/[linux-patches]/genpatches-2.6/tags/2.6.38-5/1002_linux-2.6.38.3.patch
Gentoo

Contents of /genpatches-2.6/tags/2.6.38-5/1002_linux-2.6.38.3.patch

Parent Directory Parent Directory | Revision Log Revision Log


Revision 1910 - (show annotations) (download)
Tue May 3 13:08:58 2011 UTC (3 years, 7 months ago) by mpagano
File size: 134373 byte(s)
2.6.38-5 release
1 diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
2 index 09d31db..aa92696 100644
3 --- a/arch/powerpc/kernel/time.c
4 +++ b/arch/powerpc/kernel/time.c
5 @@ -356,7 +356,7 @@ void account_system_vtime(struct task_struct *tsk)
6 }
7 get_paca()->user_time_scaled += user_scaled;
8
9 - if (in_irq() || idle_task(smp_processor_id()) != tsk) {
10 + if (in_interrupt() || idle_task(smp_processor_id()) != tsk) {
11 account_system_time(tsk, 0, delta, sys_scaled);
12 if (stolen)
13 account_steal_time(stolen);
14 diff --git a/arch/x86/crypto/aesni-intel_asm.S b/arch/x86/crypto/aesni-intel_asm.S
15 index 8fe2a49..4292df7 100644
16 --- a/arch/x86/crypto/aesni-intel_asm.S
17 +++ b/arch/x86/crypto/aesni-intel_asm.S
18 @@ -1612,6 +1612,7 @@ _zero_cipher_left_encrypt:
19 movdqa SHUF_MASK(%rip), %xmm10
20 PSHUFB_XMM %xmm10, %xmm0
21
22 +
23 ENCRYPT_SINGLE_BLOCK %xmm0, %xmm1 # Encrypt(K, Yn)
24 sub $16, %r11
25 add %r13, %r11
26 @@ -1634,7 +1635,9 @@ _zero_cipher_left_encrypt:
27 # GHASH computation for the last <16 byte block
28 sub %r13, %r11
29 add $16, %r11
30 - PSHUFB_XMM %xmm10, %xmm1
31 +
32 + movdqa SHUF_MASK(%rip), %xmm10
33 + PSHUFB_XMM %xmm10, %xmm0
34
35 # shuffle xmm0 back to output as ciphertext
36
37 diff --git a/arch/x86/crypto/aesni-intel_glue.c b/arch/x86/crypto/aesni-intel_glue.c
38 index e1e60c7..b375b2a 100644
39 --- a/arch/x86/crypto/aesni-intel_glue.c
40 +++ b/arch/x86/crypto/aesni-intel_glue.c
41 @@ -828,9 +828,15 @@ static int rfc4106_init(struct crypto_tfm *tfm)
42 struct cryptd_aead *cryptd_tfm;
43 struct aesni_rfc4106_gcm_ctx *ctx = (struct aesni_rfc4106_gcm_ctx *)
44 PTR_ALIGN((u8 *)crypto_tfm_ctx(tfm), AESNI_ALIGN);
45 + struct crypto_aead *cryptd_child;
46 + struct aesni_rfc4106_gcm_ctx *child_ctx;
47 cryptd_tfm = cryptd_alloc_aead("__driver-gcm-aes-aesni", 0, 0);
48 if (IS_ERR(cryptd_tfm))
49 return PTR_ERR(cryptd_tfm);
50 +
51 + cryptd_child = cryptd_aead_child(cryptd_tfm);
52 + child_ctx = aesni_rfc4106_gcm_ctx_get(cryptd_child);
53 + memcpy(child_ctx, ctx, sizeof(*ctx));
54 ctx->cryptd_tfm = cryptd_tfm;
55 tfm->crt_aead.reqsize = sizeof(struct aead_request)
56 + crypto_aead_reqsize(&cryptd_tfm->base);
57 @@ -925,6 +931,9 @@ static int rfc4106_set_key(struct crypto_aead *parent, const u8 *key,
58 int ret = 0;
59 struct crypto_tfm *tfm = crypto_aead_tfm(parent);
60 struct aesni_rfc4106_gcm_ctx *ctx = aesni_rfc4106_gcm_ctx_get(parent);
61 + struct crypto_aead *cryptd_child = cryptd_aead_child(ctx->cryptd_tfm);
62 + struct aesni_rfc4106_gcm_ctx *child_ctx =
63 + aesni_rfc4106_gcm_ctx_get(cryptd_child);
64 u8 *new_key_mem = NULL;
65
66 if (key_len < 4) {
67 @@ -968,6 +977,7 @@ static int rfc4106_set_key(struct crypto_aead *parent, const u8 *key,
68 goto exit;
69 }
70 ret = rfc4106_set_hash_subkey(ctx->hash_subkey, key, key_len);
71 + memcpy(child_ctx, ctx, sizeof(*ctx));
72 exit:
73 kfree(new_key_mem);
74 return ret;
75 @@ -999,7 +1009,6 @@ static int rfc4106_encrypt(struct aead_request *req)
76 int ret;
77 struct crypto_aead *tfm = crypto_aead_reqtfm(req);
78 struct aesni_rfc4106_gcm_ctx *ctx = aesni_rfc4106_gcm_ctx_get(tfm);
79 - struct crypto_aead *cryptd_child = cryptd_aead_child(ctx->cryptd_tfm);
80
81 if (!irq_fpu_usable()) {
82 struct aead_request *cryptd_req =
83 @@ -1008,6 +1017,7 @@ static int rfc4106_encrypt(struct aead_request *req)
84 aead_request_set_tfm(cryptd_req, &ctx->cryptd_tfm->base);
85 return crypto_aead_encrypt(cryptd_req);
86 } else {
87 + struct crypto_aead *cryptd_child = cryptd_aead_child(ctx->cryptd_tfm);
88 kernel_fpu_begin();
89 ret = cryptd_child->base.crt_aead.encrypt(req);
90 kernel_fpu_end();
91 @@ -1020,7 +1030,6 @@ static int rfc4106_decrypt(struct aead_request *req)
92 int ret;
93 struct crypto_aead *tfm = crypto_aead_reqtfm(req);
94 struct aesni_rfc4106_gcm_ctx *ctx = aesni_rfc4106_gcm_ctx_get(tfm);
95 - struct crypto_aead *cryptd_child = cryptd_aead_child(ctx->cryptd_tfm);
96
97 if (!irq_fpu_usable()) {
98 struct aead_request *cryptd_req =
99 @@ -1029,6 +1038,7 @@ static int rfc4106_decrypt(struct aead_request *req)
100 aead_request_set_tfm(cryptd_req, &ctx->cryptd_tfm->base);
101 return crypto_aead_decrypt(cryptd_req);
102 } else {
103 + struct crypto_aead *cryptd_child = cryptd_aead_child(ctx->cryptd_tfm);
104 kernel_fpu_begin();
105 ret = cryptd_child->base.crt_aead.decrypt(req);
106 kernel_fpu_end();
107 diff --git a/arch/x86/kernel/cpu/mtrr/main.c b/arch/x86/kernel/cpu/mtrr/main.c
108 index bebabec..151787e 100644
109 --- a/arch/x86/kernel/cpu/mtrr/main.c
110 +++ b/arch/x86/kernel/cpu/mtrr/main.c
111 @@ -292,14 +292,24 @@ set_mtrr(unsigned int reg, unsigned long base, unsigned long size, mtrr_type typ
112
113 /*
114 * HACK!
115 - * We use this same function to initialize the mtrrs on boot.
116 - * The state of the boot cpu's mtrrs has been saved, and we want
117 - * to replicate across all the APs.
118 - * If we're doing that @reg is set to something special...
119 + *
120 + * We use this same function to initialize the mtrrs during boot,
121 + * resume, runtime cpu online and on an explicit request to set a
122 + * specific MTRR.
123 + *
124 + * During boot or suspend, the state of the boot cpu's mtrrs has been
125 + * saved, and we want to replicate that across all the cpus that come
126 + * online (either at the end of boot or resume or during a runtime cpu
127 + * online). If we're doing that, @reg is set to something special and on
128 + * this cpu we still do mtrr_if->set_all(). During boot/resume, this
129 + * is unnecessary if at this point we are still on the cpu that started
130 + * the boot/resume sequence. But there is no guarantee that we are still
131 + * on the same cpu. So we do mtrr_if->set_all() on this cpu aswell to be
132 + * sure that we are in sync with everyone else.
133 */
134 if (reg != ~0U)
135 mtrr_if->set(reg, base, size, type);
136 - else if (!mtrr_aps_delayed_init)
137 + else
138 mtrr_if->set_all();
139
140 /* Wait for the others */
141 diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
142 index 5655c22..2d2673c 100644
143 --- a/arch/x86/kernel/head64.c
144 +++ b/arch/x86/kernel/head64.c
145 @@ -77,6 +77,9 @@ void __init x86_64_start_kernel(char * real_mode_data)
146 /* Make NULL pointers segfault */
147 zap_identity_mappings();
148
149 + /* Cleanup the over mapped high alias */
150 + cleanup_highmap();
151 +
152 max_pfn_mapped = KERNEL_IMAGE_SIZE >> PAGE_SHIFT;
153
154 for (i = 0; i < NUM_EXCEPTION_VECTORS; i++) {
155 diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
156 index e543fe9..d3cfe26 100644
157 --- a/arch/x86/kernel/setup.c
158 +++ b/arch/x86/kernel/setup.c
159 @@ -297,9 +297,6 @@ static void __init init_gbpages(void)
160 static inline void init_gbpages(void)
161 {
162 }
163 -static void __init cleanup_highmap(void)
164 -{
165 -}
166 #endif
167
168 static void __init reserve_brk(void)
169 @@ -925,8 +922,6 @@ void __init setup_arch(char **cmdline_p)
170 */
171 reserve_brk();
172
173 - cleanup_highmap();
174 -
175 memblock.current_limit = get_max_mapped();
176 memblock_x86_fill();
177
178 diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
179 index f13ff3a..947f42a 100644
180 --- a/arch/x86/mm/init.c
181 +++ b/arch/x86/mm/init.c
182 @@ -279,6 +279,25 @@ unsigned long __init_refok init_memory_mapping(unsigned long start,
183 load_cr3(swapper_pg_dir);
184 #endif
185
186 +#ifdef CONFIG_X86_64
187 + if (!after_bootmem && !start) {
188 + pud_t *pud;
189 + pmd_t *pmd;
190 +
191 + mmu_cr4_features = read_cr4();
192 +
193 + /*
194 + * _brk_end cannot change anymore, but it and _end may be
195 + * located on different 2M pages. cleanup_highmap(), however,
196 + * can only consider _end when it runs, so destroy any
197 + * mappings beyond _brk_end here.
198 + */
199 + pud = pud_offset(pgd_offset_k(_brk_end), _brk_end);
200 + pmd = pmd_offset(pud, _brk_end - 1);
201 + while (++pmd <= pmd_offset(pud, (unsigned long)_end - 1))
202 + pmd_clear(pmd);
203 + }
204 +#endif
205 __flush_tlb_all();
206
207 if (!after_bootmem && e820_table_end > e820_table_start)
208 diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
209 index 68f9921..c14a542 100644
210 --- a/arch/x86/mm/init_64.c
211 +++ b/arch/x86/mm/init_64.c
212 @@ -51,7 +51,6 @@
213 #include <asm/numa.h>
214 #include <asm/cacheflush.h>
215 #include <asm/init.h>
216 -#include <asm/setup.h>
217
218 static int __init parse_direct_gbpages_off(char *arg)
219 {
220 @@ -294,18 +293,18 @@ void __init init_extra_mapping_uc(unsigned long phys, unsigned long size)
221 * to the compile time generated pmds. This results in invalid pmds up
222 * to the point where we hit the physaddr 0 mapping.
223 *
224 - * We limit the mappings to the region from _text to _brk_end. _brk_end
225 - * is rounded up to the 2MB boundary. This catches the invalid pmds as
226 + * We limit the mappings to the region from _text to _end. _end is
227 + * rounded up to the 2MB boundary. This catches the invalid pmds as
228 * well, as they are located before _text:
229 */
230 void __init cleanup_highmap(void)
231 {
232 unsigned long vaddr = __START_KERNEL_map;
233 - unsigned long vaddr_end = __START_KERNEL_map + (max_pfn_mapped << PAGE_SHIFT);
234 - unsigned long end = roundup((unsigned long)_brk_end, PMD_SIZE) - 1;
235 + unsigned long end = roundup((unsigned long)_end, PMD_SIZE) - 1;
236 pmd_t *pmd = level2_kernel_pgt;
237 + pmd_t *last_pmd = pmd + PTRS_PER_PMD;
238
239 - for (; vaddr + PMD_SIZE - 1 < vaddr_end; pmd++, vaddr += PMD_SIZE) {
240 + for (; pmd < last_pmd; pmd++, vaddr += PMD_SIZE) {
241 if (pmd_none(*pmd))
242 continue;
243 if (vaddr < (unsigned long) _text || vaddr > end)
244 diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
245 index 8524939..c7358dd 100644
246 --- a/drivers/acpi/pci_root.c
247 +++ b/drivers/acpi/pci_root.c
248 @@ -564,7 +564,7 @@ static int __devinit acpi_pci_root_add(struct acpi_device *device)
249 /* Indicate support for various _OSC capabilities. */
250 if (pci_ext_cfg_avail(root->bus->self))
251 flags |= OSC_EXT_PCI_CONFIG_SUPPORT;
252 - if (pcie_aspm_enabled())
253 + if (pcie_aspm_support_enabled())
254 flags |= OSC_ACTIVE_STATE_PWR_SUPPORT |
255 OSC_CLOCK_PWR_CAPABILITY_SUPPORT;
256 if (pci_msi_enabled())
257 diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
258 index 25ef1a4..b836e11 100644
259 --- a/drivers/atm/solos-pci.c
260 +++ b/drivers/atm/solos-pci.c
261 @@ -165,7 +165,6 @@ static uint32_t fpga_tx(struct solos_card *);
262 static irqreturn_t solos_irq(int irq, void *dev_id);
263 static struct atm_vcc* find_vcc(struct atm_dev *dev, short vpi, int vci);
264 static int list_vccs(int vci);
265 -static void release_vccs(struct atm_dev *dev);
266 static int atm_init(struct solos_card *, struct device *);
267 static void atm_remove(struct solos_card *);
268 static int send_command(struct solos_card *card, int dev, const char *buf, size_t size);
269 @@ -384,7 +383,6 @@ static int process_status(struct solos_card *card, int port, struct sk_buff *skb
270 /* Anything but 'Showtime' is down */
271 if (strcmp(state_str, "Showtime")) {
272 atm_dev_signal_change(card->atmdev[port], ATM_PHY_SIG_LOST);
273 - release_vccs(card->atmdev[port]);
274 dev_info(&card->dev->dev, "Port %d: %s\n", port, state_str);
275 return 0;
276 }
277 @@ -697,7 +695,7 @@ void solos_bh(unsigned long card_arg)
278 size);
279 }
280 if (atmdebug) {
281 - dev_info(&card->dev->dev, "Received: device %d\n", port);
282 + dev_info(&card->dev->dev, "Received: port %d\n", port);
283 dev_info(&card->dev->dev, "size: %d VPI: %d VCI: %d\n",
284 size, le16_to_cpu(header->vpi),
285 le16_to_cpu(header->vci));
286 @@ -830,28 +828,6 @@ static int list_vccs(int vci)
287 return num_found;
288 }
289
290 -static void release_vccs(struct atm_dev *dev)
291 -{
292 - int i;
293 -
294 - write_lock_irq(&vcc_sklist_lock);
295 - for (i = 0; i < VCC_HTABLE_SIZE; i++) {
296 - struct hlist_head *head = &vcc_hash[i];
297 - struct hlist_node *node, *tmp;
298 - struct sock *s;
299 - struct atm_vcc *vcc;
300 -
301 - sk_for_each_safe(s, node, tmp, head) {
302 - vcc = atm_sk(s);
303 - if (vcc->dev == dev) {
304 - vcc_release_async(vcc, -EPIPE);
305 - sk_del_node_init(s);
306 - }
307 - }
308 - }
309 - write_unlock_irq(&vcc_sklist_lock);
310 -}
311 -
312
313 static int popen(struct atm_vcc *vcc)
314 {
315 @@ -1018,8 +994,15 @@ static uint32_t fpga_tx(struct solos_card *card)
316
317 /* Clean up and free oldskb now it's gone */
318 if (atmdebug) {
319 + struct pkt_hdr *header = (void *)oldskb->data;
320 + int size = le16_to_cpu(header->size);
321 +
322 + skb_pull(oldskb, sizeof(*header));
323 dev_info(&card->dev->dev, "Transmitted: port %d\n",
324 port);
325 + dev_info(&card->dev->dev, "size: %d VPI: %d VCI: %d\n",
326 + size, le16_to_cpu(header->vpi),
327 + le16_to_cpu(header->vci));
328 print_buffer(oldskb);
329 }
330
331 @@ -1262,7 +1245,7 @@ static int atm_init(struct solos_card *card, struct device *parent)
332 card->atmdev[i]->ci_range.vci_bits = 16;
333 card->atmdev[i]->dev_data = card;
334 card->atmdev[i]->phy_data = (void *)(unsigned long)i;
335 - atm_dev_signal_change(card->atmdev[i], ATM_PHY_SIG_UNKNOWN);
336 + atm_dev_signal_change(card->atmdev[i], ATM_PHY_SIG_FOUND);
337
338 skb = alloc_skb(sizeof(*header), GFP_ATOMIC);
339 if (!skb) {
340 diff --git a/drivers/block/cciss.h b/drivers/block/cciss.h
341 index 579f749..554bbd9 100644
342 --- a/drivers/block/cciss.h
343 +++ b/drivers/block/cciss.h
344 @@ -222,6 +222,7 @@ static void SA5_submit_command( ctlr_info_t *h, CommandList_struct *c)
345 h->ctlr, c->busaddr);
346 #endif /* CCISS_DEBUG */
347 writel(c->busaddr, h->vaddr + SA5_REQUEST_PORT_OFFSET);
348 + readl(h->vaddr + SA5_REQUEST_PORT_OFFSET);
349 h->commands_outstanding++;
350 if ( h->commands_outstanding > h->max_outstanding)
351 h->max_outstanding = h->commands_outstanding;
352 diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
353 index 700a384..f44ca40 100644
354 --- a/drivers/bluetooth/btusb.c
355 +++ b/drivers/bluetooth/btusb.c
356 @@ -71,6 +71,9 @@ static struct usb_device_id btusb_table[] = {
357 /* Apple MacBookAir3,1, MacBookAir3,2 */
358 { USB_DEVICE(0x05ac, 0x821b) },
359
360 + /* Apple MacBookPro8,2 */
361 + { USB_DEVICE(0x05ac, 0x821a) },
362 +
363 /* AVM BlueFRITZ! USB v2.0 */
364 { USB_DEVICE(0x057c, 0x3800) },
365
366 diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
367 index 1f46f1c..7beb0e2 100644
368 --- a/drivers/char/tpm/tpm.c
369 +++ b/drivers/char/tpm/tpm.c
370 @@ -980,7 +980,7 @@ int tpm_open(struct inode *inode, struct file *file)
371 return -EBUSY;
372 }
373
374 - chip->data_buffer = kmalloc(TPM_BUFSIZE * sizeof(u8), GFP_KERNEL);
375 + chip->data_buffer = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
376 if (chip->data_buffer == NULL) {
377 clear_bit(0, &chip->is_open);
378 put_device(chip->dev);
379 diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
380 index 23e0355..7e0e660 100644
381 --- a/drivers/edac/amd64_edac.c
382 +++ b/drivers/edac/amd64_edac.c
383 @@ -2765,7 +2765,7 @@ static int __init amd64_edac_init(void)
384 mcis = kzalloc(amd_nb_num() * sizeof(mcis[0]), GFP_KERNEL);
385 ecc_stngs = kzalloc(amd_nb_num() * sizeof(ecc_stngs[0]), GFP_KERNEL);
386 if (!(mcis && ecc_stngs))
387 - goto err_ret;
388 + goto err_free;
389
390 msrs = msrs_alloc();
391 if (!msrs)
392 diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
393 index 02d5c41..99768d9 100644
394 --- a/drivers/gpu/drm/radeon/radeon_atombios.c
395 +++ b/drivers/gpu/drm/radeon/radeon_atombios.c
396 @@ -675,7 +675,8 @@ bool radeon_get_atom_connector_info_from_object_table(struct drm_device *dev)
397 ATOM_ENCODER_CAP_RECORD *cap_record;
398 u16 caps = 0;
399
400 - while (record->ucRecordType > 0 &&
401 + while (record->ucRecordSize > 0 &&
402 + record->ucRecordType > 0 &&
403 record->ucRecordType <= ATOM_MAX_OBJECT_RECORD_NUMBER) {
404 switch (record->ucRecordType) {
405 case ATOM_ENCODER_CAP_RECORD_TYPE:
406 @@ -720,7 +721,8 @@ bool radeon_get_atom_connector_info_from_object_table(struct drm_device *dev)
407 break;
408 }
409
410 - while (record->ucRecordType > 0 &&
411 + while (record->ucRecordSize > 0 &&
412 + record->ucRecordType > 0 &&
413 record->ucRecordType <= ATOM_MAX_OBJECT_RECORD_NUMBER) {
414 switch (record->ucRecordType) {
415 case ATOM_I2C_RECORD_TYPE:
416 @@ -782,10 +784,9 @@ bool radeon_get_atom_connector_info_from_object_table(struct drm_device *dev)
417 ATOM_HPD_INT_RECORD *hpd_record;
418 ATOM_I2C_ID_CONFIG_ACCESS *i2c_config;
419
420 - while (record->ucRecordType > 0
421 - && record->
422 - ucRecordType <=
423 - ATOM_MAX_OBJECT_RECORD_NUMBER) {
424 + while (record->ucRecordSize > 0 &&
425 + record->ucRecordType > 0 &&
426 + record->ucRecordType <= ATOM_MAX_OBJECT_RECORD_NUMBER) {
427 switch (record->ucRecordType) {
428 case ATOM_I2C_RECORD_TYPE:
429 i2c_record =
430 diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c
431 index 318cc40..418c399 100644
432 --- a/drivers/hid/hid-magicmouse.c
433 +++ b/drivers/hid/hid-magicmouse.c
434 @@ -418,6 +418,8 @@ static void magicmouse_setup_input(struct input_dev *input, struct hid_device *h
435 input_set_abs_params(input, ABS_MT_POSITION_Y, -2456,
436 2565, 4, 0);
437 }
438 +
439 + input_set_events_per_packet(input, 60);
440 }
441
442 if (report_undeciphered) {
443 diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
444 index aa186cf..e06e045 100644
445 --- a/drivers/input/mouse/synaptics.c
446 +++ b/drivers/input/mouse/synaptics.c
447 @@ -836,8 +836,8 @@ static const struct dmi_system_id __initconst toshiba_dmi_table[] = {
448 },
449
450 },
451 - { }
452 #endif
453 + { }
454 };
455
456 static bool broken_olpc_ec;
457 @@ -851,8 +851,8 @@ static const struct dmi_system_id __initconst olpc_dmi_table[] = {
458 DMI_MATCH(DMI_PRODUCT_NAME, "XO"),
459 },
460 },
461 - { }
462 #endif
463 + { }
464 };
465
466 void __init synaptics_module_init(void)
467 diff --git a/drivers/leds/leds-lp5521.c b/drivers/leds/leds-lp5521.c
468 index 80a3ae3..c0cff64 100644
469 --- a/drivers/leds/leds-lp5521.c
470 +++ b/drivers/leds/leds-lp5521.c
471 @@ -534,7 +534,7 @@ static ssize_t lp5521_selftest(struct device *dev,
472 }
473
474 /* led class device attributes */
475 -static DEVICE_ATTR(led_current, S_IRUGO | S_IWUGO, show_current, store_current);
476 +static DEVICE_ATTR(led_current, S_IRUGO | S_IWUSR, show_current, store_current);
477 static DEVICE_ATTR(max_current, S_IRUGO , show_max_current, NULL);
478
479 static struct attribute *lp5521_led_attributes[] = {
480 @@ -548,15 +548,15 @@ static struct attribute_group lp5521_led_attribute_group = {
481 };
482
483 /* device attributes */
484 -static DEVICE_ATTR(engine1_mode, S_IRUGO | S_IWUGO,
485 +static DEVICE_ATTR(engine1_mode, S_IRUGO | S_IWUSR,
486 show_engine1_mode, store_engine1_mode);
487 -static DEVICE_ATTR(engine2_mode, S_IRUGO | S_IWUGO,
488 +static DEVICE_ATTR(engine2_mode, S_IRUGO | S_IWUSR,
489 show_engine2_mode, store_engine2_mode);
490 -static DEVICE_ATTR(engine3_mode, S_IRUGO | S_IWUGO,
491 +static DEVICE_ATTR(engine3_mode, S_IRUGO | S_IWUSR,
492 show_engine3_mode, store_engine3_mode);
493 -static DEVICE_ATTR(engine1_load, S_IWUGO, NULL, store_engine1_load);
494 -static DEVICE_ATTR(engine2_load, S_IWUGO, NULL, store_engine2_load);
495 -static DEVICE_ATTR(engine3_load, S_IWUGO, NULL, store_engine3_load);
496 +static DEVICE_ATTR(engine1_load, S_IWUSR, NULL, store_engine1_load);
497 +static DEVICE_ATTR(engine2_load, S_IWUSR, NULL, store_engine2_load);
498 +static DEVICE_ATTR(engine3_load, S_IWUSR, NULL, store_engine3_load);
499 static DEVICE_ATTR(selftest, S_IRUGO, lp5521_selftest, NULL);
500
501 static struct attribute *lp5521_attributes[] = {
502 diff --git a/drivers/leds/leds-lp5523.c b/drivers/leds/leds-lp5523.c
503 index d0c4068..e19fed2 100644
504 --- a/drivers/leds/leds-lp5523.c
505 +++ b/drivers/leds/leds-lp5523.c
506 @@ -713,7 +713,7 @@ static ssize_t store_current(struct device *dev,
507 }
508
509 /* led class device attributes */
510 -static DEVICE_ATTR(led_current, S_IRUGO | S_IWUGO, show_current, store_current);
511 +static DEVICE_ATTR(led_current, S_IRUGO | S_IWUSR, show_current, store_current);
512 static DEVICE_ATTR(max_current, S_IRUGO , show_max_current, NULL);
513
514 static struct attribute *lp5523_led_attributes[] = {
515 @@ -727,21 +727,21 @@ static struct attribute_group lp5523_led_attribute_group = {
516 };
517
518 /* device attributes */
519 -static DEVICE_ATTR(engine1_mode, S_IRUGO | S_IWUGO,
520 +static DEVICE_ATTR(engine1_mode, S_IRUGO | S_IWUSR,
521 show_engine1_mode, store_engine1_mode);
522 -static DEVICE_ATTR(engine2_mode, S_IRUGO | S_IWUGO,
523 +static DEVICE_ATTR(engine2_mode, S_IRUGO | S_IWUSR,
524 show_engine2_mode, store_engine2_mode);
525 -static DEVICE_ATTR(engine3_mode, S_IRUGO | S_IWUGO,
526 +static DEVICE_ATTR(engine3_mode, S_IRUGO | S_IWUSR,
527 show_engine3_mode, store_engine3_mode);
528 -static DEVICE_ATTR(engine1_leds, S_IRUGO | S_IWUGO,
529 +static DEVICE_ATTR(engine1_leds, S_IRUGO | S_IWUSR,
530 show_engine1_leds, store_engine1_leds);
531 -static DEVICE_ATTR(engine2_leds, S_IRUGO | S_IWUGO,
532 +static DEVICE_ATTR(engine2_leds, S_IRUGO | S_IWUSR,
533 show_engine2_leds, store_engine2_leds);
534 -static DEVICE_ATTR(engine3_leds, S_IRUGO | S_IWUGO,
535 +static DEVICE_ATTR(engine3_leds, S_IRUGO | S_IWUSR,
536 show_engine3_leds, store_engine3_leds);
537 -static DEVICE_ATTR(engine1_load, S_IWUGO, NULL, store_engine1_load);
538 -static DEVICE_ATTR(engine2_load, S_IWUGO, NULL, store_engine2_load);
539 -static DEVICE_ATTR(engine3_load, S_IWUGO, NULL, store_engine3_load);
540 +static DEVICE_ATTR(engine1_load, S_IWUSR, NULL, store_engine1_load);
541 +static DEVICE_ATTR(engine2_load, S_IWUSR, NULL, store_engine2_load);
542 +static DEVICE_ATTR(engine3_load, S_IWUSR, NULL, store_engine3_load);
543 static DEVICE_ATTR(selftest, S_IRUGO, lp5523_selftest, NULL);
544
545 static struct attribute *lp5523_attributes[] = {
546 diff --git a/drivers/media/radio/Kconfig b/drivers/media/radio/Kconfig
547 index ecdffa6..c090246 100644
548 --- a/drivers/media/radio/Kconfig
549 +++ b/drivers/media/radio/Kconfig
550 @@ -441,6 +441,7 @@ config RADIO_TIMBERDALE
551 config RADIO_WL1273
552 tristate "Texas Instruments WL1273 I2C FM Radio"
553 depends on I2C && VIDEO_V4L2
554 + select MFD_CORE
555 select MFD_WL1273_CORE
556 select FW_LOADER
557 ---help---
558 diff --git a/drivers/media/video/tlg2300/pd-video.c b/drivers/media/video/tlg2300/pd-video.c
559 index df33a1d..a794ae6 100644
560 --- a/drivers/media/video/tlg2300/pd-video.c
561 +++ b/drivers/media/video/tlg2300/pd-video.c
562 @@ -764,10 +764,8 @@ static int pd_vidioc_s_fmt(struct poseidon *pd, struct v4l2_pix_format *pix)
563 }
564 ret |= send_set_req(pd, VIDEO_ROSOLU_SEL,
565 vid_resol, &cmd_status);
566 - if (ret || cmd_status) {
567 - mutex_unlock(&pd->lock);
568 + if (ret || cmd_status)
569 return -EBUSY;
570 - }
571
572 pix_def->pixelformat = pix->pixelformat; /* save it */
573 pix->height = (context->tvnormid & V4L2_STD_525_60) ? 480 : 576;
574 diff --git a/drivers/mfd/ab3100-core.c b/drivers/mfd/ab3100-core.c
575 index 4193af5..1707d22 100644
576 --- a/drivers/mfd/ab3100-core.c
577 +++ b/drivers/mfd/ab3100-core.c
578 @@ -613,7 +613,7 @@ static void ab3100_setup_debugfs(struct ab3100 *ab3100)
579 ab3100_get_priv.ab3100 = ab3100;
580 ab3100_get_priv.mode = false;
581 ab3100_get_reg_file = debugfs_create_file("get_reg",
582 - S_IWUGO, ab3100_dir, &ab3100_get_priv,
583 + S_IWUSR, ab3100_dir, &ab3100_get_priv,
584 &ab3100_get_set_reg_fops);
585 if (!ab3100_get_reg_file) {
586 err = -ENOMEM;
587 @@ -623,7 +623,7 @@ static void ab3100_setup_debugfs(struct ab3100 *ab3100)
588 ab3100_set_priv.ab3100 = ab3100;
589 ab3100_set_priv.mode = true;
590 ab3100_set_reg_file = debugfs_create_file("set_reg",
591 - S_IWUGO, ab3100_dir, &ab3100_set_priv,
592 + S_IWUSR, ab3100_dir, &ab3100_set_priv,
593 &ab3100_get_set_reg_fops);
594 if (!ab3100_set_reg_file) {
595 err = -ENOMEM;
596 diff --git a/drivers/mfd/ab3550-core.c b/drivers/mfd/ab3550-core.c
597 index 5fbca34..681984d 100644
598 --- a/drivers/mfd/ab3550-core.c
599 +++ b/drivers/mfd/ab3550-core.c
600 @@ -1053,17 +1053,17 @@ static inline void ab3550_setup_debugfs(struct ab3550 *ab)
601 goto exit_destroy_dir;
602
603 ab3550_bank_file = debugfs_create_file("register-bank",
604 - (S_IRUGO | S_IWUGO), ab3550_dir, ab, &ab3550_bank_fops);
605 + (S_IRUGO | S_IWUSR), ab3550_dir, ab, &ab3550_bank_fops);
606 if (!ab3550_bank_file)
607 goto exit_destroy_reg;
608
609 ab3550_address_file = debugfs_create_file("register-address",
610 - (S_IRUGO | S_IWUGO), ab3550_dir, ab, &ab3550_address_fops);
611 + (S_IRUGO | S_IWUSR), ab3550_dir, ab, &ab3550_address_fops);
612 if (!ab3550_address_file)
613 goto exit_destroy_bank;
614
615 ab3550_val_file = debugfs_create_file("register-value",
616 - (S_IRUGO | S_IWUGO), ab3550_dir, ab, &ab3550_val_fops);
617 + (S_IRUGO | S_IWUSR), ab3550_dir, ab, &ab3550_val_fops);
618 if (!ab3550_val_file)
619 goto exit_destroy_address;
620
621 diff --git a/drivers/mfd/ab8500-debugfs.c b/drivers/mfd/ab8500-debugfs.c
622 index 3c1541a..64748e4 100644
623 --- a/drivers/mfd/ab8500-debugfs.c
624 +++ b/drivers/mfd/ab8500-debugfs.c
625 @@ -585,18 +585,18 @@ static int __devinit ab8500_debug_probe(struct platform_device *plf)
626 goto exit_destroy_dir;
627
628 ab8500_bank_file = debugfs_create_file("register-bank",
629 - (S_IRUGO | S_IWUGO), ab8500_dir, &plf->dev, &ab8500_bank_fops);
630 + (S_IRUGO | S_IWUSR), ab8500_dir, &plf->dev, &ab8500_bank_fops);
631 if (!ab8500_bank_file)
632 goto exit_destroy_reg;
633
634 ab8500_address_file = debugfs_create_file("register-address",
635 - (S_IRUGO | S_IWUGO), ab8500_dir, &plf->dev,
636 + (S_IRUGO | S_IWUSR), ab8500_dir, &plf->dev,
637 &ab8500_address_fops);
638 if (!ab8500_address_file)
639 goto exit_destroy_bank;
640
641 ab8500_val_file = debugfs_create_file("register-value",
642 - (S_IRUGO | S_IWUGO), ab8500_dir, &plf->dev, &ab8500_val_fops);
643 + (S_IRUGO | S_IWUSR), ab8500_dir, &plf->dev, &ab8500_val_fops);
644 if (!ab8500_val_file)
645 goto exit_destroy_address;
646
647 diff --git a/drivers/misc/ep93xx_pwm.c b/drivers/misc/ep93xx_pwm.c
648 index 46b3439..16d7179 100644
649 --- a/drivers/misc/ep93xx_pwm.c
650 +++ b/drivers/misc/ep93xx_pwm.c
651 @@ -249,11 +249,11 @@ static ssize_t ep93xx_pwm_set_invert(struct device *dev,
652
653 static DEVICE_ATTR(min_freq, S_IRUGO, ep93xx_pwm_get_min_freq, NULL);
654 static DEVICE_ATTR(max_freq, S_IRUGO, ep93xx_pwm_get_max_freq, NULL);
655 -static DEVICE_ATTR(freq, S_IWUGO | S_IRUGO,
656 +static DEVICE_ATTR(freq, S_IWUSR | S_IRUGO,
657 ep93xx_pwm_get_freq, ep93xx_pwm_set_freq);
658 -static DEVICE_ATTR(duty_percent, S_IWUGO | S_IRUGO,
659 +static DEVICE_ATTR(duty_percent, S_IWUSR | S_IRUGO,
660 ep93xx_pwm_get_duty_percent, ep93xx_pwm_set_duty_percent);
661 -static DEVICE_ATTR(invert, S_IWUGO | S_IRUGO,
662 +static DEVICE_ATTR(invert, S_IWUSR | S_IRUGO,
663 ep93xx_pwm_get_invert, ep93xx_pwm_set_invert);
664
665 static struct attribute *ep93xx_pwm_attrs[] = {
666 diff --git a/drivers/net/myri10ge/myri10ge.c b/drivers/net/myri10ge/myri10ge.c
667 index ea5cfe2..24386a8 100644
668 --- a/drivers/net/myri10ge/myri10ge.c
669 +++ b/drivers/net/myri10ge/myri10ge.c
670 @@ -3645,6 +3645,7 @@ static void myri10ge_free_slices(struct myri10ge_priv *mgp)
671 dma_free_coherent(&pdev->dev, bytes,
672 ss->fw_stats, ss->fw_stats_bus);
673 ss->fw_stats = NULL;
674 + netif_napi_del(&ss->napi);
675 }
676 }
677 kfree(mgp->ss);
678 diff --git a/drivers/net/netxen/netxen_nic_ethtool.c b/drivers/net/netxen/netxen_nic_ethtool.c
679 index 587498e..3de98cb 100644
680 --- a/drivers/net/netxen/netxen_nic_ethtool.c
681 +++ b/drivers/net/netxen/netxen_nic_ethtool.c
682 @@ -901,7 +901,7 @@ static int netxen_nic_set_flags(struct net_device *netdev, u32 data)
683 struct netxen_adapter *adapter = netdev_priv(netdev);
684 int hw_lro;
685
686 - if (data & ~ETH_FLAG_LRO)
687 + if (ethtool_invalid_flags(netdev, data, ETH_FLAG_LRO))
688 return -EINVAL;
689
690 if (!(adapter->capabilities & NX_FW_CAPABILITY_HW_LRO))
691 diff --git a/drivers/net/qlcnic/qlcnic_ethtool.c b/drivers/net/qlcnic/qlcnic_ethtool.c
692 index 4c14510..45b2755 100644
693 --- a/drivers/net/qlcnic/qlcnic_ethtool.c
694 +++ b/drivers/net/qlcnic/qlcnic_ethtool.c
695 @@ -1003,7 +1003,7 @@ static int qlcnic_set_flags(struct net_device *netdev, u32 data)
696 struct qlcnic_adapter *adapter = netdev_priv(netdev);
697 int hw_lro;
698
699 - if (data & ~ETH_FLAG_LRO)
700 + if (ethtool_invalid_flags(netdev, data, ETH_FLAG_LRO))
701 return -EINVAL;
702
703 if (!(adapter->capabilities & QLCNIC_FW_CAPABILITY_HW_LRO))
704 diff --git a/drivers/net/s2io.c b/drivers/net/s2io.c
705 index 39c17ce..0cdff2b 100644
706 --- a/drivers/net/s2io.c
707 +++ b/drivers/net/s2io.c
708 @@ -6726,7 +6726,7 @@ static int s2io_ethtool_set_flags(struct net_device *dev, u32 data)
709 int rc = 0;
710 int changed = 0;
711
712 - if (data & ~ETH_FLAG_LRO)
713 + if (ethtool_invalid_flags(dev, data, ETH_FLAG_LRO))
714 return -EINVAL;
715
716 if (data & ETH_FLAG_LRO) {
717 diff --git a/drivers/net/vmxnet3/vmxnet3_ethtool.c b/drivers/net/vmxnet3/vmxnet3_ethtool.c
718 index 81254be..51f2ef1 100644
719 --- a/drivers/net/vmxnet3/vmxnet3_ethtool.c
720 +++ b/drivers/net/vmxnet3/vmxnet3_ethtool.c
721 @@ -304,8 +304,8 @@ vmxnet3_set_flags(struct net_device *netdev, u32 data)
722 u8 lro_present = (netdev->features & NETIF_F_LRO) == 0 ? 0 : 1;
723 unsigned long flags;
724
725 - if (data & ~ETH_FLAG_LRO)
726 - return -EOPNOTSUPP;
727 + if (ethtool_invalid_flags(netdev, data, ETH_FLAG_LRO))
728 + return -EINVAL;
729
730 if (lro_requested ^ lro_present) {
731 /* toggle the LRO feature*/
732 diff --git a/drivers/net/vxge/vxge-ethtool.c b/drivers/net/vxge/vxge-ethtool.c
733 index 1dd3a21..c5eb034 100644
734 --- a/drivers/net/vxge/vxge-ethtool.c
735 +++ b/drivers/net/vxge/vxge-ethtool.c
736 @@ -1117,8 +1117,8 @@ static int vxge_set_flags(struct net_device *dev, u32 data)
737 struct vxgedev *vdev = netdev_priv(dev);
738 enum vxge_hw_status status;
739
740 - if (data & ~ETH_FLAG_RXHASH)
741 - return -EOPNOTSUPP;
742 + if (ethtool_invalid_flags(dev, data, ETH_FLAG_RXHASH))
743 + return -EINVAL;
744
745 if (!!(data & ETH_FLAG_RXHASH) == vdev->devh->config.rth_en)
746 return 0;
747 diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
748 index a09d15f..0848e09 100644
749 --- a/drivers/net/wireless/ath/ath9k/main.c
750 +++ b/drivers/net/wireless/ath/ath9k/main.c
751 @@ -1063,6 +1063,8 @@ static int ath9k_start(struct ieee80211_hw *hw)
752 "Starting driver with initial channel: %d MHz\n",
753 curchan->center_freq);
754
755 + ath9k_ps_wakeup(sc);
756 +
757 mutex_lock(&sc->mutex);
758
759 if (ath9k_wiphy_started(sc)) {
760 @@ -1179,6 +1181,8 @@ static int ath9k_start(struct ieee80211_hw *hw)
761 mutex_unlock:
762 mutex_unlock(&sc->mutex);
763
764 + ath9k_ps_restore(sc);
765 +
766 return r;
767 }
768
769 diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
770 index 07b7804..5c9d83b 100644
771 --- a/drivers/net/wireless/ath/ath9k/xmit.c
772 +++ b/drivers/net/wireless/ath/ath9k/xmit.c
773 @@ -1699,8 +1699,8 @@ static void ath_tx_start_dma(struct ath_softc *sc, struct ath_buf *bf,
774 u8 tidno;
775
776 spin_lock_bh(&txctl->txq->axq_lock);
777 -
778 - if (ieee80211_is_data_qos(hdr->frame_control) && txctl->an) {
779 + if ((sc->sc_flags & SC_OP_TXAGGR) && txctl->an &&
780 + ieee80211_is_data_qos(hdr->frame_control)) {
781 tidno = ieee80211_get_qos_ctl(hdr)[0] &
782 IEEE80211_QOS_CTL_TID_MASK;
783 tid = ATH_AN_2_TID(txctl->an, tidno);
784 diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
785 index 3d5566e..ff0f5ba 100644
786 --- a/drivers/net/wireless/b43/dma.c
787 +++ b/drivers/net/wireless/b43/dma.c
788 @@ -1536,7 +1536,7 @@ static void dma_rx(struct b43_dmaring *ring, int *slot)
789 dmaaddr = meta->dmaaddr;
790 goto drop_recycle_buffer;
791 }
792 - if (unlikely(len > ring->rx_buffersize)) {
793 + if (unlikely(len + ring->frameoffset > ring->rx_buffersize)) {
794 /* The data did not fit into one descriptor buffer
795 * and is split over multiple buffers.
796 * This should never happen, as we try to allocate buffers
797 diff --git a/drivers/net/wireless/b43/dma.h b/drivers/net/wireless/b43/dma.h
798 index a01c210..e8a80a1 100644
799 --- a/drivers/net/wireless/b43/dma.h
800 +++ b/drivers/net/wireless/b43/dma.h
801 @@ -163,7 +163,7 @@ struct b43_dmadesc_generic {
802 /* DMA engine tuning knobs */
803 #define B43_TXRING_SLOTS 256
804 #define B43_RXRING_SLOTS 64
805 -#define B43_DMA0_RX_BUFFERSIZE IEEE80211_MAX_FRAME_LEN
806 +#define B43_DMA0_RX_BUFFERSIZE (B43_DMA0_RX_FRAMEOFFSET + IEEE80211_MAX_FRAME_LEN)
807
808 /* Pointer poison */
809 #define B43_DMA_PTR_POISON ((void *)ERR_PTR(-ENOMEM))
810 diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.h b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
811 index 9e6f313..c0cd307 100644
812 --- a/drivers/net/wireless/iwlwifi/iwl-eeprom.h
813 +++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
814 @@ -241,7 +241,7 @@ struct iwl_eeprom_enhanced_txpwr {
815
816 /* 6x00 Specific */
817 #define EEPROM_6000_TX_POWER_VERSION (4)
818 -#define EEPROM_6000_EEPROM_VERSION (0x434)
819 +#define EEPROM_6000_EEPROM_VERSION (0x423)
820
821 /* 6x50 Specific */
822 #define EEPROM_6050_TX_POWER_VERSION (4)
823 diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
824 index 9b344a9..e183587 100644
825 --- a/drivers/net/wireless/p54/p54usb.c
826 +++ b/drivers/net/wireless/p54/p54usb.c
827 @@ -56,6 +56,7 @@ static struct usb_device_id p54u_table[] __devinitdata = {
828 {USB_DEVICE(0x0846, 0x4210)}, /* Netgear WG121 the second ? */
829 {USB_DEVICE(0x0846, 0x4220)}, /* Netgear WG111 */
830 {USB_DEVICE(0x09aa, 0x1000)}, /* Spinnaker Proto board */
831 + {USB_DEVICE(0x0bf8, 0x1007)}, /* Fujitsu E-5400 USB */
832 {USB_DEVICE(0x0cde, 0x0006)}, /* Medion 40900, Roper Europe */
833 {USB_DEVICE(0x0db0, 0x6826)}, /* MSI UB54G (MS-6826) */
834 {USB_DEVICE(0x107b, 0x55f2)}, /* Gateway WGU-210 (Gemtek) */
835 @@ -68,6 +69,7 @@ static struct usb_device_id p54u_table[] __devinitdata = {
836 {USB_DEVICE(0x1915, 0x2235)}, /* Linksys WUSB54G Portable OEM */
837 {USB_DEVICE(0x2001, 0x3701)}, /* DLink DWL-G120 Spinnaker */
838 {USB_DEVICE(0x2001, 0x3703)}, /* DLink DWL-G122 */
839 + {USB_DEVICE(0x2001, 0x3762)}, /* Conceptronic C54U */
840 {USB_DEVICE(0x5041, 0x2234)}, /* Linksys WUSB54G */
841 {USB_DEVICE(0x5041, 0x2235)}, /* Linksys WUSB54G Portable */
842
843 diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
844 index 54917a2..e2a528d 100644
845 --- a/drivers/net/wireless/rt2x00/rt2800lib.c
846 +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
847 @@ -2810,10 +2810,7 @@ void rt2800_disable_radio(struct rt2x00_dev *rt2x00dev)
848
849 rt2800_register_read(rt2x00dev, WPDMA_GLO_CFG, &reg);
850 rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_TX_DMA, 0);
851 - rt2x00_set_field32(&reg, WPDMA_GLO_CFG_TX_DMA_BUSY, 0);
852 rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_RX_DMA, 0);
853 - rt2x00_set_field32(&reg, WPDMA_GLO_CFG_RX_DMA_BUSY, 0);
854 - rt2x00_set_field32(&reg, WPDMA_GLO_CFG_TX_WRITEBACK_DONE, 1);
855 rt2800_register_write(rt2x00dev, WPDMA_GLO_CFG, reg);
856
857 /* Wait for DMA, ignore error */
858 @@ -2823,9 +2820,6 @@ void rt2800_disable_radio(struct rt2x00_dev *rt2x00dev)
859 rt2x00_set_field32(&reg, MAC_SYS_CTRL_ENABLE_TX, 0);
860 rt2x00_set_field32(&reg, MAC_SYS_CTRL_ENABLE_RX, 0);
861 rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, reg);
862 -
863 - rt2800_register_write(rt2x00dev, PWR_PIN_CFG, 0);
864 - rt2800_register_write(rt2x00dev, TX_PIN_CFG, 0);
865 }
866 EXPORT_SYMBOL_GPL(rt2800_disable_radio);
867
868 diff --git a/drivers/net/wireless/rt2x00/rt2800pci.c b/drivers/net/wireless/rt2x00/rt2800pci.c
869 index 3b3f1e4..37a38b5 100644
870 --- a/drivers/net/wireless/rt2x00/rt2800pci.c
871 +++ b/drivers/net/wireless/rt2x00/rt2800pci.c
872 @@ -475,39 +475,23 @@ static int rt2800pci_enable_radio(struct rt2x00_dev *rt2x00dev)
873
874 static void rt2800pci_disable_radio(struct rt2x00_dev *rt2x00dev)
875 {
876 - u32 reg;
877 -
878 - rt2800_disable_radio(rt2x00dev);
879 -
880 - rt2800_register_write(rt2x00dev, PBF_SYS_CTRL, 0x00001280);
881 -
882 - rt2800_register_read(rt2x00dev, WPDMA_RST_IDX, &reg);
883 - rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX0, 1);
884 - rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX1, 1);
885 - rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX2, 1);
886 - rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX3, 1);
887 - rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX4, 1);
888 - rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX5, 1);
889 - rt2x00_set_field32(&reg, WPDMA_RST_IDX_DRX_IDX0, 1);
890 - rt2800_register_write(rt2x00dev, WPDMA_RST_IDX, reg);
891 -
892 - rt2800_register_write(rt2x00dev, PBF_SYS_CTRL, 0x00000e1f);
893 - rt2800_register_write(rt2x00dev, PBF_SYS_CTRL, 0x00000e00);
894 + if (rt2x00_is_soc(rt2x00dev)) {
895 + rt2800_disable_radio(rt2x00dev);
896 + rt2800_register_write(rt2x00dev, PWR_PIN_CFG, 0);
897 + rt2800_register_write(rt2x00dev, TX_PIN_CFG, 0);
898 + }
899 }
900
901 static int rt2800pci_set_state(struct rt2x00_dev *rt2x00dev,
902 enum dev_state state)
903 {
904 - /*
905 - * Always put the device to sleep (even when we intend to wakeup!)
906 - * if the device is booting and wasn't asleep it will return
907 - * failure when attempting to wakeup.
908 - */
909 - rt2800_mcu_request(rt2x00dev, MCU_SLEEP, 0xff, 0xff, 2);
910 -
911 if (state == STATE_AWAKE) {
912 - rt2800_mcu_request(rt2x00dev, MCU_WAKEUP, TOKEN_WAKUP, 0, 0);
913 + rt2800_mcu_request(rt2x00dev, MCU_WAKEUP, TOKEN_WAKUP, 0, 0x02);
914 rt2800pci_mcu_status(rt2x00dev, TOKEN_WAKUP);
915 + } else if (state == STATE_SLEEP) {
916 + rt2800_register_write(rt2x00dev, H2M_MAILBOX_STATUS, 0xffffffff);
917 + rt2800_register_write(rt2x00dev, H2M_MAILBOX_CID, 0xffffffff);
918 + rt2800_mcu_request(rt2x00dev, MCU_SLEEP, 0x01, 0xff, 0x01);
919 }
920
921 return 0;
922 diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
923 index 9597a03..2b77a29 100644
924 --- a/drivers/net/wireless/rt2x00/rt2x00dev.c
925 +++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
926 @@ -1031,8 +1031,10 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
927 * Stop all work.
928 */
929 cancel_work_sync(&rt2x00dev->intf_work);
930 - cancel_work_sync(&rt2x00dev->rxdone_work);
931 - cancel_work_sync(&rt2x00dev->txdone_work);
932 + if (rt2x00_is_usb(rt2x00dev)) {
933 + cancel_work_sync(&rt2x00dev->rxdone_work);
934 + cancel_work_sync(&rt2x00dev->txdone_work);
935 + }
936
937 /*
938 * Free the tx status fifo.
939 diff --git a/drivers/net/wireless/wl12xx/testmode.c b/drivers/net/wireless/wl12xx/testmode.c
940 index e64403b..6ec06a4 100644
941 --- a/drivers/net/wireless/wl12xx/testmode.c
942 +++ b/drivers/net/wireless/wl12xx/testmode.c
943 @@ -204,7 +204,10 @@ static int wl1271_tm_cmd_nvs_push(struct wl1271 *wl, struct nlattr *tb[])
944
945 kfree(wl->nvs);
946
947 - wl->nvs = kzalloc(sizeof(struct wl1271_nvs_file), GFP_KERNEL);
948 + if (len != sizeof(struct wl1271_nvs_file))
949 + return -EINVAL;
950 +
951 + wl->nvs = kzalloc(len, GFP_KERNEL);
952 if (!wl->nvs) {
953 wl1271_error("could not allocate memory for the nvs file");
954 ret = -ENOMEM;
955 diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
956 index 3188cd9..bbdb4fd 100644
957 --- a/drivers/pci/pcie/aspm.c
958 +++ b/drivers/pci/pcie/aspm.c
959 @@ -69,6 +69,7 @@ struct pcie_link_state {
960 };
961
962 static int aspm_disabled, aspm_force, aspm_clear_state;
963 +static bool aspm_support_enabled = true;
964 static DEFINE_MUTEX(aspm_lock);
965 static LIST_HEAD(link_list);
966
967 @@ -896,6 +897,7 @@ static int __init pcie_aspm_disable(char *str)
968 {
969 if (!strcmp(str, "off")) {
970 aspm_disabled = 1;
971 + aspm_support_enabled = false;
972 printk(KERN_INFO "PCIe ASPM is disabled\n");
973 } else if (!strcmp(str, "force")) {
974 aspm_force = 1;
975 @@ -930,3 +932,8 @@ int pcie_aspm_enabled(void)
976 }
977 EXPORT_SYMBOL(pcie_aspm_enabled);
978
979 +bool pcie_aspm_support_enabled(void)
980 +{
981 + return aspm_support_enabled;
982 +}
983 +EXPORT_SYMBOL(pcie_aspm_support_enabled);
984 diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
985 index 38b34a7..fa54ba7 100644
986 --- a/drivers/platform/x86/acer-wmi.c
987 +++ b/drivers/platform/x86/acer-wmi.c
988 @@ -222,6 +222,7 @@ struct acer_debug {
989 static struct rfkill *wireless_rfkill;
990 static struct rfkill *bluetooth_rfkill;
991 static struct rfkill *threeg_rfkill;
992 +static bool rfkill_inited;
993
994 /* Each low-level interface must define at least some of the following */
995 struct wmi_interface {
996 @@ -1161,9 +1162,13 @@ static int acer_rfkill_set(void *data, bool blocked)
997 {
998 acpi_status status;
999 u32 cap = (unsigned long)data;
1000 - status = set_u32(!blocked, cap);
1001 - if (ACPI_FAILURE(status))
1002 - return -ENODEV;
1003 +
1004 + if (rfkill_inited) {
1005 + status = set_u32(!blocked, cap);
1006 + if (ACPI_FAILURE(status))
1007 + return -ENODEV;
1008 + }
1009 +
1010 return 0;
1011 }
1012
1013 @@ -1187,14 +1192,16 @@ static struct rfkill *acer_rfkill_register(struct device *dev,
1014 return ERR_PTR(-ENOMEM);
1015
1016 status = get_device_status(&state, cap);
1017 - if (ACPI_SUCCESS(status))
1018 - rfkill_init_sw_state(rfkill_dev, !state);
1019
1020 err = rfkill_register(rfkill_dev);
1021 if (err) {
1022 rfkill_destroy(rfkill_dev);
1023 return ERR_PTR(err);
1024 }
1025 +
1026 + if (ACPI_SUCCESS(status))
1027 + rfkill_set_sw_state(rfkill_dev, !state);
1028 +
1029 return rfkill_dev;
1030 }
1031
1032 @@ -1229,6 +1236,8 @@ static int acer_rfkill_init(struct device *dev)
1033 }
1034 }
1035
1036 + rfkill_inited = true;
1037 +
1038 schedule_delayed_work(&acer_rfkill_work, round_jiffies_relative(HZ));
1039
1040 return 0;
1041 diff --git a/drivers/rtc/rtc-ds1511.c b/drivers/rtc/rtc-ds1511.c
1042 index 37268e9..afeb546 100644
1043 --- a/drivers/rtc/rtc-ds1511.c
1044 +++ b/drivers/rtc/rtc-ds1511.c
1045 @@ -485,7 +485,7 @@ ds1511_nvram_write(struct file *filp, struct kobject *kobj,
1046 static struct bin_attribute ds1511_nvram_attr = {
1047 .attr = {
1048 .name = "nvram",
1049 - .mode = S_IRUGO | S_IWUGO,
1050 + .mode = S_IRUGO | S_IWUSR,
1051 },
1052 .size = DS1511_RAM_MAX,
1053 .read = ds1511_nvram_read,
1054 diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
1055 index f905ecb..01543d2 100644
1056 --- a/drivers/scsi/scsi_transport_iscsi.c
1057 +++ b/drivers/scsi/scsi_transport_iscsi.c
1058 @@ -1847,7 +1847,7 @@ store_priv_session_##field(struct device *dev, \
1059 #define iscsi_priv_session_rw_attr(field, format) \
1060 iscsi_priv_session_attr_show(field, format) \
1061 iscsi_priv_session_attr_store(field) \
1062 -static ISCSI_CLASS_ATTR(priv_sess, field, S_IRUGO | S_IWUGO, \
1063 +static ISCSI_CLASS_ATTR(priv_sess, field, S_IRUGO | S_IWUSR, \
1064 show_priv_session_##field, \
1065 store_priv_session_##field)
1066 iscsi_priv_session_rw_attr(recovery_tmo, "%d");
1067 diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
1068 index 7f5a6a8..3b00e90 100644
1069 --- a/drivers/scsi/ses.c
1070 +++ b/drivers/scsi/ses.c
1071 @@ -390,9 +390,9 @@ static void ses_enclosure_data_process(struct enclosure_device *edev,
1072 len = (desc_ptr[2] << 8) + desc_ptr[3];
1073 /* skip past overall descriptor */
1074 desc_ptr += len + 4;
1075 - if (ses_dev->page10)
1076 - addl_desc_ptr = ses_dev->page10 + 8;
1077 }
1078 + if (ses_dev->page10)
1079 + addl_desc_ptr = ses_dev->page10 + 8;
1080 type_ptr = ses_dev->page1 + 12 + ses_dev->page1[11];
1081 components = 0;
1082 for (i = 0; i < types; i++, type_ptr += 4) {
1083 diff --git a/drivers/staging/hv/channel.c b/drivers/staging/hv/channel.c
1084 index 45a627d..09e596a 100644
1085 --- a/drivers/staging/hv/channel.c
1086 +++ b/drivers/staging/hv/channel.c
1087 @@ -76,14 +76,14 @@ static void vmbus_setevent(struct vmbus_channel *channel)
1088
1089 if (channel->offermsg.monitor_allocated) {
1090 /* Each u32 represents 32 channels */
1091 - set_bit(channel->offermsg.child_relid & 31,
1092 + sync_set_bit(channel->offermsg.child_relid & 31,
1093 (unsigned long *) gVmbusConnection.SendInterruptPage +
1094 (channel->offermsg.child_relid >> 5));
1095
1096 monitorpage = gVmbusConnection.MonitorPages;
1097 monitorpage++; /* Get the child to parent monitor page */
1098
1099 - set_bit(channel->monitor_bit,
1100 + sync_set_bit(channel->monitor_bit,
1101 (unsigned long *)&monitorpage->trigger_group
1102 [channel->monitor_grp].pending);
1103
1104 @@ -99,7 +99,7 @@ static void VmbusChannelClearEvent(struct vmbus_channel *channel)
1105
1106 if (Channel->offermsg.monitor_allocated) {
1107 /* Each u32 represents 32 channels */
1108 - clear_bit(Channel->offermsg.child_relid & 31,
1109 + sync_clear_bit(Channel->offermsg.child_relid & 31,
1110 (unsigned long *)gVmbusConnection.SendInterruptPage +
1111 (Channel->offermsg.child_relid >> 5));
1112
1113 @@ -107,7 +107,7 @@ static void VmbusChannelClearEvent(struct vmbus_channel *channel)
1114 (struct hv_monitor_page *)gVmbusConnection.MonitorPages;
1115 monitorPage++; /* Get the child to parent monitor page */
1116
1117 - clear_bit(Channel->monitor_bit,
1118 + sync_clear_bit(Channel->monitor_bit,
1119 (unsigned long *)&monitorPage->trigger_group
1120 [Channel->monitor_grp].Pending);
1121 }
1122 diff --git a/drivers/staging/hv/connection.c b/drivers/staging/hv/connection.c
1123 index c2e298f..0739eb7 100644
1124 --- a/drivers/staging/hv/connection.c
1125 +++ b/drivers/staging/hv/connection.c
1126 @@ -281,7 +281,7 @@ void VmbusOnEvents(void)
1127 for (dword = 0; dword < maxdword; dword++) {
1128 if (recvInterruptPage[dword]) {
1129 for (bit = 0; bit < 32; bit++) {
1130 - if (test_and_clear_bit(bit, (unsigned long *)&recvInterruptPage[dword])) {
1131 + if (sync_test_and_clear_bit(bit, (unsigned long *)&recvInterruptPage[dword])) {
1132 relid = (dword << 5) + bit;
1133 DPRINT_DBG(VMBUS, "event detected for relid - %d", relid);
1134
1135 @@ -320,7 +320,7 @@ int VmbusPostMessage(void *buffer, size_t bufferLen)
1136 int VmbusSetEvent(u32 childRelId)
1137 {
1138 /* Each u32 represents 32 channels */
1139 - set_bit(childRelId & 31,
1140 + sync_set_bit(childRelId & 31,
1141 (unsigned long *)gVmbusConnection.SendInterruptPage +
1142 (childRelId >> 5));
1143
1144 diff --git a/drivers/staging/hv/netvsc_drv.c b/drivers/staging/hv/netvsc_drv.c
1145 index b41c964..f433add 100644
1146 --- a/drivers/staging/hv/netvsc_drv.c
1147 +++ b/drivers/staging/hv/netvsc_drv.c
1148 @@ -46,6 +46,7 @@ struct net_device_context {
1149 /* point back to our device context */
1150 struct vm_device *device_ctx;
1151 unsigned long avail;
1152 + struct work_struct work;
1153 };
1154
1155 struct netvsc_driver_context {
1156 @@ -225,6 +226,7 @@ static void netvsc_linkstatus_callback(struct hv_device *device_obj,
1157 unsigned int status)
1158 {
1159 struct vm_device *device_ctx = to_vm_device(device_obj);
1160 + struct net_device_context *ndev_ctx;
1161 struct net_device *net = dev_get_drvdata(&device_ctx->device);
1162
1163 if (!net) {
1164 @@ -237,6 +239,8 @@ static void netvsc_linkstatus_callback(struct hv_device *device_obj,
1165 netif_carrier_on(net);
1166 netif_wake_queue(net);
1167 netif_notify_peers(net);
1168 + ndev_ctx = netdev_priv(net);
1169 + schedule_work(&ndev_ctx->work);
1170 } else {
1171 netif_carrier_off(net);
1172 netif_stop_queue(net);
1173 @@ -336,6 +340,25 @@ static const struct net_device_ops device_ops = {
1174 .ndo_set_mac_address = eth_mac_addr,
1175 };
1176
1177 +/*
1178 + * Send GARP packet to network peers after migrations.
1179 + * After Quick Migration, the network is not immediately operational in the
1180 + * current context when receiving RNDIS_STATUS_MEDIA_CONNECT event. So, add
1181 + * another netif_notify_peers() into a scheduled work, otherwise GARP packet
1182 + * will not be sent after quick migration, and cause network disconnection.
1183 + */
1184 +static void netvsc_send_garp(struct work_struct *w)
1185 +{
1186 + struct net_device_context *ndev_ctx;
1187 + struct net_device *net;
1188 +
1189 + msleep(20);
1190 + ndev_ctx = container_of(w, struct net_device_context, work);
1191 + net = dev_get_drvdata(&ndev_ctx->device_ctx->device);
1192 + netif_notify_peers(net);
1193 +}
1194 +
1195 +
1196 static int netvsc_probe(struct device *device)
1197 {
1198 struct driver_context *driver_ctx =
1199 @@ -364,6 +387,7 @@ static int netvsc_probe(struct device *device)
1200 net_device_ctx->device_ctx = device_ctx;
1201 net_device_ctx->avail = ring_size;
1202 dev_set_drvdata(device, net);
1203 + INIT_WORK(&net_device_ctx->work, netvsc_send_garp);
1204
1205 /* Notify the netvsc driver of the new device */
1206 ret = net_drv_obj->base.OnDeviceAdd(device_obj, &device_info);
1207 diff --git a/drivers/staging/hv/vmbus_drv.c b/drivers/staging/hv/vmbus_drv.c
1208 index 84fdb64..87e6cf2 100644
1209 --- a/drivers/staging/hv/vmbus_drv.c
1210 +++ b/drivers/staging/hv/vmbus_drv.c
1211 @@ -291,7 +291,7 @@ static int vmbus_on_isr(struct hv_driver *drv)
1212 event = (union hv_synic_event_flags *)page_addr + VMBUS_MESSAGE_SINT;
1213
1214 /* Since we are a child, we only need to check bit 0 */
1215 - if (test_and_clear_bit(0, (unsigned long *) &event->flags32[0])) {
1216 + if (sync_test_and_clear_bit(0, (unsigned long *) &event->flags32[0])) {
1217 DPRINT_DBG(VMBUS, "received event %d", event->flags32[0]);
1218 ret |= 0x2;
1219 }
1220 diff --git a/drivers/staging/hv/vmbus_private.h b/drivers/staging/hv/vmbus_private.h
1221 index 07f6d22..c75b2d7 100644
1222 --- a/drivers/staging/hv/vmbus_private.h
1223 +++ b/drivers/staging/hv/vmbus_private.h
1224 @@ -31,6 +31,7 @@
1225 #include "channel_mgmt.h"
1226 #include "ring_buffer.h"
1227 #include <linux/list.h>
1228 +#include <asm/sync_bitops.h>
1229
1230
1231 /*
1232 diff --git a/drivers/staging/iio/imu/adis16400.h b/drivers/staging/iio/imu/adis16400.h
1233 index 6ff33e1..90e90f0 100644
1234 --- a/drivers/staging/iio/imu/adis16400.h
1235 +++ b/drivers/staging/iio/imu/adis16400.h
1236 @@ -17,7 +17,8 @@
1237 #ifndef SPI_ADIS16400_H_
1238 #define SPI_ADIS16400_H_
1239
1240 -#define ADIS16400_STARTUP_DELAY 220 /* ms */
1241 +#define ADIS16400_STARTUP_DELAY 290 /* ms */
1242 +#define ADIS16400_MTEST_DELAY 90 /* ms */
1243
1244 #define ADIS16400_READ_REG(a) a
1245 #define ADIS16400_WRITE_REG(a) ((a) | 0x80)
1246 diff --git a/drivers/staging/iio/imu/adis16400_core.c b/drivers/staging/iio/imu/adis16400_core.c
1247 index cfb108a..2107edb 100644
1248 --- a/drivers/staging/iio/imu/adis16400_core.c
1249 +++ b/drivers/staging/iio/imu/adis16400_core.c
1250 @@ -93,7 +93,6 @@ static int adis16400_spi_write_reg_16(struct device *dev,
1251 .tx_buf = st->tx + 2,
1252 .bits_per_word = 8,
1253 .len = 2,
1254 - .cs_change = 1,
1255 },
1256 };
1257
1258 @@ -137,7 +136,6 @@ static int adis16400_spi_read_reg_16(struct device *dev,
1259 .rx_buf = st->rx,
1260 .bits_per_word = 8,
1261 .len = 2,
1262 - .cs_change = 1,
1263 },
1264 };
1265
1266 @@ -375,7 +373,7 @@ static int adis16400_self_test(struct device *dev)
1267 dev_err(dev, "problem starting self test");
1268 goto err_ret;
1269 }
1270 -
1271 + msleep(ADIS16400_MTEST_DELAY);
1272 adis16400_check_status(dev);
1273
1274 err_ret:
1275 @@ -497,12 +495,12 @@ err_ret:
1276 _reg)
1277
1278 static ADIS16400_DEV_ATTR_CALIBBIAS(GYRO_X, ADIS16400_XGYRO_OFF);
1279 -static ADIS16400_DEV_ATTR_CALIBBIAS(GYRO_Y, ADIS16400_XGYRO_OFF);
1280 -static ADIS16400_DEV_ATTR_CALIBBIAS(GYRO_Z, ADIS16400_XGYRO_OFF);
1281 +static ADIS16400_DEV_ATTR_CALIBBIAS(GYRO_Y, ADIS16400_YGYRO_OFF);
1282 +static ADIS16400_DEV_ATTR_CALIBBIAS(GYRO_Z, ADIS16400_ZGYRO_OFF);
1283
1284 static ADIS16400_DEV_ATTR_CALIBBIAS(ACCEL_X, ADIS16400_XACCL_OFF);
1285 -static ADIS16400_DEV_ATTR_CALIBBIAS(ACCEL_Y, ADIS16400_XACCL_OFF);
1286 -static ADIS16400_DEV_ATTR_CALIBBIAS(ACCEL_Z, ADIS16400_XACCL_OFF);
1287 +static ADIS16400_DEV_ATTR_CALIBBIAS(ACCEL_Y, ADIS16400_YACCL_OFF);
1288 +static ADIS16400_DEV_ATTR_CALIBBIAS(ACCEL_Z, ADIS16400_ZACCL_OFF);
1289
1290
1291 static IIO_DEV_ATTR_IN_NAMED_RAW(0, supply, adis16400_read_14bit_signed,
1292 diff --git a/drivers/staging/iio/imu/adis16400_ring.c b/drivers/staging/iio/imu/adis16400_ring.c
1293 index 33293fb..da28cb4 100644
1294 --- a/drivers/staging/iio/imu/adis16400_ring.c
1295 +++ b/drivers/staging/iio/imu/adis16400_ring.c
1296 @@ -122,12 +122,10 @@ static int adis16400_spi_read_burst(struct device *dev, u8 *rx)
1297 .tx_buf = st->tx,
1298 .bits_per_word = 8,
1299 .len = 2,
1300 - .cs_change = 0,
1301 }, {
1302 .rx_buf = rx,
1303 .bits_per_word = 8,
1304 .len = 24,
1305 - .cs_change = 1,
1306 },
1307 };
1308
1309 @@ -162,9 +160,10 @@ static void adis16400_trigger_bh_to_ring(struct work_struct *work_s)
1310 work_trigger_to_ring);
1311 struct iio_ring_buffer *ring = st->indio_dev->ring;
1312
1313 - int i = 0;
1314 + int i = 0, j;
1315 s16 *data;
1316 size_t datasize = ring->access.get_bytes_per_datum(ring);
1317 + unsigned long mask = ring->scan_mask;
1318
1319 data = kmalloc(datasize , GFP_KERNEL);
1320 if (data == NULL) {
1321 @@ -174,9 +173,12 @@ static void adis16400_trigger_bh_to_ring(struct work_struct *work_s)
1322
1323 if (ring->scan_count)
1324 if (adis16400_spi_read_burst(&st->indio_dev->dev, st->rx) >= 0)
1325 - for (; i < ring->scan_count; i++)
1326 + for (; i < ring->scan_count; i++) {
1327 + j = __ffs(mask);
1328 + mask &= ~(1 << j);
1329 data[i] = be16_to_cpup(
1330 - (__be16 *)&(st->rx[i*2]));
1331 + (__be16 *)&(st->rx[j*2]));
1332 + }
1333
1334 /* Guaranteed to be aligned with 8 byte boundary */
1335 if (ring->scan_timestamp)
1336 diff --git a/drivers/staging/usbip/stub_rx.c b/drivers/staging/usbip/stub_rx.c
1337 index ae6ac82..8e60332 100644
1338 --- a/drivers/staging/usbip/stub_rx.c
1339 +++ b/drivers/staging/usbip/stub_rx.c
1340 @@ -170,33 +170,23 @@ static int tweak_set_configuration_cmd(struct urb *urb)
1341
1342 static int tweak_reset_device_cmd(struct urb *urb)
1343 {
1344 - struct usb_ctrlrequest *req;
1345 - __u16 value;
1346 - __u16 index;
1347 - int ret;
1348 -
1349 - req = (struct usb_ctrlrequest *) urb->setup_packet;
1350 - value = le16_to_cpu(req->wValue);
1351 - index = le16_to_cpu(req->wIndex);
1352 -
1353 - usbip_uinfo("reset_device (port %d) to %s\n", index,
1354 - dev_name(&urb->dev->dev));
1355 + struct stub_priv *priv = (struct stub_priv *) urb->context;
1356 + struct stub_device *sdev = priv->sdev;
1357
1358 - /* all interfaces should be owned by usbip driver, so just reset it. */
1359 - ret = usb_lock_device_for_reset(urb->dev, NULL);
1360 - if (ret < 0) {
1361 - dev_err(&urb->dev->dev, "lock for reset\n");
1362 - return ret;
1363 - }
1364 -
1365 - /* try to reset the device */
1366 - ret = usb_reset_device(urb->dev);
1367 - if (ret < 0)
1368 - dev_err(&urb->dev->dev, "device reset\n");
1369 + usbip_uinfo("reset_device %s\n", dev_name(&urb->dev->dev));
1370
1371 - usb_unlock_device(urb->dev);
1372 -
1373 - return ret;
1374 + /*
1375 + * usb_lock_device_for_reset caused a deadlock: it causes the driver
1376 + * to unbind. In the shutdown the rx thread is signalled to shut down
1377 + * but this thread is pending in the usb_lock_device_for_reset.
1378 + *
1379 + * Instead queue the reset.
1380 + *
1381 + * Unfortunatly an existing usbip connection will be dropped due to
1382 + * driver unbinding.
1383 + */
1384 + usb_queue_reset_device(sdev->interface);
1385 + return 0;
1386 }
1387
1388 /*
1389 diff --git a/drivers/staging/usbip/stub_tx.c b/drivers/staging/usbip/stub_tx.c
1390 index d7136e2..b7a493c 100644
1391 --- a/drivers/staging/usbip/stub_tx.c
1392 +++ b/drivers/staging/usbip/stub_tx.c
1393 @@ -169,7 +169,6 @@ static int stub_send_ret_submit(struct stub_device *sdev)
1394 struct stub_priv *priv, *tmp;
1395
1396 struct msghdr msg;
1397 - struct kvec iov[3];
1398 size_t txsize;
1399
1400 size_t total_size = 0;
1401 @@ -179,28 +178,73 @@ static int stub_send_ret_submit(struct stub_device *sdev)
1402 struct urb *urb = priv->urb;
1403 struct usbip_header pdu_header;
1404 void *iso_buffer = NULL;
1405 + struct kvec *iov = NULL;
1406 + int iovnum = 0;
1407
1408 txsize = 0;
1409 memset(&pdu_header, 0, sizeof(pdu_header));
1410 memset(&msg, 0, sizeof(msg));
1411 - memset(&iov, 0, sizeof(iov));
1412
1413 - usbip_dbg_stub_tx("setup txdata urb %p\n", urb);
1414 + if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS)
1415 + iovnum = 2 + urb->number_of_packets;
1416 + else
1417 + iovnum = 2;
1418 +
1419 + iov = kzalloc(iovnum * sizeof(struct kvec), GFP_KERNEL);
1420
1421 + if (!iov) {
1422 + usbip_event_add(&sdev->ud, SDEV_EVENT_ERROR_MALLOC);
1423 + return -1;
1424 + }
1425 +
1426 + iovnum = 0;
1427
1428 /* 1. setup usbip_header */
1429 setup_ret_submit_pdu(&pdu_header, urb);
1430 + usbip_dbg_stub_tx("setup txdata seqnum: %d urb: %p\n",
1431 + pdu_header.base.seqnum, urb);
1432 + /*usbip_dump_header(pdu_header);*/
1433 usbip_header_correct_endian(&pdu_header, 1);
1434
1435 - iov[0].iov_base = &pdu_header;
1436 - iov[0].iov_len = sizeof(pdu_header);
1437 + iov[iovnum].iov_base = &pdu_header;
1438 + iov[iovnum].iov_len = sizeof(pdu_header);
1439 + iovnum++;
1440 txsize += sizeof(pdu_header);
1441
1442 /* 2. setup transfer buffer */
1443 - if (usb_pipein(urb->pipe) && urb->actual_length > 0) {
1444 - iov[1].iov_base = urb->transfer_buffer;
1445 - iov[1].iov_len = urb->actual_length;
1446 + if (usb_pipein(urb->pipe) &&
1447 + usb_pipetype(urb->pipe) != PIPE_ISOCHRONOUS &&
1448 + urb->actual_length > 0) {
1449 + iov[iovnum].iov_base = urb->transfer_buffer;
1450 + iov[iovnum].iov_len = urb->actual_length;
1451 + iovnum++;
1452 txsize += urb->actual_length;
1453 + } else if (usb_pipein(urb->pipe) &&
1454 + usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) {
1455 + /*
1456 + * For isochronous packets: actual length is the sum of
1457 + * the actual length of the individual, packets, but as
1458 + * the packet offsets are not changed there will be
1459 + * padding between the packets. To optimally use the
1460 + * bandwidth the padding is not transmitted.
1461 + */
1462 +
1463 + int i;
1464 + for (i = 0; i < urb->number_of_packets; i++) {
1465 + iov[iovnum].iov_base = urb->transfer_buffer + urb->iso_frame_desc[i].offset;
1466 + iov[iovnum].iov_len = urb->iso_frame_desc[i].actual_length;
1467 + iovnum++;
1468 + txsize += urb->iso_frame_desc[i].actual_length;
1469 + }
1470 +
1471 + if (txsize != sizeof(pdu_header) + urb->actual_length) {
1472 + dev_err(&sdev->interface->dev,
1473 + "actual length of urb (%d) does not match iso packet sizes (%d)\n",
1474 + urb->actual_length, txsize-sizeof(pdu_header));
1475 + kfree(iov);
1476 + usbip_event_add(&sdev->ud, SDEV_EVENT_ERROR_TCP);
1477 + return -1;
1478 + }
1479 }
1480
1481 /* 3. setup iso_packet_descriptor */
1482 @@ -211,32 +255,34 @@ static int stub_send_ret_submit(struct stub_device *sdev)
1483 if (!iso_buffer) {
1484 usbip_event_add(&sdev->ud,
1485 SDEV_EVENT_ERROR_MALLOC);
1486 + kfree(iov);
1487 return -1;
1488 }
1489
1490 - iov[2].iov_base = iso_buffer;
1491 - iov[2].iov_len = len;
1492 + iov[iovnum].iov_base = iso_buffer;
1493 + iov[iovnum].iov_len = len;
1494 txsize += len;
1495 + iovnum++;
1496 }
1497
1498 - ret = kernel_sendmsg(sdev->ud.tcp_socket, &msg, iov,
1499 - 3, txsize);
1500 + ret = kernel_sendmsg(sdev->ud.tcp_socket, &msg,
1501 + iov, iovnum, txsize);
1502 if (ret != txsize) {
1503 dev_err(&sdev->interface->dev,
1504 "sendmsg failed!, retval %d for %zd\n",
1505 ret, txsize);
1506 + kfree(iov);
1507 kfree(iso_buffer);
1508 usbip_event_add(&sdev->ud, SDEV_EVENT_ERROR_TCP);
1509 return -1;
1510 }
1511
1512 + kfree(iov);
1513 kfree(iso_buffer);
1514 - usbip_dbg_stub_tx("send txdata\n");
1515
1516 total_size += txsize;
1517 }
1518
1519 -
1520 spin_lock_irqsave(&sdev->priv_lock, flags);
1521
1522 list_for_each_entry_safe(priv, tmp, &sdev->priv_free, list) {
1523 diff --git a/drivers/staging/usbip/usbip_common.c b/drivers/staging/usbip/usbip_common.c
1524 index 210ef16..2108ca1 100644
1525 --- a/drivers/staging/usbip/usbip_common.c
1526 +++ b/drivers/staging/usbip/usbip_common.c
1527 @@ -334,10 +334,11 @@ void usbip_dump_header(struct usbip_header *pdu)
1528 usbip_udbg("CMD_UNLINK: seq %u\n", pdu->u.cmd_unlink.seqnum);
1529 break;
1530 case USBIP_RET_SUBMIT:
1531 - usbip_udbg("RET_SUBMIT: st %d al %u sf %d ec %d\n",
1532 + usbip_udbg("RET_SUBMIT: st %d al %u sf %d #p %d ec %d\n",
1533 pdu->u.ret_submit.status,
1534 pdu->u.ret_submit.actual_length,
1535 pdu->u.ret_submit.start_frame,
1536 + pdu->u.ret_submit.number_of_packets,
1537 pdu->u.ret_submit.error_count);
1538 case USBIP_RET_UNLINK:
1539 usbip_udbg("RET_UNLINK: status %d\n", pdu->u.ret_unlink.status);
1540 @@ -625,6 +626,7 @@ static void usbip_pack_ret_submit(struct usbip_header *pdu, struct urb *urb,
1541 rpdu->status = urb->status;
1542 rpdu->actual_length = urb->actual_length;
1543 rpdu->start_frame = urb->start_frame;
1544 + rpdu->number_of_packets = urb->number_of_packets;
1545 rpdu->error_count = urb->error_count;
1546 } else {
1547 /* vhci_rx.c */
1548 @@ -632,6 +634,7 @@ static void usbip_pack_ret_submit(struct usbip_header *pdu, struct urb *urb,
1549 urb->status = rpdu->status;
1550 urb->actual_length = rpdu->actual_length;
1551 urb->start_frame = rpdu->start_frame;
1552 + urb->number_of_packets = rpdu->number_of_packets;
1553 urb->error_count = rpdu->error_count;
1554 }
1555 }
1556 @@ -700,11 +703,13 @@ static void correct_endian_ret_submit(struct usbip_header_ret_submit *pdu,
1557 cpu_to_be32s(&pdu->status);
1558 cpu_to_be32s(&pdu->actual_length);
1559 cpu_to_be32s(&pdu->start_frame);
1560 + cpu_to_be32s(&pdu->number_of_packets);
1561 cpu_to_be32s(&pdu->error_count);
1562 } else {
1563 be32_to_cpus(&pdu->status);
1564 be32_to_cpus(&pdu->actual_length);
1565 be32_to_cpus(&pdu->start_frame);
1566 + cpu_to_be32s(&pdu->number_of_packets);
1567 be32_to_cpus(&pdu->error_count);
1568 }
1569 }
1570 @@ -830,6 +835,7 @@ int usbip_recv_iso(struct usbip_device *ud, struct urb *urb)
1571 int size = np * sizeof(*iso);
1572 int i;
1573 int ret;
1574 + int total_length = 0;
1575
1576 if (!usb_pipeisoc(urb->pipe))
1577 return 0;
1578 @@ -859,19 +865,75 @@ int usbip_recv_iso(struct usbip_device *ud, struct urb *urb)
1579 return -EPIPE;
1580 }
1581
1582 +
1583 for (i = 0; i < np; i++) {
1584 iso = buff + (i * sizeof(*iso));
1585
1586 usbip_iso_pakcet_correct_endian(iso, 0);
1587 usbip_pack_iso(iso, &urb->iso_frame_desc[i], 0);
1588 + total_length += urb->iso_frame_desc[i].actual_length;
1589 }
1590
1591 kfree(buff);
1592
1593 + if (total_length != urb->actual_length) {
1594 + dev_err(&urb->dev->dev,
1595 + "total length of iso packets (%d) not equal to actual length of buffer (%d)\n",
1596 + total_length, urb->actual_length);
1597 +
1598 + if (ud->side == USBIP_STUB)
1599 + usbip_event_add(ud, SDEV_EVENT_ERROR_TCP);
1600 + else
1601 + usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
1602 +
1603 + return -EPIPE;
1604 + }
1605 +
1606 return ret;
1607 }
1608 EXPORT_SYMBOL_GPL(usbip_recv_iso);
1609
1610 +/*
1611 + * This functions restores the padding which was removed for optimizing
1612 + * the bandwidth during transfer over tcp/ip
1613 + *
1614 + * buffer and iso packets need to be stored and be in propeper endian in urb
1615 + * before calling this function
1616 + */
1617 +int usbip_pad_iso(struct usbip_device *ud, struct urb *urb)
1618 +{
1619 + int np = urb->number_of_packets;
1620 + int i;
1621 + int ret;
1622 + int actualoffset = urb->actual_length;
1623 +
1624 + if (!usb_pipeisoc(urb->pipe))
1625 + return 0;
1626 +
1627 + /* if no packets or length of data is 0, then nothing to unpack */
1628 + if (np == 0 || urb->actual_length == 0)
1629 + return 0;
1630 +
1631 + /*
1632 + * if actual_length is transfer_buffer_length then no padding is
1633 + * present.
1634 + */
1635 + if (urb->actual_length == urb->transfer_buffer_length)
1636 + return 0;
1637 +
1638 + /*
1639 + * loop over all packets from last to first (to prevent overwritting
1640 + * memory when padding) and move them into the proper place
1641 + */
1642 + for (i = np-1; i > 0; i--) {
1643 + actualoffset -= urb->iso_frame_desc[i].actual_length;
1644 + memmove(urb->transfer_buffer + urb->iso_frame_desc[i].offset,
1645 + urb->transfer_buffer + actualoffset,
1646 + urb->iso_frame_desc[i].actual_length);
1647 + }
1648 + return ret;
1649 +}
1650 +EXPORT_SYMBOL_GPL(usbip_pad_iso);
1651
1652 /* some members of urb must be substituted before. */
1653 int usbip_recv_xbuff(struct usbip_device *ud, struct urb *urb)
1654 diff --git a/drivers/staging/usbip/usbip_common.h b/drivers/staging/usbip/usbip_common.h
1655 index d280e23..baa4c09 100644
1656 --- a/drivers/staging/usbip/usbip_common.h
1657 +++ b/drivers/staging/usbip/usbip_common.h
1658 @@ -393,6 +393,8 @@ void usbip_header_correct_endian(struct usbip_header *pdu, int send);
1659 int usbip_recv_xbuff(struct usbip_device *ud, struct urb *urb);
1660 /* some members of urb must be substituted before. */
1661 int usbip_recv_iso(struct usbip_device *ud, struct urb *urb);
1662 +/* some members of urb must be substituted before. */
1663 +int usbip_pad_iso(struct usbip_device *ud, struct urb *urb);
1664 void *usbip_alloc_iso_desc_pdu(struct urb *urb, ssize_t *bufflen);
1665
1666
1667 diff --git a/drivers/staging/usbip/vhci_rx.c b/drivers/staging/usbip/vhci_rx.c
1668 index bf69914..109002a 100644
1669 --- a/drivers/staging/usbip/vhci_rx.c
1670 +++ b/drivers/staging/usbip/vhci_rx.c
1671 @@ -99,6 +99,9 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev,
1672 if (usbip_recv_iso(ud, urb) < 0)
1673 return;
1674
1675 + /* restore the padding in iso packets */
1676 + if (usbip_pad_iso(ud, urb) < 0)
1677 + return;
1678
1679 if (usbip_dbg_flag_vhci_rx)
1680 usbip_dump_urb(urb);
1681 diff --git a/drivers/watchdog/davinci_wdt.c b/drivers/watchdog/davinci_wdt.c
1682 index 596ba60..51b5551 100644
1683 --- a/drivers/watchdog/davinci_wdt.c
1684 +++ b/drivers/watchdog/davinci_wdt.c
1685 @@ -202,7 +202,6 @@ static struct miscdevice davinci_wdt_miscdev = {
1686 static int __devinit davinci_wdt_probe(struct platform_device *pdev)
1687 {
1688 int ret = 0, size;
1689 - struct resource *res;
1690 struct device *dev = &pdev->dev;
1691
1692 wdt_clk = clk_get(dev, NULL);
1693 @@ -216,31 +215,31 @@ static int __devinit davinci_wdt_probe(struct platform_device *pdev)
1694
1695 dev_info(dev, "heartbeat %d sec\n", heartbeat);
1696
1697 - res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
1698 - if (res == NULL) {
1699 + wdt_mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
1700 + if (wdt_mem == NULL) {
1701 dev_err(dev, "failed to get memory region resource\n");
1702 return -ENOENT;
1703 }
1704
1705 - size = resource_size(res);
1706 - wdt_mem = request_mem_region(res->start, size, pdev->name);
1707 -
1708 - if (wdt_mem == NULL) {
1709 + size = resource_size(wdt_mem);
1710 + if (!request_mem_region(wdt_mem->start, size, pdev->name)) {
1711 dev_err(dev, "failed to get memory region\n");
1712 return -ENOENT;
1713 }
1714
1715 - wdt_base = ioremap(res->start, size);
1716 + wdt_base = ioremap(wdt_mem->start, size);
1717 if (!wdt_base) {
1718 dev_err(dev, "failed to map memory region\n");
1719 + release_mem_region(wdt_mem->start, size);
1720 + wdt_mem = NULL;
1721 return -ENOMEM;
1722 }
1723
1724 ret = misc_register(&davinci_wdt_miscdev);
1725 if (ret < 0) {
1726 dev_err(dev, "cannot register misc device\n");
1727 - release_resource(wdt_mem);
1728 - kfree(wdt_mem);
1729 + release_mem_region(wdt_mem->start, size);
1730 + wdt_mem = NULL;
1731 } else {
1732 set_bit(WDT_DEVICE_INITED, &wdt_status);
1733 }
1734 @@ -253,8 +252,7 @@ static int __devexit davinci_wdt_remove(struct platform_device *pdev)
1735 {
1736 misc_deregister(&davinci_wdt_miscdev);
1737 if (wdt_mem) {
1738 - release_resource(wdt_mem);
1739 - kfree(wdt_mem);
1740 + release_mem_region(wdt_mem->start, resource_size(wdt_mem));
1741 wdt_mem = NULL;
1742 }
1743
1744 diff --git a/drivers/watchdog/max63xx_wdt.c b/drivers/watchdog/max63xx_wdt.c
1745 index 3053ff0..1fe9bc5 100644
1746 --- a/drivers/watchdog/max63xx_wdt.c
1747 +++ b/drivers/watchdog/max63xx_wdt.c
1748 @@ -270,7 +270,6 @@ static int __devinit max63xx_wdt_probe(struct platform_device *pdev)
1749 {
1750 int ret = 0;
1751 int size;
1752 - struct resource *res;
1753 struct device *dev = &pdev->dev;
1754 struct max63xx_timeout *table;
1755
1756 @@ -294,21 +293,19 @@ static int __devinit max63xx_wdt_probe(struct platform_device *pdev)
1757
1758 max63xx_pdev = pdev;
1759
1760 - res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
1761 - if (res == NULL) {
1762 + wdt_mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
1763 + if (wdt_mem == NULL) {
1764 dev_err(dev, "failed to get memory region resource\n");
1765 return -ENOENT;
1766 }
1767
1768 - size = resource_size(res);
1769 - wdt_mem = request_mem_region(res->start, size, pdev->name);
1770 -
1771 - if (wdt_mem == NULL) {
1772 + size = resource_size(wdt_mem);
1773 + if (!request_mem_region(wdt_mem->start, size, pdev->name)) {
1774 dev_err(dev, "failed to get memory region\n");
1775 return -ENOENT;
1776 }
1777
1778 - wdt_base = ioremap(res->start, size);
1779 + wdt_base = ioremap(wdt_mem->start, size);
1780 if (!wdt_base) {
1781 dev_err(dev, "failed to map memory region\n");
1782 ret = -ENOMEM;
1783 @@ -326,8 +323,8 @@ static int __devinit max63xx_wdt_probe(struct platform_device *pdev)
1784 out_unmap:
1785 iounmap(wdt_base);
1786 out_request:
1787 - release_resource(wdt_mem);
1788 - kfree(wdt_mem);
1789 + release_mem_region(wdt_mem->start, size);
1790 + wdt_mem = NULL;
1791
1792 return ret;
1793 }
1794 @@ -336,8 +333,7 @@ static int __devexit max63xx_wdt_remove(struct platform_device *pdev)
1795 {
1796 misc_deregister(&max63xx_wdt_miscdev);
1797 if (wdt_mem) {
1798 - release_resource(wdt_mem);
1799 - kfree(wdt_mem);
1800 + release_mem_region(wdt_mem->start, resource_size(wdt_mem));
1801 wdt_mem = NULL;
1802 }
1803
1804 diff --git a/drivers/watchdog/pnx4008_wdt.c b/drivers/watchdog/pnx4008_wdt.c
1805 index bf5b97c..8c8c7d5 100644
1806 --- a/drivers/watchdog/pnx4008_wdt.c
1807 +++ b/drivers/watchdog/pnx4008_wdt.c
1808 @@ -254,7 +254,6 @@ static struct miscdevice pnx4008_wdt_miscdev = {
1809 static int __devinit pnx4008_wdt_probe(struct platform_device *pdev)
1810 {
1811 int ret = 0, size;
1812 - struct resource *res;
1813
1814 if (heartbeat < 1 || heartbeat > MAX_HEARTBEAT)
1815 heartbeat = DEFAULT_HEARTBEAT;
1816 @@ -262,42 +261,42 @@ static int __devinit pnx4008_wdt_probe(struct platform_device *pdev)
1817 printk(KERN_INFO MODULE_NAME
1818 "PNX4008 Watchdog Timer: heartbeat %d sec\n", heartbeat);
1819
1820 - res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
1821 - if (res == NULL) {
1822 + wdt_mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
1823 + if (wdt_mem == NULL) {
1824 printk(KERN_INFO MODULE_NAME
1825 "failed to get memory region resouce\n");
1826 return -ENOENT;
1827 }
1828
1829 - size = resource_size(res);
1830 - wdt_mem = request_mem_region(res->start, size, pdev->name);
1831 + size = resource_size(wdt_mem);
1832
1833 - if (wdt_mem == NULL) {
1834 + if (!request_mem_region(wdt_mem->start, size, pdev->name)) {
1835 printk(KERN_INFO MODULE_NAME "failed to get memory region\n");
1836 return -ENOENT;
1837 }
1838 - wdt_base = (void __iomem *)IO_ADDRESS(res->start);
1839 + wdt_base = (void __iomem *)IO_ADDRESS(wdt_mem->start);
1840
1841 wdt_clk = clk_get(&pdev->dev, NULL);
1842 if (IS_ERR(wdt_clk)) {
1843 ret = PTR_ERR(wdt_clk);
1844 - release_resource(wdt_mem);
1845 - kfree(wdt_mem);
1846 + release_mem_region(wdt_mem->start, size);
1847 + wdt_mem = NULL;
1848 goto out;
1849 }
1850
1851 ret = clk_enable(wdt_clk);
1852 if (ret) {
1853 - release_resource(wdt_mem);
1854 - kfree(wdt_mem);
1855 + release_mem_region(wdt_mem->start, size);
1856 + wdt_mem = NULL;
1857 + clk_put(wdt_clk);
1858 goto out;
1859 }
1860
1861 ret = misc_register(&pnx4008_wdt_miscdev);
1862 if (ret < 0) {
1863 printk(KERN_ERR MODULE_NAME "cannot register misc device\n");
1864 - release_resource(wdt_mem);
1865 - kfree(wdt_mem);
1866 + release_mem_region(wdt_mem->start, size);
1867 + wdt_mem = NULL;
1868 clk_disable(wdt_clk);
1869 clk_put(wdt_clk);
1870 } else {
1871 @@ -320,8 +319,7 @@ static int __devexit pnx4008_wdt_remove(struct platform_device *pdev)
1872 clk_put(wdt_clk);
1873
1874 if (wdt_mem) {
1875 - release_resource(wdt_mem);
1876 - kfree(wdt_mem);
1877 + release_mem_region(wdt_mem->start, resource_size(wdt_mem));
1878 wdt_mem = NULL;
1879 }
1880 return 0;
1881 diff --git a/drivers/watchdog/s3c2410_wdt.c b/drivers/watchdog/s3c2410_wdt.c
1882 index ae53662..8303c57 100644
1883 --- a/drivers/watchdog/s3c2410_wdt.c
1884 +++ b/drivers/watchdog/s3c2410_wdt.c
1885 @@ -402,7 +402,6 @@ static inline void s3c2410wdt_cpufreq_deregister(void)
1886
1887 static int __devinit s3c2410wdt_probe(struct platform_device *pdev)
1888 {
1889 - struct resource *res;
1890 struct device *dev;
1891 unsigned int wtcon;
1892 int started = 0;
1893 @@ -416,20 +415,19 @@ static int __devinit s3c2410wdt_probe(struct platform_device *pdev)
1894
1895 /* get the memory region for the watchdog timer */
1896
1897 - res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
1898 - if (res == NULL) {
1899 + wdt_mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
1900 + if (wdt_mem == NULL) {
1901 dev_err(dev, "no memory resource specified\n");
1902 return -ENOENT;
1903 }
1904
1905 - size = resource_size(res);
1906 - wdt_mem = request_mem_region(res->start, size, pdev->name);
1907 - if (wdt_mem == NULL) {
1908 + size = resource_size(wdt_mem);
1909 + if (!request_mem_region(wdt_mem->start, size, pdev->name)) {
1910 dev_err(dev, "failed to get memory region\n");
1911 return -EBUSY;
1912 }
1913
1914 - wdt_base = ioremap(res->start, size);
1915 + wdt_base = ioremap(wdt_mem->start, size);
1916 if (wdt_base == NULL) {
1917 dev_err(dev, "failed to ioremap() region\n");
1918 ret = -EINVAL;
1919 @@ -524,8 +522,8 @@ static int __devinit s3c2410wdt_probe(struct platform_device *pdev)
1920 iounmap(wdt_base);
1921
1922 err_req:
1923 - release_resource(wdt_mem);
1924 - kfree(wdt_mem);
1925 + release_mem_region(wdt_mem->start, size);
1926 + wdt_mem = NULL;
1927
1928 return ret;
1929 }
1930 @@ -545,8 +543,7 @@ static int __devexit s3c2410wdt_remove(struct platform_device *dev)
1931
1932 iounmap(wdt_base);
1933
1934 - release_resource(wdt_mem);
1935 - kfree(wdt_mem);
1936 + release_mem_region(wdt_mem->start, resource_size(wdt_mem));
1937 wdt_mem = NULL;
1938 return 0;
1939 }
1940 diff --git a/drivers/watchdog/sp5100_tco.c b/drivers/watchdog/sp5100_tco.c
1941 index 8083728..c7ea4be 100644
1942 --- a/drivers/watchdog/sp5100_tco.c
1943 +++ b/drivers/watchdog/sp5100_tco.c
1944 @@ -42,6 +42,7 @@
1945 #define PFX TCO_MODULE_NAME ": "
1946
1947 /* internal variables */
1948 +static u32 tcobase_phys;
1949 static void __iomem *tcobase;
1950 static unsigned int pm_iobase;
1951 static DEFINE_SPINLOCK(tco_lock); /* Guards the hardware */
1952 @@ -305,10 +306,18 @@ static unsigned char __devinit sp5100_tco_setupdevice(void)
1953 /* Low three bits of BASE0 are reserved. */
1954 val = val << 8 | (inb(SP5100_IO_PM_DATA_REG) & 0xf8);
1955
1956 + if (!request_mem_region_exclusive(val, SP5100_WDT_MEM_MAP_SIZE,
1957 + "SP5100 TCO")) {
1958 + printk(KERN_ERR PFX "mmio address 0x%04x already in use\n",
1959 + val);
1960 + goto unreg_region;
1961 + }
1962 + tcobase_phys = val;
1963 +
1964 tcobase = ioremap(val, SP5100_WDT_MEM_MAP_SIZE);
1965 if (tcobase == 0) {
1966 printk(KERN_ERR PFX "failed to get tcobase address\n");
1967 - goto unreg_region;
1968 + goto unreg_mem_region;
1969 }
1970
1971 /* Enable watchdog decode bit */
1972 @@ -346,7 +355,8 @@ static unsigned char __devinit sp5100_tco_setupdevice(void)
1973 /* Done */
1974 return 1;
1975
1976 - iounmap(tcobase);
1977 +unreg_mem_region:
1978 + release_mem_region(tcobase_phys, SP5100_WDT_MEM_MAP_SIZE);
1979 unreg_region:
1980 release_region(pm_iobase, SP5100_PM_IOPORTS_SIZE);
1981 exit:
1982 @@ -401,6 +411,7 @@ static int __devinit sp5100_tco_init(struct platform_device *dev)
1983
1984 exit:
1985 iounmap(tcobase);
1986 + release_mem_region(tcobase_phys, SP5100_WDT_MEM_MAP_SIZE);
1987 release_region(pm_iobase, SP5100_PM_IOPORTS_SIZE);
1988 return ret;
1989 }
1990 @@ -414,6 +425,7 @@ static void __devexit sp5100_tco_cleanup(void)
1991 /* Deregister */
1992 misc_deregister(&sp5100_tco_miscdev);
1993 iounmap(tcobase);
1994 + release_mem_region(tcobase_phys, SP5100_WDT_MEM_MAP_SIZE);
1995 release_region(pm_iobase, SP5100_PM_IOPORTS_SIZE);
1996 }
1997
1998 diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
1999 index 7f78cc7..bd64b41 100644
2000 --- a/fs/btrfs/ctree.h
2001 +++ b/fs/btrfs/ctree.h
2002 @@ -1284,6 +1284,8 @@ struct btrfs_root {
2003 #define BTRFS_INODE_NOATIME (1 << 9)
2004 #define BTRFS_INODE_DIRSYNC (1 << 10)
2005
2006 +#define BTRFS_INODE_ROOT_ITEM_INIT (1 << 31)
2007 +
2008 /* some macros to generate set/get funcs for the struct fields. This
2009 * assumes there is a lefoo_to_cpu for every type, so lets make a simple
2010 * one for u8:
2011 @@ -2355,6 +2357,8 @@ int btrfs_find_dead_roots(struct btrfs_root *root, u64 objectid);
2012 int btrfs_find_orphan_roots(struct btrfs_root *tree_root);
2013 int btrfs_set_root_node(struct btrfs_root_item *item,
2014 struct extent_buffer *node);
2015 +void btrfs_check_and_init_root_item(struct btrfs_root_item *item);
2016 +
2017 /* dir-item.c */
2018 int btrfs_insert_dir_item(struct btrfs_trans_handle *trans,
2019 struct btrfs_root *root, const char *name,
2020 diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
2021 index e1aa8d6..edd9efa 100644
2022 --- a/fs/btrfs/disk-io.c
2023 +++ b/fs/btrfs/disk-io.c
2024 @@ -1184,8 +1184,10 @@ struct btrfs_root *btrfs_read_fs_root_no_radix(struct btrfs_root *tree_root,
2025 root->commit_root = btrfs_root_node(root);
2026 BUG_ON(!root->node);
2027 out:
2028 - if (location->objectid != BTRFS_TREE_LOG_OBJECTID)
2029 + if (location->objectid != BTRFS_TREE_LOG_OBJECTID) {
2030 root->ref_cows = 1;
2031 + btrfs_check_and_init_root_item(&root->root_item);
2032 + }
2033
2034 return root;
2035 }
2036 diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
2037 index 5fdb2ab..2ff51e6 100644
2038 --- a/fs/btrfs/ioctl.c
2039 +++ b/fs/btrfs/ioctl.c
2040 @@ -294,6 +294,10 @@ static noinline int create_subvol(struct btrfs_root *root,
2041 inode_item->nbytes = cpu_to_le64(root->leafsize);
2042 inode_item->mode = cpu_to_le32(S_IFDIR | 0755);
2043
2044 + root_item.flags = 0;
2045 + root_item.byte_limit = 0;
2046 + inode_item->flags = cpu_to_le64(BTRFS_INODE_ROOT_ITEM_INIT);
2047 +
2048 btrfs_set_root_bytenr(&root_item, leaf->start);
2049 btrfs_set_root_generation(&root_item, trans->transid);
2050 btrfs_set_root_level(&root_item, 0);
2051 diff --git a/fs/btrfs/root-tree.c b/fs/btrfs/root-tree.c
2052 index 6a1086e..3e45c32 100644
2053 --- a/fs/btrfs/root-tree.c
2054 +++ b/fs/btrfs/root-tree.c
2055 @@ -471,3 +471,21 @@ again:
2056 btrfs_free_path(path);
2057 return 0;
2058 }
2059 +
2060 +/*
2061 + * Old btrfs forgets to init root_item->flags and root_item->byte_limit
2062 + * for subvolumes. To work around this problem, we steal a bit from
2063 + * root_item->inode_item->flags, and use it to indicate if those fields
2064 + * have been properly initialized.
2065 + */
2066 +void btrfs_check_and_init_root_item(struct btrfs_root_item *root_item)
2067 +{
2068 + u64 inode_flags = le64_to_cpu(root_item->inode.flags);
2069 +
2070 + if (!(inode_flags & BTRFS_INODE_ROOT_ITEM_INIT)) {
2071 + inode_flags |= BTRFS_INODE_ROOT_ITEM_INIT;
2072 + root_item->inode.flags = cpu_to_le64(inode_flags);
2073 + root_item->flags = 0;
2074 + root_item->byte_limit = 0;
2075 + }
2076 +}
2077 diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
2078 index 3d73c8d..f3d6681 100644
2079 --- a/fs/btrfs/transaction.c
2080 +++ b/fs/btrfs/transaction.c
2081 @@ -970,6 +970,7 @@ static noinline int create_pending_snapshot(struct btrfs_trans_handle *trans,
2082 record_root_in_trans(trans, root);
2083 btrfs_set_root_last_snapshot(&root->root_item, trans->transid);
2084 memcpy(new_root_item, &root->root_item, sizeof(*new_root_item));
2085 + btrfs_check_and_init_root_item(new_root_item);
2086
2087 root_flags = btrfs_root_flags(new_root_item);
2088 if (pending->readonly)
2089 diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c
2090 index c1436cf..4feb78c 100644
2091 --- a/fs/ecryptfs/keystore.c
2092 +++ b/fs/ecryptfs/keystore.c
2093 @@ -1563,6 +1563,7 @@ int ecryptfs_keyring_auth_tok_for_sig(struct key **auth_tok_key,
2094 printk(KERN_ERR "Could not find key with description: [%s]\n",
2095 sig);
2096 rc = process_request_key_err(PTR_ERR(*auth_tok_key));
2097 + (*auth_tok_key) = NULL;
2098 goto out;
2099 }
2100 (*auth_tok) = ecryptfs_get_key_payload_data(*auth_tok_key);
2101 diff --git a/fs/ecryptfs/mmap.c b/fs/ecryptfs/mmap.c
2102 index cc64fca..eb9d967 100644
2103 --- a/fs/ecryptfs/mmap.c
2104 +++ b/fs/ecryptfs/mmap.c
2105 @@ -374,6 +374,11 @@ static int ecryptfs_write_begin(struct file *file,
2106 && (pos != 0))
2107 zero_user(page, 0, PAGE_CACHE_SIZE);
2108 out:
2109 + if (unlikely(rc)) {
2110 + unlock_page(page);
2111 + page_cache_release(page);
2112 + *pagep = NULL;
2113 + }
2114 return rc;
2115 }
2116
2117 diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
2118 index 9f7f9e4..fee51db 100644
2119 --- a/fs/ext4/inode.c
2120 +++ b/fs/ext4/inode.c
2121 @@ -5460,13 +5460,12 @@ static int ext4_indirect_trans_blocks(struct inode *inode, int nrblocks,
2122 /* if nrblocks are contiguous */
2123 if (chunk) {
2124 /*
2125 - * With N contiguous data blocks, it need at most
2126 - * N/EXT4_ADDR_PER_BLOCK(inode->i_sb) indirect blocks
2127 - * 2 dindirect blocks
2128 - * 1 tindirect block
2129 + * With N contiguous data blocks, we need at most
2130 + * N/EXT4_ADDR_PER_BLOCK(inode->i_sb) + 1 indirect blocks,
2131 + * 2 dindirect blocks, and 1 tindirect block
2132 */
2133 - indirects = nrblocks / EXT4_ADDR_PER_BLOCK(inode->i_sb);
2134 - return indirects + 3;
2135 + return DIV_ROUND_UP(nrblocks,
2136 + EXT4_ADDR_PER_BLOCK(inode->i_sb)) + 4;
2137 }
2138 /*
2139 * if nrblocks are not contiguous, worse case, each block touch
2140 diff --git a/fs/ext4/super.c b/fs/ext4/super.c
2141 index 4381efe..243deb0 100644
2142 --- a/fs/ext4/super.c
2143 +++ b/fs/ext4/super.c
2144 @@ -2978,6 +2978,12 @@ static int ext4_register_li_request(struct super_block *sb,
2145 mutex_unlock(&ext4_li_info->li_list_mtx);
2146
2147 sbi->s_li_request = elr;
2148 + /*
2149 + * set elr to NULL here since it has been inserted to
2150 + * the request_list and the removal and free of it is
2151 + * handled by ext4_clear_request_list from now on.
2152 + */
2153 + elr = NULL;
2154
2155 if (!(ext4_li_info->li_state & EXT4_LAZYINIT_RUNNING)) {
2156 ret = ext4_run_lazyinit_thread();
2157 diff --git a/fs/nfsd/lockd.c b/fs/nfsd/lockd.c
2158 index 0c6d816..7c831a2 100644
2159 --- a/fs/nfsd/lockd.c
2160 +++ b/fs/nfsd/lockd.c
2161 @@ -38,7 +38,6 @@ nlm_fopen(struct svc_rqst *rqstp, struct nfs_fh *f, struct file **filp)
2162 exp_readlock();
2163 nfserr = nfsd_open(rqstp, &fh, S_IFREG, NFSD_MAY_LOCK, filp);
2164 fh_put(&fh);
2165 - rqstp->rq_client = NULL;
2166 exp_readunlock();
2167 /* We return nlm error codes as nlm doesn't know
2168 * about nfsd, but nfsd does know about nlm..
2169 diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
2170 index f0e448a..96aaaa4 100644
2171 --- a/fs/nfsd/nfs4state.c
2172 +++ b/fs/nfsd/nfs4state.c
2173 @@ -397,10 +397,13 @@ static void unhash_generic_stateid(struct nfs4_stateid *stp)
2174
2175 static void free_generic_stateid(struct nfs4_stateid *stp)
2176 {
2177 - int oflag = nfs4_access_bmap_to_omode(stp);
2178 + int oflag;
2179
2180 - nfs4_file_put_access(stp->st_file, oflag);
2181 - put_nfs4_file(stp->st_file);
2182 + if (stp->st_access_bmap) {
2183 + oflag = nfs4_access_bmap_to_omode(stp);
2184 + nfs4_file_put_access(stp->st_file, oflag);
2185 + put_nfs4_file(stp->st_file);
2186 + }
2187 kmem_cache_free(stateid_slab, stp);
2188 }
2189
2190 diff --git a/fs/nilfs2/file.c b/fs/nilfs2/file.c
2191 index 2f560c9..f49e628 100644
2192 --- a/fs/nilfs2/file.c
2193 +++ b/fs/nilfs2/file.c
2194 @@ -72,10 +72,9 @@ static int nilfs_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
2195 /*
2196 * check to see if the page is mapped already (no holes)
2197 */
2198 - if (PageMappedToDisk(page)) {
2199 - unlock_page(page);
2200 + if (PageMappedToDisk(page))
2201 goto mapped;
2202 - }
2203 +
2204 if (page_has_buffers(page)) {
2205 struct buffer_head *bh, *head;
2206 int fully_mapped = 1;
2207 @@ -90,7 +89,6 @@ static int nilfs_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
2208
2209 if (fully_mapped) {
2210 SetPageMappedToDisk(page);
2211 - unlock_page(page);
2212 goto mapped;
2213 }
2214 }
2215 @@ -105,16 +103,17 @@ static int nilfs_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
2216 return VM_FAULT_SIGBUS;
2217
2218 ret = block_page_mkwrite(vma, vmf, nilfs_get_block);
2219 - if (unlikely(ret)) {
2220 + if (ret != VM_FAULT_LOCKED) {
2221 nilfs_transaction_abort(inode->i_sb);
2222 return ret;
2223 }
2224 + nilfs_set_file_dirty(inode, 1 << (PAGE_SHIFT - inode->i_blkbits));
2225 nilfs_transaction_commit(inode->i_sb);
2226
2227 mapped:
2228 SetPageChecked(page);
2229 wait_on_page_writeback(page);
2230 - return 0;
2231 + return VM_FAULT_LOCKED;
2232 }
2233
2234 static const struct vm_operations_struct nilfs_file_vm_ops = {
2235 diff --git a/fs/notify/inotify/inotify_fsnotify.c b/fs/notify/inotify/inotify_fsnotify.c
2236 index a91b69a..0348d0c 100644
2237 --- a/fs/notify/inotify/inotify_fsnotify.c
2238 +++ b/fs/notify/inotify/inotify_fsnotify.c
2239 @@ -198,6 +198,7 @@ static void inotify_free_group_priv(struct fsnotify_group *group)
2240 idr_for_each(&group->inotify_data.idr, idr_callback, group);
2241 idr_remove_all(&group->inotify_data.idr);
2242 idr_destroy(&group->inotify_data.idr);
2243 + atomic_dec(&group->inotify_data.user->inotify_devs);
2244 free_uid(group->inotify_data.user);
2245 }
2246
2247 diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c
2248 index 4cd5d5d..aec9b4a 100644
2249 --- a/fs/notify/inotify/inotify_user.c
2250 +++ b/fs/notify/inotify/inotify_user.c
2251 @@ -290,7 +290,6 @@ static int inotify_fasync(int fd, struct file *file, int on)
2252 static int inotify_release(struct inode *ignored, struct file *file)
2253 {
2254 struct fsnotify_group *group = file->private_data;
2255 - struct user_struct *user = group->inotify_data.user;
2256
2257 pr_debug("%s: group=%p\n", __func__, group);
2258
2259 @@ -299,8 +298,6 @@ static int inotify_release(struct inode *ignored, struct file *file)
2260 /* free this group, matching get was inotify_init->fsnotify_obtain_group */
2261 fsnotify_put_group(group);
2262
2263 - atomic_dec(&user->inotify_devs);
2264 -
2265 return 0;
2266 }
2267
2268 @@ -697,7 +694,7 @@ retry:
2269 return ret;
2270 }
2271
2272 -static struct fsnotify_group *inotify_new_group(struct user_struct *user, unsigned int max_events)
2273 +static struct fsnotify_group *inotify_new_group(unsigned int max_events)
2274 {
2275 struct fsnotify_group *group;
2276
2277 @@ -710,8 +707,14 @@ static struct fsnotify_group *inotify_new_group(struct user_struct *user, unsign
2278 spin_lock_init(&group->inotify_data.idr_lock);
2279 idr_init(&group->inotify_data.idr);
2280 group->inotify_data.last_wd = 0;
2281 - group->inotify_data.user = user;
2282 group->inotify_data.fa = NULL;
2283 + group->inotify_data.user = get_current_user();
2284 +
2285 + if (atomic_inc_return(&group->inotify_data.user->inotify_devs) >
2286 + inotify_max_user_instances) {
2287 + fsnotify_put_group(group);
2288 + return ERR_PTR(-EMFILE);
2289 + }
2290
2291 return group;
2292 }
2293 @@ -721,7 +724,6 @@ static struct fsnotify_group *inotify_new_group(struct user_struct *user, unsign
2294 SYSCALL_DEFINE1(inotify_init1, int, flags)
2295 {
2296 struct fsnotify_group *group;
2297 - struct user_struct *user;
2298 int ret;
2299
2300 /* Check the IN_* constants for consistency. */
2301 @@ -731,31 +733,16 @@ SYSCALL_DEFINE1(inotify_init1, int, flags)
2302 if (flags & ~(IN_CLOEXEC | IN_NONBLOCK))
2303 return -EINVAL;
2304
2305 - user = get_current_user();
2306 - if (unlikely(atomic_read(&user->inotify_devs) >=
2307 - inotify_max_user_instances)) {
2308 - ret = -EMFILE;
2309 - goto out_free_uid;
2310 - }
2311 -
2312 /* fsnotify_obtain_group took a reference to group, we put this when we kill the file in the end */
2313 - group = inotify_new_group(user, inotify_max_queued_events);
2314 - if (IS_ERR(group)) {
2315 - ret = PTR_ERR(group);
2316 - goto out_free_uid;
2317 - }
2318 -
2319 - atomic_inc(&user->inotify_devs);
2320 + group = inotify_new_group(inotify_max_queued_events);
2321 + if (IS_ERR(group))
2322 + return PTR_ERR(group);
2323
2324 ret = anon_inode_getfd("inotify", &inotify_fops, group,
2325 O_RDONLY | flags);
2326 - if (ret >= 0)
2327 - return ret;
2328 + if (ret < 0)
2329 + fsnotify_put_group(group);
2330
2331 - fsnotify_put_group(group);
2332 - atomic_dec(&user->inotify_devs);
2333 -out_free_uid:
2334 - free_uid(user);
2335 return ret;
2336 }
2337
2338 diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
2339 index 1fbb0e2..bbba782 100644
2340 --- a/fs/ocfs2/aops.c
2341 +++ b/fs/ocfs2/aops.c
2342 @@ -1026,6 +1026,12 @@ static int ocfs2_prepare_page_for_write(struct inode *inode, u64 *p_blkno,
2343 ocfs2_figure_cluster_boundaries(OCFS2_SB(inode->i_sb), cpos,
2344 &cluster_start, &cluster_end);
2345
2346 + /* treat the write as new if the a hole/lseek spanned across
2347 + * the page boundary.
2348 + */
2349 + new = new | ((i_size_read(inode) <= page_offset(page)) &&
2350 + (page_offset(page) <= user_pos));
2351 +
2352 if (page == wc->w_target_page) {
2353 map_from = user_pos & (PAGE_CACHE_SIZE - 1);
2354 map_to = map_from + user_len;
2355 diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
2356 index a2a622e..b59ee61 100644
2357 --- a/fs/quota/dquot.c
2358 +++ b/fs/quota/dquot.c
2359 @@ -442,7 +442,7 @@ EXPORT_SYMBOL(dquot_acquire);
2360 */
2361 int dquot_commit(struct dquot *dquot)
2362 {
2363 - int ret = 0, ret2 = 0;
2364 + int ret = 0;
2365 struct quota_info *dqopt = sb_dqopt(dquot->dq_sb);
2366
2367 mutex_lock(&dqopt->dqio_mutex);
2368 @@ -454,15 +454,10 @@ int dquot_commit(struct dquot *dquot)
2369 spin_unlock(&dq_list_lock);
2370 /* Inactive dquot can be only if there was error during read/init
2371 * => we have better not writing it */
2372 - if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) {
2373 + if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags))
2374 ret = dqopt->ops[dquot->dq_type]->commit_dqblk(dquot);
2375 - if (info_dirty(&dqopt->info[dquot->dq_type])) {
2376 - ret2 = dqopt->ops[dquot->dq_type]->write_file_info(
2377 - dquot->dq_sb, dquot->dq_type);
2378 - }
2379 - if (ret >= 0)
2380 - ret = ret2;
2381 - }
2382 + else
2383 + ret = -EIO;
2384 out_sem:
2385 mutex_unlock(&dqopt->dqio_mutex);
2386 return ret;
2387 diff --git a/fs/squashfs/dir.c b/fs/squashfs/dir.c
2388 index 0dc340a..3f79cd1 100644
2389 --- a/fs/squashfs/dir.c
2390 +++ b/fs/squashfs/dir.c
2391 @@ -172,6 +172,11 @@ static int squashfs_readdir(struct file *file, void *dirent, filldir_t filldir)
2392 length += sizeof(dirh);
2393
2394 dir_count = le32_to_cpu(dirh.count) + 1;
2395 +
2396 + /* dir_count should never be larger than 256 */
2397 + if (dir_count > 256)
2398 + goto failed_read;
2399 +
2400 while (dir_count--) {
2401 /*
2402 * Read directory entry.
2403 @@ -183,6 +188,10 @@ static int squashfs_readdir(struct file *file, void *dirent, filldir_t filldir)
2404
2405 size = le16_to_cpu(dire->size) + 1;
2406
2407 + /* size should never be larger than SQUASHFS_NAME_LEN */
2408 + if (size > SQUASHFS_NAME_LEN)
2409 + goto failed_read;
2410 +
2411 err = squashfs_read_metadata(inode->i_sb, dire->name,
2412 &block, &offset, size);
2413 if (err < 0)
2414 diff --git a/fs/squashfs/namei.c b/fs/squashfs/namei.c
2415 index 7a9464d..5d922a6 100644
2416 --- a/fs/squashfs/namei.c
2417 +++ b/fs/squashfs/namei.c
2418 @@ -176,6 +176,11 @@ static struct dentry *squashfs_lookup(struct inode *dir, struct dentry *dentry,
2419 length += sizeof(dirh);
2420
2421 dir_count = le32_to_cpu(dirh.count) + 1;
2422 +
2423 + /* dir_count should never be larger than 256 */
2424 + if (dir_count > 256)
2425 + goto data_error;
2426 +
2427 while (dir_count--) {
2428 /*
2429 * Read directory entry.
2430 @@ -187,6 +192,10 @@ static struct dentry *squashfs_lookup(struct inode *dir, struct dentry *dentry,
2431
2432 size = le16_to_cpu(dire->size) + 1;
2433
2434 + /* size should never be larger than SQUASHFS_NAME_LEN */
2435 + if (size > SQUASHFS_NAME_LEN)
2436 + goto data_error;
2437 +
2438 err = squashfs_read_metadata(dir->i_sb, dire->name,
2439 &block, &offset, size);
2440 if (err < 0)
2441 @@ -228,6 +237,9 @@ exit_lookup:
2442 d_add(dentry, inode);
2443 return ERR_PTR(0);
2444
2445 +data_error:
2446 + err = -EIO;
2447 +
2448 read_failure:
2449 ERROR("Unable to read directory block [%llx:%x]\n",
2450 squashfs_i(dir)->start + msblk->directory_table,
2451 diff --git a/fs/squashfs/zlib_wrapper.c b/fs/squashfs/zlib_wrapper.c
2452 index 4661ae2..04ae9a5 100644
2453 --- a/fs/squashfs/zlib_wrapper.c
2454 +++ b/fs/squashfs/zlib_wrapper.c
2455 @@ -26,6 +26,7 @@
2456 #include <linux/buffer_head.h>
2457 #include <linux/slab.h>
2458 #include <linux/zlib.h>
2459 +#include <linux/vmalloc.h>
2460
2461 #include "squashfs_fs.h"
2462 #include "squashfs_fs_sb.h"
2463 @@ -37,8 +38,7 @@ static void *zlib_init(struct squashfs_sb_info *dummy)
2464 z_stream *stream = kmalloc(sizeof(z_stream), GFP_KERNEL);
2465 if (stream == NULL)
2466 goto failed;
2467 - stream->workspace = kmalloc(zlib_inflate_workspacesize(),
2468 - GFP_KERNEL);
2469 + stream->workspace = vmalloc(zlib_inflate_workspacesize());
2470 if (stream->workspace == NULL)
2471 goto failed;
2472
2473 @@ -56,7 +56,7 @@ static void zlib_free(void *strm)
2474 z_stream *stream = strm;
2475
2476 if (stream)
2477 - kfree(stream->workspace);
2478 + vfree(stream->workspace);
2479 kfree(stream);
2480 }
2481
2482 diff --git a/fs/ubifs/commit.c b/fs/ubifs/commit.c
2483 index 02429d8..32bcb2c 100644
2484 --- a/fs/ubifs/commit.c
2485 +++ b/fs/ubifs/commit.c
2486 @@ -521,7 +521,7 @@ int dbg_check_old_index(struct ubifs_info *c, struct ubifs_zbranch *zroot)
2487 size_t sz;
2488
2489 if (!(ubifs_chk_flags & UBIFS_CHK_OLD_IDX))
2490 - goto out;
2491 + return 0;
2492
2493 INIT_LIST_HEAD(&list);
2494
2495 diff --git a/fs/ubifs/debug.c b/fs/ubifs/debug.c
2496 index 0bee4db..5b9e985 100644
2497 --- a/fs/ubifs/debug.c
2498 +++ b/fs/ubifs/debug.c
2499 @@ -961,11 +961,39 @@ void dbg_dump_index(struct ubifs_info *c)
2500 void dbg_save_space_info(struct ubifs_info *c)
2501 {
2502 struct ubifs_debug_info *d = c->dbg;
2503 -
2504 - ubifs_get_lp_stats(c, &d->saved_lst);
2505 + int freeable_cnt;
2506
2507 spin_lock(&c->space_lock);
2508 + memcpy(&d->saved_lst, &c->lst, sizeof(struct ubifs_lp_stats));
2509 +
2510 + /*
2511 + * We use a dirty hack here and zero out @c->freeable_cnt, because it
2512 + * affects the free space calculations, and UBIFS might not know about
2513 + * all freeable eraseblocks. Indeed, we know about freeable eraseblocks
2514 + * only when we read their lprops, and we do this only lazily, upon the
2515 + * need. So at any given point of time @c->freeable_cnt might be not
2516 + * exactly accurate.
2517 + *
2518 + * Just one example about the issue we hit when we did not zero
2519 + * @c->freeable_cnt.
2520 + * 1. The file-system is mounted R/O, c->freeable_cnt is %0. We save the
2521 + * amount of free space in @d->saved_free
2522 + * 2. We re-mount R/W, which makes UBIFS to read the "lsave"
2523 + * information from flash, where we cache LEBs from various
2524 + * categories ('ubifs_remount_fs()' -> 'ubifs_lpt_init()'
2525 + * -> 'lpt_init_wr()' -> 'read_lsave()' -> 'ubifs_lpt_lookup()'
2526 + * -> 'ubifs_get_pnode()' -> 'update_cats()'
2527 + * -> 'ubifs_add_to_cat()').
2528 + * 3. Lsave contains a freeable eraseblock, and @c->freeable_cnt
2529 + * becomes %1.
2530 + * 4. We calculate the amount of free space when the re-mount is
2531 + * finished in 'dbg_check_space_info()' and it does not match
2532 + * @d->saved_free.
2533 + */
2534 + freeable_cnt = c->freeable_cnt;
2535 + c->freeable_cnt = 0;
2536 d->saved_free = ubifs_get_free_space_nolock(c);
2537 + c->freeable_cnt = freeable_cnt;
2538 spin_unlock(&c->space_lock);
2539 }
2540
2541 @@ -982,12 +1010,15 @@ int dbg_check_space_info(struct ubifs_info *c)
2542 {
2543 struct ubifs_debug_info *d = c->dbg;
2544 struct ubifs_lp_stats lst;
2545 - long long avail, free;
2546 + long long free;
2547 + int freeable_cnt;
2548
2549 spin_lock(&c->space_lock);
2550 - avail = ubifs_calc_available(c, c->min_idx_lebs);
2551 + freeable_cnt = c->freeable_cnt;
2552 + c->freeable_cnt = 0;
2553 + free = ubifs_get_free_space_nolock(c);
2554 + c->freeable_cnt = freeable_cnt;
2555 spin_unlock(&c->space_lock);
2556 - free = ubifs_get_free_space(c);
2557
2558 if (free != d->saved_free) {
2559 ubifs_err("free space changed from %lld to %lld",
2560 diff --git a/fs/ubifs/lpt.c b/fs/ubifs/lpt.c
2561 index 72775d3..ef5155e 100644
2562 --- a/fs/ubifs/lpt.c
2563 +++ b/fs/ubifs/lpt.c
2564 @@ -1270,10 +1270,9 @@ static int read_pnode(struct ubifs_info *c, struct ubifs_nnode *parent, int iip)
2565 lnum = branch->lnum;
2566 offs = branch->offs;
2567 pnode = kzalloc(sizeof(struct ubifs_pnode), GFP_NOFS);
2568 - if (!pnode) {
2569 - err = -ENOMEM;
2570 - goto out;
2571 - }
2572 + if (!pnode)
2573 + return -ENOMEM;
2574 +
2575 if (lnum == 0) {
2576 /*
2577 * This pnode was not written which just means that the LEB
2578 diff --git a/fs/xfs/linux-2.6/xfs_super.c b/fs/xfs/linux-2.6/xfs_super.c
2579 index 9731898..ad485b6 100644
2580 --- a/fs/xfs/linux-2.6/xfs_super.c
2581 +++ b/fs/xfs/linux-2.6/xfs_super.c
2582 @@ -1551,10 +1551,14 @@ xfs_fs_fill_super(
2583 if (error)
2584 goto out_free_sb;
2585
2586 - error = xfs_mountfs(mp);
2587 - if (error)
2588 - goto out_filestream_unmount;
2589 -
2590 + /*
2591 + * we must configure the block size in the superblock before we run the
2592 + * full mount process as the mount process can lookup and cache inodes.
2593 + * For the same reason we must also initialise the syncd and register
2594 + * the inode cache shrinker so that inodes can be reclaimed during
2595 + * operations like a quotacheck that iterate all inodes in the
2596 + * filesystem.
2597 + */
2598 sb->s_magic = XFS_SB_MAGIC;
2599 sb->s_blocksize = mp->m_sb.sb_blocksize;
2600 sb->s_blocksize_bits = ffs(sb->s_blocksize) - 1;
2601 @@ -1562,6 +1566,16 @@ xfs_fs_fill_super(
2602 sb->s_time_gran = 1;
2603 set_posix_acl_flag(sb);
2604
2605 + error = xfs_syncd_init(mp);
2606 + if (error)
2607 + goto out_filestream_unmount;
2608 +
2609 + xfs_inode_shrinker_register(mp);
2610 +
2611 + error = xfs_mountfs(mp);
2612 + if (error)
2613 + goto out_syncd_stop;
2614 +
2615 root = igrab(VFS_I(mp->m_rootip));
2616 if (!root) {
2617 error = ENOENT;
2618 @@ -1577,14 +1591,11 @@ xfs_fs_fill_super(
2619 goto fail_vnrele;
2620 }
2621
2622 - error = xfs_syncd_init(mp);
2623 - if (error)
2624 - goto fail_vnrele;
2625 -
2626 - xfs_inode_shrinker_register(mp);
2627 -
2628 return 0;
2629
2630 + out_syncd_stop:
2631 + xfs_inode_shrinker_unregister(mp);
2632 + xfs_syncd_stop(mp);
2633 out_filestream_unmount:
2634 xfs_filestream_unmount(mp);
2635 out_free_sb:
2636 @@ -1608,6 +1619,9 @@ xfs_fs_fill_super(
2637 }
2638
2639 fail_unmount:
2640 + xfs_inode_shrinker_unregister(mp);
2641 + xfs_syncd_stop(mp);
2642 +
2643 /*
2644 * Blow away any referenced inode in the filestreams cache.
2645 * This can and will cause log traffic as inodes go inactive
2646 diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
2647 index 5ff1194..6724bf3 100644
2648 --- a/include/drm/drm_pciids.h
2649 +++ b/include/drm/drm_pciids.h
2650 @@ -458,6 +458,8 @@
2651 {0x1002, 0x9803, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PALM|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
2652 {0x1002, 0x9804, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PALM|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
2653 {0x1002, 0x9805, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PALM|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
2654 + {0x1002, 0x9806, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PALM|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
2655 + {0x1002, 0x9807, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PALM|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
2656 {0, 0, 0}
2657
2658 #define r128_PCI_IDS \
2659 diff --git a/include/linux/atmdev.h b/include/linux/atmdev.h
2660 index 475f8c4..381f4ce 100644
2661 --- a/include/linux/atmdev.h
2662 +++ b/include/linux/atmdev.h
2663 @@ -443,6 +443,7 @@ void atm_dev_signal_change(struct atm_dev *dev, char signal);
2664
2665 void vcc_insert_socket(struct sock *sk);
2666
2667 +void atm_dev_release_vccs(struct atm_dev *dev);
2668
2669 /*
2670 * This is approximately the algorithm used by alloc_skb.
2671 diff --git a/include/linux/ethtool.h b/include/linux/ethtool.h
2672 index a3c1874..a04b6ce 100644
2673 --- a/include/linux/ethtool.h
2674 +++ b/include/linux/ethtool.h
2675 @@ -591,6 +591,7 @@ int ethtool_op_set_ufo(struct net_device *dev, u32 data);
2676 u32 ethtool_op_get_flags(struct net_device *dev);
2677 int ethtool_op_set_flags(struct net_device *dev, u32 data, u32 supported);
2678 void ethtool_ntuple_flush(struct net_device *dev);
2679 +bool ethtool_invalid_flags(struct net_device *dev, u32 data, u32 supported);
2680
2681 /**
2682 * &ethtool_ops - Alter and report network device settings
2683 diff --git a/include/linux/pci.h b/include/linux/pci.h
2684 index 559d028..6002bca 100644
2685 --- a/include/linux/pci.h
2686 +++ b/include/linux/pci.h
2687 @@ -1002,12 +1002,11 @@ extern bool pcie_ports_auto;
2688 #endif
2689
2690 #ifndef CONFIG_PCIEASPM
2691 -static inline int pcie_aspm_enabled(void)
2692 -{
2693 - return 0;
2694 -}
2695 +static inline int pcie_aspm_enabled(void) { return 0; }
2696 +static inline bool pcie_aspm_support_enabled(void) { return false; }
2697 #else
2698 extern int pcie_aspm_enabled(void);
2699 +extern bool pcie_aspm_support_enabled(void);
2700 #endif
2701
2702 #ifdef CONFIG_PCIEAER
2703 diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
2704 index 85867dc..bfd36ff 100644
2705 --- a/include/scsi/scsi_device.h
2706 +++ b/include/scsi/scsi_device.h
2707 @@ -461,7 +461,7 @@ static inline int scsi_device_qas(struct scsi_device *sdev)
2708 }
2709 static inline int scsi_device_enclosure(struct scsi_device *sdev)
2710 {
2711 - return sdev->inquiry[6] & (1<<6);
2712 + return sdev->inquiry ? (sdev->inquiry[6] & (1<<6)) : 1;
2713 }
2714
2715 static inline int scsi_device_protection(struct scsi_device *sdev)
2716 diff --git a/include/sound/pcm.h b/include/sound/pcm.h
2717 index e731f8d..ec26781 100644
2718 --- a/include/sound/pcm.h
2719 +++ b/include/sound/pcm.h
2720 @@ -1030,9 +1030,7 @@ int snd_pcm_lib_mmap_iomem(struct snd_pcm_substream *substream, struct vm_area_s
2721 #define snd_pcm_lib_mmap_iomem NULL
2722 #endif
2723
2724 -int snd_pcm_lib_mmap_noncached(struct snd_pcm_substream *substream,
2725 - struct vm_area_struct *area);
2726 -#define snd_pcm_lib_mmap_vmalloc snd_pcm_lib_mmap_noncached
2727 +#define snd_pcm_lib_mmap_vmalloc NULL
2728
2729 static inline void snd_pcm_limit_isa_dma_size(int dma, size_t *max)
2730 {
2731 diff --git a/include/sound/soc-dapm.h b/include/sound/soc-dapm.h
2732 index 8031769..60f94fb 100644
2733 --- a/include/sound/soc-dapm.h
2734 +++ b/include/sound/soc-dapm.h
2735 @@ -45,25 +45,25 @@
2736 /* platform domain */
2737 #define SND_SOC_DAPM_INPUT(wname) \
2738 { .id = snd_soc_dapm_input, .name = wname, .kcontrols = NULL, \
2739 - .num_kcontrols = 0}
2740 + .num_kcontrols = 0, .reg = SND_SOC_NOPM }
2741 #define SND_SOC_DAPM_OUTPUT(wname) \
2742 { .id = snd_soc_dapm_output, .name = wname, .kcontrols = NULL, \
2743 - .num_kcontrols = 0}
2744 + .num_kcontrols = 0, .reg = SND_SOC_NOPM }
2745 #define SND_SOC_DAPM_MIC(wname, wevent) \
2746 { .id = snd_soc_dapm_mic, .name = wname, .kcontrols = NULL, \
2747 - .num_kcontrols = 0, .event = wevent, \
2748 + .num_kcontrols = 0, .reg = SND_SOC_NOPM, .event = wevent, \
2749 .event_flags = SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD}
2750 #define SND_SOC_DAPM_HP(wname, wevent) \
2751 { .id = snd_soc_dapm_hp, .name = wname, .kcontrols = NULL, \
2752 - .num_kcontrols = 0, .event = wevent, \
2753 + .num_kcontrols = 0, .reg = SND_SOC_NOPM, .event = wevent, \
2754 .event_flags = SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD}
2755 #define SND_SOC_DAPM_SPK(wname, wevent) \
2756 { .id = snd_soc_dapm_spk, .name = wname, .kcontrols = NULL, \
2757 - .num_kcontrols = 0, .event = wevent, \
2758 + .num_kcontrols = 0, .reg = SND_SOC_NOPM, .event = wevent, \
2759 .event_flags = SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD}
2760 #define SND_SOC_DAPM_LINE(wname, wevent) \
2761 { .id = snd_soc_dapm_line, .name = wname, .kcontrols = NULL, \
2762 - .num_kcontrols = 0, .event = wevent, \
2763 + .num_kcontrols = 0, .reg = SND_SOC_NOPM, .event = wevent, \
2764 .event_flags = SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD}
2765
2766 /* path domain */
2767 @@ -177,11 +177,11 @@
2768 /* events that are pre and post DAPM */
2769 #define SND_SOC_DAPM_PRE(wname, wevent) \
2770 { .id = snd_soc_dapm_pre, .name = wname, .kcontrols = NULL, \
2771 - .num_kcontrols = 0, .event = wevent, \
2772 + .num_kcontrols = 0, .reg = SND_SOC_NOPM, .event = wevent, \
2773 .event_flags = SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_PRE_PMD}
2774 #define SND_SOC_DAPM_POST(wname, wevent) \
2775 { .id = snd_soc_dapm_post, .name = wname, .kcontrols = NULL, \
2776 - .num_kcontrols = 0, .event = wevent, \
2777 + .num_kcontrols = 0, .reg = SND_SOC_NOPM, .event = wevent, \
2778 .event_flags = SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_POST_PMD}
2779
2780 /* stream domain */
2781 diff --git a/kernel/perf_event.c b/kernel/perf_event.c
2782 index ad02fea..b2536bd 100644
2783 --- a/kernel/perf_event.c
2784 +++ b/kernel/perf_event.c
2785 @@ -62,7 +62,8 @@ static struct srcu_struct pmus_srcu;
2786 */
2787 int sysctl_perf_event_paranoid __read_mostly = 1;
2788
2789 -int sysctl_perf_event_mlock __read_mostly = 512; /* 'free' kb per user */
2790 +/* Minimum for 512 kiB + 1 user control page */
2791 +int sysctl_perf_event_mlock __read_mostly = 512 + (PAGE_SIZE / 1024); /* 'free' kiB per user */
2792
2793 /*
2794 * max perf event sample rate
2795 @@ -5916,6 +5917,11 @@ SYSCALL_DEFINE5(perf_event_open,
2796 goto err_alloc;
2797 }
2798
2799 + if (task) {
2800 + put_task_struct(task);
2801 + task = NULL;
2802 + }
2803 +
2804 /*
2805 * Look up the group leader (we will attach this event to it):
2806 */
2807 diff --git a/kernel/signal.c b/kernel/signal.c
2808 index 3175186..bf11d269 100644
2809 --- a/kernel/signal.c
2810 +++ b/kernel/signal.c
2811 @@ -2423,7 +2423,7 @@ SYSCALL_DEFINE3(rt_sigqueueinfo, pid_t, pid, int, sig,
2812 /* Not even root can pretend to send signals from the kernel.
2813 * Nor can they impersonate a kill()/tgkill(), which adds source info.
2814 */
2815 - if (info.si_code != SI_QUEUE) {
2816 + if (info.si_code >= 0 || info.si_code == SI_TKILL) {
2817 /* We used to allow any < 0 si_code */
2818 WARN_ON_ONCE(info.si_code < 0);
2819 return -EPERM;
2820 @@ -2443,7 +2443,7 @@ long do_rt_tgsigqueueinfo(pid_t tgid, pid_t pid, int sig, siginfo_t *info)
2821 /* Not even root can pretend to send signals from the kernel.
2822 * Nor can they impersonate a kill()/tgkill(), which adds source info.
2823 */
2824 - if (info->si_code != SI_QUEUE) {
2825 + if (info->si_code >= 0 || info->si_code == SI_TKILL) {
2826 /* We used to allow any < 0 si_code */
2827 WARN_ON_ONCE(info->si_code < 0);
2828 return -EPERM;
2829 diff --git a/mm/mremap.c b/mm/mremap.c
2830 index 1de98d4..a7c1f9f 100644
2831 --- a/mm/mremap.c
2832 +++ b/mm/mremap.c
2833 @@ -277,9 +277,16 @@ static struct vm_area_struct *vma_to_resize(unsigned long addr,
2834 if (old_len > vma->vm_end - addr)
2835 goto Efault;
2836
2837 - if (vma->vm_flags & (VM_DONTEXPAND | VM_PFNMAP)) {
2838 - if (new_len > old_len)
2839 + /* Need to be careful about a growing mapping */
2840 + if (new_len > old_len) {
2841 + unsigned long pgoff;
2842 +
2843 + if (vma->vm_flags & (VM_DONTEXPAND | VM_PFNMAP))
2844 goto Efault;
2845 + pgoff = (addr - vma->vm_start) >> PAGE_SHIFT;
2846 + pgoff += vma->vm_pgoff;
2847 + if (pgoff + (new_len >> PAGE_SHIFT) < pgoff)
2848 + goto Einval;
2849 }
2850
2851 if (vma->vm_flags & VM_LOCKED) {
2852 diff --git a/net/atm/common.c b/net/atm/common.c
2853 index 1b9c52a..22b963d 100644
2854 --- a/net/atm/common.c
2855 +++ b/net/atm/common.c
2856 @@ -252,6 +252,7 @@ void atm_dev_release_vccs(struct atm_dev *dev)
2857 }
2858 write_unlock_irq(&vcc_sklist_lock);
2859 }
2860 +EXPORT_SYMBOL(atm_dev_release_vccs);
2861
2862 static int adjust_tp(struct atm_trafprm *tp, unsigned char aal)
2863 {
2864 diff --git a/net/bluetooth/bnep/sock.c b/net/bluetooth/bnep/sock.c
2865 index 2862f53..d935da7 100644
2866 --- a/net/bluetooth/bnep/sock.c
2867 +++ b/net/bluetooth/bnep/sock.c
2868 @@ -88,6 +88,7 @@ static int bnep_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long
2869 sockfd_put(nsock);
2870 return -EBADFD;
2871 }
2872 + ca.device[sizeof(ca.device)-1] = 0;
2873
2874 err = bnep_add_connection(&ca, nsock);
2875 if (!err) {
2876 diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
2877 index 960c6d1..926ed39 100644
2878 --- a/net/bluetooth/sco.c
2879 +++ b/net/bluetooth/sco.c
2880 @@ -703,6 +703,7 @@ static int sco_sock_getsockopt_old(struct socket *sock, int optname, char __user
2881 break;
2882 }
2883
2884 + memset(&cinfo, 0, sizeof(cinfo));
2885 cinfo.hci_handle = sco_pi(sk)->conn->hcon->handle;
2886 memcpy(cinfo.dev_class, sco_pi(sk)->conn->hcon->dev_class, 3);
2887
2888 diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
2889 index 16df053..47acf4a 100644
2890 --- a/net/bridge/netfilter/ebtables.c
2891 +++ b/net/bridge/netfilter/ebtables.c
2892 @@ -1107,6 +1107,8 @@ static int do_replace(struct net *net, const void __user *user,
2893 if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
2894 return -ENOMEM;
2895
2896 + tmp.name[sizeof(tmp.name) - 1] = 0;
2897 +
2898 countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;
2899 newinfo = vmalloc(sizeof(*newinfo) + countersize);
2900 if (!newinfo)
2901 diff --git a/net/core/ethtool.c b/net/core/ethtool.c
2902 index ff23029..6c7c610 100644
2903 --- a/net/core/ethtool.c
2904 +++ b/net/core/ethtool.c
2905 @@ -146,9 +146,24 @@ u32 ethtool_op_get_flags(struct net_device *dev)
2906 }
2907 EXPORT_SYMBOL(ethtool_op_get_flags);
2908
2909 +/* Check if device can enable (or disable) particular feature coded in "data"
2910 + * argument. Flags "supported" describe features that can be toggled by device.
2911 + * If feature can not be toggled, it state (enabled or disabled) must match
2912 + * hardcoded device features state, otherwise flags are marked as invalid.
2913 + */
2914 +bool ethtool_invalid_flags(struct net_device *dev, u32 data, u32 supported)
2915 +{
2916 + u32 features = dev->features & flags_dup_features;
2917 + /* "data" can contain only flags_dup_features bits,
2918 + * see __ethtool_set_flags */
2919 +
2920 + return (features & ~supported) != (data & ~supported);
2921 +}
2922 +EXPORT_SYMBOL(ethtool_invalid_flags);
2923 +
2924 int ethtool_op_set_flags(struct net_device *dev, u32 data, u32 supported)
2925 {
2926 - if (data & ~supported)
2927 + if (ethtool_invalid_flags(dev, data, supported))
2928 return -EINVAL;
2929
2930 dev->features = ((dev->features & ~flags_dup_features) |
2931 diff --git a/net/econet/af_econet.c b/net/econet/af_econet.c
2932 index 0c28263..116d3fd 100644
2933 --- a/net/econet/af_econet.c
2934 +++ b/net/econet/af_econet.c
2935 @@ -435,10 +435,10 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
2936 udpdest.sin_addr.s_addr = htonl(network | addr.station);
2937 }
2938
2939 + memset(&ah, 0, sizeof(ah));
2940 ah.port = port;
2941 ah.cb = cb & 0x7f;
2942 ah.code = 2; /* magic */
2943 - ah.pad = 0;
2944
2945 /* tack our header on the front of the iovec */
2946 size = sizeof(struct aunhdr);
2947 diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
2948 index e855fff..6d79aa1 100644
2949 --- a/net/ipv4/netfilter/arp_tables.c
2950 +++ b/net/ipv4/netfilter/arp_tables.c
2951 @@ -1065,6 +1065,7 @@ static int do_replace(struct net *net, const void __user *user,
2952 /* overflow check */
2953 if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
2954 return -ENOMEM;
2955 + tmp.name[sizeof(tmp.name)-1] = 0;
2956
2957 newinfo = xt_alloc_table_info(tmp.size);
2958 if (!newinfo)
2959 @@ -1486,6 +1487,7 @@ static int compat_do_replace(struct net *net, void __user *user,
2960 return -ENOMEM;
2961 if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
2962 return -ENOMEM;
2963 + tmp.name[sizeof(tmp.name)-1] = 0;
2964
2965 newinfo = xt_alloc_table_info(tmp.size);
2966 if (!newinfo)
2967 @@ -1738,6 +1740,7 @@ static int do_arpt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len
2968 ret = -EFAULT;
2969 break;
2970 }
2971 + rev.name[sizeof(rev.name)-1] = 0;
2972
2973 try_then_request_module(xt_find_revision(NFPROTO_ARP, rev.name,
2974 rev.revision, 1, &ret),
2975 diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
2976 index 652efea..92fb4c5 100644
2977 --- a/net/ipv4/netfilter/ip_tables.c
2978 +++ b/net/ipv4/netfilter/ip_tables.c
2979 @@ -387,7 +387,7 @@ ipt_do_table(struct sk_buff *skb,
2980 verdict = (unsigned)(-v) - 1;
2981 break;
2982 }
2983 - if (*stackptr == 0) {
2984 + if (*stackptr <= origptr) {
2985 e = get_entry(table_base,
2986 private->underflow[hook]);
2987 pr_debug("Underflow (this is normal) "
2988 @@ -427,10 +427,10 @@ ipt_do_table(struct sk_buff *skb,
2989 /* Verdict */
2990 break;
2991 } while (!acpar.hotdrop);
2992 - xt_info_rdunlock_bh();
2993 pr_debug("Exiting %s; resetting sp from %u to %u\n",
2994 __func__, *stackptr, origptr);
2995 *stackptr = origptr;
2996 + xt_info_rdunlock_bh();
2997 #ifdef DEBUG_ALLOW_ALL
2998 return NF_ACCEPT;
2999 #else
3000 @@ -1261,6 +1261,7 @@ do_replace(struct net *net, const void __user *user, unsigned int len)
3001 /* overflow check */
3002 if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
3003 return -ENOMEM;
3004 + tmp.name[sizeof(tmp.name)-1] = 0;
3005
3006 newinfo = xt_alloc_table_info(tmp.size);
3007 if (!newinfo)
3008 @@ -1805,6 +1806,7 @@ compat_do_replace(struct net *net, void __user *user, unsigned int len)
3009 return -ENOMEM;
3010 if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
3011 return -ENOMEM;
3012 + tmp.name[sizeof(tmp.name)-1] = 0;
3013
3014 newinfo = xt_alloc_table_info(tmp.size);
3015 if (!newinfo)
3016 @@ -2034,6 +2036,7 @@ do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
3017 ret = -EFAULT;
3018 break;
3019 }
3020 + rev.name[sizeof(rev.name)-1] = 0;
3021
3022 if (cmd == IPT_SO_GET_REVISION_TARGET)
3023 target = 1;
3024 diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
3025 index 1e26a48..af7dec6 100644
3026 --- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
3027 +++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
3028 @@ -669,8 +669,11 @@ static ssize_t clusterip_proc_write(struct file *file, const char __user *input,
3029 char buffer[PROC_WRITELEN+1];
3030 unsigned long nodenum;
3031
3032 - if (copy_from_user(buffer, input, PROC_WRITELEN))
3033 + if (size > PROC_WRITELEN)
3034 + return -EIO;
3035 + if (copy_from_user(buffer, input, size))
3036 return -EFAULT;
3037 + buffer[size] = 0;
3038
3039 if (*buffer == '+') {
3040 nodenum = simple_strtoul(buffer+1, NULL, 10);
3041 diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
3042 index 7d227c6..eadafbf 100644
3043 --- a/net/ipv6/netfilter/ip6_tables.c
3044 +++ b/net/ipv6/netfilter/ip6_tables.c
3045 @@ -410,7 +410,7 @@ ip6t_do_table(struct sk_buff *skb,
3046 verdict = (unsigned)(-v) - 1;
3047 break;
3048 }
3049 - if (*stackptr == 0)
3050 + if (*stackptr <= origptr)
3051 e = get_entry(table_base,
3052 private->underflow[hook]);
3053 else
3054 @@ -441,8 +441,8 @@ ip6t_do_table(struct sk_buff *skb,
3055 break;
3056 } while (!acpar.hotdrop);
3057
3058 - xt_info_rdunlock_bh();
3059 *stackptr = origptr;
3060 + xt_info_rdunlock_bh();
3061
3062 #ifdef DEBUG_ALLOW_ALL
3063 return NF_ACCEPT;
3064 @@ -1274,6 +1274,7 @@ do_replace(struct net *net, const void __user *user, unsigned int len)
3065 /* overflow check */
3066 if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
3067 return -ENOMEM;
3068 + tmp.name[sizeof(tmp.name)-1] = 0;
3069
3070 newinfo = xt_alloc_table_info(tmp.size);
3071 if (!newinfo)
3072 @@ -1820,6 +1821,7 @@ compat_do_replace(struct net *net, void __user *user, unsigned int len)
3073 return -ENOMEM;
3074 if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
3075 return -ENOMEM;
3076 + tmp.name[sizeof(tmp.name)-1] = 0;
3077
3078 newinfo = xt_alloc_table_info(tmp.size);
3079 if (!newinfo)
3080 @@ -2049,6 +2051,7 @@ do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
3081 ret = -EFAULT;
3082 break;
3083 }
3084 + rev.name[sizeof(rev.name)-1] = 0;
3085
3086 if (cmd == IP6T_SO_GET_REVISION_TARGET)
3087 target = 1;
3088 diff --git a/net/irda/iriap.c b/net/irda/iriap.c
3089 index 5b743bd..3647753 100644
3090 --- a/net/irda/iriap.c
3091 +++ b/net/irda/iriap.c
3092 @@ -656,10 +656,16 @@ static void iriap_getvaluebyclass_indication(struct iriap_cb *self,
3093 n = 1;
3094
3095 name_len = fp[n++];
3096 +
3097 + IRDA_ASSERT(name_len < IAS_MAX_CLASSNAME + 1, return;);
3098 +
3099 memcpy(name, fp+n, name_len); n+=name_len;
3100 name[name_len] = '\0';
3101
3102 attr_len = fp[n++];
3103 +
3104 + IRDA_ASSERT(attr_len < IAS_MAX_ATTRIBNAME + 1, return;);
3105 +
3106 memcpy(attr, fp+n, attr_len); n+=attr_len;
3107 attr[attr_len] = '\0';
3108
3109 diff --git a/net/irda/irnet/irnet_ppp.c b/net/irda/irnet/irnet_ppp.c
3110 index 7c567b8..2bb2beb 100644
3111 --- a/net/irda/irnet/irnet_ppp.c
3112 +++ b/net/irda/irnet/irnet_ppp.c
3113 @@ -105,6 +105,9 @@ irnet_ctrl_write(irnet_socket * ap,
3114 while(isspace(start[length - 1]))
3115 length--;
3116
3117 + DABORT(length < 5 || length > NICKNAME_MAX_LEN + 5,
3118 + -EINVAL, CTRL_ERROR, "Invalid nickname.\n");
3119 +
3120 /* Copy the name for later reuse */
3121 memcpy(ap->rname, start + 5, length - 5);
3122 ap->rname[length - 5] = '\0';
3123 diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
3124 index 165a451..cac35ff 100644
3125 --- a/net/mac80211/rc80211_minstrel_ht.c
3126 +++ b/net/mac80211/rc80211_minstrel_ht.c
3127 @@ -639,18 +639,14 @@ minstrel_ht_update_caps(void *priv, struct ieee80211_supported_band *sband,
3128 struct ieee80211_mcs_info *mcs = &sta->ht_cap.mcs;
3129 struct ieee80211_local *local = hw_to_local(mp->hw);
3130 u16 sta_cap = sta->ht_cap.cap;
3131 + int n_supported = 0;
3132 int ack_dur;
3133 int stbc;
3134 int i;
3135
3136 /* fall back to the old minstrel for legacy stations */
3137 - if (!sta->ht_cap.ht_supported) {
3138 - msp->is_ht = false;
3139 - memset(&msp->legacy, 0, sizeof(msp->legacy));
3140 - msp->legacy.r = msp->ratelist;
3141 - msp->legacy.sample_table = msp->sample_table;
3142 - return mac80211_minstrel.rate_init(priv, sband, sta, &msp->legacy);
3143 - }
3144 + if (!sta->ht_cap.ht_supported)
3145 + goto use_legacy;
3146
3147 BUILD_BUG_ON(ARRAY_SIZE(minstrel_mcs_groups) !=
3148 MINSTREL_MAX_STREAMS * MINSTREL_STREAM_GROUPS);
3149 @@ -705,7 +701,22 @@ minstrel_ht_update_caps(void *priv, struct ieee80211_supported_band *sband,
3150
3151 mi->groups[i].supported =
3152 mcs->rx_mask[minstrel_mcs_groups[i].streams - 1];
3153 +
3154 + if (mi->groups[i].supported)
3155 + n_supported++;
3156 }
3157 +
3158 + if (!n_supported)
3159 + goto use_legacy;
3160 +
3161 + return;
3162 +
3163 +use_legacy:
3164 + msp->is_ht = false;
3165 + memset(&msp->legacy, 0, sizeof(msp->legacy));
3166 + msp->legacy.r = msp->ratelist;
3167 + msp->legacy.sample_table = msp->sample_table;
3168 + return mac80211_minstrel.rate_init(priv, sband, sta, &msp->legacy);
3169 }
3170
3171 static void
3172 diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
3173 index c426504..604216e 100644
3174 --- a/net/mac80211/sta_info.c
3175 +++ b/net/mac80211/sta_info.c
3176 @@ -243,6 +243,7 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
3177 memcpy(sta->sta.addr, addr, ETH_ALEN);
3178 sta->local = local;
3179 sta->sdata = sdata;
3180 + sta->last_rx = jiffies;
3181
3182 ewma_init(&sta->avg_signal, 1024, 8);
3183
3184 diff --git a/net/netfilter/nf_conntrack_h323_asn1.c b/net/netfilter/nf_conntrack_h323_asn1.c
3185 index 8678823..bcd5ed6 100644
3186 --- a/net/netfilter/nf_conntrack_h323_asn1.c
3187 +++ b/net/netfilter/nf_conntrack_h323_asn1.c
3188 @@ -631,7 +631,7 @@ static int decode_seqof(bitstr_t *bs, const struct field_t *f,
3189 CHECK_BOUND(bs, 2);
3190 count = *bs->cur++;
3191 count <<= 8;
3192 - count = *bs->cur++;
3193 + count += *bs->cur++;
3194 break;
3195 case SEMI:
3196 BYTE_ALIGN(bs);
3197 diff --git a/net/rose/rose_subr.c b/net/rose/rose_subr.c
3198 index 1734abb..174d51c 100644
3199 --- a/net/rose/rose_subr.c
3200 +++ b/net/rose/rose_subr.c
3201 @@ -290,10 +290,15 @@ static int rose_parse_national(unsigned char *p, struct rose_facilities_struct *
3202 facilities->source_ndigis = 0;
3203 facilities->dest_ndigis = 0;
3204 for (pt = p + 2, lg = 0 ; lg < l ; pt += AX25_ADDR_LEN, lg += AX25_ADDR_LEN) {
3205 - if (pt[6] & AX25_HBIT)
3206 + if (pt[6] & AX25_HBIT) {
3207 + if (facilities->dest_ndigis >= ROSE_MAX_DIGIS)
3208 + return -1;
3209 memcpy(&facilities->dest_digis[facilities->dest_ndigis++], pt, AX25_ADDR_LEN);
3210 - else
3211 + } else {
3212 + if (facilities->source_ndigis >= ROSE_MAX_DIGIS)
3213 + return -1;
3214 memcpy(&facilities->source_digis[facilities->source_ndigis++], pt, AX25_ADDR_LEN);
3215 + }
3216 }
3217 }
3218 p += l + 2;
3219 @@ -333,6 +338,11 @@ static int rose_parse_ccitt(unsigned char *p, struct rose_facilities_struct *fac
3220
3221 case 0xC0:
3222 l = p[1];
3223 +
3224 + /* Prevent overflows*/
3225 + if (l < 10 || l > 20)
3226 + return -1;
3227 +
3228 if (*p == FAC_CCITT_DEST_NSAP) {
3229 memcpy(&facilities->source_addr, p + 7, ROSE_ADDR_LEN);
3230 memcpy(callsign, p + 12, l - 10);
3231 @@ -373,12 +383,16 @@ int rose_parse_facilities(unsigned char *p,
3232 switch (*p) {
3233 case FAC_NATIONAL: /* National */
3234 len = rose_parse_national(p + 1, facilities, facilities_len - 1);
3235 + if (len < 0)
3236 + return 0;
3237 facilities_len -= len + 1;
3238 p += len + 1;
3239 break;
3240
3241 case FAC_CCITT: /* CCITT */
3242 len = rose_parse_ccitt(p + 1, facilities, facilities_len - 1);
3243 + if (len < 0)
3244 + return 0;
3245 facilities_len -= len + 1;
3246 p += len + 1;
3247 break;
3248 diff --git a/net/sunrpc/auth_gss/gss_krb5_mech.c b/net/sunrpc/auth_gss/gss_krb5_mech.c
3249 index f375dec..778e5df 100644
3250 --- a/net/sunrpc/auth_gss/gss_krb5_mech.c
3251 +++ b/net/sunrpc/auth_gss/gss_krb5_mech.c
3252 @@ -427,7 +427,7 @@ static int
3253 context_derive_keys_rc4(struct krb5_ctx *ctx)
3254 {
3255 struct crypto_hash *hmac;
3256 - static const char sigkeyconstant[] = "signaturekey";
3257 + char sigkeyconstant[] = "signaturekey";
3258 int slen = strlen(sigkeyconstant) + 1; /* include null terminator */
3259 struct hash_desc desc;
3260 struct scatterlist sg[1];
3261 diff --git a/sound/core/init.c b/sound/core/init.c
3262 index 3e65da2..a0080aa 100644
3263 --- a/sound/core/init.c
3264 +++ b/sound/core/init.c
3265 @@ -848,6 +848,7 @@ int snd_card_file_add(struct snd_card *card, struct file *file)
3266 return -ENOMEM;
3267 mfile->file = file;
3268 mfile->disconnected_f_op = NULL;
3269 + INIT_LIST_HEAD(&mfile->shutdown_list);
3270 spin_lock(&card->files_lock);
3271 if (card->shutdown) {
3272 spin_unlock(&card->files_lock);
3273 @@ -883,6 +884,9 @@ int snd_card_file_remove(struct snd_card *card, struct file *file)
3274 list_for_each_entry(mfile, &card->files_list, list) {
3275 if (mfile->file == file) {
3276 list_del(&mfile->list);
3277 + spin_lock(&shutdown_lock);
3278 + list_del(&mfile->shutdown_list);
3279 + spin_unlock(&shutdown_lock);
3280 if (mfile->disconnected_f_op)
3281 fops_put(mfile->disconnected_f_op);
3282 found = mfile;
3283 diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
3284 index a82e3756..64449cb 100644
3285 --- a/sound/core/pcm_lib.c
3286 +++ b/sound/core/pcm_lib.c
3287 @@ -375,6 +375,7 @@ static int snd_pcm_update_hw_ptr0(struct snd_pcm_substream *substream,
3288 }
3289
3290 if (runtime->no_period_wakeup) {
3291 + snd_pcm_sframes_t xrun_threshold;
3292 /*
3293 * Without regular period interrupts, we have to check
3294 * the elapsed time to detect xruns.
3295 @@ -383,7 +384,8 @@ static int snd_pcm_update_hw_ptr0(struct snd_pcm_substream *substream,
3296 if (jdelta < runtime->hw_ptr_buffer_jiffies / 2)
3297 goto no_delta_check;
3298 hdelta = jdelta - delta * HZ / runtime->rate;
3299 - while (hdelta > runtime->hw_ptr_buffer_jiffies / 2 + 1) {
3300 + xrun_threshold = runtime->hw_ptr_buffer_jiffies / 2 + 1;
3301 + while (hdelta > xrun_threshold) {
3302 delta += runtime->buffer_size;
3303 hw_base += runtime->buffer_size;
3304 if (hw_base >= runtime->boundary)
3305 diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
3306 index 4be45e7..6848dd9 100644
3307 --- a/sound/core/pcm_native.c
3308 +++ b/sound/core/pcm_native.c
3309 @@ -3201,15 +3201,6 @@ int snd_pcm_lib_mmap_iomem(struct snd_pcm_substream *substream,
3310 EXPORT_SYMBOL(snd_pcm_lib_mmap_iomem);
3311 #endif /* SNDRV_PCM_INFO_MMAP */
3312
3313 -/* mmap callback with pgprot_noncached */
3314 -int snd_pcm_lib_mmap_noncached(struct snd_pcm_substream *substream,
3315 - struct vm_area_struct *area)
3316 -{
3317 - area->vm_page_prot = pgprot_noncached(area->vm_page_prot);
3318 - return snd_pcm_default_mmap(substream, area);
3319 -}
3320 -EXPORT_SYMBOL(snd_pcm_lib_mmap_noncached);
3321 -
3322 /*
3323 * mmap DMA buffer
3324 */
3325 diff --git a/sound/oss/dev_table.h b/sound/oss/dev_table.h
3326 index b7617be..0199a31 100644
3327 --- a/sound/oss/dev_table.h
3328 +++ b/sound/oss/dev_table.h
3329 @@ -271,7 +271,7 @@ struct synth_operations
3330 void (*reset) (int dev);
3331 void (*hw_control) (int dev, unsigned char *event);
3332 int (*load_patch) (int dev, int format, const char __user *addr,
3333 - int offs, int count, int pmgr_flag);
3334 + int count, int pmgr_flag);
3335 void (*aftertouch) (int dev, int voice, int pressure);
3336 void (*controller) (int dev, int voice, int ctrl_num, int value);
3337 void (*panning) (int dev, int voice, int value);
3338 diff --git a/sound/oss/midi_synth.c b/sound/oss/midi_synth.c
3339 index 3c09374..2292c23 100644
3340 --- a/sound/oss/midi_synth.c
3341 +++ b/sound/oss/midi_synth.c
3342 @@ -476,7 +476,7 @@ EXPORT_SYMBOL(midi_synth_hw_control);
3343
3344 int
3345 midi_synth_load_patch(int dev, int format, const char __user *addr,
3346 - int offs, int count, int pmgr_flag)
3347 + int count, int pmgr_flag)
3348 {
3349 int orig_dev = synth_devs[dev]->midi_dev;
3350
3351 @@ -491,33 +491,29 @@ midi_synth_load_patch(int dev, int format, const char __user *addr,
3352 if (!prefix_cmd(orig_dev, 0xf0))
3353 return 0;
3354
3355 + /* Invalid patch format */
3356 if (format != SYSEX_PATCH)
3357 - {
3358 -/* printk("MIDI Error: Invalid patch format (key) 0x%x\n", format);*/
3359 return -EINVAL;
3360 - }
3361 +
3362 + /* Patch header too short */
3363 if (count < hdr_size)
3364 - {
3365 -/* printk("MIDI Error: Patch header too short\n");*/
3366 return -EINVAL;
3367 - }
3368 +
3369 count -= hdr_size;
3370
3371 /*
3372 - * Copy the header from user space but ignore the first bytes which have
3373 - * been transferred already.
3374 + * Copy the header from user space
3375 */
3376
3377 - if(copy_from_user(&((char *) &sysex)[offs], &(addr)[offs], hdr_size - offs))
3378 + if (copy_from_user(&sysex, addr, hdr_size))
3379 return -EFAULT;
3380 -
3381 - if (count < sysex.len)
3382 - {
3383 -/* printk(KERN_WARNING "MIDI Warning: Sysex record too short (%d<%d)\n", count, (int) sysex.len);*/
3384 +
3385 + /* Sysex record too short */
3386 + if ((unsigned)count < (unsigned)sysex.len)
3387 sysex.len = count;
3388 - }
3389 - left = sysex.len;
3390 - src_offs = 0;
3391 +
3392 + left = sysex.len;
3393 + src_offs = 0;
3394
3395 for (i = 0; i < left && !signal_pending(current); i++)
3396 {
3397 diff --git a/sound/oss/midi_synth.h b/sound/oss/midi_synth.h
3398 index 6bc9d00..b64ddd6 100644
3399 --- a/sound/oss/midi_synth.h
3400 +++ b/sound/oss/midi_synth.h
3401 @@ -8,7 +8,7 @@ int midi_synth_open (int dev, int mode);
3402 void midi_synth_close (int dev);
3403 void midi_synth_hw_control (int dev, unsigned char *event);
3404 int midi_synth_load_patch (int dev, int format, const char __user * addr,
3405 - int offs, int count, int pmgr_flag);
3406 + int count, int pmgr_flag);
3407 void midi_synth_panning (int dev, int channel, int pressure);
3408 void midi_synth_aftertouch (int dev, int channel, int pressure);
3409 void midi_synth_controller (int dev, int channel, int ctrl_num, int value);
3410 diff --git a/sound/oss/opl3.c b/sound/oss/opl3.c
3411 index 938c48c..407cd67 100644
3412 --- a/sound/oss/opl3.c
3413 +++ b/sound/oss/opl3.c
3414 @@ -820,7 +820,7 @@ static void opl3_hw_control(int dev, unsigned char *event)
3415 }
3416
3417 static int opl3_load_patch(int dev, int format, const char __user *addr,
3418 - int offs, int count, int pmgr_flag)
3419 + int count, int pmgr_flag)
3420 {
3421 struct sbi_instrument ins;
3422
3423 @@ -830,11 +830,7 @@ static int opl3_load_patch(int dev, int format, const char __user *addr,
3424 return -EINVAL;
3425 }
3426
3427 - /*
3428 - * What the fuck is going on here? We leave junk in the beginning
3429 - * of ins and then check the field pretty close to that beginning?
3430 - */
3431 - if(copy_from_user(&((char *) &ins)[offs], addr + offs, sizeof(ins) - offs))
3432 + if (copy_from_user(&ins, addr, sizeof(ins)))
3433 return -EFAULT;
3434
3435 if (ins.channel < 0 || ins.channel >= SBFM_MAXINSTR)
3436 @@ -849,6 +845,10 @@ static int opl3_load_patch(int dev, int format, const char __user *addr,
3437
3438 static void opl3_panning(int dev, int voice, int value)
3439 {
3440 +
3441 + if (voice < 0 || voice >= devc->nr_voice)
3442 + return;
3443 +
3444 devc->voc[voice].panning = value;
3445 }
3446
3447 @@ -1066,8 +1066,15 @@ static int opl3_alloc_voice(int dev, int chn, int note, struct voice_alloc_info
3448
3449 static void opl3_setup_voice(int dev, int voice, int chn)
3450 {
3451 - struct channel_info *info =
3452 - &synth_devs[dev]->chn_info[chn];
3453 + struct channel_info *info;
3454 +
3455 + if (voice < 0 || voice >= devc->nr_voice)
3456 + return;
3457 +
3458 + if (chn < 0 || chn > 15)
3459 + return;
3460 +
3461 + info = &synth_devs[dev]->chn_info[chn];
3462
3463 opl3_set_instr(dev, voice, info->pgm_num);
3464
3465 diff --git a/sound/oss/sequencer.c b/sound/oss/sequencer.c
3466 index 5ea1098..30bcfe4 100644
3467 --- a/sound/oss/sequencer.c
3468 +++ b/sound/oss/sequencer.c
3469 @@ -241,7 +241,7 @@ int sequencer_write(int dev, struct file *file, const char __user *buf, int coun
3470 return -ENXIO;
3471
3472 fmt = (*(short *) &event_rec[0]) & 0xffff;
3473 - err = synth_devs[dev]->load_patch(dev, fmt, buf, p + 4, c, 0);
3474 + err = synth_devs[dev]->load_patch(dev, fmt, buf + p, c, 0);
3475 if (err < 0)
3476 return err;
3477
3478 diff --git a/sound/pci/ens1370.c b/sound/pci/ens1370.c
3479 index 537cfba..863eafe 100644
3480 --- a/sound/pci/ens1370.c
3481 +++ b/sound/pci/ens1370.c
3482 @@ -229,6 +229,7 @@ MODULE_PARM_DESC(lineio, "Line In to Rear Out (0 = auto, 1 = force).");
3483 #define ES_REG_1371_CODEC 0x14 /* W/R: Codec Read/Write register address */
3484 #define ES_1371_CODEC_RDY (1<<31) /* codec ready */
3485 #define ES_1371_CODEC_WIP (1<<30) /* codec register access in progress */
3486 +#define EV_1938_CODEC_MAGIC (1<<26)
3487 #define ES_1371_CODEC_PIRD (1<<23) /* codec read/write select register */
3488 #define ES_1371_CODEC_WRITE(a,d) ((((a)&0x7f)<<16)|(((d)&0xffff)<<0))
3489 #define ES_1371_CODEC_READS(a) ((((a)&0x7f)<<16)|ES_1371_CODEC_PIRD)
3490 @@ -603,12 +604,18 @@ static void snd_es1370_codec_write(struct snd_ak4531 *ak4531,
3491
3492 #ifdef CHIP1371
3493
3494 +static inline bool is_ev1938(struct ensoniq *ensoniq)
3495 +{
3496 + return ensoniq->pci->device == 0x8938;
3497 +}
3498 +
3499 static void snd_es1371_codec_write(struct snd_ac97 *ac97,
3500 unsigned short reg, unsigned short val)
3501 {
3502 struct ensoniq *ensoniq = ac97->private_data;
3503 - unsigned int t, x;
3504 + unsigned int t, x, flag;
3505
3506 + flag = is_ev1938(ensoniq) ? EV_1938_CODEC_MAGIC : 0;
3507 mutex_lock(&ensoniq->src_mutex);
3508 for (t = 0; t < POLL_COUNT; t++) {
3509 if (!(inl(ES_REG(ensoniq, 1371_CODEC)) & ES_1371_CODEC_WIP)) {
3510 @@ -630,7 +637,8 @@ static void snd_es1371_codec_write(struct snd_ac97 *ac97,
3511 0x00010000)
3512 break;
3513 }
3514 - outl(ES_1371_CODEC_WRITE(reg, val), ES_REG(ensoniq, 1371_CODEC));
3515 + outl(ES_1371_CODEC_WRITE(reg, val) | flag,
3516 + ES_REG(ensoniq, 1371_CODEC));
3517 /* restore SRC reg */
3518 snd_es1371_wait_src_ready(ensoniq);
3519 outl(x, ES_REG(ensoniq, 1371_SMPRATE));
3520 @@ -647,8 +655,9 @@ static unsigned short snd_es1371_codec_read(struct snd_ac97 *ac97,
3521 unsigned short reg)
3522 {
3523 struct ensoniq *ensoniq = ac97->private_data;
3524 - unsigned int t, x, fail = 0;
3525 + unsigned int t, x, flag, fail = 0;
3526
3527 + flag = is_ev1938(ensoniq) ? EV_1938_CODEC_MAGIC : 0;
3528 __again:
3529 mutex_lock(&ensoniq->src_mutex);
3530 for (t = 0; t < POLL_COUNT; t++) {
3531 @@ -671,7 +680,8 @@ static unsigned short snd_es1371_codec_read(struct snd_ac97 *ac97,
3532 0x00010000)
3533 break;
3534 }
3535 - outl(ES_1371_CODEC_READS(reg), ES_REG(ensoniq, 1371_CODEC));
3536 + outl(ES_1371_CODEC_READS(reg) | flag,
3537 + ES_REG(ensoniq, 1371_CODEC));
3538 /* restore SRC reg */
3539 snd_es1371_wait_src_ready(ensoniq);
3540 outl(x, ES_REG(ensoniq, 1371_SMPRATE));
3541 @@ -683,6 +693,11 @@ static unsigned short snd_es1371_codec_read(struct snd_ac97 *ac97,
3542 /* now wait for the stinkin' data (RDY) */
3543 for (t = 0; t < POLL_COUNT; t++) {
3544 if ((x = inl(ES_REG(ensoniq, 1371_CODEC))) & ES_1371_CODEC_RDY) {
3545 + if (is_ev1938(ensoniq)) {
3546 + for (t = 0; t < 100; t++)
3547 + inl(ES_REG(ensoniq, CONTROL));
3548 + x = inl(ES_REG(ensoniq, 1371_CODEC));
3549 + }
3550 mutex_unlock(&ensoniq->src_mutex);
3551 return ES_1371_CODEC_READ(x);
3552 }
3553 diff --git a/sound/pci/hda/patch_analog.c b/sound/pci/hda/patch_analog.c
3554 index 8dabab7..7aee900 100644
3555 --- a/sound/pci/hda/patch_analog.c
3556 +++ b/sound/pci/hda/patch_analog.c
3557 @@ -4353,6 +4353,84 @@ static int ad1984a_thinkpad_init(struct hda_codec *codec)
3558 }
3559
3560 /*
3561 + * Precision R5500
3562 + * 0x12 - HP/line-out
3563 + * 0x13 - speaker (mono)
3564 + * 0x15 - mic-in
3565 + */
3566 +
3567 +static struct hda_verb ad1984a_precision_verbs[] = {
3568 + /* Unmute main output path */
3569 + {0x03, AC_VERB_SET_AMP_GAIN_MUTE, 0x27}, /* 0dB */
3570 + {0x21, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE + 0x1f}, /* 0dB */
3571 + {0x20, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_UNMUTE(5) + 0x17}, /* 0dB */
3572 + /* Analog mixer; mute as default */
3573 + {0x20, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(0)},
3574 + {0x20, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(1)},
3575 + {0x20, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(2)},
3576 + {0x20, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(3)},
3577 + {0x20, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(4)},
3578 + /* Select mic as input */
3579 + {0x0c, AC_VERB_SET_CONNECT_SEL, 0x1},
3580 + {0x0c, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE + 0x27}, /* 0dB */
3581 + /* Configure as mic */
3582 + {0x15, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_VREF80},
3583 + {0x15, AC_VERB_SET_AMP_GAIN_MUTE, 0x7002}, /* raise mic as default */
3584 + /* HP unmute */
3585 + {0x12, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE},
3586 + /* turn on EAPD */
3587 + {0x13, AC_VERB_SET_EAPD_BTLENABLE, 0x02},
3588 + /* unsolicited event for pin-sense */
3589 + {0x12, AC_VERB_SET_UNSOLICITED_ENABLE, AC_USRSP_EN | AD1884A_HP_EVENT},
3590 + { } /* end */
3591 +};
3592 +
3593 +static struct snd_kcontrol_new ad1984a_precision_mixers[] = {
3594 + HDA_CODEC_VOLUME("Master Playback Volume", 0x21, 0x0, HDA_OUTPUT),
3595 + HDA_CODEC_MUTE("Master Playback Switch", 0x21, 0x0, HDA_OUTPUT),
3596 + HDA_CODEC_VOLUME("PCM Playback Volume", 0x20, 0x5, HDA_INPUT),
3597 + HDA_CODEC_MUTE("PCM Playback Switch", 0x20, 0x5, HDA_INPUT),
3598 + HDA_CODEC_VOLUME("Mic Playback Volume", 0x20, 0x01, HDA_INPUT),
3599 + HDA_CODEC_MUTE("Mic Playback Switch", 0x20, 0x01, HDA_INPUT),
3600 + HDA_CODEC_VOLUME("Mic Boost Volume", 0x15, 0x0, HDA_INPUT),
3601 + HDA_CODEC_MUTE("Front Playback Switch", 0x12, 0x0, HDA_OUTPUT),
3602 + HDA_CODEC_VOLUME("Speaker Playback Volume", 0x13, 0x0, HDA_OUTPUT),
3603 + HDA_CODEC_VOLUME("Capture Volume", 0x0c, 0x0, HDA_OUTPUT),
3604 + HDA_CODEC_MUTE("Capture Switch", 0x0c, 0x0, HDA_OUTPUT),
3605 + { } /* end */
3606 +};
3607 +
3608 +
3609 +/* mute internal speaker if HP is plugged */
3610 +static void ad1984a_precision_automute(struct hda_codec *codec)
3611 +{
3612 + unsigned int present;
3613 +
3614 + present = snd_hda_jack_detect(codec, 0x12);
3615 + snd_hda_codec_amp_stereo(codec, 0x13, HDA_OUTPUT, 0,
3616 + HDA_AMP_MUTE, present ? HDA_AMP_MUTE : 0);
3617 +}
3618 +
3619 +
3620 +/* unsolicited event for HP jack sensing */
3621 +static void ad1984a_precision_unsol_event(struct hda_codec *codec,
3622 + unsigned int res)
3623 +{
3624 + if ((res >> 26) != AD1884A_HP_EVENT)
3625 + return;
3626 + ad1984a_precision_automute(codec);
3627 +}
3628 +
3629 +/* initialize jack-sensing, too */
3630 +static int ad1984a_precision_init(struct hda_codec *codec)
3631 +{
3632 + ad198x_init(codec);
3633 + ad1984a_precision_automute(codec);
3634 + return 0;
3635 +}
3636 +
3637 +
3638 +/*
3639 * HP Touchsmart
3640 * port-A (0x11) - front hp-out
3641 * port-B (0x14) - unused
3642 @@ -4481,6 +4559,7 @@ enum {
3643 AD1884A_MOBILE,
3644 AD1884A_THINKPAD,
3645 AD1984A_TOUCHSMART,
3646 + AD1984A_PRECISION,
3647 AD1884A_MODELS
3648 };
3649
3650 @@ -4490,9 +4569,11 @@ static const char * const ad1884a_models[AD1884A_MODELS] = {
3651 [AD1884A_MOBILE] = "mobile",
3652 [AD1884A_THINKPAD] = "thinkpad",
3653 [AD1984A_TOUCHSMART] = "touchsmart",
3654 + [AD1984A_PRECISION] = "precision",
3655 };
3656
3657 static struct snd_pci_quirk ad1884a_cfg_tbl[] = {
3658 + SND_PCI_QUIRK(0x1028, 0x04ac, "Precision R5500", AD1984A_PRECISION),
3659 SND_PCI_QUIRK(0x103c, 0x3030, "HP", AD1884A_MOBILE),
3660 SND_PCI_QUIRK(0x103c, 0x3037, "HP 2230s", AD1884A_LAPTOP),
3661 SND_PCI_QUIRK(0x103c, 0x3056, "HP", AD1884A_MOBILE),
3662 @@ -4586,6 +4667,14 @@ static int patch_ad1884a(struct hda_codec *codec)
3663 codec->patch_ops.unsol_event = ad1984a_thinkpad_unsol_event;
3664 codec->patch_ops.init = ad1984a_thinkpad_init;
3665 break;
3666 + case AD1984A_PRECISION:
3667 + spec->mixers[0] = ad1984a_precision_mixers;
3668 + spec->init_verbs[spec->num_init_verbs++] =
3669 + ad1984a_precision_verbs;
3670 + spec->multiout.dig_out_nid = 0;
3671 + codec->patch_ops.unsol_event = ad1984a_precision_unsol_event;
3672 + codec->patch_ops.init = ad1984a_precision_init;
3673 + break;
3674 case AD1984A_TOUCHSMART:
3675 spec->mixers[0] = ad1984a_touchsmart_mixers;
3676 spec->init_verbs[0] = ad1984a_touchsmart_verbs;
3677 diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
3678 index 4d5004e..e33d69e 100644
3679 --- a/sound/pci/hda/patch_conexant.c
3680 +++ b/sound/pci/hda/patch_conexant.c
3681 @@ -3130,6 +3130,8 @@ static struct snd_pci_quirk cxt5066_cfg_tbl[] = {
3682 SND_PCI_QUIRK(0x17aa, 0x21c5, "Thinkpad Edge 13", CXT5066_THINKPAD),
3683 SND_PCI_QUIRK(0x17aa, 0x21c6, "Thinkpad Edge 13", CXT5066_ASUS),
3684 SND_PCI_QUIRK(0x17aa, 0x215e, "Lenovo Thinkpad", CXT5066_THINKPAD),
3685 + SND_PCI_QUIRK(0x17aa, 0x21da, "Lenovo X220", CXT5066_THINKPAD),
3686 + SND_PCI_QUIRK(0x17aa, 0x21db, "Lenovo X220-tablet", CXT5066_THINKPAD),
3687 SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo G560", CXT5066_ASUS),
3688 SND_PCI_QUIRK_VENDOR(0x17aa, "Lenovo", CXT5066_IDEAPAD), /* Fallback for Lenovos without dock mic */
3689 {}
3690 diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
3691 index ec0fa2d..520f94a 100644
3692 --- a/sound/pci/hda/patch_hdmi.c
3693 +++ b/sound/pci/hda/patch_hdmi.c
3694 @@ -1276,6 +1276,39 @@ static int simple_playback_pcm_prepare(struct hda_pcm_stream *hinfo,
3695 stream_tag, format, substream);
3696 }
3697
3698 +static void nvhdmi_8ch_7x_set_info_frame_parameters(struct hda_codec *codec,
3699 + int channels)
3700 +{
3701 + unsigned int chanmask;
3702 + int chan = channels ? (channels - 1) : 1;
3703 +
3704 + switch (channels) {
3705 + default:
3706 + case 0:
3707 + case 2:
3708 + chanmask = 0x00;
3709 + break;
3710 + case 4:
3711 + chanmask = 0x08;
3712 + break;
3713 + case 6:
3714 + chanmask = 0x0b;
3715 + break;
3716 + case 8:
3717 + chanmask = 0x13;
3718 + break;
3719 + }
3720 +
3721 + /* Set the audio infoframe channel allocation and checksum fields. The
3722 + * channel count is computed implicitly by the hardware. */
3723 + snd_hda_codec_write(codec, 0x1, 0,
3724 + Nv_VERB_SET_Channel_Allocation, chanmask);
3725 +
3726 + snd_hda_codec_write(codec, 0x1, 0,
3727 + Nv_VERB_SET_Info_Frame_Checksum,
3728 + (0x71 - chan - chanmask));
3729 +}
3730 +
3731 static int nvhdmi_8ch_7x_pcm_close(struct hda_pcm_stream *hinfo,
3732 struct hda_codec *codec,
3733 struct snd_pcm_substream *substream)
3734 @@ -1294,6 +1327,10 @@ static int nvhdmi_8ch_7x_pcm_close(struct hda_pcm_stream *hinfo,
3735 AC_VERB_SET_STREAM_FORMAT, 0);
3736 }
3737
3738 + /* The audio hardware sends a channel count of 0x7 (8ch) when all the
3739 + * streams are disabled. */
3740 + nvhdmi_8ch_7x_set_info_frame_parameters(codec, 8);
3741 +
3742 return snd_hda_multi_out_dig_close(codec, &spec->multiout);
3743 }
3744
3745 @@ -1304,37 +1341,16 @@ static int nvhdmi_8ch_7x_pcm_prepare(struct hda_pcm_stream *hinfo,
3746 struct snd_pcm_substream *substream)
3747 {
3748 int chs;
3749 - unsigned int dataDCC1, dataDCC2, chan, chanmask, channel_id;
3750 + unsigned int dataDCC1, dataDCC2, channel_id;
3751 int i;
3752
3753 mutex_lock(&codec->spdif_mutex);
3754
3755 chs = substream->runtime->channels;
3756 - chan = chs ? (chs - 1) : 1;
3757
3758 - switch (chs) {
3759 - default:
3760 - case 0:
3761 - case 2:
3762 - chanmask = 0x00;
3763 - break;
3764 - case 4:
3765 - chanmask = 0x08;
3766 - break;
3767 - case 6:
3768 - chanmask = 0x0b;
3769 - break;
3770 - case 8:
3771 - chanmask = 0x13;
3772 - break;
3773 - }
3774 dataDCC1 = AC_DIG1_ENABLE | AC_DIG1_COPYRIGHT;
3775 dataDCC2 = 0x2;
3776
3777 - /* set the Audio InforFrame Channel Allocation */
3778 - snd_hda_codec_write(codec, 0x1, 0,
3779 - Nv_VERB_SET_Channel_Allocation, chanmask);
3780 -
3781 /* turn off SPDIF once; otherwise the IEC958 bits won't be updated */
3782 if (codec->spdif_status_reset && (codec->spdif_ctls & AC_DIG1_ENABLE))
3783 snd_hda_codec_write(codec,
3784 @@ -1409,10 +1425,7 @@ static int nvhdmi_8ch_7x_pcm_prepare(struct hda_pcm_stream *hinfo,
3785 }
3786 }
3787
3788 - /* set the Audio Info Frame Checksum */
3789 - snd_hda_codec_write(codec, 0x1, 0,
3790 - Nv_VERB_SET_Info_Frame_Checksum,
3791 - (0x71 - chan - chanmask));
3792 + nvhdmi_8ch_7x_set_info_frame_parameters(codec, chs);
3793
3794 mutex_unlock(&codec->spdif_mutex);
3795 return 0;
3796 @@ -1508,6 +1521,11 @@ static int patch_nvhdmi_8ch_7x(struct hda_codec *codec)
3797 spec->multiout.max_channels = 8;
3798 spec->pcm_playback = &nvhdmi_pcm_playback_8ch_7x;
3799 codec->patch_ops = nvhdmi_patch_ops_8ch_7x;
3800 +
3801 + /* Initialize the audio infoframe channel mask and checksum to something
3802 + * valid */
3803 + nvhdmi_8ch_7x_set_info_frame_parameters(codec, 8);
3804 +
3805 return 0;
3806 }
3807
3808 diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
3809 index c2eb6a7..e164a4b 100644
3810 --- a/sound/pci/hda/patch_realtek.c
3811 +++ b/sound/pci/hda/patch_realtek.c
3812 @@ -1360,7 +1360,7 @@ static void alc_auto_init_amp(struct hda_codec *codec, int type)
3813 case 0x10ec0883:
3814 case 0x10ec0885:
3815 case 0x10ec0887:
3816 - case 0x10ec0889:
3817 + /*case 0x10ec0889:*/ /* this causes an SPDIF problem */
3818 alc889_coef_init(codec);
3819 break;
3820 case 0x10ec0888:
3821 @@ -14191,7 +14191,7 @@ static hda_nid_t alc269vb_capsrc_nids[1] = {
3822 };
3823
3824 static hda_nid_t alc269_adc_candidates[] = {
3825 - 0x08, 0x09, 0x07,
3826 + 0x08, 0x09, 0x07, 0x11,
3827 };
3828
3829 #define alc269_modes alc260_modes
3830 diff --git a/sound/soc/imx/imx-pcm-dma-mx2.c b/sound/soc/imx/imx-pcm-dma-mx2.c
3831 index 671ef8d..aab7765 100644
3832 --- a/sound/soc/imx/imx-pcm-dma-mx2.c
3833 +++ b/sound/soc/imx/imx-pcm-dma-mx2.c
3834 @@ -110,12 +110,12 @@ static int imx_ssi_dma_alloc(struct snd_pcm_substream *substream,
3835 slave_config.direction = DMA_TO_DEVICE;
3836 slave_config.dst_addr = dma_params->dma_addr;
3837 slave_config.dst_addr_width = buswidth;
3838 - slave_config.dst_maxburst = dma_params->burstsize;
3839 + slave_config.dst_maxburst = dma_params->burstsize * buswidth;
3840 } else {
3841 slave_config.direction = DMA_FROM_DEVICE;
3842 slave_config.src_addr = dma_params->dma_addr;
3843 slave_config.src_addr_width = buswidth;
3844 - slave_config.src_maxburst = dma_params->burstsize;
3845 + slave_config.src_maxburst = dma_params->burstsize * buswidth;
3846 }
3847
3848 ret = dmaengine_slave_config(iprtd->dma_chan, &slave_config);
3849 @@ -303,6 +303,11 @@ static struct snd_soc_platform_driver imx_soc_platform_mx2 = {
3850
3851 static int __devinit imx_soc_platform_probe(struct platform_device *pdev)
3852 {
3853 + struct imx_ssi *ssi = platform_get_drvdata(pdev);
3854 +
3855 + ssi->dma_params_tx.burstsize = 6;
3856 + ssi->dma_params_rx.burstsize = 4;
3857 +
3858 return snd_soc_register_platform(&pdev->dev, &imx_soc_platform_mx2);
3859 }
3860
3861 diff --git a/sound/soc/imx/imx-ssi.h b/sound/soc/imx/imx-ssi.h
3862 index a4406a1..dc8a875 100644
3863 --- a/sound/soc/imx/imx-ssi.h
3864 +++ b/sound/soc/imx/imx-ssi.h
3865 @@ -234,7 +234,4 @@ void imx_pcm_free(struct snd_pcm *pcm);
3866 */
3867 #define IMX_SSI_DMABUF_SIZE (64 * 1024)
3868
3869 -#define DMA_RXFIFO_BURST 0x4
3870 -#define DMA_TXFIFO_BURST 0x6
3871 -
3872 #endif /* _IMX_SSI_H */
3873 diff --git a/sound/soc/pxa/corgi.c b/sound/soc/pxa/corgi.c
3874 index 784cff5..9027da4 100644
3875 --- a/sound/soc/pxa/corgi.c
3876 +++ b/sound/soc/pxa/corgi.c
3877 @@ -310,7 +310,7 @@ static struct snd_soc_dai_link corgi_dai = {
3878 .cpu_dai_name = "pxa2xx-i2s",
3879 .codec_dai_name = "wm8731-hifi",
3880 .platform_name = "pxa-pcm-audio",
3881 - .codec_name = "wm8731-codec-0.001b",
3882 + .codec_name = "wm8731-codec.0-001b",
3883 .init = corgi_wm8731_init,
3884 .ops = &corgi_ops,
3885 };

  ViewVC Help
Powered by ViewVC 1.1.20