[kernel] r17882 - in dists/trunk/linux-2.6/debian: . config patches/bugfix/all/stable patches/series
Maximilian Attems
maks at alioth.debian.org
Thu Aug 4 00:31:08 UTC 2011
Author: maks
Date: Thu Aug 4 00:31:06 2011
New Revision: 17882
Log:
add 3.0.1-rc1 stable
has potential to unfuck current sad scsi stack troubels.
temporaly disable rt, has some conflicts to resolve.
Added:
dists/trunk/linux-2.6/debian/patches/bugfix/all/stable/3.0.1-rc1.patch
dists/trunk/linux-2.6/debian/patches/series/2
Modified:
dists/trunk/linux-2.6/debian/changelog
dists/trunk/linux-2.6/debian/config/defines
Modified: dists/trunk/linux-2.6/debian/changelog
==============================================================================
--- dists/trunk/linux-2.6/debian/changelog Wed Aug 3 16:31:45 2011 (r17881)
+++ dists/trunk/linux-2.6/debian/changelog Thu Aug 4 00:31:06 2011 (r17882)
@@ -7,6 +7,10 @@
* linux-libc-dev: Install include/asm under arch-specific directory;
mark package as multi-arch-coinstallable (Multi-Arch: same)
+ [ maximilian attems ]
+ * Add stable 3.0.1-rc1, including:
+ - [SCSI] fix crash in scsi_dispatch_cmd()
+
-- Ben Hutchings <ben at decadent.org.uk> Wed, 27 Jul 2011 23:58:10 +0200
linux-2.6 (3.0.0-1) unstable; urgency=low
Modified: dists/trunk/linux-2.6/debian/config/defines
==============================================================================
--- dists/trunk/linux-2.6/debian/config/defines Wed Aug 3 16:31:45 2011 (r17881)
+++ dists/trunk/linux-2.6/debian/config/defines Thu Aug 4 00:31:06 2011 (r17882)
@@ -50,4 +50,4 @@
s390-tools: s390-tools (>= 1.8.3-2~)
[featureset-rt]
-enabled: true
+enabled: false
Added: dists/trunk/linux-2.6/debian/patches/bugfix/all/stable/3.0.1-rc1.patch
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/trunk/linux-2.6/debian/patches/bugfix/all/stable/3.0.1-rc1.patch Thu Aug 4 00:31:06 2011 (r17882)
@@ -0,0 +1,3653 @@
+diff --git a/arch/alpha/kernel/time.c b/arch/alpha/kernel/time.c
+index 818e74e..f20d1b5 100644
+--- a/arch/alpha/kernel/time.c
++++ b/arch/alpha/kernel/time.c
+@@ -91,7 +91,7 @@ DEFINE_PER_CPU(u8, irq_work_pending);
+ #define test_irq_work_pending() __get_cpu_var(irq_work_pending)
+ #define clear_irq_work_pending() __get_cpu_var(irq_work_pending) = 0
+
+-void set_irq_work_pending(void)
++void arch_irq_work_raise(void)
+ {
+ set_irq_work_pending_flag();
+ }
+diff --git a/arch/arm/mach-pxa/cm-x300.c b/arch/arm/mach-pxa/cm-x300.c
+index b2248e7..8a03487 100644
+--- a/arch/arm/mach-pxa/cm-x300.c
++++ b/arch/arm/mach-pxa/cm-x300.c
+@@ -161,10 +161,10 @@ static mfp_cfg_t cm_x3xx_mfp_cfg[] __initdata = {
+ GPIO99_GPIO, /* Ethernet IRQ */
+
+ /* RTC GPIOs */
+- GPIO95_GPIO, /* RTC CS */
+- GPIO96_GPIO, /* RTC WR */
+- GPIO97_GPIO, /* RTC RD */
+- GPIO98_GPIO, /* RTC IO */
++ GPIO95_GPIO | MFP_LPM_DRIVE_HIGH, /* RTC CS */
++ GPIO96_GPIO | MFP_LPM_DRIVE_HIGH, /* RTC WR */
++ GPIO97_GPIO | MFP_LPM_DRIVE_HIGH, /* RTC RD */
++ GPIO98_GPIO, /* RTC IO */
+
+ /* Standard I2C */
+ GPIO21_I2C_SCL,
+diff --git a/arch/powerpc/kernel/crash.c b/arch/powerpc/kernel/crash.c
+index 4e6ee94..cc6a9d5 100644
+--- a/arch/powerpc/kernel/crash.c
++++ b/arch/powerpc/kernel/crash.c
+@@ -242,12 +242,8 @@ static void crash_kexec_wait_realmode(int cpu)
+
+ while (paca[i].kexec_state < KEXEC_STATE_REAL_MODE) {
+ barrier();
+- if (!cpu_possible(i)) {
++ if (!cpu_possible(i) || !cpu_online(i) || (msecs <= 0))
+ break;
+- }
+- if (!cpu_online(i)) {
+- break;
+- }
+ msecs--;
+ mdelay(1);
+ }
+diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
+index f33acfd..03b29a6 100644
+--- a/arch/powerpc/kernel/time.c
++++ b/arch/powerpc/kernel/time.c
+@@ -544,7 +544,7 @@ DEFINE_PER_CPU(u8, irq_work_pending);
+
+ #endif /* 32 vs 64 bit */
+
+-void set_irq_work_pending(void)
++void arch_irq_work_raise(void)
+ {
+ preempt_disable();
+ set_irq_work_pending_flag();
+diff --git a/arch/powerpc/platforms/pseries/hvconsole.c b/arch/powerpc/platforms/pseries/hvconsole.c
+index 3f6a89b..041e87c 100644
+--- a/arch/powerpc/platforms/pseries/hvconsole.c
++++ b/arch/powerpc/platforms/pseries/hvconsole.c
+@@ -73,7 +73,7 @@ int hvc_put_chars(uint32_t vtermno, const char *buf, int count)
+ if (ret == H_SUCCESS)
+ return count;
+ if (ret == H_BUSY)
+- return 0;
++ return -EAGAIN;
+ return -EIO;
+ }
+
+diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
+index 485b4f1..23a9d89 100644
+--- a/arch/x86/include/asm/msr-index.h
++++ b/arch/x86/include/asm/msr-index.h
+@@ -259,6 +259,9 @@
+ #define MSR_IA32_TEMPERATURE_TARGET 0x000001a2
+
+ #define MSR_IA32_ENERGY_PERF_BIAS 0x000001b0
++#define ENERGY_PERF_BIAS_PERFORMANCE 0
++#define ENERGY_PERF_BIAS_NORMAL 6
++#define ENERGY_PERF_BIAS_POWERSWAVE 15
+
+ #define MSR_IA32_PACKAGE_THERM_STATUS 0x000001b1
+
+diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
+index 1edf5ba..da0d779 100644
+--- a/arch/x86/kernel/cpu/intel.c
++++ b/arch/x86/kernel/cpu/intel.c
+@@ -456,6 +456,24 @@ static void __cpuinit init_intel(struct cpuinfo_x86 *c)
+
+ if (cpu_has(c, X86_FEATURE_VMX))
+ detect_vmx_virtcap(c);
++
++ /*
++ * Initialize MSR_IA32_ENERGY_PERF_BIAS if BIOS did not.
++ * x86_energy_perf_policy(8) is available to change it at run-time
++ */
++ if (cpu_has(c, X86_FEATURE_EPB)) {
++ u64 epb;
++
++ rdmsrl(MSR_IA32_ENERGY_PERF_BIAS, epb);
++ if ((epb & 0xF) == 0) {
++ printk_once(KERN_WARNING, "x86: updated energy_perf_bias"
++ " to 'normal' from 'performance'\n"
++ "You can view and update epb via utility,"
++ " such as x86_energy_perf_policy(8)\n");
++ epb = (epb & ~0xF) | ENERGY_PERF_BIAS_NORMAL;
++ wrmsrl(MSR_IA32_ENERGY_PERF_BIAS, epb);
++ }
++ }
+ }
+
+ #ifdef CONFIG_X86_32
+diff --git a/arch/x86/kernel/relocate_kernel_32.S b/arch/x86/kernel/relocate_kernel_32.S
+index 4123553..36818f8 100644
+--- a/arch/x86/kernel/relocate_kernel_32.S
++++ b/arch/x86/kernel/relocate_kernel_32.S
+@@ -97,6 +97,8 @@ relocate_kernel:
+ ret
+
+ identity_mapped:
++ /* set return address to 0 if not preserving context */
++ pushl $0
+ /* store the start address on the stack */
+ pushl %edx
+
+diff --git a/arch/x86/kernel/relocate_kernel_64.S b/arch/x86/kernel/relocate_kernel_64.S
+index 4de8f5b..7a6f3b3 100644
+--- a/arch/x86/kernel/relocate_kernel_64.S
++++ b/arch/x86/kernel/relocate_kernel_64.S
+@@ -100,6 +100,8 @@ relocate_kernel:
+ ret
+
+ identity_mapped:
++ /* set return address to 0 if not preserving context */
++ pushq $0
+ /* store the start address on the stack */
+ pushq %rdx
+
+diff --git a/arch/x86/oprofile/backtrace.c b/arch/x86/oprofile/backtrace.c
+index a5b64ab..32f78eb 100644
+--- a/arch/x86/oprofile/backtrace.c
++++ b/arch/x86/oprofile/backtrace.c
+@@ -11,10 +11,12 @@
+ #include <linux/oprofile.h>
+ #include <linux/sched.h>
+ #include <linux/mm.h>
++#include <linux/compat.h>
++#include <linux/highmem.h>
++
+ #include <asm/ptrace.h>
+ #include <asm/uaccess.h>
+ #include <asm/stacktrace.h>
+-#include <linux/compat.h>
+
+ static int backtrace_stack(void *data, char *name)
+ {
+@@ -36,17 +38,53 @@ static struct stacktrace_ops backtrace_ops = {
+ .walk_stack = print_context_stack,
+ };
+
++/* from arch/x86/kernel/cpu/perf_event.c: */
++
++/*
++ * best effort, GUP based copy_from_user() that assumes IRQ or NMI context
++ */
++static unsigned long
++copy_from_user_nmi(void *to, const void __user *from, unsigned long n)
++{
++ unsigned long offset, addr = (unsigned long)from;
++ unsigned long size, len = 0;
++ struct page *page;
++ void *map;
++ int ret;
++
++ do {
++ ret = __get_user_pages_fast(addr, 1, 0, &page);
++ if (!ret)
++ break;
++
++ offset = addr & (PAGE_SIZE - 1);
++ size = min(PAGE_SIZE - offset, n - len);
++
++ map = kmap_atomic(page);
++ memcpy(to, map+offset, size);
++ kunmap_atomic(map);
++ put_page(page);
++
++ len += size;
++ to += size;
++ addr += size;
++
++ } while (len < n);
++
++ return len;
++}
++
+ #ifdef CONFIG_COMPAT
+ static struct stack_frame_ia32 *
+ dump_user_backtrace_32(struct stack_frame_ia32 *head)
+ {
++ /* Also check accessibility of one struct frame_head beyond: */
+ struct stack_frame_ia32 bufhead[2];
+ struct stack_frame_ia32 *fp;
++ unsigned long bytes;
+
+- /* Also check accessibility of one struct frame_head beyond */
+- if (!access_ok(VERIFY_READ, head, sizeof(bufhead)))
+- return NULL;
+- if (__copy_from_user_inatomic(bufhead, head, sizeof(bufhead)))
++ bytes = copy_from_user_nmi(bufhead, head, sizeof(bufhead));
++ if (bytes != sizeof(bufhead))
+ return NULL;
+
+ fp = (struct stack_frame_ia32 *) compat_ptr(bufhead[0].next_frame);
+@@ -87,12 +125,12 @@ x86_backtrace_32(struct pt_regs * const regs, unsigned int depth)
+
+ static struct stack_frame *dump_user_backtrace(struct stack_frame *head)
+ {
++ /* Also check accessibility of one struct frame_head beyond: */
+ struct stack_frame bufhead[2];
++ unsigned long bytes;
+
+- /* Also check accessibility of one struct stack_frame beyond */
+- if (!access_ok(VERIFY_READ, head, sizeof(bufhead)))
+- return NULL;
+- if (__copy_from_user_inatomic(bufhead, head, sizeof(bufhead)))
++ bytes = copy_from_user_nmi(bufhead, head, sizeof(bufhead));
++ if (bytes != sizeof(bufhead))
+ return NULL;
+
+ oprofile_add_trace(bufhead[0].return_address);
+diff --git a/arch/xtensa/kernel/ptrace.c b/arch/xtensa/kernel/ptrace.c
+index c72c947..a0d042a 100644
+--- a/arch/xtensa/kernel/ptrace.c
++++ b/arch/xtensa/kernel/ptrace.c
+@@ -147,6 +147,9 @@ int ptrace_setxregs(struct task_struct *child, void __user *uregs)
+ elf_xtregs_t *xtregs = uregs;
+ int ret = 0;
+
++ if (!access_ok(VERIFY_READ, uregs, sizeof(elf_xtregs_t)))
++ return -EFAULT;
++
+ #if XTENSA_HAVE_COPROCESSORS
+ /* Flush all coprocessors before we overwrite them. */
+ coprocessor_flush_all(ti);
+diff --git a/block/blk-core.c b/block/blk-core.c
+index d2f8f40..1d49e1c 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -839,6 +839,9 @@ struct request *blk_get_request(struct request_queue *q, int rw, gfp_t gfp_mask)
+ {
+ struct request *rq;
+
++ if (unlikely(test_bit(QUEUE_FLAG_DEAD, &q->queue_flags)))
++ return NULL;
++
+ BUG_ON(rw != READ && rw != WRITE);
+
+ spin_lock_irq(q->queue_lock);
+diff --git a/block/blk-exec.c b/block/blk-exec.c
+index 8a0e7ec..a1ebceb 100644
+--- a/block/blk-exec.c
++++ b/block/blk-exec.c
+@@ -50,6 +50,13 @@ void blk_execute_rq_nowait(struct request_queue *q, struct gendisk *bd_disk,
+ {
+ int where = at_head ? ELEVATOR_INSERT_FRONT : ELEVATOR_INSERT_BACK;
+
++ if (unlikely(test_bit(QUEUE_FLAG_DEAD, &q->queue_flags))) {
++ rq->errors = -ENXIO;
++ if (rq->end_io)
++ rq->end_io(rq, rq->errors);
++ return;
++ }
++
+ rq->rq_disk = bd_disk;
+ rq->end_io = done;
+ WARN_ON(irqs_disabled());
+diff --git a/drivers/block/cciss.h b/drivers/block/cciss.h
+index 16b4d58..c049548 100644
+--- a/drivers/block/cciss.h
++++ b/drivers/block/cciss.h
+@@ -223,7 +223,7 @@ static void SA5_submit_command( ctlr_info_t *h, CommandList_struct *c)
+ h->ctlr, c->busaddr);
+ #endif /* CCISS_DEBUG */
+ writel(c->busaddr, h->vaddr + SA5_REQUEST_PORT_OFFSET);
+- readl(h->vaddr + SA5_REQUEST_PORT_OFFSET);
++ readl(h->vaddr + SA5_SCRATCHPAD_OFFSET);
+ h->commands_outstanding++;
+ if ( h->commands_outstanding > h->max_outstanding)
+ h->max_outstanding = h->commands_outstanding;
+diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c
+index b1c1177..e6ad3bb 100644
+--- a/drivers/firewire/core-cdev.c
++++ b/drivers/firewire/core-cdev.c
+@@ -253,14 +253,11 @@ static int fw_device_op_open(struct inode *inode, struct file *file)
+ init_waitqueue_head(&client->wait);
+ init_waitqueue_head(&client->tx_flush_wait);
+ INIT_LIST_HEAD(&client->phy_receiver_link);
++ INIT_LIST_HEAD(&client->link);
+ kref_init(&client->kref);
+
+ file->private_data = client;
+
+- mutex_lock(&device->client_list_mutex);
+- list_add_tail(&client->link, &device->client_list);
+- mutex_unlock(&device->client_list_mutex);
+-
+ return nonseekable_open(inode, file);
+ }
+
+@@ -451,15 +448,20 @@ static int ioctl_get_info(struct client *client, union ioctl_arg *arg)
+ if (ret != 0)
+ return -EFAULT;
+
++ mutex_lock(&client->device->client_list_mutex);
++
+ client->bus_reset_closure = a->bus_reset_closure;
+ if (a->bus_reset != 0) {
+ fill_bus_reset_event(&bus_reset, client);
+- if (copy_to_user(u64_to_uptr(a->bus_reset),
+- &bus_reset, sizeof(bus_reset)))
+- return -EFAULT;
++ ret = copy_to_user(u64_to_uptr(a->bus_reset),
++ &bus_reset, sizeof(bus_reset));
+ }
++ if (ret == 0 && list_empty(&client->link))
++ list_add_tail(&client->link, &client->device->client_list);
+
+- return 0;
++ mutex_unlock(&client->device->client_list_mutex);
++
++ return ret ? -EFAULT : 0;
+ }
+
+ static int add_client_resource(struct client *client,
+@@ -1583,7 +1585,7 @@ static int dispatch_ioctl(struct client *client,
+ if (_IOC_TYPE(cmd) != '#' ||
+ _IOC_NR(cmd) >= ARRAY_SIZE(ioctl_handlers) ||
+ _IOC_SIZE(cmd) > sizeof(buffer))
+- return -EINVAL;
++ return -ENOTTY;
+
+ if (_IOC_DIR(cmd) == _IOC_READ)
+ memset(&buffer, 0, _IOC_SIZE(cmd));
+diff --git a/drivers/firmware/sigma.c b/drivers/firmware/sigma.c
+index c19cd2c..f10fc52 100644
+--- a/drivers/firmware/sigma.c
++++ b/drivers/firmware/sigma.c
+@@ -11,6 +11,7 @@
+ #include <linux/firmware.h>
+ #include <linux/kernel.h>
+ #include <linux/i2c.h>
++#include <linux/module.h>
+ #include <linux/sigma.h>
+
+ /* Return: 0==OK, <0==error, =1 ==no more actions */
+@@ -113,3 +114,5 @@ int process_sigma_firmware(struct i2c_client *client, const char *name)
+ return ret;
+ }
+ EXPORT_SYMBOL(process_sigma_firmware);
++
++MODULE_LICENSE("GPL");
+diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
+index 8c0f9e3..645b84b 100644
+--- a/drivers/gpu/drm/radeon/atombios_dp.c
++++ b/drivers/gpu/drm/radeon/atombios_dp.c
+@@ -627,6 +627,7 @@ struct radeon_dp_link_train_info {
+ u8 train_set[4];
+ u8 link_status[DP_LINK_STATUS_SIZE];
+ u8 tries;
++ bool use_dpencoder;
+ };
+
+ static void radeon_dp_update_vs_emph(struct radeon_dp_link_train_info *dp_info)
+@@ -646,7 +647,7 @@ static void radeon_dp_set_tp(struct radeon_dp_link_train_info *dp_info, int tp)
+ int rtp = 0;
+
+ /* set training pattern on the source */
+- if (ASIC_IS_DCE4(dp_info->rdev)) {
++ if (ASIC_IS_DCE4(dp_info->rdev) || !dp_info->use_dpencoder) {
+ switch (tp) {
+ case DP_TRAINING_PATTERN_1:
+ rtp = ATOM_ENCODER_CMD_DP_LINK_TRAINING_PATTERN1;
+@@ -706,7 +707,7 @@ static int radeon_dp_link_train_init(struct radeon_dp_link_train_info *dp_info)
+ radeon_write_dpcd_reg(dp_info->radeon_connector, DP_LINK_BW_SET, tmp);
+
+ /* start training on the source */
+- if (ASIC_IS_DCE4(dp_info->rdev))
++ if (ASIC_IS_DCE4(dp_info->rdev) || !dp_info->use_dpencoder)
+ atombios_dig_encoder_setup(dp_info->encoder,
+ ATOM_ENCODER_CMD_DP_LINK_TRAINING_START, 0);
+ else
+@@ -731,7 +732,7 @@ static int radeon_dp_link_train_finish(struct radeon_dp_link_train_info *dp_info
+ DP_TRAINING_PATTERN_DISABLE);
+
+ /* disable the training pattern on the source */
+- if (ASIC_IS_DCE4(dp_info->rdev))
++ if (ASIC_IS_DCE4(dp_info->rdev) || !dp_info->use_dpencoder)
+ atombios_dig_encoder_setup(dp_info->encoder,
+ ATOM_ENCODER_CMD_DP_LINK_TRAINING_COMPLETE, 0);
+ else
+@@ -869,7 +870,8 @@ void radeon_dp_link_train(struct drm_encoder *encoder,
+ struct radeon_connector *radeon_connector;
+ struct radeon_connector_atom_dig *dig_connector;
+ struct radeon_dp_link_train_info dp_info;
+- u8 tmp;
++ int index;
++ u8 tmp, frev, crev;
+
+ if (!radeon_encoder->enc_priv)
+ return;
+@@ -884,6 +886,18 @@ void radeon_dp_link_train(struct drm_encoder *encoder,
+ (dig_connector->dp_sink_type != CONNECTOR_OBJECT_ID_eDP))
+ return;
+
++ /* DPEncoderService newer than 1.1 can't program properly the
++ * training pattern. When facing such version use the
++ * DIGXEncoderControl (X== 1 | 2)
++ */
++ dp_info.use_dpencoder = true;
++ index = GetIndexIntoMasterTable(COMMAND, DPEncoderService);
++ if (atom_parse_cmd_header(rdev->mode_info.atom_context, index, &frev, &crev)) {
++ if (crev > 1) {
++ dp_info.use_dpencoder = false;
++ }
++ }
++
+ dp_info.enc_id = 0;
+ if (dig->dig_encoder)
+ dp_info.enc_id |= ATOM_DP_CONFIG_DIG2_ENCODER;
+diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
+index e459467..a74217c 100644
+--- a/drivers/gpu/drm/radeon/radeon_combios.c
++++ b/drivers/gpu/drm/radeon/radeon_combios.c
+@@ -779,7 +779,8 @@ void radeon_combios_i2c_init(struct radeon_device *rdev)
+ }
+ }
+ }
+- } else if (rdev->family >= CHIP_R200) {
++ } else if ((rdev->family == CHIP_R200) ||
++ (rdev->family >= CHIP_R300)) {
+ /* 0x68 */
+ i2c = combios_setup_i2c_bus(rdev, DDC_MONID, 0, 0);
+ rdev->i2c_bus[3] = radeon_i2c_create(dev, &i2c, "MONID");
+diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
+index aaa19dc..6fabe89 100644
+--- a/drivers/gpu/drm/radeon/radeon_pm.c
++++ b/drivers/gpu/drm/radeon/radeon_pm.c
+@@ -594,6 +594,9 @@ int radeon_pm_init(struct radeon_device *rdev)
+ if (rdev->pm.default_vddc)
+ radeon_atom_set_voltage(rdev, rdev->pm.default_vddc,
+ SET_VOLTAGE_TYPE_ASIC_VDDC);
++ if (rdev->pm.default_vddci)
++ radeon_atom_set_voltage(rdev, rdev->pm.default_vddci,
++ SET_VOLTAGE_TYPE_ASIC_VDDCI);
+ if (rdev->pm.default_sclk)
+ radeon_set_engine_clock(rdev, rdev->pm.default_sclk);
+ if (rdev->pm.default_mclk)
+diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
+index ee165fd..7d5109b 100644
+--- a/drivers/infiniband/ulp/srp/ib_srp.c
++++ b/drivers/infiniband/ulp/srp/ib_srp.c
+@@ -2127,6 +2127,8 @@ static ssize_t srp_create_target(struct device *dev,
+ return -ENOMEM;
+
+ target_host->transportt = ib_srp_transport_template;
++ target_host->max_channel = 0;
++ target_host->max_id = 1;
+ target_host->max_lun = SRP_MAX_LUN;
+ target_host->max_cmd_len = sizeof ((struct srp_cmd *) (void *) 0L)->cdb;
+
+diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c
+index 2067288..ad2eba4 100644
+--- a/drivers/md/dm-io.c
++++ b/drivers/md/dm-io.c
+@@ -38,6 +38,8 @@ struct io {
+ struct dm_io_client *client;
+ io_notify_fn callback;
+ void *context;
++ void *vma_invalidate_address;
++ unsigned long vma_invalidate_size;
+ } __attribute__((aligned(DM_IO_MAX_REGIONS)));
+
+ static struct kmem_cache *_dm_io_cache;
+@@ -116,6 +118,10 @@ static void dec_count(struct io *io, unsigned int region, int error)
+ set_bit(region, &io->error_bits);
+
+ if (atomic_dec_and_test(&io->count)) {
++ if (io->vma_invalidate_size)
++ invalidate_kernel_vmap_range(io->vma_invalidate_address,
++ io->vma_invalidate_size);
++
+ if (io->sleeper)
+ wake_up_process(io->sleeper);
+
+@@ -159,6 +165,9 @@ struct dpages {
+
+ unsigned context_u;
+ void *context_ptr;
++
++ void *vma_invalidate_address;
++ unsigned long vma_invalidate_size;
+ };
+
+ /*
+@@ -377,6 +386,9 @@ static int sync_io(struct dm_io_client *client, unsigned int num_regions,
+ io->sleeper = current;
+ io->client = client;
+
++ io->vma_invalidate_address = dp->vma_invalidate_address;
++ io->vma_invalidate_size = dp->vma_invalidate_size;
++
+ dispatch_io(rw, num_regions, where, dp, io, 1);
+
+ while (1) {
+@@ -415,13 +427,21 @@ static int async_io(struct dm_io_client *client, unsigned int num_regions,
+ io->callback = fn;
+ io->context = context;
+
++ io->vma_invalidate_address = dp->vma_invalidate_address;
++ io->vma_invalidate_size = dp->vma_invalidate_size;
++
+ dispatch_io(rw, num_regions, where, dp, io, 0);
+ return 0;
+ }
+
+-static int dp_init(struct dm_io_request *io_req, struct dpages *dp)
++static int dp_init(struct dm_io_request *io_req, struct dpages *dp,
++ unsigned long size)
+ {
+ /* Set up dpages based on memory type */
++
++ dp->vma_invalidate_address = NULL;
++ dp->vma_invalidate_size = 0;
++
+ switch (io_req->mem.type) {
+ case DM_IO_PAGE_LIST:
+ list_dp_init(dp, io_req->mem.ptr.pl, io_req->mem.offset);
+@@ -432,6 +452,11 @@ static int dp_init(struct dm_io_request *io_req, struct dpages *dp)
+ break;
+
+ case DM_IO_VMA:
++ flush_kernel_vmap_range(io_req->mem.ptr.vma, size);
++ if ((io_req->bi_rw & RW_MASK) == READ) {
++ dp->vma_invalidate_address = io_req->mem.ptr.vma;
++ dp->vma_invalidate_size = size;
++ }
+ vm_dp_init(dp, io_req->mem.ptr.vma);
+ break;
+
+@@ -460,7 +485,7 @@ int dm_io(struct dm_io_request *io_req, unsigned num_regions,
+ int r;
+ struct dpages dp;
+
+- r = dp_init(io_req, &dp);
++ r = dp_init(io_req, &dp, (unsigned long)where->count << SECTOR_SHIFT);
+ if (r)
+ return r;
+
+diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
+index aa4e570..209991b 100644
+--- a/drivers/md/dm-mpath.c
++++ b/drivers/md/dm-mpath.c
+@@ -807,6 +807,11 @@ static int parse_features(struct arg_set *as, struct multipath *m)
+ if (!argc)
+ return 0;
+
++ if (argc > as->argc) {
++ ti->error = "not enough arguments for features";
++ return -EINVAL;
++ }
++
+ do {
+ param_name = shift(as);
+ argc--;
+diff --git a/drivers/md/dm-snap-persistent.c b/drivers/md/dm-snap-persistent.c
+index 135c2f1..e4ecadf 100644
+--- a/drivers/md/dm-snap-persistent.c
++++ b/drivers/md/dm-snap-persistent.c
+@@ -753,7 +753,7 @@ static int persistent_commit_merge(struct dm_exception_store *store,
+ for (i = 0; i < nr_merged; i++)
+ clear_exception(ps, ps->current_committed - 1 - i);
+
+- r = area_io(ps, WRITE);
++ r = area_io(ps, WRITE_FLUSH_FUA);
+ if (r < 0)
+ return r;
+
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index 0cf68b4..41abc6d 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -37,6 +37,8 @@ static const char *_name = DM_NAME;
+ static unsigned int major = 0;
+ static unsigned int _major = 0;
+
++static DEFINE_IDR(_minor_idr);
++
+ static DEFINE_SPINLOCK(_minor_lock);
+ /*
+ * For bio-based dm.
+@@ -313,6 +315,12 @@ static void __exit dm_exit(void)
+
+ while (i--)
+ _exits[i]();
++
++ /*
++ * Should be empty by this point.
++ */
++ idr_remove_all(&_minor_idr);
++ idr_destroy(&_minor_idr);
+ }
+
+ /*
+@@ -1705,8 +1713,6 @@ static int dm_any_congested(void *congested_data, int bdi_bits)
+ /*-----------------------------------------------------------------
+ * An IDR is used to keep track of allocated minor numbers.
+ *---------------------------------------------------------------*/
+-static DEFINE_IDR(_minor_idr);
+-
+ static void free_minor(int minor)
+ {
+ spin_lock(&_minor_lock);
+diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
+index 4e349cd..3546474 100644
+--- a/drivers/misc/Kconfig
++++ b/drivers/misc/Kconfig
+@@ -245,8 +245,7 @@ config SGI_XP
+
+ config CS5535_MFGPT
+ tristate "CS5535/CS5536 Geode Multi-Function General Purpose Timer (MFGPT) support"
+- depends on PCI
+- depends on X86
++ depends on PCI && X86 && MFD_CS5535
+ default n
+ help
+ This driver provides access to MFGPT functionality for other
+diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
+index a19967d..ba31abe 100644
+--- a/drivers/mmc/host/sdhci-esdhc-imx.c
++++ b/drivers/mmc/host/sdhci-esdhc-imx.c
+@@ -74,7 +74,7 @@ static u32 esdhc_readl_le(struct sdhci_host *host, int reg)
+ if (boarddata && gpio_is_valid(boarddata->cd_gpio)
+ && gpio_get_value(boarddata->cd_gpio))
+ /* no card, if a valid gpio says so... */
+- val &= SDHCI_CARD_PRESENT;
++ val &= ~SDHCI_CARD_PRESENT;
+ else
+ /* ... in all other cases assume card is present */
+ val |= SDHCI_CARD_PRESENT;
+diff --git a/drivers/net/jme.c b/drivers/net/jme.c
+index b5b174a..1973814 100644
+--- a/drivers/net/jme.c
++++ b/drivers/net/jme.c
+@@ -753,20 +753,28 @@ jme_make_new_rx_buf(struct jme_adapter *jme, int i)
+ struct jme_ring *rxring = &(jme->rxring[0]);
+ struct jme_buffer_info *rxbi = rxring->bufinf + i;
+ struct sk_buff *skb;
++ dma_addr_t mapping;
+
+ skb = netdev_alloc_skb(jme->dev,
+ jme->dev->mtu + RX_EXTRA_LEN);
+ if (unlikely(!skb))
+ return -ENOMEM;
+
++ mapping = pci_map_page(jme->pdev, virt_to_page(skb->data),
++ offset_in_page(skb->data), skb_tailroom(skb),
++ PCI_DMA_FROMDEVICE);
++ if (unlikely(pci_dma_mapping_error(jme->pdev, mapping))) {
++ dev_kfree_skb(skb);
++ return -ENOMEM;
++ }
++
++ if (likely(rxbi->mapping))
++ pci_unmap_page(jme->pdev, rxbi->mapping,
++ rxbi->len, PCI_DMA_FROMDEVICE);
++
+ rxbi->skb = skb;
+ rxbi->len = skb_tailroom(skb);
+- rxbi->mapping = pci_map_page(jme->pdev,
+- virt_to_page(skb->data),
+- offset_in_page(skb->data),
+- rxbi->len,
+- PCI_DMA_FROMDEVICE);
+-
++ rxbi->mapping = mapping;
+ return 0;
+ }
+
+diff --git a/drivers/net/wireless/ath/ath9k/ar9003_mac.c b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
+index 10d71f7..1f99249 100644
+--- a/drivers/net/wireless/ath/ath9k/ar9003_mac.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
+@@ -629,8 +629,7 @@ int ath9k_hw_process_rxdesc_edma(struct ath_hw *ah, struct ath_rx_status *rxs,
+ rxs->rs_status |= ATH9K_RXERR_DECRYPT;
+ else if (rxsp->status11 & AR_MichaelErr)
+ rxs->rs_status |= ATH9K_RXERR_MIC;
+-
+- if (rxsp->status11 & AR_KeyMiss)
++ else if (rxsp->status11 & AR_KeyMiss)
+ rxs->rs_status |= ATH9K_RXERR_DECRYPT;
+ }
+
+diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
+index c2091f1..b6b523a 100644
+--- a/drivers/net/wireless/ath/ath9k/mac.c
++++ b/drivers/net/wireless/ath/ath9k/mac.c
+@@ -645,8 +645,7 @@ int ath9k_hw_rxprocdesc(struct ath_hw *ah, struct ath_desc *ds,
+ rs->rs_status |= ATH9K_RXERR_DECRYPT;
+ else if (ads.ds_rxstatus8 & AR_MichaelErr)
+ rs->rs_status |= ATH9K_RXERR_MIC;
+-
+- if (ads.ds_rxstatus8 & AR_KeyMiss)
++ else if (ads.ds_rxstatus8 & AR_KeyMiss)
+ rs->rs_status |= ATH9K_RXERR_DECRYPT;
+ }
+
+diff --git a/drivers/net/wireless/rt2x00/rt2800pci.c b/drivers/net/wireless/rt2x00/rt2800pci.c
+index cc4a54f..55cd3e1 100644
+--- a/drivers/net/wireless/rt2x00/rt2800pci.c
++++ b/drivers/net/wireless/rt2x00/rt2800pci.c
+@@ -1158,6 +1158,7 @@ static DEFINE_PCI_DEVICE_TABLE(rt2800pci_device_table) = {
+ #endif
+ #ifdef CONFIG_RT2800PCI_RT53XX
+ { PCI_DEVICE(0x1814, 0x5390) },
++ { PCI_DEVICE(0x1814, 0x539f) },
+ #endif
+ { 0, }
+ };
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c b/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c
+index c7576ec..3bee79e 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c
+@@ -104,7 +104,7 @@ void rtl92cu_phy_rf6052_set_cck_txpower(struct ieee80211_hw *hw,
+ tx_agc[RF90_PATH_A] = 0x10101010;
+ tx_agc[RF90_PATH_B] = 0x10101010;
+ } else if (rtlpriv->dm.dynamic_txhighpower_lvl ==
+- TXHIGHPWRLEVEL_LEVEL1) {
++ TXHIGHPWRLEVEL_LEVEL2) {
+ tx_agc[RF90_PATH_A] = 0x00000000;
+ tx_agc[RF90_PATH_B] = 0x00000000;
+ } else{
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 692671b..d549bbc 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -1905,7 +1905,7 @@ void pci_enable_ari(struct pci_dev *dev)
+ {
+ int pos;
+ u32 cap;
+- u16 ctrl;
++ u16 flags, ctrl;
+ struct pci_dev *bridge;
+
+ if (!pci_is_pcie(dev) || dev->devfn)
+@@ -1923,6 +1923,11 @@ void pci_enable_ari(struct pci_dev *dev)
+ if (!pos)
+ return;
+
++ /* ARI is a PCIe v2 feature */
++ pci_read_config_word(bridge, pos + PCI_EXP_FLAGS, &flags);
++ if ((flags & PCI_EXP_FLAGS_VERS) < 2)
++ return;
++
+ pci_read_config_dword(bridge, pos + PCI_EXP_DEVCAP2, &cap);
+ if (!(cap & PCI_EXP_DEVCAP2_ARI))
+ return;
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 02145e9..1196f61 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -2758,6 +2758,29 @@ static void ricoh_mmc_fixup_r5c832(struct pci_dev *dev)
+
+ dev_notice(&dev->dev, "proprietary Ricoh MMC controller disabled (via firewire function)\n");
+ dev_notice(&dev->dev, "MMC cards are now supported by standard SDHCI controller\n");
++
++ /*
++ * RICOH 0xe823 SD/MMC card reader fails to recognize
++ * certain types of SD/MMC cards. Lowering the SD base
++ * clock frequency from 200Mhz to 50Mhz fixes this issue.
++ *
++ * 0x150 - SD2.0 mode enable for changing base clock
++ * frequency to 50Mhz
++ * 0xe1 - Base clock frequency
++ * 0x32 - 50Mhz new clock frequency
++ * 0xf9 - Key register for 0x150
++ * 0xfc - key register for 0xe1
++ */
++ if (dev->device == PCI_DEVICE_ID_RICOH_R5CE823) {
++ pci_write_config_byte(dev, 0xf9, 0xfc);
++ pci_write_config_byte(dev, 0x150, 0x10);
++ pci_write_config_byte(dev, 0xf9, 0x00);
++ pci_write_config_byte(dev, 0xfc, 0x01);
++ pci_write_config_byte(dev, 0xe1, 0x32);
++ pci_write_config_byte(dev, 0xfc, 0x00);
++
++ dev_notice(&dev->dev, "MMC controller base frequency changed to 50Mhz.\n");
++ }
+ }
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_RICOH, PCI_DEVICE_ID_RICOH_R5C832, ricoh_mmc_fixup_r5c832);
+ DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_RICOH, PCI_DEVICE_ID_RICOH_R5C832, ricoh_mmc_fixup_r5c832);
+diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c
+index df68618..3195dbd 100644
+--- a/drivers/rtc/interface.c
++++ b/drivers/rtc/interface.c
+@@ -636,6 +636,29 @@ void rtc_irq_unregister(struct rtc_device *rtc, struct rtc_task *task)
+ }
+ EXPORT_SYMBOL_GPL(rtc_irq_unregister);
+
++static int rtc_update_hrtimer(struct rtc_device *rtc, int enabled)
++{
++ /*
++ * We unconditionally cancel the timer here, because otherwise
++ * we could run into BUG_ON(timer->state != HRTIMER_STATE_CALLBACK);
++ * when we manage to start the timer before the callback
++ * returns HRTIMER_RESTART.
++ *
++ * We cannot use hrtimer_cancel() here as a running callback
++ * could be blocked on rtc->irq_task_lock and hrtimer_cancel()
++ * would spin forever.
++ */
++ if (hrtimer_try_to_cancel(&rtc->pie_timer) < 0)
++ return -1;
++
++ if (enabled) {
++ ktime_t period = ktime_set(0, NSEC_PER_SEC / rtc->irq_freq);
++
++ hrtimer_start(&rtc->pie_timer, period, HRTIMER_MODE_REL);
++ }
++ return 0;
++}
++
+ /**
+ * rtc_irq_set_state - enable/disable 2^N Hz periodic IRQs
+ * @rtc: the rtc device
+@@ -651,21 +674,21 @@ int rtc_irq_set_state(struct rtc_device *rtc, struct rtc_task *task, int enabled
+ int err = 0;
+ unsigned long flags;
+
++retry:
+ spin_lock_irqsave(&rtc->irq_task_lock, flags);
+ if (rtc->irq_task != NULL && task == NULL)
+ err = -EBUSY;
+ if (rtc->irq_task != task)
+ err = -EACCES;
+-
+- if (enabled) {
+- ktime_t period = ktime_set(0, NSEC_PER_SEC/rtc->irq_freq);
+- hrtimer_start(&rtc->pie_timer, period, HRTIMER_MODE_REL);
+- } else {
+- hrtimer_cancel(&rtc->pie_timer);
++ if (!err) {
++ if (rtc_update_hrtimer(rtc, enabled) < 0) {
++ spin_unlock_irqrestore(&rtc->irq_task_lock, flags);
++ cpu_relax();
++ goto retry;
++ }
++ rtc->pie_enabled = enabled;
+ }
+- rtc->pie_enabled = enabled;
+ spin_unlock_irqrestore(&rtc->irq_task_lock, flags);
+-
+ return err;
+ }
+ EXPORT_SYMBOL_GPL(rtc_irq_set_state);
+@@ -685,22 +708,20 @@ int rtc_irq_set_freq(struct rtc_device *rtc, struct rtc_task *task, int freq)
+ int err = 0;
+ unsigned long flags;
+
+- if (freq <= 0)
++ if (freq <= 0 || freq > 5000)
+ return -EINVAL;
+-
++retry:
+ spin_lock_irqsave(&rtc->irq_task_lock, flags);
+ if (rtc->irq_task != NULL && task == NULL)
+ err = -EBUSY;
+ if (rtc->irq_task != task)
+ err = -EACCES;
+- if (err == 0) {
++ if (!err) {
+ rtc->irq_freq = freq;
+- if (rtc->pie_enabled) {
+- ktime_t period;
+- hrtimer_cancel(&rtc->pie_timer);
+- period = ktime_set(0, NSEC_PER_SEC/rtc->irq_freq);
+- hrtimer_start(&rtc->pie_timer, period,
+- HRTIMER_MODE_REL);
++ if (rtc->pie_enabled && rtc_update_hrtimer(rtc, 1) < 0) {
++ spin_unlock_irqrestore(&rtc->irq_task_lock, flags);
++ cpu_relax();
++ goto retry;
+ }
+ }
+ spin_unlock_irqrestore(&rtc->irq_task_lock, flags);
+diff --git a/drivers/rtc/rtc-tegra.c b/drivers/rtc/rtc-tegra.c
+index 2fc31aa..75259fe 100644
+--- a/drivers/rtc/rtc-tegra.c
++++ b/drivers/rtc/rtc-tegra.c
+@@ -343,7 +343,7 @@ static int __devinit tegra_rtc_probe(struct platform_device *pdev)
+
+ /* set context info. */
+ info->pdev = pdev;
+- info->tegra_rtc_lock = __SPIN_LOCK_UNLOCKED(info->tegra_rtc_lock);
++ spin_lock_init(&info->tegra_rtc_lock);
+
+ platform_set_drvdata(pdev, info);
+
+diff --git a/drivers/scsi/hpsa.h b/drivers/scsi/hpsa.h
+index 6d8dcd4..7f53cea 100644
+--- a/drivers/scsi/hpsa.h
++++ b/drivers/scsi/hpsa.h
+@@ -214,7 +214,7 @@ static void SA5_submit_command(struct ctlr_info *h,
+ dev_dbg(&h->pdev->dev, "Sending %x, tag = %x\n", c->busaddr,
+ c->Header.Tag.lower);
+ writel(c->busaddr, h->vaddr + SA5_REQUEST_PORT_OFFSET);
+- (void) readl(h->vaddr + SA5_REQUEST_PORT_OFFSET);
++ (void) readl(h->vaddr + SA5_SCRATCHPAD_OFFSET);
+ h->commands_outstanding++;
+ if (h->commands_outstanding > h->max_outstanding)
+ h->max_outstanding = h->commands_outstanding;
+diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
+index 874e29d..f84084b 100644
+--- a/drivers/scsi/libsas/sas_expander.c
++++ b/drivers/scsi/libsas/sas_expander.c
+@@ -849,6 +849,9 @@ static struct domain_device *sas_ex_discover_expander(
+
+ res = sas_discover_expander(child);
+ if (res) {
++ spin_lock_irq(&parent->port->dev_list_lock);
++ list_del(&child->dev_list_node);
++ spin_unlock_irq(&parent->port->dev_list_lock);
+ kfree(child);
+ return NULL;
+ }
+diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c
+index fca6a89..d079f9a 100644
+--- a/drivers/scsi/pmcraid.c
++++ b/drivers/scsi/pmcraid.c
+@@ -3871,6 +3871,9 @@ static long pmcraid_ioctl_passthrough(
+ pmcraid_err("couldn't build passthrough ioadls\n");
+ goto out_free_buffer;
+ }
++ } else if (request_size < 0) {
++ rc = -EINVAL;
++ goto out_free_buffer;
+ }
+
+ /* If data is being written into the device, copy the data from user
+diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
+index 82e9e5c..cf8dfab 100644
+--- a/drivers/scsi/scsi_devinfo.c
++++ b/drivers/scsi/scsi_devinfo.c
+@@ -197,6 +197,7 @@ static struct {
+ {"IBM", "ProFibre 4000R", "*", BLIST_SPARSELUN | BLIST_LARGELUN},
+ {"IBM", "2105", NULL, BLIST_RETRY_HWERROR},
+ {"iomega", "jaz 1GB", "J.86", BLIST_NOTQ | BLIST_NOLUN},
++ {"IOMEGA", "ZIP", NULL, BLIST_NOTQ | BLIST_NOLUN},
+ {"IOMEGA", "Io20S *F", NULL, BLIST_KEY},
+ {"INSITE", "Floptical F*8I", NULL, BLIST_KEY},
+ {"INSITE", "I325VM", NULL, BLIST_KEY},
+@@ -243,6 +244,7 @@ static struct {
+ {"Tornado-", "F4", "*", BLIST_NOREPORTLUN},
+ {"TOSHIBA", "CDROM", NULL, BLIST_ISROM},
+ {"TOSHIBA", "CD-ROM", NULL, BLIST_ISROM},
++ {"Traxdata", "CDR4120", NULL, BLIST_NOLUN}, /* locks up */
+ {"USB2.0", "SMARTMEDIA/XD", NULL, BLIST_FORCELUN | BLIST_INQUIRY_36},
+ {"WangDAT", "Model 2600", "01.7", BLIST_SELECT_NO_ATN},
+ {"WangDAT", "Model 3200", "02.2", BLIST_SELECT_NO_ATN},
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index ec1803a..28d9c9d 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -213,6 +213,8 @@ int scsi_execute(struct scsi_device *sdev, const unsigned char *cmd,
+ int ret = DRIVER_ERROR << 24;
+
+ req = blk_get_request(sdev->request_queue, write, __GFP_WAIT);
++ if (!req)
++ return ret;
+
+ if (bufflen && blk_rq_map_kern(sdev->request_queue, req,
+ buffer, bufflen, __GFP_WAIT))
+diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
+index eb7a3e8..eba183c 100644
+--- a/drivers/scsi/ses.c
++++ b/drivers/scsi/ses.c
+@@ -160,6 +160,10 @@ static unsigned char *ses_get_page2_descriptor(struct enclosure_device *edev,
+ return NULL;
+ }
+
++/* For device slot and array device slot elements, byte 3 bit 6
++ * is "fault sensed" while byte 3 bit 5 is "fault reqstd". As this
++ * code stands these bits are shifted 4 positions right so in
++ * sysfs they will appear as bits 2 and 1 respectively. Strange. */
+ static void ses_get_fault(struct enclosure_device *edev,
+ struct enclosure_component *ecomp)
+ {
+@@ -181,7 +185,7 @@ static int ses_set_fault(struct enclosure_device *edev,
+ /* zero is disabled */
+ break;
+ case ENCLOSURE_SETTING_ENABLED:
+- desc[2] = 0x02;
++ desc[3] = 0x20;
+ break;
+ default:
+ /* SES doesn't do the SGPIO blink settings */
+diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
+index 4778e27..5fc97d2 100644
+--- a/drivers/scsi/sr.c
++++ b/drivers/scsi/sr.c
+@@ -221,14 +221,33 @@ static unsigned int sr_check_events(struct cdrom_device_info *cdi,
+ return 0;
+
+ events = sr_get_events(cd->device);
++ cd->get_event_changed |= events & DISK_EVENT_MEDIA_CHANGE;
++
++ /*
++ * If earlier GET_EVENT_STATUS_NOTIFICATION and TUR did not agree
++ * for several times in a row. We rely on TUR only for this likely
++ * broken device, to prevent generating incorrect media changed
++ * events for every open().
++ */
++ if (cd->ignore_get_event) {
++ events &= ~DISK_EVENT_MEDIA_CHANGE;
++ goto do_tur;
++ }
++
+ /*
+ * GET_EVENT_STATUS_NOTIFICATION is enough unless MEDIA_CHANGE
+ * is being cleared. Note that there are devices which hang
+ * if asked to execute TUR repeatedly.
+ */
+- if (!(clearing & DISK_EVENT_MEDIA_CHANGE))
+- goto skip_tur;
++ if (cd->device->changed) {
++ events |= DISK_EVENT_MEDIA_CHANGE;
++ cd->device->changed = 0;
++ cd->tur_changed = true;
++ }
+
++ if (!(clearing & DISK_EVENT_MEDIA_CHANGE))
++ return events;
++do_tur:
+ /* let's see whether the media is there with TUR */
+ last_present = cd->media_present;
+ ret = scsi_test_unit_ready(cd->device, SR_TIMEOUT, MAX_RETRIES, &sshdr);
+@@ -242,12 +261,31 @@ static unsigned int sr_check_events(struct cdrom_device_info *cdi,
+ (scsi_sense_valid(&sshdr) && sshdr.asc != 0x3a);
+
+ if (last_present != cd->media_present)
+- events |= DISK_EVENT_MEDIA_CHANGE;
+-skip_tur:
++ cd->device->changed = 1;
++
+ if (cd->device->changed) {
+ events |= DISK_EVENT_MEDIA_CHANGE;
+ cd->device->changed = 0;
++ cd->tur_changed = true;
++ }
++
++ if (cd->ignore_get_event)
++ return events;
++
++ /* check whether GET_EVENT is reporting spurious MEDIA_CHANGE */
++ if (!cd->tur_changed) {
++ if (cd->get_event_changed) {
++ if (cd->tur_mismatch++ > 8) {
++ sdev_printk(KERN_WARNING, cd->device,
++ "GET_EVENT and TUR disagree continuously, suppress GET_EVENT events\n");
++ cd->ignore_get_event = true;
++ }
++ } else {
++ cd->tur_mismatch = 0;
++ }
+ }
++ cd->tur_changed = false;
++ cd->get_event_changed = false;
+
+ return events;
+ }
+diff --git a/drivers/scsi/sr.h b/drivers/scsi/sr.h
+index e036f1d..37c8f6b 100644
+--- a/drivers/scsi/sr.h
++++ b/drivers/scsi/sr.h
+@@ -41,6 +41,13 @@ typedef struct scsi_cd {
+ unsigned readcd_known:1; /* drive supports READ_CD (0xbe) */
+ unsigned readcd_cdda:1; /* reading audio data using READ_CD */
+ unsigned media_present:1; /* media is present */
++
++ /* GET_EVENT spurious event handling, blk layer guarantees exclusion */
++ int tur_mismatch; /* nr of get_event TUR mismatches */
++ bool tur_changed:1; /* changed according to TUR */
++ bool get_event_changed:1; /* changed according to GET_EVENT */
++ bool ignore_get_event:1; /* GET_EVENT is unreliable, use TUR */
++
+ struct cdrom_device_info cdi;
+ /* We hold gendisk and scsi_device references on probe and use
+ * the refs on this kref to decide when to release them */
+diff --git a/drivers/staging/ath6kl/os/linux/ar6000_drv.c b/drivers/staging/ath6kl/os/linux/ar6000_drv.c
+index 48dd9e3..aa97efc 100644
+--- a/drivers/staging/ath6kl/os/linux/ar6000_drv.c
++++ b/drivers/staging/ath6kl/os/linux/ar6000_drv.c
+@@ -954,9 +954,13 @@ ar6000_transfer_bin_file(struct ar6_softc *ar, AR6K_BIN_FILE file, u32 address,
+ const char *filename;
+ const struct firmware *fw_entry;
+ u32 fw_entry_size;
++ u8 **buf;
++ size_t *buf_len;
+
+ switch (file) {
+ case AR6K_OTP_FILE:
++ buf = &ar->fw_otp;
++ buf_len = &ar->fw_otp_len;
+ if (ar->arVersion.target_ver == AR6003_REV1_VERSION) {
+ filename = AR6003_REV1_OTP_FILE;
+ } else if (ar->arVersion.target_ver == AR6003_REV2_VERSION) {
+@@ -970,6 +974,8 @@ ar6000_transfer_bin_file(struct ar6_softc *ar, AR6K_BIN_FILE file, u32 address,
+ break;
+
+ case AR6K_FIRMWARE_FILE:
++ buf = &ar->fw;
++ buf_len = &ar->fw_len;
+ if (ar->arVersion.target_ver == AR6003_REV1_VERSION) {
+ filename = AR6003_REV1_FIRMWARE_FILE;
+ } else if (ar->arVersion.target_ver == AR6003_REV2_VERSION) {
+@@ -1028,6 +1034,8 @@ ar6000_transfer_bin_file(struct ar6_softc *ar, AR6K_BIN_FILE file, u32 address,
+ break;
+
+ case AR6K_PATCH_FILE:
++ buf = &ar->fw_patch;
++ buf_len = &ar->fw_patch_len;
+ if (ar->arVersion.target_ver == AR6003_REV1_VERSION) {
+ filename = AR6003_REV1_PATCH_FILE;
+ } else if (ar->arVersion.target_ver == AR6003_REV2_VERSION) {
+@@ -1041,6 +1049,8 @@ ar6000_transfer_bin_file(struct ar6_softc *ar, AR6K_BIN_FILE file, u32 address,
+ break;
+
+ case AR6K_BOARD_DATA_FILE:
++ buf = &ar->fw_data;
++ buf_len = &ar->fw_data_len;
+ if (ar->arVersion.target_ver == AR6003_REV1_VERSION) {
+ filename = AR6003_REV1_BOARD_DATA_FILE;
+ } else if (ar->arVersion.target_ver == AR6003_REV2_VERSION) {
+@@ -1057,23 +1067,29 @@ ar6000_transfer_bin_file(struct ar6_softc *ar, AR6K_BIN_FILE file, u32 address,
+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unknown file type: %d\n", file));
+ return A_ERROR;
+ }
+- if ((A_REQUEST_FIRMWARE(&fw_entry, filename, ((struct device *)ar->osDevInfo.pOSDevice))) != 0)
+- {
+- AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Failed to get %s\n", filename));
+- return A_ENOENT;
++
++ if (*buf == NULL) {
++ if ((A_REQUEST_FIRMWARE(&fw_entry, filename, ((struct device *)ar->osDevInfo.pOSDevice))) != 0) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Failed to get %s\n", filename));
++ return A_ENOENT;
++ }
++
++ *buf = kmemdup(fw_entry->data, fw_entry->size, GFP_KERNEL);
++ *buf_len = fw_entry->size;
++ A_RELEASE_FIRMWARE(fw_entry);
+ }
+
+ #ifdef SOFTMAC_FILE_USED
+- if (file==AR6K_BOARD_DATA_FILE && fw_entry->data) {
+- ar6000_softmac_update(ar, (u8 *)fw_entry->data, fw_entry->size);
++ if (file==AR6K_BOARD_DATA_FILE && *buf_len) {
++ ar6000_softmac_update(ar, *buf, *buf_len);
+ }
+ #endif
+
+
+- fw_entry_size = fw_entry->size;
++ fw_entry_size = *buf_len;
+
+ /* Load extended board data for AR6003 */
+- if ((file==AR6K_BOARD_DATA_FILE) && (fw_entry->data)) {
++ if ((file==AR6K_BOARD_DATA_FILE) && *buf) {
+ u32 board_ext_address;
+ u32 board_ext_data_size;
+ u32 board_data_size;
+@@ -1089,14 +1105,13 @@ ar6000_transfer_bin_file(struct ar6_softc *ar, AR6K_BIN_FILE file, u32 address,
+ AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("Board extended Data download address: 0x%x\n", board_ext_address));
+
+ /* check whether the target has allocated memory for extended board data and file contains extended board data */
+- if ((board_ext_address) && (fw_entry->size == (board_data_size + board_ext_data_size))) {
++ if ((board_ext_address) && (*buf_len == (board_data_size + board_ext_data_size))) {
+ u32 param;
+
+- status = BMIWriteMemory(ar->arHifDevice, board_ext_address, (u8 *)(fw_entry->data + board_data_size), board_ext_data_size);
++ status = BMIWriteMemory(ar->arHifDevice, board_ext_address, (u8 *)(*buf + board_data_size), board_ext_data_size);
+
+ if (status) {
+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("BMI operation failed: %d\n", __LINE__));
+- A_RELEASE_FIRMWARE(fw_entry);
+ return A_ERROR;
+ }
+
+@@ -1110,17 +1125,16 @@ ar6000_transfer_bin_file(struct ar6_softc *ar, AR6K_BIN_FILE file, u32 address,
+ }
+
+ if (compressed) {
+- status = BMIFastDownload(ar->arHifDevice, address, (u8 *)fw_entry->data, fw_entry_size);
++ status = BMIFastDownload(ar->arHifDevice, address, *buf, fw_entry_size);
+ } else {
+- status = BMIWriteMemory(ar->arHifDevice, address, (u8 *)fw_entry->data, fw_entry_size);
++ status = BMIWriteMemory(ar->arHifDevice, address, *buf, fw_entry_size);
+ }
+
+ if (status) {
+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("BMI operation failed: %d\n", __LINE__));
+- A_RELEASE_FIRMWARE(fw_entry);
+ return A_ERROR;
+ }
+- A_RELEASE_FIRMWARE(fw_entry);
++
+ return 0;
+ }
+
+@@ -2088,6 +2102,11 @@ ar6000_destroy(struct net_device *dev, unsigned int unregister)
+ ar6000_remove_ap_interface();
+ #endif /*CONFIG_AP_VIRTUAL_ADAPTER_SUPPORT */
+
++ kfree(ar->fw_otp);
++ kfree(ar->fw);
++ kfree(ar->fw_patch);
++ kfree(ar->fw_data);
++
+ AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("-ar6000_destroy \n"));
+ }
+
+diff --git a/drivers/staging/ath6kl/os/linux/cfg80211.c b/drivers/staging/ath6kl/os/linux/cfg80211.c
+index d3a774d..32e3197 100644
+--- a/drivers/staging/ath6kl/os/linux/cfg80211.c
++++ b/drivers/staging/ath6kl/os/linux/cfg80211.c
+@@ -867,26 +867,31 @@ ar6k_cfg80211_scanComplete_event(struct ar6_softc *ar, int status)
+
+ AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: status %d\n", __func__, status));
+
+- if(ar->scan_request)
+- {
+- /* Translate data to cfg80211 mgmt format */
+- if (ar->arWmi)
+- wmi_iterate_nodes(ar->arWmi, ar6k_cfg80211_scan_node, ar->wdev->wiphy);
++ if (!ar->scan_request)
++ return;
++
++ if ((status == A_ECANCELED) || (status == A_EBUSY)) {
++ cfg80211_scan_done(ar->scan_request, true);
++ goto out;
++ }
++
++ /* Translate data to cfg80211 mgmt format */
++ wmi_iterate_nodes(ar->arWmi, ar6k_cfg80211_scan_node, ar->wdev->wiphy);
+
+- cfg80211_scan_done(ar->scan_request,
+- ((status & A_ECANCELED) || (status & A_EBUSY)) ? true : false);
++ cfg80211_scan_done(ar->scan_request, false);
+
+- if(ar->scan_request->n_ssids &&
+- ar->scan_request->ssids[0].ssid_len) {
++ if(ar->scan_request->n_ssids &&
++ ar->scan_request->ssids[0].ssid_len) {
+ u8 i;
+
+ for (i = 0; i < ar->scan_request->n_ssids; i++) {
+- wmi_probedSsid_cmd(ar->arWmi, i+1, DISABLE_SSID_FLAG,
+- 0, NULL);
++ wmi_probedSsid_cmd(ar->arWmi, i+1, DISABLE_SSID_FLAG,
++ 0, NULL);
+ }
+- }
+- ar->scan_request = NULL;
+ }
++
++out:
++ ar->scan_request = NULL;
+ }
+
+ static int
+diff --git a/drivers/staging/ath6kl/os/linux/include/ar6000_drv.h b/drivers/staging/ath6kl/os/linux/include/ar6000_drv.h
+index 22453b0..2911ea0 100644
+--- a/drivers/staging/ath6kl/os/linux/include/ar6000_drv.h
++++ b/drivers/staging/ath6kl/os/linux/include/ar6000_drv.h
+@@ -651,6 +651,15 @@ struct ar6_softc {
+ void *arApDev;
+ #endif
+ u8 arAutoAuthStage;
++
++ u8 *fw_otp;
++ size_t fw_otp_len;
++ u8 *fw;
++ size_t fw_len;
++ u8 *fw_patch;
++ size_t fw_patch_len;
++ u8 *fw_data;
++ size_t fw_data_len;
+ };
+
+ #ifdef CONFIG_AP_VIRTUAL_ADAPTER_SUPPORT
+diff --git a/drivers/staging/brcm80211/brcmsmac/wl_mac80211.c b/drivers/staging/brcm80211/brcmsmac/wl_mac80211.c
+index 6c6236c..aa0d127 100644
+--- a/drivers/staging/brcm80211/brcmsmac/wl_mac80211.c
++++ b/drivers/staging/brcm80211/brcmsmac/wl_mac80211.c
+@@ -449,11 +449,6 @@ wl_ops_bss_info_changed(struct ieee80211_hw *hw,
+ wiphy_err(wiphy, "%s: qos enabled: %s (implement)\n", __func__,
+ info->qos ? "true" : "false");
+ }
+- if (changed & BSS_CHANGED_IDLE) {
+- /* Idle changed for this BSS/interface */
+- wiphy_err(wiphy, "%s: BSS idle: %s (implement)\n", __func__,
+- info->idle ? "true" : "false");
+- }
+ return;
+ }
+
+diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
+index e7e72b8..c20694e 100644
+--- a/drivers/staging/comedi/comedi_fops.c
++++ b/drivers/staging/comedi/comedi_fops.c
+@@ -383,8 +383,8 @@ static int do_devinfo_ioctl(struct comedi_device *dev,
+ /* fill devinfo structure */
+ devinfo.version_code = COMEDI_VERSION_CODE;
+ devinfo.n_subdevs = dev->n_subdevices;
+- memcpy(devinfo.driver_name, dev->driver->driver_name, COMEDI_NAMELEN);
+- memcpy(devinfo.board_name, dev->board_name, COMEDI_NAMELEN);
++ strlcpy(devinfo.driver_name, dev->driver->driver_name, COMEDI_NAMELEN);
++ strlcpy(devinfo.board_name, dev->board_name, COMEDI_NAMELEN);
+
+ if (read_subdev)
+ devinfo.read_subdevice = read_subdev - dev->subdevices;
+diff --git a/drivers/staging/hv/channel.c b/drivers/staging/hv/channel.c
+index f655e59..d971bab 100644
+--- a/drivers/staging/hv/channel.c
++++ b/drivers/staging/hv/channel.c
+@@ -212,7 +212,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
+ if (ret != 0)
+ goto Cleanup;
+
+- t = wait_for_completion_timeout(&openInfo->waitevent, HZ);
++ t = wait_for_completion_timeout(&openInfo->waitevent, 5*HZ);
+ if (t == 0) {
+ err = -ETIMEDOUT;
+ goto errorout;
+diff --git a/drivers/staging/hv/channel_mgmt.c b/drivers/staging/hv/channel_mgmt.c
+index 957d61e..e2e7d05 100644
+--- a/drivers/staging/hv/channel_mgmt.c
++++ b/drivers/staging/hv/channel_mgmt.c
+@@ -773,7 +773,7 @@ int vmbus_request_offers(void)
+ goto cleanup;
+ }
+
+- t = wait_for_completion_timeout(&msginfo->waitevent, HZ);
++ t = wait_for_completion_timeout(&msginfo->waitevent, 5*HZ);
+ if (t == 0) {
+ ret = -ETIMEDOUT;
+ goto cleanup;
+diff --git a/drivers/staging/hv/connection.c b/drivers/staging/hv/connection.c
+index 37bbf77..91c65ad 100644
+--- a/drivers/staging/hv/connection.c
++++ b/drivers/staging/hv/connection.c
+@@ -135,7 +135,7 @@ int vmbus_connect(void)
+ }
+
+ /* Wait for the connection response */
+- t = wait_for_completion_timeout(&msginfo->waitevent, HZ);
++ t = wait_for_completion_timeout(&msginfo->waitevent, 5*HZ);
+ if (t == 0) {
+ spin_lock_irqsave(&vmbus_connection.channelmsg_lock,
+ flags);
+diff --git a/drivers/staging/hv/netvsc.c b/drivers/staging/hv/netvsc.c
+index 41cbb26..4742b68 100644
+--- a/drivers/staging/hv/netvsc.c
++++ b/drivers/staging/hv/netvsc.c
+@@ -270,7 +270,7 @@ static int netvsc_init_recv_buf(struct hv_device *device)
+ goto cleanup;
+ }
+
+- t = wait_for_completion_timeout(&net_device->channel_init_wait, HZ);
++ t = wait_for_completion_timeout(&net_device->channel_init_wait, 5*HZ);
+ BUG_ON(t == 0);
+
+
+@@ -513,7 +513,7 @@ static int netvsc_connect_vsp(struct hv_device *device)
+ if (ret != 0)
+ goto cleanup;
+
+- t = wait_for_completion_timeout(&net_device->channel_init_wait, HZ);
++ t = wait_for_completion_timeout(&net_device->channel_init_wait, 5*HZ);
+
+ if (t == 0) {
+ ret = -ETIMEDOUT;
+diff --git a/drivers/staging/hv/rndis_filter.c b/drivers/staging/hv/rndis_filter.c
+index 60ebdb1..b47ebb3 100644
+--- a/drivers/staging/hv/rndis_filter.c
++++ b/drivers/staging/hv/rndis_filter.c
+@@ -467,7 +467,7 @@ static int rndis_filter_query_device(struct rndis_device *dev, u32 oid,
+ if (ret != 0)
+ goto Cleanup;
+
+- t = wait_for_completion_timeout(&request->wait_event, HZ);
++ t = wait_for_completion_timeout(&request->wait_event, 5*HZ);
+ if (t == 0) {
+ ret = -ETIMEDOUT;
+ goto Cleanup;
+@@ -543,7 +543,7 @@ static int rndis_filter_set_packet_filter(struct rndis_device *dev,
+ if (ret != 0)
+ goto Cleanup;
+
+- t = wait_for_completion_timeout(&request->wait_event, HZ);
++ t = wait_for_completion_timeout(&request->wait_event, 5*HZ);
+
+ if (t == 0) {
+ ret = -1;
+@@ -600,7 +600,7 @@ static int rndis_filter_init_device(struct rndis_device *dev)
+ }
+
+
+- t = wait_for_completion_timeout(&request->wait_event, HZ);
++ t = wait_for_completion_timeout(&request->wait_event, 5*HZ);
+
+ if (t == 0) {
+ ret = -ETIMEDOUT;
+diff --git a/drivers/staging/hv/storvsc.c b/drivers/staging/hv/storvsc.c
+index 06cd327..3029786 100644
+--- a/drivers/staging/hv/storvsc.c
++++ b/drivers/staging/hv/storvsc.c
+@@ -135,7 +135,7 @@ static int storvsc_channel_init(struct hv_device *device)
+ if (ret != 0)
+ goto cleanup;
+
+- t = wait_for_completion_timeout(&request->wait_event, HZ);
++ t = wait_for_completion_timeout(&request->wait_event, 5*HZ);
+ if (t == 0) {
+ ret = -ETIMEDOUT;
+ goto cleanup;
+@@ -163,7 +163,7 @@ static int storvsc_channel_init(struct hv_device *device)
+ if (ret != 0)
+ goto cleanup;
+
+- t = wait_for_completion_timeout(&request->wait_event, HZ);
++ t = wait_for_completion_timeout(&request->wait_event, 5*HZ);
+ if (t == 0) {
+ ret = -ETIMEDOUT;
+ goto cleanup;
+@@ -192,7 +192,7 @@ static int storvsc_channel_init(struct hv_device *device)
+ if (ret != 0)
+ goto cleanup;
+
+- t = wait_for_completion_timeout(&request->wait_event, HZ);
++ t = wait_for_completion_timeout(&request->wait_event, 5*HZ);
+ if (t == 0) {
+ ret = -ETIMEDOUT;
+ goto cleanup;
+@@ -222,7 +222,7 @@ static int storvsc_channel_init(struct hv_device *device)
+ if (ret != 0)
+ goto cleanup;
+
+- t = wait_for_completion_timeout(&request->wait_event, HZ);
++ t = wait_for_completion_timeout(&request->wait_event, 5*HZ);
+ if (t == 0) {
+ ret = -ETIMEDOUT;
+ goto cleanup;
+diff --git a/drivers/staging/hv/storvsc_drv.c b/drivers/staging/hv/storvsc_drv.c
+index 942cc5f..cb4a25b 100644
+--- a/drivers/staging/hv/storvsc_drv.c
++++ b/drivers/staging/hv/storvsc_drv.c
+@@ -393,7 +393,7 @@ static int storvsc_host_reset(struct hv_device *device)
+ if (ret != 0)
+ goto cleanup;
+
+- t = wait_for_completion_timeout(&request->wait_event, HZ);
++ t = wait_for_completion_timeout(&request->wait_event, 5*HZ);
+ if (t == 0) {
+ ret = -ETIMEDOUT;
+ goto cleanup;
+diff --git a/drivers/staging/rtl8192e/r8192E_core.c b/drivers/staging/rtl8192e/r8192E_core.c
+index 58d800f..cd98f89 100644
+--- a/drivers/staging/rtl8192e/r8192E_core.c
++++ b/drivers/staging/rtl8192e/r8192E_core.c
+@@ -4532,6 +4532,7 @@ static int __devinit rtl8192_pci_probe(struct pci_dev *pdev,
+ u8 unit = 0;
+ int ret = -ENODEV;
+ unsigned long pmem_start, pmem_len, pmem_flags;
++ u8 revisionid;
+
+ RT_TRACE(COMP_INIT,"Configuring chip resources\n");
+
+@@ -4592,6 +4593,11 @@ static int __devinit rtl8192_pci_probe(struct pci_dev *pdev,
+ pci_write_config_byte(pdev, 0x41, 0x00);
+
+
++ pci_read_config_byte(pdev, 0x08, &revisionid);
++ /* If the revisionid is 0x10, the device uses rtl8192se. */
++ if (pdev->device == 0x8192 && revisionid == 0x10)
++ goto fail1;
++
+ pci_read_config_byte(pdev, 0x05, &unit);
+ pci_write_config_byte(pdev, 0x05, unit & (~0x04));
+
+diff --git a/drivers/staging/usbip/vhci_hcd.c b/drivers/staging/usbip/vhci_hcd.c
+index a76e8fa..76d7485 100644
+--- a/drivers/staging/usbip/vhci_hcd.c
++++ b/drivers/staging/usbip/vhci_hcd.c
+@@ -846,9 +846,9 @@ static void vhci_shutdown_connection(struct usbip_device *ud)
+ }
+
+ /* kill threads related to this sdev, if v.c. exists */
+- if (vdev->ud.tcp_rx)
++ if (vdev->ud.tcp_rx && !task_is_dead(vdev->ud.tcp_rx))
+ kthread_stop(vdev->ud.tcp_rx);
+- if (vdev->ud.tcp_tx)
++ if (vdev->ud.tcp_tx && !task_is_dead(vdev->ud.tcp_tx))
+ kthread_stop(vdev->ud.tcp_tx);
+
+ pr_info("stop threads\n");
+diff --git a/drivers/tty/hvc/hvc_console.c b/drivers/tty/hvc/hvc_console.c
+index e9cba13..aa84555 100644
+--- a/drivers/tty/hvc/hvc_console.c
++++ b/drivers/tty/hvc/hvc_console.c
+@@ -163,8 +163,10 @@ static void hvc_console_print(struct console *co, const char *b,
+ } else {
+ r = cons_ops[index]->put_chars(vtermnos[index], c, i);
+ if (r <= 0) {
+- /* throw away chars on error */
+- i = 0;
++ /* throw away characters on error
++ * but spin in case of -EAGAIN */
++ if (r != -EAGAIN)
++ i = 0;
+ } else if (r > 0) {
+ i -= r;
+ if (i > 0)
+@@ -448,7 +450,7 @@ static int hvc_push(struct hvc_struct *hp)
+
+ n = hp->ops->put_chars(hp->vtermno, hp->outbuf, hp->n_outbuf);
+ if (n <= 0) {
+- if (n == 0) {
++ if (n == 0 || n == -EAGAIN) {
+ hp->do_wakeup = 1;
+ return 0;
+ }
+diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
+index 19b4ae0..c0d34ad 100644
+--- a/drivers/tty/n_gsm.c
++++ b/drivers/tty/n_gsm.c
+@@ -1823,10 +1823,6 @@ static void gsm0_receive(struct gsm_mux *gsm, unsigned char c)
+ break;
+ case GSM_FCS: /* FCS follows the packet */
+ gsm->received_fcs = c;
+- if (c == GSM0_SOF) {
+- gsm->state = GSM_SEARCH;
+- break;
+- }
+ gsm_queue(gsm);
+ gsm->state = GSM_SSOF;
+ break;
+diff --git a/drivers/tty/serial/8250.c b/drivers/tty/serial/8250.c
+index b4129f5..d32b5bb 100644
+--- a/drivers/tty/serial/8250.c
++++ b/drivers/tty/serial/8250.c
+@@ -1107,7 +1107,7 @@ static void autoconfig_16550a(struct uart_8250_port *up)
+ */
+ DEBUG_AUTOCONF("Xscale ");
+ up->port.type = PORT_XSCALE;
+- up->capabilities |= UART_CAP_UUE;
++ up->capabilities |= UART_CAP_UUE | UART_CAP_RTOIE;
+ return;
+ }
+ } else {
+diff --git a/drivers/tty/serial/Kconfig b/drivers/tty/serial/Kconfig
+index 636144c..b3692e6 100644
+--- a/drivers/tty/serial/Kconfig
++++ b/drivers/tty/serial/Kconfig
+@@ -1419,7 +1419,7 @@ config SERIAL_SC26XX
+
+ config SERIAL_SC26XX_CONSOLE
+ bool "Console on SC2681/SC2692 serial port"
+- depends on SERIAL_SC26XX
++ depends on SERIAL_SC26XX=y
+ select SERIAL_CORE_CONSOLE
+ help
+ Support for Console on SC2681/SC2692 serial ports.
+diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
+index f8030ee..9ff9abc 100644
+--- a/drivers/usb/host/ehci-hcd.c
++++ b/drivers/usb/host/ehci-hcd.c
+@@ -94,7 +94,8 @@ static const char hcd_name [] = "ehci_hcd";
+ #define EHCI_IAA_MSECS 10 /* arbitrary */
+ #define EHCI_IO_JIFFIES (HZ/10) /* io watchdog > irq_thresh */
+ #define EHCI_ASYNC_JIFFIES (HZ/20) /* async idle timeout */
+-#define EHCI_SHRINK_FRAMES 5 /* async qh unlink delay */
++#define EHCI_SHRINK_JIFFIES (DIV_ROUND_UP(HZ, 200) + 1)
++ /* 200-ms async qh unlink delay */
+
+ /* Initial IRQ latency: faster than hw default */
+ static int log2_irq_thresh = 0; // 0 to 6
+@@ -152,10 +153,7 @@ timer_action(struct ehci_hcd *ehci, enum ehci_timer_action action)
+ break;
+ /* case TIMER_ASYNC_SHRINK: */
+ default:
+- /* add a jiffie since we synch against the
+- * 8 KHz uframe counter.
+- */
+- t = DIV_ROUND_UP(EHCI_SHRINK_FRAMES * HZ, 1000) + 1;
++ t = EHCI_SHRINK_JIFFIES;
+ break;
+ }
+ mod_timer(&ehci->watchdog, t + jiffies);
+diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
+index ea6184b..88cfb8f 100644
+--- a/drivers/usb/host/ehci-hub.c
++++ b/drivers/usb/host/ehci-hub.c
+@@ -891,10 +891,11 @@ static int ehci_hub_control (
+ * power switching; they're allowed to just limit the
+ * current. khubd will turn the power back on.
+ */
+- if (HCS_PPC (ehci->hcs_params)){
++ if ((temp & PORT_OC) && HCS_PPC(ehci->hcs_params)) {
+ ehci_writel(ehci,
+ temp & ~(PORT_RWC_BITS | PORT_POWER),
+ status_reg);
++ temp = ehci_readl(ehci, status_reg);
+ }
+ }
+
+diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
+index 5d6bc62..0917e3a 100644
+--- a/drivers/usb/host/ehci-q.c
++++ b/drivers/usb/host/ehci-q.c
+@@ -103,7 +103,7 @@ qh_update (struct ehci_hcd *ehci, struct ehci_qh *qh, struct ehci_qtd *qtd)
+ if (!(hw->hw_info1 & cpu_to_hc32(ehci, 1 << 14))) {
+ unsigned is_out, epnum;
+
+- is_out = !(qtd->hw_token & cpu_to_hc32(ehci, 1 << 8));
++ is_out = qh->is_out;
+ epnum = (hc32_to_cpup(ehci, &hw->hw_info1) >> 8) & 0x0f;
+ if (unlikely (!usb_gettoggle (qh->dev, epnum, is_out))) {
+ hw->hw_token &= ~cpu_to_hc32(ehci, QTD_TOGGLE);
+@@ -946,6 +946,7 @@ done:
+ hw = qh->hw;
+ hw->hw_info1 = cpu_to_hc32(ehci, info1);
+ hw->hw_info2 = cpu_to_hc32(ehci, info2);
++ qh->is_out = !is_input;
+ usb_settoggle (urb->dev, usb_pipeendpoint (urb->pipe), !is_input, 1);
+ qh_refresh (ehci, qh);
+ return qh;
+@@ -1231,6 +1232,8 @@ static void start_unlink_async (struct ehci_hcd *ehci, struct ehci_qh *qh)
+
+ prev->hw->hw_next = qh->hw->hw_next;
+ prev->qh_next = qh->qh_next;
++ if (ehci->qh_scan_next == qh)
++ ehci->qh_scan_next = qh->qh_next.qh;
+ wmb ();
+
+ /* If the controller isn't running, we don't have to wait for it */
+@@ -1256,53 +1259,49 @@ static void scan_async (struct ehci_hcd *ehci)
+ struct ehci_qh *qh;
+ enum ehci_timer_action action = TIMER_IO_WATCHDOG;
+
+- ehci->stamp = ehci_readl(ehci, &ehci->regs->frame_index);
+ timer_action_done (ehci, TIMER_ASYNC_SHRINK);
+-rescan:
+ stopped = !HC_IS_RUNNING(ehci_to_hcd(ehci)->state);
+- qh = ehci->async->qh_next.qh;
+- if (likely (qh != NULL)) {
+- do {
+- /* clean any finished work for this qh */
+- if (!list_empty(&qh->qtd_list) && (stopped ||
+- qh->stamp != ehci->stamp)) {
+- int temp;
+-
+- /* unlinks could happen here; completion
+- * reporting drops the lock. rescan using
+- * the latest schedule, but don't rescan
+- * qhs we already finished (no looping)
+- * unless the controller is stopped.
+- */
+- qh = qh_get (qh);
+- qh->stamp = ehci->stamp;
+- temp = qh_completions (ehci, qh);
+- if (qh->needs_rescan)
+- unlink_async(ehci, qh);
+- qh_put (qh);
+- if (temp != 0) {
+- goto rescan;
+- }
+- }
+
+- /* unlink idle entries, reducing DMA usage as well
+- * as HCD schedule-scanning costs. delay for any qh
+- * we just scanned, there's a not-unusual case that it
+- * doesn't stay idle for long.
+- * (plus, avoids some kind of re-activation race.)
++ ehci->qh_scan_next = ehci->async->qh_next.qh;
++ while (ehci->qh_scan_next) {
++ qh = ehci->qh_scan_next;
++ ehci->qh_scan_next = qh->qh_next.qh;
++ rescan:
++ /* clean any finished work for this qh */
++ if (!list_empty(&qh->qtd_list)) {
++ int temp;
++
++ /*
++ * Unlinks could happen here; completion reporting
++ * drops the lock. That's why ehci->qh_scan_next
++ * always holds the next qh to scan; if the next qh
++ * gets unlinked then ehci->qh_scan_next is adjusted
++ * in start_unlink_async().
+ */
+- if (list_empty(&qh->qtd_list)
+- && qh->qh_state == QH_STATE_LINKED) {
+- if (!ehci->reclaim && (stopped ||
+- ((ehci->stamp - qh->stamp) & 0x1fff)
+- >= EHCI_SHRINK_FRAMES * 8))
+- start_unlink_async(ehci, qh);
+- else
+- action = TIMER_ASYNC_SHRINK;
+- }
++ qh = qh_get(qh);
++ temp = qh_completions(ehci, qh);
++ if (qh->needs_rescan)
++ unlink_async(ehci, qh);
++ qh->unlink_time = jiffies + EHCI_SHRINK_JIFFIES;
++ qh_put(qh);
++ if (temp != 0)
++ goto rescan;
++ }
+
+- qh = qh->qh_next.qh;
+- } while (qh);
++ /* unlink idle entries, reducing DMA usage as well
++ * as HCD schedule-scanning costs. delay for any qh
++ * we just scanned, there's a not-unusual case that it
++ * doesn't stay idle for long.
++ * (plus, avoids some kind of re-activation race.)
++ */
++ if (list_empty(&qh->qtd_list)
++ && qh->qh_state == QH_STATE_LINKED) {
++ if (!ehci->reclaim && (stopped ||
++ time_after_eq(jiffies, qh->unlink_time)))
++ start_unlink_async(ehci, qh);
++ else
++ action = TIMER_ASYNC_SHRINK;
++ }
+ }
+ if (action == TIMER_ASYNC_SHRINK)
+ timer_action (ehci, TIMER_ASYNC_SHRINK);
+diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
+index bd6ff48..989e0a8 100644
+--- a/drivers/usb/host/ehci.h
++++ b/drivers/usb/host/ehci.h
+@@ -75,6 +75,7 @@ struct ehci_hcd { /* one per controller */
+ struct ehci_qh *async;
+ struct ehci_qh *dummy; /* For AMD quirk use */
+ struct ehci_qh *reclaim;
++ struct ehci_qh *qh_scan_next;
+ unsigned scanning : 1;
+
+ /* periodic schedule support */
+@@ -117,7 +118,6 @@ struct ehci_hcd { /* one per controller */
+ struct timer_list iaa_watchdog;
+ struct timer_list watchdog;
+ unsigned long actions;
+- unsigned stamp;
+ unsigned periodic_stamp;
+ unsigned random_frame;
+ unsigned long next_statechange;
+@@ -343,6 +343,7 @@ struct ehci_qh {
+ struct ehci_qh *reclaim; /* next to reclaim */
+
+ struct ehci_hcd *ehci;
++ unsigned long unlink_time;
+
+ /*
+ * Do NOT use atomic operations for QH refcounting. On some CPUs
+@@ -374,6 +375,7 @@ struct ehci_qh {
+ #define NO_FRAME ((unsigned short)~0) /* pick new start */
+
+ struct usb_device *dev; /* access to TT */
++ unsigned is_out:1; /* bulk or intr OUT */
+ unsigned clearing_tt:1; /* Clear-TT-Buf in progress */
+ };
+
+diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
+index fd93061..04b90ad 100644
+--- a/drivers/usb/host/pci-quirks.c
++++ b/drivers/usb/host/pci-quirks.c
+@@ -35,6 +35,8 @@
+ #define OHCI_INTRSTATUS 0x0c
+ #define OHCI_INTRENABLE 0x10
+ #define OHCI_INTRDISABLE 0x14
++#define OHCI_FMINTERVAL 0x34
++#define OHCI_HCR (1 << 0) /* host controller reset */
+ #define OHCI_OCR (1 << 3) /* ownership change request */
+ #define OHCI_CTRL_RWC (1 << 9) /* remote wakeup connected */
+ #define OHCI_CTRL_IR (1 << 8) /* interrupt routing */
+@@ -497,6 +499,32 @@ static void __devinit quirk_usb_handoff_ohci(struct pci_dev *pdev)
+
+ /* reset controller, preserving RWC (and possibly IR) */
+ writel(control & OHCI_CTRL_MASK, base + OHCI_CONTROL);
++ readl(base + OHCI_CONTROL);
++
++ /* Some NVIDIA controllers stop working if kept in RESET for too long */
++ if (pdev->vendor == PCI_VENDOR_ID_NVIDIA) {
++ u32 fminterval;
++ int cnt;
++
++ /* drive reset for at least 50 ms (7.1.7.5) */
++ msleep(50);
++
++ /* software reset of the controller, preserving HcFmInterval */
++ fminterval = readl(base + OHCI_FMINTERVAL);
++ writel(OHCI_HCR, base + OHCI_CMDSTATUS);
++
++ /* reset requires max 10 us delay */
++ for (cnt = 30; cnt > 0; --cnt) { /* ... allow extra time */
++ if ((readl(base + OHCI_CMDSTATUS) & OHCI_HCR) == 0)
++ break;
++ udelay(1);
++ }
++ writel(fminterval, base + OHCI_FMINTERVAL);
++
++ /* Now we're in the SUSPEND state with all devices reset
++ * and wakeups and interrupts disabled
++ */
++ }
+
+ /*
+ * disable interrupts
+diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
+index c71b037..dce7182 100644
+--- a/drivers/usb/musb/musb_core.c
++++ b/drivers/usb/musb/musb_core.c
+@@ -2329,6 +2329,7 @@ static void musb_restore_context(struct musb *musb)
+ musb->context.index_regs[i].rxhubport);
+ }
+ }
++ musb_writeb(musb_base, MUSB_INDEX, musb->context.index);
+ }
+
+ static int musb_suspend(struct device *dev)
+diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
+index 30461fc..0c20831 100644
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -91,6 +91,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(SONY_VENDOR_ID, SONY_QN3USB_PRODUCT_ID) },
+ { USB_DEVICE(SANWA_VENDOR_ID, SANWA_PRODUCT_ID) },
+ { USB_DEVICE(ADLINK_VENDOR_ID, ADLINK_ND6530_PRODUCT_ID) },
++ { USB_DEVICE(WINCHIPHEAD_VENDOR_ID, WINCHIPHEAD_USBSER_PRODUCT_ID) },
+ { } /* Terminating entry */
+ };
+
+diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
+index 1b025f7..ca0d237 100644
+--- a/drivers/usb/serial/pl2303.h
++++ b/drivers/usb/serial/pl2303.h
+@@ -144,3 +144,7 @@
+ /* ADLINK ND-6530 RS232,RS485 and RS422 adapter */
+ #define ADLINK_VENDOR_ID 0x0b63
+ #define ADLINK_ND6530_PRODUCT_ID 0x6530
++
++/* WinChipHead USB->RS 232 adapter */
++#define WINCHIPHEAD_VENDOR_ID 0x4348
++#define WINCHIPHEAD_USBSER_PRODUCT_ID 0x5523
+diff --git a/drivers/watchdog/shwdt.c b/drivers/watchdog/shwdt.c
+index db84f23..a267dc0 100644
+--- a/drivers/watchdog/shwdt.c
++++ b/drivers/watchdog/shwdt.c
+@@ -64,7 +64,7 @@
+ * misses its deadline, the kernel timer will allow the WDT to overflow.
+ */
+ static int clock_division_ratio = WTCSR_CKS_4096;
+-#define next_ping_period(cks) msecs_to_jiffies(cks - 4)
++#define next_ping_period(cks) (jiffies + msecs_to_jiffies(cks - 4))
+
+ static const struct watchdog_info sh_wdt_info;
+ static struct platform_device *sh_wdt_dev;
+diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
+index fa8c21d..d8d26f3 100644
+--- a/fs/cifs/dir.c
++++ b/fs/cifs/dir.c
+@@ -641,7 +641,7 @@ lookup_out:
+ static int
+ cifs_d_revalidate(struct dentry *direntry, struct nameidata *nd)
+ {
+- if (nd->flags & LOOKUP_RCU)
++ if (nd && (nd->flags & LOOKUP_RCU))
+ return -ECHILD;
+
+ if (direntry->d_inode) {
+diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
+index 7349ade..4a4fad7 100644
+--- a/fs/ecryptfs/inode.c
++++ b/fs/ecryptfs/inode.c
+@@ -69,6 +69,7 @@ static int ecryptfs_inode_set(struct inode *inode, void *opaque)
+ inode->i_ino = lower_inode->i_ino;
+ inode->i_version++;
+ inode->i_mapping->a_ops = &ecryptfs_aops;
++ inode->i_mapping->backing_dev_info = inode->i_sb->s_bdi;
+
+ if (S_ISLNK(inode->i_mode))
+ inode->i_op = &ecryptfs_symlink_iops;
+diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c
+index 27a7fef..89dc18e 100644
+--- a/fs/ecryptfs/keystore.c
++++ b/fs/ecryptfs/keystore.c
+@@ -1868,11 +1868,6 @@ int ecryptfs_parse_packet_set(struct ecryptfs_crypt_stat *crypt_stat,
+ * just one will be sufficient to decrypt to get the FEK. */
+ find_next_matching_auth_tok:
+ found_auth_tok = 0;
+- if (auth_tok_key) {
+- up_write(&(auth_tok_key->sem));
+- key_put(auth_tok_key);
+- auth_tok_key = NULL;
+- }
+ list_for_each_entry(auth_tok_list_item, &auth_tok_list, list) {
+ candidate_auth_tok = &auth_tok_list_item->auth_tok;
+ if (unlikely(ecryptfs_verbosity > 0)) {
+@@ -1909,14 +1904,22 @@ found_matching_auth_tok:
+ memcpy(&(candidate_auth_tok->token.private_key),
+ &(matching_auth_tok->token.private_key),
+ sizeof(struct ecryptfs_private_key));
++ up_write(&(auth_tok_key->sem));
++ key_put(auth_tok_key);
+ rc = decrypt_pki_encrypted_session_key(candidate_auth_tok,
+ crypt_stat);
+ } else if (candidate_auth_tok->token_type == ECRYPTFS_PASSWORD) {
+ memcpy(&(candidate_auth_tok->token.password),
+ &(matching_auth_tok->token.password),
+ sizeof(struct ecryptfs_password));
++ up_write(&(auth_tok_key->sem));
++ key_put(auth_tok_key);
+ rc = decrypt_passphrase_encrypted_session_key(
+ candidate_auth_tok, crypt_stat);
++ } else {
++ up_write(&(auth_tok_key->sem));
++ key_put(auth_tok_key);
++ rc = -EINVAL;
+ }
+ if (rc) {
+ struct ecryptfs_auth_tok_list_item *auth_tok_list_item_tmp;
+@@ -1956,15 +1959,12 @@ found_matching_auth_tok:
+ out_wipe_list:
+ wipe_auth_tok_list(&auth_tok_list);
+ out:
+- if (auth_tok_key) {
+- up_write(&(auth_tok_key->sem));
+- key_put(auth_tok_key);
+- }
+ return rc;
+ }
+
+ static int
+-pki_encrypt_session_key(struct ecryptfs_auth_tok *auth_tok,
++pki_encrypt_session_key(struct key *auth_tok_key,
++ struct ecryptfs_auth_tok *auth_tok,
+ struct ecryptfs_crypt_stat *crypt_stat,
+ struct ecryptfs_key_record *key_rec)
+ {
+@@ -1979,6 +1979,8 @@ pki_encrypt_session_key(struct ecryptfs_auth_tok *auth_tok,
+ crypt_stat->cipher,
+ crypt_stat->key_size),
+ crypt_stat, &payload, &payload_len);
++ up_write(&(auth_tok_key->sem));
++ key_put(auth_tok_key);
+ if (rc) {
+ ecryptfs_printk(KERN_ERR, "Error generating tag 66 packet\n");
+ goto out;
+@@ -2008,6 +2010,8 @@ out:
+ * write_tag_1_packet - Write an RFC2440-compatible tag 1 (public key) packet
+ * @dest: Buffer into which to write the packet
+ * @remaining_bytes: Maximum number of bytes that can be writtn
++ * @auth_tok_key: The authentication token key to unlock and put when done with
++ * @auth_tok
+ * @auth_tok: The authentication token used for generating the tag 1 packet
+ * @crypt_stat: The cryptographic context
+ * @key_rec: The key record struct for the tag 1 packet
+@@ -2018,7 +2022,7 @@ out:
+ */
+ static int
+ write_tag_1_packet(char *dest, size_t *remaining_bytes,
+- struct ecryptfs_auth_tok *auth_tok,
++ struct key *auth_tok_key, struct ecryptfs_auth_tok *auth_tok,
+ struct ecryptfs_crypt_stat *crypt_stat,
+ struct ecryptfs_key_record *key_rec, size_t *packet_size)
+ {
+@@ -2039,12 +2043,15 @@ write_tag_1_packet(char *dest, size_t *remaining_bytes,
+ memcpy(key_rec->enc_key,
+ auth_tok->session_key.encrypted_key,
+ auth_tok->session_key.encrypted_key_size);
++ up_write(&(auth_tok_key->sem));
++ key_put(auth_tok_key);
+ goto encrypted_session_key_set;
+ }
+ if (auth_tok->session_key.encrypted_key_size == 0)
+ auth_tok->session_key.encrypted_key_size =
+ auth_tok->token.private_key.key_size;
+- rc = pki_encrypt_session_key(auth_tok, crypt_stat, key_rec);
++ rc = pki_encrypt_session_key(auth_tok_key, auth_tok, crypt_stat,
++ key_rec);
+ if (rc) {
+ printk(KERN_ERR "Failed to encrypt session key via a key "
+ "module; rc = [%d]\n", rc);
+@@ -2421,6 +2428,8 @@ ecryptfs_generate_key_packet_set(char *dest_base,
+ &max, auth_tok,
+ crypt_stat, key_rec,
+ &written);
++ up_write(&(auth_tok_key->sem));
++ key_put(auth_tok_key);
+ if (rc) {
+ ecryptfs_printk(KERN_WARNING, "Error "
+ "writing tag 3 packet\n");
+@@ -2438,8 +2447,8 @@ ecryptfs_generate_key_packet_set(char *dest_base,
+ }
+ (*len) += written;
+ } else if (auth_tok->token_type == ECRYPTFS_PRIVATE_KEY) {
+- rc = write_tag_1_packet(dest_base + (*len),
+- &max, auth_tok,
++ rc = write_tag_1_packet(dest_base + (*len), &max,
++ auth_tok_key, auth_tok,
+ crypt_stat, key_rec, &written);
+ if (rc) {
+ ecryptfs_printk(KERN_WARNING, "Error "
+@@ -2448,14 +2457,13 @@ ecryptfs_generate_key_packet_set(char *dest_base,
+ }
+ (*len) += written;
+ } else {
++ up_write(&(auth_tok_key->sem));
++ key_put(auth_tok_key);
+ ecryptfs_printk(KERN_WARNING, "Unsupported "
+ "authentication token type\n");
+ rc = -EINVAL;
+ goto out_free;
+ }
+- up_write(&(auth_tok_key->sem));
+- key_put(auth_tok_key);
+- auth_tok_key = NULL;
+ }
+ if (likely(max > 0)) {
+ dest_base[(*len)] = 0x00;
+@@ -2468,11 +2476,6 @@ out_free:
+ out:
+ if (rc)
+ (*len) = 0;
+- if (auth_tok_key) {
+- up_write(&(auth_tok_key->sem));
+- key_put(auth_tok_key);
+- }
+-
+ mutex_unlock(&crypt_stat->keysig_list_mutex);
+ return rc;
+ }
+diff --git a/fs/ext3/xattr.c b/fs/ext3/xattr.c
+index 32e6cc2..d565759 100644
+--- a/fs/ext3/xattr.c
++++ b/fs/ext3/xattr.c
+@@ -803,8 +803,16 @@ inserted:
+ /* We need to allocate a new block */
+ ext3_fsblk_t goal = ext3_group_first_block_no(sb,
+ EXT3_I(inode)->i_block_group);
+- ext3_fsblk_t block = ext3_new_block(handle, inode,
+- goal, &error);
++ ext3_fsblk_t block;
++
++ /*
++ * Protect us agaist concurrent allocations to the
++ * same inode from ext3_..._writepage(). Reservation
++ * code does not expect racing allocations.
++ */
++ mutex_lock(&EXT3_I(inode)->truncate_mutex);
++ block = ext3_new_block(handle, inode, goal, &error);
++ mutex_unlock(&EXT3_I(inode)->truncate_mutex);
+ if (error)
+ goto cleanup;
+ ea_idebug(inode, "creating block %d", block);
+diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
+index 1921392..354619a 100644
+--- a/fs/ext4/ext4.h
++++ b/fs/ext4/ext4.h
+@@ -526,6 +526,7 @@ struct ext4_new_group_data {
+ #define EXT4_FREE_BLOCKS_METADATA 0x0001
+ #define EXT4_FREE_BLOCKS_FORGET 0x0002
+ #define EXT4_FREE_BLOCKS_VALIDATED 0x0004
++#define EXT4_FREE_BLOCKS_NO_QUOT_UPDATE 0x0008
+
+ /*
+ * ioctl commands
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index f815cc8..f3aacb3 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -3596,17 +3596,18 @@ int ext4_ext_map_blocks(handle_t *handle, struct inode *inode,
+ }
+
+ err = check_eofblocks_fl(handle, inode, map->m_lblk, path, ar.len);
+- if (err)
+- goto out2;
+-
+- err = ext4_ext_insert_extent(handle, inode, path, &newex, flags);
++ if (!err)
++ err = ext4_ext_insert_extent(handle, inode, path,
++ &newex, flags);
+ if (err) {
++ int fb_flags = flags & EXT4_GET_BLOCKS_DELALLOC_RESERVE ?
++ EXT4_FREE_BLOCKS_NO_QUOT_UPDATE : 0;
+ /* free data blocks we just allocated */
+ /* not a good idea to call discard here directly,
+ * but otherwise we'd need to call it every free() */
+ ext4_discard_preallocations(inode);
+ ext4_free_blocks(handle, inode, NULL, ext4_ext_pblock(&newex),
+- ext4_ext_get_actual_len(&newex), 0);
++ ext4_ext_get_actual_len(&newex), fb_flags);
+ goto out2;
+ }
+
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index 6ed859d..0f1be7f 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -4637,7 +4637,7 @@ do_more:
+ }
+ ext4_mark_super_dirty(sb);
+ error_return:
+- if (freed)
++ if (freed && !(flags & EXT4_FREE_BLOCKS_NO_QUOT_UPDATE))
+ dquot_free_block(inode, freed);
+ brelse(bitmap_bh);
+ ext4_std_error(sb, err);
+diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
+index 2a77071..fa780e6 100644
+--- a/fs/gfs2/ops_fstype.c
++++ b/fs/gfs2/ops_fstype.c
+@@ -1018,13 +1018,13 @@ hostdata_error:
+ fsname++;
+ if (lm->lm_mount == NULL) {
+ fs_info(sdp, "Now mounting FS...\n");
+- complete(&sdp->sd_locking_init);
++ complete_all(&sdp->sd_locking_init);
+ return 0;
+ }
+ ret = lm->lm_mount(sdp, fsname);
+ if (ret == 0)
+ fs_info(sdp, "Joined cluster. Now mounting FS...\n");
+- complete(&sdp->sd_locking_init);
++ complete_all(&sdp->sd_locking_init);
+ return ret;
+ }
+
+diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
+index dd25c2a..321a66b 100644
+--- a/fs/nfs/delegation.c
++++ b/fs/nfs/delegation.c
+@@ -398,12 +398,11 @@ int nfs_inode_return_delegation(struct inode *inode)
+ return err;
+ }
+
+-static void nfs_mark_return_delegation(struct nfs_delegation *delegation)
++static void nfs_mark_return_delegation(struct nfs_server *server,
++ struct nfs_delegation *delegation)
+ {
+- struct nfs_client *clp = NFS_SERVER(delegation->inode)->nfs_client;
+-
+ set_bit(NFS_DELEGATION_RETURN, &delegation->flags);
+- set_bit(NFS4CLNT_DELEGRETURN, &clp->cl_state);
++ set_bit(NFS4CLNT_DELEGRETURN, &server->nfs_client->cl_state);
+ }
+
+ /**
+@@ -441,7 +440,7 @@ static void nfs_mark_return_all_delegation_types(struct nfs_server *server,
+ if ((delegation->type == (FMODE_READ|FMODE_WRITE)) && !(flags & FMODE_WRITE))
+ continue;
+ if (delegation->type & flags)
+- nfs_mark_return_delegation(delegation);
++ nfs_mark_return_delegation(server, delegation);
+ }
+ }
+
+@@ -508,7 +507,7 @@ static void nfs_mark_return_unreferenced_delegations(struct nfs_server *server)
+ list_for_each_entry_rcu(delegation, &server->delegations, super_list) {
+ if (test_and_clear_bit(NFS_DELEGATION_REFERENCED, &delegation->flags))
+ continue;
+- nfs_mark_return_delegation(delegation);
++ nfs_mark_return_delegation(server, delegation);
+ }
+ }
+
+@@ -539,7 +538,8 @@ void nfs_expire_unreferenced_delegations(struct nfs_client *clp)
+ int nfs_async_inode_return_delegation(struct inode *inode,
+ const nfs4_stateid *stateid)
+ {
+- struct nfs_client *clp = NFS_SERVER(inode)->nfs_client;
++ struct nfs_server *server = NFS_SERVER(inode);
++ struct nfs_client *clp = server->nfs_client;
+ struct nfs_delegation *delegation;
+
+ rcu_read_lock();
+@@ -549,7 +549,7 @@ int nfs_async_inode_return_delegation(struct inode *inode,
+ rcu_read_unlock();
+ return -ENOENT;
+ }
+- nfs_mark_return_delegation(delegation);
++ nfs_mark_return_delegation(server, delegation);
+ rcu_read_unlock();
+
+ nfs_delegation_run_state_manager(clp);
+diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
+index ededdbd..f91c62d 100644
+--- a/fs/nfs/dir.c
++++ b/fs/nfs/dir.c
+@@ -134,18 +134,19 @@ const struct inode_operations nfs4_dir_inode_operations = {
+
+ #endif /* CONFIG_NFS_V4 */
+
+-static struct nfs_open_dir_context *alloc_nfs_open_dir_context(struct rpc_cred *cred)
++static struct nfs_open_dir_context *alloc_nfs_open_dir_context(struct inode *dir, struct rpc_cred *cred)
+ {
+ struct nfs_open_dir_context *ctx;
+ ctx = kmalloc(sizeof(*ctx), GFP_KERNEL);
+ if (ctx != NULL) {
+ ctx->duped = 0;
++ ctx->attr_gencount = NFS_I(dir)->attr_gencount;
+ ctx->dir_cookie = 0;
+ ctx->dup_cookie = 0;
+ ctx->cred = get_rpccred(cred);
+- } else
+- ctx = ERR_PTR(-ENOMEM);
+- return ctx;
++ return ctx;
++ }
++ return ERR_PTR(-ENOMEM);
+ }
+
+ static void put_nfs_open_dir_context(struct nfs_open_dir_context *ctx)
+@@ -173,7 +174,7 @@ nfs_opendir(struct inode *inode, struct file *filp)
+ cred = rpc_lookup_cred();
+ if (IS_ERR(cred))
+ return PTR_ERR(cred);
+- ctx = alloc_nfs_open_dir_context(cred);
++ ctx = alloc_nfs_open_dir_context(inode, cred);
+ if (IS_ERR(ctx)) {
+ res = PTR_ERR(ctx);
+ goto out;
+@@ -323,7 +324,6 @@ int nfs_readdir_search_for_pos(struct nfs_cache_array *array, nfs_readdir_descri
+ {
+ loff_t diff = desc->file->f_pos - desc->current_index;
+ unsigned int index;
+- struct nfs_open_dir_context *ctx = desc->file->private_data;
+
+ if (diff < 0)
+ goto out_eof;
+@@ -336,7 +336,6 @@ int nfs_readdir_search_for_pos(struct nfs_cache_array *array, nfs_readdir_descri
+ index = (unsigned int)diff;
+ *desc->dir_cookie = array->array[index].cookie;
+ desc->cache_entry_index = index;
+- ctx->duped = 0;
+ return 0;
+ out_eof:
+ desc->eof = 1;
+@@ -349,14 +348,33 @@ int nfs_readdir_search_for_cookie(struct nfs_cache_array *array, nfs_readdir_des
+ int i;
+ loff_t new_pos;
+ int status = -EAGAIN;
+- struct nfs_open_dir_context *ctx = desc->file->private_data;
+
+ for (i = 0; i < array->size; i++) {
+ if (array->array[i].cookie == *desc->dir_cookie) {
++ struct nfs_inode *nfsi = NFS_I(desc->file->f_path.dentry->d_inode);
++ struct nfs_open_dir_context *ctx = desc->file->private_data;
++
+ new_pos = desc->current_index + i;
+- if (new_pos < desc->file->f_pos) {
++ if (ctx->attr_gencount != nfsi->attr_gencount
++ || (nfsi->cache_validity & (NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA))) {
++ ctx->duped = 0;
++ ctx->attr_gencount = nfsi->attr_gencount;
++ } else if (new_pos < desc->file->f_pos) {
++ if (ctx->duped > 0
++ && ctx->dup_cookie == *desc->dir_cookie) {
++ if (printk_ratelimit()) {
++ pr_notice("NFS: directory %s/%s contains a readdir loop."
++ "Please contact your server vendor. "
++ "Offending cookie: %llu\n",
++ desc->file->f_dentry->d_parent->d_name.name,
++ desc->file->f_dentry->d_name.name,
++ *desc->dir_cookie);
++ }
++ status = -ELOOP;
++ goto out;
++ }
+ ctx->dup_cookie = *desc->dir_cookie;
+- ctx->duped = 1;
++ ctx->duped = -1;
+ }
+ desc->file->f_pos = new_pos;
+ desc->cache_entry_index = i;
+@@ -368,6 +386,7 @@ int nfs_readdir_search_for_cookie(struct nfs_cache_array *array, nfs_readdir_des
+ if (*desc->dir_cookie == array->last_cookie)
+ desc->eof = 1;
+ }
++out:
+ return status;
+ }
+
+@@ -740,19 +759,6 @@ int nfs_do_filldir(nfs_readdir_descriptor_t *desc, void *dirent,
+ struct nfs_cache_array *array = NULL;
+ struct nfs_open_dir_context *ctx = file->private_data;
+
+- if (ctx->duped != 0 && ctx->dup_cookie == *desc->dir_cookie) {
+- if (printk_ratelimit()) {
+- pr_notice("NFS: directory %s/%s contains a readdir loop. "
+- "Please contact your server vendor. "
+- "Offending cookie: %llu\n",
+- file->f_dentry->d_parent->d_name.name,
+- file->f_dentry->d_name.name,
+- *desc->dir_cookie);
+- }
+- res = -ELOOP;
+- goto out;
+- }
+-
+ array = nfs_readdir_get_array(desc->page);
+ if (IS_ERR(array)) {
+ res = PTR_ERR(array);
+@@ -774,6 +780,8 @@ int nfs_do_filldir(nfs_readdir_descriptor_t *desc, void *dirent,
+ *desc->dir_cookie = array->array[i+1].cookie;
+ else
+ *desc->dir_cookie = array->last_cookie;
++ if (ctx->duped != 0)
++ ctx->duped = 1;
+ }
+ if (array->eof_index >= 0)
+ desc->eof = 1;
+@@ -805,6 +813,7 @@ int uncached_readdir(nfs_readdir_descriptor_t *desc, void *dirent,
+ struct page *page = NULL;
+ int status;
+ struct inode *inode = desc->file->f_path.dentry->d_inode;
++ struct nfs_open_dir_context *ctx = desc->file->private_data;
+
+ dfprintk(DIRCACHE, "NFS: uncached_readdir() searching for cookie %Lu\n",
+ (unsigned long long)*desc->dir_cookie);
+@@ -818,6 +827,7 @@ int uncached_readdir(nfs_readdir_descriptor_t *desc, void *dirent,
+ desc->page_index = 0;
+ desc->last_cookie = *desc->dir_cookie;
+ desc->page = page;
++ ctx->duped = 0;
+
+ status = nfs_readdir_xdr_to_array(desc, page, inode);
+ if (status < 0)
+diff --git a/fs/nfs/nfs4filelayout.c b/fs/nfs/nfs4filelayout.c
+index f9d03ab..614c4d2 100644
+--- a/fs/nfs/nfs4filelayout.c
++++ b/fs/nfs/nfs4filelayout.c
+@@ -170,7 +170,7 @@ filelayout_set_layoutcommit(struct nfs_write_data *wdata)
+
+ pnfs_set_layoutcommit(wdata);
+ dprintk("%s ionde %lu pls_end_pos %lu\n", __func__, wdata->inode->i_ino,
+- (unsigned long) wdata->lseg->pls_end_pos);
++ (unsigned long) NFS_I(wdata->inode)->layout->plh_lwb);
+ }
+
+ /*
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 5879b23..92cfd2e 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -5850,9 +5850,15 @@ nfs4_layoutcommit_done(struct rpc_task *task, void *calldata)
+ static void nfs4_layoutcommit_release(void *calldata)
+ {
+ struct nfs4_layoutcommit_data *data = calldata;
++ struct pnfs_layout_segment *lseg, *tmp;
+
+ /* Matched by references in pnfs_set_layoutcommit */
+- put_lseg(data->lseg);
++ list_for_each_entry_safe(lseg, tmp, &data->lseg_list, pls_lc_list) {
++ list_del_init(&lseg->pls_lc_list);
++ if (test_and_clear_bit(NFS_LSEG_LAYOUTCOMMIT,
++ &lseg->pls_flags))
++ put_lseg(lseg);
++ }
+ put_rpccred(data->cred);
+ kfree(data);
+ }
+diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
+index e6e8f3b..fc97fd5 100644
+--- a/fs/nfs/nfs4xdr.c
++++ b/fs/nfs/nfs4xdr.c
+@@ -1888,7 +1888,7 @@ encode_layoutcommit(struct xdr_stream *xdr,
+ *p++ = cpu_to_be32(OP_LAYOUTCOMMIT);
+ /* Only whole file layouts */
+ p = xdr_encode_hyper(p, 0); /* offset */
+- p = xdr_encode_hyper(p, NFS4_MAX_UINT64); /* length */
++ p = xdr_encode_hyper(p, args->lastbytewritten + 1); /* length */
+ *p++ = cpu_to_be32(0); /* reclaim */
+ p = xdr_encode_opaque_fixed(p, args->stateid.data, NFS4_STATEID_SIZE);
+ *p++ = cpu_to_be32(1); /* newoffset = TRUE */
+diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
+index 29c0ca7..a726c0a 100644
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -189,6 +189,7 @@ static void
+ pnfs_free_layout_hdr(struct pnfs_layout_hdr *lo)
+ {
+ struct pnfs_layoutdriver_type *ld = NFS_SERVER(lo->plh_inode)->pnfs_curr_ld;
++ put_rpccred(lo->plh_lc_cred);
+ return ld->alloc_layout_hdr ? ld->free_layout_hdr(lo) : kfree(lo);
+ }
+
+@@ -223,6 +224,7 @@ static void
+ init_lseg(struct pnfs_layout_hdr *lo, struct pnfs_layout_segment *lseg)
+ {
+ INIT_LIST_HEAD(&lseg->pls_list);
++ INIT_LIST_HEAD(&lseg->pls_lc_list);
+ atomic_set(&lseg->pls_refcount, 1);
+ smp_mb();
+ set_bit(NFS_LSEG_VALID, &lseg->pls_flags);
+@@ -805,7 +807,9 @@ out:
+ }
+
+ static struct pnfs_layout_hdr *
+-alloc_init_layout_hdr(struct inode *ino, gfp_t gfp_flags)
++alloc_init_layout_hdr(struct inode *ino,
++ struct nfs_open_context *ctx,
++ gfp_t gfp_flags)
+ {
+ struct pnfs_layout_hdr *lo;
+
+@@ -817,11 +821,14 @@ alloc_init_layout_hdr(struct inode *ino, gfp_t gfp_flags)
+ INIT_LIST_HEAD(&lo->plh_segs);
+ INIT_LIST_HEAD(&lo->plh_bulk_recall);
+ lo->plh_inode = ino;
++ lo->plh_lc_cred = get_rpccred(ctx->state->owner->so_cred);
+ return lo;
+ }
+
+ static struct pnfs_layout_hdr *
+-pnfs_find_alloc_layout(struct inode *ino, gfp_t gfp_flags)
++pnfs_find_alloc_layout(struct inode *ino,
++ struct nfs_open_context *ctx,
++ gfp_t gfp_flags)
+ {
+ struct nfs_inode *nfsi = NFS_I(ino);
+ struct pnfs_layout_hdr *new = NULL;
+@@ -836,7 +843,7 @@ pnfs_find_alloc_layout(struct inode *ino, gfp_t gfp_flags)
+ return nfsi->layout;
+ }
+ spin_unlock(&ino->i_lock);
+- new = alloc_init_layout_hdr(ino, gfp_flags);
++ new = alloc_init_layout_hdr(ino, ctx, gfp_flags);
+ spin_lock(&ino->i_lock);
+
+ if (likely(nfsi->layout == NULL)) /* Won the race? */
+@@ -928,7 +935,7 @@ pnfs_update_layout(struct inode *ino,
+ if (!pnfs_enabled_sb(NFS_SERVER(ino)))
+ return NULL;
+ spin_lock(&ino->i_lock);
+- lo = pnfs_find_alloc_layout(ino, gfp_flags);
++ lo = pnfs_find_alloc_layout(ino, ctx, gfp_flags);
+ if (lo == NULL) {
+ dprintk("%s ERROR: can't get pnfs_layout_hdr\n", __func__);
+ goto out_unlock;
+@@ -1195,16 +1202,17 @@ pnfs_try_to_read_data(struct nfs_read_data *rdata,
+ }
+
+ /*
+- * Currently there is only one (whole file) write lseg.
++ * There can be multiple RW segments.
+ */
+-static struct pnfs_layout_segment *pnfs_list_write_lseg(struct inode *inode)
++static void pnfs_list_write_lseg(struct inode *inode, struct list_head *listp)
+ {
+- struct pnfs_layout_segment *lseg, *rv = NULL;
++ struct pnfs_layout_segment *lseg;
+
+- list_for_each_entry(lseg, &NFS_I(inode)->layout->plh_segs, pls_list)
+- if (lseg->pls_range.iomode == IOMODE_RW)
+- rv = lseg;
+- return rv;
++ list_for_each_entry(lseg, &NFS_I(inode)->layout->plh_segs, pls_list) {
++ if (lseg->pls_range.iomode == IOMODE_RW &&
++ test_bit(NFS_LSEG_LAYOUTCOMMIT, &lseg->pls_flags))
++ list_add(&lseg->pls_lc_list, listp);
++ }
+ }
+
+ void
+@@ -1216,17 +1224,19 @@ pnfs_set_layoutcommit(struct nfs_write_data *wdata)
+
+ spin_lock(&nfsi->vfs_inode.i_lock);
+ if (!test_and_set_bit(NFS_INO_LAYOUTCOMMIT, &nfsi->flags)) {
+- /* references matched in nfs4_layoutcommit_release */
+- get_lseg(wdata->lseg);
+- wdata->lseg->pls_lc_cred =
+- get_rpccred(wdata->args.context->state->owner->so_cred);
+ mark_as_dirty = true;
+ dprintk("%s: Set layoutcommit for inode %lu ",
+ __func__, wdata->inode->i_ino);
+ }
+- if (end_pos > wdata->lseg->pls_end_pos)
+- wdata->lseg->pls_end_pos = end_pos;
++ if (!test_and_set_bit(NFS_LSEG_LAYOUTCOMMIT, &wdata->lseg->pls_flags)) {
++ /* references matched in nfs4_layoutcommit_release */
++ get_lseg(wdata->lseg);
++ }
++ if (end_pos > nfsi->layout->plh_lwb)
++ nfsi->layout->plh_lwb = end_pos;
+ spin_unlock(&nfsi->vfs_inode.i_lock);
++ dprintk("%s: lseg %p end_pos %llu\n",
++ __func__, wdata->lseg, nfsi->layout->plh_lwb);
+
+ /* if pnfs_layoutcommit_inode() runs between inode locks, the next one
+ * will be a noop because NFS_INO_LAYOUTCOMMIT will not be set */
+@@ -1248,8 +1258,6 @@ pnfs_layoutcommit_inode(struct inode *inode, bool sync)
+ {
+ struct nfs4_layoutcommit_data *data;
+ struct nfs_inode *nfsi = NFS_I(inode);
+- struct pnfs_layout_segment *lseg;
+- struct rpc_cred *cred;
+ loff_t end_pos;
+ int status = 0;
+
+@@ -1266,30 +1274,25 @@ pnfs_layoutcommit_inode(struct inode *inode, bool sync)
+ goto out;
+ }
+
++ INIT_LIST_HEAD(&data->lseg_list);
+ spin_lock(&inode->i_lock);
+ if (!test_and_clear_bit(NFS_INO_LAYOUTCOMMIT, &nfsi->flags)) {
+ spin_unlock(&inode->i_lock);
+ kfree(data);
+ goto out;
+ }
+- /*
+- * Currently only one (whole file) write lseg which is referenced
+- * in pnfs_set_layoutcommit and will be found.
+- */
+- lseg = pnfs_list_write_lseg(inode);
+
+- end_pos = lseg->pls_end_pos;
+- cred = lseg->pls_lc_cred;
+- lseg->pls_end_pos = 0;
+- lseg->pls_lc_cred = NULL;
++ pnfs_list_write_lseg(inode, &data->lseg_list);
++
++ end_pos = nfsi->layout->plh_lwb;
++ nfsi->layout->plh_lwb = 0;
+
+ memcpy(&data->args.stateid.data, nfsi->layout->plh_stateid.data,
+ sizeof(nfsi->layout->plh_stateid.data));
+ spin_unlock(&inode->i_lock);
+
+ data->args.inode = inode;
+- data->lseg = lseg;
+- data->cred = cred;
++ data->cred = get_rpccred(nfsi->layout->plh_lc_cred);
+ nfs_fattr_init(&data->fattr);
+ data->args.bitmask = NFS_SERVER(inode)->cache_consistency_bitmask;
+ data->res.fattr = &data->fattr;
+diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h
+index 96bf4e6..9d147d9 100644
+--- a/fs/nfs/pnfs.h
++++ b/fs/nfs/pnfs.h
+@@ -36,16 +36,16 @@
+ enum {
+ NFS_LSEG_VALID = 0, /* cleared when lseg is recalled/returned */
+ NFS_LSEG_ROC, /* roc bit received from server */
++ NFS_LSEG_LAYOUTCOMMIT, /* layoutcommit bit set for layoutcommit */
+ };
+
+ struct pnfs_layout_segment {
+ struct list_head pls_list;
++ struct list_head pls_lc_list;
+ struct pnfs_layout_range pls_range;
+ atomic_t pls_refcount;
+ unsigned long pls_flags;
+ struct pnfs_layout_hdr *pls_layout;
+- struct rpc_cred *pls_lc_cred; /* LAYOUTCOMMIT credential */
+- loff_t pls_end_pos; /* LAYOUTCOMMIT write end */
+ };
+
+ enum pnfs_try_status {
+@@ -124,6 +124,8 @@ struct pnfs_layout_hdr {
+ unsigned long plh_block_lgets; /* block LAYOUTGET if >0 */
+ u32 plh_barrier; /* ignore lower seqids */
+ unsigned long plh_flags;
++ loff_t plh_lwb; /* last write byte for layoutcommit */
++ struct rpc_cred *plh_lc_cred; /* layoutcommit cred */
+ struct inode *plh_inode;
+ };
+
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index e98f3c2..3b8ad35 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -381,14 +381,6 @@ static int nfs4_access_to_omode(u32 access)
+ BUG();
+ }
+
+-static int nfs4_access_bmap_to_omode(struct nfs4_stateid *stp)
+-{
+- unsigned int access;
+-
+- set_access(&access, stp->st_access_bmap);
+- return nfs4_access_to_omode(access);
+-}
+-
+ static void unhash_generic_stateid(struct nfs4_stateid *stp)
+ {
+ list_del(&stp->st_hash);
+@@ -398,11 +390,14 @@ static void unhash_generic_stateid(struct nfs4_stateid *stp)
+
+ static void free_generic_stateid(struct nfs4_stateid *stp)
+ {
+- int oflag;
++ int i;
+
+ if (stp->st_access_bmap) {
+- oflag = nfs4_access_bmap_to_omode(stp);
+- nfs4_file_put_access(stp->st_file, oflag);
++ for (i = 1; i < 4; i++) {
++ if (test_bit(i, &stp->st_access_bmap))
++ nfs4_file_put_access(stp->st_file,
++ nfs4_access_to_omode(i));
++ }
+ }
+ put_nfs4_file(stp->st_file);
+ kmem_cache_free(stateid_slab, stp);
+@@ -2337,15 +2332,6 @@ out:
+ return ret;
+ }
+
+-static inline void
+-nfs4_file_downgrade(struct nfs4_file *fp, unsigned int share_access)
+-{
+- if (share_access & NFS4_SHARE_ACCESS_WRITE)
+- nfs4_file_put_access(fp, O_WRONLY);
+- if (share_access & NFS4_SHARE_ACCESS_READ)
+- nfs4_file_put_access(fp, O_RDONLY);
+-}
+-
+ static void nfsd_break_one_deleg(struct nfs4_delegation *dp)
+ {
+ /* We're assuming the state code never drops its reference
+@@ -2556,12 +2542,18 @@ static inline int nfs4_access_to_access(u32 nfs4_access)
+ return flags;
+ }
+
+-static __be32 nfs4_get_vfs_file(struct svc_rqst *rqstp, struct nfs4_file
+-*fp, struct svc_fh *cur_fh, u32 nfs4_access)
++static __be32 nfs4_get_vfs_file(struct svc_rqst *rqstp, struct nfs4_file *fp,
++ struct svc_fh *cur_fh, struct nfsd4_open *open)
+ {
+ __be32 status;
+- int oflag = nfs4_access_to_omode(nfs4_access);
+- int access = nfs4_access_to_access(nfs4_access);
++ int oflag = nfs4_access_to_omode(open->op_share_access);
++ int access = nfs4_access_to_access(open->op_share_access);
++
++ /* CLAIM_DELEGATE_CUR is used in response to a broken lease;
++ * allowing it to break the lease and return EAGAIN leaves the
++ * client unable to make progress in returning the delegation */
++ if (open->op_claim_type == NFS4_OPEN_CLAIM_DELEGATE_CUR)
++ access |= NFSD_MAY_NOT_BREAK_LEASE;
+
+ if (!fp->fi_fds[oflag]) {
+ status = nfsd_open(rqstp, cur_fh, S_IFREG, access,
+@@ -2586,7 +2578,7 @@ nfs4_new_open(struct svc_rqst *rqstp, struct nfs4_stateid **stpp,
+ if (stp == NULL)
+ return nfserr_resource;
+
+- status = nfs4_get_vfs_file(rqstp, fp, cur_fh, open->op_share_access);
++ status = nfs4_get_vfs_file(rqstp, fp, cur_fh, open);
+ if (status) {
+ kmem_cache_free(stateid_slab, stp);
+ return status;
+@@ -2619,14 +2611,14 @@ nfs4_upgrade_open(struct svc_rqst *rqstp, struct nfs4_file *fp, struct svc_fh *c
+
+ new_access = !test_bit(op_share_access, &stp->st_access_bmap);
+ if (new_access) {
+- status = nfs4_get_vfs_file(rqstp, fp, cur_fh, op_share_access);
++ status = nfs4_get_vfs_file(rqstp, fp, cur_fh, open);
+ if (status)
+ return status;
+ }
+ status = nfsd4_truncate(rqstp, cur_fh, open);
+ if (status) {
+ if (new_access) {
+- int oflag = nfs4_access_to_omode(new_access);
++ int oflag = nfs4_access_to_omode(op_share_access);
+ nfs4_file_put_access(fp, oflag);
+ }
+ return status;
+@@ -3384,18 +3376,15 @@ out:
+ return status;
+ }
+
+-
+-/*
+- * unset all bits in union bitmap (bmap) that
+- * do not exist in share (from successful OPEN_DOWNGRADE)
+- */
+-static void
+-reset_union_bmap_access(unsigned long access, unsigned long *bmap)
++static inline void nfs4_file_downgrade(struct nfs4_stateid *stp, unsigned int to_access)
+ {
+ int i;
++
+ for (i = 1; i < 4; i++) {
+- if ((i & access) != i)
+- __clear_bit(i, bmap);
++ if (test_bit(i, &stp->st_access_bmap) && !(i & to_access)) {
++ nfs4_file_put_access(stp->st_file, i);
++ __clear_bit(i, &stp->st_access_bmap);
++ }
+ }
+ }
+
+@@ -3416,7 +3405,6 @@ nfsd4_open_downgrade(struct svc_rqst *rqstp,
+ {
+ __be32 status;
+ struct nfs4_stateid *stp;
+- unsigned int share_access;
+
+ dprintk("NFSD: nfsd4_open_downgrade on file %.*s\n",
+ (int)cstate->current_fh.fh_dentry->d_name.len,
+@@ -3445,10 +3433,8 @@ nfsd4_open_downgrade(struct svc_rqst *rqstp,
+ stp->st_deny_bmap, od->od_share_deny);
+ goto out;
+ }
+- set_access(&share_access, stp->st_access_bmap);
+- nfs4_file_downgrade(stp->st_file, share_access & ~od->od_share_access);
++ nfs4_file_downgrade(stp, od->od_share_access);
+
+- reset_union_bmap_access(od->od_share_access, &stp->st_access_bmap);
+ reset_union_bmap_deny(od->od_share_deny, &stp->st_deny_bmap);
+
+ update_stateid(&stp->st_stateid);
+diff --git a/fs/proc/base.c b/fs/proc/base.c
+index fc5bc27..5bff4c6 100644
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -2707,9 +2707,16 @@ static int do_io_accounting(struct task_struct *task, char *buffer, int whole)
+ {
+ struct task_io_accounting acct = task->ioac;
+ unsigned long flags;
++ int result;
+
+- if (!ptrace_may_access(task, PTRACE_MODE_READ))
+- return -EACCES;
++ result = mutex_lock_killable(&task->signal->cred_guard_mutex);
++ if (result)
++ return result;
++
++ if (!ptrace_may_access(task, PTRACE_MODE_READ)) {
++ result = -EACCES;
++ goto out_unlock;
++ }
+
+ if (whole && lock_task_sighand(task, &flags)) {
+ struct task_struct *t = task;
+@@ -2720,7 +2727,7 @@ static int do_io_accounting(struct task_struct *task, char *buffer, int whole)
+
+ unlock_task_sighand(task, &flags);
+ }
+- return sprintf(buffer,
++ result = sprintf(buffer,
+ "rchar: %llu\n"
+ "wchar: %llu\n"
+ "syscr: %llu\n"
+@@ -2735,6 +2742,9 @@ static int do_io_accounting(struct task_struct *task, char *buffer, int whole)
+ (unsigned long long)acct.read_bytes,
+ (unsigned long long)acct.write_bytes,
+ (unsigned long long)acct.cancelled_write_bytes);
++out_unlock:
++ mutex_unlock(&task->signal->cred_guard_mutex);
++ return result;
+ }
+
+ static int proc_tid_io_accounting(struct task_struct *task, char *buffer)
+diff --git a/include/linux/firewire-cdev.h b/include/linux/firewire-cdev.h
+index 4ff0988..55814aa 100644
+--- a/include/linux/firewire-cdev.h
++++ b/include/linux/firewire-cdev.h
+@@ -475,6 +475,9 @@ union fw_cdev_event {
+ * of the bus. This does not cause a bus reset to happen.
+ * @bus_reset_closure: Value of &closure in this and subsequent bus reset events
+ * @card: The index of the card this device belongs to
++ *
++ * As a side effect, reception of %FW_CDEV_EVENT_BUS_RESET events to be read(2)
++ * is started by this ioctl.
+ */
+ struct fw_cdev_get_info {
+ __u32 version;
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index 9670f71..1036614 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -985,6 +985,8 @@ int get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
+ int get_user_pages_fast(unsigned long start, int nr_pages, int write,
+ struct page **pages);
+ struct page *get_dump_page(unsigned long addr);
++extern int fixup_user_fault(struct task_struct *tsk, struct mm_struct *mm,
++ unsigned long address, unsigned int fault_flags);
+
+ extern int try_to_release_page(struct page * page, gfp_t gfp_mask);
+ extern void do_invalidatepage(struct page *page, unsigned long offset);
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index 9e19477..33b5968 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -1688,9 +1688,12 @@ static inline int skb_gro_header_hard(struct sk_buff *skb, unsigned int hlen)
+ static inline void *skb_gro_header_slow(struct sk_buff *skb, unsigned int hlen,
+ unsigned int offset)
+ {
++ if (!pskb_may_pull(skb, hlen))
++ return NULL;
++
+ NAPI_GRO_CB(skb)->frag0 = NULL;
+ NAPI_GRO_CB(skb)->frag0_len = 0;
+- return pskb_may_pull(skb, hlen) ? skb->data + offset : NULL;
++ return skb->data + offset;
+ }
+
+ static inline void *skb_gro_mac_header(struct sk_buff *skb)
+diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h
+index 1b93b9c..b522370 100644
+--- a/include/linux/nfs_fs.h
++++ b/include/linux/nfs_fs.h
+@@ -99,9 +99,10 @@ struct nfs_open_context {
+
+ struct nfs_open_dir_context {
+ struct rpc_cred *cred;
++ unsigned long attr_gencount;
+ __u64 dir_cookie;
+ __u64 dup_cookie;
+- int duped;
++ signed char duped;
+ };
+
+ /*
+diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
+index 00848d8..be2eba7 100644
+--- a/include/linux/nfs_xdr.h
++++ b/include/linux/nfs_xdr.h
+@@ -262,7 +262,7 @@ struct nfs4_layoutcommit_res {
+ struct nfs4_layoutcommit_data {
+ struct rpc_task task;
+ struct nfs_fattr fattr;
+- struct pnfs_layout_segment *lseg;
++ struct list_head lseg_list;
+ struct rpc_cred *cred;
+ struct nfs4_layoutcommit_args args;
+ struct nfs4_layoutcommit_res res;
+diff --git a/ipc/sem.c b/ipc/sem.c
+index 34193ed..e68a8f5 100644
+--- a/ipc/sem.c
++++ b/ipc/sem.c
+@@ -1456,15 +1456,24 @@ SYSCALL_DEFINE4(semtimedop, int, semid, struct sembuf __user *, tsops,
+ }
+
+ sma = sem_lock(ns, semid);
++
++ /*
++ * Wait until it's guaranteed that no wakeup_sem_queue_do() is ongoing.
++ */
++ error = get_queue_result(&queue);
++
++ /*
++ * Array removed? If yes, leave without sem_unlock().
++ */
+ if (IS_ERR(sma)) {
+ error = -EIDRM;
+ goto out_free;
+ }
+
+- error = get_queue_result(&queue);
+
+ /*
+- * If queue.status != -EINTR we are woken up by another process
++ * If queue.status != -EINTR we are woken up by another process.
++ * Leave without unlink_queue(), but with sem_unlock().
+ */
+
+ if (error != -EINTR) {
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 9efe710..32a6151 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -5016,11 +5016,8 @@ static int __perf_event_overflow(struct perf_event *event, int nmi,
+ if (events && atomic_dec_and_test(&event->event_limit)) {
+ ret = 1;
+ event->pending_kill = POLL_HUP;
+- if (nmi) {
+- event->pending_disable = 1;
+- irq_work_queue(&event->pending);
+- } else
+- perf_event_disable(event);
++ event->pending_disable = 1;
++ irq_work_queue(&event->pending);
+ }
+
+ if (event->overflow_handler)
+diff --git a/kernel/futex.c b/kernel/futex.c
+index fe28dc2..7a0a4ed 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -355,8 +355,8 @@ static int fault_in_user_writeable(u32 __user *uaddr)
+ int ret;
+
+ down_read(&mm->mmap_sem);
+- ret = get_user_pages(current, mm, (unsigned long)uaddr,
+- 1, 1, 0, NULL, NULL);
++ ret = fixup_user_fault(current, mm, (unsigned long)uaddr,
++ FAULT_FLAG_WRITE);
+ up_read(&mm->mmap_sem);
+
+ return ret < 0 ? ret : 0;
+diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
+index 229f859..f807407 100644
+--- a/kernel/trace/trace.h
++++ b/kernel/trace/trace.h
+@@ -677,6 +677,7 @@ struct event_subsystem {
+ struct dentry *entry;
+ struct event_filter *filter;
+ int nr_events;
++ int ref_count;
+ };
+
+ #define FILTER_PRED_INVALID ((unsigned short)-1)
+diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
+index 686ec39..3e2a7c9 100644
+--- a/kernel/trace/trace_events.c
++++ b/kernel/trace/trace_events.c
+@@ -244,6 +244,35 @@ static void ftrace_clear_events(void)
+ mutex_unlock(&event_mutex);
+ }
+
++static void __put_system(struct event_subsystem *system)
++{
++ struct event_filter *filter = system->filter;
++
++ WARN_ON_ONCE(system->ref_count == 0);
++ if (--system->ref_count)
++ return;
++
++ if (filter) {
++ kfree(filter->filter_string);
++ kfree(filter);
++ }
++ kfree(system->name);
++ kfree(system);
++}
++
++static void __get_system(struct event_subsystem *system)
++{
++ WARN_ON_ONCE(system->ref_count == 0);
++ system->ref_count++;
++}
++
++static void put_system(struct event_subsystem *system)
++{
++ mutex_lock(&event_mutex);
++ __put_system(system);
++ mutex_unlock(&event_mutex);
++}
++
+ /*
+ * __ftrace_set_clr_event(NULL, NULL, NULL, set) will set/unset all events.
+ */
+@@ -528,7 +557,7 @@ system_enable_read(struct file *filp, char __user *ubuf, size_t cnt,
+ loff_t *ppos)
+ {
+ const char set_to_char[4] = { '?', '0', '1', 'X' };
+- const char *system = filp->private_data;
++ struct event_subsystem *system = filp->private_data;
+ struct ftrace_event_call *call;
+ char buf[2];
+ int set = 0;
+@@ -539,7 +568,7 @@ system_enable_read(struct file *filp, char __user *ubuf, size_t cnt,
+ if (!call->name || !call->class || !call->class->reg)
+ continue;
+
+- if (system && strcmp(call->class->system, system) != 0)
++ if (system && strcmp(call->class->system, system->name) != 0)
+ continue;
+
+ /*
+@@ -569,7 +598,8 @@ static ssize_t
+ system_enable_write(struct file *filp, const char __user *ubuf, size_t cnt,
+ loff_t *ppos)
+ {
+- const char *system = filp->private_data;
++ struct event_subsystem *system = filp->private_data;
++ const char *name = NULL;
+ unsigned long val;
+ char buf[64];
+ ssize_t ret;
+@@ -593,7 +623,14 @@ system_enable_write(struct file *filp, const char __user *ubuf, size_t cnt,
+ if (val != 0 && val != 1)
+ return -EINVAL;
+
+- ret = __ftrace_set_clr_event(NULL, system, NULL, val);
++ /*
++ * Opening of "enable" adds a ref count to system,
++ * so the name is safe to use.
++ */
++ if (system)
++ name = system->name;
++
++ ret = __ftrace_set_clr_event(NULL, name, NULL, val);
+ if (ret)
+ goto out;
+
+@@ -826,6 +863,52 @@ event_filter_write(struct file *filp, const char __user *ubuf, size_t cnt,
+ return cnt;
+ }
+
++static LIST_HEAD(event_subsystems);
++
++static int subsystem_open(struct inode *inode, struct file *filp)
++{
++ struct event_subsystem *system = NULL;
++ int ret;
++
++ if (!inode->i_private)
++ goto skip_search;
++
++ /* Make sure the system still exists */
++ mutex_lock(&event_mutex);
++ list_for_each_entry(system, &event_subsystems, list) {
++ if (system == inode->i_private) {
++ /* Don't open systems with no events */
++ if (!system->nr_events) {
++ system = NULL;
++ break;
++ }
++ __get_system(system);
++ break;
++ }
++ }
++ mutex_unlock(&event_mutex);
++
++ if (system != inode->i_private)
++ return -ENODEV;
++
++ skip_search:
++ ret = tracing_open_generic(inode, filp);
++ if (ret < 0 && system)
++ put_system(system);
++
++ return ret;
++}
++
++static int subsystem_release(struct inode *inode, struct file *file)
++{
++ struct event_subsystem *system = inode->i_private;
++
++ if (system)
++ put_system(system);
++
++ return 0;
++}
++
+ static ssize_t
+ subsystem_filter_read(struct file *filp, char __user *ubuf, size_t cnt,
+ loff_t *ppos)
+@@ -963,17 +1046,19 @@ static const struct file_operations ftrace_event_filter_fops = {
+ };
+
+ static const struct file_operations ftrace_subsystem_filter_fops = {
+- .open = tracing_open_generic,
++ .open = subsystem_open,
+ .read = subsystem_filter_read,
+ .write = subsystem_filter_write,
+ .llseek = default_llseek,
++ .release = subsystem_release,
+ };
+
+ static const struct file_operations ftrace_system_enable_fops = {
+- .open = tracing_open_generic,
++ .open = subsystem_open,
+ .read = system_enable_read,
+ .write = system_enable_write,
+ .llseek = default_llseek,
++ .release = subsystem_release,
+ };
+
+ static const struct file_operations ftrace_show_header_fops = {
+@@ -1002,8 +1087,6 @@ static struct dentry *event_trace_events_dir(void)
+ return d_events;
+ }
+
+-static LIST_HEAD(event_subsystems);
+-
+ static struct dentry *
+ event_subsystem_dir(const char *name, struct dentry *d_events)
+ {
+@@ -1013,6 +1096,7 @@ event_subsystem_dir(const char *name, struct dentry *d_events)
+ /* First see if we did not already create this dir */
+ list_for_each_entry(system, &event_subsystems, list) {
+ if (strcmp(system->name, name) == 0) {
++ __get_system(system);
+ system->nr_events++;
+ return system->entry;
+ }
+@@ -1035,6 +1119,7 @@ event_subsystem_dir(const char *name, struct dentry *d_events)
+ }
+
+ system->nr_events = 1;
++ system->ref_count = 1;
+ system->name = kstrdup(name, GFP_KERNEL);
+ if (!system->name) {
+ debugfs_remove(system->entry);
+@@ -1062,8 +1147,7 @@ event_subsystem_dir(const char *name, struct dentry *d_events)
+ "'%s/filter' entry\n", name);
+ }
+
+- trace_create_file("enable", 0644, system->entry,
+- (void *)system->name,
++ trace_create_file("enable", 0644, system->entry, system,
+ &ftrace_system_enable_fops);
+
+ return system->entry;
+@@ -1184,16 +1268,9 @@ static void remove_subsystem_dir(const char *name)
+ list_for_each_entry(system, &event_subsystems, list) {
+ if (strcmp(system->name, name) == 0) {
+ if (!--system->nr_events) {
+- struct event_filter *filter = system->filter;
+-
+ debugfs_remove_recursive(system->entry);
+ list_del(&system->list);
+- if (filter) {
+- kfree(filter->filter_string);
+- kfree(filter);
+- }
+- kfree(system->name);
+- kfree(system);
++ __put_system(system);
+ }
+ break;
+ }
+diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
+index 8008ddc..256764e 100644
+--- a/kernel/trace/trace_events_filter.c
++++ b/kernel/trace/trace_events_filter.c
+@@ -1886,6 +1886,12 @@ int apply_subsystem_event_filter(struct event_subsystem *system,
+
+ mutex_lock(&event_mutex);
+
++ /* Make sure the system still has events */
++ if (!system->nr_events) {
++ err = -ENODEV;
++ goto out_unlock;
++ }
++
+ if (!strcmp(strstrip(filter_string), "0")) {
+ filter_free_subsystem_preds(system);
+ remove_filter_string(system->filter);
+diff --git a/lib/xz/xz_private.h b/lib/xz/xz_private.h
+index a65633e..482b90f 100644
+--- a/lib/xz/xz_private.h
++++ b/lib/xz/xz_private.h
+@@ -12,7 +12,7 @@
+
+ #ifdef __KERNEL__
+ # include <linux/xz.h>
+-# include <asm/byteorder.h>
++# include <linux/kernel.h>
+ # include <asm/unaligned.h>
+ /* XZ_PREBOOT may be defined only via decompress_unxz.c. */
+ # ifndef XZ_PREBOOT
+diff --git a/mm/backing-dev.c b/mm/backing-dev.c
+index f032e6e..e56fe35 100644
+--- a/mm/backing-dev.c
++++ b/mm/backing-dev.c
+@@ -606,6 +606,7 @@ static void bdi_prune_sb(struct backing_dev_info *bdi)
+ void bdi_unregister(struct backing_dev_info *bdi)
+ {
+ if (bdi->dev) {
++ bdi_set_min_ratio(bdi, 0);
+ trace_writeback_bdi_unregister(bdi);
+ bdi_prune_sb(bdi);
+ del_timer_sync(&bdi->wb.wakeup_timer);
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index e013b8e..59ac5d6 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -1730,7 +1730,7 @@ static int mem_cgroup_hierarchical_reclaim(struct mem_cgroup *root_mem,
+ excess = res_counter_soft_limit_excess(&root_mem->res) >> PAGE_SHIFT;
+
+ /* If memsw_is_minimum==1, swap-out is of-no-use. */
+- if (!check_soft && root_mem->memsw_is_minimum)
++ if (!check_soft && !shrink && root_mem->memsw_is_minimum)
+ noswap = true;
+
+ while (1) {
+diff --git a/mm/memory.c b/mm/memory.c
+index 9b8a01d..d961e19 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -1816,7 +1816,63 @@ next_page:
+ }
+ EXPORT_SYMBOL(__get_user_pages);
+
+-/**
++/*
++ * fixup_user_fault() - manually resolve a user page fault
++ * @tsk: the task_struct to use for page fault accounting, or
++ * NULL if faults are not to be recorded.
++ * @mm: mm_struct of target mm
++ * @address: user address
++ * @fault_flags:flags to pass down to handle_mm_fault()
++ *
++ * This is meant to be called in the specific scenario where for locking reasons
++ * we try to access user memory in atomic context (within a pagefault_disable()
++ * section), this returns -EFAULT, and we want to resolve the user fault before
++ * trying again.
++ *
++ * Typically this is meant to be used by the futex code.
++ *
++ * The main difference with get_user_pages() is that this function will
++ * unconditionally call handle_mm_fault() which will in turn perform all the
++ * necessary SW fixup of the dirty and young bits in the PTE, while
++ * handle_mm_fault() only guarantees to update these in the struct page.
++ *
++ * This is important for some architectures where those bits also gate the
++ * access permission to the page because they are maintained in software. On
++ * such architectures, gup() will not be enough to make a subsequent access
++ * succeed.
++ *
++ * This should be called with the mm_sem held for read.
++ */
++int fixup_user_fault(struct task_struct *tsk, struct mm_struct *mm,
++ unsigned long address, unsigned int fault_flags)
++{
++ struct vm_area_struct *vma;
++ int ret;
++
++ vma = find_extend_vma(mm, address);
++ if (!vma || address < vma->vm_start)
++ return -EFAULT;
++
++ ret = handle_mm_fault(mm, vma, address, fault_flags);
++ if (ret & VM_FAULT_ERROR) {
++ if (ret & VM_FAULT_OOM)
++ return -ENOMEM;
++ if (ret & (VM_FAULT_HWPOISON | VM_FAULT_HWPOISON_LARGE))
++ return -EHWPOISON;
++ if (ret & VM_FAULT_SIGBUS)
++ return -EFAULT;
++ BUG();
++ }
++ if (tsk) {
++ if (ret & VM_FAULT_MAJOR)
++ tsk->maj_flt++;
++ else
++ tsk->min_flt++;
++ }
++ return 0;
++}
++
++/*
+ * get_user_pages() - pin user pages in memory
+ * @tsk: the task_struct to use for page fault accounting, or
+ * NULL if faults are not to be recorded.
+diff --git a/mm/oom_kill.c b/mm/oom_kill.c
+index e4b0991..8093fc7 100644
+--- a/mm/oom_kill.c
++++ b/mm/oom_kill.c
+@@ -303,7 +303,7 @@ static struct task_struct *select_bad_process(unsigned int *ppoints,
+ do_each_thread(g, p) {
+ unsigned int points;
+
+- if (!p->mm)
++ if (p->exit_state)
+ continue;
+ if (oom_unkillable_task(p, mem, nodemask))
+ continue;
+@@ -319,6 +319,8 @@ static struct task_struct *select_bad_process(unsigned int *ppoints,
+ */
+ if (test_tsk_thread_flag(p, TIF_MEMDIE))
+ return ERR_PTR(-1UL);
++ if (!p->mm)
++ continue;
+
+ if (p->flags & PF_EXITING) {
+ /*
+diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
+index 54578f2..78cc364 100644
+--- a/net/bridge/br_private.h
++++ b/net/bridge/br_private.h
+@@ -124,6 +124,7 @@ struct net_bridge_port
+ bridge_id designated_bridge;
+ u32 path_cost;
+ u32 designated_cost;
++ unsigned long designated_age;
+
+ struct timer_list forward_delay_timer;
+ struct timer_list hold_timer;
+diff --git a/net/bridge/br_stp.c b/net/bridge/br_stp.c
+index bb4383e..fcff622 100644
+--- a/net/bridge/br_stp.c
++++ b/net/bridge/br_stp.c
+@@ -164,8 +164,7 @@ void br_transmit_config(struct net_bridge_port *p)
+ else {
+ struct net_bridge_port *root
+ = br_get_port(br, br->root_port);
+- bpdu.message_age = br->max_age
+- - (root->message_age_timer.expires - jiffies)
++ bpdu.message_age = (jiffies - root->designated_age)
+ + MESSAGE_AGE_INCR;
+ }
+ bpdu.max_age = br->max_age;
+@@ -189,6 +188,7 @@ static inline void br_record_config_information(struct net_bridge_port *p,
+ p->designated_cost = bpdu->root_path_cost;
+ p->designated_bridge = bpdu->bridge_id;
+ p->designated_port = bpdu->port_id;
++ p->designated_age = jiffies + bpdu->message_age;
+
+ mod_timer(&p->message_age_timer, jiffies
+ + (p->br->max_age - bpdu->message_age));
+diff --git a/net/core/ethtool.c b/net/core/ethtool.c
+index fd14116..4fb7704 100644
+--- a/net/core/ethtool.c
++++ b/net/core/ethtool.c
+@@ -1227,7 +1227,7 @@ static int ethtool_get_regs(struct net_device *dev, char __user *useraddr)
+ regs.len = reglen;
+
+ regbuf = vzalloc(reglen);
+- if (!regbuf)
++ if (reglen && !regbuf)
+ return -ENOMEM;
+
+ ops->get_regs(dev, ®s, regbuf);
+@@ -1236,7 +1236,7 @@ static int ethtool_get_regs(struct net_device *dev, char __user *useraddr)
+ if (copy_to_user(useraddr, ®s, sizeof(regs)))
+ goto out;
+ useraddr += offsetof(struct ethtool_regs, data);
+- if (copy_to_user(useraddr, regbuf, regs.len))
++ if (regbuf && copy_to_user(useraddr, regbuf, regs.len))
+ goto out;
+ ret = 0;
+
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index d595265..7a334fd 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -2200,6 +2200,9 @@ void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
+ {
+ struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+
++ if (!ifmgd->associated)
++ return;
++
+ if (test_and_clear_bit(TMR_RUNNING_TIMER, &ifmgd->timers_running))
+ add_timer(&ifmgd->timer);
+ if (test_and_clear_bit(TMR_RUNNING_CHANSW, &ifmgd->timers_running))
+diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
+index ab86b79..bd31208 100644
+--- a/net/sunrpc/svc_xprt.c
++++ b/net/sunrpc/svc_xprt.c
+@@ -902,12 +902,13 @@ void svc_delete_xprt(struct svc_xprt *xprt)
+ if (!test_and_set_bit(XPT_DETACHED, &xprt->xpt_flags))
+ list_del_init(&xprt->xpt_list);
+ /*
+- * We used to delete the transport from whichever list
+- * it's sk_xprt.xpt_ready node was on, but we don't actually
+- * need to. This is because the only time we're called
+- * while still attached to a queue, the queue itself
+- * is about to be destroyed (in svc_destroy).
++ * The only time we're called while xpt_ready is still on a list
++ * is while the list itself is about to be destroyed (in
++ * svc_destroy). BUT svc_xprt_enqueue could still be attempting
++ * to add new entries to the sp_sockets list, so we can't leave
++ * a freed xprt on it.
+ */
++ list_del_init(&xprt->xpt_ready);
+ if (test_bit(XPT_TEMP, &xprt->xpt_flags))
+ serv->sv_tmpcnt--;
+ spin_unlock_bh(&serv->sv_lock);
+diff --git a/net/wireless/reg.c b/net/wireless/reg.c
+index 1ad0f39..4453eb7 100644
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -1125,12 +1125,13 @@ void wiphy_update_regulatory(struct wiphy *wiphy,
+ enum ieee80211_band band;
+
+ if (ignore_reg_update(wiphy, initiator))
+- goto out;
++ return;
++
+ for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+ if (wiphy->bands[band])
+ handle_band(wiphy, band, initiator);
+ }
+-out:
++
+ reg_process_beacons(wiphy);
+ reg_process_ht_flags(wiphy);
+ if (wiphy->reg_notifier)
+diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
+index c825c6e..78adc43 100644
+--- a/security/apparmor/domain.c
++++ b/security/apparmor/domain.c
+@@ -73,7 +73,6 @@ static int may_change_ptraced_domain(struct task_struct *task,
+ cred = get_task_cred(tracer);
+ tracerp = aa_cred_profile(cred);
+ }
+- rcu_read_unlock();
+
+ /* not ptraced */
+ if (!tracer || unconfined(tracerp))
+@@ -82,6 +81,7 @@ static int may_change_ptraced_domain(struct task_struct *task,
+ error = aa_may_ptrace(tracer, tracerp, to_profile, PTRACE_MODE_ATTACH);
+
+ out:
++ rcu_read_unlock();
+ if (cred)
+ put_cred(cred);
+
+diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
+index 3d2fd14..3783202 100644
+--- a/security/apparmor/lsm.c
++++ b/security/apparmor/lsm.c
+@@ -127,7 +127,7 @@ static int apparmor_capget(struct task_struct *target, kernel_cap_t *effective,
+ *inheritable = cred->cap_inheritable;
+ *permitted = cred->cap_permitted;
+
+- if (!unconfined(profile)) {
++ if (!unconfined(profile) && !COMPLAIN_MODE(profile)) {
+ *effective = cap_intersect(*effective, profile->caps.allow);
+ *permitted = cap_intersect(*permitted, profile->caps.allow);
+ }
+diff --git a/sound/core/pcm_compat.c b/sound/core/pcm_compat.c
+index 5fb2e28..91cdf94 100644
+--- a/sound/core/pcm_compat.c
++++ b/sound/core/pcm_compat.c
+@@ -342,7 +342,7 @@ static int snd_pcm_ioctl_xfern_compat(struct snd_pcm_substream *substream,
+ kfree(bufs);
+ return -EFAULT;
+ }
+- bufs[ch] = compat_ptr(ptr);
++ bufs[i] = compat_ptr(ptr);
+ bufptr++;
+ }
+ if (dir == SNDRV_PCM_STREAM_PLAYBACK)
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index b48fb43..524ff26 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -1578,13 +1578,15 @@ static void alc_init_auto_hp(struct hda_codec *codec)
+ if (present == 3)
+ spec->automute_hp_lo = 1; /* both HP and LO automute */
+
+- if (!cfg->speaker_pins[0]) {
++ if (!cfg->speaker_pins[0] &&
++ cfg->line_out_type == AUTO_PIN_SPEAKER_OUT) {
+ memcpy(cfg->speaker_pins, cfg->line_out_pins,
+ sizeof(cfg->speaker_pins));
+ cfg->speaker_outs = cfg->line_outs;
+ }
+
+- if (!cfg->hp_pins[0]) {
++ if (!cfg->hp_pins[0] &&
++ cfg->line_out_type == AUTO_PIN_HP_OUT) {
+ memcpy(cfg->hp_pins, cfg->line_out_pins,
+ sizeof(cfg->hp_pins));
+ cfg->hp_outs = cfg->line_outs;
+@@ -1603,6 +1605,7 @@ static void alc_init_auto_hp(struct hda_codec *codec)
+ spec->automute_mode = ALC_AUTOMUTE_PIN;
+ }
+ if (spec->automute && cfg->line_out_pins[0] &&
++ cfg->speaker_pins[0] &&
+ cfg->line_out_pins[0] != cfg->hp_pins[0] &&
+ cfg->line_out_pins[0] != cfg->speaker_pins[0]) {
+ for (i = 0; i < cfg->line_outs; i++) {
+diff --git a/sound/pci/oxygen/xonar_pcm179x.c b/sound/pci/oxygen/xonar_pcm179x.c
+index 54cad38..32d096c 100644
+--- a/sound/pci/oxygen/xonar_pcm179x.c
++++ b/sound/pci/oxygen/xonar_pcm179x.c
+@@ -327,8 +327,10 @@ static void pcm1796_init(struct oxygen *chip)
+ {
+ struct xonar_pcm179x *data = chip->model_data;
+
+- data->pcm1796_regs[0][18 - PCM1796_REG_BASE] = PCM1796_MUTE |
++ data->pcm1796_regs[0][18 - PCM1796_REG_BASE] =
+ PCM1796_DMF_DISABLED | PCM1796_FMT_24_I2S | PCM1796_ATLD;
++ if (!data->broken_i2c)
++ data->pcm1796_regs[0][18 - PCM1796_REG_BASE] |= PCM1796_MUTE;
+ data->pcm1796_regs[0][19 - PCM1796_REG_BASE] =
+ PCM1796_FLT_SHARP | PCM1796_ATS_1;
+ data->pcm1796_regs[0][20 - PCM1796_REG_BASE] =
+@@ -1123,6 +1125,7 @@ int __devinit get_xonar_pcm179x_model(struct oxygen *chip,
+ chip->model.control_filter = xonar_st_h6_control_filter;
+ chip->model.dac_channels_pcm = 8;
+ chip->model.dac_channels_mixer = 8;
++ chip->model.dac_volume_min = 255;
+ chip->model.dac_mclks = OXYGEN_MCLKS(256, 128, 128);
+ break;
+ }
+diff --git a/sound/soc/davinci/davinci-vcif.c b/sound/soc/davinci/davinci-vcif.c
+index 9259f1f..1f11525 100644
+--- a/sound/soc/davinci/davinci-vcif.c
++++ b/sound/soc/davinci/davinci-vcif.c
+@@ -62,9 +62,9 @@ static void davinci_vcif_start(struct snd_pcm_substream *substream)
+ w = readl(davinci_vc->base + DAVINCI_VC_CTRL);
+
+ if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
+- MOD_REG_BIT(w, DAVINCI_VC_CTRL_RSTDAC, 1);
++ MOD_REG_BIT(w, DAVINCI_VC_CTRL_RSTDAC, 0);
+ else
+- MOD_REG_BIT(w, DAVINCI_VC_CTRL_RSTADC, 1);
++ MOD_REG_BIT(w, DAVINCI_VC_CTRL_RSTADC, 0);
+
+ writel(w, davinci_vc->base + DAVINCI_VC_CTRL);
+ }
+@@ -80,9 +80,9 @@ static void davinci_vcif_stop(struct snd_pcm_substream *substream)
+ /* Reset transmitter/receiver and sample rate/frame sync generators */
+ w = readl(davinci_vc->base + DAVINCI_VC_CTRL);
+ if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
+- MOD_REG_BIT(w, DAVINCI_VC_CTRL_RSTDAC, 0);
++ MOD_REG_BIT(w, DAVINCI_VC_CTRL_RSTDAC, 1);
+ else
+- MOD_REG_BIT(w, DAVINCI_VC_CTRL_RSTADC, 0);
++ MOD_REG_BIT(w, DAVINCI_VC_CTRL_RSTADC, 1);
+
+ writel(w, davinci_vc->base + DAVINCI_VC_CTRL);
+ }
+@@ -159,6 +159,7 @@ static int davinci_vcif_trigger(struct snd_pcm_substream *substream, int cmd,
+ case SNDRV_PCM_TRIGGER_RESUME:
+ case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+ davinci_vcif_start(substream);
++ break;
+ case SNDRV_PCM_TRIGGER_STOP:
+ case SNDRV_PCM_TRIGGER_SUSPEND:
+ case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
+index b194be0..59abd84 100644
+--- a/sound/soc/soc-core.c
++++ b/sound/soc/soc-core.c
+@@ -1124,6 +1124,7 @@ int snd_soc_suspend(struct device *dev)
+ case SND_SOC_BIAS_OFF:
+ codec->driver->suspend(codec, PMSG_SUSPEND);
+ codec->suspended = 1;
++ codec->cache_sync = 1;
+ break;
+ default:
+ dev_dbg(codec->dev, "CODEC is on over suspend\n");
+diff --git a/tools/perf/Makefile b/tools/perf/Makefile
+index 940257b..c168366 100644
+--- a/tools/perf/Makefile
++++ b/tools/perf/Makefile
+@@ -52,7 +52,10 @@ ifeq ($(ARCH),i386)
+ endif
+ ifeq ($(ARCH),x86_64)
+ ARCH := x86
+- IS_X86_64 := $(shell echo __x86_64__ | ${CC} -E -xc - | tail -n 1)
++ IS_X86_64 := 0
++ ifeq (, $(findstring m32,$(EXTRA_CFLAGS)))
++ IS_X86_64 := $(shell echo __x86_64__ | ${CC} -E -xc - | tail -n 1)
++ endif
+ ifeq (${IS_X86_64}, 1)
+ RAW_ARCH := x86_64
+ ARCH_CFLAGS := -DARCH_X86_64
+diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
+index afb0849..cb2959a 100644
+--- a/tools/perf/util/header.c
++++ b/tools/perf/util/header.c
+@@ -877,9 +877,12 @@ int perf_session__read_header(struct perf_session *session, int fd)
+ struct perf_evsel *evsel;
+ off_t tmp;
+
+- if (perf_header__getbuffer64(header, fd, &f_attr, sizeof(f_attr)))
++ if (readn(fd, &f_attr, sizeof(f_attr)) <= 0)
+ goto out_errno;
+
++ if (header->needs_swap)
++ perf_event__attr_swap(&f_attr.attr);
++
+ tmp = lseek(fd, 0, SEEK_CUR);
+ evsel = perf_evsel__new(&f_attr.attr, i);
+
+diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
+index f5a8fbd..2dbf0ab 100644
+--- a/tools/perf/util/session.c
++++ b/tools/perf/util/session.c
+@@ -407,20 +407,26 @@ static void perf_event__read_swap(union perf_event *event)
+ event->read.id = bswap_64(event->read.id);
+ }
+
+-static void perf_event__attr_swap(union perf_event *event)
++/* exported for swapping attributes in file header */
++void perf_event__attr_swap(struct perf_event_attr *attr)
++{
++ attr->type = bswap_32(attr->type);
++ attr->size = bswap_32(attr->size);
++ attr->config = bswap_64(attr->config);
++ attr->sample_period = bswap_64(attr->sample_period);
++ attr->sample_type = bswap_64(attr->sample_type);
++ attr->read_format = bswap_64(attr->read_format);
++ attr->wakeup_events = bswap_32(attr->wakeup_events);
++ attr->bp_type = bswap_32(attr->bp_type);
++ attr->bp_addr = bswap_64(attr->bp_addr);
++ attr->bp_len = bswap_64(attr->bp_len);
++}
++
++static void perf_event__hdr_attr_swap(union perf_event *event)
+ {
+ size_t size;
+
+- event->attr.attr.type = bswap_32(event->attr.attr.type);
+- event->attr.attr.size = bswap_32(event->attr.attr.size);
+- event->attr.attr.config = bswap_64(event->attr.attr.config);
+- event->attr.attr.sample_period = bswap_64(event->attr.attr.sample_period);
+- event->attr.attr.sample_type = bswap_64(event->attr.attr.sample_type);
+- event->attr.attr.read_format = bswap_64(event->attr.attr.read_format);
+- event->attr.attr.wakeup_events = bswap_32(event->attr.attr.wakeup_events);
+- event->attr.attr.bp_type = bswap_32(event->attr.attr.bp_type);
+- event->attr.attr.bp_addr = bswap_64(event->attr.attr.bp_addr);
+- event->attr.attr.bp_len = bswap_64(event->attr.attr.bp_len);
++ perf_event__attr_swap(&event->attr.attr);
+
+ size = event->header.size;
+ size -= (void *)&event->attr.id - (void *)event;
+@@ -448,7 +454,7 @@ static perf_event__swap_op perf_event__swap_ops[] = {
+ [PERF_RECORD_LOST] = perf_event__all64_swap,
+ [PERF_RECORD_READ] = perf_event__read_swap,
+ [PERF_RECORD_SAMPLE] = perf_event__all64_swap,
+- [PERF_RECORD_HEADER_ATTR] = perf_event__attr_swap,
++ [PERF_RECORD_HEADER_ATTR] = perf_event__hdr_attr_swap,
+ [PERF_RECORD_HEADER_EVENT_TYPE] = perf_event__event_type_swap,
+ [PERF_RECORD_HEADER_TRACING_DATA] = perf_event__tracing_data_swap,
+ [PERF_RECORD_HEADER_BUILD_ID] = NULL,
+diff --git a/tools/perf/util/session.h b/tools/perf/util/session.h
+index 66d4e14..b84c003 100644
+--- a/tools/perf/util/session.h
++++ b/tools/perf/util/session.h
+@@ -112,6 +112,7 @@ int perf_session__set_kallsyms_ref_reloc_sym(struct map **maps,
+ u64 addr);
+
+ void mem_bswap_64(void *src, int byte_size);
++void perf_event__attr_swap(struct perf_event_attr *attr);
+
+ int perf_session__create_kernel_maps(struct perf_session *self);
+
Added: dists/trunk/linux-2.6/debian/patches/series/2
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/trunk/linux-2.6/debian/patches/series/2 Thu Aug 4 00:31:06 2011 (r17882)
@@ -0,0 +1,2 @@
+- features/all/rt2x00-Add-device-ID-for-RT539F-device.patch
++ bugfix/all/stable/3.0.1-rc1.patch
More information about the Kernel-svn-changes
mailing list