/[linux-patches]/genpatches-2.6/tags/2.6.32-15/1008_linux-2.6.32.9.patch
Gentoo

Contents of /genpatches-2.6/tags/2.6.32-15/1008_linux-2.6.32.9.patch

Parent Directory Parent Directory | Revision Log Revision Log


Revision 1735 - (show annotations) (download)
Wed Aug 4 11:25:09 2010 UTC (4 years, 1 month ago) by mpagano
File size: 133035 byte(s)
2.6.32-15 release
1 diff --git a/arch/sh/include/asm/pgtable_32.h b/arch/sh/include/asm/pgtable_32.h
2 index c0d359c..ba64e7f 100644
3 --- a/arch/sh/include/asm/pgtable_32.h
4 +++ b/arch/sh/include/asm/pgtable_32.h
5 @@ -344,7 +344,8 @@ static inline void set_pte(pte_t *ptep, pte_t pte)
6 #define pte_special(pte) ((pte).pte_low & _PAGE_SPECIAL)
7
8 #ifdef CONFIG_X2TLB
9 -#define pte_write(pte) ((pte).pte_high & _PAGE_EXT_USER_WRITE)
10 +#define pte_write(pte) \
11 + ((pte).pte_high & (_PAGE_EXT_USER_WRITE | _PAGE_EXT_KERN_WRITE))
12 #else
13 #define pte_write(pte) ((pte).pte_low & _PAGE_RW)
14 #endif
15 @@ -358,7 +359,7 @@ static inline pte_t pte_##fn(pte_t pte) { pte.pte_##h op; return pte; }
16 * individually toggled (and user permissions are entirely decoupled from
17 * kernel permissions), we attempt to couple them a bit more sanely here.
18 */
19 -PTE_BIT_FUNC(high, wrprotect, &= ~_PAGE_EXT_USER_WRITE);
20 +PTE_BIT_FUNC(high, wrprotect, &= ~(_PAGE_EXT_USER_WRITE | _PAGE_EXT_KERN_WRITE));
21 PTE_BIT_FUNC(high, mkwrite, |= _PAGE_EXT_USER_WRITE | _PAGE_EXT_KERN_WRITE);
22 PTE_BIT_FUNC(high, mkhuge, |= _PAGE_SZHUGE);
23 #else
24 diff --git a/arch/x86/include/asm/amd_iommu.h b/arch/x86/include/asm/amd_iommu.h
25 index 4b18089..18aa3f8 100644
26 --- a/arch/x86/include/asm/amd_iommu.h
27 +++ b/arch/x86/include/asm/amd_iommu.h
28 @@ -32,6 +32,7 @@ extern void amd_iommu_flush_all_domains(void);
29 extern void amd_iommu_flush_all_devices(void);
30 extern void amd_iommu_shutdown(void);
31 extern void amd_iommu_apply_erratum_63(u16 devid);
32 +extern void amd_iommu_init_api(void);
33 #else
34 static inline int amd_iommu_init(void) { return -ENODEV; }
35 static inline void amd_iommu_detect(void) { }
36 diff --git a/arch/x86/kernel/amd_iommu.c b/arch/x86/kernel/amd_iommu.c
37 index e3f85fe..23fc9fe 100644
38 --- a/arch/x86/kernel/amd_iommu.c
39 +++ b/arch/x86/kernel/amd_iommu.c
40 @@ -1230,9 +1230,10 @@ static void __detach_device(struct protection_domain *domain, u16 devid)
41
42 /*
43 * If we run in passthrough mode the device must be assigned to the
44 - * passthrough domain if it is detached from any other domain
45 + * passthrough domain if it is detached from any other domain.
46 + * Make sure we can deassign from the pt_domain itself.
47 */
48 - if (iommu_pass_through) {
49 + if (iommu_pass_through && domain != pt_domain) {
50 struct amd_iommu *iommu = amd_iommu_rlookup_table[devid];
51 __attach_device(iommu, pt_domain, devid);
52 }
53 @@ -2083,6 +2084,11 @@ static struct dma_map_ops amd_iommu_dma_ops = {
54 .dma_supported = amd_iommu_dma_supported,
55 };
56
57 +void __init amd_iommu_init_api(void)
58 +{
59 + register_iommu(&amd_iommu_ops);
60 +}
61 +
62 /*
63 * The function which clues the AMD IOMMU driver into dma_ops.
64 */
65 @@ -2124,8 +2130,6 @@ int __init amd_iommu_init_dma_ops(void)
66 /* Make the driver finally visible to the drivers */
67 dma_ops = &amd_iommu_dma_ops;
68
69 - register_iommu(&amd_iommu_ops);
70 -
71 bus_register_notifier(&pci_bus_type, &device_nb);
72
73 amd_iommu_stats_init();
74 diff --git a/arch/x86/kernel/amd_iommu_init.c b/arch/x86/kernel/amd_iommu_init.c
75 index c8243f0..362ab88 100644
76 --- a/arch/x86/kernel/amd_iommu_init.c
77 +++ b/arch/x86/kernel/amd_iommu_init.c
78 @@ -1288,9 +1288,12 @@ int __init amd_iommu_init(void)
79 ret = amd_iommu_init_passthrough();
80 else
81 ret = amd_iommu_init_dma_ops();
82 +
83 if (ret)
84 goto free;
85
86 + amd_iommu_init_api();
87 +
88 enable_iommus();
89
90 if (iommu_pass_through)
91 diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
92 index dc69f28..c107e83 100644
93 --- a/arch/x86/kernel/apic/io_apic.c
94 +++ b/arch/x86/kernel/apic/io_apic.c
95 @@ -3157,6 +3157,7 @@ unsigned int create_irq_nr(unsigned int irq_want, int node)
96 continue;
97
98 desc_new = move_irq_desc(desc_new, node);
99 + cfg_new = desc_new->chip_data;
100
101 if (__assign_irq_vector(new, cfg_new, apic->target_cpus()) == 0)
102 irq = new;
103 diff --git a/arch/x86/kernel/cpu/cpufreq/powernow-k8.c b/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
104 index 3f12dab..ab1cd30 100644
105 --- a/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
106 +++ b/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
107 @@ -1351,6 +1351,7 @@ static int __devexit powernowk8_cpu_exit(struct cpufreq_policy *pol)
108
109 kfree(data->powernow_table);
110 kfree(data);
111 + per_cpu(powernow_data, pol->cpu) = NULL;
112
113 return 0;
114 }
115 @@ -1370,7 +1371,7 @@ static unsigned int powernowk8_get(unsigned int cpu)
116 int err;
117
118 if (!data)
119 - return -EINVAL;
120 + return 0;
121
122 smp_call_function_single(cpu, query_values_on_cpu, &err, true);
123 if (err)
124 diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c
125 index 144e7f6..88ad162 100644
126 --- a/arch/x86/kvm/i8254.c
127 +++ b/arch/x86/kvm/i8254.c
128 @@ -465,6 +465,9 @@ static int pit_ioport_read(struct kvm_io_device *this,
129 return -EOPNOTSUPP;
130
131 addr &= KVM_PIT_CHANNEL_MASK;
132 + if (addr == 3)
133 + return 0;
134 +
135 s = &pit_state->channels[addr];
136
137 mutex_lock(&pit_state->lock);
138 diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
139 index 145741c..e78d990 100644
140 --- a/arch/x86/kvm/x86.c
141 +++ b/arch/x86/kvm/x86.c
142 @@ -583,7 +583,7 @@ static void kvm_write_wall_clock(struct kvm *kvm, gpa_t wall_clock)
143 {
144 static int version;
145 struct pvclock_wall_clock wc;
146 - struct timespec now, sys, boot;
147 + struct timespec boot;
148
149 if (!wall_clock)
150 return;
151 @@ -598,9 +598,7 @@ static void kvm_write_wall_clock(struct kvm *kvm, gpa_t wall_clock)
152 * wall clock specified here. guest system time equals host
153 * system time for us, thus we must fill in host boot time here.
154 */
155 - now = current_kernel_time();
156 - ktime_get_ts(&sys);
157 - boot = ns_to_timespec(timespec_to_ns(&now) - timespec_to_ns(&sys));
158 + getboottime(&boot);
159
160 wc.sec = boot.tv_sec;
161 wc.nsec = boot.tv_nsec;
162 @@ -675,6 +673,7 @@ static void kvm_write_guest_time(struct kvm_vcpu *v)
163 local_irq_save(flags);
164 kvm_get_msr(v, MSR_IA32_TSC, &vcpu->hv_clock.tsc_timestamp);
165 ktime_get_ts(&ts);
166 + monotonic_to_bootbased(&ts);
167 local_irq_restore(flags);
168
169 /* With all the info we got, fill in the values */
170 diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
171 index a8f3ca6..d9f78f6 100644
172 --- a/drivers/acpi/processor_idle.c
173 +++ b/drivers/acpi/processor_idle.c
174 @@ -110,6 +110,14 @@ static struct dmi_system_id __cpuinitdata processor_power_dmi_table[] = {
175 DMI_MATCH(DMI_BIOS_VENDOR,"Phoenix Technologies LTD"),
176 DMI_MATCH(DMI_BIOS_VERSION,"SHE845M0.86C.0013.D.0302131307")},
177 (void *)2},
178 + { set_max_cstate, "Pavilion zv5000", {
179 + DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
180 + DMI_MATCH(DMI_PRODUCT_NAME,"Pavilion zv5000 (DS502A#ABA)")},
181 + (void *)1},
182 + { set_max_cstate, "Asus L8400B", {
183 + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer Inc."),
184 + DMI_MATCH(DMI_PRODUCT_NAME,"L8400B series Notebook PC")},
185 + (void *)1},
186 {},
187 };
188
189 diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
190 index 14a7481..0b09703 100644
191 --- a/drivers/acpi/scan.c
192 +++ b/drivers/acpi/scan.c
193 @@ -1357,6 +1357,9 @@ int acpi_bus_start(struct acpi_device *device)
194 {
195 struct acpi_bus_ops ops;
196
197 + if (!device)
198 + return -EINVAL;
199 +
200 memset(&ops, 0, sizeof(ops));
201 ops.acpi_op_start = 1;
202
203 diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
204 index 9519c77..9b37502 100644
205 --- a/drivers/ata/ahci.c
206 +++ b/drivers/ata/ahci.c
207 @@ -2868,6 +2868,21 @@ static bool ahci_broken_suspend(struct pci_dev *pdev)
208 },
209 .driver_data = "F.23", /* cutoff BIOS version */
210 },
211 + /*
212 + * Acer eMachines G725 has the same problem. BIOS
213 + * V1.03 is known to be broken. V3.04 is known to
214 + * work. Inbetween, there are V1.06, V2.06 and V3.03
215 + * that we don't have much idea about. For now,
216 + * blacklist anything older than V3.04.
217 + */
218 + {
219 + .ident = "G725",
220 + .matches = {
221 + DMI_MATCH(DMI_SYS_VENDOR, "eMachines"),
222 + DMI_MATCH(DMI_PRODUCT_NAME, "eMachines G725"),
223 + },
224 + .driver_data = "V3.04", /* cutoff BIOS version */
225 + },
226 { } /* terminate list */
227 };
228 const struct dmi_system_id *dmi = dmi_first_match(sysids);
229 diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
230 index bbbb1fa..2ae15c3 100644
231 --- a/drivers/ata/libata-sff.c
232 +++ b/drivers/ata/libata-sff.c
233 @@ -893,6 +893,9 @@ static void ata_pio_sector(struct ata_queued_cmd *qc)
234 do_write);
235 }
236
237 + if (!do_write)
238 + flush_dcache_page(page);
239 +
240 qc->curbytes += qc->sect_size;
241 qc->cursg_ofs += qc->sect_size;
242
243 diff --git a/drivers/base/class.c b/drivers/base/class.c
244 index 161746d..6e2c3b0 100644
245 --- a/drivers/base/class.c
246 +++ b/drivers/base/class.c
247 @@ -59,6 +59,8 @@ static void class_release(struct kobject *kobj)
248 else
249 pr_debug("class '%s' does not have a release() function, "
250 "be careful\n", class->name);
251 +
252 + kfree(cp);
253 }
254
255 static struct sysfs_ops class_sysfs_ops = {
256 diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
257 index 92b1263..ca9c548 100644
258 --- a/drivers/block/cciss.c
259 +++ b/drivers/block/cciss.c
260 @@ -339,6 +339,9 @@ static int cciss_seq_show(struct seq_file *seq, void *v)
261 if (*pos > h->highest_lun)
262 return 0;
263
264 + if (drv == NULL) /* it's possible for h->drv[] to have holes. */
265 + return 0;
266 +
267 if (drv->heads == 0)
268 return 0;
269
270 diff --git a/drivers/char/mem.c b/drivers/char/mem.c
271 index a074fce..aef3fb4 100644
272 --- a/drivers/char/mem.c
273 +++ b/drivers/char/mem.c
274 @@ -35,6 +35,19 @@
275 # include <linux/efi.h>
276 #endif
277
278 +static inline unsigned long size_inside_page(unsigned long start,
279 + unsigned long size)
280 +{
281 + unsigned long sz;
282 +
283 + if (-start & (PAGE_SIZE - 1))
284 + sz = -start & (PAGE_SIZE - 1);
285 + else
286 + sz = PAGE_SIZE;
287 +
288 + return min_t(unsigned long, sz, size);
289 +}
290 +
291 /*
292 * Architectures vary in how they handle caching for addresses
293 * outside of main memory.
294 @@ -408,6 +421,7 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
295 unsigned long p = *ppos;
296 ssize_t low_count, read, sz;
297 char * kbuf; /* k-addr because vread() takes vmlist_lock rwlock */
298 + int err = 0;
299
300 read = 0;
301 if (p < (unsigned long) high_memory) {
302 @@ -430,15 +444,7 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
303 }
304 #endif
305 while (low_count > 0) {
306 - /*
307 - * Handle first page in case it's not aligned
308 - */
309 - if (-p & (PAGE_SIZE - 1))
310 - sz = -p & (PAGE_SIZE - 1);
311 - else
312 - sz = PAGE_SIZE;
313 -
314 - sz = min_t(unsigned long, sz, low_count);
315 + sz = size_inside_page(p, low_count);
316
317 /*
318 * On ia64 if a page has been mapped somewhere as
319 @@ -462,16 +468,18 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
320 if (!kbuf)
321 return -ENOMEM;
322 while (count > 0) {
323 - int len = count;
324 + int len = size_inside_page(p, count);
325
326 - if (len > PAGE_SIZE)
327 - len = PAGE_SIZE;
328 + if (!is_vmalloc_or_module_addr((void *)p)) {
329 + err = -ENXIO;
330 + break;
331 + }
332 len = vread(kbuf, (char *)p, len);
333 if (!len)
334 break;
335 if (copy_to_user(buf, kbuf, len)) {
336 - free_page((unsigned long)kbuf);
337 - return -EFAULT;
338 + err = -EFAULT;
339 + break;
340 }
341 count -= len;
342 buf += len;
343 @@ -480,8 +488,8 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
344 }
345 free_page((unsigned long)kbuf);
346 }
347 - *ppos = p;
348 - return read;
349 + *ppos = p;
350 + return read ? read : err;
351 }
352
353
354 @@ -510,15 +518,8 @@ do_write_kmem(void *p, unsigned long realp, const char __user * buf,
355
356 while (count > 0) {
357 char *ptr;
358 - /*
359 - * Handle first page in case it's not aligned
360 - */
361 - if (-realp & (PAGE_SIZE - 1))
362 - sz = -realp & (PAGE_SIZE - 1);
363 - else
364 - sz = PAGE_SIZE;
365
366 - sz = min_t(unsigned long, sz, count);
367 + sz = size_inside_page(realp, count);
368
369 /*
370 * On ia64 if a page has been mapped somewhere as
371 @@ -557,6 +558,7 @@ static ssize_t write_kmem(struct file * file, const char __user * buf,
372 ssize_t virtr = 0;
373 ssize_t written;
374 char * kbuf; /* k-addr because vwrite() takes vmlist_lock rwlock */
375 + int err = 0;
376
377 if (p < (unsigned long) high_memory) {
378
379 @@ -578,20 +580,20 @@ static ssize_t write_kmem(struct file * file, const char __user * buf,
380 if (!kbuf)
381 return wrote ? wrote : -ENOMEM;
382 while (count > 0) {
383 - int len = count;
384 + int len = size_inside_page(p, count);
385
386 - if (len > PAGE_SIZE)
387 - len = PAGE_SIZE;
388 + if (!is_vmalloc_or_module_addr((void *)p)) {
389 + err = -ENXIO;
390 + break;
391 + }
392 if (len) {
393 written = copy_from_user(kbuf, buf, len);
394 if (written) {
395 - if (wrote + virtr)
396 - break;
397 - free_page((unsigned long)kbuf);
398 - return -EFAULT;
399 + err = -EFAULT;
400 + break;
401 }
402 }
403 - len = vwrite(kbuf, (char *)p, len);
404 + vwrite(kbuf, (char *)p, len);
405 count -= len;
406 buf += len;
407 virtr += len;
408 @@ -600,8 +602,8 @@ static ssize_t write_kmem(struct file * file, const char __user * buf,
409 free_page((unsigned long)kbuf);
410 }
411
412 - *ppos = p;
413 - return virtr + wrote;
414 + *ppos = p;
415 + return virtr + wrote ? : err;
416 }
417 #endif
418
419 diff --git a/drivers/char/tpm/tpm_infineon.c b/drivers/char/tpm/tpm_infineon.c
420 index ecba494..f584407 100644
421 --- a/drivers/char/tpm/tpm_infineon.c
422 +++ b/drivers/char/tpm/tpm_infineon.c
423 @@ -39,12 +39,12 @@
424 struct tpm_inf_dev {
425 int iotype;
426
427 - void __iomem *mem_base; /* MMIO ioremap'd addr */
428 - unsigned long map_base; /* phys MMIO base */
429 - unsigned long map_size; /* MMIO region size */
430 - unsigned int index_off; /* index register offset */
431 + void __iomem *mem_base; /* MMIO ioremap'd addr */
432 + unsigned long map_base; /* phys MMIO base */
433 + unsigned long map_size; /* MMIO region size */
434 + unsigned int index_off; /* index register offset */
435
436 - unsigned int data_regs; /* Data registers */
437 + unsigned int data_regs; /* Data registers */
438 unsigned int data_size;
439
440 unsigned int config_port; /* IO Port config index reg */
441 @@ -406,14 +406,14 @@ static const struct tpm_vendor_specific tpm_inf = {
442 .miscdev = {.fops = &inf_ops,},
443 };
444
445 -static const struct pnp_device_id tpm_pnp_tbl[] = {
446 +static const struct pnp_device_id tpm_inf_pnp_tbl[] = {
447 /* Infineon TPMs */
448 {"IFX0101", 0},
449 {"IFX0102", 0},
450 {"", 0}
451 };
452
453 -MODULE_DEVICE_TABLE(pnp, tpm_pnp_tbl);
454 +MODULE_DEVICE_TABLE(pnp, tpm_inf_pnp_tbl);
455
456 static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
457 const struct pnp_device_id *dev_id)
458 @@ -430,7 +430,7 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
459 if (pnp_port_valid(dev, 0) && pnp_port_valid(dev, 1) &&
460 !(pnp_port_flags(dev, 0) & IORESOURCE_DISABLED)) {
461
462 - tpm_dev.iotype = TPM_INF_IO_PORT;
463 + tpm_dev.iotype = TPM_INF_IO_PORT;
464
465 tpm_dev.config_port = pnp_port_start(dev, 0);
466 tpm_dev.config_size = pnp_port_len(dev, 0);
467 @@ -459,9 +459,9 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
468 goto err_last;
469 }
470 } else if (pnp_mem_valid(dev, 0) &&
471 - !(pnp_mem_flags(dev, 0) & IORESOURCE_DISABLED)) {
472 + !(pnp_mem_flags(dev, 0) & IORESOURCE_DISABLED)) {
473
474 - tpm_dev.iotype = TPM_INF_IO_MEM;
475 + tpm_dev.iotype = TPM_INF_IO_MEM;
476
477 tpm_dev.map_base = pnp_mem_start(dev, 0);
478 tpm_dev.map_size = pnp_mem_len(dev, 0);
479 @@ -563,11 +563,11 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
480 "product id 0x%02x%02x"
481 "%s\n",
482 tpm_dev.iotype == TPM_INF_IO_PORT ?
483 - tpm_dev.config_port :
484 - tpm_dev.map_base + tpm_dev.index_off,
485 + tpm_dev.config_port :
486 + tpm_dev.map_base + tpm_dev.index_off,
487 tpm_dev.iotype == TPM_INF_IO_PORT ?
488 - tpm_dev.data_regs :
489 - tpm_dev.map_base + tpm_dev.data_regs,
490 + tpm_dev.data_regs :
491 + tpm_dev.map_base + tpm_dev.data_regs,
492 version[0], version[1],
493 vendorid[0], vendorid[1],
494 productid[0], productid[1], chipname);
495 @@ -607,20 +607,55 @@ static __devexit void tpm_inf_pnp_remove(struct pnp_dev *dev)
496 iounmap(tpm_dev.mem_base);
497 release_mem_region(tpm_dev.map_base, tpm_dev.map_size);
498 }
499 + tpm_dev_vendor_release(chip);
500 tpm_remove_hardware(chip->dev);
501 }
502 }
503
504 +static int tpm_inf_pnp_suspend(struct pnp_dev *dev, pm_message_t pm_state)
505 +{
506 + struct tpm_chip *chip = pnp_get_drvdata(dev);
507 + int rc;
508 + if (chip) {
509 + u8 savestate[] = {
510 + 0, 193, /* TPM_TAG_RQU_COMMAND */
511 + 0, 0, 0, 10, /* blob length (in bytes) */
512 + 0, 0, 0, 152 /* TPM_ORD_SaveState */
513 + };
514 + dev_info(&dev->dev, "saving TPM state\n");
515 + rc = tpm_inf_send(chip, savestate, sizeof(savestate));
516 + if (rc < 0) {
517 + dev_err(&dev->dev, "error while saving TPM state\n");
518 + return rc;
519 + }
520 + }
521 + return 0;
522 +}
523 +
524 +static int tpm_inf_pnp_resume(struct pnp_dev *dev)
525 +{
526 + /* Re-configure TPM after suspending */
527 + tpm_config_out(ENABLE_REGISTER_PAIR, TPM_INF_ADDR);
528 + tpm_config_out(IOLIMH, TPM_INF_ADDR);
529 + tpm_config_out((tpm_dev.data_regs >> 8) & 0xff, TPM_INF_DATA);
530 + tpm_config_out(IOLIML, TPM_INF_ADDR);
531 + tpm_config_out((tpm_dev.data_regs & 0xff), TPM_INF_DATA);
532 + /* activate register */
533 + tpm_config_out(TPM_DAR, TPM_INF_ADDR);
534 + tpm_config_out(0x01, TPM_INF_DATA);
535 + tpm_config_out(DISABLE_REGISTER_PAIR, TPM_INF_ADDR);
536 + /* disable RESET, LP and IRQC */
537 + tpm_data_out(RESET_LP_IRQC_DISABLE, CMD);
538 + return tpm_pm_resume(&dev->dev);
539 +}
540 +
541 static struct pnp_driver tpm_inf_pnp_driver = {
542 .name = "tpm_inf_pnp",
543 - .driver = {
544 - .owner = THIS_MODULE,
545 - .suspend = tpm_pm_suspend,
546 - .resume = tpm_pm_resume,
547 - },
548 - .id_table = tpm_pnp_tbl,
549 + .id_table = tpm_inf_pnp_tbl,
550 .probe = tpm_inf_pnp_probe,
551 - .remove = __devexit_p(tpm_inf_pnp_remove),
552 + .suspend = tpm_inf_pnp_suspend,
553 + .resume = tpm_inf_pnp_resume,
554 + .remove = __devexit_p(tpm_inf_pnp_remove)
555 };
556
557 static int __init init_inf(void)
558 @@ -638,5 +673,5 @@ module_exit(cleanup_inf);
559
560 MODULE_AUTHOR("Marcel Selhorst <m.selhorst@sirrix.com>");
561 MODULE_DESCRIPTION("Driver for Infineon TPM SLD 9630 TT 1.1 / SLB 9635 TT 1.2");
562 -MODULE_VERSION("1.9");
563 +MODULE_VERSION("1.9.2");
564 MODULE_LICENSE("GPL");
565 diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
566 index e919bd9..05cab2c 100644
567 --- a/drivers/char/tty_io.c
568 +++ b/drivers/char/tty_io.c
569 @@ -1930,8 +1930,10 @@ static int tty_fasync(int fd, struct file *filp, int on)
570 pid = task_pid(current);
571 type = PIDTYPE_PID;
572 }
573 - retval = __f_setown(filp, pid, type, 0);
574 + get_pid(pid);
575 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
576 + retval = __f_setown(filp, pid, type, 0);
577 + put_pid(pid);
578 if (retval)
579 goto out;
580 } else {
581 diff --git a/drivers/crypto/padlock-sha.c b/drivers/crypto/padlock-sha.c
582 index 0af8057..d3a27e0 100644
583 --- a/drivers/crypto/padlock-sha.c
584 +++ b/drivers/crypto/padlock-sha.c
585 @@ -57,6 +57,23 @@ static int padlock_sha_update(struct shash_desc *desc,
586 return crypto_shash_update(&dctx->fallback, data, length);
587 }
588
589 +static int padlock_sha_export(struct shash_desc *desc, void *out)
590 +{
591 + struct padlock_sha_desc *dctx = shash_desc_ctx(desc);
592 +
593 + return crypto_shash_export(&dctx->fallback, out);
594 +}
595 +
596 +static int padlock_sha_import(struct shash_desc *desc, const void *in)
597 +{
598 + struct padlock_sha_desc *dctx = shash_desc_ctx(desc);
599 + struct padlock_sha_ctx *ctx = crypto_shash_ctx(desc->tfm);
600 +
601 + dctx->fallback.tfm = ctx->fallback;
602 + dctx->fallback.flags = desc->flags & CRYPTO_TFM_REQ_MAY_SLEEP;
603 + return crypto_shash_import(&dctx->fallback, in);
604 +}
605 +
606 static inline void padlock_output_block(uint32_t *src,
607 uint32_t *dst, size_t count)
608 {
609 @@ -235,7 +252,10 @@ static struct shash_alg sha1_alg = {
610 .update = padlock_sha_update,
611 .finup = padlock_sha1_finup,
612 .final = padlock_sha1_final,
613 + .export = padlock_sha_export,
614 + .import = padlock_sha_import,
615 .descsize = sizeof(struct padlock_sha_desc),
616 + .statesize = sizeof(struct sha1_state),
617 .base = {
618 .cra_name = "sha1",
619 .cra_driver_name = "sha1-padlock",
620 @@ -256,7 +276,10 @@ static struct shash_alg sha256_alg = {
621 .update = padlock_sha_update,
622 .finup = padlock_sha256_finup,
623 .final = padlock_sha256_final,
624 + .export = padlock_sha_export,
625 + .import = padlock_sha_import,
626 .descsize = sizeof(struct padlock_sha_desc),
627 + .statesize = sizeof(struct sha256_state),
628 .base = {
629 .cra_name = "sha256",
630 .cra_driver_name = "sha256-padlock",
631 diff --git a/drivers/dma/ioat/dma_v2.c b/drivers/dma/ioat/dma_v2.c
632 index 5f7a500..5cc37af 100644
633 --- a/drivers/dma/ioat/dma_v2.c
634 +++ b/drivers/dma/ioat/dma_v2.c
635 @@ -249,7 +249,7 @@ int ioat2_quiesce(struct ioat_chan_common *chan, unsigned long tmo)
636 if (is_ioat_active(status) || is_ioat_idle(status))
637 ioat_suspend(chan);
638 while (is_ioat_active(status) || is_ioat_idle(status)) {
639 - if (end && time_after(jiffies, end)) {
640 + if (tmo && time_after(jiffies, end)) {
641 err = -ETIMEDOUT;
642 break;
643 }
644 diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
645 index a0bcfba..01bc8e2 100644
646 --- a/drivers/edac/amd64_edac.c
647 +++ b/drivers/edac/amd64_edac.c
648 @@ -2801,10 +2801,11 @@ static void amd64_restore_ecc_error_reporting(struct amd64_pvt *pvt)
649 * the memory system completely. A command line option allows to force-enable
650 * hardware ECC later in amd64_enable_ecc_error_reporting().
651 */
652 -static const char *ecc_warning =
653 - "WARNING: ECC is disabled by BIOS. Module will NOT be loaded.\n"
654 - " Either Enable ECC in the BIOS, or set 'ecc_enable_override'.\n"
655 - " Also, use of the override can cause unknown side effects.\n";
656 +static const char *ecc_msg =
657 + "ECC disabled in the BIOS or no ECC capability, module will not load.\n"
658 + " Either enable ECC checking or force module loading by setting "
659 + "'ecc_enable_override'.\n"
660 + " (Note that use of the override may cause unknown side effects.)\n";
661
662 static int amd64_check_ecc_enabled(struct amd64_pvt *pvt)
663 {
664 @@ -2819,7 +2820,7 @@ static int amd64_check_ecc_enabled(struct amd64_pvt *pvt)
665
666 ecc_enabled = !!(value & K8_NBCFG_ECC_ENABLE);
667 if (!ecc_enabled)
668 - amd64_printk(KERN_WARNING, "This node reports that Memory ECC "
669 + amd64_printk(KERN_NOTICE, "This node reports that Memory ECC "
670 "is currently disabled, set F3x%x[22] (%s).\n",
671 K8_NBCFG, pci_name(pvt->misc_f3_ctl));
672 else
673 @@ -2827,13 +2828,13 @@ static int amd64_check_ecc_enabled(struct amd64_pvt *pvt)
674
675 nb_mce_en = amd64_nb_mce_bank_enabled_on_node(pvt->mc_node_id);
676 if (!nb_mce_en)
677 - amd64_printk(KERN_WARNING, "NB MCE bank disabled, set MSR "
678 + amd64_printk(KERN_NOTICE, "NB MCE bank disabled, set MSR "
679 "0x%08x[4] on node %d to enable.\n",
680 MSR_IA32_MCG_CTL, pvt->mc_node_id);
681
682 if (!ecc_enabled || !nb_mce_en) {
683 if (!ecc_enable_override) {
684 - amd64_printk(KERN_WARNING, "%s", ecc_warning);
685 + amd64_printk(KERN_NOTICE, "%s", ecc_msg);
686 return -ENODEV;
687 }
688 ecc_enable_override = 0;
689 diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
690 index af655e8..7e859d6 100644
691 --- a/drivers/gpu/drm/i915/i915_debugfs.c
692 +++ b/drivers/gpu/drm/i915/i915_debugfs.c
693 @@ -384,37 +384,7 @@ out:
694 return 0;
695 }
696
697 -static int i915_registers_info(struct seq_file *m, void *data) {
698 - struct drm_info_node *node = (struct drm_info_node *) m->private;
699 - struct drm_device *dev = node->minor->dev;
700 - drm_i915_private_t *dev_priv = dev->dev_private;
701 - uint32_t reg;
702 -
703 -#define DUMP_RANGE(start, end) \
704 - for (reg=start; reg < end; reg += 4) \
705 - seq_printf(m, "%08x\t%08x\n", reg, I915_READ(reg));
706 -
707 - DUMP_RANGE(0x00000, 0x00fff); /* VGA registers */
708 - DUMP_RANGE(0x02000, 0x02fff); /* instruction, memory, interrupt control registers */
709 - DUMP_RANGE(0x03000, 0x031ff); /* FENCE and PPGTT control registers */
710 - DUMP_RANGE(0x03200, 0x03fff); /* frame buffer compression registers */
711 - DUMP_RANGE(0x05000, 0x05fff); /* I/O control registers */
712 - DUMP_RANGE(0x06000, 0x06fff); /* clock control registers */
713 - DUMP_RANGE(0x07000, 0x07fff); /* 3D internal debug registers */
714 - DUMP_RANGE(0x07400, 0x088ff); /* GPE debug registers */
715 - DUMP_RANGE(0x0a000, 0x0afff); /* display palette registers */
716 - DUMP_RANGE(0x10000, 0x13fff); /* MMIO MCHBAR */
717 - DUMP_RANGE(0x30000, 0x3ffff); /* overlay registers */
718 - DUMP_RANGE(0x60000, 0x6ffff); /* display engine pipeline registers */
719 - DUMP_RANGE(0x70000, 0x72fff); /* display and cursor registers */
720 - DUMP_RANGE(0x73000, 0x73fff); /* performance counters */
721 -
722 - return 0;
723 -}
724 -
725 -
726 static struct drm_info_list i915_debugfs_list[] = {
727 - {"i915_regs", i915_registers_info, 0},
728 {"i915_gem_active", i915_gem_object_list_info, 0, (void *) ACTIVE_LIST},
729 {"i915_gem_flushing", i915_gem_object_list_info, 0, (void *) FLUSHING_LIST},
730 {"i915_gem_inactive", i915_gem_object_list_info, 0, (void *) INACTIVE_LIST},
731 diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
732 index 7277246..f5d49a7 100644
733 --- a/drivers/gpu/drm/i915/i915_drv.h
734 +++ b/drivers/gpu/drm/i915/i915_drv.h
735 @@ -467,6 +467,15 @@ typedef struct drm_i915_private {
736 struct list_head flushing_list;
737
738 /**
739 + * List of objects currently pending a GPU write flush.
740 + *
741 + * All elements on this list will belong to either the
742 + * active_list or flushing_list, last_rendering_seqno can
743 + * be used to differentiate between the two elements.
744 + */
745 + struct list_head gpu_write_list;
746 +
747 + /**
748 * LRU list of objects which are not in the ringbuffer and
749 * are ready to unbind, but are still in the GTT.
750 *
751 @@ -558,6 +567,8 @@ struct drm_i915_gem_object {
752
753 /** This object's place on the active/flushing/inactive lists */
754 struct list_head list;
755 + /** This object's place on GPU write list */
756 + struct list_head gpu_write_list;
757
758 /** This object's place on the fenced object LRU */
759 struct list_head fence_list;
760 @@ -814,9 +825,11 @@ void i915_gem_cleanup_ringbuffer(struct drm_device *dev);
761 int i915_gem_do_init(struct drm_device *dev, unsigned long start,
762 unsigned long end);
763 int i915_gem_idle(struct drm_device *dev);
764 +int i915_lp_ring_sync(struct drm_device *dev);
765 int i915_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf);
766 int i915_gem_object_set_to_gtt_domain(struct drm_gem_object *obj,
767 int write);
768 +int i915_gem_object_set_to_display_plane(struct drm_gem_object *obj);
769 int i915_gem_attach_phys_object(struct drm_device *dev,
770 struct drm_gem_object *obj, int id);
771 void i915_gem_detach_phys_object(struct drm_device *dev,
772 diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
773 index 8ad244a..04da731 100644
774 --- a/drivers/gpu/drm/i915/i915_gem.c
775 +++ b/drivers/gpu/drm/i915/i915_gem.c
776 @@ -1552,6 +1552,8 @@ i915_gem_object_move_to_inactive(struct drm_gem_object *obj)
777 else
778 list_move_tail(&obj_priv->list, &dev_priv->mm.inactive_list);
779
780 + BUG_ON(!list_empty(&obj_priv->gpu_write_list));
781 +
782 obj_priv->last_rendering_seqno = 0;
783 if (obj_priv->active) {
784 obj_priv->active = 0;
785 @@ -1622,7 +1624,8 @@ i915_add_request(struct drm_device *dev, struct drm_file *file_priv,
786 struct drm_i915_gem_object *obj_priv, *next;
787
788 list_for_each_entry_safe(obj_priv, next,
789 - &dev_priv->mm.flushing_list, list) {
790 + &dev_priv->mm.gpu_write_list,
791 + gpu_write_list) {
792 struct drm_gem_object *obj = obj_priv->obj;
793
794 if ((obj->write_domain & flush_domains) ==
795 @@ -1630,6 +1633,7 @@ i915_add_request(struct drm_device *dev, struct drm_file *file_priv,
796 uint32_t old_write_domain = obj->write_domain;
797
798 obj->write_domain = 0;
799 + list_del_init(&obj_priv->gpu_write_list);
800 i915_gem_object_move_to_active(obj, seqno);
801
802 trace_i915_gem_object_change_domain(obj,
803 @@ -1805,12 +1809,8 @@ i915_gem_retire_work_handler(struct work_struct *work)
804 mutex_unlock(&dev->struct_mutex);
805 }
806
807 -/**
808 - * Waits for a sequence number to be signaled, and cleans up the
809 - * request and object lists appropriately for that event.
810 - */
811 static int
812 -i915_wait_request(struct drm_device *dev, uint32_t seqno)
813 +i915_do_wait_request(struct drm_device *dev, uint32_t seqno, int interruptible)
814 {
815 drm_i915_private_t *dev_priv = dev->dev_private;
816 u32 ier;
817 @@ -1837,10 +1837,15 @@ i915_wait_request(struct drm_device *dev, uint32_t seqno)
818
819 dev_priv->mm.waiting_gem_seqno = seqno;
820 i915_user_irq_get(dev);
821 - ret = wait_event_interruptible(dev_priv->irq_queue,
822 - i915_seqno_passed(i915_get_gem_seqno(dev),
823 - seqno) ||
824 - atomic_read(&dev_priv->mm.wedged));
825 + if (interruptible)
826 + ret = wait_event_interruptible(dev_priv->irq_queue,
827 + i915_seqno_passed(i915_get_gem_seqno(dev), seqno) ||
828 + atomic_read(&dev_priv->mm.wedged));
829 + else
830 + wait_event(dev_priv->irq_queue,
831 + i915_seqno_passed(i915_get_gem_seqno(dev), seqno) ||
832 + atomic_read(&dev_priv->mm.wedged));
833 +
834 i915_user_irq_put(dev);
835 dev_priv->mm.waiting_gem_seqno = 0;
836
837 @@ -1864,6 +1869,34 @@ i915_wait_request(struct drm_device *dev, uint32_t seqno)
838 return ret;
839 }
840
841 +/**
842 + * Waits for a sequence number to be signaled, and cleans up the
843 + * request and object lists appropriately for that event.
844 + */
845 +static int
846 +i915_wait_request(struct drm_device *dev, uint32_t seqno)
847 +{
848 + return i915_do_wait_request(dev, seqno, 1);
849 +}
850 +
851 +/**
852 + * Waits for the ring to finish up to the latest request. Usefull for waiting
853 + * for flip events, e.g for the overlay support. */
854 +int i915_lp_ring_sync(struct drm_device *dev)
855 +{
856 + uint32_t seqno;
857 + int ret;
858 +
859 + seqno = i915_add_request(dev, NULL, 0);
860 +
861 + if (seqno == 0)
862 + return -ENOMEM;
863 +
864 + ret = i915_do_wait_request(dev, seqno, 0);
865 + BUG_ON(ret == -ERESTARTSYS);
866 + return ret;
867 +}
868 +
869 static void
870 i915_gem_flush(struct drm_device *dev,
871 uint32_t invalidate_domains,
872 @@ -1932,7 +1965,7 @@ i915_gem_flush(struct drm_device *dev,
873 #endif
874 BEGIN_LP_RING(2);
875 OUT_RING(cmd);
876 - OUT_RING(0); /* noop */
877 + OUT_RING(MI_NOOP);
878 ADVANCE_LP_RING();
879 }
880 }
881 @@ -2073,8 +2106,8 @@ static int
882 i915_gem_evict_everything(struct drm_device *dev)
883 {
884 drm_i915_private_t *dev_priv = dev->dev_private;
885 - uint32_t seqno;
886 int ret;
887 + uint32_t seqno;
888 bool lists_empty;
889
890 spin_lock(&dev_priv->mm.active_list_lock);
891 @@ -2096,6 +2129,8 @@ i915_gem_evict_everything(struct drm_device *dev)
892 if (ret)
893 return ret;
894
895 + BUG_ON(!list_empty(&dev_priv->mm.flushing_list));
896 +
897 ret = i915_gem_evict_from_inactive_list(dev);
898 if (ret)
899 return ret;
900 @@ -2690,7 +2725,7 @@ i915_gem_object_flush_gpu_write_domain(struct drm_gem_object *obj)
901 old_write_domain = obj->write_domain;
902 i915_gem_flush(dev, 0, obj->write_domain);
903 seqno = i915_add_request(dev, NULL, obj->write_domain);
904 - obj->write_domain = 0;
905 + BUG_ON(obj->write_domain);
906 i915_gem_object_move_to_active(obj, seqno);
907
908 trace_i915_gem_object_change_domain(obj,
909 @@ -2790,6 +2825,57 @@ i915_gem_object_set_to_gtt_domain(struct drm_gem_object *obj, int write)
910 return 0;
911 }
912
913 +/*
914 + * Prepare buffer for display plane. Use uninterruptible for possible flush
915 + * wait, as in modesetting process we're not supposed to be interrupted.
916 + */
917 +int
918 +i915_gem_object_set_to_display_plane(struct drm_gem_object *obj)
919 +{
920 + struct drm_device *dev = obj->dev;
921 + struct drm_i915_gem_object *obj_priv = obj->driver_private;
922 + uint32_t old_write_domain, old_read_domains;
923 + int ret;
924 +
925 + /* Not valid to be called on unbound objects. */
926 + if (obj_priv->gtt_space == NULL)
927 + return -EINVAL;
928 +
929 + i915_gem_object_flush_gpu_write_domain(obj);
930 +
931 + /* Wait on any GPU rendering and flushing to occur. */
932 + if (obj_priv->active) {
933 +#if WATCH_BUF
934 + DRM_INFO("%s: object %p wait for seqno %08x\n",
935 + __func__, obj, obj_priv->last_rendering_seqno);
936 +#endif
937 + ret = i915_do_wait_request(dev, obj_priv->last_rendering_seqno, 0);
938 + if (ret != 0)
939 + return ret;
940 + }
941 +
942 + old_write_domain = obj->write_domain;
943 + old_read_domains = obj->read_domains;
944 +
945 + obj->read_domains &= I915_GEM_DOMAIN_GTT;
946 +
947 + i915_gem_object_flush_cpu_write_domain(obj);
948 +
949 + /* It should now be out of any other write domains, and we can update
950 + * the domain values for our changes.
951 + */
952 + BUG_ON((obj->write_domain & ~I915_GEM_DOMAIN_GTT) != 0);
953 + obj->read_domains |= I915_GEM_DOMAIN_GTT;
954 + obj->write_domain = I915_GEM_DOMAIN_GTT;
955 + obj_priv->dirty = 1;
956 +
957 + trace_i915_gem_object_change_domain(obj,
958 + old_read_domains,
959 + old_write_domain);
960 +
961 + return 0;
962 +}
963 +
964 /**
965 * Moves a single object to the CPU read, and possibly write domain.
966 *
967 @@ -3710,16 +3796,23 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
968 i915_gem_flush(dev,
969 dev->invalidate_domains,
970 dev->flush_domains);
971 - if (dev->flush_domains)
972 + if (dev->flush_domains & I915_GEM_GPU_DOMAINS)
973 (void)i915_add_request(dev, file_priv,
974 dev->flush_domains);
975 }
976
977 for (i = 0; i < args->buffer_count; i++) {
978 struct drm_gem_object *obj = object_list[i];
979 + struct drm_i915_gem_object *obj_priv = obj->driver_private;
980 uint32_t old_write_domain = obj->write_domain;
981
982 obj->write_domain = obj->pending_write_domain;
983 + if (obj->write_domain)
984 + list_move_tail(&obj_priv->gpu_write_list,
985 + &dev_priv->mm.gpu_write_list);
986 + else
987 + list_del_init(&obj_priv->gpu_write_list);
988 +
989 trace_i915_gem_object_change_domain(obj,
990 obj->read_domains,
991 old_write_domain);
992 @@ -4112,6 +4205,7 @@ int i915_gem_init_object(struct drm_gem_object *obj)
993 obj_priv->obj = obj;
994 obj_priv->fence_reg = I915_FENCE_REG_NONE;
995 INIT_LIST_HEAD(&obj_priv->list);
996 + INIT_LIST_HEAD(&obj_priv->gpu_write_list);
997 INIT_LIST_HEAD(&obj_priv->fence_list);
998 obj_priv->madv = I915_MADV_WILLNEED;
999
1000 @@ -4563,6 +4657,7 @@ i915_gem_load(struct drm_device *dev)
1001 spin_lock_init(&dev_priv->mm.active_list_lock);
1002 INIT_LIST_HEAD(&dev_priv->mm.active_list);
1003 INIT_LIST_HEAD(&dev_priv->mm.flushing_list);
1004 + INIT_LIST_HEAD(&dev_priv->mm.gpu_write_list);
1005 INIT_LIST_HEAD(&dev_priv->mm.inactive_list);
1006 INIT_LIST_HEAD(&dev_priv->mm.request_list);
1007 INIT_LIST_HEAD(&dev_priv->mm.fence_list);
1008 diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
1009 index fd537f4..cc9b49a 100644
1010 --- a/drivers/gpu/drm/i915/i915_reg.h
1011 +++ b/drivers/gpu/drm/i915/i915_reg.h
1012 @@ -329,6 +329,7 @@
1013 #define FBC_CTL_PERIODIC (1<<30)
1014 #define FBC_CTL_INTERVAL_SHIFT (16)
1015 #define FBC_CTL_UNCOMPRESSIBLE (1<<14)
1016 +#define FBC_C3_IDLE (1<<13)
1017 #define FBC_CTL_STRIDE_SHIFT (5)
1018 #define FBC_CTL_FENCENO (1<<0)
1019 #define FBC_COMMAND 0x0320c
1020 @@ -405,6 +406,13 @@
1021 # define GPIO_DATA_VAL_IN (1 << 12)
1022 # define GPIO_DATA_PULLUP_DISABLE (1 << 13)
1023
1024 +#define GMBUS0 0x5100
1025 +#define GMBUS1 0x5104
1026 +#define GMBUS2 0x5108
1027 +#define GMBUS3 0x510c
1028 +#define GMBUS4 0x5110
1029 +#define GMBUS5 0x5120
1030 +
1031 /*
1032 * Clock control & power management
1033 */
1034 @@ -2153,6 +2161,13 @@
1035 #define PCH_GPIOE 0xc5020
1036 #define PCH_GPIOF 0xc5024
1037
1038 +#define PCH_GMBUS0 0xc5100
1039 +#define PCH_GMBUS1 0xc5104
1040 +#define PCH_GMBUS2 0xc5108
1041 +#define PCH_GMBUS3 0xc510c
1042 +#define PCH_GMBUS4 0xc5110
1043 +#define PCH_GMBUS5 0xc5120
1044 +
1045 #define PCH_DPLL_A 0xc6014
1046 #define PCH_DPLL_B 0xc6018
1047
1048 diff --git a/drivers/gpu/drm/i915/i915_suspend.c b/drivers/gpu/drm/i915/i915_suspend.c
1049 index 6eec817..7ad742f 100644
1050 --- a/drivers/gpu/drm/i915/i915_suspend.c
1051 +++ b/drivers/gpu/drm/i915/i915_suspend.c
1052 @@ -27,7 +27,7 @@
1053 #include "drmP.h"
1054 #include "drm.h"
1055 #include "i915_drm.h"
1056 -#include "i915_drv.h"
1057 +#include "intel_drv.h"
1058
1059 static bool i915_pipe_enabled(struct drm_device *dev, enum pipe pipe)
1060 {
1061 @@ -846,6 +846,9 @@ int i915_restore_state(struct drm_device *dev)
1062 for (i = 0; i < 3; i++)
1063 I915_WRITE(SWF30 + (i << 2), dev_priv->saveSWF2[i]);
1064
1065 + /* I2C state */
1066 + intel_i2c_reset_gmbus(dev);
1067 +
1068 return 0;
1069 }
1070
1071 diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
1072 index 6d3730f..5e730e6 100644
1073 --- a/drivers/gpu/drm/i915/intel_crt.c
1074 +++ b/drivers/gpu/drm/i915/intel_crt.c
1075 @@ -185,6 +185,9 @@ static bool intel_igdng_crt_detect_hotplug(struct drm_connector *connector)
1076 adpa = I915_READ(PCH_ADPA);
1077
1078 adpa &= ~ADPA_CRT_HOTPLUG_MASK;
1079 + /* disable HPD first */
1080 + I915_WRITE(PCH_ADPA, adpa);
1081 + (void)I915_READ(PCH_ADPA);
1082
1083 adpa |= (ADPA_CRT_HOTPLUG_PERIOD_128 |
1084 ADPA_CRT_HOTPLUG_WARMUP_10MS |
1085 diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
1086 index 601415d..b00a1aa 100644
1087 --- a/drivers/gpu/drm/i915/intel_display.c
1088 +++ b/drivers/gpu/drm/i915/intel_display.c
1089 @@ -988,6 +988,8 @@ static void i8xx_enable_fbc(struct drm_crtc *crtc, unsigned long interval)
1090
1091 /* enable it... */
1092 fbc_ctl = FBC_CTL_EN | FBC_CTL_PERIODIC;
1093 + if (IS_I945GM(dev))
1094 + fbc_ctl |= FBC_C3_IDLE; /* 945 needs special SR handling */
1095 fbc_ctl |= (dev_priv->cfb_pitch & 0xff) << FBC_CTL_STRIDE_SHIFT;
1096 fbc_ctl |= (interval & 0x2fff) << FBC_CTL_INTERVAL_SHIFT;
1097 if (obj_priv->tiling_mode != I915_TILING_NONE)
1098 @@ -1251,7 +1253,7 @@ intel_pipe_set_base(struct drm_crtc *crtc, int x, int y,
1099 return ret;
1100 }
1101
1102 - ret = i915_gem_object_set_to_gtt_domain(obj, 1);
1103 + ret = i915_gem_object_set_to_display_plane(obj);
1104 if (ret != 0) {
1105 i915_gem_object_unpin(obj);
1106 mutex_unlock(&dev->struct_mutex);
1107 @@ -2538,6 +2540,10 @@ static void g4x_update_wm(struct drm_device *dev, int planea_clock,
1108 sr_entries = roundup(sr_entries / cacheline_size, 1);
1109 DRM_DEBUG("self-refresh entries: %d\n", sr_entries);
1110 I915_WRITE(FW_BLC_SELF, FW_BLC_SELF_EN);
1111 + } else {
1112 + /* Turn off self refresh if both pipes are enabled */
1113 + I915_WRITE(FW_BLC_SELF, I915_READ(FW_BLC_SELF)
1114 + & ~FW_BLC_SELF_EN);
1115 }
1116
1117 DRM_DEBUG("Setting FIFO watermarks - A: %d, B: %d, SR %d\n",
1118 @@ -2556,15 +2562,43 @@ static void g4x_update_wm(struct drm_device *dev, int planea_clock,
1119 (cursor_sr << DSPFW_CURSOR_SR_SHIFT));
1120 }
1121
1122 -static void i965_update_wm(struct drm_device *dev, int unused, int unused2,
1123 - int unused3, int unused4)
1124 +static void i965_update_wm(struct drm_device *dev, int planea_clock,
1125 + int planeb_clock, int sr_hdisplay, int pixel_size)
1126 {
1127 struct drm_i915_private *dev_priv = dev->dev_private;
1128 + unsigned long line_time_us;
1129 + int sr_clock, sr_entries, srwm = 1;
1130 +
1131 + /* Calc sr entries for one plane configs */
1132 + if (sr_hdisplay && (!planea_clock || !planeb_clock)) {
1133 + /* self-refresh has much higher latency */
1134 + const static int sr_latency_ns = 12000;
1135 +
1136 + sr_clock = planea_clock ? planea_clock : planeb_clock;
1137 + line_time_us = ((sr_hdisplay * 1000) / sr_clock);
1138
1139 - DRM_DEBUG("Setting FIFO watermarks - A: 8, B: 8, C: 8, SR 8\n");
1140 + /* Use ns/us then divide to preserve precision */
1141 + sr_entries = (((sr_latency_ns / line_time_us) + 1) *
1142 + pixel_size * sr_hdisplay) / 1000;
1143 + sr_entries = roundup(sr_entries / I915_FIFO_LINE_SIZE, 1);
1144 + DRM_DEBUG("self-refresh entries: %d\n", sr_entries);
1145 + srwm = I945_FIFO_SIZE - sr_entries;
1146 + if (srwm < 0)
1147 + srwm = 1;
1148 + srwm &= 0x3f;
1149 + I915_WRITE(FW_BLC_SELF, FW_BLC_SELF_EN);
1150 + } else {
1151 + /* Turn off self refresh if both pipes are enabled */
1152 + I915_WRITE(FW_BLC_SELF, I915_READ(FW_BLC_SELF)
1153 + & ~FW_BLC_SELF_EN);
1154 + }
1155 +
1156 + DRM_DEBUG_KMS("Setting FIFO watermarks - A: 8, B: 8, C: 8, SR %d\n",
1157 + srwm);
1158
1159 /* 965 has limitations... */
1160 - I915_WRITE(DSPFW1, (8 << 16) | (8 << 8) | (8 << 0));
1161 + I915_WRITE(DSPFW1, (srwm << DSPFW_SR_SHIFT) | (8 << 16) | (8 << 8) |
1162 + (8 << 0));
1163 I915_WRITE(DSPFW2, (8 << 8) | (8 << 0));
1164 }
1165
1166 @@ -2625,6 +2659,10 @@ static void i9xx_update_wm(struct drm_device *dev, int planea_clock,
1167 if (srwm < 0)
1168 srwm = 1;
1169 I915_WRITE(FW_BLC_SELF, FW_BLC_SELF_EN | (srwm & 0x3f));
1170 + } else {
1171 + /* Turn off self refresh if both pipes are enabled */
1172 + I915_WRITE(FW_BLC_SELF, I915_READ(FW_BLC_SELF)
1173 + & ~FW_BLC_SELF_EN);
1174 }
1175
1176 DRM_DEBUG("Setting FIFO watermarks - A: %d, B: %d, C: %d, SR %d\n",
1177 diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
1178 index ef61fe9..6c7c19f 100644
1179 --- a/drivers/gpu/drm/i915/intel_drv.h
1180 +++ b/drivers/gpu/drm/i915/intel_drv.h
1181 @@ -134,6 +134,8 @@ void intel_i2c_destroy(struct i2c_adapter *adapter);
1182 int intel_ddc_get_modes(struct intel_output *intel_output);
1183 extern bool intel_ddc_probe(struct intel_output *intel_output);
1184 void intel_i2c_quirk_set(struct drm_device *dev, bool enable);
1185 +void intel_i2c_reset_gmbus(struct drm_device *dev);
1186 +
1187 extern void intel_crt_init(struct drm_device *dev);
1188 extern void intel_hdmi_init(struct drm_device *dev, int sdvox_reg);
1189 extern bool intel_sdvo_init(struct drm_device *dev, int output_device);
1190 diff --git a/drivers/gpu/drm/i915/intel_fb.c b/drivers/gpu/drm/i915/intel_fb.c
1191 index 2b0fe54..1318ac2 100644
1192 --- a/drivers/gpu/drm/i915/intel_fb.c
1193 +++ b/drivers/gpu/drm/i915/intel_fb.c
1194 @@ -148,7 +148,7 @@ static int intelfb_create(struct drm_device *dev, uint32_t fb_width,
1195
1196 mutex_lock(&dev->struct_mutex);
1197
1198 - ret = i915_gem_object_pin(fbo, PAGE_SIZE);
1199 + ret = i915_gem_object_pin(fbo, 64*1024);
1200 if (ret) {
1201 DRM_ERROR("failed to pin fb: %d\n", ret);
1202 goto out_unref;
1203 diff --git a/drivers/gpu/drm/i915/intel_i2c.c b/drivers/gpu/drm/i915/intel_i2c.c
1204 index c7eab72..b94acc4 100644
1205 --- a/drivers/gpu/drm/i915/intel_i2c.c
1206 +++ b/drivers/gpu/drm/i915/intel_i2c.c
1207 @@ -118,6 +118,23 @@ static void set_data(void *data, int state_high)
1208 udelay(I2C_RISEFALL_TIME); /* wait for the line to change state */
1209 }
1210
1211 +/* Clears the GMBUS setup. Our driver doesn't make use of the GMBUS I2C
1212 + * engine, but if the BIOS leaves it enabled, then that can break our use
1213 + * of the bit-banging I2C interfaces. This is notably the case with the
1214 + * Mac Mini in EFI mode.
1215 + */
1216 +void
1217 +intel_i2c_reset_gmbus(struct drm_device *dev)
1218 +{
1219 + struct drm_i915_private *dev_priv = dev->dev_private;
1220 +
1221 + if (IS_IGDNG(dev)) {
1222 + I915_WRITE(PCH_GMBUS0, 0);
1223 + } else {
1224 + I915_WRITE(GMBUS0, 0);
1225 + }
1226 +}
1227 +
1228 /**
1229 * intel_i2c_create - instantiate an Intel i2c bus using the specified GPIO reg
1230 * @dev: DRM device
1231 @@ -168,6 +185,8 @@ struct i2c_adapter *intel_i2c_create(struct drm_device *dev, const u32 reg,
1232 if(i2c_bit_add_bus(&chan->adapter))
1233 goto out_free;
1234
1235 + intel_i2c_reset_gmbus(dev);
1236 +
1237 /* JJJ: raise SCL and SDA? */
1238 intel_i2c_quirk_set(dev, true);
1239 set_data(chan, 1);
1240 diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
1241 index 0e0e4b4..952bb4e 100644
1242 --- a/drivers/gpu/drm/i915/intel_lvds.c
1243 +++ b/drivers/gpu/drm/i915/intel_lvds.c
1244 @@ -602,12 +602,33 @@ static void intel_lvds_mode_set(struct drm_encoder *encoder,
1245 /* Some lid devices report incorrect lid status, assume they're connected */
1246 static const struct dmi_system_id bad_lid_status[] = {
1247 {
1248 + .ident = "Compaq nx9020",
1249 + .matches = {
1250 + DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
1251 + DMI_MATCH(DMI_BOARD_NAME, "3084"),
1252 + },
1253 + },
1254 + {
1255 + .ident = "Samsung SX20S",
1256 + .matches = {
1257 + DMI_MATCH(DMI_SYS_VENDOR, "Samsung Electronics"),
1258 + DMI_MATCH(DMI_BOARD_NAME, "SX20S"),
1259 + },
1260 + },
1261 + {
1262 .ident = "Aspire One",
1263 .matches = {
1264 DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
1265 DMI_MATCH(DMI_PRODUCT_NAME, "Aspire one"),
1266 },
1267 },
1268 + {
1269 + .ident = "PC-81005",
1270 + .matches = {
1271 + DMI_MATCH(DMI_SYS_VENDOR, "MALATA"),
1272 + DMI_MATCH(DMI_PRODUCT_NAME, "PC-81005"),
1273 + },
1274 + },
1275 { }
1276 };
1277
1278 diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
1279 index d67c425..fed2291 100644
1280 --- a/drivers/gpu/drm/radeon/atom.c
1281 +++ b/drivers/gpu/drm/radeon/atom.c
1282 @@ -607,7 +607,7 @@ static void atom_op_delay(atom_exec_context *ctx, int *ptr, int arg)
1283 uint8_t count = U8((*ptr)++);
1284 SDEBUG(" count: %d\n", count);
1285 if (arg == ATOM_UNIT_MICROSEC)
1286 - schedule_timeout_uninterruptible(usecs_to_jiffies(count));
1287 + udelay(count);
1288 else
1289 schedule_timeout_uninterruptible(msecs_to_jiffies(count));
1290 }
1291 diff --git a/drivers/hwmon/adt7462.c b/drivers/hwmon/adt7462.c
1292 index 262c133..14f910d 100644
1293 --- a/drivers/hwmon/adt7462.c
1294 +++ b/drivers/hwmon/adt7462.c
1295 @@ -182,7 +182,7 @@ I2C_CLIENT_INSMOD_1(adt7462);
1296 *
1297 * Some, but not all, of these voltages have low/high limits.
1298 */
1299 -#define ADT7462_VOLT_COUNT 12
1300 +#define ADT7462_VOLT_COUNT 13
1301
1302 #define ADT7462_VENDOR 0x41
1303 #define ADT7462_DEVICE 0x62
1304 diff --git a/drivers/hwmon/lm78.c b/drivers/hwmon/lm78.c
1305 index f7e7016..1508e0a 100644
1306 --- a/drivers/hwmon/lm78.c
1307 +++ b/drivers/hwmon/lm78.c
1308 @@ -870,17 +870,16 @@ static struct lm78_data *lm78_update_device(struct device *dev)
1309 static int __init lm78_isa_found(unsigned short address)
1310 {
1311 int val, save, found = 0;
1312 -
1313 - /* We have to request the region in two parts because some
1314 - boards declare base+4 to base+7 as a PNP device */
1315 - if (!request_region(address, 4, "lm78")) {
1316 - pr_debug("lm78: Failed to request low part of region\n");
1317 - return 0;
1318 - }
1319 - if (!request_region(address + 4, 4, "lm78")) {
1320 - pr_debug("lm78: Failed to request high part of region\n");
1321 - release_region(address, 4);
1322 - return 0;
1323 + int port;
1324 +
1325 + /* Some boards declare base+0 to base+7 as a PNP device, some base+4
1326 + * to base+7 and some base+5 to base+6. So we better request each port
1327 + * individually for the probing phase. */
1328 + for (port = address; port < address + LM78_EXTENT; port++) {
1329 + if (!request_region(port, 1, "lm78")) {
1330 + pr_debug("lm78: Failed to request port 0x%x\n", port);
1331 + goto release;
1332 + }
1333 }
1334
1335 #define REALLY_SLOW_IO
1336 @@ -944,8 +943,8 @@ static int __init lm78_isa_found(unsigned short address)
1337 val & 0x80 ? "LM79" : "LM78", (int)address);
1338
1339 release:
1340 - release_region(address + 4, 4);
1341 - release_region(address, 4);
1342 + for (port--; port >= address; port--)
1343 + release_region(port, 1);
1344 return found;
1345 }
1346
1347 diff --git a/drivers/hwmon/w83781d.c b/drivers/hwmon/w83781d.c
1348 index d27ed1b..f0b6883 100644
1349 --- a/drivers/hwmon/w83781d.c
1350 +++ b/drivers/hwmon/w83781d.c
1351 @@ -1818,17 +1818,17 @@ static int __init
1352 w83781d_isa_found(unsigned short address)
1353 {
1354 int val, save, found = 0;
1355 -
1356 - /* We have to request the region in two parts because some
1357 - boards declare base+4 to base+7 as a PNP device */
1358 - if (!request_region(address, 4, "w83781d")) {
1359 - pr_debug("w83781d: Failed to request low part of region\n");
1360 - return 0;
1361 - }
1362 - if (!request_region(address + 4, 4, "w83781d")) {
1363 - pr_debug("w83781d: Failed to request high part of region\n");
1364 - release_region(address, 4);
1365 - return 0;
1366 + int port;
1367 +
1368 + /* Some boards declare base+0 to base+7 as a PNP device, some base+4
1369 + * to base+7 and some base+5 to base+6. So we better request each port
1370 + * individually for the probing phase. */
1371 + for (port = address; port < address + W83781D_EXTENT; port++) {
1372 + if (!request_region(port, 1, "w83781d")) {
1373 + pr_debug("w83781d: Failed to request port 0x%x\n",
1374 + port);
1375 + goto release;
1376 + }
1377 }
1378
1379 #define REALLY_SLOW_IO
1380 @@ -1902,8 +1902,8 @@ w83781d_isa_found(unsigned short address)
1381 val == 0x30 ? "W83782D" : "W83781D", (int)address);
1382
1383 release:
1384 - release_region(address + 4, 4);
1385 - release_region(address, 4);
1386 + for (port--; port >= address; port--)
1387 + release_region(port, 1);
1388 return found;
1389 }
1390
1391 diff --git a/drivers/i2c/busses/i2c-tiny-usb.c b/drivers/i2c/busses/i2c-tiny-usb.c
1392 index b1c050f..e29b6d5 100644
1393 --- a/drivers/i2c/busses/i2c-tiny-usb.c
1394 +++ b/drivers/i2c/busses/i2c-tiny-usb.c
1395 @@ -13,6 +13,7 @@
1396 #include <linux/kernel.h>
1397 #include <linux/errno.h>
1398 #include <linux/module.h>
1399 +#include <linux/types.h>
1400
1401 /* include interfaces to usb layer */
1402 #include <linux/usb.h>
1403 @@ -31,8 +32,8 @@
1404 #define CMD_I2C_IO_END (1<<1)
1405
1406 /* i2c bit delay, default is 10us -> 100kHz */
1407 -static int delay = 10;
1408 -module_param(delay, int, 0);
1409 +static unsigned short delay = 10;
1410 +module_param(delay, ushort, 0);
1411 MODULE_PARM_DESC(delay, "bit delay in microseconds, "
1412 "e.g. 10 for 100kHz (default is 100kHz)");
1413
1414 @@ -109,7 +110,7 @@ static int usb_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs, int num)
1415
1416 static u32 usb_func(struct i2c_adapter *adapter)
1417 {
1418 - u32 func;
1419 + __le32 func;
1420
1421 /* get functionality from adapter */
1422 if (usb_read(adapter, CMD_GET_FUNC, 0, 0, &func, sizeof(func)) !=
1423 @@ -118,7 +119,7 @@ static u32 usb_func(struct i2c_adapter *adapter)
1424 return 0;
1425 }
1426
1427 - return func;
1428 + return le32_to_cpu(func);
1429 }
1430
1431 /* This is the actual algorithm we define */
1432 @@ -216,8 +217,7 @@ static int i2c_tiny_usb_probe(struct usb_interface *interface,
1433 "i2c-tiny-usb at bus %03d device %03d",
1434 dev->usb_dev->bus->busnum, dev->usb_dev->devnum);
1435
1436 - if (usb_write(&dev->adapter, CMD_SET_DELAY,
1437 - cpu_to_le16(delay), 0, NULL, 0) != 0) {
1438 + if (usb_write(&dev->adapter, CMD_SET_DELAY, delay, 0, NULL, 0) != 0) {
1439 dev_err(&dev->adapter.dev,
1440 "failure setting delay to %dus\n", delay);
1441 retval = -EIO;
1442 diff --git a/drivers/md/dm-log-userspace-transfer.c b/drivers/md/dm-log-userspace-transfer.c
1443 index 54abf9e..f1c8cae 100644
1444 --- a/drivers/md/dm-log-userspace-transfer.c
1445 +++ b/drivers/md/dm-log-userspace-transfer.c
1446 @@ -172,11 +172,15 @@ int dm_consult_userspace(const char *uuid, uint64_t luid, int request_type,
1447 {
1448 int r = 0;
1449 size_t dummy = 0;
1450 - int overhead_size =
1451 - sizeof(struct dm_ulog_request *) + sizeof(struct cn_msg);
1452 + int overhead_size = sizeof(struct dm_ulog_request) + sizeof(struct cn_msg);
1453 struct dm_ulog_request *tfr = prealloced_ulog_tfr;
1454 struct receiving_pkg pkg;
1455
1456 + /*
1457 + * Given the space needed to hold the 'struct cn_msg' and
1458 + * 'struct dm_ulog_request' - do we have enough payload
1459 + * space remaining?
1460 + */
1461 if (data_size > (DM_ULOG_PREALLOCED_SIZE - overhead_size)) {
1462 DMINFO("Size of tfr exceeds preallocated size");
1463 return -EINVAL;
1464 @@ -191,7 +195,7 @@ resend:
1465 */
1466 mutex_lock(&dm_ulog_lock);
1467
1468 - memset(tfr, 0, DM_ULOG_PREALLOCED_SIZE - overhead_size);
1469 + memset(tfr, 0, DM_ULOG_PREALLOCED_SIZE - sizeof(struct cn_msg));
1470 memcpy(tfr->uuid, uuid, DM_UUID_LEN);
1471 tfr->luid = luid;
1472 tfr->seq = dm_ulog_seq++;
1473 diff --git a/drivers/md/dm-stripe.c b/drivers/md/dm-stripe.c
1474 index e0efc1a..bd58703 100644
1475 --- a/drivers/md/dm-stripe.c
1476 +++ b/drivers/md/dm-stripe.c
1477 @@ -110,7 +110,7 @@ static int stripe_ctr(struct dm_target *ti, unsigned int argc, char **argv)
1478 }
1479
1480 stripes = simple_strtoul(argv[0], &end, 10);
1481 - if (*end) {
1482 + if (!stripes || *end) {
1483 ti->error = "Invalid stripe count";
1484 return -EINVAL;
1485 }
1486 diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
1487 index d29215d..431b9b2 100644
1488 --- a/drivers/md/raid5.c
1489 +++ b/drivers/md/raid5.c
1490 @@ -5432,11 +5432,11 @@ static int raid5_start_reshape(mddev_t *mddev)
1491 !test_bit(Faulty, &rdev->flags)) {
1492 if (raid5_add_disk(mddev, rdev) == 0) {
1493 char nm[20];
1494 - if (rdev->raid_disk >= conf->previous_raid_disks)
1495 + if (rdev->raid_disk >= conf->previous_raid_disks) {
1496 set_bit(In_sync, &rdev->flags);
1497 - else
1498 + added_devices++;
1499 + } else
1500 rdev->recovery_offset = 0;
1501 - added_devices++;
1502 sprintf(nm, "rd%d", rdev->raid_disk);
1503 if (sysfs_create_link(&mddev->kobj,
1504 &rdev->kobj, nm))
1505 @@ -5448,9 +5448,12 @@ static int raid5_start_reshape(mddev_t *mddev)
1506 break;
1507 }
1508
1509 + /* When a reshape changes the number of devices, ->degraded
1510 + * is measured against the large of the pre and post number of
1511 + * devices.*/
1512 if (mddev->delta_disks > 0) {
1513 spin_lock_irqsave(&conf->device_lock, flags);
1514 - mddev->degraded = (conf->raid_disks - conf->previous_raid_disks)
1515 + mddev->degraded += (conf->raid_disks - conf->previous_raid_disks)
1516 - added_devices;
1517 spin_unlock_irqrestore(&conf->device_lock, flags);
1518 }
1519 diff --git a/drivers/media/dvb/dvb-core/dmxdev.c b/drivers/media/dvb/dvb-core/dmxdev.c
1520 index c37790a..9ddc579 100644
1521 --- a/drivers/media/dvb/dvb-core/dmxdev.c
1522 +++ b/drivers/media/dvb/dvb-core/dmxdev.c
1523 @@ -761,7 +761,6 @@ static int dvb_demux_open(struct inode *inode, struct file *file)
1524 dvb_ringbuffer_init(&dmxdevfilter->buffer, NULL, 8192);
1525 dmxdevfilter->type = DMXDEV_TYPE_NONE;
1526 dvb_dmxdev_filter_state_set(dmxdevfilter, DMXDEV_STATE_ALLOCATED);
1527 - INIT_LIST_HEAD(&dmxdevfilter->feed.ts);
1528 init_timer(&dmxdevfilter->timer);
1529
1530 dvbdev->users++;
1531 @@ -887,6 +886,7 @@ static int dvb_dmxdev_pes_filter_set(struct dmxdev *dmxdev,
1532 dmxdevfilter->type = DMXDEV_TYPE_PES;
1533 memcpy(&dmxdevfilter->params, params,
1534 sizeof(struct dmx_pes_filter_params));
1535 + INIT_LIST_HEAD(&dmxdevfilter->feed.ts);
1536
1537 dvb_dmxdev_filter_state_set(dmxdevfilter, DMXDEV_STATE_SET);
1538
1539 diff --git a/drivers/message/fusion/mptscsih.c b/drivers/message/fusion/mptscsih.c
1540 index c295786..6cea718 100644
1541 --- a/drivers/message/fusion/mptscsih.c
1542 +++ b/drivers/message/fusion/mptscsih.c
1543 @@ -1720,7 +1720,7 @@ mptscsih_abort(struct scsi_cmnd * SCpnt)
1544 dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT "task abort: "
1545 "Command not in the active list! (sc=%p)\n", ioc->name,
1546 SCpnt));
1547 - retval = 0;
1548 + retval = SUCCESS;
1549 goto out;
1550 }
1551
1552 diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
1553 index 2c6b063..9009bac 100644
1554 --- a/drivers/net/wireless/ath/ath9k/xmit.c
1555 +++ b/drivers/net/wireless/ath/ath9k/xmit.c
1556 @@ -1563,7 +1563,7 @@ static int ath_tx_setup_buffer(struct ieee80211_hw *hw, struct ath_buf *bf,
1557
1558 bf->bf_frmlen = skb->len + FCS_LEN - (hdrlen & 3);
1559
1560 - if (conf_is_ht(&sc->hw->conf) && !is_pae(skb))
1561 + if (conf_is_ht(&sc->hw->conf))
1562 bf->bf_state.bf_type |= BUF_HT;
1563
1564 bf->bf_flags = setup_tx_flags(sc, skb, txctl->txq);
1565 @@ -1648,7 +1648,7 @@ static void ath_tx_start_dma(struct ath_softc *sc, struct ath_buf *bf,
1566 goto tx_done;
1567 }
1568
1569 - if (tx_info->flags & IEEE80211_TX_CTL_AMPDU) {
1570 + if ((tx_info->flags & IEEE80211_TX_CTL_AMPDU) && !is_pae(skb)) {
1571 /*
1572 * Try aggregation if it's a unicast data frame
1573 * and the destination is HT capable.
1574 diff --git a/drivers/net/wireless/b43/b43.h b/drivers/net/wireless/b43/b43.h
1575 index 6607162..0e6b154 100644
1576 --- a/drivers/net/wireless/b43/b43.h
1577 +++ b/drivers/net/wireless/b43/b43.h
1578 @@ -117,6 +117,7 @@
1579 #define B43_MMIO_TSF_2 0x636 /* core rev < 3 only */
1580 #define B43_MMIO_TSF_3 0x638 /* core rev < 3 only */
1581 #define B43_MMIO_RNG 0x65A
1582 +#define B43_MMIO_IFSSLOT 0x684 /* Interframe slot time */
1583 #define B43_MMIO_IFSCTL 0x688 /* Interframe space control */
1584 #define B43_MMIO_IFSCTL_USE_EDCF 0x0004
1585 #define B43_MMIO_POWERUP_DELAY 0x6A8
1586 diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
1587 index 098dda1..9ca253e 100644
1588 --- a/drivers/net/wireless/b43/main.c
1589 +++ b/drivers/net/wireless/b43/main.c
1590 @@ -628,10 +628,17 @@ static void b43_upload_card_macaddress(struct b43_wldev *dev)
1591 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
1592 {
1593 /* slot_time is in usec. */
1594 - if (dev->phy.type != B43_PHYTYPE_G)
1595 + /* This test used to exit for all but a G PHY. */
1596 + if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ)
1597 return;
1598 - b43_write16(dev, 0x684, 510 + slot_time);
1599 - b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
1600 + b43_write16(dev, B43_MMIO_IFSSLOT, 510 + slot_time);
1601 + /* Shared memory location 0x0010 is the slot time and should be
1602 + * set to slot_time; however, this register is initially 0 and changing
1603 + * the value adversely affects the transmit rate for BCM4311
1604 + * devices. Until this behavior is unterstood, delete this step
1605 + *
1606 + * b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
1607 + */
1608 }
1609
1610 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
1611 diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
1612 index 2dc9287..0cd4ec4 100644
1613 --- a/drivers/net/wireless/iwlwifi/iwl-core.c
1614 +++ b/drivers/net/wireless/iwlwifi/iwl-core.c
1615 @@ -2645,6 +2645,7 @@ int iwl_mac_config(struct ieee80211_hw *hw, u32 changed)
1616 if ((le16_to_cpu(priv->staging_rxon.channel) != ch))
1617 priv->staging_rxon.flags = 0;
1618
1619 + iwl_set_rxon_ht(priv, ht_conf);
1620 iwl_set_rxon_channel(priv, conf->channel);
1621
1622 iwl_set_flags_for_band(priv, conf->channel->band);
1623 diff --git a/drivers/net/wireless/rtl818x/rtl8187_dev.c b/drivers/net/wireless/rtl818x/rtl8187_dev.c
1624 index ea49918..9921147 100644
1625 --- a/drivers/net/wireless/rtl818x/rtl8187_dev.c
1626 +++ b/drivers/net/wireless/rtl818x/rtl8187_dev.c
1627 @@ -65,6 +65,7 @@ static struct usb_device_id rtl8187_table[] __devinitdata = {
1628 /* Sitecom */
1629 {USB_DEVICE(0x0df6, 0x000d), .driver_info = DEVICE_RTL8187},
1630 {USB_DEVICE(0x0df6, 0x0028), .driver_info = DEVICE_RTL8187B},
1631 + {USB_DEVICE(0x0df6, 0x0029), .driver_info = DEVICE_RTL8187B},
1632 /* Sphairon Access Systems GmbH */
1633 {USB_DEVICE(0x114B, 0x0150), .driver_info = DEVICE_RTL8187},
1634 /* Dick Smith Electronics */
1635 diff --git a/drivers/platform/x86/dell-wmi.c b/drivers/platform/x86/dell-wmi.c
1636 index 0f900cc..6dec7cc 100644
1637 --- a/drivers/platform/x86/dell-wmi.c
1638 +++ b/drivers/platform/x86/dell-wmi.c
1639 @@ -158,8 +158,13 @@ static void dell_wmi_notify(u32 value, void *context)
1640 struct acpi_buffer response = { ACPI_ALLOCATE_BUFFER, NULL };
1641 static struct key_entry *key;
1642 union acpi_object *obj;
1643 + acpi_status status;
1644
1645 - wmi_get_event_data(value, &response);
1646 + status = wmi_get_event_data(value, &response);
1647 + if (status != AE_OK) {
1648 + printk(KERN_INFO "dell-wmi: bad event status 0x%x\n", status);
1649 + return;
1650 + }
1651
1652 obj = (union acpi_object *)response.pointer;
1653
1654 @@ -180,6 +185,7 @@ static void dell_wmi_notify(u32 value, void *context)
1655 printk(KERN_INFO "dell-wmi: Unknown key %x pressed\n",
1656 buffer[1] & 0xFFFF);
1657 }
1658 + kfree(obj);
1659 }
1660
1661 static int __init dell_wmi_input_setup(void)
1662 diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c
1663 index c284217..deb53b5 100644
1664 --- a/drivers/platform/x86/hp-wmi.c
1665 +++ b/drivers/platform/x86/hp-wmi.c
1666 @@ -334,8 +334,13 @@ static void hp_wmi_notify(u32 value, void *context)
1667 struct acpi_buffer response = { ACPI_ALLOCATE_BUFFER, NULL };
1668 static struct key_entry *key;
1669 union acpi_object *obj;
1670 + acpi_status status;
1671
1672 - wmi_get_event_data(value, &response);
1673 + status = wmi_get_event_data(value, &response);
1674 + if (status != AE_OK) {
1675 + printk(KERN_INFO "hp-wmi: bad event status 0x%x\n", status);
1676 + return;
1677 + }
1678
1679 obj = (union acpi_object *)response.pointer;
1680
1681 @@ -377,6 +382,8 @@ static void hp_wmi_notify(u32 value, void *context)
1682 eventcode);
1683 } else
1684 printk(KERN_INFO "HP WMI: Unknown response received\n");
1685 +
1686 + kfree(obj);
1687 }
1688
1689 static int __init hp_wmi_input_setup(void)
1690 diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
1691 index 177f8d7..87f4c97 100644
1692 --- a/drivers/platform/x86/wmi.c
1693 +++ b/drivers/platform/x86/wmi.c
1694 @@ -510,8 +510,8 @@ EXPORT_SYMBOL_GPL(wmi_remove_notify_handler);
1695 /**
1696 * wmi_get_event_data - Get WMI data associated with an event
1697 *
1698 - * @event - Event to find
1699 - * &out - Buffer to hold event data
1700 + * @event: Event to find
1701 + * @out: Buffer to hold event data. out->pointer should be freed with kfree()
1702 *
1703 * Returns extra data associated with an event in WMI.
1704 */
1705 diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
1706 index efe568d..1836053 100644
1707 --- a/drivers/regulator/core.c
1708 +++ b/drivers/regulator/core.c
1709 @@ -640,7 +640,7 @@ static int suspend_prepare(struct regulator_dev *rdev, suspend_state_t state)
1710 static void print_constraints(struct regulator_dev *rdev)
1711 {
1712 struct regulation_constraints *constraints = rdev->constraints;
1713 - char buf[80];
1714 + char buf[80] = "";
1715 int count;
1716
1717 if (rdev->desc->type == REGULATOR_VOLTAGE) {
1718 diff --git a/drivers/rtc/rtc-fm3130.c b/drivers/rtc/rtc-fm3130.c
1719 index 3a7be11..812c667 100644
1720 --- a/drivers/rtc/rtc-fm3130.c
1721 +++ b/drivers/rtc/rtc-fm3130.c
1722 @@ -376,20 +376,22 @@ static int __devinit fm3130_probe(struct i2c_client *client,
1723 }
1724
1725 /* Disabling calibration mode */
1726 - if (fm3130->regs[FM3130_RTC_CONTROL] & FM3130_RTC_CONTROL_BIT_CAL)
1727 + if (fm3130->regs[FM3130_RTC_CONTROL] & FM3130_RTC_CONTROL_BIT_CAL) {
1728 i2c_smbus_write_byte_data(client, FM3130_RTC_CONTROL,
1729 fm3130->regs[FM3130_RTC_CONTROL] &
1730 ~(FM3130_RTC_CONTROL_BIT_CAL));
1731 dev_warn(&client->dev, "Disabling calibration mode!\n");
1732 + }
1733
1734 /* Disabling read and write modes */
1735 if (fm3130->regs[FM3130_RTC_CONTROL] & FM3130_RTC_CONTROL_BIT_WRITE ||
1736 - fm3130->regs[FM3130_RTC_CONTROL] & FM3130_RTC_CONTROL_BIT_READ)
1737 + fm3130->regs[FM3130_RTC_CONTROL] & FM3130_RTC_CONTROL_BIT_READ) {
1738 i2c_smbus_write_byte_data(client, FM3130_RTC_CONTROL,
1739 fm3130->regs[FM3130_RTC_CONTROL] &
1740 ~(FM3130_RTC_CONTROL_BIT_READ |
1741 FM3130_RTC_CONTROL_BIT_WRITE));
1742 dev_warn(&client->dev, "Disabling READ or WRITE mode!\n");
1743 + }
1744
1745 /* oscillator off? turn it on, so clock can tick. */
1746 if (fm3130->regs[FM3130_CAL_CONTROL] & FM3130_CAL_CONTROL_BIT_nOSCEN)
1747 diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
1748 index 513dec9..d0ef15a 100644
1749 --- a/drivers/s390/block/dasd.c
1750 +++ b/drivers/s390/block/dasd.c
1751 @@ -994,10 +994,9 @@ static void dasd_handle_killed_request(struct ccw_device *cdev,
1752 return;
1753 cqr = (struct dasd_ccw_req *) intparm;
1754 if (cqr->status != DASD_CQR_IN_IO) {
1755 - DBF_EVENT(DBF_DEBUG,
1756 - "invalid status in handle_killed_request: "
1757 - "bus_id %s, status %02x",
1758 - dev_name(&cdev->dev), cqr->status);
1759 + DBF_EVENT_DEVID(DBF_DEBUG, cdev,
1760 + "invalid status in handle_killed_request: "
1761 + "%02x", cqr->status);
1762 return;
1763 }
1764
1765 @@ -1045,12 +1044,13 @@ void dasd_int_handler(struct ccw_device *cdev, unsigned long intparm,
1766 case -EIO:
1767 break;
1768 case -ETIMEDOUT:
1769 - DBF_EVENT(DBF_WARNING, "%s(%s): request timed out\n",
1770 - __func__, dev_name(&cdev->dev));
1771 + DBF_EVENT_DEVID(DBF_WARNING, cdev, "%s: "
1772 + "request timed out\n", __func__);
1773 break;
1774 default:
1775 - DBF_EVENT(DBF_WARNING, "%s(%s): unknown error %ld\n",
1776 - __func__, dev_name(&cdev->dev), PTR_ERR(irb));
1777 + DBF_EVENT_DEVID(DBF_WARNING, cdev, "%s: "
1778 + "unknown error %ld\n", __func__,
1779 + PTR_ERR(irb));
1780 }
1781 dasd_handle_killed_request(cdev, intparm);
1782 return;
1783 @@ -2217,9 +2217,9 @@ int dasd_generic_probe(struct ccw_device *cdev,
1784 }
1785 ret = dasd_add_sysfs_files(cdev);
1786 if (ret) {
1787 - DBF_EVENT(DBF_WARNING,
1788 - "dasd_generic_probe: could not add sysfs entries "
1789 - "for %s\n", dev_name(&cdev->dev));
1790 + DBF_EVENT_DEVID(DBF_WARNING, cdev, "%s",
1791 + "dasd_generic_probe: could not add "
1792 + "sysfs entries");
1793 return ret;
1794 }
1795 cdev->handler = &dasd_int_handler;
1796 diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
1797 index 80c205b..678bb94 100644
1798 --- a/drivers/s390/block/dasd_eckd.c
1799 +++ b/drivers/s390/block/dasd_eckd.c
1800 @@ -88,9 +88,9 @@ dasd_eckd_probe (struct ccw_device *cdev)
1801 /* set ECKD specific ccw-device options */
1802 ret = ccw_device_set_options(cdev, CCWDEV_ALLOW_FORCE);
1803 if (ret) {
1804 - DBF_EVENT(DBF_WARNING,
1805 - "dasd_eckd_probe: could not set ccw-device options "
1806 - "for %s\n", dev_name(&cdev->dev));
1807 + DBF_EVENT_DEVID(DBF_WARNING, cdev, "%s",
1808 + "dasd_eckd_probe: could not set "
1809 + "ccw-device options");
1810 return ret;
1811 }
1812 ret = dasd_generic_probe(cdev, &dasd_eckd_discipline);
1813 @@ -885,16 +885,15 @@ static int dasd_eckd_read_conf(struct dasd_device *device)
1814 rc = dasd_eckd_read_conf_lpm(device, &conf_data,
1815 &conf_len, lpm);
1816 if (rc && rc != -EOPNOTSUPP) { /* -EOPNOTSUPP is ok */
1817 - DBF_EVENT(DBF_WARNING,
1818 + DBF_EVENT_DEVID(DBF_WARNING, device->cdev,
1819 "Read configuration data returned "
1820 - "error %d for device: %s", rc,
1821 - dev_name(&device->cdev->dev));
1822 + "error %d", rc);
1823 return rc;
1824 }
1825 if (conf_data == NULL) {
1826 - DBF_EVENT(DBF_WARNING, "No configuration "
1827 - "data retrieved for device: %s",
1828 - dev_name(&device->cdev->dev));
1829 + DBF_EVENT_DEVID(DBF_WARNING, device->cdev, "%s",
1830 + "No configuration data "
1831 + "retrieved");
1832 continue; /* no error */
1833 }
1834 /* save first valid configuration data */
1835 @@ -941,9 +940,8 @@ static int dasd_eckd_read_features(struct dasd_device *device)
1836 sizeof(struct dasd_rssd_features)),
1837 device);
1838 if (IS_ERR(cqr)) {
1839 - DBF_EVENT(DBF_WARNING, "Could not allocate initialization "
1840 - "request for device: %s",
1841 - dev_name(&device->cdev->dev));
1842 + DBF_EVENT_DEVID(DBF_WARNING, device->cdev, "%s", "Could not "
1843 + "allocate initialization request");
1844 return PTR_ERR(cqr);
1845 }
1846 cqr->startdev = device;
1847 @@ -1071,10 +1069,8 @@ static int dasd_eckd_validate_server(struct dasd_device *device)
1848 /* may be requested feature is not available on server,
1849 * therefore just report error and go ahead */
1850 private = (struct dasd_eckd_private *) device->private;
1851 - DBF_EVENT(DBF_WARNING, "PSF-SSC on storage subsystem %s.%s.%04x "
1852 - "returned rc=%d for device: %s",
1853 - private->uid.vendor, private->uid.serial,
1854 - private->uid.ssid, rc, dev_name(&device->cdev->dev));
1855 + DBF_EVENT_DEVID(DBF_WARNING, device->cdev, "PSF-SSC for SSID %04x "
1856 + "returned rc=%d", private->uid.ssid, rc);
1857 /* RE-Read Configuration Data */
1858 return dasd_eckd_read_conf(device);
1859 }
1860 @@ -1123,9 +1119,9 @@ dasd_eckd_check_characteristics(struct dasd_device *device)
1861 if (private->uid.type == UA_BASE_DEVICE) {
1862 block = dasd_alloc_block();
1863 if (IS_ERR(block)) {
1864 - DBF_EVENT(DBF_WARNING, "could not allocate dasd "
1865 - "block structure for device: %s",
1866 - dev_name(&device->cdev->dev));
1867 + DBF_EVENT_DEVID(DBF_WARNING, device->cdev, "%s",
1868 + "could not allocate dasd "
1869 + "block structure");
1870 rc = PTR_ERR(block);
1871 goto out_err1;
1872 }
1873 @@ -1153,9 +1149,8 @@ dasd_eckd_check_characteristics(struct dasd_device *device)
1874 rc = dasd_generic_read_dev_chars(device, DASD_ECKD_MAGIC,
1875 &private->rdc_data, 64);
1876 if (rc) {
1877 - DBF_EVENT(DBF_WARNING,
1878 - "Read device characteristics failed, rc=%d for "
1879 - "device: %s", rc, dev_name(&device->cdev->dev));
1880 + DBF_EVENT_DEVID(DBF_WARNING, device->cdev,
1881 + "Read device characteristic failed, rc=%d", rc);
1882 goto out_err3;
1883 }
1884 /* find the vaild cylinder size */
1885 @@ -3253,9 +3248,8 @@ int dasd_eckd_restore_device(struct dasd_device *device)
1886 rc = dasd_generic_read_dev_chars(device, DASD_ECKD_MAGIC,
1887 &temp_rdc_data, 64);
1888 if (rc) {
1889 - DBF_EVENT(DBF_WARNING,
1890 - "Read device characteristics failed, rc=%d for "
1891 - "device: %s", rc, dev_name(&device->cdev->dev));
1892 + DBF_EVENT_DEVID(DBF_WARNING, device->cdev,
1893 + "Read device characteristic failed, rc=%d", rc);
1894 goto out_err;
1895 }
1896 spin_lock_irqsave(get_ccwdev_lock(device->cdev), flags);
1897 diff --git a/drivers/s390/block/dasd_fba.c b/drivers/s390/block/dasd_fba.c
1898 index f245377..227b4e9 100644
1899 --- a/drivers/s390/block/dasd_fba.c
1900 +++ b/drivers/s390/block/dasd_fba.c
1901 @@ -141,9 +141,8 @@ dasd_fba_check_characteristics(struct dasd_device *device)
1902 }
1903 block = dasd_alloc_block();
1904 if (IS_ERR(block)) {
1905 - DBF_EVENT(DBF_WARNING, "could not allocate dasd block "
1906 - "structure for device: %s",
1907 - dev_name(&device->cdev->dev));
1908 + DBF_EVENT_DEVID(DBF_WARNING, cdev, "%s", "could not allocate "
1909 + "dasd block structure");
1910 device->private = NULL;
1911 kfree(private);
1912 return PTR_ERR(block);
1913 @@ -155,9 +154,8 @@ dasd_fba_check_characteristics(struct dasd_device *device)
1914 rc = dasd_generic_read_dev_chars(device, DASD_FBA_MAGIC,
1915 &private->rdc_data, 32);
1916 if (rc) {
1917 - DBF_EVENT(DBF_WARNING, "Read device characteristics returned "
1918 - "error %d for device: %s",
1919 - rc, dev_name(&device->cdev->dev));
1920 + DBF_EVENT_DEVID(DBF_WARNING, cdev, "Read device "
1921 + "characteristics returned error %d", rc);
1922 device->block = NULL;
1923 dasd_free_block(block);
1924 device->private = NULL;
1925 diff --git a/drivers/s390/block/dasd_int.h b/drivers/s390/block/dasd_int.h
1926 index 8afd9fa..b19f309 100644
1927 --- a/drivers/s390/block/dasd_int.h
1928 +++ b/drivers/s390/block/dasd_int.h
1929 @@ -108,6 +108,16 @@ do { \
1930 d_data); \
1931 } while(0)
1932
1933 +#define DBF_EVENT_DEVID(d_level, d_cdev, d_str, d_data...) \
1934 +do { \
1935 + struct ccw_dev_id __dev_id; \
1936 + ccw_device_get_id(d_cdev, &__dev_id); \
1937 + debug_sprintf_event(dasd_debug_area, \
1938 + d_level, \
1939 + "0.%x.%04x " d_str "\n", \
1940 + __dev_id.ssid, __dev_id.devno, d_data); \
1941 +} while (0)
1942 +
1943 #define DBF_EXC(d_level, d_str, d_data...)\
1944 do { \
1945 debug_sprintf_exception(dasd_debug_area, \
1946 diff --git a/drivers/serial/8250.c b/drivers/serial/8250.c
1947 index 807042b..5ed1b82 100644
1948 --- a/drivers/serial/8250.c
1949 +++ b/drivers/serial/8250.c
1950 @@ -83,6 +83,9 @@ static unsigned int skip_txen_test; /* force skip of txen test at init time */
1951
1952 #define PASS_LIMIT 256
1953
1954 +#define BOTH_EMPTY (UART_LSR_TEMT | UART_LSR_THRE)
1955 +
1956 +
1957 /*
1958 * We default to IRQ0 for the "no irq" hack. Some
1959 * machine types want others as well - they're free
1960 @@ -1792,7 +1795,7 @@ static unsigned int serial8250_tx_empty(struct uart_port *port)
1961 up->lsr_saved_flags |= lsr & LSR_SAVE_FLAGS;
1962 spin_unlock_irqrestore(&up->port.lock, flags);
1963
1964 - return lsr & UART_LSR_TEMT ? TIOCSER_TEMT : 0;
1965 + return (lsr & BOTH_EMPTY) == BOTH_EMPTY ? TIOCSER_TEMT : 0;
1966 }
1967
1968 static unsigned int serial8250_get_mctrl(struct uart_port *port)
1969 @@ -1850,8 +1853,6 @@ static void serial8250_break_ctl(struct uart_port *port, int break_state)
1970 spin_unlock_irqrestore(&up->port.lock, flags);
1971 }
1972
1973 -#define BOTH_EMPTY (UART_LSR_TEMT | UART_LSR_THRE)
1974 -
1975 /*
1976 * Wait for transmitter & holding register to empty
1977 */
1978 diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211.h b/drivers/staging/rtl8187se/ieee80211/ieee80211.h
1979 index 3222c22..0d490c1 100644
1980 --- a/drivers/staging/rtl8187se/ieee80211/ieee80211.h
1981 +++ b/drivers/staging/rtl8187se/ieee80211/ieee80211.h
1982 @@ -1318,13 +1318,13 @@ extern int ieee80211_encrypt_fragment(
1983 struct sk_buff *frag,
1984 int hdr_len);
1985
1986 -extern int ieee80211_xmit(struct sk_buff *skb,
1987 +extern int ieee80211_rtl_xmit(struct sk_buff *skb,
1988 struct net_device *dev);
1989 extern void ieee80211_txb_free(struct ieee80211_txb *);
1990
1991
1992 /* ieee80211_rx.c */
1993 -extern int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
1994 +extern int ieee80211_rtl_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
1995 struct ieee80211_rx_stats *rx_stats);
1996 extern void ieee80211_rx_mgt(struct ieee80211_device *ieee,
1997 struct ieee80211_hdr_4addr *header,
1998 @@ -1376,8 +1376,8 @@ extern void ieee80211_stop_protocol(struct ieee80211_device *ieee);
1999 extern void ieee80211_softmac_start_protocol(struct ieee80211_device *ieee);
2000 extern void ieee80211_softmac_stop_protocol(struct ieee80211_device *ieee);
2001 extern void ieee80211_reset_queue(struct ieee80211_device *ieee);
2002 -extern void ieee80211_wake_queue(struct ieee80211_device *ieee);
2003 -extern void ieee80211_stop_queue(struct ieee80211_device *ieee);
2004 +extern void ieee80211_rtl_wake_queue(struct ieee80211_device *ieee);
2005 +extern void ieee80211_rtl_stop_queue(struct ieee80211_device *ieee);
2006 extern struct sk_buff *ieee80211_get_beacon(struct ieee80211_device *ieee);
2007 extern void ieee80211_start_send_beacons(struct ieee80211_device *ieee);
2008 extern void ieee80211_stop_send_beacons(struct ieee80211_device *ieee);
2009 @@ -1385,7 +1385,7 @@ extern int ieee80211_wpa_supplicant_ioctl(struct ieee80211_device *ieee, struct
2010 extern void notify_wx_assoc_event(struct ieee80211_device *ieee);
2011 extern void ieee80211_ps_tx_ack(struct ieee80211_device *ieee, short success);
2012 extern void SendDisassociation(struct ieee80211_device *ieee,u8* asSta,u8 asRsn);
2013 -extern void ieee80211_start_scan(struct ieee80211_device *ieee);
2014 +extern void ieee80211_rtl_start_scan(struct ieee80211_device *ieee);
2015
2016 //Add for RF power on power off by lizhaoming 080512
2017 extern void SendDisassociation(struct ieee80211_device *ieee,
2018 diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211_rx.c b/drivers/staging/rtl8187se/ieee80211/ieee80211_rx.c
2019 index 5e2e79b..7ad305b 100644
2020 --- a/drivers/staging/rtl8187se/ieee80211/ieee80211_rx.c
2021 +++ b/drivers/staging/rtl8187se/ieee80211/ieee80211_rx.c
2022 @@ -470,7 +470,7 @@ drop:
2023 /* All received frames are sent to this function. @skb contains the frame in
2024 * IEEE 802.11 format, i.e., in the format it was sent over air.
2025 * This function is called only as a tasklet (software IRQ). */
2026 -int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
2027 +int ieee80211_rtl_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
2028 struct ieee80211_rx_stats *rx_stats)
2029 {
2030 struct net_device *dev = ieee->dev;
2031 diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac.c b/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac.c
2032 index 334e4c7..a2fa9a9 100644
2033 --- a/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac.c
2034 +++ b/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac.c
2035 @@ -689,7 +689,7 @@ void ieee80211_stop_scan(struct ieee80211_device *ieee)
2036 }
2037
2038 /* called with ieee->lock held */
2039 -void ieee80211_start_scan(struct ieee80211_device *ieee)
2040 +void ieee80211_rtl_start_scan(struct ieee80211_device *ieee)
2041 {
2042 if(IS_DOT11D_ENABLE(ieee) )
2043 {
2044 @@ -1196,7 +1196,7 @@ void ieee80211_associate_step1(struct ieee80211_device *ieee)
2045 }
2046 }
2047
2048 -void ieee80211_auth_challenge(struct ieee80211_device *ieee, u8 *challenge, int chlen)
2049 +void ieee80211_rtl_auth_challenge(struct ieee80211_device *ieee, u8 *challenge, int chlen)
2050 {
2051 u8 *c;
2052 struct sk_buff *skb;
2053 @@ -1898,7 +1898,7 @@ associate_complete:
2054
2055 ieee80211_associate_step2(ieee);
2056 }else{
2057 - ieee80211_auth_challenge(ieee, challenge, chlen);
2058 + ieee80211_rtl_auth_challenge(ieee, challenge, chlen);
2059 }
2060 }else{
2061 ieee->softmac_stats.rx_auth_rs_err++;
2062 @@ -2047,7 +2047,7 @@ void ieee80211_reset_queue(struct ieee80211_device *ieee)
2063
2064 }
2065
2066 -void ieee80211_wake_queue(struct ieee80211_device *ieee)
2067 +void ieee80211_rtl_wake_queue(struct ieee80211_device *ieee)
2068 {
2069
2070 unsigned long flags;
2071 @@ -2089,7 +2089,7 @@ exit :
2072 }
2073
2074
2075 -void ieee80211_stop_queue(struct ieee80211_device *ieee)
2076 +void ieee80211_rtl_stop_queue(struct ieee80211_device *ieee)
2077 {
2078 //unsigned long flags;
2079 //spin_lock_irqsave(&ieee->lock,flags);
2080 @@ -2301,7 +2301,7 @@ void ieee80211_start_bss(struct ieee80211_device *ieee)
2081 //#else
2082 if (ieee->state == IEEE80211_NOLINK){
2083 ieee->actscanning = true;
2084 - ieee80211_start_scan(ieee);
2085 + ieee80211_rtl_start_scan(ieee);
2086 }
2087 //#endif
2088 spin_unlock_irqrestore(&ieee->lock, flags);
2089 @@ -2357,7 +2357,7 @@ void ieee80211_associate_retry_wq(struct work_struct *work)
2090 if(ieee->state == IEEE80211_NOLINK){
2091 ieee->beinretry = false;
2092 ieee->actscanning = true;
2093 - ieee80211_start_scan(ieee);
2094 + ieee80211_rtl_start_scan(ieee);
2095 }
2096 //YJ,add,080828, notify os here
2097 if(ieee->state == IEEE80211_NOLINK)
2098 diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211_tx.c b/drivers/staging/rtl8187se/ieee80211/ieee80211_tx.c
2099 index e2945db..c7996ea 100644
2100 --- a/drivers/staging/rtl8187se/ieee80211/ieee80211_tx.c
2101 +++ b/drivers/staging/rtl8187se/ieee80211/ieee80211_tx.c
2102 @@ -305,7 +305,7 @@ ieee80211_classify(struct sk_buff *skb, struct ieee80211_network *network)
2103 }
2104
2105 /* SKBs are added to the ieee->tx_queue. */
2106 -int ieee80211_xmit(struct sk_buff *skb,
2107 +int ieee80211_rtl_xmit(struct sk_buff *skb,
2108 struct net_device *dev)
2109 {
2110 struct ieee80211_device *ieee = netdev_priv(dev);
2111 diff --git a/drivers/staging/rtl8187se/r8180_core.c b/drivers/staging/rtl8187se/r8180_core.c
2112 index 53e654d..3f19143 100644
2113 --- a/drivers/staging/rtl8187se/r8180_core.c
2114 +++ b/drivers/staging/rtl8187se/r8180_core.c
2115 @@ -1830,7 +1830,7 @@ void rtl8180_rx(struct net_device *dev)
2116 if(priv->rx_skb->len > 4)
2117 skb_trim(priv->rx_skb,priv->rx_skb->len-4);
2118 #ifndef RX_DONT_PASS_UL
2119 - if(!ieee80211_rx(priv->ieee80211,
2120 + if(!ieee80211_rtl_rx(priv->ieee80211,
2121 priv->rx_skb, &stats)){
2122 #endif // RX_DONT_PASS_UL
2123
2124 @@ -1936,11 +1936,11 @@ rate)
2125 if (!check_nic_enought_desc(dev, priority)){
2126 DMESGW("Error: no descriptor left by previous TX (avail %d) ",
2127 get_curr_tx_free_desc(dev, priority));
2128 - ieee80211_stop_queue(priv->ieee80211);
2129 + ieee80211_rtl_stop_queue(priv->ieee80211);
2130 }
2131 rtl8180_tx(dev, skb->data, skb->len, priority, morefrag,0,rate);
2132 if (!check_nic_enought_desc(dev, priority))
2133 - ieee80211_stop_queue(priv->ieee80211);
2134 + ieee80211_rtl_stop_queue(priv->ieee80211);
2135
2136 spin_unlock_irqrestore(&priv->tx_lock,flags);
2137 }
2138 @@ -3846,7 +3846,7 @@ static const struct net_device_ops rtl8180_netdev_ops = {
2139 .ndo_set_mac_address = r8180_set_mac_adr,
2140 .ndo_validate_addr = eth_validate_addr,
2141 .ndo_change_mtu = eth_change_mtu,
2142 - .ndo_start_xmit = ieee80211_xmit,
2143 + .ndo_start_xmit = ieee80211_rtl_xmit,
2144 };
2145
2146 static int __devinit rtl8180_pci_probe(struct pci_dev *pdev,
2147 @@ -4066,7 +4066,7 @@ void rtl8180_try_wake_queue(struct net_device *dev, int pri)
2148 spin_unlock_irqrestore(&priv->tx_lock,flags);
2149
2150 if(enough_desc)
2151 - ieee80211_wake_queue(priv->ieee80211);
2152 + ieee80211_rtl_wake_queue(priv->ieee80211);
2153 }
2154
2155 void rtl8180_tx_isr(struct net_device *dev, int pri,short error)
2156 diff --git a/drivers/staging/rtl8187se/r8180_wx.c b/drivers/staging/rtl8187se/r8180_wx.c
2157 index 766892e..637ee8e 100644
2158 --- a/drivers/staging/rtl8187se/r8180_wx.c
2159 +++ b/drivers/staging/rtl8187se/r8180_wx.c
2160 @@ -377,7 +377,7 @@ static int r8180_wx_set_scan(struct net_device *dev, struct iw_request_info *a,
2161 // queue_work(priv->ieee80211->wq, &priv->ieee80211->wx_sync_scan_wq);
2162 //printk("start scan============================>\n");
2163 ieee80211_softmac_ips_scan_syncro(priv->ieee80211);
2164 -//ieee80211_start_scan(priv->ieee80211);
2165 +//ieee80211_rtl_start_scan(priv->ieee80211);
2166 /* intentionally forget to up sem */
2167 // up(&priv->ieee80211->wx_sem);
2168 ret = 0;
2169 diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
2170 index 181f78c..24120db 100644
2171 --- a/drivers/usb/core/devio.c
2172 +++ b/drivers/usb/core/devio.c
2173 @@ -1312,9 +1312,9 @@ static int processcompl(struct async *as, void __user * __user *arg)
2174 void __user *addr = as->userurb;
2175 unsigned int i;
2176
2177 - if (as->userbuffer)
2178 + if (as->userbuffer && urb->actual_length)
2179 if (copy_to_user(as->userbuffer, urb->transfer_buffer,
2180 - urb->transfer_buffer_length))
2181 + urb->actual_length))
2182 goto err_out;
2183 if (put_user(as->status, &userurb->status))
2184 goto err_out;
2185 @@ -1334,14 +1334,11 @@ static int processcompl(struct async *as, void __user * __user *arg)
2186 }
2187 }
2188
2189 - free_async(as);
2190 -
2191 if (put_user(addr, (void __user * __user *)arg))
2192 return -EFAULT;
2193 return 0;
2194
2195 err_out:
2196 - free_async(as);
2197 return -EFAULT;
2198 }
2199
2200 @@ -1371,8 +1368,11 @@ static struct async *reap_as(struct dev_state *ps)
2201 static int proc_reapurb(struct dev_state *ps, void __user *arg)
2202 {
2203 struct async *as = reap_as(ps);
2204 - if (as)
2205 - return processcompl(as, (void __user * __user *)arg);
2206 + if (as) {
2207 + int retval = processcompl(as, (void __user * __user *)arg);
2208 + free_async(as);
2209 + return retval;
2210 + }
2211 if (signal_pending(current))
2212 return -EINTR;
2213 return -EIO;
2214 @@ -1380,11 +1380,16 @@ static int proc_reapurb(struct dev_state *ps, void __user *arg)
2215
2216 static int proc_reapurbnonblock(struct dev_state *ps, void __user *arg)
2217 {
2218 + int retval;
2219 struct async *as;
2220
2221 - if (!(as = async_getcompleted(ps)))
2222 - return -EAGAIN;
2223 - return processcompl(as, (void __user * __user *)arg);
2224 + as = async_getcompleted(ps);
2225 + retval = -EAGAIN;
2226 + if (as) {
2227 + retval = processcompl(as, (void __user * __user *)arg);
2228 + free_async(as);
2229 + }
2230 + return retval;
2231 }
2232
2233 #ifdef CONFIG_COMPAT
2234 @@ -1435,9 +1440,9 @@ static int processcompl_compat(struct async *as, void __user * __user *arg)
2235 void __user *addr = as->userurb;
2236 unsigned int i;
2237
2238 - if (as->userbuffer)
2239 + if (as->userbuffer && urb->actual_length)
2240 if (copy_to_user(as->userbuffer, urb->transfer_buffer,
2241 - urb->transfer_buffer_length))
2242 + urb->actual_length))
2243 return -EFAULT;
2244 if (put_user(as->status, &userurb->status))
2245 return -EFAULT;
2246 @@ -1457,7 +1462,6 @@ static int processcompl_compat(struct async *as, void __user * __user *arg)
2247 }
2248 }
2249
2250 - free_async(as);
2251 if (put_user(ptr_to_compat(addr), (u32 __user *)arg))
2252 return -EFAULT;
2253 return 0;
2254 @@ -1466,8 +1470,11 @@ static int processcompl_compat(struct async *as, void __user * __user *arg)
2255 static int proc_reapurb_compat(struct dev_state *ps, void __user *arg)
2256 {
2257 struct async *as = reap_as(ps);
2258 - if (as)
2259 - return processcompl_compat(as, (void __user * __user *)arg);
2260 + if (as) {
2261 + int retval = processcompl_compat(as, (void __user * __user *)arg);
2262 + free_async(as);
2263 + return retval;
2264 + }
2265 if (signal_pending(current))
2266 return -EINTR;
2267 return -EIO;
2268 @@ -1475,11 +1482,16 @@ static int proc_reapurb_compat(struct dev_state *ps, void __user *arg)
2269
2270 static int proc_reapurbnonblock_compat(struct dev_state *ps, void __user *arg)
2271 {
2272 + int retval;
2273 struct async *as;
2274
2275 - if (!(as = async_getcompleted(ps)))
2276 - return -EAGAIN;
2277 - return processcompl_compat(as, (void __user * __user *)arg);
2278 + retval = -EAGAIN;
2279 + as = async_getcompleted(ps);
2280 + if (as) {
2281 + retval = processcompl_compat(as, (void __user * __user *)arg);
2282 + free_async(as);
2283 + }
2284 + return retval;
2285 }
2286
2287 #endif
2288 diff --git a/drivers/usb/host/r8a66597-hcd.c b/drivers/usb/host/r8a66597-hcd.c
2289 index 5b56f53..9260c74 100644
2290 --- a/drivers/usb/host/r8a66597-hcd.c
2291 +++ b/drivers/usb/host/r8a66597-hcd.c
2292 @@ -35,7 +35,9 @@
2293 #include <linux/usb.h>
2294 #include <linux/platform_device.h>
2295 #include <linux/io.h>
2296 +#include <linux/mm.h>
2297 #include <linux/irq.h>
2298 +#include <asm/cacheflush.h>
2299
2300 #include "../core/hcd.h"
2301 #include "r8a66597.h"
2302 @@ -820,6 +822,26 @@ static void enable_r8a66597_pipe(struct r8a66597 *r8a66597, struct urb *urb,
2303 enable_r8a66597_pipe_dma(r8a66597, dev, pipe, urb);
2304 }
2305
2306 +static void r8a66597_urb_done(struct r8a66597 *r8a66597, struct urb *urb,
2307 + int status)
2308 +__releases(r8a66597->lock)
2309 +__acquires(r8a66597->lock)
2310 +{
2311 + if (usb_pipein(urb->pipe) && usb_pipetype(urb->pipe) != PIPE_CONTROL) {
2312 + void *ptr;
2313 +
2314 + for (ptr = urb->transfer_buffer;
2315 + ptr < urb->transfer_buffer + urb->transfer_buffer_length;
2316 + ptr += PAGE_SIZE)
2317 + flush_dcache_page(virt_to_page(ptr));
2318 + }
2319 +
2320 + usb_hcd_unlink_urb_from_ep(r8a66597_to_hcd(r8a66597), urb);
2321 + spin_unlock(&r8a66597->lock);
2322 + usb_hcd_giveback_urb(r8a66597_to_hcd(r8a66597), urb, status);
2323 + spin_lock(&r8a66597->lock);
2324 +}
2325 +
2326 /* this function must be called with interrupt disabled */
2327 static void force_dequeue(struct r8a66597 *r8a66597, u16 pipenum, u16 address)
2328 {
2329 @@ -840,15 +862,9 @@ static void force_dequeue(struct r8a66597 *r8a66597, u16 pipenum, u16 address)
2330 list_del(&td->queue);
2331 kfree(td);
2332
2333 - if (urb) {
2334 - usb_hcd_unlink_urb_from_ep(r8a66597_to_hcd(r8a66597),
2335 - urb);
2336 + if (urb)
2337 + r8a66597_urb_done(r8a66597, urb, -ENODEV);
2338
2339 - spin_unlock(&r8a66597->lock);
2340 - usb_hcd_giveback_urb(r8a66597_to_hcd(r8a66597), urb,
2341 - -ENODEV);
2342 - spin_lock(&r8a66597->lock);
2343 - }
2344 break;
2345 }
2346 }
2347 @@ -1285,10 +1301,7 @@ __releases(r8a66597->lock) __acquires(r8a66597->lock)
2348 if (usb_pipeisoc(urb->pipe))
2349 urb->start_frame = r8a66597_get_frame(hcd);
2350
2351 - usb_hcd_unlink_urb_from_ep(r8a66597_to_hcd(r8a66597), urb);
2352 - spin_unlock(&r8a66597->lock);
2353 - usb_hcd_giveback_urb(hcd, urb, status);
2354 - spin_lock(&r8a66597->lock);
2355 + r8a66597_urb_done(r8a66597, urb, status);
2356 }
2357
2358 if (restart) {
2359 diff --git a/fs/befs/linuxvfs.c b/fs/befs/linuxvfs.c
2360 index 33baf27..34ddda8 100644
2361 --- a/fs/befs/linuxvfs.c
2362 +++ b/fs/befs/linuxvfs.c
2363 @@ -873,6 +873,7 @@ befs_fill_super(struct super_block *sb, void *data, int silent)
2364 brelse(bh);
2365
2366 unacquire_priv_sbp:
2367 + kfree(befs_sb->mount_opts.iocharset);
2368 kfree(sb->s_fs_info);
2369
2370 unacquire_none:
2371 diff --git a/fs/block_dev.c b/fs/block_dev.c
2372 index 8bed055..34e2d20 100644
2373 --- a/fs/block_dev.c
2374 +++ b/fs/block_dev.c
2375 @@ -246,7 +246,8 @@ struct super_block *freeze_bdev(struct block_device *bdev)
2376 if (!sb)
2377 goto out;
2378 if (sb->s_flags & MS_RDONLY) {
2379 - deactivate_locked_super(sb);
2380 + sb->s_frozen = SB_FREEZE_TRANS;
2381 + up_write(&sb->s_umount);
2382 mutex_unlock(&bdev->bd_fsfreeze_mutex);
2383 return sb;
2384 }
2385 @@ -307,7 +308,7 @@ int thaw_bdev(struct block_device *bdev, struct super_block *sb)
2386 BUG_ON(sb->s_bdev != bdev);
2387 down_write(&sb->s_umount);
2388 if (sb->s_flags & MS_RDONLY)
2389 - goto out_deactivate;
2390 + goto out_unfrozen;
2391
2392 if (sb->s_op->unfreeze_fs) {
2393 error = sb->s_op->unfreeze_fs(sb);
2394 @@ -321,11 +322,11 @@ int thaw_bdev(struct block_device *bdev, struct super_block *sb)
2395 }
2396 }
2397
2398 +out_unfrozen:
2399 sb->s_frozen = SB_UNFROZEN;
2400 smp_wmb();
2401 wake_up(&sb->s_wait_unfrozen);
2402
2403 -out_deactivate:
2404 if (sb)
2405 deactivate_locked_super(sb);
2406 out_unlock:
2407 diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
2408 index f84062f..f5618f8 100644
2409 --- a/fs/cifs/readdir.c
2410 +++ b/fs/cifs/readdir.c
2411 @@ -666,6 +666,7 @@ static int cifs_get_name_from_search_buf(struct qstr *pqst,
2412 min(len, max_len), nlt,
2413 cifs_sb->mnt_cifs_flags &
2414 CIFS_MOUNT_MAP_SPECIAL_CHR);
2415 + pqst->len -= nls_nullsize(nlt);
2416 } else {
2417 pqst->name = filename;
2418 pqst->len = len;
2419 diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
2420 index 056fed6..728f07e 100644
2421 --- a/fs/ecryptfs/inode.c
2422 +++ b/fs/ecryptfs/inode.c
2423 @@ -971,6 +971,21 @@ out:
2424 return rc;
2425 }
2426
2427 +int ecryptfs_getattr(struct vfsmount *mnt, struct dentry *dentry,
2428 + struct kstat *stat)
2429 +{
2430 + struct kstat lower_stat;
2431 + int rc;
2432 +
2433 + rc = vfs_getattr(ecryptfs_dentry_to_lower_mnt(dentry),
2434 + ecryptfs_dentry_to_lower(dentry), &lower_stat);
2435 + if (!rc) {
2436 + generic_fillattr(dentry->d_inode, stat);
2437 + stat->blocks = lower_stat.blocks;
2438 + }
2439 + return rc;
2440 +}
2441 +
2442 int
2443 ecryptfs_setxattr(struct dentry *dentry, const char *name, const void *value,
2444 size_t size, int flags)
2445 @@ -1100,6 +1115,7 @@ const struct inode_operations ecryptfs_dir_iops = {
2446 const struct inode_operations ecryptfs_main_iops = {
2447 .permission = ecryptfs_permission,
2448 .setattr = ecryptfs_setattr,
2449 + .getattr = ecryptfs_getattr,
2450 .setxattr = ecryptfs_setxattr,
2451 .getxattr = ecryptfs_getxattr,
2452 .listxattr = ecryptfs_listxattr,
2453 diff --git a/fs/exec.c b/fs/exec.c
2454 index 7fa4efd..da36c20 100644
2455 --- a/fs/exec.c
2456 +++ b/fs/exec.c
2457 @@ -572,6 +572,9 @@ int setup_arg_pages(struct linux_binprm *bprm,
2458 struct vm_area_struct *prev = NULL;
2459 unsigned long vm_flags;
2460 unsigned long stack_base;
2461 + unsigned long stack_size;
2462 + unsigned long stack_expand;
2463 + unsigned long rlim_stack;
2464
2465 #ifdef CONFIG_STACK_GROWSUP
2466 /* Limit stack size to 1GB */
2467 @@ -628,10 +631,24 @@ int setup_arg_pages(struct linux_binprm *bprm,
2468 goto out_unlock;
2469 }
2470
2471 + stack_expand = EXTRA_STACK_VM_PAGES * PAGE_SIZE;
2472 + stack_size = vma->vm_end - vma->vm_start;
2473 + /*
2474 + * Align this down to a page boundary as expand_stack
2475 + * will align it up.
2476 + */
2477 + rlim_stack = rlimit(RLIMIT_STACK) & PAGE_MASK;
2478 + rlim_stack = min(rlim_stack, stack_size);
2479 #ifdef CONFIG_STACK_GROWSUP
2480 - stack_base = vma->vm_end + EXTRA_STACK_VM_PAGES * PAGE_SIZE;
2481 + if (stack_size + stack_expand > rlim_stack)
2482 + stack_base = vma->vm_start + rlim_stack;
2483 + else
2484 + stack_base = vma->vm_end + stack_expand;
2485 #else
2486 - stack_base = vma->vm_start - EXTRA_STACK_VM_PAGES * PAGE_SIZE;
2487 + if (stack_size + stack_expand > rlim_stack)
2488 + stack_base = vma->vm_end - rlim_stack;
2489 + else
2490 + stack_base = vma->vm_start - stack_expand;
2491 #endif
2492 ret = expand_stack(vma, stack_base);
2493 if (ret)
2494 diff --git a/fs/fcntl.c b/fs/fcntl.c
2495 index 5ef953e..97e01dc 100644
2496 --- a/fs/fcntl.c
2497 +++ b/fs/fcntl.c
2498 @@ -199,9 +199,7 @@ static int setfl(int fd, struct file * filp, unsigned long arg)
2499 static void f_modown(struct file *filp, struct pid *pid, enum pid_type type,
2500 int force)
2501 {
2502 - unsigned long flags;
2503 -
2504 - write_lock_irqsave(&filp->f_owner.lock, flags);
2505 + write_lock_irq(&filp->f_owner.lock);
2506 if (force || !filp->f_owner.pid) {
2507 put_pid(filp->f_owner.pid);
2508 filp->f_owner.pid = get_pid(pid);
2509 @@ -213,7 +211,7 @@ static void f_modown(struct file *filp, struct pid *pid, enum pid_type type,
2510 filp->f_owner.euid = cred->euid;
2511 }
2512 }
2513 - write_unlock_irqrestore(&filp->f_owner.lock, flags);
2514 + write_unlock_irq(&filp->f_owner.lock);
2515 }
2516
2517 int __f_setown(struct file *filp, struct pid *pid, enum pid_type type,
2518 diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
2519 index e1d415e..0d28982 100644
2520 --- a/fs/nfs/direct.c
2521 +++ b/fs/nfs/direct.c
2522 @@ -342,6 +342,7 @@ static ssize_t nfs_direct_read_schedule_segment(struct nfs_direct_req *dreq,
2523 data->res.fattr = &data->fattr;
2524 data->res.eof = 0;
2525 data->res.count = bytes;
2526 + nfs_fattr_init(&data->fattr);
2527 msg.rpc_argp = &data->args;
2528 msg.rpc_resp = &data->res;
2529
2530 @@ -575,6 +576,7 @@ static void nfs_direct_commit_schedule(struct nfs_direct_req *dreq)
2531 data->res.count = 0;
2532 data->res.fattr = &data->fattr;
2533 data->res.verf = &data->verf;
2534 + nfs_fattr_init(&data->fattr);
2535
2536 NFS_PROTO(data->inode)->commit_setup(data, &msg);
2537
2538 @@ -766,6 +768,7 @@ static ssize_t nfs_direct_write_schedule_segment(struct nfs_direct_req *dreq,
2539 data->res.fattr = &data->fattr;
2540 data->res.count = bytes;
2541 data->res.verf = &data->verf;
2542 + nfs_fattr_init(&data->fattr);
2543
2544 task_setup_data.task = &data->task;
2545 task_setup_data.callback_data = data;
2546 diff --git a/fs/nfs/file.c b/fs/nfs/file.c
2547 index f5fdd39..393d40f 100644
2548 --- a/fs/nfs/file.c
2549 +++ b/fs/nfs/file.c
2550 @@ -486,6 +486,8 @@ static int nfs_release_page(struct page *page, gfp_t gfp)
2551 {
2552 dfprintk(PAGECACHE, "NFS: release_page(%p)\n", page);
2553
2554 + if (gfp & __GFP_WAIT)
2555 + nfs_wb_page(page->mapping->host, page);
2556 /* If PagePrivate() is set, then the page is not freeable */
2557 if (PagePrivate(page))
2558 return 0;
2559 diff --git a/fs/nfs/fscache.c b/fs/nfs/fscache.c
2560 index fa58800..237874f 100644
2561 --- a/fs/nfs/fscache.c
2562 +++ b/fs/nfs/fscache.c
2563 @@ -354,12 +354,11 @@ void nfs_fscache_reset_inode_cookie(struct inode *inode)
2564 */
2565 int nfs_fscache_release_page(struct page *page, gfp_t gfp)
2566 {
2567 - struct nfs_inode *nfsi = NFS_I(page->mapping->host);
2568 - struct fscache_cookie *cookie = nfsi->fscache;
2569 -
2570 - BUG_ON(!cookie);
2571 -
2572 if (PageFsCache(page)) {
2573 + struct nfs_inode *nfsi = NFS_I(page->mapping->host);
2574 + struct fscache_cookie *cookie = nfsi->fscache;
2575 +
2576 + BUG_ON(!cookie);
2577 dfprintk(FSCACHE, "NFS: fscache releasepage (0x%p/0x%p/0x%p)\n",
2578 cookie, page, nfsi);
2579
2580 diff --git a/fs/nfs/mount_clnt.c b/fs/nfs/mount_clnt.c
2581 index 0adefc4..59047f8 100644
2582 --- a/fs/nfs/mount_clnt.c
2583 +++ b/fs/nfs/mount_clnt.c
2584 @@ -120,7 +120,7 @@ static struct {
2585 { .status = MNT3ERR_INVAL, .errno = -EINVAL, },
2586 { .status = MNT3ERR_NAMETOOLONG, .errno = -ENAMETOOLONG, },
2587 { .status = MNT3ERR_NOTSUPP, .errno = -ENOTSUPP, },
2588 - { .status = MNT3ERR_SERVERFAULT, .errno = -ESERVERFAULT, },
2589 + { .status = MNT3ERR_SERVERFAULT, .errno = -EREMOTEIO, },
2590 };
2591
2592 struct mountres {
2593 diff --git a/fs/nfs/nfs2xdr.c b/fs/nfs/nfs2xdr.c
2594 index 5e078b2..7bc2da8 100644
2595 --- a/fs/nfs/nfs2xdr.c
2596 +++ b/fs/nfs/nfs2xdr.c
2597 @@ -699,7 +699,7 @@ static struct {
2598 { NFSERR_BAD_COOKIE, -EBADCOOKIE },
2599 { NFSERR_NOTSUPP, -ENOTSUPP },
2600 { NFSERR_TOOSMALL, -ETOOSMALL },
2601 - { NFSERR_SERVERFAULT, -ESERVERFAULT },
2602 + { NFSERR_SERVERFAULT, -EREMOTEIO },
2603 { NFSERR_BADTYPE, -EBADTYPE },
2604 { NFSERR_JUKEBOX, -EJUKEBOX },
2605 { -1, -EIO }
2606 diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
2607 index 6ea07a3..b4a6b1a 100644
2608 --- a/fs/nfs/nfs4_fs.h
2609 +++ b/fs/nfs/nfs4_fs.h
2610 @@ -141,6 +141,7 @@ enum {
2611 NFS_O_RDWR_STATE, /* OPEN stateid has read/write state */
2612 NFS_STATE_RECLAIM_REBOOT, /* OPEN stateid server rebooted */
2613 NFS_STATE_RECLAIM_NOGRACE, /* OPEN stateid needs to recover state */
2614 + NFS_STATE_POSIX_LOCKS, /* Posix locks are supported */
2615 };
2616
2617 struct nfs4_state {
2618 diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
2619 index 741a562..6c20059 100644
2620 --- a/fs/nfs/nfs4proc.c
2621 +++ b/fs/nfs/nfs4proc.c
2622 @@ -1573,6 +1573,8 @@ static int _nfs4_do_open(struct inode *dir, struct path *path, fmode_t fmode, in
2623 status = PTR_ERR(state);
2624 if (IS_ERR(state))
2625 goto err_opendata_put;
2626 + if ((opendata->o_res.rflags & NFS4_OPEN_RESULT_LOCKTYPE_POSIX) != 0)
2627 + set_bit(NFS_STATE_POSIX_LOCKS, &state->flags);
2628 nfs4_opendata_put(opendata);
2629 nfs4_put_state_owner(sp);
2630 *res = state;
2631 @@ -3976,6 +3978,22 @@ static const struct rpc_call_ops nfs4_lock_ops = {
2632 .rpc_release = nfs4_lock_release,
2633 };
2634
2635 +static void nfs4_handle_setlk_error(struct nfs_server *server, struct nfs4_lock_state *lsp, int new_lock_owner, int error)
2636 +{
2637 + struct nfs_client *clp = server->nfs_client;
2638 + struct nfs4_state *state = lsp->ls_state;
2639 +
2640 + switch (error) {
2641 + case -NFS4ERR_ADMIN_REVOKED:
2642 + case -NFS4ERR_BAD_STATEID:
2643 + case -NFS4ERR_EXPIRED:
2644 + if (new_lock_owner != 0 ||
2645 + (lsp->ls_flags & NFS_LOCK_INITIALIZED) != 0)
2646 + nfs4_state_mark_reclaim_nograce(clp, state);
2647 + lsp->ls_seqid.flags &= ~NFS_SEQID_CONFIRMED;
2648 + };
2649 +}
2650 +
2651 static int _nfs4_do_setlk(struct nfs4_state *state, int cmd, struct file_lock *fl, int reclaim)
2652 {
2653 struct nfs4_lockdata *data;
2654 @@ -4011,6 +4029,9 @@ static int _nfs4_do_setlk(struct nfs4_state *state, int cmd, struct file_lock *f
2655 ret = nfs4_wait_for_completion_rpc_task(task);
2656 if (ret == 0) {
2657 ret = data->rpc_status;
2658 + if (ret)
2659 + nfs4_handle_setlk_error(data->server, data->lsp,
2660 + data->arg.new_lock_owner, ret);
2661 } else
2662 data->cancelled = 1;
2663 rpc_put_task(task);
2664 @@ -4060,8 +4081,11 @@ static int _nfs4_proc_setlk(struct nfs4_state *state, int cmd, struct file_lock
2665 {
2666 struct nfs_inode *nfsi = NFS_I(state->inode);
2667 unsigned char fl_flags = request->fl_flags;
2668 - int status;
2669 + int status = -ENOLCK;
2670
2671 + if ((fl_flags & FL_POSIX) &&
2672 + !test_bit(NFS_STATE_POSIX_LOCKS, &state->flags))
2673 + goto out;
2674 /* Is this a delegated open? */
2675 status = nfs4_set_lock_state(state, request);
2676 if (status != 0)
2677 diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
2678 index 20b4e30..a4cd1b7 100644
2679 --- a/fs/nfs/nfs4xdr.c
2680 +++ b/fs/nfs/nfs4xdr.c
2681 @@ -4554,7 +4554,7 @@ static int decode_sequence(struct xdr_stream *xdr,
2682 * If the server returns different values for sessionID, slotID or
2683 * sequence number, the server is looney tunes.
2684 */
2685 - status = -ESERVERFAULT;
2686 + status = -EREMOTEIO;
2687
2688 if (memcmp(id.data, res->sr_session->sess_id.data,
2689 NFS4_MAX_SESSIONID_LEN)) {
2690 @@ -5678,7 +5678,7 @@ static struct {
2691 { NFS4ERR_BAD_COOKIE, -EBADCOOKIE },
2692 { NFS4ERR_NOTSUPP, -ENOTSUPP },
2693 { NFS4ERR_TOOSMALL, -ETOOSMALL },
2694 - { NFS4ERR_SERVERFAULT, -ESERVERFAULT },
2695 + { NFS4ERR_SERVERFAULT, -EREMOTEIO },
2696 { NFS4ERR_BADTYPE, -EBADTYPE },
2697 { NFS4ERR_LOCKED, -EAGAIN },
2698 { NFS4ERR_SYMLINK, -ELOOP },
2699 @@ -5705,7 +5705,7 @@ nfs4_stat_to_errno(int stat)
2700 }
2701 if (stat <= 10000 || stat > 10100) {
2702 /* The server is looney tunes. */
2703 - return -ESERVERFAULT;
2704 + return -EREMOTEIO;
2705 }
2706 /* If we cannot translate the error, the recovery routines should
2707 * handle it.
2708 diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
2709 index e297593..a12c45b 100644
2710 --- a/fs/nfs/pagelist.c
2711 +++ b/fs/nfs/pagelist.c
2712 @@ -176,6 +176,12 @@ void nfs_release_request(struct nfs_page *req)
2713 kref_put(&req->wb_kref, nfs_free_request);
2714 }
2715
2716 +static int nfs_wait_bit_uninterruptible(void *word)
2717 +{
2718 + io_schedule();
2719 + return 0;
2720 +}
2721 +
2722 /**
2723 * nfs_wait_on_request - Wait for a request to complete.
2724 * @req: request to wait upon.
2725 @@ -186,14 +192,9 @@ void nfs_release_request(struct nfs_page *req)
2726 int
2727 nfs_wait_on_request(struct nfs_page *req)
2728 {
2729 - int ret = 0;
2730 -
2731 - if (!test_bit(PG_BUSY, &req->wb_flags))
2732 - goto out;
2733 - ret = out_of_line_wait_on_bit(&req->wb_flags, PG_BUSY,
2734 - nfs_wait_bit_killable, TASK_KILLABLE);
2735 -out:
2736 - return ret;
2737 + return wait_on_bit(&req->wb_flags, PG_BUSY,
2738 + nfs_wait_bit_uninterruptible,
2739 + TASK_UNINTERRUPTIBLE);
2740 }
2741
2742 /**
2743 diff --git a/fs/nfs/super.c b/fs/nfs/super.c
2744 index e71f0fd..4bf23f6 100644
2745 --- a/fs/nfs/super.c
2746 +++ b/fs/nfs/super.c
2747 @@ -241,6 +241,7 @@ static int nfs_show_stats(struct seq_file *, struct vfsmount *);
2748 static int nfs_get_sb(struct file_system_type *, int, const char *, void *, struct vfsmount *);
2749 static int nfs_xdev_get_sb(struct file_system_type *fs_type,
2750 int flags, const char *dev_name, void *raw_data, struct vfsmount *mnt);
2751 +static void nfs_put_super(struct super_block *);
2752 static void nfs_kill_super(struct super_block *);
2753 static int nfs_remount(struct super_block *sb, int *flags, char *raw_data);
2754
2755 @@ -264,6 +265,7 @@ static const struct super_operations nfs_sops = {
2756 .alloc_inode = nfs_alloc_inode,
2757 .destroy_inode = nfs_destroy_inode,
2758 .write_inode = nfs_write_inode,
2759 + .put_super = nfs_put_super,
2760 .statfs = nfs_statfs,
2761 .clear_inode = nfs_clear_inode,
2762 .umount_begin = nfs_umount_begin,
2763 @@ -333,6 +335,7 @@ static const struct super_operations nfs4_sops = {
2764 .alloc_inode = nfs_alloc_inode,
2765 .destroy_inode = nfs_destroy_inode,
2766 .write_inode = nfs_write_inode,
2767 + .put_super = nfs_put_super,
2768 .statfs = nfs_statfs,
2769 .clear_inode = nfs4_clear_inode,
2770 .umount_begin = nfs_umount_begin,
2771 @@ -2196,6 +2199,17 @@ error_splat_super:
2772 }
2773
2774 /*
2775 + * Ensure that we unregister the bdi before kill_anon_super
2776 + * releases the device name
2777 + */
2778 +static void nfs_put_super(struct super_block *s)
2779 +{
2780 + struct nfs_server *server = NFS_SB(s);
2781 +
2782 + bdi_unregister(&server->backing_dev_info);
2783 +}
2784 +
2785 +/*
2786 * Destroy an NFS2/3 superblock
2787 */
2788 static void nfs_kill_super(struct super_block *s)
2789 @@ -2203,7 +2217,6 @@ static void nfs_kill_super(struct super_block *s)
2790 struct nfs_server *server = NFS_SB(s);
2791
2792 kill_anon_super(s);
2793 - bdi_unregister(&server->backing_dev_info);
2794 nfs_fscache_release_super_cookie(s);
2795 nfs_free_server(server);
2796 }
2797 diff --git a/fs/nfs/write.c b/fs/nfs/write.c
2798 index 6fc3776..cf6c06f 100644
2799 --- a/fs/nfs/write.c
2800 +++ b/fs/nfs/write.c
2801 @@ -1542,6 +1542,7 @@ int nfs_wb_page_cancel(struct inode *inode, struct page *page)
2802 break;
2803 }
2804 ret = nfs_wait_on_request(req);
2805 + nfs_release_request(req);
2806 if (ret < 0)
2807 goto out;
2808 }
2809 diff --git a/fs/sysfs/inode.c b/fs/sysfs/inode.c
2810 index e28cecf..02a022a 100644
2811 --- a/fs/sysfs/inode.c
2812 +++ b/fs/sysfs/inode.c
2813 @@ -94,30 +94,29 @@ int sysfs_setattr(struct dentry * dentry, struct iattr * iattr)
2814 if (!sd_attrs)
2815 return -ENOMEM;
2816 sd->s_iattr = sd_attrs;
2817 - } else {
2818 - /* attributes were changed at least once in past */
2819 - iattrs = &sd_attrs->ia_iattr;
2820 -
2821 - if (ia_valid & ATTR_UID)
2822 - iattrs->ia_uid = iattr->ia_uid;
2823 - if (ia_valid & ATTR_GID)
2824 - iattrs->ia_gid = iattr->ia_gid;
2825 - if (ia_valid & ATTR_ATIME)
2826 - iattrs->ia_atime = timespec_trunc(iattr->ia_atime,
2827 - inode->i_sb->s_time_gran);
2828 - if (ia_valid & ATTR_MTIME)
2829 - iattrs->ia_mtime = timespec_trunc(iattr->ia_mtime,
2830 - inode->i_sb->s_time_gran);
2831 - if (ia_valid & ATTR_CTIME)
2832 - iattrs->ia_ctime = timespec_trunc(iattr->ia_ctime,
2833 - inode->i_sb->s_time_gran);
2834 - if (ia_valid & ATTR_MODE) {
2835 - umode_t mode = iattr->ia_mode;
2836 -
2837 - if (!in_group_p(inode->i_gid) && !capable(CAP_FSETID))
2838 - mode &= ~S_ISGID;
2839 - iattrs->ia_mode = sd->s_mode = mode;
2840 - }
2841 + }
2842 + /* attributes were changed at least once in past */
2843 + iattrs = &sd_attrs->ia_iattr;
2844 +
2845 + if (ia_valid & ATTR_UID)
2846 + iattrs->ia_uid = iattr->ia_uid;
2847 + if (ia_valid & ATTR_GID)
2848 + iattrs->ia_gid = iattr->ia_gid;
2849 + if (ia_valid & ATTR_ATIME)
2850 + iattrs->ia_atime = timespec_trunc(iattr->ia_atime,
2851 + inode->i_sb->s_time_gran);
2852 + if (ia_valid & ATTR_MTIME)
2853 + iattrs->ia_mtime = timespec_trunc(iattr->ia_mtime,
2854 + inode->i_sb->s_time_gran);
2855 + if (ia_valid & ATTR_CTIME)
2856 + iattrs->ia_ctime = timespec_trunc(iattr->ia_ctime,
2857 + inode->i_sb->s_time_gran);
2858 + if (ia_valid & ATTR_MODE) {
2859 + umode_t mode = iattr->ia_mode;
2860 +
2861 + if (!in_group_p(inode->i_gid) && !capable(CAP_FSETID))
2862 + mode &= ~S_ISGID;
2863 + iattrs->ia_mode = sd->s_mode = mode;
2864 }
2865 return error;
2866 }
2867 diff --git a/include/drm/drm_os_linux.h b/include/drm/drm_os_linux.h
2868 index 26641e9..3933691 100644
2869 --- a/include/drm/drm_os_linux.h
2870 +++ b/include/drm/drm_os_linux.h
2871 @@ -123,5 +123,5 @@ do { \
2872 remove_wait_queue(&(queue), &entry); \
2873 } while (0)
2874
2875 -#define DRM_WAKEUP( queue ) wake_up_interruptible( queue )
2876 +#define DRM_WAKEUP( queue ) wake_up( queue )
2877 #define DRM_INIT_WAITQUEUE( queue ) init_waitqueue_head( queue )
2878 diff --git a/include/linux/sched.h b/include/linux/sched.h
2879 index d3dce7d..e48311e 100644
2880 --- a/include/linux/sched.h
2881 +++ b/include/linux/sched.h
2882 @@ -2583,6 +2583,28 @@ static inline void mm_init_owner(struct mm_struct *mm, struct task_struct *p)
2883
2884 #define TASK_STATE_TO_CHAR_STR "RSDTtZX"
2885
2886 +static inline unsigned long task_rlimit(const struct task_struct *tsk,
2887 + unsigned int limit)
2888 +{
2889 + return ACCESS_ONCE(tsk->signal->rlim[limit].rlim_cur);
2890 +}
2891 +
2892 +static inline unsigned long task_rlimit_max(const struct task_struct *tsk,
2893 + unsigned int limit)
2894 +{
2895 + return ACCESS_ONCE(tsk->signal->rlim[limit].rlim_max);
2896 +}
2897 +
2898 +static inline unsigned long rlimit(unsigned int limit)
2899 +{
2900 + return task_rlimit(current, limit);
2901 +}
2902 +
2903 +static inline unsigned long rlimit_max(unsigned int limit)
2904 +{
2905 + return task_rlimit_max(current, limit);
2906 +}
2907 +
2908 #endif /* __KERNEL__ */
2909
2910 #endif
2911 diff --git a/include/net/netns/conntrack.h b/include/net/netns/conntrack.h
2912 index ba1ba0c..63d4498 100644
2913 --- a/include/net/netns/conntrack.h
2914 +++ b/include/net/netns/conntrack.h
2915 @@ -11,6 +11,8 @@ struct nf_conntrack_ecache;
2916 struct netns_ct {
2917 atomic_t count;
2918 unsigned int expect_count;
2919 + unsigned int htable_size;
2920 + struct kmem_cache *nf_conntrack_cachep;
2921 struct hlist_nulls_head *hash;
2922 struct hlist_head *expect_hash;
2923 struct hlist_nulls_head unconfirmed;
2924 @@ -28,5 +30,6 @@ struct netns_ct {
2925 #endif
2926 int hash_vmalloc;
2927 int expect_vmalloc;
2928 + char *slabname;
2929 };
2930 #endif
2931 diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
2932 index 2eb3814..9a4b8b7 100644
2933 --- a/include/net/netns/ipv4.h
2934 +++ b/include/net/netns/ipv4.h
2935 @@ -40,6 +40,7 @@ struct netns_ipv4 {
2936 struct xt_table *iptable_security;
2937 struct xt_table *nat_table;
2938 struct hlist_head *nat_bysource;
2939 + unsigned int nat_htable_size;
2940 int nat_vmalloced;
2941 #endif
2942
2943 diff --git a/kernel/futex.c b/kernel/futex.c
2944 index 3b74909..1ad4fa6 100644
2945 --- a/kernel/futex.c
2946 +++ b/kernel/futex.c
2947 @@ -530,8 +530,25 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
2948 return -EINVAL;
2949
2950 WARN_ON(!atomic_read(&pi_state->refcount));
2951 - WARN_ON(pid && pi_state->owner &&
2952 - pi_state->owner->pid != pid);
2953 +
2954 + /*
2955 + * When pi_state->owner is NULL then the owner died
2956 + * and another waiter is on the fly. pi_state->owner
2957 + * is fixed up by the task which acquires
2958 + * pi_state->rt_mutex.
2959 + *
2960 + * We do not check for pid == 0 which can happen when
2961 + * the owner died and robust_list_exit() cleared the
2962 + * TID.
2963 + */
2964 + if (pid && pi_state->owner) {
2965 + /*
2966 + * Bail out if user space manipulated the
2967 + * futex value.
2968 + */
2969 + if (pid != task_pid_vnr(pi_state->owner))
2970 + return -EINVAL;
2971 + }
2972
2973 atomic_inc(&pi_state->refcount);
2974 *ps = pi_state;
2975 @@ -758,6 +775,13 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this)
2976 if (!pi_state)
2977 return -EINVAL;
2978
2979 + /*
2980 + * If current does not own the pi_state then the futex is
2981 + * inconsistent and user space fiddled with the futex value.
2982 + */
2983 + if (pi_state->owner != current)
2984 + return -EINVAL;
2985 +
2986 spin_lock(&pi_state->pi_mutex.wait_lock);
2987 new_owner = rt_mutex_next_owner(&pi_state->pi_mutex);
2988
2989 @@ -1971,7 +1995,7 @@ retry_private:
2990 /* Unqueue and drop the lock */
2991 unqueue_me_pi(&q);
2992
2993 - goto out;
2994 + goto out_put_key;
2995
2996 out_unlock_put_key:
2997 queue_unlock(&q, hb);
2998 diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
2999 index 66d090e..8b709de 100644
3000 --- a/kernel/time/timekeeping.c
3001 +++ b/kernel/time/timekeeping.c
3002 @@ -845,6 +845,7 @@ void getboottime(struct timespec *ts)
3003
3004 set_normalized_timespec(ts, -boottime.tv_sec, -boottime.tv_nsec);
3005 }
3006 +EXPORT_SYMBOL_GPL(getboottime);
3007
3008 /**
3009 * monotonic_to_bootbased - Convert the monotonic time to boot based.
3010 @@ -854,6 +855,7 @@ void monotonic_to_bootbased(struct timespec *ts)
3011 {
3012 *ts = timespec_add_safe(*ts, total_sleep_time);
3013 }
3014 +EXPORT_SYMBOL_GPL(monotonic_to_bootbased);
3015
3016 unsigned long get_seconds(void)
3017 {
3018 diff --git a/mm/migrate.c b/mm/migrate.c
3019 index 7dbcb22..0e39f94 100644
3020 --- a/mm/migrate.c
3021 +++ b/mm/migrate.c
3022 @@ -953,6 +953,9 @@ static int do_pages_move(struct mm_struct *mm, struct task_struct *task,
3023 goto out_pm;
3024
3025 err = -ENODEV;
3026 + if (node < 0 || node >= MAX_NUMNODES)
3027 + goto out_pm;
3028 +
3029 if (!node_state(node, N_HIGH_MEMORY))
3030 goto out_pm;
3031
3032 diff --git a/net/core/dst.c b/net/core/dst.c
3033 index 57bc4d5..cb1b348 100644
3034 --- a/net/core/dst.c
3035 +++ b/net/core/dst.c
3036 @@ -17,6 +17,7 @@
3037 #include <linux/string.h>
3038 #include <linux/types.h>
3039 #include <net/net_namespace.h>
3040 +#include <linux/sched.h>
3041
3042 #include <net/dst.h>
3043
3044 @@ -79,6 +80,7 @@ loop:
3045 while ((dst = next) != NULL) {
3046 next = dst->next;
3047 prefetch(&next->next);
3048 + cond_resched();
3049 if (likely(atomic_read(&dst->__refcnt))) {
3050 last->next = dst;
3051 last = dst;
3052 diff --git a/net/core/pktgen.c b/net/core/pktgen.c
3053 index 6e79e96..6a993b1 100644
3054 --- a/net/core/pktgen.c
3055 +++ b/net/core/pktgen.c
3056 @@ -3516,6 +3516,7 @@ static int pktgen_thread_worker(void *arg)
3057 wait_event_interruptible_timeout(t->queue,
3058 t->control != 0,
3059 HZ/10);
3060 + try_to_freeze();
3061 continue;
3062 }
3063
3064 diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
3065 index 27774c9..98442f3 100644
3066 --- a/net/ipv4/netfilter/arp_tables.c
3067 +++ b/net/ipv4/netfilter/arp_tables.c
3068 @@ -925,10 +925,10 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
3069 if (t && !IS_ERR(t)) {
3070 struct arpt_getinfo info;
3071 const struct xt_table_info *private = t->private;
3072 -
3073 #ifdef CONFIG_COMPAT
3074 + struct xt_table_info tmp;
3075 +
3076 if (compat) {
3077 - struct xt_table_info tmp;
3078 ret = compat_table_info(private, &tmp);
3079 xt_compat_flush_offsets(NFPROTO_ARP);
3080 private = &tmp;
3081 diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
3082 index cde755d..62aff31 100644
3083 --- a/net/ipv4/netfilter/ip_tables.c
3084 +++ b/net/ipv4/netfilter/ip_tables.c
3085 @@ -1132,10 +1132,10 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
3086 if (t && !IS_ERR(t)) {
3087 struct ipt_getinfo info;
3088 const struct xt_table_info *private = t->private;
3089 -
3090 #ifdef CONFIG_COMPAT
3091 + struct xt_table_info tmp;
3092 +
3093 if (compat) {
3094 - struct xt_table_info tmp;
3095 ret = compat_table_info(private, &tmp);
3096 xt_compat_flush_offsets(AF_INET);
3097 private = &tmp;
3098 diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
3099 index aa95bb8..1032a15 100644
3100 --- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
3101 +++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
3102 @@ -213,7 +213,7 @@ static ctl_table ip_ct_sysctl_table[] = {
3103 {
3104 .ctl_name = NET_IPV4_NF_CONNTRACK_BUCKETS,
3105 .procname = "ip_conntrack_buckets",
3106 - .data = &nf_conntrack_htable_size,
3107 + .data = &init_net.ct.htable_size,
3108 .maxlen = sizeof(unsigned int),
3109 .mode = 0444,
3110 .proc_handler = proc_dointvec,
3111 diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
3112 index 8668a3d..2fb7b76 100644
3113 --- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
3114 +++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
3115 @@ -32,7 +32,7 @@ static struct hlist_nulls_node *ct_get_first(struct seq_file *seq)
3116 struct hlist_nulls_node *n;
3117
3118 for (st->bucket = 0;
3119 - st->bucket < nf_conntrack_htable_size;
3120 + st->bucket < net->ct.htable_size;
3121 st->bucket++) {
3122 n = rcu_dereference(net->ct.hash[st->bucket].first);
3123 if (!is_a_nulls(n))
3124 @@ -50,7 +50,7 @@ static struct hlist_nulls_node *ct_get_next(struct seq_file *seq,
3125 head = rcu_dereference(head->next);
3126 while (is_a_nulls(head)) {
3127 if (likely(get_nulls_value(head) == st->bucket)) {
3128 - if (++st->bucket >= nf_conntrack_htable_size)
3129 + if (++st->bucket >= net->ct.htable_size)
3130 return NULL;
3131 }
3132 head = rcu_dereference(net->ct.hash[st->bucket].first);
3133 diff --git a/net/ipv4/netfilter/nf_nat_core.c b/net/ipv4/netfilter/nf_nat_core.c
3134 index fe1a644..26066a2 100644
3135 --- a/net/ipv4/netfilter/nf_nat_core.c
3136 +++ b/net/ipv4/netfilter/nf_nat_core.c
3137 @@ -35,9 +35,6 @@ static DEFINE_SPINLOCK(nf_nat_lock);
3138
3139 static struct nf_conntrack_l3proto *l3proto __read_mostly;
3140
3141 -/* Calculated at init based on memory size */
3142 -static unsigned int nf_nat_htable_size __read_mostly;
3143 -
3144 #define MAX_IP_NAT_PROTO 256
3145 static const struct nf_nat_protocol *nf_nat_protos[MAX_IP_NAT_PROTO]
3146 __read_mostly;
3147 @@ -72,7 +69,7 @@ EXPORT_SYMBOL_GPL(nf_nat_proto_put);
3148
3149 /* We keep an extra hash for each conntrack, for fast searching. */
3150 static inline unsigned int
3151 -hash_by_src(const struct nf_conntrack_tuple *tuple)
3152 +hash_by_src(const struct net *net, const struct nf_conntrack_tuple *tuple)
3153 {
3154 unsigned int hash;
3155
3156 @@ -80,7 +77,7 @@ hash_by_src(const struct nf_conntrack_tuple *tuple)
3157 hash = jhash_3words((__force u32)tuple->src.u3.ip,
3158 (__force u32)tuple->src.u.all,
3159 tuple->dst.protonum, 0);
3160 - return ((u64)hash * nf_nat_htable_size) >> 32;
3161 + return ((u64)hash * net->ipv4.nat_htable_size) >> 32;
3162 }
3163
3164 /* Is this tuple already taken? (not by us) */
3165 @@ -147,7 +144,7 @@ find_appropriate_src(struct net *net,
3166 struct nf_conntrack_tuple *result,
3167 const struct nf_nat_range *range)
3168 {
3169 - unsigned int h = hash_by_src(tuple);
3170 + unsigned int h = hash_by_src(net, tuple);
3171 const struct nf_conn_nat *nat;
3172 const struct nf_conn *ct;
3173 const struct hlist_node *n;
3174 @@ -330,7 +327,7 @@ nf_nat_setup_info(struct nf_conn *ct,
3175 if (have_to_hash) {
3176 unsigned int srchash;
3177
3178 - srchash = hash_by_src(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
3179 + srchash = hash_by_src(net, &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
3180 spin_lock_bh(&nf_nat_lock);
3181 /* nf_conntrack_alter_reply might re-allocate exntension aera */
3182 nat = nfct_nat(ct);
3183 @@ -679,8 +676,10 @@ nfnetlink_parse_nat_setup(struct nf_conn *ct,
3184
3185 static int __net_init nf_nat_net_init(struct net *net)
3186 {
3187 - net->ipv4.nat_bysource = nf_ct_alloc_hashtable(&nf_nat_htable_size,
3188 - &net->ipv4.nat_vmalloced, 0);
3189 + /* Leave them the same for the moment. */
3190 + net->ipv4.nat_htable_size = net->ct.htable_size;
3191 + net->ipv4.nat_bysource = nf_ct_alloc_hashtable(&net->ipv4.nat_htable_size,
3192 + &net->ipv4.nat_vmalloced, 0);
3193 if (!net->ipv4.nat_bysource)
3194 return -ENOMEM;
3195 return 0;
3196 @@ -703,7 +702,7 @@ static void __net_exit nf_nat_net_exit(struct net *net)
3197 nf_ct_iterate_cleanup(net, &clean_nat, NULL);
3198 synchronize_rcu();
3199 nf_ct_free_hashtable(net->ipv4.nat_bysource, net->ipv4.nat_vmalloced,
3200 - nf_nat_htable_size);
3201 + net->ipv4.nat_htable_size);
3202 }
3203
3204 static struct pernet_operations nf_nat_net_ops = {
3205 @@ -724,9 +723,6 @@ static int __init nf_nat_init(void)
3206 return ret;
3207 }
3208
3209 - /* Leave them the same for the moment. */
3210 - nf_nat_htable_size = nf_conntrack_htable_size;
3211 -
3212 ret = register_pernet_subsys(&nf_nat_net_ops);
3213 if (ret < 0)
3214 goto cleanup_extend;
3215 diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
3216 index cc9f8ef..1de56fd 100644
3217 --- a/net/ipv6/netfilter/ip6_tables.c
3218 +++ b/net/ipv6/netfilter/ip6_tables.c
3219 @@ -1164,10 +1164,10 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
3220 if (t && !IS_ERR(t)) {
3221 struct ip6t_getinfo info;
3222 const struct xt_table_info *private = t->private;
3223 -
3224 #ifdef CONFIG_COMPAT
3225 + struct xt_table_info tmp;
3226 +
3227 if (compat) {
3228 - struct xt_table_info tmp;
3229 ret = compat_table_info(private, &tmp);
3230 xt_compat_flush_offsets(AF_INET6);
3231 private = &tmp;
3232 diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
3233 index fbffce9..07600a6 100644
3234 --- a/net/mac80211/ibss.c
3235 +++ b/net/mac80211/ibss.c
3236 @@ -643,7 +643,7 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
3237 }
3238 if (pos[1] != 0 &&
3239 (pos[1] != ifibss->ssid_len ||
3240 - !memcmp(pos + 2, ifibss->ssid, ifibss->ssid_len))) {
3241 + memcmp(pos + 2, ifibss->ssid, ifibss->ssid_len))) {
3242 /* Ignore ProbeReq for foreign SSID */
3243 return;
3244 }
3245 diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
3246 index b9168c1..1374179 100644
3247 --- a/net/netfilter/nf_conntrack_core.c
3248 +++ b/net/netfilter/nf_conntrack_core.c
3249 @@ -30,6 +30,7 @@
3250 #include <linux/netdevice.h>
3251 #include <linux/socket.h>
3252 #include <linux/mm.h>
3253 +#include <linux/nsproxy.h>
3254 #include <linux/rculist_nulls.h>
3255
3256 #include <net/netfilter/nf_conntrack.h>
3257 @@ -63,8 +64,6 @@ EXPORT_SYMBOL_GPL(nf_conntrack_max);
3258 struct nf_conn nf_conntrack_untracked __read_mostly;
3259 EXPORT_SYMBOL_GPL(nf_conntrack_untracked);
3260
3261 -static struct kmem_cache *nf_conntrack_cachep __read_mostly;
3262 -
3263 static int nf_conntrack_hash_rnd_initted;
3264 static unsigned int nf_conntrack_hash_rnd;
3265
3266 @@ -86,9 +85,10 @@ static u_int32_t __hash_conntrack(const struct nf_conntrack_tuple *tuple,
3267 return ((u64)h * size) >> 32;
3268 }
3269
3270 -static inline u_int32_t hash_conntrack(const struct nf_conntrack_tuple *tuple)
3271 +static inline u_int32_t hash_conntrack(const struct net *net,
3272 + const struct nf_conntrack_tuple *tuple)
3273 {
3274 - return __hash_conntrack(tuple, nf_conntrack_htable_size,
3275 + return __hash_conntrack(tuple, net->ct.htable_size,
3276 nf_conntrack_hash_rnd);
3277 }
3278
3279 @@ -296,7 +296,7 @@ __nf_conntrack_find(struct net *net, const struct nf_conntrack_tuple *tuple)
3280 {
3281 struct nf_conntrack_tuple_hash *h;
3282 struct hlist_nulls_node *n;
3283 - unsigned int hash = hash_conntrack(tuple);
3284 + unsigned int hash = hash_conntrack(net, tuple);
3285
3286 /* Disable BHs the entire time since we normally need to disable them
3287 * at least once for the stats anyway.
3288 @@ -366,10 +366,11 @@ static void __nf_conntrack_hash_insert(struct nf_conn *ct,
3289
3290 void nf_conntrack_hash_insert(struct nf_conn *ct)
3291 {
3292 + struct net *net = nf_ct_net(ct);
3293 unsigned int hash, repl_hash;
3294
3295 - hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
3296 - repl_hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
3297 + hash = hash_conntrack(net, &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
3298 + repl_hash = hash_conntrack(net, &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
3299
3300 __nf_conntrack_hash_insert(ct, hash, repl_hash);
3301 }
3302 @@ -397,8 +398,8 @@ __nf_conntrack_confirm(struct sk_buff *skb)
3303 if (CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL)
3304 return NF_ACCEPT;
3305
3306 - hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
3307 - repl_hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
3308 + hash = hash_conntrack(net, &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
3309 + repl_hash = hash_conntrack(net, &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
3310
3311 /* We're not in hash table, and we refuse to set up related
3312 connections for unconfirmed conns. But packet copies and
3313 @@ -468,7 +469,7 @@ nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple,
3314 struct net *net = nf_ct_net(ignored_conntrack);
3315 struct nf_conntrack_tuple_hash *h;
3316 struct hlist_nulls_node *n;
3317 - unsigned int hash = hash_conntrack(tuple);
3318 + unsigned int hash = hash_conntrack(net, tuple);
3319
3320 /* Disable BHs the entire time since we need to disable them at
3321 * least once for the stats anyway.
3322 @@ -503,7 +504,7 @@ static noinline int early_drop(struct net *net, unsigned int hash)
3323 int dropped = 0;
3324
3325 rcu_read_lock();
3326 - for (i = 0; i < nf_conntrack_htable_size; i++) {
3327 + for (i = 0; i < net->ct.htable_size; i++) {
3328 hlist_nulls_for_each_entry_rcu(h, n, &net->ct.hash[hash],
3329 hnnode) {
3330 tmp = nf_ct_tuplehash_to_ctrack(h);
3331 @@ -517,7 +518,8 @@ static noinline int early_drop(struct net *net, unsigned int hash)
3332 ct = NULL;
3333 if (ct || cnt >= NF_CT_EVICTION_RANGE)
3334 break;
3335 - hash = (hash + 1) % nf_conntrack_htable_size;
3336 +
3337 + hash = (hash + 1) % net->ct.htable_size;
3338 }
3339 rcu_read_unlock();
3340
3341 @@ -551,7 +553,7 @@ struct nf_conn *nf_conntrack_alloc(struct net *net,
3342
3343 if (nf_conntrack_max &&
3344 unlikely(atomic_read(&net->ct.count) > nf_conntrack_max)) {
3345 - unsigned int hash = hash_conntrack(orig);
3346 + unsigned int hash = hash_conntrack(net, orig);
3347 if (!early_drop(net, hash)) {
3348 atomic_dec(&net->ct.count);
3349 if (net_ratelimit())
3350 @@ -566,7 +568,7 @@ struct nf_conn *nf_conntrack_alloc(struct net *net,
3351 * Do not use kmem_cache_zalloc(), as this cache uses
3352 * SLAB_DESTROY_BY_RCU.
3353 */
3354 - ct = kmem_cache_alloc(nf_conntrack_cachep, gfp);
3355 + ct = kmem_cache_alloc(net->ct.nf_conntrack_cachep, gfp);
3356 if (ct == NULL) {
3357 pr_debug("nf_conntrack_alloc: Can't alloc conntrack.\n");
3358 atomic_dec(&net->ct.count);
3359 @@ -605,7 +607,7 @@ void nf_conntrack_free(struct nf_conn *ct)
3360 nf_ct_ext_destroy(ct);
3361 atomic_dec(&net->ct.count);
3362 nf_ct_ext_free(ct);
3363 - kmem_cache_free(nf_conntrack_cachep, ct);
3364 + kmem_cache_free(net->ct.nf_conntrack_cachep, ct);
3365 }
3366 EXPORT_SYMBOL_GPL(nf_conntrack_free);
3367
3368 @@ -1008,7 +1010,7 @@ get_next_corpse(struct net *net, int (*iter)(struct nf_conn *i, void *data),
3369 struct hlist_nulls_node *n;
3370
3371 spin_lock_bh(&nf_conntrack_lock);
3372 - for (; *bucket < nf_conntrack_htable_size; (*bucket)++) {
3373 + for (; *bucket < net->ct.htable_size; (*bucket)++) {
3374 hlist_nulls_for_each_entry(h, n, &net->ct.hash[*bucket], hnnode) {
3375 ct = nf_ct_tuplehash_to_ctrack(h);
3376 if (iter(ct, data))
3377 @@ -1107,9 +1109,12 @@ static void nf_ct_release_dying_list(struct net *net)
3378
3379 static void nf_conntrack_cleanup_init_net(void)
3380 {
3381 + /* wait until all references to nf_conntrack_untracked are dropped */
3382 + while (atomic_read(&nf_conntrack_untracked.ct_general.use) > 1)
3383 + schedule();
3384 +
3385 nf_conntrack_helper_fini();
3386 nf_conntrack_proto_fini();
3387 - kmem_cache_destroy(nf_conntrack_cachep);
3388 }
3389
3390 static void nf_conntrack_cleanup_net(struct net *net)
3391 @@ -1121,15 +1126,14 @@ static void nf_conntrack_cleanup_net(struct net *net)
3392 schedule();
3393 goto i_see_dead_people;
3394 }
3395 - /* wait until all references to nf_conntrack_untracked are dropped */
3396 - while (atomic_read(&nf_conntrack_untracked.ct_general.use) > 1)
3397 - schedule();
3398
3399 nf_ct_free_hashtable(net->ct.hash, net->ct.hash_vmalloc,
3400 - nf_conntrack_htable_size);
3401 + net->ct.htable_size);
3402 nf_conntrack_ecache_fini(net);
3403 nf_conntrack_acct_fini(net);
3404 nf_conntrack_expect_fini(net);
3405 + kmem_cache_destroy(net->ct.nf_conntrack_cachep);
3406 + kfree(net->ct.slabname);
3407 free_percpu(net->ct.stat);
3408 }
3409
3410 @@ -1184,10 +1188,12 @@ int nf_conntrack_set_hashsize(const char *val, struct kernel_param *kp)
3411 {
3412 int i, bucket, vmalloced, old_vmalloced;
3413 unsigned int hashsize, old_size;
3414 - int rnd;
3415 struct hlist_nulls_head *hash, *old_hash;
3416 struct nf_conntrack_tuple_hash *h;
3417
3418 + if (current->nsproxy->net_ns != &init_net)
3419 + return -EOPNOTSUPP;
3420 +
3421 /* On boot, we can set this without any fancy locking. */
3422 if (!nf_conntrack_htable_size)
3423 return param_set_uint(val, kp);
3424 @@ -1200,33 +1206,29 @@ int nf_conntrack_set_hashsize(const char *val, struct kernel_param *kp)
3425 if (!hash)
3426 return -ENOMEM;
3427
3428 - /* We have to rehahs for the new table anyway, so we also can
3429 - * use a newrandom seed */
3430 - get_random_bytes(&rnd, sizeof(rnd));
3431 -
3432 /* Lookups in the old hash might happen in parallel, which means we
3433 * might get false negatives during connection lookup. New connections
3434 * created because of a false negative won't make it into the hash
3435 * though since that required taking the lock.
3436 */
3437 spin_lock_bh(&nf_conntrack_lock);
3438 - for (i = 0; i < nf_conntrack_htable_size; i++) {
3439 + for (i = 0; i < init_net.ct.htable_size; i++) {
3440 while (!hlist_nulls_empty(&init_net.ct.hash[i])) {
3441 h = hlist_nulls_entry(init_net.ct.hash[i].first,
3442 struct nf_conntrack_tuple_hash, hnnode);
3443 hlist_nulls_del_rcu(&h->hnnode);
3444 - bucket = __hash_conntrack(&h->tuple, hashsize, rnd);
3445 + bucket = __hash_conntrack(&h->tuple, hashsize,
3446 + nf_conntrack_hash_rnd);
3447 hlist_nulls_add_head_rcu(&h->hnnode, &hash[bucket]);
3448 }
3449 }
3450 - old_size = nf_conntrack_htable_size;
3451 + old_size = init_net.ct.htable_size;
3452 old_vmalloced = init_net.ct.hash_vmalloc;
3453 old_hash = init_net.ct.hash;
3454
3455 - nf_conntrack_htable_size = hashsize;
3456 + init_net.ct.htable_size = nf_conntrack_htable_size = hashsize;
3457 init_net.ct.hash_vmalloc = vmalloced;
3458 init_net.ct.hash = hash;
3459 - nf_conntrack_hash_rnd = rnd;
3460 spin_unlock_bh(&nf_conntrack_lock);
3461
3462 nf_ct_free_hashtable(old_hash, old_vmalloced, old_size);
3463 @@ -1265,15 +1267,6 @@ static int nf_conntrack_init_init_net(void)
3464 NF_CONNTRACK_VERSION, nf_conntrack_htable_size,
3465 nf_conntrack_max);
3466
3467 - nf_conntrack_cachep = kmem_cache_create("nf_conntrack",
3468 - sizeof(struct nf_conn),
3469 - 0, SLAB_DESTROY_BY_RCU, NULL);
3470 - if (!nf_conntrack_cachep) {
3471 - printk(KERN_ERR "Unable to create nf_conn slab cache\n");
3472 - ret = -ENOMEM;
3473 - goto err_cache;
3474 - }
3475 -
3476 ret = nf_conntrack_proto_init();
3477 if (ret < 0)
3478 goto err_proto;
3479 @@ -1282,13 +1275,19 @@ static int nf_conntrack_init_init_net(void)
3480 if (ret < 0)
3481 goto err_helper;
3482
3483 + /* Set up fake conntrack: to never be deleted, not in any hashes */
3484 +#ifdef CONFIG_NET_NS
3485 + nf_conntrack_untracked.ct_net = &init_net;
3486 +#endif
3487 + atomic_set(&nf_conntrack_untracked.ct_general.use, 1);
3488 + /* - and look it like as a confirmed connection */
3489 + set_bit(IPS_CONFIRMED_BIT, &nf_conntrack_untracked.status);
3490 +
3491 return 0;
3492
3493 err_helper:
3494 nf_conntrack_proto_fini();
3495 err_proto:
3496 - kmem_cache_destroy(nf_conntrack_cachep);
3497 -err_cache:
3498 return ret;
3499 }
3500
3501 @@ -1310,7 +1309,24 @@ static int nf_conntrack_init_net(struct net *net)
3502 ret = -ENOMEM;
3503 goto err_stat;
3504 }
3505 - net->ct.hash = nf_ct_alloc_hashtable(&nf_conntrack_htable_size,
3506 +
3507 + net->ct.slabname = kasprintf(GFP_KERNEL, "nf_conntrack_%p", net);
3508 + if (!net->ct.slabname) {
3509 + ret = -ENOMEM;
3510 + goto err_slabname;
3511 + }
3512 +
3513 + net->ct.nf_conntrack_cachep = kmem_cache_create(net->ct.slabname,
3514 + sizeof(struct nf_conn), 0,
3515 + SLAB_DESTROY_BY_RCU, NULL);
3516 + if (!net->ct.nf_conntrack_cachep) {
3517 + printk(KERN_ERR "Unable to create nf_conn slab cache\n");
3518 + ret = -ENOMEM;
3519 + goto err_cache;
3520 + }
3521 +
3522 + net->ct.htable_size = nf_conntrack_htable_size;
3523 + net->ct.hash = nf_ct_alloc_hashtable(&net->ct.htable_size,
3524 &net->ct.hash_vmalloc, 1);
3525 if (!net->ct.hash) {
3526 ret = -ENOMEM;
3527 @@ -1327,15 +1343,6 @@ static int nf_conntrack_init_net(struct net *net)
3528 if (ret < 0)
3529 goto err_ecache;
3530
3531 - /* Set up fake conntrack:
3532 - - to never be deleted, not in any hashes */
3533 -#ifdef CONFIG_NET_NS
3534 - nf_conntrack_untracked.ct_net = &init_net;
3535 -#endif
3536 - atomic_set(&nf_conntrack_untracked.ct_general.use, 1);
3537 - /* - and look it like as a confirmed connection */
3538 - set_bit(IPS_CONFIRMED_BIT, &nf_conntrack_untracked.status);
3539 -
3540 return 0;
3541
3542 err_ecache:
3543 @@ -1344,8 +1351,12 @@ err_acct:
3544 nf_conntrack_expect_fini(net);
3545 err_expect:
3546 nf_ct_free_hashtable(net->ct.hash, net->ct.hash_vmalloc,
3547 - nf_conntrack_htable_size);
3548 + net->ct.htable_size);
3549 err_hash:
3550 + kmem_cache_destroy(net->ct.nf_conntrack_cachep);
3551 +err_cache:
3552 + kfree(net->ct.slabname);
3553 +err_slabname:
3554 free_percpu(net->ct.stat);
3555 err_stat:
3556 return ret;
3557 diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
3558 index 2032dfe..e73eb04 100644
3559 --- a/net/netfilter/nf_conntrack_expect.c
3560 +++ b/net/netfilter/nf_conntrack_expect.c
3561 @@ -569,7 +569,7 @@ static void exp_proc_remove(struct net *net)
3562 #endif /* CONFIG_PROC_FS */
3563 }
3564
3565 -module_param_named(expect_hashsize, nf_ct_expect_hsize, uint, 0600);
3566 +module_param_named(expect_hashsize, nf_ct_expect_hsize, uint, 0400);
3567
3568 int nf_conntrack_expect_init(struct net *net)
3569 {
3570 @@ -577,7 +577,7 @@ int nf_conntrack_expect_init(struct net *net)
3571
3572 if (net_eq(net, &init_net)) {
3573 if (!nf_ct_expect_hsize) {
3574 - nf_ct_expect_hsize = nf_conntrack_htable_size / 256;
3575 + nf_ct_expect_hsize = net->ct.htable_size / 256;
3576 if (!nf_ct_expect_hsize)
3577 nf_ct_expect_hsize = 1;
3578 }
3579 diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
3580 index 65c2a7b..4b1a56b 100644
3581 --- a/net/netfilter/nf_conntrack_helper.c
3582 +++ b/net/netfilter/nf_conntrack_helper.c
3583 @@ -192,7 +192,7 @@ static void __nf_conntrack_helper_unregister(struct nf_conntrack_helper *me,
3584 /* Get rid of expecteds, set helpers to NULL. */
3585 hlist_nulls_for_each_entry(h, nn, &net->ct.unconfirmed, hnnode)
3586 unhelp(h, me);
3587 - for (i = 0; i < nf_conntrack_htable_size; i++) {
3588 + for (i = 0; i < net->ct.htable_size; i++) {
3589 hlist_nulls_for_each_entry(h, nn, &net->ct.hash[i], hnnode)
3590 unhelp(h, me);
3591 }
3592 diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
3593 index 59d8064..d521718 100644
3594 --- a/net/netfilter/nf_conntrack_netlink.c
3595 +++ b/net/netfilter/nf_conntrack_netlink.c
3596 @@ -594,7 +594,7 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
3597
3598 rcu_read_lock();
3599 last = (struct nf_conn *)cb->args[1];
3600 - for (; cb->args[0] < nf_conntrack_htable_size; cb->args[0]++) {
3601 + for (; cb->args[0] < init_net.ct.htable_size; cb->args[0]++) {
3602 restart:
3603 hlist_nulls_for_each_entry_rcu(h, n, &init_net.ct.hash[cb->args[0]],
3604 hnnode) {
3605 diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
3606 index 1935153..1a84bf6 100644
3607 --- a/net/netfilter/nf_conntrack_standalone.c
3608 +++ b/net/netfilter/nf_conntrack_standalone.c
3609 @@ -51,7 +51,7 @@ static struct hlist_nulls_node *ct_get_first(struct seq_file *seq)
3610 struct hlist_nulls_node *n;
3611
3612 for (st->bucket = 0;
3613 - st->bucket < nf_conntrack_htable_size;
3614 + st->bucket < net->ct.htable_size;
3615 st->bucket++) {
3616 n = rcu_dereference(net->ct.hash[st->bucket].first);
3617 if (!is_a_nulls(n))
3618 @@ -69,7 +69,7 @@ static struct hlist_nulls_node *ct_get_next(struct seq_file *seq,
3619 head = rcu_dereference(head->next);
3620 while (is_a_nulls(head)) {
3621 if (likely(get_nulls_value(head) == st->bucket)) {
3622 - if (++st->bucket >= nf_conntrack_htable_size)
3623 + if (++st->bucket >= net->ct.htable_size)
3624 return NULL;
3625 }
3626 head = rcu_dereference(net->ct.hash[st->bucket].first);
3627 @@ -358,7 +358,7 @@ static ctl_table nf_ct_sysctl_table[] = {
3628 {
3629 .ctl_name = NET_NF_CONNTRACK_BUCKETS,
3630 .procname = "nf_conntrack_buckets",
3631 - .data = &nf_conntrack_htable_size,
3632 + .data = &init_net.ct.htable_size,
3633 .maxlen = sizeof(unsigned int),
3634 .mode = 0444,
3635 .proc_handler = proc_dointvec,
3636 @@ -429,6 +429,7 @@ static int nf_conntrack_standalone_init_sysctl(struct net *net)
3637 goto out_kmemdup;
3638
3639 table[1].data = &net->ct.count;
3640 + table[2].data = &net->ct.htable_size;
3641 table[3].data = &net->ct.sysctl_checksum;
3642 table[4].data = &net->ct.sysctl_log_invalid;
3643
3644 diff --git a/sound/pci/ctxfi/ctatc.c b/sound/pci/ctxfi/ctatc.c
3645 index 7545464..cb1f533 100644
3646 --- a/sound/pci/ctxfi/ctatc.c
3647 +++ b/sound/pci/ctxfi/ctatc.c
3648 @@ -166,18 +166,7 @@ static void ct_unmap_audio_buffer(struct ct_atc *atc, struct ct_atc_pcm *apcm)
3649
3650 static unsigned long atc_get_ptp_phys(struct ct_atc *atc, int index)
3651 {
3652 - struct ct_vm *vm;
3653 - void *kvirt_addr;
3654 - unsigned long phys_addr;
3655 -
3656 - vm = atc->vm;
3657 - kvirt_addr = vm->get_ptp_virt(vm, index);
3658 - if (kvirt_addr == NULL)
3659 - phys_addr = (~0UL);
3660 - else
3661 - phys_addr = virt_to_phys(kvirt_addr);
3662 -
3663 - return phys_addr;
3664 + return atc->vm->get_ptp_phys(atc->vm, index);
3665 }
3666
3667 static unsigned int convert_format(snd_pcm_format_t snd_format)
3668 @@ -1669,7 +1658,7 @@ int __devinit ct_atc_create(struct snd_card *card, struct pci_dev *pci,
3669 }
3670
3671 /* Set up device virtual memory management object */
3672 - err = ct_vm_create(&atc->vm);
3673 + err = ct_vm_create(&atc->vm, pci);
3674 if (err < 0)
3675 goto error1;
3676
3677 diff --git a/sound/pci/ctxfi/ctvmem.c b/sound/pci/ctxfi/ctvmem.c
3678 index 6b78752..65da6e4 100644
3679 --- a/sound/pci/ctxfi/ctvmem.c
3680 +++ b/sound/pci/ctxfi/ctvmem.c
3681 @@ -138,7 +138,7 @@ ct_vm_map(struct ct_vm *vm, struct snd_pcm_substream *substream, int size)
3682 return NULL;
3683 }
3684
3685 - ptp = vm->ptp[0];
3686 + ptp = (unsigned long *)vm->ptp[0].area;
3687 pte_start = (block->addr >> CT_PAGE_SHIFT);
3688 pages = block->size >> CT_PAGE_SHIFT;
3689 for (i = 0; i < pages; i++) {
3690 @@ -158,25 +158,25 @@ static void ct_vm_unmap(struct ct_vm *vm, struct ct_vm_block *block)
3691 }
3692
3693 /* *
3694 - * return the host (kmalloced) addr of the @index-th device
3695 - * page talbe page on success, or NULL on failure.
3696 - * The first returned NULL indicates the termination.
3697 + * return the host physical addr of the @index-th device
3698 + * page table page on success, or ~0UL on failure.
3699 + * The first returned ~0UL indicates the termination.
3700 * */
3701 -static void *
3702 -ct_get_ptp_virt(struct ct_vm *vm, int index)
3703 +static dma_addr_t
3704 +ct_get_ptp_phys(struct ct_vm *vm, int index)
3705 {
3706 - void *addr;
3707 + dma_addr_t addr;
3708
3709 - addr = (index >= CT_PTP_NUM) ? NULL : vm->ptp[index];
3710 + addr = (index >= CT_PTP_NUM) ? ~0UL : vm->ptp[index].addr;
3711
3712 return addr;
3713 }
3714
3715 -int ct_vm_create(struct ct_vm **rvm)
3716 +int ct_vm_create(struct ct_vm **rvm, struct pci_dev *pci)
3717 {
3718 struct ct_vm *vm;
3719 struct ct_vm_block *block;
3720 - int i;
3721 + int i, err = 0;
3722
3723 *rvm = NULL;
3724
3725 @@ -188,23 +188,21 @@ int ct_vm_create(struct ct_vm **rvm)
3726
3727 /* Allocate page table pages */
3728 for (i = 0; i < CT_PTP_NUM; i++) {
3729 - vm->ptp[i] = kmalloc(PAGE_SIZE, GFP_KERNEL);
3730 - if (!vm->ptp[i])
3731 + err = snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV,
3732 + snd_dma_pci_data(pci),
3733 + PAGE_SIZE, &vm->ptp[i]);
3734 + if (err < 0)
3735 break;
3736 }
3737 - if (!i) {
3738 + if (err < 0) {
3739 /* no page table pages are allocated */
3740 - kfree(vm);
3741 + ct_vm_destroy(vm);
3742 return -ENOMEM;
3743 }
3744 vm->size = CT_ADDRS_PER_PAGE * i;
3745 - /* Initialise remaining ptps */
3746 - for (; i < CT_PTP_NUM; i++)
3747 - vm->ptp[i] = NULL;
3748 -
3749 vm->map = ct_vm_map;
3750 vm->unmap = ct_vm_unmap;
3751 - vm->get_ptp_virt = ct_get_ptp_virt;
3752 + vm->get_ptp_phys = ct_get_ptp_phys;
3753 INIT_LIST_HEAD(&vm->unused);
3754 INIT_LIST_HEAD(&vm->used);
3755 block = kzalloc(sizeof(*block), GFP_KERNEL);
3756 @@ -242,7 +240,7 @@ void ct_vm_destroy(struct ct_vm *vm)
3757
3758 /* free allocated page table pages */
3759 for (i = 0; i < CT_PTP_NUM; i++)
3760 - kfree(vm->ptp[i]);
3761 + snd_dma_free_pages(&vm->ptp[i]);
3762
3763 vm->size = 0;
3764
3765 diff --git a/sound/pci/ctxfi/ctvmem.h b/sound/pci/ctxfi/ctvmem.h
3766 index 01e4fd0..b23adfc 100644
3767 --- a/sound/pci/ctxfi/ctvmem.h
3768 +++ b/sound/pci/ctxfi/ctvmem.h
3769 @@ -22,6 +22,8 @@
3770
3771 #include <linux/mutex.h>
3772 #include <linux/list.h>
3773 +#include <linux/pci.h>
3774 +#include <sound/memalloc.h>
3775
3776 /* The chip can handle the page table of 4k pages
3777 * (emu20k1 can handle even 8k pages, but we don't use it right now)
3778 @@ -41,7 +43,7 @@ struct snd_pcm_substream;
3779
3780 /* Virtual memory management object for card device */
3781 struct ct_vm {
3782 - void *ptp[CT_PTP_NUM]; /* Device page table pages */
3783 + struct snd_dma_buffer ptp[CT_PTP_NUM]; /* Device page table pages */
3784 unsigned int size; /* Available addr space in bytes */
3785 struct list_head unused; /* List of unused blocks */
3786 struct list_head used; /* List of used blocks */
3787 @@ -52,10 +54,10 @@ struct ct_vm {
3788 int size);
3789 /* Unmap device logical addr area. */
3790 void (*unmap)(struct ct_vm *, struct ct_vm_block *block);
3791 - void *(*get_ptp_virt)(struct ct_vm *vm, int index);
3792 + dma_addr_t (*get_ptp_phys)(struct ct_vm *vm, int index);
3793 };
3794
3795 -int ct_vm_create(struct ct_vm **rvm);
3796 +int ct_vm_create(struct ct_vm **rvm, struct pci_dev *pci);
3797 void ct_vm_destroy(struct ct_vm *vm);
3798
3799 #endif /* CTVMEM_H */
3800 diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
3801 index 03784da..fec8724 100644
3802 --- a/sound/pci/hda/hda_intel.c
3803 +++ b/sound/pci/hda/hda_intel.c
3804 @@ -1858,6 +1858,9 @@ static int azx_position_ok(struct azx *chip, struct azx_dev *azx_dev)
3805
3806 if (!bdl_pos_adj[chip->dev_index])
3807 return 1; /* no delayed ack */
3808 + if (WARN_ONCE(!azx_dev->period_bytes,
3809 + "hda-intel: zero azx_dev->period_bytes"))
3810 + return 0; /* this shouldn't happen! */
3811 if (pos % azx_dev->period_bytes > azx_dev->period_bytes / 2)
3812 return 0; /* NG - it's below the period boundary */
3813 return 1; /* OK, it's fine */
3814 diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
3815 index c2e9370..911dd1f 100644
3816 --- a/sound/pci/hda/patch_realtek.c
3817 +++ b/sound/pci/hda/patch_realtek.c
3818 @@ -7042,8 +7042,8 @@ static struct snd_kcontrol_new alc885_mb5_mixer[] = {
3819 HDA_BIND_MUTE ("Surround Playback Switch", 0x0d, 0x02, HDA_INPUT),
3820 HDA_CODEC_VOLUME("LFE Playback Volume", 0x0e, 0x00, HDA_OUTPUT),
3821 HDA_BIND_MUTE ("LFE Playback Switch", 0x0e, 0x02, HDA_INPUT),
3822 - HDA_CODEC_VOLUME("HP Playback Volume", 0x0f, 0x00, HDA_OUTPUT),
3823 - HDA_BIND_MUTE ("HP Playback Switch", 0x0f, 0x02, HDA_INPUT),
3824 + HDA_CODEC_VOLUME("Headphone Playback Volume", 0x0f, 0x00, HDA_OUTPUT),
3825 + HDA_BIND_MUTE ("Headphone Playback Switch", 0x0f, 0x02, HDA_INPUT),
3826 HDA_CODEC_VOLUME("Line Playback Volume", 0x0b, 0x02, HDA_INPUT),
3827 HDA_CODEC_MUTE ("Line Playback Switch", 0x0b, 0x02, HDA_INPUT),
3828 HDA_CODEC_VOLUME("Mic Playback Volume", 0x0b, 0x01, HDA_INPUT),
3829 @@ -7430,6 +7430,7 @@ static struct hda_verb alc885_mb5_init_verbs[] = {
3830 {0x14, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT},
3831 {0x14, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE},
3832 {0x14, AC_VERB_SET_CONNECT_SEL, 0x03},
3833 + {0x14, AC_VERB_SET_UNSOLICITED_ENABLE, ALC880_HP_EVENT | AC_USRSP_EN},
3834 /* Front Mic pin: input vref at 80% */
3835 {0x19, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_VREF80},
3836 {0x19, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE},
3837 @@ -7554,6 +7555,27 @@ static void alc885_mbp3_setup(struct hda_codec *codec)
3838 spec->autocfg.speaker_pins[0] = 0x14;
3839 }
3840
3841 +static void alc885_mb5_automute(struct hda_codec *codec)
3842 +{
3843 + unsigned int present;
3844 +
3845 + present = snd_hda_codec_read(codec, 0x14, 0,
3846 + AC_VERB_GET_PIN_SENSE, 0) & 0x80000000;
3847 + snd_hda_codec_amp_stereo(codec, 0x18, HDA_OUTPUT, 0,
3848 + HDA_AMP_MUTE, present ? HDA_AMP_MUTE : 0);
3849 + snd_hda_codec_amp_stereo(codec, 0x1a, HDA_OUTPUT, 0,
3850 + HDA_AMP_MUTE, present ? HDA_AMP_MUTE : 0);
3851 +
3852 +}
3853 +
3854 +static void alc885_mb5_unsol_event(struct hda_codec *codec,
3855 + unsigned int res)
3856 +{
3857 + /* Headphone insertion or removal. */
3858 + if ((res >> 26) == ALC880_HP_EVENT)
3859 + alc885_mb5_automute(codec);
3860 +}
3861 +
3862
3863 static struct hda_verb alc882_targa_verbs[] = {
3864 {0x0c, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_UNMUTE(0)},
3865 @@ -8996,6 +9018,8 @@ static struct alc_config_preset alc882_presets[] = {
3866 .input_mux = &mb5_capture_source,
3867 .dig_out_nid = ALC882_DIGOUT_NID,
3868 .dig_in_nid = ALC882_DIGIN_NID,
3869 + .unsol_event = alc885_mb5_unsol_event,
3870 + .init_hook = alc885_mb5_automute,
3871 },
3872 [ALC885_MACPRO] = {
3873 .mixers = { alc882_macpro_mixer },
3874 diff --git a/sound/usb/usbaudio.c b/sound/usb/usbaudio.c
3875 index 8803d9d..f26a125 100644
3876 --- a/sound/usb/usbaudio.c
3877 +++ b/sound/usb/usbaudio.c
3878 @@ -1936,7 +1936,7 @@ static int snd_usb_pcm_close(struct snd_pcm_substream *substream, int direction)
3879 struct snd_usb_stream *as = snd_pcm_substream_chip(substream);
3880 struct snd_usb_substream *subs = &as->substream[direction];
3881
3882 - if (subs->interface >= 0) {
3883 + if (!as->chip->shutdown && subs->interface >= 0) {
3884 usb_set_interface(subs->dev, subs->interface, 0);
3885 subs->interface = -1;
3886 }

  ViewVC Help
Powered by ViewVC 1.1.20