* [gentoo-commits] linux-patches r1693 - genpatches-2.6/trunk/2.6.33
@ 2010-04-02 12:05 Mike Pagano (mpagano)
0 siblings, 0 replies; only message in thread
From: Mike Pagano (mpagano) @ 2010-04-02 12:05 UTC (permalink / raw
To: gentoo-commits
Author: mpagano
Date: 2010-04-02 12:05:30 +0000 (Fri, 02 Apr 2010)
New Revision: 1693
Added:
genpatches-2.6/trunk/2.6.33/1001_linux-2.6.33.2.patch
Modified:
genpatches-2.6/trunk/2.6.33/0000_README
Log:
Linux patch version 2.6.33.2
Modified: genpatches-2.6/trunk/2.6.33/0000_README
===================================================================
--- genpatches-2.6/trunk/2.6.33/0000_README 2010-04-02 12:00:14 UTC (rev 1692)
+++ genpatches-2.6/trunk/2.6.33/0000_README 2010-04-02 12:05:30 UTC (rev 1693)
@@ -43,6 +43,10 @@
From: http://www.kernel.org
Desc: Linux 2.6.33.1
+Patch: 1001_linux-2.6.33.2.patch
+From: http://www.kernel.org
+Desc: Linux 2.6.33.2
+
Patch: 4100_dm-bbr.patch
From: EVMS 2.5.2
Desc: Bad block relocation support for LiveCD users
Added: genpatches-2.6/trunk/2.6.33/1001_linux-2.6.33.2.patch
===================================================================
--- genpatches-2.6/trunk/2.6.33/1001_linux-2.6.33.2.patch (rev 0)
+++ genpatches-2.6/trunk/2.6.33/1001_linux-2.6.33.2.patch 2010-04-02 12:05:30 UTC (rev 1693)
@@ -0,0 +1,6335 @@
+diff --git a/Documentation/filesystems/tmpfs.txt b/Documentation/filesystems/tmpfs.txt
+index 3015da0..fe09a2c 100644
+--- a/Documentation/filesystems/tmpfs.txt
++++ b/Documentation/filesystems/tmpfs.txt
+@@ -82,11 +82,13 @@ tmpfs has a mount option to set the NUMA memory allocation policy for
+ all files in that instance (if CONFIG_NUMA is enabled) - which can be
+ adjusted on the fly via 'mount -o remount ...'
+
+-mpol=default prefers to allocate memory from the local node
++mpol=default use the process allocation policy
++ (see set_mempolicy(2))
+ mpol=prefer:Node prefers to allocate memory from the given Node
+ mpol=bind:NodeList allocates memory only from nodes in NodeList
+ mpol=interleave prefers to allocate from each node in turn
+ mpol=interleave:NodeList allocates from each node of NodeList in turn
++mpol=local prefers to allocate memory from the local node
+
+ NodeList format is a comma-separated list of decimal numbers and ranges,
+ a range being two hyphen-separated decimal numbers, the smallest and
+@@ -134,3 +136,5 @@ Author:
+ Christoph Rohland <cr@sap.com>, 1.12.01
+ Updated:
+ Hugh Dickins, 4 June 2007
++Updated:
++ KOSAKI Motohiro, 16 Mar 2010
+diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S
+index 4fddc50..6b84a04 100644
+--- a/arch/arm/boot/compressed/head.S
++++ b/arch/arm/boot/compressed/head.S
+@@ -170,8 +170,8 @@ not_angel:
+
+ .text
+ adr r0, LC0
+- ARM( ldmia r0, {r1, r2, r3, r4, r5, r6, ip, sp} )
+- THUMB( ldmia r0, {r1, r2, r3, r4, r5, r6, ip} )
++ ARM( ldmia r0, {r1, r2, r3, r4, r5, r6, r11, ip, sp})
++ THUMB( ldmia r0, {r1, r2, r3, r4, r5, r6, r11, ip} )
+ THUMB( ldr sp, [r0, #28] )
+ subs r0, r0, r1 @ calculate the delta offset
+
+@@ -182,12 +182,13 @@ not_angel:
+ /*
+ * We're running at a different address. We need to fix
+ * up various pointers:
+- * r5 - zImage base address
+- * r6 - GOT start
++ * r5 - zImage base address (_start)
++ * r6 - size of decompressed image
++ * r11 - GOT start
+ * ip - GOT end
+ */
+ add r5, r5, r0
+- add r6, r6, r0
++ add r11, r11, r0
+ add ip, ip, r0
+
+ #ifndef CONFIG_ZBOOT_ROM
+@@ -205,10 +206,10 @@ not_angel:
+ /*
+ * Relocate all entries in the GOT table.
+ */
+-1: ldr r1, [r6, #0] @ relocate entries in the GOT
++1: ldr r1, [r11, #0] @ relocate entries in the GOT
+ add r1, r1, r0 @ table. This fixes up the
+- str r1, [r6], #4 @ C references.
+- cmp r6, ip
++ str r1, [r11], #4 @ C references.
++ cmp r11, ip
+ blo 1b
+ #else
+
+@@ -216,12 +217,12 @@ not_angel:
+ * Relocate entries in the GOT table. We only relocate
+ * the entries that are outside the (relocated) BSS region.
+ */
+-1: ldr r1, [r6, #0] @ relocate entries in the GOT
++1: ldr r1, [r11, #0] @ relocate entries in the GOT
+ cmp r1, r2 @ entry < bss_start ||
+ cmphs r3, r1 @ _end < entry
+ addlo r1, r1, r0 @ table. This fixes up the
+- str r1, [r6], #4 @ C references.
+- cmp r6, ip
++ str r1, [r11], #4 @ C references.
++ cmp r11, ip
+ blo 1b
+ #endif
+
+@@ -247,6 +248,7 @@ not_relocated: mov r0, #0
+ * Check to see if we will overwrite ourselves.
+ * r4 = final kernel address
+ * r5 = start of this image
++ * r6 = size of decompressed image
+ * r2 = end of malloc space (and therefore this image)
+ * We basically want:
+ * r4 >= r2 -> OK
+@@ -254,8 +256,7 @@ not_relocated: mov r0, #0
+ */
+ cmp r4, r2
+ bhs wont_overwrite
+- sub r3, sp, r5 @ > compressed kernel size
+- add r0, r4, r3, lsl #2 @ allow for 4x expansion
++ add r0, r4, r6
+ cmp r0, r5
+ bls wont_overwrite
+
+@@ -271,7 +272,6 @@ not_relocated: mov r0, #0
+ * r1-r3 = unused
+ * r4 = kernel execution address
+ * r5 = decompressed kernel start
+- * r6 = processor ID
+ * r7 = architecture ID
+ * r8 = atags pointer
+ * r9-r12,r14 = corrupted
+@@ -312,7 +312,8 @@ LC0: .word LC0 @ r1
+ .word _end @ r3
+ .word zreladdr @ r4
+ .word _start @ r5
+- .word _got_start @ r6
++ .word _image_size @ r6
++ .word _got_start @ r11
+ .word _got_end @ ip
+ .word user_stack+4096 @ sp
+ LC1: .word reloc_end - reloc_start
+@@ -336,7 +337,6 @@ params: ldr r0, =params_phys
+ *
+ * On entry,
+ * r4 = kernel execution address
+- * r6 = processor ID
+ * r7 = architecture number
+ * r8 = atags pointer
+ * r9 = run-time address of "start" (???)
+@@ -542,7 +542,6 @@ __common_mmu_cache_on:
+ * r1-r3 = unused
+ * r4 = kernel execution address
+ * r5 = decompressed kernel start
+- * r6 = processor ID
+ * r7 = architecture ID
+ * r8 = atags pointer
+ * r9-r12,r14 = corrupted
+@@ -581,19 +580,19 @@ call_kernel: bl cache_clean_flush
+ * r1 = corrupted
+ * r2 = corrupted
+ * r3 = block offset
+- * r6 = corrupted
++ * r9 = corrupted
+ * r12 = corrupted
+ */
+
+ call_cache_fn: adr r12, proc_types
+ #ifdef CONFIG_CPU_CP15
+- mrc p15, 0, r6, c0, c0 @ get processor ID
++ mrc p15, 0, r9, c0, c0 @ get processor ID
+ #else
+- ldr r6, =CONFIG_PROCESSOR_ID
++ ldr r9, =CONFIG_PROCESSOR_ID
+ #endif
+ 1: ldr r1, [r12, #0] @ get value
+ ldr r2, [r12, #4] @ get mask
+- eor r1, r1, r6 @ (real ^ match)
++ eor r1, r1, r9 @ (real ^ match)
+ tst r1, r2 @ & mask
+ ARM( addeq pc, r12, r3 ) @ call cache function
+ THUMB( addeq r12, r3 )
+@@ -778,8 +777,7 @@ proc_types:
+ * Turn off the Cache and MMU. ARMv3 does not support
+ * reading the control register, but ARMv4 does.
+ *
+- * On entry, r6 = processor ID
+- * On exit, r0, r1, r2, r3, r12 corrupted
++ * On exit, r0, r1, r2, r3, r9, r12 corrupted
+ * This routine must preserve: r4, r6, r7
+ */
+ .align 5
+@@ -852,10 +850,8 @@ __armv3_mmu_cache_off:
+ /*
+ * Clean and flush the cache to maintain consistency.
+ *
+- * On entry,
+- * r6 = processor ID
+ * On exit,
+- * r1, r2, r3, r11, r12 corrupted
++ * r1, r2, r3, r9, r11, r12 corrupted
+ * This routine must preserve:
+ * r0, r4, r5, r6, r7
+ */
+@@ -967,7 +963,7 @@ __armv4_mmu_cache_flush:
+ mov r2, #64*1024 @ default: 32K dcache size (*2)
+ mov r11, #32 @ default: 32 byte line size
+ mrc p15, 0, r3, c0, c0, 1 @ read cache type
+- teq r3, r6 @ cache ID register present?
++ teq r3, r9 @ cache ID register present?
+ beq no_cache_id
+ mov r1, r3, lsr #18
+ and r1, r1, #7
+diff --git a/arch/arm/boot/compressed/vmlinux.lds.in b/arch/arm/boot/compressed/vmlinux.lds.in
+index a5924b9..cbed030 100644
+--- a/arch/arm/boot/compressed/vmlinux.lds.in
++++ b/arch/arm/boot/compressed/vmlinux.lds.in
+@@ -36,6 +36,9 @@ SECTIONS
+
+ _etext = .;
+
++ /* Assume size of decompressed image is 4x the compressed image */
++ _image_size = (_etext - _text) * 4;
++
+ _got_start = .;
+ .got : { *(.got) }
+ _got_end = .;
+diff --git a/arch/powerpc/kernel/perf_event.c b/arch/powerpc/kernel/perf_event.c
+index 1eb85fb..a3c0a32 100644
+--- a/arch/powerpc/kernel/perf_event.c
++++ b/arch/powerpc/kernel/perf_event.c
+@@ -1164,10 +1164,10 @@ static void record_and_restart(struct perf_event *event, unsigned long val,
+ * Finally record data if requested.
+ */
+ if (record) {
+- struct perf_sample_data data = {
+- .addr = ~0ULL,
+- .period = event->hw.last_period,
+- };
++ struct perf_sample_data data;
++
++ perf_sample_data_init(&data, ~0ULL);
++ data.period = event->hw.last_period;
+
+ if (event->attr.sample_type & PERF_SAMPLE_ADDR)
+ perf_get_data_addr(regs, &data.addr);
+diff --git a/arch/sh/boot/compressed/misc.c b/arch/sh/boot/compressed/misc.c
+index b51b1fc..d3cc94f 100644
+--- a/arch/sh/boot/compressed/misc.c
++++ b/arch/sh/boot/compressed/misc.c
+@@ -132,7 +132,7 @@ void decompress_kernel(void)
+ output_addr = (CONFIG_MEMORY_START + 0x2000);
+ #else
+ output_addr = __pa((unsigned long)&_text+PAGE_SIZE);
+-#ifdef CONFIG_29BIT
++#if defined(CONFIG_29BIT) || defined(CONFIG_PMB_LEGACY)
+ output_addr |= P2SEG;
+ #endif
+ #endif
+diff --git a/arch/sparc/kernel/perf_event.c b/arch/sparc/kernel/perf_event.c
+index e856456..8c70d3e 100644
+--- a/arch/sparc/kernel/perf_event.c
++++ b/arch/sparc/kernel/perf_event.c
+@@ -1189,7 +1189,7 @@ static int __kprobes perf_event_nmi_handler(struct notifier_block *self,
+
+ regs = args->regs;
+
+- data.addr = 0;
++ perf_sample_data_init(&data, 0);
+
+ cpuc = &__get_cpu_var(cpu_hw_events);
+
+@@ -1337,7 +1337,7 @@ static void perf_callchain_user_32(struct pt_regs *regs,
+ callchain_store(entry, PERF_CONTEXT_USER);
+ callchain_store(entry, regs->tpc);
+
+- ufp = regs->u_regs[UREG_I6];
++ ufp = regs->u_regs[UREG_I6] & 0xffffffffUL;
+ do {
+ struct sparc_stackf32 *usf, sf;
+ unsigned long pc;
+diff --git a/arch/sparc/prom/p1275.c b/arch/sparc/prom/p1275.c
+index 4b7c937..2d8b70d 100644
+--- a/arch/sparc/prom/p1275.c
++++ b/arch/sparc/prom/p1275.c
+@@ -32,10 +32,9 @@ extern void prom_cif_interface(void);
+ extern void prom_cif_callback(void);
+
+ /*
+- * This provides SMP safety on the p1275buf. prom_callback() drops this lock
+- * to allow recursuve acquisition.
++ * This provides SMP safety on the p1275buf.
+ */
+-DEFINE_SPINLOCK(prom_entry_lock);
++DEFINE_RAW_SPINLOCK(prom_entry_lock);
+
+ long p1275_cmd(const char *service, long fmt, ...)
+ {
+@@ -47,7 +46,9 @@ long p1275_cmd(const char *service, long fmt, ...)
+
+ p = p1275buf.prom_buffer;
+
+- spin_lock_irqsave(&prom_entry_lock, flags);
++ raw_local_save_flags(flags);
++ raw_local_irq_restore(PIL_NMI);
++ raw_spin_lock(&prom_entry_lock);
+
+ p1275buf.prom_args[0] = (unsigned long)p; /* service */
+ strcpy (p, service);
+@@ -139,7 +140,8 @@ long p1275_cmd(const char *service, long fmt, ...)
+ va_end(list);
+ x = p1275buf.prom_args [nargs + 3];
+
+- spin_unlock_irqrestore(&prom_entry_lock, flags);
++ raw_spin_unlock(&prom_entry_lock);
++ raw_local_irq_restore(flags);
+
+ return x;
+ }
+diff --git a/arch/x86/include/asm/fixmap.h b/arch/x86/include/asm/fixmap.h
+index 14f9890..c22a164 100644
+--- a/arch/x86/include/asm/fixmap.h
++++ b/arch/x86/include/asm/fixmap.h
+@@ -82,6 +82,9 @@ enum fixed_addresses {
+ #endif
+ FIX_DBGP_BASE,
+ FIX_EARLYCON_MEM_BASE,
++#ifdef CONFIG_PROVIDE_OHCI1394_DMA_INIT
++ FIX_OHCI1394_BASE,
++#endif
+ #ifdef CONFIG_X86_LOCAL_APIC
+ FIX_APIC_BASE, /* local (CPU) APIC) -- required for SMP or not */
+ #endif
+@@ -126,9 +129,6 @@ enum fixed_addresses {
+ FIX_BTMAP_END = __end_of_permanent_fixed_addresses + 256 -
+ (__end_of_permanent_fixed_addresses & 255),
+ FIX_BTMAP_BEGIN = FIX_BTMAP_END + NR_FIX_BTMAPS*FIX_BTMAPS_SLOTS - 1,
+-#ifdef CONFIG_PROVIDE_OHCI1394_DMA_INIT
+- FIX_OHCI1394_BASE,
+-#endif
+ #ifdef CONFIG_X86_32
+ FIX_WP_TEST,
+ #endif
+diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
+index 1cd58cd..4604e6a 100644
+--- a/arch/x86/include/asm/msr-index.h
++++ b/arch/x86/include/asm/msr-index.h
+@@ -105,6 +105,8 @@
+ #define MSR_AMD64_PATCH_LEVEL 0x0000008b
+ #define MSR_AMD64_NB_CFG 0xc001001f
+ #define MSR_AMD64_PATCH_LOADER 0xc0010020
++#define MSR_AMD64_OSVW_ID_LENGTH 0xc0010140
++#define MSR_AMD64_OSVW_STATUS 0xc0010141
+ #define MSR_AMD64_IBSFETCHCTL 0xc0011030
+ #define MSR_AMD64_IBSFETCHLINAD 0xc0011031
+ #define MSR_AMD64_IBSFETCHPHYSAD 0xc0011032
+diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
+index 879666f..7e1cca1 100644
+--- a/arch/x86/kernel/cpu/intel.c
++++ b/arch/x86/kernel/cpu/intel.c
+@@ -70,7 +70,8 @@ static void __cpuinit early_init_intel(struct cpuinfo_x86 *c)
+ if (c->x86_power & (1 << 8)) {
+ set_cpu_cap(c, X86_FEATURE_CONSTANT_TSC);
+ set_cpu_cap(c, X86_FEATURE_NONSTOP_TSC);
+- sched_clock_stable = 1;
++ if (!check_tsc_unstable())
++ sched_clock_stable = 1;
+ }
+
+ /*
+diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
+index 8c1c070..98819b3 100644
+--- a/arch/x86/kernel/cpu/perf_event.c
++++ b/arch/x86/kernel/cpu/perf_event.c
+@@ -1636,10 +1636,9 @@ static void intel_pmu_drain_bts_buffer(struct cpu_hw_events *cpuc)
+
+ ds->bts_index = ds->bts_buffer_base;
+
++ perf_sample_data_init(&data, 0);
+
+ data.period = event->hw.last_period;
+- data.addr = 0;
+- data.raw = NULL;
+ regs.ip = 0;
+
+ /*
+@@ -1756,8 +1755,7 @@ static int p6_pmu_handle_irq(struct pt_regs *regs)
+ int idx, handled = 0;
+ u64 val;
+
+- data.addr = 0;
+- data.raw = NULL;
++ perf_sample_data_init(&data, 0);
+
+ cpuc = &__get_cpu_var(cpu_hw_events);
+
+@@ -1802,8 +1800,7 @@ static int intel_pmu_handle_irq(struct pt_regs *regs)
+ int bit, loops;
+ u64 ack, status;
+
+- data.addr = 0;
+- data.raw = NULL;
++ perf_sample_data_init(&data, 0);
+
+ cpuc = &__get_cpu_var(cpu_hw_events);
+
+diff --git a/arch/x86/kernel/dumpstack_64.c b/arch/x86/kernel/dumpstack_64.c
+index 0ad9597..a6c906c 100644
+--- a/arch/x86/kernel/dumpstack_64.c
++++ b/arch/x86/kernel/dumpstack_64.c
+@@ -125,9 +125,15 @@ fixup_bp_irq_link(unsigned long bp, unsigned long *stack,
+ {
+ #ifdef CONFIG_FRAME_POINTER
+ struct stack_frame *frame = (struct stack_frame *)bp;
++ unsigned long next;
+
+- if (!in_irq_stack(stack, irq_stack, irq_stack_end))
+- return (unsigned long)frame->next_frame;
++ if (!in_irq_stack(stack, irq_stack, irq_stack_end)) {
++ if (!probe_kernel_address(&frame->next_frame, next))
++ return next;
++ else
++ WARN_ONCE(1, "Perf: bad frame pointer = %p in "
++ "callchain\n", &frame->next_frame);
++ }
+ #endif
+ return bp;
+ }
+diff --git a/arch/x86/kernel/hw_breakpoint.c b/arch/x86/kernel/hw_breakpoint.c
+index bb6006e..1e8cead 100644
+--- a/arch/x86/kernel/hw_breakpoint.c
++++ b/arch/x86/kernel/hw_breakpoint.c
+@@ -531,8 +531,3 @@ void hw_breakpoint_pmu_read(struct perf_event *bp)
+ {
+ /* TODO */
+ }
+-
+-void hw_breakpoint_pmu_unthrottle(struct perf_event *bp)
+-{
+- /* TODO */
+-}
+diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
+index c9b3522..999c8a6 100644
+--- a/arch/x86/kernel/process.c
++++ b/arch/x86/kernel/process.c
+@@ -519,21 +519,37 @@ static int __cpuinit mwait_usable(const struct cpuinfo_x86 *c)
+ }
+
+ /*
+- * Check for AMD CPUs, which have potentially C1E support
++ * Check for AMD CPUs, where APIC timer interrupt does not wake up CPU from C1e.
++ * For more information see
++ * - Erratum #400 for NPT family 0xf and family 0x10 CPUs
++ * - Erratum #365 for family 0x11 (not affected because C1e not in use)
+ */
+ static int __cpuinit check_c1e_idle(const struct cpuinfo_x86 *c)
+ {
++ u64 val;
+ if (c->x86_vendor != X86_VENDOR_AMD)
+- return 0;
+-
+- if (c->x86 < 0x0F)
+- return 0;
++ goto no_c1e_idle;
+
+ /* Family 0x0f models < rev F do not have C1E */
+- if (c->x86 == 0x0f && c->x86_model < 0x40)
+- return 0;
++ if (c->x86 == 0x0F && c->x86_model >= 0x40)
++ return 1;
+
+- return 1;
++ if (c->x86 == 0x10) {
++ /*
++ * check OSVW bit for CPUs that are not affected
++ * by erratum #400
++ */
++ rdmsrl(MSR_AMD64_OSVW_ID_LENGTH, val);
++ if (val >= 2) {
++ rdmsrl(MSR_AMD64_OSVW_STATUS, val);
++ if (!(val & BIT(1)))
++ goto no_c1e_idle;
++ }
++ return 1;
++ }
++
++no_c1e_idle:
++ return 0;
+ }
+
+ static cpumask_var_t c1e_mask;
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index a1e1bc9..e900908 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -1351,6 +1351,7 @@ int kvm_dev_ioctl_check_extension(long ext)
+ case KVM_CAP_XEN_HVM:
+ case KVM_CAP_ADJUST_CLOCK:
+ case KVM_CAP_VCPU_EVENTS:
++ case KVM_CAP_X86_ROBUST_SINGLESTEP:
+ r = 1;
+ break;
+ case KVM_CAP_COALESCED_MMIO:
+diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
+index 1d4eb93..cf07c26 100644
+--- a/arch/x86/mm/pageattr.c
++++ b/arch/x86/mm/pageattr.c
+@@ -291,8 +291,29 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
+ */
+ if (kernel_set_to_readonly &&
+ within(address, (unsigned long)_text,
+- (unsigned long)__end_rodata_hpage_align))
+- pgprot_val(forbidden) |= _PAGE_RW;
++ (unsigned long)__end_rodata_hpage_align)) {
++ unsigned int level;
++
++ /*
++ * Don't enforce the !RW mapping for the kernel text mapping,
++ * if the current mapping is already using small page mapping.
++ * No need to work hard to preserve large page mappings in this
++ * case.
++ *
++ * This also fixes the Linux Xen paravirt guest boot failure
++ * (because of unexpected read-only mappings for kernel identity
++ * mappings). In this paravirt guest case, the kernel text
++ * mapping and the kernel identity mapping share the same
++ * page-table pages. Thus we can't really use different
++ * protections for the kernel text and identity mappings. Also,
++ * these shared mappings are made of small page mappings.
++ * Thus this don't enforce !RW mapping for small page kernel
++ * text mapping logic will help Linux Xen parvirt guest boot
++ * aswell.
++ */
++ if (lookup_address(address, &level) && (level != PG_LEVEL_4K))
++ pgprot_val(forbidden) |= _PAGE_RW;
++ }
+ #endif
+
+ prot = __pgprot(pgprot_val(prot) & ~pgprot_val(forbidden));
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index a6a736a..9e2feb6 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -2831,6 +2831,14 @@ static bool ahci_broken_suspend(struct pci_dev *pdev)
+ * On HP dv[4-6] and HDX18 with earlier BIOSen, link
+ * to the harddisk doesn't become online after
+ * resuming from STR. Warn and fail suspend.
++ *
++ * http://bugzilla.kernel.org/show_bug.cgi?id=12276
++ *
++ * Use dates instead of versions to match as HP is
++ * apparently recycling both product and version
++ * strings.
++ *
++ * http://bugzilla.kernel.org/show_bug.cgi?id=15462
+ */
+ {
+ .ident = "dv4",
+@@ -2839,7 +2847,7 @@ static bool ahci_broken_suspend(struct pci_dev *pdev)
+ DMI_MATCH(DMI_PRODUCT_NAME,
+ "HP Pavilion dv4 Notebook PC"),
+ },
+- .driver_data = "F.30", /* cutoff BIOS version */
++ .driver_data = "20090105", /* F.30 */
+ },
+ {
+ .ident = "dv5",
+@@ -2848,7 +2856,7 @@ static bool ahci_broken_suspend(struct pci_dev *pdev)
+ DMI_MATCH(DMI_PRODUCT_NAME,
+ "HP Pavilion dv5 Notebook PC"),
+ },
+- .driver_data = "F.16", /* cutoff BIOS version */
++ .driver_data = "20090506", /* F.16 */
+ },
+ {
+ .ident = "dv6",
+@@ -2857,7 +2865,7 @@ static bool ahci_broken_suspend(struct pci_dev *pdev)
+ DMI_MATCH(DMI_PRODUCT_NAME,
+ "HP Pavilion dv6 Notebook PC"),
+ },
+- .driver_data = "F.21", /* cutoff BIOS version */
++ .driver_data = "20090423", /* F.21 */
+ },
+ {
+ .ident = "HDX18",
+@@ -2866,7 +2874,7 @@ static bool ahci_broken_suspend(struct pci_dev *pdev)
+ DMI_MATCH(DMI_PRODUCT_NAME,
+ "HP HDX18 Notebook PC"),
+ },
+- .driver_data = "F.23", /* cutoff BIOS version */
++ .driver_data = "20090430", /* F.23 */
+ },
+ /*
+ * Acer eMachines G725 has the same problem. BIOS
+@@ -2874,6 +2882,8 @@ static bool ahci_broken_suspend(struct pci_dev *pdev)
+ * work. Inbetween, there are V1.06, V2.06 and V3.03
+ * that we don't have much idea about. For now,
+ * blacklist anything older than V3.04.
++ *
++ * http://bugzilla.kernel.org/show_bug.cgi?id=15104
+ */
+ {
+ .ident = "G725",
+@@ -2881,19 +2891,21 @@ static bool ahci_broken_suspend(struct pci_dev *pdev)
+ DMI_MATCH(DMI_SYS_VENDOR, "eMachines"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "eMachines G725"),
+ },
+- .driver_data = "V3.04", /* cutoff BIOS version */
++ .driver_data = "20091216", /* V3.04 */
+ },
+ { } /* terminate list */
+ };
+ const struct dmi_system_id *dmi = dmi_first_match(sysids);
+- const char *ver;
++ int year, month, date;
++ char buf[9];
+
+ if (!dmi || pdev->bus->number || pdev->devfn != PCI_DEVFN(0x1f, 2))
+ return false;
+
+- ver = dmi_get_system_info(DMI_BIOS_VERSION);
++ dmi_get_date(DMI_BIOS_DATE, &year, &month, &date);
++ snprintf(buf, sizeof(buf), "%04d%02d%02d", year, month, date);
+
+- return !ver || strcmp(ver, dmi->driver_data) < 0;
++ return strcmp(buf, dmi->driver_data) < 0;
+ }
+
+ static bool ahci_broken_online(struct pci_dev *pdev)
+diff --git a/drivers/ata/pata_via.c b/drivers/ata/pata_via.c
+index 0d97890..be7c395 100644
+--- a/drivers/ata/pata_via.c
++++ b/drivers/ata/pata_via.c
+@@ -588,6 +588,10 @@ static int via_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
+ u8 rev = isa->revision;
+ pci_dev_put(isa);
+
++ if ((id->device == 0x0415 || id->device == 0x3164) &&
++ (config->id != id->device))
++ continue;
++
+ if (rev >= config->rev_min && rev <= config->rev_max)
+ break;
+ }
+diff --git a/drivers/char/tty_buffer.c b/drivers/char/tty_buffer.c
+index 66fa4e1..f27c4d6 100644
+--- a/drivers/char/tty_buffer.c
++++ b/drivers/char/tty_buffer.c
+@@ -247,7 +247,8 @@ int tty_insert_flip_string(struct tty_struct *tty, const unsigned char *chars,
+ {
+ int copied = 0;
+ do {
+- int space = tty_buffer_request_room(tty, size - copied);
++ int goal = min(size - copied, TTY_BUFFER_PAGE);
++ int space = tty_buffer_request_room(tty, goal);
+ struct tty_buffer *tb = tty->buf.tail;
+ /* If there is no space then tb may be NULL */
+ if (unlikely(space == 0))
+@@ -283,7 +284,8 @@ int tty_insert_flip_string_flags(struct tty_struct *tty,
+ {
+ int copied = 0;
+ do {
+- int space = tty_buffer_request_room(tty, size - copied);
++ int goal = min(size - copied, TTY_BUFFER_PAGE);
++ int space = tty_buffer_request_room(tty, goal);
+ struct tty_buffer *tb = tty->buf.tail;
+ /* If there is no space then tb may be NULL */
+ if (unlikely(space == 0))
+diff --git a/drivers/edac/edac_mce_amd.c b/drivers/edac/edac_mce_amd.c
+index 8fc91a0..f5b6d9f 100644
+--- a/drivers/edac/edac_mce_amd.c
++++ b/drivers/edac/edac_mce_amd.c
+@@ -316,7 +316,12 @@ void amd_decode_nb_mce(int node_id, struct err_regs *regs, int handle_errors)
+ if (regs->nbsh & K8_NBSH_ERR_CPU_VAL)
+ pr_cont(", core: %u\n", (u8)(regs->nbsh & 0xf));
+ } else {
+- pr_cont(", core: %d\n", fls((regs->nbsh & 0xf) - 1));
++ u8 assoc_cpus = regs->nbsh & 0xf;
++
++ if (assoc_cpus > 0)
++ pr_cont(", core: %d", fls(assoc_cpus) - 1);
++
++ pr_cont("\n");
+ }
+
+ pr_emerg("%s.\n", EXT_ERR_MSG(xec));
+diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
+index ec8a0d7..fd099a1 100644
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -1470,9 +1470,6 @@ i915_gem_object_put_pages(struct drm_gem_object *obj)
+ obj_priv->dirty = 0;
+
+ for (i = 0; i < page_count; i++) {
+- if (obj_priv->pages[i] == NULL)
+- break;
+-
+ if (obj_priv->dirty)
+ set_page_dirty(obj_priv->pages[i]);
+
+@@ -2228,7 +2225,6 @@ i915_gem_object_get_pages(struct drm_gem_object *obj,
+ struct address_space *mapping;
+ struct inode *inode;
+ struct page *page;
+- int ret;
+
+ if (obj_priv->pages_refcount++ != 0)
+ return 0;
+@@ -2251,11 +2247,9 @@ i915_gem_object_get_pages(struct drm_gem_object *obj,
+ mapping_gfp_mask (mapping) |
+ __GFP_COLD |
+ gfpmask);
+- if (IS_ERR(page)) {
+- ret = PTR_ERR(page);
+- i915_gem_object_put_pages(obj);
+- return ret;
+- }
++ if (IS_ERR(page))
++ goto err_pages;
++
+ obj_priv->pages[i] = page;
+ }
+
+@@ -2263,6 +2257,15 @@ i915_gem_object_get_pages(struct drm_gem_object *obj,
+ i915_gem_object_do_bit_17_swizzle(obj);
+
+ return 0;
++
++err_pages:
++ while (i--)
++ page_cache_release(obj_priv->pages[i]);
++
++ drm_free_large(obj_priv->pages);
++ obj_priv->pages = NULL;
++ obj_priv->pages_refcount--;
++ return PTR_ERR(page);
+ }
+
+ static void i965_write_fence_reg(struct drm_i915_fence_reg *reg)
+diff --git a/drivers/gpu/drm/i915/intel_overlay.c b/drivers/gpu/drm/i915/intel_overlay.c
+index 2639591..63f569b 100644
+--- a/drivers/gpu/drm/i915/intel_overlay.c
++++ b/drivers/gpu/drm/i915/intel_overlay.c
+@@ -1083,14 +1083,18 @@ int intel_overlay_put_image(struct drm_device *dev, void *data,
+
+ drmmode_obj = drm_mode_object_find(dev, put_image_rec->crtc_id,
+ DRM_MODE_OBJECT_CRTC);
+- if (!drmmode_obj)
+- return -ENOENT;
++ if (!drmmode_obj) {
++ ret = -ENOENT;
++ goto out_free;
++ }
+ crtc = to_intel_crtc(obj_to_crtc(drmmode_obj));
+
+ new_bo = drm_gem_object_lookup(dev, file_priv,
+ put_image_rec->bo_handle);
+- if (!new_bo)
+- return -ENOENT;
++ if (!new_bo) {
++ ret = -ENOENT;
++ goto out_free;
++ }
+
+ mutex_lock(&dev->mode_config.mutex);
+ mutex_lock(&dev->struct_mutex);
+@@ -1180,6 +1184,7 @@ out_unlock:
+ mutex_unlock(&dev->struct_mutex);
+ mutex_unlock(&dev->mode_config.mutex);
+ drm_gem_object_unreference(new_bo);
++out_free:
+ kfree(params);
+
+ return ret;
+diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
+index d2f6335..a378bc3 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
++++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
+@@ -239,12 +239,14 @@ nouveau_connector_detect(struct drm_connector *connector)
+ if (connector->connector_type == DRM_MODE_CONNECTOR_LVDS)
+ nv_encoder = find_encoder_by_type(connector, OUTPUT_LVDS);
+ if (nv_encoder && nv_connector->native_mode) {
++ unsigned status = connector_status_connected;
++
+ #ifdef CONFIG_ACPI
+ if (!nouveau_ignorelid && !acpi_lid_open())
+- return connector_status_disconnected;
++ status = connector_status_unknown;
+ #endif
+ nouveau_connector_set_encoder(connector, nv_encoder);
+- return connector_status_connected;
++ return status;
+ }
+
+ /* Cleanup the previous EDID block. */
+diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
+index 2d7bcee..cb4290a 100644
+--- a/drivers/hwmon/coretemp.c
++++ b/drivers/hwmon/coretemp.c
+@@ -228,7 +228,7 @@ static int __devinit adjust_tjmax(struct cpuinfo_x86 *c, u32 id, struct device *
+ if (err) {
+ dev_warn(dev,
+ "Unable to access MSR 0xEE, for Tjmax, left"
+- " at default");
++ " at default\n");
+ } else if (eax & 0x40000000) {
+ tjmax = tjmax_ee;
+ }
+diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
+index df6ab55..5574be2 100644
+--- a/drivers/i2c/busses/i2c-i801.c
++++ b/drivers/i2c/busses/i2c-i801.c
+@@ -415,9 +415,11 @@ static int i801_block_transaction(union i2c_smbus_data *data, char read_write,
+ data->block[0] = 32; /* max for SMBus block reads */
+ }
+
++ /* Experience has shown that the block buffer can only be used for
++ SMBus (not I2C) block transactions, even though the datasheet
++ doesn't mention this limitation. */
+ if ((i801_features & FEATURE_BLOCK_BUFFER)
+- && !(command == I2C_SMBUS_I2C_BLOCK_DATA
+- && read_write == I2C_SMBUS_READ)
++ && command != I2C_SMBUS_I2C_BLOCK_DATA
+ && i801_set_block_buffer_mode() == 0)
+ result = i801_block_transaction_by_block(data, read_write,
+ hwpec);
+diff --git a/drivers/i2c/busses/i2c-powermac.c b/drivers/i2c/busses/i2c-powermac.c
+index 1c440a7..b289ec9 100644
+--- a/drivers/i2c/busses/i2c-powermac.c
++++ b/drivers/i2c/busses/i2c-powermac.c
+@@ -122,9 +122,14 @@ static s32 i2c_powermac_smbus_xfer( struct i2c_adapter* adap,
+
+ rc = pmac_i2c_xfer(bus, addrdir, subsize, subaddr, buf, len);
+ if (rc) {
+- dev_err(&adap->dev,
+- "I2C transfer at 0x%02x failed, size %d, err %d\n",
+- addrdir >> 1, size, rc);
++ if (rc == -ENXIO)
++ dev_dbg(&adap->dev,
++ "I2C transfer at 0x%02x failed, size %d, "
++ "err %d\n", addrdir >> 1, size, rc);
++ else
++ dev_err(&adap->dev,
++ "I2C transfer at 0x%02x failed, size %d, "
++ "err %d\n", addrdir >> 1, size, rc);
+ goto bail;
+ }
+
+@@ -175,10 +180,16 @@ static int i2c_powermac_master_xfer( struct i2c_adapter *adap,
+ goto bail;
+ }
+ rc = pmac_i2c_xfer(bus, addrdir, 0, 0, msgs->buf, msgs->len);
+- if (rc < 0)
+- dev_err(&adap->dev, "I2C %s 0x%02x failed, err %d\n",
+- addrdir & 1 ? "read from" : "write to", addrdir >> 1,
+- rc);
++ if (rc < 0) {
++ if (rc == -ENXIO)
++ dev_dbg(&adap->dev, "I2C %s 0x%02x failed, err %d\n",
++ addrdir & 1 ? "read from" : "write to",
++ addrdir >> 1, rc);
++ else
++ dev_err(&adap->dev, "I2C %s 0x%02x failed, err %d\n",
++ addrdir & 1 ? "read from" : "write to",
++ addrdir >> 1, rc);
++ }
+ bail:
+ pmac_i2c_close(bus);
+ return rc < 0 ? rc : 1;
+diff --git a/drivers/ide/icside.c b/drivers/ide/icside.c
+index 0f67f1a..d7e6f09 100644
+--- a/drivers/ide/icside.c
++++ b/drivers/ide/icside.c
+@@ -65,6 +65,8 @@ static struct cardinfo icside_cardinfo_v6_2 = {
+ };
+
+ struct icside_state {
++ unsigned int channel;
++ unsigned int enabled;
+ void __iomem *irq_port;
+ void __iomem *ioc_base;
+ unsigned int sel;
+@@ -114,11 +116,18 @@ static void icside_irqenable_arcin_v6 (struct expansion_card *ec, int irqnr)
+ struct icside_state *state = ec->irq_data;
+ void __iomem *base = state->irq_port;
+
+- writeb(0, base + ICS_ARCIN_V6_INTROFFSET_1);
+- readb(base + ICS_ARCIN_V6_INTROFFSET_2);
++ state->enabled = 1;
+
+- writeb(0, base + ICS_ARCIN_V6_INTROFFSET_2);
+- readb(base + ICS_ARCIN_V6_INTROFFSET_1);
++ switch (state->channel) {
++ case 0:
++ writeb(0, base + ICS_ARCIN_V6_INTROFFSET_1);
++ readb(base + ICS_ARCIN_V6_INTROFFSET_2);
++ break;
++ case 1:
++ writeb(0, base + ICS_ARCIN_V6_INTROFFSET_2);
++ readb(base + ICS_ARCIN_V6_INTROFFSET_1);
++ break;
++ }
+ }
+
+ /* Prototype: icside_irqdisable_arcin_v6 (struct expansion_card *ec, int irqnr)
+@@ -128,6 +137,8 @@ static void icside_irqdisable_arcin_v6 (struct expansion_card *ec, int irqnr)
+ {
+ struct icside_state *state = ec->irq_data;
+
++ state->enabled = 0;
++
+ readb(state->irq_port + ICS_ARCIN_V6_INTROFFSET_1);
+ readb(state->irq_port + ICS_ARCIN_V6_INTROFFSET_2);
+ }
+@@ -149,6 +160,44 @@ static const expansioncard_ops_t icside_ops_arcin_v6 = {
+ .irqpending = icside_irqpending_arcin_v6,
+ };
+
++/*
++ * Handle routing of interrupts. This is called before
++ * we write the command to the drive.
++ */
++static void icside_maskproc(ide_drive_t *drive, int mask)
++{
++ ide_hwif_t *hwif = drive->hwif;
++ struct expansion_card *ec = ECARD_DEV(hwif->dev);
++ struct icside_state *state = ecard_get_drvdata(ec);
++ unsigned long flags;
++
++ local_irq_save(flags);
++
++ state->channel = hwif->channel;
++
++ if (state->enabled && !mask) {
++ switch (hwif->channel) {
++ case 0:
++ writeb(0, state->irq_port + ICS_ARCIN_V6_INTROFFSET_1);
++ readb(state->irq_port + ICS_ARCIN_V6_INTROFFSET_2);
++ break;
++ case 1:
++ writeb(0, state->irq_port + ICS_ARCIN_V6_INTROFFSET_2);
++ readb(state->irq_port + ICS_ARCIN_V6_INTROFFSET_1);
++ break;
++ }
++ } else {
++ readb(state->irq_port + ICS_ARCIN_V6_INTROFFSET_2);
++ readb(state->irq_port + ICS_ARCIN_V6_INTROFFSET_1);
++ }
++
++ local_irq_restore(flags);
++}
++
++static const struct ide_port_ops icside_v6_no_dma_port_ops = {
++ .maskproc = icside_maskproc,
++};
++
+ #ifdef CONFIG_BLK_DEV_IDEDMA_ICS
+ /*
+ * SG-DMA support.
+@@ -228,6 +277,7 @@ static void icside_set_dma_mode(ide_drive_t *drive, const u8 xfer_mode)
+
+ static const struct ide_port_ops icside_v6_port_ops = {
+ .set_dma_mode = icside_set_dma_mode,
++ .maskproc = icside_maskproc,
+ };
+
+ static void icside_dma_host_set(ide_drive_t *drive, int on)
+@@ -272,6 +322,11 @@ static int icside_dma_setup(ide_drive_t *drive, struct ide_cmd *cmd)
+ BUG_ON(dma_channel_active(ec->dma));
+
+ /*
++ * Ensure that we have the right interrupt routed.
++ */
++ icside_maskproc(drive, 0);
++
++ /*
+ * Route the DMA signals to the correct interface.
+ */
+ writeb(state->sel | hwif->channel, state->ioc_base);
+@@ -399,6 +454,7 @@ err_free:
+
+ static const struct ide_port_info icside_v6_port_info __initdata = {
+ .init_dma = icside_dma_off_init,
++ .port_ops = &icside_v6_no_dma_port_ops,
+ .dma_ops = &icside_v6_dma_ops,
+ .host_flags = IDE_HFLAG_SERIALIZE | IDE_HFLAG_MMIO,
+ .mwdma_mask = ATA_MWDMA2,
+diff --git a/drivers/ide/ide-probe.c b/drivers/ide/ide-probe.c
+index 4d76ba4..0c11237 100644
+--- a/drivers/ide/ide-probe.c
++++ b/drivers/ide/ide-probe.c
+@@ -695,14 +695,8 @@ static int ide_probe_port(ide_hwif_t *hwif)
+ if (irqd)
+ disable_irq(hwif->irq);
+
+- rc = ide_port_wait_ready(hwif);
+- if (rc == -ENODEV) {
+- printk(KERN_INFO "%s: no devices on the port\n", hwif->name);
+- goto out;
+- } else if (rc == -EBUSY)
+- printk(KERN_ERR "%s: not ready before the probe\n", hwif->name);
+- else
+- rc = -ENODEV;
++ if (ide_port_wait_ready(hwif) == -EBUSY)
++ printk(KERN_DEBUG "%s: Wait for ready failed before probe !\n", hwif->name);
+
+ /*
+ * Second drive should only exist if first drive was found,
+@@ -713,7 +707,7 @@ static int ide_probe_port(ide_hwif_t *hwif)
+ if (drive->dev_flags & IDE_DFLAG_PRESENT)
+ rc = 0;
+ }
+-out:
++
+ /*
+ * Use cached IRQ number. It might be (and is...) changed by probe
+ * code above
+diff --git a/drivers/ide/pdc202xx_old.c b/drivers/ide/pdc202xx_old.c
+index 35161dd..e3bca38 100644
+--- a/drivers/ide/pdc202xx_old.c
++++ b/drivers/ide/pdc202xx_old.c
+@@ -100,13 +100,13 @@ static int pdc202xx_test_irq(ide_hwif_t *hwif)
+ * bit 7: error, bit 6: interrupting,
+ * bit 5: FIFO full, bit 4: FIFO empty
+ */
+- return ((sc1d & 0x50) == 0x40) ? 1 : 0;
++ return ((sc1d & 0x50) == 0x50) ? 1 : 0;
+ } else {
+ /*
+ * bit 3: error, bit 2: interrupting,
+ * bit 1: FIFO full, bit 0: FIFO empty
+ */
+- return ((sc1d & 0x05) == 0x04) ? 1 : 0;
++ return ((sc1d & 0x05) == 0x05) ? 1 : 0;
+ }
+ }
+
+diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
+index f93c2c0..f6dad83 100644
+--- a/drivers/input/mouse/alps.c
++++ b/drivers/input/mouse/alps.c
+@@ -63,6 +63,8 @@ static const struct alps_model_info alps_model_data[] = {
+ { { 0x62, 0x02, 0x14 }, 0xcf, 0xcf,
+ ALPS_PASS | ALPS_DUALPOINT | ALPS_PS2_INTERLEAVED },
+ { { 0x73, 0x02, 0x50 }, 0xcf, 0xcf, ALPS_FOUR_BUTTONS }, /* Dell Vostro 1400 */
++ { { 0x52, 0x01, 0x14 }, 0xff, 0xff,
++ ALPS_PASS | ALPS_DUALPOINT | ALPS_PS2_INTERLEAVED }, /* Toshiba Tecra A11-11L */
+ };
+
+ /*
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index 2a5982e..525b9b9 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -442,6 +442,13 @@ static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = {
+ },
+ },
+ {
++ /* Medion Akoya E1222 */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "MEDION"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "E122X"),
++ },
++ },
++ {
+ /* Mivvy M310 */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "VIOOO"),
+diff --git a/drivers/isdn/gigaset/capi.c b/drivers/isdn/gigaset/capi.c
+index 3f5cd06..6b6c25d 100644
+--- a/drivers/isdn/gigaset/capi.c
++++ b/drivers/isdn/gigaset/capi.c
+@@ -1313,7 +1313,7 @@ static void do_connect_req(struct gigaset_capi_ctr *iif,
+ }
+
+ /* check parameter: CIP Value */
+- if (cmsg->CIPValue > ARRAY_SIZE(cip2bchlc) ||
++ if (cmsg->CIPValue >= ARRAY_SIZE(cip2bchlc) ||
+ (cmsg->CIPValue > 0 && cip2bchlc[cmsg->CIPValue].bc == NULL)) {
+ dev_notice(cs->dev, "%s: unknown CIP value %d\n",
+ "CONNECT_REQ", cmsg->CIPValue);
+@@ -2215,36 +2215,24 @@ static int gigaset_ctr_read_proc(char *page, char **start, off_t off,
+ }
+
+
+-static struct capi_driver capi_driver_gigaset = {
+- .name = "gigaset",
+- .revision = "1.0",
+-};
+-
+ /**
+- * gigaset_isdn_register() - register to LL
++ * gigaset_isdn_regdev() - register device to LL
+ * @cs: device descriptor structure.
+ * @isdnid: device name.
+ *
+- * Called by main module to register the device with the LL.
+- *
+ * Return value: 1 for success, 0 for failure
+ */
+-int gigaset_isdn_register(struct cardstate *cs, const char *isdnid)
++int gigaset_isdn_regdev(struct cardstate *cs, const char *isdnid)
+ {
+ struct gigaset_capi_ctr *iif;
+ int rc;
+
+- pr_info("Kernel CAPI interface\n");
+-
+ iif = kmalloc(sizeof(*iif), GFP_KERNEL);
+ if (!iif) {
+ pr_err("%s: out of memory\n", __func__);
+ return 0;
+ }
+
+- /* register driver with CAPI (ToDo: what for?) */
+- register_capi_driver(&capi_driver_gigaset);
+-
+ /* prepare controller structure */
+ iif->ctr.owner = THIS_MODULE;
+ iif->ctr.driverdata = cs;
+@@ -2265,7 +2253,6 @@ int gigaset_isdn_register(struct cardstate *cs, const char *isdnid)
+ rc = attach_capi_ctr(&iif->ctr);
+ if (rc) {
+ pr_err("attach_capi_ctr failed (%d)\n", rc);
+- unregister_capi_driver(&capi_driver_gigaset);
+ kfree(iif);
+ return 0;
+ }
+@@ -2276,17 +2263,36 @@ int gigaset_isdn_register(struct cardstate *cs, const char *isdnid)
+ }
+
+ /**
+- * gigaset_isdn_unregister() - unregister from LL
++ * gigaset_isdn_unregdev() - unregister device from LL
+ * @cs: device descriptor structure.
+- *
+- * Called by main module to unregister the device from the LL.
+ */
+-void gigaset_isdn_unregister(struct cardstate *cs)
++void gigaset_isdn_unregdev(struct cardstate *cs)
+ {
+ struct gigaset_capi_ctr *iif = cs->iif;
+
+ detach_capi_ctr(&iif->ctr);
+ kfree(iif);
+ cs->iif = NULL;
++}
++
++static struct capi_driver capi_driver_gigaset = {
++ .name = "gigaset",
++ .revision = "1.0",
++};
++
++/**
++ * gigaset_isdn_regdrv() - register driver to LL
++ */
++void gigaset_isdn_regdrv(void)
++{
++ pr_info("Kernel CAPI interface\n");
++ register_capi_driver(&capi_driver_gigaset);
++}
++
++/**
++ * gigaset_isdn_unregdrv() - unregister driver from LL
++ */
++void gigaset_isdn_unregdrv(void)
++{
+ unregister_capi_driver(&capi_driver_gigaset);
+ }
+diff --git a/drivers/isdn/gigaset/common.c b/drivers/isdn/gigaset/common.c
+index 664b0c5..0427fac 100644
+--- a/drivers/isdn/gigaset/common.c
++++ b/drivers/isdn/gigaset/common.c
+@@ -505,7 +505,7 @@ void gigaset_freecs(struct cardstate *cs)
+ case 2: /* error in initcshw */
+ /* Deregister from LL */
+ make_invalid(cs, VALID_ID);
+- gigaset_isdn_unregister(cs);
++ gigaset_isdn_unregdev(cs);
+
+ /* fall through */
+ case 1: /* error when registering to LL */
+@@ -767,7 +767,7 @@ struct cardstate *gigaset_initcs(struct gigaset_driver *drv, int channels,
+ cs->cmdbytes = 0;
+
+ gig_dbg(DEBUG_INIT, "setting up iif");
+- if (!gigaset_isdn_register(cs, modulename)) {
++ if (!gigaset_isdn_regdev(cs, modulename)) {
+ pr_err("error registering ISDN device\n");
+ goto error;
+ }
+@@ -1214,11 +1214,13 @@ static int __init gigaset_init_module(void)
+ gigaset_debuglevel = DEBUG_DEFAULT;
+
+ pr_info(DRIVER_DESC DRIVER_DESC_DEBUG "\n");
++ gigaset_isdn_regdrv();
+ return 0;
+ }
+
+ static void __exit gigaset_exit_module(void)
+ {
++ gigaset_isdn_unregdrv();
+ }
+
+ module_init(gigaset_init_module);
+diff --git a/drivers/isdn/gigaset/dummyll.c b/drivers/isdn/gigaset/dummyll.c
+index 5b27c99..bd0b1ea 100644
+--- a/drivers/isdn/gigaset/dummyll.c
++++ b/drivers/isdn/gigaset/dummyll.c
+@@ -57,12 +57,20 @@ void gigaset_isdn_stop(struct cardstate *cs)
+ {
+ }
+
+-int gigaset_isdn_register(struct cardstate *cs, const char *isdnid)
++int gigaset_isdn_regdev(struct cardstate *cs, const char *isdnid)
+ {
+- pr_info("no ISDN subsystem interface\n");
+ return 1;
+ }
+
+-void gigaset_isdn_unregister(struct cardstate *cs)
++void gigaset_isdn_unregdev(struct cardstate *cs)
++{
++}
++
++void gigaset_isdn_regdrv(void)
++{
++ pr_info("no ISDN subsystem interface\n");
++}
++
++void gigaset_isdn_unregdrv(void)
+ {
+ }
+diff --git a/drivers/isdn/gigaset/ev-layer.c b/drivers/isdn/gigaset/ev-layer.c
+index ddeb045..0304d02 100644
+--- a/drivers/isdn/gigaset/ev-layer.c
++++ b/drivers/isdn/gigaset/ev-layer.c
+@@ -1259,14 +1259,10 @@ static void do_action(int action, struct cardstate *cs,
+ * note that bcs may be NULL if no B channel is free
+ */
+ at_state2->ConState = 700;
+- kfree(at_state2->str_var[STR_NMBR]);
+- at_state2->str_var[STR_NMBR] = NULL;
+- kfree(at_state2->str_var[STR_ZCPN]);
+- at_state2->str_var[STR_ZCPN] = NULL;
+- kfree(at_state2->str_var[STR_ZBC]);
+- at_state2->str_var[STR_ZBC] = NULL;
+- kfree(at_state2->str_var[STR_ZHLC]);
+- at_state2->str_var[STR_ZHLC] = NULL;
++ for (i = 0; i < STR_NUM; ++i) {
++ kfree(at_state2->str_var[i]);
++ at_state2->str_var[i] = NULL;
++ }
+ at_state2->int_var[VAR_ZCTP] = -1;
+
+ spin_lock_irqsave(&cs->lock, flags);
+diff --git a/drivers/isdn/gigaset/gigaset.h b/drivers/isdn/gigaset/gigaset.h
+index e963a6c..62909b2 100644
+--- a/drivers/isdn/gigaset/gigaset.h
++++ b/drivers/isdn/gigaset/gigaset.h
+@@ -674,8 +674,10 @@ int gigaset_isowbuf_getbytes(struct isowbuf_t *iwb, int size);
+ */
+
+ /* Called from common.c for setting up/shutting down with the ISDN subsystem */
+-int gigaset_isdn_register(struct cardstate *cs, const char *isdnid);
+-void gigaset_isdn_unregister(struct cardstate *cs);
++void gigaset_isdn_regdrv(void);
++void gigaset_isdn_unregdrv(void);
++int gigaset_isdn_regdev(struct cardstate *cs, const char *isdnid);
++void gigaset_isdn_unregdev(struct cardstate *cs);
+
+ /* Called from hardware module to indicate completion of an skb */
+ void gigaset_skb_sent(struct bc_state *bcs, struct sk_buff *skb);
+diff --git a/drivers/isdn/gigaset/i4l.c b/drivers/isdn/gigaset/i4l.c
+index c129ee4..6429a6b 100644
+--- a/drivers/isdn/gigaset/i4l.c
++++ b/drivers/isdn/gigaset/i4l.c
+@@ -632,15 +632,13 @@ void gigaset_isdn_stop(struct cardstate *cs)
+ }
+
+ /**
+- * gigaset_isdn_register() - register to LL
++ * gigaset_isdn_regdev() - register to LL
+ * @cs: device descriptor structure.
+ * @isdnid: device name.
+ *
+- * Called by main module to register the device with the LL.
+- *
+ * Return value: 1 for success, 0 for failure
+ */
+-int gigaset_isdn_register(struct cardstate *cs, const char *isdnid)
++int gigaset_isdn_regdev(struct cardstate *cs, const char *isdnid)
+ {
+ isdn_if *iif;
+
+@@ -690,15 +688,29 @@ int gigaset_isdn_register(struct cardstate *cs, const char *isdnid)
+ }
+
+ /**
+- * gigaset_isdn_unregister() - unregister from LL
++ * gigaset_isdn_unregdev() - unregister device from LL
+ * @cs: device descriptor structure.
+- *
+- * Called by main module to unregister the device from the LL.
+ */
+-void gigaset_isdn_unregister(struct cardstate *cs)
++void gigaset_isdn_unregdev(struct cardstate *cs)
+ {
+ gig_dbg(DEBUG_CMD, "sending UNLOAD");
+ gigaset_i4l_cmd(cs, ISDN_STAT_UNLOAD);
+ kfree(cs->iif);
+ cs->iif = NULL;
+ }
++
++/**
++ * gigaset_isdn_regdrv() - register driver to LL
++ */
++void gigaset_isdn_regdrv(void)
++{
++ /* nothing to do */
++}
++
++/**
++ * gigaset_isdn_unregdrv() - unregister driver from LL
++ */
++void gigaset_isdn_unregdrv(void)
++{
++ /* nothing to do */
++}
+diff --git a/drivers/isdn/gigaset/interface.c b/drivers/isdn/gigaset/interface.c
+index d2260b0..07bb299 100644
+--- a/drivers/isdn/gigaset/interface.c
++++ b/drivers/isdn/gigaset/interface.c
+@@ -632,7 +632,6 @@ void gigaset_if_receive(struct cardstate *cs,
+ if (tty == NULL)
+ gig_dbg(DEBUG_ANY, "receive on closed device");
+ else {
+- tty_buffer_request_room(tty, len);
+ tty_insert_flip_string(tty, buffer, len);
+ tty_flip_buffer_push(tty);
+ }
+diff --git a/drivers/leds/leds-gpio.c b/drivers/leds/leds-gpio.c
+index e5225d2..0823e26 100644
+--- a/drivers/leds/leds-gpio.c
++++ b/drivers/leds/leds-gpio.c
+@@ -211,7 +211,6 @@ static int __devinit of_gpio_leds_probe(struct of_device *ofdev,
+ const struct of_device_id *match)
+ {
+ struct device_node *np = ofdev->node, *child;
+- struct gpio_led led;
+ struct gpio_led_of_platform_data *pdata;
+ int count = 0, ret;
+
+@@ -226,8 +225,8 @@ static int __devinit of_gpio_leds_probe(struct of_device *ofdev,
+ if (!pdata)
+ return -ENOMEM;
+
+- memset(&led, 0, sizeof(led));
+ for_each_child_of_node(np, child) {
++ struct gpio_led led = {};
+ enum of_gpio_flags flags;
+ const char *state;
+
+diff --git a/drivers/media/video/em28xx/em28xx-dvb.c b/drivers/media/video/em28xx/em28xx-dvb.c
+index cc0505e..6b0a495 100644
+--- a/drivers/media/video/em28xx/em28xx-dvb.c
++++ b/drivers/media/video/em28xx/em28xx-dvb.c
+@@ -606,6 +606,7 @@ static int dvb_fini(struct em28xx *dev)
+
+ if (dev->dvb) {
+ unregister_dvb(dev->dvb);
++ kfree(dev->dvb);
+ dev->dvb = NULL;
+ }
+
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index efa0e41..1f800ae 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -4935,6 +4935,8 @@ int bond_create(struct net *net, const char *name)
+ }
+
+ res = register_netdevice(bond_dev);
++ if (res < 0)
++ goto out_netdev;
+
+ out:
+ rtnl_unlock();
+diff --git a/drivers/net/can/bfin_can.c b/drivers/net/can/bfin_can.c
+index 0ec1524..fe5e320 100644
+--- a/drivers/net/can/bfin_can.c
++++ b/drivers/net/can/bfin_can.c
+@@ -26,6 +26,7 @@
+
+ #define DRV_NAME "bfin_can"
+ #define BFIN_CAN_TIMEOUT 100
++#define TX_ECHO_SKB_MAX 1
+
+ /*
+ * transmit and receive channels
+@@ -590,7 +591,7 @@ struct net_device *alloc_bfin_candev(void)
+ struct net_device *dev;
+ struct bfin_can_priv *priv;
+
+- dev = alloc_candev(sizeof(*priv));
++ dev = alloc_candev(sizeof(*priv), TX_ECHO_SKB_MAX);
+ if (!dev)
+ return NULL;
+
+diff --git a/drivers/net/e100.c b/drivers/net/e100.c
+index 839fb2b..a565ea1 100644
+--- a/drivers/net/e100.c
++++ b/drivers/net/e100.c
+@@ -2854,7 +2854,7 @@ static int __devinit e100_probe(struct pci_dev *pdev,
+ }
+ nic->cbs_pool = pci_pool_create(netdev->name,
+ nic->pdev,
+- nic->params.cbs.count * sizeof(struct cb),
++ nic->params.cbs.max * sizeof(struct cb),
+ sizeof(u32),
+ 0);
+ DPRINTK(PROBE, INFO, "addr 0x%llx, irq %d, MAC addr %pM\n",
+diff --git a/drivers/net/jme.c b/drivers/net/jme.c
+index 792b88f..981c9fb 100644
+--- a/drivers/net/jme.c
++++ b/drivers/net/jme.c
+@@ -946,6 +946,8 @@ jme_alloc_and_feed_skb(struct jme_adapter *jme, int idx)
+ jme->jme_vlan_rx(skb, jme->vlgrp,
+ le16_to_cpu(rxdesc->descwb.vlan));
+ NET_STAT(jme).rx_bytes += 4;
++ } else {
++ dev_kfree_skb(skb);
+ }
+ } else {
+ jme->jme_rx(skb);
+@@ -2085,12 +2087,45 @@ jme_tx_timeout(struct net_device *netdev)
+ jme_reset_link(jme);
+ }
+
++static inline void jme_pause_rx(struct jme_adapter *jme)
++{
++ atomic_dec(&jme->link_changing);
++
++ jme_set_rx_pcc(jme, PCC_OFF);
++ if (test_bit(JME_FLAG_POLL, &jme->flags)) {
++ JME_NAPI_DISABLE(jme);
++ } else {
++ tasklet_disable(&jme->rxclean_task);
++ tasklet_disable(&jme->rxempty_task);
++ }
++}
++
++static inline void jme_resume_rx(struct jme_adapter *jme)
++{
++ struct dynpcc_info *dpi = &(jme->dpi);
++
++ if (test_bit(JME_FLAG_POLL, &jme->flags)) {
++ JME_NAPI_ENABLE(jme);
++ } else {
++ tasklet_hi_enable(&jme->rxclean_task);
++ tasklet_hi_enable(&jme->rxempty_task);
++ }
++ dpi->cur = PCC_P1;
++ dpi->attempt = PCC_P1;
++ dpi->cnt = 0;
++ jme_set_rx_pcc(jme, PCC_P1);
++
++ atomic_inc(&jme->link_changing);
++}
++
+ static void
+ jme_vlan_rx_register(struct net_device *netdev, struct vlan_group *grp)
+ {
+ struct jme_adapter *jme = netdev_priv(netdev);
+
++ jme_pause_rx(jme);
+ jme->vlgrp = grp;
++ jme_resume_rx(jme);
+ }
+
+ static void
+diff --git a/drivers/net/pppol2tp.c b/drivers/net/pppol2tp.c
+index 9fbb2eb..449a982 100644
+--- a/drivers/net/pppol2tp.c
++++ b/drivers/net/pppol2tp.c
+@@ -756,6 +756,7 @@ static int pppol2tp_recv_core(struct sock *sock, struct sk_buff *skb)
+
+ /* Try to dequeue as many skbs from reorder_q as we can. */
+ pppol2tp_recv_dequeue(session);
++ sock_put(sock);
+
+ return 0;
+
+@@ -772,6 +773,7 @@ discard_bad_csum:
+ UDP_INC_STATS_USER(&init_net, UDP_MIB_INERRORS, 0);
+ tunnel->stats.rx_errors++;
+ kfree_skb(skb);
++ sock_put(sock);
+
+ return 0;
+
+@@ -1180,7 +1182,8 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
+ /* Calculate UDP checksum if configured to do so */
+ if (sk_tun->sk_no_check == UDP_CSUM_NOXMIT)
+ skb->ip_summed = CHECKSUM_NONE;
+- else if (!(skb_dst(skb)->dev->features & NETIF_F_V4_CSUM)) {
++ else if ((skb_dst(skb) && skb_dst(skb)->dev) &&
++ (!(skb_dst(skb)->dev->features & NETIF_F_V4_CSUM))) {
+ skb->ip_summed = CHECKSUM_COMPLETE;
+ csum = skb_checksum(skb, 0, udp_len, 0);
+ uh->check = csum_tcpudp_magic(inet->inet_saddr,
+@@ -1661,6 +1664,7 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
+ if (tunnel_sock == NULL)
+ goto end;
+
++ sock_hold(tunnel_sock);
+ tunnel = tunnel_sock->sk_user_data;
+ } else {
+ tunnel = pppol2tp_tunnel_find(sock_net(sk), sp->pppol2tp.s_tunnel);
+diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
+index 60f96c4..67d414b 100644
+--- a/drivers/net/r8169.c
++++ b/drivers/net/r8169.c
+@@ -186,7 +186,12 @@ static struct pci_device_id rtl8169_pci_tbl[] = {
+
+ MODULE_DEVICE_TABLE(pci, rtl8169_pci_tbl);
+
+-static int rx_copybreak = 200;
++/*
++ * we set our copybreak very high so that we don't have
++ * to allocate 16k frames all the time (see note in
++ * rtl8169_open()
++ */
++static int rx_copybreak = 16383;
+ static int use_dac;
+ static struct {
+ u32 msg_enable;
+@@ -3245,9 +3250,13 @@ static void __devexit rtl8169_remove_one(struct pci_dev *pdev)
+ }
+
+ static void rtl8169_set_rxbufsize(struct rtl8169_private *tp,
+- struct net_device *dev)
++ unsigned int mtu)
+ {
+- unsigned int max_frame = dev->mtu + VLAN_ETH_HLEN + ETH_FCS_LEN;
++ unsigned int max_frame = mtu + VLAN_ETH_HLEN + ETH_FCS_LEN;
++
++ if (max_frame != 16383)
++ printk(KERN_WARNING "WARNING! Changing of MTU on this NIC"
++ "May lead to frame reception errors!\n");
+
+ tp->rx_buf_sz = (max_frame > RX_BUF_SIZE) ? max_frame : RX_BUF_SIZE;
+ }
+@@ -3259,7 +3268,17 @@ static int rtl8169_open(struct net_device *dev)
+ int retval = -ENOMEM;
+
+
+- rtl8169_set_rxbufsize(tp, dev);
++ /*
++ * Note that we use a magic value here, its wierd I know
++ * its done because, some subset of rtl8169 hardware suffers from
++ * a problem in which frames received that are longer than
++ * the size set in RxMaxSize register return garbage sizes
++ * when received. To avoid this we need to turn off filtering,
++ * which is done by setting a value of 16383 in the RxMaxSize register
++ * and allocating 16k frames to handle the largest possible rx value
++ * thats what the magic math below does.
++ */
++ rtl8169_set_rxbufsize(tp, 16383 - VLAN_ETH_HLEN - ETH_FCS_LEN);
+
+ /*
+ * Rx and Tx desscriptors needs 256 bytes alignment.
+@@ -3912,7 +3931,7 @@ static int rtl8169_change_mtu(struct net_device *dev, int new_mtu)
+
+ rtl8169_down(dev);
+
+- rtl8169_set_rxbufsize(tp, dev);
++ rtl8169_set_rxbufsize(tp, dev->mtu);
+
+ ret = rtl8169_init_ring(dev);
+ if (ret < 0)
+diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
+index 7f82b02..17d1493 100644
+--- a/drivers/net/tg3.c
++++ b/drivers/net/tg3.c
+@@ -5223,7 +5223,7 @@ static void tg3_poll_controller(struct net_device *dev)
+ struct tg3 *tp = netdev_priv(dev);
+
+ for (i = 0; i < tp->irq_cnt; i++)
+- tg3_interrupt(tp->napi[i].irq_vec, dev);
++ tg3_interrupt(tp->napi[i].irq_vec, &tp->napi[i]);
+ }
+ #endif
+
+diff --git a/drivers/net/wireless/ath/ath5k/ath5k.h b/drivers/net/wireless/ath/ath5k/ath5k.h
+index bbd2f31..8b43089 100644
+--- a/drivers/net/wireless/ath/ath5k/ath5k.h
++++ b/drivers/net/wireless/ath/ath5k/ath5k.h
+@@ -535,7 +535,7 @@ struct ath5k_txq_info {
+ u32 tqi_cbr_period; /* Constant bit rate period */
+ u32 tqi_cbr_overflow_limit;
+ u32 tqi_burst_time;
+- u32 tqi_ready_time; /* Not used */
++ u32 tqi_ready_time; /* Time queue waits after an event */
+ };
+
+ /*
+diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
+index d6ee8ac..ced648b 100644
+--- a/drivers/net/wireless/ath/ath5k/base.c
++++ b/drivers/net/wireless/ath/ath5k/base.c
+@@ -1537,7 +1537,8 @@ ath5k_beaconq_config(struct ath5k_softc *sc)
+
+ ret = ath5k_hw_get_tx_queueprops(ah, sc->bhalq, &qi);
+ if (ret)
+- return ret;
++ goto err;
++
+ if (sc->opmode == NL80211_IFTYPE_AP ||
+ sc->opmode == NL80211_IFTYPE_MESH_POINT) {
+ /*
+@@ -1564,10 +1565,25 @@ ath5k_beaconq_config(struct ath5k_softc *sc)
+ if (ret) {
+ ATH5K_ERR(sc, "%s: unable to update parameters for beacon "
+ "hardware queue!\n", __func__);
+- return ret;
++ goto err;
+ }
++ ret = ath5k_hw_reset_tx_queue(ah, sc->bhalq); /* push to h/w */
++ if (ret)
++ goto err;
+
+- return ath5k_hw_reset_tx_queue(ah, sc->bhalq); /* push to h/w */;
++ /* reconfigure cabq with ready time to 80% of beacon_interval */
++ ret = ath5k_hw_get_tx_queueprops(ah, AR5K_TX_QUEUE_ID_CAB, &qi);
++ if (ret)
++ goto err;
++
++ qi.tqi_ready_time = (sc->bintval * 80) / 100;
++ ret = ath5k_hw_set_tx_queueprops(ah, AR5K_TX_QUEUE_ID_CAB, &qi);
++ if (ret)
++ goto err;
++
++ ret = ath5k_hw_reset_tx_queue(ah, AR5K_TX_QUEUE_ID_CAB);
++err:
++ return ret;
+ }
+
+ static void
+diff --git a/drivers/net/wireless/ath/ath5k/phy.c b/drivers/net/wireless/ath/ath5k/phy.c
+index 72474c0..97df0d9 100644
+--- a/drivers/net/wireless/ath/ath5k/phy.c
++++ b/drivers/net/wireless/ath/ath5k/phy.c
+@@ -1386,38 +1386,39 @@ static int ath5k_hw_rf511x_calibrate(struct ath5k_hw *ah,
+ goto done;
+
+ /* Calibration has finished, get the results and re-run */
++
++ /* work around empty results which can apparently happen on 5212 */
+ for (i = 0; i <= 10; i++) {
+ iq_corr = ath5k_hw_reg_read(ah, AR5K_PHY_IQRES_CAL_CORR);
+ i_pwr = ath5k_hw_reg_read(ah, AR5K_PHY_IQRES_CAL_PWR_I);
+ q_pwr = ath5k_hw_reg_read(ah, AR5K_PHY_IQRES_CAL_PWR_Q);
++ ATH5K_DBG_UNLIMIT(ah->ah_sc, ATH5K_DEBUG_CALIBRATE,
++ "iq_corr:%x i_pwr:%x q_pwr:%x", iq_corr, i_pwr, q_pwr);
++ if (i_pwr && q_pwr)
++ break;
+ }
+
+ i_coffd = ((i_pwr >> 1) + (q_pwr >> 1)) >> 7;
+ q_coffd = q_pwr >> 7;
+
+- /* No correction */
+- if (i_coffd == 0 || q_coffd == 0)
++ /* protect against divide by 0 and loss of sign bits */
++ if (i_coffd == 0 || q_coffd < 2)
+ goto done;
+
+- i_coff = ((-iq_corr) / i_coffd);
++ i_coff = (-iq_corr) / i_coffd;
++ i_coff = clamp(i_coff, -32, 31); /* signed 6 bit */
+
+- /* Boundary check */
+- if (i_coff > 31)
+- i_coff = 31;
+- if (i_coff < -32)
+- i_coff = -32;
++ q_coff = (i_pwr / q_coffd) - 128;
++ q_coff = clamp(q_coff, -16, 15); /* signed 5 bit */
+
+- q_coff = (((s32)i_pwr / q_coffd) - 128);
++ ATH5K_DBG_UNLIMIT(ah->ah_sc, ATH5K_DEBUG_CALIBRATE,
++ "new I:%d Q:%d (i_coffd:%x q_coffd:%x)",
++ i_coff, q_coff, i_coffd, q_coffd);
+
+- /* Boundary check */
+- if (q_coff > 15)
+- q_coff = 15;
+- if (q_coff < -16)
+- q_coff = -16;
+-
+- /* Commit new I/Q value */
+- AR5K_REG_ENABLE_BITS(ah, AR5K_PHY_IQ, AR5K_PHY_IQ_CORR_ENABLE |
+- ((u32)q_coff) | ((u32)i_coff << AR5K_PHY_IQ_CORR_Q_I_COFF_S));
++ /* Commit new I/Q values (set enable bit last to match HAL sources) */
++ AR5K_REG_WRITE_BITS(ah, AR5K_PHY_IQ, AR5K_PHY_IQ_CORR_Q_I_COFF, i_coff);
++ AR5K_REG_WRITE_BITS(ah, AR5K_PHY_IQ, AR5K_PHY_IQ_CORR_Q_Q_COFF, q_coff);
++ AR5K_REG_ENABLE_BITS(ah, AR5K_PHY_IQ, AR5K_PHY_IQ_CORR_ENABLE);
+
+ /* Re-enable calibration -if we don't we'll commit
+ * the same values again and again */
+diff --git a/drivers/net/wireless/ath/ath5k/qcu.c b/drivers/net/wireless/ath/ath5k/qcu.c
+index eeebb9a..b7c5725 100644
+--- a/drivers/net/wireless/ath/ath5k/qcu.c
++++ b/drivers/net/wireless/ath/ath5k/qcu.c
+@@ -408,12 +408,13 @@ int ath5k_hw_reset_tx_queue(struct ath5k_hw *ah, unsigned int queue)
+ break;
+
+ case AR5K_TX_QUEUE_CAB:
++ /* XXX: use BCN_SENT_GT, if we can figure out how */
+ AR5K_REG_ENABLE_BITS(ah, AR5K_QUEUE_MISC(queue),
+- AR5K_QCU_MISC_FRSHED_BCN_SENT_GT |
++ AR5K_QCU_MISC_FRSHED_DBA_GT |
+ AR5K_QCU_MISC_CBREXP_DIS |
+ AR5K_QCU_MISC_CBREXP_BCN_DIS);
+
+- ath5k_hw_reg_write(ah, ((AR5K_TUNE_BEACON_INTERVAL -
++ ath5k_hw_reg_write(ah, ((tq->tqi_ready_time -
+ (AR5K_TUNE_SW_BEACON_RESP -
+ AR5K_TUNE_DMA_BEACON_RESP) -
+ AR5K_TUNE_ADDITIONAL_SWBA_BACKOFF) * 1024) |
+diff --git a/drivers/net/wireless/ath/ath5k/reg.h b/drivers/net/wireless/ath/ath5k/reg.h
+index 4cb9c5d..1464f89 100644
+--- a/drivers/net/wireless/ath/ath5k/reg.h
++++ b/drivers/net/wireless/ath/ath5k/reg.h
+@@ -2187,6 +2187,7 @@
+ */
+ #define AR5K_PHY_IQ 0x9920 /* Register Address */
+ #define AR5K_PHY_IQ_CORR_Q_Q_COFF 0x0000001f /* Mask for q correction info */
++#define AR5K_PHY_IQ_CORR_Q_Q_COFF_S 0
+ #define AR5K_PHY_IQ_CORR_Q_I_COFF 0x000007e0 /* Mask for i correction info */
+ #define AR5K_PHY_IQ_CORR_Q_I_COFF_S 5
+ #define AR5K_PHY_IQ_CORR_ENABLE 0x00000800 /* Enable i/q correction */
+diff --git a/drivers/net/wireless/ath/ath5k/reset.c b/drivers/net/wireless/ath/ath5k/reset.c
+index 62954fc..dbc52ee 100644
+--- a/drivers/net/wireless/ath/ath5k/reset.c
++++ b/drivers/net/wireless/ath/ath5k/reset.c
+@@ -1371,8 +1371,9 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum nl80211_iftype op_mode,
+ * Set clocks to 32KHz operation and use an
+ * external 32KHz crystal when sleeping if one
+ * exists */
+- if (ah->ah_version == AR5K_AR5212)
+- ath5k_hw_set_sleep_clock(ah, true);
++ if (ah->ah_version == AR5K_AR5212 &&
++ ah->ah_op_mode != NL80211_IFTYPE_AP)
++ ath5k_hw_set_sleep_clock(ah, true);
+
+ /*
+ * Disable beacons and reset the register
+diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
+index 1597a42..2bad712 100644
+--- a/drivers/net/wireless/ath/ath9k/ath9k.h
++++ b/drivers/net/wireless/ath/ath9k/ath9k.h
+@@ -267,6 +267,7 @@ void ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
+ u16 tid, u16 *ssn);
+ void ath_tx_aggr_stop(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid);
+ void ath_tx_aggr_resume(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid);
++void ath9k_enable_ps(struct ath_softc *sc);
+
+ /********/
+ /* VIFs */
+diff --git a/drivers/net/wireless/ath/ath9k/beacon.c b/drivers/net/wireless/ath/ath9k/beacon.c
+index 06eaaa9..20b1fd3 100644
+--- a/drivers/net/wireless/ath/ath9k/beacon.c
++++ b/drivers/net/wireless/ath/ath9k/beacon.c
+@@ -573,6 +573,13 @@ static void ath_beacon_config_sta(struct ath_softc *sc,
+ u64 tsf;
+ int num_beacons, offset, dtim_dec_count, cfp_dec_count;
+
++ /* No need to configure beacon if we are not associated */
++ if (!common->curaid) {
++ ath_print(common, ATH_DBG_BEACON,
++ "STA is not yet associated..skipping beacon config\n");
++ return;
++ }
++
+ memset(&bs, 0, sizeof(bs));
+ intval = conf->beacon_interval & ATH9K_BEACON_PERIOD;
+
+diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
+index 7c64aa5..6661178 100644
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -380,7 +380,6 @@ static void ath9k_hw_init_config(struct ath_hw *ah)
+ ah->config.pcie_clock_req = 0;
+ ah->config.pcie_waen = 0;
+ ah->config.analog_shiftreg = 1;
+- ah->config.ht_enable = 1;
+ ah->config.ofdm_trig_low = 200;
+ ah->config.ofdm_trig_high = 500;
+ ah->config.cck_trig_high = 200;
+@@ -392,6 +391,11 @@ static void ath9k_hw_init_config(struct ath_hw *ah)
+ ah->config.spurchans[i][1] = AR_NO_SPUR;
+ }
+
++ if (ah->hw_version.devid != AR2427_DEVID_PCIE)
++ ah->config.ht_enable = 1;
++ else
++ ah->config.ht_enable = 0;
++
+ ah->config.intr_mitigation = true;
+
+ /*
+@@ -590,6 +594,7 @@ static bool ath9k_hw_devid_supported(u16 devid)
+ case AR5416_DEVID_AR9287_PCI:
+ case AR5416_DEVID_AR9287_PCIE:
+ case AR9271_USB:
++ case AR2427_DEVID_PCIE:
+ return true;
+ default:
+ break;
+diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
+index e2b0c73..33a28ec 100644
+--- a/drivers/net/wireless/ath/ath9k/hw.h
++++ b/drivers/net/wireless/ath/ath9k/hw.h
+@@ -40,6 +40,7 @@
+ #define AR9280_DEVID_PCI 0x0029
+ #define AR9280_DEVID_PCIE 0x002a
+ #define AR9285_DEVID_PCIE 0x002b
++#define AR2427_DEVID_PCIE 0x002c
+
+ #define AR5416_AR9100_DEVID 0x000b
+
+diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
+index 4faafbd..33a1071 100644
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -1854,11 +1854,14 @@ void ath_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
+ hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
+ IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
+ IEEE80211_HW_SIGNAL_DBM |
+- IEEE80211_HW_AMPDU_AGGREGATION |
+ IEEE80211_HW_SUPPORTS_PS |
+ IEEE80211_HW_PS_NULLFUNC_STACK |
++ IEEE80211_HW_REPORTS_TX_ACK_STATUS |
+ IEEE80211_HW_SPECTRUM_MGMT;
+
++ if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT)
++ hw->flags |= IEEE80211_HW_AMPDU_AGGREGATION;
++
+ if (AR_SREV_9160_10_OR_LATER(sc->sc_ah) || modparam_nohwcrypt)
+ hw->flags |= IEEE80211_HW_MFP_CAPABLE;
+
+@@ -2679,6 +2682,19 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw,
+ mutex_unlock(&sc->mutex);
+ }
+
++void ath9k_enable_ps(struct ath_softc *sc)
++{
++ sc->ps_enabled = true;
++ if (!(sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_AUTOSLEEP)) {
++ if ((sc->imask & ATH9K_INT_TIM_TIMER) == 0) {
++ sc->imask |= ATH9K_INT_TIM_TIMER;
++ ath9k_hw_set_interrupts(sc->sc_ah,
++ sc->imask);
++ }
++ }
++ ath9k_hw_setrxabort(sc->sc_ah, 1);
++}
++
+ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
+ {
+ struct ath_wiphy *aphy = hw->priv;
+@@ -2732,22 +2748,13 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
+ if (changed & IEEE80211_CONF_CHANGE_PS) {
+ if (conf->flags & IEEE80211_CONF_PS) {
+ sc->sc_flags |= SC_OP_PS_ENABLED;
+- if (!(ah->caps.hw_caps &
+- ATH9K_HW_CAP_AUTOSLEEP)) {
+- if ((sc->imask & ATH9K_INT_TIM_TIMER) == 0) {
+- sc->imask |= ATH9K_INT_TIM_TIMER;
+- ath9k_hw_set_interrupts(sc->sc_ah,
+- sc->imask);
+- }
+- }
+ /*
+ * At this point we know hardware has received an ACK
+ * of a previously sent null data frame.
+ */
+ if ((sc->sc_flags & SC_OP_NULLFUNC_COMPLETED)) {
+ sc->sc_flags &= ~SC_OP_NULLFUNC_COMPLETED;
+- sc->ps_enabled = true;
+- ath9k_hw_setrxabort(sc->sc_ah, 1);
++ ath9k_enable_ps(sc);
+ }
+ } else {
+ sc->ps_enabled = false;
+diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
+index f7af5ea..199c54a 100644
+--- a/drivers/net/wireless/ath/ath9k/pci.c
++++ b/drivers/net/wireless/ath/ath9k/pci.c
+@@ -25,6 +25,7 @@ static struct pci_device_id ath_pci_id_table[] __devinitdata = {
+ { PCI_VDEVICE(ATHEROS, 0x0029) }, /* PCI */
+ { PCI_VDEVICE(ATHEROS, 0x002A) }, /* PCI-E */
+ { PCI_VDEVICE(ATHEROS, 0x002B) }, /* PCI-E */
++ { PCI_VDEVICE(ATHEROS, 0x002C) }, /* PCI-E 802.11n bonded out */
+ { PCI_VDEVICE(ATHEROS, 0x002D) }, /* PCI */
+ { PCI_VDEVICE(ATHEROS, 0x002E) }, /* PCI-E */
+ { 0 }
+diff --git a/drivers/net/wireless/ath/ath9k/rc.c b/drivers/net/wireless/ath/ath9k/rc.c
+index 1d6cf7d..171ce2b 100644
+--- a/drivers/net/wireless/ath/ath9k/rc.c
++++ b/drivers/net/wireless/ath/ath9k/rc.c
+@@ -1323,7 +1323,7 @@ static void ath_rate_init(void *priv, struct ieee80211_supported_band *sband,
+
+ static void ath_rate_update(void *priv, struct ieee80211_supported_band *sband,
+ struct ieee80211_sta *sta, void *priv_sta,
+- u32 changed)
++ u32 changed, enum nl80211_channel_type oper_chan_type)
+ {
+ struct ath_softc *sc = priv;
+ struct ath_rate_priv *ath_rc_priv = priv_sta;
+@@ -1340,8 +1340,8 @@ static void ath_rate_update(void *priv, struct ieee80211_supported_band *sband,
+ if (sc->sc_ah->opmode != NL80211_IFTYPE_STATION)
+ return;
+
+- if (sc->hw->conf.channel_type == NL80211_CHAN_HT40MINUS ||
+- sc->hw->conf.channel_type == NL80211_CHAN_HT40PLUS)
++ if (oper_chan_type == NL80211_CHAN_HT40MINUS ||
++ oper_chan_type == NL80211_CHAN_HT40PLUS)
+ oper_cw40 = true;
+
+ oper_sgi40 = (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40) ?
+diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
+index 29bf336..c3ce920 100644
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -1353,25 +1353,6 @@ static enum ath9k_pkt_type get_hw_packet_type(struct sk_buff *skb)
+ return htype;
+ }
+
+-static bool is_pae(struct sk_buff *skb)
+-{
+- struct ieee80211_hdr *hdr;
+- __le16 fc;
+-
+- hdr = (struct ieee80211_hdr *)skb->data;
+- fc = hdr->frame_control;
+-
+- if (ieee80211_is_data(fc)) {
+- if (ieee80211_is_nullfunc(fc) ||
+- /* Port Access Entity (IEEE 802.1X) */
+- (skb->protocol == cpu_to_be16(ETH_P_PAE))) {
+- return true;
+- }
+- }
+-
+- return false;
+-}
+-
+ static int get_hw_crypto_keytype(struct sk_buff *skb)
+ {
+ struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
+@@ -1701,7 +1682,7 @@ static void ath_tx_start_dma(struct ath_softc *sc, struct ath_buf *bf,
+ goto tx_done;
+ }
+
+- if ((tx_info->flags & IEEE80211_TX_CTL_AMPDU) && !is_pae(skb)) {
++ if (tx_info->flags & IEEE80211_TX_CTL_AMPDU) {
+ /*
+ * Try aggregation if it's a unicast data frame
+ * and the destination is HT capable.
+@@ -2053,10 +2034,9 @@ static void ath_tx_processq(struct ath_softc *sc, struct ath_txq *txq)
+ */
+ if (bf->bf_isnullfunc &&
+ (ds->ds_txstat.ts_status & ATH9K_TX_ACKED)) {
+- if ((sc->sc_flags & SC_OP_PS_ENABLED)) {
+- sc->ps_enabled = true;
+- ath9k_hw_setrxabort(sc->sc_ah, 1);
+- } else
++ if ((sc->sc_flags & SC_OP_PS_ENABLED))
++ ath9k_enable_ps(sc);
++ else
+ sc->sc_flags |= SC_OP_NULLFUNC_COMPLETED;
+ }
+
+@@ -2264,7 +2244,7 @@ void ath_tx_node_cleanup(struct ath_softc *sc, struct ath_node *an)
+ if (ATH_TXQ_SETUP(sc, i)) {
+ txq = &sc->tx.txq[i];
+
+- spin_lock(&txq->axq_lock);
++ spin_lock_bh(&txq->axq_lock);
+
+ list_for_each_entry_safe(ac,
+ ac_tmp, &txq->axq_acq, list) {
+@@ -2285,7 +2265,7 @@ void ath_tx_node_cleanup(struct ath_softc *sc, struct ath_node *an)
+ }
+ }
+
+- spin_unlock(&txq->axq_lock);
++ spin_unlock_bh(&txq->axq_lock);
+ }
+ }
+ }
+diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
+index b59166c..629c166 100644
+--- a/drivers/net/wireless/b43/main.c
++++ b/drivers/net/wireless/b43/main.c
+@@ -852,19 +852,16 @@ static void b43_op_update_tkip_key(struct ieee80211_hw *hw,
+ if (B43_WARN_ON(!modparam_hwtkip))
+ return;
+
+- mutex_lock(&wl->mutex);
+-
++ /* This is only called from the RX path through mac80211, where
++ * our mutex is already locked. */
++ B43_WARN_ON(!mutex_is_locked(&wl->mutex));
+ dev = wl->current_dev;
+- if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
+- goto out_unlock;
++ B43_WARN_ON(!dev || b43_status(dev) < B43_STAT_INITIALIZED);
+
+ keymac_write(dev, index, NULL); /* First zero out mac to avoid race */
+
+ rx_tkip_phase1_write(dev, index, iv32, phase1key);
+ keymac_write(dev, index, addr);
+-
+-out_unlock:
+- mutex_unlock(&wl->mutex);
+ }
+
+ static void do_key_write(struct b43_wldev *dev,
+diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
+index 234891d..e955515 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
++++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
+@@ -2474,11 +2474,9 @@ int iwl3945_hw_set_hw_params(struct iwl_priv *priv)
+ memset((void *)&priv->hw_params, 0,
+ sizeof(struct iwl_hw_params));
+
+- priv->shared_virt =
+- pci_alloc_consistent(priv->pci_dev,
+- sizeof(struct iwl3945_shared),
+- &priv->shared_phys);
+-
++ priv->shared_virt = dma_alloc_coherent(&priv->pci_dev->dev,
++ sizeof(struct iwl3945_shared),
++ &priv->shared_phys, GFP_KERNEL);
+ if (!priv->shared_virt) {
+ IWL_ERR(priv, "failed to allocate pci memory\n");
+ mutex_unlock(&priv->mutex);
+diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
+index f36f804..6e9e156 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-core.c
++++ b/drivers/net/wireless/iwlwifi/iwl-core.c
+@@ -1658,9 +1658,9 @@ EXPORT_SYMBOL(iwl_set_tx_power);
+ void iwl_free_isr_ict(struct iwl_priv *priv)
+ {
+ if (priv->ict_tbl_vir) {
+- pci_free_consistent(priv->pci_dev, (sizeof(u32) * ICT_COUNT) +
+- PAGE_SIZE, priv->ict_tbl_vir,
+- priv->ict_tbl_dma);
++ dma_free_coherent(&priv->pci_dev->dev,
++ (sizeof(u32) * ICT_COUNT) + PAGE_SIZE,
++ priv->ict_tbl_vir, priv->ict_tbl_dma);
+ priv->ict_tbl_vir = NULL;
+ }
+ }
+@@ -1676,9 +1676,9 @@ int iwl_alloc_isr_ict(struct iwl_priv *priv)
+ if (priv->cfg->use_isr_legacy)
+ return 0;
+ /* allocate shrared data table */
+- priv->ict_tbl_vir = pci_alloc_consistent(priv->pci_dev, (sizeof(u32) *
+- ICT_COUNT) + PAGE_SIZE,
+- &priv->ict_tbl_dma);
++ priv->ict_tbl_vir = dma_alloc_coherent(&priv->pci_dev->dev,
++ (sizeof(u32) * ICT_COUNT) + PAGE_SIZE,
++ &priv->ict_tbl_dma, GFP_KERNEL);
+ if (!priv->ict_tbl_vir)
+ return -ENOMEM;
+
+diff --git a/drivers/net/wireless/iwlwifi/iwl-helpers.h b/drivers/net/wireless/iwlwifi/iwl-helpers.h
+index bd0b12e..f8481e8 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-helpers.h
++++ b/drivers/net/wireless/iwlwifi/iwl-helpers.h
+@@ -80,8 +80,8 @@ static inline void iwl_free_fw_desc(struct pci_dev *pci_dev,
+ struct fw_desc *desc)
+ {
+ if (desc->v_addr)
+- pci_free_consistent(pci_dev, desc->len,
+- desc->v_addr, desc->p_addr);
++ dma_free_coherent(&pci_dev->dev, desc->len,
++ desc->v_addr, desc->p_addr);
+ desc->v_addr = NULL;
+ desc->len = 0;
+ }
+@@ -89,7 +89,8 @@ static inline void iwl_free_fw_desc(struct pci_dev *pci_dev,
+ static inline int iwl_alloc_fw_desc(struct pci_dev *pci_dev,
+ struct fw_desc *desc)
+ {
+- desc->v_addr = pci_alloc_consistent(pci_dev, desc->len, &desc->p_addr);
++ desc->v_addr = dma_alloc_coherent(&pci_dev->dev, desc->len,
++ &desc->p_addr, GFP_KERNEL);
+ return (desc->v_addr != NULL) ? 0 : -ENOMEM;
+ }
+
+diff --git a/drivers/net/wireless/iwlwifi/iwl-rx.c b/drivers/net/wireless/iwlwifi/iwl-rx.c
+index 2dbce85..4ac16d9 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-rx.c
++++ b/drivers/net/wireless/iwlwifi/iwl-rx.c
+@@ -350,10 +350,10 @@ void iwl_rx_queue_free(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
+ }
+ }
+
+- pci_free_consistent(priv->pci_dev, 4 * RX_QUEUE_SIZE, rxq->bd,
+- rxq->dma_addr);
+- pci_free_consistent(priv->pci_dev, sizeof(struct iwl_rb_status),
+- rxq->rb_stts, rxq->rb_stts_dma);
++ dma_free_coherent(&priv->pci_dev->dev, 4 * RX_QUEUE_SIZE, rxq->bd,
++ rxq->dma_addr);
++ dma_free_coherent(&priv->pci_dev->dev, sizeof(struct iwl_rb_status),
++ rxq->rb_stts, rxq->rb_stts_dma);
+ rxq->bd = NULL;
+ rxq->rb_stts = NULL;
+ }
+@@ -362,7 +362,7 @@ EXPORT_SYMBOL(iwl_rx_queue_free);
+ int iwl_rx_queue_alloc(struct iwl_priv *priv)
+ {
+ struct iwl_rx_queue *rxq = &priv->rxq;
+- struct pci_dev *dev = priv->pci_dev;
++ struct device *dev = &priv->pci_dev->dev;
+ int i;
+
+ spin_lock_init(&rxq->lock);
+@@ -370,12 +370,13 @@ int iwl_rx_queue_alloc(struct iwl_priv *priv)
+ INIT_LIST_HEAD(&rxq->rx_used);
+
+ /* Alloc the circular buffer of Read Buffer Descriptors (RBDs) */
+- rxq->bd = pci_alloc_consistent(dev, 4 * RX_QUEUE_SIZE, &rxq->dma_addr);
++ rxq->bd = dma_alloc_coherent(dev, 4 * RX_QUEUE_SIZE, &rxq->dma_addr,
++ GFP_KERNEL);
+ if (!rxq->bd)
+ goto err_bd;
+
+- rxq->rb_stts = pci_alloc_consistent(dev, sizeof(struct iwl_rb_status),
+- &rxq->rb_stts_dma);
++ rxq->rb_stts = dma_alloc_coherent(dev, sizeof(struct iwl_rb_status),
++ &rxq->rb_stts_dma, GFP_KERNEL);
+ if (!rxq->rb_stts)
+ goto err_rb;
+
+@@ -392,8 +393,8 @@ int iwl_rx_queue_alloc(struct iwl_priv *priv)
+ return 0;
+
+ err_rb:
+- pci_free_consistent(priv->pci_dev, 4 * RX_QUEUE_SIZE, rxq->bd,
+- rxq->dma_addr);
++ dma_free_coherent(&priv->pci_dev->dev, 4 * RX_QUEUE_SIZE, rxq->bd,
++ rxq->dma_addr);
+ err_bd:
+ return -ENOMEM;
+ }
+diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
+index 8f40715..88470fb 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
++++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
+@@ -60,7 +60,8 @@ static const u16 default_tid_to_tx_fifo[] = {
+ static inline int iwl_alloc_dma_ptr(struct iwl_priv *priv,
+ struct iwl_dma_ptr *ptr, size_t size)
+ {
+- ptr->addr = pci_alloc_consistent(priv->pci_dev, size, &ptr->dma);
++ ptr->addr = dma_alloc_coherent(&priv->pci_dev->dev, size, &ptr->dma,
++ GFP_KERNEL);
+ if (!ptr->addr)
+ return -ENOMEM;
+ ptr->size = size;
+@@ -73,7 +74,7 @@ static inline void iwl_free_dma_ptr(struct iwl_priv *priv,
+ if (unlikely(!ptr->addr))
+ return;
+
+- pci_free_consistent(priv->pci_dev, ptr->size, ptr->addr, ptr->dma);
++ dma_free_coherent(&priv->pci_dev->dev, ptr->size, ptr->addr, ptr->dma);
+ memset(ptr, 0, sizeof(*ptr));
+ }
+
+@@ -126,7 +127,7 @@ void iwl_free_tfds_in_queue(struct iwl_priv *priv,
+ if (priv->stations[sta_id].tid[tid].tfds_in_queue >= freed)
+ priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;
+ else {
+- IWL_ERR(priv, "free more than tfds_in_queue (%u:%d)\n",
++ IWL_DEBUG_TX(priv, "free more than tfds_in_queue (%u:%d)\n",
+ priv->stations[sta_id].tid[tid].tfds_in_queue,
+ freed);
+ priv->stations[sta_id].tid[tid].tfds_in_queue = 0;
+@@ -146,7 +147,7 @@ void iwl_tx_queue_free(struct iwl_priv *priv, int txq_id)
+ {
+ struct iwl_tx_queue *txq = &priv->txq[txq_id];
+ struct iwl_queue *q = &txq->q;
+- struct pci_dev *dev = priv->pci_dev;
++ struct device *dev = &priv->pci_dev->dev;
+ int i;
+
+ if (q->n_bd == 0)
+@@ -163,8 +164,8 @@ void iwl_tx_queue_free(struct iwl_priv *priv, int txq_id)
+
+ /* De-alloc circular buffer of TFDs */
+ if (txq->q.n_bd)
+- pci_free_consistent(dev, priv->hw_params.tfd_size *
+- txq->q.n_bd, txq->tfds, txq->q.dma_addr);
++ dma_free_coherent(dev, priv->hw_params.tfd_size *
++ txq->q.n_bd, txq->tfds, txq->q.dma_addr);
+
+ /* De-alloc array of per-TFD driver data */
+ kfree(txq->txb);
+@@ -193,7 +194,7 @@ void iwl_cmd_queue_free(struct iwl_priv *priv)
+ {
+ struct iwl_tx_queue *txq = &priv->txq[IWL_CMD_QUEUE_NUM];
+ struct iwl_queue *q = &txq->q;
+- struct pci_dev *dev = priv->pci_dev;
++ struct device *dev = &priv->pci_dev->dev;
+ int i;
+
+ if (q->n_bd == 0)
+@@ -205,8 +206,8 @@ void iwl_cmd_queue_free(struct iwl_priv *priv)
+
+ /* De-alloc circular buffer of TFDs */
+ if (txq->q.n_bd)
+- pci_free_consistent(dev, priv->hw_params.tfd_size *
+- txq->q.n_bd, txq->tfds, txq->q.dma_addr);
++ dma_free_coherent(dev, priv->hw_params.tfd_size * txq->q.n_bd,
++ txq->tfds, txq->q.dma_addr);
+
+ /* deallocate arrays */
+ kfree(txq->cmd);
+@@ -297,7 +298,7 @@ static int iwl_queue_init(struct iwl_priv *priv, struct iwl_queue *q,
+ static int iwl_tx_queue_alloc(struct iwl_priv *priv,
+ struct iwl_tx_queue *txq, u32 id)
+ {
+- struct pci_dev *dev = priv->pci_dev;
++ struct device *dev = &priv->pci_dev->dev;
+ size_t tfd_sz = priv->hw_params.tfd_size * TFD_QUEUE_SIZE_MAX;
+
+ /* Driver private data, only for Tx (not command) queues,
+@@ -316,8 +317,8 @@ static int iwl_tx_queue_alloc(struct iwl_priv *priv,
+
+ /* Circular buffer of transmit frame descriptors (TFDs),
+ * shared with device */
+- txq->tfds = pci_alloc_consistent(dev, tfd_sz, &txq->q.dma_addr);
+-
++ txq->tfds = dma_alloc_coherent(dev, tfd_sz, &txq->q.dma_addr,
++ GFP_KERNEL);
+ if (!txq->tfds) {
+ IWL_ERR(priv, "pci_alloc_consistent(%zd) failed\n", tfd_sz);
+ goto error;
+diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
+index f8e4e4b..f297865 100644
+--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
++++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
+@@ -352,10 +352,10 @@ static int iwl3945_send_beacon_cmd(struct iwl_priv *priv)
+ static void iwl3945_unset_hw_params(struct iwl_priv *priv)
+ {
+ if (priv->shared_virt)
+- pci_free_consistent(priv->pci_dev,
+- sizeof(struct iwl3945_shared),
+- priv->shared_virt,
+- priv->shared_phys);
++ dma_free_coherent(&priv->pci_dev->dev,
++ sizeof(struct iwl3945_shared),
++ priv->shared_virt,
++ priv->shared_phys);
+ }
+
+ static void iwl3945_build_tx_cmd_hwcrypto(struct iwl_priv *priv,
+@@ -1253,10 +1253,10 @@ static void iwl3945_rx_queue_free(struct iwl_priv *priv, struct iwl_rx_queue *rx
+ }
+ }
+
+- pci_free_consistent(priv->pci_dev, 4 * RX_QUEUE_SIZE, rxq->bd,
+- rxq->dma_addr);
+- pci_free_consistent(priv->pci_dev, sizeof(struct iwl_rb_status),
+- rxq->rb_stts, rxq->rb_stts_dma);
++ dma_free_coherent(&priv->pci_dev->dev, 4 * RX_QUEUE_SIZE, rxq->bd,
++ rxq->dma_addr);
++ dma_free_coherent(&priv->pci_dev->dev, sizeof(struct iwl_rb_status),
++ rxq->rb_stts, rxq->rb_stts_dma);
+ rxq->bd = NULL;
+ rxq->rb_stts = NULL;
+ }
+diff --git a/drivers/net/wireless/wl12xx/wl1251_debugfs.c b/drivers/net/wireless/wl12xx/wl1251_debugfs.c
+index a007230..1685c09 100644
+--- a/drivers/net/wireless/wl12xx/wl1251_debugfs.c
++++ b/drivers/net/wireless/wl12xx/wl1251_debugfs.c
+@@ -443,7 +443,8 @@ out:
+
+ void wl1251_debugfs_reset(struct wl1251 *wl)
+ {
+- memset(wl->stats.fw_stats, 0, sizeof(*wl->stats.fw_stats));
++ if (wl->stats.fw_stats != NULL)
++ memset(wl->stats.fw_stats, 0, sizeof(*wl->stats.fw_stats));
+ wl->stats.retry_count = 0;
+ wl->stats.excessive_retries = 0;
+ }
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 315fea4..3245d33 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -2421,18 +2421,17 @@ EXPORT_SYMBOL_GPL(pci_reset_function);
+ */
+ int pcix_get_max_mmrbc(struct pci_dev *dev)
+ {
+- int err, cap;
++ int cap;
+ u32 stat;
+
+ cap = pci_find_capability(dev, PCI_CAP_ID_PCIX);
+ if (!cap)
+ return -EINVAL;
+
+- err = pci_read_config_dword(dev, cap + PCI_X_STATUS, &stat);
+- if (err)
++ if (pci_read_config_dword(dev, cap + PCI_X_STATUS, &stat))
+ return -EINVAL;
+
+- return (stat & PCI_X_STATUS_MAX_READ) >> 12;
++ return 512 << ((stat & PCI_X_STATUS_MAX_READ) >> 21);
+ }
+ EXPORT_SYMBOL(pcix_get_max_mmrbc);
+
+@@ -2445,18 +2444,17 @@ EXPORT_SYMBOL(pcix_get_max_mmrbc);
+ */
+ int pcix_get_mmrbc(struct pci_dev *dev)
+ {
+- int ret, cap;
+- u32 cmd;
++ int cap;
++ u16 cmd;
+
+ cap = pci_find_capability(dev, PCI_CAP_ID_PCIX);
+ if (!cap)
+ return -EINVAL;
+
+- ret = pci_read_config_dword(dev, cap + PCI_X_CMD, &cmd);
+- if (!ret)
+- ret = 512 << ((cmd & PCI_X_CMD_MAX_READ) >> 2);
++ if (pci_read_config_word(dev, cap + PCI_X_CMD, &cmd))
++ return -EINVAL;
+
+- return ret;
++ return 512 << ((cmd & PCI_X_CMD_MAX_READ) >> 2);
+ }
+ EXPORT_SYMBOL(pcix_get_mmrbc);
+
+@@ -2471,28 +2469,27 @@ EXPORT_SYMBOL(pcix_get_mmrbc);
+ */
+ int pcix_set_mmrbc(struct pci_dev *dev, int mmrbc)
+ {
+- int cap, err = -EINVAL;
+- u32 stat, cmd, v, o;
++ int cap;
++ u32 stat, v, o;
++ u16 cmd;
+
+ if (mmrbc < 512 || mmrbc > 4096 || !is_power_of_2(mmrbc))
+- goto out;
++ return -EINVAL;
+
+ v = ffs(mmrbc) - 10;
+
+ cap = pci_find_capability(dev, PCI_CAP_ID_PCIX);
+ if (!cap)
+- goto out;
++ return -EINVAL;
+
+- err = pci_read_config_dword(dev, cap + PCI_X_STATUS, &stat);
+- if (err)
+- goto out;
++ if (pci_read_config_dword(dev, cap + PCI_X_STATUS, &stat))
++ return -EINVAL;
+
+ if (v > (stat & PCI_X_STATUS_MAX_READ) >> 21)
+ return -E2BIG;
+
+- err = pci_read_config_dword(dev, cap + PCI_X_CMD, &cmd);
+- if (err)
+- goto out;
++ if (pci_read_config_word(dev, cap + PCI_X_CMD, &cmd))
++ return -EINVAL;
+
+ o = (cmd & PCI_X_CMD_MAX_READ) >> 2;
+ if (o != v) {
+@@ -2502,10 +2499,10 @@ int pcix_set_mmrbc(struct pci_dev *dev, int mmrbc)
+
+ cmd &= ~PCI_X_CMD_MAX_READ;
+ cmd |= v << 2;
+- err = pci_write_config_dword(dev, cap + PCI_X_CMD, cmd);
++ if (pci_write_config_word(dev, cap + PCI_X_CMD, cmd))
++ return -EIO;
+ }
+-out:
+- return err;
++ return 0;
+ }
+ EXPORT_SYMBOL(pcix_set_mmrbc);
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index d58b940..456c265 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -2534,6 +2534,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x10e7, quirk_i82576_sriov);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x10e8, quirk_i82576_sriov);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x150a, quirk_i82576_sriov);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x150d, quirk_i82576_sriov);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1518, quirk_i82576_sriov);
+
+ #endif /* CONFIG_PCI_IOV */
+
+diff --git a/drivers/platform/x86/classmate-laptop.c b/drivers/platform/x86/classmate-laptop.c
+index ed90082..8cb20e4 100644
+--- a/drivers/platform/x86/classmate-laptop.c
++++ b/drivers/platform/x86/classmate-laptop.c
+@@ -34,6 +34,11 @@ struct cmpc_accel {
+ #define CMPC_ACCEL_SENSITIVITY_DEFAULT 5
+
+
++#define CMPC_ACCEL_HID "ACCE0000"
++#define CMPC_TABLET_HID "TBLT0000"
++#define CMPC_BL_HID "IPML200"
++#define CMPC_KEYS_HID "FnBT0000"
++
+ /*
+ * Generic input device code.
+ */
+@@ -282,10 +287,9 @@ static int cmpc_accel_remove(struct acpi_device *acpi, int type)
+ }
+
+ static const struct acpi_device_id cmpc_accel_device_ids[] = {
+- {"ACCE0000", 0},
++ {CMPC_ACCEL_HID, 0},
+ {"", 0}
+ };
+-MODULE_DEVICE_TABLE(acpi, cmpc_accel_device_ids);
+
+ static struct acpi_driver cmpc_accel_acpi_driver = {
+ .owner = THIS_MODULE,
+@@ -366,10 +370,9 @@ static int cmpc_tablet_resume(struct acpi_device *acpi)
+ }
+
+ static const struct acpi_device_id cmpc_tablet_device_ids[] = {
+- {"TBLT0000", 0},
++ {CMPC_TABLET_HID, 0},
+ {"", 0}
+ };
+-MODULE_DEVICE_TABLE(acpi, cmpc_tablet_device_ids);
+
+ static struct acpi_driver cmpc_tablet_acpi_driver = {
+ .owner = THIS_MODULE,
+@@ -477,17 +480,16 @@ static int cmpc_bl_remove(struct acpi_device *acpi, int type)
+ return 0;
+ }
+
+-static const struct acpi_device_id cmpc_device_ids[] = {
+- {"IPML200", 0},
++static const struct acpi_device_id cmpc_bl_device_ids[] = {
++ {CMPC_BL_HID, 0},
+ {"", 0}
+ };
+-MODULE_DEVICE_TABLE(acpi, cmpc_device_ids);
+
+ static struct acpi_driver cmpc_bl_acpi_driver = {
+ .owner = THIS_MODULE,
+ .name = "cmpc",
+ .class = "cmpc",
+- .ids = cmpc_device_ids,
++ .ids = cmpc_bl_device_ids,
+ .ops = {
+ .add = cmpc_bl_add,
+ .remove = cmpc_bl_remove
+@@ -540,10 +542,9 @@ static int cmpc_keys_remove(struct acpi_device *acpi, int type)
+ }
+
+ static const struct acpi_device_id cmpc_keys_device_ids[] = {
+- {"FnBT0000", 0},
++ {CMPC_KEYS_HID, 0},
+ {"", 0}
+ };
+-MODULE_DEVICE_TABLE(acpi, cmpc_keys_device_ids);
+
+ static struct acpi_driver cmpc_keys_acpi_driver = {
+ .owner = THIS_MODULE,
+@@ -607,3 +608,13 @@ static void cmpc_exit(void)
+
+ module_init(cmpc_init);
+ module_exit(cmpc_exit);
++
++static const struct acpi_device_id cmpc_device_ids[] = {
++ {CMPC_ACCEL_HID, 0},
++ {CMPC_TABLET_HID, 0},
++ {CMPC_BL_HID, 0},
++ {CMPC_KEYS_HID, 0},
++ {"", 0}
++};
++
++MODULE_DEVICE_TABLE(acpi, cmpc_device_ids);
+diff --git a/drivers/scsi/qlogicpti.c b/drivers/scsi/qlogicpti.c
+index fa34b92..1b82170 100644
+--- a/drivers/scsi/qlogicpti.c
++++ b/drivers/scsi/qlogicpti.c
+@@ -738,7 +738,7 @@ static int __devinit qpti_register_irq(struct qlogicpti *qpti)
+ * sanely maintain.
+ */
+ if (request_irq(qpti->irq, qpti_intr,
+- IRQF_SHARED, "Qlogic/PTI", qpti))
++ IRQF_SHARED, "QlogicPTI", qpti))
+ goto fail;
+
+ printk("qlogicpti%d: IRQ %d ", qpti->qpti_id, qpti->irq);
+diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
+index 653f22a..bb8fd5b 100644
+--- a/drivers/scsi/scsi_transport_fc.c
++++ b/drivers/scsi/scsi_transport_fc.c
+@@ -1216,6 +1216,15 @@ store_fc_vport_delete(struct device *dev, struct device_attribute *attr,
+ {
+ struct fc_vport *vport = transport_class_to_vport(dev);
+ struct Scsi_Host *shost = vport_to_shost(vport);
++ unsigned long flags;
++
++ spin_lock_irqsave(shost->host_lock, flags);
++ if (vport->flags & (FC_VPORT_DEL | FC_VPORT_CREATING)) {
++ spin_unlock_irqrestore(shost->host_lock, flags);
++ return -EBUSY;
++ }
++ vport->flags |= FC_VPORT_DELETING;
++ spin_unlock_irqrestore(shost->host_lock, flags);
+
+ fc_queue_work(shost, &vport->vport_delete_work);
+ return count;
+@@ -1805,6 +1814,9 @@ store_fc_host_vport_delete(struct device *dev, struct device_attribute *attr,
+ list_for_each_entry(vport, &fc_host->vports, peers) {
+ if ((vport->channel == 0) &&
+ (vport->port_name == wwpn) && (vport->node_name == wwnn)) {
++ if (vport->flags & (FC_VPORT_DEL | FC_VPORT_CREATING))
++ break;
++ vport->flags |= FC_VPORT_DELETING;
+ match = 1;
+ break;
+ }
+@@ -3354,18 +3366,6 @@ fc_vport_terminate(struct fc_vport *vport)
+ unsigned long flags;
+ int stat;
+
+- spin_lock_irqsave(shost->host_lock, flags);
+- if (vport->flags & FC_VPORT_CREATING) {
+- spin_unlock_irqrestore(shost->host_lock, flags);
+- return -EBUSY;
+- }
+- if (vport->flags & (FC_VPORT_DEL)) {
+- spin_unlock_irqrestore(shost->host_lock, flags);
+- return -EALREADY;
+- }
+- vport->flags |= FC_VPORT_DELETING;
+- spin_unlock_irqrestore(shost->host_lock, flags);
+-
+ if (i->f->vport_delete)
+ stat = i->f->vport_delete(vport);
+ else
+diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
+index 55b034b..3c8a024 100644
+--- a/drivers/scsi/ses.c
++++ b/drivers/scsi/ses.c
+@@ -591,8 +591,6 @@ static int ses_intf_add(struct device *cdev,
+ ses_dev->page10_len = len;
+ buf = NULL;
+ }
+- kfree(hdr_buf);
+-
+ scomp = kzalloc(sizeof(struct ses_component) * components, GFP_KERNEL);
+ if (!scomp)
+ goto err_free;
+@@ -604,6 +602,8 @@ static int ses_intf_add(struct device *cdev,
+ goto err_free;
+ }
+
++ kfree(hdr_buf);
++
+ edev->scratch = ses_dev;
+ for (i = 0; i < components; i++)
+ edev->component[i].scratch = scomp + i;
+diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
+index a678186..4fd67d6 100644
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -1176,6 +1176,13 @@ static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
+ free_async(as);
+ return -ENOMEM;
+ }
++ /* Isochronous input data may end up being discontiguous
++ * if some of the packets are short. Clear the buffer so
++ * that the gaps don't leak kernel data to userspace.
++ */
++ if (is_in && uurb->type == USBDEVFS_URB_TYPE_ISO)
++ memset(as->urb->transfer_buffer, 0,
++ uurb->buffer_length);
+ }
+ as->urb->dev = ps->dev;
+ as->urb->pipe = (uurb->type << 30) |
+@@ -1312,10 +1319,14 @@ static int processcompl(struct async *as, void __user * __user *arg)
+ void __user *addr = as->userurb;
+ unsigned int i;
+
+- if (as->userbuffer && urb->actual_length)
+- if (copy_to_user(as->userbuffer, urb->transfer_buffer,
+- urb->actual_length))
++ if (as->userbuffer && urb->actual_length) {
++ if (urb->number_of_packets > 0) /* Isochronous */
++ i = urb->transfer_buffer_length;
++ else /* Non-Isoc */
++ i = urb->actual_length;
++ if (copy_to_user(as->userbuffer, urb->transfer_buffer, i))
+ goto err_out;
++ }
+ if (put_user(as->status, &userurb->status))
+ goto err_out;
+ if (put_user(urb->actual_length, &userurb->actual_length))
+diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
+index 1ec3857..9c90b67 100644
+--- a/drivers/usb/host/ehci-hcd.c
++++ b/drivers/usb/host/ehci-hcd.c
+@@ -995,7 +995,7 @@ rescan:
+ /* endpoints can be iso streams. for now, we don't
+ * accelerate iso completions ... so spin a while.
+ */
+- if (qh->hw->hw_info1 == 0) {
++ if (qh->hw == NULL) {
+ ehci_vdbg (ehci, "iso delay\n");
+ goto idle_timeout;
+ }
+diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
+index 1e391e6..df533ce 100644
+--- a/drivers/usb/host/ehci-sched.c
++++ b/drivers/usb/host/ehci-sched.c
+@@ -1121,8 +1121,8 @@ iso_stream_find (struct ehci_hcd *ehci, struct urb *urb)
+ urb->interval);
+ }
+
+- /* if dev->ep [epnum] is a QH, info1.maxpacket is nonzero */
+- } else if (unlikely (stream->hw_info1 != 0)) {
++ /* if dev->ep [epnum] is a QH, hw is set */
++ } else if (unlikely (stream->hw != NULL)) {
+ ehci_dbg (ehci, "dev %s ep%d%s, not iso??\n",
+ urb->dev->devpath, epnum,
+ usb_pipein(urb->pipe) ? "in" : "out");
+@@ -1563,13 +1563,27 @@ itd_patch(
+ static inline void
+ itd_link (struct ehci_hcd *ehci, unsigned frame, struct ehci_itd *itd)
+ {
+- /* always prepend ITD/SITD ... only QH tree is order-sensitive */
+- itd->itd_next = ehci->pshadow [frame];
+- itd->hw_next = ehci->periodic [frame];
+- ehci->pshadow [frame].itd = itd;
++ union ehci_shadow *prev = &ehci->pshadow[frame];
++ __hc32 *hw_p = &ehci->periodic[frame];
++ union ehci_shadow here = *prev;
++ __hc32 type = 0;
++
++ /* skip any iso nodes which might belong to previous microframes */
++ while (here.ptr) {
++ type = Q_NEXT_TYPE(ehci, *hw_p);
++ if (type == cpu_to_hc32(ehci, Q_TYPE_QH))
++ break;
++ prev = periodic_next_shadow(ehci, prev, type);
++ hw_p = shadow_next_periodic(ehci, &here, type);
++ here = *prev;
++ }
++
++ itd->itd_next = here;
++ itd->hw_next = *hw_p;
++ prev->itd = itd;
+ itd->frame = frame;
+ wmb ();
+- ehci->periodic[frame] = cpu_to_hc32(ehci, itd->itd_dma | Q_TYPE_ITD);
++ *hw_p = cpu_to_hc32(ehci, itd->itd_dma | Q_TYPE_ITD);
+ }
+
+ /* fit urb's itds into the selected schedule slot; activate as needed */
+diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
+index 2d85e21..b1dce96 100644
+--- a/drivers/usb/host/ehci.h
++++ b/drivers/usb/host/ehci.h
+@@ -394,9 +394,8 @@ struct ehci_iso_sched {
+ * acts like a qh would, if EHCI had them for ISO.
+ */
+ struct ehci_iso_stream {
+- /* first two fields match QH, but info1 == 0 */
+- __hc32 hw_next;
+- __hc32 hw_info1;
++ /* first field matches ehci_hq, but is NULL */
++ struct ehci_qh_hw *hw;
+
+ u32 refcount;
+ u8 bEndpointAddress;
+diff --git a/drivers/usb/host/r8a66597-hcd.c b/drivers/usb/host/r8a66597-hcd.c
+index bee558a..f71a73a 100644
+--- a/drivers/usb/host/r8a66597-hcd.c
++++ b/drivers/usb/host/r8a66597-hcd.c
+@@ -418,7 +418,7 @@ static u8 alloc_usb_address(struct r8a66597 *r8a66597, struct urb *urb)
+
+ /* this function must be called with interrupt disabled */
+ static void free_usb_address(struct r8a66597 *r8a66597,
+- struct r8a66597_device *dev)
++ struct r8a66597_device *dev, int reset)
+ {
+ int port;
+
+@@ -430,7 +430,13 @@ static void free_usb_address(struct r8a66597 *r8a66597,
+ dev->state = USB_STATE_DEFAULT;
+ r8a66597->address_map &= ~(1 << dev->address);
+ dev->address = 0;
+- dev_set_drvdata(&dev->udev->dev, NULL);
++ /*
++ * Only when resetting USB, it is necessary to erase drvdata. When
++ * a usb device with usb hub is disconnect, "dev->udev" is already
++ * freed on usb_desconnect(). So we cannot access the data.
++ */
++ if (reset)
++ dev_set_drvdata(&dev->udev->dev, NULL);
+ list_del(&dev->device_list);
+ kfree(dev);
+
+@@ -1069,7 +1075,7 @@ static void r8a66597_usb_disconnect(struct r8a66597 *r8a66597, int port)
+ struct r8a66597_device *dev = r8a66597->root_hub[port].dev;
+
+ disable_r8a66597_pipe_all(r8a66597, dev);
+- free_usb_address(r8a66597, dev);
++ free_usb_address(r8a66597, dev, 0);
+
+ start_root_hub_sampling(r8a66597, port, 0);
+ }
+@@ -2085,7 +2091,7 @@ static void update_usb_address_map(struct r8a66597 *r8a66597,
+ spin_lock_irqsave(&r8a66597->lock, flags);
+ dev = get_r8a66597_device(r8a66597, addr);
+ disable_r8a66597_pipe_all(r8a66597, dev);
+- free_usb_address(r8a66597, dev);
++ free_usb_address(r8a66597, dev, 0);
+ put_child_connect_map(r8a66597, addr);
+ spin_unlock_irqrestore(&r8a66597->lock, flags);
+ }
+@@ -2228,7 +2234,7 @@ static int r8a66597_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ rh->port |= (1 << USB_PORT_FEAT_RESET);
+
+ disable_r8a66597_pipe_all(r8a66597, dev);
+- free_usb_address(r8a66597, dev);
++ free_usb_address(r8a66597, dev, 1);
+
+ r8a66597_mdfy(r8a66597, USBRST, USBRST | UACT,
+ get_dvstctr_reg(port));
+diff --git a/drivers/usb/host/xhci-hcd.c b/drivers/usb/host/xhci-hcd.c
+index 5e92c72..fa920c7 100644
+--- a/drivers/usb/host/xhci-hcd.c
++++ b/drivers/usb/host/xhci-hcd.c
+@@ -1173,6 +1173,7 @@ static int xhci_configure_endpoint(struct xhci_hcd *xhci,
+ cmd_completion = &virt_dev->cmd_completion;
+ cmd_status = &virt_dev->cmd_status;
+ }
++ init_completion(cmd_completion);
+
+ if (!ctx_change)
+ ret = xhci_queue_configure_endpoint(xhci, in_ctx->dma,
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 34acf6c..ca9e3ba 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -658,6 +658,7 @@ static struct usb_device_id id_table_combined [] = {
+ { USB_DEVICE(EVOLUTION_VID, EVOLUTION_ER1_PID) },
+ { USB_DEVICE(EVOLUTION_VID, EVO_HYBRID_PID) },
+ { USB_DEVICE(EVOLUTION_VID, EVO_RCM4_PID) },
++ { USB_DEVICE(CONTEC_VID, CONTEC_COM1USBH_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_ARTEMIS_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_ATIK_ATK16_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_ATIK_ATK16C_PID) },
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index d10b5a8..8f9e805 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -501,6 +501,13 @@
+ #define CONTEC_COM1USBH_PID 0x8311 /* COM-1(USB)H */
+
+ /*
++ * Contec products (http://www.contec.com)
++ * Submitted by Daniel Sangorrin
++ */
++#define CONTEC_VID 0x06CE /* Vendor ID */
++#define CONTEC_COM1USBH_PID 0x8311 /* COM-1(USB)H */
++
++/*
+ * Definitions for B&B Electronics products.
+ */
+ #define BANDB_VID 0x0856 /* B&B Electronics Vendor ID */
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 6e94a67..d93283d 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -288,7 +288,9 @@ static int option_resume(struct usb_serial *serial);
+
+ #define QUALCOMM_VENDOR_ID 0x05C6
+
+-#define MAXON_VENDOR_ID 0x16d8
++#define CMOTECH_VENDOR_ID 0x16d8
++#define CMOTECH_PRODUCT_6008 0x6008
++#define CMOTECH_PRODUCT_6280 0x6280
+
+ #define TELIT_VENDOR_ID 0x1bc7
+ #define TELIT_PRODUCT_UC864E 0x1003
+@@ -520,7 +522,8 @@ static struct usb_device_id option_ids[] = {
+ { USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC680) },
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6000)}, /* ZTE AC8700 */
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
+- { USB_DEVICE(MAXON_VENDOR_ID, 0x6280) }, /* BP3-USB & BP3-EXT HSDPA */
++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6280) }, /* BP3-USB & BP3-EXT HSDPA */
++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6008) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864E) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864G) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
+diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
+index 7528b8d..8ab4ab2 100644
+--- a/drivers/usb/serial/qcserial.c
++++ b/drivers/usb/serial/qcserial.c
+@@ -47,6 +47,35 @@ static struct usb_device_id id_table[] = {
+ {USB_DEVICE(0x05c6, 0x9221)}, /* Generic Gobi QDL device */
+ {USB_DEVICE(0x05c6, 0x9231)}, /* Generic Gobi QDL device */
+ {USB_DEVICE(0x1f45, 0x0001)}, /* Unknown Gobi QDL device */
++ {USB_DEVICE(0x413c, 0x8185)}, /* Dell Gobi 2000 QDL device (N0218, VU936) */
++ {USB_DEVICE(0x413c, 0x8186)}, /* Dell Gobi 2000 Modem device (N0218, VU936) */
++ {USB_DEVICE(0x05c6, 0x9224)}, /* Sony Gobi 2000 QDL device (N0279, VU730) */
++ {USB_DEVICE(0x05c6, 0x9225)}, /* Sony Gobi 2000 Modem device (N0279, VU730) */
++ {USB_DEVICE(0x05c6, 0x9244)}, /* Samsung Gobi 2000 QDL device (VL176) */
++ {USB_DEVICE(0x05c6, 0x9245)}, /* Samsung Gobi 2000 Modem device (VL176) */
++ {USB_DEVICE(0x03f0, 0x241d)}, /* HP Gobi 2000 QDL device (VP412) */
++ {USB_DEVICE(0x03f0, 0x251d)}, /* HP Gobi 2000 Modem device (VP412) */
++ {USB_DEVICE(0x05c6, 0x9214)}, /* Acer Gobi 2000 QDL device (VP413) */
++ {USB_DEVICE(0x05c6, 0x9215)}, /* Acer Gobi 2000 Modem device (VP413) */
++ {USB_DEVICE(0x05c6, 0x9264)}, /* Asus Gobi 2000 QDL device (VR305) */
++ {USB_DEVICE(0x05c6, 0x9265)}, /* Asus Gobi 2000 Modem device (VR305) */
++ {USB_DEVICE(0x05c6, 0x9234)}, /* Top Global Gobi 2000 QDL device (VR306) */
++ {USB_DEVICE(0x05c6, 0x9235)}, /* Top Global Gobi 2000 Modem device (VR306) */
++ {USB_DEVICE(0x05c6, 0x9274)}, /* iRex Technologies Gobi 2000 QDL device (VR307) */
++ {USB_DEVICE(0x05c6, 0x9275)}, /* iRex Technologies Gobi 2000 Modem device (VR307) */
++ {USB_DEVICE(0x1199, 0x9000)}, /* Sierra Wireless Gobi 2000 QDL device (VT773) */
++ {USB_DEVICE(0x1199, 0x9001)}, /* Sierra Wireless Gobi 2000 Modem device (VT773) */
++ {USB_DEVICE(0x1199, 0x9002)}, /* Sierra Wireless Gobi 2000 Modem device (VT773) */
++ {USB_DEVICE(0x1199, 0x9003)}, /* Sierra Wireless Gobi 2000 Modem device (VT773) */
++ {USB_DEVICE(0x1199, 0x9004)}, /* Sierra Wireless Gobi 2000 Modem device (VT773) */
++ {USB_DEVICE(0x1199, 0x9005)}, /* Sierra Wireless Gobi 2000 Modem device (VT773) */
++ {USB_DEVICE(0x1199, 0x9006)}, /* Sierra Wireless Gobi 2000 Modem device (VT773) */
++ {USB_DEVICE(0x1199, 0x9007)}, /* Sierra Wireless Gobi 2000 Modem device (VT773) */
++ {USB_DEVICE(0x1199, 0x9008)}, /* Sierra Wireless Gobi 2000 Modem device (VT773) */
++ {USB_DEVICE(0x1199, 0x9009)}, /* Sierra Wireless Gobi 2000 Modem device (VT773) */
++ {USB_DEVICE(0x1199, 0x900a)}, /* Sierra Wireless Gobi 2000 Modem device (VT773) */
++ {USB_DEVICE(0x16d8, 0x8001)}, /* CMDTech Gobi 2000 QDL device (VU922) */
++ {USB_DEVICE(0x16d8, 0x8002)}, /* CMDTech Gobi 2000 Modem device (VU922) */
+ { } /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, id_table);
+diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
+index 5a5c303..f15fb02 100644
+--- a/drivers/video/Kconfig
++++ b/drivers/video/Kconfig
+@@ -909,6 +909,18 @@ config FB_XVR2500
+ mostly initialized the card already. It is treated as a
+ completely dumb framebuffer device.
+
++config FB_XVR1000
++ bool "Sun XVR-1000 support"
++ depends on (FB = y) && SPARC64
++ select FB_CFB_FILLRECT
++ select FB_CFB_COPYAREA
++ select FB_CFB_IMAGEBLIT
++ help
++ This is the framebuffer device for the Sun XVR-1000 and similar
++ graphics cards. The driver only works on sparc64 systems where
++ the system firmware has mostly initialized the card already. It
++ is treated as a completely dumb framebuffer device.
++
+ config FB_PVR2
+ tristate "NEC PowerVR 2 display support"
+ depends on FB && SH_DREAMCAST
+diff --git a/drivers/video/Makefile b/drivers/video/Makefile
+index 4ecb30c..8c9a357 100644
+--- a/drivers/video/Makefile
++++ b/drivers/video/Makefile
+@@ -79,6 +79,7 @@ obj-$(CONFIG_FB_N411) += n411.o
+ obj-$(CONFIG_FB_HGA) += hgafb.o
+ obj-$(CONFIG_FB_XVR500) += sunxvr500.o
+ obj-$(CONFIG_FB_XVR2500) += sunxvr2500.o
++obj-$(CONFIG_FB_XVR1000) += sunxvr1000.o
+ obj-$(CONFIG_FB_IGA) += igafb.o
+ obj-$(CONFIG_FB_APOLLO) += dnfb.o
+ obj-$(CONFIG_FB_Q40) += q40fb.o
+diff --git a/drivers/video/sunxvr1000.c b/drivers/video/sunxvr1000.c
+new file mode 100644
+index 0000000..a8248c0
+--- /dev/null
++++ b/drivers/video/sunxvr1000.c
+@@ -0,0 +1,228 @@
++/* sunxvr1000.c: Sun XVR-1000 driver for sparc64 systems
++ *
++ * Copyright (C) 2010 David S. Miller (davem@davemloft.net)
++ */
++
++#include <linux/module.h>
++#include <linux/kernel.h>
++#include <linux/slab.h>
++#include <linux/fb.h>
++#include <linux/init.h>
++#include <linux/of_device.h>
++
++struct gfb_info {
++ struct fb_info *info;
++
++ char __iomem *fb_base;
++ unsigned long fb_base_phys;
++
++ struct device_node *of_node;
++
++ unsigned int width;
++ unsigned int height;
++ unsigned int depth;
++ unsigned int fb_size;
++
++ u32 pseudo_palette[16];
++};
++
++static int __devinit gfb_get_props(struct gfb_info *gp)
++{
++ gp->width = of_getintprop_default(gp->of_node, "width", 0);
++ gp->height = of_getintprop_default(gp->of_node, "height", 0);
++ gp->depth = of_getintprop_default(gp->of_node, "depth", 32);
++
++ if (!gp->width || !gp->height) {
++ printk(KERN_ERR "gfb: Critical properties missing for %s\n",
++ gp->of_node->full_name);
++ return -EINVAL;
++ }
++
++ return 0;
++}
++
++static int gfb_setcolreg(unsigned regno,
++ unsigned red, unsigned green, unsigned blue,
++ unsigned transp, struct fb_info *info)
++{
++ u32 value;
++
++ if (regno < 16) {
++ red >>= 8;
++ green >>= 8;
++ blue >>= 8;
++
++ value = (blue << 16) | (green << 8) | red;
++ ((u32 *)info->pseudo_palette)[regno] = value;
++ }
++
++ return 0;
++}
++
++static struct fb_ops gfb_ops = {
++ .owner = THIS_MODULE,
++ .fb_setcolreg = gfb_setcolreg,
++ .fb_fillrect = cfb_fillrect,
++ .fb_copyarea = cfb_copyarea,
++ .fb_imageblit = cfb_imageblit,
++};
++
++static int __devinit gfb_set_fbinfo(struct gfb_info *gp)
++{
++ struct fb_info *info = gp->info;
++ struct fb_var_screeninfo *var = &info->var;
++
++ info->flags = FBINFO_DEFAULT;
++ info->fbops = &gfb_ops;
++ info->screen_base = gp->fb_base;
++ info->screen_size = gp->fb_size;
++
++ info->pseudo_palette = gp->pseudo_palette;
++
++ /* Fill fix common fields */
++ strlcpy(info->fix.id, "gfb", sizeof(info->fix.id));
++ info->fix.smem_start = gp->fb_base_phys;
++ info->fix.smem_len = gp->fb_size;
++ info->fix.type = FB_TYPE_PACKED_PIXELS;
++ if (gp->depth == 32 || gp->depth == 24)
++ info->fix.visual = FB_VISUAL_TRUECOLOR;
++ else
++ info->fix.visual = FB_VISUAL_PSEUDOCOLOR;
++
++ var->xres = gp->width;
++ var->yres = gp->height;
++ var->xres_virtual = var->xres;
++ var->yres_virtual = var->yres;
++ var->bits_per_pixel = gp->depth;
++
++ var->red.offset = 0;
++ var->red.length = 8;
++ var->green.offset = 8;
++ var->green.length = 8;
++ var->blue.offset = 16;
++ var->blue.length = 8;
++ var->transp.offset = 0;
++ var->transp.length = 0;
++
++ if (fb_alloc_cmap(&info->cmap, 256, 0)) {
++ printk(KERN_ERR "gfb: Cannot allocate color map.\n");
++ return -ENOMEM;
++ }
++
++ return 0;
++}
++
++static int __devinit gfb_probe(struct of_device *op,
++ const struct of_device_id *match)
++{
++ struct device_node *dp = op->node;
++ struct fb_info *info;
++ struct gfb_info *gp;
++ int err;
++
++ info = framebuffer_alloc(sizeof(struct gfb_info), &op->dev);
++ if (!info) {
++ printk(KERN_ERR "gfb: Cannot allocate fb_info\n");
++ err = -ENOMEM;
++ goto err_out;
++ }
++
++ gp = info->par;
++ gp->info = info;
++ gp->of_node = dp;
++
++ gp->fb_base_phys = op->resource[6].start;
++
++ err = gfb_get_props(gp);
++ if (err)
++ goto err_release_fb;
++
++ /* Framebuffer length is the same regardless of resolution. */
++ info->fix.line_length = 16384;
++ gp->fb_size = info->fix.line_length * gp->height;
++
++ gp->fb_base = of_ioremap(&op->resource[6], 0,
++ gp->fb_size, "gfb fb");
++ if (!gp->fb_base)
++ goto err_release_fb;
++
++ err = gfb_set_fbinfo(gp);
++ if (err)
++ goto err_unmap_fb;
++
++ printk("gfb: Found device at %s\n", dp->full_name);
++
++ err = register_framebuffer(info);
++ if (err < 0) {
++ printk(KERN_ERR "gfb: Could not register framebuffer %s\n",
++ dp->full_name);
++ goto err_unmap_fb;
++ }
++
++ dev_set_drvdata(&op->dev, info);
++
++ return 0;
++
++err_unmap_fb:
++ of_iounmap(&op->resource[6], gp->fb_base, gp->fb_size);
++
++err_release_fb:
++ framebuffer_release(info);
++
++err_out:
++ return err;
++}
++
++static int __devexit gfb_remove(struct of_device *op)
++{
++ struct fb_info *info = dev_get_drvdata(&op->dev);
++ struct gfb_info *gp = info->par;
++
++ unregister_framebuffer(info);
++
++ iounmap(gp->fb_base);
++
++ of_iounmap(&op->resource[6], gp->fb_base, gp->fb_size);
++
++ framebuffer_release(info);
++
++ dev_set_drvdata(&op->dev, NULL);
++
++ return 0;
++}
++
++static const struct of_device_id gfb_match[] = {
++ {
++ .name = "SUNW,gfb",
++ },
++ {},
++};
++MODULE_DEVICE_TABLE(of, ffb_match);
++
++static struct of_platform_driver gfb_driver = {
++ .name = "gfb",
++ .match_table = gfb_match,
++ .probe = gfb_probe,
++ .remove = __devexit_p(gfb_remove),
++};
++
++static int __init gfb_init(void)
++{
++ if (fb_get_options("gfb", NULL))
++ return -ENODEV;
++
++ return of_register_driver(&gfb_driver, &of_bus_type);
++}
++
++static void __exit gfb_exit(void)
++{
++ of_unregister_driver(&gfb_driver);
++}
++
++module_init(gfb_init);
++module_exit(gfb_exit);
++
++MODULE_DESCRIPTION("framebuffer driver for Sun XVR-1000 graphics");
++MODULE_AUTHOR("David S. Miller <davem@davemloft.net>");
++MODULE_VERSION("1.0");
++MODULE_LICENSE("GPL");
+diff --git a/drivers/virtio/virtio_pci.c b/drivers/virtio/virtio_pci.c
+index 28d9cf7..7127bfe 100644
+--- a/drivers/virtio/virtio_pci.c
++++ b/drivers/virtio/virtio_pci.c
+@@ -473,7 +473,8 @@ static void vp_del_vqs(struct virtio_device *vdev)
+
+ list_for_each_entry_safe(vq, n, &vdev->vqs, list) {
+ info = vq->priv;
+- if (vp_dev->per_vq_vectors)
++ if (vp_dev->per_vq_vectors &&
++ info->msix_vector != VIRTIO_MSI_NO_VECTOR)
+ free_irq(vp_dev->msix_entries[info->msix_vector].vector,
+ vq);
+ vp_del_vq(vq);
+diff --git a/fs/exec.c b/fs/exec.c
+index cce6bbd..9071360 100644
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -1923,8 +1923,9 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
+ /*
+ * Dont allow local users get cute and trick others to coredump
+ * into their pre-created files:
++ * Note, this is not relevant for pipes
+ */
+- if (inode->i_uid != current_fsuid())
++ if (!ispipe && (inode->i_uid != current_fsuid()))
+ goto close_fail;
+ if (!cprm.file->f_op)
+ goto close_fail;
+diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c
+index a6abbae..e6dd2ae 100644
+--- a/fs/gfs2/file.c
++++ b/fs/gfs2/file.c
+@@ -640,7 +640,7 @@ static int gfs2_lock(struct file *file, int cmd, struct file_lock *fl)
+
+ if (!(fl->fl_flags & FL_POSIX))
+ return -ENOLCK;
+- if (__mandatory_lock(&ip->i_inode))
++ if (__mandatory_lock(&ip->i_inode) && fl->fl_type != F_UNLCK)
+ return -ENOLCK;
+
+ if (cmd == F_CANCELLK) {
+diff --git a/fs/nfs/delegation.h b/fs/nfs/delegation.h
+index 944b627..69e7b81 100644
+--- a/fs/nfs/delegation.h
++++ b/fs/nfs/delegation.h
+@@ -71,4 +71,10 @@ static inline int nfs_inode_return_delegation(struct inode *inode)
+ }
+ #endif
+
++static inline int nfs_have_delegated_attributes(struct inode *inode)
++{
++ return nfs_have_delegation(inode, FMODE_READ) &&
++ !(NFS_I(inode)->cache_validity & NFS_INO_REVAL_FORCED);
++}
++
+ #endif
+diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
+index 3c7f03b..8b5382e 100644
+--- a/fs/nfs/dir.c
++++ b/fs/nfs/dir.c
+@@ -1789,7 +1789,7 @@ static int nfs_access_get_cached(struct inode *inode, struct rpc_cred *cred, str
+ cache = nfs_access_search_rbtree(inode, cred);
+ if (cache == NULL)
+ goto out;
+- if (!nfs_have_delegation(inode, FMODE_READ) &&
++ if (!nfs_have_delegated_attributes(inode) &&
+ !time_in_range_open(jiffies, cache->jiffies, cache->jiffies + nfsi->attrtimeo))
+ goto out_stale;
+ res->jiffies = cache->jiffies;
+diff --git a/fs/nfs/file.c b/fs/nfs/file.c
+index 63f2071..bdd2142 100644
+--- a/fs/nfs/file.c
++++ b/fs/nfs/file.c
+@@ -486,7 +486,8 @@ static int nfs_release_page(struct page *page, gfp_t gfp)
+ {
+ dfprintk(PAGECACHE, "NFS: release_page(%p)\n", page);
+
+- if (gfp & __GFP_WAIT)
++ /* Only do I/O if gfp is a superset of GFP_KERNEL */
++ if ((gfp & GFP_KERNEL) == GFP_KERNEL)
+ nfs_wb_page(page->mapping->host, page);
+ /* If PagePrivate() is set, then the page is not freeable */
+ if (PagePrivate(page))
+diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
+index f141bde..5f59a2d 100644
+--- a/fs/nfs/inode.c
++++ b/fs/nfs/inode.c
+@@ -759,7 +759,7 @@ int nfs_attribute_timeout(struct inode *inode)
+ {
+ struct nfs_inode *nfsi = NFS_I(inode);
+
+- if (nfs_have_delegation(inode, FMODE_READ))
++ if (nfs_have_delegated_attributes(inode))
+ return 0;
+ return !time_in_range_open(jiffies, nfsi->read_cache_jiffies, nfsi->read_cache_jiffies + nfsi->attrtimeo);
+ }
+diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
+index a12c45b..29d9d36 100644
+--- a/fs/nfs/pagelist.c
++++ b/fs/nfs/pagelist.c
+@@ -112,12 +112,10 @@ void nfs_unlock_request(struct nfs_page *req)
+ */
+ int nfs_set_page_tag_locked(struct nfs_page *req)
+ {
+- struct nfs_inode *nfsi = NFS_I(req->wb_context->path.dentry->d_inode);
+-
+ if (!nfs_lock_request_dontget(req))
+ return 0;
+ if (req->wb_page != NULL)
+- radix_tree_tag_set(&nfsi->nfs_page_tree, req->wb_index, NFS_PAGE_TAG_LOCKED);
++ radix_tree_tag_set(&NFS_I(req->wb_context->path.dentry->d_inode)->nfs_page_tree, req->wb_index, NFS_PAGE_TAG_LOCKED);
+ return 1;
+ }
+
+@@ -126,10 +124,10 @@ int nfs_set_page_tag_locked(struct nfs_page *req)
+ */
+ void nfs_clear_page_tag_locked(struct nfs_page *req)
+ {
+- struct inode *inode = req->wb_context->path.dentry->d_inode;
+- struct nfs_inode *nfsi = NFS_I(inode);
+-
+ if (req->wb_page != NULL) {
++ struct inode *inode = req->wb_context->path.dentry->d_inode;
++ struct nfs_inode *nfsi = NFS_I(inode);
++
+ spin_lock(&inode->i_lock);
+ radix_tree_tag_clear(&nfsi->nfs_page_tree, req->wb_index, NFS_PAGE_TAG_LOCKED);
+ nfs_unlock_request(req);
+@@ -142,16 +140,22 @@ void nfs_clear_page_tag_locked(struct nfs_page *req)
+ * nfs_clear_request - Free up all resources allocated to the request
+ * @req:
+ *
+- * Release page resources associated with a write request after it
+- * has completed.
++ * Release page and open context resources associated with a read/write
++ * request after it has completed.
+ */
+ void nfs_clear_request(struct nfs_page *req)
+ {
+ struct page *page = req->wb_page;
++ struct nfs_open_context *ctx = req->wb_context;
++
+ if (page != NULL) {
+ page_cache_release(page);
+ req->wb_page = NULL;
+ }
++ if (ctx != NULL) {
++ put_nfs_open_context(ctx);
++ req->wb_context = NULL;
++ }
+ }
+
+
+@@ -165,9 +169,8 @@ static void nfs_free_request(struct kref *kref)
+ {
+ struct nfs_page *req = container_of(kref, struct nfs_page, wb_kref);
+
+- /* Release struct file or cached credential */
++ /* Release struct file and open context */
+ nfs_clear_request(req);
+- put_nfs_open_context(req->wb_context);
+ nfs_page_free(req);
+ }
+
+diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
+index 105b508..ddce17b 100644
+--- a/fs/nilfs2/segment.c
++++ b/fs/nilfs2/segment.c
+@@ -1902,8 +1902,7 @@ static void nilfs_segctor_abort_construction(struct nilfs_sc_info *sci,
+
+ list_splice_tail_init(&sci->sc_write_logs, &logs);
+ ret = nilfs_wait_on_logs(&logs);
+- if (ret)
+- nilfs_abort_logs(&logs, NULL, sci->sc_super_root, ret);
++ nilfs_abort_logs(&logs, NULL, sci->sc_super_root, ret ? : err);
+
+ list_splice_tail_init(&sci->sc_segbufs, &logs);
+ nilfs_cancel_segusage(&logs, nilfs->ns_sufile);
+diff --git a/fs/partitions/msdos.c b/fs/partitions/msdos.c
+index 0028d2e..90be97f 100644
+--- a/fs/partitions/msdos.c
++++ b/fs/partitions/msdos.c
+@@ -31,14 +31,17 @@
+ */
+ #include <asm/unaligned.h>
+
+-#define SYS_IND(p) (get_unaligned(&p->sys_ind))
+-#define NR_SECTS(p) ({ __le32 __a = get_unaligned(&p->nr_sects); \
+- le32_to_cpu(__a); \
+- })
++#define SYS_IND(p) get_unaligned(&p->sys_ind)
+
+-#define START_SECT(p) ({ __le32 __a = get_unaligned(&p->start_sect); \
+- le32_to_cpu(__a); \
+- })
++static inline sector_t nr_sects(struct partition *p)
++{
++ return (sector_t)get_unaligned_le32(&p->nr_sects);
++}
++
++static inline sector_t start_sect(struct partition *p)
++{
++ return (sector_t)get_unaligned_le32(&p->start_sect);
++}
+
+ static inline int is_extended_partition(struct partition *p)
+ {
+@@ -104,13 +107,13 @@ static int aix_magic_present(unsigned char *p, struct block_device *bdev)
+
+ static void
+ parse_extended(struct parsed_partitions *state, struct block_device *bdev,
+- u32 first_sector, u32 first_size)
++ sector_t first_sector, sector_t first_size)
+ {
+ struct partition *p;
+ Sector sect;
+ unsigned char *data;
+- u32 this_sector, this_size;
+- int sector_size = bdev_logical_block_size(bdev) / 512;
++ sector_t this_sector, this_size;
++ sector_t sector_size = bdev_logical_block_size(bdev) / 512;
+ int loopct = 0; /* number of links followed
+ without finding a data partition */
+ int i;
+@@ -145,14 +148,14 @@ parse_extended(struct parsed_partitions *state, struct block_device *bdev,
+ * First process the data partition(s)
+ */
+ for (i=0; i<4; i++, p++) {
+- u32 offs, size, next;
+- if (!NR_SECTS(p) || is_extended_partition(p))
++ sector_t offs, size, next;
++ if (!nr_sects(p) || is_extended_partition(p))
+ continue;
+
+ /* Check the 3rd and 4th entries -
+ these sometimes contain random garbage */
+- offs = START_SECT(p)*sector_size;
+- size = NR_SECTS(p)*sector_size;
++ offs = start_sect(p)*sector_size;
++ size = nr_sects(p)*sector_size;
+ next = this_sector + offs;
+ if (i >= 2) {
+ if (offs + size > this_size)
+@@ -179,13 +182,13 @@ parse_extended(struct parsed_partitions *state, struct block_device *bdev,
+ */
+ p -= 4;
+ for (i=0; i<4; i++, p++)
+- if (NR_SECTS(p) && is_extended_partition(p))
++ if (nr_sects(p) && is_extended_partition(p))
+ break;
+ if (i == 4)
+ goto done; /* nothing left to do */
+
+- this_sector = first_sector + START_SECT(p) * sector_size;
+- this_size = NR_SECTS(p) * sector_size;
++ this_sector = first_sector + start_sect(p) * sector_size;
++ this_size = nr_sects(p) * sector_size;
+ put_dev_sector(sect);
+ }
+ done:
+@@ -197,7 +200,7 @@ done:
+
+ static void
+ parse_solaris_x86(struct parsed_partitions *state, struct block_device *bdev,
+- u32 offset, u32 size, int origin)
++ sector_t offset, sector_t size, int origin)
+ {
+ #ifdef CONFIG_SOLARIS_X86_PARTITION
+ Sector sect;
+@@ -244,7 +247,7 @@ parse_solaris_x86(struct parsed_partitions *state, struct block_device *bdev,
+ */
+ static void
+ parse_bsd(struct parsed_partitions *state, struct block_device *bdev,
+- u32 offset, u32 size, int origin, char *flavour,
++ sector_t offset, sector_t size, int origin, char *flavour,
+ int max_partitions)
+ {
+ Sector sect;
+@@ -263,7 +266,7 @@ parse_bsd(struct parsed_partitions *state, struct block_device *bdev,
+ if (le16_to_cpu(l->d_npartitions) < max_partitions)
+ max_partitions = le16_to_cpu(l->d_npartitions);
+ for (p = l->d_partitions; p - l->d_partitions < max_partitions; p++) {
+- u32 bsd_start, bsd_size;
++ sector_t bsd_start, bsd_size;
+
+ if (state->next == state->limit)
+ break;
+@@ -290,7 +293,7 @@ parse_bsd(struct parsed_partitions *state, struct block_device *bdev,
+
+ static void
+ parse_freebsd(struct parsed_partitions *state, struct block_device *bdev,
+- u32 offset, u32 size, int origin)
++ sector_t offset, sector_t size, int origin)
+ {
+ #ifdef CONFIG_BSD_DISKLABEL
+ parse_bsd(state, bdev, offset, size, origin,
+@@ -300,7 +303,7 @@ parse_freebsd(struct parsed_partitions *state, struct block_device *bdev,
+
+ static void
+ parse_netbsd(struct parsed_partitions *state, struct block_device *bdev,
+- u32 offset, u32 size, int origin)
++ sector_t offset, sector_t size, int origin)
+ {
+ #ifdef CONFIG_BSD_DISKLABEL
+ parse_bsd(state, bdev, offset, size, origin,
+@@ -310,7 +313,7 @@ parse_netbsd(struct parsed_partitions *state, struct block_device *bdev,
+
+ static void
+ parse_openbsd(struct parsed_partitions *state, struct block_device *bdev,
+- u32 offset, u32 size, int origin)
++ sector_t offset, sector_t size, int origin)
+ {
+ #ifdef CONFIG_BSD_DISKLABEL
+ parse_bsd(state, bdev, offset, size, origin,
+@@ -324,7 +327,7 @@ parse_openbsd(struct parsed_partitions *state, struct block_device *bdev,
+ */
+ static void
+ parse_unixware(struct parsed_partitions *state, struct block_device *bdev,
+- u32 offset, u32 size, int origin)
++ sector_t offset, sector_t size, int origin)
+ {
+ #ifdef CONFIG_UNIXWARE_DISKLABEL
+ Sector sect;
+@@ -348,7 +351,8 @@ parse_unixware(struct parsed_partitions *state, struct block_device *bdev,
+
+ if (p->s_label != UNIXWARE_FS_UNUSED)
+ put_partition(state, state->next++,
+- START_SECT(p), NR_SECTS(p));
++ le32_to_cpu(p->start_sect),
++ le32_to_cpu(p->nr_sects));
+ p++;
+ }
+ put_dev_sector(sect);
+@@ -363,7 +367,7 @@ parse_unixware(struct parsed_partitions *state, struct block_device *bdev,
+ */
+ static void
+ parse_minix(struct parsed_partitions *state, struct block_device *bdev,
+- u32 offset, u32 size, int origin)
++ sector_t offset, sector_t size, int origin)
+ {
+ #ifdef CONFIG_MINIX_SUBPARTITION
+ Sector sect;
+@@ -390,7 +394,7 @@ parse_minix(struct parsed_partitions *state, struct block_device *bdev,
+ /* add each partition in use */
+ if (SYS_IND(p) == MINIX_PARTITION)
+ put_partition(state, state->next++,
+- START_SECT(p), NR_SECTS(p));
++ start_sect(p), nr_sects(p));
+ }
+ printk(" >\n");
+ }
+@@ -401,7 +405,7 @@ parse_minix(struct parsed_partitions *state, struct block_device *bdev,
+ static struct {
+ unsigned char id;
+ void (*parse)(struct parsed_partitions *, struct block_device *,
+- u32, u32, int);
++ sector_t, sector_t, int);
+ } subtypes[] = {
+ {FREEBSD_PARTITION, parse_freebsd},
+ {NETBSD_PARTITION, parse_netbsd},
+@@ -415,7 +419,7 @@ static struct {
+
+ int msdos_partition(struct parsed_partitions *state, struct block_device *bdev)
+ {
+- int sector_size = bdev_logical_block_size(bdev) / 512;
++ sector_t sector_size = bdev_logical_block_size(bdev) / 512;
+ Sector sect;
+ unsigned char *data;
+ struct partition *p;
+@@ -483,14 +487,21 @@ int msdos_partition(struct parsed_partitions *state, struct block_device *bdev)
+
+ state->next = 5;
+ for (slot = 1 ; slot <= 4 ; slot++, p++) {
+- u32 start = START_SECT(p)*sector_size;
+- u32 size = NR_SECTS(p)*sector_size;
++ sector_t start = start_sect(p)*sector_size;
++ sector_t size = nr_sects(p)*sector_size;
+ if (!size)
+ continue;
+ if (is_extended_partition(p)) {
+- /* prevent someone doing mkfs or mkswap on an
+- extended partition, but leave room for LILO */
+- put_partition(state, slot, start, size == 1 ? 1 : 2);
++ /*
++ * prevent someone doing mkfs or mkswap on an
++ * extended partition, but leave room for LILO
++ * FIXME: this uses one logical sector for > 512b
++ * sector, although it may not be enough/proper.
++ */
++ sector_t n = 2;
++ n = min(size, max(sector_size, n));
++ put_partition(state, slot, start, n);
++
+ printk(" <");
+ parse_extended(state, bdev, start, size);
+ printk(" >");
+@@ -513,7 +524,7 @@ int msdos_partition(struct parsed_partitions *state, struct block_device *bdev)
+ unsigned char id = SYS_IND(p);
+ int n;
+
+- if (!NR_SECTS(p))
++ if (!nr_sects(p))
+ continue;
+
+ for (n = 0; subtypes[n].parse && id != subtypes[n].id; n++)
+@@ -521,8 +532,8 @@ int msdos_partition(struct parsed_partitions *state, struct block_device *bdev)
+
+ if (!subtypes[n].parse)
+ continue;
+- subtypes[n].parse(state, bdev, START_SECT(p)*sector_size,
+- NR_SECTS(p)*sector_size, slot);
++ subtypes[n].parse(state, bdev, start_sect(p)*sector_size,
++ nr_sects(p)*sector_size, slot);
+ }
+ put_dev_sector(sect);
+ return 1;
+diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
+index 3fc62b0..6e722c1 100644
+--- a/fs/quota/dquot.c
++++ b/fs/quota/dquot.c
+@@ -225,6 +225,8 @@ static struct hlist_head *dquot_hash;
+ struct dqstats dqstats;
+ EXPORT_SYMBOL(dqstats);
+
++static qsize_t inode_get_rsv_space(struct inode *inode);
++
+ static inline unsigned int
+ hashfn(const struct super_block *sb, unsigned int id, int type)
+ {
+@@ -840,11 +842,14 @@ static int dqinit_needed(struct inode *inode, int type)
+ static void add_dquot_ref(struct super_block *sb, int type)
+ {
+ struct inode *inode, *old_inode = NULL;
++ int reserved = 0;
+
+ spin_lock(&inode_lock);
+ list_for_each_entry(inode, &sb->s_inodes, i_sb_list) {
+ if (inode->i_state & (I_FREEING|I_CLEAR|I_WILL_FREE|I_NEW))
+ continue;
++ if (unlikely(inode_get_rsv_space(inode) > 0))
++ reserved = 1;
+ if (!atomic_read(&inode->i_writecount))
+ continue;
+ if (!dqinit_needed(inode, type))
+@@ -865,6 +870,12 @@ static void add_dquot_ref(struct super_block *sb, int type)
+ }
+ spin_unlock(&inode_lock);
+ iput(old_inode);
++
++ if (reserved) {
++ printk(KERN_WARNING "VFS (%s): Writes happened before quota"
++ " was turned on thus quota information is probably "
++ "inconsistent. Please run quotacheck(8).\n", sb->s_id);
++ }
+ }
+
+ /*
+@@ -978,10 +989,12 @@ static inline void dquot_resv_space(struct dquot *dquot, qsize_t number)
+ /*
+ * Claim reserved quota space
+ */
+-static void dquot_claim_reserved_space(struct dquot *dquot,
+- qsize_t number)
++static void dquot_claim_reserved_space(struct dquot *dquot, qsize_t number)
+ {
+- WARN_ON(dquot->dq_dqb.dqb_rsvspace < number);
++ if (dquot->dq_dqb.dqb_rsvspace < number) {
++ WARN_ON_ONCE(1);
++ number = dquot->dq_dqb.dqb_rsvspace;
++ }
+ dquot->dq_dqb.dqb_curspace += number;
+ dquot->dq_dqb.dqb_rsvspace -= number;
+ }
+@@ -989,7 +1002,12 @@ static void dquot_claim_reserved_space(struct dquot *dquot,
+ static inline
+ void dquot_free_reserved_space(struct dquot *dquot, qsize_t number)
+ {
+- dquot->dq_dqb.dqb_rsvspace -= number;
++ if (dquot->dq_dqb.dqb_rsvspace >= number)
++ dquot->dq_dqb.dqb_rsvspace -= number;
++ else {
++ WARN_ON_ONCE(1);
++ dquot->dq_dqb.dqb_rsvspace = 0;
++ }
+ }
+
+ static void dquot_decr_inodes(struct dquot *dquot, qsize_t number)
+@@ -1242,6 +1260,7 @@ static int info_bdq_free(struct dquot *dquot, qsize_t space)
+ return QUOTA_NL_BHARDBELOW;
+ return QUOTA_NL_NOWARN;
+ }
++
+ /*
+ * Initialize quota pointers in inode
+ * We do things in a bit complicated way but by that we avoid calling
+@@ -1253,6 +1272,7 @@ int dquot_initialize(struct inode *inode, int type)
+ int cnt, ret = 0;
+ struct dquot *got[MAXQUOTAS] = { NULL, NULL };
+ struct super_block *sb = inode->i_sb;
++ qsize_t rsv;
+
+ /* First test before acquiring mutex - solves deadlocks when we
+ * re-enter the quota code and are already holding the mutex */
+@@ -1287,6 +1307,13 @@ int dquot_initialize(struct inode *inode, int type)
+ if (!inode->i_dquot[cnt]) {
+ inode->i_dquot[cnt] = got[cnt];
+ got[cnt] = NULL;
++ /*
++ * Make quota reservation system happy if someone
++ * did a write before quota was turned on
++ */
++ rsv = inode_get_rsv_space(inode);
++ if (unlikely(rsv))
++ dquot_resv_space(inode->i_dquot[cnt], rsv);
+ }
+ }
+ out_err:
+@@ -1351,28 +1378,30 @@ static qsize_t *inode_reserved_space(struct inode * inode)
+ return inode->i_sb->dq_op->get_reserved_space(inode);
+ }
+
+-static void inode_add_rsv_space(struct inode *inode, qsize_t number)
++void inode_add_rsv_space(struct inode *inode, qsize_t number)
+ {
+ spin_lock(&inode->i_lock);
+ *inode_reserved_space(inode) += number;
+ spin_unlock(&inode->i_lock);
+ }
++EXPORT_SYMBOL(inode_add_rsv_space);
+
+-
+-static void inode_claim_rsv_space(struct inode *inode, qsize_t number)
++void inode_claim_rsv_space(struct inode *inode, qsize_t number)
+ {
+ spin_lock(&inode->i_lock);
+ *inode_reserved_space(inode) -= number;
+ __inode_add_bytes(inode, number);
+ spin_unlock(&inode->i_lock);
+ }
++EXPORT_SYMBOL(inode_claim_rsv_space);
+
+-static void inode_sub_rsv_space(struct inode *inode, qsize_t number)
++void inode_sub_rsv_space(struct inode *inode, qsize_t number)
+ {
+ spin_lock(&inode->i_lock);
+ *inode_reserved_space(inode) -= number;
+ spin_unlock(&inode->i_lock);
+ }
++EXPORT_SYMBOL(inode_sub_rsv_space);
+
+ static qsize_t inode_get_rsv_space(struct inode *inode)
+ {
+diff --git a/include/linux/decompress/mm.h b/include/linux/decompress/mm.h
+index 5032b9a..ad5ec1d 100644
+--- a/include/linux/decompress/mm.h
++++ b/include/linux/decompress/mm.h
+@@ -14,11 +14,21 @@
+
+ /* Code active when included from pre-boot environment: */
+
++/*
++ * Some architectures want to ensure there is no local data in their
++ * pre-boot environment, so that data can arbitarily relocated (via
++ * GOT references). This is achieved by defining STATIC_RW_DATA to
++ * be null.
++ */
++#ifndef STATIC_RW_DATA
++#define STATIC_RW_DATA static
++#endif
++
+ /* A trivial malloc implementation, adapted from
+ * malloc by Hannu Savolainen 1993 and Matthias Urlichs 1994
+ */
+-static unsigned long malloc_ptr;
+-static int malloc_count;
++STATIC_RW_DATA unsigned long malloc_ptr;
++STATIC_RW_DATA int malloc_count;
+
+ static void *malloc(int size)
+ {
+diff --git a/include/linux/if_tunnel.h b/include/linux/if_tunnel.h
+index 1822d63..16b92d0 100644
+--- a/include/linux/if_tunnel.h
++++ b/include/linux/if_tunnel.h
+@@ -2,6 +2,7 @@
+ #define _IF_TUNNEL_H_
+
+ #include <linux/types.h>
++#include <asm/byteorder.h>
+
+ #ifdef __KERNEL__
+ #include <linux/ip.h>
+diff --git a/include/linux/kfifo.h b/include/linux/kfifo.h
+index bc0fc79..ece0b1c 100644
+--- a/include/linux/kfifo.h
++++ b/include/linux/kfifo.h
+@@ -102,8 +102,6 @@ union { \
+ unsigned char name##kfifo_buffer[size]; \
+ struct kfifo name = __kfifo_initializer(size, name##kfifo_buffer)
+
+-#undef __kfifo_initializer
+-
+ extern void kfifo_init(struct kfifo *fifo, void *buffer,
+ unsigned int size);
+ extern __must_check int kfifo_alloc(struct kfifo *fifo, unsigned int size,
+diff --git a/include/linux/kvm.h b/include/linux/kvm.h
+index a24de0b..553a388 100644
+--- a/include/linux/kvm.h
++++ b/include/linux/kvm.h
+@@ -497,6 +497,7 @@ struct kvm_ioeventfd {
+ #endif
+ #define KVM_CAP_S390_PSW 42
+ #define KVM_CAP_PPC_SEGSTATE 43
++#define KVM_CAP_X86_ROBUST_SINGLESTEP 51
+
+ #ifdef KVM_CAP_IRQ_ROUTING
+
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index 99914e6..03e8d81 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -2023,12 +2023,12 @@ static inline void skb_bond_set_mac_by_master(struct sk_buff *skb,
+ * duplicates except for 802.3ad ETH_P_SLOW, alb non-mcast/bcast, and
+ * ARP on active-backup slaves with arp_validate enabled.
+ */
+-static inline int skb_bond_should_drop(struct sk_buff *skb)
++static inline int skb_bond_should_drop(struct sk_buff *skb,
++ struct net_device *master)
+ {
+- struct net_device *dev = skb->dev;
+- struct net_device *master = dev->master;
+-
+ if (master) {
++ struct net_device *dev = skb->dev;
++
+ if (master->priv_flags & IFF_MASTER_ARPMON)
+ dev->last_rx = jiffies;
+
+diff --git a/include/linux/netfilter/nfnetlink.h b/include/linux/netfilter/nfnetlink.h
+index 49d321f..264d83d 100644
+--- a/include/linux/netfilter/nfnetlink.h
++++ b/include/linux/netfilter/nfnetlink.h
+@@ -76,7 +76,7 @@ extern int nfnetlink_subsys_unregister(const struct nfnetlink_subsystem *n);
+ extern int nfnetlink_has_listeners(unsigned int group);
+ extern int nfnetlink_send(struct sk_buff *skb, u32 pid, unsigned group,
+ int echo, gfp_t flags);
+-extern void nfnetlink_set_err(u32 pid, u32 group, int error);
++extern int nfnetlink_set_err(u32 pid, u32 group, int error);
+ extern int nfnetlink_unicast(struct sk_buff *skb, u_int32_t pid, int flags);
+
+ extern void nfnl_lock(void);
+diff --git a/include/linux/netlink.h b/include/linux/netlink.h
+index fde27c0..6eaca5e 100644
+--- a/include/linux/netlink.h
++++ b/include/linux/netlink.h
+@@ -188,7 +188,7 @@ extern int netlink_has_listeners(struct sock *sk, unsigned int group);
+ extern int netlink_unicast(struct sock *ssk, struct sk_buff *skb, __u32 pid, int nonblock);
+ extern int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, __u32 pid,
+ __u32 group, gfp_t allocation);
+-extern void netlink_set_err(struct sock *ssk, __u32 pid, __u32 group, int code);
++extern int netlink_set_err(struct sock *ssk, __u32 pid, __u32 group, int code);
+ extern int netlink_register_notifier(struct notifier_block *nb);
+ extern int netlink_unregister_notifier(struct notifier_block *nb);
+
+diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
+index c8ea0c7..41f977b 100644
+--- a/include/linux/perf_event.h
++++ b/include/linux/perf_event.h
+@@ -793,6 +793,13 @@ struct perf_sample_data {
+ struct perf_raw_record *raw;
+ };
+
++static inline
++void perf_sample_data_init(struct perf_sample_data *data, u64 addr)
++{
++ data->addr = addr;
++ data->raw = NULL;
++}
++
+ extern void perf_output_sample(struct perf_output_handle *handle,
+ struct perf_event_header *header,
+ struct perf_sample_data *data,
+diff --git a/include/linux/quotaops.h b/include/linux/quotaops.h
+index 3ebb231..a529d86 100644
+--- a/include/linux/quotaops.h
++++ b/include/linux/quotaops.h
+@@ -26,6 +26,10 @@ static inline void writeout_quota_sb(struct super_block *sb, int type)
+ sb->s_qcop->quota_sync(sb, type);
+ }
+
++void inode_add_rsv_space(struct inode *inode, qsize_t number);
++void inode_claim_rsv_space(struct inode *inode, qsize_t number);
++void inode_sub_rsv_space(struct inode *inode, qsize_t number);
++
+ int dquot_initialize(struct inode *inode, int type);
+ int dquot_drop(struct inode *inode);
+ struct dquot *dqget(struct super_block *sb, unsigned int id, int type);
+@@ -42,7 +46,6 @@ int dquot_alloc_inode(const struct inode *inode, qsize_t number);
+ int dquot_reserve_space(struct inode *inode, qsize_t number, int prealloc);
+ int dquot_claim_space(struct inode *inode, qsize_t number);
+ void dquot_release_reserved_space(struct inode *inode, qsize_t number);
+-qsize_t dquot_get_reserved_space(struct inode *inode);
+
+ int dquot_free_space(struct inode *inode, qsize_t number);
+ int dquot_free_inode(const struct inode *inode, qsize_t number);
+@@ -199,6 +202,8 @@ static inline int vfs_dq_reserve_space(struct inode *inode, qsize_t nr)
+ if (inode->i_sb->dq_op->reserve_space(inode, nr, 0) == NO_QUOTA)
+ return 1;
+ }
++ else
++ inode_add_rsv_space(inode, nr);
+ return 0;
+ }
+
+@@ -221,7 +226,7 @@ static inline int vfs_dq_claim_space(struct inode *inode, qsize_t nr)
+ if (inode->i_sb->dq_op->claim_space(inode, nr) == NO_QUOTA)
+ return 1;
+ } else
+- inode_add_bytes(inode, nr);
++ inode_claim_rsv_space(inode, nr);
+
+ mark_inode_dirty(inode);
+ return 0;
+@@ -235,6 +240,8 @@ void vfs_dq_release_reservation_space(struct inode *inode, qsize_t nr)
+ {
+ if (sb_any_quota_active(inode->i_sb))
+ inode->i_sb->dq_op->release_rsv(inode, nr);
++ else
++ inode_sub_rsv_space(inode, nr);
+ }
+
+ static inline void vfs_dq_free_space_nodirty(struct inode *inode, qsize_t nr)
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index ec226a2..28a9617 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -190,9 +190,6 @@ struct skb_shared_info {
+ atomic_t dataref;
+ unsigned short nr_frags;
+ unsigned short gso_size;
+-#ifdef CONFIG_HAS_DMA
+- dma_addr_t dma_head;
+-#endif
+ /* Warning: this field is not always filled in (UFO)! */
+ unsigned short gso_segs;
+ unsigned short gso_type;
+@@ -201,9 +198,6 @@ struct skb_shared_info {
+ struct sk_buff *frag_list;
+ struct skb_shared_hwtstamps hwtstamps;
+ skb_frag_t frags[MAX_SKB_FRAGS];
+-#ifdef CONFIG_HAS_DMA
+- dma_addr_t dma_maps[MAX_SKB_FRAGS];
+-#endif
+ /* Intermediate layers must ensure that destructor_arg
+ * remains valid until skb destructor */
+ void * destructor_arg;
+diff --git a/include/linux/tty.h b/include/linux/tty.h
+index 6abfcf5..42f2076 100644
+--- a/include/linux/tty.h
++++ b/include/linux/tty.h
+@@ -68,6 +68,17 @@ struct tty_buffer {
+ unsigned long data[0];
+ };
+
++/*
++ * We default to dicing tty buffer allocations to this many characters
++ * in order to avoid multiple page allocations. We know the size of
++ * tty_buffer itself but it must also be taken into account that the
++ * the buffer is 256 byte aligned. See tty_buffer_find for the allocation
++ * logic this must match
++ */
++
++#define TTY_BUFFER_PAGE (((PAGE_SIZE - sizeof(struct tty_buffer)) / 2) & ~0xFF)
++
++
+ struct tty_bufhead {
+ struct delayed_work work;
+ spinlock_t lock;
+diff --git a/include/net/mac80211.h b/include/net/mac80211.h
+index 0bf3697..f39b303 100644
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -926,6 +926,9 @@ enum ieee80211_tkip_key_type {
+ * @IEEE80211_HW_BEACON_FILTER:
+ * Hardware supports dropping of irrelevant beacon frames to
+ * avoid waking up cpu.
++ * @IEEE80211_HW_REPORTS_TX_ACK_STATUS:
++ * Hardware can provide ack status reports of Tx frames to
++ * the stack.
+ */
+ enum ieee80211_hw_flags {
+ IEEE80211_HW_HAS_RATE_CONTROL = 1<<0,
+@@ -943,6 +946,7 @@ enum ieee80211_hw_flags {
+ IEEE80211_HW_SUPPORTS_DYNAMIC_PS = 1<<12,
+ IEEE80211_HW_MFP_CAPABLE = 1<<13,
+ IEEE80211_HW_BEACON_FILTER = 1<<14,
++ IEEE80211_HW_REPORTS_TX_ACK_STATUS = 1<<15,
+ };
+
+ /**
+@@ -2258,7 +2262,8 @@ struct rate_control_ops {
+ struct ieee80211_sta *sta, void *priv_sta);
+ void (*rate_update)(void *priv, struct ieee80211_supported_band *sband,
+ struct ieee80211_sta *sta,
+- void *priv_sta, u32 changed);
++ void *priv_sta, u32 changed,
++ enum nl80211_channel_type oper_chan_type);
+ void (*free_sta)(void *priv, struct ieee80211_sta *sta,
+ void *priv_sta);
+
+diff --git a/include/net/netlink.h b/include/net/netlink.h
+index a63b219..668ad04 100644
+--- a/include/net/netlink.h
++++ b/include/net/netlink.h
+@@ -945,7 +945,11 @@ static inline u64 nla_get_u64(const struct nlattr *nla)
+ */
+ static inline __be64 nla_get_be64(const struct nlattr *nla)
+ {
+- return *(__be64 *) nla_data(nla);
++ __be64 tmp;
++
++ nla_memcpy(&tmp, nla, sizeof(tmp));
++
++ return tmp;
+ }
+
+ /**
+diff --git a/include/net/sock.h b/include/net/sock.h
+index 3f1a480..86f2da1 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -253,6 +253,8 @@ struct sock {
+ struct {
+ struct sk_buff *head;
+ struct sk_buff *tail;
++ int len;
++ int limit;
+ } sk_backlog;
+ wait_queue_head_t *sk_sleep;
+ struct dst_entry *sk_dst_cache;
+@@ -574,8 +576,8 @@ static inline int sk_stream_memory_free(struct sock *sk)
+ return sk->sk_wmem_queued < sk->sk_sndbuf;
+ }
+
+-/* The per-socket spinlock must be held here. */
+-static inline void sk_add_backlog(struct sock *sk, struct sk_buff *skb)
++/* OOB backlog add */
++static inline void __sk_add_backlog(struct sock *sk, struct sk_buff *skb)
+ {
+ if (!sk->sk_backlog.tail) {
+ sk->sk_backlog.head = sk->sk_backlog.tail = skb;
+@@ -586,6 +588,17 @@ static inline void sk_add_backlog(struct sock *sk, struct sk_buff *skb)
+ skb->next = NULL;
+ }
+
++/* The per-socket spinlock must be held here. */
++static inline __must_check int sk_add_backlog(struct sock *sk, struct sk_buff *skb)
++{
++ if (sk->sk_backlog.len >= max(sk->sk_backlog.limit, sk->sk_rcvbuf << 1))
++ return -ENOBUFS;
++
++ __sk_add_backlog(sk, skb);
++ sk->sk_backlog.len += skb->truesize;
++ return 0;
++}
++
+ static inline int sk_backlog_rcv(struct sock *sk, struct sk_buff *skb)
+ {
+ return sk->sk_backlog_rcv(sk, skb);
+diff --git a/include/net/xfrm.h b/include/net/xfrm.h
+index 60c2770..1e355d8 100644
+--- a/include/net/xfrm.h
++++ b/include/net/xfrm.h
+@@ -274,7 +274,8 @@ struct xfrm_policy_afinfo {
+ struct dst_entry *dst,
+ int nfheader_len);
+ int (*fill_dst)(struct xfrm_dst *xdst,
+- struct net_device *dev);
++ struct net_device *dev,
++ struct flowi *fl);
+ };
+
+ extern int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo);
+diff --git a/init/main.c b/init/main.c
+index 4cb47a1..512ba15 100644
+--- a/init/main.c
++++ b/init/main.c
+@@ -846,7 +846,7 @@ static int __init kernel_init(void * unused)
+ /*
+ * init can allocate pages on any node
+ */
+- set_mems_allowed(node_possible_map);
++ set_mems_allowed(node_states[N_HIGH_MEMORY]);
+ /*
+ * init can run on any cpu.
+ */
+diff --git a/ipc/mqueue.c b/ipc/mqueue.c
+index c79bd57..04985a7 100644
+--- a/ipc/mqueue.c
++++ b/ipc/mqueue.c
+@@ -705,7 +705,7 @@ SYSCALL_DEFINE4(mq_open, const char __user *, u_name, int, oflag, mode_t, mode,
+ dentry = lookup_one_len(name, ipc_ns->mq_mnt->mnt_root, strlen(name));
+ if (IS_ERR(dentry)) {
+ error = PTR_ERR(dentry);
+- goto out_err;
++ goto out_putfd;
+ }
+ mntget(ipc_ns->mq_mnt);
+
+@@ -742,7 +742,6 @@ out:
+ mntput(ipc_ns->mq_mnt);
+ out_putfd:
+ put_unused_fd(fd);
+-out_err:
+ fd = error;
+ out_upsem:
+ mutex_unlock(&ipc_ns->mq_mnt->mnt_root->d_inode->i_mutex);
+diff --git a/kernel/cpuset.c b/kernel/cpuset.c
+index ba401fa..5d38bd7 100644
+--- a/kernel/cpuset.c
++++ b/kernel/cpuset.c
+@@ -920,9 +920,6 @@ static int update_cpumask(struct cpuset *cs, struct cpuset *trialcs,
+ * call to guarantee_online_mems(), as we know no one is changing
+ * our task's cpuset.
+ *
+- * Hold callback_mutex around the two modifications of our tasks
+- * mems_allowed to synchronize with cpuset_mems_allowed().
+- *
+ * While the mm_struct we are migrating is typically from some
+ * other task, the task_struct mems_allowed that we are hacking
+ * is for our current task, which must allocate new pages for that
+@@ -1391,11 +1388,10 @@ static void cpuset_attach(struct cgroup_subsys *ss, struct cgroup *cont,
+
+ if (cs == &top_cpuset) {
+ cpumask_copy(cpus_attach, cpu_possible_mask);
+- to = node_possible_map;
+ } else {
+ guarantee_online_cpus(cs, cpus_attach);
+- guarantee_online_mems(cs, &to);
+ }
++ guarantee_online_mems(cs, &to);
+
+ /* do per-task migration stuff possibly for each in the threadgroup */
+ cpuset_attach_task(tsk, &to, cs);
+@@ -2090,15 +2086,23 @@ static int cpuset_track_online_cpus(struct notifier_block *unused_nb,
+ static int cpuset_track_online_nodes(struct notifier_block *self,
+ unsigned long action, void *arg)
+ {
++ nodemask_t oldmems;
++
+ cgroup_lock();
+ switch (action) {
+ case MEM_ONLINE:
+- case MEM_OFFLINE:
++ oldmems = top_cpuset.mems_allowed;
+ mutex_lock(&callback_mutex);
+ top_cpuset.mems_allowed = node_states[N_HIGH_MEMORY];
+ mutex_unlock(&callback_mutex);
+- if (action == MEM_OFFLINE)
+- scan_for_empty_cpusets(&top_cpuset);
++ update_tasks_nodemask(&top_cpuset, &oldmems, NULL);
++ break;
++ case MEM_OFFLINE:
++ /*
++ * needn't update top_cpuset.mems_allowed explicitly because
++ * scan_for_empty_cpusets() will update it.
++ */
++ scan_for_empty_cpusets(&top_cpuset);
+ break;
+ default:
+ break;
+diff --git a/kernel/hw_breakpoint.c b/kernel/hw_breakpoint.c
+index 967e661..4d99512 100644
+--- a/kernel/hw_breakpoint.c
++++ b/kernel/hw_breakpoint.c
+@@ -489,5 +489,4 @@ struct pmu perf_ops_bp = {
+ .enable = arch_install_hw_breakpoint,
+ .disable = arch_uninstall_hw_breakpoint,
+ .read = hw_breakpoint_pmu_read,
+- .unthrottle = hw_breakpoint_pmu_unthrottle
+ };
+diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
+index d70394f..71eba24 100644
+--- a/kernel/irq/chip.c
++++ b/kernel/irq/chip.c
+@@ -359,6 +359,23 @@ static inline void mask_ack_irq(struct irq_desc *desc, int irq)
+ if (desc->chip->ack)
+ desc->chip->ack(irq);
+ }
++ desc->status |= IRQ_MASKED;
++}
++
++static inline void mask_irq(struct irq_desc *desc, int irq)
++{
++ if (desc->chip->mask) {
++ desc->chip->mask(irq);
++ desc->status |= IRQ_MASKED;
++ }
++}
++
++static inline void unmask_irq(struct irq_desc *desc, int irq)
++{
++ if (desc->chip->unmask) {
++ desc->chip->unmask(irq);
++ desc->status &= ~IRQ_MASKED;
++ }
+ }
+
+ /*
+@@ -484,10 +501,8 @@ handle_level_irq(unsigned int irq, struct irq_desc *desc)
+ raw_spin_lock(&desc->lock);
+ desc->status &= ~IRQ_INPROGRESS;
+
+- if (unlikely(desc->status & IRQ_ONESHOT))
+- desc->status |= IRQ_MASKED;
+- else if (!(desc->status & IRQ_DISABLED) && desc->chip->unmask)
+- desc->chip->unmask(irq);
++ if (!(desc->status & (IRQ_DISABLED | IRQ_ONESHOT)))
++ unmask_irq(desc, irq);
+ out_unlock:
+ raw_spin_unlock(&desc->lock);
+ }
+@@ -524,8 +539,7 @@ handle_fasteoi_irq(unsigned int irq, struct irq_desc *desc)
+ action = desc->action;
+ if (unlikely(!action || (desc->status & IRQ_DISABLED))) {
+ desc->status |= IRQ_PENDING;
+- if (desc->chip->mask)
+- desc->chip->mask(irq);
++ mask_irq(desc, irq);
+ goto out;
+ }
+
+@@ -593,7 +607,7 @@ handle_edge_irq(unsigned int irq, struct irq_desc *desc)
+ irqreturn_t action_ret;
+
+ if (unlikely(!action)) {
+- desc->chip->mask(irq);
++ mask_irq(desc, irq);
+ goto out_unlock;
+ }
+
+@@ -605,8 +619,7 @@ handle_edge_irq(unsigned int irq, struct irq_desc *desc)
+ if (unlikely((desc->status &
+ (IRQ_PENDING | IRQ_MASKED | IRQ_DISABLED)) ==
+ (IRQ_PENDING | IRQ_MASKED))) {
+- desc->chip->unmask(irq);
+- desc->status &= ~IRQ_MASKED;
++ unmask_irq(desc, irq);
+ }
+
+ desc->status &= ~IRQ_PENDING;
+diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
+index eb6078c..69a3d7b 100644
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -483,8 +483,26 @@ static int irq_wait_for_interrupt(struct irqaction *action)
+ */
+ static void irq_finalize_oneshot(unsigned int irq, struct irq_desc *desc)
+ {
++again:
+ chip_bus_lock(irq, desc);
+ raw_spin_lock_irq(&desc->lock);
++
++ /*
++ * Implausible though it may be we need to protect us against
++ * the following scenario:
++ *
++ * The thread is faster done than the hard interrupt handler
++ * on the other CPU. If we unmask the irq line then the
++ * interrupt can come in again and masks the line, leaves due
++ * to IRQ_INPROGRESS and the irq line is masked forever.
++ */
++ if (unlikely(desc->status & IRQ_INPROGRESS)) {
++ raw_spin_unlock_irq(&desc->lock);
++ chip_bus_sync_unlock(irq, desc);
++ cpu_relax();
++ goto again;
++ }
++
+ if (!(desc->status & IRQ_DISABLED) && (desc->status & IRQ_MASKED)) {
+ desc->status &= ~IRQ_MASKED;
+ desc->chip->unmask(irq);
+diff --git a/kernel/kthread.c b/kernel/kthread.c
+index fbb6222..84c7f99 100644
+--- a/kernel/kthread.c
++++ b/kernel/kthread.c
+@@ -219,7 +219,7 @@ int kthreadd(void *unused)
+ set_task_comm(tsk, "kthreadd");
+ ignore_signals(tsk);
+ set_cpus_allowed_ptr(tsk, cpu_all_mask);
+- set_mems_allowed(node_possible_map);
++ set_mems_allowed(node_states[N_HIGH_MEMORY]);
+
+ current->flags |= PF_NOFREEZE | PF_FREEZER_NOSIG;
+
+diff --git a/kernel/perf_event.c b/kernel/perf_event.c
+index b707465..32d0ae2 100644
+--- a/kernel/perf_event.c
++++ b/kernel/perf_event.c
+@@ -4027,8 +4027,7 @@ void __perf_sw_event(u32 event_id, u64 nr, int nmi,
+ if (rctx < 0)
+ return;
+
+- data.addr = addr;
+- data.raw = NULL;
++ perf_sample_data_init(&data, addr);
+
+ do_perf_sw_event(PERF_TYPE_SOFTWARE, event_id, nr, nmi, &data, regs);
+
+@@ -4073,11 +4072,10 @@ static enum hrtimer_restart perf_swevent_hrtimer(struct hrtimer *hrtimer)
+ struct perf_event *event;
+ u64 period;
+
+- event = container_of(hrtimer, struct perf_event, hw.hrtimer);
++ event = container_of(hrtimer, struct perf_event, hw.hrtimer);
+ event->pmu->read(event);
+
+- data.addr = 0;
+- data.raw = NULL;
++ perf_sample_data_init(&data, 0);
+ data.period = event->hw.last_period;
+ regs = get_irq_regs();
+ /*
+@@ -4241,17 +4239,15 @@ static const struct pmu perf_ops_task_clock = {
+ void perf_tp_event(int event_id, u64 addr, u64 count, void *record,
+ int entry_size)
+ {
++ struct pt_regs *regs = get_irq_regs();
++ struct perf_sample_data data;
+ struct perf_raw_record raw = {
+ .size = entry_size,
+ .data = record,
+ };
+
+- struct perf_sample_data data = {
+- .addr = addr,
+- .raw = &raw,
+- };
+-
+- struct pt_regs *regs = get_irq_regs();
++ perf_sample_data_init(&data, addr);
++ data.raw = &raw;
+
+ if (!regs)
+ regs = task_pt_regs(current);
+@@ -4367,8 +4363,7 @@ void perf_bp_event(struct perf_event *bp, void *data)
+ struct perf_sample_data sample;
+ struct pt_regs *regs = data;
+
+- sample.raw = NULL;
+- sample.addr = bp->attr.bp_addr;
++ perf_sample_data_init(&sample, bp->attr.bp_addr);
+
+ if (!perf_exclude_event(bp, regs))
+ perf_swevent_add(bp, 1, 1, &sample, regs);
+@@ -5251,12 +5246,22 @@ int perf_event_init_task(struct task_struct *child)
+ return ret;
+ }
+
++static void __init perf_event_init_all_cpus(void)
++{
++ int cpu;
++ struct perf_cpu_context *cpuctx;
++
++ for_each_possible_cpu(cpu) {
++ cpuctx = &per_cpu(perf_cpu_context, cpu);
++ __perf_event_init_context(&cpuctx->ctx, NULL);
++ }
++}
++
+ static void __cpuinit perf_event_init_cpu(int cpu)
+ {
+ struct perf_cpu_context *cpuctx;
+
+ cpuctx = &per_cpu(perf_cpu_context, cpu);
+- __perf_event_init_context(&cpuctx->ctx, NULL);
+
+ spin_lock(&perf_resource_lock);
+ cpuctx->max_pertask = perf_max_events - perf_reserved_percpu;
+@@ -5327,6 +5332,7 @@ static struct notifier_block __cpuinitdata perf_cpu_nb = {
+
+ void __init perf_event_init(void)
+ {
++ perf_event_init_all_cpus();
+ perf_cpu_notify(&perf_cpu_nb, (unsigned long)CPU_UP_PREPARE,
+ (void *)(long)smp_processor_id());
+ perf_cpu_notify(&perf_cpu_nb, (unsigned long)CPU_ONLINE,
+diff --git a/kernel/sched.c b/kernel/sched.c
+index 00a59b0..7ca9345 100644
+--- a/kernel/sched.c
++++ b/kernel/sched.c
+@@ -3423,6 +3423,7 @@ struct sd_lb_stats {
+ unsigned long max_load;
+ unsigned long busiest_load_per_task;
+ unsigned long busiest_nr_running;
++ unsigned long busiest_group_capacity;
+
+ int group_imb; /* Is there imbalance in this sd */
+ #if defined(CONFIG_SCHED_MC) || defined(CONFIG_SCHED_SMT)
+@@ -3742,8 +3743,7 @@ static inline void update_sg_lb_stats(struct sched_domain *sd,
+ unsigned long load, max_cpu_load, min_cpu_load;
+ int i;
+ unsigned int balance_cpu = -1, first_idle_cpu = 0;
+- unsigned long sum_avg_load_per_task;
+- unsigned long avg_load_per_task;
++ unsigned long avg_load_per_task = 0;
+
+ if (local_group) {
+ balance_cpu = group_first_cpu(group);
+@@ -3752,7 +3752,6 @@ static inline void update_sg_lb_stats(struct sched_domain *sd,
+ }
+
+ /* Tally up the load of all CPUs in the group */
+- sum_avg_load_per_task = avg_load_per_task = 0;
+ max_cpu_load = 0;
+ min_cpu_load = ~0UL;
+
+@@ -3782,7 +3781,6 @@ static inline void update_sg_lb_stats(struct sched_domain *sd,
+ sgs->sum_nr_running += rq->nr_running;
+ sgs->sum_weighted_load += weighted_cpuload(i);
+
+- sum_avg_load_per_task += cpu_avg_load_per_task(i);
+ }
+
+ /*
+@@ -3800,7 +3798,6 @@ static inline void update_sg_lb_stats(struct sched_domain *sd,
+ /* Adjust by relative CPU power of the group */
+ sgs->avg_load = (sgs->group_load * SCHED_LOAD_SCALE) / group->cpu_power;
+
+-
+ /*
+ * Consider the group unbalanced when the imbalance is larger
+ * than the average weight of two tasks.
+@@ -3810,8 +3807,8 @@ static inline void update_sg_lb_stats(struct sched_domain *sd,
+ * normalized nr_running number somewhere that negates
+ * the hierarchy?
+ */
+- avg_load_per_task = (sum_avg_load_per_task * SCHED_LOAD_SCALE) /
+- group->cpu_power;
++ if (sgs->sum_nr_running)
++ avg_load_per_task = sgs->sum_weighted_load / sgs->sum_nr_running;
+
+ if ((max_cpu_load - min_cpu_load) > 2*avg_load_per_task)
+ sgs->group_imb = 1;
+@@ -3880,6 +3877,7 @@ static inline void update_sd_lb_stats(struct sched_domain *sd, int this_cpu,
+ sds->max_load = sgs.avg_load;
+ sds->busiest = group;
+ sds->busiest_nr_running = sgs.sum_nr_running;
++ sds->busiest_group_capacity = sgs.group_capacity;
+ sds->busiest_load_per_task = sgs.sum_weighted_load;
+ sds->group_imb = sgs.group_imb;
+ }
+@@ -3902,6 +3900,7 @@ static inline void fix_small_imbalance(struct sd_lb_stats *sds,
+ {
+ unsigned long tmp, pwr_now = 0, pwr_move = 0;
+ unsigned int imbn = 2;
++ unsigned long scaled_busy_load_per_task;
+
+ if (sds->this_nr_running) {
+ sds->this_load_per_task /= sds->this_nr_running;
+@@ -3912,8 +3911,12 @@ static inline void fix_small_imbalance(struct sd_lb_stats *sds,
+ sds->this_load_per_task =
+ cpu_avg_load_per_task(this_cpu);
+
+- if (sds->max_load - sds->this_load + sds->busiest_load_per_task >=
+- sds->busiest_load_per_task * imbn) {
++ scaled_busy_load_per_task = sds->busiest_load_per_task
++ * SCHED_LOAD_SCALE;
++ scaled_busy_load_per_task /= sds->busiest->cpu_power;
++
++ if (sds->max_load - sds->this_load + scaled_busy_load_per_task >=
++ (scaled_busy_load_per_task * imbn)) {
+ *imbalance = sds->busiest_load_per_task;
+ return;
+ }
+@@ -3964,7 +3967,14 @@ static inline void fix_small_imbalance(struct sd_lb_stats *sds,
+ static inline void calculate_imbalance(struct sd_lb_stats *sds, int this_cpu,
+ unsigned long *imbalance)
+ {
+- unsigned long max_pull;
++ unsigned long max_pull, load_above_capacity = ~0UL;
++
++ sds->busiest_load_per_task /= sds->busiest_nr_running;
++ if (sds->group_imb) {
++ sds->busiest_load_per_task =
++ min(sds->busiest_load_per_task, sds->avg_load);
++ }
++
+ /*
+ * In the presence of smp nice balancing, certain scenarios can have
+ * max load less than avg load(as we skip the groups at or below
+@@ -3975,9 +3985,29 @@ static inline void calculate_imbalance(struct sd_lb_stats *sds, int this_cpu,
+ return fix_small_imbalance(sds, this_cpu, imbalance);
+ }
+
+- /* Don't want to pull so many tasks that a group would go idle */
+- max_pull = min(sds->max_load - sds->avg_load,
+- sds->max_load - sds->busiest_load_per_task);
++ if (!sds->group_imb) {
++ /*
++ * Don't want to pull so many tasks that a group would go idle.
++ */
++ load_above_capacity = (sds->busiest_nr_running -
++ sds->busiest_group_capacity);
++
++ load_above_capacity *= (SCHED_LOAD_SCALE * SCHED_LOAD_SCALE);
++
++ load_above_capacity /= sds->busiest->cpu_power;
++ }
++
++ /*
++ * We're trying to get all the cpus to the average_load, so we don't
++ * want to push ourselves above the average load, nor do we wish to
++ * reduce the max loaded cpu below the average load. At the same time,
++ * we also don't want to reduce the group load below the group capacity
++ * (so that we can implement power-savings policies etc). Thus we look
++ * for the minimum possible imbalance.
++ * Be careful of negative numbers as they'll appear as very large values
++ * with unsigned longs.
++ */
++ max_pull = min(sds->max_load - sds->avg_load, load_above_capacity);
+
+ /* How much load to actually move to equalise the imbalance */
+ *imbalance = min(max_pull * sds->busiest->cpu_power,
+@@ -4045,7 +4075,6 @@ find_busiest_group(struct sched_domain *sd, int this_cpu,
+ * 4) This group is more busy than the avg busieness at this
+ * sched_domain.
+ * 5) The imbalance is within the specified limit.
+- * 6) Any rebalance would lead to ping-pong
+ */
+ if (balance && !(*balance))
+ goto ret;
+@@ -4064,25 +4093,6 @@ find_busiest_group(struct sched_domain *sd, int this_cpu,
+ if (100 * sds.max_load <= sd->imbalance_pct * sds.this_load)
+ goto out_balanced;
+
+- sds.busiest_load_per_task /= sds.busiest_nr_running;
+- if (sds.group_imb)
+- sds.busiest_load_per_task =
+- min(sds.busiest_load_per_task, sds.avg_load);
+-
+- /*
+- * We're trying to get all the cpus to the average_load, so we don't
+- * want to push ourselves above the average load, nor do we wish to
+- * reduce the max loaded cpu below the average load, as either of these
+- * actions would just result in more rebalancing later, and ping-pong
+- * tasks around. Thus we look for the minimum possible imbalance.
+- * Negative imbalances (*we* are more loaded than anyone else) will
+- * be counted as no imbalance for these purposes -- we can't fix that
+- * by pulling tasks to us. Be careful of negative numbers as they'll
+- * appear as very large values with unsigned longs.
+- */
+- if (sds.max_load <= sds.busiest_load_per_task)
+- goto out_balanced;
+-
+ /* Looks like there is an imbalance. Compute it */
+ calculate_imbalance(&sds, this_cpu, imbalance);
+ return sds.busiest;
+diff --git a/kernel/softlockup.c b/kernel/softlockup.c
+index 0d4c789..4b493f6 100644
+--- a/kernel/softlockup.c
++++ b/kernel/softlockup.c
+@@ -155,11 +155,11 @@ void softlockup_tick(void)
+ * Wake up the high-prio watchdog task twice per
+ * threshold timespan.
+ */
+- if (now > touch_ts + softlockup_thresh/2)
++ if (time_after(now - softlockup_thresh/2, touch_ts))
+ wake_up_process(per_cpu(softlockup_watchdog, this_cpu));
+
+ /* Warn about unreasonable delays: */
+- if (now <= (touch_ts + softlockup_thresh))
++ if (time_before_eq(now - softlockup_thresh, touch_ts))
+ return;
+
+ per_cpu(softlockup_print_ts, this_cpu) = touch_ts;
+diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c
+index 1370083..0e98497 100644
+--- a/kernel/time/clocksource.c
++++ b/kernel/time/clocksource.c
+@@ -580,6 +580,10 @@ static inline void clocksource_select(void) { }
+ */
+ static int __init clocksource_done_booting(void)
+ {
++ mutex_lock(&clocksource_mutex);
++ curr_clocksource = clocksource_default_clock();
++ mutex_unlock(&clocksource_mutex);
++
+ finished_booting = 1;
+
+ /*
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 1e6640f..404c9ba 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -3364,6 +3364,7 @@ void ftrace_graph_init_task(struct task_struct *t)
+ {
+ /* Make sure we do not use the parent ret_stack */
+ t->ret_stack = NULL;
++ t->curr_ret_stack = -1;
+
+ if (ftrace_graph_active) {
+ struct ftrace_ret_stack *ret_stack;
+@@ -3373,7 +3374,6 @@ void ftrace_graph_init_task(struct task_struct *t)
+ GFP_KERNEL);
+ if (!ret_stack)
+ return;
+- t->curr_ret_stack = -1;
+ atomic_set(&t->tracing_graph_pause, 0);
+ atomic_set(&t->trace_overrun, 0);
+ t->ftrace_timestamp = 0;
+diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
+index 8c1b2d2..54191d6 100644
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -2232,12 +2232,12 @@ ring_buffer_lock_reserve(struct ring_buffer *buffer, unsigned long length)
+ if (ring_buffer_flags != RB_BUFFERS_ON)
+ return NULL;
+
+- if (atomic_read(&buffer->record_disabled))
+- return NULL;
+-
+ /* If we are tracing schedule, we don't want to recurse */
+ resched = ftrace_preempt_disable();
+
++ if (atomic_read(&buffer->record_disabled))
++ goto out_nocheck;
++
+ if (trace_recursive_lock())
+ goto out_nocheck;
+
+@@ -2469,11 +2469,11 @@ int ring_buffer_write(struct ring_buffer *buffer,
+ if (ring_buffer_flags != RB_BUFFERS_ON)
+ return -EBUSY;
+
+- if (atomic_read(&buffer->record_disabled))
+- return -EBUSY;
+-
+ resched = ftrace_preempt_disable();
+
++ if (atomic_read(&buffer->record_disabled))
++ goto out;
++
+ cpu = raw_smp_processor_id();
+
+ if (!cpumask_test_cpu(cpu, buffer->cpumask))
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index eac6875..45cfb6d 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -747,10 +747,10 @@ out:
+ mutex_unlock(&trace_types_lock);
+ }
+
+-static void __tracing_reset(struct trace_array *tr, int cpu)
++static void __tracing_reset(struct ring_buffer *buffer, int cpu)
+ {
+ ftrace_disable_cpu();
+- ring_buffer_reset_cpu(tr->buffer, cpu);
++ ring_buffer_reset_cpu(buffer, cpu);
+ ftrace_enable_cpu();
+ }
+
+@@ -762,7 +762,7 @@ void tracing_reset(struct trace_array *tr, int cpu)
+
+ /* Make sure all commits have finished */
+ synchronize_sched();
+- __tracing_reset(tr, cpu);
++ __tracing_reset(buffer, cpu);
+
+ ring_buffer_record_enable(buffer);
+ }
+@@ -780,7 +780,7 @@ void tracing_reset_online_cpus(struct trace_array *tr)
+ tr->time_start = ftrace_now(tr->cpu);
+
+ for_each_online_cpu(cpu)
+- __tracing_reset(tr, cpu);
++ __tracing_reset(buffer, cpu);
+
+ ring_buffer_record_enable(buffer);
+ }
+@@ -857,6 +857,8 @@ void tracing_start(void)
+ goto out;
+ }
+
++ /* Prevent the buffers from switching */
++ arch_spin_lock(&ftrace_max_lock);
+
+ buffer = global_trace.buffer;
+ if (buffer)
+@@ -866,6 +868,8 @@ void tracing_start(void)
+ if (buffer)
+ ring_buffer_record_enable(buffer);
+
++ arch_spin_unlock(&ftrace_max_lock);
++
+ ftrace_start();
+ out:
+ spin_unlock_irqrestore(&tracing_start_lock, flags);
+@@ -887,6 +891,9 @@ void tracing_stop(void)
+ if (trace_stop_count++)
+ goto out;
+
++ /* Prevent the buffers from switching */
++ arch_spin_lock(&ftrace_max_lock);
++
+ buffer = global_trace.buffer;
+ if (buffer)
+ ring_buffer_record_disable(buffer);
+@@ -895,6 +902,8 @@ void tracing_stop(void)
+ if (buffer)
+ ring_buffer_record_disable(buffer);
+
++ arch_spin_unlock(&ftrace_max_lock);
++
+ out:
+ spin_unlock_irqrestore(&tracing_start_lock, flags);
+ }
+@@ -1182,6 +1191,13 @@ ftrace_trace_userstack(struct ring_buffer *buffer, unsigned long flags, int pc)
+ if (!(trace_flags & TRACE_ITER_USERSTACKTRACE))
+ return;
+
++ /*
++ * NMIs can not handle page faults, even with fix ups.
++ * The save user stack can (and often does) fault.
++ */
++ if (unlikely(in_nmi()))
++ return;
++
+ event = trace_buffer_lock_reserve(buffer, TRACE_USER_STACK,
+ sizeof(*entry), flags, pc);
+ if (!event)
+@@ -1628,6 +1644,7 @@ static void *s_start(struct seq_file *m, loff_t *pos)
+
+ ftrace_enable_cpu();
+
++ iter->leftover = 0;
+ for (p = iter; p && l < *pos; p = s_next(m, p, &l))
+ ;
+
+diff --git a/mm/mempolicy.c b/mm/mempolicy.c
+index 290fb5b..0beac93 100644
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -2167,8 +2167,8 @@ int mpol_parse_str(char *str, struct mempolicy **mpol, int no_context)
+ char *rest = nodelist;
+ while (isdigit(*rest))
+ rest++;
+- if (!*rest)
+- err = 0;
++ if (*rest)
++ goto out;
+ }
+ break;
+ case MPOL_INTERLEAVE:
+@@ -2177,7 +2177,6 @@ int mpol_parse_str(char *str, struct mempolicy **mpol, int no_context)
+ */
+ if (!nodelist)
+ nodes = node_states[N_HIGH_MEMORY];
+- err = 0;
+ break;
+ case MPOL_LOCAL:
+ /*
+@@ -2187,11 +2186,19 @@ int mpol_parse_str(char *str, struct mempolicy **mpol, int no_context)
+ goto out;
+ mode = MPOL_PREFERRED;
+ break;
+-
+- /*
+- * case MPOL_BIND: mpol_new() enforces non-empty nodemask.
+- * case MPOL_DEFAULT: mpol_new() enforces empty nodemask, ignores flags.
+- */
++ case MPOL_DEFAULT:
++ /*
++ * Insist on a empty nodelist
++ */
++ if (!nodelist)
++ err = 0;
++ goto out;
++ case MPOL_BIND:
++ /*
++ * Insist on a nodelist
++ */
++ if (!nodelist)
++ goto out;
+ }
+
+ mode_flags = 0;
+@@ -2205,13 +2212,14 @@ int mpol_parse_str(char *str, struct mempolicy **mpol, int no_context)
+ else if (!strcmp(flags, "relative"))
+ mode_flags |= MPOL_F_RELATIVE_NODES;
+ else
+- err = 1;
++ goto out;
+ }
+
+ new = mpol_new(mode, mode_flags, &nodes);
+ if (IS_ERR(new))
+- err = 1;
+- else {
++ goto out;
++
++ {
+ int ret;
+ NODEMASK_SCRATCH(scratch);
+ if (scratch) {
+@@ -2222,13 +2230,15 @@ int mpol_parse_str(char *str, struct mempolicy **mpol, int no_context)
+ ret = -ENOMEM;
+ NODEMASK_SCRATCH_FREE(scratch);
+ if (ret) {
+- err = 1;
+ mpol_put(new);
+- } else if (no_context) {
+- /* save for contextualization */
+- new->w.user_nodemask = nodes;
++ goto out;
+ }
+ }
++ err = 0;
++ if (no_context) {
++ /* save for contextualization */
++ new->w.user_nodemask = nodes;
++ }
+
+ out:
+ /* Restore string for error message */
+diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
+index e75a2f3..152760a 100644
+--- a/net/8021q/vlan_core.c
++++ b/net/8021q/vlan_core.c
+@@ -11,7 +11,7 @@ int __vlan_hwaccel_rx(struct sk_buff *skb, struct vlan_group *grp,
+ if (netpoll_rx(skb))
+ return NET_RX_DROP;
+
+- if (skb_bond_should_drop(skb))
++ if (skb_bond_should_drop(skb, ACCESS_ONCE(skb->dev->master)))
+ goto drop;
+
+ __vlan_hwaccel_put_tag(skb, vlan_tci);
+@@ -82,7 +82,7 @@ vlan_gro_common(struct napi_struct *napi, struct vlan_group *grp,
+ {
+ struct sk_buff *p;
+
+- if (skb_bond_should_drop(skb))
++ if (skb_bond_should_drop(skb, ACCESS_ONCE(skb->dev->master)))
+ goto drop;
+
+ __vlan_hwaccel_put_tag(skb, vlan_tci);
+diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
+index 400efa2..615fecc 100644
+--- a/net/bluetooth/l2cap.c
++++ b/net/bluetooth/l2cap.c
+@@ -2830,6 +2830,11 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr
+ int len = cmd->len - sizeof(*rsp);
+ char req[64];
+
++ if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) {
++ l2cap_send_disconn_req(conn, sk);
++ goto done;
++ }
++
+ /* throw out any old stored conf requests */
+ result = L2CAP_CONF_SUCCESS;
+ len = l2cap_parse_conf_rsp(sk, rsp->data,
+@@ -3942,16 +3947,24 @@ static ssize_t l2cap_sysfs_show(struct class *dev, char *buf)
+ struct sock *sk;
+ struct hlist_node *node;
+ char *str = buf;
++ int size = PAGE_SIZE;
+
+ read_lock_bh(&l2cap_sk_list.lock);
+
+ sk_for_each(sk, node, &l2cap_sk_list.head) {
+ struct l2cap_pinfo *pi = l2cap_pi(sk);
++ int len;
+
+- str += sprintf(str, "%s %s %d %d 0x%4.4x 0x%4.4x %d %d %d\n",
++ len = snprintf(str, size, "%s %s %d %d 0x%4.4x 0x%4.4x %d %d %d\n",
+ batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
+ sk->sk_state, __le16_to_cpu(pi->psm), pi->scid,
+ pi->dcid, pi->imtu, pi->omtu, pi->sec_level);
++
++ size -= len;
++ if (size <= 0)
++ break;
++
++ str += len;
+ }
+
+ read_unlock_bh(&l2cap_sk_list.lock);
+diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
+index 89f4a59..3fe9c7c 100644
+--- a/net/bluetooth/rfcomm/core.c
++++ b/net/bluetooth/rfcomm/core.c
+@@ -2103,6 +2103,7 @@ static ssize_t rfcomm_dlc_sysfs_show(struct class *dev, char *buf)
+ struct rfcomm_session *s;
+ struct list_head *pp, *p;
+ char *str = buf;
++ int size = PAGE_SIZE;
+
+ rfcomm_lock();
+
+@@ -2111,11 +2112,21 @@ static ssize_t rfcomm_dlc_sysfs_show(struct class *dev, char *buf)
+ list_for_each(pp, &s->dlcs) {
+ struct sock *sk = s->sock->sk;
+ struct rfcomm_dlc *d = list_entry(pp, struct rfcomm_dlc, list);
++ int len;
+
+- str += sprintf(str, "%s %s %ld %d %d %d %d\n",
++ len = snprintf(str, size, "%s %s %ld %d %d %d %d\n",
+ batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
+ d->state, d->dlci, d->mtu, d->rx_credits, d->tx_credits);
++
++ size -= len;
++ if (size <= 0)
++ break;
++
++ str += len;
+ }
++
++ if (size <= 0)
++ break;
+ }
+
+ rfcomm_unlock();
+diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
+index 4b5968d..bc03b50 100644
+--- a/net/bluetooth/rfcomm/sock.c
++++ b/net/bluetooth/rfcomm/sock.c
+@@ -1066,13 +1066,22 @@ static ssize_t rfcomm_sock_sysfs_show(struct class *dev, char *buf)
+ struct sock *sk;
+ struct hlist_node *node;
+ char *str = buf;
++ int size = PAGE_SIZE;
+
+ read_lock_bh(&rfcomm_sk_list.lock);
+
+ sk_for_each(sk, node, &rfcomm_sk_list.head) {
+- str += sprintf(str, "%s %s %d %d\n",
++ int len;
++
++ len = snprintf(str, size, "%s %s %d %d\n",
+ batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
+ sk->sk_state, rfcomm_pi(sk)->channel);
++
++ size -= len;
++ if (size <= 0)
++ break;
++
++ str += len;
+ }
+
+ read_unlock_bh(&rfcomm_sk_list.lock);
+diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
+index dd8f6ec..66cab63 100644
+--- a/net/bluetooth/sco.c
++++ b/net/bluetooth/sco.c
+@@ -958,13 +958,22 @@ static ssize_t sco_sysfs_show(struct class *dev, char *buf)
+ struct sock *sk;
+ struct hlist_node *node;
+ char *str = buf;
++ int size = PAGE_SIZE;
+
+ read_lock_bh(&sco_sk_list.lock);
+
+ sk_for_each(sk, node, &sco_sk_list.head) {
+- str += sprintf(str, "%s %s %d\n",
++ int len;
++
++ len = snprintf(str, size, "%s %s %d\n",
+ batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
+ sk->sk_state);
++
++ size -= len;
++ if (size <= 0)
++ break;
++
++ str += len;
+ }
+
+ read_unlock_bh(&sco_sk_list.lock);
+diff --git a/net/core/dev.c b/net/core/dev.c
+index ec87421..f51f940 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -2421,6 +2421,7 @@ int netif_receive_skb(struct sk_buff *skb)
+ {
+ struct packet_type *ptype, *pt_prev;
+ struct net_device *orig_dev;
++ struct net_device *master;
+ struct net_device *null_or_orig;
+ int ret = NET_RX_DROP;
+ __be16 type;
+@@ -2440,11 +2441,12 @@ int netif_receive_skb(struct sk_buff *skb)
+
+ null_or_orig = NULL;
+ orig_dev = skb->dev;
+- if (orig_dev->master) {
+- if (skb_bond_should_drop(skb))
++ master = ACCESS_ONCE(orig_dev->master);
++ if (master) {
++ if (skb_bond_should_drop(skb, master))
+ null_or_orig = orig_dev; /* deliver only exact match */
+ else
+- skb->dev = orig_dev->master;
++ skb->dev = master;
+ }
+
+ __get_cpu_var(netdev_rx_stat).total++;
+diff --git a/net/core/sock.c b/net/core/sock.c
+index e1f6f22..5779f31 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -340,8 +340,12 @@ int sk_receive_skb(struct sock *sk, struct sk_buff *skb, const int nested)
+ rc = sk_backlog_rcv(sk, skb);
+
+ mutex_release(&sk->sk_lock.dep_map, 1, _RET_IP_);
+- } else
+- sk_add_backlog(sk, skb);
++ } else if (sk_add_backlog(sk, skb)) {
++ bh_unlock_sock(sk);
++ atomic_inc(&sk->sk_drops);
++ goto discard_and_relse;
++ }
++
+ bh_unlock_sock(sk);
+ out:
+ sock_put(sk);
+@@ -1138,6 +1142,7 @@ struct sock *sk_clone(const struct sock *sk, const gfp_t priority)
+ sock_lock_init(newsk);
+ bh_lock_sock(newsk);
+ newsk->sk_backlog.head = newsk->sk_backlog.tail = NULL;
++ newsk->sk_backlog.len = 0;
+
+ atomic_set(&newsk->sk_rmem_alloc, 0);
+ /*
+@@ -1541,6 +1546,12 @@ static void __release_sock(struct sock *sk)
+
+ bh_lock_sock(sk);
+ } while ((skb = sk->sk_backlog.head) != NULL);
++
++ /*
++ * Doing the zeroing here guarantee we can not loop forever
++ * while a wild producer attempts to flood us.
++ */
++ sk->sk_backlog.len = 0;
+ }
+
+ /**
+@@ -1873,6 +1884,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
+ sk->sk_allocation = GFP_KERNEL;
+ sk->sk_rcvbuf = sysctl_rmem_default;
+ sk->sk_sndbuf = sysctl_wmem_default;
++ sk->sk_backlog.limit = sk->sk_rcvbuf << 1;
+ sk->sk_state = TCP_CLOSE;
+ sk_set_socket(sk, sock);
+
+diff --git a/net/dccp/minisocks.c b/net/dccp/minisocks.c
+index af226a0..0d508c3 100644
+--- a/net/dccp/minisocks.c
++++ b/net/dccp/minisocks.c
+@@ -254,7 +254,7 @@ int dccp_child_process(struct sock *parent, struct sock *child,
+ * in main socket hash table and lock on listening
+ * socket does not protect us more.
+ */
+- sk_add_backlog(child, skb);
++ __sk_add_backlog(child, skb);
+ }
+
+ bh_unlock_sock(child);
+diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
+index f36ce15..68c1454 100644
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -810,11 +810,13 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
+ tunnel->err_count = 0;
+ }
+
+- max_headroom = LL_RESERVED_SPACE(tdev) + gre_hlen;
++ max_headroom = LL_RESERVED_SPACE(tdev) + gre_hlen + rt->u.dst.header_len;
+
+ if (skb_headroom(skb) < max_headroom || skb_shared(skb)||
+ (skb_cloned(skb) && !skb_clone_writable(skb, 0))) {
+ struct sk_buff *new_skb = skb_realloc_headroom(skb, max_headroom);
++ if (max_headroom > dev->needed_headroom)
++ dev->needed_headroom = max_headroom;
+ if (!new_skb) {
+ ip_rt_put(rt);
+ txq->tx_dropped++;
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index d62b05d..af86e41 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -922,10 +922,8 @@ static void rt_secret_rebuild_oneshot(struct net *net)
+ {
+ del_timer_sync(&net->ipv4.rt_secret_timer);
+ rt_cache_invalidate(net);
+- if (ip_rt_secret_interval) {
+- net->ipv4.rt_secret_timer.expires += ip_rt_secret_interval;
+- add_timer(&net->ipv4.rt_secret_timer);
+- }
++ if (ip_rt_secret_interval)
++ mod_timer(&net->ipv4.rt_secret_timer, jiffies + ip_rt_secret_interval);
+ }
+
+ static void rt_emergency_hash_rebuild(struct net *net)
+@@ -1417,7 +1415,7 @@ void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
+ dev_hold(rt->u.dst.dev);
+ if (rt->idev)
+ in_dev_hold(rt->idev);
+- rt->u.dst.obsolete = 0;
++ rt->u.dst.obsolete = -1;
+ rt->u.dst.lastuse = jiffies;
+ rt->u.dst.path = &rt->u.dst;
+ rt->u.dst.neighbour = NULL;
+@@ -1482,11 +1480,12 @@ static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst)
+ struct dst_entry *ret = dst;
+
+ if (rt) {
+- if (dst->obsolete) {
++ if (dst->obsolete > 0) {
+ ip_rt_put(rt);
+ ret = NULL;
+ } else if ((rt->rt_flags & RTCF_REDIRECTED) ||
+- rt->u.dst.expires) {
++ (rt->u.dst.expires &&
++ time_after_eq(jiffies, rt->u.dst.expires))) {
+ unsigned hash = rt_hash(rt->fl.fl4_dst, rt->fl.fl4_src,
+ rt->fl.oif,
+ rt_genid(dev_net(dst->dev)));
+@@ -1702,7 +1701,9 @@ static void ip_rt_update_pmtu(struct dst_entry *dst, u32 mtu)
+
+ static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie)
+ {
+- return NULL;
++ if (rt_is_expired((struct rtable *)dst))
++ return NULL;
++ return dst;
+ }
+
+ static void ipv4_dst_destroy(struct dst_entry *dst)
+@@ -1864,7 +1865,8 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
+ if (!rth)
+ goto e_nobufs;
+
+- rth->u.dst.output= ip_rt_bug;
++ rth->u.dst.output = ip_rt_bug;
++ rth->u.dst.obsolete = -1;
+
+ atomic_set(&rth->u.dst.__refcnt, 1);
+ rth->u.dst.flags= DST_HOST;
+@@ -2025,6 +2027,7 @@ static int __mkroute_input(struct sk_buff *skb,
+ rth->fl.oif = 0;
+ rth->rt_spec_dst= spec_dst;
+
++ rth->u.dst.obsolete = -1;
+ rth->u.dst.input = ip_forward;
+ rth->u.dst.output = ip_output;
+ rth->rt_genid = rt_genid(dev_net(rth->u.dst.dev));
+@@ -2189,6 +2192,7 @@ local_input:
+ goto e_nobufs;
+
+ rth->u.dst.output= ip_rt_bug;
++ rth->u.dst.obsolete = -1;
+ rth->rt_genid = rt_genid(net);
+
+ atomic_set(&rth->u.dst.__refcnt, 1);
+@@ -2415,6 +2419,7 @@ static int __mkroute_output(struct rtable **result,
+ rth->rt_spec_dst= fl->fl4_src;
+
+ rth->u.dst.output=ip_output;
++ rth->u.dst.obsolete = -1;
+ rth->rt_genid = rt_genid(dev_net(dev_out));
+
+ RT_CACHE_STAT_INC(out_slow_tot);
+@@ -3072,22 +3077,20 @@ static void rt_secret_reschedule(int old)
+ rtnl_lock();
+ for_each_net(net) {
+ int deleted = del_timer_sync(&net->ipv4.rt_secret_timer);
++ long time;
+
+ if (!new)
+ continue;
+
+ if (deleted) {
+- long time = net->ipv4.rt_secret_timer.expires - jiffies;
++ time = net->ipv4.rt_secret_timer.expires - jiffies;
+
+ if (time <= 0 || (time += diff) <= 0)
+ time = 0;
+-
+- net->ipv4.rt_secret_timer.expires = time;
+ } else
+- net->ipv4.rt_secret_timer.expires = new;
++ time = new;
+
+- net->ipv4.rt_secret_timer.expires += jiffies;
+- add_timer(&net->ipv4.rt_secret_timer);
++ mod_timer(&net->ipv4.rt_secret_timer, jiffies + time);
+ }
+ rtnl_unlock();
+ }
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index b0a26bb..564a0f8 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -429,7 +429,7 @@ unsigned int tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
+ if (tp->urg_seq == tp->copied_seq &&
+ !sock_flag(sk, SOCK_URGINLINE) &&
+ tp->urg_data)
+- target--;
++ target++;
+
+ /* Potential race condition. If read of tp below will
+ * escape above sk->sk_state, we can be illegally awaken
+@@ -1254,6 +1254,39 @@ static void tcp_prequeue_process(struct sock *sk)
+ tp->ucopy.memory = 0;
+ }
+
++#ifdef CONFIG_NET_DMA
++static void tcp_service_net_dma(struct sock *sk, bool wait)
++{
++ dma_cookie_t done, used;
++ dma_cookie_t last_issued;
++ struct tcp_sock *tp = tcp_sk(sk);
++
++ if (!tp->ucopy.dma_chan)
++ return;
++
++ last_issued = tp->ucopy.dma_cookie;
++ dma_async_memcpy_issue_pending(tp->ucopy.dma_chan);
++
++ do {
++ if (dma_async_memcpy_complete(tp->ucopy.dma_chan,
++ last_issued, &done,
++ &used) == DMA_SUCCESS) {
++ /* Safe to free early-copied skbs now */
++ __skb_queue_purge(&sk->sk_async_wait_queue);
++ break;
++ } else {
++ struct sk_buff *skb;
++ while ((skb = skb_peek(&sk->sk_async_wait_queue)) &&
++ (dma_async_is_complete(skb->dma_cookie, done,
++ used) == DMA_SUCCESS)) {
++ __skb_dequeue(&sk->sk_async_wait_queue);
++ kfree_skb(skb);
++ }
++ }
++ } while (wait);
++}
++#endif
++
+ static inline struct sk_buff *tcp_recv_skb(struct sock *sk, u32 seq, u32 *off)
+ {
+ struct sk_buff *skb;
+@@ -1546,6 +1579,10 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
+ /* __ Set realtime policy in scheduler __ */
+ }
+
++#ifdef CONFIG_NET_DMA
++ if (tp->ucopy.dma_chan)
++ dma_async_memcpy_issue_pending(tp->ucopy.dma_chan);
++#endif
+ if (copied >= target) {
+ /* Do not sleep, just process backlog. */
+ release_sock(sk);
+@@ -1554,6 +1591,7 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
+ sk_wait_data(sk, &timeo);
+
+ #ifdef CONFIG_NET_DMA
++ tcp_service_net_dma(sk, false); /* Don't block */
+ tp->ucopy.wakeup = 0;
+ #endif
+
+@@ -1633,6 +1671,9 @@ do_prequeue:
+ copied = -EFAULT;
+ break;
+ }
++
++ dma_async_memcpy_issue_pending(tp->ucopy.dma_chan);
++
+ if ((offset + used) == skb->len)
+ copied_early = 1;
+
+@@ -1702,27 +1743,9 @@ skip_copy:
+ }
+
+ #ifdef CONFIG_NET_DMA
+- if (tp->ucopy.dma_chan) {
+- dma_cookie_t done, used;
+-
+- dma_async_memcpy_issue_pending(tp->ucopy.dma_chan);
+-
+- while (dma_async_memcpy_complete(tp->ucopy.dma_chan,
+- tp->ucopy.dma_cookie, &done,
+- &used) == DMA_IN_PROGRESS) {
+- /* do partial cleanup of sk_async_wait_queue */
+- while ((skb = skb_peek(&sk->sk_async_wait_queue)) &&
+- (dma_async_is_complete(skb->dma_cookie, done,
+- used) == DMA_SUCCESS)) {
+- __skb_dequeue(&sk->sk_async_wait_queue);
+- kfree_skb(skb);
+- }
+- }
++ tcp_service_net_dma(sk, true); /* Wait for queue to drain */
++ tp->ucopy.dma_chan = NULL;
+
+- /* Safe to free early-copied skbs now */
+- __skb_queue_purge(&sk->sk_async_wait_queue);
+- tp->ucopy.dma_chan = NULL;
+- }
+ if (tp->ucopy.pinned_list) {
+ dma_unpin_iovec_pages(tp->ucopy.pinned_list);
+ tp->ucopy.pinned_list = NULL;
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 3fddc69..b347d3c 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -2499,6 +2499,9 @@ static void tcp_mark_head_lost(struct sock *sk, int packets)
+ int err;
+ unsigned int mss;
+
++ if (packets == 0)
++ return;
++
+ WARN_ON(packets > tp->packets_out);
+ if (tp->lost_skb_hint) {
+ skb = tp->lost_skb_hint;
+diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
+index 65b8ebf..de935e3 100644
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -1677,8 +1677,10 @@ process:
+ if (!tcp_prequeue(sk, skb))
+ ret = tcp_v4_do_rcv(sk, skb);
+ }
+- } else
+- sk_add_backlog(sk, skb);
++ } else if (sk_add_backlog(sk, skb)) {
++ bh_unlock_sock(sk);
++ goto discard_and_relse;
++ }
+ bh_unlock_sock(sk);
+
+ sock_put(sk);
+diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
+index f206ee5..4199bc6 100644
+--- a/net/ipv4/tcp_minisocks.c
++++ b/net/ipv4/tcp_minisocks.c
+@@ -728,7 +728,7 @@ int tcp_child_process(struct sock *parent, struct sock *child,
+ * in main socket hash table and lock on listening
+ * socket does not protect us more.
+ */
+- sk_add_backlog(child, skb);
++ __sk_add_backlog(child, skb);
+ }
+
+ bh_unlock_sock(child);
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 383ce23..dc26654 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -2393,13 +2393,17 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
+ struct tcp_extend_values *xvp = tcp_xv(rvp);
+ struct inet_request_sock *ireq = inet_rsk(req);
+ struct tcp_sock *tp = tcp_sk(sk);
++ const struct tcp_cookie_values *cvp = tp->cookie_values;
+ struct tcphdr *th;
+ struct sk_buff *skb;
+ struct tcp_md5sig_key *md5;
+ int tcp_header_size;
+ int mss;
++ int s_data_desired = 0;
+
+- skb = sock_wmalloc(sk, MAX_TCP_HEADER + 15, 1, GFP_ATOMIC);
++ if (cvp != NULL && cvp->s_data_constant && cvp->s_data_desired)
++ s_data_desired = cvp->s_data_desired;
++ skb = sock_wmalloc(sk, MAX_TCP_HEADER + 15 + s_data_desired, 1, GFP_ATOMIC);
+ if (skb == NULL)
+ return NULL;
+
+@@ -2454,16 +2458,12 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
+ TCPCB_FLAG_SYN | TCPCB_FLAG_ACK);
+
+ if (OPTION_COOKIE_EXTENSION & opts.options) {
+- const struct tcp_cookie_values *cvp = tp->cookie_values;
+-
+- if (cvp != NULL &&
+- cvp->s_data_constant &&
+- cvp->s_data_desired > 0) {
+- u8 *buf = skb_put(skb, cvp->s_data_desired);
++ if (s_data_desired) {
++ u8 *buf = skb_put(skb, s_data_desired);
+
+ /* copy data directly from the listening socket. */
+- memcpy(buf, cvp->s_data_payload, cvp->s_data_desired);
+- TCP_SKB_CB(skb)->end_seq += cvp->s_data_desired;
++ memcpy(buf, cvp->s_data_payload, s_data_desired);
++ TCP_SKB_CB(skb)->end_seq += s_data_desired;
+ }
+
+ if (opts.hash_size > 0) {
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index f0126fd..112c611 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -1372,8 +1372,10 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
+ bh_lock_sock(sk);
+ if (!sock_owned_by_user(sk))
+ rc = __udp_queue_rcv_skb(sk, skb);
+- else
+- sk_add_backlog(sk, skb);
++ else if (sk_add_backlog(sk, skb)) {
++ bh_unlock_sock(sk);
++ goto drop;
++ }
+ bh_unlock_sock(sk);
+
+ return rc;
+diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
+index 67107d6..e4a1483 100644
+--- a/net/ipv4/xfrm4_policy.c
++++ b/net/ipv4/xfrm4_policy.c
+@@ -91,11 +91,12 @@ static int xfrm4_init_path(struct xfrm_dst *path, struct dst_entry *dst,
+ return 0;
+ }
+
+-static int xfrm4_fill_dst(struct xfrm_dst *xdst, struct net_device *dev)
++static int xfrm4_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
++ struct flowi *fl)
+ {
+ struct rtable *rt = (struct rtable *)xdst->route;
+
+- xdst->u.rt.fl = rt->fl;
++ xdst->u.rt.fl = *fl;
+
+ xdst->u.dst.dev = dev;
+ dev_hold(dev);
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index c2bd74c..6232284 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -897,12 +897,17 @@ static struct dst_entry *ip6_negative_advice(struct dst_entry *dst)
+ struct rt6_info *rt = (struct rt6_info *) dst;
+
+ if (rt) {
+- if (rt->rt6i_flags & RTF_CACHE)
+- ip6_del_rt(rt);
+- else
++ if (rt->rt6i_flags & RTF_CACHE) {
++ if (rt6_check_expired(rt)) {
++ ip6_del_rt(rt);
++ dst = NULL;
++ }
++ } else {
+ dst_release(dst);
++ dst = NULL;
++ }
+ }
+- return NULL;
++ return dst;
+ }
+
+ static void ip6_link_failure(struct sk_buff *skb)
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index febfd59..548a06e 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -1732,8 +1732,10 @@ process:
+ if (!tcp_prequeue(sk, skb))
+ ret = tcp_v6_do_rcv(sk, skb);
+ }
+- } else
+- sk_add_backlog(sk, skb);
++ } else if (sk_add_backlog(sk, skb)) {
++ bh_unlock_sock(sk);
++ goto discard_and_relse;
++ }
+ bh_unlock_sock(sk);
+
+ sock_put(sk);
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index 69ebdbe..d9714d2 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -584,16 +584,20 @@ static void flush_stack(struct sock **stack, unsigned int count,
+ bh_lock_sock(sk);
+ if (!sock_owned_by_user(sk))
+ udpv6_queue_rcv_skb(sk, skb1);
+- else
+- sk_add_backlog(sk, skb1);
++ else if (sk_add_backlog(sk, skb1)) {
++ kfree_skb(skb1);
++ bh_unlock_sock(sk);
++ goto drop;
++ }
+ bh_unlock_sock(sk);
+- } else {
+- atomic_inc(&sk->sk_drops);
+- UDP6_INC_STATS_BH(sock_net(sk),
+- UDP_MIB_RCVBUFERRORS, IS_UDPLITE(sk));
+- UDP6_INC_STATS_BH(sock_net(sk),
+- UDP_MIB_INERRORS, IS_UDPLITE(sk));
++ continue;
+ }
++drop:
++ atomic_inc(&sk->sk_drops);
++ UDP6_INC_STATS_BH(sock_net(sk),
++ UDP_MIB_RCVBUFERRORS, IS_UDPLITE(sk));
++ UDP6_INC_STATS_BH(sock_net(sk),
++ UDP_MIB_INERRORS, IS_UDPLITE(sk));
+ }
+ }
+ /*
+@@ -756,8 +760,12 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
+ bh_lock_sock(sk);
+ if (!sock_owned_by_user(sk))
+ udpv6_queue_rcv_skb(sk, skb);
+- else
+- sk_add_backlog(sk, skb);
++ else if (sk_add_backlog(sk, skb)) {
++ atomic_inc(&sk->sk_drops);
++ bh_unlock_sock(sk);
++ sock_put(sk);
++ goto discard;
++ }
+ bh_unlock_sock(sk);
+ sock_put(sk);
+ return 0;
+diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
+index dbdc696..ae18165 100644
+--- a/net/ipv6/xfrm6_policy.c
++++ b/net/ipv6/xfrm6_policy.c
+@@ -116,7 +116,8 @@ static int xfrm6_init_path(struct xfrm_dst *path, struct dst_entry *dst,
+ return 0;
+ }
+
+-static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev)
++static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
++ struct flowi *fl)
+ {
+ struct rt6_info *rt = (struct rt6_info*)xdst->route;
+
+diff --git a/net/llc/llc_c_ac.c b/net/llc/llc_c_ac.c
+index 019c780..86d6985 100644
+--- a/net/llc/llc_c_ac.c
++++ b/net/llc/llc_c_ac.c
+@@ -1437,7 +1437,7 @@ static void llc_process_tmr_ev(struct sock *sk, struct sk_buff *skb)
+ llc_conn_state_process(sk, skb);
+ else {
+ llc_set_backlog_type(skb, LLC_EVENT);
+- sk_add_backlog(sk, skb);
++ __sk_add_backlog(sk, skb);
+ }
+ }
+ }
+diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c
+index c6bab39..c61ca88 100644
+--- a/net/llc/llc_conn.c
++++ b/net/llc/llc_conn.c
+@@ -756,7 +756,8 @@ void llc_conn_handler(struct llc_sap *sap, struct sk_buff *skb)
+ else {
+ dprintk("%s: adding to backlog...\n", __func__);
+ llc_set_backlog_type(skb, LLC_PACKET);
+- sk_add_backlog(sk, skb);
++ if (sk_add_backlog(sk, skb))
++ goto drop_unlock;
+ }
+ out:
+ bh_unlock_sock(sk);
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
+index 91dc863..3521c17 100644
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -264,6 +264,7 @@ enum ieee80211_sta_flags {
+ IEEE80211_STA_DISABLE_11N = BIT(4),
+ IEEE80211_STA_CSA_RECEIVED = BIT(5),
+ IEEE80211_STA_MFP_ENABLED = BIT(6),
++ IEEE80211_STA_NULLFUNC_ACKED = BIT(7),
+ };
+
+ /* flags for MLME request */
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index 05a18f4..1a209ac 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -205,7 +205,8 @@ static u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
+ sta = sta_info_get(local, bssid);
+ if (sta)
+ rate_control_rate_update(local, sband, sta,
+- IEEE80211_RC_HT_CHANGED);
++ IEEE80211_RC_HT_CHANGED,
++ local->oper_channel_type);
+ rcu_read_unlock();
+ }
+
+@@ -661,8 +662,11 @@ static void ieee80211_enable_ps(struct ieee80211_local *local,
+ } else {
+ if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
+ ieee80211_send_nullfunc(local, sdata, 1);
+- conf->flags |= IEEE80211_CONF_PS;
+- ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
++
++ if (!(local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)) {
++ conf->flags |= IEEE80211_CONF_PS;
++ ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
++ }
+ }
+ }
+
+@@ -753,6 +757,7 @@ void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
+ container_of(work, struct ieee80211_local,
+ dynamic_ps_enable_work);
+ struct ieee80211_sub_if_data *sdata = local->ps_sdata;
++ struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+
+ /* can only happen when PS was just disabled anyway */
+ if (!sdata)
+@@ -761,11 +766,16 @@ void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
+ if (local->hw.conf.flags & IEEE80211_CONF_PS)
+ return;
+
+- if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
++ if ((local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) &&
++ (!(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)))
+ ieee80211_send_nullfunc(local, sdata, 1);
+
+- local->hw.conf.flags |= IEEE80211_CONF_PS;
+- ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
++ if (!(local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) ||
++ (ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
++ ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
++ local->hw.conf.flags |= IEEE80211_CONF_PS;
++ ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
++ }
+ }
+
+ void ieee80211_dynamic_ps_timer(unsigned long data)
+@@ -2467,6 +2477,7 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
+ list_add(&wk->list, &ifmgd->work_list);
+
+ ifmgd->flags &= ~IEEE80211_STA_DISABLE_11N;
++ ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
+
+ for (i = 0; i < req->crypto.n_ciphers_pairwise; i++)
+ if (req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP40 ||
+diff --git a/net/mac80211/rate.h b/net/mac80211/rate.h
+index cb9bd1f..3e02ea4 100644
+--- a/net/mac80211/rate.h
++++ b/net/mac80211/rate.h
+@@ -69,7 +69,8 @@ static inline void rate_control_rate_init(struct sta_info *sta)
+
+ static inline void rate_control_rate_update(struct ieee80211_local *local,
+ struct ieee80211_supported_band *sband,
+- struct sta_info *sta, u32 changed)
++ struct sta_info *sta, u32 changed,
++ enum nl80211_channel_type oper_chan_type)
+ {
+ struct rate_control_ref *ref = local->rate_ctrl;
+ struct ieee80211_sta *ista = &sta->sta;
+@@ -77,7 +78,7 @@ static inline void rate_control_rate_update(struct ieee80211_local *local,
+
+ if (ref && ref->ops->rate_update)
+ ref->ops->rate_update(ref->priv, sband, ista,
+- priv_sta, changed);
++ priv_sta, changed, oper_chan_type);
+ }
+
+ static inline void *rate_control_alloc_sta(struct rate_control_ref *ref,
+diff --git a/net/mac80211/status.c b/net/mac80211/status.c
+index d78f36c..f5abeec 100644
+--- a/net/mac80211/status.c
++++ b/net/mac80211/status.c
+@@ -165,6 +165,7 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
+ rcu_read_lock();
+
+ sband = local->hw.wiphy->bands[info->band];
++ fc = hdr->frame_control;
+
+ sta = sta_info_get(local, hdr->addr1);
+
+@@ -180,8 +181,6 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
+ return;
+ }
+
+- fc = hdr->frame_control;
+-
+ if ((info->flags & IEEE80211_TX_STAT_AMPDU_NO_BACK) &&
+ (ieee80211_is_data_qos(fc))) {
+ u16 tid, ssn;
+@@ -246,6 +245,20 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
+ local->dot11FailedCount++;
+ }
+
++ if (ieee80211_is_nullfunc(fc) && ieee80211_has_pm(fc) &&
++ (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) &&
++ !(info->flags & IEEE80211_TX_CTL_INJECTED) &&
++ local->ps_sdata && !(local->scanning)) {
++ if (info->flags & IEEE80211_TX_STAT_ACK) {
++ local->ps_sdata->u.mgd.flags |=
++ IEEE80211_STA_NULLFUNC_ACKED;
++ ieee80211_queue_work(&local->hw,
++ &local->dynamic_ps_enable_work);
++ } else
++ mod_timer(&local->dynamic_ps_timer, jiffies +
++ msecs_to_jiffies(10));
++ }
++
+ /* this was a transmitted frame, but now we want to reuse it */
+ skb_orphan(skb);
+
+diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
+index 0ffe689..eeac97f 100644
+--- a/net/netfilter/nf_conntrack_netlink.c
++++ b/net/netfilter/nf_conntrack_netlink.c
+@@ -571,7 +571,8 @@ nla_put_failure:
+ nlmsg_failure:
+ kfree_skb(skb);
+ errout:
+- nfnetlink_set_err(0, group, -ENOBUFS);
++ if (nfnetlink_set_err(0, group, -ENOBUFS) > 0)
++ return -ENOBUFS;
+ return 0;
+ }
+ #endif /* CONFIG_NF_CONNTRACK_EVENTS */
+diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
+index eedc0c1..35fe185 100644
+--- a/net/netfilter/nfnetlink.c
++++ b/net/netfilter/nfnetlink.c
+@@ -114,9 +114,9 @@ int nfnetlink_send(struct sk_buff *skb, u32 pid,
+ }
+ EXPORT_SYMBOL_GPL(nfnetlink_send);
+
+-void nfnetlink_set_err(u32 pid, u32 group, int error)
++int nfnetlink_set_err(u32 pid, u32 group, int error)
+ {
+- netlink_set_err(nfnl, pid, group, error);
++ return netlink_set_err(nfnl, pid, group, error);
+ }
+ EXPORT_SYMBOL_GPL(nfnetlink_set_err);
+
+diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c
+index 43e83a4..e460bf9 100644
+--- a/net/netfilter/xt_recent.c
++++ b/net/netfilter/xt_recent.c
+@@ -260,7 +260,7 @@ recent_mt(const struct sk_buff *skb, const struct xt_match_param *par)
+ for (i = 0; i < e->nstamps; i++) {
+ if (info->seconds && time_after(time, e->stamps[i]))
+ continue;
+- if (info->hit_count && ++hits >= info->hit_count) {
++ if (!info->hit_count || ++hits >= info->hit_count) {
+ ret = !ret;
+ break;
+ }
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index 4c5972b..0052d3c 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -1093,6 +1093,7 @@ static inline int do_one_set_err(struct sock *sk,
+ struct netlink_set_err_data *p)
+ {
+ struct netlink_sock *nlk = nlk_sk(sk);
++ int ret = 0;
+
+ if (sk == p->exclude_sk)
+ goto out;
+@@ -1104,10 +1105,15 @@ static inline int do_one_set_err(struct sock *sk,
+ !test_bit(p->group - 1, nlk->groups))
+ goto out;
+
++ if (p->code == ENOBUFS && nlk->flags & NETLINK_RECV_NO_ENOBUFS) {
++ ret = 1;
++ goto out;
++ }
++
+ sk->sk_err = p->code;
+ sk->sk_error_report(sk);
+ out:
+- return 0;
++ return ret;
+ }
+
+ /**
+@@ -1116,12 +1122,16 @@ out:
+ * @pid: the PID of a process that we want to skip (if any)
+ * @groups: the broadcast group that will notice the error
+ * @code: error code, must be negative (as usual in kernelspace)
++ *
++ * This function returns the number of broadcast listeners that have set the
++ * NETLINK_RECV_NO_ENOBUFS socket option.
+ */
+-void netlink_set_err(struct sock *ssk, u32 pid, u32 group, int code)
++int netlink_set_err(struct sock *ssk, u32 pid, u32 group, int code)
+ {
+ struct netlink_set_err_data info;
+ struct hlist_node *node;
+ struct sock *sk;
++ int ret = 0;
+
+ info.exclude_sk = ssk;
+ info.pid = pid;
+@@ -1132,9 +1142,10 @@ void netlink_set_err(struct sock *ssk, u32 pid, u32 group, int code)
+ read_lock(&nl_table_lock);
+
+ sk_for_each_bound(sk, node, &nl_table[ssk->sk_protocol].mc_list)
+- do_one_set_err(sk, &info);
++ ret += do_one_set_err(sk, &info);
+
+ read_unlock(&nl_table_lock);
++ return ret;
+ }
+ EXPORT_SYMBOL(netlink_set_err);
+
+diff --git a/net/sctp/input.c b/net/sctp/input.c
+index c0c973e..3d74b26 100644
+--- a/net/sctp/input.c
++++ b/net/sctp/input.c
+@@ -75,7 +75,7 @@ static struct sctp_association *__sctp_lookup_association(
+ const union sctp_addr *peer,
+ struct sctp_transport **pt);
+
+-static void sctp_add_backlog(struct sock *sk, struct sk_buff *skb);
++static int sctp_add_backlog(struct sock *sk, struct sk_buff *skb);
+
+
+ /* Calculate the SCTP checksum of an SCTP packet. */
+@@ -265,8 +265,13 @@ int sctp_rcv(struct sk_buff *skb)
+ }
+
+ if (sock_owned_by_user(sk)) {
++ if (sctp_add_backlog(sk, skb)) {
++ sctp_bh_unlock_sock(sk);
++ sctp_chunk_free(chunk);
++ skb = NULL; /* sctp_chunk_free already freed the skb */
++ goto discard_release;
++ }
+ SCTP_INC_STATS_BH(SCTP_MIB_IN_PKT_BACKLOG);
+- sctp_add_backlog(sk, skb);
+ } else {
+ SCTP_INC_STATS_BH(SCTP_MIB_IN_PKT_SOFTIRQ);
+ sctp_inq_push(&chunk->rcvr->inqueue, chunk);
+@@ -336,8 +341,10 @@ int sctp_backlog_rcv(struct sock *sk, struct sk_buff *skb)
+ sctp_bh_lock_sock(sk);
+
+ if (sock_owned_by_user(sk)) {
+- sk_add_backlog(sk, skb);
+- backloged = 1;
++ if (sk_add_backlog(sk, skb))
++ sctp_chunk_free(chunk);
++ else
++ backloged = 1;
+ } else
+ sctp_inq_push(inqueue, chunk);
+
+@@ -362,22 +369,27 @@ done:
+ return 0;
+ }
+
+-static void sctp_add_backlog(struct sock *sk, struct sk_buff *skb)
++static int sctp_add_backlog(struct sock *sk, struct sk_buff *skb)
+ {
+ struct sctp_chunk *chunk = SCTP_INPUT_CB(skb)->chunk;
+ struct sctp_ep_common *rcvr = chunk->rcvr;
++ int ret;
+
+- /* Hold the assoc/ep while hanging on the backlog queue.
+- * This way, we know structures we need will not disappear from us
+- */
+- if (SCTP_EP_TYPE_ASSOCIATION == rcvr->type)
+- sctp_association_hold(sctp_assoc(rcvr));
+- else if (SCTP_EP_TYPE_SOCKET == rcvr->type)
+- sctp_endpoint_hold(sctp_ep(rcvr));
+- else
+- BUG();
++ ret = sk_add_backlog(sk, skb);
++ if (!ret) {
++ /* Hold the assoc/ep while hanging on the backlog queue.
++ * This way, we know structures we need will not disappear
++ * from us
++ */
++ if (SCTP_EP_TYPE_ASSOCIATION == rcvr->type)
++ sctp_association_hold(sctp_assoc(rcvr));
++ else if (SCTP_EP_TYPE_SOCKET == rcvr->type)
++ sctp_endpoint_hold(sctp_ep(rcvr));
++ else
++ BUG();
++ }
++ return ret;
+
+- sk_add_backlog(sk, skb);
+ }
+
+ /* Handle icmp frag needed error. */
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index 67fdac9..9bd9d82 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -3720,6 +3720,9 @@ SCTP_STATIC int sctp_init_sock(struct sock *sk)
+ SCTP_DBG_OBJCNT_INC(sock);
+ percpu_counter_inc(&sctp_sockets_allocated);
+
++ /* Set socket backlog limit. */
++ sk->sk_backlog.limit = sysctl_sctp_rmem[1];
++
+ local_bh_disable();
+ sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
+ local_bh_enable();
+diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
+index f7a7f83..50346a6 100644
+--- a/net/sunrpc/auth_gss/auth_gss.c
++++ b/net/sunrpc/auth_gss/auth_gss.c
+@@ -1273,9 +1273,8 @@ alloc_enc_pages(struct rpc_rqst *rqstp)
+ rqstp->rq_release_snd_buf = priv_release_snd_buf;
+ return 0;
+ out_free:
+- for (i--; i >= 0; i--) {
+- __free_page(rqstp->rq_enc_pages[i]);
+- }
++ rqstp->rq_enc_pages_num = i;
++ priv_release_snd_buf(rqstp);
+ out:
+ return -EAGAIN;
+ }
+diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
+index 49278f8..27a2378 100644
+--- a/net/sunrpc/rpc_pipe.c
++++ b/net/sunrpc/rpc_pipe.c
+@@ -587,6 +587,8 @@ static struct dentry *__rpc_lookup_create_exclusive(struct dentry *parent,
+ struct dentry *dentry;
+
+ dentry = __rpc_lookup_create(parent, name);
++ if (IS_ERR(dentry))
++ return dentry;
+ if (dentry->d_inode == NULL)
+ return dentry;
+ dput(dentry);
+diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
+index 4f30336..6bd41a9 100644
+--- a/net/sunrpc/svc_xprt.c
++++ b/net/sunrpc/svc_xprt.c
+@@ -699,8 +699,10 @@ int svc_recv(struct svc_rqst *rqstp, long timeout)
+ spin_unlock_bh(&pool->sp_lock);
+
+ len = 0;
+- if (test_bit(XPT_LISTENER, &xprt->xpt_flags) &&
+- !test_bit(XPT_CLOSE, &xprt->xpt_flags)) {
++ if (test_bit(XPT_CLOSE, &xprt->xpt_flags)) {
++ dprintk("svc_recv: found XPT_CLOSE\n");
++ svc_delete_xprt(xprt);
++ } else if (test_bit(XPT_LISTENER, &xprt->xpt_flags)) {
+ struct svc_xprt *newxpt;
+ newxpt = xprt->xpt_ops->xpo_accept(xprt);
+ if (newxpt) {
+@@ -726,7 +728,7 @@ int svc_recv(struct svc_rqst *rqstp, long timeout)
+ svc_xprt_received(newxpt);
+ }
+ svc_xprt_received(xprt);
+- } else if (!test_bit(XPT_CLOSE, &xprt->xpt_flags)) {
++ } else {
+ dprintk("svc: server %p, pool %u, transport %p, inuse=%d\n",
+ rqstp, pool->sp_id, xprt,
+ atomic_read(&xprt->xpt_ref.refcount));
+@@ -739,11 +741,6 @@ int svc_recv(struct svc_rqst *rqstp, long timeout)
+ dprintk("svc: got len=%d\n", len);
+ }
+
+- if (test_bit(XPT_CLOSE, &xprt->xpt_flags)) {
+- dprintk("svc_recv: found XPT_CLOSE\n");
+- svc_delete_xprt(xprt);
+- }
+-
+ /* No data, incomplete (TCP) read, or accept() */
+ if (len == 0 || len == -EAGAIN) {
+ rqstp->rq_res.len = 0;
+diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
+index 870929e..528efef 100644
+--- a/net/sunrpc/svcsock.c
++++ b/net/sunrpc/svcsock.c
+@@ -968,6 +968,7 @@ static int svc_tcp_recv_record(struct svc_sock *svsk, struct svc_rqst *rqstp)
+ return len;
+ err_delete:
+ set_bit(XPT_CLOSE, &svsk->sk_xprt.xpt_flags);
++ svc_xprt_received(&svsk->sk_xprt);
+ err_again:
+ return -EAGAIN;
+ }
+diff --git a/net/tipc/socket.c b/net/tipc/socket.c
+index 1ea64f0..4b235fc 100644
+--- a/net/tipc/socket.c
++++ b/net/tipc/socket.c
+@@ -1322,8 +1322,10 @@ static u32 dispatch(struct tipc_port *tport, struct sk_buff *buf)
+ if (!sock_owned_by_user(sk)) {
+ res = filter_rcv(sk, buf);
+ } else {
+- sk_add_backlog(sk, buf);
+- res = TIPC_OK;
++ if (sk_add_backlog(sk, buf))
++ res = TIPC_ERR_OVERLOAD;
++ else
++ res = TIPC_OK;
+ }
+ bh_unlock_sock(sk);
+
+diff --git a/net/x25/x25_dev.c b/net/x25/x25_dev.c
+index 3e1efe5..52e3042 100644
+--- a/net/x25/x25_dev.c
++++ b/net/x25/x25_dev.c
+@@ -53,7 +53,7 @@ static int x25_receive_data(struct sk_buff *skb, struct x25_neigh *nb)
+ if (!sock_owned_by_user(sk)) {
+ queued = x25_process_rx_frame(sk, skb);
+ } else {
+- sk_add_backlog(sk, skb);
++ queued = !sk_add_backlog(sk, skb);
+ }
+ bh_unlock_sock(sk);
+ sock_put(sk);
+diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
+index 0ecb16a..f12dd3d 100644
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -1354,7 +1354,8 @@ static inline int xfrm_init_path(struct xfrm_dst *path, struct dst_entry *dst,
+ return err;
+ }
+
+-static inline int xfrm_fill_dst(struct xfrm_dst *xdst, struct net_device *dev)
++static inline int xfrm_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
++ struct flowi *fl)
+ {
+ struct xfrm_policy_afinfo *afinfo =
+ xfrm_policy_get_afinfo(xdst->u.dst.ops->family);
+@@ -1363,7 +1364,7 @@ static inline int xfrm_fill_dst(struct xfrm_dst *xdst, struct net_device *dev)
+ if (!afinfo)
+ return -EINVAL;
+
+- err = afinfo->fill_dst(xdst, dev);
++ err = afinfo->fill_dst(xdst, dev, fl);
+
+ xfrm_policy_put_afinfo(afinfo);
+
+@@ -1468,7 +1469,7 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy,
+ for (dst_prev = dst0; dst_prev != dst; dst_prev = dst_prev->child) {
+ struct xfrm_dst *xdst = (struct xfrm_dst *)dst_prev;
+
+- err = xfrm_fill_dst(xdst, dev);
++ err = xfrm_fill_dst(xdst, dev, fl);
+ if (err)
+ goto free_dst;
+
+diff --git a/sound/pci/ac97/ac97_patch.c b/sound/pci/ac97/ac97_patch.c
+index d9266ba..4e5f2f7 100644
+--- a/sound/pci/ac97/ac97_patch.c
++++ b/sound/pci/ac97/ac97_patch.c
+@@ -1867,12 +1867,14 @@ static unsigned int ad1981_jacks_blacklist[] = {
+ 0x10140523, /* Thinkpad R40 */
+ 0x10140534, /* Thinkpad X31 */
+ 0x10140537, /* Thinkpad T41p */
++ 0x1014053e, /* Thinkpad R40e */
+ 0x10140554, /* Thinkpad T42p/R50p */
+ 0x10140567, /* Thinkpad T43p 2668-G7U */
+ 0x10140581, /* Thinkpad X41-2527 */
+ 0x10280160, /* Dell Dimension 2400 */
+ 0x104380b0, /* Asus A7V8X-MX */
+ 0x11790241, /* Toshiba Satellite A-15 S127 */
++ 0x1179ff10, /* Toshiba P500 */
+ 0x144dc01a, /* Samsung NP-X20C004/SEG */
+ 0 /* end */
+ };
+diff --git a/sound/pci/cmipci.c b/sound/pci/cmipci.c
+index a312bae..bbaec22 100644
+--- a/sound/pci/cmipci.c
++++ b/sound/pci/cmipci.c
+@@ -941,13 +941,21 @@ static snd_pcm_uframes_t snd_cmipci_pcm_pointer(struct cmipci *cm, struct cmipci
+ struct snd_pcm_substream *substream)
+ {
+ size_t ptr;
+- unsigned int reg;
++ unsigned int reg, rem, tries;
++
+ if (!rec->running)
+ return 0;
+ #if 1 // this seems better..
+ reg = rec->ch ? CM_REG_CH1_FRAME2 : CM_REG_CH0_FRAME2;
+- ptr = rec->dma_size - (snd_cmipci_read_w(cm, reg) + 1);
+- ptr >>= rec->shift;
++ for (tries = 0; tries < 3; tries++) {
++ rem = snd_cmipci_read_w(cm, reg);
++ if (rem < rec->dma_size)
++ goto ok;
++ }
++ printk(KERN_ERR "cmipci: invalid PCM pointer: %#x\n", rem);
++ return SNDRV_PCM_POS_XRUN;
++ok:
++ ptr = (rec->dma_size - (rem + 1)) >> rec->shift;
+ #else
+ reg = rec->ch ? CM_REG_CH1_FRAME1 : CM_REG_CH0_FRAME1;
+ ptr = snd_cmipci_read(cm, reg) - rec->offset;
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 6d6e307..9ace8eb 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2265,8 +2265,10 @@ static struct snd_pci_quirk position_fix_list[] __devinitdata = {
+ SND_PCI_QUIRK(0x103c, 0x306d, "HP dv3", POS_FIX_LPIB),
+ SND_PCI_QUIRK(0x1106, 0x3288, "ASUS M2V-MX SE", POS_FIX_LPIB),
+ SND_PCI_QUIRK(0x1043, 0x813d, "ASUS P5AD2", POS_FIX_LPIB),
++ SND_PCI_QUIRK(0x1458, 0xa022, "ga-ma770-ud3", POS_FIX_LPIB),
+ SND_PCI_QUIRK(0x1462, 0x1002, "MSI Wind U115", POS_FIX_LPIB),
+ SND_PCI_QUIRK(0x1565, 0x820f, "Biostar Microtech", POS_FIX_LPIB),
++ SND_PCI_QUIRK(0x8086, 0xd601, "eMachines T5212", POS_FIX_LPIB),
+ {}
+ };
+
+@@ -2354,6 +2356,7 @@ static void __devinit check_probe_mask(struct azx *chip, int dev)
+ static struct snd_pci_quirk msi_black_list[] __devinitdata = {
+ SND_PCI_QUIRK(0x1043, 0x81f2, "ASUS", 0), /* Athlon64 X2 + nvidia */
+ SND_PCI_QUIRK(0x1043, 0x81f6, "ASUS", 0), /* nvidia */
++ SND_PCI_QUIRK(0x1043, 0x822d, "ASUS", 0), /* Athlon64 X2 + nvidia MCP55 */
+ {}
+ };
+
+@@ -2372,6 +2375,13 @@ static void __devinit check_msi(struct azx *chip)
+ "hda_intel: msi for device %04x:%04x set to %d\n",
+ q->subvendor, q->subdevice, q->value);
+ chip->msi = q->value;
++ return;
++ }
++
++ /* NVidia chipsets seem to cause troubles with MSI */
++ if (chip->driver_type == AZX_DRIVER_NVIDIA) {
++ printk(KERN_INFO "hda_intel: Disable MSI for Nvidia chipset\n");
++ chip->msi = 0;
+ }
+ }
+
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index c578c28..71b7a96 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -1570,6 +1570,21 @@ static int patch_cxt5047(struct hda_codec *codec)
+ #endif
+ }
+ spec->vmaster_nid = 0x13;
++
++ switch (codec->subsystem_id >> 16) {
++ case 0x103c:
++ /* HP laptops have really bad sound over 0 dB on NID 0x10.
++ * Fix max PCM level to 0 dB (originally it has 0x1e steps
++ * with 0 dB offset 0x17)
++ */
++ snd_hda_override_amp_caps(codec, 0x10, HDA_INPUT,
++ (0x17 << AC_AMPCAP_OFFSET_SHIFT) |
++ (0x17 << AC_AMPCAP_NUM_STEPS_SHIFT) |
++ (0x05 << AC_AMPCAP_STEP_SIZE_SHIFT) |
++ (1 << AC_AMPCAP_MUTE_SHIFT));
++ break;
++ }
++
+ return 0;
+ }
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index da34095..a79f841 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -407,6 +407,8 @@ static int alc_mux_enum_info(struct snd_kcontrol *kcontrol,
+ unsigned int mux_idx = snd_ctl_get_ioffidx(kcontrol, &uinfo->id);
+ if (mux_idx >= spec->num_mux_defs)
+ mux_idx = 0;
++ if (!spec->input_mux[mux_idx].num_items && mux_idx > 0)
++ mux_idx = 0;
+ return snd_hda_input_mux_info(&spec->input_mux[mux_idx], uinfo);
+ }
+
+@@ -435,6 +437,8 @@ static int alc_mux_enum_put(struct snd_kcontrol *kcontrol,
+
+ mux_idx = adc_idx >= spec->num_mux_defs ? 0 : adc_idx;
+ imux = &spec->input_mux[mux_idx];
++ if (!imux->num_items && mux_idx > 0)
++ imux = &spec->input_mux[0];
+
+ type = get_wcaps_type(get_wcaps(codec, nid));
+ if (type == AC_WID_AUD_MIX) {
+@@ -6380,7 +6384,7 @@ static struct alc_config_preset alc260_presets[] = {
+ .num_dacs = ARRAY_SIZE(alc260_dac_nids),
+ .dac_nids = alc260_dac_nids,
+ .num_adc_nids = ARRAY_SIZE(alc260_dual_adc_nids),
+- .adc_nids = alc260_adc_nids,
++ .adc_nids = alc260_dual_adc_nids,
+ .num_channel_mode = ARRAY_SIZE(alc260_modes),
+ .channel_mode = alc260_modes,
+ .input_mux = &alc260_capture_source,
+@@ -9097,7 +9101,7 @@ static struct snd_pci_quirk alc882_cfg_tbl[] = {
+ SND_PCI_QUIRK(0x8086, 0x0022, "DX58SO", ALC889_INTEL),
+ SND_PCI_QUIRK(0x8086, 0x0021, "Intel IbexPeak", ALC889A_INTEL),
+ SND_PCI_QUIRK(0x8086, 0x3b56, "Intel IbexPeak", ALC889A_INTEL),
+- SND_PCI_QUIRK(0x8086, 0xd601, "D102GGC", ALC883_3ST_6ch),
++ SND_PCI_QUIRK(0x8086, 0xd601, "D102GGC", ALC882_6ST_DIG),
+
+ {}
+ };
+@@ -9941,6 +9945,8 @@ static void alc882_auto_init_input_src(struct hda_codec *codec)
+ continue;
+ mux_idx = c >= spec->num_mux_defs ? 0 : c;
+ imux = &spec->input_mux[mux_idx];
++ if (!imux->num_items && mux_idx > 0)
++ imux = &spec->input_mux[0];
+ for (idx = 0; idx < conns; idx++) {
+ /* if the current connection is the selected one,
+ * unmute it as default - otherwise mute it
+diff --git a/tools/perf/Documentation/Makefile b/tools/perf/Documentation/Makefile
+index bdd3b7e..bd498d4 100644
+--- a/tools/perf/Documentation/Makefile
++++ b/tools/perf/Documentation/Makefile
+@@ -24,7 +24,10 @@ DOC_MAN1=$(patsubst %.txt,%.1,$(MAN1_TXT))
+ DOC_MAN5=$(patsubst %.txt,%.5,$(MAN5_TXT))
+ DOC_MAN7=$(patsubst %.txt,%.7,$(MAN7_TXT))
+
++# Make the path relative to DESTDIR, not prefix
++ifndef DESTDIR
+ prefix?=$(HOME)
++endif
+ bindir?=$(prefix)/bin
+ htmldir?=$(prefix)/share/doc/perf-doc
+ pdfdir?=$(prefix)/share/doc/perf-doc
+@@ -32,7 +35,6 @@ mandir?=$(prefix)/share/man
+ man1dir=$(mandir)/man1
+ man5dir=$(mandir)/man5
+ man7dir=$(mandir)/man7
+-# DESTDIR=
+
+ ASCIIDOC=asciidoc
+ ASCIIDOC_EXTRA = --unsafe
+diff --git a/tools/perf/Makefile b/tools/perf/Makefile
+index 2e7fa3a..03eb7c9 100644
+--- a/tools/perf/Makefile
++++ b/tools/perf/Makefile
+@@ -216,7 +216,10 @@ STRIP ?= strip
+ # runtime figures out where they are based on the path to the executable.
+ # This can help installing the suite in a relocatable way.
+
++# Make the path relative to DESTDIR, not to prefix
++ifndef DESTDIR
+ prefix = $(HOME)
++endif
+ bindir_relative = bin
+ bindir = $(prefix)/$(bindir_relative)
+ mandir = share/man
+@@ -233,7 +236,6 @@ sysconfdir = $(prefix)/etc
+ ETC_PERFCONFIG = etc/perfconfig
+ endif
+ lib = lib
+-# DESTDIR=
+
+ export prefix bindir sharedir sysconfdir
+
+diff --git a/tools/perf/builtin-annotate.c b/tools/perf/builtin-annotate.c
+index 593ff25..0b1ba36 100644
+--- a/tools/perf/builtin-annotate.c
++++ b/tools/perf/builtin-annotate.c
+@@ -53,32 +53,20 @@ struct sym_priv {
+
+ static const char *sym_hist_filter;
+
+-static int symbol_filter(struct map *map __used, struct symbol *sym)
++static int sym__alloc_hist(struct symbol *self)
+ {
+- if (sym_hist_filter == NULL ||
+- strcmp(sym->name, sym_hist_filter) == 0) {
+- struct sym_priv *priv = symbol__priv(sym);
+- const int size = (sizeof(*priv->hist) +
+- (sym->end - sym->start) * sizeof(u64));
++ struct sym_priv *priv = symbol__priv(self);
++ const int size = (sizeof(*priv->hist) +
++ (self->end - self->start) * sizeof(u64));
+
+- priv->hist = malloc(size);
+- if (priv->hist)
+- memset(priv->hist, 0, size);
+- return 0;
+- }
+- /*
+- * FIXME: We should really filter it out, as we don't want to go thru symbols
+- * we're not interested, and if a DSO ends up with no symbols, delete it too,
+- * but right now the kernel loading routines in symbol.c bail out if no symbols
+- * are found, fix it later.
+- */
+- return 0;
++ priv->hist = zalloc(size);
++ return priv->hist == NULL ? -1 : 0;
+ }
+
+ /*
+ * collect histogram counts
+ */
+-static void hist_hit(struct hist_entry *he, u64 ip)
++static int annotate__hist_hit(struct hist_entry *he, u64 ip)
+ {
+ unsigned int sym_size, offset;
+ struct symbol *sym = he->sym;
+@@ -88,11 +76,11 @@ static void hist_hit(struct hist_entry *he, u64 ip)
+ he->count++;
+
+ if (!sym || !he->map)
+- return;
++ return 0;
+
+ priv = symbol__priv(sym);
+- if (!priv->hist)
+- return;
++ if (priv->hist == NULL && sym__alloc_hist(sym) < 0)
++ return -ENOMEM;
+
+ sym_size = sym->end - sym->start;
+ offset = ip - sym->start;
+@@ -102,7 +90,7 @@ static void hist_hit(struct hist_entry *he, u64 ip)
+ he->map->unmap_ip(he->map, ip));
+
+ if (offset >= sym_size)
+- return;
++ return 0;
+
+ h = priv->hist;
+ h->sum++;
+@@ -114,18 +102,31 @@ static void hist_hit(struct hist_entry *he, u64 ip)
+ he->sym->name,
+ (void *)(unsigned long)ip, ip - he->sym->start,
+ h->ip[offset]);
++ return 0;
+ }
+
+ static int perf_session__add_hist_entry(struct perf_session *self,
+ struct addr_location *al, u64 count)
+ {
+- bool hit;
+- struct hist_entry *he = __perf_session__add_hist_entry(self, al, NULL,
+- count, &hit);
+- if (he == NULL)
+- return -ENOMEM;
+- hist_hit(he, al->addr);
+- return 0;
++ bool hit;
++ struct hist_entry *he;
++
++ if (sym_hist_filter != NULL &&
++ (al->sym == NULL || strcmp(sym_hist_filter, al->sym->name) != 0)) {
++ /* We're only interested in a symbol named sym_hist_filter */
++ if (al->sym != NULL) {
++ rb_erase(&al->sym->rb_node,
++ &al->map->dso->symbols[al->map->type]);
++ symbol__delete(al->sym);
++ }
++ return 0;
++ }
++
++ he = __perf_session__add_hist_entry(self, al, NULL, count, &hit);
++ if (he == NULL)
++ return -ENOMEM;
++
++ return annotate__hist_hit(he, al->addr);
+ }
+
+ static int process_sample_event(event_t *event, struct perf_session *session)
+@@ -135,7 +136,7 @@ static int process_sample_event(event_t *event, struct perf_session *session)
+ dump_printf("(IP, %d): %d: %p\n", event->header.misc,
+ event->ip.pid, (void *)(long)event->ip.ip);
+
+- if (event__preprocess_sample(event, session, &al, symbol_filter) < 0) {
++ if (event__preprocess_sample(event, session, &al, NULL) < 0) {
+ fprintf(stderr, "problem processing %d event, skipping it.\n",
+ event->header.type);
+ return -1;
+diff --git a/tools/perf/builtin-probe.c b/tools/perf/builtin-probe.c
+index c1e6774..fa626eb 100644
+--- a/tools/perf/builtin-probe.c
++++ b/tools/perf/builtin-probe.c
+@@ -48,7 +48,6 @@
+ #include "util/probe-event.h"
+
+ #define MAX_PATH_LEN 256
+-#define MAX_PROBES 128
+
+ /* Session management structure */
+ static struct {
+diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
+index 4b852c0..7f81ded 100644
+--- a/tools/perf/util/probe-finder.c
++++ b/tools/perf/util/probe-finder.c
+@@ -544,6 +544,9 @@ static void show_probepoint(Dwarf_Die sp_die, Dwarf_Signed offs,
+ }
+ free_current_frame_base(pf);
+
++ if (pp->found == MAX_PROBES)
++ die("Too many( > %d) probe point found.\n", MAX_PROBES);
++
+ pp->probes[pp->found] = strdup(tmp);
+ pp->found++;
+ }
+diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
+index 72547b9..fcb8919 100644
+--- a/tools/perf/util/symbol.c
++++ b/tools/perf/util/symbol.c
+@@ -149,7 +149,7 @@ static struct symbol *symbol__new(u64 start, u64 len, const char *name)
+ return self;
+ }
+
+-static void symbol__delete(struct symbol *self)
++void symbol__delete(struct symbol *self)
+ {
+ free(((void *)self) - symbol_conf.priv_size);
+ }
+diff --git a/tools/perf/util/symbol.h b/tools/perf/util/symbol.h
+index 8aded23..400227a 100644
+--- a/tools/perf/util/symbol.h
++++ b/tools/perf/util/symbol.h
+@@ -49,6 +49,8 @@ struct symbol {
+ char name[0];
+ };
+
++void symbol__delete(struct symbol *self);
++
+ struct strlist;
+
+ struct symbol_conf {
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2010-04-02 12:05 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-04-02 12:05 [gentoo-commits] linux-patches r1693 - genpatches-2.6/trunk/2.6.33 Mike Pagano (mpagano)
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox