[kernel] r17285 - in dists/sid/linux-2.6/debian: . patches/bugfix/all/stable patches/bugfix/m68k patches/series
Ben Hutchings
benh at alioth.debian.org
Mon May 2 20:32:02 UTC 2011
Author: benh
Date: Mon May 2 20:31:54 2011
New Revision: 17285
Log:
Add stable 2.6.38.5
Added:
dists/sid/linux-2.6/debian/patches/bugfix/all/stable/2.6.38.5.patch
Deleted:
dists/sid/linux-2.6/debian/patches/bugfix/m68k/0009-m68k-mm-set-all-online-nodes-in-N_NORMAL_MEMORY.patch
Modified:
dists/sid/linux-2.6/debian/changelog
dists/sid/linux-2.6/debian/patches/series/5
Modified: dists/sid/linux-2.6/debian/changelog
==============================================================================
--- dists/sid/linux-2.6/debian/changelog Mon May 2 19:06:10 2011 (r17284)
+++ dists/sid/linux-2.6/debian/changelog Mon May 2 20:31:54 2011 (r17285)
@@ -21,6 +21,23 @@
* rt2800pci, rt2800usb: Enable experimental support for more recent
chips (Closes: #623808)
* [x86] staging: Enable EASYCAP as module (Closes: #624505)
+ * Add stable 2.6.38.5, including:
+ - p54: Initialize extra_len in p54_tx_80211
+ - nfsd4: Fix filp leak (regression introduced in 2.6.38.3)
+ - radeon: PLL tweaks for R7xx
+ - nouveau: Fix notifier memory corruption bug
+ - radeon: Fix bad shift in atom iio table parser
+ - [x86] i915: Sanitize the output registers after resume
+ - [x86] ideapad: Read brightness setting on brightness key notify
+ - ath9k_hw: Partially revert "fix dma descriptor rx error bit parsing"
+ - [s390] pfault: fix token handling
+ - ACPI/PM: Avoid infinite recurrence while registering power resources
+ - [hppa, m68k] slub: Disable use with DISCONTIGMEM && !NUMA
+ - vfs: avoid large kmalloc()s for the fdtable
+ - agp: Fix arbitrary kernel memory writes (CVE-2011-1745)
+ - agp: Fix OOM and buffer overflow (CVE-2011-1746)
+ For the complete list of changes, see:
+ http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.38.5
-- Ben Hutchings <ben at decadent.org.uk> Mon, 25 Apr 2011 02:15:23 +0100
Added: dists/sid/linux-2.6/debian/patches/bugfix/all/stable/2.6.38.5.patch
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/sid/linux-2.6/debian/patches/bugfix/all/stable/2.6.38.5.patch Mon May 2 20:31:54 2011 (r17285)
@@ -0,0 +1,1958 @@
+diff --git a/Makefile b/Makefile
+index e712243..20ed7d1 100644
+diff --git a/arch/m68k/mm/motorola.c b/arch/m68k/mm/motorola.c
+index 02b7a03..8b3db1c 100644
+--- a/arch/m68k/mm/motorola.c
++++ b/arch/m68k/mm/motorola.c
+@@ -300,6 +300,8 @@ void __init paging_init(void)
+ zones_size[ZONE_DMA] = m68k_memory[i].size >> PAGE_SHIFT;
+ free_area_init_node(i, zones_size,
+ m68k_memory[i].addr >> PAGE_SHIFT, NULL);
++ if (node_present_pages(i))
++ node_set_state(i, N_NORMAL_MEMORY);
+ }
+ }
+
+diff --git a/arch/parisc/mm/init.c b/arch/parisc/mm/init.c
+index f4f4d70..7fd8aad 100644
+--- a/arch/parisc/mm/init.c
++++ b/arch/parisc/mm/init.c
+@@ -266,8 +266,10 @@ static void __init setup_bootmem(void)
+ }
+ memset(pfnnid_map, 0xff, sizeof(pfnnid_map));
+
+- for (i = 0; i < npmem_ranges; i++)
++ for (i = 0; i < npmem_ranges; i++) {
++ node_set_state(i, N_NORMAL_MEMORY);
+ node_set_online(i);
++ }
+ #endif
+
+ /*
+diff --git a/arch/s390/kvm/sie64a.S b/arch/s390/kvm/sie64a.S
+index 7e9d30d..ab0e041 100644
+--- a/arch/s390/kvm/sie64a.S
++++ b/arch/s390/kvm/sie64a.S
+@@ -48,10 +48,10 @@ sie_irq_handler:
+ tm __TI_flags+7(%r2),_TIF_EXIT_SIE
+ jz 0f
+ larl %r2,sie_exit # work pending, leave sie
+- stg %r2,__LC_RETURN_PSW+8
++ stg %r2,SPI_PSW+8(0,%r15)
+ br %r14
+ 0: larl %r2,sie_reenter # re-enter with guest id
+- stg %r2,__LC_RETURN_PSW+8
++ stg %r2,SPI_PSW+8(0,%r15)
+ 1: br %r14
+
+ /*
+diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c
+index 2c57806..0f900c8 100644
+--- a/arch/s390/mm/fault.c
++++ b/arch/s390/mm/fault.c
+@@ -558,9 +558,9 @@ static void pfault_interrupt(unsigned int ext_int_code,
+ * Get the token (= address of the task structure of the affected task).
+ */
+ #ifdef CONFIG_64BIT
+- tsk = *(struct task_struct **) param64;
++ tsk = (struct task_struct *) param64;
+ #else
+- tsk = *(struct task_struct **) param32;
++ tsk = (struct task_struct *) param32;
+ #endif
+
+ if (subcode & 0x0080) {
+diff --git a/arch/um/sys-i386/Makefile b/arch/um/sys-i386/Makefile
+index 804b28d..b1da91c 100644
+--- a/arch/um/sys-i386/Makefile
++++ b/arch/um/sys-i386/Makefile
+@@ -4,7 +4,7 @@
+
+ obj-y = bug.o bugs.o checksum.o delay.o fault.o ksyms.o ldt.o ptrace.o \
+ ptrace_user.o setjmp.o signal.o stub.o stub_segv.o syscalls.o sysrq.o \
+- sys_call_table.o tls.o
++ sys_call_table.o tls.o atomic64_cx8_32.o
+
+ obj-$(CONFIG_BINFMT_ELF) += elfcore.o
+
+diff --git a/arch/um/sys-i386/atomic64_cx8_32.S b/arch/um/sys-i386/atomic64_cx8_32.S
+new file mode 100644
+index 0000000..1e901d3d
+--- /dev/null
++++ b/arch/um/sys-i386/atomic64_cx8_32.S
+@@ -0,0 +1,225 @@
++/*
++ * atomic64_t for 586+
++ *
++ * Copied from arch/x86/lib/atomic64_cx8_32.S
++ *
++ * Copyright © 2010 Luca Barbieri
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation; either version 2 of the License, or
++ * (at your option) any later version.
++ *
++ */
++
++#include <linux/linkage.h>
++#include <asm/alternative-asm.h>
++#include <asm/dwarf2.h>
++
++.macro SAVE reg
++ pushl_cfi %\reg
++ CFI_REL_OFFSET \reg, 0
++.endm
++
++.macro RESTORE reg
++ popl_cfi %\reg
++ CFI_RESTORE \reg
++.endm
++
++.macro read64 reg
++ movl %ebx, %eax
++ movl %ecx, %edx
++/* we need LOCK_PREFIX since otherwise cmpxchg8b always does the write */
++ LOCK_PREFIX
++ cmpxchg8b (\reg)
++.endm
++
++ENTRY(atomic64_read_cx8)
++ CFI_STARTPROC
++
++ read64 %ecx
++ ret
++ CFI_ENDPROC
++ENDPROC(atomic64_read_cx8)
++
++ENTRY(atomic64_set_cx8)
++ CFI_STARTPROC
++
++1:
++/* we don't need LOCK_PREFIX since aligned 64-bit writes
++ * are atomic on 586 and newer */
++ cmpxchg8b (%esi)
++ jne 1b
++
++ ret
++ CFI_ENDPROC
++ENDPROC(atomic64_set_cx8)
++
++ENTRY(atomic64_xchg_cx8)
++ CFI_STARTPROC
++
++ movl %ebx, %eax
++ movl %ecx, %edx
++1:
++ LOCK_PREFIX
++ cmpxchg8b (%esi)
++ jne 1b
++
++ ret
++ CFI_ENDPROC
++ENDPROC(atomic64_xchg_cx8)
++
++.macro addsub_return func ins insc
++ENTRY(atomic64_\func\()_return_cx8)
++ CFI_STARTPROC
++ SAVE ebp
++ SAVE ebx
++ SAVE esi
++ SAVE edi
++
++ movl %eax, %esi
++ movl %edx, %edi
++ movl %ecx, %ebp
++
++ read64 %ebp
++1:
++ movl %eax, %ebx
++ movl %edx, %ecx
++ \ins\()l %esi, %ebx
++ \insc\()l %edi, %ecx
++ LOCK_PREFIX
++ cmpxchg8b (%ebp)
++ jne 1b
++
++10:
++ movl %ebx, %eax
++ movl %ecx, %edx
++ RESTORE edi
++ RESTORE esi
++ RESTORE ebx
++ RESTORE ebp
++ ret
++ CFI_ENDPROC
++ENDPROC(atomic64_\func\()_return_cx8)
++.endm
++
++addsub_return add add adc
++addsub_return sub sub sbb
++
++.macro incdec_return func ins insc
++ENTRY(atomic64_\func\()_return_cx8)
++ CFI_STARTPROC
++ SAVE ebx
++
++ read64 %esi
++1:
++ movl %eax, %ebx
++ movl %edx, %ecx
++ \ins\()l $1, %ebx
++ \insc\()l $0, %ecx
++ LOCK_PREFIX
++ cmpxchg8b (%esi)
++ jne 1b
++
++10:
++ movl %ebx, %eax
++ movl %ecx, %edx
++ RESTORE ebx
++ ret
++ CFI_ENDPROC
++ENDPROC(atomic64_\func\()_return_cx8)
++.endm
++
++incdec_return inc add adc
++incdec_return dec sub sbb
++
++ENTRY(atomic64_dec_if_positive_cx8)
++ CFI_STARTPROC
++ SAVE ebx
++
++ read64 %esi
++1:
++ movl %eax, %ebx
++ movl %edx, %ecx
++ subl $1, %ebx
++ sbb $0, %ecx
++ js 2f
++ LOCK_PREFIX
++ cmpxchg8b (%esi)
++ jne 1b
++
++2:
++ movl %ebx, %eax
++ movl %ecx, %edx
++ RESTORE ebx
++ ret
++ CFI_ENDPROC
++ENDPROC(atomic64_dec_if_positive_cx8)
++
++ENTRY(atomic64_add_unless_cx8)
++ CFI_STARTPROC
++ SAVE ebp
++ SAVE ebx
++/* these just push these two parameters on the stack */
++ SAVE edi
++ SAVE esi
++
++ movl %ecx, %ebp
++ movl %eax, %esi
++ movl %edx, %edi
++
++ read64 %ebp
++1:
++ cmpl %eax, 0(%esp)
++ je 4f
++2:
++ movl %eax, %ebx
++ movl %edx, %ecx
++ addl %esi, %ebx
++ adcl %edi, %ecx
++ LOCK_PREFIX
++ cmpxchg8b (%ebp)
++ jne 1b
++
++ movl $1, %eax
++3:
++ addl $8, %esp
++ CFI_ADJUST_CFA_OFFSET -8
++ RESTORE ebx
++ RESTORE ebp
++ ret
++4:
++ cmpl %edx, 4(%esp)
++ jne 2b
++ xorl %eax, %eax
++ jmp 3b
++ CFI_ENDPROC
++ENDPROC(atomic64_add_unless_cx8)
++
++ENTRY(atomic64_inc_not_zero_cx8)
++ CFI_STARTPROC
++ SAVE ebx
++
++ read64 %esi
++1:
++ testl %eax, %eax
++ je 4f
++2:
++ movl %eax, %ebx
++ movl %edx, %ecx
++ addl $1, %ebx
++ adcl $0, %ecx
++ LOCK_PREFIX
++ cmpxchg8b (%esi)
++ jne 1b
++
++ movl $1, %eax
++3:
++ RESTORE ebx
++ ret
++4:
++ testl %edx, %edx
++ jne 2b
++ jmp 3b
++ CFI_ENDPROC
++ENDPROC(atomic64_inc_not_zero_cx8)
+diff --git a/arch/x86/include/asm/gart.h b/arch/x86/include/asm/gart.h
+index 43085bf..3e7349f 100644
+--- a/arch/x86/include/asm/gart.h
++++ b/arch/x86/include/asm/gart.h
+@@ -66,7 +66,7 @@ static inline void gart_set_size_and_enable(struct pci_dev *dev, u32 order)
+ * Don't enable translation but enable GART IO and CPU accesses.
+ * Also, set DISTLBWALKPRB since GART tables memory is UC.
+ */
+- ctl = DISTLBWALKPRB | order << 1;
++ ctl = order << 1;
+
+ pci_write_config_dword(dev, AMD64_GARTAPERTURECTL, ctl);
+ }
+@@ -83,7 +83,7 @@ static inline void enable_gart_translation(struct pci_dev *dev, u64 addr)
+
+ /* Enable GART translation for this hammer. */
+ pci_read_config_dword(dev, AMD64_GARTAPERTURECTL, &ctl);
+- ctl |= GARTEN;
++ ctl |= GARTEN | DISTLBWALKPRB;
+ ctl &= ~(DISGARTCPU | DISGARTIO);
+ pci_write_config_dword(dev, AMD64_GARTAPERTURECTL, ctl);
+ }
+diff --git a/arch/x86/kernel/aperture_64.c b/arch/x86/kernel/aperture_64.c
+index 5955a78..f6a1c23 100644
+--- a/arch/x86/kernel/aperture_64.c
++++ b/arch/x86/kernel/aperture_64.c
+@@ -500,7 +500,7 @@ out:
+ * Don't enable translation yet but enable GART IO and CPU
+ * accesses and set DISTLBWALKPRB since GART table memory is UC.
+ */
+- u32 ctl = DISTLBWALKPRB | aper_order << 1;
++ u32 ctl = aper_order << 1;
+
+ bus = amd_nb_bus_dev_ranges[i].bus;
+ dev_base = amd_nb_bus_dev_ranges[i].dev_base;
+diff --git a/arch/x86/kernel/pci-gart_64.c b/arch/x86/kernel/pci-gart_64.c
+index c01ffa5..197a46f 100644
+--- a/arch/x86/kernel/pci-gart_64.c
++++ b/arch/x86/kernel/pci-gart_64.c
+@@ -81,6 +81,9 @@ static u32 gart_unmapped_entry;
+ #define AGPEXTERN
+ #endif
+
++/* GART can only remap to physical addresses < 1TB */
++#define GART_MAX_PHYS_ADDR (1ULL << 40)
++
+ /* backdoor interface to AGP driver */
+ AGPEXTERN int agp_memory_reserved;
+ AGPEXTERN __u32 *agp_gatt_table;
+@@ -212,9 +215,13 @@ static dma_addr_t dma_map_area(struct device *dev, dma_addr_t phys_mem,
+ size_t size, int dir, unsigned long align_mask)
+ {
+ unsigned long npages = iommu_num_pages(phys_mem, size, PAGE_SIZE);
+- unsigned long iommu_page = alloc_iommu(dev, npages, align_mask);
++ unsigned long iommu_page;
+ int i;
+
++ if (unlikely(phys_mem + size > GART_MAX_PHYS_ADDR))
++ return bad_dma_addr;
++
++ iommu_page = alloc_iommu(dev, npages, align_mask);
+ if (iommu_page == -1) {
+ if (!nonforced_iommu(dev, phys_mem, size))
+ return phys_mem;
+diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
+index 41fb691..3655e19 100644
+--- a/block/blk-sysfs.c
++++ b/block/blk-sysfs.c
+@@ -511,8 +511,10 @@ int blk_register_queue(struct gendisk *disk)
+ return ret;
+
+ ret = kobject_add(&q->kobj, kobject_get(&dev->kobj), "%s", "queue");
+- if (ret < 0)
++ if (ret < 0) {
++ blk_trace_remove_sysfs(dev);
+ return ret;
++ }
+
+ kobject_uevent(&q->kobj, KOBJ_ADD);
+
+diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
+index ac1a599..fcc13ac 100644
+--- a/drivers/acpi/battery.c
++++ b/drivers/acpi/battery.c
+@@ -33,6 +33,7 @@
+ #include <linux/async.h>
+ #include <linux/dmi.h>
+ #include <linux/slab.h>
++#include <linux/suspend.h>
+
+ #ifdef CONFIG_ACPI_PROCFS_POWER
+ #include <linux/proc_fs.h>
+@@ -102,6 +103,7 @@ struct acpi_battery {
+ struct mutex lock;
+ struct power_supply bat;
+ struct acpi_device *device;
++ struct notifier_block pm_nb;
+ unsigned long update_time;
+ int rate_now;
+ int capacity_now;
+@@ -940,6 +942,21 @@ static void acpi_battery_notify(struct acpi_device *device, u32 event)
+ power_supply_changed(&battery->bat);
+ }
+
++static int battery_notify(struct notifier_block *nb,
++ unsigned long mode, void *_unused)
++{
++ struct acpi_battery *battery = container_of(nb, struct acpi_battery,
++ pm_nb);
++ switch (mode) {
++ case PM_POST_SUSPEND:
++ sysfs_remove_battery(battery);
++ sysfs_add_battery(battery);
++ break;
++ }
++
++ return 0;
++}
++
+ static int acpi_battery_add(struct acpi_device *device)
+ {
+ int result = 0;
+@@ -972,6 +989,10 @@ static int acpi_battery_add(struct acpi_device *device)
+ #endif
+ kfree(battery);
+ }
++
++ battery->pm_nb.notifier_call = battery_notify;
++ register_pm_notifier(&battery->pm_nb);
++
+ return result;
+ }
+
+@@ -982,6 +1003,7 @@ static int acpi_battery_remove(struct acpi_device *device, int type)
+ if (!device || !acpi_driver_data(device))
+ return -EINVAL;
+ battery = acpi_driver_data(device);
++ unregister_pm_notifier(&battery->pm_nb);
+ #ifdef CONFIG_ACPI_PROCFS_POWER
+ acpi_battery_remove_fs(device);
+ #endif
+diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
+index b99e624..8eee69f 100644
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -944,6 +944,10 @@ static int acpi_bus_get_flags(struct acpi_device *device)
+ if (ACPI_SUCCESS(status))
+ device->flags.lockable = 1;
+
++ /* Power resources cannot be power manageable. */
++ if (device->device_type == ACPI_BUS_TYPE_POWER)
++ return 0;
++
+ /* Presence of _PS0|_PR0 indicates 'power manageable' */
+ status = acpi_get_handle(device->handle, "_PS0", &temp);
+ if (ACPI_FAILURE(status))
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index 34e08f6..54c096b 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -150,7 +150,7 @@ static const struct ata_port_info ahci_port_info[] = {
+ {
+ AHCI_HFLAGS (AHCI_HFLAG_NO_FPDMA_AA | AHCI_HFLAG_NO_PMP |
+ AHCI_HFLAG_YES_NCQ),
+- .flags = AHCI_FLAG_COMMON,
++ .flags = AHCI_FLAG_COMMON | ATA_FLAG_NO_DIPM,
+ .pio_mask = ATA_PIO4,
+ .udma_mask = ATA_UDMA6,
+ .port_ops = &ahci_ops,
+diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
+index 26d4523..8498eb5 100644
+--- a/drivers/ata/libahci.c
++++ b/drivers/ata/libahci.c
+@@ -1897,7 +1897,17 @@ static void ahci_pmp_attach(struct ata_port *ap)
+ ahci_enable_fbs(ap);
+
+ pp->intr_mask |= PORT_IRQ_BAD_PMP;
+- writel(pp->intr_mask, port_mmio + PORT_IRQ_MASK);
++
++ /*
++ * We must not change the port interrupt mask register if the
++ * port is marked frozen, the value in pp->intr_mask will be
++ * restored later when the port is thawed.
++ *
++ * Note that during initialization, the port is marked as
++ * frozen since the irq handler is not yet registered.
++ */
++ if (!(ap->pflags & ATA_PFLAG_FROZEN))
++ writel(pp->intr_mask, port_mmio + PORT_IRQ_MASK);
+ }
+
+ static void ahci_pmp_detach(struct ata_port *ap)
+@@ -1913,7 +1923,10 @@ static void ahci_pmp_detach(struct ata_port *ap)
+ writel(cmd, port_mmio + PORT_CMD);
+
+ pp->intr_mask &= ~PORT_IRQ_BAD_PMP;
+- writel(pp->intr_mask, port_mmio + PORT_IRQ_MASK);
++
++ /* see comment above in ahci_pmp_attach() */
++ if (!(ap->pflags & ATA_PFLAG_FROZEN))
++ writel(pp->intr_mask, port_mmio + PORT_IRQ_MASK);
+ }
+
+ int ahci_port_resume(struct ata_port *ap)
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index d4e52e2..4ccce0f 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -5479,8 +5479,8 @@ struct ata_port *ata_port_alloc(struct ata_host *host)
+ ap = kzalloc(sizeof(*ap), GFP_KERNEL);
+ if (!ap)
+ return NULL;
+-
+- ap->pflags |= ATA_PFLAG_INITIALIZING;
++
++ ap->pflags |= ATA_PFLAG_INITIALIZING | ATA_PFLAG_FROZEN;
+ ap->lock = &host->lock;
+ ap->print_id = -1;
+ ap->host = host;
+diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
+index e16850e..fe18c2d 100644
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -3276,6 +3276,7 @@ static int ata_eh_set_lpm(struct ata_link *link, enum ata_lpm_policy policy,
+ struct ata_eh_context *ehc = &link->eh_context;
+ struct ata_device *dev, *link_dev = NULL, *lpm_dev = NULL;
+ enum ata_lpm_policy old_policy = link->lpm_policy;
++ bool no_dipm = ap->flags & ATA_FLAG_NO_DIPM;
+ unsigned int hints = ATA_LPM_EMPTY | ATA_LPM_HIPM;
+ unsigned int err_mask;
+ int rc;
+@@ -3292,7 +3293,7 @@ static int ata_eh_set_lpm(struct ata_link *link, enum ata_lpm_policy policy,
+ */
+ ata_for_each_dev(dev, link, ENABLED) {
+ bool hipm = ata_id_has_hipm(dev->id);
+- bool dipm = ata_id_has_dipm(dev->id);
++ bool dipm = ata_id_has_dipm(dev->id) && !no_dipm;
+
+ /* find the first enabled and LPM enabled devices */
+ if (!link_dev)
+@@ -3349,7 +3350,8 @@ static int ata_eh_set_lpm(struct ata_link *link, enum ata_lpm_policy policy,
+
+ /* host config updated, enable DIPM if transitioning to MIN_POWER */
+ ata_for_each_dev(dev, link, ENABLED) {
+- if (policy == ATA_LPM_MIN_POWER && ata_id_has_dipm(dev->id)) {
++ if (policy == ATA_LPM_MIN_POWER && !no_dipm &&
++ ata_id_has_dipm(dev->id)) {
+ err_mask = ata_dev_set_feature(dev,
+ SETFEATURES_SATA_ENABLE, SATA_DIPM);
+ if (err_mask && err_mask != AC_ERR_DEV) {
+diff --git a/drivers/char/agp/generic.c b/drivers/char/agp/generic.c
+index 012cba0..b072648 100644
+--- a/drivers/char/agp/generic.c
++++ b/drivers/char/agp/generic.c
+@@ -115,6 +115,9 @@ static struct agp_memory *agp_create_user_memory(unsigned long num_agp_pages)
+ struct agp_memory *new;
+ unsigned long alloc_size = num_agp_pages*sizeof(struct page *);
+
++ if (INT_MAX/sizeof(struct page *) < num_agp_pages)
++ return NULL;
++
+ new = kzalloc(sizeof(struct agp_memory), GFP_KERNEL);
+ if (new == NULL)
+ return NULL;
+@@ -234,11 +237,14 @@ struct agp_memory *agp_allocate_memory(struct agp_bridge_data *bridge,
+ int scratch_pages;
+ struct agp_memory *new;
+ size_t i;
++ int cur_memory;
+
+ if (!bridge)
+ return NULL;
+
+- if ((atomic_read(&bridge->current_memory_agp) + page_count) > bridge->max_memory_agp)
++ cur_memory = atomic_read(&bridge->current_memory_agp);
++ if ((cur_memory + page_count > bridge->max_memory_agp) ||
++ (cur_memory + page_count < page_count))
+ return NULL;
+
+ if (type >= AGP_USER_TYPES) {
+@@ -1089,8 +1095,8 @@ int agp_generic_insert_memory(struct agp_memory * mem, off_t pg_start, int type)
+ return -EINVAL;
+ }
+
+- /* AK: could wrap */
+- if ((pg_start + mem->page_count) > num_entries)
++ if (((pg_start + mem->page_count) > num_entries) ||
++ ((pg_start + mem->page_count) < pg_start))
+ return -EINVAL;
+
+ j = pg_start;
+@@ -1124,7 +1130,7 @@ int agp_generic_remove_memory(struct agp_memory *mem, off_t pg_start, int type)
+ {
+ size_t i;
+ struct agp_bridge_data *bridge;
+- int mask_type;
++ int mask_type, num_entries;
+
+ bridge = mem->bridge;
+ if (!bridge)
+@@ -1136,6 +1142,11 @@ int agp_generic_remove_memory(struct agp_memory *mem, off_t pg_start, int type)
+ if (type != mem->type)
+ return -EINVAL;
+
++ num_entries = agp_num_entries();
++ if (((pg_start + mem->page_count) > num_entries) ||
++ ((pg_start + mem->page_count) < pg_start))
++ return -EINVAL;
++
+ mask_type = bridge->driver->agp_type_to_mask_type(bridge, type);
+ if (mask_type != 0) {
+ /* The generic routines know nothing of memory types */
+diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
+index 84b164d..838568a 100644
+--- a/drivers/char/virtio_console.c
++++ b/drivers/char/virtio_console.c
+@@ -1280,18 +1280,7 @@ static void unplug_port(struct port *port)
+ spin_lock_irq(&pdrvdata_lock);
+ list_del(&port->cons.list);
+ spin_unlock_irq(&pdrvdata_lock);
+-#if 0
+- /*
+- * hvc_remove() not called as removing one hvc port
+- * results in other hvc ports getting frozen.
+- *
+- * Once this is resolved in hvc, this functionality
+- * will be enabled. Till that is done, the -EPIPE
+- * return from get_chars() above will help
+- * hvc_console.c to clean up on ports we remove here.
+- */
+ hvc_remove(port->cons.hvc);
+-#endif
+ }
+
+ /* Remove unused data this port might have received. */
+diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig
+index 0902d44..4b4b545 100644
+--- a/drivers/gpu/drm/Kconfig
++++ b/drivers/gpu/drm/Kconfig
+@@ -24,6 +24,7 @@ config DRM_KMS_HELPER
+ depends on DRM
+ select FB
+ select FRAMEBUFFER_CONSOLE if !EXPERT
++ select FRAMEBUFFER_CONSOLE_DETECT_PRIMARY if FRAMEBUFFER_CONSOLE
+ help
+ FB and CRTC helpers for KMS drivers.
+
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index 49fb54f..ecf8f94 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -5630,36 +5630,6 @@ cleanup_work:
+ return ret;
+ }
+
+-static void intel_crtc_reset(struct drm_crtc *crtc)
+-{
+- struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
+-
+- /* Reset flags back to the 'unknown' status so that they
+- * will be correctly set on the initial modeset.
+- */
+- intel_crtc->dpms_mode = -1;
+-}
+-
+-static struct drm_crtc_helper_funcs intel_helper_funcs = {
+- .dpms = intel_crtc_dpms,
+- .mode_fixup = intel_crtc_mode_fixup,
+- .mode_set = intel_crtc_mode_set,
+- .mode_set_base = intel_pipe_set_base,
+- .mode_set_base_atomic = intel_pipe_set_base_atomic,
+- .load_lut = intel_crtc_load_lut,
+- .disable = intel_crtc_disable,
+-};
+-
+-static const struct drm_crtc_funcs intel_crtc_funcs = {
+- .reset = intel_crtc_reset,
+- .cursor_set = intel_crtc_cursor_set,
+- .cursor_move = intel_crtc_cursor_move,
+- .gamma_set = intel_crtc_gamma_set,
+- .set_config = drm_crtc_helper_set_config,
+- .destroy = intel_crtc_destroy,
+- .page_flip = intel_crtc_page_flip,
+-};
+-
+ static void intel_sanitize_modesetting(struct drm_device *dev,
+ int pipe, int plane)
+ {
+@@ -5710,6 +5680,42 @@ static void intel_sanitize_modesetting(struct drm_device *dev,
+ }
+ }
+
++static void intel_crtc_reset(struct drm_crtc *crtc)
++{
++ struct drm_device *dev = crtc->dev;
++ struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
++
++ /* Reset flags back to the 'unknown' status so that they
++ * will be correctly set on the initial modeset.
++ */
++ intel_crtc->dpms_mode = -1;
++
++ /* We need to fix up any BIOS configuration that conflicts with
++ * our expectations.
++ */
++ intel_sanitize_modesetting(dev, intel_crtc->pipe, intel_crtc->plane);
++}
++
++static struct drm_crtc_helper_funcs intel_helper_funcs = {
++ .dpms = intel_crtc_dpms,
++ .mode_fixup = intel_crtc_mode_fixup,
++ .mode_set = intel_crtc_mode_set,
++ .mode_set_base = intel_pipe_set_base,
++ .mode_set_base_atomic = intel_pipe_set_base_atomic,
++ .load_lut = intel_crtc_load_lut,
++ .disable = intel_crtc_disable,
++};
++
++static const struct drm_crtc_funcs intel_crtc_funcs = {
++ .reset = intel_crtc_reset,
++ .cursor_set = intel_crtc_cursor_set,
++ .cursor_move = intel_crtc_cursor_move,
++ .gamma_set = intel_crtc_gamma_set,
++ .set_config = drm_crtc_helper_set_config,
++ .destroy = intel_crtc_destroy,
++ .page_flip = intel_crtc_page_flip,
++};
++
+ static void intel_crtc_init(struct drm_device *dev, int pipe)
+ {
+ drm_i915_private_t *dev_priv = dev->dev_private;
+@@ -5759,8 +5765,6 @@ static void intel_crtc_init(struct drm_device *dev, int pipe)
+
+ setup_timer(&intel_crtc->idle_timer, intel_crtc_idle_timer,
+ (unsigned long)intel_crtc);
+-
+- intel_sanitize_modesetting(dev, intel_crtc->pipe, intel_crtc->plane);
+ }
+
+ int intel_get_pipe_from_crtc_id(struct drm_device *dev, void *data,
+diff --git a/drivers/gpu/drm/i915/intel_tv.c b/drivers/gpu/drm/i915/intel_tv.c
+index fe4a53a..65edb22 100644
+--- a/drivers/gpu/drm/i915/intel_tv.c
++++ b/drivers/gpu/drm/i915/intel_tv.c
+@@ -1380,7 +1380,9 @@ intel_tv_detect(struct drm_connector *connector, bool force)
+ if (type < 0)
+ return connector_status_disconnected;
+
++ intel_tv->type = type;
+ intel_tv_find_better_format(connector);
++
+ return connector_status_connected;
+ }
+
+diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+index 60769d2..7826be0 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
++++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+@@ -181,13 +181,13 @@ nouveau_fbcon_sync(struct fb_info *info)
+ OUT_RING (chan, 0);
+ }
+
+- nouveau_bo_wr32(chan->notifier_bo, chan->m2mf_ntfy + 3, 0xffffffff);
++ nouveau_bo_wr32(chan->notifier_bo, chan->m2mf_ntfy/4 + 3, 0xffffffff);
+ FIRE_RING(chan);
+ mutex_unlock(&chan->mutex);
+
+ ret = -EBUSY;
+ for (i = 0; i < 100000; i++) {
+- if (!nouveau_bo_rd32(chan->notifier_bo, chan->m2mf_ntfy + 3)) {
++ if (!nouveau_bo_rd32(chan->notifier_bo, chan->m2mf_ntfy/4 + 3)) {
+ ret = 0;
+ break;
+ }
+diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
+index d71d375..7bd7456 100644
+--- a/drivers/gpu/drm/radeon/atom.c
++++ b/drivers/gpu/drm/radeon/atom.c
+@@ -135,7 +135,7 @@ static uint32_t atom_iio_execute(struct atom_context *ctx, int base,
+ case ATOM_IIO_MOVE_INDEX:
+ temp &=
+ ~((0xFFFFFFFF >> (32 - CU8(base + 1))) <<
+- CU8(base + 2));
++ CU8(base + 3));
+ temp |=
+ ((index >> CU8(base + 2)) &
+ (0xFFFFFFFF >> (32 - CU8(base + 1)))) << CU8(base +
+@@ -145,7 +145,7 @@ static uint32_t atom_iio_execute(struct atom_context *ctx, int base,
+ case ATOM_IIO_MOVE_DATA:
+ temp &=
+ ~((0xFFFFFFFF >> (32 - CU8(base + 1))) <<
+- CU8(base + 2));
++ CU8(base + 3));
+ temp |=
+ ((data >> CU8(base + 2)) &
+ (0xFFFFFFFF >> (32 - CU8(base + 1)))) << CU8(base +
+@@ -155,7 +155,7 @@ static uint32_t atom_iio_execute(struct atom_context *ctx, int base,
+ case ATOM_IIO_MOVE_ATTR:
+ temp &=
+ ~((0xFFFFFFFF >> (32 - CU8(base + 1))) <<
+- CU8(base + 2));
++ CU8(base + 3));
+ temp |=
+ ((ctx->
+ io_attr >> CU8(base + 2)) & (0xFFFFFFFF >> (32 -
+diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
+index 0861257..bede31c 100644
+--- a/drivers/gpu/drm/radeon/atombios_crtc.c
++++ b/drivers/gpu/drm/radeon/atombios_crtc.c
+@@ -532,10 +532,7 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
+ else
+ pll->flags |= RADEON_PLL_PREFER_LOW_REF_DIV;
+
+- if ((rdev->family == CHIP_R600) ||
+- (rdev->family == CHIP_RV610) ||
+- (rdev->family == CHIP_RV630) ||
+- (rdev->family == CHIP_RV670))
++ if (rdev->family < CHIP_RV770)
+ pll->flags |= RADEON_PLL_PREFER_MINM_OVER_MAXP;
+ } else {
+ pll->flags |= RADEON_PLL_LEGACY;
+@@ -565,7 +562,6 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
+ if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT)) {
+ if (ss_enabled) {
+ if (ss->refdiv) {
+- pll->flags |= RADEON_PLL_PREFER_MINM_OVER_MAXP;
+ pll->flags |= RADEON_PLL_USE_REF_DIV;
+ pll->reference_div = ss->refdiv;
+ if (ASIC_IS_AVIVO(rdev))
+diff --git a/drivers/input/xen-kbdfront.c b/drivers/input/xen-kbdfront.c
+index 53e6273..c35ab94 100644
+--- a/drivers/input/xen-kbdfront.c
++++ b/drivers/input/xen-kbdfront.c
+@@ -286,7 +286,7 @@ static void xenkbd_backend_changed(struct xenbus_device *dev,
+ enum xenbus_state backend_state)
+ {
+ struct xenkbd_info *info = dev_get_drvdata(&dev->dev);
+- int val;
++ int ret, val;
+
+ switch (backend_state) {
+ case XenbusStateInitialising:
+@@ -299,6 +299,16 @@ static void xenkbd_backend_changed(struct xenbus_device *dev,
+
+ case XenbusStateInitWait:
+ InitWait:
++ ret = xenbus_scanf(XBT_NIL, info->xbdev->otherend,
++ "feature-abs-pointer", "%d", &val);
++ if (ret < 0)
++ val = 0;
++ if (val) {
++ ret = xenbus_printf(XBT_NIL, info->xbdev->nodename,
++ "request-abs-pointer", "1");
++ if (ret)
++ pr_warning("can't request abs-pointer\n");
++ }
+ xenbus_switch_state(dev, XenbusStateConnected);
+ break;
+
+diff --git a/drivers/media/dvb/b2c2/flexcop-pci.c b/drivers/media/dvb/b2c2/flexcop-pci.c
+index 227c020..4f3e3ce 100644
+--- a/drivers/media/dvb/b2c2/flexcop-pci.c
++++ b/drivers/media/dvb/b2c2/flexcop-pci.c
+@@ -38,7 +38,7 @@ MODULE_PARM_DESC(debug,
+ DEBSTATUS);
+
+ #define DRIVER_VERSION "0.1"
+-#define DRIVER_NAME "Technisat/B2C2 FlexCop II/IIb/III Digital TV PCI Driver"
++#define DRIVER_NAME "flexcop-pci"
+ #define DRIVER_AUTHOR "Patrick Boettcher <patrick.boettcher at desy.de>"
+
+ struct flexcop_pci {
+diff --git a/drivers/net/netxen/netxen_nic.h b/drivers/net/netxen/netxen_nic.h
+index a113805..10f86e0 100644
+--- a/drivers/net/netxen/netxen_nic.h
++++ b/drivers/net/netxen/netxen_nic.h
+@@ -174,7 +174,7 @@
+
+ #define MAX_NUM_CARDS 4
+
+-#define MAX_BUFFERS_PER_CMD 32
++#define NETXEN_MAX_FRAGS_PER_TX 14
+ #define MAX_TSO_HEADER_DESC 2
+ #define MGMT_CMD_DESC_RESV 4
+ #define TX_STOP_THRESH ((MAX_SKB_FRAGS >> 2) + MAX_TSO_HEADER_DESC \
+@@ -558,7 +558,7 @@ struct netxen_recv_crb {
+ */
+ struct netxen_cmd_buffer {
+ struct sk_buff *skb;
+- struct netxen_skb_frag frag_array[MAX_BUFFERS_PER_CMD + 1];
++ struct netxen_skb_frag frag_array[MAX_SKB_FRAGS + 1];
+ u32 frag_count;
+ };
+
+diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
+index 33fac32..28139df 100644
+--- a/drivers/net/netxen/netxen_nic_main.c
++++ b/drivers/net/netxen/netxen_nic_main.c
+@@ -1841,6 +1841,8 @@ netxen_nic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
+ struct cmd_desc_type0 *hwdesc, *first_desc;
+ struct pci_dev *pdev;
+ int i, k;
++ int delta = 0;
++ struct skb_frag_struct *frag;
+
+ u32 producer;
+ int frag_count, no_of_desc;
+@@ -1848,6 +1850,21 @@ netxen_nic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
+
+ frag_count = skb_shinfo(skb)->nr_frags + 1;
+
++ /* 14 frags supported for normal packet and
++ * 32 frags supported for TSO packet
++ */
++ if (!skb_is_gso(skb) && frag_count > NETXEN_MAX_FRAGS_PER_TX) {
++
++ for (i = 0; i < (frag_count - NETXEN_MAX_FRAGS_PER_TX); i++) {
++ frag = &skb_shinfo(skb)->frags[i];
++ delta += frag->size;
++ }
++
++ if (!__pskb_pull_tail(skb, delta))
++ goto drop_packet;
++
++ frag_count = 1 + skb_shinfo(skb)->nr_frags;
++ }
+ /* 4 fragments per cmd des */
+ no_of_desc = (frag_count + 3) >> 2;
+
+diff --git a/drivers/net/qlcnic/qlcnic.h b/drivers/net/qlcnic/qlcnic.h
+index 44e316f..0f136ff 100644
+--- a/drivers/net/qlcnic/qlcnic.h
++++ b/drivers/net/qlcnic/qlcnic.h
+@@ -99,6 +99,7 @@
+ #define TX_UDPV6_PKT 0x0c
+
+ /* Tx defines */
++#define QLCNIC_MAX_FRAGS_PER_TX 14
+ #define MAX_TSO_HEADER_DESC 2
+ #define MGMT_CMD_DESC_RESV 4
+ #define TX_STOP_THRESH ((MAX_SKB_FRAGS >> 2) + MAX_TSO_HEADER_DESC \
+diff --git a/drivers/net/qlcnic/qlcnic_main.c b/drivers/net/qlcnic/qlcnic_main.c
+index 37c04b4..92619d7 100644
+--- a/drivers/net/qlcnic/qlcnic_main.c
++++ b/drivers/net/qlcnic/qlcnic_main.c
+@@ -2099,6 +2099,7 @@ qlcnic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
+ struct cmd_desc_type0 *hwdesc, *first_desc;
+ struct pci_dev *pdev;
+ struct ethhdr *phdr;
++ int delta = 0;
+ int i, k;
+
+ u32 producer;
+@@ -2118,6 +2119,19 @@ qlcnic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
+ }
+
+ frag_count = skb_shinfo(skb)->nr_frags + 1;
++ /* 14 frags supported for normal packet and
++ * 32 frags supported for TSO packet
++ */
++ if (!skb_is_gso(skb) && frag_count > QLCNIC_MAX_FRAGS_PER_TX) {
++
++ for (i = 0; i < (frag_count - QLCNIC_MAX_FRAGS_PER_TX); i++)
++ delta += skb_shinfo(skb)->frags[i].size;
++
++ if (!__pskb_pull_tail(skb, delta))
++ goto drop_packet;
++
++ frag_count = 1 + skb_shinfo(skb)->nr_frags;
++ }
+
+ /* 4 fragments per cmd des */
+ no_of_desc = (frag_count + 3) >> 2;
+diff --git a/drivers/net/wireless/ath/ath9k/ar9003_mac.c b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
+index 4ceddbb..038a0cb 100644
+--- a/drivers/net/wireless/ath/ath9k/ar9003_mac.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
+@@ -615,7 +615,7 @@ int ath9k_hw_process_rxdesc_edma(struct ath_hw *ah, struct ath_rx_status *rxs,
+ */
+ if (rxsp->status11 & AR_CRCErr)
+ rxs->rs_status |= ATH9K_RXERR_CRC;
+- if (rxsp->status11 & AR_PHYErr) {
++ else if (rxsp->status11 & AR_PHYErr) {
+ phyerr = MS(rxsp->status11, AR_PHYErrCode);
+ /*
+ * If we reach a point here where AR_PostDelimCRCErr is
+@@ -638,11 +638,11 @@ int ath9k_hw_process_rxdesc_edma(struct ath_hw *ah, struct ath_rx_status *rxs,
+ rxs->rs_phyerr = phyerr;
+ }
+
+- }
+- if (rxsp->status11 & AR_DecryptCRCErr)
++ } else if (rxsp->status11 & AR_DecryptCRCErr)
+ rxs->rs_status |= ATH9K_RXERR_DECRYPT;
+- if (rxsp->status11 & AR_MichaelErr)
++ else if (rxsp->status11 & AR_MichaelErr)
+ rxs->rs_status |= ATH9K_RXERR_MIC;
++
+ if (rxsp->status11 & AR_KeyMiss)
+ rxs->rs_status |= ATH9K_RXERR_DECRYPT;
+ }
+diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
+index 7c0a7c4..a3b77ae 100644
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -1218,15 +1218,6 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
+ ah->txchainmask = common->tx_chainmask;
+ ah->rxchainmask = common->rx_chainmask;
+
+- if ((common->bus_ops->ath_bus_type != ATH_USB) && !ah->chip_fullsleep) {
+- ath9k_hw_abortpcurecv(ah);
+- if (!ath9k_hw_stopdmarecv(ah)) {
+- ath_dbg(common, ATH_DBG_XMIT,
+- "Failed to stop receive dma\n");
+- bChannelChange = false;
+- }
+- }
+-
+ if (!ath9k_hw_setpower(ah, ATH9K_PM_AWAKE))
+ return -EIO;
+
+diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
+index 2915b11..e9fc97d 100644
+--- a/drivers/net/wireless/ath/ath9k/mac.c
++++ b/drivers/net/wireless/ath/ath9k/mac.c
+@@ -690,17 +690,23 @@ int ath9k_hw_rxprocdesc(struct ath_hw *ah, struct ath_desc *ds,
+ rs->rs_flags |= ATH9K_RX_DECRYPT_BUSY;
+
+ if ((ads.ds_rxstatus8 & AR_RxFrameOK) == 0) {
++ /*
++ * Treat these errors as mutually exclusive to avoid spurious
++ * extra error reports from the hardware. If a CRC error is
++ * reported, then decryption and MIC errors are irrelevant,
++ * the frame is going to be dropped either way
++ */
+ if (ads.ds_rxstatus8 & AR_CRCErr)
+ rs->rs_status |= ATH9K_RXERR_CRC;
+- if (ads.ds_rxstatus8 & AR_PHYErr) {
++ else if (ads.ds_rxstatus8 & AR_PHYErr) {
+ rs->rs_status |= ATH9K_RXERR_PHY;
+ phyerr = MS(ads.ds_rxstatus8, AR_PHYErrCode);
+ rs->rs_phyerr = phyerr;
+- }
+- if (ads.ds_rxstatus8 & AR_DecryptCRCErr)
++ } else if (ads.ds_rxstatus8 & AR_DecryptCRCErr)
+ rs->rs_status |= ATH9K_RXERR_DECRYPT;
+- if (ads.ds_rxstatus8 & AR_MichaelErr)
++ else if (ads.ds_rxstatus8 & AR_MichaelErr)
+ rs->rs_status |= ATH9K_RXERR_MIC;
++
+ if (ads.ds_rxstatus8 & AR_KeyMiss)
+ rs->rs_status |= ATH9K_RXERR_DECRYPT;
+ }
+@@ -770,28 +776,47 @@ void ath9k_hw_abortpcurecv(struct ath_hw *ah)
+ }
+ EXPORT_SYMBOL(ath9k_hw_abortpcurecv);
+
+-bool ath9k_hw_stopdmarecv(struct ath_hw *ah)
++bool ath9k_hw_stopdmarecv(struct ath_hw *ah, bool *reset)
+ {
+ #define AH_RX_STOP_DMA_TIMEOUT 10000 /* usec */
+ #define AH_RX_TIME_QUANTUM 100 /* usec */
+ struct ath_common *common = ath9k_hw_common(ah);
++ u32 mac_status, last_mac_status = 0;
+ int i;
+
++ /* Enable access to the DMA observation bus */
++ REG_WRITE(ah, AR_MACMISC,
++ ((AR_MACMISC_DMA_OBS_LINE_8 << AR_MACMISC_DMA_OBS_S) |
++ (AR_MACMISC_MISC_OBS_BUS_1 <<
++ AR_MACMISC_MISC_OBS_BUS_MSB_S)));
++
+ REG_WRITE(ah, AR_CR, AR_CR_RXD);
+
+ /* Wait for rx enable bit to go low */
+ for (i = AH_RX_STOP_DMA_TIMEOUT / AH_TIME_QUANTUM; i != 0; i--) {
+ if ((REG_READ(ah, AR_CR) & AR_CR_RXE) == 0)
+ break;
++
++ if (!AR_SREV_9300_20_OR_LATER(ah)) {
++ mac_status = REG_READ(ah, AR_DMADBG_7) & 0x7f0;
++ if (mac_status == 0x1c0 && mac_status == last_mac_status) {
++ *reset = true;
++ break;
++ }
++
++ last_mac_status = mac_status;
++ }
++
+ udelay(AH_TIME_QUANTUM);
+ }
+
+ if (i == 0) {
+ ath_err(common,
+- "DMA failed to stop in %d ms AR_CR=0x%08x AR_DIAG_SW=0x%08x\n",
++ "DMA failed to stop in %d ms AR_CR=0x%08x AR_DIAG_SW=0x%08x DMADBG_7=0x%08x\n",
+ AH_RX_STOP_DMA_TIMEOUT / 1000,
+ REG_READ(ah, AR_CR),
+- REG_READ(ah, AR_DIAG_SW));
++ REG_READ(ah, AR_DIAG_SW),
++ REG_READ(ah, AR_DMADBG_7));
+ return false;
+ } else {
+ return true;
+diff --git a/drivers/net/wireless/ath/ath9k/mac.h b/drivers/net/wireless/ath/ath9k/mac.h
+index 7512f97..d9cc299 100644
+--- a/drivers/net/wireless/ath/ath9k/mac.h
++++ b/drivers/net/wireless/ath/ath9k/mac.h
+@@ -692,7 +692,7 @@ bool ath9k_hw_setrxabort(struct ath_hw *ah, bool set);
+ void ath9k_hw_putrxbuf(struct ath_hw *ah, u32 rxdp);
+ void ath9k_hw_startpcureceive(struct ath_hw *ah, bool is_scanning);
+ void ath9k_hw_abortpcurecv(struct ath_hw *ah);
+-bool ath9k_hw_stopdmarecv(struct ath_hw *ah);
++bool ath9k_hw_stopdmarecv(struct ath_hw *ah, bool *reset);
+ int ath9k_hw_beaconq_setup(struct ath_hw *ah);
+
+ /* Interrupt Handling */
+diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
+index 3867a2e..89546bc 100644
+--- a/drivers/net/wireless/ath/ath9k/recv.c
++++ b/drivers/net/wireless/ath/ath9k/recv.c
+@@ -513,12 +513,12 @@ start_recv:
+ bool ath_stoprecv(struct ath_softc *sc)
+ {
+ struct ath_hw *ah = sc->sc_ah;
+- bool stopped;
++ bool stopped, reset = false;
+
+ spin_lock_bh(&sc->rx.rxbuflock);
+ ath9k_hw_abortpcurecv(ah);
+ ath9k_hw_setrxfilter(ah, 0);
+- stopped = ath9k_hw_stopdmarecv(ah);
++ stopped = ath9k_hw_stopdmarecv(ah, &reset);
+
+ if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
+ ath_edma_stop_recv(sc);
+@@ -533,7 +533,7 @@ bool ath_stoprecv(struct ath_softc *sc)
+ "confusing the DMA engine when we start RX up\n");
+ ATH_DBG_WARN_ON_ONCE(!stopped);
+ }
+- return stopped;
++ return stopped || reset;
+ }
+
+ void ath_flushrecv(struct ath_softc *sc)
+diff --git a/drivers/net/wireless/ath/regd_common.h b/drivers/net/wireless/ath/regd_common.h
+index 248c670..5c2cfe6 100644
+--- a/drivers/net/wireless/ath/regd_common.h
++++ b/drivers/net/wireless/ath/regd_common.h
+@@ -195,6 +195,7 @@ static struct reg_dmn_pair_mapping regDomainPairs[] = {
+ {APL9_WORLD, CTL_ETSI, CTL_ETSI},
+
+ {APL3_FCCA, CTL_FCC, CTL_FCC},
++ {APL7_FCCA, CTL_FCC, CTL_FCC},
+ {APL1_ETSIC, CTL_FCC, CTL_ETSI},
+ {APL2_ETSIC, CTL_FCC, CTL_ETSI},
+ {APL2_APLD, CTL_FCC, NO_CTL},
+diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-hw.h b/drivers/net/wireless/iwlwifi/iwl-3945-hw.h
+index 65b5834..c2dd4cd 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-3945-hw.h
++++ b/drivers/net/wireless/iwlwifi/iwl-3945-hw.h
+@@ -74,8 +74,6 @@
+ /* RSSI to dBm */
+ #define IWL39_RSSI_OFFSET 95
+
+-#define IWL_DEFAULT_TX_POWER 0x0F
+-
+ /*
+ * EEPROM related constants, enums, and structures.
+ */
+diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
+index 39b6f16..4e7b58b 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
++++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
+@@ -1823,7 +1823,7 @@ int iwl3945_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
+
+ /* If we issue a new RXON command which required a tune then we must
+ * send a new TXPOWER command or we won't be able to Tx any frames */
+- rc = priv->cfg->ops->lib->send_tx_power(priv);
++ rc = iwl_set_tx_power(priv, priv->tx_power_next, true);
+ if (rc) {
+ IWL_ERR(priv, "Error setting Tx power (%d).\n", rc);
+ return rc;
+diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
+index 91a9f52..992caa0 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
++++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
+@@ -1571,7 +1571,7 @@ static int iwl4965_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *c
+
+ /* If we issue a new RXON command which required a tune then we must
+ * send a new TXPOWER command or we won't be able to Tx any frames */
+- ret = iwl_set_tx_power(priv, priv->tx_power_user_lmt, true);
++ ret = iwl_set_tx_power(priv, priv->tx_power_next, true);
+ if (ret) {
+ IWL_ERR(priv, "Error sending TX power (%d)\n", ret);
+ return ret;
+diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c b/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
+index 6d140bd..ee802fe 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
+@@ -288,10 +288,9 @@ int iwlagn_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
+ * If we issue a new RXON command which required a tune then we must
+ * send a new TXPOWER command or we won't be able to Tx any frames.
+ *
+- * FIXME: which RXON requires a tune? Can we optimise this out in
+- * some cases?
++ * It's expected we set power here if channel is changing.
+ */
+- ret = iwl_set_tx_power(priv, priv->tx_power_user_lmt, true);
++ ret = iwl_set_tx_power(priv, priv->tx_power_next, true);
+ if (ret) {
+ IWL_ERR(priv, "Error sending TX power (%d)\n", ret);
+ return ret;
+diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
+index c1cfd99..35239f0 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
+@@ -3841,12 +3841,6 @@ static int iwl_init_drv(struct iwl_priv *priv)
+ priv->dynamic_frag_thresh = BT_FRAG_THRESHOLD_DEF;
+ }
+
+- /* Set the tx_power_user_lmt to the lowest power level
+- * this value will get overwritten by channel max power avg
+- * from eeprom */
+- priv->tx_power_user_lmt = IWLAGN_TX_POWER_TARGET_POWER_MIN;
+- priv->tx_power_next = IWLAGN_TX_POWER_TARGET_POWER_MIN;
+-
+ ret = iwl_init_channel_map(priv);
+ if (ret) {
+ IWL_ERR(priv, "initializing regulatory failed: %d\n", ret);
+diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
+index efbde1f..294e9fc 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-core.c
++++ b/drivers/net/wireless/iwlwifi/iwl-core.c
+@@ -168,6 +168,7 @@ int iwlcore_init_geos(struct iwl_priv *priv)
+ struct ieee80211_channel *geo_ch;
+ struct ieee80211_rate *rates;
+ int i = 0;
++ s8 max_tx_power = 0;
+
+ if (priv->bands[IEEE80211_BAND_2GHZ].n_bitrates ||
+ priv->bands[IEEE80211_BAND_5GHZ].n_bitrates) {
+@@ -244,8 +245,8 @@ int iwlcore_init_geos(struct iwl_priv *priv)
+
+ geo_ch->flags |= ch->ht40_extension_channel;
+
+- if (ch->max_power_avg > priv->tx_power_device_lmt)
+- priv->tx_power_device_lmt = ch->max_power_avg;
++ if (ch->max_power_avg > max_tx_power)
++ max_tx_power = ch->max_power_avg;
+ } else {
+ geo_ch->flags |= IEEE80211_CHAN_DISABLED;
+ }
+@@ -258,6 +259,10 @@ int iwlcore_init_geos(struct iwl_priv *priv)
+ geo_ch->flags);
+ }
+
++ priv->tx_power_device_lmt = max_tx_power;
++ priv->tx_power_user_lmt = max_tx_power;
++ priv->tx_power_next = max_tx_power;
++
+ if ((priv->bands[IEEE80211_BAND_5GHZ].n_channels == 0) &&
+ priv->cfg->sku & IWL_SKU_A) {
+ IWL_INFO(priv, "Incorrectly detected BG card as ABG. "
+@@ -1161,6 +1166,8 @@ int iwl_set_tx_power(struct iwl_priv *priv, s8 tx_power, bool force)
+ {
+ int ret;
+ s8 prev_tx_power;
++ bool defer;
++ struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
+
+ lockdep_assert_held(&priv->mutex);
+
+@@ -1188,10 +1195,15 @@ int iwl_set_tx_power(struct iwl_priv *priv, s8 tx_power, bool force)
+ if (!iwl_is_ready_rf(priv))
+ return -EIO;
+
+- /* scan complete use tx_power_next, need to be updated */
++ /* scan complete and commit_rxon use tx_power_next value,
++ * it always need to be updated for newest request */
+ priv->tx_power_next = tx_power;
+- if (test_bit(STATUS_SCANNING, &priv->status) && !force) {
+- IWL_DEBUG_INFO(priv, "Deferring tx power set while scanning\n");
++
++ /* do not set tx power when scanning or channel changing */
++ defer = test_bit(STATUS_SCANNING, &priv->status) ||
++ memcmp(&ctx->active, &ctx->staging, sizeof(ctx->staging));
++ if (defer && !force) {
++ IWL_DEBUG_INFO(priv, "Deferring tx power set\n");
+ return 0;
+ }
+
+diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.c b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
+index 358cfd7..8b3c127 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.c
++++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
+@@ -724,13 +724,6 @@ int iwl_init_channel_map(struct iwl_priv *priv)
+ flags & EEPROM_CHANNEL_RADAR))
+ ? "" : "not ");
+
+- /* Set the tx_power_user_lmt to the highest power
+- * supported by any channel */
+- if (eeprom_ch_info[ch].max_power_avg >
+- priv->tx_power_user_lmt)
+- priv->tx_power_user_lmt =
+- eeprom_ch_info[ch].max_power_avg;
+-
+ ch_info++;
+ }
+ }
+diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
+index 371abbf..64917ed 100644
+--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
++++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
+@@ -94,6 +94,7 @@ MODULE_LICENSE("GPL");
+ struct iwl_mod_params iwl3945_mod_params = {
+ .sw_crypto = 1,
+ .restart_fw = 1,
++ .disable_hw_scan = 1,
+ /* the rest are 0 by default */
+ };
+
+@@ -3858,10 +3859,6 @@ static int iwl3945_init_drv(struct iwl_priv *priv)
+ priv->force_reset[IWL_FW_RESET].reset_duration =
+ IWL_DELAY_NEXT_FORCE_FW_RELOAD;
+
+-
+- priv->tx_power_user_lmt = IWL_DEFAULT_TX_POWER;
+- priv->tx_power_next = IWL_DEFAULT_TX_POWER;
+-
+ if (eeprom->version < EEPROM_3945_EEPROM_VERSION) {
+ IWL_WARN(priv, "Unsupported EEPROM version: 0x%04X\n",
+ eeprom->version);
+@@ -3995,8 +3992,7 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
+ * "the hard way", rather than using device's scan.
+ */
+ if (iwl3945_mod_params.disable_hw_scan) {
+- dev_printk(KERN_DEBUG, &(pdev->dev),
+- "sw scan support is deprecated\n");
++ IWL_DEBUG_INFO(priv, "Disabling hw_scan\n");
+ iwl3945_hw_ops.hw_scan = NULL;
+ }
+
+@@ -4318,8 +4314,7 @@ MODULE_PARM_DESC(debug, "debug output mask");
+ #endif
+ module_param_named(disable_hw_scan, iwl3945_mod_params.disable_hw_scan,
+ int, S_IRUGO);
+-MODULE_PARM_DESC(disable_hw_scan,
+- "disable hardware scanning (default 0) (deprecated)");
++MODULE_PARM_DESC(disable_hw_scan, "disable hardware scanning (default 1)");
+ module_param_named(fw_restart3945, iwl3945_mod_params.restart_fw, int, S_IRUGO);
+ MODULE_PARM_DESC(fw_restart3945, "restart firmware in case of error");
+
+diff --git a/drivers/net/wireless/p54/txrx.c b/drivers/net/wireless/p54/txrx.c
+index f618b96..2cfdd38 100644
+--- a/drivers/net/wireless/p54/txrx.c
++++ b/drivers/net/wireless/p54/txrx.c
+@@ -705,7 +705,7 @@ int p54_tx_80211(struct ieee80211_hw *dev, struct sk_buff *skb)
+ struct p54_tx_info *p54info;
+ struct p54_hdr *hdr;
+ struct p54_tx_data *txhdr;
+- unsigned int padding, len, extra_len;
++ unsigned int padding, len, extra_len = 0;
+ int i, j, ridx;
+ u16 hdr_flags = 0, aid = 0;
+ u8 rate, queue = 0, crypt_offset = 0;
+diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
+index 4789f8e..5dc5d3e 100644
+--- a/drivers/pci/intel-iommu.c
++++ b/drivers/pci/intel-iommu.c
+@@ -1835,7 +1835,7 @@ static struct dmar_domain *get_domain_for_dev(struct pci_dev *pdev, int gaw)
+
+ ret = iommu_attach_domain(domain, iommu);
+ if (ret) {
+- domain_exit(domain);
++ free_domain_mem(domain);
+ goto error;
+ }
+
+@@ -3260,9 +3260,15 @@ static int device_notifier(struct notifier_block *nb,
+ if (!domain)
+ return 0;
+
+- if (action == BUS_NOTIFY_UNBOUND_DRIVER && !iommu_pass_through)
++ if (action == BUS_NOTIFY_UNBOUND_DRIVER && !iommu_pass_through) {
+ domain_remove_one_dev_info(domain, pdev);
+
++ if (!(domain->flags & DOMAIN_FLAG_VIRTUAL_MACHINE) &&
++ !(domain->flags & DOMAIN_FLAG_STATIC_IDENTITY) &&
++ list_empty(&domain->devices))
++ domain_exit(domain);
++ }
++
+ return 0;
+ }
+
+@@ -3411,6 +3417,11 @@ static void domain_remove_one_dev_info(struct dmar_domain *domain,
+ domain->iommu_count--;
+ domain_update_iommu_cap(domain);
+ spin_unlock_irqrestore(&domain->iommu_lock, tmp_flags);
++
++ spin_lock_irqsave(&iommu->lock, tmp_flags);
++ clear_bit(domain->id, iommu->domain_ids);
++ iommu->domains[domain->id] = NULL;
++ spin_unlock_irqrestore(&iommu->lock, tmp_flags);
+ }
+
+ spin_unlock_irqrestore(&device_domain_lock, flags);
+@@ -3627,9 +3638,9 @@ static int intel_iommu_attach_device(struct iommu_domain *domain,
+
+ pte = dmar_domain->pgd;
+ if (dma_pte_present(pte)) {
+- free_pgtable_page(dmar_domain->pgd);
+ dmar_domain->pgd = (struct dma_pte *)
+ phys_to_virt(dma_pte_addr(pte));
++ free_pgtable_page(pte);
+ }
+ dmar_domain->agaw--;
+ }
+diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c
+index 114d952..21b1018 100644
+--- a/drivers/platform/x86/ideapad-laptop.c
++++ b/drivers/platform/x86/ideapad-laptop.c
+@@ -459,6 +459,8 @@ static void ideapad_acpi_notify(struct acpi_device *adevice, u32 event)
+ if (test_bit(vpc_bit, &vpc1)) {
+ if (vpc_bit == 9)
+ ideapad_sync_rfk_state(adevice);
++ else if (vpc_bit == 4)
++ read_ec_data(handle, 0x12, &vpc2);
+ else
+ ideapad_input_report(priv, vpc_bit);
+ }
+diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
+index aa2e5d3..c4b0ef1 100644
+--- a/drivers/tty/n_gsm.c
++++ b/drivers/tty/n_gsm.c
+@@ -1659,8 +1659,12 @@ static void gsm_queue(struct gsm_mux *gsm)
+
+ if ((gsm->control & ~PF) == UI)
+ gsm->fcs = gsm_fcs_add_block(gsm->fcs, gsm->buf, gsm->len);
+- /* generate final CRC with received FCS */
+- gsm->fcs = gsm_fcs_add(gsm->fcs, gsm->received_fcs);
++ if (gsm->encoding == 0){
++ /* WARNING: gsm->received_fcs is used for gsm->encoding = 0 only.
++ In this case it contain the last piece of data
++ required to generate final CRC */
++ gsm->fcs = gsm_fcs_add(gsm->fcs, gsm->received_fcs);
++ }
+ if (gsm->fcs != GOOD_FCS) {
+ gsm->bad_fcs++;
+ if (debug & 4)
+diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
+index dfcf4b1..0d66751 100644
+--- a/drivers/tty/serial/imx.c
++++ b/drivers/tty/serial/imx.c
+@@ -382,12 +382,13 @@ static void imx_start_tx(struct uart_port *port)
+ static irqreturn_t imx_rtsint(int irq, void *dev_id)
+ {
+ struct imx_port *sport = dev_id;
+- unsigned int val = readl(sport->port.membase + USR1) & USR1_RTSS;
++ unsigned int val;
+ unsigned long flags;
+
+ spin_lock_irqsave(&sport->port.lock, flags);
+
+ writel(USR1_RTSD, sport->port.membase + USR1);
++ val = readl(sport->port.membase + USR1) & USR1_RTSS;
+ uart_handle_cts_change(&sport->port, !!val);
+ wake_up_interruptible(&sport->port.state->port.delta_msr_wait);
+
+diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
+index cc2f73e..b0043fb 100644
+--- a/drivers/virtio/virtio_ring.c
++++ b/drivers/virtio/virtio_ring.c
+@@ -371,6 +371,7 @@ void *virtqueue_detach_unused_buf(struct virtqueue *_vq)
+ /* detach_buf clears data, so grab it now. */
+ buf = vq->data[i];
+ detach_buf(vq, i);
++ vq->vring.avail->idx--;
+ END_USE(vq);
+ return buf;
+ }
+diff --git a/fs/file.c b/fs/file.c
+index 0be3447..4c6992d 100644
+--- a/fs/file.c
++++ b/fs/file.c
+@@ -9,6 +9,7 @@
+ #include <linux/module.h>
+ #include <linux/fs.h>
+ #include <linux/mm.h>
++#include <linux/mmzone.h>
+ #include <linux/time.h>
+ #include <linux/sched.h>
+ #include <linux/slab.h>
+@@ -39,14 +40,17 @@ int sysctl_nr_open_max = 1024 * 1024; /* raised later */
+ */
+ static DEFINE_PER_CPU(struct fdtable_defer, fdtable_defer_list);
+
+-static inline void *alloc_fdmem(unsigned int size)
++static void *alloc_fdmem(unsigned int size)
+ {
+- void *data;
+-
+- data = kmalloc(size, GFP_KERNEL|__GFP_NOWARN);
+- if (data != NULL)
+- return data;
+-
++ /*
++ * Very large allocations can stress page reclaim, so fall back to
++ * vmalloc() if the allocation size will be considered "large" by the VM.
++ */
++ if (size <= (PAGE_SIZE << PAGE_ALLOC_COSTLY_ORDER)) {
++ void *data = kmalloc(size, GFP_KERNEL|__GFP_NOWARN);
++ if (data != NULL)
++ return data;
++ }
+ return vmalloc(size);
+ }
+
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index 0592288..6221640 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -1600,7 +1600,7 @@ static void nfs4_state_manager(struct nfs_client *clp)
+ int status = 0;
+
+ /* Ensure exclusive access to NFSv4 state */
+- for(;;) {
++ do {
+ if (test_and_clear_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state)) {
+ /* We're going to have to re-establish a clientid */
+ status = nfs4_reclaim_lease(clp);
+@@ -1684,7 +1684,7 @@ static void nfs4_state_manager(struct nfs_client *clp)
+ break;
+ if (test_and_set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) != 0)
+ break;
+- }
++ } while (atomic_read(&clp->cl_count) > 1);
+ return;
+ out_error:
+ printk(KERN_WARNING "Error: state manager failed on NFSv4 server %s"
+diff --git a/fs/nfs/super.c b/fs/nfs/super.c
+index b68c860..6a2ec50 100644
+--- a/fs/nfs/super.c
++++ b/fs/nfs/super.c
+@@ -2077,6 +2077,15 @@ nfs_remount(struct super_block *sb, int *flags, char *raw_data)
+ if (error < 0)
+ goto out;
+
++ /*
++ * noac is a special case. It implies -o sync, but that's not
++ * necessarily reflected in the mtab options. do_remount_sb
++ * will clear MS_SYNCHRONOUS if -o sync wasn't specified in the
++ * remount options, so we have to explicitly reset it.
++ */
++ if (data->flags & NFS_MOUNT_NOAC)
++ *flags |= MS_SYNCHRONOUS;
++
+ /* compare new mount options with old ones */
+ error = nfs_compare_remount_data(nfss, data);
+ out:
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index 96aaaa4..18c356c 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -258,6 +258,7 @@ static void nfs4_put_deleg_lease(struct nfs4_file *fp)
+ if (atomic_dec_and_test(&fp->fi_delegees)) {
+ vfs_setlease(fp->fi_deleg_file, F_UNLCK, &fp->fi_lease);
+ fp->fi_lease = NULL;
++ fput(fp->fi_deleg_file);
+ fp->fi_deleg_file = NULL;
+ }
+ }
+@@ -402,8 +403,8 @@ static void free_generic_stateid(struct nfs4_stateid *stp)
+ if (stp->st_access_bmap) {
+ oflag = nfs4_access_bmap_to_omode(stp);
+ nfs4_file_put_access(stp->st_file, oflag);
+- put_nfs4_file(stp->st_file);
+ }
++ put_nfs4_file(stp->st_file);
+ kmem_cache_free(stateid_slab, stp);
+ }
+
+diff --git a/fs/ubifs/recovery.c b/fs/ubifs/recovery.c
+index 77e9b87..c0c590f 100644
+--- a/fs/ubifs/recovery.c
++++ b/fs/ubifs/recovery.c
+@@ -300,6 +300,32 @@ int ubifs_recover_master_node(struct ubifs_info *c)
+ goto out_free;
+ }
+ memcpy(c->rcvrd_mst_node, c->mst_node, UBIFS_MST_NODE_SZ);
++
++ /*
++ * We had to recover the master node, which means there was an
++ * unclean reboot. However, it is possible that the master node
++ * is clean at this point, i.e., %UBIFS_MST_DIRTY is not set.
++ * E.g., consider the following chain of events:
++ *
++ * 1. UBIFS was cleanly unmounted, so the master node is clean
++ * 2. UBIFS is being mounted R/W and starts changing the master
++ * node in the first (%UBIFS_MST_LNUM). A power cut happens,
++ * so this LEB ends up with some amount of garbage at the
++ * end.
++ * 3. UBIFS is being mounted R/O. We reach this place and
++ * recover the master node from the second LEB
++ * (%UBIFS_MST_LNUM + 1). But we cannot update the media
++ * because we are being mounted R/O. We have to defer the
++ * operation.
++ * 4. However, this master node (@c->mst_node) is marked as
++ * clean (since the step 1). And if we just return, the
++ * mount code will be confused and won't recover the master
++ * node when it is re-mounter R/W later.
++ *
++ * Thus, to force the recovery by marking the master node as
++ * dirty.
++ */
++ c->mst_node->flags |= cpu_to_le32(UBIFS_MST_DIRTY);
+ } else {
+ /* Write the recovered master node */
+ c->max_sqnum = le64_to_cpu(mst->ch.sqnum) - 1;
+diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
+index 0f029e1..e94d962 100644
+--- a/fs/ubifs/super.c
++++ b/fs/ubifs/super.c
+@@ -1643,15 +1643,27 @@ static int ubifs_remount_rw(struct ubifs_info *c)
+ if (err)
+ goto out;
+
++ dbg_gen("re-mounted read-write");
++ c->remounting_rw = 0;
++
+ if (c->need_recovery) {
+ c->need_recovery = 0;
+ ubifs_msg("deferred recovery completed");
++ } else {
++ /*
++ * Do not run the debugging space check if the were doing
++ * recovery, because when we saved the information we had the
++ * file-system in a state where the TNC and lprops has been
++ * modified in memory, but all the I/O operations (including a
++ * commit) were deferred. So the file-system was in
++ * "non-committed" state. Now the file-system is in committed
++ * state, and of course the amount of free space will change
++ * because, for example, the old index size was imprecise.
++ */
++ err = dbg_check_space_info(c);
+ }
+
+- dbg_gen("re-mounted read-write");
+- c->remounting_rw = 0;
+ c->always_chk_crc = 0;
+- err = dbg_check_space_info(c);
+ mutex_unlock(&c->umount_mutex);
+ return err;
+
+diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h
+index df29c8f..8847c8c 100644
+--- a/include/linux/huge_mm.h
++++ b/include/linux/huge_mm.h
+@@ -117,7 +117,7 @@ static inline void vma_adjust_trans_huge(struct vm_area_struct *vma,
+ unsigned long end,
+ long adjust_next)
+ {
+- if (!vma->anon_vma || vma->vm_ops || vma->vm_file)
++ if (!vma->anon_vma || vma->vm_ops)
+ return;
+ __vma_adjust_trans_huge(vma, start, end, adjust_next);
+ }
+diff --git a/include/linux/libata.h b/include/linux/libata.h
+index c9c5d7a..1f00080 100644
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -203,6 +203,7 @@ enum {
+ * management */
+ ATA_FLAG_SW_ACTIVITY = (1 << 22), /* driver supports sw activity
+ * led */
++ ATA_FLAG_NO_DIPM = (1 << 23), /* host not happy with DIPM */
+
+ /* bits 24:31 of ap->flags are reserved for LLD specific flags */
+
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index c67adb4..248c946 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -137,7 +137,8 @@ extern unsigned int kobjsize(const void *objp);
+ #define VM_RandomReadHint(v) ((v)->vm_flags & VM_RAND_READ)
+
+ /*
+- * special vmas that are non-mergable, non-mlock()able
++ * Special vmas that are non-mergable, non-mlock()able.
++ * Note: mm/huge_memory.c VM_NO_THP depends on this definition.
+ */
+ #define VM_SPECIAL (VM_IO | VM_DONTEXPAND | VM_RESERVED | VM_PFNMAP)
+
+diff --git a/init/Kconfig b/init/Kconfig
+index be788c0..47dd02f 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -1209,6 +1209,7 @@ config SLAB
+ per cpu and per node queues.
+
+ config SLUB
++ depends on BROKEN || NUMA || !DISCONTIGMEM
+ bool "SLUB (Unqueued Allocator)"
+ help
+ SLUB is a slab allocator that minimizes cache line usage
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index 8f76561..56cac93 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -1400,6 +1400,9 @@ out:
+ return ret;
+ }
+
++#define VM_NO_THP (VM_SPECIAL|VM_INSERTPAGE|VM_MIXEDMAP|VM_SAO| \
++ VM_HUGETLB|VM_SHARED|VM_MAYSHARE)
++
+ int hugepage_madvise(struct vm_area_struct *vma,
+ unsigned long *vm_flags, int advice)
+ {
+@@ -1408,11 +1411,7 @@ int hugepage_madvise(struct vm_area_struct *vma,
+ /*
+ * Be somewhat over-protective like KSM for now!
+ */
+- if (*vm_flags & (VM_HUGEPAGE |
+- VM_SHARED | VM_MAYSHARE |
+- VM_PFNMAP | VM_IO | VM_DONTEXPAND |
+- VM_RESERVED | VM_HUGETLB | VM_INSERTPAGE |
+- VM_MIXEDMAP | VM_SAO))
++ if (*vm_flags & (VM_HUGEPAGE | VM_NO_THP))
+ return -EINVAL;
+ *vm_flags &= ~VM_NOHUGEPAGE;
+ *vm_flags |= VM_HUGEPAGE;
+@@ -1428,11 +1427,7 @@ int hugepage_madvise(struct vm_area_struct *vma,
+ /*
+ * Be somewhat over-protective like KSM for now!
+ */
+- if (*vm_flags & (VM_NOHUGEPAGE |
+- VM_SHARED | VM_MAYSHARE |
+- VM_PFNMAP | VM_IO | VM_DONTEXPAND |
+- VM_RESERVED | VM_HUGETLB | VM_INSERTPAGE |
+- VM_MIXEDMAP | VM_SAO))
++ if (*vm_flags & (VM_NOHUGEPAGE | VM_NO_THP))
+ return -EINVAL;
+ *vm_flags &= ~VM_HUGEPAGE;
+ *vm_flags |= VM_NOHUGEPAGE;
+@@ -1566,10 +1561,14 @@ int khugepaged_enter_vma_merge(struct vm_area_struct *vma)
+ * page fault if needed.
+ */
+ return 0;
+- if (vma->vm_file || vma->vm_ops)
++ if (vma->vm_ops)
+ /* khugepaged not yet working on file or special mappings */
+ return 0;
+- VM_BUG_ON(is_linear_pfn_mapping(vma) || is_pfn_mapping(vma));
++ /*
++ * If is_pfn_mapping() is true is_learn_pfn_mapping() must be
++ * true too, verify it here.
++ */
++ VM_BUG_ON(is_linear_pfn_mapping(vma) || vma->vm_flags & VM_NO_THP);
+ hstart = (vma->vm_start + ~HPAGE_PMD_MASK) & HPAGE_PMD_MASK;
+ hend = vma->vm_end & HPAGE_PMD_MASK;
+ if (hstart < hend)
+@@ -1818,12 +1817,15 @@ static void collapse_huge_page(struct mm_struct *mm,
+ (vma->vm_flags & VM_NOHUGEPAGE))
+ goto out;
+
+- /* VM_PFNMAP vmas may have vm_ops null but vm_file set */
+- if (!vma->anon_vma || vma->vm_ops || vma->vm_file)
++ if (!vma->anon_vma || vma->vm_ops)
+ goto out;
+ if (is_vma_temporary_stack(vma))
+ goto out;
+- VM_BUG_ON(is_linear_pfn_mapping(vma) || is_pfn_mapping(vma));
++ /*
++ * If is_pfn_mapping() is true is_learn_pfn_mapping() must be
++ * true too, verify it here.
++ */
++ VM_BUG_ON(is_linear_pfn_mapping(vma) || vma->vm_flags & VM_NO_THP);
+
+ pgd = pgd_offset(mm, address);
+ if (!pgd_present(*pgd))
+@@ -2056,13 +2058,16 @@ static unsigned int khugepaged_scan_mm_slot(unsigned int pages,
+ progress++;
+ continue;
+ }
+- /* VM_PFNMAP vmas may have vm_ops null but vm_file set */
+- if (!vma->anon_vma || vma->vm_ops || vma->vm_file)
++ if (!vma->anon_vma || vma->vm_ops)
+ goto skip;
+ if (is_vma_temporary_stack(vma))
+ goto skip;
+-
+- VM_BUG_ON(is_linear_pfn_mapping(vma) || is_pfn_mapping(vma));
++ /*
++ * If is_pfn_mapping() is true is_learn_pfn_mapping()
++ * must be true too, verify it here.
++ */
++ VM_BUG_ON(is_linear_pfn_mapping(vma) ||
++ vma->vm_flags & VM_NO_THP);
+
+ hstart = (vma->vm_start + ~HPAGE_PMD_MASK) & HPAGE_PMD_MASK;
+ hend = vma->vm_end & HPAGE_PMD_MASK;
+diff --git a/mm/memory.c b/mm/memory.c
+index f17746a..ab88d09 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -3332,7 +3332,7 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+ * run pte_offset_map on the pmd, if an huge pmd could
+ * materialize from under us from a different thread.
+ */
+- if (unlikely(__pte_alloc(mm, vma, pmd, address)))
++ if (unlikely(pmd_none(*pmd)) && __pte_alloc(mm, vma, pmd, address))
+ return VM_FAULT_OOM;
+ /* if an huge pmd materialized from under us just retry later */
+ if (unlikely(pmd_trans_huge(*pmd)))
+diff --git a/mm/oom_kill.c b/mm/oom_kill.c
+index ea16f72..49ea0cc 100644
+--- a/mm/oom_kill.c
++++ b/mm/oom_kill.c
+@@ -172,10 +172,13 @@ unsigned int oom_badness(struct task_struct *p, struct mem_cgroup *mem,
+
+ /*
+ * The baseline for the badness score is the proportion of RAM that each
+- * task's rss and swap space use.
++ * task's rss, pagetable and swap space use.
+ */
+- points = (get_mm_rss(p->mm) + get_mm_counter(p->mm, MM_SWAPENTS)) * 1000 /
+- totalpages;
++ points = get_mm_rss(p->mm) + p->mm->nr_ptes;
++ points += get_mm_counter(p->mm, MM_SWAPENTS);
++
++ points *= 1000;
++ points /= totalpages;
+ task_unlock(p);
+
+ /*
+diff --git a/scripts/kconfig/conf.c b/scripts/kconfig/conf.c
+index 659326c..006ad81 100644
+--- a/scripts/kconfig/conf.c
++++ b/scripts/kconfig/conf.c
+@@ -332,7 +332,7 @@ static int conf_choice(struct menu *menu)
+ }
+ if (!child)
+ continue;
+- if (line[strlen(line) - 1] == '?') {
++ if (line[0] && line[strlen(line) - 1] == '?') {
+ print_help(child);
+ continue;
+ }
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index da7cdca..8ff0223 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -14945,6 +14945,23 @@ static void alc269_fixup_hweq(struct hda_codec *codec,
+ alc_write_coef_idx(codec, 0x1e, coef | 0x80);
+ }
+
++static void alc271_fixup_dmic(struct hda_codec *codec,
++ const struct alc_fixup *fix, int action)
++{
++ static struct hda_verb verbs[] = {
++ {0x20, AC_VERB_SET_COEF_INDEX, 0x0d},
++ {0x20, AC_VERB_SET_PROC_COEF, 0x4000},
++ {}
++ };
++ unsigned int cfg;
++
++ if (strcmp(codec->chip_name, "ALC271X"))
++ return;
++ cfg = snd_hda_codec_get_pincfg(codec, 0x12);
++ if (get_defcfg_connect(cfg) == AC_JACK_PORT_FIXED)
++ snd_hda_sequence_write(codec, verbs);
++}
++
+ enum {
+ ALC269_FIXUP_SONY_VAIO,
+ ALC275_FIXUP_SONY_VAIO_GPIO2,
+@@ -14953,6 +14970,7 @@ enum {
+ ALC269_FIXUP_ASUS_G73JW,
+ ALC269_FIXUP_LENOVO_EAPD,
+ ALC275_FIXUP_SONY_HWEQ,
++ ALC271_FIXUP_DMIC,
+ };
+
+ static const struct alc_fixup alc269_fixups[] = {
+@@ -15006,7 +15024,11 @@ static const struct alc_fixup alc269_fixups[] = {
+ .v.func = alc269_fixup_hweq,
+ .chained = true,
+ .chain_id = ALC275_FIXUP_SONY_VAIO_GPIO2
+- }
++ },
++ [ALC271_FIXUP_DMIC] = {
++ .type = ALC_FIXUP_FUNC,
++ .v.func = alc271_fixup_dmic,
++ },
+ };
+
+ static struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -15015,6 +15037,7 @@ static struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x104d, 0x9084, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ),
+ SND_PCI_QUIRK_VENDOR(0x104d, "Sony VAIO", ALC269_FIXUP_SONY_VAIO),
+ SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z),
++ SND_PCI_QUIRK_VENDOR(0x1025, "Acer Aspire", ALC271_FIXUP_DMIC),
+ SND_PCI_QUIRK(0x17aa, 0x20f2, "Thinkpad SL410/510", ALC269_FIXUP_SKU_IGNORE),
+ SND_PCI_QUIRK(0x17aa, 0x215e, "Thinkpad L512", ALC269_FIXUP_SKU_IGNORE),
+ SND_PCI_QUIRK(0x17aa, 0x21b8, "Thinkpad Edge 14", ALC269_FIXUP_SKU_IGNORE),
+diff --git a/sound/soc/codecs/jz4740.c b/sound/soc/codecs/jz4740.c
+index f7cd346..f5ccdbf 100644
+--- a/sound/soc/codecs/jz4740.c
++++ b/sound/soc/codecs/jz4740.c
+@@ -308,8 +308,6 @@ static int jz4740_codec_dev_probe(struct snd_soc_codec *codec)
+ snd_soc_dapm_add_routes(dapm, jz4740_codec_dapm_routes,
+ ARRAY_SIZE(jz4740_codec_dapm_routes));
+
+- snd_soc_dapm_new_widgets(codec);
+-
+ jz4740_codec_set_bias_level(codec, SND_SOC_BIAS_STANDBY);
+
+ return 0;
+diff --git a/sound/soc/codecs/wm_hubs.c b/sound/soc/codecs/wm_hubs.c
+index 5168927..d365f43 100644
+--- a/sound/soc/codecs/wm_hubs.c
++++ b/sound/soc/codecs/wm_hubs.c
+@@ -739,12 +739,12 @@ static const struct snd_soc_dapm_route analogue_routes[] = {
+
+ { "SPKL", "Input Switch", "MIXINL" },
+ { "SPKL", "IN1LP Switch", "IN1LP" },
+- { "SPKL", "Output Switch", "Left Output Mixer" },
++ { "SPKL", "Output Switch", "Left Output PGA" },
+ { "SPKL", NULL, "TOCLK" },
+
+ { "SPKR", "Input Switch", "MIXINR" },
+ { "SPKR", "IN1RP Switch", "IN1RP" },
+- { "SPKR", "Output Switch", "Right Output Mixer" },
++ { "SPKR", "Output Switch", "Right Output PGA" },
+ { "SPKR", NULL, "TOCLK" },
+
+ { "SPKL Boost", "Direct Voice Switch", "Direct Voice" },
+@@ -766,8 +766,8 @@ static const struct snd_soc_dapm_route analogue_routes[] = {
+ { "SPKOUTRP", NULL, "SPKR Driver" },
+ { "SPKOUTRN", NULL, "SPKR Driver" },
+
+- { "Left Headphone Mux", "Mixer", "Left Output Mixer" },
+- { "Right Headphone Mux", "Mixer", "Right Output Mixer" },
++ { "Left Headphone Mux", "Mixer", "Left Output PGA" },
++ { "Right Headphone Mux", "Mixer", "Right Output PGA" },
+
+ { "Headphone PGA", NULL, "Left Headphone Mux" },
+ { "Headphone PGA", NULL, "Right Headphone Mux" },
Modified: dists/sid/linux-2.6/debian/patches/series/5
==============================================================================
--- dists/sid/linux-2.6/debian/patches/series/5 Mon May 2 19:06:10 2011 (r17284)
+++ dists/sid/linux-2.6/debian/patches/series/5 Mon May 2 20:31:54 2011 (r17285)
@@ -8,5 +8,6 @@
+ bugfix/m68k/0007-m68k-atari-ARAnyM-Add-support-for-network-access.patch
# from m68k subsystem maintainer's patch queue, probably in 2.6.40
+ bugfix/m68k/0008-m68k-atari-Reserve-some-ST-RAM-early-on-for-device-b.patch
-# from http://thread.gmane.org/gmane.linux.kernel.mm/61328/focus=2190
-+ bugfix/m68k/0009-m68k-mm-set-all-online-nodes-in-N_NORMAL_MEMORY.patch
+- bugfix/s390/S390-pfault-fix-token-handling.patch
+- bugfix/all/kconfig-Avoid-buffer-underrun-in-choice-input.patch
++ bugfix/all/stable/2.6.38.5.patch
More information about the Kernel-svn-changes
mailing list