diff options
Diffstat (limited to '3.2.52/1050_linux-3.2.51.patch')
| -rw-r--r-- | 3.2.52/1050_linux-3.2.51.patch | 3886 |
1 files changed, 3886 insertions, 0 deletions
diff --git a/3.2.52/1050_linux-3.2.51.patch b/3.2.52/1050_linux-3.2.51.patch new file mode 100644 index 0000000..5d5832b --- /dev/null +++ b/3.2.52/1050_linux-3.2.51.patch @@ -0,0 +1,3886 @@ +diff --git a/Makefile b/Makefile +index 0799e8e..0f11936 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 2 +-SUBLEVEL = 50 ++SUBLEVEL = 51 + EXTRAVERSION = + NAME = Saber-toothed Squirrel + +diff --git a/arch/alpha/Makefile b/arch/alpha/Makefile +index 4759fe7..2cc3cc5 100644 +--- a/arch/alpha/Makefile ++++ b/arch/alpha/Makefile +@@ -12,7 +12,7 @@ NM := $(NM) -B + + LDFLAGS_vmlinux := -static -N #-relax + CHECKFLAGS += -D__alpha__ -m64 +-cflags-y := -pipe -mno-fp-regs -ffixed-8 -msmall-data ++cflags-y := -pipe -mno-fp-regs -ffixed-8 + cflags-y += $(call cc-option, -fno-jump-tables) + + cpuflags-$(CONFIG_ALPHA_EV4) := -mcpu=ev4 +diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig +index 27bcd12..790ea68 100644 +--- a/arch/arm/Kconfig ++++ b/arch/arm/Kconfig +@@ -1,7 +1,6 @@ + config ARM + bool + default y +- select HAVE_AOUT + select HAVE_DMA_API_DEBUG + select HAVE_IDE if PCI || ISA || PCMCIA + select HAVE_MEMBLOCK +diff --git a/arch/arm/include/asm/a.out-core.h b/arch/arm/include/asm/a.out-core.h +deleted file mode 100644 +index 92f10cb..0000000 +--- a/arch/arm/include/asm/a.out-core.h ++++ /dev/null +@@ -1,45 +0,0 @@ +-/* a.out coredump register dumper +- * +- * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved. +- * Written by David Howells (dhowells@redhat.com) +- * +- * This program is free software; you can redistribute it and/or +- * modify it under the terms of the GNU General Public Licence +- * as published by the Free Software Foundation; either version +- * 2 of the Licence, or (at your option) any later version. +- */ +- +-#ifndef _ASM_A_OUT_CORE_H +-#define _ASM_A_OUT_CORE_H +- +-#ifdef __KERNEL__ +- +-#include <linux/user.h> +-#include <linux/elfcore.h> +- +-/* +- * fill in the user structure for an a.out core dump +- */ +-static inline void aout_dump_thread(struct pt_regs *regs, struct user *dump) +-{ +- struct task_struct *tsk = current; +- +- dump->magic = CMAGIC; +- dump->start_code = tsk->mm->start_code; +- dump->start_stack = regs->ARM_sp & ~(PAGE_SIZE - 1); +- +- dump->u_tsize = (tsk->mm->end_code - tsk->mm->start_code) >> PAGE_SHIFT; +- dump->u_dsize = (tsk->mm->brk - tsk->mm->start_data + PAGE_SIZE - 1) >> PAGE_SHIFT; +- dump->u_ssize = 0; +- +- memset(dump->u_debugreg, 0, sizeof(dump->u_debugreg)); +- +- if (dump->start_stack < 0x04000000) +- dump->u_ssize = (0x04000000 - dump->start_stack) >> PAGE_SHIFT; +- +- dump->regs = *regs; +- dump->u_fpvalid = dump_fpu (regs, &dump->u_fp); +-} +- +-#endif /* __KERNEL__ */ +-#endif /* _ASM_A_OUT_CORE_H */ +diff --git a/arch/arm/include/asm/a.out.h b/arch/arm/include/asm/a.out.h +deleted file mode 100644 +index 083894b..0000000 +--- a/arch/arm/include/asm/a.out.h ++++ /dev/null +@@ -1,34 +0,0 @@ +-#ifndef __ARM_A_OUT_H__ +-#define __ARM_A_OUT_H__ +- +-#include <linux/personality.h> +-#include <linux/types.h> +- +-struct exec +-{ +- __u32 a_info; /* Use macros N_MAGIC, etc for access */ +- __u32 a_text; /* length of text, in bytes */ +- __u32 a_data; /* length of data, in bytes */ +- __u32 a_bss; /* length of uninitialized data area for file, in bytes */ +- __u32 a_syms; /* length of symbol table data in file, in bytes */ +- __u32 a_entry; /* start address */ +- __u32 a_trsize; /* length of relocation info for text, in bytes */ +- __u32 a_drsize; /* length of relocation info for data, in bytes */ +-}; +- +-/* +- * This is always the same +- */ +-#define N_TXTADDR(a) (0x00008000) +- +-#define N_TRSIZE(a) ((a).a_trsize) +-#define N_DRSIZE(a) ((a).a_drsize) +-#define N_SYMSIZE(a) ((a).a_syms) +- +-#define M_ARM 103 +- +-#ifndef LIBRARY_START_TEXT +-#define LIBRARY_START_TEXT (0x00c00000) +-#endif +- +-#endif /* __A_OUT_GNU_H__ */ +diff --git a/arch/arm/include/asm/processor.h b/arch/arm/include/asm/processor.h +index b2d9df5..3352451 100644 +--- a/arch/arm/include/asm/processor.h ++++ b/arch/arm/include/asm/processor.h +@@ -54,7 +54,6 @@ struct thread_struct { + + #define start_thread(regs,pc,sp) \ + ({ \ +- unsigned long *stack = (unsigned long *)sp; \ + set_fs(USER_DS); \ + memset(regs->uregs, 0, sizeof(regs->uregs)); \ + if (current->personality & ADDR_LIMIT_32BIT) \ +@@ -66,9 +65,6 @@ struct thread_struct { + regs->ARM_cpsr |= PSR_ENDSTATE; \ + regs->ARM_pc = pc & ~1; /* pc */ \ + regs->ARM_sp = sp; /* sp */ \ +- regs->ARM_r2 = stack[2]; /* r2 (envp) */ \ +- regs->ARM_r1 = stack[1]; /* r1 (argv) */ \ +- regs->ARM_r0 = stack[0]; /* r0 (argc) */ \ + nommu_start_thread(regs); \ + }) + +diff --git a/arch/arm/kernel/perf_event.c b/arch/arm/kernel/perf_event.c +index 778d248..4a2db48 100644 +--- a/arch/arm/kernel/perf_event.c ++++ b/arch/arm/kernel/perf_event.c +@@ -116,7 +116,12 @@ armpmu_map_cache_event(const unsigned (*cache_map) + static int + armpmu_map_event(const unsigned (*event_map)[PERF_COUNT_HW_MAX], u64 config) + { +- int mapping = (*event_map)[config]; ++ int mapping; ++ ++ if (config >= PERF_COUNT_HW_MAX) ++ return -ENOENT; ++ ++ mapping = (*event_map)[config]; + return mapping == HW_OP_UNSUPPORTED ? -ENOENT : mapping; + } + +@@ -326,6 +331,9 @@ validate_event(struct pmu_hw_events *hw_events, + struct hw_perf_event fake_event = event->hw; + struct pmu *leader_pmu = event->group_leader->pmu; + ++ if (is_software_event(event)) ++ return 1; ++ + if (event->pmu != leader_pmu || event->state < PERF_EVENT_STATE_OFF) + return 1; + +diff --git a/arch/cris/kernel/vmlinux.lds.S b/arch/cris/kernel/vmlinux.lds.S +index a6990cb..a68b983 100644 +--- a/arch/cris/kernel/vmlinux.lds.S ++++ b/arch/cris/kernel/vmlinux.lds.S +@@ -52,6 +52,7 @@ SECTIONS + + EXCEPTION_TABLE(4) + ++ _sdata = .; + RODATA + + . = ALIGN (4); +diff --git a/arch/hexagon/kernel/dma.c b/arch/hexagon/kernel/dma.c +index e711ace..54891e1 100644 +--- a/arch/hexagon/kernel/dma.c ++++ b/arch/hexagon/kernel/dma.c +@@ -22,6 +22,7 @@ + #include <linux/bootmem.h> + #include <linux/genalloc.h> + #include <asm/dma-mapping.h> ++#include <linux/module.h> + + struct dma_map_ops *dma_ops; + EXPORT_SYMBOL(dma_ops); +diff --git a/arch/hexagon/kernel/ptrace.c b/arch/hexagon/kernel/ptrace.c +index bea3f08..8fe0349 100644 +--- a/arch/hexagon/kernel/ptrace.c ++++ b/arch/hexagon/kernel/ptrace.c +@@ -28,6 +28,7 @@ + #include <linux/ptrace.h> + #include <linux/regset.h> + #include <linux/user.h> ++#include <linux/elf.h> + + #include <asm/system.h> + #include <asm/user.h> +diff --git a/arch/hexagon/kernel/time.c b/arch/hexagon/kernel/time.c +index 6bee15c..5d9b33b 100644 +--- a/arch/hexagon/kernel/time.c ++++ b/arch/hexagon/kernel/time.c +@@ -28,6 +28,7 @@ + #include <linux/of.h> + #include <linux/of_address.h> + #include <linux/of_irq.h> ++#include <linux/module.h> + + #include <asm/timer-regs.h> + #include <asm/hexagon_vm.h> +diff --git a/arch/hexagon/kernel/vdso.c b/arch/hexagon/kernel/vdso.c +index 16277c3..e4ceedb 100644 +--- a/arch/hexagon/kernel/vdso.c ++++ b/arch/hexagon/kernel/vdso.c +@@ -21,6 +21,7 @@ + #include <linux/err.h> + #include <linux/mm.h> + #include <linux/vmalloc.h> ++#include <linux/binfmts.h> + + #include <asm/vdso.h> + +diff --git a/arch/m32r/boot/compressed/Makefile b/arch/m32r/boot/compressed/Makefile +index 177716b..01729c2 100644 +--- a/arch/m32r/boot/compressed/Makefile ++++ b/arch/m32r/boot/compressed/Makefile +@@ -43,9 +43,9 @@ endif + + OBJCOPYFLAGS += -R .empty_zero_page + +-suffix_$(CONFIG_KERNEL_GZIP) = gz +-suffix_$(CONFIG_KERNEL_BZIP2) = bz2 +-suffix_$(CONFIG_KERNEL_LZMA) = lzma ++suffix-$(CONFIG_KERNEL_GZIP) = gz ++suffix-$(CONFIG_KERNEL_BZIP2) = bz2 ++suffix-$(CONFIG_KERNEL_LZMA) = lzma + + $(obj)/piggy.o: $(obj)/vmlinux.scr $(obj)/vmlinux.bin.$(suffix-y) FORCE + $(call if_changed,ld) +diff --git a/arch/m32r/boot/compressed/misc.c b/arch/m32r/boot/compressed/misc.c +index 370d608..28a0952 100644 +--- a/arch/m32r/boot/compressed/misc.c ++++ b/arch/m32r/boot/compressed/misc.c +@@ -28,7 +28,7 @@ static unsigned long free_mem_ptr; + static unsigned long free_mem_end_ptr; + + #ifdef CONFIG_KERNEL_BZIP2 +-static void *memset(void *s, int c, size_t n) ++void *memset(void *s, int c, size_t n) + { + char *ss = s; + +@@ -39,6 +39,16 @@ static void *memset(void *s, int c, size_t n) + #endif + + #ifdef CONFIG_KERNEL_GZIP ++void *memcpy(void *dest, const void *src, size_t n) ++{ ++ char *d = dest; ++ const char *s = src; ++ while (n--) ++ *d++ = *s++; ++ ++ return dest; ++} ++ + #define BOOT_HEAP_SIZE 0x10000 + #include "../../../../lib/decompress_inflate.c" + #endif +diff --git a/arch/m68k/emu/natfeat.c b/arch/m68k/emu/natfeat.c +index 2291a7d..fa277ae 100644 +--- a/arch/m68k/emu/natfeat.c ++++ b/arch/m68k/emu/natfeat.c +@@ -18,9 +18,11 @@ + #include <asm/machdep.h> + #include <asm/natfeat.h> + ++extern long nf_get_id2(const char *feature_name); ++ + asm("\n" +-" .global nf_get_id,nf_call\n" +-"nf_get_id:\n" ++" .global nf_get_id2,nf_call\n" ++"nf_get_id2:\n" + " .short 0x7300\n" + " rts\n" + "nf_call:\n" +@@ -29,12 +31,25 @@ asm("\n" + "1: moveq.l #0,%d0\n" + " rts\n" + " .section __ex_table,\"a\"\n" +-" .long nf_get_id,1b\n" ++" .long nf_get_id2,1b\n" + " .long nf_call,1b\n" + " .previous"); +-EXPORT_SYMBOL_GPL(nf_get_id); + EXPORT_SYMBOL_GPL(nf_call); + ++long nf_get_id(const char *feature_name) ++{ ++ /* feature_name may be in vmalloc()ed memory, so make a copy */ ++ char name_copy[32]; ++ size_t n; ++ ++ n = strlcpy(name_copy, feature_name, sizeof(name_copy)); ++ if (n >= sizeof(name_copy)) ++ return 0; ++ ++ return nf_get_id2(name_copy); ++} ++EXPORT_SYMBOL_GPL(nf_get_id); ++ + void nfprint(const char *fmt, ...) + { + static char buf[256]; +diff --git a/arch/m68k/include/asm/div64.h b/arch/m68k/include/asm/div64.h +index edb6614..7558032 100644 +--- a/arch/m68k/include/asm/div64.h ++++ b/arch/m68k/include/asm/div64.h +@@ -13,16 +13,17 @@ + unsigned long long n64; \ + } __n; \ + unsigned long __rem, __upper; \ ++ unsigned long __base = (base); \ + \ + __n.n64 = (n); \ + if ((__upper = __n.n32[0])) { \ + asm ("divul.l %2,%1:%0" \ +- : "=d" (__n.n32[0]), "=d" (__upper) \ +- : "d" (base), "0" (__n.n32[0])); \ ++ : "=d" (__n.n32[0]), "=d" (__upper) \ ++ : "d" (__base), "0" (__n.n32[0])); \ + } \ + asm ("divu.l %2,%1:%0" \ +- : "=d" (__n.n32[1]), "=d" (__rem) \ +- : "d" (base), "1" (__upper), "0" (__n.n32[1])); \ ++ : "=d" (__n.n32[1]), "=d" (__rem) \ ++ : "d" (__base), "1" (__upper), "0" (__n.n32[1])); \ + (n) = __n.n64; \ + __rem; \ + }) +diff --git a/arch/microblaze/configs/mmu_defconfig b/arch/microblaze/configs/mmu_defconfig +index b3f5eec..a470f57 100644 +--- a/arch/microblaze/configs/mmu_defconfig ++++ b/arch/microblaze/configs/mmu_defconfig +@@ -1,25 +1,22 @@ + CONFIG_EXPERIMENTAL=y + CONFIG_SYSVIPC=y ++CONFIG_POSIX_MQUEUE=y ++CONFIG_FHANDLE=y ++CONFIG_AUDIT=y ++CONFIG_AUDIT_LOGINUID_IMMUTABLE=y + CONFIG_IKCONFIG=y + CONFIG_IKCONFIG_PROC=y ++CONFIG_SYSFS_DEPRECATED=y + CONFIG_SYSFS_DEPRECATED_V2=y +-CONFIG_BLK_DEV_INITRD=y +-CONFIG_INITRAMFS_SOURCE="rootfs.cpio" +-CONFIG_INITRAMFS_COMPRESSION_GZIP=y +-# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set +-CONFIG_EXPERT=y + CONFIG_KALLSYMS_ALL=y +-CONFIG_KALLSYMS_EXTRA_PASS=y +-# CONFIG_HOTPLUG is not set + # CONFIG_BASE_FULL is not set +-# CONFIG_FUTEX is not set +-# CONFIG_EPOLL is not set +-# CONFIG_SIGNALFD is not set +-# CONFIG_SHMEM is not set ++CONFIG_EMBEDDED=y + CONFIG_SLAB=y + CONFIG_MODULES=y + CONFIG_MODULE_UNLOAD=y + # CONFIG_BLK_DEV_BSG is not set ++CONFIG_PARTITION_ADVANCED=y ++# CONFIG_EFI_PARTITION is not set + CONFIG_OPT_LIB_ASM=y + CONFIG_XILINX_MICROBLAZE0_USE_MSR_INSTR=1 + CONFIG_XILINX_MICROBLAZE0_USE_PCMP_INSTR=1 +@@ -37,33 +34,53 @@ CONFIG_UNIX=y + CONFIG_INET=y + # CONFIG_INET_LRO is not set + # CONFIG_IPV6 is not set ++CONFIG_MTD=y + CONFIG_PROC_DEVICETREE=y + CONFIG_BLK_DEV_RAM=y + CONFIG_BLK_DEV_RAM_SIZE=8192 + CONFIG_NETDEVICES=y +-CONFIG_NET_ETHERNET=y + CONFIG_XILINX_EMACLITE=y ++CONFIG_XILINX_LL_TEMAC=y + # CONFIG_INPUT is not set + # CONFIG_SERIO is not set + # CONFIG_VT is not set ++CONFIG_SERIAL_8250=y ++CONFIG_SERIAL_8250_CONSOLE=y + CONFIG_SERIAL_UARTLITE=y + CONFIG_SERIAL_UARTLITE_CONSOLE=y + # CONFIG_HW_RANDOM is not set ++CONFIG_XILINX_HWICAP=y ++CONFIG_I2C=y ++CONFIG_I2C_XILINX=y ++CONFIG_SPI=y ++CONFIG_SPI_XILINX=y ++CONFIG_GPIOLIB=y ++CONFIG_GPIO_SYSFS=y ++CONFIG_GPIO_XILINX=y + # CONFIG_HWMON is not set ++CONFIG_WATCHDOG=y ++CONFIG_XILINX_WATCHDOG=y ++CONFIG_FB=y ++CONFIG_FB_XILINX=y + # CONFIG_USB_SUPPORT is not set ++CONFIG_UIO=y ++CONFIG_UIO_PDRV=y ++CONFIG_UIO_PDRV_GENIRQ=y ++CONFIG_UIO_DMEM_GENIRQ=y + CONFIG_EXT2_FS=y + # CONFIG_DNOTIFY is not set ++CONFIG_CRAMFS=y ++CONFIG_ROMFS_FS=y + CONFIG_NFS_FS=y +-CONFIG_NFS_V3=y + CONFIG_CIFS=y + CONFIG_CIFS_STATS=y + CONFIG_CIFS_STATS2=y +-CONFIG_PARTITION_ADVANCED=y +-CONFIG_DEBUG_KERNEL=y + CONFIG_DETECT_HUNG_TASK=y + CONFIG_DEBUG_SLAB=y + CONFIG_DEBUG_SPINLOCK=y + CONFIG_DEBUG_INFO=y +-# CONFIG_RCU_CPU_STALL_DETECTOR is not set + CONFIG_EARLY_PRINTK=y ++CONFIG_KEYS=y ++CONFIG_ENCRYPTED_KEYS=y ++CONFIG_KEYS_DEBUG_PROC_KEYS=y + # CONFIG_CRYPTO_ANSI_CPRNG is not set +diff --git a/arch/microblaze/configs/nommu_defconfig b/arch/microblaze/configs/nommu_defconfig +index 0249e4b..5454a6d 100644 +--- a/arch/microblaze/configs/nommu_defconfig ++++ b/arch/microblaze/configs/nommu_defconfig +@@ -1,41 +1,40 @@ + CONFIG_EXPERIMENTAL=y + CONFIG_SYSVIPC=y + CONFIG_POSIX_MQUEUE=y ++CONFIG_FHANDLE=y ++CONFIG_AUDIT=y ++CONFIG_AUDIT_LOGINUID_IMMUTABLE=y + CONFIG_BSD_PROCESS_ACCT=y + CONFIG_BSD_PROCESS_ACCT_V3=y + CONFIG_IKCONFIG=y + CONFIG_IKCONFIG_PROC=y ++CONFIG_SYSFS_DEPRECATED=y + CONFIG_SYSFS_DEPRECATED_V2=y +-CONFIG_EXPERT=y + CONFIG_KALLSYMS_ALL=y +-CONFIG_KALLSYMS_EXTRA_PASS=y +-# CONFIG_HOTPLUG is not set + # CONFIG_BASE_FULL is not set ++CONFIG_EMBEDDED=y + CONFIG_SLAB=y + CONFIG_MODULES=y + CONFIG_MODULE_UNLOAD=y + # CONFIG_BLK_DEV_BSG is not set +-# CONFIG_OPT_LIB_FUNCTION is not set ++CONFIG_PARTITION_ADVANCED=y ++# CONFIG_EFI_PARTITION is not set + CONFIG_XILINX_MICROBLAZE0_USE_MSR_INSTR=1 + CONFIG_XILINX_MICROBLAZE0_USE_PCMP_INSTR=1 + CONFIG_XILINX_MICROBLAZE0_USE_BARREL=1 + CONFIG_XILINX_MICROBLAZE0_USE_DIV=1 + CONFIG_XILINX_MICROBLAZE0_USE_HW_MUL=2 + CONFIG_XILINX_MICROBLAZE0_USE_FPU=2 +-CONFIG_HIGH_RES_TIMERS=y + CONFIG_HZ_100=y + CONFIG_CMDLINE_BOOL=y +-CONFIG_BINFMT_FLAT=y ++CONFIG_CMDLINE_FORCE=y + CONFIG_NET=y + CONFIG_PACKET=y + CONFIG_UNIX=y + CONFIG_INET=y + # CONFIG_INET_LRO is not set + # CONFIG_IPV6 is not set +-# CONFIG_PREVENT_FIRMWARE_BUILD is not set + CONFIG_MTD=y +-CONFIG_MTD_CONCAT=y +-CONFIG_MTD_PARTITIONS=y + CONFIG_MTD_CMDLINE_PARTS=y + CONFIG_MTD_CHAR=y + CONFIG_MTD_BLOCK=y +@@ -45,41 +44,55 @@ CONFIG_MTD_CFI_AMDSTD=y + CONFIG_MTD_RAM=y + CONFIG_MTD_UCLINUX=y + CONFIG_PROC_DEVICETREE=y +-CONFIG_BLK_DEV_NBD=y + CONFIG_BLK_DEV_RAM=y ++CONFIG_BLK_DEV_RAM_SIZE=8192 + CONFIG_NETDEVICES=y +-CONFIG_NET_ETHERNET=y ++CONFIG_XILINX_EMACLITE=y ++CONFIG_XILINX_LL_TEMAC=y + # CONFIG_INPUT is not set + # CONFIG_SERIO is not set + # CONFIG_VT is not set ++CONFIG_SERIAL_8250=y ++CONFIG_SERIAL_8250_CONSOLE=y + CONFIG_SERIAL_UARTLITE=y + CONFIG_SERIAL_UARTLITE_CONSOLE=y +-CONFIG_HW_RANDOM=y ++# CONFIG_HW_RANDOM is not set ++CONFIG_XILINX_HWICAP=y ++CONFIG_I2C=y ++CONFIG_I2C_XILINX=y ++CONFIG_SPI=y ++CONFIG_SPI_XILINX=y ++CONFIG_GPIOLIB=y ++CONFIG_GPIO_SYSFS=y ++CONFIG_GPIO_XILINX=y + # CONFIG_HWMON is not set +-CONFIG_VIDEO_OUTPUT_CONTROL=y ++CONFIG_WATCHDOG=y ++CONFIG_XILINX_WATCHDOG=y ++CONFIG_FB=y ++CONFIG_FB_XILINX=y ++# CONFIG_USB_SUPPORT is not set ++CONFIG_UIO=y ++CONFIG_UIO_PDRV=y ++CONFIG_UIO_PDRV_GENIRQ=y ++CONFIG_UIO_DMEM_GENIRQ=y + CONFIG_EXT2_FS=y + # CONFIG_DNOTIFY is not set + CONFIG_CRAMFS=y + CONFIG_ROMFS_FS=y + CONFIG_NFS_FS=y +-CONFIG_NFS_V3=y + CONFIG_NFS_V3_ACL=y +-CONFIG_UNUSED_SYMBOLS=y +-CONFIG_DEBUG_FS=y +-CONFIG_DEBUG_KERNEL=y +-CONFIG_DEBUG_SHIRQ=y ++CONFIG_NLS=y + CONFIG_DETECT_HUNG_TASK=y +-CONFIG_SCHEDSTATS=y +-CONFIG_TIMER_STATS=y +-CONFIG_DEBUG_OBJECTS=y +-CONFIG_DEBUG_OBJECTS_SELFTEST=y +-CONFIG_DEBUG_OBJECTS_FREE=y +-CONFIG_DEBUG_OBJECTS_TIMERS=y ++CONFIG_DEBUG_SLAB=y ++CONFIG_DEBUG_SPINLOCK=y + CONFIG_DEBUG_INFO=y +-CONFIG_DEBUG_LIST=y +-CONFIG_DEBUG_SG=y +-# CONFIG_RCU_CPU_STALL_DETECTOR is not set +-CONFIG_SYSCTL_SYSCALL_CHECK=y + CONFIG_EARLY_PRINTK=y ++CONFIG_KEYS=y ++CONFIG_ENCRYPTED_KEYS=y ++CONFIG_KEYS_DEBUG_PROC_KEYS=y ++CONFIG_CRYPTO_ECB=y ++CONFIG_CRYPTO_MD4=y ++CONFIG_CRYPTO_MD5=y ++CONFIG_CRYPTO_ARC4=y ++CONFIG_CRYPTO_DES=y + # CONFIG_CRYPTO_ANSI_CPRNG is not set +-# CONFIG_CRC32 is not set +diff --git a/arch/microblaze/include/asm/futex.h b/arch/microblaze/include/asm/futex.h +index b0526d2..ff8cde1 100644 +--- a/arch/microblaze/include/asm/futex.h ++++ b/arch/microblaze/include/asm/futex.h +@@ -24,7 +24,7 @@ + .word 1b,4b,2b,4b; \ + .previous;" \ + : "=&r" (oldval), "=&r" (ret) \ +- : "b" (uaddr), "i" (-EFAULT), "r" (oparg) \ ++ : "r" (uaddr), "i" (-EFAULT), "r" (oparg) \ + ); \ + }) + +diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig +index 951e18f..16ef838 100644 +--- a/arch/powerpc/Kconfig ++++ b/arch/powerpc/Kconfig +@@ -937,6 +937,7 @@ config RELOCATABLE + must live at a different physical address than the primary + kernel. + ++# This value must have zeroes in the bottom 60 bits otherwise lots will break + config PAGE_OFFSET + hex + default "0xc000000000000000" +diff --git a/arch/powerpc/include/asm/page.h b/arch/powerpc/include/asm/page.h +index dd9c4fd..5b0bde2 100644 +--- a/arch/powerpc/include/asm/page.h ++++ b/arch/powerpc/include/asm/page.h +@@ -132,9 +132,19 @@ extern phys_addr_t kernstart_addr; + #define __va(x) ((void *)(unsigned long)((phys_addr_t)(x) - PHYSICAL_START + KERNELBASE)) + #define __pa(x) ((unsigned long)(x) + PHYSICAL_START - KERNELBASE) + #else ++#ifdef CONFIG_PPC64 ++/* ++ * gcc miscompiles (unsigned long)(&static_var) - PAGE_OFFSET ++ * with -mcmodel=medium, so we use & and | instead of - and + on 64-bit. ++ */ ++#define __va(x) ((void *)(unsigned long)((phys_addr_t)(x) | PAGE_OFFSET)) ++#define __pa(x) ((unsigned long)(x) & 0x0fffffffffffffffUL) ++ ++#else /* 32-bit, non book E */ + #define __va(x) ((void *)(unsigned long)((phys_addr_t)(x) + PAGE_OFFSET - MEMORY_START)) + #define __pa(x) ((unsigned long)(x) - PAGE_OFFSET + MEMORY_START) + #endif ++#endif + + /* + * Unfortunately the PLT is in the BSS in the PPC32 ELF ABI, +diff --git a/arch/powerpc/kernel/lparcfg.c b/arch/powerpc/kernel/lparcfg.c +index 84daabe..826681d 100644 +--- a/arch/powerpc/kernel/lparcfg.c ++++ b/arch/powerpc/kernel/lparcfg.c +@@ -37,7 +37,13 @@ + #include <asm/vdso_datapage.h> + #include <asm/vio.h> + #include <asm/mmu.h> ++#include <asm/machdep.h> + ++ ++/* ++ * This isn't a module but we expose that to userspace ++ * via /proc so leave the definitions here ++ */ + #define MODULE_VERS "1.9" + #define MODULE_NAME "lparcfg" + +@@ -487,7 +493,8 @@ static void parse_em_data(struct seq_file *m) + { + unsigned long retbuf[PLPAR_HCALL_BUFSIZE]; + +- if (plpar_hcall(H_GET_EM_PARMS, retbuf) == H_SUCCESS) ++ if (firmware_has_feature(FW_FEATURE_LPAR) && ++ plpar_hcall(H_GET_EM_PARMS, retbuf) == H_SUCCESS) + seq_printf(m, "power_mode_data=%016lx\n", retbuf[0]); + } + +@@ -772,7 +779,6 @@ static int lparcfg_open(struct inode *inode, struct file *file) + } + + static const struct file_operations lparcfg_fops = { +- .owner = THIS_MODULE, + .read = seq_read, + .write = lparcfg_write, + .open = lparcfg_open, +@@ -799,15 +805,4 @@ static int __init lparcfg_init(void) + proc_ppc64_lparcfg = ent; + return 0; + } +- +-static void __exit lparcfg_cleanup(void) +-{ +- if (proc_ppc64_lparcfg) +- remove_proc_entry("lparcfg", proc_ppc64_lparcfg->parent); +-} +- +-module_init(lparcfg_init); +-module_exit(lparcfg_cleanup); +-MODULE_DESCRIPTION("Interface for LPAR configuration data"); +-MODULE_AUTHOR("Dave Engebretsen"); +-MODULE_LICENSE("GPL"); ++machine_device_initcall(pseries, lparcfg_init); +diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c +index 4db9b1e..dd072b1 100644 +--- a/arch/s390/kvm/kvm-s390.c ++++ b/arch/s390/kvm/kvm-s390.c +@@ -469,6 +469,8 @@ int kvm_arch_vcpu_ioctl_set_mpstate(struct kvm_vcpu *vcpu, + + static void __vcpu_run(struct kvm_vcpu *vcpu) + { ++ int rc; ++ + memcpy(&vcpu->arch.sie_block->gg14, &vcpu->arch.guest_gprs[14], 16); + + if (need_resched()) +@@ -479,21 +481,24 @@ static void __vcpu_run(struct kvm_vcpu *vcpu) + + kvm_s390_deliver_pending_interrupts(vcpu); + ++ VCPU_EVENT(vcpu, 6, "entering sie flags %x", ++ atomic_read(&vcpu->arch.sie_block->cpuflags)); ++ + vcpu->arch.sie_block->icptcode = 0; + local_irq_disable(); + kvm_guest_enter(); + local_irq_enable(); +- VCPU_EVENT(vcpu, 6, "entering sie flags %x", +- atomic_read(&vcpu->arch.sie_block->cpuflags)); +- if (sie64a(vcpu->arch.sie_block, vcpu->arch.guest_gprs)) { ++ rc = sie64a(vcpu->arch.sie_block, vcpu->arch.guest_gprs); ++ local_irq_disable(); ++ kvm_guest_exit(); ++ local_irq_enable(); ++ ++ if (rc) { + VCPU_EVENT(vcpu, 3, "%s", "fault in sie instruction"); + kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING); + } + VCPU_EVENT(vcpu, 6, "exit sie icptcode %d", + vcpu->arch.sie_block->icptcode); +- local_irq_disable(); +- kvm_guest_exit(); +- local_irq_enable(); + + memcpy(&vcpu->arch.guest_gprs[14], &vcpu->arch.sie_block->gg14, 16); + } +diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig +index f210d51..87537e2 100644 +--- a/arch/sparc/Kconfig ++++ b/arch/sparc/Kconfig +@@ -31,6 +31,7 @@ config SPARC + + config SPARC32 + def_bool !64BIT ++ select GENERIC_ATOMIC64 + + config SPARC64 + def_bool 64BIT +diff --git a/arch/sparc/include/asm/atomic_32.h b/arch/sparc/include/asm/atomic_32.h +index 5c3c8b6..07dd35e 100644 +--- a/arch/sparc/include/asm/atomic_32.h ++++ b/arch/sparc/include/asm/atomic_32.h +@@ -15,6 +15,8 @@ + + #ifdef __KERNEL__ + ++#include <asm-generic/atomic64.h> ++ + #include <asm/system.h> + + #define ATOMIC_INIT(i) { (i) } +diff --git a/arch/sparc/lib/Makefile b/arch/sparc/lib/Makefile +index a3fc437..4961516 100644 +--- a/arch/sparc/lib/Makefile ++++ b/arch/sparc/lib/Makefile +@@ -40,7 +40,7 @@ lib-$(CONFIG_SPARC64) += copy_in_user.o user_fixup.o memmove.o + lib-$(CONFIG_SPARC64) += mcount.o ipcsum.o xor.o hweight.o ffs.o + + obj-y += iomap.o +-obj-$(CONFIG_SPARC32) += atomic32.o ++obj-$(CONFIG_SPARC32) += atomic32.o ucmpdi2.o + obj-y += ksyms.o + obj-$(CONFIG_SPARC64) += PeeCeeI.o + obj-y += usercopy.o +diff --git a/arch/sparc/lib/ucmpdi2.c b/arch/sparc/lib/ucmpdi2.c +new file mode 100644 +index 0000000..1e06ed5 +--- /dev/null ++++ b/arch/sparc/lib/ucmpdi2.c +@@ -0,0 +1,19 @@ ++#include <linux/module.h> ++#include "libgcc.h" ++ ++word_type __ucmpdi2(unsigned long long a, unsigned long long b) ++{ ++ const DWunion au = {.ll = a}; ++ const DWunion bu = {.ll = b}; ++ ++ if ((unsigned int) au.s.high < (unsigned int) bu.s.high) ++ return 0; ++ else if ((unsigned int) au.s.high > (unsigned int) bu.s.high) ++ return 2; ++ if ((unsigned int) au.s.low < (unsigned int) bu.s.low) ++ return 0; ++ else if ((unsigned int) au.s.low > (unsigned int) bu.s.low) ++ return 2; ++ return 1; ++} ++EXPORT_SYMBOL(__ucmpdi2); +diff --git a/arch/x86/kernel/i387.c b/arch/x86/kernel/i387.c +index 739d859..fa4ea09 100644 +--- a/arch/x86/kernel/i387.c ++++ b/arch/x86/kernel/i387.c +@@ -51,7 +51,7 @@ void __cpuinit mxcsr_feature_mask_init(void) + clts(); + if (cpu_has_fxsr) { + memset(&fx_scratch, 0, sizeof(struct i387_fxsave_struct)); +- asm volatile("fxsave %0" : : "m" (fx_scratch)); ++ asm volatile("fxsave %0" : "+m" (fx_scratch)); + mask = fx_scratch.mxcsr_mask; + if (mask == 0) + mask = 0x0000ffbf; +diff --git a/arch/x86/kernel/sys_x86_64.c b/arch/x86/kernel/sys_x86_64.c +index 0514890..cdb2fc9 100644 +--- a/arch/x86/kernel/sys_x86_64.c ++++ b/arch/x86/kernel/sys_x86_64.c +@@ -115,7 +115,7 @@ static void find_start_end(unsigned long flags, unsigned long *begin, + *begin = new_begin; + } + } else { +- *begin = TASK_UNMAPPED_BASE; ++ *begin = current->mm->mmap_legacy_base; + *end = TASK_SIZE; + } + } +diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c +index 845df68..5c1ae28 100644 +--- a/arch/x86/mm/mmap.c ++++ b/arch/x86/mm/mmap.c +@@ -112,12 +112,14 @@ static unsigned long mmap_legacy_base(void) + */ + void arch_pick_mmap_layout(struct mm_struct *mm) + { ++ mm->mmap_legacy_base = mmap_legacy_base(); ++ mm->mmap_base = mmap_base(); ++ + if (mmap_is_legacy()) { +- mm->mmap_base = mmap_legacy_base(); ++ mm->mmap_base = mm->mmap_legacy_base; + mm->get_unmapped_area = arch_get_unmapped_area; + mm->unmap_area = arch_unmap_area; + } else { +- mm->mmap_base = mmap_base(); + mm->get_unmapped_area = arch_get_unmapped_area_topdown; + mm->unmap_area = arch_unmap_area_topdown; + } +diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c +index 6e5a7f1..4d54b38 100644 +--- a/arch/x86/xen/setup.c ++++ b/arch/x86/xen/setup.c +@@ -212,6 +212,17 @@ static void xen_align_and_add_e820_region(u64 start, u64 size, int type) + e820_add_region(start, end - start, type); + } + ++void xen_ignore_unusable(struct e820entry *list, size_t map_size) ++{ ++ struct e820entry *entry; ++ unsigned int i; ++ ++ for (i = 0, entry = list; i < map_size; i++, entry++) { ++ if (entry->type == E820_UNUSABLE) ++ entry->type = E820_RAM; ++ } ++} ++ + /** + * machine_specific_memory_setup - Hook for machine specific memory setup. + **/ +@@ -250,6 +261,17 @@ char * __init xen_memory_setup(void) + } + BUG_ON(rc); + ++ /* ++ * Xen won't allow a 1:1 mapping to be created to UNUSABLE ++ * regions, so if we're using the machine memory map leave the ++ * region as RAM as it is in the pseudo-physical map. ++ * ++ * UNUSABLE regions in domUs are not handled and will need ++ * a patch in the future. ++ */ ++ if (xen_initial_domain()) ++ xen_ignore_unusable(map, memmap.nr_entries); ++ + /* Make sure the Xen-supplied memory map is well-ordered. */ + sanitize_e820_map(map, memmap.nr_entries, &memmap.nr_entries); + +diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c +index a1a4b8e..c749b93 100644 +--- a/drivers/acpi/battery.c ++++ b/drivers/acpi/battery.c +@@ -117,6 +117,7 @@ struct acpi_battery { + struct acpi_device *device; + struct notifier_block pm_nb; + unsigned long update_time; ++ int revision; + int rate_now; + int capacity_now; + int voltage_now; +@@ -350,6 +351,7 @@ static struct acpi_offsets info_offsets[] = { + }; + + static struct acpi_offsets extended_info_offsets[] = { ++ {offsetof(struct acpi_battery, revision), 0}, + {offsetof(struct acpi_battery, power_unit), 0}, + {offsetof(struct acpi_battery, design_capacity), 0}, + {offsetof(struct acpi_battery, full_charge_capacity), 0}, +diff --git a/drivers/ata/Kconfig b/drivers/ata/Kconfig +index cf047c4..e7b3a9e 100644 +--- a/drivers/ata/Kconfig ++++ b/drivers/ata/Kconfig +@@ -93,7 +93,7 @@ config SATA_FSL + If unsure, say N. + + config SATA_INIC162X +- tristate "Initio 162x SATA support" ++ tristate "Initio 162x SATA support (Very Experimental)" + depends on PCI + help + This option enables support for Initio 162x Serial ATA. +diff --git a/drivers/ata/libata-pmp.c b/drivers/ata/libata-pmp.c +index f63a588..f5c35be 100644 +--- a/drivers/ata/libata-pmp.c ++++ b/drivers/ata/libata-pmp.c +@@ -289,24 +289,24 @@ static int sata_pmp_configure(struct ata_device *dev, int print_info) + + /* Disable sending Early R_OK. + * With "cached read" HDD testing and multiple ports busy on a SATA +- * host controller, 3726 PMP will very rarely drop a deferred ++ * host controller, 3x26 PMP will very rarely drop a deferred + * R_OK that was intended for the host. Symptom will be all + * 5 drives under test will timeout, get reset, and recover. + */ +- if (vendor == 0x1095 && devid == 0x3726) { ++ if (vendor == 0x1095 && (devid == 0x3726 || devid == 0x3826)) { + u32 reg; + + err_mask = sata_pmp_read(&ap->link, PMP_GSCR_SII_POL, ®); + if (err_mask) { + rc = -EIO; +- reason = "failed to read Sil3726 Private Register"; ++ reason = "failed to read Sil3x26 Private Register"; + goto fail; + } + reg &= ~0x1; + err_mask = sata_pmp_write(&ap->link, PMP_GSCR_SII_POL, reg); + if (err_mask) { + rc = -EIO; +- reason = "failed to write Sil3726 Private Register"; ++ reason = "failed to write Sil3x26 Private Register"; + goto fail; + } + } +@@ -383,8 +383,8 @@ static void sata_pmp_quirks(struct ata_port *ap) + u16 devid = sata_pmp_gscr_devid(gscr); + struct ata_link *link; + +- if (vendor == 0x1095 && devid == 0x3726) { +- /* sil3726 quirks */ ++ if (vendor == 0x1095 && (devid == 0x3726 || devid == 0x3826)) { ++ /* sil3x26 quirks */ + ata_for_each_link(link, ap, EDGE) { + /* link reports offline after LPM */ + link->flags |= ATA_LFLAG_NO_LPM; +diff --git a/drivers/ata/sata_inic162x.c b/drivers/ata/sata_inic162x.c +index 5c7d70c..3a8b55e 100644 +--- a/drivers/ata/sata_inic162x.c ++++ b/drivers/ata/sata_inic162x.c +@@ -6,6 +6,18 @@ + * + * This file is released under GPL v2. + * ++ * **** WARNING **** ++ * ++ * This driver never worked properly and unfortunately data corruption is ++ * relatively common. There isn't anyone working on the driver and there's ++ * no support from the vendor. Do not use this driver in any production ++ * environment. ++ * ++ * http://thread.gmane.org/gmane.linux.debian.devel.bugs.rc/378525/focus=54491 ++ * https://bugzilla.kernel.org/show_bug.cgi?id=60565 ++ * ++ * ***************** ++ * + * This controller is eccentric and easily locks up if something isn't + * right. Documentation is available at initio's website but it only + * documents registers (not programming model). +@@ -809,6 +821,8 @@ static int inic_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + + ata_print_version_once(&pdev->dev, DRV_VERSION); + ++ dev_alert(&pdev->dev, "inic162x support is broken with common data corruption issues and will be disabled by default, contact linux-ide@vger.kernel.org if in production use\n"); ++ + /* alloc host */ + host = ata_host_alloc_pinfo(&pdev->dev, ppi, NR_PORTS); + hpriv = devm_kzalloc(&pdev->dev, sizeof(*hpriv), GFP_KERNEL); +diff --git a/drivers/base/memory.c b/drivers/base/memory.c +index 8272d92..732ad0d 100644 +--- a/drivers/base/memory.c ++++ b/drivers/base/memory.c +@@ -172,6 +172,8 @@ static ssize_t show_mem_removable(struct sys_device *dev, + container_of(dev, struct memory_block, sysdev); + + for (i = 0; i < sections_per_block; i++) { ++ if (!present_section_nr(mem->start_section_nr + i)) ++ continue; + pfn = section_nr_to_pfn(mem->start_section_nr + i); + ret &= is_mem_section_removable(pfn, PAGES_PER_SECTION); + } +diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c +index 79038e5..6790cf7 100644 +--- a/drivers/base/power/domain.c ++++ b/drivers/base/power/domain.c +@@ -751,8 +751,7 @@ static int pm_genpd_resume_noirq(struct device *dev) + if (IS_ERR(genpd)) + return -EINVAL; + +- if (genpd->suspend_power_off +- || (dev->power.wakeup_path && genpd_dev_active_wakeup(genpd, dev))) ++ if (genpd->suspend_power_off) + return 0; + + /* +diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c +index 853fdf8..bde72f7 100644 +--- a/drivers/bluetooth/ath3k.c ++++ b/drivers/bluetooth/ath3k.c +@@ -89,6 +89,11 @@ static struct usb_device_id ath3k_table[] = { + { USB_DEVICE(0x13d3, 0x3393) }, + { USB_DEVICE(0x0489, 0xe04e) }, + { USB_DEVICE(0x0489, 0xe056) }, ++ { USB_DEVICE(0x0489, 0xe04d) }, ++ { USB_DEVICE(0x04c5, 0x1330) }, ++ { USB_DEVICE(0x13d3, 0x3402) }, ++ { USB_DEVICE(0x0cf3, 0x3121) }, ++ { USB_DEVICE(0x0cf3, 0xe003) }, + + /* Atheros AR5BBU12 with sflash firmware */ + { USB_DEVICE(0x0489, 0xE02C) }, +@@ -125,6 +130,11 @@ static struct usb_device_id ath3k_blist_tbl[] = { + { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 }, + + /* Atheros AR5BBU22 with sflash firmware */ + { USB_DEVICE(0x0489, 0xE03C), .driver_info = BTUSB_ATH3012 }, +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 6b784b7..1bd3924 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -63,6 +63,9 @@ static struct usb_device_id btusb_table[] = { + /* Apple-specific (Broadcom) devices */ + { USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01) }, + ++ /* MediaTek MT76x0E */ ++ { USB_DEVICE(0x0e8d, 0x763f) }, ++ + /* Broadcom SoftSailing reporting vendor specific */ + { USB_DEVICE(0x0a5c, 0x21e1) }, + +@@ -156,6 +159,11 @@ static struct usb_device_id blacklist_table[] = { + { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 }, + + /* Atheros AR5BBU12 with sflash firmware */ + { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE }, +diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c +index d5ae736..c68b8ad 100644 +--- a/drivers/char/virtio_console.c ++++ b/drivers/char/virtio_console.c +@@ -257,9 +257,12 @@ static struct port *find_port_by_devt_in_portdev(struct ports_device *portdev, + unsigned long flags; + + spin_lock_irqsave(&portdev->ports_lock, flags); +- list_for_each_entry(port, &portdev->ports, list) +- if (port->cdev->dev == dev) ++ list_for_each_entry(port, &portdev->ports, list) { ++ if (port->cdev->dev == dev) { ++ kref_get(&port->kref); + goto out; ++ } ++ } + port = NULL; + out: + spin_unlock_irqrestore(&portdev->ports_lock, flags); +@@ -634,6 +637,10 @@ static ssize_t port_fops_read(struct file *filp, char __user *ubuf, + + port = filp->private_data; + ++ /* Port is hot-unplugged. */ ++ if (!port->guest_connected) ++ return -ENODEV; ++ + if (!port_has_data(port)) { + /* + * If nothing's connected on the host just return 0 in +@@ -650,7 +657,7 @@ static ssize_t port_fops_read(struct file *filp, char __user *ubuf, + if (ret < 0) + return ret; + } +- /* Port got hot-unplugged. */ ++ /* Port got hot-unplugged while we were waiting above. */ + if (!port->guest_connected) + return -ENODEV; + /* +@@ -793,14 +800,14 @@ static int port_fops_open(struct inode *inode, struct file *filp) + struct port *port; + int ret; + ++ /* We get the port with a kref here */ + port = find_port_by_devt(cdev->dev); ++ if (!port) { ++ /* Port was unplugged before we could proceed */ ++ return -ENXIO; ++ } + filp->private_data = port; + +- /* Prevent against a port getting hot-unplugged at the same time */ +- spin_lock_irq(&port->portdev->ports_lock); +- kref_get(&port->kref); +- spin_unlock_irq(&port->portdev->ports_lock); +- + /* + * Don't allow opening of console port devices -- that's done + * via /dev/hvc +@@ -1264,14 +1271,6 @@ static void remove_port(struct kref *kref) + + port = container_of(kref, struct port, kref); + +- sysfs_remove_group(&port->dev->kobj, &port_attribute_group); +- device_destroy(pdrvdata.class, port->dev->devt); +- cdev_del(port->cdev); +- +- kfree(port->name); +- +- debugfs_remove(port->debugfs_file); +- + kfree(port); + } + +@@ -1289,12 +1288,14 @@ static void unplug_port(struct port *port) + spin_unlock_irq(&port->portdev->ports_lock); + + if (port->guest_connected) { ++ /* Let the app know the port is going down. */ ++ send_sigio_to_port(port); ++ ++ /* Do this after sigio is actually sent */ + port->guest_connected = false; + port->host_connected = false; +- wake_up_interruptible(&port->waitqueue); + +- /* Let the app know the port is going down. */ +- send_sigio_to_port(port); ++ wake_up_interruptible(&port->waitqueue); + } + + if (is_console_port(port)) { +@@ -1320,6 +1321,14 @@ static void unplug_port(struct port *port) + */ + port->portdev = NULL; + ++ sysfs_remove_group(&port->dev->kobj, &port_attribute_group); ++ device_destroy(pdrvdata.class, port->dev->devt); ++ cdev_del(port->cdev); ++ ++ kfree(port->name); ++ ++ debugfs_remove(port->debugfs_file); ++ + /* + * Locks around here are not necessary - a port can't be + * opened after we removed the port struct from ports_list +diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h +index 144d37c..61274bf 100644 +--- a/drivers/gpu/drm/i915/i915_drv.h ++++ b/drivers/gpu/drm/i915/i915_drv.h +@@ -275,6 +275,7 @@ enum intel_pch { + #define QUIRK_PIPEA_FORCE (1<<0) + #define QUIRK_LVDS_SSC_DISABLE (1<<1) + #define QUIRK_INVERT_BRIGHTNESS (1<<2) ++#define QUIRK_NO_PCH_PWM_ENABLE (1<<3) + + struct intel_fbdev; + struct intel_fbc_work; +diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h +index 124dd87..97a050f 100644 +--- a/drivers/gpu/drm/i915/i915_reg.h ++++ b/drivers/gpu/drm/i915/i915_reg.h +@@ -362,6 +362,7 @@ + #define IPEIR_I965 0x02064 + #define IPEHR_I965 0x02068 + #define INSTDONE_I965 0x0206c ++#define RING_INSTPM(base) ((base)+0xc0) + #define INSTPS 0x02070 /* 965+ only */ + #define INSTDONE1 0x0207c /* 965+ only */ + #define ACTHD_I965 0x02074 +@@ -458,6 +459,8 @@ + will not assert AGPBUSY# and will only + be delivered when out of C3. */ + #define INSTPM_FORCE_ORDERING (1<<7) /* GEN6+ */ ++#define INSTPM_TLB_INVALIDATE (1<<9) ++#define INSTPM_SYNC_FLUSH (1<<5) + #define ACTHD 0x020c8 + #define FW_BLC 0x020d8 + #define FW_BLC2 0x020dc +@@ -3513,7 +3516,7 @@ + #define EDP_LINK_TRAIN_600MV_0DB_IVB (0x30 <<22) + #define EDP_LINK_TRAIN_600MV_3_5DB_IVB (0x36 <<22) + #define EDP_LINK_TRAIN_800MV_0DB_IVB (0x38 <<22) +-#define EDP_LINK_TRAIN_800MV_3_5DB_IVB (0x33 <<22) ++#define EDP_LINK_TRAIN_800MV_3_5DB_IVB (0x3e <<22) + + /* legacy values */ + #define EDP_LINK_TRAIN_500MV_0DB_IVB (0x00 <<22) +diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c +index cfbb893..ee29c1f 100644 +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -8842,6 +8842,17 @@ static void quirk_invert_brightness(struct drm_device *dev) + dev_priv->quirks |= QUIRK_INVERT_BRIGHTNESS; + } + ++/* ++ * Some machines (Dell XPS13) suffer broken backlight controls if ++ * BLM_PCH_PWM_ENABLE is set. ++ */ ++static void quirk_no_pcm_pwm_enable(struct drm_device *dev) ++{ ++ struct drm_i915_private *dev_priv = dev->dev_private; ++ dev_priv->quirks |= QUIRK_NO_PCH_PWM_ENABLE; ++ DRM_INFO("applying no-PCH_PWM_ENABLE quirk\n"); ++} ++ + struct intel_quirk { + int device; + int subsystem_vendor; +@@ -8916,6 +8927,11 @@ struct intel_quirk intel_quirks[] = { + + /* Acer/Packard Bell NCL20 */ + { 0x2a42, 0x1025, 0x034b, quirk_invert_brightness }, ++ ++ /* Dell XPS13 HD Sandy Bridge */ ++ { 0x0116, 0x1028, 0x052e, quirk_no_pcm_pwm_enable }, ++ /* Dell XPS13 HD and XPS13 FHD Ivy Bridge */ ++ { 0x0166, 0x1028, 0x058b, quirk_no_pcm_pwm_enable }, + }; + + static void intel_init_quirks(struct drm_device *dev) +diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c +index 2ffa740..74d312f 100644 +--- a/drivers/gpu/drm/i915/intel_lvds.c ++++ b/drivers/gpu/drm/i915/intel_lvds.c +@@ -402,13 +402,7 @@ static void intel_lvds_prepare(struct drm_encoder *encoder) + { + struct intel_lvds *intel_lvds = to_intel_lvds(encoder); + +- /* +- * Prior to Ironlake, we must disable the pipe if we want to adjust +- * the panel fitter. However at all other times we can just reset +- * the registers regardless. +- */ +- if (!HAS_PCH_SPLIT(encoder->dev) && intel_lvds->pfit_dirty) +- intel_lvds_disable(intel_lvds); ++ intel_lvds_disable(intel_lvds); + } + + static void intel_lvds_commit(struct drm_encoder *encoder) +@@ -1075,7 +1069,8 @@ bool intel_lvds_init(struct drm_device *dev) + goto failed; + + out: +- if (HAS_PCH_SPLIT(dev)) { ++ if (HAS_PCH_SPLIT(dev) && ++ !(dev_priv->quirks & QUIRK_NO_PCH_PWM_ENABLE)) { + u32 pwm; + + pipe = (I915_READ(PCH_LVDS) & LVDS_PIPEB_SELECT) ? 1 : 0; +diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c +index 38a7793..3c55cf6 100644 +--- a/drivers/gpu/drm/i915/intel_ringbuffer.c ++++ b/drivers/gpu/drm/i915/intel_ringbuffer.c +@@ -776,6 +776,18 @@ void intel_ring_setup_status_page(struct intel_ring_buffer *ring) + + I915_WRITE(mmio, (u32)ring->status_page.gfx_addr); + POSTING_READ(mmio); ++ ++ /* Flush the TLB for this page */ ++ if (INTEL_INFO(dev)->gen >= 6) { ++ u32 reg = RING_INSTPM(ring->mmio_base); ++ I915_WRITE(reg, ++ _MASKED_BIT_ENABLE(INSTPM_TLB_INVALIDATE | ++ INSTPM_SYNC_FLUSH)); ++ if (wait_for((I915_READ(reg) & INSTPM_SYNC_FLUSH) == 0, ++ 1000)) ++ DRM_ERROR("%s: wait for SyncFlush to complete for TLB invalidation timed out\n", ++ ring->name); ++ } + } + + static int +diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c +index d969f3c..afb351a 100644 +--- a/drivers/gpu/drm/radeon/atom.c ++++ b/drivers/gpu/drm/radeon/atom.c +@@ -1220,12 +1220,17 @@ int atom_execute_table(struct atom_context *ctx, int index, uint32_t * params) + int r; + + mutex_lock(&ctx->mutex); ++ /* reset data block */ ++ ctx->data_block = 0; + /* reset reg block */ + ctx->reg_block = 0; + /* reset fb window */ + ctx->fb_base = 0; + /* reset io mode */ + ctx->io_mode = ATOM_IO_MM; ++ /* reset divmul */ ++ ctx->divmul[0] = 0; ++ ctx->divmul[1] = 0; + r = atom_execute_table_locked(ctx, index, params); + mutex_unlock(&ctx->mutex); + return r; +diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c +index 9bea4a6..f5962a0 100644 +--- a/drivers/gpu/drm/radeon/evergreen.c ++++ b/drivers/gpu/drm/radeon/evergreen.c +@@ -3036,6 +3036,8 @@ static int evergreen_startup(struct radeon_device *rdev) + /* enable pcie gen2 link */ + evergreen_pcie_gen2_enable(rdev); + ++ evergreen_mc_program(rdev); ++ + if (ASIC_IS_DCE5(rdev)) { + if (!rdev->me_fw || !rdev->pfp_fw || !rdev->rlc_fw || !rdev->mc_fw) { + r = ni_init_microcode(rdev); +@@ -3063,7 +3065,6 @@ static int evergreen_startup(struct radeon_device *rdev) + if (r) + return r; + +- evergreen_mc_program(rdev); + if (rdev->flags & RADEON_IS_AGP) { + evergreen_agp_enable(rdev); + } else { +diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c +index 3f9705b..77e6fb1 100644 +--- a/drivers/gpu/drm/radeon/ni.c ++++ b/drivers/gpu/drm/radeon/ni.c +@@ -1353,6 +1353,8 @@ static int cayman_startup(struct radeon_device *rdev) + /* enable pcie gen2 link */ + evergreen_pcie_gen2_enable(rdev); + ++ evergreen_mc_program(rdev); ++ + if (!rdev->me_fw || !rdev->pfp_fw || !rdev->rlc_fw || !rdev->mc_fw) { + r = ni_init_microcode(rdev); + if (r) { +@@ -1370,7 +1372,6 @@ static int cayman_startup(struct radeon_device *rdev) + if (r) + return r; + +- evergreen_mc_program(rdev); + r = cayman_pcie_gart_enable(rdev); + if (r) + return r; +diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c +index 3d46d7d4..57e45c6 100644 +--- a/drivers/gpu/drm/radeon/r600.c ++++ b/drivers/gpu/drm/radeon/r600.c +@@ -2415,6 +2415,8 @@ int r600_startup(struct radeon_device *rdev) + /* enable pcie gen2 link */ + r600_pcie_gen2_enable(rdev); + ++ r600_mc_program(rdev); ++ + if (!rdev->me_fw || !rdev->pfp_fw || !rdev->rlc_fw) { + r = r600_init_microcode(rdev); + if (r) { +@@ -2427,7 +2429,6 @@ int r600_startup(struct radeon_device *rdev) + if (r) + return r; + +- r600_mc_program(rdev); + if (rdev->flags & RADEON_IS_AGP) { + r600_agp_enable(rdev); + } else { +diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c +index 63db75d..3e72074 100644 +--- a/drivers/gpu/drm/radeon/rv770.c ++++ b/drivers/gpu/drm/radeon/rv770.c +@@ -1057,6 +1057,8 @@ static int rv770_startup(struct radeon_device *rdev) + /* enable pcie gen2 link */ + rv770_pcie_gen2_enable(rdev); + ++ rv770_mc_program(rdev); ++ + if (!rdev->me_fw || !rdev->pfp_fw || !rdev->rlc_fw) { + r = r600_init_microcode(rdev); + if (r) { +@@ -1069,7 +1071,6 @@ static int rv770_startup(struct radeon_device *rdev) + if (r) + return r; + +- rv770_mc_program(rdev); + if (rdev->flags & RADEON_IS_AGP) { + rv770_agp_enable(rdev); + } else { +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c b/drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c +index c41226a..2952249 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c +@@ -29,7 +29,9 @@ + #include "drmP.h" + #include "ttm/ttm_bo_driver.h" + +-#define VMW_PPN_SIZE sizeof(unsigned long) ++#define VMW_PPN_SIZE (sizeof(unsigned long)) ++/* A future safe maximum remap size. */ ++#define VMW_PPN_PER_REMAP ((31 * 1024) / VMW_PPN_SIZE) + + static int vmw_gmr2_bind(struct vmw_private *dev_priv, + struct page *pages[], +@@ -38,43 +40,61 @@ static int vmw_gmr2_bind(struct vmw_private *dev_priv, + { + SVGAFifoCmdDefineGMR2 define_cmd; + SVGAFifoCmdRemapGMR2 remap_cmd; +- uint32_t define_size = sizeof(define_cmd) + 4; +- uint32_t remap_size = VMW_PPN_SIZE * num_pages + sizeof(remap_cmd) + 4; + uint32_t *cmd; + uint32_t *cmd_orig; ++ uint32_t define_size = sizeof(define_cmd) + sizeof(*cmd); ++ uint32_t remap_num = num_pages / VMW_PPN_PER_REMAP + ((num_pages % VMW_PPN_PER_REMAP) > 0); ++ uint32_t remap_size = VMW_PPN_SIZE * num_pages + (sizeof(remap_cmd) + sizeof(*cmd)) * remap_num; ++ uint32_t remap_pos = 0; ++ uint32_t cmd_size = define_size + remap_size; + uint32_t i; + +- cmd_orig = cmd = vmw_fifo_reserve(dev_priv, define_size + remap_size); ++ cmd_orig = cmd = vmw_fifo_reserve(dev_priv, cmd_size); + if (unlikely(cmd == NULL)) + return -ENOMEM; + + define_cmd.gmrId = gmr_id; + define_cmd.numPages = num_pages; + ++ *cmd++ = SVGA_CMD_DEFINE_GMR2; ++ memcpy(cmd, &define_cmd, sizeof(define_cmd)); ++ cmd += sizeof(define_cmd) / sizeof(*cmd); ++ ++ /* ++ * Need to split the command if there are too many ++ * pages that goes into the gmr. ++ */ ++ + remap_cmd.gmrId = gmr_id; + remap_cmd.flags = (VMW_PPN_SIZE > sizeof(*cmd)) ? + SVGA_REMAP_GMR2_PPN64 : SVGA_REMAP_GMR2_PPN32; +- remap_cmd.offsetPages = 0; +- remap_cmd.numPages = num_pages; + +- *cmd++ = SVGA_CMD_DEFINE_GMR2; +- memcpy(cmd, &define_cmd, sizeof(define_cmd)); +- cmd += sizeof(define_cmd) / sizeof(uint32); ++ while (num_pages > 0) { ++ unsigned long nr = min(num_pages, (unsigned long)VMW_PPN_PER_REMAP); ++ ++ remap_cmd.offsetPages = remap_pos; ++ remap_cmd.numPages = nr; + +- *cmd++ = SVGA_CMD_REMAP_GMR2; +- memcpy(cmd, &remap_cmd, sizeof(remap_cmd)); +- cmd += sizeof(remap_cmd) / sizeof(uint32); ++ *cmd++ = SVGA_CMD_REMAP_GMR2; ++ memcpy(cmd, &remap_cmd, sizeof(remap_cmd)); ++ cmd += sizeof(remap_cmd) / sizeof(*cmd); + +- for (i = 0; i < num_pages; ++i) { +- if (VMW_PPN_SIZE <= 4) +- *cmd = page_to_pfn(*pages++); +- else +- *((uint64_t *)cmd) = page_to_pfn(*pages++); ++ for (i = 0; i < nr; ++i) { ++ if (VMW_PPN_SIZE <= 4) ++ *cmd = page_to_pfn(*pages++); ++ else ++ *((uint64_t *)cmd) = page_to_pfn(*pages++); + +- cmd += VMW_PPN_SIZE / sizeof(*cmd); ++ cmd += VMW_PPN_SIZE / sizeof(*cmd); ++ } ++ ++ num_pages -= nr; ++ remap_pos += nr; + } + +- vmw_fifo_commit(dev_priv, define_size + remap_size); ++ BUG_ON(cmd != cmd_orig + cmd_size / sizeof(*cmd)); ++ ++ vmw_fifo_commit(dev_priv, cmd_size); + + return 0; + } +diff --git a/drivers/hwmon/adt7470.c b/drivers/hwmon/adt7470.c +index c6d1ce0..a9726c1 100644 +--- a/drivers/hwmon/adt7470.c ++++ b/drivers/hwmon/adt7470.c +@@ -215,7 +215,7 @@ static inline int adt7470_write_word_data(struct i2c_client *client, u8 reg, + u16 value) + { + return i2c_smbus_write_byte_data(client, reg, value & 0xFF) +- && i2c_smbus_write_byte_data(client, reg + 1, value >> 8); ++ || i2c_smbus_write_byte_data(client, reg + 1, value >> 8); + } + + static void adt7470_init_client(struct i2c_client *client) +diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c +index 298e02a..c706a7b 100644 +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -1139,7 +1139,7 @@ read_again: + * know the original bi_idx, so we just free + * them all + */ +- __bio_for_each_segment(bvec, mbio, j, 0) ++ bio_for_each_segment_all(bvec, mbio, j) + bvec->bv_page = r1_bio->behind_bvecs[j].bv_page; + if (test_bit(WriteMostly, &conf->mirrors[i].rdev->flags)) + atomic_inc(&r1_bio->behind_remaining); +diff --git a/drivers/net/arcnet/arcnet.c b/drivers/net/arcnet/arcnet.c +index a746ba2..a956053 100644 +--- a/drivers/net/arcnet/arcnet.c ++++ b/drivers/net/arcnet/arcnet.c +@@ -1007,7 +1007,7 @@ static void arcnet_rx(struct net_device *dev, int bufnum) + + soft = &pkt.soft.rfc1201; + +- lp->hw.copy_from_card(dev, bufnum, 0, &pkt, sizeof(ARC_HDR_SIZE)); ++ lp->hw.copy_from_card(dev, bufnum, 0, &pkt, ARC_HDR_SIZE); + if (pkt.hard.offset[0]) { + ofs = pkt.hard.offset[0]; + length = 256 - ofs; +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c +index fcd0e47..2a7d091 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c +@@ -108,9 +108,8 @@ s32 ixgbe_dcb_config_tx_desc_arbiter_82598(struct ixgbe_hw *hw, + + /* Enable arbiter */ + reg &= ~IXGBE_DPMCS_ARBDIS; +- /* Enable DFP and Recycle mode */ +- reg |= (IXGBE_DPMCS_TDPAC | IXGBE_DPMCS_TRM); + reg |= IXGBE_DPMCS_TSOEF; ++ + /* Configure Max TSO packet size 34KB including payload and headers */ + reg |= (0x4 << IXGBE_DPMCS_MTSOS_SHIFT); + +diff --git a/drivers/net/ifb.c b/drivers/net/ifb.c +index b19841a..00f1367 100644 +--- a/drivers/net/ifb.c ++++ b/drivers/net/ifb.c +@@ -34,6 +34,7 @@ + #include <linux/init.h> + #include <linux/interrupt.h> + #include <linux/moduleparam.h> ++#include <linux/sched.h> + #include <net/pkt_sched.h> + #include <net/net_namespace.h> + +diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c +index f3d17f8..a8e4640 100644 +--- a/drivers/net/usb/smsc75xx.c ++++ b/drivers/net/usb/smsc75xx.c +@@ -43,7 +43,6 @@ + #define EEPROM_MAC_OFFSET (0x01) + #define DEFAULT_TX_CSUM_ENABLE (true) + #define DEFAULT_RX_CSUM_ENABLE (true) +-#define DEFAULT_TSO_ENABLE (true) + #define SMSC75XX_INTERNAL_PHY_ID (1) + #define SMSC75XX_TX_OVERHEAD (8) + #define MAX_RX_FIFO_SIZE (20 * 1024) +@@ -1035,17 +1034,14 @@ static int smsc75xx_bind(struct usbnet *dev, struct usb_interface *intf) + + INIT_WORK(&pdata->set_multicast, smsc75xx_deferred_multicast_write); + +- if (DEFAULT_TX_CSUM_ENABLE) { ++ if (DEFAULT_TX_CSUM_ENABLE) + dev->net->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM; +- if (DEFAULT_TSO_ENABLE) +- dev->net->features |= NETIF_F_SG | +- NETIF_F_TSO | NETIF_F_TSO6; +- } ++ + if (DEFAULT_RX_CSUM_ENABLE) + dev->net->features |= NETIF_F_RXCSUM; + + dev->net->hw_features = NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM | +- NETIF_F_SG | NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_RXCSUM; ++ NETIF_F_RXCSUM; + + /* Init all registers */ + ret = smsc75xx_reset(dev); +@@ -1170,8 +1166,6 @@ static struct sk_buff *smsc75xx_tx_fixup(struct usbnet *dev, + { + u32 tx_cmd_a, tx_cmd_b; + +- skb_linearize(skb); +- + if (skb_headroom(skb) < SMSC75XX_TX_OVERHEAD) { + struct sk_buff *skb2 = + skb_copy_expand(skb, SMSC75XX_TX_OVERHEAD, 0, flags); +diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c +index 84890d5..ef921e1 100644 +--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c ++++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c +@@ -851,6 +851,7 @@ static int ath9k_init_device(struct ath9k_htc_priv *priv, + if (error != 0) + goto err_rx; + ++ ath9k_hw_disable(priv->ah); + #ifdef CONFIG_MAC80211_LEDS + /* must be initialized before ieee80211_register_hw */ + priv->led_cdev.default_trigger = ieee80211_create_tpt_led_trigger(priv->hw, +diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c +index a48bb83..9a57149 100644 +--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c ++++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c +@@ -448,6 +448,7 @@ static void ath9k_htc_tx_process(struct ath9k_htc_priv *priv, + struct ieee80211_conf *cur_conf = &priv->hw->conf; + bool txok; + int slot; ++ int hdrlen, padsize; + + slot = strip_drv_header(priv, skb); + if (slot < 0) { +@@ -504,6 +505,15 @@ send_mac80211: + + ath9k_htc_tx_clear_slot(priv, slot); + ++ /* Remove padding before handing frame back to mac80211 */ ++ hdrlen = ieee80211_get_hdrlen_from_skb(skb); ++ ++ padsize = hdrlen & 3; ++ if (padsize && skb->len > hdrlen + padsize) { ++ memmove(skb->data + padsize, skb->data, hdrlen); ++ skb_pull(skb, padsize); ++ } ++ + /* Send status to mac80211 */ + ieee80211_tx_status(priv->hw, skb); + } +diff --git a/drivers/net/wireless/hostap/hostap_ioctl.c b/drivers/net/wireless/hostap/hostap_ioctl.c +index 045a936..271e818 100644 +--- a/drivers/net/wireless/hostap/hostap_ioctl.c ++++ b/drivers/net/wireless/hostap/hostap_ioctl.c +@@ -522,9 +522,9 @@ static int prism2_ioctl_giwaplist(struct net_device *dev, + + data->length = prism2_ap_get_sta_qual(local, addr, qual, IW_MAX_AP, 1); + +- memcpy(extra, &addr, sizeof(struct sockaddr) * data->length); ++ memcpy(extra, addr, sizeof(struct sockaddr) * data->length); + data->flags = 1; /* has quality information */ +- memcpy(extra + sizeof(struct sockaddr) * data->length, &qual, ++ memcpy(extra + sizeof(struct sockaddr) * data->length, qual, + sizeof(struct iw_quality) * data->length); + + kfree(addr); +diff --git a/drivers/net/wireless/iwlegacy/iwl-core.c b/drivers/net/wireless/iwlegacy/iwl-core.c +index 1bb64c9..09891e5 100644 +--- a/drivers/net/wireless/iwlegacy/iwl-core.c ++++ b/drivers/net/wireless/iwlegacy/iwl-core.c +@@ -1757,6 +1757,7 @@ int iwl_legacy_force_reset(struct iwl_priv *priv, bool external) + + return 0; + } ++EXPORT_SYMBOL(iwl_legacy_force_reset); + + int + iwl_legacy_mac_change_interface(struct ieee80211_hw *hw, +diff --git a/drivers/net/wireless/iwlegacy/iwl4965-base.c b/drivers/net/wireless/iwlegacy/iwl4965-base.c +index d2fba9e..6e25c7b 100644 +--- a/drivers/net/wireless/iwlegacy/iwl4965-base.c ++++ b/drivers/net/wireless/iwlegacy/iwl4965-base.c +@@ -868,13 +868,13 @@ static void iwl4965_irq_tasklet(struct iwl_priv *priv) + * is killed. Hence update the killswitch state here. The + * rfkill handler will care about restarting if needed. + */ +- if (!test_bit(STATUS_ALIVE, &priv->status)) { +- if (hw_rf_kill) +- set_bit(STATUS_RF_KILL_HW, &priv->status); +- else +- clear_bit(STATUS_RF_KILL_HW, &priv->status); +- wiphy_rfkill_set_hw_state(priv->hw->wiphy, hw_rf_kill); ++ if (hw_rf_kill) { ++ set_bit(STATUS_RF_KILL_HW, &priv->status); ++ } else { ++ clear_bit(STATUS_RF_KILL_HW, &priv->status); ++ iwl_legacy_force_reset(priv, true); + } ++ wiphy_rfkill_set_hw_state(priv->hw->wiphy, hw_rf_kill); + + handled |= CSR_INT_BIT_RF_KILL; + } +@@ -1764,6 +1764,9 @@ static void iwl4965_alive_start(struct iwl_priv *priv) + + priv->active_rate = IWL_RATES_MASK; + ++ iwl_legacy_power_update_mode(priv, true); ++ IWL_DEBUG_INFO(priv, "Updated power mode\n"); ++ + if (iwl_legacy_is_associated_ctx(ctx)) { + struct iwl_legacy_rxon_cmd *active_rxon = + (struct iwl_legacy_rxon_cmd *)&ctx->active; +@@ -1796,9 +1799,6 @@ static void iwl4965_alive_start(struct iwl_priv *priv) + IWL_DEBUG_INFO(priv, "ALIVE processing complete.\n"); + wake_up(&priv->wait_command_queue); + +- iwl_legacy_power_update_mode(priv, true); +- IWL_DEBUG_INFO(priv, "Updated power mode\n"); +- + return; + + restart: +diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c +index 16cdd12..94d35ad 100644 +--- a/drivers/net/wireless/iwlwifi/iwl-agn.c ++++ b/drivers/net/wireless/iwlwifi/iwl-agn.c +@@ -1297,7 +1297,7 @@ int iwl_alive_start(struct iwl_priv *priv) + BT_COEX_PRIO_TBL_EVT_INIT_CALIB2); + if (ret) + return ret; +- } else { ++ } else if (priv->cfg->bt_params) { + /* + * default is 2-wire BT coexexistence support + */ +diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c +index 832ec4d..5ef176a 100644 +--- a/drivers/net/wireless/iwlwifi/iwl-core.c ++++ b/drivers/net/wireless/iwlwifi/iwl-core.c +@@ -808,8 +808,11 @@ void iwl_chswitch_done(struct iwl_priv *priv, bool is_success) + if (test_bit(STATUS_EXIT_PENDING, &priv->shrd->status)) + return; + +- if (test_and_clear_bit(STATUS_CHANNEL_SWITCH_PENDING, ++ if (!test_and_clear_bit(STATUS_CHANNEL_SWITCH_PENDING, + &priv->shrd->status)) ++ return; ++ ++ if (ctx->vif) + ieee80211_chswitch_done(ctx->vif, is_success); + } + +diff --git a/drivers/net/wireless/iwlwifi/iwl-pci.c b/drivers/net/wireless/iwlwifi/iwl-pci.c +index 1800029..346dc9b 100644 +--- a/drivers/net/wireless/iwlwifi/iwl-pci.c ++++ b/drivers/net/wireless/iwlwifi/iwl-pci.c +@@ -227,6 +227,7 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = { + {IWL_PCI_DEVICE(0x423C, 0x1306, iwl5150_abg_cfg)}, /* Half Mini Card */ + {IWL_PCI_DEVICE(0x423C, 0x1221, iwl5150_agn_cfg)}, /* Mini Card */ + {IWL_PCI_DEVICE(0x423C, 0x1321, iwl5150_agn_cfg)}, /* Half Mini Card */ ++ {IWL_PCI_DEVICE(0x423C, 0x1326, iwl5150_abg_cfg)}, /* Half Mini Card */ + + {IWL_PCI_DEVICE(0x423D, 0x1211, iwl5150_agn_cfg)}, /* Mini Card */ + {IWL_PCI_DEVICE(0x423D, 0x1311, iwl5150_agn_cfg)}, /* Half Mini Card */ +diff --git a/drivers/net/wireless/mwifiex/sdio.c b/drivers/net/wireless/mwifiex/sdio.c +index 3579a68..17f8720 100644 +--- a/drivers/net/wireless/mwifiex/sdio.c ++++ b/drivers/net/wireless/mwifiex/sdio.c +@@ -1429,8 +1429,8 @@ static int mwifiex_sdio_host_to_card(struct mwifiex_adapter *adapter, + /* Allocate buffer and copy payload */ + blk_size = MWIFIEX_SDIO_BLOCK_SIZE; + buf_block_len = (pkt_len + blk_size - 1) / blk_size; +- *(u16 *) &payload[0] = (u16) pkt_len; +- *(u16 *) &payload[2] = type; ++ *(__le16 *)&payload[0] = cpu_to_le16((u16)pkt_len); ++ *(__le16 *)&payload[2] = cpu_to_le16(type); + + /* + * This is SDIO specific header +diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c +index 50f92d5..4d792a2 100644 +--- a/drivers/net/wireless/rt2x00/rt2x00queue.c ++++ b/drivers/net/wireless/rt2x00/rt2x00queue.c +@@ -856,13 +856,8 @@ void rt2x00queue_index_inc(struct queue_entry *entry, enum queue_index index) + spin_unlock_irqrestore(&queue->index_lock, irqflags); + } + +-void rt2x00queue_pause_queue(struct data_queue *queue) ++void rt2x00queue_pause_queue_nocheck(struct data_queue *queue) + { +- if (!test_bit(DEVICE_STATE_PRESENT, &queue->rt2x00dev->flags) || +- !test_bit(QUEUE_STARTED, &queue->flags) || +- test_and_set_bit(QUEUE_PAUSED, &queue->flags)) +- return; +- + switch (queue->qid) { + case QID_AC_VO: + case QID_AC_VI: +@@ -878,6 +873,15 @@ void rt2x00queue_pause_queue(struct data_queue *queue) + break; + } + } ++void rt2x00queue_pause_queue(struct data_queue *queue) ++{ ++ if (!test_bit(DEVICE_STATE_PRESENT, &queue->rt2x00dev->flags) || ++ !test_bit(QUEUE_STARTED, &queue->flags) || ++ test_and_set_bit(QUEUE_PAUSED, &queue->flags)) ++ return; ++ ++ rt2x00queue_pause_queue_nocheck(queue); ++} + EXPORT_SYMBOL_GPL(rt2x00queue_pause_queue); + + void rt2x00queue_unpause_queue(struct data_queue *queue) +@@ -939,7 +943,7 @@ void rt2x00queue_stop_queue(struct data_queue *queue) + return; + } + +- rt2x00queue_pause_queue(queue); ++ rt2x00queue_pause_queue_nocheck(queue); + + queue->rt2x00dev->ops->lib->stop_queue(queue); + +diff --git a/drivers/net/wireless/zd1201.c b/drivers/net/wireless/zd1201.c +index 8efa2f2..f8c319c 100644 +--- a/drivers/net/wireless/zd1201.c ++++ b/drivers/net/wireless/zd1201.c +@@ -98,10 +98,12 @@ static int zd1201_fw_upload(struct usb_device *dev, int apfw) + goto exit; + + err = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), 0x4, +- USB_DIR_IN | 0x40, 0,0, &ret, sizeof(ret), ZD1201_FW_TIMEOUT); ++ USB_DIR_IN | 0x40, 0, 0, buf, sizeof(ret), ZD1201_FW_TIMEOUT); + if (err < 0) + goto exit; + ++ memcpy(&ret, buf, sizeof(ret)); ++ + if (ret & 0x80) { + err = -EIO; + goto exit; +diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c +index fd85fa2..b77808c 100644 +--- a/drivers/of/fdt.c ++++ b/drivers/of/fdt.c +@@ -389,6 +389,8 @@ static void __unflatten_device_tree(struct boot_param_header *blob, + mem = (unsigned long) + dt_alloc(size + 4, __alignof__(struct device_node)); + ++ memset((void *)mem, 0, size); ++ + ((__be32 *)mem)[size / 4] = cpu_to_be32(0xdeadbeef); + + pr_debug(" unflattening %lx...\n", mem); +diff --git a/drivers/parisc/iommu-helpers.h b/drivers/parisc/iommu-helpers.h +index a9c46cc..8c33491 100644 +--- a/drivers/parisc/iommu-helpers.h ++++ b/drivers/parisc/iommu-helpers.h +@@ -1,3 +1,5 @@ ++#include <linux/prefetch.h> ++ + /** + * iommu_fill_pdir - Insert coalesced scatter/gather chunks into the I/O Pdir. + * @ioc: The I/O Controller. +diff --git a/drivers/pci/Makefile b/drivers/pci/Makefile +index 083a49f..165274c 100644 +--- a/drivers/pci/Makefile ++++ b/drivers/pci/Makefile +@@ -42,6 +42,7 @@ obj-$(CONFIG_UNICORE32) += setup-bus.o setup-irq.o + obj-$(CONFIG_PARISC) += setup-bus.o + obj-$(CONFIG_SUPERH) += setup-bus.o setup-irq.o + obj-$(CONFIG_PPC) += setup-bus.o ++obj-$(CONFIG_FRV) += setup-bus.o + obj-$(CONFIG_MIPS) += setup-bus.o setup-irq.o + obj-$(CONFIG_X86_VISWS) += setup-irq.o + obj-$(CONFIG_MN10300) += setup-bus.o +diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c +index e1b4f80..5c87270 100644 +--- a/drivers/s390/scsi/zfcp_erp.c ++++ b/drivers/s390/scsi/zfcp_erp.c +@@ -102,10 +102,13 @@ static void zfcp_erp_action_dismiss_port(struct zfcp_port *port) + + if (atomic_read(&port->status) & ZFCP_STATUS_COMMON_ERP_INUSE) + zfcp_erp_action_dismiss(&port->erp_action); +- else +- shost_for_each_device(sdev, port->adapter->scsi_host) ++ else { ++ spin_lock(port->adapter->scsi_host->host_lock); ++ __shost_for_each_device(sdev, port->adapter->scsi_host) + if (sdev_to_zfcp(sdev)->port == port) + zfcp_erp_action_dismiss_lun(sdev); ++ spin_unlock(port->adapter->scsi_host->host_lock); ++ } + } + + static void zfcp_erp_action_dismiss_adapter(struct zfcp_adapter *adapter) +@@ -592,9 +595,11 @@ static void _zfcp_erp_lun_reopen_all(struct zfcp_port *port, int clear, + { + struct scsi_device *sdev; + +- shost_for_each_device(sdev, port->adapter->scsi_host) ++ spin_lock(port->adapter->scsi_host->host_lock); ++ __shost_for_each_device(sdev, port->adapter->scsi_host) + if (sdev_to_zfcp(sdev)->port == port) + _zfcp_erp_lun_reopen(sdev, clear, id, 0); ++ spin_unlock(port->adapter->scsi_host->host_lock); + } + + static void zfcp_erp_strategy_followup_failed(struct zfcp_erp_action *act) +@@ -1435,8 +1440,10 @@ void zfcp_erp_set_adapter_status(struct zfcp_adapter *adapter, u32 mask) + atomic_set_mask(common_mask, &port->status); + read_unlock_irqrestore(&adapter->port_list_lock, flags); + +- shost_for_each_device(sdev, adapter->scsi_host) ++ spin_lock_irqsave(adapter->scsi_host->host_lock, flags); ++ __shost_for_each_device(sdev, adapter->scsi_host) + atomic_set_mask(common_mask, &sdev_to_zfcp(sdev)->status); ++ spin_unlock_irqrestore(adapter->scsi_host->host_lock, flags); + } + + /** +@@ -1470,11 +1477,13 @@ void zfcp_erp_clear_adapter_status(struct zfcp_adapter *adapter, u32 mask) + } + read_unlock_irqrestore(&adapter->port_list_lock, flags); + +- shost_for_each_device(sdev, adapter->scsi_host) { ++ spin_lock_irqsave(adapter->scsi_host->host_lock, flags); ++ __shost_for_each_device(sdev, adapter->scsi_host) { + atomic_clear_mask(common_mask, &sdev_to_zfcp(sdev)->status); + if (clear_counter) + atomic_set(&sdev_to_zfcp(sdev)->erp_counter, 0); + } ++ spin_unlock_irqrestore(adapter->scsi_host->host_lock, flags); + } + + /** +@@ -1488,16 +1497,19 @@ void zfcp_erp_set_port_status(struct zfcp_port *port, u32 mask) + { + struct scsi_device *sdev; + u32 common_mask = mask & ZFCP_COMMON_FLAGS; ++ unsigned long flags; + + atomic_set_mask(mask, &port->status); + + if (!common_mask) + return; + +- shost_for_each_device(sdev, port->adapter->scsi_host) ++ spin_lock_irqsave(port->adapter->scsi_host->host_lock, flags); ++ __shost_for_each_device(sdev, port->adapter->scsi_host) + if (sdev_to_zfcp(sdev)->port == port) + atomic_set_mask(common_mask, + &sdev_to_zfcp(sdev)->status); ++ spin_unlock_irqrestore(port->adapter->scsi_host->host_lock, flags); + } + + /** +@@ -1512,6 +1524,7 @@ void zfcp_erp_clear_port_status(struct zfcp_port *port, u32 mask) + struct scsi_device *sdev; + u32 common_mask = mask & ZFCP_COMMON_FLAGS; + u32 clear_counter = mask & ZFCP_STATUS_COMMON_ERP_FAILED; ++ unsigned long flags; + + atomic_clear_mask(mask, &port->status); + +@@ -1521,13 +1534,15 @@ void zfcp_erp_clear_port_status(struct zfcp_port *port, u32 mask) + if (clear_counter) + atomic_set(&port->erp_counter, 0); + +- shost_for_each_device(sdev, port->adapter->scsi_host) ++ spin_lock_irqsave(port->adapter->scsi_host->host_lock, flags); ++ __shost_for_each_device(sdev, port->adapter->scsi_host) + if (sdev_to_zfcp(sdev)->port == port) { + atomic_clear_mask(common_mask, + &sdev_to_zfcp(sdev)->status); + if (clear_counter) + atomic_set(&sdev_to_zfcp(sdev)->erp_counter, 0); + } ++ spin_unlock_irqrestore(port->adapter->scsi_host->host_lock, flags); + } + + /** +diff --git a/drivers/s390/scsi/zfcp_qdio.c b/drivers/s390/scsi/zfcp_qdio.c +index e76d003..52c6b59 100644 +--- a/drivers/s390/scsi/zfcp_qdio.c ++++ b/drivers/s390/scsi/zfcp_qdio.c +@@ -224,11 +224,9 @@ int zfcp_qdio_sbals_from_sg(struct zfcp_qdio *qdio, struct zfcp_qdio_req *q_req, + + static int zfcp_qdio_sbal_check(struct zfcp_qdio *qdio) + { +- spin_lock_irq(&qdio->req_q_lock); + if (atomic_read(&qdio->req_q_free) || + !(atomic_read(&qdio->adapter->status) & ZFCP_STATUS_ADAPTER_QDIOUP)) + return 1; +- spin_unlock_irq(&qdio->req_q_lock); + return 0; + } + +@@ -246,9 +244,8 @@ int zfcp_qdio_sbal_get(struct zfcp_qdio *qdio) + { + long ret; + +- spin_unlock_irq(&qdio->req_q_lock); +- ret = wait_event_interruptible_timeout(qdio->req_q_wq, +- zfcp_qdio_sbal_check(qdio), 5 * HZ); ++ ret = wait_event_interruptible_lock_irq_timeout(qdio->req_q_wq, ++ zfcp_qdio_sbal_check(qdio), qdio->req_q_lock, 5 * HZ); + + if (!(atomic_read(&qdio->adapter->status) & ZFCP_STATUS_ADAPTER_QDIOUP)) + return -EIO; +@@ -262,7 +259,6 @@ int zfcp_qdio_sbal_get(struct zfcp_qdio *qdio) + zfcp_erp_adapter_reopen(qdio->adapter, 0, "qdsbg_1"); + } + +- spin_lock_irq(&qdio->req_q_lock); + return -EIO; + } + +diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c +index fc5a2ef..b018997 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_base.c ++++ b/drivers/scsi/megaraid/megaraid_sas_base.c +@@ -3547,11 +3547,21 @@ static int megasas_init_fw(struct megasas_instance *instance) + break; + } + +- /* +- * We expect the FW state to be READY +- */ +- if (megasas_transition_to_ready(instance, 0)) +- goto fail_ready_state; ++ if (megasas_transition_to_ready(instance, 0)) { ++ atomic_set(&instance->fw_reset_no_pci_access, 1); ++ instance->instancet->adp_reset ++ (instance, instance->reg_set); ++ atomic_set(&instance->fw_reset_no_pci_access, 0); ++ dev_info(&instance->pdev->dev, ++ "megasas: FW restarted successfully from %s!\n", ++ __func__); ++ ++ /*waitting for about 30 second before retry*/ ++ ssleep(30); ++ ++ if (megasas_transition_to_ready(instance, 0)) ++ goto fail_ready_state; ++ } + + /* Check if MSI-X is supported while in ready state */ + msix_enable = (instance->instancet->read_fw_status_reg(reg_set) & +diff --git a/drivers/scsi/nsp32.c b/drivers/scsi/nsp32.c +index f6a50c9..bfb05b8 100644 +--- a/drivers/scsi/nsp32.c ++++ b/drivers/scsi/nsp32.c +@@ -2927,7 +2927,7 @@ static void nsp32_do_bus_reset(nsp32_hw_data *data) + * reset SCSI bus + */ + nsp32_write1(base, SCSI_BUS_CONTROL, BUSCTL_RST); +- udelay(RESET_HOLD_TIME); ++ mdelay(RESET_HOLD_TIME / 1000); + nsp32_write1(base, SCSI_BUS_CONTROL, 0); + for(i = 0; i < 5; i++) { + intrdat = nsp32_read2(base, IRQ_STATUS); /* dummy read */ +diff --git a/drivers/target/target_core_cdb.c b/drivers/target/target_core_cdb.c +index 717a8d4..903b2f5 100644 +--- a/drivers/target/target_core_cdb.c ++++ b/drivers/target/target_core_cdb.c +@@ -127,11 +127,12 @@ target_emulate_inquiry_std(struct se_cmd *cmd) + goto out; + } + +- snprintf((unsigned char *)&buf[8], 8, "LIO-ORG"); +- snprintf((unsigned char *)&buf[16], 16, "%s", +- &dev->se_sub_dev->t10_wwn.model[0]); +- snprintf((unsigned char *)&buf[32], 4, "%s", +- &dev->se_sub_dev->t10_wwn.revision[0]); ++ memcpy(&buf[8], "LIO-ORG ", 8); ++ memset(&buf[16], 0x20, 16); ++ memcpy(&buf[16], dev->se_sub_dev->t10_wwn.model, ++ min_t(size_t, strlen(dev->se_sub_dev->t10_wwn.model), 16)); ++ memcpy(&buf[32], dev->se_sub_dev->t10_wwn.revision, ++ min_t(size_t, strlen(dev->se_sub_dev->t10_wwn.revision), 4)); + buf[4] = 31; /* Set additional length to 31 */ + + out: +diff --git a/drivers/tty/hvc/hvsi_lib.c b/drivers/tty/hvc/hvsi_lib.c +index 6f4dd83..3749688 100644 +--- a/drivers/tty/hvc/hvsi_lib.c ++++ b/drivers/tty/hvc/hvsi_lib.c +@@ -341,8 +341,8 @@ void hvsilib_establish(struct hvsi_priv *pv) + + pr_devel("HVSI@%x: ... waiting handshake\n", pv->termno); + +- /* Try for up to 200s */ +- for (timeout = 0; timeout < 20; timeout++) { ++ /* Try for up to 400ms */ ++ for (timeout = 0; timeout < 40; timeout++) { + if (pv->established) + goto established; + if (!hvsi_get_packet(pv)) +diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c +index 5b3d063..ab7d11e 100644 +--- a/drivers/tty/serial/mxs-auart.c ++++ b/drivers/tty/serial/mxs-auart.c +@@ -374,11 +374,18 @@ static void mxs_auart_settermios(struct uart_port *u, + + static irqreturn_t mxs_auart_irq_handle(int irq, void *context) + { +- u32 istatus, istat; ++ u32 istat; + struct mxs_auart_port *s = context; + u32 stat = readl(s->port.membase + AUART_STAT); + +- istatus = istat = readl(s->port.membase + AUART_INTR); ++ istat = readl(s->port.membase + AUART_INTR); ++ ++ /* ack irq */ ++ writel(istat & (AUART_INTR_RTIS ++ | AUART_INTR_TXIS ++ | AUART_INTR_RXIS ++ | AUART_INTR_CTSMIS), ++ s->port.membase + AUART_INTR_CLR); + + if (istat & AUART_INTR_CTSMIS) { + uart_handle_cts_change(&s->port, stat & AUART_STAT_CTS); +@@ -397,12 +404,6 @@ static irqreturn_t mxs_auart_irq_handle(int irq, void *context) + istat &= ~AUART_INTR_TXIS; + } + +- writel(istatus & (AUART_INTR_RTIS +- | AUART_INTR_TXIS +- | AUART_INTR_RXIS +- | AUART_INTR_CTSMIS), +- s->port.membase + AUART_INTR_CLR); +- + return IRQ_HANDLED; + } + +@@ -542,7 +543,7 @@ auart_console_write(struct console *co, const char *str, unsigned int count) + struct mxs_auart_port *s; + struct uart_port *port; + unsigned int old_ctrl0, old_ctrl2; +- unsigned int to = 1000; ++ unsigned int to = 20000; + + if (co->index > MXS_AUART_PORTS || co->index < 0) + return; +@@ -563,18 +564,23 @@ auart_console_write(struct console *co, const char *str, unsigned int count) + + uart_console_write(port, str, count, mxs_auart_console_putchar); + +- /* +- * Finally, wait for transmitter to become empty +- * and restore the TCR +- */ ++ /* Finally, wait for transmitter to become empty ... */ + while (readl(port->membase + AUART_STAT) & AUART_STAT_BUSY) { ++ udelay(1); + if (!to--) + break; +- udelay(1); + } + +- writel(old_ctrl0, port->membase + AUART_CTRL0); +- writel(old_ctrl2, port->membase + AUART_CTRL2); ++ /* ++ * ... and restore the TCR if we waited long enough for the transmitter ++ * to be idle. This might keep the transmitter enabled although it is ++ * unused, but that is better than to disable it while it is still ++ * transmitting. ++ */ ++ if (!(readl(port->membase + AUART_STAT) & AUART_STAT_BUSY)) { ++ writel(old_ctrl0, port->membase + AUART_CTRL0); ++ writel(old_ctrl2, port->membase + AUART_CTRL2); ++ } + + clk_disable(s->clk); + } +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index 2fbcb75..f52182d 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -78,6 +78,12 @@ static const struct usb_device_id usb_quirk_list[] = { + { USB_DEVICE(0x04d8, 0x000c), .driver_info = + USB_QUIRK_CONFIG_INTF_STRINGS }, + ++ /* CarrolTouch 4000U */ ++ { USB_DEVICE(0x04e7, 0x0009), .driver_info = USB_QUIRK_RESET_RESUME }, ++ ++ /* CarrolTouch 4500U */ ++ { USB_DEVICE(0x04e7, 0x0030), .driver_info = USB_QUIRK_RESET_RESUME }, ++ + /* Samsung Android phone modem - ID conflict with SPH-I500 */ + { USB_DEVICE(0x04e8, 0x6601), .driver_info = + USB_QUIRK_CONFIG_INTF_STRINGS }, +diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c +index fe85871..db5128b7e 100644 +--- a/drivers/usb/misc/adutux.c ++++ b/drivers/usb/misc/adutux.c +@@ -829,7 +829,7 @@ static int adu_probe(struct usb_interface *interface, + + /* let the user know what node this device is now attached to */ + dev_info(&interface->dev, "ADU%d %s now attached to /dev/usb/adutux%d\n", +- udev->descriptor.idProduct, dev->serial_number, ++ le16_to_cpu(udev->descriptor.idProduct), dev->serial_number, + (dev->minor - ADU_MINOR_BASE)); + exit: + dbg(2," %s : leave, return value %p (dev)", __func__, dev); +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index ce9f87f..a3f6fe0 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -743,9 +743,34 @@ static struct usb_device_id id_table_combined [] = { + { USB_DEVICE(FTDI_VID, FTDI_NDI_AURORA_SCU_PID), + .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk }, + { USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) }, +- { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_SERIAL_VX7_PID) }, +- { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_CT29B_PID) }, +- { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_RTS01_PID) }, ++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_S03_PID) }, ++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_59_PID) }, ++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_57A_PID) }, ++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_57B_PID) }, ++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_29A_PID) }, ++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_29B_PID) }, ++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_29F_PID) }, ++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_62B_PID) }, ++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_S01_PID) }, ++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_63_PID) }, ++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_29C_PID) }, ++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_81B_PID) }, ++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_82B_PID) }, ++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_K5D_PID) }, ++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_K4Y_PID) }, ++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_K5G_PID) }, ++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_S05_PID) }, ++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_60_PID) }, ++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_61_PID) }, ++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_62_PID) }, ++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_63B_PID) }, ++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_64_PID) }, ++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_65_PID) }, ++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_92_PID) }, ++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_92D_PID) }, ++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_W5R_PID) }, ++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_A5R_PID) }, ++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_PW1_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_MAXSTREAM_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_PHI_FISCO_PID) }, + { USB_DEVICE(TML_VID, TML_USB_SERIAL_PID) }, +diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h +index 5d25e26..61685ed 100644 +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -815,11 +815,35 @@ + /* + * RT Systems programming cables for various ham radios + */ +-#define RTSYSTEMS_VID 0x2100 /* Vendor ID */ +-#define RTSYSTEMS_SERIAL_VX7_PID 0x9e52 /* Serial converter for VX-7 Radios using FT232RL */ +-#define RTSYSTEMS_CT29B_PID 0x9e54 /* CT29B Radio Cable */ +-#define RTSYSTEMS_RTS01_PID 0x9e57 /* USB-RTS01 Radio Cable */ +- ++#define RTSYSTEMS_VID 0x2100 /* Vendor ID */ ++#define RTSYSTEMS_USB_S03_PID 0x9001 /* RTS-03 USB to Serial Adapter */ ++#define RTSYSTEMS_USB_59_PID 0x9e50 /* USB-59 USB to 8 pin plug */ ++#define RTSYSTEMS_USB_57A_PID 0x9e51 /* USB-57A USB to 4pin 3.5mm plug */ ++#define RTSYSTEMS_USB_57B_PID 0x9e52 /* USB-57B USB to extended 4pin 3.5mm plug */ ++#define RTSYSTEMS_USB_29A_PID 0x9e53 /* USB-29A USB to 3.5mm stereo plug */ ++#define RTSYSTEMS_USB_29B_PID 0x9e54 /* USB-29B USB to 6 pin mini din */ ++#define RTSYSTEMS_USB_29F_PID 0x9e55 /* USB-29F USB to 6 pin modular plug */ ++#define RTSYSTEMS_USB_62B_PID 0x9e56 /* USB-62B USB to 8 pin mini din plug*/ ++#define RTSYSTEMS_USB_S01_PID 0x9e57 /* USB-RTS01 USB to 3.5 mm stereo plug*/ ++#define RTSYSTEMS_USB_63_PID 0x9e58 /* USB-63 USB to 9 pin female*/ ++#define RTSYSTEMS_USB_29C_PID 0x9e59 /* USB-29C USB to 4 pin modular plug*/ ++#define RTSYSTEMS_USB_81B_PID 0x9e5A /* USB-81 USB to 8 pin mini din plug*/ ++#define RTSYSTEMS_USB_82B_PID 0x9e5B /* USB-82 USB to 2.5 mm stereo plug*/ ++#define RTSYSTEMS_USB_K5D_PID 0x9e5C /* USB-K5D USB to 8 pin modular plug*/ ++#define RTSYSTEMS_USB_K4Y_PID 0x9e5D /* USB-K4Y USB to 2.5/3.5 mm plugs*/ ++#define RTSYSTEMS_USB_K5G_PID 0x9e5E /* USB-K5G USB to 8 pin modular plug*/ ++#define RTSYSTEMS_USB_S05_PID 0x9e5F /* USB-RTS05 USB to 2.5 mm stereo plug*/ ++#define RTSYSTEMS_USB_60_PID 0x9e60 /* USB-60 USB to 6 pin din*/ ++#define RTSYSTEMS_USB_61_PID 0x9e61 /* USB-61 USB to 6 pin mini din*/ ++#define RTSYSTEMS_USB_62_PID 0x9e62 /* USB-62 USB to 8 pin mini din*/ ++#define RTSYSTEMS_USB_63B_PID 0x9e63 /* USB-63 USB to 9 pin female*/ ++#define RTSYSTEMS_USB_64_PID 0x9e64 /* USB-64 USB to 9 pin male*/ ++#define RTSYSTEMS_USB_65_PID 0x9e65 /* USB-65 USB to 9 pin female null modem*/ ++#define RTSYSTEMS_USB_92_PID 0x9e66 /* USB-92 USB to 12 pin plug*/ ++#define RTSYSTEMS_USB_92D_PID 0x9e67 /* USB-92D USB to 12 pin plug data*/ ++#define RTSYSTEMS_USB_W5R_PID 0x9e68 /* USB-W5R USB to 8 pin modular plug*/ ++#define RTSYSTEMS_USB_A5R_PID 0x9e69 /* USB-A5R USB to 8 pin modular plug*/ ++#define RTSYSTEMS_USB_PW1_PID 0x9e6A /* USB-PW1 USB to 8 pin modular plug*/ + + /* + * Physik Instrumente +diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c +index 4f415e28..b668069 100644 +--- a/drivers/usb/serial/keyspan.c ++++ b/drivers/usb/serial/keyspan.c +@@ -2620,7 +2620,7 @@ static int keyspan_startup(struct usb_serial *serial) + if (d_details == NULL) { + dev_err(&serial->dev->dev, "%s - unknown product id %x\n", + __func__, le16_to_cpu(serial->dev->descriptor.idProduct)); +- return 1; ++ return -ENODEV; + } + + /* Setup private data for serial driver */ +diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c +index 9580679..9270d5c 100644 +--- a/drivers/usb/serial/mos7720.c ++++ b/drivers/usb/serial/mos7720.c +@@ -97,6 +97,7 @@ struct urbtracker { + struct list_head urblist_entry; + struct kref ref_count; + struct urb *urb; ++ struct usb_ctrlrequest *setup; + }; + + enum mos7715_pp_modes { +@@ -279,6 +280,7 @@ static void destroy_urbtracker(struct kref *kref) + struct mos7715_parport *mos_parport = urbtrack->mos_parport; + dbg("%s called", __func__); + usb_free_urb(urbtrack->urb); ++ kfree(urbtrack->setup); + kfree(urbtrack); + kref_put(&mos_parport->ref_count, destroy_mos_parport); + } +@@ -363,7 +365,6 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport, + struct urbtracker *urbtrack; + int ret_val; + unsigned long flags; +- struct usb_ctrlrequest setup; + struct usb_serial *serial = mos_parport->serial; + struct usb_device *usbdev = serial->dev; + dbg("%s called", __func__); +@@ -382,14 +383,20 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport, + kfree(urbtrack); + return -ENOMEM; + } +- setup.bRequestType = (__u8)0x40; +- setup.bRequest = (__u8)0x0e; +- setup.wValue = get_reg_value(reg, dummy); +- setup.wIndex = get_reg_index(reg); +- setup.wLength = 0; ++ urbtrack->setup = kmalloc(sizeof(*urbtrack->setup), GFP_KERNEL); ++ if (!urbtrack->setup) { ++ usb_free_urb(urbtrack->urb); ++ kfree(urbtrack); ++ return -ENOMEM; ++ } ++ urbtrack->setup->bRequestType = (__u8)0x40; ++ urbtrack->setup->bRequest = (__u8)0x0e; ++ urbtrack->setup->wValue = get_reg_value(reg, dummy); ++ urbtrack->setup->wIndex = get_reg_index(reg); ++ urbtrack->setup->wLength = 0; + usb_fill_control_urb(urbtrack->urb, usbdev, + usb_sndctrlpipe(usbdev, 0), +- (unsigned char *)&setup, ++ (unsigned char *)urbtrack->setup, + NULL, 0, async_complete, urbtrack); + kref_init(&urbtrack->ref_count); + INIT_LIST_HEAD(&urbtrack->urblist_entry); +diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c +index 5e8c736..5d2501e 100644 +--- a/drivers/usb/serial/mos7840.c ++++ b/drivers/usb/serial/mos7840.c +@@ -185,6 +185,10 @@ + #define URB_TRANSFER_BUFFER_SIZE 32 /* URB Size */ + + ++enum mos7840_flag { ++ MOS7840_FLAG_CTRL_BUSY, ++}; ++ + static const struct usb_device_id moschip_port_id_table[] = { + {USB_DEVICE(USB_VENDOR_ID_MOSCHIP, MOSCHIP_DEVICE_ID_7840)}, + {USB_DEVICE(USB_VENDOR_ID_MOSCHIP, MOSCHIP_DEVICE_ID_7820)}, +@@ -258,6 +262,8 @@ struct moschip_port { + struct urb *write_urb_pool[NUM_URBS]; + char busy[NUM_URBS]; + bool read_urb_busy; ++ ++ unsigned long flags; + }; + + +@@ -519,11 +525,11 @@ static void mos7840_control_callback(struct urb *urb) + /* this urb is terminated, clean up */ + dbg("%s - urb shutting down with status: %d", __func__, + status); +- return; ++ goto out; + default: + dbg("%s - nonzero urb status received: %d", __func__, + status); +- return; ++ goto out; + } + + dbg("%s urb buffer size is %d", __func__, urb->actual_length); +@@ -536,6 +542,8 @@ static void mos7840_control_callback(struct urb *urb) + mos7840_handle_new_msr(mos7840_port, regval); + else if (mos7840_port->MsrLsr == 1) + mos7840_handle_new_lsr(mos7840_port, regval); ++out: ++ clear_bit_unlock(MOS7840_FLAG_CTRL_BUSY, &mos7840_port->flags); + } + + static int mos7840_get_reg(struct moschip_port *mcs, __u16 Wval, __u16 reg, +@@ -546,6 +554,9 @@ static int mos7840_get_reg(struct moschip_port *mcs, __u16 Wval, __u16 reg, + unsigned char *buffer = mcs->ctrl_buf; + int ret; + ++ if (test_and_set_bit_lock(MOS7840_FLAG_CTRL_BUSY, &mcs->flags)) ++ return -EBUSY; ++ + dr->bRequestType = MCS_RD_RTYPE; + dr->bRequest = MCS_RDREQ; + dr->wValue = cpu_to_le16(Wval); /* 0 */ +@@ -557,6 +568,9 @@ static int mos7840_get_reg(struct moschip_port *mcs, __u16 Wval, __u16 reg, + mos7840_control_callback, mcs); + mcs->control_urb->transfer_buffer_length = 2; + ret = usb_submit_urb(mcs->control_urb, GFP_ATOMIC); ++ if (ret) ++ clear_bit_unlock(MOS7840_FLAG_CTRL_BUSY, &mcs->flags); ++ + return ret; + } + +diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c +index 42038ba..885d15d 100644 +--- a/drivers/usb/serial/ti_usb_3410_5052.c ++++ b/drivers/usb/serial/ti_usb_3410_5052.c +@@ -1713,12 +1713,13 @@ static int ti_download_firmware(struct ti_device *tdev) + + dbg("%s\n", __func__); + /* try ID specific firmware first, then try generic firmware */ +- sprintf(buf, "ti_usb-v%04x-p%04x.fw", dev->descriptor.idVendor, +- dev->descriptor.idProduct); ++ sprintf(buf, "ti_usb-v%04x-p%04x.fw", ++ le16_to_cpu(dev->descriptor.idVendor), ++ le16_to_cpu(dev->descriptor.idProduct)); + if ((status = request_firmware(&fw_p, buf, &dev->dev)) != 0) { + buf[0] = '\0'; +- if (dev->descriptor.idVendor == MTS_VENDOR_ID) { +- switch (dev->descriptor.idProduct) { ++ if (le16_to_cpu(dev->descriptor.idVendor) == MTS_VENDOR_ID) { ++ switch (le16_to_cpu(dev->descriptor.idProduct)) { + case MTS_CDMA_PRODUCT_ID: + strcpy(buf, "mts_cdma.fw"); + break; +diff --git a/drivers/xen/events.c b/drivers/xen/events.c +index 11d7b64..f6227cc 100644 +--- a/drivers/xen/events.c ++++ b/drivers/xen/events.c +@@ -316,7 +316,7 @@ static void init_evtchn_cpu_bindings(void) + + for_each_possible_cpu(i) + memset(per_cpu(cpu_evtchn_mask, i), +- (i == 0) ? ~0 : 0, sizeof(*per_cpu(cpu_evtchn_mask, i))); ++ (i == 0) ? ~0 : 0, NR_EVENT_CHANNELS/8); + } + + static inline void clear_evtchn(int port) +@@ -1340,8 +1340,10 @@ void rebind_evtchn_irq(int evtchn, int irq) + /* Rebind an evtchn so that it gets delivered to a specific cpu */ + static int rebind_irq_to_cpu(unsigned irq, unsigned tcpu) + { ++ struct shared_info *s = HYPERVISOR_shared_info; + struct evtchn_bind_vcpu bind_vcpu; + int evtchn = evtchn_from_irq(irq); ++ int masked; + + if (!VALID_EVTCHN(evtchn)) + return -1; +@@ -1358,6 +1360,12 @@ static int rebind_irq_to_cpu(unsigned irq, unsigned tcpu) + bind_vcpu.vcpu = tcpu; + + /* ++ * Mask the event while changing the VCPU binding to prevent ++ * it being delivered on an unexpected VCPU. ++ */ ++ masked = sync_test_and_set_bit(evtchn, s->evtchn_mask); ++ ++ /* + * If this fails, it usually just indicates that we're dealing with a + * virq or IPI channel, which don't actually need to be rebound. Ignore + * it, but don't do the xenlinux-level rebind in that case. +@@ -1365,6 +1373,9 @@ static int rebind_irq_to_cpu(unsigned irq, unsigned tcpu) + if (HYPERVISOR_event_channel_op(EVTCHNOP_bind_vcpu, &bind_vcpu) >= 0) + bind_evtchn_to_cpu(evtchn, tcpu); + ++ if (!masked) ++ unmask_evtchn(evtchn); ++ + return 0; + } + +diff --git a/fs/bio.c b/fs/bio.c +index 4fc4dbb..b84d851 100644 +--- a/fs/bio.c ++++ b/fs/bio.c +@@ -734,7 +734,7 @@ static int __bio_copy_iov(struct bio *bio, struct bio_vec *iovecs, + int iov_idx = 0; + unsigned int iov_off = 0; + +- __bio_for_each_segment(bvec, bio, i, 0) { ++ bio_for_each_segment_all(bvec, bio, i) { + char *bv_addr = page_address(bvec->bv_page); + unsigned int bv_len = iovecs[i].bv_len; + +@@ -787,12 +787,22 @@ static int __bio_copy_iov(struct bio *bio, struct bio_vec *iovecs, + int bio_uncopy_user(struct bio *bio) + { + struct bio_map_data *bmd = bio->bi_private; +- int ret = 0; ++ struct bio_vec *bvec; ++ int ret = 0, i; + +- if (!bio_flagged(bio, BIO_NULL_MAPPED)) +- ret = __bio_copy_iov(bio, bmd->iovecs, bmd->sgvecs, +- bmd->nr_sgvecs, bio_data_dir(bio) == READ, +- 0, bmd->is_our_pages); ++ if (!bio_flagged(bio, BIO_NULL_MAPPED)) { ++ /* ++ * if we're in a workqueue, the request is orphaned, so ++ * don't copy into a random user address space, just free. ++ */ ++ if (current->mm) ++ ret = __bio_copy_iov(bio, bmd->iovecs, bmd->sgvecs, ++ bmd->nr_sgvecs, bio_data_dir(bio) == READ, ++ 0, bmd->is_our_pages); ++ else if (bmd->is_our_pages) ++ bio_for_each_segment_all(bvec, bio, i) ++ __free_page(bvec->bv_page); ++ } + bio_free_map_data(bmd); + bio_put(bio); + return ret; +@@ -916,7 +926,7 @@ struct bio *bio_copy_user_iov(struct request_queue *q, + return bio; + cleanup: + if (!map_data) +- bio_for_each_segment(bvec, bio, i) ++ bio_for_each_segment_all(bvec, bio, i) + __free_page(bvec->bv_page); + + bio_put(bio); +@@ -1130,7 +1140,7 @@ static void __bio_unmap_user(struct bio *bio) + /* + * make sure we dirty pages we wrote to + */ +- __bio_for_each_segment(bvec, bio, i, 0) { ++ bio_for_each_segment_all(bvec, bio, i) { + if (bio_data_dir(bio) == READ) + set_page_dirty_lock(bvec->bv_page); + +@@ -1236,7 +1246,7 @@ static void bio_copy_kern_endio(struct bio *bio, int err) + int i; + char *p = bmd->sgvecs[0].iov_base; + +- __bio_for_each_segment(bvec, bio, i, 0) { ++ bio_for_each_segment_all(bvec, bio, i) { + char *addr = page_address(bvec->bv_page); + int len = bmd->iovecs[i].bv_len; + +@@ -1276,7 +1286,7 @@ struct bio *bio_copy_kern(struct request_queue *q, void *data, unsigned int len, + if (!reading) { + void *p = data; + +- bio_for_each_segment(bvec, bio, i) { ++ bio_for_each_segment_all(bvec, bio, i) { + char *addr = page_address(bvec->bv_page); + + memcpy(addr, p, bvec->bv_len); +@@ -1556,7 +1566,7 @@ sector_t bio_sector_offset(struct bio *bio, unsigned short index, + if (index >= bio->bi_idx) + index = bio->bi_vcnt - 1; + +- __bio_for_each_segment(bv, bio, i, 0) { ++ bio_for_each_segment_all(bv, bio, i) { + if (i == index) { + if (offset > bv->bv_offset) + sectors += (offset - bv->bv_offset) / sector_sz; +diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c +index cdcd665..b4675bd 100644 +--- a/fs/cifs/cifsencrypt.c ++++ b/fs/cifs/cifsencrypt.c +@@ -369,7 +369,7 @@ find_domain_name(struct cifs_ses *ses, const struct nls_table *nls_cp) + if (blobptr + attrsize > blobend) + break; + if (type == NTLMSSP_AV_NB_DOMAIN_NAME) { +- if (!attrsize) ++ if (!attrsize || attrsize >= CIFS_MAX_DOMAINNAME_LEN) + break; + if (!ses->domainName) { + ses->domainName = +diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h +index 2f3ff59..7b68088 100644 +--- a/fs/cifs/cifsglob.h ++++ b/fs/cifs/cifsglob.h +@@ -38,6 +38,7 @@ + #define MAX_TREE_SIZE (2 + MAX_SERVER_SIZE + 1 + MAX_SHARE_SIZE + 1) + #define MAX_SERVER_SIZE 15 + #define MAX_SHARE_SIZE 80 ++#define CIFS_MAX_DOMAINNAME_LEN 256 /* max domain name length */ + #define MAX_USERNAME_SIZE 256 /* reasonable maximum for current servers */ + #define MAX_PASSWORD_SIZE 512 /* max for windows seems to be 256 wide chars */ + +diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c +index 4c37ed4..52a820a 100644 +--- a/fs/cifs/readdir.c ++++ b/fs/cifs/readdir.c +@@ -96,6 +96,14 @@ cifs_readdir_lookup(struct dentry *parent, struct qstr *name, + dput(dentry); + } + ++ /* ++ * If we know that the inode will need to be revalidated immediately, ++ * then don't create a new dentry for it. We'll end up doing an on ++ * the wire call either way and this spares us an invalidation. ++ */ ++ if (fattr->cf_flags & CIFS_FATTR_NEED_REVAL) ++ return NULL; ++ + dentry = d_alloc(parent, name); + if (dentry == NULL) + return NULL; +diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c +index 2504809..d362626 100644 +--- a/fs/cifs/sess.c ++++ b/fs/cifs/sess.c +@@ -198,7 +198,7 @@ static void unicode_domain_string(char **pbcc_area, struct cifs_ses *ses, + bytes_ret = 0; + } else + bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, ses->domainName, +- 256, nls_cp); ++ CIFS_MAX_DOMAINNAME_LEN, nls_cp); + bcc_ptr += 2 * bytes_ret; + bcc_ptr += 2; /* account for null terminator */ + +@@ -256,8 +256,8 @@ static void ascii_ssetup_strings(char **pbcc_area, struct cifs_ses *ses, + + /* copy domain */ + if (ses->domainName != NULL) { +- strncpy(bcc_ptr, ses->domainName, 256); +- bcc_ptr += strnlen(ses->domainName, 256); ++ strncpy(bcc_ptr, ses->domainName, CIFS_MAX_DOMAINNAME_LEN); ++ bcc_ptr += strnlen(ses->domainName, CIFS_MAX_DOMAINNAME_LEN); + } /* else we will send a null domain name + so the server will default to its own domain */ + *bcc_ptr = 0; +diff --git a/fs/exofs/ore.c b/fs/exofs/ore.c +index 1585db1..26bb512 100644 +--- a/fs/exofs/ore.c ++++ b/fs/exofs/ore.c +@@ -401,7 +401,7 @@ static void _clear_bio(struct bio *bio) + struct bio_vec *bv; + unsigned i; + +- __bio_for_each_segment(bv, bio, i, 0) { ++ bio_for_each_segment_all(bv, bio, i) { + unsigned this_count = bv->bv_len; + + if (likely(PAGE_SIZE == this_count)) +diff --git a/fs/exofs/ore_raid.c b/fs/exofs/ore_raid.c +index fff2070..2c64826 100644 +--- a/fs/exofs/ore_raid.c ++++ b/fs/exofs/ore_raid.c +@@ -432,7 +432,7 @@ static void _mark_read4write_pages_uptodate(struct ore_io_state *ios, int ret) + if (!bio) + continue; + +- __bio_for_each_segment(bv, bio, i, 0) { ++ bio_for_each_segment_all(bv, bio, i) { + struct page *page = bv->bv_page; + + SetPageUptodate(page); +diff --git a/fs/ext4/ext4_jbd2.c b/fs/ext4/ext4_jbd2.c +index aca1790..d0b8f98 100644 +--- a/fs/ext4/ext4_jbd2.c ++++ b/fs/ext4/ext4_jbd2.c +@@ -109,10 +109,10 @@ int __ext4_handle_dirty_metadata(const char *where, unsigned int line, + + if (ext4_handle_valid(handle)) { + err = jbd2_journal_dirty_metadata(handle, bh); +- if (err) { +- /* Errors can only happen if there is a bug */ +- handle->h_err = err; +- __ext4_journal_stop(where, line, handle); ++ /* Errors can only happen if there is a bug */ ++ if (WARN_ON_ONCE(err)) { ++ ext4_journal_abort_handle(where, line, __func__, bh, ++ handle, err); + } + } else { + if (inode) +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 259e950..84f84bf 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -3372,7 +3372,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + } + if (test_opt(sb, DIOREAD_NOLOCK)) { + ext4_msg(sb, KERN_ERR, "can't mount with " +- "both data=journal and delalloc"); ++ "both data=journal and dioread_nolock"); + goto failed_mount; + } + if (test_opt(sb, DELALLOC)) +@@ -4539,6 +4539,21 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) + goto restore_opts; + } + ++ if (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA) { ++ if (test_opt2(sb, EXPLICIT_DELALLOC)) { ++ ext4_msg(sb, KERN_ERR, "can't mount with " ++ "both data=journal and delalloc"); ++ err = -EINVAL; ++ goto restore_opts; ++ } ++ if (test_opt(sb, DIOREAD_NOLOCK)) { ++ ext4_msg(sb, KERN_ERR, "can't mount with " ++ "both data=journal and dioread_nolock"); ++ err = -EINVAL; ++ goto restore_opts; ++ } ++ } ++ + if (sbi->s_mount_flags & EXT4_MF_FS_ABORTED) + ext4_abort(sb, "Abort forced by user"); + +diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c +index 9197a1b..9f7c758 100644 +--- a/fs/jfs/jfs_dtree.c ++++ b/fs/jfs/jfs_dtree.c +@@ -3047,6 +3047,14 @@ int jfs_readdir(struct file *filp, void *dirent, filldir_t filldir) + + dir_index = (u32) filp->f_pos; + ++ /* ++ * NFSv4 reserves cookies 1 and 2 for . and .. so the value ++ * we return to the vfs is one greater than the one we use ++ * internally. ++ */ ++ if (dir_index) ++ dir_index--; ++ + if (dir_index > 1) { + struct dir_table_slot dirtab_slot; + +@@ -3086,7 +3094,7 @@ int jfs_readdir(struct file *filp, void *dirent, filldir_t filldir) + if (p->header.flag & BT_INTERNAL) { + jfs_err("jfs_readdir: bad index table"); + DT_PUTPAGE(mp); +- filp->f_pos = -1; ++ filp->f_pos = DIREND; + return 0; + } + } else { +@@ -3094,7 +3102,7 @@ int jfs_readdir(struct file *filp, void *dirent, filldir_t filldir) + /* + * self "." + */ +- filp->f_pos = 0; ++ filp->f_pos = 1; + if (filldir(dirent, ".", 1, 0, ip->i_ino, + DT_DIR)) + return 0; +@@ -3102,7 +3110,7 @@ int jfs_readdir(struct file *filp, void *dirent, filldir_t filldir) + /* + * parent ".." + */ +- filp->f_pos = 1; ++ filp->f_pos = 2; + if (filldir(dirent, "..", 2, 1, PARENT(ip), DT_DIR)) + return 0; + +@@ -3123,24 +3131,25 @@ int jfs_readdir(struct file *filp, void *dirent, filldir_t filldir) + /* + * Legacy filesystem - OS/2 & Linux JFS < 0.3.6 + * +- * pn = index = 0: First entry "." +- * pn = 0; index = 1: Second entry ".." ++ * pn = 0; index = 1: First entry "." ++ * pn = 0; index = 2: Second entry ".." + * pn > 0: Real entries, pn=1 -> leftmost page + * pn = index = -1: No more entries + */ + dtpos = filp->f_pos; +- if (dtpos == 0) { ++ if (dtpos < 2) { + /* build "." entry */ + ++ filp->f_pos = 1; + if (filldir(dirent, ".", 1, filp->f_pos, ip->i_ino, + DT_DIR)) + return 0; +- dtoffset->index = 1; ++ dtoffset->index = 2; + filp->f_pos = dtpos; + } + + if (dtoffset->pn == 0) { +- if (dtoffset->index == 1) { ++ if (dtoffset->index == 2) { + /* build ".." entry */ + + if (filldir(dirent, "..", 2, filp->f_pos, +@@ -3233,6 +3242,12 @@ int jfs_readdir(struct file *filp, void *dirent, filldir_t filldir) + } + jfs_dirent->position = unique_pos++; + } ++ /* ++ * We add 1 to the index because we may ++ * use a value of 2 internally, and NFSv4 ++ * doesn't like that. ++ */ ++ jfs_dirent->position++; + } else { + jfs_dirent->position = dtpos; + len = min(d_namleft, DTLHDRDATALEN_LEGACY); +diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c +index 168cb93..3fde055 100644 +--- a/fs/nfs/callback_xdr.c ++++ b/fs/nfs/callback_xdr.c +@@ -451,9 +451,9 @@ static __be32 decode_cb_sequence_args(struct svc_rqst *rqstp, + args->csa_nrclists = ntohl(*p++); + args->csa_rclists = NULL; + if (args->csa_nrclists) { +- args->csa_rclists = kmalloc(args->csa_nrclists * +- sizeof(*args->csa_rclists), +- GFP_KERNEL); ++ args->csa_rclists = kmalloc_array(args->csa_nrclists, ++ sizeof(*args->csa_rclists), ++ GFP_KERNEL); + if (unlikely(args->csa_rclists == NULL)) + goto out; + +diff --git a/fs/nilfs2/segbuf.c b/fs/nilfs2/segbuf.c +index 850a7c0..07a666a 100644 +--- a/fs/nilfs2/segbuf.c ++++ b/fs/nilfs2/segbuf.c +@@ -345,8 +345,7 @@ static void nilfs_end_bio_write(struct bio *bio, int err) + + if (err == -EOPNOTSUPP) { + set_bit(BIO_EOPNOTSUPP, &bio->bi_flags); +- bio_put(bio); +- /* to be detected by submit_seg_bio() */ ++ /* to be detected by nilfs_segbuf_submit_bio() */ + } + + if (!uptodate) +@@ -377,12 +376,12 @@ static int nilfs_segbuf_submit_bio(struct nilfs_segment_buffer *segbuf, + bio->bi_private = segbuf; + bio_get(bio); + submit_bio(mode, bio); ++ segbuf->sb_nbio++; + if (bio_flagged(bio, BIO_EOPNOTSUPP)) { + bio_put(bio); + err = -EOPNOTSUPP; + goto failed; + } +- segbuf->sb_nbio++; + bio_put(bio); + + wi->bio = NULL; +diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c +index 3efa725..ef1740d 100644 +--- a/fs/proc/task_mmu.c ++++ b/fs/proc/task_mmu.c +@@ -604,7 +604,7 @@ const struct file_operations proc_clear_refs_operations = { + }; + + struct pagemapread { +- int pos, len; ++ int pos, len; /* units: PM_ENTRY_BYTES, not bytes */ + u64 *buffer; + }; + +@@ -792,8 +792,8 @@ static ssize_t pagemap_read(struct file *file, char __user *buf, + if (!count) + goto out_task; + +- pm.len = PM_ENTRY_BYTES * (PAGEMAP_WALK_SIZE >> PAGE_SHIFT); +- pm.buffer = kmalloc(pm.len, GFP_TEMPORARY); ++ pm.len = (PAGEMAP_WALK_SIZE >> PAGE_SHIFT); ++ pm.buffer = kmalloc(pm.len * PM_ENTRY_BYTES, GFP_TEMPORARY); + ret = -ENOMEM; + if (!pm.buffer) + goto out_task; +diff --git a/include/linux/bio.h b/include/linux/bio.h +index 847994a..e868554 100644 +--- a/include/linux/bio.h ++++ b/include/linux/bio.h +@@ -135,16 +135,27 @@ static inline int bio_has_allocated_vec(struct bio *bio) + #define bio_io_error(bio) bio_endio((bio), -EIO) + + /* +- * drivers should not use the __ version unless they _really_ want to +- * run through the entire bio and not just pending pieces ++ * drivers should not use the __ version unless they _really_ know what ++ * they're doing + */ + #define __bio_for_each_segment(bvl, bio, i, start_idx) \ + for (bvl = bio_iovec_idx((bio), (start_idx)), i = (start_idx); \ + i < (bio)->bi_vcnt; \ + bvl++, i++) + ++/* ++ * drivers should _never_ use the all version - the bio may have been split ++ * before it got to the driver and the driver won't own all of it ++ */ ++#define bio_for_each_segment_all(bvl, bio, i) \ ++ for (i = 0; \ ++ bvl = bio_iovec_idx((bio), (i)), i < (bio)->bi_vcnt; \ ++ i++) ++ + #define bio_for_each_segment(bvl, bio, i) \ +- __bio_for_each_segment(bvl, bio, i, (bio)->bi_idx) ++ for (i = (bio)->bi_idx; \ ++ bvl = bio_iovec_idx((bio), (i)), i < (bio)->bi_vcnt; \ ++ i++) + + /* + * get a reference to a bio, so it won't disappear. the intended use is +diff --git a/include/linux/ftrace_event.h b/include/linux/ftrace_event.h +index c3da42d..82924bf 100644 +--- a/include/linux/ftrace_event.h ++++ b/include/linux/ftrace_event.h +@@ -71,6 +71,8 @@ struct trace_iterator { + /* trace_seq for __print_flags() and __print_symbolic() etc. */ + struct trace_seq tmp_seq; + ++ cpumask_var_t started; ++ + /* The below is zeroed out in pipe_read */ + struct trace_seq seq; + struct trace_entry *ent; +@@ -83,7 +85,7 @@ struct trace_iterator { + loff_t pos; + long idx; + +- cpumask_var_t started; ++ /* All new field here will be zeroed out in pipe_read */ + }; + + +diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h +index 5b42f1b..de3a321 100644 +--- a/include/linux/mm_types.h ++++ b/include/linux/mm_types.h +@@ -297,6 +297,7 @@ struct mm_struct { + void (*unmap_area) (struct mm_struct *mm, unsigned long addr); + #endif + unsigned long mmap_base; /* base of mmap area */ ++ unsigned long mmap_legacy_base; /* base of mmap area in bottom-up allocations */ + unsigned long task_size; /* size of task vm space */ + unsigned long cached_hole_size; /* if non-zero, the largest hole below free_area_cache */ + unsigned long free_area_cache; /* first hole of size cached_hole_size or larger */ +diff --git a/include/linux/slab.h b/include/linux/slab.h +index 573c809..a595dce 100644 +--- a/include/linux/slab.h ++++ b/include/linux/slab.h +@@ -190,7 +190,7 @@ size_t ksize(const void *); + #endif + + /** +- * kcalloc - allocate memory for an array. The memory is set to zero. ++ * kmalloc_array - allocate memory for an array. + * @n: number of elements. + * @size: element size. + * @flags: the type of memory to allocate. +@@ -240,11 +240,22 @@ size_t ksize(const void *); + * for general use, and so are not documented here. For a full list of + * potential flags, always refer to linux/gfp.h. + */ +-static inline void *kcalloc(size_t n, size_t size, gfp_t flags) ++static inline void *kmalloc_array(size_t n, size_t size, gfp_t flags) + { + if (size != 0 && n > ULONG_MAX / size) + return NULL; +- return __kmalloc(n * size, flags | __GFP_ZERO); ++ return __kmalloc(n * size, flags); ++} ++ ++/** ++ * kcalloc - allocate memory for an array. The memory is set to zero. ++ * @n: number of elements. ++ * @size: element size. ++ * @flags: the type of memory to allocate (see kmalloc). ++ */ ++static inline void *kcalloc(size_t n, size_t size, gfp_t flags) ++{ ++ return kmalloc_array(n, size, flags | __GFP_ZERO); + } + + #if !defined(CONFIG_NUMA) && !defined(CONFIG_SLOB) +diff --git a/include/linux/wait.h b/include/linux/wait.h +index bea7ad5..e007f76 100644 +--- a/include/linux/wait.h ++++ b/include/linux/wait.h +@@ -530,6 +530,63 @@ do { \ + ? 0 : __wait_event_interruptible_locked(wq, condition, 1, 1)) + + ++#define __wait_event_interruptible_lock_irq_timeout(wq, condition, \ ++ lock, ret) \ ++do { \ ++ DEFINE_WAIT(__wait); \ ++ \ ++ for (;;) { \ ++ prepare_to_wait(&wq, &__wait, TASK_INTERRUPTIBLE); \ ++ if (condition) \ ++ break; \ ++ if (signal_pending(current)) { \ ++ ret = -ERESTARTSYS; \ ++ break; \ ++ } \ ++ spin_unlock_irq(&lock); \ ++ ret = schedule_timeout(ret); \ ++ spin_lock_irq(&lock); \ ++ if (!ret) \ ++ break; \ ++ } \ ++ finish_wait(&wq, &__wait); \ ++} while (0) ++ ++/** ++ * wait_event_interruptible_lock_irq_timeout - sleep until a condition gets true or a timeout elapses. ++ * The condition is checked under the lock. This is expected ++ * to be called with the lock taken. ++ * @wq: the waitqueue to wait on ++ * @condition: a C expression for the event to wait for ++ * @lock: a locked spinlock_t, which will be released before schedule() ++ * and reacquired afterwards. ++ * @timeout: timeout, in jiffies ++ * ++ * The process is put to sleep (TASK_INTERRUPTIBLE) until the ++ * @condition evaluates to true or signal is received. The @condition is ++ * checked each time the waitqueue @wq is woken up. ++ * ++ * wake_up() has to be called after changing any variable that could ++ * change the result of the wait condition. ++ * ++ * This is supposed to be called while holding the lock. The lock is ++ * dropped before going to sleep and is reacquired afterwards. ++ * ++ * The function returns 0 if the @timeout elapsed, -ERESTARTSYS if it ++ * was interrupted by a signal, and the remaining jiffies otherwise ++ * if the condition evaluated to true before the timeout elapsed. ++ */ ++#define wait_event_interruptible_lock_irq_timeout(wq, condition, lock, \ ++ timeout) \ ++({ \ ++ int __ret = timeout; \ ++ \ ++ if (!(condition)) \ ++ __wait_event_interruptible_lock_irq_timeout( \ ++ wq, condition, lock, __ret); \ ++ __ret; \ ++}) ++ + + #define __wait_event_killable(wq, condition, ret) \ + do { \ +diff --git a/kernel/events/core.c b/kernel/events/core.c +index 8be9b746..5bbe443 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -900,6 +900,15 @@ list_add_event(struct perf_event *event, struct perf_event_context *ctx) + } + + /* ++ * Initialize event state based on the perf_event_attr::disabled. ++ */ ++static inline void perf_event__state_init(struct perf_event *event) ++{ ++ event->state = event->attr.disabled ? PERF_EVENT_STATE_OFF : ++ PERF_EVENT_STATE_INACTIVE; ++} ++ ++/* + * Called at perf_event creation and when events are attached/detached from a + * group. + */ +@@ -6050,8 +6059,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu, + event->overflow_handler = overflow_handler; + event->overflow_handler_context = context; + +- if (attr->disabled) +- event->state = PERF_EVENT_STATE_OFF; ++ perf_event__state_init(event); + + pmu = NULL; + +@@ -6433,9 +6441,17 @@ SYSCALL_DEFINE5(perf_event_open, + + mutex_lock(&gctx->mutex); + perf_remove_from_context(group_leader); ++ ++ /* ++ * Removing from the context ends up with disabled ++ * event. What we want here is event in the initial ++ * startup state, ready to be add into new context. ++ */ ++ perf_event__state_init(group_leader); + list_for_each_entry(sibling, &group_leader->sibling_list, + group_entry) { + perf_remove_from_context(sibling); ++ perf_event__state_init(sibling); + put_ctx(gctx); + } + mutex_unlock(&gctx->mutex); +diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c +index 66e4576..59474c5 100644 +--- a/kernel/sched_fair.c ++++ b/kernel/sched_fair.c +@@ -5033,7 +5033,7 @@ static unsigned int get_rr_interval_fair(struct rq *rq, struct task_struct *task + * idle runqueue: + */ + if (rq->cfs.load.weight) +- rr_interval = NS_TO_JIFFIES(sched_slice(&rq->cfs, se)); ++ rr_interval = NS_TO_JIFFIES(sched_slice(cfs_rq_of(se), se)); + + return rr_interval; + } +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index a584ad9..ce1067f 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -3375,6 +3375,7 @@ waitagain: + memset(&iter->seq, 0, + sizeof(struct trace_iterator) - + offsetof(struct trace_iterator, seq)); ++ cpumask_clear(iter->started); + iter->pos = -1; + + trace_event_read_lock(); +diff --git a/kernel/workqueue.c b/kernel/workqueue.c +index 0ad2420..0bc9ff0 100644 +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -1920,6 +1920,15 @@ __acquires(&gcwq->lock) + dump_stack(); + } + ++ /* ++ * The following prevents a kworker from hogging CPU on !PREEMPT ++ * kernels, where a requeueing work item waiting for something to ++ * happen could deadlock with stop_machine as such work item could ++ * indefinitely requeue itself while all other CPUs are trapped in ++ * stop_machine. ++ */ ++ cond_resched(); ++ + spin_lock_irq(&gcwq->lock); + + /* clear cpu intensive status */ +diff --git a/mm/bounce.c b/mm/bounce.c +index 4e9ae72..f71a3b34 100644 +--- a/mm/bounce.c ++++ b/mm/bounce.c +@@ -132,7 +132,7 @@ static void bounce_end_io(struct bio *bio, mempool_t *pool, int err) + /* + * free up bounce indirect pages used + */ +- __bio_for_each_segment(bvec, bio, i, 0) { ++ bio_for_each_segment_all(bvec, bio, i) { + org_vec = bio_orig->bi_io_vec + i; + if (bvec->bv_page == org_vec->bv_page) + continue; +diff --git a/mm/nommu.c b/mm/nommu.c +index f0cd7ab..1db7971 100644 +--- a/mm/nommu.c ++++ b/mm/nommu.c +@@ -1825,6 +1825,16 @@ int remap_pfn_range(struct vm_area_struct *vma, unsigned long addr, + } + EXPORT_SYMBOL(remap_pfn_range); + ++int vm_iomap_memory(struct vm_area_struct *vma, phys_addr_t start, unsigned long len) ++{ ++ unsigned long pfn = start >> PAGE_SHIFT; ++ unsigned long vm_len = vma->vm_end - vma->vm_start; ++ ++ pfn += vma->vm_pgoff; ++ return io_remap_pfn_range(vma, vma->vm_start, pfn, vm_len, vma->vm_page_prot); ++} ++EXPORT_SYMBOL(vm_iomap_memory); ++ + int remap_vmalloc_range(struct vm_area_struct *vma, void *addr, + unsigned long pgoff) + { +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index 5c028e2..b5afea2 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -5777,6 +5777,10 @@ __offline_isolated_pages(unsigned long start_pfn, unsigned long end_pfn) + zone->free_area[order].nr_free--; + __mod_zone_page_state(zone, NR_FREE_PAGES, + - (1UL << order)); ++#ifdef CONFIG_HIGHMEM ++ if (PageHighMem(page)) ++ totalhigh_pages -= 1 << order; ++#endif + for (i = 0; i < (1 << order); i++) + SetPageReserved((page+i)); + pfn += (1 << order); +diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c +index 5485077..739b073 100644 +--- a/net/ipv4/sysctl_net_ipv4.c ++++ b/net/ipv4/sysctl_net_ipv4.c +@@ -32,6 +32,8 @@ static int tcp_adv_win_scale_min = -31; + static int tcp_adv_win_scale_max = 31; + static int ip_ttl_min = 1; + static int ip_ttl_max = 255; ++static int tcp_syn_retries_min = 1; ++static int tcp_syn_retries_max = MAX_TCP_SYNCNT; + static int ip_ping_group_range_min[] = { 0, 0 }; + static int ip_ping_group_range_max[] = { GID_T_MAX, GID_T_MAX }; + +@@ -231,7 +233,9 @@ static struct ctl_table ipv4_table[] = { + .data = &sysctl_tcp_syn_retries, + .maxlen = sizeof(int), + .mode = 0644, +- .proc_handler = proc_dointvec ++ .proc_handler = proc_dointvec_minmax, ++ .extra1 = &tcp_syn_retries_min, ++ .extra2 = &tcp_syn_retries_max + }, + { + .procname = "tcp_synack_retries", +diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c +index 449a918..f5af259 100644 +--- a/net/ipv6/ip6mr.c ++++ b/net/ipv6/ip6mr.c +@@ -257,10 +257,12 @@ static void __net_exit ip6mr_rules_exit(struct net *net) + { + struct mr6_table *mrt, *next; + ++ rtnl_lock(); + list_for_each_entry_safe(mrt, next, &net->ipv6.mr6_tables, list) { + list_del(&mrt->list); + ip6mr_free_table(mrt); + } ++ rtnl_unlock(); + fib_rules_unregister(net->ipv6.mr6_rules_ops); + } + #else +@@ -287,7 +289,10 @@ static int __net_init ip6mr_rules_init(struct net *net) + + static void __net_exit ip6mr_rules_exit(struct net *net) + { ++ rtnl_lock(); + ip6mr_free_table(net->ipv6.mrt6); ++ net->ipv6.mrt6 = NULL; ++ rtnl_unlock(); + } + #endif + +diff --git a/net/key/af_key.c b/net/key/af_key.c +index 6fefdfc..8dbdb8e 100644 +--- a/net/key/af_key.c ++++ b/net/key/af_key.c +@@ -2073,6 +2073,7 @@ static int pfkey_xfrm_policy2msg(struct sk_buff *skb, const struct xfrm_policy * + pol->sadb_x_policy_type = IPSEC_POLICY_NONE; + } + pol->sadb_x_policy_dir = dir+1; ++ pol->sadb_x_policy_reserved = 0; + pol->sadb_x_policy_id = xp->index; + pol->sadb_x_policy_priority = xp->priority; + +@@ -2686,6 +2687,7 @@ static int key_notify_policy_flush(const struct km_event *c) + hdr->sadb_msg_pid = c->pid; + hdr->sadb_msg_version = PF_KEY_V2; + hdr->sadb_msg_errno = (uint8_t) 0; ++ hdr->sadb_msg_satype = SADB_SATYPE_UNSPEC; + hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t)); + hdr->sadb_msg_reserved = 0; + pfkey_broadcast(skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net); +@@ -3108,7 +3110,9 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct + pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY; + pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC; + pol->sadb_x_policy_dir = dir+1; ++ pol->sadb_x_policy_reserved = 0; + pol->sadb_x_policy_id = xp->index; ++ pol->sadb_x_policy_priority = xp->priority; + + /* Set sadb_comb's. */ + if (x->id.proto == IPPROTO_AH) +@@ -3496,6 +3500,7 @@ static int pfkey_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, + pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY; + pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC; + pol->sadb_x_policy_dir = dir + 1; ++ pol->sadb_x_policy_reserved = 0; + pol->sadb_x_policy_id = 0; + pol->sadb_x_policy_priority = 0; + +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index cd6cbdb..7d882fc 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -821,8 +821,14 @@ ieee80211_rx_h_check(struct ieee80211_rx_data *rx) + struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; + struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); + +- /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */ +- if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) { ++ /* ++ * Drop duplicate 802.11 retransmissions ++ * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery") ++ */ ++ if (rx->skb->len >= 24 && rx->sta && ++ !ieee80211_is_ctl(hdr->frame_control) && ++ !ieee80211_is_qos_nullfunc(hdr->frame_control) && ++ !is_multicast_ether_addr(hdr->addr1)) { + if (unlikely(ieee80211_has_retry(hdr->frame_control) && + rx->sta->last_seq_ctrl[rx->seqno_idx] == + hdr->seq_ctrl)) { +diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c +index e25e490..6e38ef0 100644 +--- a/net/sched/sch_atm.c ++++ b/net/sched/sch_atm.c +@@ -606,6 +606,7 @@ static int atm_tc_dump_class(struct Qdisc *sch, unsigned long cl, + struct sockaddr_atmpvc pvc; + int state; + ++ memset(&pvc, 0, sizeof(pvc)); + pvc.sap_family = AF_ATMPVC; + pvc.sap_addr.itf = flow->vcc->dev ? flow->vcc->dev->number : -1; + pvc.sap_addr.vpi = flow->vcc->vpi; +diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c +index b7cddb9..7f59944 100644 +--- a/net/sched/sch_cbq.c ++++ b/net/sched/sch_cbq.c +@@ -1467,6 +1467,7 @@ static int cbq_dump_wrr(struct sk_buff *skb, struct cbq_class *cl) + unsigned char *b = skb_tail_pointer(skb); + struct tc_cbq_wrropt opt; + ++ memset(&opt, 0, sizeof(opt)); + opt.flags = 0; + opt.allot = cl->allot; + opt.priority = cl->priority + 1; +diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c +index 96eb168..3dd7207 100644 +--- a/net/sctp/outqueue.c ++++ b/net/sctp/outqueue.c +@@ -205,6 +205,8 @@ static inline int sctp_cacc_skip(struct sctp_transport *primary, + */ + void sctp_outq_init(struct sctp_association *asoc, struct sctp_outq *q) + { ++ memset(q, 0, sizeof(struct sctp_outq)); ++ + q->asoc = asoc; + INIT_LIST_HEAD(&q->out_chunk_list); + INIT_LIST_HEAD(&q->control_chunk_list); +@@ -212,13 +214,7 @@ void sctp_outq_init(struct sctp_association *asoc, struct sctp_outq *q) + INIT_LIST_HEAD(&q->sacked); + INIT_LIST_HEAD(&q->abandoned); + +- q->fast_rtx = 0; +- q->outstanding_bytes = 0; + q->empty = 1; +- q->cork = 0; +- +- q->malloced = 0; +- q->out_qlen = 0; + } + + /* Free the outqueue structure and any related pending chunks. +diff --git a/net/sunrpc/auth_gss/gss_krb5_wrap.c b/net/sunrpc/auth_gss/gss_krb5_wrap.c +index 2763e3e..38f388c 100644 +--- a/net/sunrpc/auth_gss/gss_krb5_wrap.c ++++ b/net/sunrpc/auth_gss/gss_krb5_wrap.c +@@ -82,9 +82,9 @@ gss_krb5_remove_padding(struct xdr_buf *buf, int blocksize) + >>PAGE_CACHE_SHIFT; + unsigned int offset = (buf->page_base + len - 1) + & (PAGE_CACHE_SIZE - 1); +- ptr = kmap_atomic(buf->pages[last], KM_USER0); ++ ptr = kmap_atomic(buf->pages[last]); + pad = *(ptr + offset); +- kunmap_atomic(ptr, KM_USER0); ++ kunmap_atomic(ptr); + goto out; + } else + len -= buf->page_len; +diff --git a/net/sunrpc/socklib.c b/net/sunrpc/socklib.c +index 145e6784..0a648c5 100644 +--- a/net/sunrpc/socklib.c ++++ b/net/sunrpc/socklib.c +@@ -114,7 +114,7 @@ ssize_t xdr_partial_copy_from_skb(struct xdr_buf *xdr, unsigned int base, struct + } + + len = PAGE_CACHE_SIZE; +- kaddr = kmap_atomic(*ppage, KM_SKB_SUNRPC_DATA); ++ kaddr = kmap_atomic(*ppage); + if (base) { + len -= base; + if (pglen < len) +@@ -127,7 +127,7 @@ ssize_t xdr_partial_copy_from_skb(struct xdr_buf *xdr, unsigned int base, struct + ret = copy_actor(desc, kaddr, len); + } + flush_dcache_page(*ppage); +- kunmap_atomic(kaddr, KM_SKB_SUNRPC_DATA); ++ kunmap_atomic(kaddr); + copied += ret; + if (ret != len || !desc->count) + goto out; +diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c +index 593f4c6..6997cdd 100644 +--- a/net/sunrpc/xdr.c ++++ b/net/sunrpc/xdr.c +@@ -122,9 +122,9 @@ xdr_terminate_string(struct xdr_buf *buf, const u32 len) + { + char *kaddr; + +- kaddr = kmap_atomic(buf->pages[0], KM_USER0); ++ kaddr = kmap_atomic(buf->pages[0]); + kaddr[buf->page_base + len] = '\0'; +- kunmap_atomic(kaddr, KM_USER0); ++ kunmap_atomic(kaddr); + } + EXPORT_SYMBOL_GPL(xdr_terminate_string); + +@@ -232,12 +232,15 @@ _shift_data_right_pages(struct page **pages, size_t pgto_base, + pgto_base -= copy; + pgfrom_base -= copy; + +- vto = kmap_atomic(*pgto, KM_USER0); +- vfrom = kmap_atomic(*pgfrom, KM_USER1); +- memmove(vto + pgto_base, vfrom + pgfrom_base, copy); ++ vto = kmap_atomic(*pgto); ++ if (*pgto != *pgfrom) { ++ vfrom = kmap_atomic(*pgfrom); ++ memcpy(vto + pgto_base, vfrom + pgfrom_base, copy); ++ kunmap_atomic(vfrom); ++ } else ++ memmove(vto + pgto_base, vto + pgfrom_base, copy); + flush_dcache_page(*pgto); +- kunmap_atomic(vfrom, KM_USER1); +- kunmap_atomic(vto, KM_USER0); ++ kunmap_atomic(vto); + + } while ((len -= copy) != 0); + } +@@ -267,9 +270,9 @@ _copy_to_pages(struct page **pages, size_t pgbase, const char *p, size_t len) + if (copy > len) + copy = len; + +- vto = kmap_atomic(*pgto, KM_USER0); ++ vto = kmap_atomic(*pgto); + memcpy(vto + pgbase, p, copy); +- kunmap_atomic(vto, KM_USER0); ++ kunmap_atomic(vto); + + len -= copy; + if (len == 0) +@@ -311,9 +314,9 @@ _copy_from_pages(char *p, struct page **pages, size_t pgbase, size_t len) + if (copy > len) + copy = len; + +- vfrom = kmap_atomic(*pgfrom, KM_USER0); ++ vfrom = kmap_atomic(*pgfrom); + memcpy(p, vfrom + pgbase, copy); +- kunmap_atomic(vfrom, KM_USER0); ++ kunmap_atomic(vfrom); + + pgbase += copy; + if (pgbase == PAGE_CACHE_SIZE) { +diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c +index 554d081..1776e57 100644 +--- a/net/sunrpc/xprtrdma/rpc_rdma.c ++++ b/net/sunrpc/xprtrdma/rpc_rdma.c +@@ -338,9 +338,9 @@ rpcrdma_inline_pullup(struct rpc_rqst *rqst, int pad) + curlen = copy_len; + dprintk("RPC: %s: page %d destp 0x%p len %d curlen %d\n", + __func__, i, destp, copy_len, curlen); +- srcp = kmap_atomic(ppages[i], KM_SKB_SUNRPC_DATA); ++ srcp = kmap_atomic(ppages[i]); + memcpy(destp, srcp+page_base, curlen); +- kunmap_atomic(srcp, KM_SKB_SUNRPC_DATA); ++ kunmap_atomic(srcp); + rqst->rq_svec[0].iov_len += curlen; + destp += curlen; + copy_len -= curlen; +@@ -639,10 +639,10 @@ rpcrdma_inline_fixup(struct rpc_rqst *rqst, char *srcp, int copy_len, int pad) + dprintk("RPC: %s: page %d" + " srcp 0x%p len %d curlen %d\n", + __func__, i, srcp, copy_len, curlen); +- destp = kmap_atomic(ppages[i], KM_SKB_SUNRPC_DATA); ++ destp = kmap_atomic(ppages[i]); + memcpy(destp + page_base, srcp, curlen); + flush_dcache_page(ppages[i]); +- kunmap_atomic(destp, KM_SKB_SUNRPC_DATA); ++ kunmap_atomic(destp); + srcp += curlen; + copy_len -= curlen; + if (copy_len == 0) +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index c06c365..6d4d263 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -4826,12 +4826,14 @@ EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb); + + void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp) + { ++ struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0]; + void *hdr = ((void **)skb->cb)[1]; + struct nlattr *data = ((void **)skb->cb)[2]; + + nla_nest_end(skb, data); + genlmsg_end(skb, hdr); +- genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp); ++ genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), skb, 0, ++ nl80211_testmode_mcgrp.id, gfp); + } + EXPORT_SYMBOL(cfg80211_testmode_event); + #endif +@@ -7282,7 +7284,8 @@ void nl80211_send_mgmt_tx_status(struct cfg80211_registered_device *rdev, + return; + } + +- genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp); ++ genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0, ++ nl80211_mlme_mcgrp.id, gfp); + return; + + nla_put_failure: +diff --git a/sound/i2c/other/ak4xxx-adda.c b/sound/i2c/other/ak4xxx-adda.c +index cef813d..ed726d1 100644 +--- a/sound/i2c/other/ak4xxx-adda.c ++++ b/sound/i2c/other/ak4xxx-adda.c +@@ -571,7 +571,7 @@ static int ak4xxx_capture_source_info(struct snd_kcontrol *kcontrol, + struct snd_akm4xxx *ak = snd_kcontrol_chip(kcontrol); + int mixer_ch = AK_GET_SHIFT(kcontrol->private_value); + const char **input_names; +- int num_names, idx; ++ unsigned int num_names, idx; + + num_names = ak4xxx_capture_num_inputs(ak, mixer_ch); + if (!num_names) +diff --git a/sound/isa/opti9xx/opti92x-ad1848.c b/sound/isa/opti9xx/opti92x-ad1848.c +index 97871be..cba84ef 100644 +--- a/sound/isa/opti9xx/opti92x-ad1848.c ++++ b/sound/isa/opti9xx/opti92x-ad1848.c +@@ -173,11 +173,7 @@ MODULE_DEVICE_TABLE(pnp_card, snd_opti9xx_pnpids); + + #endif /* CONFIG_PNP */ + +-#ifdef OPTi93X +-#define DEV_NAME "opti93x" +-#else +-#define DEV_NAME "opti92x" +-#endif ++#define DEV_NAME KBUILD_MODNAME + + static char * snd_opti9xx_names[] = { + "unknown", +@@ -1126,7 +1122,7 @@ static void __devexit snd_opti9xx_pnp_remove(struct pnp_card_link * pcard) + + static struct pnp_card_driver opti9xx_pnpc_driver = { + .flags = PNP_DRIVER_RES_DISABLE, +- .name = "opti9xx", ++ .name = DEV_NAME, + .id_table = snd_opti9xx_pnpids, + .probe = snd_opti9xx_pnp_probe, + .remove = __devexit_p(snd_opti9xx_pnp_remove), +diff --git a/sound/oss/Kconfig b/sound/oss/Kconfig +index 6c9e8e8..1fc28f5 100644 +--- a/sound/oss/Kconfig ++++ b/sound/oss/Kconfig +@@ -250,6 +250,7 @@ config MSND_FIFOSIZE + menuconfig SOUND_OSS + tristate "OSS sound modules" + depends on ISA_DMA_API && VIRT_TO_BUS ++ depends on !GENERIC_ISA_DMA_SUPPORT_BROKEN + help + OSS is the Open Sound System suite of sound card drivers. They make + sound programming easier since they provide a common API. Say Y or +diff --git a/sound/usb/6fire/comm.c b/sound/usb/6fire/comm.c +index c994daa..af6ec8d 100644 +--- a/sound/usb/6fire/comm.c ++++ b/sound/usb/6fire/comm.c +@@ -111,19 +111,37 @@ static int usb6fire_comm_send_buffer(u8 *buffer, struct usb_device *dev) + static int usb6fire_comm_write8(struct comm_runtime *rt, u8 request, + u8 reg, u8 value) + { +- u8 buffer[13]; /* 13: maximum length of message */ ++ u8 *buffer; ++ int ret; ++ ++ /* 13: maximum length of message */ ++ buffer = kmalloc(13, GFP_KERNEL); ++ if (!buffer) ++ return -ENOMEM; + + usb6fire_comm_init_buffer(buffer, 0x00, request, reg, value, 0x00); +- return usb6fire_comm_send_buffer(buffer, rt->chip->dev); ++ ret = usb6fire_comm_send_buffer(buffer, rt->chip->dev); ++ ++ kfree(buffer); ++ return ret; + } + + static int usb6fire_comm_write16(struct comm_runtime *rt, u8 request, + u8 reg, u8 vl, u8 vh) + { +- u8 buffer[13]; /* 13: maximum length of message */ ++ u8 *buffer; ++ int ret; ++ ++ /* 13: maximum length of message */ ++ buffer = kmalloc(13, GFP_KERNEL); ++ if (!buffer) ++ return -ENOMEM; + + usb6fire_comm_init_buffer(buffer, 0x00, request, reg, vl, vh); +- return usb6fire_comm_send_buffer(buffer, rt->chip->dev); ++ ret = usb6fire_comm_send_buffer(buffer, rt->chip->dev); ++ ++ kfree(buffer); ++ return ret; + } + + int __devinit usb6fire_comm_init(struct sfire_chip *chip) +@@ -136,6 +154,12 @@ int __devinit usb6fire_comm_init(struct sfire_chip *chip) + if (!rt) + return -ENOMEM; + ++ rt->receiver_buffer = kzalloc(COMM_RECEIVER_BUFSIZE, GFP_KERNEL); ++ if (!rt->receiver_buffer) { ++ kfree(rt); ++ return -ENOMEM; ++ } ++ + rt->serial = 1; + rt->chip = chip; + usb_init_urb(urb); +@@ -153,6 +177,7 @@ int __devinit usb6fire_comm_init(struct sfire_chip *chip) + urb->interval = 1; + ret = usb_submit_urb(urb, GFP_KERNEL); + if (ret < 0) { ++ kfree(rt->receiver_buffer); + kfree(rt); + snd_printk(KERN_ERR PREFIX "cannot create comm data receiver."); + return ret; +@@ -171,6 +196,9 @@ void usb6fire_comm_abort(struct sfire_chip *chip) + + void usb6fire_comm_destroy(struct sfire_chip *chip) + { +- kfree(chip->comm); ++ struct comm_runtime *rt = chip->comm; ++ ++ kfree(rt->receiver_buffer); ++ kfree(rt); + chip->comm = NULL; + } +diff --git a/sound/usb/6fire/comm.h b/sound/usb/6fire/comm.h +index edc5dc8..19e2f92 100644 +--- a/sound/usb/6fire/comm.h ++++ b/sound/usb/6fire/comm.h +@@ -25,7 +25,7 @@ struct comm_runtime { + struct sfire_chip *chip; + + struct urb receiver; +- u8 receiver_buffer[COMM_RECEIVER_BUFSIZE]; ++ u8 *receiver_buffer; + + u8 serial; /* urb serial */ + +diff --git a/sound/usb/6fire/midi.c b/sound/usb/6fire/midi.c +index 13f4509..8283c5d 100644 +--- a/sound/usb/6fire/midi.c ++++ b/sound/usb/6fire/midi.c +@@ -20,6 +20,10 @@ + #include "chip.h" + #include "comm.h" + ++enum { ++ MIDI_BUFSIZE = 64 ++}; ++ + static void usb6fire_midi_out_handler(struct urb *urb) + { + struct midi_runtime *rt = urb->context; +@@ -157,6 +161,12 @@ int __devinit usb6fire_midi_init(struct sfire_chip *chip) + if (!rt) + return -ENOMEM; + ++ rt->out_buffer = kzalloc(MIDI_BUFSIZE, GFP_KERNEL); ++ if (!rt->out_buffer) { ++ kfree(rt); ++ return -ENOMEM; ++ } ++ + rt->chip = chip; + rt->in_received = usb6fire_midi_in_received; + rt->out_buffer[0] = 0x80; /* 'send midi' command */ +@@ -170,6 +180,7 @@ int __devinit usb6fire_midi_init(struct sfire_chip *chip) + + ret = snd_rawmidi_new(chip->card, "6FireUSB", 0, 1, 1, &rt->instance); + if (ret < 0) { ++ kfree(rt->out_buffer); + kfree(rt); + snd_printk(KERN_ERR PREFIX "unable to create midi.\n"); + return ret; +@@ -198,6 +209,9 @@ void usb6fire_midi_abort(struct sfire_chip *chip) + + void usb6fire_midi_destroy(struct sfire_chip *chip) + { +- kfree(chip->midi); ++ struct midi_runtime *rt = chip->midi; ++ ++ kfree(rt->out_buffer); ++ kfree(rt); + chip->midi = NULL; + } +diff --git a/sound/usb/6fire/midi.h b/sound/usb/6fire/midi.h +index 97a7bf6..7f8f448 100644 +--- a/sound/usb/6fire/midi.h ++++ b/sound/usb/6fire/midi.h +@@ -17,10 +17,6 @@ + + #include "common.h" + +-enum { +- MIDI_BUFSIZE = 64 +-}; +- + struct midi_runtime { + struct sfire_chip *chip; + struct snd_rawmidi *instance; +@@ -33,7 +29,7 @@ struct midi_runtime { + struct snd_rawmidi_substream *out; + struct urb out_urb; + u8 out_serial; /* serial number of out packet */ +- u8 out_buffer[MIDI_BUFSIZE]; ++ u8 *out_buffer; + int buffer_offset; + + void (*in_received)(struct midi_runtime *rt, u8 *data, int length); +diff --git a/sound/usb/6fire/pcm.c b/sound/usb/6fire/pcm.c +index 888a7c7..8609c74 100644 +--- a/sound/usb/6fire/pcm.c ++++ b/sound/usb/6fire/pcm.c +@@ -579,6 +579,33 @@ static void __devinit usb6fire_pcm_init_urb(struct pcm_urb *urb, + urb->instance.number_of_packets = PCM_N_PACKETS_PER_URB; + } + ++static int usb6fire_pcm_buffers_init(struct pcm_runtime *rt) ++{ ++ int i; ++ ++ for (i = 0; i < PCM_N_URBS; i++) { ++ rt->out_urbs[i].buffer = kzalloc(PCM_N_PACKETS_PER_URB ++ * PCM_MAX_PACKET_SIZE, GFP_KERNEL); ++ if (!rt->out_urbs[i].buffer) ++ return -ENOMEM; ++ rt->in_urbs[i].buffer = kzalloc(PCM_N_PACKETS_PER_URB ++ * PCM_MAX_PACKET_SIZE, GFP_KERNEL); ++ if (!rt->in_urbs[i].buffer) ++ return -ENOMEM; ++ } ++ return 0; ++} ++ ++static void usb6fire_pcm_buffers_destroy(struct pcm_runtime *rt) ++{ ++ int i; ++ ++ for (i = 0; i < PCM_N_URBS; i++) { ++ kfree(rt->out_urbs[i].buffer); ++ kfree(rt->in_urbs[i].buffer); ++ } ++} ++ + int __devinit usb6fire_pcm_init(struct sfire_chip *chip) + { + int i; +@@ -590,6 +617,13 @@ int __devinit usb6fire_pcm_init(struct sfire_chip *chip) + if (!rt) + return -ENOMEM; + ++ ret = usb6fire_pcm_buffers_init(rt); ++ if (ret) { ++ usb6fire_pcm_buffers_destroy(rt); ++ kfree(rt); ++ return ret; ++ } ++ + rt->chip = chip; + rt->stream_state = STREAM_DISABLED; + rt->rate = ARRAY_SIZE(rates); +@@ -611,6 +645,7 @@ int __devinit usb6fire_pcm_init(struct sfire_chip *chip) + + ret = snd_pcm_new(chip->card, "DMX6FireUSB", 0, 1, 1, &pcm); + if (ret < 0) { ++ usb6fire_pcm_buffers_destroy(rt); + kfree(rt); + snd_printk(KERN_ERR PREFIX "cannot create pcm instance.\n"); + return ret; +@@ -626,6 +661,7 @@ int __devinit usb6fire_pcm_init(struct sfire_chip *chip) + snd_dma_continuous_data(GFP_KERNEL), + MAX_BUFSIZE, MAX_BUFSIZE); + if (ret) { ++ usb6fire_pcm_buffers_destroy(rt); + kfree(rt); + snd_printk(KERN_ERR PREFIX + "error preallocating pcm buffers.\n"); +@@ -670,6 +706,9 @@ void usb6fire_pcm_abort(struct sfire_chip *chip) + + void usb6fire_pcm_destroy(struct sfire_chip *chip) + { +- kfree(chip->pcm); ++ struct pcm_runtime *rt = chip->pcm; ++ ++ usb6fire_pcm_buffers_destroy(rt); ++ kfree(rt); + chip->pcm = NULL; + } +diff --git a/sound/usb/6fire/pcm.h b/sound/usb/6fire/pcm.h +index 2bee813..a8e8899 100644 +--- a/sound/usb/6fire/pcm.h ++++ b/sound/usb/6fire/pcm.h +@@ -33,7 +33,7 @@ struct pcm_urb { + struct urb instance; + struct usb_iso_packet_descriptor packets[PCM_N_PACKETS_PER_URB]; + /* END DO NOT SEPARATE */ +- u8 buffer[PCM_N_PACKETS_PER_URB * PCM_MAX_PACKET_SIZE]; ++ u8 *buffer; + + struct pcm_urb *peer; + }; +diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c +index aeb26eb..41b9fe0 100644 +--- a/sound/usb/mixer.c ++++ b/sound/usb/mixer.c +@@ -720,8 +720,20 @@ static int check_input_term(struct mixer_build *state, int id, struct usb_audio_ + return 0; + } + case UAC1_PROCESSING_UNIT: +- case UAC1_EXTENSION_UNIT: { ++ case UAC1_EXTENSION_UNIT: ++ /* UAC2_PROCESSING_UNIT_V2 */ ++ /* UAC2_EFFECT_UNIT */ ++ case UAC2_EXTENSION_UNIT_V2: { + struct uac_processing_unit_descriptor *d = p1; ++ ++ if (state->mixer->protocol == UAC_VERSION_2 && ++ hdr[2] == UAC2_EFFECT_UNIT) { ++ /* UAC2/UAC1 unit IDs overlap here in an ++ * uncompatible way. Ignore this unit for now. ++ */ ++ return 0; ++ } ++ + if (d->bNrInPins) { + id = d->baSourceID[0]; + break; /* continue to parse */ +@@ -1956,6 +1968,8 @@ static int parse_audio_unit(struct mixer_build *state, int unitid) + return parse_audio_extension_unit(state, unitid, p1); + else /* UAC_VERSION_2 */ + return parse_audio_processing_unit(state, unitid, p1); ++ case UAC2_EXTENSION_UNIT_V2: ++ return parse_audio_extension_unit(state, unitid, p1); + default: + snd_printk(KERN_ERR "usbaudio: unit %u: unexpected type 0x%02x\n", unitid, p1[2]); + return -EINVAL; +diff --git a/tools/perf/util/map.c b/tools/perf/util/map.c +index 78284b1..42dffa0 100644 +--- a/tools/perf/util/map.c ++++ b/tools/perf/util/map.c +@@ -15,7 +15,8 @@ const char *map_type__name[MAP__NR_TYPES] = { + + static inline int is_anon_memory(const char *filename) + { +- return strcmp(filename, "//anon") == 0; ++ return !strcmp(filename, "//anon") || ++ !strcmp(filename, "/anon_hugepage (deleted)"); + } + + static inline int is_no_dso_memory(const char *filename) |