[kernel] r17823 - in dists/sid/linux-2.6/debian: . patches/bugfix/all/stable patches/series
Ben Hutchings
benh at alioth.debian.org
Sun Jul 10 01:48:23 UTC 2011
Author: benh
Date: Sun Jul 10 01:48:22 2011
New Revision: 17823
Log:
Add stable release 2.6.39.3
Added:
dists/sid/linux-2.6/debian/patches/bugfix/all/stable/2.6.39.3.patch
dists/sid/linux-2.6/debian/patches/series/4
Modified:
dists/sid/linux-2.6/debian/changelog
Modified: dists/sid/linux-2.6/debian/changelog
==============================================================================
--- dists/sid/linux-2.6/debian/changelog Fri Jul 8 04:32:21 2011 (r17822)
+++ dists/sid/linux-2.6/debian/changelog Sun Jul 10 01:48:22 2011 (r17823)
@@ -2,6 +2,27 @@
[ Ben Hutchings ]
* [amd64] Enable PCMCIA_AHA152X as module (Closes: #632929)
+ * Add stable release 2.6.39.3, including:
+ - ipvs/ip_vs_ftp: Use separate state per netns
+ - inetpeer: fix race in unused_list manipulations
+ - af_packet: prevent information leak
+ - ipv4: Check for mistakenly passed in non-IPv4 address
+ - ipv6/udp: Use the correct variable to determine non-blocking condition
+ - udp/recvmsg: Clear MSG_TRUNC flag when starting over for a new packet
+ - TTY: ldisc: Do not close until there are no readers
+ - ath5k: Disable fast channel switching by default
+ - NFS41: do not update isize if inode needs layoutcommit
+ - uvcvideo: Remove buffers from the queues when freeing
+ - KEYS: Fix error handling in construct_key_and_link()
+ - hfsplus: add missing call to bio_put()
+ - fs: fix lock initialization
+ - FS-Cache: Add a helper to bulk uncache pages on an inode
+ - NLM: Don't hang forever on NLM unlock requests
+ - netfilter: Fix ip_route_me_harder triggering ip_rt_bug
+ - xfrm: Fix off by one in the replay advance functions
+ - KVM: Fix register corruption in pvclock_scale_delta
+ For the complete list of changes, see:
+ http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.39.3
-- Ben Hutchings <ben at decadent.org.uk> Fri, 08 Jul 2011 02:10:52 +0100
Added: dists/sid/linux-2.6/debian/patches/bugfix/all/stable/2.6.39.3.patch
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/sid/linux-2.6/debian/patches/bugfix/all/stable/2.6.39.3.patch Sun Jul 10 01:48:22 2011 (r17823)
@@ -0,0 +1,3682 @@
+diff --git a/Documentation/filesystems/caching/netfs-api.txt b/Documentation/filesystems/caching/netfs-api.txt
+index a167ab8..7cc6bf2 100644
+--- a/Documentation/filesystems/caching/netfs-api.txt
++++ b/Documentation/filesystems/caching/netfs-api.txt
+@@ -673,6 +673,22 @@ storage request to complete, or it may attempt to cancel the storage request -
+ in which case the page will not be stored in the cache this time.
+
+
++BULK INODE PAGE UNCACHE
++-----------------------
++
++A convenience routine is provided to perform an uncache on all the pages
++attached to an inode. This assumes that the pages on the inode correspond on a
++1:1 basis with the pages in the cache.
++
++ void fscache_uncache_all_inode_pages(struct fscache_cookie *cookie,
++ struct inode *inode);
++
++This takes the netfs cookie that the pages were cached with and the inode that
++the pages are attached to. This function will wait for pages to finish being
++written to the cache and for the cache to finish with the page generally. No
++error is returned.
++
++
+ ==========================
+ INDEX AND DATA FILE UPDATE
+ ==========================
+diff --git a/Makefile b/Makefile
+index eb39aac..2abc88e 100644
+diff --git a/arch/arm/mach-exynos4/init.c b/arch/arm/mach-exynos4/init.c
+index cf91f50..a8a83e3 100644
+--- a/arch/arm/mach-exynos4/init.c
++++ b/arch/arm/mach-exynos4/init.c
+@@ -35,6 +35,7 @@ void __init exynos4_common_init_uarts(struct s3c2410_uartcfg *cfg, int no)
+ tcfg->clocks = exynos4_serial_clocks;
+ tcfg->clocks_size = ARRAY_SIZE(exynos4_serial_clocks);
+ }
++ tcfg->flags |= NO_NEED_CHECK_CLKSRC;
+ }
+
+ s3c24xx_init_uartdevs("s5pv210-uart", s5p_uart_resources, cfg, no);
+diff --git a/arch/arm/plat-samsung/include/plat/regs-serial.h b/arch/arm/plat-samsung/include/plat/regs-serial.h
+index 788837e..d2ef07f 100644
+--- a/arch/arm/plat-samsung/include/plat/regs-serial.h
++++ b/arch/arm/plat-samsung/include/plat/regs-serial.h
+@@ -224,6 +224,8 @@
+ #define S5PV210_UFSTAT_RXMASK (255<<0)
+ #define S5PV210_UFSTAT_RXSHIFT (0)
+
++#define NO_NEED_CHECK_CLKSRC 1
++
+ #ifndef __ASSEMBLY__
+
+ /* struct s3c24xx_uart_clksrc
+diff --git a/arch/x86/include/asm/pvclock.h b/arch/x86/include/asm/pvclock.h
+index 31d84ac..a518c0a 100644
+--- a/arch/x86/include/asm/pvclock.h
++++ b/arch/x86/include/asm/pvclock.h
+@@ -22,6 +22,8 @@ static inline u64 pvclock_scale_delta(u64 delta, u32 mul_frac, int shift)
+ u64 product;
+ #ifdef __i386__
+ u32 tmp1, tmp2;
++#else
++ ulong tmp;
+ #endif
+
+ if (shift < 0)
+@@ -42,8 +44,11 @@ static inline u64 pvclock_scale_delta(u64 delta, u32 mul_frac, int shift)
+ : "a" ((u32)delta), "1" ((u32)(delta >> 32)), "2" (mul_frac) );
+ #elif defined(__x86_64__)
+ __asm__ (
+- "mul %%rdx ; shrd $32,%%rdx,%%rax"
+- : "=a" (product) : "0" (delta), "d" ((u64)mul_frac) );
++ "mul %[mul_frac] ; shrd $32, %[hi], %[lo]"
++ : [lo]"=a"(product),
++ [hi]"=d"(tmp)
++ : "0"(delta),
++ [mul_frac]"rm"((u64)mul_frac));
+ #else
+ #error implement me!
+ #endif
+diff --git a/arch/x86/kernel/acpi/realmode/wakeup.S b/arch/x86/kernel/acpi/realmode/wakeup.S
+index ead21b6..b4fd836 100644
+--- a/arch/x86/kernel/acpi/realmode/wakeup.S
++++ b/arch/x86/kernel/acpi/realmode/wakeup.S
+@@ -28,6 +28,8 @@ pmode_cr3: .long 0 /* Saved %cr3 */
+ pmode_cr4: .long 0 /* Saved %cr4 */
+ pmode_efer: .quad 0 /* Saved EFER */
+ pmode_gdt: .quad 0
++pmode_misc_en: .quad 0 /* Saved MISC_ENABLE MSR */
++pmode_behavior: .long 0 /* Wakeup behavior flags */
+ realmode_flags: .long 0
+ real_magic: .long 0
+ trampoline_segment: .word 0
+@@ -91,6 +93,18 @@ wakeup_code:
+ /* Call the C code */
+ calll main
+
++ /* Restore MISC_ENABLE before entering protected mode, in case
++ BIOS decided to clear XD_DISABLE during S3. */
++ movl pmode_behavior, %eax
++ btl $WAKEUP_BEHAVIOR_RESTORE_MISC_ENABLE, %eax
++ jnc 1f
++
++ movl pmode_misc_en, %eax
++ movl pmode_misc_en + 4, %edx
++ movl $MSR_IA32_MISC_ENABLE, %ecx
++ wrmsr
++1:
++
+ /* Do any other stuff... */
+
+ #ifndef CONFIG_64BIT
+diff --git a/arch/x86/kernel/acpi/realmode/wakeup.h b/arch/x86/kernel/acpi/realmode/wakeup.h
+index e1828c0..97a29e1 100644
+--- a/arch/x86/kernel/acpi/realmode/wakeup.h
++++ b/arch/x86/kernel/acpi/realmode/wakeup.h
+@@ -21,6 +21,9 @@ struct wakeup_header {
+ u32 pmode_efer_low; /* Protected mode EFER */
+ u32 pmode_efer_high;
+ u64 pmode_gdt;
++ u32 pmode_misc_en_low; /* Protected mode MISC_ENABLE */
++ u32 pmode_misc_en_high;
++ u32 pmode_behavior; /* Wakeup routine behavior flags */
+ u32 realmode_flags;
+ u32 real_magic;
+ u16 trampoline_segment; /* segment with trampoline code, 64-bit only */
+@@ -39,4 +42,7 @@ extern struct wakeup_header wakeup_header;
+ #define WAKEUP_HEADER_SIGNATURE 0x51ee1111
+ #define WAKEUP_END_SIGNATURE 0x65a22c82
+
++/* Wakeup behavior bits */
++#define WAKEUP_BEHAVIOR_RESTORE_MISC_ENABLE 0
++
+ #endif /* ARCH_X86_KERNEL_ACPI_RM_WAKEUP_H */
+diff --git a/arch/x86/kernel/acpi/sleep.c b/arch/x86/kernel/acpi/sleep.c
+index ff93bc1..cdddffc 100644
+--- a/arch/x86/kernel/acpi/sleep.c
++++ b/arch/x86/kernel/acpi/sleep.c
+@@ -77,6 +77,12 @@ int acpi_suspend_lowlevel(void)
+
+ header->pmode_cr0 = read_cr0();
+ header->pmode_cr4 = read_cr4_safe();
++ header->pmode_behavior = 0;
++ if (!rdmsr_safe(MSR_IA32_MISC_ENABLE,
++ &header->pmode_misc_en_low,
++ &header->pmode_misc_en_high))
++ header->pmode_behavior |=
++ (1 << WAKEUP_BEHAVIOR_RESTORE_MISC_ENABLE);
+ header->realmode_flags = acpi_realmode_flags;
+ header->real_magic = 0x12345678;
+
+diff --git a/arch/x86/oprofile/nmi_int.c b/arch/x86/oprofile/nmi_int.c
+index cf97500..68894fd 100644
+--- a/arch/x86/oprofile/nmi_int.c
++++ b/arch/x86/oprofile/nmi_int.c
+@@ -112,8 +112,10 @@ static void nmi_cpu_start(void *dummy)
+ static int nmi_start(void)
+ {
+ get_online_cpus();
+- on_each_cpu(nmi_cpu_start, NULL, 1);
+ ctr_running = 1;
++ /* make ctr_running visible to the nmi handler: */
++ smp_mb();
++ on_each_cpu(nmi_cpu_start, NULL, 1);
+ put_online_cpus();
+ return 0;
+ }
+@@ -504,15 +506,18 @@ static int nmi_setup(void)
+
+ nmi_enabled = 0;
+ ctr_running = 0;
+- barrier();
++ /* make variables visible to the nmi handler: */
++ smp_mb();
+ err = register_die_notifier(&profile_exceptions_nb);
+ if (err)
+ goto fail;
+
+ get_online_cpus();
+ register_cpu_notifier(&oprofile_cpu_nb);
+- on_each_cpu(nmi_cpu_setup, NULL, 1);
+ nmi_enabled = 1;
++ /* make nmi_enabled visible to the nmi handler: */
++ smp_mb();
++ on_each_cpu(nmi_cpu_setup, NULL, 1);
+ put_online_cpus();
+
+ return 0;
+@@ -531,7 +536,8 @@ static void nmi_shutdown(void)
+ nmi_enabled = 0;
+ ctr_running = 0;
+ put_online_cpus();
+- barrier();
++ /* make variables visible to the nmi handler: */
++ smp_mb();
+ unregister_die_notifier(&profile_exceptions_nb);
+ msrs = &get_cpu_var(cpu_msrs);
+ model->shutdown(msrs);
+diff --git a/arch/x86/pci/xen.c b/arch/x86/pci/xen.c
+index e37b407..632ba33 100644
+--- a/arch/x86/pci/xen.c
++++ b/arch/x86/pci/xen.c
+@@ -316,7 +316,7 @@ int __init pci_xen_hvm_init(void)
+ }
+
+ #ifdef CONFIG_XEN_DOM0
+-static int xen_register_pirq(u32 gsi, int triggering)
++static int xen_register_pirq(u32 gsi, int gsi_override, int triggering)
+ {
+ int rc, pirq, irq = -1;
+ struct physdev_map_pirq map_irq;
+@@ -333,16 +333,18 @@ static int xen_register_pirq(u32 gsi, int triggering)
+ shareable = 1;
+ name = "ioapic-level";
+ }
+-
+ pirq = xen_allocate_pirq_gsi(gsi);
+ if (pirq < 0)
+ goto out;
+
+- irq = xen_bind_pirq_gsi_to_irq(gsi, pirq, shareable, name);
++ if (gsi_override >= 0)
++ irq = xen_bind_pirq_gsi_to_irq(gsi_override, pirq, shareable, name);
++ else
++ irq = xen_bind_pirq_gsi_to_irq(gsi, pirq, shareable, name);
+ if (irq < 0)
+ goto out;
+
+- printk(KERN_DEBUG "xen: --> pirq=%d -> irq=%d\n", pirq, irq);
++ printk(KERN_DEBUG "xen: --> pirq=%d -> irq=%d (gsi=%d)\n", pirq, irq, gsi);
+
+ map_irq.domid = DOMID_SELF;
+ map_irq.type = MAP_PIRQ_TYPE_GSI;
+@@ -359,7 +361,7 @@ out:
+ return irq;
+ }
+
+-static int xen_register_gsi(u32 gsi, int triggering, int polarity)
++static int xen_register_gsi(u32 gsi, int gsi_override, int triggering, int polarity)
+ {
+ int rc, irq;
+ struct physdev_setup_gsi setup_gsi;
+@@ -370,7 +372,7 @@ static int xen_register_gsi(u32 gsi, int triggering, int polarity)
+ printk(KERN_DEBUG "xen: registering gsi %u triggering %d polarity %d\n",
+ gsi, triggering, polarity);
+
+- irq = xen_register_pirq(gsi, triggering);
++ irq = xen_register_pirq(gsi, gsi_override, triggering);
+
+ setup_gsi.gsi = gsi;
+ setup_gsi.triggering = (triggering == ACPI_EDGE_SENSITIVE ? 0 : 1);
+@@ -392,6 +394,8 @@ static __init void xen_setup_acpi_sci(void)
+ int rc;
+ int trigger, polarity;
+ int gsi = acpi_sci_override_gsi;
++ int irq = -1;
++ int gsi_override = -1;
+
+ if (!gsi)
+ return;
+@@ -408,7 +412,25 @@ static __init void xen_setup_acpi_sci(void)
+ printk(KERN_INFO "xen: sci override: global_irq=%d trigger=%d "
+ "polarity=%d\n", gsi, trigger, polarity);
+
+- gsi = xen_register_gsi(gsi, trigger, polarity);
++ /* Before we bind the GSI to a Linux IRQ, check whether
++ * we need to override it with bus_irq (IRQ) value. Usually for
++ * IRQs below IRQ_LEGACY_IRQ this holds IRQ == GSI, as so:
++ * ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 9 low level)
++ * but there are oddballs where the IRQ != GSI:
++ * ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 20 low level)
++ * which ends up being: gsi_to_irq[9] == 20
++ * (which is what acpi_gsi_to_irq ends up calling when starting the
++ * the ACPI interpreter and keels over since IRQ 9 has not been
++ * setup as we had setup IRQ 20 for it).
++ */
++ /* Check whether the GSI != IRQ */
++ if (acpi_gsi_to_irq(gsi, &irq) == 0) {
++ if (irq >= 0 && irq != gsi)
++ /* Bugger, we MUST have that IRQ. */
++ gsi_override = irq;
++ }
++
++ gsi = xen_register_gsi(gsi, gsi_override, trigger, polarity);
+ printk(KERN_INFO "xen: acpi sci %d\n", gsi);
+
+ return;
+@@ -417,7 +439,7 @@ static __init void xen_setup_acpi_sci(void)
+ static int acpi_register_gsi_xen(struct device *dev, u32 gsi,
+ int trigger, int polarity)
+ {
+- return xen_register_gsi(gsi, trigger, polarity);
++ return xen_register_gsi(gsi, -1 /* no GSI override */, trigger, polarity);
+ }
+
+ static int __init pci_xen_initial_domain(void)
+@@ -456,7 +478,7 @@ void __init xen_setup_pirqs(void)
+ if (acpi_get_override_irq(irq, &trigger, &polarity) == -1)
+ continue;
+
+- xen_register_pirq(irq,
++ xen_register_pirq(irq, -1 /* no GSI override */,
+ trigger ? ACPI_LEVEL_SENSITIVE : ACPI_EDGE_SENSITIVE);
+ }
+ }
+diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
+index f298bd7..0d668d1 100644
+--- a/arch/x86/xen/mmu.c
++++ b/arch/x86/xen/mmu.c
+@@ -59,6 +59,7 @@
+ #include <asm/page.h>
+ #include <asm/init.h>
+ #include <asm/pat.h>
++#include <asm/smp.h>
+
+ #include <asm/xen/hypercall.h>
+ #include <asm/xen/hypervisor.h>
+@@ -1353,7 +1354,11 @@ static void xen_flush_tlb_others(const struct cpumask *cpus,
+ {
+ struct {
+ struct mmuext_op op;
++#ifdef CONFIG_SMP
++ DECLARE_BITMAP(mask, num_processors);
++#else
+ DECLARE_BITMAP(mask, NR_CPUS);
++#endif
+ } *args;
+ struct multicall_space mcs;
+
+@@ -1721,6 +1726,11 @@ static __init void xen_map_identity_early(pmd_t *pmd, unsigned long max_pfn)
+ for (pteidx = 0; pteidx < PTRS_PER_PTE; pteidx++, pfn++) {
+ pte_t pte;
+
++#ifdef CONFIG_X86_32
++ if (pfn > max_pfn_mapped)
++ max_pfn_mapped = pfn;
++#endif
++
+ if (!pte_none(pte_page[pteidx]))
+ continue;
+
+@@ -1888,7 +1898,9 @@ __init pgd_t *xen_setup_kernel_pagetable(pgd_t *pgd,
+ initial_kernel_pmd =
+ extend_brk(sizeof(pmd_t) * PTRS_PER_PMD, PAGE_SIZE);
+
+- max_pfn_mapped = PFN_DOWN(__pa(xen_start_info->mfn_list));
++ max_pfn_mapped = PFN_DOWN(__pa(xen_start_info->pt_base) +
++ xen_start_info->nr_pt_frames * PAGE_SIZE +
++ 512*1024);
+
+ kernel_pmd = m2v(pgd[KERNEL_PGD_BOUNDARY].pgd);
+ memcpy(initial_kernel_pmd, kernel_pmd, sizeof(pmd_t) * PTRS_PER_PMD);
+diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
+index 3061244..ae49046 100644
+--- a/arch/x86/xen/smp.c
++++ b/arch/x86/xen/smp.c
+@@ -206,11 +206,18 @@ static void __init xen_smp_prepare_boot_cpu(void)
+ static void __init xen_smp_prepare_cpus(unsigned int max_cpus)
+ {
+ unsigned cpu;
++ unsigned int i;
+
+ xen_init_lock_cpu(0);
+
+ smp_store_cpu_info(0);
+ cpu_data(0).x86_max_cores = 1;
++
++ for_each_possible_cpu(i) {
++ zalloc_cpumask_var(&per_cpu(cpu_sibling_map, i), GFP_KERNEL);
++ zalloc_cpumask_var(&per_cpu(cpu_core_map, i), GFP_KERNEL);
++ zalloc_cpumask_var(&per_cpu(cpu_llc_shared_map, i), GFP_KERNEL);
++ }
+ set_cpu_sibling_map(0);
+
+ if (xen_smp_intr_init(0))
+diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
+index ab7a9e6..bd2fa5f 100644
+--- a/block/cfq-iosched.c
++++ b/block/cfq-iosched.c
+@@ -2704,8 +2704,14 @@ static void __cfq_exit_single_io_context(struct cfq_data *cfqd,
+ smp_wmb();
+ cic->key = cfqd_dead_key(cfqd);
+
+- if (ioc->ioc_data == cic)
++ rcu_read_lock();
++ if (rcu_dereference(ioc->ioc_data) == cic) {
++ rcu_read_unlock();
++ spin_lock(&ioc->lock);
+ rcu_assign_pointer(ioc->ioc_data, NULL);
++ spin_unlock(&ioc->lock);
++ } else
++ rcu_read_unlock();
+
+ if (cic->cfqq[BLK_RW_ASYNC]) {
+ cfq_exit_cfqq(cfqd, cic->cfqq[BLK_RW_ASYNC]);
+@@ -3012,7 +3018,8 @@ cfq_drop_dead_cic(struct cfq_data *cfqd, struct io_context *ioc,
+
+ spin_lock_irqsave(&ioc->lock, flags);
+
+- BUG_ON(ioc->ioc_data == cic);
++ BUG_ON(rcu_dereference_check(ioc->ioc_data,
++ lockdep_is_held(&ioc->lock)) == cic);
+
+ radix_tree_delete(&ioc->radix_root, cfqd->cic_index);
+ hlist_del_rcu(&cic->cic_list);
+diff --git a/drivers/base/platform.c b/drivers/base/platform.c
+index 9e0e4fc..5d5bd1a 100644
+--- a/drivers/base/platform.c
++++ b/drivers/base/platform.c
+@@ -367,7 +367,7 @@ EXPORT_SYMBOL_GPL(platform_device_unregister);
+ *
+ * Returns &struct platform_device pointer on success, or ERR_PTR() on error.
+ */
+-struct platform_device *__init_or_module platform_device_register_resndata(
++struct platform_device *platform_device_register_resndata(
+ struct device *parent,
+ const char *name, int id,
+ const struct resource *res, unsigned int num,
+diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
+index abe3ab7..631b5d3 100644
+--- a/drivers/base/power/main.c
++++ b/drivers/base/power/main.c
+@@ -57,7 +57,8 @@ static int async_error;
+ */
+ void device_pm_init(struct device *dev)
+ {
+- dev->power.in_suspend = false;
++ dev->power.is_prepared = false;
++ dev->power.is_suspended = false;
+ init_completion(&dev->power.completion);
+ complete_all(&dev->power.completion);
+ dev->power.wakeup = NULL;
+@@ -91,7 +92,7 @@ void device_pm_add(struct device *dev)
+ pr_debug("PM: Adding info for %s:%s\n",
+ dev->bus ? dev->bus->name : "No Bus", dev_name(dev));
+ mutex_lock(&dpm_list_mtx);
+- if (dev->parent && dev->parent->power.in_suspend)
++ if (dev->parent && dev->parent->power.is_prepared)
+ dev_warn(dev, "parent %s should not be sleeping\n",
+ dev_name(dev->parent));
+ list_add_tail(&dev->power.entry, &dpm_list);
+@@ -513,7 +514,14 @@ static int device_resume(struct device *dev, pm_message_t state, bool async)
+ dpm_wait(dev->parent, async);
+ device_lock(dev);
+
+- dev->power.in_suspend = false;
++ /*
++ * This is a fib. But we'll allow new children to be added below
++ * a resumed device, even if the device hasn't been completed yet.
++ */
++ dev->power.is_prepared = false;
++
++ if (!dev->power.is_suspended)
++ goto Unlock;
+
+ if (dev->pwr_domain) {
+ pm_dev_dbg(dev, state, "power domain ");
+@@ -549,6 +557,9 @@ static int device_resume(struct device *dev, pm_message_t state, bool async)
+ }
+
+ End:
++ dev->power.is_suspended = false;
++
++ Unlock:
+ device_unlock(dev);
+ complete_all(&dev->power.completion);
+
+@@ -668,7 +679,7 @@ static void dpm_complete(pm_message_t state)
+ struct device *dev = to_device(dpm_prepared_list.prev);
+
+ get_device(dev);
+- dev->power.in_suspend = false;
++ dev->power.is_prepared = false;
+ list_move(&dev->power.entry, &list);
+ mutex_unlock(&dpm_list_mtx);
+
+@@ -834,11 +845,11 @@ static int __device_suspend(struct device *dev, pm_message_t state, bool async)
+ device_lock(dev);
+
+ if (async_error)
+- goto End;
++ goto Unlock;
+
+ if (pm_wakeup_pending()) {
+ async_error = -EBUSY;
+- goto End;
++ goto Unlock;
+ }
+
+ if (dev->type && dev->type->pm) {
+@@ -876,6 +887,9 @@ static int __device_suspend(struct device *dev, pm_message_t state, bool async)
+ }
+
+ End:
++ dev->power.is_suspended = !error;
++
++ Unlock:
+ device_unlock(dev);
+ complete_all(&dev->power.completion);
+
+@@ -1037,7 +1051,7 @@ static int dpm_prepare(pm_message_t state)
+ put_device(dev);
+ break;
+ }
+- dev->power.in_suspend = true;
++ dev->power.is_prepared = true;
+ if (!list_empty(&dev->power.entry))
+ list_move_tail(&dev->power.entry, &dpm_prepared_list);
+ put_device(dev);
+diff --git a/drivers/connector/connector.c b/drivers/connector/connector.c
+index 219d88a..dde6a0f 100644
+--- a/drivers/connector/connector.c
++++ b/drivers/connector/connector.c
+@@ -139,6 +139,7 @@ static int cn_call_callback(struct sk_buff *skb)
+ spin_unlock_bh(&dev->cbdev->queue_lock);
+
+ if (cbq != NULL) {
++ err = 0;
+ cbq->callback(msg, nsp);
+ kfree_skb(skb);
+ cn_queue_release_callback(cbq);
+diff --git a/drivers/gpu/drm/drm_pci.c b/drivers/gpu/drm/drm_pci.c
+index e1aee4f..b6a19cb 100644
+--- a/drivers/gpu/drm/drm_pci.c
++++ b/drivers/gpu/drm/drm_pci.c
+@@ -251,7 +251,7 @@ err:
+ }
+
+
+-int drm_pci_irq_by_busid(struct drm_device *dev, struct drm_irq_busid *p)
++static int drm_pci_irq_by_busid(struct drm_device *dev, struct drm_irq_busid *p)
+ {
+ if ((p->busnum >> 8) != drm_get_pci_domain(dev) ||
+ (p->busnum & 0xff) != dev->pdev->bus->number ||
+@@ -292,6 +292,7 @@ static struct drm_bus drm_pci_bus = {
+ .get_name = drm_pci_get_name,
+ .set_busid = drm_pci_set_busid,
+ .set_unique = drm_pci_set_unique,
++ .irq_by_busid = drm_pci_irq_by_busid,
+ .agp_init = drm_pci_agp_init,
+ };
+
+diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
+index 188b497..58c7f27 100644
+--- a/drivers/gpu/drm/i915/i915_irq.c
++++ b/drivers/gpu/drm/i915/i915_irq.c
+@@ -1567,6 +1567,17 @@ static void ironlake_irq_preinstall(struct drm_device *dev)
+ drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+
+ I915_WRITE(HWSTAM, 0xeffe);
++ if (IS_GEN6(dev)) {
++ /* Workaround stalls observed on Sandy Bridge GPUs by
++ * making the blitter command streamer generate a
++ * write to the Hardware Status Page for
++ * MI_USER_INTERRUPT. This appears to serialize the
++ * previous seqno write out before the interrupt
++ * happens.
++ */
++ I915_WRITE(GEN6_BLITTER_HWSTAM, ~GEN6_BLITTER_USER_INTERRUPT);
++ I915_WRITE(GEN6_BSD_HWSTAM, ~GEN6_BSD_USER_INTERRUPT);
++ }
+
+ /* XXX hotplug from PCH */
+
+diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
+index f39ac3a..5a96fd1 100644
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -528,6 +528,7 @@
+ #define GEN6_BSD_SLEEP_PSMI_CONTROL_RC_ILDL_MESSAGE_ENABLE 0
+ #define GEN6_BSD_SLEEP_PSMI_CONTROL_IDLE_INDICATOR (1 << 3)
+
++#define GEN6_BSD_HWSTAM 0x12098
+ #define GEN6_BSD_IMR 0x120a8
+ #define GEN6_BSD_USER_INTERRUPT (1 << 12)
+
+diff --git a/drivers/gpu/drm/i915/intel_i2c.c b/drivers/gpu/drm/i915/intel_i2c.c
+index d3b903b..d98cee6 100644
+--- a/drivers/gpu/drm/i915/intel_i2c.c
++++ b/drivers/gpu/drm/i915/intel_i2c.c
+@@ -401,8 +401,7 @@ int intel_setup_gmbus(struct drm_device *dev)
+ bus->reg0 = i | GMBUS_RATE_100KHZ;
+
+ /* XXX force bit banging until GMBUS is fully debugged */
+- if (IS_GEN2(dev))
+- bus->force_bit = intel_gpio_create(dev_priv, i);
++ bus->force_bit = intel_gpio_create(dev_priv, i);
+ }
+
+ intel_i2c_reset(dev_priv->dev);
+diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c
+index b427488..9423fba 100644
+--- a/drivers/gpu/drm/radeon/radeon_encoders.c
++++ b/drivers/gpu/drm/radeon/radeon_encoders.c
+@@ -1294,7 +1294,11 @@ radeon_atom_encoder_dpms(struct drm_encoder *encoder, int mode)
+ if (is_dig) {
+ switch (mode) {
+ case DRM_MODE_DPMS_ON:
+- atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT, 0, 0);
++ /* some early dce3.2 boards have a bug in their transmitter control table */
++ if ((rdev->family == CHIP_RV710) || (rdev->family == CHIP_RV730))
++ atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE, 0, 0);
++ else
++ atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT, 0, 0);
+ if (atombios_get_encoder_mode(encoder) == ATOM_ENCODER_MODE_DP) {
+ struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
+
+diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
+index ef8a5ba..05aa674 100644
+--- a/drivers/gpu/drm/radeon/rv770.c
++++ b/drivers/gpu/drm/radeon/rv770.c
+@@ -572,6 +572,12 @@ static void rv770_program_channel_remap(struct radeon_device *rdev)
+ else
+ tcp_chan_steer = 0x00fac688;
+
++ /* RV770 CE has special chremap setup */
++ if (rdev->pdev->device == 0x944e) {
++ tcp_chan_steer = 0x00b08b08;
++ mc_shared_chremap = 0x00b08b08;
++ }
++
+ WREG32(TCP_CHAN_STEER, tcp_chan_steer);
+ WREG32(MC_SHARED_CHREMAP, mc_shared_chremap);
+ }
+diff --git a/drivers/hwmon/ibmaem.c b/drivers/hwmon/ibmaem.c
+index bc6e2ab..affc17e 100644
+--- a/drivers/hwmon/ibmaem.c
++++ b/drivers/hwmon/ibmaem.c
+@@ -947,6 +947,7 @@ static int aem_register_sensors(struct aem_data *data,
+
+ /* Set up read-only sensors */
+ while (ro->label) {
++ sysfs_attr_init(&sensors->dev_attr.attr);
+ sensors->dev_attr.attr.name = ro->label;
+ sensors->dev_attr.attr.mode = S_IRUGO;
+ sensors->dev_attr.show = ro->show;
+@@ -963,6 +964,7 @@ static int aem_register_sensors(struct aem_data *data,
+
+ /* Set up read-write sensors */
+ while (rw->label) {
++ sysfs_attr_init(&sensors->dev_attr.attr);
+ sensors->dev_attr.attr.name = rw->label;
+ sensors->dev_attr.attr.mode = S_IRUGO | S_IWUSR;
+ sensors->dev_attr.show = rw->show;
+diff --git a/drivers/hwmon/ibmpex.c b/drivers/hwmon/ibmpex.c
+index 06d4eaf..41dbf81 100644
+--- a/drivers/hwmon/ibmpex.c
++++ b/drivers/hwmon/ibmpex.c
+@@ -358,6 +358,7 @@ static int create_sensor(struct ibmpex_bmc_data *data, int type,
+ else if (type == POWER_SENSOR)
+ sprintf(n, power_sensor_name_templates[func], "power", counter);
+
++ sysfs_attr_init(&data->sensors[sensor].attr[func].dev_attr.attr);
+ data->sensors[sensor].attr[func].dev_attr.attr.name = n;
+ data->sensors[sensor].attr[func].dev_attr.attr.mode = S_IRUGO;
+ data->sensors[sensor].attr[func].dev_attr.show = ibmpex_show_sensor;
+diff --git a/drivers/hwmon/s3c-hwmon.c b/drivers/hwmon/s3c-hwmon.c
+index 92b42db..b39f52e 100644
+--- a/drivers/hwmon/s3c-hwmon.c
++++ b/drivers/hwmon/s3c-hwmon.c
+@@ -232,6 +232,7 @@ static int s3c_hwmon_create_attr(struct device *dev,
+
+ attr = &attrs->in;
+ attr->index = channel;
++ sysfs_attr_init(&attr->dev_attr.attr);
+ attr->dev_attr.attr.name = attrs->in_name;
+ attr->dev_attr.attr.mode = S_IRUGO;
+ attr->dev_attr.show = s3c_hwmon_ch_show;
+@@ -249,6 +250,7 @@ static int s3c_hwmon_create_attr(struct device *dev,
+
+ attr = &attrs->label;
+ attr->index = channel;
++ sysfs_attr_init(&attr->dev_attr.attr);
+ attr->dev_attr.attr.name = attrs->label_name;
+ attr->dev_attr.attr.mode = S_IRUGO;
+ attr->dev_attr.show = s3c_hwmon_label_show;
+diff --git a/drivers/i2c/busses/i2c-taos-evm.c b/drivers/i2c/busses/i2c-taos-evm.c
+index dd39c1e..26c352a 100644
+--- a/drivers/i2c/busses/i2c-taos-evm.c
++++ b/drivers/i2c/busses/i2c-taos-evm.c
+@@ -234,7 +234,7 @@ static int taos_connect(struct serio *serio, struct serio_driver *drv)
+
+ if (taos->state != TAOS_STATE_IDLE) {
+ err = -ENODEV;
+- dev_dbg(&serio->dev, "TAOS EVM reset failed (state=%d, "
++ dev_err(&serio->dev, "TAOS EVM reset failed (state=%d, "
+ "pos=%d)\n", taos->state, taos->pos);
+ goto exit_close;
+ }
+@@ -255,7 +255,7 @@ static int taos_connect(struct serio *serio, struct serio_driver *drv)
+ msecs_to_jiffies(250));
+ if (taos->state != TAOS_STATE_IDLE) {
+ err = -ENODEV;
+- dev_err(&adapter->dev, "Echo off failed "
++ dev_err(&serio->dev, "TAOS EVM echo off failed "
+ "(state=%d)\n", taos->state);
+ goto exit_close;
+ }
+@@ -263,7 +263,7 @@ static int taos_connect(struct serio *serio, struct serio_driver *drv)
+ err = i2c_add_adapter(adapter);
+ if (err)
+ goto exit_close;
+- dev_dbg(&serio->dev, "Connected to TAOS EVM\n");
++ dev_info(&serio->dev, "Connected to TAOS EVM\n");
+
+ taos->client = taos_instantiate_device(adapter);
+ return 0;
+@@ -288,7 +288,7 @@ static void taos_disconnect(struct serio *serio)
+ serio_set_drvdata(serio, NULL);
+ kfree(taos);
+
+- dev_dbg(&serio->dev, "Disconnected from TAOS EVM\n");
++ dev_info(&serio->dev, "Disconnected from TAOS EVM\n");
+ }
+
+ static struct serio_device_id taos_serio_ids[] = {
+diff --git a/drivers/i2c/muxes/pca954x.c b/drivers/i2c/muxes/pca954x.c
+index 54e1ce7..6f89536 100644
+--- a/drivers/i2c/muxes/pca954x.c
++++ b/drivers/i2c/muxes/pca954x.c
+@@ -201,10 +201,11 @@ static int pca954x_probe(struct i2c_client *client,
+
+ i2c_set_clientdata(client, data);
+
+- /* Read the mux register at addr to verify
+- * that the mux is in fact present.
++ /* Write the mux register at addr to verify
++ * that the mux is in fact present. This also
++ * initializes the mux to disconnected state.
+ */
+- if (i2c_smbus_read_byte(client) < 0) {
++ if (i2c_smbus_write_byte(client, 0) < 0) {
+ dev_warn(&client->dev, "probe failed\n");
+ goto exit_free;
+ }
+diff --git a/drivers/input/input.c b/drivers/input/input.c
+index ebbceed..e3c88fc 100644
+--- a/drivers/input/input.c
++++ b/drivers/input/input.c
+@@ -1757,7 +1757,7 @@ static unsigned int input_estimate_events_per_packet(struct input_dev *dev)
+ } else if (test_bit(ABS_MT_TRACKING_ID, dev->absbit)) {
+ mt_slots = dev->absinfo[ABS_MT_TRACKING_ID].maximum -
+ dev->absinfo[ABS_MT_TRACKING_ID].minimum + 1,
+- clamp(mt_slots, 2, 32);
++ mt_slots = clamp(mt_slots, 2, 32);
+ } else if (test_bit(ABS_MT_POSITION_X, dev->absbit)) {
+ mt_slots = 2;
+ } else {
+diff --git a/drivers/input/mousedev.c b/drivers/input/mousedev.c
+index 7630273..f8ba7c9 100644
+--- a/drivers/input/mousedev.c
++++ b/drivers/input/mousedev.c
+@@ -187,7 +187,7 @@ static void mousedev_abs_event(struct input_dev *dev, struct mousedev *mousedev,
+ if (size == 0)
+ size = xres ? : 1;
+
+- clamp(value, min, max);
++ value = clamp(value, min, max);
+
+ mousedev->packet.x = ((value - min) * xres) / size;
+ mousedev->packet.abs_event = 1;
+@@ -201,7 +201,7 @@ static void mousedev_abs_event(struct input_dev *dev, struct mousedev *mousedev,
+ if (size == 0)
+ size = yres ? : 1;
+
+- clamp(value, min, max);
++ value = clamp(value, min, max);
+
+ mousedev->packet.y = yres - ((value - min) * yres) / size;
+ mousedev->packet.abs_event = 1;
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 9930792..a7ed02c 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -7062,6 +7062,7 @@ static int remove_and_add_spares(mddev_t *mddev)
+ list_for_each_entry(rdev, &mddev->disks, same_set) {
+ if (rdev->raid_disk >= 0 &&
+ !test_bit(In_sync, &rdev->flags) &&
++ !test_bit(Faulty, &rdev->flags) &&
+ !test_bit(Blocked, &rdev->flags))
+ spares++;
+ if (rdev->raid_disk < 0
+diff --git a/drivers/media/rc/ir-raw.c b/drivers/media/rc/ir-raw.c
+index 11c19d8..423ed45 100644
+--- a/drivers/media/rc/ir-raw.c
++++ b/drivers/media/rc/ir-raw.c
+@@ -114,18 +114,20 @@ int ir_raw_event_store_edge(struct rc_dev *dev, enum raw_event_type type)
+ s64 delta; /* ns */
+ DEFINE_IR_RAW_EVENT(ev);
+ int rc = 0;
++ int delay;
+
+ if (!dev->raw)
+ return -EINVAL;
+
+ now = ktime_get();
+ delta = ktime_to_ns(ktime_sub(now, dev->raw->last_event));
++ delay = MS_TO_NS(dev->input_dev->rep[REP_DELAY]);
+
+ /* Check for a long duration since last event or if we're
+ * being called for the first time, note that delta can't
+ * possibly be negative.
+ */
+- if (delta > IR_MAX_DURATION || !dev->raw->last_type)
++ if (delta > delay || !dev->raw->last_type)
+ type |= IR_START_EVENT;
+ else
+ ev.duration = delta;
+diff --git a/drivers/media/rc/ite-cir.c b/drivers/media/rc/ite-cir.c
+index 43908a7..c1717bf 100644
+--- a/drivers/media/rc/ite-cir.c
++++ b/drivers/media/rc/ite-cir.c
+@@ -1357,6 +1357,7 @@ static const struct ite_dev_params ite_dev_descs[] = {
+ { /* 0: ITE8704 */
+ .model = "ITE8704 CIR transceiver",
+ .io_region_size = IT87_IOREG_LENGTH,
++ .io_rsrc_no = 0,
+ .hw_tx_capable = true,
+ .sample_period = (u32) (1000000000ULL / 115200),
+ .tx_carrier_freq = 38000,
+@@ -1381,6 +1382,7 @@ static const struct ite_dev_params ite_dev_descs[] = {
+ { /* 1: ITE8713 */
+ .model = "ITE8713 CIR transceiver",
+ .io_region_size = IT87_IOREG_LENGTH,
++ .io_rsrc_no = 0,
+ .hw_tx_capable = true,
+ .sample_period = (u32) (1000000000ULL / 115200),
+ .tx_carrier_freq = 38000,
+@@ -1405,6 +1407,7 @@ static const struct ite_dev_params ite_dev_descs[] = {
+ { /* 2: ITE8708 */
+ .model = "ITE8708 CIR transceiver",
+ .io_region_size = IT8708_IOREG_LENGTH,
++ .io_rsrc_no = 0,
+ .hw_tx_capable = true,
+ .sample_period = (u32) (1000000000ULL / 115200),
+ .tx_carrier_freq = 38000,
+@@ -1430,6 +1433,7 @@ static const struct ite_dev_params ite_dev_descs[] = {
+ { /* 3: ITE8709 */
+ .model = "ITE8709 CIR transceiver",
+ .io_region_size = IT8709_IOREG_LENGTH,
++ .io_rsrc_no = 2,
+ .hw_tx_capable = true,
+ .sample_period = (u32) (1000000000ULL / 115200),
+ .tx_carrier_freq = 38000,
+@@ -1471,6 +1475,7 @@ static int ite_probe(struct pnp_dev *pdev, const struct pnp_device_id
+ struct rc_dev *rdev = NULL;
+ int ret = -ENOMEM;
+ int model_no;
++ int io_rsrc_no;
+
+ ite_dbg("%s called", __func__);
+
+@@ -1500,10 +1505,11 @@ static int ite_probe(struct pnp_dev *pdev, const struct pnp_device_id
+
+ /* get the description for the device */
+ dev_desc = &ite_dev_descs[model_no];
++ io_rsrc_no = dev_desc->io_rsrc_no;
+
+ /* validate pnp resources */
+- if (!pnp_port_valid(pdev, 0) ||
+- pnp_port_len(pdev, 0) != dev_desc->io_region_size) {
++ if (!pnp_port_valid(pdev, io_rsrc_no) ||
++ pnp_port_len(pdev, io_rsrc_no) != dev_desc->io_region_size) {
+ dev_err(&pdev->dev, "IR PNP Port not valid!\n");
+ goto failure;
+ }
+@@ -1514,7 +1520,7 @@ static int ite_probe(struct pnp_dev *pdev, const struct pnp_device_id
+ }
+
+ /* store resource values */
+- itdev->cir_addr = pnp_port_start(pdev, 0);
++ itdev->cir_addr = pnp_port_start(pdev, io_rsrc_no);
+ itdev->cir_irq = pnp_irq(pdev, 0);
+
+ /* initialize spinlocks */
+diff --git a/drivers/media/rc/ite-cir.h b/drivers/media/rc/ite-cir.h
+index 16a19f5..aa899a0 100644
+--- a/drivers/media/rc/ite-cir.h
++++ b/drivers/media/rc/ite-cir.h
+@@ -57,6 +57,9 @@ struct ite_dev_params {
+ /* size of the I/O region */
+ int io_region_size;
+
++ /* IR pnp I/O resource number */
++ int io_rsrc_no;
++
+ /* true if the hardware supports transmission */
+ bool hw_tx_capable;
+
+diff --git a/drivers/media/rc/keymaps/rc-pinnacle-pctv-hd.c b/drivers/media/rc/keymaps/rc-pinnacle-pctv-hd.c
+index bb10ffe..8d558ae 100644
+--- a/drivers/media/rc/keymaps/rc-pinnacle-pctv-hd.c
++++ b/drivers/media/rc/keymaps/rc-pinnacle-pctv-hd.c
+@@ -15,43 +15,39 @@
+ /* Pinnacle PCTV HD 800i mini remote */
+
+ static struct rc_map_table pinnacle_pctv_hd[] = {
+-
+- { 0x0f, KEY_1 },
+- { 0x15, KEY_2 },
+- { 0x10, KEY_3 },
+- { 0x18, KEY_4 },
+- { 0x1b, KEY_5 },
+- { 0x1e, KEY_6 },
+- { 0x11, KEY_7 },
+- { 0x21, KEY_8 },
+- { 0x12, KEY_9 },
+- { 0x27, KEY_0 },
+-
+- { 0x24, KEY_ZOOM },
+- { 0x2a, KEY_SUBTITLE },
+-
+- { 0x00, KEY_MUTE },
+- { 0x01, KEY_ENTER }, /* Pinnacle Logo */
+- { 0x39, KEY_POWER },
+-
+- { 0x03, KEY_VOLUMEUP },
+- { 0x09, KEY_VOLUMEDOWN },
+- { 0x06, KEY_CHANNELUP },
+- { 0x0c, KEY_CHANNELDOWN },
+-
+- { 0x2d, KEY_REWIND },
+- { 0x30, KEY_PLAYPAUSE },
+- { 0x33, KEY_FASTFORWARD },
+- { 0x3c, KEY_STOP },
+- { 0x36, KEY_RECORD },
+- { 0x3f, KEY_EPG }, /* Labeled "?" */
++ /* Key codes for the tiny Pinnacle remote*/
++ { 0x0700, KEY_MUTE },
++ { 0x0701, KEY_MENU }, /* Pinnacle logo */
++ { 0x0739, KEY_POWER },
++ { 0x0703, KEY_VOLUMEUP },
++ { 0x0709, KEY_VOLUMEDOWN },
++ { 0x0706, KEY_CHANNELUP },
++ { 0x070c, KEY_CHANNELDOWN },
++ { 0x070f, KEY_1 },
++ { 0x0715, KEY_2 },
++ { 0x0710, KEY_3 },
++ { 0x0718, KEY_4 },
++ { 0x071b, KEY_5 },
++ { 0x071e, KEY_6 },
++ { 0x0711, KEY_7 },
++ { 0x0721, KEY_8 },
++ { 0x0712, KEY_9 },
++ { 0x0727, KEY_0 },
++ { 0x0724, KEY_ZOOM }, /* 'Square' key */
++ { 0x072a, KEY_SUBTITLE }, /* 'T' key */
++ { 0x072d, KEY_REWIND },
++ { 0x0730, KEY_PLAYPAUSE },
++ { 0x0733, KEY_FASTFORWARD },
++ { 0x0736, KEY_RECORD },
++ { 0x073c, KEY_STOP },
++ { 0x073f, KEY_HELP }, /* '?' key */
+ };
+
+ static struct rc_map_list pinnacle_pctv_hd_map = {
+ .map = {
+ .scan = pinnacle_pctv_hd,
+ .size = ARRAY_SIZE(pinnacle_pctv_hd),
+- .rc_type = RC_TYPE_UNKNOWN, /* Legacy IR type */
++ .rc_type = RC_TYPE_RC5,
+ .name = RC_MAP_PINNACLE_PCTV_HD,
+ }
+ };
+diff --git a/drivers/media/video/uvc/uvc_queue.c b/drivers/media/video/uvc/uvc_queue.c
+index f14581b..48c5c57 100644
+--- a/drivers/media/video/uvc/uvc_queue.c
++++ b/drivers/media/video/uvc/uvc_queue.c
+@@ -104,6 +104,8 @@ static int __uvc_free_buffers(struct uvc_video_queue *queue)
+ }
+
+ if (queue->count) {
++ uvc_queue_cancel(queue, 0);
++ INIT_LIST_HEAD(&queue->mainqueue);
+ vfree(queue->mem);
+ queue->count = 0;
+ }
+diff --git a/drivers/misc/lkdtm.c b/drivers/misc/lkdtm.c
+index 81d7fa4..150cd70 100644
+--- a/drivers/misc/lkdtm.c
++++ b/drivers/misc/lkdtm.c
+@@ -120,6 +120,7 @@ static int recur_count = REC_NUM_DEFAULT;
+ static enum cname cpoint = CN_INVALID;
+ static enum ctype cptype = CT_NONE;
+ static int count = DEFAULT_COUNT;
++static DEFINE_SPINLOCK(count_lock);
+
+ module_param(recur_count, int, 0644);
+ MODULE_PARM_DESC(recur_count, " Recursion level for the stack overflow test, "\
+@@ -230,11 +231,14 @@ static const char *cp_name_to_str(enum cname name)
+ static int lkdtm_parse_commandline(void)
+ {
+ int i;
++ unsigned long flags;
+
+ if (cpoint_count < 1 || recur_count < 1)
+ return -EINVAL;
+
++ spin_lock_irqsave(&count_lock, flags);
+ count = cpoint_count;
++ spin_unlock_irqrestore(&count_lock, flags);
+
+ /* No special parameters */
+ if (!cpoint_type && !cpoint_name)
+@@ -349,6 +353,9 @@ static void lkdtm_do_action(enum ctype which)
+
+ static void lkdtm_handler(void)
+ {
++ unsigned long flags;
++
++ spin_lock_irqsave(&count_lock, flags);
+ count--;
+ printk(KERN_INFO "lkdtm: Crash point %s of type %s hit, trigger in %d rounds\n",
+ cp_name_to_str(cpoint), cp_type_to_str(cptype), count);
+@@ -357,6 +364,7 @@ static void lkdtm_handler(void)
+ lkdtm_do_action(cptype);
+ count = cpoint_count;
+ }
++ spin_unlock_irqrestore(&count_lock, flags);
+ }
+
+ static int lkdtm_register_cpoint(enum cname which)
+diff --git a/drivers/mmc/host/tmio_mmc_pio.c b/drivers/mmc/host/tmio_mmc_pio.c
+index 710339a..b98196c 100644
+--- a/drivers/mmc/host/tmio_mmc_pio.c
++++ b/drivers/mmc/host/tmio_mmc_pio.c
+@@ -760,8 +760,8 @@ static int tmio_mmc_get_ro(struct mmc_host *mmc)
+ struct tmio_mmc_host *host = mmc_priv(mmc);
+ struct tmio_mmc_data *pdata = host->pdata;
+
+- return ((pdata->flags & TMIO_MMC_WRPROTECT_DISABLE) ||
+- !(sd_ctrl_read32(host, CTL_STATUS) & TMIO_STAT_WRPROTECT));
++ return !((pdata->flags & TMIO_MMC_WRPROTECT_DISABLE) ||
++ (sd_ctrl_read32(host, CTL_STATUS) & TMIO_STAT_WRPROTECT));
+ }
+
+ static int tmio_mmc_get_cd(struct mmc_host *mmc)
+diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
+index 3e5d0b6..0d28378 100644
+--- a/drivers/net/hamradio/6pack.c
++++ b/drivers/net/hamradio/6pack.c
+@@ -692,10 +692,10 @@ static void sixpack_close(struct tty_struct *tty)
+ {
+ struct sixpack *sp;
+
+- write_lock(&disc_data_lock);
++ write_lock_bh(&disc_data_lock);
+ sp = tty->disc_data;
+ tty->disc_data = NULL;
+- write_unlock(&disc_data_lock);
++ write_unlock_bh(&disc_data_lock);
+ if (!sp)
+ return;
+
+diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c
+index 4c62839..bc02968 100644
+--- a/drivers/net/hamradio/mkiss.c
++++ b/drivers/net/hamradio/mkiss.c
+@@ -813,10 +813,10 @@ static void mkiss_close(struct tty_struct *tty)
+ {
+ struct mkiss *ax;
+
+- write_lock(&disc_data_lock);
++ write_lock_bh(&disc_data_lock);
+ ax = tty->disc_data;
+ tty->disc_data = NULL;
+- write_unlock(&disc_data_lock);
++ write_unlock_bh(&disc_data_lock);
+
+ if (!ax)
+ return;
+diff --git a/drivers/net/pxa168_eth.c b/drivers/net/pxa168_eth.c
+index 89f7540..5f597ca 100644
+--- a/drivers/net/pxa168_eth.c
++++ b/drivers/net/pxa168_eth.c
+@@ -1273,7 +1273,7 @@ static int pxa168_eth_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ wmb();
+ wrl(pep, SDMA_CMD, SDMA_CMD_TXDH | SDMA_CMD_ERD);
+
+- stats->tx_bytes += skb->len;
++ stats->tx_bytes += length;
+ stats->tx_packets++;
+ dev->trans_start = jiffies;
+ if (pep->tx_ring_size - pep->tx_desc_count <= 1) {
+diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
+index 349a596..76d5089 100644
+--- a/drivers/net/wireless/ath/ath5k/base.c
++++ b/drivers/net/wireless/ath/ath5k/base.c
+@@ -72,6 +72,11 @@ static int modparam_all_channels;
+ module_param_named(all_channels, modparam_all_channels, bool, S_IRUGO);
+ MODULE_PARM_DESC(all_channels, "Expose all channels the device can use.");
+
++static int modparam_fastchanswitch;
++module_param_named(fastchanswitch, modparam_fastchanswitch, bool, S_IRUGO);
++MODULE_PARM_DESC(fastchanswitch, "Enable fast channel switching for AR2413/AR5413 radios.");
++
++
+ /* Module info */
+ MODULE_AUTHOR("Jiri Slaby");
+ MODULE_AUTHOR("Nick Kossifidis");
+@@ -2644,6 +2649,7 @@ ath5k_reset(struct ath5k_softc *sc, struct ieee80211_channel *chan,
+ struct ath5k_hw *ah = sc->ah;
+ struct ath_common *common = ath5k_hw_common(ah);
+ int ret, ani_mode;
++ bool fast;
+
+ ATH5K_DBG(sc, ATH5K_DEBUG_RESET, "resetting\n");
+
+@@ -2663,7 +2669,10 @@ ath5k_reset(struct ath5k_softc *sc, struct ieee80211_channel *chan,
+ ath5k_drain_tx_buffs(sc);
+ if (chan)
+ sc->curchan = chan;
+- ret = ath5k_hw_reset(ah, sc->opmode, sc->curchan, chan != NULL,
++
++ fast = ((chan != NULL) && modparam_fastchanswitch) ? 1 : 0;
++
++ ret = ath5k_hw_reset(ah, sc->opmode, sc->curchan, fast,
+ skip_pcu);
+ if (ret) {
+ ATH5K_ERR(sc, "can't reset hardware (%d)\n", ret);
+diff --git a/drivers/net/wireless/ath/ath5k/eeprom.c b/drivers/net/wireless/ath/ath5k/eeprom.c
+index efb672c..a33ae01 100644
+--- a/drivers/net/wireless/ath/ath5k/eeprom.c
++++ b/drivers/net/wireless/ath/ath5k/eeprom.c
+@@ -1565,14 +1565,12 @@ ath5k_eeprom_free_pcal_info(struct ath5k_hw *ah, int mode)
+ if (!chinfo[pier].pd_curves)
+ continue;
+
+- for (pdg = 0; pdg < ee->ee_pd_gains[mode]; pdg++) {
++ for (pdg = 0; pdg < AR5K_EEPROM_N_PD_CURVES; pdg++) {
+ struct ath5k_pdgain_info *pd =
+ &chinfo[pier].pd_curves[pdg];
+
+- if (pd != NULL) {
+- kfree(pd->pd_step);
+- kfree(pd->pd_pwr);
+- }
++ kfree(pd->pd_step);
++ kfree(pd->pd_pwr);
+ }
+
+ kfree(chinfo[pier].pd_curves);
+diff --git a/drivers/net/wireless/ath/ath5k/reset.c b/drivers/net/wireless/ath/ath5k/reset.c
+index 8420689..6f53d2b 100644
+--- a/drivers/net/wireless/ath/ath5k/reset.c
++++ b/drivers/net/wireless/ath/ath5k/reset.c
+@@ -1119,8 +1119,11 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum nl80211_iftype op_mode,
+ /* Non fatal, can happen eg.
+ * on mode change */
+ ret = 0;
+- } else
++ } else {
++ ATH5K_DBG(ah->ah_sc, ATH5K_DEBUG_RESET,
++ "fast chan change successful\n");
+ return 0;
++ }
+ }
+
+ /*
+diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
+index 9c65459..e137212 100644
+--- a/drivers/net/wireless/ath/ath9k/pci.c
++++ b/drivers/net/wireless/ath/ath9k/pci.c
+@@ -278,6 +278,12 @@ static int ath_pci_suspend(struct device *device)
+
+ ath9k_hw_set_gpio(sc->sc_ah, sc->sc_ah->led_pin, 1);
+
++ /* The device has to be moved to FULLSLEEP forcibly.
++ * Otherwise the chip never moved to full sleep,
++ * when no interface is up.
++ */
++ ath9k_hw_setpower(sc->sc_ah, ATH9K_PM_FULL_SLEEP);
++
+ return 0;
+ }
+
+diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
+index 7950bc4..7fd7fe6 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-core.c
++++ b/drivers/net/wireless/iwlwifi/iwl-core.c
+@@ -1772,6 +1772,7 @@ int iwl_mac_change_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ struct iwl_priv *priv = hw->priv;
+ struct iwl_rxon_context *ctx = iwl_rxon_ctx_from_vif(vif);
+ struct iwl_rxon_context *tmp;
++ enum nl80211_iftype newviftype = newtype;
+ u32 interface_modes;
+ int err;
+
+@@ -1814,7 +1815,7 @@ int iwl_mac_change_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+
+ /* success */
+ iwl_teardown_interface(priv, vif, true);
+- vif->type = newtype;
++ vif->type = newviftype;
+ vif->p2p = newp2p;
+ err = iwl_setup_interface(priv, ctx);
+ WARN_ON(err);
+diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
+index 135df16..46767c5 100644
+--- a/drivers/pci/pci-driver.c
++++ b/drivers/pci/pci-driver.c
+@@ -624,7 +624,7 @@ static int pci_pm_prepare(struct device *dev)
+ * system from the sleep state, we'll have to prevent it from signaling
+ * wake-up.
+ */
+- pm_runtime_resume(dev);
++ pm_runtime_get_sync(dev);
+
+ if (drv && drv->pm && drv->pm->prepare)
+ error = drv->pm->prepare(dev);
+@@ -638,6 +638,8 @@ static void pci_pm_complete(struct device *dev)
+
+ if (drv && drv->pm && drv->pm->complete)
+ drv->pm->complete(dev);
++
++ pm_runtime_put_sync(dev);
+ }
+
+ #else /* !CONFIG_PM_SLEEP */
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 4b2bbe8..a5747c2 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -2758,6 +2758,8 @@ static void ricoh_mmc_fixup_r5c832(struct pci_dev *dev)
+ }
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_RICOH, PCI_DEVICE_ID_RICOH_R5C832, ricoh_mmc_fixup_r5c832);
+ DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_RICOH, PCI_DEVICE_ID_RICOH_R5C832, ricoh_mmc_fixup_r5c832);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_RICOH, PCI_DEVICE_ID_RICOH_R5CE823, ricoh_mmc_fixup_r5c832);
++DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_RICOH, PCI_DEVICE_ID_RICOH_R5CE823, ricoh_mmc_fixup_r5c832);
+ #endif /*CONFIG_MMC_RICOH_MMC*/
+
+ #if defined(CONFIG_DMAR) || defined(CONFIG_INTR_REMAP)
+diff --git a/drivers/staging/lirc/lirc_zilog.c b/drivers/staging/lirc/lirc_zilog.c
+index dd6a57c..4e051f6 100644
+--- a/drivers/staging/lirc/lirc_zilog.c
++++ b/drivers/staging/lirc/lirc_zilog.c
+@@ -475,14 +475,14 @@ static int lirc_thread(void *arg)
+ dprintk("poll thread started\n");
+
+ while (!kthread_should_stop()) {
++ set_current_state(TASK_INTERRUPTIBLE);
++
+ /* if device not opened, we can sleep half a second */
+ if (atomic_read(&ir->open_count) == 0) {
+ schedule_timeout(HZ/2);
+ continue;
+ }
+
+- set_current_state(TASK_INTERRUPTIBLE);
+-
+ /*
+ * This is ~113*2 + 24 + jitter (2*repeat gap + code length).
+ * We use this interval as the chip resets every time you poll
+diff --git a/drivers/tty/serial/pch_uart.c b/drivers/tty/serial/pch_uart.c
+index 26403b8..da9270e 100644
+--- a/drivers/tty/serial/pch_uart.c
++++ b/drivers/tty/serial/pch_uart.c
+@@ -1392,6 +1392,7 @@ static struct eg20t_port *pch_uart_init_port(struct pci_dev *pdev,
+ int fifosize, base_baud;
+ int port_type;
+ struct pch_uart_driver_data *board;
++ const char *board_name;
+
+ board = &drv_dat[id->driver_data];
+ port_type = board->port_type;
+@@ -1407,7 +1408,8 @@ static struct eg20t_port *pch_uart_init_port(struct pci_dev *pdev,
+ base_baud = 1843200; /* 1.8432MHz */
+
+ /* quirk for CM-iTC board */
+- if (strstr(dmi_get_system_info(DMI_BOARD_NAME), "CM-iTC"))
++ board_name = dmi_get_system_info(DMI_BOARD_NAME);
++ if (board_name && strstr(board_name, "CM-iTC"))
+ base_baud = 192000000; /* 192.0MHz */
+
+ switch (port_type) {
+diff --git a/drivers/tty/serial/s5pv210.c b/drivers/tty/serial/s5pv210.c
+index 6ebccd7..453e5b7 100644
+--- a/drivers/tty/serial/s5pv210.c
++++ b/drivers/tty/serial/s5pv210.c
+@@ -31,7 +31,7 @@ static int s5pv210_serial_setsource(struct uart_port *port,
+ struct s3c2410_uartcfg *cfg = port->dev->platform_data;
+ unsigned long ucon = rd_regl(port, S3C2410_UCON);
+
+- if ((cfg->clocks_size) == 1)
++ if (cfg->flags & NO_NEED_CHECK_CLKSRC)
+ return 0;
+
+ if (strcmp(clk->name, "pclk") == 0)
+@@ -56,7 +56,7 @@ static int s5pv210_serial_getsource(struct uart_port *port,
+
+ clk->divisor = 1;
+
+- if ((cfg->clocks_size) == 1)
++ if (cfg->flags & NO_NEED_CHECK_CLKSRC)
+ return 0;
+
+ switch (ucon & S5PV210_UCON_CLKMASK) {
+diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c
+index e19e136..1104c9d 100644
+--- a/drivers/tty/tty_ldisc.c
++++ b/drivers/tty/tty_ldisc.c
+@@ -555,7 +555,7 @@ static void tty_ldisc_flush_works(struct tty_struct *tty)
+ static int tty_ldisc_wait_idle(struct tty_struct *tty)
+ {
+ int ret;
+- ret = wait_event_interruptible_timeout(tty_ldisc_idle,
++ ret = wait_event_timeout(tty_ldisc_idle,
+ atomic_read(&tty->ldisc->users) == 1, 5 * HZ);
+ if (ret < 0)
+ return ret;
+@@ -763,6 +763,8 @@ static int tty_ldisc_reinit(struct tty_struct *tty, int ldisc)
+ if (IS_ERR(ld))
+ return -1;
+
++ WARN_ON_ONCE(tty_ldisc_wait_idle(tty));
++
+ tty_ldisc_close(tty, tty->ldisc);
+ tty_ldisc_put(tty->ldisc);
+ tty->ldisc = NULL;
+diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
+index e35a176..34e3da5 100644
+--- a/drivers/usb/core/driver.c
++++ b/drivers/usb/core/driver.c
+@@ -375,7 +375,7 @@ static int usb_unbind_interface(struct device *dev)
+ * Just re-enable it without affecting the endpoint toggles.
+ */
+ usb_enable_interface(udev, intf, false);
+- } else if (!error && !intf->dev.power.in_suspend) {
++ } else if (!error && !intf->dev.power.is_prepared) {
+ r = usb_set_interface(udev, intf->altsetting[0].
+ desc.bInterfaceNumber, 0);
+ if (r < 0)
+@@ -960,7 +960,7 @@ void usb_rebind_intf(struct usb_interface *intf)
+ }
+
+ /* Try to rebind the interface */
+- if (!intf->dev.power.in_suspend) {
++ if (!intf->dev.power.is_prepared) {
+ intf->needs_binding = 0;
+ rc = device_attach(&intf->dev);
+ if (rc < 0)
+@@ -1107,7 +1107,7 @@ static int usb_resume_interface(struct usb_device *udev,
+ if (intf->condition == USB_INTERFACE_UNBOUND) {
+
+ /* Carry out a deferred switch to altsetting 0 */
+- if (intf->needs_altsetting0 && !intf->dev.power.in_suspend) {
++ if (intf->needs_altsetting0 && !intf->dev.power.is_prepared) {
+ usb_set_interface(udev, intf->altsetting[0].
+ desc.bInterfaceNumber, 0);
+ intf->needs_altsetting0 = 0;
+@@ -1187,13 +1187,22 @@ static int usb_suspend_both(struct usb_device *udev, pm_message_t msg)
+ for (i = n - 1; i >= 0; --i) {
+ intf = udev->actconfig->interface[i];
+ status = usb_suspend_interface(udev, intf, msg);
++
++ /* Ignore errors during system sleep transitions */
++ if (!(msg.event & PM_EVENT_AUTO))
++ status = 0;
+ if (status != 0)
+ break;
+ }
+ }
+- if (status == 0)
++ if (status == 0) {
+ status = usb_suspend_device(udev, msg);
+
++ /* Again, ignore errors during system sleep transitions */
++ if (!(msg.event & PM_EVENT_AUTO))
++ status = 0;
++ }
++
+ /* If the suspend failed, resume interfaces that did get suspended */
+ if (status != 0) {
+ msg.event ^= (PM_EVENT_SUSPEND | PM_EVENT_RESUME);
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 78e7f25..64edb30 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -1643,6 +1643,7 @@ void usb_disconnect(struct usb_device **pdev)
+ {
+ struct usb_device *udev = *pdev;
+ int i;
++ struct usb_hcd *hcd = bus_to_hcd(udev->bus);
+
+ if (!udev) {
+ pr_debug ("%s nodev\n", __func__);
+@@ -1670,7 +1671,9 @@ void usb_disconnect(struct usb_device **pdev)
+ * so that the hardware is now fully quiesced.
+ */
+ dev_dbg (&udev->dev, "unregistering device\n");
++ mutex_lock(hcd->bandwidth_mutex);
+ usb_disable_device(udev, 0);
++ mutex_unlock(hcd->bandwidth_mutex);
+ usb_hcd_synchronize_unlinks(udev);
+
+ usb_remove_ep_devs(&udev->ep0);
+@@ -2308,6 +2311,10 @@ int usb_port_suspend(struct usb_device *udev, pm_message_t msg)
+ USB_DEVICE_REMOTE_WAKEUP, 0,
+ NULL, 0,
+ USB_CTRL_SET_TIMEOUT);
++
++ /* System sleep transitions should never fail */
++ if (!(msg.event & PM_EVENT_AUTO))
++ status = 0;
+ } else {
+ /* device has up to 10 msec to fully suspend */
+ dev_dbg(&udev->dev, "usb %ssuspend\n",
+@@ -2546,16 +2553,15 @@ static int hub_suspend(struct usb_interface *intf, pm_message_t msg)
+ struct usb_device *hdev = hub->hdev;
+ unsigned port1;
+
+- /* fail if children aren't already suspended */
++ /* Warn if children aren't already suspended */
+ for (port1 = 1; port1 <= hdev->maxchild; port1++) {
+ struct usb_device *udev;
+
+ udev = hdev->children [port1-1];
+ if (udev && udev->can_submit) {
+- if (!(msg.event & PM_EVENT_AUTO))
+- dev_dbg(&intf->dev, "port %d nyet suspended\n",
+- port1);
+- return -EBUSY;
++ dev_warn(&intf->dev, "port %d nyet suspended\n", port1);
++ if (msg.event & PM_EVENT_AUTO)
++ return -EBUSY;
+ }
+ }
+
+diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
+index 5701e85..0b5ec23 100644
+--- a/drivers/usb/core/message.c
++++ b/drivers/usb/core/message.c
+@@ -1135,15 +1135,26 @@ void usb_disable_interface(struct usb_device *dev, struct usb_interface *intf,
+ * Deallocates hcd/hardware state for the endpoints (nuking all or most
+ * pending urbs) and usbcore state for the interfaces, so that usbcore
+ * must usb_set_configuration() before any interfaces could be used.
++ *
++ * Must be called with hcd->bandwidth_mutex held.
+ */
+ void usb_disable_device(struct usb_device *dev, int skip_ep0)
+ {
+ int i;
++ struct usb_hcd *hcd = bus_to_hcd(dev->bus);
+
+ /* getting rid of interfaces will disconnect
+ * any drivers bound to them (a key side effect)
+ */
+ if (dev->actconfig) {
++ /*
++ * FIXME: In order to avoid self-deadlock involving the
++ * bandwidth_mutex, we have to mark all the interfaces
++ * before unregistering any of them.
++ */
++ for (i = 0; i < dev->actconfig->desc.bNumInterfaces; i++)
++ dev->actconfig->interface[i]->unregistering = 1;
++
+ for (i = 0; i < dev->actconfig->desc.bNumInterfaces; i++) {
+ struct usb_interface *interface;
+
+@@ -1153,7 +1164,6 @@ void usb_disable_device(struct usb_device *dev, int skip_ep0)
+ continue;
+ dev_dbg(&dev->dev, "unregistering interface %s\n",
+ dev_name(&interface->dev));
+- interface->unregistering = 1;
+ remove_intf_ep_devs(interface);
+ device_del(&interface->dev);
+ }
+@@ -1172,6 +1182,16 @@ void usb_disable_device(struct usb_device *dev, int skip_ep0)
+
+ dev_dbg(&dev->dev, "%s nuking %s URBs\n", __func__,
+ skip_ep0 ? "non-ep0" : "all");
++ if (hcd->driver->check_bandwidth) {
++ /* First pass: Cancel URBs, leave endpoint pointers intact. */
++ for (i = skip_ep0; i < 16; ++i) {
++ usb_disable_endpoint(dev, i, false);
++ usb_disable_endpoint(dev, i + USB_DIR_IN, false);
++ }
++ /* Remove endpoints from the host controller internal state */
++ usb_hcd_alloc_bandwidth(dev, NULL, NULL, NULL);
++ /* Second pass: remove endpoint pointers */
++ }
+ for (i = skip_ep0; i < 16; ++i) {
+ usb_disable_endpoint(dev, i, true);
+ usb_disable_endpoint(dev, i + USB_DIR_IN, true);
+@@ -1273,6 +1293,8 @@ int usb_set_interface(struct usb_device *dev, int interface, int alternate)
+ interface);
+ return -EINVAL;
+ }
++ if (iface->unregistering)
++ return -ENODEV;
+
+ alt = usb_altnum_to_altsetting(iface, alternate);
+ if (!alt) {
+@@ -1727,6 +1749,7 @@ free_interfaces:
+ /* if it's already configured, clear out old state first.
+ * getting rid of old interfaces means unbinding their drivers.
+ */
++ mutex_lock(hcd->bandwidth_mutex);
+ if (dev->state != USB_STATE_ADDRESS)
+ usb_disable_device(dev, 1); /* Skip ep0 */
+
+@@ -1739,7 +1762,6 @@ free_interfaces:
+ * host controller will not allow submissions to dropped endpoints. If
+ * this call fails, the device state is unchanged.
+ */
+- mutex_lock(hcd->bandwidth_mutex);
+ ret = usb_hcd_alloc_bandwidth(dev, cp, NULL, NULL);
+ if (ret < 0) {
+ mutex_unlock(hcd->bandwidth_mutex);
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 4940717..6fce318 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -28,6 +28,9 @@
+ #define PCI_VENDOR_ID_FRESCO_LOGIC 0x1b73
+ #define PCI_DEVICE_ID_FRESCO_LOGIC_PDK 0x1000
+
++#define PCI_VENDOR_ID_ETRON 0x1b6f
++#define PCI_DEVICE_ID_ASROCK_P67 0x7023
++
+ static const char hcd_name[] = "xhci_hcd";
+
+ /* called after powerup, by probe or system-pm "wakeup" */
+@@ -120,6 +123,11 @@ static int xhci_pci_setup(struct usb_hcd *hcd)
+ "has broken MSI implementation\n",
+ pdev->revision);
+ }
++ if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
++ pdev->device == PCI_DEVICE_ID_ASROCK_P67) {
++ xhci->quirks |= XHCI_RESET_ON_RESUME;
++ xhci_dbg(xhci, "QUIRK: Resetting on resume\n");
++ }
+
+ if (pdev->vendor == PCI_VENDOR_ID_NEC)
+ xhci->quirks |= XHCI_NEC_HOST;
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 078b566..a5e96cb 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1768,9 +1768,6 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td,
+ }
+ }
+
+- if ((idx == urb_priv->length - 1) && *status == -EINPROGRESS)
+- *status = 0;
+-
+ return finish_td(xhci, td, event_trb, event, ep, status, false);
+ }
+
+@@ -1788,8 +1785,7 @@ static int skip_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td,
+ idx = urb_priv->td_cnt;
+ frame = &td->urb->iso_frame_desc[idx];
+
+- /* The transfer is partly done */
+- *status = -EXDEV;
++ /* The transfer is partly done. */
+ frame->status = -EXDEV;
+
+ /* calc actual length */
+@@ -2139,6 +2135,11 @@ cleanup:
+ "status = %d\n",
+ urb, urb->actual_length, status);
+ spin_unlock(&xhci->lock);
++ /* EHCI, UHCI, and OHCI always unconditionally set the
++ * urb->status of an isochronous endpoint to 0.
++ */
++ if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS)
++ status = 0;
+ usb_hcd_giveback_urb(bus_to_hcd(urb->dev->bus), urb, status);
+ spin_lock(&xhci->lock);
+ }
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index e5c4861..4209b02 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -759,6 +759,8 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
+ msleep(100);
+
+ spin_lock_irq(&xhci->lock);
++ if (xhci->quirks & XHCI_RESET_ON_RESUME)
++ hibernated = true;
+
+ if (!hibernated) {
+ /* step 1: restore register */
+@@ -1396,6 +1398,7 @@ int xhci_add_endpoint(struct usb_hcd *hcd, struct usb_device *udev,
+ u32 added_ctxs;
+ unsigned int last_ctx;
+ u32 new_add_flags, new_drop_flags, new_slot_info;
++ struct xhci_virt_device *virt_dev;
+ int ret = 0;
+
+ ret = xhci_check_args(hcd, udev, ep, 1, true, __func__);
+@@ -1418,11 +1421,25 @@ int xhci_add_endpoint(struct usb_hcd *hcd, struct usb_device *udev,
+ return 0;
+ }
+
+- in_ctx = xhci->devs[udev->slot_id]->in_ctx;
+- out_ctx = xhci->devs[udev->slot_id]->out_ctx;
++ virt_dev = xhci->devs[udev->slot_id];
++ in_ctx = virt_dev->in_ctx;
++ out_ctx = virt_dev->out_ctx;
+ ctrl_ctx = xhci_get_input_control_ctx(xhci, in_ctx);
+ ep_index = xhci_get_endpoint_index(&ep->desc);
+ ep_ctx = xhci_get_ep_ctx(xhci, out_ctx, ep_index);
++
++ /* If this endpoint is already in use, and the upper layers are trying
++ * to add it again without dropping it, reject the addition.
++ */
++ if (virt_dev->eps[ep_index].ring &&
++ !(le32_to_cpu(ctrl_ctx->drop_flags) &
++ xhci_get_endpoint_flag(&ep->desc))) {
++ xhci_warn(xhci, "Trying to add endpoint 0x%x "
++ "without dropping it.\n",
++ (unsigned int) ep->desc.bEndpointAddress);
++ return -EINVAL;
++ }
++
+ /* If the HCD has already noted the endpoint is enabled,
+ * ignore this request.
+ */
+@@ -1437,8 +1454,7 @@ int xhci_add_endpoint(struct usb_hcd *hcd, struct usb_device *udev,
+ * process context, not interrupt context (or so documenation
+ * for usb_set_interface() and usb_set_configuration() claim).
+ */
+- if (xhci_endpoint_init(xhci, xhci->devs[udev->slot_id],
+- udev, ep, GFP_NOIO) < 0) {
++ if (xhci_endpoint_init(xhci, virt_dev, udev, ep, GFP_NOIO) < 0) {
+ dev_dbg(&udev->dev, "%s - could not initialize ep %#x\n",
+ __func__, ep->desc.bEndpointAddress);
+ return -ENOMEM;
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index fb85ce3..1e52d5e 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1287,6 +1287,7 @@ struct xhci_hcd {
+ #define XHCI_NEC_HOST (1 << 2)
+ #define XHCI_AMD_PLL_FIX (1 << 3)
+ #define XHCI_BROKEN_MSI (1 << 6)
++#define XHCI_RESET_ON_RESUME (1 << 7)
+ /* There are two roothubs to keep track of bus suspend info for */
+ struct xhci_bus_state bus_state[2];
+ /* Is each xHCI roothub port a USB 3.0, USB 2.0, or USB 1.1 port? */
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 1627289..2e06b90 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -179,6 +179,7 @@ static struct usb_device_id id_table_combined [] = {
+ { USB_DEVICE(FTDI_VID, FTDI_232RL_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_8U2232C_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_4232H_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_232H_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_MICRO_CHAMELEON_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_RELAIS_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_OPENDCC_PID) },
+@@ -848,7 +849,8 @@ static const char *ftdi_chip_name[] = {
+ [FT2232C] = "FT2232C",
+ [FT232RL] = "FT232RL",
+ [FT2232H] = "FT2232H",
+- [FT4232H] = "FT4232H"
++ [FT4232H] = "FT4232H",
++ [FT232H] = "FT232H"
+ };
+
+
+@@ -1168,6 +1170,7 @@ static __u32 get_ftdi_divisor(struct tty_struct *tty,
+ break;
+ case FT2232H: /* FT2232H chip */
+ case FT4232H: /* FT4232H chip */
++ case FT232H: /* FT232H chip */
+ if ((baud <= 12000000) & (baud >= 1200)) {
+ div_value = ftdi_2232h_baud_to_divisor(baud);
+ } else if (baud < 1200) {
+@@ -1429,9 +1432,12 @@ static void ftdi_determine_type(struct usb_serial_port *port)
+ } else if (version < 0x600) {
+ /* Assume it's an FT232BM (or FT245BM) */
+ priv->chip_type = FT232BM;
+- } else {
+- /* Assume it's an FT232R */
++ } else if (version < 0x900) {
++ /* Assume it's an FT232RL */
+ priv->chip_type = FT232RL;
++ } else {
++ /* Assume it's an FT232H */
++ priv->chip_type = FT232H;
+ }
+ dev_info(&udev->dev, "Detected %s\n", ftdi_chip_name[priv->chip_type]);
+ }
+@@ -1559,7 +1565,8 @@ static int create_sysfs_attrs(struct usb_serial_port *port)
+ priv->chip_type == FT2232C ||
+ priv->chip_type == FT232RL ||
+ priv->chip_type == FT2232H ||
+- priv->chip_type == FT4232H)) {
++ priv->chip_type == FT4232H ||
++ priv->chip_type == FT232H)) {
+ retval = device_create_file(&port->dev,
+ &dev_attr_latency_timer);
+ }
+@@ -1580,7 +1587,8 @@ static void remove_sysfs_attrs(struct usb_serial_port *port)
+ priv->chip_type == FT2232C ||
+ priv->chip_type == FT232RL ||
+ priv->chip_type == FT2232H ||
+- priv->chip_type == FT4232H) {
++ priv->chip_type == FT4232H ||
++ priv->chip_type == FT232H) {
+ device_remove_file(&port->dev, &dev_attr_latency_timer);
+ }
+ }
+@@ -2212,6 +2220,7 @@ static int ftdi_tiocmget(struct tty_struct *tty)
+ case FT232RL:
+ case FT2232H:
+ case FT4232H:
++ case FT232H:
+ len = 2;
+ break;
+ default:
+diff --git a/drivers/usb/serial/ftdi_sio.h b/drivers/usb/serial/ftdi_sio.h
+index 213fe3d..19584fa 100644
+--- a/drivers/usb/serial/ftdi_sio.h
++++ b/drivers/usb/serial/ftdi_sio.h
+@@ -156,7 +156,8 @@ enum ftdi_chip_type {
+ FT2232C = 4,
+ FT232RL = 5,
+ FT2232H = 6,
+- FT4232H = 7
++ FT4232H = 7,
++ FT232H = 8
+ };
+
+ enum ftdi_sio_baudrate {
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index ab1fcdf..19156d1 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -22,6 +22,7 @@
+ #define FTDI_8U232AM_ALT_PID 0x6006 /* FTDI's alternate PID for above */
+ #define FTDI_8U2232C_PID 0x6010 /* Dual channel device */
+ #define FTDI_4232H_PID 0x6011 /* Quad channel hi-speed device */
++#define FTDI_232H_PID 0x6014 /* Single channel hi-speed device */
+ #define FTDI_SIO_PID 0x8372 /* Product Id SIO application of 8U100AX */
+ #define FTDI_232RL_PID 0xFBFA /* Product ID for FT232RL */
+
+diff --git a/drivers/watchdog/mtx-1_wdt.c b/drivers/watchdog/mtx-1_wdt.c
+index 5ec5ac1..befbe80 100644
+--- a/drivers/watchdog/mtx-1_wdt.c
++++ b/drivers/watchdog/mtx-1_wdt.c
+@@ -211,6 +211,12 @@ static int __devinit mtx1_wdt_probe(struct platform_device *pdev)
+ int ret;
+
+ mtx1_wdt_device.gpio = pdev->resource[0].start;
++ ret = gpio_request_one(mtx1_wdt_device.gpio,
++ GPIOF_OUT_INIT_HIGH, "mtx1-wdt");
++ if (ret < 0) {
++ dev_err(&pdev->dev, "failed to request gpio");
++ return ret;
++ }
+
+ spin_lock_init(&mtx1_wdt_device.lock);
+ init_completion(&mtx1_wdt_device.stop);
+@@ -236,6 +242,8 @@ static int __devexit mtx1_wdt_remove(struct platform_device *pdev)
+ mtx1_wdt_device.queue = 0;
+ wait_for_completion(&mtx1_wdt_device.stop);
+ }
++
++ gpio_free(mtx1_wdt_device.gpio);
+ misc_deregister(&mtx1_wdt_misc);
+ return 0;
+ }
+diff --git a/fs/block_dev.c b/fs/block_dev.c
+index 1a2421f..610e8e0 100644
+--- a/fs/block_dev.c
++++ b/fs/block_dev.c
+@@ -762,7 +762,19 @@ static struct block_device *bd_start_claiming(struct block_device *bdev,
+ if (!disk)
+ return ERR_PTR(-ENXIO);
+
+- whole = bdget_disk(disk, 0);
++ /*
++ * Normally, @bdev should equal what's returned from bdget_disk()
++ * if partno is 0; however, some drivers (floppy) use multiple
++ * bdev's for the same physical device and @bdev may be one of the
++ * aliases. Keep @bdev if partno is 0. This means claimer
++ * tracking is broken for those devices but it has always been that
++ * way.
++ */
++ if (partno)
++ whole = bdget_disk(disk, 0);
++ else
++ whole = bdgrab(bdev);
++
+ module_put(disk->fops->owner);
+ put_disk(disk);
+ if (!whole)
+diff --git a/fs/cifs/fscache.c b/fs/cifs/fscache.c
+index 297a43d..05268cf 100644
+--- a/fs/cifs/fscache.c
++++ b/fs/cifs/fscache.c
+@@ -94,6 +94,7 @@ static void cifs_fscache_disable_inode_cookie(struct inode *inode)
+ if (cifsi->fscache) {
+ cFYI(1, "CIFS disabling inode cookie (0x%p)",
+ cifsi->fscache);
++ fscache_uncache_all_inode_pages(cifsi->fscache, inode);
+ fscache_relinquish_cookie(cifsi->fscache, 1);
+ cifsi->fscache = NULL;
+ }
+diff --git a/fs/fscache/page.c b/fs/fscache/page.c
+index 41c441c..52b59e2 100644
+--- a/fs/fscache/page.c
++++ b/fs/fscache/page.c
+@@ -967,3 +967,47 @@ void fscache_mark_pages_cached(struct fscache_retrieval *op,
+ pagevec_reinit(pagevec);
+ }
+ EXPORT_SYMBOL(fscache_mark_pages_cached);
++
++/*
++ * Uncache all the pages in an inode that are marked PG_fscache, assuming them
++ * to be associated with the given cookie.
++ */
++void __fscache_uncache_all_inode_pages(struct fscache_cookie *cookie,
++ struct inode *inode)
++{
++ struct address_space *mapping = inode->i_mapping;
++ struct pagevec pvec;
++ pgoff_t next;
++ int i;
++
++ _enter("%p,%p", cookie, inode);
++
++ if (!mapping || mapping->nrpages == 0) {
++ _leave(" [no pages]");
++ return;
++ }
++
++ pagevec_init(&pvec, 0);
++ next = 0;
++ while (next <= (loff_t)-1 &&
++ pagevec_lookup(&pvec, mapping, next, PAGEVEC_SIZE)
++ ) {
++ for (i = 0; i < pagevec_count(&pvec); i++) {
++ struct page *page = pvec.pages[i];
++ pgoff_t page_index = page->index;
++
++ ASSERTCMP(page_index, >=, next);
++ next = page_index + 1;
++
++ if (PageFsCache(page)) {
++ __fscache_wait_on_page_write(cookie, page);
++ __fscache_uncache_page(cookie, page);
++ }
++ }
++ pagevec_release(&pvec);
++ cond_resched();
++ }
++
++ _leave("");
++}
++EXPORT_SYMBOL(__fscache_uncache_all_inode_pages);
+diff --git a/fs/hfsplus/wrapper.c b/fs/hfsplus/wrapper.c
+index 3031d81..4ac88ff 100644
+--- a/fs/hfsplus/wrapper.c
++++ b/fs/hfsplus/wrapper.c
+@@ -36,6 +36,7 @@ int hfsplus_submit_bio(struct block_device *bdev, sector_t sector,
+ {
+ DECLARE_COMPLETION_ONSTACK(wait);
+ struct bio *bio;
++ int ret = 0;
+
+ bio = bio_alloc(GFP_NOIO, 1);
+ bio->bi_sector = sector;
+@@ -54,8 +55,10 @@ int hfsplus_submit_bio(struct block_device *bdev, sector_t sector,
+ wait_for_completion(&wait);
+
+ if (!bio_flagged(bio, BIO_UPTODATE))
+- return -EIO;
+- return 0;
++ ret = -EIO;
++
++ bio_put(bio);
++ return ret;
+ }
+
+ static int hfsplus_read_mdb(void *bufptr, struct hfsplus_wd *wd)
+diff --git a/fs/lockd/clntproc.c b/fs/lockd/clntproc.c
+index adb45ec..e374050 100644
+--- a/fs/lockd/clntproc.c
++++ b/fs/lockd/clntproc.c
+@@ -708,7 +708,13 @@ static void nlmclnt_unlock_callback(struct rpc_task *task, void *data)
+
+ if (task->tk_status < 0) {
+ dprintk("lockd: unlock failed (err = %d)\n", -task->tk_status);
+- goto retry_rebind;
++ switch (task->tk_status) {
++ case -EACCES:
++ case -EIO:
++ goto die;
++ default:
++ goto retry_rebind;
++ }
+ }
+ if (status == NLM_LCK_DENIED_GRACE_PERIOD) {
+ rpc_delay(task, NLMCLNT_GRACE_WAIT);
+diff --git a/fs/locks.c b/fs/locks.c
+index 0a4f50d..b286539 100644
+--- a/fs/locks.c
++++ b/fs/locks.c
+@@ -160,10 +160,28 @@ EXPORT_SYMBOL_GPL(unlock_flocks);
+
+ static struct kmem_cache *filelock_cache __read_mostly;
+
++static void locks_init_lock_always(struct file_lock *fl)
++{
++ fl->fl_next = NULL;
++ fl->fl_fasync = NULL;
++ fl->fl_owner = NULL;
++ fl->fl_pid = 0;
++ fl->fl_nspid = NULL;
++ fl->fl_file = NULL;
++ fl->fl_flags = 0;
++ fl->fl_type = 0;
++ fl->fl_start = fl->fl_end = 0;
++}
++
+ /* Allocate an empty lock structure. */
+ struct file_lock *locks_alloc_lock(void)
+ {
+- return kmem_cache_alloc(filelock_cache, GFP_KERNEL);
++ struct file_lock *fl = kmem_cache_alloc(filelock_cache, GFP_KERNEL);
++
++ if (fl)
++ locks_init_lock_always(fl);
++
++ return fl;
+ }
+ EXPORT_SYMBOL_GPL(locks_alloc_lock);
+
+@@ -200,17 +218,9 @@ void locks_init_lock(struct file_lock *fl)
+ INIT_LIST_HEAD(&fl->fl_link);
+ INIT_LIST_HEAD(&fl->fl_block);
+ init_waitqueue_head(&fl->fl_wait);
+- fl->fl_next = NULL;
+- fl->fl_fasync = NULL;
+- fl->fl_owner = NULL;
+- fl->fl_pid = 0;
+- fl->fl_nspid = NULL;
+- fl->fl_file = NULL;
+- fl->fl_flags = 0;
+- fl->fl_type = 0;
+- fl->fl_start = fl->fl_end = 0;
+ fl->fl_ops = NULL;
+ fl->fl_lmops = NULL;
++ locks_init_lock_always(fl);
+ }
+
+ EXPORT_SYMBOL(locks_init_lock);
+diff --git a/fs/nfs/fscache.c b/fs/nfs/fscache.c
+index ce153a6..419119c 100644
+--- a/fs/nfs/fscache.c
++++ b/fs/nfs/fscache.c
+@@ -259,12 +259,10 @@ static void nfs_fscache_disable_inode_cookie(struct inode *inode)
+ dfprintk(FSCACHE,
+ "NFS: nfsi 0x%p turning cache off\n", NFS_I(inode));
+
+- /* Need to invalidate any mapped pages that were read in before
+- * turning off the cache.
++ /* Need to uncache any pages attached to this inode that
++ * fscache knows about before turning off the cache.
+ */
+- if (inode->i_mapping && inode->i_mapping->nrpages)
+- invalidate_inode_pages2(inode->i_mapping);
+-
++ fscache_uncache_all_inode_pages(NFS_I(inode)->fscache, inode);
+ nfs_fscache_zap_inode_cookie(inode);
+ }
+ }
+diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
+index 57bb31a..19877db 100644
+--- a/fs/nfs/inode.c
++++ b/fs/nfs/inode.c
+@@ -256,7 +256,8 @@ nfs_fhget(struct super_block *sb, struct nfs_fh *fh, struct nfs_fattr *fattr)
+
+ nfs_attr_check_mountpoint(sb, fattr);
+
+- if ((fattr->valid & NFS_ATTR_FATTR_FILEID) == 0 && (fattr->valid & NFS_ATTR_FATTR_MOUNTPOINT) == 0)
++ if (((fattr->valid & NFS_ATTR_FATTR_FILEID) == 0) &&
++ !nfs_attr_use_mounted_on_fileid(fattr))
+ goto out_no_inode;
+ if ((fattr->valid & NFS_ATTR_FATTR_TYPE) == 0)
+ goto out_no_inode;
+@@ -1294,7 +1295,8 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
+ if (new_isize != cur_isize) {
+ /* Do we perhaps have any outstanding writes, or has
+ * the file grown beyond our last write? */
+- if (nfsi->npages == 0 || new_isize > cur_isize) {
++ if ((nfsi->npages == 0 && !test_bit(NFS_INO_LAYOUTCOMMIT, &nfsi->flags)) ||
++ new_isize > cur_isize) {
+ i_size_write(inode, new_isize);
+ invalid |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA;
+ }
+diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
+index ce118ce..d10eb7e 100644
+--- a/fs/nfs/internal.h
++++ b/fs/nfs/internal.h
+@@ -45,6 +45,17 @@ static inline void nfs_attr_check_mountpoint(struct super_block *parent, struct
+ fattr->valid |= NFS_ATTR_FATTR_MOUNTPOINT;
+ }
+
++static inline int nfs_attr_use_mounted_on_fileid(struct nfs_fattr *fattr)
++{
++ if (((fattr->valid & NFS_ATTR_FATTR_MOUNTED_ON_FILEID) == 0) ||
++ (((fattr->valid & NFS_ATTR_FATTR_MOUNTPOINT) == 0) &&
++ ((fattr->valid & NFS_ATTR_FATTR_V4_REFERRAL) == 0)))
++ return 0;
++
++ fattr->fileid = fattr->mounted_on_fileid;
++ return 1;
++}
++
+ struct nfs_clone_mount {
+ const struct super_block *sb;
+ const struct dentry *dentry;
+diff --git a/fs/nfs/nfs4filelayout.c b/fs/nfs/nfs4filelayout.c
+index be79dc9..590c09c 100644
+--- a/fs/nfs/nfs4filelayout.c
++++ b/fs/nfs/nfs4filelayout.c
+@@ -554,13 +554,18 @@ filelayout_decode_layout(struct pnfs_layout_hdr *flo,
+ __func__, nfl_util, fl->num_fh, fl->first_stripe_index,
+ fl->pattern_offset);
+
+- if (!fl->num_fh)
++ /* Note that a zero value for num_fh is legal for STRIPE_SPARSE.
++ * Futher checking is done in filelayout_check_layout */
++ if (fl->num_fh < 0 || fl->num_fh >
++ max(NFS4_PNFS_MAX_STRIPE_CNT, NFS4_PNFS_MAX_MULTI_CNT))
+ goto out_err;
+
+- fl->fh_array = kzalloc(fl->num_fh * sizeof(struct nfs_fh *),
+- gfp_flags);
+- if (!fl->fh_array)
+- goto out_err;
++ if (fl->num_fh > 0) {
++ fl->fh_array = kzalloc(fl->num_fh * sizeof(struct nfs_fh *),
++ gfp_flags);
++ if (!fl->fh_array)
++ goto out_err;
++ }
+
+ for (i = 0; i < fl->num_fh; i++) {
+ /* Do we want to use a mempool here? */
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index d0e15db..d348326 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -2265,12 +2265,14 @@ static int nfs4_proc_get_root(struct nfs_server *server, struct nfs_fh *fhandle,
+ return nfs4_map_errors(status);
+ }
+
++static void nfs_fixup_referral_attributes(struct nfs_fattr *fattr);
+ /*
+ * Get locations and (maybe) other attributes of a referral.
+ * Note that we'll actually follow the referral later when
+ * we detect fsid mismatch in inode revalidation
+ */
+-static int nfs4_get_referral(struct inode *dir, const struct qstr *name, struct nfs_fattr *fattr, struct nfs_fh *fhandle)
++static int nfs4_get_referral(struct inode *dir, const struct qstr *name,
++ struct nfs_fattr *fattr, struct nfs_fh *fhandle)
+ {
+ int status = -ENOMEM;
+ struct page *page = NULL;
+@@ -2288,15 +2290,16 @@ static int nfs4_get_referral(struct inode *dir, const struct qstr *name, struct
+ goto out;
+ /* Make sure server returned a different fsid for the referral */
+ if (nfs_fsid_equal(&NFS_SERVER(dir)->fsid, &locations->fattr.fsid)) {
+- dprintk("%s: server did not return a different fsid for a referral at %s\n", __func__, name->name);
++ dprintk("%s: server did not return a different fsid for"
++ " a referral at %s\n", __func__, name->name);
+ status = -EIO;
+ goto out;
+ }
++ /* Fixup attributes for the nfs_lookup() call to nfs_fhget() */
++ nfs_fixup_referral_attributes(&locations->fattr);
+
++ /* replace the lookup nfs_fattr with the locations nfs_fattr */
+ memcpy(fattr, &locations->fattr, sizeof(struct nfs_fattr));
+- fattr->valid |= NFS_ATTR_FATTR_V4_REFERRAL;
+- if (!fattr->mode)
+- fattr->mode = S_IFDIR;
+ memset(fhandle, 0, sizeof(struct nfs_fh));
+ out:
+ if (page)
+@@ -4657,11 +4660,15 @@ static size_t nfs4_xattr_list_nfs4_acl(struct dentry *dentry, char *list,
+ return len;
+ }
+
++/*
++ * nfs_fhget will use either the mounted_on_fileid or the fileid
++ */
+ static void nfs_fixup_referral_attributes(struct nfs_fattr *fattr)
+ {
+- if (!((fattr->valid & NFS_ATTR_FATTR_FILEID) &&
+- (fattr->valid & NFS_ATTR_FATTR_FSID) &&
+- (fattr->valid & NFS_ATTR_FATTR_V4_REFERRAL)))
++ if (!(((fattr->valid & NFS_ATTR_FATTR_MOUNTED_ON_FILEID) ||
++ (fattr->valid & NFS_ATTR_FATTR_FILEID)) &&
++ (fattr->valid & NFS_ATTR_FATTR_FSID) &&
++ (fattr->valid & NFS_ATTR_FATTR_V4_REFERRAL)))
+ return;
+
+ fattr->valid |= NFS_ATTR_FATTR_TYPE | NFS_ATTR_FATTR_MODE |
+@@ -4676,7 +4683,6 @@ int nfs4_proc_fs_locations(struct inode *dir, const struct qstr *name,
+ struct nfs_server *server = NFS_SERVER(dir);
+ u32 bitmask[2] = {
+ [0] = FATTR4_WORD0_FSID | FATTR4_WORD0_FS_LOCATIONS,
+- [1] = FATTR4_WORD1_MOUNTED_ON_FILEID,
+ };
+ struct nfs4_fs_locations_arg args = {
+ .dir_fh = NFS_FH(dir),
+@@ -4695,11 +4701,18 @@ int nfs4_proc_fs_locations(struct inode *dir, const struct qstr *name,
+ int status;
+
+ dprintk("%s: start\n", __func__);
++
++ /* Ask for the fileid of the absent filesystem if mounted_on_fileid
++ * is not supported */
++ if (NFS_SERVER(dir)->attr_bitmask[1] & FATTR4_WORD1_MOUNTED_ON_FILEID)
++ bitmask[1] |= FATTR4_WORD1_MOUNTED_ON_FILEID;
++ else
++ bitmask[0] |= FATTR4_WORD0_FILEID;
++
+ nfs_fattr_init(&fs_locations->fattr);
+ fs_locations->server = server;
+ fs_locations->nlocations = 0;
+ status = nfs4_call_sync(server->client, server, &msg, &args.seq_args, &res.seq_res, 0);
+- nfs_fixup_referral_attributes(&fs_locations->fattr);
+ dprintk("%s: returned status = %d\n", __func__, status);
+ return status;
+ }
+diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
+index c3ccd2c..7685279 100644
+--- a/fs/nfs/nfs4xdr.c
++++ b/fs/nfs/nfs4xdr.c
+@@ -3030,7 +3030,7 @@ out_overflow:
+ return -EIO;
+ }
+
+-static int decode_attr_error(struct xdr_stream *xdr, uint32_t *bitmap)
++static int decode_attr_error(struct xdr_stream *xdr, uint32_t *bitmap, int32_t *res)
+ {
+ __be32 *p;
+
+@@ -3041,7 +3041,7 @@ static int decode_attr_error(struct xdr_stream *xdr, uint32_t *bitmap)
+ if (unlikely(!p))
+ goto out_overflow;
+ bitmap[0] &= ~FATTR4_WORD0_RDATTR_ERROR;
+- return -be32_to_cpup(p);
++ *res = -be32_to_cpup(p);
+ }
+ return 0;
+ out_overflow:
+@@ -4002,6 +4002,7 @@ static int decode_getfattr_attrs(struct xdr_stream *xdr, uint32_t *bitmap,
+ int status;
+ umode_t fmode = 0;
+ uint32_t type;
++ int32_t err;
+
+ status = decode_attr_type(xdr, bitmap, &type);
+ if (status < 0)
+@@ -4027,13 +4028,12 @@ static int decode_getfattr_attrs(struct xdr_stream *xdr, uint32_t *bitmap,
+ goto xdr_error;
+ fattr->valid |= status;
+
+- status = decode_attr_error(xdr, bitmap);
+- if (status == -NFS4ERR_WRONGSEC) {
+- nfs_fixup_secinfo_attributes(fattr, fh);
+- status = 0;
+- }
++ err = 0;
++ status = decode_attr_error(xdr, bitmap, &err);
+ if (status < 0)
+ goto xdr_error;
++ if (err == -NFS4ERR_WRONGSEC)
++ nfs_fixup_secinfo_attributes(fattr, fh);
+
+ status = decode_attr_filehandle(xdr, bitmap, fh);
+ if (status < 0)
+diff --git a/fs/nfsd/Kconfig b/fs/nfsd/Kconfig
+index 18b3e89..fbb2a5e 100644
+--- a/fs/nfsd/Kconfig
++++ b/fs/nfsd/Kconfig
+@@ -82,6 +82,7 @@ config NFSD_V4
+ select NFSD_V3
+ select FS_POSIX_ACL
+ select SUNRPC_GSS
++ select CRYPTO
+ help
+ This option enables support in your system's NFS server for
+ version 4 of the NFS protocol (RFC 3530).
+diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
+index 1f5eae4..2b1449d 100644
+--- a/fs/nfsd/nfsctl.c
++++ b/fs/nfsd/nfsctl.c
+@@ -13,6 +13,7 @@
+ #include <linux/lockd/lockd.h>
+ #include <linux/sunrpc/clnt.h>
+ #include <linux/sunrpc/gss_api.h>
++#include <linux/sunrpc/gss_krb5_enctypes.h>
+
+ #include "idmap.h"
+ #include "nfsd.h"
+@@ -189,18 +190,10 @@ static struct file_operations export_features_operations = {
+ .release = single_release,
+ };
+
+-#ifdef CONFIG_SUNRPC_GSS
++#if defined(CONFIG_SUNRPC_GSS) || defined(CONFIG_SUNRPC_GSS_MODULE)
+ static int supported_enctypes_show(struct seq_file *m, void *v)
+ {
+- struct gss_api_mech *k5mech;
+-
+- k5mech = gss_mech_get_by_name("krb5");
+- if (k5mech == NULL)
+- goto out;
+- if (k5mech->gm_upcall_enctypes != NULL)
+- seq_printf(m, k5mech->gm_upcall_enctypes);
+- gss_mech_put(k5mech);
+-out:
++ seq_printf(m, KRB5_SUPPORTED_ENCTYPES);
+ return 0;
+ }
+
+@@ -215,7 +208,7 @@ static struct file_operations supported_enctypes_ops = {
+ .llseek = seq_lseek,
+ .release = single_release,
+ };
+-#endif /* CONFIG_SUNRPC_GSS */
++#endif /* CONFIG_SUNRPC_GSS or CONFIG_SUNRPC_GSS_MODULE */
+
+ extern int nfsd_pool_stats_open(struct inode *inode, struct file *file);
+ extern int nfsd_pool_stats_release(struct inode *inode, struct file *file);
+@@ -1427,9 +1420,9 @@ static int nfsd_fill_super(struct super_block * sb, void * data, int silent)
+ [NFSD_Versions] = {"versions", &transaction_ops, S_IWUSR|S_IRUSR},
+ [NFSD_Ports] = {"portlist", &transaction_ops, S_IWUSR|S_IRUGO},
+ [NFSD_MaxBlkSize] = {"max_block_size", &transaction_ops, S_IWUSR|S_IRUGO},
+-#ifdef CONFIG_SUNRPC_GSS
++#if defined(CONFIG_SUNRPC_GSS) || defined(CONFIG_SUNRPC_GSS_MODULE)
+ [NFSD_SupportedEnctypes] = {"supported_krb5_enctypes", &supported_enctypes_ops, S_IRUGO},
+-#endif /* CONFIG_SUNRPC_GSS */
++#endif /* CONFIG_SUNRPC_GSS or CONFIG_SUNRPC_GSS_MODULE */
+ #ifdef CONFIG_NFSD_V4
+ [NFSD_Leasetime] = {"nfsv4leasetime", &transaction_ops, S_IWUSR|S_IRUSR},
+ [NFSD_Gracetime] = {"nfsv4gracetime", &transaction_ops, S_IWUSR|S_IRUSR},
+diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
+index 129f3c9..d80b2d8 100644
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -699,7 +699,15 @@ nfsd_access(struct svc_rqst *rqstp, struct svc_fh *fhp, u32 *access, u32 *suppor
+ }
+ #endif /* CONFIG_NFSD_V3 */
+
++static int nfsd_open_break_lease(struct inode *inode, int access)
++{
++ unsigned int mode;
+
++ if (access & NFSD_MAY_NOT_BREAK_LEASE)
++ return 0;
++ mode = (access & NFSD_MAY_WRITE) ? O_WRONLY : O_RDONLY;
++ return break_lease(inode, mode | O_NONBLOCK);
++}
+
+ /*
+ * Open an existing file or directory.
+@@ -747,12 +755,7 @@ nfsd_open(struct svc_rqst *rqstp, struct svc_fh *fhp, int type,
+ if (!inode->i_fop)
+ goto out;
+
+- /*
+- * Check to see if there are any leases on this file.
+- * This may block while leases are broken.
+- */
+- if (!(access & NFSD_MAY_NOT_BREAK_LEASE))
+- host_err = break_lease(inode, O_NONBLOCK | ((access & NFSD_MAY_WRITE) ? O_WRONLY : 0));
++ host_err = nfsd_open_break_lease(inode, access);
+ if (host_err) /* NOMEM or WOULDBLOCK */
+ goto out_nfserr;
+
+@@ -1653,8 +1656,10 @@ nfsd_link(struct svc_rqst *rqstp, struct svc_fh *ffhp,
+ if (!dold->d_inode)
+ goto out_drop_write;
+ host_err = nfsd_break_lease(dold->d_inode);
+- if (host_err)
++ if (host_err) {
++ err = nfserrno(host_err);
+ goto out_drop_write;
++ }
+ host_err = vfs_link(dold, dirp, dnew);
+ if (!host_err) {
+ err = nfserrno(commit_metadata(ffhp));
+diff --git a/include/asm-generic/bug.h b/include/asm-generic/bug.h
+index e5a3f58..dfb0ec6 100644
+--- a/include/asm-generic/bug.h
++++ b/include/asm-generic/bug.h
+@@ -162,9 +162,6 @@ extern void warn_slowpath_null(const char *file, const int line);
+ unlikely(__ret_warn_once); \
+ })
+
+-#define WARN_ON_RATELIMIT(condition, state) \
+- WARN_ON((condition) && __ratelimit(state))
+-
+ /*
+ * WARN_ON_SMP() is for cases that the warning is either
+ * meaningless for !SMP or may even cause failures.
+diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h
+index be50d9e..acdb143 100644
+--- a/include/linux/blk_types.h
++++ b/include/linux/blk_types.h
+@@ -168,7 +168,7 @@ enum rq_flag_bits {
+ (REQ_FAILFAST_DEV | REQ_FAILFAST_TRANSPORT | REQ_FAILFAST_DRIVER)
+ #define REQ_COMMON_MASK \
+ (REQ_WRITE | REQ_FAILFAST_MASK | REQ_SYNC | REQ_META | REQ_DISCARD | \
+- REQ_NOIDLE | REQ_FLUSH | REQ_FUA)
++ REQ_NOIDLE | REQ_FLUSH | REQ_FUA | REQ_SECURE)
+ #define REQ_CLONE_MASK REQ_COMMON_MASK
+
+ #define REQ_RAHEAD (1 << __REQ_RAHEAD)
+diff --git a/include/linux/clocksource.h b/include/linux/clocksource.h
+index c37b21a..24e2932 100644
+--- a/include/linux/clocksource.h
++++ b/include/linux/clocksource.h
+@@ -192,6 +192,7 @@ struct clocksource {
+ #ifdef CONFIG_CLOCKSOURCE_WATCHDOG
+ /* Watchdog related data, used by the framework */
+ struct list_head wd_list;
++ cycle_t cs_last;
+ cycle_t wd_last;
+ #endif
+ };
+diff --git a/include/linux/connector.h b/include/linux/connector.h
+index 7c60d09..f696bcc 100644
+--- a/include/linux/connector.h
++++ b/include/linux/connector.h
+@@ -44,7 +44,7 @@
+ #define CN_VAL_DRBD 0x1
+ #define CN_KVP_IDX 0x9 /* HyperV KVP */
+
+-#define CN_NETLINK_USERS 9
++#define CN_NETLINK_USERS 10 /* Highest index + 1 */
+
+ /*
+ * Maximum connector's message size.
+diff --git a/include/linux/device.h b/include/linux/device.h
+index d08399d..779e860 100644
+--- a/include/linux/device.h
++++ b/include/linux/device.h
+@@ -506,13 +506,13 @@ static inline int device_is_registered(struct device *dev)
+
+ static inline void device_enable_async_suspend(struct device *dev)
+ {
+- if (!dev->power.in_suspend)
++ if (!dev->power.is_prepared)
+ dev->power.async_suspend = true;
+ }
+
+ static inline void device_disable_async_suspend(struct device *dev)
+ {
+- if (!dev->power.in_suspend)
++ if (!dev->power.is_prepared)
+ dev->power.async_suspend = false;
+ }
+
+diff --git a/include/linux/fscache.h b/include/linux/fscache.h
+index 7c4d72f..9ec20de 100644
+--- a/include/linux/fscache.h
++++ b/include/linux/fscache.h
+@@ -204,6 +204,8 @@ extern bool __fscache_check_page_write(struct fscache_cookie *, struct page *);
+ extern void __fscache_wait_on_page_write(struct fscache_cookie *, struct page *);
+ extern bool __fscache_maybe_release_page(struct fscache_cookie *, struct page *,
+ gfp_t);
++extern void __fscache_uncache_all_inode_pages(struct fscache_cookie *,
++ struct inode *);
+
+ /**
+ * fscache_register_netfs - Register a filesystem as desiring caching services
+@@ -643,4 +645,23 @@ bool fscache_maybe_release_page(struct fscache_cookie *cookie,
+ return false;
+ }
+
++/**
++ * fscache_uncache_all_inode_pages - Uncache all an inode's pages
++ * @cookie: The cookie representing the inode's cache object.
++ * @inode: The inode to uncache pages from.
++ *
++ * Uncache all the pages in an inode that are marked PG_fscache, assuming them
++ * to be associated with the given cookie.
++ *
++ * This function may sleep. It will wait for pages that are being written out
++ * and will wait whilst the PG_fscache mark is removed by the cache.
++ */
++static inline
++void fscache_uncache_all_inode_pages(struct fscache_cookie *cookie,
++ struct inode *inode)
++{
++ if (fscache_cookie_valid(cookie))
++ __fscache_uncache_all_inode_pages(cookie, inode);
++}
++
+ #endif /* _LINUX_FSCACHE_H */
+diff --git a/include/linux/if_packet.h b/include/linux/if_packet.h
+index 72bfa5a..8e37fba 100644
+--- a/include/linux/if_packet.h
++++ b/include/linux/if_packet.h
+@@ -62,6 +62,7 @@ struct tpacket_auxdata {
+ __u16 tp_mac;
+ __u16 tp_net;
+ __u16 tp_vlan_tci;
++ __u16 tp_padding;
+ };
+
+ /* Rx ring - header status */
+@@ -100,6 +101,7 @@ struct tpacket2_hdr {
+ __u32 tp_sec;
+ __u32 tp_nsec;
+ __u16 tp_vlan_tci;
++ __u16 tp_padding;
+ };
+
+ #define TPACKET2_HDRLEN (TPACKET_ALIGN(sizeof(struct tpacket2_hdr)) + sizeof(struct sockaddr_ll))
+diff --git a/include/linux/netfilter/ipset/ip_set_ahash.h b/include/linux/netfilter/ipset/ip_set_ahash.h
+index a0196ac..ac3c822 100644
+--- a/include/linux/netfilter/ipset/ip_set_ahash.h
++++ b/include/linux/netfilter/ipset/ip_set_ahash.h
+@@ -839,7 +839,7 @@ type_pf_tdel(struct ip_set *set, void *value, u32 timeout)
+ struct htable *t = h->table;
+ const struct type_pf_elem *d = value;
+ struct hbucket *n;
+- int i, ret = 0;
++ int i;
+ struct type_pf_elem *data;
+ u32 key;
+
+@@ -850,7 +850,7 @@ type_pf_tdel(struct ip_set *set, void *value, u32 timeout)
+ if (!type_pf_data_equal(data, d))
+ continue;
+ if (type_pf_data_expired(data))
+- ret = -IPSET_ERR_EXIST;
++ return -IPSET_ERR_EXIST;
+ if (i != n->pos - 1)
+ /* Not last one */
+ type_pf_data_copy(data, ahash_tdata(n, n->pos - 1));
+diff --git a/include/linux/netfilter/ipset/ip_set_timeout.h b/include/linux/netfilter/ipset/ip_set_timeout.h
+index 9f30c5f..bb773c1 100644
+--- a/include/linux/netfilter/ipset/ip_set_timeout.h
++++ b/include/linux/netfilter/ipset/ip_set_timeout.h
+@@ -45,7 +45,7 @@ ip_set_timeout_test(unsigned long timeout)
+ {
+ return timeout != IPSET_ELEM_UNSET &&
+ (timeout == IPSET_ELEM_PERMANENT ||
+- time_after(timeout, jiffies));
++ time_is_after_jiffies(timeout));
+ }
+
+ static inline bool
+@@ -53,7 +53,7 @@ ip_set_timeout_expired(unsigned long timeout)
+ {
+ return timeout != IPSET_ELEM_UNSET &&
+ timeout != IPSET_ELEM_PERMANENT &&
+- time_before(timeout, jiffies);
++ time_is_before_jiffies(timeout);
+ }
+
+ static inline unsigned long
+@@ -64,7 +64,7 @@ ip_set_timeout_set(u32 timeout)
+ if (!timeout)
+ return IPSET_ELEM_PERMANENT;
+
+- t = timeout * HZ + jiffies;
++ t = msecs_to_jiffies(timeout * 1000) + jiffies;
+ if (t == IPSET_ELEM_UNSET || t == IPSET_ELEM_PERMANENT)
+ /* Bingo! */
+ t++;
+@@ -75,7 +75,8 @@ ip_set_timeout_set(u32 timeout)
+ static inline u32
+ ip_set_timeout_get(unsigned long timeout)
+ {
+- return timeout == IPSET_ELEM_PERMANENT ? 0 : (timeout - jiffies)/HZ;
++ return timeout == IPSET_ELEM_PERMANENT ? 0 :
++ jiffies_to_msecs(timeout - jiffies)/1000;
+ }
+
+ #else
+@@ -89,14 +90,14 @@ static inline bool
+ ip_set_timeout_test(unsigned long timeout)
+ {
+ return timeout == IPSET_ELEM_PERMANENT ||
+- time_after(timeout, jiffies);
++ time_is_after_jiffies(timeout);
+ }
+
+ static inline bool
+ ip_set_timeout_expired(unsigned long timeout)
+ {
+ return timeout != IPSET_ELEM_PERMANENT &&
+- time_before(timeout, jiffies);
++ time_is_before_jiffies(timeout);
+ }
+
+ static inline unsigned long
+@@ -107,7 +108,7 @@ ip_set_timeout_set(u32 timeout)
+ if (!timeout)
+ return IPSET_ELEM_PERMANENT;
+
+- t = timeout * HZ + jiffies;
++ t = msecs_to_jiffies(timeout * 1000) + jiffies;
+ if (t == IPSET_ELEM_PERMANENT)
+ /* Bingo! :-) */
+ t++;
+@@ -118,7 +119,8 @@ ip_set_timeout_set(u32 timeout)
+ static inline u32
+ ip_set_timeout_get(unsigned long timeout)
+ {
+- return timeout == IPSET_ELEM_PERMANENT ? 0 : (timeout - jiffies)/HZ;
++ return timeout == IPSET_ELEM_PERMANENT ? 0 :
++ jiffies_to_msecs(timeout - jiffies)/1000;
+ }
+ #endif /* ! IP_SET_BITMAP_TIMEOUT */
+
+diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
+index 8652a4f..d041a4a 100644
+--- a/include/linux/pci_ids.h
++++ b/include/linux/pci_ids.h
+@@ -1537,6 +1537,7 @@
+ #define PCI_DEVICE_ID_RICOH_RL5C476 0x0476
+ #define PCI_DEVICE_ID_RICOH_RL5C478 0x0478
+ #define PCI_DEVICE_ID_RICOH_R5C822 0x0822
++#define PCI_DEVICE_ID_RICOH_R5CE823 0xe823
+ #define PCI_DEVICE_ID_RICOH_R5C832 0x0832
+ #define PCI_DEVICE_ID_RICOH_R5C843 0x0843
+
+diff --git a/include/linux/pm.h b/include/linux/pm.h
+index 512e091..fffb12f 100644
+--- a/include/linux/pm.h
++++ b/include/linux/pm.h
+@@ -425,7 +425,8 @@ struct dev_pm_info {
+ pm_message_t power_state;
+ unsigned int can_wakeup:1;
+ unsigned int async_suspend:1;
+- unsigned int in_suspend:1; /* Owned by the PM core */
++ bool is_prepared:1; /* Owned by the PM core */
++ bool is_suspended:1; /* Ditto */
+ spinlock_t lock;
+ #ifdef CONFIG_PM_SLEEP
+ struct list_head entry;
+diff --git a/include/linux/ratelimit.h b/include/linux/ratelimit.h
+index 03ff67b..2f00715 100644
+--- a/include/linux/ratelimit.h
++++ b/include/linux/ratelimit.h
+@@ -41,4 +41,44 @@ extern struct ratelimit_state printk_ratelimit_state;
+ extern int ___ratelimit(struct ratelimit_state *rs, const char *func);
+ #define __ratelimit(state) ___ratelimit(state, __func__)
+
++#ifdef CONFIG_PRINTK
++
++#define WARN_ON_RATELIMIT(condition, state) \
++ WARN_ON((condition) && __ratelimit(state))
++
++#define __WARN_RATELIMIT(condition, state, format...) \
++({ \
++ int rtn = 0; \
++ if (unlikely(__ratelimit(state))) \
++ rtn = WARN(condition, format); \
++ rtn; \
++})
++
++#define WARN_RATELIMIT(condition, format...) \
++({ \
++ static DEFINE_RATELIMIT_STATE(_rs, \
++ DEFAULT_RATELIMIT_INTERVAL, \
++ DEFAULT_RATELIMIT_BURST); \
++ __WARN_RATELIMIT(condition, &_rs, format); \
++})
++
++#else
++
++#define WARN_ON_RATELIMIT(condition, state) \
++ WARN_ON(condition)
++
++#define __WARN_RATELIMIT(condition, state, format...) \
++({ \
++ int rtn = WARN(condition, format); \
++ rtn; \
++})
++
++#define WARN_RATELIMIT(condition, format...) \
++({ \
++ int rtn = WARN(condition, format); \
++ rtn; \
++})
++
++#endif
++
+ #endif /* _LINUX_RATELIMIT_H */
+diff --git a/include/linux/sunrpc/gss_krb5_enctypes.h b/include/linux/sunrpc/gss_krb5_enctypes.h
+new file mode 100644
+index 0000000..ec6234e
+--- /dev/null
++++ b/include/linux/sunrpc/gss_krb5_enctypes.h
+@@ -0,0 +1,4 @@
++/*
++ * Dumb way to share this static piece of information with nfsd
++ */
++#define KRB5_SUPPORTED_ENCTYPES "18,17,16,23,3,1,2"
+diff --git a/include/linux/sunrpc/sched.h b/include/linux/sunrpc/sched.h
+index f73c482..fe2d8e6 100644
+--- a/include/linux/sunrpc/sched.h
++++ b/include/linux/sunrpc/sched.h
+@@ -84,7 +84,8 @@ struct rpc_task {
+ #endif
+ unsigned char tk_priority : 2,/* Task priority */
+ tk_garb_retry : 2,
+- tk_cred_retry : 2;
++ tk_cred_retry : 2,
++ tk_rebind_retry : 2;
+ };
+ #define tk_xprt tk_client->cl_xprt
+
+diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
+index 86aefed..e5bf4c8 100644
+--- a/include/net/ip_vs.h
++++ b/include/net/ip_vs.h
+@@ -802,7 +802,8 @@ struct netns_ipvs {
+ struct list_head rs_table[IP_VS_RTAB_SIZE];
+ /* ip_vs_app */
+ struct list_head app_list;
+-
++ /* ip_vs_ftp */
++ struct ip_vs_app *ftp_app;
+ /* ip_vs_proto */
+ #define IP_VS_PROTO_TAB_SIZE 32 /* must be power of 2 */
+ struct ip_vs_proto_data *proto_data_table[IP_VS_PROTO_TAB_SIZE];
+diff --git a/init/calibrate.c b/init/calibrate.c
+index 76ac919..30a44cd 100644
+--- a/init/calibrate.c
++++ b/init/calibrate.c
+@@ -185,30 +185,32 @@ recalibrate:
+
+ void __cpuinit calibrate_delay(void)
+ {
++ unsigned long lpj;
+ static bool printed;
+
+ if (preset_lpj) {
+- loops_per_jiffy = preset_lpj;
++ lpj = preset_lpj;
+ if (!printed)
+ pr_info("Calibrating delay loop (skipped) "
+ "preset value.. ");
+ } else if ((!printed) && lpj_fine) {
+- loops_per_jiffy = lpj_fine;
++ lpj = lpj_fine;
+ pr_info("Calibrating delay loop (skipped), "
+ "value calculated using timer frequency.. ");
+- } else if ((loops_per_jiffy = calibrate_delay_direct()) != 0) {
++ } else if ((lpj = calibrate_delay_direct()) != 0) {
+ if (!printed)
+ pr_info("Calibrating delay using timer "
+ "specific routine.. ");
+ } else {
+ if (!printed)
+ pr_info("Calibrating delay loop... ");
+- loops_per_jiffy = calibrate_delay_converge();
++ lpj = calibrate_delay_converge();
+ }
+ if (!printed)
+ pr_cont("%lu.%02lu BogoMIPS (lpj=%lu)\n",
+- loops_per_jiffy/(500000/HZ),
+- (loops_per_jiffy/(5000/HZ)) % 100, loops_per_jiffy);
++ lpj/(500000/HZ),
++ (lpj/(5000/HZ)) % 100, lpj);
+
++ loops_per_jiffy = lpj;
+ printed = true;
+ }
+diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
+index ca0aacc..1a78c1a 100644
+--- a/kernel/power/snapshot.c
++++ b/kernel/power/snapshot.c
+@@ -1199,7 +1199,11 @@ static void free_unnecessary_pages(void)
+ to_free_highmem = alloc_highmem - save;
+ } else {
+ to_free_highmem = 0;
+- to_free_normal -= save - alloc_highmem;
++ save -= alloc_highmem;
++ if (to_free_normal > save)
++ to_free_normal -= save;
++ else
++ to_free_normal = 0;
+ }
+
+ memory_bm_position_reset(©_bm);
+diff --git a/kernel/power/user.c b/kernel/power/user.c
+index 7d02d33..42ddbc6 100644
+--- a/kernel/power/user.c
++++ b/kernel/power/user.c
+@@ -113,8 +113,10 @@ static int snapshot_open(struct inode *inode, struct file *filp)
+ if (error)
+ pm_notifier_call_chain(PM_POST_RESTORE);
+ }
+- if (error)
++ if (error) {
++ free_basic_memory_bitmaps();
+ atomic_inc(&snapshot_device_available);
++ }
+ data->frozen = 0;
+ data->ready = 0;
+ data->platform_support = 0;
+diff --git a/kernel/taskstats.c b/kernel/taskstats.c
+index 9ffea36..fc0f220 100644
+--- a/kernel/taskstats.c
++++ b/kernel/taskstats.c
+@@ -285,16 +285,18 @@ ret:
+ static int add_del_listener(pid_t pid, const struct cpumask *mask, int isadd)
+ {
+ struct listener_list *listeners;
+- struct listener *s, *tmp;
++ struct listener *s, *tmp, *s2;
+ unsigned int cpu;
+
+ if (!cpumask_subset(mask, cpu_possible_mask))
+ return -EINVAL;
+
++ s = NULL;
+ if (isadd == REGISTER) {
+ for_each_cpu(cpu, mask) {
+- s = kmalloc_node(sizeof(struct listener), GFP_KERNEL,
+- cpu_to_node(cpu));
++ if (!s)
++ s = kmalloc_node(sizeof(struct listener),
++ GFP_KERNEL, cpu_to_node(cpu));
+ if (!s)
+ goto cleanup;
+ s->pid = pid;
+@@ -303,9 +305,16 @@ static int add_del_listener(pid_t pid, const struct cpumask *mask, int isadd)
+
+ listeners = &per_cpu(listener_array, cpu);
+ down_write(&listeners->sem);
++ list_for_each_entry_safe(s2, tmp, &listeners->list, list) {
++ if (s2->pid == pid)
++ goto next_cpu;
++ }
+ list_add(&s->list, &listeners->list);
++ s = NULL;
++next_cpu:
+ up_write(&listeners->sem);
+ }
++ kfree(s);
+ return 0;
+ }
+
+diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c
+index 0e17c10..727da92 100644
+--- a/kernel/time/clocksource.c
++++ b/kernel/time/clocksource.c
+@@ -185,7 +185,6 @@ static struct clocksource *watchdog;
+ static struct timer_list watchdog_timer;
+ static DECLARE_WORK(watchdog_work, clocksource_watchdog_work);
+ static DEFINE_SPINLOCK(watchdog_lock);
+-static cycle_t watchdog_last;
+ static int watchdog_running;
+
+ static int clocksource_watchdog_kthread(void *data);
+@@ -254,11 +253,6 @@ static void clocksource_watchdog(unsigned long data)
+ if (!watchdog_running)
+ goto out;
+
+- wdnow = watchdog->read(watchdog);
+- wd_nsec = clocksource_cyc2ns((wdnow - watchdog_last) & watchdog->mask,
+- watchdog->mult, watchdog->shift);
+- watchdog_last = wdnow;
+-
+ list_for_each_entry(cs, &watchdog_list, wd_list) {
+
+ /* Clocksource already marked unstable? */
+@@ -268,19 +262,28 @@ static void clocksource_watchdog(unsigned long data)
+ continue;
+ }
+
++ local_irq_disable();
+ csnow = cs->read(cs);
++ wdnow = watchdog->read(watchdog);
++ local_irq_enable();
+
+ /* Clocksource initialized ? */
+ if (!(cs->flags & CLOCK_SOURCE_WATCHDOG)) {
+ cs->flags |= CLOCK_SOURCE_WATCHDOG;
+- cs->wd_last = csnow;
++ cs->wd_last = wdnow;
++ cs->cs_last = csnow;
+ continue;
+ }
+
+- /* Check the deviation from the watchdog clocksource. */
+- cs_nsec = clocksource_cyc2ns((csnow - cs->wd_last) &
++ wd_nsec = clocksource_cyc2ns((wdnow - cs->wd_last) & watchdog->mask,
++ watchdog->mult, watchdog->shift);
++
++ cs_nsec = clocksource_cyc2ns((csnow - cs->cs_last) &
+ cs->mask, cs->mult, cs->shift);
+- cs->wd_last = csnow;
++ cs->cs_last = csnow;
++ cs->wd_last = wdnow;
++
++ /* Check the deviation from the watchdog clocksource. */
+ if (abs(cs_nsec - wd_nsec) > WATCHDOG_THRESHOLD) {
+ clocksource_unstable(cs, cs_nsec - wd_nsec);
+ continue;
+@@ -318,7 +321,6 @@ static inline void clocksource_start_watchdog(void)
+ return;
+ init_timer(&watchdog_timer);
+ watchdog_timer.function = clocksource_watchdog;
+- watchdog_last = watchdog->read(watchdog);
+ watchdog_timer.expires = jiffies + WATCHDOG_INTERVAL;
+ add_timer_on(&watchdog_timer, cpumask_first(cpu_online_mask));
+ watchdog_running = 1;
+diff --git a/lib/debugobjects.c b/lib/debugobjects.c
+index 9d86e45..a78b7c6 100644
+--- a/lib/debugobjects.c
++++ b/lib/debugobjects.c
+@@ -198,7 +198,7 @@ static void free_object(struct debug_obj *obj)
+ * initialized:
+ */
+ if (obj_pool_free > ODEBUG_POOL_SIZE && obj_cache)
+- sched = !work_pending(&debug_obj_work);
++ sched = keventd_up() && !work_pending(&debug_obj_work);
+ hlist_add_head(&obj->node, &obj_pool);
+ obj_pool_free++;
+ obj_pool_used--;
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 39f86fc..f7c32fb 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -1111,6 +1111,14 @@ static void __init gather_bootmem_prealloc(void)
+ WARN_ON(page_count(page) != 1);
+ prep_compound_huge_page(page, h->order);
+ prep_new_huge_page(h, page, page_to_nid(page));
++ /*
++ * If we had gigantic hugepages allocated at boot time, we need
++ * to restore the 'stolen' pages to totalram_pages in order to
++ * fix confusing memory reports from free(1) and another
++ * side-effects, like CommitLimit going negative.
++ */
++ if (h->order > (MAX_ORDER - 1))
++ totalram_pages += 1 << h->order;
+ }
+ }
+
+diff --git a/mm/ksm.c b/mm/ksm.c
+index 942dfc7..e48c86e 100644
+--- a/mm/ksm.c
++++ b/mm/ksm.c
+@@ -1301,6 +1301,12 @@ static struct rmap_item *scan_get_next_rmap_item(struct page **page)
+ slot = list_entry(slot->mm_list.next, struct mm_slot, mm_list);
+ ksm_scan.mm_slot = slot;
+ spin_unlock(&ksm_mmlist_lock);
++ /*
++ * Although we tested list_empty() above, a racing __ksm_exit
++ * of the last mm on the list may have removed it since then.
++ */
++ if (slot == &ksm_mm_head)
++ return NULL;
+ next_mm:
+ ksm_scan.address = 0;
+ ksm_scan.rmap_list = &slot->rmap_list;
+diff --git a/mm/memory-failure.c b/mm/memory-failure.c
+index 2b9a5ee..9568e0b 100644
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -52,6 +52,7 @@
+ #include <linux/swapops.h>
+ #include <linux/hugetlb.h>
+ #include <linux/memory_hotplug.h>
++#include <linux/mm_inline.h>
+ #include "internal.h"
+
+ int sysctl_memory_failure_early_kill __read_mostly = 0;
+@@ -1463,7 +1464,8 @@ int soft_offline_page(struct page *page, int flags)
+ ret = isolate_lru_page(page);
+ if (!ret) {
+ LIST_HEAD(pagelist);
+-
++ inc_zone_page_state(page, NR_ISOLATED_ANON +
++ page_is_file_cache(page));
+ list_add(&page->lru, &pagelist);
+ ret = migrate_pages(&pagelist, new_page, MPOL_MF_MOVE_ALL,
+ 0, true);
+diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
+index 9ca1d60..fc5e0ba 100644
+--- a/mm/memory_hotplug.c
++++ b/mm/memory_hotplug.c
+@@ -518,7 +518,7 @@ int mem_online_node(int nid)
+
+ lock_memory_hotplug();
+ pgdat = hotadd_new_pgdat(nid, 0);
+- if (pgdat) {
++ if (!pgdat) {
+ ret = -ENOMEM;
+ goto out;
+ }
+diff --git a/mm/migrate.c b/mm/migrate.c
+index 34132f8..3179891 100644
+--- a/mm/migrate.c
++++ b/mm/migrate.c
+@@ -288,7 +288,7 @@ static int migrate_page_move_mapping(struct address_space *mapping,
+ */
+ __dec_zone_page_state(page, NR_FILE_PAGES);
+ __inc_zone_page_state(newpage, NR_FILE_PAGES);
+- if (PageSwapBacked(page)) {
++ if (!PageSwapCache(page) && PageSwapBacked(page)) {
+ __dec_zone_page_state(page, NR_SHMEM);
+ __inc_zone_page_state(newpage, NR_SHMEM);
+ }
+diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
+index b2ff6c8..f11e61e 100644
+--- a/net/8021q/vlan_dev.c
++++ b/net/8021q/vlan_dev.c
+@@ -338,7 +338,7 @@ static netdev_tx_t vlan_dev_hard_start_xmit(struct sk_buff *skb,
+ u64_stats_update_begin(&stats->syncp);
+ stats->tx_packets++;
+ stats->tx_bytes += len;
+- u64_stats_update_begin(&stats->syncp);
++ u64_stats_update_end(&stats->syncp);
+ } else {
+ this_cpu_inc(vlan_dev_info(dev)->vlan_pcpu_stats->tx_dropped);
+ }
+diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
+index 5f9c091..ecaaa00 100644
+--- a/net/bridge/br_netfilter.c
++++ b/net/bridge/br_netfilter.c
+@@ -104,10 +104,16 @@ static void fake_update_pmtu(struct dst_entry *dst, u32 mtu)
+ {
+ }
+
++static u32 *fake_cow_metrics(struct dst_entry *dst, unsigned long old)
++{
++ return NULL;
++}
++
+ static struct dst_ops fake_dst_ops = {
+ .family = AF_INET,
+ .protocol = cpu_to_be16(ETH_P_IP),
+ .update_pmtu = fake_update_pmtu,
++ .cow_metrics = fake_cow_metrics,
+ };
+
+ /*
+diff --git a/net/core/ethtool.c b/net/core/ethtool.c
+index f337525..76ed645 100644
+--- a/net/core/ethtool.c
++++ b/net/core/ethtool.c
+@@ -231,6 +231,29 @@ static int ethtool_set_feature_compat(struct net_device *dev,
+ return 1;
+ }
+
++static int ethtool_set_flags_compat(struct net_device *dev,
++ int (*legacy_set)(struct net_device *, u32),
++ struct ethtool_set_features_block *features, u32 mask)
++{
++ u32 value;
++
++ if (!legacy_set)
++ return 0;
++
++ if (!(features[0].valid & mask))
++ return 0;
++
++ value = dev->features & ~features[0].valid;
++ value |= features[0].requested;
++
++ features[0].valid &= ~mask;
++
++ if (legacy_set(dev, value & mask) < 0)
++ netdev_info(dev, "Legacy flags change failed\n");
++
++ return 1;
++}
++
+ static int ethtool_set_features_compat(struct net_device *dev,
+ struct ethtool_set_features_block *features)
+ {
+@@ -247,7 +270,7 @@ static int ethtool_set_features_compat(struct net_device *dev,
+ features, NETIF_F_ALL_TSO);
+ compat |= ethtool_set_feature_compat(dev, dev->ethtool_ops->set_rx_csum,
+ features, NETIF_F_RXCSUM);
+- compat |= ethtool_set_feature_compat(dev, dev->ethtool_ops->set_flags,
++ compat |= ethtool_set_flags_compat(dev, dev->ethtool_ops->set_flags,
+ features, flags_dup_features);
+
+ return compat;
+diff --git a/net/core/filter.c b/net/core/filter.c
+index afb8afb..1238cbd 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -38,6 +38,7 @@
+ #include <asm/unaligned.h>
+ #include <linux/filter.h>
+ #include <linux/reciprocal_div.h>
++#include <linux/ratelimit.h>
+
+ enum {
+ BPF_S_RET_K = 1,
+@@ -409,7 +410,9 @@ load_b:
+ continue;
+ }
+ default:
+- WARN_ON(1);
++ WARN_RATELIMIT(1, "Unknown code:%u jt:%u tf:%u k:%u\n",
++ fentry->code, fentry->jt,
++ fentry->jf, fentry->k);
+ return 0;
+ }
+ }
+diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
+index 807d83c..6bab50e 100644
+--- a/net/ipv4/af_inet.c
++++ b/net/ipv4/af_inet.c
+@@ -464,6 +464,9 @@ int inet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+ if (addr_len < sizeof(struct sockaddr_in))
+ goto out;
+
++ if (addr->sin_family != AF_INET)
++ goto out;
++
+ chk_addr_ret = inet_addr_type(sock_net(sk), addr->sin_addr.s_addr);
+
+ /* Not specified by any standard per-se, however it breaks too
+diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
+index 2ada171..65c23d9 100644
+--- a/net/ipv4/inet_diag.c
++++ b/net/ipv4/inet_diag.c
+@@ -437,7 +437,7 @@ static int valid_cc(const void *bc, int len, int cc)
+ return 0;
+ if (cc == len)
+ return 1;
+- if (op->yes < 4)
++ if (op->yes < 4 || op->yes & 3)
+ return 0;
+ len -= op->yes;
+ bc += op->yes;
+@@ -447,11 +447,11 @@ static int valid_cc(const void *bc, int len, int cc)
+
+ static int inet_diag_bc_audit(const void *bytecode, int bytecode_len)
+ {
+- const unsigned char *bc = bytecode;
++ const void *bc = bytecode;
+ int len = bytecode_len;
+
+ while (len > 0) {
+- struct inet_diag_bc_op *op = (struct inet_diag_bc_op *)bc;
++ const struct inet_diag_bc_op *op = bc;
+
+ //printk("BC: %d %d %d {%d} / %d\n", op->code, op->yes, op->no, op[1].no, len);
+ switch (op->code) {
+@@ -462,22 +462,20 @@ static int inet_diag_bc_audit(const void *bytecode, int bytecode_len)
+ case INET_DIAG_BC_S_LE:
+ case INET_DIAG_BC_D_GE:
+ case INET_DIAG_BC_D_LE:
+- if (op->yes < 4 || op->yes > len + 4)
+- return -EINVAL;
+ case INET_DIAG_BC_JMP:
+- if (op->no < 4 || op->no > len + 4)
++ if (op->no < 4 || op->no > len + 4 || op->no & 3)
+ return -EINVAL;
+ if (op->no < len &&
+ !valid_cc(bytecode, bytecode_len, len - op->no))
+ return -EINVAL;
+ break;
+ case INET_DIAG_BC_NOP:
+- if (op->yes < 4 || op->yes > len + 4)
+- return -EINVAL;
+ break;
+ default:
+ return -EINVAL;
+ }
++ if (op->yes < 4 || op->yes > len + 4 || op->yes & 3)
++ return -EINVAL;
+ bc += op->yes;
+ len -= op->yes;
+ }
+diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
+index 9df4e63..ce616d9 100644
+--- a/net/ipv4/inetpeer.c
++++ b/net/ipv4/inetpeer.c
+@@ -154,11 +154,9 @@ void __init inet_initpeers(void)
+ /* Called with or without local BH being disabled. */
+ static void unlink_from_unused(struct inet_peer *p)
+ {
+- if (!list_empty(&p->unused)) {
+- spin_lock_bh(&unused_peers.lock);
+- list_del_init(&p->unused);
+- spin_unlock_bh(&unused_peers.lock);
+- }
++ spin_lock_bh(&unused_peers.lock);
++ list_del_init(&p->unused);
++ spin_unlock_bh(&unused_peers.lock);
+ }
+
+ static int addr_compare(const struct inetpeer_addr *a,
+@@ -205,6 +203,20 @@ static int addr_compare(const struct inetpeer_addr *a,
+ u; \
+ })
+
++static bool atomic_add_unless_return(atomic_t *ptr, int a, int u, int *newv)
++{
++ int cur, old = atomic_read(ptr);
++
++ while (old != u) {
++ *newv = old + a;
++ cur = atomic_cmpxchg(ptr, old, *newv);
++ if (cur == old)
++ return true;
++ old = cur;
++ }
++ return false;
++}
++
+ /*
+ * Called with rcu_read_lock()
+ * Because we hold no lock against a writer, its quite possible we fall
+@@ -213,7 +225,8 @@ static int addr_compare(const struct inetpeer_addr *a,
+ * We exit from this function if number of links exceeds PEER_MAXDEPTH
+ */
+ static struct inet_peer *lookup_rcu(const struct inetpeer_addr *daddr,
+- struct inet_peer_base *base)
++ struct inet_peer_base *base,
++ int *newrefcnt)
+ {
+ struct inet_peer *u = rcu_dereference(base->root);
+ int count = 0;
+@@ -226,7 +239,7 @@ static struct inet_peer *lookup_rcu(const struct inetpeer_addr *daddr,
+ * distinction between an unused entry (refcnt=0) and
+ * a freed one.
+ */
+- if (unlikely(!atomic_add_unless(&u->refcnt, 1, -1)))
++ if (!atomic_add_unless_return(&u->refcnt, 1, -1, newrefcnt))
+ u = NULL;
+ return u;
+ }
+@@ -465,22 +478,23 @@ struct inet_peer *inet_getpeer(struct inetpeer_addr *daddr, int create)
+ struct inet_peer_base *base = family_to_base(daddr->family);
+ struct inet_peer *p;
+ unsigned int sequence;
+- int invalidated;
++ int invalidated, newrefcnt = 0;
+
+ /* Look up for the address quickly, lockless.
+ * Because of a concurrent writer, we might not find an existing entry.
+ */
+ rcu_read_lock();
+ sequence = read_seqbegin(&base->lock);
+- p = lookup_rcu(daddr, base);
++ p = lookup_rcu(daddr, base, &newrefcnt);
+ invalidated = read_seqretry(&base->lock, sequence);
+ rcu_read_unlock();
+
+ if (p) {
+- /* The existing node has been found.
++found: /* The existing node has been found.
+ * Remove the entry from unused list if it was there.
+ */
+- unlink_from_unused(p);
++ if (newrefcnt == 1)
++ unlink_from_unused(p);
+ return p;
+ }
+
+@@ -494,11 +508,9 @@ struct inet_peer *inet_getpeer(struct inetpeer_addr *daddr, int create)
+ write_seqlock_bh(&base->lock);
+ p = lookup(daddr, stack, base);
+ if (p != peer_avl_empty) {
+- atomic_inc(&p->refcnt);
++ newrefcnt = atomic_inc_return(&p->refcnt);
+ write_sequnlock_bh(&base->lock);
+- /* Remove the entry from unused list if it was there. */
+- unlink_from_unused(p);
+- return p;
++ goto found;
+ }
+ p = create ? kmem_cache_alloc(peer_cachep, GFP_ATOMIC) : NULL;
+ if (p) {
+diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c
+index 4614bab..2e97e3e 100644
+--- a/net/ipv4/netfilter.c
++++ b/net/ipv4/netfilter.c
+@@ -17,51 +17,35 @@ int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type)
+ const struct iphdr *iph = ip_hdr(skb);
+ struct rtable *rt;
+ struct flowi4 fl4 = {};
+- unsigned long orefdst;
++ __be32 saddr = iph->saddr;
++ __u8 flags = 0;
+ unsigned int hh_len;
+- unsigned int type;
+
+- type = inet_addr_type(net, iph->saddr);
+- if (skb->sk && inet_sk(skb->sk)->transparent)
+- type = RTN_LOCAL;
+- if (addr_type == RTN_UNSPEC)
+- addr_type = type;
++ if (!skb->sk && addr_type != RTN_LOCAL) {
++ if (addr_type == RTN_UNSPEC)
++ addr_type = inet_addr_type(net, saddr);
++ if (addr_type == RTN_LOCAL || addr_type == RTN_UNICAST)
++ flags |= FLOWI_FLAG_ANYSRC;
++ else
++ saddr = 0;
++ }
+
+ /* some non-standard hacks like ipt_REJECT.c:send_reset() can cause
+ * packets with foreign saddr to appear on the NF_INET_LOCAL_OUT hook.
+ */
+- if (addr_type == RTN_LOCAL) {
+- fl4.daddr = iph->daddr;
+- if (type == RTN_LOCAL)
+- fl4.saddr = iph->saddr;
+- fl4.flowi4_tos = RT_TOS(iph->tos);
+- fl4.flowi4_oif = skb->sk ? skb->sk->sk_bound_dev_if : 0;
+- fl4.flowi4_mark = skb->mark;
+- fl4.flowi4_flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : 0;
+- rt = ip_route_output_key(net, &fl4);
+- if (IS_ERR(rt))
+- return -1;
+-
+- /* Drop old route. */
+- skb_dst_drop(skb);
+- skb_dst_set(skb, &rt->dst);
+- } else {
+- /* non-local src, find valid iif to satisfy
+- * rp-filter when calling ip_route_input. */
+- fl4.daddr = iph->saddr;
+- rt = ip_route_output_key(net, &fl4);
+- if (IS_ERR(rt))
+- return -1;
++ fl4.daddr = iph->daddr;
++ fl4.saddr = saddr;
++ fl4.flowi4_tos = RT_TOS(iph->tos);
++ fl4.flowi4_oif = skb->sk ? skb->sk->sk_bound_dev_if : 0;
++ fl4.flowi4_mark = skb->mark;
++ fl4.flowi4_flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : flags;
++ rt = ip_route_output_key(net, &fl4);
++ if (IS_ERR(rt))
++ return -1;
+
+- orefdst = skb->_skb_refdst;
+- if (ip_route_input(skb, iph->daddr, iph->saddr,
+- RT_TOS(iph->tos), rt->dst.dev) != 0) {
+- dst_release(&rt->dst);
+- return -1;
+- }
+- dst_release(&rt->dst);
+- refdst_drop(orefdst);
+- }
++ /* Drop old route. */
++ skb_dst_drop(skb);
++ skb_dst_set(skb, &rt->dst);
+
+ if (skb_dst(skb)->error)
+ return -1;
+diff --git a/net/ipv4/netfilter/ipt_REJECT.c b/net/ipv4/netfilter/ipt_REJECT.c
+index 1ff79e5..51f13f8 100644
+--- a/net/ipv4/netfilter/ipt_REJECT.c
++++ b/net/ipv4/netfilter/ipt_REJECT.c
+@@ -40,7 +40,6 @@ static void send_reset(struct sk_buff *oldskb, int hook)
+ struct iphdr *niph;
+ const struct tcphdr *oth;
+ struct tcphdr _otcph, *tcph;
+- unsigned int addr_type;
+
+ /* IP header checks: fragment. */
+ if (ip_hdr(oldskb)->frag_off & htons(IP_OFFSET))
+@@ -55,6 +54,9 @@ static void send_reset(struct sk_buff *oldskb, int hook)
+ if (oth->rst)
+ return;
+
++ if (skb_rtable(oldskb)->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST))
++ return;
++
+ /* Check checksum */
+ if (nf_ip_checksum(oldskb, hook, ip_hdrlen(oldskb), IPPROTO_TCP))
+ return;
+@@ -101,19 +103,11 @@ static void send_reset(struct sk_buff *oldskb, int hook)
+ nskb->csum_start = (unsigned char *)tcph - nskb->head;
+ nskb->csum_offset = offsetof(struct tcphdr, check);
+
+- addr_type = RTN_UNSPEC;
+- if (hook != NF_INET_FORWARD
+-#ifdef CONFIG_BRIDGE_NETFILTER
+- || (nskb->nf_bridge && nskb->nf_bridge->mask & BRNF_BRIDGED)
+-#endif
+- )
+- addr_type = RTN_LOCAL;
+-
+ /* ip_route_me_harder expects skb->dst to be set */
+ skb_dst_set_noref(nskb, skb_dst(oldskb));
+
+ nskb->protocol = htons(ETH_P_IP);
+- if (ip_route_me_harder(nskb, addr_type))
++ if (ip_route_me_harder(nskb, RTN_UNSPEC))
+ goto free_nskb;
+
+ niph->ttl = ip4_dst_hoplimit(skb_dst(nskb));
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 99e6e4b..b8b5c3f 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -1914,9 +1914,7 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
+
+ hash = rt_hash(daddr, saddr, dev->ifindex, rt_genid(dev_net(dev)));
+ rth = rt_intern_hash(hash, rth, skb, dev->ifindex);
+- err = 0;
+- if (IS_ERR(rth))
+- err = PTR_ERR(rth);
++ return IS_ERR(rth) ? PTR_ERR(rth) : 0;
+
+ e_nobufs:
+ return -ENOBUFS;
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index f87a8eb..0e33e34 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -1241,6 +1241,9 @@ csum_copy_err:
+
+ if (noblock)
+ return -EAGAIN;
++
++ /* starting over for a new packet */
++ msg->msg_flags &= ~MSG_TRUNC;
+ goto try_again;
+ }
+
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index 9e305d74..b31a2f3 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -453,8 +453,11 @@ csum_copy_err:
+ }
+ unlock_sock_fast(sk, slow);
+
+- if (flags & MSG_DONTWAIT)
++ if (noblock)
+ return -EAGAIN;
++
++ /* starting over for a new packet */
++ msg->msg_flags &= ~MSG_TRUNC;
+ goto try_again;
+ }
+
+diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
+index 72d1ac6..8041bef 100644
+--- a/net/netfilter/ipset/ip_set_core.c
++++ b/net/netfilter/ipset/ip_set_core.c
+@@ -815,7 +815,7 @@ ip_set_flush(struct sock *ctnl, struct sk_buff *skb,
+ ip_set_id_t i;
+
+ if (unlikely(protocol_failed(attr)))
+- return -EPROTO;
++ return -IPSET_ERR_PROTOCOL;
+
+ if (!attr[IPSET_ATTR_SETNAME]) {
+ for (i = 0; i < ip_set_max; i++)
+diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
+index bf28ac2..782db27 100644
+--- a/net/netfilter/ipvs/ip_vs_conn.c
++++ b/net/netfilter/ipvs/ip_vs_conn.c
+@@ -776,8 +776,16 @@ static void ip_vs_conn_expire(unsigned long data)
+ if (cp->control)
+ ip_vs_control_del(cp);
+
+- if (cp->flags & IP_VS_CONN_F_NFCT)
++ if (cp->flags & IP_VS_CONN_F_NFCT) {
+ ip_vs_conn_drop_conntrack(cp);
++ /* Do not access conntracks during subsys cleanup
++ * because nf_conntrack_find_get can not be used after
++ * conntrack cleanup for the net.
++ */
++ smp_rmb();
++ if (ipvs->enable)
++ ip_vs_conn_drop_conntrack(cp);
++ }
+
+ ip_vs_pe_put(cp->pe);
+ kfree(cp->pe_data);
+diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
+index a74dae6..7729eae 100644
+--- a/net/netfilter/ipvs/ip_vs_core.c
++++ b/net/netfilter/ipvs/ip_vs_core.c
+@@ -1965,6 +1965,7 @@ static void __net_exit __ip_vs_dev_cleanup(struct net *net)
+ {
+ EnterFunction(2);
+ net_ipvs(net)->enable = 0; /* Disable packet reception */
++ smp_wmb();
+ __ip_vs_sync_cleanup(net);
+ LeaveFunction(2);
+ }
+diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c
+index 6b5dd6d..af63553 100644
+--- a/net/netfilter/ipvs/ip_vs_ftp.c
++++ b/net/netfilter/ipvs/ip_vs_ftp.c
+@@ -411,25 +411,35 @@ static struct ip_vs_app ip_vs_ftp = {
+ static int __net_init __ip_vs_ftp_init(struct net *net)
+ {
+ int i, ret;
+- struct ip_vs_app *app = &ip_vs_ftp;
++ struct ip_vs_app *app;
++ struct netns_ipvs *ipvs = net_ipvs(net);
++
++ app = kmemdup(&ip_vs_ftp, sizeof(struct ip_vs_app), GFP_KERNEL);
++ if (!app)
++ return -ENOMEM;
++ INIT_LIST_HEAD(&app->a_list);
++ INIT_LIST_HEAD(&app->incs_list);
++ ipvs->ftp_app = app;
+
+ ret = register_ip_vs_app(net, app);
+ if (ret)
+- return ret;
++ goto err_exit;
+
+ for (i=0; i<IP_VS_APP_MAX_PORTS; i++) {
+ if (!ports[i])
+ continue;
+ ret = register_ip_vs_app_inc(net, app, app->protocol, ports[i]);
+ if (ret)
+- break;
++ goto err_unreg;
+ pr_info("%s: loaded support on port[%d] = %d\n",
+ app->name, i, ports[i]);
+ }
++ return 0;
+
+- if (ret)
+- unregister_ip_vs_app(net, app);
+-
++err_unreg:
++ unregister_ip_vs_app(net, app);
++err_exit:
++ kfree(ipvs->ftp_app);
+ return ret;
+ }
+ /*
+@@ -437,9 +447,10 @@ static int __net_init __ip_vs_ftp_init(struct net *net)
+ */
+ static void __ip_vs_ftp_exit(struct net *net)
+ {
+- struct ip_vs_app *app = &ip_vs_ftp;
++ struct netns_ipvs *ipvs = net_ipvs(net);
+
+- unregister_ip_vs_app(net, app);
++ unregister_ip_vs_app(net, ipvs->ftp_app);
++ kfree(ipvs->ftp_app);
+ }
+
+ static struct pernet_operations ip_vs_ftp_ops = {
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index b5362e9..04098c2 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -799,6 +799,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
+ h.h2->tp_sec = ts.tv_sec;
+ h.h2->tp_nsec = ts.tv_nsec;
+ h.h2->tp_vlan_tci = vlan_tx_tag_get(skb);
++ h.h2->tp_padding = 0;
+ hdrlen = sizeof(*h.h2);
+ break;
+ default:
+@@ -1727,6 +1728,7 @@ static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
+ aux.tp_net = skb_network_offset(skb);
+ aux.tp_vlan_tci = vlan_tx_tag_get(skb);
+
++ aux.tp_padding = 0;
+ put_cmsg(msg, SOL_PACKET, PACKET_AUXDATA, sizeof(aux), &aux);
+ }
+
+diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
+index 339ba64..5daf6cc 100644
+--- a/net/sunrpc/auth_gss/auth_gss.c
++++ b/net/sunrpc/auth_gss/auth_gss.c
+@@ -577,13 +577,13 @@ retry:
+ }
+ inode = &gss_msg->inode->vfs_inode;
+ for (;;) {
+- prepare_to_wait(&gss_msg->waitqueue, &wait, TASK_INTERRUPTIBLE);
++ prepare_to_wait(&gss_msg->waitqueue, &wait, TASK_KILLABLE);
+ spin_lock(&inode->i_lock);
+ if (gss_msg->ctx != NULL || gss_msg->msg.errno < 0) {
+ break;
+ }
+ spin_unlock(&inode->i_lock);
+- if (signalled()) {
++ if (fatal_signal_pending(current)) {
+ err = -ERESTARTSYS;
+ goto out_intr;
+ }
+diff --git a/net/sunrpc/auth_gss/gss_krb5_mech.c b/net/sunrpc/auth_gss/gss_krb5_mech.c
+index 0a9a2ec..c3b7533 100644
+--- a/net/sunrpc/auth_gss/gss_krb5_mech.c
++++ b/net/sunrpc/auth_gss/gss_krb5_mech.c
+@@ -43,6 +43,7 @@
+ #include <linux/sunrpc/gss_krb5.h>
+ #include <linux/sunrpc/xdr.h>
+ #include <linux/crypto.h>
++#include <linux/sunrpc/gss_krb5_enctypes.h>
+
+ #ifdef RPC_DEBUG
+ # define RPCDBG_FACILITY RPCDBG_AUTH
+@@ -750,7 +751,7 @@ static struct gss_api_mech gss_kerberos_mech = {
+ .gm_ops = &gss_kerberos_ops,
+ .gm_pf_num = ARRAY_SIZE(gss_kerberos_pfs),
+ .gm_pfs = gss_kerberos_pfs,
+- .gm_upcall_enctypes = "18,17,16,23,3,1,2",
++ .gm_upcall_enctypes = KRB5_SUPPORTED_ENCTYPES,
+ };
+
+ static int __init init_kerberos_module(void)
+diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
+index 8d83f9d..00df09b 100644
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -1058,7 +1058,7 @@ call_allocate(struct rpc_task *task)
+
+ dprintk("RPC: %5u rpc_buffer allocation failed\n", task->tk_pid);
+
+- if (RPC_IS_ASYNC(task) || !signalled()) {
++ if (RPC_IS_ASYNC(task) || !fatal_signal_pending(current)) {
+ task->tk_action = call_allocate;
+ rpc_delay(task, HZ>>4);
+ return;
+@@ -1172,6 +1172,9 @@ call_bind_status(struct rpc_task *task)
+ status = -EOPNOTSUPP;
+ break;
+ }
++ if (task->tk_rebind_retry == 0)
++ break;
++ task->tk_rebind_retry--;
+ rpc_delay(task, 3*HZ);
+ goto retry_timeout;
+ case -ETIMEDOUT:
+diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
+index 6b43ee7..a27406b 100644
+--- a/net/sunrpc/sched.c
++++ b/net/sunrpc/sched.c
+@@ -792,6 +792,7 @@ static void rpc_init_task(struct rpc_task *task, const struct rpc_task_setup *ta
+ /* Initialize retry counters */
+ task->tk_garb_retry = 2;
+ task->tk_cred_retry = 2;
++ task->tk_rebind_retry = 2;
+
+ task->tk_priority = task_setup_data->priority - RPC_PRIORITY_LOW;
+ task->tk_owner = current->tgid;
+diff --git a/net/xfrm/xfrm_replay.c b/net/xfrm/xfrm_replay.c
+index 47f1b86..b11ea69 100644
+--- a/net/xfrm/xfrm_replay.c
++++ b/net/xfrm/xfrm_replay.c
+@@ -265,7 +265,7 @@ static void xfrm_replay_advance_bmp(struct xfrm_state *x, __be32 net_seq)
+ bitnr = bitnr & 0x1F;
+ replay_esn->bmp[nr] |= (1U << bitnr);
+ } else {
+- nr = replay_esn->replay_window >> 5;
++ nr = (replay_esn->replay_window - 1) >> 5;
+ for (i = 0; i <= nr; i++)
+ replay_esn->bmp[i] = 0;
+
+@@ -471,7 +471,7 @@ static void xfrm_replay_advance_esn(struct xfrm_state *x, __be32 net_seq)
+ bitnr = bitnr & 0x1F;
+ replay_esn->bmp[nr] |= (1U << bitnr);
+ } else {
+- nr = replay_esn->replay_window >> 5;
++ nr = (replay_esn->replay_window - 1) >> 5;
+ for (i = 0; i <= nr; i++)
+ replay_esn->bmp[i] = 0;
+
+diff --git a/security/keys/request_key.c b/security/keys/request_key.c
+index df3c041..6197a26 100644
+--- a/security/keys/request_key.c
++++ b/security/keys/request_key.c
+@@ -470,7 +470,7 @@ static struct key *construct_key_and_link(struct key_type *type,
+ } else if (ret == -EINPROGRESS) {
+ ret = 0;
+ } else {
+- key = ERR_PTR(ret);
++ goto couldnt_alloc_key;
+ }
+
+ key_put(dest_keyring);
+@@ -480,6 +480,7 @@ static struct key *construct_key_and_link(struct key_type *type,
+ construction_failed:
+ key_negate_and_link(key, key_negative_timeout, NULL, NULL);
+ key_put(key);
++couldnt_alloc_key:
+ key_put(dest_keyring);
+ kleave(" = %d", ret);
+ return ERR_PTR(ret);
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 15b9d16..e47f22c 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -3846,6 +3846,8 @@ static struct hda_codec_preset snd_hda_preset_conexant[] = {
+ .patch = patch_cxt5066 },
+ { .id = 0x14f15069, .name = "CX20585",
+ .patch = patch_cxt5066 },
++ { .id = 0x14f1506c, .name = "CX20588",
++ .patch = patch_cxt5066 },
+ { .id = 0x14f1506e, .name = "CX20590",
+ .patch = patch_cxt5066 },
+ { .id = 0x14f15097, .name = "CX20631",
+@@ -3874,6 +3876,7 @@ MODULE_ALIAS("snd-hda-codec-id:14f15066");
+ MODULE_ALIAS("snd-hda-codec-id:14f15067");
+ MODULE_ALIAS("snd-hda-codec-id:14f15068");
+ MODULE_ALIAS("snd-hda-codec-id:14f15069");
++MODULE_ALIAS("snd-hda-codec-id:14f1506c");
+ MODULE_ALIAS("snd-hda-codec-id:14f1506e");
+ MODULE_ALIAS("snd-hda-codec-id:14f15097");
+ MODULE_ALIAS("snd-hda-codec-id:14f15098");
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 2e95f01..4145c3c 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4607,7 +4607,6 @@ static struct snd_pci_quirk alc880_cfg_tbl[] = {
+ SND_PCI_QUIRK(0x1025, 0xe309, "ULI", ALC880_3ST_DIG),
+ SND_PCI_QUIRK(0x1025, 0xe310, "ULI", ALC880_3ST),
+ SND_PCI_QUIRK(0x1039, 0x1234, NULL, ALC880_6ST_DIG),
+- SND_PCI_QUIRK(0x103c, 0x2a09, "HP", ALC880_5ST),
+ SND_PCI_QUIRK(0x1043, 0x10b3, "ASUS W1V", ALC880_ASUS_W1V),
+ SND_PCI_QUIRK(0x1043, 0x10c2, "ASUS W6A", ALC880_ASUS_DIG),
+ SND_PCI_QUIRK(0x1043, 0x10c3, "ASUS Wxx", ALC880_ASUS_DIG),
+diff --git a/sound/soc/pxa/pxa2xx-pcm.c b/sound/soc/pxa/pxa2xx-pcm.c
+index 2ce0b2d..fab20a5 100644
+--- a/sound/soc/pxa/pxa2xx-pcm.c
++++ b/sound/soc/pxa/pxa2xx-pcm.c
+@@ -95,14 +95,14 @@ static int pxa2xx_soc_pcm_new(struct snd_card *card, struct snd_soc_dai *dai,
+ if (!card->dev->coherent_dma_mask)
+ card->dev->coherent_dma_mask = DMA_BIT_MASK(32);
+
+- if (dai->driver->playback.channels_min) {
++ if (pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream) {
+ ret = pxa2xx_pcm_preallocate_dma_buffer(pcm,
+ SNDRV_PCM_STREAM_PLAYBACK);
+ if (ret)
+ goto out;
+ }
+
+- if (dai->driver->capture.channels_min) {
++ if (pcm->streams[SNDRV_PCM_STREAM_CAPTURE].substream) {
+ ret = pxa2xx_pcm_preallocate_dma_buffer(pcm,
+ SNDRV_PCM_STREAM_CAPTURE);
+ if (ret)
+diff --git a/virt/kvm/assigned-dev.c b/virt/kvm/assigned-dev.c
+index ae72ae6..e3f1235 100644
+--- a/virt/kvm/assigned-dev.c
++++ b/virt/kvm/assigned-dev.c
+@@ -197,8 +197,7 @@ static void kvm_free_assigned_device(struct kvm *kvm,
+ {
+ kvm_free_assigned_irq(kvm, assigned_dev);
+
+- __pci_reset_function(assigned_dev->dev);
+- pci_restore_state(assigned_dev->dev);
++ pci_reset_function(assigned_dev->dev);
+
+ pci_release_regions(assigned_dev->dev);
+ pci_disable_device(assigned_dev->dev);
+@@ -515,7 +514,6 @@ static int kvm_vm_ioctl_assign_device(struct kvm *kvm,
+ }
+
+ pci_reset_function(dev);
+- pci_save_state(dev);
+
+ match->assigned_dev_id = assigned_dev->assigned_dev_id;
+ match->host_segnr = assigned_dev->segnr;
+@@ -546,7 +544,6 @@ out:
+ mutex_unlock(&kvm->lock);
+ return r;
+ out_list_del:
+- pci_restore_state(dev);
+ list_del(&match->list);
+ pci_release_regions(dev);
+ out_disable:
Added: dists/sid/linux-2.6/debian/patches/series/4
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/sid/linux-2.6/debian/patches/series/4 Sun Jul 10 01:48:22 2011 (r17823)
@@ -0,0 +1,6 @@
+- bugfix/all/taskstats-don-t-allow-duplicate-entries-in-listener-.patch
+- bugfix/all/inet_diag-fix-inet_diag_bc_audit.patch
+- bugfix/all/ksm-fix-NULL-pointer-dereference-in-scan_get_next_rm.patch
+- bugfix/all/bridge-provide-a-cow_metrics-method-for-fake_ops.patch
+- bugfix/x86/Revert-drm-i915-Enable-GMBUS-for-post-gen2-chipsets.patch
++ bugfix/all/stable/2.6.39.3.patch
More information about the Kernel-svn-changes
mailing list