From 385ae1a4ce9a975598d2e6d412eba25d5f3954e7 Mon Sep 17 00:00:00 2001 From: Igor Pecovnik Date: Wed, 11 Jan 2017 22:26:38 +0100 Subject: [PATCH] Upstream patches for Udoo - NEXT --- .../kernel/udoo-next/03-patch-4.4.39-40.patch | 2245 +++++++++++++++++ .../kernel/udoo-next/03-patch-4.4.40-41.patch | 2183 ++++++++++++++++ 2 files changed, 4428 insertions(+) create mode 100644 patch/kernel/udoo-next/03-patch-4.4.39-40.patch create mode 100644 patch/kernel/udoo-next/03-patch-4.4.40-41.patch diff --git a/patch/kernel/udoo-next/03-patch-4.4.39-40.patch b/patch/kernel/udoo-next/03-patch-4.4.39-40.patch new file mode 100644 index 0000000000..ca0c7b856a --- /dev/null +++ b/patch/kernel/udoo-next/03-patch-4.4.39-40.patch @@ -0,0 +1,2245 @@ +diff --git a/Makefile b/Makefile +index 88d26a632bef..5b5937780408 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 39 ++SUBLEVEL = 40 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/arch/arm/xen/enlighten.c b/arch/arm/xen/enlighten.c +index fc7ea529f462..52c8c1f642fe 100644 +--- a/arch/arm/xen/enlighten.c ++++ b/arch/arm/xen/enlighten.c +@@ -239,8 +239,7 @@ static int __init xen_guest_init(void) + * for secondary CPUs as they are brought up. + * For uniformity we use VCPUOP_register_vcpu_info even on cpu0. + */ +- xen_vcpu_info = __alloc_percpu(sizeof(struct vcpu_info), +- sizeof(struct vcpu_info)); ++ xen_vcpu_info = alloc_percpu(struct vcpu_info); + if (xen_vcpu_info == NULL) + return -ENOMEM; + +diff --git a/block/blk-mq.c b/block/blk-mq.c +index c3e461ec40e4..9f99a01b00e8 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -1313,9 +1313,9 @@ static blk_qc_t blk_mq_make_request(struct request_queue *q, struct bio *bio) + blk_mq_put_ctx(data.ctx); + if (!old_rq) + goto done; +- if (!blk_mq_direct_issue_request(old_rq, &cookie)) +- goto done; +- blk_mq_insert_request(old_rq, false, true, true); ++ if (test_bit(BLK_MQ_S_STOPPED, &data.hctx->state) || ++ blk_mq_direct_issue_request(old_rq, &cookie) != 0) ++ blk_mq_insert_request(old_rq, false, true, true); + goto done; + } + +diff --git a/drivers/base/core.c b/drivers/base/core.c +index b7d56c5ea3c6..f18856f5954b 100644 +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -836,11 +836,29 @@ static struct kobject *get_device_parent(struct device *dev, + return NULL; + } + ++static inline bool live_in_glue_dir(struct kobject *kobj, ++ struct device *dev) ++{ ++ if (!kobj || !dev->class || ++ kobj->kset != &dev->class->p->glue_dirs) ++ return false; ++ return true; ++} ++ ++static inline struct kobject *get_glue_dir(struct device *dev) ++{ ++ return dev->kobj.parent; ++} ++ ++/* ++ * make sure cleaning up dir as the last step, we need to make ++ * sure .release handler of kobject is run with holding the ++ * global lock ++ */ + static void cleanup_glue_dir(struct device *dev, struct kobject *glue_dir) + { + /* see if we live in a "glue" directory */ +- if (!glue_dir || !dev->class || +- glue_dir->kset != &dev->class->p->glue_dirs) ++ if (!live_in_glue_dir(glue_dir, dev)) + return; + + mutex_lock(&gdp_mutex); +@@ -848,11 +866,6 @@ static void cleanup_glue_dir(struct device *dev, struct kobject *glue_dir) + mutex_unlock(&gdp_mutex); + } + +-static void cleanup_device_parent(struct device *dev) +-{ +- cleanup_glue_dir(dev, dev->kobj.parent); +-} +- + static int device_add_class_symlinks(struct device *dev) + { + struct device_node *of_node = dev_of_node(dev); +@@ -1028,6 +1041,7 @@ int device_add(struct device *dev) + struct kobject *kobj; + struct class_interface *class_intf; + int error = -EINVAL; ++ struct kobject *glue_dir = NULL; + + dev = get_device(dev); + if (!dev) +@@ -1072,8 +1086,10 @@ int device_add(struct device *dev) + /* first, register with generic layer. */ + /* we require the name to be set before, and pass NULL */ + error = kobject_add(&dev->kobj, dev->kobj.parent, NULL); +- if (error) ++ if (error) { ++ glue_dir = get_glue_dir(dev); + goto Error; ++ } + + /* notify platform of device entry */ + if (platform_notify) +@@ -1154,9 +1170,10 @@ done: + device_remove_file(dev, &dev_attr_uevent); + attrError: + kobject_uevent(&dev->kobj, KOBJ_REMOVE); ++ glue_dir = get_glue_dir(dev); + kobject_del(&dev->kobj); + Error: +- cleanup_device_parent(dev); ++ cleanup_glue_dir(dev, glue_dir); + put_device(parent); + name_error: + kfree(dev->p); +@@ -1232,6 +1249,7 @@ EXPORT_SYMBOL_GPL(put_device); + void device_del(struct device *dev) + { + struct device *parent = dev->parent; ++ struct kobject *glue_dir = NULL; + struct class_interface *class_intf; + + /* Notify clients of device removal. This call must come +@@ -1276,8 +1294,9 @@ void device_del(struct device *dev) + blocking_notifier_call_chain(&dev->bus->p->bus_notifier, + BUS_NOTIFY_REMOVED_DEVICE, dev); + kobject_uevent(&dev->kobj, KOBJ_REMOVE); +- cleanup_device_parent(dev); ++ glue_dir = get_glue_dir(dev); + kobject_del(&dev->kobj); ++ cleanup_glue_dir(dev, glue_dir); + put_device(parent); + } + EXPORT_SYMBOL_GPL(device_del); +diff --git a/drivers/block/loop.c b/drivers/block/loop.c +index 80cf8add46ff..ab0b2dd3f629 100644 +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -1657,7 +1657,7 @@ static int loop_queue_rq(struct blk_mq_hw_ctx *hctx, + blk_mq_start_request(bd->rq); + + if (lo->lo_state != Lo_bound) +- return -EIO; ++ return BLK_MQ_RQ_QUEUE_ERROR; + + if (lo->use_dio && !(cmd->rq->cmd_flags & (REQ_FLUSH | + REQ_DISCARD))) +diff --git a/drivers/char/tpm/xen-tpmfront.c b/drivers/char/tpm/xen-tpmfront.c +index 3111f2778079..849f2e29c243 100644 +--- a/drivers/char/tpm/xen-tpmfront.c ++++ b/drivers/char/tpm/xen-tpmfront.c +@@ -305,7 +305,6 @@ static int tpmfront_probe(struct xenbus_device *dev, + rv = setup_ring(dev, priv); + if (rv) { + chip = dev_get_drvdata(&dev->dev); +- tpm_chip_unregister(chip); + ring_free(priv); + return rv; + } +diff --git a/drivers/clk/ti/clk-3xxx.c b/drivers/clk/ti/clk-3xxx.c +index 8831e1a05367..11d8aa3ec186 100644 +--- a/drivers/clk/ti/clk-3xxx.c ++++ b/drivers/clk/ti/clk-3xxx.c +@@ -22,13 +22,6 @@ + + #include "clock.h" + +-/* +- * DPLL5_FREQ_FOR_USBHOST: USBHOST and USBTLL are the only clocks +- * that are sourced by DPLL5, and both of these require this clock +- * to be at 120 MHz for proper operation. +- */ +-#define DPLL5_FREQ_FOR_USBHOST 120000000 +- + #define OMAP3430ES2_ST_DSS_IDLE_SHIFT 1 + #define OMAP3430ES2_ST_HSOTGUSB_IDLE_SHIFT 5 + #define OMAP3430ES2_ST_SSI_IDLE_SHIFT 8 +@@ -546,14 +539,21 @@ void __init omap3_clk_lock_dpll5(void) + struct clk *dpll5_clk; + struct clk *dpll5_m2_clk; + ++ /* ++ * Errata sprz319f advisory 2.1 documents a USB host clock drift issue ++ * that can be worked around using specially crafted dpll5 settings ++ * with a dpll5_m2 divider set to 8. Set the dpll5 rate to 8x the USB ++ * host clock rate, its .set_rate handler() will detect that frequency ++ * and use the errata settings. ++ */ + dpll5_clk = clk_get(NULL, "dpll5_ck"); +- clk_set_rate(dpll5_clk, DPLL5_FREQ_FOR_USBHOST); ++ clk_set_rate(dpll5_clk, OMAP3_DPLL5_FREQ_FOR_USBHOST * 8); + clk_prepare_enable(dpll5_clk); + +- /* Program dpll5_m2_clk divider for no division */ ++ /* Program dpll5_m2_clk divider */ + dpll5_m2_clk = clk_get(NULL, "dpll5_m2_ck"); + clk_prepare_enable(dpll5_m2_clk); +- clk_set_rate(dpll5_m2_clk, DPLL5_FREQ_FOR_USBHOST); ++ clk_set_rate(dpll5_m2_clk, OMAP3_DPLL5_FREQ_FOR_USBHOST); + + clk_disable_unprepare(dpll5_m2_clk); + clk_disable_unprepare(dpll5_clk); +diff --git a/drivers/clk/ti/clock.h b/drivers/clk/ti/clock.h +index 90f3f472ae1c..13c37f48d9d6 100644 +--- a/drivers/clk/ti/clock.h ++++ b/drivers/clk/ti/clock.h +@@ -257,11 +257,20 @@ long omap2_dpll_round_rate(struct clk_hw *hw, unsigned long target_rate, + unsigned long omap3_clkoutx2_recalc(struct clk_hw *hw, + unsigned long parent_rate); + ++/* ++ * OMAP3_DPLL5_FREQ_FOR_USBHOST: USBHOST and USBTLL are the only clocks ++ * that are sourced by DPLL5, and both of these require this clock ++ * to be at 120 MHz for proper operation. ++ */ ++#define OMAP3_DPLL5_FREQ_FOR_USBHOST 120000000 ++ + unsigned long omap3_dpll_recalc(struct clk_hw *hw, unsigned long parent_rate); + int omap3_dpll4_set_rate(struct clk_hw *clk, unsigned long rate, + unsigned long parent_rate); + int omap3_dpll4_set_rate_and_parent(struct clk_hw *hw, unsigned long rate, + unsigned long parent_rate, u8 index); ++int omap3_dpll5_set_rate(struct clk_hw *hw, unsigned long rate, ++ unsigned long parent_rate); + void omap3_clk_lock_dpll5(void); + + unsigned long omap4_dpll_regm4xen_recalc(struct clk_hw *hw, +diff --git a/drivers/clk/ti/dpll.c b/drivers/clk/ti/dpll.c +index 5519b386edc0..f9a5089ddc79 100644 +--- a/drivers/clk/ti/dpll.c ++++ b/drivers/clk/ti/dpll.c +@@ -114,6 +114,18 @@ static const struct clk_ops omap3_dpll_ck_ops = { + .round_rate = &omap2_dpll_round_rate, + }; + ++static const struct clk_ops omap3_dpll5_ck_ops = { ++ .enable = &omap3_noncore_dpll_enable, ++ .disable = &omap3_noncore_dpll_disable, ++ .get_parent = &omap2_init_dpll_parent, ++ .recalc_rate = &omap3_dpll_recalc, ++ .set_rate = &omap3_dpll5_set_rate, ++ .set_parent = &omap3_noncore_dpll_set_parent, ++ .set_rate_and_parent = &omap3_noncore_dpll_set_rate_and_parent, ++ .determine_rate = &omap3_noncore_dpll_determine_rate, ++ .round_rate = &omap2_dpll_round_rate, ++}; ++ + static const struct clk_ops omap3_dpll_per_ck_ops = { + .enable = &omap3_noncore_dpll_enable, + .disable = &omap3_noncore_dpll_disable, +@@ -461,7 +473,12 @@ static void __init of_ti_omap3_dpll_setup(struct device_node *node) + .modes = (1 << DPLL_LOW_POWER_BYPASS) | (1 << DPLL_LOCKED), + }; + +- of_ti_dpll_setup(node, &omap3_dpll_ck_ops, &dd); ++ if ((of_machine_is_compatible("ti,omap3630") || ++ of_machine_is_compatible("ti,omap36xx")) && ++ !strcmp(node->name, "dpll5_ck")) ++ of_ti_dpll_setup(node, &omap3_dpll5_ck_ops, &dd); ++ else ++ of_ti_dpll_setup(node, &omap3_dpll_ck_ops, &dd); + } + CLK_OF_DECLARE(ti_omap3_dpll_clock, "ti,omap3-dpll-clock", + of_ti_omap3_dpll_setup); +diff --git a/drivers/clk/ti/dpll3xxx.c b/drivers/clk/ti/dpll3xxx.c +index f4dec00fb684..0e9119fae760 100644 +--- a/drivers/clk/ti/dpll3xxx.c ++++ b/drivers/clk/ti/dpll3xxx.c +@@ -815,3 +815,70 @@ int omap3_dpll4_set_rate_and_parent(struct clk_hw *hw, unsigned long rate, + return omap3_noncore_dpll_set_rate_and_parent(hw, rate, parent_rate, + index); + } ++ ++/* Apply DM3730 errata sprz319 advisory 2.1. */ ++static bool omap3_dpll5_apply_errata(struct clk_hw *hw, ++ unsigned long parent_rate) ++{ ++ struct omap3_dpll5_settings { ++ unsigned int rate, m, n; ++ }; ++ ++ static const struct omap3_dpll5_settings precomputed[] = { ++ /* ++ * From DM3730 errata advisory 2.1, table 35 and 36. ++ * The N value is increased by 1 compared to the tables as the ++ * errata lists register values while last_rounded_field is the ++ * real divider value. ++ */ ++ { 12000000, 80, 0 + 1 }, ++ { 13000000, 443, 5 + 1 }, ++ { 19200000, 50, 0 + 1 }, ++ { 26000000, 443, 11 + 1 }, ++ { 38400000, 25, 0 + 1 } ++ }; ++ ++ const struct omap3_dpll5_settings *d; ++ struct clk_hw_omap *clk = to_clk_hw_omap(hw); ++ struct dpll_data *dd; ++ unsigned int i; ++ ++ for (i = 0; i < ARRAY_SIZE(precomputed); ++i) { ++ if (parent_rate == precomputed[i].rate) ++ break; ++ } ++ ++ if (i == ARRAY_SIZE(precomputed)) ++ return false; ++ ++ d = &precomputed[i]; ++ ++ /* Update the M, N and rounded rate values and program the DPLL. */ ++ dd = clk->dpll_data; ++ dd->last_rounded_m = d->m; ++ dd->last_rounded_n = d->n; ++ dd->last_rounded_rate = div_u64((u64)parent_rate * d->m, d->n); ++ omap3_noncore_dpll_program(clk, 0); ++ ++ return true; ++} ++ ++/** ++ * omap3_dpll5_set_rate - set rate for omap3 dpll5 ++ * @hw: clock to change ++ * @rate: target rate for clock ++ * @parent_rate: rate of the parent clock ++ * ++ * Set rate for the DPLL5 clock. Apply the sprz319 advisory 2.1 on OMAP36xx if ++ * the DPLL is used for USB host (detected through the requested rate). ++ */ ++int omap3_dpll5_set_rate(struct clk_hw *hw, unsigned long rate, ++ unsigned long parent_rate) ++{ ++ if (rate == OMAP3_DPLL5_FREQ_FOR_USBHOST * 8) { ++ if (omap3_dpll5_apply_errata(hw, parent_rate)) ++ return 0; ++ } ++ ++ return omap3_noncore_dpll_set_rate(hw, rate, parent_rate); ++} +diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c +index 2cde3796cb82..f3307fc38e79 100644 +--- a/drivers/crypto/caam/caamalg.c ++++ b/drivers/crypto/caam/caamalg.c +@@ -702,7 +702,9 @@ copy_iv: + + /* Will read cryptlen */ + append_math_add(desc, VARSEQINLEN, SEQINLEN, REG0, CAAM_CMD_SZ); +- aead_append_src_dst(desc, FIFOLD_TYPE_MSG1OUT2); ++ append_seq_fifo_load(desc, 0, FIFOLD_CLASS_BOTH | KEY_VLF | ++ FIFOLD_TYPE_MSG1OUT2 | FIFOLD_TYPE_LASTBOTH); ++ append_seq_fifo_store(desc, 0, FIFOST_TYPE_MESSAGE_DATA | KEY_VLF); + + /* Write ICV */ + append_seq_store(desc, ctx->authsize, LDST_CLASS_2_CCB | +diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c +index 5cac11d7a876..de628883ee3d 100644 +--- a/drivers/md/dm-crypt.c ++++ b/drivers/md/dm-crypt.c +@@ -1500,12 +1500,15 @@ static int crypt_set_key(struct crypt_config *cc, char *key) + if (!cc->key_size && strcmp(key, "-")) + goto out; + ++ /* clear the flag since following operations may invalidate previously valid key */ ++ clear_bit(DM_CRYPT_KEY_VALID, &cc->flags); ++ + if (cc->key_size && crypt_decode_key(cc->key, key, cc->key_size) < 0) + goto out; + +- set_bit(DM_CRYPT_KEY_VALID, &cc->flags); +- + r = crypt_setkey_allcpus(cc); ++ if (!r) ++ set_bit(DM_CRYPT_KEY_VALID, &cc->flags); + + out: + /* Hex key string not needed after here, so wipe it. */ +diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c +index 8e9e928dafba..78f403b45ab3 100644 +--- a/drivers/md/dm-flakey.c ++++ b/drivers/md/dm-flakey.c +@@ -200,11 +200,13 @@ static int flakey_ctr(struct dm_target *ti, unsigned int argc, char **argv) + + if (!(fc->up_interval + fc->down_interval)) { + ti->error = "Total (up + down) interval is zero"; ++ r = -EINVAL; + goto bad; + } + + if (fc->up_interval + fc->down_interval < fc->up_interval) { + ti->error = "Interval overflow"; ++ r = -EINVAL; + goto bad; + } + +diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c +index 7e44005595c1..20557e2c60c6 100644 +--- a/drivers/md/persistent-data/dm-space-map-metadata.c ++++ b/drivers/md/persistent-data/dm-space-map-metadata.c +@@ -775,17 +775,15 @@ int dm_sm_metadata_create(struct dm_space_map *sm, + memcpy(&smm->sm, &bootstrap_ops, sizeof(smm->sm)); + + r = sm_ll_new_metadata(&smm->ll, tm); ++ if (!r) { ++ if (nr_blocks > DM_SM_METADATA_MAX_BLOCKS) ++ nr_blocks = DM_SM_METADATA_MAX_BLOCKS; ++ r = sm_ll_extend(&smm->ll, nr_blocks); ++ } ++ memcpy(&smm->sm, &ops, sizeof(smm->sm)); + if (r) + return r; + +- if (nr_blocks > DM_SM_METADATA_MAX_BLOCKS) +- nr_blocks = DM_SM_METADATA_MAX_BLOCKS; +- r = sm_ll_extend(&smm->ll, nr_blocks); +- if (r) +- return r; +- +- memcpy(&smm->sm, &ops, sizeof(smm->sm)); +- + /* + * Now we need to update the newly created data structures with the + * allocated blocks that they were built from. +diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c +index 174e06ec7c2f..e5bb870b5461 100644 +--- a/drivers/net/ppp/ppp_generic.c ++++ b/drivers/net/ppp/ppp_generic.c +@@ -2390,8 +2390,6 @@ ppp_unregister_channel(struct ppp_channel *chan) + spin_lock_bh(&pn->all_channels_lock); + list_del(&pch->list); + spin_unlock_bh(&pn->all_channels_lock); +- put_net(pch->chan_net); +- pch->chan_net = NULL; + + pch->file.dead = 1; + wake_up_interruptible(&pch->file.rwait); +@@ -2984,6 +2982,9 @@ ppp_disconnect_channel(struct channel *pch) + */ + static void ppp_destroy_channel(struct channel *pch) + { ++ put_net(pch->chan_net); ++ pch->chan_net = NULL; ++ + atomic_dec(&channel_count); + + if (!pch->file.dead) { +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index 4d77745f439f..96849e2e7435 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -1708,6 +1708,7 @@ static const struct usb_device_id acm_ids[] = { + { USB_DEVICE(0x20df, 0x0001), /* Simtec Electronics Entropy Key */ + .driver_info = QUIRK_CONTROL_LINE_STATE, }, + { USB_DEVICE(0x2184, 0x001c) }, /* GW Instek AFG-2225 */ ++ { USB_DEVICE(0x2184, 0x0036) }, /* GW Instek AFG-125 */ + { USB_DEVICE(0x22b8, 0x6425), /* Motorola MOTOMAGX phones */ + }, + /* Motorola H24 HSPA module: */ +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index bcc1e1b729ad..496d6a558793 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -101,6 +101,8 @@ EXPORT_SYMBOL_GPL(ehci_cf_port_reset_rwsem); + + static void hub_release(struct kref *kref); + static int usb_reset_and_verify_device(struct usb_device *udev); ++static void hub_usb3_port_prepare_disable(struct usb_hub *hub, ++ struct usb_port *port_dev); + + static inline char *portspeed(struct usb_hub *hub, int portstatus) + { +@@ -883,82 +885,28 @@ static int hub_set_port_link_state(struct usb_hub *hub, int port1, + } + + /* +- * If USB 3.0 ports are placed into the Disabled state, they will no longer +- * detect any device connects or disconnects. This is generally not what the +- * USB core wants, since it expects a disabled port to produce a port status +- * change event when a new device connects. +- * +- * Instead, set the link state to Disabled, wait for the link to settle into +- * that state, clear any change bits, and then put the port into the RxDetect +- * state. ++ * USB-3 does not have a similar link state as USB-2 that will avoid negotiating ++ * a connection with a plugged-in cable but will signal the host when the cable ++ * is unplugged. Disable remote wake and set link state to U3 for USB-3 devices + */ +-static int hub_usb3_port_disable(struct usb_hub *hub, int port1) +-{ +- int ret; +- int total_time; +- u16 portchange, portstatus; +- +- if (!hub_is_superspeed(hub->hdev)) +- return -EINVAL; +- +- ret = hub_port_status(hub, port1, &portstatus, &portchange); +- if (ret < 0) +- return ret; +- +- /* +- * USB controller Advanced Micro Devices, Inc. [AMD] FCH USB XHCI +- * Controller [1022:7814] will have spurious result making the following +- * usb 3.0 device hotplugging route to the 2.0 root hub and recognized +- * as high-speed device if we set the usb 3.0 port link state to +- * Disabled. Since it's already in USB_SS_PORT_LS_RX_DETECT state, we +- * check the state here to avoid the bug. +- */ +- if ((portstatus & USB_PORT_STAT_LINK_STATE) == +- USB_SS_PORT_LS_RX_DETECT) { +- dev_dbg(&hub->ports[port1 - 1]->dev, +- "Not disabling port; link state is RxDetect\n"); +- return ret; +- } +- +- ret = hub_set_port_link_state(hub, port1, USB_SS_PORT_LS_SS_DISABLED); +- if (ret) +- return ret; +- +- /* Wait for the link to enter the disabled state. */ +- for (total_time = 0; ; total_time += HUB_DEBOUNCE_STEP) { +- ret = hub_port_status(hub, port1, &portstatus, &portchange); +- if (ret < 0) +- return ret; +- +- if ((portstatus & USB_PORT_STAT_LINK_STATE) == +- USB_SS_PORT_LS_SS_DISABLED) +- break; +- if (total_time >= HUB_DEBOUNCE_TIMEOUT) +- break; +- msleep(HUB_DEBOUNCE_STEP); +- } +- if (total_time >= HUB_DEBOUNCE_TIMEOUT) +- dev_warn(&hub->ports[port1 - 1]->dev, +- "Could not disable after %d ms\n", total_time); +- +- return hub_set_port_link_state(hub, port1, USB_SS_PORT_LS_RX_DETECT); +-} +- + static int hub_port_disable(struct usb_hub *hub, int port1, int set_state) + { + struct usb_port *port_dev = hub->ports[port1 - 1]; + struct usb_device *hdev = hub->hdev; + int ret = 0; + +- if (port_dev->child && set_state) +- usb_set_device_state(port_dev->child, USB_STATE_NOTATTACHED); + if (!hub->error) { +- if (hub_is_superspeed(hub->hdev)) +- ret = hub_usb3_port_disable(hub, port1); +- else ++ if (hub_is_superspeed(hub->hdev)) { ++ hub_usb3_port_prepare_disable(hub, port_dev); ++ ret = hub_set_port_link_state(hub, port_dev->portnum, ++ USB_SS_PORT_LS_U3); ++ } else { + ret = usb_clear_port_feature(hdev, port1, + USB_PORT_FEAT_ENABLE); ++ } + } ++ if (port_dev->child && set_state) ++ usb_set_device_state(port_dev->child, USB_STATE_NOTATTACHED); + if (ret && ret != -ENODEV) + dev_err(&port_dev->dev, "cannot disable (err = %d)\n", ret); + return ret; +@@ -4073,6 +4021,26 @@ void usb_unlocked_enable_lpm(struct usb_device *udev) + } + EXPORT_SYMBOL_GPL(usb_unlocked_enable_lpm); + ++/* usb3 devices use U3 for disabled, make sure remote wakeup is disabled */ ++static void hub_usb3_port_prepare_disable(struct usb_hub *hub, ++ struct usb_port *port_dev) ++{ ++ struct usb_device *udev = port_dev->child; ++ int ret; ++ ++ if (udev && udev->port_is_suspended && udev->do_remote_wakeup) { ++ ret = hub_set_port_link_state(hub, port_dev->portnum, ++ USB_SS_PORT_LS_U0); ++ if (!ret) { ++ msleep(USB_RESUME_TIMEOUT); ++ ret = usb_disable_remote_wakeup(udev); ++ } ++ if (ret) ++ dev_warn(&udev->dev, ++ "Port disable: can't disable remote wake\n"); ++ udev->do_remote_wakeup = 0; ++ } ++} + + #else /* CONFIG_PM */ + +@@ -4080,6 +4048,9 @@ EXPORT_SYMBOL_GPL(usb_unlocked_enable_lpm); + #define hub_resume NULL + #define hub_reset_resume NULL + ++static inline void hub_usb3_port_prepare_disable(struct usb_hub *hub, ++ struct usb_port *port_dev) { } ++ + int usb_disable_lpm(struct usb_device *udev) + { + return 0; +diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c +index 8b14c2a13ac5..739b5e2d8adb 100644 +--- a/drivers/usb/gadget/composite.c ++++ b/drivers/usb/gadget/composite.c +@@ -144,11 +144,16 @@ int config_ep_by_speed(struct usb_gadget *g, + + ep_found: + /* commit results */ +- _ep->maxpacket = usb_endpoint_maxp(chosen_desc); ++ _ep->maxpacket = usb_endpoint_maxp(chosen_desc) & 0x7ff; + _ep->desc = chosen_desc; + _ep->comp_desc = NULL; + _ep->maxburst = 0; +- _ep->mult = 0; ++ _ep->mult = 1; ++ ++ if (g->speed == USB_SPEED_HIGH && (usb_endpoint_xfer_isoc(_ep->desc) || ++ usb_endpoint_xfer_int(_ep->desc))) ++ _ep->mult = usb_endpoint_maxp(_ep->desc) & 0x7ff; ++ + if (!want_comp_desc) + return 0; + +@@ -165,7 +170,7 @@ ep_found: + switch (usb_endpoint_type(_ep->desc)) { + case USB_ENDPOINT_XFER_ISOC: + /* mult: bits 1:0 of bmAttributes */ +- _ep->mult = comp_desc->bmAttributes & 0x3; ++ _ep->mult = (comp_desc->bmAttributes & 0x3) + 1; + case USB_ENDPOINT_XFER_BULK: + case USB_ENDPOINT_XFER_INT: + _ep->maxburst = comp_desc->bMaxBurst + 1; +diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c +index 12628dd36e55..12064d3bddf6 100644 +--- a/drivers/usb/gadget/function/f_uac2.c ++++ b/drivers/usb/gadget/function/f_uac2.c +@@ -1079,13 +1079,13 @@ afunc_bind(struct usb_configuration *cfg, struct usb_function *fn) + agdev->out_ep = usb_ep_autoconfig(gadget, &fs_epout_desc); + if (!agdev->out_ep) { + dev_err(dev, "%s:%d Error!\n", __func__, __LINE__); +- goto err; ++ return ret; + } + + agdev->in_ep = usb_ep_autoconfig(gadget, &fs_epin_desc); + if (!agdev->in_ep) { + dev_err(dev, "%s:%d Error!\n", __func__, __LINE__); +- goto err; ++ return ret; + } + + uac2->p_prm.uac2 = uac2; +@@ -1102,7 +1102,7 @@ afunc_bind(struct usb_configuration *cfg, struct usb_function *fn) + + ret = usb_assign_descriptors(fn, fs_audio_desc, hs_audio_desc, NULL); + if (ret) +- goto err; ++ return ret; + + prm = &agdev->uac2.c_prm; + prm->max_psize = hs_epout_desc.wMaxPacketSize; +@@ -1117,19 +1117,19 @@ afunc_bind(struct usb_configuration *cfg, struct usb_function *fn) + prm->rbuf = kzalloc(prm->max_psize * USB_XFERS, GFP_KERNEL); + if (!prm->rbuf) { + prm->max_psize = 0; +- goto err_free_descs; ++ goto err; + } + + ret = alsa_uac2_init(agdev); + if (ret) +- goto err_free_descs; ++ goto err; + return 0; + +-err_free_descs: +- usb_free_all_descriptors(fn); + err: + kfree(agdev->uac2.p_prm.rbuf); + kfree(agdev->uac2.c_prm.rbuf); ++err_free_descs: ++ usb_free_all_descriptors(fn); + return -EINVAL; + } + +diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c +index 3d0d5d94a62f..0f01c04d7cbd 100644 +--- a/drivers/usb/gadget/function/uvc_video.c ++++ b/drivers/usb/gadget/function/uvc_video.c +@@ -243,7 +243,7 @@ uvc_video_alloc_requests(struct uvc_video *video) + + req_size = video->ep->maxpacket + * max_t(unsigned int, video->ep->maxburst, 1) +- * (video->ep->mult + 1); ++ * (video->ep->mult); + + for (i = 0; i < UVC_NUM_REQUESTS; ++i) { + video->req_buffer[i] = kmalloc(req_size, GFP_KERNEL); +diff --git a/drivers/usb/host/uhci-pci.c b/drivers/usb/host/uhci-pci.c +index 940304c33224..02260cfdedb1 100644 +--- a/drivers/usb/host/uhci-pci.c ++++ b/drivers/usb/host/uhci-pci.c +@@ -129,6 +129,10 @@ static int uhci_pci_init(struct usb_hcd *hcd) + if (to_pci_dev(uhci_dev(uhci))->vendor == PCI_VENDOR_ID_HP) + uhci->wait_for_hp = 1; + ++ /* Intel controllers use non-PME wakeup signalling */ ++ if (to_pci_dev(uhci_dev(uhci))->vendor == PCI_VENDOR_ID_INTEL) ++ device_set_run_wake(uhci_dev(uhci), 1); ++ + /* Set up pointers to PCI-specific functions */ + uhci->reset_hc = uhci_pci_reset_hc; + uhci->check_and_reset_hc = uhci_pci_check_and_reset_hc; +diff --git a/drivers/usb/serial/kl5kusb105.c b/drivers/usb/serial/kl5kusb105.c +index e020ad28a00c..53c90131764d 100644 +--- a/drivers/usb/serial/kl5kusb105.c ++++ b/drivers/usb/serial/kl5kusb105.c +@@ -296,7 +296,7 @@ static int klsi_105_open(struct tty_struct *tty, struct usb_serial_port *port) + rc = usb_serial_generic_open(tty, port); + if (rc) { + retval = rc; +- goto exit; ++ goto err_free_cfg; + } + + rc = usb_control_msg(port->serial->dev, +@@ -315,17 +315,32 @@ static int klsi_105_open(struct tty_struct *tty, struct usb_serial_port *port) + dev_dbg(&port->dev, "%s - enabled reading\n", __func__); + + rc = klsi_105_get_line_state(port, &line_state); +- if (rc >= 0) { +- spin_lock_irqsave(&priv->lock, flags); +- priv->line_state = line_state; +- spin_unlock_irqrestore(&priv->lock, flags); +- dev_dbg(&port->dev, "%s - read line state 0x%lx\n", __func__, line_state); +- retval = 0; +- } else ++ if (rc < 0) { + retval = rc; ++ goto err_disable_read; ++ } ++ ++ spin_lock_irqsave(&priv->lock, flags); ++ priv->line_state = line_state; ++ spin_unlock_irqrestore(&priv->lock, flags); ++ dev_dbg(&port->dev, "%s - read line state 0x%lx\n", __func__, ++ line_state); ++ ++ return 0; + +-exit: ++err_disable_read: ++ usb_control_msg(port->serial->dev, ++ usb_sndctrlpipe(port->serial->dev, 0), ++ KL5KUSB105A_SIO_CONFIGURE, ++ USB_TYPE_VENDOR | USB_DIR_OUT, ++ KL5KUSB105A_SIO_CONFIGURE_READ_OFF, ++ 0, /* index */ ++ NULL, 0, ++ KLSI_TIMEOUT); ++ usb_serial_generic_close(port); ++err_free_cfg: + kfree(cfg); ++ + return retval; + } + +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 9894e341c6ac..7ce31a4c7e7f 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -268,6 +268,8 @@ static void option_instat_callback(struct urb *urb); + #define TELIT_PRODUCT_CC864_SINGLE 0x1006 + #define TELIT_PRODUCT_DE910_DUAL 0x1010 + #define TELIT_PRODUCT_UE910_V2 0x1012 ++#define TELIT_PRODUCT_LE922_USBCFG1 0x1040 ++#define TELIT_PRODUCT_LE922_USBCFG2 0x1041 + #define TELIT_PRODUCT_LE922_USBCFG0 0x1042 + #define TELIT_PRODUCT_LE922_USBCFG3 0x1043 + #define TELIT_PRODUCT_LE922_USBCFG5 0x1045 +@@ -1210,6 +1212,10 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UE910_V2) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG0), + .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 }, ++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG1), ++ .driver_info = (kernel_ulong_t)&telit_le910_blacklist }, ++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG2), ++ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG3), + .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG5, 0xff), +@@ -1989,6 +1995,7 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d02, 0xff, 0x00, 0x00) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x02, 0x01) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d04, 0xff) }, /* D-Link DWM-158 */ + { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e19, 0xff), /* D-Link DWM-221 B1 */ + .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ +diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c +index 1be5dd048622..308600adf6e0 100644 +--- a/drivers/xen/gntdev.c ++++ b/drivers/xen/gntdev.c +@@ -804,7 +804,7 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma) + + vma->vm_ops = &gntdev_vmops; + +- vma->vm_flags |= VM_DONTEXPAND | VM_DONTDUMP | VM_IO; ++ vma->vm_flags |= VM_DONTEXPAND | VM_DONTDUMP | VM_MIXEDMAP; + + if (use_ptemod) + vma->vm_flags |= VM_DONTCOPY; +diff --git a/fs/block_dev.c b/fs/block_dev.c +index 44d4a1e9244e..f10dbac851a1 100644 +--- a/fs/block_dev.c ++++ b/fs/block_dev.c +@@ -759,7 +759,7 @@ static bool bd_may_claim(struct block_device *bdev, struct block_device *whole, + return true; /* already a holder */ + else if (bdev->bd_holder != NULL) + return false; /* held by someone else */ +- else if (bdev->bd_contains == bdev) ++ else if (whole == bdev) + return true; /* is a whole device which isn't held */ + + else if (whole->bd_holder == bd_may_claim) +diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c +index 9aba42b78253..a09264d8b853 100644 +--- a/fs/btrfs/async-thread.c ++++ b/fs/btrfs/async-thread.c +@@ -70,6 +70,20 @@ void btrfs_##name(struct work_struct *arg) \ + normal_work_helper(work); \ + } + ++bool btrfs_workqueue_normal_congested(struct btrfs_workqueue *wq) ++{ ++ /* ++ * We could compare wq->normal->pending with num_online_cpus() ++ * to support "thresh == NO_THRESHOLD" case, but it requires ++ * moving up atomic_inc/dec in thresh_queue/exec_hook. Let's ++ * postpone it until someone needs the support of that case. ++ */ ++ if (wq->normal->thresh == NO_THRESHOLD) ++ return false; ++ ++ return atomic_read(&wq->normal->pending) > wq->normal->thresh * 2; ++} ++ + BTRFS_WORK_HELPER(worker_helper); + BTRFS_WORK_HELPER(delalloc_helper); + BTRFS_WORK_HELPER(flush_delalloc_helper); +diff --git a/fs/btrfs/async-thread.h b/fs/btrfs/async-thread.h +index ad4d0647d1a6..8e1d6576d764 100644 +--- a/fs/btrfs/async-thread.h ++++ b/fs/btrfs/async-thread.h +@@ -80,4 +80,5 @@ void btrfs_queue_work(struct btrfs_workqueue *wq, + void btrfs_destroy_workqueue(struct btrfs_workqueue *wq); + void btrfs_workqueue_set_max(struct btrfs_workqueue *wq, int max); + void btrfs_set_work_high_priority(struct btrfs_work *work); ++bool btrfs_workqueue_normal_congested(struct btrfs_workqueue *wq); + #endif +diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h +index 1391f72c28c3..e847573c6db0 100644 +--- a/fs/btrfs/ctree.h ++++ b/fs/btrfs/ctree.h +@@ -3070,6 +3070,8 @@ btrfs_disk_balance_args_to_cpu(struct btrfs_balance_args *cpu, + cpu->target = le64_to_cpu(disk->target); + cpu->flags = le64_to_cpu(disk->flags); + cpu->limit = le64_to_cpu(disk->limit); ++ cpu->stripes_min = le32_to_cpu(disk->stripes_min); ++ cpu->stripes_max = le32_to_cpu(disk->stripes_max); + } + + static inline void +@@ -3088,6 +3090,8 @@ btrfs_cpu_balance_args_to_disk(struct btrfs_disk_balance_args *disk, + disk->target = cpu_to_le64(cpu->target); + disk->flags = cpu_to_le64(cpu->flags); + disk->limit = cpu_to_le64(cpu->limit); ++ disk->stripes_min = cpu_to_le32(cpu->stripes_min); ++ disk->stripes_max = cpu_to_le32(cpu->stripes_max); + } + + /* struct btrfs_super_block */ +diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c +index 02b934d0ee65..09fa5af9782e 100644 +--- a/fs/btrfs/delayed-inode.c ++++ b/fs/btrfs/delayed-inode.c +@@ -1375,7 +1375,8 @@ release_path: + total_done++; + + btrfs_release_prepared_delayed_node(delayed_node); +- if (async_work->nr == 0 || total_done < async_work->nr) ++ if ((async_work->nr == 0 && total_done < BTRFS_DELAYED_WRITEBACK) || ++ total_done < async_work->nr) + goto again; + + free_path: +@@ -1391,7 +1392,8 @@ static int btrfs_wq_run_delayed_node(struct btrfs_delayed_root *delayed_root, + { + struct btrfs_async_delayed_work *async_work; + +- if (atomic_read(&delayed_root->items) < BTRFS_DELAYED_BACKGROUND) ++ if (atomic_read(&delayed_root->items) < BTRFS_DELAYED_BACKGROUND || ++ btrfs_workqueue_normal_congested(fs_info->delayed_workers)) + return 0; + + async_work = kmalloc(sizeof(*async_work), GFP_NOFS); +diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c +index 47cdc6f3390b..2af08c3de775 100644 +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -8486,14 +8486,13 @@ static noinline int do_walk_down(struct btrfs_trans_handle *trans, + ret = btrfs_lookup_extent_info(trans, root, bytenr, level - 1, 1, + &wc->refs[level - 1], + &wc->flags[level - 1]); +- if (ret < 0) { +- btrfs_tree_unlock(next); +- return ret; +- } ++ if (ret < 0) ++ goto out_unlock; + + if (unlikely(wc->refs[level - 1] == 0)) { + btrfs_err(root->fs_info, "Missing references."); +- BUG(); ++ ret = -EIO; ++ goto out_unlock; + } + *lookup_info = 0; + +@@ -8545,7 +8544,12 @@ static noinline int do_walk_down(struct btrfs_trans_handle *trans, + } + + level--; +- BUG_ON(level != btrfs_header_level(next)); ++ ASSERT(level == btrfs_header_level(next)); ++ if (level != btrfs_header_level(next)) { ++ btrfs_err(root->fs_info, "mismatched level"); ++ ret = -EIO; ++ goto out_unlock; ++ } + path->nodes[level] = next; + path->slots[level] = 0; + path->locks[level] = BTRFS_WRITE_LOCK_BLOCKING; +@@ -8560,8 +8564,15 @@ skip: + if (wc->flags[level] & BTRFS_BLOCK_FLAG_FULL_BACKREF) { + parent = path->nodes[level]->start; + } else { +- BUG_ON(root->root_key.objectid != ++ ASSERT(root->root_key.objectid == + btrfs_header_owner(path->nodes[level])); ++ if (root->root_key.objectid != ++ btrfs_header_owner(path->nodes[level])) { ++ btrfs_err(root->fs_info, ++ "mismatched block owner"); ++ ret = -EIO; ++ goto out_unlock; ++ } + parent = 0; + } + +@@ -8578,12 +8589,18 @@ skip: + } + ret = btrfs_free_extent(trans, root, bytenr, blocksize, parent, + root->root_key.objectid, level - 1, 0); +- BUG_ON(ret); /* -ENOMEM */ ++ if (ret) ++ goto out_unlock; + } ++ ++ *lookup_info = 1; ++ ret = 1; ++ ++out_unlock: + btrfs_tree_unlock(next); + free_extent_buffer(next); +- *lookup_info = 1; +- return 1; ++ ++ return ret; + } + + /* +@@ -9686,6 +9703,11 @@ int btrfs_read_block_groups(struct btrfs_root *root) + struct extent_buffer *leaf; + int need_clear = 0; + u64 cache_gen; ++ u64 feature; ++ int mixed; ++ ++ feature = btrfs_super_incompat_flags(info->super_copy); ++ mixed = !!(feature & BTRFS_FEATURE_INCOMPAT_MIXED_GROUPS); + + root = info->extent_root; + key.objectid = 0; +@@ -9739,6 +9761,15 @@ int btrfs_read_block_groups(struct btrfs_root *root) + btrfs_item_ptr_offset(leaf, path->slots[0]), + sizeof(cache->item)); + cache->flags = btrfs_block_group_flags(&cache->item); ++ if (!mixed && ++ ((cache->flags & BTRFS_BLOCK_GROUP_METADATA) && ++ (cache->flags & BTRFS_BLOCK_GROUP_DATA))) { ++ btrfs_err(info, ++"bg %llu is a mixed block group but filesystem hasn't enabled mixed block groups", ++ cache->key.objectid); ++ ret = -EINVAL; ++ goto error; ++ } + + key.objectid = found_key.objectid + found_key.offset; + btrfs_release_path(path); +diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c +index 257bbdcb5df6..e767f347f2b1 100644 +--- a/fs/btrfs/extent_io.c ++++ b/fs/btrfs/extent_io.c +@@ -5294,11 +5294,20 @@ int read_extent_buffer_pages(struct extent_io_tree *tree, + lock_page(page); + } + locked_pages++; ++ } ++ /* ++ * We need to firstly lock all pages to make sure that ++ * the uptodate bit of our pages won't be affected by ++ * clear_extent_buffer_uptodate(). ++ */ ++ for (i = start_i; i < num_pages; i++) { ++ page = eb->pages[i]; + if (!PageUptodate(page)) { + num_reads++; + all_uptodate = 0; + } + } ++ + if (all_uptodate) { + if (start_i == 0) + set_bit(EXTENT_BUFFER_UPTODATE, &eb->bflags); +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index a7e18dbadf74..317b99acdf4b 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -3825,6 +3825,11 @@ process_slot: + } + btrfs_release_path(path); + key.offset = next_key_min_offset; ++ ++ if (fatal_signal_pending(current)) { ++ ret = -EINTR; ++ goto out; ++ } + } + ret = 0; + +diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c +index bcc965ed5fa1..88d9b66e2207 100644 +--- a/fs/btrfs/qgroup.c ++++ b/fs/btrfs/qgroup.c +@@ -2283,10 +2283,6 @@ static void btrfs_qgroup_rescan_worker(struct btrfs_work *work) + int err = -ENOMEM; + int ret = 0; + +- mutex_lock(&fs_info->qgroup_rescan_lock); +- fs_info->qgroup_rescan_running = true; +- mutex_unlock(&fs_info->qgroup_rescan_lock); +- + path = btrfs_alloc_path(); + if (!path) + goto out; +@@ -2397,6 +2393,7 @@ qgroup_rescan_init(struct btrfs_fs_info *fs_info, u64 progress_objectid, + sizeof(fs_info->qgroup_rescan_progress)); + fs_info->qgroup_rescan_progress.objectid = progress_objectid; + init_completion(&fs_info->qgroup_rescan_completion); ++ fs_info->qgroup_rescan_running = true; + + spin_unlock(&fs_info->qgroup_lock); + mutex_unlock(&fs_info->qgroup_rescan_lock); +diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c +index b4ca5454ef1a..8ca9aa92972d 100644 +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -921,9 +921,16 @@ again: + path2->slots[level]--; + + eb = path2->nodes[level]; +- WARN_ON(btrfs_node_blockptr(eb, path2->slots[level]) != +- cur->bytenr); +- ++ if (btrfs_node_blockptr(eb, path2->slots[level]) != ++ cur->bytenr) { ++ btrfs_err(root->fs_info, ++ "couldn't find block (%llu) (level %d) in tree (%llu) with key (%llu %u %llu)", ++ cur->bytenr, level - 1, root->objectid, ++ node_key->objectid, node_key->type, ++ node_key->offset); ++ err = -ENOENT; ++ goto out; ++ } + lower = cur; + need_check = true; + for (; level < BTRFS_MAX_LEVEL; level++) { +@@ -2343,6 +2350,10 @@ void free_reloc_roots(struct list_head *list) + while (!list_empty(list)) { + reloc_root = list_entry(list->next, struct btrfs_root, + root_list); ++ free_extent_buffer(reloc_root->node); ++ free_extent_buffer(reloc_root->commit_root); ++ reloc_root->node = NULL; ++ reloc_root->commit_root = NULL; + __del_reloc_root(reloc_root); + } + } +@@ -2676,11 +2687,15 @@ static int do_relocation(struct btrfs_trans_handle *trans, + + if (!upper->eb) { + ret = btrfs_search_slot(trans, root, key, path, 0, 1); +- if (ret < 0) { +- err = ret; ++ if (ret) { ++ if (ret < 0) ++ err = ret; ++ else ++ err = -ENOENT; ++ ++ btrfs_release_path(path); + break; + } +- BUG_ON(ret > 0); + + if (!upper->eb) { + upper->eb = path->nodes[upper->level]; +diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c +index f7441193bf35..ee7832e2d39d 100644 +--- a/fs/btrfs/tree-log.c ++++ b/fs/btrfs/tree-log.c +@@ -1923,12 +1923,11 @@ static noinline int find_dir_range(struct btrfs_root *root, + next: + /* check the next slot in the tree to see if it is a valid item */ + nritems = btrfs_header_nritems(path->nodes[0]); ++ path->slots[0]++; + if (path->slots[0] >= nritems) { + ret = btrfs_next_leaf(root, path); + if (ret) + goto out; +- } else { +- path->slots[0]++; + } + + btrfs_item_key_to_cpu(path->nodes[0], &key, path->slots[0]); +diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h +index c669a1471395..b76883606e4b 100644 +--- a/fs/cifs/cifsglob.h ++++ b/fs/cifs/cifsglob.h +@@ -627,6 +627,8 @@ struct TCP_Server_Info { + #ifdef CONFIG_CIFS_SMB2 + unsigned int max_read; + unsigned int max_write; ++ struct delayed_work reconnect; /* reconnect workqueue job */ ++ struct mutex reconnect_mutex; /* prevent simultaneous reconnects */ + #endif /* CONFIG_CIFS_SMB2 */ + }; + +@@ -826,6 +828,7 @@ cap_unix(struct cifs_ses *ses) + struct cifs_tcon { + struct list_head tcon_list; + int tc_count; ++ struct list_head rlist; /* reconnect list */ + struct list_head openFileList; + spinlock_t open_file_lock; /* protects list above */ + struct cifs_ses *ses; /* pointer to session associated with */ +diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h +index c63fd1dde25b..54590fd33df1 100644 +--- a/fs/cifs/cifsproto.h ++++ b/fs/cifs/cifsproto.h +@@ -205,6 +205,9 @@ extern void cifs_add_pending_open_locked(struct cifs_fid *fid, + struct tcon_link *tlink, + struct cifs_pending_open *open); + extern void cifs_del_pending_open(struct cifs_pending_open *open); ++extern void cifs_put_tcp_session(struct TCP_Server_Info *server, ++ int from_reconnect); ++extern void cifs_put_tcon(struct cifs_tcon *tcon); + + #if IS_ENABLED(CONFIG_CIFS_DFS_UPCALL) + extern void cifs_dfs_release_automount_timer(void); +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index 812a8cb07c63..5d59f25521ce 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -52,6 +52,9 @@ + #include "nterr.h" + #include "rfc1002pdu.h" + #include "fscache.h" ++#ifdef CONFIG_CIFS_SMB2 ++#include "smb2proto.h" ++#endif + + #define CIFS_PORT 445 + #define RFC1001_PORT 139 +@@ -2113,8 +2116,8 @@ cifs_find_tcp_session(struct smb_vol *vol) + return NULL; + } + +-static void +-cifs_put_tcp_session(struct TCP_Server_Info *server) ++void ++cifs_put_tcp_session(struct TCP_Server_Info *server, int from_reconnect) + { + struct task_struct *task; + +@@ -2131,6 +2134,19 @@ cifs_put_tcp_session(struct TCP_Server_Info *server) + + cancel_delayed_work_sync(&server->echo); + ++#ifdef CONFIG_CIFS_SMB2 ++ if (from_reconnect) ++ /* ++ * Avoid deadlock here: reconnect work calls ++ * cifs_put_tcp_session() at its end. Need to be sure ++ * that reconnect work does nothing with server pointer after ++ * that step. ++ */ ++ cancel_delayed_work(&server->reconnect); ++ else ++ cancel_delayed_work_sync(&server->reconnect); ++#endif ++ + spin_lock(&GlobalMid_Lock); + server->tcpStatus = CifsExiting; + spin_unlock(&GlobalMid_Lock); +@@ -2195,6 +2211,10 @@ cifs_get_tcp_session(struct smb_vol *volume_info) + INIT_LIST_HEAD(&tcp_ses->tcp_ses_list); + INIT_LIST_HEAD(&tcp_ses->smb_ses_list); + INIT_DELAYED_WORK(&tcp_ses->echo, cifs_echo_request); ++#ifdef CONFIG_CIFS_SMB2 ++ INIT_DELAYED_WORK(&tcp_ses->reconnect, smb2_reconnect_server); ++ mutex_init(&tcp_ses->reconnect_mutex); ++#endif + memcpy(&tcp_ses->srcaddr, &volume_info->srcaddr, + sizeof(tcp_ses->srcaddr)); + memcpy(&tcp_ses->dstaddr, &volume_info->dstaddr, +@@ -2347,7 +2367,7 @@ cifs_put_smb_ses(struct cifs_ses *ses) + spin_unlock(&cifs_tcp_ses_lock); + + sesInfoFree(ses); +- cifs_put_tcp_session(server); ++ cifs_put_tcp_session(server, 0); + } + + #ifdef CONFIG_KEYS +@@ -2521,7 +2541,7 @@ cifs_get_smb_ses(struct TCP_Server_Info *server, struct smb_vol *volume_info) + mutex_unlock(&ses->session_mutex); + + /* existing SMB ses has a server reference already */ +- cifs_put_tcp_session(server); ++ cifs_put_tcp_session(server, 0); + free_xid(xid); + return ses; + } +@@ -2611,7 +2631,7 @@ cifs_find_tcon(struct cifs_ses *ses, const char *unc) + return NULL; + } + +-static void ++void + cifs_put_tcon(struct cifs_tcon *tcon) + { + unsigned int xid; +@@ -3767,7 +3787,7 @@ mount_fail_check: + else if (ses) + cifs_put_smb_ses(ses); + else +- cifs_put_tcp_session(server); ++ cifs_put_tcp_session(server, 0); + bdi_destroy(&cifs_sb->bdi); + } + +@@ -4078,7 +4098,7 @@ cifs_construct_tcon(struct cifs_sb_info *cifs_sb, kuid_t fsuid) + ses = cifs_get_smb_ses(master_tcon->ses->server, vol_info); + if (IS_ERR(ses)) { + tcon = (struct cifs_tcon *)ses; +- cifs_put_tcp_session(master_tcon->ses->server); ++ cifs_put_tcp_session(master_tcon->ses->server, 0); + goto out; + } + +diff --git a/fs/cifs/smb2file.c b/fs/cifs/smb2file.c +index f9e766f464be..b2aff0c6f22c 100644 +--- a/fs/cifs/smb2file.c ++++ b/fs/cifs/smb2file.c +@@ -260,7 +260,7 @@ smb2_push_mandatory_locks(struct cifsFileInfo *cfile) + * and check it for zero before using. + */ + max_buf = tlink_tcon(cfile->tlink)->ses->server->maxBuf; +- if (!max_buf) { ++ if (max_buf < sizeof(struct smb2_lock_element)) { + free_xid(xid); + return -EINVAL; + } +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 0dbbdf5e4aee..2fa754c5fd62 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -278,7 +278,7 @@ out: + case SMB2_CHANGE_NOTIFY: + case SMB2_QUERY_INFO: + case SMB2_SET_INFO: +- return -EAGAIN; ++ rc = -EAGAIN; + } + unload_nls(nls_codepage); + return rc; +@@ -1822,6 +1822,54 @@ smb2_echo_callback(struct mid_q_entry *mid) + add_credits(server, credits_received, CIFS_ECHO_OP); + } + ++void smb2_reconnect_server(struct work_struct *work) ++{ ++ struct TCP_Server_Info *server = container_of(work, ++ struct TCP_Server_Info, reconnect.work); ++ struct cifs_ses *ses; ++ struct cifs_tcon *tcon, *tcon2; ++ struct list_head tmp_list; ++ int tcon_exist = false; ++ ++ /* Prevent simultaneous reconnects that can corrupt tcon->rlist list */ ++ mutex_lock(&server->reconnect_mutex); ++ ++ INIT_LIST_HEAD(&tmp_list); ++ cifs_dbg(FYI, "Need negotiate, reconnecting tcons\n"); ++ ++ spin_lock(&cifs_tcp_ses_lock); ++ list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) { ++ list_for_each_entry(tcon, &ses->tcon_list, tcon_list) { ++ if (tcon->need_reconnect) { ++ tcon->tc_count++; ++ list_add_tail(&tcon->rlist, &tmp_list); ++ tcon_exist = true; ++ } ++ } ++ } ++ /* ++ * Get the reference to server struct to be sure that the last call of ++ * cifs_put_tcon() in the loop below won't release the server pointer. ++ */ ++ if (tcon_exist) ++ server->srv_count++; ++ ++ spin_unlock(&cifs_tcp_ses_lock); ++ ++ list_for_each_entry_safe(tcon, tcon2, &tmp_list, rlist) { ++ smb2_reconnect(SMB2_ECHO, tcon); ++ list_del_init(&tcon->rlist); ++ cifs_put_tcon(tcon); ++ } ++ ++ cifs_dbg(FYI, "Reconnecting tcons finished\n"); ++ mutex_unlock(&server->reconnect_mutex); ++ ++ /* now we can safely release srv struct */ ++ if (tcon_exist) ++ cifs_put_tcp_session(server, 1); ++} ++ + int + SMB2_echo(struct TCP_Server_Info *server) + { +@@ -1834,32 +1882,11 @@ SMB2_echo(struct TCP_Server_Info *server) + cifs_dbg(FYI, "In echo request\n"); + + if (server->tcpStatus == CifsNeedNegotiate) { +- struct list_head *tmp, *tmp2; +- struct cifs_ses *ses; +- struct cifs_tcon *tcon; +- +- cifs_dbg(FYI, "Need negotiate, reconnecting tcons\n"); +- spin_lock(&cifs_tcp_ses_lock); +- list_for_each(tmp, &server->smb_ses_list) { +- ses = list_entry(tmp, struct cifs_ses, smb_ses_list); +- list_for_each(tmp2, &ses->tcon_list) { +- tcon = list_entry(tmp2, struct cifs_tcon, +- tcon_list); +- /* add check for persistent handle reconnect */ +- if (tcon && tcon->need_reconnect) { +- spin_unlock(&cifs_tcp_ses_lock); +- rc = smb2_reconnect(SMB2_ECHO, tcon); +- spin_lock(&cifs_tcp_ses_lock); +- } +- } +- } +- spin_unlock(&cifs_tcp_ses_lock); ++ /* No need to send echo on newly established connections */ ++ queue_delayed_work(cifsiod_wq, &server->reconnect, 0); ++ return rc; + } + +- /* if no session, renegotiate failed above */ +- if (server->tcpStatus == CifsNeedNegotiate) +- return -EIO; +- + rc = small_smb2_init(SMB2_ECHO, NULL, (void **)&req); + if (rc) + return rc; +diff --git a/fs/cifs/smb2proto.h b/fs/cifs/smb2proto.h +index 9bc59f9c12fb..0a406ae78129 100644 +--- a/fs/cifs/smb2proto.h ++++ b/fs/cifs/smb2proto.h +@@ -95,6 +95,7 @@ extern int smb2_open_file(const unsigned int xid, + extern int smb2_unlock_range(struct cifsFileInfo *cfile, + struct file_lock *flock, const unsigned int xid); + extern int smb2_push_mandatory_locks(struct cifsFileInfo *cfile); ++extern void smb2_reconnect_server(struct work_struct *work); + + /* + * SMB2 Worker functions - most of protocol specific implementation details +diff --git a/fs/exec.c b/fs/exec.c +index b06623a9347f..3a6de10d3891 100644 +--- a/fs/exec.c ++++ b/fs/exec.c +@@ -19,7 +19,7 @@ + * current->executable is only used by the procfs. This allows a dispatch + * table to check for several different types of binary formats. We keep + * trying until we recognize the file or we run out of supported binary +- * formats. ++ * formats. + */ + + #include +@@ -56,6 +56,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -1114,6 +1115,13 @@ int flush_old_exec(struct linux_binprm * bprm) + flush_thread(); + current->personality &= ~bprm->per_clear; + ++ /* ++ * We have to apply CLOEXEC before we change whether the process is ++ * dumpable (in setup_new_exec) to avoid a race with a process in userspace ++ * trying to access the should-be-closed file descriptors of a process ++ * undergoing exec(2). ++ */ ++ do_close_on_exec(current->files); + return 0; + + out: +@@ -1123,8 +1131,22 @@ EXPORT_SYMBOL(flush_old_exec); + + void would_dump(struct linux_binprm *bprm, struct file *file) + { +- if (inode_permission(file_inode(file), MAY_READ) < 0) ++ struct inode *inode = file_inode(file); ++ if (inode_permission(inode, MAY_READ) < 0) { ++ struct user_namespace *old, *user_ns; + bprm->interp_flags |= BINPRM_FLAGS_ENFORCE_NONDUMP; ++ ++ /* Ensure mm->user_ns contains the executable */ ++ user_ns = old = bprm->mm->user_ns; ++ while ((user_ns != &init_user_ns) && ++ !privileged_wrt_inode_uidgid(user_ns, inode)) ++ user_ns = user_ns->parent; ++ ++ if (old != user_ns) { ++ bprm->mm->user_ns = get_user_ns(user_ns); ++ put_user_ns(old); ++ } ++ } + } + EXPORT_SYMBOL(would_dump); + +@@ -1154,7 +1176,6 @@ void setup_new_exec(struct linux_binprm * bprm) + !gid_eq(bprm->cred->gid, current_egid())) { + current->pdeath_signal = 0; + } else { +- would_dump(bprm, bprm->file); + if (bprm->interp_flags & BINPRM_FLAGS_ENFORCE_NONDUMP) + set_dumpable(current->mm, suid_dumpable); + } +@@ -1163,7 +1184,6 @@ void setup_new_exec(struct linux_binprm * bprm) + group */ + current->self_exec_id++; + flush_signal_handlers(current, 0); +- do_close_on_exec(current->files); + } + EXPORT_SYMBOL(setup_new_exec); + +@@ -1254,7 +1274,7 @@ static void check_unsafe_exec(struct linux_binprm *bprm) + unsigned n_fs; + + if (p->ptrace) { +- if (p->ptrace & PT_PTRACE_CAP) ++ if (ptracer_capable(p, current_user_ns())) + bprm->unsafe |= LSM_UNSAFE_PTRACE_CAP; + else + bprm->unsafe |= LSM_UNSAFE_PTRACE; +@@ -1587,6 +1607,8 @@ static int do_execveat_common(int fd, struct filename *filename, + if (retval < 0) + goto out; + ++ would_dump(bprm, bprm->file); ++ + retval = exec_binprm(bprm); + if (retval < 0) + goto out; +diff --git a/fs/ext4/ext4_jbd2.h b/fs/ext4/ext4_jbd2.h +index 5f5846211095..f817ed58f5ad 100644 +--- a/fs/ext4/ext4_jbd2.h ++++ b/fs/ext4/ext4_jbd2.h +@@ -395,17 +395,19 @@ static inline int ext4_inode_journal_mode(struct inode *inode) + return EXT4_INODE_WRITEBACK_DATA_MODE; /* writeback */ + /* We do not support data journalling with delayed allocation */ + if (!S_ISREG(inode->i_mode) || +- test_opt(inode->i_sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA) +- return EXT4_INODE_JOURNAL_DATA_MODE; /* journal data */ +- if (ext4_test_inode_flag(inode, EXT4_INODE_JOURNAL_DATA) && +- !test_opt(inode->i_sb, DELALLOC)) ++ test_opt(inode->i_sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA || ++ (ext4_test_inode_flag(inode, EXT4_INODE_JOURNAL_DATA) && ++ !test_opt(inode->i_sb, DELALLOC))) { ++ /* We do not support data journalling for encrypted data */ ++ if (S_ISREG(inode->i_mode) && ext4_encrypted_inode(inode)) ++ return EXT4_INODE_ORDERED_DATA_MODE; /* ordered */ + return EXT4_INODE_JOURNAL_DATA_MODE; /* journal data */ ++ } + if (test_opt(inode->i_sb, DATA_FLAGS) == EXT4_MOUNT_ORDERED_DATA) + return EXT4_INODE_ORDERED_DATA_MODE; /* ordered */ + if (test_opt(inode->i_sb, DATA_FLAGS) == EXT4_MOUNT_WRITEBACK_DATA) + return EXT4_INODE_WRITEBACK_DATA_MODE; /* writeback */ +- else +- BUG(); ++ BUG(); + } + + static inline int ext4_should_journal_data(struct inode *inode) +diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c +index d884989cc83d..8968a93e2150 100644 +--- a/fs/ext4/inline.c ++++ b/fs/ext4/inline.c +@@ -336,8 +336,10 @@ static int ext4_update_inline_data(handle_t *handle, struct inode *inode, + + len -= EXT4_MIN_INLINE_DATA_SIZE; + value = kzalloc(len, GFP_NOFS); +- if (!value) ++ if (!value) { ++ error = -ENOMEM; + goto out; ++ } + + error = ext4_xattr_ibody_get(inode, i.name_index, i.name, + value, len); +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index c71d2941a45b..10690e5ba2eb 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -4175,6 +4175,7 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino) + struct inode *inode; + journal_t *journal = EXT4_SB(sb)->s_journal; + long ret; ++ loff_t size; + int block; + uid_t i_uid; + gid_t i_gid; +@@ -4266,6 +4267,11 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino) + ei->i_file_acl |= + ((__u64)le16_to_cpu(raw_inode->i_file_acl_high)) << 32; + inode->i_size = ext4_isize(raw_inode); ++ if ((size = i_size_read(inode)) < 0) { ++ EXT4_ERROR_INODE(inode, "bad i_size value: %lld", size); ++ ret = -EFSCORRUPTED; ++ goto bad_inode; ++ } + ei->i_disksize = inode->i_size; + #ifdef CONFIG_QUOTA + ei->i_reserved_quota = 0; +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index 3c7f0c44cfb3..b7a3957a9dca 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -669,7 +669,7 @@ static void ext4_mb_mark_free_simple(struct super_block *sb, + ext4_grpblk_t min; + ext4_grpblk_t max; + ext4_grpblk_t chunk; +- unsigned short border; ++ unsigned int border; + + BUG_ON(len > EXT4_CLUSTERS_PER_GROUP(sb)); + +@@ -2287,7 +2287,7 @@ static int ext4_mb_seq_groups_show(struct seq_file *seq, void *v) + struct ext4_group_info *grinfo; + struct sg { + struct ext4_group_info info; +- ext4_grpblk_t counters[16]; ++ ext4_grpblk_t counters[EXT4_MAX_BLOCK_LOG_SIZE + 2]; + } sg; + + group--; +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 127155b82e6e..68640e6f95c5 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -3037,10 +3037,15 @@ static int count_overhead(struct super_block *sb, ext4_group_t grp, + ext4_set_bit(s++, buf); + count++; + } +- for (j = ext4_bg_num_gdb(sb, grp); j > 0; j--) { +- ext4_set_bit(EXT4_B2C(sbi, s++), buf); +- count++; ++ j = ext4_bg_num_gdb(sb, grp); ++ if (s + j > EXT4_BLOCKS_PER_GROUP(sb)) { ++ ext4_error(sb, "Invalid number of block group " ++ "descriptor blocks: %d", j); ++ j = EXT4_BLOCKS_PER_GROUP(sb) - s; + } ++ count += j; ++ for (; j > 0; j--) ++ ext4_set_bit(EXT4_B2C(sbi, s++), buf); + } + if (!count) + return 0; +@@ -3130,7 +3135,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + char *orig_data = kstrdup(data, GFP_KERNEL); + struct buffer_head *bh; + struct ext4_super_block *es = NULL; +- struct ext4_sb_info *sbi; ++ struct ext4_sb_info *sbi = kzalloc(sizeof(*sbi), GFP_KERNEL); + ext4_fsblk_t block; + ext4_fsblk_t sb_block = get_sb_block(&data); + ext4_fsblk_t logical_sb_block; +@@ -3149,16 +3154,14 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + unsigned int journal_ioprio = DEFAULT_JOURNAL_IOPRIO; + ext4_group_t first_not_zeroed; + +- sbi = kzalloc(sizeof(*sbi), GFP_KERNEL); +- if (!sbi) +- goto out_free_orig; ++ if ((data && !orig_data) || !sbi) ++ goto out_free_base; + + sbi->s_blockgroup_lock = + kzalloc(sizeof(struct blockgroup_lock), GFP_KERNEL); +- if (!sbi->s_blockgroup_lock) { +- kfree(sbi); +- goto out_free_orig; +- } ++ if (!sbi->s_blockgroup_lock) ++ goto out_free_base; ++ + sb->s_fs_info = sbi; + sbi->s_sb = sb; + sbi->s_inode_readahead_blks = EXT4_DEF_INODE_READAHEAD_BLKS; +@@ -3304,11 +3307,19 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + */ + sbi->s_li_wait_mult = EXT4_DEF_LI_WAIT_MULT; + +- if (!parse_options((char *) sbi->s_es->s_mount_opts, sb, +- &journal_devnum, &journal_ioprio, 0)) { +- ext4_msg(sb, KERN_WARNING, +- "failed to parse options in superblock: %s", +- sbi->s_es->s_mount_opts); ++ if (sbi->s_es->s_mount_opts[0]) { ++ char *s_mount_opts = kstrndup(sbi->s_es->s_mount_opts, ++ sizeof(sbi->s_es->s_mount_opts), ++ GFP_KERNEL); ++ if (!s_mount_opts) ++ goto failed_mount; ++ if (!parse_options(s_mount_opts, sb, &journal_devnum, ++ &journal_ioprio, 0)) { ++ ext4_msg(sb, KERN_WARNING, ++ "failed to parse options in superblock: %s", ++ s_mount_opts); ++ } ++ kfree(s_mount_opts); + } + sbi->s_def_mount_opt = sbi->s_mount_opt; + if (!parse_options((char *) data, sb, &journal_devnum, +@@ -3334,6 +3345,11 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + "both data=journal and dax"); + goto failed_mount; + } ++ if (ext4_has_feature_encrypt(sb)) { ++ ext4_msg(sb, KERN_WARNING, ++ "encrypted files will use data=ordered " ++ "instead of data journaling mode"); ++ } + if (test_opt(sb, DELALLOC)) + clear_opt(sb, DELALLOC); + } else { +@@ -3496,12 +3512,16 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + + sbi->s_blocks_per_group = le32_to_cpu(es->s_blocks_per_group); + sbi->s_inodes_per_group = le32_to_cpu(es->s_inodes_per_group); +- if (EXT4_INODE_SIZE(sb) == 0 || EXT4_INODES_PER_GROUP(sb) == 0) +- goto cantfind_ext4; + + sbi->s_inodes_per_block = blocksize / EXT4_INODE_SIZE(sb); + if (sbi->s_inodes_per_block == 0) + goto cantfind_ext4; ++ if (sbi->s_inodes_per_group < sbi->s_inodes_per_block || ++ sbi->s_inodes_per_group > blocksize * 8) { ++ ext4_msg(sb, KERN_ERR, "invalid inodes per group: %lu\n", ++ sbi->s_blocks_per_group); ++ goto failed_mount; ++ } + sbi->s_itb_per_group = sbi->s_inodes_per_group / + sbi->s_inodes_per_block; + sbi->s_desc_per_block = blocksize / EXT4_DESC_SIZE(sb); +@@ -3584,13 +3604,6 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + } + sbi->s_cluster_ratio = clustersize / blocksize; + +- if (sbi->s_inodes_per_group > blocksize * 8) { +- ext4_msg(sb, KERN_ERR, +- "#inodes per group too big: %lu", +- sbi->s_inodes_per_group); +- goto failed_mount; +- } +- + /* Do we have standard group size of clustersize * 8 blocks ? */ + if (sbi->s_blocks_per_group == clustersize << 3) + set_opt2(sb, STD_GROUP_SIZE); +@@ -3994,7 +4007,9 @@ no_journal: + + if (___ratelimit(&ext4_mount_msg_ratelimit, "EXT4-fs mount")) + ext4_msg(sb, KERN_INFO, "mounted filesystem with%s. " +- "Opts: %s%s%s", descr, sbi->s_es->s_mount_opts, ++ "Opts: %.*s%s%s", descr, ++ (int) sizeof(sbi->s_es->s_mount_opts), ++ sbi->s_es->s_mount_opts, + *sbi->s_es->s_mount_opts ? "; " : "", orig_data); + + if (es->s_error_count) +@@ -4064,8 +4079,8 @@ failed_mount: + out_fail: + sb->s_fs_info = NULL; + kfree(sbi->s_blockgroup_lock); ++out_free_base: + kfree(sbi); +-out_free_orig: + kfree(orig_data); + return err ? err : ret; + } +diff --git a/fs/f2fs/debug.c b/fs/f2fs/debug.c +index 478e5d54154f..24d6a51b48d1 100644 +--- a/fs/f2fs/debug.c ++++ b/fs/f2fs/debug.c +@@ -352,6 +352,7 @@ static int stat_open(struct inode *inode, struct file *file) + } + + static const struct file_operations stat_fops = { ++ .owner = THIS_MODULE, + .open = stat_open, + .read = seq_read, + .llseek = seq_lseek, +diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c +index 5991cdcb9040..8cab78eeb0c2 100644 +--- a/fs/xfs/xfs_log_recover.c ++++ b/fs/xfs/xfs_log_recover.c +@@ -3980,6 +3980,7 @@ xlog_recover_clear_agi_bucket( + agi->agi_unlinked[bucket] = cpu_to_be32(NULLAGINO); + offset = offsetof(xfs_agi_t, agi_unlinked) + + (sizeof(xfs_agino_t) * bucket); ++ xfs_trans_buf_set_type(tp, agibp, XFS_BLFT_AGI_BUF); + xfs_trans_log_buf(tp, agibp, offset, + (offset + sizeof(xfs_agino_t) - 1)); + +diff --git a/include/linux/capability.h b/include/linux/capability.h +index 5f8249d378a2..2654f75a4c46 100644 +--- a/include/linux/capability.h ++++ b/include/linux/capability.h +@@ -247,8 +247,10 @@ static inline bool ns_capable_noaudit(struct user_namespace *ns, int cap) + return true; + } + #endif /* CONFIG_MULTIUSER */ ++extern bool privileged_wrt_inode_uidgid(struct user_namespace *ns, const struct inode *inode); + extern bool capable_wrt_inode_uidgid(const struct inode *inode, int cap); + extern bool file_ns_capable(const struct file *file, struct user_namespace *ns, int cap); ++extern bool ptracer_capable(struct task_struct *tsk, struct user_namespace *ns); + + /* audit system wants to get cap info from files as well */ + extern int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps); +diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h +index f8d1492a114f..2ccccbfcd532 100644 +--- a/include/linux/mm_types.h ++++ b/include/linux/mm_types.h +@@ -469,6 +469,7 @@ struct mm_struct { + */ + struct task_struct __rcu *owner; + #endif ++ struct user_namespace *user_ns; + + /* store ref to file /proc//exe symlink points to */ + struct file __rcu *exe_file; +diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h +index 504c98a278d4..e13bfdf7f314 100644 +--- a/include/linux/ptrace.h ++++ b/include/linux/ptrace.h +@@ -19,7 +19,6 @@ + #define PT_SEIZED 0x00010000 /* SEIZE used, enable new behavior */ + #define PT_PTRACED 0x00000001 + #define PT_DTRACE 0x00000002 /* delayed trace (used on m68k, i386) */ +-#define PT_PTRACE_CAP 0x00000004 /* ptracer can follow suid-exec */ + + #define PT_OPT_FLAG_SHIFT 3 + /* PT_TRACE_* event enable flags */ +diff --git a/include/linux/sched.h b/include/linux/sched.h +index 1c0193baea2a..ce0f61dcd887 100644 +--- a/include/linux/sched.h ++++ b/include/linux/sched.h +@@ -1540,6 +1540,7 @@ struct task_struct { + struct list_head cpu_timers[3]; + + /* process credentials */ ++ const struct cred __rcu *ptracer_cred; /* Tracer's credentials at attach */ + const struct cred __rcu *real_cred; /* objective and real subjective task + * credentials (COW) */ + const struct cred __rcu *cred; /* effective (overridable) subjective task +diff --git a/kernel/capability.c b/kernel/capability.c +index 00411c82dac5..4984e1f552eb 100644 +--- a/kernel/capability.c ++++ b/kernel/capability.c +@@ -457,6 +457,19 @@ bool file_ns_capable(const struct file *file, struct user_namespace *ns, + EXPORT_SYMBOL(file_ns_capable); + + /** ++ * privileged_wrt_inode_uidgid - Do capabilities in the namespace work over the inode? ++ * @ns: The user namespace in question ++ * @inode: The inode in question ++ * ++ * Return true if the inode uid and gid are within the namespace. ++ */ ++bool privileged_wrt_inode_uidgid(struct user_namespace *ns, const struct inode *inode) ++{ ++ return kuid_has_mapping(ns, inode->i_uid) && ++ kgid_has_mapping(ns, inode->i_gid); ++} ++ ++/** + * capable_wrt_inode_uidgid - Check nsown_capable and uid and gid mapped + * @inode: The inode in question + * @cap: The capability in question +@@ -469,7 +482,26 @@ bool capable_wrt_inode_uidgid(const struct inode *inode, int cap) + { + struct user_namespace *ns = current_user_ns(); + +- return ns_capable(ns, cap) && kuid_has_mapping(ns, inode->i_uid) && +- kgid_has_mapping(ns, inode->i_gid); ++ return ns_capable(ns, cap) && privileged_wrt_inode_uidgid(ns, inode); + } + EXPORT_SYMBOL(capable_wrt_inode_uidgid); ++ ++/** ++ * ptracer_capable - Determine if the ptracer holds CAP_SYS_PTRACE in the namespace ++ * @tsk: The task that may be ptraced ++ * @ns: The user namespace to search for CAP_SYS_PTRACE in ++ * ++ * Return true if the task that is ptracing the current task had CAP_SYS_PTRACE ++ * in the specified user namespace. ++ */ ++bool ptracer_capable(struct task_struct *tsk, struct user_namespace *ns) ++{ ++ int ret = 0; /* An absent tracer adds no restrictions */ ++ const struct cred *cred; ++ rcu_read_lock(); ++ cred = rcu_dereference(tsk->ptracer_cred); ++ if (cred) ++ ret = security_capable_noaudit(cred, ns, CAP_SYS_PTRACE); ++ rcu_read_unlock(); ++ return (ret == 0); ++} +diff --git a/kernel/debug/debug_core.c b/kernel/debug/debug_core.c +index 0874e2edd275..79517e5549f1 100644 +--- a/kernel/debug/debug_core.c ++++ b/kernel/debug/debug_core.c +@@ -598,11 +598,11 @@ return_normal: + /* + * Wait for the other CPUs to be notified and be waiting for us: + */ +- time_left = loops_per_jiffy * HZ; ++ time_left = MSEC_PER_SEC; + while (kgdb_do_roundup && --time_left && + (atomic_read(&masters_in_kgdb) + atomic_read(&slaves_in_kgdb)) != + online_cpus) +- cpu_relax(); ++ udelay(1000); + if (!time_left) + pr_crit("Timed out waiting for secondary CPUs.\n"); + +diff --git a/kernel/fork.c b/kernel/fork.c +index 7161ebe67cbb..2e55b53399de 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -585,7 +585,8 @@ static void mm_init_owner(struct mm_struct *mm, struct task_struct *p) + #endif + } + +-static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p) ++static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p, ++ struct user_namespace *user_ns) + { + mm->mmap = NULL; + mm->mm_rb = RB_ROOT; +@@ -625,6 +626,7 @@ static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p) + if (init_new_context(p, mm)) + goto fail_nocontext; + ++ mm->user_ns = get_user_ns(user_ns); + return mm; + + fail_nocontext: +@@ -670,7 +672,7 @@ struct mm_struct *mm_alloc(void) + return NULL; + + memset(mm, 0, sizeof(*mm)); +- return mm_init(mm, current); ++ return mm_init(mm, current, current_user_ns()); + } + + /* +@@ -685,6 +687,7 @@ void __mmdrop(struct mm_struct *mm) + destroy_context(mm); + mmu_notifier_mm_destroy(mm); + check_mm(mm); ++ put_user_ns(mm->user_ns); + free_mm(mm); + } + EXPORT_SYMBOL_GPL(__mmdrop); +@@ -942,7 +945,7 @@ static struct mm_struct *dup_mm(struct task_struct *tsk) + + memcpy(mm, oldmm, sizeof(*mm)); + +- if (!mm_init(mm, tsk)) ++ if (!mm_init(mm, tsk, mm->user_ns)) + goto fail_nomem; + + err = dup_mmap(mm, oldmm); +diff --git a/kernel/ptrace.c b/kernel/ptrace.c +index 3189e51db7e8..a46c40bfb5f6 100644 +--- a/kernel/ptrace.c ++++ b/kernel/ptrace.c +@@ -39,6 +39,9 @@ void __ptrace_link(struct task_struct *child, struct task_struct *new_parent) + BUG_ON(!list_empty(&child->ptrace_entry)); + list_add(&child->ptrace_entry, &new_parent->ptraced); + child->parent = new_parent; ++ rcu_read_lock(); ++ child->ptracer_cred = get_cred(__task_cred(new_parent)); ++ rcu_read_unlock(); + } + + /** +@@ -71,11 +74,15 @@ void __ptrace_link(struct task_struct *child, struct task_struct *new_parent) + */ + void __ptrace_unlink(struct task_struct *child) + { ++ const struct cred *old_cred; + BUG_ON(!child->ptrace); + + child->ptrace = 0; + child->parent = child->real_parent; + list_del_init(&child->ptrace_entry); ++ old_cred = child->ptracer_cred; ++ child->ptracer_cred = NULL; ++ put_cred(old_cred); + + spin_lock(&child->sighand->siglock); + +@@ -219,7 +226,7 @@ static int ptrace_has_cap(struct user_namespace *ns, unsigned int mode) + static int __ptrace_may_access(struct task_struct *task, unsigned int mode) + { + const struct cred *cred = current_cred(), *tcred; +- int dumpable = 0; ++ struct mm_struct *mm; + kuid_t caller_uid; + kgid_t caller_gid; + +@@ -270,16 +277,11 @@ static int __ptrace_may_access(struct task_struct *task, unsigned int mode) + return -EPERM; + ok: + rcu_read_unlock(); +- smp_rmb(); +- if (task->mm) +- dumpable = get_dumpable(task->mm); +- rcu_read_lock(); +- if (dumpable != SUID_DUMP_USER && +- !ptrace_has_cap(__task_cred(task)->user_ns, mode)) { +- rcu_read_unlock(); +- return -EPERM; +- } +- rcu_read_unlock(); ++ mm = task->mm; ++ if (mm && ++ ((get_dumpable(mm) != SUID_DUMP_USER) && ++ !ptrace_has_cap(mm->user_ns, mode))) ++ return -EPERM; + + return security_ptrace_access_check(task, mode); + } +@@ -343,10 +345,6 @@ static int ptrace_attach(struct task_struct *task, long request, + + if (seize) + flags |= PT_SEIZED; +- rcu_read_lock(); +- if (ns_capable(__task_cred(task)->user_ns, CAP_SYS_PTRACE)) +- flags |= PT_PTRACE_CAP; +- rcu_read_unlock(); + task->ptrace = flags; + + __ptrace_link(task, current); +diff --git a/kernel/watchdog.c b/kernel/watchdog.c +index 198137b1cadc..c1e0b5f429b6 100644 +--- a/kernel/watchdog.c ++++ b/kernel/watchdog.c +@@ -328,7 +328,6 @@ static void watchdog_overflow_callback(struct perf_event *event, + */ + if (is_hardlockup()) { + int this_cpu = smp_processor_id(); +- struct pt_regs *regs = get_irq_regs(); + + /* only print hardlockups once */ + if (__this_cpu_read(hard_watchdog_warn) == true) +diff --git a/mm/init-mm.c b/mm/init-mm.c +index a56a851908d2..975e49f00f34 100644 +--- a/mm/init-mm.c ++++ b/mm/init-mm.c +@@ -6,6 +6,7 @@ + #include + + #include ++#include + #include + #include + +@@ -21,5 +22,6 @@ struct mm_struct init_mm = { + .mmap_sem = __RWSEM_INITIALIZER(init_mm.mmap_sem), + .page_table_lock = __SPIN_LOCK_UNLOCKED(init_mm.page_table_lock), + .mmlist = LIST_HEAD_INIT(init_mm.mmlist), ++ .user_ns = &init_user_ns, + INIT_MM_CONTEXT(init_mm) + }; +diff --git a/mm/vmscan.c b/mm/vmscan.c +index de1c59d8daa3..bfc5050cbd01 100644 +--- a/mm/vmscan.c ++++ b/mm/vmscan.c +@@ -277,6 +277,7 @@ static unsigned long do_shrink_slab(struct shrink_control *shrinkctl, + int nid = shrinkctl->nid; + long batch_size = shrinker->batch ? shrinker->batch + : SHRINK_BATCH; ++ long scanned = 0, next_deferred; + + freeable = shrinker->count_objects(shrinker, shrinkctl); + if (freeable == 0) +@@ -298,7 +299,9 @@ static unsigned long do_shrink_slab(struct shrink_control *shrinkctl, + pr_err("shrink_slab: %pF negative objects to delete nr=%ld\n", + shrinker->scan_objects, total_scan); + total_scan = freeable; +- } ++ next_deferred = nr; ++ } else ++ next_deferred = total_scan; + + /* + * We need to avoid excessive windup on filesystem shrinkers +@@ -355,17 +358,22 @@ static unsigned long do_shrink_slab(struct shrink_control *shrinkctl, + + count_vm_events(SLABS_SCANNED, nr_to_scan); + total_scan -= nr_to_scan; ++ scanned += nr_to_scan; + + cond_resched(); + } + ++ if (next_deferred >= scanned) ++ next_deferred -= scanned; ++ else ++ next_deferred = 0; + /* + * move the unused scan count back into the shrinker in a + * manner that handles concurrent updates. If we exhausted the + * scan, there is no need to do an update. + */ +- if (total_scan > 0) +- new_nr = atomic_long_add_return(total_scan, ++ if (next_deferred > 0) ++ new_nr = atomic_long_add_return(next_deferred, + &shrinker->nr_deferred[nid]); + else + new_nr = atomic_long_read(&shrinker->nr_deferred[nid]); +diff --git a/sound/pci/hda/hda_auto_parser.c b/sound/pci/hda/hda_auto_parser.c +index 7f57a145a47e..a03cf68d0bcd 100644 +--- a/sound/pci/hda/hda_auto_parser.c ++++ b/sound/pci/hda/hda_auto_parser.c +@@ -884,6 +884,8 @@ void snd_hda_apply_fixup(struct hda_codec *codec, int action) + } + EXPORT_SYMBOL_GPL(snd_hda_apply_fixup); + ++#define IGNORE_SEQ_ASSOC (~(AC_DEFCFG_SEQUENCE | AC_DEFCFG_DEF_ASSOC)) ++ + static bool pin_config_match(struct hda_codec *codec, + const struct hda_pintbl *pins) + { +@@ -901,7 +903,7 @@ static bool pin_config_match(struct hda_codec *codec, + for (; t_pins->nid; t_pins++) { + if (t_pins->nid == nid) { + found = 1; +- if (t_pins->val == cfg) ++ if ((t_pins->val & IGNORE_SEQ_ASSOC) == (cfg & IGNORE_SEQ_ASSOC)) + break; + else if ((cfg & 0xf0000000) == 0x40000000 && (t_pins->val & 0xf0000000) == 0x40000000) + break; +diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c +index 9ceb2bc36e68..c146d0de53d8 100644 +--- a/sound/pci/hda/patch_ca0132.c ++++ b/sound/pci/hda/patch_ca0132.c +@@ -780,6 +780,7 @@ static const struct hda_pintbl alienware_pincfgs[] = { + static const struct snd_pci_quirk ca0132_quirks[] = { + SND_PCI_QUIRK(0x1028, 0x0685, "Alienware 15 2015", QUIRK_ALIENWARE), + SND_PCI_QUIRK(0x1028, 0x0688, "Alienware 17 2015", QUIRK_ALIENWARE), ++ SND_PCI_QUIRK(0x1028, 0x0708, "Alienware 15 R2 2016", QUIRK_ALIENWARE), + {} + }; + +diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c +index 36cd715986bc..46f7b023f69c 100644 +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -262,6 +262,7 @@ enum { + CXT_FIXUP_CAP_MIX_AMP_5047, + CXT_FIXUP_MUTE_LED_EAPD, + CXT_FIXUP_HP_SPECTRE, ++ CXT_FIXUP_HP_GATE_MIC, + }; + + /* for hda_fixup_thinkpad_acpi() */ +@@ -633,6 +634,17 @@ static void cxt_fixup_cap_mix_amp_5047(struct hda_codec *codec, + (1 << AC_AMPCAP_MUTE_SHIFT)); + } + ++static void cxt_fixup_hp_gate_mic_jack(struct hda_codec *codec, ++ const struct hda_fixup *fix, ++ int action) ++{ ++ /* the mic pin (0x19) doesn't give an unsolicited event; ++ * probe the mic pin together with the headphone pin (0x16) ++ */ ++ if (action == HDA_FIXUP_ACT_PROBE) ++ snd_hda_jack_set_gating_jack(codec, 0x19, 0x16); ++} ++ + /* ThinkPad X200 & co with cxt5051 */ + static const struct hda_pintbl cxt_pincfg_lenovo_x200[] = { + { 0x16, 0x042140ff }, /* HP (seq# overridden) */ +@@ -774,6 +786,10 @@ static const struct hda_fixup cxt_fixups[] = { + { } + } + }, ++ [CXT_FIXUP_HP_GATE_MIC] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = cxt_fixup_hp_gate_mic_jack, ++ }, + }; + + static const struct snd_pci_quirk cxt5045_fixups[] = { +@@ -824,6 +840,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = { + SND_PCI_QUIRK(0x1025, 0x054c, "Acer Aspire 3830TG", CXT_FIXUP_ASPIRE_DMIC), + SND_PCI_QUIRK(0x1025, 0x054f, "Acer Aspire 4830T", CXT_FIXUP_ASPIRE_DMIC), + SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE), ++ SND_PCI_QUIRK(0x103c, 0x8115, "HP Z1 Gen3", CXT_FIXUP_HP_GATE_MIC), + SND_PCI_QUIRK(0x1043, 0x138d, "Asus", CXT_FIXUP_HEADPHONE_MIC_PIN), + SND_PCI_QUIRK(0x152d, 0x0833, "OLPC XO-1.5", CXT_FIXUP_OLPC_XO), + SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400", CXT_PINCFG_LENOVO_TP410), +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index f0986cac82f1..3b2687889cd5 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5899,6 +5899,9 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { + {0x12, 0x90a60180}, + {0x14, 0x90170120}, + {0x21, 0x02211030}), ++ SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, ++ {0x1b, 0x01011020}, ++ {0x21, 0x02211010}), + SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, + {0x12, 0x90a60160}, + {0x14, 0x90170120}, +diff --git a/sound/soc/intel/atom/sst-mfld-platform-pcm.c b/sound/soc/intel/atom/sst-mfld-platform-pcm.c +index 0487cfaac538..2b96b11fbe71 100644 +--- a/sound/soc/intel/atom/sst-mfld-platform-pcm.c ++++ b/sound/soc/intel/atom/sst-mfld-platform-pcm.c +@@ -762,6 +762,9 @@ static int sst_soc_prepare(struct device *dev) + struct sst_data *drv = dev_get_drvdata(dev); + int i; + ++ if (!drv->soc_card) ++ return 0; ++ + /* suspend all pcms first */ + snd_soc_suspend(drv->soc_card->dev); + snd_soc_poweroff(drv->soc_card->dev); +@@ -784,6 +787,9 @@ static void sst_soc_complete(struct device *dev) + struct sst_data *drv = dev_get_drvdata(dev); + int i; + ++ if (!drv->soc_card) ++ return; ++ + /* restart SSPs */ + for (i = 0; i < drv->soc_card->num_rtd; i++) { + struct snd_soc_dai *dai = drv->soc_card->rtd[i].cpu_dai; +diff --git a/sound/usb/hiface/pcm.c b/sound/usb/hiface/pcm.c +index 2c44139b4041..33db205dd12b 100644 +--- a/sound/usb/hiface/pcm.c ++++ b/sound/usb/hiface/pcm.c +@@ -445,6 +445,8 @@ static int hiface_pcm_prepare(struct snd_pcm_substream *alsa_sub) + + mutex_lock(&rt->stream_mutex); + ++ hiface_pcm_stream_stop(rt); ++ + sub->dma_off = 0; + sub->period_off = 0; + +diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c +index 4f85757009b3..499b03c8281d 100644 +--- a/sound/usb/mixer.c ++++ b/sound/usb/mixer.c +@@ -931,9 +931,10 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval, + case USB_ID(0x046d, 0x0826): /* HD Webcam c525 */ + case USB_ID(0x046d, 0x08ca): /* Logitech Quickcam Fusion */ + case USB_ID(0x046d, 0x0991): ++ case USB_ID(0x046d, 0x09a2): /* QuickCam Communicate Deluxe/S7500 */ + /* Most audio usb devices lie about volume resolution. + * Most Logitech webcams have res = 384. +- * Proboly there is some logitech magic behind this number --fishor ++ * Probably there is some logitech magic behind this number --fishor + */ + if (!strcmp(kctl->id.name, "Mic Capture Volume")) { + usb_audio_info(chip, diff --git a/patch/kernel/udoo-next/03-patch-4.4.40-41.patch b/patch/kernel/udoo-next/03-patch-4.4.40-41.patch new file mode 100644 index 0000000000..7986fa673d --- /dev/null +++ b/patch/kernel/udoo-next/03-patch-4.4.40-41.patch @@ -0,0 +1,2183 @@ +diff --git a/Documentation/virtual/kvm/api.txt b/Documentation/virtual/kvm/api.txt +index 092ee9fbaf2b..df8ab4fc240a 100644 +--- a/Documentation/virtual/kvm/api.txt ++++ b/Documentation/virtual/kvm/api.txt +@@ -1991,6 +1991,7 @@ registers, find a list below: + PPC | KVM_REG_PPC_TM_VSCR | 32 + PPC | KVM_REG_PPC_TM_DSCR | 64 + PPC | KVM_REG_PPC_TM_TAR | 64 ++ PPC | KVM_REG_PPC_TM_XER | 64 + | | + MIPS | KVM_REG_MIPS_R0 | 64 + ... +diff --git a/Makefile b/Makefile +index 5b5937780408..855e71066174 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 40 ++SUBLEVEL = 41 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/arch/arc/include/asm/cacheflush.h b/arch/arc/include/asm/cacheflush.h +index fbe3587c4f36..56aeb5efe604 100644 +--- a/arch/arc/include/asm/cacheflush.h ++++ b/arch/arc/include/asm/cacheflush.h +@@ -85,6 +85,10 @@ void flush_anon_page(struct vm_area_struct *vma, + */ + #define PG_dc_clean PG_arch_1 + ++#define CACHE_COLORS_NUM 4 ++#define CACHE_COLORS_MSK (CACHE_COLORS_NUM - 1) ++#define CACHE_COLOR(addr) (((unsigned long)(addr) >> (PAGE_SHIFT)) & CACHE_COLORS_MSK) ++ + /* + * Simple wrapper over config option + * Bootup code ensures that hardware matches kernel configuration +@@ -94,8 +98,6 @@ static inline int cache_is_vipt_aliasing(void) + return IS_ENABLED(CONFIG_ARC_CACHE_VIPT_ALIASING); + } + +-#define CACHE_COLOR(addr) (((unsigned long)(addr) >> (PAGE_SHIFT)) & 1) +- + /* + * checks if two addresses (after page aligning) index into same cache set + */ +diff --git a/arch/arc/mm/cache.c b/arch/arc/mm/cache.c +index aaf1e2d1d900..d81b6d7e11e7 100644 +--- a/arch/arc/mm/cache.c ++++ b/arch/arc/mm/cache.c +@@ -960,11 +960,16 @@ void arc_cache_init(void) + /* check for D-Cache aliasing on ARCompact: ARCv2 has PIPT */ + if (is_isa_arcompact()) { + int handled = IS_ENABLED(CONFIG_ARC_CACHE_VIPT_ALIASING); +- +- if (dc->alias && !handled) +- panic("Enable CONFIG_ARC_CACHE_VIPT_ALIASING\n"); +- else if (!dc->alias && handled) ++ int num_colors = dc->sz_k/dc->assoc/TO_KB(PAGE_SIZE); ++ ++ if (dc->alias) { ++ if (!handled) ++ panic("Enable CONFIG_ARC_CACHE_VIPT_ALIASING\n"); ++ if (CACHE_COLORS_NUM != num_colors) ++ panic("CACHE_COLORS_NUM not optimized for config\n"); ++ } else if (!dc->alias && handled) { + panic("Disable CONFIG_ARC_CACHE_VIPT_ALIASING\n"); ++ } + } + } + +diff --git a/arch/powerpc/boot/ps3-head.S b/arch/powerpc/boot/ps3-head.S +index b6fcbaf5027b..3dc44b05fb97 100644 +--- a/arch/powerpc/boot/ps3-head.S ++++ b/arch/powerpc/boot/ps3-head.S +@@ -57,11 +57,6 @@ __system_reset_overlay: + bctr + + 1: +- /* Save the value at addr zero for a null pointer write check later. */ +- +- li r4, 0 +- lwz r3, 0(r4) +- + /* Primary delays then goes to _zimage_start in wrapper. */ + + or 31, 31, 31 /* db16cyc */ +diff --git a/arch/powerpc/boot/ps3.c b/arch/powerpc/boot/ps3.c +index 4ec2d86d3c50..a05558a7e51a 100644 +--- a/arch/powerpc/boot/ps3.c ++++ b/arch/powerpc/boot/ps3.c +@@ -119,13 +119,12 @@ void ps3_copy_vectors(void) + flush_cache((void *)0x100, 512); + } + +-void platform_init(unsigned long null_check) ++void platform_init(void) + { + const u32 heapsize = 0x1000000 - (u32)_end; /* 16MiB */ + void *chosen; + unsigned long ft_addr; + u64 rm_size; +- unsigned long val; + + console_ops.write = ps3_console_write; + platform_ops.exit = ps3_exit; +@@ -153,11 +152,6 @@ void platform_init(unsigned long null_check) + + printf(" flat tree at 0x%lx\n\r", ft_addr); + +- val = *(unsigned long *)0; +- +- if (val != null_check) +- printf("null check failed: %lx != %lx\n\r", val, null_check); +- + ((kernel_entry_t)0)(ft_addr, 0, NULL); + + ps3_exit(); +diff --git a/arch/powerpc/include/asm/kvm_host.h b/arch/powerpc/include/asm/kvm_host.h +index cfa758c6b4f6..a92d95aee42d 100644 +--- a/arch/powerpc/include/asm/kvm_host.h ++++ b/arch/powerpc/include/asm/kvm_host.h +@@ -545,6 +545,7 @@ struct kvm_vcpu_arch { + u64 tfiar; + + u32 cr_tm; ++ u64 xer_tm; + u64 lr_tm; + u64 ctr_tm; + u64 amr_tm; +diff --git a/arch/powerpc/include/uapi/asm/kvm.h b/arch/powerpc/include/uapi/asm/kvm.h +index ab4d4732c492..720b71a636c8 100644 +--- a/arch/powerpc/include/uapi/asm/kvm.h ++++ b/arch/powerpc/include/uapi/asm/kvm.h +@@ -587,6 +587,7 @@ struct kvm_get_htab_header { + #define KVM_REG_PPC_TM_VSCR (KVM_REG_PPC_TM | KVM_REG_SIZE_U32 | 0x67) + #define KVM_REG_PPC_TM_DSCR (KVM_REG_PPC_TM | KVM_REG_SIZE_U64 | 0x68) + #define KVM_REG_PPC_TM_TAR (KVM_REG_PPC_TM | KVM_REG_SIZE_U64 | 0x69) ++#define KVM_REG_PPC_TM_XER (KVM_REG_PPC_TM | KVM_REG_SIZE_U64 | 0x6a) + + /* PPC64 eXternal Interrupt Controller Specification */ + #define KVM_DEV_XICS_GRP_SOURCES 1 /* 64-bit source attributes */ +diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c +index 221d584d089f..40da69163d51 100644 +--- a/arch/powerpc/kernel/asm-offsets.c ++++ b/arch/powerpc/kernel/asm-offsets.c +@@ -584,6 +584,7 @@ int main(void) + DEFINE(VCPU_VRS_TM, offsetof(struct kvm_vcpu, arch.vr_tm.vr)); + DEFINE(VCPU_VRSAVE_TM, offsetof(struct kvm_vcpu, arch.vrsave_tm)); + DEFINE(VCPU_CR_TM, offsetof(struct kvm_vcpu, arch.cr_tm)); ++ DEFINE(VCPU_XER_TM, offsetof(struct kvm_vcpu, arch.xer_tm)); + DEFINE(VCPU_LR_TM, offsetof(struct kvm_vcpu, arch.lr_tm)); + DEFINE(VCPU_CTR_TM, offsetof(struct kvm_vcpu, arch.ctr_tm)); + DEFINE(VCPU_AMR_TM, offsetof(struct kvm_vcpu, arch.amr_tm)); +diff --git a/arch/powerpc/kernel/idle_power7.S b/arch/powerpc/kernel/idle_power7.S +index 112ccf497562..73f638789a38 100644 +--- a/arch/powerpc/kernel/idle_power7.S ++++ b/arch/powerpc/kernel/idle_power7.S +@@ -44,7 +44,7 @@ + std r0,0(r1); \ + ptesync; \ + ld r0,0(r1); \ +-1: cmp cr0,r0,r0; \ ++1: cmpd cr0,r0,r0; \ + bne 1b; \ + IDLE_INST; \ + b . +diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c +index a7352b59e6f9..3c3a367b6e59 100644 +--- a/arch/powerpc/kvm/book3s_hv.c ++++ b/arch/powerpc/kvm/book3s_hv.c +@@ -1186,6 +1186,9 @@ static int kvmppc_get_one_reg_hv(struct kvm_vcpu *vcpu, u64 id, + case KVM_REG_PPC_TM_CR: + *val = get_reg_val(id, vcpu->arch.cr_tm); + break; ++ case KVM_REG_PPC_TM_XER: ++ *val = get_reg_val(id, vcpu->arch.xer_tm); ++ break; + case KVM_REG_PPC_TM_LR: + *val = get_reg_val(id, vcpu->arch.lr_tm); + break; +@@ -1393,6 +1396,9 @@ static int kvmppc_set_one_reg_hv(struct kvm_vcpu *vcpu, u64 id, + case KVM_REG_PPC_TM_CR: + vcpu->arch.cr_tm = set_reg_val(id, *val); + break; ++ case KVM_REG_PPC_TM_XER: ++ vcpu->arch.xer_tm = set_reg_val(id, *val); ++ break; + case KVM_REG_PPC_TM_LR: + vcpu->arch.lr_tm = set_reg_val(id, *val); + break; +diff --git a/arch/powerpc/kvm/book3s_hv_rm_mmu.c b/arch/powerpc/kvm/book3s_hv_rm_mmu.c +index 91700518bbf3..d509ff5c87b0 100644 +--- a/arch/powerpc/kvm/book3s_hv_rm_mmu.c ++++ b/arch/powerpc/kvm/book3s_hv_rm_mmu.c +@@ -653,6 +653,8 @@ long kvmppc_h_protect(struct kvm_vcpu *vcpu, unsigned long flags, + HPTE_V_ABSENT); + do_tlbies(kvm, &rb, 1, global_invalidates(kvm, flags), + true); ++ /* Don't lose R/C bit updates done by hardware */ ++ r |= be64_to_cpu(hpte[1]) & (HPTE_R_R | HPTE_R_C); + hpte[1] = cpu_to_be64(r); + } + } +diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S +index 974f73df00bb..1a743f87b37d 100644 +--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S ++++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S +@@ -2514,11 +2514,13 @@ kvmppc_save_tm: + mfctr r7 + mfspr r8, SPRN_AMR + mfspr r10, SPRN_TAR ++ mfxer r11 + std r5, VCPU_LR_TM(r9) + stw r6, VCPU_CR_TM(r9) + std r7, VCPU_CTR_TM(r9) + std r8, VCPU_AMR_TM(r9) + std r10, VCPU_TAR_TM(r9) ++ std r11, VCPU_XER_TM(r9) + + /* Restore r12 as trap number. */ + lwz r12, VCPU_TRAP(r9) +@@ -2611,11 +2613,13 @@ kvmppc_restore_tm: + ld r7, VCPU_CTR_TM(r4) + ld r8, VCPU_AMR_TM(r4) + ld r9, VCPU_TAR_TM(r4) ++ ld r10, VCPU_XER_TM(r4) + mtlr r5 + mtcr r6 + mtctr r7 + mtspr SPRN_AMR, r8 + mtspr SPRN_TAR, r9 ++ mtxer r10 + + /* + * Load up PPR and DSCR values but don't put them in the actual SPRs +diff --git a/arch/x86/entry/entry_32.S b/arch/x86/entry/entry_32.S +index f3b6d54e0042..ae678ad128a9 100644 +--- a/arch/x86/entry/entry_32.S ++++ b/arch/x86/entry/entry_32.S +@@ -766,8 +766,8 @@ ftrace_graph_call: + jmp ftrace_stub + #endif + +-.globl ftrace_stub +-ftrace_stub: ++/* This is weak to keep gas from relaxing the jumps */ ++WEAK(ftrace_stub) + ret + END(ftrace_caller) + +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index 268df707b5ce..bb620df05d0d 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -1247,10 +1247,10 @@ static inline bool nested_cpu_has_posted_intr(struct vmcs12 *vmcs12) + return vmcs12->pin_based_vm_exec_control & PIN_BASED_POSTED_INTR; + } + +-static inline bool is_exception(u32 intr_info) ++static inline bool is_nmi(u32 intr_info) + { + return (intr_info & (INTR_INFO_INTR_TYPE_MASK | INTR_INFO_VALID_MASK)) +- == (INTR_TYPE_HARD_EXCEPTION | INTR_INFO_VALID_MASK); ++ == (INTR_TYPE_NMI_INTR | INTR_INFO_VALID_MASK); + } + + static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason, +@@ -5234,7 +5234,7 @@ static int handle_exception(struct kvm_vcpu *vcpu) + if (is_machine_check(intr_info)) + return handle_machine_check(vcpu); + +- if ((intr_info & INTR_INFO_INTR_TYPE_MASK) == INTR_TYPE_NMI_INTR) ++ if (is_nmi(intr_info)) + return 1; /* already handled by vmx_vcpu_run() */ + + if (is_no_device(intr_info)) { +@@ -7722,7 +7722,7 @@ static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu) + + switch (exit_reason) { + case EXIT_REASON_EXCEPTION_NMI: +- if (!is_exception(intr_info)) ++ if (is_nmi(intr_info)) + return false; + else if (is_page_fault(intr_info)) + return enable_ept; +@@ -8329,8 +8329,7 @@ static void vmx_complete_atomic_exit(struct vcpu_vmx *vmx) + kvm_machine_check(); + + /* We need to handle NMIs before interrupts are enabled */ +- if ((exit_intr_info & INTR_INFO_INTR_TYPE_MASK) == INTR_TYPE_NMI_INTR && +- (exit_intr_info & INTR_INFO_VALID_MASK)) { ++ if (is_nmi(exit_intr_info)) { + kvm_before_handle_nmi(&vmx->vcpu); + asm("int $2"); + kvm_after_handle_nmi(&vmx->vcpu); +diff --git a/block/bsg.c b/block/bsg.c +index d214e929ce18..b9a53615bdef 100644 +--- a/block/bsg.c ++++ b/block/bsg.c +@@ -655,6 +655,9 @@ bsg_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos) + + dprintk("%s: write %Zd bytes\n", bd->name, count); + ++ if (unlikely(segment_eq(get_fs(), KERNEL_DS))) ++ return -EINVAL; ++ + bsg_set_block(bd, file); + + bytes_written = 0; +diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c +index 80e55cb0827b..b48ecbfc4498 100644 +--- a/drivers/acpi/video_detect.c ++++ b/drivers/acpi/video_detect.c +@@ -271,6 +271,26 @@ static const struct dmi_system_id video_detect_dmi_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro12,1"), + }, + }, ++ { ++ /* https://bugzilla.redhat.com/show_bug.cgi?id=1123661 */ ++ .callback = video_detect_force_native, ++ .ident = "Dell XPS 17 L702X", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Dell System XPS L702X"), ++ }, ++ }, ++ { ++ /* https://bugzilla.redhat.com/show_bug.cgi?id=1204476 */ ++ /* https://bugs.launchpad.net/ubuntu/+source/linux-lts-trusty/+bug/1416940 */ ++ .callback = video_detect_force_native, ++ .ident = "HP Pavilion dv6", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv6 Notebook PC"), ++ }, ++ }, ++ + { }, + }; + +diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c +index 8524450e75bd..ccfd268148a8 100644 +--- a/drivers/base/firmware_class.c ++++ b/drivers/base/firmware_class.c +@@ -942,13 +942,14 @@ static int _request_firmware_load(struct firmware_priv *fw_priv, + timeout = MAX_JIFFY_OFFSET; + } + +- retval = wait_for_completion_interruptible_timeout(&buf->completion, ++ timeout = wait_for_completion_interruptible_timeout(&buf->completion, + timeout); +- if (retval == -ERESTARTSYS || !retval) { ++ if (timeout == -ERESTARTSYS || !timeout) { ++ retval = timeout; + mutex_lock(&fw_lock); + fw_load_abort(fw_priv); + mutex_unlock(&fw_lock); +- } else if (retval > 0) { ++ } else if (timeout > 0) { + retval = 0; + } + +diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c +index 6029313aa995..35ab89fe9d7b 100644 +--- a/drivers/clk/bcm/clk-bcm2835.c ++++ b/drivers/clk/bcm/clk-bcm2835.c +@@ -1082,7 +1082,9 @@ static void bcm2835_pll_divider_off(struct clk_hw *hw) + cprman_write(cprman, data->cm_reg, + (cprman_read(cprman, data->cm_reg) & + ~data->load_mask) | data->hold_mask); +- cprman_write(cprman, data->a2w_reg, A2W_PLL_CHANNEL_DISABLE); ++ cprman_write(cprman, data->a2w_reg, ++ cprman_read(cprman, data->a2w_reg) | ++ A2W_PLL_CHANNEL_DISABLE); + spin_unlock(&cprman->regs_lock); + } + +diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c +index e0b4586a26fd..9b8f0b975ca6 100644 +--- a/drivers/gpu/drm/ast/ast_main.c ++++ b/drivers/gpu/drm/ast/ast_main.c +@@ -223,7 +223,8 @@ static int ast_get_dram_info(struct drm_device *dev) + ast_write32(ast, 0x10000, 0xfc600309); + + do { +- ; ++ if (pci_channel_offline(dev->pdev)) ++ return -EIO; + } while (ast_read32(ast, 0x10000) != 0x01); + data = ast_read32(ast, 0x10004); + +@@ -429,7 +430,9 @@ int ast_driver_load(struct drm_device *dev, unsigned long flags) + ast_detect_chip(dev, &need_post); + + if (ast->chip != AST1180) { +- ast_get_dram_info(dev); ++ ret = ast_get_dram_info(dev); ++ if (ret) ++ goto out_free; + ast->vram_size = ast_get_vram_info(dev); + DRM_INFO("dram %d %d %d %08x\n", ast->mclk, ast->dram_type, ast->dram_bus_width, ast->vram_size); + } +diff --git a/drivers/gpu/drm/gma500/psb_drv.c b/drivers/gpu/drm/gma500/psb_drv.c +index 92e7e5795398..db98ab5cde3d 100644 +--- a/drivers/gpu/drm/gma500/psb_drv.c ++++ b/drivers/gpu/drm/gma500/psb_drv.c +@@ -484,6 +484,9 @@ static const struct file_operations psb_gem_fops = { + .open = drm_open, + .release = drm_release, + .unlocked_ioctl = psb_unlocked_ioctl, ++#ifdef CONFIG_COMPAT ++ .compat_ioctl = drm_compat_ioctl, ++#endif + .mmap = drm_gem_mmap, + .poll = drm_poll, + .read = drm_read, +diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c +index 4dca65a63b92..af224fafa21f 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_bios.c ++++ b/drivers/gpu/drm/nouveau/nouveau_bios.c +@@ -333,6 +333,9 @@ get_fp_strap(struct drm_device *dev, struct nvbios *bios) + if (bios->major_version < 5 && bios->data[0x48] & 0x4) + return NVReadVgaCrtc5758(dev, 0, 0xf) & 0xf; + ++ if (drm->device.info.family >= NV_DEVICE_INFO_V0_MAXWELL) ++ return nvif_rd32(device, 0x001800) & 0x0000000f; ++ else + if (drm->device.info.family >= NV_DEVICE_INFO_V0_TESLA) + return (nvif_rd32(device, NV_PEXTDEV_BOOT_0) >> 24) & 0xf; + else +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c +index bbc9824af6e0..ece9f4102c0e 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c +@@ -1833,7 +1833,7 @@ nvf1_chipset = { + .fb = gk104_fb_new, + .fuse = gf100_fuse_new, + .gpio = gk104_gpio_new, +- .i2c = gf119_i2c_new, ++ .i2c = gk104_i2c_new, + .ibus = gk104_ibus_new, + .imem = nv50_instmem_new, + .ltc = gk104_ltc_new, +@@ -1941,7 +1941,7 @@ nv117_chipset = { + .fb = gm107_fb_new, + .fuse = gm107_fuse_new, + .gpio = gk104_gpio_new, +- .i2c = gf119_i2c_new, ++ .i2c = gk104_i2c_new, + .ibus = gk104_ibus_new, + .imem = nv50_instmem_new, + .ltc = gm107_ltc_new, +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogf100.c b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogf100.c +index e7cbc139c1d4..89976ff4b305 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogf100.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogf100.c +@@ -59,6 +59,7 @@ gf100_fifo_gpfifo_engine_fini(struct nvkm_fifo_chan *base, + struct nvkm_gpuobj *inst = chan->base.inst; + int ret = 0; + ++ mutex_lock(&subdev->mutex); + nvkm_wr32(device, 0x002634, chan->base.chid); + if (nvkm_msec(device, 2000, + if (nvkm_rd32(device, 0x002634) == chan->base.chid) +@@ -66,10 +67,12 @@ gf100_fifo_gpfifo_engine_fini(struct nvkm_fifo_chan *base, + ) < 0) { + nvkm_error(subdev, "channel %d [%s] kick timeout\n", + chan->base.chid, chan->base.object.client->name); +- ret = -EBUSY; +- if (suspend) +- return ret; ++ ret = -ETIMEDOUT; + } ++ mutex_unlock(&subdev->mutex); ++ ++ if (ret && suspend) ++ return ret; + + if (offset) { + nvkm_kmap(inst); +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogk104.c b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogk104.c +index 0b817540a9e4..aa1692e5669f 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogk104.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogk104.c +@@ -39,7 +39,9 @@ gk104_fifo_gpfifo_kick(struct gk104_fifo_chan *chan) + struct nvkm_subdev *subdev = &fifo->base.engine.subdev; + struct nvkm_device *device = subdev->device; + struct nvkm_client *client = chan->base.object.client; ++ int ret = 0; + ++ mutex_lock(&subdev->mutex); + nvkm_wr32(device, 0x002634, chan->base.chid); + if (nvkm_msec(device, 2000, + if (!(nvkm_rd32(device, 0x002634) & 0x00100000)) +@@ -47,10 +49,10 @@ gk104_fifo_gpfifo_kick(struct gk104_fifo_chan *chan) + ) < 0) { + nvkm_error(subdev, "channel %d [%s] kick timeout\n", + chan->base.chid, client->name); +- return -EBUSY; ++ ret = -ETIMEDOUT; + } +- +- return 0; ++ mutex_unlock(&subdev->mutex); ++ return ret; + } + + static u32 +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/priv.h b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/priv.h +index 212800ecdce9..7d1d3c6b4b72 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/priv.h ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/priv.h +@@ -12,6 +12,7 @@ struct nvbios_source { + bool rw; + bool ignore_checksum; + bool no_pcir; ++ bool require_checksum; + }; + + int nvbios_extend(struct nvkm_bios *, u32 length); +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c +index b2557e87afdd..7deb81b6dbac 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c +@@ -86,9 +86,12 @@ shadow_image(struct nvkm_bios *bios, int idx, u32 offset, struct shadow *mthd) + nvbios_checksum(&bios->data[image.base], image.size)) { + nvkm_debug(subdev, "%08x: checksum failed\n", + image.base); +- if (mthd->func->rw) ++ if (!mthd->func->require_checksum) { ++ if (mthd->func->rw) ++ score += 1; + score += 1; +- score += 1; ++ } else ++ return 0; + } else { + score += 3; + } +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowacpi.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowacpi.c +index 8fecb5ff22a0..06572f8ce914 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowacpi.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowacpi.c +@@ -99,6 +99,7 @@ nvbios_acpi_fast = { + .init = acpi_init, + .read = acpi_read_fast, + .rw = false, ++ .require_checksum = true, + }; + + const struct nvbios_source +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/base.c +index 85b1464c0194..587c52f08d3f 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/base.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/base.c +@@ -47,8 +47,10 @@ nvkm_ltc_tags_clear(struct nvkm_ltc *ltc, u32 first, u32 count) + + BUG_ON((first > limit) || (limit >= ltc->num_tags)); + ++ mutex_lock(<c->subdev.mutex); + ltc->func->cbc_clear(ltc, first, limit); + ltc->func->cbc_wait(ltc); ++ mutex_unlock(<c->subdev.mutex); + } + + int +diff --git a/drivers/gpu/drm/radeon/radeon_cursor.c b/drivers/gpu/drm/radeon/radeon_cursor.c +index afaf346bd50e..b5b9cb911111 100644 +--- a/drivers/gpu/drm/radeon/radeon_cursor.c ++++ b/drivers/gpu/drm/radeon/radeon_cursor.c +@@ -90,6 +90,9 @@ static void radeon_show_cursor(struct drm_crtc *crtc) + struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc); + struct radeon_device *rdev = crtc->dev->dev_private; + ++ if (radeon_crtc->cursor_out_of_bounds) ++ return; ++ + if (ASIC_IS_DCE4(rdev)) { + WREG32(EVERGREEN_CUR_SURFACE_ADDRESS_HIGH + radeon_crtc->crtc_offset, + upper_32_bits(radeon_crtc->cursor_addr)); +@@ -148,16 +151,17 @@ static int radeon_cursor_move_locked(struct drm_crtc *crtc, int x, int y) + x += crtc->x; + y += crtc->y; + } +- DRM_DEBUG("x %d y %d c->x %d c->y %d\n", x, y, crtc->x, crtc->y); + +- if (x < 0) { ++ if (x < 0) + xorigin = min(-x, radeon_crtc->max_cursor_width - 1); +- x = 0; +- } +- if (y < 0) { ++ if (y < 0) + yorigin = min(-y, radeon_crtc->max_cursor_height - 1); +- y = 0; ++ ++ if (!ASIC_IS_AVIVO(rdev)) { ++ x += crtc->x; ++ y += crtc->y; + } ++ DRM_DEBUG("x %d y %d c->x %d c->y %d\n", x, y, crtc->x, crtc->y); + + /* fixed on DCE6 and newer */ + if (ASIC_IS_AVIVO(rdev) && !ASIC_IS_DCE6(rdev)) { +@@ -180,27 +184,31 @@ static int radeon_cursor_move_locked(struct drm_crtc *crtc, int x, int y) + if (i > 1) { + int cursor_end, frame_end; + +- cursor_end = x - xorigin + w; ++ cursor_end = x + w; + frame_end = crtc->x + crtc->mode.crtc_hdisplay; + if (cursor_end >= frame_end) { + w = w - (cursor_end - frame_end); + if (!(frame_end & 0x7f)) + w--; +- } else { +- if (!(cursor_end & 0x7f)) +- w--; ++ } else if (cursor_end <= 0) { ++ goto out_of_bounds; ++ } else if (!(cursor_end & 0x7f)) { ++ w--; + } + if (w <= 0) { +- w = 1; +- cursor_end = x - xorigin + w; +- if (!(cursor_end & 0x7f)) { +- x--; +- WARN_ON_ONCE(x < 0); +- } ++ goto out_of_bounds; + } + } + } + ++ if (x <= (crtc->x - w) || y <= (crtc->y - radeon_crtc->cursor_height) || ++ x >= (crtc->x + crtc->mode.crtc_hdisplay) || ++ y >= (crtc->y + crtc->mode.crtc_vdisplay)) ++ goto out_of_bounds; ++ ++ x += xorigin; ++ y += yorigin; ++ + if (ASIC_IS_DCE4(rdev)) { + WREG32(EVERGREEN_CUR_POSITION + radeon_crtc->crtc_offset, (x << 16) | y); + WREG32(EVERGREEN_CUR_HOT_SPOT + radeon_crtc->crtc_offset, (xorigin << 16) | yorigin); +@@ -212,6 +220,9 @@ static int radeon_cursor_move_locked(struct drm_crtc *crtc, int x, int y) + WREG32(AVIVO_D1CUR_SIZE + radeon_crtc->crtc_offset, + ((w - 1) << 16) | (radeon_crtc->cursor_height - 1)); + } else { ++ x -= crtc->x; ++ y -= crtc->y; ++ + if (crtc->mode.flags & DRM_MODE_FLAG_DBLSCAN) + y *= 2; + +@@ -232,6 +243,19 @@ static int radeon_cursor_move_locked(struct drm_crtc *crtc, int x, int y) + radeon_crtc->cursor_x = x; + radeon_crtc->cursor_y = y; + ++ if (radeon_crtc->cursor_out_of_bounds) { ++ radeon_crtc->cursor_out_of_bounds = false; ++ if (radeon_crtc->cursor_bo) ++ radeon_show_cursor(crtc); ++ } ++ ++ return 0; ++ ++ out_of_bounds: ++ if (!radeon_crtc->cursor_out_of_bounds) { ++ radeon_hide_cursor(crtc); ++ radeon_crtc->cursor_out_of_bounds = true; ++ } + return 0; + } + +@@ -297,22 +321,23 @@ int radeon_crtc_cursor_set2(struct drm_crtc *crtc, + return ret; + } + +- radeon_crtc->cursor_width = width; +- radeon_crtc->cursor_height = height; +- + radeon_lock_cursor(crtc, true); + +- if (hot_x != radeon_crtc->cursor_hot_x || ++ if (width != radeon_crtc->cursor_width || ++ height != radeon_crtc->cursor_height || ++ hot_x != radeon_crtc->cursor_hot_x || + hot_y != radeon_crtc->cursor_hot_y) { + int x, y; + + x = radeon_crtc->cursor_x + radeon_crtc->cursor_hot_x - hot_x; + y = radeon_crtc->cursor_y + radeon_crtc->cursor_hot_y - hot_y; + +- radeon_cursor_move_locked(crtc, x, y); +- ++ radeon_crtc->cursor_width = width; ++ radeon_crtc->cursor_height = height; + radeon_crtc->cursor_hot_x = hot_x; + radeon_crtc->cursor_hot_y = hot_y; ++ ++ radeon_cursor_move_locked(crtc, x, y); + } + + radeon_show_cursor(crtc); +diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h +index 7a0666ac4e23..d8f8be608c19 100644 +--- a/drivers/gpu/drm/radeon/radeon_mode.h ++++ b/drivers/gpu/drm/radeon/radeon_mode.h +@@ -330,6 +330,7 @@ struct radeon_crtc { + u16 lut_r[256], lut_g[256], lut_b[256]; + bool enabled; + bool can_tile; ++ bool cursor_out_of_bounds; + uint32_t crtc_offset; + struct drm_gem_object *cursor_bo; + uint64_t cursor_addr; +diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c +index 10191b935937..eb2a2a49974f 100644 +--- a/drivers/gpu/drm/radeon/si_dpm.c ++++ b/drivers/gpu/drm/radeon/si_dpm.c +@@ -3026,6 +3026,7 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev, + (rdev->pdev->revision == 0x80) || + (rdev->pdev->revision == 0x81) || + (rdev->pdev->revision == 0x83) || ++ (rdev->pdev->revision == 0x87) || + (rdev->pdev->device == 0x6604) || + (rdev->pdev->device == 0x6605)) { + max_sclk = 75000; +diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c +index 2281de122038..8d84c563ba75 100644 +--- a/drivers/infiniband/core/mad.c ++++ b/drivers/infiniband/core/mad.c +@@ -1745,7 +1745,7 @@ find_mad_agent(struct ib_mad_port_private *port_priv, + if (!class) + goto out; + if (convert_mgmt_class(mad_hdr->mgmt_class) >= +- IB_MGMT_MAX_METHODS) ++ ARRAY_SIZE(class->method_table)) + goto out; + method = class->method_table[convert_mgmt_class( + mad_hdr->mgmt_class)]; +diff --git a/drivers/infiniband/core/multicast.c b/drivers/infiniband/core/multicast.c +index 6aa648cb5381..2cd97977b988 100644 +--- a/drivers/infiniband/core/multicast.c ++++ b/drivers/infiniband/core/multicast.c +@@ -517,8 +517,11 @@ static void join_handler(int status, struct ib_sa_mcmember_rec *rec, + process_join_error(group, status); + else { + int mgids_changed, is_mgid0; +- ib_find_pkey(group->port->dev->device, group->port->port_num, +- be16_to_cpu(rec->pkey), &pkey_index); ++ ++ if (ib_find_pkey(group->port->dev->device, ++ group->port->port_num, be16_to_cpu(rec->pkey), ++ &pkey_index)) ++ pkey_index = MCAST_INVALID_PKEY_INDEX; + + spin_lock_irq(&group->port->lock); + if (group->state == MCAST_BUSY && +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c +index 87799de90a1d..8ec99bdea76b 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c +@@ -563,8 +563,11 @@ void ipoib_mcast_join_task(struct work_struct *work) + if (!test_bit(IPOIB_FLAG_OPER_UP, &priv->flags)) + return; + +- if (ib_query_port(priv->ca, priv->port, &port_attr) || +- port_attr.state != IB_PORT_ACTIVE) { ++ if (ib_query_port(priv->ca, priv->port, &port_attr)) { ++ ipoib_dbg(priv, "ib_query_port() failed\n"); ++ return; ++ } ++ if (port_attr.state != IB_PORT_ACTIVE) { + ipoib_dbg(priv, "port state is not ACTIVE (state = %d) suspending join task\n", + port_attr.state); + return; +diff --git a/drivers/input/misc/drv260x.c b/drivers/input/misc/drv260x.c +index 2adfd86c869a..930424e55439 100644 +--- a/drivers/input/misc/drv260x.c ++++ b/drivers/input/misc/drv260x.c +@@ -592,7 +592,6 @@ static int drv260x_probe(struct i2c_client *client, + } + + haptics->input_dev->name = "drv260x:haptics"; +- haptics->input_dev->dev.parent = client->dev.parent; + haptics->input_dev->close = drv260x_close; + input_set_drvdata(haptics->input_dev, haptics); + input_set_capability(haptics->input_dev, EV_FF, FF_RUMBLE); +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index 10ce885445f6..7af976934441 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -6980,6 +6980,15 @@ static int run(struct mddev *mddev) + stripe = (stripe | (stripe-1)) + 1; + mddev->queue->limits.discard_alignment = stripe; + mddev->queue->limits.discard_granularity = stripe; ++ ++ /* ++ * We use 16-bit counter of active stripes in bi_phys_segments ++ * (minus one for over-loaded initialization) ++ */ ++ blk_queue_max_hw_sectors(mddev->queue, 0xfffe * STRIPE_SECTORS); ++ blk_queue_max_discard_sectors(mddev->queue, ++ 0xfffe * STRIPE_SECTORS); ++ + /* + * unaligned part of discard request will be ignored, so can't + * guarantee discard_zeroes_data +diff --git a/drivers/media/pci/solo6x10/solo6x10.h b/drivers/media/pci/solo6x10/solo6x10.h +index 4ab6586c0467..f53e59e9c0ea 100644 +--- a/drivers/media/pci/solo6x10/solo6x10.h ++++ b/drivers/media/pci/solo6x10/solo6x10.h +@@ -286,7 +286,10 @@ static inline u32 solo_reg_read(struct solo_dev *solo_dev, int reg) + static inline void solo_reg_write(struct solo_dev *solo_dev, int reg, + u32 data) + { ++ u16 val; ++ + writel(data, solo_dev->reg_base + reg); ++ pci_read_config_word(solo_dev->pdev, PCI_STATUS, &val); + } + + static inline void solo_irq_on(struct solo_dev *dev, u32 mask) +diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c +index 958af84884b5..2ff39fbc70d1 100644 +--- a/drivers/misc/mei/client.c ++++ b/drivers/misc/mei/client.c +@@ -698,7 +698,7 @@ void mei_host_client_init(struct work_struct *work) + + pm_runtime_mark_last_busy(dev->dev); + dev_dbg(dev->dev, "rpm: autosuspend\n"); +- pm_runtime_autosuspend(dev->dev); ++ pm_request_autosuspend(dev->dev); + } + + /** +diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c +index 64a428984afe..7277dfd7338f 100644 +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -2040,7 +2040,27 @@ static int sdhci_execute_tuning(struct mmc_host *mmc, u32 opcode) + ctrl &= ~SDHCI_CTRL_EXEC_TUNING; + sdhci_writew(host, ctrl, SDHCI_HOST_CONTROL2); + ++ sdhci_do_reset(host, SDHCI_RESET_CMD); ++ sdhci_do_reset(host, SDHCI_RESET_DATA); ++ + err = -EIO; ++ ++ if (cmd.opcode != MMC_SEND_TUNING_BLOCK_HS200) ++ goto out; ++ ++ sdhci_writel(host, host->ier, SDHCI_INT_ENABLE); ++ sdhci_writel(host, host->ier, SDHCI_SIGNAL_ENABLE); ++ ++ spin_unlock_irqrestore(&host->lock, flags); ++ ++ memset(&cmd, 0, sizeof(cmd)); ++ cmd.opcode = MMC_STOP_TRANSMISSION; ++ cmd.flags = MMC_RSP_SPI_R1B | MMC_RSP_R1B | MMC_CMD_AC; ++ cmd.busy_timeout = 50; ++ mmc_wait_for_cmd(mmc, &cmd, 0); ++ ++ spin_lock_irqsave(&host->lock, flags); ++ + goto out; + } + +diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c +index a4beccf1fd46..25aba9886990 100644 +--- a/drivers/net/ethernet/marvell/mvpp2.c ++++ b/drivers/net/ethernet/marvell/mvpp2.c +@@ -772,6 +772,17 @@ struct mvpp2_rx_desc { + u32 reserved8; + }; + ++struct mvpp2_txq_pcpu_buf { ++ /* Transmitted SKB */ ++ struct sk_buff *skb; ++ ++ /* Physical address of transmitted buffer */ ++ dma_addr_t phys; ++ ++ /* Size transmitted */ ++ size_t size; ++}; ++ + /* Per-CPU Tx queue control */ + struct mvpp2_txq_pcpu { + int cpu; +@@ -787,11 +798,8 @@ struct mvpp2_txq_pcpu { + /* Number of Tx DMA descriptors reserved for each CPU */ + int reserved_num; + +- /* Array of transmitted skb */ +- struct sk_buff **tx_skb; +- +- /* Array of transmitted buffers' physical addresses */ +- dma_addr_t *tx_buffs; ++ /* Infos about transmitted buffers */ ++ struct mvpp2_txq_pcpu_buf *buffs; + + /* Index of last TX DMA descriptor that was inserted */ + int txq_put_index; +@@ -981,10 +989,11 @@ static void mvpp2_txq_inc_put(struct mvpp2_txq_pcpu *txq_pcpu, + struct sk_buff *skb, + struct mvpp2_tx_desc *tx_desc) + { +- txq_pcpu->tx_skb[txq_pcpu->txq_put_index] = skb; +- if (skb) +- txq_pcpu->tx_buffs[txq_pcpu->txq_put_index] = +- tx_desc->buf_phys_addr; ++ struct mvpp2_txq_pcpu_buf *tx_buf = ++ txq_pcpu->buffs + txq_pcpu->txq_put_index; ++ tx_buf->skb = skb; ++ tx_buf->size = tx_desc->data_size; ++ tx_buf->phys = tx_desc->buf_phys_addr; + txq_pcpu->txq_put_index++; + if (txq_pcpu->txq_put_index == txq_pcpu->size) + txq_pcpu->txq_put_index = 0; +@@ -4403,17 +4412,16 @@ static void mvpp2_txq_bufs_free(struct mvpp2_port *port, + int i; + + for (i = 0; i < num; i++) { +- dma_addr_t buf_phys_addr = +- txq_pcpu->tx_buffs[txq_pcpu->txq_get_index]; +- struct sk_buff *skb = txq_pcpu->tx_skb[txq_pcpu->txq_get_index]; ++ struct mvpp2_txq_pcpu_buf *tx_buf = ++ txq_pcpu->buffs + txq_pcpu->txq_get_index; + + mvpp2_txq_inc_get(txq_pcpu); + +- dma_unmap_single(port->dev->dev.parent, buf_phys_addr, +- skb_headlen(skb), DMA_TO_DEVICE); +- if (!skb) ++ dma_unmap_single(port->dev->dev.parent, tx_buf->phys, ++ tx_buf->size, DMA_TO_DEVICE); ++ if (!tx_buf->skb) + continue; +- dev_kfree_skb_any(skb); ++ dev_kfree_skb_any(tx_buf->skb); + } + } + +@@ -4664,15 +4672,10 @@ static int mvpp2_txq_init(struct mvpp2_port *port, + for_each_present_cpu(cpu) { + txq_pcpu = per_cpu_ptr(txq->pcpu, cpu); + txq_pcpu->size = txq->size; +- txq_pcpu->tx_skb = kmalloc(txq_pcpu->size * +- sizeof(*txq_pcpu->tx_skb), +- GFP_KERNEL); +- if (!txq_pcpu->tx_skb) +- goto error; +- +- txq_pcpu->tx_buffs = kmalloc(txq_pcpu->size * +- sizeof(dma_addr_t), GFP_KERNEL); +- if (!txq_pcpu->tx_buffs) ++ txq_pcpu->buffs = kmalloc(txq_pcpu->size * ++ sizeof(struct mvpp2_txq_pcpu_buf), ++ GFP_KERNEL); ++ if (!txq_pcpu->buffs) + goto error; + + txq_pcpu->count = 0; +@@ -4686,8 +4689,7 @@ static int mvpp2_txq_init(struct mvpp2_port *port, + error: + for_each_present_cpu(cpu) { + txq_pcpu = per_cpu_ptr(txq->pcpu, cpu); +- kfree(txq_pcpu->tx_skb); +- kfree(txq_pcpu->tx_buffs); ++ kfree(txq_pcpu->buffs); + } + + dma_free_coherent(port->dev->dev.parent, +@@ -4706,8 +4708,7 @@ static void mvpp2_txq_deinit(struct mvpp2_port *port, + + for_each_present_cpu(cpu) { + txq_pcpu = per_cpu_ptr(txq->pcpu, cpu); +- kfree(txq_pcpu->tx_skb); +- kfree(txq_pcpu->tx_buffs); ++ kfree(txq_pcpu->buffs); + } + + if (txq->descs) +diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c +index 7cdaf40c3057..ea7b8c25955f 100644 +--- a/drivers/net/wireless/ath/ath9k/pci.c ++++ b/drivers/net/wireless/ath/ath9k/pci.c +@@ -27,7 +27,6 @@ static const struct pci_device_id ath_pci_id_table[] = { + { PCI_VDEVICE(ATHEROS, 0x0023) }, /* PCI */ + { PCI_VDEVICE(ATHEROS, 0x0024) }, /* PCI-E */ + { PCI_VDEVICE(ATHEROS, 0x0027) }, /* PCI */ +- { PCI_VDEVICE(ATHEROS, 0x0029) }, /* PCI */ + + #ifdef CONFIG_ATH9K_PCOEM + /* Mini PCI AR9220 MB92 cards: Compex WLM200NX, Wistron DNMA-92 */ +@@ -38,7 +37,7 @@ static const struct pci_device_id ath_pci_id_table[] = { + .driver_data = ATH9K_PCI_LED_ACT_HI }, + #endif + +- { PCI_VDEVICE(ATHEROS, 0x002A) }, /* PCI-E */ ++ { PCI_VDEVICE(ATHEROS, 0x0029) }, /* PCI */ + + #ifdef CONFIG_ATH9K_PCOEM + { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS, +@@ -86,7 +85,11 @@ static const struct pci_device_id ath_pci_id_table[] = { + 0x10CF, /* Fujitsu */ + 0x1536), + .driver_data = ATH9K_PCI_D3_L1_WAR }, ++#endif + ++ { PCI_VDEVICE(ATHEROS, 0x002A) }, /* PCI-E */ ++ ++#ifdef CONFIG_ATH9K_PCOEM + /* AR9285 card for Asus */ + { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS, + 0x002B, +diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c +index 7a40d8dffa36..aab752328c26 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/base.c ++++ b/drivers/net/wireless/realtek/rtlwifi/base.c +@@ -1303,12 +1303,13 @@ EXPORT_SYMBOL_GPL(rtl_action_proc); + + static void setup_arp_tx(struct rtl_priv *rtlpriv, struct rtl_ps_ctl *ppsc) + { ++ struct ieee80211_hw *hw = rtlpriv->hw; ++ + rtlpriv->ra.is_special_data = true; + if (rtlpriv->cfg->ops->get_btc_status()) + rtlpriv->btcoexist.btc_ops->btc_special_packet_notify( + rtlpriv, 1); +- rtlpriv->enter_ps = false; +- schedule_work(&rtlpriv->works.lps_change_work); ++ rtl_lps_leave(hw); + ppsc->last_delaylps_stamp_jiffies = jiffies; + } + +@@ -1381,8 +1382,7 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx, + + if (is_tx) { + rtlpriv->ra.is_special_data = true; +- rtlpriv->enter_ps = false; +- schedule_work(&rtlpriv->works.lps_change_work); ++ rtl_lps_leave(hw); + ppsc->last_delaylps_stamp_jiffies = jiffies; + } + +diff --git a/drivers/net/wireless/realtek/rtlwifi/core.c b/drivers/net/wireless/realtek/rtlwifi/core.c +index c925a4dff599..e36d8c456275 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/core.c ++++ b/drivers/net/wireless/realtek/rtlwifi/core.c +@@ -1153,10 +1153,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw, + } else { + mstatus = RT_MEDIA_DISCONNECT; + +- if (mac->link_state == MAC80211_LINKED) { +- rtlpriv->enter_ps = false; +- schedule_work(&rtlpriv->works.lps_change_work); +- } ++ if (mac->link_state == MAC80211_LINKED) ++ rtl_lps_leave(hw); + if (ppsc->p2p_ps_info.p2p_ps_mode > P2P_PS_NONE) + rtl_p2p_ps_cmd(hw, P2P_PS_DISABLE); + mac->link_state = MAC80211_NOLINK; +@@ -1432,8 +1430,7 @@ static void rtl_op_sw_scan_start(struct ieee80211_hw *hw, + } + + if (mac->link_state == MAC80211_LINKED) { +- rtlpriv->enter_ps = false; +- schedule_work(&rtlpriv->works.lps_change_work); ++ rtl_lps_leave(hw); + mac->link_state = MAC80211_LINKED_SCANNING; + } else { + rtl_ips_nic_on(hw); +diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c +index 5b4048041147..a52230377e2c 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/pci.c ++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c +@@ -664,11 +664,9 @@ tx_status_ok: + } + + if (((rtlpriv->link_info.num_rx_inperiod + +- rtlpriv->link_info.num_tx_inperiod) > 8) || +- (rtlpriv->link_info.num_rx_inperiod > 2)) { +- rtlpriv->enter_ps = false; +- schedule_work(&rtlpriv->works.lps_change_work); +- } ++ rtlpriv->link_info.num_tx_inperiod) > 8) || ++ (rtlpriv->link_info.num_rx_inperiod > 2)) ++ rtl_lps_leave(hw); + } + + static int _rtl_pci_init_one_rxdesc(struct ieee80211_hw *hw, +@@ -919,10 +917,8 @@ new_trx_end: + } + if (((rtlpriv->link_info.num_rx_inperiod + + rtlpriv->link_info.num_tx_inperiod) > 8) || +- (rtlpriv->link_info.num_rx_inperiod > 2)) { +- rtlpriv->enter_ps = false; +- schedule_work(&rtlpriv->works.lps_change_work); +- } ++ (rtlpriv->link_info.num_rx_inperiod > 2)) ++ rtl_lps_leave(hw); + skb = new_skb; + no_new: + if (rtlpriv->use_new_trx_flow) { +diff --git a/drivers/net/wireless/realtek/rtlwifi/ps.c b/drivers/net/wireless/realtek/rtlwifi/ps.c +index b69321d45f04..626ff300352b 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/ps.c ++++ b/drivers/net/wireless/realtek/rtlwifi/ps.c +@@ -414,8 +414,8 @@ void rtl_lps_set_psmode(struct ieee80211_hw *hw, u8 rt_psmode) + } + } + +-/*Enter the leisure power save mode.*/ +-void rtl_lps_enter(struct ieee80211_hw *hw) ++/* Interrupt safe routine to enter the leisure power save mode.*/ ++static void rtl_lps_enter_core(struct ieee80211_hw *hw) + { + struct rtl_mac *mac = rtl_mac(rtl_priv(hw)); + struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw)); +@@ -455,10 +455,9 @@ void rtl_lps_enter(struct ieee80211_hw *hw) + + spin_unlock_irqrestore(&rtlpriv->locks.lps_lock, flag); + } +-EXPORT_SYMBOL(rtl_lps_enter); + +-/*Leave the leisure power save mode.*/ +-void rtl_lps_leave(struct ieee80211_hw *hw) ++/* Interrupt safe routine to leave the leisure power save mode.*/ ++static void rtl_lps_leave_core(struct ieee80211_hw *hw) + { + struct rtl_priv *rtlpriv = rtl_priv(hw); + struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw)); +@@ -488,7 +487,6 @@ void rtl_lps_leave(struct ieee80211_hw *hw) + } + spin_unlock_irqrestore(&rtlpriv->locks.lps_lock, flag); + } +-EXPORT_SYMBOL(rtl_lps_leave); + + /* For sw LPS*/ + void rtl_swlps_beacon(struct ieee80211_hw *hw, void *data, unsigned int len) +@@ -681,12 +679,34 @@ void rtl_lps_change_work_callback(struct work_struct *work) + struct rtl_priv *rtlpriv = rtl_priv(hw); + + if (rtlpriv->enter_ps) +- rtl_lps_enter(hw); ++ rtl_lps_enter_core(hw); + else +- rtl_lps_leave(hw); ++ rtl_lps_leave_core(hw); + } + EXPORT_SYMBOL_GPL(rtl_lps_change_work_callback); + ++void rtl_lps_enter(struct ieee80211_hw *hw) ++{ ++ struct rtl_priv *rtlpriv = rtl_priv(hw); ++ ++ if (!in_interrupt()) ++ return rtl_lps_enter_core(hw); ++ rtlpriv->enter_ps = true; ++ schedule_work(&rtlpriv->works.lps_change_work); ++} ++EXPORT_SYMBOL_GPL(rtl_lps_enter); ++ ++void rtl_lps_leave(struct ieee80211_hw *hw) ++{ ++ struct rtl_priv *rtlpriv = rtl_priv(hw); ++ ++ if (!in_interrupt()) ++ return rtl_lps_leave_core(hw); ++ rtlpriv->enter_ps = false; ++ schedule_work(&rtlpriv->works.lps_change_work); ++} ++EXPORT_SYMBOL_GPL(rtl_lps_leave); ++ + void rtl_swlps_wq_callback(void *data) + { + struct rtl_works *rtlworks = container_of_dwork_rtl(data, +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index 42d8617352ae..e311a9bf2c90 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -2043,6 +2043,10 @@ bool pci_dev_run_wake(struct pci_dev *dev) + if (!dev->pme_support) + return false; + ++ /* PME-capable in principle, but not from the intended sleep state */ ++ if (!pci_pme_capable(dev, pci_target_state(dev))) ++ return false; ++ + while (bus->parent) { + struct pci_dev *bridge = bus->self; + +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index 131fee2b093e..a3661cc44f86 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -128,6 +128,15 @@ static const struct dmi_system_id asus_quirks[] = { + }, + { + .callback = dmi_matched, ++ .ident = "ASUSTeK COMPUTER INC. X45U", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "X45U"), ++ }, ++ .driver_data = &quirk_asus_wapf4, ++ }, ++ { ++ .callback = dmi_matched, + .ident = "ASUSTeK COMPUTER INC. X456UA", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), +diff --git a/drivers/regulator/stw481x-vmmc.c b/drivers/regulator/stw481x-vmmc.c +index 7d2ae3e9e942..342f5da79975 100644 +--- a/drivers/regulator/stw481x-vmmc.c ++++ b/drivers/regulator/stw481x-vmmc.c +@@ -47,7 +47,8 @@ static struct regulator_desc vmmc_regulator = { + .volt_table = stw481x_vmmc_voltages, + .enable_time = 200, /* FIXME: look this up */ + .enable_reg = STW_CONF1, +- .enable_mask = STW_CONF1_PDN_VMMC, ++ .enable_mask = STW_CONF1_PDN_VMMC | STW_CONF1_MMC_LS_STATUS, ++ .enable_val = STW_CONF1_PDN_VMMC, + .vsel_reg = STW_CONF1, + .vsel_mask = STW_CONF1_VMMC_MASK, + }; +diff --git a/drivers/s390/char/vmlogrdr.c b/drivers/s390/char/vmlogrdr.c +index 799c1524c779..4b8de3e70cf2 100644 +--- a/drivers/s390/char/vmlogrdr.c ++++ b/drivers/s390/char/vmlogrdr.c +@@ -872,7 +872,7 @@ static int __init vmlogrdr_init(void) + goto cleanup; + + for (i=0; i < MAXMINOR; ++i ) { +- sys_ser[i].buffer = (char *) get_zeroed_page(GFP_KERNEL); ++ sys_ser[i].buffer = (char *) get_zeroed_page(GFP_KERNEL | GFP_DMA); + if (!sys_ser[i].buffer) { + rc = -ENOMEM; + break; +diff --git a/drivers/s390/scsi/zfcp_dbf.c b/drivers/s390/scsi/zfcp_dbf.c +index 581001989937..d5bf36ec8a75 100644 +--- a/drivers/s390/scsi/zfcp_dbf.c ++++ b/drivers/s390/scsi/zfcp_dbf.c +@@ -289,11 +289,12 @@ void zfcp_dbf_rec_trig(char *tag, struct zfcp_adapter *adapter, + + + /** +- * zfcp_dbf_rec_run - trace event related to running recovery ++ * zfcp_dbf_rec_run_lvl - trace event related to running recovery ++ * @level: trace level to be used for event + * @tag: identifier for event + * @erp: erp_action running + */ +-void zfcp_dbf_rec_run(char *tag, struct zfcp_erp_action *erp) ++void zfcp_dbf_rec_run_lvl(int level, char *tag, struct zfcp_erp_action *erp) + { + struct zfcp_dbf *dbf = erp->adapter->dbf; + struct zfcp_dbf_rec *rec = &dbf->rec_buf; +@@ -319,11 +320,21 @@ void zfcp_dbf_rec_run(char *tag, struct zfcp_erp_action *erp) + else + rec->u.run.rec_count = atomic_read(&erp->adapter->erp_counter); + +- debug_event(dbf->rec, 1, rec, sizeof(*rec)); ++ debug_event(dbf->rec, level, rec, sizeof(*rec)); + spin_unlock_irqrestore(&dbf->rec_lock, flags); + } + + /** ++ * zfcp_dbf_rec_run - trace event related to running recovery ++ * @tag: identifier for event ++ * @erp: erp_action running ++ */ ++void zfcp_dbf_rec_run(char *tag, struct zfcp_erp_action *erp) ++{ ++ zfcp_dbf_rec_run_lvl(1, tag, erp); ++} ++ ++/** + * zfcp_dbf_rec_run_wka - trace wka port event with info like running recovery + * @tag: identifier for event + * @wka_port: well known address port +diff --git a/drivers/s390/scsi/zfcp_dbf.h b/drivers/s390/scsi/zfcp_dbf.h +index 36d07584271d..db186d44cfaf 100644 +--- a/drivers/s390/scsi/zfcp_dbf.h ++++ b/drivers/s390/scsi/zfcp_dbf.h +@@ -2,7 +2,7 @@ + * zfcp device driver + * debug feature declarations + * +- * Copyright IBM Corp. 2008, 2015 ++ * Copyright IBM Corp. 2008, 2016 + */ + + #ifndef ZFCP_DBF_H +@@ -283,6 +283,30 @@ struct zfcp_dbf { + struct zfcp_dbf_scsi scsi_buf; + }; + ++/** ++ * zfcp_dbf_hba_fsf_resp_suppress - true if we should not trace by default ++ * @req: request that has been completed ++ * ++ * Returns true if FCP response with only benign residual under count. ++ */ ++static inline ++bool zfcp_dbf_hba_fsf_resp_suppress(struct zfcp_fsf_req *req) ++{ ++ struct fsf_qtcb *qtcb = req->qtcb; ++ u32 fsf_stat = qtcb->header.fsf_status; ++ struct fcp_resp *fcp_rsp; ++ u8 rsp_flags, fr_status; ++ ++ if (qtcb->prefix.qtcb_type != FSF_IO_COMMAND) ++ return false; /* not an FCP response */ ++ fcp_rsp = (struct fcp_resp *)&qtcb->bottom.io.fcp_rsp; ++ rsp_flags = fcp_rsp->fr_flags; ++ fr_status = fcp_rsp->fr_status; ++ return (fsf_stat == FSF_FCP_RSP_AVAILABLE) && ++ (rsp_flags == FCP_RESID_UNDER) && ++ (fr_status == SAM_STAT_GOOD); ++} ++ + static inline + void zfcp_dbf_hba_fsf_resp(char *tag, int level, struct zfcp_fsf_req *req) + { +@@ -304,7 +328,9 @@ void zfcp_dbf_hba_fsf_response(struct zfcp_fsf_req *req) + zfcp_dbf_hba_fsf_resp("fs_perr", 1, req); + + } else if (qtcb->header.fsf_status != FSF_GOOD) { +- zfcp_dbf_hba_fsf_resp("fs_ferr", 1, req); ++ zfcp_dbf_hba_fsf_resp("fs_ferr", ++ zfcp_dbf_hba_fsf_resp_suppress(req) ++ ? 5 : 1, req); + + } else if ((req->fsf_command == FSF_QTCB_OPEN_PORT_WITH_DID) || + (req->fsf_command == FSF_QTCB_OPEN_LUN)) { +@@ -388,4 +414,15 @@ void zfcp_dbf_scsi_devreset(char *tag, struct scsi_cmnd *scmnd, u8 flag) + _zfcp_dbf_scsi(tmp_tag, 1, scmnd, NULL); + } + ++/** ++ * zfcp_dbf_scsi_nullcmnd() - trace NULLify of SCSI command in dev/tgt-reset. ++ * @scmnd: SCSI command that was NULLified. ++ * @fsf_req: request that owned @scmnd. ++ */ ++static inline void zfcp_dbf_scsi_nullcmnd(struct scsi_cmnd *scmnd, ++ struct zfcp_fsf_req *fsf_req) ++{ ++ _zfcp_dbf_scsi("scfc__1", 3, scmnd, fsf_req); ++} ++ + #endif /* ZFCP_DBF_H */ +diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c +index a59d678125bd..7ccfce559034 100644 +--- a/drivers/s390/scsi/zfcp_erp.c ++++ b/drivers/s390/scsi/zfcp_erp.c +@@ -3,7 +3,7 @@ + * + * Error Recovery Procedures (ERP). + * +- * Copyright IBM Corp. 2002, 2015 ++ * Copyright IBM Corp. 2002, 2016 + */ + + #define KMSG_COMPONENT "zfcp" +@@ -1204,6 +1204,62 @@ static void zfcp_erp_action_dequeue(struct zfcp_erp_action *erp_action) + } + } + ++/** ++ * zfcp_erp_try_rport_unblock - unblock rport if no more/new recovery ++ * @port: zfcp_port whose fc_rport we should try to unblock ++ */ ++static void zfcp_erp_try_rport_unblock(struct zfcp_port *port) ++{ ++ unsigned long flags; ++ struct zfcp_adapter *adapter = port->adapter; ++ int port_status; ++ struct Scsi_Host *shost = adapter->scsi_host; ++ struct scsi_device *sdev; ++ ++ write_lock_irqsave(&adapter->erp_lock, flags); ++ port_status = atomic_read(&port->status); ++ if ((port_status & ZFCP_STATUS_COMMON_UNBLOCKED) == 0 || ++ (port_status & (ZFCP_STATUS_COMMON_ERP_INUSE | ++ ZFCP_STATUS_COMMON_ERP_FAILED)) != 0) { ++ /* new ERP of severity >= port triggered elsewhere meanwhile or ++ * local link down (adapter erp_failed but not clear unblock) ++ */ ++ zfcp_dbf_rec_run_lvl(4, "ertru_p", &port->erp_action); ++ write_unlock_irqrestore(&adapter->erp_lock, flags); ++ return; ++ } ++ spin_lock(shost->host_lock); ++ __shost_for_each_device(sdev, shost) { ++ struct zfcp_scsi_dev *zsdev = sdev_to_zfcp(sdev); ++ int lun_status; ++ ++ if (zsdev->port != port) ++ continue; ++ /* LUN under port of interest */ ++ lun_status = atomic_read(&zsdev->status); ++ if ((lun_status & ZFCP_STATUS_COMMON_ERP_FAILED) != 0) ++ continue; /* unblock rport despite failed LUNs */ ++ /* LUN recovery not given up yet [maybe follow-up pending] */ ++ if ((lun_status & ZFCP_STATUS_COMMON_UNBLOCKED) == 0 || ++ (lun_status & ZFCP_STATUS_COMMON_ERP_INUSE) != 0) { ++ /* LUN blocked: ++ * not yet unblocked [LUN recovery pending] ++ * or meanwhile blocked [new LUN recovery triggered] ++ */ ++ zfcp_dbf_rec_run_lvl(4, "ertru_l", &zsdev->erp_action); ++ spin_unlock(shost->host_lock); ++ write_unlock_irqrestore(&adapter->erp_lock, flags); ++ return; ++ } ++ } ++ /* now port has no child or all children have completed recovery, ++ * and no ERP of severity >= port was meanwhile triggered elsewhere ++ */ ++ zfcp_scsi_schedule_rport_register(port); ++ spin_unlock(shost->host_lock); ++ write_unlock_irqrestore(&adapter->erp_lock, flags); ++} ++ + static void zfcp_erp_action_cleanup(struct zfcp_erp_action *act, int result) + { + struct zfcp_adapter *adapter = act->adapter; +@@ -1214,6 +1270,7 @@ static void zfcp_erp_action_cleanup(struct zfcp_erp_action *act, int result) + case ZFCP_ERP_ACTION_REOPEN_LUN: + if (!(act->status & ZFCP_STATUS_ERP_NO_REF)) + scsi_device_put(sdev); ++ zfcp_erp_try_rport_unblock(port); + break; + + case ZFCP_ERP_ACTION_REOPEN_PORT: +@@ -1224,7 +1281,7 @@ static void zfcp_erp_action_cleanup(struct zfcp_erp_action *act, int result) + */ + if (act->step != ZFCP_ERP_STEP_UNINITIALIZED) + if (result == ZFCP_ERP_SUCCEEDED) +- zfcp_scsi_schedule_rport_register(port); ++ zfcp_erp_try_rport_unblock(port); + /* fall through */ + case ZFCP_ERP_ACTION_REOPEN_PORT_FORCED: + put_device(&port->dev); +diff --git a/drivers/s390/scsi/zfcp_ext.h b/drivers/s390/scsi/zfcp_ext.h +index c8fed9fa1cca..21c8c689b02b 100644 +--- a/drivers/s390/scsi/zfcp_ext.h ++++ b/drivers/s390/scsi/zfcp_ext.h +@@ -3,7 +3,7 @@ + * + * External function declarations. + * +- * Copyright IBM Corp. 2002, 2015 ++ * Copyright IBM Corp. 2002, 2016 + */ + + #ifndef ZFCP_EXT_H +@@ -35,6 +35,8 @@ extern void zfcp_dbf_adapter_unregister(struct zfcp_adapter *); + extern void zfcp_dbf_rec_trig(char *, struct zfcp_adapter *, + struct zfcp_port *, struct scsi_device *, u8, u8); + extern void zfcp_dbf_rec_run(char *, struct zfcp_erp_action *); ++extern void zfcp_dbf_rec_run_lvl(int level, char *tag, ++ struct zfcp_erp_action *erp); + extern void zfcp_dbf_rec_run_wka(char *, struct zfcp_fc_wka_port *, u64); + extern void zfcp_dbf_hba_fsf_uss(char *, struct zfcp_fsf_req *); + extern void zfcp_dbf_hba_fsf_res(char *, int, struct zfcp_fsf_req *); +diff --git a/drivers/s390/scsi/zfcp_fsf.h b/drivers/s390/scsi/zfcp_fsf.h +index be1c04b334c5..ea3c76ac0de1 100644 +--- a/drivers/s390/scsi/zfcp_fsf.h ++++ b/drivers/s390/scsi/zfcp_fsf.h +@@ -3,7 +3,7 @@ + * + * Interface to the FSF support functions. + * +- * Copyright IBM Corp. 2002, 2015 ++ * Copyright IBM Corp. 2002, 2016 + */ + + #ifndef FSF_H +@@ -78,6 +78,7 @@ + #define FSF_APP_TAG_CHECK_FAILURE 0x00000082 + #define FSF_REF_TAG_CHECK_FAILURE 0x00000083 + #define FSF_ADAPTER_STATUS_AVAILABLE 0x000000AD ++#define FSF_FCP_RSP_AVAILABLE 0x000000AF + #define FSF_UNKNOWN_COMMAND 0x000000E2 + #define FSF_UNKNOWN_OP_SUBTYPE 0x000000E3 + #define FSF_INVALID_COMMAND_OPTION 0x000000E5 +diff --git a/drivers/s390/scsi/zfcp_reqlist.h b/drivers/s390/scsi/zfcp_reqlist.h +index 7c2c6194dfca..703fce59befe 100644 +--- a/drivers/s390/scsi/zfcp_reqlist.h ++++ b/drivers/s390/scsi/zfcp_reqlist.h +@@ -4,7 +4,7 @@ + * Data structure and helper functions for tracking pending FSF + * requests. + * +- * Copyright IBM Corp. 2009 ++ * Copyright IBM Corp. 2009, 2016 + */ + + #ifndef ZFCP_REQLIST_H +@@ -180,4 +180,32 @@ static inline void zfcp_reqlist_move(struct zfcp_reqlist *rl, + spin_unlock_irqrestore(&rl->lock, flags); + } + ++/** ++ * zfcp_reqlist_apply_for_all() - apply a function to every request. ++ * @rl: the requestlist that contains the target requests. ++ * @f: the function to apply to each request; the first parameter of the ++ * function will be the target-request; the second parameter is the same ++ * pointer as given with the argument @data. ++ * @data: freely chosen argument; passed through to @f as second parameter. ++ * ++ * Uses :c:macro:`list_for_each_entry` to iterate over the lists in the hash- ++ * table (not a 'safe' variant, so don't modify the list). ++ * ++ * Holds @rl->lock over the entire request-iteration. ++ */ ++static inline void ++zfcp_reqlist_apply_for_all(struct zfcp_reqlist *rl, ++ void (*f)(struct zfcp_fsf_req *, void *), void *data) ++{ ++ struct zfcp_fsf_req *req; ++ unsigned long flags; ++ unsigned int i; ++ ++ spin_lock_irqsave(&rl->lock, flags); ++ for (i = 0; i < ZFCP_REQ_LIST_BUCKETS; i++) ++ list_for_each_entry(req, &rl->buckets[i], list) ++ f(req, data); ++ spin_unlock_irqrestore(&rl->lock, flags); ++} ++ + #endif /* ZFCP_REQLIST_H */ +diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c +index 9069f98a1817..07ffdbb5107f 100644 +--- a/drivers/s390/scsi/zfcp_scsi.c ++++ b/drivers/s390/scsi/zfcp_scsi.c +@@ -3,7 +3,7 @@ + * + * Interface to Linux SCSI midlayer. + * +- * Copyright IBM Corp. 2002, 2015 ++ * Copyright IBM Corp. 2002, 2016 + */ + + #define KMSG_COMPONENT "zfcp" +@@ -88,9 +88,7 @@ int zfcp_scsi_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scpnt) + } + + if (unlikely(!(status & ZFCP_STATUS_COMMON_UNBLOCKED))) { +- /* This could be either +- * open LUN pending: this is temporary, will result in +- * open LUN or ERP_FAILED, so retry command ++ /* This could be + * call to rport_delete pending: mimic retry from + * fc_remote_port_chkready until rport is BLOCKED + */ +@@ -209,6 +207,57 @@ static int zfcp_scsi_eh_abort_handler(struct scsi_cmnd *scpnt) + return retval; + } + ++struct zfcp_scsi_req_filter { ++ u8 tmf_scope; ++ u32 lun_handle; ++ u32 port_handle; ++}; ++ ++static void zfcp_scsi_forget_cmnd(struct zfcp_fsf_req *old_req, void *data) ++{ ++ struct zfcp_scsi_req_filter *filter = ++ (struct zfcp_scsi_req_filter *)data; ++ ++ /* already aborted - prevent side-effects - or not a SCSI command */ ++ if (old_req->data == NULL || old_req->fsf_command != FSF_QTCB_FCP_CMND) ++ return; ++ ++ /* (tmf_scope == FCP_TMF_TGT_RESET || tmf_scope == FCP_TMF_LUN_RESET) */ ++ if (old_req->qtcb->header.port_handle != filter->port_handle) ++ return; ++ ++ if (filter->tmf_scope == FCP_TMF_LUN_RESET && ++ old_req->qtcb->header.lun_handle != filter->lun_handle) ++ return; ++ ++ zfcp_dbf_scsi_nullcmnd((struct scsi_cmnd *)old_req->data, old_req); ++ old_req->data = NULL; ++} ++ ++static void zfcp_scsi_forget_cmnds(struct zfcp_scsi_dev *zsdev, u8 tm_flags) ++{ ++ struct zfcp_adapter *adapter = zsdev->port->adapter; ++ struct zfcp_scsi_req_filter filter = { ++ .tmf_scope = FCP_TMF_TGT_RESET, ++ .port_handle = zsdev->port->handle, ++ }; ++ unsigned long flags; ++ ++ if (tm_flags == FCP_TMF_LUN_RESET) { ++ filter.tmf_scope = FCP_TMF_LUN_RESET; ++ filter.lun_handle = zsdev->lun_handle; ++ } ++ ++ /* ++ * abort_lock secures against other processings - in the abort-function ++ * and normal cmnd-handler - of (struct zfcp_fsf_req *)->data ++ */ ++ write_lock_irqsave(&adapter->abort_lock, flags); ++ zfcp_reqlist_apply_for_all(adapter->req_list, zfcp_scsi_forget_cmnd, ++ &filter); ++ write_unlock_irqrestore(&adapter->abort_lock, flags); ++} ++ + static int zfcp_task_mgmt_function(struct scsi_cmnd *scpnt, u8 tm_flags) + { + struct zfcp_scsi_dev *zfcp_sdev = sdev_to_zfcp(scpnt->device); +@@ -241,8 +290,10 @@ static int zfcp_task_mgmt_function(struct scsi_cmnd *scpnt, u8 tm_flags) + if (fsf_req->status & ZFCP_STATUS_FSFREQ_TMFUNCFAILED) { + zfcp_dbf_scsi_devreset("fail", scpnt, tm_flags); + retval = FAILED; +- } else ++ } else { + zfcp_dbf_scsi_devreset("okay", scpnt, tm_flags); ++ zfcp_scsi_forget_cmnds(zfcp_sdev, tm_flags); ++ } + + zfcp_fsf_req_free(fsf_req); + return retval; +diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c +index 021b994fdae8..96007633ad39 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c ++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c +@@ -1856,6 +1856,8 @@ megasas_build_syspd_fusion(struct megasas_instance *instance, + io_request->DevHandle = pd_sync->seq[pd_index].devHandle; + pRAID_Context->regLockFlags |= + (MR_RL_FLAGS_SEQ_NUM_ENABLE|MR_RL_FLAGS_GRANT_DESTINATION_CUDA); ++ pRAID_Context->Type = MPI2_TYPE_CUDA; ++ pRAID_Context->nseg = 0x1; + } else if (fusion->fast_path_io) { + pRAID_Context->VirtualDiskTgtId = cpu_to_le16(device_id); + pRAID_Context->configSeqNum = 0; +@@ -1891,12 +1893,10 @@ megasas_build_syspd_fusion(struct megasas_instance *instance, + pRAID_Context->timeoutValue = + cpu_to_le16((os_timeout_value > timeout_limit) ? + timeout_limit : os_timeout_value); +- if (fusion->adapter_type == INVADER_SERIES) { +- pRAID_Context->Type = MPI2_TYPE_CUDA; +- pRAID_Context->nseg = 0x1; ++ if (fusion->adapter_type == INVADER_SERIES) + io_request->IoFlags |= + cpu_to_le16(MPI25_SAS_DEVICE0_FLAGS_ENABLED_FAST_PATH); +- } ++ + cmd->request_desc->SCSIIO.RequestFlags = + (MPI2_REQ_DESCRIPT_FLAGS_HIGH_PRIORITY << + MEGASAS_REQ_DESCRIPT_FLAGS_TYPE_SHIFT); +@@ -2648,6 +2648,7 @@ int megasas_wait_for_outstanding_fusion(struct megasas_instance *instance, + dev_err(&instance->pdev->dev, "pending commands remain after waiting, " + "will reset adapter scsi%d.\n", + instance->host->host_no); ++ *convert = 1; + retval = 1; + } + out: +diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c +index 7232d43e2207..4477e999ec70 100644 +--- a/drivers/scsi/scsi_sysfs.c ++++ b/drivers/scsi/scsi_sysfs.c +@@ -1031,10 +1031,6 @@ int scsi_sysfs_add_sdev(struct scsi_device *sdev) + struct request_queue *rq = sdev->request_queue; + struct scsi_target *starget = sdev->sdev_target; + +- error = scsi_device_set_state(sdev, SDEV_RUNNING); +- if (error) +- return error; +- + error = scsi_target_add(starget); + if (error) + return error; +diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c +index ae7d9bdf409c..a1c29b0afb22 100644 +--- a/drivers/scsi/sg.c ++++ b/drivers/scsi/sg.c +@@ -592,6 +592,9 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos) + sg_io_hdr_t *hp; + unsigned char cmnd[SG_MAX_CDB_SIZE]; + ++ if (unlikely(segment_eq(get_fs(), KERNEL_DS))) ++ return -EINVAL; ++ + if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp))) + return -ENXIO; + SCSI_LOG_TIMEOUT(3, sg_printk(KERN_INFO, sdp, +diff --git a/drivers/ssb/pci.c b/drivers/ssb/pci.c +index 0f28c08fcb3c..77b551da5728 100644 +--- a/drivers/ssb/pci.c ++++ b/drivers/ssb/pci.c +@@ -909,6 +909,7 @@ static int ssb_pci_sprom_get(struct ssb_bus *bus, + if (err) { + ssb_warn("WARNING: Using fallback SPROM failed (err %d)\n", + err); ++ goto out_free; + } else { + ssb_dbg("Using SPROM revision %d provided by platform\n", + sprom->revision); +diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c +index 35ab4a9ef95d..c975f6e8be49 100644 +--- a/drivers/staging/comedi/drivers/ni_mio_common.c ++++ b/drivers/staging/comedi/drivers/ni_mio_common.c +@@ -1929,7 +1929,7 @@ static int ni_ai_insn_read(struct comedi_device *dev, + unsigned int *data) + { + struct ni_private *devpriv = dev->private; +- unsigned int mask = (s->maxdata + 1) >> 1; ++ unsigned int mask = s->maxdata; + int i, n; + unsigned signbits; + unsigned int d; +@@ -1972,7 +1972,7 @@ static int ni_ai_insn_read(struct comedi_device *dev, + return -ETIME; + } + d += signbits; +- data[n] = d; ++ data[n] = d & 0xffff; + } + } else if (devpriv->is_6143) { + for (n = 0; n < insn->n; n++) { +@@ -2017,8 +2017,8 @@ static int ni_ai_insn_read(struct comedi_device *dev, + data[n] = dl; + } else { + d = ni_readw(dev, NI_E_AI_FIFO_DATA_REG); +- d += signbits; /* subtle: needs to be short addition */ +- data[n] = d; ++ d += signbits; ++ data[n] = d & 0xffff; + } + } + } +diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c +index 5e6d6cb348fc..a7d30e894cab 100644 +--- a/drivers/target/target_core_user.c ++++ b/drivers/target/target_core_user.c +@@ -645,8 +645,6 @@ static int tcmu_check_expired_cmd(int id, void *p, void *data) + target_complete_cmd(cmd->se_cmd, SAM_STAT_CHECK_CONDITION); + cmd->se_cmd = NULL; + +- kmem_cache_free(tcmu_cmd_cache, cmd); +- + return 0; + } + +diff --git a/drivers/thermal/thermal_hwmon.c b/drivers/thermal/thermal_hwmon.c +index 06fd2ed9ef9d..705b0cafedbb 100644 +--- a/drivers/thermal/thermal_hwmon.c ++++ b/drivers/thermal/thermal_hwmon.c +@@ -98,7 +98,7 @@ temp_crit_show(struct device *dev, struct device_attribute *attr, char *buf) + int temperature; + int ret; + +- ret = tz->ops->get_trip_temp(tz, 0, &temperature); ++ ret = tz->ops->get_crit_temp(tz, &temperature); + if (ret) + return ret; + +diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c +index edb5305b9d4d..7d5ee8a13ac6 100644 +--- a/drivers/tty/serial/sc16is7xx.c ++++ b/drivers/tty/serial/sc16is7xx.c +@@ -1230,7 +1230,7 @@ static int sc16is7xx_probe(struct device *dev, + + /* Setup interrupt */ + ret = devm_request_irq(dev, irq, sc16is7xx_irq, +- IRQF_ONESHOT | flags, dev_name(dev), s); ++ flags, dev_name(dev), s); + if (!ret) + return 0; + +diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c +index 41987a55a538..988c564b61a8 100644 +--- a/drivers/tty/vt/keyboard.c ++++ b/drivers/tty/vt/keyboard.c +@@ -982,7 +982,7 @@ static void kbd_led_trigger_activate(struct led_classdev *cdev) + KBD_LED_TRIGGER((_led_bit) + 8, _name) + + static struct kbd_led_trigger kbd_led_triggers[] = { +- KBD_LED_TRIGGER(VC_SCROLLOCK, "kbd-scrollock"), ++ KBD_LED_TRIGGER(VC_SCROLLOCK, "kbd-scrolllock"), + KBD_LED_TRIGGER(VC_NUMLOCK, "kbd-numlock"), + KBD_LED_TRIGGER(VC_CAPSLOCK, "kbd-capslock"), + KBD_LED_TRIGGER(VC_KANALOCK, "kbd-kanalock"), +diff --git a/fs/block_dev.c b/fs/block_dev.c +index f10dbac851a1..198aea66fe71 100644 +--- a/fs/block_dev.c ++++ b/fs/block_dev.c +@@ -1806,6 +1806,7 @@ void iterate_bdevs(void (*func)(struct block_device *, void *), void *arg) + spin_lock(&blockdev_superblock->s_inode_list_lock); + list_for_each_entry(inode, &blockdev_superblock->s_inodes, i_sb_list) { + struct address_space *mapping = inode->i_mapping; ++ struct block_device *bdev; + + spin_lock(&inode->i_lock); + if (inode->i_state & (I_FREEING|I_WILL_FREE|I_NEW) || +@@ -1826,8 +1827,12 @@ void iterate_bdevs(void (*func)(struct block_device *, void *), void *arg) + */ + iput(old_inode); + old_inode = inode; ++ bdev = I_BDEV(inode); + +- func(I_BDEV(inode), arg); ++ mutex_lock(&bdev->bd_mutex); ++ if (bdev->bd_openers) ++ func(bdev, arg); ++ mutex_unlock(&bdev->bd_mutex); + + spin_lock(&blockdev_superblock->s_inode_list_lock); + } +diff --git a/fs/nfs/file.c b/fs/nfs/file.c +index 93e236429c5d..dc875cd0e11d 100644 +--- a/fs/nfs/file.c ++++ b/fs/nfs/file.c +@@ -407,7 +407,7 @@ static int nfs_write_end(struct file *file, struct address_space *mapping, + */ + if (!PageUptodate(page)) { + unsigned pglen = nfs_page_length(page); +- unsigned end = offset + len; ++ unsigned end = offset + copied; + + if (pglen == 0) { + zero_user_segments(page, 0, offset, +diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h +index 2c7bdb81d30c..b5f3693fe5b6 100644 +--- a/include/net/cfg80211.h ++++ b/include/net/cfg80211.h +@@ -4258,6 +4258,17 @@ void cfg80211_rx_assoc_resp(struct net_device *dev, + void cfg80211_assoc_timeout(struct net_device *dev, struct cfg80211_bss *bss); + + /** ++ * cfg80211_abandon_assoc - notify cfg80211 of abandoned association attempt ++ * @dev: network device ++ * @bss: The BSS entry with which association was abandoned. ++ * ++ * Call this whenever - for reasons reported through other API, like deauth RX, ++ * an association attempt was abandoned. ++ * This function may sleep. The caller must hold the corresponding wdev's mutex. ++ */ ++void cfg80211_abandon_assoc(struct net_device *dev, struct cfg80211_bss *bss); ++ ++/** + * cfg80211_tx_mlme_mgmt - notification of transmitted deauth/disassoc frame + * @dev: network device + * @buf: 802.11 frame (header + body) +diff --git a/include/rdma/ib_addr.h b/include/rdma/ib_addr.h +index 11528591d0d7..a78ff97eb249 100644 +--- a/include/rdma/ib_addr.h ++++ b/include/rdma/ib_addr.h +@@ -197,10 +197,12 @@ static inline void iboe_addr_get_sgid(struct rdma_dev_addr *dev_addr, + + dev = dev_get_by_index(&init_net, dev_addr->bound_dev_if); + if (dev) { +- ip4 = (struct in_device *)dev->ip_ptr; +- if (ip4 && ip4->ifa_list && ip4->ifa_list->ifa_address) ++ ip4 = in_dev_get(dev); ++ if (ip4 && ip4->ifa_list && ip4->ifa_list->ifa_address) { + ipv6_addr_set_v4mapped(ip4->ifa_list->ifa_address, + (struct in6_addr *)gid); ++ in_dev_put(ip4); ++ } + dev_put(dev); + } + } +diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c +index 445601c580d6..738012d68117 100644 +--- a/kernel/time/timekeeping.c ++++ b/kernel/time/timekeeping.c +@@ -298,10 +298,10 @@ u32 (*arch_gettimeoffset)(void) = default_arch_gettimeoffset; + static inline u32 arch_gettimeoffset(void) { return 0; } + #endif + +-static inline s64 timekeeping_delta_to_ns(struct tk_read_base *tkr, ++static inline u64 timekeeping_delta_to_ns(struct tk_read_base *tkr, + cycle_t delta) + { +- s64 nsec; ++ u64 nsec; + + nsec = delta * tkr->mult + tkr->xtime_nsec; + nsec >>= tkr->shift; +diff --git a/kernel/trace/trace_functions_graph.c b/kernel/trace/trace_functions_graph.c +index a663cbb84107..7fd6f5a26143 100644 +--- a/kernel/trace/trace_functions_graph.c ++++ b/kernel/trace/trace_functions_graph.c +@@ -780,6 +780,10 @@ print_graph_entry_leaf(struct trace_iterator *iter, + + cpu_data = per_cpu_ptr(data->cpu_data, cpu); + ++ /* If a graph tracer ignored set_graph_notrace */ ++ if (call->depth < -1) ++ call->depth += FTRACE_NOTRACE_DEPTH; ++ + /* + * Comments display at + 1 to depth. Since + * this is a leaf function, keep the comments +@@ -788,7 +792,8 @@ print_graph_entry_leaf(struct trace_iterator *iter, + cpu_data->depth = call->depth - 1; + + /* No need to keep this function around for this depth */ +- if (call->depth < FTRACE_RETFUNC_DEPTH) ++ if (call->depth < FTRACE_RETFUNC_DEPTH && ++ !WARN_ON_ONCE(call->depth < 0)) + cpu_data->enter_funcs[call->depth] = 0; + } + +@@ -818,11 +823,16 @@ print_graph_entry_nested(struct trace_iterator *iter, + struct fgraph_cpu_data *cpu_data; + int cpu = iter->cpu; + ++ /* If a graph tracer ignored set_graph_notrace */ ++ if (call->depth < -1) ++ call->depth += FTRACE_NOTRACE_DEPTH; ++ + cpu_data = per_cpu_ptr(data->cpu_data, cpu); + cpu_data->depth = call->depth; + + /* Save this function pointer to see if the exit matches */ +- if (call->depth < FTRACE_RETFUNC_DEPTH) ++ if (call->depth < FTRACE_RETFUNC_DEPTH && ++ !WARN_ON_ONCE(call->depth < 0)) + cpu_data->enter_funcs[call->depth] = call->func; + } + +@@ -1052,7 +1062,8 @@ print_graph_return(struct ftrace_graph_ret *trace, struct trace_seq *s, + */ + cpu_data->depth = trace->depth - 1; + +- if (trace->depth < FTRACE_RETFUNC_DEPTH) { ++ if (trace->depth < FTRACE_RETFUNC_DEPTH && ++ !WARN_ON_ONCE(trace->depth < 0)) { + if (cpu_data->enter_funcs[trace->depth] != trace->func) + func_match = 0; + cpu_data->enter_funcs[trace->depth] = 0; +diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c +index 63ae5dd24fc5..b8d927c56494 100644 +--- a/net/ceph/messenger.c ++++ b/net/ceph/messenger.c +@@ -2042,6 +2042,19 @@ static int process_connect(struct ceph_connection *con) + + dout("process_connect on %p tag %d\n", con, (int)con->in_tag); + ++ if (con->auth_reply_buf) { ++ /* ++ * Any connection that defines ->get_authorizer() ++ * should also define ->verify_authorizer_reply(). ++ * See get_connect_authorizer(). ++ */ ++ ret = con->ops->verify_authorizer_reply(con, 0); ++ if (ret < 0) { ++ con->error_msg = "bad authorize reply"; ++ return ret; ++ } ++ } ++ + switch (con->in_reply.tag) { + case CEPH_MSGR_TAG_FEATURES: + pr_err("%s%lld %s feature set mismatch," +diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c +index 83097c3832d1..23095d5e0199 100644 +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -2517,7 +2517,7 @@ static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata, + } + + static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata, +- bool assoc) ++ bool assoc, bool abandon) + { + struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data; + +@@ -2539,6 +2539,9 @@ static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata, + mutex_lock(&sdata->local->mtx); + ieee80211_vif_release_channel(sdata); + mutex_unlock(&sdata->local->mtx); ++ ++ if (abandon) ++ cfg80211_abandon_assoc(sdata->dev, assoc_data->bss); + } + + kfree(assoc_data); +@@ -2768,7 +2771,7 @@ static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata, + bssid, reason_code, + ieee80211_get_reason_code_string(reason_code)); + +- ieee80211_destroy_assoc_data(sdata, false); ++ ieee80211_destroy_assoc_data(sdata, false, true); + + cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len); + return; +@@ -3173,14 +3176,14 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata, + if (status_code != WLAN_STATUS_SUCCESS) { + sdata_info(sdata, "%pM denied association (code=%d)\n", + mgmt->sa, status_code); +- ieee80211_destroy_assoc_data(sdata, false); ++ ieee80211_destroy_assoc_data(sdata, false, false); + event.u.mlme.status = MLME_DENIED; + event.u.mlme.reason = status_code; + drv_event_callback(sdata->local, sdata, &event); + } else { + if (!ieee80211_assoc_success(sdata, bss, mgmt, len)) { + /* oops -- internal error -- send timeout for now */ +- ieee80211_destroy_assoc_data(sdata, false); ++ ieee80211_destroy_assoc_data(sdata, false, false); + cfg80211_assoc_timeout(sdata->dev, bss); + return; + } +@@ -3193,7 +3196,7 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata, + * recalc after assoc_data is NULL but before associated + * is set can cause the interface to go idle + */ +- ieee80211_destroy_assoc_data(sdata, true); ++ ieee80211_destroy_assoc_data(sdata, true, false); + + /* get uapsd queues configuration */ + uapsd_queues = 0; +@@ -3888,7 +3891,7 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata) + .u.mlme.status = MLME_TIMEOUT, + }; + +- ieee80211_destroy_assoc_data(sdata, false); ++ ieee80211_destroy_assoc_data(sdata, false, false); + cfg80211_assoc_timeout(sdata->dev, bss); + drv_event_callback(sdata->local, sdata, &event); + } +@@ -4029,7 +4032,7 @@ void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata) + WLAN_REASON_DEAUTH_LEAVING, + false, frame_buf); + if (ifmgd->assoc_data) +- ieee80211_destroy_assoc_data(sdata, false); ++ ieee80211_destroy_assoc_data(sdata, false, true); + if (ifmgd->auth_data) + ieee80211_destroy_auth_data(sdata, false); + cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf, +@@ -4905,7 +4908,7 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata, + IEEE80211_STYPE_DEAUTH, + req->reason_code, tx, + frame_buf); +- ieee80211_destroy_assoc_data(sdata, false); ++ ieee80211_destroy_assoc_data(sdata, false, true); + ieee80211_report_disconnect(sdata, frame_buf, + sizeof(frame_buf), true, + req->reason_code); +@@ -4980,7 +4983,7 @@ void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata) + sdata_lock(sdata); + if (ifmgd->assoc_data) { + struct cfg80211_bss *bss = ifmgd->assoc_data->bss; +- ieee80211_destroy_assoc_data(sdata, false); ++ ieee80211_destroy_assoc_data(sdata, false, false); + cfg80211_assoc_timeout(sdata->dev, bss); + } + if (ifmgd->auth_data) +diff --git a/net/wireless/core.h b/net/wireless/core.h +index 47a967fed8ff..47ea169aa0a3 100644 +--- a/net/wireless/core.h ++++ b/net/wireless/core.h +@@ -398,6 +398,7 @@ void cfg80211_sme_disassoc(struct wireless_dev *wdev); + void cfg80211_sme_deauth(struct wireless_dev *wdev); + void cfg80211_sme_auth_timeout(struct wireless_dev *wdev); + void cfg80211_sme_assoc_timeout(struct wireless_dev *wdev); ++void cfg80211_sme_abandon_assoc(struct wireless_dev *wdev); + + /* internal helpers */ + bool cfg80211_supported_cipher_suite(struct wiphy *wiphy, u32 cipher); +diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c +index fb44fa3bf4ef..c0e02f72e931 100644 +--- a/net/wireless/mlme.c ++++ b/net/wireless/mlme.c +@@ -149,6 +149,18 @@ void cfg80211_assoc_timeout(struct net_device *dev, struct cfg80211_bss *bss) + } + EXPORT_SYMBOL(cfg80211_assoc_timeout); + ++void cfg80211_abandon_assoc(struct net_device *dev, struct cfg80211_bss *bss) ++{ ++ struct wireless_dev *wdev = dev->ieee80211_ptr; ++ struct wiphy *wiphy = wdev->wiphy; ++ ++ cfg80211_sme_abandon_assoc(wdev); ++ ++ cfg80211_unhold_bss(bss_from_pub(bss)); ++ cfg80211_put_bss(wiphy, bss); ++} ++EXPORT_SYMBOL(cfg80211_abandon_assoc); ++ + void cfg80211_tx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len) + { + struct wireless_dev *wdev = dev->ieee80211_ptr; +diff --git a/net/wireless/sme.c b/net/wireless/sme.c +index 8020b5b094d4..18b4a652cf41 100644 +--- a/net/wireless/sme.c ++++ b/net/wireless/sme.c +@@ -39,6 +39,7 @@ struct cfg80211_conn { + CFG80211_CONN_ASSOCIATING, + CFG80211_CONN_ASSOC_FAILED, + CFG80211_CONN_DEAUTH, ++ CFG80211_CONN_ABANDON, + CFG80211_CONN_CONNECTED, + } state; + u8 bssid[ETH_ALEN], prev_bssid[ETH_ALEN]; +@@ -204,6 +205,8 @@ static int cfg80211_conn_do_work(struct wireless_dev *wdev) + cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid, + NULL, 0, + WLAN_REASON_DEAUTH_LEAVING, false); ++ /* fall through */ ++ case CFG80211_CONN_ABANDON: + /* free directly, disconnected event already sent */ + cfg80211_sme_free(wdev); + return 0; +@@ -423,6 +426,17 @@ void cfg80211_sme_assoc_timeout(struct wireless_dev *wdev) + schedule_work(&rdev->conn_work); + } + ++void cfg80211_sme_abandon_assoc(struct wireless_dev *wdev) ++{ ++ struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); ++ ++ if (!wdev->conn) ++ return; ++ ++ wdev->conn->state = CFG80211_CONN_ABANDON; ++ schedule_work(&rdev->conn_work); ++} ++ + static int cfg80211_sme_get_conn_ies(struct wireless_dev *wdev, + const u8 *ies, size_t ies_len, + const u8 **out_ies, size_t *out_ies_len) +diff --git a/scripts/kconfig/nconf.gui.c b/scripts/kconfig/nconf.gui.c +index 8275f0e55106..4b2f44c20caf 100644 +--- a/scripts/kconfig/nconf.gui.c ++++ b/scripts/kconfig/nconf.gui.c +@@ -364,12 +364,14 @@ int dialog_inputbox(WINDOW *main_window, + WINDOW *prompt_win; + WINDOW *form_win; + PANEL *panel; +- int i, x, y; ++ int i, x, y, lines, columns, win_lines, win_cols; + int res = -1; + int cursor_position = strlen(init); + int cursor_form_win; + char *result = *resultp; + ++ getmaxyx(stdscr, lines, columns); ++ + if (strlen(init)+1 > *result_len) { + *result_len = strlen(init)+1; + *resultp = result = realloc(result, *result_len); +@@ -386,14 +388,19 @@ int dialog_inputbox(WINDOW *main_window, + if (title) + prompt_width = max(prompt_width, strlen(title)); + ++ win_lines = min(prompt_lines+6, lines-2); ++ win_cols = min(prompt_width+7, columns-2); ++ prompt_lines = max(win_lines-6, 0); ++ prompt_width = max(win_cols-7, 0); ++ + /* place dialog in middle of screen */ +- y = (getmaxy(stdscr)-(prompt_lines+4))/2; +- x = (getmaxx(stdscr)-(prompt_width+4))/2; ++ y = (lines-win_lines)/2; ++ x = (columns-win_cols)/2; + + strncpy(result, init, *result_len); + + /* create the windows */ +- win = newwin(prompt_lines+6, prompt_width+7, y, x); ++ win = newwin(win_lines, win_cols, y, x); + prompt_win = derwin(win, prompt_lines+1, prompt_width, 2, 2); + form_win = derwin(win, 1, prompt_width, prompt_lines+3, 2); + keypad(form_win, TRUE);