++ reg = musb->int_rx >> 1; + ep_num = 1; + while (reg) { + if (reg & 1) { +- /* musb_ep_select(musb->mregs, ep_num); */ +- /* REVISIT just retval |= ep->tx_irq(...) */ + retval = IRQ_HANDLED; + if (devctl & MUSB_DEVCTL_HM) { + if (is_host_capable()) +- musb_host_tx(musb, ep_num); ++ musb_host_rx(musb, ep_num); + } else { + if (is_peripheral_capable()) +- musb_g_tx(musb, ep_num); ++ musb_g_rx(musb, ep_num); + } + } ++ + reg >>= 1; + ep_num++; + } +diff --git a/drivers/usb/otg/otg_fsm.c b/drivers/usb/otg/otg_fsm.c +index ade131a8ae5e..e87edda1fe22 100644 +--- a/drivers/usb/otg/otg_fsm.c ++++ b/drivers/usb/otg/otg_fsm.c +@@ -138,9 +138,9 @@ int otg_set_state(struct otg_fsm *fsm, enum usb_otg_state new_state) + break; + case OTG_STATE_B_PERIPHERAL: + otg_chrg_vbus(fsm, 0); +- otg_loc_conn(fsm, 1); + otg_loc_sof(fsm, 0); + otg_set_protocol(fsm, PROTO_GADGET); ++ otg_loc_conn(fsm, 1); + break; + case OTG_STATE_B_WAIT_ACON: + otg_chrg_vbus(fsm, 0); +@@ -200,10 +200,10 @@ int otg_set_state(struct otg_fsm *fsm, enum usb_otg_state new_state) + + break; + case OTG_STATE_A_PERIPHERAL: +- otg_loc_conn(fsm, 1); + otg_loc_sof(fsm, 0); + otg_set_protocol(fsm, PROTO_GADGET); + otg_drv_vbus(fsm, 1); ++ otg_loc_conn(fsm, 1); + break; + case OTG_STATE_A_WAIT_VFALL: + otg_drv_vbus(fsm, 0); +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index 5c289fc2bc5a..29bf38309252 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -133,6 +133,8 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */ + { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */ + { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */ ++ { USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */ ++ { USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */ + { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */ + { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */ + { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */ +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index 06abee68cb4f..1e4899c2d5f1 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -723,6 +723,7 @@ static struct usb_device_id id_table_combined [] = { + { USB_DEVICE(XSENS_VID, XSENS_AWINDA_DONGLE_PID) }, + { USB_DEVICE(XSENS_VID, XSENS_AWINDA_STATION_PID) }, + { USB_DEVICE(XSENS_VID, XSENS_CONVERTER_PID) }, ++ { USB_DEVICE(XSENS_VID, XSENS_MTDEVBOARD_PID) }, + { USB_DEVICE(XSENS_VID, XSENS_MTW_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_OMNI1509) }, + { USB_DEVICE(MOBILITY_VID, MOBILITY_USB_SERIAL_PID) }, +diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h +index 105b9826d8d6..1fee973f100a 100644 +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -155,6 +155,7 @@ + #define XSENS_AWINDA_STATION_PID 0x0101 + #define XSENS_AWINDA_DONGLE_PID 0x0102 + #define XSENS_MTW_PID 0x0200 /* Xsens MTw */ ++#define XSENS_MTDEVBOARD_PID 0x0300 /* Motion Tracker Development Board */ + #define XSENS_CONVERTER_PID 0xD00D /* Xsens USB-serial converter */ + + /* Xsens devices using FTDI VID */ +diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c +index 3e450b4e9c5f..723ed876f318 100644 +--- a/drivers/usb/serial/pl2303.c ++++ b/drivers/usb/serial/pl2303.c +@@ -67,7 +67,6 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(DCU10_VENDOR_ID, DCU10_PRODUCT_ID) }, + { USB_DEVICE(SITECOM_VENDOR_ID, SITECOM_PRODUCT_ID) }, + { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_ID) }, +- { USB_DEVICE(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_ID) }, + { USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_SX1) }, + { USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_X65) }, + { USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_X75) }, +diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h +index 71fd9da1d6e7..e3b7af8adfb7 100644 +--- a/drivers/usb/serial/pl2303.h ++++ b/drivers/usb/serial/pl2303.h +@@ -62,10 +62,6 @@ + #define ALCATEL_VENDOR_ID 0x11f7 + #define ALCATEL_PRODUCT_ID 0x02df + +-/* Samsung I330 phone cradle */ +-#define SAMSUNG_VENDOR_ID 0x04e8 +-#define SAMSUNG_PRODUCT_ID 0x8001 +- + #define SIEMENS_VENDOR_ID 0x11f5 + #define SIEMENS_PRODUCT_ID_SX1 0x0001 + #define SIEMENS_PRODUCT_ID_X65 0x0003 +diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c +index b3afd19341f1..c5cf350ea8ce 100644 +--- a/drivers/usb/serial/visor.c ++++ b/drivers/usb/serial/visor.c +@@ -101,7 +101,7 @@ static struct usb_device_id id_table [] = { + .driver_info = (kernel_ulong_t)&palm_os_4_probe }, + { USB_DEVICE(ACER_VENDOR_ID, ACER_S10_ID), + .driver_info = (kernel_ulong_t)&palm_os_4_probe }, +- { USB_DEVICE(SAMSUNG_VENDOR_ID, SAMSUNG_SCH_I330_ID), ++ { USB_DEVICE_INTERFACE_CLASS(SAMSUNG_VENDOR_ID, SAMSUNG_SCH_I330_ID, 0xff), + .driver_info = (kernel_ulong_t)&palm_os_4_probe }, + { USB_DEVICE(SAMSUNG_VENDOR_ID, SAMSUNG_SPH_I500_ID), + .driver_info = (kernel_ulong_t)&palm_os_4_probe }, +diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h +index 25174beb8d8d..d0ecaf9ff415 100644 +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -752,6 +752,13 @@ UNUSUAL_DEV( 0x059f, 0x0643, 0x0000, 0x0000, + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_GO_SLOW ), + ++/* Reported by Christian Schaller <cschalle@redhat.com> */ ++UNUSUAL_DEV( 0x059f, 0x0651, 0x0000, 0x0000, ++ "LaCie", ++ "External HDD", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_NO_WP_DETECT ), ++ + /* Submitted by Joel Bourquard <numlock@freesurf.ch> + * Some versions of this device need the SubClass and Protocol overrides + * while others don't. +diff --git a/drivers/xen/events.c b/drivers/xen/events.c +index 9161f06564eb..d6e2deee7bf0 100644 +--- a/drivers/xen/events.c ++++ b/drivers/xen/events.c +@@ -563,8 +563,8 @@ static unsigned int __startup_pirq(unsigned int irq) + pirq_query_unmask(irq); + + evtchn_to_irq[evtchn] = irq; +- bind_evtchn_to_cpu(evtchn, 0); + info->evtchn = evtchn; ++ bind_evtchn_to_cpu(evtchn, 0); + + out: + unmask_evtchn(evtchn); +@@ -906,7 +906,7 @@ static int find_virq(unsigned int virq, unsigned int cpu) + return rc; + } + +-int bind_virq_to_irq(unsigned int virq, unsigned int cpu) ++int bind_virq_to_irq(unsigned int virq, unsigned int cpu, bool percpu) + { + struct evtchn_bind_virq bind_virq; + int evtchn, irq, ret; +@@ -920,8 +920,12 @@ int bind_virq_to_irq(unsigned int virq, unsigned int cpu) + if (irq == -1) + goto out; + +- irq_set_chip_and_handler_name(irq, &xen_percpu_chip, +- handle_percpu_irq, "virq"); ++ if (percpu) ++ irq_set_chip_and_handler_name(irq, &xen_percpu_chip, ++ handle_percpu_irq, "virq"); ++ else ++ irq_set_chip_and_handler_name(irq, &xen_dynamic_chip, ++ handle_edge_irq, "virq"); + + bind_virq.virq = virq; + bind_virq.vcpu = cpu; +@@ -1042,7 +1046,7 @@ int bind_virq_to_irqhandler(unsigned int virq, unsigned int cpu, + { + int irq, retval; + +- irq = bind_virq_to_irq(virq, cpu); ++ irq = bind_virq_to_irq(virq, cpu, irqflags & IRQF_PERCPU); + if (irq < 0) + return irq; + retval = request_irq(irq, handler, irqflags, devname, dev_id); +diff --git a/firmware/ihex2fw.c b/firmware/ihex2fw.c +index cf38e159131a..08d90e25abf0 100644 +--- a/firmware/ihex2fw.c ++++ b/firmware/ihex2fw.c +@@ -86,6 +86,7 @@ int main(int argc, char **argv) + case 'j': + include_jump = 1; + break; ++ default: + return usage(); + } + } +diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c +index 6dacccef7790..a181b58cedd5 100644 +--- a/fs/binfmt_elf.c ++++ b/fs/binfmt_elf.c +@@ -742,6 +742,7 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs) + i < loc->elf_ex.e_phnum; i++, elf_ppnt++) { + int elf_prot = 0, elf_flags; + unsigned long k, vaddr; ++ unsigned long total_size = 0; + + if (elf_ppnt->p_type != PT_LOAD) + continue; +@@ -805,10 +806,16 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs) + #else + load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr); + #endif ++ total_size = total_mapping_size(elf_phdata, ++ loc->elf_ex.e_phnum); ++ if (!total_size) { ++ error = -EINVAL; ++ goto out_free_dentry; ++ } + } + + error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt, +- elf_prot, elf_flags, 0); ++ elf_prot, elf_flags, total_size); + if (BAD_ADDR(error)) { + send_sig(SIGKILL, current, 0); + retval = IS_ERR((void *)error) ? +diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c +index cf6e7f4a4f4c..f4576dc0cf29 100644 +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -5939,12 +5939,11 @@ static int __btrfs_free_reserved_extent(struct btrfs_root *root, + return -ENOSPC; + } + +- if (btrfs_test_opt(root, DISCARD)) +- ret = btrfs_discard_extent(root, start, len, NULL); +- + if (pin) + pin_down_extent(root, cache, start, len, 1); + else { ++ if (btrfs_test_opt(root, DISCARD)) ++ ret = btrfs_discard_extent(root, start, len, NULL); + btrfs_add_free_space(cache, start, len); + btrfs_update_reserved_bytes(cache, len, RESERVE_FREE); + } +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index 3a65f4343416..d46c48187636 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -2374,6 +2374,11 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd, + if (off + len == src->i_size) + len = ALIGN(src->i_size, bs) - off; + ++ if (len == 0) { ++ ret = 0; ++ goto out_unlock; ++ } ++ + /* verify the end result is block aligned */ + if (!IS_ALIGNED(off, bs) || !IS_ALIGNED(off + len, bs) || + !IS_ALIGNED(destoff, bs)) +diff --git a/fs/btrfs/xattr.c b/fs/btrfs/xattr.c +index e7a5659087e6..0ee73d128162 100644 +--- a/fs/btrfs/xattr.c ++++ b/fs/btrfs/xattr.c +@@ -310,21 +310,40 @@ const struct xattr_handler *btrfs_xattr_handlers[] = { + /* + * Check if the attribute is in a supported namespace. + * +- * This applied after the check for the synthetic attributes in the system ++ * This is applied after the check for the synthetic attributes in the system + * namespace. + */ +-static bool btrfs_is_valid_xattr(const char *name) ++static int btrfs_is_valid_xattr(const char *name) + { +- return !strncmp(name, XATTR_SECURITY_PREFIX, +- XATTR_SECURITY_PREFIX_LEN) || +- !strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN) || +- !strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN) || +- !strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN); ++ int len = strlen(name); ++ int prefixlen = 0; ++ ++ if (!strncmp(name, XATTR_SECURITY_PREFIX, ++ XATTR_SECURITY_PREFIX_LEN)) ++ prefixlen = XATTR_SECURITY_PREFIX_LEN; ++ else if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN)) ++ prefixlen = XATTR_SYSTEM_PREFIX_LEN; ++ else if (!strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN)) ++ prefixlen = XATTR_TRUSTED_PREFIX_LEN; ++ else if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN)) ++ prefixlen = XATTR_USER_PREFIX_LEN; ++ else ++ return -EOPNOTSUPP; ++ ++ /* ++ * The name cannot consist of just prefix ++ */ ++ if (len <= prefixlen) ++ return -EINVAL; ++ ++ return 0; + } + + ssize_t btrfs_getxattr(struct dentry *dentry, const char *name, + void *buffer, size_t size) + { ++ int ret; ++ + /* + * If this is a request for a synthetic attribute in the system.* + * namespace use the generic infrastructure to resolve a handler +@@ -333,8 +352,9 @@ ssize_t btrfs_getxattr(struct dentry *dentry, const char *name, + if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN)) + return generic_getxattr(dentry, name, buffer, size); + +- if (!btrfs_is_valid_xattr(name)) +- return -EOPNOTSUPP; ++ ret = btrfs_is_valid_xattr(name); ++ if (ret) ++ return ret; + return __btrfs_getxattr(dentry->d_inode, name, buffer, size); + } + +@@ -342,6 +362,7 @@ int btrfs_setxattr(struct dentry *dentry, const char *name, const void *value, + size_t size, int flags) + { + struct btrfs_root *root = BTRFS_I(dentry->d_inode)->root; ++ int ret; + + /* + * The permission on security.* and system.* is not checked +@@ -358,8 +379,9 @@ int btrfs_setxattr(struct dentry *dentry, const char *name, const void *value, + if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN)) + return generic_setxattr(dentry, name, value, size, flags); + +- if (!btrfs_is_valid_xattr(name)) +- return -EOPNOTSUPP; ++ ret = btrfs_is_valid_xattr(name); ++ if (ret) ++ return ret; + + if (size == 0) + value = ""; /* empty EA, do not remove */ +@@ -371,6 +393,7 @@ int btrfs_setxattr(struct dentry *dentry, const char *name, const void *value, + int btrfs_removexattr(struct dentry *dentry, const char *name) + { + struct btrfs_root *root = BTRFS_I(dentry->d_inode)->root; ++ int ret; + + /* + * The permission on security.* and system.* is not checked +@@ -387,8 +410,9 @@ int btrfs_removexattr(struct dentry *dentry, const char *name) + if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN)) + return generic_removexattr(dentry, name); + +- if (!btrfs_is_valid_xattr(name)) +- return -EOPNOTSUPP; ++ ret = btrfs_is_valid_xattr(name); ++ if (ret) ++ return ret; + + return __btrfs_setxattr(NULL, dentry->d_inode, name, NULL, 0, + XATTR_REPLACE); +diff --git a/fs/dcache.c b/fs/dcache.c +index 8038a780696f..d071ea768057 100644 +--- a/fs/dcache.c ++++ b/fs/dcache.c +@@ -1204,13 +1204,13 @@ ascend: + /* might go back up the wrong parent if we have had a rename */ + if (!locked && read_seqretry(&rename_lock, seq)) + goto rename_retry; +- next = child->d_child.next; +- while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) { ++ /* go into the first sibling still alive */ ++ do { ++ next = child->d_child.next; + if (next == &this_parent->d_subdirs) + goto ascend; + child = list_entry(next, struct dentry, d_child); +- next = next->next; +- } ++ } while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)); + rcu_read_unlock(); + goto resume; + } +diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c +index 4296a6f800a0..bbe09a975003 100644 +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -320,7 +320,7 @@ static int ext4_valid_extent(struct inode *inode, struct ext4_extent *ext) + ext4_lblk_t lblock = le32_to_cpu(ext->ee_block); + ext4_lblk_t last = lblock + len - 1; + +- if (lblock > last) ++ if (len == 0 || lblock > last) + return 0; + return ext4_data_block_valid(EXT4_SB(inode->i_sb), block, len); + } +@@ -4365,13 +4365,6 @@ long ext4_fallocate(struct file *file, int mode, loff_t offset, loff_t len) + struct ext4_map_blocks map; + unsigned int credits, blkbits = inode->i_blkbits; + +- /* +- * currently supporting (pre)allocate mode for extent-based +- * files _only_ +- */ +- if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))) +- return -EOPNOTSUPP; +- + /* Return error if mode is not supported */ + if (mode & ~(FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE)) + return -EOPNOTSUPP; +@@ -4392,6 +4385,15 @@ long ext4_fallocate(struct file *file, int mode, loff_t offset, loff_t len) + */ + credits = ext4_chunk_trans_blocks(inode, max_blocks); + mutex_lock(&inode->i_mutex); ++ ++ /* ++ * We only support preallocation for extent-based files only ++ */ ++ if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))) { ++ mutex_unlock(&inode->i_mutex); ++ return -EOPNOTSUPP; ++ } ++ + ret = inode_newsize_ok(inode, (len + offset)); + if (ret) { + mutex_unlock(&inode->i_mutex); +diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c +index dc5852301da7..e1e1d467c6f9 100644 +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -1469,7 +1469,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry, + struct inode *inode) + { + struct inode *dir = dentry->d_parent->d_inode; +- struct buffer_head *bh; ++ struct buffer_head *bh = NULL; + struct ext4_dir_entry_2 *de; + struct super_block *sb; + int retval; +@@ -1484,7 +1484,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry, + if (is_dx(dir)) { + retval = ext4_dx_add_entry(handle, dentry, inode); + if (!retval || (retval != ERR_BAD_DX_DIR)) +- return retval; ++ goto out; + ext4_clear_inode_flag(dir, EXT4_INODE_INDEX); + dx_fallback++; + ext4_mark_inode_dirty(handle, dir); +@@ -1495,14 +1495,15 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry, + if(!bh) + return retval; + retval = add_dirent_to_buf(handle, dentry, inode, NULL, bh); +- if (retval != -ENOSPC) { +- brelse(bh); +- return retval; +- } ++ if (retval != -ENOSPC) ++ goto out; + + if (blocks == 1 && !dx_fallback && +- EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX)) +- return make_indexed_dir(handle, dentry, inode, bh); ++ EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX)) { ++ retval = make_indexed_dir(handle, dentry, inode, bh); ++ bh = NULL; /* make_indexed_dir releases bh */ ++ goto out; ++ } + brelse(bh); + } + bh = ext4_append(handle, dir, &block, &retval); +@@ -1512,6 +1513,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry, + de->inode = 0; + de->rec_len = ext4_rec_len_to_disk(blocksize, blocksize); + retval = add_dirent_to_buf(handle, dentry, inode, de, bh); ++out: + brelse(bh); + if (retval == 0) + ext4_set_inode_state(inode, EXT4_STATE_NEWENTRY); +diff --git a/fs/fhandle.c b/fs/fhandle.c +index a48e4a139be1..f7c18e97d852 100644 +--- a/fs/fhandle.c ++++ b/fs/fhandle.c +@@ -198,8 +198,9 @@ static int handle_to_path(int mountdirfd, struct file_handle __user *ufh, + goto out_err; + } + /* copy the full handle */ +- if (copy_from_user(handle, ufh, +- sizeof(struct file_handle) + ++ *handle = f_handle; ++ if (copy_from_user(&handle->f_handle, ++ &ufh->f_handle, + f_handle.handle_bytes)) { + retval = -EFAULT; + goto out_handle; +diff --git a/fs/namei.c b/fs/namei.c +index bdcd70544fce..9c4b9b811d7b 100644 +--- a/fs/namei.c ++++ b/fs/namei.c +@@ -1314,7 +1314,8 @@ static inline int walk_component(struct nameidata *nd, struct path *path, + } + if (should_follow_link(inode, follow)) { + if (nd->flags & LOOKUP_RCU) { +- if (unlikely(unlazy_walk(nd, path->dentry))) { ++ if (unlikely(nd->path.mnt != path->mnt || ++ unlazy_walk(nd, path->dentry))) { + terminate_walk(nd); + return -ECHILD; + } +diff --git a/fs/nfs/callback.c b/fs/nfs/callback.c +index 38a44c679a0a..0184e91eb4fa 100644 +--- a/fs/nfs/callback.c ++++ b/fs/nfs/callback.c +@@ -156,6 +156,7 @@ nfs41_callback_svc(void *vrqstp) + struct rpc_rqst, rq_bc_list); + list_del(&req->rq_bc_list); + spin_unlock_bh(&serv->sv_cb_lock); ++ finish_wait(&serv->sv_cb_waitq, &wq); + dprintk("Invoking bc_svc_process()\n"); + error = bc_svc_process(serv, req, rqstp); + dprintk("bc_svc_process() returned w/ error code= %d\n", +@@ -163,8 +164,9 @@ nfs41_callback_svc(void *vrqstp) + } else { + spin_unlock_bh(&serv->sv_cb_lock); + schedule(); ++ finish_wait(&serv->sv_cb_waitq, &wq); + } +- finish_wait(&serv->sv_cb_waitq, &wq); ++ flush_signals(current); + } + return 0; + } +diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c +index a4b87c69fbbb..6143a1ea63b1 100644 +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -3364,10 +3364,17 @@ static int check_stateid_generation(stateid_t *in, stateid_t *ref, bool has_sess + return nfserr_old_stateid; + } + ++static __be32 nfsd4_check_openowner_confirmed(struct nfs4_ol_stateid *ols) ++{ ++ if (ols->st_stateowner->so_is_open_owner && ++ !(openowner(ols->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED)) ++ return nfserr_bad_stateid; ++ return nfs_ok; ++} ++ + __be32 nfs4_validate_stateid(struct nfs4_client *cl, stateid_t *stateid) + { + struct nfs4_stid *s; +- struct nfs4_ol_stateid *ols; + __be32 status; + + if (STALE_STATEID(stateid)) +@@ -3381,11 +3388,7 @@ __be32 nfs4_validate_stateid(struct nfs4_client *cl, stateid_t *stateid) + return status; + if (!(s->sc_type & (NFS4_OPEN_STID | NFS4_LOCK_STID))) + return nfs_ok; +- ols = openlockstateid(s); +- if (ols->st_stateowner->so_is_open_owner +- && !(openowner(ols->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED)) +- return nfserr_bad_stateid; +- return nfs_ok; ++ return nfsd4_check_openowner_confirmed(openlockstateid(s)); + } + + static __be32 nfsd4_lookup_stateid(stateid_t *stateid, unsigned char typemask, struct nfs4_stid **s) +@@ -3452,8 +3455,8 @@ nfs4_preprocess_stateid_op(struct nfsd4_compound_state *cstate, + status = nfs4_check_fh(current_fh, stp); + if (status) + goto out; +- if (stp->st_stateowner->so_is_open_owner +- && !(openowner(stp->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED)) ++ status = nfsd4_check_openowner_confirmed(stp); ++ if (status) + goto out; + status = nfs4_check_openmode(stp, flags); + if (status) +diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c +index 4db777d3dc05..c8bc7ea199f5 100644 +--- a/fs/nfsd/nfsctl.c ++++ b/fs/nfsd/nfsctl.c +@@ -1163,15 +1163,15 @@ static int __init init_nfsd(void) + int retval; + printk(KERN_INFO "Installing knfsd (copyright (C) 1996 okir@monad.swb.de).\n"); + +- retval = register_cld_notifier(); +- if (retval) +- return retval; + retval = register_pernet_subsys(&nfsd_net_ops); + if (retval < 0) +- goto out_unregister_notifier; +- retval = nfsd4_init_slabs(); ++ return retval; ++ retval = register_cld_notifier(); + if (retval) + goto out_unregister_pernet; ++ retval = nfsd4_init_slabs(); ++ if (retval) ++ goto out_unregister_notifier; + nfs4_state_init(); + retval = nfsd_fault_inject_init(); /* nfsd fault injection controls */ + if (retval) +@@ -1209,10 +1209,10 @@ out_free_stat: + nfsd_fault_inject_cleanup(); + out_free_slabs: + nfsd4_free_slabs(); +-out_unregister_pernet: +- unregister_pernet_subsys(&nfsd_net_ops); + out_unregister_notifier: + unregister_cld_notifier(); ++out_unregister_pernet: ++ unregister_pernet_subsys(&nfsd_net_ops); + return retval; + } + +@@ -1228,8 +1228,8 @@ static void __exit exit_nfsd(void) + nfsd4_free_slabs(); + nfsd_fault_inject_cleanup(); + unregister_filesystem(&nfsd_fs_type); +- unregister_pernet_subsys(&nfsd_net_ops); + unregister_cld_notifier(); ++ unregister_pernet_subsys(&nfsd_net_ops); + } + + MODULE_AUTHOR("Olaf Kirch <okir@monad.swb.de>"); +diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c +index ecdbae19a766..090d8ce25bd1 100644 +--- a/fs/nilfs2/btree.c ++++ b/fs/nilfs2/btree.c +@@ -388,7 +388,7 @@ static int nilfs_btree_root_broken(const struct nilfs_btree_node *node, + nchildren = nilfs_btree_node_get_nchildren(node); + + if (unlikely(level < NILFS_BTREE_LEVEL_NODE_MIN || +- level > NILFS_BTREE_LEVEL_MAX || ++ level >= NILFS_BTREE_LEVEL_MAX || + nchildren < 0 || + nchildren > NILFS_BTREE_ROOT_NCHILDREN_MAX)) { + pr_crit("NILFS: bad btree root (inode number=%lu): level = %d, flags = 0x%x, nchildren = %d\n", +diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c +index dbc372e2f71d..7ba6ac187edd 100644 +--- a/fs/ocfs2/dlm/dlmmaster.c ++++ b/fs/ocfs2/dlm/dlmmaster.c +@@ -729,6 +729,19 @@ lookup: + if (tmpres) { + spin_unlock(&dlm->spinlock); + spin_lock(&tmpres->spinlock); ++ ++ /* ++ * Right after dlm spinlock was released, dlm_thread could have ++ * purged the lockres. Check if lockres got unhashed. If so ++ * start over. ++ */ ++ if (hlist_unhashed(&tmpres->hash_node)) { ++ spin_unlock(&tmpres->spinlock); ++ dlm_lockres_put(tmpres); ++ tmpres = NULL; ++ goto lookup; ++ } ++ + /* Wait on the thread that is mastering the resource */ + if (tmpres->owner == DLM_LOCK_RES_OWNER_UNKNOWN) { + __dlm_wait_on_lockres(tmpres); +diff --git a/fs/omfs/inode.c b/fs/omfs/inode.c +index dbc842222589..798dedcd44ef 100644 +--- a/fs/omfs/inode.c ++++ b/fs/omfs/inode.c +@@ -361,7 +361,7 @@ nomem: + } + + enum { +- Opt_uid, Opt_gid, Opt_umask, Opt_dmask, Opt_fmask ++ Opt_uid, Opt_gid, Opt_umask, Opt_dmask, Opt_fmask, Opt_err + }; + + static const match_table_t tokens = { +@@ -370,6 +370,7 @@ static const match_table_t tokens = { + {Opt_umask, "umask=%o"}, + {Opt_dmask, "dmask=%o"}, + {Opt_fmask, "fmask=%o"}, ++ {Opt_err, NULL}, + }; + + static int parse_options(char *options, struct omfs_sb_info *sbi) +diff --git a/fs/pipe.c b/fs/pipe.c +index 1667e6fe0416..abfb93525ca6 100644 +--- a/fs/pipe.c ++++ b/fs/pipe.c +@@ -104,25 +104,27 @@ void pipe_wait(struct pipe_inode_info *pipe) + } + + static int +-pipe_iov_copy_from_user(void *to, struct iovec *iov, unsigned long len, +- int atomic) ++pipe_iov_copy_from_user(void *addr, int *offset, struct iovec *iov, ++ size_t *remaining, int atomic) + { + unsigned long copy; + +- while (len > 0) { ++ while (*remaining > 0) { + while (!iov->iov_len) + iov++; +- copy = min_t(unsigned long, len, iov->iov_len); ++ copy = min_t(unsigned long, *remaining, iov->iov_len); + + if (atomic) { +- if (__copy_from_user_inatomic(to, iov->iov_base, copy)) ++ if (__copy_from_user_inatomic(addr + *offset, ++ iov->iov_base, copy)) + return -EFAULT; + } else { +- if (copy_from_user(to, iov->iov_base, copy)) ++ if (copy_from_user(addr + *offset, ++ iov->iov_base, copy)) + return -EFAULT; + } +- to += copy; +- len -= copy; ++ *offset += copy; ++ *remaining -= copy; + iov->iov_base += copy; + iov->iov_len -= copy; + } +@@ -130,25 +132,27 @@ pipe_iov_copy_from_user(void *to, struct iovec *iov, unsigned long len, + } + + static int +-pipe_iov_copy_to_user(struct iovec *iov, const void *from, unsigned long len, +- int atomic) ++pipe_iov_copy_to_user(struct iovec *iov, void *addr, int *offset, ++ size_t *remaining, int atomic) + { + unsigned long copy; + +- while (len > 0) { ++ while (*remaining > 0) { + while (!iov->iov_len) + iov++; +- copy = min_t(unsigned long, len, iov->iov_len); ++ copy = min_t(unsigned long, *remaining, iov->iov_len); + + if (atomic) { +- if (__copy_to_user_inatomic(iov->iov_base, from, copy)) ++ if (__copy_to_user_inatomic(iov->iov_base, ++ addr + *offset, copy)) + return -EFAULT; + } else { +- if (copy_to_user(iov->iov_base, from, copy)) ++ if (copy_to_user(iov->iov_base, ++ addr + *offset, copy)) + return -EFAULT; + } +- from += copy; +- len -= copy; ++ *offset += copy; ++ *remaining -= copy; + iov->iov_base += copy; + iov->iov_len -= copy; + } +@@ -384,7 +388,7 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov, + struct pipe_buffer *buf = pipe->bufs + curbuf; + const struct pipe_buf_operations *ops = buf->ops; + void *addr; +- size_t chars = buf->len; ++ size_t chars = buf->len, remaining; + int error, atomic; + + if (chars > total_len) +@@ -398,9 +402,11 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov, + } + + atomic = !iov_fault_in_pages_write(iov, chars); ++ remaining = chars; + redo: + addr = ops->map(pipe, buf, atomic); +- error = pipe_iov_copy_to_user(iov, addr + buf->offset, chars, atomic); ++ error = pipe_iov_copy_to_user(iov, addr, &buf->offset, ++ &remaining, atomic); + ops->unmap(pipe, buf, addr); + if (unlikely(error)) { + /* +@@ -415,7 +421,6 @@ redo: + break; + } + ret += chars; +- buf->offset += chars; + buf->len -= chars; + + /* Was it a packet buffer? Clean up and exit */ +@@ -522,6 +527,7 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov, + if (ops->can_merge && offset + chars <= PAGE_SIZE) { + int error, atomic = 1; + void *addr; ++ size_t remaining = chars; + + error = ops->confirm(pipe, buf); + if (error) +@@ -530,8 +536,8 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov, + iov_fault_in_pages_read(iov, chars); + redo1: + addr = ops->map(pipe, buf, atomic); +- error = pipe_iov_copy_from_user(offset + addr, iov, +- chars, atomic); ++ error = pipe_iov_copy_from_user(addr, &offset, iov, ++ &remaining, atomic); + ops->unmap(pipe, buf, addr); + ret = error; + do_wakeup = 1; +@@ -566,6 +572,8 @@ redo1: + struct page *page = pipe->tmp_page; + char *src; + int error, atomic = 1; ++ int offset = 0; ++ size_t remaining; + + if (!page) { + page = alloc_page(GFP_HIGHUSER); +@@ -586,14 +594,15 @@ redo1: + chars = total_len; + + iov_fault_in_pages_read(iov, chars); ++ remaining = chars; + redo2: + if (atomic) + src = kmap_atomic(page); + else + src = kmap(page); + +- error = pipe_iov_copy_from_user(src, iov, chars, +- atomic); ++ error = pipe_iov_copy_from_user(src, &offset, iov, ++ &remaining, atomic); + if (atomic) + kunmap_atomic(src); + else +diff --git a/fs/udf/inode.c b/fs/udf/inode.c +index 8053ee75d297..330ec8cfeb63 100644 +--- a/fs/udf/inode.c ++++ b/fs/udf/inode.c +@@ -1392,6 +1392,19 @@ static void udf_fill_inode(struct inode *inode, struct buffer_head *bh) + iinfo->i_lenEAttr; + } + ++ /* ++ * Sanity check length of allocation descriptors and extended attrs to ++ * avoid integer overflows ++ */ ++ if (iinfo->i_lenEAttr > inode->i_sb->s_blocksize || iinfo->i_lenAlloc > inode->i_sb->s_blocksize) { ++ make_bad_inode(inode); ++ return; ++ } ++ /* Now do exact checks */ ++ if (udf_file_entry_alloc_offset(inode) + iinfo->i_lenAlloc > inode->i_sb->s_blocksize) { ++ make_bad_inode(inode); ++ return; ++ } + /* Sanity checks for files in ICB so that we don't get confused later */ + if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) { + /* +diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h +index e8bcc4742e0e..6d52429f80bc 100644 +--- a/include/acpi/actypes.h ++++ b/include/acpi/actypes.h +@@ -198,9 +198,29 @@ typedef int INT32; + typedef s32 acpi_native_int; + + typedef u32 acpi_size; ++ ++#ifdef ACPI_32BIT_PHYSICAL_ADDRESS ++ ++/* ++ * OSPMs can define this to shrink the size of the structures for 32-bit ++ * none PAE environment. ASL compiler may always define this to generate ++ * 32-bit OSPM compliant tables. ++ */ + typedef u32 acpi_io_address; + typedef u32 acpi_physical_address; + ++#else /* ACPI_32BIT_PHYSICAL_ADDRESS */ ++ ++/* ++ * It is reported that, after some calculations, the physical addresses can ++ * wrap over the 32-bit boundary on 32-bit PAE environment. ++ * https://bugzilla.kernel.org/show_bug.cgi?id=87971 ++ */ ++typedef u64 acpi_io_address; ++typedef u64 acpi_physical_address; ++ ++#endif /* ACPI_32BIT_PHYSICAL_ADDRESS */ ++ + #define ACPI_MAX_PTR ACPI_UINT32_MAX + #define ACPI_SIZE_MAX ACPI_UINT32_MAX + +diff --git a/include/acpi/platform/acenv.h b/include/acpi/platform/acenv.h +index 5af3ed52ef98..b9f921012043 100644 +--- a/include/acpi/platform/acenv.h ++++ b/include/acpi/platform/acenv.h +@@ -75,6 +75,7 @@ + #define ACPI_CONSTANT_EVAL_ONLY + #define ACPI_LARGE_NAMESPACE_NODE + #define ACPI_DATA_TABLE_DISASSEMBLY ++#define ACPI_32BIT_PHYSICAL_ADDRESS + #endif + + #ifdef ACPI_EXEC_APP +diff --git a/include/linux/jhash.h b/include/linux/jhash.h +index 47cb09edec1a..348c6f47e4cc 100644 +--- a/include/linux/jhash.h ++++ b/include/linux/jhash.h +@@ -145,11 +145,11 @@ static inline u32 jhash2(const u32 *k, u32 length, u32 initval) + } + + +-/* jhash_3words - hash exactly 3, 2 or 1 word(s) */ +-static inline u32 jhash_3words(u32 a, u32 b, u32 c, u32 initval) ++/* __jhash_nwords - hash exactly 3, 2 or 1 word(s) */ ++static inline u32 __jhash_nwords(u32 a, u32 b, u32 c, u32 initval) + { +- a += JHASH_INITVAL; +- b += JHASH_INITVAL; ++ a += initval; ++ b += initval; + c += initval; + + __jhash_final(a, b, c); +@@ -157,14 +157,19 @@ static inline u32 jhash_3words(u32 a, u32 b, u32 c, u32 initval) + return c; + } + ++static inline u32 jhash_3words(u32 a, u32 b, u32 c, u32 initval) ++{ ++ return __jhash_nwords(a, b, c, initval + JHASH_INITVAL + (3 << 2)); ++} ++ + static inline u32 jhash_2words(u32 a, u32 b, u32 initval) + { +- return jhash_3words(a, b, 0, initval); ++ return __jhash_nwords(a, b, 0, initval + JHASH_INITVAL + (2 << 2)); + } + + static inline u32 jhash_1word(u32 a, u32 initval) + { +- return jhash_3words(a, 0, 0, initval); ++ return __jhash_nwords(a, 0, 0, initval + JHASH_INITVAL + (1 << 2)); + } + + #endif /* _LINUX_JHASH_H */ +diff --git a/include/linux/libata.h b/include/linux/libata.h +index 764cd54dfea7..35e7f71cd8a5 100644 +--- a/include/linux/libata.h ++++ b/include/linux/libata.h +@@ -182,6 +182,7 @@ enum { + ATA_LFLAG_DISABLED = (1 << 6), /* link is disabled */ + ATA_LFLAG_SW_ACTIVITY = (1 << 7), /* keep activity stats */ + ATA_LFLAG_NO_LPM = (1 << 8), /* disable LPM on this link */ ++ ATA_LFLAG_CHANGED = (1 << 10), /* LPM state changed on this link */ + + /* struct ata_port flags */ + ATA_FLAG_SLAVE_POSS = (1 << 0), /* host supports slave dev */ +@@ -285,6 +286,12 @@ enum { + */ + ATA_TMOUT_PMP_SRST_WAIT = 5000, + ++ /* When the LPM policy is set to ATA_LPM_MAX_POWER, there might ++ * be a spurious PHY event, so ignore the first PHY event that ++ * occurs within 10s after the policy change. ++ */ ++ ATA_TMOUT_SPURIOUS_PHY = 10000, ++ + /* ATA bus states */ + BUS_UNKNOWN = 0, + BUS_DMA = 1, +@@ -727,6 +734,8 @@ struct ata_link { + struct ata_eh_context eh_context; + + struct ata_device device[ATA_MAX_DEVICES]; ++ ++ unsigned long last_lpm_change; /* when last LPM change happened */ + }; + #define ATA_LINK_CLEAR_BEGIN offsetof(struct ata_link, active_tag) + #define ATA_LINK_CLEAR_END offsetof(struct ata_link, device[0]) +@@ -1065,6 +1074,7 @@ extern struct ata_device *ata_dev_pair(struct ata_device *adev); + extern int ata_do_set_mode(struct ata_link *link, struct ata_device **r_failed_dev); + extern void ata_scsi_port_error_handler(struct Scsi_Host *host, struct ata_port *ap); + extern void ata_scsi_cmd_error_handler(struct Scsi_Host *host, struct ata_port *ap, struct list_head *eh_q); ++extern bool sata_lpm_ignore_phy_events(struct ata_link *link); + + extern int ata_cable_40wire(struct ata_port *ap); + extern int ata_cable_80wire(struct ata_port *ap); +diff --git a/include/linux/nilfs2_fs.h b/include/linux/nilfs2_fs.h +index 89bd4a4dcfb4..25c6891e6302 100644 +--- a/include/linux/nilfs2_fs.h ++++ b/include/linux/nilfs2_fs.h +@@ -458,7 +458,7 @@ struct nilfs_btree_node { + /* level */ + #define NILFS_BTREE_LEVEL_DATA 0 + #define NILFS_BTREE_LEVEL_NODE_MIN (NILFS_BTREE_LEVEL_DATA + 1) +-#define NILFS_BTREE_LEVEL_MAX 14 ++#define NILFS_BTREE_LEVEL_MAX 14 /* Max level (exclusive) */ + + /** + * struct nilfs_palloc_group_desc - block group descriptor +diff --git a/include/scsi/scsi_devinfo.h b/include/scsi/scsi_devinfo.h +index b4ddd3b18b4c..fc8cdff83a50 100644 +--- a/include/scsi/scsi_devinfo.h ++++ b/include/scsi/scsi_devinfo.h +@@ -30,4 +30,5 @@ + #define BLIST_RETRY_HWERROR 0x400000 /* retry HARDWARE_ERROR */ + #define BLIST_MAX_512 0x800000 /* maximum 512 sector cdb length */ + #define BLIST_ATTACH_PQ3 0x1000000 /* Scan: Attach to PQ3 devices */ ++#define BLIST_MAX_1024 0x40000000 /* maximum 1024 sector cdb length */ + #endif +diff --git a/include/sound/emu10k1.h b/include/sound/emu10k1.h +index 4f865df42f0f..7ee55e3ff4fe 100644 +--- a/include/sound/emu10k1.h ++++ b/include/sound/emu10k1.h +@@ -43,7 +43,8 @@ + + #define EMUPAGESIZE 4096 + #define MAXREQVOICES 8 +-#define MAXPAGES 8192 ++#define MAXPAGES0 4096 /* 32 bit mode */ ++#define MAXPAGES1 8192 /* 31 bit mode */ + #define RESERVED 0 + #define NUM_MIDI 16 + #define NUM_G 64 /* use all channels */ +@@ -52,8 +53,7 @@ + + /* FIXME? - according to the OSS driver the EMU10K1 needs a 29 bit DMA mask */ + #define EMU10K1_DMA_MASK 0x7fffffffUL /* 31bit */ +-#define AUDIGY_DMA_MASK 0x7fffffffUL /* 31bit FIXME - 32 should work? */ +- /* See ALSA bug #1276 - rlrevell */ ++#define AUDIGY_DMA_MASK 0xffffffffUL /* 32bit mode */ + + #define TMEMSIZE 256*1024 + #define TMEMSIZEREG 4 +@@ -470,8 +470,11 @@ + + #define MAPB 0x0d /* Cache map B */ + +-#define MAP_PTE_MASK 0xffffe000 /* The 19 MSBs of the PTE indexed by the PTI */ +-#define MAP_PTI_MASK 0x00001fff /* The 13 bit index to one of the 8192 PTE dwords */ ++#define MAP_PTE_MASK0 0xfffff000 /* The 20 MSBs of the PTE indexed by the PTI */ ++#define MAP_PTI_MASK0 0x00000fff /* The 12 bit index to one of the 4096 PTE dwords */ ++ ++#define MAP_PTE_MASK1 0xffffe000 /* The 19 MSBs of the PTE indexed by the PTI */ ++#define MAP_PTI_MASK1 0x00001fff /* The 13 bit index to one of the 8192 PTE dwords */ + + /* 0x0e, 0x0f: Not used */ + +@@ -1708,6 +1711,7 @@ struct snd_emu10k1 { + unsigned short model; /* subsystem id */ + unsigned int card_type; /* EMU10K1_CARD_* */ + unsigned int ecard_ctrl; /* ecard control bits */ ++ unsigned int address_mode; /* address mode */ + unsigned long dma_mask; /* PCI DMA mask */ + unsigned int delay_pcm_irq; /* in samples */ + int max_cache_pages; /* max memory size / PAGE_SIZE */ +diff --git a/include/xen/events.h b/include/xen/events.h +index 04399b28e821..f9cb6306511f 100644 +--- a/include/xen/events.h ++++ b/include/xen/events.h +@@ -12,7 +12,7 @@ int bind_evtchn_to_irqhandler(unsigned int evtchn, + irq_handler_t handler, + unsigned long irqflags, const char *devname, + void *dev_id); +-int bind_virq_to_irq(unsigned int virq, unsigned int cpu); ++int bind_virq_to_irq(unsigned int virq, unsigned int cpu, bool percpu); + int bind_virq_to_irqhandler(unsigned int virq, unsigned int cpu, + irq_handler_t handler, + unsigned long irqflags, const char *devname, +diff --git a/kernel/ptrace.c b/kernel/ptrace.c +index a1432369be50..d9e71e311027 100644 +--- a/kernel/ptrace.c ++++ b/kernel/ptrace.c +@@ -632,6 +632,8 @@ static int ptrace_setsiginfo(struct task_struct *child, const siginfo_t *info) + static int ptrace_resume(struct task_struct *child, long request, + unsigned long data) + { ++ bool need_siglock; ++ + if (!valid_signal(data)) + return -EIO; + +@@ -659,8 +661,26 @@ static int ptrace_resume(struct task_struct *child, long request, + user_disable_single_step(child); + } + ++ /* ++ * Change ->exit_code and ->state under siglock to avoid the race ++ * with wait_task_stopped() in between; a non-zero ->exit_code will ++ * wrongly look like another report from tracee. ++ * ++ * Note that we need siglock even if ->exit_code == data and/or this ++ * status was not reported yet, the new status must not be cleared by ++ * wait_task_stopped() after resume. ++ * ++ * If data == 0 we do not care if wait_task_stopped() reports the old ++ * status and clears the code too; this can't race with the tracee, it ++ * takes siglock after resume. ++ */ ++ need_siglock = data && !thread_group_empty(current); ++ if (need_siglock) ++ spin_lock_irq(&child->sighand->siglock); + child->exit_code = data; + wake_up_state(child, __TASK_TRACED); ++ if (need_siglock) ++ spin_unlock_irq(&child->sighand->siglock); + + return 0; + } +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 2f8363e0a1ec..15be43522c8b 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -4396,8 +4396,13 @@ recheck: + + if (running) + p->sched_class->set_curr_task(rq); +- if (on_rq) +- enqueue_task(rq, p, 0); ++ if (on_rq) { ++ /* ++ * We enqueue to tail when the priority of a task is ++ * increased (user space view). ++ */ ++ enqueue_task(rq, p, oldprio <= p->prio ? ENQUEUE_HEAD : 0); ++ } + + check_class_changed(rq, p, prev_class, oldprio); + task_rq_unlock(rq, p, &flags); +diff --git a/kernel/trace/ring_buffer_benchmark.c b/kernel/trace/ring_buffer_benchmark.c +index a5457d577b98..6ad2e2d320fe 100644 +--- a/kernel/trace/ring_buffer_benchmark.c ++++ b/kernel/trace/ring_buffer_benchmark.c +@@ -455,7 +455,7 @@ static int __init ring_buffer_benchmark_init(void) + + if (producer_fifo >= 0) { + struct sched_param param = { +- .sched_priority = consumer_fifo ++ .sched_priority = producer_fifo + }; + sched_setscheduler(producer, SCHED_FIFO, ¶m); + } else +diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c +index 289197a2d334..3b04aec58700 100644 +--- a/kernel/trace/trace_events_filter.c ++++ b/kernel/trace/trace_events_filter.c +@@ -1357,19 +1357,25 @@ static int check_preds(struct filter_parse_state *ps) + { + int n_normal_preds = 0, n_logical_preds = 0; + struct postfix_elt *elt; ++ int cnt = 0; + + list_for_each_entry(elt, &ps->postfix, list) { +- if (elt->op == OP_NONE) ++ if (elt->op == OP_NONE) { ++ cnt++; + continue; ++ } + + if (elt->op == OP_AND || elt->op == OP_OR) { + n_logical_preds++; ++ cnt--; + continue; + } ++ cnt--; + n_normal_preds++; ++ WARN_ON_ONCE(cnt < 0); + } + +- if (!n_normal_preds || n_logical_preds >= n_normal_preds) { ++ if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) { + parse_error(ps, FILT_ERR_INVALID_FILTER, 0); + return -EINVAL; + } +diff --git a/mm/memory-failure.c b/mm/memory-failure.c +index 97eec2174769..c957a370bff8 100644 +--- a/mm/memory-failure.c ++++ b/mm/memory-failure.c +@@ -1095,10 +1095,10 @@ int memory_failure(unsigned long pfn, int trapno, int flags) + * The check (unnecessarily) ignores LRU pages being isolated and + * walked by the page reclaim code, however that's not a big loss. + */ +- if (!PageHuge(p) && !PageTransTail(p)) { +- if (!PageLRU(p)) +- shake_page(p, 0); +- if (!PageLRU(p)) { ++ if (!PageHuge(p)) { ++ if (!PageLRU(hpage)) ++ shake_page(hpage, 0); ++ if (!PageLRU(hpage)) { + /* + * shake_page could have turned it free. + */ +diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c +index 5ba0c844d508..3cb93e85d221 100644 +--- a/net/bridge/br_fdb.c ++++ b/net/bridge/br_fdb.c +@@ -440,7 +440,7 @@ void br_fdb_update(struct net_bridge *br, struct net_bridge_port *source, + fdb->updated = jiffies; + } + } else { +- spin_lock(&br->hash_lock); ++ spin_lock_bh(&br->hash_lock); + if (likely(!fdb_find(head, addr))) { + fdb = fdb_create(head, source, addr); + if (fdb) +@@ -449,7 +449,7 @@ void br_fdb_update(struct net_bridge *br, struct net_bridge_port *source, + /* else we lose race and someone else inserts + * it first, don't bother updating + */ +- spin_unlock(&br->hash_lock); ++ spin_unlock_bh(&br->hash_lock); + } + } + +@@ -665,9 +665,11 @@ int br_fdb_add(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg) + } + + if (ndm->ndm_flags & NTF_USE) { ++ local_bh_disable(); + rcu_read_lock(); + br_fdb_update(p->br, p, addr); + rcu_read_unlock(); ++ local_bh_enable(); + } else { + spin_lock_bh(&p->br->hash_lock); + err = fdb_add_entry(p, addr, ndm->ndm_state, nlh->nlmsg_flags); +diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c +index 0b870d75a542..a41051a1bca5 100644 +--- a/net/bridge/br_multicast.c ++++ b/net/bridge/br_multicast.c +@@ -972,7 +972,7 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br, + } + + err = br_ip6_multicast_add_group(br, port, &grec->grec_mca); +- if (!err) ++ if (err) + break; + } + +@@ -991,6 +991,9 @@ static void br_multicast_add_router(struct net_bridge *br, + struct net_bridge_port *p; + struct hlist_node *n, *slot = NULL; + ++ if (!hlist_unhashed(&port->rlist)) ++ return; ++ + hlist_for_each_entry(p, n, &br->router_list, rlist) { + if ((unsigned long) port >= (unsigned long) p) + break; +@@ -1018,12 +1021,8 @@ static void br_multicast_mark_router(struct net_bridge *br, + if (port->multicast_router != 1) + return; + +- if (!hlist_unhashed(&port->rlist)) +- goto timer; +- + br_multicast_add_router(br, port); + +-timer: + mod_timer(&port->multicast_router_timer, + now + br->multicast_querier_interval); + } +diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c +index e54ef82fdad7..5ba424839939 100644 +--- a/net/bridge/br_netfilter.c ++++ b/net/bridge/br_netfilter.c +@@ -818,12 +818,12 @@ static unsigned int br_nf_forward_arp(unsigned int hook, struct sk_buff *skb, + return NF_STOLEN; + } + +-#if IS_ENABLED(CONFIG_NF_CONNTRACK_IPV4) ++#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV4) + static int br_nf_dev_queue_xmit(struct sk_buff *skb) + { + int ret; + +- if (skb->nfct != NULL && skb->protocol == htons(ETH_P_IP) && ++ if (skb->protocol == htons(ETH_P_IP) && + skb->len + nf_bridge_mtu_reduction(skb) > skb->dev->mtu && + !skb_is_gso(skb)) { + if (br_parse_ip_options(skb)) +diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c +index cb9085272dd7..9f471c32d209 100644 +--- a/net/ipv4/ping.c ++++ b/net/ipv4/ping.c +@@ -138,6 +138,7 @@ static void ping_v4_unhash(struct sock *sk) + if (sk_hashed(sk)) { + write_lock_bh(&ping_table.lock); + hlist_nulls_del(&sk->sk_nulls_node); ++ sk_nulls_node_init(&sk->sk_nulls_node); + sock_put(sk); + isk->inet_num = 0; + isk->inet_sport = 0; +diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c +index 7949b5d1663f..5f8c20b67da2 100644 +--- a/net/ipv4/udp.c ++++ b/net/ipv4/udp.c +@@ -1251,10 +1251,8 @@ csum_copy_err: + UDP_INC_STATS_USER(sock_net(sk), UDP_MIB_INERRORS, is_udplite); + unlock_sock_fast(sk, slow); + +- if (noblock) +- return -EAGAIN; +- +- /* starting over for a new packet */ ++ /* starting over for a new packet, but check if we need to yield */ ++ cond_resched(); + msg->msg_flags &= ~MSG_TRUNC; + goto try_again; + } +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 4cfba3d5ad2c..23b33048ea98 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -1661,6 +1661,17 @@ void rt6_redirect(const struct in6_addr *dest, const struct in6_addr *src, + goto out; + } + ++#ifdef CONFIG_IPV6_MULTIPLE_TABLES ++ if (rt == net->ipv6.ip6_blk_hole_entry || ++ rt == net->ipv6.ip6_prohibit_entry) { ++ if (net_ratelimit()) ++ printk(KERN_DEBUG "rt6_redirect: source isn't a valid" \ ++ " nexthop for redirect target " \ ++ "(blackhole or prohibited)\n"); ++ goto out; ++ } ++#endif ++ + /* + * We have finally decided to accept it. + */ +diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c +index ef9052f8c90b..2f99b12b717e 100644 +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -451,10 +451,8 @@ csum_copy_err: + } + unlock_sock_fast(sk, slow); + +- if (noblock) +- return -EAGAIN; +- +- /* starting over for a new packet */ ++ /* starting over for a new packet, but check if we need to yield */ ++ cond_resched(); + msg->msg_flags &= ~MSG_TRUNC; + goto try_again; + } +diff --git a/net/mac80211/wep.c b/net/mac80211/wep.c +index 7aa31bbfaa3b..9464f92b1447 100644 +--- a/net/mac80211/wep.c ++++ b/net/mac80211/wep.c +@@ -97,8 +97,7 @@ static u8 *ieee80211_wep_add_iv(struct ieee80211_local *local, + + hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED); + +- if (WARN_ON(skb_tailroom(skb) < WEP_ICV_LEN || +- skb_headroom(skb) < WEP_IV_LEN)) ++ if (WARN_ON(skb_headroom(skb) < WEP_IV_LEN)) + return NULL; + + hdrlen = ieee80211_hdrlen(hdr->frame_control); +@@ -160,6 +159,9 @@ int ieee80211_wep_encrypt(struct ieee80211_local *local, + size_t len; + u8 rc4key[3 + WLAN_KEY_LEN_WEP104]; + ++ if (WARN_ON(skb_tailroom(skb) < WEP_ICV_LEN)) ++ return -1; ++ + iv = ieee80211_wep_add_iv(local, skb, keylen, keyidx); + if (!iv) + return -1; +diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c +index cbc5bfd8c8e4..f2ed4a996290 100644 +--- a/net/netfilter/ipvs/ip_vs_ctl.c ++++ b/net/netfilter/ipvs/ip_vs_ctl.c +@@ -3689,6 +3689,9 @@ void __net_exit ip_vs_control_net_cleanup_sysctl(struct net *net) + cancel_delayed_work_sync(&ipvs->defense_work); + cancel_work_sync(&ipvs->defense_work.work); + unregister_net_sysctl_table(ipvs->sysctl_hdr); ++ ++ if (!net_eq(net, &init_net)) ++ kfree(ipvs->sysctl_tbl); + } + + #else +diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c +index bde7d69b440d..e89563655030 100644 +--- a/net/rose/af_rose.c ++++ b/net/rose/af_rose.c +@@ -194,7 +194,8 @@ static void rose_kill_by_device(struct net_device *dev) + + if (rose->device == dev) { + rose_disconnect(s, ENETUNREACH, ROSE_OUT_OF_ORDER, 0); +- rose->neighbour->use--; ++ if (rose->neighbour) ++ rose->neighbour->use--; + rose->device = NULL; + } + } +diff --git a/net/socket.c b/net/socket.c +index 025f7f4d2d80..f5ce151e0e3b 100644 +--- a/net/socket.c ++++ b/net/socket.c +@@ -1934,14 +1934,12 @@ static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg, + int err, ctl_len, iov_size, total_len; + + err = -EFAULT; +- if (MSG_CMSG_COMPAT & flags) { +- if (get_compat_msghdr(msg_sys, msg_compat)) +- return -EFAULT; +- } else { ++ if (MSG_CMSG_COMPAT & flags) ++ err = get_compat_msghdr(msg_sys, msg_compat); ++ else + err = copy_msghdr_from_user(msg_sys, msg); +- if (err) +- return err; +- } ++ if (err) ++ return err; + + /* do not move before msg_sys is valid */ + err = -EMSGSIZE; +@@ -2149,14 +2147,12 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg, + struct sockaddr __user *uaddr; + int __user *uaddr_len; + +- if (MSG_CMSG_COMPAT & flags) { +- if (get_compat_msghdr(msg_sys, msg_compat)) +- return -EFAULT; +- } else { ++ if (MSG_CMSG_COMPAT & flags) ++ err = get_compat_msghdr(msg_sys, msg_compat); ++ else + err = copy_msghdr_from_user(msg_sys, msg); +- if (err) +- return err; +- } ++ if (err) ++ return err; + + err = -EMSGSIZE; + if (msg_sys->msg_iovlen > UIO_MAXIOV) +diff --git a/security/selinux/nlmsgtab.c b/security/selinux/nlmsgtab.c +index 0920ea3bf599..5776921d6209 100644 +--- a/security/selinux/nlmsgtab.c ++++ b/security/selinux/nlmsgtab.c +@@ -100,6 +100,12 @@ static struct nlmsg_perm nlmsg_xfrm_perms[] = + { XFRM_MSG_FLUSHPOLICY, NETLINK_XFRM_SOCKET__NLMSG_WRITE }, + { XFRM_MSG_NEWAE, NETLINK_XFRM_SOCKET__NLMSG_WRITE }, + { XFRM_MSG_GETAE, NETLINK_XFRM_SOCKET__NLMSG_READ }, ++ { XFRM_MSG_REPORT, NETLINK_XFRM_SOCKET__NLMSG_READ }, ++ { XFRM_MSG_MIGRATE, NETLINK_XFRM_SOCKET__NLMSG_WRITE }, ++ { XFRM_MSG_NEWSADINFO, NETLINK_XFRM_SOCKET__NLMSG_READ }, ++ { XFRM_MSG_GETSADINFO, NETLINK_XFRM_SOCKET__NLMSG_READ }, ++ { XFRM_MSG_GETSPDINFO, NETLINK_XFRM_SOCKET__NLMSG_READ }, ++ { XFRM_MSG_MAPPING, NETLINK_XFRM_SOCKET__NLMSG_READ }, + }; + + static struct nlmsg_perm nlmsg_audit_perms[] = +diff --git a/sound/pci/emu10k1/emu10k1.c b/sound/pci/emu10k1/emu10k1.c +index 790c65d980c8..aefde0175846 100644 +--- a/sound/pci/emu10k1/emu10k1.c ++++ b/sound/pci/emu10k1/emu10k1.c +@@ -181,8 +181,10 @@ static int __devinit snd_card_emu10k1_probe(struct pci_dev *pci, + } + #endif + +- strcpy(card->driver, emu->card_capabilities->driver); +- strcpy(card->shortname, emu->card_capabilities->name); ++ strlcpy(card->driver, emu->card_capabilities->driver, ++ sizeof(card->driver)); ++ strlcpy(card->shortname, emu->card_capabilities->name, ++ sizeof(card->shortname)); + snprintf(card->longname, sizeof(card->longname), + "%s (rev.%d, serial:0x%x) at 0x%lx, irq %i", + card->shortname, emu->revision, emu->serial, emu->port, emu->irq); +diff --git a/sound/pci/emu10k1/emu10k1_callback.c b/sound/pci/emu10k1/emu10k1_callback.c +index f35284be7b02..829595078fa1 100644 +--- a/sound/pci/emu10k1/emu10k1_callback.c ++++ b/sound/pci/emu10k1/emu10k1_callback.c +@@ -415,7 +415,7 @@ start_voice(struct snd_emux_voice *vp) + snd_emu10k1_ptr_write(hw, Z2, ch, 0); + + /* invalidate maps */ +- temp = (hw->silent_page.addr << 1) | MAP_PTI_MASK; ++ temp = (hw->silent_page.addr << hw->address_mode) | (hw->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0); + snd_emu10k1_ptr_write(hw, MAPA, ch, temp); + snd_emu10k1_ptr_write(hw, MAPB, ch, temp); + #if 0 +@@ -436,7 +436,7 @@ start_voice(struct snd_emux_voice *vp) + snd_emu10k1_ptr_write(hw, CDF, ch, sample); + + /* invalidate maps */ +- temp = ((unsigned int)hw->silent_page.addr << 1) | MAP_PTI_MASK; ++ temp = ((unsigned int)hw->silent_page.addr << hw_address_mode) | (hw->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0); + snd_emu10k1_ptr_write(hw, MAPA, ch, temp); + snd_emu10k1_ptr_write(hw, MAPB, ch, temp); + +diff --git a/sound/pci/emu10k1/emu10k1_main.c b/sound/pci/emu10k1/emu10k1_main.c +index a78fdf466fa7..124ae93d3748 100644 +--- a/sound/pci/emu10k1/emu10k1_main.c ++++ b/sound/pci/emu10k1/emu10k1_main.c +@@ -282,7 +282,7 @@ static int snd_emu10k1_init(struct snd_emu10k1 *emu, int enable_ir, int resume) + snd_emu10k1_ptr_write(emu, TCB, 0, 0); /* taken from original driver */ + snd_emu10k1_ptr_write(emu, TCBS, 0, 4); /* taken from original driver */ + +- silent_page = (emu->silent_page.addr << 1) | MAP_PTI_MASK; ++ silent_page = (emu->silent_page.addr << emu->address_mode) | (emu->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0); + for (ch = 0; ch < NUM_G; ch++) { + snd_emu10k1_ptr_write(emu, MAPA, ch, silent_page); + snd_emu10k1_ptr_write(emu, MAPB, ch, silent_page); +@@ -348,6 +348,11 @@ static int snd_emu10k1_init(struct snd_emu10k1 *emu, int enable_ir, int resume) + outl(reg | A_IOCFG_GPOUT0, emu->port + A_IOCFG); + } + ++ if (emu->address_mode == 0) { ++ /* use 16M in 4G */ ++ outl(inl(emu->port + HCFG) | HCFG_EXPANDED_MEM, emu->port + HCFG); ++ } ++ + return 0; + } + +@@ -1390,7 +1395,7 @@ static struct snd_emu_chip_details emu_chip_details[] = { + * + */ + {.vendor = 0x1102, .device = 0x0008, .subsystem = 0x20011102, +- .driver = "Audigy2", .name = "SB Audigy 2 ZS Notebook [SB0530]", ++ .driver = "Audigy2", .name = "Audigy 2 ZS Notebook [SB0530]", + .id = "Audigy2", + .emu10k2_chip = 1, + .ca0108_chip = 1, +@@ -1540,7 +1545,7 @@ static struct snd_emu_chip_details emu_chip_details[] = { + .adc_1361t = 1, /* 24 bit capture instead of 16bit */ + .ac97_chip = 1} , + {.vendor = 0x1102, .device = 0x0004, .subsystem = 0x10051102, +- .driver = "Audigy2", .name = "SB Audigy 2 Platinum EX [SB0280]", ++ .driver = "Audigy2", .name = "Audigy 2 Platinum EX [SB0280]", + .id = "Audigy2", + .emu10k2_chip = 1, + .ca0102_chip = 1, +@@ -1844,8 +1849,10 @@ int __devinit snd_emu10k1_create(struct snd_card *card, + + is_audigy = emu->audigy = c->emu10k2_chip; + ++ /* set addressing mode */ ++ emu->address_mode = is_audigy ? 0 : 1; + /* set the DMA transfer mask */ +- emu->dma_mask = is_audigy ? AUDIGY_DMA_MASK : EMU10K1_DMA_MASK; ++ emu->dma_mask = emu->address_mode ? EMU10K1_DMA_MASK : AUDIGY_DMA_MASK; + if (pci_set_dma_mask(pci, emu->dma_mask) < 0 || + pci_set_consistent_dma_mask(pci, emu->dma_mask) < 0) { + snd_printk(KERN_ERR "architecture does not support PCI busmaster DMA with mask 0x%lx\n", emu->dma_mask); +@@ -1868,7 +1875,7 @@ int __devinit snd_emu10k1_create(struct snd_card *card, + + emu->max_cache_pages = max_cache_bytes >> PAGE_SHIFT; + if (snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV, snd_dma_pci_data(pci), +- 32 * 1024, &emu->ptb_pages) < 0) { ++ (emu->address_mode ? 32 : 16) * 1024, &emu->ptb_pages) < 0) { + err = -ENOMEM; + goto error; + } +@@ -1967,8 +1974,8 @@ int __devinit snd_emu10k1_create(struct snd_card *card, + + /* Clear silent pages and set up pointers */ + memset(emu->silent_page.area, 0, PAGE_SIZE); +- silent_page = emu->silent_page.addr << 1; +- for (idx = 0; idx < MAXPAGES; idx++) ++ silent_page = emu->silent_page.addr << emu->address_mode; ++ for (idx = 0; idx < (emu->address_mode ? MAXPAGES1 : MAXPAGES0); idx++) + ((u32 *)emu->ptb_pages.area)[idx] = cpu_to_le32(silent_page | idx); + + /* set up voice indices */ +diff --git a/sound/pci/emu10k1/emupcm.c b/sound/pci/emu10k1/emupcm.c +index e22b8e2bbd88..c673d2b31510 100644 +--- a/sound/pci/emu10k1/emupcm.c ++++ b/sound/pci/emu10k1/emupcm.c +@@ -379,7 +379,7 @@ static void snd_emu10k1_pcm_init_voice(struct snd_emu10k1 *emu, + snd_emu10k1_ptr_write(emu, Z1, voice, 0); + snd_emu10k1_ptr_write(emu, Z2, voice, 0); + /* invalidate maps */ +- silent_page = ((unsigned int)emu->silent_page.addr << 1) | MAP_PTI_MASK; ++ silent_page = ((unsigned int)emu->silent_page.addr << emu->address_mode) | (emu->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0); + snd_emu10k1_ptr_write(emu, MAPA, voice, silent_page); + snd_emu10k1_ptr_write(emu, MAPB, voice, silent_page); + /* modulation envelope */ +diff --git a/sound/pci/emu10k1/emuproc.c b/sound/pci/emu10k1/emuproc.c +index bc38dd4d071f..9c499e6bae06 100644 +--- a/sound/pci/emu10k1/emuproc.c ++++ b/sound/pci/emu10k1/emuproc.c +@@ -241,31 +241,22 @@ static void snd_emu10k1_proc_spdif_read(struct snd_info_entry *entry, + struct snd_emu10k1 *emu = entry->private_data; + u32 value; + u32 value2; +- unsigned long flags; + u32 rate; + + if (emu->card_capabilities->emu_model) { +- spin_lock_irqsave(&emu->emu_lock, flags); + snd_emu1010_fpga_read(emu, 0x38, &value); +- spin_unlock_irqrestore(&emu->emu_lock, flags); + if ((value & 0x1) == 0) { +- spin_lock_irqsave(&emu->emu_lock, flags); + snd_emu1010_fpga_read(emu, 0x2a, &value); + snd_emu1010_fpga_read(emu, 0x2b, &value2); +- spin_unlock_irqrestore(&emu->emu_lock, flags); + rate = 0x1770000 / (((value << 5) | value2)+1); + snd_iprintf(buffer, "ADAT Locked : %u\n", rate); + } else { + snd_iprintf(buffer, "ADAT Unlocked\n"); + } +- spin_lock_irqsave(&emu->emu_lock, flags); + snd_emu1010_fpga_read(emu, 0x20, &value); +- spin_unlock_irqrestore(&emu->emu_lock, flags); + if ((value & 0x4) == 0) { +- spin_lock_irqsave(&emu->emu_lock, flags); + snd_emu1010_fpga_read(emu, 0x28, &value); + snd_emu1010_fpga_read(emu, 0x29, &value2); +- spin_unlock_irqrestore(&emu->emu_lock, flags); + rate = 0x1770000 / (((value << 5) | value2)+1); + snd_iprintf(buffer, "SPDIF Locked : %d\n", rate); + } else { +@@ -410,14 +401,11 @@ static void snd_emu_proc_emu1010_reg_read(struct snd_info_entry *entry, + { + struct snd_emu10k1 *emu = entry->private_data; + u32 value; +- unsigned long flags; + int i; + snd_iprintf(buffer, "EMU1010 Registers:\n\n"); + + for(i = 0; i < 0x40; i+=1) { +- spin_lock_irqsave(&emu->emu_lock, flags); + snd_emu1010_fpga_read(emu, i, &value); +- spin_unlock_irqrestore(&emu->emu_lock, flags); + snd_iprintf(buffer, "%02X: %08X, %02X\n", i, value, (value >> 8) & 0x7f); + } + } +diff --git a/sound/pci/emu10k1/memory.c b/sound/pci/emu10k1/memory.c +index 4f502a2bdc3c..87b7c65fa033 100644 +--- a/sound/pci/emu10k1/memory.c ++++ b/sound/pci/emu10k1/memory.c +@@ -34,10 +34,11 @@ + * aligned pages in others + */ + #define __set_ptb_entry(emu,page,addr) \ +- (((u32 *)(emu)->ptb_pages.area)[page] = cpu_to_le32(((addr) << 1) | (page))) ++ (((u32 *)(emu)->ptb_pages.area)[page] = cpu_to_le32(((addr) << (emu->address_mode)) | (page))) + + #define UNIT_PAGES (PAGE_SIZE / EMUPAGESIZE) +-#define MAX_ALIGN_PAGES (MAXPAGES / UNIT_PAGES) ++#define MAX_ALIGN_PAGES0 (MAXPAGES0 / UNIT_PAGES) ++#define MAX_ALIGN_PAGES1 (MAXPAGES1 / UNIT_PAGES) + /* get aligned page from offset address */ + #define get_aligned_page(offset) ((offset) >> PAGE_SHIFT) + /* get offset address from aligned page */ +@@ -124,7 +125,7 @@ static int search_empty_map_area(struct snd_emu10k1 *emu, int npages, struct lis + } + page = blk->mapped_page + blk->pages; + } +- size = MAX_ALIGN_PAGES - page; ++ size = (emu->address_mode ? MAX_ALIGN_PAGES1 : MAX_ALIGN_PAGES0) - page; + if (size >= max_size) { + *nextp = pos; + return page; +@@ -181,7 +182,7 @@ static int unmap_memblk(struct snd_emu10k1 *emu, struct snd_emu10k1_memblk *blk) + q = get_emu10k1_memblk(p, mapped_link); + end_page = q->mapped_page; + } else +- end_page = MAX_ALIGN_PAGES; ++ end_page = (emu->address_mode ? MAX_ALIGN_PAGES1 : MAX_ALIGN_PAGES0); + + /* remove links */ + list_del(&blk->mapped_link); +@@ -305,7 +306,7 @@ snd_emu10k1_alloc_pages(struct snd_emu10k1 *emu, struct snd_pcm_substream *subst + if (snd_BUG_ON(!emu)) + return NULL; + if (snd_BUG_ON(runtime->dma_bytes <= 0 || +- runtime->dma_bytes >= MAXPAGES * EMUPAGESIZE)) ++ runtime->dma_bytes >= (emu->address_mode ? MAXPAGES1 : MAXPAGES0) * EMUPAGESIZE)) + return NULL; + hdr = emu->memhdr; + if (snd_BUG_ON(!hdr)) +diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c +index c74a044284b0..f70115e143ec 100644 +--- a/sound/pci/hda/hda_codec.c ++++ b/sound/pci/hda/hda_codec.c +@@ -2093,6 +2093,16 @@ _snd_hda_find_mixer_ctl(struct hda_codec *codec, + return snd_ctl_find_id(codec->bus->card, &id); + } + ++/* meta hook to call each driver's vmaster hook */ ++static void vmaster_hook(void *private_data, int enabled) ++{ ++ struct hda_vmaster_mute_hook *hook = private_data; ++ ++ if (hook->mute_mode != HDA_VMUTE_FOLLOW_MASTER) ++ enabled = hook->mute_mode; ++ hook->hook(hook->codec, enabled); ++} ++ + /** + * snd_hda_find_mixer_ctl - Find a mixer control element with the given name + * @codec: HD-audio codec +@@ -2520,9 +2530,9 @@ int snd_hda_add_vmaster_hook(struct hda_codec *codec, + + if (!hook->hook || !hook->sw_kctl) + return 0; +- snd_ctl_add_vmaster_hook(hook->sw_kctl, hook->hook, codec); + hook->codec = codec; + hook->mute_mode = HDA_VMUTE_FOLLOW_MASTER; ++ snd_ctl_add_vmaster_hook(hook->sw_kctl, vmaster_hook, hook); + if (!expose_enum_ctl) + return 0; + kctl = snd_ctl_new1(&vmaster_mute_mode, hook); +@@ -2540,14 +2550,7 @@ void snd_hda_sync_vmaster_hook(struct hda_vmaster_mute_hook *hook) + { + if (!hook->hook || !hook->codec) + return; +- switch (hook->mute_mode) { +- case HDA_VMUTE_FOLLOW_MASTER: +- snd_ctl_sync_vmaster_hook(hook->sw_kctl); +- break; +- default: +- hook->hook(hook->codec, hook->mute_mode); +- break; +- } ++ snd_ctl_sync_vmaster_hook(hook->sw_kctl); + } + EXPORT_SYMBOL_HDA(snd_hda_sync_vmaster_hook); + +diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c +index 20cfc5b44710..ba80c2f7e047 100644 +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -4606,6 +4606,14 @@ static const struct hda_codec_preset snd_hda_preset_conexant[] = { + .patch = patch_conexant_auto }, + { .id = 0x14f150b9, .name = "CX20665", + .patch = patch_conexant_auto }, ++ { .id = 0x14f150f1, .name = "CX20721", ++ .patch = patch_conexant_auto }, ++ { .id = 0x14f150f2, .name = "CX20722", ++ .patch = patch_conexant_auto }, ++ { .id = 0x14f150f3, .name = "CX20723", ++ .patch = patch_conexant_auto }, ++ { .id = 0x14f150f4, .name = "CX20724", ++ .patch = patch_conexant_auto }, + { .id = 0x14f1510f, .name = "CX20751/2", + .patch = patch_conexant_auto }, + { .id = 0x14f15110, .name = "CX20751/2", +@@ -4640,6 +4648,10 @@ MODULE_ALIAS("snd-hda-codec-id:14f150ab"); + MODULE_ALIAS("snd-hda-codec-id:14f150ac"); + MODULE_ALIAS("snd-hda-codec-id:14f150b8"); + MODULE_ALIAS("snd-hda-codec-id:14f150b9"); ++MODULE_ALIAS("snd-hda-codec-id:14f150f1"); ++MODULE_ALIAS("snd-hda-codec-id:14f150f2"); ++MODULE_ALIAS("snd-hda-codec-id:14f150f3"); ++MODULE_ALIAS("snd-hda-codec-id:14f150f4"); + MODULE_ALIAS("snd-hda-codec-id:14f1510f"); + MODULE_ALIAS("snd-hda-codec-id:14f15110"); + MODULE_ALIAS("snd-hda-codec-id:14f15111"); +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index b16a37f633c5..bf1f0abf415b 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5412,6 +5412,7 @@ static const struct alc_fixup alc882_fixups[] = { + static const struct snd_pci_quirk alc882_fixup_tbl[] = { + SND_PCI_QUIRK(0x1025, 0x006c, "Acer Aspire 9810", ALC883_FIXUP_ACER_EAPD), + SND_PCI_QUIRK(0x1025, 0x0090, "Acer Aspire", ALC883_FIXUP_ACER_EAPD), ++ SND_PCI_QUIRK(0x1025, 0x0107, "Acer Aspire", ALC883_FIXUP_ACER_EAPD), + SND_PCI_QUIRK(0x1025, 0x010a, "Acer Ferrari 5000", ALC883_FIXUP_ACER_EAPD), + SND_PCI_QUIRK(0x1025, 0x0110, "Acer Aspire", ALC883_FIXUP_ACER_EAPD), + SND_PCI_QUIRK(0x1025, 0x0112, "Acer Aspire 9303", ALC883_FIXUP_ACER_EAPD), +diff --git a/sound/soc/codecs/cs4271.c b/sound/soc/codecs/cs4271.c +index f9e2bdaf91f1..54059324d942 100644 +--- a/sound/soc/codecs/cs4271.c ++++ b/sound/soc/codecs/cs4271.c +@@ -475,10 +475,10 @@ static int cs4271_probe(struct snd_soc_codec *codec) + if (gpio_nreset >= 0) { + /* Reset codec */ + gpio_direction_output(gpio_nreset, 0); +- udelay(1); ++ mdelay(1); + gpio_set_value(gpio_nreset, 1); + /* Give the codec time to wake up */ +- udelay(1); ++ mdelay(1); + } + + cs4271->gpio_nreset = gpio_nreset; +diff --git a/sound/soc/codecs/wm8741.c b/sound/soc/codecs/wm8741.c +index 3941f50bf187..90deecddb6ac 100644 +--- a/sound/soc/codecs/wm8741.c ++++ b/sound/soc/codecs/wm8741.c +@@ -105,7 +105,7 @@ static struct { + }; + + static unsigned int rates_11289[] = { +- 44100, 88235, ++ 44100, 88200, + }; + + static struct snd_pcm_hw_constraint_list constraints_11289 = { +@@ -132,7 +132,7 @@ static struct snd_pcm_hw_constraint_list constraints_16384 = { + }; + + static unsigned int rates_16934[] = { +- 44100, 88235, ++ 44100, 88200, + }; + + static struct snd_pcm_hw_constraint_list constraints_16934 = { +@@ -150,7 +150,7 @@ static struct snd_pcm_hw_constraint_list constraints_18432 = { + }; + + static unsigned int rates_22579[] = { +- 44100, 88235, 1764000 ++ 44100, 88200, 176400 + }; + + static struct snd_pcm_hw_constraint_list constraints_22579 = { +@@ -168,7 +168,7 @@ static struct snd_pcm_hw_constraint_list constraints_24576 = { + }; + + static unsigned int rates_36864[] = { +- 48000, 96000, 19200 ++ 48000, 96000, 192000 + }; + + static struct snd_pcm_hw_constraint_list constraints_36864 = { +diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c +index a3e4831bbe39..ed986e6d10c4 100644 +--- a/sound/soc/codecs/wm8960.c ++++ b/sound/soc/codecs/wm8960.c +@@ -333,7 +333,7 @@ static const struct snd_soc_dapm_route audio_paths[] = { + { "Right Input Mixer", "Boost Switch", "Right Boost Mixer", }, + { "Right Input Mixer", NULL, "RINPUT1", }, /* Really Boost Switch */ + { "Right Input Mixer", NULL, "RINPUT2" }, +- { "Right Input Mixer", NULL, "LINPUT3" }, ++ { "Right Input Mixer", NULL, "RINPUT3" }, + + { "Left ADC", NULL, "Left Input Mixer" }, + { "Right ADC", NULL, "Right Input Mixer" }, +diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c +index d9924d76f713..c93c573f967a 100644 +--- a/sound/soc/codecs/wm8994.c ++++ b/sound/soc/codecs/wm8994.c +@@ -2636,7 +2636,7 @@ static struct { + }; + + static int fs_ratios[] = { +- 64, 128, 192, 256, 348, 512, 768, 1024, 1408, 1536 ++ 64, 128, 192, 256, 384, 512, 768, 1024, 1408, 1536 + }; + + static int bclk_divs[] = { +diff --git a/sound/synth/emux/emux_oss.c b/sound/synth/emux/emux_oss.c +index 319754cf6208..daf61abc3670 100644 +--- a/sound/synth/emux/emux_oss.c ++++ b/sound/synth/emux/emux_oss.c +@@ -118,12 +118,8 @@ snd_emux_open_seq_oss(struct snd_seq_oss_arg *arg, void *closure) + if (snd_BUG_ON(!arg || !emu)) + return -ENXIO; + +- mutex_lock(&emu->register_mutex); +- +- if (!snd_emux_inc_count(emu)) { +- mutex_unlock(&emu->register_mutex); ++ if (!snd_emux_inc_count(emu)) + return -EFAULT; +- } + + memset(&callback, 0, sizeof(callback)); + callback.owner = THIS_MODULE; +@@ -135,7 +131,6 @@ snd_emux_open_seq_oss(struct snd_seq_oss_arg *arg, void *closure) + if (p == NULL) { + snd_printk(KERN_ERR "can't create port\n"); + snd_emux_dec_count(emu); +- mutex_unlock(&emu->register_mutex); + return -ENOMEM; + } + +@@ -148,8 +143,6 @@ snd_emux_open_seq_oss(struct snd_seq_oss_arg *arg, void *closure) + reset_port_mode(p, arg->seq_mode); + + snd_emux_reset_port(p); +- +- mutex_unlock(&emu->register_mutex); + return 0; + } + +@@ -195,13 +188,11 @@ snd_emux_close_seq_oss(struct snd_seq_oss_arg *arg) + if (snd_BUG_ON(!emu)) + return -ENXIO; + +- mutex_lock(&emu->register_mutex); + snd_emux_sounds_off_all(p); + snd_soundfont_close_check(emu->sflist, SF_CLIENT_NO(p->chset.port)); + snd_seq_event_port_detach(p->chset.client, p->chset.port); + snd_emux_dec_count(emu); + +- mutex_unlock(&emu->register_mutex); + return 0; + } + +diff --git a/sound/synth/emux/emux_seq.c b/sound/synth/emux/emux_seq.c +index 7778b8e19782..a0209204ae48 100644 +--- a/sound/synth/emux/emux_seq.c ++++ b/sound/synth/emux/emux_seq.c +@@ -124,12 +124,10 @@ snd_emux_detach_seq(struct snd_emux *emu) + if (emu->voices) + snd_emux_terminate_all(emu); + +- mutex_lock(&emu->register_mutex); + if (emu->client >= 0) { + snd_seq_delete_kernel_client(emu->client); + emu->client = -1; + } +- mutex_unlock(&emu->register_mutex); + } + + +@@ -269,8 +267,8 @@ snd_emux_event_input(struct snd_seq_event *ev, int direct, void *private_data, + /* + * increment usage count + */ +-int +-snd_emux_inc_count(struct snd_emux *emu) ++static int ++__snd_emux_inc_count(struct snd_emux *emu) + { + emu->used++; + if (!try_module_get(emu->ops.owner)) +@@ -284,12 +282,21 @@ snd_emux_inc_count(struct snd_emux *emu) + return 1; + } + ++int snd_emux_inc_count(struct snd_emux *emu) ++{ ++ int ret; ++ ++ mutex_lock(&emu->register_mutex); ++ ret = __snd_emux_inc_count(emu); ++ mutex_unlock(&emu->register_mutex); ++ return ret; ++} + + /* + * decrease usage count + */ +-void +-snd_emux_dec_count(struct snd_emux *emu) ++static void ++__snd_emux_dec_count(struct snd_emux *emu) + { + module_put(emu->card->module); + emu->used--; +@@ -298,6 +305,12 @@ snd_emux_dec_count(struct snd_emux *emu) + module_put(emu->ops.owner); + } + ++void snd_emux_dec_count(struct snd_emux *emu) ++{ ++ mutex_lock(&emu->register_mutex); ++ __snd_emux_dec_count(emu); ++ mutex_unlock(&emu->register_mutex); ++} + + /* + * Routine that is called upon a first use of a particular port +@@ -317,7 +330,7 @@ snd_emux_use(void *private_data, struct snd_seq_port_subscribe *info) + + mutex_lock(&emu->register_mutex); + snd_emux_init_port(p); +- snd_emux_inc_count(emu); ++ __snd_emux_inc_count(emu); + mutex_unlock(&emu->register_mutex); + return 0; + } +@@ -340,7 +353,7 @@ snd_emux_unuse(void *private_data, struct snd_seq_port_subscribe *info) + + mutex_lock(&emu->register_mutex); + snd_emux_sounds_off_all(p); +- snd_emux_dec_count(emu); ++ __snd_emux_dec_count(emu); + mutex_unlock(&emu->register_mutex); + return 0; + } +diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c +index 1e0798f6539b..851786ffa639 100644 +--- a/sound/usb/mixer_maps.c ++++ b/sound/usb/mixer_maps.c +@@ -380,6 +380,11 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = { + .ignore_ctl_error = 1, + }, + { ++ /* MAYA44 USB+ */ ++ .id = USB_ID(0x2573, 0x0008), ++ .map = maya44_map, ++ }, ++ { + /* KEF X300A */ + .id = USB_ID(0x27ac, 0x1000), + .map = scms_usb3318_map, |