[kernel] r16936 - in dists/sid/linux-2.6/debian: . patches/bugfix/all patches/bugfix/all/stable patches/series
Ben Hutchings
benh at alioth.debian.org
Fri Feb 25 03:50:41 UTC 2011
Author: benh
Date: Fri Feb 25 03:50:38 2011
New Revision: 16936
Log:
Add stable 2.6.37.2
Remove changlog item for a change in 2.6.37.1 that this reverts.
Added:
dists/sid/linux-2.6/debian/patches/bugfix/all/stable/2.6.37.2.patch
Deleted:
dists/sid/linux-2.6/debian/patches/bugfix/all/btrfs-prevent-heap-corruption-in-btrfs_ioctl_space_i.patch
Modified:
dists/sid/linux-2.6/debian/changelog
dists/sid/linux-2.6/debian/patches/series/2
Modified: dists/sid/linux-2.6/debian/changelog
==============================================================================
--- dists/sid/linux-2.6/debian/changelog Fri Feb 25 03:34:23 2011 (r16935)
+++ dists/sid/linux-2.6/debian/changelog Fri Feb 25 03:50:38 2011 (r16936)
@@ -5,7 +5,6 @@
- libata: Set queue DMA alignment to sector size for ATAPI too
- USB: serial: add missing .usb_driver field in serial drivers
- USB: EHCI: fix scheduling while atomic during suspend
- - USB: Prevent buggy hubs from crashing the USB stack
- zram: Fix data corruption issue
- brcm80211: Fix suspend/resume issue
- ath9k: Fix system hang when resuming from S3/S4
@@ -31,8 +30,23 @@
mm_cpumask after switching mm
* Kbuild: Include localversion file in linux-headers-*; fixes output
of 'make kernelrelease'
- * btrfs: Prevent heap corruption in btrfs_ioctl_space_info()
- (CVE-2011-0699)
+ * Add stable 2.6.37.2:
+ - nfsd: Memory corruption due to writing beyond the stat array
+ - xen: p2m: Correctly initialize partial p2m leaf
+ - av7110: Check for negative array offset (CVE-2011-0521)
+ - cred: Fix kernel panic upon security_file_alloc() failure
+ - btrfs: Prevent heap corruption in btrfs_ioctl_space_info()
+ (CVE-2011-0699)
+ - cred: Fix BUG() upon security_cred_alloc_blank() failure
+ - cred: Fix memory and refcount leaks upon security_prepare_creds()
+ failure
+ - PCI: Use security_capable() when checking capablities during config
+ space read
+ - [s390] Remove task_show_regs (CVE-2011-0710)
+ - PM/hibernate: Return error code when alloc_image_page() fails
+ - fs/partitions: Validate map_count in Mac partition tables
+ - workqueue: Wake up a worker when a rescuer is leaving a gcwq
+ - ALSA: caiaq - Fix possible string-buffer overflow
-- Ben Hutchings <ben at decadent.org.uk> Fri, 18 Feb 2011 05:46:35 +0000
Added: dists/sid/linux-2.6/debian/patches/bugfix/all/stable/2.6.37.2.patch
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/sid/linux-2.6/debian/patches/bugfix/all/stable/2.6.37.2.patch Fri Feb 25 03:50:38 2011 (r16936)
@@ -0,0 +1,2338 @@
+diff --git a/Documentation/hwmon/jc42 b/Documentation/hwmon/jc42
+index 0e76ef1..a22ecf4 100644
+--- a/Documentation/hwmon/jc42
++++ b/Documentation/hwmon/jc42
+@@ -51,7 +51,8 @@ Supported chips:
+ * JEDEC JC 42.4 compliant temperature sensor chips
+ Prefix: 'jc42'
+ Addresses scanned: I2C 0x18 - 0x1f
+- Datasheet: -
++ Datasheet:
++ http://www.jedec.org/sites/default/files/docs/4_01_04R19.pdf
+
+ Author:
+ Guenter Roeck <guenter.roeck at ericsson.com>
+@@ -60,7 +61,11 @@ Author:
+ Description
+ -----------
+
+-This driver implements support for JEDEC JC 42.4 compliant temperature sensors.
++This driver implements support for JEDEC JC 42.4 compliant temperature sensors,
++which are used on many DDR3 memory modules for mobile devices and servers. Some
++systems use the sensor to prevent memory overheating by automatically throttling
++the memory controller.
++
+ The driver auto-detects the chips listed above, but can be manually instantiated
+ to support other JC 42.4 compliant chips.
+
+@@ -81,15 +86,19 @@ limits. The chip supports only a single register to configure the hysteresis,
+ which applies to all limits. This register can be written by writing into
+ temp1_crit_hyst. Other hysteresis attributes are read-only.
+
++If the BIOS has configured the sensor for automatic temperature management, it
++is likely that it has locked the registers, i.e., that the temperature limits
++cannot be changed.
++
+ Sysfs entries
+ -------------
+
+ temp1_input Temperature (RO)
+-temp1_min Minimum temperature (RW)
+-temp1_max Maximum temperature (RW)
+-temp1_crit Critical high temperature (RW)
++temp1_min Minimum temperature (RO or RW)
++temp1_max Maximum temperature (RO or RW)
++temp1_crit Critical high temperature (RO or RW)
+
+-temp1_crit_hyst Critical hysteresis temperature (RW)
++temp1_crit_hyst Critical hysteresis temperature (RO or RW)
+ temp1_max_hyst Maximum hysteresis temperature (RO)
+
+ temp1_min_alarm Temperature low alarm
+diff --git a/Documentation/hwmon/k10temp b/Documentation/hwmon/k10temp
+index 6526eee..d2b56a4 100644
+--- a/Documentation/hwmon/k10temp
++++ b/Documentation/hwmon/k10temp
+@@ -9,6 +9,8 @@ Supported chips:
+ Socket S1G3: Athlon II, Sempron, Turion II
+ * AMD Family 11h processors:
+ Socket S1G2: Athlon (X2), Sempron (X2), Turion X2 (Ultra)
++* AMD Family 12h processors: "Llano"
++* AMD Family 14h processors: "Brazos" (C/E/G-Series)
+
+ Prefix: 'k10temp'
+ Addresses scanned: PCI space
+@@ -17,10 +19,14 @@ Supported chips:
+ http://support.amd.com/us/Processor_TechDocs/31116.pdf
+ BIOS and Kernel Developer's Guide (BKDG) for AMD Family 11h Processors:
+ http://support.amd.com/us/Processor_TechDocs/41256.pdf
++ BIOS and Kernel Developer's Guide (BKDG) for AMD Family 14h Models 00h-0Fh Processors:
++ http://support.amd.com/us/Processor_TechDocs/43170.pdf
+ Revision Guide for AMD Family 10h Processors:
+ http://support.amd.com/us/Processor_TechDocs/41322.pdf
+ Revision Guide for AMD Family 11h Processors:
+ http://support.amd.com/us/Processor_TechDocs/41788.pdf
++ Revision Guide for AMD Family 14h Models 00h-0Fh Processors:
++ http://support.amd.com/us/Processor_TechDocs/47534.pdf
+ AMD Family 11h Processor Power and Thermal Data Sheet for Notebooks:
+ http://support.amd.com/us/Processor_TechDocs/43373.pdf
+ AMD Family 10h Server and Workstation Processor Power and Thermal Data Sheet:
+@@ -34,7 +40,7 @@ Description
+ -----------
+
+ This driver permits reading of the internal temperature sensor of AMD
+-Family 10h and 11h processors.
++Family 10h/11h/12h/14h processors.
+
+ All these processors have a sensor, but on those for Socket F or AM2+,
+ the sensor may return inconsistent values (erratum 319). The driver
+diff --git a/Makefile b/Makefile
+index 8096fed..b3cdfa5 100644
+diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c
+index 907d5a6..abaf844 100644
+--- a/arch/arm/kernel/signal.c
++++ b/arch/arm/kernel/signal.c
+@@ -474,7 +474,9 @@ setup_return(struct pt_regs *regs, struct k_sigaction *ka,
+ unsigned long handler = (unsigned long)ka->sa.sa_handler;
+ unsigned long retcode;
+ int thumb = 0;
+- unsigned long cpsr = regs->ARM_cpsr & ~PSR_f;
++ unsigned long cpsr = regs->ARM_cpsr & ~(PSR_f | PSR_E_BIT);
++
++ cpsr |= PSR_ENDSTATE;
+
+ /*
+ * Maybe we need to deliver a 32-bit signal to a 26-bit task.
+diff --git a/arch/arm/kernel/vmlinux.lds.S b/arch/arm/kernel/vmlinux.lds.S
+index cead889..223ba96 100644
+--- a/arch/arm/kernel/vmlinux.lds.S
++++ b/arch/arm/kernel/vmlinux.lds.S
+@@ -21,6 +21,12 @@
+ #define ARM_CPU_KEEP(x)
+ #endif
+
++#if defined(CONFIG_SMP_ON_UP) && !defined(CONFIG_DEBUG_SPINLOCK)
++#define ARM_EXIT_KEEP(x) x
++#else
++#define ARM_EXIT_KEEP(x)
++#endif
++
+ OUTPUT_ARCH(arm)
+ ENTRY(stext)
+
+@@ -43,6 +49,7 @@ SECTIONS
+ _sinittext = .;
+ HEAD_TEXT
+ INIT_TEXT
++ ARM_EXIT_KEEP(EXIT_TEXT)
+ _einittext = .;
+ ARM_CPU_DISCARD(PROC_INFO)
+ __arch_info_begin = .;
+@@ -67,6 +74,7 @@ SECTIONS
+ #ifndef CONFIG_XIP_KERNEL
+ __init_begin = _stext;
+ INIT_DATA
++ ARM_EXIT_KEEP(EXIT_DATA)
+ #endif
+ }
+
+@@ -161,6 +169,7 @@ SECTIONS
+ . = ALIGN(PAGE_SIZE);
+ __init_begin = .;
+ INIT_DATA
++ ARM_EXIT_KEEP(EXIT_DATA)
+ . = ALIGN(PAGE_SIZE);
+ __init_end = .;
+ #endif
+diff --git a/arch/arm/mach-sa1100/simpad.c b/arch/arm/mach-sa1100/simpad.c
+index 27692d0..cfb7607 100644
+--- a/arch/arm/mach-sa1100/simpad.c
++++ b/arch/arm/mach-sa1100/simpad.c
+@@ -166,9 +166,6 @@ static void __init simpad_map_io(void)
+ PCFR = 0;
+ PSDR = 0;
+
+- sa11x0_register_mtd(&simpad_flash_data, simpad_flash_resources,
+- ARRAY_SIZE(simpad_flash_resources));
+- sa11x0_register_mcp(&simpad_mcp_data);
+ }
+
+ static void simpad_power_off(void)
+@@ -216,6 +213,10 @@ static int __init simpad_init(void)
+
+ pm_power_off = simpad_power_off;
+
++ sa11x0_register_mtd(&simpad_flash_data, simpad_flash_resources,
++ ARRAY_SIZE(simpad_flash_resources));
++ sa11x0_register_mcp(&simpad_mcp_data);
++
+ ret = platform_add_devices(devices, ARRAY_SIZE(devices));
+ if(ret)
+ printk(KERN_WARNING "simpad: Unable to register mq200 framebuffer device");
+diff --git a/arch/s390/include/asm/processor.h b/arch/s390/include/asm/processor.h
+index 8d6f871..b7cbfab 100644
+--- a/arch/s390/include/asm/processor.h
++++ b/arch/s390/include/asm/processor.h
+@@ -148,11 +148,6 @@ extern int kernel_thread(int (*fn)(void *), void * arg, unsigned long flags);
+ */
+ extern unsigned long thread_saved_pc(struct task_struct *t);
+
+-/*
+- * Print register of task into buffer. Used in fs/proc/array.c.
+- */
+-extern void task_show_regs(struct seq_file *m, struct task_struct *task);
+-
+ extern void show_code(struct pt_regs *regs);
+
+ unsigned long get_wchan(struct task_struct *p);
+diff --git a/arch/s390/kernel/traps.c b/arch/s390/kernel/traps.c
+index 7064082..5aa4183 100644
+--- a/arch/s390/kernel/traps.c
++++ b/arch/s390/kernel/traps.c
+@@ -237,43 +237,6 @@ void show_regs(struct pt_regs *regs)
+ show_last_breaking_event(regs);
+ }
+
+-/* This is called from fs/proc/array.c */
+-void task_show_regs(struct seq_file *m, struct task_struct *task)
+-{
+- struct pt_regs *regs;
+-
+- regs = task_pt_regs(task);
+- seq_printf(m, "task: %p, ksp: %p\n",
+- task, (void *)task->thread.ksp);
+- seq_printf(m, "User PSW : %p %p\n",
+- (void *) regs->psw.mask, (void *)regs->psw.addr);
+-
+- seq_printf(m, "User GPRS: " FOURLONG,
+- regs->gprs[0], regs->gprs[1],
+- regs->gprs[2], regs->gprs[3]);
+- seq_printf(m, " " FOURLONG,
+- regs->gprs[4], regs->gprs[5],
+- regs->gprs[6], regs->gprs[7]);
+- seq_printf(m, " " FOURLONG,
+- regs->gprs[8], regs->gprs[9],
+- regs->gprs[10], regs->gprs[11]);
+- seq_printf(m, " " FOURLONG,
+- regs->gprs[12], regs->gprs[13],
+- regs->gprs[14], regs->gprs[15]);
+- seq_printf(m, "User ACRS: %08x %08x %08x %08x\n",
+- task->thread.acrs[0], task->thread.acrs[1],
+- task->thread.acrs[2], task->thread.acrs[3]);
+- seq_printf(m, " %08x %08x %08x %08x\n",
+- task->thread.acrs[4], task->thread.acrs[5],
+- task->thread.acrs[6], task->thread.acrs[7]);
+- seq_printf(m, " %08x %08x %08x %08x\n",
+- task->thread.acrs[8], task->thread.acrs[9],
+- task->thread.acrs[10], task->thread.acrs[11]);
+- seq_printf(m, " %08x %08x %08x %08x\n",
+- task->thread.acrs[12], task->thread.acrs[13],
+- task->thread.acrs[14], task->thread.acrs[15]);
+-}
+-
+ static DEFINE_SPINLOCK(die_lock);
+
+ void die(const char * str, struct pt_regs * regs, long err)
+diff --git a/arch/x86/include/asm/cpu.h b/arch/x86/include/asm/cpu.h
+index 4fab24d..4564c8e 100644
+--- a/arch/x86/include/asm/cpu.h
++++ b/arch/x86/include/asm/cpu.h
+@@ -32,5 +32,6 @@ extern void arch_unregister_cpu(int);
+
+ DECLARE_PER_CPU(int, cpu_state);
+
++int mwait_usable(const struct cpuinfo_x86 *);
+
+ #endif /* _ASM_X86_CPU_H */
+diff --git a/arch/x86/kernel/apb_timer.c b/arch/x86/kernel/apb_timer.c
+index 92543c7..5181673 100644
+--- a/arch/x86/kernel/apb_timer.c
++++ b/arch/x86/kernel/apb_timer.c
+@@ -313,10 +313,12 @@ static void apbt_setup_irq(struct apbt_dev *adev)
+ if (adev->irq == 0)
+ return;
+
++ irq_modify_status(adev->irq, 0, IRQ_MOVE_PCNTXT);
++ irq_set_affinity(adev->irq, cpumask_of(adev->cpu));
++ /* APB timer irqs are set up as mp_irqs, timer is edge type */
++ __set_irq_handler(adev->irq, handle_edge_irq, 0, "edge");
++
+ if (system_state == SYSTEM_BOOTING) {
+- irq_modify_status(adev->irq, 0, IRQ_MOVE_PCNTXT);
+- /* APB timer irqs are set up as mp_irqs, timer is edge type */
+- __set_irq_handler(adev->irq, handle_edge_irq, 0, "edge");
+ if (request_irq(adev->irq, apbt_interrupt_handler,
+ IRQF_TIMER | IRQF_DISABLED | IRQF_NOBALANCING,
+ adev->name, adev)) {
+diff --git a/arch/x86/kernel/irq_32.c b/arch/x86/kernel/irq_32.c
+index 96656f2..5206bb9 100644
+--- a/arch/x86/kernel/irq_32.c
++++ b/arch/x86/kernel/irq_32.c
+@@ -129,8 +129,7 @@ void __cpuinit irq_ctx_init(int cpu)
+ irqctx = page_address(alloc_pages_node(cpu_to_node(cpu),
+ THREAD_FLAGS,
+ THREAD_ORDER));
+- irqctx->tinfo.task = NULL;
+- irqctx->tinfo.exec_domain = NULL;
++ memset(&irqctx->tinfo, 0, sizeof(struct thread_info));
+ irqctx->tinfo.cpu = cpu;
+ irqctx->tinfo.preempt_count = HARDIRQ_OFFSET;
+ irqctx->tinfo.addr_limit = MAKE_MM_SEG(0);
+@@ -140,10 +139,8 @@ void __cpuinit irq_ctx_init(int cpu)
+ irqctx = page_address(alloc_pages_node(cpu_to_node(cpu),
+ THREAD_FLAGS,
+ THREAD_ORDER));
+- irqctx->tinfo.task = NULL;
+- irqctx->tinfo.exec_domain = NULL;
++ memset(&irqctx->tinfo, 0, sizeof(struct thread_info));
+ irqctx->tinfo.cpu = cpu;
+- irqctx->tinfo.preempt_count = 0;
+ irqctx->tinfo.addr_limit = MAKE_MM_SEG(0);
+
+ per_cpu(softirq_ctx, cpu) = irqctx;
+diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
+index 2502aaf..12d4bf1 100644
+--- a/arch/x86/kernel/process.c
++++ b/arch/x86/kernel/process.c
+@@ -14,6 +14,7 @@
+ #include <linux/utsname.h>
+ #include <trace/events/power.h>
+ #include <linux/hw_breakpoint.h>
++#include <asm/cpu.h>
+ #include <asm/system.h>
+ #include <asm/apic.h>
+ #include <asm/syscalls.h>
+@@ -509,13 +510,13 @@ static void poll_idle(void)
+ *
+ * idle=mwait overrides this decision and forces the usage of mwait.
+ */
+-static int __cpuinitdata force_mwait;
++static int force_mwait;
+
+ #define MWAIT_INFO 0x05
+ #define MWAIT_ECX_EXTENDED_INFO 0x01
+ #define MWAIT_EDX_C1 0xf0
+
+-static int __cpuinit mwait_usable(const struct cpuinfo_x86 *c)
++int mwait_usable(const struct cpuinfo_x86 *c)
+ {
+ u32 eax, ebx, ecx, edx;
+
+diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
+index 083e99d..d8fd571 100644
+--- a/arch/x86/kernel/smpboot.c
++++ b/arch/x86/kernel/smpboot.c
+@@ -1396,8 +1396,9 @@ static inline void mwait_play_dead(void)
+ unsigned int highest_subcstate = 0;
+ int i;
+ void *mwait_ptr;
++ struct cpuinfo_x86 *c = ¤t_cpu_data;
+
+- if (!cpu_has(¤t_cpu_data, X86_FEATURE_MWAIT))
++ if (!(cpu_has(c, X86_FEATURE_MWAIT) && mwait_usable(c)))
+ return;
+ if (!cpu_has(¤t_cpu_data, X86_FEATURE_CLFLSH))
+ return;
+diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
+index 44924e5..198df8d 100644
+--- a/arch/x86/xen/mmu.c
++++ b/arch/x86/xen/mmu.c
+@@ -395,6 +395,18 @@ void __init xen_build_dynamic_phys_to_machine(void)
+ p2m_top[topidx] = mid;
+ }
+
++ /*
++ * As long as the mfn_list has enough entries to completely
++ * fill a p2m page, pointing into the array is ok. But if
++ * not the entries beyond the last pfn will be undefined.
++ */
++ if (unlikely(pfn + P2M_PER_PAGE > max_pfn)) {
++ unsigned long p2midx;
++
++ p2midx = max_pfn % P2M_PER_PAGE;
++ for ( ; p2midx < P2M_PER_PAGE; p2midx++)
++ mfn_list[pfn + p2midx] = INVALID_P2M_ENTRY;
++ }
+ p2m_top[topidx][mididx] = &mfn_list[pfn];
+ }
+ }
+diff --git a/drivers/acpi/wakeup.c b/drivers/acpi/wakeup.c
+index f62a50c..3f3ab8f 100644
+--- a/drivers/acpi/wakeup.c
++++ b/drivers/acpi/wakeup.c
+@@ -84,8 +84,12 @@ int __init acpi_wakeup_device_init(void)
+ struct acpi_device *dev = container_of(node,
+ struct acpi_device,
+ wakeup_list);
+- if (dev->wakeup.flags.always_enabled)
++ if (dev->wakeup.flags.always_enabled) {
++ /* Button GPEs are supposed to be always enabled. */
++ acpi_enable_gpe(dev->wakeup.gpe_device,
++ dev->wakeup.gpe_number);
+ dev->wakeup.state.enabled = 1;
++ }
+ }
+ mutex_unlock(&acpi_device_lock);
+ return 0;
+diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
+index 55d0466..d5284bc 100644
+--- a/drivers/char/tpm/tpm.c
++++ b/drivers/char/tpm/tpm.c
+@@ -577,11 +577,9 @@ duration:
+ if (rc)
+ return;
+
+- if (be32_to_cpu(tpm_cmd.header.out.return_code) != 0 ||
+- be32_to_cpu(tpm_cmd.header.out.length)
+- != sizeof(tpm_cmd.header.out) + sizeof(u32) + 3 * sizeof(u32))
++ if (be32_to_cpu(tpm_cmd.header.out.return_code)
++ != 3 * sizeof(u32))
+ return;
+-
+ duration_cap = &tpm_cmd.params.getcap_out.cap.duration;
+ chip->vendor.duration[TPM_SHORT] =
+ usecs_to_jiffies(be32_to_cpu(duration_cap->tpm_short));
+@@ -925,18 +923,6 @@ ssize_t tpm_show_caps_1_2(struct device * dev,
+ }
+ EXPORT_SYMBOL_GPL(tpm_show_caps_1_2);
+
+-ssize_t tpm_show_timeouts(struct device *dev, struct device_attribute *attr,
+- char *buf)
+-{
+- struct tpm_chip *chip = dev_get_drvdata(dev);
+-
+- return sprintf(buf, "%d %d %d\n",
+- jiffies_to_usecs(chip->vendor.duration[TPM_SHORT]),
+- jiffies_to_usecs(chip->vendor.duration[TPM_MEDIUM]),
+- jiffies_to_usecs(chip->vendor.duration[TPM_LONG]));
+-}
+-EXPORT_SYMBOL_GPL(tpm_show_timeouts);
+-
+ ssize_t tpm_store_cancel(struct device *dev, struct device_attribute *attr,
+ const char *buf, size_t count)
+ {
+diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
+index ba1779c..792868d 100644
+--- a/drivers/char/tpm/tpm.h
++++ b/drivers/char/tpm/tpm.h
+@@ -56,8 +56,6 @@ extern ssize_t tpm_show_owned(struct device *, struct device_attribute *attr,
+ char *);
+ extern ssize_t tpm_show_temp_deactivated(struct device *,
+ struct device_attribute *attr, char *);
+-extern ssize_t tpm_show_timeouts(struct device *,
+- struct device_attribute *attr, char *);
+
+ struct tpm_chip;
+
+diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
+index 0d1d38e..dd21df5 100644
+--- a/drivers/char/tpm/tpm_tis.c
++++ b/drivers/char/tpm/tpm_tis.c
+@@ -376,7 +376,6 @@ static DEVICE_ATTR(temp_deactivated, S_IRUGO, tpm_show_temp_deactivated,
+ NULL);
+ static DEVICE_ATTR(caps, S_IRUGO, tpm_show_caps_1_2, NULL);
+ static DEVICE_ATTR(cancel, S_IWUSR | S_IWGRP, NULL, tpm_store_cancel);
+-static DEVICE_ATTR(timeouts, S_IRUGO, tpm_show_timeouts, NULL);
+
+ static struct attribute *tis_attrs[] = {
+ &dev_attr_pubek.attr,
+@@ -386,8 +385,7 @@ static struct attribute *tis_attrs[] = {
+ &dev_attr_owned.attr,
+ &dev_attr_temp_deactivated.attr,
+ &dev_attr_caps.attr,
+- &dev_attr_cancel.attr,
+- &dev_attr_timeouts.attr, NULL,
++ &dev_attr_cancel.attr, NULL,
+ };
+
+ static struct attribute_group tis_attr_grp = {
+diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
+index c1f13bf..5f08e2c 100644
+--- a/drivers/gpu/drm/i915/intel_dp.c
++++ b/drivers/gpu/drm/i915/intel_dp.c
+@@ -1343,17 +1343,24 @@ intel_dp_complete_link_train(struct intel_dp *intel_dp)
+ struct drm_device *dev = intel_dp->base.base.dev;
+ struct drm_i915_private *dev_priv = dev->dev_private;
+ bool channel_eq = false;
+- int tries;
++ int tries, cr_tries;
+ u32 reg;
+ uint32_t DP = intel_dp->DP;
+
+ /* channel equalization */
+ tries = 0;
++ cr_tries = 0;
+ channel_eq = false;
+ for (;;) {
+ /* Use intel_dp->train_set[0] to set the voltage and pre emphasis values */
+ uint32_t signal_levels;
+
++ if (cr_tries > 5) {
++ DRM_ERROR("failed to train DP, aborting\n");
++ intel_dp_link_down(intel_dp);
++ break;
++ }
++
+ if (IS_GEN6(dev) && is_edp(intel_dp)) {
+ signal_levels = intel_gen6_edp_signal_levels(intel_dp->train_set[0]);
+ DP = (DP & ~EDP_LINK_TRAIN_VOL_EMP_MASK_SNB) | signal_levels;
+@@ -1376,14 +1383,26 @@ intel_dp_complete_link_train(struct intel_dp *intel_dp)
+ if (!intel_dp_get_link_status(intel_dp))
+ break;
+
++ /* Make sure clock is still ok */
++ if (!intel_clock_recovery_ok(intel_dp->link_status, intel_dp->lane_count)) {
++ intel_dp_start_link_train(intel_dp);
++ cr_tries++;
++ continue;
++ }
++
+ if (intel_channel_eq_ok(intel_dp)) {
+ channel_eq = true;
+ break;
+ }
+
+- /* Try 5 times */
+- if (tries > 5)
+- break;
++ /* Try 5 times, then try clock recovery if that fails */
++ if (tries > 5) {
++ intel_dp_link_down(intel_dp);
++ intel_dp_start_link_train(intel_dp);
++ tries = 0;
++ cr_tries++;
++ continue;
++ }
+
+ /* Compute new intel_dp->train_set as requested by target */
+ intel_get_adjust_train(intel_dp);
+diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
+index 920ca27..c0de519 100644
+--- a/drivers/gpu/drm/i915/intel_sdvo.c
++++ b/drivers/gpu/drm/i915/intel_sdvo.c
+@@ -46,6 +46,7 @@
+ SDVO_TV_MASK)
+
+ #define IS_TV(c) (c->output_flag & SDVO_TV_MASK)
++#define IS_TMDS(c) (c->output_flag & SDVO_TMDS_MASK)
+ #define IS_LVDS(c) (c->output_flag & SDVO_LVDS_MASK)
+ #define IS_TV_OR_LVDS(c) (c->output_flag & (SDVO_TV_MASK | SDVO_LVDS_MASK))
+
+@@ -1356,7 +1357,8 @@ intel_sdvo_hdmi_sink_detect(struct drm_connector *connector)
+ intel_sdvo->has_hdmi_monitor = drm_detect_hdmi_monitor(edid);
+ intel_sdvo->has_hdmi_audio = drm_detect_monitor_audio(edid);
+ }
+- }
++ } else
++ status = connector_status_disconnected;
+ connector->display_info.raw_edid = NULL;
+ kfree(edid);
+ }
+@@ -1404,10 +1406,25 @@ intel_sdvo_detect(struct drm_connector *connector, bool force)
+
+ if ((intel_sdvo_connector->output_flag & response) == 0)
+ ret = connector_status_disconnected;
+- else if (response & SDVO_TMDS_MASK)
++ else if (IS_TMDS(intel_sdvo_connector))
+ ret = intel_sdvo_hdmi_sink_detect(connector);
+- else
+- ret = connector_status_connected;
++ else {
++ struct edid *edid;
++
++ /* if we have an edid check it matches the connection */
++ edid = intel_sdvo_get_edid(connector);
++ if (edid == NULL)
++ edid = intel_sdvo_get_analog_edid(connector);
++ if (edid != NULL) {
++ if (edid->input & DRM_EDID_INPUT_DIGITAL)
++ ret = connector_status_disconnected;
++ else
++ ret = connector_status_connected;
++ connector->display_info.raw_edid = NULL;
++ kfree(edid);
++ } else
++ ret = connector_status_connected;
++ }
+
+ /* May update encoder flag for like clock for SDVO TV, etc.*/
+ if (ret == connector_status_connected) {
+@@ -1443,10 +1460,15 @@ static void intel_sdvo_get_ddc_modes(struct drm_connector *connector)
+ edid = intel_sdvo_get_analog_edid(connector);
+
+ if (edid != NULL) {
+- if (edid->input & DRM_EDID_INPUT_DIGITAL) {
++ struct intel_sdvo_connector *intel_sdvo_connector = to_intel_sdvo_connector(connector);
++ bool monitor_is_digital = !!(edid->input & DRM_EDID_INPUT_DIGITAL);
++ bool connector_is_digital = !!IS_TMDS(intel_sdvo_connector);
++
++ if (connector_is_digital == monitor_is_digital) {
+ drm_mode_connector_update_edid_property(connector, edid);
+ drm_add_edid_modes(connector, edid);
+ }
++
+ connector->display_info.raw_edid = NULL;
+ kfree(edid);
+ }
+diff --git a/drivers/gpu/drm/nouveau/Kconfig b/drivers/gpu/drm/nouveau/Kconfig
+index 72730e9..21d6c29 100644
+--- a/drivers/gpu/drm/nouveau/Kconfig
++++ b/drivers/gpu/drm/nouveau/Kconfig
+@@ -10,7 +10,7 @@ config DRM_NOUVEAU
+ select FB
+ select FRAMEBUFFER_CONSOLE if !EMBEDDED
+ select FB_BACKLIGHT if DRM_NOUVEAU_BACKLIGHT
+- select ACPI_VIDEO if ACPI
++ select ACPI_VIDEO if ACPI && X86 && BACKLIGHT_CLASS_DEVICE && VIDEO_OUTPUT_CONTROL && INPUT
+ help
+ Choose this option for open-source nVidia support.
+
+diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
+index 6b7fc4b..ee14b8a 100644
+--- a/drivers/gpu/drm/radeon/atombios_crtc.c
++++ b/drivers/gpu/drm/radeon/atombios_crtc.c
+@@ -514,7 +514,6 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
+ pll->flags |= RADEON_PLL_PREFER_HIGH_FB_DIV;
+ else
+ pll->flags |= RADEON_PLL_PREFER_LOW_REF_DIV;
+-
+ }
+
+ list_for_each_entry(encoder, &dev->mode_config.encoder_list, head) {
+@@ -531,29 +530,28 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
+ dp_clock = dig_connector->dp_clock;
+ }
+ }
+-/* this might work properly with the new pll algo */
+-#if 0 /* doesn't work properly on some laptops */
++
+ /* use recommended ref_div for ss */
+ if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT)) {
+ if (ss_enabled) {
+ if (ss->refdiv) {
++ pll->flags |= RADEON_PLL_PREFER_MINM_OVER_MAXP;
+ pll->flags |= RADEON_PLL_USE_REF_DIV;
+ pll->reference_div = ss->refdiv;
++ if (ASIC_IS_AVIVO(rdev))
++ pll->flags |= RADEON_PLL_USE_FRAC_FB_DIV;
+ }
+ }
+ }
+-#endif
++
+ if (ASIC_IS_AVIVO(rdev)) {
+ /* DVO wants 2x pixel clock if the DVO chip is in 12 bit mode */
+ if (radeon_encoder->encoder_id == ENCODER_OBJECT_ID_INTERNAL_KLDSCP_DVO1)
+ adjusted_clock = mode->clock * 2;
+ if (radeon_encoder->active_device & (ATOM_DEVICE_TV_SUPPORT))
+ pll->flags |= RADEON_PLL_PREFER_CLOSEST_LOWER;
+- /* rv515 needs more testing with this option */
+- if (rdev->family != CHIP_RV515) {
+- if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT))
+- pll->flags |= RADEON_PLL_IS_LCD;
+- }
++ if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT))
++ pll->flags |= RADEON_PLL_IS_LCD;
+ } else {
+ if (encoder->encoder_type != DRM_MODE_ENCODER_DAC)
+ pll->flags |= RADEON_PLL_NO_ODD_POST_DIV;
+@@ -652,10 +650,12 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
+ index, (uint32_t *)&args);
+ adjusted_clock = le32_to_cpu(args.v3.sOutput.ulDispPllFreq) * 10;
+ if (args.v3.sOutput.ucRefDiv) {
++ pll->flags |= RADEON_PLL_USE_FRAC_FB_DIV;
+ pll->flags |= RADEON_PLL_USE_REF_DIV;
+ pll->reference_div = args.v3.sOutput.ucRefDiv;
+ }
+ if (args.v3.sOutput.ucPostDiv) {
++ pll->flags |= RADEON_PLL_USE_FRAC_FB_DIV;
+ pll->flags |= RADEON_PLL_USE_POST_DIV;
+ pll->post_div = args.v3.sOutput.ucPostDiv;
+ }
+@@ -921,11 +921,7 @@ static void atombios_crtc_set_pll(struct drm_crtc *crtc, struct drm_display_mode
+ /* adjust pixel clock as needed */
+ adjusted_clock = atombios_adjust_pll(crtc, mode, pll, ss_enabled, &ss);
+
+- /* rv515 seems happier with the old algo */
+- if (rdev->family == CHIP_RV515)
+- radeon_compute_pll_legacy(pll, adjusted_clock, &pll_clock, &fb_div, &frac_fb_div,
+- &ref_div, &post_div);
+- else if (ASIC_IS_AVIVO(rdev))
++ if (ASIC_IS_AVIVO(rdev))
+ radeon_compute_pll_avivo(pll, adjusted_clock, &pll_clock, &fb_div, &frac_fb_div,
+ &ref_div, &post_div);
+ else
+@@ -959,9 +955,9 @@ static void atombios_crtc_set_pll(struct drm_crtc *crtc, struct drm_display_mode
+ }
+ }
+
+-static int evergreen_crtc_do_set_base(struct drm_crtc *crtc,
+- struct drm_framebuffer *fb,
+- int x, int y, int atomic)
++static int dce4_crtc_do_set_base(struct drm_crtc *crtc,
++ struct drm_framebuffer *fb,
++ int x, int y, int atomic)
+ {
+ struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
+ struct drm_device *dev = crtc->dev;
+@@ -1093,12 +1089,6 @@ static int evergreen_crtc_do_set_base(struct drm_crtc *crtc,
+ WREG32(EVERGREEN_VIEWPORT_SIZE + radeon_crtc->crtc_offset,
+ (crtc->mode.hdisplay << 16) | crtc->mode.vdisplay);
+
+- if (crtc->mode.flags & DRM_MODE_FLAG_INTERLACE)
+- WREG32(EVERGREEN_DATA_FORMAT + radeon_crtc->crtc_offset,
+- EVERGREEN_INTERLEAVE_EN);
+- else
+- WREG32(EVERGREEN_DATA_FORMAT + radeon_crtc->crtc_offset, 0);
+-
+ if (!atomic && fb && fb != crtc->fb) {
+ radeon_fb = to_radeon_framebuffer(fb);
+ rbo = radeon_fb->obj->driver_private;
+@@ -1247,12 +1237,6 @@ static int avivo_crtc_do_set_base(struct drm_crtc *crtc,
+ WREG32(AVIVO_D1MODE_VIEWPORT_SIZE + radeon_crtc->crtc_offset,
+ (crtc->mode.hdisplay << 16) | crtc->mode.vdisplay);
+
+- if (crtc->mode.flags & DRM_MODE_FLAG_INTERLACE)
+- WREG32(AVIVO_D1MODE_DATA_FORMAT + radeon_crtc->crtc_offset,
+- AVIVO_D1MODE_INTERLEAVE_EN);
+- else
+- WREG32(AVIVO_D1MODE_DATA_FORMAT + radeon_crtc->crtc_offset, 0);
+-
+ if (!atomic && fb && fb != crtc->fb) {
+ radeon_fb = to_radeon_framebuffer(fb);
+ rbo = radeon_fb->obj->driver_private;
+@@ -1276,7 +1260,7 @@ int atombios_crtc_set_base(struct drm_crtc *crtc, int x, int y,
+ struct radeon_device *rdev = dev->dev_private;
+
+ if (ASIC_IS_DCE4(rdev))
+- return evergreen_crtc_do_set_base(crtc, old_fb, x, y, 0);
++ return dce4_crtc_do_set_base(crtc, old_fb, x, y, 0);
+ else if (ASIC_IS_AVIVO(rdev))
+ return avivo_crtc_do_set_base(crtc, old_fb, x, y, 0);
+ else
+@@ -1291,7 +1275,7 @@ int atombios_crtc_set_base_atomic(struct drm_crtc *crtc,
+ struct radeon_device *rdev = dev->dev_private;
+
+ if (ASIC_IS_DCE4(rdev))
+- return evergreen_crtc_do_set_base(crtc, fb, x, y, 1);
++ return dce4_crtc_do_set_base(crtc, fb, x, y, 1);
+ else if (ASIC_IS_AVIVO(rdev))
+ return avivo_crtc_do_set_base(crtc, fb, x, y, 1);
+ else
+diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c
+index 7831e08..153095f 100644
+--- a/drivers/gpu/drm/radeon/r600_cs.c
++++ b/drivers/gpu/drm/radeon/r600_cs.c
+@@ -295,17 +295,18 @@ static inline int r600_cs_track_validate_cb(struct radeon_cs_parser *p, int i)
+ }
+
+ if (!IS_ALIGNED(pitch, pitch_align)) {
+- dev_warn(p->dev, "%s:%d cb pitch (%d) invalid\n",
+- __func__, __LINE__, pitch);
++ dev_warn(p->dev, "%s:%d cb pitch (%d, 0x%x, %d) invalid\n",
++ __func__, __LINE__, pitch, pitch_align, array_mode);
+ return -EINVAL;
+ }
+ if (!IS_ALIGNED(height, height_align)) {
+- dev_warn(p->dev, "%s:%d cb height (%d) invalid\n",
+- __func__, __LINE__, height);
++ dev_warn(p->dev, "%s:%d cb height (%d, 0x%x, %d) invalid\n",
++ __func__, __LINE__, height, height_align, array_mode);
+ return -EINVAL;
+ }
+ if (!IS_ALIGNED(base_offset, base_align)) {
+- dev_warn(p->dev, "%s offset[%d] 0x%llx not aligned\n", __func__, i, base_offset);
++ dev_warn(p->dev, "%s offset[%d] 0x%llx 0x%llx, %d not aligned\n", __func__, i,
++ base_offset, base_align, array_mode);
+ return -EINVAL;
+ }
+
+@@ -320,7 +321,10 @@ static inline int r600_cs_track_validate_cb(struct radeon_cs_parser *p, int i)
+ * broken userspace.
+ */
+ } else {
+- dev_warn(p->dev, "%s offset[%d] %d %d %lu too big\n", __func__, i, track->cb_color_bo_offset[i], tmp, radeon_bo_size(track->cb_color_bo[i]));
++ dev_warn(p->dev, "%s offset[%d] %d %d %d %lu too big\n", __func__, i,
++ array_mode,
++ track->cb_color_bo_offset[i], tmp,
++ radeon_bo_size(track->cb_color_bo[i]));
+ return -EINVAL;
+ }
+ }
+@@ -455,17 +459,18 @@ static int r600_cs_track_check(struct radeon_cs_parser *p)
+ }
+
+ if (!IS_ALIGNED(pitch, pitch_align)) {
+- dev_warn(p->dev, "%s:%d db pitch (%d) invalid\n",
+- __func__, __LINE__, pitch);
++ dev_warn(p->dev, "%s:%d db pitch (%d, 0x%x, %d) invalid\n",
++ __func__, __LINE__, pitch, pitch_align, array_mode);
+ return -EINVAL;
+ }
+ if (!IS_ALIGNED(height, height_align)) {
+- dev_warn(p->dev, "%s:%d db height (%d) invalid\n",
+- __func__, __LINE__, height);
++ dev_warn(p->dev, "%s:%d db height (%d, 0x%x, %d) invalid\n",
++ __func__, __LINE__, height, height_align, array_mode);
+ return -EINVAL;
+ }
+ if (!IS_ALIGNED(base_offset, base_align)) {
+- dev_warn(p->dev, "%s offset[%d] 0x%llx not aligned\n", __func__, i, base_offset);
++ dev_warn(p->dev, "%s offset[%d] 0x%llx, 0x%llx, %d not aligned\n", __func__, i,
++ base_offset, base_align, array_mode);
+ return -EINVAL;
+ }
+
+@@ -473,9 +478,10 @@ static int r600_cs_track_check(struct radeon_cs_parser *p)
+ nviews = G_028004_SLICE_MAX(track->db_depth_view) + 1;
+ tmp = ntiles * bpe * 64 * nviews;
+ if ((tmp + track->db_offset) > radeon_bo_size(track->db_bo)) {
+- dev_warn(p->dev, "z/stencil buffer too small (0x%08X %d %d %d -> %u have %lu)\n",
+- track->db_depth_size, ntiles, nviews, bpe, tmp + track->db_offset,
+- radeon_bo_size(track->db_bo));
++ dev_warn(p->dev, "z/stencil buffer (%d) too small (0x%08X %d %d %d -> %u have %lu)\n",
++ array_mode,
++ track->db_depth_size, ntiles, nviews, bpe, tmp + track->db_offset,
++ radeon_bo_size(track->db_bo));
+ return -EINVAL;
+ }
+ }
+@@ -1227,18 +1233,18 @@ static inline int r600_check_texture_resource(struct radeon_cs_parser *p, u32 i
+ /* XXX check height as well... */
+
+ if (!IS_ALIGNED(pitch, pitch_align)) {
+- dev_warn(p->dev, "%s:%d tex pitch (%d) invalid\n",
+- __func__, __LINE__, pitch);
++ dev_warn(p->dev, "%s:%d tex pitch (%d, 0x%x, %d) invalid\n",
++ __func__, __LINE__, pitch, pitch_align, G_038000_TILE_MODE(word0));
+ return -EINVAL;
+ }
+ if (!IS_ALIGNED(base_offset, base_align)) {
+- dev_warn(p->dev, "%s:%d tex base offset (0x%llx) invalid\n",
+- __func__, __LINE__, base_offset);
++ dev_warn(p->dev, "%s:%d tex base offset (0x%llx, 0x%llx, %d) invalid\n",
++ __func__, __LINE__, base_offset, base_align, G_038000_TILE_MODE(word0));
+ return -EINVAL;
+ }
+ if (!IS_ALIGNED(mip_offset, base_align)) {
+- dev_warn(p->dev, "%s:%d tex mip offset (0x%llx) invalid\n",
+- __func__, __LINE__, mip_offset);
++ dev_warn(p->dev, "%s:%d tex mip offset (0x%llx, 0x%llx, %d) invalid\n",
++ __func__, __LINE__, mip_offset, base_align, G_038000_TILE_MODE(word0));
+ return -EINVAL;
+ }
+
+diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
+index 137b807..57bee7e 100644
+--- a/drivers/gpu/drm/radeon/radeon_combios.c
++++ b/drivers/gpu/drm/radeon/radeon_combios.c
+@@ -1503,6 +1503,11 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
+ (rdev->pdev->subsystem_device == 0x4a48)) {
+ /* Mac X800 */
+ rdev->mode_info.connector_table = CT_MAC_X800;
++ } else if ((rdev->pdev->device == 0x4150) &&
++ (rdev->pdev->subsystem_vendor == 0x1002) &&
++ (rdev->pdev->subsystem_device == 0x4150)) {
++ /* Mac G5 9600 */
++ rdev->mode_info.connector_table = CT_MAC_G5_9600;
+ } else
+ #endif /* CONFIG_PPC_PMAC */
+ #ifdef CONFIG_PPC64
+@@ -2021,6 +2026,48 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
+ CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_I,
+ &hpd);
+ break;
++ case CT_MAC_G5_9600:
++ DRM_INFO("Connector Table: %d (mac g5 9600)\n",
++ rdev->mode_info.connector_table);
++ /* DVI - tv dac, dvo */
++ ddc_i2c = combios_setup_i2c_bus(rdev, DDC_DVI, 0, 0);
++ hpd.hpd = RADEON_HPD_1; /* ??? */
++ radeon_add_legacy_encoder(dev,
++ radeon_get_encoder_enum(dev,
++ ATOM_DEVICE_DFP2_SUPPORT,
++ 0),
++ ATOM_DEVICE_DFP2_SUPPORT);
++ radeon_add_legacy_encoder(dev,
++ radeon_get_encoder_enum(dev,
++ ATOM_DEVICE_CRT2_SUPPORT,
++ 2),
++ ATOM_DEVICE_CRT2_SUPPORT);
++ radeon_add_legacy_connector(dev, 0,
++ ATOM_DEVICE_DFP2_SUPPORT |
++ ATOM_DEVICE_CRT2_SUPPORT,
++ DRM_MODE_CONNECTOR_DVII, &ddc_i2c,
++ CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_I,
++ &hpd);
++ /* ADC - primary dac, internal tmds */
++ ddc_i2c = combios_setup_i2c_bus(rdev, DDC_VGA, 0, 0);
++ hpd.hpd = RADEON_HPD_2; /* ??? */
++ radeon_add_legacy_encoder(dev,
++ radeon_get_encoder_enum(dev,
++ ATOM_DEVICE_DFP1_SUPPORT,
++ 0),
++ ATOM_DEVICE_DFP1_SUPPORT);
++ radeon_add_legacy_encoder(dev,
++ radeon_get_encoder_enum(dev,
++ ATOM_DEVICE_CRT1_SUPPORT,
++ 1),
++ ATOM_DEVICE_CRT1_SUPPORT);
++ radeon_add_legacy_connector(dev, 1,
++ ATOM_DEVICE_DFP1_SUPPORT |
++ ATOM_DEVICE_CRT1_SUPPORT,
++ DRM_MODE_CONNECTOR_DVII, &ddc_i2c,
++ CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_I,
++ &hpd);
++ break;
+ default:
+ DRM_INFO("Connector table: %d (invalid)\n",
+ rdev->mode_info.connector_table);
+diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
+index a26a70d..c7d1fca 100644
+--- a/drivers/gpu/drm/radeon/radeon_display.c
++++ b/drivers/gpu/drm/radeon/radeon_display.c
+@@ -461,6 +461,11 @@ static void avivo_get_fb_div(struct radeon_pll *pll,
+ tmp *= target_clock;
+ *fb_div = tmp / pll->reference_freq;
+ *frac_fb_div = tmp % pll->reference_freq;
++
++ if (*fb_div > pll->max_feedback_div)
++ *fb_div = pll->max_feedback_div;
++ else if (*fb_div < pll->min_feedback_div)
++ *fb_div = pll->min_feedback_div;
+ }
+
+ static u32 avivo_get_post_div(struct radeon_pll *pll,
+@@ -494,6 +499,11 @@ static u32 avivo_get_post_div(struct radeon_pll *pll,
+ post_div--;
+ }
+
++ if (post_div > pll->max_post_div)
++ post_div = pll->max_post_div;
++ else if (post_div < pll->min_post_div)
++ post_div = pll->min_post_div;
++
+ return post_div;
+ }
+
+diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c
+index 041943d..6a3d063 100644
+--- a/drivers/gpu/drm/radeon/radeon_encoders.c
++++ b/drivers/gpu/drm/radeon/radeon_encoders.c
+@@ -1465,11 +1465,21 @@ atombios_apply_encoder_quirks(struct drm_encoder *encoder,
+ }
+
+ /* set scaler clears this on some chips */
+- /* XXX check DCE4 */
+- if (!(radeon_encoder->active_device & (ATOM_DEVICE_TV_SUPPORT))) {
+- if (ASIC_IS_AVIVO(rdev) && (mode->flags & DRM_MODE_FLAG_INTERLACE))
+- WREG32(AVIVO_D1MODE_DATA_FORMAT + radeon_crtc->crtc_offset,
+- AVIVO_D1MODE_INTERLEAVE_EN);
++ if (ASIC_IS_AVIVO(rdev) &&
++ (!(radeon_encoder->active_device & (ATOM_DEVICE_TV_SUPPORT)))) {
++ if (ASIC_IS_DCE4(rdev)) {
++ if (mode->flags & DRM_MODE_FLAG_INTERLACE)
++ WREG32(EVERGREEN_DATA_FORMAT + radeon_crtc->crtc_offset,
++ EVERGREEN_INTERLEAVE_EN);
++ else
++ WREG32(EVERGREEN_DATA_FORMAT + radeon_crtc->crtc_offset, 0);
++ } else {
++ if (mode->flags & DRM_MODE_FLAG_INTERLACE)
++ WREG32(AVIVO_D1MODE_DATA_FORMAT + radeon_crtc->crtc_offset,
++ AVIVO_D1MODE_INTERLEAVE_EN);
++ else
++ WREG32(AVIVO_D1MODE_DATA_FORMAT + radeon_crtc->crtc_offset, 0);
++ }
+ }
+ }
+
+diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h
+index aa22570..2615e51 100644
+--- a/drivers/gpu/drm/radeon/radeon_mode.h
++++ b/drivers/gpu/drm/radeon/radeon_mode.h
+@@ -209,6 +209,7 @@ enum radeon_connector_table {
+ CT_EMAC,
+ CT_RN50_POWER,
+ CT_MAC_X800,
++ CT_MAC_G5_9600,
+ };
+
+ enum radeon_dvo_chip {
+diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
+index 1272e4b..e5b2cf1 100644
+--- a/drivers/gpu/drm/radeon/radeon_ttm.c
++++ b/drivers/gpu/drm/radeon/radeon_ttm.c
+@@ -787,9 +787,9 @@ static int radeon_ttm_debugfs_init(struct radeon_device *rdev)
+ radeon_mem_types_list[i].show = &radeon_mm_dump_table;
+ radeon_mem_types_list[i].driver_features = 0;
+ if (i == 0)
+- radeon_mem_types_list[i].data = &rdev->mman.bdev.man[TTM_PL_VRAM].priv;
++ radeon_mem_types_list[i].data = rdev->mman.bdev.man[TTM_PL_VRAM].priv;
+ else
+- radeon_mem_types_list[i].data = &rdev->mman.bdev.man[TTM_PL_TT].priv;
++ radeon_mem_types_list[i].data = rdev->mman.bdev.man[TTM_PL_TT].priv;
+
+ }
+ /* Add ttm page pool to debugfs */
+diff --git a/drivers/hid/hid-cando.c b/drivers/hid/hid-cando.c
+index 5925bdc..343c41b 100644
+--- a/drivers/hid/hid-cando.c
++++ b/drivers/hid/hid-cando.c
+@@ -236,6 +236,8 @@ static const struct hid_device_id cando_devices[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_CANDO,
+ USB_DEVICE_ID_CANDO_MULTI_TOUCH) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CANDO,
++ USB_DEVICE_ID_CANDO_MULTI_TOUCH_10_1) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_CANDO,
+ USB_DEVICE_ID_CANDO_MULTI_TOUCH_11_6) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CANDO,
+ USB_DEVICE_ID_CANDO_MULTI_TOUCH_15_6) },
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 88cb04e..52cf7ca 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1287,6 +1287,7 @@ static const struct hid_device_id hid_blacklist[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_BTC, USB_DEVICE_ID_BTC_EMPREX_REMOTE) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_BTC, USB_DEVICE_ID_BTC_EMPREX_REMOTE_2) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CANDO, USB_DEVICE_ID_CANDO_MULTI_TOUCH) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_CANDO, USB_DEVICE_ID_CANDO_MULTI_TOUCH_10_1) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CANDO, USB_DEVICE_ID_CANDO_MULTI_TOUCH_11_6) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CANDO, USB_DEVICE_ID_CANDO_MULTI_TOUCH_15_6) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CHERRY, USB_DEVICE_ID_CHERRY_CYMOTION) },
+@@ -1390,6 +1391,7 @@ static const struct hid_device_id hid_blacklist[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_TOPSEED, USB_DEVICE_ID_TOPSEED_CYBERLINK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_TOPSEED2, USB_DEVICE_ID_TOPSEED2_RF_COMBO) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_TWINHAN, USB_DEVICE_ID_TWINHAN_IR_REMOTE) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_TURBOX, USB_DEVICE_ID_TURBOX_TOUCHSCREEN_MOSART) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_PF1209) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_WP4030U) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_WP5540U) },
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 3341baa..f04789d 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -135,6 +135,7 @@
+
+ #define USB_VENDOR_ID_CANDO 0x2087
+ #define USB_DEVICE_ID_CANDO_MULTI_TOUCH 0x0a01
++#define USB_DEVICE_ID_CANDO_MULTI_TOUCH_10_1 0x0a02
+ #define USB_DEVICE_ID_CANDO_MULTI_TOUCH_11_6 0x0b03
+ #define USB_DEVICE_ID_CANDO_MULTI_TOUCH_15_6 0x0f01
+
+diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c
+index e6dc151..ed732b7 100644
+--- a/drivers/hid/hid-magicmouse.c
++++ b/drivers/hid/hid-magicmouse.c
+@@ -433,6 +433,11 @@ static int magicmouse_input_mapping(struct hid_device *hdev,
+ if (!msc->input)
+ msc->input = hi->input;
+
++ /* Magic Trackpad does not give relative data after switching to MT */
++ if (hi->input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD &&
++ field->flags & HID_MAIN_ITEM_RELATIVE)
++ return -1;
++
+ return 0;
+ }
+
+diff --git a/drivers/hid/hid-mosart.c b/drivers/hid/hid-mosart.c
+index ac5421d..251eaa4 100644
+--- a/drivers/hid/hid-mosart.c
++++ b/drivers/hid/hid-mosart.c
+@@ -240,6 +240,7 @@ static void mosart_remove(struct hid_device *hdev)
+ static const struct hid_device_id mosart_devices[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_ASUS, USB_DEVICE_ID_ASUS_T91MT) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ASUS, USB_DEVICE_ID_ASUSTEK_MULTITOUCH_YFO) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_TURBOX, USB_DEVICE_ID_TURBOX_TOUCHSCREEN_MOSART) },
+ { }
+ };
+ MODULE_DEVICE_TABLE(hid, mosart_devices);
+diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
+index 2c18547..af34376 100644
+--- a/drivers/hid/usbhid/hid-quirks.c
++++ b/drivers/hid/usbhid/hid-quirks.c
+@@ -35,7 +35,6 @@ static const struct hid_blacklist {
+ { USB_VENDOR_ID_CHIC, USB_DEVICE_ID_CHIC_GAMEPAD, HID_QUIRK_BADPAD },
+ { USB_VENDOR_ID_DWAV, USB_DEVICE_ID_EGALAX_TOUCHCONTROLLER, HID_QUIRK_MULTI_INPUT | HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_MOJO, USB_DEVICE_ID_RETRO_ADAPTER, HID_QUIRK_MULTI_INPUT },
+- { USB_VENDOR_ID_TURBOX, USB_DEVICE_ID_TURBOX_TOUCHSCREEN_MOSART, HID_QUIRK_MULTI_INPUT },
+ { USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_DRIVING, HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
+ { USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FLYING, HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
+ { USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FIGHTING, HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
+diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
+index a56f6ad..004ff55 100644
+--- a/drivers/hwmon/Kconfig
++++ b/drivers/hwmon/Kconfig
+@@ -238,13 +238,13 @@ config SENSORS_K8TEMP
+ will be called k8temp.
+
+ config SENSORS_K10TEMP
+- tristate "AMD Phenom/Sempron/Turion/Opteron temperature sensor"
++ tristate "AMD Family 10h/11h/12h/14h temperature sensor"
+ depends on X86 && PCI
+ help
+ If you say yes here you get support for the temperature
+ sensor(s) inside your CPU. Supported are later revisions of
+- the AMD Family 10h and all revisions of the AMD Family 11h
+- microarchitectures.
++ the AMD Family 10h and all revisions of the AMD Family 11h,
++ 12h (Llano), and 14h (Brazos) microarchitectures.
+
+ This driver can also be built as a module. If so, the module
+ will be called k10temp.
+@@ -445,13 +445,14 @@ config SENSORS_JZ4740
+ called jz4740-hwmon.
+
+ config SENSORS_JC42
+- tristate "JEDEC JC42.4 compliant temperature sensors"
++ tristate "JEDEC JC42.4 compliant memory module temperature sensors"
+ depends on I2C
+ help
+- If you say yes here you get support for Jedec JC42.4 compliant
+- temperature sensors. Support will include, but not be limited to,
+- ADT7408, CAT34TS02,, CAT6095, MAX6604, MCP9805, MCP98242, MCP98243,
+- MCP9843, SE97, SE98, STTS424, TSE2002B3, and TS3000B3.
++ If you say yes here, you get support for JEDEC JC42.4 compliant
++ temperature sensors, which are used on many DDR3 memory modules for
++ mobile devices and servers. Support will include, but not be limited
++ to, ADT7408, CAT34TS02, CAT6095, MAX6604, MCP9805, MCP98242, MCP98243,
++ MCP9843, SE97, SE98, STTS424(E), TSE2002B3, and TS3000B3.
+
+ This driver can also be built as a module. If so, the module
+ will be called jc42.
+@@ -564,7 +565,7 @@ config SENSORS_LM85
+ help
+ If you say yes here you get support for National Semiconductor LM85
+ sensor chips and clones: ADM1027, ADT7463, ADT7468, EMC6D100,
+- EMC6D101 and EMC6D102.
++ EMC6D101, EMC6D102, and EMC6D103.
+
+ This driver can also be built as a module. If so, the module
+ will be called lm85.
+diff --git a/drivers/hwmon/jc42.c b/drivers/hwmon/jc42.c
+index 340fc78..9349912 100644
+--- a/drivers/hwmon/jc42.c
++++ b/drivers/hwmon/jc42.c
+@@ -53,6 +53,8 @@ static const unsigned short normal_i2c[] = {
+
+ /* Configuration register defines */
+ #define JC42_CFG_CRIT_ONLY (1 << 2)
++#define JC42_CFG_TCRIT_LOCK (1 << 6)
++#define JC42_CFG_EVENT_LOCK (1 << 7)
+ #define JC42_CFG_SHUTDOWN (1 << 8)
+ #define JC42_CFG_HYST_SHIFT 9
+ #define JC42_CFG_HYST_MASK 0x03
+@@ -332,7 +334,7 @@ static ssize_t set_temp_crit_hyst(struct device *dev,
+ {
+ struct i2c_client *client = to_i2c_client(dev);
+ struct jc42_data *data = i2c_get_clientdata(client);
+- long val;
++ unsigned long val;
+ int diff, hyst;
+ int err;
+ int ret = count;
+@@ -380,14 +382,14 @@ static ssize_t show_alarm(struct device *dev,
+
+ static DEVICE_ATTR(temp1_input, S_IRUGO,
+ show_temp_input, NULL);
+-static DEVICE_ATTR(temp1_crit, S_IWUSR | S_IRUGO,
++static DEVICE_ATTR(temp1_crit, S_IRUGO,
+ show_temp_crit, set_temp_crit);
+-static DEVICE_ATTR(temp1_min, S_IWUSR | S_IRUGO,
++static DEVICE_ATTR(temp1_min, S_IRUGO,
+ show_temp_min, set_temp_min);
+-static DEVICE_ATTR(temp1_max, S_IWUSR | S_IRUGO,
++static DEVICE_ATTR(temp1_max, S_IRUGO,
+ show_temp_max, set_temp_max);
+
+-static DEVICE_ATTR(temp1_crit_hyst, S_IWUSR | S_IRUGO,
++static DEVICE_ATTR(temp1_crit_hyst, S_IRUGO,
+ show_temp_crit_hyst, set_temp_crit_hyst);
+ static DEVICE_ATTR(temp1_max_hyst, S_IRUGO,
+ show_temp_max_hyst, NULL);
+@@ -412,8 +414,31 @@ static struct attribute *jc42_attributes[] = {
+ NULL
+ };
+
++static mode_t jc42_attribute_mode(struct kobject *kobj,
++ struct attribute *attr, int index)
++{
++ struct device *dev = container_of(kobj, struct device, kobj);
++ struct i2c_client *client = to_i2c_client(dev);
++ struct jc42_data *data = i2c_get_clientdata(client);
++ unsigned int config = data->config;
++ bool readonly;
++
++ if (attr == &dev_attr_temp1_crit.attr)
++ readonly = config & JC42_CFG_TCRIT_LOCK;
++ else if (attr == &dev_attr_temp1_min.attr ||
++ attr == &dev_attr_temp1_max.attr)
++ readonly = config & JC42_CFG_EVENT_LOCK;
++ else if (attr == &dev_attr_temp1_crit_hyst.attr)
++ readonly = config & (JC42_CFG_EVENT_LOCK | JC42_CFG_TCRIT_LOCK);
++ else
++ readonly = true;
++
++ return S_IRUGO | (readonly ? 0 : S_IWUSR);
++}
++
+ static const struct attribute_group jc42_group = {
+ .attrs = jc42_attributes,
++ .is_visible = jc42_attribute_mode,
+ };
+
+ /* Return 0 if detection is successful, -ENODEV otherwise */
+diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c
+index da5a240..82bf65a 100644
+--- a/drivers/hwmon/k10temp.c
++++ b/drivers/hwmon/k10temp.c
+@@ -1,5 +1,5 @@
+ /*
+- * k10temp.c - AMD Family 10h/11h processor hardware monitoring
++ * k10temp.c - AMD Family 10h/11h/12h/14h processor hardware monitoring
+ *
+ * Copyright (c) 2009 Clemens Ladisch <clemens at ladisch.de>
+ *
+@@ -25,7 +25,7 @@
+ #include <linux/pci.h>
+ #include <asm/processor.h>
+
+-MODULE_DESCRIPTION("AMD Family 10h/11h CPU core temperature monitor");
++MODULE_DESCRIPTION("AMD Family 10h/11h/12h/14h CPU core temperature monitor");
+ MODULE_AUTHOR("Clemens Ladisch <clemens at ladisch.de>");
+ MODULE_LICENSE("GPL");
+
+@@ -208,6 +208,7 @@ static void __devexit k10temp_remove(struct pci_dev *pdev)
+ static const struct pci_device_id k10temp_id_table[] = {
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_10H_NB_MISC) },
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_11H_NB_MISC) },
++ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_CNB17H_F3) },
+ {}
+ };
+ MODULE_DEVICE_TABLE(pci, k10temp_id_table);
+diff --git a/drivers/hwmon/lm85.c b/drivers/hwmon/lm85.c
+index 1e22984..d2cc286 100644
+--- a/drivers/hwmon/lm85.c
++++ b/drivers/hwmon/lm85.c
+@@ -41,7 +41,7 @@ static const unsigned short normal_i2c[] = { 0x2c, 0x2d, 0x2e, I2C_CLIENT_END };
+ enum chips {
+ any_chip, lm85b, lm85c,
+ adm1027, adt7463, adt7468,
+- emc6d100, emc6d102
++ emc6d100, emc6d102, emc6d103
+ };
+
+ /* The LM85 registers */
+@@ -90,6 +90,9 @@ enum chips {
+ #define LM85_VERSTEP_EMC6D100_A0 0x60
+ #define LM85_VERSTEP_EMC6D100_A1 0x61
+ #define LM85_VERSTEP_EMC6D102 0x65
++#define LM85_VERSTEP_EMC6D103_A0 0x68
++#define LM85_VERSTEP_EMC6D103_A1 0x69
++#define LM85_VERSTEP_EMC6D103S 0x6A /* Also known as EMC6D103:A2 */
+
+ #define LM85_REG_CONFIG 0x40
+
+@@ -348,6 +351,7 @@ static const struct i2c_device_id lm85_id[] = {
+ { "emc6d100", emc6d100 },
+ { "emc6d101", emc6d100 },
+ { "emc6d102", emc6d102 },
++ { "emc6d103", emc6d103 },
+ { }
+ };
+ MODULE_DEVICE_TABLE(i2c, lm85_id);
+@@ -1250,6 +1254,20 @@ static int lm85_detect(struct i2c_client *client, struct i2c_board_info *info)
+ case LM85_VERSTEP_EMC6D102:
+ type_name = "emc6d102";
+ break;
++ case LM85_VERSTEP_EMC6D103_A0:
++ case LM85_VERSTEP_EMC6D103_A1:
++ type_name = "emc6d103";
++ break;
++ /*
++ * Registers apparently missing in EMC6D103S/EMC6D103:A2
++ * compared to EMC6D103:A0, EMC6D103:A1, and EMC6D102
++ * (according to the data sheets), but used unconditionally
++ * in the driver: 62[5:7], 6D[0:7], and 6E[0:7].
++ * So skip EMC6D103S for now.
++ case LM85_VERSTEP_EMC6D103S:
++ type_name = "emc6d103s";
++ break;
++ */
+ }
+ } else {
+ dev_dbg(&adapter->dev,
+@@ -1283,6 +1301,7 @@ static int lm85_probe(struct i2c_client *client,
+ case adt7468:
+ case emc6d100:
+ case emc6d102:
++ case emc6d103:
+ data->freq_map = adm1027_freq_map;
+ break;
+ default:
+@@ -1468,7 +1487,7 @@ static struct lm85_data *lm85_update_device(struct device *dev)
+ /* More alarm bits */
+ data->alarms |= lm85_read_value(client,
+ EMC6D100_REG_ALARM3) << 16;
+- } else if (data->type == emc6d102) {
++ } else if (data->type == emc6d102 || data->type == emc6d103) {
+ /* Have to read LSB bits after the MSB ones because
+ the reading of the MSB bits has frozen the
+ LSBs (backward from the ADM1027).
+diff --git a/drivers/media/dvb/ttpci/av7110_ca.c b/drivers/media/dvb/ttpci/av7110_ca.c
+index 122c728..9fc1dd0 100644
+--- a/drivers/media/dvb/ttpci/av7110_ca.c
++++ b/drivers/media/dvb/ttpci/av7110_ca.c
+@@ -277,7 +277,7 @@ static int dvb_ca_ioctl(struct file *file, unsigned int cmd, void *parg)
+ {
+ ca_slot_info_t *info=(ca_slot_info_t *)parg;
+
+- if (info->num > 1)
++ if (info->num < 0 || info->num > 1)
+ return -EINVAL;
+ av7110->ci_slot[info->num].num = info->num;
+ av7110->ci_slot[info->num].type = FW_CI_LL_SUPPORT(av7110->arm_app) ?
+diff --git a/drivers/media/radio/radio-aimslab.c b/drivers/media/radio/radio-aimslab.c
+index 6cc5d13..4ce10db 100644
+--- a/drivers/media/radio/radio-aimslab.c
++++ b/drivers/media/radio/radio-aimslab.c
+@@ -31,6 +31,7 @@
+ #include <linux/module.h> /* Modules */
+ #include <linux/init.h> /* Initdata */
+ #include <linux/ioport.h> /* request_region */
++#include <linux/delay.h> /* msleep */
+ #include <linux/videodev2.h> /* kernel radio structs */
+ #include <linux/version.h> /* for KERNEL_VERSION MACRO */
+ #include <linux/io.h> /* outb, outb_p */
+diff --git a/drivers/message/fusion/mptctl.c b/drivers/message/fusion/mptctl.c
+index a3856ed..e8deb8e 100644
+--- a/drivers/message/fusion/mptctl.c
++++ b/drivers/message/fusion/mptctl.c
+@@ -597,6 +597,13 @@ mptctl_event_process(MPT_ADAPTER *ioc, EventNotificationReply_t *pEvReply)
+ }
+
+ static int
++mptctl_release(struct inode *inode, struct file *filep)
++{
++ fasync_helper(-1, filep, 0, &async_queue);
++ return 0;
++}
++
++static int
+ mptctl_fasync(int fd, struct file *filep, int mode)
+ {
+ MPT_ADAPTER *ioc;
+@@ -2815,6 +2822,7 @@ static const struct file_operations mptctl_fops = {
+ .llseek = no_llseek,
+ .fasync = mptctl_fasync,
+ .unlocked_ioctl = mptctl_ioctl,
++ .release = mptctl_release,
+ #ifdef CONFIG_COMPAT
+ .compat_ioctl = compat_mpctl_ioctl,
+ #endif
+diff --git a/drivers/message/fusion/mptscsih.c b/drivers/message/fusion/mptscsih.c
+index 59b8f53..0d9b82a 100644
+--- a/drivers/message/fusion/mptscsih.c
++++ b/drivers/message/fusion/mptscsih.c
+@@ -1873,8 +1873,9 @@ mptscsih_abort(struct scsi_cmnd * SCpnt)
+ }
+
+ out:
+- printk(MYIOC_s_INFO_FMT "task abort: %s (sc=%p)\n",
+- ioc->name, ((retval == SUCCESS) ? "SUCCESS" : "FAILED"), SCpnt);
++ printk(MYIOC_s_INFO_FMT "task abort: %s (rv=%04x) (sc=%p) (sn=%ld)\n",
++ ioc->name, ((retval == SUCCESS) ? "SUCCESS" : "FAILED"), retval,
++ SCpnt, SCpnt->serial_number);
+
+ return retval;
+ }
+@@ -1911,7 +1912,7 @@ mptscsih_dev_reset(struct scsi_cmnd * SCpnt)
+
+ vdevice = SCpnt->device->hostdata;
+ if (!vdevice || !vdevice->vtarget) {
+- retval = SUCCESS;
++ retval = 0;
+ goto out;
+ }
+
+diff --git a/drivers/net/can/janz-ican3.c b/drivers/net/can/janz-ican3.c
+index 6e533dc..e733f2c 100644
+--- a/drivers/net/can/janz-ican3.c
++++ b/drivers/net/can/janz-ican3.c
+@@ -1627,7 +1627,7 @@ static ssize_t ican3_sysfs_set_term(struct device *dev,
+ return count;
+ }
+
+-static DEVICE_ATTR(termination, S_IWUGO | S_IRUGO, ican3_sysfs_show_term,
++static DEVICE_ATTR(termination, S_IWUSR | S_IRUGO, ican3_sysfs_show_term,
+ ican3_sysfs_set_term);
+
+ static struct attribute *ican3_sysfs_attrs[] = {
+diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
+index 176e525..e7fe35c 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
++++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
+@@ -2727,7 +2727,6 @@ static struct iwl_lib_ops iwl3945_lib = {
+ .config_ap = iwl3945_config_ap,
+ .manage_ibss_station = iwl3945_manage_ibss_station,
+ .recover_from_tx_stall = iwl_bg_monitor_recover,
+- .check_plcp_health = iwl3945_good_plcp_health,
+
+ .debugfs_ops = {
+ .rx_stats_read = iwl3945_ucode_rx_stats_read,
+diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
+index 63d5042..1539d2c 100644
+--- a/drivers/pci/pci-sysfs.c
++++ b/drivers/pci/pci-sysfs.c
+@@ -23,6 +23,7 @@
+ #include <linux/mm.h>
+ #include <linux/fs.h>
+ #include <linux/capability.h>
++#include <linux/security.h>
+ #include <linux/pci-aspm.h>
+ #include <linux/slab.h>
+ #include "pci.h"
+@@ -368,7 +369,7 @@ pci_read_config(struct file *filp, struct kobject *kobj,
+ u8 *data = (u8*) buf;
+
+ /* Several chips lock up trying to read undefined config space */
+- if (cap_raised(filp->f_cred->cap_effective, CAP_SYS_ADMIN)) {
++ if (security_capable(filp->f_cred, CAP_SYS_ADMIN) == 0) {
+ size = dev->cfg_size;
+ } else if (dev->hdr_type == PCI_HEADER_TYPE_CARDBUS) {
+ size = 128;
+diff --git a/drivers/pcmcia/pcmcia_resource.c b/drivers/pcmcia/pcmcia_resource.c
+index 0bdda5b..42fbf1a 100644
+--- a/drivers/pcmcia/pcmcia_resource.c
++++ b/drivers/pcmcia/pcmcia_resource.c
+@@ -518,6 +518,8 @@ int pcmcia_enable_device(struct pcmcia_device *p_dev)
+ flags |= CONF_ENABLE_IOCARD;
+ if (flags & CONF_ENABLE_IOCARD)
+ s->socket.flags |= SS_IOCARD;
++ if (flags & CONF_ENABLE_ZVCARD)
++ s->socket.flags |= SS_ZVCARD | SS_IOCARD;
+ if (flags & CONF_ENABLE_SPKR) {
+ s->socket.flags |= SS_SPKR_ENA;
+ status = CCSR_AUDIO_ENA;
+diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
+index c8c6537..196a59e 100644
+--- a/drivers/platform/x86/acer-wmi.c
++++ b/drivers/platform/x86/acer-wmi.c
+@@ -80,7 +80,7 @@ MODULE_LICENSE("GPL");
+ */
+ #define AMW0_GUID1 "67C3371D-95A3-4C37-BB61-DD47B491DAAB"
+ #define AMW0_GUID2 "431F16ED-0C2B-444C-B267-27DEB140CF9C"
+-#define WMID_GUID1 "6AF4F258-B401-42fd-BE91-3D4AC2D7C0D3"
++#define WMID_GUID1 "6AF4F258-B401-42FD-BE91-3D4AC2D7C0D3"
+ #define WMID_GUID2 "95764E09-FB56-4e83-B31A-37761F60994A"
+
+ MODULE_ALIAS("wmi:67C3371D-95A3-4C37-BB61-DD47B491DAAB");
+@@ -1065,7 +1065,7 @@ static ssize_t set_bool_threeg(struct device *dev,
+ return -EINVAL;
+ return count;
+ }
+-static DEVICE_ATTR(threeg, S_IWUGO | S_IRUGO | S_IWUSR, show_bool_threeg,
++static DEVICE_ATTR(threeg, S_IRUGO | S_IWUSR, show_bool_threeg,
+ set_bool_threeg);
+
+ static ssize_t show_interface(struct device *dev, struct device_attribute *attr,
+diff --git a/drivers/platform/x86/asus_acpi.c b/drivers/platform/x86/asus_acpi.c
+index ca05aef..cfab7b1 100644
+--- a/drivers/platform/x86/asus_acpi.c
++++ b/drivers/platform/x86/asus_acpi.c
+@@ -1081,14 +1081,8 @@ static int asus_hotk_add_fs(struct acpi_device *device)
+ struct proc_dir_entry *proc;
+ mode_t mode;
+
+- /*
+- * If parameter uid or gid is not changed, keep the default setting for
+- * our proc entries (-rw-rw-rw-) else, it means we care about security,
+- * and then set to -rw-rw----
+- */
+-
+ if ((asus_uid == 0) && (asus_gid == 0)) {
+- mode = S_IFREG | S_IRUGO | S_IWUGO;
++ mode = S_IFREG | S_IRUGO | S_IWUSR | S_IWGRP;
+ } else {
+ mode = S_IFREG | S_IRUSR | S_IRGRP | S_IWUSR | S_IWGRP;
+ printk(KERN_WARNING " asus_uid and asus_gid parameters are "
+diff --git a/drivers/platform/x86/tc1100-wmi.c b/drivers/platform/x86/tc1100-wmi.c
+index 1fe0f1f..865ef78 100644
+--- a/drivers/platform/x86/tc1100-wmi.c
++++ b/drivers/platform/x86/tc1100-wmi.c
+@@ -162,7 +162,7 @@ set_bool_##value(struct device *dev, struct device_attribute *attr, \
+ return -EINVAL; \
+ return count; \
+ } \
+-static DEVICE_ATTR(value, S_IWUGO | S_IRUGO | S_IWUSR, \
++static DEVICE_ATTR(value, S_IRUGO | S_IWUSR, \
+ show_bool_##value, set_bool_##value);
+
+ show_set_bool(wireless, TC1100_INSTANCE_WIRELESS);
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index a8ec48e..9130699 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -3524,7 +3524,7 @@ int register_con_driver(const struct consw *csw, int first, int last)
+
+ /* already registered */
+ if (con_driver->con == csw)
+- retval = -EINVAL;
++ retval = -EBUSY;
+ }
+
+ if (retval)
+@@ -3635,7 +3635,12 @@ int take_over_console(const struct consw *csw, int first, int last, int deflt)
+ int err;
+
+ err = register_con_driver(csw, first, last);
+-
++ /* if we get an busy error we still want to bind the console driver
++ * and return success, as we may have unbound the console driver
++ * but not unregistered it.
++ */
++ if (err == -EBUSY)
++ err = 0;
+ if (!err)
+ bind_con_driver(csw, first, last, deflt);
+
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 31edd87..32d0ad2 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -2744,11 +2744,6 @@ hub_port_init (struct usb_hub *hub, struct usb_device *udev, int port1,
+ udev->ttport = hdev->ttport;
+ } else if (udev->speed != USB_SPEED_HIGH
+ && hdev->speed == USB_SPEED_HIGH) {
+- if (!hub->tt.hub) {
+- dev_err(&udev->dev, "parent hub has no TT\n");
+- retval = -EINVAL;
+- goto fail;
+- }
+ udev->tt = &hub->tt;
+ udev->ttport = port1;
+ }
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index f87552a..866a1d5 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -2087,7 +2087,7 @@ long btrfs_ioctl_space_info(struct btrfs_root *root, void __user *arg)
+ int num_types = 4;
+ int alloc_size;
+ int ret = 0;
+- int slot_count = 0;
++ u64 slot_count = 0;
+ int i, c;
+
+ if (copy_from_user(&space_args,
+@@ -2126,7 +2126,7 @@ long btrfs_ioctl_space_info(struct btrfs_root *root, void __user *arg)
+ goto out;
+ }
+
+- slot_count = min_t(int, space_args.space_slots, slot_count);
++ slot_count = min_t(u64, space_args.space_slots, slot_count);
+
+ alloc_size = sizeof(*dest) * slot_count;
+
+@@ -2146,6 +2146,9 @@ long btrfs_ioctl_space_info(struct btrfs_root *root, void __user *arg)
+ for (i = 0; i < num_types; i++) {
+ struct btrfs_space_info *tmp;
+
++ if (!slot_count)
++ break;
++
+ info = NULL;
+ rcu_read_lock();
+ list_for_each_entry_rcu(tmp, &root->fs_info->space_info,
+@@ -2167,7 +2170,10 @@ long btrfs_ioctl_space_info(struct btrfs_root *root, void __user *arg)
+ memcpy(dest, &space, sizeof(space));
+ dest++;
+ space_args.total_spaces++;
++ slot_count--;
+ }
++ if (!slot_count)
++ break;
+ }
+ up_read(&info->groups_sem);
+ }
+diff --git a/fs/cifs/netmisc.c b/fs/cifs/netmisc.c
+index 9aad47a..23b741d 100644
+--- a/fs/cifs/netmisc.c
++++ b/fs/cifs/netmisc.c
+@@ -170,7 +170,7 @@ cifs_convert_address(struct sockaddr *dst, const char *src, int len)
+ {
+ int rc, alen, slen;
+ const char *pct;
+- char *endp, scope_id[13];
++ char scope_id[13];
+ struct sockaddr_in *s4 = (struct sockaddr_in *) dst;
+ struct sockaddr_in6 *s6 = (struct sockaddr_in6 *) dst;
+
+@@ -197,9 +197,9 @@ cifs_convert_address(struct sockaddr *dst, const char *src, int len)
+ memcpy(scope_id, pct + 1, slen);
+ scope_id[slen] = '\0';
+
+- s6->sin6_scope_id = (u32) simple_strtoul(pct, &endp, 0);
+- if (endp != scope_id + slen)
+- return 0;
++ rc = strict_strtoul(scope_id, 0,
++ (unsigned long *)&s6->sin6_scope_id);
++ rc = (rc == 0) ? 1 : 0;
+ }
+
+ return rc;
+diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
+index 7b01d3f..a91f8d2 100644
+--- a/fs/cifs/sess.c
++++ b/fs/cifs/sess.c
+@@ -667,13 +667,13 @@ ssetup_ntlmssp_authenticate:
+
+ if (type == LANMAN) {
+ #ifdef CONFIG_CIFS_WEAK_PW_HASH
+- char lnm_session_key[CIFS_SESS_KEY_SIZE];
++ char lnm_session_key[CIFS_AUTH_RESP_SIZE];
+
+ pSMB->req.hdr.Flags2 &= ~SMBFLG2_UNICODE;
+
+ /* no capabilities flags in old lanman negotiation */
+
+- pSMB->old_req.PasswordLength = cpu_to_le16(CIFS_SESS_KEY_SIZE);
++ pSMB->old_req.PasswordLength = cpu_to_le16(CIFS_AUTH_RESP_SIZE);
+
+ /* Calculate hash with password and copy into bcc_ptr.
+ * Encryption Key (stored as in cryptkey) gets used if the
+@@ -686,8 +686,8 @@ ssetup_ntlmssp_authenticate:
+ true : false, lnm_session_key);
+
+ ses->flags |= CIFS_SES_LANMAN;
+- memcpy(bcc_ptr, (char *)lnm_session_key, CIFS_SESS_KEY_SIZE);
+- bcc_ptr += CIFS_SESS_KEY_SIZE;
++ memcpy(bcc_ptr, (char *)lnm_session_key, CIFS_AUTH_RESP_SIZE);
++ bcc_ptr += CIFS_AUTH_RESP_SIZE;
+
+ /* can not sign if LANMAN negotiated so no need
+ to calculate signing key? but what if server
+diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
+index 9d1a22d..89edfe3 100644
+--- a/fs/ecryptfs/inode.c
++++ b/fs/ecryptfs/inode.c
+@@ -1095,6 +1095,8 @@ int ecryptfs_getattr(struct vfsmount *mnt, struct dentry *dentry,
+ rc = vfs_getattr(ecryptfs_dentry_to_lower_mnt(dentry),
+ ecryptfs_dentry_to_lower(dentry), &lower_stat);
+ if (!rc) {
++ fsstack_copy_attr_all(dentry->d_inode,
++ ecryptfs_inode_to_lower(dentry->d_inode));
+ generic_fillattr(dentry->d_inode, stat);
+ stat->blocks = lower_stat.blocks;
+ }
+diff --git a/fs/file_table.c b/fs/file_table.c
+index c3dee38..079940a 100644
+--- a/fs/file_table.c
++++ b/fs/file_table.c
+@@ -125,13 +125,13 @@ struct file *get_empty_filp(void)
+ goto fail;
+
+ percpu_counter_inc(&nr_files);
++ f->f_cred = get_cred(cred);
+ if (security_file_alloc(f))
+ goto fail_sec;
+
+ INIT_LIST_HEAD(&f->f_u.fu_list);
+ atomic_long_set(&f->f_count, 1);
+ rwlock_init(&f->f_owner.lock);
+- f->f_cred = get_cred(cred);
+ spin_lock_init(&f->f_lock);
+ eventpoll_init_file(f);
+ /* f->f_version: 0 */
+diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
+index f35a94a..67080e4 100644
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -316,8 +316,8 @@ nfsd4_decode_fattr(struct nfsd4_compoundargs *argp, u32 *bmval,
+ READ_BUF(dummy32);
+ len += (XDR_QUADLEN(dummy32) << 2);
+ READMEM(buf, dummy32);
+- if ((host_err = nfsd_map_name_to_uid(argp->rqstp, buf, dummy32, &iattr->ia_uid)))
+- goto out_nfserr;
++ if ((status = nfsd_map_name_to_uid(argp->rqstp, buf, dummy32, &iattr->ia_uid)))
++ return status;
+ iattr->ia_valid |= ATTR_UID;
+ }
+ if (bmval[1] & FATTR4_WORD1_OWNER_GROUP) {
+@@ -327,8 +327,8 @@ nfsd4_decode_fattr(struct nfsd4_compoundargs *argp, u32 *bmval,
+ READ_BUF(dummy32);
+ len += (XDR_QUADLEN(dummy32) << 2);
+ READMEM(buf, dummy32);
+- if ((host_err = nfsd_map_name_to_gid(argp->rqstp, buf, dummy32, &iattr->ia_gid)))
+- goto out_nfserr;
++ if ((status = nfsd_map_name_to_gid(argp->rqstp, buf, dummy32, &iattr->ia_gid)))
++ return status;
+ iattr->ia_valid |= ATTR_GID;
+ }
+ if (bmval[1] & FATTR4_WORD1_TIME_ACCESS_SET) {
+diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
+index 184938f..f1b0951 100644
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -809,7 +809,7 @@ nfsd_get_raparms(dev_t dev, ino_t ino)
+ if (ra->p_count == 0)
+ frap = rap;
+ }
+- depth = nfsdstats.ra_size*11/10;
++ depth = nfsdstats.ra_size;
+ if (!frap) {
+ spin_unlock(&rab->pb_lock);
+ return NULL;
+diff --git a/fs/partitions/mac.c b/fs/partitions/mac.c
+index 68d6a21..11f688b 100644
+--- a/fs/partitions/mac.c
++++ b/fs/partitions/mac.c
+@@ -29,10 +29,9 @@ static inline void mac_fix_string(char *stg, int len)
+
+ int mac_partition(struct parsed_partitions *state)
+ {
+- int slot = 1;
+ Sector sect;
+ unsigned char *data;
+- int blk, blocks_in_map;
++ int slot, blocks_in_map;
+ unsigned secsize;
+ #ifdef CONFIG_PPC_PMAC
+ int found_root = 0;
+@@ -59,10 +58,14 @@ int mac_partition(struct parsed_partitions *state)
+ put_dev_sector(sect);
+ return 0; /* not a MacOS disk */
+ }
+- strlcat(state->pp_buf, " [mac]", PAGE_SIZE);
+ blocks_in_map = be32_to_cpu(part->map_count);
+- for (blk = 1; blk <= blocks_in_map; ++blk) {
+- int pos = blk * secsize;
++ if (blocks_in_map < 0 || blocks_in_map >= DISK_MAX_PARTS) {
++ put_dev_sector(sect);
++ return 0;
++ }
++ strlcat(state->pp_buf, " [mac]", PAGE_SIZE);
++ for (slot = 1; slot <= blocks_in_map; ++slot) {
++ int pos = slot * secsize;
+ put_dev_sector(sect);
+ data = read_part_sector(state, pos/512, §);
+ if (!data)
+@@ -113,13 +116,11 @@ int mac_partition(struct parsed_partitions *state)
+ }
+
+ if (goodness > found_root_goodness) {
+- found_root = blk;
++ found_root = slot;
+ found_root_goodness = goodness;
+ }
+ }
+ #endif /* CONFIG_PPC_PMAC */
+-
+- ++slot;
+ }
+ #ifdef CONFIG_PPC_PMAC
+ if (found_root_goodness)
+diff --git a/fs/proc/array.c b/fs/proc/array.c
+index fff6572..3d88fe1 100644
+--- a/fs/proc/array.c
++++ b/fs/proc/array.c
+@@ -353,9 +353,6 @@ int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
+ task_cap(m, task);
+ task_cpus_allowed(m, task);
+ cpuset_task_status_allowed(m, task);
+-#if defined(CONFIG_S390)
+- task_show_regs(m, task);
+-#endif
+ task_context_switch_counts(m, task);
+ return 0;
+ }
+diff --git a/fs/xfs/quota/xfs_qm.c b/fs/xfs/quota/xfs_qm.c
+index f8e854b..206a281 100644
+--- a/fs/xfs/quota/xfs_qm.c
++++ b/fs/xfs/quota/xfs_qm.c
+@@ -1863,12 +1863,14 @@ xfs_qm_dqreclaim_one(void)
+ xfs_dquot_t *dqpout;
+ xfs_dquot_t *dqp;
+ int restarts;
++ int startagain;
+
+ restarts = 0;
+ dqpout = NULL;
+
+ /* lockorder: hashchainlock, freelistlock, mplistlock, dqlock, dqflock */
+-startagain:
++again:
++ startagain = 0;
+ mutex_lock(&xfs_Gqm->qm_dqfrlist_lock);
+
+ list_for_each_entry(dqp, &xfs_Gqm->qm_dqfrlist, q_freelist) {
+@@ -1885,13 +1887,10 @@ startagain:
+ ASSERT(! (dqp->dq_flags & XFS_DQ_INACTIVE));
+
+ trace_xfs_dqreclaim_want(dqp);
+-
+- xfs_dqunlock(dqp);
+- mutex_unlock(&xfs_Gqm->qm_dqfrlist_lock);
+- if (++restarts >= XFS_QM_RECLAIM_MAX_RESTARTS)
+- return NULL;
+ XQM_STATS_INC(xqmstats.xs_qm_dqwants);
+- goto startagain;
++ restarts++;
++ startagain = 1;
++ goto dqunlock;
+ }
+
+ /*
+@@ -1906,23 +1905,20 @@ startagain:
+ ASSERT(list_empty(&dqp->q_mplist));
+ list_del_init(&dqp->q_freelist);
+ xfs_Gqm->qm_dqfrlist_cnt--;
+- xfs_dqunlock(dqp);
+ dqpout = dqp;
+ XQM_STATS_INC(xqmstats.xs_qm_dqinact_reclaims);
+- break;
++ goto dqunlock;
+ }
+
+ ASSERT(dqp->q_hash);
+ ASSERT(!list_empty(&dqp->q_mplist));
+
+ /*
+- * Try to grab the flush lock. If this dquot is in the process of
+- * getting flushed to disk, we don't want to reclaim it.
++ * Try to grab the flush lock. If this dquot is in the process
++ * of getting flushed to disk, we don't want to reclaim it.
+ */
+- if (!xfs_dqflock_nowait(dqp)) {
+- xfs_dqunlock(dqp);
+- continue;
+- }
++ if (!xfs_dqflock_nowait(dqp))
++ goto dqunlock;
+
+ /*
+ * We have the flush lock so we know that this is not in the
+@@ -1944,8 +1940,7 @@ startagain:
+ xfs_fs_cmn_err(CE_WARN, mp,
+ "xfs_qm_dqreclaim: dquot %p flush failed", dqp);
+ }
+- xfs_dqunlock(dqp); /* dqflush unlocks dqflock */
+- continue;
++ goto dqunlock;
+ }
+
+ /*
+@@ -1967,13 +1962,8 @@ startagain:
+ */
+ if (!mutex_trylock(&mp->m_quotainfo->qi_dqlist_lock)) {
+ restarts++;
+- mutex_unlock(&dqp->q_hash->qh_lock);
+- xfs_dqfunlock(dqp);
+- xfs_dqunlock(dqp);
+- mutex_unlock(&xfs_Gqm->qm_dqfrlist_lock);
+- if (restarts++ >= XFS_QM_RECLAIM_MAX_RESTARTS)
+- return NULL;
+- goto startagain;
++ startagain = 1;
++ goto qhunlock;
+ }
+
+ ASSERT(dqp->q_nrefs == 0);
+@@ -1986,14 +1976,20 @@ startagain:
+ xfs_Gqm->qm_dqfrlist_cnt--;
+ dqpout = dqp;
+ mutex_unlock(&mp->m_quotainfo->qi_dqlist_lock);
++qhunlock:
+ mutex_unlock(&dqp->q_hash->qh_lock);
+ dqfunlock:
+ xfs_dqfunlock(dqp);
++dqunlock:
+ xfs_dqunlock(dqp);
+ if (dqpout)
+ break;
+ if (restarts >= XFS_QM_RECLAIM_MAX_RESTARTS)
+- return NULL;
++ break;
++ if (startagain) {
++ mutex_unlock(&xfs_Gqm->qm_dqfrlist_lock);
++ goto again;
++ }
+ }
+ mutex_unlock(&xfs_Gqm->qm_dqfrlist_lock);
+ return dqpout;
+diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
+index cb845c1..dd7d4e2 100644
+--- a/include/linux/pci_ids.h
++++ b/include/linux/pci_ids.h
+@@ -518,6 +518,7 @@
+ #define PCI_DEVICE_ID_AMD_11H_NB_MISC 0x1303
+ #define PCI_DEVICE_ID_AMD_11H_NB_LINK 0x1304
+ #define PCI_DEVICE_ID_AMD_15H_NB_MISC 0x1603
++#define PCI_DEVICE_ID_AMD_CNB17H_F3 0x1703
+ #define PCI_DEVICE_ID_AMD_LANCE 0x2000
+ #define PCI_DEVICE_ID_AMD_LANCE_HOME 0x2001
+ #define PCI_DEVICE_ID_AMD_SCSI 0x2020
+diff --git a/include/linux/security.h b/include/linux/security.h
+index d47a4c2..b3f2f47 100644
+--- a/include/linux/security.h
++++ b/include/linux/security.h
+@@ -1664,7 +1664,7 @@ int security_capset(struct cred *new, const struct cred *old,
+ const kernel_cap_t *effective,
+ const kernel_cap_t *inheritable,
+ const kernel_cap_t *permitted);
+-int security_capable(int cap);
++int security_capable(const struct cred *cred, int cap);
+ int security_real_capable(struct task_struct *tsk, int cap);
+ int security_real_capable_noaudit(struct task_struct *tsk, int cap);
+ int security_sysctl(struct ctl_table *table, int op);
+@@ -1857,9 +1857,9 @@ static inline int security_capset(struct cred *new,
+ return cap_capset(new, old, effective, inheritable, permitted);
+ }
+
+-static inline int security_capable(int cap)
++static inline int security_capable(const struct cred *cred, int cap)
+ {
+- return cap_capable(current, current_cred(), cap, SECURITY_CAP_AUDIT);
++ return cap_capable(current, cred, cap, SECURITY_CAP_AUDIT);
+ }
+
+ static inline int security_real_capable(struct task_struct *tsk, int cap)
+diff --git a/include/pcmcia/ds.h b/include/pcmcia/ds.h
+index 8479b66..3fd5064 100644
+--- a/include/pcmcia/ds.h
++++ b/include/pcmcia/ds.h
+@@ -261,6 +261,7 @@ void pcmcia_disable_device(struct pcmcia_device *p_dev);
+ #define CONF_ENABLE_ESR 0x0008
+ #define CONF_ENABLE_IOCARD 0x0010 /* auto-enabled if IO resources or IRQ
+ * (CONF_ENABLE_IRQ) in use */
++#define CONF_ENABLE_ZVCARD 0x0020
+
+ /* flags used by pcmcia_loop_config() autoconfiguration */
+ #define CONF_AUTO_CHECK_VCC 0x0100 /* check for matching Vcc? */
+diff --git a/kernel/capability.c b/kernel/capability.c
+index 2f05303..9e9385f 100644
+--- a/kernel/capability.c
++++ b/kernel/capability.c
+@@ -306,7 +306,7 @@ int capable(int cap)
+ BUG();
+ }
+
+- if (security_capable(cap) == 0) {
++ if (security_capable(current_cred(), cap) == 0) {
+ current->flags |= PF_SUPERPRIV;
+ return 1;
+ }
+diff --git a/kernel/cred.c b/kernel/cred.c
+index 6a1aa00..3a9d6dd 100644
+--- a/kernel/cred.c
++++ b/kernel/cred.c
+@@ -252,13 +252,13 @@ struct cred *cred_alloc_blank(void)
+ #endif
+
+ atomic_set(&new->usage, 1);
++#ifdef CONFIG_DEBUG_CREDENTIALS
++ new->magic = CRED_MAGIC;
++#endif
+
+ if (security_cred_alloc_blank(new, GFP_KERNEL) < 0)
+ goto error;
+
+-#ifdef CONFIG_DEBUG_CREDENTIALS
+- new->magic = CRED_MAGIC;
+-#endif
+ return new;
+
+ error:
+@@ -657,6 +657,8 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon)
+ validate_creds(old);
+
+ *new = *old;
++ atomic_set(&new->usage, 1);
++ set_cred_subscribers(new, 0);
+ get_uid(new->user);
+ get_group_info(new->group_info);
+
+@@ -674,8 +676,6 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon)
+ if (security_prepare_creds(new, old, GFP_KERNEL) < 0)
+ goto error;
+
+- atomic_set(&new->usage, 1);
+- set_cred_subscribers(new, 0);
+ put_cred(old);
+ validate_creds(new);
+ return new;
+@@ -748,7 +748,11 @@ bool creds_are_invalid(const struct cred *cred)
+ if (cred->magic != CRED_MAGIC)
+ return true;
+ #ifdef CONFIG_SECURITY_SELINUX
+- if (selinux_is_enabled()) {
++ /*
++ * cred->security == NULL if security_cred_alloc_blank() or
++ * security_prepare_creds() returned an error.
++ */
++ if (selinux_is_enabled() && cred->security) {
+ if ((unsigned long) cred->security < PAGE_SIZE)
+ return true;
+ if ((*(u32 *)cred->security & 0xffffff00) ==
+diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h
+index 4571ae7..99c3bc8 100644
+--- a/kernel/irq/internals.h
++++ b/kernel/irq/internals.h
+@@ -3,6 +3,12 @@
+ */
+ #include <linux/irqdesc.h>
+
++#ifdef CONFIG_SPARSE_IRQ
++# define IRQ_BITMAP_BITS (NR_IRQS + 8196)
++#else
++# define IRQ_BITMAP_BITS NR_IRQS
++#endif
++
+ extern int noirqdebug;
+
+ #define irq_data_to_desc(data) container_of(data, struct irq_desc, irq_data)
+diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
+index 9988d03..49b8394 100644
+--- a/kernel/irq/irqdesc.c
++++ b/kernel/irq/irqdesc.c
+@@ -91,7 +91,7 @@ int nr_irqs = NR_IRQS;
+ EXPORT_SYMBOL_GPL(nr_irqs);
+
+ static DEFINE_MUTEX(sparse_irq_lock);
+-static DECLARE_BITMAP(allocated_irqs, NR_IRQS);
++static DECLARE_BITMAP(allocated_irqs, IRQ_BITMAP_BITS);
+
+ #ifdef CONFIG_SPARSE_IRQ
+
+@@ -215,6 +215,15 @@ int __init early_irq_init(void)
+ initcnt = arch_probe_nr_irqs();
+ printk(KERN_INFO "NR_IRQS:%d nr_irqs:%d %d\n", NR_IRQS, nr_irqs, initcnt);
+
++ if (WARN_ON(nr_irqs > IRQ_BITMAP_BITS))
++ nr_irqs = IRQ_BITMAP_BITS;
++
++ if (WARN_ON(initcnt > IRQ_BITMAP_BITS))
++ initcnt = IRQ_BITMAP_BITS;
++
++ if (initcnt > nr_irqs)
++ nr_irqs = initcnt;
++
+ for (i = 0; i < initcnt; i++) {
+ desc = alloc_desc(i, node);
+ set_bit(i, allocated_irqs);
+diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
+index 5f92acc5..6f7c114 100644
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -1098,7 +1098,7 @@ int request_threaded_irq(unsigned int irq, irq_handler_t handler,
+ if (retval)
+ kfree(action);
+
+-#ifdef CONFIG_DEBUG_SHIRQ
++#ifdef CONFIG_DEBUG_SHIRQ_FIXME
+ if (!retval && (irqflags & IRQF_SHARED)) {
+ /*
+ * It's a shared IRQ -- the driver ought to be prepared for it
+diff --git a/kernel/irq/resend.c b/kernel/irq/resend.c
+index 891115a..dc49358 100644
+--- a/kernel/irq/resend.c
++++ b/kernel/irq/resend.c
+@@ -23,7 +23,7 @@
+ #ifdef CONFIG_HARDIRQS_SW_RESEND
+
+ /* Bitmap to handle software resend of interrupts: */
+-static DECLARE_BITMAP(irqs_resend, NR_IRQS);
++static DECLARE_BITMAP(irqs_resend, IRQ_BITMAP_BITS);
+
+ /*
+ * Run software resends of IRQ's
+diff --git a/kernel/perf_event.c b/kernel/perf_event.c
+index 64668bd..785c66a 100644
+--- a/kernel/perf_event.c
++++ b/kernel/perf_event.c
+@@ -652,6 +652,10 @@ retry:
+ raw_spin_unlock_irq(&ctx->lock);
+ }
+
++#define MAX_INTERRUPTS (~0ULL)
++
++static void perf_log_throttle(struct perf_event *event, int enable);
++
+ static int
+ event_sched_in(struct perf_event *event,
+ struct perf_cpu_context *cpuctx,
+@@ -662,6 +666,17 @@ event_sched_in(struct perf_event *event,
+
+ event->state = PERF_EVENT_STATE_ACTIVE;
+ event->oncpu = smp_processor_id();
++
++ /*
++ * Unthrottle events, since we scheduled we might have missed several
++ * ticks already, also for a heavily scheduling task there is little
++ * guarantee it'll get a tick in a timely manner.
++ */
++ if (unlikely(event->hw.interrupts == MAX_INTERRUPTS)) {
++ perf_log_throttle(event, 1);
++ event->hw.interrupts = 0;
++ }
++
+ /*
+ * The new state must be visible before we turn it on in the hardware:
+ */
+@@ -1469,10 +1484,6 @@ void __perf_event_task_sched_in(struct task_struct *task)
+ }
+ }
+
+-#define MAX_INTERRUPTS (~0ULL)
+-
+-static void perf_log_throttle(struct perf_event *event, int enable);
+-
+ static u64 perf_calculate_period(struct perf_event *event, u64 nsec, u64 count)
+ {
+ u64 frequency = event->attr.sample_freq;
+diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
+index 0dac75e..64db648 100644
+--- a/kernel/power/snapshot.c
++++ b/kernel/power/snapshot.c
+@@ -1519,11 +1519,8 @@ static int
+ swsusp_alloc(struct memory_bitmap *orig_bm, struct memory_bitmap *copy_bm,
+ unsigned int nr_pages, unsigned int nr_highmem)
+ {
+- int error = 0;
+-
+ if (nr_highmem > 0) {
+- error = get_highmem_buffer(PG_ANY);
+- if (error)
++ if (get_highmem_buffer(PG_ANY))
+ goto err_out;
+ if (nr_highmem > alloc_highmem) {
+ nr_highmem -= alloc_highmem;
+@@ -1546,7 +1543,7 @@ swsusp_alloc(struct memory_bitmap *orig_bm, struct memory_bitmap *copy_bm,
+
+ err_out:
+ swsusp_free();
+- return error;
++ return -ENOMEM;
+ }
+
+ asmlinkage int swsusp_save(void)
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index 4be7fa5..c95f321 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -79,7 +79,9 @@ enum {
+ MAX_IDLE_WORKERS_RATIO = 4, /* 1/4 of busy can be idle */
+ IDLE_WORKER_TIMEOUT = 300 * HZ, /* keep idle ones for 5 mins */
+
+- MAYDAY_INITIAL_TIMEOUT = HZ / 100, /* call for help after 10ms */
++ MAYDAY_INITIAL_TIMEOUT = HZ / 100 >= 2 ? HZ / 100 : 2,
++ /* call for help after 10ms
++ (min two ticks) */
+ MAYDAY_INTERVAL = HZ / 10, /* and then every 100ms */
+ CREATE_COOLDOWN = HZ, /* time to breath after fail */
+ TRUSTEE_COOLDOWN = HZ / 10, /* for trustee draining */
+@@ -2009,6 +2011,15 @@ repeat:
+ move_linked_works(work, scheduled, &n);
+
+ process_scheduled_works(rescuer);
++
++ /*
++ * Leave this gcwq. If keep_working() is %true, notify a
++ * regular worker; otherwise, we end up with 0 concurrency
++ * and stalling the execution.
++ */
++ if (keep_working(gcwq))
++ wake_up_worker(gcwq);
++
+ spin_unlock_irq(&gcwq->lock);
+ }
+
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 0dd54a6..c0d3b5f 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -4945,6 +4945,7 @@ static void rollback_registered(struct net_device *dev)
+
+ list_add(&dev->unreg_list, &single);
+ rollback_registered_many(&single);
++ list_del(&single);
+ }
+
+ unsigned long netdev_fix_features(unsigned long features, const char *name)
+@@ -6114,6 +6115,7 @@ static void __net_exit default_device_exit_batch(struct list_head *net_list)
+ }
+ }
+ unregister_netdevice_many(&dev_kill_list);
++ list_del(&dev_kill_list);
+ rtnl_unlock();
+ }
+
+diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
+index b729ace..742a6dc 100644
+--- a/net/netfilter/nf_conntrack_netlink.c
++++ b/net/netfilter/nf_conntrack_netlink.c
+@@ -642,30 +642,29 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
+ struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
+ u_int8_t l3proto = nfmsg->nfgen_family;
+
+- rcu_read_lock();
++ spin_lock_bh(&nf_conntrack_lock);
+ last = (struct nf_conn *)cb->args[1];
+ for (; cb->args[0] < net->ct.htable_size; cb->args[0]++) {
+ restart:
+- hlist_nulls_for_each_entry_rcu(h, n, &net->ct.hash[cb->args[0]],
++ hlist_nulls_for_each_entry(h, n, &net->ct.hash[cb->args[0]],
+ hnnode) {
+ if (NF_CT_DIRECTION(h) != IP_CT_DIR_ORIGINAL)
+ continue;
+ ct = nf_ct_tuplehash_to_ctrack(h);
+- if (!atomic_inc_not_zero(&ct->ct_general.use))
+- continue;
+ /* Dump entries of a given L3 protocol number.
+ * If it is not specified, ie. l3proto == 0,
+ * then dump everything. */
+ if (l3proto && nf_ct_l3num(ct) != l3proto)
+- goto releasect;
++ continue;
+ if (cb->args[1]) {
+ if (ct != last)
+- goto releasect;
++ continue;
+ cb->args[1] = 0;
+ }
+ if (ctnetlink_fill_info(skb, NETLINK_CB(cb->skb).pid,
+ cb->nlh->nlmsg_seq,
+ IPCTNL_MSG_CT_NEW, ct) < 0) {
++ nf_conntrack_get(&ct->ct_general);
+ cb->args[1] = (unsigned long)ct;
+ goto out;
+ }
+@@ -678,8 +677,6 @@ restart:
+ if (acct)
+ memset(acct, 0, sizeof(struct nf_conn_counter[IP_CT_DIR_MAX]));
+ }
+-releasect:
+- nf_ct_put(ct);
+ }
+ if (cb->args[1]) {
+ cb->args[1] = 0;
+@@ -687,7 +684,7 @@ releasect:
+ }
+ }
+ out:
+- rcu_read_unlock();
++ spin_unlock_bh(&nf_conntrack_lock);
+ if (last)
+ nf_ct_put(last);
+
+diff --git a/security/security.c b/security/security.c
+index e5fb07a..8d57dbb 100644
+--- a/security/security.c
++++ b/security/security.c
+@@ -154,10 +154,9 @@ int security_capset(struct cred *new, const struct cred *old,
+ effective, inheritable, permitted);
+ }
+
+-int security_capable(int cap)
++int security_capable(const struct cred *cred, int cap)
+ {
+- return security_ops->capable(current, current_cred(), cap,
+- SECURITY_CAP_AUDIT);
++ return security_ops->capable(current, cred, cap, SECURITY_CAP_AUDIT);
+ }
+
+ int security_real_capable(struct task_struct *tsk, int cap)
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index 11d5c47..a373ab6 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -3198,7 +3198,11 @@ static void selinux_cred_free(struct cred *cred)
+ {
+ struct task_security_struct *tsec = cred->security;
+
+- BUG_ON((unsigned long) cred->security < PAGE_SIZE);
++ /*
++ * cred->security == NULL if security_cred_alloc_blank() or
++ * security_prepare_creds() returned an error.
++ */
++ BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
+ cred->security = (void *) 0x7UL;
+ kfree(tsec);
+ }
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index a1c4008..5825d18 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2305,6 +2305,7 @@ static struct snd_pci_quirk position_fix_list[] __devinitdata = {
+ SND_PCI_QUIRK(0x1043, 0x813d, "ASUS P5AD2", POS_FIX_LPIB),
+ SND_PCI_QUIRK(0x1043, 0x81b3, "ASUS", POS_FIX_LPIB),
+ SND_PCI_QUIRK(0x1043, 0x81e7, "ASUS M2V", POS_FIX_LPIB),
++ SND_PCI_QUIRK(0x1043, 0x8410, "ASUS", POS_FIX_LPIB),
+ SND_PCI_QUIRK(0x104d, 0x9069, "Sony VPCS11V9E", POS_FIX_LPIB),
+ SND_PCI_QUIRK(0x1106, 0x3288, "ASUS M2V-MX SE", POS_FIX_LPIB),
+ SND_PCI_QUIRK(0x1179, 0xff10, "Toshiba A100-259", POS_FIX_LPIB),
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 5667fb9..fc5e027 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -3401,7 +3401,7 @@ static void cx_auto_parse_output(struct hda_codec *codec)
+ }
+ }
+ spec->multiout.dac_nids = spec->private_dac_nids;
+- spec->multiout.max_channels = nums * 2;
++ spec->multiout.max_channels = spec->multiout.num_dacs * 2;
+
+ if (cfg->hp_outs > 0)
+ spec->auto_mute = 1;
+diff --git a/sound/soc/codecs/wm8903.c b/sound/soc/codecs/wm8903.c
+index 622b602..8b87e04 100644
+--- a/sound/soc/codecs/wm8903.c
++++ b/sound/soc/codecs/wm8903.c
+@@ -1479,7 +1479,7 @@ int wm8903_mic_detect(struct snd_soc_codec *codec, struct snd_soc_jack *jack,
+ WM8903_MICDET_EINT | WM8903_MICSHRT_EINT,
+ irq_mask);
+
+- if (det && shrt) {
++ if (det || shrt) {
+ /* Enable mic detection, this may not have been set through
+ * platform data (eg, if the defaults are OK). */
+ snd_soc_update_bits(codec, WM8903_WRITE_SEQUENCER_0,
+diff --git a/sound/usb/caiaq/audio.c b/sound/usb/caiaq/audio.c
+index 68b9747..66eabaf 100644
+--- a/sound/usb/caiaq/audio.c
++++ b/sound/usb/caiaq/audio.c
+@@ -785,7 +785,7 @@ int snd_usb_caiaq_audio_init(struct snd_usb_caiaqdev *dev)
+ }
+
+ dev->pcm->private_data = dev;
+- strcpy(dev->pcm->name, dev->product_name);
++ strlcpy(dev->pcm->name, dev->product_name, sizeof(dev->pcm->name));
+
+ memset(dev->sub_playback, 0, sizeof(dev->sub_playback));
+ memset(dev->sub_capture, 0, sizeof(dev->sub_capture));
+diff --git a/sound/usb/caiaq/midi.c b/sound/usb/caiaq/midi.c
+index 2f218c7..a1a4708 100644
+--- a/sound/usb/caiaq/midi.c
++++ b/sound/usb/caiaq/midi.c
+@@ -136,7 +136,7 @@ int snd_usb_caiaq_midi_init(struct snd_usb_caiaqdev *device)
+ if (ret < 0)
+ return ret;
+
+- strcpy(rmidi->name, device->product_name);
++ strlcpy(rmidi->name, device->product_name, sizeof(rmidi->name));
+
+ rmidi->info_flags = SNDRV_RAWMIDI_INFO_DUPLEX;
+ rmidi->private_data = device;
+diff --git a/tools/perf/builtin-timechart.c b/tools/perf/builtin-timechart.c
+index 9bcc38f..b3028eb 100644
+--- a/tools/perf/builtin-timechart.c
++++ b/tools/perf/builtin-timechart.c
+@@ -502,7 +502,7 @@ static int process_sample_event(event_t *event, struct perf_session *session)
+ c_state_start(pe->cpu_id, data.time, pe->value);
+
+ if (strcmp(event_str, "power:power_end") == 0)
+- c_state_end(pe->cpu_id, data.time);
++ c_state_end(data.cpu, data.time);
+
+ if (strcmp(event_str, "power:power_frequency") == 0)
+ p_state_change(pe->cpu_id, data.time, pe->value);
Modified: dists/sid/linux-2.6/debian/patches/series/2
==============================================================================
--- dists/sid/linux-2.6/debian/patches/series/2 Fri Feb 25 03:34:23 2011 (r16935)
+++ dists/sid/linux-2.6/debian/patches/series/2 Fri Feb 25 03:50:38 2011 (r16936)
@@ -2,4 +2,9 @@
- debian/sysrq-mask.patch
+ bugfix/all/stable/2.6.37.1.patch
+ debian/sysrq-mask-2.patch
-+ bugfix/all/btrfs-prevent-heap-corruption-in-btrfs_ioctl_space_i.patch
+- bugfix/x86/platform-x86-tc1100-wmi-world-writable-sysfs-wireles.patch
+- bugfix/x86/platform-x86-asus_acpi-world-writable-procfs-files.patch
+- bugfix/x86/platform-x86-acer-wmi-world-writable-sysfs-threeg-fi.patch
+- bugfix/all/net-can-janz-ican3-world-writable-sysfs-termination-.patch
+- bugfix/all/drm-nouveau-Only-select-ACPI_VIDEO-if-its-dependenci.patch
++ bugfix/all/stable/2.6.37.2.patch
More information about the Kernel-svn-changes
mailing list