lkml.org 
[lkml]   [2015]   [Sep]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    SubjectRe: [PATCH 3.4 000/146] 3.4.109-rc1 review
    Date
    From: Zefan Li <lizefan@huawei.com>

    This is the combined patch for 3.4.106-rc1 relative to 3.4.105.

    ---

    diff --git a/Documentation/networking/rds.txt b/Documentation/networking/rds.txt
    index c67077c..e1a3d59 100644
    --- a/Documentation/networking/rds.txt
    +++ b/Documentation/networking/rds.txt
    @@ -62,11 +62,10 @@ Socket Interface
    ================

    AF_RDS, PF_RDS, SOL_RDS
    - These constants haven't been assigned yet, because RDS isn't in
    - mainline yet. Currently, the kernel module assigns some constant
    - and publishes it to user space through two sysctl files
    - /proc/sys/net/rds/pf_rds
    - /proc/sys/net/rds/sol_rds
    + AF_RDS and PF_RDS are the domain type to be used with socket(2)
    + to create RDS sockets. SOL_RDS is the socket-level to be used
    + with setsockopt(2) and getsockopt(2) for RDS specific socket
    + options.

    fd = socket(PF_RDS, SOCK_SEQPACKET, 0);
    This creates a new, unbound RDS socket.
    diff --git a/Documentation/pinctrl.txt b/Documentation/pinctrl.txt
    index d97bccf..d464716 100644
    --- a/Documentation/pinctrl.txt
    +++ b/Documentation/pinctrl.txt
    @@ -72,7 +72,6 @@ static struct pinctrl_desc foo_desc = {
    .name = "foo",
    .pins = foo_pins,
    .npins = ARRAY_SIZE(foo_pins),
    - .maxpin = 63,
    .owner = THIS_MODULE,
    };

    @@ -166,8 +165,8 @@ static const char *foo_get_group_name(struct pinctrl_dev *pctldev,
    }

    static int foo_get_group_pins(struct pinctrl_dev *pctldev, unsigned selector,
    - unsigned ** const pins,
    - unsigned * const num_pins)
    + const unsigned **pins,
    + unsigned *num_pins)
    {
    *pins = (unsigned *) foo_groups[selector].pins;
    *num_pins = foo_groups[selector].num_pins;
    @@ -1043,7 +1042,7 @@ The semantics of the pinctrl APIs are:

    Usually the pin control core handled the get/put pair and call out to the
    device drivers bookkeeping operations, like checking available functions and
    -the associated pins, whereas the enable/disable pass on to the pin controller
    +the associated pins, whereas select_state pass on to the pin controller
    driver which takes care of activating and/or deactivating the mux setting by
    quickly poking some registers.

    @@ -1089,8 +1088,9 @@ function, but with different named in the mapping as described under
    "Advanced mapping" above. So that for an SPI device, we have two states named
    "pos-A" and "pos-B".

    -This snippet first muxes the function in the pins defined by group A, enables
    -it, disables and releases it, and muxes it in on the pins defined by group B:
    +This snippet first initializes a state object for both groups (in foo_probe()),
    +then muxes the function in the pins defined by group A, and finally muxes it in
    +on the pins defined by group B:

    #include <linux/pinctrl/consumer.h>

    diff --git a/Makefile b/Makefile
    index 5056e1b..e78af5c 100644
    --- a/Makefile
    +++ b/Makefile
    @@ -1,7 +1,7 @@
    VERSION = 3
    PATCHLEVEL = 4
    -SUBLEVEL = 108
    -EXTRAVERSION =
    +SUBLEVEL = 109
    +EXTRAVERSION = -rc1
    NAME = Saber-toothed Squirrel

    # *DOCUMENTATION*
    diff --git a/arch/arm/boot/dts/imx27.dtsi b/arch/arm/boot/dts/imx27.dtsi
    index bc5e7d5..9cc8ed2 100644
    --- a/arch/arm/boot/dts/imx27.dtsi
    +++ b/arch/arm/boot/dts/imx27.dtsi
    @@ -208,7 +208,7 @@

    fec: fec@1002b000 {
    compatible = "fsl,imx27-fec";
    - reg = <0x1002b000 0x4000>;
    + reg = <0x1002b000 0x1000>;
    interrupts = <50>;
    status = "disabled";
    };
    diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h
    index 38050b1..dfc980b 100644
    --- a/arch/arm/include/asm/elf.h
    +++ b/arch/arm/include/asm/elf.h
    @@ -116,7 +116,7 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs);
    the loader. We need to make sure that it is out of the way of the program
    that it will "exec", and that there is sufficient room for the brk. */

    -#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
    +#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)

    /* When the program starts, a1 contains a pointer to a function to be
    registered with atexit, as per the SVR4 ABI. A value of 0 means we
    diff --git a/arch/arm/mach-pxa/Kconfig b/arch/arm/mach-pxa/Kconfig
    index fe2d1f8..2f8b171 100644
    --- a/arch/arm/mach-pxa/Kconfig
    +++ b/arch/arm/mach-pxa/Kconfig
    @@ -718,4 +718,13 @@ config PXA_HAVE_ISA_IRQS
    config PXA310_ULPI
    bool

    +config PXA_SYSTEMS_CPLDS
    + tristate "Motherboard cplds"
    + default ARCH_LUBBOCK || MACH_MAINSTONE
    + help
    + This driver supports the Lubbock and Mainstone multifunction chip
    + found on the pxa25x development platform system (Lubbock) and pxa27x
    + development platform system (Mainstone). This IO board supports the
    + interrupts handling, ethernet controller, flash chips, etc ...
    +
    endif
    diff --git a/arch/arm/mach-pxa/Makefile b/arch/arm/mach-pxa/Makefile
    index be0f7df..318c0d7 100644
    --- a/arch/arm/mach-pxa/Makefile
    +++ b/arch/arm/mach-pxa/Makefile
    @@ -103,4 +103,5 @@ led-$(CONFIG_ARCH_PXA_IDP) += leds-idp.o

    obj-$(CONFIG_LEDS) += $(led-y)

    +obj-$(CONFIG_PXA_SYSTEMS_CPLDS) += pxa_cplds_irqs.o
    obj-$(CONFIG_TOSA_BT) += tosa-bt.o
    diff --git a/arch/arm/mach-pxa/include/mach/lubbock.h b/arch/arm/mach-pxa/include/mach/lubbock.h
    index 2a086e8..b20b97e 100644
    --- a/arch/arm/mach-pxa/include/mach/lubbock.h
    +++ b/arch/arm/mach-pxa/include/mach/lubbock.h
    @@ -35,7 +35,9 @@
    #define LUB_GP __LUB_REG(LUBBOCK_FPGA_PHYS + 0x100)

    /* Board specific IRQs */
    -#define LUBBOCK_IRQ(x) (IRQ_BOARD_START + (x))
    +#define LUBBOCK_NR_IRQS IRQ_BOARD_START
    +
    +#define LUBBOCK_IRQ(x) (LUBBOCK_NR_IRQS + (x))
    #define LUBBOCK_SD_IRQ LUBBOCK_IRQ(0)
    #define LUBBOCK_SA1111_IRQ LUBBOCK_IRQ(1)
    #define LUBBOCK_USB_IRQ LUBBOCK_IRQ(2) /* usb connect */
    @@ -45,8 +47,7 @@
    #define LUBBOCK_USB_DISC_IRQ LUBBOCK_IRQ(6) /* usb disconnect */
    #define LUBBOCK_LAST_IRQ LUBBOCK_IRQ(6)

    -#define LUBBOCK_SA1111_IRQ_BASE (IRQ_BOARD_START + 16)
    -#define LUBBOCK_NR_IRQS (IRQ_BOARD_START + 16 + 55)
    +#define LUBBOCK_SA1111_IRQ_BASE (LUBBOCK_NR_IRQS + 32)

    #ifndef __ASSEMBLY__
    extern void lubbock_set_misc_wr(unsigned int mask, unsigned int set);
    diff --git a/arch/arm/mach-pxa/include/mach/mainstone.h b/arch/arm/mach-pxa/include/mach/mainstone.h
    index 1bfc4e8..e82a7d3 100644
    --- a/arch/arm/mach-pxa/include/mach/mainstone.h
    +++ b/arch/arm/mach-pxa/include/mach/mainstone.h
    @@ -120,7 +120,9 @@
    #define MST_PCMCIA_PWR_VCC_50 0x4 /* voltage VCC = 5.0V */

    /* board specific IRQs */
    -#define MAINSTONE_IRQ(x) (IRQ_BOARD_START + (x))
    +#define MAINSTONE_NR_IRQS IRQ_BOARD_START
    +
    +#define MAINSTONE_IRQ(x) (MAINSTONE_NR_IRQS + (x))
    #define MAINSTONE_MMC_IRQ MAINSTONE_IRQ(0)
    #define MAINSTONE_USIM_IRQ MAINSTONE_IRQ(1)
    #define MAINSTONE_USBC_IRQ MAINSTONE_IRQ(2)
    @@ -136,6 +138,4 @@
    #define MAINSTONE_S1_STSCHG_IRQ MAINSTONE_IRQ(14)
    #define MAINSTONE_S1_IRQ MAINSTONE_IRQ(15)

    -#define MAINSTONE_NR_IRQS (IRQ_BOARD_START + 16)
    -
    #endif
    diff --git a/arch/arm/mach-pxa/lubbock.c b/arch/arm/mach-pxa/lubbock.c
    index 6bb3f47..799f31f 100644
    --- a/arch/arm/mach-pxa/lubbock.c
    +++ b/arch/arm/mach-pxa/lubbock.c
    @@ -12,6 +12,7 @@
    * published by the Free Software Foundation.
    */
    #include <linux/gpio.h>
    +#include <linux/gpio/machine.h>
    #include <linux/module.h>
    #include <linux/kernel.h>
    #include <linux/init.h>
    @@ -120,84 +121,6 @@ void lubbock_set_misc_wr(unsigned int mask, unsigned int set)
    }
    EXPORT_SYMBOL(lubbock_set_misc_wr);

    -static unsigned long lubbock_irq_enabled;
    -
    -static void lubbock_mask_irq(struct irq_data *d)
    -{
    - int lubbock_irq = (d->irq - LUBBOCK_IRQ(0));
    - LUB_IRQ_MASK_EN = (lubbock_irq_enabled &= ~(1 << lubbock_irq));
    -}
    -
    -static void lubbock_unmask_irq(struct irq_data *d)
    -{
    - int lubbock_irq = (d->irq - LUBBOCK_IRQ(0));
    - /* the irq can be acknowledged only if deasserted, so it's done here */
    - LUB_IRQ_SET_CLR &= ~(1 << lubbock_irq);
    - LUB_IRQ_MASK_EN = (lubbock_irq_enabled |= (1 << lubbock_irq));
    -}
    -
    -static struct irq_chip lubbock_irq_chip = {
    - .name = "FPGA",
    - .irq_ack = lubbock_mask_irq,
    - .irq_mask = lubbock_mask_irq,
    - .irq_unmask = lubbock_unmask_irq,
    -};
    -
    -static void lubbock_irq_handler(unsigned int irq, struct irq_desc *desc)
    -{
    - unsigned long pending = LUB_IRQ_SET_CLR & lubbock_irq_enabled;
    - do {
    - /* clear our parent irq */
    - desc->irq_data.chip->irq_ack(&desc->irq_data);
    - if (likely(pending)) {
    - irq = LUBBOCK_IRQ(0) + __ffs(pending);
    - generic_handle_irq(irq);
    - }
    - pending = LUB_IRQ_SET_CLR & lubbock_irq_enabled;
    - } while (pending);
    -}
    -
    -static void __init lubbock_init_irq(void)
    -{
    - int irq;
    -
    - pxa25x_init_irq();
    -
    - /* setup extra lubbock irqs */
    - for (irq = LUBBOCK_IRQ(0); irq <= LUBBOCK_LAST_IRQ; irq++) {
    - irq_set_chip_and_handler(irq, &lubbock_irq_chip,
    - handle_level_irq);
    - set_irq_flags(irq, IRQF_VALID | IRQF_PROBE);
    - }
    -
    - irq_set_chained_handler(PXA_GPIO_TO_IRQ(0), lubbock_irq_handler);
    - irq_set_irq_type(PXA_GPIO_TO_IRQ(0), IRQ_TYPE_EDGE_FALLING);
    -}
    -
    -#ifdef CONFIG_PM
    -
    -static void lubbock_irq_resume(void)
    -{
    - LUB_IRQ_MASK_EN = lubbock_irq_enabled;
    -}
    -
    -static struct syscore_ops lubbock_irq_syscore_ops = {
    - .resume = lubbock_irq_resume,
    -};
    -
    -static int __init lubbock_irq_device_init(void)
    -{
    - if (machine_is_lubbock()) {
    - register_syscore_ops(&lubbock_irq_syscore_ops);
    - return 0;
    - }
    - return -ENODEV;
    -}
    -
    -device_initcall(lubbock_irq_device_init);
    -
    -#endif
    -
    static int lubbock_udc_is_connected(void)
    {
    return (LUB_MISC_RD & (1 << 9)) == 0;
    @@ -380,11 +303,38 @@ static struct platform_device lubbock_flash_device[2] = {
    },
    };

    +static struct resource lubbock_cplds_resources[] = {
    + [0] = {
    + .start = LUBBOCK_FPGA_PHYS + 0xc0,
    + .end = LUBBOCK_FPGA_PHYS + 0xe0 - 1,
    + .flags = IORESOURCE_MEM,
    + },
    + [1] = {
    + .start = PXA_GPIO_TO_IRQ(0),
    + .end = PXA_GPIO_TO_IRQ(0),
    + .flags = IORESOURCE_IRQ | IORESOURCE_IRQ_LOWEDGE,
    + },
    + [2] = {
    + .start = LUBBOCK_IRQ(0),
    + .end = LUBBOCK_IRQ(6),
    + .flags = IORESOURCE_IRQ,
    + },
    +};
    +
    +static struct platform_device lubbock_cplds_device = {
    + .name = "pxa_cplds_irqs",
    + .id = -1,
    + .resource = &lubbock_cplds_resources[0],
    + .num_resources = 3,
    +};
    +
    +
    static struct platform_device *devices[] __initdata = {
    &sa1111_device,
    &smc91x_device,
    &lubbock_flash_device[0],
    &lubbock_flash_device[1],
    + &lubbock_cplds_device,
    };

    static struct pxafb_mode_info sharp_lm8v31_mode = {
    @@ -553,7 +503,7 @@ MACHINE_START(LUBBOCK, "Intel DBPXA250 Development Platform (aka Lubbock)")
    /* Maintainer: MontaVista Software Inc. */
    .map_io = lubbock_map_io,
    .nr_irqs = LUBBOCK_NR_IRQS,
    - .init_irq = lubbock_init_irq,
    + .init_irq = pxa25x_init_irq,
    .handle_irq = pxa25x_handle_irq,
    .timer = &pxa_timer,
    .init_machine = lubbock_init,
    diff --git a/arch/arm/mach-pxa/mainstone.c b/arch/arm/mach-pxa/mainstone.c
    index 1aebaf7..3d679db 100644
    --- a/arch/arm/mach-pxa/mainstone.c
    +++ b/arch/arm/mach-pxa/mainstone.c
    @@ -13,6 +13,7 @@
    * published by the Free Software Foundation.
    */
    #include <linux/gpio.h>
    +#include <linux/gpio/machine.h>
    #include <linux/init.h>
    #include <linux/platform_device.h>
    #include <linux/syscore_ops.h>
    @@ -120,92 +121,6 @@ static unsigned long mainstone_pin_config[] = {
    GPIO1_GPIO | WAKEUP_ON_EDGE_BOTH,
    };

    -static unsigned long mainstone_irq_enabled;
    -
    -static void mainstone_mask_irq(struct irq_data *d)
    -{
    - int mainstone_irq = (d->irq - MAINSTONE_IRQ(0));
    - MST_INTMSKENA = (mainstone_irq_enabled &= ~(1 << mainstone_irq));
    -}
    -
    -static void mainstone_unmask_irq(struct irq_data *d)
    -{
    - int mainstone_irq = (d->irq - MAINSTONE_IRQ(0));
    - /* the irq can be acknowledged only if deasserted, so it's done here */
    - MST_INTSETCLR &= ~(1 << mainstone_irq);
    - MST_INTMSKENA = (mainstone_irq_enabled |= (1 << mainstone_irq));
    -}
    -
    -static struct irq_chip mainstone_irq_chip = {
    - .name = "FPGA",
    - .irq_ack = mainstone_mask_irq,
    - .irq_mask = mainstone_mask_irq,
    - .irq_unmask = mainstone_unmask_irq,
    -};
    -
    -static void mainstone_irq_handler(unsigned int irq, struct irq_desc *desc)
    -{
    - unsigned long pending = MST_INTSETCLR & mainstone_irq_enabled;
    - do {
    - /* clear useless edge notification */
    - desc->irq_data.chip->irq_ack(&desc->irq_data);
    - if (likely(pending)) {
    - irq = MAINSTONE_IRQ(0) + __ffs(pending);
    - generic_handle_irq(irq);
    - }
    - pending = MST_INTSETCLR & mainstone_irq_enabled;
    - } while (pending);
    -}
    -
    -static void __init mainstone_init_irq(void)
    -{
    - int irq;
    -
    - pxa27x_init_irq();
    -
    - /* setup extra Mainstone irqs */
    - for(irq = MAINSTONE_IRQ(0); irq <= MAINSTONE_IRQ(15); irq++) {
    - irq_set_chip_and_handler(irq, &mainstone_irq_chip,
    - handle_level_irq);
    - if (irq == MAINSTONE_IRQ(10) || irq == MAINSTONE_IRQ(14))
    - set_irq_flags(irq, IRQF_VALID | IRQF_PROBE | IRQF_NOAUTOEN);
    - else
    - set_irq_flags(irq, IRQF_VALID | IRQF_PROBE);
    - }
    - set_irq_flags(MAINSTONE_IRQ(8), 0);
    - set_irq_flags(MAINSTONE_IRQ(12), 0);
    -
    - MST_INTMSKENA = 0;
    - MST_INTSETCLR = 0;
    -
    - irq_set_chained_handler(PXA_GPIO_TO_IRQ(0), mainstone_irq_handler);
    - irq_set_irq_type(PXA_GPIO_TO_IRQ(0), IRQ_TYPE_EDGE_FALLING);
    -}
    -
    -#ifdef CONFIG_PM
    -
    -static void mainstone_irq_resume(void)
    -{
    - MST_INTMSKENA = mainstone_irq_enabled;
    -}
    -
    -static struct syscore_ops mainstone_irq_syscore_ops = {
    - .resume = mainstone_irq_resume,
    -};
    -
    -static int __init mainstone_irq_device_init(void)
    -{
    - if (machine_is_mainstone())
    - register_syscore_ops(&mainstone_irq_syscore_ops);
    -
    - return 0;
    -}
    -
    -device_initcall(mainstone_irq_device_init);
    -
    -#endif
    -
    -
    static struct resource smc91x_resources[] = {
    [0] = {
    .start = (MST_ETH_PHYS + 0x300),
    @@ -483,11 +398,37 @@ static struct platform_device mst_gpio_keys_device = {
    },
    };

    +static struct resource mst_cplds_resources[] = {
    + [0] = {
    + .start = MST_FPGA_PHYS + 0xc0,
    + .end = MST_FPGA_PHYS + 0xe0 - 1,
    + .flags = IORESOURCE_MEM,
    + },
    + [1] = {
    + .start = PXA_GPIO_TO_IRQ(0),
    + .end = PXA_GPIO_TO_IRQ(0),
    + .flags = IORESOURCE_IRQ | IORESOURCE_IRQ_LOWEDGE,
    + },
    + [2] = {
    + .start = MAINSTONE_IRQ(0),
    + .end = MAINSTONE_IRQ(15),
    + .flags = IORESOURCE_IRQ,
    + },
    +};
    +
    +static struct platform_device mst_cplds_device = {
    + .name = "pxa_cplds_irqs",
    + .id = -1,
    + .resource = &mst_cplds_resources[0],
    + .num_resources = 3,
    +};
    +
    static struct platform_device *platform_devices[] __initdata = {
    &smc91x_device,
    &mst_flash_device[0],
    &mst_flash_device[1],
    &mst_gpio_keys_device,
    + &mst_cplds_device,
    };

    static struct pxaohci_platform_data mainstone_ohci_platform_data = {
    @@ -618,7 +559,7 @@ MACHINE_START(MAINSTONE, "Intel HCDDBBVA0 Development Platform (aka Mainstone)")
    .atag_offset = 0x100, /* BLOB boot parameter setting */
    .map_io = mainstone_map_io,
    .nr_irqs = MAINSTONE_NR_IRQS,
    - .init_irq = mainstone_init_irq,
    + .init_irq = pxa27x_init_irq,
    .handle_irq = pxa27x_handle_irq,
    .timer = &pxa_timer,
    .init_machine = mainstone_init,
    diff --git a/arch/arm/mach-pxa/pxa_cplds_irqs.c b/arch/arm/mach-pxa/pxa_cplds_irqs.c
    new file mode 100644
    index 0000000..f1aeb54
    --- /dev/null
    +++ b/arch/arm/mach-pxa/pxa_cplds_irqs.c
    @@ -0,0 +1,200 @@
    +/*
    + * Intel Reference Systems cplds
    + *
    + * Copyright (C) 2014 Robert Jarzmik
    + *
    + * This program is free software; you can redistribute it and/or modify
    + * it under the terms of the GNU General Public License as published by
    + * the Free Software Foundation; either version 2 of the License, or
    + * (at your option) any later version.
    + *
    + * Cplds motherboard driver, supporting lubbock and mainstone SoC board.
    + */
    +
    +#include <linux/bitops.h>
    +#include <linux/gpio.h>
    +#include <linux/gpio/consumer.h>
    +#include <linux/interrupt.h>
    +#include <linux/io.h>
    +#include <linux/irq.h>
    +#include <linux/irqdomain.h>
    +#include <linux/mfd/core.h>
    +#include <linux/module.h>
    +#include <linux/of_platform.h>
    +
    +#define FPGA_IRQ_MASK_EN 0x0
    +#define FPGA_IRQ_SET_CLR 0x10
    +
    +#define CPLDS_NB_IRQ 32
    +
    +struct cplds {
    + void __iomem *base;
    + int irq;
    + unsigned int irq_mask;
    + struct gpio_desc *gpio0;
    + struct irq_domain *irqdomain;
    +};
    +
    +static irqreturn_t cplds_irq_handler(int in_irq, void *d)
    +{
    + struct cplds *fpga = d;
    + unsigned long pending;
    + unsigned int bit;
    +
    + pending = readl(fpga->base + FPGA_IRQ_SET_CLR) & fpga->irq_mask;
    + for_each_set_bit(bit, &pending, CPLDS_NB_IRQ)
    + generic_handle_irq(irq_find_mapping(fpga->irqdomain, bit));
    +
    + return IRQ_HANDLED;
    +}
    +
    +static void cplds_irq_mask_ack(struct irq_data *d)
    +{
    + struct cplds *fpga = irq_data_get_irq_chip_data(d);
    + unsigned int cplds_irq = irqd_to_hwirq(d);
    + unsigned int set, bit = BIT(cplds_irq);
    +
    + fpga->irq_mask &= ~bit;
    + writel(fpga->irq_mask, fpga->base + FPGA_IRQ_MASK_EN);
    + set = readl(fpga->base + FPGA_IRQ_SET_CLR);
    + writel(set & ~bit, fpga->base + FPGA_IRQ_SET_CLR);
    +}
    +
    +static void cplds_irq_unmask(struct irq_data *d)
    +{
    + struct cplds *fpga = irq_data_get_irq_chip_data(d);
    + unsigned int cplds_irq = irqd_to_hwirq(d);
    + unsigned int bit = BIT(cplds_irq);
    +
    + fpga->irq_mask |= bit;
    + writel(fpga->irq_mask, fpga->base + FPGA_IRQ_MASK_EN);
    +}
    +
    +static struct irq_chip cplds_irq_chip = {
    + .name = "pxa_cplds",
    + .irq_mask_ack = cplds_irq_mask_ack,
    + .irq_unmask = cplds_irq_unmask,
    + .flags = IRQCHIP_MASK_ON_SUSPEND | IRQCHIP_SKIP_SET_WAKE,
    +};
    +
    +static int cplds_irq_domain_map(struct irq_domain *d, unsigned int irq,
    + irq_hw_number_t hwirq)
    +{
    + struct cplds *fpga = d->host_data;
    +
    + irq_set_chip_and_handler(irq, &cplds_irq_chip, handle_level_irq);
    + irq_set_chip_data(irq, fpga);
    +
    + return 0;
    +}
    +
    +static const struct irq_domain_ops cplds_irq_domain_ops = {
    + .xlate = irq_domain_xlate_twocell,
    + .map = cplds_irq_domain_map,
    +};
    +
    +static int cplds_resume(struct platform_device *pdev)
    +{
    + struct cplds *fpga = platform_get_drvdata(pdev);
    +
    + writel(fpga->irq_mask, fpga->base + FPGA_IRQ_MASK_EN);
    +
    + return 0;
    +}
    +
    +static int cplds_probe(struct platform_device *pdev)
    +{
    + struct resource *res;
    + struct cplds *fpga;
    + int ret;
    + unsigned int base_irq = 0;
    + unsigned long irqflags = 0;
    +
    + fpga = devm_kzalloc(&pdev->dev, sizeof(*fpga), GFP_KERNEL);
    + if (!fpga)
    + return -ENOMEM;
    +
    + res = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
    + if (res) {
    + fpga->irq = (unsigned int)res->start;
    + irqflags = res->flags;
    + }
    + if (!fpga->irq)
    + return -ENODEV;
    +
    + base_irq = platform_get_irq(pdev, 1);
    + if (base_irq < 0)
    + base_irq = 0;
    +
    + res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
    + fpga->base = devm_ioremap_resource(&pdev->dev, res);
    + if (IS_ERR(fpga->base))
    + return PTR_ERR(fpga->base);
    +
    + platform_set_drvdata(pdev, fpga);
    +
    + writel(fpga->irq_mask, fpga->base + FPGA_IRQ_MASK_EN);
    + writel(0, fpga->base + FPGA_IRQ_SET_CLR);
    +
    + ret = devm_request_irq(&pdev->dev, fpga->irq, cplds_irq_handler,
    + irqflags, dev_name(&pdev->dev), fpga);
    + if (ret == -ENOSYS)
    + return -EPROBE_DEFER;
    +
    + if (ret) {
    + dev_err(&pdev->dev, "couldn't request main irq%d: %d\n",
    + fpga->irq, ret);
    + return ret;
    + }
    +
    + irq_set_irq_wake(fpga->irq, 1);
    + fpga->irqdomain = irq_domain_add_linear(pdev->dev.of_node,
    + CPLDS_NB_IRQ,
    + &cplds_irq_domain_ops, fpga);
    + if (!fpga->irqdomain)
    + return -ENODEV;
    +
    + if (base_irq) {
    + ret = irq_create_strict_mappings(fpga->irqdomain, base_irq, 0,
    + CPLDS_NB_IRQ);
    + if (ret) {
    + dev_err(&pdev->dev, "couldn't create the irq mapping %d..%d\n",
    + base_irq, base_irq + CPLDS_NB_IRQ);
    + return ret;
    + }
    + }
    +
    + return 0;
    +}
    +
    +static int cplds_remove(struct platform_device *pdev)
    +{
    + struct cplds *fpga = platform_get_drvdata(pdev);
    +
    + irq_set_chip_and_handler(fpga->irq, NULL, NULL);
    +
    + return 0;
    +}
    +
    +static const struct of_device_id cplds_id_table[] = {
    + { .compatible = "intel,lubbock-cplds-irqs", },
    + { .compatible = "intel,mainstone-cplds-irqs", },
    + { }
    +};
    +MODULE_DEVICE_TABLE(of, cplds_id_table);
    +
    +static struct platform_driver cplds_driver = {
    + .driver = {
    + .name = "pxa_cplds_irqs",
    + .of_match_table = of_match_ptr(cplds_id_table),
    + },
    + .probe = cplds_probe,
    + .remove = cplds_remove,
    + .resume = cplds_resume,
    +};
    +
    +module_platform_driver(cplds_driver);
    +
    +MODULE_DESCRIPTION("PXA Cplds interrupts driver");
    +MODULE_AUTHOR("Robert Jarzmik <robert.jarzmik@free.fr>");
    +MODULE_LICENSE("GPL");
    diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c
    index 62135849..ad94145 100644
    --- a/arch/arm/net/bpf_jit_32.c
    +++ b/arch/arm/net/bpf_jit_32.c
    @@ -52,6 +52,7 @@
    #define SEEN_DATA (1 << (BPF_MEMWORDS + 3))

    #define FLAG_NEED_X_RESET (1 << 0)
    +#define FLAG_IMM_OVERFLOW (1 << 1)

    struct jit_ctx {
    const struct sk_filter *skf;
    @@ -286,6 +287,15 @@ static u16 imm_offset(u32 k, struct jit_ctx *ctx)
    /* PC in ARM mode == address of the instruction + 8 */
    imm = offset - (8 + ctx->idx * 4);

    + if (imm & ~0xfff) {
    + /*
    + * literal pool is too far, signal it into flags. we
    + * can only detect it on the second pass unfortunately.
    + */
    + ctx->flags |= FLAG_IMM_OVERFLOW;
    + return 0;
    + }
    +
    return imm;
    }

    @@ -817,6 +827,14 @@ b_epilogue:
    default:
    return -1;
    }
    +
    + if (ctx->flags & FLAG_IMM_OVERFLOW)
    + /*
    + * this instruction generated an overflow when
    + * trying to access the literal pool, so
    + * delegate this filter to the kernel interpreter.
    + */
    + return -1;
    }

    /* compute offsets only during the first pass */
    @@ -876,7 +894,14 @@ void bpf_jit_compile(struct sk_filter *fp)

    ctx.idx = 0;
    build_prologue(&ctx);
    - build_body(&ctx);
    + if (build_body(&ctx) < 0) {
    +#if __LINUX_ARM_ARCH__ < 7
    + if (ctx.imm_count)
    + kfree(ctx.imms);
    +#endif
    + bpf_jit_binary_free(header);
    + goto out;
    + }
    build_epilogue(&ctx);

    flush_icache_range((u32)ctx.target, (u32)(ctx.target + ctx.idx));
    diff --git a/arch/c6x/kernel/time.c b/arch/c6x/kernel/time.c
    index 356ee84..04845aa 100644
    --- a/arch/c6x/kernel/time.c
    +++ b/arch/c6x/kernel/time.c
    @@ -49,7 +49,7 @@ u64 sched_clock(void)
    return (tsc * sched_clock_multiplier) >> SCHED_CLOCK_SHIFT;
    }

    -void time_init(void)
    +void __init time_init(void)
    {
    u64 tmp = (u64)NSEC_PER_SEC << SCHED_CLOCK_SHIFT;

    diff --git a/arch/mips/kernel/irq.c b/arch/mips/kernel/irq.c
    index a5aa43d..9cd8cbf 100644
    --- a/arch/mips/kernel/irq.c
    +++ b/arch/mips/kernel/irq.c
    @@ -110,7 +110,7 @@ void __init init_IRQ(void)
    #endif
    }

    -#ifdef DEBUG_STACKOVERFLOW
    +#ifdef CONFIG_DEBUG_STACKOVERFLOW
    static inline void check_stack_overflow(void)
    {
    unsigned long sp;
    diff --git a/arch/mips/power/hibernate.S b/arch/mips/power/hibernate.S
    index 5bf34ec..2ca1735 100644
    --- a/arch/mips/power/hibernate.S
    +++ b/arch/mips/power/hibernate.S
    @@ -31,6 +31,8 @@ LEAF(swsusp_arch_suspend)
    END(swsusp_arch_suspend)

    LEAF(swsusp_arch_resume)
    + /* Avoid TLB mismatch during and after kernel resume */
    + jal local_flush_tlb_all
    PTR_L t0, restore_pblist
    0:
    PTR_L t1, PBE_ADDRESS(t0) /* source */
    @@ -44,7 +46,6 @@ LEAF(swsusp_arch_resume)
    bne t1, t3, 1b
    PTR_L t0, PBE_NEXT(t0)
    bnez t0, 0b
    - jal local_flush_tlb_all /* Avoid TLB mismatch after kernel resume */
    PTR_LA t0, saved_regs
    PTR_L ra, PT_R31(t0)
    PTR_L sp, PT_R29(t0)
    diff --git a/arch/powerpc/kernel/cacheinfo.c b/arch/powerpc/kernel/cacheinfo.c
    index b4437e8..334254c 100644
    --- a/arch/powerpc/kernel/cacheinfo.c
    +++ b/arch/powerpc/kernel/cacheinfo.c
    @@ -62,12 +62,22 @@ struct cache_type_info {
    };

    /* These are used to index the cache_type_info array. */
    -#define CACHE_TYPE_UNIFIED 0
    -#define CACHE_TYPE_INSTRUCTION 1
    -#define CACHE_TYPE_DATA 2
    +#define CACHE_TYPE_UNIFIED 0 /* cache-size, cache-block-size, etc. */
    +#define CACHE_TYPE_UNIFIED_D 1 /* d-cache-size, d-cache-block-size, etc */
    +#define CACHE_TYPE_INSTRUCTION 2
    +#define CACHE_TYPE_DATA 3

    static const struct cache_type_info cache_type_info[] = {
    {
    + /* Embedded systems that use cache-size, cache-block-size,
    + * etc. for the Unified (typically L2) cache. */
    + .name = "Unified",
    + .size_prop = "cache-size",
    + .line_size_props = { "cache-line-size",
    + "cache-block-size", },
    + .nr_sets_prop = "cache-sets",
    + },
    + {
    /* PowerPC Processor binding says the [di]-cache-*
    * must be equal on unified caches, so just use
    * d-cache properties. */
    @@ -293,7 +303,8 @@ static struct cache *cache_find_first_sibling(struct cache *cache)
    {
    struct cache *iter;

    - if (cache->type == CACHE_TYPE_UNIFIED)
    + if (cache->type == CACHE_TYPE_UNIFIED ||
    + cache->type == CACHE_TYPE_UNIFIED_D)
    return cache;

    list_for_each_entry(iter, &cache_list, list)
    @@ -324,15 +335,27 @@ static bool cache_node_is_unified(const struct device_node *np)
    return of_get_property(np, "cache-unified", NULL);
    }

    -static struct cache *__cpuinit cache_do_one_devnode_unified(struct device_node *node, int level)
    +/*
    + * Unified caches can have two different sets of tags. Most embedded
    + * use cache-size, etc. for the unified cache size, but open firmware systems
    + * use d-cache-size, etc. Check on initialization for which type we have, and
    + * return the appropriate structure type. Assume it's embedded if it isn't
    + * open firmware. If it's yet a 3rd type, then there will be missing entries
    + * in /sys/devices/system/cpu/cpu0/cache/index2/, and this code will need
    + * to be extended further.
    + */
    +static int cache_is_unified_d(const struct device_node *np)
    {
    - struct cache *cache;
    + return of_get_property(np,
    + cache_type_info[CACHE_TYPE_UNIFIED_D].size_prop, NULL) ?
    + CACHE_TYPE_UNIFIED_D : CACHE_TYPE_UNIFIED;
    +}

    +static struct cache *__cpuinit cache_do_one_devnode_unified(struct device_node *node, int level)
    +{
    pr_debug("creating L%d ucache for %s\n", level, node->full_name);

    - cache = new_cache(CACHE_TYPE_UNIFIED, level, node);
    -
    - return cache;
    + return new_cache(cache_is_unified_d(node), level, node);
    }

    static struct cache *__cpuinit cache_do_one_devnode_split(struct device_node *node, int level)
    diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S
    index 7703569..6be807d 100644
    --- a/arch/powerpc/kernel/vmlinux.lds.S
    +++ b/arch/powerpc/kernel/vmlinux.lds.S
    @@ -213,6 +213,7 @@ SECTIONS
    *(.opd)
    }

    + . = ALIGN(256);
    .got : AT(ADDR(.got) - LOAD_OFFSET) {
    __toc_start = .;
    *(.got)
    diff --git a/arch/powerpc/perf/callchain.c b/arch/powerpc/perf/callchain.c
    index e8a18d1..a9bd794 100644
    --- a/arch/powerpc/perf/callchain.c
    +++ b/arch/powerpc/perf/callchain.c
    @@ -243,7 +243,7 @@ static void perf_callchain_user_64(struct perf_callchain_entry *entry,
    sp = regs->gpr[1];
    perf_callchain_store(entry, next_ip);

    - for (;;) {
    + while (entry->nr < PERF_MAX_STACK_DEPTH) {
    fp = (unsigned long __user *) sp;
    if (!valid_user_sp(sp, 1) || read_user_stack_64(fp, &next_sp))
    return;
    diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c
    index 0f1b706..2767276 100644
    --- a/arch/powerpc/platforms/pseries/dlpar.c
    +++ b/arch/powerpc/platforms/pseries/dlpar.c
    @@ -416,6 +416,12 @@ static ssize_t dlpar_cpu_probe(const char *buf, size_t count)
    goto out;
    }

    + rc = dlpar_acquire_drc(drc_index);
    + if (rc) {
    + rc = -EINVAL;
    + goto out;
    + }
    +
    dn = dlpar_configure_connector(drc_index);
    if (!dn) {
    rc = -EINVAL;
    @@ -436,13 +442,6 @@ static ssize_t dlpar_cpu_probe(const char *buf, size_t count)
    kfree(dn->full_name);
    dn->full_name = cpu_name;

    - rc = dlpar_acquire_drc(drc_index);
    - if (rc) {
    - dlpar_free_cc_nodes(dn);
    - rc = -EINVAL;
    - goto out;
    - }
    -
    rc = dlpar_attach_node(dn);
    if (rc) {
    dlpar_release_drc(drc_index);
    diff --git a/arch/s390/crypto/ghash_s390.c b/arch/s390/crypto/ghash_s390.c
    index b1bd170..c4a954e 100644
    --- a/arch/s390/crypto/ghash_s390.c
    +++ b/arch/s390/crypto/ghash_s390.c
    @@ -16,11 +16,12 @@
    #define GHASH_DIGEST_SIZE 16

    struct ghash_ctx {
    - u8 icv[16];
    - u8 key[16];
    + u8 key[GHASH_BLOCK_SIZE];
    };

    struct ghash_desc_ctx {
    + u8 icv[GHASH_BLOCK_SIZE];
    + u8 key[GHASH_BLOCK_SIZE];
    u8 buffer[GHASH_BLOCK_SIZE];
    u32 bytes;
    };
    @@ -28,8 +29,10 @@ struct ghash_desc_ctx {
    static int ghash_init(struct shash_desc *desc)
    {
    struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
    + struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm);

    memset(dctx, 0, sizeof(*dctx));
    + memcpy(dctx->key, ctx->key, GHASH_BLOCK_SIZE);

    return 0;
    }
    @@ -45,7 +48,6 @@ static int ghash_setkey(struct crypto_shash *tfm,
    }

    memcpy(ctx->key, key, GHASH_BLOCK_SIZE);
    - memset(ctx->icv, 0, GHASH_BLOCK_SIZE);

    return 0;
    }
    @@ -54,7 +56,6 @@ static int ghash_update(struct shash_desc *desc,
    const u8 *src, unsigned int srclen)
    {
    struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
    - struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm);
    unsigned int n;
    u8 *buf = dctx->buffer;
    int ret;
    @@ -70,7 +71,7 @@ static int ghash_update(struct shash_desc *desc,
    src += n;

    if (!dctx->bytes) {
    - ret = crypt_s390_kimd(KIMD_GHASH, ctx, buf,
    + ret = crypt_s390_kimd(KIMD_GHASH, dctx, buf,
    GHASH_BLOCK_SIZE);
    BUG_ON(ret != GHASH_BLOCK_SIZE);
    }
    @@ -78,7 +79,7 @@ static int ghash_update(struct shash_desc *desc,

    n = srclen & ~(GHASH_BLOCK_SIZE - 1);
    if (n) {
    - ret = crypt_s390_kimd(KIMD_GHASH, ctx, src, n);
    + ret = crypt_s390_kimd(KIMD_GHASH, dctx, src, n);
    BUG_ON(ret != n);
    src += n;
    srclen -= n;
    @@ -92,7 +93,7 @@ static int ghash_update(struct shash_desc *desc,
    return 0;
    }

    -static void ghash_flush(struct ghash_ctx *ctx, struct ghash_desc_ctx *dctx)
    +static int ghash_flush(struct ghash_desc_ctx *dctx)
    {
    u8 *buf = dctx->buffer;
    int ret;
    @@ -102,19 +103,18 @@ static void ghash_flush(struct ghash_ctx *ctx, struct ghash_desc_ctx *dctx)

    memset(pos, 0, dctx->bytes);

    - ret = crypt_s390_kimd(KIMD_GHASH, ctx, buf, GHASH_BLOCK_SIZE);
    + ret = crypt_s390_kimd(KIMD_GHASH, dctx, buf, GHASH_BLOCK_SIZE);
    BUG_ON(ret != GHASH_BLOCK_SIZE);
    - }

    - dctx->bytes = 0;
    + dctx->bytes = 0;
    + }
    }

    static int ghash_final(struct shash_desc *desc, u8 *dst)
    {
    struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
    - struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm);

    - ghash_flush(ctx, dctx);
    + ghash_flush(dctx);
    memcpy(dst, ctx->icv, GHASH_BLOCK_SIZE);

    return 0;
    diff --git a/arch/s390/kernel/suspend.c b/arch/s390/kernel/suspend.c
    index aa1494d..4206804 100644
    --- a/arch/s390/kernel/suspend.c
    +++ b/arch/s390/kernel/suspend.c
    @@ -9,6 +9,8 @@
    #include <linux/pfn.h>
    #include <linux/suspend.h>
    #include <linux/mm.h>
    +#include <asm/ipl.h>
    +#include <asm/sections.h>
    #include <asm/ctl_reg.h>

    /*
    @@ -137,6 +139,8 @@ int pfn_is_nosave(unsigned long pfn)
    {
    unsigned long nosave_begin_pfn = PFN_DOWN(__pa(&__nosave_begin));
    unsigned long nosave_end_pfn = PFN_DOWN(__pa(&__nosave_end));
    + unsigned long eshared_pfn = PFN_DOWN(__pa(&_eshared)) - 1;
    + unsigned long stext_pfn = PFN_DOWN(__pa(&_stext));

    /* Always save lowcore pages (LC protection might be enabled). */
    if (pfn <= LC_PAGES)
    @@ -144,6 +148,8 @@ int pfn_is_nosave(unsigned long pfn)
    if (pfn >= nosave_begin_pfn && pfn < nosave_end_pfn)
    return 1;
    /* Skip memory holes and read-only pages (NSS, DCSS, ...). */
    + if (pfn >= stext_pfn && pfn <= eshared_pfn)
    + return ipl_info.type == IPL_TYPE_NSS ? 1 : 0;
    if (tprot(PFN_PHYS(pfn)))
    return 1;
    return 0;
    diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c
    index e5a45db..f641458 100644
    --- a/arch/s390/kvm/priv.c
    +++ b/arch/s390/kvm/priv.c
    @@ -218,6 +218,7 @@ static void handle_stsi_3_2_2(struct kvm_vcpu *vcpu, struct sysinfo_3_2_2 *mem)
    for (n = mem->count - 1; n > 0 ; n--)
    memcpy(&mem->vm[n], &mem->vm[n - 1], sizeof(mem->vm[0]));

    + memset(&mem->vm[0], 0, sizeof(mem->vm[0]));
    mem->vm[0].cpus_total = cpus;
    mem->vm[0].cpus_configured = cpus;
    mem->vm[0].cpus_standby = 0;
    diff --git a/arch/x86/include/asm/i387.h b/arch/x86/include/asm/i387.h
    index 257d9cc..1262fb6 100644
    --- a/arch/x86/include/asm/i387.h
    +++ b/arch/x86/include/asm/i387.h
    @@ -23,8 +23,32 @@ extern int dump_fpu(struct pt_regs *, struct user_i387_struct *);
    extern void math_state_restore(void);

    extern bool irq_fpu_usable(void);
    -extern void kernel_fpu_begin(void);
    -extern void kernel_fpu_end(void);
    +
    +/*
    + * Careful: __kernel_fpu_begin/end() must be called with preempt disabled
    + * and they don't touch the preempt state on their own.
    + * If you enable preemption after __kernel_fpu_begin(), preempt notifier
    + * should call the __kernel_fpu_end() to prevent the kernel/user FPU
    + * state from getting corrupted. KVM for example uses this model.
    + *
    + * All other cases use kernel_fpu_begin/end() which disable preemption
    + * during kernel FPU usage.
    + */
    +extern void __kernel_fpu_begin(void);
    +extern void __kernel_fpu_end(void);
    +
    +static inline void kernel_fpu_begin(void)
    +{
    + WARN_ON_ONCE(!irq_fpu_usable());
    + preempt_disable();
    + __kernel_fpu_begin();
    +}
    +
    +static inline void kernel_fpu_end(void)
    +{
    + __kernel_fpu_end();
    + preempt_enable();
    +}

    /*
    * Some instructions like VIA's padlock instructions generate a spurious
    diff --git a/arch/x86/include/asm/iommu_table.h b/arch/x86/include/asm/iommu_table.h
    index f229b13..0c54822 100644
    --- a/arch/x86/include/asm/iommu_table.h
    +++ b/arch/x86/include/asm/iommu_table.h
    @@ -79,11 +79,12 @@ struct iommu_table_entry {
    * d). Similar to the 'init', except that this gets called from pci_iommu_init
    * where we do have a memory allocator.
    *
    - * The standard vs the _FINISH differs in that the _FINISH variant will
    - * continue detecting other IOMMUs in the call list after the
    - * the detection routine returns a positive number. The _FINISH will
    - * stop the execution chain. Both will still call the 'init' and
    - * 'late_init' functions if they are set.
    + * The standard IOMMU_INIT differs from the IOMMU_INIT_FINISH variant
    + * in that the former will continue detecting other IOMMUs in the call
    + * list after the detection routine returns a positive number, while the
    + * latter will stop the execution chain upon first successful detection.
    + * Both variants will still call the 'init' and 'late_init' functions if
    + * they are set.
    */
    #define IOMMU_INIT_FINISH(_detect, _depend, _init, _late_init) \
    __IOMMU_INIT(_detect, _depend, _init, _late_init, 1)
    diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
    index 0d2db0e..9eeaed4 100644
    --- a/arch/x86/kernel/cpu/mcheck/mce.c
    +++ b/arch/x86/kernel/cpu/mcheck/mce.c
    @@ -652,11 +652,14 @@ EXPORT_SYMBOL_GPL(machine_check_poll);
    static int mce_no_way_out(struct mce *m, char **msg)
    {
    int i;
    + char *tmp;

    for (i = 0; i < banks; i++) {
    m->status = mce_rdmsrl(MSR_IA32_MCx_STATUS(i));
    - if (mce_severity(m, tolerant, msg) >= MCE_PANIC_SEVERITY)
    + if (mce_severity(m, tolerant, &tmp) >= MCE_PANIC_SEVERITY) {
    + *msg = tmp;
    return 1;
    + }
    }
    return 0;
    }
    diff --git a/arch/x86/kernel/i387.c b/arch/x86/kernel/i387.c
    index 6610e81..7aa728d 100644
    --- a/arch/x86/kernel/i387.c
    +++ b/arch/x86/kernel/i387.c
    @@ -77,29 +77,26 @@ bool irq_fpu_usable(void)
    }
    EXPORT_SYMBOL(irq_fpu_usable);

    -void kernel_fpu_begin(void)
    +void __kernel_fpu_begin(void)
    {
    struct task_struct *me = current;

    - WARN_ON_ONCE(!irq_fpu_usable());
    - preempt_disable();
    if (__thread_has_fpu(me)) {
    __save_init_fpu(me);
    __thread_clear_has_fpu(me);
    - /* We do 'stts()' in kernel_fpu_end() */
    + /* We do 'stts()' in __kernel_fpu_end() */
    } else {
    percpu_write(fpu_owner_task, NULL);
    clts();
    }
    }
    -EXPORT_SYMBOL(kernel_fpu_begin);
    +EXPORT_SYMBOL(__kernel_fpu_begin);

    -void kernel_fpu_end(void)
    +void __kernel_fpu_end(void)
    {
    stts();
    - preempt_enable();
    }
    -EXPORT_SYMBOL(kernel_fpu_end);
    +EXPORT_SYMBOL(__kernel_fpu_end);

    void unlazy_fpu(struct task_struct *tsk)
    {
    diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
    index 84f4bca..2da1a8c 100644
    --- a/arch/x86/kvm/mmu.c
    +++ b/arch/x86/kvm/mmu.c
    @@ -3658,7 +3658,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
    ++vcpu->kvm->stat.mmu_pte_write;
    kvm_mmu_audit(vcpu, AUDIT_PRE_PTE_WRITE);

    - mask.cr0_wp = mask.cr4_pae = mask.nxe = 1;
    + mask.cr0_wp = mask.cr4_pae = mask.nxe = mask.smep_andnot_wp = 1;
    for_each_gfn_indirect_valid_sp(vcpu->kvm, sp, gfn, node) {
    if (detect_write_misaligned(sp, gpa, bytes) ||
    detect_write_flooding(sp)) {
    diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
    index 2eb4e5a..4ad0d71 100644
    --- a/arch/x86/kvm/vmx.c
    +++ b/arch/x86/kvm/vmx.c
    @@ -1455,8 +1455,12 @@ static void __vmx_load_host_state(struct vcpu_vmx *vmx)
    #ifdef CONFIG_X86_64
    wrmsrl(MSR_KERNEL_GS_BASE, vmx->msr_host_kernel_gs_base);
    #endif
    - if (user_has_fpu())
    - clts();
    + /*
    + * If the FPU is not active (through the host task or
    + * the guest vcpu), then restore the cr0.TS bit.
    + */
    + if (!user_has_fpu() && !vmx->vcpu.guest_fpu_loaded)
    + stts();
    load_gdt(&__get_cpu_var(host_gdt));
    }

    @@ -3633,7 +3637,7 @@ static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
    struct desc_ptr dt;
    unsigned long cr4;

    - vmcs_writel(HOST_CR0, read_cr0() | X86_CR0_TS); /* 22.2.3 */
    + vmcs_writel(HOST_CR0, read_cr0() & ~X86_CR0_TS); /* 22.2.3 */
    vmcs_writel(HOST_CR3, read_cr3()); /* 22.2.3 FIXME: shadow tables */

    /* Save the most likely value for this task's CR4 in the VMCS. */
    diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
    index 318a245..4ad2b7b 100644
    --- a/arch/x86/kvm/x86.c
    +++ b/arch/x86/kvm/x86.c
    @@ -5907,7 +5907,7 @@ void kvm_load_guest_fpu(struct kvm_vcpu *vcpu)
    */
    kvm_put_guest_xcr0(vcpu);
    vcpu->guest_fpu_loaded = 1;
    - unlazy_fpu(current);
    + __kernel_fpu_begin();
    fpu_restore_checking(&vcpu->arch.guest_fpu);
    trace_kvm_fpu(1);
    }
    @@ -5921,6 +5921,7 @@ void kvm_put_guest_fpu(struct kvm_vcpu *vcpu)

    vcpu->guest_fpu_loaded = 0;
    fpu_save_init(&vcpu->arch.guest_fpu);
    + __kernel_fpu_end();
    ++vcpu->stat.fpu_reload;
    kvm_make_request(KVM_REQ_DEACTIVATE_FPU, vcpu);
    trace_kvm_fpu(0);
    diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
    index 0597f95..95f9934 100644
    --- a/arch/x86/net/bpf_jit_comp.c
    +++ b/arch/x86/net/bpf_jit_comp.c
    @@ -155,7 +155,12 @@ void bpf_jit_compile(struct sk_filter *fp)
    }
    cleanup_addr = proglen; /* epilogue address */

    - for (pass = 0; pass < 10; pass++) {
    + /* JITed image shrinks with every pass and the loop iterates
    + * until the image stops shrinking. Very large bpf programs
    + * may converge on the last pass. In such case do one more
    + * pass to emit the final image
    + */
    + for (pass = 0; pass < 10 || image; pass++) {
    u8 seen_or_pass0 = (pass == 0) ? (SEEN_XREG | SEEN_DATAREF | SEEN_MEM) : seen;
    /* no prologue/epilogue for trivial filters (RET something) */
    proglen = 0;
    diff --git a/block/genhd.c b/block/genhd.c
    index 7a2a8dc..618ca1a 100644
    --- a/block/genhd.c
    +++ b/block/genhd.c
    @@ -420,13 +420,13 @@ int blk_alloc_devt(struct hd_struct *part, dev_t *devt)
    do {
    if (!idr_pre_get(&ext_devt_idr, GFP_KERNEL))
    return -ENOMEM;
    - spin_lock(&ext_devt_lock);
    + spin_lock_bh(&ext_devt_lock);
    rc = idr_get_new(&ext_devt_idr, part, &idx);
    if (!rc && idx >= NR_EXT_DEVT) {
    idr_remove(&ext_devt_idr, idx);
    rc = -EBUSY;
    }
    - spin_unlock(&ext_devt_lock);
    + spin_unlock_bh(&ext_devt_lock);
    } while (rc == -EAGAIN);

    if (rc)
    @@ -451,9 +451,9 @@ void blk_free_devt(dev_t devt)
    return;

    if (MAJOR(devt) == BLOCK_EXT_MAJOR) {
    - spin_lock(&ext_devt_lock);
    + spin_lock_bh(&ext_devt_lock);
    idr_remove(&ext_devt_idr, blk_mangle_minor(MINOR(devt)));
    - spin_unlock(&ext_devt_lock);
    + spin_unlock_bh(&ext_devt_lock);
    }
    }

    @@ -684,13 +684,13 @@ struct gendisk *get_gendisk(dev_t devt, int *partno)
    } else {
    struct hd_struct *part;

    - spin_lock(&ext_devt_lock);
    + spin_lock_bh(&ext_devt_lock);
    part = idr_find(&ext_devt_idr, blk_mangle_minor(MINOR(devt)));
    if (part && get_disk(part_to_disk(part))) {
    *partno = part->partno;
    disk = part_to_disk(part);
    }
    - spin_unlock(&ext_devt_lock);
    + spin_unlock_bh(&ext_devt_lock);
    }

    return disk;
    diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
    index 6fc61eb..1338f1f 100644
    --- a/drivers/ata/ahci.c
    +++ b/drivers/ata/ahci.c
    @@ -67,6 +67,7 @@ enum board_ids {
    board_ahci_yes_fbs,

    /* board IDs for specific chipsets in alphabetical order */
    + board_ahci_avn,
    board_ahci_mcp65,
    board_ahci_mcp77,
    board_ahci_mcp89,
    @@ -85,6 +86,8 @@ enum board_ids {
    static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent);
    static int ahci_vt8251_hardreset(struct ata_link *link, unsigned int *class,
    unsigned long deadline);
    +static int ahci_avn_hardreset(struct ata_link *link, unsigned int *class,
    + unsigned long deadline);
    static int ahci_p5wdh_hardreset(struct ata_link *link, unsigned int *class,
    unsigned long deadline);
    #ifdef CONFIG_PM
    @@ -106,6 +109,11 @@ static struct ata_port_operations ahci_p5wdh_ops = {
    .hardreset = ahci_p5wdh_hardreset,
    };

    +static struct ata_port_operations ahci_avn_ops = {
    + .inherits = &ahci_ops,
    + .hardreset = ahci_avn_hardreset,
    +};
    +
    static const struct ata_port_info ahci_port_info[] = {
    /* by features */
    [board_ahci] =
    @@ -154,6 +162,12 @@ static const struct ata_port_info ahci_port_info[] = {
    .port_ops = &ahci_ops,
    },
    /* by chipsets */
    + [board_ahci_avn] = {
    + .flags = AHCI_FLAG_COMMON,
    + .pio_mask = ATA_PIO4,
    + .udma_mask = ATA_UDMA6,
    + .port_ops = &ahci_avn_ops,
    + },
    [board_ahci_mcp65] =
    {
    AHCI_HFLAGS (AHCI_HFLAG_NO_FPDMA_AA | AHCI_HFLAG_NO_PMP |
    @@ -300,14 +314,14 @@ static const struct pci_device_id ahci_pci_tbl[] = {
    { PCI_VDEVICE(INTEL, 0x1f27), board_ahci }, /* Avoton RAID */
    { PCI_VDEVICE(INTEL, 0x1f2e), board_ahci }, /* Avoton RAID */
    { PCI_VDEVICE(INTEL, 0x1f2f), board_ahci }, /* Avoton RAID */
    - { PCI_VDEVICE(INTEL, 0x1f32), board_ahci }, /* Avoton AHCI */
    - { PCI_VDEVICE(INTEL, 0x1f33), board_ahci }, /* Avoton AHCI */
    - { PCI_VDEVICE(INTEL, 0x1f34), board_ahci }, /* Avoton RAID */
    - { PCI_VDEVICE(INTEL, 0x1f35), board_ahci }, /* Avoton RAID */
    - { PCI_VDEVICE(INTEL, 0x1f36), board_ahci }, /* Avoton RAID */
    - { PCI_VDEVICE(INTEL, 0x1f37), board_ahci }, /* Avoton RAID */
    - { PCI_VDEVICE(INTEL, 0x1f3e), board_ahci }, /* Avoton RAID */
    - { PCI_VDEVICE(INTEL, 0x1f3f), board_ahci }, /* Avoton RAID */
    + { PCI_VDEVICE(INTEL, 0x1f32), board_ahci_avn }, /* Avoton AHCI */
    + { PCI_VDEVICE(INTEL, 0x1f33), board_ahci_avn }, /* Avoton AHCI */
    + { PCI_VDEVICE(INTEL, 0x1f34), board_ahci_avn }, /* Avoton RAID */
    + { PCI_VDEVICE(INTEL, 0x1f35), board_ahci_avn }, /* Avoton RAID */
    + { PCI_VDEVICE(INTEL, 0x1f36), board_ahci_avn }, /* Avoton RAID */
    + { PCI_VDEVICE(INTEL, 0x1f37), board_ahci_avn }, /* Avoton RAID */
    + { PCI_VDEVICE(INTEL, 0x1f3e), board_ahci_avn }, /* Avoton RAID */
    + { PCI_VDEVICE(INTEL, 0x1f3f), board_ahci_avn }, /* Avoton RAID */
    { PCI_VDEVICE(INTEL, 0x8d02), board_ahci }, /* Wellsburg AHCI */
    { PCI_VDEVICE(INTEL, 0x8d04), board_ahci }, /* Wellsburg RAID */
    { PCI_VDEVICE(INTEL, 0x8d06), board_ahci }, /* Wellsburg RAID */
    @@ -671,6 +685,78 @@ static int ahci_p5wdh_hardreset(struct ata_link *link, unsigned int *class,
    return rc;
    }

    +/*
    + * ahci_avn_hardreset - attempt more aggressive recovery of Avoton ports.
    + *
    + * It has been observed with some SSDs that the timing of events in the
    + * link synchronization phase can leave the port in a state that can not
    + * be recovered by a SATA-hard-reset alone. The failing signature is
    + * SStatus.DET stuck at 1 ("Device presence detected but Phy
    + * communication not established"). It was found that unloading and
    + * reloading the driver when this problem occurs allows the drive
    + * connection to be recovered (DET advanced to 0x3). The critical
    + * component of reloading the driver is that the port state machines are
    + * reset by bouncing "port enable" in the AHCI PCS configuration
    + * register. So, reproduce that effect by bouncing a port whenever we
    + * see DET==1 after a reset.
    + */
    +static int ahci_avn_hardreset(struct ata_link *link, unsigned int *class,
    + unsigned long deadline)
    +{
    + const unsigned long *timing = sata_ehc_deb_timing(&link->eh_context);
    + struct ata_port *ap = link->ap;
    + struct ahci_port_priv *pp = ap->private_data;
    + u8 *d2h_fis = pp->rx_fis + RX_FIS_D2H_REG;
    + unsigned long tmo = deadline - jiffies;
    + struct ata_taskfile tf;
    + bool online;
    + int rc, i;
    +
    + DPRINTK("ENTER\n");
    +
    + ahci_stop_engine(ap);
    +
    + for (i = 0; i < 2; i++) {
    + u16 val;
    + u32 sstatus;
    + int port = ap->port_no;
    + struct ata_host *host = ap->host;
    + struct pci_dev *pdev = to_pci_dev(host->dev);
    +
    + /* clear D2H reception area to properly wait for D2H FIS */
    + ata_tf_init(link->device, &tf);
    + tf.command = ATA_BUSY;
    + ata_tf_to_fis(&tf, 0, 0, d2h_fis);
    +
    + rc = sata_link_hardreset(link, timing, deadline, &online,
    + ahci_check_ready);
    +
    + if (sata_scr_read(link, SCR_STATUS, &sstatus) != 0 ||
    + (sstatus & 0xf) != 1)
    + break;
    +
    + ata_link_printk(link, KERN_INFO, "avn bounce port%d\n",
    + port);
    +
    + pci_read_config_word(pdev, 0x92, &val);
    + val &= ~(1 << port);
    + pci_write_config_word(pdev, 0x92, val);
    + ata_msleep(ap, 1000);
    + val |= 1 << port;
    + pci_write_config_word(pdev, 0x92, val);
    + deadline += tmo;
    + }
    +
    + ahci_start_engine(ap);
    +
    + if (online)
    + *class = ahci_dev_classify(ap);
    +
    + DPRINTK("EXIT, rc=%d, class=%u\n", rc, *class);
    + return rc;
    +}
    +
    +
    #ifdef CONFIG_PM
    static int ahci_pci_device_suspend(struct pci_dev *pdev, pm_message_t mesg)
    {
    diff --git a/drivers/ata/ahci.h b/drivers/ata/ahci.h
    index c2594dd..57eb1c2 100644
    --- a/drivers/ata/ahci.h
    +++ b/drivers/ata/ahci.h
    @@ -320,6 +320,7 @@ extern struct device_attribute *ahci_sdev_attrs[];
    extern struct ata_port_operations ahci_ops;
    extern struct ata_port_operations ahci_pmp_retry_srst_ops;

    +unsigned int ahci_dev_classify(struct ata_port *ap);
    void ahci_fill_cmd_slot(struct ahci_port_priv *pp, unsigned int tag,
    u32 opts);
    void ahci_save_initial_config(struct device *dev,
    diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
    index 60f41cd..30cdba7 100644
    --- a/drivers/ata/libahci.c
    +++ b/drivers/ata/libahci.c
    @@ -1139,7 +1139,7 @@ static void ahci_dev_config(struct ata_device *dev)
    }
    }

    -static unsigned int ahci_dev_classify(struct ata_port *ap)
    +unsigned int ahci_dev_classify(struct ata_port *ap)
    {
    void __iomem *port_mmio = ahci_port_base(ap);
    struct ata_taskfile tf;
    @@ -1153,6 +1153,7 @@ static unsigned int ahci_dev_classify(struct ata_port *ap)

    return ata_dev_classify(&tf);
    }
    +EXPORT_SYMBOL_GPL(ahci_dev_classify);

    void ahci_fill_cmd_slot(struct ahci_port_priv *pp, unsigned int tag,
    u32 opts)
    @@ -1670,8 +1671,7 @@ static void ahci_port_intr(struct ata_port *ap)
    if (unlikely(resetting))
    status &= ~PORT_IRQ_BAD_PMP;

    - /* if LPM is enabled, PHYRDY doesn't mean anything */
    - if (ap->link.lpm_policy > ATA_LPM_MAX_POWER) {
    + if (sata_lpm_ignore_phy_events(&ap->link)) {
    status &= ~PORT_IRQ_PHYRDY;
    ahci_scr_write(&ap->link, SCR_ERROR, SERR_PHYRDY_CHG);
    }
    diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
    index adaf994..0a6767b 100644
    --- a/drivers/ata/libata-core.c
    +++ b/drivers/ata/libata-core.c
    @@ -6657,6 +6657,38 @@ u32 ata_wait_register(struct ata_port *ap, void __iomem *reg, u32 mask, u32 val,
    return tmp;
    }

    +/**
    + * sata_lpm_ignore_phy_events - test if PHY event should be ignored
    + * @link: Link receiving the event
    + *
    + * Test whether the received PHY event has to be ignored or not.
    + *
    + * LOCKING:
    + * None:
    + *
    + * RETURNS:
    + * True if the event has to be ignored.
    + */
    +bool sata_lpm_ignore_phy_events(struct ata_link *link)
    +{
    + unsigned long lpm_timeout = link->last_lpm_change +
    + msecs_to_jiffies(ATA_TMOUT_SPURIOUS_PHY);
    +
    + /* if LPM is enabled, PHYRDY doesn't mean anything */
    + if (link->lpm_policy > ATA_LPM_MAX_POWER)
    + return true;
    +
    + /* ignore the first PHY event after the LPM policy changed
    + * as it is might be spurious
    + */
    + if ((link->flags & ATA_LFLAG_CHANGED) &&
    + time_before(jiffies, lpm_timeout))
    + return true;
    +
    + return false;
    +}
    +EXPORT_SYMBOL_GPL(sata_lpm_ignore_phy_events);
    +
    /*
    * Dummy port_ops
    */
    diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
    index 37fb4d6..033b8cd 100644
    --- a/drivers/ata/libata-eh.c
    +++ b/drivers/ata/libata-eh.c
    @@ -3424,6 +3424,9 @@ static int ata_eh_set_lpm(struct ata_link *link, enum ata_lpm_policy policy,
    }
    }

    + link->last_lpm_change = jiffies;
    + link->flags |= ATA_LFLAG_CHANGED;
    +
    return 0;

    fail:
    diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
    index 8a084bf..52be498 100644
    --- a/drivers/bluetooth/ath3k.c
    +++ b/drivers/bluetooth/ath3k.c
    @@ -64,6 +64,7 @@ static struct usb_device_id ath3k_table[] = {
    /* Atheros AR3011 with sflash firmware*/
    { USB_DEVICE(0x0489, 0xE027) },
    { USB_DEVICE(0x0489, 0xE03D) },
    + { USB_DEVICE(0x04F2, 0xAFF1) },
    { USB_DEVICE(0x0930, 0x0215) },
    { USB_DEVICE(0x0CF3, 0x3002) },
    { USB_DEVICE(0x0CF3, 0xE019) },
    diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
    index 7c0b21e..f8a58db 100644
    --- a/drivers/bluetooth/btusb.c
    +++ b/drivers/bluetooth/btusb.c
    @@ -142,6 +142,7 @@ static struct usb_device_id blacklist_table[] = {
    /* Atheros 3011 with sflash firmware */
    { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE },
    { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
    + { USB_DEVICE(0x04f2, 0xaff1), .driver_info = BTUSB_IGNORE },
    { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
    { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE },
    { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE },
    diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
    index bdecba5..e539949 100644
    --- a/drivers/char/ipmi/ipmi_si_intf.c
    +++ b/drivers/char/ipmi/ipmi_si_intf.c
    @@ -2668,7 +2668,7 @@ static int wait_for_msg_done(struct smi_info *smi_info)
    smi_result == SI_SM_CALL_WITH_TICK_DELAY) {
    schedule_timeout_uninterruptible(1);
    smi_result = smi_info->handlers->event(
    - smi_info->si_sm, 100);
    + smi_info->si_sm, jiffies_to_usecs(1));
    } else if (smi_result == SI_SM_CALL_WITHOUT_DELAY) {
    smi_result = smi_info->handlers->event(
    smi_info->si_sm, 0);
    diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
    index b1f1d10..e1c744d 100644
    --- a/drivers/gpu/drm/i915/i915_gem.c
    +++ b/drivers/gpu/drm/i915/i915_gem.c
    @@ -1779,9 +1779,6 @@ i915_gem_retire_requests_ring(struct intel_ring_buffer *ring)
    uint32_t seqno;
    int i;

    - if (list_empty(&ring->request_list))
    - return;
    -
    WARN_ON(i915_verify_lists(ring->dev));

    seqno = ring->get_seqno(ring);
    diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
    index d51c08d..af6790c 100644
    --- a/drivers/gpu/drm/radeon/atombios_crtc.c
    +++ b/drivers/gpu/drm/radeon/atombios_crtc.c
    @@ -318,8 +318,10 @@ atombios_set_crtc_dtd_timing(struct drm_crtc *crtc,
    misc |= ATOM_COMPOSITESYNC;
    if (mode->flags & DRM_MODE_FLAG_INTERLACE)
    misc |= ATOM_INTERLACE;
    - if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
    + if (mode->flags & DRM_MODE_FLAG_DBLCLK)
    misc |= ATOM_DOUBLE_CLOCK_MODE;
    + if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
    + misc |= ATOM_H_REPLICATIONBY2 | ATOM_V_REPLICATIONBY2;

    args.susModeMiscInfo.usAccess = cpu_to_le16(misc);
    args.ucCRTC = radeon_crtc->crtc_id;
    @@ -362,8 +364,10 @@ static void atombios_crtc_set_timing(struct drm_crtc *crtc,
    misc |= ATOM_COMPOSITESYNC;
    if (mode->flags & DRM_MODE_FLAG_INTERLACE)
    misc |= ATOM_INTERLACE;
    - if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
    + if (mode->flags & DRM_MODE_FLAG_DBLCLK)
    misc |= ATOM_DOUBLE_CLOCK_MODE;
    + if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
    + misc |= ATOM_H_REPLICATIONBY2 | ATOM_V_REPLICATIONBY2;

    args.susModeMiscInfo.usAccess = cpu_to_le16(misc);
    args.ucCRTC = radeon_crtc->crtc_id;
    diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
    index c5fe79e..db4df97 100644
    --- a/drivers/gpu/drm/radeon/evergreen.c
    +++ b/drivers/gpu/drm/radeon/evergreen.c
    @@ -1079,7 +1079,7 @@ int evergreen_pcie_gart_enable(struct radeon_device *rdev)
    WREG32(MC_VM_MB_L1_TLB2_CNTL, tmp);
    WREG32(MC_VM_MB_L1_TLB3_CNTL, tmp);
    WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
    - WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
    + WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
    WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
    WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) |
    RANGE_PROTECTION_FAULT_ENABLE_DEFAULT);
    diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
    index 461262e..1f45179 100644
    --- a/drivers/gpu/drm/radeon/ni.c
    +++ b/drivers/gpu/drm/radeon/ni.c
    @@ -1075,7 +1075,7 @@ int cayman_pcie_gart_enable(struct radeon_device *rdev)
    L2_CACHE_BIGK_FRAGMENT_SIZE(6));
    /* setup context0 */
    WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
    - WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
    + WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
    WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
    WREG32(VM_CONTEXT0_PROTECTION_FAULT_DEFAULT_ADDR,
    (u32)(rdev->dummy_page.addr >> 12));
    diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
    index 9c7062d..d441aed 100644
    --- a/drivers/gpu/drm/radeon/r600.c
    +++ b/drivers/gpu/drm/radeon/r600.c
    @@ -930,7 +930,7 @@ int r600_pcie_gart_enable(struct radeon_device *rdev)
    WREG32(MC_VM_L1_TLB_MCB_RD_SEM_CNTL, tmp | ENABLE_SEMAPHORE_MODE);
    WREG32(MC_VM_L1_TLB_MCB_WR_SEM_CNTL, tmp | ENABLE_SEMAPHORE_MODE);
    WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
    - WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
    + WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
    WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
    WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) |
    RANGE_PROTECTION_FAULT_ENABLE_DEFAULT);
    diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
    index f3ee360..d66d2cd 100644
    --- a/drivers/gpu/drm/radeon/radeon_cs.c
    +++ b/drivers/gpu/drm/radeon/radeon_cs.c
    @@ -49,7 +49,7 @@ int radeon_cs_parser_relocs(struct radeon_cs_parser *p)
    if (p->relocs_ptr == NULL) {
    return -ENOMEM;
    }
    - p->relocs = kcalloc(p->nrelocs, sizeof(struct radeon_cs_reloc), GFP_KERNEL);
    + p->relocs = drm_calloc_large(p->nrelocs, sizeof(struct radeon_bo_list));
    if (p->relocs == NULL) {
    return -ENOMEM;
    }
    @@ -324,7 +324,7 @@ static void radeon_cs_parser_fini(struct radeon_cs_parser *parser, int error)
    }
    }
    kfree(parser->track);
    - kfree(parser->relocs);
    + drm_free_large(parser->relocs);
    kfree(parser->relocs_ptr);
    for (i = 0; i < parser->nchunks; i++) {
    kfree(parser->chunks[i].kdata);
    diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
    index 1ec1255..3358730 100644
    --- a/drivers/gpu/drm/radeon/rv770.c
    +++ b/drivers/gpu/drm/radeon/rv770.c
    @@ -158,7 +158,7 @@ int rv770_pcie_gart_enable(struct radeon_device *rdev)
    WREG32(MC_VM_MB_L1_TLB2_CNTL, tmp);
    WREG32(MC_VM_MB_L1_TLB3_CNTL, tmp);
    WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
    - WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
    + WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
    WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
    WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) |
    RANGE_PROTECTION_FAULT_ENABLE_DEFAULT);
    diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
    index 068b21f..3b6e641 100644
    --- a/drivers/gpu/drm/radeon/si.c
    +++ b/drivers/gpu/drm/radeon/si.c
    @@ -2537,7 +2537,7 @@ int si_pcie_gart_enable(struct radeon_device *rdev)
    L2_CACHE_BIGK_FRAGMENT_SIZE(0));
    /* setup context0 */
    WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
    - WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
    + WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
    WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
    WREG32(VM_CONTEXT0_PROTECTION_FAULT_DEFAULT_ADDR,
    (u32)(rdev->dummy_page.addr >> 12));
    @@ -2555,7 +2555,7 @@ int si_pcie_gart_enable(struct radeon_device *rdev)
    */
    /* set vm size, must be a multiple of 4 */
    WREG32(VM_CONTEXT1_PAGE_TABLE_START_ADDR, 0);
    - WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn);
    + WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn - 1);
    for (i = 1; i < 16; i++) {
    if (i < 8)
    WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR + (i << 2),
    diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
    index 3c8b2c4..980ef7e 100644
    --- a/drivers/hv/channel.c
    +++ b/drivers/hv/channel.c
    @@ -177,7 +177,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
    GFP_KERNEL);
    if (!open_info) {
    err = -ENOMEM;
    - goto error0;
    + goto error_gpadl;
    }

    init_completion(&open_info->waitevent);
    @@ -193,7 +193,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,

    if (userdatalen > MAX_USER_DEFINED_BYTES) {
    err = -EINVAL;
    - goto error0;
    + goto error_gpadl;
    }

    if (userdatalen)
    @@ -234,6 +234,9 @@ error1:
    list_del(&open_info->msglistentry);
    spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags);

    +error_gpadl:
    + vmbus_teardown_gpadl(newchannel, newchannel->ringbuffer_gpadlhandle);
    +
    error0:
    free_pages((unsigned long)out,
    get_order(send_ringbuffer_size + recv_ringbuffer_size));
    diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
    index 9ffbfc5..bcf67af 100644
    --- a/drivers/hv/channel_mgmt.c
    +++ b/drivers/hv/channel_mgmt.c
    @@ -531,7 +531,7 @@ int vmbus_request_offers(void)
    {
    struct vmbus_channel_message_header *msg;
    struct vmbus_channel_msginfo *msginfo;
    - int ret, t;
    + int ret;

    msginfo = kmalloc(sizeof(*msginfo) +
    sizeof(struct vmbus_channel_message_header),
    @@ -539,8 +539,6 @@ int vmbus_request_offers(void)
    if (!msginfo)
    return -ENOMEM;

    - init_completion(&msginfo->waitevent);
    -
    msg = (struct vmbus_channel_message_header *)msginfo->msg;

    msg->msgtype = CHANNELMSG_REQUESTOFFERS;
    @@ -554,14 +552,6 @@ int vmbus_request_offers(void)
    goto cleanup;
    }

    - t = wait_for_completion_timeout(&msginfo->waitevent, 5*HZ);
    - if (t == 0) {
    - ret = -ETIMEDOUT;
    - goto cleanup;
    - }
    -
    -
    -
    cleanup:
    kfree(msginfo);

    diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
    index 67432e2..8987a9a 100644
    --- a/drivers/infiniband/core/cma.c
    +++ b/drivers/infiniband/core/cma.c
    @@ -759,36 +759,43 @@ static int cma_get_net_info(void *hdr, enum rdma_port_space ps,
    return 0;
    }

    +static __be16 ss_get_port(const struct sockaddr_storage *ss)
    +{
    + if (ss->ss_family == AF_INET)
    + return ((struct sockaddr_in *)ss)->sin_port;
    + else if (ss->ss_family == AF_INET6)
    + return ((struct sockaddr_in6 *)ss)->sin6_port;
    + BUG();
    +}
    +
    static void cma_save_net_info(struct rdma_addr *addr,
    struct rdma_addr *listen_addr,
    u8 ip_ver, __be16 port,
    union cma_ip_addr *src, union cma_ip_addr *dst)
    {
    - struct sockaddr_in *listen4, *ip4;
    - struct sockaddr_in6 *listen6, *ip6;
    + struct sockaddr_in *ip4;
    + struct sockaddr_in6 *ip6;

    switch (ip_ver) {
    case 4:
    - listen4 = (struct sockaddr_in *) &listen_addr->src_addr;
    ip4 = (struct sockaddr_in *) &addr->src_addr;
    - ip4->sin_family = listen4->sin_family;
    + ip4->sin_family = AF_INET;;
    ip4->sin_addr.s_addr = dst->ip4.addr;
    - ip4->sin_port = listen4->sin_port;
    + ip4->sin_port = ss_get_port(&listen_addr->src_addr);

    ip4 = (struct sockaddr_in *) &addr->dst_addr;
    - ip4->sin_family = listen4->sin_family;
    + ip4->sin_family = AF_INET;
    ip4->sin_addr.s_addr = src->ip4.addr;
    ip4->sin_port = port;
    break;
    case 6:
    - listen6 = (struct sockaddr_in6 *) &listen_addr->src_addr;
    ip6 = (struct sockaddr_in6 *) &addr->src_addr;
    - ip6->sin6_family = listen6->sin6_family;
    + ip6->sin6_family = AF_INET6;
    ip6->sin6_addr = dst->ip6;
    - ip6->sin6_port = listen6->sin6_port;
    + ip6->sin6_port = ss_get_port(&listen_addr->src_addr);

    ip6 = (struct sockaddr_in6 *) &addr->dst_addr;
    - ip6->sin6_family = listen6->sin6_family;
    + ip6->sin6_family = AF_INET6;
    ip6->sin6_addr = src->ip6;
    ip6->sin6_port = port;
    break;
    diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
    index d0254be..c1fef27 100644
    --- a/drivers/infiniband/core/umem.c
    +++ b/drivers/infiniband/core/umem.c
    @@ -94,6 +94,9 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
    if (dmasync)
    dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs);

    + if (!size)
    + return ERR_PTR(-EINVAL);
    +
    /*
    * If the combination of the addr and size requested for this memory
    * region causes an integer overflow, return error.
    diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
    index 3a78489..b53548c 100644
    --- a/drivers/infiniband/hw/mlx4/qp.c
    +++ b/drivers/infiniband/hw/mlx4/qp.c
    @@ -1670,8 +1670,7 @@ static int build_lso_seg(struct mlx4_wqe_lso_seg *wqe, struct ib_send_wr *wr,

    memcpy(wqe->header, wr->wr.ud.header, wr->wr.ud.hlen);

    - *lso_hdr_sz = cpu_to_be32((wr->wr.ud.mss - wr->wr.ud.hlen) << 16 |
    - wr->wr.ud.hlen);
    + *lso_hdr_sz = cpu_to_be32(wr->wr.ud.mss << 16 | wr->wr.ud.hlen);
    *lso_seg_len = halign;
    return 0;
    }
    diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
    index f2c2ffe..8eeff9e 100644
    --- a/drivers/input/mouse/elantech.c
    +++ b/drivers/input/mouse/elantech.c
    @@ -313,7 +313,7 @@ static void elantech_report_semi_mt_data(struct input_dev *dev,
    unsigned int x2, unsigned int y2)
    {
    elantech_set_slot(dev, 0, num_fingers != 0, x1, y1);
    - elantech_set_slot(dev, 1, num_fingers == 2, x2, y2);
    + elantech_set_slot(dev, 1, num_fingers >= 2, x2, y2);
    }

    /*
    @@ -783,6 +783,21 @@ static psmouse_ret_t elantech_process_byte(struct psmouse *psmouse)
    }

    /*
    + * This writes the reg_07 value again to the hardware at the end of every
    + * set_rate call because the register loses its value. reg_07 allows setting
    + * absolute mode on v4 hardware
    + */
    +static void elantech_set_rate_restore_reg_07(struct psmouse *psmouse,
    + unsigned int rate)
    +{
    + struct elantech_data *etd = psmouse->private;
    +
    + etd->original_set_rate(psmouse, rate);
    + if (elantech_write_reg(psmouse, 0x07, etd->reg_07))
    + psmouse_err(psmouse, "restoring reg_07 failed\n");
    +}
    +
    +/*
    * Put the touchpad into absolute mode
    */
    static int elantech_set_absolute_mode(struct psmouse *psmouse)
    @@ -980,6 +995,8 @@ static int elantech_get_resolution_v4(struct psmouse *psmouse,
    * Asus K53SV 0x450f01 78, 15, 0c 2 hw buttons
    * Asus G46VW 0x460f02 00, 18, 0c 2 hw buttons
    * Asus G750JX 0x360f00 00, 16, 0c 2 hw buttons
    + * Asus TP500LN 0x381f17 10, 14, 0e clickpad
    + * Asus X750JN 0x381f17 10, 14, 0e clickpad
    * Asus UX31 0x361f00 20, 15, 0e clickpad
    * Asus UX32VD 0x361f02 00, 15, 0e clickpad
    * Avatar AVIU-145A2 0x361f00 ? clickpad
    @@ -1219,10 +1236,11 @@ static bool elantech_is_signature_valid(const unsigned char *param)
    return true;

    /*
    - * Some models have a revision higher then 20. Meaning param[2] may
    - * be 10 or 20, skip the rates check for these.
    + * Some hw_version >= 4 models have a revision higher then 20. Meaning
    + * that param[2] may be 10 or 20, skip the rates check for these.
    */
    - if (param[0] == 0x46 && (param[1] & 0xef) == 0x0f && param[2] < 40)
    + if ((param[0] & 0x0f) >= 0x06 && (param[1] & 0xaf) == 0x0f &&
    + param[2] < 40)
    return true;

    for (i = 0; i < ARRAY_SIZE(rates); i++)
    @@ -1427,6 +1445,11 @@ int elantech_init(struct psmouse *psmouse)
    goto init_fail;
    }

    + if (etd->fw_version == 0x381f17) {
    + etd->original_set_rate = psmouse->set_rate;
    + psmouse->set_rate = elantech_set_rate_restore_reg_07;
    + }
    +
    if (elantech_set_input_params(psmouse)) {
    psmouse_err(psmouse, "failed to query touchpad range.\n");
    goto init_fail;
    diff --git a/drivers/input/mouse/elantech.h b/drivers/input/mouse/elantech.h
    index 46db3be..4d1b220 100644
    --- a/drivers/input/mouse/elantech.h
    +++ b/drivers/input/mouse/elantech.h
    @@ -137,6 +137,7 @@ struct elantech_data {
    struct finger_pos mt[ETP_MAX_FINGERS];
    unsigned char parity[256];
    int (*send_cmd)(struct psmouse *psmouse, unsigned char c, unsigned char *param);
    + void (*original_set_rate)(struct psmouse *psmouse, unsigned int rate);
    };

    #ifdef CONFIG_MOUSE_PS2_ELANTECH
    diff --git a/drivers/lguest/core.c b/drivers/lguest/core.c
    index b5fdcb7..34842e5 100644
    --- a/drivers/lguest/core.c
    +++ b/drivers/lguest/core.c
    @@ -171,7 +171,7 @@ static void unmap_switcher(void)
    bool lguest_address_ok(const struct lguest *lg,
    unsigned long addr, unsigned long len)
    {
    - return (addr+len) / PAGE_SIZE < lg->pfn_limit && (addr+len >= addr);
    + return addr+len <= lg->pfn_limit * PAGE_SIZE && (addr+len >= addr);
    }

    /*
    diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
    index 926989d..a1bd688 100644
    --- a/drivers/md/dm-crypt.c
    +++ b/drivers/md/dm-crypt.c
    @@ -782,11 +782,10 @@ static int crypt_convert(struct crypt_config *cc,

    switch (r) {
    /* async */
    + case -EINPROGRESS:
    case -EBUSY:
    wait_for_completion(&ctx->restart);
    INIT_COMPLETION(ctx->restart);
    - /* fall through*/
    - case -EINPROGRESS:
    this_cc->req = NULL;
    ctx->sector++;
    continue;
    @@ -1195,10 +1194,8 @@ static void kcryptd_async_done(struct crypto_async_request *async_req,
    struct dm_crypt_io *io = container_of(ctx, struct dm_crypt_io, ctx);
    struct crypt_config *cc = io->target->private;

    - if (error == -EINPROGRESS) {
    - complete(&ctx->restart);
    + if (error == -EINPROGRESS)
    return;
    - }

    if (!error && cc->iv_gen_ops && cc->iv_gen_ops->post)
    error = cc->iv_gen_ops->post(cc, iv_of_dmreq(cc, dmreq), dmreq);
    @@ -1209,12 +1206,15 @@ static void kcryptd_async_done(struct crypto_async_request *async_req,
    mempool_free(req_of_dmreq(cc, dmreq), cc->req_pool);

    if (!atomic_dec_and_test(&ctx->pending))
    - return;
    + goto done;

    if (bio_data_dir(io->base_bio) == READ)
    kcryptd_crypt_read_done(io);
    else
    kcryptd_crypt_write_io_submit(io, 1);
    +done:
    + if (!completion_done(&ctx->restart))
    + complete(&ctx->restart);
    }

    static void kcryptd_crypt(struct work_struct *work)
    diff --git a/drivers/md/md.c b/drivers/md/md.c
    index 17e2f52..83dba06 100644
    --- a/drivers/md/md.c
    +++ b/drivers/md/md.c
    @@ -5431,9 +5431,9 @@ static int get_bitmap_file(struct mddev * mddev, void __user * arg)
    int err = -ENOMEM;

    if (md_allow_write(mddev))
    - file = kmalloc(sizeof(*file), GFP_NOIO);
    + file = kzalloc(sizeof(*file), GFP_NOIO);
    else
    - file = kmalloc(sizeof(*file), GFP_KERNEL);
    + file = kzalloc(sizeof(*file), GFP_KERNEL);

    if (!file)
    goto out;
    diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
    index c276ad0..7a218e8 100644
    --- a/drivers/md/raid5.c
    +++ b/drivers/md/raid5.c
    @@ -1622,7 +1622,8 @@ static int resize_stripes(struct r5conf *conf, int newsize)

    conf->slab_cache = sc;
    conf->active_name = 1-conf->active_name;
    - conf->pool_size = newsize;
    + if (!err)
    + conf->pool_size = newsize;
    return err;
    }

    diff --git a/drivers/memstick/core/mspro_block.c b/drivers/memstick/core/mspro_block.c
    index 9729b92..f8449d5 100644
    --- a/drivers/memstick/core/mspro_block.c
    +++ b/drivers/memstick/core/mspro_block.c
    @@ -760,7 +760,7 @@ static int mspro_block_complete_req(struct memstick_dev *card, int error)

    if (error || (card->current_mrq.tpc == MSPRO_CMD_STOP)) {
    if (msb->data_dir == READ) {
    - for (cnt = 0; cnt < msb->current_seg; cnt++)
    + for (cnt = 0; cnt < msb->current_seg; cnt++) {
    t_len += msb->req_sg[cnt].length
    / msb->page_size;

    @@ -768,6 +768,7 @@ static int mspro_block_complete_req(struct memstick_dev *card, int error)
    t_len += msb->current_page - 1;

    t_len *= msb->page_size;
    + }
    }
    } else
    t_len = blk_rq_bytes(msb->block_req);
    diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
    index ba821fe..eef1261 100644
    --- a/drivers/mmc/core/core.c
    +++ b/drivers/mmc/core/core.c
    @@ -2370,6 +2370,7 @@ int mmc_pm_notify(struct notifier_block *notify_block,
    switch (mode) {
    case PM_HIBERNATION_PREPARE:
    case PM_SUSPEND_PREPARE:
    + case PM_RESTORE_PREPARE:

    spin_lock_irqsave(&host->lock, flags);
    host->rescan_disable = 1;
    diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c
    index e6f08d9..c300cc4 100644
    --- a/drivers/mmc/host/atmel-mci.c
    +++ b/drivers/mmc/host/atmel-mci.c
    @@ -1125,7 +1125,7 @@ static void atmci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)

    if (ios->clock) {
    unsigned int clock_min = ~0U;
    - u32 clkdiv;
    + int clkdiv;

    spin_lock_bh(&host->lock);
    if (!host->mode_reg) {
    @@ -1150,7 +1150,12 @@ static void atmci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
    /* Calculate clock divider */
    if (host->caps.has_odd_clk_div) {
    clkdiv = DIV_ROUND_UP(host->bus_hz, clock_min) - 2;
    - if (clkdiv > 511) {
    + if (clkdiv < 0) {
    + dev_warn(&mmc->class_dev,
    + "clock %u too fast; using %lu\n",
    + clock_min, host->bus_hz / 2);
    + clkdiv = 0;
    + } else if (clkdiv > 511) {
    dev_warn(&mmc->class_dev,
    "clock %u too slow; using %lu\n",
    clock_min, host->bus_hz / (511 + 2));
    diff --git a/drivers/mtd/ubi/cdev.c b/drivers/mtd/ubi/cdev.c
    index ad76592..7ac2c05 100644
    --- a/drivers/mtd/ubi/cdev.c
    +++ b/drivers/mtd/ubi/cdev.c
    @@ -475,7 +475,7 @@ static long vol_cdev_ioctl(struct file *file, unsigned int cmd,
    /* Validate the request */
    err = -EINVAL;
    if (req.lnum < 0 || req.lnum >= vol->reserved_pebs ||
    - req.bytes < 0 || req.lnum >= vol->usable_leb_size)
    + req.bytes < 0 || req.bytes > vol->usable_leb_size)
    break;
    if (req.dtype != UBI_LONGTERM && req.dtype != UBI_SHORTTERM &&
    req.dtype != UBI_UNKNOWN)
    diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c
    index 2455d62..9abc0ea 100644
    --- a/drivers/mtd/ubi/eba.c
    +++ b/drivers/mtd/ubi/eba.c
    @@ -1261,7 +1261,8 @@ int ubi_eba_init_scan(struct ubi_device *ubi, struct ubi_scan_info *si)
    * during re-size.
    */
    ubi_scan_move_to_list(sv, seb, &si->erase);
    - vol->eba_tbl[seb->lnum] = seb->pnum;
    + else
    + vol->eba_tbl[seb->lnum] = seb->pnum;
    }
    }

    diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
    index 7c1a9bf..284d144 100644
    --- a/drivers/mtd/ubi/wl.c
    +++ b/drivers/mtd/ubi/wl.c
    @@ -666,7 +666,7 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
    int cancel)
    {
    int err, scrubbing = 0, torture = 0, protect = 0, erroneous = 0;
    - int vol_id = -1, uninitialized_var(lnum);
    + int vol_id = -1, lnum = -1;
    struct ubi_wl_entry *e1, *e2;
    struct ubi_vid_hdr *vid_hdr;

    diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c
    index 8d8908d..b7a7524 100644
    --- a/drivers/net/ethernet/intel/e1000/e1000_main.c
    +++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
    @@ -144,6 +144,11 @@ static bool e1000_clean_rx_irq(struct e1000_adapter *adapter,
    static bool e1000_clean_jumbo_rx_irq(struct e1000_adapter *adapter,
    struct e1000_rx_ring *rx_ring,
    int *work_done, int work_to_do);
    +static void e1000_alloc_dummy_rx_buffers(struct e1000_adapter *adapter,
    + struct e1000_rx_ring *rx_ring,
    + int cleaned_count)
    +{
    +}
    static void e1000_alloc_rx_buffers(struct e1000_adapter *adapter,
    struct e1000_rx_ring *rx_ring,
    int cleaned_count);
    @@ -3545,8 +3550,11 @@ static int e1000_change_mtu(struct net_device *netdev, int new_mtu)
    msleep(1);
    /* e1000_down has a dependency on max_frame_size */
    hw->max_frame_size = max_frame;
    - if (netif_running(netdev))
    + if (netif_running(netdev)) {
    + /* prevent buffers from being reallocated */
    + adapter->alloc_rx_buf = e1000_alloc_dummy_rx_buffers;
    e1000_down(adapter);
    + }

    /* NOTE: netdev_alloc_skb reserves 16 bytes, and typically NET_IP_ALIGN
    * means we reserve 2 more, this pushes us to allocate from the next
    diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
    index 2c4cdce..091c85f 100644
    --- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
    +++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
    @@ -357,6 +357,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
    {RTL_USB_DEVICE(0x2001, 0x3307, rtl92cu_hal_cfg)}, /*D-Link-Cameo*/
    {RTL_USB_DEVICE(0x2001, 0x3309, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/
    {RTL_USB_DEVICE(0x2001, 0x330a, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/
    + {RTL_USB_DEVICE(0x2001, 0x330d, rtl92cu_hal_cfg)}, /*D-Link DWA-131 */
    {RTL_USB_DEVICE(0x2019, 0xab2b, rtl92cu_hal_cfg)}, /*Planex -Abocom*/
    {RTL_USB_DEVICE(0x20f4, 0x624d, rtl92cu_hal_cfg)}, /*TRENDNet*/
    {RTL_USB_DEVICE(0x2357, 0x0100, rtl92cu_hal_cfg)}, /*TP-Link WN8200ND*/
    diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
    index 2b6faa0..9b6cb58 100644
    --- a/drivers/net/wireless/rtlwifi/usb.c
    +++ b/drivers/net/wireless/rtlwifi/usb.c
    @@ -119,7 +119,7 @@ static int _usbctrl_vendorreq_sync_read(struct usb_device *udev, u8 request,

    do {
    status = usb_control_msg(udev, pipe, request, reqtype, value,
    - index, pdata, len, 0); /*max. timeout*/
    + index, pdata, len, 1000);
    if (status < 0) {
    /* firmware download is checksumed, don't retry */
    if ((value >= FW_8192C_START_ADDRESS &&
    diff --git a/drivers/platform/x86/compal-laptop.c b/drivers/platform/x86/compal-laptop.c
    index 1887e2f..6793888 100644
    --- a/drivers/platform/x86/compal-laptop.c
    +++ b/drivers/platform/x86/compal-laptop.c
    @@ -1047,7 +1047,13 @@ static int __devinit compal_probe(struct platform_device *pdev)

    /* Power supply */
    initialize_power_supply_data(data);
    - power_supply_register(&compal_device->dev, &data->psy);
    + err = power_supply_register(&compal_device->dev, &data->psy);
    + if (err < 0) {
    + hwmon_device_unregister(data->hwmon_dev);
    + sysfs_remove_group(&pdev->dev.kobj,
    + &compal_attribute_group);
    + kfree(data);
    + }

    platform_set_drvdata(pdev, data);

    diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c
    index 3868ab2..fb37df6 100644
    --- a/drivers/scsi/3w-9xxx.c
    +++ b/drivers/scsi/3w-9xxx.c
    @@ -149,7 +149,6 @@ static int twa_reset_sequence(TW_Device_Extension *tw_dev, int soft_reset);
    static int twa_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, char *cdb, int use_sg, TW_SG_Entry *sglistarg);
    static void twa_scsiop_execute_scsi_complete(TW_Device_Extension *tw_dev, int request_id);
    static char *twa_string_lookup(twa_message_type *table, unsigned int aen_code);
    -static void twa_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id);

    /* Functions */

    @@ -1352,11 +1351,11 @@ static irqreturn_t twa_interrupt(int irq, void *dev_instance)
    }

    /* Now complete the io */
    + scsi_dma_unmap(cmd);
    + cmd->scsi_done(cmd);
    tw_dev->state[request_id] = TW_S_COMPLETED;
    twa_free_request_id(tw_dev, request_id);
    tw_dev->posted_request_count--;
    - tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]);
    - twa_unmap_scsi_data(tw_dev, request_id);
    }

    /* Check for valid status after each drain */
    @@ -1414,26 +1413,6 @@ static void twa_load_sgl(TW_Device_Extension *tw_dev, TW_Command_Full *full_comm
    }
    } /* End twa_load_sgl() */

    -/* This function will perform a pci-dma mapping for a scatter gather list */
    -static int twa_map_scsi_sg_data(TW_Device_Extension *tw_dev, int request_id)
    -{
    - int use_sg;
    - struct scsi_cmnd *cmd = tw_dev->srb[request_id];
    -
    - use_sg = scsi_dma_map(cmd);
    - if (!use_sg)
    - return 0;
    - else if (use_sg < 0) {
    - TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1c, "Failed to map scatter gather list");
    - return 0;
    - }
    -
    - cmd->SCp.phase = TW_PHASE_SGLIST;
    - cmd->SCp.have_data_in = use_sg;
    -
    - return use_sg;
    -} /* End twa_map_scsi_sg_data() */
    -
    /* This function will poll for a response interrupt of a request */
    static int twa_poll_response(TW_Device_Extension *tw_dev, int request_id, int seconds)
    {
    @@ -1612,9 +1591,11 @@ static int twa_reset_device_extension(TW_Device_Extension *tw_dev)
    (tw_dev->state[i] != TW_S_INITIAL) &&
    (tw_dev->state[i] != TW_S_COMPLETED)) {
    if (tw_dev->srb[i]) {
    - tw_dev->srb[i]->result = (DID_RESET << 16);
    - tw_dev->srb[i]->scsi_done(tw_dev->srb[i]);
    - twa_unmap_scsi_data(tw_dev, i);
    + struct scsi_cmnd *cmd = tw_dev->srb[i];
    +
    + cmd->result = (DID_RESET << 16);
    + scsi_dma_unmap(cmd);
    + cmd->scsi_done(cmd);
    }
    }
    }
    @@ -1793,21 +1774,18 @@ static int twa_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_
    /* Save the scsi command for use by the ISR */
    tw_dev->srb[request_id] = SCpnt;

    - /* Initialize phase to zero */
    - SCpnt->SCp.phase = TW_PHASE_INITIAL;
    -
    retval = twa_scsiop_execute_scsi(tw_dev, request_id, NULL, 0, NULL);
    switch (retval) {
    case SCSI_MLQUEUE_HOST_BUSY:
    + scsi_dma_unmap(SCpnt);
    twa_free_request_id(tw_dev, request_id);
    - twa_unmap_scsi_data(tw_dev, request_id);
    break;
    case 1:
    - tw_dev->state[request_id] = TW_S_COMPLETED;
    - twa_free_request_id(tw_dev, request_id);
    - twa_unmap_scsi_data(tw_dev, request_id);
    SCpnt->result = (DID_ERROR << 16);
    + scsi_dma_unmap(SCpnt);
    done(SCpnt);
    + tw_dev->state[request_id] = TW_S_COMPLETED;
    + twa_free_request_id(tw_dev, request_id);
    retval = 0;
    }
    out:
    @@ -1875,8 +1853,8 @@ static int twa_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id,
    command_packet->sg_list[0].address = TW_CPU_TO_SGL(tw_dev->generic_buffer_phys[request_id]);
    command_packet->sg_list[0].length = cpu_to_le32(TW_MIN_SGL_LENGTH);
    } else {
    - sg_count = twa_map_scsi_sg_data(tw_dev, request_id);
    - if (sg_count == 0)
    + sg_count = scsi_dma_map(srb);
    + if (sg_count < 0)
    goto out;

    scsi_for_each_sg(srb, sg, sg_count, i) {
    @@ -1991,15 +1969,6 @@ static char *twa_string_lookup(twa_message_type *table, unsigned int code)
    return(table[index].text);
    } /* End twa_string_lookup() */

    -/* This function will perform a pci-dma unmap */
    -static void twa_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id)
    -{
    - struct scsi_cmnd *cmd = tw_dev->srb[request_id];
    -
    - if (cmd->SCp.phase == TW_PHASE_SGLIST)
    - scsi_dma_unmap(cmd);
    -} /* End twa_unmap_scsi_data() */
    -
    /* This function gets called when a disk is coming on-line */
    static int twa_slave_configure(struct scsi_device *sdev)
    {
    diff --git a/drivers/scsi/3w-9xxx.h b/drivers/scsi/3w-9xxx.h
    index 040f721..0fdc83c 100644
    --- a/drivers/scsi/3w-9xxx.h
    +++ b/drivers/scsi/3w-9xxx.h
    @@ -324,11 +324,6 @@ static twa_message_type twa_error_table[] = {
    #define TW_CURRENT_DRIVER_BUILD 0
    #define TW_CURRENT_DRIVER_BRANCH 0

    -/* Phase defines */
    -#define TW_PHASE_INITIAL 0
    -#define TW_PHASE_SINGLE 1
    -#define TW_PHASE_SGLIST 2
    -
    /* Misc defines */
    #define TW_9550SX_DRAIN_COMPLETED 0xFFFF
    #define TW_SECTOR_SIZE 512
    diff --git a/drivers/scsi/3w-sas.c b/drivers/scsi/3w-sas.c
    index 13e39e1..c555ccb 100644
    --- a/drivers/scsi/3w-sas.c
    +++ b/drivers/scsi/3w-sas.c
    @@ -303,26 +303,6 @@ static int twl_post_command_packet(TW_Device_Extension *tw_dev, int request_id)
    return 0;
    } /* End twl_post_command_packet() */

    -/* This function will perform a pci-dma mapping for a scatter gather list */
    -static int twl_map_scsi_sg_data(TW_Device_Extension *tw_dev, int request_id)
    -{
    - int use_sg;
    - struct scsi_cmnd *cmd = tw_dev->srb[request_id];
    -
    - use_sg = scsi_dma_map(cmd);
    - if (!use_sg)
    - return 0;
    - else if (use_sg < 0) {
    - TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1, "Failed to map scatter gather list");
    - return 0;
    - }
    -
    - cmd->SCp.phase = TW_PHASE_SGLIST;
    - cmd->SCp.have_data_in = use_sg;
    -
    - return use_sg;
    -} /* End twl_map_scsi_sg_data() */
    -
    /* This function hands scsi cdb's to the firmware */
    static int twl_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, char *cdb, int use_sg, TW_SG_Entry_ISO *sglistarg)
    {
    @@ -370,8 +350,8 @@ static int twl_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id,
    if (!sglistarg) {
    /* Map sglist from scsi layer to cmd packet */
    if (scsi_sg_count(srb)) {
    - sg_count = twl_map_scsi_sg_data(tw_dev, request_id);
    - if (sg_count == 0)
    + sg_count = scsi_dma_map(srb);
    + if (sg_count <= 0)
    goto out;

    scsi_for_each_sg(srb, sg, sg_count, i) {
    @@ -1116,15 +1096,6 @@ out:
    return retval;
    } /* End twl_initialize_device_extension() */

    -/* This function will perform a pci-dma unmap */
    -static void twl_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id)
    -{
    - struct scsi_cmnd *cmd = tw_dev->srb[request_id];
    -
    - if (cmd->SCp.phase == TW_PHASE_SGLIST)
    - scsi_dma_unmap(cmd);
    -} /* End twl_unmap_scsi_data() */
    -
    /* This function will handle attention interrupts */
    static int twl_handle_attention_interrupt(TW_Device_Extension *tw_dev)
    {
    @@ -1265,11 +1236,11 @@ static irqreturn_t twl_interrupt(int irq, void *dev_instance)
    }

    /* Now complete the io */
    + scsi_dma_unmap(cmd);
    + cmd->scsi_done(cmd);
    tw_dev->state[request_id] = TW_S_COMPLETED;
    twl_free_request_id(tw_dev, request_id);
    tw_dev->posted_request_count--;
    - tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]);
    - twl_unmap_scsi_data(tw_dev, request_id);
    }

    /* Check for another response interrupt */
    @@ -1414,10 +1385,12 @@ static int twl_reset_device_extension(TW_Device_Extension *tw_dev, int ioctl_res
    if ((tw_dev->state[i] != TW_S_FINISHED) &&
    (tw_dev->state[i] != TW_S_INITIAL) &&
    (tw_dev->state[i] != TW_S_COMPLETED)) {
    - if (tw_dev->srb[i]) {
    - tw_dev->srb[i]->result = (DID_RESET << 16);
    - tw_dev->srb[i]->scsi_done(tw_dev->srb[i]);
    - twl_unmap_scsi_data(tw_dev, i);
    + struct scsi_cmnd *cmd = tw_dev->srb[i];
    +
    + if (cmd) {
    + cmd->result = (DID_RESET << 16);
    + scsi_dma_unmap(cmd);
    + cmd->scsi_done(cmd);
    }
    }
    }
    @@ -1521,9 +1494,6 @@ static int twl_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_
    /* Save the scsi command for use by the ISR */
    tw_dev->srb[request_id] = SCpnt;

    - /* Initialize phase to zero */
    - SCpnt->SCp.phase = TW_PHASE_INITIAL;
    -
    retval = twl_scsiop_execute_scsi(tw_dev, request_id, NULL, 0, NULL);
    if (retval) {
    tw_dev->state[request_id] = TW_S_COMPLETED;
    diff --git a/drivers/scsi/3w-sas.h b/drivers/scsi/3w-sas.h
    index d474892..fec6449 100644
    --- a/drivers/scsi/3w-sas.h
    +++ b/drivers/scsi/3w-sas.h
    @@ -103,10 +103,6 @@ static char *twl_aen_severity_table[] =
    #define TW_CURRENT_DRIVER_BUILD 0
    #define TW_CURRENT_DRIVER_BRANCH 0

    -/* Phase defines */
    -#define TW_PHASE_INITIAL 0
    -#define TW_PHASE_SGLIST 2
    -
    /* Misc defines */
    #define TW_SECTOR_SIZE 512
    #define TW_MAX_UNITS 32
    diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c
    index 7fe96ff..86bc5f9 100644
    --- a/drivers/scsi/3w-xxxx.c
    +++ b/drivers/scsi/3w-xxxx.c
    @@ -1283,32 +1283,6 @@ static int tw_initialize_device_extension(TW_Device_Extension *tw_dev)
    return 0;
    } /* End tw_initialize_device_extension() */

    -static int tw_map_scsi_sg_data(struct pci_dev *pdev, struct scsi_cmnd *cmd)
    -{
    - int use_sg;
    -
    - dprintk(KERN_WARNING "3w-xxxx: tw_map_scsi_sg_data()\n");
    -
    - use_sg = scsi_dma_map(cmd);
    - if (use_sg < 0) {
    - printk(KERN_WARNING "3w-xxxx: tw_map_scsi_sg_data(): pci_map_sg() failed.\n");
    - return 0;
    - }
    -
    - cmd->SCp.phase = TW_PHASE_SGLIST;
    - cmd->SCp.have_data_in = use_sg;
    -
    - return use_sg;
    -} /* End tw_map_scsi_sg_data() */
    -
    -static void tw_unmap_scsi_data(struct pci_dev *pdev, struct scsi_cmnd *cmd)
    -{
    - dprintk(KERN_WARNING "3w-xxxx: tw_unmap_scsi_data()\n");
    -
    - if (cmd->SCp.phase == TW_PHASE_SGLIST)
    - scsi_dma_unmap(cmd);
    -} /* End tw_unmap_scsi_data() */
    -
    /* This function will reset a device extension */
    static int tw_reset_device_extension(TW_Device_Extension *tw_dev)
    {
    @@ -1331,8 +1305,8 @@ static int tw_reset_device_extension(TW_Device_Extension *tw_dev)
    srb = tw_dev->srb[i];
    if (srb != NULL) {
    srb->result = (DID_RESET << 16);
    - tw_dev->srb[i]->scsi_done(tw_dev->srb[i]);
    - tw_unmap_scsi_data(tw_dev->tw_pci_dev, tw_dev->srb[i]);
    + scsi_dma_unmap(srb);
    + srb->scsi_done(srb);
    }
    }
    }
    @@ -1779,8 +1753,8 @@ static int tw_scsiop_read_write(TW_Device_Extension *tw_dev, int request_id)
    command_packet->byte8.io.lba = lba;
    command_packet->byte6.block_count = num_sectors;

    - use_sg = tw_map_scsi_sg_data(tw_dev->tw_pci_dev, tw_dev->srb[request_id]);
    - if (!use_sg)
    + use_sg = scsi_dma_map(srb);
    + if (use_sg <= 0)
    return 1;

    scsi_for_each_sg(tw_dev->srb[request_id], sg, use_sg, i) {
    @@ -1967,9 +1941,6 @@ static int tw_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_c
    /* Save the scsi command for use by the ISR */
    tw_dev->srb[request_id] = SCpnt;

    - /* Initialize phase to zero */
    - SCpnt->SCp.phase = TW_PHASE_INITIAL;
    -
    switch (*command) {
    case READ_10:
    case READ_6:
    @@ -2196,12 +2167,11 @@ static irqreturn_t tw_interrupt(int irq, void *dev_instance)

    /* Now complete the io */
    if ((error != TW_ISR_DONT_COMPLETE)) {
    + scsi_dma_unmap(tw_dev->srb[request_id]);
    + tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]);
    tw_dev->state[request_id] = TW_S_COMPLETED;
    tw_state_request_finish(tw_dev, request_id);
    tw_dev->posted_request_count--;
    - tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]);
    -
    - tw_unmap_scsi_data(tw_dev->tw_pci_dev, tw_dev->srb[request_id]);
    }
    }

    diff --git a/drivers/scsi/3w-xxxx.h b/drivers/scsi/3w-xxxx.h
    index 49dcf03..1d31858 100644
    --- a/drivers/scsi/3w-xxxx.h
    +++ b/drivers/scsi/3w-xxxx.h
    @@ -195,11 +195,6 @@ static unsigned char tw_sense_table[][4] =
    #define TW_AEN_SMART_FAIL 0x000F
    #define TW_AEN_SBUF_FAIL 0x0024

    -/* Phase defines */
    -#define TW_PHASE_INITIAL 0
    -#define TW_PHASE_SINGLE 1
    -#define TW_PHASE_SGLIST 2
    -
    /* Misc defines */
    #define TW_ALIGNMENT_6000 64 /* 64 bytes */
    #define TW_ALIGNMENT_7000 4 /* 4 bytes */
    diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
    index bfd87fa..3e0f71c 100644
    --- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
    +++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
    @@ -1426,11 +1426,11 @@ megasas_build_ldio_fusion(struct megasas_instance *instance,
    fp_possible = io_info.fpOkForIo;
    }

    - /* Use smp_processor_id() for now until cmd->request->cpu is CPU
    + /* Use raw_smp_processor_id() for now until cmd->request->cpu is CPU
    id by default, not CPU group id, otherwise all MSI-X queues won't
    be utilized */
    cmd->request_desc->SCSIIO.MSIxIndex = instance->msix_vectors ?
    - smp_processor_id() % instance->msix_vectors : 0;
    + raw_smp_processor_id() % instance->msix_vectors : 0;

    if (fp_possible) {
    megasas_set_pd_lba(io_request, scp->cmd_len, &io_info, scp,
    diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
    index cf8dfab..28a635c 100644
    --- a/drivers/scsi/scsi_devinfo.c
    +++ b/drivers/scsi/scsi_devinfo.c
    @@ -222,6 +222,7 @@ static struct {
    {"PIONEER", "CD-ROM DRM-604X", NULL, BLIST_FORCELUN | BLIST_SINGLELUN},
    {"PIONEER", "CD-ROM DRM-624X", NULL, BLIST_FORCELUN | BLIST_SINGLELUN},
    {"Promise", "", NULL, BLIST_SPARSELUN},
    + {"QNAP", "iSCSI Storage", NULL, BLIST_MAX_1024},
    {"QUANTUM", "XP34301", "1071", BLIST_NOTQ},
    {"REGAL", "CDC-4X", NULL, BLIST_MAX5LUN | BLIST_SINGLELUN},
    {"SanDisk", "ImageMate CF-SD1", NULL, BLIST_FORCELUN},
    diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
    index 348840e..37abf4f 100644
    --- a/drivers/scsi/scsi_scan.c
    +++ b/drivers/scsi/scsi_scan.c
    @@ -888,6 +888,12 @@ static int scsi_add_lun(struct scsi_device *sdev, unsigned char *inq_result,
    */
    if (*bflags & BLIST_MAX_512)
    blk_queue_max_hw_sectors(sdev->request_queue, 512);
    + /*
    + * Max 1024 sector transfer length for targets that report incorrect
    + * max/optimal lengths and relied on the old block layer safe default
    + */
    + else if (*bflags & BLIST_MAX_1024)
    + blk_queue_max_hw_sectors(sdev->request_queue, 1024);

    /*
    * Some devices may not want to have a start command automatically
    diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
    index 7f6746a..97aa6c6 100644
    --- a/drivers/scsi/sd.c
    +++ b/drivers/scsi/sd.c
    @@ -1423,6 +1423,7 @@ static unsigned int sd_completed_bytes(struct scsi_cmnd *scmd)
    {
    u64 start_lba = blk_rq_pos(scmd->request);
    u64 end_lba = blk_rq_pos(scmd->request) + (scsi_bufflen(scmd) / 512);
    + u64 factor = scmd->device->sector_size / 512;
    u64 bad_lba;
    int info_valid;
    /*
    @@ -1444,16 +1445,10 @@ static unsigned int sd_completed_bytes(struct scsi_cmnd *scmd)
    if (scsi_bufflen(scmd) <= scmd->device->sector_size)
    return 0;

    - if (scmd->device->sector_size < 512) {
    - /* only legitimate sector_size here is 256 */
    - start_lba <<= 1;
    - end_lba <<= 1;
    - } else {
    - /* be careful ... don't want any overflows */
    - u64 factor = scmd->device->sector_size / 512;
    - do_div(start_lba, factor);
    - do_div(end_lba, factor);
    - }
    + /* be careful ... don't want any overflows */
    + factor = scmd->device->sector_size / 512;
    + do_div(start_lba, factor);
    + do_div(end_lba, factor);

    /* The bad lba was reported incorrectly, we have no idea where
    * the error is.
    @@ -1984,8 +1979,7 @@ got_data:
    if (sector_size != 512 &&
    sector_size != 1024 &&
    sector_size != 2048 &&
    - sector_size != 4096 &&
    - sector_size != 256) {
    + sector_size != 4096) {
    sd_printk(KERN_NOTICE, sdkp, "Unsupported sector size %d.\n",
    sector_size);
    /*
    @@ -2034,8 +2028,6 @@ got_data:
    sdkp->capacity <<= 2;
    else if (sector_size == 1024)
    sdkp->capacity <<= 1;
    - else if (sector_size == 256)
    - sdkp->capacity >>= 1;

    blk_queue_physical_block_size(sdp->request_queue,
    sdkp->physical_block_size);
    diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
    index a0df0fb..4ae7769 100644
    --- a/drivers/scsi/storvsc_drv.c
    +++ b/drivers/scsi/storvsc_drv.c
    @@ -610,21 +610,22 @@ static unsigned int copy_to_bounce_buffer(struct scatterlist *orig_sgl,
    if (bounce_sgl[j].length == PAGE_SIZE) {
    /* full..move to next entry */
    sg_kunmap_atomic(bounce_addr);
    + bounce_addr = 0;
    j++;
    + }

    - /* if we need to use another bounce buffer */
    - if (srclen || i != orig_sgl_count - 1)
    - bounce_addr = sg_kmap_atomic(bounce_sgl,j);
    + /* if we need to use another bounce buffer */
    + if (srclen && bounce_addr == 0)
    + bounce_addr = sg_kmap_atomic(bounce_sgl, j);

    - } else if (srclen == 0 && i == orig_sgl_count - 1) {
    - /* unmap the last bounce that is < PAGE_SIZE */
    - sg_kunmap_atomic(bounce_addr);
    - }
    }

    sg_kunmap_atomic(src_addr - orig_sgl[i].offset);
    }

    + if (bounce_addr)
    + sg_kunmap_atomic(bounce_addr);
    +
    local_irq_restore(flags);

    return total_copied;
    diff --git a/drivers/staging/ozwpan/ozusbsvc1.c b/drivers/staging/ozwpan/ozusbsvc1.c
    index 66bd576..ca61576 100644
    --- a/drivers/staging/ozwpan/ozusbsvc1.c
    +++ b/drivers/staging/ozwpan/ozusbsvc1.c
    @@ -314,7 +314,11 @@ void oz_usb_handle_ep_data(struct oz_usb_ctx *usb_ctx,
    struct oz_multiple_fixed *body =
    (struct oz_multiple_fixed *)data_hdr;
    u8 *data = body->data;
    - int n = (len - sizeof(struct oz_multiple_fixed)+1)
    + unsigned int n;
    + if (!body->unit_size ||
    + len < sizeof(struct oz_multiple_fixed) - 1)
    + break;
    + n = (len - (sizeof(struct oz_multiple_fixed) - 1))
    / body->unit_size;
    while (n--) {
    oz_hcd_data_ind(usb_ctx->hport, body->endpoint,
    @@ -376,10 +380,15 @@ void oz_usb_rx(struct oz_pd *pd, struct oz_elt *elt)
    case OZ_GET_DESC_RSP: {
    struct oz_get_desc_rsp *body =
    (struct oz_get_desc_rsp *)usb_hdr;
    - int data_len = elt->length -
    - sizeof(struct oz_get_desc_rsp) + 1;
    - u16 offs = le16_to_cpu(get_unaligned(&body->offset));
    - u16 total_size =
    + u16 offs, total_size;
    + u8 data_len;
    +
    + if (elt->length < sizeof(struct oz_get_desc_rsp) - 1)
    + break;
    + data_len = elt->length -
    + (sizeof(struct oz_get_desc_rsp) - 1);
    + offs = le16_to_cpu(get_unaligned(&body->offset));
    + total_size =
    le16_to_cpu(get_unaligned(&body->total_size));
    oz_trace("USB_REQ_GET_DESCRIPTOR - cnf\n");
    oz_hcd_get_desc_cnf(usb_ctx->hport, body->req_id,
    diff --git a/drivers/staging/panel/panel.c b/drivers/staging/panel/panel.c
    index 6183573..5d4b4f07 100644
    --- a/drivers/staging/panel/panel.c
    +++ b/drivers/staging/panel/panel.c
    @@ -273,11 +273,11 @@ static unsigned char lcd_bits[LCD_PORTS][LCD_BITS][BIT_STATES];
    * LCD types
    */
    #define LCD_TYPE_NONE 0
    -#define LCD_TYPE_OLD 1
    -#define LCD_TYPE_KS0074 2
    -#define LCD_TYPE_HANTRONIX 3
    -#define LCD_TYPE_NEXCOM 4
    -#define LCD_TYPE_CUSTOM 5
    +#define LCD_TYPE_CUSTOM 1
    +#define LCD_TYPE_OLD 2
    +#define LCD_TYPE_KS0074 3
    +#define LCD_TYPE_HANTRONIX 4
    +#define LCD_TYPE_NEXCOM 5

    /*
    * keypad types
    @@ -455,8 +455,7 @@ MODULE_PARM_DESC(keypad_enabled, "Deprecated option, use keypad_type instead");
    static int lcd_type = -1;
    module_param(lcd_type, int, 0000);
    MODULE_PARM_DESC(lcd_type,
    - "LCD type: 0=none, 1=old //, 2=serial ks0074, "
    - "3=hantronix //, 4=nexcom //, 5=compiled-in");
    + "LCD type: 0=none, 1=compiled-in, 2=old, 3=serial ks0074, 4=hantronix, 5=nexcom");

    static int lcd_proto = -1;
    module_param(lcd_proto, int, 0000);
    diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
    index 8082674..ec7e71c 100644
    --- a/drivers/target/target_core_pscsi.c
    +++ b/drivers/target/target_core_pscsi.c
    @@ -567,6 +567,7 @@ static struct se_device *pscsi_create_virtdevice(
    " pdv_host_id: %d\n", pdv->pdv_host_id);
    return ERR_PTR(-EINVAL);
    }
    + pdv->pdv_lld_host = sh;
    }
    } else {
    if (phv->phv_mode == PHV_VIRTUAL_HOST_ID) {
    @@ -653,6 +654,8 @@ static void pscsi_free_device(void *p)
    if ((phv->phv_mode == PHV_LLD_SCSI_HOST_NO) &&
    (phv->phv_lld_host != NULL))
    scsi_host_put(phv->phv_lld_host);
    + else if (pdv->pdv_lld_host)
    + scsi_host_put(pdv->pdv_lld_host);

    if ((sd->type == TYPE_DISK) || (sd->type == TYPE_ROM))
    scsi_device_put(sd);
    diff --git a/drivers/target/target_core_pscsi.h b/drivers/target/target_core_pscsi.h
    index 43f1c41..6c23c94 100644
    --- a/drivers/target/target_core_pscsi.h
    +++ b/drivers/target/target_core_pscsi.h
    @@ -45,6 +45,7 @@ struct pscsi_dev_virt {
    int pdv_lun_id;
    struct block_device *pdv_bd;
    struct scsi_device *pdv_sd;
    + struct Scsi_Host *pdv_lld_host;
    struct se_hba *pdv_se_hba;
    } ____cacheline_aligned;

    diff --git a/drivers/tty/hvc/hvc_xen.c b/drivers/tty/hvc/hvc_xen.c
    index 944eaeb..160b1f3 100644
    --- a/drivers/tty/hvc/hvc_xen.c
    +++ b/drivers/tty/hvc/hvc_xen.c
    @@ -290,7 +290,7 @@ static int xen_initial_domain_console_init(void)
    return -ENOMEM;
    }

    - info->irq = bind_virq_to_irq(VIRQ_CONSOLE, 0);
    + info->irq = bind_virq_to_irq(VIRQ_CONSOLE, 0, false);
    info->vtermno = HVC_COOKIE;

    spin_lock(&xencons_lock);
    @@ -300,11 +300,27 @@ static int xen_initial_domain_console_init(void)
    return 0;
    }

    +static void xen_console_update_evtchn(struct xencons_info *info)
    +{
    + if (xen_hvm_domain()) {
    + uint64_t v;
    + int err;
    +
    + err = hvm_get_parameter(HVM_PARAM_CONSOLE_EVTCHN, &v);
    + if (!err && v)
    + info->evtchn = v;
    + } else
    + info->evtchn = xen_start_info->console.domU.evtchn;
    +}
    +
    void xen_console_resume(void)
    {
    struct xencons_info *info = vtermno_to_xencons(HVC_COOKIE);
    - if (info != NULL && info->irq)
    + if (info != NULL && info->irq) {
    + if (!xen_initial_domain())
    + xen_console_update_evtchn(info);
    rebind_evtchn_irq(info->evtchn, info->irq);
    + }
    }

    static void xencons_disconnect_backend(struct xencons_info *info)
    diff --git a/drivers/tty/serial/of_serial.c b/drivers/tty/serial/of_serial.c
    index 6563cad..746e771 100644
    --- a/drivers/tty/serial/of_serial.c
    +++ b/drivers/tty/serial/of_serial.c
    @@ -192,7 +192,6 @@ static struct of_device_id __devinitdata of_platform_serial_table[] = {
    { .compatible = "ibm,qpace-nwp-serial",
    .data = (void *)PORT_NWPSERIAL, },
    #endif
    - { .type = "serial", .data = (void *)PORT_UNKNOWN, },
    { /* end of list */ },
    };

    diff --git a/drivers/tty/serial/uartlite.c b/drivers/tty/serial/uartlite.c
    index 6cd4143..d9706e7 100644
    --- a/drivers/tty/serial/uartlite.c
    +++ b/drivers/tty/serial/uartlite.c
    @@ -573,7 +573,8 @@ MODULE_DEVICE_TABLE(of, ulite_of_match);

    static int __devinit ulite_probe(struct platform_device *pdev)
    {
    - struct resource *res, *res2;
    + struct resource *res;
    + int irq;
    int id = pdev->id;
    #ifdef CONFIG_OF
    const __be32 *prop;
    @@ -587,11 +588,11 @@ static int __devinit ulite_probe(struct platform_device *pdev)
    if (!res)
    return -ENODEV;

    - res2 = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
    - if (!res2)
    - return -ENODEV;
    + irq = platform_get_irq(pdev, 0);
    + if (irq <= 0)
    + return -ENXIO;

    - return ulite_assign(&pdev->dev, id, res->start, res2->start);
    + return ulite_assign(&pdev->dev, id, res->start, irq);
    }

    static int __devexit ulite_remove(struct platform_device *pdev)
    diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c
    index b627363..778c39a 100644
    --- a/drivers/tty/serial/xilinx_uartps.c
    +++ b/drivers/tty/serial/xilinx_uartps.c
    @@ -941,9 +941,9 @@ static struct uart_driver xuartps_uart_driver = {
    **/
    static int __devinit xuartps_probe(struct platform_device *pdev)
    {
    - int rc;
    + int rc, irq;
    struct uart_port *port;
    - struct resource *res, *res2;
    + struct resource *res;
    int clk = 0;

    #ifdef CONFIG_OF
    @@ -964,9 +964,9 @@ static int __devinit xuartps_probe(struct platform_device *pdev)
    if (!res)
    return -ENODEV;

    - res2 = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
    - if (!res2)
    - return -ENODEV;
    + irq = platform_get_irq(pdev, 0);
    + if (irq <= 0)
    + return -ENXIO;

    /* Initialize the port structure */
    port = xuartps_get_port();
    @@ -980,7 +980,7 @@ static int __devinit xuartps_probe(struct platform_device *pdev)
    * and triggers invocation of the config_port() entry point.
    */
    port->mapbase = res->start;
    - port->irq = res2->start;
    + port->irq = irq;
    port->dev = &pdev->dev;
    port->uartclk = clk;
    dev_set_drvdata(&pdev->dev, port);
    diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
    index e5fa34e..c65c939 100644
    --- a/drivers/usb/class/cdc-wdm.c
    +++ b/drivers/usb/class/cdc-wdm.c
    @@ -268,7 +268,7 @@ static void wdm_int_callback(struct urb *urb)
    case USB_CDC_NOTIFY_RESPONSE_AVAILABLE:
    dev_dbg(&desc->intf->dev,
    "NOTIFY_RESPONSE_AVAILABLE received: index %d len %d",
    - dr->wIndex, dr->wLength);
    + le16_to_cpu(dr->wIndex), le16_to_cpu(dr->wLength));
    break;

    case USB_CDC_NOTIFY_NETWORK_CONNECTION:
    @@ -281,7 +281,9 @@ static void wdm_int_callback(struct urb *urb)
    clear_bit(WDM_POLL_RUNNING, &desc->flags);
    dev_err(&desc->intf->dev,
    "unknown notification %d received: index %d len %d\n",
    - dr->bNotificationType, dr->wIndex, dr->wLength);
    + dr->bNotificationType,
    + le16_to_cpu(dr->wIndex),
    + le16_to_cpu(dr->wLength));
    goto exit;
    }

    @@ -425,7 +427,7 @@ static ssize_t wdm_write
    USB_RECIP_INTERFACE);
    req->bRequest = USB_CDC_SEND_ENCAPSULATED_COMMAND;
    req->wValue = 0;
    - req->wIndex = desc->inum;
    + req->wIndex = desc->inum; /* already converted */
    req->wLength = cpu_to_le16(count);
    set_bit(WDM_IN_USE, &desc->flags);
    desc->outbuf = buf;
    @@ -438,7 +440,7 @@ static ssize_t wdm_write
    dev_err(&desc->intf->dev, "Tx URB error: %d\n", rv);
    } else {
    dev_dbg(&desc->intf->dev, "Tx URB has been submitted index=%d",
    - req->wIndex);
    + le16_to_cpu(req->wIndex));
    }
    out:
    usb_autopm_put_interface(desc->intf);
    @@ -782,7 +784,7 @@ static int wdm_create(struct usb_interface *intf, struct usb_endpoint_descriptor
    desc->irq->bRequestType = (USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE);
    desc->irq->bRequest = USB_CDC_GET_ENCAPSULATED_RESPONSE;
    desc->irq->wValue = 0;
    - desc->irq->wIndex = desc->inum;
    + desc->irq->wIndex = desc->inum; /* already converted */
    desc->irq->wLength = cpu_to_le16(desc->wMaxCommand);

    usb_fill_control_urb(
    diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
    index e47a4e1..5e93425 100644
    --- a/drivers/usb/host/xhci-ring.c
    +++ b/drivers/usb/host/xhci-ring.c
    @@ -2129,8 +2129,13 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td,
    break;
    case COMP_DEV_ERR:
    case COMP_STALL:
    + frame->status = -EPROTO;
    + skip_td = true;
    + break;
    case COMP_TX_ERR:
    frame->status = -EPROTO;
    + if (event_trb != td->last_trb)
    + return 0;
    skip_td = true;
    break;
    case COMP_STOP:
    @@ -2738,7 +2743,7 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd)
    xhci_halt(xhci);
    hw_died:
    spin_unlock(&xhci->lock);
    - return -ESHUTDOWN;
    + return IRQ_HANDLED;
    }

    /*
    diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
    index 80b3d85..855f084 100644
    --- a/drivers/usb/host/xhci.h
    +++ b/drivers/usb/host/xhci.h
    @@ -1233,7 +1233,7 @@ union xhci_trb {
    * since the command ring is 64-byte aligned.
    * It must also be greater than 16.
    */
    -#define TRBS_PER_SEGMENT 64
    +#define TRBS_PER_SEGMENT 256
    /* Allow two commands + a link TRB, along with any reserved command TRBs */
    #define MAX_RSVD_CMD_TRBS (TRBS_PER_SEGMENT - 3)
    #define SEGMENT_SIZE (TRBS_PER_SEGMENT*16)
    diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
    index a2b4008..d3481c4 100644
    --- a/drivers/usb/musb/musb_core.c
    +++ b/drivers/usb/musb/musb_core.c
    @@ -1544,16 +1544,30 @@ irqreturn_t musb_interrupt(struct musb *musb)
    (devctl & MUSB_DEVCTL_HM) ? "host" : "peripheral",
    musb->int_usb, musb->int_tx, musb->int_rx);

    - /* the core can interrupt us for multiple reasons; docs have
    - * a generic interrupt flowchart to follow
    + /**
    + * According to Mentor Graphics' documentation, flowchart on page 98,
    + * IRQ should be handled as follows:
    + *
    + * . Resume IRQ
    + * . Session Request IRQ
    + * . VBUS Error IRQ
    + * . Suspend IRQ
    + * . Connect IRQ
    + * . Disconnect IRQ
    + * . Reset/Babble IRQ
    + * . SOF IRQ (we're not using this one)
    + * . Endpoint 0 IRQ
    + * . TX Endpoints
    + * . RX Endpoints
    + *
    + * We will be following that flowchart in order to avoid any problems
    + * that might arise with internal Finite State Machine.
    */
    +
    if (musb->int_usb)
    retval |= musb_stage0_irq(musb, musb->int_usb,
    devctl, power);

    - /* "stage 1" is handling endpoint irqs */
    -
    - /* handle endpoint 0 first */
    if (musb->int_tx & 1) {
    if (devctl & MUSB_DEVCTL_HM)
    retval |= musb_h_ep0_irq(musb);
    @@ -1561,43 +1575,37 @@ irqreturn_t musb_interrupt(struct musb *musb)
    retval |= musb_g_ep0_irq(musb);
    }

    - /* RX on endpoints 1-15 */
    - reg = musb->int_rx >> 1;
    + reg = musb->int_tx >> 1;
    ep_num = 1;
    while (reg) {
    if (reg & 1) {
    - /* musb_ep_select(musb->mregs, ep_num); */
    - /* REVISIT just retval = ep->rx_irq(...) */
    retval = IRQ_HANDLED;
    if (devctl & MUSB_DEVCTL_HM) {
    if (is_host_capable())
    - musb_host_rx(musb, ep_num);
    + musb_host_tx(musb, ep_num);
    } else {
    if (is_peripheral_capable())
    - musb_g_rx(musb, ep_num);
    + musb_g_tx(musb, ep_num);
    }
    }
    -
    reg >>= 1;
    ep_num++;
    }

    - /* TX on endpoints 1-15 */
    - reg = musb->int_tx >> 1;
    + reg = musb->int_rx >> 1;
    ep_num = 1;
    while (reg) {
    if (reg & 1) {
    - /* musb_ep_select(musb->mregs, ep_num); */
    - /* REVISIT just retval |= ep->tx_irq(...) */
    retval = IRQ_HANDLED;
    if (devctl & MUSB_DEVCTL_HM) {
    if (is_host_capable())
    - musb_host_tx(musb, ep_num);
    + musb_host_rx(musb, ep_num);
    } else {
    if (is_peripheral_capable())
    - musb_g_tx(musb, ep_num);
    + musb_g_rx(musb, ep_num);
    }
    }
    +
    reg >>= 1;
    ep_num++;
    }
    diff --git a/drivers/usb/otg/otg_fsm.c b/drivers/usb/otg/otg_fsm.c
    index ade131a..e87edda 100644
    --- a/drivers/usb/otg/otg_fsm.c
    +++ b/drivers/usb/otg/otg_fsm.c
    @@ -138,9 +138,9 @@ int otg_set_state(struct otg_fsm *fsm, enum usb_otg_state new_state)
    break;
    case OTG_STATE_B_PERIPHERAL:
    otg_chrg_vbus(fsm, 0);
    - otg_loc_conn(fsm, 1);
    otg_loc_sof(fsm, 0);
    otg_set_protocol(fsm, PROTO_GADGET);
    + otg_loc_conn(fsm, 1);
    break;
    case OTG_STATE_B_WAIT_ACON:
    otg_chrg_vbus(fsm, 0);
    @@ -200,10 +200,10 @@ int otg_set_state(struct otg_fsm *fsm, enum usb_otg_state new_state)

    break;
    case OTG_STATE_A_PERIPHERAL:
    - otg_loc_conn(fsm, 1);
    otg_loc_sof(fsm, 0);
    otg_set_protocol(fsm, PROTO_GADGET);
    otg_drv_vbus(fsm, 1);
    + otg_loc_conn(fsm, 1);
    break;
    case OTG_STATE_A_WAIT_VFALL:
    otg_drv_vbus(fsm, 0);
    diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
    index 5c289fc..29bf383 100644
    --- a/drivers/usb/serial/cp210x.c
    +++ b/drivers/usb/serial/cp210x.c
    @@ -133,6 +133,8 @@ static const struct usb_device_id id_table[] = {
    { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */
    { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */
    { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */
    + { USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */
    + { USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */
    { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
    { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
    { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
    diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
    index 06abee6..1e4899c 100644
    --- a/drivers/usb/serial/ftdi_sio.c
    +++ b/drivers/usb/serial/ftdi_sio.c
    @@ -723,6 +723,7 @@ static struct usb_device_id id_table_combined [] = {
    { USB_DEVICE(XSENS_VID, XSENS_AWINDA_DONGLE_PID) },
    { USB_DEVICE(XSENS_VID, XSENS_AWINDA_STATION_PID) },
    { USB_DEVICE(XSENS_VID, XSENS_CONVERTER_PID) },
    + { USB_DEVICE(XSENS_VID, XSENS_MTDEVBOARD_PID) },
    { USB_DEVICE(XSENS_VID, XSENS_MTW_PID) },
    { USB_DEVICE(FTDI_VID, FTDI_OMNI1509) },
    { USB_DEVICE(MOBILITY_VID, MOBILITY_USB_SERIAL_PID) },
    diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
    index 105b982..1fee973 100644
    --- a/drivers/usb/serial/ftdi_sio_ids.h
    +++ b/drivers/usb/serial/ftdi_sio_ids.h
    @@ -155,6 +155,7 @@
    #define XSENS_AWINDA_STATION_PID 0x0101
    #define XSENS_AWINDA_DONGLE_PID 0x0102
    #define XSENS_MTW_PID 0x0200 /* Xsens MTw */
    +#define XSENS_MTDEVBOARD_PID 0x0300 /* Motion Tracker Development Board */
    #define XSENS_CONVERTER_PID 0xD00D /* Xsens USB-serial converter */

    /* Xsens devices using FTDI VID */
    diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
    index 3e450b4..723ed87 100644
    --- a/drivers/usb/serial/pl2303.c
    +++ b/drivers/usb/serial/pl2303.c
    @@ -67,7 +67,6 @@ static const struct usb_device_id id_table[] = {
    { USB_DEVICE(DCU10_VENDOR_ID, DCU10_PRODUCT_ID) },
    { USB_DEVICE(SITECOM_VENDOR_ID, SITECOM_PRODUCT_ID) },
    { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_ID) },
    - { USB_DEVICE(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_ID) },
    { USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_SX1) },
    { USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_X65) },
    { USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_X75) },
    diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
    index 71fd9da..e3b7af8 100644
    --- a/drivers/usb/serial/pl2303.h
    +++ b/drivers/usb/serial/pl2303.h
    @@ -62,10 +62,6 @@
    #define ALCATEL_VENDOR_ID 0x11f7
    #define ALCATEL_PRODUCT_ID 0x02df

    -/* Samsung I330 phone cradle */
    -#define SAMSUNG_VENDOR_ID 0x04e8
    -#define SAMSUNG_PRODUCT_ID 0x8001
    -
    #define SIEMENS_VENDOR_ID 0x11f5
    #define SIEMENS_PRODUCT_ID_SX1 0x0001
    #define SIEMENS_PRODUCT_ID_X65 0x0003
    diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c
    index b3afd19..c5cf350 100644
    --- a/drivers/usb/serial/visor.c
    +++ b/drivers/usb/serial/visor.c
    @@ -101,7 +101,7 @@ static struct usb_device_id id_table [] = {
    .driver_info = (kernel_ulong_t)&palm_os_4_probe },
    { USB_DEVICE(ACER_VENDOR_ID, ACER_S10_ID),
    .driver_info = (kernel_ulong_t)&palm_os_4_probe },
    - { USB_DEVICE(SAMSUNG_VENDOR_ID, SAMSUNG_SCH_I330_ID),
    + { USB_DEVICE_INTERFACE_CLASS(SAMSUNG_VENDOR_ID, SAMSUNG_SCH_I330_ID, 0xff),
    .driver_info = (kernel_ulong_t)&palm_os_4_probe },
    { USB_DEVICE(SAMSUNG_VENDOR_ID, SAMSUNG_SPH_I500_ID),
    .driver_info = (kernel_ulong_t)&palm_os_4_probe },
    diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
    index 25174be..d0ecaf9 100644
    --- a/drivers/usb/storage/unusual_devs.h
    +++ b/drivers/usb/storage/unusual_devs.h
    @@ -752,6 +752,13 @@ UNUSUAL_DEV( 0x059f, 0x0643, 0x0000, 0x0000,
    USB_SC_DEVICE, USB_PR_DEVICE, NULL,
    US_FL_GO_SLOW ),

    +/* Reported by Christian Schaller <cschalle@redhat.com> */
    +UNUSUAL_DEV( 0x059f, 0x0651, 0x0000, 0x0000,
    + "LaCie",
    + "External HDD",
    + USB_SC_DEVICE, USB_PR_DEVICE, NULL,
    + US_FL_NO_WP_DETECT ),
    +
    /* Submitted by Joel Bourquard <numlock@freesurf.ch>
    * Some versions of this device need the SubClass and Protocol overrides
    * while others don't.
    diff --git a/drivers/xen/events.c b/drivers/xen/events.c
    index 9161f06..d6e2dee 100644
    --- a/drivers/xen/events.c
    +++ b/drivers/xen/events.c
    @@ -563,8 +563,8 @@ static unsigned int __startup_pirq(unsigned int irq)
    pirq_query_unmask(irq);

    evtchn_to_irq[evtchn] = irq;
    - bind_evtchn_to_cpu(evtchn, 0);
    info->evtchn = evtchn;
    + bind_evtchn_to_cpu(evtchn, 0);

    out:
    unmask_evtchn(evtchn);
    @@ -906,7 +906,7 @@ static int find_virq(unsigned int virq, unsigned int cpu)
    return rc;
    }

    -int bind_virq_to_irq(unsigned int virq, unsigned int cpu)
    +int bind_virq_to_irq(unsigned int virq, unsigned int cpu, bool percpu)
    {
    struct evtchn_bind_virq bind_virq;
    int evtchn, irq, ret;
    @@ -920,8 +920,12 @@ int bind_virq_to_irq(unsigned int virq, unsigned int cpu)
    if (irq == -1)
    goto out;

    - irq_set_chip_and_handler_name(irq, &xen_percpu_chip,
    - handle_percpu_irq, "virq");
    + if (percpu)
    + irq_set_chip_and_handler_name(irq, &xen_percpu_chip,
    + handle_percpu_irq, "virq");
    + else
    + irq_set_chip_and_handler_name(irq, &xen_dynamic_chip,
    + handle_edge_irq, "virq");

    bind_virq.virq = virq;
    bind_virq.vcpu = cpu;
    @@ -1042,7 +1046,7 @@ int bind_virq_to_irqhandler(unsigned int virq, unsigned int cpu,
    {
    int irq, retval;

    - irq = bind_virq_to_irq(virq, cpu);
    + irq = bind_virq_to_irq(virq, cpu, irqflags & IRQF_PERCPU);
    if (irq < 0)
    return irq;
    retval = request_irq(irq, handler, irqflags, devname, dev_id);
    diff --git a/firmware/ihex2fw.c b/firmware/ihex2fw.c
    index cf38e15..08d90e2 100644
    --- a/firmware/ihex2fw.c
    +++ b/firmware/ihex2fw.c
    @@ -86,6 +86,7 @@ int main(int argc, char **argv)
    case 'j':
    include_jump = 1;
    break;
    + default:
    return usage();
    }
    }
    diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
    index 6dacccef..a181b58 100644
    --- a/fs/binfmt_elf.c
    +++ b/fs/binfmt_elf.c
    @@ -742,6 +742,7 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
    i < loc->elf_ex.e_phnum; i++, elf_ppnt++) {
    int elf_prot = 0, elf_flags;
    unsigned long k, vaddr;
    + unsigned long total_size = 0;

    if (elf_ppnt->p_type != PT_LOAD)
    continue;
    @@ -805,10 +806,16 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
    #else
    load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
    #endif
    + total_size = total_mapping_size(elf_phdata,
    + loc->elf_ex.e_phnum);
    + if (!total_size) {
    + error = -EINVAL;
    + goto out_free_dentry;
    + }
    }

    error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
    - elf_prot, elf_flags, 0);
    + elf_prot, elf_flags, total_size);
    if (BAD_ADDR(error)) {
    send_sig(SIGKILL, current, 0);
    retval = IS_ERR((void *)error) ?
    diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
    index cf6e7f4..f4576dc 100644
    --- a/fs/btrfs/extent-tree.c
    +++ b/fs/btrfs/extent-tree.c
    @@ -5939,12 +5939,11 @@ static int __btrfs_free_reserved_extent(struct btrfs_root *root,
    return -ENOSPC;
    }

    - if (btrfs_test_opt(root, DISCARD))
    - ret = btrfs_discard_extent(root, start, len, NULL);
    -
    if (pin)
    pin_down_extent(root, cache, start, len, 1);
    else {
    + if (btrfs_test_opt(root, DISCARD))
    + ret = btrfs_discard_extent(root, start, len, NULL);
    btrfs_add_free_space(cache, start, len);
    btrfs_update_reserved_bytes(cache, len, RESERVE_FREE);
    }
    diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
    index 3a65f43..d46c481 100644
    --- a/fs/btrfs/ioctl.c
    +++ b/fs/btrfs/ioctl.c
    @@ -2374,6 +2374,11 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
    if (off + len == src->i_size)
    len = ALIGN(src->i_size, bs) - off;

    + if (len == 0) {
    + ret = 0;
    + goto out_unlock;
    + }
    +
    /* verify the end result is block aligned */
    if (!IS_ALIGNED(off, bs) || !IS_ALIGNED(off + len, bs) ||
    !IS_ALIGNED(destoff, bs))
    diff --git a/fs/btrfs/xattr.c b/fs/btrfs/xattr.c
    index e7a5659..0ee73d1 100644
    --- a/fs/btrfs/xattr.c
    +++ b/fs/btrfs/xattr.c
    @@ -310,21 +310,40 @@ const struct xattr_handler *btrfs_xattr_handlers[] = {
    /*
    * Check if the attribute is in a supported namespace.
    *
    - * This applied after the check for the synthetic attributes in the system
    + * This is applied after the check for the synthetic attributes in the system
    * namespace.
    */
    -static bool btrfs_is_valid_xattr(const char *name)
    +static int btrfs_is_valid_xattr(const char *name)
    {
    - return !strncmp(name, XATTR_SECURITY_PREFIX,
    - XATTR_SECURITY_PREFIX_LEN) ||
    - !strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN) ||
    - !strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN) ||
    - !strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN);
    + int len = strlen(name);
    + int prefixlen = 0;
    +
    + if (!strncmp(name, XATTR_SECURITY_PREFIX,
    + XATTR_SECURITY_PREFIX_LEN))
    + prefixlen = XATTR_SECURITY_PREFIX_LEN;
    + else if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN))
    + prefixlen = XATTR_SYSTEM_PREFIX_LEN;
    + else if (!strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN))
    + prefixlen = XATTR_TRUSTED_PREFIX_LEN;
    + else if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN))
    + prefixlen = XATTR_USER_PREFIX_LEN;
    + else
    + return -EOPNOTSUPP;
    +
    + /*
    + * The name cannot consist of just prefix
    + */
    + if (len <= prefixlen)
    + return -EINVAL;
    +
    + return 0;
    }

    ssize_t btrfs_getxattr(struct dentry *dentry, const char *name,
    void *buffer, size_t size)
    {
    + int ret;
    +
    /*
    * If this is a request for a synthetic attribute in the system.*
    * namespace use the generic infrastructure to resolve a handler
    @@ -333,8 +352,9 @@ ssize_t btrfs_getxattr(struct dentry *dentry, const char *name,
    if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN))
    return generic_getxattr(dentry, name, buffer, size);

    - if (!btrfs_is_valid_xattr(name))
    - return -EOPNOTSUPP;
    + ret = btrfs_is_valid_xattr(name);
    + if (ret)
    + return ret;
    return __btrfs_getxattr(dentry->d_inode, name, buffer, size);
    }

    @@ -342,6 +362,7 @@ int btrfs_setxattr(struct dentry *dentry, const char *name, const void *value,
    size_t size, int flags)
    {
    struct btrfs_root *root = BTRFS_I(dentry->d_inode)->root;
    + int ret;

    /*
    * The permission on security.* and system.* is not checked
    @@ -358,8 +379,9 @@ int btrfs_setxattr(struct dentry *dentry, const char *name, const void *value,
    if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN))
    return generic_setxattr(dentry, name, value, size, flags);

    - if (!btrfs_is_valid_xattr(name))
    - return -EOPNOTSUPP;
    + ret = btrfs_is_valid_xattr(name);
    + if (ret)
    + return ret;

    if (size == 0)
    value = ""; /* empty EA, do not remove */
    @@ -371,6 +393,7 @@ int btrfs_setxattr(struct dentry *dentry, const char *name, const void *value,
    int btrfs_removexattr(struct dentry *dentry, const char *name)
    {
    struct btrfs_root *root = BTRFS_I(dentry->d_inode)->root;
    + int ret;

    /*
    * The permission on security.* and system.* is not checked
    @@ -387,8 +410,9 @@ int btrfs_removexattr(struct dentry *dentry, const char *name)
    if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN))
    return generic_removexattr(dentry, name);

    - if (!btrfs_is_valid_xattr(name))
    - return -EOPNOTSUPP;
    + ret = btrfs_is_valid_xattr(name);
    + if (ret)
    + return ret;

    return __btrfs_setxattr(NULL, dentry->d_inode, name, NULL, 0,
    XATTR_REPLACE);
    diff --git a/fs/dcache.c b/fs/dcache.c
    index 8038a78..d071ea7 100644
    --- a/fs/dcache.c
    +++ b/fs/dcache.c
    @@ -1204,13 +1204,13 @@ ascend:
    /* might go back up the wrong parent if we have had a rename */
    if (!locked && read_seqretry(&rename_lock, seq))
    goto rename_retry;
    - next = child->d_child.next;
    - while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) {
    + /* go into the first sibling still alive */
    + do {
    + next = child->d_child.next;
    if (next == &this_parent->d_subdirs)
    goto ascend;
    child = list_entry(next, struct dentry, d_child);
    - next = next->next;
    - }
    + } while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED));
    rcu_read_unlock();
    goto resume;
    }
    diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
    index 4296a6f..bbe09a9 100644
    --- a/fs/ext4/extents.c
    +++ b/fs/ext4/extents.c
    @@ -320,7 +320,7 @@ static int ext4_valid_extent(struct inode *inode, struct ext4_extent *ext)
    ext4_lblk_t lblock = le32_to_cpu(ext->ee_block);
    ext4_lblk_t last = lblock + len - 1;

    - if (lblock > last)
    + if (len == 0 || lblock > last)
    return 0;
    return ext4_data_block_valid(EXT4_SB(inode->i_sb), block, len);
    }
    @@ -4365,13 +4365,6 @@ long ext4_fallocate(struct file *file, int mode, loff_t offset, loff_t len)
    struct ext4_map_blocks map;
    unsigned int credits, blkbits = inode->i_blkbits;

    - /*
    - * currently supporting (pre)allocate mode for extent-based
    - * files _only_
    - */
    - if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)))
    - return -EOPNOTSUPP;
    -
    /* Return error if mode is not supported */
    if (mode & ~(FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE))
    return -EOPNOTSUPP;
    @@ -4392,6 +4385,15 @@ long ext4_fallocate(struct file *file, int mode, loff_t offset, loff_t len)
    */
    credits = ext4_chunk_trans_blocks(inode, max_blocks);
    mutex_lock(&inode->i_mutex);
    +
    + /*
    + * We only support preallocation for extent-based files only
    + */
    + if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))) {
    + mutex_unlock(&inode->i_mutex);
    + return -EOPNOTSUPP;
    + }
    +
    ret = inode_newsize_ok(inode, (len + offset));
    if (ret) {
    mutex_unlock(&inode->i_mutex);
    diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
    index dc58523..e1e1d46 100644
    --- a/fs/ext4/namei.c
    +++ b/fs/ext4/namei.c
    @@ -1469,7 +1469,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
    struct inode *inode)
    {
    struct inode *dir = dentry->d_parent->d_inode;
    - struct buffer_head *bh;
    + struct buffer_head *bh = NULL;
    struct ext4_dir_entry_2 *de;
    struct super_block *sb;
    int retval;
    @@ -1484,7 +1484,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
    if (is_dx(dir)) {
    retval = ext4_dx_add_entry(handle, dentry, inode);
    if (!retval || (retval != ERR_BAD_DX_DIR))
    - return retval;
    + goto out;
    ext4_clear_inode_flag(dir, EXT4_INODE_INDEX);
    dx_fallback++;
    ext4_mark_inode_dirty(handle, dir);
    @@ -1495,14 +1495,15 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
    if(!bh)
    return retval;
    retval = add_dirent_to_buf(handle, dentry, inode, NULL, bh);
    - if (retval != -ENOSPC) {
    - brelse(bh);
    - return retval;
    - }
    + if (retval != -ENOSPC)
    + goto out;

    if (blocks == 1 && !dx_fallback &&
    - EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX))
    - return make_indexed_dir(handle, dentry, inode, bh);
    + EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX)) {
    + retval = make_indexed_dir(handle, dentry, inode, bh);
    + bh = NULL; /* make_indexed_dir releases bh */
    + goto out;
    + }
    brelse(bh);
    }
    bh = ext4_append(handle, dir, &block, &retval);
    @@ -1512,6 +1513,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
    de->inode = 0;
    de->rec_len = ext4_rec_len_to_disk(blocksize, blocksize);
    retval = add_dirent_to_buf(handle, dentry, inode, de, bh);
    +out:
    brelse(bh);
    if (retval == 0)
    ext4_set_inode_state(inode, EXT4_STATE_NEWENTRY);
    diff --git a/fs/fhandle.c b/fs/fhandle.c
    index a48e4a1..f7c18e9 100644
    --- a/fs/fhandle.c
    +++ b/fs/fhandle.c
    @@ -198,8 +198,9 @@ static int handle_to_path(int mountdirfd, struct file_handle __user *ufh,
    goto out_err;
    }
    /* copy the full handle */
    - if (copy_from_user(handle, ufh,
    - sizeof(struct file_handle) +
    + *handle = f_handle;
    + if (copy_from_user(&handle->f_handle,
    + &ufh->f_handle,
    f_handle.handle_bytes)) {
    retval = -EFAULT;
    goto out_handle;
    diff --git a/fs/namei.c b/fs/namei.c
    index bdcd705..9c4b9b8 100644
    --- a/fs/namei.c
    +++ b/fs/namei.c
    @@ -1314,7 +1314,8 @@ static inline int walk_component(struct nameidata *nd, struct path *path,
    }
    if (should_follow_link(inode, follow)) {
    if (nd->flags & LOOKUP_RCU) {
    - if (unlikely(unlazy_walk(nd, path->dentry))) {
    + if (unlikely(nd->path.mnt != path->mnt ||
    + unlazy_walk(nd, path->dentry))) {
    terminate_walk(nd);
    return -ECHILD;
    }
    diff --git a/fs/nfs/callback.c b/fs/nfs/callback.c
    index 38a44c6..0184e91 100644
    --- a/fs/nfs/callback.c
    +++ b/fs/nfs/callback.c
    @@ -156,6 +156,7 @@ nfs41_callback_svc(void *vrqstp)
    struct rpc_rqst, rq_bc_list);
    list_del(&req->rq_bc_list);
    spin_unlock_bh(&serv->sv_cb_lock);
    + finish_wait(&serv->sv_cb_waitq, &wq);
    dprintk("Invoking bc_svc_process()\n");
    error = bc_svc_process(serv, req, rqstp);
    dprintk("bc_svc_process() returned w/ error code= %d\n",
    @@ -163,8 +164,9 @@ nfs41_callback_svc(void *vrqstp)
    } else {
    spin_unlock_bh(&serv->sv_cb_lock);
    schedule();
    + finish_wait(&serv->sv_cb_waitq, &wq);
    }
    - finish_wait(&serv->sv_cb_waitq, &wq);
    + flush_signals(current);
    }
    return 0;
    }
    diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
    index a4b87c6..6143a1e 100644
    --- a/fs/nfsd/nfs4state.c
    +++ b/fs/nfsd/nfs4state.c
    @@ -3364,10 +3364,17 @@ static int check_stateid_generation(stateid_t *in, stateid_t *ref, bool has_sess
    return nfserr_old_stateid;
    }

    +static __be32 nfsd4_check_openowner_confirmed(struct nfs4_ol_stateid *ols)
    +{
    + if (ols->st_stateowner->so_is_open_owner &&
    + !(openowner(ols->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED))
    + return nfserr_bad_stateid;
    + return nfs_ok;
    +}
    +
    __be32 nfs4_validate_stateid(struct nfs4_client *cl, stateid_t *stateid)
    {
    struct nfs4_stid *s;
    - struct nfs4_ol_stateid *ols;
    __be32 status;

    if (STALE_STATEID(stateid))
    @@ -3381,11 +3388,7 @@ __be32 nfs4_validate_stateid(struct nfs4_client *cl, stateid_t *stateid)
    return status;
    if (!(s->sc_type & (NFS4_OPEN_STID | NFS4_LOCK_STID)))
    return nfs_ok;
    - ols = openlockstateid(s);
    - if (ols->st_stateowner->so_is_open_owner
    - && !(openowner(ols->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED))
    - return nfserr_bad_stateid;
    - return nfs_ok;
    + return nfsd4_check_openowner_confirmed(openlockstateid(s));
    }

    static __be32 nfsd4_lookup_stateid(stateid_t *stateid, unsigned char typemask, struct nfs4_stid **s)
    @@ -3452,8 +3455,8 @@ nfs4_preprocess_stateid_op(struct nfsd4_compound_state *cstate,
    status = nfs4_check_fh(current_fh, stp);
    if (status)
    goto out;
    - if (stp->st_stateowner->so_is_open_owner
    - && !(openowner(stp->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED))
    + status = nfsd4_check_openowner_confirmed(stp);
    + if (status)
    goto out;
    status = nfs4_check_openmode(stp, flags);
    if (status)
    diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
    index 4db777d..c8bc7ea 100644
    --- a/fs/nfsd/nfsctl.c
    +++ b/fs/nfsd/nfsctl.c
    @@ -1163,15 +1163,15 @@ static int __init init_nfsd(void)
    int retval;
    printk(KERN_INFO "Installing knfsd (copyright (C) 1996 okir@monad.swb.de).\n");

    - retval = register_cld_notifier();
    - if (retval)
    - return retval;
    retval = register_pernet_subsys(&nfsd_net_ops);
    if (retval < 0)
    - goto out_unregister_notifier;
    - retval = nfsd4_init_slabs();
    + return retval;
    + retval = register_cld_notifier();
    if (retval)
    goto out_unregister_pernet;
    + retval = nfsd4_init_slabs();
    + if (retval)
    + goto out_unregister_notifier;
    nfs4_state_init();
    retval = nfsd_fault_inject_init(); /* nfsd fault injection controls */
    if (retval)
    @@ -1209,10 +1209,10 @@ out_free_stat:
    nfsd_fault_inject_cleanup();
    out_free_slabs:
    nfsd4_free_slabs();
    -out_unregister_pernet:
    - unregister_pernet_subsys(&nfsd_net_ops);
    out_unregister_notifier:
    unregister_cld_notifier();
    +out_unregister_pernet:
    + unregister_pernet_subsys(&nfsd_net_ops);
    return retval;
    }

    @@ -1228,8 +1228,8 @@ static void __exit exit_nfsd(void)
    nfsd4_free_slabs();
    nfsd_fault_inject_cleanup();
    unregister_filesystem(&nfsd_fs_type);
    - unregister_pernet_subsys(&nfsd_net_ops);
    unregister_cld_notifier();
    + unregister_pernet_subsys(&nfsd_net_ops);
    }

    MODULE_AUTHOR("Olaf Kirch <okir@monad.swb.de>");
    diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c
    index ecdbae1..090d8ce 100644
    --- a/fs/nilfs2/btree.c
    +++ b/fs/nilfs2/btree.c
    @@ -388,7 +388,7 @@ static int nilfs_btree_root_broken(const struct nilfs_btree_node *node,
    nchildren = nilfs_btree_node_get_nchildren(node);

    if (unlikely(level < NILFS_BTREE_LEVEL_NODE_MIN ||
    - level > NILFS_BTREE_LEVEL_MAX ||
    + level >= NILFS_BTREE_LEVEL_MAX ||
    nchildren < 0 ||
    nchildren > NILFS_BTREE_ROOT_NCHILDREN_MAX)) {
    pr_crit("NILFS: bad btree root (inode number=%lu): level = %d, flags = 0x%x, nchildren = %d\n",
    diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
    index dbc372e..7ba6ac1 100644
    --- a/fs/ocfs2/dlm/dlmmaster.c
    +++ b/fs/ocfs2/dlm/dlmmaster.c
    @@ -729,6 +729,19 @@ lookup:
    if (tmpres) {
    spin_unlock(&dlm->spinlock);
    spin_lock(&tmpres->spinlock);
    +
    + /*
    + * Right after dlm spinlock was released, dlm_thread could have
    + * purged the lockres. Check if lockres got unhashed. If so
    + * start over.
    + */
    + if (hlist_unhashed(&tmpres->hash_node)) {
    + spin_unlock(&tmpres->spinlock);
    + dlm_lockres_put(tmpres);
    + tmpres = NULL;
    + goto lookup;
    + }
    +
    /* Wait on the thread that is mastering the resource */
    if (tmpres->owner == DLM_LOCK_RES_OWNER_UNKNOWN) {
    __dlm_wait_on_lockres(tmpres);
    diff --git a/fs/omfs/inode.c b/fs/omfs/inode.c
    index dbc8422..798dedc 100644
    --- a/fs/omfs/inode.c
    +++ b/fs/omfs/inode.c
    @@ -361,7 +361,7 @@ nomem:
    }

    enum {
    - Opt_uid, Opt_gid, Opt_umask, Opt_dmask, Opt_fmask
    + Opt_uid, Opt_gid, Opt_umask, Opt_dmask, Opt_fmask, Opt_err
    };

    static const match_table_t tokens = {
    @@ -370,6 +370,7 @@ static const match_table_t tokens = {
    {Opt_umask, "umask=%o"},
    {Opt_dmask, "dmask=%o"},
    {Opt_fmask, "fmask=%o"},
    + {Opt_err, NULL},
    };

    static int parse_options(char *options, struct omfs_sb_info *sbi)
    diff --git a/fs/pipe.c b/fs/pipe.c
    index 1667e6f..abfb935 100644
    --- a/fs/pipe.c
    +++ b/fs/pipe.c
    @@ -104,25 +104,27 @@ void pipe_wait(struct pipe_inode_info *pipe)
    }

    static int
    -pipe_iov_copy_from_user(void *to, struct iovec *iov, unsigned long len,
    - int atomic)
    +pipe_iov_copy_from_user(void *addr, int *offset, struct iovec *iov,
    + size_t *remaining, int atomic)
    {
    unsigned long copy;

    - while (len > 0) {
    + while (*remaining > 0) {
    while (!iov->iov_len)
    iov++;
    - copy = min_t(unsigned long, len, iov->iov_len);
    + copy = min_t(unsigned long, *remaining, iov->iov_len);

    if (atomic) {
    - if (__copy_from_user_inatomic(to, iov->iov_base, copy))
    + if (__copy_from_user_inatomic(addr + *offset,
    + iov->iov_base, copy))
    return -EFAULT;
    } else {
    - if (copy_from_user(to, iov->iov_base, copy))
    + if (copy_from_user(addr + *offset,
    + iov->iov_base, copy))
    return -EFAULT;
    }
    - to += copy;
    - len -= copy;
    + *offset += copy;
    + *remaining -= copy;
    iov->iov_base += copy;
    iov->iov_len -= copy;
    }
    @@ -130,25 +132,27 @@ pipe_iov_copy_from_user(void *to, struct iovec *iov, unsigned long len,
    }

    static int
    -pipe_iov_copy_to_user(struct iovec *iov, const void *from, unsigned long len,
    - int atomic)
    +pipe_iov_copy_to_user(struct iovec *iov, void *addr, int *offset,
    + size_t *remaining, int atomic)
    {
    unsigned long copy;

    - while (len > 0) {
    + while (*remaining > 0) {
    while (!iov->iov_len)
    iov++;
    - copy = min_t(unsigned long, len, iov->iov_len);
    + copy = min_t(unsigned long, *remaining, iov->iov_len);

    if (atomic) {
    - if (__copy_to_user_inatomic(iov->iov_base, from, copy))
    + if (__copy_to_user_inatomic(iov->iov_base,
    + addr + *offset, copy))
    return -EFAULT;
    } else {
    - if (copy_to_user(iov->iov_base, from, copy))
    + if (copy_to_user(iov->iov_base,
    + addr + *offset, copy))
    return -EFAULT;
    }
    - from += copy;
    - len -= copy;
    + *offset += copy;
    + *remaining -= copy;
    iov->iov_base += copy;
    iov->iov_len -= copy;
    }
    @@ -384,7 +388,7 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov,
    struct pipe_buffer *buf = pipe->bufs + curbuf;
    const struct pipe_buf_operations *ops = buf->ops;
    void *addr;
    - size_t chars = buf->len;
    + size_t chars = buf->len, remaining;
    int error, atomic;

    if (chars > total_len)
    @@ -398,9 +402,11 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov,
    }

    atomic = !iov_fault_in_pages_write(iov, chars);
    + remaining = chars;
    redo:
    addr = ops->map(pipe, buf, atomic);
    - error = pipe_iov_copy_to_user(iov, addr + buf->offset, chars, atomic);
    + error = pipe_iov_copy_to_user(iov, addr, &buf->offset,
    + &remaining, atomic);
    ops->unmap(pipe, buf, addr);
    if (unlikely(error)) {
    /*
    @@ -415,7 +421,6 @@ redo:
    break;
    }
    ret += chars;
    - buf->offset += chars;
    buf->len -= chars;

    /* Was it a packet buffer? Clean up and exit */
    @@ -522,6 +527,7 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
    if (ops->can_merge && offset + chars <= PAGE_SIZE) {
    int error, atomic = 1;
    void *addr;
    + size_t remaining = chars;

    error = ops->confirm(pipe, buf);
    if (error)
    @@ -530,8 +536,8 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
    iov_fault_in_pages_read(iov, chars);
    redo1:
    addr = ops->map(pipe, buf, atomic);
    - error = pipe_iov_copy_from_user(offset + addr, iov,
    - chars, atomic);
    + error = pipe_iov_copy_from_user(addr, &offset, iov,
    + &remaining, atomic);
    ops->unmap(pipe, buf, addr);
    ret = error;
    do_wakeup = 1;
    @@ -566,6 +572,8 @@ redo1:
    struct page *page = pipe->tmp_page;
    char *src;
    int error, atomic = 1;
    + int offset = 0;
    + size_t remaining;

    if (!page) {
    page = alloc_page(GFP_HIGHUSER);
    @@ -586,14 +594,15 @@ redo1:
    chars = total_len;

    iov_fault_in_pages_read(iov, chars);
    + remaining = chars;
    redo2:
    if (atomic)
    src = kmap_atomic(page);
    else
    src = kmap(page);

    - error = pipe_iov_copy_from_user(src, iov, chars,
    - atomic);
    + error = pipe_iov_copy_from_user(src, &offset, iov,
    + &remaining, atomic);
    if (atomic)
    kunmap_atomic(src);
    else
    diff --git a/fs/udf/inode.c b/fs/udf/inode.c
    index 8053ee7..330ec8c 100644
    --- a/fs/udf/inode.c
    +++ b/fs/udf/inode.c
    @@ -1392,6 +1392,19 @@ static void udf_fill_inode(struct inode *inode, struct buffer_head *bh)
    iinfo->i_lenEAttr;
    }

    + /*
    + * Sanity check length of allocation descriptors and extended attrs to
    + * avoid integer overflows
    + */
    + if (iinfo->i_lenEAttr > inode->i_sb->s_blocksize || iinfo->i_lenAlloc > inode->i_sb->s_blocksize) {
    + make_bad_inode(inode);
    + return;
    + }
    + /* Now do exact checks */
    + if (udf_file_entry_alloc_offset(inode) + iinfo->i_lenAlloc > inode->i_sb->s_blocksize) {
    + make_bad_inode(inode);
    + return;
    + }
    /* Sanity checks for files in ICB so that we don't get confused later */
    if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {
    /*
    diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h
    index e8bcc47..6d52429 100644
    --- a/include/acpi/actypes.h
    +++ b/include/acpi/actypes.h
    @@ -198,9 +198,29 @@ typedef int INT32;
    typedef s32 acpi_native_int;

    typedef u32 acpi_size;
    +
    +#ifdef ACPI_32BIT_PHYSICAL_ADDRESS
    +
    +/*
    + * OSPMs can define this to shrink the size of the structures for 32-bit
    + * none PAE environment. ASL compiler may always define this to generate
    + * 32-bit OSPM compliant tables.
    + */
    typedef u32 acpi_io_address;
    typedef u32 acpi_physical_address;

    +#else /* ACPI_32BIT_PHYSICAL_ADDRESS */
    +
    +/*
    + * It is reported that, after some calculations, the physical addresses can
    + * wrap over the 32-bit boundary on 32-bit PAE environment.
    + * https://bugzilla.kernel.org/show_bug.cgi?id=87971
    + */
    +typedef u64 acpi_io_address;
    +typedef u64 acpi_physical_address;
    +
    +#endif /* ACPI_32BIT_PHYSICAL_ADDRESS */
    +
    #define ACPI_MAX_PTR ACPI_UINT32_MAX
    #define ACPI_SIZE_MAX ACPI_UINT32_MAX

    diff --git a/include/acpi/platform/acenv.h b/include/acpi/platform/acenv.h
    index 5af3ed5..b9f9210 100644
    --- a/include/acpi/platform/acenv.h
    +++ b/include/acpi/platform/acenv.h
    @@ -75,6 +75,7 @@
    #define ACPI_CONSTANT_EVAL_ONLY
    #define ACPI_LARGE_NAMESPACE_NODE
    #define ACPI_DATA_TABLE_DISASSEMBLY
    +#define ACPI_32BIT_PHYSICAL_ADDRESS
    #endif

    #ifdef ACPI_EXEC_APP
    diff --git a/include/linux/jhash.h b/include/linux/jhash.h
    index 47cb09e..348c6f4 100644
    --- a/include/linux/jhash.h
    +++ b/include/linux/jhash.h
    @@ -145,11 +145,11 @@ static inline u32 jhash2(const u32 *k, u32 length, u32 initval)
    }


    -/* jhash_3words - hash exactly 3, 2 or 1 word(s) */
    -static inline u32 jhash_3words(u32 a, u32 b, u32 c, u32 initval)
    +/* __jhash_nwords - hash exactly 3, 2 or 1 word(s) */
    +static inline u32 __jhash_nwords(u32 a, u32 b, u32 c, u32 initval)
    {
    - a += JHASH_INITVAL;
    - b += JHASH_INITVAL;
    + a += initval;
    + b += initval;
    c += initval;

    __jhash_final(a, b, c);
    @@ -157,14 +157,19 @@ static inline u32 jhash_3words(u32 a, u32 b, u32 c, u32 initval)
    return c;
    }

    +static inline u32 jhash_3words(u32 a, u32 b, u32 c, u32 initval)
    +{
    + return __jhash_nwords(a, b, c, initval + JHASH_INITVAL + (3 << 2));
    +}
    +
    static inline u32 jhash_2words(u32 a, u32 b, u32 initval)
    {
    - return jhash_3words(a, b, 0, initval);
    + return __jhash_nwords(a, b, 0, initval + JHASH_INITVAL + (2 << 2));
    }

    static inline u32 jhash_1word(u32 a, u32 initval)
    {
    - return jhash_3words(a, 0, 0, initval);
    + return __jhash_nwords(a, 0, 0, initval + JHASH_INITVAL + (1 << 2));
    }

    #endif /* _LINUX_JHASH_H */
    diff --git a/include/linux/libata.h b/include/linux/libata.h
    index 764cd54..35e7f71 100644
    --- a/include/linux/libata.h
    +++ b/include/linux/libata.h
    @@ -182,6 +182,7 @@ enum {
    ATA_LFLAG_DISABLED = (1 << 6), /* link is disabled */
    ATA_LFLAG_SW_ACTIVITY = (1 << 7), /* keep activity stats */
    ATA_LFLAG_NO_LPM = (1 << 8), /* disable LPM on this link */
    + ATA_LFLAG_CHANGED = (1 << 10), /* LPM state changed on this link */

    /* struct ata_port flags */
    ATA_FLAG_SLAVE_POSS = (1 << 0), /* host supports slave dev */
    @@ -285,6 +286,12 @@ enum {
    */
    ATA_TMOUT_PMP_SRST_WAIT = 5000,

    + /* When the LPM policy is set to ATA_LPM_MAX_POWER, there might
    + * be a spurious PHY event, so ignore the first PHY event that
    + * occurs within 10s after the policy change.
    + */
    + ATA_TMOUT_SPURIOUS_PHY = 10000,
    +
    /* ATA bus states */
    BUS_UNKNOWN = 0,
    BUS_DMA = 1,
    @@ -727,6 +734,8 @@ struct ata_link {
    struct ata_eh_context eh_context;

    struct ata_device device[ATA_MAX_DEVICES];
    +
    + unsigned long last_lpm_change; /* when last LPM change happened */
    };
    #define ATA_LINK_CLEAR_BEGIN offsetof(struct ata_link, active_tag)
    #define ATA_LINK_CLEAR_END offsetof(struct ata_link, device[0])
    @@ -1065,6 +1074,7 @@ extern struct ata_device *ata_dev_pair(struct ata_device *adev);
    extern int ata_do_set_mode(struct ata_link *link, struct ata_device **r_failed_dev);
    extern void ata_scsi_port_error_handler(struct Scsi_Host *host, struct ata_port *ap);
    extern void ata_scsi_cmd_error_handler(struct Scsi_Host *host, struct ata_port *ap, struct list_head *eh_q);
    +extern bool sata_lpm_ignore_phy_events(struct ata_link *link);

    extern int ata_cable_40wire(struct ata_port *ap);
    extern int ata_cable_80wire(struct ata_port *ap);
    diff --git a/include/linux/nilfs2_fs.h b/include/linux/nilfs2_fs.h
    index 89bd4a4..25c6891 100644
    --- a/include/linux/nilfs2_fs.h
    +++ b/include/linux/nilfs2_fs.h
    @@ -458,7 +458,7 @@ struct nilfs_btree_node {
    /* level */
    #define NILFS_BTREE_LEVEL_DATA 0
    #define NILFS_BTREE_LEVEL_NODE_MIN (NILFS_BTREE_LEVEL_DATA + 1)
    -#define NILFS_BTREE_LEVEL_MAX 14
    +#define NILFS_BTREE_LEVEL_MAX 14 /* Max level (exclusive) */

    /**
    * struct nilfs_palloc_group_desc - block group descriptor
    diff --git a/include/scsi/scsi_devinfo.h b/include/scsi/scsi_devinfo.h
    index b4ddd3b..fc8cdff 100644
    --- a/include/scsi/scsi_devinfo.h
    +++ b/include/scsi/scsi_devinfo.h
    @@ -30,4 +30,5 @@
    #define BLIST_RETRY_HWERROR 0x400000 /* retry HARDWARE_ERROR */
    #define BLIST_MAX_512 0x800000 /* maximum 512 sector cdb length */
    #define BLIST_ATTACH_PQ3 0x1000000 /* Scan: Attach to PQ3 devices */
    +#define BLIST_MAX_1024 0x40000000 /* maximum 1024 sector cdb length */
    #endif
    diff --git a/include/sound/emu10k1.h b/include/sound/emu10k1.h
    index 4f865df..7ee55e3 100644
    --- a/include/sound/emu10k1.h
    +++ b/include/sound/emu10k1.h
    @@ -43,7 +43,8 @@

    #define EMUPAGESIZE 4096
    #define MAXREQVOICES 8
    -#define MAXPAGES 8192
    +#define MAXPAGES0 4096 /* 32 bit mode */
    +#define MAXPAGES1 8192 /* 31 bit mode */
    #define RESERVED 0
    #define NUM_MIDI 16
    #define NUM_G 64 /* use all channels */
    @@ -52,8 +53,7 @@

    /* FIXME? - according to the OSS driver the EMU10K1 needs a 29 bit DMA mask */
    #define EMU10K1_DMA_MASK 0x7fffffffUL /* 31bit */
    -#define AUDIGY_DMA_MASK 0x7fffffffUL /* 31bit FIXME - 32 should work? */
    - /* See ALSA bug #1276 - rlrevell */
    +#define AUDIGY_DMA_MASK 0xffffffffUL /* 32bit mode */

    #define TMEMSIZE 256*1024
    #define TMEMSIZEREG 4
    @@ -470,8 +470,11 @@

    #define MAPB 0x0d /* Cache map B */

    -#define MAP_PTE_MASK 0xffffe000 /* The 19 MSBs of the PTE indexed by the PTI */
    -#define MAP_PTI_MASK 0x00001fff /* The 13 bit index to one of the 8192 PTE dwords */
    +#define MAP_PTE_MASK0 0xfffff000 /* The 20 MSBs of the PTE indexed by the PTI */
    +#define MAP_PTI_MASK0 0x00000fff /* The 12 bit index to one of the 4096 PTE dwords */
    +
    +#define MAP_PTE_MASK1 0xffffe000 /* The 19 MSBs of the PTE indexed by the PTI */
    +#define MAP_PTI_MASK1 0x00001fff /* The 13 bit index to one of the 8192 PTE dwords */

    /* 0x0e, 0x0f: Not used */

    @@ -1708,6 +1711,7 @@ struct snd_emu10k1 {
    unsigned short model; /* subsystem id */
    unsigned int card_type; /* EMU10K1_CARD_* */
    unsigned int ecard_ctrl; /* ecard control bits */
    + unsigned int address_mode; /* address mode */
    unsigned long dma_mask; /* PCI DMA mask */
    unsigned int delay_pcm_irq; /* in samples */
    int max_cache_pages; /* max memory size / PAGE_SIZE */
    diff --git a/include/xen/events.h b/include/xen/events.h
    index 04399b2..f9cb630 100644
    --- a/include/xen/events.h
    +++ b/include/xen/events.h
    @@ -12,7 +12,7 @@ int bind_evtchn_to_irqhandler(unsigned int evtchn,
    irq_handler_t handler,
    unsigned long irqflags, const char *devname,
    void *dev_id);
    -int bind_virq_to_irq(unsigned int virq, unsigned int cpu);
    +int bind_virq_to_irq(unsigned int virq, unsigned int cpu, bool percpu);
    int bind_virq_to_irqhandler(unsigned int virq, unsigned int cpu,
    irq_handler_t handler,
    unsigned long irqflags, const char *devname,
    diff --git a/kernel/ptrace.c b/kernel/ptrace.c
    index a143236..d9e71e3 100644
    --- a/kernel/ptrace.c
    +++ b/kernel/ptrace.c
    @@ -632,6 +632,8 @@ static int ptrace_setsiginfo(struct task_struct *child, const siginfo_t *info)
    static int ptrace_resume(struct task_struct *child, long request,
    unsigned long data)
    {
    + bool need_siglock;
    +
    if (!valid_signal(data))
    return -EIO;

    @@ -659,8 +661,26 @@ static int ptrace_resume(struct task_struct *child, long request,
    user_disable_single_step(child);
    }

    + /*
    + * Change ->exit_code and ->state under siglock to avoid the race
    + * with wait_task_stopped() in between; a non-zero ->exit_code will
    + * wrongly look like another report from tracee.
    + *
    + * Note that we need siglock even if ->exit_code == data and/or this
    + * status was not reported yet, the new status must not be cleared by
    + * wait_task_stopped() after resume.
    + *
    + * If data == 0 we do not care if wait_task_stopped() reports the old
    + * status and clears the code too; this can't race with the tracee, it
    + * takes siglock after resume.
    + */
    + need_siglock = data && !thread_group_empty(current);
    + if (need_siglock)
    + spin_lock_irq(&child->sighand->siglock);
    child->exit_code = data;
    wake_up_state(child, __TASK_TRACED);
    + if (need_siglock)
    + spin_unlock_irq(&child->sighand->siglock);

    return 0;
    }
    diff --git a/kernel/sched/core.c b/kernel/sched/core.c
    index 2f8363e..15be435 100644
    --- a/kernel/sched/core.c
    +++ b/kernel/sched/core.c
    @@ -4396,8 +4396,13 @@ recheck:

    if (running)
    p->sched_class->set_curr_task(rq);
    - if (on_rq)
    - enqueue_task(rq, p, 0);
    + if (on_rq) {
    + /*
    + * We enqueue to tail when the priority of a task is
    + * increased (user space view).
    + */
    + enqueue_task(rq, p, oldprio <= p->prio ? ENQUEUE_HEAD : 0);
    + }

    check_class_changed(rq, p, prev_class, oldprio);
    task_rq_unlock(rq, p, &flags);
    diff --git a/kernel/trace/ring_buffer_benchmark.c b/kernel/trace/ring_buffer_benchmark.c
    index a5457d5..6ad2e2d 100644
    --- a/kernel/trace/ring_buffer_benchmark.c
    +++ b/kernel/trace/ring_buffer_benchmark.c
    @@ -455,7 +455,7 @@ static int __init ring_buffer_benchmark_init(void)

    if (producer_fifo >= 0) {
    struct sched_param param = {
    - .sched_priority = consumer_fifo
    + .sched_priority = producer_fifo
    };
    sched_setscheduler(producer, SCHED_FIFO, &param);
    } else
    diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
    index 289197a..3b04aec 100644
    --- a/kernel/trace/trace_events_filter.c
    +++ b/kernel/trace/trace_events_filter.c
    @@ -1357,19 +1357,25 @@ static int check_preds(struct filter_parse_state *ps)
    {
    int n_normal_preds = 0, n_logical_preds = 0;
    struct postfix_elt *elt;
    + int cnt = 0;

    list_for_each_entry(elt, &ps->postfix, list) {
    - if (elt->op == OP_NONE)
    + if (elt->op == OP_NONE) {
    + cnt++;
    continue;
    + }

    if (elt->op == OP_AND || elt->op == OP_OR) {
    n_logical_preds++;
    + cnt--;
    continue;
    }
    + cnt--;
    n_normal_preds++;
    + WARN_ON_ONCE(cnt < 0);
    }

    - if (!n_normal_preds || n_logical_preds >= n_normal_preds) {
    + if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) {
    parse_error(ps, FILT_ERR_INVALID_FILTER, 0);
    return -EINVAL;
    }
    diff --git a/mm/memory-failure.c b/mm/memory-failure.c
    index 97eec21..c957a37 100644
    --- a/mm/memory-failure.c
    +++ b/mm/memory-failure.c
    @@ -1095,10 +1095,10 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
    * The check (unnecessarily) ignores LRU pages being isolated and
    * walked by the page reclaim code, however that's not a big loss.
    */
    - if (!PageHuge(p) && !PageTransTail(p)) {
    - if (!PageLRU(p))
    - shake_page(p, 0);
    - if (!PageLRU(p)) {
    + if (!PageHuge(p)) {
    + if (!PageLRU(hpage))
    + shake_page(hpage, 0);
    + if (!PageLRU(hpage)) {
    /*
    * shake_page could have turned it free.
    */
    diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
    index 5ba0c84..3cb93e8 100644
    --- a/net/bridge/br_fdb.c
    +++ b/net/bridge/br_fdb.c
    @@ -440,7 +440,7 @@ void br_fdb_update(struct net_bridge *br, struct net_bridge_port *source,
    fdb->updated = jiffies;
    }
    } else {
    - spin_lock(&br->hash_lock);
    + spin_lock_bh(&br->hash_lock);
    if (likely(!fdb_find(head, addr))) {
    fdb = fdb_create(head, source, addr);
    if (fdb)
    @@ -449,7 +449,7 @@ void br_fdb_update(struct net_bridge *br, struct net_bridge_port *source,
    /* else we lose race and someone else inserts
    * it first, don't bother updating
    */
    - spin_unlock(&br->hash_lock);
    + spin_unlock_bh(&br->hash_lock);
    }
    }

    @@ -665,9 +665,11 @@ int br_fdb_add(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
    }

    if (ndm->ndm_flags & NTF_USE) {
    + local_bh_disable();
    rcu_read_lock();
    br_fdb_update(p->br, p, addr);
    rcu_read_unlock();
    + local_bh_enable();
    } else {
    spin_lock_bh(&p->br->hash_lock);
    err = fdb_add_entry(p, addr, ndm->ndm_state, nlh->nlmsg_flags);
    diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
    index 0b870d7..a41051a 100644
    --- a/net/bridge/br_multicast.c
    +++ b/net/bridge/br_multicast.c
    @@ -972,7 +972,7 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br,
    }

    err = br_ip6_multicast_add_group(br, port, &grec->grec_mca);
    - if (!err)
    + if (err)
    break;
    }

    @@ -991,6 +991,9 @@ static void br_multicast_add_router(struct net_bridge *br,
    struct net_bridge_port *p;
    struct hlist_node *n, *slot = NULL;

    + if (!hlist_unhashed(&port->rlist))
    + return;
    +
    hlist_for_each_entry(p, n, &br->router_list, rlist) {
    if ((unsigned long) port >= (unsigned long) p)
    break;
    @@ -1018,12 +1021,8 @@ static void br_multicast_mark_router(struct net_bridge *br,
    if (port->multicast_router != 1)
    return;

    - if (!hlist_unhashed(&port->rlist))
    - goto timer;
    -
    br_multicast_add_router(br, port);

    -timer:
    mod_timer(&port->multicast_router_timer,
    now + br->multicast_querier_interval);
    }
    diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
    index e54ef82..5ba4248 100644
    --- a/net/bridge/br_netfilter.c
    +++ b/net/bridge/br_netfilter.c
    @@ -818,12 +818,12 @@ static unsigned int br_nf_forward_arp(unsigned int hook, struct sk_buff *skb,
    return NF_STOLEN;
    }

    -#if IS_ENABLED(CONFIG_NF_CONNTRACK_IPV4)
    +#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV4)
    static int br_nf_dev_queue_xmit(struct sk_buff *skb)
    {
    int ret;

    - if (skb->nfct != NULL && skb->protocol == htons(ETH_P_IP) &&
    + if (skb->protocol == htons(ETH_P_IP) &&
    skb->len + nf_bridge_mtu_reduction(skb) > skb->dev->mtu &&
    !skb_is_gso(skb)) {
    if (br_parse_ip_options(skb))
    diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
    index cb90852..9f471c3 100644
    --- a/net/ipv4/ping.c
    +++ b/net/ipv4/ping.c
    @@ -138,6 +138,7 @@ static void ping_v4_unhash(struct sock *sk)
    if (sk_hashed(sk)) {
    write_lock_bh(&ping_table.lock);
    hlist_nulls_del(&sk->sk_nulls_node);
    + sk_nulls_node_init(&sk->sk_nulls_node);
    sock_put(sk);
    isk->inet_num = 0;
    isk->inet_sport = 0;
    diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
    index 7949b5d..5f8c20b 100644
    --- a/net/ipv4/udp.c
    +++ b/net/ipv4/udp.c
    @@ -1251,10 +1251,8 @@ csum_copy_err:
    UDP_INC_STATS_USER(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
    unlock_sock_fast(sk, slow);

    - if (noblock)
    - return -EAGAIN;
    -
    - /* starting over for a new packet */
    + /* starting over for a new packet, but check if we need to yield */
    + cond_resched();
    msg->msg_flags &= ~MSG_TRUNC;
    goto try_again;
    }
    diff --git a/net/ipv6/route.c b/net/ipv6/route.c
    index 4cfba3d..6a80567 100644
    --- a/net/ipv6/route.c
    +++ b/net/ipv6/route.c
    @@ -1661,6 +1661,28 @@ void rt6_redirect(const struct in6_addr *dest, const struct in6_addr *src,
    goto out;
    }

    +#ifdef CONFIG_IPV6_MULTIPLE_TABLES
    + if (rt == net->ipv6.ip6_blk_hole_entry ||
    + rt == net->ipv6.ip6_prohibit_entry) {
    + if (net_ratelimit())
    + printk(KERN_DEBUG "rt6_redirect: source isn't a valid" \
    + " nexthop for redirect target " \
    + "(blackhole or prohibited)\n");
    + goto out;
    + }
    +#endif
    +
    +#ifdef CONFIG_IPV6_MULTIPLE_TABLES
    + if (rt == net->ipv6.ip6_blk_hole_entry ||
    + rt == net->ipv6.ip6_prohibit_entry) {
    + if (net_ratelimit())
    + printk(KERN_DEBUG "rt6_redirect: source isn't a valid" \
    + " nexthop for redirect target " \
    + "(blackhole or prohibited)\n");
    + goto out;
    + }
    +#endif
    +
    /*
    * We have finally decided to accept it.
    */
    diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
    index ef9052f..2f99b12 100644
    --- a/net/ipv6/udp.c
    +++ b/net/ipv6/udp.c
    @@ -451,10 +451,8 @@ csum_copy_err:
    }
    unlock_sock_fast(sk, slow);

    - if (noblock)
    - return -EAGAIN;
    -
    - /* starting over for a new packet */
    + /* starting over for a new packet, but check if we need to yield */
    + cond_resched();
    msg->msg_flags &= ~MSG_TRUNC;
    goto try_again;
    }
    diff --git a/net/mac80211/wep.c b/net/mac80211/wep.c
    index 7aa31bb..9464f92 100644
    --- a/net/mac80211/wep.c
    +++ b/net/mac80211/wep.c
    @@ -97,8 +97,7 @@ static u8 *ieee80211_wep_add_iv(struct ieee80211_local *local,

    hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);

    - if (WARN_ON(skb_tailroom(skb) < WEP_ICV_LEN ||
    - skb_headroom(skb) < WEP_IV_LEN))
    + if (WARN_ON(skb_headroom(skb) < WEP_IV_LEN))
    return NULL;

    hdrlen = ieee80211_hdrlen(hdr->frame_control);
    @@ -160,6 +159,9 @@ int ieee80211_wep_encrypt(struct ieee80211_local *local,
    size_t len;
    u8 rc4key[3 + WLAN_KEY_LEN_WEP104];

    + if (WARN_ON(skb_tailroom(skb) < WEP_ICV_LEN))
    + return -1;
    +
    iv = ieee80211_wep_add_iv(local, skb, keylen, keyidx);
    if (!iv)
    return -1;
    diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
    index cbc5bfd..f2ed4a9 100644
    --- a/net/netfilter/ipvs/ip_vs_ctl.c
    +++ b/net/netfilter/ipvs/ip_vs_ctl.c
    @@ -3689,6 +3689,9 @@ void __net_exit ip_vs_control_net_cleanup_sysctl(struct net *net)
    cancel_delayed_work_sync(&ipvs->defense_work);
    cancel_work_sync(&ipvs->defense_work.work);
    unregister_net_sysctl_table(ipvs->sysctl_hdr);
    +
    + if (!net_eq(net, &init_net))
    + kfree(ipvs->sysctl_tbl);
    }

    #else
    diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
    index bde7d69..e895636 100644
    --- a/net/rose/af_rose.c
    +++ b/net/rose/af_rose.c
    @@ -194,7 +194,8 @@ static void rose_kill_by_device(struct net_device *dev)

    if (rose->device == dev) {
    rose_disconnect(s, ENETUNREACH, ROSE_OUT_OF_ORDER, 0);
    - rose->neighbour->use--;
    + if (rose->neighbour)
    + rose->neighbour->use--;
    rose->device = NULL;
    }
    }
    diff --git a/net/socket.c b/net/socket.c
    index 025f7f4..f5ce151 100644
    --- a/net/socket.c
    +++ b/net/socket.c
    @@ -1934,14 +1934,12 @@ static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
    int err, ctl_len, iov_size, total_len;

    err = -EFAULT;
    - if (MSG_CMSG_COMPAT & flags) {
    - if (get_compat_msghdr(msg_sys, msg_compat))
    - return -EFAULT;
    - } else {
    + if (MSG_CMSG_COMPAT & flags)
    + err = get_compat_msghdr(msg_sys, msg_compat);
    + else
    err = copy_msghdr_from_user(msg_sys, msg);
    - if (err)
    - return err;
    - }
    + if (err)
    + return err;

    /* do not move before msg_sys is valid */
    err = -EMSGSIZE;
    @@ -2149,14 +2147,12 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
    struct sockaddr __user *uaddr;
    int __user *uaddr_len;

    - if (MSG_CMSG_COMPAT & flags) {
    - if (get_compat_msghdr(msg_sys, msg_compat))
    - return -EFAULT;
    - } else {
    + if (MSG_CMSG_COMPAT & flags)
    + err = get_compat_msghdr(msg_sys, msg_compat);
    + else
    err = copy_msghdr_from_user(msg_sys, msg);
    - if (err)
    - return err;
    - }
    + if (err)
    + return err;

    err = -EMSGSIZE;
    if (msg_sys->msg_iovlen > UIO_MAXIOV)
    diff --git a/security/selinux/nlmsgtab.c b/security/selinux/nlmsgtab.c
    index 0920ea3..5776921 100644
    --- a/security/selinux/nlmsgtab.c
    +++ b/security/selinux/nlmsgtab.c
    @@ -100,6 +100,12 @@ static struct nlmsg_perm nlmsg_xfrm_perms[] =
    { XFRM_MSG_FLUSHPOLICY, NETLINK_XFRM_SOCKET__NLMSG_WRITE },
    { XFRM_MSG_NEWAE, NETLINK_XFRM_SOCKET__NLMSG_WRITE },
    { XFRM_MSG_GETAE, NETLINK_XFRM_SOCKET__NLMSG_READ },
    + { XFRM_MSG_REPORT, NETLINK_XFRM_SOCKET__NLMSG_READ },
    + { XFRM_MSG_MIGRATE, NETLINK_XFRM_SOCKET__NLMSG_WRITE },
    + { XFRM_MSG_NEWSADINFO, NETLINK_XFRM_SOCKET__NLMSG_READ },
    + { XFRM_MSG_GETSADINFO, NETLINK_XFRM_SOCKET__NLMSG_READ },
    + { XFRM_MSG_GETSPDINFO, NETLINK_XFRM_SOCKET__NLMSG_READ },
    + { XFRM_MSG_MAPPING, NETLINK_XFRM_SOCKET__NLMSG_READ },
    };

    static struct nlmsg_perm nlmsg_audit_perms[] =
    diff --git a/sound/pci/emu10k1/emu10k1.c b/sound/pci/emu10k1/emu10k1.c
    index 790c65d..aefde01 100644
    --- a/sound/pci/emu10k1/emu10k1.c
    +++ b/sound/pci/emu10k1/emu10k1.c
    @@ -181,8 +181,10 @@ static int __devinit snd_card_emu10k1_probe(struct pci_dev *pci,
    }
    #endif

    - strcpy(card->driver, emu->card_capabilities->driver);
    - strcpy(card->shortname, emu->card_capabilities->name);
    + strlcpy(card->driver, emu->card_capabilities->driver,
    + sizeof(card->driver));
    + strlcpy(card->shortname, emu->card_capabilities->name,
    + sizeof(card->shortname));
    snprintf(card->longname, sizeof(card->longname),
    "%s (rev.%d, serial:0x%x) at 0x%lx, irq %i",
    card->shortname, emu->revision, emu->serial, emu->port, emu->irq);
    diff --git a/sound/pci/emu10k1/emu10k1_callback.c b/sound/pci/emu10k1/emu10k1_callback.c
    index f35284b..8295950 100644
    --- a/sound/pci/emu10k1/emu10k1_callback.c
    +++ b/sound/pci/emu10k1/emu10k1_callback.c
    @@ -415,7 +415,7 @@ start_voice(struct snd_emux_voice *vp)
    snd_emu10k1_ptr_write(hw, Z2, ch, 0);

    /* invalidate maps */
    - temp = (hw->silent_page.addr << 1) | MAP_PTI_MASK;
    + temp = (hw->silent_page.addr << hw->address_mode) | (hw->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0);
    snd_emu10k1_ptr_write(hw, MAPA, ch, temp);
    snd_emu10k1_ptr_write(hw, MAPB, ch, temp);
    #if 0
    @@ -436,7 +436,7 @@ start_voice(struct snd_emux_voice *vp)
    snd_emu10k1_ptr_write(hw, CDF, ch, sample);

    /* invalidate maps */
    - temp = ((unsigned int)hw->silent_page.addr << 1) | MAP_PTI_MASK;
    + temp = ((unsigned int)hw->silent_page.addr << hw_address_mode) | (hw->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0);
    snd_emu10k1_ptr_write(hw, MAPA, ch, temp);
    snd_emu10k1_ptr_write(hw, MAPB, ch, temp);

    diff --git a/sound/pci/emu10k1/emu10k1_main.c b/sound/pci/emu10k1/emu10k1_main.c
    index a78fdf4..124ae93 100644
    --- a/sound/pci/emu10k1/emu10k1_main.c
    +++ b/sound/pci/emu10k1/emu10k1_main.c
    @@ -282,7 +282,7 @@ static int snd_emu10k1_init(struct snd_emu10k1 *emu, int enable_ir, int resume)
    snd_emu10k1_ptr_write(emu, TCB, 0, 0); /* taken from original driver */
    snd_emu10k1_ptr_write(emu, TCBS, 0, 4); /* taken from original driver */

    - silent_page = (emu->silent_page.addr << 1) | MAP_PTI_MASK;
    + silent_page = (emu->silent_page.addr << emu->address_mode) | (emu->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0);
    for (ch = 0; ch < NUM_G; ch++) {
    snd_emu10k1_ptr_write(emu, MAPA, ch, silent_page);
    snd_emu10k1_ptr_write(emu, MAPB, ch, silent_page);
    @@ -348,6 +348,11 @@ static int snd_emu10k1_init(struct snd_emu10k1 *emu, int enable_ir, int resume)
    outl(reg | A_IOCFG_GPOUT0, emu->port + A_IOCFG);
    }

    + if (emu->address_mode == 0) {
    + /* use 16M in 4G */
    + outl(inl(emu->port + HCFG) | HCFG_EXPANDED_MEM, emu->port + HCFG);
    + }
    +
    return 0;
    }

    @@ -1390,7 +1395,7 @@ static struct snd_emu_chip_details emu_chip_details[] = {
    *
    */
    {.vendor = 0x1102, .device = 0x0008, .subsystem = 0x20011102,
    - .driver = "Audigy2", .name = "SB Audigy 2 ZS Notebook [SB0530]",
    + .driver = "Audigy2", .name = "Audigy 2 ZS Notebook [SB0530]",
    .id = "Audigy2",
    .emu10k2_chip = 1,
    .ca0108_chip = 1,
    @@ -1540,7 +1545,7 @@ static struct snd_emu_chip_details emu_chip_details[] = {
    .adc_1361t = 1, /* 24 bit capture instead of 16bit */
    .ac97_chip = 1} ,
    {.vendor = 0x1102, .device = 0x0004, .subsystem = 0x10051102,
    - .driver = "Audigy2", .name = "SB Audigy 2 Platinum EX [SB0280]",
    + .driver = "Audigy2", .name = "Audigy 2 Platinum EX [SB0280]",
    .id = "Audigy2",
    .emu10k2_chip = 1,
    .ca0102_chip = 1,
    @@ -1844,8 +1849,10 @@ int __devinit snd_emu10k1_create(struct snd_card *card,

    is_audigy = emu->audigy = c->emu10k2_chip;

    + /* set addressing mode */
    + emu->address_mode = is_audigy ? 0 : 1;
    /* set the DMA transfer mask */
    - emu->dma_mask = is_audigy ? AUDIGY_DMA_MASK : EMU10K1_DMA_MASK;
    + emu->dma_mask = emu->address_mode ? EMU10K1_DMA_MASK : AUDIGY_DMA_MASK;
    if (pci_set_dma_mask(pci, emu->dma_mask) < 0 ||
    pci_set_consistent_dma_mask(pci, emu->dma_mask) < 0) {
    snd_printk(KERN_ERR "architecture does not support PCI busmaster DMA with mask 0x%lx\n", emu->dma_mask);
    @@ -1868,7 +1875,7 @@ int __devinit snd_emu10k1_create(struct snd_card *card,

    emu->max_cache_pages = max_cache_bytes >> PAGE_SHIFT;
    if (snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV, snd_dma_pci_data(pci),
    - 32 * 1024, &emu->ptb_pages) < 0) {
    + (emu->address_mode ? 32 : 16) * 1024, &emu->ptb_pages) < 0) {
    err = -ENOMEM;
    goto error;
    }
    @@ -1967,8 +1974,8 @@ int __devinit snd_emu10k1_create(struct snd_card *card,

    /* Clear silent pages and set up pointers */
    memset(emu->silent_page.area, 0, PAGE_SIZE);
    - silent_page = emu->silent_page.addr << 1;
    - for (idx = 0; idx < MAXPAGES; idx++)
    + silent_page = emu->silent_page.addr << emu->address_mode;
    + for (idx = 0; idx < (emu->address_mode ? MAXPAGES1 : MAXPAGES0); idx++)
    ((u32 *)emu->ptb_pages.area)[idx] = cpu_to_le32(silent_page | idx);

    /* set up voice indices */
    diff --git a/sound/pci/emu10k1/emupcm.c b/sound/pci/emu10k1/emupcm.c
    index e22b8e2..c673d2b 100644
    --- a/sound/pci/emu10k1/emupcm.c
    +++ b/sound/pci/emu10k1/emupcm.c
    @@ -379,7 +379,7 @@ static void snd_emu10k1_pcm_init_voice(struct snd_emu10k1 *emu,
    snd_emu10k1_ptr_write(emu, Z1, voice, 0);
    snd_emu10k1_ptr_write(emu, Z2, voice, 0);
    /* invalidate maps */
    - silent_page = ((unsigned int)emu->silent_page.addr << 1) | MAP_PTI_MASK;
    + silent_page = ((unsigned int)emu->silent_page.addr << emu->address_mode) | (emu->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0);
    snd_emu10k1_ptr_write(emu, MAPA, voice, silent_page);
    snd_emu10k1_ptr_write(emu, MAPB, voice, silent_page);
    /* modulation envelope */
    diff --git a/sound/pci/emu10k1/emuproc.c b/sound/pci/emu10k1/emuproc.c
    index bc38dd4..9c499e6 100644
    --- a/sound/pci/emu10k1/emuproc.c
    +++ b/sound/pci/emu10k1/emuproc.c
    @@ -241,31 +241,22 @@ static void snd_emu10k1_proc_spdif_read(struct snd_info_entry *entry,
    struct snd_emu10k1 *emu = entry->private_data;
    u32 value;
    u32 value2;
    - unsigned long flags;
    u32 rate;

    if (emu->card_capabilities->emu_model) {
    - spin_lock_irqsave(&emu->emu_lock, flags);
    snd_emu1010_fpga_read(emu, 0x38, &value);
    - spin_unlock_irqrestore(&emu->emu_lock, flags);
    if ((value & 0x1) == 0) {
    - spin_lock_irqsave(&emu->emu_lock, flags);
    snd_emu1010_fpga_read(emu, 0x2a, &value);
    snd_emu1010_fpga_read(emu, 0x2b, &value2);
    - spin_unlock_irqrestore(&emu->emu_lock, flags);
    rate = 0x1770000 / (((value << 5) | value2)+1);
    snd_iprintf(buffer, "ADAT Locked : %u\n", rate);
    } else {
    snd_iprintf(buffer, "ADAT Unlocked\n");
    }
    - spin_lock_irqsave(&emu->emu_lock, flags);
    snd_emu1010_fpga_read(emu, 0x20, &value);
    - spin_unlock_irqrestore(&emu->emu_lock, flags);
    if ((value & 0x4) == 0) {
    - spin_lock_irqsave(&emu->emu_lock, flags);
    snd_emu1010_fpga_read(emu, 0x28, &value);
    snd_emu1010_fpga_read(emu, 0x29, &value2);
    - spin_unlock_irqrestore(&emu->emu_lock, flags);
    rate = 0x1770000 / (((value << 5) | value2)+1);
    snd_iprintf(buffer, "SPDIF Locked : %d\n", rate);
    } else {
    @@ -410,14 +401,11 @@ static void snd_emu_proc_emu1010_reg_read(struct snd_info_entry *entry,
    {
    struct snd_emu10k1 *emu = entry->private_data;
    u32 value;
    - unsigned long flags;
    int i;
    snd_iprintf(buffer, "EMU1010 Registers:\n\n");

    for(i = 0; i < 0x40; i+=1) {
    - spin_lock_irqsave(&emu->emu_lock, flags);
    snd_emu1010_fpga_read(emu, i, &value);
    - spin_unlock_irqrestore(&emu->emu_lock, flags);
    snd_iprintf(buffer, "%02X: %08X, %02X\n", i, value, (value >> 8) & 0x7f);
    }
    }
    diff --git a/sound/pci/emu10k1/memory.c b/sound/pci/emu10k1/memory.c
    index 4f502a2..87b7c65 100644
    --- a/sound/pci/emu10k1/memory.c
    +++ b/sound/pci/emu10k1/memory.c
    @@ -34,10 +34,11 @@
    * aligned pages in others
    */
    #define __set_ptb_entry(emu,page,addr) \
    - (((u32 *)(emu)->ptb_pages.area)[page] = cpu_to_le32(((addr) << 1) | (page)))
    + (((u32 *)(emu)->ptb_pages.area)[page] = cpu_to_le32(((addr) << (emu->address_mode)) | (page)))

    #define UNIT_PAGES (PAGE_SIZE / EMUPAGESIZE)
    -#define MAX_ALIGN_PAGES (MAXPAGES / UNIT_PAGES)
    +#define MAX_ALIGN_PAGES0 (MAXPAGES0 / UNIT_PAGES)
    +#define MAX_ALIGN_PAGES1 (MAXPAGES1 / UNIT_PAGES)
    /* get aligned page from offset address */
    #define get_aligned_page(offset) ((offset) >> PAGE_SHIFT)
    /* get offset address from aligned page */
    @@ -124,7 +125,7 @@ static int search_empty_map_area(struct snd_emu10k1 *emu, int npages, struct lis
    }
    page = blk->mapped_page + blk->pages;
    }
    - size = MAX_ALIGN_PAGES - page;
    + size = (emu->address_mode ? MAX_ALIGN_PAGES1 : MAX_ALIGN_PAGES0) - page;
    if (size >= max_size) {
    *nextp = pos;
    return page;
    @@ -181,7 +182,7 @@ static int unmap_memblk(struct snd_emu10k1 *emu, struct snd_emu10k1_memblk *blk)
    q = get_emu10k1_memblk(p, mapped_link);
    end_page = q->mapped_page;
    } else
    - end_page = MAX_ALIGN_PAGES;
    + end_page = (emu->address_mode ? MAX_ALIGN_PAGES1 : MAX_ALIGN_PAGES0);

    /* remove links */
    list_del(&blk->mapped_link);
    @@ -305,7 +306,7 @@ snd_emu10k1_alloc_pages(struct snd_emu10k1 *emu, struct snd_pcm_substream *subst
    if (snd_BUG_ON(!emu))
    return NULL;
    if (snd_BUG_ON(runtime->dma_bytes <= 0 ||
    - runtime->dma_bytes >= MAXPAGES * EMUPAGESIZE))
    + runtime->dma_bytes >= (emu->address_mode ? MAXPAGES1 : MAXPAGES0) * EMUPAGESIZE))
    return NULL;
    hdr = emu->memhdr;
    if (snd_BUG_ON(!hdr))
    diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
    index c74a044..f70115e 100644
    --- a/sound/pci/hda/hda_codec.c
    +++ b/sound/pci/hda/hda_codec.c
    @@ -2093,6 +2093,16 @@ _snd_hda_find_mixer_ctl(struct hda_codec *codec,
    return snd_ctl_find_id(codec->bus->card, &id);
    }

    +/* meta hook to call each driver's vmaster hook */
    +static void vmaster_hook(void *private_data, int enabled)
    +{
    + struct hda_vmaster_mute_hook *hook = private_data;
    +
    + if (hook->mute_mode != HDA_VMUTE_FOLLOW_MASTER)
    + enabled = hook->mute_mode;
    + hook->hook(hook->codec, enabled);
    +}
    +
    /**
    * snd_hda_find_mixer_ctl - Find a mixer control element with the given name
    * @codec: HD-audio codec
    @@ -2520,9 +2530,9 @@ int snd_hda_add_vmaster_hook(struct hda_codec *codec,

    if (!hook->hook || !hook->sw_kctl)
    return 0;
    - snd_ctl_add_vmaster_hook(hook->sw_kctl, hook->hook, codec);
    hook->codec = codec;
    hook->mute_mode = HDA_VMUTE_FOLLOW_MASTER;
    + snd_ctl_add_vmaster_hook(hook->sw_kctl, vmaster_hook, hook);
    if (!expose_enum_ctl)
    return 0;
    kctl = snd_ctl_new1(&vmaster_mute_mode, hook);
    @@ -2540,14 +2550,7 @@ void snd_hda_sync_vmaster_hook(struct hda_vmaster_mute_hook *hook)
    {
    if (!hook->hook || !hook->codec)
    return;
    - switch (hook->mute_mode) {
    - case HDA_VMUTE_FOLLOW_MASTER:
    - snd_ctl_sync_vmaster_hook(hook->sw_kctl);
    - break;
    - default:
    - hook->hook(hook->codec, hook->mute_mode);
    - break;
    - }
    + snd_ctl_sync_vmaster_hook(hook->sw_kctl);
    }
    EXPORT_SYMBOL_HDA(snd_hda_sync_vmaster_hook);

    diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
    index 20cfc5b..ba80c2f 100644
    --- a/sound/pci/hda/patch_conexant.c
    +++ b/sound/pci/hda/patch_conexant.c
    @@ -4606,6 +4606,14 @@ static const struct hda_codec_preset snd_hda_preset_conexant[] = {
    .patch = patch_conexant_auto },
    { .id = 0x14f150b9, .name = "CX20665",
    .patch = patch_conexant_auto },
    + { .id = 0x14f150f1, .name = "CX20721",
    + .patch = patch_conexant_auto },
    + { .id = 0x14f150f2, .name = "CX20722",
    + .patch = patch_conexant_auto },
    + { .id = 0x14f150f3, .name = "CX20723",
    + .patch = patch_conexant_auto },
    + { .id = 0x14f150f4, .name = "CX20724",
    + .patch = patch_conexant_auto },
    { .id = 0x14f1510f, .name = "CX20751/2",
    .patch = patch_conexant_auto },
    { .id = 0x14f15110, .name = "CX20751/2",
    @@ -4640,6 +4648,10 @@ MODULE_ALIAS("snd-hda-codec-id:14f150ab");
    MODULE_ALIAS("snd-hda-codec-id:14f150ac");
    MODULE_ALIAS("snd-hda-codec-id:14f150b8");
    MODULE_ALIAS("snd-hda-codec-id:14f150b9");
    +MODULE_ALIAS("snd-hda-codec-id:14f150f1");
    +MODULE_ALIAS("snd-hda-codec-id:14f150f2");
    +MODULE_ALIAS("snd-hda-codec-id:14f150f3");
    +MODULE_ALIAS("snd-hda-codec-id:14f150f4");
    MODULE_ALIAS("snd-hda-codec-id:14f1510f");
    MODULE_ALIAS("snd-hda-codec-id:14f15110");
    MODULE_ALIAS("snd-hda-codec-id:14f15111");
    diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
    index b16a37f..bf1f0ab 100644
    --- a/sound/pci/hda/patch_realtek.c
    +++ b/sound/pci/hda/patch_realtek.c
    @@ -5412,6 +5412,7 @@ static const struct alc_fixup alc882_fixups[] = {
    static const struct snd_pci_quirk alc882_fixup_tbl[] = {
    SND_PCI_QUIRK(0x1025, 0x006c, "Acer Aspire 9810", ALC883_FIXUP_ACER_EAPD),
    SND_PCI_QUIRK(0x1025, 0x0090, "Acer Aspire", ALC883_FIXUP_ACER_EAPD),
    + SND_PCI_QUIRK(0x1025, 0x0107, "Acer Aspire", ALC883_FIXUP_ACER_EAPD),
    SND_PCI_QUIRK(0x1025, 0x010a, "Acer Ferrari 5000", ALC883_FIXUP_ACER_EAPD),
    SND_PCI_QUIRK(0x1025, 0x0110, "Acer Aspire", ALC883_FIXUP_ACER_EAPD),
    SND_PCI_QUIRK(0x1025, 0x0112, "Acer Aspire 9303", ALC883_FIXUP_ACER_EAPD),
    diff --git a/sound/soc/codecs/cs4271.c b/sound/soc/codecs/cs4271.c
    index f9e2bda..5405932 100644
    --- a/sound/soc/codecs/cs4271.c
    +++ b/sound/soc/codecs/cs4271.c
    @@ -475,10 +475,10 @@ static int cs4271_probe(struct snd_soc_codec *codec)
    if (gpio_nreset >= 0) {
    /* Reset codec */
    gpio_direction_output(gpio_nreset, 0);
    - udelay(1);
    + mdelay(1);
    gpio_set_value(gpio_nreset, 1);
    /* Give the codec time to wake up */
    - udelay(1);
    + mdelay(1);
    }

    cs4271->gpio_nreset = gpio_nreset;
    diff --git a/sound/soc/codecs/wm8741.c b/sound/soc/codecs/wm8741.c
    index 3941f50..90deecd 100644
    --- a/sound/soc/codecs/wm8741.c
    +++ b/sound/soc/codecs/wm8741.c
    @@ -105,7 +105,7 @@ static struct {
    };

    static unsigned int rates_11289[] = {
    - 44100, 88235,
    + 44100, 88200,
    };

    static struct snd_pcm_hw_constraint_list constraints_11289 = {
    @@ -132,7 +132,7 @@ static struct snd_pcm_hw_constraint_list constraints_16384 = {
    };

    static unsigned int rates_16934[] = {
    - 44100, 88235,
    + 44100, 88200,
    };

    static struct snd_pcm_hw_constraint_list constraints_16934 = {
    @@ -150,7 +150,7 @@ static struct snd_pcm_hw_constraint_list constraints_18432 = {
    };

    static unsigned int rates_22579[] = {
    - 44100, 88235, 1764000
    + 44100, 88200, 176400
    };

    static struct snd_pcm_hw_constraint_list constraints_22579 = {
    @@ -168,7 +168,7 @@ static struct snd_pcm_hw_constraint_list constraints_24576 = {
    };

    static unsigned int rates_36864[] = {
    - 48000, 96000, 19200
    + 48000, 96000, 192000
    };

    static struct snd_pcm_hw_constraint_list constraints_36864 = {
    diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
    index a3e4831..ed986e6 100644
    --- a/sound/soc/codecs/wm8960.c
    +++ b/sound/soc/codecs/wm8960.c
    @@ -333,7 +333,7 @@ static const struct snd_soc_dapm_route audio_paths[] = {
    { "Right Input Mixer", "Boost Switch", "Right Boost Mixer", },
    { "Right Input Mixer", NULL, "RINPUT1", }, /* Really Boost Switch */
    { "Right Input Mixer", NULL, "RINPUT2" },
    - { "Right Input Mixer", NULL, "LINPUT3" },
    + { "Right Input Mixer", NULL, "RINPUT3" },

    { "Left ADC", NULL, "Left Input Mixer" },
    { "Right ADC", NULL, "Right Input Mixer" },
    diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
    index d9924d7..c93c573 100644
    --- a/sound/soc/codecs/wm8994.c
    +++ b/sound/soc/codecs/wm8994.c
    @@ -2636,7 +2636,7 @@ static struct {
    };

    static int fs_ratios[] = {
    - 64, 128, 192, 256, 348, 512, 768, 1024, 1408, 1536
    + 64, 128, 192, 256, 384, 512, 768, 1024, 1408, 1536
    };

    static int bclk_divs[] = {
    diff --git a/sound/synth/emux/emux_oss.c b/sound/synth/emux/emux_oss.c
    index 319754c..daf61ab 100644
    --- a/sound/synth/emux/emux_oss.c
    +++ b/sound/synth/emux/emux_oss.c
    @@ -118,12 +118,8 @@ snd_emux_open_seq_oss(struct snd_seq_oss_arg *arg, void *closure)
    if (snd_BUG_ON(!arg || !emu))
    return -ENXIO;

    - mutex_lock(&emu->register_mutex);
    -
    - if (!snd_emux_inc_count(emu)) {
    - mutex_unlock(&emu->register_mutex);
    + if (!snd_emux_inc_count(emu))
    return -EFAULT;
    - }

    memset(&callback, 0, sizeof(callback));
    callback.owner = THIS_MODULE;
    @@ -135,7 +131,6 @@ snd_emux_open_seq_oss(struct snd_seq_oss_arg *arg, void *closure)
    if (p == NULL) {
    snd_printk(KERN_ERR "can't create port\n");
    snd_emux_dec_count(emu);
    - mutex_unlock(&emu->register_mutex);
    return -ENOMEM;
    }

    @@ -148,8 +143,6 @@ snd_emux_open_seq_oss(struct snd_seq_oss_arg *arg, void *closure)
    reset_port_mode(p, arg->seq_mode);

    snd_emux_reset_port(p);
    -
    - mutex_unlock(&emu->register_mutex);
    return 0;
    }

    @@ -195,13 +188,11 @@ snd_emux_close_seq_oss(struct snd_seq_oss_arg *arg)
    if (snd_BUG_ON(!emu))
    return -ENXIO;

    - mutex_lock(&emu->register_mutex);
    snd_emux_sounds_off_all(p);
    snd_soundfont_close_check(emu->sflist, SF_CLIENT_NO(p->chset.port));
    snd_seq_event_port_detach(p->chset.client, p->chset.port);
    snd_emux_dec_count(emu);

    - mutex_unlock(&emu->register_mutex);
    return 0;
    }

    diff --git a/sound/synth/emux/emux_seq.c b/sound/synth/emux/emux_seq.c
    index 7778b8e..a020920 100644
    --- a/sound/synth/emux/emux_seq.c
    +++ b/sound/synth/emux/emux_seq.c
    @@ -124,12 +124,10 @@ snd_emux_detach_seq(struct snd_emux *emu)
    if (emu->voices)
    snd_emux_terminate_all(emu);

    - mutex_lock(&emu->register_mutex);
    if (emu->client >= 0) {
    snd_seq_delete_kernel_client(emu->client);
    emu->client = -1;
    }
    - mutex_unlock(&emu->register_mutex);
    }


    @@ -269,8 +267,8 @@ snd_emux_event_input(struct snd_seq_event *ev, int direct, void *private_data,
    /*
    * increment usage count
    */
    -int
    -snd_emux_inc_count(struct snd_emux *emu)
    +static int
    +__snd_emux_inc_count(struct snd_emux *emu)
    {
    emu->used++;
    if (!try_module_get(emu->ops.owner))
    @@ -284,12 +282,21 @@ snd_emux_inc_count(struct snd_emux *emu)
    return 1;
    }

    +int snd_emux_inc_count(struct snd_emux *emu)
    +{
    + int ret;
    +
    + mutex_lock(&emu->register_mutex);
    + ret = __snd_emux_inc_count(emu);
    + mutex_unlock(&emu->register_mutex);
    + return ret;
    +}

    /*
    * decrease usage count
    */
    -void
    -snd_emux_dec_count(struct snd_emux *emu)
    +static void
    +__snd_emux_dec_count(struct snd_emux *emu)
    {
    module_put(emu->card->module);
    emu->used--;
    @@ -298,6 +305,12 @@ snd_emux_dec_count(struct snd_emux *emu)
    module_put(emu->ops.owner);
    }

    +void snd_emux_dec_count(struct snd_emux *emu)
    +{
    + mutex_lock(&emu->register_mutex);
    + __snd_emux_dec_count(emu);
    + mutex_unlock(&emu->register_mutex);
    +}

    /*
    * Routine that is called upon a first use of a particular port
    @@ -317,7 +330,7 @@ snd_emux_use(void *private_data, struct snd_seq_port_subscribe *info)

    mutex_lock(&emu->register_mutex);
    snd_emux_init_port(p);
    - snd_emux_inc_count(emu);
    + __snd_emux_inc_count(emu);
    mutex_unlock(&emu->register_mutex);
    return 0;
    }
    @@ -340,7 +353,7 @@ snd_emux_unuse(void *private_data, struct snd_seq_port_subscribe *info)

    mutex_lock(&emu->register_mutex);
    snd_emux_sounds_off_all(p);
    - snd_emux_dec_count(emu);
    + __snd_emux_dec_count(emu);
    mutex_unlock(&emu->register_mutex);
    return 0;
    }
    diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
    index 1e0798f..851786f 100644
    --- a/sound/usb/mixer_maps.c
    +++ b/sound/usb/mixer_maps.c
    @@ -380,6 +380,11 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = {
    .ignore_ctl_error = 1,
    },
    {
    + /* MAYA44 USB+ */
    + .id = USB_ID(0x2573, 0x0008),
    + .map = maya44_map,
    + },
    + {
    /* KEF X300A */
    .id = USB_ID(0x27ac, 0x1000),
    .map = scms_usb3318_map,

    \
     
     \ /
      Last update: 2015-09-15 11:41    [W:5.512 / U:0.248 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site