From 422fc32fbefd66940362509aac9cfd3751d4ff13 Mon Sep 17 00:00:00 2001 From: zador-blood-stained Date: Thu, 26 May 2016 18:58:42 +0300 Subject: [PATCH] Move u-boot compilation targets to sources family configuration files Remove obsolete odroid-c2 upstream patches --- build-all.sh | 2 +- common.sh | 7 +- config/sources/marvell.conf | 2 + config/sources/odroidc2.conf | 2 + config/sources/s500.conf | 2 + .../odroidc2-default/patch-3.14.29-30.patch | 4387 ------------- .../odroidc2-default/patch-3.14.30-31.patch | 5703 ----------------- .../odroidc2-default/patch-3.14.31-32.patch | 1049 --- .../odroidc2-default/patch-3.14.32-33.patch | 721 --- .../odroidc2-default/patch-3.14.33-34.patch | 559 -- .../odroidc2-default/patch-3.14.34-35.patch | 2036 ------ .../odroidc2-default/patch-3.14.35-36.patch | 3448 ---------- .../odroidc2-default/patch-3.14.36-37.patch | 2847 -------- .../odroidc2-default/patch-3.14.37-38.patch | 1029 --- .../odroidc2-default/patch-3.14.38-39.patch | 1100 ---- .../odroidc2-default/patch-3.14.39-40.patch | 2442 ------- .../odroidc2-default/patch-3.14.40-41.patch | 3477 ---------- .../odroidc2-default/patch-3.14.41-42.patch | 1142 ---- .../odroidc2-default/patch-3.14.42-43.patch | 1548 ----- .../odroidc2-default/patch-3.14.43-44.patch | 1680 ----- .../odroidc2-default/patch-3.14.44-45.patch | 1273 ---- .../odroidc2-default/patch-3.14.45-46.patch | 334 - .../odroidc2-default/patch-3.14.46-47.patch | 944 --- .../odroidc2-default/patch-3.14.47-48.patch | 984 --- .../odroidc2-default/patch-3.14.48-49.patch | 4026 ------------ .../odroidc2-default/patch-3.14.49-50.patch | 700 -- .../odroidc2-default/patch-3.14.50-51.patch | 1929 ------ .../odroidc2-default/patch-3.14.51-52.patch | 568 -- .../odroidc2-default/patch-3.14.52-53.patch | 940 --- .../odroidc2-default/patch-3.14.53-54.patch | 3567 ----------- .../odroidc2-default/patch-3.14.54-55.patch | 2905 --------- .../odroidc2-default/patch-3.14.55-56.patch | 782 --- .../odroidc2-default/patch-3.14.56-57.patch | 975 --- .../odroidc2-default/patch-3.14.57-58.patch | 1007 --- .../odroidc2-default/patch-3.14.58-59.patch | 1452 ----- .../odroidc2-default/patch-3.14.59-60.patch | 1636 ----- .../odroidc2-default/patch-3.14.60-61.patch | 2765 -------- .../odroidc2-default/patch-3.14.61-62.patch | 2180 ------- .../odroidc2-default/patch-3.14.62-63.patch | 4346 ------------- .../odroidc2-default/patch-3.14.63-64.patch | 2736 -------- .../odroidc2-default/patch-3.14.64-65.patch | 1518 ----- 41 files changed, 8 insertions(+), 70742 deletions(-) delete mode 100644 patch/kernel/odroidc2-default/patch-3.14.29-30.patch delete mode 100644 patch/kernel/odroidc2-default/patch-3.14.30-31.patch delete mode 100644 patch/kernel/odroidc2-default/patch-3.14.31-32.patch delete mode 100644 patch/kernel/odroidc2-default/patch-3.14.32-33.patch delete mode 100644 patch/kernel/odroidc2-default/patch-3.14.33-34.patch delete mode 100644 patch/kernel/odroidc2-default/patch-3.14.34-35.patch delete mode 100644 patch/kernel/odroidc2-default/patch-3.14.35-36.patch delete mode 100644 patch/kernel/odroidc2-default/patch-3.14.36-37.patch delete mode 100644 patch/kernel/odroidc2-default/patch-3.14.37-38.patch delete mode 100644 patch/kernel/odroidc2-default/patch-3.14.38-39.patch delete mode 100644 patch/kernel/odroidc2-default/patch-3.14.39-40.patch delete mode 100644 patch/kernel/odroidc2-default/patch-3.14.40-41.patch delete mode 100644 patch/kernel/odroidc2-default/patch-3.14.41-42.patch delete mode 100644 patch/kernel/odroidc2-default/patch-3.14.42-43.patch delete mode 100644 patch/kernel/odroidc2-default/patch-3.14.43-44.patch delete mode 100644 patch/kernel/odroidc2-default/patch-3.14.44-45.patch delete mode 100644 patch/kernel/odroidc2-default/patch-3.14.45-46.patch delete mode 100644 patch/kernel/odroidc2-default/patch-3.14.46-47.patch delete mode 100644 patch/kernel/odroidc2-default/patch-3.14.47-48.patch delete mode 100644 patch/kernel/odroidc2-default/patch-3.14.48-49.patch delete mode 100644 patch/kernel/odroidc2-default/patch-3.14.49-50.patch delete mode 100644 patch/kernel/odroidc2-default/patch-3.14.50-51.patch delete mode 100644 patch/kernel/odroidc2-default/patch-3.14.51-52.patch delete mode 100644 patch/kernel/odroidc2-default/patch-3.14.52-53.patch delete mode 100644 patch/kernel/odroidc2-default/patch-3.14.53-54.patch delete mode 100644 patch/kernel/odroidc2-default/patch-3.14.54-55.patch delete mode 100644 patch/kernel/odroidc2-default/patch-3.14.55-56.patch delete mode 100644 patch/kernel/odroidc2-default/patch-3.14.56-57.patch delete mode 100644 patch/kernel/odroidc2-default/patch-3.14.57-58.patch delete mode 100644 patch/kernel/odroidc2-default/patch-3.14.58-59.patch delete mode 100644 patch/kernel/odroidc2-default/patch-3.14.59-60.patch delete mode 100644 patch/kernel/odroidc2-default/patch-3.14.60-61.patch delete mode 100644 patch/kernel/odroidc2-default/patch-3.14.61-62.patch delete mode 100644 patch/kernel/odroidc2-default/patch-3.14.62-63.patch delete mode 100644 patch/kernel/odroidc2-default/patch-3.14.63-64.patch delete mode 100644 patch/kernel/odroidc2-default/patch-3.14.64-65.patch diff --git a/build-all.sh b/build-all.sh index 30f33b1fba..a6a170c1a7 100644 --- a/build-all.sh +++ b/build-all.sh @@ -100,7 +100,7 @@ n=0 for line in "${buildlist[@]}"; do unset LINUXFAMILY LINUXCONFIG LINUXKERNEL LINUXSOURCE KERNELBRANCH BOOTLOADER BOOTSOURCE BOOTBRANCH ARCH UBOOT_NEEDS_GCC KERNEL_NEEDS_GCC \ CPUMIN CPUMAX UBOOT_VER KERNEL_VER GOVERNOR BOOTSIZE UBOOT_TOOLCHAIN KERNEL_TOOLCHAIN PACKAGE_LIST_EXCLUDE KERNEL_IMAGE_TYPE \ - write_uboot_platform family_tweaks UBOOT_FILES LOCALVERSION UBOOT_COMPILER KERNEL_COMPILER + write_uboot_platform family_tweaks UBOOT_FILES LOCALVERSION UBOOT_COMPILER KERNEL_COMPILER UBOOT_TARGET read BOARD BRANCH RELEASE BUILD_DESKTOP <<< $line n=$[$n+1] diff --git a/common.sh b/common.sh index cfe57993c4..f36339cc52 100644 --- a/common.sh +++ b/common.sh @@ -36,11 +36,6 @@ compile_uboot (){ display_alert "Compiler version" "${UBOOT_COMPILER}gcc $(eval ${UBOOT_TOOLCHAIN:+env PATH=$UBOOT_TOOLCHAIN:$PATH} ${UBOOT_COMPILER}gcc -dumpversion)" "info" cd $SOURCES/$BOOTSOURCEDIR - local cthreads=$CTHREADS - [[ $LINUXFAMILY == marvell ]] && local MAKEPARA="u-boot.mmc" - [[ $LINUXFAMILY == s500 ]] && local MAKEPARA="u-boot-dtb.img" - [[ $BOARD == odroidc2 ]] && local MAKEPARA="ARCH=arm" && local cthreads="" - eval ${UBOOT_TOOLCHAIN:+env PATH=$UBOOT_TOOLCHAIN:$PATH} 'make $CTHREADS $BOOTCONFIG CROSS_COMPILE="$CCACHE $UBOOT_COMPILER"' 2>&1 \ ${PROGRESS_LOG_TO_FILE:+' | tee -a $DEST/debug/compilation.log'} \ ${OUTPUT_VERYSILENT:+' >/dev/null 2>/dev/null'} @@ -57,7 +52,7 @@ compile_uboot (){ fi fi - eval ${UBOOT_TOOLCHAIN:+env PATH=$UBOOT_TOOLCHAIN:$PATH} 'make $MAKEPARA $cthreads CROSS_COMPILE="$CCACHE $UBOOT_COMPILER"' 2>&1 \ + eval ${UBOOT_TOOLCHAIN:+env PATH=$UBOOT_TOOLCHAIN:$PATH} 'make $UBOOT_TARGET $CTHREADS CROSS_COMPILE="$CCACHE $UBOOT_COMPILER"' 2>&1 \ ${PROGRESS_LOG_TO_FILE:+' | tee -a $DEST/debug/compilation.log'} \ ${OUTPUT_DIALOG:+' | dialog --backtitle "$backtitle" --progressbox "Compiling u-boot..." $TTY_Y $TTY_X'} \ ${OUTPUT_VERYSILENT:+' >/dev/null 2>/dev/null'} diff --git a/config/sources/marvell.conf b/config/sources/marvell.conf index 5b5b1814c5..d43eb4d444 100644 --- a/config/sources/marvell.conf +++ b/config/sources/marvell.conf @@ -4,6 +4,8 @@ BOOTSOURCE='u-boot-armada' UBOOT_NEEDS_GCC='< 5.0' +UBOOT_TARGET="u-boot.mmc" + case $BRANCH in default) LINUXKERNEL='https://github.com/SolidRun/linux-armada38x' diff --git a/config/sources/odroidc2.conf b/config/sources/odroidc2.conf index 78db6837f9..793decb2cc 100644 --- a/config/sources/odroidc2.conf +++ b/config/sources/odroidc2.conf @@ -4,6 +4,8 @@ BOOTSOURCE='u-boot-odroidc2' UBOOT_NEEDS_GCC='< 5.0' +UBOOT_TARGET="ARCH=arm" + LINUXKERNEL='https://github.com/hardkernel/linux' KERNELBRANCH='odroidc2-3.14.y' LINUXSOURCE='linux-odroidc2' diff --git a/config/sources/s500.conf b/config/sources/s500.conf index c6e96037c0..eecb728783 100644 --- a/config/sources/s500.conf +++ b/config/sources/s500.conf @@ -3,6 +3,8 @@ BOOTLOADER='https://github.com/LeMaker/u-boot-actions' BOOTBRANCH='s500-master' BOOTSOURCE='u-boot-s500' +UBOOT_TARGET="u-boot-dtb.img" + LINUXKERNEL='https://github.com/LeMaker/linux-actions' KERNELBRANCH='linux-3.10.y' LINUXSOURCE='linux-s500' diff --git a/patch/kernel/odroidc2-default/patch-3.14.29-30.patch b/patch/kernel/odroidc2-default/patch-3.14.29-30.patch deleted file mode 100644 index c39d88beee..0000000000 --- a/patch/kernel/odroidc2-default/patch-3.14.29-30.patch +++ /dev/null @@ -1,4387 +0,0 @@ -diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt -index 7116fda7077f..5d91ba1606bb 100644 ---- a/Documentation/kernel-parameters.txt -+++ b/Documentation/kernel-parameters.txt -@@ -1172,6 +1172,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted. - i8042.notimeout [HW] Ignore timeout condition signalled by controller - i8042.reset [HW] Reset the controller during init and cleanup - i8042.unlock [HW] Unlock (ignore) the keylock -+ i8042.kbdreset [HW] Reset device connected to KBD port - - i810= [HW,DRM] - -diff --git a/Makefile b/Makefile -index 7aff64ee4fb6..5b94752a85e3 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 3 - PATCHLEVEL = 14 --SUBLEVEL = 29 -+SUBLEVEL = 30 - EXTRAVERSION = - NAME = Remembering Coco - -diff --git a/arch/arc/boot/dts/nsimosci.dts b/arch/arc/boot/dts/nsimosci.dts -index 398064cef746..4c169d825415 100644 ---- a/arch/arc/boot/dts/nsimosci.dts -+++ b/arch/arc/boot/dts/nsimosci.dts -@@ -20,7 +20,7 @@ - /* this is for console on PGU */ - /* bootargs = "console=tty0 consoleblank=0"; */ - /* this is for console on serial */ -- bootargs = "earlycon=uart8250,mmio32,0xc0000000,115200n8 console=tty0 console=ttyS0,115200n8 consoleblank=0 debug"; -+ bootargs = "earlycon=uart8250,mmio32,0xf0000000,115200n8 console=tty0 console=ttyS0,115200n8 consoleblank=0 debug"; - }; - - aliases { -@@ -46,9 +46,9 @@ - #interrupt-cells = <1>; - }; - -- uart0: serial@c0000000 { -+ uart0: serial@f0000000 { - compatible = "ns8250"; -- reg = <0xc0000000 0x2000>; -+ reg = <0xf0000000 0x2000>; - interrupts = <11>; - clock-frequency = <3686400>; - baud = <115200>; -@@ -57,21 +57,21 @@ - no-loopback-test = <1>; - }; - -- pgu0: pgu@c9000000 { -+ pgu0: pgu@f9000000 { - compatible = "snps,arcpgufb"; -- reg = <0xc9000000 0x400>; -+ reg = <0xf9000000 0x400>; - }; - -- ps2: ps2@c9001000 { -+ ps2: ps2@f9001000 { - compatible = "snps,arc_ps2"; -- reg = <0xc9000400 0x14>; -+ reg = <0xf9000400 0x14>; - interrupts = <13>; - interrupt-names = "arc_ps2_irq"; - }; - -- eth0: ethernet@c0003000 { -+ eth0: ethernet@f0003000 { - compatible = "snps,oscilan"; -- reg = <0xc0003000 0x44>; -+ reg = <0xf0003000 0x44>; - interrupts = <7>, <8>; - interrupt-names = "rx", "tx"; - }; -diff --git a/arch/arc/include/asm/linkage.h b/arch/arc/include/asm/linkage.h -index 66ee5527aefc..5faad17118b4 100644 ---- a/arch/arc/include/asm/linkage.h -+++ b/arch/arc/include/asm/linkage.h -@@ -13,20 +13,6 @@ - - #define ASM_NL ` /* use '`' to mark new line in macro */ - --/* Can't use the ENTRY macro in linux/linkage.h -- * gas considers ';' as comment vs. newline -- */ --.macro ARC_ENTRY name -- .global \name -- .align 4 -- \name: --.endm -- --.macro ARC_EXIT name --#define ASM_PREV_SYM_ADDR(name) .-##name -- .size \ name, ASM_PREV_SYM_ADDR(\name) --.endm -- - /* annotation for data we want in DCCM - if enabled in .config */ - .macro ARCFP_DATA nm - #ifdef CONFIG_ARC_HAS_DCCM -diff --git a/arch/arc/kernel/ctx_sw_asm.S b/arch/arc/kernel/ctx_sw_asm.S -index 65690e7fcc8c..2ff0347a2fd7 100644 ---- a/arch/arc/kernel/ctx_sw_asm.S -+++ b/arch/arc/kernel/ctx_sw_asm.S -@@ -62,4 +62,4 @@ __switch_to: - ld.ab blink, [sp, 4] - j [blink] - --ARC_EXIT __switch_to -+END(__switch_to) -diff --git a/arch/arc/kernel/entry.S b/arch/arc/kernel/entry.S -index 6e8f83a32522..29b82adbf0b4 100644 ---- a/arch/arc/kernel/entry.S -+++ b/arch/arc/kernel/entry.S -@@ -141,7 +141,7 @@ VECTOR EV_Extension ; 0x130, Extn Intruction Excp (0x26) - VECTOR reserved ; Reserved Exceptions - .endr - --#include /* ARC_{EXTRY,EXIT} */ -+#include /* {EXTRY,EXIT} */ - #include /* SAVE_ALL_{INT1,INT2,SYS...} */ - #include - #include -@@ -184,7 +184,7 @@ reserved: ; processor restart - ; --------------------------------------------- - ; Level 2 ISR: Can interrupt a Level 1 ISR - ; --------------------------------------------- --ARC_ENTRY handle_interrupt_level2 -+ENTRY(handle_interrupt_level2) - - ; TODO-vineetg for SMP this wont work - ; free up r9 as scratchpad -@@ -225,14 +225,14 @@ ARC_ENTRY handle_interrupt_level2 - - b ret_from_exception - --ARC_EXIT handle_interrupt_level2 -+END(handle_interrupt_level2) - - #endif - - ; --------------------------------------------- - ; Level 1 ISR - ; --------------------------------------------- --ARC_ENTRY handle_interrupt_level1 -+ENTRY(handle_interrupt_level1) - - /* free up r9 as scratchpad */ - #ifdef CONFIG_SMP -@@ -265,7 +265,7 @@ ARC_ENTRY handle_interrupt_level1 - sr r8, [AUX_IRQ_LV12] ; clear bit in Sticky Status Reg - - b ret_from_exception --ARC_EXIT handle_interrupt_level1 -+END(handle_interrupt_level1) - - ;################### Non TLB Exception Handling ############################# - -@@ -273,7 +273,7 @@ ARC_EXIT handle_interrupt_level1 - ; Instruction Error Exception Handler - ; --------------------------------------------- - --ARC_ENTRY instr_service -+ENTRY(instr_service) - - EXCEPTION_PROLOGUE - -@@ -284,13 +284,13 @@ ARC_ENTRY instr_service - - bl do_insterror_or_kprobe - b ret_from_exception --ARC_EXIT instr_service -+END(instr_service) - - ; --------------------------------------------- - ; Memory Error Exception Handler - ; --------------------------------------------- - --ARC_ENTRY mem_service -+ENTRY(mem_service) - - EXCEPTION_PROLOGUE - -@@ -301,13 +301,13 @@ ARC_ENTRY mem_service - - bl do_memory_error - b ret_from_exception --ARC_EXIT mem_service -+END(mem_service) - - ; --------------------------------------------- - ; Machine Check Exception Handler - ; --------------------------------------------- - --ARC_ENTRY EV_MachineCheck -+ENTRY(EV_MachineCheck) - - EXCEPTION_PROLOGUE - -@@ -331,13 +331,13 @@ ARC_ENTRY EV_MachineCheck - - j do_machine_check_fault - --ARC_EXIT EV_MachineCheck -+END(EV_MachineCheck) - - ; --------------------------------------------- - ; Protection Violation Exception Handler - ; --------------------------------------------- - --ARC_ENTRY EV_TLBProtV -+ENTRY(EV_TLBProtV) - - EXCEPTION_PROLOGUE - -@@ -385,12 +385,12 @@ ARC_ENTRY EV_TLBProtV - - b ret_from_exception - --ARC_EXIT EV_TLBProtV -+END(EV_TLBProtV) - - ; --------------------------------------------- - ; Privilege Violation Exception Handler - ; --------------------------------------------- --ARC_ENTRY EV_PrivilegeV -+ENTRY(EV_PrivilegeV) - - EXCEPTION_PROLOGUE - -@@ -401,12 +401,12 @@ ARC_ENTRY EV_PrivilegeV - - bl do_privilege_fault - b ret_from_exception --ARC_EXIT EV_PrivilegeV -+END(EV_PrivilegeV) - - ; --------------------------------------------- - ; Extension Instruction Exception Handler - ; --------------------------------------------- --ARC_ENTRY EV_Extension -+ENTRY(EV_Extension) - - EXCEPTION_PROLOGUE - -@@ -417,7 +417,7 @@ ARC_ENTRY EV_Extension - - bl do_extension_fault - b ret_from_exception --ARC_EXIT EV_Extension -+END(EV_Extension) - - ;######################### System Call Tracing ######################### - -@@ -504,7 +504,7 @@ trap_with_param: - ; (2) Break Points - ;------------------------------------------------------------------ - --ARC_ENTRY EV_Trap -+ENTRY(EV_Trap) - - EXCEPTION_PROLOGUE - -@@ -534,9 +534,9 @@ ARC_ENTRY EV_Trap - jl [r9] ; Entry into Sys Call Handler - - ; fall through to ret_from_system_call --ARC_EXIT EV_Trap -+END(EV_Trap) - --ARC_ENTRY ret_from_system_call -+ENTRY(ret_from_system_call) - - st r0, [sp, PT_r0] ; sys call return value in pt_regs - -@@ -546,7 +546,7 @@ ARC_ENTRY ret_from_system_call - ; - ; If ret to user mode do we need to handle signals, schedule() et al. - --ARC_ENTRY ret_from_exception -+ENTRY(ret_from_exception) - - ; Pre-{IRQ,Trap,Exception} K/U mode from pt_regs->status32 - ld r8, [sp, PT_status32] ; returning to User/Kernel Mode -@@ -728,9 +728,9 @@ not_level1_interrupt: - debug_marker_syscall: - rtie - --ARC_EXIT ret_from_exception -+END(ret_from_exception) - --ARC_ENTRY ret_from_fork -+ENTRY(ret_from_fork) - ; when the forked child comes here from the __switch_to function - ; r0 has the last task pointer. - ; put last task in scheduler queue -@@ -747,11 +747,11 @@ ARC_ENTRY ret_from_fork - ; special case of kernel_thread entry point returning back due to - ; kernel_execve() - pretend return from syscall to ret to userland - b ret_from_exception --ARC_EXIT ret_from_fork -+END(ret_from_fork) - - ;################### Special Sys Call Wrappers ########################## - --ARC_ENTRY sys_clone_wrapper -+ENTRY(sys_clone_wrapper) - SAVE_CALLEE_SAVED_USER - bl @sys_clone - DISCARD_CALLEE_SAVED_USER -@@ -761,7 +761,7 @@ ARC_ENTRY sys_clone_wrapper - bnz tracesys_exit - - b ret_from_system_call --ARC_EXIT sys_clone_wrapper -+END(sys_clone_wrapper) - - #ifdef CONFIG_ARC_DW2_UNWIND - ; Workaround for bug 94179 (STAR ): -diff --git a/arch/arc/lib/memcmp.S b/arch/arc/lib/memcmp.S -index bc813d55b6c3..978bf8314dfb 100644 ---- a/arch/arc/lib/memcmp.S -+++ b/arch/arc/lib/memcmp.S -@@ -6,7 +6,7 @@ - * published by the Free Software Foundation. - */ - --#include -+#include - - #ifdef __LITTLE_ENDIAN__ - #define WORD2 r2 -@@ -16,7 +16,7 @@ - #define SHIFT r2 - #endif - --ARC_ENTRY memcmp -+ENTRY(memcmp) - or r12,r0,r1 - asl_s r12,r12,30 - sub r3,r2,1 -@@ -121,4 +121,4 @@ ARC_ENTRY memcmp - .Lnil: - j_s.d [blink] - mov r0,0 --ARC_EXIT memcmp -+END(memcmp) -diff --git a/arch/arc/lib/memcpy-700.S b/arch/arc/lib/memcpy-700.S -index b64cc10ac918..3222573e50de 100644 ---- a/arch/arc/lib/memcpy-700.S -+++ b/arch/arc/lib/memcpy-700.S -@@ -6,9 +6,9 @@ - * published by the Free Software Foundation. - */ - --#include -+#include - --ARC_ENTRY memcpy -+ENTRY(memcpy) - or r3,r0,r1 - asl_s r3,r3,30 - mov_s r5,r0 -@@ -63,4 +63,4 @@ ARC_ENTRY memcpy - .Lendbloop: - j_s.d [blink] - stb r12,[r5,0] --ARC_EXIT memcpy -+END(memcpy) -diff --git a/arch/arc/lib/memset.S b/arch/arc/lib/memset.S -index 9b2d88d2e141..d36bd43fc98d 100644 ---- a/arch/arc/lib/memset.S -+++ b/arch/arc/lib/memset.S -@@ -6,11 +6,11 @@ - * published by the Free Software Foundation. - */ - --#include -+#include - - #define SMALL 7 /* Must be at least 6 to deal with alignment/loop issues. */ - --ARC_ENTRY memset -+ENTRY(memset) - mov_s r4,r0 - or r12,r0,r2 - bmsk.f r12,r12,1 -@@ -46,14 +46,14 @@ ARC_ENTRY memset - stb.ab r1,[r4,1] - .Ltiny_end: - j_s [blink] --ARC_EXIT memset -+END(memset) - - ; memzero: @r0 = mem, @r1 = size_t - ; memset: @r0 = mem, @r1 = char, @r2 = size_t - --ARC_ENTRY memzero -+ENTRY(memzero) - ; adjust bzero args to memset args - mov r2, r1 - mov r1, 0 - b memset ;tail call so need to tinker with blink --ARC_EXIT memzero -+END(memzero) -diff --git a/arch/arc/lib/strchr-700.S b/arch/arc/lib/strchr-700.S -index 9c548c7cf001..b725d5862107 100644 ---- a/arch/arc/lib/strchr-700.S -+++ b/arch/arc/lib/strchr-700.S -@@ -11,9 +11,9 @@ - presence of the norm instruction makes it easier to operate on whole - words branch-free. */ - --#include -+#include - --ARC_ENTRY strchr -+ENTRY(strchr) - extb_s r1,r1 - asl r5,r1,8 - bmsk r2,r0,1 -@@ -130,4 +130,4 @@ ARC_ENTRY strchr - j_s.d [blink] - mov.mi r0,0 - #endif /* ENDIAN */ --ARC_EXIT strchr -+END(strchr) -diff --git a/arch/arc/lib/strcmp.S b/arch/arc/lib/strcmp.S -index 5dc802b45cf3..3544600fefe6 100644 ---- a/arch/arc/lib/strcmp.S -+++ b/arch/arc/lib/strcmp.S -@@ -13,9 +13,9 @@ - source 1; however, that would increase the overhead for loop setup / finish, - and strcmp might often terminate early. */ - --#include -+#include - --ARC_ENTRY strcmp -+ENTRY(strcmp) - or r2,r0,r1 - bmsk_s r2,r2,1 - brne r2,0,.Lcharloop -@@ -93,4 +93,4 @@ ARC_ENTRY strcmp - .Lcmpend: - j_s.d [blink] - sub r0,r2,r3 --ARC_EXIT strcmp -+END(strcmp) -diff --git a/arch/arc/lib/strcpy-700.S b/arch/arc/lib/strcpy-700.S -index b7ca4ae81d88..8422f38e1218 100644 ---- a/arch/arc/lib/strcpy-700.S -+++ b/arch/arc/lib/strcpy-700.S -@@ -16,9 +16,9 @@ - there, but the it is not likely to be taken often, and it - would also be likey to cost an unaligned mispredict at the next call. */ - --#include -+#include - --ARC_ENTRY strcpy -+ENTRY(strcpy) - or r2,r0,r1 - bmsk_s r2,r2,1 - brne.d r2,0,charloop -@@ -67,4 +67,4 @@ charloop: - brne.d r3,0,charloop - stb.ab r3,[r10,1] - j [blink] --ARC_EXIT strcpy -+END(strcpy) -diff --git a/arch/arc/lib/strlen.S b/arch/arc/lib/strlen.S -index 39759e099696..53cfd5685a5f 100644 ---- a/arch/arc/lib/strlen.S -+++ b/arch/arc/lib/strlen.S -@@ -6,9 +6,9 @@ - * published by the Free Software Foundation. - */ - --#include -+#include - --ARC_ENTRY strlen -+ENTRY(strlen) - or r3,r0,7 - ld r2,[r3,-7] - ld.a r6,[r3,-3] -@@ -80,4 +80,4 @@ ARC_ENTRY strlen - .Learly_end: - b.d .Lend - sub_s.ne r1,r1,r1 --ARC_EXIT strlen -+END(strlen) -diff --git a/arch/arc/mm/tlbex.S b/arch/arc/mm/tlbex.S -index 3fcfdb38d242..79bfc81358c9 100644 ---- a/arch/arc/mm/tlbex.S -+++ b/arch/arc/mm/tlbex.S -@@ -260,7 +260,7 @@ ARCFP_CODE ;Fast Path Code, candidate for ICCM - ; I-TLB Miss Exception Handler - ;----------------------------------------------------------------------------- - --ARC_ENTRY EV_TLBMissI -+ENTRY(EV_TLBMissI) - - TLBMISS_FREEUP_REGS - -@@ -293,13 +293,13 @@ ARC_ENTRY EV_TLBMissI - TLBMISS_RESTORE_REGS - rtie - --ARC_EXIT EV_TLBMissI -+END(EV_TLBMissI) - - ;----------------------------------------------------------------------------- - ; D-TLB Miss Exception Handler - ;----------------------------------------------------------------------------- - --ARC_ENTRY EV_TLBMissD -+ENTRY(EV_TLBMissD) - - TLBMISS_FREEUP_REGS - -@@ -381,6 +381,4 @@ do_slow_path_pf: - bl do_page_fault - b ret_from_exception - --ARC_EXIT EV_TLBMissD -- --ARC_ENTRY EV_TLBMissB ; Bogus entry to measure sz of DTLBMiss hdlr -+END(EV_TLBMissD) -diff --git a/arch/arm/boot/dts/imx25.dtsi b/arch/arm/boot/dts/imx25.dtsi -index de1611966d8b..6a26e79f0ef4 100644 ---- a/arch/arm/boot/dts/imx25.dtsi -+++ b/arch/arm/boot/dts/imx25.dtsi -@@ -158,7 +158,7 @@ - #size-cells = <0>; - compatible = "fsl,imx25-cspi", "fsl,imx35-cspi"; - reg = <0x43fa4000 0x4000>; -- clocks = <&clks 62>, <&clks 62>; -+ clocks = <&clks 78>, <&clks 78>; - clock-names = "ipg", "per"; - interrupts = <14>; - status = "disabled"; -diff --git a/arch/arm/mach-imx/clk-imx6q.c b/arch/arm/mach-imx/clk-imx6q.c -index 4d677f442539..01a5765a8b26 100644 ---- a/arch/arm/mach-imx/clk-imx6q.c -+++ b/arch/arm/mach-imx/clk-imx6q.c -@@ -161,8 +161,8 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node) - post_div_table[1].div = 1; - post_div_table[2].div = 1; - video_div_table[1].div = 1; -- video_div_table[2].div = 1; -- }; -+ video_div_table[3].div = 1; -+ } - - /* type name parent_name base div_mask */ - clk[pll1_sys] = imx_clk_pllv3(IMX_PLLV3_SYS, "pll1_sys", "osc", base, 0x7f); -diff --git a/arch/arm/mach-omap2/timer.c b/arch/arm/mach-omap2/timer.c -index 74044aaf438b..73d80b8576c3 100644 ---- a/arch/arm/mach-omap2/timer.c -+++ b/arch/arm/mach-omap2/timer.c -@@ -513,11 +513,11 @@ static void __init realtime_counter_init(void) - rate = clk_get_rate(sys_clk); - /* Numerator/denumerator values refer TRM Realtime Counter section */ - switch (rate) { -- case 1200000: -+ case 12000000: - num = 64; - den = 125; - break; -- case 1300000: -+ case 13000000: - num = 768; - den = 1625; - break; -@@ -529,11 +529,11 @@ static void __init realtime_counter_init(void) - num = 192; - den = 625; - break; -- case 2600000: -+ case 26000000: - num = 384; - den = 1625; - break; -- case 2700000: -+ case 27000000: - num = 256; - den = 1125; - break; -diff --git a/arch/arm/mach-shmobile/setup-sh73a0.c b/arch/arm/mach-shmobile/setup-sh73a0.c -index f74ab530c71d..2b73c8a0c244 100644 ---- a/arch/arm/mach-shmobile/setup-sh73a0.c -+++ b/arch/arm/mach-shmobile/setup-sh73a0.c -@@ -617,6 +617,7 @@ static struct platform_device ipmmu_device = { - - static struct renesas_intc_irqpin_config irqpin0_platform_data = { - .irq_base = irq_pin(0), /* IRQ0 -> IRQ7 */ -+ .control_parent = true, - }; - - static struct resource irqpin0_resources[] = { -@@ -678,6 +679,7 @@ static struct platform_device irqpin1_device = { - - static struct renesas_intc_irqpin_config irqpin2_platform_data = { - .irq_base = irq_pin(16), /* IRQ16 -> IRQ23 */ -+ .control_parent = true, - }; - - static struct resource irqpin2_resources[] = { -@@ -708,6 +710,7 @@ static struct platform_device irqpin2_device = { - - static struct renesas_intc_irqpin_config irqpin3_platform_data = { - .irq_base = irq_pin(24), /* IRQ24 -> IRQ31 */ -+ .control_parent = true, - }; - - static struct resource irqpin3_resources[] = { -diff --git a/arch/parisc/include/asm/ldcw.h b/arch/parisc/include/asm/ldcw.h -index d2d11b7055ba..8121aa6db2ff 100644 ---- a/arch/parisc/include/asm/ldcw.h -+++ b/arch/parisc/include/asm/ldcw.h -@@ -33,11 +33,18 @@ - - #endif /*!CONFIG_PA20*/ - --/* LDCW, the only atomic read-write operation PA-RISC has. *sigh*. */ -+/* LDCW, the only atomic read-write operation PA-RISC has. *sigh*. -+ We don't explicitly expose that "*a" may be written as reload -+ fails to find a register in class R1_REGS when "a" needs to be -+ reloaded when generating 64-bit PIC code. Instead, we clobber -+ memory to indicate to the compiler that the assembly code reads -+ or writes to items other than those listed in the input and output -+ operands. This may pessimize the code somewhat but __ldcw is -+ usually used within code blocks surrounded by memory barriors. */ - #define __ldcw(a) ({ \ - unsigned __ret; \ -- __asm__ __volatile__(__LDCW " 0(%2),%0" \ -- : "=r" (__ret), "+m" (*(a)) : "r" (a)); \ -+ __asm__ __volatile__(__LDCW " 0(%1),%0" \ -+ : "=r" (__ret) : "r" (a) : "memory"); \ - __ret; \ - }) - -diff --git a/arch/um/Kconfig.common b/arch/um/Kconfig.common -index 21ca44c4f6d5..1f0ea5537e8a 100644 ---- a/arch/um/Kconfig.common -+++ b/arch/um/Kconfig.common -@@ -2,6 +2,7 @@ config UML - bool - default y - select HAVE_UID16 -+ select HAVE_FUTEX_CMPXCHG if FUTEX - select GENERIC_IRQ_SHOW - select GENERIC_CPU_DEVICES - select GENERIC_IO -diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c -index 79a3f9682871..a1f5b1866cbe 100644 ---- a/arch/x86/kernel/kprobes/core.c -+++ b/arch/x86/kernel/kprobes/core.c -@@ -1017,6 +1017,15 @@ int __kprobes setjmp_pre_handler(struct kprobe *p, struct pt_regs *regs) - regs->flags &= ~X86_EFLAGS_IF; - trace_hardirqs_off(); - regs->ip = (unsigned long)(jp->entry); -+ -+ /* -+ * jprobes use jprobe_return() which skips the normal return -+ * path of the function, and this messes up the accounting of the -+ * function graph tracer to get messed up. -+ * -+ * Pause function graph tracing while performing the jprobe function. -+ */ -+ pause_graph_tracing(); - return 1; - } - -@@ -1042,24 +1051,25 @@ int __kprobes longjmp_break_handler(struct kprobe *p, struct pt_regs *regs) - struct kprobe_ctlblk *kcb = get_kprobe_ctlblk(); - u8 *addr = (u8 *) (regs->ip - 1); - struct jprobe *jp = container_of(p, struct jprobe, kp); -+ void *saved_sp = kcb->jprobe_saved_sp; - - if ((addr > (u8 *) jprobe_return) && - (addr < (u8 *) jprobe_return_end)) { -- if (stack_addr(regs) != kcb->jprobe_saved_sp) { -+ if (stack_addr(regs) != saved_sp) { - struct pt_regs *saved_regs = &kcb->jprobe_saved_regs; - printk(KERN_ERR - "current sp %p does not match saved sp %p\n", -- stack_addr(regs), kcb->jprobe_saved_sp); -+ stack_addr(regs), saved_sp); - printk(KERN_ERR "Saved registers for jprobe %p\n", jp); - show_regs(saved_regs); - printk(KERN_ERR "Current registers\n"); - show_regs(regs); - BUG(); - } -+ /* It's OK to start function graph tracing again */ -+ unpause_graph_tracing(); - *regs = kcb->jprobe_saved_regs; -- memcpy((kprobe_opcode_t *)(kcb->jprobe_saved_sp), -- kcb->jprobes_stack, -- MIN_STACK_SIZE(kcb->jprobe_saved_sp)); -+ memcpy(saved_sp, kcb->jprobes_stack, MIN_STACK_SIZE(saved_sp)); - preempt_enable_no_resched(); - return 1; - } -diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c -index 0c90f4b3f835..de426887b359 100644 ---- a/arch/x86/kvm/vmx.c -+++ b/arch/x86/kvm/vmx.c -@@ -2320,12 +2320,12 @@ static __init void nested_vmx_setup_ctls_msrs(void) - nested_vmx_secondary_ctls_low = 0; - nested_vmx_secondary_ctls_high &= - SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES | -- SECONDARY_EXEC_UNRESTRICTED_GUEST | - SECONDARY_EXEC_WBINVD_EXITING; - - if (enable_ept) { - /* nested EPT: emulate EPT also to L1 */ -- nested_vmx_secondary_ctls_high |= SECONDARY_EXEC_ENABLE_EPT; -+ nested_vmx_secondary_ctls_high |= SECONDARY_EXEC_ENABLE_EPT | -+ SECONDARY_EXEC_UNRESTRICTED_GUEST; - nested_vmx_ept_caps = VMX_EPT_PAGE_WALK_4_BIT | - VMX_EPTP_WB_BIT | VMX_EPT_2MB_PAGE_BIT | - VMX_EPT_INVEPT_BIT; -diff --git a/arch/x86/um/sys_call_table_32.c b/arch/x86/um/sys_call_table_32.c -index 531d4269e2e3..bd16d6c370ec 100644 ---- a/arch/x86/um/sys_call_table_32.c -+++ b/arch/x86/um/sys_call_table_32.c -@@ -34,7 +34,7 @@ typedef asmlinkage void (*sys_call_ptr_t)(void); - - extern asmlinkage void sys_ni_syscall(void); - --const sys_call_ptr_t sys_call_table[] __cacheline_aligned = { -+const sys_call_ptr_t sys_call_table[] ____cacheline_aligned = { - /* - * Smells like a compiler bug -- it doesn't work - * when the & below is removed. -diff --git a/arch/x86/um/sys_call_table_64.c b/arch/x86/um/sys_call_table_64.c -index f2f0723070ca..95783087f0d3 100644 ---- a/arch/x86/um/sys_call_table_64.c -+++ b/arch/x86/um/sys_call_table_64.c -@@ -46,7 +46,7 @@ typedef void (*sys_call_ptr_t)(void); - - extern void sys_ni_syscall(void); - --const sys_call_ptr_t sys_call_table[] __cacheline_aligned = { -+const sys_call_ptr_t sys_call_table[] ____cacheline_aligned = { - /* - * Smells like a compiler bug -- it doesn't work - * when the & below is removed. -diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c -index f9c4632d4dd3..7145f6d93567 100644 ---- a/drivers/clk/clk.c -+++ b/drivers/clk/clk.c -@@ -2282,14 +2282,18 @@ int __clk_get(struct clk *clk) - - void __clk_put(struct clk *clk) - { -+ struct module *owner; -+ - if (!clk || WARN_ON_ONCE(IS_ERR(clk))) - return; - - clk_mutex_lock(clk); -+ owner = clk->owner; - kref_put(&clk->ref, __clk_release); - clk_mutex_unlock(clk); - - module_put(clk->owner); -+ module_put(owner); - } - - /*** clk rate change notifiers ***/ -diff --git a/drivers/clk/samsung/clk-exynos-audss.c b/drivers/clk/samsung/clk-exynos-audss.c -index 884187fbfe00..7f30b94c00a5 100644 ---- a/drivers/clk/samsung/clk-exynos-audss.c -+++ b/drivers/clk/samsung/clk-exynos-audss.c -@@ -210,6 +210,10 @@ static int exynos_audss_clk_remove(struct platform_device *pdev) - { - int i; - -+#ifdef CONFIG_PM_SLEEP -+ unregister_syscore_ops(&exynos_audss_clk_syscore_ops); -+#endif -+ - of_clk_del_provider(pdev->dev.of_node); - - for (i = 0; i < clk_data.clk_num; i++) { -diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c -index e0a98f581f58..74ed17d6cfa1 100644 ---- a/drivers/gpio/gpiolib-of.c -+++ b/drivers/gpio/gpiolib-of.c -@@ -44,8 +44,14 @@ static int of_gpiochip_find_and_xlate(struct gpio_chip *gc, void *data) - return false; - - ret = gc->of_xlate(gc, &gg_data->gpiospec, gg_data->flags); -- if (ret < 0) -- return false; -+ if (ret < 0) { -+ /* We've found the gpio chip, but the translation failed. -+ * Return true to stop looking and return the translation -+ * error via out_gpio -+ */ -+ gg_data->out_gpio = ERR_PTR(ret); -+ return true; -+ } - - gg_data->out_gpio = gpio_to_desc(ret + gc->base); - return true; -diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c -index 50c4922fe53a..5b88c83888d1 100644 ---- a/drivers/gpio/gpiolib.c -+++ b/drivers/gpio/gpiolib.c -@@ -1222,6 +1222,9 @@ int gpiochip_add(struct gpio_chip *chip) - - spin_unlock_irqrestore(&gpio_lock, flags); - -+ if (status) -+ goto fail; -+ - #ifdef CONFIG_PINCTRL - INIT_LIST_HEAD(&chip->pin_ranges); - #endif -@@ -1229,12 +1232,12 @@ int gpiochip_add(struct gpio_chip *chip) - of_gpiochip_add(chip); - acpi_gpiochip_add(chip); - -- if (status) -- goto fail; -- - status = gpiochip_export(chip); -- if (status) -+ if (status) { -+ acpi_gpiochip_remove(chip); -+ of_gpiochip_remove(chip); - goto fail; -+ } - - pr_debug("%s: registered GPIOs %d to %d on device: %s\n", __func__, - chip->base, chip->base + chip->ngpio - 1, -diff --git a/drivers/gpu/drm/i915/i915_gem_stolen.c b/drivers/gpu/drm/i915/i915_gem_stolen.c -index 3c78b2268209..800e06c28018 100644 ---- a/drivers/gpu/drm/i915/i915_gem_stolen.c -+++ b/drivers/gpu/drm/i915/i915_gem_stolen.c -@@ -137,7 +137,11 @@ static unsigned long i915_stolen_to_physical(struct drm_device *dev) - r = devm_request_mem_region(dev->dev, base + 1, - dev_priv->gtt.stolen_size - 1, - "Graphics Stolen Memory"); -- if (r == NULL) { -+ /* -+ * GEN3 firmware likes to smash pci bridges into the stolen -+ * range. Apparently this works. -+ */ -+ if (r == NULL && !IS_GEN3(dev)) { - DRM_ERROR("conflict detected with stolen region: [0x%08x - 0x%08x]\n", - base, base + (uint32_t)dev_priv->gtt.stolen_size); - base = 0; -diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h -index 0a3b9386eb43..0c83b3dab58c 100644 ---- a/drivers/gpu/drm/i915/i915_reg.h -+++ b/drivers/gpu/drm/i915/i915_reg.h -@@ -320,6 +320,7 @@ - #define PIPE_CONTROL_GLOBAL_GTT_IVB (1<<24) /* gen7+ */ - #define PIPE_CONTROL_CS_STALL (1<<20) - #define PIPE_CONTROL_TLB_INVALIDATE (1<<18) -+#define PIPE_CONTROL_MEDIA_STATE_CLEAR (1<<16) - #define PIPE_CONTROL_QW_WRITE (1<<14) - #define PIPE_CONTROL_DEPTH_STALL (1<<13) - #define PIPE_CONTROL_WRITE_FLUSH (1<<12) -diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c -index d488fc71ef49..d2af1e138c91 100644 ---- a/drivers/gpu/drm/i915/intel_ringbuffer.c -+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c -@@ -334,12 +334,15 @@ gen7_render_ring_flush(struct intel_ring_buffer *ring, - flags |= PIPE_CONTROL_VF_CACHE_INVALIDATE; - flags |= PIPE_CONTROL_CONST_CACHE_INVALIDATE; - flags |= PIPE_CONTROL_STATE_CACHE_INVALIDATE; -+ flags |= PIPE_CONTROL_MEDIA_STATE_CLEAR; - /* - * TLB invalidate requires a post-sync write. - */ - flags |= PIPE_CONTROL_QW_WRITE; - flags |= PIPE_CONTROL_GLOBAL_GTT_IVB; - -+ flags |= PIPE_CONTROL_STALL_AT_SCOREBOARD; -+ - /* Workaround: we must issue a pipe_control with CS-stall bit - * set before a pipe_control command that has the state cache - * invalidate bit set. */ -diff --git a/drivers/gpu/drm/i915/intel_uncore.c b/drivers/gpu/drm/i915/intel_uncore.c -index c8796316d242..b6c063cad59b 100644 ---- a/drivers/gpu/drm/i915/intel_uncore.c -+++ b/drivers/gpu/drm/i915/intel_uncore.c -@@ -451,8 +451,8 @@ hsw_unclaimed_reg_check(struct drm_i915_private *dev_priv, u32 reg) - static void - assert_device_not_suspended(struct drm_i915_private *dev_priv) - { -- WARN(HAS_RUNTIME_PM(dev_priv->dev) && dev_priv->pm.suspended, -- "Device suspended\n"); -+ WARN_ONCE(HAS_RUNTIME_PM(dev_priv->dev) && dev_priv->pm.suspended, -+ "Device suspended\n"); - } - - #define REG_READ_HEADER(x) \ -diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv4c.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nv4c.c -index a75c35ccf25c..165401c4045c 100644 ---- a/drivers/gpu/drm/nouveau/core/subdev/mc/nv4c.c -+++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv4c.c -@@ -24,13 +24,6 @@ - - #include "nv04.h" - --static void --nv4c_mc_msi_rearm(struct nouveau_mc *pmc) --{ -- struct nv04_mc_priv *priv = (void *)pmc; -- nv_wr08(priv, 0x088050, 0xff); --} -- - struct nouveau_oclass * - nv4c_mc_oclass = &(struct nouveau_mc_oclass) { - .base.handle = NV_SUBDEV(MC, 0x4c), -@@ -41,5 +34,4 @@ nv4c_mc_oclass = &(struct nouveau_mc_oclass) { - .fini = _nouveau_mc_fini, - }, - .intr = nv04_mc_intr, -- .msi_rearm = nv4c_mc_msi_rearm, - }.base; -diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c -index 5727dbdeda7f..b4dbaded2caf 100644 ---- a/drivers/gpu/drm/radeon/atombios_dp.c -+++ b/drivers/gpu/drm/radeon/atombios_dp.c -@@ -576,6 +576,10 @@ int radeon_dp_mode_valid_helper(struct drm_connector *connector, - struct radeon_connector_atom_dig *dig_connector; - int dp_clock; - -+ if ((mode->clock > 340000) && -+ (!radeon_connector_is_dp12_capable(connector))) -+ return MODE_CLOCK_HIGH; -+ - if (!radeon_connector->con_priv) - return MODE_CLOCK_HIGH; - dig_connector = radeon_connector->con_priv; -diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c -index 543ba2d4a659..c7c285646857 100644 ---- a/drivers/gpu/drm/radeon/ci_dpm.c -+++ b/drivers/gpu/drm/radeon/ci_dpm.c -@@ -4733,7 +4733,7 @@ void ci_dpm_disable(struct radeon_device *rdev) - ci_enable_spread_spectrum(rdev, false); - ci_enable_auto_throttle_source(rdev, RADEON_DPM_AUTO_THROTTLE_SRC_THERMAL, false); - ci_stop_dpm(rdev); -- ci_enable_ds_master_switch(rdev, true); -+ ci_enable_ds_master_switch(rdev, false); - ci_enable_ulv(rdev, false); - ci_clear_vc(rdev); - ci_reset_to_default(rdev); -diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c -index ddf70d6c0270..8ef67cb4ef1e 100644 ---- a/drivers/gpu/drm/radeon/cik.c -+++ b/drivers/gpu/drm/radeon/cik.c -@@ -5879,6 +5879,7 @@ static void cik_enable_mgcg(struct radeon_device *rdev, bool enable) - } - - orig = data = RREG32(RLC_CGTT_MGCG_OVERRIDE); -+ data |= 0x00000001; - data &= 0xfffffffd; - if (orig != data) - WREG32(RLC_CGTT_MGCG_OVERRIDE, data); -@@ -5910,7 +5911,7 @@ static void cik_enable_mgcg(struct radeon_device *rdev, bool enable) - } - } else { - orig = data = RREG32(RLC_CGTT_MGCG_OVERRIDE); -- data |= 0x00000002; -+ data |= 0x00000003; - if (orig != data) - WREG32(RLC_CGTT_MGCG_OVERRIDE, data); - -diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c -index 040a2a10ea17..45a9a03efc06 100644 ---- a/drivers/gpu/drm/radeon/radeon_ttm.c -+++ b/drivers/gpu/drm/radeon/radeon_ttm.c -@@ -191,7 +191,7 @@ static void radeon_evict_flags(struct ttm_buffer_object *bo, - rbo = container_of(bo, struct radeon_bo, tbo); - switch (bo->mem.mem_type) { - case TTM_PL_VRAM: -- if (rbo->rdev->ring[RADEON_RING_TYPE_GFX_INDEX].ready == false) -+ if (rbo->rdev->ring[radeon_copy_ring_index(rbo->rdev)].ready == false) - radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_CPU); - else - radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_GTT); -diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c -index cf4bad2c1d59..76329d27385b 100644 ---- a/drivers/gpu/drm/ttm/ttm_page_alloc.c -+++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c -@@ -297,11 +297,12 @@ static void ttm_pool_update_free_locked(struct ttm_page_pool *pool, - * - * @pool: to free the pages from - * @free_all: If set to true will free all pages in pool -- * @gfp: GFP flags. -+ * @use_static: Safe to use static buffer - **/ - static int ttm_page_pool_free(struct ttm_page_pool *pool, unsigned nr_free, -- gfp_t gfp) -+ bool use_static) - { -+ static struct page *static_buf[NUM_PAGES_TO_ALLOC]; - unsigned long irq_flags; - struct page *p; - struct page **pages_to_free; -@@ -311,7 +312,11 @@ static int ttm_page_pool_free(struct ttm_page_pool *pool, unsigned nr_free, - if (NUM_PAGES_TO_ALLOC < nr_free) - npages_to_free = NUM_PAGES_TO_ALLOC; - -- pages_to_free = kmalloc(npages_to_free * sizeof(struct page *), gfp); -+ if (use_static) -+ pages_to_free = static_buf; -+ else -+ pages_to_free = kmalloc(npages_to_free * sizeof(struct page *), -+ GFP_KERNEL); - if (!pages_to_free) { - pr_err("Failed to allocate memory for pool free operation\n"); - return 0; -@@ -374,7 +379,8 @@ restart: - if (freed_pages) - ttm_pages_put(pages_to_free, freed_pages); - out: -- kfree(pages_to_free); -+ if (pages_to_free != static_buf) -+ kfree(pages_to_free); - return nr_free; - } - -@@ -383,8 +389,6 @@ out: - * - * XXX: (dchinner) Deadlock warning! - * -- * We need to pass sc->gfp_mask to ttm_page_pool_free(). -- * - * This code is crying out for a shrinker per pool.... - */ - static unsigned long -@@ -407,8 +411,8 @@ ttm_pool_shrink_scan(struct shrinker *shrink, struct shrink_control *sc) - if (shrink_pages == 0) - break; - pool = &_manager->pools[(i + pool_offset)%NUM_POOLS]; -- shrink_pages = ttm_page_pool_free(pool, nr_free, -- sc->gfp_mask); -+ /* OK to use static buffer since global mutex is held. */ -+ shrink_pages = ttm_page_pool_free(pool, nr_free, true); - freed += nr_free - shrink_pages; - } - mutex_unlock(&lock); -@@ -710,7 +714,7 @@ static void ttm_put_pages(struct page **pages, unsigned npages, int flags, - } - spin_unlock_irqrestore(&pool->lock, irq_flags); - if (npages) -- ttm_page_pool_free(pool, npages, GFP_KERNEL); -+ ttm_page_pool_free(pool, npages, false); - } - - /* -@@ -849,9 +853,9 @@ void ttm_page_alloc_fini(void) - pr_info("Finalizing pool allocator\n"); - ttm_pool_mm_shrink_fini(_manager); - -+ /* OK to use static buffer since global mutex is no longer used. */ - for (i = 0; i < NUM_POOLS; ++i) -- ttm_page_pool_free(&_manager->pools[i], FREE_ALL_PAGES, -- GFP_KERNEL); -+ ttm_page_pool_free(&_manager->pools[i], FREE_ALL_PAGES, true); - - kobject_put(&_manager->kobj); - _manager = NULL; -diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c -index ca65df144765..3dfa97d04e51 100644 ---- a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c -+++ b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c -@@ -411,11 +411,12 @@ static void ttm_dma_page_put(struct dma_pool *pool, struct dma_page *d_page) - * - * @pool: to free the pages from - * @nr_free: If set to true will free all pages in pool -- * @gfp: GFP flags. -+ * @use_static: Safe to use static buffer - **/ - static unsigned ttm_dma_page_pool_free(struct dma_pool *pool, unsigned nr_free, -- gfp_t gfp) -+ bool use_static) - { -+ static struct page *static_buf[NUM_PAGES_TO_ALLOC]; - unsigned long irq_flags; - struct dma_page *dma_p, *tmp; - struct page **pages_to_free; -@@ -432,7 +433,11 @@ static unsigned ttm_dma_page_pool_free(struct dma_pool *pool, unsigned nr_free, - npages_to_free, nr_free); - } - #endif -- pages_to_free = kmalloc(npages_to_free * sizeof(struct page *), gfp); -+ if (use_static) -+ pages_to_free = static_buf; -+ else -+ pages_to_free = kmalloc(npages_to_free * sizeof(struct page *), -+ GFP_KERNEL); - - if (!pages_to_free) { - pr_err("%s: Failed to allocate memory for pool free operation\n", -@@ -502,7 +507,8 @@ restart: - if (freed_pages) - ttm_dma_pages_put(pool, &d_pages, pages_to_free, freed_pages); - out: -- kfree(pages_to_free); -+ if (pages_to_free != static_buf) -+ kfree(pages_to_free); - return nr_free; - } - -@@ -531,7 +537,8 @@ static void ttm_dma_free_pool(struct device *dev, enum pool_type type) - if (pool->type != type) - continue; - /* Takes a spinlock.. */ -- ttm_dma_page_pool_free(pool, FREE_ALL_PAGES, GFP_KERNEL); -+ /* OK to use static buffer since global mutex is held. */ -+ ttm_dma_page_pool_free(pool, FREE_ALL_PAGES, true); - WARN_ON(((pool->npages_in_use + pool->npages_free) != 0)); - /* This code path is called after _all_ references to the - * struct device has been dropped - so nobody should be -@@ -984,7 +991,7 @@ void ttm_dma_unpopulate(struct ttm_dma_tt *ttm_dma, struct device *dev) - - /* shrink pool if necessary (only on !is_cached pools)*/ - if (npages) -- ttm_dma_page_pool_free(pool, npages, GFP_KERNEL); -+ ttm_dma_page_pool_free(pool, npages, false); - ttm->state = tt_unpopulated; - } - EXPORT_SYMBOL_GPL(ttm_dma_unpopulate); -@@ -994,8 +1001,6 @@ EXPORT_SYMBOL_GPL(ttm_dma_unpopulate); - * - * XXX: (dchinner) Deadlock warning! - * -- * We need to pass sc->gfp_mask to ttm_dma_page_pool_free(). -- * - * I'm getting sadder as I hear more pathetical whimpers about needing per-pool - * shrinkers - */ -@@ -1028,8 +1033,8 @@ ttm_dma_pool_shrink_scan(struct shrinker *shrink, struct shrink_control *sc) - if (++idx < pool_offset) - continue; - nr_free = shrink_pages; -- shrink_pages = ttm_dma_page_pool_free(p->pool, nr_free, -- sc->gfp_mask); -+ /* OK to use static buffer since global mutex is held. */ -+ shrink_pages = ttm_dma_page_pool_free(p->pool, nr_free, true); - freed += nr_free - shrink_pages; - - pr_debug("%s: (%s:%d) Asked to shrink %d, have %d more to go\n", -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c -index 436b013b4231..b65272d7ea56 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c -@@ -1049,6 +1049,8 @@ static int vmw_event_fence_action_create(struct drm_file *file_priv, - if (ret != 0) - goto out_no_queue; - -+ return 0; -+ - out_no_queue: - event->base.destroy(&event->base); - out_no_event: -@@ -1124,17 +1126,10 @@ int vmw_fence_event_ioctl(struct drm_device *dev, void *data, - - BUG_ON(fence == NULL); - -- if (arg->flags & DRM_VMW_FE_FLAG_REQ_TIME) -- ret = vmw_event_fence_action_create(file_priv, fence, -- arg->flags, -- arg->user_data, -- true); -- else -- ret = vmw_event_fence_action_create(file_priv, fence, -- arg->flags, -- arg->user_data, -- true); -- -+ ret = vmw_event_fence_action_create(file_priv, fence, -+ arg->flags, -+ arg->user_data, -+ true); - if (unlikely(ret != 0)) { - if (ret != -ERESTARTSYS) - DRM_ERROR("Failed to attach event to fence.\n"); -diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c -index a96cfc31372e..60142274fe4b 100644 ---- a/drivers/infiniband/ulp/isert/ib_isert.c -+++ b/drivers/infiniband/ulp/isert/ib_isert.c -@@ -41,6 +41,7 @@ static DEFINE_MUTEX(device_list_mutex); - static LIST_HEAD(device_list); - static struct workqueue_struct *isert_rx_wq; - static struct workqueue_struct *isert_comp_wq; -+static struct workqueue_struct *isert_release_wq; - - static void - isert_unmap_cmd(struct isert_cmd *isert_cmd, struct isert_conn *isert_conn); -@@ -52,6 +53,11 @@ isert_unreg_rdma(struct isert_cmd *isert_cmd, struct isert_conn *isert_conn); - static int - isert_reg_rdma(struct iscsi_conn *conn, struct iscsi_cmd *cmd, - struct isert_rdma_wr *wr); -+static int -+isert_rdma_post_recvl(struct isert_conn *isert_conn); -+static int -+isert_rdma_accept(struct isert_conn *isert_conn); -+struct rdma_cm_id *isert_setup_id(struct isert_np *isert_np); - - static void - isert_qp_event_callback(struct ib_event *e, void *context) -@@ -132,12 +138,18 @@ isert_conn_setup_qp(struct isert_conn *isert_conn, struct rdma_cm_id *cma_id) - ret = rdma_create_qp(cma_id, isert_conn->conn_pd, &attr); - if (ret) { - pr_err("rdma_create_qp failed for cma_id %d\n", ret); -- return ret; -+ goto err; - } - isert_conn->conn_qp = cma_id->qp; - pr_debug("rdma_create_qp() returned success >>>>>>>>>>>>>>>>>>>>>>>>>.\n"); - - return 0; -+err: -+ mutex_lock(&device_list_mutex); -+ device->cq_active_qps[min_index]--; -+ mutex_unlock(&device_list_mutex); -+ -+ return ret; - } - - static void -@@ -489,8 +501,8 @@ err: - static int - isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event) - { -- struct iscsi_np *np = cma_id->context; -- struct isert_np *isert_np = np->np_context; -+ struct isert_np *isert_np = cma_id->context; -+ struct iscsi_np *np = isert_np->np; - struct isert_conn *isert_conn; - struct isert_device *device; - struct ib_device *ib_dev = cma_id->device; -@@ -515,6 +527,7 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event) - isert_conn->state = ISER_CONN_INIT; - INIT_LIST_HEAD(&isert_conn->conn_accept_node); - init_completion(&isert_conn->conn_login_comp); -+ init_completion(&isert_conn->login_req_comp); - init_completion(&isert_conn->conn_wait); - init_completion(&isert_conn->conn_wait_comp_err); - kref_init(&isert_conn->conn_kref); -@@ -522,7 +535,6 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event) - spin_lock_init(&isert_conn->conn_lock); - INIT_LIST_HEAD(&isert_conn->conn_fr_pool); - -- cma_id->context = isert_conn; - isert_conn->conn_cm_id = cma_id; - isert_conn->responder_resources = event->param.conn.responder_resources; - isert_conn->initiator_depth = event->param.conn.initiator_depth; -@@ -596,6 +608,14 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event) - if (ret) - goto out_conn_dev; - -+ ret = isert_rdma_post_recvl(isert_conn); -+ if (ret) -+ goto out_conn_dev; -+ -+ ret = isert_rdma_accept(isert_conn); -+ if (ret) -+ goto out_conn_dev; -+ - mutex_lock(&isert_np->np_accept_mutex); - list_add_tail(&isert_conn->conn_accept_node, &isert_np->np_accept_list); - mutex_unlock(&isert_np->np_accept_mutex); -@@ -620,6 +640,7 @@ out_login_buf: - kfree(isert_conn->login_buf); - out: - kfree(isert_conn); -+ rdma_reject(cma_id, NULL, 0); - return ret; - } - -@@ -635,18 +656,20 @@ isert_connect_release(struct isert_conn *isert_conn) - if (device && device->use_fastreg) - isert_conn_free_fastreg_pool(isert_conn); - -+ isert_free_rx_descriptors(isert_conn); -+ rdma_destroy_id(isert_conn->conn_cm_id); -+ - if (isert_conn->conn_qp) { - cq_index = ((struct isert_cq_desc *) - isert_conn->conn_qp->recv_cq->cq_context)->cq_index; - pr_debug("isert_connect_release: cq_index: %d\n", cq_index); -+ mutex_lock(&device_list_mutex); - isert_conn->conn_device->cq_active_qps[cq_index]--; -+ mutex_unlock(&device_list_mutex); - -- rdma_destroy_qp(isert_conn->conn_cm_id); -+ ib_destroy_qp(isert_conn->conn_qp); - } - -- isert_free_rx_descriptors(isert_conn); -- rdma_destroy_id(isert_conn->conn_cm_id); -- - ib_dereg_mr(isert_conn->conn_mr); - ib_dealloc_pd(isert_conn->conn_pd); - -@@ -669,9 +692,19 @@ isert_connect_release(struct isert_conn *isert_conn) - static void - isert_connected_handler(struct rdma_cm_id *cma_id) - { -- struct isert_conn *isert_conn = cma_id->context; -+ struct isert_conn *isert_conn = cma_id->qp->qp_context; -+ -+ pr_info("conn %p\n", isert_conn); - -- kref_get(&isert_conn->conn_kref); -+ if (!kref_get_unless_zero(&isert_conn->conn_kref)) { -+ pr_warn("conn %p connect_release is running\n", isert_conn); -+ return; -+ } -+ -+ mutex_lock(&isert_conn->conn_mutex); -+ if (isert_conn->state != ISER_CONN_FULL_FEATURE) -+ isert_conn->state = ISER_CONN_UP; -+ mutex_unlock(&isert_conn->conn_mutex); - } - - static void -@@ -692,65 +725,108 @@ isert_put_conn(struct isert_conn *isert_conn) - kref_put(&isert_conn->conn_kref, isert_release_conn_kref); - } - -+/** -+ * isert_conn_terminate() - Initiate connection termination -+ * @isert_conn: isert connection struct -+ * -+ * Notes: -+ * In case the connection state is FULL_FEATURE, move state -+ * to TEMINATING and start teardown sequence (rdma_disconnect). -+ * In case the connection state is UP, complete flush as well. -+ * -+ * This routine must be called with conn_mutex held. Thus it is -+ * safe to call multiple times. -+ */ - static void --isert_disconnect_work(struct work_struct *work) -+isert_conn_terminate(struct isert_conn *isert_conn) - { -- struct isert_conn *isert_conn = container_of(work, -- struct isert_conn, conn_logout_work); -+ int err; - -- pr_debug("isert_disconnect_work(): >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n"); -- mutex_lock(&isert_conn->conn_mutex); -- if (isert_conn->state == ISER_CONN_UP) -+ switch (isert_conn->state) { -+ case ISER_CONN_TERMINATING: -+ break; -+ case ISER_CONN_UP: -+ /* -+ * No flush completions will occur as we didn't -+ * get to ISER_CONN_FULL_FEATURE yet, complete -+ * to allow teardown progress. -+ */ -+ complete(&isert_conn->conn_wait_comp_err); -+ case ISER_CONN_FULL_FEATURE: /* FALLTHRU */ -+ pr_info("Terminating conn %p state %d\n", -+ isert_conn, isert_conn->state); - isert_conn->state = ISER_CONN_TERMINATING; -- -- if (isert_conn->post_recv_buf_count == 0 && -- atomic_read(&isert_conn->post_send_buf_count) == 0) { -- mutex_unlock(&isert_conn->conn_mutex); -- goto wake_up; -- } -- if (!isert_conn->conn_cm_id) { -- mutex_unlock(&isert_conn->conn_mutex); -- isert_put_conn(isert_conn); -- return; -+ err = rdma_disconnect(isert_conn->conn_cm_id); -+ if (err) -+ pr_warn("Failed rdma_disconnect isert_conn %p\n", -+ isert_conn); -+ break; -+ default: -+ pr_warn("conn %p teminating in state %d\n", -+ isert_conn, isert_conn->state); - } -+} - -- if (isert_conn->disconnect) { -- /* Send DREQ/DREP towards our initiator */ -- rdma_disconnect(isert_conn->conn_cm_id); -- } -+static int -+isert_np_cma_handler(struct isert_np *isert_np, -+ enum rdma_cm_event_type event) -+{ -+ pr_debug("isert np %p, handling event %d\n", isert_np, event); - -- mutex_unlock(&isert_conn->conn_mutex); -+ switch (event) { -+ case RDMA_CM_EVENT_DEVICE_REMOVAL: -+ isert_np->np_cm_id = NULL; -+ break; -+ case RDMA_CM_EVENT_ADDR_CHANGE: -+ isert_np->np_cm_id = isert_setup_id(isert_np); -+ if (IS_ERR(isert_np->np_cm_id)) { -+ pr_err("isert np %p setup id failed: %ld\n", -+ isert_np, PTR_ERR(isert_np->np_cm_id)); -+ isert_np->np_cm_id = NULL; -+ } -+ break; -+ default: -+ pr_err("isert np %p Unexpected event %d\n", -+ isert_np, event); -+ } - --wake_up: -- complete(&isert_conn->conn_wait); -+ return -1; - } - - static int --isert_disconnected_handler(struct rdma_cm_id *cma_id, bool disconnect) -+isert_disconnected_handler(struct rdma_cm_id *cma_id, -+ enum rdma_cm_event_type event) - { -+ struct isert_np *isert_np = cma_id->context; - struct isert_conn *isert_conn; - -- if (!cma_id->qp) { -- struct isert_np *isert_np = cma_id->context; -+ if (isert_np->np_cm_id == cma_id) -+ return isert_np_cma_handler(cma_id->context, event); - -- isert_np->np_cm_id = NULL; -- return -1; -- } -+ isert_conn = cma_id->qp->qp_context; - -- isert_conn = (struct isert_conn *)cma_id->context; -+ mutex_lock(&isert_conn->conn_mutex); -+ isert_conn_terminate(isert_conn); -+ mutex_unlock(&isert_conn->conn_mutex); - -- isert_conn->disconnect = disconnect; -- INIT_WORK(&isert_conn->conn_logout_work, isert_disconnect_work); -- schedule_work(&isert_conn->conn_logout_work); -+ pr_info("conn %p completing conn_wait\n", isert_conn); -+ complete(&isert_conn->conn_wait); - - return 0; - } - -+static void -+isert_connect_error(struct rdma_cm_id *cma_id) -+{ -+ struct isert_conn *isert_conn = cma_id->qp->qp_context; -+ -+ isert_put_conn(isert_conn); -+} -+ - static int - isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event) - { - int ret = 0; -- bool disconnect = false; - - pr_debug("isert_cma_handler: event %d status %d conn %p id %p\n", - event->event, event->status, cma_id->context, cma_id); -@@ -768,11 +844,14 @@ isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event) - case RDMA_CM_EVENT_ADDR_CHANGE: /* FALLTHRU */ - case RDMA_CM_EVENT_DISCONNECTED: /* FALLTHRU */ - case RDMA_CM_EVENT_DEVICE_REMOVAL: /* FALLTHRU */ -- disconnect = true; - case RDMA_CM_EVENT_TIMEWAIT_EXIT: /* FALLTHRU */ -- ret = isert_disconnected_handler(cma_id, disconnect); -+ ret = isert_disconnected_handler(cma_id, event->event); - break; -+ case RDMA_CM_EVENT_REJECTED: /* FALLTHRU */ -+ case RDMA_CM_EVENT_UNREACHABLE: /* FALLTHRU */ - case RDMA_CM_EVENT_CONNECT_ERROR: -+ isert_connect_error(cma_id); -+ break; - default: - pr_err("Unhandled RDMA CMA event: %d\n", event->event); - break; -@@ -906,7 +985,7 @@ isert_init_send_wr(struct isert_conn *isert_conn, struct isert_cmd *isert_cmd, - * bit for every ISERT_COMP_BATCH_COUNT number of ib_post_send() calls. - */ - mutex_lock(&isert_conn->conn_mutex); -- if (coalesce && isert_conn->state == ISER_CONN_UP && -+ if (coalesce && isert_conn->state == ISER_CONN_FULL_FEATURE && - ++isert_conn->conn_comp_batch < ISERT_COMP_BATCH_COUNT) { - tx_desc->llnode_active = true; - llist_add(&tx_desc->comp_llnode, &isert_conn->conn_comp_llist); -@@ -1003,7 +1082,10 @@ isert_put_login_tx(struct iscsi_conn *conn, struct iscsi_login *login, - if (ret) - return ret; - -- isert_conn->state = ISER_CONN_UP; -+ /* Now we are in FULL_FEATURE phase */ -+ mutex_lock(&isert_conn->conn_mutex); -+ isert_conn->state = ISER_CONN_FULL_FEATURE; -+ mutex_unlock(&isert_conn->conn_mutex); - goto post_send; - } - -@@ -1020,18 +1102,17 @@ post_send: - } - - static void --isert_rx_login_req(struct iser_rx_desc *rx_desc, int rx_buflen, -- struct isert_conn *isert_conn) -+isert_rx_login_req(struct isert_conn *isert_conn) - { -+ struct iser_rx_desc *rx_desc = (void *)isert_conn->login_req_buf; -+ int rx_buflen = isert_conn->login_req_len; - struct iscsi_conn *conn = isert_conn->conn; - struct iscsi_login *login = conn->conn_login; - int size; - -- if (!login) { -- pr_err("conn->conn_login is NULL\n"); -- dump_stack(); -- return; -- } -+ pr_info("conn %p\n", isert_conn); -+ -+ WARN_ON_ONCE(!login); - - if (login->first_request) { - struct iscsi_login_req *login_req = -@@ -1394,11 +1475,20 @@ isert_rx_completion(struct iser_rx_desc *desc, struct isert_conn *isert_conn, - hdr->opcode, hdr->itt, hdr->flags, - (int)(xfer_len - ISER_HEADERS_LEN)); - -- if ((char *)desc == isert_conn->login_req_buf) -- isert_rx_login_req(desc, xfer_len - ISER_HEADERS_LEN, -- isert_conn); -- else -+ if ((char *)desc == isert_conn->login_req_buf) { -+ isert_conn->login_req_len = xfer_len - ISER_HEADERS_LEN; -+ if (isert_conn->conn) { -+ struct iscsi_login *login = isert_conn->conn->conn_login; -+ -+ if (login && !login->first_request) -+ isert_rx_login_req(isert_conn); -+ } -+ mutex_lock(&isert_conn->conn_mutex); -+ complete(&isert_conn->login_req_comp); -+ mutex_unlock(&isert_conn->conn_mutex); -+ } else { - isert_rx_do_work(desc, isert_conn); -+ } - - ib_dma_sync_single_for_device(ib_dev, rx_dma, rx_buflen, - DMA_FROM_DEVICE); -@@ -1799,7 +1889,7 @@ isert_cq_rx_comp_err(struct isert_conn *isert_conn) - msleep(3000); - - mutex_lock(&isert_conn->conn_mutex); -- isert_conn->state = ISER_CONN_DOWN; -+ isert_conn_terminate(isert_conn); - mutex_unlock(&isert_conn->conn_mutex); - - iscsit_cause_connection_reinstatement(isert_conn->conn, 0); -@@ -2579,13 +2669,51 @@ isert_response_queue(struct iscsi_conn *conn, struct iscsi_cmd *cmd, int state) - return ret; - } - -+struct rdma_cm_id * -+isert_setup_id(struct isert_np *isert_np) -+{ -+ struct iscsi_np *np = isert_np->np; -+ struct rdma_cm_id *id; -+ struct sockaddr *sa; -+ int ret; -+ -+ sa = (struct sockaddr *)&np->np_sockaddr; -+ pr_debug("ksockaddr: %p, sa: %p\n", &np->np_sockaddr, sa); -+ -+ id = rdma_create_id(isert_cma_handler, isert_np, -+ RDMA_PS_TCP, IB_QPT_RC); -+ if (IS_ERR(id)) { -+ pr_err("rdma_create_id() failed: %ld\n", PTR_ERR(id)); -+ ret = PTR_ERR(id); -+ goto out; -+ } -+ pr_debug("id %p context %p\n", id, id->context); -+ -+ ret = rdma_bind_addr(id, sa); -+ if (ret) { -+ pr_err("rdma_bind_addr() failed: %d\n", ret); -+ goto out_id; -+ } -+ -+ ret = rdma_listen(id, ISERT_RDMA_LISTEN_BACKLOG); -+ if (ret) { -+ pr_err("rdma_listen() failed: %d\n", ret); -+ goto out_id; -+ } -+ -+ return id; -+out_id: -+ rdma_destroy_id(id); -+out: -+ return ERR_PTR(ret); -+} -+ - static int - isert_setup_np(struct iscsi_np *np, - struct __kernel_sockaddr_storage *ksockaddr) - { - struct isert_np *isert_np; - struct rdma_cm_id *isert_lid; -- struct sockaddr *sa; - int ret; - - isert_np = kzalloc(sizeof(struct isert_np), GFP_KERNEL); -@@ -2597,9 +2725,8 @@ isert_setup_np(struct iscsi_np *np, - mutex_init(&isert_np->np_accept_mutex); - INIT_LIST_HEAD(&isert_np->np_accept_list); - init_completion(&isert_np->np_login_comp); -+ isert_np->np = np; - -- sa = (struct sockaddr *)ksockaddr; -- pr_debug("ksockaddr: %p, sa: %p\n", ksockaddr, sa); - /* - * Setup the np->np_sockaddr from the passed sockaddr setup - * in iscsi_target_configfs.c code.. -@@ -2607,37 +2734,20 @@ isert_setup_np(struct iscsi_np *np, - memcpy(&np->np_sockaddr, ksockaddr, - sizeof(struct __kernel_sockaddr_storage)); - -- isert_lid = rdma_create_id(isert_cma_handler, np, RDMA_PS_TCP, -- IB_QPT_RC); -+ isert_lid = isert_setup_id(isert_np); - if (IS_ERR(isert_lid)) { -- pr_err("rdma_create_id() for isert_listen_handler failed: %ld\n", -- PTR_ERR(isert_lid)); - ret = PTR_ERR(isert_lid); - goto out; - } - -- ret = rdma_bind_addr(isert_lid, sa); -- if (ret) { -- pr_err("rdma_bind_addr() for isert_lid failed: %d\n", ret); -- goto out_lid; -- } -- -- ret = rdma_listen(isert_lid, ISERT_RDMA_LISTEN_BACKLOG); -- if (ret) { -- pr_err("rdma_listen() for isert_lid failed: %d\n", ret); -- goto out_lid; -- } -- - isert_np->np_cm_id = isert_lid; - np->np_context = isert_np; -- pr_debug("Setup isert_lid->context: %p\n", isert_lid->context); - - return 0; - --out_lid: -- rdma_destroy_id(isert_lid); - out: - kfree(isert_np); -+ - return ret; - } - -@@ -2673,7 +2783,15 @@ isert_get_login_rx(struct iscsi_conn *conn, struct iscsi_login *login) - struct isert_conn *isert_conn = (struct isert_conn *)conn->context; - int ret; - -- pr_debug("isert_get_login_rx before conn_login_comp conn: %p\n", conn); -+ pr_info("before login_req comp conn: %p\n", isert_conn); -+ ret = wait_for_completion_interruptible(&isert_conn->login_req_comp); -+ if (ret) { -+ pr_err("isert_conn %p interrupted before got login req\n", -+ isert_conn); -+ return ret; -+ } -+ reinit_completion(&isert_conn->login_req_comp); -+ - /* - * For login requests after the first PDU, isert_rx_login_req() will - * kick schedule_delayed_work(&conn->login_work) as the packet is -@@ -2683,11 +2801,15 @@ isert_get_login_rx(struct iscsi_conn *conn, struct iscsi_login *login) - if (!login->first_request) - return 0; - -+ isert_rx_login_req(isert_conn); -+ -+ pr_info("before conn_login_comp conn: %p\n", conn); - ret = wait_for_completion_interruptible(&isert_conn->conn_login_comp); - if (ret) - return ret; - -- pr_debug("isert_get_login_rx processing login->req: %p\n", login->req); -+ pr_info("processing login->req: %p\n", login->req); -+ - return 0; - } - -@@ -2765,17 +2887,10 @@ accept_wait: - isert_conn->conn = conn; - max_accept = 0; - -- ret = isert_rdma_post_recvl(isert_conn); -- if (ret) -- return ret; -- -- ret = isert_rdma_accept(isert_conn); -- if (ret) -- return ret; -- - isert_set_conn_info(np, conn, isert_conn); - -- pr_debug("Processing isert_accept_np: isert_conn: %p\n", isert_conn); -+ pr_debug("Processing isert_conn: %p\n", isert_conn); -+ - return 0; - } - -@@ -2791,6 +2906,24 @@ isert_free_np(struct iscsi_np *np) - kfree(isert_np); - } - -+static void isert_release_work(struct work_struct *work) -+{ -+ struct isert_conn *isert_conn = container_of(work, -+ struct isert_conn, -+ release_work); -+ -+ pr_info("Starting release conn %p\n", isert_conn); -+ -+ wait_for_completion(&isert_conn->conn_wait); -+ -+ mutex_lock(&isert_conn->conn_mutex); -+ isert_conn->state = ISER_CONN_DOWN; -+ mutex_unlock(&isert_conn->conn_mutex); -+ -+ pr_info("Destroying conn %p\n", isert_conn); -+ isert_put_conn(isert_conn); -+} -+ - static void isert_wait_conn(struct iscsi_conn *conn) - { - struct isert_conn *isert_conn = conn->context; -@@ -2798,10 +2931,6 @@ static void isert_wait_conn(struct iscsi_conn *conn) - pr_debug("isert_wait_conn: Starting \n"); - - mutex_lock(&isert_conn->conn_mutex); -- if (isert_conn->conn_cm_id) { -- pr_debug("Calling rdma_disconnect from isert_wait_conn\n"); -- rdma_disconnect(isert_conn->conn_cm_id); -- } - /* - * Only wait for conn_wait_comp_err if the isert_conn made it - * into full feature phase.. -@@ -2810,14 +2939,13 @@ static void isert_wait_conn(struct iscsi_conn *conn) - mutex_unlock(&isert_conn->conn_mutex); - return; - } -- if (isert_conn->state == ISER_CONN_UP) -- isert_conn->state = ISER_CONN_TERMINATING; -+ isert_conn_terminate(isert_conn); - mutex_unlock(&isert_conn->conn_mutex); - - wait_for_completion(&isert_conn->conn_wait_comp_err); - -- wait_for_completion(&isert_conn->conn_wait); -- isert_put_conn(isert_conn); -+ INIT_WORK(&isert_conn->release_work, isert_release_work); -+ queue_work(isert_release_wq, &isert_conn->release_work); - } - - static void isert_free_conn(struct iscsi_conn *conn) -@@ -2863,10 +2991,21 @@ static int __init isert_init(void) - goto destroy_rx_wq; - } - -+ isert_release_wq = alloc_workqueue("isert_release_wq", WQ_UNBOUND, -+ WQ_UNBOUND_MAX_ACTIVE); -+ if (!isert_release_wq) { -+ pr_err("Unable to allocate isert_release_wq\n"); -+ ret = -ENOMEM; -+ goto destroy_comp_wq; -+ } -+ - iscsit_register_transport(&iser_target_transport); -- pr_debug("iSER_TARGET[0] - Loaded iser_target_transport\n"); -+ pr_info("iSER_TARGET[0] - Loaded iser_target_transport\n"); -+ - return 0; - -+destroy_comp_wq: -+ destroy_workqueue(isert_comp_wq); - destroy_rx_wq: - destroy_workqueue(isert_rx_wq); - return ret; -@@ -2875,6 +3014,7 @@ destroy_rx_wq: - static void __exit isert_exit(void) - { - flush_scheduled_work(); -+ destroy_workqueue(isert_release_wq); - destroy_workqueue(isert_comp_wq); - destroy_workqueue(isert_rx_wq); - iscsit_unregister_transport(&iser_target_transport); -diff --git a/drivers/infiniband/ulp/isert/ib_isert.h b/drivers/infiniband/ulp/isert/ib_isert.h -index cbecaabe90b9..1178c5b6800c 100644 ---- a/drivers/infiniband/ulp/isert/ib_isert.h -+++ b/drivers/infiniband/ulp/isert/ib_isert.h -@@ -23,6 +23,7 @@ enum iser_ib_op_code { - enum iser_conn_state { - ISER_CONN_INIT, - ISER_CONN_UP, -+ ISER_CONN_FULL_FEATURE, - ISER_CONN_TERMINATING, - ISER_CONN_DOWN, - }; -@@ -102,6 +103,7 @@ struct isert_conn { - char *login_req_buf; - char *login_rsp_buf; - u64 login_req_dma; -+ int login_req_len; - u64 login_rsp_dma; - unsigned int conn_rx_desc_head; - struct iser_rx_desc *conn_rx_descs; -@@ -109,13 +111,13 @@ struct isert_conn { - struct iscsi_conn *conn; - struct list_head conn_accept_node; - struct completion conn_login_comp; -+ struct completion login_req_comp; - struct iser_tx_desc conn_login_tx_desc; - struct rdma_cm_id *conn_cm_id; - struct ib_pd *conn_pd; - struct ib_mr *conn_mr; - struct ib_qp *conn_qp; - struct isert_device *conn_device; -- struct work_struct conn_logout_work; - struct mutex conn_mutex; - struct completion conn_wait; - struct completion conn_wait_comp_err; -@@ -124,10 +126,10 @@ struct isert_conn { - int conn_fr_pool_size; - /* lock to protect fastreg pool */ - spinlock_t conn_lock; -+ struct work_struct release_work; - #define ISERT_COMP_BATCH_COUNT 8 - int conn_comp_batch; - struct llist_head conn_comp_llist; -- bool disconnect; - }; - - #define ISERT_MAX_CQ 64 -@@ -158,6 +160,7 @@ struct isert_device { - }; - - struct isert_np { -+ struct iscsi_np *np; - struct semaphore np_sem; - struct rdma_cm_id *np_cm_id; - struct mutex np_accept_mutex; -diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h -index 8fca488fdc15..c43c46f7dcd0 100644 ---- a/drivers/input/serio/i8042-x86ia64io.h -+++ b/drivers/input/serio/i8042-x86ia64io.h -@@ -408,6 +408,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = { - }, - }, - { -+ /* Acer Aspire 7738 */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Acer"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 7738"), -+ }, -+ }, -+ { - /* Gericom Bellagio */ - .matches = { - DMI_MATCH(DMI_SYS_VENDOR, "Gericom"), -@@ -721,6 +728,35 @@ static const struct dmi_system_id __initconst i8042_dmi_dritek_table[] = { - { } - }; - -+/* -+ * Some laptops need keyboard reset before probing for the trackpad to get -+ * it detected, initialised & finally work. -+ */ -+static const struct dmi_system_id __initconst i8042_dmi_kbdreset_table[] = { -+ { -+ /* Gigabyte P35 v2 - Elantech touchpad */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "P35V2"), -+ }, -+ }, -+ { -+ /* Aorus branded Gigabyte X3 Plus - Elantech touchpad */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "X3"), -+ }, -+ }, -+ { -+ /* Gigabyte P34 - Elantech touchpad */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "P34"), -+ }, -+ }, -+ { } -+}; -+ - #endif /* CONFIG_X86 */ - - #ifdef CONFIG_PNP -@@ -1016,6 +1052,9 @@ static int __init i8042_platform_init(void) - if (dmi_check_system(i8042_dmi_dritek_table)) - i8042_dritek = true; - -+ if (dmi_check_system(i8042_dmi_kbdreset_table)) -+ i8042_kbdreset = true; -+ - /* - * A20 was already enabled during early kernel init. But some buggy - * BIOSes (in MSI Laptops) require A20 to be enabled using 8042 to -diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c -index 3807c3e971cc..eb796fff9e62 100644 ---- a/drivers/input/serio/i8042.c -+++ b/drivers/input/serio/i8042.c -@@ -67,6 +67,10 @@ static bool i8042_notimeout; - module_param_named(notimeout, i8042_notimeout, bool, 0); - MODULE_PARM_DESC(notimeout, "Ignore timeouts signalled by i8042"); - -+static bool i8042_kbdreset; -+module_param_named(kbdreset, i8042_kbdreset, bool, 0); -+MODULE_PARM_DESC(kbdreset, "Reset device connected to KBD port"); -+ - #ifdef CONFIG_X86 - static bool i8042_dritek; - module_param_named(dritek, i8042_dritek, bool, 0); -@@ -790,6 +794,16 @@ static int __init i8042_check_aux(void) - return -1; - - /* -+ * Reset keyboard (needed on some laptops to successfully detect -+ * touchpad, e.g., some Gigabyte laptop models with Elantech -+ * touchpads). -+ */ -+ if (i8042_kbdreset) { -+ pr_warn("Attempting to reset device connected to KBD port\n"); -+ i8042_kbd_write(NULL, (unsigned char) 0xff); -+ } -+ -+/* - * Test AUX IRQ delivery to make sure BIOS did not grab the IRQ and - * used it for a PCI card or somethig else. - */ -diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c -index 5f9c2a665ca5..fbcb6225f794 100644 ---- a/drivers/md/bcache/btree.c -+++ b/drivers/md/bcache/btree.c -@@ -199,7 +199,7 @@ void bch_btree_node_read_done(struct btree *b) - struct bset *i = btree_bset_first(b); - struct btree_iter *iter; - -- iter = mempool_alloc(b->c->fill_iter, GFP_NOWAIT); -+ iter = mempool_alloc(b->c->fill_iter, GFP_NOIO); - iter->size = b->c->sb.bucket_size / b->c->sb.block_size; - iter->used = 0; - -diff --git a/drivers/media/i2c/smiapp-pll.c b/drivers/media/i2c/smiapp-pll.c -index 2335529b195c..ab5d9a3adebf 100644 ---- a/drivers/media/i2c/smiapp-pll.c -+++ b/drivers/media/i2c/smiapp-pll.c -@@ -67,7 +67,7 @@ static void print_pll(struct device *dev, struct smiapp_pll *pll) - { - dev_dbg(dev, "pre_pll_clk_div\t%d\n", pll->pre_pll_clk_div); - dev_dbg(dev, "pll_multiplier \t%d\n", pll->pll_multiplier); -- if (pll->flags != SMIAPP_PLL_FLAG_NO_OP_CLOCKS) { -+ if (!(pll->flags & SMIAPP_PLL_FLAG_NO_OP_CLOCKS)) { - dev_dbg(dev, "op_sys_clk_div \t%d\n", pll->op_sys_clk_div); - dev_dbg(dev, "op_pix_clk_div \t%d\n", pll->op_pix_clk_div); - } -@@ -77,7 +77,7 @@ static void print_pll(struct device *dev, struct smiapp_pll *pll) - dev_dbg(dev, "ext_clk_freq_hz \t%d\n", pll->ext_clk_freq_hz); - dev_dbg(dev, "pll_ip_clk_freq_hz \t%d\n", pll->pll_ip_clk_freq_hz); - dev_dbg(dev, "pll_op_clk_freq_hz \t%d\n", pll->pll_op_clk_freq_hz); -- if (pll->flags & SMIAPP_PLL_FLAG_NO_OP_CLOCKS) { -+ if (!(pll->flags & SMIAPP_PLL_FLAG_NO_OP_CLOCKS)) { - dev_dbg(dev, "op_sys_clk_freq_hz \t%d\n", - pll->op_sys_clk_freq_hz); - dev_dbg(dev, "op_pix_clk_freq_hz \t%d\n", -diff --git a/drivers/media/i2c/smiapp/smiapp-core.c b/drivers/media/i2c/smiapp/smiapp-core.c -index 7026ab08ec91..873d0627a75b 100644 ---- a/drivers/media/i2c/smiapp/smiapp-core.c -+++ b/drivers/media/i2c/smiapp/smiapp-core.c -@@ -2624,7 +2624,9 @@ static int smiapp_registered(struct v4l2_subdev *subdev) - pll->flags |= SMIAPP_PLL_FLAG_OP_PIX_CLOCK_PER_LANE; - pll->scale_n = sensor->limits[SMIAPP_LIMIT_SCALER_N_MIN]; - -+ mutex_lock(&sensor->mutex); - rval = smiapp_update_mode(sensor); -+ mutex_unlock(&sensor->mutex); - if (rval) { - dev_err(&client->dev, "update mode failed\n"); - goto out_nvm_release; -diff --git a/drivers/media/usb/au0828/au0828-cards.c b/drivers/media/usb/au0828/au0828-cards.c -index dd32decb237d..1d4b11038958 100644 ---- a/drivers/media/usb/au0828/au0828-cards.c -+++ b/drivers/media/usb/au0828/au0828-cards.c -@@ -36,6 +36,11 @@ static void hvr950q_cs5340_audio(void *priv, int enable) - au0828_clear(dev, REG_000, 0x10); - } - -+/* -+ * WARNING: There's a quirks table at sound/usb/quirks-table.h -+ * that should also be updated every time a new device with V4L2 support -+ * is added here. -+ */ - struct au0828_board au0828_boards[] = { - [AU0828_BOARD_UNKNOWN] = { - .name = "Unknown board", -diff --git a/drivers/media/usb/dvb-usb/af9005.c b/drivers/media/usb/dvb-usb/af9005.c -index af176b6ce738..e6d3561eea47 100644 ---- a/drivers/media/usb/dvb-usb/af9005.c -+++ b/drivers/media/usb/dvb-usb/af9005.c -@@ -1081,9 +1081,12 @@ static int __init af9005_usb_module_init(void) - err("usb_register failed. (%d)", result); - return result; - } -+#if IS_MODULE(CONFIG_DVB_USB_AF9005) || defined(CONFIG_DVB_USB_AF9005_REMOTE) -+ /* FIXME: convert to todays kernel IR infrastructure */ - rc_decode = symbol_request(af9005_rc_decode); - rc_keys = symbol_request(rc_map_af9005_table); - rc_keys_size = symbol_request(rc_map_af9005_table_size); -+#endif - if (rc_decode == NULL || rc_keys == NULL || rc_keys_size == NULL) { - err("af9005_rc_decode function not found, disabling remote"); - af9005_properties.rc.legacy.rc_query = NULL; -diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c -index 753ad4cfc118..45314412b4a3 100644 ---- a/drivers/media/usb/uvc/uvc_driver.c -+++ b/drivers/media/usb/uvc/uvc_driver.c -@@ -1603,12 +1603,12 @@ static void uvc_delete(struct uvc_device *dev) - { - struct list_head *p, *n; - -- usb_put_intf(dev->intf); -- usb_put_dev(dev->udev); -- - uvc_status_cleanup(dev); - uvc_ctrl_cleanup_device(dev); - -+ usb_put_intf(dev->intf); -+ usb_put_dev(dev->udev); -+ - if (dev->vdev.dev) - v4l2_device_unregister(&dev->vdev); - #ifdef CONFIG_MEDIA_CONTROLLER -diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c -index e77d11049747..4e65b35bebc0 100644 ---- a/drivers/net/can/usb/kvaser_usb.c -+++ b/drivers/net/can/usb/kvaser_usb.c -@@ -1237,6 +1237,9 @@ static int kvaser_usb_close(struct net_device *netdev) - if (err) - netdev_warn(netdev, "Cannot stop device, error %d\n", err); - -+ /* reset tx contexts */ -+ kvaser_usb_unlink_tx_urbs(priv); -+ - priv->can.state = CAN_STATE_STOPPED; - close_candev(priv->netdev); - -@@ -1285,12 +1288,14 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb, - if (!urb) { - netdev_err(netdev, "No memory left for URBs\n"); - stats->tx_dropped++; -- goto nourbmem; -+ dev_kfree_skb(skb); -+ return NETDEV_TX_OK; - } - - buf = kmalloc(sizeof(struct kvaser_msg), GFP_ATOMIC); - if (!buf) { - stats->tx_dropped++; -+ dev_kfree_skb(skb); - goto nobufmem; - } - -@@ -1325,6 +1330,7 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb, - } - } - -+ /* This should never happen; it implies a flow control bug */ - if (!context) { - netdev_warn(netdev, "cannot find free context\n"); - ret = NETDEV_TX_BUSY; -@@ -1355,9 +1361,6 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb, - if (unlikely(err)) { - can_free_echo_skb(netdev, context->echo_index); - -- skb = NULL; /* set to NULL to avoid double free in -- * dev_kfree_skb(skb) */ -- - atomic_dec(&priv->active_tx_urbs); - usb_unanchor_urb(urb); - -@@ -1379,8 +1382,6 @@ releasebuf: - kfree(buf); - nobufmem: - usb_free_urb(urb); --nourbmem: -- dev_kfree_skb(skb); - return ret; - } - -@@ -1492,6 +1493,10 @@ static int kvaser_usb_init_one(struct usb_interface *intf, - struct kvaser_usb_net_priv *priv; - int i, err; - -+ err = kvaser_usb_send_simple_msg(dev, CMD_RESET_CHIP, channel); -+ if (err) -+ return err; -+ - netdev = alloc_candev(sizeof(*priv), MAX_TX_URBS); - if (!netdev) { - dev_err(&intf->dev, "Cannot alloc candev\n"); -@@ -1595,9 +1600,6 @@ static int kvaser_usb_probe(struct usb_interface *intf, - - usb_set_intfdata(intf, dev); - -- for (i = 0; i < MAX_NET_DEVICES; i++) -- kvaser_usb_send_simple_msg(dev, CMD_RESET_CHIP, i); -- - err = kvaser_usb_get_software_info(dev); - if (err) { - dev_err(&intf->dev, -diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c -index 380d24922049..3e1d7d29b4ec 100644 ---- a/drivers/net/ethernet/atheros/alx/main.c -+++ b/drivers/net/ethernet/atheros/alx/main.c -@@ -184,15 +184,16 @@ static void alx_schedule_reset(struct alx_priv *alx) - schedule_work(&alx->reset_wk); - } - --static bool alx_clean_rx_irq(struct alx_priv *alx, int budget) -+static int alx_clean_rx_irq(struct alx_priv *alx, int budget) - { - struct alx_rx_queue *rxq = &alx->rxq; - struct alx_rrd *rrd; - struct alx_buffer *rxb; - struct sk_buff *skb; - u16 length, rfd_cleaned = 0; -+ int work = 0; - -- while (budget > 0) { -+ while (work < budget) { - rrd = &rxq->rrd[rxq->rrd_read_idx]; - if (!(rrd->word3 & cpu_to_le32(1 << RRD_UPDATED_SHIFT))) - break; -@@ -203,7 +204,7 @@ static bool alx_clean_rx_irq(struct alx_priv *alx, int budget) - ALX_GET_FIELD(le32_to_cpu(rrd->word0), - RRD_NOR) != 1) { - alx_schedule_reset(alx); -- return 0; -+ return work; - } - - rxb = &rxq->bufs[rxq->read_idx]; -@@ -243,7 +244,7 @@ static bool alx_clean_rx_irq(struct alx_priv *alx, int budget) - } - - napi_gro_receive(&alx->napi, skb); -- budget--; -+ work++; - - next_pkt: - if (++rxq->read_idx == alx->rx_ringsz) -@@ -258,21 +259,22 @@ next_pkt: - if (rfd_cleaned) - alx_refill_rx_ring(alx, GFP_ATOMIC); - -- return budget > 0; -+ return work; - } - - static int alx_poll(struct napi_struct *napi, int budget) - { - struct alx_priv *alx = container_of(napi, struct alx_priv, napi); - struct alx_hw *hw = &alx->hw; -- bool complete = true; - unsigned long flags; -+ bool tx_complete; -+ int work; - -- complete = alx_clean_tx_irq(alx) && -- alx_clean_rx_irq(alx, budget); -+ tx_complete = alx_clean_tx_irq(alx); -+ work = alx_clean_rx_irq(alx, budget); - -- if (!complete) -- return 1; -+ if (!tx_complete || work == budget) -+ return budget; - - napi_complete(&alx->napi); - -@@ -284,7 +286,7 @@ static int alx_poll(struct napi_struct *napi, int budget) - - alx_post_write(hw); - -- return 0; -+ return work; - } - - static irqreturn_t alx_intr_handle(struct alx_priv *alx, u32 intr) -diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c -index 086eac5af5c2..82061139b215 100644 ---- a/drivers/net/ethernet/broadcom/tg3.c -+++ b/drivers/net/ethernet/broadcom/tg3.c -@@ -17731,23 +17731,6 @@ static int tg3_init_one(struct pci_dev *pdev, - goto err_out_apeunmap; - } - -- /* -- * Reset chip in case UNDI or EFI driver did not shutdown -- * DMA self test will enable WDMAC and we'll see (spurious) -- * pending DMA on the PCI bus at that point. -- */ -- if ((tr32(HOSTCC_MODE) & HOSTCC_MODE_ENABLE) || -- (tr32(WDMAC_MODE) & WDMAC_MODE_ENABLE)) { -- tw32(MEMARB_MODE, MEMARB_MODE_ENABLE); -- tg3_halt(tp, RESET_KIND_SHUTDOWN, 1); -- } -- -- err = tg3_test_dma(tp); -- if (err) { -- dev_err(&pdev->dev, "DMA engine test failed, aborting\n"); -- goto err_out_apeunmap; -- } -- - intmbx = MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW; - rcvmbx = MAILBOX_RCVRET_CON_IDX_0 + TG3_64BIT_REG_LOW; - sndmbx = MAILBOX_SNDHOST_PROD_IDX_0 + TG3_64BIT_REG_LOW; -@@ -17792,6 +17775,23 @@ static int tg3_init_one(struct pci_dev *pdev, - sndmbx += 0xc; - } - -+ /* -+ * Reset chip in case UNDI or EFI driver did not shutdown -+ * DMA self test will enable WDMAC and we'll see (spurious) -+ * pending DMA on the PCI bus at that point. -+ */ -+ if ((tr32(HOSTCC_MODE) & HOSTCC_MODE_ENABLE) || -+ (tr32(WDMAC_MODE) & WDMAC_MODE_ENABLE)) { -+ tw32(MEMARB_MODE, MEMARB_MODE_ENABLE); -+ tg3_halt(tp, RESET_KIND_SHUTDOWN, 1); -+ } -+ -+ err = tg3_test_dma(tp); -+ if (err) { -+ dev_err(&pdev->dev, "DMA engine test failed, aborting\n"); -+ goto err_out_apeunmap; -+ } -+ - tg3_init_coal(tp); - - pci_set_drvdata(pdev, dev); -diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c -index b740bfce72ef..ff9b423805a0 100644 ---- a/drivers/net/ethernet/cisco/enic/enic_main.c -+++ b/drivers/net/ethernet/cisco/enic/enic_main.c -@@ -1044,10 +1044,14 @@ static void enic_rq_indicate_buf(struct vnic_rq *rq, - PKT_HASH_TYPE_L4 : PKT_HASH_TYPE_L3); - } - -- if ((netdev->features & NETIF_F_RXCSUM) && !csum_not_calc) { -- skb->csum = htons(checksum); -- skb->ip_summed = CHECKSUM_COMPLETE; -- } -+ /* Hardware does not provide whole packet checksum. It only -+ * provides pseudo checksum. Since hw validates the packet -+ * checksum but not provide us the checksum value. use -+ * CHECSUM_UNNECESSARY. -+ */ -+ if ((netdev->features & NETIF_F_RXCSUM) && tcp_udp_csum_ok && -+ ipv4_csum_ok) -+ skb->ip_summed = CHECKSUM_UNNECESSARY; - - if (vlan_stripped) - __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), vlan_tci); -diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c -index 921b9df2faca..316650c3b5d7 100644 ---- a/drivers/net/ethernet/ti/cpsw.c -+++ b/drivers/net/ethernet/ti/cpsw.c -@@ -596,7 +596,7 @@ static void cpsw_set_promiscious(struct net_device *ndev, bool enable) - - /* Clear all mcast from ALE */ - cpsw_ale_flush_multicast(ale, ALE_ALL_PORTS << -- priv->host_port); -+ priv->host_port, -1); - - /* Flood All Unicast Packets to Host port */ - cpsw_ale_control_set(ale, 0, ALE_P0_UNI_FLOOD, 1); -@@ -620,6 +620,12 @@ static void cpsw_set_promiscious(struct net_device *ndev, bool enable) - static void cpsw_ndo_set_rx_mode(struct net_device *ndev) - { - struct cpsw_priv *priv = netdev_priv(ndev); -+ int vid; -+ -+ if (priv->data.dual_emac) -+ vid = priv->slaves[priv->emac_port].port_vlan; -+ else -+ vid = priv->data.default_vlan; - - if (ndev->flags & IFF_PROMISC) { - /* Enable promiscuous mode */ -@@ -631,7 +637,8 @@ static void cpsw_ndo_set_rx_mode(struct net_device *ndev) - } - - /* Clear all mcast from ALE */ -- cpsw_ale_flush_multicast(priv->ale, ALE_ALL_PORTS << priv->host_port); -+ cpsw_ale_flush_multicast(priv->ale, ALE_ALL_PORTS << priv->host_port, -+ vid); - - if (!netdev_mc_empty(ndev)) { - struct netdev_hw_addr *ha; -@@ -716,6 +723,14 @@ static void cpsw_rx_handler(void *token, int len, int status) - static irqreturn_t cpsw_interrupt(int irq, void *dev_id) - { - struct cpsw_priv *priv = dev_id; -+ int value = irq - priv->irqs_table[0]; -+ -+ /* NOTICE: Ending IRQ here. The trick with the 'value' variable above -+ * is to make sure we will always write the correct value to the EOI -+ * register. Namely 0 for RX_THRESH Interrupt, 1 for RX Interrupt, 2 -+ * for TX Interrupt and 3 for MISC Interrupt. -+ */ -+ cpdma_ctlr_eoi(priv->dma, value); - - cpsw_intr_disable(priv); - if (priv->irq_enabled == true) { -@@ -745,8 +760,6 @@ static int cpsw_poll(struct napi_struct *napi, int budget) - int num_tx, num_rx; - - num_tx = cpdma_chan_process(priv->txch, 128); -- if (num_tx) -- cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_TX); - - num_rx = cpdma_chan_process(priv->rxch, budget); - if (num_rx < budget) { -@@ -754,7 +767,6 @@ static int cpsw_poll(struct napi_struct *napi, int budget) - - napi_complete(napi); - cpsw_intr_enable(priv); -- cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_RX); - prim_cpsw = cpsw_get_slave_priv(priv, 0); - if (prim_cpsw->irq_enabled == false) { - prim_cpsw->irq_enabled = true; -@@ -1265,8 +1277,6 @@ static int cpsw_ndo_open(struct net_device *ndev) - napi_enable(&priv->napi); - cpdma_ctlr_start(priv->dma); - cpsw_intr_enable(priv); -- cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_RX); -- cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_TX); - - if (priv->data.dual_emac) - priv->slaves[priv->emac_port].open_stat = true; -@@ -1512,9 +1522,6 @@ static void cpsw_ndo_tx_timeout(struct net_device *ndev) - cpdma_chan_start(priv->txch); - cpdma_ctlr_int_ctrl(priv->dma, true); - cpsw_intr_enable(priv); -- cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_RX); -- cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_TX); -- - } - - static int cpsw_ndo_set_mac_address(struct net_device *ndev, void *p) -@@ -1560,9 +1567,6 @@ static void cpsw_ndo_poll_controller(struct net_device *ndev) - cpsw_interrupt(ndev->irq, priv); - cpdma_ctlr_int_ctrl(priv->dma, true); - cpsw_intr_enable(priv); -- cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_RX); -- cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_TX); -- - } - #endif - -diff --git a/drivers/net/ethernet/ti/cpsw_ale.c b/drivers/net/ethernet/ti/cpsw_ale.c -index 7f893069c418..4eceb7e42c80 100644 ---- a/drivers/net/ethernet/ti/cpsw_ale.c -+++ b/drivers/net/ethernet/ti/cpsw_ale.c -@@ -236,7 +236,7 @@ static void cpsw_ale_flush_mcast(struct cpsw_ale *ale, u32 *ale_entry, - cpsw_ale_set_entry_type(ale_entry, ALE_TYPE_FREE); - } - --int cpsw_ale_flush_multicast(struct cpsw_ale *ale, int port_mask) -+int cpsw_ale_flush_multicast(struct cpsw_ale *ale, int port_mask, int vid) - { - u32 ale_entry[ALE_ENTRY_WORDS]; - int ret, idx; -@@ -247,6 +247,14 @@ int cpsw_ale_flush_multicast(struct cpsw_ale *ale, int port_mask) - if (ret != ALE_TYPE_ADDR && ret != ALE_TYPE_VLAN_ADDR) - continue; - -+ /* if vid passed is -1 then remove all multicast entry from -+ * the table irrespective of vlan id, if a valid vlan id is -+ * passed then remove only multicast added to that vlan id. -+ * if vlan id doesn't match then move on to next entry. -+ */ -+ if (vid != -1 && cpsw_ale_get_vlan_id(ale_entry) != vid) -+ continue; -+ - if (cpsw_ale_get_mcast(ale_entry)) { - u8 addr[6]; - -diff --git a/drivers/net/ethernet/ti/cpsw_ale.h b/drivers/net/ethernet/ti/cpsw_ale.h -index de409c33b250..e701358fd00b 100644 ---- a/drivers/net/ethernet/ti/cpsw_ale.h -+++ b/drivers/net/ethernet/ti/cpsw_ale.h -@@ -88,7 +88,7 @@ void cpsw_ale_stop(struct cpsw_ale *ale); - - int cpsw_ale_set_ageout(struct cpsw_ale *ale, int ageout); - int cpsw_ale_flush(struct cpsw_ale *ale, int port_mask); --int cpsw_ale_flush_multicast(struct cpsw_ale *ale, int port_mask); -+int cpsw_ale_flush_multicast(struct cpsw_ale *ale, int port_mask, int vid); - int cpsw_ale_add_ucast(struct cpsw_ale *ale, u8 *addr, int port, - int flags, u16 vid); - int cpsw_ale_del_ucast(struct cpsw_ale *ale, u8 *addr, int port, -diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c -index 979fe433278c..32efe8371ff8 100644 ---- a/drivers/net/team/team.c -+++ b/drivers/net/team/team.c -@@ -629,6 +629,7 @@ static int team_change_mode(struct team *team, const char *kind) - static void team_notify_peers_work(struct work_struct *work) - { - struct team *team; -+ int val; - - team = container_of(work, struct team, notify_peers.dw.work); - -@@ -636,9 +637,14 @@ static void team_notify_peers_work(struct work_struct *work) - schedule_delayed_work(&team->notify_peers.dw, 0); - return; - } -+ val = atomic_dec_if_positive(&team->notify_peers.count_pending); -+ if (val < 0) { -+ rtnl_unlock(); -+ return; -+ } - call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, team->dev); - rtnl_unlock(); -- if (!atomic_dec_and_test(&team->notify_peers.count_pending)) -+ if (val) - schedule_delayed_work(&team->notify_peers.dw, - msecs_to_jiffies(team->notify_peers.interval)); - } -@@ -669,6 +675,7 @@ static void team_notify_peers_fini(struct team *team) - static void team_mcast_rejoin_work(struct work_struct *work) - { - struct team *team; -+ int val; - - team = container_of(work, struct team, mcast_rejoin.dw.work); - -@@ -676,9 +683,14 @@ static void team_mcast_rejoin_work(struct work_struct *work) - schedule_delayed_work(&team->mcast_rejoin.dw, 0); - return; - } -+ val = atomic_dec_if_positive(&team->mcast_rejoin.count_pending); -+ if (val < 0) { -+ rtnl_unlock(); -+ return; -+ } - call_netdevice_notifiers(NETDEV_RESEND_IGMP, team->dev); - rtnl_unlock(); -- if (!atomic_dec_and_test(&team->mcast_rejoin.count_pending)) -+ if (val) - schedule_delayed_work(&team->mcast_rejoin.dw, - msecs_to_jiffies(team->mcast_rejoin.interval)); - } -diff --git a/drivers/platform/x86/hp_accel.c b/drivers/platform/x86/hp_accel.c -index 3dc934438c28..07fbcb0fb646 100644 ---- a/drivers/platform/x86/hp_accel.c -+++ b/drivers/platform/x86/hp_accel.c -@@ -237,6 +237,7 @@ static struct dmi_system_id lis3lv02d_dmi_ids[] = { - AXIS_DMI_MATCH("HPB64xx", "HP ProBook 64", xy_swap), - AXIS_DMI_MATCH("HPB64xx", "HP EliteBook 84", xy_swap), - AXIS_DMI_MATCH("HPB65xx", "HP ProBook 65", x_inverted), -+ AXIS_DMI_MATCH("HPZBook15", "HP ZBook 15", x_inverted), - { NULL, } - /* Laptop models without axis info (yet): - * "NC6910" "HP Compaq 6910" -diff --git a/drivers/s390/char/con3215.c b/drivers/s390/char/con3215.c -index bb86494e2b7b..19915c5b256f 100644 ---- a/drivers/s390/char/con3215.c -+++ b/drivers/s390/char/con3215.c -@@ -288,12 +288,16 @@ static void raw3215_timeout(unsigned long __data) - unsigned long flags; - - spin_lock_irqsave(get_ccwdev_lock(raw->cdev), flags); -- if (raw->flags & RAW3215_TIMER_RUNS) { -- del_timer(&raw->timer); -- raw->flags &= ~RAW3215_TIMER_RUNS; -- if (!(raw->port.flags & ASYNC_SUSPENDED)) { -- raw3215_mk_write_req(raw); -- raw3215_start_io(raw); -+ raw->flags &= ~RAW3215_TIMER_RUNS; -+ if (!(raw->port.flags & ASYNC_SUSPENDED)) { -+ raw3215_mk_write_req(raw); -+ raw3215_start_io(raw); -+ if ((raw->queued_read || raw->queued_write) && -+ !(raw->flags & RAW3215_WORKING) && -+ !(raw->flags & RAW3215_TIMER_RUNS)) { -+ raw->timer.expires = RAW3215_TIMEOUT + jiffies; -+ add_timer(&raw->timer); -+ raw->flags |= RAW3215_TIMER_RUNS; - } - } - spin_unlock_irqrestore(get_ccwdev_lock(raw->cdev), flags); -@@ -317,17 +321,15 @@ static inline void raw3215_try_io(struct raw3215_info *raw) - (raw->flags & RAW3215_FLUSHING)) { - /* execute write requests bigger than minimum size */ - raw3215_start_io(raw); -- if (raw->flags & RAW3215_TIMER_RUNS) { -- del_timer(&raw->timer); -- raw->flags &= ~RAW3215_TIMER_RUNS; -- } -- } else if (!(raw->flags & RAW3215_TIMER_RUNS)) { -- /* delay small writes */ -- raw->timer.expires = RAW3215_TIMEOUT + jiffies; -- add_timer(&raw->timer); -- raw->flags |= RAW3215_TIMER_RUNS; - } - } -+ if ((raw->queued_read || raw->queued_write) && -+ !(raw->flags & RAW3215_WORKING) && -+ !(raw->flags & RAW3215_TIMER_RUNS)) { -+ raw->timer.expires = RAW3215_TIMEOUT + jiffies; -+ add_timer(&raw->timer); -+ raw->flags |= RAW3215_TIMER_RUNS; -+ } - } - - /* -@@ -1027,12 +1029,26 @@ static int tty3215_write(struct tty_struct * tty, - const unsigned char *buf, int count) - { - struct raw3215_info *raw; -+ int i, written; - - if (!tty) - return 0; - raw = (struct raw3215_info *) tty->driver_data; -- raw3215_write(raw, buf, count); -- return count; -+ written = count; -+ while (count > 0) { -+ for (i = 0; i < count; i++) -+ if (buf[i] == '\t' || buf[i] == '\n') -+ break; -+ raw3215_write(raw, buf, i); -+ count -= i; -+ buf += i; -+ if (count > 0) { -+ raw3215_putchar(raw, *buf); -+ count--; -+ buf++; -+ } -+ } -+ return written; - } - - /* -@@ -1180,7 +1196,7 @@ static int __init tty3215_init(void) - driver->subtype = SYSTEM_TYPE_TTY; - driver->init_termios = tty_std_termios; - driver->init_termios.c_iflag = IGNBRK | IGNPAR; -- driver->init_termios.c_oflag = ONLCR | XTABS; -+ driver->init_termios.c_oflag = ONLCR; - driver->init_termios.c_lflag = ISIG; - driver->flags = TTY_DRIVER_REAL_RAW; - tty_set_operations(driver, &tty3215_ops); -diff --git a/drivers/scsi/mpt2sas/mpt2sas_transport.c b/drivers/scsi/mpt2sas/mpt2sas_transport.c -index 410f4a3e8888..72f9c55d0e00 100644 ---- a/drivers/scsi/mpt2sas/mpt2sas_transport.c -+++ b/drivers/scsi/mpt2sas/mpt2sas_transport.c -@@ -1006,12 +1006,9 @@ mpt2sas_transport_update_links(struct MPT2SAS_ADAPTER *ioc, - &mpt2sas_phy->remote_identify); - _transport_add_phy_to_an_existing_port(ioc, sas_node, - mpt2sas_phy, mpt2sas_phy->remote_identify.sas_address); -- } else { -+ } else - memset(&mpt2sas_phy->remote_identify, 0 , sizeof(struct - sas_identify)); -- _transport_del_phy_from_an_existing_port(ioc, sas_node, -- mpt2sas_phy); -- } - - if (mpt2sas_phy->phy) - mpt2sas_phy->phy->negotiated_linkrate = -diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c -index 65170cb1a00f..55aa597eb229 100644 ---- a/drivers/scsi/mpt3sas/mpt3sas_transport.c -+++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c -@@ -1003,12 +1003,9 @@ mpt3sas_transport_update_links(struct MPT3SAS_ADAPTER *ioc, - &mpt3sas_phy->remote_identify); - _transport_add_phy_to_an_existing_port(ioc, sas_node, - mpt3sas_phy, mpt3sas_phy->remote_identify.sas_address); -- } else { -+ } else - memset(&mpt3sas_phy->remote_identify, 0 , sizeof(struct - sas_identify)); -- _transport_del_phy_from_an_existing_port(ioc, sas_node, -- mpt3sas_phy); -- } - - if (mpt3sas_phy->phy) - mpt3sas_phy->phy->negotiated_linkrate = -diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c -index c1d04d4d3c6c..262ab837a704 100644 ---- a/drivers/scsi/scsi_devinfo.c -+++ b/drivers/scsi/scsi_devinfo.c -@@ -211,6 +211,7 @@ static struct { - {"Medion", "Flash XL MMC/SD", "2.6D", BLIST_FORCELUN}, - {"MegaRAID", "LD", NULL, BLIST_FORCELUN}, - {"MICROP", "4110", NULL, BLIST_NOTQ}, -+ {"MSFT", "Virtual HD", NULL, BLIST_NO_RSOC}, - {"MYLEX", "DACARMRB", "*", BLIST_REPORTLUN2}, - {"nCipher", "Fastness Crypto", NULL, BLIST_FORCELUN}, - {"NAKAMICH", "MJ-4.8S", NULL, BLIST_FORCELUN | BLIST_SINGLELUN}, -diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c -index ed0f899e8aa5..86b05151fdab 100644 ---- a/drivers/scsi/storvsc_drv.c -+++ b/drivers/scsi/storvsc_drv.c -@@ -1690,13 +1690,12 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd) - if (ret == -EAGAIN) { - /* no more space */ - -- if (cmd_request->bounce_sgl_count) { -+ if (cmd_request->bounce_sgl_count) - destroy_bounce_buffer(cmd_request->bounce_sgl, - cmd_request->bounce_sgl_count); - -- ret = SCSI_MLQUEUE_DEVICE_BUSY; -- goto queue_error; -- } -+ ret = SCSI_MLQUEUE_DEVICE_BUSY; -+ goto queue_error; - } - - return 0; -diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c -index d509aa74cfa1..c5d3811a7b8c 100644 ---- a/drivers/target/iscsi/iscsi_target_login.c -+++ b/drivers/target/iscsi/iscsi_target_login.c -@@ -1186,6 +1186,9 @@ old_sess_out: - conn->sock = NULL; - } - -+ if (conn->conn_transport->iscsit_wait_conn) -+ conn->conn_transport->iscsit_wait_conn(conn); -+ - if (conn->conn_transport->iscsit_free_conn) - conn->conn_transport->iscsit_free_conn(conn); - -diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c -index ab77f80ead2b..1e406af4ee47 100644 ---- a/drivers/target/iscsi/iscsi_target_util.c -+++ b/drivers/target/iscsi/iscsi_target_util.c -@@ -1356,15 +1356,15 @@ static int iscsit_do_tx_data( - struct iscsi_conn *conn, - struct iscsi_data_count *count) - { -- int data = count->data_length, total_tx = 0, tx_loop = 0, iov_len; -+ int ret, iov_len; - struct kvec *iov_p; - struct msghdr msg; - - if (!conn || !conn->sock || !conn->conn_ops) - return -1; - -- if (data <= 0) { -- pr_err("Data length is: %d\n", data); -+ if (count->data_length <= 0) { -+ pr_err("Data length is: %d\n", count->data_length); - return -1; - } - -@@ -1373,20 +1373,16 @@ static int iscsit_do_tx_data( - iov_p = count->iov; - iov_len = count->iov_count; - -- while (total_tx < data) { -- tx_loop = kernel_sendmsg(conn->sock, &msg, iov_p, iov_len, -- (data - total_tx)); -- if (tx_loop <= 0) { -- pr_debug("tx_loop: %d total_tx %d\n", -- tx_loop, total_tx); -- return tx_loop; -- } -- total_tx += tx_loop; -- pr_debug("tx_loop: %d, total_tx: %d, data: %d\n", -- tx_loop, total_tx, data); -+ ret = kernel_sendmsg(conn->sock, &msg, iov_p, iov_len, -+ count->data_length); -+ if (ret != count->data_length) { -+ pr_err("Unexpected ret: %d send data %d\n", -+ ret, count->data_length); -+ return -EPIPE; - } -+ pr_debug("ret: %d, sent data: %d\n", ret, count->data_length); - -- return total_tx; -+ return ret; - } - - int rx_data( -diff --git a/drivers/target/loopback/tcm_loop.c b/drivers/target/loopback/tcm_loop.c -index fadad7c5f635..67c802c93ef3 100644 ---- a/drivers/target/loopback/tcm_loop.c -+++ b/drivers/target/loopback/tcm_loop.c -@@ -153,18 +153,11 @@ static int tcm_loop_change_queue_type(struct scsi_device *sdev, int tag) - /* - * Locate the SAM Task Attr from struct scsi_cmnd * - */ --static int tcm_loop_sam_attr(struct scsi_cmnd *sc) --{ -- if (sc->device->tagged_supported) { -- switch (sc->tag) { -- case HEAD_OF_QUEUE_TAG: -- return MSG_HEAD_TAG; -- case ORDERED_QUEUE_TAG: -- return MSG_ORDERED_TAG; -- default: -- break; -- } -- } -+static int tcm_loop_sam_attr(struct scsi_cmnd *sc, int tag) -+{ -+ if (sc->device->tagged_supported && -+ sc->device->ordered_tags && tag >= 0) -+ return MSG_ORDERED_TAG; - - return MSG_SIMPLE_TAG; - } -@@ -197,7 +190,7 @@ static void tcm_loop_submission_work(struct work_struct *work) - set_host_byte(sc, DID_TRANSPORT_DISRUPTED); - goto out_done; - } -- tl_nexus = tl_hba->tl_nexus; -+ tl_nexus = tl_tpg->tl_nexus; - if (!tl_nexus) { - scmd_printk(KERN_ERR, sc, "TCM_Loop I_T Nexus" - " does not exist\n"); -@@ -214,7 +207,7 @@ static void tcm_loop_submission_work(struct work_struct *work) - } - rc = target_submit_cmd_map_sgls(se_cmd, tl_nexus->se_sess, sc->cmnd, - &tl_cmd->tl_sense_buf[0], tl_cmd->sc->device->lun, -- scsi_bufflen(sc), tcm_loop_sam_attr(sc), -+ scsi_bufflen(sc), tcm_loop_sam_attr(sc, tl_cmd->sc_cmd_tag), - sc->sc_data_direction, 0, - scsi_sglist(sc), scsi_sg_count(sc), - sgl_bidi, sgl_bidi_count, -@@ -252,7 +245,7 @@ static int tcm_loop_queuecommand(struct Scsi_Host *sh, struct scsi_cmnd *sc) - } - - tl_cmd->sc = sc; -- tl_cmd->sc_cmd_tag = sc->tag; -+ tl_cmd->sc_cmd_tag = sc->request->tag; - INIT_WORK(&tl_cmd->work, tcm_loop_submission_work); - queue_work(tcm_loop_workqueue, &tl_cmd->work); - return 0; -@@ -263,16 +256,26 @@ static int tcm_loop_queuecommand(struct Scsi_Host *sh, struct scsi_cmnd *sc) - * to struct scsi_device - */ - static int tcm_loop_issue_tmr(struct tcm_loop_tpg *tl_tpg, -- struct tcm_loop_nexus *tl_nexus, - int lun, int task, enum tcm_tmreq_table tmr) - { - struct se_cmd *se_cmd = NULL; - struct se_session *se_sess; - struct se_portal_group *se_tpg; -+ struct tcm_loop_nexus *tl_nexus; - struct tcm_loop_cmd *tl_cmd = NULL; - struct tcm_loop_tmr *tl_tmr = NULL; - int ret = TMR_FUNCTION_FAILED, rc; - -+ /* -+ * Locate the tl_nexus and se_sess pointers -+ */ -+ tl_nexus = tl_tpg->tl_nexus; -+ if (!tl_nexus) { -+ pr_err("Unable to perform device reset without" -+ " active I_T Nexus\n"); -+ return ret; -+ } -+ - tl_cmd = kmem_cache_zalloc(tcm_loop_cmd_cache, GFP_KERNEL); - if (!tl_cmd) { - pr_err("Unable to allocate memory for tl_cmd\n"); -@@ -288,7 +291,7 @@ static int tcm_loop_issue_tmr(struct tcm_loop_tpg *tl_tpg, - - se_cmd = &tl_cmd->tl_se_cmd; - se_tpg = &tl_tpg->tl_se_tpg; -- se_sess = tl_nexus->se_sess; -+ se_sess = tl_tpg->tl_nexus->se_sess; - /* - * Initialize struct se_cmd descriptor from target_core_mod infrastructure - */ -@@ -333,7 +336,6 @@ release: - static int tcm_loop_abort_task(struct scsi_cmnd *sc) - { - struct tcm_loop_hba *tl_hba; -- struct tcm_loop_nexus *tl_nexus; - struct tcm_loop_tpg *tl_tpg; - int ret = FAILED; - -@@ -341,22 +343,9 @@ static int tcm_loop_abort_task(struct scsi_cmnd *sc) - * Locate the tcm_loop_hba_t pointer - */ - tl_hba = *(struct tcm_loop_hba **)shost_priv(sc->device->host); -- /* -- * Locate the tl_nexus and se_sess pointers -- */ -- tl_nexus = tl_hba->tl_nexus; -- if (!tl_nexus) { -- pr_err("Unable to perform device reset without" -- " active I_T Nexus\n"); -- return FAILED; -- } -- -- /* -- * Locate the tl_tpg pointer from TargetID in sc->device->id -- */ - tl_tpg = &tl_hba->tl_hba_tpgs[sc->device->id]; -- ret = tcm_loop_issue_tmr(tl_tpg, tl_nexus, sc->device->lun, -- sc->tag, TMR_ABORT_TASK); -+ ret = tcm_loop_issue_tmr(tl_tpg, sc->device->lun, -+ sc->request->tag, TMR_ABORT_TASK); - return (ret == TMR_FUNCTION_COMPLETE) ? SUCCESS : FAILED; - } - -@@ -367,7 +356,6 @@ static int tcm_loop_abort_task(struct scsi_cmnd *sc) - static int tcm_loop_device_reset(struct scsi_cmnd *sc) - { - struct tcm_loop_hba *tl_hba; -- struct tcm_loop_nexus *tl_nexus; - struct tcm_loop_tpg *tl_tpg; - int ret = FAILED; - -@@ -375,20 +363,9 @@ static int tcm_loop_device_reset(struct scsi_cmnd *sc) - * Locate the tcm_loop_hba_t pointer - */ - tl_hba = *(struct tcm_loop_hba **)shost_priv(sc->device->host); -- /* -- * Locate the tl_nexus and se_sess pointers -- */ -- tl_nexus = tl_hba->tl_nexus; -- if (!tl_nexus) { -- pr_err("Unable to perform device reset without" -- " active I_T Nexus\n"); -- return FAILED; -- } -- /* -- * Locate the tl_tpg pointer from TargetID in sc->device->id -- */ - tl_tpg = &tl_hba->tl_hba_tpgs[sc->device->id]; -- ret = tcm_loop_issue_tmr(tl_tpg, tl_nexus, sc->device->lun, -+ -+ ret = tcm_loop_issue_tmr(tl_tpg, sc->device->lun, - 0, TMR_LUN_RESET); - return (ret == TMR_FUNCTION_COMPLETE) ? SUCCESS : FAILED; - } -@@ -995,8 +972,8 @@ static int tcm_loop_make_nexus( - struct tcm_loop_nexus *tl_nexus; - int ret = -ENOMEM; - -- if (tl_tpg->tl_hba->tl_nexus) { -- pr_debug("tl_tpg->tl_hba->tl_nexus already exists\n"); -+ if (tl_tpg->tl_nexus) { -+ pr_debug("tl_tpg->tl_nexus already exists\n"); - return -EEXIST; - } - se_tpg = &tl_tpg->tl_se_tpg; -@@ -1031,7 +1008,7 @@ static int tcm_loop_make_nexus( - */ - __transport_register_session(se_tpg, tl_nexus->se_sess->se_node_acl, - tl_nexus->se_sess, tl_nexus); -- tl_tpg->tl_hba->tl_nexus = tl_nexus; -+ tl_tpg->tl_nexus = tl_nexus; - pr_debug("TCM_Loop_ConfigFS: Established I_T Nexus to emulated" - " %s Initiator Port: %s\n", tcm_loop_dump_proto_id(tl_hba), - name); -@@ -1047,12 +1024,8 @@ static int tcm_loop_drop_nexus( - { - struct se_session *se_sess; - struct tcm_loop_nexus *tl_nexus; -- struct tcm_loop_hba *tl_hba = tpg->tl_hba; - -- if (!tl_hba) -- return -ENODEV; -- -- tl_nexus = tl_hba->tl_nexus; -+ tl_nexus = tpg->tl_nexus; - if (!tl_nexus) - return -ENODEV; - -@@ -1068,13 +1041,13 @@ static int tcm_loop_drop_nexus( - } - - pr_debug("TCM_Loop_ConfigFS: Removing I_T Nexus to emulated" -- " %s Initiator Port: %s\n", tcm_loop_dump_proto_id(tl_hba), -+ " %s Initiator Port: %s\n", tcm_loop_dump_proto_id(tpg->tl_hba), - tl_nexus->se_sess->se_node_acl->initiatorname); - /* - * Release the SCSI I_T Nexus to the emulated SAS Target Port - */ - transport_deregister_session(tl_nexus->se_sess); -- tpg->tl_hba->tl_nexus = NULL; -+ tpg->tl_nexus = NULL; - kfree(tl_nexus); - return 0; - } -@@ -1090,7 +1063,7 @@ static ssize_t tcm_loop_tpg_show_nexus( - struct tcm_loop_nexus *tl_nexus; - ssize_t ret; - -- tl_nexus = tl_tpg->tl_hba->tl_nexus; -+ tl_nexus = tl_tpg->tl_nexus; - if (!tl_nexus) - return -ENODEV; - -diff --git a/drivers/target/loopback/tcm_loop.h b/drivers/target/loopback/tcm_loop.h -index 54c59d0b6608..6ae49f272ba6 100644 ---- a/drivers/target/loopback/tcm_loop.h -+++ b/drivers/target/loopback/tcm_loop.h -@@ -27,11 +27,6 @@ struct tcm_loop_tmr { - }; - - struct tcm_loop_nexus { -- int it_nexus_active; -- /* -- * Pointer to Linux/SCSI HBA from linux/include/scsi_host.h -- */ -- struct scsi_host *sh; - /* - * Pointer to TCM session for I_T Nexus - */ -@@ -51,6 +46,7 @@ struct tcm_loop_tpg { - atomic_t tl_tpg_port_count; - struct se_portal_group tl_se_tpg; - struct tcm_loop_hba *tl_hba; -+ struct tcm_loop_nexus *tl_nexus; - }; - - struct tcm_loop_hba { -@@ -59,7 +55,6 @@ struct tcm_loop_hba { - struct se_hba_s *se_hba; - struct se_lun *tl_hba_lun; - struct se_port *tl_hba_lun_sep; -- struct tcm_loop_nexus *tl_nexus; - struct device dev; - struct Scsi_Host *sh; - struct tcm_loop_tpg tl_hba_tpgs[TL_TPGS_PER_HBA]; -diff --git a/drivers/thermal/intel_powerclamp.c b/drivers/thermal/intel_powerclamp.c -index a084325f1386..6e75177915fa 100644 ---- a/drivers/thermal/intel_powerclamp.c -+++ b/drivers/thermal/intel_powerclamp.c -@@ -435,7 +435,6 @@ static int clamp_thread(void *arg) - * allowed. thus jiffies are updated properly. - */ - preempt_disable(); -- tick_nohz_idle_enter(); - /* mwait until target jiffies is reached */ - while (time_before(jiffies, target_jiffies)) { - unsigned long ecx = 1; -@@ -451,7 +450,6 @@ static int clamp_thread(void *arg) - start_critical_timings(); - atomic_inc(&idle_wakeup_counter); - } -- tick_nohz_idle_exit(); - preempt_enable(); - } - del_timer_sync(&wakeup_timer); -diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c -index d90c70c23adb..8f6738d46b14 100644 ---- a/drivers/usb/dwc3/gadget.c -+++ b/drivers/usb/dwc3/gadget.c -@@ -887,8 +887,7 @@ static void dwc3_prepare_trbs(struct dwc3_ep *dep, bool starting) - - if (i == (request->num_mapped_sgs - 1) || - sg_is_last(s)) { -- if (list_is_last(&req->list, -- &dep->request_list)) -+ if (list_empty(&dep->request_list)) - last_one = true; - chain = false; - } -@@ -906,6 +905,9 @@ static void dwc3_prepare_trbs(struct dwc3_ep *dep, bool starting) - if (last_one) - break; - } -+ -+ if (last_one) -+ break; - } else { - dma = req->request.dma; - length = req->request.length; -diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c -index e113fd73aeae..c399606f154e 100644 ---- a/drivers/usb/host/ehci-sched.c -+++ b/drivers/usb/host/ehci-sched.c -@@ -1581,6 +1581,10 @@ iso_stream_schedule ( - else - next = (now + 2 + 7) & ~0x07; /* full frame cache */ - -+ /* If needed, initialize last_iso_frame so that this URB will be seen */ -+ if (ehci->isoc_count == 0) -+ ehci->last_iso_frame = now >> 3; -+ - /* - * Use ehci->last_iso_frame as the base. There can't be any - * TDs scheduled for earlier than that. -@@ -1671,10 +1675,6 @@ iso_stream_schedule ( - urb->start_frame = start & (mod - 1); - if (!stream->highspeed) - urb->start_frame >>= 3; -- -- /* Make sure scan_isoc() sees these */ -- if (ehci->isoc_count == 0) -- ehci->last_iso_frame = now >> 3; - return status; - - fail: -diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c -index 2f3acebb577a..f4e6b945136c 100644 ---- a/drivers/usb/host/pci-quirks.c -+++ b/drivers/usb/host/pci-quirks.c -@@ -571,7 +571,8 @@ static void quirk_usb_handoff_ohci(struct pci_dev *pdev) - { - void __iomem *base; - u32 control; -- u32 fminterval; -+ u32 fminterval = 0; -+ bool no_fminterval = false; - int cnt; - - if (!mmio_resource_enabled(pdev, 0)) -@@ -581,6 +582,13 @@ static void quirk_usb_handoff_ohci(struct pci_dev *pdev) - if (base == NULL) - return; - -+ /* -+ * ULi M5237 OHCI controller locks the whole system when accessing -+ * the OHCI_FMINTERVAL offset. -+ */ -+ if (pdev->vendor == PCI_VENDOR_ID_AL && pdev->device == 0x5237) -+ no_fminterval = true; -+ - control = readl(base + OHCI_CONTROL); - - /* On PA-RISC, PDC can leave IR set incorrectly; ignore it there. */ -@@ -619,7 +627,9 @@ static void quirk_usb_handoff_ohci(struct pci_dev *pdev) - } - - /* software reset of the controller, preserving HcFmInterval */ -- fminterval = readl(base + OHCI_FMINTERVAL); -+ if (!no_fminterval) -+ fminterval = readl(base + OHCI_FMINTERVAL); -+ - writel(OHCI_HCR, base + OHCI_CMDSTATUS); - - /* reset requires max 10 us delay */ -@@ -628,7 +638,9 @@ static void quirk_usb_handoff_ohci(struct pci_dev *pdev) - break; - udelay(1); - } -- writel(fminterval, base + OHCI_FMINTERVAL); -+ -+ if (!no_fminterval) -+ writel(fminterval, base + OHCI_FMINTERVAL); - - /* Now the controller is safely in SUSPEND and nothing can wake it up */ - iounmap(base); -diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c -index abb38c3833ef..6b0fb6af6815 100644 ---- a/drivers/usb/musb/musb_host.c -+++ b/drivers/usb/musb/musb_host.c -@@ -2640,7 +2640,6 @@ void musb_host_cleanup(struct musb *musb) - if (musb->port_mode == MUSB_PORT_MODE_GADGET) - return; - usb_remove_hcd(musb->hcd); -- musb->hcd = NULL; - } - - void musb_host_free(struct musb *musb) -diff --git a/drivers/usb/serial/console.c b/drivers/usb/serial/console.c -index 8d7fc48b1f30..29fa1c3d0089 100644 ---- a/drivers/usb/serial/console.c -+++ b/drivers/usb/serial/console.c -@@ -46,6 +46,8 @@ static struct console usbcons; - * ------------------------------------------------------------ - */ - -+static const struct tty_operations usb_console_fake_tty_ops = { -+}; - - /* - * The parsing of the command line works exactly like the -@@ -137,13 +139,17 @@ static int usb_console_setup(struct console *co, char *options) - goto reset_open_count; - } - kref_init(&tty->kref); -- tty_port_tty_set(&port->port, tty); - tty->driver = usb_serial_tty_driver; - tty->index = co->index; -+ init_ldsem(&tty->ldisc_sem); -+ INIT_LIST_HEAD(&tty->tty_files); -+ kref_get(&tty->driver->kref); -+ tty->ops = &usb_console_fake_tty_ops; - if (tty_init_termios(tty)) { - retval = -ENOMEM; -- goto free_tty; -+ goto put_tty; - } -+ tty_port_tty_set(&port->port, tty); - } - - /* only call the device specific open if this -@@ -161,7 +167,7 @@ static int usb_console_setup(struct console *co, char *options) - serial->type->set_termios(tty, port, &dummy); - - tty_port_tty_set(&port->port, NULL); -- kfree(tty); -+ tty_kref_put(tty); - } - set_bit(ASYNCB_INITIALIZED, &port->port.flags); - } -@@ -177,8 +183,8 @@ static int usb_console_setup(struct console *co, char *options) - - fail: - tty_port_tty_set(&port->port, NULL); -- free_tty: -- kfree(tty); -+ put_tty: -+ tty_kref_put(tty); - reset_open_count: - port->port.count = 0; - usb_autopm_put_interface(serial->interface); -diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c -index 5741e9405069..9e8708c5cbfa 100644 ---- a/drivers/usb/serial/cp210x.c -+++ b/drivers/usb/serial/cp210x.c -@@ -120,10 +120,12 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */ - { USB_DEVICE(0x10C4, 0x8664) }, /* AC-Services CAN-IF */ - { USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */ -- { USB_DEVICE(0x10C4, 0x8875) }, /* CEL MeshConnect USB Stick */ -+ { USB_DEVICE(0x10C4, 0x8856) }, /* CEL EM357 ZigBee USB Stick - LR */ -+ { USB_DEVICE(0x10C4, 0x8857) }, /* CEL EM357 ZigBee USB Stick */ - { USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */ - { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */ - { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */ -+ { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */ - { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */ - { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */ - { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */ -diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c -index 49101fe45d38..35297a845a63 100644 ---- a/drivers/usb/serial/keyspan.c -+++ b/drivers/usb/serial/keyspan.c -@@ -421,6 +421,8 @@ static void usa26_instat_callback(struct urb *urb) - } - port = serial->port[msg->port]; - p_priv = usb_get_serial_port_data(port); -+ if (!p_priv) -+ goto resubmit; - - /* Update handshaking pin state information */ - old_dcd_state = p_priv->dcd_state; -@@ -431,7 +433,7 @@ static void usa26_instat_callback(struct urb *urb) - - if (old_dcd_state != p_priv->dcd_state) - tty_port_tty_hangup(&port->port, true); -- -+resubmit: - /* Resubmit urb so we continue receiving */ - err = usb_submit_urb(urb, GFP_ATOMIC); - if (err != 0) -@@ -541,6 +543,8 @@ static void usa28_instat_callback(struct urb *urb) - } - port = serial->port[msg->port]; - p_priv = usb_get_serial_port_data(port); -+ if (!p_priv) -+ goto resubmit; - - /* Update handshaking pin state information */ - old_dcd_state = p_priv->dcd_state; -@@ -551,7 +555,7 @@ static void usa28_instat_callback(struct urb *urb) - - if (old_dcd_state != p_priv->dcd_state && old_dcd_state) - tty_port_tty_hangup(&port->port, true); -- -+resubmit: - /* Resubmit urb so we continue receiving */ - err = usb_submit_urb(urb, GFP_ATOMIC); - if (err != 0) -@@ -624,6 +628,8 @@ static void usa49_instat_callback(struct urb *urb) - } - port = serial->port[msg->portNumber]; - p_priv = usb_get_serial_port_data(port); -+ if (!p_priv) -+ goto resubmit; - - /* Update handshaking pin state information */ - old_dcd_state = p_priv->dcd_state; -@@ -634,7 +640,7 @@ static void usa49_instat_callback(struct urb *urb) - - if (old_dcd_state != p_priv->dcd_state && old_dcd_state) - tty_port_tty_hangup(&port->port, true); -- -+resubmit: - /* Resubmit urb so we continue receiving */ - err = usb_submit_urb(urb, GFP_ATOMIC); - if (err != 0) -@@ -872,6 +878,8 @@ static void usa90_instat_callback(struct urb *urb) - - port = serial->port[0]; - p_priv = usb_get_serial_port_data(port); -+ if (!p_priv) -+ goto resubmit; - - /* Update handshaking pin state information */ - old_dcd_state = p_priv->dcd_state; -@@ -882,7 +890,7 @@ static void usa90_instat_callback(struct urb *urb) - - if (old_dcd_state != p_priv->dcd_state && old_dcd_state) - tty_port_tty_hangup(&port->port, true); -- -+resubmit: - /* Resubmit urb so we continue receiving */ - err = usb_submit_urb(urb, GFP_ATOMIC); - if (err != 0) -@@ -943,6 +951,8 @@ static void usa67_instat_callback(struct urb *urb) - - port = serial->port[msg->port]; - p_priv = usb_get_serial_port_data(port); -+ if (!p_priv) -+ goto resubmit; - - /* Update handshaking pin state information */ - old_dcd_state = p_priv->dcd_state; -@@ -951,7 +961,7 @@ static void usa67_instat_callback(struct urb *urb) - - if (old_dcd_state != p_priv->dcd_state && old_dcd_state) - tty_port_tty_hangup(&port->port, true); -- -+resubmit: - /* Resubmit urb so we continue receiving */ - err = usb_submit_urb(urb, GFP_ATOMIC); - if (err != 0) -diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c -index 7ba042498857..75e1d03b8da3 100644 ---- a/drivers/vfio/pci/vfio_pci.c -+++ b/drivers/vfio/pci/vfio_pci.c -@@ -810,13 +810,11 @@ static const struct vfio_device_ops vfio_pci_ops = { - - static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) - { -- u8 type; - struct vfio_pci_device *vdev; - struct iommu_group *group; - int ret; - -- pci_read_config_byte(pdev, PCI_HEADER_TYPE, &type); -- if ((type & PCI_HEADER_TYPE) != PCI_HEADER_TYPE_NORMAL) -+ if (pdev->hdr_type != PCI_HEADER_TYPE_NORMAL) - return -EINVAL; - - group = iommu_group_get(&pdev->dev); -diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c -index 5d0b7b846440..486d710a5293 100644 ---- a/drivers/vhost/scsi.c -+++ b/drivers/vhost/scsi.c -@@ -861,6 +861,23 @@ vhost_scsi_map_iov_to_sgl(struct tcm_vhost_cmd *cmd, - return 0; - } - -+static int vhost_scsi_to_tcm_attr(int attr) -+{ -+ switch (attr) { -+ case VIRTIO_SCSI_S_SIMPLE: -+ return MSG_SIMPLE_TAG; -+ case VIRTIO_SCSI_S_ORDERED: -+ return MSG_ORDERED_TAG; -+ case VIRTIO_SCSI_S_HEAD: -+ return MSG_HEAD_TAG; -+ case VIRTIO_SCSI_S_ACA: -+ return MSG_ACA_TAG; -+ default: -+ break; -+ } -+ return MSG_SIMPLE_TAG; -+} -+ - static void tcm_vhost_submission_work(struct work_struct *work) - { - struct tcm_vhost_cmd *cmd = -@@ -887,9 +904,10 @@ static void tcm_vhost_submission_work(struct work_struct *work) - rc = target_submit_cmd_map_sgls(se_cmd, tv_nexus->tvn_se_sess, - cmd->tvc_cdb, &cmd->tvc_sense_buf[0], - cmd->tvc_lun, cmd->tvc_exp_data_len, -- cmd->tvc_task_attr, cmd->tvc_data_direction, -- TARGET_SCF_ACK_KREF, sg_ptr, cmd->tvc_sgl_count, -- sg_bidi_ptr, sg_no_bidi, NULL, 0); -+ vhost_scsi_to_tcm_attr(cmd->tvc_task_attr), -+ cmd->tvc_data_direction, TARGET_SCF_ACK_KREF, -+ sg_ptr, cmd->tvc_sgl_count, sg_bidi_ptr, sg_no_bidi, -+ NULL, 0); - if (rc < 0) { - transport_send_check_condition_and_sense(se_cmd, - TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE, 0); -diff --git a/drivers/video/logo/logo.c b/drivers/video/logo/logo.c -index b670cbda38e3..ffe024b830fc 100644 ---- a/drivers/video/logo/logo.c -+++ b/drivers/video/logo/logo.c -@@ -21,6 +21,21 @@ static bool nologo; - module_param(nologo, bool, 0); - MODULE_PARM_DESC(nologo, "Disables startup logo"); - -+/* -+ * Logos are located in the initdata, and will be freed in kernel_init. -+ * Use late_init to mark the logos as freed to prevent any further use. -+ */ -+ -+static bool logos_freed; -+ -+static int __init fb_logo_late_init(void) -+{ -+ logos_freed = true; -+ return 0; -+} -+ -+late_initcall(fb_logo_late_init); -+ - /* logo's are marked __initdata. Use __init_refok to tell - * modpost that it is intended that this function uses data - * marked __initdata. -@@ -29,7 +44,7 @@ const struct linux_logo * __init_refok fb_find_logo(int depth) - { - const struct linux_logo *logo = NULL; - -- if (nologo) -+ if (nologo || logos_freed) - return NULL; - - if (depth >= 1) { -diff --git a/fs/lockd/svc.c b/fs/lockd/svc.c -index 223e1cb14345..59a53f664005 100644 ---- a/fs/lockd/svc.c -+++ b/fs/lockd/svc.c -@@ -137,10 +137,6 @@ lockd(void *vrqstp) - - dprintk("NFS locking service started (ver " LOCKD_VERSION ").\n"); - -- if (!nlm_timeout) -- nlm_timeout = LOCKD_DFLT_TIMEO; -- nlmsvc_timeout = nlm_timeout * HZ; -- - /* - * The main request loop. We don't terminate until the last - * NFS mount or NFS daemon has gone away. -@@ -346,6 +342,10 @@ static struct svc_serv *lockd_create_svc(void) - printk(KERN_WARNING - "lockd_up: no pid, %d users??\n", nlmsvc_users); - -+ if (!nlm_timeout) -+ nlm_timeout = LOCKD_DFLT_TIMEO; -+ nlmsvc_timeout = nlm_timeout * HZ; -+ - serv = svc_create(&nlmsvc_program, LOCKD_BUFSIZE, NULL); - if (!serv) { - printk(KERN_WARNING "lockd_up: create service failed\n"); -diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c -index 1abe4f55dea2..037f9572b94c 100644 ---- a/fs/nfs/nfs4client.c -+++ b/fs/nfs/nfs4client.c -@@ -565,20 +565,14 @@ static bool nfs4_match_clientids(struct nfs_client *a, struct nfs_client *b) - } - - /* -- * Returns true if the server owners match -+ * Returns true if the server major ids match - */ - static bool --nfs4_match_serverowners(struct nfs_client *a, struct nfs_client *b) -+nfs4_check_clientid_trunking(struct nfs_client *a, struct nfs_client *b) - { - struct nfs41_server_owner *o1 = a->cl_serverowner; - struct nfs41_server_owner *o2 = b->cl_serverowner; - -- if (o1->minor_id != o2->minor_id) { -- dprintk("NFS: --> %s server owner minor IDs do not match\n", -- __func__); -- return false; -- } -- - if (o1->major_id_sz != o2->major_id_sz) - goto out_major_mismatch; - if (memcmp(o1->major_id, o2->major_id, o1->major_id_sz) != 0) -@@ -654,7 +648,12 @@ int nfs41_walk_client_list(struct nfs_client *new, - if (!nfs4_match_clientids(pos, new)) - continue; - -- if (!nfs4_match_serverowners(pos, new)) -+ /* -+ * Note that session trunking is just a special subcase of -+ * client id trunking. In either case, we want to fall back -+ * to using the existing nfs_client. -+ */ -+ if (!nfs4_check_clientid_trunking(pos, new)) - continue; - - atomic_inc(&pos->cl_count); -diff --git a/fs/notify/inode_mark.c b/fs/notify/inode_mark.c -index 74825be65b7b..fbb9dfb7b1d2 100644 ---- a/fs/notify/inode_mark.c -+++ b/fs/notify/inode_mark.c -@@ -288,20 +288,25 @@ void fsnotify_unmount_inodes(struct list_head *list) - spin_unlock(&inode->i_lock); - - /* In case the dropping of a reference would nuke next_i. */ -- if ((&next_i->i_sb_list != list) && -- atomic_read(&next_i->i_count)) { -+ while (&next_i->i_sb_list != list) { - spin_lock(&next_i->i_lock); -- if (!(next_i->i_state & (I_FREEING | I_WILL_FREE))) { -+ if (!(next_i->i_state & (I_FREEING | I_WILL_FREE)) && -+ atomic_read(&next_i->i_count)) { - __iget(next_i); - need_iput = next_i; -+ spin_unlock(&next_i->i_lock); -+ break; - } - spin_unlock(&next_i->i_lock); -+ next_i = list_entry(next_i->i_sb_list.next, -+ struct inode, i_sb_list); - } - - /* -- * We can safely drop inode_sb_list_lock here because we hold -- * references on both inode and next_i. Also no new inodes -- * will be added since the umount has begun. -+ * We can safely drop inode_sb_list_lock here because either -+ * we actually hold references on both inode and next_i or -+ * end of list. Also no new inodes will be added since the -+ * umount has begun. - */ - spin_unlock(&inode_sb_list_lock); - -diff --git a/fs/proc/stat.c b/fs/proc/stat.c -index 6f599c62f0cc..dbd027235440 100644 ---- a/fs/proc/stat.c -+++ b/fs/proc/stat.c -@@ -159,7 +159,7 @@ static int show_stat(struct seq_file *p, void *v) - - /* sum again ? it could be updated? */ - for_each_irq_nr(j) -- seq_put_decimal_ull(p, ' ', kstat_irqs(j)); -+ seq_put_decimal_ull(p, ' ', kstat_irqs_usr(j)); - - seq_printf(p, - "\nctxt %llu\n" -diff --git a/include/linux/kernel_stat.h b/include/linux/kernel_stat.h -index 51c72be4a7c3..4b2053a232c9 100644 ---- a/include/linux/kernel_stat.h -+++ b/include/linux/kernel_stat.h -@@ -74,6 +74,7 @@ static inline unsigned int kstat_softirqs_cpu(unsigned int irq, int cpu) - * Number of interrupts per specific IRQ source, since bootup - */ - extern unsigned int kstat_irqs(unsigned int irq); -+extern unsigned int kstat_irqs_usr(unsigned int irq); - - /* - * Number of interrupts per cpu, since bootup -diff --git a/include/uapi/linux/in6.h b/include/uapi/linux/in6.h -index e9a1d2d973b6..4c399ae04677 100644 ---- a/include/uapi/linux/in6.h -+++ b/include/uapi/linux/in6.h -@@ -149,7 +149,7 @@ struct in6_flowlabel_req { - /* - * IPV6 socket options - */ -- -+#if __UAPI_DEF_IPV6_OPTIONS - #define IPV6_ADDRFORM 1 - #define IPV6_2292PKTINFO 2 - #define IPV6_2292HOPOPTS 3 -@@ -192,6 +192,7 @@ struct in6_flowlabel_req { - - #define IPV6_IPSEC_POLICY 34 - #define IPV6_XFRM_POLICY 35 -+#endif - - /* - * Multicast: -diff --git a/include/uapi/linux/libc-compat.h b/include/uapi/linux/libc-compat.h -index c140620dad92..e28807ad17fa 100644 ---- a/include/uapi/linux/libc-compat.h -+++ b/include/uapi/linux/libc-compat.h -@@ -69,6 +69,7 @@ - #define __UAPI_DEF_SOCKADDR_IN6 0 - #define __UAPI_DEF_IPV6_MREQ 0 - #define __UAPI_DEF_IPPROTO_V6 0 -+#define __UAPI_DEF_IPV6_OPTIONS 0 - - #else - -@@ -82,6 +83,7 @@ - #define __UAPI_DEF_SOCKADDR_IN6 1 - #define __UAPI_DEF_IPV6_MREQ 1 - #define __UAPI_DEF_IPPROTO_V6 1 -+#define __UAPI_DEF_IPV6_OPTIONS 1 - - #endif /* _NETINET_IN_H */ - -@@ -103,6 +105,7 @@ - #define __UAPI_DEF_SOCKADDR_IN6 1 - #define __UAPI_DEF_IPV6_MREQ 1 - #define __UAPI_DEF_IPPROTO_V6 1 -+#define __UAPI_DEF_IPV6_OPTIONS 1 - - /* Definitions for xattr.h */ - #define __UAPI_DEF_XATTR 1 -diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h -index 001fa5bab490..8a160e8a44e8 100644 ---- a/kernel/irq/internals.h -+++ b/kernel/irq/internals.h -@@ -74,6 +74,14 @@ extern void irq_percpu_disable(struct irq_desc *desc, unsigned int cpu); - extern void mask_irq(struct irq_desc *desc); - extern void unmask_irq(struct irq_desc *desc); - -+#ifdef CONFIG_SPARSE_IRQ -+extern void irq_lock_sparse(void); -+extern void irq_unlock_sparse(void); -+#else -+static inline void irq_lock_sparse(void) { } -+static inline void irq_unlock_sparse(void) { } -+#endif -+ - extern void init_kstat_irqs(struct irq_desc *desc, int node, int nr); - - irqreturn_t handle_irq_event_percpu(struct irq_desc *desc, struct irqaction *action); -diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c -index 8ab8e9390297..07d45516b540 100644 ---- a/kernel/irq/irqdesc.c -+++ b/kernel/irq/irqdesc.c -@@ -131,6 +131,16 @@ static void free_masks(struct irq_desc *desc) - static inline void free_masks(struct irq_desc *desc) { } - #endif - -+void irq_lock_sparse(void) -+{ -+ mutex_lock(&sparse_irq_lock); -+} -+ -+void irq_unlock_sparse(void) -+{ -+ mutex_unlock(&sparse_irq_lock); -+} -+ - static struct irq_desc *alloc_desc(int irq, int node, struct module *owner) - { - struct irq_desc *desc; -@@ -167,6 +177,12 @@ static void free_desc(unsigned int irq) - - unregister_irq_proc(irq, desc); - -+ /* -+ * sparse_irq_lock protects also show_interrupts() and -+ * kstat_irq_usr(). Once we deleted the descriptor from the -+ * sparse tree we can free it. Access in proc will fail to -+ * lookup the descriptor. -+ */ - mutex_lock(&sparse_irq_lock); - delete_irq_desc(irq); - mutex_unlock(&sparse_irq_lock); -@@ -489,6 +505,15 @@ void dynamic_irq_cleanup(unsigned int irq) - raw_spin_unlock_irqrestore(&desc->lock, flags); - } - -+/** -+ * kstat_irqs_cpu - Get the statistics for an interrupt on a cpu -+ * @irq: The interrupt number -+ * @cpu: The cpu number -+ * -+ * Returns the sum of interrupt counts on @cpu since boot for -+ * @irq. The caller must ensure that the interrupt is not removed -+ * concurrently. -+ */ - unsigned int kstat_irqs_cpu(unsigned int irq, int cpu) - { - struct irq_desc *desc = irq_to_desc(irq); -@@ -497,6 +522,14 @@ unsigned int kstat_irqs_cpu(unsigned int irq, int cpu) - *per_cpu_ptr(desc->kstat_irqs, cpu) : 0; - } - -+/** -+ * kstat_irqs - Get the statistics for an interrupt -+ * @irq: The interrupt number -+ * -+ * Returns the sum of interrupt counts on all cpus since boot for -+ * @irq. The caller must ensure that the interrupt is not removed -+ * concurrently. -+ */ - unsigned int kstat_irqs(unsigned int irq) - { - struct irq_desc *desc = irq_to_desc(irq); -@@ -509,3 +542,22 @@ unsigned int kstat_irqs(unsigned int irq) - sum += *per_cpu_ptr(desc->kstat_irqs, cpu); - return sum; - } -+ -+/** -+ * kstat_irqs_usr - Get the statistics for an interrupt -+ * @irq: The interrupt number -+ * -+ * Returns the sum of interrupt counts on all cpus since boot for -+ * @irq. Contrary to kstat_irqs() this can be called from any -+ * preemptible context. It's protected against concurrent removal of -+ * an interrupt descriptor when sparse irqs are enabled. -+ */ -+unsigned int kstat_irqs_usr(unsigned int irq) -+{ -+ int sum; -+ -+ irq_lock_sparse(); -+ sum = kstat_irqs(irq); -+ irq_unlock_sparse(); -+ return sum; -+} -diff --git a/kernel/irq/proc.c b/kernel/irq/proc.c -index 36f6ee181b0c..095cd7230aef 100644 ---- a/kernel/irq/proc.c -+++ b/kernel/irq/proc.c -@@ -15,6 +15,23 @@ - - #include "internals.h" - -+/* -+ * Access rules: -+ * -+ * procfs protects read/write of /proc/irq/N/ files against a -+ * concurrent free of the interrupt descriptor. remove_proc_entry() -+ * immediately prevents new read/writes to happen and waits for -+ * already running read/write functions to complete. -+ * -+ * We remove the proc entries first and then delete the interrupt -+ * descriptor from the radix tree and free it. So it is guaranteed -+ * that irq_to_desc(N) is valid as long as the read/writes are -+ * permitted by procfs. -+ * -+ * The read from /proc/interrupts is a different problem because there -+ * is no protection. So the lookup and the access to irqdesc -+ * information must be protected by sparse_irq_lock. -+ */ - static struct proc_dir_entry *root_irq_dir; - - #ifdef CONFIG_SMP -@@ -437,9 +454,10 @@ int show_interrupts(struct seq_file *p, void *v) - seq_putc(p, '\n'); - } - -+ irq_lock_sparse(); - desc = irq_to_desc(i); - if (!desc) -- return 0; -+ goto outsparse; - - raw_spin_lock_irqsave(&desc->lock, flags); - for_each_online_cpu(j) -@@ -479,6 +497,8 @@ int show_interrupts(struct seq_file *p, void *v) - seq_putc(p, '\n'); - out: - raw_spin_unlock_irqrestore(&desc->lock, flags); -+outsparse: -+ irq_unlock_sparse(); - return 0; - } - #endif -diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c -index 6558b7ac112d..8c08a6f9cca0 100644 ---- a/kernel/time/tick-sched.c -+++ b/kernel/time/tick-sched.c -@@ -807,7 +807,6 @@ void tick_nohz_idle_enter(void) - - local_irq_enable(); - } --EXPORT_SYMBOL_GPL(tick_nohz_idle_enter); - - /** - * tick_nohz_irq_exit - update next tick event from interrupt exit -@@ -934,7 +933,6 @@ void tick_nohz_idle_exit(void) - - local_irq_enable(); - } --EXPORT_SYMBOL_GPL(tick_nohz_idle_exit); - - static int tick_nohz_reprogram(struct tick_sched *ts, ktime_t now) - { -diff --git a/lib/decompress_bunzip2.c b/lib/decompress_bunzip2.c -index 31c5f7675fbf..f504027d66a8 100644 ---- a/lib/decompress_bunzip2.c -+++ b/lib/decompress_bunzip2.c -@@ -184,7 +184,7 @@ static int INIT get_next_block(struct bunzip_data *bd) - if (get_bits(bd, 1)) - return RETVAL_OBSOLETE_INPUT; - origPtr = get_bits(bd, 24); -- if (origPtr > dbufSize) -+ if (origPtr >= dbufSize) - return RETVAL_DATA_ERROR; - /* mapping table: if some byte values are never used (encoding things - like ascii text), the compression code removes the gaps to have fewer -diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c -index c46387a46535..e5c5f573c0d4 100644 ---- a/net/batman-adv/fragmentation.c -+++ b/net/batman-adv/fragmentation.c -@@ -251,7 +251,7 @@ batadv_frag_merge_packets(struct hlist_head *chain, struct sk_buff *skb) - kfree(entry); - - /* Make room for the rest of the fragments. */ -- if (pskb_expand_head(skb_out, 0, size - skb->len, GFP_ATOMIC) < 0) { -+ if (pskb_expand_head(skb_out, 0, size - skb_out->len, GFP_ATOMIC) < 0) { - kfree_skb(skb_out); - skb_out = NULL; - goto free; -@@ -434,7 +434,7 @@ bool batadv_frag_send_packet(struct sk_buff *skb, - * fragments larger than BATADV_FRAG_MAX_FRAG_SIZE - */ - mtu = min_t(unsigned, mtu, BATADV_FRAG_MAX_FRAG_SIZE); -- max_fragment_size = (mtu - header_size - ETH_HLEN); -+ max_fragment_size = mtu - header_size; - max_packet_size = max_fragment_size * BATADV_FRAG_MAX_FRAGMENTS; - - /* Don't even try to fragment, if we need more than 16 fragments */ -diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c -index 36b9ae61f5e8..2393ea72d65f 100644 ---- a/net/batman-adv/gateway_client.c -+++ b/net/batman-adv/gateway_client.c -@@ -812,7 +812,7 @@ bool batadv_gw_out_of_range(struct batadv_priv *bat_priv, - goto out; - - gw_node = batadv_gw_node_get(bat_priv, orig_dst_node); -- if (!gw_node->bandwidth_down == 0) -+ if (!gw_node) - goto out; - - switch (atomic_read(&bat_priv->gw_mode)) { -diff --git a/net/core/dev.c b/net/core/dev.c -index 3ed11a555834..86bb9cc81f02 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -1709,6 +1709,7 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb) - - skb_scrub_packet(skb, true); - skb->protocol = eth_type_trans(skb, dev); -+ skb_postpull_rcsum(skb, eth_hdr(skb), ETH_HLEN); - - return netif_rx_internal(skb); - } -@@ -2529,11 +2530,14 @@ netdev_features_t netif_skb_dev_features(struct sk_buff *skb, - if (skb_shinfo(skb)->gso_segs > dev->gso_max_segs) - features &= ~NETIF_F_GSO_MASK; - -- if (protocol == htons(ETH_P_8021Q) || protocol == htons(ETH_P_8021AD)) { -- struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data; -- protocol = veh->h_vlan_encapsulated_proto; -- } else if (!vlan_tx_tag_present(skb)) { -- return harmonize_features(skb, dev, features); -+ if (!vlan_tx_tag_present(skb)) { -+ if (unlikely(protocol == htons(ETH_P_8021Q) || -+ protocol == htons(ETH_P_8021AD))) { -+ struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data; -+ protocol = veh->h_vlan_encapsulated_proto; -+ } else { -+ return harmonize_features(skb, dev, features); -+ } - } - - features &= (dev->vlan_features | NETIF_F_HW_VLAN_CTAG_TX | -@@ -4701,9 +4705,14 @@ static void netdev_adjacent_sysfs_del(struct net_device *dev, - sysfs_remove_link(&(dev->dev.kobj), linkname); - } - --#define netdev_adjacent_is_neigh_list(dev, dev_list) \ -- (dev_list == &dev->adj_list.upper || \ -- dev_list == &dev->adj_list.lower) -+static inline bool netdev_adjacent_is_neigh_list(struct net_device *dev, -+ struct net_device *adj_dev, -+ struct list_head *dev_list) -+{ -+ return (dev_list == &dev->adj_list.upper || -+ dev_list == &dev->adj_list.lower) && -+ net_eq(dev_net(dev), dev_net(adj_dev)); -+} - - static int __netdev_adjacent_dev_insert(struct net_device *dev, - struct net_device *adj_dev, -@@ -4733,7 +4742,7 @@ static int __netdev_adjacent_dev_insert(struct net_device *dev, - pr_debug("dev_hold for %s, because of link added from %s to %s\n", - adj_dev->name, dev->name, adj_dev->name); - -- if (netdev_adjacent_is_neigh_list(dev, dev_list)) { -+ if (netdev_adjacent_is_neigh_list(dev, adj_dev, dev_list)) { - ret = netdev_adjacent_sysfs_add(dev, adj_dev, dev_list); - if (ret) - goto free_adj; -@@ -4754,7 +4763,7 @@ static int __netdev_adjacent_dev_insert(struct net_device *dev, - return 0; - - remove_symlinks: -- if (netdev_adjacent_is_neigh_list(dev, dev_list)) -+ if (netdev_adjacent_is_neigh_list(dev, adj_dev, dev_list)) - netdev_adjacent_sysfs_del(dev, adj_dev->name, dev_list); - free_adj: - kfree(adj); -@@ -4787,7 +4796,7 @@ static void __netdev_adjacent_dev_remove(struct net_device *dev, - if (adj->master) - sysfs_remove_link(&(dev->dev.kobj), "master"); - -- if (netdev_adjacent_is_neigh_list(dev, dev_list)) -+ if (netdev_adjacent_is_neigh_list(dev, adj_dev, dev_list)) - netdev_adjacent_sysfs_del(dev, adj_dev->name, dev_list); - - list_del_rcu(&adj->list); -@@ -5057,11 +5066,65 @@ void netdev_upper_dev_unlink(struct net_device *dev, - } - EXPORT_SYMBOL(netdev_upper_dev_unlink); - -+void netdev_adjacent_add_links(struct net_device *dev) -+{ -+ struct netdev_adjacent *iter; -+ -+ struct net *net = dev_net(dev); -+ -+ list_for_each_entry(iter, &dev->adj_list.upper, list) { -+ if (!net_eq(net,dev_net(iter->dev))) -+ continue; -+ netdev_adjacent_sysfs_add(iter->dev, dev, -+ &iter->dev->adj_list.lower); -+ netdev_adjacent_sysfs_add(dev, iter->dev, -+ &dev->adj_list.upper); -+ } -+ -+ list_for_each_entry(iter, &dev->adj_list.lower, list) { -+ if (!net_eq(net,dev_net(iter->dev))) -+ continue; -+ netdev_adjacent_sysfs_add(iter->dev, dev, -+ &iter->dev->adj_list.upper); -+ netdev_adjacent_sysfs_add(dev, iter->dev, -+ &dev->adj_list.lower); -+ } -+} -+ -+void netdev_adjacent_del_links(struct net_device *dev) -+{ -+ struct netdev_adjacent *iter; -+ -+ struct net *net = dev_net(dev); -+ -+ list_for_each_entry(iter, &dev->adj_list.upper, list) { -+ if (!net_eq(net,dev_net(iter->dev))) -+ continue; -+ netdev_adjacent_sysfs_del(iter->dev, dev->name, -+ &iter->dev->adj_list.lower); -+ netdev_adjacent_sysfs_del(dev, iter->dev->name, -+ &dev->adj_list.upper); -+ } -+ -+ list_for_each_entry(iter, &dev->adj_list.lower, list) { -+ if (!net_eq(net,dev_net(iter->dev))) -+ continue; -+ netdev_adjacent_sysfs_del(iter->dev, dev->name, -+ &iter->dev->adj_list.upper); -+ netdev_adjacent_sysfs_del(dev, iter->dev->name, -+ &dev->adj_list.lower); -+ } -+} -+ - void netdev_adjacent_rename_links(struct net_device *dev, char *oldname) - { - struct netdev_adjacent *iter; - -+ struct net *net = dev_net(dev); -+ - list_for_each_entry(iter, &dev->adj_list.upper, list) { -+ if (!net_eq(net,dev_net(iter->dev))) -+ continue; - netdev_adjacent_sysfs_del(iter->dev, oldname, - &iter->dev->adj_list.lower); - netdev_adjacent_sysfs_add(iter->dev, dev, -@@ -5069,6 +5132,8 @@ void netdev_adjacent_rename_links(struct net_device *dev, char *oldname) - } - - list_for_each_entry(iter, &dev->adj_list.lower, list) { -+ if (!net_eq(net,dev_net(iter->dev))) -+ continue; - netdev_adjacent_sysfs_del(iter->dev, oldname, - &iter->dev->adj_list.upper); - netdev_adjacent_sysfs_add(iter->dev, dev, -@@ -6675,6 +6740,7 @@ int dev_change_net_namespace(struct net_device *dev, struct net *net, const char - - /* Send a netdev-removed uevent to the old namespace */ - kobject_uevent(&dev->dev.kobj, KOBJ_REMOVE); -+ netdev_adjacent_del_links(dev); - - /* Actually switch the network namespace */ - dev_net_set(dev, net); -@@ -6689,6 +6755,7 @@ int dev_change_net_namespace(struct net_device *dev, struct net *net, const char - - /* Send a netdev-add uevent to the new namespace */ - kobject_uevent(&dev->dev.kobj, KOBJ_ADD); -+ netdev_adjacent_add_links(dev); - - /* Fixup kobjects */ - err = device_rename(&dev->dev, dev->name); -diff --git a/net/core/skbuff.c b/net/core/skbuff.c -index baf6fc457df9..e2b1bba69882 100644 ---- a/net/core/skbuff.c -+++ b/net/core/skbuff.c -@@ -3937,6 +3937,7 @@ void skb_scrub_packet(struct sk_buff *skb, bool xnet) - skb->local_df = 0; - skb_dst_drop(skb); - skb->mark = 0; -+ skb_init_secmark(skb); - secpath_reset(skb); - nf_reset(skb); - nf_reset_trace(skb); -diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c -index 94213c891565..b40b90d3bd2b 100644 ---- a/net/ipv4/ip_gre.c -+++ b/net/ipv4/ip_gre.c -@@ -250,10 +250,6 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb, - struct ip_tunnel *tunnel = netdev_priv(dev); - const struct iphdr *tnl_params; - -- skb = gre_handle_offloads(skb, !!(tunnel->parms.o_flags&TUNNEL_CSUM)); -- if (IS_ERR(skb)) -- goto out; -- - if (dev->header_ops) { - /* Need space for new headers */ - if (skb_cow_head(skb, dev->needed_headroom - -@@ -266,6 +262,7 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb, - * to gre header. - */ - skb_pull(skb, tunnel->hlen + sizeof(struct iphdr)); -+ skb_reset_mac_header(skb); - } else { - if (skb_cow_head(skb, dev->needed_headroom)) - goto free_skb; -@@ -273,6 +270,10 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb, - tnl_params = &tunnel->parms.iph; - } - -+ skb = gre_handle_offloads(skb, !!(tunnel->parms.o_flags&TUNNEL_CSUM)); -+ if (IS_ERR(skb)) -+ goto out; -+ - __gre_xmit(skb, dev, tnl_params, skb->protocol); - - return NETDEV_TX_OK; -diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c -index 91b98e5a17aa..7efa26bb872c 100644 ---- a/net/ipv4/tcp_output.c -+++ b/net/ipv4/tcp_output.c -@@ -1894,7 +1894,7 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle, - if (unlikely(!tcp_snd_wnd_test(tp, skb, mss_now))) - break; - -- if (tso_segs == 1) { -+ if (tso_segs == 1 || !sk->sk_gso_max_segs) { - if (unlikely(!tcp_nagle_test(tp, skb, mss_now, - (tcp_skb_is_last(sk, skb) ? - nonagle : TCP_NAGLE_PUSH)))) -@@ -1931,7 +1931,7 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle, - } - - limit = mss_now; -- if (tso_segs > 1 && !tcp_urg_mode(tp)) -+ if (tso_segs > 1 && sk->sk_gso_max_segs && !tcp_urg_mode(tp)) - limit = tcp_mss_split_point(sk, skb, mss_now, - min_t(unsigned int, - cwnd_quota, -diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c -index cf9937743abb..53ea1644a297 100644 ---- a/net/netfilter/ipset/ip_set_core.c -+++ b/net/netfilter/ipset/ip_set_core.c -@@ -1839,6 +1839,12 @@ ip_set_sockfn_get(struct sock *sk, int optval, void __user *user, int *len) - if (*op < IP_SET_OP_VERSION) { - /* Check the version at the beginning of operations */ - struct ip_set_req_version *req_version = data; -+ -+ if (*len < sizeof(struct ip_set_req_version)) { -+ ret = -EINVAL; -+ goto done; -+ } -+ - if (req_version->version != IPSET_PROTOCOL) { - ret = -EPROTO; - goto done; -diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c -index 7c177bc43806..1d52506bda14 100644 ---- a/net/netlink/af_netlink.c -+++ b/net/netlink/af_netlink.c -@@ -510,14 +510,14 @@ out: - return err; - } - --static void netlink_frame_flush_dcache(const struct nl_mmap_hdr *hdr) -+static void netlink_frame_flush_dcache(const struct nl_mmap_hdr *hdr, unsigned int nm_len) - { - #if ARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE == 1 - struct page *p_start, *p_end; - - /* First page is flushed through netlink_{get,set}_status */ - p_start = pgvec_to_page(hdr + PAGE_SIZE); -- p_end = pgvec_to_page((void *)hdr + NL_MMAP_HDRLEN + hdr->nm_len - 1); -+ p_end = pgvec_to_page((void *)hdr + NL_MMAP_HDRLEN + nm_len - 1); - while (p_start <= p_end) { - flush_dcache_page(p_start); - p_start++; -@@ -535,9 +535,9 @@ static enum nl_mmap_status netlink_get_status(const struct nl_mmap_hdr *hdr) - static void netlink_set_status(struct nl_mmap_hdr *hdr, - enum nl_mmap_status status) - { -+ smp_mb(); - hdr->nm_status = status; - flush_dcache_page(pgvec_to_page(hdr)); -- smp_wmb(); - } - - static struct nl_mmap_hdr * -@@ -699,24 +699,16 @@ static int netlink_mmap_sendmsg(struct sock *sk, struct msghdr *msg, - struct nl_mmap_hdr *hdr; - struct sk_buff *skb; - unsigned int maxlen; -- bool excl = true; - int err = 0, len = 0; - -- /* Netlink messages are validated by the receiver before processing. -- * In order to avoid userspace changing the contents of the message -- * after validation, the socket and the ring may only be used by a -- * single process, otherwise we fall back to copying. -- */ -- if (atomic_long_read(&sk->sk_socket->file->f_count) > 1 || -- atomic_read(&nlk->mapped) > 1) -- excl = false; -- - mutex_lock(&nlk->pg_vec_lock); - - ring = &nlk->tx_ring; - maxlen = ring->frame_size - NL_MMAP_HDRLEN; - - do { -+ unsigned int nm_len; -+ - hdr = netlink_current_frame(ring, NL_MMAP_STATUS_VALID); - if (hdr == NULL) { - if (!(msg->msg_flags & MSG_DONTWAIT) && -@@ -724,35 +716,23 @@ static int netlink_mmap_sendmsg(struct sock *sk, struct msghdr *msg, - schedule(); - continue; - } -- if (hdr->nm_len > maxlen) { -+ -+ nm_len = ACCESS_ONCE(hdr->nm_len); -+ if (nm_len > maxlen) { - err = -EINVAL; - goto out; - } - -- netlink_frame_flush_dcache(hdr); -+ netlink_frame_flush_dcache(hdr, nm_len); - -- if (likely(dst_portid == 0 && dst_group == 0 && excl)) { -- skb = alloc_skb_head(GFP_KERNEL); -- if (skb == NULL) { -- err = -ENOBUFS; -- goto out; -- } -- sock_hold(sk); -- netlink_ring_setup_skb(skb, sk, ring, hdr); -- NETLINK_CB(skb).flags |= NETLINK_SKB_TX; -- __skb_put(skb, hdr->nm_len); -- netlink_set_status(hdr, NL_MMAP_STATUS_RESERVED); -- atomic_inc(&ring->pending); -- } else { -- skb = alloc_skb(hdr->nm_len, GFP_KERNEL); -- if (skb == NULL) { -- err = -ENOBUFS; -- goto out; -- } -- __skb_put(skb, hdr->nm_len); -- memcpy(skb->data, (void *)hdr + NL_MMAP_HDRLEN, hdr->nm_len); -- netlink_set_status(hdr, NL_MMAP_STATUS_UNUSED); -+ skb = alloc_skb(nm_len, GFP_KERNEL); -+ if (skb == NULL) { -+ err = -ENOBUFS; -+ goto out; - } -+ __skb_put(skb, nm_len); -+ memcpy(skb->data, (void *)hdr + NL_MMAP_HDRLEN, nm_len); -+ netlink_set_status(hdr, NL_MMAP_STATUS_UNUSED); - - netlink_increment_head(ring); - -@@ -798,7 +778,7 @@ static void netlink_queue_mmaped_skb(struct sock *sk, struct sk_buff *skb) - hdr->nm_pid = NETLINK_CB(skb).creds.pid; - hdr->nm_uid = from_kuid(sk_user_ns(sk), NETLINK_CB(skb).creds.uid); - hdr->nm_gid = from_kgid(sk_user_ns(sk), NETLINK_CB(skb).creds.gid); -- netlink_frame_flush_dcache(hdr); -+ netlink_frame_flush_dcache(hdr, hdr->nm_len); - netlink_set_status(hdr, NL_MMAP_STATUS_VALID); - - NETLINK_CB(skb).flags |= NETLINK_SKB_DELIVERED; -diff --git a/net/wireless/chan.c b/net/wireless/chan.c -index 78559b5bbd1f..27157a7801e8 100644 ---- a/net/wireless/chan.c -+++ b/net/wireless/chan.c -@@ -516,7 +516,7 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy, - { - struct ieee80211_sta_ht_cap *ht_cap; - struct ieee80211_sta_vht_cap *vht_cap; -- u32 width, control_freq; -+ u32 width, control_freq, cap; - - if (WARN_ON(!cfg80211_chandef_valid(chandef))) - return false; -@@ -554,7 +554,8 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy, - return false; - break; - case NL80211_CHAN_WIDTH_80P80: -- if (!(vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ)) -+ cap = vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK; -+ if (cap != IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ) - return false; - case NL80211_CHAN_WIDTH_80: - if (!vht_cap->vht_supported) -@@ -565,7 +566,9 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy, - case NL80211_CHAN_WIDTH_160: - if (!vht_cap->vht_supported) - return false; -- if (!(vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ)) -+ cap = vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK; -+ if (cap != IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ && -+ cap != IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ) - return false; - prohibited_flags |= IEEE80211_CHAN_NO_160MHZ; - width = 160; -diff --git a/net/wireless/reg.c b/net/wireless/reg.c -index 338794ea44d1..04d530560ec8 100644 ---- a/net/wireless/reg.c -+++ b/net/wireless/reg.c -@@ -1547,7 +1547,7 @@ static enum reg_request_treatment - reg_process_hint_driver(struct wiphy *wiphy, - struct regulatory_request *driver_request) - { -- const struct ieee80211_regdomain *regd; -+ const struct ieee80211_regdomain *regd, *tmp; - enum reg_request_treatment treatment; - - treatment = __reg_process_hint_driver(driver_request); -@@ -1566,7 +1566,10 @@ reg_process_hint_driver(struct wiphy *wiphy, - kfree(driver_request); - return REG_REQ_IGNORE; - } -+ -+ tmp = get_wiphy_regdom(wiphy); - rcu_assign_pointer(wiphy->regd, regd); -+ rcu_free_regdom(tmp); - } - - -@@ -1625,11 +1628,8 @@ __reg_process_hint_country_ie(struct wiphy *wiphy, - return REG_REQ_IGNORE; - return REG_REQ_ALREADY_SET; - } -- /* -- * Two consecutive Country IE hints on the same wiphy. -- * This should be picked up early by the driver/stack -- */ -- if (WARN_ON(regdom_changes(country_ie_request->alpha2))) -+ -+ if (regdom_changes(country_ie_request->alpha2)) - return REG_REQ_OK; - return REG_REQ_ALREADY_SET; - } -diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h -index c657752a420c..83bddbdb90e9 100644 ---- a/sound/usb/quirks-table.h -+++ b/sound/usb/quirks-table.h -@@ -2804,133 +2804,45 @@ YAMAHA_DEVICE(0x7010, "UB99"), - } - }, - --/* Hauppauge HVR-950Q and HVR-850 */ --{ -- USB_DEVICE_VENDOR_SPEC(0x2040, 0x7200), -- .match_flags = USB_DEVICE_ID_MATCH_DEVICE | -- USB_DEVICE_ID_MATCH_INT_CLASS | -- USB_DEVICE_ID_MATCH_INT_SUBCLASS, -- .bInterfaceClass = USB_CLASS_AUDIO, -- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL, -- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { -- .vendor_name = "Hauppauge", -- .product_name = "HVR-950Q", -- .ifnum = QUIRK_ANY_INTERFACE, -- .type = QUIRK_AUDIO_ALIGN_TRANSFER, -- } --}, --{ -- USB_DEVICE_VENDOR_SPEC(0x2040, 0x7210), -- .match_flags = USB_DEVICE_ID_MATCH_DEVICE | -- USB_DEVICE_ID_MATCH_INT_CLASS | -- USB_DEVICE_ID_MATCH_INT_SUBCLASS, -- .bInterfaceClass = USB_CLASS_AUDIO, -- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL, -- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { -- .vendor_name = "Hauppauge", -- .product_name = "HVR-950Q", -- .ifnum = QUIRK_ANY_INTERFACE, -- .type = QUIRK_AUDIO_ALIGN_TRANSFER, -- } --}, --{ -- USB_DEVICE_VENDOR_SPEC(0x2040, 0x7217), -- .match_flags = USB_DEVICE_ID_MATCH_DEVICE | -- USB_DEVICE_ID_MATCH_INT_CLASS | -- USB_DEVICE_ID_MATCH_INT_SUBCLASS, -- .bInterfaceClass = USB_CLASS_AUDIO, -- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL, -- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { -- .vendor_name = "Hauppauge", -- .product_name = "HVR-950Q", -- .ifnum = QUIRK_ANY_INTERFACE, -- .type = QUIRK_AUDIO_ALIGN_TRANSFER, -- } --}, --{ -- USB_DEVICE_VENDOR_SPEC(0x2040, 0x721b), -- .match_flags = USB_DEVICE_ID_MATCH_DEVICE | -- USB_DEVICE_ID_MATCH_INT_CLASS | -- USB_DEVICE_ID_MATCH_INT_SUBCLASS, -- .bInterfaceClass = USB_CLASS_AUDIO, -- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL, -- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { -- .vendor_name = "Hauppauge", -- .product_name = "HVR-950Q", -- .ifnum = QUIRK_ANY_INTERFACE, -- .type = QUIRK_AUDIO_ALIGN_TRANSFER, -- } --}, --{ -- USB_DEVICE_VENDOR_SPEC(0x2040, 0x721e), -- .match_flags = USB_DEVICE_ID_MATCH_DEVICE | -- USB_DEVICE_ID_MATCH_INT_CLASS | -- USB_DEVICE_ID_MATCH_INT_SUBCLASS, -- .bInterfaceClass = USB_CLASS_AUDIO, -- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL, -- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { -- .vendor_name = "Hauppauge", -- .product_name = "HVR-950Q", -- .ifnum = QUIRK_ANY_INTERFACE, -- .type = QUIRK_AUDIO_ALIGN_TRANSFER, -- } --}, --{ -- USB_DEVICE_VENDOR_SPEC(0x2040, 0x721f), -- .match_flags = USB_DEVICE_ID_MATCH_DEVICE | -- USB_DEVICE_ID_MATCH_INT_CLASS | -- USB_DEVICE_ID_MATCH_INT_SUBCLASS, -- .bInterfaceClass = USB_CLASS_AUDIO, -- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL, -- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { -- .vendor_name = "Hauppauge", -- .product_name = "HVR-950Q", -- .ifnum = QUIRK_ANY_INTERFACE, -- .type = QUIRK_AUDIO_ALIGN_TRANSFER, -- } --}, --{ -- USB_DEVICE_VENDOR_SPEC(0x2040, 0x7240), -- .match_flags = USB_DEVICE_ID_MATCH_DEVICE | -- USB_DEVICE_ID_MATCH_INT_CLASS | -- USB_DEVICE_ID_MATCH_INT_SUBCLASS, -- .bInterfaceClass = USB_CLASS_AUDIO, -- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL, -- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { -- .vendor_name = "Hauppauge", -- .product_name = "HVR-850", -- .ifnum = QUIRK_ANY_INTERFACE, -- .type = QUIRK_AUDIO_ALIGN_TRANSFER, -- } --}, --{ -- USB_DEVICE_VENDOR_SPEC(0x2040, 0x7280), -- .match_flags = USB_DEVICE_ID_MATCH_DEVICE | -- USB_DEVICE_ID_MATCH_INT_CLASS | -- USB_DEVICE_ID_MATCH_INT_SUBCLASS, -- .bInterfaceClass = USB_CLASS_AUDIO, -- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL, -- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { -- .vendor_name = "Hauppauge", -- .product_name = "HVR-950Q", -- .ifnum = QUIRK_ANY_INTERFACE, -- .type = QUIRK_AUDIO_ALIGN_TRANSFER, -- } --}, --{ -- USB_DEVICE_VENDOR_SPEC(0x0fd9, 0x0008), -- .match_flags = USB_DEVICE_ID_MATCH_DEVICE | -- USB_DEVICE_ID_MATCH_INT_CLASS | -- USB_DEVICE_ID_MATCH_INT_SUBCLASS, -- .bInterfaceClass = USB_CLASS_AUDIO, -- .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL, -- .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { -- .vendor_name = "Hauppauge", -- .product_name = "HVR-950Q", -- .ifnum = QUIRK_ANY_INTERFACE, -- .type = QUIRK_AUDIO_ALIGN_TRANSFER, -- } --}, -+/* -+ * Auvitek au0828 devices with audio interface. -+ * This should be kept in sync with drivers/media/usb/au0828/au0828-cards.c -+ * Please notice that some drivers are DVB only, and don't need to be -+ * here. That's the case, for example, of DVICO_FUSIONHDTV7. -+ */ -+ -+#define AU0828_DEVICE(vid, pid, vname, pname) { \ -+ USB_DEVICE_VENDOR_SPEC(vid, pid), \ -+ .match_flags = USB_DEVICE_ID_MATCH_DEVICE | \ -+ USB_DEVICE_ID_MATCH_INT_CLASS | \ -+ USB_DEVICE_ID_MATCH_INT_SUBCLASS, \ -+ .bInterfaceClass = USB_CLASS_AUDIO, \ -+ .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL, \ -+ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { \ -+ .vendor_name = vname, \ -+ .product_name = pname, \ -+ .ifnum = QUIRK_ANY_INTERFACE, \ -+ .type = QUIRK_AUDIO_ALIGN_TRANSFER, \ -+ } \ -+} -+ -+AU0828_DEVICE(0x2040, 0x7200, "Hauppauge", "HVR-950Q"), -+AU0828_DEVICE(0x2040, 0x7240, "Hauppauge", "HVR-850"), -+AU0828_DEVICE(0x2040, 0x7210, "Hauppauge", "HVR-950Q"), -+AU0828_DEVICE(0x2040, 0x7217, "Hauppauge", "HVR-950Q"), -+AU0828_DEVICE(0x2040, 0x721b, "Hauppauge", "HVR-950Q"), -+AU0828_DEVICE(0x2040, 0x721e, "Hauppauge", "HVR-950Q"), -+AU0828_DEVICE(0x2040, 0x721f, "Hauppauge", "HVR-950Q"), -+AU0828_DEVICE(0x2040, 0x7280, "Hauppauge", "HVR-950Q"), -+AU0828_DEVICE(0x0fd9, 0x0008, "Hauppauge", "HVR-950Q"), -+AU0828_DEVICE(0x2040, 0x7201, "Hauppauge", "HVR-950Q-MXL"), -+AU0828_DEVICE(0x2040, 0x7211, "Hauppauge", "HVR-950Q-MXL"), -+AU0828_DEVICE(0x2040, 0x7281, "Hauppauge", "HVR-950Q-MXL"), -+AU0828_DEVICE(0x05e1, 0x0480, "Hauppauge", "Woodbury"), -+AU0828_DEVICE(0x2040, 0x8200, "Hauppauge", "Woodbury"), -+AU0828_DEVICE(0x2040, 0x7260, "Hauppauge", "HVR-950Q"), -+AU0828_DEVICE(0x2040, 0x7213, "Hauppauge", "HVR-950Q"), -+AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"), - - /* Digidesign Mbox */ - { diff --git a/patch/kernel/odroidc2-default/patch-3.14.30-31.patch b/patch/kernel/odroidc2-default/patch-3.14.30-31.patch deleted file mode 100644 index a74b19a5ef..0000000000 --- a/patch/kernel/odroidc2-default/patch-3.14.30-31.patch +++ /dev/null @@ -1,5703 +0,0 @@ -diff --git a/Makefile b/Makefile -index 5b94752a85e3..5abf670c6651 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 3 - PATCHLEVEL = 14 --SUBLEVEL = 30 -+SUBLEVEL = 31 - EXTRAVERSION = - NAME = Remembering Coco - -diff --git a/arch/arc/include/asm/barrier.h b/arch/arc/include/asm/barrier.h -deleted file mode 100644 -index c32245c3d1e9..000000000000 ---- a/arch/arc/include/asm/barrier.h -+++ /dev/null -@@ -1,37 +0,0 @@ --/* -- * Copyright (C) 2004, 2007-2010, 2011-2012 Synopsys, Inc. (www.synopsys.com) -- * -- * This program is free software; you can redistribute it and/or modify -- * it under the terms of the GNU General Public License version 2 as -- * published by the Free Software Foundation. -- */ -- --#ifndef __ASM_BARRIER_H --#define __ASM_BARRIER_H -- --#ifndef __ASSEMBLY__ -- --/* TODO-vineetg: Need to see what this does, don't we need sync anywhere */ --#define mb() __asm__ __volatile__ ("" : : : "memory") --#define rmb() mb() --#define wmb() mb() --#define set_mb(var, value) do { var = value; mb(); } while (0) --#define set_wmb(var, value) do { var = value; wmb(); } while (0) --#define read_barrier_depends() mb() -- --/* TODO-vineetg verify the correctness of macros here */ --#ifdef CONFIG_SMP --#define smp_mb() mb() --#define smp_rmb() rmb() --#define smp_wmb() wmb() --#else --#define smp_mb() barrier() --#define smp_rmb() barrier() --#define smp_wmb() barrier() --#endif -- --#define smp_read_barrier_depends() do { } while (0) -- --#endif -- --#endif -diff --git a/arch/arc/kernel/ctx_sw_asm.S b/arch/arc/kernel/ctx_sw_asm.S -index 2ff0347a2fd7..e248594097e7 100644 ---- a/arch/arc/kernel/ctx_sw_asm.S -+++ b/arch/arc/kernel/ctx_sw_asm.S -@@ -10,9 +10,9 @@ - * -This is the more "natural" hand written assembler - */ - -+#include - #include /* For the SAVE_* macros */ - #include --#include - - #define KSP_WORD_OFF ((TASK_THREAD + THREAD_KSP) / 4) - -diff --git a/arch/arm/boot/dts/imx25.dtsi b/arch/arm/boot/dts/imx25.dtsi -index 6a26e79f0ef4..cf3300a3071d 100644 ---- a/arch/arm/boot/dts/imx25.dtsi -+++ b/arch/arm/boot/dts/imx25.dtsi -@@ -352,7 +352,7 @@ - compatible = "fsl,imx25-pwm", "fsl,imx27-pwm"; - #pwm-cells = <2>; - reg = <0x53fa0000 0x4000>; -- clocks = <&clks 106>, <&clks 36>; -+ clocks = <&clks 106>, <&clks 52>; - clock-names = "ipg", "per"; - interrupts = <36>; - }; -@@ -371,7 +371,7 @@ - compatible = "fsl,imx25-pwm", "fsl,imx27-pwm"; - #pwm-cells = <2>; - reg = <0x53fa8000 0x4000>; -- clocks = <&clks 107>, <&clks 36>; -+ clocks = <&clks 107>, <&clks 52>; - clock-names = "ipg", "per"; - interrupts = <41>; - }; -@@ -412,7 +412,7 @@ - pwm4: pwm@53fc8000 { - compatible = "fsl,imx25-pwm", "fsl,imx27-pwm"; - reg = <0x53fc8000 0x4000>; -- clocks = <&clks 108>, <&clks 36>; -+ clocks = <&clks 108>, <&clks 52>; - clock-names = "ipg", "per"; - interrupts = <42>; - }; -@@ -458,7 +458,7 @@ - compatible = "fsl,imx25-pwm", "fsl,imx27-pwm"; - #pwm-cells = <2>; - reg = <0x53fe0000 0x4000>; -- clocks = <&clks 105>, <&clks 36>; -+ clocks = <&clks 105>, <&clks 52>; - clock-names = "ipg", "per"; - interrupts = <26>; - }; -diff --git a/arch/arm/crypto/aes_glue.c b/arch/arm/crypto/aes_glue.c -index 3003fa1f6fb4..0409b8f89782 100644 ---- a/arch/arm/crypto/aes_glue.c -+++ b/arch/arm/crypto/aes_glue.c -@@ -93,6 +93,6 @@ module_exit(aes_fini); - - MODULE_DESCRIPTION("Rijndael (AES) Cipher Algorithm (ASM)"); - MODULE_LICENSE("GPL"); --MODULE_ALIAS("aes"); --MODULE_ALIAS("aes-asm"); -+MODULE_ALIAS_CRYPTO("aes"); -+MODULE_ALIAS_CRYPTO("aes-asm"); - MODULE_AUTHOR("David McCullough "); -diff --git a/arch/arm/crypto/sha1_glue.c b/arch/arm/crypto/sha1_glue.c -index 76cd976230bc..ace4cd67464c 100644 ---- a/arch/arm/crypto/sha1_glue.c -+++ b/arch/arm/crypto/sha1_glue.c -@@ -175,5 +175,5 @@ module_exit(sha1_mod_fini); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("SHA1 Secure Hash Algorithm (ARM)"); --MODULE_ALIAS("sha1"); -+MODULE_ALIAS_CRYPTO("sha1"); - MODULE_AUTHOR("David McCullough "); -diff --git a/arch/powerpc/crypto/sha1.c b/arch/powerpc/crypto/sha1.c -index f9e8b9491efc..b51da9132744 100644 ---- a/arch/powerpc/crypto/sha1.c -+++ b/arch/powerpc/crypto/sha1.c -@@ -154,4 +154,5 @@ module_exit(sha1_powerpc_mod_fini); - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("SHA1 Secure Hash Algorithm"); - --MODULE_ALIAS("sha1-powerpc"); -+MODULE_ALIAS_CRYPTO("sha1"); -+MODULE_ALIAS_CRYPTO("sha1-powerpc"); -diff --git a/arch/s390/crypto/aes_s390.c b/arch/s390/crypto/aes_s390.c -index 23223cd63e54..1f272b24fc0b 100644 ---- a/arch/s390/crypto/aes_s390.c -+++ b/arch/s390/crypto/aes_s390.c -@@ -979,7 +979,7 @@ static void __exit aes_s390_fini(void) - module_init(aes_s390_init); - module_exit(aes_s390_fini); - --MODULE_ALIAS("aes-all"); -+MODULE_ALIAS_CRYPTO("aes-all"); - - MODULE_DESCRIPTION("Rijndael (AES) Cipher Algorithm"); - MODULE_LICENSE("GPL"); -diff --git a/arch/s390/crypto/des_s390.c b/arch/s390/crypto/des_s390.c -index 7acb77f7ef1a..9e05cc453a40 100644 ---- a/arch/s390/crypto/des_s390.c -+++ b/arch/s390/crypto/des_s390.c -@@ -619,8 +619,8 @@ static void __exit des_s390_exit(void) - module_init(des_s390_init); - module_exit(des_s390_exit); - --MODULE_ALIAS("des"); --MODULE_ALIAS("des3_ede"); -+MODULE_ALIAS_CRYPTO("des"); -+MODULE_ALIAS_CRYPTO("des3_ede"); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("DES & Triple DES EDE Cipher Algorithms"); -diff --git a/arch/s390/crypto/ghash_s390.c b/arch/s390/crypto/ghash_s390.c -index d43485d142e9..7940dc90e80b 100644 ---- a/arch/s390/crypto/ghash_s390.c -+++ b/arch/s390/crypto/ghash_s390.c -@@ -160,7 +160,7 @@ static void __exit ghash_mod_exit(void) - module_init(ghash_mod_init); - module_exit(ghash_mod_exit); - --MODULE_ALIAS("ghash"); -+MODULE_ALIAS_CRYPTO("ghash"); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("GHASH Message Digest Algorithm, s390 implementation"); -diff --git a/arch/s390/crypto/sha1_s390.c b/arch/s390/crypto/sha1_s390.c -index a1b3a9dc9d8a..5b2bee323694 100644 ---- a/arch/s390/crypto/sha1_s390.c -+++ b/arch/s390/crypto/sha1_s390.c -@@ -103,6 +103,6 @@ static void __exit sha1_s390_fini(void) - module_init(sha1_s390_init); - module_exit(sha1_s390_fini); - --MODULE_ALIAS("sha1"); -+MODULE_ALIAS_CRYPTO("sha1"); - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("SHA1 Secure Hash Algorithm"); -diff --git a/arch/s390/crypto/sha256_s390.c b/arch/s390/crypto/sha256_s390.c -index 9b853809a492..b74ff158108c 100644 ---- a/arch/s390/crypto/sha256_s390.c -+++ b/arch/s390/crypto/sha256_s390.c -@@ -143,7 +143,7 @@ static void __exit sha256_s390_fini(void) - module_init(sha256_s390_init); - module_exit(sha256_s390_fini); - --MODULE_ALIAS("sha256"); --MODULE_ALIAS("sha224"); -+MODULE_ALIAS_CRYPTO("sha256"); -+MODULE_ALIAS_CRYPTO("sha224"); - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("SHA256 and SHA224 Secure Hash Algorithm"); -diff --git a/arch/s390/crypto/sha512_s390.c b/arch/s390/crypto/sha512_s390.c -index 32a81383b69c..0c36989ba182 100644 ---- a/arch/s390/crypto/sha512_s390.c -+++ b/arch/s390/crypto/sha512_s390.c -@@ -86,7 +86,7 @@ static struct shash_alg sha512_alg = { - } - }; - --MODULE_ALIAS("sha512"); -+MODULE_ALIAS_CRYPTO("sha512"); - - static int sha384_init(struct shash_desc *desc) - { -@@ -126,7 +126,7 @@ static struct shash_alg sha384_alg = { - } - }; - --MODULE_ALIAS("sha384"); -+MODULE_ALIAS_CRYPTO("sha384"); - - static int __init init(void) - { -diff --git a/arch/sparc/crypto/aes_glue.c b/arch/sparc/crypto/aes_glue.c -index 503e6d96ad4e..ded4cee35318 100644 ---- a/arch/sparc/crypto/aes_glue.c -+++ b/arch/sparc/crypto/aes_glue.c -@@ -499,6 +499,6 @@ module_exit(aes_sparc64_mod_fini); - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("AES Secure Hash Algorithm, sparc64 aes opcode accelerated"); - --MODULE_ALIAS("aes"); -+MODULE_ALIAS_CRYPTO("aes"); - - #include "crop_devid.c" -diff --git a/arch/sparc/crypto/camellia_glue.c b/arch/sparc/crypto/camellia_glue.c -index 888f6260b4ec..641f55cb61c3 100644 ---- a/arch/sparc/crypto/camellia_glue.c -+++ b/arch/sparc/crypto/camellia_glue.c -@@ -322,6 +322,6 @@ module_exit(camellia_sparc64_mod_fini); - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("Camellia Cipher Algorithm, sparc64 camellia opcode accelerated"); - --MODULE_ALIAS("aes"); -+MODULE_ALIAS_CRYPTO("aes"); - - #include "crop_devid.c" -diff --git a/arch/sparc/crypto/crc32c_glue.c b/arch/sparc/crypto/crc32c_glue.c -index 5162fad912ce..d1064e46efe8 100644 ---- a/arch/sparc/crypto/crc32c_glue.c -+++ b/arch/sparc/crypto/crc32c_glue.c -@@ -176,6 +176,6 @@ module_exit(crc32c_sparc64_mod_fini); - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("CRC32c (Castagnoli), sparc64 crc32c opcode accelerated"); - --MODULE_ALIAS("crc32c"); -+MODULE_ALIAS_CRYPTO("crc32c"); - - #include "crop_devid.c" -diff --git a/arch/sparc/crypto/des_glue.c b/arch/sparc/crypto/des_glue.c -index 3065bc61f9d3..d11500972994 100644 ---- a/arch/sparc/crypto/des_glue.c -+++ b/arch/sparc/crypto/des_glue.c -@@ -532,6 +532,6 @@ module_exit(des_sparc64_mod_fini); - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("DES & Triple DES EDE Cipher Algorithms, sparc64 des opcode accelerated"); - --MODULE_ALIAS("des"); -+MODULE_ALIAS_CRYPTO("des"); - - #include "crop_devid.c" -diff --git a/arch/sparc/crypto/md5_glue.c b/arch/sparc/crypto/md5_glue.c -index 09a9ea1dfb69..64c7ff5f72a9 100644 ---- a/arch/sparc/crypto/md5_glue.c -+++ b/arch/sparc/crypto/md5_glue.c -@@ -185,6 +185,6 @@ module_exit(md5_sparc64_mod_fini); - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("MD5 Secure Hash Algorithm, sparc64 md5 opcode accelerated"); - --MODULE_ALIAS("md5"); -+MODULE_ALIAS_CRYPTO("md5"); - - #include "crop_devid.c" -diff --git a/arch/sparc/crypto/sha1_glue.c b/arch/sparc/crypto/sha1_glue.c -index 6cd5f29e1e0d..1b3e47accc74 100644 ---- a/arch/sparc/crypto/sha1_glue.c -+++ b/arch/sparc/crypto/sha1_glue.c -@@ -180,6 +180,6 @@ module_exit(sha1_sparc64_mod_fini); - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("SHA1 Secure Hash Algorithm, sparc64 sha1 opcode accelerated"); - --MODULE_ALIAS("sha1"); -+MODULE_ALIAS_CRYPTO("sha1"); - - #include "crop_devid.c" -diff --git a/arch/sparc/crypto/sha256_glue.c b/arch/sparc/crypto/sha256_glue.c -index 04f555ab2680..41f27cca2a22 100644 ---- a/arch/sparc/crypto/sha256_glue.c -+++ b/arch/sparc/crypto/sha256_glue.c -@@ -237,7 +237,7 @@ module_exit(sha256_sparc64_mod_fini); - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("SHA-224 and SHA-256 Secure Hash Algorithm, sparc64 sha256 opcode accelerated"); - --MODULE_ALIAS("sha224"); --MODULE_ALIAS("sha256"); -+MODULE_ALIAS_CRYPTO("sha224"); -+MODULE_ALIAS_CRYPTO("sha256"); - - #include "crop_devid.c" -diff --git a/arch/sparc/crypto/sha512_glue.c b/arch/sparc/crypto/sha512_glue.c -index f04d1994d19a..9fff88541b8c 100644 ---- a/arch/sparc/crypto/sha512_glue.c -+++ b/arch/sparc/crypto/sha512_glue.c -@@ -222,7 +222,7 @@ module_exit(sha512_sparc64_mod_fini); - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("SHA-384 and SHA-512 Secure Hash Algorithm, sparc64 sha512 opcode accelerated"); - --MODULE_ALIAS("sha384"); --MODULE_ALIAS("sha512"); -+MODULE_ALIAS_CRYPTO("sha384"); -+MODULE_ALIAS_CRYPTO("sha512"); - - #include "crop_devid.c" -diff --git a/arch/tile/mm/homecache.c b/arch/tile/mm/homecache.c -index 004ba568d93f..33294fdc402e 100644 ---- a/arch/tile/mm/homecache.c -+++ b/arch/tile/mm/homecache.c -@@ -417,7 +417,7 @@ void __homecache_free_pages(struct page *page, unsigned int order) - if (put_page_testzero(page)) { - homecache_change_page_home(page, order, PAGE_HOME_HASH); - if (order == 0) { -- free_hot_cold_page(page, 0); -+ free_hot_cold_page(page, false); - } else { - init_page_count(page); - __free_pages(page, order); -diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig -index 98aa930230ec..2f645c90e4d8 100644 ---- a/arch/x86/Kconfig -+++ b/arch/x86/Kconfig -@@ -854,7 +854,7 @@ source "kernel/Kconfig.preempt" - - config X86_UP_APIC - bool "Local APIC support on uniprocessors" -- depends on X86_32 && !SMP && !X86_32_NON_STANDARD && !PCI_MSI -+ depends on X86_32 && !SMP && !X86_32_NON_STANDARD - ---help--- - A local APIC (Advanced Programmable Interrupt Controller) is an - integrated interrupt controller in the CPU. If you have a single-CPU -@@ -865,6 +865,10 @@ config X86_UP_APIC - performance counters), and the NMI watchdog which detects hard - lockups. - -+config X86_UP_APIC_MSI -+ def_bool y -+ select X86_UP_APIC if X86_32 && !SMP && !X86_32_NON_STANDARD && PCI_MSI -+ - config X86_UP_IOAPIC - bool "IO-APIC support on uniprocessors" - depends on X86_UP_APIC -diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c -index eb25ca1eb6da..8f45c855f84c 100644 ---- a/arch/x86/boot/compressed/misc.c -+++ b/arch/x86/boot/compressed/misc.c -@@ -396,6 +396,8 @@ asmlinkage void *decompress_kernel(void *rmode, memptr heap, - unsigned long output_len, - unsigned long run_size) - { -+ unsigned char *output_orig = output; -+ - real_mode = rmode; - - sanitize_boot_params(real_mode); -@@ -444,7 +446,12 @@ asmlinkage void *decompress_kernel(void *rmode, memptr heap, - debug_putstr("\nDecompressing Linux... "); - decompress(input_data, input_len, NULL, NULL, output, NULL, error); - parse_elf(output); -- handle_relocations(output, output_len); -+ /* -+ * 32-bit always performs relocations. 64-bit relocations are only -+ * needed if kASLR has chosen a different load address. -+ */ -+ if (!IS_ENABLED(CONFIG_X86_64) || output != output_orig) -+ handle_relocations(output, output_len); - debug_putstr("done.\nBooting the kernel.\n"); - return output; - } -diff --git a/arch/x86/crypto/aes_glue.c b/arch/x86/crypto/aes_glue.c -index aafe8ce0d65d..e26984f7ab8d 100644 ---- a/arch/x86/crypto/aes_glue.c -+++ b/arch/x86/crypto/aes_glue.c -@@ -66,5 +66,5 @@ module_exit(aes_fini); - - MODULE_DESCRIPTION("Rijndael (AES) Cipher Algorithm, asm optimized"); - MODULE_LICENSE("GPL"); --MODULE_ALIAS("aes"); --MODULE_ALIAS("aes-asm"); -+MODULE_ALIAS_CRYPTO("aes"); -+MODULE_ALIAS_CRYPTO("aes-asm"); -diff --git a/arch/x86/crypto/aesni-intel_glue.c b/arch/x86/crypto/aesni-intel_glue.c -index 948ad0e77741..6dfb7d0b139a 100644 ---- a/arch/x86/crypto/aesni-intel_glue.c -+++ b/arch/x86/crypto/aesni-intel_glue.c -@@ -1514,4 +1514,4 @@ module_exit(aesni_exit); - - MODULE_DESCRIPTION("Rijndael (AES) Cipher Algorithm, Intel AES-NI instructions optimized"); - MODULE_LICENSE("GPL"); --MODULE_ALIAS("aes"); -+MODULE_ALIAS_CRYPTO("aes"); -diff --git a/arch/x86/crypto/blowfish_glue.c b/arch/x86/crypto/blowfish_glue.c -index 50ec333b70e6..1477cfcdbf6b 100644 ---- a/arch/x86/crypto/blowfish_glue.c -+++ b/arch/x86/crypto/blowfish_glue.c -@@ -481,5 +481,5 @@ module_exit(fini); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("Blowfish Cipher Algorithm, asm optimized"); --MODULE_ALIAS("blowfish"); --MODULE_ALIAS("blowfish-asm"); -+MODULE_ALIAS_CRYPTO("blowfish"); -+MODULE_ALIAS_CRYPTO("blowfish-asm"); -diff --git a/arch/x86/crypto/camellia_aesni_avx2_glue.c b/arch/x86/crypto/camellia_aesni_avx2_glue.c -index 4209a76fcdaa..9a07fafe3831 100644 ---- a/arch/x86/crypto/camellia_aesni_avx2_glue.c -+++ b/arch/x86/crypto/camellia_aesni_avx2_glue.c -@@ -582,5 +582,5 @@ module_exit(camellia_aesni_fini); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("Camellia Cipher Algorithm, AES-NI/AVX2 optimized"); --MODULE_ALIAS("camellia"); --MODULE_ALIAS("camellia-asm"); -+MODULE_ALIAS_CRYPTO("camellia"); -+MODULE_ALIAS_CRYPTO("camellia-asm"); -diff --git a/arch/x86/crypto/camellia_aesni_avx_glue.c b/arch/x86/crypto/camellia_aesni_avx_glue.c -index 87a041a10f4a..ed38d959add6 100644 ---- a/arch/x86/crypto/camellia_aesni_avx_glue.c -+++ b/arch/x86/crypto/camellia_aesni_avx_glue.c -@@ -574,5 +574,5 @@ module_exit(camellia_aesni_fini); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("Camellia Cipher Algorithm, AES-NI/AVX optimized"); --MODULE_ALIAS("camellia"); --MODULE_ALIAS("camellia-asm"); -+MODULE_ALIAS_CRYPTO("camellia"); -+MODULE_ALIAS_CRYPTO("camellia-asm"); -diff --git a/arch/x86/crypto/camellia_glue.c b/arch/x86/crypto/camellia_glue.c -index c171dcbf192d..5c8b6266a394 100644 ---- a/arch/x86/crypto/camellia_glue.c -+++ b/arch/x86/crypto/camellia_glue.c -@@ -1725,5 +1725,5 @@ module_exit(fini); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("Camellia Cipher Algorithm, asm optimized"); --MODULE_ALIAS("camellia"); --MODULE_ALIAS("camellia-asm"); -+MODULE_ALIAS_CRYPTO("camellia"); -+MODULE_ALIAS_CRYPTO("camellia-asm"); -diff --git a/arch/x86/crypto/cast5_avx_glue.c b/arch/x86/crypto/cast5_avx_glue.c -index e6a3700489b9..f62e9db5a462 100644 ---- a/arch/x86/crypto/cast5_avx_glue.c -+++ b/arch/x86/crypto/cast5_avx_glue.c -@@ -494,4 +494,4 @@ module_exit(cast5_exit); - - MODULE_DESCRIPTION("Cast5 Cipher Algorithm, AVX optimized"); - MODULE_LICENSE("GPL"); --MODULE_ALIAS("cast5"); -+MODULE_ALIAS_CRYPTO("cast5"); -diff --git a/arch/x86/crypto/cast6_avx_glue.c b/arch/x86/crypto/cast6_avx_glue.c -index 09f3677393e4..0160f68a57ff 100644 ---- a/arch/x86/crypto/cast6_avx_glue.c -+++ b/arch/x86/crypto/cast6_avx_glue.c -@@ -611,4 +611,4 @@ module_exit(cast6_exit); - - MODULE_DESCRIPTION("Cast6 Cipher Algorithm, AVX optimized"); - MODULE_LICENSE("GPL"); --MODULE_ALIAS("cast6"); -+MODULE_ALIAS_CRYPTO("cast6"); -diff --git a/arch/x86/crypto/crc32-pclmul_glue.c b/arch/x86/crypto/crc32-pclmul_glue.c -index 9d014a74ef96..1937fc1d8763 100644 ---- a/arch/x86/crypto/crc32-pclmul_glue.c -+++ b/arch/x86/crypto/crc32-pclmul_glue.c -@@ -197,5 +197,5 @@ module_exit(crc32_pclmul_mod_fini); - MODULE_AUTHOR("Alexander Boyko "); - MODULE_LICENSE("GPL"); - --MODULE_ALIAS("crc32"); --MODULE_ALIAS("crc32-pclmul"); -+MODULE_ALIAS_CRYPTO("crc32"); -+MODULE_ALIAS_CRYPTO("crc32-pclmul"); -diff --git a/arch/x86/crypto/crc32c-intel_glue.c b/arch/x86/crypto/crc32c-intel_glue.c -index 6812ad98355c..28640c3d6af7 100644 ---- a/arch/x86/crypto/crc32c-intel_glue.c -+++ b/arch/x86/crypto/crc32c-intel_glue.c -@@ -280,5 +280,5 @@ MODULE_AUTHOR("Austin Zhang , Kent Liu "); - MODULE_DESCRIPTION("T10 DIF CRC calculation accelerated with PCLMULQDQ."); - MODULE_LICENSE("GPL"); - --MODULE_ALIAS("crct10dif"); --MODULE_ALIAS("crct10dif-pclmul"); -+MODULE_ALIAS_CRYPTO("crct10dif"); -+MODULE_ALIAS_CRYPTO("crct10dif-pclmul"); -diff --git a/arch/x86/crypto/fpu.c b/arch/x86/crypto/fpu.c -index 98d7a188f46b..f368ba261739 100644 ---- a/arch/x86/crypto/fpu.c -+++ b/arch/x86/crypto/fpu.c -@@ -17,6 +17,7 @@ - #include - #include - #include -+#include - #include - - struct crypto_fpu_ctx { -@@ -159,3 +160,5 @@ void __exit crypto_fpu_exit(void) - { - crypto_unregister_template(&crypto_fpu_tmpl); - } -+ -+MODULE_ALIAS_CRYPTO("fpu"); -diff --git a/arch/x86/crypto/ghash-clmulni-intel_glue.c b/arch/x86/crypto/ghash-clmulni-intel_glue.c -index d785cf2c529c..a8d6f69f92a3 100644 ---- a/arch/x86/crypto/ghash-clmulni-intel_glue.c -+++ b/arch/x86/crypto/ghash-clmulni-intel_glue.c -@@ -341,4 +341,4 @@ module_exit(ghash_pclmulqdqni_mod_exit); - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("GHASH Message Digest Algorithm, " - "acclerated by PCLMULQDQ-NI"); --MODULE_ALIAS("ghash"); -+MODULE_ALIAS_CRYPTO("ghash"); -diff --git a/arch/x86/crypto/salsa20_glue.c b/arch/x86/crypto/salsa20_glue.c -index 5e8e67739bb5..399a29d067d6 100644 ---- a/arch/x86/crypto/salsa20_glue.c -+++ b/arch/x86/crypto/salsa20_glue.c -@@ -119,5 +119,5 @@ module_exit(fini); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION ("Salsa20 stream cipher algorithm (optimized assembly version)"); --MODULE_ALIAS("salsa20"); --MODULE_ALIAS("salsa20-asm"); -+MODULE_ALIAS_CRYPTO("salsa20"); -+MODULE_ALIAS_CRYPTO("salsa20-asm"); -diff --git a/arch/x86/crypto/serpent_avx2_glue.c b/arch/x86/crypto/serpent_avx2_glue.c -index 2fae489b1524..437e47a4d302 100644 ---- a/arch/x86/crypto/serpent_avx2_glue.c -+++ b/arch/x86/crypto/serpent_avx2_glue.c -@@ -558,5 +558,5 @@ module_exit(fini); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("Serpent Cipher Algorithm, AVX2 optimized"); --MODULE_ALIAS("serpent"); --MODULE_ALIAS("serpent-asm"); -+MODULE_ALIAS_CRYPTO("serpent"); -+MODULE_ALIAS_CRYPTO("serpent-asm"); -diff --git a/arch/x86/crypto/serpent_avx_glue.c b/arch/x86/crypto/serpent_avx_glue.c -index ff4870870972..7e217398b4eb 100644 ---- a/arch/x86/crypto/serpent_avx_glue.c -+++ b/arch/x86/crypto/serpent_avx_glue.c -@@ -617,4 +617,4 @@ module_exit(serpent_exit); - - MODULE_DESCRIPTION("Serpent Cipher Algorithm, AVX optimized"); - MODULE_LICENSE("GPL"); --MODULE_ALIAS("serpent"); -+MODULE_ALIAS_CRYPTO("serpent"); -diff --git a/arch/x86/crypto/serpent_sse2_glue.c b/arch/x86/crypto/serpent_sse2_glue.c -index 8c95f8637306..bf025adaea01 100644 ---- a/arch/x86/crypto/serpent_sse2_glue.c -+++ b/arch/x86/crypto/serpent_sse2_glue.c -@@ -618,4 +618,4 @@ module_exit(serpent_sse2_exit); - - MODULE_DESCRIPTION("Serpent Cipher Algorithm, SSE2 optimized"); - MODULE_LICENSE("GPL"); --MODULE_ALIAS("serpent"); -+MODULE_ALIAS_CRYPTO("serpent"); -diff --git a/arch/x86/crypto/sha1_ssse3_glue.c b/arch/x86/crypto/sha1_ssse3_glue.c -index 4a11a9d72451..29e1060e9001 100644 ---- a/arch/x86/crypto/sha1_ssse3_glue.c -+++ b/arch/x86/crypto/sha1_ssse3_glue.c -@@ -237,4 +237,4 @@ module_exit(sha1_ssse3_mod_fini); - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("SHA1 Secure Hash Algorithm, Supplemental SSE3 accelerated"); - --MODULE_ALIAS("sha1"); -+MODULE_ALIAS_CRYPTO("sha1"); -diff --git a/arch/x86/crypto/sha256_ssse3_glue.c b/arch/x86/crypto/sha256_ssse3_glue.c -index f248546da1ca..4dc100d82902 100644 ---- a/arch/x86/crypto/sha256_ssse3_glue.c -+++ b/arch/x86/crypto/sha256_ssse3_glue.c -@@ -318,5 +318,5 @@ module_exit(sha256_ssse3_mod_fini); - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("SHA256 Secure Hash Algorithm, Supplemental SSE3 accelerated"); - --MODULE_ALIAS("sha256"); --MODULE_ALIAS("sha224"); -+MODULE_ALIAS_CRYPTO("sha256"); -+MODULE_ALIAS_CRYPTO("sha224"); -diff --git a/arch/x86/crypto/sha512_ssse3_glue.c b/arch/x86/crypto/sha512_ssse3_glue.c -index 8626b03e83b7..26a5898a6f26 100644 ---- a/arch/x86/crypto/sha512_ssse3_glue.c -+++ b/arch/x86/crypto/sha512_ssse3_glue.c -@@ -326,5 +326,5 @@ module_exit(sha512_ssse3_mod_fini); - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("SHA512 Secure Hash Algorithm, Supplemental SSE3 accelerated"); - --MODULE_ALIAS("sha512"); --MODULE_ALIAS("sha384"); -+MODULE_ALIAS_CRYPTO("sha512"); -+MODULE_ALIAS_CRYPTO("sha384"); -diff --git a/arch/x86/crypto/twofish_avx_glue.c b/arch/x86/crypto/twofish_avx_glue.c -index 4e3c665be129..1ac531ea9bcc 100644 ---- a/arch/x86/crypto/twofish_avx_glue.c -+++ b/arch/x86/crypto/twofish_avx_glue.c -@@ -579,4 +579,4 @@ module_exit(twofish_exit); - - MODULE_DESCRIPTION("Twofish Cipher Algorithm, AVX optimized"); - MODULE_LICENSE("GPL"); --MODULE_ALIAS("twofish"); -+MODULE_ALIAS_CRYPTO("twofish"); -diff --git a/arch/x86/crypto/twofish_glue.c b/arch/x86/crypto/twofish_glue.c -index 0a5202303501..77e06c2da83d 100644 ---- a/arch/x86/crypto/twofish_glue.c -+++ b/arch/x86/crypto/twofish_glue.c -@@ -96,5 +96,5 @@ module_exit(fini); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION ("Twofish Cipher Algorithm, asm optimized"); --MODULE_ALIAS("twofish"); --MODULE_ALIAS("twofish-asm"); -+MODULE_ALIAS_CRYPTO("twofish"); -+MODULE_ALIAS_CRYPTO("twofish-asm"); -diff --git a/arch/x86/crypto/twofish_glue_3way.c b/arch/x86/crypto/twofish_glue_3way.c -index 13e63b3e1dfb..56d8a08ee479 100644 ---- a/arch/x86/crypto/twofish_glue_3way.c -+++ b/arch/x86/crypto/twofish_glue_3way.c -@@ -495,5 +495,5 @@ module_exit(fini); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("Twofish Cipher Algorithm, 3-way parallel asm optimized"); --MODULE_ALIAS("twofish"); --MODULE_ALIAS("twofish-asm"); -+MODULE_ALIAS_CRYPTO("twofish"); -+MODULE_ALIAS_CRYPTO("twofish-asm"); -diff --git a/arch/x86/include/asm/desc.h b/arch/x86/include/asm/desc.h -index 50d033a8947d..a94b82e8f156 100644 ---- a/arch/x86/include/asm/desc.h -+++ b/arch/x86/include/asm/desc.h -@@ -251,7 +251,8 @@ static inline void native_load_tls(struct thread_struct *t, unsigned int cpu) - gdt[GDT_ENTRY_TLS_MIN + i] = t->tls_array[i]; - } - --#define _LDT_empty(info) \ -+/* This intentionally ignores lm, since 32-bit apps don't have that field. */ -+#define LDT_empty(info) \ - ((info)->base_addr == 0 && \ - (info)->limit == 0 && \ - (info)->contents == 0 && \ -@@ -261,11 +262,18 @@ static inline void native_load_tls(struct thread_struct *t, unsigned int cpu) - (info)->seg_not_present == 1 && \ - (info)->useable == 0) - --#ifdef CONFIG_X86_64 --#define LDT_empty(info) (_LDT_empty(info) && ((info)->lm == 0)) --#else --#define LDT_empty(info) (_LDT_empty(info)) --#endif -+/* Lots of programs expect an all-zero user_desc to mean "no segment at all". */ -+static inline bool LDT_zero(const struct user_desc *info) -+{ -+ return (info->base_addr == 0 && -+ info->limit == 0 && -+ info->contents == 0 && -+ info->read_exec_only == 0 && -+ info->seg_32bit == 0 && -+ info->limit_in_pages == 0 && -+ info->seg_not_present == 0 && -+ info->useable == 0); -+} - - static inline void clear_LDT(void) - { -diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c -index 832d05a914ba..317c81172c18 100644 ---- a/arch/x86/kernel/cpu/mshyperv.c -+++ b/arch/x86/kernel/cpu/mshyperv.c -@@ -67,6 +67,7 @@ static struct clocksource hyperv_cs = { - .rating = 400, /* use this when running on Hyperv*/ - .read = read_hv_clock, - .mask = CLOCKSOURCE_MASK(64), -+ .flags = CLOCK_SOURCE_IS_CONTINUOUS, - }; - - static void __init ms_hyperv_init_platform(void) -diff --git a/arch/x86/kernel/tls.c b/arch/x86/kernel/tls.c -index 4e942f31b1a7..7fc5e843f247 100644 ---- a/arch/x86/kernel/tls.c -+++ b/arch/x86/kernel/tls.c -@@ -29,7 +29,28 @@ static int get_free_idx(void) - - static bool tls_desc_okay(const struct user_desc *info) - { -- if (LDT_empty(info)) -+ /* -+ * For historical reasons (i.e. no one ever documented how any -+ * of the segmentation APIs work), user programs can and do -+ * assume that a struct user_desc that's all zeros except for -+ * entry_number means "no segment at all". This never actually -+ * worked. In fact, up to Linux 3.19, a struct user_desc like -+ * this would create a 16-bit read-write segment with base and -+ * limit both equal to zero. -+ * -+ * That was close enough to "no segment at all" until we -+ * hardened this function to disallow 16-bit TLS segments. Fix -+ * it up by interpreting these zeroed segments the way that they -+ * were almost certainly intended to be interpreted. -+ * -+ * The correct way to ask for "no segment at all" is to specify -+ * a user_desc that satisfies LDT_empty. To keep everything -+ * working, we accept both. -+ * -+ * Note that there's a similar kludge in modify_ldt -- look at -+ * the distinction between modes 1 and 0x11. -+ */ -+ if (LDT_empty(info) || LDT_zero(info)) - return true; - - /* -@@ -71,7 +92,7 @@ static void set_tls_desc(struct task_struct *p, int idx, - cpu = get_cpu(); - - while (n-- > 0) { -- if (LDT_empty(info)) -+ if (LDT_empty(info) || LDT_zero(info)) - desc->a = desc->b = 0; - else - fill_ldt(desc, info); -diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c -index f9d976e0ae67..b1d9002af7db 100644 ---- a/arch/x86/kernel/traps.c -+++ b/arch/x86/kernel/traps.c -@@ -365,7 +365,7 @@ exit: - * for scheduling or signal handling. The actual stack switch is done in - * entry.S - */ --asmlinkage __kprobes struct pt_regs *sync_regs(struct pt_regs *eregs) -+asmlinkage notrace __kprobes struct pt_regs *sync_regs(struct pt_regs *eregs) - { - struct pt_regs *regs = eregs; - /* Did already sync */ -@@ -390,7 +390,7 @@ struct bad_iret_stack { - struct pt_regs regs; - }; - --asmlinkage __visible -+asmlinkage __visible notrace __kprobes - struct bad_iret_stack *fixup_bad_iret(struct bad_iret_stack *s) - { - /* -diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c -index de0290605903..b20bced0090f 100644 ---- a/arch/x86/kernel/tsc.c -+++ b/arch/x86/kernel/tsc.c -@@ -618,7 +618,7 @@ static unsigned long quick_pit_calibrate(void) - goto success; - } - } -- pr_err("Fast TSC calibration failed\n"); -+ pr_info("Fast TSC calibration failed\n"); - return 0; - - success: -diff --git a/crypto/842.c b/crypto/842.c -index 65c7a89cfa09..b48f4f108c47 100644 ---- a/crypto/842.c -+++ b/crypto/842.c -@@ -180,3 +180,4 @@ module_exit(nx842_mod_exit); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("842 Compression Algorithm"); -+MODULE_ALIAS_CRYPTO("842"); -diff --git a/crypto/aes_generic.c b/crypto/aes_generic.c -index fd0d6b454975..3dd101144a58 100644 ---- a/crypto/aes_generic.c -+++ b/crypto/aes_generic.c -@@ -1474,4 +1474,5 @@ module_exit(aes_fini); - - MODULE_DESCRIPTION("Rijndael (AES) Cipher Algorithm"); - MODULE_LICENSE("Dual BSD/GPL"); --MODULE_ALIAS("aes"); -+MODULE_ALIAS_CRYPTO("aes"); -+MODULE_ALIAS_CRYPTO("aes-generic"); -diff --git a/crypto/algapi.c b/crypto/algapi.c -index 7a1ae87f1683..00d8d939733b 100644 ---- a/crypto/algapi.c -+++ b/crypto/algapi.c -@@ -495,8 +495,8 @@ static struct crypto_template *__crypto_lookup_template(const char *name) - - struct crypto_template *crypto_lookup_template(const char *name) - { -- return try_then_request_module(__crypto_lookup_template(name), "%s", -- name); -+ return try_then_request_module(__crypto_lookup_template(name), -+ "crypto-%s", name); - } - EXPORT_SYMBOL_GPL(crypto_lookup_template); - -diff --git a/crypto/ansi_cprng.c b/crypto/ansi_cprng.c -index 666f1962a160..6f5bebc9bf01 100644 ---- a/crypto/ansi_cprng.c -+++ b/crypto/ansi_cprng.c -@@ -476,4 +476,5 @@ module_param(dbg, int, 0); - MODULE_PARM_DESC(dbg, "Boolean to enable debugging (0/1 == off/on)"); - module_init(prng_mod_init); - module_exit(prng_mod_fini); --MODULE_ALIAS("stdrng"); -+MODULE_ALIAS_CRYPTO("stdrng"); -+MODULE_ALIAS_CRYPTO("ansi_cprng"); -diff --git a/crypto/anubis.c b/crypto/anubis.c -index 008c8a4fb67c..4bb187c2a902 100644 ---- a/crypto/anubis.c -+++ b/crypto/anubis.c -@@ -704,3 +704,4 @@ module_exit(anubis_mod_fini); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("Anubis Cryptographic Algorithm"); -+MODULE_ALIAS_CRYPTO("anubis"); -diff --git a/crypto/api.c b/crypto/api.c -index a2b39c5f3649..2a81e98a0021 100644 ---- a/crypto/api.c -+++ b/crypto/api.c -@@ -216,11 +216,11 @@ struct crypto_alg *crypto_larval_lookup(const char *name, u32 type, u32 mask) - - alg = crypto_alg_lookup(name, type, mask); - if (!alg) { -- request_module("%s", name); -+ request_module("crypto-%s", name); - - if (!((type ^ CRYPTO_ALG_NEED_FALLBACK) & mask & - CRYPTO_ALG_NEED_FALLBACK)) -- request_module("%s-all", name); -+ request_module("crypto-%s-all", name); - - alg = crypto_alg_lookup(name, type, mask); - } -diff --git a/crypto/arc4.c b/crypto/arc4.c -index 5a772c3657d5..f1a81925558f 100644 ---- a/crypto/arc4.c -+++ b/crypto/arc4.c -@@ -166,3 +166,4 @@ module_exit(arc4_exit); - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("ARC4 Cipher Algorithm"); - MODULE_AUTHOR("Jon Oberheide "); -+MODULE_ALIAS_CRYPTO("arc4"); -diff --git a/crypto/authenc.c b/crypto/authenc.c -index e1223559d5df..78fb16cab13f 100644 ---- a/crypto/authenc.c -+++ b/crypto/authenc.c -@@ -721,3 +721,4 @@ module_exit(crypto_authenc_module_exit); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("Simple AEAD wrapper for IPsec"); -+MODULE_ALIAS_CRYPTO("authenc"); -diff --git a/crypto/authencesn.c b/crypto/authencesn.c -index 4be0dd4373a9..024bff2344fc 100644 ---- a/crypto/authencesn.c -+++ b/crypto/authencesn.c -@@ -814,3 +814,4 @@ module_exit(crypto_authenc_esn_module_exit); - MODULE_LICENSE("GPL"); - MODULE_AUTHOR("Steffen Klassert "); - MODULE_DESCRIPTION("AEAD wrapper for IPsec with extended sequence numbers"); -+MODULE_ALIAS_CRYPTO("authencesn"); -diff --git a/crypto/blowfish_generic.c b/crypto/blowfish_generic.c -index 8baf5447d35b..87b392a77a93 100644 ---- a/crypto/blowfish_generic.c -+++ b/crypto/blowfish_generic.c -@@ -138,4 +138,5 @@ module_exit(blowfish_mod_fini); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("Blowfish Cipher Algorithm"); --MODULE_ALIAS("blowfish"); -+MODULE_ALIAS_CRYPTO("blowfish"); -+MODULE_ALIAS_CRYPTO("blowfish-generic"); -diff --git a/crypto/camellia_generic.c b/crypto/camellia_generic.c -index 26bcd7a2d6b4..a02286bf319e 100644 ---- a/crypto/camellia_generic.c -+++ b/crypto/camellia_generic.c -@@ -1098,4 +1098,5 @@ module_exit(camellia_fini); - - MODULE_DESCRIPTION("Camellia Cipher Algorithm"); - MODULE_LICENSE("GPL"); --MODULE_ALIAS("camellia"); -+MODULE_ALIAS_CRYPTO("camellia"); -+MODULE_ALIAS_CRYPTO("camellia-generic"); -diff --git a/crypto/cast5_generic.c b/crypto/cast5_generic.c -index 5558f630a0eb..df5c72629383 100644 ---- a/crypto/cast5_generic.c -+++ b/crypto/cast5_generic.c -@@ -549,4 +549,5 @@ module_exit(cast5_mod_fini); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("Cast5 Cipher Algorithm"); --MODULE_ALIAS("cast5"); -+MODULE_ALIAS_CRYPTO("cast5"); -+MODULE_ALIAS_CRYPTO("cast5-generic"); -diff --git a/crypto/cast6_generic.c b/crypto/cast6_generic.c -index de732528a430..058c8d755d03 100644 ---- a/crypto/cast6_generic.c -+++ b/crypto/cast6_generic.c -@@ -291,4 +291,5 @@ module_exit(cast6_mod_fini); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("Cast6 Cipher Algorithm"); --MODULE_ALIAS("cast6"); -+MODULE_ALIAS_CRYPTO("cast6"); -+MODULE_ALIAS_CRYPTO("cast6-generic"); -diff --git a/crypto/cbc.c b/crypto/cbc.c -index 61ac42e1e32b..780ee27b2d43 100644 ---- a/crypto/cbc.c -+++ b/crypto/cbc.c -@@ -289,3 +289,4 @@ module_exit(crypto_cbc_module_exit); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("CBC block cipher algorithm"); -+MODULE_ALIAS_CRYPTO("cbc"); -diff --git a/crypto/ccm.c b/crypto/ccm.c -index 1df84217f7c9..003bbbd21a2b 100644 ---- a/crypto/ccm.c -+++ b/crypto/ccm.c -@@ -879,5 +879,6 @@ module_exit(crypto_ccm_module_exit); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("Counter with CBC MAC"); --MODULE_ALIAS("ccm_base"); --MODULE_ALIAS("rfc4309"); -+MODULE_ALIAS_CRYPTO("ccm_base"); -+MODULE_ALIAS_CRYPTO("rfc4309"); -+MODULE_ALIAS_CRYPTO("ccm"); -diff --git a/crypto/chainiv.c b/crypto/chainiv.c -index 834d8dd3d4fc..22b7e55b0e1b 100644 ---- a/crypto/chainiv.c -+++ b/crypto/chainiv.c -@@ -359,3 +359,4 @@ module_exit(chainiv_module_exit); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("Chain IV Generator"); -+MODULE_ALIAS_CRYPTO("chainiv"); -diff --git a/crypto/cmac.c b/crypto/cmac.c -index 50880cf17fad..7a8bfbd548f6 100644 ---- a/crypto/cmac.c -+++ b/crypto/cmac.c -@@ -313,3 +313,4 @@ module_exit(crypto_cmac_module_exit); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("CMAC keyed hash algorithm"); -+MODULE_ALIAS_CRYPTO("cmac"); -diff --git a/crypto/crc32.c b/crypto/crc32.c -index 9d1c41569898..187ded28cb0b 100644 ---- a/crypto/crc32.c -+++ b/crypto/crc32.c -@@ -156,3 +156,4 @@ module_exit(crc32_mod_fini); - MODULE_AUTHOR("Alexander Boyko "); - MODULE_DESCRIPTION("CRC32 calculations wrapper for lib/crc32"); - MODULE_LICENSE("GPL"); -+MODULE_ALIAS_CRYPTO("crc32"); -diff --git a/crypto/crct10dif_generic.c b/crypto/crct10dif_generic.c -index 877e7114ec5c..c1229614c7e3 100644 ---- a/crypto/crct10dif_generic.c -+++ b/crypto/crct10dif_generic.c -@@ -124,4 +124,5 @@ module_exit(crct10dif_mod_fini); - MODULE_AUTHOR("Tim Chen "); - MODULE_DESCRIPTION("T10 DIF CRC calculation."); - MODULE_LICENSE("GPL"); --MODULE_ALIAS("crct10dif"); -+MODULE_ALIAS_CRYPTO("crct10dif"); -+MODULE_ALIAS_CRYPTO("crct10dif-generic"); -diff --git a/crypto/cryptd.c b/crypto/cryptd.c -index 7bdd61b867c8..75c415d37086 100644 ---- a/crypto/cryptd.c -+++ b/crypto/cryptd.c -@@ -955,3 +955,4 @@ module_exit(cryptd_exit); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("Software async crypto daemon"); -+MODULE_ALIAS_CRYPTO("cryptd"); -diff --git a/crypto/crypto_null.c b/crypto/crypto_null.c -index fee7265cd35d..7b39fa3deac2 100644 ---- a/crypto/crypto_null.c -+++ b/crypto/crypto_null.c -@@ -149,9 +149,9 @@ static struct crypto_alg null_algs[3] = { { - .coa_decompress = null_compress } } - } }; - --MODULE_ALIAS("compress_null"); --MODULE_ALIAS("digest_null"); --MODULE_ALIAS("cipher_null"); -+MODULE_ALIAS_CRYPTO("compress_null"); -+MODULE_ALIAS_CRYPTO("digest_null"); -+MODULE_ALIAS_CRYPTO("cipher_null"); - - static int __init crypto_null_mod_init(void) - { -diff --git a/crypto/ctr.c b/crypto/ctr.c -index f2b94f27bb2c..2386f7313952 100644 ---- a/crypto/ctr.c -+++ b/crypto/ctr.c -@@ -466,4 +466,5 @@ module_exit(crypto_ctr_module_exit); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("CTR Counter block mode"); --MODULE_ALIAS("rfc3686"); -+MODULE_ALIAS_CRYPTO("rfc3686"); -+MODULE_ALIAS_CRYPTO("ctr"); -diff --git a/crypto/cts.c b/crypto/cts.c -index 042223f8e733..60b9da3fa7c1 100644 ---- a/crypto/cts.c -+++ b/crypto/cts.c -@@ -350,3 +350,4 @@ module_exit(crypto_cts_module_exit); - - MODULE_LICENSE("Dual BSD/GPL"); - MODULE_DESCRIPTION("CTS-CBC CipherText Stealing for CBC"); -+MODULE_ALIAS_CRYPTO("cts"); -diff --git a/crypto/deflate.c b/crypto/deflate.c -index b57d70eb156b..95d8d37c5021 100644 ---- a/crypto/deflate.c -+++ b/crypto/deflate.c -@@ -222,4 +222,4 @@ module_exit(deflate_mod_fini); - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("Deflate Compression Algorithm for IPCOMP"); - MODULE_AUTHOR("James Morris "); -- -+MODULE_ALIAS_CRYPTO("deflate"); -diff --git a/crypto/des_generic.c b/crypto/des_generic.c -index f6cf63f88468..3ec6071309d9 100644 ---- a/crypto/des_generic.c -+++ b/crypto/des_generic.c -@@ -971,8 +971,6 @@ static struct crypto_alg des_algs[2] = { { - .cia_decrypt = des3_ede_decrypt } } - } }; - --MODULE_ALIAS("des3_ede"); -- - static int __init des_generic_mod_init(void) - { - return crypto_register_algs(des_algs, ARRAY_SIZE(des_algs)); -@@ -989,4 +987,7 @@ module_exit(des_generic_mod_fini); - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("DES & Triple DES EDE Cipher Algorithms"); - MODULE_AUTHOR("Dag Arne Osvik "); --MODULE_ALIAS("des"); -+MODULE_ALIAS_CRYPTO("des"); -+MODULE_ALIAS_CRYPTO("des-generic"); -+MODULE_ALIAS_CRYPTO("des3_ede"); -+MODULE_ALIAS_CRYPTO("des3_ede-generic"); -diff --git a/crypto/ecb.c b/crypto/ecb.c -index 935cfef4aa84..12011aff0971 100644 ---- a/crypto/ecb.c -+++ b/crypto/ecb.c -@@ -185,3 +185,4 @@ module_exit(crypto_ecb_module_exit); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("ECB block cipher algorithm"); -+MODULE_ALIAS_CRYPTO("ecb"); -diff --git a/crypto/eseqiv.c b/crypto/eseqiv.c -index 42ce9f570aec..388f582ab0b9 100644 ---- a/crypto/eseqiv.c -+++ b/crypto/eseqiv.c -@@ -267,3 +267,4 @@ module_exit(eseqiv_module_exit); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("Encrypted Sequence Number IV Generator"); -+MODULE_ALIAS_CRYPTO("eseqiv"); -diff --git a/crypto/fcrypt.c b/crypto/fcrypt.c -index 021d7fec6bc8..77286ea28865 100644 ---- a/crypto/fcrypt.c -+++ b/crypto/fcrypt.c -@@ -420,3 +420,4 @@ module_exit(fcrypt_mod_fini); - MODULE_LICENSE("Dual BSD/GPL"); - MODULE_DESCRIPTION("FCrypt Cipher Algorithm"); - MODULE_AUTHOR("David Howells "); -+MODULE_ALIAS_CRYPTO("fcrypt"); -diff --git a/crypto/gcm.c b/crypto/gcm.c -index b4f017939004..9cea4d0b6904 100644 ---- a/crypto/gcm.c -+++ b/crypto/gcm.c -@@ -1441,6 +1441,7 @@ module_exit(crypto_gcm_module_exit); - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("Galois/Counter Mode"); - MODULE_AUTHOR("Mikko Herranen "); --MODULE_ALIAS("gcm_base"); --MODULE_ALIAS("rfc4106"); --MODULE_ALIAS("rfc4543"); -+MODULE_ALIAS_CRYPTO("gcm_base"); -+MODULE_ALIAS_CRYPTO("rfc4106"); -+MODULE_ALIAS_CRYPTO("rfc4543"); -+MODULE_ALIAS_CRYPTO("gcm"); -diff --git a/crypto/ghash-generic.c b/crypto/ghash-generic.c -index 9d3f0c69a86f..bac70995e064 100644 ---- a/crypto/ghash-generic.c -+++ b/crypto/ghash-generic.c -@@ -172,4 +172,5 @@ module_exit(ghash_mod_exit); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("GHASH Message Digest Algorithm"); --MODULE_ALIAS("ghash"); -+MODULE_ALIAS_CRYPTO("ghash"); -+MODULE_ALIAS_CRYPTO("ghash-generic"); -diff --git a/crypto/hmac.c b/crypto/hmac.c -index 8d9544cf8169..ade790b454e9 100644 ---- a/crypto/hmac.c -+++ b/crypto/hmac.c -@@ -271,3 +271,4 @@ module_exit(hmac_module_exit); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("HMAC hash algorithm"); -+MODULE_ALIAS_CRYPTO("hmac"); -diff --git a/crypto/khazad.c b/crypto/khazad.c -index 60e7cd66facc..873eb5ded6d7 100644 ---- a/crypto/khazad.c -+++ b/crypto/khazad.c -@@ -880,3 +880,4 @@ module_exit(khazad_mod_fini); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("Khazad Cryptographic Algorithm"); -+MODULE_ALIAS_CRYPTO("khazad"); -diff --git a/crypto/krng.c b/crypto/krng.c -index a2d2b72fc135..0224841b6579 100644 ---- a/crypto/krng.c -+++ b/crypto/krng.c -@@ -62,4 +62,5 @@ module_exit(krng_mod_fini); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("Kernel Random Number Generator"); --MODULE_ALIAS("stdrng"); -+MODULE_ALIAS_CRYPTO("stdrng"); -+MODULE_ALIAS_CRYPTO("krng"); -diff --git a/crypto/lrw.c b/crypto/lrw.c -index ba42acc4deba..6f9908a7ebcb 100644 ---- a/crypto/lrw.c -+++ b/crypto/lrw.c -@@ -400,3 +400,4 @@ module_exit(crypto_module_exit); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("LRW block cipher mode"); -+MODULE_ALIAS_CRYPTO("lrw"); -diff --git a/crypto/lz4.c b/crypto/lz4.c -index 4586dd15b0d8..53279ab8c3a6 100644 ---- a/crypto/lz4.c -+++ b/crypto/lz4.c -@@ -104,3 +104,4 @@ module_exit(lz4_mod_fini); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("LZ4 Compression Algorithm"); -+MODULE_ALIAS_CRYPTO("lz4"); -diff --git a/crypto/lz4hc.c b/crypto/lz4hc.c -index 151ba31d34e3..eaec5fa3debf 100644 ---- a/crypto/lz4hc.c -+++ b/crypto/lz4hc.c -@@ -104,3 +104,4 @@ module_exit(lz4hc_mod_fini); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("LZ4HC Compression Algorithm"); -+MODULE_ALIAS_CRYPTO("lz4hc"); -diff --git a/crypto/lzo.c b/crypto/lzo.c -index 1c2aa69c54b8..d1ff69404353 100644 ---- a/crypto/lzo.c -+++ b/crypto/lzo.c -@@ -103,3 +103,4 @@ module_exit(lzo_mod_fini); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("LZO Compression Algorithm"); -+MODULE_ALIAS_CRYPTO("lzo"); -diff --git a/crypto/md4.c b/crypto/md4.c -index 0477a6a01d58..3515af425cc9 100644 ---- a/crypto/md4.c -+++ b/crypto/md4.c -@@ -255,4 +255,4 @@ module_exit(md4_mod_fini); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("MD4 Message Digest Algorithm"); -- -+MODULE_ALIAS_CRYPTO("md4"); -diff --git a/crypto/md5.c b/crypto/md5.c -index 7febeaab923b..36f5e5b103f3 100644 ---- a/crypto/md5.c -+++ b/crypto/md5.c -@@ -168,3 +168,4 @@ module_exit(md5_mod_fini); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("MD5 Message Digest Algorithm"); -+MODULE_ALIAS_CRYPTO("md5"); -diff --git a/crypto/michael_mic.c b/crypto/michael_mic.c -index 079b761bc70d..46195e0d0f4d 100644 ---- a/crypto/michael_mic.c -+++ b/crypto/michael_mic.c -@@ -184,3 +184,4 @@ module_exit(michael_mic_exit); - MODULE_LICENSE("GPL v2"); - MODULE_DESCRIPTION("Michael MIC"); - MODULE_AUTHOR("Jouni Malinen "); -+MODULE_ALIAS_CRYPTO("michael_mic"); -diff --git a/crypto/pcbc.c b/crypto/pcbc.c -index d1b8bdfb5855..f654965f0933 100644 ---- a/crypto/pcbc.c -+++ b/crypto/pcbc.c -@@ -295,3 +295,4 @@ module_exit(crypto_pcbc_module_exit); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("PCBC block cipher algorithm"); -+MODULE_ALIAS_CRYPTO("pcbc"); -diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c -index 309d345ead95..c305d4112735 100644 ---- a/crypto/pcrypt.c -+++ b/crypto/pcrypt.c -@@ -565,3 +565,4 @@ module_exit(pcrypt_exit); - MODULE_LICENSE("GPL"); - MODULE_AUTHOR("Steffen Klassert "); - MODULE_DESCRIPTION("Parallel crypto wrapper"); -+MODULE_ALIAS_CRYPTO("pcrypt"); -diff --git a/crypto/rmd128.c b/crypto/rmd128.c -index 8a0f68b7f257..049486ede938 100644 ---- a/crypto/rmd128.c -+++ b/crypto/rmd128.c -@@ -327,3 +327,4 @@ module_exit(rmd128_mod_fini); - MODULE_LICENSE("GPL"); - MODULE_AUTHOR("Adrian-Ken Rueegsegger "); - MODULE_DESCRIPTION("RIPEMD-128 Message Digest"); -+MODULE_ALIAS_CRYPTO("rmd128"); -diff --git a/crypto/rmd160.c b/crypto/rmd160.c -index 525d7bb752cf..de585e51d455 100644 ---- a/crypto/rmd160.c -+++ b/crypto/rmd160.c -@@ -371,3 +371,4 @@ module_exit(rmd160_mod_fini); - MODULE_LICENSE("GPL"); - MODULE_AUTHOR("Adrian-Ken Rueegsegger "); - MODULE_DESCRIPTION("RIPEMD-160 Message Digest"); -+MODULE_ALIAS_CRYPTO("rmd160"); -diff --git a/crypto/rmd256.c b/crypto/rmd256.c -index 69293d9b56e0..4ec02a754e09 100644 ---- a/crypto/rmd256.c -+++ b/crypto/rmd256.c -@@ -346,3 +346,4 @@ module_exit(rmd256_mod_fini); - MODULE_LICENSE("GPL"); - MODULE_AUTHOR("Adrian-Ken Rueegsegger "); - MODULE_DESCRIPTION("RIPEMD-256 Message Digest"); -+MODULE_ALIAS_CRYPTO("rmd256"); -diff --git a/crypto/rmd320.c b/crypto/rmd320.c -index 09f97dfdfbba..770f2cb369f8 100644 ---- a/crypto/rmd320.c -+++ b/crypto/rmd320.c -@@ -395,3 +395,4 @@ module_exit(rmd320_mod_fini); - MODULE_LICENSE("GPL"); - MODULE_AUTHOR("Adrian-Ken Rueegsegger "); - MODULE_DESCRIPTION("RIPEMD-320 Message Digest"); -+MODULE_ALIAS_CRYPTO("rmd320"); -diff --git a/crypto/salsa20_generic.c b/crypto/salsa20_generic.c -index 9a4770c02284..f550b5d94630 100644 ---- a/crypto/salsa20_generic.c -+++ b/crypto/salsa20_generic.c -@@ -248,4 +248,5 @@ module_exit(salsa20_generic_mod_fini); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION ("Salsa20 stream cipher algorithm"); --MODULE_ALIAS("salsa20"); -+MODULE_ALIAS_CRYPTO("salsa20"); -+MODULE_ALIAS_CRYPTO("salsa20-generic"); -diff --git a/crypto/seed.c b/crypto/seed.c -index 9c904d6d2151..c6ba8438be43 100644 ---- a/crypto/seed.c -+++ b/crypto/seed.c -@@ -476,3 +476,4 @@ module_exit(seed_fini); - MODULE_DESCRIPTION("SEED Cipher Algorithm"); - MODULE_LICENSE("GPL"); - MODULE_AUTHOR("Hye-Shik Chang , Kim Hyun "); -+MODULE_ALIAS_CRYPTO("seed"); -diff --git a/crypto/seqiv.c b/crypto/seqiv.c -index f2cba4ed6f25..49a4069ff453 100644 ---- a/crypto/seqiv.c -+++ b/crypto/seqiv.c -@@ -362,3 +362,4 @@ module_exit(seqiv_module_exit); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("Sequence Number IV Generator"); -+MODULE_ALIAS_CRYPTO("seqiv"); -diff --git a/crypto/serpent_generic.c b/crypto/serpent_generic.c -index 7ddbd7e88859..94970a794975 100644 ---- a/crypto/serpent_generic.c -+++ b/crypto/serpent_generic.c -@@ -665,5 +665,6 @@ module_exit(serpent_mod_fini); - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("Serpent and tnepres (kerneli compatible serpent reversed) Cipher Algorithm"); - MODULE_AUTHOR("Dag Arne Osvik "); --MODULE_ALIAS("tnepres"); --MODULE_ALIAS("serpent"); -+MODULE_ALIAS_CRYPTO("tnepres"); -+MODULE_ALIAS_CRYPTO("serpent"); -+MODULE_ALIAS_CRYPTO("serpent-generic"); -diff --git a/crypto/sha1_generic.c b/crypto/sha1_generic.c -index 42794803c480..fdf7c00de4b0 100644 ---- a/crypto/sha1_generic.c -+++ b/crypto/sha1_generic.c -@@ -153,4 +153,5 @@ module_exit(sha1_generic_mod_fini); - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("SHA1 Secure Hash Algorithm"); - --MODULE_ALIAS("sha1"); -+MODULE_ALIAS_CRYPTO("sha1"); -+MODULE_ALIAS_CRYPTO("sha1-generic"); -diff --git a/crypto/sha256_generic.c b/crypto/sha256_generic.c -index 543366779524..136381bdd48d 100644 ---- a/crypto/sha256_generic.c -+++ b/crypto/sha256_generic.c -@@ -384,5 +384,7 @@ module_exit(sha256_generic_mod_fini); - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("SHA-224 and SHA-256 Secure Hash Algorithm"); - --MODULE_ALIAS("sha224"); --MODULE_ALIAS("sha256"); -+MODULE_ALIAS_CRYPTO("sha224"); -+MODULE_ALIAS_CRYPTO("sha224-generic"); -+MODULE_ALIAS_CRYPTO("sha256"); -+MODULE_ALIAS_CRYPTO("sha256-generic"); -diff --git a/crypto/sha512_generic.c b/crypto/sha512_generic.c -index 6ed124f3ea0f..6c6d901a7cc1 100644 ---- a/crypto/sha512_generic.c -+++ b/crypto/sha512_generic.c -@@ -287,5 +287,7 @@ module_exit(sha512_generic_mod_fini); - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("SHA-512 and SHA-384 Secure Hash Algorithms"); - --MODULE_ALIAS("sha384"); --MODULE_ALIAS("sha512"); -+MODULE_ALIAS_CRYPTO("sha384"); -+MODULE_ALIAS_CRYPTO("sha384-generic"); -+MODULE_ALIAS_CRYPTO("sha512"); -+MODULE_ALIAS_CRYPTO("sha512-generic"); -diff --git a/crypto/tea.c b/crypto/tea.c -index 0a572323ee4a..b70b441c7d1e 100644 ---- a/crypto/tea.c -+++ b/crypto/tea.c -@@ -270,8 +270,9 @@ static void __exit tea_mod_fini(void) - crypto_unregister_algs(tea_algs, ARRAY_SIZE(tea_algs)); - } - --MODULE_ALIAS("xtea"); --MODULE_ALIAS("xeta"); -+MODULE_ALIAS_CRYPTO("tea"); -+MODULE_ALIAS_CRYPTO("xtea"); -+MODULE_ALIAS_CRYPTO("xeta"); - - module_init(tea_mod_init); - module_exit(tea_mod_fini); -diff --git a/crypto/tgr192.c b/crypto/tgr192.c -index 87403556fd0b..f7ed2fba396c 100644 ---- a/crypto/tgr192.c -+++ b/crypto/tgr192.c -@@ -676,8 +676,9 @@ static void __exit tgr192_mod_fini(void) - crypto_unregister_shashes(tgr_algs, ARRAY_SIZE(tgr_algs)); - } - --MODULE_ALIAS("tgr160"); --MODULE_ALIAS("tgr128"); -+MODULE_ALIAS_CRYPTO("tgr192"); -+MODULE_ALIAS_CRYPTO("tgr160"); -+MODULE_ALIAS_CRYPTO("tgr128"); - - module_init(tgr192_mod_init); - module_exit(tgr192_mod_fini); -diff --git a/crypto/twofish_generic.c b/crypto/twofish_generic.c -index 2d5000552d0f..ebf7a3efb572 100644 ---- a/crypto/twofish_generic.c -+++ b/crypto/twofish_generic.c -@@ -211,4 +211,5 @@ module_exit(twofish_mod_fini); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION ("Twofish Cipher Algorithm"); --MODULE_ALIAS("twofish"); -+MODULE_ALIAS_CRYPTO("twofish"); -+MODULE_ALIAS_CRYPTO("twofish-generic"); -diff --git a/crypto/vmac.c b/crypto/vmac.c -index 2eb11a30c29c..bf2d3a89845f 100644 ---- a/crypto/vmac.c -+++ b/crypto/vmac.c -@@ -713,3 +713,4 @@ module_exit(vmac_module_exit); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("VMAC hash algorithm"); -+MODULE_ALIAS_CRYPTO("vmac"); -diff --git a/crypto/wp512.c b/crypto/wp512.c -index 180f1d6e03f4..253db94b5479 100644 ---- a/crypto/wp512.c -+++ b/crypto/wp512.c -@@ -1167,8 +1167,9 @@ static void __exit wp512_mod_fini(void) - crypto_unregister_shashes(wp_algs, ARRAY_SIZE(wp_algs)); - } - --MODULE_ALIAS("wp384"); --MODULE_ALIAS("wp256"); -+MODULE_ALIAS_CRYPTO("wp512"); -+MODULE_ALIAS_CRYPTO("wp384"); -+MODULE_ALIAS_CRYPTO("wp256"); - - module_init(wp512_mod_init); - module_exit(wp512_mod_fini); -diff --git a/crypto/xcbc.c b/crypto/xcbc.c -index a5fbdf3738cf..df90b332554c 100644 ---- a/crypto/xcbc.c -+++ b/crypto/xcbc.c -@@ -286,3 +286,4 @@ module_exit(crypto_xcbc_module_exit); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("XCBC keyed hash algorithm"); -+MODULE_ALIAS_CRYPTO("xcbc"); -diff --git a/crypto/xts.c b/crypto/xts.c -index ca1608f44cb5..f6fd43f100c8 100644 ---- a/crypto/xts.c -+++ b/crypto/xts.c -@@ -362,3 +362,4 @@ module_exit(crypto_module_exit); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("XTS block cipher mode"); -+MODULE_ALIAS_CRYPTO("xts"); -diff --git a/crypto/zlib.c b/crypto/zlib.c -index 06b62e5cdcc7..d98078835281 100644 ---- a/crypto/zlib.c -+++ b/crypto/zlib.c -@@ -378,3 +378,4 @@ module_exit(zlib_mod_fini); - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("Zlib Compression Algorithm"); - MODULE_AUTHOR("Sony Corporation"); -+MODULE_ALIAS_CRYPTO("zlib"); -diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c -index 37acda6fa7e4..136803c47cdb 100644 ---- a/drivers/ata/libata-sff.c -+++ b/drivers/ata/libata-sff.c -@@ -1333,7 +1333,19 @@ void ata_sff_flush_pio_task(struct ata_port *ap) - DPRINTK("ENTER\n"); - - cancel_delayed_work_sync(&ap->sff_pio_task); -+ -+ /* -+ * We wanna reset the HSM state to IDLE. If we do so without -+ * grabbing the port lock, critical sections protected by it which -+ * expect the HSM state to stay stable may get surprised. For -+ * example, we may set IDLE in between the time -+ * __ata_sff_port_intr() checks for HSM_ST_IDLE and before it calls -+ * ata_sff_hsm_move() causing ata_sff_hsm_move() to BUG(). -+ */ -+ spin_lock_irq(ap->lock); - ap->hsm_task_state = HSM_ST_IDLE; -+ spin_unlock_irq(ap->lock); -+ - ap->sff_pio_task_link = NULL; - - if (ata_msg_ctl(ap)) -diff --git a/drivers/ata/sata_dwc_460ex.c b/drivers/ata/sata_dwc_460ex.c -index 523524b68022..f71e09d6cfe6 100644 ---- a/drivers/ata/sata_dwc_460ex.c -+++ b/drivers/ata/sata_dwc_460ex.c -@@ -799,7 +799,7 @@ static int dma_dwc_init(struct sata_dwc_device *hsdev, int irq) - if (err) { - dev_err(host_pvt.dwc_dev, "%s: dma_request_interrupts returns" - " %d\n", __func__, err); -- goto error_out; -+ return err; - } - - /* Enabe DMA */ -@@ -810,11 +810,6 @@ static int dma_dwc_init(struct sata_dwc_device *hsdev, int irq) - sata_dma_regs); - - return 0; -- --error_out: -- dma_dwc_exit(hsdev); -- -- return err; - } - - static int sata_dwc_scr_read(struct ata_link *link, unsigned int scr, u32 *val) -@@ -1664,7 +1659,7 @@ static int sata_dwc_probe(struct platform_device *ofdev) - char *ver = (char *)&versionr; - u8 *base = NULL; - int err = 0; -- int irq, rc; -+ int irq; - struct ata_host *host; - struct ata_port_info pi = sata_dwc_port_info[0]; - const struct ata_port_info *ppi[] = { &pi, NULL }; -@@ -1727,7 +1722,7 @@ static int sata_dwc_probe(struct platform_device *ofdev) - if (irq == NO_IRQ) { - dev_err(&ofdev->dev, "no SATA DMA irq\n"); - err = -ENODEV; -- goto error_out; -+ goto error_iomap; - } - - /* Get physical SATA DMA register base address */ -@@ -1736,14 +1731,16 @@ static int sata_dwc_probe(struct platform_device *ofdev) - dev_err(&ofdev->dev, "ioremap failed for AHBDMA register" - " address\n"); - err = -ENODEV; -- goto error_out; -+ goto error_iomap; - } - - /* Save dev for later use in dev_xxx() routines */ - host_pvt.dwc_dev = &ofdev->dev; - - /* Initialize AHB DMAC */ -- dma_dwc_init(hsdev, irq); -+ err = dma_dwc_init(hsdev, irq); -+ if (err) -+ goto error_dma_iomap; - - /* Enable SATA Interrupts */ - sata_dwc_enable_interrupts(hsdev); -@@ -1761,9 +1758,8 @@ static int sata_dwc_probe(struct platform_device *ofdev) - * device discovery process, invoking our port_start() handler & - * error_handler() to execute a dummy Softreset EH session - */ -- rc = ata_host_activate(host, irq, sata_dwc_isr, 0, &sata_dwc_sht); -- -- if (rc != 0) -+ err = ata_host_activate(host, irq, sata_dwc_isr, 0, &sata_dwc_sht); -+ if (err) - dev_err(&ofdev->dev, "failed to activate host"); - - dev_set_drvdata(&ofdev->dev, host); -@@ -1772,7 +1768,8 @@ static int sata_dwc_probe(struct platform_device *ofdev) - error_out: - /* Free SATA DMA resources */ - dma_dwc_exit(hsdev); -- -+error_dma_iomap: -+ iounmap((void __iomem *)host_pvt.sata_dma_regs); - error_iomap: - iounmap(base); - error_kmalloc: -@@ -1793,6 +1790,7 @@ static int sata_dwc_remove(struct platform_device *ofdev) - /* Free SATA DMA resources */ - dma_dwc_exit(hsdev); - -+ iounmap((void __iomem *)host_pvt.sata_dma_regs); - iounmap(hsdev->reg_base); - kfree(hsdev); - kfree(host); -diff --git a/drivers/block/drbd/drbd_req.c b/drivers/block/drbd/drbd_req.c -index 104a040f24de..6efdbeafa33c 100644 ---- a/drivers/block/drbd/drbd_req.c -+++ b/drivers/block/drbd/drbd_req.c -@@ -1310,6 +1310,7 @@ int drbd_merge_bvec(struct request_queue *q, struct bvec_merge_data *bvm, struct - struct request_queue * const b = - mdev->ldev->backing_bdev->bd_disk->queue; - if (b->merge_bvec_fn) { -+ bvm->bi_bdev = mdev->ldev->backing_bdev; - backing_limit = b->merge_bvec_fn(b, bvm, bvec); - limit = min(limit, backing_limit); - } -diff --git a/drivers/bus/mvebu-mbus.c b/drivers/bus/mvebu-mbus.c -index 372ae72cce34..e990deed2d33 100644 ---- a/drivers/bus/mvebu-mbus.c -+++ b/drivers/bus/mvebu-mbus.c -@@ -181,12 +181,25 @@ static void mvebu_mbus_disable_window(struct mvebu_mbus_state *mbus, - } - - /* Checks whether the given window number is available */ -+ -+/* On Armada XP, 375 and 38x the MBus window 13 has the remap -+ * capability, like windows 0 to 7. However, the mvebu-mbus driver -+ * isn't currently taking into account this special case, which means -+ * that when window 13 is actually used, the remap registers are left -+ * to 0, making the device using this MBus window unavailable. The -+ * quick fix for stable is to not use window 13. A follow up patch -+ * will correctly handle this window. -+*/ - static int mvebu_mbus_window_is_free(struct mvebu_mbus_state *mbus, - const int win) - { - void __iomem *addr = mbus->mbuswins_base + - mbus->soc->win_cfg_offset(win); - u32 ctrl = readl(addr + WIN_CTRL_OFF); -+ -+ if (win == 13) -+ return false; -+ - return !(ctrl & WIN_CTRL_ENABLE); - } - -diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c -index e252939b9ee1..831b48287a22 100644 ---- a/drivers/clocksource/exynos_mct.c -+++ b/drivers/clocksource/exynos_mct.c -@@ -98,8 +98,8 @@ static void exynos4_mct_write(unsigned int value, unsigned long offset) - __raw_writel(value, reg_base + offset); - - if (likely(offset >= EXYNOS4_MCT_L_BASE(0))) { -- stat_addr = (offset & ~EXYNOS4_MCT_L_MASK) + MCT_L_WSTAT_OFFSET; -- switch (offset & EXYNOS4_MCT_L_MASK) { -+ stat_addr = (offset & EXYNOS4_MCT_L_MASK) + MCT_L_WSTAT_OFFSET; -+ switch (offset & ~EXYNOS4_MCT_L_MASK) { - case MCT_L_TCON_OFFSET: - mask = 1 << 3; /* L_TCON write status */ - break; -diff --git a/drivers/crypto/padlock-aes.c b/drivers/crypto/padlock-aes.c -index 633ba945e153..c178ed8c3908 100644 ---- a/drivers/crypto/padlock-aes.c -+++ b/drivers/crypto/padlock-aes.c -@@ -563,4 +563,4 @@ MODULE_DESCRIPTION("VIA PadLock AES algorithm support"); - MODULE_LICENSE("GPL"); - MODULE_AUTHOR("Michal Ludvig"); - --MODULE_ALIAS("aes"); -+MODULE_ALIAS_CRYPTO("aes"); -diff --git a/drivers/crypto/padlock-sha.c b/drivers/crypto/padlock-sha.c -index 9266c0e25492..93d7753ab38a 100644 ---- a/drivers/crypto/padlock-sha.c -+++ b/drivers/crypto/padlock-sha.c -@@ -593,7 +593,7 @@ MODULE_DESCRIPTION("VIA PadLock SHA1/SHA256 algorithms support."); - MODULE_LICENSE("GPL"); - MODULE_AUTHOR("Michal Ludvig"); - --MODULE_ALIAS("sha1-all"); --MODULE_ALIAS("sha256-all"); --MODULE_ALIAS("sha1-padlock"); --MODULE_ALIAS("sha256-padlock"); -+MODULE_ALIAS_CRYPTO("sha1-all"); -+MODULE_ALIAS_CRYPTO("sha256-all"); -+MODULE_ALIAS_CRYPTO("sha1-padlock"); -+MODULE_ALIAS_CRYPTO("sha256-padlock"); -diff --git a/drivers/crypto/ux500/cryp/cryp_core.c b/drivers/crypto/ux500/cryp/cryp_core.c -index 92105f3dc8e0..e4cea7c45142 100644 ---- a/drivers/crypto/ux500/cryp/cryp_core.c -+++ b/drivers/crypto/ux500/cryp/cryp_core.c -@@ -1810,7 +1810,7 @@ module_exit(ux500_cryp_mod_fini); - module_param(cryp_mode, int, 0); - - MODULE_DESCRIPTION("Driver for ST-Ericsson UX500 CRYP crypto engine."); --MODULE_ALIAS("aes-all"); --MODULE_ALIAS("des-all"); -+MODULE_ALIAS_CRYPTO("aes-all"); -+MODULE_ALIAS_CRYPTO("des-all"); - - MODULE_LICENSE("GPL"); -diff --git a/drivers/crypto/ux500/hash/hash_core.c b/drivers/crypto/ux500/hash/hash_core.c -index 1c73f4fbc252..8e5e0187506f 100644 ---- a/drivers/crypto/ux500/hash/hash_core.c -+++ b/drivers/crypto/ux500/hash/hash_core.c -@@ -1995,7 +1995,7 @@ module_exit(ux500_hash_mod_fini); - MODULE_DESCRIPTION("Driver for ST-Ericsson UX500 HASH engine."); - MODULE_LICENSE("GPL"); - --MODULE_ALIAS("sha1-all"); --MODULE_ALIAS("sha256-all"); --MODULE_ALIAS("hmac-sha1-all"); --MODULE_ALIAS("hmac-sha256-all"); -+MODULE_ALIAS_CRYPTO("sha1-all"); -+MODULE_ALIAS_CRYPTO("sha256-all"); -+MODULE_ALIAS_CRYPTO("hmac-sha1-all"); -+MODULE_ALIAS_CRYPTO("hmac-sha256-all"); -diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c -index 5b88c83888d1..ccbffd0d7a02 100644 ---- a/drivers/gpio/gpiolib.c -+++ b/drivers/gpio/gpiolib.c -@@ -408,7 +408,7 @@ static ssize_t gpio_value_store(struct device *dev, - return status; - } - --static const DEVICE_ATTR(value, 0644, -+static DEVICE_ATTR(value, 0644, - gpio_value_show, gpio_value_store); - - static irqreturn_t gpio_sysfs_irq(int irq, void *priv) -@@ -633,18 +633,16 @@ static ssize_t gpio_active_low_store(struct device *dev, - return status ? : size; - } - --static const DEVICE_ATTR(active_low, 0644, -+static DEVICE_ATTR(active_low, 0644, - gpio_active_low_show, gpio_active_low_store); - --static const struct attribute *gpio_attrs[] = { -+static struct attribute *gpio_attrs[] = { - &dev_attr_value.attr, - &dev_attr_active_low.attr, - NULL, - }; - --static const struct attribute_group gpio_attr_group = { -- .attrs = (struct attribute **) gpio_attrs, --}; -+ATTRIBUTE_GROUPS(gpio); - - /* - * /sys/class/gpio/gpiochipN/ -@@ -680,16 +678,13 @@ static ssize_t chip_ngpio_show(struct device *dev, - } - static DEVICE_ATTR(ngpio, 0444, chip_ngpio_show, NULL); - --static const struct attribute *gpiochip_attrs[] = { -+static struct attribute *gpiochip_attrs[] = { - &dev_attr_base.attr, - &dev_attr_label.attr, - &dev_attr_ngpio.attr, - NULL, - }; -- --static const struct attribute_group gpiochip_attr_group = { -- .attrs = (struct attribute **) gpiochip_attrs, --}; -+ATTRIBUTE_GROUPS(gpiochip); - - /* - * /sys/class/gpio/export ... write-only -@@ -844,18 +839,15 @@ int gpiod_export(struct gpio_desc *desc, bool direction_may_change) - if (desc->chip->names && desc->chip->names[offset]) - ioname = desc->chip->names[offset]; - -- dev = device_create(&gpio_class, desc->chip->dev, MKDEV(0, 0), -- desc, ioname ? ioname : "gpio%u", -- desc_to_gpio(desc)); -+ dev = device_create_with_groups(&gpio_class, desc->chip->dev, -+ MKDEV(0, 0), desc, gpio_groups, -+ ioname ? ioname : "gpio%u", -+ desc_to_gpio(desc)); - if (IS_ERR(dev)) { - status = PTR_ERR(dev); - goto fail_unlock; - } - -- status = sysfs_create_group(&dev->kobj, &gpio_attr_group); -- if (status) -- goto fail_unregister_device; -- - if (direction_may_change) { - status = device_create_file(dev, &dev_attr_direction); - if (status) -@@ -866,13 +858,15 @@ int gpiod_export(struct gpio_desc *desc, bool direction_may_change) - !test_bit(FLAG_IS_OUT, &desc->flags))) { - status = device_create_file(dev, &dev_attr_edge); - if (status) -- goto fail_unregister_device; -+ goto fail_remove_attr_direction; - } - - set_bit(FLAG_EXPORT, &desc->flags); - mutex_unlock(&sysfs_lock); - return 0; - -+fail_remove_attr_direction: -+ device_remove_file(dev, &dev_attr_direction); - fail_unregister_device: - device_unregister(dev); - fail_unlock: -@@ -1006,6 +1000,8 @@ void gpiod_unexport(struct gpio_desc *desc) - mutex_unlock(&sysfs_lock); - - if (dev) { -+ device_remove_file(dev, &dev_attr_edge); -+ device_remove_file(dev, &dev_attr_direction); - device_unregister(dev); - put_device(dev); - } -@@ -1030,13 +1026,13 @@ static int gpiochip_export(struct gpio_chip *chip) - - /* use chip->base for the ID; it's already known to be unique */ - mutex_lock(&sysfs_lock); -- dev = device_create(&gpio_class, chip->dev, MKDEV(0, 0), chip, -- "gpiochip%d", chip->base); -- if (!IS_ERR(dev)) { -- status = sysfs_create_group(&dev->kobj, -- &gpiochip_attr_group); -- } else -+ dev = device_create_with_groups(&gpio_class, chip->dev, MKDEV(0, 0), -+ chip, gpiochip_groups, -+ "gpiochip%d", chip->base); -+ if (IS_ERR(dev)) - status = PTR_ERR(dev); -+ else -+ status = 0; - chip->exported = (status == 0); - mutex_unlock(&sysfs_lock); - -diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c -index 7410a507eacc..3153eabde39b 100644 ---- a/drivers/gpu/drm/i915/i915_gem.c -+++ b/drivers/gpu/drm/i915/i915_gem.c -@@ -4978,7 +4978,7 @@ static bool mutex_is_locked_by(struct mutex *mutex, struct task_struct *task) - if (!mutex_is_locked(mutex)) - return false; - --#if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_MUTEXES) -+#if defined(CONFIG_SMP) && !defined(CONFIG_DEBUG_MUTEXES) - return mutex->owner == task; - #else - /* Since UP may be pre-empted, we cannot assume that we own the lock */ -diff --git a/drivers/gpu/drm/radeon/radeon_asic.c b/drivers/gpu/drm/radeon/radeon_asic.c -index 5600d4c5f981..64d6cfba9952 100644 ---- a/drivers/gpu/drm/radeon/radeon_asic.c -+++ b/drivers/gpu/drm/radeon/radeon_asic.c -@@ -335,6 +335,20 @@ static struct radeon_asic_ring r300_gfx_ring = { - .set_wptr = &r100_gfx_set_wptr, - }; - -+static struct radeon_asic_ring rv515_gfx_ring = { -+ .ib_execute = &r100_ring_ib_execute, -+ .emit_fence = &r300_fence_ring_emit, -+ .emit_semaphore = &r100_semaphore_ring_emit, -+ .cs_parse = &r300_cs_parse, -+ .ring_start = &rv515_ring_start, -+ .ring_test = &r100_ring_test, -+ .ib_test = &r100_ib_test, -+ .is_lockup = &r100_gpu_is_lockup, -+ .get_rptr = &r100_gfx_get_rptr, -+ .get_wptr = &r100_gfx_get_wptr, -+ .set_wptr = &r100_gfx_set_wptr, -+}; -+ - static struct radeon_asic r300_asic = { - .init = &r300_init, - .fini = &r300_fini, -@@ -756,7 +770,7 @@ static struct radeon_asic rv515_asic = { - .set_page = &rv370_pcie_gart_set_page, - }, - .ring = { -- [RADEON_RING_TYPE_GFX_INDEX] = &r300_gfx_ring -+ [RADEON_RING_TYPE_GFX_INDEX] = &rv515_gfx_ring - }, - .irq = { - .set = &rs600_irq_set, -@@ -823,7 +837,7 @@ static struct radeon_asic r520_asic = { - .set_page = &rv370_pcie_gart_set_page, - }, - .ring = { -- [RADEON_RING_TYPE_GFX_INDEX] = &r300_gfx_ring -+ [RADEON_RING_TYPE_GFX_INDEX] = &rv515_gfx_ring - }, - .irq = { - .set = &rs600_irq_set, -diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c -index cfb513f933d5..0095ee7fce34 100644 ---- a/drivers/gpu/drm/radeon/radeon_pm.c -+++ b/drivers/gpu/drm/radeon/radeon_pm.c -@@ -1260,8 +1260,39 @@ dpm_failed: - return ret; - } - -+struct radeon_dpm_quirk { -+ u32 chip_vendor; -+ u32 chip_device; -+ u32 subsys_vendor; -+ u32 subsys_device; -+}; -+ -+/* cards with dpm stability problems */ -+static struct radeon_dpm_quirk radeon_dpm_quirk_list[] = { -+ /* TURKS - https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1386534 */ -+ { PCI_VENDOR_ID_ATI, 0x6759, 0x1682, 0x3195 }, -+ /* TURKS - https://bugzilla.kernel.org/show_bug.cgi?id=83731 */ -+ { PCI_VENDOR_ID_ATI, 0x6840, 0x1179, 0xfb81 }, -+ { 0, 0, 0, 0 }, -+}; -+ - int radeon_pm_init(struct radeon_device *rdev) - { -+ struct radeon_dpm_quirk *p = radeon_dpm_quirk_list; -+ bool disable_dpm = false; -+ -+ /* Apply dpm quirks */ -+ while (p && p->chip_device != 0) { -+ if (rdev->pdev->vendor == p->chip_vendor && -+ rdev->pdev->device == p->chip_device && -+ rdev->pdev->subsystem_vendor == p->subsys_vendor && -+ rdev->pdev->subsystem_device == p->subsys_device) { -+ disable_dpm = true; -+ break; -+ } -+ ++p; -+ } -+ - /* enable dpm on rv6xx+ */ - switch (rdev->family) { - case CHIP_RV610: -@@ -1316,6 +1347,8 @@ int radeon_pm_init(struct radeon_device *rdev) - (!(rdev->flags & RADEON_IS_IGP)) && - (!rdev->smc_fw)) - rdev->pm.pm_method = PM_METHOD_PROFILE; -+ else if (disable_dpm && (radeon_dpm == -1)) -+ rdev->pm.pm_method = PM_METHOD_PROFILE; - else if (radeon_dpm == 0) - rdev->pm.pm_method = PM_METHOD_PROFILE; - else -diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c -index 879e62844b2b..35bf2bba69bf 100644 ---- a/drivers/gpu/drm/radeon/si_dpm.c -+++ b/drivers/gpu/drm/radeon/si_dpm.c -@@ -2900,6 +2900,22 @@ static int si_init_smc_spll_table(struct radeon_device *rdev) - return ret; - } - -+struct si_dpm_quirk { -+ u32 chip_vendor; -+ u32 chip_device; -+ u32 subsys_vendor; -+ u32 subsys_device; -+ u32 max_sclk; -+ u32 max_mclk; -+}; -+ -+/* cards with dpm stability problems */ -+static struct si_dpm_quirk si_dpm_quirk_list[] = { -+ /* PITCAIRN - https://bugs.freedesktop.org/show_bug.cgi?id=76490 */ -+ { PCI_VENDOR_ID_ATI, 0x6810, 0x1462, 0x3036, 0, 120000 }, -+ { 0, 0, 0, 0 }, -+}; -+ - static void si_apply_state_adjust_rules(struct radeon_device *rdev, - struct radeon_ps *rps) - { -@@ -2910,7 +2926,22 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev, - u32 mclk, sclk; - u16 vddc, vddci; - u32 max_sclk_vddc, max_mclk_vddci, max_mclk_vddc; -+ u32 max_sclk = 0, max_mclk = 0; - int i; -+ struct si_dpm_quirk *p = si_dpm_quirk_list; -+ -+ /* Apply dpm quirks */ -+ while (p && p->chip_device != 0) { -+ if (rdev->pdev->vendor == p->chip_vendor && -+ rdev->pdev->device == p->chip_device && -+ rdev->pdev->subsystem_vendor == p->subsys_vendor && -+ rdev->pdev->subsystem_device == p->subsys_device) { -+ max_sclk = p->max_sclk; -+ max_mclk = p->max_mclk; -+ break; -+ } -+ ++p; -+ } - - if ((rdev->pm.dpm.new_active_crtc_count > 1) || - ni_dpm_vblank_too_short(rdev)) -@@ -2964,6 +2995,14 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev, - if (ps->performance_levels[i].mclk > max_mclk_vddc) - ps->performance_levels[i].mclk = max_mclk_vddc; - } -+ if (max_mclk) { -+ if (ps->performance_levels[i].mclk > max_mclk) -+ ps->performance_levels[i].mclk = max_mclk; -+ } -+ if (max_sclk) { -+ if (ps->performance_levels[i].sclk > max_sclk) -+ ps->performance_levels[i].sclk = max_sclk; -+ } - } - - /* XXX validate the min clocks required for display */ -diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c -index a87d3fab0271..d290e8396116 100644 ---- a/drivers/md/dm-cache-metadata.c -+++ b/drivers/md/dm-cache-metadata.c -@@ -94,6 +94,9 @@ struct cache_disk_superblock { - } __packed; - - struct dm_cache_metadata { -+ atomic_t ref_count; -+ struct list_head list; -+ - struct block_device *bdev; - struct dm_block_manager *bm; - struct dm_space_map *metadata_sm; -@@ -669,10 +672,10 @@ static void unpack_value(__le64 value_le, dm_oblock_t *block, unsigned *flags) - - /*----------------------------------------------------------------*/ - --struct dm_cache_metadata *dm_cache_metadata_open(struct block_device *bdev, -- sector_t data_block_size, -- bool may_format_device, -- size_t policy_hint_size) -+static struct dm_cache_metadata *metadata_open(struct block_device *bdev, -+ sector_t data_block_size, -+ bool may_format_device, -+ size_t policy_hint_size) - { - int r; - struct dm_cache_metadata *cmd; -@@ -683,6 +686,7 @@ struct dm_cache_metadata *dm_cache_metadata_open(struct block_device *bdev, - return NULL; - } - -+ atomic_set(&cmd->ref_count, 1); - init_rwsem(&cmd->root_lock); - cmd->bdev = bdev; - cmd->data_block_size = data_block_size; -@@ -705,10 +709,95 @@ struct dm_cache_metadata *dm_cache_metadata_open(struct block_device *bdev, - return cmd; - } - -+/* -+ * We keep a little list of ref counted metadata objects to prevent two -+ * different target instances creating separate bufio instances. This is -+ * an issue if a table is reloaded before the suspend. -+ */ -+static DEFINE_MUTEX(table_lock); -+static LIST_HEAD(table); -+ -+static struct dm_cache_metadata *lookup(struct block_device *bdev) -+{ -+ struct dm_cache_metadata *cmd; -+ -+ list_for_each_entry(cmd, &table, list) -+ if (cmd->bdev == bdev) { -+ atomic_inc(&cmd->ref_count); -+ return cmd; -+ } -+ -+ return NULL; -+} -+ -+static struct dm_cache_metadata *lookup_or_open(struct block_device *bdev, -+ sector_t data_block_size, -+ bool may_format_device, -+ size_t policy_hint_size) -+{ -+ struct dm_cache_metadata *cmd, *cmd2; -+ -+ mutex_lock(&table_lock); -+ cmd = lookup(bdev); -+ mutex_unlock(&table_lock); -+ -+ if (cmd) -+ return cmd; -+ -+ cmd = metadata_open(bdev, data_block_size, may_format_device, policy_hint_size); -+ if (cmd) { -+ mutex_lock(&table_lock); -+ cmd2 = lookup(bdev); -+ if (cmd2) { -+ mutex_unlock(&table_lock); -+ __destroy_persistent_data_objects(cmd); -+ kfree(cmd); -+ return cmd2; -+ } -+ list_add(&cmd->list, &table); -+ mutex_unlock(&table_lock); -+ } -+ -+ return cmd; -+} -+ -+static bool same_params(struct dm_cache_metadata *cmd, sector_t data_block_size) -+{ -+ if (cmd->data_block_size != data_block_size) { -+ DMERR("data_block_size (%llu) different from that in metadata (%llu)\n", -+ (unsigned long long) data_block_size, -+ (unsigned long long) cmd->data_block_size); -+ return false; -+ } -+ -+ return true; -+} -+ -+struct dm_cache_metadata *dm_cache_metadata_open(struct block_device *bdev, -+ sector_t data_block_size, -+ bool may_format_device, -+ size_t policy_hint_size) -+{ -+ struct dm_cache_metadata *cmd = lookup_or_open(bdev, data_block_size, -+ may_format_device, policy_hint_size); -+ if (cmd && !same_params(cmd, data_block_size)) { -+ dm_cache_metadata_close(cmd); -+ return NULL; -+ } -+ -+ return cmd; -+} -+ - void dm_cache_metadata_close(struct dm_cache_metadata *cmd) - { -- __destroy_persistent_data_objects(cmd); -- kfree(cmd); -+ if (atomic_dec_and_test(&cmd->ref_count)) { -+ mutex_lock(&table_lock); -+ list_del(&cmd->list); -+ mutex_unlock(&table_lock); -+ -+ __destroy_persistent_data_objects(cmd); -+ kfree(cmd); -+ } - } - - /* -diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c -index ff284b7a17bd..c10dec0f6e9d 100644 ---- a/drivers/md/dm-cache-target.c -+++ b/drivers/md/dm-cache-target.c -@@ -222,7 +222,13 @@ struct cache { - struct list_head need_commit_migrations; - sector_t migration_threshold; - wait_queue_head_t migration_wait; -- atomic_t nr_migrations; -+ atomic_t nr_allocated_migrations; -+ -+ /* -+ * The number of in flight migrations that are performing -+ * background io. eg, promotion, writeback. -+ */ -+ atomic_t nr_io_migrations; - - wait_queue_head_t quiescing_wait; - atomic_t quiescing; -@@ -259,7 +265,6 @@ struct cache { - struct dm_deferred_set *all_io_ds; - - mempool_t *migration_pool; -- struct dm_cache_migration *next_migration; - - struct dm_cache_policy *policy; - unsigned policy_nr_args; -@@ -350,10 +355,31 @@ static void free_prison_cell(struct cache *cache, struct dm_bio_prison_cell *cel - dm_bio_prison_free_cell(cache->prison, cell); - } - -+static struct dm_cache_migration *alloc_migration(struct cache *cache) -+{ -+ struct dm_cache_migration *mg; -+ -+ mg = mempool_alloc(cache->migration_pool, GFP_NOWAIT); -+ if (mg) { -+ mg->cache = cache; -+ atomic_inc(&mg->cache->nr_allocated_migrations); -+ } -+ -+ return mg; -+} -+ -+static void free_migration(struct dm_cache_migration *mg) -+{ -+ if (atomic_dec_and_test(&mg->cache->nr_allocated_migrations)) -+ wake_up(&mg->cache->migration_wait); -+ -+ mempool_free(mg, mg->cache->migration_pool); -+} -+ - static int prealloc_data_structs(struct cache *cache, struct prealloc *p) - { - if (!p->mg) { -- p->mg = mempool_alloc(cache->migration_pool, GFP_NOWAIT); -+ p->mg = alloc_migration(cache); - if (!p->mg) - return -ENOMEM; - } -@@ -382,7 +408,7 @@ static void prealloc_free_structs(struct cache *cache, struct prealloc *p) - free_prison_cell(cache, p->cell1); - - if (p->mg) -- mempool_free(p->mg, cache->migration_pool); -+ free_migration(p->mg); - } - - static struct dm_cache_migration *prealloc_get_migration(struct prealloc *p) -@@ -812,24 +838,14 @@ static void remap_to_origin_then_cache(struct cache *cache, struct bio *bio, - * Migration covers moving data from the origin device to the cache, or - * vice versa. - *--------------------------------------------------------------*/ --static void free_migration(struct dm_cache_migration *mg) --{ -- mempool_free(mg, mg->cache->migration_pool); --} -- --static void inc_nr_migrations(struct cache *cache) -+static void inc_io_migrations(struct cache *cache) - { -- atomic_inc(&cache->nr_migrations); -+ atomic_inc(&cache->nr_io_migrations); - } - --static void dec_nr_migrations(struct cache *cache) -+static void dec_io_migrations(struct cache *cache) - { -- atomic_dec(&cache->nr_migrations); -- -- /* -- * Wake the worker in case we're suspending the target. -- */ -- wake_up(&cache->migration_wait); -+ atomic_dec(&cache->nr_io_migrations); - } - - static void __cell_defer(struct cache *cache, struct dm_bio_prison_cell *cell, -@@ -852,11 +868,10 @@ static void cell_defer(struct cache *cache, struct dm_bio_prison_cell *cell, - wake_worker(cache); - } - --static void cleanup_migration(struct dm_cache_migration *mg) -+static void free_io_migration(struct dm_cache_migration *mg) - { -- struct cache *cache = mg->cache; -+ dec_io_migrations(mg->cache); - free_migration(mg); -- dec_nr_migrations(cache); - } - - static void migration_failure(struct dm_cache_migration *mg) -@@ -881,7 +896,7 @@ static void migration_failure(struct dm_cache_migration *mg) - cell_defer(cache, mg->new_ocell, true); - } - -- cleanup_migration(mg); -+ free_io_migration(mg); - } - - static void migration_success_pre_commit(struct dm_cache_migration *mg) -@@ -892,7 +907,7 @@ static void migration_success_pre_commit(struct dm_cache_migration *mg) - if (mg->writeback) { - clear_dirty(cache, mg->old_oblock, mg->cblock); - cell_defer(cache, mg->old_ocell, false); -- cleanup_migration(mg); -+ free_io_migration(mg); - return; - - } else if (mg->demote) { -@@ -902,14 +917,14 @@ static void migration_success_pre_commit(struct dm_cache_migration *mg) - mg->old_oblock); - if (mg->promote) - cell_defer(cache, mg->new_ocell, true); -- cleanup_migration(mg); -+ free_io_migration(mg); - return; - } - } else { - if (dm_cache_insert_mapping(cache->cmd, mg->cblock, mg->new_oblock)) { - DMWARN_LIMIT("promotion failed; couldn't update on disk metadata"); - policy_remove_mapping(cache->policy, mg->new_oblock); -- cleanup_migration(mg); -+ free_io_migration(mg); - return; - } - } -@@ -942,7 +957,7 @@ static void migration_success_post_commit(struct dm_cache_migration *mg) - } else { - if (mg->invalidate) - policy_remove_mapping(cache->policy, mg->old_oblock); -- cleanup_migration(mg); -+ free_io_migration(mg); - } - - } else { -@@ -957,7 +972,7 @@ static void migration_success_post_commit(struct dm_cache_migration *mg) - bio_endio(mg->new_ocell->holder, 0); - cell_defer(cache, mg->new_ocell, false); - } -- cleanup_migration(mg); -+ free_io_migration(mg); - } - } - -@@ -1169,7 +1184,7 @@ static void promote(struct cache *cache, struct prealloc *structs, - mg->new_ocell = cell; - mg->start_jiffies = jiffies; - -- inc_nr_migrations(cache); -+ inc_io_migrations(cache); - quiesce_migration(mg); - } - -@@ -1192,7 +1207,7 @@ static void writeback(struct cache *cache, struct prealloc *structs, - mg->new_ocell = NULL; - mg->start_jiffies = jiffies; - -- inc_nr_migrations(cache); -+ inc_io_migrations(cache); - quiesce_migration(mg); - } - -@@ -1218,7 +1233,7 @@ static void demote_then_promote(struct cache *cache, struct prealloc *structs, - mg->new_ocell = new_ocell; - mg->start_jiffies = jiffies; - -- inc_nr_migrations(cache); -+ inc_io_migrations(cache); - quiesce_migration(mg); - } - -@@ -1245,7 +1260,7 @@ static void invalidate(struct cache *cache, struct prealloc *structs, - mg->new_ocell = NULL; - mg->start_jiffies = jiffies; - -- inc_nr_migrations(cache); -+ inc_io_migrations(cache); - quiesce_migration(mg); - } - -@@ -1306,7 +1321,7 @@ static void process_discard_bio(struct cache *cache, struct bio *bio) - - static bool spare_migration_bandwidth(struct cache *cache) - { -- sector_t current_volume = (atomic_read(&cache->nr_migrations) + 1) * -+ sector_t current_volume = (atomic_read(&cache->nr_io_migrations) + 1) * - cache->sectors_per_block; - return current_volume < cache->migration_threshold; - } -@@ -1661,7 +1676,7 @@ static void stop_quiescing(struct cache *cache) - - static void wait_for_migrations(struct cache *cache) - { -- wait_event(cache->migration_wait, !atomic_read(&cache->nr_migrations)); -+ wait_event(cache->migration_wait, !atomic_read(&cache->nr_allocated_migrations)); - } - - static void stop_worker(struct cache *cache) -@@ -1772,9 +1787,6 @@ static void destroy(struct cache *cache) - { - unsigned i; - -- if (cache->next_migration) -- mempool_free(cache->next_migration, cache->migration_pool); -- - if (cache->migration_pool) - mempool_destroy(cache->migration_pool); - -@@ -2282,7 +2294,8 @@ static int cache_create(struct cache_args *ca, struct cache **result) - INIT_LIST_HEAD(&cache->quiesced_migrations); - INIT_LIST_HEAD(&cache->completed_migrations); - INIT_LIST_HEAD(&cache->need_commit_migrations); -- atomic_set(&cache->nr_migrations, 0); -+ atomic_set(&cache->nr_allocated_migrations, 0); -+ atomic_set(&cache->nr_io_migrations, 0); - init_waitqueue_head(&cache->migration_wait); - - init_waitqueue_head(&cache->quiescing_wait); -@@ -2342,8 +2355,6 @@ static int cache_create(struct cache_args *ca, struct cache **result) - goto bad; - } - -- cache->next_migration = NULL; -- - cache->need_tick_bio = true; - cache->sized = false; - cache->invalidate = false; -diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c -index 4913c0690872..175584ad643f 100644 ---- a/drivers/md/raid5.c -+++ b/drivers/md/raid5.c -@@ -2896,7 +2896,8 @@ static int fetch_block(struct stripe_head *sh, struct stripe_head_state *s, - (s->failed >= 2 && fdev[1]->toread) || - (sh->raid_conf->level <= 5 && s->failed && fdev[0]->towrite && - !test_bit(R5_OVERWRITE, &fdev[0]->flags)) || -- (sh->raid_conf->level == 6 && s->failed && s->to_write))) { -+ ((sh->raid_conf->level == 6 || sh->sector >= sh->raid_conf->mddev->recovery_cp) -+ && s->failed && s->to_write))) { - /* we would like to get this block, possibly by computing it, - * otherwise read it if the backing disk is insync - */ -diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c -index 7e0176321aff..881bf89acfcc 100644 ---- a/drivers/mmc/host/sdhci.c -+++ b/drivers/mmc/host/sdhci.c -@@ -2537,7 +2537,7 @@ out: - /* - * We have to delay this as it calls back into the driver. - */ -- if (cardint) -+ if (cardint && host->mmc->sdio_irqs) - mmc_signal_sdio_irq(host->mmc); - - return result; -diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c -index cc11f7f5e91d..1468c4658804 100644 ---- a/drivers/net/can/dev.c -+++ b/drivers/net/can/dev.c -@@ -664,10 +664,14 @@ static int can_changelink(struct net_device *dev, - if (dev->flags & IFF_UP) - return -EBUSY; - cm = nla_data(data[IFLA_CAN_CTRLMODE]); -- if (cm->flags & ~priv->ctrlmode_supported) -+ -+ /* check whether changed bits are allowed to be modified */ -+ if (cm->mask & ~priv->ctrlmode_supported) - return -EOPNOTSUPP; -+ -+ /* clear bits to be modified and copy the flag values */ - priv->ctrlmode &= ~cm->mask; -- priv->ctrlmode |= cm->flags; -+ priv->ctrlmode |= (cm->flags & cm->mask); - } - - if (data[IFLA_CAN_RESTART_MS]) { -diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c -index dae70d216762..78c65d327e33 100644 ---- a/drivers/pci/pci.c -+++ b/drivers/pci/pci.c -@@ -3187,7 +3187,8 @@ static int pci_parent_bus_reset(struct pci_dev *dev, int probe) - { - struct pci_dev *pdev; - -- if (pci_is_root_bus(dev->bus) || dev->subordinate || !dev->bus->self) -+ if (pci_is_root_bus(dev->bus) || dev->subordinate || -+ !dev->bus->self || dev->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET) - return -ENOTTY; - - list_for_each_entry(pdev, &dev->bus->devices, bus_list) -@@ -3221,7 +3222,8 @@ static int pci_dev_reset_slot_function(struct pci_dev *dev, int probe) - { - struct pci_dev *pdev; - -- if (dev->subordinate || !dev->slot) -+ if (dev->subordinate || !dev->slot || -+ dev->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET) - return -ENOTTY; - - list_for_each_entry(pdev, &dev->bus->devices, bus_list) -@@ -3452,6 +3454,20 @@ int pci_try_reset_function(struct pci_dev *dev) - } - EXPORT_SYMBOL_GPL(pci_try_reset_function); - -+/* Do any devices on or below this bus prevent a bus reset? */ -+static bool pci_bus_resetable(struct pci_bus *bus) -+{ -+ struct pci_dev *dev; -+ -+ list_for_each_entry(dev, &bus->devices, bus_list) { -+ if (dev->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET || -+ (dev->subordinate && !pci_bus_resetable(dev->subordinate))) -+ return false; -+ } -+ -+ return true; -+} -+ - /* Lock devices from the top of the tree down */ - static void pci_bus_lock(struct pci_bus *bus) - { -@@ -3502,6 +3518,22 @@ unlock: - return 0; - } - -+/* Do any devices on or below this slot prevent a bus reset? */ -+static bool pci_slot_resetable(struct pci_slot *slot) -+{ -+ struct pci_dev *dev; -+ -+ list_for_each_entry(dev, &slot->bus->devices, bus_list) { -+ if (!dev->slot || dev->slot != slot) -+ continue; -+ if (dev->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET || -+ (dev->subordinate && !pci_bus_resetable(dev->subordinate))) -+ return false; -+ } -+ -+ return true; -+} -+ - /* Lock devices from the top of the tree down */ - static void pci_slot_lock(struct pci_slot *slot) - { -@@ -3623,7 +3655,7 @@ static int pci_slot_reset(struct pci_slot *slot, int probe) - { - int rc; - -- if (!slot) -+ if (!slot || !pci_slot_resetable(slot)) - return -ENOTTY; - - if (!probe) -@@ -3715,7 +3747,7 @@ EXPORT_SYMBOL_GPL(pci_try_reset_slot); - - static int pci_bus_reset(struct pci_bus *bus, int probe) - { -- if (!bus->self) -+ if (!bus->self || !pci_bus_resetable(bus)) - return -ENOTTY; - - if (probe) -diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c -index 6e8776b59a2c..27abeb40dfab 100644 ---- a/drivers/pci/quirks.c -+++ b/drivers/pci/quirks.c -@@ -3008,6 +3008,20 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_CHELSIO, 0x0030, - DECLARE_PCI_FIXUP_HEADER(0x1814, 0x0601, /* Ralink RT2800 802.11n PCI */ - quirk_broken_intx_masking); - -+static void quirk_no_bus_reset(struct pci_dev *dev) -+{ -+ dev->dev_flags |= PCI_DEV_FLAGS_NO_BUS_RESET; -+} -+ -+/* -+ * Atheros AR93xx chips do not behave after a bus reset. The device will -+ * throw a Link Down error on AER-capable systems and regardless of AER, -+ * config space of the device is never accessible again and typically -+ * causes the system to hang or reset when access is attempted. -+ * http://www.spinics.net/lists/linux-pci/msg34797.html -+ */ -+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0030, quirk_no_bus_reset); -+ - static void pci_do_fixups(struct pci_dev *dev, struct pci_fixup *f, - struct pci_fixup *end) - { -diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c -index c0fe6091566a..988f5e18763a 100644 ---- a/drivers/pinctrl/core.c -+++ b/drivers/pinctrl/core.c -@@ -1812,14 +1812,15 @@ void pinctrl_unregister(struct pinctrl_dev *pctldev) - if (pctldev == NULL) - return; - -- mutex_lock(&pinctrldev_list_mutex); - mutex_lock(&pctldev->mutex); -- - pinctrl_remove_device_debugfs(pctldev); -+ mutex_unlock(&pctldev->mutex); - - if (!IS_ERR(pctldev->p)) - pinctrl_put(pctldev->p); - -+ mutex_lock(&pinctrldev_list_mutex); -+ mutex_lock(&pctldev->mutex); - /* TODO: check that no pinmuxes are still active? */ - list_del(&pctldev->node); - /* Destroy descriptor tree */ -diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c -index ab3baa7f9508..86ade85481bd 100644 ---- a/drivers/s390/crypto/ap_bus.c -+++ b/drivers/s390/crypto/ap_bus.c -@@ -44,6 +44,7 @@ - #include - #include - #include -+#include - - #include "ap_bus.h" - -@@ -71,7 +72,7 @@ MODULE_AUTHOR("IBM Corporation"); - MODULE_DESCRIPTION("Adjunct Processor Bus driver, " \ - "Copyright IBM Corp. 2006, 2012"); - MODULE_LICENSE("GPL"); --MODULE_ALIAS("z90crypt"); -+MODULE_ALIAS_CRYPTO("z90crypt"); - - /* - * Module parameter -diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c -index 3f5b56a99892..b4ddb7310e36 100644 ---- a/drivers/scsi/ipr.c -+++ b/drivers/scsi/ipr.c -@@ -683,6 +683,7 @@ static void ipr_init_ipr_cmnd(struct ipr_cmnd *ipr_cmd, - ipr_reinit_ipr_cmnd(ipr_cmd); - ipr_cmd->u.scratch = 0; - ipr_cmd->sibling = NULL; -+ ipr_cmd->eh_comp = NULL; - ipr_cmd->fast_done = fast_done; - init_timer(&ipr_cmd->timer); - } -@@ -848,6 +849,8 @@ static void ipr_scsi_eh_done(struct ipr_cmnd *ipr_cmd) - - scsi_dma_unmap(ipr_cmd->scsi_cmd); - scsi_cmd->scsi_done(scsi_cmd); -+ if (ipr_cmd->eh_comp) -+ complete(ipr_cmd->eh_comp); - list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q); - } - -@@ -4805,6 +4808,84 @@ static int ipr_slave_alloc(struct scsi_device *sdev) - return rc; - } - -+/** -+ * ipr_match_lun - Match function for specified LUN -+ * @ipr_cmd: ipr command struct -+ * @device: device to match (sdev) -+ * -+ * Returns: -+ * 1 if command matches sdev / 0 if command does not match sdev -+ **/ -+static int ipr_match_lun(struct ipr_cmnd *ipr_cmd, void *device) -+{ -+ if (ipr_cmd->scsi_cmd && ipr_cmd->scsi_cmd->device == device) -+ return 1; -+ return 0; -+} -+ -+/** -+ * ipr_wait_for_ops - Wait for matching commands to complete -+ * @ipr_cmd: ipr command struct -+ * @device: device to match (sdev) -+ * @match: match function to use -+ * -+ * Returns: -+ * SUCCESS / FAILED -+ **/ -+static int ipr_wait_for_ops(struct ipr_ioa_cfg *ioa_cfg, void *device, -+ int (*match)(struct ipr_cmnd *, void *)) -+{ -+ struct ipr_cmnd *ipr_cmd; -+ int wait; -+ unsigned long flags; -+ struct ipr_hrr_queue *hrrq; -+ signed long timeout = IPR_ABORT_TASK_TIMEOUT; -+ DECLARE_COMPLETION_ONSTACK(comp); -+ -+ ENTER; -+ do { -+ wait = 0; -+ -+ for_each_hrrq(hrrq, ioa_cfg) { -+ spin_lock_irqsave(hrrq->lock, flags); -+ list_for_each_entry(ipr_cmd, &hrrq->hrrq_pending_q, queue) { -+ if (match(ipr_cmd, device)) { -+ ipr_cmd->eh_comp = ∁ -+ wait++; -+ } -+ } -+ spin_unlock_irqrestore(hrrq->lock, flags); -+ } -+ -+ if (wait) { -+ timeout = wait_for_completion_timeout(&comp, timeout); -+ -+ if (!timeout) { -+ wait = 0; -+ -+ for_each_hrrq(hrrq, ioa_cfg) { -+ spin_lock_irqsave(hrrq->lock, flags); -+ list_for_each_entry(ipr_cmd, &hrrq->hrrq_pending_q, queue) { -+ if (match(ipr_cmd, device)) { -+ ipr_cmd->eh_comp = NULL; -+ wait++; -+ } -+ } -+ spin_unlock_irqrestore(hrrq->lock, flags); -+ } -+ -+ if (wait) -+ dev_err(&ioa_cfg->pdev->dev, "Timed out waiting for aborted commands\n"); -+ LEAVE; -+ return wait ? FAILED : SUCCESS; -+ } -+ } -+ } while (wait); -+ -+ LEAVE; -+ return SUCCESS; -+} -+ - static int ipr_eh_host_reset(struct scsi_cmnd *cmd) - { - struct ipr_ioa_cfg *ioa_cfg; -@@ -5023,11 +5104,17 @@ static int __ipr_eh_dev_reset(struct scsi_cmnd *scsi_cmd) - static int ipr_eh_dev_reset(struct scsi_cmnd *cmd) - { - int rc; -+ struct ipr_ioa_cfg *ioa_cfg; -+ -+ ioa_cfg = (struct ipr_ioa_cfg *) cmd->device->host->hostdata; - - spin_lock_irq(cmd->device->host->host_lock); - rc = __ipr_eh_dev_reset(cmd); - spin_unlock_irq(cmd->device->host->host_lock); - -+ if (rc == SUCCESS) -+ rc = ipr_wait_for_ops(ioa_cfg, cmd->device, ipr_match_lun); -+ - return rc; - } - -@@ -5205,13 +5292,18 @@ static int ipr_eh_abort(struct scsi_cmnd *scsi_cmd) - { - unsigned long flags; - int rc; -+ struct ipr_ioa_cfg *ioa_cfg; - - ENTER; - -+ ioa_cfg = (struct ipr_ioa_cfg *) scsi_cmd->device->host->hostdata; -+ - spin_lock_irqsave(scsi_cmd->device->host->host_lock, flags); - rc = ipr_cancel_op(scsi_cmd); - spin_unlock_irqrestore(scsi_cmd->device->host->host_lock, flags); - -+ if (rc == SUCCESS) -+ rc = ipr_wait_for_ops(ioa_cfg, scsi_cmd->device, ipr_match_lun); - LEAVE; - return rc; - } -diff --git a/drivers/scsi/ipr.h b/drivers/scsi/ipr.h -index 9ce38a22647e..0801f3df4b27 100644 ---- a/drivers/scsi/ipr.h -+++ b/drivers/scsi/ipr.h -@@ -1585,6 +1585,7 @@ struct ipr_cmnd { - struct scsi_device *sdev; - } u; - -+ struct completion *eh_comp; - struct ipr_hrr_queue *hrrq; - struct ipr_ioa_cfg *ioa_cfg; - }; -diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c -index d46b4ccec8cd..850e232d086e 100644 ---- a/drivers/tty/n_tty.c -+++ b/drivers/tty/n_tty.c -@@ -2417,12 +2417,17 @@ static unsigned int n_tty_poll(struct tty_struct *tty, struct file *file, - - poll_wait(file, &tty->read_wait, wait); - poll_wait(file, &tty->write_wait, wait); -+ if (test_bit(TTY_OTHER_CLOSED, &tty->flags)) -+ mask |= POLLHUP; - if (input_available_p(tty, 1)) - mask |= POLLIN | POLLRDNORM; -+ else if (mask & POLLHUP) { -+ tty_flush_to_ldisc(tty); -+ if (input_available_p(tty, 1)) -+ mask |= POLLIN | POLLRDNORM; -+ } - if (tty->packet && tty->link->ctrl_status) - mask |= POLLPRI | POLLIN | POLLRDNORM; -- if (test_bit(TTY_OTHER_CLOSED, &tty->flags)) -- mask |= POLLHUP; - if (tty_hung_up_p(file)) - mask |= POLLHUP; - if (!(mask & (POLLHUP | POLLIN | POLLRDNORM))) { -diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c -index 9df5d6ec7eec..f3a9d831d0f9 100644 ---- a/drivers/xen/swiotlb-xen.c -+++ b/drivers/xen/swiotlb-xen.c -@@ -449,7 +449,7 @@ static void xen_unmap_single(struct device *hwdev, dma_addr_t dev_addr, - - /* NOTE: We use dev_addr here, not paddr! */ - if (is_xen_swiotlb_buffer(dev_addr)) { -- swiotlb_tbl_unmap_single(hwdev, dev_addr, size, dir); -+ swiotlb_tbl_unmap_single(hwdev, paddr, size, dir); - return; - } - -diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c -index 1a858947006e..fa9f90049099 100644 ---- a/fs/btrfs/extent_io.c -+++ b/fs/btrfs/extent_io.c -@@ -4507,7 +4507,8 @@ static void check_buffer_tree_ref(struct extent_buffer *eb) - spin_unlock(&eb->refs_lock); - } - --static void mark_extent_buffer_accessed(struct extent_buffer *eb) -+static void mark_extent_buffer_accessed(struct extent_buffer *eb, -+ struct page *accessed) - { - unsigned long num_pages, i; - -@@ -4516,7 +4517,8 @@ static void mark_extent_buffer_accessed(struct extent_buffer *eb) - num_pages = num_extent_pages(eb->start, eb->len); - for (i = 0; i < num_pages; i++) { - struct page *p = extent_buffer_page(eb, i); -- mark_page_accessed(p); -+ if (p != accessed) -+ mark_page_accessed(p); - } - } - -@@ -4530,7 +4532,7 @@ struct extent_buffer *find_extent_buffer(struct btrfs_fs_info *fs_info, - start >> PAGE_CACHE_SHIFT); - if (eb && atomic_inc_not_zero(&eb->refs)) { - rcu_read_unlock(); -- mark_extent_buffer_accessed(eb); -+ mark_extent_buffer_accessed(eb, NULL); - return eb; - } - rcu_read_unlock(); -@@ -4578,7 +4580,7 @@ struct extent_buffer *alloc_extent_buffer(struct btrfs_fs_info *fs_info, - spin_unlock(&mapping->private_lock); - unlock_page(p); - page_cache_release(p); -- mark_extent_buffer_accessed(exists); -+ mark_extent_buffer_accessed(exists, p); - goto free_eb; - } - -@@ -4593,7 +4595,6 @@ struct extent_buffer *alloc_extent_buffer(struct btrfs_fs_info *fs_info, - attach_extent_buffer_page(eb, p); - spin_unlock(&mapping->private_lock); - WARN_ON(PageDirty(p)); -- mark_page_accessed(p); - eb->pages[i] = p; - if (!PageUptodate(p)) - uptodate = 0; -diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c -index f6d00df99a8c..279b06ef5522 100644 ---- a/fs/btrfs/file.c -+++ b/fs/btrfs/file.c -@@ -470,11 +470,12 @@ static void btrfs_drop_pages(struct page **pages, size_t num_pages) - for (i = 0; i < num_pages; i++) { - /* page checked is some magic around finding pages that - * have been modified without going through btrfs_set_page_dirty -- * clear it here -+ * clear it here. There should be no need to mark the pages -+ * accessed as prepare_pages should have marked them accessed -+ * in prepare_pages via find_or_create_page() - */ - ClearPageChecked(pages[i]); - unlock_page(pages[i]); -- mark_page_accessed(pages[i]); - page_cache_release(pages[i]); - } - } -diff --git a/fs/buffer.c b/fs/buffer.c -index 4d06a573d199..eef21c69f2d7 100644 ---- a/fs/buffer.c -+++ b/fs/buffer.c -@@ -227,7 +227,7 @@ __find_get_block_slow(struct block_device *bdev, sector_t block) - int all_mapped = 1; - - index = block >> (PAGE_CACHE_SHIFT - bd_inode->i_blkbits); -- page = find_get_page(bd_mapping, index); -+ page = find_get_page_flags(bd_mapping, index, FGP_ACCESSED); - if (!page) - goto out; - -@@ -1368,12 +1368,13 @@ __find_get_block(struct block_device *bdev, sector_t block, unsigned size) - struct buffer_head *bh = lookup_bh_lru(bdev, block, size); - - if (bh == NULL) { -+ /* __find_get_block_slow will mark the page accessed */ - bh = __find_get_block_slow(bdev, block); - if (bh) - bh_lru_install(bh); -- } -- if (bh) -+ } else - touch_buffer(bh); -+ - return bh; - } - EXPORT_SYMBOL(__find_get_block); -@@ -1485,16 +1486,27 @@ EXPORT_SYMBOL(set_bh_page); - /* - * Called when truncating a buffer on a page completely. - */ -+ -+/* Bits that are cleared during an invalidate */ -+#define BUFFER_FLAGS_DISCARD \ -+ (1 << BH_Mapped | 1 << BH_New | 1 << BH_Req | \ -+ 1 << BH_Delay | 1 << BH_Unwritten) -+ - static void discard_buffer(struct buffer_head * bh) - { -+ unsigned long b_state, b_state_old; -+ - lock_buffer(bh); - clear_buffer_dirty(bh); - bh->b_bdev = NULL; -- clear_buffer_mapped(bh); -- clear_buffer_req(bh); -- clear_buffer_new(bh); -- clear_buffer_delay(bh); -- clear_buffer_unwritten(bh); -+ b_state = bh->b_state; -+ for (;;) { -+ b_state_old = cmpxchg(&bh->b_state, b_state, -+ (b_state & ~BUFFER_FLAGS_DISCARD)); -+ if (b_state_old == b_state) -+ break; -+ b_state = b_state_old; -+ } - unlock_buffer(bh); - } - -diff --git a/fs/cifs/ioctl.c b/fs/cifs/ioctl.c -index 77492301cc2b..dfc95646b88c 100644 ---- a/fs/cifs/ioctl.c -+++ b/fs/cifs/ioctl.c -@@ -86,21 +86,16 @@ static long cifs_ioctl_clone(unsigned int xid, struct file *dst_file, - } - - src_inode = src_file.file->f_dentry->d_inode; -+ rc = -EINVAL; -+ if (S_ISDIR(src_inode->i_mode)) -+ goto out_fput; - - /* - * Note: cifs case is easier than btrfs since server responsible for - * checks for proper open modes and file type and if it wants - * server could even support copy of range where source = target - */ -- -- /* so we do not deadlock racing two ioctls on same files */ -- if (target_inode < src_inode) { -- mutex_lock_nested(&target_inode->i_mutex, I_MUTEX_PARENT); -- mutex_lock_nested(&src_inode->i_mutex, I_MUTEX_CHILD); -- } else { -- mutex_lock_nested(&src_inode->i_mutex, I_MUTEX_PARENT); -- mutex_lock_nested(&target_inode->i_mutex, I_MUTEX_CHILD); -- } -+ lock_two_nondirectories(target_inode, src_inode); - - /* determine range to clone */ - rc = -EINVAL; -@@ -124,13 +119,7 @@ static long cifs_ioctl_clone(unsigned int xid, struct file *dst_file, - out_unlock: - /* although unlocking in the reverse order from locking is not - strictly necessary here it is a little cleaner to be consistent */ -- if (target_inode < src_inode) { -- mutex_unlock(&src_inode->i_mutex); -- mutex_unlock(&target_inode->i_mutex); -- } else { -- mutex_unlock(&target_inode->i_mutex); -- mutex_unlock(&src_inode->i_mutex); -- } -+ unlock_two_nondirectories(src_inode, target_inode); - out_fput: - fdput(src_file); - out_drop_write: -diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c -index 242226a87be7..7620133f78bf 100644 ---- a/fs/ext4/mballoc.c -+++ b/fs/ext4/mballoc.c -@@ -1044,6 +1044,8 @@ int ext4_mb_init_group(struct super_block *sb, ext4_group_t group) - * allocating. If we are looking at the buddy cache we would - * have taken a reference using ext4_mb_load_buddy and that - * would have pinned buddy page to page cache. -+ * The call to ext4_mb_get_buddy_page_lock will mark the -+ * page accessed. - */ - ret = ext4_mb_get_buddy_page_lock(sb, group, &e4b); - if (ret || !EXT4_MB_GRP_NEED_INIT(this_grp)) { -@@ -1062,7 +1064,6 @@ int ext4_mb_init_group(struct super_block *sb, ext4_group_t group) - ret = -EIO; - goto err; - } -- mark_page_accessed(page); - - if (e4b.bd_buddy_page == NULL) { - /* -@@ -1082,7 +1083,6 @@ int ext4_mb_init_group(struct super_block *sb, ext4_group_t group) - ret = -EIO; - goto err; - } -- mark_page_accessed(page); - err: - ext4_mb_put_buddy_page_lock(&e4b); - return ret; -@@ -1141,7 +1141,7 @@ ext4_mb_load_buddy(struct super_block *sb, ext4_group_t group, - - /* we could use find_or_create_page(), but it locks page - * what we'd like to avoid in fast path ... */ -- page = find_get_page(inode->i_mapping, pnum); -+ page = find_get_page_flags(inode->i_mapping, pnum, FGP_ACCESSED); - if (page == NULL || !PageUptodate(page)) { - if (page) - /* -@@ -1172,15 +1172,16 @@ ext4_mb_load_buddy(struct super_block *sb, ext4_group_t group, - ret = -EIO; - goto err; - } -+ -+ /* Pages marked accessed already */ - e4b->bd_bitmap_page = page; - e4b->bd_bitmap = page_address(page) + (poff * sb->s_blocksize); -- mark_page_accessed(page); - - block++; - pnum = block / blocks_per_page; - poff = block % blocks_per_page; - -- page = find_get_page(inode->i_mapping, pnum); -+ page = find_get_page_flags(inode->i_mapping, pnum, FGP_ACCESSED); - if (page == NULL || !PageUptodate(page)) { - if (page) - page_cache_release(page); -@@ -1201,9 +1202,10 @@ ext4_mb_load_buddy(struct super_block *sb, ext4_group_t group, - ret = -EIO; - goto err; - } -+ -+ /* Pages marked accessed already */ - e4b->bd_buddy_page = page; - e4b->bd_buddy = page_address(page) + (poff * sb->s_blocksize); -- mark_page_accessed(page); - - BUG_ON(e4b->bd_bitmap_page == NULL); - BUG_ON(e4b->bd_buddy_page == NULL); -diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c -index 293d0486a40f..5c6fe278fb63 100644 ---- a/fs/f2fs/checkpoint.c -+++ b/fs/f2fs/checkpoint.c -@@ -71,7 +71,6 @@ repeat: - goto repeat; - } - out: -- mark_page_accessed(page); - return page; - } - -diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c -index b0649b76eb4f..bb6478acb369 100644 ---- a/fs/f2fs/node.c -+++ b/fs/f2fs/node.c -@@ -969,7 +969,6 @@ repeat: - } - got_it: - f2fs_bug_on(nid != nid_of_node(page)); -- mark_page_accessed(page); - return page; - } - -@@ -1024,7 +1023,6 @@ page_hit: - f2fs_put_page(page, 1); - return ERR_PTR(-EIO); - } -- mark_page_accessed(page); - return page; - } - -diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c -index 0a648bb455ae..6eb13c621a14 100644 ---- a/fs/fuse/dev.c -+++ b/fs/fuse/dev.c -@@ -1614,7 +1614,7 @@ out_finish: - - static void fuse_retrieve_end(struct fuse_conn *fc, struct fuse_req *req) - { -- release_pages(req->pages, req->num_pages, 0); -+ release_pages(req->pages, req->num_pages, false); - } - - static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode, -diff --git a/fs/fuse/file.c b/fs/fuse/file.c -index a91d3b4d32f3..d8a60270581c 100644 ---- a/fs/fuse/file.c -+++ b/fs/fuse/file.c -@@ -1006,8 +1006,6 @@ static ssize_t fuse_fill_write_pages(struct fuse_req *req, - tmp = iov_iter_copy_from_user_atomic(page, ii, offset, bytes); - flush_dcache_page(page); - -- mark_page_accessed(page); -- - if (!tmp) { - unlock_page(page); - page_cache_release(page); -diff --git a/fs/gfs2/aops.c b/fs/gfs2/aops.c -index 49436fa7cd4f..4ccb60d943bb 100644 ---- a/fs/gfs2/aops.c -+++ b/fs/gfs2/aops.c -@@ -517,7 +517,6 @@ int gfs2_internal_read(struct gfs2_inode *ip, char *buf, loff_t *pos, - p = kmap_atomic(page); - memcpy(buf + copied, p + offset, amt); - kunmap_atomic(p); -- mark_page_accessed(page); - page_cache_release(page); - copied += amt; - index++; -diff --git a/fs/gfs2/meta_io.c b/fs/gfs2/meta_io.c -index b82a9c99e18b..e7b149614f5e 100644 ---- a/fs/gfs2/meta_io.c -+++ b/fs/gfs2/meta_io.c -@@ -136,7 +136,8 @@ struct buffer_head *gfs2_getbuf(struct gfs2_glock *gl, u64 blkno, int create) - yield(); - } - } else { -- page = find_lock_page(mapping, index); -+ page = find_get_page_flags(mapping, index, -+ FGP_LOCK|FGP_ACCESSED); - if (!page) - return NULL; - } -@@ -153,7 +154,6 @@ struct buffer_head *gfs2_getbuf(struct gfs2_glock *gl, u64 blkno, int create) - map_bh(bh, sdp->sd_vfs, blkno); - - unlock_page(page); -- mark_page_accessed(page); - page_cache_release(page); - - return bh; -diff --git a/fs/ntfs/attrib.c b/fs/ntfs/attrib.c -index a27e3fecefaf..250ed5b20c8f 100644 ---- a/fs/ntfs/attrib.c -+++ b/fs/ntfs/attrib.c -@@ -1748,7 +1748,6 @@ int ntfs_attr_make_non_resident(ntfs_inode *ni, const u32 data_size) - if (page) { - set_page_dirty(page); - unlock_page(page); -- mark_page_accessed(page); - page_cache_release(page); - } - ntfs_debug("Done."); -diff --git a/fs/ntfs/file.c b/fs/ntfs/file.c -index db9bd8a31725..86ddab916b66 100644 ---- a/fs/ntfs/file.c -+++ b/fs/ntfs/file.c -@@ -2060,7 +2060,6 @@ static ssize_t ntfs_file_buffered_write(struct kiocb *iocb, - } - do { - unlock_page(pages[--do_pages]); -- mark_page_accessed(pages[do_pages]); - page_cache_release(pages[do_pages]); - } while (do_pages); - if (unlikely(status)) -diff --git a/include/linux/cpuset.h b/include/linux/cpuset.h -index b19d3dc2e651..ade2390ffe92 100644 ---- a/include/linux/cpuset.h -+++ b/include/linux/cpuset.h -@@ -12,10 +12,31 @@ - #include - #include - #include -+#include - - #ifdef CONFIG_CPUSETS - --extern int number_of_cpusets; /* How many cpusets are defined in system? */ -+extern struct static_key cpusets_enabled_key; -+static inline bool cpusets_enabled(void) -+{ -+ return static_key_false(&cpusets_enabled_key); -+} -+ -+static inline int nr_cpusets(void) -+{ -+ /* jump label reference count + the top-level cpuset */ -+ return static_key_count(&cpusets_enabled_key) + 1; -+} -+ -+static inline void cpuset_inc(void) -+{ -+ static_key_slow_inc(&cpusets_enabled_key); -+} -+ -+static inline void cpuset_dec(void) -+{ -+ static_key_slow_dec(&cpusets_enabled_key); -+} - - extern int cpuset_init(void); - extern void cpuset_init_smp(void); -@@ -32,13 +53,13 @@ extern int __cpuset_node_allowed_hardwall(int node, gfp_t gfp_mask); - - static inline int cpuset_node_allowed_softwall(int node, gfp_t gfp_mask) - { -- return number_of_cpusets <= 1 || -+ return nr_cpusets() <= 1 || - __cpuset_node_allowed_softwall(node, gfp_mask); - } - - static inline int cpuset_node_allowed_hardwall(int node, gfp_t gfp_mask) - { -- return number_of_cpusets <= 1 || -+ return nr_cpusets() <= 1 || - __cpuset_node_allowed_hardwall(node, gfp_mask); - } - -@@ -124,6 +145,8 @@ static inline void set_mems_allowed(nodemask_t nodemask) - - #else /* !CONFIG_CPUSETS */ - -+static inline bool cpusets_enabled(void) { return false; } -+ - static inline int cpuset_init(void) { return 0; } - static inline void cpuset_init_smp(void) {} - -diff --git a/include/linux/crypto.h b/include/linux/crypto.h -index b92eadf92d72..2b00d92a6e6f 100644 ---- a/include/linux/crypto.h -+++ b/include/linux/crypto.h -@@ -26,6 +26,19 @@ - #include - - /* -+ * Autoloaded crypto modules should only use a prefixed name to avoid allowing -+ * arbitrary modules to be loaded. Loading from userspace may still need the -+ * unprefixed names, so retains those aliases as well. -+ * This uses __MODULE_INFO directly instead of MODULE_ALIAS because pre-4.3 -+ * gcc (e.g. avr32 toolchain) uses __LINE__ for uniqueness, and this macro -+ * expands twice on the same line. Instead, use a separate base name for the -+ * alias. -+ */ -+#define MODULE_ALIAS_CRYPTO(name) \ -+ __MODULE_INFO(alias, alias_userspace, name); \ -+ __MODULE_INFO(alias, alias_crypto, "crypto-" name) -+ -+/* - * Algorithm masks and types. - */ - #define CRYPTO_ALG_TYPE_MASK 0x0000000f -diff --git a/include/linux/gfp.h b/include/linux/gfp.h -index 39b81dc7d01a..3824ac62f395 100644 ---- a/include/linux/gfp.h -+++ b/include/linux/gfp.h -@@ -369,8 +369,8 @@ void *alloc_pages_exact_nid(int nid, size_t size, gfp_t gfp_mask); - - extern void __free_pages(struct page *page, unsigned int order); - extern void free_pages(unsigned long addr, unsigned int order); --extern void free_hot_cold_page(struct page *page, int cold); --extern void free_hot_cold_page_list(struct list_head *list, int cold); -+extern void free_hot_cold_page(struct page *page, bool cold); -+extern void free_hot_cold_page_list(struct list_head *list, bool cold); - - extern void __free_memcg_kmem_pages(struct page *page, unsigned int order); - extern void free_memcg_kmem_pages(unsigned long addr, unsigned int order); -diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h -index b826239bdce0..63579cb8d3dc 100644 ---- a/include/linux/huge_mm.h -+++ b/include/linux/huge_mm.h -@@ -93,10 +93,6 @@ extern bool is_vma_temporary_stack(struct vm_area_struct *vma); - #endif /* CONFIG_DEBUG_VM */ - - extern unsigned long transparent_hugepage_flags; --extern int copy_pte_range(struct mm_struct *dst_mm, struct mm_struct *src_mm, -- pmd_t *dst_pmd, pmd_t *src_pmd, -- struct vm_area_struct *vma, -- unsigned long addr, unsigned long end); - extern int split_huge_page_to_list(struct page *page, struct list_head *list); - static inline int split_huge_page(struct page *page) - { -diff --git a/include/linux/jump_label.h b/include/linux/jump_label.h -index 5c1dfb2a9e73..784304b222b3 100644 ---- a/include/linux/jump_label.h -+++ b/include/linux/jump_label.h -@@ -69,6 +69,10 @@ struct static_key { - - # include - # define HAVE_JUMP_LABEL -+#else -+struct static_key { -+ atomic_t enabled; -+}; - #endif /* CC_HAVE_ASM_GOTO && CONFIG_JUMP_LABEL */ - - enum jump_label_type { -@@ -79,6 +83,12 @@ enum jump_label_type { - struct module; - - #include -+ -+static inline int static_key_count(struct static_key *key) -+{ -+ return atomic_read(&key->enabled); -+} -+ - #ifdef HAVE_JUMP_LABEL - - #define JUMP_LABEL_TYPE_FALSE_BRANCH 0UL -@@ -134,10 +144,6 @@ extern void jump_label_apply_nops(struct module *mod); - - #else /* !HAVE_JUMP_LABEL */ - --struct static_key { -- atomic_t enabled; --}; -- - static __always_inline void jump_label_init(void) - { - static_key_initialized = true; -@@ -145,14 +151,14 @@ static __always_inline void jump_label_init(void) - - static __always_inline bool static_key_false(struct static_key *key) - { -- if (unlikely(atomic_read(&key->enabled) > 0)) -+ if (unlikely(static_key_count(key) > 0)) - return true; - return false; - } - - static __always_inline bool static_key_true(struct static_key *key) - { -- if (likely(atomic_read(&key->enabled) > 0)) -+ if (likely(static_key_count(key) > 0)) - return true; - return false; - } -@@ -194,7 +200,7 @@ static inline int jump_label_apply_nops(struct module *mod) - - static inline bool static_key_enabled(struct static_key *key) - { -- return (atomic_read(&key->enabled) > 0); -+ return static_key_count(key) > 0; - } - - #endif /* _LINUX_JUMP_LABEL_H */ -diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h -index 18843532a0c9..ac819bf9522c 100644 ---- a/include/linux/mmzone.h -+++ b/include/linux/mmzone.h -@@ -78,10 +78,15 @@ extern int page_group_by_mobility_disabled; - #define NR_MIGRATETYPE_BITS (PB_migrate_end - PB_migrate + 1) - #define MIGRATETYPE_MASK ((1UL << NR_MIGRATETYPE_BITS) - 1) - --static inline int get_pageblock_migratetype(struct page *page) -+#define get_pageblock_migratetype(page) \ -+ get_pfnblock_flags_mask(page, page_to_pfn(page), \ -+ PB_migrate_end, MIGRATETYPE_MASK) -+ -+static inline int get_pfnblock_migratetype(struct page *page, unsigned long pfn) - { - BUILD_BUG_ON(PB_migrate_end - PB_migrate != 2); -- return get_pageblock_flags_mask(page, PB_migrate_end, MIGRATETYPE_MASK); -+ return get_pfnblock_flags_mask(page, pfn, PB_migrate_end, -+ MIGRATETYPE_MASK); - } - - struct free_area { -@@ -138,6 +143,7 @@ enum zone_stat_item { - NR_SHMEM, /* shmem pages (included tmpfs/GEM pages) */ - NR_DIRTIED, /* page dirtyings since bootup */ - NR_WRITTEN, /* page writings since bootup */ -+ NR_PAGES_SCANNED, /* pages scanned since last reclaim */ - #ifdef CONFIG_NUMA - NUMA_HIT, /* allocated in intended node */ - NUMA_MISS, /* allocated in non intended node */ -@@ -316,19 +322,12 @@ enum zone_type { - #ifndef __GENERATING_BOUNDS_H - - struct zone { -- /* Fields commonly accessed by the page allocator */ -+ /* Read-mostly fields */ - - /* zone watermarks, access with *_wmark_pages(zone) macros */ - unsigned long watermark[NR_WMARK]; - - /* -- * When free pages are below this point, additional steps are taken -- * when reading the number of free pages to avoid per-cpu counter -- * drift allowing watermarks to be breached -- */ -- unsigned long percpu_drift_mark; -- -- /* - * We don't know if the memory that we're going to allocate will be freeable - * or/and it will be released eventually, so to avoid totally wasting several - * GB of ram we must reserve some of the lower zone memory (otherwise we risk -@@ -336,41 +335,26 @@ struct zone { - * on the higher zones). This array is recalculated at runtime if the - * sysctl_lowmem_reserve_ratio sysctl changes. - */ -- unsigned long lowmem_reserve[MAX_NR_ZONES]; -- -- /* -- * This is a per-zone reserve of pages that should not be -- * considered dirtyable memory. -- */ -- unsigned long dirty_balance_reserve; -+ long lowmem_reserve[MAX_NR_ZONES]; - - #ifdef CONFIG_NUMA - int node; -+#endif -+ - /* -- * zone reclaim becomes active if more unmapped pages exist. -+ * The target ratio of ACTIVE_ANON to INACTIVE_ANON pages on -+ * this zone's LRU. Maintained by the pageout code. - */ -- unsigned long min_unmapped_pages; -- unsigned long min_slab_pages; --#endif -+ unsigned int inactive_ratio; -+ -+ struct pglist_data *zone_pgdat; - struct per_cpu_pageset __percpu *pageset; -+ - /* -- * free areas of different sizes -+ * This is a per-zone reserve of pages that should not be -+ * considered dirtyable memory. - */ -- spinlock_t lock; --#if defined CONFIG_COMPACTION || defined CONFIG_CMA -- /* Set to true when the PG_migrate_skip bits should be cleared */ -- bool compact_blockskip_flush; -- -- /* pfn where compaction free scanner should start */ -- unsigned long compact_cached_free_pfn; -- /* pfn where async and sync compaction migration scanner should start */ -- unsigned long compact_cached_migrate_pfn[2]; --#endif --#ifdef CONFIG_MEMORY_HOTPLUG -- /* see spanned/present_pages for more description */ -- seqlock_t span_seqlock; --#endif -- struct free_area free_area[MAX_ORDER]; -+ unsigned long dirty_balance_reserve; - - #ifndef CONFIG_SPARSEMEM - /* -@@ -380,71 +364,14 @@ struct zone { - unsigned long *pageblock_flags; - #endif /* CONFIG_SPARSEMEM */ - --#ifdef CONFIG_COMPACTION -- /* -- * On compaction failure, 1<> PAGE_SHIFT */ - unsigned long zone_start_pfn; - -@@ -490,9 +417,11 @@ struct zone { - * adjust_managed_page_count() should be used instead of directly - * touching zone->managed_pages and totalram_pages. - */ -+ unsigned long managed_pages; - unsigned long spanned_pages; - unsigned long present_pages; -- unsigned long managed_pages; -+ -+ const char *name; - - /* - * Number of MIGRATE_RESEVE page block. To maintain for just -@@ -500,10 +429,91 @@ struct zone { - */ - int nr_migrate_reserve_block; - -+#ifdef CONFIG_MEMORY_HOTPLUG -+ /* see spanned/present_pages for more description */ -+ seqlock_t span_seqlock; -+#endif -+ - /* -- * rarely used fields: -+ * wait_table -- the array holding the hash table -+ * wait_table_hash_nr_entries -- the size of the hash table array -+ * wait_table_bits -- wait_table_size == (1 << wait_table_bits) -+ * -+ * The purpose of all these is to keep track of the people -+ * waiting for a page to become available and make them -+ * runnable again when possible. The trouble is that this -+ * consumes a lot of space, especially when so few things -+ * wait on pages at a given time. So instead of using -+ * per-page waitqueues, we use a waitqueue hash table. -+ * -+ * The bucket discipline is to sleep on the same queue when -+ * colliding and wake all in that wait queue when removing. -+ * When something wakes, it must check to be sure its page is -+ * truly available, a la thundering herd. The cost of a -+ * collision is great, but given the expected load of the -+ * table, they should be so rare as to be outweighed by the -+ * benefits from the saved space. -+ * -+ * __wait_on_page_locked() and unlock_page() in mm/filemap.c, are the -+ * primary users of these fields, and in mm/page_alloc.c -+ * free_area_init_core() performs the initialization of them. - */ -- const char *name; -+ wait_queue_head_t *wait_table; -+ unsigned long wait_table_hash_nr_entries; -+ unsigned long wait_table_bits; -+ -+ ZONE_PADDING(_pad1_) -+ -+ /* Write-intensive fields used from the page allocator */ -+ spinlock_t lock; -+ -+ /* free areas of different sizes */ -+ struct free_area free_area[MAX_ORDER]; -+ -+ /* zone flags, see below */ -+ unsigned long flags; -+ -+ ZONE_PADDING(_pad2_) -+ -+ /* Write-intensive fields used by page reclaim */ -+ -+ /* Fields commonly accessed by the page reclaim scanner */ -+ spinlock_t lru_lock; -+ struct lruvec lruvec; -+ -+ /* -+ * When free pages are below this point, additional steps are taken -+ * when reading the number of free pages to avoid per-cpu counter -+ * drift allowing watermarks to be breached -+ */ -+ unsigned long percpu_drift_mark; -+ -+#if defined CONFIG_COMPACTION || defined CONFIG_CMA -+ /* pfn where compaction free scanner should start */ -+ unsigned long compact_cached_free_pfn; -+ /* pfn where async and sync compaction migration scanner should start */ -+ unsigned long compact_cached_migrate_pfn[2]; -+#endif -+ -+#ifdef CONFIG_COMPACTION -+ /* -+ * On compaction failure, 1<flags); - } - -+static inline int zone_is_fair_depleted(const struct zone *zone) -+{ -+ return test_bit(ZONE_FAIR_DEPLETED, &zone->flags); -+} -+ - static inline int zone_is_oom_locked(const struct zone *zone) - { - return test_bit(ZONE_OOM_LOCKED, &zone->flags); -@@ -807,10 +823,10 @@ static inline bool pgdat_is_empty(pg_data_t *pgdat) - extern struct mutex zonelists_mutex; - void build_all_zonelists(pg_data_t *pgdat, struct zone *zone); - void wakeup_kswapd(struct zone *zone, int order, enum zone_type classzone_idx); --bool zone_watermark_ok(struct zone *z, int order, unsigned long mark, -- int classzone_idx, int alloc_flags); --bool zone_watermark_ok_safe(struct zone *z, int order, unsigned long mark, -- int classzone_idx, int alloc_flags); -+bool zone_watermark_ok(struct zone *z, unsigned int order, -+ unsigned long mark, int classzone_idx, int alloc_flags); -+bool zone_watermark_ok_safe(struct zone *z, unsigned int order, -+ unsigned long mark, int classzone_idx, int alloc_flags); - enum memmap_context { - MEMMAP_EARLY, - MEMMAP_HOTPLUG, -diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h -index ca71a1d347a0..3c545b48aeab 100644 ---- a/include/linux/page-flags.h -+++ b/include/linux/page-flags.h -@@ -198,6 +198,7 @@ struct page; /* forward declaration */ - TESTPAGEFLAG(Locked, locked) - PAGEFLAG(Error, error) TESTCLEARFLAG(Error, error) - PAGEFLAG(Referenced, referenced) TESTCLEARFLAG(Referenced, referenced) -+ __SETPAGEFLAG(Referenced, referenced) - PAGEFLAG(Dirty, dirty) TESTSCFLAG(Dirty, dirty) __CLEARPAGEFLAG(Dirty, dirty) - PAGEFLAG(LRU, lru) __CLEARPAGEFLAG(LRU, lru) - PAGEFLAG(Active, active) __CLEARPAGEFLAG(Active, active) -@@ -208,6 +209,7 @@ PAGEFLAG(Pinned, pinned) TESTSCFLAG(Pinned, pinned) /* Xen */ - PAGEFLAG(SavePinned, savepinned); /* Xen */ - PAGEFLAG(Reserved, reserved) __CLEARPAGEFLAG(Reserved, reserved) - PAGEFLAG(SwapBacked, swapbacked) __CLEARPAGEFLAG(SwapBacked, swapbacked) -+ __SETPAGEFLAG(SwapBacked, swapbacked) - - __PAGEFLAG(SlobFree, slob_free) - -diff --git a/include/linux/pageblock-flags.h b/include/linux/pageblock-flags.h -index c08730c10c7a..2baeee12f48e 100644 ---- a/include/linux/pageblock-flags.h -+++ b/include/linux/pageblock-flags.h -@@ -65,33 +65,26 @@ extern int pageblock_order; - /* Forward declaration */ - struct page; - --unsigned long get_pageblock_flags_mask(struct page *page, -+unsigned long get_pfnblock_flags_mask(struct page *page, -+ unsigned long pfn, - unsigned long end_bitidx, - unsigned long mask); --void set_pageblock_flags_mask(struct page *page, -+ -+void set_pfnblock_flags_mask(struct page *page, - unsigned long flags, -+ unsigned long pfn, - unsigned long end_bitidx, - unsigned long mask); - - /* Declarations for getting and setting flags. See mm/page_alloc.c */ --static inline unsigned long get_pageblock_flags_group(struct page *page, -- int start_bitidx, int end_bitidx) --{ -- unsigned long nr_flag_bits = end_bitidx - start_bitidx + 1; -- unsigned long mask = (1 << nr_flag_bits) - 1; -- -- return get_pageblock_flags_mask(page, end_bitidx, mask); --} -- --static inline void set_pageblock_flags_group(struct page *page, -- unsigned long flags, -- int start_bitidx, int end_bitidx) --{ -- unsigned long nr_flag_bits = end_bitidx - start_bitidx + 1; -- unsigned long mask = (1 << nr_flag_bits) - 1; -- -- set_pageblock_flags_mask(page, flags, end_bitidx, mask); --} -+#define get_pageblock_flags_group(page, start_bitidx, end_bitidx) \ -+ get_pfnblock_flags_mask(page, page_to_pfn(page), \ -+ end_bitidx, \ -+ (1 << (end_bitidx - start_bitidx + 1)) - 1) -+#define set_pageblock_flags_group(page, flags, start_bitidx, end_bitidx) \ -+ set_pfnblock_flags_mask(page, flags, page_to_pfn(page), \ -+ end_bitidx, \ -+ (1 << (end_bitidx - start_bitidx + 1)) - 1) - - #ifdef CONFIG_COMPACTION - #define get_pageblock_skip(page) \ -diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h -index 09c1b03867d9..fcebdda3651c 100644 ---- a/include/linux/pagemap.h -+++ b/include/linux/pagemap.h -@@ -99,7 +99,7 @@ static inline void mapping_set_gfp_mask(struct address_space *m, gfp_t mask) - - #define page_cache_get(page) get_page(page) - #define page_cache_release(page) put_page(page) --void release_pages(struct page **pages, int nr, int cold); -+void release_pages(struct page **pages, int nr, bool cold); - - /* - * speculatively take a reference to a page. -@@ -248,12 +248,108 @@ pgoff_t page_cache_next_hole(struct address_space *mapping, - pgoff_t page_cache_prev_hole(struct address_space *mapping, - pgoff_t index, unsigned long max_scan); - -+#define FGP_ACCESSED 0x00000001 -+#define FGP_LOCK 0x00000002 -+#define FGP_CREAT 0x00000004 -+#define FGP_WRITE 0x00000008 -+#define FGP_NOFS 0x00000010 -+#define FGP_NOWAIT 0x00000020 -+ -+struct page *pagecache_get_page(struct address_space *mapping, pgoff_t offset, -+ int fgp_flags, gfp_t cache_gfp_mask); -+ -+/** -+ * find_get_page - find and get a page reference -+ * @mapping: the address_space to search -+ * @offset: the page index -+ * -+ * Looks up the page cache slot at @mapping & @offset. If there is a -+ * page cache page, it is returned with an increased refcount. -+ * -+ * Otherwise, %NULL is returned. -+ */ -+static inline struct page *find_get_page(struct address_space *mapping, -+ pgoff_t offset) -+{ -+ return pagecache_get_page(mapping, offset, 0, 0); -+} -+ -+static inline struct page *find_get_page_flags(struct address_space *mapping, -+ pgoff_t offset, int fgp_flags) -+{ -+ return pagecache_get_page(mapping, offset, fgp_flags, 0); -+} -+ -+/** -+ * find_lock_page - locate, pin and lock a pagecache page -+ * pagecache_get_page - find and get a page reference -+ * @mapping: the address_space to search -+ * @offset: the page index -+ * -+ * Looks up the page cache slot at @mapping & @offset. If there is a -+ * page cache page, it is returned locked and with an increased -+ * refcount. -+ * -+ * Otherwise, %NULL is returned. -+ * -+ * find_lock_page() may sleep. -+ */ -+static inline struct page *find_lock_page(struct address_space *mapping, -+ pgoff_t offset) -+{ -+ return pagecache_get_page(mapping, offset, FGP_LOCK, 0); -+} -+ -+/** -+ * find_or_create_page - locate or add a pagecache page -+ * @mapping: the page's address_space -+ * @index: the page's index into the mapping -+ * @gfp_mask: page allocation mode -+ * -+ * Looks up the page cache slot at @mapping & @offset. If there is a -+ * page cache page, it is returned locked and with an increased -+ * refcount. -+ * -+ * If the page is not present, a new page is allocated using @gfp_mask -+ * and added to the page cache and the VM's LRU list. The page is -+ * returned locked and with an increased refcount. -+ * -+ * On memory exhaustion, %NULL is returned. -+ * -+ * find_or_create_page() may sleep, even if @gfp_flags specifies an -+ * atomic allocation! -+ */ -+static inline struct page *find_or_create_page(struct address_space *mapping, -+ pgoff_t offset, gfp_t gfp_mask) -+{ -+ return pagecache_get_page(mapping, offset, -+ FGP_LOCK|FGP_ACCESSED|FGP_CREAT, -+ gfp_mask); -+} -+ -+/** -+ * grab_cache_page_nowait - returns locked page at given index in given cache -+ * @mapping: target address_space -+ * @index: the page index -+ * -+ * Same as grab_cache_page(), but do not wait if the page is unavailable. -+ * This is intended for speculative data generators, where the data can -+ * be regenerated if the page couldn't be grabbed. This routine should -+ * be safe to call while holding the lock for another page. -+ * -+ * Clear __GFP_FS when allocating the page to avoid recursion into the fs -+ * and deadlock against the caller's locked page. -+ */ -+static inline struct page *grab_cache_page_nowait(struct address_space *mapping, -+ pgoff_t index) -+{ -+ return pagecache_get_page(mapping, index, -+ FGP_LOCK|FGP_CREAT|FGP_NOFS|FGP_NOWAIT, -+ mapping_gfp_mask(mapping)); -+} -+ - struct page *find_get_entry(struct address_space *mapping, pgoff_t offset); --struct page *find_get_page(struct address_space *mapping, pgoff_t offset); - struct page *find_lock_entry(struct address_space *mapping, pgoff_t offset); --struct page *find_lock_page(struct address_space *mapping, pgoff_t offset); --struct page *find_or_create_page(struct address_space *mapping, pgoff_t index, -- gfp_t gfp_mask); - unsigned find_get_entries(struct address_space *mapping, pgoff_t start, - unsigned int nr_entries, struct page **entries, - pgoff_t *indices); -@@ -276,8 +372,6 @@ static inline struct page *grab_cache_page(struct address_space *mapping, - return find_or_create_page(mapping, index, mapping_gfp_mask(mapping)); - } - --extern struct page * grab_cache_page_nowait(struct address_space *mapping, -- pgoff_t index); - extern struct page * read_cache_page(struct address_space *mapping, - pgoff_t index, filler_t *filler, void *data); - extern struct page * read_cache_page_gfp(struct address_space *mapping, -diff --git a/include/linux/pci.h b/include/linux/pci.h -index 0e5e16c6f7f1..d662546f77d8 100644 ---- a/include/linux/pci.h -+++ b/include/linux/pci.h -@@ -170,6 +170,8 @@ enum pci_dev_flags { - PCI_DEV_FLAGS_NO_D3 = (__force pci_dev_flags_t) 2, - /* Provide indication device is assigned by a Virtual Machine Manager */ - PCI_DEV_FLAGS_ASSIGNED = (__force pci_dev_flags_t) 4, -+ /* Do not use bus resets for device */ -+ PCI_DEV_FLAGS_NO_BUS_RESET = (__force pci_dev_flags_t) (1 << 6), - }; - - enum pci_irq_reroute_variant { -diff --git a/include/linux/swap.h b/include/linux/swap.h -index 789324976801..241bf0922770 100644 ---- a/include/linux/swap.h -+++ b/include/linux/swap.h -@@ -268,12 +268,14 @@ extern unsigned long nr_free_pagecache_pages(void); - - - /* linux/mm/swap.c */ --extern void __lru_cache_add(struct page *); - extern void lru_cache_add(struct page *); -+extern void lru_cache_add_anon(struct page *page); -+extern void lru_cache_add_file(struct page *page); - extern void lru_add_page_tail(struct page *page, struct page *page_tail, - struct lruvec *lruvec, struct list_head *head); - extern void activate_page(struct page *); - extern void mark_page_accessed(struct page *); -+extern void init_page_accessed(struct page *page); - extern void lru_add_drain(void); - extern void lru_add_drain_cpu(int cpu); - extern void lru_add_drain_all(void); -@@ -283,22 +285,6 @@ extern void swap_setup(void); - - extern void add_page_to_unevictable_list(struct page *page); - --/** -- * lru_cache_add: add a page to the page lists -- * @page: the page to add -- */ --static inline void lru_cache_add_anon(struct page *page) --{ -- ClearPageActive(page); -- __lru_cache_add(page); --} -- --static inline void lru_cache_add_file(struct page *page) --{ -- ClearPageActive(page); -- __lru_cache_add(page); --} -- - /* linux/mm/vmscan.c */ - extern unsigned long try_to_free_pages(struct zonelist *zonelist, int order, - gfp_t gfp_mask, nodemask_t *mask); -@@ -456,7 +442,7 @@ mem_cgroup_uncharge_swapcache(struct page *page, swp_entry_t ent, bool swapout) - #define free_page_and_swap_cache(page) \ - page_cache_release(page) - #define free_pages_and_swap_cache(pages, nr) \ -- release_pages((pages), (nr), 0); -+ release_pages((pages), (nr), false); - - static inline void show_swap_cache_info(void) - { -diff --git a/include/linux/time.h b/include/linux/time.h -index d5d229b2e5af..7d532a32ff3a 100644 ---- a/include/linux/time.h -+++ b/include/linux/time.h -@@ -173,6 +173,19 @@ extern void getboottime(struct timespec *ts); - extern void monotonic_to_bootbased(struct timespec *ts); - extern void get_monotonic_boottime(struct timespec *ts); - -+static inline bool timeval_valid(const struct timeval *tv) -+{ -+ /* Dates before 1970 are bogus */ -+ if (tv->tv_sec < 0) -+ return false; -+ -+ /* Can't have more microseconds then a second */ -+ if (tv->tv_usec < 0 || tv->tv_usec >= USEC_PER_SEC) -+ return false; -+ -+ return true; -+} -+ - extern struct timespec timespec_trunc(struct timespec t, unsigned gran); - extern int timekeeping_valid_for_hres(void); - extern u64 timekeeping_max_deferment(void); -diff --git a/include/trace/events/pagemap.h b/include/trace/events/pagemap.h -index 1c9fabde69e4..ce0803b8d05f 100644 ---- a/include/trace/events/pagemap.h -+++ b/include/trace/events/pagemap.h -@@ -28,12 +28,10 @@ TRACE_EVENT(mm_lru_insertion, - - TP_PROTO( - struct page *page, -- unsigned long pfn, -- int lru, -- unsigned long flags -+ int lru - ), - -- TP_ARGS(page, pfn, lru, flags), -+ TP_ARGS(page, lru), - - TP_STRUCT__entry( - __field(struct page *, page ) -@@ -44,9 +42,9 @@ TRACE_EVENT(mm_lru_insertion, - - TP_fast_assign( - __entry->page = page; -- __entry->pfn = pfn; -+ __entry->pfn = page_to_pfn(page); - __entry->lru = lru; -- __entry->flags = flags; -+ __entry->flags = trace_pagemap_flags(page); - ), - - /* Flag format is based on page-types.c formatting for pagemap */ -@@ -64,9 +62,9 @@ TRACE_EVENT(mm_lru_insertion, - - TRACE_EVENT(mm_lru_activate, - -- TP_PROTO(struct page *page, unsigned long pfn), -+ TP_PROTO(struct page *page), - -- TP_ARGS(page, pfn), -+ TP_ARGS(page), - - TP_STRUCT__entry( - __field(struct page *, page ) -@@ -75,7 +73,7 @@ TRACE_EVENT(mm_lru_activate, - - TP_fast_assign( - __entry->page = page; -- __entry->pfn = pfn; -+ __entry->pfn = page_to_pfn(page); - ), - - /* Flag format is based on page-types.c formatting for pagemap */ -diff --git a/kernel/cpuset.c b/kernel/cpuset.c -index 15b3ea693225..2fb2877e6961 100644 ---- a/kernel/cpuset.c -+++ b/kernel/cpuset.c -@@ -61,12 +61,7 @@ - #include - #include - --/* -- * Tracks how many cpusets are currently defined in system. -- * When there is only one cpuset (the root cpuset) we can -- * short circuit some hooks. -- */ --int number_of_cpusets __read_mostly; -+struct static_key cpusets_enabled_key __read_mostly = STATIC_KEY_INIT_FALSE; - - /* See "Frequency meter" comments, below. */ - -@@ -611,7 +606,7 @@ static int generate_sched_domains(cpumask_var_t **domains, - goto done; - } - -- csa = kmalloc(number_of_cpusets * sizeof(cp), GFP_KERNEL); -+ csa = kmalloc(nr_cpusets() * sizeof(cp), GFP_KERNEL); - if (!csa) - goto done; - csn = 0; -@@ -1961,7 +1956,7 @@ static int cpuset_css_online(struct cgroup_subsys_state *css) - if (is_spread_slab(parent)) - set_bit(CS_SPREAD_SLAB, &cs->flags); - -- number_of_cpusets++; -+ cpuset_inc(); - - if (!test_bit(CGRP_CPUSET_CLONE_CHILDREN, &css->cgroup->flags)) - goto out_unlock; -@@ -2012,7 +2007,7 @@ static void cpuset_css_offline(struct cgroup_subsys_state *css) - if (is_sched_load_balance(cs)) - update_flag(CS_SCHED_LOAD_BALANCE, cs, 0); - -- number_of_cpusets--; -+ cpuset_dec(); - clear_bit(CS_ONLINE, &cs->flags); - - mutex_unlock(&cpuset_mutex); -@@ -2067,7 +2062,6 @@ int __init cpuset_init(void) - if (!alloc_cpumask_var(&cpus_attach, GFP_KERNEL)) - BUG(); - -- number_of_cpusets = 1; - return 0; - } - -diff --git a/kernel/time.c b/kernel/time.c -index 3c49ab45f822..3eb322e518a3 100644 ---- a/kernel/time.c -+++ b/kernel/time.c -@@ -195,6 +195,10 @@ SYSCALL_DEFINE2(settimeofday, struct timeval __user *, tv, - if (tv) { - if (copy_from_user(&user_tv, tv, sizeof(*tv))) - return -EFAULT; -+ -+ if (!timeval_valid(&user_tv)) -+ return -EINVAL; -+ - new_ts.tv_sec = user_tv.tv_sec; - new_ts.tv_nsec = user_tv.tv_usec * NSEC_PER_USEC; - } -diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c -index af8d1d4f3d55..28db9bedc857 100644 ---- a/kernel/time/ntp.c -+++ b/kernel/time/ntp.c -@@ -631,6 +631,13 @@ int ntp_validate_timex(struct timex *txc) - if ((txc->modes & ADJ_SETOFFSET) && (!capable(CAP_SYS_TIME))) - return -EPERM; - -+ if (txc->modes & ADJ_FREQUENCY) { -+ if (LONG_MIN / PPM_SCALE > txc->freq) -+ return -EINVAL; -+ if (LONG_MAX / PPM_SCALE < txc->freq) -+ return -EINVAL; -+ } -+ - return 0; - } - -diff --git a/mm/filemap.c b/mm/filemap.c -index bdaa21555abe..217cfd3b3264 100644 ---- a/mm/filemap.c -+++ b/mm/filemap.c -@@ -644,8 +644,17 @@ EXPORT_SYMBOL(unlock_page); - */ - void end_page_writeback(struct page *page) - { -- if (TestClearPageReclaim(page)) -+ /* -+ * TestClearPageReclaim could be used here but it is an atomic -+ * operation and overkill in this particular case. Failing to -+ * shuffle a page marked for immediate reclaim is too mild to -+ * justify taking an atomic operation penalty at the end of -+ * ever page writeback. -+ */ -+ if (PageReclaim(page)) { -+ ClearPageReclaim(page); - rotate_reclaimable_page(page); -+ } - - if (!test_clear_page_writeback(page)) - BUG(); -@@ -848,26 +857,6 @@ out: - EXPORT_SYMBOL(find_get_entry); - - /** -- * find_get_page - find and get a page reference -- * @mapping: the address_space to search -- * @offset: the page index -- * -- * Looks up the page cache slot at @mapping & @offset. If there is a -- * page cache page, it is returned with an increased refcount. -- * -- * Otherwise, %NULL is returned. -- */ --struct page *find_get_page(struct address_space *mapping, pgoff_t offset) --{ -- struct page *page = find_get_entry(mapping, offset); -- -- if (radix_tree_exceptional_entry(page)) -- page = NULL; -- return page; --} --EXPORT_SYMBOL(find_get_page); -- --/** - * find_lock_entry - locate, pin and lock a page cache entry - * @mapping: the address_space to search - * @offset: the page cache index -@@ -904,66 +893,83 @@ repeat: - EXPORT_SYMBOL(find_lock_entry); - - /** -- * find_lock_page - locate, pin and lock a pagecache page -+ * pagecache_get_page - find and get a page reference - * @mapping: the address_space to search - * @offset: the page index -+ * @fgp_flags: PCG flags -+ * @gfp_mask: gfp mask to use for the page cache data page allocation - * -- * Looks up the page cache slot at @mapping & @offset. If there is a -- * page cache page, it is returned locked and with an increased -- * refcount. -- * -- * Otherwise, %NULL is returned. -+ * Looks up the page cache slot at @mapping & @offset. - * -- * find_lock_page() may sleep. -- */ --struct page *find_lock_page(struct address_space *mapping, pgoff_t offset) --{ -- struct page *page = find_lock_entry(mapping, offset); -- -- if (radix_tree_exceptional_entry(page)) -- page = NULL; -- return page; --} --EXPORT_SYMBOL(find_lock_page); -- --/** -- * find_or_create_page - locate or add a pagecache page -- * @mapping: the page's address_space -- * @index: the page's index into the mapping -- * @gfp_mask: page allocation mode -+ * PCG flags modify how the page is returned - * -- * Looks up the page cache slot at @mapping & @offset. If there is a -- * page cache page, it is returned locked and with an increased -- * refcount. -- * -- * If the page is not present, a new page is allocated using @gfp_mask -- * and added to the page cache and the VM's LRU list. The page is -- * returned locked and with an increased refcount. -+ * FGP_ACCESSED: the page will be marked accessed -+ * FGP_LOCK: Page is return locked -+ * FGP_CREAT: If page is not present then a new page is allocated using -+ * @gfp_mask and added to the page cache and the VM's LRU -+ * list. The page is returned locked and with an increased -+ * refcount. Otherwise, %NULL is returned. - * -- * On memory exhaustion, %NULL is returned. -+ * If FGP_LOCK or FGP_CREAT are specified then the function may sleep even -+ * if the GFP flags specified for FGP_CREAT are atomic. - * -- * find_or_create_page() may sleep, even if @gfp_flags specifies an -- * atomic allocation! -+ * If there is a page cache page, it is returned with an increased refcount. - */ --struct page *find_or_create_page(struct address_space *mapping, -- pgoff_t index, gfp_t gfp_mask) -+struct page *pagecache_get_page(struct address_space *mapping, pgoff_t offset, -+ int fgp_flags, gfp_t gfp_mask) - { - struct page *page; -- int err; -+ - repeat: -- page = find_lock_page(mapping, index); -- if (!page) { -+ page = find_get_entry(mapping, offset); -+ if (radix_tree_exceptional_entry(page)) -+ page = NULL; -+ if (!page) -+ goto no_page; -+ -+ if (fgp_flags & FGP_LOCK) { -+ if (fgp_flags & FGP_NOWAIT) { -+ if (!trylock_page(page)) { -+ page_cache_release(page); -+ return NULL; -+ } -+ } else { -+ lock_page(page); -+ } -+ -+ /* Has the page been truncated? */ -+ if (unlikely(page->mapping != mapping)) { -+ unlock_page(page); -+ page_cache_release(page); -+ goto repeat; -+ } -+ VM_BUG_ON(page->index != offset); -+ } -+ -+ if (page && (fgp_flags & FGP_ACCESSED)) -+ mark_page_accessed(page); -+ -+no_page: -+ if (!page && (fgp_flags & FGP_CREAT)) { -+ int err; -+ if ((fgp_flags & FGP_WRITE) && mapping_cap_account_dirty(mapping)) -+ gfp_mask |= __GFP_WRITE; -+ if (fgp_flags & FGP_NOFS) -+ gfp_mask &= ~__GFP_FS; -+ - page = __page_cache_alloc(gfp_mask); - if (!page) - return NULL; -- /* -- * We want a regular kernel memory (not highmem or DMA etc) -- * allocation for the radix tree nodes, but we need to honour -- * the context-specific requirements the caller has asked for. -- * GFP_RECLAIM_MASK collects those requirements. -- */ -- err = add_to_page_cache_lru(page, mapping, index, -- (gfp_mask & GFP_RECLAIM_MASK)); -+ -+ if (WARN_ON_ONCE(!(fgp_flags & FGP_LOCK))) -+ fgp_flags |= FGP_LOCK; -+ -+ /* Init accessed so avoit atomic mark_page_accessed later */ -+ if (fgp_flags & FGP_ACCESSED) -+ init_page_accessed(page); -+ -+ err = add_to_page_cache_lru(page, mapping, offset, -+ gfp_mask & GFP_RECLAIM_MASK); - if (unlikely(err)) { - page_cache_release(page); - page = NULL; -@@ -971,9 +977,10 @@ repeat: - goto repeat; - } - } -+ - return page; - } --EXPORT_SYMBOL(find_or_create_page); -+EXPORT_SYMBOL(pagecache_get_page); - - /** - * find_get_entries - gang pagecache lookup -@@ -1263,39 +1270,6 @@ repeat: - } - EXPORT_SYMBOL(find_get_pages_tag); - --/** -- * grab_cache_page_nowait - returns locked page at given index in given cache -- * @mapping: target address_space -- * @index: the page index -- * -- * Same as grab_cache_page(), but do not wait if the page is unavailable. -- * This is intended for speculative data generators, where the data can -- * be regenerated if the page couldn't be grabbed. This routine should -- * be safe to call while holding the lock for another page. -- * -- * Clear __GFP_FS when allocating the page to avoid recursion into the fs -- * and deadlock against the caller's locked page. -- */ --struct page * --grab_cache_page_nowait(struct address_space *mapping, pgoff_t index) --{ -- struct page *page = find_get_page(mapping, index); -- -- if (page) { -- if (trylock_page(page)) -- return page; -- page_cache_release(page); -- return NULL; -- } -- page = __page_cache_alloc(mapping_gfp_mask(mapping) & ~__GFP_FS); -- if (page && add_to_page_cache_lru(page, mapping, index, GFP_NOFS)) { -- page_cache_release(page); -- page = NULL; -- } -- return page; --} --EXPORT_SYMBOL(grab_cache_page_nowait); -- - /* - * CD/DVDs are error prone. When a medium error occurs, the driver may fail - * a _large_ part of the i/o request. Imagine the worst scenario: -@@ -2397,7 +2371,6 @@ int pagecache_write_end(struct file *file, struct address_space *mapping, - { - const struct address_space_operations *aops = mapping->a_ops; - -- mark_page_accessed(page); - return aops->write_end(file, mapping, pos, len, copied, page, fsdata); - } - EXPORT_SYMBOL(pagecache_write_end); -@@ -2479,34 +2452,17 @@ EXPORT_SYMBOL(generic_file_direct_write); - struct page *grab_cache_page_write_begin(struct address_space *mapping, - pgoff_t index, unsigned flags) - { -- int status; -- gfp_t gfp_mask; - struct page *page; -- gfp_t gfp_notmask = 0; -+ int fgp_flags = FGP_LOCK|FGP_ACCESSED|FGP_WRITE|FGP_CREAT; - -- gfp_mask = mapping_gfp_mask(mapping); -- if (mapping_cap_account_dirty(mapping)) -- gfp_mask |= __GFP_WRITE; - if (flags & AOP_FLAG_NOFS) -- gfp_notmask = __GFP_FS; --repeat: -- page = find_lock_page(mapping, index); -+ fgp_flags |= FGP_NOFS; -+ -+ page = pagecache_get_page(mapping, index, fgp_flags, -+ mapping_gfp_mask(mapping)); - if (page) -- goto found; -+ wait_for_stable_page(page); - -- page = __page_cache_alloc(gfp_mask & ~gfp_notmask); -- if (!page) -- return NULL; -- status = add_to_page_cache_lru(page, mapping, index, -- GFP_KERNEL & ~gfp_notmask); -- if (unlikely(status)) { -- page_cache_release(page); -- if (status == -EEXIST) -- goto repeat; -- return NULL; -- } --found: -- wait_for_stable_page(page); - return page; - } - EXPORT_SYMBOL(grab_cache_page_write_begin); -@@ -2555,7 +2511,7 @@ again: - - status = a_ops->write_begin(file, mapping, pos, bytes, flags, - &page, &fsdata); -- if (unlikely(status)) -+ if (unlikely(status < 0)) - break; - - if (mapping_writably_mapped(mapping)) -@@ -2564,7 +2520,6 @@ again: - copied = iov_iter_copy_from_user_atomic(page, i, offset, bytes); - flush_dcache_page(page); - -- mark_page_accessed(page); - status = a_ops->write_end(file, mapping, pos, bytes, copied, - page, fsdata); - if (unlikely(status < 0)) -diff --git a/mm/huge_memory.c b/mm/huge_memory.c -index 331faa5c0d5e..adce656d2e9c 100644 ---- a/mm/huge_memory.c -+++ b/mm/huge_memory.c -@@ -2273,6 +2273,30 @@ static void khugepaged_alloc_sleep(void) - - static int khugepaged_node_load[MAX_NUMNODES]; - -+static bool khugepaged_scan_abort(int nid) -+{ -+ int i; -+ -+ /* -+ * If zone_reclaim_mode is disabled, then no extra effort is made to -+ * allocate memory locally. -+ */ -+ if (!zone_reclaim_mode) -+ return false; -+ -+ /* If there is a count for this node already, it must be acceptable */ -+ if (khugepaged_node_load[nid]) -+ return false; -+ -+ for (i = 0; i < MAX_NUMNODES; i++) { -+ if (!khugepaged_node_load[i]) -+ continue; -+ if (node_distance(nid, i) > RECLAIM_DISTANCE) -+ return true; -+ } -+ return false; -+} -+ - #ifdef CONFIG_NUMA - static int khugepaged_find_target_node(void) - { -@@ -2589,6 +2613,8 @@ static int khugepaged_scan_pmd(struct mm_struct *mm, - * hit record. - */ - node = page_to_nid(page); -+ if (khugepaged_scan_abort(node)) -+ goto out_unmap; - khugepaged_node_load[node]++; - VM_BUG_ON_PAGE(PageCompound(page), page); - if (!PageLRU(page) || PageLocked(page) || !PageAnon(page)) -diff --git a/mm/memory.c b/mm/memory.c -index 924429e5ef4d..7f30beaba74f 100644 ---- a/mm/memory.c -+++ b/mm/memory.c -@@ -878,7 +878,7 @@ out_set_pte: - return 0; - } - --int copy_pte_range(struct mm_struct *dst_mm, struct mm_struct *src_mm, -+static int copy_pte_range(struct mm_struct *dst_mm, struct mm_struct *src_mm, - pmd_t *dst_pmd, pmd_t *src_pmd, struct vm_area_struct *vma, - unsigned long addr, unsigned long end) - { -@@ -3646,7 +3646,7 @@ static int handle_pte_fault(struct mm_struct *mm, - pte_t entry; - spinlock_t *ptl; - -- entry = *pte; -+ entry = ACCESS_ONCE(*pte); - if (!pte_present(entry)) { - if (pte_none(entry)) { - if (vma->vm_ops) { -diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index 4b258297cc7c..ea419137f845 100644 ---- a/mm/page_alloc.c -+++ b/mm/page_alloc.c -@@ -432,7 +432,8 @@ - return bad; - } - --static inline void prep_zero_page(struct page *page, int order, gfp_t gfp_flags) -+static inline void prep_zero_page(struct page *page, unsigned int order, -+ gfp_t gfp_flags) - { - int i; - -@@ -476,7 +477,7 @@ - static inline void clear_page_guard_flag(struct page *page) { } - #endif - --static inline void set_page_order(struct page *page, int order) -+static inline void set_page_order(struct page *page, unsigned int order) - { - set_page_private(page, order); - __SetPageBuddy(page); -@@ -527,21 +528,31 @@ - * For recording page's order, we use page_private(page). - */ - static inline int page_is_buddy(struct page *page, struct page *buddy, -- int order) -+ unsigned int order) - { - if (!pfn_valid_within(page_to_pfn(buddy))) - return 0; - -- if (page_zone_id(page) != page_zone_id(buddy)) -- return 0; -- - if (page_is_guard(buddy) && page_order(buddy) == order) { - VM_BUG_ON_PAGE(page_count(buddy) != 0, buddy); -+ -+ if (page_zone_id(page) != page_zone_id(buddy)) -+ return 0; -+ - return 1; - } - - if (PageBuddy(buddy) && page_order(buddy) == order) { - VM_BUG_ON_PAGE(page_count(buddy) != 0, buddy); -+ -+ /* -+ * zone check is done late to avoid uselessly -+ * calculating zone/node ids for pages that could -+ * never merge. -+ */ -+ if (page_zone_id(page) != page_zone_id(buddy)) -+ return 0; -+ - return 1; - } - return 0; -@@ -573,6 +584,7 @@ - */ - - static inline void __free_one_page(struct page *page, -+ unsigned long pfn, - struct zone *zone, unsigned int order, - int migratetype) - { -@@ -589,7 +601,7 @@ - - VM_BUG_ON(migratetype == -1); - -- page_idx = page_to_pfn(page) & ((1 << MAX_ORDER) - 1); -+ page_idx = pfn & ((1 << MAX_ORDER) - 1); - - VM_BUG_ON_PAGE(page_idx & ((1 << order) - 1), page); - VM_BUG_ON_PAGE(bad_range(zone, page), page); -@@ -694,9 +706,12 @@ - int migratetype = 0; - int batch_free = 0; - int to_free = count; -+ unsigned long nr_scanned; - - spin_lock(&zone->lock); -- zone->pages_scanned = 0; -+ nr_scanned = zone_page_state(zone, NR_PAGES_SCANNED); -+ if (nr_scanned) -+ __mod_zone_page_state(zone, NR_PAGES_SCANNED, -nr_scanned); - - while (to_free) { - struct page *page; -@@ -728,7 +743,7 @@ - list_del(&page->lru); - mt = get_freepage_migratetype(page); - /* MIGRATE_MOVABLE list may include MIGRATE_RESERVEs */ -- __free_one_page(page, zone, 0, mt); -+ __free_one_page(page, page_to_pfn(page), zone, 0, mt); - trace_mm_page_pcpu_drain(page, 0, mt); - if (likely(!is_migrate_isolate_page(page))) { - __mod_zone_page_state(zone, NR_FREE_PAGES, 1); -@@ -740,13 +755,18 @@ - spin_unlock(&zone->lock); - } - --static void free_one_page(struct zone *zone, struct page *page, int order, -+static void free_one_page(struct zone *zone, -+ struct page *page, unsigned long pfn, -+ unsigned int order, - int migratetype) - { -+ unsigned long nr_scanned; - spin_lock(&zone->lock); -- zone->pages_scanned = 0; -+ nr_scanned = zone_page_state(zone, NR_PAGES_SCANNED); -+ if (nr_scanned) -+ __mod_zone_page_state(zone, NR_PAGES_SCANNED, -nr_scanned); - -- __free_one_page(page, zone, order, migratetype); -+ __free_one_page(page, pfn, zone, order, migratetype); - if (unlikely(!is_migrate_isolate(migratetype))) - __mod_zone_freepage_state(zone, 1 << order, migratetype); - spin_unlock(&zone->lock); -@@ -783,15 +803,16 @@ - { - unsigned long flags; - int migratetype; -+ unsigned long pfn = page_to_pfn(page); - - if (!free_pages_prepare(page, order)) - return; - -+ migratetype = get_pfnblock_migratetype(page, pfn); - local_irq_save(flags); - __count_vm_events(PGFREE, 1 << order); -- migratetype = get_pageblock_migratetype(page); - set_freepage_migratetype(page, migratetype); -- free_one_page(page_zone(page), page, order, migratetype); -+ free_one_page(page_zone(page), page, pfn, order, migratetype); - local_irq_restore(flags); - } - -@@ -924,7 +945,7 @@ - return 0; - } - --static int prep_new_page(struct page *page, int order, gfp_t gfp_flags) -+static int prep_new_page(struct page *page, unsigned int order, gfp_t gfp_flags) - { - int i; - -@@ -1147,10 +1168,10 @@ - - /* Remove an element from the buddy allocator from the fallback list */ - static inline struct page * --__rmqueue_fallback(struct zone *zone, int order, int start_migratetype) -+__rmqueue_fallback(struct zone *zone, unsigned int order, int start_migratetype) - { - struct free_area *area; -- int current_order; -+ unsigned int current_order; - struct page *page; - int migratetype, new_type, i; - #ifdef CONFIG_CMA -@@ -1159,7 +1180,7 @@ - - start_migratetype &= (~__GFP_BDEV); - /* Find the largest possible block of pages in the other list */ -- for (current_order = MAX_ORDER-1; current_order >= order; -+ for (current_order = MAX_ORDER-1; current_order >= order && current_order <= MAX_ORDER-1; - --current_order) { - for (i = 0;; i++) { - migratetype = fallbacks[start_migratetype][i]; -@@ -1276,7 +1297,7 @@ - */ - static int rmqueue_bulk(struct zone *zone, unsigned int order, - unsigned long count, struct list_head *list, -- int migratetype, int cold) -+ int migratetype, bool cold) - { - int i; - -@@ -1295,7 +1316,7 @@ - * merge IO requests if the physical pages are ordered - * properly. - */ -- if (likely(cold == 0)) -+ if (likely(!cold)) - list_add(&page->lru, list); - else - list_add_tail(&page->lru, list); -@@ -1424,7 +1445,7 @@ - { - unsigned long pfn, max_zone_pfn; - unsigned long flags; -- int order, t; -+ unsigned int order, t; - struct list_head *curr; - - if (zone_is_empty(zone)) -@@ -1456,19 +1477,20 @@ - - /* - * Free a 0-order page -- * cold == 1 ? free a cold page : free a hot page -+ * cold == true ? free a cold page : free a hot page - */ --void free_hot_cold_page(struct page *page, int cold) -+void free_hot_cold_page(struct page *page, bool cold) - { - struct zone *zone = page_zone(page); - struct per_cpu_pages *pcp; - unsigned long flags; -+ unsigned long pfn = page_to_pfn(page); - int migratetype; - - if (!free_pages_prepare(page, 0)) - return; - -- migratetype = get_pageblock_migratetype(page); -+ migratetype = get_pfnblock_migratetype(page, pfn); - set_freepage_migratetype(page, migratetype); - local_irq_save(flags); - __count_vm_event(PGFREE); -@@ -1483,17 +1505,17 @@ - if (migratetype >= MIGRATE_PCPTYPES) { - if (unlikely(is_migrate_isolate(migratetype)) - || unlikely(is_migrate_cma(migratetype))) { -- free_one_page(zone, page, 0, migratetype); -+ free_one_page(zone, page, pfn, 0, migratetype); - goto out; - } - migratetype = MIGRATE_MOVABLE; - } - - pcp = &this_cpu_ptr(zone->pageset)->pcp; -- if (cold) -- list_add_tail(&page->lru, &pcp->lists[migratetype]); -+ if (!cold) -+ list_add(&page->lru, &pcp->lists[migratetype]); - else -- list_add(&page->lru, &pcp->lists[migratetype]); -+ list_add_tail(&page->lru, &pcp->lists[migratetype]); - pcp->count++; - if (pcp->count >= pcp->high) { - unsigned long batch = ACCESS_ONCE(pcp->batch); -@@ -1508,7 +1530,7 @@ - /* - * Free a list of 0-order pages - */ --void free_hot_cold_page_list(struct list_head *list, int cold) -+void free_hot_cold_page_list(struct list_head *list, bool cold) - { - struct page *page, *next; - -@@ -1625,12 +1647,12 @@ - */ - static inline - struct page *buffered_rmqueue(struct zone *preferred_zone, -- struct zone *zone, int order, gfp_t gfp_flags, -+ struct zone *zone, unsigned int order, gfp_t gfp_flags, - int migratetype) - { - unsigned long flags; - struct page *page, *tmp_page = NULL; -- int cold = !!(gfp_flags & __GFP_COLD); -+ bool cold = ((gfp_flags & __GFP_COLD) != 0); - - again: - if (likely(order == 0)) { -@@ -1717,6 +1739,9 @@ - alloc_sucess: - #endif - __mod_zone_page_state(zone, NR_ALLOC_BATCH, -(1 << order)); -+ if (zone_page_state(zone, NR_ALLOC_BATCH) == 0 && -+ !zone_is_fair_depleted(zone)) -+ zone_set_flag(zone, ZONE_FAIR_DEPLETED); - - __count_zone_vm_events(PGALLOC, zone, 1 << order); - zone_statistics(preferred_zone, zone, gfp_flags); -@@ -1813,12 +1838,12 @@ - * Return true if free pages are above 'mark'. This takes into account the order - * of the allocation. - */ --static bool __zone_watermark_ok(struct zone *z, int order, unsigned long mark, -- int classzone_idx, int alloc_flags, long free_pages) -+static bool __zone_watermark_ok(struct zone *z, unsigned int order, -+ unsigned long mark, int classzone_idx, int alloc_flags, -+ long free_pages) - { - /* free_pages my go negative - that's OK */ - long min = mark; -- long lowmem_reserve = z->lowmem_reserve[classzone_idx]; - int o; - long free_cma = 0; - -@@ -1834,7 +1859,7 @@ - #endif - - free_pages -= free_cma; -- if (free_pages <= min + lowmem_reserve) -+ if (free_pages <= min + z->lowmem_reserve[classzone_idx]) - return false; - for (o = 0; o < order; o++) { - /* At the next order, this order's pages become unavailable */ -@@ -1853,15 +1878,15 @@ - return true; - } - --bool zone_watermark_ok(struct zone *z, int order, unsigned long mark, -+bool zone_watermark_ok(struct zone *z, unsigned int order, unsigned long mark, - int classzone_idx, int alloc_flags) - { - return __zone_watermark_ok(z, order, mark, classzone_idx, alloc_flags, - zone_page_state(z, NR_FREE_PAGES)); - } - --bool zone_watermark_ok_safe(struct zone *z, int order, unsigned long mark, -- int classzone_idx, int alloc_flags) -+bool zone_watermark_ok_safe(struct zone *z, unsigned int order, -+ unsigned long mark, int classzone_idx, int alloc_flags) - { - long free_pages = zone_page_state(z, NR_FREE_PAGES); - -@@ -2050,6 +2075,18 @@ - } - #endif /* CONFIG_NUMA */ - -+static void reset_alloc_batches(struct zone *preferred_zone) -+{ -+ struct zone *zone = preferred_zone->zone_pgdat->node_zones; -+ -+ do { -+ mod_zone_page_state(zone, NR_ALLOC_BATCH, -+ high_wmark_pages(zone) - low_wmark_pages(zone) - -+ atomic_long_read(&zone->vm_stat[NR_ALLOC_BATCH])); -+ zone_clear_flag(zone, ZONE_FAIR_DEPLETED); -+ } while (zone++ != preferred_zone); -+} -+ - /* - * get_page_from_freelist goes through the zonelist trying to allocate - * a page. -@@ -2057,18 +2094,22 @@ - static struct page * - get_page_from_freelist(gfp_t gfp_mask, nodemask_t *nodemask, unsigned int order, - struct zonelist *zonelist, int high_zoneidx, int alloc_flags, -- struct zone *preferred_zone, int migratetype) -+ struct zone *preferred_zone, int classzone_idx, int migratetype) - { - struct zoneref *z; - struct page *page = NULL; -- int classzone_idx; - struct zone *zone; - nodemask_t *allowednodes = NULL;/* zonelist_cache approximation */ - int zlc_active = 0; /* set if using zonelist_cache */ - int did_zlc_setup = 0; /* just call zlc_setup() one time */ -+ bool consider_zone_dirty = (alloc_flags & ALLOC_WMARK_LOW) && -+ (gfp_mask & __GFP_WRITE); -+ int nr_fair_skipped = 0; -+ bool zonelist_rescan; - -- classzone_idx = zone_idx(preferred_zone); - zonelist_scan: -+ zonelist_rescan = false; -+ - /* - * Scan zonelist, looking for a zone with enough free. - * See also __cpuset_node_allowed_softwall() comment in kernel/cpuset.c. -@@ -2080,12 +2121,10 @@ - if (IS_ENABLED(CONFIG_NUMA) && zlc_active && - !zlc_zone_worth_trying(zonelist, z, allowednodes)) - continue; -- if ((alloc_flags & ALLOC_CPUSET) && -+ if (cpusets_enabled() && -+ (alloc_flags & ALLOC_CPUSET) && - !cpuset_zone_allowed_softwall(zone, gfp_mask)) - continue; -- BUILD_BUG_ON(ALLOC_NO_WATERMARKS < NR_WMARK); -- if (unlikely(alloc_flags & ALLOC_NO_WATERMARKS)) -- goto try_this_zone; - /* - * Distribute pages in proportion to the individual - * zone size to ensure fair page aging. The zone a -@@ -2094,9 +2133,11 @@ - */ - if (alloc_flags & ALLOC_FAIR) { - if (!zone_local(preferred_zone, zone)) -+ break; -+ if (zone_is_fair_depleted(zone)) { -+ nr_fair_skipped++; - continue; -- if (atomic_long_read(&zone->vm_stat[NR_ALLOC_BATCH]) <= 0) -- continue; -+ } - } - /* - * When allocating a page cache page for writing, we -@@ -2124,15 +2165,19 @@ - * will require awareness of zones in the - * dirty-throttling and the flusher threads. - */ -- if ((alloc_flags & ALLOC_WMARK_LOW) && -- (gfp_mask & __GFP_WRITE) && !zone_dirty_ok(zone)) -- goto this_zone_full; -+ if (consider_zone_dirty && !zone_dirty_ok(zone)) -+ continue; - - mark = zone->watermark[alloc_flags & ALLOC_WMARK_MASK]; - if (!zone_watermark_ok(zone, order, mark, - classzone_idx, alloc_flags)) { - int ret; - -+ /* Checked here to keep the fast path fast */ -+ BUILD_BUG_ON(ALLOC_NO_WATERMARKS < NR_WMARK); -+ if (alloc_flags & ALLOC_NO_WATERMARKS) -+ goto try_this_zone; -+ - if (IS_ENABLED(CONFIG_NUMA) && - !did_zlc_setup && nr_online_nodes > 1) { - /* -@@ -2194,17 +2239,11 @@ - if (page) - break; - this_zone_full: -- if (IS_ENABLED(CONFIG_NUMA)) -+ if (IS_ENABLED(CONFIG_NUMA) && zlc_active) - zlc_mark_zone_full(zonelist, z); - } - -- if (unlikely(IS_ENABLED(CONFIG_NUMA) && page == NULL && zlc_active)) { -- /* Disable zlc cache for second zonelist scan */ -- zlc_active = 0; -- goto zonelist_scan; -- } -- -- if (page) -+ if (page) { - /* - * page->pfmemalloc is set when ALLOC_NO_WATERMARKS was - * necessary to allocate the page. The expectation is -@@ -2213,8 +2252,37 @@ - * for !PFMEMALLOC purposes. - */ - page->pfmemalloc = !!(alloc_flags & ALLOC_NO_WATERMARKS); -+ return page; -+ } - -- return page; -+ /* -+ * The first pass makes sure allocations are spread fairly within the -+ * local node. However, the local node might have free pages left -+ * after the fairness batches are exhausted, and remote zones haven't -+ * even been considered yet. Try once more without fairness, and -+ * include remote zones now, before entering the slowpath and waking -+ * kswapd: prefer spilling to a remote zone over swapping locally. -+ */ -+ if (alloc_flags & ALLOC_FAIR) { -+ alloc_flags &= ~ALLOC_FAIR; -+ if (nr_fair_skipped) { -+ zonelist_rescan = true; -+ reset_alloc_batches(preferred_zone); -+ } -+ if (nr_online_nodes > 1) -+ zonelist_rescan = true; -+ } -+ -+ if (unlikely(IS_ENABLED(CONFIG_NUMA) && zlc_active)) { -+ /* Disable zlc cache for second zonelist scan */ -+ zlc_active = 0; -+ zonelist_rescan = true; -+ } -+ -+ if (zonelist_rescan) -+ goto zonelist_scan; -+ -+ return NULL; - } - - /* -@@ -2323,7 +2391,7 @@ - __alloc_pages_may_oom(gfp_t gfp_mask, unsigned int order, - struct zonelist *zonelist, enum zone_type high_zoneidx, - nodemask_t *nodemask, struct zone *preferred_zone, -- int migratetype) -+ int classzone_idx, int migratetype) - { - struct page *page; - -@@ -2349,7 +2417,7 @@ - page = get_page_from_freelist(gfp_mask|__GFP_HARDWALL, nodemask, - order, zonelist, high_zoneidx, - ALLOC_WMARK_HIGH|ALLOC_CPUSET, -- preferred_zone, migratetype); -+ preferred_zone, classzone_idx, migratetype); - if (page) - goto out; - -@@ -2384,7 +2452,7 @@ - __alloc_pages_direct_compact(gfp_t gfp_mask, unsigned int order, - struct zonelist *zonelist, enum zone_type high_zoneidx, - nodemask_t *nodemask, int alloc_flags, struct zone *preferred_zone, -- int migratetype, enum migrate_mode mode, -+ int classzone_idx, int migratetype, enum migrate_mode mode, - bool *contended_compaction, bool *deferred_compaction, - unsigned long *did_some_progress) - { -@@ -2412,7 +2480,7 @@ - page = get_page_from_freelist(gfp_mask, nodemask, - order, zonelist, high_zoneidx, - alloc_flags & ~ALLOC_NO_WATERMARKS, -- preferred_zone, migratetype); -+ preferred_zone, classzone_idx, migratetype); - if (page) { - preferred_zone->compact_blockskip_flush = false; - compaction_defer_reset(preferred_zone, order, true); -@@ -2444,7 +2512,8 @@ - __alloc_pages_direct_compact(gfp_t gfp_mask, unsigned int order, - struct zonelist *zonelist, enum zone_type high_zoneidx, - nodemask_t *nodemask, int alloc_flags, struct zone *preferred_zone, -- int migratetype, enum migrate_mode mode, bool *contended_compaction, -+ int classzone_idx, int migratetype, -+ enum migrate_mode mode, bool *contended_compaction, - bool *deferred_compaction, unsigned long *did_some_progress) - { - return NULL; -@@ -2484,7 +2553,7 @@ - __alloc_pages_direct_reclaim(gfp_t gfp_mask, unsigned int order, - struct zonelist *zonelist, enum zone_type high_zoneidx, - nodemask_t *nodemask, int alloc_flags, struct zone *preferred_zone, -- int migratetype, unsigned long *did_some_progress) -+ int classzone_idx, int migratetype, unsigned long *did_some_progress) - { - struct page *page = NULL; - bool drained = false; -@@ -2502,7 +2571,8 @@ - page = get_page_from_freelist(gfp_mask, nodemask, order, - zonelist, high_zoneidx, - alloc_flags & ~ALLOC_NO_WATERMARKS, -- preferred_zone, migratetype); -+ preferred_zone, classzone_idx, -+ migratetype); - - /* - * If an allocation failed after direct reclaim, it could be because -@@ -2525,14 +2595,14 @@ - __alloc_pages_high_priority(gfp_t gfp_mask, unsigned int order, - struct zonelist *zonelist, enum zone_type high_zoneidx, - nodemask_t *nodemask, struct zone *preferred_zone, -- int migratetype) -+ int classzone_idx, int migratetype) - { - struct page *page; - - do { - page = get_page_from_freelist(gfp_mask, nodemask, order, - zonelist, high_zoneidx, ALLOC_NO_WATERMARKS, -- preferred_zone, migratetype); -+ preferred_zone, classzone_idx, migratetype); - - if (!page && gfp_mask & __GFP_NOFAIL) - wait_iff_congested(preferred_zone, BLK_RW_ASYNC, HZ/50); -@@ -2541,28 +2611,6 @@ - return page; - } - --static void reset_alloc_batches(struct zonelist *zonelist, -- enum zone_type high_zoneidx, -- struct zone *preferred_zone) --{ -- struct zoneref *z; -- struct zone *zone; -- -- for_each_zone_zonelist(zone, z, zonelist, high_zoneidx) { -- /* -- * Only reset the batches of zones that were actually -- * considered in the fairness pass, we don't want to -- * trash fairness information for zones that are not -- * actually part of this zonelist's round-robin cycle. -- */ -- if (!zone_local(preferred_zone, zone)) -- continue; -- mod_zone_page_state(zone, NR_ALLOC_BATCH, -- high_wmark_pages(zone) - low_wmark_pages(zone) - -- atomic_long_read(&zone->vm_stat[NR_ALLOC_BATCH])); -- } --} -- - static void wake_all_kswapds(unsigned int order, - struct zonelist *zonelist, - enum zone_type high_zoneidx, -@@ -2633,7 +2681,7 @@ - __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order, - struct zonelist *zonelist, enum zone_type high_zoneidx, - nodemask_t *nodemask, struct zone *preferred_zone, -- int migratetype) -+ int classzone_idx, int migratetype) - { - const gfp_t wait = gfp_mask & __GFP_WAIT; - struct page *page = NULL; -@@ -2682,15 +2730,19 @@ - * Find the true preferred zone if the allocation is unconstrained by - * cpusets. - */ -- if (!(alloc_flags & ALLOC_CPUSET) && !nodemask) -- first_zones_zonelist(zonelist, high_zoneidx, NULL, -- &preferred_zone); -+ if (!(alloc_flags & ALLOC_CPUSET) && !nodemask) { -+ struct zoneref *preferred_zoneref; -+ preferred_zoneref = first_zones_zonelist(zonelist, high_zoneidx, -+ NULL, -+ &preferred_zone); -+ classzone_idx = zonelist_zone_idx(preferred_zoneref); -+ } - - rebalance: - /* This is the last chance, in general, before the goto nopage. */ - page = get_page_from_freelist(gfp_mask, nodemask, order, zonelist, - high_zoneidx, alloc_flags & ~ALLOC_NO_WATERMARKS, -- preferred_zone, migratetype); -+ preferred_zone, classzone_idx, migratetype); - if (page) - goto got_pg; - -@@ -2705,7 +2757,7 @@ - - page = __alloc_pages_high_priority(gfp_mask, order, - zonelist, high_zoneidx, nodemask, -- preferred_zone, migratetype); -+ preferred_zone, classzone_idx, migratetype); - if (page) { - goto got_pg; - } -@@ -2736,7 +2788,8 @@ - */ - page = __alloc_pages_direct_compact(gfp_mask, order, zonelist, - high_zoneidx, nodemask, alloc_flags, -- preferred_zone, migratetype, -+ preferred_zone, -+ classzone_idx, migratetype, - migration_mode, &contended_compaction, - &deferred_compaction, - &did_some_progress); -@@ -2759,7 +2812,8 @@ - zonelist, high_zoneidx, - nodemask, - alloc_flags, preferred_zone, -- migratetype, &did_some_progress); -+ classzone_idx, migratetype, -+ &did_some_progress); - if (page) - goto got_pg; - -@@ -2778,7 +2832,7 @@ - page = __alloc_pages_may_oom(gfp_mask, order, - zonelist, high_zoneidx, - nodemask, preferred_zone, -- migratetype); -+ classzone_idx, migratetype); - if (page) - goto got_pg; - -@@ -2819,7 +2873,8 @@ - */ - page = __alloc_pages_direct_compact(gfp_mask, order, zonelist, - high_zoneidx, nodemask, alloc_flags, -- preferred_zone, migratetype, -+ preferred_zone, -+ classzone_idx, migratetype, - migration_mode, &contended_compaction, - &deferred_compaction, - &did_some_progress); -@@ -2846,11 +2901,13 @@ - { - enum zone_type high_zoneidx = gfp_zone(gfp_mask); - struct zone *preferred_zone; -+ struct zoneref *preferred_zoneref; - struct page *page = NULL; - int migratetype = allocflags_to_migratetype(gfp_mask); - unsigned int cpuset_mems_cookie; - int alloc_flags = ALLOC_WMARK_LOW|ALLOC_CPUSET|ALLOC_FAIR; - struct mem_cgroup *memcg = NULL; -+ int classzone_idx; - - gfp_mask &= gfp_allowed_mask; - -@@ -2880,17 +2937,17 @@ - cpuset_mems_cookie = read_mems_allowed_begin(); - - /* The preferred zone is used for statistics later */ -- first_zones_zonelist(zonelist, high_zoneidx, -+ preferred_zoneref = first_zones_zonelist(zonelist, high_zoneidx, - nodemask ? : &cpuset_current_mems_allowed, - &preferred_zone); - if (!preferred_zone) - goto out; -+ classzone_idx = zonelist_zone_idx(preferred_zoneref); - - #ifdef CONFIG_CMA - if (allocflags_to_migratetype(gfp_mask) == MIGRATE_MOVABLE) - alloc_flags |= ALLOC_CMA; - #endif --retry: - if (global_page_state(NR_FREE_PAGES) - - global_page_state(NR_FREE_CMA_PAGES) - < mem_management_thresh) -@@ -2900,7 +2957,7 @@ - /* First allocation attempt */ - page = get_page_from_freelist(gfp_mask|__GFP_HARDWALL, nodemask, order, - zonelist, high_zoneidx, alloc_flags, -- preferred_zone, migratetype); -+ preferred_zone, classzone_idx, migratetype); - if (unlikely(!page)) { - /* - * The first pass makes sure allocations are spread -@@ -2911,14 +2968,6 @@ - * fairness, and include remote zones now, before - * entering the slowpath and waking kswapd: prefer - * spilling to a remote zone over swapping locally. -- */ -- if (alloc_flags & ALLOC_FAIR) { -- reset_alloc_batches(zonelist, high_zoneidx, -- preferred_zone); -- alloc_flags &= ~ALLOC_FAIR; -- goto retry; -- } -- /* - * Runtime PM, block IO and its error handling path - * can deadlock because I/O on the device might not - * complete. -@@ -2926,7 +2975,7 @@ - gfp_mask = memalloc_noio_flags(gfp_mask); - page = __alloc_pages_slowpath(gfp_mask, order, - zonelist, high_zoneidx, nodemask, -- preferred_zone, migratetype); -+ preferred_zone, classzone_idx, migratetype); - } - - trace_mm_page_alloc(page, order, gfp_mask, migratetype); -@@ -2976,7 +3025,7 @@ - { - if (put_page_testzero(page)) { - if (order == 0) -- free_hot_cold_page(page, 0); -+ free_hot_cold_page(page, false); - else - __free_pages_ok(page, order); - } -@@ -3361,12 +3410,12 @@ - K(zone_page_state(zone, NR_BOUNCE)), - K(zone_page_state(zone, NR_FREE_CMA_PAGES)), - K(zone_page_state(zone, NR_WRITEBACK_TEMP)), -- zone->pages_scanned, -+ K(zone_page_state(zone, NR_PAGES_SCANNED)), - (!zone_reclaimable(zone) ? "yes" : "no") - ); - printk("lowmem_reserve[]:"); - for (i = 0; i < MAX_NR_ZONES; i++) -- printk(" %lu", zone->lowmem_reserve[i]); -+ printk(" %ld", zone->lowmem_reserve[i]); - printk("\n"); - } - -@@ -4254,7 +4303,7 @@ - - static void __meminit zone_init_free_lists(struct zone *zone) - { -- int order, t; -+ unsigned int order, t; - for_each_migratetype_order(order, t) { - INIT_LIST_HEAD(&zone->free_area[order].free_list[t]); - zone->free_area[order].nr_free = 0; -@@ -5695,7 +5744,7 @@ - for_each_online_pgdat(pgdat) { - for (i = 0; i < MAX_NR_ZONES; i++) { - struct zone *zone = pgdat->node_zones + i; -- unsigned long max = 0; -+ long max = 0; - - /* Find valid and maximum lowmem_reserve in the zone */ - for (j = i; j < MAX_NR_ZONES; j++) { -@@ -6188,17 +6237,16 @@ - * @end_bitidx: The last bit of interest - * returns pageblock_bits flags - */ --unsigned long get_pageblock_flags_mask(struct page *page, -+unsigned long get_pfnblock_flags_mask(struct page *page, unsigned long pfn, - unsigned long end_bitidx, - unsigned long mask) - { - struct zone *zone; - unsigned long *bitmap; -- unsigned long pfn, bitidx, word_bitidx; -+ unsigned long bitidx, word_bitidx; - unsigned long word; - - zone = page_zone(page); -- pfn = page_to_pfn(page); - bitmap = get_pageblock_bitmap(zone, pfn); - bitidx = pfn_to_bitidx(zone, pfn); - word_bitidx = bitidx / BITS_PER_LONG; -@@ -6210,25 +6258,25 @@ - } - - /** -- * set_pageblock_flags_mask - Set the requested group of flags for a pageblock_nr_pages block of pages -+ * set_pfnblock_flags_mask - Set the requested group of flags for a pageblock_nr_pages block of pages - * @page: The page within the block of interest - * @start_bitidx: The first bit of interest - * @end_bitidx: The last bit of interest - * @flags: The flags to set - */ --void set_pageblock_flags_mask(struct page *page, unsigned long flags, -+void set_pfnblock_flags_mask(struct page *page, unsigned long flags, -+ unsigned long pfn, - unsigned long end_bitidx, - unsigned long mask) - { - struct zone *zone; - unsigned long *bitmap; -- unsigned long pfn, bitidx, word_bitidx; -+ unsigned long bitidx, word_bitidx; - unsigned long old_word, word; - - BUILD_BUG_ON(NR_PAGEBLOCK_BITS != 4); - - zone = page_zone(page); -- pfn = page_to_pfn(page); - bitmap = get_pageblock_bitmap(zone, pfn); - bitidx = pfn_to_bitidx(zone, pfn); - word_bitidx = bitidx / BITS_PER_LONG; -@@ -6608,7 +6656,7 @@ - { - struct page *page; - struct zone *zone; -- int order, i; -+ unsigned int order, i; - unsigned long pfn; - unsigned long flags; - /* find the first valid pfn */ -@@ -6662,7 +6710,7 @@ - struct zone *zone = page_zone(page); - unsigned long pfn = page_to_pfn(page); - unsigned long flags; -- int order; -+ unsigned int order; - - spin_lock_irqsave(&zone->lock, flags); - for (order = 0; order < MAX_ORDER; order++) { -diff --git a/mm/shmem.c b/mm/shmem.c -index 0f1447563f17..85d8a1a3626c 100644 ---- a/mm/shmem.c -+++ b/mm/shmem.c -@@ -1035,6 +1035,9 @@ repeat: - goto failed; - } - -+ if (page && sgp == SGP_WRITE) -+ mark_page_accessed(page); -+ - /* fallocated page? */ - if (page && !PageUptodate(page)) { - if (sgp != SGP_READ) -@@ -1116,6 +1119,9 @@ repeat: - shmem_recalc_inode(inode); - spin_unlock(&info->lock); - -+ if (sgp == SGP_WRITE) -+ mark_page_accessed(page); -+ - delete_from_swap_cache(page); - set_page_dirty(page); - swap_free(swap); -@@ -1140,8 +1146,11 @@ repeat: - goto decused; - } - -- SetPageSwapBacked(page); -+ __SetPageSwapBacked(page); - __set_page_locked(page); -+ if (sgp == SGP_WRITE) -+ init_page_accessed(page); -+ - error = mem_cgroup_cache_charge(page, current->mm, - gfp & GFP_RECLAIM_MASK); - if (error) -diff --git a/mm/swap.c b/mm/swap.c -index c8048d71c642..d2ceddf70d42 100644 ---- a/mm/swap.c -+++ b/mm/swap.c -@@ -67,7 +67,7 @@ static void __page_cache_release(struct page *page) - static void __put_single_page(struct page *page) - { - __page_cache_release(page); -- free_hot_cold_page(page, 0); -+ free_hot_cold_page(page, false); - } - - static void __put_compound_page(struct page *page) -@@ -469,7 +469,7 @@ static void __activate_page(struct page *page, struct lruvec *lruvec, - SetPageActive(page); - lru += LRU_ACTIVE; - add_page_to_lru_list(page, lruvec, lru); -- trace_mm_lru_activate(page, page_to_pfn(page)); -+ trace_mm_lru_activate(page); - - __count_vm_event(PGACTIVATE); - update_page_reclaim_stat(lruvec, file, 1); -@@ -581,12 +581,17 @@ void mark_page_accessed(struct page *page) - EXPORT_SYMBOL(mark_page_accessed); - - /* -- * Queue the page for addition to the LRU via pagevec. The decision on whether -- * to add the page to the [in]active [file|anon] list is deferred until the -- * pagevec is drained. This gives a chance for the caller of __lru_cache_add() -- * have the page added to the active list using mark_page_accessed(). -+ * Used to mark_page_accessed(page) that is not visible yet and when it is -+ * still safe to use non-atomic ops - */ --void __lru_cache_add(struct page *page) -+void init_page_accessed(struct page *page) -+{ -+ if (!PageReferenced(page)) -+ __SetPageReferenced(page); -+} -+EXPORT_SYMBOL(init_page_accessed); -+ -+static void __lru_cache_add(struct page *page) - { - struct pagevec *pvec = &get_cpu_var(lru_add_pvec); - -@@ -596,11 +601,34 @@ void __lru_cache_add(struct page *page) - pagevec_add(pvec, page); - put_cpu_var(lru_add_pvec); - } --EXPORT_SYMBOL(__lru_cache_add); -+ -+/** -+ * lru_cache_add: add a page to the page lists -+ * @page: the page to add -+ */ -+void lru_cache_add_anon(struct page *page) -+{ -+ if (PageActive(page)) -+ ClearPageActive(page); -+ __lru_cache_add(page); -+} -+ -+void lru_cache_add_file(struct page *page) -+{ -+ if (PageActive(page)) -+ ClearPageActive(page); -+ __lru_cache_add(page); -+} -+EXPORT_SYMBOL(lru_cache_add_file); - - /** - * lru_cache_add - add a page to a page list - * @page: the page to be added to the LRU. -+ * -+ * Queue the page for addition to the LRU via pagevec. The decision on whether -+ * to add the page to the [in]active [file|anon] list is deferred until the -+ * pagevec is drained. This gives a chance for the caller of lru_cache_add() -+ * have the page added to the active list using mark_page_accessed(). - */ - void lru_cache_add(struct page *page) - { -@@ -811,7 +839,7 @@ void lru_add_drain_all(void) - * grabbed the page via the LRU. If it did, give up: shrink_inactive_list() - * will free it. - */ --void release_pages(struct page **pages, int nr, int cold) -+void release_pages(struct page **pages, int nr, bool cold) - { - int i; - LIST_HEAD(pages_to_free); -@@ -852,7 +880,7 @@ void release_pages(struct page **pages, int nr, int cold) - } - - /* Clear Active bit in case of parallel mark_page_accessed */ -- ClearPageActive(page); -+ __ClearPageActive(page); - - list_add(&page->lru, &pages_to_free); - } -@@ -934,7 +962,7 @@ static void __pagevec_lru_add_fn(struct page *page, struct lruvec *lruvec, - SetPageLRU(page); - add_page_to_lru_list(page, lruvec, lru); - update_page_reclaim_stat(lruvec, file, active); -- trace_mm_lru_insertion(page, page_to_pfn(page), lru, trace_pagemap_flags(page)); -+ trace_mm_lru_insertion(page, lru); - } - - /* -diff --git a/mm/swap_state.c b/mm/swap_state.c -index e76ace30d436..2972eee184a4 100644 ---- a/mm/swap_state.c -+++ b/mm/swap_state.c -@@ -270,7 +270,7 @@ void free_pages_and_swap_cache(struct page **pages, int nr) - - for (i = 0; i < todo; i++) - free_swap_cache(pagep[i]); -- release_pages(pagep, todo, 0); -+ release_pages(pagep, todo, false); - pagep += todo; - nr -= todo; - } -diff --git a/mm/vmalloc.c b/mm/vmalloc.c -index 0fdf96803c5b..aa3891e8e388 100644 ---- a/mm/vmalloc.c -+++ b/mm/vmalloc.c -@@ -2681,14 +2681,14 @@ void get_vmalloc_info(struct vmalloc_info *vmi) - - prev_end = VMALLOC_START; - -- spin_lock(&vmap_area_lock); -+ rcu_read_lock(); - - if (list_empty(&vmap_area_list)) { - vmi->largest_chunk = VMALLOC_TOTAL; - goto out; - } - -- list_for_each_entry(va, &vmap_area_list, list) { -+ list_for_each_entry_rcu(va, &vmap_area_list, list) { - unsigned long addr = va->va_start; - - /* -@@ -2715,7 +2715,7 @@ void get_vmalloc_info(struct vmalloc_info *vmi) - vmi->largest_chunk = VMALLOC_END - prev_end; - - out: -- spin_unlock(&vmap_area_lock); -+ rcu_read_unlock(); - } - #endif - -diff --git a/mm/vmscan.c b/mm/vmscan.c -index be6a689a71a6..b850ced69ed6 100644 ---- a/mm/vmscan.c -+++ b/mm/vmscan.c -@@ -163,7 +163,8 @@ static unsigned long zone_reclaimable_pages(struct zone *zone) - - bool zone_reclaimable(struct zone *zone) - { -- return zone->pages_scanned < zone_reclaimable_pages(zone) * 6; -+ return zone_page_state(zone, NR_PAGES_SCANNED) < -+ zone_reclaimable_pages(zone) * 6; - } - - static unsigned long get_lru_size(struct lruvec *lruvec, enum lru_list lru) -@@ -1107,7 +1108,7 @@ keep: - VM_BUG_ON_PAGE(PageLRU(page) || PageUnevictable(page), page); - } - -- free_hot_cold_page_list(&free_pages, 1); -+ free_hot_cold_page_list(&free_pages, true); - - list_splice(&ret_pages, page_list); - count_vm_events(PGACTIVATE, pgactivate); -@@ -1470,7 +1471,7 @@ shrink_inactive_list(unsigned long nr_to_scan, struct lruvec *lruvec, - __mod_zone_page_state(zone, NR_ISOLATED_ANON + file, nr_taken); - - if (global_reclaim(sc)) { -- zone->pages_scanned += nr_scanned; -+ __mod_zone_page_state(zone, NR_PAGES_SCANNED, nr_scanned); - if (current_is_kswapd()) - __count_zone_vm_events(PGSCAN_KSWAPD, zone, nr_scanned); - else -@@ -1690,7 +1691,7 @@ shrink_inactive_list(unsigned long nr_to_scan, struct lruvec *lruvec, - - spin_unlock_irq(&zone->lru_lock); - -- free_hot_cold_page_list(&page_list, 1); -+ free_hot_cold_page_list(&page_list, true); - #ifdef CONFIG_CMA - wakeup_wq(has_cma); - #endif -@@ -1659,7 +1660,7 @@ static void shrink_active_list(unsigned long nr_to_scan, - nr_taken = isolate_lru_pages(nr_to_scan, lruvec, &l_hold, - &nr_scanned, sc, isolate_mode, lru); - if (global_reclaim(sc)) -- zone->pages_scanned += nr_scanned; -+ __mod_zone_page_state(zone, NR_PAGES_SCANNED, nr_scanned); - - reclaim_stat->recent_scanned[file] += nr_taken; - -@@ -1725,7 +1726,7 @@ static void shrink_active_list(unsigned long nr_to_scan, - __mod_zone_page_state(zone, NR_ISOLATED_ANON + file, -nr_taken); - spin_unlock_irq(&zone->lru_lock); - -- free_hot_cold_page_list(&l_hold, 1); -+ free_hot_cold_page_list(&l_hold, true); - } - - #ifdef CONFIG_SWAP -@@ -1847,7 +1848,7 @@ static void get_scan_count(struct lruvec *lruvec, struct scan_control *sc, - struct zone *zone = lruvec_zone(lruvec); - unsigned long anon_prio, file_prio; - enum scan_balance scan_balance; -- unsigned long anon, file, free; -+ unsigned long anon, file; - bool force_scan = false; - unsigned long ap, fp; - enum lru_list lru; -@@ -1895,11 +1896,6 @@ static void get_scan_count(struct lruvec *lruvec, struct scan_control *sc, - goto out; - } - -- anon = get_lru_size(lruvec, LRU_ACTIVE_ANON) + -- get_lru_size(lruvec, LRU_INACTIVE_ANON); -- file = get_lru_size(lruvec, LRU_ACTIVE_FILE) + -- get_lru_size(lruvec, LRU_INACTIVE_FILE); -- - /* - * If it's foreseeable that reclaiming the file cache won't be - * enough to get the zone back into a desirable shape, we have -@@ -1907,8 +1903,14 @@ static void get_scan_count(struct lruvec *lruvec, struct scan_control *sc, - * thrashing - remaining file pages alone. - */ - if (global_reclaim(sc)) { -- free = zone_page_state(zone, NR_FREE_PAGES); -- if (unlikely(file + free <= high_wmark_pages(zone))) { -+ unsigned long zonefile; -+ unsigned long zonefree; -+ -+ zonefree = zone_page_state(zone, NR_FREE_PAGES); -+ zonefile = zone_page_state(zone, NR_ACTIVE_FILE) + -+ zone_page_state(zone, NR_INACTIVE_FILE); -+ -+ if (unlikely(zonefile + zonefree <= high_wmark_pages(zone))) { - scan_balance = SCAN_ANON; - goto out; - } -@@ -1943,6 +1945,12 @@ static void get_scan_count(struct lruvec *lruvec, struct scan_control *sc, - * - * anon in [0], file in [1] - */ -+ -+ anon = get_lru_size(lruvec, LRU_ACTIVE_ANON) + -+ get_lru_size(lruvec, LRU_INACTIVE_ANON); -+ file = get_lru_size(lruvec, LRU_ACTIVE_FILE) + -+ get_lru_size(lruvec, LRU_INACTIVE_FILE); -+ - spin_lock_irq(&zone->lru_lock); - if (unlikely(reclaim_stat->recent_scanned[0] > anon / 4)) { - reclaim_stat->recent_scanned[0] /= 2; -diff --git a/mm/vmstat.c b/mm/vmstat.c -index def5dd2fbe61..eded1909a690 100644 ---- a/mm/vmstat.c -+++ b/mm/vmstat.c -@@ -200,7 +200,7 @@ void set_pgdat_percpu_threshold(pg_data_t *pgdat, - continue; - - threshold = (*calculate_pressure)(zone); -- for_each_possible_cpu(cpu) -+ for_each_online_cpu(cpu) - per_cpu_ptr(zone->pageset, cpu)->stat_threshold - = threshold; - } -@@ -761,6 +761,7 @@ const char * const vmstat_text[] = { - "nr_shmem", - "nr_dirtied", - "nr_written", -+ "nr_pages_scanned", - - #ifdef CONFIG_NUMA - "numa_hit", -@@ -1055,7 +1056,7 @@ static void zoneinfo_show_print(struct seq_file *m, pg_data_t *pgdat, - min_wmark_pages(zone), - low_wmark_pages(zone), - high_wmark_pages(zone), -- zone->pages_scanned, -+ zone_page_state(zone, NR_PAGES_SCANNED), - zone->spanned_pages, - zone->present_pages, - zone->managed_pages); -@@ -1065,10 +1066,10 @@ static void zoneinfo_show_print(struct seq_file *m, pg_data_t *pgdat, - zone_page_state(zone, i)); - - seq_printf(m, -- "\n protection: (%lu", -+ "\n protection: (%ld", - zone->lowmem_reserve[0]); - for (i = 1; i < ARRAY_SIZE(zone->lowmem_reserve); i++) -- seq_printf(m, ", %lu", zone->lowmem_reserve[i]); -+ seq_printf(m, ", %ld", zone->lowmem_reserve[i]); - seq_printf(m, - ")" - "\n pagesets"); -diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c -index 77c173282f38..4a662f15eaee 100644 ---- a/net/netfilter/ipvs/ip_vs_ftp.c -+++ b/net/netfilter/ipvs/ip_vs_ftp.c -@@ -183,6 +183,8 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp, - struct nf_conn *ct; - struct net *net; - -+ *diff = 0; -+ - #ifdef CONFIG_IP_VS_IPV6 - /* This application helper doesn't work with IPv6 yet, - * so turn this into a no-op for IPv6 packets -@@ -191,8 +193,6 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp, - return 1; - #endif - -- *diff = 0; -- - /* Only useful for established sessions */ - if (cp->state != IP_VS_TCP_S_ESTABLISHED) - return 1; -@@ -321,6 +321,9 @@ static int ip_vs_ftp_in(struct ip_vs_app *app, struct ip_vs_conn *cp, - struct ip_vs_conn *n_cp; - struct net *net; - -+ /* no diff required for incoming packets */ -+ *diff = 0; -+ - #ifdef CONFIG_IP_VS_IPV6 - /* This application helper doesn't work with IPv6 yet, - * so turn this into a no-op for IPv6 packets -@@ -329,9 +332,6 @@ static int ip_vs_ftp_in(struct ip_vs_app *app, struct ip_vs_conn *cp, - return 1; - #endif - -- /* no diff required for incoming packets */ -- *diff = 0; -- - /* Only useful for established sessions */ - if (cp->state != IP_VS_TCP_S_ESTABLISHED) - return 1; -diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c -index bf8a108b46e2..6cf2f077e09c 100644 ---- a/net/netfilter/nfnetlink.c -+++ b/net/netfilter/nfnetlink.c -@@ -265,7 +265,8 @@ replay: - nlh = nlmsg_hdr(skb); - err = 0; - -- if (nlh->nlmsg_len < NLMSG_HDRLEN) { -+ if (nlmsg_len(nlh) < sizeof(struct nfgenmsg) || -+ skb->len < nlh->nlmsg_len) { - err = -EINVAL; - goto ack; - } -diff --git a/scripts/recordmcount.pl b/scripts/recordmcount.pl -index 91280b82da08..513f7bd85cb7 100755 ---- a/scripts/recordmcount.pl -+++ b/scripts/recordmcount.pl -@@ -262,7 +262,6 @@ if ($arch eq "x86_64") { - # force flags for this arch - $ld .= " -m shlelf_linux"; - $objcopy .= " -O elf32-sh-linux"; -- $cc .= " -m32"; - - } elsif ($arch eq "powerpc") { - $local_regex = "^[0-9a-fA-F]+\\s+t\\s+(\\.?\\S+)"; -diff --git a/security/keys/gc.c b/security/keys/gc.c -index d3222b6d7d59..009d9370c8fd 100644 ---- a/security/keys/gc.c -+++ b/security/keys/gc.c -@@ -157,12 +157,12 @@ static noinline void key_gc_unused_keys(struct list_head *keys) - if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags)) - atomic_dec(&key->user->nikeys); - -- key_user_put(key->user); -- - /* now throw away the key memory */ - if (key->type->destroy) - key->type->destroy(key); - -+ key_user_put(key->user); -+ - kfree(key->description); - - #ifdef KEY_DEBUGGING -diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c -index 1bed780e21d9..2d37b3fc3a21 100644 ---- a/sound/usb/mixer.c -+++ b/sound/usb/mixer.c -@@ -886,6 +886,7 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval, - case USB_ID(0x046d, 0x0807): /* Logitech Webcam C500 */ - case USB_ID(0x046d, 0x0808): - case USB_ID(0x046d, 0x0809): -+ case USB_ID(0x046d, 0x0819): /* Logitech Webcam C210 */ - case USB_ID(0x046d, 0x081b): /* HD Webcam c310 */ - case USB_ID(0x046d, 0x081d): /* HD Webcam c510 */ - case USB_ID(0x046d, 0x0825): /* HD Webcam c270 */ diff --git a/patch/kernel/odroidc2-default/patch-3.14.31-32.patch b/patch/kernel/odroidc2-default/patch-3.14.31-32.patch deleted file mode 100644 index ae18f763c0..0000000000 --- a/patch/kernel/odroidc2-default/patch-3.14.31-32.patch +++ /dev/null @@ -1,1049 +0,0 @@ -diff --git a/Makefile b/Makefile -index 5abf670c6651..00fffa3f2310 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 3 - PATCHLEVEL = 14 --SUBLEVEL = 31 -+SUBLEVEL = 32 - EXTRAVERSION = - NAME = Remembering Coco - -diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c -index 11b3914660d2..42f2fb8c5a00 100644 ---- a/arch/arm/mm/dma-mapping.c -+++ b/arch/arm/mm/dma-mapping.c -@@ -464,12 +464,21 @@ void __init dma_contiguous_remap(void) - map.type = MT_MEMORY_DMA_READY; - - /* -- * Clear previous low-memory mapping -+ * Clear previous low-memory mapping to ensure that the -+ * TLB does not see any conflicting entries, then flush -+ * the TLB of the old entries before creating new mappings. -+ * -+ * This ensures that any speculatively loaded TLB entries -+ * (even though they may be rare) can not cause any problems, -+ * and ensures that this code is architecturally compliant. - */ - for (addr = __phys_to_virt(start); addr < __phys_to_virt(end); - addr += PMD_SIZE) - pmd_clear(pmd_off_k(addr)); - -+ flush_tlb_kernel_range(__phys_to_virt(start), -+ __phys_to_virt(end)); -+ - iotable_init(&map, 1); - } - } -diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c -index bc5fbc201bcb..f89389f634d7 100644 ---- a/arch/powerpc/xmon/xmon.c -+++ b/arch/powerpc/xmon/xmon.c -@@ -288,6 +288,7 @@ static inline void disable_surveillance(void) - args.token = rtas_token("set-indicator"); - if (args.token == RTAS_UNKNOWN_SERVICE) - return; -+ args.token = cpu_to_be32(args.token); - args.nargs = cpu_to_be32(3); - args.nret = cpu_to_be32(1); - args.rets = &args.args[3]; -diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile -index b5bb49866bcc..67e9f5cc91ed 100644 ---- a/arch/x86/boot/compressed/Makefile -+++ b/arch/x86/boot/compressed/Makefile -@@ -76,7 +76,7 @@ suffix-$(CONFIG_KERNEL_LZO) := lzo - suffix-$(CONFIG_KERNEL_LZ4) := lz4 - - RUN_SIZE = $(shell $(OBJDUMP) -h vmlinux | \ -- perl $(srctree)/arch/x86/tools/calc_run_size.pl) -+ $(CONFIG_SHELL) $(srctree)/arch/x86/tools/calc_run_size.sh) - quiet_cmd_mkpiggy = MKPIGGY $@ - cmd_mkpiggy = $(obj)/mkpiggy $< $(RUN_SIZE) > $@ || ( rm -f $@ ; false ) - -diff --git a/arch/x86/tools/calc_run_size.pl b/arch/x86/tools/calc_run_size.pl -deleted file mode 100644 -index 23210baade2d..000000000000 ---- a/arch/x86/tools/calc_run_size.pl -+++ /dev/null -@@ -1,39 +0,0 @@ --#!/usr/bin/perl --# --# Calculate the amount of space needed to run the kernel, including room for --# the .bss and .brk sections. --# --# Usage: --# objdump -h a.out | perl calc_run_size.pl --use strict; -- --my $mem_size = 0; --my $file_offset = 0; -- --my $sections=" *[0-9]+ \.(?:bss|brk) +"; --while (<>) { -- if (/^$sections([0-9a-f]+) +(?:[0-9a-f]+ +){2}([0-9a-f]+)/) { -- my $size = hex($1); -- my $offset = hex($2); -- $mem_size += $size; -- if ($file_offset == 0) { -- $file_offset = $offset; -- } elsif ($file_offset != $offset) { -- # BFD linker shows the same file offset in ELF. -- # Gold linker shows them as consecutive. -- next if ($file_offset + $mem_size == $offset + $size); -- -- printf STDERR "file_offset: 0x%lx\n", $file_offset; -- printf STDERR "mem_size: 0x%lx\n", $mem_size; -- printf STDERR "offset: 0x%lx\n", $offset; -- printf STDERR "size: 0x%lx\n", $size; -- -- die ".bss and .brk are non-contiguous\n"; -- } -- } --} -- --if ($file_offset == 0) { -- die "Never found .bss or .brk file offset\n"; --} --printf("%d\n", $mem_size + $file_offset); -diff --git a/arch/x86/tools/calc_run_size.sh b/arch/x86/tools/calc_run_size.sh -new file mode 100644 -index 000000000000..1a4c17bb3910 ---- /dev/null -+++ b/arch/x86/tools/calc_run_size.sh -@@ -0,0 +1,42 @@ -+#!/bin/sh -+# -+# Calculate the amount of space needed to run the kernel, including room for -+# the .bss and .brk sections. -+# -+# Usage: -+# objdump -h a.out | sh calc_run_size.sh -+ -+NUM='\([0-9a-fA-F]*[ \t]*\)' -+OUT=$(sed -n 's/^[ \t0-9]*.b[sr][sk][ \t]*'"$NUM$NUM$NUM$NUM"'.*/\1\4/p') -+if [ -z "$OUT" ] ; then -+ echo "Never found .bss or .brk file offset" >&2 -+ exit 1 -+fi -+ -+OUT=$(echo ${OUT# }) -+sizeA=$(printf "%d" 0x${OUT%% *}) -+OUT=${OUT#* } -+offsetA=$(printf "%d" 0x${OUT%% *}) -+OUT=${OUT#* } -+sizeB=$(printf "%d" 0x${OUT%% *}) -+OUT=${OUT#* } -+offsetB=$(printf "%d" 0x${OUT%% *}) -+ -+run_size=$(( $offsetA + $sizeA + $sizeB )) -+ -+# BFD linker shows the same file offset in ELF. -+if [ "$offsetA" -ne "$offsetB" ] ; then -+ # Gold linker shows them as consecutive. -+ endB=$(( $offsetB + $sizeB )) -+ if [ "$endB" != "$run_size" ] ; then -+ printf "sizeA: 0x%x\n" $sizeA >&2 -+ printf "offsetA: 0x%x\n" $offsetA >&2 -+ printf "sizeB: 0x%x\n" $sizeB >&2 -+ printf "offsetB: 0x%x\n" $offsetB >&2 -+ echo ".bss and .brk are non-contiguous" >&2 -+ exit 1 -+ fi -+fi -+ -+printf "%d\n" $run_size -+exit 0 -diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c -index 255ca232ecc7..275a7dc2b06c 100644 ---- a/drivers/block/rbd.c -+++ b/drivers/block/rbd.c -@@ -1926,32 +1926,26 @@ static void rbd_dev_parent_put(struct rbd_device *rbd_dev) - * If an image has a non-zero parent overlap, get a reference to its - * parent. - * -- * We must get the reference before checking for the overlap to -- * coordinate properly with zeroing the parent overlap in -- * rbd_dev_v2_parent_info() when an image gets flattened. We -- * drop it again if there is no overlap. -- * - * Returns true if the rbd device has a parent with a non-zero - * overlap and a reference for it was successfully taken, or - * false otherwise. - */ - static bool rbd_dev_parent_get(struct rbd_device *rbd_dev) - { -- int counter; -+ int counter = 0; - - if (!rbd_dev->parent_spec) - return false; - -- counter = atomic_inc_return_safe(&rbd_dev->parent_ref); -- if (counter > 0 && rbd_dev->parent_overlap) -- return true; -- -- /* Image was flattened, but parent is not yet torn down */ -+ down_read(&rbd_dev->header_rwsem); -+ if (rbd_dev->parent_overlap) -+ counter = atomic_inc_return_safe(&rbd_dev->parent_ref); -+ up_read(&rbd_dev->header_rwsem); - - if (counter < 0) - rbd_warn(rbd_dev, "parent reference overflow\n"); - -- return false; -+ return counter > 0; - } - - /* -@@ -3904,7 +3898,6 @@ static int rbd_dev_v2_parent_info(struct rbd_device *rbd_dev) - */ - if (rbd_dev->parent_overlap) { - rbd_dev->parent_overlap = 0; -- smp_mb(); - rbd_dev_parent_put(rbd_dev); - pr_info("%s: clone image has been flattened\n", - rbd_dev->disk->disk_name); -@@ -3948,7 +3941,6 @@ static int rbd_dev_v2_parent_info(struct rbd_device *rbd_dev) - * treat it specially. - */ - rbd_dev->parent_overlap = overlap; -- smp_mb(); - if (!overlap) { - - /* A null parent_spec indicates it's the initial probe */ -@@ -4764,10 +4756,7 @@ static void rbd_dev_unprobe(struct rbd_device *rbd_dev) - { - struct rbd_image_header *header; - -- /* Drop parent reference unless it's already been done (or none) */ -- -- if (rbd_dev->parent_overlap) -- rbd_dev_parent_put(rbd_dev); -+ rbd_dev_parent_put(rbd_dev); - - /* Free dynamic fields from the header, then zero it out */ - -diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c -index 3153eabde39b..de5ab4876a89 100644 ---- a/drivers/gpu/drm/i915/i915_gem.c -+++ b/drivers/gpu/drm/i915/i915_gem.c -@@ -2893,6 +2893,13 @@ static void i965_write_fence_reg(struct drm_device *dev, int reg, - u32 size = i915_gem_obj_ggtt_size(obj); - uint64_t val; - -+ /* Adjust fence size to match tiled area */ -+ if (obj->tiling_mode != I915_TILING_NONE) { -+ uint32_t row_size = obj->stride * -+ (obj->tiling_mode == I915_TILING_Y ? 32 : 8); -+ size = (size / row_size) * row_size; -+ } -+ - val = (uint64_t)((i915_gem_obj_ggtt_offset(obj) + size - 4096) & - 0xfffff000) << 32; - val |= i915_gem_obj_ggtt_offset(obj) & 0xfffff000; -diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c -index 93ec37649346..79a211782766 100644 ---- a/drivers/i2c/busses/i2c-s3c2410.c -+++ b/drivers/i2c/busses/i2c-s3c2410.c -@@ -753,14 +753,16 @@ static int s3c24xx_i2c_xfer(struct i2c_adapter *adap, - int ret; - - pm_runtime_get_sync(&adap->dev); -- clk_prepare_enable(i2c->clk); -+ ret = clk_enable(i2c->clk); -+ if (ret) -+ return ret; - - for (retry = 0; retry < adap->retries; retry++) { - - ret = s3c24xx_i2c_doxfer(i2c, msgs, num); - - if (ret != -EAGAIN) { -- clk_disable_unprepare(i2c->clk); -+ clk_disable(i2c->clk); - pm_runtime_put(&adap->dev); - return ret; - } -@@ -770,7 +772,7 @@ static int s3c24xx_i2c_xfer(struct i2c_adapter *adap, - udelay(100); - } - -- clk_disable_unprepare(i2c->clk); -+ clk_disable(i2c->clk); - pm_runtime_put(&adap->dev); - return -EREMOTEIO; - } -@@ -1153,7 +1155,7 @@ static int s3c24xx_i2c_probe(struct platform_device *pdev) - - clk_prepare_enable(i2c->clk); - ret = s3c24xx_i2c_init(i2c); -- clk_disable_unprepare(i2c->clk); -+ clk_disable(i2c->clk); - if (ret != 0) { - dev_err(&pdev->dev, "I2C controller init failed\n"); - return ret; -@@ -1166,6 +1168,7 @@ static int s3c24xx_i2c_probe(struct platform_device *pdev) - i2c->irq = ret = platform_get_irq(pdev, 0); - if (ret <= 0) { - dev_err(&pdev->dev, "cannot find IRQ\n"); -+ clk_unprepare(i2c->clk); - return ret; - } - -@@ -1174,6 +1177,7 @@ static int s3c24xx_i2c_probe(struct platform_device *pdev) - - if (ret != 0) { - dev_err(&pdev->dev, "cannot claim IRQ %d\n", i2c->irq); -+ clk_unprepare(i2c->clk); - return ret; - } - } -@@ -1181,6 +1185,7 @@ static int s3c24xx_i2c_probe(struct platform_device *pdev) - ret = s3c24xx_i2c_register_cpufreq(i2c); - if (ret < 0) { - dev_err(&pdev->dev, "failed to register cpufreq notifier\n"); -+ clk_unprepare(i2c->clk); - return ret; - } - -@@ -1197,6 +1202,7 @@ static int s3c24xx_i2c_probe(struct platform_device *pdev) - if (ret < 0) { - dev_err(&pdev->dev, "failed to add bus to i2c core\n"); - s3c24xx_i2c_deregister_cpufreq(i2c); -+ clk_unprepare(i2c->clk); - return ret; - } - -@@ -1218,6 +1224,8 @@ static int s3c24xx_i2c_remove(struct platform_device *pdev) - { - struct s3c24xx_i2c *i2c = platform_get_drvdata(pdev); - -+ clk_unprepare(i2c->clk); -+ - pm_runtime_disable(&i2c->adap.dev); - pm_runtime_disable(&pdev->dev); - -@@ -1246,10 +1254,13 @@ static int s3c24xx_i2c_resume(struct device *dev) - { - struct platform_device *pdev = to_platform_device(dev); - struct s3c24xx_i2c *i2c = platform_get_drvdata(pdev); -+ int ret; - -- clk_prepare_enable(i2c->clk); -+ ret = clk_enable(i2c->clk); -+ if (ret) -+ return ret; - s3c24xx_i2c_init(i2c); -- clk_disable_unprepare(i2c->clk); -+ clk_disable(i2c->clk); - i2c->suspended = 0; - - return 0; -diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c -index a3769cf84381..b00e282ef166 100644 ---- a/drivers/input/mouse/synaptics.c -+++ b/drivers/input/mouse/synaptics.c -@@ -132,8 +132,9 @@ static const struct min_max_quirk min_max_pnpid_table[] = { - 1232, 5710, 1156, 4696 - }, - { -- (const char * const []){"LEN0034", "LEN0036", "LEN0039", -- "LEN2002", "LEN2004", NULL}, -+ (const char * const []){"LEN0034", "LEN0036", "LEN0037", -+ "LEN0039", "LEN2002", "LEN2004", -+ NULL}, - 1024, 5112, 2024, 4832 - }, - { -@@ -162,7 +163,7 @@ static const char * const topbuttonpad_pnp_ids[] = { - "LEN0034", /* T431s, L440, L540, T540, W540, X1 Carbon 2nd */ - "LEN0035", /* X240 */ - "LEN0036", /* T440 */ -- "LEN0037", -+ "LEN0037", /* X1 Carbon 2nd */ - "LEN0038", - "LEN0039", /* T440s */ - "LEN0041", -diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h -index c43c46f7dcd0..dd6d14d2337f 100644 ---- a/drivers/input/serio/i8042-x86ia64io.h -+++ b/drivers/input/serio/i8042-x86ia64io.h -@@ -152,6 +152,14 @@ static const struct dmi_system_id __initconst i8042_dmi_noloop_table[] = { - }, - }, - { -+ /* Medion Akoya E7225 */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Medion"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "Akoya E7225"), -+ DMI_MATCH(DMI_PRODUCT_VERSION, "1.0"), -+ }, -+ }, -+ { - /* Blue FB5601 */ - .matches = { - DMI_MATCH(DMI_SYS_VENDOR, "blue"), -diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c -index d290e8396116..b950a803bae8 100644 ---- a/drivers/md/dm-cache-metadata.c -+++ b/drivers/md/dm-cache-metadata.c -@@ -683,7 +683,7 @@ static struct dm_cache_metadata *metadata_open(struct block_device *bdev, - cmd = kzalloc(sizeof(*cmd), GFP_KERNEL); - if (!cmd) { - DMERR("could not allocate metadata struct"); -- return NULL; -+ return ERR_PTR(-ENOMEM); - } - - atomic_set(&cmd->ref_count, 1); -@@ -745,7 +745,7 @@ static struct dm_cache_metadata *lookup_or_open(struct block_device *bdev, - return cmd; - - cmd = metadata_open(bdev, data_block_size, may_format_device, policy_hint_size); -- if (cmd) { -+ if (!IS_ERR(cmd)) { - mutex_lock(&table_lock); - cmd2 = lookup(bdev); - if (cmd2) { -@@ -780,9 +780,10 @@ struct dm_cache_metadata *dm_cache_metadata_open(struct block_device *bdev, - { - struct dm_cache_metadata *cmd = lookup_or_open(bdev, data_block_size, - may_format_device, policy_hint_size); -- if (cmd && !same_params(cmd, data_block_size)) { -+ -+ if (!IS_ERR(cmd) && !same_params(cmd, data_block_size)) { - dm_cache_metadata_close(cmd); -- return NULL; -+ return ERR_PTR(-EINVAL); - } - - return cmd; -diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c -index f7e052c7ab5f..c1120eb96d86 100644 ---- a/drivers/md/dm-thin.c -+++ b/drivers/md/dm-thin.c -@@ -2744,6 +2744,12 @@ static int pool_message(struct dm_target *ti, unsigned argc, char **argv) - struct pool_c *pt = ti->private; - struct pool *pool = pt->pool; - -+ if (get_pool_mode(pool) >= PM_READ_ONLY) { -+ DMERR("%s: unable to service pool target messages in READ_ONLY or FAIL mode", -+ dm_device_name(pool->pool_md)); -+ return -EINVAL; -+ } -+ - if (!strcasecmp(argv[0], "create_thin")) - r = process_create_thin_mesg(argc, argv, pool); - -diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c -index 4e65b35bebc0..3d198679510b 100644 ---- a/drivers/net/can/usb/kvaser_usb.c -+++ b/drivers/net/can/usb/kvaser_usb.c -@@ -578,7 +578,7 @@ static int kvaser_usb_simple_msg_async(struct kvaser_usb_net_priv *priv, - usb_sndbulkpipe(dev->udev, - dev->bulk_out->bEndpointAddress), - buf, msg->len, -- kvaser_usb_simple_msg_callback, priv); -+ kvaser_usb_simple_msg_callback, netdev); - usb_anchor_urb(urb, &priv->tx_submitted); - - err = usb_submit_urb(urb, GFP_ATOMIC); -@@ -653,11 +653,6 @@ static void kvaser_usb_rx_error(const struct kvaser_usb *dev, - priv = dev->nets[channel]; - stats = &priv->netdev->stats; - -- if (status & M16C_STATE_BUS_RESET) { -- kvaser_usb_unlink_tx_urbs(priv); -- return; -- } -- - skb = alloc_can_err_skb(priv->netdev, &cf); - if (!skb) { - stats->rx_dropped++; -@@ -668,7 +663,7 @@ static void kvaser_usb_rx_error(const struct kvaser_usb *dev, - - netdev_dbg(priv->netdev, "Error status: 0x%02x\n", status); - -- if (status & M16C_STATE_BUS_OFF) { -+ if (status & (M16C_STATE_BUS_OFF | M16C_STATE_BUS_RESET)) { - cf->can_id |= CAN_ERR_BUSOFF; - - priv->can.can_stats.bus_off++; -@@ -694,9 +689,7 @@ static void kvaser_usb_rx_error(const struct kvaser_usb *dev, - } - - new_state = CAN_STATE_ERROR_PASSIVE; -- } -- -- if (status == M16C_STATE_BUS_ERROR) { -+ } else if (status & M16C_STATE_BUS_ERROR) { - if ((priv->can.state < CAN_STATE_ERROR_WARNING) && - ((txerr >= 96) || (rxerr >= 96))) { - cf->can_id |= CAN_ERR_CRTL; -@@ -706,7 +699,8 @@ static void kvaser_usb_rx_error(const struct kvaser_usb *dev, - - priv->can.can_stats.error_warning++; - new_state = CAN_STATE_ERROR_WARNING; -- } else if (priv->can.state > CAN_STATE_ERROR_ACTIVE) { -+ } else if ((priv->can.state > CAN_STATE_ERROR_ACTIVE) && -+ ((txerr < 96) && (rxerr < 96))) { - cf->can_id |= CAN_ERR_PROT; - cf->data[2] = CAN_ERR_PROT_ACTIVE; - -@@ -1582,7 +1576,7 @@ static int kvaser_usb_probe(struct usb_interface *intf, - { - struct kvaser_usb *dev; - int err = -ENOMEM; -- int i; -+ int i, retry = 3; - - dev = devm_kzalloc(&intf->dev, sizeof(*dev), GFP_KERNEL); - if (!dev) -@@ -1600,7 +1594,15 @@ static int kvaser_usb_probe(struct usb_interface *intf, - - usb_set_intfdata(intf, dev); - -- err = kvaser_usb_get_software_info(dev); -+ /* On some x86 laptops, plugging a Kvaser device again after -+ * an unplug makes the firmware always ignore the very first -+ * command. For such a case, provide some room for retries -+ * instead of completely exiting the driver. -+ */ -+ do { -+ err = kvaser_usb_get_software_info(dev); -+ } while (--retry && err == -ETIMEDOUT); -+ - if (err) { - dev_err(&intf->dev, - "Cannot get software infos, error %d\n", err); -diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c -index 316650c3b5d7..4eb091da7fb6 100644 ---- a/drivers/net/ethernet/ti/cpsw.c -+++ b/drivers/net/ethernet/ti/cpsw.c -@@ -1610,6 +1610,19 @@ static int cpsw_ndo_vlan_rx_add_vid(struct net_device *ndev, - if (vid == priv->data.default_vlan) - return 0; - -+ if (priv->data.dual_emac) { -+ /* In dual EMAC, reserved VLAN id should not be used for -+ * creating VLAN interfaces as this can break the dual -+ * EMAC port separation -+ */ -+ int i; -+ -+ for (i = 0; i < priv->data.slaves; i++) { -+ if (vid == priv->slaves[i].port_vlan) -+ return -EINVAL; -+ } -+ } -+ - dev_info(priv->dev, "Adding vlanid %d to vlan filter\n", vid); - return cpsw_add_vlan_ale_entry(priv, vid); - } -@@ -1623,6 +1636,15 @@ static int cpsw_ndo_vlan_rx_kill_vid(struct net_device *ndev, - if (vid == priv->data.default_vlan) - return 0; - -+ if (priv->data.dual_emac) { -+ int i; -+ -+ for (i = 0; i < priv->data.slaves; i++) { -+ if (vid == priv->slaves[i].port_vlan) -+ return -EINVAL; -+ } -+ } -+ - dev_info(priv->dev, "removing vlanid %d from vlan filter\n", vid); - ret = cpsw_ale_del_vlan(priv->ale, vid, 0); - if (ret != 0) -diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c -index afca1bc24f26..b7984044232d 100644 ---- a/drivers/regulator/core.c -+++ b/drivers/regulator/core.c -@@ -1479,7 +1479,7 @@ struct regulator *regulator_get_optional(struct device *dev, const char *id) - } - EXPORT_SYMBOL_GPL(regulator_get_optional); - --/* Locks held by regulator_put() */ -+/* regulator_list_mutex lock held by regulator_put() */ - static void _regulator_put(struct regulator *regulator) - { - struct regulator_dev *rdev; -@@ -1494,12 +1494,14 @@ static void _regulator_put(struct regulator *regulator) - /* remove any sysfs entries */ - if (regulator->dev) - sysfs_remove_link(&rdev->dev.kobj, regulator->supply_name); -+ mutex_lock(&rdev->mutex); - kfree(regulator->supply_name); - list_del(®ulator->list); - kfree(regulator); - - rdev->open_count--; - rdev->exclusive = 0; -+ mutex_unlock(&rdev->mutex); - - module_put(rdev->owner); - } -diff --git a/drivers/spi/spi-dw-mid.c b/drivers/spi/spi-dw-mid.c -index a4c45ea8f688..996e16d12cd4 100644 ---- a/drivers/spi/spi-dw-mid.c -+++ b/drivers/spi/spi-dw-mid.c -@@ -222,7 +222,6 @@ int dw_spi_mid_init(struct dw_spi *dws) - iounmap(clk_reg); - - dws->num_cs = 16; -- dws->fifo_len = 40; /* FIFO has 40 words buffer */ - - #ifdef CONFIG_SPI_DW_MID_DMA - dws->dma_priv = kzalloc(sizeof(struct mid_dma), GFP_KERNEL); -diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c -index 7ab3ccb592eb..458a1480dc07 100644 ---- a/drivers/spi/spi-pxa2xx.c -+++ b/drivers/spi/spi-pxa2xx.c -@@ -400,8 +400,8 @@ static void giveback(struct driver_data *drv_data) - cs_deassert(drv_data); - } - -- spi_finalize_current_message(drv_data->master); - drv_data->cur_chip = NULL; -+ spi_finalize_current_message(drv_data->master); - } - - static void reset_sccr1(struct driver_data *drv_data) -diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c -index 38b4be24d13f..26ae6886ac59 100644 ---- a/drivers/target/target_core_device.c -+++ b/drivers/target/target_core_device.c -@@ -1153,10 +1153,10 @@ int se_dev_set_optimal_sectors(struct se_device *dev, u32 optimal_sectors) - " changed for TCM/pSCSI\n", dev); - return -EINVAL; - } -- if (optimal_sectors > dev->dev_attrib.fabric_max_sectors) { -+ if (optimal_sectors > dev->dev_attrib.hw_max_sectors) { - pr_err("dev[%p]: Passed optimal_sectors %u cannot be" -- " greater than fabric_max_sectors: %u\n", dev, -- optimal_sectors, dev->dev_attrib.fabric_max_sectors); -+ " greater than hw_max_sectors: %u\n", dev, -+ optimal_sectors, dev->dev_attrib.hw_max_sectors); - return -EINVAL; - } - -@@ -1565,7 +1565,6 @@ struct se_device *target_alloc_device(struct se_hba *hba, const char *name) - DA_UNMAP_GRANULARITY_ALIGNMENT_DEFAULT; - dev->dev_attrib.max_write_same_len = DA_MAX_WRITE_SAME_LEN; - dev->dev_attrib.fabric_max_sectors = DA_FABRIC_MAX_SECTORS; -- dev->dev_attrib.optimal_sectors = DA_FABRIC_MAX_SECTORS; - - xcopy_lun = &dev->xcopy_lun; - xcopy_lun->lun_se_dev = dev; -@@ -1606,6 +1605,7 @@ int target_configure_device(struct se_device *dev) - dev->dev_attrib.hw_max_sectors = - se_dev_align_max_sectors(dev->dev_attrib.hw_max_sectors, - dev->dev_attrib.hw_block_size); -+ dev->dev_attrib.optimal_sectors = dev->dev_attrib.hw_max_sectors; - - dev->dev_index = scsi_get_new_index(SCSI_DEVICE_INDEX); - dev->creation_time = get_jiffies_64(); -diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c -index cf991a91a8a9..41eff7d64cb8 100644 ---- a/drivers/target/target_core_file.c -+++ b/drivers/target/target_core_file.c -@@ -620,7 +620,16 @@ fd_execute_rw(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents, - struct fd_prot fd_prot; - sense_reason_t rc; - int ret = 0; -- -+ /* -+ * We are currently limited by the number of iovecs (2048) per -+ * single vfs_[writev,readv] call. -+ */ -+ if (cmd->data_length > FD_MAX_BYTES) { -+ pr_err("FILEIO: Not able to process I/O of %u bytes due to" -+ "FD_MAX_BYTES: %u iovec count limitiation\n", -+ cmd->data_length, FD_MAX_BYTES); -+ return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE; -+ } - /* - * Call vectorized fileio functions to map struct scatterlist - * physical memory addresses to struct iovec virtual memory. -diff --git a/drivers/target/target_core_iblock.c b/drivers/target/target_core_iblock.c -index 9e0232cca92e..feefe24a88f7 100644 ---- a/drivers/target/target_core_iblock.c -+++ b/drivers/target/target_core_iblock.c -@@ -123,7 +123,7 @@ static int iblock_configure_device(struct se_device *dev) - q = bdev_get_queue(bd); - - dev->dev_attrib.hw_block_size = bdev_logical_block_size(bd); -- dev->dev_attrib.hw_max_sectors = UINT_MAX; -+ dev->dev_attrib.hw_max_sectors = queue_max_hw_sectors(q); - dev->dev_attrib.hw_queue_depth = q->nr_requests; - - /* -diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c -index 379033f5903b..5216acd68b4b 100644 ---- a/drivers/target/target_core_sbc.c -+++ b/drivers/target/target_core_sbc.c -@@ -910,21 +910,6 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops) - if (cmd->se_cmd_flags & SCF_SCSI_DATA_CDB) { - unsigned long long end_lba; - -- if (sectors > dev->dev_attrib.fabric_max_sectors) { -- printk_ratelimited(KERN_ERR "SCSI OP %02xh with too" -- " big sectors %u exceeds fabric_max_sectors:" -- " %u\n", cdb[0], sectors, -- dev->dev_attrib.fabric_max_sectors); -- return TCM_INVALID_CDB_FIELD; -- } -- if (sectors > dev->dev_attrib.hw_max_sectors) { -- printk_ratelimited(KERN_ERR "SCSI OP %02xh with too" -- " big sectors %u exceeds backend hw_max_sectors:" -- " %u\n", cdb[0], sectors, -- dev->dev_attrib.hw_max_sectors); -- return TCM_INVALID_CDB_FIELD; -- } -- - end_lba = dev->transport->get_blocks(dev) + 1; - if (cmd->t_task_lba + sectors > end_lba) { - pr_err("cmd exceeds last lba %llu " -diff --git a/drivers/target/target_core_spc.c b/drivers/target/target_core_spc.c -index fcdf98fc947c..12a74f646d38 100644 ---- a/drivers/target/target_core_spc.c -+++ b/drivers/target/target_core_spc.c -@@ -503,7 +503,6 @@ static sense_reason_t - spc_emulate_evpd_b0(struct se_cmd *cmd, unsigned char *buf) - { - struct se_device *dev = cmd->se_dev; -- u32 max_sectors; - int have_tp = 0; - int opt, min; - -@@ -537,9 +536,7 @@ spc_emulate_evpd_b0(struct se_cmd *cmd, unsigned char *buf) - /* - * Set MAXIMUM TRANSFER LENGTH - */ -- max_sectors = min(dev->dev_attrib.fabric_max_sectors, -- dev->dev_attrib.hw_max_sectors); -- put_unaligned_be32(max_sectors, &buf[8]); -+ put_unaligned_be32(dev->dev_attrib.hw_max_sectors, &buf[8]); - - /* - * Set OPTIMAL TRANSFER LENGTH -diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c -index de2543d3c283..7ececa1c6c4f 100644 ---- a/fs/nfs/direct.c -+++ b/fs/nfs/direct.c -@@ -123,6 +123,12 @@ static inline int put_dreq(struct nfs_direct_req *dreq) - */ - ssize_t nfs_direct_IO(int rw, struct kiocb *iocb, const struct iovec *iov, loff_t pos, unsigned long nr_segs) - { -+ struct inode *inode = iocb->ki_filp->f_mapping->host; -+ -+ /* we only support swap file calling nfs_direct_IO */ -+ if (!IS_SWAPFILE(inode)) -+ return 0; -+ - #ifndef CONFIG_NFS_SWAP - dprintk("NFS: nfs_direct_IO (%pD) off/no(%Ld/%lu) EINVAL\n", - iocb->ki_filp, (long long) pos, nr_segs); -diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c -index 037f9572b94c..d3f606255b99 100644 ---- a/fs/nfs/nfs4client.c -+++ b/fs/nfs/nfs4client.c -@@ -633,7 +633,7 @@ int nfs41_walk_client_list(struct nfs_client *new, - prev = pos; - - status = nfs_wait_client_init_complete(pos); -- if (status == 0) { -+ if (pos->cl_cons_state == NFS_CS_SESSION_INITING) { - nfs4_schedule_lease_recovery(pos); - status = nfs4_wait_clnt_recover(pos); - } -diff --git a/kernel/workqueue.c b/kernel/workqueue.c -index b4defdecec8a..f6f31d823e8e 100644 ---- a/kernel/workqueue.c -+++ b/kernel/workqueue.c -@@ -1962,17 +1962,13 @@ static void pool_mayday_timeout(unsigned long __pool) - * spin_lock_irq(pool->lock) which may be released and regrabbed - * multiple times. Does GFP_KERNEL allocations. Called only from - * manager. -- * -- * Return: -- * %false if no action was taken and pool->lock stayed locked, %true -- * otherwise. - */ --static bool maybe_create_worker(struct worker_pool *pool) -+static void maybe_create_worker(struct worker_pool *pool) - __releases(&pool->lock) - __acquires(&pool->lock) - { - if (!need_to_create_worker(pool)) -- return false; -+ return; - restart: - spin_unlock_irq(&pool->lock); - -@@ -1989,7 +1985,7 @@ restart: - start_worker(worker); - if (WARN_ON_ONCE(need_to_create_worker(pool))) - goto restart; -- return true; -+ return; - } - - if (!need_to_create_worker(pool)) -@@ -2006,7 +2002,7 @@ restart: - spin_lock_irq(&pool->lock); - if (need_to_create_worker(pool)) - goto restart; -- return true; -+ return; - } - - /** -@@ -2019,15 +2015,9 @@ restart: - * LOCKING: - * spin_lock_irq(pool->lock) which may be released and regrabbed - * multiple times. Called only from manager. -- * -- * Return: -- * %false if no action was taken and pool->lock stayed locked, %true -- * otherwise. - */ --static bool maybe_destroy_workers(struct worker_pool *pool) -+static void maybe_destroy_workers(struct worker_pool *pool) - { -- bool ret = false; -- - while (too_many_workers(pool)) { - struct worker *worker; - unsigned long expires; -@@ -2041,10 +2031,7 @@ static bool maybe_destroy_workers(struct worker_pool *pool) - } - - destroy_worker(worker); -- ret = true; - } -- -- return ret; - } - - /** -@@ -2064,16 +2051,14 @@ static bool maybe_destroy_workers(struct worker_pool *pool) - * multiple times. Does GFP_KERNEL allocations. - * - * Return: -- * %false if the pool don't need management and the caller can safely start -- * processing works, %true indicates that the function released pool->lock -- * and reacquired it to perform some management function and that the -- * conditions that the caller verified while holding the lock before -- * calling the function might no longer be true. -+ * %false if the pool doesn't need management and the caller can safely -+ * start processing works, %true if management function was performed and -+ * the conditions that the caller verified before calling the function may -+ * no longer be true. - */ - static bool manage_workers(struct worker *worker) - { - struct worker_pool *pool = worker->pool; -- bool ret = false; - - /* - * Managership is governed by two mutexes - manager_arb and -@@ -2097,7 +2082,7 @@ static bool manage_workers(struct worker *worker) - * manager_mutex. - */ - if (!mutex_trylock(&pool->manager_arb)) -- return ret; -+ return false; - - /* - * With manager arbitration won, manager_mutex would be free in -@@ -2107,7 +2092,6 @@ static bool manage_workers(struct worker *worker) - spin_unlock_irq(&pool->lock); - mutex_lock(&pool->manager_mutex); - spin_lock_irq(&pool->lock); -- ret = true; - } - - pool->flags &= ~POOL_MANAGE_WORKERS; -@@ -2116,12 +2100,12 @@ static bool manage_workers(struct worker *worker) - * Destroy and then create so that may_start_working() is true - * on return. - */ -- ret |= maybe_destroy_workers(pool); -- ret |= maybe_create_worker(pool); -+ maybe_destroy_workers(pool); -+ maybe_create_worker(pool); - - mutex_unlock(&pool->manager_mutex); - mutex_unlock(&pool->manager_arb); -- return ret; -+ return true; - } - - /** -diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c -index 1e4dc4ed5e0d..815ca56b39e7 100644 ---- a/net/mac80211/rx.c -+++ b/net/mac80211/rx.c -@@ -261,7 +261,7 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local, - else if (rate && rate->flags & IEEE80211_RATE_ERP_G) - channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ; - else if (rate) -- channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ; -+ channel_flags |= IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ; - else - channel_flags |= IEEE80211_CHAN_2GHZ; - put_unaligned_le16(channel_flags, pos); -diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c -index df33156ecd2d..18d73df72531 100644 ---- a/net/wireless/nl80211.c -+++ b/net/wireless/nl80211.c -@@ -2697,6 +2697,9 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info) - if (!rdev->ops->get_key) - return -EOPNOTSUPP; - -+ if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)) -+ return -ENOENT; -+ - msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); - if (!msg) - return -ENOMEM; -@@ -2716,10 +2719,6 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info) - nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr)) - goto nla_put_failure; - -- if (pairwise && mac_addr && -- !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)) -- return -ENOENT; -- - err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie, - get_key_callback); - -@@ -2890,7 +2889,7 @@ static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info) - wdev_lock(dev->ieee80211_ptr); - err = nl80211_key_allowed(dev->ieee80211_ptr); - -- if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr && -+ if (key.type == NL80211_KEYTYPE_GROUP && mac_addr && - !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)) - err = -ENOENT; - -diff --git a/sound/core/seq/seq_dummy.c b/sound/core/seq/seq_dummy.c -index dbc550716790..f60d81497f28 100644 ---- a/sound/core/seq/seq_dummy.c -+++ b/sound/core/seq/seq_dummy.c -@@ -82,36 +82,6 @@ struct snd_seq_dummy_port { - static int my_client = -1; - - /* -- * unuse callback - send ALL_SOUNDS_OFF and RESET_CONTROLLERS events -- * to subscribers. -- * Note: this callback is called only after all subscribers are removed. -- */ --static int --dummy_unuse(void *private_data, struct snd_seq_port_subscribe *info) --{ -- struct snd_seq_dummy_port *p; -- int i; -- struct snd_seq_event ev; -- -- p = private_data; -- memset(&ev, 0, sizeof(ev)); -- if (p->duplex) -- ev.source.port = p->connect; -- else -- ev.source.port = p->port; -- ev.dest.client = SNDRV_SEQ_ADDRESS_SUBSCRIBERS; -- ev.type = SNDRV_SEQ_EVENT_CONTROLLER; -- for (i = 0; i < 16; i++) { -- ev.data.control.channel = i; -- ev.data.control.param = MIDI_CTL_ALL_SOUNDS_OFF; -- snd_seq_kernel_client_dispatch(p->client, &ev, 0, 0); -- ev.data.control.param = MIDI_CTL_RESET_CONTROLLERS; -- snd_seq_kernel_client_dispatch(p->client, &ev, 0, 0); -- } -- return 0; --} -- --/* - * event input callback - just redirect events to subscribers - */ - static int -@@ -175,7 +145,6 @@ create_port(int idx, int type) - | SNDRV_SEQ_PORT_TYPE_PORT; - memset(&pcb, 0, sizeof(pcb)); - pcb.owner = THIS_MODULE; -- pcb.unuse = dummy_unuse; - pcb.event_input = dummy_input; - pcb.private_free = dummy_free; - pcb.private_data = rec; -diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c -index f156010e52bc..942ef8427347 100644 ---- a/sound/soc/codecs/wm8960.c -+++ b/sound/soc/codecs/wm8960.c -@@ -555,7 +555,7 @@ static struct { - { 22050, 2 }, - { 24000, 2 }, - { 16000, 3 }, -- { 11250, 4 }, -+ { 11025, 4 }, - { 12000, 4 }, - { 8000, 5 }, - }; -diff --git a/sound/soc/fsl/fsl_esai.h b/sound/soc/fsl/fsl_esai.h -index 75e14033e8d8..dfdbaa014561 100644 ---- a/sound/soc/fsl/fsl_esai.h -+++ b/sound/soc/fsl/fsl_esai.h -@@ -302,7 +302,7 @@ - #define ESAI_xCCR_xFP_MASK (((1 << ESAI_xCCR_xFP_WIDTH) - 1) << ESAI_xCCR_xFP_SHIFT) - #define ESAI_xCCR_xFP(v) ((((v) - 1) << ESAI_xCCR_xFP_SHIFT) & ESAI_xCCR_xFP_MASK) - #define ESAI_xCCR_xDC_SHIFT 9 --#define ESAI_xCCR_xDC_WIDTH 4 -+#define ESAI_xCCR_xDC_WIDTH 5 - #define ESAI_xCCR_xDC_MASK (((1 << ESAI_xCCR_xDC_WIDTH) - 1) << ESAI_xCCR_xDC_SHIFT) - #define ESAI_xCCR_xDC(v) ((((v) - 1) << ESAI_xCCR_xDC_SHIFT) & ESAI_xCCR_xDC_MASK) - #define ESAI_xCCR_xPSR_SHIFT 8 -diff --git a/sound/soc/omap/omap-mcbsp.c b/sound/soc/omap/omap-mcbsp.c -index 6c19bba23570..6a339fb55479 100644 ---- a/sound/soc/omap/omap-mcbsp.c -+++ b/sound/soc/omap/omap-mcbsp.c -@@ -436,7 +436,7 @@ static int omap_mcbsp_dai_set_dai_fmt(struct snd_soc_dai *cpu_dai, - case SND_SOC_DAIFMT_CBM_CFS: - /* McBSP slave. FS clock as output */ - regs->srgr2 |= FSGM; -- regs->pcr0 |= FSXM; -+ regs->pcr0 |= FSXM | FSRM; - break; - case SND_SOC_DAIFMT_CBM_CFM: - /* McBSP slave */ -diff --git a/sound/soc/soc-compress.c b/sound/soc/soc-compress.c -index 5e9690c85d8f..4f98ff14cf12 100644 ---- a/sound/soc/soc-compress.c -+++ b/sound/soc/soc-compress.c -@@ -696,7 +696,8 @@ int soc_new_compress(struct snd_soc_pcm_runtime *rtd, int num) - rtd->dai_link->stream_name); - - ret = snd_pcm_new_internal(rtd->card->snd_card, new_name, num, -- 1, 0, &be_pcm); -+ rtd->dai_link->dpcm_playback, -+ rtd->dai_link->dpcm_capture, &be_pcm); - if (ret < 0) { - dev_err(rtd->card->dev, "ASoC: can't create compressed for %s\n", - rtd->dai_link->name); -@@ -705,8 +706,10 @@ int soc_new_compress(struct snd_soc_pcm_runtime *rtd, int num) - - rtd->pcm = be_pcm; - rtd->fe_compr = 1; -- be_pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream->private_data = rtd; -- be_pcm->streams[SNDRV_PCM_STREAM_CAPTURE].substream->private_data = rtd; -+ if (rtd->dai_link->dpcm_playback) -+ be_pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream->private_data = rtd; -+ else if (rtd->dai_link->dpcm_capture) -+ be_pcm->streams[SNDRV_PCM_STREAM_CAPTURE].substream->private_data = rtd; - memcpy(compr->ops, &soc_compr_dyn_ops, sizeof(soc_compr_dyn_ops)); - } else - memcpy(compr->ops, &soc_compr_ops, sizeof(soc_compr_ops)); diff --git a/patch/kernel/odroidc2-default/patch-3.14.32-33.patch b/patch/kernel/odroidc2-default/patch-3.14.32-33.patch deleted file mode 100644 index 9ad4cbd784..0000000000 --- a/patch/kernel/odroidc2-default/patch-3.14.32-33.patch +++ /dev/null @@ -1,721 +0,0 @@ -diff --git a/Makefile b/Makefile -index 00fffa3f2310..b0963ca2895d 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 3 - PATCHLEVEL = 14 --SUBLEVEL = 32 -+SUBLEVEL = 33 - EXTRAVERSION = - NAME = Remembering Coco - -diff --git a/arch/arm/mm/context.c b/arch/arm/mm/context.c -index 6eb97b3a7481..4370933f16cd 100644 ---- a/arch/arm/mm/context.c -+++ b/arch/arm/mm/context.c -@@ -144,21 +144,17 @@ static void flush_context(unsigned int cpu) - /* Update the list of reserved ASIDs and the ASID bitmap. */ - bitmap_clear(asid_map, 0, NUM_USER_ASIDS); - for_each_possible_cpu(i) { -- if (i == cpu) { -- asid = 0; -- } else { -- asid = atomic64_xchg(&per_cpu(active_asids, i), 0); -- /* -- * If this CPU has already been through a -- * rollover, but hasn't run another task in -- * the meantime, we must preserve its reserved -- * ASID, as this is the only trace we have of -- * the process it is still running. -- */ -- if (asid == 0) -- asid = per_cpu(reserved_asids, i); -- __set_bit(asid & ~ASID_MASK, asid_map); -- } -+ asid = atomic64_xchg(&per_cpu(active_asids, i), 0); -+ /* -+ * If this CPU has already been through a -+ * rollover, but hasn't run another task in -+ * the meantime, we must preserve its reserved -+ * ASID, as this is the only trace we have of -+ * the process it is still running. -+ */ -+ if (asid == 0) -+ asid = per_cpu(reserved_asids, i); -+ __set_bit(asid & ~ASID_MASK, asid_map); - per_cpu(reserved_asids, i) = asid; - } - -diff --git a/arch/mips/cavium-octeon/smp.c b/arch/mips/cavium-octeon/smp.c -index 67a078ffc464..34467ac8220c 100644 ---- a/arch/mips/cavium-octeon/smp.c -+++ b/arch/mips/cavium-octeon/smp.c -@@ -263,9 +263,7 @@ static int octeon_cpu_disable(void) - - set_cpu_online(cpu, false); - cpu_clear(cpu, cpu_callin_map); -- local_irq_disable(); - octeon_fixup_irqs(); -- local_irq_enable(); - - flush_cache_all(); - local_flush_tlb_all(); -diff --git a/arch/mips/kernel/irq_cpu.c b/arch/mips/kernel/irq_cpu.c -index e498f2b3646a..f5598e25e906 100644 ---- a/arch/mips/kernel/irq_cpu.c -+++ b/arch/mips/kernel/irq_cpu.c -@@ -56,6 +56,8 @@ static struct irq_chip mips_cpu_irq_controller = { - .irq_mask_ack = mask_mips_irq, - .irq_unmask = unmask_mips_irq, - .irq_eoi = unmask_mips_irq, -+ .irq_disable = mask_mips_irq, -+ .irq_enable = unmask_mips_irq, - }; - - /* -@@ -92,6 +94,8 @@ static struct irq_chip mips_mt_cpu_irq_controller = { - .irq_mask_ack = mips_mt_cpu_irq_ack, - .irq_unmask = unmask_mips_irq, - .irq_eoi = unmask_mips_irq, -+ .irq_disable = mask_mips_irq, -+ .irq_enable = unmask_mips_irq, - }; - - void __init mips_cpu_irq_init(void) -diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c -index 0a022ee33b2a..18ed11275052 100644 ---- a/arch/mips/kernel/smp.c -+++ b/arch/mips/kernel/smp.c -@@ -109,10 +109,10 @@ asmlinkage void start_secondary(void) - else - #endif /* CONFIG_MIPS_MT_SMTC */ - cpu_probe(); -- cpu_report(); - per_cpu_trap_init(false); - mips_clockevent_init(); - mp_ops->init_secondary(); -+ cpu_report(); - - /* - * XXX parity protection should be folded in here when it's converted -diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c -index de426887b359..80c22a3ca688 100644 ---- a/arch/x86/kvm/vmx.c -+++ b/arch/x86/kvm/vmx.c -@@ -441,6 +441,7 @@ struct vcpu_vmx { - #endif - int gs_ldt_reload_needed; - int fs_reload_needed; -+ unsigned long vmcs_host_cr4; /* May not match real cr4 */ - } host_state; - struct { - int vm86_active; -@@ -4165,11 +4166,16 @@ static void vmx_set_constant_host_state(struct vcpu_vmx *vmx) - u32 low32, high32; - unsigned long tmpl; - struct desc_ptr dt; -+ unsigned long cr4; - - vmcs_writel(HOST_CR0, read_cr0() & ~X86_CR0_TS); /* 22.2.3 */ -- vmcs_writel(HOST_CR4, read_cr4()); /* 22.2.3, 22.2.5 */ - vmcs_writel(HOST_CR3, read_cr3()); /* 22.2.3 FIXME: shadow tables */ - -+ /* Save the most likely value for this task's CR4 in the VMCS. */ -+ cr4 = read_cr4(); -+ vmcs_writel(HOST_CR4, cr4); /* 22.2.3, 22.2.5 */ -+ vmx->host_state.vmcs_host_cr4 = cr4; -+ - vmcs_write16(HOST_CS_SELECTOR, __KERNEL_CS); /* 22.2.4 */ - #ifdef CONFIG_X86_64 - /* -@@ -7196,7 +7202,7 @@ static void atomic_switch_perf_msrs(struct vcpu_vmx *vmx) - static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu) - { - struct vcpu_vmx *vmx = to_vmx(vcpu); -- unsigned long debugctlmsr; -+ unsigned long debugctlmsr, cr4; - - /* Record the guest's net vcpu time for enforced NMI injections. */ - if (unlikely(!cpu_has_virtual_nmis() && vmx->soft_vnmi_blocked)) -@@ -7217,6 +7223,12 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu) - if (test_bit(VCPU_REGS_RIP, (unsigned long *)&vcpu->arch.regs_dirty)) - vmcs_writel(GUEST_RIP, vcpu->arch.regs[VCPU_REGS_RIP]); - -+ cr4 = read_cr4(); -+ if (unlikely(cr4 != vmx->host_state.vmcs_host_cr4)) { -+ vmcs_writel(HOST_CR4, cr4); -+ vmx->host_state.vmcs_host_cr4 = cr4; -+ } -+ - /* When single-stepping over STI and MOV SS, we must clear the - * corresponding interruptibility bits in the guest state. Otherwise - * vmentry fails as it then expects bit 14 (BS) in pending debug -diff --git a/arch/x86/pci/common.c b/arch/x86/pci/common.c -index 981c2dbd72cc..88f143d9754e 100644 ---- a/arch/x86/pci/common.c -+++ b/arch/x86/pci/common.c -@@ -448,6 +448,22 @@ static const struct dmi_system_id pciprobe_dmi_table[] = { - DMI_MATCH(DMI_PRODUCT_NAME, "ftServer"), - }, - }, -+ { -+ .callback = set_scan_all, -+ .ident = "Stratus/NEC ftServer", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "NEC"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "Express5800/R32"), -+ }, -+ }, -+ { -+ .callback = set_scan_all, -+ .ident = "Stratus/NEC ftServer", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "NEC"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "Express5800/R31"), -+ }, -+ }, - {} - }; - -diff --git a/crypto/crc32c.c b/crypto/crc32c.c -index 06f7018c9d95..238f0e627ef3 100644 ---- a/crypto/crc32c.c -+++ b/crypto/crc32c.c -@@ -170,3 +170,4 @@ module_exit(crc32c_mod_fini); - MODULE_AUTHOR("Clay Haapala "); - MODULE_DESCRIPTION("CRC32c (Castagnoli) calculations wrapper for lib/crc32c"); - MODULE_LICENSE("GPL"); -+MODULE_ALIAS_CRYPTO("crc32c"); -diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c -index ccbffd0d7a02..8f42bd724682 100644 ---- a/drivers/gpio/gpiolib.c -+++ b/drivers/gpio/gpiolib.c -@@ -911,6 +911,7 @@ int gpiod_export_link(struct device *dev, const char *name, - if (tdev != NULL) { - status = sysfs_create_link(&dev->kobj, &tdev->kobj, - name); -+ put_device(tdev); - } else { - status = -ENODEV; - } -@@ -958,7 +959,7 @@ int gpiod_sysfs_set_active_low(struct gpio_desc *desc, int value) - } - - status = sysfs_set_active_low(desc, dev, value); -- -+ put_device(dev); - unlock: - mutex_unlock(&sysfs_lock); - -diff --git a/fs/cifs/file.c b/fs/cifs/file.c -index d375322b6cec..0218a9b23b38 100644 ---- a/fs/cifs/file.c -+++ b/fs/cifs/file.c -@@ -366,6 +366,7 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file) - struct cifsLockInfo *li, *tmp; - struct cifs_fid fid; - struct cifs_pending_open open; -+ bool oplock_break_cancelled; - - spin_lock(&cifs_file_list_lock); - if (--cifs_file->count > 0) { -@@ -397,7 +398,7 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file) - } - spin_unlock(&cifs_file_list_lock); - -- cancel_work_sync(&cifs_file->oplock_break); -+ oplock_break_cancelled = cancel_work_sync(&cifs_file->oplock_break); - - if (!tcon->need_reconnect && !cifs_file->invalidHandle) { - struct TCP_Server_Info *server = tcon->ses->server; -@@ -409,6 +410,9 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file) - _free_xid(xid); - } - -+ if (oplock_break_cancelled) -+ cifs_done_oplock_break(cifsi); -+ - cifs_del_pending_open(&open); - - /* -diff --git a/fs/ext4/file.c b/fs/ext4/file.c -index 2a8b2e15dcc4..589117e9e9be 100644 ---- a/fs/ext4/file.c -+++ b/fs/ext4/file.c -@@ -100,7 +100,7 @@ ext4_file_dio_write(struct kiocb *iocb, const struct iovec *iov, - struct blk_plug plug; - int unaligned_aio = 0; - ssize_t ret; -- int overwrite = 0; -+ int *overwrite = iocb->private; - size_t length = iov_length(iov, nr_segs); - - if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS) && -@@ -118,8 +118,6 @@ ext4_file_dio_write(struct kiocb *iocb, const struct iovec *iov, - mutex_lock(&inode->i_mutex); - blk_start_plug(&plug); - -- iocb->private = &overwrite; -- - /* check whether we do a DIO overwrite or not */ - if (ext4_should_dioread_nolock(inode) && !unaligned_aio && - !file->f_mapping->nrpages && pos + length <= i_size_read(inode)) { -@@ -143,7 +141,7 @@ ext4_file_dio_write(struct kiocb *iocb, const struct iovec *iov, - * So we should check these two conditions. - */ - if (err == len && (map.m_flags & EXT4_MAP_MAPPED)) -- overwrite = 1; -+ *overwrite = 1; - } - - ret = __generic_file_aio_write(iocb, iov, nr_segs, &iocb->ki_pos); -@@ -170,6 +168,7 @@ ext4_file_write(struct kiocb *iocb, const struct iovec *iov, - { - struct inode *inode = file_inode(iocb->ki_filp); - ssize_t ret; -+ int overwrite = 0; - - /* - * If we have encountered a bitmap-format file, the size limit -@@ -190,6 +189,7 @@ ext4_file_write(struct kiocb *iocb, const struct iovec *iov, - } - } - -+ iocb->private = &overwrite; - if (unlikely(iocb->ki_filp->f_flags & O_DIRECT)) - ret = ext4_file_dio_write(iocb, iov, nr_segs, pos); - else -diff --git a/fs/nilfs2/nilfs.h b/fs/nilfs2/nilfs.h -index 9bc72dec3fa6..b02c202223a6 100644 ---- a/fs/nilfs2/nilfs.h -+++ b/fs/nilfs2/nilfs.h -@@ -141,7 +141,6 @@ enum { - * @ti_save: Backup of journal_info field of task_struct - * @ti_flags: Flags - * @ti_count: Nest level -- * @ti_garbage: List of inode to be put when releasing semaphore - */ - struct nilfs_transaction_info { - u32 ti_magic; -@@ -150,7 +149,6 @@ struct nilfs_transaction_info { - one of other filesystems has a bug. */ - unsigned short ti_flags; - unsigned short ti_count; -- struct list_head ti_garbage; - }; - - /* ti_magic */ -diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c -index a1a191634abc..5bee81674d53 100644 ---- a/fs/nilfs2/segment.c -+++ b/fs/nilfs2/segment.c -@@ -305,7 +305,6 @@ static void nilfs_transaction_lock(struct super_block *sb, - ti->ti_count = 0; - ti->ti_save = cur_ti; - ti->ti_magic = NILFS_TI_MAGIC; -- INIT_LIST_HEAD(&ti->ti_garbage); - current->journal_info = ti; - - for (;;) { -@@ -332,8 +331,6 @@ static void nilfs_transaction_unlock(struct super_block *sb) - - up_write(&nilfs->ns_segctor_sem); - current->journal_info = ti->ti_save; -- if (!list_empty(&ti->ti_garbage)) -- nilfs_dispose_list(nilfs, &ti->ti_garbage, 0); - } - - static void *nilfs_segctor_map_segsum_entry(struct nilfs_sc_info *sci, -@@ -746,6 +743,15 @@ static void nilfs_dispose_list(struct the_nilfs *nilfs, - } - } - -+static void nilfs_iput_work_func(struct work_struct *work) -+{ -+ struct nilfs_sc_info *sci = container_of(work, struct nilfs_sc_info, -+ sc_iput_work); -+ struct the_nilfs *nilfs = sci->sc_super->s_fs_info; -+ -+ nilfs_dispose_list(nilfs, &sci->sc_iput_queue, 0); -+} -+ - static int nilfs_test_metadata_dirty(struct the_nilfs *nilfs, - struct nilfs_root *root) - { -@@ -1899,8 +1905,8 @@ static int nilfs_segctor_collect_dirty_files(struct nilfs_sc_info *sci, - static void nilfs_segctor_drop_written_files(struct nilfs_sc_info *sci, - struct the_nilfs *nilfs) - { -- struct nilfs_transaction_info *ti = current->journal_info; - struct nilfs_inode_info *ii, *n; -+ int defer_iput = false; - - spin_lock(&nilfs->ns_inode_lock); - list_for_each_entry_safe(ii, n, &sci->sc_dirty_files, i_dirty) { -@@ -1911,9 +1917,24 @@ static void nilfs_segctor_drop_written_files(struct nilfs_sc_info *sci, - clear_bit(NILFS_I_BUSY, &ii->i_state); - brelse(ii->i_bh); - ii->i_bh = NULL; -- list_move_tail(&ii->i_dirty, &ti->ti_garbage); -+ list_del_init(&ii->i_dirty); -+ if (!ii->vfs_inode.i_nlink) { -+ /* -+ * Defer calling iput() to avoid a deadlock -+ * over I_SYNC flag for inodes with i_nlink == 0 -+ */ -+ list_add_tail(&ii->i_dirty, &sci->sc_iput_queue); -+ defer_iput = true; -+ } else { -+ spin_unlock(&nilfs->ns_inode_lock); -+ iput(&ii->vfs_inode); -+ spin_lock(&nilfs->ns_inode_lock); -+ } - } - spin_unlock(&nilfs->ns_inode_lock); -+ -+ if (defer_iput) -+ schedule_work(&sci->sc_iput_work); - } - - /* -@@ -2580,6 +2601,8 @@ static struct nilfs_sc_info *nilfs_segctor_new(struct super_block *sb, - INIT_LIST_HEAD(&sci->sc_segbufs); - INIT_LIST_HEAD(&sci->sc_write_logs); - INIT_LIST_HEAD(&sci->sc_gc_inodes); -+ INIT_LIST_HEAD(&sci->sc_iput_queue); -+ INIT_WORK(&sci->sc_iput_work, nilfs_iput_work_func); - init_timer(&sci->sc_timer); - - sci->sc_interval = HZ * NILFS_SC_DEFAULT_TIMEOUT; -@@ -2606,6 +2629,8 @@ static void nilfs_segctor_write_out(struct nilfs_sc_info *sci) - ret = nilfs_segctor_construct(sci, SC_LSEG_SR); - nilfs_transaction_unlock(sci->sc_super); - -+ flush_work(&sci->sc_iput_work); -+ - } while (ret && retrycount-- > 0); - } - -@@ -2630,6 +2655,9 @@ static void nilfs_segctor_destroy(struct nilfs_sc_info *sci) - || sci->sc_seq_request != sci->sc_seq_done); - spin_unlock(&sci->sc_state_lock); - -+ if (flush_work(&sci->sc_iput_work)) -+ flag = true; -+ - if (flag || !nilfs_segctor_confirm(sci)) - nilfs_segctor_write_out(sci); - -@@ -2639,6 +2667,12 @@ static void nilfs_segctor_destroy(struct nilfs_sc_info *sci) - nilfs_dispose_list(nilfs, &sci->sc_dirty_files, 1); - } - -+ if (!list_empty(&sci->sc_iput_queue)) { -+ nilfs_warning(sci->sc_super, __func__, -+ "iput queue is not empty\n"); -+ nilfs_dispose_list(nilfs, &sci->sc_iput_queue, 1); -+ } -+ - WARN_ON(!list_empty(&sci->sc_segbufs)); - WARN_ON(!list_empty(&sci->sc_write_logs)); - -diff --git a/fs/nilfs2/segment.h b/fs/nilfs2/segment.h -index 38a1d0013314..a48d6de1e02c 100644 ---- a/fs/nilfs2/segment.h -+++ b/fs/nilfs2/segment.h -@@ -26,6 +26,7 @@ - #include - #include - #include -+#include - #include - #include "nilfs.h" - -@@ -92,6 +93,8 @@ struct nilfs_segsum_pointer { - * @sc_nblk_inc: Block count of current generation - * @sc_dirty_files: List of files to be written - * @sc_gc_inodes: List of GC inodes having blocks to be written -+ * @sc_iput_queue: list of inodes for which iput should be done -+ * @sc_iput_work: work struct to defer iput call - * @sc_freesegs: array of segment numbers to be freed - * @sc_nfreesegs: number of segments on @sc_freesegs - * @sc_dsync_inode: inode whose data pages are written for a sync operation -@@ -135,6 +138,8 @@ struct nilfs_sc_info { - - struct list_head sc_dirty_files; - struct list_head sc_gc_inodes; -+ struct list_head sc_iput_queue; -+ struct work_struct sc_iput_work; - - __u64 *sc_freesegs; - size_t sc_nfreesegs; -diff --git a/include/sound/ak4113.h b/include/sound/ak4113.h -index 2609048c1d44..3a34f6edc2d1 100644 ---- a/include/sound/ak4113.h -+++ b/include/sound/ak4113.h -@@ -286,7 +286,7 @@ struct ak4113 { - ak4113_write_t *write; - ak4113_read_t *read; - void *private_data; -- unsigned int init:1; -+ atomic_t wq_processing; - spinlock_t lock; - unsigned char regmap[AK4113_WRITABLE_REGS]; - struct snd_kcontrol *kctls[AK4113_CONTROLS]; -diff --git a/include/sound/ak4114.h b/include/sound/ak4114.h -index 52f02a60dba7..069299a88915 100644 ---- a/include/sound/ak4114.h -+++ b/include/sound/ak4114.h -@@ -168,7 +168,7 @@ struct ak4114 { - ak4114_write_t * write; - ak4114_read_t * read; - void * private_data; -- unsigned int init: 1; -+ atomic_t wq_processing; - spinlock_t lock; - unsigned char regmap[6]; - unsigned char txcsb[5]; -diff --git a/kernel/smpboot.c b/kernel/smpboot.c -index eb89e1807408..60d35ac5d3f1 100644 ---- a/kernel/smpboot.c -+++ b/kernel/smpboot.c -@@ -279,6 +279,7 @@ int smpboot_register_percpu_thread(struct smp_hotplug_thread *plug_thread) - unsigned int cpu; - int ret = 0; - -+ get_online_cpus(); - mutex_lock(&smpboot_threads_lock); - for_each_online_cpu(cpu) { - ret = __smpboot_create_thread(plug_thread, cpu); -@@ -291,6 +292,7 @@ int smpboot_register_percpu_thread(struct smp_hotplug_thread *plug_thread) - list_add(&plug_thread->list, &hotplug_threads); - out: - mutex_unlock(&smpboot_threads_lock); -+ put_online_cpus(); - return ret; - } - EXPORT_SYMBOL_GPL(smpboot_register_percpu_thread); -diff --git a/lib/checksum.c b/lib/checksum.c -index 129775eb6de6..8b39e86dbab5 100644 ---- a/lib/checksum.c -+++ b/lib/checksum.c -@@ -181,6 +181,15 @@ csum_partial_copy(const void *src, void *dst, int len, __wsum sum) - EXPORT_SYMBOL(csum_partial_copy); - - #ifndef csum_tcpudp_nofold -+static inline u32 from64to32(u64 x) -+{ -+ /* add up 32-bit and 32-bit for 32+c bit */ -+ x = (x & 0xffffffff) + (x >> 32); -+ /* add up carry.. */ -+ x = (x & 0xffffffff) + (x >> 32); -+ return (u32)x; -+} -+ - __wsum csum_tcpudp_nofold(__be32 saddr, __be32 daddr, - unsigned short len, - unsigned short proto, -@@ -195,8 +204,7 @@ __wsum csum_tcpudp_nofold(__be32 saddr, __be32 daddr, - #else - s += (proto + len) << 8; - #endif -- s += (s >> 32); -- return (__force __wsum)s; -+ return (__force __wsum)from64to32(s); - } - EXPORT_SYMBOL(csum_tcpudp_nofold); - #endif -diff --git a/mm/pagewalk.c b/mm/pagewalk.c -index 2beeabf502c5..9056d22d2880 100644 ---- a/mm/pagewalk.c -+++ b/mm/pagewalk.c -@@ -199,7 +199,10 @@ int walk_page_range(unsigned long addr, unsigned long end, - */ - if ((vma->vm_start <= addr) && - (vma->vm_flags & VM_PFNMAP)) { -- next = vma->vm_end; -+ if (walk->pte_hole) -+ err = walk->pte_hole(addr, next, walk); -+ if (err) -+ break; - pgd = pgd_offset(walk->mm, next); - continue; - } -diff --git a/sound/i2c/other/ak4113.c b/sound/i2c/other/ak4113.c -index e04e750a77ed..7a9149bb2a38 100644 ---- a/sound/i2c/other/ak4113.c -+++ b/sound/i2c/other/ak4113.c -@@ -56,8 +56,7 @@ static inline unsigned char reg_read(struct ak4113 *ak4113, unsigned char reg) - - static void snd_ak4113_free(struct ak4113 *chip) - { -- chip->init = 1; /* don't schedule new work */ -- mb(); -+ atomic_inc(&chip->wq_processing); /* don't schedule new work */ - cancel_delayed_work_sync(&chip->work); - kfree(chip); - } -@@ -89,6 +88,7 @@ int snd_ak4113_create(struct snd_card *card, ak4113_read_t *read, - chip->write = write; - chip->private_data = private_data; - INIT_DELAYED_WORK(&chip->work, ak4113_stats); -+ atomic_set(&chip->wq_processing, 0); - - for (reg = 0; reg < AK4113_WRITABLE_REGS ; reg++) - chip->regmap[reg] = pgm[reg]; -@@ -139,13 +139,11 @@ static void ak4113_init_regs(struct ak4113 *chip) - - void snd_ak4113_reinit(struct ak4113 *chip) - { -- chip->init = 1; -- mb(); -- flush_delayed_work(&chip->work); -+ if (atomic_inc_return(&chip->wq_processing) == 1) -+ cancel_delayed_work_sync(&chip->work); - ak4113_init_regs(chip); - /* bring up statistics / event queing */ -- chip->init = 0; -- if (chip->kctls[0]) -+ if (atomic_dec_and_test(&chip->wq_processing)) - schedule_delayed_work(&chip->work, HZ / 10); - } - EXPORT_SYMBOL_GPL(snd_ak4113_reinit); -@@ -632,8 +630,9 @@ static void ak4113_stats(struct work_struct *work) - { - struct ak4113 *chip = container_of(work, struct ak4113, work.work); - -- if (!chip->init) -+ if (atomic_inc_return(&chip->wq_processing) == 1) - snd_ak4113_check_rate_and_errors(chip, chip->check_flags); - -- schedule_delayed_work(&chip->work, HZ / 10); -+ if (atomic_dec_and_test(&chip->wq_processing)) -+ schedule_delayed_work(&chip->work, HZ / 10); - } -diff --git a/sound/i2c/other/ak4114.c b/sound/i2c/other/ak4114.c -index 15ae0250eace..bf515db7c2e1 100644 ---- a/sound/i2c/other/ak4114.c -+++ b/sound/i2c/other/ak4114.c -@@ -66,8 +66,7 @@ static void reg_dump(struct ak4114 *ak4114) - - static void snd_ak4114_free(struct ak4114 *chip) - { -- chip->init = 1; /* don't schedule new work */ -- mb(); -+ atomic_inc(&chip->wq_processing); /* don't schedule new work */ - cancel_delayed_work_sync(&chip->work); - kfree(chip); - } -@@ -100,6 +99,7 @@ int snd_ak4114_create(struct snd_card *card, - chip->write = write; - chip->private_data = private_data; - INIT_DELAYED_WORK(&chip->work, ak4114_stats); -+ atomic_set(&chip->wq_processing, 0); - - for (reg = 0; reg < 6; reg++) - chip->regmap[reg] = pgm[reg]; -@@ -152,13 +152,11 @@ static void ak4114_init_regs(struct ak4114 *chip) - - void snd_ak4114_reinit(struct ak4114 *chip) - { -- chip->init = 1; -- mb(); -- flush_delayed_work(&chip->work); -+ if (atomic_inc_return(&chip->wq_processing) == 1) -+ cancel_delayed_work_sync(&chip->work); - ak4114_init_regs(chip); - /* bring up statistics / event queing */ -- chip->init = 0; -- if (chip->kctls[0]) -+ if (atomic_dec_and_test(&chip->wq_processing)) - schedule_delayed_work(&chip->work, HZ / 10); - } - -@@ -612,10 +610,10 @@ static void ak4114_stats(struct work_struct *work) - { - struct ak4114 *chip = container_of(work, struct ak4114, work.work); - -- if (!chip->init) -+ if (atomic_inc_return(&chip->wq_processing) == 1) - snd_ak4114_check_rate_and_errors(chip, chip->check_flags); -- -- schedule_delayed_work(&chip->work, HZ / 10); -+ if (atomic_dec_and_test(&chip->wq_processing)) -+ schedule_delayed_work(&chip->work, HZ / 10); - } - - EXPORT_SYMBOL(snd_ak4114_create); -diff --git a/sound/soc/atmel/atmel_ssc_dai.c b/sound/soc/atmel/atmel_ssc_dai.c -index 1ead3c977a51..f20e703b2a35 100644 ---- a/sound/soc/atmel/atmel_ssc_dai.c -+++ b/sound/soc/atmel/atmel_ssc_dai.c -@@ -344,7 +344,6 @@ static int atmel_ssc_hw_params(struct snd_pcm_substream *substream, - struct atmel_pcm_dma_params *dma_params; - int dir, channels, bits; - u32 tfmr, rfmr, tcmr, rcmr; -- int start_event; - int ret; - - /* -@@ -451,19 +450,10 @@ static int atmel_ssc_hw_params(struct snd_pcm_substream *substream, - * The SSC transmit clock is obtained from the BCLK signal on - * on the TK line, and the SSC receive clock is - * generated from the transmit clock. -- * -- * For single channel data, one sample is transferred -- * on the falling edge of the LRC clock. -- * For two channel data, one sample is -- * transferred on both edges of the LRC clock. - */ -- start_event = ((channels == 1) -- ? SSC_START_FALLING_RF -- : SSC_START_EDGE_RF); -- - rcmr = SSC_BF(RCMR_PERIOD, 0) - | SSC_BF(RCMR_STTDLY, START_DELAY) -- | SSC_BF(RCMR_START, start_event) -+ | SSC_BF(RCMR_START, SSC_START_FALLING_RF) - | SSC_BF(RCMR_CKI, SSC_CKI_RISING) - | SSC_BF(RCMR_CKO, SSC_CKO_NONE) - | SSC_BF(RCMR_CKS, SSC_CKS_CLOCK); -@@ -471,14 +461,14 @@ static int atmel_ssc_hw_params(struct snd_pcm_substream *substream, - rfmr = SSC_BF(RFMR_FSEDGE, SSC_FSEDGE_POSITIVE) - | SSC_BF(RFMR_FSOS, SSC_FSOS_NONE) - | SSC_BF(RFMR_FSLEN, 0) -- | SSC_BF(RFMR_DATNB, 0) -+ | SSC_BF(RFMR_DATNB, (channels - 1)) - | SSC_BIT(RFMR_MSBF) - | SSC_BF(RFMR_LOOP, 0) - | SSC_BF(RFMR_DATLEN, (bits - 1)); - - tcmr = SSC_BF(TCMR_PERIOD, 0) - | SSC_BF(TCMR_STTDLY, START_DELAY) -- | SSC_BF(TCMR_START, start_event) -+ | SSC_BF(TCMR_START, SSC_START_FALLING_RF) - | SSC_BF(TCMR_CKI, SSC_CKI_FALLING) - | SSC_BF(TCMR_CKO, SSC_CKO_NONE) - | SSC_BF(TCMR_CKS, SSC_CKS_PIN); -@@ -487,7 +477,7 @@ static int atmel_ssc_hw_params(struct snd_pcm_substream *substream, - | SSC_BF(TFMR_FSDEN, 0) - | SSC_BF(TFMR_FSOS, SSC_FSOS_NONE) - | SSC_BF(TFMR_FSLEN, 0) -- | SSC_BF(TFMR_DATNB, 0) -+ | SSC_BF(TFMR_DATNB, (channels - 1)) - | SSC_BIT(TFMR_MSBF) - | SSC_BF(TFMR_DATDEF, 0) - | SSC_BF(TFMR_DATLEN, (bits - 1)); -diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c -index 12528e9ac4c2..715589ff0eda 100644 ---- a/sound/soc/codecs/sgtl5000.c -+++ b/sound/soc/codecs/sgtl5000.c -@@ -1521,6 +1521,9 @@ static int sgtl5000_i2c_probe(struct i2c_client *client, - if (ret) - return ret; - -+ /* Need 8 clocks before I2C accesses */ -+ udelay(1); -+ - /* read chip information */ - ret = regmap_read(sgtl5000->regmap, SGTL5000_CHIP_ID, ®); - if (ret) diff --git a/patch/kernel/odroidc2-default/patch-3.14.33-34.patch b/patch/kernel/odroidc2-default/patch-3.14.33-34.patch deleted file mode 100644 index ae3b116628..0000000000 --- a/patch/kernel/odroidc2-default/patch-3.14.33-34.patch +++ /dev/null @@ -1,559 +0,0 @@ -diff --git a/Makefile b/Makefile -index b0963ca2895d..54434817f2a4 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 3 - PATCHLEVEL = 14 --SUBLEVEL = 33 -+SUBLEVEL = 34 - EXTRAVERSION = - NAME = Remembering Coco - -diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c -index afa4a1f63270..a830d42e3d9b 100644 ---- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c -+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c -@@ -3131,7 +3131,7 @@ static int bnx2x_poll(struct napi_struct *napi, int budget) - } - #endif - if (!bnx2x_fp_lock_napi(fp)) -- return work_done; -+ return budget; - - for_each_cos_in_tx_queue(fp, cos) - if (bnx2x_tx_queue_has_work(fp->txdata_ptr[cos])) -diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c -index 70849dea32b1..5fa076fd439e 100644 ---- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c -+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c -@@ -2390,7 +2390,10 @@ static int netxen_nic_poll(struct napi_struct *napi, int budget) - - work_done = netxen_process_rcv_ring(sds_ring, budget); - -- if ((work_done < budget) && tx_complete) { -+ if (!tx_complete) -+ work_done = budget; -+ -+ if (work_done < budget) { - napi_complete(&sds_ring->napi); - if (test_bit(__NX_DEV_UP, &adapter->state)) - netxen_nic_enable_int(sds_ring); -diff --git a/drivers/net/ppp/ppp_deflate.c b/drivers/net/ppp/ppp_deflate.c -index 602c625d95d5..b5edc7f96a39 100644 ---- a/drivers/net/ppp/ppp_deflate.c -+++ b/drivers/net/ppp/ppp_deflate.c -@@ -246,7 +246,7 @@ static int z_compress(void *arg, unsigned char *rptr, unsigned char *obuf, - /* - * See if we managed to reduce the size of the packet. - */ -- if (olen < isize) { -+ if (olen < isize && olen <= osize) { - state->stats.comp_bytes += olen; - state->stats.comp_packets++; - } else { -diff --git a/include/net/ip.h b/include/net/ip.h -index 937f19681426..3446cdd29608 100644 ---- a/include/net/ip.h -+++ b/include/net/ip.h -@@ -38,11 +38,12 @@ struct inet_skb_parm { - struct ip_options opt; /* Compiled IP options */ - unsigned char flags; - --#define IPSKB_FORWARDED 1 --#define IPSKB_XFRM_TUNNEL_SIZE 2 --#define IPSKB_XFRM_TRANSFORMED 4 --#define IPSKB_FRAG_COMPLETE 8 --#define IPSKB_REROUTED 16 -+#define IPSKB_FORWARDED BIT(0) -+#define IPSKB_XFRM_TUNNEL_SIZE BIT(1) -+#define IPSKB_XFRM_TRANSFORMED BIT(2) -+#define IPSKB_FRAG_COMPLETE BIT(3) -+#define IPSKB_REROUTED BIT(4) -+#define IPSKB_DOREDIRECT BIT(5) - - u16 frag_max_size; - }; -@@ -174,7 +175,7 @@ static inline __u8 ip_reply_arg_flowi_flags(const struct ip_reply_arg *arg) - return (arg->flags & IP_REPLY_ARG_NOSRCCHECK) ? FLOWI_FLAG_ANYSRC : 0; - } - --void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr, -+void ip_send_unicast_reply(struct sock *sk, struct sk_buff *skb, __be32 daddr, - __be32 saddr, const struct ip_reply_arg *arg, - unsigned int len); - -diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h -index 80f500a29498..57c2da922952 100644 ---- a/include/net/netns/ipv4.h -+++ b/include/net/netns/ipv4.h -@@ -47,6 +47,7 @@ struct netns_ipv4 { - struct inet_peer_base *peers; - struct tcpm_hash_bucket *tcp_metrics_hash; - unsigned int tcp_metrics_hash_log; -+ struct sock * __percpu *tcp_sk; - struct netns_frags frags; - #ifdef CONFIG_NETFILTER - struct xt_table *iptable_filter; -diff --git a/net/core/dev.c b/net/core/dev.c -index 86bb9cc81f02..4ed77d7245c0 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -6812,10 +6812,20 @@ static int dev_cpu_callback(struct notifier_block *nfb, - oldsd->output_queue = NULL; - oldsd->output_queue_tailp = &oldsd->output_queue; - } -- /* Append NAPI poll list from offline CPU. */ -- if (!list_empty(&oldsd->poll_list)) { -- list_splice_init(&oldsd->poll_list, &sd->poll_list); -- raise_softirq_irqoff(NET_RX_SOFTIRQ); -+ /* Append NAPI poll list from offline CPU, with one exception : -+ * process_backlog() must be called by cpu owning percpu backlog. -+ * We properly handle process_queue & input_pkt_queue later. -+ */ -+ while (!list_empty(&oldsd->poll_list)) { -+ struct napi_struct *napi = list_first_entry(&oldsd->poll_list, -+ struct napi_struct, -+ poll_list); -+ -+ list_del_init(&napi->poll_list); -+ if (napi->poll == process_backlog) -+ napi->state = 0; -+ else -+ ____napi_schedule(sd, napi); - } - - raise_softirq_irqoff(NET_TX_SOFTIRQ); -@@ -6826,7 +6836,7 @@ static int dev_cpu_callback(struct notifier_block *nfb, - netif_rx_internal(skb); - input_queue_head_incr(oldsd); - } -- while ((skb = __skb_dequeue(&oldsd->input_pkt_queue))) { -+ while ((skb = skb_dequeue(&oldsd->input_pkt_queue))) { - netif_rx_internal(skb); - input_queue_head_incr(oldsd); - } -diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c -index 46175866851e..a6613ff972c1 100644 ---- a/net/core/rtnetlink.c -+++ b/net/core/rtnetlink.c -@@ -2649,12 +2649,16 @@ static int rtnl_bridge_notify(struct net_device *dev, u16 flags) - goto errout; - } - -+ if (!skb->len) -+ goto errout; -+ - rtnl_notify(skb, net, 0, RTNLGRP_LINK, NULL, GFP_ATOMIC); - return 0; - errout: - WARN_ON(err == -EMSGSIZE); - kfree_skb(skb); -- rtnl_set_sk_err(net, RTNLGRP_LINK, err); -+ if (err) -+ rtnl_set_sk_err(net, RTNLGRP_LINK, err); - return err; - } - -diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c -index 1c6bd4359cbd..ecb34b5ea42f 100644 ---- a/net/ipv4/ip_forward.c -+++ b/net/ipv4/ip_forward.c -@@ -178,7 +178,8 @@ int ip_forward(struct sk_buff *skb) - * We now generate an ICMP HOST REDIRECT giving the route - * we calculated. - */ -- if (rt->rt_flags&RTCF_DOREDIRECT && !opt->srr && !skb_sec_path(skb)) -+ if (IPCB(skb)->flags & IPSKB_DOREDIRECT && !opt->srr && -+ !skb_sec_path(skb)) - ip_rt_send_redirect(skb); - - skb->priority = rt_tos2priority(iph->tos); -diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c -index 844323b6cfb9..dd637fc4b553 100644 ---- a/net/ipv4/ip_output.c -+++ b/net/ipv4/ip_output.c -@@ -1460,23 +1460,8 @@ static int ip_reply_glue_bits(void *dptr, char *to, int offset, - /* - * Generic function to send a packet as reply to another packet. - * Used to send some TCP resets/acks so far. -- * -- * Use a fake percpu inet socket to avoid false sharing and contention. - */ --static DEFINE_PER_CPU(struct inet_sock, unicast_sock) = { -- .sk = { -- .__sk_common = { -- .skc_refcnt = ATOMIC_INIT(1), -- }, -- .sk_wmem_alloc = ATOMIC_INIT(1), -- .sk_allocation = GFP_ATOMIC, -- .sk_flags = (1UL << SOCK_USE_WRITE_QUEUE), -- }, -- .pmtudisc = IP_PMTUDISC_WANT, -- .uc_ttl = -1, --}; -- --void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr, -+void ip_send_unicast_reply(struct sock *sk, struct sk_buff *skb, __be32 daddr, - __be32 saddr, const struct ip_reply_arg *arg, - unsigned int len) - { -@@ -1484,9 +1469,8 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr, - struct ipcm_cookie ipc; - struct flowi4 fl4; - struct rtable *rt = skb_rtable(skb); -+ struct net *net = sock_net(sk); - struct sk_buff *nskb; -- struct sock *sk; -- struct inet_sock *inet; - int err; - - if (ip_options_echo(&replyopts.opt.opt, skb)) -@@ -1516,15 +1500,11 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr, - if (IS_ERR(rt)) - return; - -- inet = &get_cpu_var(unicast_sock); -+ inet_sk(sk)->tos = arg->tos; - -- inet->tos = arg->tos; -- sk = &inet->sk; - sk->sk_priority = skb->priority; - sk->sk_protocol = ip_hdr(skb)->protocol; - sk->sk_bound_dev_if = arg->bound_dev_if; -- sock_net_set(sk, net); -- __skb_queue_head_init(&sk->sk_write_queue); - sk->sk_sndbuf = sysctl_wmem_default; - err = ip_append_data(sk, &fl4, ip_reply_glue_bits, arg->iov->iov_base, - len, 0, &ipc, &rt, MSG_DONTWAIT); -@@ -1540,13 +1520,10 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr, - arg->csumoffset) = csum_fold(csum_add(nskb->csum, - arg->csum)); - nskb->ip_summed = CHECKSUM_NONE; -- skb_orphan(nskb); - skb_set_queue_mapping(nskb, skb_get_queue_mapping(skb)); - ip_push_pending_frames(sk, &fl4); - } - out: -- put_cpu_var(unicast_sock); -- - ip_rt_put(rt); - } - -diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c -index 580dd96666e0..135045e0e125 100644 ---- a/net/ipv4/ip_sockglue.c -+++ b/net/ipv4/ip_sockglue.c -@@ -426,15 +426,11 @@ int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len) - - memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err)); - sin = &errhdr.offender; -- sin->sin_family = AF_UNSPEC; -+ memset(sin, 0, sizeof(*sin)); - if (serr->ee.ee_origin == SO_EE_ORIGIN_ICMP) { -- struct inet_sock *inet = inet_sk(sk); -- - sin->sin_family = AF_INET; - sin->sin_addr.s_addr = ip_hdr(skb)->saddr; -- sin->sin_port = 0; -- memset(&sin->sin_zero, 0, sizeof(sin->sin_zero)); -- if (inet->cmsg_flags) -+ if (inet_sk(sk)->cmsg_flags) - ip_cmsg_recv(msg, skb); - } - -diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c -index 0d33f947a87f..04ce671430cb 100644 ---- a/net/ipv4/ping.c -+++ b/net/ipv4/ping.c -@@ -973,8 +973,11 @@ void ping_rcv(struct sk_buff *skb) - - sk = ping_lookup(net, skb, ntohs(icmph->un.echo.id)); - if (sk != NULL) { -+ struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC); -+ - pr_debug("rcv on socket %p\n", sk); -- ping_queue_rcv_skb(sk, skb_get(skb)); -+ if (skb2) -+ ping_queue_rcv_skb(sk, skb2); - sock_put(sk); - return; - } -diff --git a/net/ipv4/route.c b/net/ipv4/route.c -index 487bb6252520..b64330f25fbe 100644 ---- a/net/ipv4/route.c -+++ b/net/ipv4/route.c -@@ -1554,11 +1554,10 @@ static int __mkroute_input(struct sk_buff *skb, - - do_cache = res->fi && !itag; - if (out_dev == in_dev && err && IN_DEV_TX_REDIRECTS(out_dev) && -+ skb->protocol == htons(ETH_P_IP) && - (IN_DEV_SHARED_MEDIA(out_dev) || -- inet_addr_onlink(out_dev, saddr, FIB_RES_GW(*res)))) { -- flags |= RTCF_DOREDIRECT; -- do_cache = false; -- } -+ inet_addr_onlink(out_dev, saddr, FIB_RES_GW(*res)))) -+ IPCB(skb)->flags |= IPSKB_DOREDIRECT; - - if (skb->protocol != htons(ETH_P_IP)) { - /* Not IP (i.e. ARP). Do not create route, if it is -@@ -2305,6 +2304,8 @@ static int rt_fill_info(struct net *net, __be32 dst, __be32 src, - r->rtm_flags = (rt->rt_flags & ~0xFFFF) | RTM_F_CLONED; - if (rt->rt_flags & RTCF_NOTIFY) - r->rtm_flags |= RTM_F_NOTIFY; -+ if (IPCB(skb)->flags & IPSKB_DOREDIRECT) -+ r->rtm_flags |= RTCF_DOREDIRECT; - - if (nla_put_be32(skb, RTA_DST, dst)) - goto nla_put_failure; -diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c -index a782d5be132e..b7effad5a58c 100644 ---- a/net/ipv4/tcp_ipv4.c -+++ b/net/ipv4/tcp_ipv4.c -@@ -691,7 +691,8 @@ static void tcp_v4_send_reset(struct sock *sk, struct sk_buff *skb) - - net = dev_net(skb_dst(skb)->dev); - arg.tos = ip_hdr(skb)->tos; -- ip_send_unicast_reply(net, skb, ip_hdr(skb)->saddr, -+ ip_send_unicast_reply(*this_cpu_ptr(net->ipv4.tcp_sk), -+ skb, ip_hdr(skb)->saddr, - ip_hdr(skb)->daddr, &arg, arg.iov[0].iov_len); - - TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS); -@@ -774,7 +775,8 @@ static void tcp_v4_send_ack(struct sk_buff *skb, u32 seq, u32 ack, - if (oif) - arg.bound_dev_if = oif; - arg.tos = tos; -- ip_send_unicast_reply(net, skb, ip_hdr(skb)->saddr, -+ ip_send_unicast_reply(*this_cpu_ptr(net->ipv4.tcp_sk), -+ skb, ip_hdr(skb)->saddr, - ip_hdr(skb)->daddr, &arg, arg.iov[0].iov_len); - - TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS); -@@ -2769,14 +2771,39 @@ struct proto tcp_prot = { - }; - EXPORT_SYMBOL(tcp_prot); - -+static void __net_exit tcp_sk_exit(struct net *net) -+{ -+ int cpu; -+ -+ for_each_possible_cpu(cpu) -+ inet_ctl_sock_destroy(*per_cpu_ptr(net->ipv4.tcp_sk, cpu)); -+ free_percpu(net->ipv4.tcp_sk); -+} -+ - static int __net_init tcp_sk_init(struct net *net) - { -+ int res, cpu; -+ -+ net->ipv4.tcp_sk = alloc_percpu(struct sock *); -+ if (!net->ipv4.tcp_sk) -+ return -ENOMEM; -+ -+ for_each_possible_cpu(cpu) { -+ struct sock *sk; -+ -+ res = inet_ctl_sock_create(&sk, PF_INET, SOCK_RAW, -+ IPPROTO_TCP, net); -+ if (res) -+ goto fail; -+ *per_cpu_ptr(net->ipv4.tcp_sk, cpu) = sk; -+ } - net->ipv4.sysctl_tcp_ecn = 2; - return 0; --} - --static void __net_exit tcp_sk_exit(struct net *net) --{ -+fail: -+ tcp_sk_exit(net); -+ -+ return res; - } - - static void __net_exit tcp_sk_exit_batch(struct list_head *net_exit_list) -diff --git a/net/ipv4/udp_diag.c b/net/ipv4/udp_diag.c -index 7927db0a9279..4a000f1dd757 100644 ---- a/net/ipv4/udp_diag.c -+++ b/net/ipv4/udp_diag.c -@@ -99,11 +99,13 @@ static void udp_dump(struct udp_table *table, struct sk_buff *skb, struct netlin - s_slot = cb->args[0]; - num = s_num = cb->args[1]; - -- for (slot = s_slot; slot <= table->mask; num = s_num = 0, slot++) { -+ for (slot = s_slot; slot <= table->mask; s_num = 0, slot++) { - struct sock *sk; - struct hlist_nulls_node *node; - struct udp_hslot *hslot = &table->hash[slot]; - -+ num = 0; -+ - if (hlist_nulls_empty(&hslot->head)) - continue; - -diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c -index c3bf2d2e519e..841cfa2c4600 100644 ---- a/net/ipv6/datagram.c -+++ b/net/ipv6/datagram.c -@@ -382,11 +382,10 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len) - - memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err)); - sin = &errhdr.offender; -- sin->sin6_family = AF_UNSPEC; -+ memset(sin, 0, sizeof(*sin)); -+ - if (serr->ee.ee_origin != SO_EE_ORIGIN_LOCAL) { - sin->sin6_family = AF_INET6; -- sin->sin6_flowinfo = 0; -- sin->sin6_port = 0; - if (np->rxopt.all) - ip6_datagram_recv_common_ctl(sk, msg, skb); - if (skb->protocol == htons(ETH_P_IPV6)) { -@@ -397,12 +396,9 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len) - ipv6_iface_scope_id(&sin->sin6_addr, - IP6CB(skb)->iif); - } else { -- struct inet_sock *inet = inet_sk(sk); -- - ipv6_addr_set_v4mapped(ip_hdr(skb)->saddr, - &sin->sin6_addr); -- sin->sin6_scope_id = 0; -- if (inet->cmsg_flags) -+ if (inet_sk(sk)->cmsg_flags) - ip_cmsg_recv(msg, skb); - } - } -diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c -index 1e55f5eba185..7daaeaf1bc1a 100644 ---- a/net/ipv6/ip6_fib.c -+++ b/net/ipv6/ip6_fib.c -@@ -638,6 +638,29 @@ static inline bool rt6_qualify_for_ecmp(struct rt6_info *rt) - RTF_GATEWAY; - } - -+static void fib6_purge_rt(struct rt6_info *rt, struct fib6_node *fn, -+ struct net *net) -+{ -+ if (atomic_read(&rt->rt6i_ref) != 1) { -+ /* This route is used as dummy address holder in some split -+ * nodes. It is not leaked, but it still holds other resources, -+ * which must be released in time. So, scan ascendant nodes -+ * and replace dummy references to this route with references -+ * to still alive ones. -+ */ -+ while (fn) { -+ if (!(fn->fn_flags & RTN_RTINFO) && fn->leaf == rt) { -+ fn->leaf = fib6_find_prefix(net, fn); -+ atomic_inc(&fn->leaf->rt6i_ref); -+ rt6_release(rt); -+ } -+ fn = fn->parent; -+ } -+ /* No more references are possible at this point. */ -+ BUG_ON(atomic_read(&rt->rt6i_ref) != 1); -+ } -+} -+ - /* - * Insert routing information in a node. - */ -@@ -775,11 +798,12 @@ add: - rt->dst.rt6_next = iter->dst.rt6_next; - atomic_inc(&rt->rt6i_ref); - inet6_rt_notify(RTM_NEWROUTE, rt, info); -- rt6_release(iter); - if (!(fn->fn_flags & RTN_RTINFO)) { - info->nl_net->ipv6.rt6_stats->fib_route_nodes++; - fn->fn_flags |= RTN_RTINFO; - } -+ fib6_purge_rt(iter, fn, info->nl_net); -+ rt6_release(iter); - } - - return 0; -@@ -1284,24 +1308,7 @@ static void fib6_del_route(struct fib6_node *fn, struct rt6_info **rtp, - fn = fib6_repair_tree(net, fn); - } - -- if (atomic_read(&rt->rt6i_ref) != 1) { -- /* This route is used as dummy address holder in some split -- * nodes. It is not leaked, but it still holds other resources, -- * which must be released in time. So, scan ascendant nodes -- * and replace dummy references to this route with references -- * to still alive ones. -- */ -- while (fn) { -- if (!(fn->fn_flags & RTN_RTINFO) && fn->leaf == rt) { -- fn->leaf = fib6_find_prefix(net, fn); -- atomic_inc(&fn->leaf->rt6i_ref); -- rt6_release(rt); -- } -- fn = fn->parent; -- } -- /* No more references are possible at this point. */ -- BUG_ON(atomic_read(&rt->rt6i_ref) != 1); -- } -+ fib6_purge_rt(rt, fn, net); - - inet6_rt_notify(RTM_DELROUTE, rt, info); - rt6_release(rt); -diff --git a/net/ipv6/route.c b/net/ipv6/route.c -index 7cc1102e298c..6f1b8503a431 100644 ---- a/net/ipv6/route.c -+++ b/net/ipv6/route.c -@@ -1160,12 +1160,9 @@ static void ip6_rt_update_pmtu(struct dst_entry *dst, struct sock *sk, - struct net *net = dev_net(dst->dev); - - rt6->rt6i_flags |= RTF_MODIFIED; -- if (mtu < IPV6_MIN_MTU) { -- u32 features = dst_metric(dst, RTAX_FEATURES); -+ if (mtu < IPV6_MIN_MTU) - mtu = IPV6_MIN_MTU; -- features |= RTAX_FEATURE_ALLFRAG; -- dst_metric_set(dst, RTAX_FEATURES, features); -- } -+ - dst_metric_set(dst, RTAX_MTU, mtu); - rt6_update_expires(rt6, net->ipv6.sysctl.ip6_rt_mtu_expires); - } -diff --git a/net/sctp/associola.c b/net/sctp/associola.c -index d477d476714d..abc0922d0e31 100644 ---- a/net/sctp/associola.c -+++ b/net/sctp/associola.c -@@ -1235,7 +1235,6 @@ void sctp_assoc_update(struct sctp_association *asoc, - asoc->peer.peer_hmacs = new->peer.peer_hmacs; - new->peer.peer_hmacs = NULL; - -- sctp_auth_key_put(asoc->asoc_shared_key); - sctp_auth_asoc_init_active_key(asoc, GFP_ATOMIC); - } - -diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c -index 43abb643f3a1..df06b13a50f6 100644 ---- a/net/sctp/sm_make_chunk.c -+++ b/net/sctp/sm_make_chunk.c -@@ -2608,7 +2608,7 @@ do_addr_param: - - addr_param = param.v + sizeof(sctp_addip_param_t); - -- af = sctp_get_af_specific(param_type2af(param.p->type)); -+ af = sctp_get_af_specific(param_type2af(addr_param->p.type)); - if (af == NULL) - break; - -diff --git a/net/socket.c b/net/socket.c -index a19ae1968d37..1b2c2d62ff20 100644 ---- a/net/socket.c -+++ b/net/socket.c -@@ -886,9 +886,6 @@ static ssize_t sock_splice_read(struct file *file, loff_t *ppos, - static struct sock_iocb *alloc_sock_iocb(struct kiocb *iocb, - struct sock_iocb *siocb) - { -- if (!is_sync_kiocb(iocb)) -- BUG(); -- - siocb->kiocb = iocb; - iocb->private = siocb; - return siocb; diff --git a/patch/kernel/odroidc2-default/patch-3.14.34-35.patch b/patch/kernel/odroidc2-default/patch-3.14.34-35.patch deleted file mode 100644 index e8a6189a61..0000000000 --- a/patch/kernel/odroidc2-default/patch-3.14.34-35.patch +++ /dev/null @@ -1,2036 +0,0 @@ -diff --git a/Makefile b/Makefile -index 54434817f2a4..9720e863c06f 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 3 - PATCHLEVEL = 14 --SUBLEVEL = 34 -+SUBLEVEL = 35 - EXTRAVERSION = - NAME = Remembering Coco - -diff --git a/arch/arc/include/asm/pgtable.h b/arch/arc/include/asm/pgtable.h -index 6b0b7f7ef783..7670f33b9ce2 100644 ---- a/arch/arc/include/asm/pgtable.h -+++ b/arch/arc/include/asm/pgtable.h -@@ -259,7 +259,8 @@ static inline void pmd_set(pmd_t *pmdp, pte_t *ptep) - #define pmd_clear(xp) do { pmd_val(*(xp)) = 0; } while (0) - - #define pte_page(x) (mem_map + \ -- (unsigned long)(((pte_val(x) - PAGE_OFFSET) >> PAGE_SHIFT))) -+ (unsigned long)(((pte_val(x) - CONFIG_LINUX_LINK_BASE) >> \ -+ PAGE_SHIFT))) - - #define mk_pte(page, pgprot) \ - ({ \ -diff --git a/arch/arm/boot/dts/am335x-bone-common.dtsi b/arch/arm/boot/dts/am335x-bone-common.dtsi -index 2e7d932887b5..b3eff40188c6 100644 ---- a/arch/arm/boot/dts/am335x-bone-common.dtsi -+++ b/arch/arm/boot/dts/am335x-bone-common.dtsi -@@ -197,6 +197,7 @@ - - usb@47401000 { - status = "okay"; -+ dr_mode = "peripheral"; - }; - - usb@47401800 { -diff --git a/arch/arm/boot/dts/tegra20.dtsi b/arch/arm/boot/dts/tegra20.dtsi -index 48d2a7f4d0c0..ce978bc5b6d4 100644 ---- a/arch/arm/boot/dts/tegra20.dtsi -+++ b/arch/arm/boot/dts/tegra20.dtsi -@@ -76,9 +76,9 @@ - reset-names = "2d"; - }; - -- gr3d@54140000 { -+ gr3d@54180000 { - compatible = "nvidia,tegra20-gr3d"; -- reg = <0x54140000 0x00040000>; -+ reg = <0x54180000 0x00040000>; - clocks = <&tegra_car TEGRA20_CLK_GR3D>; - resets = <&tegra_car 24>; - reset-names = "3d"; -@@ -138,9 +138,9 @@ - status = "disabled"; - }; - -- dsi@542c0000 { -+ dsi@54300000 { - compatible = "nvidia,tegra20-dsi"; -- reg = <0x542c0000 0x00040000>; -+ reg = <0x54300000 0x00040000>; - clocks = <&tegra_car TEGRA20_CLK_DSI>; - resets = <&tegra_car 48>; - reset-names = "dsi"; -diff --git a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c -index 2e35ff99f60e..d3ac4c634624 100644 ---- a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c -+++ b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c -@@ -1669,7 +1669,7 @@ static struct omap_hwmod dra7xx_uart3_hwmod = { - .class = &dra7xx_uart_hwmod_class, - .clkdm_name = "l4per_clkdm", - .main_clk = "uart3_gfclk_mux", -- .flags = HWMOD_SWSUP_SIDLE_ACT, -+ .flags = HWMOD_SWSUP_SIDLE_ACT | DEBUG_OMAP4UART3_FLAGS, - .prcm = { - .omap4 = { - .clkctrl_offs = DRA7XX_CM_L4PER_UART3_CLKCTRL_OFFSET, -diff --git a/arch/arm/mach-pxa/corgi.c b/arch/arm/mach-pxa/corgi.c -index f162f1b77cd2..82fd9dd17ed1 100644 ---- a/arch/arm/mach-pxa/corgi.c -+++ b/arch/arm/mach-pxa/corgi.c -@@ -26,6 +26,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -711,6 +712,8 @@ static void __init corgi_init(void) - sharpsl_nand_partitions[1].size = 53 * 1024 * 1024; - - platform_add_devices(devices, ARRAY_SIZE(devices)); -+ -+ regulator_has_full_constraints(); - } - - static void __init fixup_corgi(struct tag *tags, char **cmdline, -diff --git a/arch/arm/mach-pxa/hx4700.c b/arch/arm/mach-pxa/hx4700.c -index a7c30eb0c8db..007fd8a237d9 100644 ---- a/arch/arm/mach-pxa/hx4700.c -+++ b/arch/arm/mach-pxa/hx4700.c -@@ -892,6 +892,8 @@ static void __init hx4700_init(void) - mdelay(10); - gpio_set_value(GPIO71_HX4700_ASIC3_nRESET, 1); - mdelay(10); -+ -+ regulator_has_full_constraints(); - } - - MACHINE_START(H4700, "HP iPAQ HX4700") -diff --git a/arch/arm/mach-pxa/poodle.c b/arch/arm/mach-pxa/poodle.c -index aedf053a1de5..b4fff2998b8a 100644 ---- a/arch/arm/mach-pxa/poodle.c -+++ b/arch/arm/mach-pxa/poodle.c -@@ -25,6 +25,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -454,6 +455,7 @@ static void __init poodle_init(void) - pxa_set_i2c_info(NULL); - i2c_register_board_info(0, ARRAY_AND_SIZE(poodle_i2c_devices)); - poodle_init_spi(); -+ regulator_has_full_constraints(); - } - - static void __init fixup_poodle(struct tag *tags, char **cmdline, -diff --git a/arch/arm/mach-sa1100/pm.c b/arch/arm/mach-sa1100/pm.c -index 6645d1e31f14..34853d5dfda2 100644 ---- a/arch/arm/mach-sa1100/pm.c -+++ b/arch/arm/mach-sa1100/pm.c -@@ -81,6 +81,7 @@ static int sa11x0_pm_enter(suspend_state_t state) - /* - * Ensure not to come back here if it wasn't intended - */ -+ RCSR = RCSR_SMR; - PSPR = 0; - - /* -diff --git a/arch/arm64/kernel/signal32.c b/arch/arm64/kernel/signal32.c -index b3fc9f5ec6d3..7ed72dc0fb0e 100644 ---- a/arch/arm64/kernel/signal32.c -+++ b/arch/arm64/kernel/signal32.c -@@ -151,8 +151,7 @@ int copy_siginfo_to_user32(compat_siginfo_t __user *to, const siginfo_t *from) - case __SI_TIMER: - err |= __put_user(from->si_tid, &to->si_tid); - err |= __put_user(from->si_overrun, &to->si_overrun); -- err |= __put_user((compat_uptr_t)(unsigned long)from->si_ptr, -- &to->si_ptr); -+ err |= __put_user(from->si_int, &to->si_int); - break; - case __SI_POLL: - err |= __put_user(from->si_band, &to->si_band); -@@ -181,7 +180,7 @@ int copy_siginfo_to_user32(compat_siginfo_t __user *to, const siginfo_t *from) - case __SI_MESGQ: /* But this is */ - err |= __put_user(from->si_pid, &to->si_pid); - err |= __put_user(from->si_uid, &to->si_uid); -- err |= __put_user((compat_uptr_t)(unsigned long)from->si_ptr, &to->si_ptr); -+ err |= __put_user(from->si_int, &to->si_int); - break; - default: /* this is just in case for now ... */ - err |= __put_user(from->si_pid, &to->si_pid); -diff --git a/arch/metag/include/asm/processor.h b/arch/metag/include/asm/processor.h -index a8a37477c66e..eb2005bd3c79 100644 ---- a/arch/metag/include/asm/processor.h -+++ b/arch/metag/include/asm/processor.h -@@ -149,8 +149,8 @@ extern void exit_thread(void); - - unsigned long get_wchan(struct task_struct *p); - --#define KSTK_EIP(tsk) ((tsk)->thread.kernel_context->CurrPC) --#define KSTK_ESP(tsk) ((tsk)->thread.kernel_context->AX[0].U0) -+#define KSTK_EIP(tsk) (task_pt_regs(tsk)->ctx.CurrPC) -+#define KSTK_ESP(tsk) (task_pt_regs(tsk)->ctx.AX[0].U0) - - #define user_stack_pointer(regs) ((regs)->ctx.AX[0].U0) - -diff --git a/arch/mips/kernel/mips_ksyms.c b/arch/mips/kernel/mips_ksyms.c -index 6e58e97fcd39..cedeb5686eb5 100644 ---- a/arch/mips/kernel/mips_ksyms.c -+++ b/arch/mips/kernel/mips_ksyms.c -@@ -14,6 +14,7 @@ - #include - #include - #include -+#include - - extern void *__bzero(void *__s, size_t __count); - extern long __strncpy_from_user_nocheck_asm(char *__to, -@@ -26,6 +27,13 @@ extern long __strnlen_user_nocheck_asm(const char *s); - extern long __strnlen_user_asm(const char *s); - - /* -+ * Core architecture code -+ */ -+#ifdef CONFIG_CPU_R4K_FPU -+EXPORT_SYMBOL_GPL(_save_fp); -+#endif -+ -+/* - * String functions - */ - EXPORT_SYMBOL(memset); -diff --git a/arch/mips/kvm/kvm_locore.S b/arch/mips/kvm/kvm_locore.S -index bbace092ad0a..03a2db58b22d 100644 ---- a/arch/mips/kvm/kvm_locore.S -+++ b/arch/mips/kvm/kvm_locore.S -@@ -428,7 +428,7 @@ __kvm_mips_return_to_guest: - /* Setup status register for running guest in UM */ - .set at - or v1, v1, (ST0_EXL | KSU_USER | ST0_IE) -- and v1, v1, ~ST0_CU0 -+ and v1, v1, ~(ST0_CU0 | ST0_MX) - .set noat - mtc0 v1, CP0_STATUS - ehb -diff --git a/arch/mips/kvm/kvm_mips.c b/arch/mips/kvm/kvm_mips.c -index 3e0ff8d0fbf9..897c605263f2 100644 ---- a/arch/mips/kvm/kvm_mips.c -+++ b/arch/mips/kvm/kvm_mips.c -@@ -15,6 +15,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -418,11 +419,13 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *run) - vcpu->mmio_needed = 0; - } - -+ lose_fpu(1); -+ -+ local_irq_disable(); - /* Check if we have any exceptions/interrupts pending */ - kvm_mips_deliver_interrupts(vcpu, - kvm_read_c0_guest_cause(vcpu->arch.cop0)); - -- local_irq_disable(); - kvm_guest_enter(); - - r = __kvm_mips_vcpu_run(run, vcpu); -@@ -1021,9 +1024,6 @@ void kvm_mips_set_c0_status(void) - { - uint32_t status = read_c0_status(); - -- if (cpu_has_fpu) -- status |= (ST0_CU1); -- - if (cpu_has_dsp) - status |= (ST0_MX); - -diff --git a/arch/powerpc/sysdev/axonram.c b/arch/powerpc/sysdev/axonram.c -index 47b6b9f81d43..830edc83c12a 100644 ---- a/arch/powerpc/sysdev/axonram.c -+++ b/arch/powerpc/sysdev/axonram.c -@@ -156,7 +156,7 @@ axon_ram_direct_access(struct block_device *device, sector_t sector, - } - - *kaddr = (void *)(bank->ph_addr + offset); -- *pfn = virt_to_phys(kaddr) >> PAGE_SHIFT; -+ *pfn = virt_to_phys(*kaddr) >> PAGE_SHIFT; - - return 0; - } -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index fab97ade0fc8..1777f89875fb 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -1207,21 +1207,22 @@ void kvm_track_tsc_matching(struct kvm_vcpu *vcpu) - { - #ifdef CONFIG_X86_64 - bool vcpus_matched; -- bool do_request = false; - struct kvm_arch *ka = &vcpu->kvm->arch; - struct pvclock_gtod_data *gtod = &pvclock_gtod_data; - - vcpus_matched = (ka->nr_vcpus_matched_tsc + 1 == - atomic_read(&vcpu->kvm->online_vcpus)); - -- if (vcpus_matched && gtod->clock.vclock_mode == VCLOCK_TSC) -- if (!ka->use_master_clock) -- do_request = 1; -- -- if (!vcpus_matched && ka->use_master_clock) -- do_request = 1; -- -- if (do_request) -+ /* -+ * Once the masterclock is enabled, always perform request in -+ * order to update it. -+ * -+ * In order to enable masterclock, the host clocksource must be TSC -+ * and the vcpus need to have matched TSCs. When that happens, -+ * perform request to enable masterclock. -+ */ -+ if (ka->use_master_clock || -+ (gtod->clock.vclock_mode == VCLOCK_TSC && vcpus_matched)) - kvm_make_request(KVM_REQ_MASTERCLOCK_UPDATE, vcpu); - - trace_kvm_track_tsc(vcpu->vcpu_id, ka->nr_vcpus_matched_tsc, -diff --git a/arch/x86/mm/gup.c b/arch/x86/mm/gup.c -index 207d9aef662d..448ee8912d9b 100644 ---- a/arch/x86/mm/gup.c -+++ b/arch/x86/mm/gup.c -@@ -172,7 +172,7 @@ static int gup_pmd_range(pud_t pud, unsigned long addr, unsigned long end, - */ - if (pmd_none(pmd) || pmd_trans_splitting(pmd)) - return 0; -- if (unlikely(pmd_large(pmd))) { -+ if (unlikely(pmd_large(pmd) || !pmd_present(pmd))) { - /* - * NUMA hinting faults need to be handled in the GUP - * slowpath for accounting purposes and so that they -diff --git a/arch/x86/mm/hugetlbpage.c b/arch/x86/mm/hugetlbpage.c -index 8b977ebf9388..006cc914994b 100644 ---- a/arch/x86/mm/hugetlbpage.c -+++ b/arch/x86/mm/hugetlbpage.c -@@ -66,9 +66,15 @@ follow_huge_addr(struct mm_struct *mm, unsigned long address, int write) - return ERR_PTR(-EINVAL); - } - -+/* -+ * pmd_huge() returns 1 if @pmd is hugetlb related entry, that is normal -+ * hugetlb entry or non-present (migration or hwpoisoned) hugetlb entry. -+ * Otherwise, returns 0. -+ */ - int pmd_huge(pmd_t pmd) - { -- return !!(pmd_val(pmd) & _PAGE_PSE); -+ return !pmd_none(pmd) && -+ (pmd_val(pmd) & (_PAGE_PRESENT|_PAGE_PSE)) != _PAGE_PRESENT; - } - - int pud_huge(pud_t pud) -diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c -index 25e7e1372bb2..3601ff284b92 100644 ---- a/arch/x86/mm/mmap.c -+++ b/arch/x86/mm/mmap.c -@@ -35,12 +35,12 @@ struct __read_mostly va_alignment va_align = { - .flags = -1, - }; - --static unsigned int stack_maxrandom_size(void) -+static unsigned long stack_maxrandom_size(void) - { -- unsigned int max = 0; -+ unsigned long max = 0; - if ((current->flags & PF_RANDOMIZE) && - !(current->personality & ADDR_NO_RANDOMIZE)) { -- max = ((-1U) & STACK_RND_MASK) << PAGE_SHIFT; -+ max = ((-1UL) & STACK_RND_MASK) << PAGE_SHIFT; - } - - return max; -diff --git a/block/blk-throttle.c b/block/blk-throttle.c -index 1474c3ab7e72..15998784c00e 100644 ---- a/block/blk-throttle.c -+++ b/block/blk-throttle.c -@@ -1292,6 +1292,9 @@ static u64 tg_prfill_cpu_rwstat(struct seq_file *sf, - struct blkg_rwstat rwstat = { }, tmp; - int i, cpu; - -+ if (tg->stats_cpu == NULL) -+ return 0; -+ - for_each_possible_cpu(cpu) { - struct tg_stats_cpu *sc = per_cpu_ptr(tg->stats_cpu, cpu); - -diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c -index 91c25f261c91..d9bba9915420 100644 ---- a/block/cfq-iosched.c -+++ b/block/cfq-iosched.c -@@ -3585,6 +3585,11 @@ retry: - - blkcg = bio_blkcg(bio); - cfqg = cfq_lookup_create_cfqg(cfqd, blkcg); -+ if (!cfqg) { -+ cfqq = &cfqd->oom_cfqq; -+ goto out; -+ } -+ - cfqq = cic_to_cfqq(cic, is_sync); - - /* -@@ -3621,7 +3626,7 @@ retry: - } else - cfqq = &cfqd->oom_cfqq; - } -- -+out: - if (new_cfqq) - kmem_cache_free(cfq_pool, new_cfqq); - -@@ -3651,12 +3656,17 @@ static struct cfq_queue * - cfq_get_queue(struct cfq_data *cfqd, bool is_sync, struct cfq_io_cq *cic, - struct bio *bio, gfp_t gfp_mask) - { -- const int ioprio_class = IOPRIO_PRIO_CLASS(cic->ioprio); -- const int ioprio = IOPRIO_PRIO_DATA(cic->ioprio); -+ int ioprio_class = IOPRIO_PRIO_CLASS(cic->ioprio); -+ int ioprio = IOPRIO_PRIO_DATA(cic->ioprio); - struct cfq_queue **async_cfqq = NULL; - struct cfq_queue *cfqq = NULL; - - if (!is_sync) { -+ if (!ioprio_valid(cic->ioprio)) { -+ struct task_struct *tsk = current; -+ ioprio = task_nice_ioprio(tsk); -+ ioprio_class = task_nice_ioclass(tsk); -+ } - async_cfqq = cfq_async_queue_prio(cfqd, ioprio_class, ioprio); - cfqq = *async_cfqq; - } -diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c -index b11949c5b029..f667e37394da 100644 ---- a/drivers/bluetooth/ath3k.c -+++ b/drivers/bluetooth/ath3k.c -@@ -157,6 +157,8 @@ static const struct usb_device_id ath3k_blist_tbl[] = { - #define USB_REQ_DFU_DNLOAD 1 - #define BULK_SIZE 4096 - #define FW_HDR_SIZE 20 -+#define TIMEGAP_USEC_MIN 50 -+#define TIMEGAP_USEC_MAX 100 - - static int ath3k_load_firmware(struct usb_device *udev, - const struct firmware *firmware) -@@ -187,6 +189,9 @@ static int ath3k_load_firmware(struct usb_device *udev, - count -= 20; - - while (count) { -+ /* workaround the compatibility issue with xHCI controller*/ -+ usleep_range(TIMEGAP_USEC_MIN, TIMEGAP_USEC_MAX); -+ - size = min_t(uint, count, BULK_SIZE); - pipe = usb_sndbulkpipe(udev, 0x02); - memcpy(send_buf, firmware->data + sent, size); -@@ -283,6 +288,9 @@ static int ath3k_load_fwfile(struct usb_device *udev, - count -= size; - - while (count) { -+ /* workaround the compatibility issue with xHCI controller*/ -+ usleep_range(TIMEGAP_USEC_MIN, TIMEGAP_USEC_MAX); -+ - size = min_t(uint, count, BULK_SIZE); - pipe = usb_sndbulkpipe(udev, 0x02); - -diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c -index 6af17002a115..cfb9089887bd 100644 ---- a/drivers/char/tpm/tpm-interface.c -+++ b/drivers/char/tpm/tpm-interface.c -@@ -1122,7 +1122,7 @@ struct tpm_chip *tpm_register_hardware(struct device *dev, - - /* Make chip available */ - spin_lock(&driver_lock); -- list_add_rcu(&chip->list, &tpm_chip_list); -+ list_add_tail_rcu(&chip->list, &tpm_chip_list); - spin_unlock(&driver_lock); - - return chip; -diff --git a/drivers/char/tpm/tpm_i2c_atmel.c b/drivers/char/tpm/tpm_i2c_atmel.c -index 77272925dee6..503a85ae176c 100644 ---- a/drivers/char/tpm/tpm_i2c_atmel.c -+++ b/drivers/char/tpm/tpm_i2c_atmel.c -@@ -168,6 +168,10 @@ static int i2c_atmel_probe(struct i2c_client *client, - - chip->vendor.priv = devm_kzalloc(dev, sizeof(struct priv_data), - GFP_KERNEL); -+ if (!chip->vendor.priv) { -+ rc = -ENOMEM; -+ goto out_err; -+ } - - /* Default timeouts */ - chip->vendor.timeout_a = msecs_to_jiffies(TPM_I2C_SHORT_TIMEOUT); -diff --git a/drivers/char/tpm/tpm_i2c_nuvoton.c b/drivers/char/tpm/tpm_i2c_nuvoton.c -index 7b158efd49f7..23c7b137a7fd 100644 ---- a/drivers/char/tpm/tpm_i2c_nuvoton.c -+++ b/drivers/char/tpm/tpm_i2c_nuvoton.c -@@ -538,6 +538,11 @@ static int i2c_nuvoton_probe(struct i2c_client *client, - - chip->vendor.priv = devm_kzalloc(dev, sizeof(struct priv_data), - GFP_KERNEL); -+ if (!chip->vendor.priv) { -+ rc = -ENOMEM; -+ goto out_err; -+ } -+ - init_waitqueue_head(&chip->vendor.read_queue); - init_waitqueue_head(&chip->vendor.int_queue); - -diff --git a/drivers/char/tpm/tpm_i2c_stm_st33.c b/drivers/char/tpm/tpm_i2c_stm_st33.c -index be9af2e6ca5a..576d1112ac57 100644 ---- a/drivers/char/tpm/tpm_i2c_stm_st33.c -+++ b/drivers/char/tpm/tpm_i2c_stm_st33.c -@@ -488,7 +488,7 @@ static int tpm_stm_i2c_send(struct tpm_chip *chip, unsigned char *buf, - if (burstcnt < 0) - return burstcnt; - size = min_t(int, len - i - 1, burstcnt); -- ret = I2C_WRITE_DATA(client, TPM_DATA_FIFO, buf, size); -+ ret = I2C_WRITE_DATA(client, TPM_DATA_FIFO, buf + i, size); - if (ret < 0) - goto out_err; - -diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c -index af74c57e5090..eff9d5870034 100644 ---- a/drivers/char/tpm/tpm_ibmvtpm.c -+++ b/drivers/char/tpm/tpm_ibmvtpm.c -@@ -148,7 +148,8 @@ static int tpm_ibmvtpm_send(struct tpm_chip *chip, u8 *buf, size_t count) - crq.len = (u16)count; - crq.data = ibmvtpm->rtce_dma_handle; - -- rc = ibmvtpm_send_crq(ibmvtpm->vdev, word[0], word[1]); -+ rc = ibmvtpm_send_crq(ibmvtpm->vdev, cpu_to_be64(word[0]), -+ cpu_to_be64(word[1])); - if (rc != H_SUCCESS) { - dev_err(ibmvtpm->dev, "tpm_ibmvtpm_send failed rc=%d\n", rc); - rc = 0; -@@ -186,7 +187,8 @@ static int ibmvtpm_crq_get_rtce_size(struct ibmvtpm_dev *ibmvtpm) - crq.valid = (u8)IBMVTPM_VALID_CMD; - crq.msg = (u8)VTPM_GET_RTCE_BUFFER_SIZE; - -- rc = ibmvtpm_send_crq(ibmvtpm->vdev, buf[0], buf[1]); -+ rc = ibmvtpm_send_crq(ibmvtpm->vdev, cpu_to_be64(buf[0]), -+ cpu_to_be64(buf[1])); - if (rc != H_SUCCESS) - dev_err(ibmvtpm->dev, - "ibmvtpm_crq_get_rtce_size failed rc=%d\n", rc); -@@ -212,7 +214,8 @@ static int ibmvtpm_crq_get_version(struct ibmvtpm_dev *ibmvtpm) - crq.valid = (u8)IBMVTPM_VALID_CMD; - crq.msg = (u8)VTPM_GET_VERSION; - -- rc = ibmvtpm_send_crq(ibmvtpm->vdev, buf[0], buf[1]); -+ rc = ibmvtpm_send_crq(ibmvtpm->vdev, cpu_to_be64(buf[0]), -+ cpu_to_be64(buf[1])); - if (rc != H_SUCCESS) - dev_err(ibmvtpm->dev, - "ibmvtpm_crq_get_version failed rc=%d\n", rc); -@@ -307,6 +310,14 @@ static int tpm_ibmvtpm_remove(struct vio_dev *vdev) - static unsigned long tpm_ibmvtpm_get_desired_dma(struct vio_dev *vdev) - { - struct ibmvtpm_dev *ibmvtpm = ibmvtpm_get_data(&vdev->dev); -+ -+ /* ibmvtpm initializes at probe time, so the data we are -+ * asking for may not be set yet. Estimate that 4K required -+ * for TCE-mapped buffer in addition to CRQ. -+ */ -+ if (!ibmvtpm) -+ return CRQ_RES_BUF_SIZE + PAGE_SIZE; -+ - return CRQ_RES_BUF_SIZE + ibmvtpm->rtce_size; - } - -@@ -327,7 +338,8 @@ static int tpm_ibmvtpm_suspend(struct device *dev) - crq.valid = (u8)IBMVTPM_VALID_CMD; - crq.msg = (u8)VTPM_PREPARE_TO_SUSPEND; - -- rc = ibmvtpm_send_crq(ibmvtpm->vdev, buf[0], buf[1]); -+ rc = ibmvtpm_send_crq(ibmvtpm->vdev, cpu_to_be64(buf[0]), -+ cpu_to_be64(buf[1])); - if (rc != H_SUCCESS) - dev_err(ibmvtpm->dev, - "tpm_ibmvtpm_suspend failed rc=%d\n", rc); -@@ -472,11 +484,11 @@ static void ibmvtpm_crq_process(struct ibmvtpm_crq *crq, - case IBMVTPM_VALID_CMD: - switch (crq->msg) { - case VTPM_GET_RTCE_BUFFER_SIZE_RES: -- if (crq->len <= 0) { -+ if (be16_to_cpu(crq->len) <= 0) { - dev_err(ibmvtpm->dev, "Invalid rtce size\n"); - return; - } -- ibmvtpm->rtce_size = crq->len; -+ ibmvtpm->rtce_size = be16_to_cpu(crq->len); - ibmvtpm->rtce_buf = kmalloc(ibmvtpm->rtce_size, - GFP_KERNEL); - if (!ibmvtpm->rtce_buf) { -@@ -497,11 +509,11 @@ static void ibmvtpm_crq_process(struct ibmvtpm_crq *crq, - - return; - case VTPM_GET_VERSION_RES: -- ibmvtpm->vtpm_version = crq->data; -+ ibmvtpm->vtpm_version = be32_to_cpu(crq->data); - return; - case VTPM_TPM_COMMAND_RES: - /* len of the data in rtce buffer */ -- ibmvtpm->res_len = crq->len; -+ ibmvtpm->res_len = be16_to_cpu(crq->len); - wake_up_interruptible(&ibmvtpm->wq); - return; - default: -diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c -index 2c46734b266d..51350cd0847e 100644 ---- a/drivers/char/tpm/tpm_tis.c -+++ b/drivers/char/tpm/tpm_tis.c -@@ -75,6 +75,10 @@ enum tis_defaults { - #define TPM_DID_VID(l) (0x0F00 | ((l) << 12)) - #define TPM_RID(l) (0x0F04 | ((l) << 12)) - -+struct priv_data { -+ bool irq_tested; -+}; -+ - static LIST_HEAD(tis_chips); - static DEFINE_MUTEX(tis_lock); - -@@ -338,12 +342,27 @@ out_err: - return rc; - } - -+static void disable_interrupts(struct tpm_chip *chip) -+{ -+ u32 intmask; -+ -+ intmask = -+ ioread32(chip->vendor.iobase + -+ TPM_INT_ENABLE(chip->vendor.locality)); -+ intmask &= ~TPM_GLOBAL_INT_ENABLE; -+ iowrite32(intmask, -+ chip->vendor.iobase + -+ TPM_INT_ENABLE(chip->vendor.locality)); -+ free_irq(chip->vendor.irq, chip); -+ chip->vendor.irq = 0; -+} -+ - /* - * If interrupts are used (signaled by an irq set in the vendor structure) - * tpm.c can skip polling for the data to be available as the interrupt is - * waited for here - */ --static int tpm_tis_send(struct tpm_chip *chip, u8 *buf, size_t len) -+static int tpm_tis_send_main(struct tpm_chip *chip, u8 *buf, size_t len) - { - int rc; - u32 ordinal; -@@ -373,6 +392,30 @@ out_err: - return rc; - } - -+static int tpm_tis_send(struct tpm_chip *chip, u8 *buf, size_t len) -+{ -+ int rc, irq; -+ struct priv_data *priv = chip->vendor.priv; -+ -+ if (!chip->vendor.irq || priv->irq_tested) -+ return tpm_tis_send_main(chip, buf, len); -+ -+ /* Verify receipt of the expected IRQ */ -+ irq = chip->vendor.irq; -+ chip->vendor.irq = 0; -+ rc = tpm_tis_send_main(chip, buf, len); -+ chip->vendor.irq = irq; -+ if (!priv->irq_tested) -+ msleep(1); -+ if (!priv->irq_tested) { -+ disable_interrupts(chip); -+ dev_err(chip->dev, -+ FW_BUG "TPM interrupt not working, polling instead\n"); -+ } -+ priv->irq_tested = true; -+ return rc; -+} -+ - struct tis_vendor_timeout_override { - u32 did_vid; - unsigned long timeout_us[4]; -@@ -505,6 +548,7 @@ static irqreturn_t tis_int_handler(int dummy, void *dev_id) - if (interrupt == 0) - return IRQ_NONE; - -+ ((struct priv_data *)chip->vendor.priv)->irq_tested = true; - if (interrupt & TPM_INTF_DATA_AVAIL_INT) - wake_up_interruptible(&chip->vendor.read_queue); - if (interrupt & TPM_INTF_LOCALITY_CHANGE_INT) -@@ -534,9 +578,14 @@ static int tpm_tis_init(struct device *dev, resource_size_t start, - u32 vendor, intfcaps, intmask; - int rc, i, irq_s, irq_e, probe; - struct tpm_chip *chip; -+ struct priv_data *priv; - -+ priv = devm_kzalloc(dev, sizeof(struct priv_data), GFP_KERNEL); -+ if (priv == NULL) -+ return -ENOMEM; - if (!(chip = tpm_register_hardware(dev, &tpm_tis))) - return -ENODEV; -+ chip->vendor.priv = priv; - - chip->vendor.iobase = ioremap(start, len); - if (!chip->vendor.iobase) { -@@ -605,19 +654,6 @@ static int tpm_tis_init(struct device *dev, resource_size_t start, - if (intfcaps & TPM_INTF_DATA_AVAIL_INT) - dev_dbg(dev, "\tData Avail Int Support\n"); - -- /* get the timeouts before testing for irqs */ -- if (tpm_get_timeouts(chip)) { -- dev_err(dev, "Could not get TPM timeouts and durations\n"); -- rc = -ENODEV; -- goto out_err; -- } -- -- if (tpm_do_selftest(chip)) { -- dev_err(dev, "TPM self test failed\n"); -- rc = -ENODEV; -- goto out_err; -- } -- - /* INTERRUPT Setup */ - init_waitqueue_head(&chip->vendor.read_queue); - init_waitqueue_head(&chip->vendor.int_queue); -@@ -719,6 +755,18 @@ static int tpm_tis_init(struct device *dev, resource_size_t start, - } - } - -+ if (tpm_get_timeouts(chip)) { -+ dev_err(dev, "Could not get TPM timeouts and durations\n"); -+ rc = -ENODEV; -+ goto out_err; -+ } -+ -+ if (tpm_do_selftest(chip)) { -+ dev_err(dev, "TPM self test failed\n"); -+ rc = -ENODEV; -+ goto out_err; -+ } -+ - INIT_LIST_HEAD(&chip->vendor.list); - mutex_lock(&tis_lock); - list_add(&chip->vendor.list, &tis_chips); -diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c -index 4854f81d038b..ef3b8adb9d47 100644 ---- a/drivers/cpufreq/cpufreq.c -+++ b/drivers/cpufreq/cpufreq.c -@@ -1365,9 +1365,10 @@ static int __cpufreq_remove_dev_finish(struct device *dev, - unsigned long flags; - struct cpufreq_policy *policy; - -- read_lock_irqsave(&cpufreq_driver_lock, flags); -+ write_lock_irqsave(&cpufreq_driver_lock, flags); - policy = per_cpu(cpufreq_cpu_data, cpu); -- read_unlock_irqrestore(&cpufreq_driver_lock, flags); -+ per_cpu(cpufreq_cpu_data, cpu) = NULL; -+ write_unlock_irqrestore(&cpufreq_driver_lock, flags); - - if (!policy) { - pr_debug("%s: No cpu_data found\n", __func__); -@@ -1422,7 +1423,6 @@ static int __cpufreq_remove_dev_finish(struct device *dev, - } - } - -- per_cpu(cpufreq_cpu_data, cpu) = NULL; - return 0; - } - -diff --git a/drivers/cpufreq/s3c2416-cpufreq.c b/drivers/cpufreq/s3c2416-cpufreq.c -index 826b8be23099..82cef00a27d9 100644 ---- a/drivers/cpufreq/s3c2416-cpufreq.c -+++ b/drivers/cpufreq/s3c2416-cpufreq.c -@@ -263,7 +263,7 @@ out: - } - - #ifdef CONFIG_ARM_S3C2416_CPUFREQ_VCORESCALE --static void __init s3c2416_cpufreq_cfg_regulator(struct s3c2416_data *s3c_freq) -+static void s3c2416_cpufreq_cfg_regulator(struct s3c2416_data *s3c_freq) - { - int count, v, i, found; - struct cpufreq_frequency_table *freq; -@@ -335,7 +335,7 @@ static struct notifier_block s3c2416_cpufreq_reboot_notifier = { - .notifier_call = s3c2416_cpufreq_reboot_notifier_evt, - }; - --static int __init s3c2416_cpufreq_driver_init(struct cpufreq_policy *policy) -+static int s3c2416_cpufreq_driver_init(struct cpufreq_policy *policy) - { - struct s3c2416_data *s3c_freq = &s3c2416_cpufreq; - struct cpufreq_frequency_table *freq; -diff --git a/drivers/cpufreq/s3c24xx-cpufreq.c b/drivers/cpufreq/s3c24xx-cpufreq.c -index 25069741b507..0eb5b405c2f0 100644 ---- a/drivers/cpufreq/s3c24xx-cpufreq.c -+++ b/drivers/cpufreq/s3c24xx-cpufreq.c -@@ -454,7 +454,7 @@ static struct cpufreq_driver s3c24xx_driver = { - }; - - --int __init s3c_cpufreq_register(struct s3c_cpufreq_info *info) -+int s3c_cpufreq_register(struct s3c_cpufreq_info *info) - { - if (!info || !info->name) { - printk(KERN_ERR "%s: failed to pass valid information\n", -diff --git a/drivers/cpufreq/speedstep-lib.c b/drivers/cpufreq/speedstep-lib.c -index 7047821a7f8a..4ab7a2156672 100644 ---- a/drivers/cpufreq/speedstep-lib.c -+++ b/drivers/cpufreq/speedstep-lib.c -@@ -400,6 +400,7 @@ unsigned int speedstep_get_freqs(enum speedstep_processor processor, - - pr_debug("previous speed is %u\n", prev_speed); - -+ preempt_disable(); - local_irq_save(flags); - - /* switch to low state */ -@@ -464,6 +465,8 @@ unsigned int speedstep_get_freqs(enum speedstep_processor processor, - - out: - local_irq_restore(flags); -+ preempt_enable(); -+ - return ret; - } - EXPORT_SYMBOL_GPL(speedstep_get_freqs); -diff --git a/drivers/cpufreq/speedstep-smi.c b/drivers/cpufreq/speedstep-smi.c -index 998c17b42200..b52d8af1ab3c 100644 ---- a/drivers/cpufreq/speedstep-smi.c -+++ b/drivers/cpufreq/speedstep-smi.c -@@ -156,6 +156,7 @@ static void speedstep_set_state(unsigned int state) - return; - - /* Disable IRQs */ -+ preempt_disable(); - local_irq_save(flags); - - command = (smi_sig & 0xffffff00) | (smi_cmd & 0xff); -@@ -166,9 +167,19 @@ static void speedstep_set_state(unsigned int state) - - do { - if (retry) { -+ /* -+ * We need to enable interrupts, otherwise the blockage -+ * won't resolve. -+ * -+ * We disable preemption so that other processes don't -+ * run. If other processes were running, they could -+ * submit more DMA requests, making the blockage worse. -+ */ - pr_debug("retry %u, previous result %u, waiting...\n", - retry, result); -+ local_irq_enable(); - mdelay(retry * 50); -+ local_irq_disable(); - } - retry++; - __asm__ __volatile__( -@@ -185,6 +196,7 @@ static void speedstep_set_state(unsigned int state) - - /* enable IRQs */ - local_irq_restore(flags); -+ preempt_enable(); - - if (new_state == state) - pr_debug("change to %u MHz succeeded after %u tries " -diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c -index 98e14ee4833c..278603c373ca 100644 ---- a/drivers/edac/amd64_edac.c -+++ b/drivers/edac/amd64_edac.c -@@ -2006,14 +2006,20 @@ static void __log_bus_error(struct mem_ctl_info *mci, struct err_info *err, - - static inline void decode_bus_error(int node_id, struct mce *m) - { -- struct mem_ctl_info *mci = mcis[node_id]; -- struct amd64_pvt *pvt = mci->pvt_info; -+ struct mem_ctl_info *mci; -+ struct amd64_pvt *pvt; - u8 ecc_type = (m->status >> 45) & 0x3; - u8 xec = XEC(m->status, 0x1f); - u16 ec = EC(m->status); - u64 sys_addr; - struct err_info err; - -+ mci = edac_mc_find(node_id); -+ if (!mci) -+ return; -+ -+ pvt = mci->pvt_info; -+ - /* Bail out early if this was an 'observed' error */ - if (PP(ec) == NBSL_PP_OBS) - return; -diff --git a/drivers/gpio/gpio-tps65912.c b/drivers/gpio/gpio-tps65912.c -index 59ee486cb8b9..6005d260457d 100644 ---- a/drivers/gpio/gpio-tps65912.c -+++ b/drivers/gpio/gpio-tps65912.c -@@ -26,9 +26,12 @@ struct tps65912_gpio_data { - struct gpio_chip gpio_chip; - }; - -+#define to_tgd(gc) container_of(gc, struct tps65912_gpio_data, gpio_chip) -+ - static int tps65912_gpio_get(struct gpio_chip *gc, unsigned offset) - { -- struct tps65912 *tps65912 = container_of(gc, struct tps65912, gpio); -+ struct tps65912_gpio_data *tps65912_gpio = to_tgd(gc); -+ struct tps65912 *tps65912 = tps65912_gpio->tps65912; - int val; - - val = tps65912_reg_read(tps65912, TPS65912_GPIO1 + offset); -@@ -42,7 +45,8 @@ static int tps65912_gpio_get(struct gpio_chip *gc, unsigned offset) - static void tps65912_gpio_set(struct gpio_chip *gc, unsigned offset, - int value) - { -- struct tps65912 *tps65912 = container_of(gc, struct tps65912, gpio); -+ struct tps65912_gpio_data *tps65912_gpio = to_tgd(gc); -+ struct tps65912 *tps65912 = tps65912_gpio->tps65912; - - if (value) - tps65912_set_bits(tps65912, TPS65912_GPIO1 + offset, -@@ -55,7 +59,8 @@ static void tps65912_gpio_set(struct gpio_chip *gc, unsigned offset, - static int tps65912_gpio_output(struct gpio_chip *gc, unsigned offset, - int value) - { -- struct tps65912 *tps65912 = container_of(gc, struct tps65912, gpio); -+ struct tps65912_gpio_data *tps65912_gpio = to_tgd(gc); -+ struct tps65912 *tps65912 = tps65912_gpio->tps65912; - - /* Set the initial value */ - tps65912_gpio_set(gc, offset, value); -@@ -66,7 +71,8 @@ static int tps65912_gpio_output(struct gpio_chip *gc, unsigned offset, - - static int tps65912_gpio_input(struct gpio_chip *gc, unsigned offset) - { -- struct tps65912 *tps65912 = container_of(gc, struct tps65912, gpio); -+ struct tps65912_gpio_data *tps65912_gpio = to_tgd(gc); -+ struct tps65912 *tps65912 = tps65912_gpio->tps65912; - - return tps65912_clear_bits(tps65912, TPS65912_GPIO1 + offset, - GPIO_CFG_MASK); -diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c -index 74ed17d6cfa1..d26028cb9eac 100644 ---- a/drivers/gpio/gpiolib-of.c -+++ b/drivers/gpio/gpiolib-of.c -@@ -45,12 +45,13 @@ static int of_gpiochip_find_and_xlate(struct gpio_chip *gc, void *data) - - ret = gc->of_xlate(gc, &gg_data->gpiospec, gg_data->flags); - if (ret < 0) { -- /* We've found the gpio chip, but the translation failed. -- * Return true to stop looking and return the translation -- * error via out_gpio -+ /* We've found a gpio chip, but the translation failed. -+ * Store translation error in out_gpio. -+ * Return false to keep looking, as more than one gpio chip -+ * could be registered per of-node. - */ - gg_data->out_gpio = ERR_PTR(ret); -- return true; -+ return false; - } - - gg_data->out_gpio = gpio_to_desc(ret + gc->base); -diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c -index 6e5d8fe0ce8f..17be889d8a83 100644 ---- a/drivers/hid/i2c-hid/i2c-hid.c -+++ b/drivers/hid/i2c-hid/i2c-hid.c -@@ -356,7 +356,10 @@ static int i2c_hid_hwreset(struct i2c_client *client) - static void i2c_hid_get_input(struct i2c_hid *ihid) - { - int ret, ret_size; -- int size = ihid->bufsize; -+ int size = le16_to_cpu(ihid->hdesc.wMaxInputLength); -+ -+ if (size > ihid->bufsize) -+ size = ihid->bufsize; - - ret = i2c_master_recv(ihid->client, ihid->inbuf, size); - if (ret != size) { -diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c -index 55de4f6f7eaf..b96ee9d78aa3 100644 ---- a/drivers/md/raid1.c -+++ b/drivers/md/raid1.c -@@ -561,7 +561,7 @@ static int read_balance(struct r1conf *conf, struct r1bio *r1_bio, int *max_sect - if (test_bit(WriteMostly, &rdev->flags)) { - /* Don't balance among write-mostly, just - * use the first as a last resort */ -- if (best_disk < 0) { -+ if (best_dist_disk < 0) { - if (is_badblock(rdev, this_sector, sectors, - &first_bad, &bad_sectors)) { - if (first_bad < this_sector) -@@ -570,7 +570,8 @@ static int read_balance(struct r1conf *conf, struct r1bio *r1_bio, int *max_sect - best_good_sectors = first_bad - this_sector; - } else - best_good_sectors = sectors; -- best_disk = disk; -+ best_dist_disk = disk; -+ best_pending_disk = disk; - } - continue; - } -diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c -index 175584ad643f..3545fafe2027 100644 ---- a/drivers/md/raid5.c -+++ b/drivers/md/raid5.c -@@ -3071,7 +3071,8 @@ static void handle_stripe_dirtying(struct r5conf *conf, - * generate correct data from the parity. - */ - if (conf->max_degraded == 2 || -- (recovery_cp < MaxSector && sh->sector >= recovery_cp)) { -+ (recovery_cp < MaxSector && sh->sector >= recovery_cp && -+ s->failed == 0)) { - /* Calculate the real rcw later - for now make it - * look like rcw is cheaper - */ -diff --git a/drivers/media/usb/dvb-usb-v2/lmedm04.c b/drivers/media/usb/dvb-usb-v2/lmedm04.c -index f674dc024d06..d2a4e6d40bf0 100644 ---- a/drivers/media/usb/dvb-usb-v2/lmedm04.c -+++ b/drivers/media/usb/dvb-usb-v2/lmedm04.c -@@ -350,6 +350,7 @@ static int lme2510_int_read(struct dvb_usb_adapter *adap) - { - struct dvb_usb_device *d = adap_to_d(adap); - struct lme2510_state *lme_int = adap_to_priv(adap); -+ struct usb_host_endpoint *ep; - - lme_int->lme_urb = usb_alloc_urb(0, GFP_ATOMIC); - -@@ -371,6 +372,12 @@ static int lme2510_int_read(struct dvb_usb_adapter *adap) - adap, - 8); - -+ /* Quirk of pipe reporting PIPE_BULK but behaves as interrupt */ -+ ep = usb_pipe_endpoint(d->udev, lme_int->lme_urb->pipe); -+ -+ if (usb_endpoint_type(&ep->desc) == USB_ENDPOINT_XFER_BULK) -+ lme_int->lme_urb->pipe = usb_rcvbulkpipe(d->udev, 0xa), -+ - lme_int->lme_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP; - - usb_submit_urb(lme_int->lme_urb, GFP_ATOMIC); -diff --git a/drivers/media/usb/em28xx/em28xx-audio.c b/drivers/media/usb/em28xx/em28xx-audio.c -index dfdfa772eb1e..c39f7d329ee2 100644 ---- a/drivers/media/usb/em28xx/em28xx-audio.c -+++ b/drivers/media/usb/em28xx/em28xx-audio.c -@@ -814,7 +814,7 @@ static int em28xx_audio_urb_init(struct em28xx *dev) - if (urb_size > ep_size * npackets) - npackets = DIV_ROUND_UP(urb_size, ep_size); - -- em28xx_info("Number of URBs: %d, with %d packets and %d size", -+ em28xx_info("Number of URBs: %d, with %d packets and %d size\n", - num_urb, npackets, urb_size); - - /* Estimate the bytes per period */ -@@ -974,7 +974,7 @@ static int em28xx_audio_fini(struct em28xx *dev) - return 0; - } - -- em28xx_info("Closing audio extension"); -+ em28xx_info("Closing audio extension\n"); - - if (dev->adev.sndcard) { - snd_card_disconnect(dev->adev.sndcard); -diff --git a/drivers/media/usb/em28xx/em28xx-dvb.c b/drivers/media/usb/em28xx/em28xx-dvb.c -index 1373cfa4e974..ec2ebe9b89fb 100644 ---- a/drivers/media/usb/em28xx/em28xx-dvb.c -+++ b/drivers/media/usb/em28xx/em28xx-dvb.c -@@ -1468,7 +1468,7 @@ static int em28xx_dvb_fini(struct em28xx *dev) - return 0; - } - -- em28xx_info("Closing DVB extension"); -+ em28xx_info("Closing DVB extension\n"); - - if (dev->dvb) { - struct em28xx_dvb *dvb = dev->dvb; -diff --git a/drivers/media/usb/em28xx/em28xx-input.c b/drivers/media/usb/em28xx/em28xx-input.c -index 18f65d89d4bc..dd59c005cbcc 100644 ---- a/drivers/media/usb/em28xx/em28xx-input.c -+++ b/drivers/media/usb/em28xx/em28xx-input.c -@@ -810,7 +810,7 @@ static int em28xx_ir_fini(struct em28xx *dev) - return 0; - } - -- em28xx_info("Closing input extension"); -+ em28xx_info("Closing input extension\n"); - - em28xx_shutdown_buttons(dev); - -diff --git a/drivers/media/usb/em28xx/em28xx-video.c b/drivers/media/usb/em28xx/em28xx-video.c -index e24ee08e634e..0e8d0856b89a 100644 ---- a/drivers/media/usb/em28xx/em28xx-video.c -+++ b/drivers/media/usb/em28xx/em28xx-video.c -@@ -1900,7 +1900,7 @@ static int em28xx_v4l2_fini(struct em28xx *dev) - return 0; - } - -- em28xx_info("Closing video extension"); -+ em28xx_info("Closing video extension\n"); - - mutex_lock(&dev->lock); - -diff --git a/drivers/mmc/host/sdhci-pxav3.c b/drivers/mmc/host/sdhci-pxav3.c -index 793dacd3b841..561c6b4907a1 100644 ---- a/drivers/mmc/host/sdhci-pxav3.c -+++ b/drivers/mmc/host/sdhci-pxav3.c -@@ -201,8 +201,8 @@ static struct sdhci_pxa_platdata *pxav3_get_mmc_pdata(struct device *dev) - if (!pdata) - return NULL; - -- of_property_read_u32(np, "mrvl,clk-delay-cycles", &clk_delay_cycles); -- if (clk_delay_cycles > 0) -+ if (!of_property_read_u32(np, "mrvl,clk-delay-cycles", -+ &clk_delay_cycles)) - pdata->clk_delay_cycles = clk_delay_cycles; - - return pdata; -diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c -index d06414ef15c5..a04174607e97 100644 ---- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c -+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c -@@ -410,9 +410,6 @@ static void iwl_mvm_cleanup_iterator(void *data, u8 *mac, - mvmvif->uploaded = false; - mvmvif->ap_sta_id = IWL_MVM_STATION_COUNT; - -- /* does this make sense at all? */ -- mvmvif->color++; -- - spin_lock_bh(&mvm->time_event_lock); - iwl_mvm_te_clear_data(mvm, &mvmvif->time_event_data); - spin_unlock_bh(&mvm->time_event_lock); -@@ -597,7 +594,7 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw, - - ret = iwl_mvm_mac_ctxt_add(mvm, vif); - if (ret) -- goto out_release; -+ goto out_remove_mac; - - iwl_mvm_power_disable(mvm, vif); - -diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c -index 76ee486039d7..4efcb2869379 100644 ---- a/drivers/net/wireless/iwlwifi/mvm/tx.c -+++ b/drivers/net/wireless/iwlwifi/mvm/tx.c -@@ -835,6 +835,11 @@ int iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb, - sta_id = ba_notif->sta_id; - tid = ba_notif->tid; - -+ if (WARN_ONCE(sta_id >= IWL_MVM_STATION_COUNT || -+ tid >= IWL_MAX_TID_COUNT, -+ "sta_id %d tid %d", sta_id, tid)) -+ return 0; -+ - rcu_read_lock(); - - sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_id]); -diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c -index 3d549008b3e2..52427fba22cd 100644 ---- a/drivers/net/wireless/iwlwifi/pcie/tx.c -+++ b/drivers/net/wireless/iwlwifi/pcie/tx.c -@@ -729,7 +729,12 @@ void iwl_trans_pcie_tx_reset(struct iwl_trans *trans) - iwl_write_direct32(trans, FH_KW_MEM_ADDR_REG, - trans_pcie->kw.dma >> 4); - -- iwl_pcie_tx_start(trans, trans_pcie->scd_base_addr); -+ /* -+ * Send 0 as the scd_base_addr since the device may have be reset -+ * while we were in WoWLAN in which case SCD_SRAM_BASE_ADDR will -+ * contain garbage. -+ */ -+ iwl_pcie_tx_start(trans, 0); - } - - /* -diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c -index 25f0bc659164..7f4155116cc9 100644 ---- a/drivers/pci/pci-driver.c -+++ b/drivers/pci/pci-driver.c -@@ -1324,7 +1324,7 @@ static int pci_uevent(struct device *dev, struct kobj_uevent_env *env) - if (add_uevent_var(env, "PCI_SLOT_NAME=%s", pci_name(pdev))) - return -ENOMEM; - -- if (add_uevent_var(env, "MODALIAS=pci:v%08Xd%08Xsv%08Xsd%08Xbc%02Xsc%02Xi%02x", -+ if (add_uevent_var(env, "MODALIAS=pci:v%08Xd%08Xsv%08Xsd%08Xbc%02Xsc%02Xi%02X", - pdev->vendor, pdev->device, - pdev->subsystem_vendor, pdev->subsystem_device, - (u8)(pdev->class >> 16), (u8)(pdev->class >> 8), -diff --git a/drivers/pci/rom.c b/drivers/pci/rom.c -index 5d595724e5f4..5510c88b5044 100644 ---- a/drivers/pci/rom.c -+++ b/drivers/pci/rom.c -@@ -69,6 +69,7 @@ size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, size_t size) - { - void __iomem *image; - int last_image; -+ unsigned length; - - image = rom; - do { -@@ -91,9 +92,9 @@ size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, size_t size) - if (readb(pds + 3) != 'R') - break; - last_image = readb(pds + 21) & 0x80; -- /* this length is reliable */ -- image += readw(pds + 16) * 512; -- } while (!last_image); -+ length = readw(pds + 16); -+ image += length * 512; -+ } while (length && !last_image); - - /* never return a size larger than the PCI resource window */ - /* there are known ROMs that get the size wrong */ -diff --git a/drivers/power/88pm860x_charger.c b/drivers/power/88pm860x_charger.c -index de029bbc1cc1..5ccca8743ce6 100644 ---- a/drivers/power/88pm860x_charger.c -+++ b/drivers/power/88pm860x_charger.c -@@ -711,6 +711,7 @@ static int pm860x_charger_probe(struct platform_device *pdev) - return 0; - - out_irq: -+ power_supply_unregister(&info->usb); - while (--i >= 0) - free_irq(info->irq[i], info); - out: -diff --git a/drivers/power/bq24190_charger.c b/drivers/power/bq24190_charger.c -index ad3ff8fbfbbb..e4c95e1a6733 100644 ---- a/drivers/power/bq24190_charger.c -+++ b/drivers/power/bq24190_charger.c -@@ -929,7 +929,7 @@ static void bq24190_charger_init(struct power_supply *charger) - charger->properties = bq24190_charger_properties; - charger->num_properties = ARRAY_SIZE(bq24190_charger_properties); - charger->supplied_to = bq24190_charger_supplied_to; -- charger->num_supplies = ARRAY_SIZE(bq24190_charger_supplied_to); -+ charger->num_supplicants = ARRAY_SIZE(bq24190_charger_supplied_to); - charger->get_property = bq24190_charger_get_property; - charger->set_property = bq24190_charger_set_property; - charger->property_is_writeable = bq24190_charger_property_is_writeable; -diff --git a/drivers/power/gpio-charger.c b/drivers/power/gpio-charger.c -index a0024b252197..86e03c6d28f3 100644 ---- a/drivers/power/gpio-charger.c -+++ b/drivers/power/gpio-charger.c -@@ -168,7 +168,7 @@ static int gpio_charger_suspend(struct device *dev) - - if (device_may_wakeup(dev)) - gpio_charger->wakeup_enabled = -- enable_irq_wake(gpio_charger->irq); -+ !enable_irq_wake(gpio_charger->irq); - - return 0; - } -@@ -178,7 +178,7 @@ static int gpio_charger_resume(struct device *dev) - struct platform_device *pdev = to_platform_device(dev); - struct gpio_charger *gpio_charger = platform_get_drvdata(pdev); - -- if (gpio_charger->wakeup_enabled) -+ if (device_may_wakeup(dev) && gpio_charger->wakeup_enabled) - disable_irq_wake(gpio_charger->irq); - power_supply_changed(&gpio_charger->charger); - -diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c -index f6555921fd7a..a1f04e3b2a8f 100644 ---- a/drivers/scsi/megaraid/megaraid_sas_fusion.c -+++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c -@@ -92,6 +92,8 @@ megasas_enable_intr_fusion(struct megasas_instance *instance) - { - struct megasas_register_set __iomem *regs; - regs = instance->reg_set; -+ -+ instance->mask_interrupts = 0; - /* For Thunderbolt/Invader also clear intr on enable */ - writel(~0, ®s->outbound_intr_status); - readl(®s->outbound_intr_status); -@@ -100,7 +102,6 @@ megasas_enable_intr_fusion(struct megasas_instance *instance) - - /* Dummy readl to force pci flush */ - readl(®s->outbound_intr_mask); -- instance->mask_interrupts = 0; - } - - /** -diff --git a/drivers/target/iscsi/iscsi_target_tq.c b/drivers/target/iscsi/iscsi_target_tq.c -index 601e9cc61e98..bb2890e79ca0 100644 ---- a/drivers/target/iscsi/iscsi_target_tq.c -+++ b/drivers/target/iscsi/iscsi_target_tq.c -@@ -24,36 +24,22 @@ - #include "iscsi_target_tq.h" - #include "iscsi_target.h" - --static LIST_HEAD(active_ts_list); - static LIST_HEAD(inactive_ts_list); --static DEFINE_SPINLOCK(active_ts_lock); - static DEFINE_SPINLOCK(inactive_ts_lock); - static DEFINE_SPINLOCK(ts_bitmap_lock); - --static void iscsi_add_ts_to_active_list(struct iscsi_thread_set *ts) --{ -- spin_lock(&active_ts_lock); -- list_add_tail(&ts->ts_list, &active_ts_list); -- iscsit_global->active_ts++; -- spin_unlock(&active_ts_lock); --} -- - static void iscsi_add_ts_to_inactive_list(struct iscsi_thread_set *ts) - { -+ if (!list_empty(&ts->ts_list)) { -+ WARN_ON(1); -+ return; -+ } - spin_lock(&inactive_ts_lock); - list_add_tail(&ts->ts_list, &inactive_ts_list); - iscsit_global->inactive_ts++; - spin_unlock(&inactive_ts_lock); - } - --static void iscsi_del_ts_from_active_list(struct iscsi_thread_set *ts) --{ -- spin_lock(&active_ts_lock); -- list_del(&ts->ts_list); -- iscsit_global->active_ts--; -- spin_unlock(&active_ts_lock); --} -- - static struct iscsi_thread_set *iscsi_get_ts_from_inactive_list(void) - { - struct iscsi_thread_set *ts; -@@ -66,7 +52,7 @@ static struct iscsi_thread_set *iscsi_get_ts_from_inactive_list(void) - - ts = list_first_entry(&inactive_ts_list, struct iscsi_thread_set, ts_list); - -- list_del(&ts->ts_list); -+ list_del_init(&ts->ts_list); - iscsit_global->inactive_ts--; - spin_unlock(&inactive_ts_lock); - -@@ -204,8 +190,6 @@ static void iscsi_deallocate_extra_thread_sets(void) - - void iscsi_activate_thread_set(struct iscsi_conn *conn, struct iscsi_thread_set *ts) - { -- iscsi_add_ts_to_active_list(ts); -- - spin_lock_bh(&ts->ts_state_lock); - conn->thread_set = ts; - ts->conn = conn; -@@ -397,7 +381,6 @@ struct iscsi_conn *iscsi_rx_thread_pre_handler(struct iscsi_thread_set *ts) - - if (ts->delay_inactive && (--ts->thread_count == 0)) { - spin_unlock_bh(&ts->ts_state_lock); -- iscsi_del_ts_from_active_list(ts); - - if (!iscsit_global->in_shutdown) - iscsi_deallocate_extra_thread_sets(); -@@ -452,7 +435,6 @@ struct iscsi_conn *iscsi_tx_thread_pre_handler(struct iscsi_thread_set *ts) - - if (ts->delay_inactive && (--ts->thread_count == 0)) { - spin_unlock_bh(&ts->ts_state_lock); -- iscsi_del_ts_from_active_list(ts); - - if (!iscsit_global->in_shutdown) - iscsi_deallocate_extra_thread_sets(); -diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c -index 25c9bc783722..e49616eeb1cc 100644 ---- a/drivers/tty/pty.c -+++ b/drivers/tty/pty.c -@@ -209,6 +209,9 @@ static int pty_signal(struct tty_struct *tty, int sig) - unsigned long flags; - struct pid *pgrp; - -+ if (sig != SIGINT && sig != SIGQUIT && sig != SIGTSTP) -+ return -EINVAL; -+ - if (tty->link) { - spin_lock_irqsave(&tty->link->ctrl_lock, flags); - pgrp = get_pid(tty->link->pgrp); -diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c -index ce352b81e230..0d3e6cb36748 100644 ---- a/drivers/tty/serial/atmel_serial.c -+++ b/drivers/tty/serial/atmel_serial.c -@@ -2392,7 +2392,7 @@ static int atmel_serial_probe(struct platform_device *pdev) - - ret = atmel_init_port(port, pdev); - if (ret) -- goto err; -+ goto err_clear_bit; - - if (!atmel_use_pdc_rx(&port->uart)) { - ret = -ENOMEM; -@@ -2441,6 +2441,8 @@ err_alloc_ring: - clk_put(port->clk); - port->clk = NULL; - } -+err_clear_bit: -+ clear_bit(port->uart.line, atmel_ports_in_use); - err: - return ret; - } -diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c -index 23b5d32954bf..693091ab726b 100644 ---- a/drivers/tty/vt/vt.c -+++ b/drivers/tty/vt/vt.c -@@ -498,6 +498,7 @@ void invert_screen(struct vc_data *vc, int offset, int count, int viewed) - #endif - if (DO_UPDATE(vc)) - do_update_region(vc, (unsigned long) p, count); -+ notify_update(vc); - } - - /* used by selection: complement pointer position */ -@@ -514,6 +515,7 @@ void complement_pos(struct vc_data *vc, int offset) - scr_writew(old, screenpos(vc, old_offset, 1)); - if (DO_UPDATE(vc)) - vc->vc_sw->con_putc(vc, old, oldy, oldx); -+ notify_update(vc); - } - - old_offset = offset; -@@ -531,8 +533,8 @@ void complement_pos(struct vc_data *vc, int offset) - oldy = (offset >> 1) / vc->vc_cols; - vc->vc_sw->con_putc(vc, new, oldy, oldx); - } -+ notify_update(vc); - } -- - } - - static void insert_char(struct vc_data *vc, unsigned int nr) -diff --git a/drivers/usb/core/buffer.c b/drivers/usb/core/buffer.c -index 684ef70dc09d..506b969ea7fd 100644 ---- a/drivers/usb/core/buffer.c -+++ b/drivers/usb/core/buffer.c -@@ -22,17 +22,25 @@ - */ - - /* FIXME tune these based on pool statistics ... */ --static const size_t pool_max[HCD_BUFFER_POOLS] = { -- /* platforms without dma-friendly caches might need to -- * prevent cacheline sharing... -- */ -- 32, -- 128, -- 512, -- PAGE_SIZE / 2 -- /* bigger --> allocate pages */ -+static size_t pool_max[HCD_BUFFER_POOLS] = { -+ 32, 128, 512, 2048, - }; - -+void __init usb_init_pool_max(void) -+{ -+ /* -+ * The pool_max values must never be smaller than -+ * ARCH_KMALLOC_MINALIGN. -+ */ -+ if (ARCH_KMALLOC_MINALIGN <= 32) -+ ; /* Original value is okay */ -+ else if (ARCH_KMALLOC_MINALIGN <= 64) -+ pool_max[0] = 64; -+ else if (ARCH_KMALLOC_MINALIGN <= 128) -+ pool_max[0] = 0; /* Don't use this pool */ -+ else -+ BUILD_BUG(); /* We don't allow this */ -+} - - /* SETUP primitives */ - -diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c -index ef6ec13b6ae5..ee6c5562d296 100644 ---- a/drivers/usb/core/hcd.c -+++ b/drivers/usb/core/hcd.c -@@ -1617,6 +1617,7 @@ static int unlink1(struct usb_hcd *hcd, struct urb *urb, int status) - int usb_hcd_unlink_urb (struct urb *urb, int status) - { - struct usb_hcd *hcd; -+ struct usb_device *udev = urb->dev; - int retval = -EIDRM; - unsigned long flags; - -@@ -1628,20 +1629,19 @@ int usb_hcd_unlink_urb (struct urb *urb, int status) - spin_lock_irqsave(&hcd_urb_unlink_lock, flags); - if (atomic_read(&urb->use_count) > 0) { - retval = 0; -- usb_get_dev(urb->dev); -+ usb_get_dev(udev); - } - spin_unlock_irqrestore(&hcd_urb_unlink_lock, flags); - if (retval == 0) { - hcd = bus_to_hcd(urb->dev->bus); - retval = unlink1(hcd, urb, status); -- usb_put_dev(urb->dev); -+ if (retval == 0) -+ retval = -EINPROGRESS; -+ else if (retval != -EIDRM && retval != -EBUSY) -+ dev_dbg(&udev->dev, "hcd_unlink_urb %p fail %d\n", -+ urb, retval); -+ usb_put_dev(udev); - } -- -- if (retval == 0) -- retval = -EINPROGRESS; -- else if (retval != -EIDRM && retval != -EBUSY) -- dev_dbg(&urb->dev->dev, "hcd_unlink_urb %p fail %d\n", -- urb, retval); - return retval; - } - -diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c -index 4d1144990d4c..a92273026ecc 100644 ---- a/drivers/usb/core/usb.c -+++ b/drivers/usb/core/usb.c -@@ -1050,6 +1050,7 @@ static int __init usb_init(void) - pr_info("%s: USB support disabled\n", usbcore_name); - return 0; - } -+ usb_init_pool_max(); - - retval = usb_debugfs_init(); - if (retval) -diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c -index 9e8708c5cbfa..a2d040971afe 100644 ---- a/drivers/usb/serial/cp210x.c -+++ b/drivers/usb/serial/cp210x.c -@@ -56,6 +56,7 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(0x0846, 0x1100) }, /* NetGear Managed Switch M4100 series, M5300 series, M7100 series */ - { USB_DEVICE(0x08e6, 0x5501) }, /* Gemalto Prox-PU/CU contactless smartcard reader */ - { USB_DEVICE(0x08FD, 0x000A) }, /* Digianswer A/S , ZigBee/802.15.4 MAC Device */ -+ { USB_DEVICE(0x0908, 0x01FF) }, /* Siemens RUGGEDCOM USB Serial Console */ - { USB_DEVICE(0x0BED, 0x1100) }, /* MEI (TM) Cashflow-SC Bill/Voucher Acceptor */ - { USB_DEVICE(0x0BED, 0x1101) }, /* MEI series 2000 Combo Acceptor */ - { USB_DEVICE(0x0FCF, 0x1003) }, /* Dynastream ANT development board */ -diff --git a/drivers/xen/manage.c b/drivers/xen/manage.c -index 602913d7ae03..edfd797db341 100644 ---- a/drivers/xen/manage.c -+++ b/drivers/xen/manage.c -@@ -113,10 +113,16 @@ static void do_suspend(void) - - err = freeze_processes(); - if (err) { -- pr_err("%s: freeze failed %d\n", __func__, err); -+ pr_err("%s: freeze processes failed %d\n", __func__, err); - goto out; - } - -+ err = freeze_kernel_threads(); -+ if (err) { -+ pr_err("%s: freeze kernel threads failed %d\n", __func__, err); -+ goto out_thaw; -+ } -+ - err = dpm_suspend_start(PMSG_FREEZE); - if (err) { - pr_err("%s: dpm_suspend_start %d\n", __func__, err); -diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c -index 67be2951b98a..f4d7b2fc9ffb 100644 ---- a/fs/binfmt_elf.c -+++ b/fs/binfmt_elf.c -@@ -549,11 +549,12 @@ out: - - static unsigned long randomize_stack_top(unsigned long stack_top) - { -- unsigned int random_variable = 0; -+ unsigned long random_variable = 0; - - if ((current->flags & PF_RANDOMIZE) && - !(current->personality & ADDR_NO_RANDOMIZE)) { -- random_variable = get_random_int() & STACK_RND_MASK; -+ random_variable = (unsigned long) get_random_int(); -+ random_variable &= STACK_RND_MASK; - random_variable <<= PAGE_SHIFT; - } - #ifdef CONFIG_STACK_GROWSUP -diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c -index cbd3a7d6fa68..93de3ba994e7 100644 ---- a/fs/btrfs/ctree.c -+++ b/fs/btrfs/ctree.c -@@ -2655,32 +2655,23 @@ static int key_search(struct extent_buffer *b, struct btrfs_key *key, - return 0; - } - --int btrfs_find_item(struct btrfs_root *fs_root, struct btrfs_path *found_path, -+int btrfs_find_item(struct btrfs_root *fs_root, struct btrfs_path *path, - u64 iobjectid, u64 ioff, u8 key_type, - struct btrfs_key *found_key) - { - int ret; - struct btrfs_key key; - struct extent_buffer *eb; -- struct btrfs_path *path; -+ -+ ASSERT(path); - - key.type = key_type; - key.objectid = iobjectid; - key.offset = ioff; - -- if (found_path == NULL) { -- path = btrfs_alloc_path(); -- if (!path) -- return -ENOMEM; -- } else -- path = found_path; -- - ret = btrfs_search_slot(NULL, fs_root, &key, path, 0, 0); -- if ((ret < 0) || (found_key == NULL)) { -- if (path != found_path) -- btrfs_free_path(path); -+ if ((ret < 0) || (found_key == NULL)) - return ret; -- } - - eb = path->nodes[0]; - if (ret && path->slots[0] >= btrfs_header_nritems(eb)) { -diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c -index 0db8ded65923..f48d5fc352a9 100644 ---- a/fs/btrfs/disk-io.c -+++ b/fs/btrfs/disk-io.c -@@ -1560,6 +1560,7 @@ struct btrfs_root *btrfs_get_fs_root(struct btrfs_fs_info *fs_info, - bool check_ref) - { - struct btrfs_root *root; -+ struct btrfs_path *path; - int ret; - - if (location->objectid == BTRFS_ROOT_TREE_OBJECTID) -@@ -1599,8 +1600,14 @@ again: - if (ret) - goto fail; - -- ret = btrfs_find_item(fs_info->tree_root, NULL, BTRFS_ORPHAN_OBJECTID, -+ path = btrfs_alloc_path(); -+ if (!path) { -+ ret = -ENOMEM; -+ goto fail; -+ } -+ ret = btrfs_find_item(fs_info->tree_root, path, BTRFS_ORPHAN_OBJECTID, - location->objectid, BTRFS_ORPHAN_ITEM_KEY, NULL); -+ btrfs_free_path(path); - if (ret < 0) - goto fail; - if (ret == 0) -@@ -2411,7 +2418,7 @@ int open_ctree(struct super_block *sb, - features |= BTRFS_FEATURE_INCOMPAT_COMPRESS_LZO; - - if (features & BTRFS_FEATURE_INCOMPAT_SKINNY_METADATA) -- printk(KERN_ERR "BTRFS: has skinny extents\n"); -+ printk(KERN_INFO "BTRFS: has skinny extents\n"); - - /* - * flag our filesystem as having big metadata blocks if -diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c -index 39d83da03e03..aeb57b98c53f 100644 ---- a/fs/btrfs/tree-log.c -+++ b/fs/btrfs/tree-log.c -@@ -1238,10 +1238,19 @@ static int insert_orphan_item(struct btrfs_trans_handle *trans, - struct btrfs_root *root, u64 offset) - { - int ret; -- ret = btrfs_find_item(root, NULL, BTRFS_ORPHAN_OBJECTID, -+ struct btrfs_path *path; -+ -+ path = btrfs_alloc_path(); -+ if (!path) -+ return -ENOMEM; -+ -+ ret = btrfs_find_item(root, path, BTRFS_ORPHAN_OBJECTID, - offset, BTRFS_ORPHAN_ITEM_KEY, NULL); - if (ret > 0) - ret = btrfs_insert_orphan_item(trans, root, offset); -+ -+ btrfs_free_path(path); -+ - return ret; - } - -diff --git a/fs/jffs2/scan.c b/fs/jffs2/scan.c -index 7654e87b0428..9ad5ba4b299b 100644 ---- a/fs/jffs2/scan.c -+++ b/fs/jffs2/scan.c -@@ -510,6 +510,10 @@ static int jffs2_scan_eraseblock (struct jffs2_sb_info *c, struct jffs2_eraseblo - sumlen = c->sector_size - je32_to_cpu(sm->offset); - sumptr = buf + buf_size - sumlen; - -+ /* sm->offset maybe wrong but MAGIC maybe right */ -+ if (sumlen > c->sector_size) -+ goto full_scan; -+ - /* Now, make sure the summary itself is available */ - if (sumlen > buf_size) { - /* Need to kmalloc for this. */ -@@ -544,6 +548,7 @@ static int jffs2_scan_eraseblock (struct jffs2_sb_info *c, struct jffs2_eraseblo - } - } - -+full_scan: - buf_ofs = jeb->offset; - - if (!buf_size) { -diff --git a/fs/nfs/callback.c b/fs/nfs/callback.c -index 073b4cf67ed9..0a2016bd6e58 100644 ---- a/fs/nfs/callback.c -+++ b/fs/nfs/callback.c -@@ -128,22 +128,24 @@ nfs41_callback_svc(void *vrqstp) - if (try_to_freeze()) - continue; - -- prepare_to_wait(&serv->sv_cb_waitq, &wq, TASK_INTERRUPTIBLE); -+ prepare_to_wait(&serv->sv_cb_waitq, &wq, TASK_UNINTERRUPTIBLE); - spin_lock_bh(&serv->sv_cb_lock); - if (!list_empty(&serv->sv_cb_list)) { - req = list_first_entry(&serv->sv_cb_list, - struct rpc_rqst, rq_bc_list); - list_del(&req->rq_bc_list); - spin_unlock_bh(&serv->sv_cb_lock); -+ finish_wait(&serv->sv_cb_waitq, &wq); - dprintk("Invoking bc_svc_process()\n"); - error = bc_svc_process(serv, req, rqstp); - dprintk("bc_svc_process() returned w/ error code= %d\n", - error); - } else { - spin_unlock_bh(&serv->sv_cb_lock); -- schedule(); -+ /* schedule_timeout to game the hung task watchdog */ -+ schedule_timeout(60 * HZ); -+ finish_wait(&serv->sv_cb_waitq, &wq); - } -- finish_wait(&serv->sv_cb_waitq, &wq); - } - return 0; - } -diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c -index f4ccfe6521ec..02f8d09e119f 100644 ---- a/fs/nfs/callback_xdr.c -+++ b/fs/nfs/callback_xdr.c -@@ -464,8 +464,10 @@ static __be32 decode_cb_sequence_args(struct svc_rqst *rqstp, - - for (i = 0; i < args->csa_nrclists; i++) { - status = decode_rc_list(xdr, &args->csa_rclists[i]); -- if (status) -+ if (status) { -+ args->csa_nrclists = i; - goto out_free; -+ } - } - } - status = 0; -diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c -index 33149113e333..645f180f5960 100644 ---- a/fs/xfs/xfs_buf_item.c -+++ b/fs/xfs/xfs_buf_item.c -@@ -319,6 +319,10 @@ xfs_buf_item_format( - ASSERT(atomic_read(&bip->bli_refcount) > 0); - ASSERT((bip->bli_flags & XFS_BLI_LOGGED) || - (bip->bli_flags & XFS_BLI_STALE)); -+ ASSERT((bip->bli_flags & XFS_BLI_STALE) || -+ (xfs_blft_from_flags(&bip->__bli_format) > XFS_BLFT_UNKNOWN_BUF -+ && xfs_blft_from_flags(&bip->__bli_format) < XFS_BLFT_MAX_BUF)); -+ - - /* - * If it is an inode buffer, transfer the in-memory state to the -diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c -index 3a137e9f9a7d..5d90b8db0ac7 100644 ---- a/fs/xfs/xfs_inode.c -+++ b/fs/xfs/xfs_inode.c -@@ -1946,6 +1946,7 @@ xfs_iunlink( - agi->agi_unlinked[bucket_index] = cpu_to_be32(agino); - offset = offsetof(xfs_agi_t, agi_unlinked) + - (sizeof(xfs_agino_t) * bucket_index); -+ xfs_trans_buf_set_type(tp, agibp, XFS_BLFT_AGI_BUF); - xfs_trans_log_buf(tp, agibp, offset, - (offset + sizeof(xfs_agino_t) - 1)); - return 0; -@@ -2037,6 +2038,7 @@ xfs_iunlink_remove( - agi->agi_unlinked[bucket_index] = cpu_to_be32(next_agino); - offset = offsetof(xfs_agi_t, agi_unlinked) + - (sizeof(xfs_agino_t) * bucket_index); -+ xfs_trans_buf_set_type(tp, agibp, XFS_BLFT_AGI_BUF); - xfs_trans_log_buf(tp, agibp, offset, - (offset + sizeof(xfs_agino_t) - 1)); - } else { -diff --git a/fs/xfs/xfs_qm.c b/fs/xfs/xfs_qm.c -index 6d7d1de13403..1b271f59d518 100644 ---- a/fs/xfs/xfs_qm.c -+++ b/fs/xfs/xfs_qm.c -@@ -1108,6 +1108,11 @@ xfs_qm_reset_dqcounts( - */ - xfs_dqcheck(mp, ddq, id+j, type, XFS_QMOPT_DQREPAIR, - "xfs_quotacheck"); -+ /* -+ * Reset type in case we are reusing group quota file for -+ * project quotas or vice versa -+ */ -+ ddq->d_flags = type; - ddq->d_bcount = 0; - ddq->d_icount = 0; - ddq->d_rtbcount = 0; -diff --git a/fs/xfs/xfs_trans.c b/fs/xfs/xfs_trans.c -index c812c5c060de..b626f3db67cb 100644 ---- a/fs/xfs/xfs_trans.c -+++ b/fs/xfs/xfs_trans.c -@@ -474,6 +474,7 @@ xfs_trans_apply_sb_deltas( - whole = 1; - } - -+ xfs_trans_buf_set_type(tp, bp, XFS_BLFT_SB_BUF); - if (whole) - /* - * Log the whole thing, the fields are noncontiguous. -diff --git a/include/linux/fsnotify.h b/include/linux/fsnotify.h -index 1c804b057fb1..7ee1774edee5 100644 ---- a/include/linux/fsnotify.h -+++ b/include/linux/fsnotify.h -@@ -101,8 +101,10 @@ static inline void fsnotify_move(struct inode *old_dir, struct inode *new_dir, - new_dir_mask |= FS_ISDIR; - } - -- fsnotify(old_dir, old_dir_mask, old_dir, FSNOTIFY_EVENT_INODE, old_name, fs_cookie); -- fsnotify(new_dir, new_dir_mask, new_dir, FSNOTIFY_EVENT_INODE, new_name, fs_cookie); -+ fsnotify(old_dir, old_dir_mask, source, FSNOTIFY_EVENT_INODE, old_name, -+ fs_cookie); -+ fsnotify(new_dir, new_dir_mask, source, FSNOTIFY_EVENT_INODE, new_name, -+ fs_cookie); - - if (target) - fsnotify_link_count(target); -diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h -index efe8d8a7c7ad..e34bce3781ee 100644 ---- a/include/linux/usb/hcd.h -+++ b/include/linux/usb/hcd.h -@@ -447,6 +447,7 @@ extern const struct dev_pm_ops usb_hcd_pci_pm_ops; - #endif /* CONFIG_PCI */ - - /* pci-ish (pdev null is ok) buffer alloc/mapping support */ -+void usb_init_pool_max(void); - int hcd_buffer_create(struct usb_hcd *hcd); - void hcd_buffer_destroy(struct usb_hcd *hcd); - -diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c -index 0b097c8a1e50..449518eb85ce 100644 ---- a/kernel/debug/kdb/kdb_main.c -+++ b/kernel/debug/kdb/kdb_main.c -@@ -2535,7 +2535,7 @@ static int kdb_summary(int argc, const char **argv) - #define K(x) ((x) << (PAGE_SHIFT - 10)) - kdb_printf("\nMemTotal: %8lu kB\nMemFree: %8lu kB\n" - "Buffers: %8lu kB\n", -- val.totalram, val.freeram, val.bufferram); -+ K(val.totalram), K(val.freeram), K(val.bufferram)); - return 0; - } - -diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c -index 28db9bedc857..6211d5d6d465 100644 ---- a/kernel/time/ntp.c -+++ b/kernel/time/ntp.c -@@ -631,10 +631,14 @@ int ntp_validate_timex(struct timex *txc) - if ((txc->modes & ADJ_SETOFFSET) && (!capable(CAP_SYS_TIME))) - return -EPERM; - -- if (txc->modes & ADJ_FREQUENCY) { -- if (LONG_MIN / PPM_SCALE > txc->freq) -+ /* -+ * Check for potential multiplication overflows that can -+ * only happen on 64-bit systems: -+ */ -+ if ((txc->modes & ADJ_FREQUENCY) && (BITS_PER_LONG == 64)) { -+ if (LLONG_MIN / PPM_SCALE > txc->freq) - return -EINVAL; -- if (LONG_MAX / PPM_SCALE < txc->freq) -+ if (LLONG_MAX / PPM_SCALE < txc->freq) - return -EINVAL; - } - -diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index 71136720ffa1..813b021379f5 100644 ---- a/kernel/trace/trace.c -+++ b/kernel/trace/trace.c -@@ -4694,7 +4694,7 @@ tracing_mark_write(struct file *filp, const char __user *ubuf, - *fpos += written; - - out_unlock: -- for (i = 0; i < nr_pages; i++){ -+ for (i = nr_pages - 1; i >= 0; i--) { - kunmap_atomic(map_page[i]); - put_page(pages[i]); - } -diff --git a/mm/hugetlb.c b/mm/hugetlb.c -index 67d0c175efcf..472259b00618 100644 ---- a/mm/hugetlb.c -+++ b/mm/hugetlb.c -@@ -3456,6 +3456,8 @@ follow_huge_pmd(struct mm_struct *mm, unsigned long address, - { - struct page *page; - -+ if (!pmd_present(*pmd)) -+ return NULL; - page = pte_page(*(pte_t *)pmd); - if (page) - page += ((address & ~PMD_MASK) >> PAGE_SHIFT); -diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c -index 0676f2b199d6..45f077c60348 100644 ---- a/net/ceph/osd_client.c -+++ b/net/ceph/osd_client.c -@@ -977,12 +977,24 @@ static void put_osd(struct ceph_osd *osd) - */ - static void __remove_osd(struct ceph_osd_client *osdc, struct ceph_osd *osd) - { -- dout("__remove_osd %p\n", osd); -- BUG_ON(!list_empty(&osd->o_requests)); -- rb_erase(&osd->o_node, &osdc->osds); -+ dout("%s %p osd%d\n", __func__, osd, osd->o_osd); -+ WARN_ON(!list_empty(&osd->o_requests)); -+ WARN_ON(!list_empty(&osd->o_linger_requests)); -+ - list_del_init(&osd->o_osd_lru); -- ceph_con_close(&osd->o_con); -- put_osd(osd); -+ rb_erase(&osd->o_node, &osdc->osds); -+ RB_CLEAR_NODE(&osd->o_node); -+} -+ -+static void remove_osd(struct ceph_osd_client *osdc, struct ceph_osd *osd) -+{ -+ dout("%s %p osd%d\n", __func__, osd, osd->o_osd); -+ -+ if (!RB_EMPTY_NODE(&osd->o_node)) { -+ ceph_con_close(&osd->o_con); -+ __remove_osd(osdc, osd); -+ put_osd(osd); -+ } - } - - static void remove_all_osds(struct ceph_osd_client *osdc) -@@ -992,7 +1004,7 @@ static void remove_all_osds(struct ceph_osd_client *osdc) - while (!RB_EMPTY_ROOT(&osdc->osds)) { - struct ceph_osd *osd = rb_entry(rb_first(&osdc->osds), - struct ceph_osd, o_node); -- __remove_osd(osdc, osd); -+ remove_osd(osdc, osd); - } - mutex_unlock(&osdc->request_mutex); - } -@@ -1022,7 +1034,7 @@ static void remove_old_osds(struct ceph_osd_client *osdc) - list_for_each_entry_safe(osd, nosd, &osdc->osd_lru, o_osd_lru) { - if (time_before(jiffies, osd->lru_ttl)) - break; -- __remove_osd(osdc, osd); -+ remove_osd(osdc, osd); - } - mutex_unlock(&osdc->request_mutex); - } -@@ -1037,8 +1049,7 @@ static int __reset_osd(struct ceph_osd_client *osdc, struct ceph_osd *osd) - dout("__reset_osd %p osd%d\n", osd, osd->o_osd); - if (list_empty(&osd->o_requests) && - list_empty(&osd->o_linger_requests)) { -- __remove_osd(osdc, osd); -- -+ remove_osd(osdc, osd); - return -ENODEV; - } - -@@ -1840,6 +1851,7 @@ static void reset_changed_osds(struct ceph_osd_client *osdc) - { - struct rb_node *p, *n; - -+ dout("%s %p\n", __func__, osdc); - for (p = rb_first(&osdc->osds); p; p = n) { - struct ceph_osd *osd = rb_entry(p, struct ceph_osd, o_node); - -diff --git a/sound/pci/riptide/riptide.c b/sound/pci/riptide/riptide.c -index 56cc891e395e..d99c8d341e50 100644 ---- a/sound/pci/riptide/riptide.c -+++ b/sound/pci/riptide/riptide.c -@@ -2032,32 +2032,43 @@ snd_riptide_joystick_probe(struct pci_dev *pci, const struct pci_device_id *id) - { - static int dev; - struct gameport *gameport; -+ int ret; - - if (dev >= SNDRV_CARDS) - return -ENODEV; -+ - if (!enable[dev]) { -- dev++; -- return -ENOENT; -+ ret = -ENOENT; -+ goto inc_dev; - } - -- if (!joystick_port[dev++]) -- return 0; -+ if (!joystick_port[dev]) { -+ ret = 0; -+ goto inc_dev; -+ } - - gameport = gameport_allocate_port(); -- if (!gameport) -- return -ENOMEM; -+ if (!gameport) { -+ ret = -ENOMEM; -+ goto inc_dev; -+ } - if (!request_region(joystick_port[dev], 8, "Riptide gameport")) { - snd_printk(KERN_WARNING - "Riptide: cannot grab gameport 0x%x\n", - joystick_port[dev]); - gameport_free_port(gameport); -- return -EBUSY; -+ ret = -EBUSY; -+ goto inc_dev; - } - - gameport->io = joystick_port[dev]; - gameport_register_port(gameport); - pci_set_drvdata(pci, gameport); -- return 0; -+ -+ ret = 0; -+inc_dev: -+ dev++; -+ return ret; - } - - static void snd_riptide_joystick_remove(struct pci_dev *pci) -diff --git a/sound/pci/rme9652/hdspm.c b/sound/pci/rme9652/hdspm.c -index e98dc008de0b..21167503a3f9 100644 ---- a/sound/pci/rme9652/hdspm.c -+++ b/sound/pci/rme9652/hdspm.c -@@ -6102,6 +6102,9 @@ static int snd_hdspm_playback_open(struct snd_pcm_substream *substream) - snd_pcm_hw_constraint_minmax(runtime, - SNDRV_PCM_HW_PARAM_PERIOD_SIZE, - 64, 8192); -+ snd_pcm_hw_constraint_minmax(runtime, -+ SNDRV_PCM_HW_PARAM_PERIODS, -+ 2, 2); - break; - } - -@@ -6176,6 +6179,9 @@ static int snd_hdspm_capture_open(struct snd_pcm_substream *substream) - snd_pcm_hw_constraint_minmax(runtime, - SNDRV_PCM_HW_PARAM_PERIOD_SIZE, - 64, 8192); -+ snd_pcm_hw_constraint_minmax(runtime, -+ SNDRV_PCM_HW_PARAM_PERIODS, -+ 2, 2); - break; - } - diff --git a/patch/kernel/odroidc2-default/patch-3.14.35-36.patch b/patch/kernel/odroidc2-default/patch-3.14.35-36.patch deleted file mode 100644 index 261ccc8517..0000000000 --- a/patch/kernel/odroidc2-default/patch-3.14.35-36.patch +++ /dev/null @@ -1,3448 +0,0 @@ -diff --git a/Makefile b/Makefile -index 9720e863c06f..4e6537bd8aa0 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 3 - PATCHLEVEL = 14 --SUBLEVEL = 35 -+SUBLEVEL = 36 - EXTRAVERSION = - NAME = Remembering Coco - -diff --git a/arch/arc/include/asm/processor.h b/arch/arc/include/asm/processor.h -index 15334ab66b56..fb95aa807215 100644 ---- a/arch/arc/include/asm/processor.h -+++ b/arch/arc/include/asm/processor.h -@@ -69,18 +69,19 @@ unsigned long thread_saved_pc(struct task_struct *t); - #define release_segments(mm) do { } while (0) - - #define KSTK_EIP(tsk) (task_pt_regs(tsk)->ret) -+#define KSTK_ESP(tsk) (task_pt_regs(tsk)->sp) - - /* - * Where abouts of Task's sp, fp, blink when it was last seen in kernel mode. - * Look in process.c for details of kernel stack layout - */ --#define KSTK_ESP(tsk) (tsk->thread.ksp) -+#define TSK_K_ESP(tsk) (tsk->thread.ksp) - --#define KSTK_REG(tsk, off) (*((unsigned int *)(KSTK_ESP(tsk) + \ -+#define TSK_K_REG(tsk, off) (*((unsigned int *)(TSK_K_ESP(tsk) + \ - sizeof(struct callee_regs) + off))) - --#define KSTK_BLINK(tsk) KSTK_REG(tsk, 4) --#define KSTK_FP(tsk) KSTK_REG(tsk, 0) -+#define TSK_K_BLINK(tsk) TSK_K_REG(tsk, 4) -+#define TSK_K_FP(tsk) TSK_K_REG(tsk, 0) - - /* - * Do necessary setup to start up a newly executed thread. -diff --git a/arch/arc/kernel/stacktrace.c b/arch/arc/kernel/stacktrace.c -index 9ce47cfe2303..fb98769b6a98 100644 ---- a/arch/arc/kernel/stacktrace.c -+++ b/arch/arc/kernel/stacktrace.c -@@ -64,9 +64,9 @@ static void seed_unwind_frame_info(struct task_struct *tsk, - - frame_info->task = tsk; - -- frame_info->regs.r27 = KSTK_FP(tsk); -- frame_info->regs.r28 = KSTK_ESP(tsk); -- frame_info->regs.r31 = KSTK_BLINK(tsk); -+ frame_info->regs.r27 = TSK_K_FP(tsk); -+ frame_info->regs.r28 = TSK_K_ESP(tsk); -+ frame_info->regs.r31 = TSK_K_BLINK(tsk); - frame_info->regs.r63 = (unsigned int)__switch_to; - - /* In the prologue of __switch_to, first FP is saved on stack -diff --git a/arch/mips/kvm/trace.h b/arch/mips/kvm/trace.h -index bc9e0f406c08..e51621e36152 100644 ---- a/arch/mips/kvm/trace.h -+++ b/arch/mips/kvm/trace.h -@@ -26,18 +26,18 @@ TRACE_EVENT(kvm_exit, - TP_PROTO(struct kvm_vcpu *vcpu, unsigned int reason), - TP_ARGS(vcpu, reason), - TP_STRUCT__entry( -- __field(struct kvm_vcpu *, vcpu) -+ __field(unsigned long, pc) - __field(unsigned int, reason) - ), - - TP_fast_assign( -- __entry->vcpu = vcpu; -+ __entry->pc = vcpu->arch.pc; - __entry->reason = reason; - ), - - TP_printk("[%s]PC: 0x%08lx", - kvm_mips_exit_types_str[__entry->reason], -- __entry->vcpu->arch.pc) -+ __entry->pc) - ); - - #endif /* _TRACE_KVM_H */ -diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S -index 02553d6d183d..06469ee0f26e 100644 ---- a/arch/x86/kernel/entry_64.S -+++ b/arch/x86/kernel/entry_64.S -@@ -542,11 +542,14 @@ ENTRY(ret_from_fork) - testl $3, CS-ARGOFFSET(%rsp) # from kernel_thread? - jz 1f - -- testl $_TIF_IA32, TI_flags(%rcx) # 32-bit compat task needs IRET -- jnz int_ret_from_sys_call -- -- RESTORE_TOP_OF_STACK %rdi, -ARGOFFSET -- jmp ret_from_sys_call # go to the SYSRET fastpath -+ /* -+ * By the time we get here, we have no idea whether our pt_regs, -+ * ti flags, and ti status came from the 64-bit SYSCALL fast path, -+ * the slow path, or one of the ia32entry paths. -+ * Use int_ret_from_sys_call to return, since it can safely handle -+ * all of the above. -+ */ -+ jmp int_ret_from_sys_call - - 1: - subq $REST_SKIP, %rsp # leave space for volatiles -diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c -index 38d3751472e4..09651d4a9038 100644 ---- a/arch/x86/kvm/emulate.c -+++ b/arch/x86/kvm/emulate.c -@@ -4646,7 +4646,8 @@ int x86_emulate_insn(struct x86_emulate_ctxt *ctxt) - if (rc != X86EMUL_CONTINUE) - goto done; - } -- ctxt->dst.orig_val = ctxt->dst.val; -+ /* Copy full 64-bit value for CMPXCHG8B. */ -+ ctxt->dst.orig_val64 = ctxt->dst.val64; - - special_insn: - -diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c -index bb0b90461a6b..997540dc8250 100644 ---- a/drivers/acpi/video.c -+++ b/drivers/acpi/video.c -@@ -2064,6 +2064,17 @@ EXPORT_SYMBOL(acpi_video_unregister); - - static int __init acpi_video_init(void) - { -+ /* -+ * Let the module load even if ACPI is disabled (e.g. due to -+ * a broken BIOS) so that i915.ko can still be loaded on such -+ * old systems without an AcpiOpRegion. -+ * -+ * acpi_video_register() will report -ENODEV later as well due -+ * to acpi_disabled when i915.ko tries to register itself afterwards. -+ */ -+ if (acpi_disabled) -+ return 0; -+ - dmi_check_system(video_dmi_table); - - if (intel_opregion_present()) -diff --git a/drivers/clk/clk-gate.c b/drivers/clk/clk-gate.c -index 4a58c55255bd..797bab97cea6 100644 ---- a/drivers/clk/clk-gate.c -+++ b/drivers/clk/clk-gate.c -@@ -128,7 +128,7 @@ struct clk *clk_register_gate(struct device *dev, const char *name, - struct clk_init_data init; - - if (clk_gate_flags & CLK_GATE_HIWORD_MASK) { -- if (bit_idx > 16) { -+ if (bit_idx > 15) { - pr_err("gate bit exceeds LOWORD field\n"); - return ERR_PTR(-EINVAL); - } -diff --git a/drivers/clk/sunxi/clk-factors.c b/drivers/clk/sunxi/clk-factors.c -index 9e232644f07e..ea4db844aee3 100644 ---- a/drivers/clk/sunxi/clk-factors.c -+++ b/drivers/clk/sunxi/clk-factors.c -@@ -62,7 +62,7 @@ static unsigned long clk_factors_recalc_rate(struct clk_hw *hw, - p = FACTOR_GET(config->pshift, config->pwidth, reg); - - /* Calculate the rate */ -- rate = (parent_rate * n * (k + 1) >> p) / (m + 1); -+ rate = (parent_rate * (n + config->n_start) * (k + 1) >> p) / (m + 1); - - return rate; - } -diff --git a/drivers/clk/sunxi/clk-factors.h b/drivers/clk/sunxi/clk-factors.h -index 02e1a43ebac7..d2d0efa39379 100644 ---- a/drivers/clk/sunxi/clk-factors.h -+++ b/drivers/clk/sunxi/clk-factors.h -@@ -15,6 +15,7 @@ struct clk_factors_config { - u8 mwidth; - u8 pshift; - u8 pwidth; -+ u8 n_start; - }; - - struct clk_factors { -diff --git a/drivers/clk/sunxi/clk-sunxi.c b/drivers/clk/sunxi/clk-sunxi.c -index abb6c5ac8a10..06a14b808683 100644 ---- a/drivers/clk/sunxi/clk-sunxi.c -+++ b/drivers/clk/sunxi/clk-sunxi.c -@@ -407,6 +407,7 @@ static struct clk_factors_config sun6i_a31_pll1_config = { - .kwidth = 2, - .mshift = 0, - .mwidth = 2, -+ .n_start = 1, - }; - - static struct clk_factors_config sun4i_pll5_config = { -diff --git a/drivers/clk/zynq/clkc.c b/drivers/clk/zynq/clkc.c -index 09dd0173ea0a..5f52f3f62644 100644 ---- a/drivers/clk/zynq/clkc.c -+++ b/drivers/clk/zynq/clkc.c -@@ -300,6 +300,7 @@ static void __init zynq_clk_setup(struct device_node *np) - clks[cpu_2x] = clk_register_gate(NULL, clk_output_name[cpu_2x], - "cpu_2x_div", CLK_IGNORE_UNUSED, SLCR_ARM_CLK_CTRL, - 26, 0, &armclk_lock); -+ clk_prepare_enable(clks[cpu_2x]); - - clk = clk_register_fixed_factor(NULL, "cpu_1x_div", "cpu_div", 0, 1, - 4 + 2 * tmp); -diff --git a/drivers/firmware/efi/runtime-map.c b/drivers/firmware/efi/runtime-map.c -index 97cdd16a2169..c98b101a73ae 100644 ---- a/drivers/firmware/efi/runtime-map.c -+++ b/drivers/firmware/efi/runtime-map.c -@@ -170,7 +170,7 @@ int __init efi_runtime_map_init(struct kobject *efi_kobj) - - return 0; - out_add_entry: -- for (j = i - 1; j > 0; j--) { -+ for (j = i - 1; j >= 0; j--) { - entry = *(map_entries + j); - kobject_put(&entry->kobj); - } -diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c -index 8ef67cb4ef1e..f0ed0baddf70 100644 ---- a/drivers/gpu/drm/radeon/cik.c -+++ b/drivers/gpu/drm/radeon/cik.c -@@ -3558,7 +3558,21 @@ void cik_fence_gfx_ring_emit(struct radeon_device *rdev, - struct radeon_ring *ring = &rdev->ring[fence->ring]; - u64 addr = rdev->fence_drv[fence->ring].gpu_addr; - -- /* EVENT_WRITE_EOP - flush caches, send int */ -+ /* Workaround for cache flush problems. First send a dummy EOP -+ * event down the pipe with seq one below. -+ */ -+ radeon_ring_write(ring, PACKET3(PACKET3_EVENT_WRITE_EOP, 4)); -+ radeon_ring_write(ring, (EOP_TCL1_ACTION_EN | -+ EOP_TC_ACTION_EN | -+ EVENT_TYPE(CACHE_FLUSH_AND_INV_TS_EVENT) | -+ EVENT_INDEX(5))); -+ radeon_ring_write(ring, addr & 0xfffffffc); -+ radeon_ring_write(ring, (upper_32_bits(addr) & 0xffff) | -+ DATA_SEL(1) | INT_SEL(0)); -+ radeon_ring_write(ring, fence->seq - 1); -+ radeon_ring_write(ring, 0); -+ -+ /* Then send the real EOP event down the pipe. */ - radeon_ring_write(ring, PACKET3(PACKET3_EVENT_WRITE_EOP, 4)); - radeon_ring_write(ring, (EOP_TCL1_ACTION_EN | - EOP_TC_ACTION_EN | -@@ -6809,7 +6823,6 @@ int cik_irq_set(struct radeon_device *rdev) - u32 hpd1, hpd2, hpd3, hpd4, hpd5, hpd6; - u32 grbm_int_cntl = 0; - u32 dma_cntl, dma_cntl1; -- u32 thermal_int; - - if (!rdev->irq.installed) { - WARN(1, "Can't enable IRQ/MSI because no handler is installed\n"); -@@ -6846,13 +6859,6 @@ int cik_irq_set(struct radeon_device *rdev) - cp_m2p2 = RREG32(CP_ME2_PIPE2_INT_CNTL) & ~TIME_STAMP_INT_ENABLE; - cp_m2p3 = RREG32(CP_ME2_PIPE3_INT_CNTL) & ~TIME_STAMP_INT_ENABLE; - -- if (rdev->flags & RADEON_IS_IGP) -- thermal_int = RREG32_SMC(CG_THERMAL_INT_CTRL) & -- ~(THERM_INTH_MASK | THERM_INTL_MASK); -- else -- thermal_int = RREG32_SMC(CG_THERMAL_INT) & -- ~(THERM_INT_MASK_HIGH | THERM_INT_MASK_LOW); -- - /* enable CP interrupts on all rings */ - if (atomic_read(&rdev->irq.ring_int[RADEON_RING_TYPE_GFX_INDEX])) { - DRM_DEBUG("cik_irq_set: sw int gfx\n"); -@@ -7010,14 +7016,6 @@ int cik_irq_set(struct radeon_device *rdev) - hpd6 |= DC_HPDx_INT_EN; - } - -- if (rdev->irq.dpm_thermal) { -- DRM_DEBUG("dpm thermal\n"); -- if (rdev->flags & RADEON_IS_IGP) -- thermal_int |= THERM_INTH_MASK | THERM_INTL_MASK; -- else -- thermal_int |= THERM_INT_MASK_HIGH | THERM_INT_MASK_LOW; -- } -- - WREG32(CP_INT_CNTL_RING0, cp_int_cntl); - - WREG32(SDMA0_CNTL + SDMA0_REGISTER_OFFSET, dma_cntl); -@@ -7071,11 +7069,6 @@ int cik_irq_set(struct radeon_device *rdev) - WREG32(DC_HPD5_INT_CONTROL, hpd5); - WREG32(DC_HPD6_INT_CONTROL, hpd6); - -- if (rdev->flags & RADEON_IS_IGP) -- WREG32_SMC(CG_THERMAL_INT_CTRL, thermal_int); -- else -- WREG32_SMC(CG_THERMAL_INT, thermal_int); -- - return 0; - } - -diff --git a/drivers/gpu/drm/radeon/kv_dpm.c b/drivers/gpu/drm/radeon/kv_dpm.c -index 351db361239d..c7c7bc5d573f 100644 ---- a/drivers/gpu/drm/radeon/kv_dpm.c -+++ b/drivers/gpu/drm/radeon/kv_dpm.c -@@ -1121,6 +1121,19 @@ void kv_dpm_enable_bapm(struct radeon_device *rdev, bool enable) - } - } - -+static void kv_enable_thermal_int(struct radeon_device *rdev, bool enable) -+{ -+ u32 thermal_int; -+ -+ thermal_int = RREG32_SMC(CG_THERMAL_INT_CTRL); -+ if (enable) -+ thermal_int |= THERM_INTH_MASK | THERM_INTL_MASK; -+ else -+ thermal_int &= ~(THERM_INTH_MASK | THERM_INTL_MASK); -+ WREG32_SMC(CG_THERMAL_INT_CTRL, thermal_int); -+ -+} -+ - int kv_dpm_enable(struct radeon_device *rdev) - { - struct kv_power_info *pi = kv_get_pi(rdev); -@@ -1232,8 +1245,7 @@ int kv_dpm_late_enable(struct radeon_device *rdev) - DRM_ERROR("kv_set_thermal_temperature_range failed\n"); - return ret; - } -- rdev->irq.dpm_thermal = true; -- radeon_irq_set(rdev); -+ kv_enable_thermal_int(rdev, true); - } - - /* powerdown unused blocks for now */ -@@ -1261,6 +1273,7 @@ void kv_dpm_disable(struct radeon_device *rdev) - kv_stop_dpm(rdev); - kv_enable_ulv(rdev, false); - kv_reset_am(rdev); -+ kv_enable_thermal_int(rdev, false); - - kv_update_current_ps(rdev, rdev->pm.dpm.boot_ps); - } -diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c -index bf6300cfd62d..f8c01b8d1594 100644 ---- a/drivers/gpu/drm/radeon/ni.c -+++ b/drivers/gpu/drm/radeon/ni.c -@@ -1073,12 +1073,12 @@ static void cayman_gpu_init(struct radeon_device *rdev) - - if ((rdev->config.cayman.max_backends_per_se == 1) && - (rdev->flags & RADEON_IS_IGP)) { -- if ((disabled_rb_mask & 3) == 1) { -- /* RB0 disabled, RB1 enabled */ -- tmp = 0x11111111; -- } else { -+ if ((disabled_rb_mask & 3) == 2) { - /* RB1 disabled, RB0 enabled */ - tmp = 0x00000000; -+ } else { -+ /* RB0 disabled, RB1 enabled */ -+ tmp = 0x11111111; - } - } else { - tmp = gb_addr_config & NUM_PIPES_MASK; -diff --git a/drivers/gpu/drm/radeon/r600_dpm.c b/drivers/gpu/drm/radeon/r600_dpm.c -index 3334f916945b..e98108236e04 100644 ---- a/drivers/gpu/drm/radeon/r600_dpm.c -+++ b/drivers/gpu/drm/radeon/r600_dpm.c -@@ -187,7 +187,7 @@ u32 r600_dpm_get_vrefresh(struct radeon_device *rdev) - list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) { - radeon_crtc = to_radeon_crtc(crtc); - if (crtc->enabled && radeon_crtc->enabled && radeon_crtc->hw_mode.clock) { -- vrefresh = radeon_crtc->hw_mode.vrefresh; -+ vrefresh = drm_mode_vrefresh(&radeon_crtc->hw_mode); - break; - } - } -diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c -index e2de749327ad..2fa3cf615a67 100644 ---- a/drivers/gpu/drm/radeon/radeon_atombios.c -+++ b/drivers/gpu/drm/radeon/radeon_atombios.c -@@ -3272,6 +3272,7 @@ int radeon_atom_get_voltage_evv(struct radeon_device *rdev, - - args.in.ucVoltageType = VOLTAGE_TYPE_VDDC; - args.in.ucVoltageMode = ATOM_GET_VOLTAGE_EVV_VOLTAGE; -+ args.in.usVoltageLevel = cpu_to_le16(virtual_voltage_id); - args.in.ulSCLKFreq = - cpu_to_le32(rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk.entries[entry_id].clk); - -diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c -index 4b87bb164f30..a413f76e84d4 100644 ---- a/drivers/hid/hid-input.c -+++ b/drivers/hid/hid-input.c -@@ -1066,6 +1066,23 @@ void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, struct - return; - } - -+ /* -+ * Ignore reports for absolute data if the data didn't change. This is -+ * not only an optimization but also fixes 'dead' key reports. Some -+ * RollOver implementations for localized keys (like BACKSLASH/PIPE; HID -+ * 0x31 and 0x32) report multiple keys, even though a localized keyboard -+ * can only have one of them physically available. The 'dead' keys -+ * report constant 0. As all map to the same keycode, they'd confuse -+ * the input layer. If we filter the 'dead' keys on the HID level, we -+ * skip the keycode translation and only forward real events. -+ */ -+ if (!(field->flags & (HID_MAIN_ITEM_RELATIVE | -+ HID_MAIN_ITEM_BUFFERED_BYTE)) && -+ (field->flags & HID_MAIN_ITEM_VARIABLE) && -+ usage->usage_index < field->maxusage && -+ value == field->value[usage->usage_index]) -+ return; -+ - /* report the usage code as scancode if the key status has changed */ - if (usage->type == EV_KEY && !!test_bit(usage->code, input->key) != value) - input_event(input, EV_MSC, MSC_SCAN, usage->hid); -diff --git a/drivers/iio/adc/mcp3422.c b/drivers/iio/adc/mcp3422.c -index 47dcb34ff44c..3a615f3b5d80 100644 ---- a/drivers/iio/adc/mcp3422.c -+++ b/drivers/iio/adc/mcp3422.c -@@ -57,20 +57,11 @@ - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SAMP_FREQ), \ - } - --/* LSB is in nV to eliminate floating point */ --static const u32 rates_to_lsb[] = {1000000, 250000, 62500, 15625}; -- --/* -- * scales calculated as: -- * rates_to_lsb[sample_rate] / (1 << pga); -- * pga is 1 for 0, 2 -- */ -- - static const int mcp3422_scales[4][4] = { -- { 1000000, 250000, 62500, 15625 }, -- { 500000 , 125000, 31250, 7812 }, -- { 250000 , 62500 , 15625, 3906 }, -- { 125000 , 31250 , 7812 , 1953 } }; -+ { 1000000, 500000, 250000, 125000 }, -+ { 250000 , 125000, 62500 , 31250 }, -+ { 62500 , 31250 , 15625 , 7812 }, -+ { 15625 , 7812 , 3906 , 1953 } }; - - /* Constant msleep times for data acquisitions */ - static const int mcp3422_read_times[4] = { -diff --git a/drivers/iio/dac/ad5686.c b/drivers/iio/dac/ad5686.c -index 17aca4d9bd06..861ba3d60163 100644 ---- a/drivers/iio/dac/ad5686.c -+++ b/drivers/iio/dac/ad5686.c -@@ -322,7 +322,7 @@ static int ad5686_probe(struct spi_device *spi) - st = iio_priv(indio_dev); - spi_set_drvdata(spi, indio_dev); - -- st->reg = devm_regulator_get(&spi->dev, "vcc"); -+ st->reg = devm_regulator_get_optional(&spi->dev, "vcc"); - if (!IS_ERR(st->reg)) { - ret = regulator_enable(st->reg); - if (ret) -diff --git a/drivers/iio/imu/adis16400_core.c b/drivers/iio/imu/adis16400_core.c -index 7c582f7ae34e..70753bf23a86 100644 ---- a/drivers/iio/imu/adis16400_core.c -+++ b/drivers/iio/imu/adis16400_core.c -@@ -26,6 +26,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -447,7 +448,7 @@ static int adis16400_read_raw(struct iio_dev *indio_dev, - mutex_unlock(&indio_dev->mlock); - if (ret) - return ret; -- val16 = ((val16 & 0xFFF) << 4) >> 4; -+ val16 = sign_extend32(val16, 11); - *val = val16; - return IIO_VAL_INT; - case IIO_CHAN_INFO_OFFSET: -diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c -index 56a4b7ca7ee3..45d67e9228d7 100644 ---- a/drivers/infiniband/core/ucma.c -+++ b/drivers/infiniband/core/ucma.c -@@ -1124,6 +1124,9 @@ static int ucma_set_ib_path(struct ucma_context *ctx, - if (!optlen) - return -EINVAL; - -+ memset(&sa_path, 0, sizeof(sa_path)); -+ sa_path.vlan_id = 0xffff; -+ - ib_sa_unpack_path(path_data->path_rec, &sa_path); - ret = rdma_set_ib_paths(ctx->cm_id, &sa_path, 1); - if (ret) -diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c -index 23467a2abd62..2adc14372b94 100644 ---- a/drivers/infiniband/core/uverbs_cmd.c -+++ b/drivers/infiniband/core/uverbs_cmd.c -@@ -1964,20 +1964,21 @@ ssize_t ib_uverbs_modify_qp(struct ib_uverbs_file *file, - if (qp->real_qp == qp) { - ret = ib_resolve_eth_l2_attrs(qp, attr, &cmd.attr_mask); - if (ret) -- goto out; -+ goto release_qp; - ret = qp->device->modify_qp(qp, attr, - modify_qp_mask(qp->qp_type, cmd.attr_mask), &udata); - } else { - ret = ib_modify_qp(qp, attr, modify_qp_mask(qp->qp_type, cmd.attr_mask)); - } - -- put_qp_read(qp); -- - if (ret) -- goto out; -+ goto release_qp; - - ret = in_len; - -+release_qp: -+ put_qp_read(qp); -+ - out: - kfree(attr); - -diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c -index 11f0606792bb..1a3d924744cc 100644 ---- a/drivers/infiniband/hw/mlx4/main.c -+++ b/drivers/infiniband/hw/mlx4/main.c -@@ -1161,8 +1161,7 @@ static int mlx4_ib_mcg_attach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid) - struct mlx4_ib_qp *mqp = to_mqp(ibqp); - u64 reg_id; - struct mlx4_ib_steering *ib_steering = NULL; -- enum mlx4_protocol prot = (gid->raw[1] == 0x0e) ? -- MLX4_PROT_IB_IPV4 : MLX4_PROT_IB_IPV6; -+ enum mlx4_protocol prot = MLX4_PROT_IB_IPV6; - - if (mdev->dev->caps.steering_mode == - MLX4_STEERING_MODE_DEVICE_MANAGED) { -@@ -1175,8 +1174,10 @@ static int mlx4_ib_mcg_attach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid) - !!(mqp->flags & - MLX4_IB_QP_BLOCK_MULTICAST_LOOPBACK), - prot, ®_id); -- if (err) -+ if (err) { -+ pr_err("multicast attach op failed, err %d\n", err); - goto err_malloc; -+ } - - err = add_gid_entry(ibqp, gid); - if (err) -@@ -1224,8 +1225,7 @@ static int mlx4_ib_mcg_detach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid) - struct net_device *ndev; - struct mlx4_ib_gid_entry *ge; - u64 reg_id = 0; -- enum mlx4_protocol prot = (gid->raw[1] == 0x0e) ? -- MLX4_PROT_IB_IPV4 : MLX4_PROT_IB_IPV6; -+ enum mlx4_protocol prot = MLX4_PROT_IB_IPV6; - - if (mdev->dev->caps.steering_mode == - MLX4_STEERING_MODE_DEVICE_MANAGED) { -diff --git a/drivers/infiniband/hw/qib/qib.h b/drivers/infiniband/hw/qib/qib.h -index 1946101419a3..675d3c796b9f 100644 ---- a/drivers/infiniband/hw/qib/qib.h -+++ b/drivers/infiniband/hw/qib/qib.h -@@ -1080,12 +1080,6 @@ struct qib_devdata { - /* control high-level access to EEPROM */ - struct mutex eep_lock; - uint64_t traffic_wds; -- /* active time is kept in seconds, but logged in hours */ -- atomic_t active_time; -- /* Below are nominal shadow of EEPROM, new since last EEPROM update */ -- uint8_t eep_st_errs[QIB_EEP_LOG_CNT]; -- uint8_t eep_st_new_errs[QIB_EEP_LOG_CNT]; -- uint16_t eep_hrs; - /* - * masks for which bits of errs, hwerrs that cause - * each of the counters to increment. -@@ -1307,8 +1301,7 @@ int qib_twsi_blk_rd(struct qib_devdata *dd, int dev, int addr, void *buffer, - int qib_twsi_blk_wr(struct qib_devdata *dd, int dev, int addr, - const void *buffer, int len); - void qib_get_eeprom_info(struct qib_devdata *); --int qib_update_eeprom_log(struct qib_devdata *dd); --void qib_inc_eeprom_err(struct qib_devdata *dd, u32 eidx, u32 incr); -+#define qib_inc_eeprom_err(dd, eidx, incr) - void qib_dump_lookup_output_queue(struct qib_devdata *); - void qib_force_pio_avail_update(struct qib_devdata *); - void qib_clear_symerror_on_linkup(unsigned long opaque); -diff --git a/drivers/infiniband/hw/qib/qib_eeprom.c b/drivers/infiniband/hw/qib/qib_eeprom.c -index 4d5d71aaa2b4..e2280b07df02 100644 ---- a/drivers/infiniband/hw/qib/qib_eeprom.c -+++ b/drivers/infiniband/hw/qib/qib_eeprom.c -@@ -267,190 +267,9 @@ void qib_get_eeprom_info(struct qib_devdata *dd) - "Board SN %s did not pass functional test: %s\n", - dd->serial, ifp->if_comment); - -- memcpy(&dd->eep_st_errs, &ifp->if_errcntp, QIB_EEP_LOG_CNT); -- /* -- * Power-on (actually "active") hours are kept as little-endian value -- * in EEPROM, but as seconds in a (possibly as small as 24-bit) -- * atomic_t while running. -- */ -- atomic_set(&dd->active_time, 0); -- dd->eep_hrs = ifp->if_powerhour[0] | (ifp->if_powerhour[1] << 8); -- - done: - vfree(buf); - - bail:; - } - --/** -- * qib_update_eeprom_log - copy active-time and error counters to eeprom -- * @dd: the qlogic_ib device -- * -- * Although the time is kept as seconds in the qib_devdata struct, it is -- * rounded to hours for re-write, as we have only 16 bits in EEPROM. -- * First-cut code reads whole (expected) struct qib_flash, modifies, -- * re-writes. Future direction: read/write only what we need, assuming -- * that the EEPROM had to have been "good enough" for driver init, and -- * if not, we aren't making it worse. -- * -- */ --int qib_update_eeprom_log(struct qib_devdata *dd) --{ -- void *buf; -- struct qib_flash *ifp; -- int len, hi_water; -- uint32_t new_time, new_hrs; -- u8 csum; -- int ret, idx; -- unsigned long flags; -- -- /* first, check if we actually need to do anything. */ -- ret = 0; -- for (idx = 0; idx < QIB_EEP_LOG_CNT; ++idx) { -- if (dd->eep_st_new_errs[idx]) { -- ret = 1; -- break; -- } -- } -- new_time = atomic_read(&dd->active_time); -- -- if (ret == 0 && new_time < 3600) -- goto bail; -- -- /* -- * The quick-check above determined that there is something worthy -- * of logging, so get current contents and do a more detailed idea. -- * read full flash, not just currently used part, since it may have -- * been written with a newer definition -- */ -- len = sizeof(struct qib_flash); -- buf = vmalloc(len); -- ret = 1; -- if (!buf) { -- qib_dev_err(dd, -- "Couldn't allocate memory to read %u bytes from eeprom for logging\n", -- len); -- goto bail; -- } -- -- /* Grab semaphore and read current EEPROM. If we get an -- * error, let go, but if not, keep it until we finish write. -- */ -- ret = mutex_lock_interruptible(&dd->eep_lock); -- if (ret) { -- qib_dev_err(dd, "Unable to acquire EEPROM for logging\n"); -- goto free_bail; -- } -- ret = qib_twsi_blk_rd(dd, dd->twsi_eeprom_dev, 0, buf, len); -- if (ret) { -- mutex_unlock(&dd->eep_lock); -- qib_dev_err(dd, "Unable read EEPROM for logging\n"); -- goto free_bail; -- } -- ifp = (struct qib_flash *)buf; -- -- csum = flash_csum(ifp, 0); -- if (csum != ifp->if_csum) { -- mutex_unlock(&dd->eep_lock); -- qib_dev_err(dd, "EEPROM cks err (0x%02X, S/B 0x%02X)\n", -- csum, ifp->if_csum); -- ret = 1; -- goto free_bail; -- } -- hi_water = 0; -- spin_lock_irqsave(&dd->eep_st_lock, flags); -- for (idx = 0; idx < QIB_EEP_LOG_CNT; ++idx) { -- int new_val = dd->eep_st_new_errs[idx]; -- if (new_val) { -- /* -- * If we have seen any errors, add to EEPROM values -- * We need to saturate at 0xFF (255) and we also -- * would need to adjust the checksum if we were -- * trying to minimize EEPROM traffic -- * Note that we add to actual current count in EEPROM, -- * in case it was altered while we were running. -- */ -- new_val += ifp->if_errcntp[idx]; -- if (new_val > 0xFF) -- new_val = 0xFF; -- if (ifp->if_errcntp[idx] != new_val) { -- ifp->if_errcntp[idx] = new_val; -- hi_water = offsetof(struct qib_flash, -- if_errcntp) + idx; -- } -- /* -- * update our shadow (used to minimize EEPROM -- * traffic), to match what we are about to write. -- */ -- dd->eep_st_errs[idx] = new_val; -- dd->eep_st_new_errs[idx] = 0; -- } -- } -- /* -- * Now update active-time. We would like to round to the nearest hour -- * but unless atomic_t are sure to be proper signed ints we cannot, -- * because we need to account for what we "transfer" to EEPROM and -- * if we log an hour at 31 minutes, then we would need to set -- * active_time to -29 to accurately count the _next_ hour. -- */ -- if (new_time >= 3600) { -- new_hrs = new_time / 3600; -- atomic_sub((new_hrs * 3600), &dd->active_time); -- new_hrs += dd->eep_hrs; -- if (new_hrs > 0xFFFF) -- new_hrs = 0xFFFF; -- dd->eep_hrs = new_hrs; -- if ((new_hrs & 0xFF) != ifp->if_powerhour[0]) { -- ifp->if_powerhour[0] = new_hrs & 0xFF; -- hi_water = offsetof(struct qib_flash, if_powerhour); -- } -- if ((new_hrs >> 8) != ifp->if_powerhour[1]) { -- ifp->if_powerhour[1] = new_hrs >> 8; -- hi_water = offsetof(struct qib_flash, if_powerhour) + 1; -- } -- } -- /* -- * There is a tiny possibility that we could somehow fail to write -- * the EEPROM after updating our shadows, but problems from holding -- * the spinlock too long are a much bigger issue. -- */ -- spin_unlock_irqrestore(&dd->eep_st_lock, flags); -- if (hi_water) { -- /* we made some change to the data, uopdate cksum and write */ -- csum = flash_csum(ifp, 1); -- ret = eeprom_write_with_enable(dd, 0, buf, hi_water + 1); -- } -- mutex_unlock(&dd->eep_lock); -- if (ret) -- qib_dev_err(dd, "Failed updating EEPROM\n"); -- --free_bail: -- vfree(buf); --bail: -- return ret; --} -- --/** -- * qib_inc_eeprom_err - increment one of the four error counters -- * that are logged to EEPROM. -- * @dd: the qlogic_ib device -- * @eidx: 0..3, the counter to increment -- * @incr: how much to add -- * -- * Each counter is 8-bits, and saturates at 255 (0xFF). They -- * are copied to the EEPROM (aka flash) whenever qib_update_eeprom_log() -- * is called, but it can only be called in a context that allows sleep. -- * This function can be called even at interrupt level. -- */ --void qib_inc_eeprom_err(struct qib_devdata *dd, u32 eidx, u32 incr) --{ -- uint new_val; -- unsigned long flags; -- -- spin_lock_irqsave(&dd->eep_st_lock, flags); -- new_val = dd->eep_st_new_errs[eidx] + incr; -- if (new_val > 255) -- new_val = 255; -- dd->eep_st_new_errs[eidx] = new_val; -- spin_unlock_irqrestore(&dd->eep_st_lock, flags); --} -diff --git a/drivers/infiniband/hw/qib/qib_iba6120.c b/drivers/infiniband/hw/qib/qib_iba6120.c -index 84e593d6007b..295f6312e6a9 100644 ---- a/drivers/infiniband/hw/qib/qib_iba6120.c -+++ b/drivers/infiniband/hw/qib/qib_iba6120.c -@@ -2682,8 +2682,6 @@ static void qib_get_6120_faststats(unsigned long opaque) - spin_lock_irqsave(&dd->eep_st_lock, flags); - traffic_wds -= dd->traffic_wds; - dd->traffic_wds += traffic_wds; -- if (traffic_wds >= QIB_TRAFFIC_ACTIVE_THRESHOLD) -- atomic_add(5, &dd->active_time); /* S/B #define */ - spin_unlock_irqrestore(&dd->eep_st_lock, flags); - - qib_chk_6120_errormask(dd); -diff --git a/drivers/infiniband/hw/qib/qib_iba7220.c b/drivers/infiniband/hw/qib/qib_iba7220.c -index 454c2e7668fe..c86e71b9e160 100644 ---- a/drivers/infiniband/hw/qib/qib_iba7220.c -+++ b/drivers/infiniband/hw/qib/qib_iba7220.c -@@ -3299,8 +3299,6 @@ static void qib_get_7220_faststats(unsigned long opaque) - spin_lock_irqsave(&dd->eep_st_lock, flags); - traffic_wds -= dd->traffic_wds; - dd->traffic_wds += traffic_wds; -- if (traffic_wds >= QIB_TRAFFIC_ACTIVE_THRESHOLD) -- atomic_add(5, &dd->active_time); /* S/B #define */ - spin_unlock_irqrestore(&dd->eep_st_lock, flags); - done: - mod_timer(&dd->stats_timer, jiffies + HZ * ACTIVITY_TIMER); -diff --git a/drivers/infiniband/hw/qib/qib_iba7322.c b/drivers/infiniband/hw/qib/qib_iba7322.c -index d1bd21319d7d..0f8d1f0bd929 100644 ---- a/drivers/infiniband/hw/qib/qib_iba7322.c -+++ b/drivers/infiniband/hw/qib/qib_iba7322.c -@@ -5191,8 +5191,6 @@ static void qib_get_7322_faststats(unsigned long opaque) - spin_lock_irqsave(&ppd->dd->eep_st_lock, flags); - traffic_wds -= ppd->dd->traffic_wds; - ppd->dd->traffic_wds += traffic_wds; -- if (traffic_wds >= QIB_TRAFFIC_ACTIVE_THRESHOLD) -- atomic_add(ACTIVITY_TIMER, &ppd->dd->active_time); - spin_unlock_irqrestore(&ppd->dd->eep_st_lock, flags); - if (ppd->cpspec->qdr_dfe_on && (ppd->link_speed_active & - QIB_IB_QDR) && -diff --git a/drivers/infiniband/hw/qib/qib_init.c b/drivers/infiniband/hw/qib/qib_init.c -index 76c3e177164d..8c9bb6c35838 100644 ---- a/drivers/infiniband/hw/qib/qib_init.c -+++ b/drivers/infiniband/hw/qib/qib_init.c -@@ -922,7 +922,6 @@ static void qib_shutdown_device(struct qib_devdata *dd) - } - } - -- qib_update_eeprom_log(dd); - } - - /** -diff --git a/drivers/infiniband/hw/qib/qib_sysfs.c b/drivers/infiniband/hw/qib/qib_sysfs.c -index 3c8e4e3caca6..b9ccbda7817d 100644 ---- a/drivers/infiniband/hw/qib/qib_sysfs.c -+++ b/drivers/infiniband/hw/qib/qib_sysfs.c -@@ -611,28 +611,6 @@ bail: - return ret < 0 ? ret : count; - } - --static ssize_t show_logged_errs(struct device *device, -- struct device_attribute *attr, char *buf) --{ -- struct qib_ibdev *dev = -- container_of(device, struct qib_ibdev, ibdev.dev); -- struct qib_devdata *dd = dd_from_dev(dev); -- int idx, count; -- -- /* force consistency with actual EEPROM */ -- if (qib_update_eeprom_log(dd) != 0) -- return -ENXIO; -- -- count = 0; -- for (idx = 0; idx < QIB_EEP_LOG_CNT; ++idx) { -- count += scnprintf(buf + count, PAGE_SIZE - count, "%d%c", -- dd->eep_st_errs[idx], -- idx == (QIB_EEP_LOG_CNT - 1) ? '\n' : ' '); -- } -- -- return count; --} -- - /* - * Dump tempsense regs. in decimal, to ease shell-scripts. - */ -@@ -679,7 +657,6 @@ static DEVICE_ATTR(nctxts, S_IRUGO, show_nctxts, NULL); - static DEVICE_ATTR(nfreectxts, S_IRUGO, show_nfreectxts, NULL); - static DEVICE_ATTR(serial, S_IRUGO, show_serial, NULL); - static DEVICE_ATTR(boardversion, S_IRUGO, show_boardversion, NULL); --static DEVICE_ATTR(logged_errors, S_IRUGO, show_logged_errs, NULL); - static DEVICE_ATTR(tempsense, S_IRUGO, show_tempsense, NULL); - static DEVICE_ATTR(localbus_info, S_IRUGO, show_localbus_info, NULL); - static DEVICE_ATTR(chip_reset, S_IWUSR, NULL, store_chip_reset); -@@ -693,7 +670,6 @@ static struct device_attribute *qib_attributes[] = { - &dev_attr_nfreectxts, - &dev_attr_serial, - &dev_attr_boardversion, -- &dev_attr_logged_errors, - &dev_attr_tempsense, - &dev_attr_localbus_info, - &dev_attr_chip_reset, -diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c -index 05f371df6c40..d4b0a31ab66b 100644 ---- a/drivers/input/tablet/wacom_wac.c -+++ b/drivers/input/tablet/wacom_wac.c -@@ -700,6 +700,12 @@ static int wacom_intuos_irq(struct wacom_wac *wacom) - input_report_key(input, BTN_7, (data[4] & 0x40)); /* Left */ - input_report_key(input, BTN_8, (data[4] & 0x80)); /* Down */ - input_report_key(input, BTN_0, (data[3] & 0x01)); /* Center */ -+ -+ if (data[4] | (data[3] & 0x01)) { -+ input_report_abs(input, ABS_MISC, PAD_DEVICE_ID); -+ } else { -+ input_report_abs(input, ABS_MISC, 0); -+ } - } else if (features->type >= INTUOS5S && features->type <= INTUOSPL) { - int i; - -diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c -index db404a0f7e2c..d2a8d64f8526 100644 ---- a/drivers/md/dm-io.c -+++ b/drivers/md/dm-io.c -@@ -292,6 +292,12 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where, - unsigned short logical_block_size = queue_logical_block_size(q); - sector_t num_sectors; - -+ /* Reject unsupported discard requests */ -+ if ((rw & REQ_DISCARD) && !blk_queue_discard(q)) { -+ dec_count(io, region, -EOPNOTSUPP); -+ return; -+ } -+ - /* - * where->count may be zero if rw holds a flush and we need to - * send a zero-sized flush. -diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c -index 7dfdb5c746d6..089d62751f7f 100644 ---- a/drivers/md/dm-raid1.c -+++ b/drivers/md/dm-raid1.c -@@ -604,6 +604,15 @@ static void write_callback(unsigned long error, void *context) - return; - } - -+ /* -+ * If the bio is discard, return an error, but do not -+ * degrade the array. -+ */ -+ if (bio->bi_rw & REQ_DISCARD) { -+ bio_endio(bio, -EOPNOTSUPP); -+ return; -+ } -+ - for (i = 0; i < ms->nr_mirrors; i++) - if (test_bit(i, &error)) - fail_mirror(ms->mirror + i, DM_RAID1_WRITE_ERROR); -diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c -index ebddef5237e4..c356a10b9ba5 100644 ---- a/drivers/md/dm-snap.c -+++ b/drivers/md/dm-snap.c -@@ -1440,8 +1440,6 @@ out: - full_bio->bi_private = pe->full_bio_private; - atomic_inc(&full_bio->bi_remaining); - } -- free_pending_exception(pe); -- - increment_pending_exceptions_done_count(); - - up_write(&s->lock); -@@ -1458,6 +1456,8 @@ out: - } - - retry_origin_bios(s, origin_bios); -+ -+ free_pending_exception(pe); - } - - static void commit_callback(void *context, int success) -diff --git a/drivers/md/dm.c b/drivers/md/dm.c -index 65ee3a0d4683..1582c3dac3ac 100644 ---- a/drivers/md/dm.c -+++ b/drivers/md/dm.c -@@ -2288,7 +2288,7 @@ int dm_setup_md_queue(struct mapped_device *md) - return 0; - } - --static struct mapped_device *dm_find_md(dev_t dev) -+struct mapped_device *dm_get_md(dev_t dev) - { - struct mapped_device *md; - unsigned minor = MINOR(dev); -@@ -2299,12 +2299,15 @@ static struct mapped_device *dm_find_md(dev_t dev) - spin_lock(&_minor_lock); - - md = idr_find(&_minor_idr, minor); -- if (md && (md == MINOR_ALLOCED || -- (MINOR(disk_devt(dm_disk(md))) != minor) || -- dm_deleting_md(md) || -- test_bit(DMF_FREEING, &md->flags))) { -- md = NULL; -- goto out; -+ if (md) { -+ if ((md == MINOR_ALLOCED || -+ (MINOR(disk_devt(dm_disk(md))) != minor) || -+ dm_deleting_md(md) || -+ test_bit(DMF_FREEING, &md->flags))) { -+ md = NULL; -+ goto out; -+ } -+ dm_get(md); - } - - out: -@@ -2312,16 +2315,6 @@ out: - - return md; - } -- --struct mapped_device *dm_get_md(dev_t dev) --{ -- struct mapped_device *md = dm_find_md(dev); -- -- if (md) -- dm_get(md); -- -- return md; --} - EXPORT_SYMBOL_GPL(dm_get_md); - - void *dm_get_mdptr(struct mapped_device *md) -diff --git a/drivers/misc/mei/init.c b/drivers/misc/mei/init.c -index cdd31c2a2a2b..b2965382d0ec 100644 ---- a/drivers/misc/mei/init.c -+++ b/drivers/misc/mei/init.c -@@ -275,6 +275,8 @@ void mei_stop(struct mei_device *dev) - - dev->dev_state = MEI_DEV_POWER_DOWN; - mei_reset(dev); -+ /* move device to disabled state unconditionally */ -+ dev->dev_state = MEI_DEV_DISABLED; - - mutex_unlock(&dev->device_lock); - -diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c -index 07c942b6ae01..e8c21f911b6f 100644 ---- a/drivers/net/macvtap.c -+++ b/drivers/net/macvtap.c -@@ -637,12 +637,15 @@ static void macvtap_skb_to_vnet_hdr(const struct sk_buff *skb, - } /* else everything is zero */ - } - -+/* Neighbour code has some assumptions on HH_DATA_MOD alignment */ -+#define MACVTAP_RESERVE HH_DATA_OFF(ETH_HLEN) -+ - /* Get packet from user space buffer */ - static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m, - const struct iovec *iv, unsigned long total_len, - size_t count, int noblock) - { -- int good_linear = SKB_MAX_HEAD(NET_IP_ALIGN); -+ int good_linear = SKB_MAX_HEAD(MACVTAP_RESERVE); - struct sk_buff *skb; - struct macvlan_dev *vlan; - unsigned long len = total_len; -@@ -701,7 +704,7 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m, - linear = vnet_hdr.hdr_len; - } - -- skb = macvtap_alloc_skb(&q->sk, NET_IP_ALIGN, copylen, -+ skb = macvtap_alloc_skb(&q->sk, MACVTAP_RESERVE, copylen, - linear, noblock, &err); - if (!skb) - goto err; -diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c -index 76d96b9ebcdb..1d568788c3e3 100644 ---- a/drivers/net/phy/phy.c -+++ b/drivers/net/phy/phy.c -@@ -194,6 +194,25 @@ static inline unsigned int phy_find_valid(unsigned int idx, u32 features) - } - - /** -+ * phy_check_valid - check if there is a valid PHY setting which matches -+ * speed, duplex, and feature mask -+ * @speed: speed to match -+ * @duplex: duplex to match -+ * @features: A mask of the valid settings -+ * -+ * Description: Returns true if there is a valid setting, false otherwise. -+ */ -+static inline bool phy_check_valid(int speed, int duplex, u32 features) -+{ -+ unsigned int idx; -+ -+ idx = phy_find_valid(phy_find_setting(speed, duplex), features); -+ -+ return settings[idx].speed == speed && settings[idx].duplex == duplex && -+ (settings[idx].setting & features); -+} -+ -+/** - * phy_sanitize_settings - make sure the PHY is set to supported speed and duplex - * @phydev: the target phy_device struct - * -@@ -955,7 +974,6 @@ int phy_init_eee(struct phy_device *phydev, bool clk_stop_enable) - int eee_lp, eee_cap, eee_adv; - u32 lp, cap, adv; - int status; -- unsigned int idx; - - /* Read phy status to properly get the right settings */ - status = phy_read_status(phydev); -@@ -987,8 +1005,7 @@ int phy_init_eee(struct phy_device *phydev, bool clk_stop_enable) - - adv = mmd_eee_adv_to_ethtool_adv_t(eee_adv); - lp = mmd_eee_adv_to_ethtool_adv_t(eee_lp); -- idx = phy_find_setting(phydev->speed, phydev->duplex); -- if (!(lp & adv & settings[idx].setting)) -+ if (!phy_check_valid(phydev->speed, phydev->duplex, lp & adv)) - return -EPROTONOSUPPORT; - - if (clk_stop_enable) { -diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c -index 32efe8371ff8..c28e2dafb3f0 100644 ---- a/drivers/net/team/team.c -+++ b/drivers/net/team/team.c -@@ -42,9 +42,7 @@ - - static struct team_port *team_port_get_rcu(const struct net_device *dev) - { -- struct team_port *port = rcu_dereference(dev->rx_handler_data); -- -- return team_port_exists(dev) ? port : NULL; -+ return rcu_dereference(dev->rx_handler_data); - } - - static struct team_port *team_port_get_rtnl(const struct net_device *dev) -@@ -1725,11 +1723,11 @@ static int team_set_mac_address(struct net_device *dev, void *p) - if (dev->type == ARPHRD_ETHER && !is_valid_ether_addr(addr->sa_data)) - return -EADDRNOTAVAIL; - memcpy(dev->dev_addr, addr->sa_data, dev->addr_len); -- rcu_read_lock(); -- list_for_each_entry_rcu(port, &team->port_list, list) -+ mutex_lock(&team->lock); -+ list_for_each_entry(port, &team->port_list, list) - if (team->ops.port_change_dev_addr) - team->ops.port_change_dev_addr(team, port); -- rcu_read_unlock(); -+ mutex_unlock(&team->lock); - return 0; - } - -diff --git a/drivers/net/usb/plusb.c b/drivers/net/usb/plusb.c -index 3d18bb0eee85..1bfe0fcaccf5 100644 ---- a/drivers/net/usb/plusb.c -+++ b/drivers/net/usb/plusb.c -@@ -134,6 +134,11 @@ static const struct usb_device_id products [] = { - }, { - USB_DEVICE(0x050d, 0x258a), /* Belkin F5U258/F5U279 (PL-25A1) */ - .driver_info = (unsigned long) &prolific_info, -+}, { -+ USB_DEVICE(0x3923, 0x7825), /* National Instruments USB -+ * Host-to-Host Cable -+ */ -+ .driver_info = (unsigned long) &prolific_info, - }, - - { }, // END -diff --git a/drivers/net/wireless/ath/ath5k/reset.c b/drivers/net/wireless/ath/ath5k/reset.c -index a3399c4f13a9..b9b651ea9851 100644 ---- a/drivers/net/wireless/ath/ath5k/reset.c -+++ b/drivers/net/wireless/ath/ath5k/reset.c -@@ -478,7 +478,7 @@ ath5k_hw_wisoc_reset(struct ath5k_hw *ah, u32 flags) - regval = ioread32(reg); - iowrite32(regval | val, reg); - regval = ioread32(reg); -- usleep_range(100, 150); -+ udelay(100); /* NB: should be atomic */ - - /* Bring BB/MAC out of reset */ - iowrite32(regval & ~val, reg); -diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c -index 5642a9b250c2..953bd0bfdf0d 100644 ---- a/drivers/scsi/be2iscsi/be_main.c -+++ b/drivers/scsi/be2iscsi/be_main.c -@@ -581,7 +581,6 @@ static struct beiscsi_hba *beiscsi_hba_alloc(struct pci_dev *pcidev) - "beiscsi_hba_alloc - iscsi_host_alloc failed\n"); - return NULL; - } -- shost->dma_boundary = pcidev->dma_mask; - shost->max_id = BE2_MAX_SESSIONS; - shost->max_channel = 0; - shost->max_cmd_len = BEISCSI_MAX_CMD_LEN; -diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c -index df5e961484e1..eb81c98386b9 100644 ---- a/drivers/scsi/sg.c -+++ b/drivers/scsi/sg.c -@@ -522,7 +522,7 @@ static ssize_t - sg_new_read(Sg_fd * sfp, char __user *buf, size_t count, Sg_request * srp) - { - sg_io_hdr_t *hp = &srp->header; -- int err = 0; -+ int err = 0, err2; - int len; - - if (count < SZ_SG_IO_HDR) { -@@ -551,8 +551,8 @@ sg_new_read(Sg_fd * sfp, char __user *buf, size_t count, Sg_request * srp) - goto err_out; - } - err_out: -- err = sg_finish_rem_req(srp); -- return (0 == err) ? count : err; -+ err2 = sg_finish_rem_req(srp); -+ return err ? : err2 ? : count; - } - - static ssize_t -diff --git a/drivers/staging/comedi/comedi_compat32.c b/drivers/staging/comedi/comedi_compat32.c -index 1e9da405d833..528781049ad5 100644 ---- a/drivers/staging/comedi/comedi_compat32.c -+++ b/drivers/staging/comedi/comedi_compat32.c -@@ -262,7 +262,7 @@ static int compat_cmd(struct file *file, unsigned long arg) - { - struct comedi_cmd __user *cmd; - struct comedi32_cmd_struct __user *cmd32; -- int rc; -+ int rc, err; - - cmd32 = compat_ptr(arg); - cmd = compat_alloc_user_space(sizeof(*cmd)); -@@ -271,7 +271,15 @@ static int compat_cmd(struct file *file, unsigned long arg) - if (rc) - return rc; - -- return translated_ioctl(file, COMEDI_CMD, (unsigned long)cmd); -+ rc = translated_ioctl(file, COMEDI_CMD, (unsigned long)cmd); -+ if (rc == -EAGAIN) { -+ /* Special case: copy cmd back to user. */ -+ err = put_compat_cmd(cmd32, cmd); -+ if (err) -+ rc = err; -+ } -+ -+ return rc; - } - - /* Handle 32-bit COMEDI_CMDTEST ioctl. */ -diff --git a/drivers/staging/comedi/drivers/cb_pcidas64.c b/drivers/staging/comedi/drivers/cb_pcidas64.c -index 4fff1738e3f8..3d1cb5b0a956 100644 ---- a/drivers/staging/comedi/drivers/cb_pcidas64.c -+++ b/drivers/staging/comedi/drivers/cb_pcidas64.c -@@ -441,6 +441,29 @@ static const struct comedi_lrange ai_ranges_64xx = { - } - }; - -+static const uint8_t ai_range_code_64xx[8] = { -+ 0x0, 0x1, 0x2, 0x3, /* bipolar 10, 5, 2,5, 1.25 */ -+ 0x8, 0x9, 0xa, 0xb /* unipolar 10, 5, 2.5, 1.25 */ -+}; -+ -+/* analog input ranges for 64-Mx boards */ -+static const struct comedi_lrange ai_ranges_64_mx = { -+ 7, { -+ BIP_RANGE(5), -+ BIP_RANGE(2.5), -+ BIP_RANGE(1.25), -+ BIP_RANGE(0.625), -+ UNI_RANGE(5), -+ UNI_RANGE(2.5), -+ UNI_RANGE(1.25) -+ } -+}; -+ -+static const uint8_t ai_range_code_64_mx[7] = { -+ 0x0, 0x1, 0x2, 0x3, /* bipolar 5, 2.5, 1.25, 0.625 */ -+ 0x9, 0xa, 0xb /* unipolar 5, 2.5, 1.25 */ -+}; -+ - /* analog input ranges for 60xx boards */ - static const struct comedi_lrange ai_ranges_60xx = { - 4, { -@@ -451,6 +474,10 @@ static const struct comedi_lrange ai_ranges_60xx = { - } - }; - -+static const uint8_t ai_range_code_60xx[4] = { -+ 0x0, 0x1, 0x4, 0x7 /* bipolar 10, 5, 0.5, 0.05 */ -+}; -+ - /* analog input ranges for 6030, etc boards */ - static const struct comedi_lrange ai_ranges_6030 = { - 14, { -@@ -471,6 +498,11 @@ static const struct comedi_lrange ai_ranges_6030 = { - } - }; - -+static const uint8_t ai_range_code_6030[14] = { -+ 0x0, 0x1, 0x2, 0x3, 0x4, 0x5, 0x6, /* bip 10, 5, 2, 1, 0.5, 0.2, 0.1 */ -+ 0x9, 0xa, 0xb, 0xc, 0xd, 0xe, 0xf /* uni 10, 5, 2, 1, 0.5, 0.2, 0.1 */ -+}; -+ - /* analog input ranges for 6052, etc boards */ - static const struct comedi_lrange ai_ranges_6052 = { - 15, { -@@ -492,6 +524,11 @@ static const struct comedi_lrange ai_ranges_6052 = { - } - }; - -+static const uint8_t ai_range_code_6052[15] = { -+ 0x0, 0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7, /* bipolar 10 ... 0.05 */ -+ 0x9, 0xa, 0xb, 0xc, 0xd, 0xe, 0xf /* unipolar 10 ... 0.1 */ -+}; -+ - /* analog input ranges for 4020 board */ - static const struct comedi_lrange ai_ranges_4020 = { - 2, { -@@ -595,6 +632,7 @@ struct pcidas64_board { - int ai_bits; /* analog input resolution */ - int ai_speed; /* fastest conversion period in ns */ - const struct comedi_lrange *ai_range_table; -+ const uint8_t *ai_range_code; - int ao_nchan; /* number of analog out channels */ - int ao_bits; /* analog output resolution */ - int ao_scan_speed; /* analog output scan speed */ -@@ -653,6 +691,7 @@ static const struct pcidas64_board pcidas64_boards[] = { - .ao_scan_speed = 10000, - .layout = LAYOUT_64XX, - .ai_range_table = &ai_ranges_64xx, -+ .ai_range_code = ai_range_code_64xx, - .ao_range_table = &ao_ranges_64xx, - .ao_range_code = ao_range_code_64xx, - .ai_fifo = &ai_fifo_64xx, -@@ -668,6 +707,7 @@ static const struct pcidas64_board pcidas64_boards[] = { - .ao_scan_speed = 10000, - .layout = LAYOUT_64XX, - .ai_range_table = &ai_ranges_64xx, -+ .ai_range_code = ai_range_code_64xx, - .ao_range_table = &ao_ranges_64xx, - .ao_range_code = ao_range_code_64xx, - .ai_fifo = &ai_fifo_64xx, -@@ -682,7 +722,8 @@ static const struct pcidas64_board pcidas64_boards[] = { - .ao_bits = 16, - .ao_scan_speed = 10000, - .layout = LAYOUT_64XX, -- .ai_range_table = &ai_ranges_64xx, -+ .ai_range_table = &ai_ranges_64_mx, -+ .ai_range_code = ai_range_code_64_mx, - .ao_range_table = &ao_ranges_64xx, - .ao_range_code = ao_range_code_64xx, - .ai_fifo = &ai_fifo_64xx, -@@ -697,7 +738,8 @@ static const struct pcidas64_board pcidas64_boards[] = { - .ao_bits = 16, - .ao_scan_speed = 10000, - .layout = LAYOUT_64XX, -- .ai_range_table = &ai_ranges_64xx, -+ .ai_range_table = &ai_ranges_64_mx, -+ .ai_range_code = ai_range_code_64_mx, - .ao_range_table = &ao_ranges_64xx, - .ao_range_code = ao_range_code_64xx, - .ai_fifo = &ai_fifo_64xx, -@@ -712,7 +754,8 @@ static const struct pcidas64_board pcidas64_boards[] = { - .ao_bits = 16, - .ao_scan_speed = 10000, - .layout = LAYOUT_64XX, -- .ai_range_table = &ai_ranges_64xx, -+ .ai_range_table = &ai_ranges_64_mx, -+ .ai_range_code = ai_range_code_64_mx, - .ao_range_table = &ao_ranges_64xx, - .ao_range_code = ao_range_code_64xx, - .ai_fifo = &ai_fifo_64xx, -@@ -727,6 +770,7 @@ static const struct pcidas64_board pcidas64_boards[] = { - .ao_bits = 16, - .layout = LAYOUT_60XX, - .ai_range_table = &ai_ranges_60xx, -+ .ai_range_code = ai_range_code_60xx, - .ao_range_table = &range_bipolar10, - .ao_range_code = ao_range_code_60xx, - .ai_fifo = &ai_fifo_60xx, -@@ -742,6 +786,7 @@ static const struct pcidas64_board pcidas64_boards[] = { - .ao_scan_speed = 100000, - .layout = LAYOUT_60XX, - .ai_range_table = &ai_ranges_60xx, -+ .ai_range_code = ai_range_code_60xx, - .ao_range_table = &range_bipolar10, - .ao_range_code = ao_range_code_60xx, - .ai_fifo = &ai_fifo_60xx, -@@ -756,6 +801,7 @@ static const struct pcidas64_board pcidas64_boards[] = { - .ao_scan_speed = 100000, - .layout = LAYOUT_60XX, - .ai_range_table = &ai_ranges_60xx, -+ .ai_range_code = ai_range_code_60xx, - .ao_range_table = &range_bipolar10, - .ao_range_code = ao_range_code_60xx, - .ai_fifo = &ai_fifo_60xx, -@@ -771,6 +817,7 @@ static const struct pcidas64_board pcidas64_boards[] = { - .ao_scan_speed = 100000, - .layout = LAYOUT_60XX, - .ai_range_table = &ai_ranges_60xx, -+ .ai_range_code = ai_range_code_60xx, - .ao_range_table = &range_bipolar10, - .ao_range_code = ao_range_code_60xx, - .ai_fifo = &ai_fifo_60xx, -@@ -786,6 +833,7 @@ static const struct pcidas64_board pcidas64_boards[] = { - .ao_scan_speed = 10000, - .layout = LAYOUT_60XX, - .ai_range_table = &ai_ranges_6030, -+ .ai_range_code = ai_range_code_6030, - .ao_range_table = &ao_ranges_6030, - .ao_range_code = ao_range_code_6030, - .ai_fifo = &ai_fifo_60xx, -@@ -801,6 +849,7 @@ static const struct pcidas64_board pcidas64_boards[] = { - .ao_scan_speed = 10000, - .layout = LAYOUT_60XX, - .ai_range_table = &ai_ranges_6030, -+ .ai_range_code = ai_range_code_6030, - .ao_range_table = &ao_ranges_6030, - .ao_range_code = ao_range_code_6030, - .ai_fifo = &ai_fifo_60xx, -@@ -814,6 +863,7 @@ static const struct pcidas64_board pcidas64_boards[] = { - .ao_nchan = 0, - .layout = LAYOUT_60XX, - .ai_range_table = &ai_ranges_6030, -+ .ai_range_code = ai_range_code_6030, - .ai_fifo = &ai_fifo_60xx, - .has_8255 = 0, - }, -@@ -825,6 +875,7 @@ static const struct pcidas64_board pcidas64_boards[] = { - .ao_nchan = 0, - .layout = LAYOUT_60XX, - .ai_range_table = &ai_ranges_6030, -+ .ai_range_code = ai_range_code_6030, - .ai_fifo = &ai_fifo_60xx, - .has_8255 = 0, - }, -@@ -837,6 +888,7 @@ static const struct pcidas64_board pcidas64_boards[] = { - .ao_scan_speed = 0, - .layout = LAYOUT_60XX, - .ai_range_table = &ai_ranges_60xx, -+ .ai_range_code = ai_range_code_60xx, - .ai_fifo = &ai_fifo_60xx, - .has_8255 = 0, - }, -@@ -850,6 +902,7 @@ static const struct pcidas64_board pcidas64_boards[] = { - .ao_scan_speed = 100000, - .layout = LAYOUT_60XX, - .ai_range_table = &ai_ranges_60xx, -+ .ai_range_code = ai_range_code_60xx, - .ao_range_table = &range_bipolar10, - .ao_range_code = ao_range_code_60xx, - .ai_fifo = &ai_fifo_60xx, -@@ -865,6 +918,7 @@ static const struct pcidas64_board pcidas64_boards[] = { - .ao_scan_speed = 100000, - .layout = LAYOUT_60XX, - .ai_range_table = &ai_ranges_60xx, -+ .ai_range_code = ai_range_code_60xx, - .ao_range_table = &range_bipolar10, - .ao_range_code = ao_range_code_60xx, - .ai_fifo = &ai_fifo_60xx, -@@ -880,6 +934,7 @@ static const struct pcidas64_board pcidas64_boards[] = { - .ao_scan_speed = 1000, - .layout = LAYOUT_60XX, - .ai_range_table = &ai_ranges_6052, -+ .ai_range_code = ai_range_code_6052, - .ao_range_table = &ao_ranges_6030, - .ao_range_code = ao_range_code_6030, - .ai_fifo = &ai_fifo_60xx, -@@ -895,6 +950,7 @@ static const struct pcidas64_board pcidas64_boards[] = { - .ao_scan_speed = 3333, - .layout = LAYOUT_60XX, - .ai_range_table = &ai_ranges_6052, -+ .ai_range_code = ai_range_code_6052, - .ao_range_table = &ao_ranges_6030, - .ao_range_code = ao_range_code_6030, - .ai_fifo = &ai_fifo_60xx, -@@ -910,6 +966,7 @@ static const struct pcidas64_board pcidas64_boards[] = { - .ao_scan_speed = 1000, - .layout = LAYOUT_60XX, - .ai_range_table = &ai_ranges_6052, -+ .ai_range_code = ai_range_code_6052, - .ao_range_table = &ao_ranges_6030, - .ao_range_code = ao_range_code_6030, - .ai_fifo = &ai_fifo_60xx, -@@ -925,6 +982,7 @@ static const struct pcidas64_board pcidas64_boards[] = { - .ao_scan_speed = 1000, - .layout = LAYOUT_60XX, - .ai_range_table = &ai_ranges_6052, -+ .ai_range_code = ai_range_code_6052, - .ao_range_table = &ao_ranges_6030, - .ao_range_code = ao_range_code_6030, - .ai_fifo = &ai_fifo_60xx, -@@ -959,6 +1017,7 @@ static const struct pcidas64_board pcidas64_boards[] = { - .ao_scan_speed = 10000, - .layout = LAYOUT_64XX, - .ai_range_table = &ai_ranges_64xx, -+ .ai_range_code = ai_range_code_64xx, - .ai_fifo = ai_fifo_64xx, - .has_8255 = 1, - }, -@@ -970,7 +1029,8 @@ static const struct pcidas64_board pcidas64_boards[] = { - .ao_nchan = 0, - .ao_scan_speed = 10000, - .layout = LAYOUT_64XX, -- .ai_range_table = &ai_ranges_64xx, -+ .ai_range_table = &ai_ranges_64_mx, -+ .ai_range_code = ai_range_code_64_mx, - .ai_fifo = ai_fifo_64xx, - .has_8255 = 1, - }, -@@ -982,7 +1042,8 @@ static const struct pcidas64_board pcidas64_boards[] = { - .ao_nchan = 0, - .ao_scan_speed = 10000, - .layout = LAYOUT_64XX, -- .ai_range_table = &ai_ranges_64xx, -+ .ai_range_table = &ai_ranges_64_mx, -+ .ai_range_code = ai_range_code_64_mx, - .ai_fifo = ai_fifo_64xx, - .has_8255 = 1, - }, -@@ -994,7 +1055,8 @@ static const struct pcidas64_board pcidas64_boards[] = { - .ao_nchan = 0, - .ao_scan_speed = 10000, - .layout = LAYOUT_64XX, -- .ai_range_table = &ai_ranges_64xx, -+ .ai_range_table = &ai_ranges_64_mx, -+ .ai_range_code = ai_range_code_64_mx, - .ai_fifo = ai_fifo_64xx, - .has_8255 = 1, - }, -@@ -1006,7 +1068,8 @@ static const struct pcidas64_board pcidas64_boards[] = { - .ao_nchan = 2, - .ao_scan_speed = 10000, - .layout = LAYOUT_64XX, -- .ai_range_table = &ai_ranges_64xx, -+ .ai_range_table = &ai_ranges_64_mx, -+ .ai_range_code = ai_range_code_64_mx, - .ai_fifo = ai_fifo_64xx, - .has_8255 = 1, - }, -@@ -1018,7 +1081,8 @@ static const struct pcidas64_board pcidas64_boards[] = { - .ao_nchan = 2, - .ao_scan_speed = 10000, - .layout = LAYOUT_64XX, -- .ai_range_table = &ai_ranges_64xx, -+ .ai_range_table = &ai_ranges_64_mx, -+ .ai_range_code = ai_range_code_64_mx, - .ai_fifo = ai_fifo_64xx, - .has_8255 = 1, - }, -@@ -1030,7 +1094,8 @@ static const struct pcidas64_board pcidas64_boards[] = { - .ao_nchan = 2, - .ao_scan_speed = 10000, - .layout = LAYOUT_64XX, -- .ai_range_table = &ai_ranges_64xx, -+ .ai_range_table = &ai_ranges_64_mx, -+ .ai_range_code = ai_range_code_64_mx, - .ai_fifo = ai_fifo_64xx, - .has_8255 = 1, - }, -@@ -1127,45 +1192,8 @@ static unsigned int ai_range_bits_6xxx(const struct comedi_device *dev, - unsigned int range_index) - { - const struct pcidas64_board *thisboard = comedi_board(dev); -- const struct comedi_krange *range = -- &thisboard->ai_range_table->range[range_index]; -- unsigned int bits = 0; - -- switch (range->max) { -- case 10000000: -- bits = 0x000; -- break; -- case 5000000: -- bits = 0x100; -- break; -- case 2000000: -- case 2500000: -- bits = 0x200; -- break; -- case 1000000: -- case 1250000: -- bits = 0x300; -- break; -- case 500000: -- bits = 0x400; -- break; -- case 200000: -- case 250000: -- bits = 0x500; -- break; -- case 100000: -- bits = 0x600; -- break; -- case 50000: -- bits = 0x700; -- break; -- default: -- comedi_error(dev, "bug! in ai_range_bits_6xxx"); -- break; -- } -- if (range->min == 0) -- bits += 0x900; -- return bits; -+ return thisboard->ai_range_code[range_index] << 8; - } - - static unsigned int hw_revision(const struct comedi_device *dev, -diff --git a/drivers/staging/iio/adc/mxs-lradc.c b/drivers/staging/iio/adc/mxs-lradc.c -index 9ec1df9cff95..be89260c23a6 100644 ---- a/drivers/staging/iio/adc/mxs-lradc.c -+++ b/drivers/staging/iio/adc/mxs-lradc.c -@@ -214,11 +214,17 @@ struct mxs_lradc { - unsigned long is_divided; - - /* -- * Touchscreen LRADC channels receives a private slot in the CTRL4 -- * register, the slot #7. Therefore only 7 slots instead of 8 in the -- * CTRL4 register can be mapped to LRADC channels when using the -- * touchscreen. -- * -+ * When the touchscreen is enabled, we give it two private virtual -+ * channels: #6 and #7. This means that only 6 virtual channels (instead -+ * of 8) will be available for buffered capture. -+ */ -+#define TOUCHSCREEN_VCHANNEL1 7 -+#define TOUCHSCREEN_VCHANNEL2 6 -+#define BUFFER_VCHANS_LIMITED 0x3f -+#define BUFFER_VCHANS_ALL 0xff -+ u8 buffer_vchans; -+ -+ /* - * Furthermore, certain LRADC channels are shared between touchscreen - * and/or touch-buttons and generic LRADC block. Therefore when using - * either of these, these channels are not available for the regular -@@ -342,6 +348,9 @@ struct mxs_lradc { - #define LRADC_CTRL4 0x140 - #define LRADC_CTRL4_LRADCSELECT_MASK(n) (0xf << ((n) * 4)) - #define LRADC_CTRL4_LRADCSELECT_OFFSET(n) ((n) * 4) -+#define LRADC_CTRL4_LRADCSELECT(n, x) \ -+ (((x) << LRADC_CTRL4_LRADCSELECT_OFFSET(n)) & \ -+ LRADC_CTRL4_LRADCSELECT_MASK(n)) - - #define LRADC_RESOLUTION 12 - #define LRADC_SINGLE_SAMPLE_MASK ((1 << LRADC_RESOLUTION) - 1) -@@ -423,6 +432,14 @@ static bool mxs_lradc_check_touch_event(struct mxs_lradc *lradc) - LRADC_STATUS_TOUCH_DETECT_RAW); - } - -+static void mxs_lradc_map_channel(struct mxs_lradc *lradc, unsigned vch, -+ unsigned ch) -+{ -+ mxs_lradc_reg_clear(lradc, LRADC_CTRL4_LRADCSELECT_MASK(vch), -+ LRADC_CTRL4); -+ mxs_lradc_reg_set(lradc, LRADC_CTRL4_LRADCSELECT(vch, ch), LRADC_CTRL4); -+} -+ - static void mxs_lradc_setup_ts_channel(struct mxs_lradc *lradc, unsigned ch) - { - /* -@@ -450,12 +467,8 @@ static void mxs_lradc_setup_ts_channel(struct mxs_lradc *lradc, unsigned ch) - LRADC_DELAY_DELAY(lradc->over_sample_delay - 1), - LRADC_DELAY(3)); - -- mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ(2) | -- LRADC_CTRL1_LRADC_IRQ(3) | LRADC_CTRL1_LRADC_IRQ(4) | -- LRADC_CTRL1_LRADC_IRQ(5), LRADC_CTRL1); -+ mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ(ch), LRADC_CTRL1); - -- /* wake us again, when the complete conversion is done */ -- mxs_lradc_reg_set(lradc, LRADC_CTRL1_LRADC_IRQ_EN(ch), LRADC_CTRL1); - /* - * after changing the touchscreen plates setting - * the signals need some initial time to settle. Start the -@@ -508,12 +521,8 @@ static void mxs_lradc_setup_ts_pressure(struct mxs_lradc *lradc, unsigned ch1, - LRADC_DELAY_DELAY(lradc->over_sample_delay - 1), - LRADC_DELAY(3)); - -- mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ(2) | -- LRADC_CTRL1_LRADC_IRQ(3) | LRADC_CTRL1_LRADC_IRQ(4) | -- LRADC_CTRL1_LRADC_IRQ(5), LRADC_CTRL1); -+ mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ(ch2), LRADC_CTRL1); - -- /* wake us again, when the conversions are done */ -- mxs_lradc_reg_set(lradc, LRADC_CTRL1_LRADC_IRQ_EN(ch2), LRADC_CTRL1); - /* - * after changing the touchscreen plates setting - * the signals need some initial time to settle. Start the -@@ -578,36 +587,6 @@ static unsigned mxs_lradc_read_ts_pressure(struct mxs_lradc *lradc, - #define TS_CH_XM 4 - #define TS_CH_YM 5 - --static int mxs_lradc_read_ts_channel(struct mxs_lradc *lradc) --{ -- u32 reg; -- int val; -- -- reg = readl(lradc->base + LRADC_CTRL1); -- -- /* only channels 3 to 5 are of interest here */ -- if (reg & LRADC_CTRL1_LRADC_IRQ(TS_CH_YP)) { -- mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ_EN(TS_CH_YP) | -- LRADC_CTRL1_LRADC_IRQ(TS_CH_YP), LRADC_CTRL1); -- val = mxs_lradc_read_raw_channel(lradc, TS_CH_YP); -- } else if (reg & LRADC_CTRL1_LRADC_IRQ(TS_CH_XM)) { -- mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ_EN(TS_CH_XM) | -- LRADC_CTRL1_LRADC_IRQ(TS_CH_XM), LRADC_CTRL1); -- val = mxs_lradc_read_raw_channel(lradc, TS_CH_XM); -- } else if (reg & LRADC_CTRL1_LRADC_IRQ(TS_CH_YM)) { -- mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ_EN(TS_CH_YM) | -- LRADC_CTRL1_LRADC_IRQ(TS_CH_YM), LRADC_CTRL1); -- val = mxs_lradc_read_raw_channel(lradc, TS_CH_YM); -- } else { -- return -EIO; -- } -- -- mxs_lradc_reg_wrt(lradc, 0, LRADC_DELAY(2)); -- mxs_lradc_reg_wrt(lradc, 0, LRADC_DELAY(3)); -- -- return val; --} -- - /* - * YP(open)--+-------------+ - * | |--+ -@@ -651,7 +630,8 @@ static void mxs_lradc_prepare_x_pos(struct mxs_lradc *lradc) - mxs_lradc_reg_set(lradc, mxs_lradc_drive_x_plate(lradc), LRADC_CTRL0); - - lradc->cur_plate = LRADC_SAMPLE_X; -- mxs_lradc_setup_ts_channel(lradc, TS_CH_YP); -+ mxs_lradc_map_channel(lradc, TOUCHSCREEN_VCHANNEL1, TS_CH_YP); -+ mxs_lradc_setup_ts_channel(lradc, TOUCHSCREEN_VCHANNEL1); - } - - /* -@@ -672,7 +652,8 @@ static void mxs_lradc_prepare_y_pos(struct mxs_lradc *lradc) - mxs_lradc_reg_set(lradc, mxs_lradc_drive_y_plate(lradc), LRADC_CTRL0); - - lradc->cur_plate = LRADC_SAMPLE_Y; -- mxs_lradc_setup_ts_channel(lradc, TS_CH_XM); -+ mxs_lradc_map_channel(lradc, TOUCHSCREEN_VCHANNEL1, TS_CH_XM); -+ mxs_lradc_setup_ts_channel(lradc, TOUCHSCREEN_VCHANNEL1); - } - - /* -@@ -693,7 +674,10 @@ static void mxs_lradc_prepare_pressure(struct mxs_lradc *lradc) - mxs_lradc_reg_set(lradc, mxs_lradc_drive_pressure(lradc), LRADC_CTRL0); - - lradc->cur_plate = LRADC_SAMPLE_PRESSURE; -- mxs_lradc_setup_ts_pressure(lradc, TS_CH_XP, TS_CH_YM); -+ mxs_lradc_map_channel(lradc, TOUCHSCREEN_VCHANNEL1, TS_CH_YM); -+ mxs_lradc_map_channel(lradc, TOUCHSCREEN_VCHANNEL2, TS_CH_XP); -+ mxs_lradc_setup_ts_pressure(lradc, TOUCHSCREEN_VCHANNEL2, -+ TOUCHSCREEN_VCHANNEL1); - } - - static void mxs_lradc_enable_touch_detection(struct mxs_lradc *lradc) -@@ -706,6 +690,19 @@ static void mxs_lradc_enable_touch_detection(struct mxs_lradc *lradc) - mxs_lradc_reg_set(lradc, LRADC_CTRL1_TOUCH_DETECT_IRQ_EN, LRADC_CTRL1); - } - -+static void mxs_lradc_start_touch_event(struct mxs_lradc *lradc) -+{ -+ mxs_lradc_reg_clear(lradc, LRADC_CTRL1_TOUCH_DETECT_IRQ_EN, -+ LRADC_CTRL1); -+ mxs_lradc_reg_set(lradc, -+ LRADC_CTRL1_LRADC_IRQ_EN(TOUCHSCREEN_VCHANNEL1), LRADC_CTRL1); -+ /* -+ * start with the Y-pos, because it uses nearly the same plate -+ * settings like the touch detection -+ */ -+ mxs_lradc_prepare_y_pos(lradc); -+} -+ - static void mxs_lradc_report_ts_event(struct mxs_lradc *lradc) - { - input_report_abs(lradc->ts_input, ABS_X, lradc->ts_x_pos); -@@ -723,10 +720,12 @@ static void mxs_lradc_complete_touch_event(struct mxs_lradc *lradc) - * start a dummy conversion to burn time to settle the signals - * note: we are not interested in the conversion's value - */ -- mxs_lradc_reg_wrt(lradc, 0, LRADC_CH(5)); -- mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ(5), LRADC_CTRL1); -- mxs_lradc_reg_set(lradc, LRADC_CTRL1_LRADC_IRQ_EN(5), LRADC_CTRL1); -- mxs_lradc_reg_wrt(lradc, LRADC_DELAY_TRIGGER(1 << 5) | -+ mxs_lradc_reg_wrt(lradc, 0, LRADC_CH(TOUCHSCREEN_VCHANNEL1)); -+ mxs_lradc_reg_clear(lradc, -+ LRADC_CTRL1_LRADC_IRQ(TOUCHSCREEN_VCHANNEL1) | -+ LRADC_CTRL1_LRADC_IRQ(TOUCHSCREEN_VCHANNEL2), LRADC_CTRL1); -+ mxs_lradc_reg_wrt(lradc, -+ LRADC_DELAY_TRIGGER(1 << TOUCHSCREEN_VCHANNEL1) | - LRADC_DELAY_KICK | LRADC_DELAY_DELAY(10), /* waste 5 ms */ - LRADC_DELAY(2)); - } -@@ -758,59 +757,45 @@ static void mxs_lradc_finish_touch_event(struct mxs_lradc *lradc, bool valid) - - /* if it is released, wait for the next touch via IRQ */ - lradc->cur_plate = LRADC_TOUCH; -- mxs_lradc_reg_clear(lradc, LRADC_CTRL1_TOUCH_DETECT_IRQ, LRADC_CTRL1); -+ mxs_lradc_reg_wrt(lradc, 0, LRADC_DELAY(2)); -+ mxs_lradc_reg_wrt(lradc, 0, LRADC_DELAY(3)); -+ mxs_lradc_reg_clear(lradc, LRADC_CTRL1_TOUCH_DETECT_IRQ | -+ LRADC_CTRL1_LRADC_IRQ_EN(TOUCHSCREEN_VCHANNEL1) | -+ LRADC_CTRL1_LRADC_IRQ(TOUCHSCREEN_VCHANNEL1), LRADC_CTRL1); - mxs_lradc_reg_set(lradc, LRADC_CTRL1_TOUCH_DETECT_IRQ_EN, LRADC_CTRL1); - } - - /* touchscreen's state machine */ - static void mxs_lradc_handle_touch(struct mxs_lradc *lradc) - { -- int val; -- - switch (lradc->cur_plate) { - case LRADC_TOUCH: -- /* -- * start with the Y-pos, because it uses nearly the same plate -- * settings like the touch detection -- */ -- if (mxs_lradc_check_touch_event(lradc)) { -- mxs_lradc_reg_clear(lradc, -- LRADC_CTRL1_TOUCH_DETECT_IRQ_EN, -- LRADC_CTRL1); -- mxs_lradc_prepare_y_pos(lradc); -- } -+ if (mxs_lradc_check_touch_event(lradc)) -+ mxs_lradc_start_touch_event(lradc); - mxs_lradc_reg_clear(lradc, LRADC_CTRL1_TOUCH_DETECT_IRQ, - LRADC_CTRL1); - return; - - case LRADC_SAMPLE_Y: -- val = mxs_lradc_read_ts_channel(lradc); -- if (val < 0) { -- mxs_lradc_enable_touch_detection(lradc); /* re-start */ -- return; -- } -- lradc->ts_y_pos = val; -+ lradc->ts_y_pos = mxs_lradc_read_raw_channel(lradc, -+ TOUCHSCREEN_VCHANNEL1); - mxs_lradc_prepare_x_pos(lradc); - return; - - case LRADC_SAMPLE_X: -- val = mxs_lradc_read_ts_channel(lradc); -- if (val < 0) { -- mxs_lradc_enable_touch_detection(lradc); /* re-start */ -- return; -- } -- lradc->ts_x_pos = val; -+ lradc->ts_x_pos = mxs_lradc_read_raw_channel(lradc, -+ TOUCHSCREEN_VCHANNEL1); - mxs_lradc_prepare_pressure(lradc); - return; - - case LRADC_SAMPLE_PRESSURE: -- lradc->ts_pressure = -- mxs_lradc_read_ts_pressure(lradc, TS_CH_XP, TS_CH_YM); -+ lradc->ts_pressure = mxs_lradc_read_ts_pressure(lradc, -+ TOUCHSCREEN_VCHANNEL2, -+ TOUCHSCREEN_VCHANNEL1); - mxs_lradc_complete_touch_event(lradc); - return; - - case LRADC_SAMPLE_VALID: -- val = mxs_lradc_read_ts_channel(lradc); /* ignore the value */ - mxs_lradc_finish_touch_event(lradc, 1); - break; - } -@@ -842,9 +827,9 @@ static int mxs_lradc_read_single(struct iio_dev *iio_dev, int chan, int *val) - * used if doing raw sampling. - */ - if (lradc->soc == IMX28_LRADC) -- mxs_lradc_reg_clear(lradc, LRADC_CTRL1_MX28_LRADC_IRQ_EN_MASK, -+ mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ_EN(0), - LRADC_CTRL1); -- mxs_lradc_reg_clear(lradc, 0xff, LRADC_CTRL0); -+ mxs_lradc_reg_clear(lradc, 0x1, LRADC_CTRL0); - - /* Enable / disable the divider per requirement */ - if (test_bit(chan, &lradc->is_divided)) -@@ -1091,9 +1076,8 @@ static void mxs_lradc_disable_ts(struct mxs_lradc *lradc) - { - /* stop all interrupts from firing */ - mxs_lradc_reg_clear(lradc, LRADC_CTRL1_TOUCH_DETECT_IRQ_EN | -- LRADC_CTRL1_LRADC_IRQ_EN(2) | LRADC_CTRL1_LRADC_IRQ_EN(3) | -- LRADC_CTRL1_LRADC_IRQ_EN(4) | LRADC_CTRL1_LRADC_IRQ_EN(5), -- LRADC_CTRL1); -+ LRADC_CTRL1_LRADC_IRQ_EN(TOUCHSCREEN_VCHANNEL1) | -+ LRADC_CTRL1_LRADC_IRQ_EN(TOUCHSCREEN_VCHANNEL2), LRADC_CTRL1); - - /* Power-down touchscreen touch-detect circuitry. */ - mxs_lradc_reg_clear(lradc, mxs_lradc_plate_mask(lradc), LRADC_CTRL0); -@@ -1159,25 +1143,31 @@ static irqreturn_t mxs_lradc_handle_irq(int irq, void *data) - struct iio_dev *iio = data; - struct mxs_lradc *lradc = iio_priv(iio); - unsigned long reg = readl(lradc->base + LRADC_CTRL1); -+ uint32_t clr_irq = mxs_lradc_irq_mask(lradc); - const uint32_t ts_irq_mask = - LRADC_CTRL1_TOUCH_DETECT_IRQ | -- LRADC_CTRL1_LRADC_IRQ(2) | -- LRADC_CTRL1_LRADC_IRQ(3) | -- LRADC_CTRL1_LRADC_IRQ(4) | -- LRADC_CTRL1_LRADC_IRQ(5); -+ LRADC_CTRL1_LRADC_IRQ(TOUCHSCREEN_VCHANNEL1) | -+ LRADC_CTRL1_LRADC_IRQ(TOUCHSCREEN_VCHANNEL2); - - if (!(reg & mxs_lradc_irq_mask(lradc))) - return IRQ_NONE; - -- if (lradc->use_touchscreen && (reg & ts_irq_mask)) -+ if (lradc->use_touchscreen && (reg & ts_irq_mask)) { - mxs_lradc_handle_touch(lradc); -+ /* Make sure we don't clear the next conversion's interrupt. */ -+ clr_irq &= ~(LRADC_CTRL1_LRADC_IRQ(TOUCHSCREEN_VCHANNEL1) | -+ LRADC_CTRL1_LRADC_IRQ(TOUCHSCREEN_VCHANNEL2)); -+ } - - if (iio_buffer_enabled(iio)) -- iio_trigger_poll(iio->trig, iio_get_time_ns()); -- else if (reg & LRADC_CTRL1_LRADC_IRQ(0)) -+ if (iio_buffer_enabled(iio)) { -+ if (reg & lradc->buffer_vchans) -+ iio_trigger_poll(iio->trig, iio_get_time_ns()); -+ } else if (reg & LRADC_CTRL1_LRADC_IRQ(0)) { - complete(&lradc->completion); -+ } - -- mxs_lradc_reg_clear(lradc, reg & mxs_lradc_irq_mask(lradc), LRADC_CTRL1); -+ mxs_lradc_reg_clear(lradc, reg & clr_irq, LRADC_CTRL1); - - return IRQ_HANDLED; - } -@@ -1288,9 +1278,10 @@ static int mxs_lradc_buffer_preenable(struct iio_dev *iio) - } - - if (lradc->soc == IMX28_LRADC) -- mxs_lradc_reg_clear(lradc, LRADC_CTRL1_MX28_LRADC_IRQ_EN_MASK, -- LRADC_CTRL1); -- mxs_lradc_reg_clear(lradc, 0xff, LRADC_CTRL0); -+ mxs_lradc_reg_clear(lradc, -+ lradc->buffer_vchans << LRADC_CTRL1_LRADC_IRQ_EN_OFFSET, -+ LRADC_CTRL1); -+ mxs_lradc_reg_clear(lradc, lradc->buffer_vchans, LRADC_CTRL0); - - for_each_set_bit(chan, iio->active_scan_mask, LRADC_MAX_TOTAL_CHANS) { - ctrl4_set |= chan << LRADC_CTRL4_LRADCSELECT_OFFSET(ofs); -@@ -1323,10 +1314,11 @@ static int mxs_lradc_buffer_postdisable(struct iio_dev *iio) - mxs_lradc_reg_clear(lradc, LRADC_DELAY_TRIGGER_LRADCS_MASK | - LRADC_DELAY_KICK, LRADC_DELAY(0)); - -- mxs_lradc_reg_clear(lradc, 0xff, LRADC_CTRL0); -+ mxs_lradc_reg_clear(lradc, lradc->buffer_vchans, LRADC_CTRL0); - if (lradc->soc == IMX28_LRADC) -- mxs_lradc_reg_clear(lradc, LRADC_CTRL1_MX28_LRADC_IRQ_EN_MASK, -- LRADC_CTRL1); -+ mxs_lradc_reg_clear(lradc, -+ lradc->buffer_vchans << LRADC_CTRL1_LRADC_IRQ_EN_OFFSET, -+ LRADC_CTRL1); - - kfree(lradc->buffer); - mutex_unlock(&lradc->lock); -@@ -1352,7 +1344,7 @@ static bool mxs_lradc_validate_scan_mask(struct iio_dev *iio, - if (lradc->use_touchbutton) - rsvd_chans++; - if (lradc->use_touchscreen) -- rsvd_chans++; -+ rsvd_chans += 2; - - /* Test for attempts to map channels with special mode of operation. */ - if (bitmap_intersects(mask, &rsvd_mask, LRADC_MAX_TOTAL_CHANS)) -@@ -1412,6 +1404,13 @@ static const struct iio_chan_spec mxs_lradc_chan_spec[] = { - .channel = 8, - .scan_type = {.sign = 'u', .realbits = 18, .storagebits = 32,}, - }, -+ /* Hidden channel to keep indexes */ -+ { -+ .type = IIO_TEMP, -+ .indexed = 1, -+ .scan_index = -1, -+ .channel = 9, -+ }, - MXS_ADC_CHAN(10, IIO_VOLTAGE), /* VDDIO */ - MXS_ADC_CHAN(11, IIO_VOLTAGE), /* VTH */ - MXS_ADC_CHAN(12, IIO_VOLTAGE), /* VDDA */ -@@ -1563,6 +1562,11 @@ static int mxs_lradc_probe(struct platform_device *pdev) - - touch_ret = mxs_lradc_probe_touchscreen(lradc, node); - -+ if (touch_ret == 0) -+ lradc->buffer_vchans = BUFFER_VCHANS_LIMITED; -+ else -+ lradc->buffer_vchans = BUFFER_VCHANS_ALL; -+ - /* Grab all IRQ sources */ - for (i = 0; i < of_cfg->irq_count; i++) { - lradc->irq[i] = platform_get_irq(pdev, i); -diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c -index 1205dbd4f83d..0fccdcfd1015 100644 ---- a/drivers/target/target_core_pr.c -+++ b/drivers/target/target_core_pr.c -@@ -1877,8 +1877,8 @@ static int core_scsi3_update_aptpl_buf( - } - - if ((len + strlen(tmp) >= pr_aptpl_buf_len)) { -- pr_err("Unable to update renaming" -- " APTPL metadata\n"); -+ pr_err("Unable to update renaming APTPL metadata," -+ " reallocating larger buffer\n"); - ret = -EMSGSIZE; - goto out; - } -@@ -1895,8 +1895,8 @@ static int core_scsi3_update_aptpl_buf( - lun->lun_sep->sep_rtpi, lun->unpacked_lun, reg_count); - - if ((len + strlen(tmp) >= pr_aptpl_buf_len)) { -- pr_err("Unable to update renaming" -- " APTPL metadata\n"); -+ pr_err("Unable to update renaming APTPL metadata," -+ " reallocating larger buffer\n"); - ret = -EMSGSIZE; - goto out; - } -@@ -1959,7 +1959,7 @@ static int __core_scsi3_write_aptpl_to_file( - static sense_reason_t core_scsi3_update_and_write_aptpl(struct se_device *dev, bool aptpl) - { - unsigned char *buf; -- int rc; -+ int rc, len = PR_APTPL_BUF_LEN; - - if (!aptpl) { - char *null_buf = "No Registrations or Reservations\n"; -@@ -1973,25 +1973,26 @@ static sense_reason_t core_scsi3_update_and_write_aptpl(struct se_device *dev, b - - return 0; - } -- -- buf = kzalloc(PR_APTPL_BUF_LEN, GFP_KERNEL); -+retry: -+ buf = vzalloc(len); - if (!buf) - return TCM_OUT_OF_RESOURCES; - -- rc = core_scsi3_update_aptpl_buf(dev, buf, PR_APTPL_BUF_LEN); -+ rc = core_scsi3_update_aptpl_buf(dev, buf, len); - if (rc < 0) { -- kfree(buf); -- return TCM_OUT_OF_RESOURCES; -+ vfree(buf); -+ len *= 2; -+ goto retry; - } - - rc = __core_scsi3_write_aptpl_to_file(dev, buf); - if (rc != 0) { - pr_err("SPC-3 PR: Could not update APTPL\n"); -- kfree(buf); -+ vfree(buf); - return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE; - } - dev->t10_pr.pr_aptpl_active = 1; -- kfree(buf); -+ vfree(buf); - pr_debug("SPC-3 PR: Set APTPL Bit Activated\n"); - return 0; - } -diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c -index 5216acd68b4b..68511e83486b 100644 ---- a/drivers/target/target_core_sbc.c -+++ b/drivers/target/target_core_sbc.c -@@ -266,6 +266,8 @@ static inline unsigned long long transport_lba_64_ext(unsigned char *cdb) - static sense_reason_t - sbc_setup_write_same(struct se_cmd *cmd, unsigned char *flags, struct sbc_ops *ops) - { -+ struct se_device *dev = cmd->se_dev; -+ sector_t end_lba = dev->transport->get_blocks(dev) + 1; - unsigned int sectors = sbc_get_write_same_sectors(cmd); - - if ((flags[0] & 0x04) || (flags[0] & 0x02)) { -@@ -279,6 +281,16 @@ sbc_setup_write_same(struct se_cmd *cmd, unsigned char *flags, struct sbc_ops *o - sectors, cmd->se_dev->dev_attrib.max_write_same_len); - return TCM_INVALID_CDB_FIELD; - } -+ /* -+ * Sanity check for LBA wrap and request past end of device. -+ */ -+ if (((cmd->t_task_lba + sectors) < cmd->t_task_lba) || -+ ((cmd->t_task_lba + sectors) > end_lba)) { -+ pr_err("WRITE_SAME exceeds last lba %llu (lba %llu, sectors %u)\n", -+ (unsigned long long)end_lba, cmd->t_task_lba, sectors); -+ return TCM_ADDRESS_OUT_OF_RANGE; -+ } -+ - /* We always have ANC_SUP == 0 so setting ANCHOR is always an error */ - if (flags[0] & 0x10) { - pr_warn("WRITE SAME with ANCHOR not supported\n"); -@@ -911,7 +923,8 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops) - unsigned long long end_lba; - - end_lba = dev->transport->get_blocks(dev) + 1; -- if (cmd->t_task_lba + sectors > end_lba) { -+ if (((cmd->t_task_lba + sectors) < cmd->t_task_lba) || -+ ((cmd->t_task_lba + sectors) > end_lba)) { - pr_err("cmd exceeds last lba %llu " - "(lba %llu, sectors %u)\n", - end_lba, cmd->t_task_lba, sectors); -diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c -index 25d07412e08e..39988fa91294 100644 ---- a/drivers/tty/tty_io.c -+++ b/drivers/tty/tty_io.c -@@ -996,8 +996,8 @@ EXPORT_SYMBOL(start_tty); - /* We limit tty time update visibility to every 8 seconds or so. */ - static void tty_update_time(struct timespec *time) - { -- unsigned long sec = get_seconds() & ~7; -- if ((long)(sec - time->tv_sec) > 0) -+ unsigned long sec = get_seconds(); -+ if (abs(sec - time->tv_sec) & ~7) - time->tv_sec = sec; - } - -diff --git a/drivers/tty/tty_ioctl.c b/drivers/tty/tty_ioctl.c -index 6fd60fece6b4..22da05d27009 100644 ---- a/drivers/tty/tty_ioctl.c -+++ b/drivers/tty/tty_ioctl.c -@@ -217,11 +217,17 @@ void tty_wait_until_sent(struct tty_struct *tty, long timeout) - #endif - if (!timeout) - timeout = MAX_SCHEDULE_TIMEOUT; -+ - if (wait_event_interruptible_timeout(tty->write_wait, -- !tty_chars_in_buffer(tty), timeout) >= 0) { -- if (tty->ops->wait_until_sent) -- tty->ops->wait_until_sent(tty, timeout); -+ !tty_chars_in_buffer(tty), timeout) < 0) { -+ return; - } -+ -+ if (timeout == MAX_SCHEDULE_TIMEOUT) -+ timeout = 0; -+ -+ if (tty->ops->wait_until_sent) -+ tty->ops->wait_until_sent(tty, timeout); - } - EXPORT_SYMBOL(tty_wait_until_sent); - -diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c -index 9ca77166d37e..45b7b96f9ed3 100644 ---- a/drivers/usb/core/devio.c -+++ b/drivers/usb/core/devio.c -@@ -501,6 +501,7 @@ static void async_completed(struct urb *urb) - as->status = urb->status; - signr = as->signr; - if (signr) { -+ memset(&sinfo, 0, sizeof(sinfo)); - sinfo.si_signo = as->signr; - sinfo.si_errno = as->status; - sinfo.si_code = SI_ASYNCIO; -@@ -2227,6 +2228,7 @@ static void usbdev_remove(struct usb_device *udev) - wake_up_all(&ps->wait); - list_del_init(&ps->list); - if (ps->discsignr) { -+ memset(&sinfo, 0, sizeof(sinfo)); - sinfo.si_signo = ps->discsignr; - sinfo.si_errno = EPIPE; - sinfo.si_code = SI_ASYNCIO; -diff --git a/drivers/usb/dwc3/dwc3-omap.c b/drivers/usb/dwc3/dwc3-omap.c -index 2a6841c95b64..cfca302d3d88 100644 ---- a/drivers/usb/dwc3/dwc3-omap.c -+++ b/drivers/usb/dwc3/dwc3-omap.c -@@ -211,6 +211,18 @@ static void dwc3_omap_write_irq0_set(struct dwc3_omap *omap, u32 value) - omap->irq0_offset, value); - } - -+static void dwc3_omap_write_irqmisc_clr(struct dwc3_omap *omap, u32 value) -+{ -+ dwc3_omap_writel(omap->base, USBOTGSS_IRQENABLE_CLR_MISC + -+ omap->irqmisc_offset, value); -+} -+ -+static void dwc3_omap_write_irq0_clr(struct dwc3_omap *omap, u32 value) -+{ -+ dwc3_omap_writel(omap->base, USBOTGSS_IRQENABLE_CLR_0 - -+ omap->irq0_offset, value); -+} -+ - static void dwc3_omap_set_mailbox(struct dwc3_omap *omap, - enum omap_dwc3_vbus_id_status status) - { -@@ -351,9 +363,23 @@ static void dwc3_omap_enable_irqs(struct dwc3_omap *omap) - - static void dwc3_omap_disable_irqs(struct dwc3_omap *omap) - { -+ u32 reg; -+ - /* disable all IRQs */ -- dwc3_omap_write_irqmisc_set(omap, 0x00); -- dwc3_omap_write_irq0_set(omap, 0x00); -+ reg = USBOTGSS_IRQO_COREIRQ_ST; -+ dwc3_omap_write_irq0_clr(omap, reg); -+ -+ reg = (USBOTGSS_IRQMISC_OEVT | -+ USBOTGSS_IRQMISC_DRVVBUS_RISE | -+ USBOTGSS_IRQMISC_CHRGVBUS_RISE | -+ USBOTGSS_IRQMISC_DISCHRGVBUS_RISE | -+ USBOTGSS_IRQMISC_IDPULLUP_RISE | -+ USBOTGSS_IRQMISC_DRVVBUS_FALL | -+ USBOTGSS_IRQMISC_CHRGVBUS_FALL | -+ USBOTGSS_IRQMISC_DISCHRGVBUS_FALL | -+ USBOTGSS_IRQMISC_IDPULLUP_FALL); -+ -+ dwc3_omap_write_irqmisc_clr(omap, reg); - } - - static u64 dwc3_omap_dma_mask = DMA_BIT_MASK(32); -diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c -index faa8b98954d9..a95eee8ddc38 100644 ---- a/drivers/usb/host/xhci-ring.c -+++ b/drivers/usb/host/xhci-ring.c -@@ -2133,7 +2133,7 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td, - if (event_trb != ep_ring->dequeue) { - /* The event was for the status stage */ - if (event_trb == td->last_trb) { -- if (td->urb->actual_length != 0) { -+ if (td->urb_length_set) { - /* Don't overwrite a previously set error code - */ - if ((*status == -EINPROGRESS || *status == 0) && -@@ -2147,7 +2147,13 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td, - td->urb->transfer_buffer_length; - } - } else { -- /* Maybe the event was for the data stage? */ -+ /* -+ * Maybe the event was for the data stage? If so, update -+ * already the actual_length of the URB and flag it as -+ * set, so that it is not overwritten in the event for -+ * the last TRB. -+ */ -+ td->urb_length_set = true; - td->urb->actual_length = - td->urb->transfer_buffer_length - - EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)); -diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h -index 96e9e780ccae..7225dd242bfa 100644 ---- a/drivers/usb/host/xhci.h -+++ b/drivers/usb/host/xhci.h -@@ -1,3 +1,4 @@ -+ - /* - * xHCI host controller driver - * -@@ -88,9 +89,10 @@ struct xhci_cap_regs { - #define HCS_IST(p) (((p) >> 0) & 0xf) - /* bits 4:7, max number of Event Ring segments */ - #define HCS_ERST_MAX(p) (((p) >> 4) & 0xf) -+/* bits 21:25 Hi 5 bits of Scratchpad buffers SW must allocate for the HW */ - /* bit 26 Scratchpad restore - for save/restore HW state - not used yet */ --/* bits 27:31 number of Scratchpad buffers SW must allocate for the HW */ --#define HCS_MAX_SCRATCHPAD(p) (((p) >> 27) & 0x1f) -+/* bits 27:31 Lo 5 bits of Scratchpad buffers SW must allocate for the HW */ -+#define HCS_MAX_SCRATCHPAD(p) ((((p) >> 16) & 0x3e0) | (((p) >> 27) & 0x1f)) - - /* HCSPARAMS3 - hcs_params3 - bitmasks */ - /* bits 0:7, Max U1 to U0 latency for the roothub ports */ -@@ -1289,6 +1291,8 @@ struct xhci_td { - struct xhci_segment *start_seg; - union xhci_trb *first_trb; - union xhci_trb *last_trb; -+ /* actual_length of the URB has already been set */ -+ bool urb_length_set; - }; - - /* xHCI command default timeout value */ -diff --git a/drivers/usb/serial/bus.c b/drivers/usb/serial/bus.c -index 9374bd2aba20..6f91eb9ae81a 100644 ---- a/drivers/usb/serial/bus.c -+++ b/drivers/usb/serial/bus.c -@@ -51,6 +51,7 @@ static int usb_serial_device_probe(struct device *dev) - { - struct usb_serial_driver *driver; - struct usb_serial_port *port; -+ struct device *tty_dev; - int retval = 0; - int minor; - -@@ -75,12 +76,20 @@ static int usb_serial_device_probe(struct device *dev) - retval = device_create_file(dev, &dev_attr_port_number); - if (retval) { - if (driver->port_remove) -- retval = driver->port_remove(port); -+ driver->port_remove(port); - goto exit_with_autopm; - } - - minor = port->minor; -- tty_register_device(usb_serial_tty_driver, minor, dev); -+ tty_dev = tty_register_device(usb_serial_tty_driver, minor, dev); -+ if (IS_ERR(tty_dev)) { -+ retval = PTR_ERR(tty_dev); -+ device_remove_file(dev, &dev_attr_port_number); -+ if (driver->port_remove) -+ driver->port_remove(port); -+ goto exit_with_autopm; -+ } -+ - dev_info(&port->serial->dev->dev, - "%s converter now attached to ttyUSB%d\n", - driver->description, minor); -diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c -index a2d040971afe..8d114b9733ed 100644 ---- a/drivers/usb/serial/cp210x.c -+++ b/drivers/usb/serial/cp210x.c -@@ -147,6 +147,8 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(0x166A, 0x0305) }, /* Clipsal C-5000CT2 C-Bus Spectrum Colour Touchscreen */ - { USB_DEVICE(0x166A, 0x0401) }, /* Clipsal L51xx C-Bus Architectural Dimmer */ - { USB_DEVICE(0x166A, 0x0101) }, /* Clipsal 5560884 C-Bus Multi-room Audio Matrix Switcher */ -+ { USB_DEVICE(0x16C0, 0x09B0) }, /* Lunatico Seletek */ -+ { USB_DEVICE(0x16C0, 0x09B1) }, /* Lunatico Seletek */ - { USB_DEVICE(0x16D6, 0x0001) }, /* Jablotron serial interface */ - { USB_DEVICE(0x16DC, 0x0010) }, /* W-IE-NE-R Plein & Baus GmbH PL512 Power Supply */ - { USB_DEVICE(0x16DC, 0x0011) }, /* W-IE-NE-R Plein & Baus GmbH RCM Remote Control for MARATON Power Supply */ -diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c -index debcdef4cbf0..923500595357 100644 ---- a/drivers/usb/serial/ftdi_sio.c -+++ b/drivers/usb/serial/ftdi_sio.c -@@ -812,6 +812,8 @@ static const struct usb_device_id id_table_combined[] = { - { USB_DEVICE(FTDI_VID, FTDI_ELSTER_UNICOM_PID) }, - { USB_DEVICE(FTDI_VID, FTDI_PROPOX_JTAGCABLEII_PID) }, - { USB_DEVICE(FTDI_VID, FTDI_PROPOX_ISPCABLEIII_PID) }, -+ { USB_DEVICE(FTDI_VID, CYBER_CORTEX_AV_PID), -+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_H_PID), -@@ -991,6 +993,23 @@ static const struct usb_device_id id_table_combined[] = { - { USB_DEVICE_INTERFACE_NUMBER(INFINEON_VID, INFINEON_TRIBOARD_PID, 1) }, - /* GE Healthcare devices */ - { USB_DEVICE(GE_HEALTHCARE_VID, GE_HEALTHCARE_NEMO_TRACKER_PID) }, -+ /* Active Research (Actisense) devices */ -+ { USB_DEVICE(FTDI_VID, ACTISENSE_NDC_PID) }, -+ { USB_DEVICE(FTDI_VID, ACTISENSE_USG_PID) }, -+ { USB_DEVICE(FTDI_VID, ACTISENSE_NGT_PID) }, -+ { USB_DEVICE(FTDI_VID, ACTISENSE_NGW_PID) }, -+ { USB_DEVICE(FTDI_VID, ACTISENSE_D9AC_PID) }, -+ { USB_DEVICE(FTDI_VID, ACTISENSE_D9AD_PID) }, -+ { USB_DEVICE(FTDI_VID, ACTISENSE_D9AE_PID) }, -+ { USB_DEVICE(FTDI_VID, ACTISENSE_D9AF_PID) }, -+ { USB_DEVICE(FTDI_VID, CHETCO_SEAGAUGE_PID) }, -+ { USB_DEVICE(FTDI_VID, CHETCO_SEASWITCH_PID) }, -+ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_NMEA2000_PID) }, -+ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_ETHERNET_PID) }, -+ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_WIFI_PID) }, -+ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_DISPLAY_PID) }, -+ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_LITE_PID) }, -+ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_ANALOG_PID) }, - { } /* Terminating entry */ - }; - -diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h -index e52409c9be99..56b1b55c4751 100644 ---- a/drivers/usb/serial/ftdi_sio_ids.h -+++ b/drivers/usb/serial/ftdi_sio_ids.h -@@ -38,6 +38,9 @@ - - #define FTDI_LUMEL_PD12_PID 0x6002 - -+/* Cyber Cortex AV by Fabulous Silicon (http://fabuloussilicon.com) */ -+#define CYBER_CORTEX_AV_PID 0x8698 -+ - /* - * Marvell OpenRD Base, Client - * http://www.open-rd.org -@@ -1438,3 +1441,23 @@ - */ - #define GE_HEALTHCARE_VID 0x1901 - #define GE_HEALTHCARE_NEMO_TRACKER_PID 0x0015 -+ -+/* -+ * Active Research (Actisense) devices -+ */ -+#define ACTISENSE_NDC_PID 0xD9A8 /* NDC USB Serial Adapter */ -+#define ACTISENSE_USG_PID 0xD9A9 /* USG USB Serial Adapter */ -+#define ACTISENSE_NGT_PID 0xD9AA /* NGT NMEA2000 Interface */ -+#define ACTISENSE_NGW_PID 0xD9AB /* NGW NMEA2000 Gateway */ -+#define ACTISENSE_D9AC_PID 0xD9AC /* Actisense Reserved */ -+#define ACTISENSE_D9AD_PID 0xD9AD /* Actisense Reserved */ -+#define ACTISENSE_D9AE_PID 0xD9AE /* Actisense Reserved */ -+#define ACTISENSE_D9AF_PID 0xD9AF /* Actisense Reserved */ -+#define CHETCO_SEAGAUGE_PID 0xA548 /* SeaGauge USB Adapter */ -+#define CHETCO_SEASWITCH_PID 0xA549 /* SeaSwitch USB Adapter */ -+#define CHETCO_SEASMART_NMEA2000_PID 0xA54A /* SeaSmart NMEA2000 Gateway */ -+#define CHETCO_SEASMART_ETHERNET_PID 0xA54B /* SeaSmart Ethernet Gateway */ -+#define CHETCO_SEASMART_WIFI_PID 0xA5AC /* SeaSmart Wifi Gateway */ -+#define CHETCO_SEASMART_DISPLAY_PID 0xA5AD /* SeaSmart NMEA2000 Display */ -+#define CHETCO_SEASMART_LITE_PID 0xA5AE /* SeaSmart Lite USB Adapter */ -+#define CHETCO_SEASMART_ANALOG_PID 0xA5AF /* SeaSmart Analog Adapter */ -diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c -index b63ce023f96f..d6a197917ebd 100644 ---- a/drivers/usb/serial/generic.c -+++ b/drivers/usb/serial/generic.c -@@ -258,7 +258,8 @@ void usb_serial_generic_wait_until_sent(struct tty_struct *tty, long timeout) - * character or at least one jiffy. - */ - period = max_t(unsigned long, (10 * HZ / bps), 1); -- period = min_t(unsigned long, period, timeout); -+ if (timeout) -+ period = min_t(unsigned long, period, timeout); - - dev_dbg(&port->dev, "%s - timeout = %u ms, period = %u ms\n", - __func__, jiffies_to_msecs(timeout), -@@ -268,7 +269,7 @@ void usb_serial_generic_wait_until_sent(struct tty_struct *tty, long timeout) - schedule_timeout_interruptible(period); - if (signal_pending(current)) - break; -- if (time_after(jiffies, expire)) -+ if (timeout && time_after(jiffies, expire)) - break; - } - } -diff --git a/drivers/usb/serial/mxuport.c b/drivers/usb/serial/mxuport.c -index ab1d690274ae..460a40669967 100644 ---- a/drivers/usb/serial/mxuport.c -+++ b/drivers/usb/serial/mxuport.c -@@ -1284,7 +1284,8 @@ static int mxuport_open(struct tty_struct *tty, struct usb_serial_port *port) - } - - /* Initial port termios */ -- mxuport_set_termios(tty, port, NULL); -+ if (tty) -+ mxuport_set_termios(tty, port, NULL); - - /* - * TODO: use RQ_VENDOR_GET_MSR, once we know what it -diff --git a/fs/autofs4/dev-ioctl.c b/fs/autofs4/dev-ioctl.c -index 3182c0e68b42..e3399dc2453b 100644 ---- a/fs/autofs4/dev-ioctl.c -+++ b/fs/autofs4/dev-ioctl.c -@@ -95,7 +95,7 @@ static int check_dev_ioctl_version(int cmd, struct autofs_dev_ioctl *param) - */ - static struct autofs_dev_ioctl *copy_dev_ioctl(struct autofs_dev_ioctl __user *in) - { -- struct autofs_dev_ioctl tmp; -+ struct autofs_dev_ioctl tmp, *res; - - if (copy_from_user(&tmp, in, sizeof(tmp))) - return ERR_PTR(-EFAULT); -@@ -103,7 +103,11 @@ static struct autofs_dev_ioctl *copy_dev_ioctl(struct autofs_dev_ioctl __user *i - if (tmp.size < sizeof(tmp)) - return ERR_PTR(-EINVAL); - -- return memdup_user(in, tmp.size); -+ res = memdup_user(in, tmp.size); -+ if (!IS_ERR(res)) -+ res->size = tmp.size; -+ -+ return res; - } - - static inline void free_dev_ioctl(struct autofs_dev_ioctl *param) -diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c -index 279b06ef5522..0a841ddd6843 100644 ---- a/fs/btrfs/file.c -+++ b/fs/btrfs/file.c -@@ -1774,22 +1774,10 @@ static ssize_t btrfs_file_aio_write(struct kiocb *iocb, - mutex_unlock(&inode->i_mutex); - - /* -- * we want to make sure fsync finds this change -- * but we haven't joined a transaction running right now. -- * -- * Later on, someone is sure to update the inode and get the -- * real transid recorded. -- * -- * We set last_trans now to the fs_info generation + 1, -- * this will either be one more than the running transaction -- * or the generation used for the next transaction if there isn't -- * one running right now. -- * - * We also have to set last_sub_trans to the current log transid, - * otherwise subsequent syncs to a file that's been synced in this - * transaction will appear to have already occured. - */ -- BTRFS_I(inode)->last_trans = root->fs_info->generation + 1; - BTRFS_I(inode)->last_sub_trans = root->log_transid; - if (num_written > 0) { - err = generic_write_sync(file, pos, num_written); -@@ -1892,25 +1880,37 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync) - atomic_inc(&root->log_batch); - - /* -- * check the transaction that last modified this inode -- * and see if its already been committed -- */ -- if (!BTRFS_I(inode)->last_trans) { -- mutex_unlock(&inode->i_mutex); -- goto out; -- } -- -- /* -- * if the last transaction that changed this file was before -- * the current transaction, we can bail out now without any -- * syncing -+ * If the last transaction that changed this file was before the current -+ * transaction and we have the full sync flag set in our inode, we can -+ * bail out now without any syncing. -+ * -+ * Note that we can't bail out if the full sync flag isn't set. This is -+ * because when the full sync flag is set we start all ordered extents -+ * and wait for them to fully complete - when they complete they update -+ * the inode's last_trans field through: -+ * -+ * btrfs_finish_ordered_io() -> -+ * btrfs_update_inode_fallback() -> -+ * btrfs_update_inode() -> -+ * btrfs_set_inode_last_trans() -+ * -+ * So we are sure that last_trans is up to date and can do this check to -+ * bail out safely. For the fast path, when the full sync flag is not -+ * set in our inode, we can not do it because we start only our ordered -+ * extents and don't wait for them to complete (that is when -+ * btrfs_finish_ordered_io runs), so here at this point their last_trans -+ * value might be less than or equals to fs_info->last_trans_committed, -+ * and setting a speculative last_trans for an inode when a buffered -+ * write is made (such as fs_info->generation + 1 for example) would not -+ * be reliable since after setting the value and before fsync is called -+ * any number of transactions can start and commit (transaction kthread -+ * commits the current transaction periodically), and a transaction -+ * commit does not start nor waits for ordered extents to complete. - */ - smp_mb(); - if (btrfs_inode_in_log(inode, root->fs_info->generation) || -- BTRFS_I(inode)->last_trans <= -- root->fs_info->last_trans_committed) { -- BTRFS_I(inode)->last_trans = 0; -- -+ (full_sync && BTRFS_I(inode)->last_trans <= -+ root->fs_info->last_trans_committed)) { - /* - * We'v had everything committed since the last time we were - * modified so clear this flag in case it was set for whatever -diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index d68a7250f00b..653cdd85e0f2 100644 ---- a/fs/btrfs/inode.c -+++ b/fs/btrfs/inode.c -@@ -6870,7 +6870,6 @@ static int btrfs_get_blocks_direct(struct inode *inode, sector_t iblock, - ((BTRFS_I(inode)->flags & BTRFS_INODE_NODATACOW) && - em->block_start != EXTENT_MAP_HOLE)) { - int type; -- int ret; - u64 block_start, orig_start, orig_block_len, ram_bytes; - - if (test_bit(EXTENT_FLAG_PREALLOC, &em->flags)) -diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c -index aeb57b98c53f..a7f32bfdd5e7 100644 ---- a/fs/btrfs/tree-log.c -+++ b/fs/btrfs/tree-log.c -@@ -979,7 +979,7 @@ again: - base = btrfs_item_ptr_offset(leaf, path->slots[0]); - - while (cur_offset < item_size) { -- extref = (struct btrfs_inode_extref *)base + cur_offset; -+ extref = (struct btrfs_inode_extref *)(base + cur_offset); - - victim_name_len = btrfs_inode_extref_name_len(leaf, extref); - -diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c -index 15761957cc3f..1ff8fe5dab0d 100644 ---- a/fs/debugfs/inode.c -+++ b/fs/debugfs/inode.c -@@ -245,10 +245,19 @@ static int debugfs_show_options(struct seq_file *m, struct dentry *root) - return 0; - } - -+static void debugfs_evict_inode(struct inode *inode) -+{ -+ truncate_inode_pages(&inode->i_data, 0); -+ clear_inode(inode); -+ if (S_ISLNK(inode->i_mode)) -+ kfree(inode->i_private); -+} -+ - static const struct super_operations debugfs_super_operations = { - .statfs = simple_statfs, - .remount_fs = debugfs_remount, - .show_options = debugfs_show_options, -+ .evict_inode = debugfs_evict_inode, - }; - - static int debug_fill_super(struct super_block *sb, void *data, int silent) -@@ -465,23 +474,14 @@ static int __debugfs_remove(struct dentry *dentry, struct dentry *parent) - int ret = 0; - - if (debugfs_positive(dentry)) { -- if (dentry->d_inode) { -- dget(dentry); -- switch (dentry->d_inode->i_mode & S_IFMT) { -- case S_IFDIR: -- ret = simple_rmdir(parent->d_inode, dentry); -- break; -- case S_IFLNK: -- kfree(dentry->d_inode->i_private); -- /* fall through */ -- default: -- simple_unlink(parent->d_inode, dentry); -- break; -- } -- if (!ret) -- d_delete(dentry); -- dput(dentry); -- } -+ dget(dentry); -+ if (S_ISDIR(dentry->d_inode->i_mode)) -+ ret = simple_rmdir(parent->d_inode, dentry); -+ else -+ simple_unlink(parent->d_inode, dentry); -+ if (!ret) -+ d_delete(dentry); -+ dput(dentry); - } - return ret; - } -diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c -index 3ed1be9aade3..2ea3537b8bde 100644 ---- a/fs/nfs/delegation.c -+++ b/fs/nfs/delegation.c -@@ -161,8 +161,8 @@ void nfs_inode_reclaim_delegation(struct inode *inode, struct rpc_cred *cred, - &delegation->flags); - NFS_I(inode)->delegation_state = delegation->type; - spin_unlock(&delegation->lock); -- put_rpccred(oldcred); - rcu_read_unlock(); -+ put_rpccred(oldcred); - trace_nfs4_reclaim_delegation(inode, res->delegation_type); - } else { - /* We appear to have raced with a delegation return. */ -diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c -index b2e3ff347620..ecdbae19a766 100644 ---- a/fs/nilfs2/btree.c -+++ b/fs/nilfs2/btree.c -@@ -31,6 +31,8 @@ - #include "alloc.h" - #include "dat.h" - -+static void __nilfs_btree_init(struct nilfs_bmap *bmap); -+ - static struct nilfs_btree_path *nilfs_btree_alloc_path(void) - { - struct nilfs_btree_path *path; -@@ -368,6 +370,34 @@ static int nilfs_btree_node_broken(const struct nilfs_btree_node *node, - return ret; - } - -+/** -+ * nilfs_btree_root_broken - verify consistency of btree root node -+ * @node: btree root node to be examined -+ * @ino: inode number -+ * -+ * Return Value: If node is broken, 1 is returned. Otherwise, 0 is returned. -+ */ -+static int nilfs_btree_root_broken(const struct nilfs_btree_node *node, -+ unsigned long ino) -+{ -+ int level, flags, nchildren; -+ int ret = 0; -+ -+ level = nilfs_btree_node_get_level(node); -+ flags = nilfs_btree_node_get_flags(node); -+ nchildren = nilfs_btree_node_get_nchildren(node); -+ -+ if (unlikely(level < NILFS_BTREE_LEVEL_NODE_MIN || -+ level > NILFS_BTREE_LEVEL_MAX || -+ nchildren < 0 || -+ nchildren > NILFS_BTREE_ROOT_NCHILDREN_MAX)) { -+ pr_crit("NILFS: bad btree root (inode number=%lu): level = %d, flags = 0x%x, nchildren = %d\n", -+ ino, level, flags, nchildren); -+ ret = 1; -+ } -+ return ret; -+} -+ - int nilfs_btree_broken_node_block(struct buffer_head *bh) - { - int ret; -@@ -1713,7 +1743,7 @@ nilfs_btree_commit_convert_and_insert(struct nilfs_bmap *btree, - - /* convert and insert */ - dat = NILFS_BMAP_USE_VBN(btree) ? nilfs_bmap_get_dat(btree) : NULL; -- nilfs_btree_init(btree); -+ __nilfs_btree_init(btree); - if (nreq != NULL) { - nilfs_bmap_commit_alloc_ptr(btree, dreq, dat); - nilfs_bmap_commit_alloc_ptr(btree, nreq, dat); -@@ -2294,12 +2324,23 @@ static const struct nilfs_bmap_operations nilfs_btree_ops_gc = { - .bop_gather_data = NULL, - }; - --int nilfs_btree_init(struct nilfs_bmap *bmap) -+static void __nilfs_btree_init(struct nilfs_bmap *bmap) - { - bmap->b_ops = &nilfs_btree_ops; - bmap->b_nchildren_per_block = - NILFS_BTREE_NODE_NCHILDREN_MAX(nilfs_btree_node_size(bmap)); -- return 0; -+} -+ -+int nilfs_btree_init(struct nilfs_bmap *bmap) -+{ -+ int ret = 0; -+ -+ __nilfs_btree_init(bmap); -+ -+ if (nilfs_btree_root_broken(nilfs_btree_get_root(bmap), -+ bmap->b_inode->i_ino)) -+ ret = -EIO; -+ return ret; - } - - void nilfs_btree_init_gc(struct nilfs_bmap *bmap) -diff --git a/fs/proc/generic.c b/fs/proc/generic.c -index b7f268eb5f45..2e2d9d5d78d9 100644 ---- a/fs/proc/generic.c -+++ b/fs/proc/generic.c -@@ -19,7 +19,6 @@ - #include - #include - #include --#include - #include - #include - #include -@@ -162,17 +161,6 @@ void proc_free_inum(unsigned int inum) - spin_unlock_irqrestore(&proc_inum_lock, flags); - } - --static void *proc_follow_link(struct dentry *dentry, struct nameidata *nd) --{ -- nd_set_link(nd, __PDE_DATA(dentry->d_inode)); -- return NULL; --} -- --static const struct inode_operations proc_link_inode_operations = { -- .readlink = generic_readlink, -- .follow_link = proc_follow_link, --}; -- - /* - * Don't create negative dentries here, return -ENOENT by hand - * instead. -diff --git a/fs/proc/inode.c b/fs/proc/inode.c -index 124fc43c7090..2f2815f3176e 100644 ---- a/fs/proc/inode.c -+++ b/fs/proc/inode.c -@@ -23,6 +23,7 @@ - #include - #include - #include -+#include - - #include - -@@ -401,6 +402,26 @@ static const struct file_operations proc_reg_file_ops_no_compat = { - }; - #endif - -+static void *proc_follow_link(struct dentry *dentry, struct nameidata *nd) -+{ -+ struct proc_dir_entry *pde = PDE(dentry->d_inode); -+ if (unlikely(!use_pde(pde))) -+ return ERR_PTR(-EINVAL); -+ nd_set_link(nd, pde->data); -+ return pde; -+} -+ -+static void proc_put_link(struct dentry *dentry, struct nameidata *nd, void *p) -+{ -+ unuse_pde(p); -+} -+ -+const struct inode_operations proc_link_inode_operations = { -+ .readlink = generic_readlink, -+ .follow_link = proc_follow_link, -+ .put_link = proc_put_link, -+}; -+ - struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de) - { - struct inode *inode = new_inode_pseudo(sb); -diff --git a/fs/proc/internal.h b/fs/proc/internal.h -index 651d09a11dde..8b8ca1db6316 100644 ---- a/fs/proc/internal.h -+++ b/fs/proc/internal.h -@@ -202,6 +202,7 @@ struct pde_opener { - int closing; - struct completion *c; - }; -+extern const struct inode_operations proc_link_inode_operations; - - extern const struct inode_operations proc_pid_link_inode_operations; - -diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h -index 1772fadcff62..349325404add 100644 ---- a/include/target/target_core_base.h -+++ b/include/target/target_core_base.h -@@ -407,7 +407,7 @@ struct t10_reservation { - /* Activate Persistence across Target Power Loss enabled - * for SCSI device */ - int pr_aptpl_active; --#define PR_APTPL_BUF_LEN 8192 -+#define PR_APTPL_BUF_LEN 262144 - u32 pr_generation; - spinlock_t registration_lock; - spinlock_t aptpl_reg_lock; -diff --git a/include/trace/events/kmem.h b/include/trace/events/kmem.h -index aece1346ceb7..4ad10baecd4d 100644 ---- a/include/trace/events/kmem.h -+++ b/include/trace/events/kmem.h -@@ -268,11 +268,11 @@ TRACE_EVENT(mm_page_alloc_extfrag, - - TP_PROTO(struct page *page, - int alloc_order, int fallback_order, -- int alloc_migratetype, int fallback_migratetype, int new_migratetype), -+ int alloc_migratetype, int fallback_migratetype), - - TP_ARGS(page, - alloc_order, fallback_order, -- alloc_migratetype, fallback_migratetype, new_migratetype), -+ alloc_migratetype, fallback_migratetype), - - TP_STRUCT__entry( - __field( struct page *, page ) -@@ -289,7 +289,8 @@ TRACE_EVENT(mm_page_alloc_extfrag, - __entry->fallback_order = fallback_order; - __entry->alloc_migratetype = alloc_migratetype; - __entry->fallback_migratetype = fallback_migratetype; -- __entry->change_ownership = (new_migratetype == alloc_migratetype); -+ __entry->change_ownership = (alloc_migratetype == -+ get_pageblock_migratetype(page)); - ), - - TP_printk("page=%p pfn=%lu alloc_order=%d fallback_order=%d pageblock_order=%d alloc_migratetype=%d fallback_migratetype=%d fragmenting=%d change_ownership=%d", -diff --git a/mm/compaction.c b/mm/compaction.c -index 4229fc22a477..a522208bb8ea 100644 ---- a/mm/compaction.c -+++ b/mm/compaction.c -@@ -937,7 +937,7 @@ static int compact_finished(struct zone *zone, - return COMPACT_PARTIAL; - - /* Job done if allocation would set block type */ -- if (cc->order >= pageblock_order && area->nr_free) -+ if (order >= pageblock_order && area->nr_free) - return COMPACT_PARTIAL; - } - -diff --git a/mm/hugetlb.c b/mm/hugetlb.c -index 472259b00618..c3e8660cb616 100644 ---- a/mm/hugetlb.c -+++ b/mm/hugetlb.c -@@ -2488,9 +2488,10 @@ again: - goto unlock; - - /* -- * HWPoisoned hugepage is already unmapped and dropped reference -+ * Migrating hugepage or HWPoisoned hugepage is already -+ * unmapped and its refcount is dropped, so just clear pte here. - */ -- if (unlikely(is_hugetlb_entry_hwpoisoned(pte))) { -+ if (unlikely(!pte_present(pte))) { - huge_pte_clear(mm, address, ptep); - goto unlock; - } -@@ -3163,7 +3164,26 @@ unsigned long hugetlb_change_protection(struct vm_area_struct *vma, - spin_unlock(ptl); - continue; - } -- if (!huge_pte_none(huge_ptep_get(ptep))) { -+ pte = huge_ptep_get(ptep); -+ if (unlikely(is_hugetlb_entry_hwpoisoned(pte))) { -+ spin_unlock(ptl); -+ continue; -+ } -+ if (unlikely(is_hugetlb_entry_migration(pte))) { -+ swp_entry_t entry = pte_to_swp_entry(pte); -+ -+ if (is_write_migration_entry(entry)) { -+ pte_t newpte; -+ -+ make_migration_entry_read(&entry); -+ newpte = swp_entry_to_pte(entry); -+ set_huge_pte_at(mm, address, ptep, newpte); -+ pages++; -+ } -+ spin_unlock(ptl); -+ continue; -+ } -+ if (!huge_pte_none(pte)) { - pte = huge_ptep_get_and_clear(mm, address, ptep); - pte = pte_mkhuge(huge_pte_modify(pte, newprot)); - pte = arch_make_huge_pte(pte, vma, NULL, 0); -diff --git a/mm/memory.c b/mm/memory.c -index 7f30beaba74f..102af096cbc5 100644 ---- a/mm/memory.c -+++ b/mm/memory.c -@@ -4024,7 +4024,7 @@ int generic_access_phys(struct vm_area_struct *vma, unsigned long addr, - if (follow_phys(vma, addr, write, &prot, &phys_addr)) - return -EINVAL; - -- maddr = ioremap_prot(phys_addr, PAGE_SIZE, prot); -+ maddr = ioremap_prot(phys_addr, PAGE_ALIGN(len + offset), prot); - if (write) - memcpy_toio(maddr + offset, buf, len); - else -diff --git a/mm/mmap.c b/mm/mmap.c -index 085bcd890ad2..d4c97ba6843b 100644 ---- a/mm/mmap.c -+++ b/mm/mmap.c -@@ -129,7 +129,7 @@ EXPORT_SYMBOL_GPL(vm_memory_committed); - */ - int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin) - { -- unsigned long free, allowed, reserve; -+ long free, allowed, reserve; - - vm_acct_memory(pages); - -@@ -193,7 +193,7 @@ int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin) - */ - if (mm) { - reserve = sysctl_user_reserve_kbytes >> (PAGE_SHIFT - 10); -- allowed -= min(mm->total_vm / 32, reserve); -+ allowed -= min_t(long, mm->total_vm / 32, reserve); - } - - if (percpu_counter_read_positive(&vm_committed_as) < allowed) -diff --git a/mm/nommu.c b/mm/nommu.c -index 3ee4f74fbfbe..76b3f90ada7b 100644 ---- a/mm/nommu.c -+++ b/mm/nommu.c -@@ -1905,7 +1905,7 @@ EXPORT_SYMBOL(unmap_mapping_range); - */ - int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin) - { -- unsigned long free, allowed, reserve; -+ long free, allowed, reserve; - - vm_acct_memory(pages); - -@@ -1969,7 +1969,7 @@ int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin) - */ - if (mm) { - reserve = sysctl_user_reserve_kbytes >> (PAGE_SHIFT - 10); -- allowed -= min(mm->total_vm / 32, reserve); -+ allowed -= min_t(long, mm->total_vm / 32, reserve); - } - - if (percpu_counter_read_positive(&vm_committed_as) < allowed) -diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index ea419137f845..0479732f6b02 100644 ---- a/mm/page_alloc.c -+++ b/mm/page_alloc.c -@@ -1081,8 +1081,8 @@ static void change_pageblock_range(struct page *pageblock_page, - * nor move CMA pages to different free lists. We don't want unmovable pages - * to be allocated from MIGRATE_CMA areas. - * -- * Returns the new migratetype of the pageblock (or the same old migratetype -- * if it was unchanged). -+ * Returns the allocation migratetype if free pages were stolen, or the -+ * fallback migratetype if it was decided not to steal. - */ - static int try_to_steal_freepages(struct zone *zone, struct page *page, - int start_type, int fallback_type) -@@ -1113,12 +1113,10 @@ static int try_to_steal_freepages(struct zone *zone, struct page *page, - - /* Claim the whole block if over half of it is free */ - if (pages >= (1 << (pageblock_order-1)) || -- page_group_by_mobility_disabled) { -- -+ page_group_by_mobility_disabled) - set_pageblock_migratetype(page, start_type); -- return start_type; -- } - -+ return start_type; - } - - return fallback_type; -@@ -1170,7 +1168,7 @@ __rmqueue_fallback(struct zone *zone, unsigned int order, int start_migratetype) - set_freepage_migratetype(page, new_type); - - trace_mm_page_alloc_extfrag(page, order, current_order, -- start_migratetype, migratetype, new_type); -+ start_migratetype, migratetype); - - return page; - } -diff --git a/net/compat.c b/net/compat.c -index cbc1a2a26587..275af79c131b 100644 ---- a/net/compat.c -+++ b/net/compat.c -@@ -738,24 +738,18 @@ static unsigned char nas[21] = { - - asmlinkage long compat_sys_sendmsg(int fd, struct compat_msghdr __user *msg, unsigned int flags) - { -- if (flags & MSG_CMSG_COMPAT) -- return -EINVAL; - return __sys_sendmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT); - } - - asmlinkage long compat_sys_sendmmsg(int fd, struct compat_mmsghdr __user *mmsg, - unsigned int vlen, unsigned int flags) - { -- if (flags & MSG_CMSG_COMPAT) -- return -EINVAL; - return __sys_sendmmsg(fd, (struct mmsghdr __user *)mmsg, vlen, - flags | MSG_CMSG_COMPAT); - } - - asmlinkage long compat_sys_recvmsg(int fd, struct compat_msghdr __user *msg, unsigned int flags) - { -- if (flags & MSG_CMSG_COMPAT) -- return -EINVAL; - return __sys_recvmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT); - } - -@@ -778,9 +772,6 @@ asmlinkage long compat_sys_recvmmsg(int fd, struct compat_mmsghdr __user *mmsg, - int datagrams; - struct timespec ktspec; - -- if (flags & MSG_CMSG_COMPAT) -- return -EINVAL; -- - if (timeout == NULL) - return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen, - flags | MSG_CMSG_COMPAT, NULL); -diff --git a/net/core/dev.c b/net/core/dev.c -index 4ed77d7245c0..f6d8d7fe29ab 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -940,7 +940,7 @@ bool dev_valid_name(const char *name) - return false; - - while (*name) { -- if (*name == '/' || isspace(*name)) -+ if (*name == '/' || *name == ':' || isspace(*name)) - return false; - name++; - } -diff --git a/net/core/gen_stats.c b/net/core/gen_stats.c -index 9d3d9e78397b..372ac662adf9 100644 ---- a/net/core/gen_stats.c -+++ b/net/core/gen_stats.c -@@ -32,6 +32,9 @@ gnet_stats_copy(struct gnet_dump *d, int type, void *buf, int size) - return 0; - - nla_put_failure: -+ kfree(d->xstats); -+ d->xstats = NULL; -+ d->xstats_len = 0; - spin_unlock_bh(d->lock); - return -1; - } -@@ -217,7 +220,9 @@ int - gnet_stats_copy_app(struct gnet_dump *d, void *st, int len) - { - if (d->compat_xstats) { -- d->xstats = st; -+ d->xstats = kmemdup(st, len, GFP_ATOMIC); -+ if (!d->xstats) -+ goto err_out; - d->xstats_len = len; - } - -@@ -225,6 +230,11 @@ gnet_stats_copy_app(struct gnet_dump *d, void *st, int len) - return gnet_stats_copy(d, TCA_STATS_APP, st, len); - - return 0; -+ -+err_out: -+ d->xstats_len = 0; -+ spin_unlock_bh(d->lock); -+ return -1; - } - EXPORT_SYMBOL(gnet_stats_copy_app); - -@@ -257,6 +267,9 @@ gnet_stats_finish_copy(struct gnet_dump *d) - return -1; - } - -+ kfree(d->xstats); -+ d->xstats = NULL; -+ d->xstats_len = 0; - spin_unlock_bh(d->lock); - return 0; - } -diff --git a/net/core/pktgen.c b/net/core/pktgen.c -index fdac61cac1bd..ca68d32b49ba 100644 ---- a/net/core/pktgen.c -+++ b/net/core/pktgen.c -@@ -2812,25 +2812,25 @@ static struct sk_buff *fill_packet_ipv4(struct net_device *odev, - skb->dev = odev; - skb->pkt_type = PACKET_HOST; - -+ pktgen_finalize_skb(pkt_dev, skb, datalen); -+ - if (!(pkt_dev->flags & F_UDPCSUM)) { - skb->ip_summed = CHECKSUM_NONE; - } else if (odev->features & NETIF_F_V4_CSUM) { - skb->ip_summed = CHECKSUM_PARTIAL; - skb->csum = 0; -- udp4_hwcsum(skb, udph->source, udph->dest); -+ udp4_hwcsum(skb, iph->saddr, iph->daddr); - } else { -- __wsum csum = udp_csum(skb); -+ __wsum csum = skb_checksum(skb, skb_transport_offset(skb), datalen + 8, 0); - - /* add protocol-dependent pseudo-header */ -- udph->check = csum_tcpudp_magic(udph->source, udph->dest, -+ udph->check = csum_tcpudp_magic(iph->saddr, iph->daddr, - datalen + 8, IPPROTO_UDP, csum); - - if (udph->check == 0) - udph->check = CSUM_MANGLED_0; - } - -- pktgen_finalize_skb(pkt_dev, skb, datalen); -- - #ifdef CONFIG_XFRM - if (!process_ipsec(pkt_dev, skb, protocol)) - return NULL; -@@ -2946,6 +2946,8 @@ static struct sk_buff *fill_packet_ipv6(struct net_device *odev, - skb->dev = odev; - skb->pkt_type = PACKET_HOST; - -+ pktgen_finalize_skb(pkt_dev, skb, datalen); -+ - if (!(pkt_dev->flags & F_UDPCSUM)) { - skb->ip_summed = CHECKSUM_NONE; - } else if (odev->features & NETIF_F_V6_CSUM) { -@@ -2954,7 +2956,7 @@ static struct sk_buff *fill_packet_ipv6(struct net_device *odev, - skb->csum_offset = offsetof(struct udphdr, check); - udph->check = ~csum_ipv6_magic(&iph->saddr, &iph->daddr, udplen, IPPROTO_UDP, 0); - } else { -- __wsum csum = udp_csum(skb); -+ __wsum csum = skb_checksum(skb, skb_transport_offset(skb), udplen, 0); - - /* add protocol-dependent pseudo-header */ - udph->check = csum_ipv6_magic(&iph->saddr, &iph->daddr, udplen, IPPROTO_UDP, csum); -@@ -2963,8 +2965,6 @@ static struct sk_buff *fill_packet_ipv6(struct net_device *odev, - udph->check = CSUM_MANGLED_0; - } - -- pktgen_finalize_skb(pkt_dev, skb, datalen); -- - return skb; - } - -diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c -index a6613ff972c1..8aadd6a072a4 100644 ---- a/net/core/rtnetlink.c -+++ b/net/core/rtnetlink.c -@@ -1264,14 +1264,10 @@ static const struct nla_policy ifla_vfinfo_policy[IFLA_VF_INFO_MAX+1] = { - }; - - static const struct nla_policy ifla_vf_policy[IFLA_VF_MAX+1] = { -- [IFLA_VF_MAC] = { .type = NLA_BINARY, -- .len = sizeof(struct ifla_vf_mac) }, -- [IFLA_VF_VLAN] = { .type = NLA_BINARY, -- .len = sizeof(struct ifla_vf_vlan) }, -- [IFLA_VF_TX_RATE] = { .type = NLA_BINARY, -- .len = sizeof(struct ifla_vf_tx_rate) }, -- [IFLA_VF_SPOOFCHK] = { .type = NLA_BINARY, -- .len = sizeof(struct ifla_vf_spoofchk) }, -+ [IFLA_VF_MAC] = { .len = sizeof(struct ifla_vf_mac) }, -+ [IFLA_VF_VLAN] = { .len = sizeof(struct ifla_vf_vlan) }, -+ [IFLA_VF_TX_RATE] = { .len = sizeof(struct ifla_vf_tx_rate) }, -+ [IFLA_VF_SPOOFCHK] = { .len = sizeof(struct ifla_vf_spoofchk) }, - }; - - static const struct nla_policy ifla_port_policy[IFLA_PORT_MAX+1] = { -@@ -2034,8 +2030,16 @@ replay: - } - } - err = rtnl_configure_link(dev, ifm); -- if (err < 0) -- unregister_netdevice(dev); -+ if (err < 0) { -+ if (ops->newlink) { -+ LIST_HEAD(list_kill); -+ -+ ops->dellink(dev, &list_kill); -+ unregister_netdevice_many(&list_kill); -+ } else { -+ unregister_netdevice(dev); -+ } -+ } - out: - put_net(dest_net); - return err; -diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c -index c10a3ce5cbff..9ff497d17545 100644 ---- a/net/ipv4/ip_fragment.c -+++ b/net/ipv4/ip_fragment.c -@@ -679,27 +679,30 @@ EXPORT_SYMBOL(ip_defrag); - struct sk_buff *ip_check_defrag(struct sk_buff *skb, u32 user) - { - struct iphdr iph; -+ int netoff; - u32 len; - - if (skb->protocol != htons(ETH_P_IP)) - return skb; - -- if (!skb_copy_bits(skb, 0, &iph, sizeof(iph))) -+ netoff = skb_network_offset(skb); -+ -+ if (skb_copy_bits(skb, netoff, &iph, sizeof(iph)) < 0) - return skb; - - if (iph.ihl < 5 || iph.version != 4) - return skb; - - len = ntohs(iph.tot_len); -- if (skb->len < len || len < (iph.ihl * 4)) -+ if (skb->len < netoff + len || len < (iph.ihl * 4)) - return skb; - - if (ip_is_fragment(&iph)) { - skb = skb_share_check(skb, GFP_ATOMIC); - if (skb) { -- if (!pskb_may_pull(skb, iph.ihl*4)) -+ if (!pskb_may_pull(skb, netoff + iph.ihl * 4)) - return skb; -- if (pskb_trim_rcsum(skb, len)) -+ if (pskb_trim_rcsum(skb, netoff + len)) - return skb; - memset(IPCB(skb), 0, sizeof(struct inet_skb_parm)); - if (ip_defrag(skb, user)) -diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c -index dd637fc4b553..05686c47a289 100644 ---- a/net/ipv4/ip_output.c -+++ b/net/ipv4/ip_output.c -@@ -843,7 +843,8 @@ static int __ip_append_data(struct sock *sk, - cork->length += length; - if (((length > mtu) || (skb && skb_is_gso(skb))) && - (sk->sk_protocol == IPPROTO_UDP) && -- (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len) { -+ (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len && -+ (sk->sk_type == SOCK_DGRAM)) { - err = ip_ufo_append_data(sk, queue, getfrag, from, length, - hh_len, fragheaderlen, transhdrlen, - maxfraglen, flags); -diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c -index 04ce671430cb..b94002ab8052 100644 ---- a/net/ipv4/ping.c -+++ b/net/ipv4/ping.c -@@ -259,6 +259,10 @@ int ping_init_sock(struct sock *sk) - kgid_t low, high; - int ret = 0; - -+#if IS_ENABLED(CONFIG_IPV6) -+ if (sk->sk_family == AF_INET6) -+ inet6_sk(sk)->ipv6only = 1; -+#endif - inet_get_ping_group_range_net(net, &low, &high); - if (gid_lte(low, group) && gid_lte(group, high)) - return 0; -@@ -305,6 +309,11 @@ static int ping_check_bind_addr(struct sock *sk, struct inet_sock *isk, - if (addr_len < sizeof(*addr)) - return -EINVAL; - -+ if (addr->sin_family != AF_INET && -+ !(addr->sin_family == AF_UNSPEC && -+ addr->sin_addr.s_addr == htonl(INADDR_ANY))) -+ return -EAFNOSUPPORT; -+ - pr_debug("ping_check_bind_addr(sk=%p,addr=%pI4,port=%d)\n", - sk, &addr->sin_addr.s_addr, ntohs(addr->sin_port)); - -@@ -330,7 +339,7 @@ static int ping_check_bind_addr(struct sock *sk, struct inet_sock *isk, - return -EINVAL; - - if (addr->sin6_family != AF_INET6) -- return -EINVAL; -+ return -EAFNOSUPPORT; - - pr_debug("ping_check_bind_addr(sk=%p,addr=%pI6c,port=%d)\n", - sk, addr->sin6_addr.s6_addr, ntohs(addr->sin6_port)); -@@ -716,7 +725,7 @@ static int ping_v4_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m - if (msg->msg_namelen < sizeof(*usin)) - return -EINVAL; - if (usin->sin_family != AF_INET) -- return -EINVAL; -+ return -EAFNOSUPPORT; - daddr = usin->sin_addr.s_addr; - /* no remote port */ - } else { -diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c -index 12f7ef0f243a..d7907ecf0b75 100644 ---- a/net/ipv6/ip6_output.c -+++ b/net/ipv6/ip6_output.c -@@ -1294,7 +1294,8 @@ emsgsize: - if (((length > mtu) || - (skb && skb_is_gso(skb))) && - (sk->sk_protocol == IPPROTO_UDP) && -- (rt->dst.dev->features & NETIF_F_UFO)) { -+ (rt->dst.dev->features & NETIF_F_UFO) && -+ (sk->sk_type == SOCK_DGRAM)) { - err = ip6_ufo_append_data(sk, getfrag, from, length, - hh_len, fragheaderlen, - transhdrlen, mtu, flags, rt); -diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c -index bda74291c3e0..461199533fe4 100644 ---- a/net/ipv6/ping.c -+++ b/net/ipv6/ping.c -@@ -103,9 +103,10 @@ int ping_v6_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg, - - if (msg->msg_name) { - DECLARE_SOCKADDR(struct sockaddr_in6 *, u, msg->msg_name); -- if (msg->msg_namelen < sizeof(struct sockaddr_in6) || -- u->sin6_family != AF_INET6) { -+ if (msg->msg_namelen < sizeof(*u)) - return -EINVAL; -+ if (u->sin6_family != AF_INET6) { -+ return -EAFNOSUPPORT; - } - if (sk->sk_bound_dev_if && - sk->sk_bound_dev_if != u->sin6_scope_id) { -diff --git a/net/ipv6/route.c b/net/ipv6/route.c -index 6f1b8503a431..3809ca234c69 100644 ---- a/net/ipv6/route.c -+++ b/net/ipv6/route.c -@@ -141,7 +141,7 @@ static u32 *ipv6_cow_metrics(struct dst_entry *dst, unsigned long old) - u32 *p = NULL; - - if (!(rt->dst.flags & DST_HOST)) -- return NULL; -+ return dst_cow_metrics_generic(dst, old); - - peer = rt6_get_peer_create(rt); - if (peer) { -diff --git a/net/irda/ircomm/ircomm_tty.c b/net/irda/ircomm/ircomm_tty.c -index 2ba8b9705bb7..fdcb9688b5d3 100644 ---- a/net/irda/ircomm/ircomm_tty.c -+++ b/net/irda/ircomm/ircomm_tty.c -@@ -818,7 +818,9 @@ static void ircomm_tty_wait_until_sent(struct tty_struct *tty, int timeout) - orig_jiffies = jiffies; - - /* Set poll time to 200 ms */ -- poll_time = IRDA_MIN(timeout, msecs_to_jiffies(200)); -+ poll_time = msecs_to_jiffies(200); -+ if (timeout) -+ poll_time = min_t(unsigned long, timeout, poll_time); - - spin_lock_irqsave(&self->spinlock, flags); - while (self->tx_skb && self->tx_skb->len) { -diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c -index e5a7ac2f3687..dca076f6252c 100644 ---- a/net/mac80211/tx.c -+++ b/net/mac80211/tx.c -@@ -562,6 +562,7 @@ ieee80211_tx_h_check_control_port_protocol(struct ieee80211_tx_data *tx) - if (tx->sdata->control_port_no_encrypt) - info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT; - info->control.flags |= IEEE80211_TX_CTRL_PORT_CTRL_PROTO; -+ info->flags |= IEEE80211_TX_CTL_USE_MINRATE; - } - - return TX_CONTINUE; -diff --git a/net/sched/ematch.c b/net/sched/ematch.c -index 3a633debb6df..a2abc449ce8f 100644 ---- a/net/sched/ematch.c -+++ b/net/sched/ematch.c -@@ -227,6 +227,7 @@ static int tcf_em_validate(struct tcf_proto *tp, - * to replay the request. - */ - module_put(em->ops->owner); -+ em->ops = NULL; - err = -EAGAIN; - } - #endif -diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c -index ae333c1845bb..0adc66caae2f 100644 ---- a/net/sunrpc/cache.c -+++ b/net/sunrpc/cache.c -@@ -920,7 +920,7 @@ static unsigned int cache_poll(struct file *filp, poll_table *wait, - poll_wait(filp, &queue_wait, wait); - - /* alway allow write */ -- mask = POLL_OUT | POLLWRNORM; -+ mask = POLLOUT | POLLWRNORM; - - if (!rp) - return mask; -diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c -index 566b0f69d628..ee2405723188 100644 ---- a/sound/core/pcm_native.c -+++ b/sound/core/pcm_native.c -@@ -1404,6 +1404,8 @@ static int snd_pcm_do_drain_init(struct snd_pcm_substream *substream, int state) - if (! snd_pcm_playback_empty(substream)) { - snd_pcm_do_start(substream, SNDRV_PCM_STATE_DRAINING); - snd_pcm_post_start(substream, SNDRV_PCM_STATE_DRAINING); -+ } else { -+ runtime->status->state = SNDRV_PCM_STATE_SETUP; - } - break; - case SNDRV_PCM_STATE_RUNNING: -diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c -index 103e85a13f35..2f3059b50ffa 100644 ---- a/sound/pci/hda/hda_intel.c -+++ b/sound/pci/hda/hda_intel.c -@@ -3984,7 +3984,7 @@ static DEFINE_PCI_DEVICE_TABLE(azx_ids) = { - .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH_NOPM }, - /* Panther Point */ - { PCI_DEVICE(0x8086, 0x1e20), -- .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH }, -+ .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH_NOPM }, - /* Lynx Point */ - { PCI_DEVICE(0x8086, 0x8c20), - .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH }, -diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c -index 12f28d7e0fdc..231b26471a63 100644 ---- a/sound/pci/hda/patch_sigmatel.c -+++ b/sound/pci/hda/patch_sigmatel.c -@@ -85,6 +85,7 @@ enum { - STAC_ALIENWARE_M17X, - STAC_92HD89XX_HP_FRONT_JACK, - STAC_92HD89XX_HP_Z1_G2_RIGHT_MIC_JACK, -+ STAC_92HD73XX_ASUS_MOBO, - STAC_92HD73XX_MODELS - }; - -@@ -1935,7 +1936,18 @@ static const struct hda_fixup stac92hd73xx_fixups[] = { - [STAC_92HD89XX_HP_Z1_G2_RIGHT_MIC_JACK] = { - .type = HDA_FIXUP_PINS, - .v.pins = stac92hd89xx_hp_z1_g2_right_mic_jack_pin_configs, -- } -+ }, -+ [STAC_92HD73XX_ASUS_MOBO] = { -+ .type = HDA_FIXUP_PINS, -+ .v.pins = (const struct hda_pintbl[]) { -+ /* enable 5.1 and SPDIF out */ -+ { 0x0c, 0x01014411 }, -+ { 0x0d, 0x01014410 }, -+ { 0x0e, 0x01014412 }, -+ { 0x22, 0x014b1180 }, -+ { } -+ } -+ }, - }; - - static const struct hda_model_fixup stac92hd73xx_models[] = { -@@ -1947,6 +1959,7 @@ static const struct hda_model_fixup stac92hd73xx_models[] = { - { .id = STAC_DELL_M6_BOTH, .name = "dell-m6" }, - { .id = STAC_DELL_EQ, .name = "dell-eq" }, - { .id = STAC_ALIENWARE_M17X, .name = "alienware" }, -+ { .id = STAC_92HD73XX_ASUS_MOBO, .name = "asus-mobo" }, - {} - }; - -@@ -1999,6 +2012,8 @@ static const struct snd_pci_quirk stac92hd73xx_fixup_tbl[] = { - "HP Z1 G2", STAC_92HD89XX_HP_Z1_G2_RIGHT_MIC_JACK), - SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x2b17, - "unknown HP", STAC_92HD89XX_HP_FRONT_JACK), -+ SND_PCI_QUIRK(PCI_VENDOR_ID_ASUSTEK, 0x83f8, "ASUS AT4NM10", -+ STAC_92HD73XX_ASUS_MOBO), - {} /* terminator */ - }; - -diff --git a/sound/soc/omap/omap-pcm.c b/sound/soc/omap/omap-pcm.c -index 07b8b7bc9d20..81f6a7545ef5 100644 ---- a/sound/soc/omap/omap-pcm.c -+++ b/sound/soc/omap/omap-pcm.c -@@ -200,7 +200,7 @@ static int omap_pcm_new(struct snd_soc_pcm_runtime *rtd) - struct snd_pcm *pcm = rtd->pcm; - int ret; - -- ret = dma_coerce_mask_and_coherent(card->dev, DMA_BIT_MASK(64)); -+ ret = dma_coerce_mask_and_coherent(card->dev, DMA_BIT_MASK(32)); - if (ret) - return ret; - diff --git a/patch/kernel/odroidc2-default/patch-3.14.36-37.patch b/patch/kernel/odroidc2-default/patch-3.14.36-37.patch deleted file mode 100644 index d9099b75d0..0000000000 --- a/patch/kernel/odroidc2-default/patch-3.14.36-37.patch +++ /dev/null @@ -1,2847 +0,0 @@ -diff --git a/Makefile b/Makefile -index 4e6537bd8aa0..c24acc0d34a1 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 3 - PATCHLEVEL = 14 --SUBLEVEL = 36 -+SUBLEVEL = 37 - EXTRAVERSION = - NAME = Remembering Coco - -diff --git a/arch/arm/boot/dts/dra7xx-clocks.dtsi b/arch/arm/boot/dts/dra7xx-clocks.dtsi -index e96da9a898ad..f2512e1d28c7 100644 ---- a/arch/arm/boot/dts/dra7xx-clocks.dtsi -+++ b/arch/arm/boot/dts/dra7xx-clocks.dtsi -@@ -243,10 +243,18 @@ - ti,invert-autoidle-bit; - }; - -+ dpll_core_byp_mux: dpll_core_byp_mux { -+ #clock-cells = <0>; -+ compatible = "ti,mux-clock"; -+ clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>; -+ ti,bit-shift = <23>; -+ reg = <0x012c>; -+ }; -+ - dpll_core_ck: dpll_core_ck { - #clock-cells = <0>; - compatible = "ti,omap4-dpll-core-clock"; -- clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>; -+ clocks = <&sys_clkin1>, <&dpll_core_byp_mux>; - reg = <0x0120>, <0x0124>, <0x012c>, <0x0128>; - }; - -@@ -309,10 +317,18 @@ - clock-div = <1>; - }; - -+ dpll_dsp_byp_mux: dpll_dsp_byp_mux { -+ #clock-cells = <0>; -+ compatible = "ti,mux-clock"; -+ clocks = <&sys_clkin1>, <&dsp_dpll_hs_clk_div>; -+ ti,bit-shift = <23>; -+ reg = <0x0240>; -+ }; -+ - dpll_dsp_ck: dpll_dsp_ck { - #clock-cells = <0>; - compatible = "ti,omap4-dpll-clock"; -- clocks = <&sys_clkin1>, <&dsp_dpll_hs_clk_div>; -+ clocks = <&sys_clkin1>, <&dpll_dsp_byp_mux>; - reg = <0x0234>, <0x0238>, <0x0240>, <0x023c>; - }; - -@@ -335,10 +351,18 @@ - clock-div = <1>; - }; - -+ dpll_iva_byp_mux: dpll_iva_byp_mux { -+ #clock-cells = <0>; -+ compatible = "ti,mux-clock"; -+ clocks = <&sys_clkin1>, <&iva_dpll_hs_clk_div>; -+ ti,bit-shift = <23>; -+ reg = <0x01ac>; -+ }; -+ - dpll_iva_ck: dpll_iva_ck { - #clock-cells = <0>; - compatible = "ti,omap4-dpll-clock"; -- clocks = <&sys_clkin1>, <&iva_dpll_hs_clk_div>; -+ clocks = <&sys_clkin1>, <&dpll_iva_byp_mux>; - reg = <0x01a0>, <0x01a4>, <0x01ac>, <0x01a8>; - }; - -@@ -361,10 +385,18 @@ - clock-div = <1>; - }; - -+ dpll_gpu_byp_mux: dpll_gpu_byp_mux { -+ #clock-cells = <0>; -+ compatible = "ti,mux-clock"; -+ clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>; -+ ti,bit-shift = <23>; -+ reg = <0x02e4>; -+ }; -+ - dpll_gpu_ck: dpll_gpu_ck { - #clock-cells = <0>; - compatible = "ti,omap4-dpll-clock"; -- clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>; -+ clocks = <&sys_clkin1>, <&dpll_gpu_byp_mux>; - reg = <0x02d8>, <0x02dc>, <0x02e4>, <0x02e0>; - }; - -@@ -398,10 +430,18 @@ - clock-div = <1>; - }; - -+ dpll_ddr_byp_mux: dpll_ddr_byp_mux { -+ #clock-cells = <0>; -+ compatible = "ti,mux-clock"; -+ clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>; -+ ti,bit-shift = <23>; -+ reg = <0x021c>; -+ }; -+ - dpll_ddr_ck: dpll_ddr_ck { - #clock-cells = <0>; - compatible = "ti,omap4-dpll-clock"; -- clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>; -+ clocks = <&sys_clkin1>, <&dpll_ddr_byp_mux>; - reg = <0x0210>, <0x0214>, <0x021c>, <0x0218>; - }; - -@@ -416,10 +456,18 @@ - ti,invert-autoidle-bit; - }; - -+ dpll_gmac_byp_mux: dpll_gmac_byp_mux { -+ #clock-cells = <0>; -+ compatible = "ti,mux-clock"; -+ clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>; -+ ti,bit-shift = <23>; -+ reg = <0x02b4>; -+ }; -+ - dpll_gmac_ck: dpll_gmac_ck { - #clock-cells = <0>; - compatible = "ti,omap4-dpll-clock"; -- clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>; -+ clocks = <&sys_clkin1>, <&dpll_gmac_byp_mux>; - reg = <0x02a8>, <0x02ac>, <0x02b4>, <0x02b0>; - }; - -@@ -482,10 +530,18 @@ - clock-div = <1>; - }; - -+ dpll_eve_byp_mux: dpll_eve_byp_mux { -+ #clock-cells = <0>; -+ compatible = "ti,mux-clock"; -+ clocks = <&sys_clkin1>, <&eve_dpll_hs_clk_div>; -+ ti,bit-shift = <23>; -+ reg = <0x0290>; -+ }; -+ - dpll_eve_ck: dpll_eve_ck { - #clock-cells = <0>; - compatible = "ti,omap4-dpll-clock"; -- clocks = <&sys_clkin1>, <&eve_dpll_hs_clk_div>; -+ clocks = <&sys_clkin1>, <&dpll_eve_byp_mux>; - reg = <0x0284>, <0x0288>, <0x0290>, <0x028c>; - }; - -@@ -1214,10 +1270,18 @@ - clock-div = <1>; - }; - -+ dpll_per_byp_mux: dpll_per_byp_mux { -+ #clock-cells = <0>; -+ compatible = "ti,mux-clock"; -+ clocks = <&sys_clkin1>, <&per_dpll_hs_clk_div>; -+ ti,bit-shift = <23>; -+ reg = <0x014c>; -+ }; -+ - dpll_per_ck: dpll_per_ck { - #clock-cells = <0>; - compatible = "ti,omap4-dpll-clock"; -- clocks = <&sys_clkin1>, <&per_dpll_hs_clk_div>; -+ clocks = <&sys_clkin1>, <&dpll_per_byp_mux>; - reg = <0x0140>, <0x0144>, <0x014c>, <0x0148>; - }; - -@@ -1240,10 +1304,18 @@ - clock-div = <1>; - }; - -+ dpll_usb_byp_mux: dpll_usb_byp_mux { -+ #clock-cells = <0>; -+ compatible = "ti,mux-clock"; -+ clocks = <&sys_clkin1>, <&usb_dpll_hs_clk_div>; -+ ti,bit-shift = <23>; -+ reg = <0x018c>; -+ }; -+ - dpll_usb_ck: dpll_usb_ck { - #clock-cells = <0>; - compatible = "ti,omap4-dpll-j-type-clock"; -- clocks = <&sys_clkin1>, <&usb_dpll_hs_clk_div>; -+ clocks = <&sys_clkin1>, <&dpll_usb_byp_mux>; - reg = <0x0180>, <0x0184>, <0x018c>, <0x0188>; - }; - -diff --git a/arch/arm/crypto/aesbs-core.S_shipped b/arch/arm/crypto/aesbs-core.S_shipped -index 71e5fc7cfb18..1d1800f71c5b 100644 ---- a/arch/arm/crypto/aesbs-core.S_shipped -+++ b/arch/arm/crypto/aesbs-core.S_shipped -@@ -58,14 +58,18 @@ - # define VFP_ABI_FRAME 0 - # define BSAES_ASM_EXTENDED_KEY - # define XTS_CHAIN_TWEAK --# define __ARM_ARCH__ 7 -+# define __ARM_ARCH__ __LINUX_ARM_ARCH__ -+# define __ARM_MAX_ARCH__ 7 - #endif - - #ifdef __thumb__ - # define adrl adr - #endif - --#if __ARM_ARCH__>=7 -+#if __ARM_MAX_ARCH__>=7 -+.arch armv7-a -+.fpu neon -+ - .text - .syntax unified @ ARMv7-capable assembler is expected to handle this - #ifdef __thumb2__ -@@ -74,8 +78,6 @@ - .code 32 - #endif - --.fpu neon -- - .type _bsaes_decrypt8,%function - .align 4 - _bsaes_decrypt8: -@@ -2095,9 +2097,11 @@ bsaes_xts_decrypt: - vld1.8 {q8}, [r0] @ initial tweak - adr r2, .Lxts_magic - -+#ifndef XTS_CHAIN_TWEAK - tst r9, #0xf @ if not multiple of 16 - it ne @ Thumb2 thing, sanity check in ARM - subne r9, #0x10 @ subtract another 16 bytes -+#endif - subs r9, #0x80 - - blo .Lxts_dec_short -diff --git a/arch/arm/crypto/bsaes-armv7.pl b/arch/arm/crypto/bsaes-armv7.pl -index be068db960ee..a4d3856e7d24 100644 ---- a/arch/arm/crypto/bsaes-armv7.pl -+++ b/arch/arm/crypto/bsaes-armv7.pl -@@ -701,14 +701,18 @@ $code.=<<___; - # define VFP_ABI_FRAME 0 - # define BSAES_ASM_EXTENDED_KEY - # define XTS_CHAIN_TWEAK --# define __ARM_ARCH__ 7 -+# define __ARM_ARCH__ __LINUX_ARM_ARCH__ -+# define __ARM_MAX_ARCH__ 7 - #endif - - #ifdef __thumb__ - # define adrl adr - #endif - --#if __ARM_ARCH__>=7 -+#if __ARM_MAX_ARCH__>=7 -+.arch armv7-a -+.fpu neon -+ - .text - .syntax unified @ ARMv7-capable assembler is expected to handle this - #ifdef __thumb2__ -@@ -717,8 +721,6 @@ $code.=<<___; - .code 32 - #endif - --.fpu neon -- - .type _bsaes_decrypt8,%function - .align 4 - _bsaes_decrypt8: -@@ -2076,9 +2078,11 @@ bsaes_xts_decrypt: - vld1.8 {@XMM[8]}, [r0] @ initial tweak - adr $magic, .Lxts_magic - -+#ifndef XTS_CHAIN_TWEAK - tst $len, #0xf @ if not multiple of 16 - it ne @ Thumb2 thing, sanity check in ARM - subne $len, #0x10 @ subtract another 16 bytes -+#endif - subs $len, #0x80 - - blo .Lxts_dec_short -diff --git a/arch/arm/mach-at91/pm.h b/arch/arm/mach-at91/pm.h -index c5101dcb4fb0..1d4df3b70ebc 100644 ---- a/arch/arm/mach-at91/pm.h -+++ b/arch/arm/mach-at91/pm.h -@@ -45,7 +45,7 @@ static inline void at91rm9200_standby(void) - " mcr p15, 0, %0, c7, c0, 4\n\t" - " str %5, [%1, %2]" - : -- : "r" (0), "r" (AT91_BASE_SYS), "r" (AT91RM9200_SDRAMC_LPR), -+ : "r" (0), "r" (at91_ramc_base[0]), "r" (AT91RM9200_SDRAMC_LPR), - "r" (1), "r" (AT91RM9200_SDRAMC_SRR), - "r" (lpr)); - } -diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c -index fbd76785c5db..3974881388bb 100644 ---- a/arch/arm64/mm/dma-mapping.c -+++ b/arch/arm64/mm/dma-mapping.c -@@ -44,6 +44,7 @@ static void *arm64_swiotlb_alloc_coherent(struct device *dev, size_t size, - flags |= GFP_DMA32; - if (IS_ENABLED(CONFIG_DMA_CMA)) { - struct page *page; -+ void *addr; - - size = PAGE_ALIGN(size); - page = dma_alloc_from_contiguous(dev, size >> PAGE_SHIFT, -@@ -52,7 +53,10 @@ static void *arm64_swiotlb_alloc_coherent(struct device *dev, size_t size, - return NULL; - - *dma_handle = phys_to_dma(dev, page_to_phys(page)); -- return page_address(page); -+ addr = page_address(page); -+ if (flags & __GFP_ZERO) -+ memset(addr, 0, size); -+ return addr; - } else { - return swiotlb_alloc_coherent(dev, size, dma_handle, flags); - } -diff --git a/arch/sparc/kernel/perf_event.c b/arch/sparc/kernel/perf_event.c -index 617b9fe33771..3ccb6777a7e1 100644 ---- a/arch/sparc/kernel/perf_event.c -+++ b/arch/sparc/kernel/perf_event.c -@@ -960,6 +960,8 @@ out: - cpuc->pcr[0] |= cpuc->event[0]->hw.config_base; - } - -+static void sparc_pmu_start(struct perf_event *event, int flags); -+ - /* On this PMU each PIC has it's own PCR control register. */ - static void calculate_multiple_pcrs(struct cpu_hw_events *cpuc) - { -@@ -972,20 +974,13 @@ static void calculate_multiple_pcrs(struct cpu_hw_events *cpuc) - struct perf_event *cp = cpuc->event[i]; - struct hw_perf_event *hwc = &cp->hw; - int idx = hwc->idx; -- u64 enc; - - if (cpuc->current_idx[i] != PIC_NO_INDEX) - continue; - -- sparc_perf_event_set_period(cp, hwc, idx); - cpuc->current_idx[i] = idx; - -- enc = perf_event_get_enc(cpuc->events[i]); -- cpuc->pcr[idx] &= ~mask_for_index(idx); -- if (hwc->state & PERF_HES_STOPPED) -- cpuc->pcr[idx] |= nop_for_index(idx); -- else -- cpuc->pcr[idx] |= event_encoding(enc, idx); -+ sparc_pmu_start(cp, PERF_EF_RELOAD); - } - out: - for (i = 0; i < cpuc->n_events; i++) { -@@ -1101,7 +1096,6 @@ static void sparc_pmu_del(struct perf_event *event, int _flags) - int i; - - local_irq_save(flags); -- perf_pmu_disable(event->pmu); - - for (i = 0; i < cpuc->n_events; i++) { - if (event == cpuc->event[i]) { -@@ -1127,7 +1121,6 @@ static void sparc_pmu_del(struct perf_event *event, int _flags) - } - } - -- perf_pmu_enable(event->pmu); - local_irq_restore(flags); - } - -@@ -1361,7 +1354,6 @@ static int sparc_pmu_add(struct perf_event *event, int ef_flags) - unsigned long flags; - - local_irq_save(flags); -- perf_pmu_disable(event->pmu); - - n0 = cpuc->n_events; - if (n0 >= sparc_pmu->max_hw_events) -@@ -1394,7 +1386,6 @@ nocheck: - - ret = 0; - out: -- perf_pmu_enable(event->pmu); - local_irq_restore(flags); - return ret; - } -diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c -index c6f7113b6e2f..1a79d6877981 100644 ---- a/arch/sparc/kernel/process_64.c -+++ b/arch/sparc/kernel/process_64.c -@@ -281,6 +281,8 @@ void arch_trigger_all_cpu_backtrace(void) - printk(" TPC[%lx] O7[%lx] I7[%lx] RPC[%lx]\n", - gp->tpc, gp->o7, gp->i7, gp->rpc); - } -+ -+ touch_nmi_watchdog(); - } - - memset(global_cpu_snapshot, 0, sizeof(global_cpu_snapshot)); -@@ -356,6 +358,8 @@ static void pmu_snapshot_all_cpus(void) - (cpu == this_cpu ? '*' : ' '), cpu, - pp->pcr[0], pp->pcr[1], pp->pcr[2], pp->pcr[3], - pp->pic[0], pp->pic[1], pp->pic[2], pp->pic[3]); -+ -+ touch_nmi_watchdog(); - } - - memset(global_cpu_snapshot, 0, sizeof(global_cpu_snapshot)); -diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c -index beb0b5a5f21f..25db14a33d03 100644 ---- a/arch/sparc/kernel/sys_sparc_64.c -+++ b/arch/sparc/kernel/sys_sparc_64.c -@@ -332,7 +332,7 @@ SYSCALL_DEFINE6(sparc_ipc, unsigned int, call, int, first, unsigned long, second - long err; - - /* No need for backward compatibility. We can start fresh... */ -- if (call <= SEMCTL) { -+ if (call <= SEMTIMEDOP) { - switch (call) { - case SEMOP: - err = sys_semtimedop(first, ptr, -diff --git a/arch/sparc/lib/memmove.S b/arch/sparc/lib/memmove.S -index b7f6334e159f..857ad4f8905f 100644 ---- a/arch/sparc/lib/memmove.S -+++ b/arch/sparc/lib/memmove.S -@@ -8,9 +8,11 @@ - - .text - ENTRY(memmove) /* o0=dst o1=src o2=len */ -- mov %o0, %g1 -+ brz,pn %o2, 99f -+ mov %o0, %g1 -+ - cmp %o0, %o1 -- bleu,pt %xcc, memcpy -+ bleu,pt %xcc, 2f - add %o1, %o2, %g7 - cmp %g7, %o0 - bleu,pt %xcc, memcpy -@@ -24,7 +26,34 @@ ENTRY(memmove) /* o0=dst o1=src o2=len */ - stb %g7, [%o0] - bne,pt %icc, 1b - sub %o0, 1, %o0 -- -+99: - retl - mov %g1, %o0 -+ -+ /* We can't just call memcpy for these memmove cases. On some -+ * chips the memcpy uses cache initializing stores and when dst -+ * and src are close enough, those can clobber the source data -+ * before we've loaded it in. -+ */ -+2: or %o0, %o1, %g7 -+ or %o2, %g7, %g7 -+ andcc %g7, 0x7, %g0 -+ bne,pn %xcc, 4f -+ nop -+ -+3: ldx [%o1], %g7 -+ add %o1, 8, %o1 -+ subcc %o2, 8, %o2 -+ add %o0, 8, %o0 -+ bne,pt %icc, 3b -+ stx %g7, [%o0 - 0x8] -+ ba,a,pt %xcc, 99b -+ -+4: ldub [%o1], %g7 -+ add %o1, 1, %o1 -+ subcc %o2, 1, %o2 -+ add %o0, 1, %o0 -+ bne,pt %icc, 4b -+ stb %g7, [%o0 - 0x1] -+ ba,a,pt %xcc, 99b - ENDPROC(memmove) -diff --git a/arch/sparc/mm/srmmu.c b/arch/sparc/mm/srmmu.c -index cfbe53c17b0d..09daebdee552 100644 ---- a/arch/sparc/mm/srmmu.c -+++ b/arch/sparc/mm/srmmu.c -@@ -460,10 +460,12 @@ static void __init sparc_context_init(int numctx) - void switch_mm(struct mm_struct *old_mm, struct mm_struct *mm, - struct task_struct *tsk) - { -+ unsigned long flags; -+ - if (mm->context == NO_CONTEXT) { -- spin_lock(&srmmu_context_spinlock); -+ spin_lock_irqsave(&srmmu_context_spinlock, flags); - alloc_context(old_mm, mm); -- spin_unlock(&srmmu_context_spinlock); -+ spin_unlock_irqrestore(&srmmu_context_spinlock, flags); - srmmu_ctxd_set(&srmmu_context_table[mm->context], mm->pgd); - } - -@@ -988,14 +990,15 @@ int init_new_context(struct task_struct *tsk, struct mm_struct *mm) - - void destroy_context(struct mm_struct *mm) - { -+ unsigned long flags; - - if (mm->context != NO_CONTEXT) { - flush_cache_mm(mm); - srmmu_ctxd_set(&srmmu_context_table[mm->context], srmmu_swapper_pg_dir); - flush_tlb_mm(mm); -- spin_lock(&srmmu_context_spinlock); -+ spin_lock_irqsave(&srmmu_context_spinlock, flags); - free_context(mm->context); -- spin_unlock(&srmmu_context_spinlock); -+ spin_unlock_irqrestore(&srmmu_context_spinlock, flags); - mm->context = NO_CONTEXT; - } - } -diff --git a/arch/x86/crypto/aesni-intel_glue.c b/arch/x86/crypto/aesni-intel_glue.c -index 6dfb7d0b139a..6d4fabac779c 100644 ---- a/arch/x86/crypto/aesni-intel_glue.c -+++ b/arch/x86/crypto/aesni-intel_glue.c -@@ -1109,7 +1109,7 @@ static int __driver_rfc4106_decrypt(struct aead_request *req) - src = kmalloc(req->cryptlen + req->assoclen, GFP_ATOMIC); - if (!src) - return -ENOMEM; -- assoc = (src + req->cryptlen + auth_tag_len); -+ assoc = (src + req->cryptlen); - scatterwalk_map_and_copy(src, req->src, 0, req->cryptlen, 0); - scatterwalk_map_and_copy(assoc, req->assoc, 0, - req->assoclen, 0); -@@ -1134,7 +1134,7 @@ static int __driver_rfc4106_decrypt(struct aead_request *req) - scatterwalk_done(&src_sg_walk, 0, 0); - scatterwalk_done(&assoc_sg_walk, 0, 0); - } else { -- scatterwalk_map_and_copy(dst, req->dst, 0, req->cryptlen, 1); -+ scatterwalk_map_and_copy(dst, req->dst, 0, tempCipherLen, 1); - kfree(src); - } - return retval; -diff --git a/arch/x86/include/asm/fpu-internal.h b/arch/x86/include/asm/fpu-internal.h -index cea1c76d49bf..1ac1c009090d 100644 ---- a/arch/x86/include/asm/fpu-internal.h -+++ b/arch/x86/include/asm/fpu-internal.h -@@ -368,7 +368,7 @@ static inline void drop_fpu(struct task_struct *tsk) - preempt_disable(); - tsk->thread.fpu_counter = 0; - __drop_fpu(tsk); -- clear_used_math(); -+ clear_stopped_child_used_math(tsk); - preempt_enable(); - } - -diff --git a/arch/x86/kernel/xsave.c b/arch/x86/kernel/xsave.c -index dd50e26c58f6..7a09aca4b33a 100644 ---- a/arch/x86/kernel/xsave.c -+++ b/arch/x86/kernel/xsave.c -@@ -375,7 +375,7 @@ int __restore_xstate_sig(void __user *buf, void __user *buf_fx, int size) - * thread's fpu state, reconstruct fxstate from the fsave - * header. Sanitize the copied state etc. - */ -- struct xsave_struct *xsave = &tsk->thread.fpu.state->xsave; -+ struct fpu *fpu = &tsk->thread.fpu; - struct user_i387_ia32_struct env; - int err = 0; - -@@ -389,14 +389,15 @@ int __restore_xstate_sig(void __user *buf, void __user *buf_fx, int size) - */ - drop_fpu(tsk); - -- if (__copy_from_user(xsave, buf_fx, state_size) || -+ if (__copy_from_user(&fpu->state->xsave, buf_fx, state_size) || - __copy_from_user(&env, buf, sizeof(env))) { -+ fpu_finit(fpu); - err = -1; - } else { - sanitize_restored_xstate(tsk, &env, xstate_bv, fx_only); -- set_used_math(); - } - -+ set_used_math(); - if (use_eager_fpu()) { - preempt_disable(); - math_state_restore(); -diff --git a/arch/x86/vdso/vdso32/sigreturn.S b/arch/x86/vdso/vdso32/sigreturn.S -index 31776d0efc8c..d7ec4e251c0a 100644 ---- a/arch/x86/vdso/vdso32/sigreturn.S -+++ b/arch/x86/vdso/vdso32/sigreturn.S -@@ -17,6 +17,7 @@ - .text - .globl __kernel_sigreturn - .type __kernel_sigreturn,@function -+ nop /* this guy is needed for .LSTARTFDEDLSI1 below (watch for HACK) */ - ALIGN - __kernel_sigreturn: - .LSTART_sigreturn: -diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c -index eff9d5870034..102463ba745d 100644 ---- a/drivers/char/tpm/tpm_ibmvtpm.c -+++ b/drivers/char/tpm/tpm_ibmvtpm.c -@@ -124,7 +124,7 @@ static int tpm_ibmvtpm_send(struct tpm_chip *chip, u8 *buf, size_t count) - { - struct ibmvtpm_dev *ibmvtpm; - struct ibmvtpm_crq crq; -- u64 *word = (u64 *) &crq; -+ __be64 *word = (__be64 *)&crq; - int rc; - - ibmvtpm = (struct ibmvtpm_dev *)TPM_VPRIV(chip); -@@ -145,11 +145,11 @@ static int tpm_ibmvtpm_send(struct tpm_chip *chip, u8 *buf, size_t count) - memcpy((void *)ibmvtpm->rtce_buf, (void *)buf, count); - crq.valid = (u8)IBMVTPM_VALID_CMD; - crq.msg = (u8)VTPM_TPM_COMMAND; -- crq.len = (u16)count; -- crq.data = ibmvtpm->rtce_dma_handle; -+ crq.len = cpu_to_be16(count); -+ crq.data = cpu_to_be32(ibmvtpm->rtce_dma_handle); - -- rc = ibmvtpm_send_crq(ibmvtpm->vdev, cpu_to_be64(word[0]), -- cpu_to_be64(word[1])); -+ rc = ibmvtpm_send_crq(ibmvtpm->vdev, be64_to_cpu(word[0]), -+ be64_to_cpu(word[1])); - if (rc != H_SUCCESS) { - dev_err(ibmvtpm->dev, "tpm_ibmvtpm_send failed rc=%d\n", rc); - rc = 0; -diff --git a/drivers/char/tpm/tpm_ibmvtpm.h b/drivers/char/tpm/tpm_ibmvtpm.h -index bd82a791f995..b2c231b1beec 100644 ---- a/drivers/char/tpm/tpm_ibmvtpm.h -+++ b/drivers/char/tpm/tpm_ibmvtpm.h -@@ -22,9 +22,9 @@ - struct ibmvtpm_crq { - u8 valid; - u8 msg; -- u16 len; -- u32 data; -- u64 reserved; -+ __be16 len; -+ __be32 data; -+ __be64 reserved; - } __attribute__((packed, aligned(8))); - - struct ibmvtpm_crq_queue { -diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c -index 6928d094451d..b08eadb4b1d2 100644 ---- a/drivers/char/virtio_console.c -+++ b/drivers/char/virtio_console.c -@@ -142,6 +142,7 @@ struct ports_device { - * notification - */ - struct work_struct control_work; -+ struct work_struct config_work; - - struct list_head ports; - -@@ -1832,10 +1833,21 @@ static void config_intr(struct virtio_device *vdev) - - portdev = vdev->priv; - -+ if (!use_multiport(portdev)) -+ schedule_work(&portdev->config_work); -+} -+ -+static void config_work_handler(struct work_struct *work) -+{ -+ struct ports_device *portdev; -+ -+ portdev = container_of(work, struct ports_device, control_work); - if (!use_multiport(portdev)) { -+ struct virtio_device *vdev; - struct port *port; - u16 rows, cols; - -+ vdev = portdev->vdev; - virtio_cread(vdev, struct virtio_console_config, cols, &cols); - virtio_cread(vdev, struct virtio_console_config, rows, &rows); - -@@ -2024,12 +2036,14 @@ static int virtcons_probe(struct virtio_device *vdev) - spin_lock_init(&portdev->ports_lock); - INIT_LIST_HEAD(&portdev->ports); - -+ INIT_WORK(&portdev->config_work, &config_work_handler); -+ INIT_WORK(&portdev->control_work, &control_work_handler); -+ - if (multiport) { - unsigned int nr_added_bufs; - - spin_lock_init(&portdev->c_ivq_lock); - spin_lock_init(&portdev->c_ovq_lock); -- INIT_WORK(&portdev->control_work, &control_work_handler); - - nr_added_bufs = fill_queue(portdev->c_ivq, - &portdev->c_ivq_lock); -@@ -2097,6 +2111,8 @@ static void virtcons_remove(struct virtio_device *vdev) - /* Finish up work that's lined up */ - if (use_multiport(portdev)) - cancel_work_sync(&portdev->control_work); -+ else -+ cancel_work_sync(&portdev->config_work); - - list_for_each_entry_safe(port, port2, &portdev->ports, list) - unplug_port(port); -@@ -2148,6 +2164,7 @@ static int virtcons_freeze(struct virtio_device *vdev) - - virtqueue_disable_cb(portdev->c_ivq); - cancel_work_sync(&portdev->control_work); -+ cancel_work_sync(&portdev->config_work); - /* - * Once more: if control_work_handler() was running, it would - * enable the cb as the last step. -diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c -index 0cca5f24196a..663394f0c166 100644 ---- a/drivers/gpu/drm/radeon/atombios_crtc.c -+++ b/drivers/gpu/drm/radeon/atombios_crtc.c -@@ -1306,6 +1306,9 @@ static int dce4_crtc_do_set_base(struct drm_crtc *crtc, - (x << 16) | y); - viewport_w = crtc->mode.hdisplay; - viewport_h = (crtc->mode.vdisplay + 1) & ~1; -+ if ((rdev->family >= CHIP_BONAIRE) && -+ (crtc->mode.flags & DRM_MODE_FLAG_INTERLACE)) -+ viewport_h *= 2; - WREG32(EVERGREEN_VIEWPORT_SIZE + radeon_crtc->crtc_offset, - (viewport_w << 16) | viewport_h); - -diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c -index f0ed0baddf70..c3664bc05acf 100644 ---- a/drivers/gpu/drm/radeon/cik.c -+++ b/drivers/gpu/drm/radeon/cik.c -@@ -7069,6 +7069,9 @@ int cik_irq_set(struct radeon_device *rdev) - WREG32(DC_HPD5_INT_CONTROL, hpd5); - WREG32(DC_HPD6_INT_CONTROL, hpd6); - -+ /* posting read */ -+ RREG32(SRBM_STATUS); -+ - return 0; - } - -diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c -index 7138f3e31b7c..ee9f0b4e90d6 100644 ---- a/drivers/gpu/drm/radeon/evergreen.c -+++ b/drivers/gpu/drm/radeon/evergreen.c -@@ -4596,6 +4596,9 @@ int evergreen_irq_set(struct radeon_device *rdev) - WREG32(AFMT_AUDIO_PACKET_CONTROL + EVERGREEN_CRTC4_REGISTER_OFFSET, afmt5); - WREG32(AFMT_AUDIO_PACKET_CONTROL + EVERGREEN_CRTC5_REGISTER_OFFSET, afmt6); - -+ /* posting read */ -+ RREG32(SRBM_STATUS); -+ - return 0; - } - -diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c -index 07620e198a6d..e28de20d469a 100644 ---- a/drivers/gpu/drm/radeon/r100.c -+++ b/drivers/gpu/drm/radeon/r100.c -@@ -742,6 +742,10 @@ int r100_irq_set(struct radeon_device *rdev) - tmp |= RADEON_FP2_DETECT_MASK; - } - WREG32(RADEON_GEN_INT_CNTL, tmp); -+ -+ /* read back to post the write */ -+ RREG32(RADEON_GEN_INT_CNTL); -+ - return 0; - } - -diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c -index 788f602e8989..74a8a38db4d5 100644 ---- a/drivers/gpu/drm/radeon/r600.c -+++ b/drivers/gpu/drm/radeon/r600.c -@@ -3647,6 +3647,9 @@ int r600_irq_set(struct radeon_device *rdev) - WREG32(RV770_CG_THERMAL_INT, thermal_int); - } - -+ /* posting read */ -+ RREG32(R_000E50_SRBM_STATUS); -+ - return 0; - } - -diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c -index 7f2d6c0d11c1..2f2d2ce34709 100644 ---- a/drivers/gpu/drm/radeon/radeon_cs.c -+++ b/drivers/gpu/drm/radeon/radeon_cs.c -@@ -179,11 +179,13 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data) - u32 ring = RADEON_CS_RING_GFX; - s32 priority = 0; - -+ INIT_LIST_HEAD(&p->validated); -+ - if (!cs->num_chunks) { - return 0; - } -+ - /* get chunks */ -- INIT_LIST_HEAD(&p->validated); - p->idx = 0; - p->ib.sa_bo = NULL; - p->ib.semaphore = NULL; -diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c -index e5619d5e2a30..4261b3865cb0 100644 ---- a/drivers/gpu/drm/radeon/rs600.c -+++ b/drivers/gpu/drm/radeon/rs600.c -@@ -700,6 +700,10 @@ int rs600_irq_set(struct radeon_device *rdev) - WREG32(R_007D18_DC_HOT_PLUG_DETECT2_INT_CONTROL, hpd2); - if (ASIC_IS_DCE2(rdev)) - WREG32(R_007408_HDMI0_AUDIO_PACKET_CONTROL, hdmi0); -+ -+ /* posting read */ -+ RREG32(R_000040_GEN_INT_CNTL); -+ - return 0; - } - -diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c -index 52b64ad285d6..2f2deccb3b78 100644 ---- a/drivers/gpu/drm/radeon/si.c -+++ b/drivers/gpu/drm/radeon/si.c -@@ -5958,6 +5958,9 @@ int si_irq_set(struct radeon_device *rdev) - - WREG32(CG_THERMAL_INT, thermal_int); - -+ /* posting read */ -+ RREG32(SRBM_STATUS); -+ - return 0; - } - -@@ -6875,8 +6878,7 @@ int si_set_uvd_clocks(struct radeon_device *rdev, u32 vclk, u32 dclk) - WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_BYPASS_EN_MASK, ~UPLL_BYPASS_EN_MASK); - - if (!vclk || !dclk) { -- /* keep the Bypass mode, put PLL to sleep */ -- WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_SLEEP_MASK, ~UPLL_SLEEP_MASK); -+ /* keep the Bypass mode */ - return 0; - } - -@@ -6892,8 +6894,7 @@ int si_set_uvd_clocks(struct radeon_device *rdev, u32 vclk, u32 dclk) - /* set VCO_MODE to 1 */ - WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_VCO_MODE_MASK, ~UPLL_VCO_MODE_MASK); - -- /* toggle UPLL_SLEEP to 1 then back to 0 */ -- WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_SLEEP_MASK, ~UPLL_SLEEP_MASK); -+ /* disable sleep mode */ - WREG32_P(CG_UPLL_FUNC_CNTL, 0, ~UPLL_SLEEP_MASK); - - /* deassert UPLL_RESET */ -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c -index fb7c36e93fd4..0771dcbf9ed0 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c -@@ -733,32 +733,6 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset) - goto out_err1; - } - -- ret = ttm_bo_init_mm(&dev_priv->bdev, TTM_PL_VRAM, -- (dev_priv->vram_size >> PAGE_SHIFT)); -- if (unlikely(ret != 0)) { -- DRM_ERROR("Failed initializing memory manager for VRAM.\n"); -- goto out_err2; -- } -- -- dev_priv->has_gmr = true; -- if (((dev_priv->capabilities & (SVGA_CAP_GMR | SVGA_CAP_GMR2)) == 0) || -- refuse_dma || ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_GMR, -- VMW_PL_GMR) != 0) { -- DRM_INFO("No GMR memory available. " -- "Graphics memory resources are very limited.\n"); -- dev_priv->has_gmr = false; -- } -- -- if (dev_priv->capabilities & SVGA_CAP_GBOBJECTS) { -- dev_priv->has_mob = true; -- if (ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_MOB, -- VMW_PL_MOB) != 0) { -- DRM_INFO("No MOB memory available. " -- "3D will be disabled.\n"); -- dev_priv->has_mob = false; -- } -- } -- - dev_priv->mmio_mtrr = arch_phys_wc_add(dev_priv->mmio_start, - dev_priv->mmio_size); - -@@ -821,6 +795,33 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset) - goto out_no_fman; - } - -+ -+ ret = ttm_bo_init_mm(&dev_priv->bdev, TTM_PL_VRAM, -+ (dev_priv->vram_size >> PAGE_SHIFT)); -+ if (unlikely(ret != 0)) { -+ DRM_ERROR("Failed initializing memory manager for VRAM.\n"); -+ goto out_no_vram; -+ } -+ -+ dev_priv->has_gmr = true; -+ if (((dev_priv->capabilities & (SVGA_CAP_GMR | SVGA_CAP_GMR2)) == 0) || -+ refuse_dma || ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_GMR, -+ VMW_PL_GMR) != 0) { -+ DRM_INFO("No GMR memory available. " -+ "Graphics memory resources are very limited.\n"); -+ dev_priv->has_gmr = false; -+ } -+ -+ if (dev_priv->capabilities & SVGA_CAP_GBOBJECTS) { -+ dev_priv->has_mob = true; -+ if (ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_MOB, -+ VMW_PL_MOB) != 0) { -+ DRM_INFO("No MOB memory available. " -+ "3D will be disabled.\n"); -+ dev_priv->has_mob = false; -+ } -+ } -+ - vmw_kms_save_vga(dev_priv); - - /* Start kms and overlay systems, needs fifo. */ -@@ -846,6 +847,12 @@ out_no_fifo: - vmw_kms_close(dev_priv); - out_no_kms: - vmw_kms_restore_vga(dev_priv); -+ if (dev_priv->has_mob) -+ (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB); -+ if (dev_priv->has_gmr) -+ (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR); -+ (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM); -+out_no_vram: - vmw_fence_manager_takedown(dev_priv->fman); - out_no_fman: - if (dev_priv->capabilities & SVGA_CAP_IRQMASK) -@@ -861,12 +868,6 @@ out_err4: - iounmap(dev_priv->mmio_virt); - out_err3: - arch_phys_wc_del(dev_priv->mmio_mtrr); -- if (dev_priv->has_mob) -- (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB); -- if (dev_priv->has_gmr) -- (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR); -- (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM); --out_err2: - (void)ttm_bo_device_release(&dev_priv->bdev); - out_err1: - vmw_ttm_global_release(dev_priv); -@@ -896,6 +897,13 @@ static int vmw_driver_unload(struct drm_device *dev) - } - vmw_kms_close(dev_priv); - vmw_overlay_close(dev_priv); -+ -+ if (dev_priv->has_mob) -+ (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB); -+ if (dev_priv->has_gmr) -+ (void)ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR); -+ (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM); -+ - vmw_fence_manager_takedown(dev_priv->fman); - if (dev_priv->capabilities & SVGA_CAP_IRQMASK) - drm_irq_uninstall(dev_priv->dev); -@@ -907,11 +915,6 @@ static int vmw_driver_unload(struct drm_device *dev) - ttm_object_device_release(&dev_priv->tdev); - iounmap(dev_priv->mmio_virt); - arch_phys_wc_del(dev_priv->mmio_mtrr); -- if (dev_priv->has_mob) -- (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB); -- if (dev_priv->has_gmr) -- (void)ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR); -- (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM); - (void)ttm_bo_device_release(&dev_priv->bdev); - vmw_ttm_global_release(dev_priv); - -diff --git a/drivers/mtd/nand/pxa3xx_nand.c b/drivers/mtd/nand/pxa3xx_nand.c -index 51e15fd53108..d058b00ba218 100644 ---- a/drivers/mtd/nand/pxa3xx_nand.c -+++ b/drivers/mtd/nand/pxa3xx_nand.c -@@ -481,6 +481,42 @@ static void disable_int(struct pxa3xx_nand_info *info, uint32_t int_mask) - nand_writel(info, NDCR, ndcr | int_mask); - } - -+static void drain_fifo(struct pxa3xx_nand_info *info, void *data, int len) -+{ -+ if (info->ecc_bch) { -+ int timeout; -+ -+ /* -+ * According to the datasheet, when reading from NDDB -+ * with BCH enabled, after each 32 bytes reads, we -+ * have to make sure that the NDSR.RDDREQ bit is set. -+ * -+ * Drain the FIFO 8 32 bits reads at a time, and skip -+ * the polling on the last read. -+ */ -+ while (len > 8) { -+ __raw_readsl(info->mmio_base + NDDB, data, 8); -+ -+ for (timeout = 0; -+ !(nand_readl(info, NDSR) & NDSR_RDDREQ); -+ timeout++) { -+ if (timeout >= 5) { -+ dev_err(&info->pdev->dev, -+ "Timeout on RDDREQ while draining the FIFO\n"); -+ return; -+ } -+ -+ mdelay(1); -+ } -+ -+ data += 32; -+ len -= 8; -+ } -+ } -+ -+ __raw_readsl(info->mmio_base + NDDB, data, len); -+} -+ - static void handle_data_pio(struct pxa3xx_nand_info *info) - { - unsigned int do_bytes = min(info->data_size, info->chunk_size); -@@ -497,14 +533,14 @@ static void handle_data_pio(struct pxa3xx_nand_info *info) - DIV_ROUND_UP(info->oob_size, 4)); - break; - case STATE_PIO_READING: -- __raw_readsl(info->mmio_base + NDDB, -- info->data_buff + info->data_buff_pos, -- DIV_ROUND_UP(do_bytes, 4)); -+ drain_fifo(info, -+ info->data_buff + info->data_buff_pos, -+ DIV_ROUND_UP(do_bytes, 4)); - - if (info->oob_size > 0) -- __raw_readsl(info->mmio_base + NDDB, -- info->oob_buff + info->oob_buff_pos, -- DIV_ROUND_UP(info->oob_size, 4)); -+ drain_fifo(info, -+ info->oob_buff + info->oob_buff_pos, -+ DIV_ROUND_UP(info->oob_size, 4)); - break; - default: - dev_err(&info->pdev->dev, "%s: invalid state %d\n", __func__, -diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c -index 1468c4658804..84ad2b44377c 100644 ---- a/drivers/net/can/dev.c -+++ b/drivers/net/can/dev.c -@@ -502,6 +502,14 @@ struct sk_buff *alloc_can_skb(struct net_device *dev, struct can_frame **cf) - skb->pkt_type = PACKET_BROADCAST; - skb->ip_summed = CHECKSUM_UNNECESSARY; - -+ skb_reset_mac_header(skb); -+ skb_reset_network_header(skb); -+ skb_reset_transport_header(skb); -+ -+ skb_reset_mac_header(skb); -+ skb_reset_network_header(skb); -+ skb_reset_transport_header(skb); -+ - can_skb_reserve(skb); - can_skb_prv(skb)->ifindex = dev->ifindex; - -diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c -index 7d4382286457..242874041ba4 100644 ---- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c -+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c -@@ -12395,6 +12395,9 @@ static int bnx2x_init_dev(struct bnx2x *bp, struct pci_dev *pdev, - pci_write_config_dword(bp->pdev, PCICFG_GRC_ADDRESS, - PCICFG_VENDOR_ID_OFFSET); - -+ /* Set PCIe reset type to fundamental for EEH recovery */ -+ pdev->needs_freset = 1; -+ - /* AER (Advanced Error reporting) configuration */ - rc = pci_enable_pcie_error_reporting(pdev); - if (!rc) -diff --git a/drivers/net/usb/cx82310_eth.c b/drivers/net/usb/cx82310_eth.c -index 3eed708a6182..fe48f4c51373 100644 ---- a/drivers/net/usb/cx82310_eth.c -+++ b/drivers/net/usb/cx82310_eth.c -@@ -300,9 +300,18 @@ static const struct driver_info cx82310_info = { - .tx_fixup = cx82310_tx_fixup, - }; - -+#define USB_DEVICE_CLASS(vend, prod, cl, sc, pr) \ -+ .match_flags = USB_DEVICE_ID_MATCH_DEVICE | \ -+ USB_DEVICE_ID_MATCH_DEV_INFO, \ -+ .idVendor = (vend), \ -+ .idProduct = (prod), \ -+ .bDeviceClass = (cl), \ -+ .bDeviceSubClass = (sc), \ -+ .bDeviceProtocol = (pr) -+ - static const struct usb_device_id products[] = { - { -- USB_DEVICE_AND_INTERFACE_INFO(0x0572, 0xcb01, 0xff, 0, 0), -+ USB_DEVICE_CLASS(0x0572, 0xcb01, 0xff, 0, 0), - .driver_info = (unsigned long) &cx82310_info - }, - { }, -diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c -index b7984044232d..5d8d2dcd975e 100644 ---- a/drivers/regulator/core.c -+++ b/drivers/regulator/core.c -@@ -1764,10 +1764,12 @@ static int _regulator_do_enable(struct regulator_dev *rdev) - trace_regulator_enable(rdev_get_name(rdev)); - - if (rdev->ena_pin) { -- ret = regulator_ena_gpio_ctrl(rdev, true); -- if (ret < 0) -- return ret; -- rdev->ena_gpio_state = 1; -+ if (!rdev->ena_gpio_state) { -+ ret = regulator_ena_gpio_ctrl(rdev, true); -+ if (ret < 0) -+ return ret; -+ rdev->ena_gpio_state = 1; -+ } - } else if (rdev->desc->ops->enable) { - ret = rdev->desc->ops->enable(rdev); - if (ret < 0) -@@ -1897,10 +1899,12 @@ static int _regulator_do_disable(struct regulator_dev *rdev) - trace_regulator_disable(rdev_get_name(rdev)); - - if (rdev->ena_pin) { -- ret = regulator_ena_gpio_ctrl(rdev, false); -- if (ret < 0) -- return ret; -- rdev->ena_gpio_state = 0; -+ if (rdev->ena_gpio_state) { -+ ret = regulator_ena_gpio_ctrl(rdev, false); -+ if (ret < 0) -+ return ret; -+ rdev->ena_gpio_state = 0; -+ } - - } else if (rdev->desc->ops->disable) { - ret = rdev->desc->ops->disable(rdev); -@@ -3454,12 +3458,6 @@ regulator_register(const struct regulator_desc *regulator_desc, - config->ena_gpio, ret); - goto wash; - } -- -- if (config->ena_gpio_flags & GPIOF_OUT_INIT_HIGH) -- rdev->ena_gpio_state = 1; -- -- if (config->ena_gpio_invert) -- rdev->ena_gpio_state = !rdev->ena_gpio_state; - } - - /* set regulator constraints */ -@@ -3631,9 +3629,11 @@ int regulator_suspend_finish(void) - list_for_each_entry(rdev, ®ulator_list, list) { - mutex_lock(&rdev->mutex); - if (rdev->use_count > 0 || rdev->constraints->always_on) { -- error = _regulator_do_enable(rdev); -- if (error) -- ret = error; -+ if (!_regulator_is_enabled(rdev)) { -+ error = _regulator_do_enable(rdev); -+ if (error) -+ ret = error; -+ } - } else { - if (!have_full_constraints()) - goto unlock; -diff --git a/drivers/scsi/libsas/sas_discover.c b/drivers/scsi/libsas/sas_discover.c -index 62b58d38ce2e..60de66252fa2 100644 ---- a/drivers/scsi/libsas/sas_discover.c -+++ b/drivers/scsi/libsas/sas_discover.c -@@ -500,6 +500,7 @@ static void sas_revalidate_domain(struct work_struct *work) - struct sas_discovery_event *ev = to_sas_discovery_event(work); - struct asd_sas_port *port = ev->port; - struct sas_ha_struct *ha = port->ha; -+ struct domain_device *ddev = port->port_dev; - - /* prevent revalidation from finding sata links in recovery */ - mutex_lock(&ha->disco_mutex); -@@ -514,8 +515,9 @@ static void sas_revalidate_domain(struct work_struct *work) - SAS_DPRINTK("REVALIDATING DOMAIN on port %d, pid:%d\n", port->id, - task_pid_nr(current)); - -- if (port->port_dev) -- res = sas_ex_revalidate_domain(port->port_dev); -+ if (ddev && (ddev->dev_type == SAS_FANOUT_EXPANDER_DEVICE || -+ ddev->dev_type == SAS_EDGE_EXPANDER_DEVICE)) -+ res = sas_ex_revalidate_domain(ddev); - - SAS_DPRINTK("done REVALIDATING DOMAIN on port %d, pid:%d, res 0x%x\n", - port->id, task_pid_nr(current), res); -diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c -index 5d7b07f08326..5f8c6d2f4df7 100644 ---- a/drivers/spi/spi-atmel.c -+++ b/drivers/spi/spi-atmel.c -@@ -781,17 +781,17 @@ static void atmel_spi_pdc_next_xfer(struct spi_master *master, - (unsigned long long)xfer->rx_dma); - } - -- /* REVISIT: We're waiting for ENDRX before we start the next -+ /* REVISIT: We're waiting for RXBUFF before we start the next - * transfer because we need to handle some difficult timing -- * issues otherwise. If we wait for ENDTX in one transfer and -- * then starts waiting for ENDRX in the next, it's difficult -- * to tell the difference between the ENDRX interrupt we're -- * actually waiting for and the ENDRX interrupt of the -+ * issues otherwise. If we wait for TXBUFE in one transfer and -+ * then starts waiting for RXBUFF in the next, it's difficult -+ * to tell the difference between the RXBUFF interrupt we're -+ * actually waiting for and the RXBUFF interrupt of the - * previous transfer. - * - * It should be doable, though. Just not now... - */ -- spi_writel(as, IER, SPI_BIT(ENDRX) | SPI_BIT(OVRES)); -+ spi_writel(as, IER, SPI_BIT(RXBUFF) | SPI_BIT(OVRES)); - spi_writel(as, PTCR, SPI_BIT(TXTEN) | SPI_BIT(RXTEN)); - } - -diff --git a/drivers/spi/spi-pl022.c b/drivers/spi/spi-pl022.c -index 971855e859c7..fe091a87fd6d 100644 ---- a/drivers/spi/spi-pl022.c -+++ b/drivers/spi/spi-pl022.c -@@ -503,12 +503,12 @@ static void giveback(struct pl022 *pl022) - pl022->cur_msg = NULL; - pl022->cur_transfer = NULL; - pl022->cur_chip = NULL; -- spi_finalize_current_message(pl022->master); - - /* disable the SPI/SSP operation */ - writew((readw(SSP_CR1(pl022->virtbase)) & - (~SSP_CR1_MASK_SSE)), SSP_CR1(pl022->virtbase)); - -+ spi_finalize_current_message(pl022->master); - } - - /** -diff --git a/drivers/staging/iio/adc/mxs-lradc.c b/drivers/staging/iio/adc/mxs-lradc.c -index be89260c23a6..27e1a6e62d06 100644 ---- a/drivers/staging/iio/adc/mxs-lradc.c -+++ b/drivers/staging/iio/adc/mxs-lradc.c -@@ -1159,7 +1159,6 @@ static irqreturn_t mxs_lradc_handle_irq(int irq, void *data) - LRADC_CTRL1_LRADC_IRQ(TOUCHSCREEN_VCHANNEL2)); - } - -- if (iio_buffer_enabled(iio)) - if (iio_buffer_enabled(iio)) { - if (reg & lradc->buffer_vchans) - iio_trigger_poll(iio->trig, iio_get_time_ns()); -diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c -index 104f29e6b290..e168a63e77ea 100644 ---- a/drivers/target/iscsi/iscsi_target.c -+++ b/drivers/target/iscsi/iscsi_target.c -@@ -4196,11 +4196,17 @@ int iscsit_close_connection( - pr_debug("Closing iSCSI connection CID %hu on SID:" - " %u\n", conn->cid, sess->sid); - /* -- * Always up conn_logout_comp just in case the RX Thread is sleeping -- * and the logout response never got sent because the connection -- * failed. -+ * Always up conn_logout_comp for the traditional TCP case just in case -+ * the RX Thread in iscsi_target_rx_opcode() is sleeping and the logout -+ * response never got sent because the connection failed. -+ * -+ * However for iser-target, isert_wait4logout() is using conn_logout_comp -+ * to signal logout response TX interrupt completion. Go ahead and skip -+ * this for iser since isert_rx_opcode() does not wait on logout failure, -+ * and to avoid iscsi_conn pointer dereference in iser-target code. - */ -- complete(&conn->conn_logout_comp); -+ if (conn->conn_transport->transport_type == ISCSI_TCP) -+ complete(&conn->conn_logout_comp); - - iscsi_release_thread_set(conn); - -diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c -index 26ae6886ac59..093b8cb85de7 100644 ---- a/drivers/target/target_core_device.c -+++ b/drivers/target/target_core_device.c -@@ -1591,8 +1591,6 @@ int target_configure_device(struct se_device *dev) - ret = dev->transport->configure_device(dev); - if (ret) - goto out; -- dev->dev_flags |= DF_CONFIGURED; -- - /* - * XXX: there is not much point to have two different values here.. - */ -@@ -1654,6 +1652,8 @@ int target_configure_device(struct se_device *dev) - list_add_tail(&dev->g_dev_node, &g_device_list); - mutex_unlock(&g_device_mutex); - -+ dev->dev_flags |= DF_CONFIGURED; -+ - return 0; - - out_free_alua: -diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c -index 0fccdcfd1015..70cb37516d40 100644 ---- a/drivers/target/target_core_pr.c -+++ b/drivers/target/target_core_pr.c -@@ -76,7 +76,7 @@ enum preempt_type { - }; - - static void __core_scsi3_complete_pro_release(struct se_device *, struct se_node_acl *, -- struct t10_pr_registration *, int); -+ struct t10_pr_registration *, int, int); - - static sense_reason_t - target_scsi2_reservation_check(struct se_cmd *cmd) -@@ -528,6 +528,18 @@ static int core_scsi3_pr_seq_non_holder( - - return 0; - } -+ } else if (we && registered_nexus) { -+ /* -+ * Reads are allowed for Write Exclusive locks -+ * from all registrants. -+ */ -+ if (cmd->data_direction == DMA_FROM_DEVICE) { -+ pr_debug("Allowing READ CDB: 0x%02x for %s" -+ " reservation\n", cdb[0], -+ core_scsi3_pr_dump_type(pr_reg_type)); -+ -+ return 0; -+ } - } - pr_debug("%s Conflict for %sregistered nexus %s CDB: 0x%2x" - " for %s reservation\n", transport_dump_cmd_direction(cmd), -@@ -1186,7 +1198,7 @@ static int core_scsi3_check_implicit_release( - * service action with the SERVICE ACTION RESERVATION KEY - * field set to zero (see 5.7.11.3). - */ -- __core_scsi3_complete_pro_release(dev, nacl, pr_reg, 0); -+ __core_scsi3_complete_pro_release(dev, nacl, pr_reg, 0, 1); - ret = 1; - /* - * For 'All Registrants' reservation types, all existing -@@ -1228,7 +1240,8 @@ static void __core_scsi3_free_registration( - - pr_reg->pr_reg_deve->def_pr_registered = 0; - pr_reg->pr_reg_deve->pr_res_key = 0; -- list_del(&pr_reg->pr_reg_list); -+ if (!list_empty(&pr_reg->pr_reg_list)) -+ list_del(&pr_reg->pr_reg_list); - /* - * Caller accessing *pr_reg using core_scsi3_locate_pr_reg(), - * so call core_scsi3_put_pr_reg() to decrement our reference. -@@ -1280,6 +1293,7 @@ void core_scsi3_free_pr_reg_from_nacl( - { - struct t10_reservation *pr_tmpl = &dev->t10_pr; - struct t10_pr_registration *pr_reg, *pr_reg_tmp, *pr_res_holder; -+ bool free_reg = false; - /* - * If the passed se_node_acl matches the reservation holder, - * release the reservation. -@@ -1287,13 +1301,18 @@ void core_scsi3_free_pr_reg_from_nacl( - spin_lock(&dev->dev_reservation_lock); - pr_res_holder = dev->dev_pr_res_holder; - if ((pr_res_holder != NULL) && -- (pr_res_holder->pr_reg_nacl == nacl)) -- __core_scsi3_complete_pro_release(dev, nacl, pr_res_holder, 0); -+ (pr_res_holder->pr_reg_nacl == nacl)) { -+ __core_scsi3_complete_pro_release(dev, nacl, pr_res_holder, 0, 1); -+ free_reg = true; -+ } - spin_unlock(&dev->dev_reservation_lock); - /* - * Release any registration associated with the struct se_node_acl. - */ - spin_lock(&pr_tmpl->registration_lock); -+ if (pr_res_holder && free_reg) -+ __core_scsi3_free_registration(dev, pr_res_holder, NULL, 0); -+ - list_for_each_entry_safe(pr_reg, pr_reg_tmp, - &pr_tmpl->registration_list, pr_reg_list) { - -@@ -1316,7 +1335,7 @@ void core_scsi3_free_all_registrations( - if (pr_res_holder != NULL) { - struct se_node_acl *pr_res_nacl = pr_res_holder->pr_reg_nacl; - __core_scsi3_complete_pro_release(dev, pr_res_nacl, -- pr_res_holder, 0); -+ pr_res_holder, 0, 0); - } - spin_unlock(&dev->dev_reservation_lock); - -@@ -2126,13 +2145,13 @@ core_scsi3_emulate_pro_register(struct se_cmd *cmd, u64 res_key, u64 sa_res_key, - /* - * sa_res_key=0 Unregister Reservation Key for registered I_T Nexus. - */ -- pr_holder = core_scsi3_check_implicit_release( -- cmd->se_dev, pr_reg); -+ type = pr_reg->pr_res_type; -+ pr_holder = core_scsi3_check_implicit_release(cmd->se_dev, -+ pr_reg); - if (pr_holder < 0) { - ret = TCM_RESERVATION_CONFLICT; - goto out; - } -- type = pr_reg->pr_res_type; - - spin_lock(&pr_tmpl->registration_lock); - /* -@@ -2290,6 +2309,7 @@ core_scsi3_pro_reserve(struct se_cmd *cmd, int type, int scope, u64 res_key) - spin_lock(&dev->dev_reservation_lock); - pr_res_holder = dev->dev_pr_res_holder; - if (pr_res_holder) { -+ int pr_res_type = pr_res_holder->pr_res_type; - /* - * From spc4r17 Section 5.7.9: Reserving: - * -@@ -2300,7 +2320,9 @@ core_scsi3_pro_reserve(struct se_cmd *cmd, int type, int scope, u64 res_key) - * the logical unit, then the command shall be completed with - * RESERVATION CONFLICT status. - */ -- if (pr_res_holder != pr_reg) { -+ if ((pr_res_holder != pr_reg) && -+ (pr_res_type != PR_TYPE_WRITE_EXCLUSIVE_ALLREG) && -+ (pr_res_type != PR_TYPE_EXCLUSIVE_ACCESS_ALLREG)) { - struct se_node_acl *pr_res_nacl = pr_res_holder->pr_reg_nacl; - pr_err("SPC-3 PR: Attempted RESERVE from" - " [%s]: %s while reservation already held by" -@@ -2406,23 +2428,59 @@ static void __core_scsi3_complete_pro_release( - struct se_device *dev, - struct se_node_acl *se_nacl, - struct t10_pr_registration *pr_reg, -- int explicit) -+ int explicit, -+ int unreg) - { - struct target_core_fabric_ops *tfo = se_nacl->se_tpg->se_tpg_tfo; - char i_buf[PR_REG_ISID_ID_LEN]; -+ int pr_res_type = 0, pr_res_scope = 0; - - memset(i_buf, 0, PR_REG_ISID_ID_LEN); - core_pr_dump_initiator_port(pr_reg, i_buf, PR_REG_ISID_ID_LEN); - /* - * Go ahead and release the current PR reservation holder. -+ * If an All Registrants reservation is currently active and -+ * a unregister operation is requested, replace the current -+ * dev_pr_res_holder with another active registration. - */ -- dev->dev_pr_res_holder = NULL; -+ if (dev->dev_pr_res_holder) { -+ pr_res_type = dev->dev_pr_res_holder->pr_res_type; -+ pr_res_scope = dev->dev_pr_res_holder->pr_res_scope; -+ dev->dev_pr_res_holder->pr_res_type = 0; -+ dev->dev_pr_res_holder->pr_res_scope = 0; -+ dev->dev_pr_res_holder->pr_res_holder = 0; -+ dev->dev_pr_res_holder = NULL; -+ } -+ if (!unreg) -+ goto out; - -- pr_debug("SPC-3 PR [%s] Service Action: %s RELEASE cleared" -- " reservation holder TYPE: %s ALL_TG_PT: %d\n", -- tfo->get_fabric_name(), (explicit) ? "explicit" : "implicit", -- core_scsi3_pr_dump_type(pr_reg->pr_res_type), -- (pr_reg->pr_reg_all_tg_pt) ? 1 : 0); -+ spin_lock(&dev->t10_pr.registration_lock); -+ list_del_init(&pr_reg->pr_reg_list); -+ /* -+ * If the I_T nexus is a reservation holder, the persistent reservation -+ * is of an all registrants type, and the I_T nexus is the last remaining -+ * registered I_T nexus, then the device server shall also release the -+ * persistent reservation. -+ */ -+ if (!list_empty(&dev->t10_pr.registration_list) && -+ ((pr_res_type == PR_TYPE_WRITE_EXCLUSIVE_ALLREG) || -+ (pr_res_type == PR_TYPE_EXCLUSIVE_ACCESS_ALLREG))) { -+ dev->dev_pr_res_holder = -+ list_entry(dev->t10_pr.registration_list.next, -+ struct t10_pr_registration, pr_reg_list); -+ dev->dev_pr_res_holder->pr_res_type = pr_res_type; -+ dev->dev_pr_res_holder->pr_res_scope = pr_res_scope; -+ dev->dev_pr_res_holder->pr_res_holder = 1; -+ } -+ spin_unlock(&dev->t10_pr.registration_lock); -+out: -+ if (!dev->dev_pr_res_holder) { -+ pr_debug("SPC-3 PR [%s] Service Action: %s RELEASE cleared" -+ " reservation holder TYPE: %s ALL_TG_PT: %d\n", -+ tfo->get_fabric_name(), (explicit) ? "explicit" : -+ "implicit", core_scsi3_pr_dump_type(pr_res_type), -+ (pr_reg->pr_reg_all_tg_pt) ? 1 : 0); -+ } - pr_debug("SPC-3 PR [%s] RELEASE Node: %s%s\n", - tfo->get_fabric_name(), se_nacl->initiatorname, - i_buf); -@@ -2553,7 +2611,7 @@ core_scsi3_emulate_pro_release(struct se_cmd *cmd, int type, int scope, - * server shall not establish a unit attention condition. - */ - __core_scsi3_complete_pro_release(dev, se_sess->se_node_acl, -- pr_reg, 1); -+ pr_reg, 1, 0); - - spin_unlock(&dev->dev_reservation_lock); - -@@ -2641,7 +2699,7 @@ core_scsi3_emulate_pro_clear(struct se_cmd *cmd, u64 res_key) - if (pr_res_holder) { - struct se_node_acl *pr_res_nacl = pr_res_holder->pr_reg_nacl; - __core_scsi3_complete_pro_release(dev, pr_res_nacl, -- pr_res_holder, 0); -+ pr_res_holder, 0, 0); - } - spin_unlock(&dev->dev_reservation_lock); - /* -@@ -2700,7 +2758,7 @@ static void __core_scsi3_complete_pro_preempt( - */ - if (dev->dev_pr_res_holder) - __core_scsi3_complete_pro_release(dev, nacl, -- dev->dev_pr_res_holder, 0); -+ dev->dev_pr_res_holder, 0, 0); - - dev->dev_pr_res_holder = pr_reg; - pr_reg->pr_res_holder = 1; -@@ -2944,8 +3002,8 @@ core_scsi3_pro_preempt(struct se_cmd *cmd, int type, int scope, u64 res_key, - */ - if (pr_reg_n != pr_res_holder) - __core_scsi3_complete_pro_release(dev, -- pr_res_holder->pr_reg_nacl, -- dev->dev_pr_res_holder, 0); -+ pr_res_holder->pr_reg_nacl, -+ dev->dev_pr_res_holder, 0, 0); - /* - * b) Remove the registrations for all I_T nexuses identified - * by the SERVICE ACTION RESERVATION KEY field, except the -@@ -3415,7 +3473,7 @@ after_iport_check: - * holder (i.e., the I_T nexus on which the - */ - __core_scsi3_complete_pro_release(dev, pr_res_nacl, -- dev->dev_pr_res_holder, 0); -+ dev->dev_pr_res_holder, 0, 0); - /* - * g) Move the persistent reservation to the specified I_T nexus using - * the same scope and type as the persistent reservation released in -@@ -3855,7 +3913,8 @@ core_scsi3_pri_read_full_status(struct se_cmd *cmd) - unsigned char *buf; - u32 add_desc_len = 0, add_len = 0, desc_len, exp_desc_len; - u32 off = 8; /* off into first Full Status descriptor */ -- int format_code = 0; -+ int format_code = 0, pr_res_type = 0, pr_res_scope = 0; -+ bool all_reg = false; - - if (cmd->data_length < 8) { - pr_err("PRIN SA READ_FULL_STATUS SCSI Data Length: %u" -@@ -3872,6 +3931,19 @@ core_scsi3_pri_read_full_status(struct se_cmd *cmd) - buf[2] = ((dev->t10_pr.pr_generation >> 8) & 0xff); - buf[3] = (dev->t10_pr.pr_generation & 0xff); - -+ spin_lock(&dev->dev_reservation_lock); -+ if (dev->dev_pr_res_holder) { -+ struct t10_pr_registration *pr_holder = dev->dev_pr_res_holder; -+ -+ if (pr_holder->pr_res_type == PR_TYPE_WRITE_EXCLUSIVE_ALLREG || -+ pr_holder->pr_res_type == PR_TYPE_EXCLUSIVE_ACCESS_ALLREG) { -+ all_reg = true; -+ pr_res_type = pr_holder->pr_res_type; -+ pr_res_scope = pr_holder->pr_res_scope; -+ } -+ } -+ spin_unlock(&dev->dev_reservation_lock); -+ - spin_lock(&pr_tmpl->registration_lock); - list_for_each_entry_safe(pr_reg, pr_reg_tmp, - &pr_tmpl->registration_list, pr_reg_list) { -@@ -3921,14 +3993,20 @@ core_scsi3_pri_read_full_status(struct se_cmd *cmd) - * reservation holder for PR_HOLDER bit. - * - * Also, if this registration is the reservation -- * holder, fill in SCOPE and TYPE in the next byte. -+ * holder or there is an All Registrants reservation -+ * active, fill in SCOPE and TYPE in the next byte. - */ - if (pr_reg->pr_res_holder) { - buf[off++] |= 0x01; - buf[off++] = (pr_reg->pr_res_scope & 0xf0) | - (pr_reg->pr_res_type & 0x0f); -- } else -+ } else if (all_reg) { -+ buf[off++] |= 0x01; -+ buf[off++] = (pr_res_scope & 0xf0) | -+ (pr_res_type & 0x0f); -+ } else { - off += 2; -+ } - - off += 4; /* Skip over reserved area */ - /* -diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c -index 0f199f6a0738..29f28808fc03 100644 ---- a/drivers/target/target_core_pscsi.c -+++ b/drivers/target/target_core_pscsi.c -@@ -1111,7 +1111,7 @@ static u32 pscsi_get_device_type(struct se_device *dev) - struct pscsi_dev_virt *pdv = PSCSI_DEV(dev); - struct scsi_device *sd = pdv->pdv_sd; - -- return sd->type; -+ return (sd) ? sd->type : TYPE_NO_LUN; - } - - static sector_t pscsi_get_blocks(struct se_device *dev) -diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c -index e6463ef33cd2..9e54c0fe718d 100644 ---- a/drivers/target/target_core_transport.c -+++ b/drivers/target/target_core_transport.c -@@ -2327,6 +2327,10 @@ int target_get_sess_cmd(struct se_session *se_sess, struct se_cmd *se_cmd, - list_add_tail(&se_cmd->se_cmd_list, &se_sess->sess_cmd_list); - out: - spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags); -+ -+ if (ret && ack_kref) -+ target_put_sess_cmd(se_sess, se_cmd); -+ - return ret; - } - EXPORT_SYMBOL(target_get_sess_cmd); -diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c -index feda34404ed0..5892eab03874 100644 ---- a/drivers/tty/serial/8250/8250_pci.c -+++ b/drivers/tty/serial/8250/8250_pci.c -@@ -66,7 +66,7 @@ static void moan_device(const char *str, struct pci_dev *dev) - "Please send the output of lspci -vv, this\n" - "message (0x%04x,0x%04x,0x%04x,0x%04x), the\n" - "manufacturer and name of serial board or\n" -- "modem board to rmk+serial@arm.linux.org.uk.\n", -+ "modem board to .\n", - pci_name(dev), str, dev->vendor, dev->device, - dev->subsystem_vendor, dev->subsystem_device); - } -diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c -index f4a9e3311297..c8860a8757ac 100644 ---- a/drivers/xen/events/events_base.c -+++ b/drivers/xen/events/events_base.c -@@ -547,20 +547,26 @@ static unsigned int __startup_pirq(unsigned int irq) - pirq_query_unmask(irq); - - rc = set_evtchn_to_irq(evtchn, irq); -- if (rc != 0) { -- pr_err("irq%d: Failed to set port to irq mapping (%d)\n", -- irq, rc); -- xen_evtchn_close(evtchn); -- return 0; -- } -+ if (rc) -+ goto err; -+ - bind_evtchn_to_cpu(evtchn, 0); - info->evtchn = evtchn; - -+ rc = xen_evtchn_port_setup(info); -+ if (rc) -+ goto err; -+ - out: - unmask_evtchn(evtchn); - eoi_pirq(irq_get_irq_data(irq)); - - return 0; -+ -+err: -+ pr_err("irq%d: Failed to set port to irq mapping (%d)\n", irq, rc); -+ xen_evtchn_close(evtchn); -+ return 0; - } - - static unsigned int startup_pirq(struct irq_data *data) -diff --git a/drivers/xen/xen-pciback/conf_space.c b/drivers/xen/xen-pciback/conf_space.c -index 46ae0f9f02ad..75fe3d466515 100644 ---- a/drivers/xen/xen-pciback/conf_space.c -+++ b/drivers/xen/xen-pciback/conf_space.c -@@ -16,7 +16,7 @@ - #include "conf_space.h" - #include "conf_space_quirks.h" - --static bool permissive; -+bool permissive; - module_param(permissive, bool, 0644); - - /* This is where xen_pcibk_read_config_byte, xen_pcibk_read_config_word, -diff --git a/drivers/xen/xen-pciback/conf_space.h b/drivers/xen/xen-pciback/conf_space.h -index e56c934ad137..2e1d73d1d5d0 100644 ---- a/drivers/xen/xen-pciback/conf_space.h -+++ b/drivers/xen/xen-pciback/conf_space.h -@@ -64,6 +64,8 @@ struct config_field_entry { - void *data; - }; - -+extern bool permissive; -+ - #define OFFSET(cfg_entry) ((cfg_entry)->base_offset+(cfg_entry)->field->offset) - - /* Add fields to a device - the add_fields macro expects to get a pointer to -diff --git a/drivers/xen/xen-pciback/conf_space_header.c b/drivers/xen/xen-pciback/conf_space_header.c -index c5ee82587e8c..2d7369391472 100644 ---- a/drivers/xen/xen-pciback/conf_space_header.c -+++ b/drivers/xen/xen-pciback/conf_space_header.c -@@ -11,6 +11,10 @@ - #include "pciback.h" - #include "conf_space.h" - -+struct pci_cmd_info { -+ u16 val; -+}; -+ - struct pci_bar_info { - u32 val; - u32 len_val; -@@ -20,22 +24,36 @@ struct pci_bar_info { - #define is_enable_cmd(value) ((value)&(PCI_COMMAND_MEMORY|PCI_COMMAND_IO)) - #define is_master_cmd(value) ((value)&PCI_COMMAND_MASTER) - --static int command_read(struct pci_dev *dev, int offset, u16 *value, void *data) -+/* Bits guests are allowed to control in permissive mode. */ -+#define PCI_COMMAND_GUEST (PCI_COMMAND_MASTER|PCI_COMMAND_SPECIAL| \ -+ PCI_COMMAND_INVALIDATE|PCI_COMMAND_VGA_PALETTE| \ -+ PCI_COMMAND_WAIT|PCI_COMMAND_FAST_BACK) -+ -+static void *command_init(struct pci_dev *dev, int offset) - { -- int i; -- int ret; -- -- ret = xen_pcibk_read_config_word(dev, offset, value, data); -- if (!pci_is_enabled(dev)) -- return ret; -- -- for (i = 0; i < PCI_ROM_RESOURCE; i++) { -- if (dev->resource[i].flags & IORESOURCE_IO) -- *value |= PCI_COMMAND_IO; -- if (dev->resource[i].flags & IORESOURCE_MEM) -- *value |= PCI_COMMAND_MEMORY; -+ struct pci_cmd_info *cmd = kmalloc(sizeof(*cmd), GFP_KERNEL); -+ int err; -+ -+ if (!cmd) -+ return ERR_PTR(-ENOMEM); -+ -+ err = pci_read_config_word(dev, PCI_COMMAND, &cmd->val); -+ if (err) { -+ kfree(cmd); -+ return ERR_PTR(err); - } - -+ return cmd; -+} -+ -+static int command_read(struct pci_dev *dev, int offset, u16 *value, void *data) -+{ -+ int ret = pci_read_config_word(dev, offset, value); -+ const struct pci_cmd_info *cmd = data; -+ -+ *value &= PCI_COMMAND_GUEST; -+ *value |= cmd->val & ~PCI_COMMAND_GUEST; -+ - return ret; - } - -@@ -43,6 +61,8 @@ static int command_write(struct pci_dev *dev, int offset, u16 value, void *data) - { - struct xen_pcibk_dev_data *dev_data; - int err; -+ u16 val; -+ struct pci_cmd_info *cmd = data; - - dev_data = pci_get_drvdata(dev); - if (!pci_is_enabled(dev) && is_enable_cmd(value)) { -@@ -83,6 +103,19 @@ static int command_write(struct pci_dev *dev, int offset, u16 value, void *data) - } - } - -+ cmd->val = value; -+ -+ if (!permissive && (!dev_data || !dev_data->permissive)) -+ return 0; -+ -+ /* Only allow the guest to control certain bits. */ -+ err = pci_read_config_word(dev, offset, &val); -+ if (err || val == value) -+ return err; -+ -+ value &= PCI_COMMAND_GUEST; -+ value |= val & ~PCI_COMMAND_GUEST; -+ - return pci_write_config_word(dev, offset, value); - } - -@@ -282,6 +315,8 @@ static const struct config_field header_common[] = { - { - .offset = PCI_COMMAND, - .size = 2, -+ .init = command_init, -+ .release = bar_release, - .u.w.read = command_read, - .u.w.write = command_write, - }, -diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c -index 6eb13c621a14..499155ca3e84 100644 ---- a/fs/fuse/dev.c -+++ b/fs/fuse/dev.c -@@ -819,8 +819,8 @@ static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep) - - newpage = buf->page; - -- if (WARN_ON(!PageUptodate(newpage))) -- return -EIO; -+ if (!PageUptodate(newpage)) -+ SetPageUptodate(newpage); - - ClearPageMappedToDisk(newpage); - -@@ -1726,6 +1726,9 @@ copy_finish: - static int fuse_notify(struct fuse_conn *fc, enum fuse_notify_code code, - unsigned int size, struct fuse_copy_state *cs) - { -+ /* Don't try to move pages (yet) */ -+ cs->move_pages = 0; -+ - switch (code) { - case FUSE_NOTIFY_POLL: - return fuse_notify_poll(fc, size, cs); -diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c -index 5bee81674d53..14538a865102 100644 ---- a/fs/nilfs2/segment.c -+++ b/fs/nilfs2/segment.c -@@ -1906,6 +1906,7 @@ static void nilfs_segctor_drop_written_files(struct nilfs_sc_info *sci, - struct the_nilfs *nilfs) - { - struct nilfs_inode_info *ii, *n; -+ int during_mount = !(sci->sc_super->s_flags & MS_ACTIVE); - int defer_iput = false; - - spin_lock(&nilfs->ns_inode_lock); -@@ -1918,10 +1919,10 @@ static void nilfs_segctor_drop_written_files(struct nilfs_sc_info *sci, - brelse(ii->i_bh); - ii->i_bh = NULL; - list_del_init(&ii->i_dirty); -- if (!ii->vfs_inode.i_nlink) { -+ if (!ii->vfs_inode.i_nlink || during_mount) { - /* -- * Defer calling iput() to avoid a deadlock -- * over I_SYNC flag for inodes with i_nlink == 0 -+ * Defer calling iput() to avoid deadlocks if -+ * i_nlink == 0 or mount is not yet finished. - */ - list_add_tail(&ii->i_dirty, &sci->sc_iput_queue); - defer_iput = true; -diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c -index c4b2646b6d7c..c2546717fc2b 100644 ---- a/fs/proc/task_mmu.c -+++ b/fs/proc/task_mmu.c -@@ -1227,6 +1227,9 @@ out: - - static int pagemap_open(struct inode *inode, struct file *file) - { -+ /* do not disclose physical addresses: attack vector */ -+ if (!capable(CAP_SYS_ADMIN)) -+ return -EPERM; - pr_warn_once("Bits 55-60 of /proc/PID/pagemap entries are about " - "to stop being page-shift some time soon. See the " - "linux/Documentation/vm/pagemap.txt for details.\n"); -diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h -index 6c62cfa25f1a..bc9d2c2ddf87 100644 ---- a/include/linux/workqueue.h -+++ b/include/linux/workqueue.h -@@ -71,7 +71,8 @@ enum { - /* data contains off-queue information when !WORK_STRUCT_PWQ */ - WORK_OFFQ_FLAG_BASE = WORK_STRUCT_COLOR_SHIFT, - -- WORK_OFFQ_CANCELING = (1 << WORK_OFFQ_FLAG_BASE), -+ __WORK_OFFQ_CANCELING = WORK_OFFQ_FLAG_BASE, -+ WORK_OFFQ_CANCELING = (1 << __WORK_OFFQ_CANCELING), - - /* - * When a work item is off queue, its high bits point to the last -diff --git a/kernel/cpuset.c b/kernel/cpuset.c -index 2fb2877e6961..7b4530b0b16b 100644 ---- a/kernel/cpuset.c -+++ b/kernel/cpuset.c -@@ -503,9 +503,6 @@ static void update_domain_attr_tree(struct sched_domain_attr *dattr, - - rcu_read_lock(); - cpuset_for_each_descendant_pre(cp, pos_css, root_cs) { -- if (cp == root_cs) -- continue; -- - /* skip the whole subtree if @cp doesn't have any CPU */ - if (cpumask_empty(cp->cpus_allowed)) { - pos_css = css_rightmost_descendant(pos_css); -diff --git a/kernel/printk/console_cmdline.h b/kernel/printk/console_cmdline.h -index cbd69d842341..2ca4a8b5fe57 100644 ---- a/kernel/printk/console_cmdline.h -+++ b/kernel/printk/console_cmdline.h -@@ -3,7 +3,7 @@ - - struct console_cmdline - { -- char name[8]; /* Name of the driver */ -+ char name[16]; /* Name of the driver */ - int index; /* Minor dev. to use */ - char *options; /* Options for the driver */ - #ifdef CONFIG_A11Y_BRAILLE_CONSOLE -diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c -index 8c086e6049b9..a755ad70fe8f 100644 ---- a/kernel/printk/printk.c -+++ b/kernel/printk/printk.c -@@ -2280,6 +2280,7 @@ void register_console(struct console *newcon) - for (i = 0, c = console_cmdline; - i < MAX_CMDLINECONSOLES && c->name[0]; - i++, c++) { -+ BUILD_BUG_ON(sizeof(c->name) != sizeof(newcon->name)); - if (strcmp(c->name, newcon->name) != 0) - continue; - if (newcon->index >= 0 && -diff --git a/kernel/workqueue.c b/kernel/workqueue.c -index f6f31d823e8e..423c9e37a9e7 100644 ---- a/kernel/workqueue.c -+++ b/kernel/workqueue.c -@@ -2893,19 +2893,57 @@ bool flush_work(struct work_struct *work) - } - EXPORT_SYMBOL_GPL(flush_work); - -+struct cwt_wait { -+ wait_queue_t wait; -+ struct work_struct *work; -+}; -+ -+static int cwt_wakefn(wait_queue_t *wait, unsigned mode, int sync, void *key) -+{ -+ struct cwt_wait *cwait = container_of(wait, struct cwt_wait, wait); -+ -+ if (cwait->work != key) -+ return 0; -+ return autoremove_wake_function(wait, mode, sync, key); -+} -+ - static bool __cancel_work_timer(struct work_struct *work, bool is_dwork) - { -+ static DECLARE_WAIT_QUEUE_HEAD(cancel_waitq); - unsigned long flags; - int ret; - - do { - ret = try_to_grab_pending(work, is_dwork, &flags); - /* -- * If someone else is canceling, wait for the same event it -- * would be waiting for before retrying. -+ * If someone else is already canceling, wait for it to -+ * finish. flush_work() doesn't work for PREEMPT_NONE -+ * because we may get scheduled between @work's completion -+ * and the other canceling task resuming and clearing -+ * CANCELING - flush_work() will return false immediately -+ * as @work is no longer busy, try_to_grab_pending() will -+ * return -ENOENT as @work is still being canceled and the -+ * other canceling task won't be able to clear CANCELING as -+ * we're hogging the CPU. -+ * -+ * Let's wait for completion using a waitqueue. As this -+ * may lead to the thundering herd problem, use a custom -+ * wake function which matches @work along with exclusive -+ * wait and wakeup. - */ -- if (unlikely(ret == -ENOENT)) -- flush_work(work); -+ if (unlikely(ret == -ENOENT)) { -+ struct cwt_wait cwait; -+ -+ init_wait(&cwait.wait); -+ cwait.wait.func = cwt_wakefn; -+ cwait.work = work; -+ -+ prepare_to_wait_exclusive(&cancel_waitq, &cwait.wait, -+ TASK_UNINTERRUPTIBLE); -+ if (work_is_canceling(work)) -+ schedule(); -+ finish_wait(&cancel_waitq, &cwait.wait); -+ } - } while (unlikely(ret < 0)); - - /* tell other tasks trying to grab @work to back off */ -@@ -2914,6 +2952,16 @@ static bool __cancel_work_timer(struct work_struct *work, bool is_dwork) - - flush_work(work); - clear_work_data(work); -+ -+ /* -+ * Paired with prepare_to_wait() above so that either -+ * waitqueue_active() is visible here or !work_is_canceling() is -+ * visible there. -+ */ -+ smp_mb(); -+ if (waitqueue_active(&cancel_waitq)) -+ __wake_up(&cancel_waitq, TASK_NORMAL, 1, work); -+ - return ret; - } - -diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c -index d6be3edb7a43..526bf56f4d31 100644 ---- a/net/caif/caif_socket.c -+++ b/net/caif/caif_socket.c -@@ -283,7 +283,7 @@ static int caif_seqpkt_recvmsg(struct kiocb *iocb, struct socket *sock, - int copylen; - - ret = -EOPNOTSUPP; -- if (m->msg_flags&MSG_OOB) -+ if (flags & MSG_OOB) - goto read_error; - - skb = skb_recv_datagram(sk, flags, 0 , &ret); -diff --git a/net/can/af_can.c b/net/can/af_can.c -index a27f8aad9e99..5e9a2272b7a7 100644 ---- a/net/can/af_can.c -+++ b/net/can/af_can.c -@@ -262,6 +262,9 @@ int can_send(struct sk_buff *skb, int loop) - goto inval_skb; - } - -+ skb->ip_summed = CHECKSUM_UNNECESSARY; -+ -+ skb_reset_mac_header(skb); - skb_reset_network_header(skb); - skb_reset_transport_header(skb); - -diff --git a/net/compat.c b/net/compat.c -index 275af79c131b..d12529050b29 100644 ---- a/net/compat.c -+++ b/net/compat.c -@@ -71,6 +71,13 @@ int get_compat_msghdr(struct msghdr *kmsg, struct compat_msghdr __user *umsg) - __get_user(kmsg->msg_controllen, &umsg->msg_controllen) || - __get_user(kmsg->msg_flags, &umsg->msg_flags)) - return -EFAULT; -+ -+ if (!tmp1) -+ kmsg->msg_namelen = 0; -+ -+ if (kmsg->msg_namelen < 0) -+ return -EINVAL; -+ - if (kmsg->msg_namelen > sizeof(struct sockaddr_storage)) - kmsg->msg_namelen = sizeof(struct sockaddr_storage); - kmsg->msg_name = compat_ptr(tmp1); -diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c -index cf9cd13509a7..e731c96eac4b 100644 ---- a/net/core/sysctl_net_core.c -+++ b/net/core/sysctl_net_core.c -@@ -25,6 +25,8 @@ - static int zero = 0; - static int one = 1; - static int ushort_max = USHRT_MAX; -+static int min_sndbuf = SOCK_MIN_SNDBUF; -+static int min_rcvbuf = SOCK_MIN_RCVBUF; - - #ifdef CONFIG_RPS - static int rps_sock_flow_sysctl(struct ctl_table *table, int write, -@@ -223,7 +225,7 @@ static struct ctl_table net_core_table[] = { - .maxlen = sizeof(int), - .mode = 0644, - .proc_handler = proc_dointvec_minmax, -- .extra1 = &one, -+ .extra1 = &min_sndbuf, - }, - { - .procname = "rmem_max", -@@ -231,7 +233,7 @@ static struct ctl_table net_core_table[] = { - .maxlen = sizeof(int), - .mode = 0644, - .proc_handler = proc_dointvec_minmax, -- .extra1 = &one, -+ .extra1 = &min_rcvbuf, - }, - { - .procname = "wmem_default", -@@ -239,7 +241,7 @@ static struct ctl_table net_core_table[] = { - .maxlen = sizeof(int), - .mode = 0644, - .proc_handler = proc_dointvec_minmax, -- .extra1 = &one, -+ .extra1 = &min_sndbuf, - }, - { - .procname = "rmem_default", -@@ -247,7 +249,7 @@ static struct ctl_table net_core_table[] = { - .maxlen = sizeof(int), - .mode = 0644, - .proc_handler = proc_dointvec_minmax, -- .extra1 = &one, -+ .extra1 = &min_rcvbuf, - }, - { - .procname = "dev_weight", -diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c -index e34dccbc4d70..4eeba4e497a0 100644 ---- a/net/ipv4/inet_diag.c -+++ b/net/ipv4/inet_diag.c -@@ -71,6 +71,20 @@ static inline void inet_diag_unlock_handler( - mutex_unlock(&inet_diag_table_mutex); - } - -+static size_t inet_sk_attr_size(void) -+{ -+ return nla_total_size(sizeof(struct tcp_info)) -+ + nla_total_size(1) /* INET_DIAG_SHUTDOWN */ -+ + nla_total_size(1) /* INET_DIAG_TOS */ -+ + nla_total_size(1) /* INET_DIAG_TCLASS */ -+ + nla_total_size(sizeof(struct inet_diag_meminfo)) -+ + nla_total_size(sizeof(struct inet_diag_msg)) -+ + nla_total_size(SK_MEMINFO_VARS * sizeof(u32)) -+ + nla_total_size(TCP_CA_NAME_MAX) -+ + nla_total_size(sizeof(struct tcpvegas_info)) -+ + 64; -+} -+ - int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk, - struct sk_buff *skb, struct inet_diag_req_v2 *req, - struct user_namespace *user_ns, -@@ -324,9 +338,7 @@ int inet_diag_dump_one_icsk(struct inet_hashinfo *hashinfo, struct sk_buff *in_s - if (err) - goto out; - -- rep = nlmsg_new(sizeof(struct inet_diag_msg) + -- sizeof(struct inet_diag_meminfo) + -- sizeof(struct tcp_info) + 64, GFP_KERNEL); -+ rep = nlmsg_new(inet_sk_attr_size(), GFP_KERNEL); - if (!rep) { - err = -ENOMEM; - goto out; -diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c -index 7efa26bb872c..d0c310801479 100644 ---- a/net/ipv4/tcp_output.c -+++ b/net/ipv4/tcp_output.c -@@ -2617,15 +2617,11 @@ void tcp_send_fin(struct sock *sk) - } else { - /* Socket is locked, keep trying until memory is available. */ - for (;;) { -- skb = alloc_skb_fclone(MAX_TCP_HEADER, -- sk->sk_allocation); -+ skb = sk_stream_alloc_skb(sk, 0, sk->sk_allocation); - if (skb) - break; - yield(); - } -- -- /* Reserve space for headers and prepare control bits. */ -- skb_reserve(skb, MAX_TCP_HEADER); - /* FIN eats a sequence byte, write_seq advanced by tcp_queue_skb(). */ - tcp_init_nondata_skb(skb, tp->write_seq, - TCPHDR_ACK | TCPHDR_FIN); -@@ -2899,9 +2895,9 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn) - { - struct tcp_sock *tp = tcp_sk(sk); - struct tcp_fastopen_request *fo = tp->fastopen_req; -- int syn_loss = 0, space, i, err = 0, iovlen = fo->data->msg_iovlen; -- struct sk_buff *syn_data = NULL, *data; -+ int syn_loss = 0, space, err = 0; - unsigned long last_syn_loss = 0; -+ struct sk_buff *syn_data; - - tp->rx_opt.mss_clamp = tp->advmss; /* If MSS is not cached */ - tcp_fastopen_cache_get(sk, &tp->rx_opt.mss_clamp, &fo->cookie, -@@ -2932,42 +2928,38 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn) - /* limit to order-0 allocations */ - space = min_t(size_t, space, SKB_MAX_HEAD(MAX_TCP_HEADER)); - -- syn_data = skb_copy_expand(syn, MAX_TCP_HEADER, space, -- sk->sk_allocation); -- if (syn_data == NULL) -+ syn_data = sk_stream_alloc_skb(sk, space, sk->sk_allocation); -+ if (!syn_data) - goto fallback; -+ syn_data->ip_summed = CHECKSUM_PARTIAL; -+ memcpy(syn_data->cb, syn->cb, sizeof(syn->cb)); -+ if (unlikely(memcpy_fromiovecend(skb_put(syn_data, space), -+ fo->data->msg_iov, 0, space))) { -+ kfree_skb(syn_data); -+ goto fallback; -+ } - -- for (i = 0; i < iovlen && syn_data->len < space; ++i) { -- struct iovec *iov = &fo->data->msg_iov[i]; -- unsigned char __user *from = iov->iov_base; -- int len = iov->iov_len; -- -- if (syn_data->len + len > space) -- len = space - syn_data->len; -- else if (i + 1 == iovlen) -- /* No more data pending in inet_wait_for_connect() */ -- fo->data = NULL; -+ /* No more data pending in inet_wait_for_connect() */ -+ if (space == fo->size) -+ fo->data = NULL; -+ fo->copied = space; - -- if (skb_add_data(syn_data, from, len)) -- goto fallback; -- } -+ tcp_connect_queue_skb(sk, syn_data); - -- /* Queue a data-only packet after the regular SYN for retransmission */ -- data = pskb_copy(syn_data, sk->sk_allocation); -- if (data == NULL) -- goto fallback; -- TCP_SKB_CB(data)->seq++; -- TCP_SKB_CB(data)->tcp_flags &= ~TCPHDR_SYN; -- TCP_SKB_CB(data)->tcp_flags = (TCPHDR_ACK|TCPHDR_PSH); -- tcp_connect_queue_skb(sk, data); -- fo->copied = data->len; -+ err = tcp_transmit_skb(sk, syn_data, 1, sk->sk_allocation); - -- if (tcp_transmit_skb(sk, syn_data, 0, sk->sk_allocation) == 0) { -+ /* Now full SYN+DATA was cloned and sent (or not), -+ * remove the SYN from the original skb (syn_data) -+ * we keep in write queue in case of a retransmit, as we -+ * also have the SYN packet (with no data) in the same queue. -+ */ -+ TCP_SKB_CB(syn_data)->seq++; -+ TCP_SKB_CB(syn_data)->tcp_flags = TCPHDR_ACK | TCPHDR_PSH; -+ if (!err) { - tp->syn_data = (fo->copied > 0); - NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPFASTOPENACTIVE); - goto done; - } -- syn_data = NULL; - - fallback: - /* Send a regular SYN with Fast Open cookie request option */ -@@ -2976,7 +2968,6 @@ fallback: - err = tcp_transmit_skb(sk, syn, 1, sk->sk_allocation); - if (err) - tp->syn_fastopen = 0; -- kfree_skb(syn_data); - done: - fo->cookie.len = -1; /* Exclude Fast Open option for SYN retries */ - return err; -@@ -2996,13 +2987,10 @@ int tcp_connect(struct sock *sk) - return 0; - } - -- buff = alloc_skb_fclone(MAX_TCP_HEADER + 15, sk->sk_allocation); -- if (unlikely(buff == NULL)) -+ buff = sk_stream_alloc_skb(sk, 0, sk->sk_allocation); -+ if (unlikely(!buff)) - return -ENOBUFS; - -- /* Reserve space for headers. */ -- skb_reserve(buff, MAX_TCP_HEADER); -- - tcp_init_nondata_skb(buff, tp->write_seq++, TCPHDR_SYN); - tp->retrans_stamp = TCP_SKB_CB(buff)->when = tcp_time_stamp; - tcp_connect_queue_skb(sk, buff); -diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c -index b4d5e1d97c1b..27ca79682efb 100644 ---- a/net/ipv6/fib6_rules.c -+++ b/net/ipv6/fib6_rules.c -@@ -104,6 +104,7 @@ static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp, - goto again; - flp6->saddr = saddr; - } -+ err = rt->dst.error; - goto out; - } - again: -diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c -index 27d3f40de3cd..847d2a2c5d05 100644 ---- a/net/netfilter/ipvs/ip_vs_core.c -+++ b/net/netfilter/ipvs/ip_vs_core.c -@@ -658,16 +658,24 @@ static inline int ip_vs_gather_frags(struct sk_buff *skb, u_int32_t user) - return err; - } - --static int ip_vs_route_me_harder(int af, struct sk_buff *skb) -+static int ip_vs_route_me_harder(int af, struct sk_buff *skb, -+ unsigned int hooknum) - { -+ if (!sysctl_snat_reroute(skb)) -+ return 0; -+ /* Reroute replies only to remote clients (FORWARD and LOCAL_OUT) */ -+ if (NF_INET_LOCAL_IN == hooknum) -+ return 0; - #ifdef CONFIG_IP_VS_IPV6 - if (af == AF_INET6) { -- if (sysctl_snat_reroute(skb) && ip6_route_me_harder(skb) != 0) -+ struct dst_entry *dst = skb_dst(skb); -+ -+ if (dst->dev && !(dst->dev->flags & IFF_LOOPBACK) && -+ ip6_route_me_harder(skb) != 0) - return 1; - } else - #endif -- if ((sysctl_snat_reroute(skb) || -- skb_rtable(skb)->rt_flags & RTCF_LOCAL) && -+ if (!(skb_rtable(skb)->rt_flags & RTCF_LOCAL) && - ip_route_me_harder(skb, RTN_LOCAL) != 0) - return 1; - -@@ -790,7 +798,8 @@ static int handle_response_icmp(int af, struct sk_buff *skb, - union nf_inet_addr *snet, - __u8 protocol, struct ip_vs_conn *cp, - struct ip_vs_protocol *pp, -- unsigned int offset, unsigned int ihl) -+ unsigned int offset, unsigned int ihl, -+ unsigned int hooknum) - { - unsigned int verdict = NF_DROP; - -@@ -820,7 +829,7 @@ static int handle_response_icmp(int af, struct sk_buff *skb, - #endif - ip_vs_nat_icmp(skb, pp, cp, 1); - -- if (ip_vs_route_me_harder(af, skb)) -+ if (ip_vs_route_me_harder(af, skb, hooknum)) - goto out; - - /* do the statistics and put it back */ -@@ -915,7 +924,7 @@ static int ip_vs_out_icmp(struct sk_buff *skb, int *related, - - snet.ip = iph->saddr; - return handle_response_icmp(AF_INET, skb, &snet, cih->protocol, cp, -- pp, ciph.len, ihl); -+ pp, ciph.len, ihl, hooknum); - } - - #ifdef CONFIG_IP_VS_IPV6 -@@ -980,7 +989,8 @@ static int ip_vs_out_icmp_v6(struct sk_buff *skb, int *related, - snet.in6 = ciph.saddr.in6; - writable = ciph.len; - return handle_response_icmp(AF_INET6, skb, &snet, ciph.protocol, cp, -- pp, writable, sizeof(struct ipv6hdr)); -+ pp, writable, sizeof(struct ipv6hdr), -+ hooknum); - } - #endif - -@@ -1039,7 +1049,8 @@ static inline bool is_new_conn(const struct sk_buff *skb, - */ - static unsigned int - handle_response(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd, -- struct ip_vs_conn *cp, struct ip_vs_iphdr *iph) -+ struct ip_vs_conn *cp, struct ip_vs_iphdr *iph, -+ unsigned int hooknum) - { - struct ip_vs_protocol *pp = pd->pp; - -@@ -1077,7 +1088,7 @@ handle_response(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd, - * if it came from this machine itself. So re-compute - * the routing information. - */ -- if (ip_vs_route_me_harder(af, skb)) -+ if (ip_vs_route_me_harder(af, skb, hooknum)) - goto drop; - - IP_VS_DBG_PKT(10, af, pp, skb, 0, "After SNAT"); -@@ -1180,7 +1191,7 @@ ip_vs_out(unsigned int hooknum, struct sk_buff *skb, int af) - cp = pp->conn_out_get(af, skb, &iph, 0); - - if (likely(cp)) -- return handle_response(af, skb, pd, cp, &iph); -+ return handle_response(af, skb, pd, cp, &iph, hooknum); - if (sysctl_nat_icmp_send(net) && - (pp->protocol == IPPROTO_TCP || - pp->protocol == IPPROTO_UDP || -diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c -index db801263ee9f..a8027e73b6a2 100644 ---- a/net/netfilter/ipvs/ip_vs_sync.c -+++ b/net/netfilter/ipvs/ip_vs_sync.c -@@ -891,6 +891,8 @@ static void ip_vs_proc_conn(struct net *net, struct ip_vs_conn_param *param, - IP_VS_DBG(2, "BACKUP, add new conn. failed\n"); - return; - } -+ if (!(flags & IP_VS_CONN_F_TEMPLATE)) -+ kfree(param->pe_data); - } - - if (opt) -@@ -1164,6 +1166,7 @@ static inline int ip_vs_proc_sync_conn(struct net *net, __u8 *p, __u8 *msg_end) - (opt_flags & IPVS_OPT_F_SEQ_DATA ? &opt : NULL) - ); - #endif -+ ip_vs_pe_put(param.pe); - return 0; - /* Error exit */ - out: -diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c -index ad979612238a..7350723aeb15 100644 ---- a/net/netfilter/nft_compat.c -+++ b/net/netfilter/nft_compat.c -@@ -611,8 +611,12 @@ nft_match_select_ops(const struct nft_ctx *ctx, - struct xt_match *match = nft_match->ops.data; - - if (strcmp(match->name, mt_name) == 0 && -- match->revision == rev && match->family == family) -+ match->revision == rev && match->family == family) { -+ if (!try_module_get(match->me)) -+ return ERR_PTR(-ENOENT); -+ - return &nft_match->ops; -+ } - } - - match = xt_request_find_match(family, mt_name, rev); -@@ -682,8 +686,12 @@ nft_target_select_ops(const struct nft_ctx *ctx, - struct xt_target *target = nft_target->ops.data; - - if (strcmp(target->name, tg_name) == 0 && -- target->revision == rev && target->family == family) -+ target->revision == rev && target->family == family) { -+ if (!try_module_get(target->me)) -+ return ERR_PTR(-ENOENT); -+ - return &nft_target->ops; -+ } - } - - target = xt_request_find_target(family, tg_name, rev); -diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c -index 1ba67931eb1b..13332dbf291d 100644 ---- a/net/netfilter/xt_socket.c -+++ b/net/netfilter/xt_socket.c -@@ -243,12 +243,13 @@ static int - extract_icmp6_fields(const struct sk_buff *skb, - unsigned int outside_hdrlen, - int *protocol, -- struct in6_addr **raddr, -- struct in6_addr **laddr, -+ const struct in6_addr **raddr, -+ const struct in6_addr **laddr, - __be16 *rport, -- __be16 *lport) -+ __be16 *lport, -+ struct ipv6hdr *ipv6_var) - { -- struct ipv6hdr *inside_iph, _inside_iph; -+ const struct ipv6hdr *inside_iph; - struct icmp6hdr *icmph, _icmph; - __be16 *ports, _ports[2]; - u8 inside_nexthdr; -@@ -263,12 +264,14 @@ extract_icmp6_fields(const struct sk_buff *skb, - if (icmph->icmp6_type & ICMPV6_INFOMSG_MASK) - return 1; - -- inside_iph = skb_header_pointer(skb, outside_hdrlen + sizeof(_icmph), sizeof(_inside_iph), &_inside_iph); -+ inside_iph = skb_header_pointer(skb, outside_hdrlen + sizeof(_icmph), -+ sizeof(*ipv6_var), ipv6_var); - if (inside_iph == NULL) - return 1; - inside_nexthdr = inside_iph->nexthdr; - -- inside_hdrlen = ipv6_skip_exthdr(skb, outside_hdrlen + sizeof(_icmph) + sizeof(_inside_iph), -+ inside_hdrlen = ipv6_skip_exthdr(skb, outside_hdrlen + sizeof(_icmph) + -+ sizeof(*ipv6_var), - &inside_nexthdr, &inside_fragoff); - if (inside_hdrlen < 0) - return 1; /* hjm: Packet has no/incomplete transport layer headers. */ -@@ -315,10 +318,10 @@ xt_socket_get_sock_v6(struct net *net, const u8 protocol, - static bool - socket_mt6_v1_v2(const struct sk_buff *skb, struct xt_action_param *par) - { -- struct ipv6hdr *iph = ipv6_hdr(skb); -+ struct ipv6hdr ipv6_var, *iph = ipv6_hdr(skb); - struct udphdr _hdr, *hp = NULL; - struct sock *sk = skb->sk; -- struct in6_addr *daddr = NULL, *saddr = NULL; -+ const struct in6_addr *daddr = NULL, *saddr = NULL; - __be16 uninitialized_var(dport), uninitialized_var(sport); - int thoff = 0, uninitialized_var(tproto); - const struct xt_socket_mtinfo1 *info = (struct xt_socket_mtinfo1 *) par->matchinfo; -@@ -365,7 +368,7 @@ xt_socket_get6_sk(const struct sk_buff *skb, struct xt_action_param *par) - - } else if (tproto == IPPROTO_ICMPV6) { - if (extract_icmp6_fields(skb, thoff, &tproto, &saddr, &daddr, -- &sport, &dport)) -+ &sport, &dport, &ipv6_var)) - return NULL; - } else { - return NULL; -diff --git a/net/rds/iw_rdma.c b/net/rds/iw_rdma.c -index a817705ce2d0..dba8d0864f18 100644 ---- a/net/rds/iw_rdma.c -+++ b/net/rds/iw_rdma.c -@@ -88,7 +88,9 @@ static unsigned int rds_iw_unmap_fastreg_list(struct rds_iw_mr_pool *pool, - int *unpinned); - static void rds_iw_destroy_fastreg(struct rds_iw_mr_pool *pool, struct rds_iw_mr *ibmr); - --static int rds_iw_get_device(struct rds_sock *rs, struct rds_iw_device **rds_iwdev, struct rdma_cm_id **cm_id) -+static int rds_iw_get_device(struct sockaddr_in *src, struct sockaddr_in *dst, -+ struct rds_iw_device **rds_iwdev, -+ struct rdma_cm_id **cm_id) - { - struct rds_iw_device *iwdev; - struct rds_iw_cm_id *i_cm_id; -@@ -112,15 +114,15 @@ static int rds_iw_get_device(struct rds_sock *rs, struct rds_iw_device **rds_iwd - src_addr->sin_port, - dst_addr->sin_addr.s_addr, - dst_addr->sin_port, -- rs->rs_bound_addr, -- rs->rs_bound_port, -- rs->rs_conn_addr, -- rs->rs_conn_port); -+ src->sin_addr.s_addr, -+ src->sin_port, -+ dst->sin_addr.s_addr, -+ dst->sin_port); - #ifdef WORKING_TUPLE_DETECTION -- if (src_addr->sin_addr.s_addr == rs->rs_bound_addr && -- src_addr->sin_port == rs->rs_bound_port && -- dst_addr->sin_addr.s_addr == rs->rs_conn_addr && -- dst_addr->sin_port == rs->rs_conn_port) { -+ if (src_addr->sin_addr.s_addr == src->sin_addr.s_addr && -+ src_addr->sin_port == src->sin_port && -+ dst_addr->sin_addr.s_addr == dst->sin_addr.s_addr && -+ dst_addr->sin_port == dst->sin_port) { - #else - /* FIXME - needs to compare the local and remote - * ipaddr/port tuple, but the ipaddr is the only -@@ -128,7 +130,7 @@ static int rds_iw_get_device(struct rds_sock *rs, struct rds_iw_device **rds_iwd - * zero'ed. It doesn't appear to be properly populated - * during connection setup... - */ -- if (src_addr->sin_addr.s_addr == rs->rs_bound_addr) { -+ if (src_addr->sin_addr.s_addr == src->sin_addr.s_addr) { - #endif - spin_unlock_irq(&iwdev->spinlock); - *rds_iwdev = iwdev; -@@ -180,19 +182,13 @@ int rds_iw_update_cm_id(struct rds_iw_device *rds_iwdev, struct rdma_cm_id *cm_i - { - struct sockaddr_in *src_addr, *dst_addr; - struct rds_iw_device *rds_iwdev_old; -- struct rds_sock rs; - struct rdma_cm_id *pcm_id; - int rc; - - src_addr = (struct sockaddr_in *)&cm_id->route.addr.src_addr; - dst_addr = (struct sockaddr_in *)&cm_id->route.addr.dst_addr; - -- rs.rs_bound_addr = src_addr->sin_addr.s_addr; -- rs.rs_bound_port = src_addr->sin_port; -- rs.rs_conn_addr = dst_addr->sin_addr.s_addr; -- rs.rs_conn_port = dst_addr->sin_port; -- -- rc = rds_iw_get_device(&rs, &rds_iwdev_old, &pcm_id); -+ rc = rds_iw_get_device(src_addr, dst_addr, &rds_iwdev_old, &pcm_id); - if (rc) - rds_iw_remove_cm_id(rds_iwdev, cm_id); - -@@ -598,9 +594,17 @@ void *rds_iw_get_mr(struct scatterlist *sg, unsigned long nents, - struct rds_iw_device *rds_iwdev; - struct rds_iw_mr *ibmr = NULL; - struct rdma_cm_id *cm_id; -+ struct sockaddr_in src = { -+ .sin_addr.s_addr = rs->rs_bound_addr, -+ .sin_port = rs->rs_bound_port, -+ }; -+ struct sockaddr_in dst = { -+ .sin_addr.s_addr = rs->rs_conn_addr, -+ .sin_port = rs->rs_conn_port, -+ }; - int ret; - -- ret = rds_iw_get_device(rs, &rds_iwdev, &cm_id); -+ ret = rds_iw_get_device(&src, &dst, &rds_iwdev, &cm_id); - if (ret || !cm_id) { - ret = -ENODEV; - goto out; -diff --git a/net/rxrpc/ar-recvmsg.c b/net/rxrpc/ar-recvmsg.c -index 34b5490dde65..4949f753686c 100644 ---- a/net/rxrpc/ar-recvmsg.c -+++ b/net/rxrpc/ar-recvmsg.c -@@ -87,7 +87,7 @@ int rxrpc_recvmsg(struct kiocb *iocb, struct socket *sock, - if (!skb) { - /* nothing remains on the queue */ - if (copied && -- (msg->msg_flags & MSG_PEEK || timeo == 0)) -+ (flags & MSG_PEEK || timeo == 0)) - goto out; - - /* wait for a message to turn up */ -diff --git a/sound/core/control.c b/sound/core/control.c -index 98a29b26c5f4..f2082a35b890 100644 ---- a/sound/core/control.c -+++ b/sound/core/control.c -@@ -1168,6 +1168,10 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file, - - if (info->count < 1) - return -EINVAL; -+ if (!*info->id.name) -+ return -EINVAL; -+ if (strnlen(info->id.name, sizeof(info->id.name)) >= sizeof(info->id.name)) -+ return -EINVAL; - access = info->access == 0 ? SNDRV_CTL_ELEM_ACCESS_READWRITE : - (info->access & (SNDRV_CTL_ELEM_ACCESS_READWRITE| - SNDRV_CTL_ELEM_ACCESS_INACTIVE| -diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c -index d9a09bdd09db..9a23bdea97d8 100644 ---- a/sound/pci/hda/hda_generic.c -+++ b/sound/pci/hda/hda_generic.c -@@ -653,12 +653,45 @@ static int get_amp_val_to_activate(struct hda_codec *codec, hda_nid_t nid, - return val; - } - -+/* is this a stereo widget or a stereo-to-mono mix? */ -+static bool is_stereo_amps(struct hda_codec *codec, hda_nid_t nid, int dir) -+{ -+ unsigned int wcaps = get_wcaps(codec, nid); -+ hda_nid_t conn; -+ -+ if (wcaps & AC_WCAP_STEREO) -+ return true; -+ if (dir != HDA_INPUT || get_wcaps_type(wcaps) != AC_WID_AUD_MIX) -+ return false; -+ if (snd_hda_get_num_conns(codec, nid) != 1) -+ return false; -+ if (snd_hda_get_connections(codec, nid, &conn, 1) < 0) -+ return false; -+ return !!(get_wcaps(codec, conn) & AC_WCAP_STEREO); -+} -+ - /* initialize the amp value (only at the first time) */ - static void init_amp(struct hda_codec *codec, hda_nid_t nid, int dir, int idx) - { - unsigned int caps = query_amp_caps(codec, nid, dir); - int val = get_amp_val_to_activate(codec, nid, dir, caps, false); -- snd_hda_codec_amp_init_stereo(codec, nid, dir, idx, 0xff, val); -+ -+ if (is_stereo_amps(codec, nid, dir)) -+ snd_hda_codec_amp_init_stereo(codec, nid, dir, idx, 0xff, val); -+ else -+ snd_hda_codec_amp_init(codec, nid, 0, dir, idx, 0xff, val); -+} -+ -+/* update the amp, doing in stereo or mono depending on NID */ -+static int update_amp(struct hda_codec *codec, hda_nid_t nid, int dir, int idx, -+ unsigned int mask, unsigned int val) -+{ -+ if (is_stereo_amps(codec, nid, dir)) -+ return snd_hda_codec_amp_stereo(codec, nid, dir, idx, -+ mask, val); -+ else -+ return snd_hda_codec_amp_update(codec, nid, 0, dir, idx, -+ mask, val); - } - - /* calculate amp value mask we can modify; -@@ -698,7 +731,7 @@ static void activate_amp(struct hda_codec *codec, hda_nid_t nid, int dir, - return; - - val &= mask; -- snd_hda_codec_amp_stereo(codec, nid, dir, idx, mask, val); -+ update_amp(codec, nid, dir, idx, mask, val); - } - - static void activate_amp_out(struct hda_codec *codec, struct nid_path *path, -@@ -4337,13 +4370,11 @@ static void mute_all_mixer_nid(struct hda_codec *codec, hda_nid_t mix) - has_amp = nid_has_mute(codec, mix, HDA_INPUT); - for (i = 0; i < nums; i++) { - if (has_amp) -- snd_hda_codec_amp_stereo(codec, mix, -- HDA_INPUT, i, -- 0xff, HDA_AMP_MUTE); -+ update_amp(codec, mix, HDA_INPUT, i, -+ 0xff, HDA_AMP_MUTE); - else if (nid_has_volume(codec, conn[i], HDA_OUTPUT)) -- snd_hda_codec_amp_stereo(codec, conn[i], -- HDA_OUTPUT, 0, -- 0xff, HDA_AMP_MUTE); -+ update_amp(codec, conn[i], HDA_OUTPUT, 0, -+ 0xff, HDA_AMP_MUTE); - } - } - -diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c -index 2f3059b50ffa..84e8879cc372 100644 ---- a/sound/pci/hda/hda_intel.c -+++ b/sound/pci/hda/hda_intel.c -@@ -959,7 +959,7 @@ static unsigned int azx_rirb_get_response(struct hda_bus *bus, - } - } - -- if (!bus->no_response_fallback) -+ if (bus->no_response_fallback) - return -1; - - if (!chip->polling_mode && chip->poll_count < 2) { -diff --git a/sound/pci/hda/hda_proc.c b/sound/pci/hda/hda_proc.c -index ce5a6da83419..05e19f78b4cb 100644 ---- a/sound/pci/hda/hda_proc.c -+++ b/sound/pci/hda/hda_proc.c -@@ -134,13 +134,38 @@ static void print_amp_caps(struct snd_info_buffer *buffer, - (caps & AC_AMPCAP_MUTE) >> AC_AMPCAP_MUTE_SHIFT); - } - -+/* is this a stereo widget or a stereo-to-mono mix? */ -+static bool is_stereo_amps(struct hda_codec *codec, hda_nid_t nid, -+ int dir, unsigned int wcaps, int indices) -+{ -+ hda_nid_t conn; -+ -+ if (wcaps & AC_WCAP_STEREO) -+ return true; -+ /* check for a stereo-to-mono mix; it must be: -+ * only a single connection, only for input, and only a mixer widget -+ */ -+ if (indices != 1 || dir != HDA_INPUT || -+ get_wcaps_type(wcaps) != AC_WID_AUD_MIX) -+ return false; -+ -+ if (snd_hda_get_raw_connections(codec, nid, &conn, 1) < 0) -+ return false; -+ /* the connection source is a stereo? */ -+ wcaps = snd_hda_param_read(codec, conn, AC_PAR_AUDIO_WIDGET_CAP); -+ return !!(wcaps & AC_WCAP_STEREO); -+} -+ - static void print_amp_vals(struct snd_info_buffer *buffer, - struct hda_codec *codec, hda_nid_t nid, -- int dir, int stereo, int indices) -+ int dir, unsigned int wcaps, int indices) - { - unsigned int val; -+ bool stereo; - int i; - -+ stereo = is_stereo_amps(codec, nid, dir, wcaps, indices); -+ - dir = dir == HDA_OUTPUT ? AC_AMP_GET_OUTPUT : AC_AMP_GET_INPUT; - for (i = 0; i < indices; i++) { - snd_iprintf(buffer, " ["); -@@ -757,12 +782,10 @@ static void print_codec_info(struct snd_info_entry *entry, - (codec->single_adc_amp && - wid_type == AC_WID_AUD_IN)) - print_amp_vals(buffer, codec, nid, HDA_INPUT, -- wid_caps & AC_WCAP_STEREO, -- 1); -+ wid_caps, 1); - else - print_amp_vals(buffer, codec, nid, HDA_INPUT, -- wid_caps & AC_WCAP_STEREO, -- conn_len); -+ wid_caps, conn_len); - } - if (wid_caps & AC_WCAP_OUT_AMP) { - snd_iprintf(buffer, " Amp-Out caps: "); -@@ -771,11 +794,10 @@ static void print_codec_info(struct snd_info_entry *entry, - if (wid_type == AC_WID_PIN && - codec->pin_amp_workaround) - print_amp_vals(buffer, codec, nid, HDA_OUTPUT, -- wid_caps & AC_WCAP_STEREO, -- conn_len); -+ wid_caps, conn_len); - else - print_amp_vals(buffer, codec, nid, HDA_OUTPUT, -- wid_caps & AC_WCAP_STEREO, 1); -+ wid_caps, 1); - } - - switch (wid_type) { -diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c -index fc492ac24caa..51e208022cc8 100644 ---- a/sound/pci/hda/patch_cirrus.c -+++ b/sound/pci/hda/patch_cirrus.c -@@ -396,6 +396,7 @@ static const struct snd_pci_quirk cs420x_fixup_tbl[] = { - SND_PCI_QUIRK(0x106b, 0x1c00, "MacBookPro 8,1", CS420X_MBP81), - SND_PCI_QUIRK(0x106b, 0x2000, "iMac 12,2", CS420X_IMAC27_122), - SND_PCI_QUIRK(0x106b, 0x2800, "MacBookPro 10,1", CS420X_MBP101), -+ SND_PCI_QUIRK(0x106b, 0x5600, "MacBookAir 5,2", CS420X_MBP81), - SND_PCI_QUIRK(0x106b, 0x5b00, "MacBookAir 4,2", CS420X_MBA42), - SND_PCI_QUIRK_VENDOR(0x106b, "Apple", CS420X_APPLE), - {} /* terminator */ -@@ -587,6 +588,7 @@ static int patch_cs420x(struct hda_codec *codec) - return -ENOMEM; - - spec->gen.automute_hook = cs_automute; -+ codec->single_adc_amp = 1; - - snd_hda_pick_fixup(codec, cs420x_models, cs420x_fixup_tbl, - cs420x_fixups); -diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c -index ffc19464b978..976493c4a695 100644 ---- a/sound/pci/hda/patch_conexant.c -+++ b/sound/pci/hda/patch_conexant.c -@@ -3232,6 +3232,7 @@ enum { - CXT_PINCFG_LENOVO_TP410, - CXT_PINCFG_LEMOTE_A1004, - CXT_PINCFG_LEMOTE_A1205, -+ CXT_PINCFG_COMPAQ_CQ60, - CXT_FIXUP_STEREO_DMIC, - CXT_FIXUP_INC_MIC_BOOST, - CXT_FIXUP_HEADPHONE_MIC_PIN, -@@ -3368,6 +3369,15 @@ static const struct hda_fixup cxt_fixups[] = { - .type = HDA_FIXUP_PINS, - .v.pins = cxt_pincfg_lemote, - }, -+ [CXT_PINCFG_COMPAQ_CQ60] = { -+ .type = HDA_FIXUP_PINS, -+ .v.pins = (const struct hda_pintbl[]) { -+ /* 0x17 was falsely set up as a mic, it should 0x1d */ -+ { 0x17, 0x400001f0 }, -+ { 0x1d, 0x97a70120 }, -+ { } -+ } -+ }, - [CXT_FIXUP_STEREO_DMIC] = { - .type = HDA_FIXUP_FUNC, - .v.func = cxt_fixup_stereo_dmic, -@@ -3411,6 +3421,7 @@ static const struct hda_fixup cxt_fixups[] = { - }; - - static const struct snd_pci_quirk cxt5051_fixups[] = { -+ SND_PCI_QUIRK(0x103c, 0x360b, "Compaq CQ60", CXT_PINCFG_COMPAQ_CQ60), - SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo X200", CXT_PINCFG_LENOVO_X200), - {} - }; -diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h -index 83bddbdb90e9..5293b5ac8b9d 100644 ---- a/sound/usb/quirks-table.h -+++ b/sound/usb/quirks-table.h -@@ -1773,6 +1773,36 @@ YAMAHA_DEVICE(0x7010, "UB99"), - } - } - }, -+{ -+ USB_DEVICE(0x0582, 0x0159), -+ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { -+ /* .vendor_name = "Roland", */ -+ /* .product_name = "UA-22", */ -+ .ifnum = QUIRK_ANY_INTERFACE, -+ .type = QUIRK_COMPOSITE, -+ .data = (const struct snd_usb_audio_quirk[]) { -+ { -+ .ifnum = 0, -+ .type = QUIRK_AUDIO_STANDARD_INTERFACE -+ }, -+ { -+ .ifnum = 1, -+ .type = QUIRK_AUDIO_STANDARD_INTERFACE -+ }, -+ { -+ .ifnum = 2, -+ .type = QUIRK_MIDI_FIXED_ENDPOINT, -+ .data = & (const struct snd_usb_midi_endpoint_info) { -+ .out_cables = 0x0001, -+ .in_cables = 0x0001 -+ } -+ }, -+ { -+ .ifnum = -1 -+ } -+ } -+ } -+}, - /* this catches most recent vendor-specific Roland devices */ - { - .match_flags = USB_DEVICE_ID_MATCH_VENDOR | diff --git a/patch/kernel/odroidc2-default/patch-3.14.37-38.patch b/patch/kernel/odroidc2-default/patch-3.14.37-38.patch deleted file mode 100644 index a7c8725443..0000000000 --- a/patch/kernel/odroidc2-default/patch-3.14.37-38.patch +++ /dev/null @@ -1,1029 +0,0 @@ -diff --git a/Makefile b/Makefile -index c24acc0d34a1..f09e19d2cc4f 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 3 - PATCHLEVEL = 14 --SUBLEVEL = 37 -+SUBLEVEL = 38 - EXTRAVERSION = - NAME = Remembering Coco - -diff --git a/arch/arm64/include/asm/mmu_context.h b/arch/arm64/include/asm/mmu_context.h -index a9eee33dfa62..101a42bde728 100644 ---- a/arch/arm64/include/asm/mmu_context.h -+++ b/arch/arm64/include/asm/mmu_context.h -@@ -151,6 +151,15 @@ switch_mm(struct mm_struct *prev, struct mm_struct *next, - { - unsigned int cpu = smp_processor_id(); - -+ /* -+ * init_mm.pgd does not contain any user mappings and it is always -+ * active for kernel addresses in TTBR1. Just set the reserved TTBR0. -+ */ -+ if (next == &init_mm) { -+ cpu_set_reserved_ttbr0(); -+ return; -+ } -+ - if (!cpumask_test_and_set_cpu(cpu, mm_cpumask(next)) || prev != next) - check_and_switch_context(next, tsk); - } -diff --git a/arch/powerpc/boot/dts/fsl/pq3-etsec2-0.dtsi b/arch/powerpc/boot/dts/fsl/pq3-etsec2-0.dtsi -index 1382fec9e8c5..7fcb1ac0f232 100644 ---- a/arch/powerpc/boot/dts/fsl/pq3-etsec2-0.dtsi -+++ b/arch/powerpc/boot/dts/fsl/pq3-etsec2-0.dtsi -@@ -50,6 +50,7 @@ ethernet@b0000 { - fsl,num_tx_queues = <0x8>; - fsl,magic-packet; - local-mac-address = [ 00 00 00 00 00 00 ]; -+ ranges; - - queue-group@b0000 { - #address-cells = <1>; -diff --git a/arch/powerpc/boot/dts/fsl/pq3-etsec2-1.dtsi b/arch/powerpc/boot/dts/fsl/pq3-etsec2-1.dtsi -index 221cd2ea5b31..9f25427c1527 100644 ---- a/arch/powerpc/boot/dts/fsl/pq3-etsec2-1.dtsi -+++ b/arch/powerpc/boot/dts/fsl/pq3-etsec2-1.dtsi -@@ -50,6 +50,7 @@ ethernet@b1000 { - fsl,num_tx_queues = <0x8>; - fsl,magic-packet; - local-mac-address = [ 00 00 00 00 00 00 ]; -+ ranges; - - queue-group@b1000 { - #address-cells = <1>; -diff --git a/arch/powerpc/boot/dts/fsl/pq3-etsec2-2.dtsi b/arch/powerpc/boot/dts/fsl/pq3-etsec2-2.dtsi -index 61456c317609..cd7c318ab131 100644 ---- a/arch/powerpc/boot/dts/fsl/pq3-etsec2-2.dtsi -+++ b/arch/powerpc/boot/dts/fsl/pq3-etsec2-2.dtsi -@@ -49,6 +49,7 @@ ethernet@b2000 { - fsl,num_tx_queues = <0x8>; - fsl,magic-packet; - local-mac-address = [ 00 00 00 00 00 00 ]; -+ ranges; - - queue-group@b2000 { - #address-cells = <1>; -diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S -index 38d507306a11..5193116eadc0 100644 ---- a/arch/powerpc/kernel/exceptions-64s.S -+++ b/arch/powerpc/kernel/exceptions-64s.S -@@ -1422,7 +1422,7 @@ machine_check_handle_early: - bne 9f /* continue in V mode if we are. */ - - 5: --#ifdef CONFIG_KVM_BOOK3S_64_HV -+#ifdef CONFIG_KVM_BOOK3S_64_HANDLER - /* - * We are coming from kernel context. Check if we are coming from - * guest. if yes, then we can continue. We will fall through -diff --git a/arch/powerpc/platforms/pseries/mobility.c b/arch/powerpc/platforms/pseries/mobility.c -index cde4e0a095ae..bf3829242aff 100644 ---- a/arch/powerpc/platforms/pseries/mobility.c -+++ b/arch/powerpc/platforms/pseries/mobility.c -@@ -24,10 +24,10 @@ - static struct kobject *mobility_kobj; - - struct update_props_workarea { -- u32 phandle; -- u32 state; -- u64 reserved; -- u32 nprops; -+ __be32 phandle; -+ __be32 state; -+ __be64 reserved; -+ __be32 nprops; - } __packed; - - #define NODE_ACTION_MASK 0xff000000 -@@ -53,11 +53,11 @@ static int mobility_rtas_call(int token, char *buf, s32 scope) - return rc; - } - --static int delete_dt_node(u32 phandle) -+static int delete_dt_node(__be32 phandle) - { - struct device_node *dn; - -- dn = of_find_node_by_phandle(phandle); -+ dn = of_find_node_by_phandle(be32_to_cpu(phandle)); - if (!dn) - return -ENOENT; - -@@ -126,7 +126,7 @@ static int update_dt_property(struct device_node *dn, struct property **prop, - return 0; - } - --static int update_dt_node(u32 phandle, s32 scope) -+static int update_dt_node(__be32 phandle, s32 scope) - { - struct update_props_workarea *upwa; - struct device_node *dn; -@@ -135,6 +135,7 @@ static int update_dt_node(u32 phandle, s32 scope) - char *prop_data; - char *rtas_buf; - int update_properties_token; -+ u32 nprops; - u32 vd; - - update_properties_token = rtas_token("ibm,update-properties"); -@@ -145,7 +146,7 @@ static int update_dt_node(u32 phandle, s32 scope) - if (!rtas_buf) - return -ENOMEM; - -- dn = of_find_node_by_phandle(phandle); -+ dn = of_find_node_by_phandle(be32_to_cpu(phandle)); - if (!dn) { - kfree(rtas_buf); - return -ENOENT; -@@ -161,6 +162,7 @@ static int update_dt_node(u32 phandle, s32 scope) - break; - - prop_data = rtas_buf + sizeof(*upwa); -+ nprops = be32_to_cpu(upwa->nprops); - - /* On the first call to ibm,update-properties for a node the - * the first property value descriptor contains an empty -@@ -169,17 +171,17 @@ static int update_dt_node(u32 phandle, s32 scope) - */ - if (*prop_data == 0) { - prop_data++; -- vd = *(u32 *)prop_data; -+ vd = be32_to_cpu(*(__be32 *)prop_data); - prop_data += vd + sizeof(vd); -- upwa->nprops--; -+ nprops--; - } - -- for (i = 0; i < upwa->nprops; i++) { -+ for (i = 0; i < nprops; i++) { - char *prop_name; - - prop_name = prop_data; - prop_data += strlen(prop_name) + 1; -- vd = *(u32 *)prop_data; -+ vd = be32_to_cpu(*(__be32 *)prop_data); - prop_data += sizeof(vd); - - switch (vd) { -@@ -211,13 +213,13 @@ static int update_dt_node(u32 phandle, s32 scope) - return 0; - } - --static int add_dt_node(u32 parent_phandle, u32 drc_index) -+static int add_dt_node(__be32 parent_phandle, __be32 drc_index) - { - struct device_node *dn; - struct device_node *parent_dn; - int rc; - -- parent_dn = of_find_node_by_phandle(parent_phandle); -+ parent_dn = of_find_node_by_phandle(be32_to_cpu(parent_phandle)); - if (!parent_dn) - return -ENOENT; - -@@ -236,7 +238,7 @@ static int add_dt_node(u32 parent_phandle, u32 drc_index) - int pseries_devicetree_update(s32 scope) - { - char *rtas_buf; -- u32 *data; -+ __be32 *data; - int update_nodes_token; - int rc; - -@@ -253,17 +255,17 @@ int pseries_devicetree_update(s32 scope) - if (rc && rc != 1) - break; - -- data = (u32 *)rtas_buf + 4; -- while (*data & NODE_ACTION_MASK) { -+ data = (__be32 *)rtas_buf + 4; -+ while (be32_to_cpu(*data) & NODE_ACTION_MASK) { - int i; -- u32 action = *data & NODE_ACTION_MASK; -- int node_count = *data & NODE_COUNT_MASK; -+ u32 action = be32_to_cpu(*data) & NODE_ACTION_MASK; -+ u32 node_count = be32_to_cpu(*data) & NODE_COUNT_MASK; - - data++; - - for (i = 0; i < node_count; i++) { -- u32 phandle = *data++; -- u32 drc_index; -+ __be32 phandle = *data++; -+ __be32 drc_index; - - switch (action) { - case DELETE_DT_NODE: -diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c -index 930cad4e5df8..2b946bc4212d 100644 ---- a/drivers/base/regmap/regcache-rbtree.c -+++ b/drivers/base/regmap/regcache-rbtree.c -@@ -313,7 +313,7 @@ static int regcache_rbtree_insert_to_block(struct regmap *map, - if (pos == 0) { - memmove(blk + offset * map->cache_word_size, - blk, rbnode->blklen * map->cache_word_size); -- bitmap_shift_right(present, present, offset, blklen); -+ bitmap_shift_left(present, present, offset, blklen); - } - - /* update the rbnode block, its size and the base register */ -diff --git a/drivers/clocksource/time-efm32.c b/drivers/clocksource/time-efm32.c -index 1a6205b7bed3..35b016100673 100644 ---- a/drivers/clocksource/time-efm32.c -+++ b/drivers/clocksource/time-efm32.c -@@ -225,12 +225,12 @@ static int __init efm32_clockevent_init(struct device_node *np) - clock_event_ddata.base = base; - clock_event_ddata.periodic_top = DIV_ROUND_CLOSEST(rate, 1024 * HZ); - -- setup_irq(irq, &efm32_clock_event_irq); -- - clockevents_config_and_register(&clock_event_ddata.evtdev, - DIV_ROUND_CLOSEST(rate, 1024), - 0xf, 0xffff); - -+ setup_irq(irq, &efm32_clock_event_irq); -+ - return 0; - - err_get_irq: -diff --git a/drivers/clocksource/timer-sun5i.c b/drivers/clocksource/timer-sun5i.c -index deebcd6469fc..4f0f3610371a 100644 ---- a/drivers/clocksource/timer-sun5i.c -+++ b/drivers/clocksource/timer-sun5i.c -@@ -172,10 +172,6 @@ static void __init sun5i_timer_init(struct device_node *node) - - ticks_per_jiffy = DIV_ROUND_UP(rate, HZ); - -- ret = setup_irq(irq, &sun5i_timer_irq); -- if (ret) -- pr_warn("failed to setup irq %d\n", irq); -- - /* Enable timer0 interrupt */ - val = readl(timer_base + TIMER_IRQ_EN_REG); - writel(val | TIMER_IRQ_EN(0), timer_base + TIMER_IRQ_EN_REG); -@@ -185,6 +181,10 @@ static void __init sun5i_timer_init(struct device_node *node) - - clockevents_config_and_register(&sun5i_clockevent, rate, - TIMER_SYNC_TICKS, 0xffffffff); -+ -+ ret = setup_irq(irq, &sun5i_timer_irq); -+ if (ret) -+ pr_warn("failed to setup irq %d\n", irq); - } - CLOCKSOURCE_OF_DECLARE(sun5i_a13, "allwinner,sun5i-a13-hstimer", - sun5i_timer_init); -diff --git a/drivers/dma/dw/platform.c b/drivers/dma/dw/platform.c -index 453822cc4f9d..fe8b0c991518 100644 ---- a/drivers/dma/dw/platform.c -+++ b/drivers/dma/dw/platform.c -@@ -48,6 +48,8 @@ static bool dw_dma_of_filter(struct dma_chan *chan, void *param) - return true; - } - -+#define DRV_NAME "dw_dmac" -+ - static struct dma_chan *dw_dma_of_xlate(struct of_phandle_args *dma_spec, - struct of_dma *ofdma) - { -@@ -293,7 +295,7 @@ static struct platform_driver dw_driver = { - .remove = dw_remove, - .shutdown = dw_shutdown, - .driver = { -- .name = "dw_dmac", -+ .name = DRV_NAME, - .pm = &dw_dev_pm_ops, - .of_match_table = of_match_ptr(dw_dma_of_id_table), - .acpi_match_table = ACPI_PTR(dw_dma_acpi_id_table), -@@ -314,3 +316,4 @@ module_exit(dw_exit); - - MODULE_LICENSE("GPL v2"); - MODULE_DESCRIPTION("Synopsys DesignWare DMA Controller platform driver"); -+MODULE_ALIAS("platform:" DRV_NAME); -diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c -index d2a8d64f8526..080e767250d3 100644 ---- a/drivers/md/dm-io.c -+++ b/drivers/md/dm-io.c -@@ -291,9 +291,16 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where, - struct request_queue *q = bdev_get_queue(where->bdev); - unsigned short logical_block_size = queue_logical_block_size(q); - sector_t num_sectors; -+ unsigned int uninitialized_var(special_cmd_max_sectors); - -- /* Reject unsupported discard requests */ -- if ((rw & REQ_DISCARD) && !blk_queue_discard(q)) { -+ /* -+ * Reject unsupported discard and write same requests. -+ */ -+ if (rw & REQ_DISCARD) -+ special_cmd_max_sectors = q->limits.max_discard_sectors; -+ else if (rw & REQ_WRITE_SAME) -+ special_cmd_max_sectors = q->limits.max_write_same_sectors; -+ if ((rw & (REQ_DISCARD | REQ_WRITE_SAME)) && special_cmd_max_sectors == 0) { - dec_count(io, region, -EOPNOTSUPP); - return; - } -@@ -319,7 +326,7 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where, - store_io_and_region_in_bio(bio, io, region); - - if (rw & REQ_DISCARD) { -- num_sectors = min_t(sector_t, q->limits.max_discard_sectors, remaining); -+ num_sectors = min_t(sector_t, special_cmd_max_sectors, remaining); - bio->bi_iter.bi_size = num_sectors << SECTOR_SHIFT; - remaining -= num_sectors; - } else if (rw & REQ_WRITE_SAME) { -@@ -328,7 +335,7 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where, - */ - dp->get_page(dp, &page, &len, &offset); - bio_add_page(bio, page, logical_block_size, offset); -- num_sectors = min_t(sector_t, q->limits.max_write_same_sectors, remaining); -+ num_sectors = min_t(sector_t, special_cmd_max_sectors, remaining); - bio->bi_iter.bi_size = num_sectors << SECTOR_SHIFT; - - offset = 0; -diff --git a/drivers/md/dm.c b/drivers/md/dm.c -index 1582c3dac3ac..e40059143272 100644 ---- a/drivers/md/dm.c -+++ b/drivers/md/dm.c -@@ -2352,10 +2352,16 @@ static void __dm_destroy(struct mapped_device *md, bool wait) - set_bit(DMF_FREEING, &md->flags); - spin_unlock(&_minor_lock); - -+ /* -+ * Take suspend_lock so that presuspend and postsuspend methods -+ * do not race with internal suspend. -+ */ -+ mutex_lock(&md->suspend_lock); - if (!dm_suspended_md(md)) { - dm_table_presuspend_targets(map); - dm_table_postsuspend_targets(map); - } -+ mutex_unlock(&md->suspend_lock); - - /* dm_put_live_table must be before msleep, otherwise deadlock is possible */ - dm_put_live_table(md, srcu_idx); -diff --git a/drivers/mfd/kempld-core.c b/drivers/mfd/kempld-core.c -index 38917a822335..2df3cbc968d1 100644 ---- a/drivers/mfd/kempld-core.c -+++ b/drivers/mfd/kempld-core.c -@@ -629,7 +629,7 @@ static int __init kempld_init(void) - if (force_device_id[0]) { - for (id = kempld_dmi_table; id->matches[0].slot != DMI_NONE; id++) - if (strstr(id->ident, force_device_id)) -- if (id->callback && id->callback(id)) -+ if (id->callback && !id->callback(id)) - break; - if (id->matches[0].slot == DMI_NONE) - return -ENODEV; -diff --git a/drivers/net/ethernet/amd/pcnet32.c b/drivers/net/ethernet/amd/pcnet32.c -index 9339cccfe05a..ad0e71c7a607 100644 ---- a/drivers/net/ethernet/amd/pcnet32.c -+++ b/drivers/net/ethernet/amd/pcnet32.c -@@ -1516,7 +1516,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev) - { - struct pcnet32_private *lp; - int i, media; -- int fdx, mii, fset, dxsuflo; -+ int fdx, mii, fset, dxsuflo, sram; - int chip_version; - char *chipname; - struct net_device *dev; -@@ -1553,7 +1553,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev) - } - - /* initialize variables */ -- fdx = mii = fset = dxsuflo = 0; -+ fdx = mii = fset = dxsuflo = sram = 0; - chip_version = (chip_version >> 12) & 0xffff; - - switch (chip_version) { -@@ -1586,6 +1586,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev) - chipname = "PCnet/FAST III 79C973"; /* PCI */ - fdx = 1; - mii = 1; -+ sram = 1; - break; - case 0x2626: - chipname = "PCnet/Home 79C978"; /* PCI */ -@@ -1609,6 +1610,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev) - chipname = "PCnet/FAST III 79C975"; /* PCI */ - fdx = 1; - mii = 1; -+ sram = 1; - break; - case 0x2628: - chipname = "PCnet/PRO 79C976"; -@@ -1637,6 +1639,31 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev) - dxsuflo = 1; - } - -+ /* -+ * The Am79C973/Am79C975 controllers come with 12K of SRAM -+ * which we can use for the Tx/Rx buffers but most importantly, -+ * the use of SRAM allow us to use the BCR18:NOUFLO bit to avoid -+ * Tx fifo underflows. -+ */ -+ if (sram) { -+ /* -+ * The SRAM is being configured in two steps. First we -+ * set the SRAM size in the BCR25:SRAM_SIZE bits. According -+ * to the datasheet, each bit corresponds to a 512-byte -+ * page so we can have at most 24 pages. The SRAM_SIZE -+ * holds the value of the upper 8 bits of the 16-bit SRAM size. -+ * The low 8-bits start at 0x00 and end at 0xff. So the -+ * address range is from 0x0000 up to 0x17ff. Therefore, -+ * the SRAM_SIZE is set to 0x17. The next step is to set -+ * the BCR26:SRAM_BND midway through so the Tx and Rx -+ * buffers can share the SRAM equally. -+ */ -+ a->write_bcr(ioaddr, 25, 0x17); -+ a->write_bcr(ioaddr, 26, 0xc); -+ /* And finally enable the NOUFLO bit */ -+ a->write_bcr(ioaddr, 18, a->read_bcr(ioaddr, 18) | (1 << 11)); -+ } -+ - dev = alloc_etherdev(sizeof(*lp)); - if (!dev) { - ret = -ENOMEM; -diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c -index a04174607e97..4a3b8b72c8af 100644 ---- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c -+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c -@@ -594,7 +594,7 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw, - - ret = iwl_mvm_mac_ctxt_add(mvm, vif); - if (ret) -- goto out_remove_mac; -+ goto out_release; - - iwl_mvm_power_disable(mvm, vif); - -diff --git a/drivers/of/irq.c b/drivers/of/irq.c -index 48f20ff1add9..bbff99dcbaea 100644 ---- a/drivers/of/irq.c -+++ b/drivers/of/irq.c -@@ -290,7 +290,7 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar - struct device_node *p; - const __be32 *intspec, *tmp, *addr; - u32 intsize, intlen; -- int i, res = -EINVAL; -+ int i, res; - - pr_debug("of_irq_parse_one: dev=%s, index=%d\n", of_node_full_name(device), index); - -@@ -323,15 +323,19 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar - - /* Get size of interrupt specifier */ - tmp = of_get_property(p, "#interrupt-cells", NULL); -- if (tmp == NULL) -+ if (tmp == NULL) { -+ res = -EINVAL; - goto out; -+ } - intsize = be32_to_cpu(*tmp); - - pr_debug(" intsize=%d intlen=%d\n", intsize, intlen); - - /* Check index */ -- if ((index + 1) * intsize > intlen) -+ if ((index + 1) * intsize > intlen) { -+ res = -EINVAL; - goto out; -+ } - - /* Copy intspec into irq structure */ - intspec += index * intsize; -diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c -index 34d56f7864d6..86592dd24da5 100644 ---- a/drivers/phy/phy-core.c -+++ b/drivers/phy/phy-core.c -@@ -50,7 +50,9 @@ static void devm_phy_consume(struct device *dev, void *res) - - static int devm_phy_match(struct device *dev, void *res, void *match_data) - { -- return res == match_data; -+ struct phy **phy = res; -+ -+ return *phy == match_data; - } - - static struct phy *phy_lookup(struct device *device, const char *port) -diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c -index 9d81f7693f99..1817f3f2b02d 100644 ---- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c -+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c -@@ -1515,7 +1515,7 @@ static int tcm_qla2xxx_check_initiator_node_acl( - /* - * Finally register the new FC Nexus with TCM - */ -- __transport_register_session(se_nacl->se_tpg, se_nacl, se_sess, sess); -+ transport_register_session(se_nacl->se_tpg, se_nacl, se_sess, sess); - - return 0; - } -diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c -index fbf3b22efe5a..d6563ec700d4 100644 ---- a/drivers/spi/spi.c -+++ b/drivers/spi/spi.c -@@ -846,13 +846,14 @@ void spi_finalize_current_message(struct spi_master *master) - "failed to unprepare message: %d\n", ret); - } - } -+ -+ trace_spi_message_done(mesg); -+ - master->cur_msg_prepared = false; - - mesg->state = NULL; - if (mesg->complete) - mesg->complete(mesg->context); -- -- trace_spi_message_done(mesg); - } - EXPORT_SYMBOL_GPL(spi_finalize_current_message); - -diff --git a/drivers/staging/vt6655/rf.c b/drivers/staging/vt6655/rf.c -index edb1b2768b17..dbd9d44919ac 100644 ---- a/drivers/staging/vt6655/rf.c -+++ b/drivers/staging/vt6655/rf.c -@@ -936,6 +936,7 @@ bool RFbSetPower( - break; - case RATE_6M: - case RATE_9M: -+ case RATE_12M: - case RATE_18M: - byPwr = pDevice->abyOFDMPwrTbl[uCH]; - if (pDevice->byRFType == RF_UW2452) { -diff --git a/drivers/staging/vt6656/rf.c b/drivers/staging/vt6656/rf.c -index 1e8f64bff03c..2dc48d4ff433 100644 ---- a/drivers/staging/vt6656/rf.c -+++ b/drivers/staging/vt6656/rf.c -@@ -752,6 +752,7 @@ int RFbSetPower(struct vnt_private *priv, u32 rate, u32 channel) - break; - case RATE_6M: - case RATE_9M: -+ case RATE_12M: - case RATE_18M: - case RATE_24M: - case RATE_36M: -diff --git a/drivers/target/tcm_fc/tfc_io.c b/drivers/target/tcm_fc/tfc_io.c -index e415af32115a..c67d3795db4a 100644 ---- a/drivers/target/tcm_fc/tfc_io.c -+++ b/drivers/target/tcm_fc/tfc_io.c -@@ -346,7 +346,7 @@ void ft_invl_hw_context(struct ft_cmd *cmd) - ep = fc_seq_exch(seq); - if (ep) { - lport = ep->lp; -- if (lport && (ep->xid <= lport->lro_xid)) -+ if (lport && (ep->xid <= lport->lro_xid)) { - /* - * "ddp_done" trigger invalidation of HW - * specific DDP context -@@ -361,6 +361,7 @@ void ft_invl_hw_context(struct ft_cmd *cmd) - * identified using ep->xid) - */ - cmd->was_ddp_setup = 0; -+ } - } - } - } -diff --git a/fs/hfsplus/brec.c b/fs/hfsplus/brec.c -index 6e560d56094b..754fdf8c6356 100644 ---- a/fs/hfsplus/brec.c -+++ b/fs/hfsplus/brec.c -@@ -131,13 +131,16 @@ skip: - hfs_bnode_write(node, entry, data_off + key_len, entry_len); - hfs_bnode_dump(node); - -- if (new_node) { -- /* update parent key if we inserted a key -- * at the start of the first node -- */ -- if (!rec && new_node != node) -- hfs_brec_update_parent(fd); -+ /* -+ * update parent key if we inserted a key -+ * at the start of the node and it is not the new node -+ */ -+ if (!rec && new_node != node) { -+ hfs_bnode_read_key(node, fd->search_key, data_off + size); -+ hfs_brec_update_parent(fd); -+ } - -+ if (new_node) { - hfs_bnode_put(fd->bnode); - if (!new_node->parent) { - hfs_btree_inc_height(tree); -@@ -168,9 +171,6 @@ skip: - goto again; - } - -- if (!rec) -- hfs_brec_update_parent(fd); -- - return 0; - } - -@@ -370,6 +370,8 @@ again: - if (IS_ERR(parent)) - return PTR_ERR(parent); - __hfs_brec_find(parent, fd, hfs_find_rec_by_key); -+ if (fd->record < 0) -+ return -ENOENT; - hfs_bnode_dump(parent); - rec = fd->record; - -diff --git a/kernel/events/core.c b/kernel/events/core.c -index 69cffb46db17..60146febb9b3 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -4232,6 +4232,13 @@ static void perf_pending_event(struct irq_work *entry) - { - struct perf_event *event = container_of(entry, - struct perf_event, pending); -+ int rctx; -+ -+ rctx = perf_swevent_get_recursion_context(); -+ /* -+ * If we 'fail' here, that's OK, it means recursion is already disabled -+ * and we won't recurse 'further'. -+ */ - - if (event->pending_disable) { - event->pending_disable = 0; -@@ -4242,6 +4249,9 @@ static void perf_pending_event(struct irq_work *entry) - event->pending_wakeup = 0; - perf_event_wakeup(event); - } -+ -+ if (rctx >= 0) -+ perf_swevent_put_recursion_context(rctx); - } - - /* -diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h -index bf7a1bbb975f..e278c64572de 100644 ---- a/net/mac80211/ieee80211_i.h -+++ b/net/mac80211/ieee80211_i.h -@@ -57,13 +57,24 @@ struct ieee80211_local; - #define IEEE80211_UNSET_POWER_LEVEL INT_MIN - - /* -- * Some APs experience problems when working with U-APSD. Decrease the -- * probability of that happening by using legacy mode for all ACs but VO. -- * The AP that caused us trouble was a Cisco 4410N. It ignores our -- * setting, and always treats non-VO ACs as legacy. -+ * Some APs experience problems when working with U-APSD. Decreasing the -+ * probability of that happening by using legacy mode for all ACs but VO isn't -+ * enough. -+ * -+ * Cisco 4410N originally forced us to enable VO by default only because it -+ * treated non-VO ACs as legacy. -+ * -+ * However some APs (notably Netgear R7000) silently reclassify packets to -+ * different ACs. Since u-APSD ACs require trigger frames for frame retrieval -+ * clients would never see some frames (e.g. ARP responses) or would fetch them -+ * accidentally after a long time. -+ * -+ * It makes little sense to enable u-APSD queues by default because it needs -+ * userspace applications to be aware of it to actually take advantage of the -+ * possible additional powersavings. Implicitly depending on driver autotrigger -+ * frame support doesn't make much sense. - */ --#define IEEE80211_DEFAULT_UAPSD_QUEUES \ -- IEEE80211_WMM_IE_STA_QOSINFO_AC_VO -+#define IEEE80211_DEFAULT_UAPSD_QUEUES 0 - - #define IEEE80211_DEFAULT_MAX_SP_LEN \ - IEEE80211_WMM_IE_STA_QOSINFO_SP_ALL -diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c -index 815ca56b39e7..9abb445ea261 100644 ---- a/net/mac80211/rx.c -+++ b/net/mac80211/rx.c -@@ -2107,6 +2107,9 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx) - hdr = (struct ieee80211_hdr *) skb->data; - mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen); - -+ if (ieee80211_drop_unencrypted(rx, hdr->frame_control)) -+ return RX_DROP_MONITOR; -+ - /* frame is in RMC, don't forward */ - if (ieee80211_is_data(hdr->frame_control) && - is_multicast_ether_addr(hdr->addr1) && -diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c -index 18d73df72531..c260243dbe07 100644 ---- a/net/wireless/nl80211.c -+++ b/net/wireless/nl80211.c -@@ -4190,6 +4190,16 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info) - if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms)) - return -EINVAL; - -+ /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT -+ * as userspace might just pass through the capabilities from the IEs -+ * directly, rather than enforcing this restriction and returning an -+ * error in this case. -+ */ -+ if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) { -+ params.ht_capa = NULL; -+ params.vht_capa = NULL; -+ } -+ - /* When you run into this, adjust the code below for the new flag */ - BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7); - -diff --git a/sound/soc/codecs/adav80x.c b/sound/soc/codecs/adav80x.c -index f78b27a7c461..23454e9a5d3a 100644 ---- a/sound/soc/codecs/adav80x.c -+++ b/sound/soc/codecs/adav80x.c -@@ -319,7 +319,7 @@ static int adav80x_put_deemph(struct snd_kcontrol *kcontrol, - { - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct adav80x *adav80x = snd_soc_codec_get_drvdata(codec); -- unsigned int deemph = ucontrol->value.enumerated.item[0]; -+ unsigned int deemph = ucontrol->value.integer.value[0]; - - if (deemph > 1) - return -EINVAL; -@@ -335,7 +335,7 @@ static int adav80x_get_deemph(struct snd_kcontrol *kcontrol, - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct adav80x *adav80x = snd_soc_codec_get_drvdata(codec); - -- ucontrol->value.enumerated.item[0] = adav80x->deemph; -+ ucontrol->value.integer.value[0] = adav80x->deemph; - return 0; - }; - -diff --git a/sound/soc/codecs/ak4641.c b/sound/soc/codecs/ak4641.c -index 94cbe508dd37..d7184726f8a0 100644 ---- a/sound/soc/codecs/ak4641.c -+++ b/sound/soc/codecs/ak4641.c -@@ -76,7 +76,7 @@ static int ak4641_put_deemph(struct snd_kcontrol *kcontrol, - { - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct ak4641_priv *ak4641 = snd_soc_codec_get_drvdata(codec); -- int deemph = ucontrol->value.enumerated.item[0]; -+ int deemph = ucontrol->value.integer.value[0]; - - if (deemph > 1) - return -EINVAL; -@@ -92,7 +92,7 @@ static int ak4641_get_deemph(struct snd_kcontrol *kcontrol, - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct ak4641_priv *ak4641 = snd_soc_codec_get_drvdata(codec); - -- ucontrol->value.enumerated.item[0] = ak4641->deemph; -+ ucontrol->value.integer.value[0] = ak4641->deemph; - return 0; - }; - -diff --git a/sound/soc/codecs/cs4271.c b/sound/soc/codecs/cs4271.c -index ce05fd93dc74..a0ad41ac5574 100644 ---- a/sound/soc/codecs/cs4271.c -+++ b/sound/soc/codecs/cs4271.c -@@ -288,7 +288,7 @@ static int cs4271_get_deemph(struct snd_kcontrol *kcontrol, - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct cs4271_private *cs4271 = snd_soc_codec_get_drvdata(codec); - -- ucontrol->value.enumerated.item[0] = cs4271->deemph; -+ ucontrol->value.integer.value[0] = cs4271->deemph; - return 0; - } - -@@ -298,7 +298,7 @@ static int cs4271_put_deemph(struct snd_kcontrol *kcontrol, - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct cs4271_private *cs4271 = snd_soc_codec_get_drvdata(codec); - -- cs4271->deemph = ucontrol->value.enumerated.item[0]; -+ cs4271->deemph = ucontrol->value.integer.value[0]; - return cs4271_set_deemph(codec); - } - -diff --git a/sound/soc/codecs/pcm1681.c b/sound/soc/codecs/pcm1681.c -index 73f9c3630e2c..651e2fe2c31f 100644 ---- a/sound/soc/codecs/pcm1681.c -+++ b/sound/soc/codecs/pcm1681.c -@@ -118,7 +118,7 @@ static int pcm1681_get_deemph(struct snd_kcontrol *kcontrol, - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct pcm1681_private *priv = snd_soc_codec_get_drvdata(codec); - -- ucontrol->value.enumerated.item[0] = priv->deemph; -+ ucontrol->value.integer.value[0] = priv->deemph; - - return 0; - } -@@ -129,7 +129,7 @@ static int pcm1681_put_deemph(struct snd_kcontrol *kcontrol, - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct pcm1681_private *priv = snd_soc_codec_get_drvdata(codec); - -- priv->deemph = ucontrol->value.enumerated.item[0]; -+ priv->deemph = ucontrol->value.integer.value[0]; - - return pcm1681_set_deemph(codec); - } -diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c -index 715589ff0eda..e93c36fd3073 100644 ---- a/sound/soc/codecs/sgtl5000.c -+++ b/sound/soc/codecs/sgtl5000.c -@@ -1198,13 +1198,7 @@ static int sgtl5000_set_power_regs(struct snd_soc_codec *codec) - /* Enable VDDC charge pump */ - ana_pwr |= SGTL5000_VDDC_CHRGPMP_POWERUP; - } else if (vddio >= 3100 && vdda >= 3100) { -- /* -- * if vddio and vddd > 3.1v, -- * charge pump should be clean before set ana_pwr -- */ -- snd_soc_update_bits(codec, SGTL5000_CHIP_ANA_POWER, -- SGTL5000_VDDC_CHRGPMP_POWERUP, 0); -- -+ ana_pwr &= ~SGTL5000_VDDC_CHRGPMP_POWERUP; - /* VDDC use VDDIO rail */ - lreg_ctrl |= SGTL5000_VDDC_ASSN_OVRD; - lreg_ctrl |= SGTL5000_VDDC_MAN_ASSN_VDDIO << -diff --git a/sound/soc/codecs/tas5086.c b/sound/soc/codecs/tas5086.c -index a895a5e4bdf2..c6c65001457d 100644 ---- a/sound/soc/codecs/tas5086.c -+++ b/sound/soc/codecs/tas5086.c -@@ -275,7 +275,7 @@ static int tas5086_get_deemph(struct snd_kcontrol *kcontrol, - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct tas5086_private *priv = snd_soc_codec_get_drvdata(codec); - -- ucontrol->value.enumerated.item[0] = priv->deemph; -+ ucontrol->value.integer.value[0] = priv->deemph; - - return 0; - } -@@ -286,7 +286,7 @@ static int tas5086_put_deemph(struct snd_kcontrol *kcontrol, - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct tas5086_private *priv = snd_soc_codec_get_drvdata(codec); - -- priv->deemph = ucontrol->value.enumerated.item[0]; -+ priv->deemph = ucontrol->value.integer.value[0]; - - return tas5086_set_deemph(codec); - } -diff --git a/sound/soc/codecs/wm2000.c b/sound/soc/codecs/wm2000.c -index 8ae50274ea8f..1a9f4574b65b 100644 ---- a/sound/soc/codecs/wm2000.c -+++ b/sound/soc/codecs/wm2000.c -@@ -610,7 +610,7 @@ static int wm2000_anc_mode_get(struct snd_kcontrol *kcontrol, - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev); - -- ucontrol->value.enumerated.item[0] = wm2000->anc_active; -+ ucontrol->value.integer.value[0] = wm2000->anc_active; - - return 0; - } -@@ -620,7 +620,7 @@ static int wm2000_anc_mode_put(struct snd_kcontrol *kcontrol, - { - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev); -- int anc_active = ucontrol->value.enumerated.item[0]; -+ int anc_active = ucontrol->value.integer.value[0]; - int ret; - - if (anc_active > 1) -@@ -643,7 +643,7 @@ static int wm2000_speaker_get(struct snd_kcontrol *kcontrol, - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev); - -- ucontrol->value.enumerated.item[0] = wm2000->spk_ena; -+ ucontrol->value.integer.value[0] = wm2000->spk_ena; - - return 0; - } -@@ -653,7 +653,7 @@ static int wm2000_speaker_put(struct snd_kcontrol *kcontrol, - { - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev); -- int val = ucontrol->value.enumerated.item[0]; -+ int val = ucontrol->value.integer.value[0]; - int ret; - - if (val > 1) -diff --git a/sound/soc/codecs/wm8731.c b/sound/soc/codecs/wm8731.c -index 029720366ff8..e593722574de 100644 ---- a/sound/soc/codecs/wm8731.c -+++ b/sound/soc/codecs/wm8731.c -@@ -122,7 +122,7 @@ static int wm8731_get_deemph(struct snd_kcontrol *kcontrol, - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct wm8731_priv *wm8731 = snd_soc_codec_get_drvdata(codec); - -- ucontrol->value.enumerated.item[0] = wm8731->deemph; -+ ucontrol->value.integer.value[0] = wm8731->deemph; - - return 0; - } -@@ -132,7 +132,7 @@ static int wm8731_put_deemph(struct snd_kcontrol *kcontrol, - { - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct wm8731_priv *wm8731 = snd_soc_codec_get_drvdata(codec); -- int deemph = ucontrol->value.enumerated.item[0]; -+ int deemph = ucontrol->value.integer.value[0]; - int ret = 0; - - if (deemph > 1) -diff --git a/sound/soc/codecs/wm8903.c b/sound/soc/codecs/wm8903.c -index eebcb1da3b7b..ae7d76efe063 100644 ---- a/sound/soc/codecs/wm8903.c -+++ b/sound/soc/codecs/wm8903.c -@@ -442,7 +442,7 @@ static int wm8903_get_deemph(struct snd_kcontrol *kcontrol, - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct wm8903_priv *wm8903 = snd_soc_codec_get_drvdata(codec); - -- ucontrol->value.enumerated.item[0] = wm8903->deemph; -+ ucontrol->value.integer.value[0] = wm8903->deemph; - - return 0; - } -@@ -452,7 +452,7 @@ static int wm8903_put_deemph(struct snd_kcontrol *kcontrol, - { - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct wm8903_priv *wm8903 = snd_soc_codec_get_drvdata(codec); -- int deemph = ucontrol->value.enumerated.item[0]; -+ int deemph = ucontrol->value.integer.value[0]; - int ret = 0; - - if (deemph > 1) -diff --git a/sound/soc/codecs/wm8904.c b/sound/soc/codecs/wm8904.c -index 53bbfac6a83a..66cb9e95b5eb 100644 ---- a/sound/soc/codecs/wm8904.c -+++ b/sound/soc/codecs/wm8904.c -@@ -523,7 +523,7 @@ static int wm8904_get_deemph(struct snd_kcontrol *kcontrol, - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct wm8904_priv *wm8904 = snd_soc_codec_get_drvdata(codec); - -- ucontrol->value.enumerated.item[0] = wm8904->deemph; -+ ucontrol->value.integer.value[0] = wm8904->deemph; - return 0; - } - -@@ -532,7 +532,7 @@ static int wm8904_put_deemph(struct snd_kcontrol *kcontrol, - { - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct wm8904_priv *wm8904 = snd_soc_codec_get_drvdata(codec); -- int deemph = ucontrol->value.enumerated.item[0]; -+ int deemph = ucontrol->value.integer.value[0]; - - if (deemph > 1) - return -EINVAL; -diff --git a/sound/soc/codecs/wm8955.c b/sound/soc/codecs/wm8955.c -index 82c8ba975720..1c1fc6119758 100644 ---- a/sound/soc/codecs/wm8955.c -+++ b/sound/soc/codecs/wm8955.c -@@ -393,7 +393,7 @@ static int wm8955_get_deemph(struct snd_kcontrol *kcontrol, - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct wm8955_priv *wm8955 = snd_soc_codec_get_drvdata(codec); - -- ucontrol->value.enumerated.item[0] = wm8955->deemph; -+ ucontrol->value.integer.value[0] = wm8955->deemph; - return 0; - } - -@@ -402,7 +402,7 @@ static int wm8955_put_deemph(struct snd_kcontrol *kcontrol, - { - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct wm8955_priv *wm8955 = snd_soc_codec_get_drvdata(codec); -- int deemph = ucontrol->value.enumerated.item[0]; -+ int deemph = ucontrol->value.integer.value[0]; - - if (deemph > 1) - return -EINVAL; -diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c -index 942ef8427347..2a0bfb848512 100644 ---- a/sound/soc/codecs/wm8960.c -+++ b/sound/soc/codecs/wm8960.c -@@ -181,7 +181,7 @@ static int wm8960_get_deemph(struct snd_kcontrol *kcontrol, - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct wm8960_priv *wm8960 = snd_soc_codec_get_drvdata(codec); - -- ucontrol->value.enumerated.item[0] = wm8960->deemph; -+ ucontrol->value.integer.value[0] = wm8960->deemph; - return 0; - } - -@@ -190,7 +190,7 @@ static int wm8960_put_deemph(struct snd_kcontrol *kcontrol, - { - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct wm8960_priv *wm8960 = snd_soc_codec_get_drvdata(codec); -- int deemph = ucontrol->value.enumerated.item[0]; -+ int deemph = ucontrol->value.integer.value[0]; - - if (deemph > 1) - return -EINVAL; -diff --git a/sound/soc/jz4740/Makefile b/sound/soc/jz4740/Makefile -index be873c1b0c20..d32c540555c4 100644 ---- a/sound/soc/jz4740/Makefile -+++ b/sound/soc/jz4740/Makefile -@@ -1,10 +1,8 @@ - # - # Jz4740 Platform Support - # --snd-soc-jz4740-objs := jz4740-pcm.o - snd-soc-jz4740-i2s-objs := jz4740-i2s.o - --obj-$(CONFIG_SND_JZ4740_SOC) += snd-soc-jz4740.o - obj-$(CONFIG_SND_JZ4740_SOC_I2S) += snd-soc-jz4740-i2s.o - - # Jz4740 Machine Support diff --git a/patch/kernel/odroidc2-default/patch-3.14.38-39.patch b/patch/kernel/odroidc2-default/patch-3.14.38-39.patch deleted file mode 100644 index ea2030ba34..0000000000 --- a/patch/kernel/odroidc2-default/patch-3.14.38-39.patch +++ /dev/null @@ -1,1100 +0,0 @@ -diff --git a/Makefile b/Makefile -index f09e19d2cc4f..b40845e11b84 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 3 - PATCHLEVEL = 14 --SUBLEVEL = 38 -+SUBLEVEL = 39 - EXTRAVERSION = - NAME = Remembering Coco - -diff --git a/arch/arc/kernel/signal.c b/arch/arc/kernel/signal.c -index 7e95e1a86510..d68b410595c8 100644 ---- a/arch/arc/kernel/signal.c -+++ b/arch/arc/kernel/signal.c -@@ -67,7 +67,7 @@ stash_usr_regs(struct rt_sigframe __user *sf, struct pt_regs *regs, - sigset_t *set) - { - int err; -- err = __copy_to_user(&(sf->uc.uc_mcontext.regs), regs, -+ err = __copy_to_user(&(sf->uc.uc_mcontext.regs.scratch), regs, - sizeof(sf->uc.uc_mcontext.regs.scratch)); - err |= __copy_to_user(&sf->uc.uc_sigmask, set, sizeof(sigset_t)); - -@@ -83,7 +83,7 @@ static int restore_usr_regs(struct pt_regs *regs, struct rt_sigframe __user *sf) - if (!err) - set_current_blocked(&set); - -- err |= __copy_from_user(regs, &(sf->uc.uc_mcontext.regs), -+ err |= __copy_from_user(regs, &(sf->uc.uc_mcontext.regs.scratch), - sizeof(sf->uc.uc_mcontext.regs.scratch)); - - return err; -diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c -index c752cb43e52f..a6aa91f77654 100644 ---- a/arch/x86/kernel/reboot.c -+++ b/arch/x86/kernel/reboot.c -@@ -181,6 +181,16 @@ static struct dmi_system_id __initdata reboot_dmi_table[] = { - }, - }, - -+ /* ASRock */ -+ { /* Handle problems with rebooting on ASRock Q1900DC-ITX */ -+ .callback = set_pci_reboot, -+ .ident = "ASRock Q1900DC-ITX", -+ .matches = { -+ DMI_MATCH(DMI_BOARD_VENDOR, "ASRock"), -+ DMI_MATCH(DMI_BOARD_NAME, "Q1900DC-ITX"), -+ }, -+ }, -+ - /* ASUS */ - { /* Handle problems with rebooting on ASUS P4S800 */ - .callback = set_bios_reboot, -diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c -index 17f9ec501972..fd8496a92b45 100644 ---- a/drivers/acpi/processor_idle.c -+++ b/drivers/acpi/processor_idle.c -@@ -962,7 +962,7 @@ static int acpi_processor_setup_cpuidle_states(struct acpi_processor *pr) - return -EINVAL; - - drv->safe_state_index = -1; -- for (i = 0; i < CPUIDLE_STATE_MAX; i++) { -+ for (i = CPUIDLE_DRIVER_STATE_START; i < CPUIDLE_STATE_MAX; i++) { - drv->states[i].name[0] = '\0'; - drv->states[i].desc[0] = '\0'; - } -diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c -index 55298db36b2d..d18093681af2 100644 ---- a/drivers/block/nbd.c -+++ b/drivers/block/nbd.c -@@ -814,10 +814,6 @@ static int __init nbd_init(void) - return -EINVAL; - } - -- nbd_dev = kcalloc(nbds_max, sizeof(*nbd_dev), GFP_KERNEL); -- if (!nbd_dev) -- return -ENOMEM; -- - part_shift = 0; - if (max_part > 0) { - part_shift = fls(max_part); -@@ -839,6 +835,10 @@ static int __init nbd_init(void) - if (nbds_max > 1UL << (MINORBITS - part_shift)) - return -EINVAL; - -+ nbd_dev = kcalloc(nbds_max, sizeof(*nbd_dev), GFP_KERNEL); -+ if (!nbd_dev) -+ return -ENOMEM; -+ - for (i = 0; i < nbds_max; i++) { - struct gendisk *disk = alloc_disk(1 << part_shift); - if (!disk) -diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c -index a55e68f2cfc8..e3d2052e7552 100644 ---- a/drivers/cpuidle/cpuidle.c -+++ b/drivers/cpuidle/cpuidle.c -@@ -252,9 +252,6 @@ int cpuidle_enable_device(struct cpuidle_device *dev) - if (!dev->registered) - return -EINVAL; - -- if (!dev->state_count) -- dev->state_count = drv->state_count; -- - ret = cpuidle_add_device_sysfs(dev); - if (ret) - return ret; -diff --git a/drivers/cpuidle/sysfs.c b/drivers/cpuidle/sysfs.c -index e918b6d0caf7..dcaae4c8bc08 100644 ---- a/drivers/cpuidle/sysfs.c -+++ b/drivers/cpuidle/sysfs.c -@@ -398,7 +398,7 @@ static int cpuidle_add_state_sysfs(struct cpuidle_device *device) - struct cpuidle_driver *drv = cpuidle_get_cpu_driver(device); - - /* state statistics */ -- for (i = 0; i < device->state_count; i++) { -+ for (i = 0; i < drv->state_count; i++) { - kobj = kzalloc(sizeof(struct cpuidle_state_kobj), GFP_KERNEL); - if (!kobj) - goto error_state; -@@ -430,9 +430,10 @@ error_state: - */ - static void cpuidle_remove_state_sysfs(struct cpuidle_device *device) - { -+ struct cpuidle_driver *drv = cpuidle_get_cpu_driver(device); - int i; - -- for (i = 0; i < device->state_count; i++) -+ for (i = 0; i < drv->state_count; i++) - cpuidle_free_state_kobj(device, i); - } - -diff --git a/drivers/dma/omap-dma.c b/drivers/dma/omap-dma.c -index 362e7c49f2e1..12f82942e347 100644 ---- a/drivers/dma/omap-dma.c -+++ b/drivers/dma/omap-dma.c -@@ -487,6 +487,7 @@ static int omap_dma_terminate_all(struct omap_chan *c) - * c->desc is NULL and exit.) - */ - if (c->desc) { -+ omap_dma_desc_free(&c->desc->vd); - c->desc = NULL; - /* Avoid stopping the dma twice */ - if (!c->paused) -diff --git a/drivers/gpu/drm/radeon/radeon_bios.c b/drivers/gpu/drm/radeon/radeon_bios.c -index 9ab30976287d..c43335ce8778 100644 ---- a/drivers/gpu/drm/radeon/radeon_bios.c -+++ b/drivers/gpu/drm/radeon/radeon_bios.c -@@ -76,7 +76,7 @@ static bool igp_read_bios_from_vram(struct radeon_device *rdev) - - static bool radeon_read_bios(struct radeon_device *rdev) - { -- uint8_t __iomem *bios; -+ uint8_t __iomem *bios, val1, val2; - size_t size; - - rdev->bios = NULL; -@@ -86,15 +86,19 @@ static bool radeon_read_bios(struct radeon_device *rdev) - return false; - } - -- if (size == 0 || bios[0] != 0x55 || bios[1] != 0xaa) { -+ val1 = readb(&bios[0]); -+ val2 = readb(&bios[1]); -+ -+ if (size == 0 || val1 != 0x55 || val2 != 0xaa) { - pci_unmap_rom(rdev->pdev, bios); - return false; - } -- rdev->bios = kmemdup(bios, size, GFP_KERNEL); -+ rdev->bios = kzalloc(size, GFP_KERNEL); - if (rdev->bios == NULL) { - pci_unmap_rom(rdev->pdev, bios); - return false; - } -+ memcpy_fromio(rdev->bios, bios, size); - pci_unmap_rom(rdev->pdev, bios); - return true; - } -diff --git a/drivers/iio/imu/adis_trigger.c b/drivers/iio/imu/adis_trigger.c -index e0017c22bb9c..f53e9a803a0e 100644 ---- a/drivers/iio/imu/adis_trigger.c -+++ b/drivers/iio/imu/adis_trigger.c -@@ -60,7 +60,7 @@ int adis_probe_trigger(struct adis *adis, struct iio_dev *indio_dev) - iio_trigger_set_drvdata(adis->trig, adis); - ret = iio_trigger_register(adis->trig); - -- indio_dev->trig = adis->trig; -+ indio_dev->trig = iio_trigger_get(adis->trig); - if (ret) - goto error_free_irq; - -diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c -index 429517117eff..30fce6723e61 100644 ---- a/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c -+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c -@@ -25,6 +25,16 @@ - #include - #include "inv_mpu_iio.h" - -+static void inv_clear_kfifo(struct inv_mpu6050_state *st) -+{ -+ unsigned long flags; -+ -+ /* take the spin lock sem to avoid interrupt kick in */ -+ spin_lock_irqsave(&st->time_stamp_lock, flags); -+ kfifo_reset(&st->timestamps); -+ spin_unlock_irqrestore(&st->time_stamp_lock, flags); -+} -+ - int inv_reset_fifo(struct iio_dev *indio_dev) - { - int result; -@@ -51,6 +61,10 @@ int inv_reset_fifo(struct iio_dev *indio_dev) - INV_MPU6050_BIT_FIFO_RST); - if (result) - goto reset_fifo_fail; -+ -+ /* clear timestamps fifo */ -+ inv_clear_kfifo(st); -+ - /* enable interrupt */ - if (st->chip_config.accl_fifo_enable || - st->chip_config.gyro_fifo_enable) { -@@ -84,16 +98,6 @@ reset_fifo_fail: - return result; - } - --static void inv_clear_kfifo(struct inv_mpu6050_state *st) --{ -- unsigned long flags; -- -- /* take the spin lock sem to avoid interrupt kick in */ -- spin_lock_irqsave(&st->time_stamp_lock, flags); -- kfifo_reset(&st->timestamps); -- spin_unlock_irqrestore(&st->time_stamp_lock, flags); --} -- - /** - * inv_mpu6050_irq_handler() - Cache a timestamp at each data ready interrupt. - */ -@@ -185,7 +189,6 @@ end_session: - flush_fifo: - /* Flush HW and SW FIFOs. */ - inv_reset_fifo(indio_dev); -- inv_clear_kfifo(st); - mutex_unlock(&indio_dev->mlock); - iio_trigger_notify_done(indio_dev->trig); - -diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c -index a84112322071..055ebebc07dd 100644 ---- a/drivers/infiniband/core/umem.c -+++ b/drivers/infiniband/core/umem.c -@@ -94,6 +94,14 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr, - if (dmasync) - dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs); - -+ /* -+ * If the combination of the addr and size requested for this memory -+ * region causes an integer overflow, return error. -+ */ -+ if ((PAGE_ALIGN(addr + size) <= size) || -+ (PAGE_ALIGN(addr + size) <= addr)) -+ return ERR_PTR(-EINVAL); -+ - if (!can_do_mlock()) - return ERR_PTR(-EPERM); - -diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c -index 08219fb3338b..7a515c867674 100644 ---- a/drivers/infiniband/core/uverbs_main.c -+++ b/drivers/infiniband/core/uverbs_main.c -@@ -476,6 +476,7 @@ static void ib_uverbs_async_handler(struct ib_uverbs_file *file, - - entry->desc.async.element = element; - entry->desc.async.event_type = event; -+ entry->desc.async.reserved = 0; - entry->counter = counter; - - list_add_tail(&entry->list, &file->async_file->event_list); -diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c -index f2a3f48107e7..2592ab5f21b1 100644 ---- a/drivers/infiniband/hw/mlx4/mad.c -+++ b/drivers/infiniband/hw/mlx4/mad.c -@@ -64,6 +64,14 @@ enum { - #define GUID_TBL_BLK_NUM_ENTRIES 8 - #define GUID_TBL_BLK_SIZE (GUID_TBL_ENTRY_SIZE * GUID_TBL_BLK_NUM_ENTRIES) - -+/* Counters should be saturate once they reach their maximum value */ -+#define ASSIGN_32BIT_COUNTER(counter, value) do {\ -+ if ((value) > U32_MAX) \ -+ counter = cpu_to_be32(U32_MAX); \ -+ else \ -+ counter = cpu_to_be32(value); \ -+} while (0) -+ - struct mlx4_mad_rcv_buf { - struct ib_grh grh; - u8 payload[256]; -@@ -730,10 +738,14 @@ static int ib_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num, - static void edit_counter(struct mlx4_counter *cnt, - struct ib_pma_portcounters *pma_cnt) - { -- pma_cnt->port_xmit_data = cpu_to_be32((be64_to_cpu(cnt->tx_bytes)>>2)); -- pma_cnt->port_rcv_data = cpu_to_be32((be64_to_cpu(cnt->rx_bytes)>>2)); -- pma_cnt->port_xmit_packets = cpu_to_be32(be64_to_cpu(cnt->tx_frames)); -- pma_cnt->port_rcv_packets = cpu_to_be32(be64_to_cpu(cnt->rx_frames)); -+ ASSIGN_32BIT_COUNTER(pma_cnt->port_xmit_data, -+ (be64_to_cpu(cnt->tx_bytes) >> 2)); -+ ASSIGN_32BIT_COUNTER(pma_cnt->port_rcv_data, -+ (be64_to_cpu(cnt->rx_bytes) >> 2)); -+ ASSIGN_32BIT_COUNTER(pma_cnt->port_xmit_packets, -+ be64_to_cpu(cnt->tx_frames)); -+ ASSIGN_32BIT_COUNTER(pma_cnt->port_rcv_packets, -+ be64_to_cpu(cnt->rx_frames)); - } - - static int iboe_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num, -diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_common.h b/drivers/media/platform/s5p-mfc/s5p_mfc_common.h -index f723f1f2f578..ab851278d9d0 100644 ---- a/drivers/media/platform/s5p-mfc/s5p_mfc_common.h -+++ b/drivers/media/platform/s5p-mfc/s5p_mfc_common.h -@@ -30,7 +30,7 @@ - - /* Offset base used to differentiate between CAPTURE and OUTPUT - * while mmaping */ --#define DST_QUEUE_OFF_BASE (TASK_SIZE / 2) -+#define DST_QUEUE_OFF_BASE (1 << 30) - - #define MFC_BANK1_ALLOC_CTX 0 - #define MFC_BANK2_ALLOC_CTX 1 -diff --git a/drivers/media/platform/sh_veu.c b/drivers/media/platform/sh_veu.c -index 744e43b480bc..f698e322a1cd 100644 ---- a/drivers/media/platform/sh_veu.c -+++ b/drivers/media/platform/sh_veu.c -@@ -1183,6 +1183,7 @@ static int sh_veu_probe(struct platform_device *pdev) - } - - *vdev = sh_veu_videodev; -+ vdev->v4l2_dev = &veu->v4l2_dev; - spin_lock_init(&veu->lock); - mutex_init(&veu->fop_lock); - vdev->lock = &veu->fop_lock; -diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c -index 61376abdab39..dbd8d21a8f10 100644 ---- a/drivers/net/can/flexcan.c -+++ b/drivers/net/can/flexcan.c -@@ -1095,12 +1095,19 @@ static int flexcan_probe(struct platform_device *pdev) - const struct flexcan_devtype_data *devtype_data; - struct net_device *dev; - struct flexcan_priv *priv; -+ struct regulator *reg_xceiver; - struct resource *mem; - struct clk *clk_ipg = NULL, *clk_per = NULL; - void __iomem *base; - int err, irq; - u32 clock_freq = 0; - -+ reg_xceiver = devm_regulator_get(&pdev->dev, "xceiver"); -+ if (PTR_ERR(reg_xceiver) == -EPROBE_DEFER) -+ return -EPROBE_DEFER; -+ else if (IS_ERR(reg_xceiver)) -+ reg_xceiver = NULL; -+ - if (pdev->dev.of_node) - of_property_read_u32(pdev->dev.of_node, - "clock-frequency", &clock_freq); -@@ -1162,9 +1169,7 @@ static int flexcan_probe(struct platform_device *pdev) - priv->pdata = dev_get_platdata(&pdev->dev); - priv->devtype_data = devtype_data; - -- priv->reg_xceiver = devm_regulator_get(&pdev->dev, "xceiver"); -- if (IS_ERR(priv->reg_xceiver)) -- priv->reg_xceiver = NULL; -+ priv->reg_xceiver = reg_xceiver; - - netif_napi_add(dev, &priv->napi, flexcan_poll, FLEXCAN_NAPI_WEIGHT); - -diff --git a/drivers/net/wireless/iwlwifi/dvm/dev.h b/drivers/net/wireless/iwlwifi/dvm/dev.h -index 3441f70d0ff9..6e8cdb8a0cc5 100644 ---- a/drivers/net/wireless/iwlwifi/dvm/dev.h -+++ b/drivers/net/wireless/iwlwifi/dvm/dev.h -@@ -708,7 +708,6 @@ struct iwl_priv { - unsigned long reload_jiffies; - int reload_count; - bool ucode_loaded; -- bool init_ucode_run; /* Don't run init uCode again */ - - u8 plcp_delta_threshold; - -diff --git a/drivers/net/wireless/iwlwifi/dvm/ucode.c b/drivers/net/wireless/iwlwifi/dvm/ucode.c -index cf03ef5619d9..8b2dedc30159 100644 ---- a/drivers/net/wireless/iwlwifi/dvm/ucode.c -+++ b/drivers/net/wireless/iwlwifi/dvm/ucode.c -@@ -418,9 +418,6 @@ int iwl_run_init_ucode(struct iwl_priv *priv) - if (!priv->fw->img[IWL_UCODE_INIT].sec[0].len) - return 0; - -- if (priv->init_ucode_run) -- return 0; -- - iwl_init_notification_wait(&priv->notif_wait, &calib_wait, - calib_complete, ARRAY_SIZE(calib_complete), - iwlagn_wait_calib, priv); -@@ -440,8 +437,6 @@ int iwl_run_init_ucode(struct iwl_priv *priv) - */ - ret = iwl_wait_notification(&priv->notif_wait, &calib_wait, - UCODE_CALIB_TIMEOUT); -- if (!ret) -- priv->init_ucode_run = true; - - goto out; - -diff --git a/drivers/pci/pcie/aer/aerdrv_errprint.c b/drivers/pci/pcie/aer/aerdrv_errprint.c -index 34ff7026440c..5d3b45640181 100644 ---- a/drivers/pci/pcie/aer/aerdrv_errprint.c -+++ b/drivers/pci/pcie/aer/aerdrv_errprint.c -@@ -127,16 +127,8 @@ static const char *aer_agent_string[] = { - static void __print_tlp_header(struct pci_dev *dev, - struct aer_header_log_regs *t) - { -- unsigned char *tlp = (unsigned char *)&t; -- -- dev_err(&dev->dev, " TLP Header:" -- " %02x%02x%02x%02x %02x%02x%02x%02x" -- " %02x%02x%02x%02x %02x%02x%02x%02x\n", -- *(tlp + 3), *(tlp + 2), *(tlp + 1), *tlp, -- *(tlp + 7), *(tlp + 6), *(tlp + 5), *(tlp + 4), -- *(tlp + 11), *(tlp + 10), *(tlp + 9), -- *(tlp + 8), *(tlp + 15), *(tlp + 14), -- *(tlp + 13), *(tlp + 12)); -+ dev_err(&dev->dev, " TLP Header: %08x %08x %08x %08x\n", -+ t->dw0, t->dw1, t->dw2, t->dw3); - } - - static void __aer_print_error(struct pci_dev *dev, -diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c -index 953bd0bfdf0d..19ddd43a00cf 100644 ---- a/drivers/scsi/be2iscsi/be_main.c -+++ b/drivers/scsi/be2iscsi/be_main.c -@@ -5684,9 +5684,9 @@ free_port: - hba_free: - if (phba->msix_enabled) - pci_disable_msix(phba->pcidev); -- iscsi_host_remove(phba->shost); - pci_dev_put(phba->pcidev); - iscsi_host_free(phba->shost); -+ pci_set_drvdata(pcidev, NULL); - disable_pci: - pci_disable_device(pcidev); - return ret; -diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c -index 64e487a8bf59..719bd8257520 100644 ---- a/drivers/scsi/scsi_lib.c -+++ b/drivers/scsi/scsi_lib.c -@@ -1258,9 +1258,11 @@ int scsi_prep_state_check(struct scsi_device *sdev, struct request *req) - "rejecting I/O to dead device\n"); - ret = BLKPREP_KILL; - break; -- case SDEV_QUIESCE: - case SDEV_BLOCK: - case SDEV_CREATED_BLOCK: -+ ret = BLKPREP_DEFER; -+ break; -+ case SDEV_QUIESCE: - /* - * If the devices is blocked we defer normal commands. - */ -diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c -index e168a63e77ea..b61c555a5a8f 100644 ---- a/drivers/target/iscsi/iscsi_target.c -+++ b/drivers/target/iscsi/iscsi_target.c -@@ -1165,7 +1165,7 @@ iscsit_handle_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd, - * traditional iSCSI block I/O. - */ - if (iscsit_allocate_iovecs(cmd) < 0) { -- return iscsit_add_reject_cmd(cmd, -+ return iscsit_reject_cmd(cmd, - ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf); - } - immed_data = cmd->immediate_data; -diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c -index 850e232d086e..8ab46ad40f28 100644 ---- a/drivers/tty/n_tty.c -+++ b/drivers/tty/n_tty.c -@@ -247,8 +247,6 @@ static void n_tty_write_wakeup(struct tty_struct *tty) - - static void n_tty_check_throttle(struct tty_struct *tty) - { -- if (tty->driver->type == TTY_DRIVER_TYPE_PTY) -- return; - /* - * Check the remaining room for the input canonicalization - * mode. We don't want to throttle the driver if we're in -@@ -1512,23 +1510,6 @@ n_tty_receive_char_lnext(struct tty_struct *tty, unsigned char c, char flag) - n_tty_receive_char_flagged(tty, c, flag); - } - --/** -- * n_tty_receive_buf - data receive -- * @tty: terminal device -- * @cp: buffer -- * @fp: flag buffer -- * @count: characters -- * -- * Called by the terminal driver when a block of characters has -- * been received. This function must be called from soft contexts -- * not from interrupt context. The driver is responsible for making -- * calls one at a time and in order (or using flush_to_ldisc) -- * -- * n_tty_receive_buf()/producer path: -- * claims non-exclusive termios_rwsem -- * publishes read_head and canon_head -- */ -- - static void - n_tty_receive_buf_real_raw(struct tty_struct *tty, const unsigned char *cp, - char *fp, int count) -@@ -1684,24 +1665,85 @@ static void __receive_buf(struct tty_struct *tty, const unsigned char *cp, - } - } - -+/** -+ * n_tty_receive_buf_common - process input -+ * @tty: device to receive input -+ * @cp: input chars -+ * @fp: flags for each char (if NULL, all chars are TTY_NORMAL) -+ * @count: number of input chars in @cp -+ * -+ * Called by the terminal driver when a block of characters has -+ * been received. This function must be called from soft contexts -+ * not from interrupt context. The driver is responsible for making -+ * calls one at a time and in order (or using flush_to_ldisc) -+ * -+ * Returns the # of input chars from @cp which were processed. -+ * -+ * In canonical mode, the maximum line length is 4096 chars (including -+ * the line termination char); lines longer than 4096 chars are -+ * truncated. After 4095 chars, input data is still processed but -+ * not stored. Overflow processing ensures the tty can always -+ * receive more input until at least one line can be read. -+ * -+ * In non-canonical mode, the read buffer will only accept 4095 chars; -+ * this provides the necessary space for a newline char if the input -+ * mode is switched to canonical. -+ * -+ * Note it is possible for the read buffer to _contain_ 4096 chars -+ * in non-canonical mode: the read buffer could already contain the -+ * maximum canon line of 4096 chars when the mode is switched to -+ * non-canonical. -+ * -+ * n_tty_receive_buf()/producer path: -+ * claims non-exclusive termios_rwsem -+ * publishes commit_head or canon_head -+ */ - static int - n_tty_receive_buf_common(struct tty_struct *tty, const unsigned char *cp, - char *fp, int count, int flow) - { - struct n_tty_data *ldata = tty->disc_data; -- int room, n, rcvd = 0; -+ int room, n, rcvd = 0, overflow; - - down_read(&tty->termios_rwsem); - - while (1) { -- room = receive_room(tty); -+ /* -+ * When PARMRK is set, each input char may take up to 3 chars -+ * in the read buf; reduce the buffer space avail by 3x -+ * -+ * If we are doing input canonicalization, and there are no -+ * pending newlines, let characters through without limit, so -+ * that erase characters will be handled. Other excess -+ * characters will be beeped. -+ * -+ * paired with store in *_copy_from_read_buf() -- guarantees -+ * the consumer has loaded the data in read_buf up to the new -+ * read_tail (so this producer will not overwrite unread data) -+ */ -+ size_t tail = ldata->read_tail; -+ -+ room = N_TTY_BUF_SIZE - (ldata->read_head - tail); -+ if (I_PARMRK(tty)) -+ room = (room + 2) / 3; -+ room--; -+ if (room <= 0) { -+ overflow = ldata->icanon && ldata->canon_head == tail; -+ if (overflow && room < 0) -+ ldata->read_head--; -+ room = overflow; -+ ldata->no_room = flow && !room; -+ } else -+ overflow = 0; -+ - n = min(count, room); -- if (!n) { -- if (flow && !room) -- ldata->no_room = 1; -+ if (!n) - break; -- } -- __receive_buf(tty, cp, fp, n); -+ -+ /* ignore parity errors if handling overflow */ -+ if (!overflow || !fp || *fp != TTY_PARITY) -+ __receive_buf(tty, cp, fp, n); -+ - cp += n; - if (fp) - fp += n; -@@ -1710,7 +1752,17 @@ n_tty_receive_buf_common(struct tty_struct *tty, const unsigned char *cp, - } - - tty->receive_room = room; -- n_tty_check_throttle(tty); -+ -+ /* Unthrottle if handling overflow on pty */ -+ if (tty->driver->type == TTY_DRIVER_TYPE_PTY) { -+ if (overflow) { -+ tty_set_flow_change(tty, TTY_UNTHROTTLE_SAFE); -+ tty_unthrottle_safe(tty); -+ __tty_set_flow_change(tty, 0); -+ } -+ } else -+ n_tty_check_throttle(tty); -+ - up_read(&tty->termios_rwsem); - - return rcvd; -diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c -index 175f123f4f09..501c465feb59 100644 ---- a/drivers/tty/serial/fsl_lpuart.c -+++ b/drivers/tty/serial/fsl_lpuart.c -@@ -362,6 +362,9 @@ static void lpuart_setup_watermark(struct lpuart_port *sport) - writeb(val | UARTPFIFO_TXFE | UARTPFIFO_RXFE, - sport->port.membase + UARTPFIFO); - -+ /* explicitly clear RDRF */ -+ readb(sport->port.membase + UARTSR1); -+ - /* flush Tx and Rx FIFO */ - writeb(UARTCFIFO_TXFLUSH | UARTCFIFO_RXFLUSH, - sport->port.membase + UARTCFIFO); -diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c -index 93fe089cd51a..b9e16abb0fab 100644 ---- a/drivers/usb/host/xhci-hub.c -+++ b/drivers/usb/host/xhci-hub.c -@@ -383,6 +383,10 @@ static void xhci_clear_port_change_bit(struct xhci_hcd *xhci, u16 wValue, - status = PORT_PLC; - port_change_bit = "link state"; - break; -+ case USB_PORT_FEAT_C_PORT_CONFIG_ERROR: -+ status = PORT_CEC; -+ port_change_bit = "config error"; -+ break; - default: - /* Should never happen */ - return; -@@ -584,6 +588,8 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd, - status |= USB_PORT_STAT_C_LINK_STATE << 16; - if ((raw_port_status & PORT_WRC)) - status |= USB_PORT_STAT_C_BH_RESET << 16; -+ if ((raw_port_status & PORT_CEC)) -+ status |= USB_PORT_STAT_C_CONFIG_ERROR << 16; - } - - if (hcd->speed != HCD_USB3) { -@@ -999,6 +1005,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, - case USB_PORT_FEAT_C_OVER_CURRENT: - case USB_PORT_FEAT_C_ENABLE: - case USB_PORT_FEAT_C_PORT_LINK_STATE: -+ case USB_PORT_FEAT_C_PORT_CONFIG_ERROR: - xhci_clear_port_change_bit(xhci, wValue, wIndex, - port_array[wIndex], temp); - break; -@@ -1063,7 +1070,7 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf) - */ - status = bus_state->resuming_ports; - -- mask = PORT_CSC | PORT_PEC | PORT_OCC | PORT_PLC | PORT_WRC; -+ mask = PORT_CSC | PORT_PEC | PORT_OCC | PORT_PLC | PORT_WRC | PORT_CEC; - - spin_lock_irqsave(&xhci->lock, flags); - /* For each port, did anything change? If so, set that bit in buf. */ -diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c -index 73c43e5e231b..eb3399f4c1ed 100644 ---- a/drivers/usb/host/xhci-pci.c -+++ b/drivers/usb/host/xhci-pci.c -@@ -108,6 +108,7 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) - if (pdev->vendor == PCI_VENDOR_ID_INTEL) { - xhci->quirks |= XHCI_LPM_SUPPORT; - xhci->quirks |= XHCI_INTEL_HOST; -+ xhci->quirks |= XHCI_AVOID_BEI; - } - if (pdev->vendor == PCI_VENDOR_ID_INTEL && - pdev->device == PCI_DEVICE_ID_INTEL_PANTHERPOINT_XHCI) { -@@ -123,7 +124,6 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) - * PPT chipsets. - */ - xhci->quirks |= XHCI_SPURIOUS_REBOOT; -- xhci->quirks |= XHCI_AVOID_BEI; - } - if (pdev->vendor == PCI_VENDOR_ID_INTEL && - (pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_XHCI || -diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c -index 923500595357..2d858f81ab33 100644 ---- a/drivers/usb/serial/ftdi_sio.c -+++ b/drivers/usb/serial/ftdi_sio.c -@@ -617,6 +617,7 @@ static const struct usb_device_id id_table_combined[] = { - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, -+ { USB_DEVICE(FTDI_VID, FTDI_SYNAPSE_SS200_PID) }, - /* - * ELV devices: - */ -@@ -1901,8 +1902,12 @@ static int ftdi_8u2232c_probe(struct usb_serial *serial) - { - struct usb_device *udev = serial->dev; - -- if ((udev->manufacturer && !strcmp(udev->manufacturer, "CALAO Systems")) || -- (udev->product && !strcmp(udev->product, "BeagleBone/XDS100V2"))) -+ if (udev->manufacturer && !strcmp(udev->manufacturer, "CALAO Systems")) -+ return ftdi_jtag_probe(serial); -+ -+ if (udev->product && -+ (!strcmp(udev->product, "BeagleBone/XDS100V2") || -+ !strcmp(udev->product, "SNAP Connect E10"))) - return ftdi_jtag_probe(serial); - - return 0; -diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h -index 56b1b55c4751..4e4f46f3c89c 100644 ---- a/drivers/usb/serial/ftdi_sio_ids.h -+++ b/drivers/usb/serial/ftdi_sio_ids.h -@@ -561,6 +561,12 @@ - */ - #define FTDI_NT_ORIONLXM_PID 0x7c90 /* OrionLXm Substation Automation Platform */ - -+/* -+ * Synapse Wireless product ids (FTDI_VID) -+ * http://www.synapse-wireless.com -+ */ -+#define FTDI_SYNAPSE_SS200_PID 0x9090 /* SS200 - SNAP Stick 200 */ -+ - - /********************************/ - /** third-party VID/PID combos **/ -diff --git a/fs/aio.c b/fs/aio.c -index 2f7e8c2e3e76..3241659491b1 100644 ---- a/fs/aio.c -+++ b/fs/aio.c -@@ -719,6 +719,9 @@ static struct kioctx *ioctx_alloc(unsigned nr_events) - err_cleanup: - aio_nr_sub(ctx->max_reqs); - err_ctx: -+ atomic_set(&ctx->dead, 1); -+ if (ctx->mmap_size) -+ vm_munmap(ctx->mmap_base, ctx->mmap_size); - aio_free_ring(ctx); - err: - mutex_unlock(&ctx->ring_lock); -diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c -index a7f32bfdd5e7..ec8b6542c8bd 100644 ---- a/fs/btrfs/tree-log.c -+++ b/fs/btrfs/tree-log.c -@@ -1235,21 +1235,13 @@ out: - } - - static int insert_orphan_item(struct btrfs_trans_handle *trans, -- struct btrfs_root *root, u64 offset) -+ struct btrfs_root *root, u64 ino) - { - int ret; -- struct btrfs_path *path; -- -- path = btrfs_alloc_path(); -- if (!path) -- return -ENOMEM; - -- ret = btrfs_find_item(root, path, BTRFS_ORPHAN_OBJECTID, -- offset, BTRFS_ORPHAN_ITEM_KEY, NULL); -- if (ret > 0) -- ret = btrfs_insert_orphan_item(trans, root, offset); -- -- btrfs_free_path(path); -+ ret = btrfs_insert_orphan_item(trans, root, ino); -+ if (ret == -EEXIST) -+ ret = 0; - - return ret; - } -diff --git a/fs/cifs/file.c b/fs/cifs/file.c -index 0218a9b23b38..40ddb6e93912 100644 ---- a/fs/cifs/file.c -+++ b/fs/cifs/file.c -@@ -1821,6 +1821,7 @@ refind_writable: - cifsFileInfo_put(inv_file); - spin_lock(&cifs_file_list_lock); - ++refind; -+ inv_file = NULL; - goto refind_writable; - } - } -diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c -index 34a17d425be6..30f3eb5bc022 100644 ---- a/fs/cifs/smb2ops.c -+++ b/fs/cifs/smb2ops.c -@@ -630,7 +630,8 @@ smb2_clone_range(const unsigned int xid, - - /* No need to change MaxChunks since already set to 1 */ - chunk_sizes_updated = true; -- } -+ } else -+ goto cchunk_out; - } - - cchunk_out: -diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c -index 51632c40e896..7fe30f655aa5 100644 ---- a/fs/ocfs2/file.c -+++ b/fs/ocfs2/file.c -@@ -2391,10 +2391,14 @@ out_dio: - /* buffered aio wouldn't have proper lock coverage today */ - BUG_ON(ret == -EIOCBQUEUED && !(file->f_flags & O_DIRECT)); - -+ if (unlikely(written <= 0)) -+ goto no_sync; -+ - if (((file->f_flags & O_DSYNC) && !direct_io) || IS_SYNC(inode) || - ((file->f_flags & O_DIRECT) && !direct_io)) { -- ret = filemap_fdatawrite_range(file->f_mapping, *ppos, -- *ppos + count - 1); -+ ret = filemap_fdatawrite_range(file->f_mapping, -+ iocb->ki_pos - written, -+ iocb->ki_pos - 1); - if (ret < 0) - written = ret; - -@@ -2407,10 +2411,12 @@ out_dio: - } - - if (!ret) -- ret = filemap_fdatawait_range(file->f_mapping, *ppos, -- *ppos + count - 1); -+ ret = filemap_fdatawait_range(file->f_mapping, -+ iocb->ki_pos - written, -+ iocb->ki_pos - 1); - } - -+no_sync: - /* - * deep in g_f_a_w_n()->ocfs2_direct_IO we pass in a ocfs2_dio_end_io - * function pointer which is called when o_direct io completes so that -diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h -index bbc3a6c88fce..33fd7ff53a77 100644 ---- a/include/linux/blk_types.h -+++ b/include/linux/blk_types.h -@@ -180,7 +180,9 @@ enum rq_flag_bits { - __REQ_ELVPRIV, /* elevator private data attached */ - __REQ_FAILED, /* set if the request failed */ - __REQ_QUIET, /* don't worry about errors */ -- __REQ_PREEMPT, /* set for "ide_preempt" requests */ -+ __REQ_PREEMPT, /* set for "ide_preempt" requests and also -+ for requests for which the SCSI "quiesce" -+ state must be ignored. */ - __REQ_ALLOCED, /* request came from our alloc pool */ - __REQ_COPY_USER, /* contains copies of user pages */ - __REQ_FLUSH_SEQ, /* request for flush sequence */ -diff --git a/include/linux/cpuidle.h b/include/linux/cpuidle.h -index 50fcbb0ac4e7..d1338170b6b9 100644 ---- a/include/linux/cpuidle.h -+++ b/include/linux/cpuidle.h -@@ -69,7 +69,6 @@ struct cpuidle_device { - unsigned int cpu; - - int last_residency; -- int state_count; - struct cpuidle_state_usage states_usage[CPUIDLE_STATE_MAX]; - struct cpuidle_state_kobj *kobjs[CPUIDLE_STATE_MAX]; - struct cpuidle_driver_kobj *kobj_driver; -diff --git a/kernel/sched/core.c b/kernel/sched/core.c -index 9a3f3c4e1f5a..5e973efc036e 100644 ---- a/kernel/sched/core.c -+++ b/kernel/sched/core.c -@@ -2980,6 +2980,8 @@ void rt_mutex_setprio(struct task_struct *p, int prio) - } else { - if (dl_prio(oldprio)) - p->dl.dl_boosted = 0; -+ if (rt_prio(oldprio)) -+ p->rt.timeout = 0; - p->sched_class = &fair_sched_class; - } - -diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c -index f6f23833de44..c8e450132813 100644 ---- a/mm/memory_hotplug.c -+++ b/mm/memory_hotplug.c -@@ -1016,6 +1016,10 @@ static pg_data_t __ref *hotadd_new_pgdat(int nid, u64 start) - return NULL; - - arch_refresh_nodedata(nid, pgdat); -+ } else { -+ /* Reset the nr_zones and classzone_idx to 0 before reuse */ -+ pgdat->nr_zones = 0; -+ pgdat->classzone_idx = 0; - } - - /* we can use NODE_DATA(nid) from here */ -@@ -1863,15 +1867,6 @@ void try_offline_node(int nid) - if (is_vmalloc_addr(zone->wait_table)) - vfree(zone->wait_table); - } -- -- /* -- * Since there is no way to guarentee the address of pgdat/zone is not -- * on stack of any kernel threads or used by other kernel objects -- * without reference counting or other symchronizing method, do not -- * reset node_data and free pgdat here. Just reset it to 0 and reuse -- * the memory when the node is online again. -- */ -- memset(pgdat, 0, sizeof(*pgdat)); - } - EXPORT_SYMBOL(try_offline_node); - -diff --git a/mm/page-writeback.c b/mm/page-writeback.c -index 9f45f87a5859..51d8d15f48d7 100644 ---- a/mm/page-writeback.c -+++ b/mm/page-writeback.c -@@ -878,8 +878,11 @@ static void bdi_update_write_bandwidth(struct backing_dev_info *bdi, - * bw * elapsed + write_bandwidth * (period - elapsed) - * write_bandwidth = --------------------------------------------------- - * period -+ * -+ * @written may have decreased due to account_page_redirty(). -+ * Avoid underflowing @bw calculation. - */ -- bw = written - bdi->written_stamp; -+ bw = written - min(written, bdi->written_stamp); - bw *= HZ; - if (unlikely(elapsed > period)) { - do_div(bw, elapsed); -@@ -943,7 +946,7 @@ static void global_update_bandwidth(unsigned long thresh, - unsigned long now) - { - static DEFINE_SPINLOCK(dirty_lock); -- static unsigned long update_time; -+ static unsigned long update_time = INITIAL_JIFFIES; - - /* - * check locklessly first to optimize away locking for the most time -diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c -index d0c310801479..96f64e59d70c 100644 ---- a/net/ipv4/tcp_output.c -+++ b/net/ipv4/tcp_output.c -@@ -2933,6 +2933,7 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn) - goto fallback; - syn_data->ip_summed = CHECKSUM_PARTIAL; - memcpy(syn_data->cb, syn->cb, sizeof(syn->cb)); -+ skb_shinfo(syn_data)->gso_segs = 1; - if (unlikely(memcpy_fromiovecend(skb_put(syn_data, space), - fo->data->msg_iov, 0, space))) { - kfree_skb(syn_data); -diff --git a/net/llc/sysctl_net_llc.c b/net/llc/sysctl_net_llc.c -index 612a5ddaf93b..799bafc2af39 100644 ---- a/net/llc/sysctl_net_llc.c -+++ b/net/llc/sysctl_net_llc.c -@@ -18,28 +18,28 @@ static struct ctl_table llc2_timeout_table[] = { - { - .procname = "ack", - .data = &sysctl_llc2_ack_timeout, -- .maxlen = sizeof(long), -+ .maxlen = sizeof(sysctl_llc2_ack_timeout), - .mode = 0644, - .proc_handler = proc_dointvec_jiffies, - }, - { - .procname = "busy", - .data = &sysctl_llc2_busy_timeout, -- .maxlen = sizeof(long), -+ .maxlen = sizeof(sysctl_llc2_busy_timeout), - .mode = 0644, - .proc_handler = proc_dointvec_jiffies, - }, - { - .procname = "p", - .data = &sysctl_llc2_p_timeout, -- .maxlen = sizeof(long), -+ .maxlen = sizeof(sysctl_llc2_p_timeout), - .mode = 0644, - .proc_handler = proc_dointvec_jiffies, - }, - { - .procname = "rej", - .data = &sysctl_llc2_rej_timeout, -- .maxlen = sizeof(long), -+ .maxlen = sizeof(sysctl_llc2_rej_timeout), - .mode = 0644, - .proc_handler = proc_dointvec_jiffies, - }, -diff --git a/net/rds/sysctl.c b/net/rds/sysctl.c -index b5cb2aa08f33..35773ad6d23d 100644 ---- a/net/rds/sysctl.c -+++ b/net/rds/sysctl.c -@@ -71,14 +71,14 @@ static struct ctl_table rds_sysctl_rds_table[] = { - { - .procname = "max_unacked_packets", - .data = &rds_sysctl_max_unacked_packets, -- .maxlen = sizeof(unsigned long), -+ .maxlen = sizeof(int), - .mode = 0644, - .proc_handler = proc_dointvec, - }, - { - .procname = "max_unacked_bytes", - .data = &rds_sysctl_max_unacked_bytes, -- .maxlen = sizeof(unsigned long), -+ .maxlen = sizeof(int), - .mode = 0644, - .proc_handler = proc_dointvec, - }, -diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c -index d60c0ee66387..6c4cbd97a673 100644 ---- a/security/selinux/selinuxfs.c -+++ b/security/selinux/selinuxfs.c -@@ -152,7 +152,7 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf, - goto out; - - /* No partial writes. */ -- length = EINVAL; -+ length = -EINVAL; - if (*ppos != 0) - goto out; - -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 910f2dbe1b24..ca26373ebe70 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -271,7 +271,7 @@ static void alc_auto_setup_eapd(struct hda_codec *codec, bool on) - { - /* We currently only handle front, HP */ - static hda_nid_t pins[] = { -- 0x0f, 0x10, 0x14, 0x15, 0 -+ 0x0f, 0x10, 0x14, 0x15, 0x17, 0 - }; - hda_nid_t *p; - for (p = pins; *p; p++) -@@ -2885,6 +2885,8 @@ static void alc283_init(struct hda_codec *codec) - - if (!hp_pin) - return; -+ -+ msleep(30); - hp_pin_sense = snd_hda_jack_detect(codec, hp_pin); - - /* Index 0x43 Direct Drive HP AMP LPM Control 1 */ -@@ -3951,6 +3953,7 @@ enum { - ALC269_FIXUP_QUANTA_MUTE, - ALC269_FIXUP_LIFEBOOK, - ALC269_FIXUP_LIFEBOOK_EXTMIC, -+ ALC269_FIXUP_LIFEBOOK_HP_PIN, - ALC269_FIXUP_AMIC, - ALC269_FIXUP_DMIC, - ALC269VB_FIXUP_AMIC, -@@ -4085,6 +4088,13 @@ static const struct hda_fixup alc269_fixups[] = { - { } - }, - }, -+ [ALC269_FIXUP_LIFEBOOK_HP_PIN] = { -+ .type = HDA_FIXUP_PINS, -+ .v.pins = (const struct hda_pintbl[]) { -+ { 0x21, 0x0221102f }, /* HP out */ -+ { } -+ }, -+ }, - [ALC269_FIXUP_AMIC] = { - .type = HDA_FIXUP_PINS, - .v.pins = (const struct hda_pintbl[]) { -@@ -4538,6 +4548,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x104d, 0x9084, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ), - SND_PCI_QUIRK_VENDOR(0x104d, "Sony VAIO", ALC269_FIXUP_SONY_VAIO), - SND_PCI_QUIRK(0x10cf, 0x1475, "Lifebook", ALC269_FIXUP_LIFEBOOK), -+ SND_PCI_QUIRK(0x10cf, 0x15dc, "Lifebook T731", ALC269_FIXUP_LIFEBOOK_HP_PIN), - SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC), - SND_PCI_QUIRK(0x17aa, 0x20f2, "Thinkpad SL410/510", ALC269_FIXUP_SKU_IGNORE), - SND_PCI_QUIRK(0x17aa, 0x215e, "Thinkpad L512", ALC269_FIXUP_SKU_IGNORE), -diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c -index 5a723df670b4..a82ec53b8fb3 100644 ---- a/sound/usb/mixer_quirks.c -+++ b/sound/usb/mixer_quirks.c -@@ -178,6 +178,7 @@ static const struct rc_config { - { USB_ID(0x041e, 0x3040), 2, 2, 6, 6, 2, 0x6e91 }, /* Live! 24-bit */ - { USB_ID(0x041e, 0x3042), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 */ - { USB_ID(0x041e, 0x30df), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 Pro */ -+ { USB_ID(0x041e, 0x3237), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 Pro */ - { USB_ID(0x041e, 0x3048), 2, 2, 6, 6, 2, 0x6e91 }, /* Toshiba SB0500 */ - }; - diff --git a/patch/kernel/odroidc2-default/patch-3.14.39-40.patch b/patch/kernel/odroidc2-default/patch-3.14.39-40.patch deleted file mode 100644 index df3ad67ddd..0000000000 --- a/patch/kernel/odroidc2-default/patch-3.14.39-40.patch +++ /dev/null @@ -1,2442 +0,0 @@ -diff --git a/Makefile b/Makefile -index b40845e11b84..070e0ebb9231 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 3 - PATCHLEVEL = 14 --SUBLEVEL = 39 -+SUBLEVEL = 40 - EXTRAVERSION = - NAME = Remembering Coco - -diff --git a/arch/alpha/mm/fault.c b/arch/alpha/mm/fault.c -index 98838a05ba6d..9d0ac091a52a 100644 ---- a/arch/alpha/mm/fault.c -+++ b/arch/alpha/mm/fault.c -@@ -156,6 +156,8 @@ retry: - if (unlikely(fault & VM_FAULT_ERROR)) { - if (fault & VM_FAULT_OOM) - goto out_of_memory; -+ else if (fault & VM_FAULT_SIGSEGV) -+ goto bad_area; - else if (fault & VM_FAULT_SIGBUS) - goto do_sigbus; - BUG(); -diff --git a/arch/arc/mm/fault.c b/arch/arc/mm/fault.c -index 9c69552350c4..01e18b58dfa4 100644 ---- a/arch/arc/mm/fault.c -+++ b/arch/arc/mm/fault.c -@@ -162,6 +162,8 @@ good_area: - /* TBD: switch to pagefault_out_of_memory() */ - if (fault & VM_FAULT_OOM) - goto out_of_memory; -+ else if (fault & VM_FAULT_SIGSEGV) -+ goto bad_area; - else if (fault & VM_FAULT_SIGBUS) - goto do_sigbus; - -diff --git a/arch/arm/include/asm/pgtable-3level-hwdef.h b/arch/arm/include/asm/pgtable-3level-hwdef.h -index 626989fec4d3..9fd61c72a33a 100644 ---- a/arch/arm/include/asm/pgtable-3level-hwdef.h -+++ b/arch/arm/include/asm/pgtable-3level-hwdef.h -@@ -43,7 +43,7 @@ - #define PMD_SECT_BUFFERABLE (_AT(pmdval_t, 1) << 2) - #define PMD_SECT_CACHEABLE (_AT(pmdval_t, 1) << 3) - #define PMD_SECT_USER (_AT(pmdval_t, 1) << 6) /* AP[1] */ --#define PMD_SECT_RDONLY (_AT(pmdval_t, 1) << 7) /* AP[2] */ -+#define PMD_SECT_AP2 (_AT(pmdval_t, 1) << 7) /* read only */ - #define PMD_SECT_S (_AT(pmdval_t, 3) << 8) - #define PMD_SECT_AF (_AT(pmdval_t, 1) << 10) - #define PMD_SECT_nG (_AT(pmdval_t, 1) << 11) -@@ -72,6 +72,7 @@ - #define PTE_TABLE_BIT (_AT(pteval_t, 1) << 1) - #define PTE_BUFFERABLE (_AT(pteval_t, 1) << 2) /* AttrIndx[0] */ - #define PTE_CACHEABLE (_AT(pteval_t, 1) << 3) /* AttrIndx[1] */ -+#define PTE_AP2 (_AT(pteval_t, 1) << 7) /* AP[2] */ - #define PTE_EXT_SHARED (_AT(pteval_t, 3) << 8) /* SH[1:0], inner shareable */ - #define PTE_EXT_AF (_AT(pteval_t, 1) << 10) /* Access Flag */ - #define PTE_EXT_NG (_AT(pteval_t, 1) << 11) /* nG */ -diff --git a/arch/arm/include/asm/pgtable-3level.h b/arch/arm/include/asm/pgtable-3level.h -index 85c60adc8b60..06e0bc0f8b00 100644 ---- a/arch/arm/include/asm/pgtable-3level.h -+++ b/arch/arm/include/asm/pgtable-3level.h -@@ -79,18 +79,19 @@ - #define L_PTE_PRESENT (_AT(pteval_t, 3) << 0) /* Present */ - #define L_PTE_FILE (_AT(pteval_t, 1) << 2) /* only when !PRESENT */ - #define L_PTE_USER (_AT(pteval_t, 1) << 6) /* AP[1] */ --#define L_PTE_RDONLY (_AT(pteval_t, 1) << 7) /* AP[2] */ - #define L_PTE_SHARED (_AT(pteval_t, 3) << 8) /* SH[1:0], inner shareable */ - #define L_PTE_YOUNG (_AT(pteval_t, 1) << 10) /* AF */ - #define L_PTE_XN (_AT(pteval_t, 1) << 54) /* XN */ --#define L_PTE_DIRTY (_AT(pteval_t, 1) << 55) /* unused */ --#define L_PTE_SPECIAL (_AT(pteval_t, 1) << 56) /* unused */ -+#define L_PTE_DIRTY (_AT(pteval_t, 1) << 55) -+#define L_PTE_SPECIAL (_AT(pteval_t, 1) << 56) - #define L_PTE_NONE (_AT(pteval_t, 1) << 57) /* PROT_NONE */ -+#define L_PTE_RDONLY (_AT(pteval_t, 1) << 58) /* READ ONLY */ - --#define PMD_SECT_VALID (_AT(pmdval_t, 1) << 0) --#define PMD_SECT_DIRTY (_AT(pmdval_t, 1) << 55) --#define PMD_SECT_SPLITTING (_AT(pmdval_t, 1) << 56) --#define PMD_SECT_NONE (_AT(pmdval_t, 1) << 57) -+#define L_PMD_SECT_VALID (_AT(pmdval_t, 1) << 0) -+#define L_PMD_SECT_DIRTY (_AT(pmdval_t, 1) << 55) -+#define L_PMD_SECT_SPLITTING (_AT(pmdval_t, 1) << 56) -+#define L_PMD_SECT_NONE (_AT(pmdval_t, 1) << 57) -+#define L_PMD_SECT_RDONLY (_AT(pteval_t, 1) << 58) - - /* - * To be used in assembly code with the upper page attributes. -@@ -207,27 +208,32 @@ static inline pmd_t *pmd_offset(pud_t *pud, unsigned long addr) - #define pte_huge(pte) (pte_val(pte) && !(pte_val(pte) & PTE_TABLE_BIT)) - #define pte_mkhuge(pte) (__pte(pte_val(pte) & ~PTE_TABLE_BIT)) - --#define pmd_young(pmd) (pmd_val(pmd) & PMD_SECT_AF) -+#define pmd_isset(pmd, val) ((u32)(val) == (val) ? pmd_val(pmd) & (val) \ -+ : !!(pmd_val(pmd) & (val))) -+#define pmd_isclear(pmd, val) (!(pmd_val(pmd) & (val))) -+ -+#define pmd_young(pmd) (pmd_isset((pmd), PMD_SECT_AF)) - - #define __HAVE_ARCH_PMD_WRITE --#define pmd_write(pmd) (!(pmd_val(pmd) & PMD_SECT_RDONLY)) -+#define pmd_write(pmd) (pmd_isclear((pmd), L_PMD_SECT_RDONLY)) -+#define pmd_dirty(pmd) (pmd_isset((pmd), L_PMD_SECT_DIRTY)) - - #define pmd_hugewillfault(pmd) (!pmd_young(pmd) || !pmd_write(pmd)) - #define pmd_thp_or_huge(pmd) (pmd_huge(pmd) || pmd_trans_huge(pmd)) - - #ifdef CONFIG_TRANSPARENT_HUGEPAGE --#define pmd_trans_huge(pmd) (pmd_val(pmd) && !(pmd_val(pmd) & PMD_TABLE_BIT)) --#define pmd_trans_splitting(pmd) (pmd_val(pmd) & PMD_SECT_SPLITTING) -+#define pmd_trans_huge(pmd) (pmd_val(pmd) && !pmd_table(pmd)) -+#define pmd_trans_splitting(pmd) (pmd_isset((pmd), L_PMD_SECT_SPLITTING)) - #endif - - #define PMD_BIT_FUNC(fn,op) \ - static inline pmd_t pmd_##fn(pmd_t pmd) { pmd_val(pmd) op; return pmd; } - --PMD_BIT_FUNC(wrprotect, |= PMD_SECT_RDONLY); -+PMD_BIT_FUNC(wrprotect, |= L_PMD_SECT_RDONLY); - PMD_BIT_FUNC(mkold, &= ~PMD_SECT_AF); --PMD_BIT_FUNC(mksplitting, |= PMD_SECT_SPLITTING); --PMD_BIT_FUNC(mkwrite, &= ~PMD_SECT_RDONLY); --PMD_BIT_FUNC(mkdirty, |= PMD_SECT_DIRTY); -+PMD_BIT_FUNC(mksplitting, |= L_PMD_SECT_SPLITTING); -+PMD_BIT_FUNC(mkwrite, &= ~L_PMD_SECT_RDONLY); -+PMD_BIT_FUNC(mkdirty, |= L_PMD_SECT_DIRTY); - PMD_BIT_FUNC(mkyoung, |= PMD_SECT_AF); - - #define pmd_mkhuge(pmd) (__pmd(pmd_val(pmd) & ~PMD_TABLE_BIT)) -@@ -241,8 +247,8 @@ PMD_BIT_FUNC(mkyoung, |= PMD_SECT_AF); - - static inline pmd_t pmd_modify(pmd_t pmd, pgprot_t newprot) - { -- const pmdval_t mask = PMD_SECT_USER | PMD_SECT_XN | PMD_SECT_RDONLY | -- PMD_SECT_VALID | PMD_SECT_NONE; -+ const pmdval_t mask = PMD_SECT_USER | PMD_SECT_XN | L_PMD_SECT_RDONLY | -+ L_PMD_SECT_VALID | L_PMD_SECT_NONE; - pmd_val(pmd) = (pmd_val(pmd) & ~mask) | (pgprot_val(newprot) & mask); - return pmd; - } -@@ -253,8 +259,13 @@ static inline void set_pmd_at(struct mm_struct *mm, unsigned long addr, - BUG_ON(addr >= TASK_SIZE); - - /* create a faulting entry if PROT_NONE protected */ -- if (pmd_val(pmd) & PMD_SECT_NONE) -- pmd_val(pmd) &= ~PMD_SECT_VALID; -+ if (pmd_val(pmd) & L_PMD_SECT_NONE) -+ pmd_val(pmd) &= ~L_PMD_SECT_VALID; -+ -+ if (pmd_write(pmd) && pmd_dirty(pmd)) -+ pmd_val(pmd) &= ~PMD_SECT_AP2; -+ else -+ pmd_val(pmd) |= PMD_SECT_AP2; - - *pmdp = __pmd(pmd_val(pmd) | PMD_SECT_nG); - flush_pmd_entry(pmdp); -diff --git a/arch/arm/include/asm/pgtable.h b/arch/arm/include/asm/pgtable.h -index 7d59b524f2af..89dba131703b 100644 ---- a/arch/arm/include/asm/pgtable.h -+++ b/arch/arm/include/asm/pgtable.h -@@ -214,12 +214,16 @@ static inline pte_t *pmd_page_vaddr(pmd_t pmd) - - #define pte_clear(mm,addr,ptep) set_pte_ext(ptep, __pte(0), 0) - -+#define pte_isset(pte, val) ((u32)(val) == (val) ? pte_val(pte) & (val) \ -+ : !!(pte_val(pte) & (val))) -+#define pte_isclear(pte, val) (!(pte_val(pte) & (val))) -+ - #define pte_none(pte) (!pte_val(pte)) --#define pte_present(pte) (pte_val(pte) & L_PTE_PRESENT) --#define pte_write(pte) (!(pte_val(pte) & L_PTE_RDONLY)) --#define pte_dirty(pte) (pte_val(pte) & L_PTE_DIRTY) --#define pte_young(pte) (pte_val(pte) & L_PTE_YOUNG) --#define pte_exec(pte) (!(pte_val(pte) & L_PTE_XN)) -+#define pte_present(pte) (pte_isset((pte), L_PTE_PRESENT)) -+#define pte_write(pte) (pte_isclear((pte), L_PTE_RDONLY)) -+#define pte_dirty(pte) (pte_isset((pte), L_PTE_DIRTY)) -+#define pte_young(pte) (pte_isset((pte), L_PTE_YOUNG)) -+#define pte_exec(pte) (pte_isclear((pte), L_PTE_XN)) - #define pte_special(pte) (0) - - #define pte_present_user(pte) (pte_present(pte) && (pte_val(pte) & L_PTE_USER)) -diff --git a/arch/arm/mm/proc-v7-3level.S b/arch/arm/mm/proc-v7-3level.S -index 22e3ad63500c..eb81123a845d 100644 ---- a/arch/arm/mm/proc-v7-3level.S -+++ b/arch/arm/mm/proc-v7-3level.S -@@ -86,8 +86,13 @@ ENTRY(cpu_v7_set_pte_ext) - tst rh, #1 << (57 - 32) @ L_PTE_NONE - bicne rl, #L_PTE_VALID - bne 1f -- tst rh, #1 << (55 - 32) @ L_PTE_DIRTY -- orreq rl, #L_PTE_RDONLY -+ -+ eor ip, rh, #1 << (55 - 32) @ toggle L_PTE_DIRTY in temp reg to -+ @ test for !L_PTE_DIRTY || L_PTE_RDONLY -+ tst ip, #1 << (55 - 32) | 1 << (58 - 32) -+ orrne rl, #PTE_AP2 -+ biceq rl, #PTE_AP2 -+ - 1: strd r2, r3, [r0] - ALT_SMP(W(nop)) - ALT_UP (mcr p15, 0, r0, c7, c10, 1) @ flush_pte -diff --git a/arch/avr32/mm/fault.c b/arch/avr32/mm/fault.c -index 0eca93327195..d223a8b57c1e 100644 ---- a/arch/avr32/mm/fault.c -+++ b/arch/avr32/mm/fault.c -@@ -142,6 +142,8 @@ good_area: - if (unlikely(fault & VM_FAULT_ERROR)) { - if (fault & VM_FAULT_OOM) - goto out_of_memory; -+ else if (fault & VM_FAULT_SIGSEGV) -+ goto bad_area; - else if (fault & VM_FAULT_SIGBUS) - goto do_sigbus; - BUG(); -diff --git a/arch/cris/mm/fault.c b/arch/cris/mm/fault.c -index 1790f22e71a2..2686a7aa8ec8 100644 ---- a/arch/cris/mm/fault.c -+++ b/arch/cris/mm/fault.c -@@ -176,6 +176,8 @@ retry: - if (unlikely(fault & VM_FAULT_ERROR)) { - if (fault & VM_FAULT_OOM) - goto out_of_memory; -+ else if (fault & VM_FAULT_SIGSEGV) -+ goto bad_area; - else if (fault & VM_FAULT_SIGBUS) - goto do_sigbus; - BUG(); -diff --git a/arch/frv/mm/fault.c b/arch/frv/mm/fault.c -index 9a66372fc7c7..ec4917ddf678 100644 ---- a/arch/frv/mm/fault.c -+++ b/arch/frv/mm/fault.c -@@ -168,6 +168,8 @@ asmlinkage void do_page_fault(int datammu, unsigned long esr0, unsigned long ear - if (unlikely(fault & VM_FAULT_ERROR)) { - if (fault & VM_FAULT_OOM) - goto out_of_memory; -+ else if (fault & VM_FAULT_SIGSEGV) -+ goto bad_area; - else if (fault & VM_FAULT_SIGBUS) - goto do_sigbus; - BUG(); -diff --git a/arch/ia64/mm/fault.c b/arch/ia64/mm/fault.c -index 7225dad87094..ba5ba7accd0d 100644 ---- a/arch/ia64/mm/fault.c -+++ b/arch/ia64/mm/fault.c -@@ -172,6 +172,8 @@ retry: - */ - if (fault & VM_FAULT_OOM) { - goto out_of_memory; -+ } else if (fault & VM_FAULT_SIGSEGV) { -+ goto bad_area; - } else if (fault & VM_FAULT_SIGBUS) { - signal = SIGBUS; - goto bad_area; -diff --git a/arch/m32r/mm/fault.c b/arch/m32r/mm/fault.c -index e9c6a8014bd6..e3d4d4890104 100644 ---- a/arch/m32r/mm/fault.c -+++ b/arch/m32r/mm/fault.c -@@ -200,6 +200,8 @@ good_area: - if (unlikely(fault & VM_FAULT_ERROR)) { - if (fault & VM_FAULT_OOM) - goto out_of_memory; -+ else if (fault & VM_FAULT_SIGSEGV) -+ goto bad_area; - else if (fault & VM_FAULT_SIGBUS) - goto do_sigbus; - BUG(); -diff --git a/arch/m68k/mm/fault.c b/arch/m68k/mm/fault.c -index 2bd7487440c4..b2f04aee46ec 100644 ---- a/arch/m68k/mm/fault.c -+++ b/arch/m68k/mm/fault.c -@@ -145,6 +145,8 @@ good_area: - if (unlikely(fault & VM_FAULT_ERROR)) { - if (fault & VM_FAULT_OOM) - goto out_of_memory; -+ else if (fault & VM_FAULT_SIGSEGV) -+ goto map_err; - else if (fault & VM_FAULT_SIGBUS) - goto bus_err; - BUG(); -diff --git a/arch/metag/mm/fault.c b/arch/metag/mm/fault.c -index 332680e5ebf2..2de5dc695a87 100644 ---- a/arch/metag/mm/fault.c -+++ b/arch/metag/mm/fault.c -@@ -141,6 +141,8 @@ good_area: - if (unlikely(fault & VM_FAULT_ERROR)) { - if (fault & VM_FAULT_OOM) - goto out_of_memory; -+ else if (fault & VM_FAULT_SIGSEGV) -+ goto bad_area; - else if (fault & VM_FAULT_SIGBUS) - goto do_sigbus; - BUG(); -diff --git a/arch/microblaze/mm/fault.c b/arch/microblaze/mm/fault.c -index fa4cf52aa7a6..d46a5ebb7570 100644 ---- a/arch/microblaze/mm/fault.c -+++ b/arch/microblaze/mm/fault.c -@@ -224,6 +224,8 @@ good_area: - if (unlikely(fault & VM_FAULT_ERROR)) { - if (fault & VM_FAULT_OOM) - goto out_of_memory; -+ else if (fault & VM_FAULT_SIGSEGV) -+ goto bad_area; - else if (fault & VM_FAULT_SIGBUS) - goto do_sigbus; - BUG(); -diff --git a/arch/mips/mm/fault.c b/arch/mips/mm/fault.c -index becc42bb1849..70ab5d664332 100644 ---- a/arch/mips/mm/fault.c -+++ b/arch/mips/mm/fault.c -@@ -158,6 +158,8 @@ good_area: - if (unlikely(fault & VM_FAULT_ERROR)) { - if (fault & VM_FAULT_OOM) - goto out_of_memory; -+ else if (fault & VM_FAULT_SIGSEGV) -+ goto bad_area; - else if (fault & VM_FAULT_SIGBUS) - goto do_sigbus; - BUG(); -diff --git a/arch/mn10300/mm/fault.c b/arch/mn10300/mm/fault.c -index 3516cbdf1ee9..0c2cc5d39c8e 100644 ---- a/arch/mn10300/mm/fault.c -+++ b/arch/mn10300/mm/fault.c -@@ -262,6 +262,8 @@ good_area: - if (unlikely(fault & VM_FAULT_ERROR)) { - if (fault & VM_FAULT_OOM) - goto out_of_memory; -+ else if (fault & VM_FAULT_SIGSEGV) -+ goto bad_area; - else if (fault & VM_FAULT_SIGBUS) - goto do_sigbus; - BUG(); -diff --git a/arch/openrisc/mm/fault.c b/arch/openrisc/mm/fault.c -index 0703acf7d327..230ac20ae794 100644 ---- a/arch/openrisc/mm/fault.c -+++ b/arch/openrisc/mm/fault.c -@@ -171,6 +171,8 @@ good_area: - if (unlikely(fault & VM_FAULT_ERROR)) { - if (fault & VM_FAULT_OOM) - goto out_of_memory; -+ else if (fault & VM_FAULT_SIGSEGV) -+ goto bad_area; - else if (fault & VM_FAULT_SIGBUS) - goto do_sigbus; - BUG(); -diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c -index d72197f0ddb8..d27e38874e81 100644 ---- a/arch/parisc/mm/fault.c -+++ b/arch/parisc/mm/fault.c -@@ -256,6 +256,8 @@ good_area: - */ - if (fault & VM_FAULT_OOM) - goto out_of_memory; -+ else if (fault & VM_FAULT_SIGSEGV) -+ goto bad_area; - else if (fault & VM_FAULT_SIGBUS) - goto bad_area; - BUG(); -diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c -index 51ab9e7e6c39..010fabf3828c 100644 ---- a/arch/powerpc/mm/fault.c -+++ b/arch/powerpc/mm/fault.c -@@ -432,6 +432,8 @@ good_area: - */ - fault = handle_mm_fault(mm, vma, address, flags); - if (unlikely(fault & (VM_FAULT_RETRY|VM_FAULT_ERROR))) { -+ if (fault & VM_FAULT_SIGSEGV) -+ goto bad_area; - rc = mm_fault_error(regs, address, fault); - if (rc >= MM_FAULT_RETURN) - goto bail; -diff --git a/arch/powerpc/platforms/cell/spu_fault.c b/arch/powerpc/platforms/cell/spu_fault.c -index 641e7273d75a..62f3e4e48a0b 100644 ---- a/arch/powerpc/platforms/cell/spu_fault.c -+++ b/arch/powerpc/platforms/cell/spu_fault.c -@@ -75,7 +75,7 @@ int spu_handle_mm_fault(struct mm_struct *mm, unsigned long ea, - if (*flt & VM_FAULT_OOM) { - ret = -ENOMEM; - goto out_unlock; -- } else if (*flt & VM_FAULT_SIGBUS) { -+ } else if (*flt & (VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV)) { - ret = -EFAULT; - goto out_unlock; - } -diff --git a/arch/powerpc/platforms/cell/spufs/inode.c b/arch/powerpc/platforms/cell/spufs/inode.c -index 87ba7cf99cd7..65d633f20d37 100644 ---- a/arch/powerpc/platforms/cell/spufs/inode.c -+++ b/arch/powerpc/platforms/cell/spufs/inode.c -@@ -164,7 +164,7 @@ static void spufs_prune_dir(struct dentry *dir) - struct dentry *dentry, *tmp; - - mutex_lock(&dir->d_inode->i_mutex); -- list_for_each_entry_safe(dentry, tmp, &dir->d_subdirs, d_u.d_child) { -+ list_for_each_entry_safe(dentry, tmp, &dir->d_subdirs, d_child) { - spin_lock(&dentry->d_lock); - if (!(d_unhashed(dentry)) && dentry->d_inode) { - dget_dlock(dentry); -diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c -index d95265b2719f..8e95432cc3b2 100644 ---- a/arch/s390/mm/fault.c -+++ b/arch/s390/mm/fault.c -@@ -239,6 +239,12 @@ static noinline void do_fault_error(struct pt_regs *regs, int fault) - do_no_context(regs); - else - pagefault_out_of_memory(); -+ } else if (fault & VM_FAULT_SIGSEGV) { -+ /* Kernel mode? Handle exceptions or die */ -+ if (!user_mode(regs)) -+ do_no_context(regs); -+ else -+ do_sigsegv(regs, SEGV_MAPERR); - } else if (fault & VM_FAULT_SIGBUS) { - /* Kernel mode? Handle exceptions or die */ - if (!user_mode(regs)) -diff --git a/arch/score/mm/fault.c b/arch/score/mm/fault.c -index 52238983527d..6860beb2a280 100644 ---- a/arch/score/mm/fault.c -+++ b/arch/score/mm/fault.c -@@ -114,6 +114,8 @@ good_area: - if (unlikely(fault & VM_FAULT_ERROR)) { - if (fault & VM_FAULT_OOM) - goto out_of_memory; -+ else if (fault & VM_FAULT_SIGSEGV) -+ goto bad_area; - else if (fault & VM_FAULT_SIGBUS) - goto do_sigbus; - BUG(); -diff --git a/arch/sh/mm/fault.c b/arch/sh/mm/fault.c -index 541dc6101508..a58fec9b55e0 100644 ---- a/arch/sh/mm/fault.c -+++ b/arch/sh/mm/fault.c -@@ -353,6 +353,8 @@ mm_fault_error(struct pt_regs *regs, unsigned long error_code, - } else { - if (fault & VM_FAULT_SIGBUS) - do_sigbus(regs, error_code, address); -+ else if (fault & VM_FAULT_SIGSEGV) -+ bad_area(regs, error_code, address); - else - BUG(); - } -diff --git a/arch/sparc/mm/fault_32.c b/arch/sparc/mm/fault_32.c -index 59dbd4645725..163c78712110 100644 ---- a/arch/sparc/mm/fault_32.c -+++ b/arch/sparc/mm/fault_32.c -@@ -252,6 +252,8 @@ good_area: - if (unlikely(fault & VM_FAULT_ERROR)) { - if (fault & VM_FAULT_OOM) - goto out_of_memory; -+ else if (fault & VM_FAULT_SIGSEGV) -+ goto bad_area; - else if (fault & VM_FAULT_SIGBUS) - goto do_sigbus; - BUG(); -diff --git a/arch/sparc/mm/fault_64.c b/arch/sparc/mm/fault_64.c -index 45a413e4380a..0d6de79105b6 100644 ---- a/arch/sparc/mm/fault_64.c -+++ b/arch/sparc/mm/fault_64.c -@@ -448,6 +448,8 @@ good_area: - if (unlikely(fault & VM_FAULT_ERROR)) { - if (fault & VM_FAULT_OOM) - goto out_of_memory; -+ else if (fault & VM_FAULT_SIGSEGV) -+ goto bad_area; - else if (fault & VM_FAULT_SIGBUS) - goto do_sigbus; - BUG(); -diff --git a/arch/tile/mm/fault.c b/arch/tile/mm/fault.c -index 6c0571216a9d..c6d2a76d91a8 100644 ---- a/arch/tile/mm/fault.c -+++ b/arch/tile/mm/fault.c -@@ -444,6 +444,8 @@ good_area: - if (unlikely(fault & VM_FAULT_ERROR)) { - if (fault & VM_FAULT_OOM) - goto out_of_memory; -+ else if (fault & VM_FAULT_SIGSEGV) -+ goto bad_area; - else if (fault & VM_FAULT_SIGBUS) - goto do_sigbus; - BUG(); -diff --git a/arch/um/kernel/trap.c b/arch/um/kernel/trap.c -index 974b87474a99..53b832033d9b 100644 ---- a/arch/um/kernel/trap.c -+++ b/arch/um/kernel/trap.c -@@ -80,6 +80,8 @@ good_area: - if (unlikely(fault & VM_FAULT_ERROR)) { - if (fault & VM_FAULT_OOM) { - goto out_of_memory; -+ } else if (fault & VM_FAULT_SIGSEGV) { -+ goto out; - } else if (fault & VM_FAULT_SIGBUS) { - err = -EACCES; - goto out; -diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c -index 09651d4a9038..cf1eeeafdfa3 100644 ---- a/arch/x86/kvm/emulate.c -+++ b/arch/x86/kvm/emulate.c -@@ -2258,7 +2258,7 @@ static int em_sysenter(struct x86_emulate_ctxt *ctxt) - * Not recognized on AMD in compat mode (but is recognized in legacy - * mode). - */ -- if ((ctxt->mode == X86EMUL_MODE_PROT32) && (efer & EFER_LMA) -+ if ((ctxt->mode != X86EMUL_MODE_PROT64) && (efer & EFER_LMA) - && !vendor_intel(ctxt)) - return emulate_ud(ctxt); - -@@ -2271,25 +2271,13 @@ static int em_sysenter(struct x86_emulate_ctxt *ctxt) - setup_syscalls_segments(ctxt, &cs, &ss); - - ops->get_msr(ctxt, MSR_IA32_SYSENTER_CS, &msr_data); -- switch (ctxt->mode) { -- case X86EMUL_MODE_PROT32: -- if ((msr_data & 0xfffc) == 0x0) -- return emulate_gp(ctxt, 0); -- break; -- case X86EMUL_MODE_PROT64: -- if (msr_data == 0x0) -- return emulate_gp(ctxt, 0); -- break; -- default: -- break; -- } -+ if ((msr_data & 0xfffc) == 0x0) -+ return emulate_gp(ctxt, 0); - - ctxt->eflags &= ~(EFLG_VM | EFLG_IF | EFLG_RF); -- cs_sel = (u16)msr_data; -- cs_sel &= ~SELECTOR_RPL_MASK; -+ cs_sel = (u16)msr_data & ~SELECTOR_RPL_MASK; - ss_sel = cs_sel + 8; -- ss_sel &= ~SELECTOR_RPL_MASK; -- if (ctxt->mode == X86EMUL_MODE_PROT64 || (efer & EFER_LMA)) { -+ if (efer & EFER_LMA) { - cs.d = 0; - cs.l = 1; - } -@@ -2298,10 +2286,11 @@ static int em_sysenter(struct x86_emulate_ctxt *ctxt) - ops->set_segment(ctxt, ss_sel, &ss, 0, VCPU_SREG_SS); - - ops->get_msr(ctxt, MSR_IA32_SYSENTER_EIP, &msr_data); -- ctxt->_eip = msr_data; -+ ctxt->_eip = (efer & EFER_LMA) ? msr_data : (u32)msr_data; - - ops->get_msr(ctxt, MSR_IA32_SYSENTER_ESP, &msr_data); -- *reg_write(ctxt, VCPU_REGS_RSP) = msr_data; -+ *reg_write(ctxt, VCPU_REGS_RSP) = (efer & EFER_LMA) ? msr_data : -+ (u32)msr_data; - - return X86EMUL_CONTINUE; - } -diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c -index a10c8c792161..ebc551c82605 100644 ---- a/arch/x86/mm/fault.c -+++ b/arch/x86/mm/fault.c -@@ -833,11 +833,8 @@ do_sigbus(struct pt_regs *regs, unsigned long error_code, unsigned long address, - unsigned int fault) - { - struct task_struct *tsk = current; -- struct mm_struct *mm = tsk->mm; - int code = BUS_ADRERR; - -- up_read(&mm->mmap_sem); -- - /* Kernel mode? Handle exceptions or die: */ - if (!(error_code & PF_USER)) { - no_context(regs, error_code, address, SIGBUS, BUS_ADRERR); -@@ -868,7 +865,6 @@ mm_fault_error(struct pt_regs *regs, unsigned long error_code, - unsigned long address, unsigned int fault) - { - if (fatal_signal_pending(current) && !(error_code & PF_USER)) { -- up_read(¤t->mm->mmap_sem); - no_context(regs, error_code, address, 0, 0); - return; - } -@@ -876,14 +872,11 @@ mm_fault_error(struct pt_regs *regs, unsigned long error_code, - if (fault & VM_FAULT_OOM) { - /* Kernel mode? Handle exceptions or die: */ - if (!(error_code & PF_USER)) { -- up_read(¤t->mm->mmap_sem); - no_context(regs, error_code, address, - SIGSEGV, SEGV_MAPERR); - return; - } - -- up_read(¤t->mm->mmap_sem); -- - /* - * We ran out of memory, call the OOM killer, and return the - * userspace (which will retry the fault, or kill us if we got -@@ -894,6 +887,8 @@ mm_fault_error(struct pt_regs *regs, unsigned long error_code, - if (fault & (VM_FAULT_SIGBUS|VM_FAULT_HWPOISON| - VM_FAULT_HWPOISON_LARGE)) - do_sigbus(regs, error_code, address, fault); -+ else if (fault & VM_FAULT_SIGSEGV) -+ bad_area_nosemaphore(regs, error_code, address); - else - BUG(); - } -@@ -1216,6 +1211,7 @@ good_area: - return; - - if (unlikely(fault & VM_FAULT_ERROR)) { -+ up_read(&mm->mmap_sem); - mm_fault_error(regs, error_code, address, fault); - return; - } -diff --git a/arch/xtensa/mm/fault.c b/arch/xtensa/mm/fault.c -index b57c4f91f487..9e3571a6535c 100644 ---- a/arch/xtensa/mm/fault.c -+++ b/arch/xtensa/mm/fault.c -@@ -117,6 +117,8 @@ good_area: - if (unlikely(fault & VM_FAULT_ERROR)) { - if (fault & VM_FAULT_OOM) - goto out_of_memory; -+ else if (fault & VM_FAULT_SIGSEGV) -+ goto bad_area; - else if (fault & VM_FAULT_SIGBUS) - goto do_sigbus; - BUG(); -diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c -index f667e37394da..5afe556a70f8 100644 ---- a/drivers/bluetooth/ath3k.c -+++ b/drivers/bluetooth/ath3k.c -@@ -62,51 +62,59 @@ static const struct usb_device_id ath3k_table[] = { - { USB_DEVICE(0x0CF3, 0x3000) }, - - /* Atheros AR3011 with sflash firmware*/ -+ { USB_DEVICE(0x0489, 0xE027) }, -+ { USB_DEVICE(0x0489, 0xE03D) }, -+ { USB_DEVICE(0x0930, 0x0215) }, - { USB_DEVICE(0x0CF3, 0x3002) }, - { USB_DEVICE(0x0CF3, 0xE019) }, - { USB_DEVICE(0x13d3, 0x3304) }, -- { USB_DEVICE(0x0930, 0x0215) }, -- { USB_DEVICE(0x0489, 0xE03D) }, -- { USB_DEVICE(0x0489, 0xE027) }, - - /* Atheros AR9285 Malbec with sflash firmware */ - { USB_DEVICE(0x03F0, 0x311D) }, - - /* Atheros AR3012 with sflash firmware*/ -- { USB_DEVICE(0x0CF3, 0x0036) }, -- { USB_DEVICE(0x0CF3, 0x3004) }, -- { USB_DEVICE(0x0CF3, 0x3008) }, -- { USB_DEVICE(0x0CF3, 0x311D) }, -- { USB_DEVICE(0x0CF3, 0x817a) }, -- { USB_DEVICE(0x13d3, 0x3375) }, -+ { USB_DEVICE(0x0489, 0xe04d) }, -+ { USB_DEVICE(0x0489, 0xe04e) }, -+ { USB_DEVICE(0x0489, 0xe057) }, -+ { USB_DEVICE(0x0489, 0xe056) }, -+ { USB_DEVICE(0x0489, 0xe05f) }, -+ { USB_DEVICE(0x0489, 0xe078) }, -+ { USB_DEVICE(0x04c5, 0x1330) }, - { USB_DEVICE(0x04CA, 0x3004) }, - { USB_DEVICE(0x04CA, 0x3005) }, - { USB_DEVICE(0x04CA, 0x3006) }, - { USB_DEVICE(0x04CA, 0x3007) }, - { USB_DEVICE(0x04CA, 0x3008) }, - { USB_DEVICE(0x04CA, 0x300b) }, -- { USB_DEVICE(0x13d3, 0x3362) }, -- { USB_DEVICE(0x0CF3, 0xE004) }, -- { USB_DEVICE(0x0CF3, 0xE005) }, -+ { USB_DEVICE(0x04CA, 0x3010) }, - { USB_DEVICE(0x0930, 0x0219) }, - { USB_DEVICE(0x0930, 0x0220) }, -- { USB_DEVICE(0x0489, 0xe057) }, -- { USB_DEVICE(0x13d3, 0x3393) }, -- { USB_DEVICE(0x0489, 0xe04e) }, -- { USB_DEVICE(0x0489, 0xe056) }, -- { USB_DEVICE(0x0489, 0xe04d) }, -- { USB_DEVICE(0x04c5, 0x1330) }, -- { USB_DEVICE(0x13d3, 0x3402) }, -+ { USB_DEVICE(0x0930, 0x0227) }, -+ { USB_DEVICE(0x0b05, 0x17d0) }, -+ { USB_DEVICE(0x0CF3, 0x0036) }, -+ { USB_DEVICE(0x0CF3, 0x3004) }, -+ { USB_DEVICE(0x0CF3, 0x3008) }, -+ { USB_DEVICE(0x0CF3, 0x311D) }, -+ { USB_DEVICE(0x0CF3, 0x311E) }, -+ { USB_DEVICE(0x0CF3, 0x311F) }, - { USB_DEVICE(0x0cf3, 0x3121) }, -+ { USB_DEVICE(0x0CF3, 0x817a) }, - { USB_DEVICE(0x0cf3, 0xe003) }, -- { USB_DEVICE(0x0489, 0xe05f) }, -+ { USB_DEVICE(0x0CF3, 0xE004) }, -+ { USB_DEVICE(0x0CF3, 0xE005) }, -+ { USB_DEVICE(0x13d3, 0x3362) }, -+ { USB_DEVICE(0x13d3, 0x3375) }, -+ { USB_DEVICE(0x13d3, 0x3393) }, -+ { USB_DEVICE(0x13d3, 0x3402) }, -+ { USB_DEVICE(0x13d3, 0x3408) }, -+ { USB_DEVICE(0x13d3, 0x3432) }, - - /* Atheros AR5BBU12 with sflash firmware */ - { USB_DEVICE(0x0489, 0xE02C) }, - - /* Atheros AR5BBU22 with sflash firmware */ -- { USB_DEVICE(0x0489, 0xE03C) }, - { USB_DEVICE(0x0489, 0xE036) }, -+ { USB_DEVICE(0x0489, 0xE03C) }, - - { } /* Terminating entry */ - }; -@@ -119,37 +127,45 @@ MODULE_DEVICE_TABLE(usb, ath3k_table); - static const struct usb_device_id ath3k_blist_tbl[] = { - - /* Atheros AR3012 with sflash firmware*/ -- { USB_DEVICE(0x0CF3, 0x0036), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x0cf3, 0x311D), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x0CF3, 0x817a), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0CF3, 0x0036), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0cf3, 0x311D), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0cf3, 0x311E), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0cf3, 0x311F), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0CF3, 0x817a), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 }, - - /* Atheros AR5BBU22 with sflash firmware */ -- { USB_DEVICE(0x0489, 0xE03C), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0489, 0xE036), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0489, 0xE03C), .driver_info = BTUSB_ATH3012 }, - - { } /* Terminating entry */ - }; -diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c -index e00c3f84a4cf..03b331798e16 100644 ---- a/drivers/bluetooth/btusb.c -+++ b/drivers/bluetooth/btusb.c -@@ -49,6 +49,7 @@ static struct usb_driver btusb_driver; - #define BTUSB_WRONG_SCO_MTU 0x40 - #define BTUSB_ATH3012 0x80 - #define BTUSB_INTEL 0x100 -+#define BTUSB_INTEL_BOOT 0x200 - - static const struct usb_device_id btusb_table[] = { - /* Generic Bluetooth USB device */ -@@ -101,21 +102,31 @@ static const struct usb_device_id btusb_table[] = { - { USB_DEVICE(0x0c10, 0x0000) }, - - /* Broadcom BCM20702A0 */ -+ { USB_DEVICE(0x0489, 0xe042) }, -+ { USB_DEVICE(0x04ca, 0x2003) }, - { USB_DEVICE(0x0b05, 0x17b5) }, - { USB_DEVICE(0x0b05, 0x17cb) }, -- { USB_DEVICE(0x04ca, 0x2003) }, -- { USB_DEVICE(0x0489, 0xe042) }, - { USB_DEVICE(0x413c, 0x8197) }, - - /* Foxconn - Hon Hai */ - { USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01) }, - -- /*Broadcom devices with vendor specific id */ -+ /* Broadcom devices with vendor specific id */ - { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01) }, - -+ /* ASUSTek Computer - Broadcom based */ -+ { USB_VENDOR_AND_INTERFACE_INFO(0x0b05, 0xff, 0x01, 0x01) }, -+ - /* Belkin F8065bf - Broadcom based */ - { USB_VENDOR_AND_INTERFACE_INFO(0x050d, 0xff, 0x01, 0x01) }, - -+ /* IMC Networks - Broadcom based */ -+ { USB_VENDOR_AND_INTERFACE_INFO(0x13d3, 0xff, 0x01, 0x01) }, -+ -+ /* Intel Bluetooth USB Bootloader (RAM module) */ -+ { USB_DEVICE(0x8087, 0x0a5a), -+ .driver_info = BTUSB_INTEL_BOOT | BTUSB_BROKEN_ISOC }, -+ - { } /* Terminating entry */ - }; - -@@ -129,56 +140,64 @@ static const struct usb_device_id blacklist_table[] = { - { USB_DEVICE(0x0a5c, 0x2033), .driver_info = BTUSB_IGNORE }, - - /* Atheros 3011 with sflash firmware */ -+ { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE }, -+ { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE }, -+ { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE }, - { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE }, - { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE }, - { USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE }, -- { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE }, -- { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE }, -- { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE }, - - /* Atheros AR9285 Malbec with sflash firmware */ - { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE }, - - /* Atheros 3012 with sflash firmware */ -- { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0cf3, 0x311f), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 }, - - /* Atheros AR5BBU12 with sflash firmware */ - { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE }, - - /* Atheros AR5BBU12 with sflash firmware */ -- { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 }, - - /* Broadcom BCM2035 */ -- { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU }, -- { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU }, - { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 }, -+ { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU }, -+ { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU }, - - /* Broadcom BCM2045 */ - { USB_DEVICE(0x0a5c, 0x2039), .driver_info = BTUSB_WRONG_SCO_MTU }, -@@ -1491,6 +1510,9 @@ static int btusb_probe(struct usb_interface *intf, - if (id->driver_info & BTUSB_INTEL) - hdev->setup = btusb_setup_intel; - -+ if (id->driver_info & BTUSB_INTEL_BOOT) -+ set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks); -+ - /* Interface numbers are hardcoded in the specification */ - data->isoc = usb_ifnum_to_if(data->udev, 1); - -diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c -index 54e2abe671f7..c611bcc01f7e 100644 ---- a/drivers/edac/sb_edac.c -+++ b/drivers/edac/sb_edac.c -@@ -285,8 +285,9 @@ static const u32 correrrthrsld[] = { - * sbridge structs - */ - --#define NUM_CHANNELS 4 --#define MAX_DIMMS 3 /* Max DIMMS per channel */ -+#define NUM_CHANNELS 4 -+#define MAX_DIMMS 3 /* Max DIMMS per channel */ -+#define CHANNEL_UNSPECIFIED 0xf /* Intel IA32 SDM 15-14 */ - - enum type { - SANDY_BRIDGE, -@@ -1750,6 +1751,9 @@ static void sbridge_mce_output_error(struct mem_ctl_info *mci, - - /* FIXME: need support for channel mask */ - -+ if (channel == CHANNEL_UNSPECIFIED) -+ channel = -1; -+ - /* Call the helper to output message */ - edac_mc_handle_error(tp_event, mci, core_err_cnt, - m->addr >> PAGE_SHIFT, m->addr & ~PAGE_MASK, 0, -diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c -index dcde56057fe1..3177498f3eab 100644 ---- a/drivers/net/bonding/bond_3ad.c -+++ b/drivers/net/bonding/bond_3ad.c -@@ -2479,7 +2479,7 @@ out: - return NETDEV_TX_OK; - err_free: - /* no suitable interface, frame not sent */ -- kfree_skb(skb); -+ dev_kfree_skb_any(skb); - goto out; - } - -diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c -index e8f133e926aa..c67bbc9c36dc 100644 ---- a/drivers/net/bonding/bond_alb.c -+++ b/drivers/net/bonding/bond_alb.c -@@ -1479,7 +1479,7 @@ int bond_alb_xmit(struct sk_buff *skb, struct net_device *bond_dev) - } - - /* no suitable interface, frame not sent */ -- kfree_skb(skb); -+ dev_kfree_skb_any(skb); - out: - return NETDEV_TX_OK; - } -diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c -index 15379824d77d..32b0e7055b1e 100644 ---- a/drivers/net/bonding/bond_main.c -+++ b/drivers/net/bonding/bond_main.c -@@ -3568,7 +3568,7 @@ static void bond_xmit_slave_id(struct bonding *bond, struct sk_buff *skb, int sl - } - } - /* no slave that can tx has been found */ -- kfree_skb(skb); -+ dev_kfree_skb_any(skb); - } - - /** -@@ -3650,7 +3650,7 @@ static int bond_xmit_activebackup(struct sk_buff *skb, struct net_device *bond_d - if (slave) - bond_dev_queue_xmit(bond, skb, slave->dev); - else -- kfree_skb(skb); -+ dev_kfree_skb_any(skb); - - return NETDEV_TX_OK; - } -@@ -3698,7 +3698,7 @@ static int bond_xmit_broadcast(struct sk_buff *skb, struct net_device *bond_dev) - if (slave && IS_UP(slave->dev) && slave->link == BOND_LINK_UP) - bond_dev_queue_xmit(bond, skb, slave->dev); - else -- kfree_skb(skb); -+ dev_kfree_skb_any(skb); - - return NETDEV_TX_OK; - } -@@ -3785,7 +3785,7 @@ static netdev_tx_t __bond_start_xmit(struct sk_buff *skb, struct net_device *dev - pr_err("%s: Error: Unknown bonding mode %d\n", - dev->name, bond->params.mode); - WARN_ON_ONCE(1); -- kfree_skb(skb); -+ dev_kfree_skb_any(skb); - return NETDEV_TX_OK; - } - } -@@ -3806,7 +3806,7 @@ static netdev_tx_t bond_start_xmit(struct sk_buff *skb, struct net_device *dev) - if (bond_has_slaves(bond)) - ret = __bond_start_xmit(skb, dev); - else -- kfree_skb(skb); -+ dev_kfree_skb_any(skb); - rcu_read_unlock(); - - return ret; -diff --git a/drivers/net/ethernet/broadcom/bnx2.c b/drivers/net/ethernet/broadcom/bnx2.c -index 6c9e1c9bdeb8..0c8a16866603 100644 ---- a/drivers/net/ethernet/broadcom/bnx2.c -+++ b/drivers/net/ethernet/broadcom/bnx2.c -@@ -2886,7 +2886,7 @@ bnx2_tx_int(struct bnx2 *bp, struct bnx2_napi *bnapi, int budget) - sw_cons = BNX2_NEXT_TX_BD(sw_cons); - - tx_bytes += skb->len; -- dev_kfree_skb(skb); -+ dev_kfree_skb_any(skb); - tx_pkt++; - if (tx_pkt == budget) - break; -@@ -6640,7 +6640,7 @@ bnx2_start_xmit(struct sk_buff *skb, struct net_device *dev) - - mapping = dma_map_single(&bp->pdev->dev, skb->data, len, PCI_DMA_TODEVICE); - if (dma_mapping_error(&bp->pdev->dev, mapping)) { -- dev_kfree_skb(skb); -+ dev_kfree_skb_any(skb); - return NETDEV_TX_OK; - } - -@@ -6733,7 +6733,7 @@ dma_error: - PCI_DMA_TODEVICE); - } - -- dev_kfree_skb(skb); -+ dev_kfree_skb_any(skb); - return NETDEV_TX_OK; - } - -diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c -index 82061139b215..bc65dc85a622 100644 ---- a/drivers/net/ethernet/broadcom/tg3.c -+++ b/drivers/net/ethernet/broadcom/tg3.c -@@ -6593,7 +6593,7 @@ static void tg3_tx(struct tg3_napi *tnapi) - pkts_compl++; - bytes_compl += skb->len; - -- dev_kfree_skb(skb); -+ dev_kfree_skb_any(skb); - - if (unlikely(tx_bug)) { - tg3_tx_recover(tp); -@@ -6925,7 +6925,7 @@ static int tg3_rx(struct tg3_napi *tnapi, int budget) - if (len > (tp->dev->mtu + ETH_HLEN) && - skb->protocol != htons(ETH_P_8021Q) && - skb->protocol != htons(ETH_P_8021AD)) { -- dev_kfree_skb(skb); -+ dev_kfree_skb_any(skb); - goto drop_it_no_recycle; - } - -@@ -7808,7 +7808,7 @@ static int tigon3_dma_hwbug_workaround(struct tg3_napi *tnapi, - PCI_DMA_TODEVICE); - /* Make sure the mapping succeeded */ - if (pci_dma_mapping_error(tp->pdev, new_addr)) { -- dev_kfree_skb(new_skb); -+ dev_kfree_skb_any(new_skb); - ret = -1; - } else { - u32 save_entry = *entry; -@@ -7823,13 +7823,13 @@ static int tigon3_dma_hwbug_workaround(struct tg3_napi *tnapi, - new_skb->len, base_flags, - mss, vlan)) { - tg3_tx_skb_unmap(tnapi, save_entry, -1); -- dev_kfree_skb(new_skb); -+ dev_kfree_skb_any(new_skb); - ret = -1; - } - } - } - -- dev_kfree_skb(skb); -+ dev_kfree_skb_any(skb); - *pskb = new_skb; - return ret; - } -@@ -7872,7 +7872,7 @@ static int tg3_tso_bug(struct tg3 *tp, struct sk_buff *skb) - } while (segs); - - tg3_tso_bug_end: -- dev_kfree_skb(skb); -+ dev_kfree_skb_any(skb); - - return NETDEV_TX_OK; - } -@@ -8110,7 +8110,7 @@ dma_error: - tg3_tx_skb_unmap(tnapi, tnapi->tx_prod, --i); - tnapi->tx_buffers[tnapi->tx_prod].skb = NULL; - drop: -- dev_kfree_skb(skb); -+ dev_kfree_skb_any(skb); - drop_nofree: - tp->tx_dropped++; - return NETDEV_TX_OK; -diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c -index 80bfa0391913..075e7e7abea9 100644 ---- a/drivers/net/ethernet/emulex/benet/be_main.c -+++ b/drivers/net/ethernet/emulex/benet/be_main.c -@@ -1883,7 +1883,7 @@ static u16 be_tx_compl_process(struct be_adapter *adapter, - queue_tail_inc(txq); - } while (cur_index != last_index); - -- kfree_skb(sent_skb); -+ dev_kfree_skb_any(sent_skb); - return num_wrbs; - } - -diff --git a/drivers/net/ethernet/intel/ixgb/ixgb_main.c b/drivers/net/ethernet/intel/ixgb/ixgb_main.c -index 57e390cbe6d0..f42c201f727f 100644 ---- a/drivers/net/ethernet/intel/ixgb/ixgb_main.c -+++ b/drivers/net/ethernet/intel/ixgb/ixgb_main.c -@@ -1521,12 +1521,12 @@ ixgb_xmit_frame(struct sk_buff *skb, struct net_device *netdev) - int tso; - - if (test_bit(__IXGB_DOWN, &adapter->flags)) { -- dev_kfree_skb(skb); -+ dev_kfree_skb_any(skb); - return NETDEV_TX_OK; - } - - if (skb->len <= 0) { -- dev_kfree_skb(skb); -+ dev_kfree_skb_any(skb); - return NETDEV_TX_OK; - } - -@@ -1543,7 +1543,7 @@ ixgb_xmit_frame(struct sk_buff *skb, struct net_device *netdev) - - tso = ixgb_tso(adapter, skb); - if (tso < 0) { -- dev_kfree_skb(skb); -+ dev_kfree_skb_any(skb); - return NETDEV_TX_OK; - } - -diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c -index 2f83f3489fdb..8be0f3e1e8e9 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c -+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c -@@ -2497,13 +2497,6 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port, - netif_carrier_off(dev); - mlx4_en_set_default_moderation(priv); - -- err = register_netdev(dev); -- if (err) { -- en_err(priv, "Netdev registration failed for port %d\n", port); -- goto out; -- } -- priv->registered = 1; -- - en_warn(priv, "Using %d TX rings\n", prof->tx_ring_num); - en_warn(priv, "Using %d RX rings\n", prof->rx_ring_num); - -@@ -2543,6 +2536,14 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port, - queue_delayed_work(mdev->workqueue, &priv->service_task, - SERVICE_TASK_DELAY); - -+ err = register_netdev(dev); -+ if (err) { -+ en_err(priv, "Netdev registration failed for port %d\n", port); -+ goto out; -+ } -+ -+ priv->registered = 1; -+ - return 0; - - out: -diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c -index 13457032d15f..019a04a31384 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c -+++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c -@@ -325,7 +325,7 @@ static u32 mlx4_en_free_tx_desc(struct mlx4_en_priv *priv, - } - } - } -- dev_kfree_skb(skb); -+ dev_kfree_skb_any(skb); - return tx_info->nr_txbb; - } - -diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c -index 737c1a881f78..a3c1daa7ad5c 100644 ---- a/drivers/net/ethernet/realtek/8139cp.c -+++ b/drivers/net/ethernet/realtek/8139cp.c -@@ -899,7 +899,7 @@ out_unlock: - - return NETDEV_TX_OK; - out_dma_error: -- kfree_skb(skb); -+ dev_kfree_skb_any(skb); - cp->dev->stats.tx_dropped++; - goto out_unlock; - } -diff --git a/drivers/net/ethernet/realtek/8139too.c b/drivers/net/ethernet/realtek/8139too.c -index da5972eefdd2..8cb2f357026e 100644 ---- a/drivers/net/ethernet/realtek/8139too.c -+++ b/drivers/net/ethernet/realtek/8139too.c -@@ -1717,9 +1717,9 @@ static netdev_tx_t rtl8139_start_xmit (struct sk_buff *skb, - if (len < ETH_ZLEN) - memset(tp->tx_buf[entry], 0, ETH_ZLEN); - skb_copy_and_csum_dev(skb, tp->tx_buf[entry]); -- dev_kfree_skb(skb); -+ dev_kfree_skb_any(skb); - } else { -- dev_kfree_skb(skb); -+ dev_kfree_skb_any(skb); - dev->stats.tx_dropped++; - return NETDEV_TX_OK; - } -diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c -index 3ff7bc3e7a23..90c14d16f261 100644 ---- a/drivers/net/ethernet/realtek/r8169.c -+++ b/drivers/net/ethernet/realtek/r8169.c -@@ -5834,7 +5834,7 @@ static void rtl8169_tx_clear_range(struct rtl8169_private *tp, u32 start, - tp->TxDescArray + entry); - if (skb) { - tp->dev->stats.tx_dropped++; -- dev_kfree_skb(skb); -+ dev_kfree_skb_any(skb); - tx_skb->skb = NULL; - } - } -@@ -6059,7 +6059,7 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb, - err_dma_1: - rtl8169_unmap_tx_skb(d, tp->tx_skb + entry, txd); - err_dma_0: -- dev_kfree_skb(skb); -+ dev_kfree_skb_any(skb); - err_update_stats: - dev->stats.tx_dropped++; - return NETDEV_TX_OK; -@@ -6142,7 +6142,7 @@ static void rtl_tx(struct net_device *dev, struct rtl8169_private *tp) - tp->tx_stats.packets++; - tp->tx_stats.bytes += tx_skb->skb->len; - u64_stats_update_end(&tp->tx_stats.syncp); -- dev_kfree_skb(tx_skb->skb); -+ dev_kfree_skb_any(tx_skb->skb); - tx_skb->skb = NULL; - } - dirty_tx++; -diff --git a/drivers/staging/lustre/lustre/llite/dcache.c b/drivers/staging/lustre/lustre/llite/dcache.c -index cbd663ed030c..19405ed56cab 100644 ---- a/drivers/staging/lustre/lustre/llite/dcache.c -+++ b/drivers/staging/lustre/lustre/llite/dcache.c -@@ -278,7 +278,7 @@ void ll_invalidate_aliases(struct inode *inode) - inode->i_ino, inode->i_generation, inode); - - ll_lock_dcache(inode); -- ll_d_hlist_for_each_entry(dentry, p, &inode->i_dentry, d_alias) { -+ ll_d_hlist_for_each_entry(dentry, p, &inode->i_dentry, d_u.d_alias) { - CDEBUG(D_DENTRY, "dentry in drop %.*s (%p) parent %p " - "inode %p flags %d\n", dentry->d_name.len, - dentry->d_name.name, dentry, dentry->d_parent, -diff --git a/drivers/staging/lustre/lustre/llite/llite_lib.c b/drivers/staging/lustre/lustre/llite/llite_lib.c -index 6cfdb9e4b74b..5ae562ea95f7 100644 ---- a/drivers/staging/lustre/lustre/llite/llite_lib.c -+++ b/drivers/staging/lustre/lustre/llite/llite_lib.c -@@ -678,7 +678,7 @@ void lustre_dump_dentry(struct dentry *dentry, int recur) - return; - - list_for_each(tmp, &dentry->d_subdirs) { -- struct dentry *d = list_entry(tmp, struct dentry, d_u.d_child); -+ struct dentry *d = list_entry(tmp, struct dentry, d_child); - lustre_dump_dentry(d, recur - 1); - } - } -diff --git a/drivers/staging/lustre/lustre/llite/namei.c b/drivers/staging/lustre/lustre/llite/namei.c -index fc8d264f6c9a..8e9a9e95b5cc 100644 ---- a/drivers/staging/lustre/lustre/llite/namei.c -+++ b/drivers/staging/lustre/lustre/llite/namei.c -@@ -175,14 +175,14 @@ static void ll_invalidate_negative_children(struct inode *dir) - struct ll_d_hlist_node *p; - - ll_lock_dcache(dir); -- ll_d_hlist_for_each_entry(dentry, p, &dir->i_dentry, d_alias) { -+ ll_d_hlist_for_each_entry(dentry, p, &dir->i_dentry, d_u.d_alias) { - spin_lock(&dentry->d_lock); - if (!list_empty(&dentry->d_subdirs)) { - struct dentry *child; - - list_for_each_entry_safe(child, tmp_subdir, - &dentry->d_subdirs, -- d_u.d_child) { -+ d_child) { - if (child->d_inode == NULL) - d_lustre_invalidate(child, 1); - } -@@ -364,7 +364,7 @@ static struct dentry *ll_find_alias(struct inode *inode, struct dentry *dentry) - discon_alias = invalid_alias = NULL; - - ll_lock_dcache(inode); -- ll_d_hlist_for_each_entry(alias, p, &inode->i_dentry, d_alias) { -+ ll_d_hlist_for_each_entry(alias, p, &inode->i_dentry, d_u.d_alias) { - LASSERT(alias != dentry); - - spin_lock(&alias->d_lock); -@@ -953,7 +953,7 @@ static void ll_get_child_fid(struct inode * dir, struct qstr *name, - { - struct dentry *parent, *child; - -- parent = ll_d_hlist_entry(dir->i_dentry, struct dentry, d_alias); -+ parent = ll_d_hlist_entry(dir->i_dentry, struct dentry, d_u.d_alias); - child = d_lookup(parent, name); - if (child) { - if (child->d_inode) -diff --git a/drivers/staging/lustre/lustre/llite/vvp_io.c b/drivers/staging/lustre/lustre/llite/vvp_io.c -index 93cbfbb7e7f7..6096771e2400 100644 ---- a/drivers/staging/lustre/lustre/llite/vvp_io.c -+++ b/drivers/staging/lustre/lustre/llite/vvp_io.c -@@ -642,7 +642,7 @@ static int vvp_io_kernel_fault(struct vvp_fault_io *cfio) - return 0; - } - -- if (cfio->fault.ft_flags & VM_FAULT_SIGBUS) { -+ if (cfio->fault.ft_flags & (VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV)) { - CDEBUG(D_PAGE, "got addr %p - SIGBUS\n", vmf->virtual_address); - return -EFAULT; - } -diff --git a/fs/affs/amigaffs.c b/fs/affs/amigaffs.c -index d9a43674cb94..9cca0ea4e479 100644 ---- a/fs/affs/amigaffs.c -+++ b/fs/affs/amigaffs.c -@@ -126,7 +126,7 @@ affs_fix_dcache(struct inode *inode, u32 entry_ino) - { - struct dentry *dentry; - spin_lock(&inode->i_lock); -- hlist_for_each_entry(dentry, &inode->i_dentry, d_alias) { -+ hlist_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) { - if (entry_ino == (u32)(long)dentry->d_fsdata) { - dentry->d_fsdata = (void *)inode->i_ino; - break; -diff --git a/fs/autofs4/expire.c b/fs/autofs4/expire.c -index 394e90b02c5e..edb46e67d5ca 100644 ---- a/fs/autofs4/expire.c -+++ b/fs/autofs4/expire.c -@@ -91,7 +91,7 @@ static struct dentry *get_next_positive_subdir(struct dentry *prev, - spin_lock(&root->d_lock); - - if (prev) -- next = prev->d_u.d_child.next; -+ next = prev->d_child.next; - else { - prev = dget_dlock(root); - next = prev->d_subdirs.next; -@@ -105,13 +105,13 @@ cont: - return NULL; - } - -- q = list_entry(next, struct dentry, d_u.d_child); -+ q = list_entry(next, struct dentry, d_child); - - spin_lock_nested(&q->d_lock, DENTRY_D_LOCK_NESTED); - /* Already gone or negative dentry (under construction) - try next */ - if (!d_count(q) || !simple_positive(q)) { - spin_unlock(&q->d_lock); -- next = q->d_u.d_child.next; -+ next = q->d_child.next; - goto cont; - } - dget_dlock(q); -@@ -161,13 +161,13 @@ again: - goto relock; - } - spin_unlock(&p->d_lock); -- next = p->d_u.d_child.next; -+ next = p->d_child.next; - p = parent; - if (next != &parent->d_subdirs) - break; - } - } -- ret = list_entry(next, struct dentry, d_u.d_child); -+ ret = list_entry(next, struct dentry, d_child); - - spin_lock_nested(&ret->d_lock, DENTRY_D_LOCK_NESTED); - /* Negative dentry - try next */ -@@ -461,7 +461,7 @@ found: - spin_lock(&sbi->lookup_lock); - spin_lock(&expired->d_parent->d_lock); - spin_lock_nested(&expired->d_lock, DENTRY_D_LOCK_NESTED); -- list_move(&expired->d_parent->d_subdirs, &expired->d_u.d_child); -+ list_move(&expired->d_parent->d_subdirs, &expired->d_child); - spin_unlock(&expired->d_lock); - spin_unlock(&expired->d_parent->d_lock); - spin_unlock(&sbi->lookup_lock); -diff --git a/fs/autofs4/root.c b/fs/autofs4/root.c -index cc87c1abac97..9e016e6fb582 100644 ---- a/fs/autofs4/root.c -+++ b/fs/autofs4/root.c -@@ -655,7 +655,7 @@ static void autofs_clear_leaf_automount_flags(struct dentry *dentry) - /* only consider parents below dentrys in the root */ - if (IS_ROOT(parent->d_parent)) - return; -- d_child = &dentry->d_u.d_child; -+ d_child = &dentry->d_child; - /* Set parent managed if it's becoming empty */ - if (d_child->next == &parent->d_subdirs && - d_child->prev == &parent->d_subdirs) -diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c -index 5e0982aa7000..18e14cf8f223 100644 ---- a/fs/ceph/dir.c -+++ b/fs/ceph/dir.c -@@ -111,7 +111,7 @@ static int fpos_cmp(loff_t l, loff_t r) - /* - * When possible, we try to satisfy a readdir by peeking at the - * dcache. We make this work by carefully ordering dentries on -- * d_u.d_child when we initially get results back from the MDS, and -+ * d_child when we initially get results back from the MDS, and - * falling back to a "normal" sync readdir if any dentries in the dir - * are dropped. - * -@@ -146,11 +146,11 @@ static int __dcache_readdir(struct file *file, struct dir_context *ctx) - p = parent->d_subdirs.prev; - dout(" initial p %p/%p\n", p->prev, p->next); - } else { -- p = last->d_u.d_child.prev; -+ p = last->d_child.prev; - } - - more: -- dentry = list_entry(p, struct dentry, d_u.d_child); -+ dentry = list_entry(p, struct dentry, d_child); - di = ceph_dentry(dentry); - while (1) { - dout(" p %p/%p %s d_subdirs %p/%p\n", p->prev, p->next, -@@ -172,7 +172,7 @@ more: - !dentry->d_inode ? " null" : ""); - spin_unlock(&dentry->d_lock); - p = p->prev; -- dentry = list_entry(p, struct dentry, d_u.d_child); -+ dentry = list_entry(p, struct dentry, d_child); - di = ceph_dentry(dentry); - } - -diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c -index 6471f9c83428..ee24490ee925 100644 ---- a/fs/ceph/inode.c -+++ b/fs/ceph/inode.c -@@ -1289,7 +1289,7 @@ retry_lookup: - /* reorder parent's d_subdirs */ - spin_lock(&parent->d_lock); - spin_lock_nested(&dn->d_lock, DENTRY_D_LOCK_NESTED); -- list_move(&dn->d_u.d_child, &parent->d_subdirs); -+ list_move(&dn->d_child, &parent->d_subdirs); - spin_unlock(&dn->d_lock); - spin_unlock(&parent->d_lock); - } -diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c -index f2ddcf7ac9c3..7ee427e16f3b 100644 ---- a/fs/cifs/inode.c -+++ b/fs/cifs/inode.c -@@ -883,7 +883,7 @@ inode_has_hashed_dentries(struct inode *inode) - struct dentry *dentry; - - spin_lock(&inode->i_lock); -- hlist_for_each_entry(dentry, &inode->i_dentry, d_alias) { -+ hlist_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) { - if (!d_unhashed(dentry) || IS_ROOT(dentry)) { - spin_unlock(&inode->i_lock); - return true; -diff --git a/fs/coda/cache.c b/fs/coda/cache.c -index 1da168c61d35..9bc1147a6c5d 100644 ---- a/fs/coda/cache.c -+++ b/fs/coda/cache.c -@@ -92,7 +92,7 @@ static void coda_flag_children(struct dentry *parent, int flag) - struct dentry *de; - - spin_lock(&parent->d_lock); -- list_for_each_entry(de, &parent->d_subdirs, d_u.d_child) { -+ list_for_each_entry(de, &parent->d_subdirs, d_child) { - /* don't know what to do with negative dentries */ - if (de->d_inode ) - coda_flag_inode(de->d_inode, flag); -diff --git a/fs/dcache.c b/fs/dcache.c -index 436612777203..c345f5f2b508 100644 ---- a/fs/dcache.c -+++ b/fs/dcache.c -@@ -44,7 +44,7 @@ - /* - * Usage: - * dcache->d_inode->i_lock protects: -- * - i_dentry, d_alias, d_inode of aliases -+ * - i_dentry, d_u.d_alias, d_inode of aliases - * dcache_hash_bucket lock protects: - * - the dcache hash table - * s_anon bl list spinlock protects: -@@ -59,7 +59,7 @@ - * - d_unhashed() - * - d_parent and d_subdirs - * - childrens' d_child and d_parent -- * - d_alias, d_inode -+ * - d_u.d_alias, d_inode - * - * Ordering: - * dentry->d_inode->i_lock -@@ -239,7 +239,6 @@ static void __d_free(struct rcu_head *head) - { - struct dentry *dentry = container_of(head, struct dentry, d_u.d_rcu); - -- WARN_ON(!hlist_unhashed(&dentry->d_alias)); - if (dname_external(dentry)) - kfree(dentry->d_name.name); - kmem_cache_free(dentry_cache, dentry); -@@ -250,6 +249,7 @@ static void __d_free(struct rcu_head *head) - */ - static void d_free(struct dentry *dentry) - { -+ WARN_ON(!hlist_unhashed(&dentry->d_u.d_alias)); - BUG_ON((int)dentry->d_lockref.count > 0); - this_cpu_dec(nr_dentry); - if (dentry->d_op && dentry->d_op->d_release) -@@ -288,7 +288,7 @@ static void dentry_iput(struct dentry * dentry) - struct inode *inode = dentry->d_inode; - if (inode) { - dentry->d_inode = NULL; -- hlist_del_init(&dentry->d_alias); -+ hlist_del_init(&dentry->d_u.d_alias); - spin_unlock(&dentry->d_lock); - spin_unlock(&inode->i_lock); - if (!inode->i_nlink) -@@ -313,7 +313,7 @@ static void dentry_unlink_inode(struct dentry * dentry) - struct inode *inode = dentry->d_inode; - __d_clear_type(dentry); - dentry->d_inode = NULL; -- hlist_del_init(&dentry->d_alias); -+ hlist_del_init(&dentry->d_u.d_alias); - dentry_rcuwalk_barrier(dentry); - spin_unlock(&dentry->d_lock); - spin_unlock(&inode->i_lock); -@@ -435,7 +435,7 @@ static struct dentry *d_kill(struct dentry *dentry, struct dentry *parent) - __releases(parent->d_lock) - __releases(dentry->d_inode->i_lock) - { -- list_del(&dentry->d_u.d_child); -+ list_del(&dentry->d_child); - /* - * Inform d_walk() that we are no longer attached to the - * dentry tree -@@ -737,7 +737,7 @@ static struct dentry *__d_find_alias(struct inode *inode, int want_discon) - - again: - discon_alias = NULL; -- hlist_for_each_entry(alias, &inode->i_dentry, d_alias) { -+ hlist_for_each_entry(alias, &inode->i_dentry, d_u.d_alias) { - spin_lock(&alias->d_lock); - if (S_ISDIR(inode->i_mode) || !d_unhashed(alias)) { - if (IS_ROOT(alias) && -@@ -790,7 +790,7 @@ void d_prune_aliases(struct inode *inode) - struct dentry *dentry; - restart: - spin_lock(&inode->i_lock); -- hlist_for_each_entry(dentry, &inode->i_dentry, d_alias) { -+ hlist_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) { - spin_lock(&dentry->d_lock); - if (!dentry->d_lockref.count) { - /* -@@ -1091,7 +1091,7 @@ repeat: - resume: - while (next != &this_parent->d_subdirs) { - struct list_head *tmp = next; -- struct dentry *dentry = list_entry(tmp, struct dentry, d_u.d_child); -+ struct dentry *dentry = list_entry(tmp, struct dentry, d_child); - next = tmp->next; - - spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED); -@@ -1143,7 +1143,7 @@ resume: - goto rename_retry; - } - rcu_read_unlock(); -- next = child->d_u.d_child.next; -+ next = child->d_child.next; - goto resume; - } - if (need_seqretry(&rename_lock, seq)) { -@@ -1524,8 +1524,8 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name) - INIT_HLIST_BL_NODE(&dentry->d_hash); - INIT_LIST_HEAD(&dentry->d_lru); - INIT_LIST_HEAD(&dentry->d_subdirs); -- INIT_HLIST_NODE(&dentry->d_alias); -- INIT_LIST_HEAD(&dentry->d_u.d_child); -+ INIT_HLIST_NODE(&dentry->d_u.d_alias); -+ INIT_LIST_HEAD(&dentry->d_child); - d_set_d_op(dentry, dentry->d_sb->s_d_op); - - this_cpu_inc(nr_dentry); -@@ -1555,7 +1555,7 @@ struct dentry *d_alloc(struct dentry * parent, const struct qstr *name) - */ - __dget_dlock(parent); - dentry->d_parent = parent; -- list_add(&dentry->d_u.d_child, &parent->d_subdirs); -+ list_add(&dentry->d_child, &parent->d_subdirs); - spin_unlock(&parent->d_lock); - - return dentry; -@@ -1648,7 +1648,7 @@ static void __d_instantiate(struct dentry *dentry, struct inode *inode) - spin_lock(&dentry->d_lock); - __d_set_type(dentry, add_flags); - if (inode) -- hlist_add_head(&dentry->d_alias, &inode->i_dentry); -+ hlist_add_head(&dentry->d_u.d_alias, &inode->i_dentry); - dentry->d_inode = inode; - dentry_rcuwalk_barrier(dentry); - spin_unlock(&dentry->d_lock); -@@ -1672,7 +1672,7 @@ static void __d_instantiate(struct dentry *dentry, struct inode *inode) - - void d_instantiate(struct dentry *entry, struct inode * inode) - { -- BUG_ON(!hlist_unhashed(&entry->d_alias)); -+ BUG_ON(!hlist_unhashed(&entry->d_u.d_alias)); - if (inode) - spin_lock(&inode->i_lock); - __d_instantiate(entry, inode); -@@ -1711,7 +1711,7 @@ static struct dentry *__d_instantiate_unique(struct dentry *entry, - return NULL; - } - -- hlist_for_each_entry(alias, &inode->i_dentry, d_alias) { -+ hlist_for_each_entry(alias, &inode->i_dentry, d_u.d_alias) { - /* - * Don't need alias->d_lock here, because aliases with - * d_parent == entry->d_parent are not subject to name or -@@ -1737,7 +1737,7 @@ struct dentry *d_instantiate_unique(struct dentry *entry, struct inode *inode) - { - struct dentry *result; - -- BUG_ON(!hlist_unhashed(&entry->d_alias)); -+ BUG_ON(!hlist_unhashed(&entry->d_u.d_alias)); - - if (inode) - spin_lock(&inode->i_lock); -@@ -1768,7 +1768,7 @@ EXPORT_SYMBOL(d_instantiate_unique); - */ - int d_instantiate_no_diralias(struct dentry *entry, struct inode *inode) - { -- BUG_ON(!hlist_unhashed(&entry->d_alias)); -+ BUG_ON(!hlist_unhashed(&entry->d_u.d_alias)); - - spin_lock(&inode->i_lock); - if (S_ISDIR(inode->i_mode) && !hlist_empty(&inode->i_dentry)) { -@@ -1807,7 +1807,7 @@ static struct dentry * __d_find_any_alias(struct inode *inode) - - if (hlist_empty(&inode->i_dentry)) - return NULL; -- alias = hlist_entry(inode->i_dentry.first, struct dentry, d_alias); -+ alias = hlist_entry(inode->i_dentry.first, struct dentry, d_u.d_alias); - __dget(alias); - return alias; - } -@@ -1884,7 +1884,7 @@ struct dentry *d_obtain_alias(struct inode *inode) - spin_lock(&tmp->d_lock); - tmp->d_inode = inode; - tmp->d_flags |= add_flags; -- hlist_add_head(&tmp->d_alias, &inode->i_dentry); -+ hlist_add_head(&tmp->d_u.d_alias, &inode->i_dentry); - hlist_bl_lock(&tmp->d_sb->s_anon); - hlist_bl_add_head(&tmp->d_hash, &tmp->d_sb->s_anon); - hlist_bl_unlock(&tmp->d_sb->s_anon); -@@ -2327,7 +2327,7 @@ int d_validate(struct dentry *dentry, struct dentry *dparent) - struct dentry *child; - - spin_lock(&dparent->d_lock); -- list_for_each_entry(child, &dparent->d_subdirs, d_u.d_child) { -+ list_for_each_entry(child, &dparent->d_subdirs, d_child) { - if (dentry == child) { - spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED); - __dget_dlock(dentry); -@@ -2574,8 +2574,8 @@ static void __d_move(struct dentry * dentry, struct dentry * target) - /* Unhash the target: dput() will then get rid of it */ - __d_drop(target); - -- list_del(&dentry->d_u.d_child); -- list_del(&target->d_u.d_child); -+ list_del(&dentry->d_child); -+ list_del(&target->d_child); - - /* Switch the names.. */ - switch_names(dentry, target); -@@ -2585,15 +2585,15 @@ static void __d_move(struct dentry * dentry, struct dentry * target) - if (IS_ROOT(dentry)) { - dentry->d_parent = target->d_parent; - target->d_parent = target; -- INIT_LIST_HEAD(&target->d_u.d_child); -+ INIT_LIST_HEAD(&target->d_child); - } else { - swap(dentry->d_parent, target->d_parent); - - /* And add them back to the (new) parent lists */ -- list_add(&target->d_u.d_child, &target->d_parent->d_subdirs); -+ list_add(&target->d_child, &target->d_parent->d_subdirs); - } - -- list_add(&dentry->d_u.d_child, &dentry->d_parent->d_subdirs); -+ list_add(&dentry->d_child, &dentry->d_parent->d_subdirs); - - write_seqcount_end(&target->d_seq); - write_seqcount_end(&dentry->d_seq); -@@ -2700,9 +2700,9 @@ static void __d_materialise_dentry(struct dentry *dentry, struct dentry *anon) - swap(dentry->d_name.hash, anon->d_name.hash); - - dentry->d_parent = dentry; -- list_del_init(&dentry->d_u.d_child); -+ list_del_init(&dentry->d_child); - anon->d_parent = dparent; -- list_move(&anon->d_u.d_child, &dparent->d_subdirs); -+ list_move(&anon->d_child, &dparent->d_subdirs); - - write_seqcount_end(&dentry->d_seq); - write_seqcount_end(&anon->d_seq); -@@ -3333,7 +3333,7 @@ void d_tmpfile(struct dentry *dentry, struct inode *inode) - { - inode_dec_link_count(inode); - BUG_ON(dentry->d_name.name != dentry->d_iname || -- !hlist_unhashed(&dentry->d_alias) || -+ !hlist_unhashed(&dentry->d_u.d_alias) || - !d_unlinked(dentry)); - spin_lock(&dentry->d_parent->d_lock); - spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED); -diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c -index 1ff8fe5dab0d..4a9f0e0c6644 100644 ---- a/fs/debugfs/inode.c -+++ b/fs/debugfs/inode.c -@@ -552,7 +552,7 @@ void debugfs_remove_recursive(struct dentry *dentry) - * use the d_u.d_child as the rcu head and corrupt this list. - */ - spin_lock(&parent->d_lock); -- list_for_each_entry(child, &parent->d_subdirs, d_u.d_child) { -+ list_for_each_entry(child, &parent->d_subdirs, d_child) { - if (!debugfs_positive(child)) - continue; - -diff --git a/fs/exportfs/expfs.c b/fs/exportfs/expfs.c -index 48a359dd286e..831d4f057e15 100644 ---- a/fs/exportfs/expfs.c -+++ b/fs/exportfs/expfs.c -@@ -50,7 +50,7 @@ find_acceptable_alias(struct dentry *result, - - inode = result->d_inode; - spin_lock(&inode->i_lock); -- hlist_for_each_entry(dentry, &inode->i_dentry, d_alias) { -+ hlist_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) { - dget(dentry); - spin_unlock(&inode->i_lock); - if (toput) -diff --git a/fs/libfs.c b/fs/libfs.c -index a1844244246f..868c0b70a30e 100644 ---- a/fs/libfs.c -+++ b/fs/libfs.c -@@ -113,18 +113,18 @@ loff_t dcache_dir_lseek(struct file *file, loff_t offset, int whence) - - spin_lock(&dentry->d_lock); - /* d_lock not required for cursor */ -- list_del(&cursor->d_u.d_child); -+ list_del(&cursor->d_child); - p = dentry->d_subdirs.next; - while (n && p != &dentry->d_subdirs) { - struct dentry *next; -- next = list_entry(p, struct dentry, d_u.d_child); -+ next = list_entry(p, struct dentry, d_child); - spin_lock_nested(&next->d_lock, DENTRY_D_LOCK_NESTED); - if (simple_positive(next)) - n--; - spin_unlock(&next->d_lock); - p = p->next; - } -- list_add_tail(&cursor->d_u.d_child, p); -+ list_add_tail(&cursor->d_child, p); - spin_unlock(&dentry->d_lock); - } - } -@@ -149,7 +149,7 @@ int dcache_readdir(struct file *file, struct dir_context *ctx) - { - struct dentry *dentry = file->f_path.dentry; - struct dentry *cursor = file->private_data; -- struct list_head *p, *q = &cursor->d_u.d_child; -+ struct list_head *p, *q = &cursor->d_child; - - if (!dir_emit_dots(file, ctx)) - return 0; -@@ -158,7 +158,7 @@ int dcache_readdir(struct file *file, struct dir_context *ctx) - list_move(q, &dentry->d_subdirs); - - for (p = q->next; p != &dentry->d_subdirs; p = p->next) { -- struct dentry *next = list_entry(p, struct dentry, d_u.d_child); -+ struct dentry *next = list_entry(p, struct dentry, d_child); - spin_lock_nested(&next->d_lock, DENTRY_D_LOCK_NESTED); - if (!simple_positive(next)) { - spin_unlock(&next->d_lock); -@@ -286,7 +286,7 @@ int simple_empty(struct dentry *dentry) - int ret = 0; - - spin_lock(&dentry->d_lock); -- list_for_each_entry(child, &dentry->d_subdirs, d_u.d_child) { -+ list_for_each_entry(child, &dentry->d_subdirs, d_child) { - spin_lock_nested(&child->d_lock, DENTRY_D_LOCK_NESTED); - if (simple_positive(child)) { - spin_unlock(&child->d_lock); -diff --git a/fs/ncpfs/dir.c b/fs/ncpfs/dir.c -index c320ac52353e..dc9747d6a4d0 100644 ---- a/fs/ncpfs/dir.c -+++ b/fs/ncpfs/dir.c -@@ -406,7 +406,7 @@ ncp_dget_fpos(struct dentry *dentry, struct dentry *parent, unsigned long fpos) - spin_lock(&parent->d_lock); - next = parent->d_subdirs.next; - while (next != &parent->d_subdirs) { -- dent = list_entry(next, struct dentry, d_u.d_child); -+ dent = list_entry(next, struct dentry, d_child); - if ((unsigned long)dent->d_fsdata == fpos) { - if (dent->d_inode) - dget(dent); -diff --git a/fs/ncpfs/ncplib_kernel.h b/fs/ncpfs/ncplib_kernel.h -index 32c06587351a..6d5e7c56c79d 100644 ---- a/fs/ncpfs/ncplib_kernel.h -+++ b/fs/ncpfs/ncplib_kernel.h -@@ -194,7 +194,7 @@ ncp_renew_dentries(struct dentry *parent) - spin_lock(&parent->d_lock); - next = parent->d_subdirs.next; - while (next != &parent->d_subdirs) { -- dentry = list_entry(next, struct dentry, d_u.d_child); -+ dentry = list_entry(next, struct dentry, d_child); - - if (dentry->d_fsdata == NULL) - ncp_age_dentry(server, dentry); -@@ -216,7 +216,7 @@ ncp_invalidate_dircache_entries(struct dentry *parent) - spin_lock(&parent->d_lock); - next = parent->d_subdirs.next; - while (next != &parent->d_subdirs) { -- dentry = list_entry(next, struct dentry, d_u.d_child); -+ dentry = list_entry(next, struct dentry, d_child); - dentry->d_fsdata = NULL; - ncp_age_dentry(server, dentry); - next = next->next; -diff --git a/fs/nfs/getroot.c b/fs/nfs/getroot.c -index 66984a9aafaa..5b8ab0e444f9 100644 ---- a/fs/nfs/getroot.c -+++ b/fs/nfs/getroot.c -@@ -58,7 +58,7 @@ static int nfs_superblock_set_dummy_root(struct super_block *sb, struct inode *i - */ - spin_lock(&sb->s_root->d_inode->i_lock); - spin_lock(&sb->s_root->d_lock); -- hlist_del_init(&sb->s_root->d_alias); -+ hlist_del_init(&sb->s_root->d_u.d_alias); - spin_unlock(&sb->s_root->d_lock); - spin_unlock(&sb->s_root->d_inode->i_lock); - } -diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c -index 9d3e9c50066a..700129940c6e 100644 ---- a/fs/notify/fsnotify.c -+++ b/fs/notify/fsnotify.c -@@ -63,14 +63,14 @@ void __fsnotify_update_child_dentry_flags(struct inode *inode) - spin_lock(&inode->i_lock); - /* run all of the dentries associated with this inode. Since this is a - * directory, there damn well better only be one item on this list */ -- hlist_for_each_entry(alias, &inode->i_dentry, d_alias) { -+ hlist_for_each_entry(alias, &inode->i_dentry, d_u.d_alias) { - struct dentry *child; - - /* run all of the children of the original inode and fix their - * d_flags to indicate parental interest (their parent is the - * original inode) */ - spin_lock(&alias->d_lock); -- list_for_each_entry(child, &alias->d_subdirs, d_u.d_child) { -+ list_for_each_entry(child, &alias->d_subdirs, d_child) { - if (!child->d_inode) - continue; - -diff --git a/fs/ocfs2/dcache.c b/fs/ocfs2/dcache.c -index 0d3a97d2d5f6..116748502bae 100644 ---- a/fs/ocfs2/dcache.c -+++ b/fs/ocfs2/dcache.c -@@ -173,7 +173,7 @@ struct dentry *ocfs2_find_local_alias(struct inode *inode, - struct dentry *dentry; - - spin_lock(&inode->i_lock); -- hlist_for_each_entry(dentry, &inode->i_dentry, d_alias) { -+ hlist_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) { - spin_lock(&dentry->d_lock); - if (ocfs2_match_dentry(dentry, parent_blkno, skip_unhashed)) { - trace_ocfs2_find_local_alias(dentry->d_name.len, -diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c -index c2546717fc2b..eaa7374305a3 100644 ---- a/fs/proc/task_mmu.c -+++ b/fs/proc/task_mmu.c -@@ -993,9 +993,8 @@ static int pagemap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end, - struct vm_area_struct *vma; - struct pagemapread *pm = walk->private; - spinlock_t *ptl; -- pte_t *pte; -+ pte_t *pte, *orig_pte; - int err = 0; -- pagemap_entry_t pme = make_pme(PM_NOT_PRESENT(pm->v2)); - - /* find the first VMA at or above 'addr' */ - vma = find_vma(walk->mm, addr); -@@ -1009,6 +1008,7 @@ static int pagemap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end, - - for (; addr != end; addr += PAGE_SIZE) { - unsigned long offset; -+ pagemap_entry_t pme; - - offset = (addr & ~PAGEMAP_WALK_MASK) >> - PAGE_SHIFT; -@@ -1023,32 +1023,55 @@ static int pagemap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end, - - if (pmd_trans_unstable(pmd)) - return 0; -- for (; addr != end; addr += PAGE_SIZE) { -- int flags2; -- -- /* check to see if we've left 'vma' behind -- * and need a new, higher one */ -- if (vma && (addr >= vma->vm_end)) { -- vma = find_vma(walk->mm, addr); -- if (vma && (vma->vm_flags & VM_SOFTDIRTY)) -- flags2 = __PM_SOFT_DIRTY; -- else -- flags2 = 0; -- pme = make_pme(PM_NOT_PRESENT(pm->v2) | PM_STATUS2(pm->v2, flags2)); -+ -+ while (1) { -+ /* End of address space hole, which we mark as non-present. */ -+ unsigned long hole_end; -+ -+ if (vma) -+ hole_end = min(end, vma->vm_start); -+ else -+ hole_end = end; -+ -+ for (; addr < hole_end; addr += PAGE_SIZE) { -+ pagemap_entry_t pme = make_pme(PM_NOT_PRESENT(pm->v2)); -+ -+ err = add_to_pagemap(addr, &pme, pm); -+ if (err) -+ return err; - } - -- /* check that 'vma' actually covers this address, -- * and that it isn't a huge page vma */ -- if (vma && (vma->vm_start <= addr) && -- !is_vm_hugetlb_page(vma)) { -- pte = pte_offset_map(pmd, addr); -+ if (!vma || vma->vm_start >= end) -+ break; -+ /* -+ * We can't possibly be in a hugetlb VMA. In general, -+ * for a mm_walk with a pmd_entry and a hugetlb_entry, -+ * the pmd_entry can only be called on addresses in a -+ * hugetlb if the walk starts in a non-hugetlb VMA and -+ * spans a hugepage VMA. Since pagemap_read walks are -+ * PMD-sized and PMD-aligned, this will never be true. -+ */ -+ BUG_ON(is_vm_hugetlb_page(vma)); -+ -+ /* Addresses in the VMA. */ -+ orig_pte = pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl); -+ for (; addr < min(end, vma->vm_end); pte++, addr += PAGE_SIZE) { -+ pagemap_entry_t pme; -+ - pte_to_pagemap_entry(&pme, pm, vma, addr, *pte); -- /* unmap before userspace copy */ -- pte_unmap(pte); -+ err = add_to_pagemap(addr, &pme, pm); -+ if (err) -+ break; - } -- err = add_to_pagemap(addr, &pme, pm); -+ pte_unmap_unlock(orig_pte, ptl); -+ - if (err) - return err; -+ -+ if (addr == end) -+ break; -+ -+ vma = find_vma(walk->mm, addr); - } - - cond_resched(); -diff --git a/include/linux/dcache.h b/include/linux/dcache.h -index 3b50cac7ccb3..0f0eb1c1e676 100644 ---- a/include/linux/dcache.h -+++ b/include/linux/dcache.h -@@ -124,15 +124,15 @@ struct dentry { - void *d_fsdata; /* fs-specific data */ - - struct list_head d_lru; /* LRU list */ -+ struct list_head d_child; /* child of parent list */ -+ struct list_head d_subdirs; /* our children */ - /* -- * d_child and d_rcu can share memory -+ * d_alias and d_rcu can share memory - */ - union { -- struct list_head d_child; /* child of parent list */ -+ struct hlist_node d_alias; /* inode alias list */ - struct rcu_head d_rcu; - } d_u; -- struct list_head d_subdirs; /* our children */ -- struct hlist_node d_alias; /* inode alias list */ - }; - - /* -diff --git a/include/linux/mm.h b/include/linux/mm.h -index 46b8ab56b9db..a7b311dfa742 100644 ---- a/include/linux/mm.h -+++ b/include/linux/mm.h -@@ -1009,6 +1009,7 @@ static inline int page_mapped(struct page *page) - #define VM_FAULT_WRITE 0x0008 /* Special case for get_user_pages */ - #define VM_FAULT_HWPOISON 0x0010 /* Hit poisoned small page */ - #define VM_FAULT_HWPOISON_LARGE 0x0020 /* Hit poisoned large page. Index encoded in upper bits */ -+#define VM_FAULT_SIGSEGV 0x0040 - - #define VM_FAULT_NOPAGE 0x0100 /* ->fault installed the pte, not return page */ - #define VM_FAULT_LOCKED 0x0200 /* ->fault locked the returned page */ -@@ -1017,8 +1018,9 @@ static inline int page_mapped(struct page *page) - - #define VM_FAULT_HWPOISON_LARGE_MASK 0xf000 /* encodes hpage index for large hwpoison */ - --#define VM_FAULT_ERROR (VM_FAULT_OOM | VM_FAULT_SIGBUS | VM_FAULT_HWPOISON | \ -- VM_FAULT_FALLBACK | VM_FAULT_HWPOISON_LARGE) -+#define VM_FAULT_ERROR (VM_FAULT_OOM | VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV | \ -+ VM_FAULT_HWPOISON | VM_FAULT_HWPOISON_LARGE | \ -+ VM_FAULT_FALLBACK) - - /* Encode hstate index for a hwpoisoned large page */ - #define VM_FAULT_SET_HINDEX(x) ((x) << 12) -diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h -index 911718fa92ed..bf46cc813451 100644 ---- a/include/linux/netdevice.h -+++ b/include/linux/netdevice.h -@@ -1880,6 +1880,12 @@ void netdev_freemem(struct net_device *dev); - void synchronize_net(void); - int init_dummy_netdev(struct net_device *dev); - -+DECLARE_PER_CPU(int, xmit_recursion); -+static inline int dev_recursion_level(void) -+{ -+ return this_cpu_read(xmit_recursion); -+} -+ - struct net_device *dev_get_by_index(struct net *net, int ifindex); - struct net_device *__dev_get_by_index(struct net *net, int ifindex); - struct net_device *dev_get_by_index_rcu(struct net *net, int ifindex); -diff --git a/include/linux/sched.h b/include/linux/sched.h -index 218b058060f1..91fe6a38b307 100644 ---- a/include/linux/sched.h -+++ b/include/linux/sched.h -@@ -1695,7 +1695,7 @@ static inline pid_t task_tgid_vnr(struct task_struct *tsk) - } - - --static int pid_alive(const struct task_struct *p); -+static inline int pid_alive(const struct task_struct *p); - static inline pid_t task_ppid_nr_ns(const struct task_struct *tsk, struct pid_namespace *ns) - { - pid_t pid = 0; -diff --git a/include/net/ip.h b/include/net/ip.h -index 3446cdd29608..5128fa7a8302 100644 ---- a/include/net/ip.h -+++ b/include/net/ip.h -@@ -407,22 +407,6 @@ static __inline__ void inet_reset_saddr(struct sock *sk) - - #endif - --static inline int sk_mc_loop(struct sock *sk) --{ -- if (!sk) -- return 1; -- switch (sk->sk_family) { -- case AF_INET: -- return inet_sk(sk)->mc_loop; --#if IS_ENABLED(CONFIG_IPV6) -- case AF_INET6: -- return inet6_sk(sk)->mc_loop; --#endif -- } -- WARN_ON(1); -- return 1; --} -- - bool ip_call_ra_chain(struct sk_buff *skb); - - /* -diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h -index 2e74c6cfa612..ee2d53ae62fe 100644 ---- a/include/net/ip6_route.h -+++ b/include/net/ip6_route.h -@@ -168,7 +168,8 @@ int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *)); - - static inline int ip6_skb_dst_mtu(struct sk_buff *skb) - { -- struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL; -+ struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ? -+ inet6_sk(skb->sk) : NULL; - - return (np && np->pmtudisc >= IPV6_PMTUDISC_PROBE) ? - skb_dst(skb)->dev->mtu : dst_mtu(skb_dst(skb)); -diff --git a/include/net/sock.h b/include/net/sock.h -index f66b2b19a6e4..0c79a740e97d 100644 ---- a/include/net/sock.h -+++ b/include/net/sock.h -@@ -1815,6 +1815,8 @@ struct dst_entry *__sk_dst_check(struct sock *sk, u32 cookie); - - struct dst_entry *sk_dst_check(struct sock *sk, u32 cookie); - -+bool sk_mc_loop(struct sock *sk); -+ - static inline bool sk_can_gso(const struct sock *sk) - { - return net_gso_ok(sk->sk_route_caps, sk->sk_gso_type); -diff --git a/kernel/cgroup.c b/kernel/cgroup.c -index 550e2050d778..18711f326260 100644 ---- a/kernel/cgroup.c -+++ b/kernel/cgroup.c -@@ -971,7 +971,7 @@ static void cgroup_d_remove_dir(struct dentry *dentry) - parent = dentry->d_parent; - spin_lock(&parent->d_lock); - spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED); -- list_del_init(&dentry->d_u.d_child); -+ list_del_init(&dentry->d_child); - spin_unlock(&dentry->d_lock); - spin_unlock(&parent->d_lock); - remove_dir(dentry); -diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index 813b021379f5..a2d62b3b90c7 100644 ---- a/kernel/trace/trace.c -+++ b/kernel/trace/trace.c -@@ -6158,7 +6158,7 @@ static int instance_mkdir (struct inode *inode, struct dentry *dentry, umode_t m - int ret; - - /* Paranoid: Make sure the parent is the "instances" directory */ -- parent = hlist_entry(inode->i_dentry.first, struct dentry, d_alias); -+ parent = hlist_entry(inode->i_dentry.first, struct dentry, d_u.d_alias); - if (WARN_ON_ONCE(parent != trace_instance_dir)) - return -ENOENT; - -@@ -6185,7 +6185,7 @@ static int instance_rmdir(struct inode *inode, struct dentry *dentry) - int ret; - - /* Paranoid: Make sure the parent is the "instances" directory */ -- parent = hlist_entry(inode->i_dentry.first, struct dentry, d_alias); -+ parent = hlist_entry(inode->i_dentry.first, struct dentry, d_u.d_alias); - if (WARN_ON_ONCE(parent != trace_instance_dir)) - return -ENOENT; - -diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c -index e4c4efc4ba0d..c6646a58d23e 100644 ---- a/kernel/trace/trace_events.c -+++ b/kernel/trace/trace_events.c -@@ -428,7 +428,7 @@ static void remove_event_file_dir(struct ftrace_event_file *file) - - if (dir) { - spin_lock(&dir->d_lock); /* probably unneeded */ -- list_for_each_entry(child, &dir->d_subdirs, d_u.d_child) { -+ list_for_each_entry(child, &dir->d_subdirs, d_child) { - if (child->d_inode) /* probably unneeded */ - child->d_inode->i_private = NULL; - } -diff --git a/mm/ksm.c b/mm/ksm.c -index 68710e80994a..5e706e391a02 100644 ---- a/mm/ksm.c -+++ b/mm/ksm.c -@@ -376,7 +376,7 @@ static int break_ksm(struct vm_area_struct *vma, unsigned long addr) - else - ret = VM_FAULT_WRITE; - put_page(page); -- } while (!(ret & (VM_FAULT_WRITE | VM_FAULT_SIGBUS | VM_FAULT_OOM))); -+ } while (!(ret & (VM_FAULT_WRITE | VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV | VM_FAULT_OOM))); - /* - * We must loop because handle_mm_fault() may back out if there's - * any difficulty e.g. if pte accessed bit gets updated concurrently. -diff --git a/mm/memory-failure.c b/mm/memory-failure.c -index a98c7fce470a..ffc7bf0458fb 100644 ---- a/mm/memory-failure.c -+++ b/mm/memory-failure.c -@@ -1645,8 +1645,6 @@ static int __soft_offline_page(struct page *page, int flags) - * setting PG_hwpoison. - */ - if (!is_free_buddy_page(page)) -- lru_add_drain_all(); -- if (!is_free_buddy_page(page)) - drain_all_pages(); - SetPageHWPoison(page); - if (!is_free_buddy_page(page)) -diff --git a/mm/memory.c b/mm/memory.c -index 102af096cbc5..749e1c68d490 100644 ---- a/mm/memory.c -+++ b/mm/memory.c -@@ -1836,7 +1836,8 @@ long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm, - else - return -EFAULT; - } -- if (ret & VM_FAULT_SIGBUS) -+ if (ret & (VM_FAULT_SIGBUS | -+ VM_FAULT_SIGSEGV)) - return i ? i : -EFAULT; - BUG(); - } -@@ -1946,7 +1947,7 @@ int fixup_user_fault(struct task_struct *tsk, struct mm_struct *mm, - return -ENOMEM; - if (ret & (VM_FAULT_HWPOISON | VM_FAULT_HWPOISON_LARGE)) - return -EHWPOISON; -- if (ret & VM_FAULT_SIGBUS) -+ if (ret & (VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV)) - return -EFAULT; - BUG(); - } -@@ -3235,7 +3236,7 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma, - - /* Check if we need to add a guard page to the stack */ - if (check_stack_guard_page(vma, address) < 0) -- return VM_FAULT_SIGBUS; -+ return VM_FAULT_SIGSEGV; - - /* Use the zero-page for reads */ - if (!(flags & FAULT_FLAG_WRITE)) { -diff --git a/net/core/dev.c b/net/core/dev.c -index f6d8d7fe29ab..73abbd77d72c 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -2775,7 +2775,9 @@ static void skb_update_prio(struct sk_buff *skb) - #define skb_update_prio(skb) - #endif - --static DEFINE_PER_CPU(int, xmit_recursion); -+DEFINE_PER_CPU(int, xmit_recursion); -+EXPORT_SYMBOL(xmit_recursion); -+ - #define RECURSION_LIMIT 10 - - /** -diff --git a/net/core/sock.c b/net/core/sock.c -index c8069561bdb7..650dd58ebd05 100644 ---- a/net/core/sock.c -+++ b/net/core/sock.c -@@ -659,6 +659,25 @@ static inline void sock_valbool_flag(struct sock *sk, int bit, int valbool) - sock_reset_flag(sk, bit); - } - -+bool sk_mc_loop(struct sock *sk) -+{ -+ if (dev_recursion_level()) -+ return false; -+ if (!sk) -+ return true; -+ switch (sk->sk_family) { -+ case AF_INET: -+ return inet_sk(sk)->mc_loop; -+#if IS_ENABLED(CONFIG_IPV6) -+ case AF_INET6: -+ return inet6_sk(sk)->mc_loop; -+#endif -+ } -+ WARN_ON(1); -+ return true; -+} -+EXPORT_SYMBOL(sk_mc_loop); -+ - /* - * This is meant for all protocols to use and covers goings on - * at the socket level. Everything here is generic. -diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c -index 22917918fa80..9fbd69efa999 100644 ---- a/net/ipv4/tcp_input.c -+++ b/net/ipv4/tcp_input.c -@@ -3064,10 +3064,11 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets, - if (seq_rtt < 0) { - seq_rtt = ca_seq_rtt; - } -- if (!(sacked & TCPCB_SACKED_ACKED)) -+ if (!(sacked & TCPCB_SACKED_ACKED)) { - reord = min(pkts_acked, reord); -- if (!after(scb->end_seq, tp->high_seq)) -- flag |= FLAG_ORIG_SACK_ACKED; -+ if (!after(scb->end_seq, tp->high_seq)) -+ flag |= FLAG_ORIG_SACK_ACKED; -+ } - } - - if (sacked & TCPCB_SACKED_ACKED) -diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c -index b7effad5a58c..e2f8bd0d35ed 100644 ---- a/net/ipv4/tcp_ipv4.c -+++ b/net/ipv4/tcp_ipv4.c -@@ -1875,7 +1875,7 @@ void tcp_v4_early_demux(struct sk_buff *skb) - skb->sk = sk; - skb->destructor = sock_edemux; - if (sk->sk_state != TCP_TIME_WAIT) { -- struct dst_entry *dst = sk->sk_rx_dst; -+ struct dst_entry *dst = ACCESS_ONCE(sk->sk_rx_dst); - - if (dst) - dst = dst_check(dst, 0); -diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c -index 96f64e59d70c..8c70c73da347 100644 ---- a/net/ipv4/tcp_output.c -+++ b/net/ipv4/tcp_output.c -@@ -2796,6 +2796,8 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst, - } - #endif - -+ /* Do not fool tcpdump (if any), clean our debris */ -+ skb->tstamp.tv64 = 0; - return skb; - } - EXPORT_SYMBOL(tcp_make_synack); -diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c -index d7907ecf0b75..066d0b03f2b8 100644 ---- a/net/ipv6/ip6_output.c -+++ b/net/ipv6/ip6_output.c -@@ -555,7 +555,8 @@ int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *)) - { - struct sk_buff *frag; - struct rt6_info *rt = (struct rt6_info*)skb_dst(skb); -- struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL; -+ struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ? -+ inet6_sk(skb->sk) : NULL; - struct ipv6hdr *tmp_hdr; - struct frag_hdr *fh; - unsigned int mtu, hlen, left, len; -diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c -index 09a22f4f36c9..bcd65186b497 100644 ---- a/net/ipv6/ndisc.c -+++ b/net/ipv6/ndisc.c -@@ -1193,7 +1193,14 @@ static void ndisc_router_discovery(struct sk_buff *skb) - if (rt) - rt6_set_expires(rt, jiffies + (HZ * lifetime)); - if (ra_msg->icmph.icmp6_hop_limit) { -- in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit; -+ /* Only set hop_limit on the interface if it is higher than -+ * the current hop_limit. -+ */ -+ if (in6_dev->cnf.hop_limit < ra_msg->icmph.icmp6_hop_limit) { -+ in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit; -+ } else { -+ ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than current\n"); -+ } - if (rt) - dst_metric_set(&rt->dst, RTAX_HOPLIMIT, - ra_msg->icmph.icmp6_hop_limit); -diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c -index a4f890dd223a..9d4332dba8ea 100644 ---- a/net/ipv6/tcp_ipv6.c -+++ b/net/ipv6/tcp_ipv6.c -@@ -1633,7 +1633,7 @@ static void tcp_v6_early_demux(struct sk_buff *skb) - skb->sk = sk; - skb->destructor = sock_edemux; - if (sk->sk_state != TCP_TIME_WAIT) { -- struct dst_entry *dst = sk->sk_rx_dst; -+ struct dst_entry *dst = ACCESS_ONCE(sk->sk_rx_dst); - - if (dst) - dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie); -diff --git a/net/netfilter/nf_conntrack_proto_generic.c b/net/netfilter/nf_conntrack_proto_generic.c -index d25f29377648..957c1db66652 100644 ---- a/net/netfilter/nf_conntrack_proto_generic.c -+++ b/net/netfilter/nf_conntrack_proto_generic.c -@@ -14,6 +14,30 @@ - - static unsigned int nf_ct_generic_timeout __read_mostly = 600*HZ; - -+static bool nf_generic_should_process(u8 proto) -+{ -+ switch (proto) { -+#ifdef CONFIG_NF_CT_PROTO_SCTP_MODULE -+ case IPPROTO_SCTP: -+ return false; -+#endif -+#ifdef CONFIG_NF_CT_PROTO_DCCP_MODULE -+ case IPPROTO_DCCP: -+ return false; -+#endif -+#ifdef CONFIG_NF_CT_PROTO_GRE_MODULE -+ case IPPROTO_GRE: -+ return false; -+#endif -+#ifdef CONFIG_NF_CT_PROTO_UDPLITE_MODULE -+ case IPPROTO_UDPLITE: -+ return false; -+#endif -+ default: -+ return true; -+ } -+} -+ - static inline struct nf_generic_net *generic_pernet(struct net *net) - { - return &net->ct.nf_ct_proto.generic; -@@ -67,7 +91,7 @@ static int generic_packet(struct nf_conn *ct, - static bool generic_new(struct nf_conn *ct, const struct sk_buff *skb, - unsigned int dataoff, unsigned int *timeouts) - { -- return true; -+ return nf_generic_should_process(nf_ct_protonum(ct)); - } - - #if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT) -diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c -index 6c4cbd97a673..fc68bf6e4889 100644 ---- a/security/selinux/selinuxfs.c -+++ b/security/selinux/selinuxfs.c -@@ -1200,7 +1200,7 @@ static void sel_remove_entries(struct dentry *de) - spin_lock(&de->d_lock); - node = de->d_subdirs.next; - while (node != &de->d_subdirs) { -- struct dentry *d = list_entry(node, struct dentry, d_u.d_child); -+ struct dentry *d = list_entry(node, struct dentry, d_child); - - spin_lock_nested(&d->d_lock, DENTRY_D_LOCK_NESTED); - list_del_init(node); -@@ -1674,12 +1674,12 @@ static void sel_remove_classes(void) - - list_for_each(class_node, &class_dir->d_subdirs) { - struct dentry *class_subdir = list_entry(class_node, -- struct dentry, d_u.d_child); -+ struct dentry, d_child); - struct list_head *class_subdir_node; - - list_for_each(class_subdir_node, &class_subdir->d_subdirs) { - struct dentry *d = list_entry(class_subdir_node, -- struct dentry, d_u.d_child); -+ struct dentry, d_child); - - if (d->d_inode) - if (d->d_inode->i_mode & S_IFDIR) diff --git a/patch/kernel/odroidc2-default/patch-3.14.40-41.patch b/patch/kernel/odroidc2-default/patch-3.14.40-41.patch deleted file mode 100644 index 1cbd400b1d..0000000000 --- a/patch/kernel/odroidc2-default/patch-3.14.40-41.patch +++ /dev/null @@ -1,3477 +0,0 @@ -diff --git a/Makefile b/Makefile -index 070e0ebb9231..7a60d4a1301c 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 3 - PATCHLEVEL = 14 --SUBLEVEL = 40 -+SUBLEVEL = 41 - EXTRAVERSION = - NAME = Remembering Coco - -diff --git a/arch/arm/boot/dts/dove.dtsi b/arch/arm/boot/dts/dove.dtsi -index 187fd46b7b5e..355117cbbf4a 100644 ---- a/arch/arm/boot/dts/dove.dtsi -+++ b/arch/arm/boot/dts/dove.dtsi -@@ -154,7 +154,7 @@ - - uart2: serial@12200 { - compatible = "ns16550a"; -- reg = <0x12000 0x100>; -+ reg = <0x12200 0x100>; - reg-shift = <2>; - interrupts = <9>; - clocks = <&core_clk 0>; -@@ -163,7 +163,7 @@ - - uart3: serial@12300 { - compatible = "ns16550a"; -- reg = <0x12100 0x100>; -+ reg = <0x12300 0x100>; - reg-shift = <2>; - interrupts = <10>; - clocks = <&core_clk 0>; -diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h -index f4b46d39b9cf..051b7269e639 100644 ---- a/arch/arm/include/asm/elf.h -+++ b/arch/arm/include/asm/elf.h -@@ -114,7 +114,7 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs); - the loader. We need to make sure that it is out of the way of the program - that it will "exec", and that there is sufficient room for the brk. */ - --#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3) -+#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2) - - /* When the program starts, a1 contains a pointer to a function to be - registered with atexit, as per the SVR4 ABI. A value of 0 means we -diff --git a/arch/arm/mach-s3c64xx/crag6410.h b/arch/arm/mach-s3c64xx/crag6410.h -index 7bc66682687e..dcbe17f5e5f8 100644 ---- a/arch/arm/mach-s3c64xx/crag6410.h -+++ b/arch/arm/mach-s3c64xx/crag6410.h -@@ -14,6 +14,7 @@ - #include - - #define GLENFARCLAS_PMIC_IRQ_BASE IRQ_BOARD_START -+#define BANFF_PMIC_IRQ_BASE (IRQ_BOARD_START + 64) - - #define PCA935X_GPIO_BASE GPIO_BOARD_START - #define CODEC_GPIO_BASE (GPIO_BOARD_START + 8) -diff --git a/arch/arm/mach-s3c64xx/mach-crag6410.c b/arch/arm/mach-s3c64xx/mach-crag6410.c -index 3df3c372ee1f..66b95c466497 100644 ---- a/arch/arm/mach-s3c64xx/mach-crag6410.c -+++ b/arch/arm/mach-s3c64xx/mach-crag6410.c -@@ -555,6 +555,7 @@ static struct wm831x_touch_pdata touch_pdata = { - - static struct wm831x_pdata crag_pmic_pdata = { - .wm831x_num = 1, -+ .irq_base = BANFF_PMIC_IRQ_BASE, - .gpio_base = BANFF_PMIC_GPIO_BASE, - .soft_shutdown = true, - -diff --git a/arch/arm64/kernel/vdso/Makefile b/arch/arm64/kernel/vdso/Makefile -index 6d20b7d162d8..a268a9af0c2d 100644 ---- a/arch/arm64/kernel/vdso/Makefile -+++ b/arch/arm64/kernel/vdso/Makefile -@@ -43,7 +43,7 @@ $(obj)/vdso-offsets.h: $(obj)/vdso.so.dbg FORCE - $(call if_changed,vdsosym) - - # Assembly rules for the .S files --$(obj-vdso): %.o: %.S -+$(obj-vdso): %.o: %.S FORCE - $(call if_changed_dep,vdsoas) - - # Actual build commands -diff --git a/arch/c6x/kernel/time.c b/arch/c6x/kernel/time.c -index 356ee84cad95..04845aaf5985 100644 ---- a/arch/c6x/kernel/time.c -+++ b/arch/c6x/kernel/time.c -@@ -49,7 +49,7 @@ u64 sched_clock(void) - return (tsc * sched_clock_multiplier) >> SCHED_CLOCK_SHIFT; - } - --void time_init(void) -+void __init time_init(void) - { - u64 tmp = (u64)NSEC_PER_SEC << SCHED_CLOCK_SHIFT; - -diff --git a/arch/mips/include/asm/suspend.h b/arch/mips/include/asm/suspend.h -deleted file mode 100644 -index 3adac3b53d19..000000000000 ---- a/arch/mips/include/asm/suspend.h -+++ /dev/null -@@ -1,7 +0,0 @@ --#ifndef __ASM_SUSPEND_H --#define __ASM_SUSPEND_H -- --/* References to section boundaries */ --extern const void __nosave_begin, __nosave_end; -- --#endif /* __ASM_SUSPEND_H */ -diff --git a/arch/mips/power/cpu.c b/arch/mips/power/cpu.c -index 521e5963df05..2129e67723ff 100644 ---- a/arch/mips/power/cpu.c -+++ b/arch/mips/power/cpu.c -@@ -7,7 +7,7 @@ - * Author: Hu Hongbing - * Wu Zhangjin - */ --#include -+#include - #include - #include - -diff --git a/arch/mips/power/hibernate.S b/arch/mips/power/hibernate.S -index 32a7c828f073..e7567c8a9e79 100644 ---- a/arch/mips/power/hibernate.S -+++ b/arch/mips/power/hibernate.S -@@ -30,6 +30,8 @@ LEAF(swsusp_arch_suspend) - END(swsusp_arch_suspend) - - LEAF(swsusp_arch_resume) -+ /* Avoid TLB mismatch during and after kernel resume */ -+ jal local_flush_tlb_all - PTR_L t0, restore_pblist - 0: - PTR_L t1, PBE_ADDRESS(t0) /* source */ -@@ -43,7 +45,6 @@ LEAF(swsusp_arch_resume) - bne t1, t3, 1b - PTR_L t0, PBE_NEXT(t0) - bnez t0, 0b -- jal local_flush_tlb_all /* Avoid TLB mismatch after kernel resume */ - PTR_LA t0, saved_regs - PTR_L ra, PT_R31(t0) - PTR_L sp, PT_R29(t0) -diff --git a/arch/powerpc/kernel/cacheinfo.c b/arch/powerpc/kernel/cacheinfo.c -index 2912b8787aa4..3eb36cea324c 100644 ---- a/arch/powerpc/kernel/cacheinfo.c -+++ b/arch/powerpc/kernel/cacheinfo.c -@@ -61,12 +61,22 @@ struct cache_type_info { - }; - - /* These are used to index the cache_type_info array. */ --#define CACHE_TYPE_UNIFIED 0 --#define CACHE_TYPE_INSTRUCTION 1 --#define CACHE_TYPE_DATA 2 -+#define CACHE_TYPE_UNIFIED 0 /* cache-size, cache-block-size, etc. */ -+#define CACHE_TYPE_UNIFIED_D 1 /* d-cache-size, d-cache-block-size, etc */ -+#define CACHE_TYPE_INSTRUCTION 2 -+#define CACHE_TYPE_DATA 3 - - static const struct cache_type_info cache_type_info[] = { - { -+ /* Embedded systems that use cache-size, cache-block-size, -+ * etc. for the Unified (typically L2) cache. */ -+ .name = "Unified", -+ .size_prop = "cache-size", -+ .line_size_props = { "cache-line-size", -+ "cache-block-size", }, -+ .nr_sets_prop = "cache-sets", -+ }, -+ { - /* PowerPC Processor binding says the [di]-cache-* - * must be equal on unified caches, so just use - * d-cache properties. */ -@@ -293,7 +303,8 @@ static struct cache *cache_find_first_sibling(struct cache *cache) - { - struct cache *iter; - -- if (cache->type == CACHE_TYPE_UNIFIED) -+ if (cache->type == CACHE_TYPE_UNIFIED || -+ cache->type == CACHE_TYPE_UNIFIED_D) - return cache; - - list_for_each_entry(iter, &cache_list, list) -@@ -324,16 +335,29 @@ static bool cache_node_is_unified(const struct device_node *np) - return of_get_property(np, "cache-unified", NULL); - } - --static struct cache *cache_do_one_devnode_unified(struct device_node *node, -- int level) -+/* -+ * Unified caches can have two different sets of tags. Most embedded -+ * use cache-size, etc. for the unified cache size, but open firmware systems -+ * use d-cache-size, etc. Check on initialization for which type we have, and -+ * return the appropriate structure type. Assume it's embedded if it isn't -+ * open firmware. If it's yet a 3rd type, then there will be missing entries -+ * in /sys/devices/system/cpu/cpu0/cache/index2/, and this code will need -+ * to be extended further. -+ */ -+static int cache_is_unified_d(const struct device_node *np) - { -- struct cache *cache; -+ return of_get_property(np, -+ cache_type_info[CACHE_TYPE_UNIFIED_D].size_prop, NULL) ? -+ CACHE_TYPE_UNIFIED_D : CACHE_TYPE_UNIFIED; -+} - -+/* -+ */ -+static struct cache *cache_do_one_devnode_unified(struct device_node *node, int level) -+{ - pr_debug("creating L%d ucache for %s\n", level, node->full_name); - -- cache = new_cache(CACHE_TYPE_UNIFIED, level, node); -- -- return cache; -+ return new_cache(cache_is_unified_d(node), level, node); - } - - static struct cache *cache_do_one_devnode_split(struct device_node *node, -diff --git a/arch/powerpc/kernel/suspend.c b/arch/powerpc/kernel/suspend.c -index 0167d53da30c..a531154cc0f3 100644 ---- a/arch/powerpc/kernel/suspend.c -+++ b/arch/powerpc/kernel/suspend.c -@@ -9,9 +9,7 @@ - - #include - #include -- --/* References to section boundaries */ --extern const void __nosave_begin, __nosave_end; -+#include - - /* - * pfn_is_nosave - check if given pfn is in the 'nosave' section -diff --git a/arch/powerpc/perf/callchain.c b/arch/powerpc/perf/callchain.c -index 2396dda282cd..ead55351b254 100644 ---- a/arch/powerpc/perf/callchain.c -+++ b/arch/powerpc/perf/callchain.c -@@ -243,7 +243,7 @@ static void perf_callchain_user_64(struct perf_callchain_entry *entry, - sp = regs->gpr[1]; - perf_callchain_store(entry, next_ip); - -- for (;;) { -+ while (entry->nr < PERF_MAX_STACK_DEPTH) { - fp = (unsigned long __user *) sp; - if (!valid_user_sp(sp, 1) || read_user_stack_64(fp, &next_sp)) - return; -diff --git a/arch/powerpc/platforms/cell/iommu.c b/arch/powerpc/platforms/cell/iommu.c -index 2b90ff8a93be..59ef76c5f4f4 100644 ---- a/arch/powerpc/platforms/cell/iommu.c -+++ b/arch/powerpc/platforms/cell/iommu.c -@@ -197,7 +197,7 @@ static int tce_build_cell(struct iommu_table *tbl, long index, long npages, - - io_pte = (unsigned long *)tbl->it_base + (index - tbl->it_offset); - -- for (i = 0; i < npages; i++, uaddr += tbl->it_page_shift) -+ for (i = 0; i < npages; i++, uaddr += (1 << tbl->it_page_shift)) - io_pte[i] = base_pte | (__pa(uaddr) & CBE_IOPTE_RPN_Mask); - - mb(); -diff --git a/arch/s390/kernel/suspend.c b/arch/s390/kernel/suspend.c -index a7a7537ce1e7..d3236c9e226b 100644 ---- a/arch/s390/kernel/suspend.c -+++ b/arch/s390/kernel/suspend.c -@@ -13,14 +13,10 @@ - #include - #include - #include -+#include - #include "entry.h" - - /* -- * References to section boundaries -- */ --extern const void __nosave_begin, __nosave_end; -- --/* - * The restore of the saved pages in an hibernation image will set - * the change and referenced bits in the storage key for each page. - * Overindication of the referenced bits after an hibernation cycle -@@ -142,6 +138,8 @@ int pfn_is_nosave(unsigned long pfn) - { - unsigned long nosave_begin_pfn = PFN_DOWN(__pa(&__nosave_begin)); - unsigned long nosave_end_pfn = PFN_DOWN(__pa(&__nosave_end)); -+ unsigned long eshared_pfn = PFN_DOWN(__pa(&_eshared)) - 1; -+ unsigned long stext_pfn = PFN_DOWN(__pa(&_stext)); - - /* Always save lowcore pages (LC protection might be enabled). */ - if (pfn <= LC_PAGES) -@@ -149,6 +147,8 @@ int pfn_is_nosave(unsigned long pfn) - if (pfn >= nosave_begin_pfn && pfn < nosave_end_pfn) - return 1; - /* Skip memory holes and read-only pages (NSS, DCSS, ...). */ -+ if (pfn >= stext_pfn && pfn <= eshared_pfn) -+ return ipl_info.type == IPL_TYPE_NSS ? 1 : 0; - if (tprot(PFN_PHYS(pfn))) - return 1; - return 0; -diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c -index 75beea632a10..3588f2f37986 100644 ---- a/arch/s390/kvm/priv.c -+++ b/arch/s390/kvm/priv.c -@@ -414,6 +414,7 @@ static void handle_stsi_3_2_2(struct kvm_vcpu *vcpu, struct sysinfo_3_2_2 *mem) - for (n = mem->count - 1; n > 0 ; n--) - memcpy(&mem->vm[n], &mem->vm[n - 1], sizeof(mem->vm[0])); - -+ memset(&mem->vm[0], 0, sizeof(mem->vm[0])); - mem->vm[0].cpus_total = cpus; - mem->vm[0].cpus_configured = cpus; - mem->vm[0].cpus_standby = 0; -diff --git a/arch/sh/include/asm/sections.h b/arch/sh/include/asm/sections.h -index 1b6199740e98..7a99e6af6372 100644 ---- a/arch/sh/include/asm/sections.h -+++ b/arch/sh/include/asm/sections.h -@@ -3,7 +3,6 @@ - - #include - --extern long __nosave_begin, __nosave_end; - extern long __machvec_start, __machvec_end; - extern char __uncached_start, __uncached_end; - extern char __start_eh_frame[], __stop_eh_frame[]; -diff --git a/arch/sparc/power/hibernate.c b/arch/sparc/power/hibernate.c -index 42b0b8ce699a..17bd2e167e07 100644 ---- a/arch/sparc/power/hibernate.c -+++ b/arch/sparc/power/hibernate.c -@@ -9,11 +9,9 @@ - #include - #include - #include -+#include - #include - --/* References to section boundaries */ --extern const void __nosave_begin, __nosave_end; -- - struct saved_context saved_context; - - /* -diff --git a/arch/unicore32/include/mach/pm.h b/arch/unicore32/include/mach/pm.h -index 4dcd34ae194c..77b522694e74 100644 ---- a/arch/unicore32/include/mach/pm.h -+++ b/arch/unicore32/include/mach/pm.h -@@ -36,8 +36,5 @@ extern int puv3_pm_enter(suspend_state_t state); - /* Defined in hibernate_asm.S */ - extern int restore_image(pgd_t *resume_pg_dir, struct pbe *restore_pblist); - --/* References to section boundaries */ --extern const void __nosave_begin, __nosave_end; -- - extern struct pbe *restore_pblist; - #endif -diff --git a/arch/unicore32/kernel/hibernate.c b/arch/unicore32/kernel/hibernate.c -index d75ef8b6cb56..9969ec374abb 100644 ---- a/arch/unicore32/kernel/hibernate.c -+++ b/arch/unicore32/kernel/hibernate.c -@@ -18,6 +18,7 @@ - #include - #include - #include -+#include - #include - - #include "mach/pm.h" -diff --git a/arch/x86/include/asm/mwait.h b/arch/x86/include/asm/mwait.h -index 1da25a5f96f9..3ba047cbcf5b 100644 ---- a/arch/x86/include/asm/mwait.h -+++ b/arch/x86/include/asm/mwait.h -@@ -30,6 +30,14 @@ static inline void __mwait(unsigned long eax, unsigned long ecx) - :: "a" (eax), "c" (ecx)); - } - -+static inline void __sti_mwait(unsigned long eax, unsigned long ecx) -+{ -+ trace_hardirqs_on(); -+ /* "mwait %eax, %ecx;" */ -+ asm volatile("sti; .byte 0x0f, 0x01, 0xc9;" -+ :: "a" (eax), "c" (ecx)); -+} -+ - /* - * This uses new MONITOR/MWAIT instructions on P4 processors with PNI, - * which can obviate IPI to trigger checking of need_resched. -diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c -index 3fb8d95ab8b5..1a1ff42094a7 100644 ---- a/arch/x86/kernel/process.c -+++ b/arch/x86/kernel/process.c -@@ -28,6 +28,7 @@ - #include - #include - #include -+#include - - /* - * per-CPU TSS segments. Threads are completely 'soft' on Linux, -@@ -398,6 +399,52 @@ static void amd_e400_idle(void) - default_idle(); - } - -+/* -+ * Intel Core2 and older machines prefer MWAIT over HALT for C1. -+ * We can't rely on cpuidle installing MWAIT, because it will not load -+ * on systems that support only C1 -- so the boot default must be MWAIT. -+ * -+ * Some AMD machines are the opposite, they depend on using HALT. -+ * -+ * So for default C1, which is used during boot until cpuidle loads, -+ * use MWAIT-C1 on Intel HW that has it, else use HALT. -+ */ -+static int prefer_mwait_c1_over_halt(const struct cpuinfo_x86 *c) -+{ -+ if (c->x86_vendor != X86_VENDOR_INTEL) -+ return 0; -+ -+ if (!cpu_has(c, X86_FEATURE_MWAIT)) -+ return 0; -+ -+ return 1; -+} -+ -+/* -+ * MONITOR/MWAIT with no hints, used for default default C1 state. -+ * This invokes MWAIT with interrutps enabled and no flags, -+ * which is backwards compatible with the original MWAIT implementation. -+ */ -+ -+static void mwait_idle(void) -+{ -+ if (!current_set_polling_and_test()) { -+ if (static_cpu_has(X86_FEATURE_CLFLUSH_MONITOR)) { -+ mb(); -+ clflush((void *)¤t_thread_info()->flags); -+ mb(); -+ } -+ -+ __monitor((void *)¤t_thread_info()->flags, 0, 0); -+ if (!need_resched()) -+ __sti_mwait(0, 0); -+ else -+ local_irq_enable(); -+ } else -+ local_irq_enable(); -+ current_clr_polling(); -+} -+ - void select_idle_routine(const struct cpuinfo_x86 *c) - { - #ifdef CONFIG_SMP -@@ -411,6 +458,9 @@ void select_idle_routine(const struct cpuinfo_x86 *c) - /* E400: APIC timer interrupt does not wake up CPU from C1e */ - pr_info("using AMD E400 aware idle routine\n"); - x86_idle = amd_e400_idle; -+ } else if (prefer_mwait_c1_over_halt(c)) { -+ pr_info("using mwait in idle threads\n"); -+ x86_idle = mwait_idle; - } else - x86_idle = default_idle; - } -diff --git a/arch/x86/power/hibernate_32.c b/arch/x86/power/hibernate_32.c -index 7d28c885d238..291226b952a9 100644 ---- a/arch/x86/power/hibernate_32.c -+++ b/arch/x86/power/hibernate_32.c -@@ -13,13 +13,11 @@ - #include - #include - #include -+#include - - /* Defined in hibernate_asm_32.S */ - extern int restore_image(void); - --/* References to section boundaries */ --extern const void __nosave_begin, __nosave_end; -- - /* Pointer to the temporary resume page tables */ - pgd_t *resume_pg_dir; - -diff --git a/arch/x86/power/hibernate_64.c b/arch/x86/power/hibernate_64.c -index 304fca20d96e..2276238fde6f 100644 ---- a/arch/x86/power/hibernate_64.c -+++ b/arch/x86/power/hibernate_64.c -@@ -17,11 +17,9 @@ - #include - #include - #include -+#include - #include - --/* References to section boundaries */ --extern __visible const void __nosave_begin, __nosave_end; -- - /* Defined in hibernate_asm_64.S */ - extern asmlinkage int restore_image(void); - -diff --git a/arch/xtensa/Kconfig b/arch/xtensa/Kconfig -index c87ae7c6e5f9..8879361e477e 100644 ---- a/arch/xtensa/Kconfig -+++ b/arch/xtensa/Kconfig -@@ -336,6 +336,36 @@ menu "Executable file formats" - - source "fs/Kconfig.binfmt" - -+config XTFPGA_LCD -+ bool "Enable XTFPGA LCD driver" -+ depends on XTENSA_PLATFORM_XTFPGA -+ default n -+ help -+ There's a 2x16 LCD on most of XTFPGA boards, kernel may output -+ progress messages there during bootup/shutdown. It may be useful -+ during board bringup. -+ -+ If unsure, say N. -+ -+config XTFPGA_LCD_BASE_ADDR -+ hex "XTFPGA LCD base address" -+ depends on XTFPGA_LCD -+ default "0x0d0c0000" -+ help -+ Base address of the LCD controller inside KIO region. -+ Different boards from XTFPGA family have LCD controller at different -+ addresses. Please consult prototyping user guide for your board for -+ the correct address. Wrong address here may lead to hardware lockup. -+ -+config XTFPGA_LCD_8BIT_ACCESS -+ bool "Use 8-bit access to XTFPGA LCD" -+ depends on XTFPGA_LCD -+ default n -+ help -+ LCD may be connected with 4- or 8-bit interface, 8-bit access may -+ only be used with 8-bit interface. Please consult prototyping user -+ guide for your board for the correct interface width. -+ - endmenu - - source "net/Kconfig" -diff --git a/arch/xtensa/include/uapi/asm/unistd.h b/arch/xtensa/include/uapi/asm/unistd.h -index 50084f7c01c8..b54fa1bd7f7e 100644 ---- a/arch/xtensa/include/uapi/asm/unistd.h -+++ b/arch/xtensa/include/uapi/asm/unistd.h -@@ -715,7 +715,7 @@ __SYSCALL(323, sys_process_vm_writev, 6) - __SYSCALL(324, sys_name_to_handle_at, 5) - #define __NR_open_by_handle_at 325 - __SYSCALL(325, sys_open_by_handle_at, 3) --#define __NR_sync_file_range 326 -+#define __NR_sync_file_range2 326 - __SYSCALL(326, sys_sync_file_range2, 6) - #define __NR_perf_event_open 327 - __SYSCALL(327, sys_perf_event_open, 5) -diff --git a/arch/xtensa/platforms/iss/network.c b/arch/xtensa/platforms/iss/network.c -index d05f8feeb8d7..17b1ef3232e4 100644 ---- a/arch/xtensa/platforms/iss/network.c -+++ b/arch/xtensa/platforms/iss/network.c -@@ -349,8 +349,8 @@ static void iss_net_timer(unsigned long priv) - { - struct iss_net_private *lp = (struct iss_net_private *)priv; - -- spin_lock(&lp->lock); - iss_net_poll(); -+ spin_lock(&lp->lock); - mod_timer(&lp->timer, jiffies + lp->timer_val); - spin_unlock(&lp->lock); - } -@@ -361,7 +361,7 @@ static int iss_net_open(struct net_device *dev) - struct iss_net_private *lp = netdev_priv(dev); - int err; - -- spin_lock(&lp->lock); -+ spin_lock_bh(&lp->lock); - - err = lp->tp.open(lp); - if (err < 0) -@@ -376,9 +376,11 @@ static int iss_net_open(struct net_device *dev) - while ((err = iss_net_rx(dev)) > 0) - ; - -- spin_lock(&opened_lock); -+ spin_unlock_bh(&lp->lock); -+ spin_lock_bh(&opened_lock); - list_add(&lp->opened_list, &opened); -- spin_unlock(&opened_lock); -+ spin_unlock_bh(&opened_lock); -+ spin_lock_bh(&lp->lock); - - init_timer(&lp->timer); - lp->timer_val = ISS_NET_TIMER_VALUE; -@@ -387,7 +389,7 @@ static int iss_net_open(struct net_device *dev) - mod_timer(&lp->timer, jiffies + lp->timer_val); - - out: -- spin_unlock(&lp->lock); -+ spin_unlock_bh(&lp->lock); - return err; - } - -@@ -395,7 +397,7 @@ static int iss_net_close(struct net_device *dev) - { - struct iss_net_private *lp = netdev_priv(dev); - netif_stop_queue(dev); -- spin_lock(&lp->lock); -+ spin_lock_bh(&lp->lock); - - spin_lock(&opened_lock); - list_del(&opened); -@@ -405,18 +407,17 @@ static int iss_net_close(struct net_device *dev) - - lp->tp.close(lp); - -- spin_unlock(&lp->lock); -+ spin_unlock_bh(&lp->lock); - return 0; - } - - static int iss_net_start_xmit(struct sk_buff *skb, struct net_device *dev) - { - struct iss_net_private *lp = netdev_priv(dev); -- unsigned long flags; - int len; - - netif_stop_queue(dev); -- spin_lock_irqsave(&lp->lock, flags); -+ spin_lock_bh(&lp->lock); - - len = lp->tp.write(lp, &skb); - -@@ -438,7 +439,7 @@ static int iss_net_start_xmit(struct sk_buff *skb, struct net_device *dev) - pr_err("%s: %s failed(%d)\n", dev->name, __func__, len); - } - -- spin_unlock_irqrestore(&lp->lock, flags); -+ spin_unlock_bh(&lp->lock); - - dev_kfree_skb(skb); - return NETDEV_TX_OK; -@@ -466,9 +467,9 @@ static int iss_net_set_mac(struct net_device *dev, void *addr) - - if (!is_valid_ether_addr(hwaddr->sa_data)) - return -EADDRNOTAVAIL; -- spin_lock(&lp->lock); -+ spin_lock_bh(&lp->lock); - memcpy(dev->dev_addr, hwaddr->sa_data, ETH_ALEN); -- spin_unlock(&lp->lock); -+ spin_unlock_bh(&lp->lock); - return 0; - } - -@@ -520,11 +521,11 @@ static int iss_net_configure(int index, char *init) - *lp = (struct iss_net_private) { - .device_list = LIST_HEAD_INIT(lp->device_list), - .opened_list = LIST_HEAD_INIT(lp->opened_list), -- .lock = __SPIN_LOCK_UNLOCKED(lp.lock), - .dev = dev, - .index = index, -- }; -+ }; - -+ spin_lock_init(&lp->lock); - /* - * If this name ends up conflicting with an existing registered - * netdevice, that is OK, register_netdev{,ice}() will notice this -diff --git a/arch/xtensa/platforms/xtfpga/Makefile b/arch/xtensa/platforms/xtfpga/Makefile -index b9ae206340cd..7839d38b2337 100644 ---- a/arch/xtensa/platforms/xtfpga/Makefile -+++ b/arch/xtensa/platforms/xtfpga/Makefile -@@ -6,4 +6,5 @@ - # - # Note 2! The CFLAGS definitions are in the main makefile... - --obj-y = setup.o lcd.o -+obj-y += setup.o -+obj-$(CONFIG_XTFPGA_LCD) += lcd.o -diff --git a/arch/xtensa/platforms/xtfpga/include/platform/hardware.h b/arch/xtensa/platforms/xtfpga/include/platform/hardware.h -index aeb316b7ff88..e8cc86fbba09 100644 ---- a/arch/xtensa/platforms/xtfpga/include/platform/hardware.h -+++ b/arch/xtensa/platforms/xtfpga/include/platform/hardware.h -@@ -40,9 +40,6 @@ - - /* UART */ - #define DUART16552_PADDR (XCHAL_KIO_PADDR + 0x0D050020) --/* LCD instruction and data addresses. */ --#define LCD_INSTR_ADDR ((char *)IOADDR(0x0D040000)) --#define LCD_DATA_ADDR ((char *)IOADDR(0x0D040004)) - - /* Misc. */ - #define XTFPGA_FPGAREGS_VADDR IOADDR(0x0D020000) -diff --git a/arch/xtensa/platforms/xtfpga/include/platform/lcd.h b/arch/xtensa/platforms/xtfpga/include/platform/lcd.h -index 0e435645af5a..4c8541ed1139 100644 ---- a/arch/xtensa/platforms/xtfpga/include/platform/lcd.h -+++ b/arch/xtensa/platforms/xtfpga/include/platform/lcd.h -@@ -11,10 +11,25 @@ - #ifndef __XTENSA_XTAVNET_LCD_H - #define __XTENSA_XTAVNET_LCD_H - -+#ifdef CONFIG_XTFPGA_LCD - /* Display string STR at position POS on the LCD. */ - void lcd_disp_at_pos(char *str, unsigned char pos); - - /* Shift the contents of the LCD display left or right. */ - void lcd_shiftleft(void); - void lcd_shiftright(void); -+#else -+static inline void lcd_disp_at_pos(char *str, unsigned char pos) -+{ -+} -+ -+static inline void lcd_shiftleft(void) -+{ -+} -+ -+static inline void lcd_shiftright(void) -+{ -+} -+#endif -+ - #endif -diff --git a/arch/xtensa/platforms/xtfpga/lcd.c b/arch/xtensa/platforms/xtfpga/lcd.c -index 2872301598df..4dc0c1b43f4b 100644 ---- a/arch/xtensa/platforms/xtfpga/lcd.c -+++ b/arch/xtensa/platforms/xtfpga/lcd.c -@@ -1,50 +1,63 @@ - /* -- * Driver for the LCD display on the Tensilica LX60 Board. -+ * Driver for the LCD display on the Tensilica XTFPGA board family. -+ * http://www.mytechcorp.com/cfdata/productFile/File1/MOC-16216B-B-A0A04.pdf - * - * This file is subject to the terms and conditions of the GNU General Public - * License. See the file "COPYING" in the main directory of this archive - * for more details. - * - * Copyright (C) 2001, 2006 Tensilica Inc. -+ * Copyright (C) 2015 Cadence Design Systems Inc. - */ - --/* -- * -- * FIXME: this code is from the examples from the LX60 user guide. -- * -- * The lcd_pause function does busy waiting, which is probably not -- * great. Maybe the code could be changed to use kernel timers, or -- * change the hardware to not need to wait. -- */ -- -+#include - #include - #include - - #include - #include --#include - --#define LCD_PAUSE_ITERATIONS 4000 -+/* LCD instruction and data addresses. */ -+#define LCD_INSTR_ADDR ((char *)IOADDR(CONFIG_XTFPGA_LCD_BASE_ADDR)) -+#define LCD_DATA_ADDR (LCD_INSTR_ADDR + 4) -+ - #define LCD_CLEAR 0x1 - #define LCD_DISPLAY_ON 0xc - - /* 8bit and 2 lines display */ - #define LCD_DISPLAY_MODE8BIT 0x38 -+#define LCD_DISPLAY_MODE4BIT 0x28 - #define LCD_DISPLAY_POS 0x80 - #define LCD_SHIFT_LEFT 0x18 - #define LCD_SHIFT_RIGHT 0x1c - -+static void lcd_put_byte(u8 *addr, u8 data) -+{ -+#ifdef CONFIG_XTFPGA_LCD_8BIT_ACCESS -+ ACCESS_ONCE(*addr) = data; -+#else -+ ACCESS_ONCE(*addr) = data & 0xf0; -+ ACCESS_ONCE(*addr) = (data << 4) & 0xf0; -+#endif -+} -+ - static int __init lcd_init(void) - { -- *LCD_INSTR_ADDR = LCD_DISPLAY_MODE8BIT; -+ ACCESS_ONCE(*LCD_INSTR_ADDR) = LCD_DISPLAY_MODE8BIT; - mdelay(5); -- *LCD_INSTR_ADDR = LCD_DISPLAY_MODE8BIT; -+ ACCESS_ONCE(*LCD_INSTR_ADDR) = LCD_DISPLAY_MODE8BIT; - udelay(200); -- *LCD_INSTR_ADDR = LCD_DISPLAY_MODE8BIT; -+ ACCESS_ONCE(*LCD_INSTR_ADDR) = LCD_DISPLAY_MODE8BIT; -+ udelay(50); -+#ifndef CONFIG_XTFPGA_LCD_8BIT_ACCESS -+ ACCESS_ONCE(*LCD_INSTR_ADDR) = LCD_DISPLAY_MODE4BIT; -+ udelay(50); -+ lcd_put_byte(LCD_INSTR_ADDR, LCD_DISPLAY_MODE4BIT); - udelay(50); -- *LCD_INSTR_ADDR = LCD_DISPLAY_ON; -+#endif -+ lcd_put_byte(LCD_INSTR_ADDR, LCD_DISPLAY_ON); - udelay(50); -- *LCD_INSTR_ADDR = LCD_CLEAR; -+ lcd_put_byte(LCD_INSTR_ADDR, LCD_CLEAR); - mdelay(10); - lcd_disp_at_pos("XTENSA LINUX", 0); - return 0; -@@ -52,10 +65,10 @@ static int __init lcd_init(void) - - void lcd_disp_at_pos(char *str, unsigned char pos) - { -- *LCD_INSTR_ADDR = LCD_DISPLAY_POS | pos; -+ lcd_put_byte(LCD_INSTR_ADDR, LCD_DISPLAY_POS | pos); - udelay(100); - while (*str != 0) { -- *LCD_DATA_ADDR = *str; -+ lcd_put_byte(LCD_DATA_ADDR, *str); - udelay(200); - str++; - } -@@ -63,13 +76,13 @@ void lcd_disp_at_pos(char *str, unsigned char pos) - - void lcd_shiftleft(void) - { -- *LCD_INSTR_ADDR = LCD_SHIFT_LEFT; -+ lcd_put_byte(LCD_INSTR_ADDR, LCD_SHIFT_LEFT); - udelay(50); - } - - void lcd_shiftright(void) - { -- *LCD_INSTR_ADDR = LCD_SHIFT_RIGHT; -+ lcd_put_byte(LCD_INSTR_ADDR, LCD_SHIFT_RIGHT); - udelay(50); - } - -diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c -index 666beea3bf1c..9498c3d575d4 100644 ---- a/drivers/acpi/scan.c -+++ b/drivers/acpi/scan.c -@@ -192,7 +192,11 @@ bool acpi_scan_is_offline(struct acpi_device *adev, bool uevent) - struct acpi_device_physical_node *pn; - bool offline = true; - -- mutex_lock(&adev->physical_node_lock); -+ /* -+ * acpi_container_offline() calls this for all of the container's -+ * children under the container's physical_node_lock lock. -+ */ -+ mutex_lock_nested(&adev->physical_node_lock, SINGLE_DEPTH_NESTING); - - list_for_each_entry(pn, &adev->physical_node_list, node) - if (device_supports_offline(pn->dev) && !pn->dev->offline) { -diff --git a/drivers/base/bus.c b/drivers/base/bus.c -index 45d0fa78981c..12b39dc2ad5c 100644 ---- a/drivers/base/bus.c -+++ b/drivers/base/bus.c -@@ -515,11 +515,11 @@ int bus_add_device(struct device *dev) - goto out_put; - error = device_add_groups(dev, bus->dev_groups); - if (error) -- goto out_groups; -+ goto out_id; - error = sysfs_create_link(&bus->p->devices_kset->kobj, - &dev->kobj, dev_name(dev)); - if (error) -- goto out_id; -+ goto out_groups; - error = sysfs_create_link(&dev->kobj, - &dev->bus->p->subsys.kobj, "subsystem"); - if (error) -diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c -index 5afe556a70f8..26b03e1254ef 100644 ---- a/drivers/bluetooth/ath3k.c -+++ b/drivers/bluetooth/ath3k.c -@@ -64,6 +64,7 @@ static const struct usb_device_id ath3k_table[] = { - /* Atheros AR3011 with sflash firmware*/ - { USB_DEVICE(0x0489, 0xE027) }, - { USB_DEVICE(0x0489, 0xE03D) }, -+ { USB_DEVICE(0x04F2, 0xAFF1) }, - { USB_DEVICE(0x0930, 0x0215) }, - { USB_DEVICE(0x0CF3, 0x3002) }, - { USB_DEVICE(0x0CF3, 0xE019) }, -diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c -index 03b331798e16..9eb1669962ef 100644 ---- a/drivers/bluetooth/btusb.c -+++ b/drivers/bluetooth/btusb.c -@@ -142,6 +142,7 @@ static const struct usb_device_id blacklist_table[] = { - /* Atheros 3011 with sflash firmware */ - { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE }, - { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE }, -+ { USB_DEVICE(0x04f2, 0xaff1), .driver_info = BTUSB_IGNORE }, - { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE }, - { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE }, - { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE }, -diff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c -index 0996a3a39855..a9dd21aff6bb 100644 ---- a/drivers/clk/qcom/clk-rcg2.c -+++ b/drivers/clk/qcom/clk-rcg2.c -@@ -257,7 +257,7 @@ static int __clk_rcg2_set_rate(struct clk_hw *hw, unsigned long rate) - mask |= CFG_SRC_SEL_MASK | CFG_MODE_MASK; - cfg = f->pre_div << CFG_SRC_DIV_SHIFT; - cfg |= rcg->parent_map[f->src] << CFG_SRC_SEL_SHIFT; -- if (rcg->mnd_width && f->n) -+ if (rcg->mnd_width && f->n && (f->m != f->n)) - cfg |= CFG_MODE_DUAL_EDGE; - ret = regmap_update_bits(rcg->clkr.regmap, rcg->cmd_rcgr + CFG_REG, mask, - cfg); -diff --git a/drivers/clk/tegra/clk.c b/drivers/clk/tegra/clk.c -index c0a7d7723510..a90af1780cf2 100644 ---- a/drivers/clk/tegra/clk.c -+++ b/drivers/clk/tegra/clk.c -@@ -266,7 +266,7 @@ void __init tegra_add_of_provider(struct device_node *np) - of_clk_add_provider(np, of_clk_src_onecell_get, &clk_data); - - rst_ctlr.of_node = np; -- rst_ctlr.nr_resets = clk_num * 32; -+ rst_ctlr.nr_resets = periph_banks * 32; - reset_controller_register(&rst_ctlr); - } - -diff --git a/drivers/crypto/omap-aes.c b/drivers/crypto/omap-aes.c -index dde41f1df608..d522396174c3 100644 ---- a/drivers/crypto/omap-aes.c -+++ b/drivers/crypto/omap-aes.c -@@ -554,15 +554,23 @@ static int omap_aes_crypt_dma_stop(struct omap_aes_dev *dd) - return err; - } - --static int omap_aes_check_aligned(struct scatterlist *sg) -+static int omap_aes_check_aligned(struct scatterlist *sg, int total) - { -+ int len = 0; -+ - while (sg) { - if (!IS_ALIGNED(sg->offset, 4)) - return -1; - if (!IS_ALIGNED(sg->length, AES_BLOCK_SIZE)) - return -1; -+ -+ len += sg->length; - sg = sg_next(sg); - } -+ -+ if (len != total) -+ return -1; -+ - return 0; - } - -@@ -633,8 +641,8 @@ static int omap_aes_handle_queue(struct omap_aes_dev *dd, - dd->in_sg = req->src; - dd->out_sg = req->dst; - -- if (omap_aes_check_aligned(dd->in_sg) || -- omap_aes_check_aligned(dd->out_sg)) { -+ if (omap_aes_check_aligned(dd->in_sg, dd->total) || -+ omap_aes_check_aligned(dd->out_sg, dd->total)) { - if (omap_aes_copy_sgs(dd)) - pr_err("Failed to copy SGs for unaligned cases\n"); - dd->sgs_copied = 1; -diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c -index 3b1fd1ce460f..e9d8cf6c2f79 100644 ---- a/drivers/gpio/gpio-mvebu.c -+++ b/drivers/gpio/gpio-mvebu.c -@@ -304,11 +304,13 @@ static void mvebu_gpio_edge_irq_mask(struct irq_data *d) - { - struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d); - struct mvebu_gpio_chip *mvchip = gc->private; -+ struct irq_chip_type *ct = irq_data_get_chip_type(d); - u32 mask = 1 << (d->irq - gc->irq_base); - - irq_gc_lock(gc); -- gc->mask_cache &= ~mask; -- writel_relaxed(gc->mask_cache, mvebu_gpioreg_edge_mask(mvchip)); -+ ct->mask_cache_priv &= ~mask; -+ -+ writel_relaxed(ct->mask_cache_priv, mvebu_gpioreg_edge_mask(mvchip)); - irq_gc_unlock(gc); - } - -@@ -316,11 +318,13 @@ static void mvebu_gpio_edge_irq_unmask(struct irq_data *d) - { - struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d); - struct mvebu_gpio_chip *mvchip = gc->private; -+ struct irq_chip_type *ct = irq_data_get_chip_type(d); -+ - u32 mask = 1 << (d->irq - gc->irq_base); - - irq_gc_lock(gc); -- gc->mask_cache |= mask; -- writel_relaxed(gc->mask_cache, mvebu_gpioreg_edge_mask(mvchip)); -+ ct->mask_cache_priv |= mask; -+ writel_relaxed(ct->mask_cache_priv, mvebu_gpioreg_edge_mask(mvchip)); - irq_gc_unlock(gc); - } - -@@ -328,11 +332,13 @@ static void mvebu_gpio_level_irq_mask(struct irq_data *d) - { - struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d); - struct mvebu_gpio_chip *mvchip = gc->private; -+ struct irq_chip_type *ct = irq_data_get_chip_type(d); -+ - u32 mask = 1 << (d->irq - gc->irq_base); - - irq_gc_lock(gc); -- gc->mask_cache &= ~mask; -- writel_relaxed(gc->mask_cache, mvebu_gpioreg_level_mask(mvchip)); -+ ct->mask_cache_priv &= ~mask; -+ writel_relaxed(ct->mask_cache_priv, mvebu_gpioreg_level_mask(mvchip)); - irq_gc_unlock(gc); - } - -@@ -340,11 +346,13 @@ static void mvebu_gpio_level_irq_unmask(struct irq_data *d) - { - struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d); - struct mvebu_gpio_chip *mvchip = gc->private; -+ struct irq_chip_type *ct = irq_data_get_chip_type(d); -+ - u32 mask = 1 << (d->irq - gc->irq_base); - - irq_gc_lock(gc); -- gc->mask_cache |= mask; -- writel_relaxed(gc->mask_cache, mvebu_gpioreg_level_mask(mvchip)); -+ ct->mask_cache_priv |= mask; -+ writel_relaxed(ct->mask_cache_priv, mvebu_gpioreg_level_mask(mvchip)); - irq_gc_unlock(gc); - } - -diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c -index 8f42bd724682..f1fc14c33be5 100644 ---- a/drivers/gpio/gpiolib.c -+++ b/drivers/gpio/gpiolib.c -@@ -1928,15 +1928,15 @@ EXPORT_SYMBOL_GPL(gpiod_is_active_low); - * that the GPIO was actually requested. - */ - --static int _gpiod_get_raw_value(const struct gpio_desc *desc) -+static bool _gpiod_get_raw_value(const struct gpio_desc *desc) - { - struct gpio_chip *chip; -- int value; -+ bool value; - int offset; - - chip = desc->chip; - offset = gpio_chip_hwgpio(desc); -- value = chip->get ? chip->get(chip, offset) : 0; -+ value = chip->get ? chip->get(chip, offset) : false; - trace_gpio_value(desc_to_gpio(desc), 1, value); - return value; - } -@@ -1992,7 +1992,7 @@ EXPORT_SYMBOL_GPL(gpiod_get_value); - * @desc: gpio descriptor whose state need to be set. - * @value: Non-zero for setting it HIGH otherise it will set to LOW. - */ --static void _gpio_set_open_drain_value(struct gpio_desc *desc, int value) -+static void _gpio_set_open_drain_value(struct gpio_desc *desc, bool value) - { - int err = 0; - struct gpio_chip *chip = desc->chip; -@@ -2019,7 +2019,7 @@ static void _gpio_set_open_drain_value(struct gpio_desc *desc, int value) - * @desc: gpio descriptor whose state need to be set. - * @value: Non-zero for setting it HIGH otherise it will set to LOW. - */ --static void _gpio_set_open_source_value(struct gpio_desc *desc, int value) -+static void _gpio_set_open_source_value(struct gpio_desc *desc, bool value) - { - int err = 0; - struct gpio_chip *chip = desc->chip; -@@ -2041,7 +2041,7 @@ static void _gpio_set_open_source_value(struct gpio_desc *desc, int value) - __func__, err); - } - --static void _gpiod_set_raw_value(struct gpio_desc *desc, int value) -+static void _gpiod_set_raw_value(struct gpio_desc *desc, bool value) - { - struct gpio_chip *chip; - -diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h -index 0c83b3dab58c..5b38bf819b7b 100644 ---- a/drivers/gpu/drm/i915/i915_reg.h -+++ b/drivers/gpu/drm/i915/i915_reg.h -@@ -1181,6 +1181,7 @@ - #define GMBUS_CYCLE_INDEX (2<<25) - #define GMBUS_CYCLE_STOP (4<<25) - #define GMBUS_BYTE_COUNT_SHIFT 16 -+#define GMBUS_BYTE_COUNT_MAX 256U - #define GMBUS_SLAVE_INDEX_SHIFT 8 - #define GMBUS_SLAVE_ADDR_SHIFT 1 - #define GMBUS_SLAVE_READ (1<<0) -diff --git a/drivers/gpu/drm/i915/intel_i2c.c b/drivers/gpu/drm/i915/intel_i2c.c -index d33b61d0dd33..1d02970ed395 100644 ---- a/drivers/gpu/drm/i915/intel_i2c.c -+++ b/drivers/gpu/drm/i915/intel_i2c.c -@@ -324,18 +324,17 @@ gmbus_wait_idle(struct drm_i915_private *dev_priv) - } - - static int --gmbus_xfer_read(struct drm_i915_private *dev_priv, struct i2c_msg *msg, -- u32 gmbus1_index) -+gmbus_xfer_read_chunk(struct drm_i915_private *dev_priv, -+ unsigned short addr, u8 *buf, unsigned int len, -+ u32 gmbus1_index) - { - int reg_offset = dev_priv->gpio_mmio_base; -- u16 len = msg->len; -- u8 *buf = msg->buf; - - I915_WRITE(GMBUS1 + reg_offset, - gmbus1_index | - GMBUS_CYCLE_WAIT | - (len << GMBUS_BYTE_COUNT_SHIFT) | -- (msg->addr << GMBUS_SLAVE_ADDR_SHIFT) | -+ (addr << GMBUS_SLAVE_ADDR_SHIFT) | - GMBUS_SLAVE_READ | GMBUS_SW_RDY); - while (len) { - int ret; -@@ -357,11 +356,35 @@ gmbus_xfer_read(struct drm_i915_private *dev_priv, struct i2c_msg *msg, - } - - static int --gmbus_xfer_write(struct drm_i915_private *dev_priv, struct i2c_msg *msg) -+gmbus_xfer_read(struct drm_i915_private *dev_priv, struct i2c_msg *msg, -+ u32 gmbus1_index) - { -- int reg_offset = dev_priv->gpio_mmio_base; -- u16 len = msg->len; - u8 *buf = msg->buf; -+ unsigned int rx_size = msg->len; -+ unsigned int len; -+ int ret; -+ -+ do { -+ len = min(rx_size, GMBUS_BYTE_COUNT_MAX); -+ -+ ret = gmbus_xfer_read_chunk(dev_priv, msg->addr, -+ buf, len, gmbus1_index); -+ if (ret) -+ return ret; -+ -+ rx_size -= len; -+ buf += len; -+ } while (rx_size != 0); -+ -+ return 0; -+} -+ -+static int -+gmbus_xfer_write_chunk(struct drm_i915_private *dev_priv, -+ unsigned short addr, u8 *buf, unsigned int len) -+{ -+ int reg_offset = dev_priv->gpio_mmio_base; -+ unsigned int chunk_size = len; - u32 val, loop; - - val = loop = 0; -@@ -373,8 +396,8 @@ gmbus_xfer_write(struct drm_i915_private *dev_priv, struct i2c_msg *msg) - I915_WRITE(GMBUS3 + reg_offset, val); - I915_WRITE(GMBUS1 + reg_offset, - GMBUS_CYCLE_WAIT | -- (msg->len << GMBUS_BYTE_COUNT_SHIFT) | -- (msg->addr << GMBUS_SLAVE_ADDR_SHIFT) | -+ (chunk_size << GMBUS_BYTE_COUNT_SHIFT) | -+ (addr << GMBUS_SLAVE_ADDR_SHIFT) | - GMBUS_SLAVE_WRITE | GMBUS_SW_RDY); - while (len) { - int ret; -@@ -391,6 +414,29 @@ gmbus_xfer_write(struct drm_i915_private *dev_priv, struct i2c_msg *msg) - if (ret) - return ret; - } -+ -+ return 0; -+} -+ -+static int -+gmbus_xfer_write(struct drm_i915_private *dev_priv, struct i2c_msg *msg) -+{ -+ u8 *buf = msg->buf; -+ unsigned int tx_size = msg->len; -+ unsigned int len; -+ int ret; -+ -+ do { -+ len = min(tx_size, GMBUS_BYTE_COUNT_MAX); -+ -+ ret = gmbus_xfer_write_chunk(dev_priv, msg->addr, buf, len); -+ if (ret) -+ return ret; -+ -+ buf += len; -+ tx_size -= len; -+ } while (tx_size != 0); -+ - return 0; - } - -diff --git a/drivers/gpu/drm/msm/adreno/a3xx_gpu.c b/drivers/gpu/drm/msm/adreno/a3xx_gpu.c -index 461df93e825e..4f32b34f48d4 100644 ---- a/drivers/gpu/drm/msm/adreno/a3xx_gpu.c -+++ b/drivers/gpu/drm/msm/adreno/a3xx_gpu.c -@@ -35,8 +35,6 @@ - A3XX_INT0_CP_AHB_ERROR_HALT | \ - A3XX_INT0_UCHE_OOB_ACCESS) - --static struct platform_device *a3xx_pdev; -- - static void a3xx_me_init(struct msm_gpu *gpu) - { - struct msm_ringbuffer *ring = gpu->rb; -@@ -311,7 +309,6 @@ static void a3xx_destroy(struct msm_gpu *gpu) - ocmem_free(OCMEM_GRAPHICS, a3xx_gpu->ocmem_hdl); - #endif - -- put_device(&a3xx_gpu->pdev->dev); - kfree(a3xx_gpu); - } - -@@ -439,7 +436,8 @@ struct msm_gpu *a3xx_gpu_init(struct drm_device *dev) - struct a3xx_gpu *a3xx_gpu = NULL; - struct adreno_gpu *adreno_gpu; - struct msm_gpu *gpu; -- struct platform_device *pdev = a3xx_pdev; -+ struct msm_drm_private *priv = dev->dev_private; -+ struct platform_device *pdev = priv->gpu_pdev; - struct adreno_platform_config *config; - int ret; - -@@ -460,7 +458,6 @@ struct msm_gpu *a3xx_gpu_init(struct drm_device *dev) - adreno_gpu = &a3xx_gpu->base; - gpu = &adreno_gpu->base; - -- get_device(&pdev->dev); - a3xx_gpu->pdev = pdev; - - gpu->fast_rate = config->fast_rate; -@@ -522,17 +519,24 @@ fail: - # include - #endif - --static int a3xx_probe(struct platform_device *pdev) -+static void set_gpu_pdev(struct drm_device *dev, -+ struct platform_device *pdev) -+{ -+ struct msm_drm_private *priv = dev->dev_private; -+ priv->gpu_pdev = pdev; -+} -+ -+static int a3xx_bind(struct device *dev, struct device *master, void *data) - { - static struct adreno_platform_config config = {}; - #ifdef CONFIG_OF -- struct device_node *child, *node = pdev->dev.of_node; -+ struct device_node *child, *node = dev->of_node; - u32 val; - int ret; - - ret = of_property_read_u32(node, "qcom,chipid", &val); - if (ret) { -- dev_err(&pdev->dev, "could not find chipid: %d\n", ret); -+ dev_err(dev, "could not find chipid: %d\n", ret); - return ret; - } - -@@ -548,7 +552,7 @@ static int a3xx_probe(struct platform_device *pdev) - for_each_child_of_node(child, pwrlvl) { - ret = of_property_read_u32(pwrlvl, "qcom,gpu-freq", &val); - if (ret) { -- dev_err(&pdev->dev, "could not find gpu-freq: %d\n", ret); -+ dev_err(dev, "could not find gpu-freq: %d\n", ret); - return ret; - } - config.fast_rate = max(config.fast_rate, val); -@@ -558,12 +562,12 @@ static int a3xx_probe(struct platform_device *pdev) - } - - if (!config.fast_rate) { -- dev_err(&pdev->dev, "could not find clk rates\n"); -+ dev_err(dev, "could not find clk rates\n"); - return -ENXIO; - } - - #else -- struct kgsl_device_platform_data *pdata = pdev->dev.platform_data; -+ struct kgsl_device_platform_data *pdata = dev->platform_data; - uint32_t version = socinfo_get_version(); - if (cpu_is_apq8064ab()) { - config.fast_rate = 450000000; -@@ -609,14 +613,30 @@ static int a3xx_probe(struct platform_device *pdev) - config.bus_scale_table = pdata->bus_scale_table; - # endif - #endif -- pdev->dev.platform_data = &config; -- a3xx_pdev = pdev; -+ dev->platform_data = &config; -+ set_gpu_pdev(dev_get_drvdata(master), to_platform_device(dev)); - return 0; - } - -+static void a3xx_unbind(struct device *dev, struct device *master, -+ void *data) -+{ -+ set_gpu_pdev(dev_get_drvdata(master), NULL); -+} -+ -+static const struct component_ops a3xx_ops = { -+ .bind = a3xx_bind, -+ .unbind = a3xx_unbind, -+}; -+ -+static int a3xx_probe(struct platform_device *pdev) -+{ -+ return component_add(&pdev->dev, &a3xx_ops); -+} -+ - static int a3xx_remove(struct platform_device *pdev) - { -- a3xx_pdev = NULL; -+ component_del(&pdev->dev, &a3xx_ops); - return 0; - } - -@@ -624,7 +644,6 @@ static const struct of_device_id dt_match[] = { - { .compatible = "qcom,kgsl-3d0" }, - {} - }; --MODULE_DEVICE_TABLE(of, dt_match); - - static struct platform_driver a3xx_driver = { - .probe = a3xx_probe, -diff --git a/drivers/gpu/drm/msm/hdmi/hdmi.c b/drivers/gpu/drm/msm/hdmi/hdmi.c -index 6f1588aa9071..8a04a1d206cd 100644 ---- a/drivers/gpu/drm/msm/hdmi/hdmi.c -+++ b/drivers/gpu/drm/msm/hdmi/hdmi.c -@@ -17,8 +17,6 @@ - - #include "hdmi.h" - --static struct platform_device *hdmi_pdev; -- - void hdmi_set_mode(struct hdmi *hdmi, bool power_on) - { - uint32_t ctrl = 0; -@@ -75,7 +73,7 @@ struct hdmi *hdmi_init(struct drm_device *dev, struct drm_encoder *encoder) - { - struct hdmi *hdmi = NULL; - struct msm_drm_private *priv = dev->dev_private; -- struct platform_device *pdev = hdmi_pdev; -+ struct platform_device *pdev = priv->hdmi_pdev; - struct hdmi_platform_config *config; - int i, ret; - -@@ -95,8 +93,6 @@ struct hdmi *hdmi_init(struct drm_device *dev, struct drm_encoder *encoder) - - kref_init(&hdmi->refcount); - -- get_device(&pdev->dev); -- - hdmi->dev = dev; - hdmi->pdev = pdev; - hdmi->config = config; -@@ -249,17 +245,24 @@ fail: - - #include - --static int hdmi_dev_probe(struct platform_device *pdev) -+static void set_hdmi_pdev(struct drm_device *dev, -+ struct platform_device *pdev) -+{ -+ struct msm_drm_private *priv = dev->dev_private; -+ priv->hdmi_pdev = pdev; -+} -+ -+static int hdmi_bind(struct device *dev, struct device *master, void *data) - { - static struct hdmi_platform_config config = {}; - #ifdef CONFIG_OF -- struct device_node *of_node = pdev->dev.of_node; -+ struct device_node *of_node = dev->of_node; - - int get_gpio(const char *name) - { - int gpio = of_get_named_gpio(of_node, name, 0); - if (gpio < 0) { -- dev_err(&pdev->dev, "failed to get gpio: %s (%d)\n", -+ dev_err(dev, "failed to get gpio: %s (%d)\n", - name, gpio); - gpio = -1; - } -@@ -336,14 +339,30 @@ static int hdmi_dev_probe(struct platform_device *pdev) - config.mux_sel_gpio = -1; - } - #endif -- pdev->dev.platform_data = &config; -- hdmi_pdev = pdev; -+ dev->platform_data = &config; -+ set_hdmi_pdev(dev_get_drvdata(master), to_platform_device(dev)); - return 0; - } - -+static void hdmi_unbind(struct device *dev, struct device *master, -+ void *data) -+{ -+ set_hdmi_pdev(dev_get_drvdata(master), NULL); -+} -+ -+static const struct component_ops hdmi_ops = { -+ .bind = hdmi_bind, -+ .unbind = hdmi_unbind, -+}; -+ -+static int hdmi_dev_probe(struct platform_device *pdev) -+{ -+ return component_add(&pdev->dev, &hdmi_ops); -+} -+ - static int hdmi_dev_remove(struct platform_device *pdev) - { -- hdmi_pdev = NULL; -+ component_del(&pdev->dev, &hdmi_ops); - return 0; - } - -@@ -351,7 +370,6 @@ static const struct of_device_id dt_match[] = { - { .compatible = "qcom,hdmi-tx" }, - {} - }; --MODULE_DEVICE_TABLE(of, dt_match); - - static struct platform_driver hdmi_driver = { - .probe = hdmi_dev_probe, -diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c -index e6adafc7eff3..e79cfd0b2b04 100644 ---- a/drivers/gpu/drm/msm/msm_drv.c -+++ b/drivers/gpu/drm/msm/msm_drv.c -@@ -56,6 +56,10 @@ static char *vram; - MODULE_PARM_DESC(vram, "Configure VRAM size (for devices without IOMMU/GPUMMU"); - module_param(vram, charp, 0); - -+/* -+ * Util/helpers: -+ */ -+ - void __iomem *msm_ioremap(struct platform_device *pdev, const char *name, - const char *dbgname) - { -@@ -143,6 +147,8 @@ static int msm_unload(struct drm_device *dev) - priv->vram.paddr, &attrs); - } - -+ component_unbind_all(dev->dev, dev); -+ - dev->dev_private = NULL; - - kfree(priv); -@@ -175,6 +181,7 @@ static int msm_load(struct drm_device *dev, unsigned long flags) - struct msm_kms *kms; - int ret; - -+ - priv = kzalloc(sizeof(*priv), GFP_KERNEL); - if (!priv) { - dev_err(dev->dev, "failed to allocate private data\n"); -@@ -226,6 +233,13 @@ static int msm_load(struct drm_device *dev, unsigned long flags) - (uint32_t)(priv->vram.paddr + size)); - } - -+ platform_set_drvdata(pdev, dev); -+ -+ /* Bind all our sub-components: */ -+ ret = component_bind_all(dev->dev, dev); -+ if (ret) -+ return ret; -+ - switch (get_mdp_ver(pdev)) { - case 4: - kms = mdp4_kms_init(dev); -@@ -281,8 +295,6 @@ static int msm_load(struct drm_device *dev, unsigned long flags) - goto fail; - } - -- platform_set_drvdata(pdev, dev); -- - #ifdef CONFIG_DRM_MSM_FBDEV - priv->fbdev = msm_fbdev_init(dev); - #endif -@@ -819,18 +831,110 @@ static const struct dev_pm_ops msm_pm_ops = { - }; - - /* -+ * Componentized driver support: -+ */ -+ -+#ifdef CONFIG_OF -+/* NOTE: the CONFIG_OF case duplicates the same code as exynos or imx -+ * (or probably any other).. so probably some room for some helpers -+ */ -+static int compare_of(struct device *dev, void *data) -+{ -+ return dev->of_node == data; -+} -+ -+static int msm_drm_add_components(struct device *master, struct master *m) -+{ -+ struct device_node *np = master->of_node; -+ unsigned i; -+ int ret; -+ -+ for (i = 0; ; i++) { -+ struct device_node *node; -+ -+ node = of_parse_phandle(np, "connectors", i); -+ if (!node) -+ break; -+ -+ ret = component_master_add_child(m, compare_of, node); -+ of_node_put(node); -+ -+ if (ret) -+ return ret; -+ } -+ return 0; -+} -+#else -+static int compare_dev(struct device *dev, void *data) -+{ -+ return dev == data; -+} -+ -+static int msm_drm_add_components(struct device *master, struct master *m) -+{ -+ /* For non-DT case, it kinda sucks. We don't actually have a way -+ * to know whether or not we are waiting for certain devices (or if -+ * they are simply not present). But for non-DT we only need to -+ * care about apq8064/apq8060/etc (all mdp4/a3xx): -+ */ -+ static const char *devnames[] = { -+ "hdmi_msm.0", "kgsl-3d0.0", -+ }; -+ int i; -+ -+ DBG("Adding components.."); -+ -+ for (i = 0; i < ARRAY_SIZE(devnames); i++) { -+ struct device *dev; -+ int ret; -+ -+ dev = bus_find_device_by_name(&platform_bus_type, -+ NULL, devnames[i]); -+ if (!dev) { -+ dev_info(master, "still waiting for %s\n", devnames[i]); -+ return -EPROBE_DEFER; -+ } -+ -+ ret = component_master_add_child(m, compare_dev, dev); -+ if (ret) { -+ DBG("could not add child: %d", ret); -+ return ret; -+ } -+ } -+ -+ return 0; -+} -+#endif -+ -+static int msm_drm_bind(struct device *dev) -+{ -+ return drm_platform_init(&msm_driver, to_platform_device(dev)); -+} -+ -+static void msm_drm_unbind(struct device *dev) -+{ -+ drm_put_dev(platform_get_drvdata(to_platform_device(dev))); -+} -+ -+static const struct component_master_ops msm_drm_ops = { -+ .add_components = msm_drm_add_components, -+ .bind = msm_drm_bind, -+ .unbind = msm_drm_unbind, -+}; -+ -+/* - * Platform driver: - */ - - static int msm_pdev_probe(struct platform_device *pdev) - { - pdev->dev.coherent_dma_mask = DMA_BIT_MASK(32); -- return drm_platform_init(&msm_driver, pdev); -+ return component_master_add(&pdev->dev, &msm_drm_ops); - } - - static int msm_pdev_remove(struct platform_device *pdev) - { -- drm_put_dev(platform_get_drvdata(pdev)); -+ component_master_del(&pdev->dev, &msm_drm_ops); - - return 0; - } -diff --git a/drivers/gpu/drm/msm/msm_drv.h b/drivers/gpu/drm/msm/msm_drv.h -index 3d63269c5b29..9d10ee0b5aac 100644 ---- a/drivers/gpu/drm/msm/msm_drv.h -+++ b/drivers/gpu/drm/msm/msm_drv.h -@@ -22,6 +22,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -69,6 +70,9 @@ struct msm_drm_private { - - struct msm_kms *kms; - -+ /* subordinate devices, if present: */ -+ struct platform_device *hdmi_pdev, *gpu_pdev; -+ - /* when we have more than one 'msm_gpu' these need to be an array: */ - struct msm_gpu *gpu; - struct msm_file_private *lastctx; -diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c -index 663394f0c166..0db3e208f02a 100644 ---- a/drivers/gpu/drm/radeon/atombios_crtc.c -+++ b/drivers/gpu/drm/radeon/atombios_crtc.c -@@ -330,8 +330,10 @@ atombios_set_crtc_dtd_timing(struct drm_crtc *crtc, - misc |= ATOM_COMPOSITESYNC; - if (mode->flags & DRM_MODE_FLAG_INTERLACE) - misc |= ATOM_INTERLACE; -- if (mode->flags & DRM_MODE_FLAG_DBLSCAN) -+ if (mode->flags & DRM_MODE_FLAG_DBLCLK) - misc |= ATOM_DOUBLE_CLOCK_MODE; -+ if (mode->flags & DRM_MODE_FLAG_DBLSCAN) -+ misc |= ATOM_H_REPLICATIONBY2 | ATOM_V_REPLICATIONBY2; - - args.susModeMiscInfo.usAccess = cpu_to_le16(misc); - args.ucCRTC = radeon_crtc->crtc_id; -@@ -374,8 +376,10 @@ static void atombios_crtc_set_timing(struct drm_crtc *crtc, - misc |= ATOM_COMPOSITESYNC; - if (mode->flags & DRM_MODE_FLAG_INTERLACE) - misc |= ATOM_INTERLACE; -- if (mode->flags & DRM_MODE_FLAG_DBLSCAN) -+ if (mode->flags & DRM_MODE_FLAG_DBLCLK) - misc |= ATOM_DOUBLE_CLOCK_MODE; -+ if (mode->flags & DRM_MODE_FLAG_DBLSCAN) -+ misc |= ATOM_H_REPLICATIONBY2 | ATOM_V_REPLICATIONBY2; - - args.susModeMiscInfo.usAccess = cpu_to_le16(misc); - args.ucCRTC = radeon_crtc->crtc_id; -diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c -index e99e71a6ea59..356f22f90a05 100644 ---- a/drivers/hv/channel.c -+++ b/drivers/hv/channel.c -@@ -134,7 +134,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size, - GFP_KERNEL); - if (!open_info) { - err = -ENOMEM; -- goto error0; -+ goto error_gpadl; - } - - init_completion(&open_info->waitevent); -@@ -150,7 +150,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size, - - if (userdatalen > MAX_USER_DEFINED_BYTES) { - err = -EINVAL; -- goto error0; -+ goto error_gpadl; - } - - if (userdatalen) -@@ -194,6 +194,9 @@ error1: - list_del(&open_info->msglistentry); - spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags); - -+error_gpadl: -+ vmbus_teardown_gpadl(newchannel, newchannel->ringbuffer_gpadlhandle); -+ - error0: - free_pages((unsigned long)out, - get_order(send_ringbuffer_size + recv_ringbuffer_size)); -diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c -index 5fb80b8962a2..43fe15a0e5cc 100644 ---- a/drivers/i2c/i2c-core.c -+++ b/drivers/i2c/i2c-core.c -@@ -217,6 +217,7 @@ int i2c_generic_scl_recovery(struct i2c_adapter *adap) - adap->bus_recovery_info->set_scl(adap, 1); - return i2c_generic_recovery(adap); - } -+EXPORT_SYMBOL_GPL(i2c_generic_scl_recovery); - - int i2c_generic_gpio_recovery(struct i2c_adapter *adap) - { -@@ -231,6 +232,7 @@ int i2c_generic_gpio_recovery(struct i2c_adapter *adap) - - return ret; - } -+EXPORT_SYMBOL_GPL(i2c_generic_gpio_recovery); - - int i2c_recover_bus(struct i2c_adapter *adap) - { -@@ -240,6 +242,7 @@ int i2c_recover_bus(struct i2c_adapter *adap) - dev_dbg(&adap->dev, "Trying i2c bus recovery\n"); - return adap->bus_recovery_info->recover_bus(adap); - } -+EXPORT_SYMBOL_GPL(i2c_recover_bus); - - static int i2c_device_probe(struct device *dev) - { -diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c -index 055ebebc07dd..c1fef27010d4 100644 ---- a/drivers/infiniband/core/umem.c -+++ b/drivers/infiniband/core/umem.c -@@ -94,12 +94,15 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr, - if (dmasync) - dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs); - -+ if (!size) -+ return ERR_PTR(-EINVAL); -+ - /* - * If the combination of the addr and size requested for this memory - * region causes an integer overflow, return error. - */ -- if ((PAGE_ALIGN(addr + size) <= size) || -- (PAGE_ALIGN(addr + size) <= addr)) -+ if (((addr + size) < addr) || -+ PAGE_ALIGN(addr + size) < (addr + size)) - return ERR_PTR(-EINVAL); - - if (!can_do_mlock()) -diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c -index d8f4d1fe8494..8d7cd98c9671 100644 ---- a/drivers/infiniband/hw/mlx4/qp.c -+++ b/drivers/infiniband/hw/mlx4/qp.c -@@ -2274,8 +2274,7 @@ static int build_lso_seg(struct mlx4_wqe_lso_seg *wqe, struct ib_send_wr *wr, - - memcpy(wqe->header, wr->wr.ud.header, wr->wr.ud.hlen); - -- *lso_hdr_sz = cpu_to_be32((wr->wr.ud.mss - wr->wr.ud.hlen) << 16 | -- wr->wr.ud.hlen); -+ *lso_hdr_sz = cpu_to_be32(wr->wr.ud.mss << 16 | wr->wr.ud.hlen); - *lso_seg_len = halign; - return 0; - } -diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c -index 0b75b5764f31..cfc5a2e6dcce 100644 ---- a/drivers/input/mouse/elantech.c -+++ b/drivers/input/mouse/elantech.c -@@ -814,6 +814,21 @@ static psmouse_ret_t elantech_process_byte(struct psmouse *psmouse) - } - - /* -+ * This writes the reg_07 value again to the hardware at the end of every -+ * set_rate call because the register loses its value. reg_07 allows setting -+ * absolute mode on v4 hardware -+ */ -+static void elantech_set_rate_restore_reg_07(struct psmouse *psmouse, -+ unsigned int rate) -+{ -+ struct elantech_data *etd = psmouse->private; -+ -+ etd->original_set_rate(psmouse, rate); -+ if (elantech_write_reg(psmouse, 0x07, etd->reg_07)) -+ psmouse_err(psmouse, "restoring reg_07 failed\n"); -+} -+ -+/* - * Put the touchpad into absolute mode - */ - static int elantech_set_absolute_mode(struct psmouse *psmouse) -@@ -1015,6 +1030,8 @@ static int elantech_get_resolution_v4(struct psmouse *psmouse, - * Asus K53SV 0x450f01 78, 15, 0c 2 hw buttons - * Asus G46VW 0x460f02 00, 18, 0c 2 hw buttons - * Asus G750JX 0x360f00 00, 16, 0c 2 hw buttons -+ * Asus TP500LN 0x381f17 10, 14, 0e clickpad -+ * Asus X750JN 0x381f17 10, 14, 0e clickpad - * Asus UX31 0x361f00 20, 15, 0e clickpad - * Asus UX32VD 0x361f02 00, 15, 0e clickpad - * Avatar AVIU-145A2 0x361f00 ? clickpad -@@ -1490,6 +1507,11 @@ int elantech_init(struct psmouse *psmouse) - goto init_fail; - } - -+ if (etd->fw_version == 0x381f17) { -+ etd->original_set_rate = psmouse->set_rate; -+ psmouse->set_rate = elantech_set_rate_restore_reg_07; -+ } -+ - if (elantech_set_input_params(psmouse)) { - psmouse_err(psmouse, "failed to query touchpad range.\n"); - goto init_fail; -diff --git a/drivers/input/mouse/elantech.h b/drivers/input/mouse/elantech.h -index 9e0e2a1f340d..59263a3a8667 100644 ---- a/drivers/input/mouse/elantech.h -+++ b/drivers/input/mouse/elantech.h -@@ -139,6 +139,7 @@ struct elantech_data { - struct finger_pos mt[ETP_MAX_FINGERS]; - unsigned char parity[256]; - int (*send_cmd)(struct psmouse *psmouse, unsigned char c, unsigned char *param); -+ void (*original_set_rate)(struct psmouse *psmouse, unsigned int rate); - }; - - #ifdef CONFIG_MOUSE_PS2_ELANTECH -diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c -index 4a8d19d0a5a4..5a4cda24e302 100644 ---- a/drivers/md/dm-crypt.c -+++ b/drivers/md/dm-crypt.c -@@ -915,11 +915,10 @@ static int crypt_convert(struct crypt_config *cc, - - switch (r) { - /* async */ -+ case -EINPROGRESS: - case -EBUSY: - wait_for_completion(&ctx->restart); - reinit_completion(&ctx->restart); -- /* fall through*/ -- case -EINPROGRESS: - ctx->req = NULL; - ctx->cc_sector++; - continue; -@@ -1314,10 +1313,8 @@ static void kcryptd_async_done(struct crypto_async_request *async_req, - struct dm_crypt_io *io = container_of(ctx, struct dm_crypt_io, ctx); - struct crypt_config *cc = io->cc; - -- if (error == -EINPROGRESS) { -- complete(&ctx->restart); -+ if (error == -EINPROGRESS) - return; -- } - - if (!error && cc->iv_gen_ops && cc->iv_gen_ops->post) - error = cc->iv_gen_ops->post(cc, iv_of_dmreq(cc, dmreq), dmreq); -@@ -1328,12 +1325,15 @@ static void kcryptd_async_done(struct crypto_async_request *async_req, - mempool_free(req_of_dmreq(cc, dmreq), cc->req_pool); - - if (!atomic_dec_and_test(&ctx->cc_pending)) -- return; -+ goto done; - - if (bio_data_dir(io->base_bio) == READ) - kcryptd_crypt_read_done(io); - else - kcryptd_crypt_write_io_submit(io, 1); -+done: -+ if (!completion_done(&ctx->restart)) -+ complete(&ctx->restart); - } - - static void kcryptd_crypt(struct work_struct *work) -diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c -index 407a99e46f69..683e685ed697 100644 ---- a/drivers/md/raid0.c -+++ b/drivers/md/raid0.c -@@ -320,7 +320,7 @@ static struct strip_zone *find_zone(struct r0conf *conf, - - /* - * remaps the bio to the target device. we separate two flows. -- * power 2 flow and a general flow for the sake of perfromance -+ * power 2 flow and a general flow for the sake of performance - */ - static struct md_rdev *map_sector(struct mddev *mddev, struct strip_zone *zone, - sector_t sector, sector_t *sector_offset) -@@ -538,6 +538,7 @@ static void raid0_make_request(struct mddev *mddev, struct bio *bio) - split = bio; - } - -+ sector = bio->bi_iter.bi_sector; - zone = find_zone(mddev->private, §or); - tmp_dev = map_sector(mddev, zone, sector, §or); - split->bi_bdev = tmp_dev->bdev; -diff --git a/drivers/media/usb/stk1160/stk1160-v4l.c b/drivers/media/usb/stk1160/stk1160-v4l.c -index c45c9881bb5f..4572530346fb 100644 ---- a/drivers/media/usb/stk1160/stk1160-v4l.c -+++ b/drivers/media/usb/stk1160/stk1160-v4l.c -@@ -244,6 +244,11 @@ static int stk1160_stop_streaming(struct stk1160 *dev) - if (mutex_lock_interruptible(&dev->v4l_lock)) - return -ERESTARTSYS; - -+ /* -+ * Once URBs are cancelled, the URB complete handler -+ * won't be running. This is required to safely release the -+ * current buffer (dev->isoc_ctl.buf). -+ */ - stk1160_cancel_isoc(dev); - - /* -@@ -624,8 +629,16 @@ void stk1160_clear_queue(struct stk1160 *dev) - stk1160_info("buffer [%p/%d] aborted\n", - buf, buf->vb.v4l2_buf.index); - } -- /* It's important to clear current buffer */ -- dev->isoc_ctl.buf = NULL; -+ -+ /* It's important to release the current buffer */ -+ if (dev->isoc_ctl.buf) { -+ buf = dev->isoc_ctl.buf; -+ dev->isoc_ctl.buf = NULL; -+ -+ vb2_buffer_done(&buf->vb, VB2_BUF_STATE_ERROR); -+ stk1160_info("buffer [%p/%d] aborted\n", -+ buf, buf->vb.v4l2_buf.index); -+ } - spin_unlock_irqrestore(&dev->buf_lock, flags); - } - -diff --git a/drivers/memstick/core/mspro_block.c b/drivers/memstick/core/mspro_block.c -index fc145d202c46..922a750640e8 100644 ---- a/drivers/memstick/core/mspro_block.c -+++ b/drivers/memstick/core/mspro_block.c -@@ -758,7 +758,7 @@ static int mspro_block_complete_req(struct memstick_dev *card, int error) - - if (error || (card->current_mrq.tpc == MSPRO_CMD_STOP)) { - if (msb->data_dir == READ) { -- for (cnt = 0; cnt < msb->current_seg; cnt++) -+ for (cnt = 0; cnt < msb->current_seg; cnt++) { - t_len += msb->req_sg[cnt].length - / msb->page_size; - -@@ -766,6 +766,7 @@ static int mspro_block_complete_req(struct memstick_dev *card, int error) - t_len += msb->current_page - 1; - - t_len *= msb->page_size; -+ } - } - } else - t_len = blk_rq_bytes(msb->block_req); -diff --git a/drivers/mtd/ubi/attach.c b/drivers/mtd/ubi/attach.c -index 6f27d9a1be3b..21841fe25ad3 100644 ---- a/drivers/mtd/ubi/attach.c -+++ b/drivers/mtd/ubi/attach.c -@@ -408,7 +408,7 @@ int ubi_compare_lebs(struct ubi_device *ubi, const struct ubi_ainf_peb *aeb, - second_is_newer = !second_is_newer; - } else { - dbg_bld("PEB %d CRC is OK", pnum); -- bitflips = !!err; -+ bitflips |= !!err; - } - mutex_unlock(&ubi->buf_mutex); - -diff --git a/drivers/mtd/ubi/cdev.c b/drivers/mtd/ubi/cdev.c -index 8ca49f2043e4..4cbbd5531133 100644 ---- a/drivers/mtd/ubi/cdev.c -+++ b/drivers/mtd/ubi/cdev.c -@@ -451,7 +451,7 @@ static long vol_cdev_ioctl(struct file *file, unsigned int cmd, - /* Validate the request */ - err = -EINVAL; - if (req.lnum < 0 || req.lnum >= vol->reserved_pebs || -- req.bytes < 0 || req.lnum >= vol->usable_leb_size) -+ req.bytes < 0 || req.bytes > vol->usable_leb_size) - break; - - err = get_exclusive(desc); -diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c -index 0e11671dadc4..930cf2c77abb 100644 ---- a/drivers/mtd/ubi/eba.c -+++ b/drivers/mtd/ubi/eba.c -@@ -1362,7 +1362,8 @@ int ubi_eba_init(struct ubi_device *ubi, struct ubi_attach_info *ai) - * during re-size. - */ - ubi_move_aeb_to_list(av, aeb, &ai->erase); -- vol->eba_tbl[aeb->lnum] = aeb->pnum; -+ else -+ vol->eba_tbl[aeb->lnum] = aeb->pnum; - } - } - -diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c -index 68b924ec222e..c6b0b078ab99 100644 ---- a/drivers/mtd/ubi/wl.c -+++ b/drivers/mtd/ubi/wl.c -@@ -995,7 +995,7 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk, - int cancel) - { - int err, scrubbing = 0, torture = 0, protect = 0, erroneous = 0; -- int vol_id = -1, uninitialized_var(lnum); -+ int vol_id = -1, lnum = -1; - #ifdef CONFIG_MTD_UBI_FASTMAP - int anchor = wrk->anchor; - #endif -diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c -index 46e6544ed1b7..b655fe4f4c2e 100644 ---- a/drivers/net/ethernet/intel/e1000/e1000_main.c -+++ b/drivers/net/ethernet/intel/e1000/e1000_main.c -@@ -144,6 +144,11 @@ static bool e1000_clean_rx_irq(struct e1000_adapter *adapter, - static bool e1000_clean_jumbo_rx_irq(struct e1000_adapter *adapter, - struct e1000_rx_ring *rx_ring, - int *work_done, int work_to_do); -+static void e1000_alloc_dummy_rx_buffers(struct e1000_adapter *adapter, -+ struct e1000_rx_ring *rx_ring, -+ int cleaned_count) -+{ -+} - static void e1000_alloc_rx_buffers(struct e1000_adapter *adapter, - struct e1000_rx_ring *rx_ring, - int cleaned_count); -@@ -3531,8 +3536,11 @@ static int e1000_change_mtu(struct net_device *netdev, int new_mtu) - msleep(1); - /* e1000_down has a dependency on max_frame_size */ - hw->max_frame_size = max_frame; -- if (netif_running(netdev)) -+ if (netif_running(netdev)) { -+ /* prevent buffers from being reallocated */ -+ adapter->alloc_rx_buf = e1000_alloc_dummy_rx_buffers; - e1000_down(adapter); -+ } - - /* NOTE: netdev_alloc_skb reserves 16 bytes, and typically NET_IP_ALIGN - * means we reserve 2 more, this pushes us to allocate from the next -diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c -index f58316769159..66c92a16da29 100644 ---- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c -+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c -@@ -314,6 +314,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = { - {RTL_USB_DEVICE(0x07b8, 0x8188, rtl92cu_hal_cfg)}, /*Abocom - Abocom*/ - {RTL_USB_DEVICE(0x07b8, 0x8189, rtl92cu_hal_cfg)}, /*Funai - Abocom*/ - {RTL_USB_DEVICE(0x0846, 0x9041, rtl92cu_hal_cfg)}, /*NetGear WNA1000M*/ -+ {RTL_USB_DEVICE(0x0b05, 0x17ba, rtl92cu_hal_cfg)}, /*ASUS-Edimax*/ - {RTL_USB_DEVICE(0x0bda, 0x5088, rtl92cu_hal_cfg)}, /*Thinkware-CC&C*/ - {RTL_USB_DEVICE(0x0df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/ - {RTL_USB_DEVICE(0x0df6, 0x005c, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/ -@@ -370,6 +371,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = { - {RTL_USB_DEVICE(0x2001, 0x3307, rtl92cu_hal_cfg)}, /*D-Link-Cameo*/ - {RTL_USB_DEVICE(0x2001, 0x3309, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/ - {RTL_USB_DEVICE(0x2001, 0x330a, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/ -+ {RTL_USB_DEVICE(0x2001, 0x330d, rtl92cu_hal_cfg)}, /*D-Link DWA-131 */ - {RTL_USB_DEVICE(0x2019, 0xab2b, rtl92cu_hal_cfg)}, /*Planex -Abocom*/ - {RTL_USB_DEVICE(0x20f4, 0x624d, rtl92cu_hal_cfg)}, /*TRENDNet*/ - {RTL_USB_DEVICE(0x2357, 0x0100, rtl92cu_hal_cfg)}, /*TP-Link WN8200ND*/ -diff --git a/drivers/net/wireless/ti/wl18xx/debugfs.c b/drivers/net/wireless/ti/wl18xx/debugfs.c -index 7f1669cdea09..779dc2b2ca75 100644 ---- a/drivers/net/wireless/ti/wl18xx/debugfs.c -+++ b/drivers/net/wireless/ti/wl18xx/debugfs.c -@@ -136,7 +136,7 @@ WL18XX_DEBUGFS_FWSTATS_FILE(rx_filter, protection_filter, "%u"); - WL18XX_DEBUGFS_FWSTATS_FILE(rx_filter, accum_arp_pend_requests, "%u"); - WL18XX_DEBUGFS_FWSTATS_FILE(rx_filter, max_arp_queue_dep, "%u"); - --WL18XX_DEBUGFS_FWSTATS_FILE(rx_rate, rx_frames_per_rates, "%u"); -+WL18XX_DEBUGFS_FWSTATS_FILE_ARRAY(rx_rate, rx_frames_per_rates, 50); - - WL18XX_DEBUGFS_FWSTATS_FILE_ARRAY(aggr_size, tx_agg_vs_rate, - AGGR_STATS_TX_AGG*AGGR_STATS_TX_RATE); -diff --git a/drivers/net/wireless/ti/wlcore/debugfs.h b/drivers/net/wireless/ti/wlcore/debugfs.h -index f7381dd69009..1bce4325e86b 100644 ---- a/drivers/net/wireless/ti/wlcore/debugfs.h -+++ b/drivers/net/wireless/ti/wlcore/debugfs.h -@@ -26,8 +26,8 @@ - - #include "wlcore.h" - --int wl1271_format_buffer(char __user *userbuf, size_t count, -- loff_t *ppos, char *fmt, ...); -+__printf(4, 5) int wl1271_format_buffer(char __user *userbuf, size_t count, -+ loff_t *ppos, char *fmt, ...); - - int wl1271_debugfs_init(struct wl1271 *wl); - void wl1271_debugfs_exit(struct wl1271 *wl); -diff --git a/drivers/platform/x86/compal-laptop.c b/drivers/platform/x86/compal-laptop.c -index 7297df2ebf50..2d9d1985adc1 100644 ---- a/drivers/platform/x86/compal-laptop.c -+++ b/drivers/platform/x86/compal-laptop.c -@@ -1037,7 +1037,9 @@ static int compal_probe(struct platform_device *pdev) - - /* Power supply */ - initialize_power_supply_data(data); -- power_supply_register(&compal_device->dev, &data->psy); -+ err = power_supply_register(&compal_device->dev, &data->psy); -+ if (err < 0) -+ goto remove; - - platform_set_drvdata(pdev, data); - -diff --git a/drivers/power/lp8788-charger.c b/drivers/power/lp8788-charger.c -index ed49b50b220b..72da2a6c22db 100644 ---- a/drivers/power/lp8788-charger.c -+++ b/drivers/power/lp8788-charger.c -@@ -417,8 +417,10 @@ static int lp8788_psy_register(struct platform_device *pdev, - pchg->battery.num_properties = ARRAY_SIZE(lp8788_battery_prop); - pchg->battery.get_property = lp8788_battery_get_property; - -- if (power_supply_register(&pdev->dev, &pchg->battery)) -+ if (power_supply_register(&pdev->dev, &pchg->battery)) { -+ power_supply_unregister(&pchg->charger); - return -EPERM; -+ } - - return 0; - } -diff --git a/drivers/power/twl4030_madc_battery.c b/drivers/power/twl4030_madc_battery.c -index 7ef445a6cfa6..cf907609ec49 100644 ---- a/drivers/power/twl4030_madc_battery.c -+++ b/drivers/power/twl4030_madc_battery.c -@@ -192,6 +192,7 @@ static int twl4030_madc_battery_probe(struct platform_device *pdev) - { - struct twl4030_madc_battery *twl4030_madc_bat; - struct twl4030_madc_bat_platform_data *pdata = pdev->dev.platform_data; -+ int ret = 0; - - twl4030_madc_bat = kzalloc(sizeof(*twl4030_madc_bat), GFP_KERNEL); - if (!twl4030_madc_bat) -@@ -216,9 +217,11 @@ static int twl4030_madc_battery_probe(struct platform_device *pdev) - - twl4030_madc_bat->pdata = pdata; - platform_set_drvdata(pdev, twl4030_madc_bat); -- power_supply_register(&pdev->dev, &twl4030_madc_bat->psy); -+ ret = power_supply_register(&pdev->dev, &twl4030_madc_bat->psy); -+ if (ret < 0) -+ kfree(twl4030_madc_bat); - -- return 0; -+ return ret; - } - - static int twl4030_madc_battery_remove(struct platform_device *pdev) -diff --git a/drivers/scsi/bfa/bfa_ioc.c b/drivers/scsi/bfa/bfa_ioc.c -index 65180e15de6e..50c75e1fbf8a 100644 ---- a/drivers/scsi/bfa/bfa_ioc.c -+++ b/drivers/scsi/bfa/bfa_ioc.c -@@ -7006,7 +7006,7 @@ bfa_flash_sem_get(void __iomem *bar) - while (!bfa_raw_sem_get(bar)) { - if (--n <= 0) - return BFA_STATUS_BADFLASH; -- udelay(10000); -+ mdelay(10); - } - return BFA_STATUS_OK; - } -diff --git a/drivers/scsi/mvsas/mv_sas.c b/drivers/scsi/mvsas/mv_sas.c -index 6c1f223a8e1d..4c0b8b4e1d40 100644 ---- a/drivers/scsi/mvsas/mv_sas.c -+++ b/drivers/scsi/mvsas/mv_sas.c -@@ -441,14 +441,11 @@ static u32 mvs_get_ncq_tag(struct sas_task *task, u32 *tag) - static int mvs_task_prep_ata(struct mvs_info *mvi, - struct mvs_task_exec_info *tei) - { -- struct sas_ha_struct *sha = mvi->sas; - struct sas_task *task = tei->task; - struct domain_device *dev = task->dev; - struct mvs_device *mvi_dev = dev->lldd_dev; - struct mvs_cmd_hdr *hdr = tei->hdr; - struct asd_sas_port *sas_port = dev->port; -- struct sas_phy *sphy = dev->phy; -- struct asd_sas_phy *sas_phy = sha->sas_phy[sphy->number]; - struct mvs_slot_info *slot; - void *buf_prd; - u32 tag = tei->tag, hdr_tag; -@@ -468,7 +465,7 @@ static int mvs_task_prep_ata(struct mvs_info *mvi, - slot->tx = mvi->tx_prod; - del_q = TXQ_MODE_I | tag | - (TXQ_CMD_STP << TXQ_CMD_SHIFT) | -- (MVS_PHY_ID << TXQ_PHY_SHIFT) | -+ ((sas_port->phy_mask & TXQ_PHY_MASK) << TXQ_PHY_SHIFT) | - (mvi_dev->taskfileset << TXQ_SRS_SHIFT); - mvi->tx[mvi->tx_prod] = cpu_to_le32(del_q); - -diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c -index 86b05151fdab..97892f258043 100644 ---- a/drivers/scsi/storvsc_drv.c -+++ b/drivers/scsi/storvsc_drv.c -@@ -739,21 +739,22 @@ static unsigned int copy_to_bounce_buffer(struct scatterlist *orig_sgl, - if (bounce_sgl[j].length == PAGE_SIZE) { - /* full..move to next entry */ - sg_kunmap_atomic(bounce_addr); -+ bounce_addr = 0; - j++; -+ } - -- /* if we need to use another bounce buffer */ -- if (srclen || i != orig_sgl_count - 1) -- bounce_addr = sg_kmap_atomic(bounce_sgl,j); -+ /* if we need to use another bounce buffer */ -+ if (srclen && bounce_addr == 0) -+ bounce_addr = sg_kmap_atomic(bounce_sgl, j); - -- } else if (srclen == 0 && i == orig_sgl_count - 1) { -- /* unmap the last bounce that is < PAGE_SIZE */ -- sg_kunmap_atomic(bounce_addr); -- } - } - - sg_kunmap_atomic(src_addr - orig_sgl[i].offset); - } - -+ if (bounce_addr) -+ sg_kunmap_atomic(bounce_addr); -+ - local_irq_restore(flags); - - return total_copied; -diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c -index d7c6e36021e8..2fe5b61d886a 100644 ---- a/drivers/spi/spidev.c -+++ b/drivers/spi/spidev.c -@@ -243,7 +243,10 @@ static int spidev_message(struct spidev_data *spidev, - k_tmp->len = u_tmp->len; - - total += k_tmp->len; -- if (total > bufsiz) { -+ /* Check total length of transfers. Also check each -+ * transfer length to avoid arithmetic overflow. -+ */ -+ if (total > bufsiz || k_tmp->len > bufsiz) { - status = -EMSGSIZE; - goto done; - } -diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c -index 41eff7d64cb8..b199f1e21d0e 100644 ---- a/drivers/target/target_core_file.c -+++ b/drivers/target/target_core_file.c -@@ -263,40 +263,32 @@ static int fd_do_prot_rw(struct se_cmd *cmd, struct fd_prot *fd_prot, - struct se_device *se_dev = cmd->se_dev; - struct fd_dev *dev = FD_DEV(se_dev); - struct file *prot_fd = dev->fd_prot_file; -- struct scatterlist *sg; - loff_t pos = (cmd->t_task_lba * se_dev->prot_length); - unsigned char *buf; -- u32 prot_size, len, size; -- int rc, ret = 1, i; -+ u32 prot_size; -+ int rc, ret = 1; - - prot_size = (cmd->data_length / se_dev->dev_attrib.block_size) * - se_dev->prot_length; - - if (!is_write) { -- fd_prot->prot_buf = vzalloc(prot_size); -+ fd_prot->prot_buf = kzalloc(prot_size, GFP_KERNEL); - if (!fd_prot->prot_buf) { - pr_err("Unable to allocate fd_prot->prot_buf\n"); - return -ENOMEM; - } - buf = fd_prot->prot_buf; - -- fd_prot->prot_sg_nents = cmd->t_prot_nents; -- fd_prot->prot_sg = kzalloc(sizeof(struct scatterlist) * -- fd_prot->prot_sg_nents, GFP_KERNEL); -+ fd_prot->prot_sg_nents = 1; -+ fd_prot->prot_sg = kzalloc(sizeof(struct scatterlist), -+ GFP_KERNEL); - if (!fd_prot->prot_sg) { - pr_err("Unable to allocate fd_prot->prot_sg\n"); -- vfree(fd_prot->prot_buf); -+ kfree(fd_prot->prot_buf); - return -ENOMEM; - } -- size = prot_size; -- -- for_each_sg(fd_prot->prot_sg, sg, fd_prot->prot_sg_nents, i) { -- -- len = min_t(u32, PAGE_SIZE, size); -- sg_set_buf(sg, buf, len); -- size -= len; -- buf += len; -- } -+ sg_init_table(fd_prot->prot_sg, fd_prot->prot_sg_nents); -+ sg_set_buf(fd_prot->prot_sg, buf, prot_size); - } - - if (is_write) { -@@ -317,7 +309,7 @@ static int fd_do_prot_rw(struct se_cmd *cmd, struct fd_prot *fd_prot, - - if (is_write || ret < 0) { - kfree(fd_prot->prot_sg); -- vfree(fd_prot->prot_buf); -+ kfree(fd_prot->prot_buf); - } - - return ret; -@@ -652,11 +644,11 @@ fd_execute_rw(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents, - 0, fd_prot.prot_sg, 0); - if (rc) { - kfree(fd_prot.prot_sg); -- vfree(fd_prot.prot_buf); -+ kfree(fd_prot.prot_buf); - return rc; - } - kfree(fd_prot.prot_sg); -- vfree(fd_prot.prot_buf); -+ kfree(fd_prot.prot_buf); - } - } else { - memset(&fd_prot, 0, sizeof(struct fd_prot)); -@@ -672,7 +664,7 @@ fd_execute_rw(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents, - 0, fd_prot.prot_sg, 0); - if (rc) { - kfree(fd_prot.prot_sg); -- vfree(fd_prot.prot_buf); -+ kfree(fd_prot.prot_buf); - return rc; - } - } -@@ -703,7 +695,7 @@ fd_execute_rw(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents, - - if (ret < 0) { - kfree(fd_prot.prot_sg); -- vfree(fd_prot.prot_buf); -+ kfree(fd_prot.prot_buf); - return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE; - } - -diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c -index 68511e83486b..f89b24a09b19 100644 ---- a/drivers/target/target_core_sbc.c -+++ b/drivers/target/target_core_sbc.c -@@ -314,7 +314,7 @@ sbc_setup_write_same(struct se_cmd *cmd, unsigned char *flags, struct sbc_ops *o - return 0; - } - --static sense_reason_t xdreadwrite_callback(struct se_cmd *cmd) -+static sense_reason_t xdreadwrite_callback(struct se_cmd *cmd, bool success) - { - unsigned char *buf, *addr; - struct scatterlist *sg; -@@ -378,7 +378,7 @@ sbc_execute_rw(struct se_cmd *cmd) - cmd->data_direction); - } - --static sense_reason_t compare_and_write_post(struct se_cmd *cmd) -+static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success) - { - struct se_device *dev = cmd->se_dev; - -@@ -401,7 +401,7 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd) - return TCM_NO_SENSE; - } - --static sense_reason_t compare_and_write_callback(struct se_cmd *cmd) -+static sense_reason_t compare_and_write_callback(struct se_cmd *cmd, bool success) - { - struct se_device *dev = cmd->se_dev; - struct scatterlist *write_sg = NULL, *sg; -@@ -416,11 +416,16 @@ static sense_reason_t compare_and_write_callback(struct se_cmd *cmd) - - /* - * Handle early failure in transport_generic_request_failure(), -- * which will not have taken ->caw_mutex yet.. -+ * which will not have taken ->caw_sem yet.. - */ -- if (!cmd->t_data_sg || !cmd->t_bidi_data_sg) -+ if (!success && (!cmd->t_data_sg || !cmd->t_bidi_data_sg)) - return TCM_NO_SENSE; - /* -+ * Handle special case for zero-length COMPARE_AND_WRITE -+ */ -+ if (!cmd->data_length) -+ goto out; -+ /* - * Immediately exit + release dev->caw_sem if command has already - * been failed with a non-zero SCSI status. - */ -diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c -index 9e54c0fe718d..6fc38903046c 100644 ---- a/drivers/target/target_core_transport.c -+++ b/drivers/target/target_core_transport.c -@@ -1600,11 +1600,11 @@ void transport_generic_request_failure(struct se_cmd *cmd, - transport_complete_task_attr(cmd); - /* - * Handle special case for COMPARE_AND_WRITE failure, where the -- * callback is expected to drop the per device ->caw_mutex. -+ * callback is expected to drop the per device ->caw_sem. - */ - if ((cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE) && - cmd->transport_complete_callback) -- cmd->transport_complete_callback(cmd); -+ cmd->transport_complete_callback(cmd, false); - - switch (sense_reason) { - case TCM_NON_EXISTENT_LUN: -@@ -1941,8 +1941,12 @@ static void target_complete_ok_work(struct work_struct *work) - if (cmd->transport_complete_callback) { - sense_reason_t rc; - -- rc = cmd->transport_complete_callback(cmd); -+ rc = cmd->transport_complete_callback(cmd, true); - if (!rc && !(cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE_POST)) { -+ if ((cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE) && -+ !cmd->data_length) -+ goto queue_rsp; -+ - return; - } else if (rc) { - ret = transport_send_check_condition_and_sense(cmd, -@@ -1956,6 +1960,7 @@ static void target_complete_ok_work(struct work_struct *work) - } - } - -+queue_rsp: - switch (cmd->data_direction) { - case DMA_FROM_DEVICE: - spin_lock(&cmd->se_lun->lun_sep_lock); -@@ -2044,6 +2049,16 @@ static inline void transport_reset_sgl_orig(struct se_cmd *cmd) - static inline void transport_free_pages(struct se_cmd *cmd) - { - if (cmd->se_cmd_flags & SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC) { -+ /* -+ * Release special case READ buffer payload required for -+ * SG_TO_MEM_NOALLOC to function with COMPARE_AND_WRITE -+ */ -+ if (cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE) { -+ transport_free_sgl(cmd->t_bidi_data_sg, -+ cmd->t_bidi_data_nents); -+ cmd->t_bidi_data_sg = NULL; -+ cmd->t_bidi_data_nents = 0; -+ } - transport_reset_sgl_orig(cmd); - return; - } -@@ -2192,6 +2207,7 @@ sense_reason_t - transport_generic_new_cmd(struct se_cmd *cmd) - { - int ret = 0; -+ bool zero_flag = !(cmd->se_cmd_flags & SCF_SCSI_DATA_CDB); - - /* - * Determine is the TCM fabric module has already allocated physical -@@ -2200,7 +2216,6 @@ transport_generic_new_cmd(struct se_cmd *cmd) - */ - if (!(cmd->se_cmd_flags & SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC) && - cmd->data_length) { -- bool zero_flag = !(cmd->se_cmd_flags & SCF_SCSI_DATA_CDB); - - if ((cmd->se_cmd_flags & SCF_BIDI) || - (cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE)) { -@@ -2223,6 +2238,20 @@ transport_generic_new_cmd(struct se_cmd *cmd) - cmd->data_length, zero_flag); - if (ret < 0) - return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE; -+ } else if ((cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE) && -+ cmd->data_length) { -+ /* -+ * Special case for COMPARE_AND_WRITE with fabrics -+ * using SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC. -+ */ -+ u32 caw_length = cmd->t_task_nolb * -+ cmd->se_dev->dev_attrib.block_size; -+ -+ ret = target_alloc_sgl(&cmd->t_bidi_data_sg, -+ &cmd->t_bidi_data_nents, -+ caw_length, zero_flag); -+ if (ret < 0) -+ return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE; - } - /* - * If this command is not a write we can execute it right here, -diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c -index a051a7a2b1bd..a81f9dd7ee97 100644 ---- a/drivers/usb/class/cdc-wdm.c -+++ b/drivers/usb/class/cdc-wdm.c -@@ -245,7 +245,7 @@ static void wdm_int_callback(struct urb *urb) - case USB_CDC_NOTIFY_RESPONSE_AVAILABLE: - dev_dbg(&desc->intf->dev, - "NOTIFY_RESPONSE_AVAILABLE received: index %d len %d", -- dr->wIndex, dr->wLength); -+ le16_to_cpu(dr->wIndex), le16_to_cpu(dr->wLength)); - break; - - case USB_CDC_NOTIFY_NETWORK_CONNECTION: -@@ -262,7 +262,9 @@ static void wdm_int_callback(struct urb *urb) - clear_bit(WDM_POLL_RUNNING, &desc->flags); - dev_err(&desc->intf->dev, - "unknown notification %d received: index %d len %d\n", -- dr->bNotificationType, dr->wIndex, dr->wLength); -+ dr->bNotificationType, -+ le16_to_cpu(dr->wIndex), -+ le16_to_cpu(dr->wLength)); - goto exit; - } - -@@ -408,7 +410,7 @@ static ssize_t wdm_write - USB_RECIP_INTERFACE); - req->bRequest = USB_CDC_SEND_ENCAPSULATED_COMMAND; - req->wValue = 0; -- req->wIndex = desc->inum; -+ req->wIndex = desc->inum; /* already converted */ - req->wLength = cpu_to_le16(count); - set_bit(WDM_IN_USE, &desc->flags); - desc->outbuf = buf; -@@ -422,7 +424,7 @@ static ssize_t wdm_write - rv = usb_translate_errors(rv); - } else { - dev_dbg(&desc->intf->dev, "Tx URB has been submitted index=%d", -- req->wIndex); -+ le16_to_cpu(req->wIndex)); - } - out: - usb_autopm_put_interface(desc->intf); -@@ -820,7 +822,7 @@ static int wdm_create(struct usb_interface *intf, struct usb_endpoint_descriptor - desc->irq->bRequestType = (USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE); - desc->irq->bRequest = USB_CDC_GET_ENCAPSULATED_RESPONSE; - desc->irq->wValue = 0; -- desc->irq->wIndex = desc->inum; -+ desc->irq->wIndex = desc->inum; /* already converted */ - desc->irq->wLength = cpu_to_le16(desc->wMaxCommand); - - usb_fill_control_urb( -diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c -index d2bd9d7c8f4b..1847a7d38026 100644 ---- a/drivers/usb/core/hub.c -+++ b/drivers/usb/core/hub.c -@@ -3289,10 +3289,10 @@ int usb_port_resume(struct usb_device *udev, pm_message_t msg) - dev_dbg(hub->intfdev, "can't resume port %d, status %d\n", - port1, status); - } else { -- /* drive resume for at least 20 msec */ -+ /* drive resume for USB_RESUME_TIMEOUT msec */ - dev_dbg(&udev->dev, "usb %sresume\n", - (PMSG_IS_AUTO(msg) ? "auto-" : "")); -- msleep(25); -+ msleep(USB_RESUME_TIMEOUT); - - /* Virtual root hubs can trigger on GET_PORT_STATUS to - * stop resume signaling. Then finish the resume -diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c -index 4d918ed8d343..0f9980088c08 100644 ---- a/drivers/usb/dwc2/hcd.c -+++ b/drivers/usb/dwc2/hcd.c -@@ -1501,7 +1501,7 @@ static int dwc2_hcd_hub_control(struct dwc2_hsotg *hsotg, u16 typereq, - dev_dbg(hsotg->dev, - "ClearPortFeature USB_PORT_FEAT_SUSPEND\n"); - writel(0, hsotg->regs + PCGCTL); -- usleep_range(20000, 40000); -+ msleep(USB_RESUME_TIMEOUT); - - hprt0 = dwc2_read_hprt0(hsotg); - hprt0 |= HPRT0_RES; -diff --git a/drivers/usb/host/fotg210-hcd.c b/drivers/usb/host/fotg210-hcd.c -index 98a89d16cc3e..8aa4ba0a0c69 100644 ---- a/drivers/usb/host/fotg210-hcd.c -+++ b/drivers/usb/host/fotg210-hcd.c -@@ -1595,7 +1595,7 @@ static int fotg210_hub_control( - /* resume signaling for 20 msec */ - fotg210_writel(fotg210, temp | PORT_RESUME, status_reg); - fotg210->reset_done[wIndex] = jiffies -- + msecs_to_jiffies(20); -+ + msecs_to_jiffies(USB_RESUME_TIMEOUT); - break; - case USB_PORT_FEAT_C_SUSPEND: - clear_bit(wIndex, &fotg210->port_c_suspend); -diff --git a/drivers/usb/host/fusbh200-hcd.c b/drivers/usb/host/fusbh200-hcd.c -index ba9499060f63..3e3926aa584e 100644 ---- a/drivers/usb/host/fusbh200-hcd.c -+++ b/drivers/usb/host/fusbh200-hcd.c -@@ -1550,10 +1550,9 @@ static int fusbh200_hub_control ( - if ((temp & PORT_PE) == 0) - goto error; - -- /* resume signaling for 20 msec */ - fusbh200_writel(fusbh200, temp | PORT_RESUME, status_reg); - fusbh200->reset_done[wIndex] = jiffies -- + msecs_to_jiffies(20); -+ + msecs_to_jiffies(USB_RESUME_TIMEOUT); - break; - case USB_PORT_FEAT_C_SUSPEND: - clear_bit(wIndex, &fusbh200->port_c_suspend); -diff --git a/drivers/usb/host/isp116x-hcd.c b/drivers/usb/host/isp116x-hcd.c -index 240e792c81a7..b62298fe0be8 100644 ---- a/drivers/usb/host/isp116x-hcd.c -+++ b/drivers/usb/host/isp116x-hcd.c -@@ -1487,7 +1487,7 @@ static int isp116x_bus_resume(struct usb_hcd *hcd) - spin_unlock_irq(&isp116x->lock); - - hcd->state = HC_STATE_RESUMING; -- msleep(20); -+ msleep(USB_RESUME_TIMEOUT); - - /* Go operational */ - spin_lock_irq(&isp116x->lock); -diff --git a/drivers/usb/host/r8a66597-hcd.c b/drivers/usb/host/r8a66597-hcd.c -index 110b4b9ebeaa..f130bb2f7bbe 100644 ---- a/drivers/usb/host/r8a66597-hcd.c -+++ b/drivers/usb/host/r8a66597-hcd.c -@@ -2300,7 +2300,7 @@ static int r8a66597_bus_resume(struct usb_hcd *hcd) - rh->port &= ~USB_PORT_STAT_SUSPEND; - rh->port |= USB_PORT_STAT_C_SUSPEND << 16; - r8a66597_mdfy(r8a66597, RESUME, RESUME | UACT, dvstctr_reg); -- msleep(50); -+ msleep(USB_RESUME_TIMEOUT); - r8a66597_mdfy(r8a66597, UACT, RESUME | UACT, dvstctr_reg); - } - -diff --git a/drivers/usb/host/sl811-hcd.c b/drivers/usb/host/sl811-hcd.c -index a517151867af..0f53cc8c8ecf 100644 ---- a/drivers/usb/host/sl811-hcd.c -+++ b/drivers/usb/host/sl811-hcd.c -@@ -1259,7 +1259,7 @@ sl811h_hub_control( - sl811_write(sl811, SL11H_CTLREG1, sl811->ctrl1); - - mod_timer(&sl811->timer, jiffies -- + msecs_to_jiffies(20)); -+ + msecs_to_jiffies(USB_RESUME_TIMEOUT)); - break; - case USB_PORT_FEAT_POWER: - port_power(sl811, 0); -diff --git a/drivers/usb/host/uhci-hub.c b/drivers/usb/host/uhci-hub.c -index 93e17b12fb33..98c66d88ebde 100644 ---- a/drivers/usb/host/uhci-hub.c -+++ b/drivers/usb/host/uhci-hub.c -@@ -165,7 +165,7 @@ static void uhci_check_ports(struct uhci_hcd *uhci) - /* Port received a wakeup request */ - set_bit(port, &uhci->resuming_ports); - uhci->ports_timeout = jiffies + -- msecs_to_jiffies(25); -+ msecs_to_jiffies(USB_RESUME_TIMEOUT); - usb_hcd_start_port_resume( - &uhci_to_hcd(uhci)->self, port); - -@@ -337,7 +337,8 @@ static int uhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, - uhci_finish_suspend(uhci, port, port_addr); - - /* USB v2.0 7.1.7.5 */ -- uhci->ports_timeout = jiffies + msecs_to_jiffies(50); -+ uhci->ports_timeout = jiffies + -+ msecs_to_jiffies(USB_RESUME_TIMEOUT); - break; - case USB_PORT_FEAT_POWER: - /* UHCI has no power switching */ -diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c -index a95eee8ddc38..05185b9d4495 100644 ---- a/drivers/usb/host/xhci-ring.c -+++ b/drivers/usb/host/xhci-ring.c -@@ -1768,7 +1768,7 @@ static void handle_port_status(struct xhci_hcd *xhci, - } else { - xhci_dbg(xhci, "resume HS port %d\n", port_id); - bus_state->resume_done[faked_port_index] = jiffies + -- msecs_to_jiffies(20); -+ msecs_to_jiffies(USB_RESUME_TIMEOUT); - set_bit(faked_port_index, &bus_state->resuming_ports); - mod_timer(&hcd->rh_timer, - bus_state->resume_done[faked_port_index]); -diff --git a/drivers/usb/phy/phy.c b/drivers/usb/phy/phy.c -index 0180eef05656..964ebafe8b44 100644 ---- a/drivers/usb/phy/phy.c -+++ b/drivers/usb/phy/phy.c -@@ -78,7 +78,9 @@ static void devm_usb_phy_release(struct device *dev, void *res) - - static int devm_usb_phy_match(struct device *dev, void *res, void *match_data) - { -- return res == match_data; -+ struct usb_phy **phy = res; -+ -+ return *phy == match_data; - } - - /** -diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c -index f4d7b2fc9ffb..78f46089a077 100644 ---- a/fs/binfmt_elf.c -+++ b/fs/binfmt_elf.c -@@ -751,6 +751,7 @@ static int load_elf_binary(struct linux_binprm *bprm) - i < loc->elf_ex.e_phnum; i++, elf_ppnt++) { - int elf_prot = 0, elf_flags; - unsigned long k, vaddr; -+ unsigned long total_size = 0; - - if (elf_ppnt->p_type != PT_LOAD) - continue; -@@ -815,10 +816,16 @@ static int load_elf_binary(struct linux_binprm *bprm) - #else - load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr); - #endif -+ total_size = total_mapping_size(elf_phdata, -+ loc->elf_ex.e_phnum); -+ if (!total_size) { -+ error = -EINVAL; -+ goto out_free_dentry; -+ } - } - - error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt, -- elf_prot, elf_flags, 0); -+ elf_prot, elf_flags, total_size); - if (BAD_ADDR(error)) { - send_sig(SIGKILL, current, 0); - retval = IS_ERR((void *)error) ? -diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c -index d2f1c011d73a..794d7c6ea9ee 100644 ---- a/fs/btrfs/extent-tree.c -+++ b/fs/btrfs/extent-tree.c -@@ -6645,12 +6645,11 @@ static int __btrfs_free_reserved_extent(struct btrfs_root *root, - return -ENOSPC; - } - -- if (btrfs_test_opt(root, DISCARD)) -- ret = btrfs_discard_extent(root, start, len, NULL); -- - if (pin) - pin_down_extent(root, cache, start, len, 1); - else { -+ if (btrfs_test_opt(root, DISCARD)) -+ ret = btrfs_discard_extent(root, start, len, NULL); - btrfs_add_free_space(cache, start, len); - btrfs_update_reserved_bytes(cache, len, RESERVE_FREE); - } -diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c -index 0b72006aecbe..3e16042338e4 100644 ---- a/fs/btrfs/ioctl.c -+++ b/fs/btrfs/ioctl.c -@@ -2708,6 +2708,9 @@ static int btrfs_extent_same(struct inode *src, u64 loff, u64 len, - if (src == dst) - return -EINVAL; - -+ if (len == 0) -+ return 0; -+ - btrfs_double_lock(src, loff, dst, dst_loff, len); - - ret = extent_same_check_offsets(src, loff, len); -@@ -3226,6 +3229,11 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd, - if (off + len == src->i_size) - len = ALIGN(src->i_size, bs) - off; - -+ if (len == 0) { -+ ret = 0; -+ goto out_unlock; -+ } -+ - /* verify the end result is block aligned */ - if (!IS_ALIGNED(off, bs) || !IS_ALIGNED(off + len, bs) || - !IS_ALIGNED(destoff, bs)) -diff --git a/fs/btrfs/xattr.c b/fs/btrfs/xattr.c -index ad8328d797ea..488e987c3374 100644 ---- a/fs/btrfs/xattr.c -+++ b/fs/btrfs/xattr.c -@@ -324,22 +324,42 @@ const struct xattr_handler *btrfs_xattr_handlers[] = { - /* - * Check if the attribute is in a supported namespace. - * -- * This applied after the check for the synthetic attributes in the system -+ * This is applied after the check for the synthetic attributes in the system - * namespace. - */ --static bool btrfs_is_valid_xattr(const char *name) -+static int btrfs_is_valid_xattr(const char *name) - { -- return !strncmp(name, XATTR_SECURITY_PREFIX, -- XATTR_SECURITY_PREFIX_LEN) || -- !strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN) || -- !strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN) || -- !strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN) || -- !strncmp(name, XATTR_BTRFS_PREFIX, XATTR_BTRFS_PREFIX_LEN); -+ int len = strlen(name); -+ int prefixlen = 0; -+ -+ if (!strncmp(name, XATTR_SECURITY_PREFIX, -+ XATTR_SECURITY_PREFIX_LEN)) -+ prefixlen = XATTR_SECURITY_PREFIX_LEN; -+ else if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN)) -+ prefixlen = XATTR_SYSTEM_PREFIX_LEN; -+ else if (!strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN)) -+ prefixlen = XATTR_TRUSTED_PREFIX_LEN; -+ else if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN)) -+ prefixlen = XATTR_USER_PREFIX_LEN; -+ else if (!strncmp(name, XATTR_BTRFS_PREFIX, XATTR_BTRFS_PREFIX_LEN)) -+ prefixlen = XATTR_BTRFS_PREFIX_LEN; -+ else -+ return -EOPNOTSUPP; -+ -+ /* -+ * The name cannot consist of just prefix -+ */ -+ if (len <= prefixlen) -+ return -EINVAL; -+ -+ return 0; - } - - ssize_t btrfs_getxattr(struct dentry *dentry, const char *name, - void *buffer, size_t size) - { -+ int ret; -+ - /* - * If this is a request for a synthetic attribute in the system.* - * namespace use the generic infrastructure to resolve a handler -@@ -348,8 +368,9 @@ ssize_t btrfs_getxattr(struct dentry *dentry, const char *name, - if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN)) - return generic_getxattr(dentry, name, buffer, size); - -- if (!btrfs_is_valid_xattr(name)) -- return -EOPNOTSUPP; -+ ret = btrfs_is_valid_xattr(name); -+ if (ret) -+ return ret; - return __btrfs_getxattr(dentry->d_inode, name, buffer, size); - } - -@@ -357,6 +378,7 @@ int btrfs_setxattr(struct dentry *dentry, const char *name, const void *value, - size_t size, int flags) - { - struct btrfs_root *root = BTRFS_I(dentry->d_inode)->root; -+ int ret; - - /* - * The permission on security.* and system.* is not checked -@@ -373,8 +395,9 @@ int btrfs_setxattr(struct dentry *dentry, const char *name, const void *value, - if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN)) - return generic_setxattr(dentry, name, value, size, flags); - -- if (!btrfs_is_valid_xattr(name)) -- return -EOPNOTSUPP; -+ ret = btrfs_is_valid_xattr(name); -+ if (ret) -+ return ret; - - if (!strncmp(name, XATTR_BTRFS_PREFIX, XATTR_BTRFS_PREFIX_LEN)) - return btrfs_set_prop(dentry->d_inode, name, -@@ -390,6 +413,7 @@ int btrfs_setxattr(struct dentry *dentry, const char *name, const void *value, - int btrfs_removexattr(struct dentry *dentry, const char *name) - { - struct btrfs_root *root = BTRFS_I(dentry->d_inode)->root; -+ int ret; - - /* - * The permission on security.* and system.* is not checked -@@ -406,8 +430,9 @@ int btrfs_removexattr(struct dentry *dentry, const char *name) - if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN)) - return generic_removexattr(dentry, name); - -- if (!btrfs_is_valid_xattr(name)) -- return -EOPNOTSUPP; -+ ret = btrfs_is_valid_xattr(name); -+ if (ret) -+ return ret; - - if (!strncmp(name, XATTR_BTRFS_PREFIX, XATTR_BTRFS_PREFIX_LEN)) - return btrfs_set_prop(dentry->d_inode, name, -diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c -index 2dcbfb6245d8..bc7e37bc0c5b 100644 ---- a/fs/ext4/namei.c -+++ b/fs/ext4/namei.c -@@ -1869,7 +1869,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry, - struct inode *inode) - { - struct inode *dir = dentry->d_parent->d_inode; -- struct buffer_head *bh; -+ struct buffer_head *bh = NULL; - struct ext4_dir_entry_2 *de; - struct ext4_dir_entry_tail *t; - struct super_block *sb; -@@ -1893,14 +1893,14 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry, - return retval; - if (retval == 1) { - retval = 0; -- return retval; -+ goto out; - } - } - - if (is_dx(dir)) { - retval = ext4_dx_add_entry(handle, dentry, inode); - if (!retval || (retval != ERR_BAD_DX_DIR)) -- return retval; -+ goto out; - ext4_clear_inode_flag(dir, EXT4_INODE_INDEX); - dx_fallback++; - ext4_mark_inode_dirty(handle, dir); -@@ -1912,14 +1912,15 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry, - return PTR_ERR(bh); - - retval = add_dirent_to_buf(handle, dentry, inode, NULL, bh); -- if (retval != -ENOSPC) { -- brelse(bh); -- return retval; -- } -+ if (retval != -ENOSPC) -+ goto out; - - if (blocks == 1 && !dx_fallback && -- EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX)) -- return make_indexed_dir(handle, dentry, inode, bh); -+ EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX)) { -+ retval = make_indexed_dir(handle, dentry, inode, bh); -+ bh = NULL; /* make_indexed_dir releases bh */ -+ goto out; -+ } - brelse(bh); - } - bh = ext4_append(handle, dir, &block); -@@ -1935,6 +1936,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry, - } - - retval = add_dirent_to_buf(handle, dentry, inode, de, bh); -+out: - brelse(bh); - if (retval == 0) - ext4_set_inode_state(inode, EXT4_STATE_NEWENTRY); -diff --git a/fs/namei.c b/fs/namei.c -index 0dd72c8e65fd..ccb8000f3459 100644 ---- a/fs/namei.c -+++ b/fs/namei.c -@@ -1545,7 +1545,8 @@ static inline int walk_component(struct nameidata *nd, struct path *path, - - if (should_follow_link(path->dentry, follow)) { - if (nd->flags & LOOKUP_RCU) { -- if (unlikely(unlazy_walk(nd, path->dentry))) { -+ if (unlikely(nd->path.mnt != path->mnt || -+ unlazy_walk(nd, path->dentry))) { - err = -ECHILD; - goto out_err; - } -@@ -2992,7 +2993,8 @@ finish_lookup: - - if (should_follow_link(path->dentry, !symlink_ok)) { - if (nd->flags & LOOKUP_RCU) { -- if (unlikely(unlazy_walk(nd, path->dentry))) { -+ if (unlikely(nd->path.mnt != path->mnt || -+ unlazy_walk(nd, path->dentry))) { - error = -ECHILD; - goto out; - } -diff --git a/fs/open.c b/fs/open.c -index 2ed7325f713e..17679f2b2f1c 100644 ---- a/fs/open.c -+++ b/fs/open.c -@@ -539,6 +539,7 @@ static int chown_common(struct path *path, uid_t user, gid_t group) - uid = make_kuid(current_user_ns(), user); - gid = make_kgid(current_user_ns(), group); - -+retry_deleg: - newattrs.ia_valid = ATTR_CTIME; - if (user != (uid_t) -1) { - if (!uid_valid(uid)) -@@ -555,7 +556,6 @@ static int chown_common(struct path *path, uid_t user, gid_t group) - if (!S_ISDIR(inode->i_mode)) - newattrs.ia_valid |= - ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_KILL_PRIV; --retry_deleg: - mutex_lock(&inode->i_mutex); - error = security_path_chown(path, uid, gid); - if (!error) -diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h -index 68a3ada689c9..8fc12f80b616 100644 ---- a/include/acpi/actypes.h -+++ b/include/acpi/actypes.h -@@ -198,9 +198,29 @@ typedef int INT32; - typedef s32 acpi_native_int; - - typedef u32 acpi_size; -+ -+#ifdef ACPI_32BIT_PHYSICAL_ADDRESS -+ -+/* -+ * OSPMs can define this to shrink the size of the structures for 32-bit -+ * none PAE environment. ASL compiler may always define this to generate -+ * 32-bit OSPM compliant tables. -+ */ - typedef u32 acpi_io_address; - typedef u32 acpi_physical_address; - -+#else /* ACPI_32BIT_PHYSICAL_ADDRESS */ -+ -+/* -+ * It is reported that, after some calculations, the physical addresses can -+ * wrap over the 32-bit boundary on 32-bit PAE environment. -+ * https://bugzilla.kernel.org/show_bug.cgi?id=87971 -+ */ -+typedef u64 acpi_io_address; -+typedef u64 acpi_physical_address; -+ -+#endif /* ACPI_32BIT_PHYSICAL_ADDRESS */ -+ - #define ACPI_MAX_PTR ACPI_UINT32_MAX - #define ACPI_SIZE_MAX ACPI_UINT32_MAX - -diff --git a/include/acpi/platform/acenv.h b/include/acpi/platform/acenv.h -index b402eb67af83..579912c7156c 100644 ---- a/include/acpi/platform/acenv.h -+++ b/include/acpi/platform/acenv.h -@@ -76,6 +76,7 @@ - #define ACPI_LARGE_NAMESPACE_NODE - #define ACPI_DATA_TABLE_DISASSEMBLY - #define ACPI_SINGLE_THREADED -+#define ACPI_32BIT_PHYSICAL_ADDRESS - #endif - - /* acpi_exec configuration. Multithreaded with full AML debugger */ -diff --git a/include/asm-generic/sections.h b/include/asm-generic/sections.h -index f1a24b5c3b90..b58fd667f87b 100644 ---- a/include/asm-generic/sections.h -+++ b/include/asm-generic/sections.h -@@ -3,6 +3,8 @@ - - /* References to section boundaries */ - -+#include -+ - /* - * Usage guidelines: - * _text, _data: architecture specific, don't use them in arch-independent code -@@ -37,6 +39,8 @@ extern char __start_rodata[], __end_rodata[]; - /* Start and end of .ctors section - used for constructor calls. */ - extern char __ctors_start[], __ctors_end[]; - -+extern __visible const void __nosave_begin, __nosave_end; -+ - /* function descriptor handling (if any). Override - * in asm/sections.h */ - #ifndef dereference_function_descriptor -diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h -index ad8f85908a56..ab3133797ff7 100644 ---- a/include/linux/skbuff.h -+++ b/include/linux/skbuff.h -@@ -661,6 +661,7 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from, - - struct sk_buff *__alloc_skb(unsigned int size, gfp_t priority, int flags, - int node); -+struct sk_buff *__build_skb(void *data, unsigned int frag_size); - struct sk_buff *build_skb(void *data, unsigned int frag_size); - static inline struct sk_buff *alloc_skb(unsigned int size, - gfp_t priority) -diff --git a/include/linux/usb.h b/include/linux/usb.h -index 7f6eb859873e..49466beab90d 100644 ---- a/include/linux/usb.h -+++ b/include/linux/usb.h -@@ -206,6 +206,32 @@ void usb_put_intf(struct usb_interface *intf); - #define USB_MAXINTERFACES 32 - #define USB_MAXIADS (USB_MAXINTERFACES/2) - -+/* -+ * USB Resume Timer: Every Host controller driver should drive the resume -+ * signalling on the bus for the amount of time defined by this macro. -+ * -+ * That way we will have a 'stable' behavior among all HCDs supported by Linux. -+ * -+ * Note that the USB Specification states we should drive resume for *at least* -+ * 20 ms, but it doesn't give an upper bound. This creates two possible -+ * situations which we want to avoid: -+ * -+ * (a) sometimes an msleep(20) might expire slightly before 20 ms, which causes -+ * us to fail USB Electrical Tests, thus failing Certification -+ * -+ * (b) Some (many) devices actually need more than 20 ms of resume signalling, -+ * and while we can argue that's against the USB Specification, we don't have -+ * control over which devices a certification laboratory will be using for -+ * certification. If CertLab uses a device which was tested against Windows and -+ * that happens to have relaxed resume signalling rules, we might fall into -+ * situations where we fail interoperability and electrical tests. -+ * -+ * In order to avoid both conditions, we're using a 40 ms resume timeout, which -+ * should cope with both LPJ calibration errors and devices not following every -+ * detail of the USB Specification. -+ */ -+#define USB_RESUME_TIMEOUT 40 /* ms */ -+ - /** - * struct usb_interface_cache - long-term representation of a device interface - * @num_altsetting: number of altsettings defined. -diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h -index 349325404add..e4b9e011d2a1 100644 ---- a/include/target/target_core_base.h -+++ b/include/target/target_core_base.h -@@ -513,7 +513,7 @@ struct se_cmd { - sense_reason_t (*execute_cmd)(struct se_cmd *); - sense_reason_t (*execute_rw)(struct se_cmd *, struct scatterlist *, - u32, enum dma_data_direction); -- sense_reason_t (*transport_complete_callback)(struct se_cmd *); -+ sense_reason_t (*transport_complete_callback)(struct se_cmd *, bool); - - unsigned char *t_task_cdb; - unsigned char __t_task_cdb[TCM_MAX_COMMAND_SIZE]; -diff --git a/kernel/ptrace.c b/kernel/ptrace.c -index 1f4bcb3cc21c..be9760f8284a 100644 ---- a/kernel/ptrace.c -+++ b/kernel/ptrace.c -@@ -720,6 +720,8 @@ static int ptrace_peek_siginfo(struct task_struct *child, - static int ptrace_resume(struct task_struct *child, long request, - unsigned long data) - { -+ bool need_siglock; -+ - if (!valid_signal(data)) - return -EIO; - -@@ -747,8 +749,26 @@ static int ptrace_resume(struct task_struct *child, long request, - user_disable_single_step(child); - } - -+ /* -+ * Change ->exit_code and ->state under siglock to avoid the race -+ * with wait_task_stopped() in between; a non-zero ->exit_code will -+ * wrongly look like another report from tracee. -+ * -+ * Note that we need siglock even if ->exit_code == data and/or this -+ * status was not reported yet, the new status must not be cleared by -+ * wait_task_stopped() after resume. -+ * -+ * If data == 0 we do not care if wait_task_stopped() reports the old -+ * status and clears the code too; this can't race with the tracee, it -+ * takes siglock after resume. -+ */ -+ need_siglock = data && !thread_group_empty(current); -+ if (need_siglock) -+ spin_lock_irq(&child->sighand->siglock); - child->exit_code = data; - wake_up_state(child, __TASK_TRACED); -+ if (need_siglock) -+ spin_unlock_irq(&child->sighand->siglock); - - return 0; - } -diff --git a/kernel/softirq.c b/kernel/softirq.c -index 490fcbb1dc5b..93be750348c8 100644 ---- a/kernel/softirq.c -+++ b/kernel/softirq.c -@@ -657,9 +657,13 @@ static void run_ksoftirqd(unsigned int cpu) - * in the task stack here. - */ - __do_softirq(); -- rcu_note_context_switch(cpu); - local_irq_enable(); - cond_resched(); -+ -+ preempt_disable(); -+ rcu_note_context_switch(cpu); -+ preempt_enable(); -+ - return; - } - local_irq_enable(); -diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c -index 774a0807fe81..da41de9dc319 100644 ---- a/kernel/trace/ring_buffer.c -+++ b/kernel/trace/ring_buffer.c -@@ -2651,7 +2651,7 @@ static DEFINE_PER_CPU(unsigned int, current_context); - - static __always_inline int trace_recursive_lock(void) - { -- unsigned int val = this_cpu_read(current_context); -+ unsigned int val = __this_cpu_read(current_context); - int bit; - - if (in_interrupt()) { -@@ -2668,18 +2668,17 @@ static __always_inline int trace_recursive_lock(void) - return 1; - - val |= (1 << bit); -- this_cpu_write(current_context, val); -+ __this_cpu_write(current_context, val); - - return 0; - } - - static __always_inline void trace_recursive_unlock(void) - { -- unsigned int val = this_cpu_read(current_context); -+ unsigned int val = __this_cpu_read(current_context); - -- val--; -- val &= this_cpu_read(current_context); -- this_cpu_write(current_context, val); -+ val &= val & (val - 1); -+ __this_cpu_write(current_context, val); - } - - #else -diff --git a/lib/string.c b/lib/string.c -index 43d0781daf47..cb9ea2181557 100644 ---- a/lib/string.c -+++ b/lib/string.c -@@ -598,7 +598,7 @@ EXPORT_SYMBOL(memset); - void memzero_explicit(void *s, size_t count) - { - memset(s, 0, count); -- OPTIMIZER_HIDE_VAR(s); -+ barrier(); - } - EXPORT_SYMBOL(memzero_explicit); - -diff --git a/net/core/skbuff.c b/net/core/skbuff.c -index e2b1bba69882..69ec61abfb37 100644 ---- a/net/core/skbuff.c -+++ b/net/core/skbuff.c -@@ -278,13 +278,14 @@ nodata: - EXPORT_SYMBOL(__alloc_skb); - - /** -- * build_skb - build a network buffer -+ * __build_skb - build a network buffer - * @data: data buffer provided by caller -- * @frag_size: size of fragment, or 0 if head was kmalloced -+ * @frag_size: size of data, or 0 if head was kmalloced - * - * Allocate a new &sk_buff. Caller provides space holding head and - * skb_shared_info. @data must have been allocated by kmalloc() only if -- * @frag_size is 0, otherwise data should come from the page allocator. -+ * @frag_size is 0, otherwise data should come from the page allocator -+ * or vmalloc() - * The return is the new skb buffer. - * On a failure the return is %NULL, and @data is not freed. - * Notes : -@@ -295,7 +296,7 @@ EXPORT_SYMBOL(__alloc_skb); - * before giving packet to stack. - * RX rings only contains data buffers, not full skbs. - */ --struct sk_buff *build_skb(void *data, unsigned int frag_size) -+struct sk_buff *__build_skb(void *data, unsigned int frag_size) - { - struct skb_shared_info *shinfo; - struct sk_buff *skb; -@@ -309,7 +310,6 @@ struct sk_buff *build_skb(void *data, unsigned int frag_size) - - memset(skb, 0, offsetof(struct sk_buff, tail)); - skb->truesize = SKB_TRUESIZE(size); -- skb->head_frag = frag_size != 0; - atomic_set(&skb->users, 1); - skb->head = data; - skb->data = data; -@@ -326,6 +326,23 @@ struct sk_buff *build_skb(void *data, unsigned int frag_size) - - return skb; - } -+ -+/* build_skb() is wrapper over __build_skb(), that specifically -+ * takes care of skb->head and skb->pfmemalloc -+ * This means that if @frag_size is not zero, then @data must be backed -+ * by a page fragment, not kmalloc() or vmalloc() -+ */ -+struct sk_buff *build_skb(void *data, unsigned int frag_size) -+{ -+ struct sk_buff *skb = __build_skb(data, frag_size); -+ -+ if (skb && frag_size) { -+ skb->head_frag = 1; -+ if (virt_to_head_page(data)->pfmemalloc) -+ skb->pfmemalloc = 1; -+ } -+ return skb; -+} - EXPORT_SYMBOL(build_skb); - - struct netdev_alloc_cache { -@@ -352,7 +369,8 @@ refill: - gfp_t gfp = gfp_mask; - - if (order) -- gfp |= __GFP_COMP | __GFP_NOWARN; -+ gfp |= __GFP_COMP | __GFP_NOWARN | -+ __GFP_NOMEMALLOC; - nc->frag.page = alloc_pages(gfp, order); - if (likely(nc->frag.page)) - break; -diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c -index ecb34b5ea42f..57075c4508f7 100644 ---- a/net/ipv4/ip_forward.c -+++ b/net/ipv4/ip_forward.c -@@ -127,6 +127,9 @@ int ip_forward(struct sk_buff *skb) - struct rtable *rt; /* Route we use */ - struct ip_options *opt = &(IPCB(skb)->opt); - -+ if (unlikely(skb->sk)) -+ goto drop; -+ - if (skb_warn_if_lro(skb)) - goto drop; - -diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c -index 8c70c73da347..a68cd7100349 100644 ---- a/net/ipv4/tcp_output.c -+++ b/net/ipv4/tcp_output.c -@@ -2595,39 +2595,65 @@ begin_fwd: - } - } - --/* Send a fin. The caller locks the socket for us. This cannot be -- * allowed to fail queueing a FIN frame under any circumstances. -+/* We allow to exceed memory limits for FIN packets to expedite -+ * connection tear down and (memory) recovery. -+ * Otherwise tcp_send_fin() could be tempted to either delay FIN -+ * or even be forced to close flow without any FIN. -+ */ -+static void sk_forced_wmem_schedule(struct sock *sk, int size) -+{ -+ int amt, status; -+ -+ if (size <= sk->sk_forward_alloc) -+ return; -+ amt = sk_mem_pages(size); -+ sk->sk_forward_alloc += amt * SK_MEM_QUANTUM; -+ sk_memory_allocated_add(sk, amt, &status); -+} -+ -+/* Send a FIN. The caller locks the socket for us. -+ * We should try to send a FIN packet really hard, but eventually give up. - */ - void tcp_send_fin(struct sock *sk) - { -+ struct sk_buff *skb, *tskb = tcp_write_queue_tail(sk); - struct tcp_sock *tp = tcp_sk(sk); -- struct sk_buff *skb = tcp_write_queue_tail(sk); -- int mss_now; - -- /* Optimization, tack on the FIN if we have a queue of -- * unsent frames. But be careful about outgoing SACKS -- * and IP options. -+ /* Optimization, tack on the FIN if we have one skb in write queue and -+ * this skb was not yet sent, or we are under memory pressure. -+ * Note: in the latter case, FIN packet will be sent after a timeout, -+ * as TCP stack thinks it has already been transmitted. - */ -- mss_now = tcp_current_mss(sk); -- -- if (tcp_send_head(sk) != NULL) { -- TCP_SKB_CB(skb)->tcp_flags |= TCPHDR_FIN; -- TCP_SKB_CB(skb)->end_seq++; -+ if (tskb && (tcp_send_head(sk) || sk_under_memory_pressure(sk))) { -+coalesce: -+ TCP_SKB_CB(tskb)->tcp_flags |= TCPHDR_FIN; -+ TCP_SKB_CB(tskb)->end_seq++; - tp->write_seq++; -+ if (!tcp_send_head(sk)) { -+ /* This means tskb was already sent. -+ * Pretend we included the FIN on previous transmit. -+ * We need to set tp->snd_nxt to the value it would have -+ * if FIN had been sent. This is because retransmit path -+ * does not change tp->snd_nxt. -+ */ -+ tp->snd_nxt++; -+ return; -+ } - } else { -- /* Socket is locked, keep trying until memory is available. */ -- for (;;) { -- skb = sk_stream_alloc_skb(sk, 0, sk->sk_allocation); -- if (skb) -- break; -- yield(); -+ skb = alloc_skb_fclone(MAX_TCP_HEADER, sk->sk_allocation); -+ if (unlikely(!skb)) { -+ if (tskb) -+ goto coalesce; -+ return; - } -+ skb_reserve(skb, MAX_TCP_HEADER); -+ sk_forced_wmem_schedule(sk, skb->truesize); - /* FIN eats a sequence byte, write_seq advanced by tcp_queue_skb(). */ - tcp_init_nondata_skb(skb, tp->write_seq, - TCPHDR_ACK | TCPHDR_FIN); - tcp_queue_skb(sk, skb); - } -- __tcp_push_pending_frames(sk, mss_now, TCP_NAGLE_OFF); -+ __tcp_push_pending_frames(sk, tcp_current_mss(sk), TCP_NAGLE_OFF); - } - - /* We get here when a process closes a file descriptor (either due to -diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c -index 1d52506bda14..a0b0ea949192 100644 ---- a/net/netlink/af_netlink.c -+++ b/net/netlink/af_netlink.c -@@ -1624,13 +1624,11 @@ static struct sk_buff *netlink_alloc_large_skb(unsigned int size, - if (data == NULL) - return NULL; - -- skb = build_skb(data, size); -+ skb = __build_skb(data, size); - if (skb == NULL) - vfree(data); -- else { -- skb->head_frag = 0; -+ else - skb->destructor = netlink_skb_destructor; -- } - - return skb; - } -diff --git a/sound/pci/emu10k1/emuproc.c b/sound/pci/emu10k1/emuproc.c -index 2ca9f2e93139..53745f4c2bf5 100644 ---- a/sound/pci/emu10k1/emuproc.c -+++ b/sound/pci/emu10k1/emuproc.c -@@ -241,31 +241,22 @@ static void snd_emu10k1_proc_spdif_read(struct snd_info_entry *entry, - struct snd_emu10k1 *emu = entry->private_data; - u32 value; - u32 value2; -- unsigned long flags; - u32 rate; - - if (emu->card_capabilities->emu_model) { -- spin_lock_irqsave(&emu->emu_lock, flags); - snd_emu1010_fpga_read(emu, 0x38, &value); -- spin_unlock_irqrestore(&emu->emu_lock, flags); - if ((value & 0x1) == 0) { -- spin_lock_irqsave(&emu->emu_lock, flags); - snd_emu1010_fpga_read(emu, 0x2a, &value); - snd_emu1010_fpga_read(emu, 0x2b, &value2); -- spin_unlock_irqrestore(&emu->emu_lock, flags); - rate = 0x1770000 / (((value << 5) | value2)+1); - snd_iprintf(buffer, "ADAT Locked : %u\n", rate); - } else { - snd_iprintf(buffer, "ADAT Unlocked\n"); - } -- spin_lock_irqsave(&emu->emu_lock, flags); - snd_emu1010_fpga_read(emu, 0x20, &value); -- spin_unlock_irqrestore(&emu->emu_lock, flags); - if ((value & 0x4) == 0) { -- spin_lock_irqsave(&emu->emu_lock, flags); - snd_emu1010_fpga_read(emu, 0x28, &value); - snd_emu1010_fpga_read(emu, 0x29, &value2); -- spin_unlock_irqrestore(&emu->emu_lock, flags); - rate = 0x1770000 / (((value << 5) | value2)+1); - snd_iprintf(buffer, "SPDIF Locked : %d\n", rate); - } else { -@@ -410,14 +401,11 @@ static void snd_emu_proc_emu1010_reg_read(struct snd_info_entry *entry, - { - struct snd_emu10k1 *emu = entry->private_data; - u32 value; -- unsigned long flags; - int i; - snd_iprintf(buffer, "EMU1010 Registers:\n\n"); - - for(i = 0; i < 0x40; i+=1) { -- spin_lock_irqsave(&emu->emu_lock, flags); - snd_emu1010_fpga_read(emu, i, &value); -- spin_unlock_irqrestore(&emu->emu_lock, flags); - snd_iprintf(buffer, "%02X: %08X, %02X\n", i, value, (value >> 8) & 0x7f); - } - } -diff --git a/sound/soc/davinci/davinci-evm.c b/sound/soc/davinci/davinci-evm.c -index 5e3bc3c6801a..f40a7a4b6591 100644 ---- a/sound/soc/davinci/davinci-evm.c -+++ b/sound/soc/davinci/davinci-evm.c -@@ -384,18 +384,8 @@ static int davinci_evm_probe(struct platform_device *pdev) - return ret; - } - --static int davinci_evm_remove(struct platform_device *pdev) --{ -- struct snd_soc_card *card = platform_get_drvdata(pdev); -- -- snd_soc_unregister_card(card); -- -- return 0; --} -- - static struct platform_driver davinci_evm_driver = { - .probe = davinci_evm_probe, -- .remove = davinci_evm_remove, - .driver = { - .name = "davinci_evm", - .owner = THIS_MODULE, -diff --git a/tools/lib/traceevent/kbuffer-parse.c b/tools/lib/traceevent/kbuffer-parse.c -index dcc665228c71..deb3569ab004 100644 ---- a/tools/lib/traceevent/kbuffer-parse.c -+++ b/tools/lib/traceevent/kbuffer-parse.c -@@ -372,7 +372,6 @@ translate_data(struct kbuffer *kbuf, void *data, void **rptr, - switch (type_len) { - case KBUFFER_TYPE_PADDING: - *length = read_4(kbuf, data); -- data += *length; - break; - - case KBUFFER_TYPE_TIME_EXTEND: -diff --git a/tools/power/x86/turbostat/Makefile b/tools/power/x86/turbostat/Makefile -index d1b3a361e526..4039854560d0 100644 ---- a/tools/power/x86/turbostat/Makefile -+++ b/tools/power/x86/turbostat/Makefile -@@ -1,8 +1,12 @@ - CC = $(CROSS_COMPILE)gcc --BUILD_OUTPUT := $(PWD) -+BUILD_OUTPUT := $(CURDIR) - PREFIX := /usr - DESTDIR := - -+ifeq ("$(origin O)", "command line") -+ BUILD_OUTPUT := $(O) -+endif -+ - turbostat : turbostat.c - CFLAGS += -Wall - CFLAGS += -DMSRHEADER='"../../../../arch/x86/include/uapi/asm/msr-index.h"' -diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c -index 66112533b1e9..eed250e9c218 100644 ---- a/virt/kvm/kvm_main.c -+++ b/virt/kvm/kvm_main.c -@@ -1549,8 +1549,8 @@ int kvm_gfn_to_hva_cache_init(struct kvm *kvm, struct gfn_to_hva_cache *ghc, - ghc->generation = slots->generation; - ghc->len = len; - ghc->memslot = gfn_to_memslot(kvm, start_gfn); -- ghc->hva = gfn_to_hva_many(ghc->memslot, start_gfn, &nr_pages_avail); -- if (!kvm_is_error_hva(ghc->hva) && nr_pages_avail >= nr_pages_needed) { -+ ghc->hva = gfn_to_hva_many(ghc->memslot, start_gfn, NULL); -+ if (!kvm_is_error_hva(ghc->hva) && nr_pages_needed <= 1) { - ghc->hva += offset; - } else { - /* diff --git a/patch/kernel/odroidc2-default/patch-3.14.41-42.patch b/patch/kernel/odroidc2-default/patch-3.14.41-42.patch deleted file mode 100644 index 3f6eb7b9bd..0000000000 --- a/patch/kernel/odroidc2-default/patch-3.14.41-42.patch +++ /dev/null @@ -1,1142 +0,0 @@ -diff --git a/Makefile b/Makefile -index 7a60d4a1301c..b9d850d86366 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 3 - PATCHLEVEL = 14 --SUBLEVEL = 41 -+SUBLEVEL = 42 - EXTRAVERSION = - NAME = Remembering Coco - -diff --git a/arch/arc/kernel/signal.c b/arch/arc/kernel/signal.c -index d68b410595c8..a0c63fc48457 100644 ---- a/arch/arc/kernel/signal.c -+++ b/arch/arc/kernel/signal.c -@@ -131,6 +131,15 @@ SYSCALL_DEFINE0(rt_sigreturn) - /* Don't restart from sigreturn */ - syscall_wont_restart(regs); - -+ /* -+ * Ensure that sigreturn always returns to user mode (in case the -+ * regs saved on user stack got fudged between save and sigreturn) -+ * Otherwise it is easy to panic the kernel with a custom -+ * signal handler and/or restorer which clobberes the status32/ret -+ * to return to a bogus location in kernel mode. -+ */ -+ regs->status32 |= STATUS_U_MASK; -+ - return regs->r0; - - badframe: -@@ -234,8 +243,11 @@ setup_rt_frame(int signo, struct k_sigaction *ka, siginfo_t *info, - - /* - * handler returns using sigreturn stub provided already by userpsace -+ * If not, nuke the process right away - */ -- BUG_ON(!(ka->sa.sa_flags & SA_RESTORER)); -+ if(!(ka->sa.sa_flags & SA_RESTORER)) -+ return 1; -+ - regs->blink = (unsigned long)ka->sa.sa_restorer; - - /* User Stack for signal handler will be above the frame just carved */ -@@ -302,12 +314,12 @@ handle_signal(unsigned long sig, struct k_sigaction *ka, siginfo_t *info, - struct pt_regs *regs) - { - sigset_t *oldset = sigmask_to_save(); -- int ret; -+ int failed; - - /* Set up the stack frame */ -- ret = setup_rt_frame(sig, ka, info, oldset, regs); -+ failed = setup_rt_frame(sig, ka, info, oldset, regs); - -- if (ret) -+ if (failed) - force_sigsegv(sig, current); - else - signal_delivered(sig, info, ka, regs, 0); -diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c -index 275a7dc2b06c..63688d3a6ea0 100644 ---- a/drivers/block/rbd.c -+++ b/drivers/block/rbd.c -@@ -2084,6 +2084,11 @@ static bool rbd_img_obj_end_request(struct rbd_obj_request *obj_request) - result, xferred); - if (!img_request->result) - img_request->result = result; -+ /* -+ * Need to end I/O on the entire obj_request worth of -+ * bytes in case of error. -+ */ -+ xferred = obj_request->length; - } - - /* Image object requests don't own their page array */ -diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c -index 35bf2bba69bf..11804cc1e11f 100644 ---- a/drivers/gpu/drm/radeon/si_dpm.c -+++ b/drivers/gpu/drm/radeon/si_dpm.c -@@ -2913,6 +2913,7 @@ struct si_dpm_quirk { - static struct si_dpm_quirk si_dpm_quirk_list[] = { - /* PITCAIRN - https://bugs.freedesktop.org/show_bug.cgi?id=76490 */ - { PCI_VENDOR_ID_ATI, 0x6810, 0x1462, 0x3036, 0, 120000 }, -+ { PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0xe271, 0, 120000 }, - { 0, 0, 0, 0 }, - }; - -diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c -index 505fe29c75b0..8c248818592e 100644 ---- a/drivers/hv/channel_mgmt.c -+++ b/drivers/hv/channel_mgmt.c -@@ -716,7 +716,7 @@ int vmbus_request_offers(void) - { - struct vmbus_channel_message_header *msg; - struct vmbus_channel_msginfo *msginfo; -- int ret, t; -+ int ret; - - msginfo = kmalloc(sizeof(*msginfo) + - sizeof(struct vmbus_channel_message_header), -@@ -724,8 +724,6 @@ int vmbus_request_offers(void) - if (!msginfo) - return -ENOMEM; - -- init_completion(&msginfo->waitevent); -- - msg = (struct vmbus_channel_message_header *)msginfo->msg; - - msg->msgtype = CHANNELMSG_REQUESTOFFERS; -@@ -739,14 +737,6 @@ int vmbus_request_offers(void) - goto cleanup; - } - -- t = wait_for_completion_timeout(&msginfo->waitevent, 5*HZ); -- if (t == 0) { -- ret = -ETIMEDOUT; -- goto cleanup; -- } -- -- -- - cleanup: - kfree(msginfo); - -diff --git a/drivers/mtd/ubi/misc.c b/drivers/mtd/ubi/misc.c -index f913d701a5b3..c4b1af07a121 100644 ---- a/drivers/mtd/ubi/misc.c -+++ b/drivers/mtd/ubi/misc.c -@@ -74,6 +74,8 @@ int ubi_check_volume(struct ubi_device *ubi, int vol_id) - for (i = 0; i < vol->used_ebs; i++) { - int size; - -+ cond_resched(); -+ - if (i == vol->used_ebs - 1) - size = vol->last_eb_bytes; - else -diff --git a/drivers/platform/x86/compal-laptop.c b/drivers/platform/x86/compal-laptop.c -index 2d9d1985adc1..54407a8209b5 100644 ---- a/drivers/platform/x86/compal-laptop.c -+++ b/drivers/platform/x86/compal-laptop.c -@@ -1027,9 +1027,9 @@ static int compal_probe(struct platform_device *pdev) - if (err) - return err; - -- hwmon_dev = hwmon_device_register_with_groups(&pdev->dev, -- DRIVER_NAME, data, -- compal_hwmon_groups); -+ hwmon_dev = devm_hwmon_device_register_with_groups(&pdev->dev, -+ DRIVER_NAME, data, -+ compal_hwmon_groups); - if (IS_ERR(hwmon_dev)) { - err = PTR_ERR(hwmon_dev); - goto remove; -diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c -index 0a7325361d29..5f57e3d35e26 100644 ---- a/drivers/scsi/3w-9xxx.c -+++ b/drivers/scsi/3w-9xxx.c -@@ -149,7 +149,6 @@ static int twa_reset_sequence(TW_Device_Extension *tw_dev, int soft_reset); - static int twa_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, char *cdb, int use_sg, TW_SG_Entry *sglistarg); - static void twa_scsiop_execute_scsi_complete(TW_Device_Extension *tw_dev, int request_id); - static char *twa_string_lookup(twa_message_type *table, unsigned int aen_code); --static void twa_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id); - - /* Functions */ - -@@ -1352,11 +1351,11 @@ static irqreturn_t twa_interrupt(int irq, void *dev_instance) - } - - /* Now complete the io */ -+ scsi_dma_unmap(cmd); -+ cmd->scsi_done(cmd); - tw_dev->state[request_id] = TW_S_COMPLETED; - twa_free_request_id(tw_dev, request_id); - tw_dev->posted_request_count--; -- tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]); -- twa_unmap_scsi_data(tw_dev, request_id); - } - - /* Check for valid status after each drain */ -@@ -1414,26 +1413,6 @@ static void twa_load_sgl(TW_Device_Extension *tw_dev, TW_Command_Full *full_comm - } - } /* End twa_load_sgl() */ - --/* This function will perform a pci-dma mapping for a scatter gather list */ --static int twa_map_scsi_sg_data(TW_Device_Extension *tw_dev, int request_id) --{ -- int use_sg; -- struct scsi_cmnd *cmd = tw_dev->srb[request_id]; -- -- use_sg = scsi_dma_map(cmd); -- if (!use_sg) -- return 0; -- else if (use_sg < 0) { -- TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1c, "Failed to map scatter gather list"); -- return 0; -- } -- -- cmd->SCp.phase = TW_PHASE_SGLIST; -- cmd->SCp.have_data_in = use_sg; -- -- return use_sg; --} /* End twa_map_scsi_sg_data() */ -- - /* This function will poll for a response interrupt of a request */ - static int twa_poll_response(TW_Device_Extension *tw_dev, int request_id, int seconds) - { -@@ -1612,9 +1591,11 @@ static int twa_reset_device_extension(TW_Device_Extension *tw_dev) - (tw_dev->state[i] != TW_S_INITIAL) && - (tw_dev->state[i] != TW_S_COMPLETED)) { - if (tw_dev->srb[i]) { -- tw_dev->srb[i]->result = (DID_RESET << 16); -- tw_dev->srb[i]->scsi_done(tw_dev->srb[i]); -- twa_unmap_scsi_data(tw_dev, i); -+ struct scsi_cmnd *cmd = tw_dev->srb[i]; -+ -+ cmd->result = (DID_RESET << 16); -+ scsi_dma_unmap(cmd); -+ cmd->scsi_done(cmd); - } - } - } -@@ -1793,21 +1774,18 @@ static int twa_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_ - /* Save the scsi command for use by the ISR */ - tw_dev->srb[request_id] = SCpnt; - -- /* Initialize phase to zero */ -- SCpnt->SCp.phase = TW_PHASE_INITIAL; -- - retval = twa_scsiop_execute_scsi(tw_dev, request_id, NULL, 0, NULL); - switch (retval) { - case SCSI_MLQUEUE_HOST_BUSY: -+ scsi_dma_unmap(SCpnt); - twa_free_request_id(tw_dev, request_id); -- twa_unmap_scsi_data(tw_dev, request_id); - break; - case 1: -- tw_dev->state[request_id] = TW_S_COMPLETED; -- twa_free_request_id(tw_dev, request_id); -- twa_unmap_scsi_data(tw_dev, request_id); - SCpnt->result = (DID_ERROR << 16); -+ scsi_dma_unmap(SCpnt); - done(SCpnt); -+ tw_dev->state[request_id] = TW_S_COMPLETED; -+ twa_free_request_id(tw_dev, request_id); - retval = 0; - } - out: -@@ -1875,8 +1853,8 @@ static int twa_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, - command_packet->sg_list[0].address = TW_CPU_TO_SGL(tw_dev->generic_buffer_phys[request_id]); - command_packet->sg_list[0].length = cpu_to_le32(TW_MIN_SGL_LENGTH); - } else { -- sg_count = twa_map_scsi_sg_data(tw_dev, request_id); -- if (sg_count == 0) -+ sg_count = scsi_dma_map(srb); -+ if (sg_count < 0) - goto out; - - scsi_for_each_sg(srb, sg, sg_count, i) { -@@ -1991,15 +1969,6 @@ static char *twa_string_lookup(twa_message_type *table, unsigned int code) - return(table[index].text); - } /* End twa_string_lookup() */ - --/* This function will perform a pci-dma unmap */ --static void twa_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id) --{ -- struct scsi_cmnd *cmd = tw_dev->srb[request_id]; -- -- if (cmd->SCp.phase == TW_PHASE_SGLIST) -- scsi_dma_unmap(cmd); --} /* End twa_unmap_scsi_data() */ -- - /* This function gets called when a disk is coming on-line */ - static int twa_slave_configure(struct scsi_device *sdev) - { -diff --git a/drivers/scsi/3w-9xxx.h b/drivers/scsi/3w-9xxx.h -index 040f7214e5b7..0fdc83cfa0e1 100644 ---- a/drivers/scsi/3w-9xxx.h -+++ b/drivers/scsi/3w-9xxx.h -@@ -324,11 +324,6 @@ static twa_message_type twa_error_table[] = { - #define TW_CURRENT_DRIVER_BUILD 0 - #define TW_CURRENT_DRIVER_BRANCH 0 - --/* Phase defines */ --#define TW_PHASE_INITIAL 0 --#define TW_PHASE_SINGLE 1 --#define TW_PHASE_SGLIST 2 -- - /* Misc defines */ - #define TW_9550SX_DRAIN_COMPLETED 0xFFFF - #define TW_SECTOR_SIZE 512 -diff --git a/drivers/scsi/3w-sas.c b/drivers/scsi/3w-sas.c -index 4de346017e9f..61702ac00d42 100644 ---- a/drivers/scsi/3w-sas.c -+++ b/drivers/scsi/3w-sas.c -@@ -303,26 +303,6 @@ static int twl_post_command_packet(TW_Device_Extension *tw_dev, int request_id) - return 0; - } /* End twl_post_command_packet() */ - --/* This function will perform a pci-dma mapping for a scatter gather list */ --static int twl_map_scsi_sg_data(TW_Device_Extension *tw_dev, int request_id) --{ -- int use_sg; -- struct scsi_cmnd *cmd = tw_dev->srb[request_id]; -- -- use_sg = scsi_dma_map(cmd); -- if (!use_sg) -- return 0; -- else if (use_sg < 0) { -- TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1, "Failed to map scatter gather list"); -- return 0; -- } -- -- cmd->SCp.phase = TW_PHASE_SGLIST; -- cmd->SCp.have_data_in = use_sg; -- -- return use_sg; --} /* End twl_map_scsi_sg_data() */ -- - /* This function hands scsi cdb's to the firmware */ - static int twl_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, char *cdb, int use_sg, TW_SG_Entry_ISO *sglistarg) - { -@@ -370,8 +350,8 @@ static int twl_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, - if (!sglistarg) { - /* Map sglist from scsi layer to cmd packet */ - if (scsi_sg_count(srb)) { -- sg_count = twl_map_scsi_sg_data(tw_dev, request_id); -- if (sg_count == 0) -+ sg_count = scsi_dma_map(srb); -+ if (sg_count <= 0) - goto out; - - scsi_for_each_sg(srb, sg, sg_count, i) { -@@ -1116,15 +1096,6 @@ out: - return retval; - } /* End twl_initialize_device_extension() */ - --/* This function will perform a pci-dma unmap */ --static void twl_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id) --{ -- struct scsi_cmnd *cmd = tw_dev->srb[request_id]; -- -- if (cmd->SCp.phase == TW_PHASE_SGLIST) -- scsi_dma_unmap(cmd); --} /* End twl_unmap_scsi_data() */ -- - /* This function will handle attention interrupts */ - static int twl_handle_attention_interrupt(TW_Device_Extension *tw_dev) - { -@@ -1265,11 +1236,11 @@ static irqreturn_t twl_interrupt(int irq, void *dev_instance) - } - - /* Now complete the io */ -+ scsi_dma_unmap(cmd); -+ cmd->scsi_done(cmd); - tw_dev->state[request_id] = TW_S_COMPLETED; - twl_free_request_id(tw_dev, request_id); - tw_dev->posted_request_count--; -- tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]); -- twl_unmap_scsi_data(tw_dev, request_id); - } - - /* Check for another response interrupt */ -@@ -1414,10 +1385,12 @@ static int twl_reset_device_extension(TW_Device_Extension *tw_dev, int ioctl_res - if ((tw_dev->state[i] != TW_S_FINISHED) && - (tw_dev->state[i] != TW_S_INITIAL) && - (tw_dev->state[i] != TW_S_COMPLETED)) { -- if (tw_dev->srb[i]) { -- tw_dev->srb[i]->result = (DID_RESET << 16); -- tw_dev->srb[i]->scsi_done(tw_dev->srb[i]); -- twl_unmap_scsi_data(tw_dev, i); -+ struct scsi_cmnd *cmd = tw_dev->srb[i]; -+ -+ if (cmd) { -+ cmd->result = (DID_RESET << 16); -+ scsi_dma_unmap(cmd); -+ cmd->scsi_done(cmd); - } - } - } -@@ -1521,9 +1494,6 @@ static int twl_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_ - /* Save the scsi command for use by the ISR */ - tw_dev->srb[request_id] = SCpnt; - -- /* Initialize phase to zero */ -- SCpnt->SCp.phase = TW_PHASE_INITIAL; -- - retval = twl_scsiop_execute_scsi(tw_dev, request_id, NULL, 0, NULL); - if (retval) { - tw_dev->state[request_id] = TW_S_COMPLETED; -diff --git a/drivers/scsi/3w-sas.h b/drivers/scsi/3w-sas.h -index d474892701d4..fec6449c7595 100644 ---- a/drivers/scsi/3w-sas.h -+++ b/drivers/scsi/3w-sas.h -@@ -103,10 +103,6 @@ static char *twl_aen_severity_table[] = - #define TW_CURRENT_DRIVER_BUILD 0 - #define TW_CURRENT_DRIVER_BRANCH 0 - --/* Phase defines */ --#define TW_PHASE_INITIAL 0 --#define TW_PHASE_SGLIST 2 -- - /* Misc defines */ - #define TW_SECTOR_SIZE 512 - #define TW_MAX_UNITS 32 -diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c -index 752624e6bc00..b327742b95ef 100644 ---- a/drivers/scsi/3w-xxxx.c -+++ b/drivers/scsi/3w-xxxx.c -@@ -1284,32 +1284,6 @@ static int tw_initialize_device_extension(TW_Device_Extension *tw_dev) - return 0; - } /* End tw_initialize_device_extension() */ - --static int tw_map_scsi_sg_data(struct pci_dev *pdev, struct scsi_cmnd *cmd) --{ -- int use_sg; -- -- dprintk(KERN_WARNING "3w-xxxx: tw_map_scsi_sg_data()\n"); -- -- use_sg = scsi_dma_map(cmd); -- if (use_sg < 0) { -- printk(KERN_WARNING "3w-xxxx: tw_map_scsi_sg_data(): pci_map_sg() failed.\n"); -- return 0; -- } -- -- cmd->SCp.phase = TW_PHASE_SGLIST; -- cmd->SCp.have_data_in = use_sg; -- -- return use_sg; --} /* End tw_map_scsi_sg_data() */ -- --static void tw_unmap_scsi_data(struct pci_dev *pdev, struct scsi_cmnd *cmd) --{ -- dprintk(KERN_WARNING "3w-xxxx: tw_unmap_scsi_data()\n"); -- -- if (cmd->SCp.phase == TW_PHASE_SGLIST) -- scsi_dma_unmap(cmd); --} /* End tw_unmap_scsi_data() */ -- - /* This function will reset a device extension */ - static int tw_reset_device_extension(TW_Device_Extension *tw_dev) - { -@@ -1332,8 +1306,8 @@ static int tw_reset_device_extension(TW_Device_Extension *tw_dev) - srb = tw_dev->srb[i]; - if (srb != NULL) { - srb->result = (DID_RESET << 16); -- tw_dev->srb[i]->scsi_done(tw_dev->srb[i]); -- tw_unmap_scsi_data(tw_dev->tw_pci_dev, tw_dev->srb[i]); -+ scsi_dma_unmap(srb); -+ srb->scsi_done(srb); - } - } - } -@@ -1780,8 +1754,8 @@ static int tw_scsiop_read_write(TW_Device_Extension *tw_dev, int request_id) - command_packet->byte8.io.lba = lba; - command_packet->byte6.block_count = num_sectors; - -- use_sg = tw_map_scsi_sg_data(tw_dev->tw_pci_dev, tw_dev->srb[request_id]); -- if (!use_sg) -+ use_sg = scsi_dma_map(srb); -+ if (use_sg <= 0) - return 1; - - scsi_for_each_sg(tw_dev->srb[request_id], sg, use_sg, i) { -@@ -1968,9 +1942,6 @@ static int tw_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_c - /* Save the scsi command for use by the ISR */ - tw_dev->srb[request_id] = SCpnt; - -- /* Initialize phase to zero */ -- SCpnt->SCp.phase = TW_PHASE_INITIAL; -- - switch (*command) { - case READ_10: - case READ_6: -@@ -2198,12 +2169,11 @@ static irqreturn_t tw_interrupt(int irq, void *dev_instance) - - /* Now complete the io */ - if ((error != TW_ISR_DONT_COMPLETE)) { -+ scsi_dma_unmap(tw_dev->srb[request_id]); -+ tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]); - tw_dev->state[request_id] = TW_S_COMPLETED; - tw_state_request_finish(tw_dev, request_id); - tw_dev->posted_request_count--; -- tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]); -- -- tw_unmap_scsi_data(tw_dev->tw_pci_dev, tw_dev->srb[request_id]); - } - } - -diff --git a/drivers/scsi/3w-xxxx.h b/drivers/scsi/3w-xxxx.h -index 49dcf03c631a..1d31858766ce 100644 ---- a/drivers/scsi/3w-xxxx.h -+++ b/drivers/scsi/3w-xxxx.h -@@ -195,11 +195,6 @@ static unsigned char tw_sense_table[][4] = - #define TW_AEN_SMART_FAIL 0x000F - #define TW_AEN_SBUF_FAIL 0x0024 - --/* Phase defines */ --#define TW_PHASE_INITIAL 0 --#define TW_PHASE_SINGLE 1 --#define TW_PHASE_SGLIST 2 -- - /* Misc defines */ - #define TW_ALIGNMENT_6000 64 /* 64 bytes */ - #define TW_ALIGNMENT_7000 4 /* 4 bytes */ -diff --git a/drivers/staging/panel/panel.c b/drivers/staging/panel/panel.c -index ec4b1fd14021..790e12e0f524 100644 ---- a/drivers/staging/panel/panel.c -+++ b/drivers/staging/panel/panel.c -@@ -275,11 +275,11 @@ static unsigned char lcd_bits[LCD_PORTS][LCD_BITS][BIT_STATES]; - * LCD types - */ - #define LCD_TYPE_NONE 0 --#define LCD_TYPE_OLD 1 --#define LCD_TYPE_KS0074 2 --#define LCD_TYPE_HANTRONIX 3 --#define LCD_TYPE_NEXCOM 4 --#define LCD_TYPE_CUSTOM 5 -+#define LCD_TYPE_CUSTOM 1 -+#define LCD_TYPE_OLD 2 -+#define LCD_TYPE_KS0074 3 -+#define LCD_TYPE_HANTRONIX 4 -+#define LCD_TYPE_NEXCOM 5 - - /* - * keypad types -@@ -457,8 +457,7 @@ MODULE_PARM_DESC(keypad_enabled, "Deprecated option, use keypad_type instead"); - static int lcd_type = -1; - module_param(lcd_type, int, 0000); - MODULE_PARM_DESC(lcd_type, -- "LCD type: 0=none, 1=old //, 2=serial ks0074, " -- "3=hantronix //, 4=nexcom //, 5=compiled-in"); -+ "LCD type: 0=none, 1=compiled-in, 2=old, 3=serial ks0074, 4=hantronix, 5=nexcom"); - - static int lcd_proto = -1; - module_param(lcd_proto, int, 0000); -diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c -index 0d3e6cb36748..9d162ef79af6 100644 ---- a/drivers/tty/serial/atmel_serial.c -+++ b/drivers/tty/serial/atmel_serial.c -@@ -757,6 +757,7 @@ static int atmel_prepare_tx_dma(struct uart_port *port) - config.direction = DMA_MEM_TO_DEV; - config.dst_addr_width = DMA_SLAVE_BUSWIDTH_1_BYTE; - config.dst_addr = port->mapbase + ATMEL_US_THR; -+ config.dst_maxburst = 1; - - ret = dmaengine_device_control(atmel_port->chan_tx, - DMA_SLAVE_CONFIG, -@@ -921,6 +922,7 @@ static int atmel_prepare_rx_dma(struct uart_port *port) - config.direction = DMA_DEV_TO_MEM; - config.src_addr_width = DMA_SLAVE_BUSWIDTH_1_BYTE; - config.src_addr = port->mapbase + ATMEL_US_RHR; -+ config.src_maxburst = 1; - - ret = dmaengine_device_control(atmel_port->chan_rx, - DMA_SLAVE_CONFIG, -diff --git a/drivers/tty/serial/of_serial.c b/drivers/tty/serial/of_serial.c -index 99246606a256..9dd8a71fff9e 100644 ---- a/drivers/tty/serial/of_serial.c -+++ b/drivers/tty/serial/of_serial.c -@@ -261,7 +261,6 @@ static struct of_device_id of_platform_serial_table[] = { - { .compatible = "ibm,qpace-nwp-serial", - .data = (void *)PORT_NWPSERIAL, }, - #endif -- { .type = "serial", .data = (void *)PORT_UNKNOWN, }, - { /* end of list */ }, - }; - -diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c -index 488a30836c36..3df32fa8c8ae 100644 ---- a/drivers/usb/host/ehci-hcd.c -+++ b/drivers/usb/host/ehci-hcd.c -@@ -787,12 +787,12 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd) - ehci->reset_done[i] == 0)) - continue; - -- /* start 20 msec resume signaling from this port, -- * and make khubd collect PORT_STAT_C_SUSPEND to -- * stop that signaling. Use 5 ms extra for safety, -- * like usb_port_resume() does. -+ /* start USB_RESUME_TIMEOUT msec resume signaling from -+ * this port, and make hub_wq collect -+ * PORT_STAT_C_SUSPEND to stop that signaling. - */ -- ehci->reset_done[i] = jiffies + msecs_to_jiffies(25); -+ ehci->reset_done[i] = jiffies + -+ msecs_to_jiffies(USB_RESUME_TIMEOUT); - set_bit(i, &ehci->resuming_ports); - ehci_dbg (ehci, "port %d remote wakeup\n", i + 1); - usb_hcd_start_port_resume(&hcd->self, i); -diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c -index 7d6f64c447bf..323c5faf7a2f 100644 ---- a/drivers/usb/host/ehci-hub.c -+++ b/drivers/usb/host/ehci-hub.c -@@ -482,10 +482,13 @@ static int ehci_bus_resume (struct usb_hcd *hcd) - ehci_writel(ehci, temp, &ehci->regs->port_status [i]); - } - -- /* msleep for 20ms only if code is trying to resume port */ -+ /* -+ * msleep for USB_RESUME_TIMEOUT ms only if code is trying to resume -+ * port -+ */ - if (resume_needed) { - spin_unlock_irq(&ehci->lock); -- msleep(20); -+ msleep(USB_RESUME_TIMEOUT); - spin_lock_irq(&ehci->lock); - if (ehci->shutdown) - goto shutdown; -@@ -953,7 +956,7 @@ static int ehci_hub_control ( - temp &= ~PORT_WAKE_BITS; - ehci_writel(ehci, temp | PORT_RESUME, status_reg); - ehci->reset_done[wIndex] = jiffies -- + msecs_to_jiffies(20); -+ + msecs_to_jiffies(USB_RESUME_TIMEOUT); - set_bit(wIndex, &ehci->resuming_ports); - usb_hcd_start_port_resume(&hcd->self, wIndex); - break; -diff --git a/drivers/usb/host/oxu210hp-hcd.c b/drivers/usb/host/oxu210hp-hcd.c -index e07248b6ab67..1b1e6e0d9270 100644 ---- a/drivers/usb/host/oxu210hp-hcd.c -+++ b/drivers/usb/host/oxu210hp-hcd.c -@@ -2500,11 +2500,12 @@ static irqreturn_t oxu210_hcd_irq(struct usb_hcd *hcd) - || oxu->reset_done[i] != 0) - continue; - -- /* start 20 msec resume signaling from this port, -- * and make khubd collect PORT_STAT_C_SUSPEND to -+ /* start USB_RESUME_TIMEOUT resume signaling from this -+ * port, and make hub_wq collect PORT_STAT_C_SUSPEND to - * stop that signaling. - */ -- oxu->reset_done[i] = jiffies + msecs_to_jiffies(20); -+ oxu->reset_done[i] = jiffies + -+ msecs_to_jiffies(USB_RESUME_TIMEOUT); - oxu_dbg(oxu, "port %d remote wakeup\n", i + 1); - mod_timer(&hcd->rh_timer, oxu->reset_done[i]); - } -diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c -index 07576907e2c6..ec69b90475c7 100644 ---- a/drivers/usb/musb/musb_core.c -+++ b/drivers/usb/musb/musb_core.c -@@ -99,6 +99,7 @@ - #include - #include - #include -+#include - - #include "musb_core.h" - -@@ -477,10 +478,11 @@ static irqreturn_t musb_stage0_irq(struct musb *musb, u8 int_usb, - (USB_PORT_STAT_C_SUSPEND << 16) - | MUSB_PORT_STAT_RESUME; - musb->rh_timer = jiffies -- + msecs_to_jiffies(20); -+ + msecs_to_jiffies(USB_RESUME_TIMEOUT); -+ - schedule_delayed_work( - &musb->finish_resume_work, -- msecs_to_jiffies(20)); -+ msecs_to_jiffies(USB_RESUME_TIMEOUT)); - - musb->xceiv->state = OTG_STATE_A_HOST; - musb->is_active = 1; -diff --git a/drivers/usb/musb/musb_virthub.c b/drivers/usb/musb/musb_virthub.c -index e2d2d8c9891b..0241a3a0d63e 100644 ---- a/drivers/usb/musb/musb_virthub.c -+++ b/drivers/usb/musb/musb_virthub.c -@@ -136,7 +136,7 @@ void musb_port_suspend(struct musb *musb, bool do_suspend) - /* later, GetPortStatus will stop RESUME signaling */ - musb->port1_status |= MUSB_PORT_STAT_RESUME; - schedule_delayed_work(&musb->finish_resume_work, -- msecs_to_jiffies(20)); -+ msecs_to_jiffies(USB_RESUME_TIMEOUT)); - } - } - -diff --git a/fs/ext4/extents_status.c b/fs/ext4/extents_status.c -index 171b9fa0f27a..4e8b79def9c7 100644 ---- a/fs/ext4/extents_status.c -+++ b/fs/ext4/extents_status.c -@@ -656,6 +656,14 @@ int ext4_es_insert_extent(struct inode *inode, ext4_lblk_t lblk, - - BUG_ON(end < lblk); - -+ if ((status & EXTENT_STATUS_DELAYED) && -+ (status & EXTENT_STATUS_WRITTEN)) { -+ ext4_warning(inode->i_sb, "Inserting extent [%u/%u] as " -+ " delayed and written which can potentially " -+ " cause data loss.\n", lblk, len); -+ WARN_ON(1); -+ } -+ - newes.es_lblk = lblk; - newes.es_len = len; - ext4_es_store_pblock(&newes, pblk); -diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c -index 3a7e0341447f..da03340fdb17 100644 ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -569,6 +569,7 @@ int ext4_map_blocks(handle_t *handle, struct inode *inode, - status = map->m_flags & EXT4_MAP_UNWRITTEN ? - EXTENT_STATUS_UNWRITTEN : EXTENT_STATUS_WRITTEN; - if (!(flags & EXT4_GET_BLOCKS_DELALLOC_RESERVE) && -+ !(status & EXTENT_STATUS_WRITTEN) && - ext4_find_delalloc_range(inode, map->m_lblk, - map->m_lblk + map->m_len - 1)) - status |= EXTENT_STATUS_DELAYED; -@@ -678,6 +679,7 @@ found: - status = map->m_flags & EXT4_MAP_UNWRITTEN ? - EXTENT_STATUS_UNWRITTEN : EXTENT_STATUS_WRITTEN; - if (!(flags & EXT4_GET_BLOCKS_DELALLOC_RESERVE) && -+ !(status & EXTENT_STATUS_WRITTEN) && - ext4_find_delalloc_range(inode, map->m_lblk, - map->m_lblk + map->m_len - 1)) - status |= EXTENT_STATUS_DELAYED; -diff --git a/include/sound/emu10k1.h b/include/sound/emu10k1.h -index dfb42ca6d043..8898cdeb42a4 100644 ---- a/include/sound/emu10k1.h -+++ b/include/sound/emu10k1.h -@@ -41,7 +41,8 @@ - - #define EMUPAGESIZE 4096 - #define MAXREQVOICES 8 --#define MAXPAGES 8192 -+#define MAXPAGES0 4096 /* 32 bit mode */ -+#define MAXPAGES1 8192 /* 31 bit mode */ - #define RESERVED 0 - #define NUM_MIDI 16 - #define NUM_G 64 /* use all channels */ -@@ -50,8 +51,7 @@ - - /* FIXME? - according to the OSS driver the EMU10K1 needs a 29 bit DMA mask */ - #define EMU10K1_DMA_MASK 0x7fffffffUL /* 31bit */ --#define AUDIGY_DMA_MASK 0x7fffffffUL /* 31bit FIXME - 32 should work? */ -- /* See ALSA bug #1276 - rlrevell */ -+#define AUDIGY_DMA_MASK 0xffffffffUL /* 32bit mode */ - - #define TMEMSIZE 256*1024 - #define TMEMSIZEREG 4 -@@ -468,8 +468,11 @@ - - #define MAPB 0x0d /* Cache map B */ - --#define MAP_PTE_MASK 0xffffe000 /* The 19 MSBs of the PTE indexed by the PTI */ --#define MAP_PTI_MASK 0x00001fff /* The 13 bit index to one of the 8192 PTE dwords */ -+#define MAP_PTE_MASK0 0xfffff000 /* The 20 MSBs of the PTE indexed by the PTI */ -+#define MAP_PTI_MASK0 0x00000fff /* The 12 bit index to one of the 4096 PTE dwords */ -+ -+#define MAP_PTE_MASK1 0xffffe000 /* The 19 MSBs of the PTE indexed by the PTI */ -+#define MAP_PTI_MASK1 0x00001fff /* The 13 bit index to one of the 8192 PTE dwords */ - - /* 0x0e, 0x0f: Not used */ - -@@ -1706,6 +1709,7 @@ struct snd_emu10k1 { - unsigned short model; /* subsystem id */ - unsigned int card_type; /* EMU10K1_CARD_* */ - unsigned int ecard_ctrl; /* ecard control bits */ -+ unsigned int address_mode; /* address mode */ - unsigned long dma_mask; /* PCI DMA mask */ - unsigned int delay_pcm_irq; /* in samples */ - int max_cache_pages; /* max memory size / PAGE_SIZE */ -diff --git a/include/sound/soc-dapm.h b/include/sound/soc-dapm.h -index 6e89ef6c11c1..13412ab158ee 100644 ---- a/include/sound/soc-dapm.h -+++ b/include/sound/soc-dapm.h -@@ -302,7 +302,7 @@ struct device; - .access = SNDRV_CTL_ELEM_ACCESS_TLV_READ | SNDRV_CTL_ELEM_ACCESS_READWRITE,\ - .tlv.p = (tlv_array), \ - .get = snd_soc_dapm_get_volsw, .put = snd_soc_dapm_put_volsw, \ -- .private_value = SOC_SINGLE_VALUE(reg, shift, max, invert, 0) } -+ .private_value = SOC_SINGLE_VALUE(reg, shift, max, invert, 1) } - #define SOC_DAPM_SINGLE_TLV_VIRT(xname, max, tlv_array) \ - SOC_DAPM_SINGLE(xname, SND_SOC_NOPM, 0, max, 0, tlv_array) - #define SOC_DAPM_ENUM(xname, xenum) \ -diff --git a/sound/pci/emu10k1/emu10k1.c b/sound/pci/emu10k1/emu10k1.c -index 9e1bd0c39a8c..6757458e8db6 100644 ---- a/sound/pci/emu10k1/emu10k1.c -+++ b/sound/pci/emu10k1/emu10k1.c -@@ -181,8 +181,10 @@ static int snd_card_emu10k1_probe(struct pci_dev *pci, - } - #endif - -- strcpy(card->driver, emu->card_capabilities->driver); -- strcpy(card->shortname, emu->card_capabilities->name); -+ strlcpy(card->driver, emu->card_capabilities->driver, -+ sizeof(card->driver)); -+ strlcpy(card->shortname, emu->card_capabilities->name, -+ sizeof(card->shortname)); - snprintf(card->longname, sizeof(card->longname), - "%s (rev.%d, serial:0x%x) at 0x%lx, irq %i", - card->shortname, emu->revision, emu->serial, emu->port, emu->irq); -diff --git a/sound/pci/emu10k1/emu10k1_callback.c b/sound/pci/emu10k1/emu10k1_callback.c -index 0a34b5f1c475..f8a6549f00e5 100644 ---- a/sound/pci/emu10k1/emu10k1_callback.c -+++ b/sound/pci/emu10k1/emu10k1_callback.c -@@ -415,7 +415,7 @@ start_voice(struct snd_emux_voice *vp) - snd_emu10k1_ptr_write(hw, Z2, ch, 0); - - /* invalidate maps */ -- temp = (hw->silent_page.addr << 1) | MAP_PTI_MASK; -+ temp = (hw->silent_page.addr << hw->address_mode) | (hw->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0); - snd_emu10k1_ptr_write(hw, MAPA, ch, temp); - snd_emu10k1_ptr_write(hw, MAPB, ch, temp); - #if 0 -@@ -436,7 +436,7 @@ start_voice(struct snd_emux_voice *vp) - snd_emu10k1_ptr_write(hw, CDF, ch, sample); - - /* invalidate maps */ -- temp = ((unsigned int)hw->silent_page.addr << 1) | MAP_PTI_MASK; -+ temp = ((unsigned int)hw->silent_page.addr << hw_address_mode) | (hw->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0); - snd_emu10k1_ptr_write(hw, MAPA, ch, temp); - snd_emu10k1_ptr_write(hw, MAPB, ch, temp); - -diff --git a/sound/pci/emu10k1/emu10k1_main.c b/sound/pci/emu10k1/emu10k1_main.c -index bdd888ec9a84..a131092572e6 100644 ---- a/sound/pci/emu10k1/emu10k1_main.c -+++ b/sound/pci/emu10k1/emu10k1_main.c -@@ -282,7 +282,7 @@ static int snd_emu10k1_init(struct snd_emu10k1 *emu, int enable_ir, int resume) - snd_emu10k1_ptr_write(emu, TCB, 0, 0); /* taken from original driver */ - snd_emu10k1_ptr_write(emu, TCBS, 0, 4); /* taken from original driver */ - -- silent_page = (emu->silent_page.addr << 1) | MAP_PTI_MASK; -+ silent_page = (emu->silent_page.addr << emu->address_mode) | (emu->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0); - for (ch = 0; ch < NUM_G; ch++) { - snd_emu10k1_ptr_write(emu, MAPA, ch, silent_page); - snd_emu10k1_ptr_write(emu, MAPB, ch, silent_page); -@@ -348,6 +348,11 @@ static int snd_emu10k1_init(struct snd_emu10k1 *emu, int enable_ir, int resume) - outl(reg | A_IOCFG_GPOUT0, emu->port + A_IOCFG); - } - -+ if (emu->address_mode == 0) { -+ /* use 16M in 4G */ -+ outl(inl(emu->port + HCFG) | HCFG_EXPANDED_MEM, emu->port + HCFG); -+ } -+ - return 0; - } - -@@ -1411,7 +1416,7 @@ static struct snd_emu_chip_details emu_chip_details[] = { - * - */ - {.vendor = 0x1102, .device = 0x0008, .subsystem = 0x20011102, -- .driver = "Audigy2", .name = "SB Audigy 2 ZS Notebook [SB0530]", -+ .driver = "Audigy2", .name = "Audigy 2 ZS Notebook [SB0530]", - .id = "Audigy2", - .emu10k2_chip = 1, - .ca0108_chip = 1, -@@ -1561,7 +1566,7 @@ static struct snd_emu_chip_details emu_chip_details[] = { - .adc_1361t = 1, /* 24 bit capture instead of 16bit */ - .ac97_chip = 1} , - {.vendor = 0x1102, .device = 0x0004, .subsystem = 0x10051102, -- .driver = "Audigy2", .name = "SB Audigy 2 Platinum EX [SB0280]", -+ .driver = "Audigy2", .name = "Audigy 2 Platinum EX [SB0280]", - .id = "Audigy2", - .emu10k2_chip = 1, - .ca0102_chip = 1, -@@ -1865,8 +1870,10 @@ int snd_emu10k1_create(struct snd_card *card, - - is_audigy = emu->audigy = c->emu10k2_chip; - -+ /* set addressing mode */ -+ emu->address_mode = is_audigy ? 0 : 1; - /* set the DMA transfer mask */ -- emu->dma_mask = is_audigy ? AUDIGY_DMA_MASK : EMU10K1_DMA_MASK; -+ emu->dma_mask = emu->address_mode ? EMU10K1_DMA_MASK : AUDIGY_DMA_MASK; - if (pci_set_dma_mask(pci, emu->dma_mask) < 0 || - pci_set_consistent_dma_mask(pci, emu->dma_mask) < 0) { - snd_printk(KERN_ERR "architecture does not support PCI busmaster DMA with mask 0x%lx\n", emu->dma_mask); -@@ -1889,7 +1896,7 @@ int snd_emu10k1_create(struct snd_card *card, - - emu->max_cache_pages = max_cache_bytes >> PAGE_SHIFT; - if (snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV, snd_dma_pci_data(pci), -- 32 * 1024, &emu->ptb_pages) < 0) { -+ (emu->address_mode ? 32 : 16) * 1024, &emu->ptb_pages) < 0) { - err = -ENOMEM; - goto error; - } -@@ -1988,8 +1995,8 @@ int snd_emu10k1_create(struct snd_card *card, - - /* Clear silent pages and set up pointers */ - memset(emu->silent_page.area, 0, PAGE_SIZE); -- silent_page = emu->silent_page.addr << 1; -- for (idx = 0; idx < MAXPAGES; idx++) -+ silent_page = emu->silent_page.addr << emu->address_mode; -+ for (idx = 0; idx < (emu->address_mode ? MAXPAGES1 : MAXPAGES0); idx++) - ((u32 *)emu->ptb_pages.area)[idx] = cpu_to_le32(silent_page | idx); - - /* set up voice indices */ -diff --git a/sound/pci/emu10k1/emupcm.c b/sound/pci/emu10k1/emupcm.c -index 5ae1d045bdcb..7581019d7c84 100644 ---- a/sound/pci/emu10k1/emupcm.c -+++ b/sound/pci/emu10k1/emupcm.c -@@ -379,7 +379,7 @@ static void snd_emu10k1_pcm_init_voice(struct snd_emu10k1 *emu, - snd_emu10k1_ptr_write(emu, Z1, voice, 0); - snd_emu10k1_ptr_write(emu, Z2, voice, 0); - /* invalidate maps */ -- silent_page = ((unsigned int)emu->silent_page.addr << 1) | MAP_PTI_MASK; -+ silent_page = ((unsigned int)emu->silent_page.addr << emu->address_mode) | (emu->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0); - snd_emu10k1_ptr_write(emu, MAPA, voice, silent_page); - snd_emu10k1_ptr_write(emu, MAPB, voice, silent_page); - /* modulation envelope */ -diff --git a/sound/pci/emu10k1/memory.c b/sound/pci/emu10k1/memory.c -index ae709c1ab3a8..d514458efe3d 100644 ---- a/sound/pci/emu10k1/memory.c -+++ b/sound/pci/emu10k1/memory.c -@@ -34,10 +34,11 @@ - * aligned pages in others - */ - #define __set_ptb_entry(emu,page,addr) \ -- (((u32 *)(emu)->ptb_pages.area)[page] = cpu_to_le32(((addr) << 1) | (page))) -+ (((u32 *)(emu)->ptb_pages.area)[page] = cpu_to_le32(((addr) << (emu->address_mode)) | (page))) - - #define UNIT_PAGES (PAGE_SIZE / EMUPAGESIZE) --#define MAX_ALIGN_PAGES (MAXPAGES / UNIT_PAGES) -+#define MAX_ALIGN_PAGES0 (MAXPAGES0 / UNIT_PAGES) -+#define MAX_ALIGN_PAGES1 (MAXPAGES1 / UNIT_PAGES) - /* get aligned page from offset address */ - #define get_aligned_page(offset) ((offset) >> PAGE_SHIFT) - /* get offset address from aligned page */ -@@ -124,7 +125,7 @@ static int search_empty_map_area(struct snd_emu10k1 *emu, int npages, struct lis - } - page = blk->mapped_page + blk->pages; - } -- size = MAX_ALIGN_PAGES - page; -+ size = (emu->address_mode ? MAX_ALIGN_PAGES1 : MAX_ALIGN_PAGES0) - page; - if (size >= max_size) { - *nextp = pos; - return page; -@@ -181,7 +182,7 @@ static int unmap_memblk(struct snd_emu10k1 *emu, struct snd_emu10k1_memblk *blk) - q = get_emu10k1_memblk(p, mapped_link); - end_page = q->mapped_page; - } else -- end_page = MAX_ALIGN_PAGES; -+ end_page = (emu->address_mode ? MAX_ALIGN_PAGES1 : MAX_ALIGN_PAGES0); - - /* remove links */ - list_del(&blk->mapped_link); -@@ -305,7 +306,7 @@ snd_emu10k1_alloc_pages(struct snd_emu10k1 *emu, struct snd_pcm_substream *subst - if (snd_BUG_ON(!emu)) - return NULL; - if (snd_BUG_ON(runtime->dma_bytes <= 0 || -- runtime->dma_bytes >= MAXPAGES * EMUPAGESIZE)) -+ runtime->dma_bytes >= (emu->address_mode ? MAXPAGES1 : MAXPAGES0) * EMUPAGESIZE)) - return NULL; - hdr = emu->memhdr; - if (snd_BUG_ON(!hdr)) -diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c -index f6e5c4ed03ed..97ebc105cf3c 100644 ---- a/sound/pci/hda/hda_codec.c -+++ b/sound/pci/hda/hda_codec.c -@@ -2082,6 +2082,16 @@ static void put_vol_mute(struct hda_codec *codec, unsigned int amp_caps, - snd_hda_codec_write(codec, nid, 0, AC_VERB_SET_AMP_GAIN_MUTE, parm); - } - -+/* meta hook to call each driver's vmaster hook */ -+static void vmaster_hook(void *private_data, int enabled) -+{ -+ struct hda_vmaster_mute_hook *hook = private_data; -+ -+ if (hook->mute_mode != HDA_VMUTE_FOLLOW_MASTER) -+ enabled = hook->mute_mode; -+ hook->hook(hook->codec, enabled); -+} -+ - /** - * snd_hda_codec_amp_read - Read AMP value - * @codec: HD-audio codec -@@ -2917,9 +2927,9 @@ int snd_hda_add_vmaster_hook(struct hda_codec *codec, - - if (!hook->hook || !hook->sw_kctl) - return 0; -- snd_ctl_add_vmaster_hook(hook->sw_kctl, hook->hook, codec); - hook->codec = codec; - hook->mute_mode = HDA_VMUTE_FOLLOW_MASTER; -+ snd_ctl_add_vmaster_hook(hook->sw_kctl, vmaster_hook, hook); - if (!expose_enum_ctl) - return 0; - kctl = snd_ctl_new1(&vmaster_mute_mode, hook); -@@ -2942,14 +2952,7 @@ void snd_hda_sync_vmaster_hook(struct hda_vmaster_mute_hook *hook) - */ - if (hook->codec->bus->shutdown) - return; -- switch (hook->mute_mode) { -- case HDA_VMUTE_FOLLOW_MASTER: -- snd_ctl_sync_vmaster_hook(hook->sw_kctl); -- break; -- default: -- hook->hook(hook->codec, hook->mute_mode); -- break; -- } -+ snd_ctl_sync_vmaster_hook(hook->sw_kctl); - } - EXPORT_SYMBOL_GPL(snd_hda_sync_vmaster_hook); - -diff --git a/sound/pci/hda/thinkpad_helper.c b/sound/pci/hda/thinkpad_helper.c -index 8fe3b8c18ed4..1eafc1a28193 100644 ---- a/sound/pci/hda/thinkpad_helper.c -+++ b/sound/pci/hda/thinkpad_helper.c -@@ -71,6 +71,7 @@ static void hda_fixup_thinkpad_acpi(struct hda_codec *codec, - if (led_set_func(TPACPI_LED_MUTE, false) >= 0) { - old_vmaster_hook = spec->vmaster_mute.hook; - spec->vmaster_mute.hook = update_tpacpi_mute_led; -+ spec->vmaster_mute_enum = 1; - removefunc = false; - } - if (led_set_func(TPACPI_LED_MICMUTE, false) >= 0) { -diff --git a/sound/synth/emux/emux_oss.c b/sound/synth/emux/emux_oss.c -index 319754cf6208..daf61abc3670 100644 ---- a/sound/synth/emux/emux_oss.c -+++ b/sound/synth/emux/emux_oss.c -@@ -118,12 +118,8 @@ snd_emux_open_seq_oss(struct snd_seq_oss_arg *arg, void *closure) - if (snd_BUG_ON(!arg || !emu)) - return -ENXIO; - -- mutex_lock(&emu->register_mutex); -- -- if (!snd_emux_inc_count(emu)) { -- mutex_unlock(&emu->register_mutex); -+ if (!snd_emux_inc_count(emu)) - return -EFAULT; -- } - - memset(&callback, 0, sizeof(callback)); - callback.owner = THIS_MODULE; -@@ -135,7 +131,6 @@ snd_emux_open_seq_oss(struct snd_seq_oss_arg *arg, void *closure) - if (p == NULL) { - snd_printk(KERN_ERR "can't create port\n"); - snd_emux_dec_count(emu); -- mutex_unlock(&emu->register_mutex); - return -ENOMEM; - } - -@@ -148,8 +143,6 @@ snd_emux_open_seq_oss(struct snd_seq_oss_arg *arg, void *closure) - reset_port_mode(p, arg->seq_mode); - - snd_emux_reset_port(p); -- -- mutex_unlock(&emu->register_mutex); - return 0; - } - -@@ -195,13 +188,11 @@ snd_emux_close_seq_oss(struct snd_seq_oss_arg *arg) - if (snd_BUG_ON(!emu)) - return -ENXIO; - -- mutex_lock(&emu->register_mutex); - snd_emux_sounds_off_all(p); - snd_soundfont_close_check(emu->sflist, SF_CLIENT_NO(p->chset.port)); - snd_seq_event_port_detach(p->chset.client, p->chset.port); - snd_emux_dec_count(emu); - -- mutex_unlock(&emu->register_mutex); - return 0; - } - -diff --git a/sound/synth/emux/emux_seq.c b/sound/synth/emux/emux_seq.c -index 7778b8e19782..a0209204ae48 100644 ---- a/sound/synth/emux/emux_seq.c -+++ b/sound/synth/emux/emux_seq.c -@@ -124,12 +124,10 @@ snd_emux_detach_seq(struct snd_emux *emu) - if (emu->voices) - snd_emux_terminate_all(emu); - -- mutex_lock(&emu->register_mutex); - if (emu->client >= 0) { - snd_seq_delete_kernel_client(emu->client); - emu->client = -1; - } -- mutex_unlock(&emu->register_mutex); - } - - -@@ -269,8 +267,8 @@ snd_emux_event_input(struct snd_seq_event *ev, int direct, void *private_data, - /* - * increment usage count - */ --int --snd_emux_inc_count(struct snd_emux *emu) -+static int -+__snd_emux_inc_count(struct snd_emux *emu) - { - emu->used++; - if (!try_module_get(emu->ops.owner)) -@@ -284,12 +282,21 @@ snd_emux_inc_count(struct snd_emux *emu) - return 1; - } - -+int snd_emux_inc_count(struct snd_emux *emu) -+{ -+ int ret; -+ -+ mutex_lock(&emu->register_mutex); -+ ret = __snd_emux_inc_count(emu); -+ mutex_unlock(&emu->register_mutex); -+ return ret; -+} - - /* - * decrease usage count - */ --void --snd_emux_dec_count(struct snd_emux *emu) -+static void -+__snd_emux_dec_count(struct snd_emux *emu) - { - module_put(emu->card->module); - emu->used--; -@@ -298,6 +305,12 @@ snd_emux_dec_count(struct snd_emux *emu) - module_put(emu->ops.owner); - } - -+void snd_emux_dec_count(struct snd_emux *emu) -+{ -+ mutex_lock(&emu->register_mutex); -+ __snd_emux_dec_count(emu); -+ mutex_unlock(&emu->register_mutex); -+} - - /* - * Routine that is called upon a first use of a particular port -@@ -317,7 +330,7 @@ snd_emux_use(void *private_data, struct snd_seq_port_subscribe *info) - - mutex_lock(&emu->register_mutex); - snd_emux_init_port(p); -- snd_emux_inc_count(emu); -+ __snd_emux_inc_count(emu); - mutex_unlock(&emu->register_mutex); - return 0; - } -@@ -340,7 +353,7 @@ snd_emux_unuse(void *private_data, struct snd_seq_port_subscribe *info) - - mutex_lock(&emu->register_mutex); - snd_emux_sounds_off_all(p); -- snd_emux_dec_count(emu); -+ __snd_emux_dec_count(emu); - mutex_unlock(&emu->register_mutex); - return 0; - } diff --git a/patch/kernel/odroidc2-default/patch-3.14.42-43.patch b/patch/kernel/odroidc2-default/patch-3.14.42-43.patch deleted file mode 100644 index f8f98cb322..0000000000 --- a/patch/kernel/odroidc2-default/patch-3.14.42-43.patch +++ /dev/null @@ -1,1548 +0,0 @@ -diff --git a/Documentation/devicetree/bindings/dma/fsl-mxs-dma.txt b/Documentation/devicetree/bindings/dma/fsl-mxs-dma.txt -index a4873e5e3e36..e30e184f50c7 100644 ---- a/Documentation/devicetree/bindings/dma/fsl-mxs-dma.txt -+++ b/Documentation/devicetree/bindings/dma/fsl-mxs-dma.txt -@@ -38,7 +38,7 @@ dma_apbx: dma-apbx@80024000 { - 80 81 68 69 - 70 71 72 73 - 74 75 76 77>; -- interrupt-names = "auart4-rx", "aurat4-tx", "spdif-tx", "empty", -+ interrupt-names = "auart4-rx", "auart4-tx", "spdif-tx", "empty", - "saif0", "saif1", "i2c0", "i2c1", - "auart0-rx", "auart0-tx", "auart1-rx", "auart1-tx", - "auart2-rx", "auart2-tx", "auart3-rx", "auart3-tx"; -diff --git a/Makefile b/Makefile -index b9d850d86366..ae5f1e62812f 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 3 - PATCHLEVEL = 14 --SUBLEVEL = 42 -+SUBLEVEL = 43 - EXTRAVERSION = - NAME = Remembering Coco - -diff --git a/arch/arm/boot/dts/armada-xp-openblocks-ax3-4.dts b/arch/arm/boot/dts/armada-xp-openblocks-ax3-4.dts -index 1c6bd83bde5e..2ade35703d72 100644 ---- a/arch/arm/boot/dts/armada-xp-openblocks-ax3-4.dts -+++ b/arch/arm/boot/dts/armada-xp-openblocks-ax3-4.dts -@@ -69,6 +69,10 @@ - }; - - internal-regs { -+ rtc@10300 { -+ /* No crystal connected to the internal RTC */ -+ status = "disabled"; -+ }; - serial@12000 { - clock-frequency = <250000000>; - status = "okay"; -diff --git a/arch/arm/boot/dts/imx23-olinuxino.dts b/arch/arm/boot/dts/imx23-olinuxino.dts -index 526bfdbd87f9..f8922fb9bf50 100644 ---- a/arch/arm/boot/dts/imx23-olinuxino.dts -+++ b/arch/arm/boot/dts/imx23-olinuxino.dts -@@ -12,6 +12,7 @@ - */ - - /dts-v1/; -+#include - #include "imx23.dtsi" - - / { -@@ -93,6 +94,7 @@ - - ahb@80080000 { - usb0: usb@80080000 { -+ dr_mode = "host"; - vbus-supply = <®_usb0_vbus>; - status = "okay"; - }; -@@ -119,7 +121,7 @@ - - user { - label = "green"; -- gpios = <&gpio2 1 1>; -+ gpios = <&gpio2 1 GPIO_ACTIVE_HIGH>; - }; - }; - }; -diff --git a/arch/arm/boot/dts/imx25.dtsi b/arch/arm/boot/dts/imx25.dtsi -index cf3300a3071d..bfc327ff70af 100644 ---- a/arch/arm/boot/dts/imx25.dtsi -+++ b/arch/arm/boot/dts/imx25.dtsi -@@ -411,6 +411,7 @@ - - pwm4: pwm@53fc8000 { - compatible = "fsl,imx25-pwm", "fsl,imx27-pwm"; -+ #pwm-cells = <2>; - reg = <0x53fc8000 0x4000>; - clocks = <&clks 108>, <&clks 52>; - clock-names = "ipg", "per"; -diff --git a/arch/arm/boot/dts/imx28.dtsi b/arch/arm/boot/dts/imx28.dtsi -index f8e9b20f6982..ee1a4da35cc4 100644 ---- a/arch/arm/boot/dts/imx28.dtsi -+++ b/arch/arm/boot/dts/imx28.dtsi -@@ -803,7 +803,7 @@ - 80 81 68 69 - 70 71 72 73 - 74 75 76 77>; -- interrupt-names = "auart4-rx", "aurat4-tx", "spdif-tx", "empty", -+ interrupt-names = "auart4-rx", "auart4-tx", "spdif-tx", "empty", - "saif0", "saif1", "i2c0", "i2c1", - "auart0-rx", "auart0-tx", "auart1-rx", "auart1-tx", - "auart2-rx", "auart2-tx", "auart3-rx", "auart3-tx"; -diff --git a/arch/arm/boot/dts/ste-dbx5x0.dtsi b/arch/arm/boot/dts/ste-dbx5x0.dtsi -index e0853ea02df2..75e748efa9c2 100644 ---- a/arch/arm/boot/dts/ste-dbx5x0.dtsi -+++ b/arch/arm/boot/dts/ste-dbx5x0.dtsi -@@ -985,23 +985,6 @@ - status = "disabled"; - }; - -- vmmci: regulator-gpio { -- compatible = "regulator-gpio"; -- -- regulator-min-microvolt = <1800000>; -- regulator-max-microvolt = <2900000>; -- regulator-name = "mmci-reg"; -- regulator-type = "voltage"; -- -- startup-delay-us = <100>; -- enable-active-high; -- -- states = <1800000 0x1 -- 2900000 0x0>; -- -- status = "disabled"; -- }; -- - mcde@a0350000 { - compatible = "stericsson,mcde"; - reg = <0xa0350000 0x1000>, /* MCDE */ -diff --git a/arch/arm/boot/dts/ste-href.dtsi b/arch/arm/boot/dts/ste-href.dtsi -index 6cb9b68e2188..0b668f87dd40 100644 ---- a/arch/arm/boot/dts/ste-href.dtsi -+++ b/arch/arm/boot/dts/ste-href.dtsi -@@ -111,6 +111,21 @@ - pinctrl-1 = <&i2c3_sleep_mode>; - }; - -+ vmmci: regulator-gpio { -+ compatible = "regulator-gpio"; -+ -+ regulator-min-microvolt = <1800000>; -+ regulator-max-microvolt = <2900000>; -+ regulator-name = "mmci-reg"; -+ regulator-type = "voltage"; -+ -+ startup-delay-us = <100>; -+ enable-active-high; -+ -+ states = <1800000 0x1 -+ 2900000 0x0>; -+ }; -+ - // External Micro SD slot - sdi0_per1@80126000 { - arm,primecell-periphid = <0x10480180>; -diff --git a/arch/arm/boot/dts/ste-snowball.dts b/arch/arm/boot/dts/ste-snowball.dts -index 97d5d21b7db7..5deaf3c1292f 100644 ---- a/arch/arm/boot/dts/ste-snowball.dts -+++ b/arch/arm/boot/dts/ste-snowball.dts -@@ -146,8 +146,21 @@ - }; - - vmmci: regulator-gpio { -+ compatible = "regulator-gpio"; -+ - gpios = <&gpio7 4 0x4>; - enable-gpio = <&gpio6 25 0x4>; -+ -+ regulator-min-microvolt = <1800000>; -+ regulator-max-microvolt = <2900000>; -+ regulator-name = "mmci-reg"; -+ regulator-type = "voltage"; -+ -+ startup-delay-us = <100>; -+ enable-active-high; -+ -+ states = <1800000 0x1 -+ 2900000 0x0>; - }; - - // External Micro SD slot -diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c -index 271b5e971568..6adf5913a7ac 100644 ---- a/arch/arm/net/bpf_jit_32.c -+++ b/arch/arm/net/bpf_jit_32.c -@@ -449,10 +449,21 @@ static inline void emit_udiv(u8 rd, u8 rm, u8 rn, struct jit_ctx *ctx) - return; - } - #endif -- if (rm != ARM_R0) -- emit(ARM_MOV_R(ARM_R0, rm), ctx); -+ -+ /* -+ * For BPF_ALU | BPF_DIV | BPF_K instructions, rm is ARM_R4 -+ * (r_A) and rn is ARM_R0 (r_scratch) so load rn first into -+ * ARM_R1 to avoid accidentally overwriting ARM_R0 with rm -+ * before using it as a source for ARM_R1. -+ * -+ * For BPF_ALU | BPF_DIV | BPF_X rm is ARM_R4 (r_A) and rn is -+ * ARM_R5 (r_X) so there is no particular register overlap -+ * issues. -+ */ - if (rn != ARM_R1) - emit(ARM_MOV_R(ARM_R1, rn), ctx); -+ if (rm != ARM_R0) -+ emit(ARM_MOV_R(ARM_R0, rm), ctx); - - ctx->seen |= SEEN_CALL; - emit_mov_i(ARM_R3, (u32)jit_udiv, ctx); -diff --git a/drivers/acpi/acpica/acmacros.h b/drivers/acpi/acpica/acmacros.h -index 2a86c65d873b..97c7a52dfb4a 100644 ---- a/drivers/acpi/acpica/acmacros.h -+++ b/drivers/acpi/acpica/acmacros.h -@@ -63,19 +63,15 @@ - #define ACPI_SET64(ptr, val) (*ACPI_CAST64 (ptr) = (u64) (val)) - - /* -- * printf() format helpers -+ * printf() format helper. This macros is a workaround for the difficulties -+ * with emitting 64-bit integers and 64-bit pointers with the same code -+ * for both 32-bit and 64-bit hosts. - */ - - /* Split 64-bit integer into two 32-bit values. Use with %8.8X%8.8X */ - - #define ACPI_FORMAT_UINT64(i) ACPI_HIDWORD(i), ACPI_LODWORD(i) - --#if ACPI_MACHINE_WIDTH == 64 --#define ACPI_FORMAT_NATIVE_UINT(i) ACPI_FORMAT_UINT64(i) --#else --#define ACPI_FORMAT_NATIVE_UINT(i) 0, (i) --#endif -- - /* - * Macros for moving data around to/from buffers that are possibly unaligned. - * If the hardware supports the transfer of unaligned data, just do the store. -diff --git a/drivers/acpi/acpica/dsopcode.c b/drivers/acpi/acpica/dsopcode.c -index 5205edcf2c01..fe79296fdd9e 100644 ---- a/drivers/acpi/acpica/dsopcode.c -+++ b/drivers/acpi/acpica/dsopcode.c -@@ -446,7 +446,7 @@ acpi_ds_eval_region_operands(struct acpi_walk_state *walk_state, - - ACPI_DEBUG_PRINT((ACPI_DB_EXEC, "RgnObj %p Addr %8.8X%8.8X Len %X\n", - obj_desc, -- ACPI_FORMAT_NATIVE_UINT(obj_desc->region.address), -+ ACPI_FORMAT_UINT64(obj_desc->region.address), - obj_desc->region.length)); - - /* Now the address and length are valid for this opregion */ -@@ -539,13 +539,12 @@ acpi_ds_eval_table_region_operands(struct acpi_walk_state *walk_state, - return_ACPI_STATUS(AE_NOT_EXIST); - } - -- obj_desc->region.address = -- (acpi_physical_address) ACPI_TO_INTEGER(table); -+ obj_desc->region.address = ACPI_PTR_TO_PHYSADDR(table); - obj_desc->region.length = table->length; - - ACPI_DEBUG_PRINT((ACPI_DB_EXEC, "RgnObj %p Addr %8.8X%8.8X Len %X\n", - obj_desc, -- ACPI_FORMAT_NATIVE_UINT(obj_desc->region.address), -+ ACPI_FORMAT_UINT64(obj_desc->region.address), - obj_desc->region.length)); - - /* Now the address and length are valid for this opregion */ -diff --git a/drivers/acpi/acpica/evregion.c b/drivers/acpi/acpica/evregion.c -index cd4b231ae760..ee8ec4bf0611 100644 ---- a/drivers/acpi/acpica/evregion.c -+++ b/drivers/acpi/acpica/evregion.c -@@ -272,7 +272,7 @@ acpi_ev_address_space_dispatch(union acpi_operand_object *region_obj, - ACPI_DEBUG_PRINT((ACPI_DB_OPREGION, - "Handler %p (@%p) Address %8.8X%8.8X [%s]\n", - ®ion_obj->region.handler->address_space, handler, -- ACPI_FORMAT_NATIVE_UINT(address), -+ ACPI_FORMAT_UINT64(address), - acpi_ut_get_region_name(region_obj->region. - space_id))); - -diff --git a/drivers/acpi/acpica/exdump.c b/drivers/acpi/acpica/exdump.c -index 4d046faac48c..b64fb68aa5d3 100644 ---- a/drivers/acpi/acpica/exdump.c -+++ b/drivers/acpi/acpica/exdump.c -@@ -622,8 +622,8 @@ void acpi_ex_dump_operand(union acpi_operand_object *obj_desc, u32 depth) - acpi_os_printf("\n"); - } else { - acpi_os_printf(" base %8.8X%8.8X Length %X\n", -- ACPI_FORMAT_NATIVE_UINT(obj_desc->region. -- address), -+ ACPI_FORMAT_UINT64(obj_desc->region. -+ address), - obj_desc->region.length); - } - break; -diff --git a/drivers/acpi/acpica/exfldio.c b/drivers/acpi/acpica/exfldio.c -index 49fb742d61b9..98af39f0d677 100644 ---- a/drivers/acpi/acpica/exfldio.c -+++ b/drivers/acpi/acpica/exfldio.c -@@ -263,17 +263,15 @@ acpi_ex_access_region(union acpi_operand_object *obj_desc, - } - - ACPI_DEBUG_PRINT_RAW((ACPI_DB_BFIELD, -- " Region [%s:%X], Width %X, ByteBase %X, Offset %X at %p\n", -+ " Region [%s:%X], Width %X, ByteBase %X, Offset %X at %8.8X%8.8X\n", - acpi_ut_get_region_name(rgn_desc->region. - space_id), - rgn_desc->region.space_id, - obj_desc->common_field.access_byte_width, - obj_desc->common_field.base_byte_offset, -- field_datum_byte_offset, ACPI_CAST_PTR(void, -- (rgn_desc-> -- region. -- address + -- region_offset)))); -+ field_datum_byte_offset, -+ ACPI_FORMAT_UINT64(rgn_desc->region.address + -+ region_offset))); - - /* Invoke the appropriate address_space/op_region handler */ - -diff --git a/drivers/acpi/acpica/exregion.c b/drivers/acpi/acpica/exregion.c -index 9d28867e60dc..cf4022359dc7 100644 ---- a/drivers/acpi/acpica/exregion.c -+++ b/drivers/acpi/acpica/exregion.c -@@ -181,7 +181,7 @@ acpi_ex_system_memory_space_handler(u32 function, - if (!mem_info->mapped_logical_address) { - ACPI_ERROR((AE_INFO, - "Could not map memory at 0x%8.8X%8.8X, size %u", -- ACPI_FORMAT_NATIVE_UINT(address), -+ ACPI_FORMAT_UINT64(address), - (u32) map_length)); - mem_info->mapped_length = 0; - return_ACPI_STATUS(AE_NO_MEMORY); -@@ -202,8 +202,7 @@ acpi_ex_system_memory_space_handler(u32 function, - - ACPI_DEBUG_PRINT((ACPI_DB_INFO, - "System-Memory (width %u) R/W %u Address=%8.8X%8.8X\n", -- bit_width, function, -- ACPI_FORMAT_NATIVE_UINT(address))); -+ bit_width, function, ACPI_FORMAT_UINT64(address))); - - /* - * Perform the memory read or write -@@ -318,8 +317,7 @@ acpi_ex_system_io_space_handler(u32 function, - - ACPI_DEBUG_PRINT((ACPI_DB_INFO, - "System-IO (width %u) R/W %u Address=%8.8X%8.8X\n", -- bit_width, function, -- ACPI_FORMAT_NATIVE_UINT(address))); -+ bit_width, function, ACPI_FORMAT_UINT64(address))); - - /* Decode the function parameter */ - -diff --git a/drivers/acpi/acpica/hwvalid.c b/drivers/acpi/acpica/hwvalid.c -index eab70d58852a..fae57584a182 100644 ---- a/drivers/acpi/acpica/hwvalid.c -+++ b/drivers/acpi/acpica/hwvalid.c -@@ -142,17 +142,17 @@ acpi_hw_validate_io_request(acpi_io_address address, u32 bit_width) - byte_width = ACPI_DIV_8(bit_width); - last_address = address + byte_width - 1; - -- ACPI_DEBUG_PRINT((ACPI_DB_IO, "Address %p LastAddress %p Length %X", -- ACPI_CAST_PTR(void, address), ACPI_CAST_PTR(void, -- last_address), -- byte_width)); -+ ACPI_DEBUG_PRINT((ACPI_DB_IO, -+ "Address %8.8X%8.8X LastAddress %8.8X%8.8X Length %X", -+ ACPI_FORMAT_UINT64(address), -+ ACPI_FORMAT_UINT64(last_address), byte_width)); - - /* Maximum 16-bit address in I/O space */ - - if (last_address > ACPI_UINT16_MAX) { - ACPI_ERROR((AE_INFO, -- "Illegal I/O port address/length above 64K: %p/0x%X", -- ACPI_CAST_PTR(void, address), byte_width)); -+ "Illegal I/O port address/length above 64K: %8.8X%8.8X/0x%X", -+ ACPI_FORMAT_UINT64(address), byte_width)); - return_ACPI_STATUS(AE_LIMIT); - } - -@@ -181,8 +181,8 @@ acpi_hw_validate_io_request(acpi_io_address address, u32 bit_width) - - if (acpi_gbl_osi_data >= port_info->osi_dependency) { - ACPI_DEBUG_PRINT((ACPI_DB_IO, -- "Denied AML access to port 0x%p/%X (%s 0x%.4X-0x%.4X)", -- ACPI_CAST_PTR(void, address), -+ "Denied AML access to port 0x%8.8X%8.8X/%X (%s 0x%.4X-0x%.4X)", -+ ACPI_FORMAT_UINT64(address), - byte_width, port_info->name, - port_info->start, - port_info->end)); -diff --git a/drivers/acpi/acpica/nsdump.c b/drivers/acpi/acpica/nsdump.c -index 48b9c6f12643..fc82c532090f 100644 ---- a/drivers/acpi/acpica/nsdump.c -+++ b/drivers/acpi/acpica/nsdump.c -@@ -271,12 +271,11 @@ acpi_ns_dump_one_object(acpi_handle obj_handle, - switch (type) { - case ACPI_TYPE_PROCESSOR: - -- acpi_os_printf("ID %02X Len %02X Addr %p\n", -+ acpi_os_printf("ID %02X Len %02X Addr %8.8X%8.8X\n", - obj_desc->processor.proc_id, - obj_desc->processor.length, -- ACPI_CAST_PTR(void, -- obj_desc->processor. -- address)); -+ ACPI_FORMAT_UINT64(obj_desc->processor. -+ address)); - break; - - case ACPI_TYPE_DEVICE: -@@ -347,8 +346,9 @@ acpi_ns_dump_one_object(acpi_handle obj_handle, - space_id)); - if (obj_desc->region.flags & AOPOBJ_DATA_VALID) { - acpi_os_printf(" Addr %8.8X%8.8X Len %.4X\n", -- ACPI_FORMAT_NATIVE_UINT -- (obj_desc->region.address), -+ ACPI_FORMAT_UINT64(obj_desc-> -+ region. -+ address), - obj_desc->region.length); - } else { - acpi_os_printf -diff --git a/drivers/acpi/acpica/tbinstal.c b/drivers/acpi/acpica/tbinstal.c -index 634357d51fe9..c4d097700a86 100644 ---- a/drivers/acpi/acpica/tbinstal.c -+++ b/drivers/acpi/acpica/tbinstal.c -@@ -294,8 +294,7 @@ struct acpi_table_header *acpi_tb_table_override(struct acpi_table_header - ACPI_EXCEPTION((AE_INFO, AE_NO_MEMORY, - "%4.4s %p Attempted physical table override failed", - table_header->signature, -- ACPI_CAST_PTR(void, -- table_desc->address))); -+ ACPI_PHYSADDR_TO_PTR(table_desc->address))); - return (NULL); - } - -@@ -311,7 +310,7 @@ finish_override: - ACPI_INFO((AE_INFO, - "%4.4s %p %s table override, new table: %p", - table_header->signature, -- ACPI_CAST_PTR(void, table_desc->address), -+ ACPI_PHYSADDR_TO_PTR(table_desc->address), - override_type, new_table)); - - /* We can now unmap/delete the original table (if fully mapped) */ -diff --git a/drivers/acpi/acpica/tbprint.c b/drivers/acpi/acpica/tbprint.c -index 6866e767ba90..2957ed50b552 100644 ---- a/drivers/acpi/acpica/tbprint.c -+++ b/drivers/acpi/acpica/tbprint.c -@@ -127,16 +127,12 @@ acpi_tb_print_table_header(acpi_physical_address address, - { - struct acpi_table_header local_header; - -- /* -- * The reason that the Address is cast to a void pointer is so that we -- * can use %p which will work properly on both 32-bit and 64-bit hosts. -- */ - if (ACPI_COMPARE_NAME(header->signature, ACPI_SIG_FACS)) { - - /* FACS only has signature and length fields */ - -- ACPI_INFO((AE_INFO, "%4.4s %p %06X", -- header->signature, ACPI_CAST_PTR(void, address), -+ ACPI_INFO((AE_INFO, "%-4.4s 0x%8.8X%8.8X %06X", -+ header->signature, ACPI_FORMAT_UINT64(address), - header->length)); - } else if (ACPI_VALIDATE_RSDP_SIG(header->signature)) { - -@@ -147,8 +143,8 @@ acpi_tb_print_table_header(acpi_physical_address address, - header)->oem_id, ACPI_OEM_ID_SIZE); - acpi_tb_fix_string(local_header.oem_id, ACPI_OEM_ID_SIZE); - -- ACPI_INFO((AE_INFO, "RSDP %p %06X (v%.2d %6.6s)", -- ACPI_CAST_PTR(void, address), -+ ACPI_INFO((AE_INFO, "RSDP 0x%8.8X%8.8X %06X (v%.2d %-6.6s)", -+ ACPI_FORMAT_UINT64(address), - (ACPI_CAST_PTR(struct acpi_table_rsdp, header)-> - revision > - 0) ? ACPI_CAST_PTR(struct acpi_table_rsdp, -@@ -162,8 +158,9 @@ acpi_tb_print_table_header(acpi_physical_address address, - acpi_tb_cleanup_table_header(&local_header, header); - - ACPI_INFO((AE_INFO, -- "%4.4s %p %06X (v%.2d %6.6s %8.8s %08X %4.4s %08X)", -- local_header.signature, ACPI_CAST_PTR(void, address), -+ "%-4.4s 0x%8.8X%8.8X" -+ " %06X (v%.2d %-6.6s %-8.8s %08X %-4.4s %08X)", -+ local_header.signature, ACPI_FORMAT_UINT64(address), - local_header.length, local_header.revision, - local_header.oem_id, local_header.oem_table_id, - local_header.oem_revision, -diff --git a/drivers/acpi/acpica/tbutils.c b/drivers/acpi/acpica/tbutils.c -index 1bc879ec83d4..4cca6b797808 100644 ---- a/drivers/acpi/acpica/tbutils.c -+++ b/drivers/acpi/acpica/tbutils.c -@@ -227,8 +227,8 @@ acpi_tb_install_table(acpi_physical_address address, - table = acpi_os_map_memory(address, sizeof(struct acpi_table_header)); - if (!table) { - ACPI_ERROR((AE_INFO, -- "Could not map memory for table [%s] at %p", -- signature, ACPI_CAST_PTR(void, address))); -+ "Could not map memory for table [%s] at %8.8X%8.8X", -+ signature, ACPI_FORMAT_UINT64(address))); - return; - } - -diff --git a/drivers/acpi/acpica/tbxfload.c b/drivers/acpi/acpica/tbxfload.c -index 60b5a871833c..daad59d76e67 100644 ---- a/drivers/acpi/acpica/tbxfload.c -+++ b/drivers/acpi/acpica/tbxfload.c -@@ -184,11 +184,10 @@ static acpi_status acpi_tb_load_namespace(void) - * be useful for debugging ACPI problems on some machines. - */ - if (acpi_gbl_disable_ssdt_table_load) { -- ACPI_INFO((AE_INFO, "Ignoring %4.4s at %p", -+ ACPI_INFO((AE_INFO, "Ignoring %4.4s at %8.8X%8.8X", - acpi_gbl_root_table_list.tables[i].signature. -- ascii, ACPI_CAST_PTR(void, -- acpi_gbl_root_table_list. -- tables[i].address))); -+ ascii, ACPI_FORMAT_UINT64(acpi_gbl_root_table_list. -+ tables[i].address))); - continue; - } - -diff --git a/drivers/acpi/acpica/tbxfroot.c b/drivers/acpi/acpica/tbxfroot.c -index e4e1468877c3..01bf7ebef7a4 100644 ---- a/drivers/acpi/acpica/tbxfroot.c -+++ b/drivers/acpi/acpica/tbxfroot.c -@@ -111,7 +111,7 @@ acpi_status acpi_tb_validate_rsdp(struct acpi_table_rsdp *rsdp) - * - ******************************************************************************/ - --acpi_status __init acpi_find_root_pointer(acpi_size *table_address) -+acpi_status __init acpi_find_root_pointer(acpi_physical_address * table_address) - { - u8 *table_ptr; - u8 *mem_rover; -@@ -169,7 +169,8 @@ acpi_status __init acpi_find_root_pointer(acpi_size *table_address) - physical_address += - (u32) ACPI_PTR_DIFF(mem_rover, table_ptr); - -- *table_address = physical_address; -+ *table_address = -+ (acpi_physical_address) physical_address; - return_ACPI_STATUS(AE_OK); - } - } -@@ -202,7 +203,7 @@ acpi_status __init acpi_find_root_pointer(acpi_size *table_address) - (ACPI_HI_RSDP_WINDOW_BASE + - ACPI_PTR_DIFF(mem_rover, table_ptr)); - -- *table_address = physical_address; -+ *table_address = (acpi_physical_address) physical_address; - return_ACPI_STATUS(AE_OK); - } - -diff --git a/drivers/acpi/acpica/utaddress.c b/drivers/acpi/acpica/utaddress.c -index 2c2b6ae5dfc4..3a02b65a1d9e 100644 ---- a/drivers/acpi/acpica/utaddress.c -+++ b/drivers/acpi/acpica/utaddress.c -@@ -107,10 +107,10 @@ acpi_ut_add_address_range(acpi_adr_space_type space_id, - acpi_gbl_address_range_list[space_id] = range_info; - - ACPI_DEBUG_PRINT((ACPI_DB_NAMES, -- "\nAdded [%4.4s] address range: 0x%p-0x%p\n", -+ "\nAdded [%4.4s] address range: 0x%8.8X%8.8X-0x%8.8X%8.8X\n", - acpi_ut_get_node_name(range_info->region_node), -- ACPI_CAST_PTR(void, address), -- ACPI_CAST_PTR(void, range_info->end_address))); -+ ACPI_FORMAT_UINT64(address), -+ ACPI_FORMAT_UINT64(range_info->end_address))); - - (void)acpi_ut_release_mutex(ACPI_MTX_NAMESPACE); - return_ACPI_STATUS(AE_OK); -@@ -160,15 +160,13 @@ acpi_ut_remove_address_range(acpi_adr_space_type space_id, - } - - ACPI_DEBUG_PRINT((ACPI_DB_NAMES, -- "\nRemoved [%4.4s] address range: 0x%p-0x%p\n", -+ "\nRemoved [%4.4s] address range: 0x%8.8X%8.8X-0x%8.8X%8.8X\n", - acpi_ut_get_node_name(range_info-> - region_node), -- ACPI_CAST_PTR(void, -- range_info-> -- start_address), -- ACPI_CAST_PTR(void, -- range_info-> -- end_address))); -+ ACPI_FORMAT_UINT64(range_info-> -+ start_address), -+ ACPI_FORMAT_UINT64(range_info-> -+ end_address))); - - ACPI_FREE(range_info); - return_VOID; -@@ -245,16 +243,14 @@ acpi_ut_check_address_range(acpi_adr_space_type space_id, - region_node); - - ACPI_WARNING((AE_INFO, -- "%s range 0x%p-0x%p conflicts with OpRegion 0x%p-0x%p (%s)", -+ "%s range 0x%8.8X%8.8X-0x%8.8X%8.8X conflicts with OpRegion 0x%8.8X%8.8X-0x%8.8X%8.8X (%s)", - acpi_ut_get_region_name(space_id), -- ACPI_CAST_PTR(void, address), -- ACPI_CAST_PTR(void, end_address), -- ACPI_CAST_PTR(void, -- range_info-> -- start_address), -- ACPI_CAST_PTR(void, -- range_info-> -- end_address), -+ ACPI_FORMAT_UINT64(address), -+ ACPI_FORMAT_UINT64(end_address), -+ ACPI_FORMAT_UINT64(range_info-> -+ start_address), -+ ACPI_FORMAT_UINT64(range_info-> -+ end_address), - pathname)); - ACPI_FREE(pathname); - } -diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c -index f1fc14c33be5..a03e18f5e562 100644 ---- a/drivers/gpio/gpiolib.c -+++ b/drivers/gpio/gpiolib.c -@@ -800,6 +800,7 @@ static struct class gpio_class = { - */ - int gpiod_export(struct gpio_desc *desc, bool direction_may_change) - { -+ struct gpio_chip *chip; - unsigned long flags; - int status; - const char *ioname = NULL; -@@ -817,8 +818,16 @@ int gpiod_export(struct gpio_desc *desc, bool direction_may_change) - return -EINVAL; - } - -+ chip = desc->chip; -+ - mutex_lock(&sysfs_lock); - -+ /* check if chip is being removed */ -+ if (!chip || !chip->exported) { -+ status = -ENODEV; -+ goto fail_unlock; -+ } -+ - spin_lock_irqsave(&gpio_lock, flags); - if (!test_bit(FLAG_REQUESTED, &desc->flags) || - test_bit(FLAG_EXPORT, &desc->flags)) { -@@ -1057,12 +1066,15 @@ static void gpiochip_unexport(struct gpio_chip *chip) - { - int status; - struct device *dev; -+ struct gpio_desc *desc; -+ unsigned int i; - - mutex_lock(&sysfs_lock); - dev = class_find_device(&gpio_class, NULL, chip, match_export); - if (dev) { - put_device(dev); - device_unregister(dev); -+ /* prevent further gpiod exports */ - chip->exported = false; - status = 0; - } else -@@ -1071,6 +1083,13 @@ static void gpiochip_unexport(struct gpio_chip *chip) - - if (status) - chip_dbg(chip, "%s: status %d\n", __func__, status); -+ -+ /* unregister gpiod class devices owned by sysfs */ -+ for (i = 0; i < chip->ngpio; i++) { -+ desc = &chip->desc[i]; -+ if (test_and_clear_bit(FLAG_SYSFS, &desc->flags)) -+ gpiod_free(desc); -+ } - } - - static int __init gpiolib_sysfs_init(void) -@@ -1265,6 +1284,8 @@ int gpiochip_remove(struct gpio_chip *chip) - int status = 0; - unsigned id; - -+ gpiochip_unexport(chip); -+ - spin_lock_irqsave(&gpio_lock, flags); - - gpiochip_remove_pin_ranges(chip); -@@ -1286,9 +1307,6 @@ int gpiochip_remove(struct gpio_chip *chip) - - spin_unlock_irqrestore(&gpio_lock, flags); - -- if (status == 0) -- gpiochip_unexport(chip); -- - return status; - } - EXPORT_SYMBOL_GPL(gpiochip_remove); -diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c -index af49b24d14cb..1eb49941faff 100644 ---- a/drivers/gpu/drm/i915/intel_lvds.c -+++ b/drivers/gpu/drm/i915/intel_lvds.c -@@ -815,12 +815,28 @@ static int intel_dual_link_lvds_callback(const struct dmi_system_id *id) - static const struct dmi_system_id intel_dual_link_lvds[] = { - { - .callback = intel_dual_link_lvds_callback, -- .ident = "Apple MacBook Pro (Core i5/i7 Series)", -+ .ident = "Apple MacBook Pro 15\" (2010)", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro6,2"), -+ }, -+ }, -+ { -+ .callback = intel_dual_link_lvds_callback, -+ .ident = "Apple MacBook Pro 15\" (2011)", - .matches = { - DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."), - DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro8,2"), - }, - }, -+ { -+ .callback = intel_dual_link_lvds_callback, -+ .ident = "Apple MacBook Pro 15\" (2012)", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro9,1"), -+ }, -+ }, - { } /* terminating entry */ - }; - -diff --git a/drivers/gpu/drm/radeon/radeon_asic.c b/drivers/gpu/drm/radeon/radeon_asic.c -index 64d6cfba9952..d625a14ec038 100644 ---- a/drivers/gpu/drm/radeon/radeon_asic.c -+++ b/drivers/gpu/drm/radeon/radeon_asic.c -@@ -1173,7 +1173,7 @@ static struct radeon_asic rs780_asic = { - static struct radeon_asic_ring rv770_uvd_ring = { - .ib_execute = &uvd_v1_0_ib_execute, - .emit_fence = &uvd_v2_2_fence_emit, -- .emit_semaphore = &uvd_v1_0_semaphore_emit, -+ .emit_semaphore = &uvd_v2_2_semaphore_emit, - .cs_parse = &radeon_uvd_cs_parse, - .ring_test = &uvd_v1_0_ring_test, - .ib_test = &uvd_v1_0_ib_test, -diff --git a/drivers/gpu/drm/radeon/radeon_asic.h b/drivers/gpu/drm/radeon/radeon_asic.h -index ae637cfda783..f6e19edb1166 100644 ---- a/drivers/gpu/drm/radeon/radeon_asic.h -+++ b/drivers/gpu/drm/radeon/radeon_asic.h -@@ -853,6 +853,10 @@ void uvd_v1_0_ib_execute(struct radeon_device *rdev, struct radeon_ib *ib); - int uvd_v2_2_resume(struct radeon_device *rdev); - void uvd_v2_2_fence_emit(struct radeon_device *rdev, - struct radeon_fence *fence); -+bool uvd_v2_2_semaphore_emit(struct radeon_device *rdev, -+ struct radeon_ring *ring, -+ struct radeon_semaphore *semaphore, -+ bool emit_wait); - - /* uvd v3.1 */ - bool uvd_v3_1_semaphore_emit(struct radeon_device *rdev, -diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c -index 414e07928693..bcfac7624550 100644 ---- a/drivers/gpu/drm/radeon/radeon_uvd.c -+++ b/drivers/gpu/drm/radeon/radeon_uvd.c -@@ -350,6 +350,29 @@ static int radeon_uvd_cs_msg_decode(uint32_t *msg, unsigned buf_sizes[]) - return 0; - } - -+static int radeon_uvd_validate_codec(struct radeon_cs_parser *p, -+ unsigned stream_type) -+{ -+ switch (stream_type) { -+ case 0: /* H264 */ -+ case 1: /* VC1 */ -+ /* always supported */ -+ return 0; -+ -+ case 3: /* MPEG2 */ -+ case 4: /* MPEG4 */ -+ /* only since UVD 3 */ -+ if (p->rdev->family >= CHIP_PALM) -+ return 0; -+ -+ /* fall through */ -+ default: -+ DRM_ERROR("UVD codec not supported by hardware %d!\n", -+ stream_type); -+ return -EINVAL; -+ } -+} -+ - static int radeon_uvd_cs_msg(struct radeon_cs_parser *p, struct radeon_bo *bo, - unsigned offset, unsigned buf_sizes[]) - { -@@ -388,50 +411,70 @@ static int radeon_uvd_cs_msg(struct radeon_cs_parser *p, struct radeon_bo *bo, - return -EINVAL; - } - -- if (msg_type == 1) { -- /* it's a decode msg, calc buffer sizes */ -- r = radeon_uvd_cs_msg_decode(msg, buf_sizes); -- /* calc image size (width * height) */ -- img_size = msg[6] * msg[7]; -+ switch (msg_type) { -+ case 0: -+ /* it's a create msg, calc image size (width * height) */ -+ img_size = msg[7] * msg[8]; -+ -+ r = radeon_uvd_validate_codec(p, msg[4]); -+ radeon_bo_kunmap(bo); -+ if (r) -+ return r; -+ -+ /* try to alloc a new handle */ -+ for (i = 0; i < RADEON_MAX_UVD_HANDLES; ++i) { -+ if (atomic_read(&p->rdev->uvd.handles[i]) == handle) { -+ DRM_ERROR("Handle 0x%x already in use!\n", handle); -+ return -EINVAL; -+ } -+ -+ if (!atomic_cmpxchg(&p->rdev->uvd.handles[i], 0, handle)) { -+ p->rdev->uvd.filp[i] = p->filp; -+ p->rdev->uvd.img_size[i] = img_size; -+ return 0; -+ } -+ } -+ -+ DRM_ERROR("No more free UVD handles!\n"); -+ return -EINVAL; -+ -+ case 1: -+ /* it's a decode msg, validate codec and calc buffer sizes */ -+ r = radeon_uvd_validate_codec(p, msg[4]); -+ if (!r) -+ r = radeon_uvd_cs_msg_decode(msg, buf_sizes); - radeon_bo_kunmap(bo); - if (r) - return r; - -- } else if (msg_type == 2) { -+ /* validate the handle */ -+ for (i = 0; i < RADEON_MAX_UVD_HANDLES; ++i) { -+ if (atomic_read(&p->rdev->uvd.handles[i]) == handle) { -+ if (p->rdev->uvd.filp[i] != p->filp) { -+ DRM_ERROR("UVD handle collision detected!\n"); -+ return -EINVAL; -+ } -+ return 0; -+ } -+ } -+ -+ DRM_ERROR("Invalid UVD handle 0x%x!\n", handle); -+ return -ENOENT; -+ -+ case 2: - /* it's a destroy msg, free the handle */ - for (i = 0; i < RADEON_MAX_UVD_HANDLES; ++i) - atomic_cmpxchg(&p->rdev->uvd.handles[i], handle, 0); - radeon_bo_kunmap(bo); - return 0; -- } else { -- /* it's a create msg, calc image size (width * height) */ -- img_size = msg[7] * msg[8]; -- radeon_bo_kunmap(bo); - -- if (msg_type != 0) { -- DRM_ERROR("Illegal UVD message type (%d)!\n", msg_type); -- return -EINVAL; -- } -- -- /* it's a create msg, no special handling needed */ -- } -- -- /* create or decode, validate the handle */ -- for (i = 0; i < RADEON_MAX_UVD_HANDLES; ++i) { -- if (atomic_read(&p->rdev->uvd.handles[i]) == handle) -- return 0; -- } -+ default: - -- /* handle not found try to alloc a new one */ -- for (i = 0; i < RADEON_MAX_UVD_HANDLES; ++i) { -- if (!atomic_cmpxchg(&p->rdev->uvd.handles[i], 0, handle)) { -- p->rdev->uvd.filp[i] = p->filp; -- p->rdev->uvd.img_size[i] = img_size; -- return 0; -- } -+ DRM_ERROR("Illegal UVD message type (%d)!\n", msg_type); -+ return -EINVAL; - } - -- DRM_ERROR("No more free UVD handles!\n"); -+ BUG(); - return -EINVAL; - } - -diff --git a/drivers/gpu/drm/radeon/rv770d.h b/drivers/gpu/drm/radeon/rv770d.h -index 3cf1e2921545..9ef2064b1c9c 100644 ---- a/drivers/gpu/drm/radeon/rv770d.h -+++ b/drivers/gpu/drm/radeon/rv770d.h -@@ -989,6 +989,9 @@ - ((n) & 0x3FFF) << 16) - - /* UVD */ -+#define UVD_SEMA_ADDR_LOW 0xef00 -+#define UVD_SEMA_ADDR_HIGH 0xef04 -+#define UVD_SEMA_CMD 0xef08 - #define UVD_GPCOM_VCPU_CMD 0xef0c - #define UVD_GPCOM_VCPU_DATA0 0xef10 - #define UVD_GPCOM_VCPU_DATA1 0xef14 -diff --git a/drivers/gpu/drm/radeon/uvd_v1_0.c b/drivers/gpu/drm/radeon/uvd_v1_0.c -index c310a0aeebb9..0fa9009fef64 100644 ---- a/drivers/gpu/drm/radeon/uvd_v1_0.c -+++ b/drivers/gpu/drm/radeon/uvd_v1_0.c -@@ -365,18 +365,8 @@ bool uvd_v1_0_semaphore_emit(struct radeon_device *rdev, - struct radeon_semaphore *semaphore, - bool emit_wait) - { -- uint64_t addr = semaphore->gpu_addr; -- -- radeon_ring_write(ring, PACKET0(UVD_SEMA_ADDR_LOW, 0)); -- radeon_ring_write(ring, (addr >> 3) & 0x000FFFFF); -- -- radeon_ring_write(ring, PACKET0(UVD_SEMA_ADDR_HIGH, 0)); -- radeon_ring_write(ring, (addr >> 23) & 0x000FFFFF); -- -- radeon_ring_write(ring, PACKET0(UVD_SEMA_CMD, 0)); -- radeon_ring_write(ring, emit_wait ? 1 : 0); -- -- return true; -+ /* disable semaphores for UVD V1 hardware */ -+ return false; - } - - /** -diff --git a/drivers/gpu/drm/radeon/uvd_v2_2.c b/drivers/gpu/drm/radeon/uvd_v2_2.c -index d1771004cb52..19ccb2ae7a5d 100644 ---- a/drivers/gpu/drm/radeon/uvd_v2_2.c -+++ b/drivers/gpu/drm/radeon/uvd_v2_2.c -@@ -60,6 +60,35 @@ void uvd_v2_2_fence_emit(struct radeon_device *rdev, - } - - /** -+ * uvd_v2_2_semaphore_emit - emit semaphore command -+ * -+ * @rdev: radeon_device pointer -+ * @ring: radeon_ring pointer -+ * @semaphore: semaphore to emit commands for -+ * @emit_wait: true if we should emit a wait command -+ * -+ * Emit a semaphore command (either wait or signal) to the UVD ring. -+ */ -+bool uvd_v2_2_semaphore_emit(struct radeon_device *rdev, -+ struct radeon_ring *ring, -+ struct radeon_semaphore *semaphore, -+ bool emit_wait) -+{ -+ uint64_t addr = semaphore->gpu_addr; -+ -+ radeon_ring_write(ring, PACKET0(UVD_SEMA_ADDR_LOW, 0)); -+ radeon_ring_write(ring, (addr >> 3) & 0x000FFFFF); -+ -+ radeon_ring_write(ring, PACKET0(UVD_SEMA_ADDR_HIGH, 0)); -+ radeon_ring_write(ring, (addr >> 23) & 0x000FFFFF); -+ -+ radeon_ring_write(ring, PACKET0(UVD_SEMA_CMD, 0)); -+ radeon_ring_write(ring, emit_wait ? 1 : 0); -+ -+ return true; -+} -+ -+/** - * uvd_v2_2_resume - memory controller programming - * - * @rdev: radeon_device pointer -diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c -index 42c3058e6e9c..dbd7d66977c9 100644 ---- a/drivers/infiniband/core/cma.c -+++ b/drivers/infiniband/core/cma.c -@@ -859,19 +859,27 @@ static void cma_save_ib_info(struct rdma_cm_id *id, struct rdma_cm_id *listen_id - memcpy(&ib->sib_addr, &path->dgid, 16); - } - -+static __be16 ss_get_port(const struct sockaddr_storage *ss) -+{ -+ if (ss->ss_family == AF_INET) -+ return ((struct sockaddr_in *)ss)->sin_port; -+ else if (ss->ss_family == AF_INET6) -+ return ((struct sockaddr_in6 *)ss)->sin6_port; -+ BUG(); -+} -+ - static void cma_save_ip4_info(struct rdma_cm_id *id, struct rdma_cm_id *listen_id, - struct cma_hdr *hdr) - { -- struct sockaddr_in *listen4, *ip4; -+ struct sockaddr_in *ip4; - -- listen4 = (struct sockaddr_in *) &listen_id->route.addr.src_addr; - ip4 = (struct sockaddr_in *) &id->route.addr.src_addr; -- ip4->sin_family = listen4->sin_family; -+ ip4->sin_family = AF_INET; - ip4->sin_addr.s_addr = hdr->dst_addr.ip4.addr; -- ip4->sin_port = listen4->sin_port; -+ ip4->sin_port = ss_get_port(&listen_id->route.addr.src_addr); - - ip4 = (struct sockaddr_in *) &id->route.addr.dst_addr; -- ip4->sin_family = listen4->sin_family; -+ ip4->sin_family = AF_INET; - ip4->sin_addr.s_addr = hdr->src_addr.ip4.addr; - ip4->sin_port = hdr->port; - } -@@ -879,16 +887,15 @@ static void cma_save_ip4_info(struct rdma_cm_id *id, struct rdma_cm_id *listen_i - static void cma_save_ip6_info(struct rdma_cm_id *id, struct rdma_cm_id *listen_id, - struct cma_hdr *hdr) - { -- struct sockaddr_in6 *listen6, *ip6; -+ struct sockaddr_in6 *ip6; - -- listen6 = (struct sockaddr_in6 *) &listen_id->route.addr.src_addr; - ip6 = (struct sockaddr_in6 *) &id->route.addr.src_addr; -- ip6->sin6_family = listen6->sin6_family; -+ ip6->sin6_family = AF_INET6; - ip6->sin6_addr = hdr->dst_addr.ip6; -- ip6->sin6_port = listen6->sin6_port; -+ ip6->sin6_port = ss_get_port(&listen_id->route.addr.src_addr); - - ip6 = (struct sockaddr_in6 *) &id->route.addr.dst_addr; -- ip6->sin6_family = listen6->sin6_family; -+ ip6->sin6_family = AF_INET6; - ip6->sin6_addr = hdr->src_addr.ip6; - ip6->sin6_port = hdr->port; - } -diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c -index 5a4cda24e302..4a8d19d0a5a4 100644 ---- a/drivers/md/dm-crypt.c -+++ b/drivers/md/dm-crypt.c -@@ -915,10 +915,11 @@ static int crypt_convert(struct crypt_config *cc, - - switch (r) { - /* async */ -- case -EINPROGRESS: - case -EBUSY: - wait_for_completion(&ctx->restart); - reinit_completion(&ctx->restart); -+ /* fall through*/ -+ case -EINPROGRESS: - ctx->req = NULL; - ctx->cc_sector++; - continue; -@@ -1313,8 +1314,10 @@ static void kcryptd_async_done(struct crypto_async_request *async_req, - struct dm_crypt_io *io = container_of(ctx, struct dm_crypt_io, ctx); - struct crypt_config *cc = io->cc; - -- if (error == -EINPROGRESS) -+ if (error == -EINPROGRESS) { -+ complete(&ctx->restart); - return; -+ } - - if (!error && cc->iv_gen_ops && cc->iv_gen_ops->post) - error = cc->iv_gen_ops->post(cc, iv_of_dmreq(cc, dmreq), dmreq); -@@ -1325,15 +1328,12 @@ static void kcryptd_async_done(struct crypto_async_request *async_req, - mempool_free(req_of_dmreq(cc, dmreq), cc->req_pool); - - if (!atomic_dec_and_test(&ctx->cc_pending)) -- goto done; -+ return; - - if (bio_data_dir(io->base_bio) == READ) - kcryptd_crypt_read_done(io); - else - kcryptd_crypt_write_io_submit(io, 1); --done: -- if (!completion_done(&ctx->restart)) -- complete(&ctx->restart); - } - - static void kcryptd_crypt(struct work_struct *work) -diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c -index df72c478c5a2..b1e21fc869c3 100644 ---- a/drivers/mmc/card/block.c -+++ b/drivers/mmc/card/block.c -@@ -951,6 +951,18 @@ static inline void mmc_blk_reset_success(struct mmc_blk_data *md, int type) - md->reset_done &= ~type; - } - -+int mmc_access_rpmb(struct mmc_queue *mq) -+{ -+ struct mmc_blk_data *md = mq->data; -+ /* -+ * If this is a RPMB partition access, return ture -+ */ -+ if (md && md->part_type == EXT_CSD_PART_CONFIG_ACC_RPMB) -+ return true; -+ -+ return false; -+} -+ - static int mmc_blk_issue_discard_rq(struct mmc_queue *mq, struct request *req) - { - struct mmc_blk_data *md = mq->data; -diff --git a/drivers/mmc/card/queue.c b/drivers/mmc/card/queue.c -index 3e049c13429c..6ceede0a0bf7 100644 ---- a/drivers/mmc/card/queue.c -+++ b/drivers/mmc/card/queue.c -@@ -38,7 +38,7 @@ static int mmc_prep_request(struct request_queue *q, struct request *req) - return BLKPREP_KILL; - } - -- if (mq && mmc_card_removed(mq->card)) -+ if (mq && (mmc_card_removed(mq->card) || mmc_access_rpmb(mq))) - return BLKPREP_KILL; - - req->cmd_flags |= REQ_DONTPREP; -diff --git a/drivers/mmc/card/queue.h b/drivers/mmc/card/queue.h -index 5752d50049a3..99e6521e6169 100644 ---- a/drivers/mmc/card/queue.h -+++ b/drivers/mmc/card/queue.h -@@ -73,4 +73,6 @@ extern void mmc_queue_bounce_post(struct mmc_queue_req *); - extern int mmc_packed_init(struct mmc_queue *, struct mmc_card *); - extern void mmc_packed_clean(struct mmc_queue *); - -+extern int mmc_access_rpmb(struct mmc_queue *); -+ - #endif -diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c -index 098374b1ab2b..6a881ebe5b02 100644 ---- a/drivers/mmc/core/core.c -+++ b/drivers/mmc/core/core.c -@@ -2657,6 +2657,7 @@ int mmc_pm_notify(struct notifier_block *notify_block, - switch (mode) { - case PM_HIBERNATION_PREPARE: - case PM_SUSPEND_PREPARE: -+ case PM_RESTORE_PREPARE: - spin_lock_irqsave(&host->lock, flags); - host->rescan_disable = 1; - spin_unlock_irqrestore(&host->lock, flags); -diff --git a/drivers/mmc/host/sh_mmcif.c b/drivers/mmc/host/sh_mmcif.c -index 54730f4aac87..9c208fdf43ab 100644 ---- a/drivers/mmc/host/sh_mmcif.c -+++ b/drivers/mmc/host/sh_mmcif.c -@@ -1401,7 +1401,7 @@ static int sh_mmcif_probe(struct platform_device *pdev) - host = mmc_priv(mmc); - host->mmc = mmc; - host->addr = reg; -- host->timeout = msecs_to_jiffies(1000); -+ host->timeout = msecs_to_jiffies(10000); - host->ccs_enable = !pd || !pd->ccs_unsupported; - host->clk_ctrl2_enable = pd && pd->clk_ctrl2_present; - -diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c -index 988f5e18763a..a2a79c737b1b 100644 ---- a/drivers/pinctrl/core.c -+++ b/drivers/pinctrl/core.c -@@ -1121,7 +1121,7 @@ void devm_pinctrl_put(struct pinctrl *p) - EXPORT_SYMBOL_GPL(devm_pinctrl_put); - - int pinctrl_register_map(struct pinctrl_map const *maps, unsigned num_maps, -- bool dup, bool locked) -+ bool dup) - { - int i, ret; - struct pinctrl_maps *maps_node; -@@ -1189,11 +1189,9 @@ int pinctrl_register_map(struct pinctrl_map const *maps, unsigned num_maps, - maps_node->maps = maps; - } - -- if (!locked) -- mutex_lock(&pinctrl_maps_mutex); -+ mutex_lock(&pinctrl_maps_mutex); - list_add_tail(&maps_node->node, &pinctrl_maps); -- if (!locked) -- mutex_unlock(&pinctrl_maps_mutex); -+ mutex_unlock(&pinctrl_maps_mutex); - - return 0; - } -@@ -1208,7 +1206,7 @@ int pinctrl_register_map(struct pinctrl_map const *maps, unsigned num_maps, - int pinctrl_register_mappings(struct pinctrl_map const *maps, - unsigned num_maps) - { -- return pinctrl_register_map(maps, num_maps, true, false); -+ return pinctrl_register_map(maps, num_maps, true); - } - - void pinctrl_unregister_map(struct pinctrl_map const *map) -diff --git a/drivers/pinctrl/core.h b/drivers/pinctrl/core.h -index 75476b3d87da..b24ea846c867 100644 ---- a/drivers/pinctrl/core.h -+++ b/drivers/pinctrl/core.h -@@ -183,7 +183,7 @@ static inline struct pin_desc *pin_desc_get(struct pinctrl_dev *pctldev, - } - - int pinctrl_register_map(struct pinctrl_map const *maps, unsigned num_maps, -- bool dup, bool locked); -+ bool dup); - void pinctrl_unregister_map(struct pinctrl_map const *map); - - extern int pinctrl_force_sleep(struct pinctrl_dev *pctldev); -diff --git a/drivers/pinctrl/devicetree.c b/drivers/pinctrl/devicetree.c -index 340fb4e6c600..fd91c4c31f6b 100644 ---- a/drivers/pinctrl/devicetree.c -+++ b/drivers/pinctrl/devicetree.c -@@ -92,7 +92,7 @@ static int dt_remember_or_free_map(struct pinctrl *p, const char *statename, - dt_map->num_maps = num_maps; - list_add_tail(&dt_map->node, &p->dt_maps); - -- return pinctrl_register_map(map, num_maps, false, true); -+ return pinctrl_register_map(map, num_maps, false); - } - - struct pinctrl_dev *of_pinctrl_get(struct device_node *np) -diff --git a/drivers/tty/hvc/hvc_xen.c b/drivers/tty/hvc/hvc_xen.c -index 2dc2831840ca..8eb65f26fcae 100644 ---- a/drivers/tty/hvc/hvc_xen.c -+++ b/drivers/tty/hvc/hvc_xen.c -@@ -299,11 +299,27 @@ static int xen_initial_domain_console_init(void) - return 0; - } - -+static void xen_console_update_evtchn(struct xencons_info *info) -+{ -+ if (xen_hvm_domain()) { -+ uint64_t v; -+ int err; -+ -+ err = hvm_get_parameter(HVM_PARAM_CONSOLE_EVTCHN, &v); -+ if (!err && v) -+ info->evtchn = v; -+ } else -+ info->evtchn = xen_start_info->console.domU.evtchn; -+} -+ - void xen_console_resume(void) - { - struct xencons_info *info = vtermno_to_xencons(HVC_COOKIE); -- if (info != NULL && info->irq) -+ if (info != NULL && info->irq) { -+ if (!xen_initial_domain()) -+ xen_console_update_evtchn(info); - rebind_evtchn_irq(info->evtchn, info->irq); -+ } - } - - static void xencons_disconnect_backend(struct xencons_info *info) -diff --git a/drivers/xen/events/events_2l.c b/drivers/xen/events/events_2l.c -index d7ff91757307..843e5d8538bd 100644 ---- a/drivers/xen/events/events_2l.c -+++ b/drivers/xen/events/events_2l.c -@@ -352,6 +352,15 @@ irqreturn_t xen_debug_interrupt(int irq, void *dev_id) - return IRQ_HANDLED; - } - -+static void evtchn_2l_resume(void) -+{ -+ int i; -+ -+ for_each_online_cpu(i) -+ memset(per_cpu(cpu_evtchn_mask, i), 0, sizeof(xen_ulong_t) * -+ EVTCHN_2L_NR_CHANNELS/BITS_PER_EVTCHN_WORD); -+} -+ - static const struct evtchn_ops evtchn_ops_2l = { - .max_channels = evtchn_2l_max_channels, - .nr_channels = evtchn_2l_max_channels, -@@ -363,6 +372,7 @@ static const struct evtchn_ops evtchn_ops_2l = { - .mask = evtchn_2l_mask, - .unmask = evtchn_2l_unmask, - .handle_events = evtchn_2l_handle_events, -+ .resume = evtchn_2l_resume, - }; - - void __init xen_evtchn_2l_init(void) -diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c -index c8860a8757ac..a5cc476256f1 100644 ---- a/drivers/xen/events/events_base.c -+++ b/drivers/xen/events/events_base.c -@@ -550,8 +550,8 @@ static unsigned int __startup_pirq(unsigned int irq) - if (rc) - goto err; - -- bind_evtchn_to_cpu(evtchn, 0); - info->evtchn = evtchn; -+ bind_evtchn_to_cpu(evtchn, 0); - - rc = xen_evtchn_port_setup(info); - if (rc) -@@ -1294,8 +1294,9 @@ void rebind_evtchn_irq(int evtchn, int irq) - - mutex_unlock(&irq_mapping_update_lock); - -- /* new event channels are always bound to cpu 0 */ -- irq_set_affinity(irq, cpumask_of(0)); -+ bind_evtchn_to_cpu(evtchn, info->cpu); -+ /* This will be deferred until interrupt is processed */ -+ irq_set_affinity(irq, cpumask_of(info->cpu)); - - /* Unmask the event channel. */ - enable_irq(irq); -diff --git a/fs/dcache.c b/fs/dcache.c -index c345f5f2b508..a9231c872342 100644 ---- a/fs/dcache.c -+++ b/fs/dcache.c -@@ -435,7 +435,7 @@ static struct dentry *d_kill(struct dentry *dentry, struct dentry *parent) - __releases(parent->d_lock) - __releases(dentry->d_inode->i_lock) - { -- list_del(&dentry->d_child); -+ __list_del_entry(&dentry->d_child); - /* - * Inform d_walk() that we are no longer attached to the - * dentry tree -@@ -1123,33 +1123,31 @@ resume: - /* - * All done at this level ... ascend and resume the search. - */ -+ rcu_read_lock(); -+ascend: - if (this_parent != parent) { - struct dentry *child = this_parent; - this_parent = child->d_parent; - -- rcu_read_lock(); - spin_unlock(&child->d_lock); - spin_lock(&this_parent->d_lock); - -- /* -- * might go back up the wrong parent if we have had a rename -- * or deletion -- */ -- if (this_parent != child->d_parent || -- (child->d_flags & DCACHE_DENTRY_KILLED) || -- need_seqretry(&rename_lock, seq)) { -- spin_unlock(&this_parent->d_lock); -- rcu_read_unlock(); -+ /* might go back up the wrong parent if we have had a rename. */ -+ if (need_seqretry(&rename_lock, seq)) - goto rename_retry; -+ next = child->d_child.next; -+ while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) { -+ if (next == &this_parent->d_subdirs) -+ goto ascend; -+ child = list_entry(next, struct dentry, d_child); -+ next = next->next; - } - rcu_read_unlock(); -- next = child->d_child.next; - goto resume; - } -- if (need_seqretry(&rename_lock, seq)) { -- spin_unlock(&this_parent->d_lock); -+ if (need_seqretry(&rename_lock, seq)) - goto rename_retry; -- } -+ rcu_read_unlock(); - if (finish) - finish(data); - -@@ -1159,6 +1157,9 @@ out_unlock: - return; - - rename_retry: -+ spin_unlock(&this_parent->d_lock); -+ rcu_read_unlock(); -+ BUG_ON(seq & 1); - if (!retry) - return; - seq = 1; -diff --git a/fs/namespace.c b/fs/namespace.c -index 039f3802d70e..2faa7eacb62b 100644 ---- a/fs/namespace.c -+++ b/fs/namespace.c -@@ -3025,6 +3025,12 @@ bool fs_fully_visible(struct file_system_type *type) - if (mnt->mnt.mnt_sb->s_type != type) - continue; - -+ /* This mount is not fully visible if it's root directory -+ * is not the root directory of the filesystem. -+ */ -+ if (mnt->mnt.mnt_root != mnt->mnt.mnt_sb->s_root) -+ continue; -+ - /* This mount is not fully visible if there are any child mounts - * that cover anything except for empty directories. - */ -diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c -index ecdbae19a766..090d8ce25bd1 100644 ---- a/fs/nilfs2/btree.c -+++ b/fs/nilfs2/btree.c -@@ -388,7 +388,7 @@ static int nilfs_btree_root_broken(const struct nilfs_btree_node *node, - nchildren = nilfs_btree_node_get_nchildren(node); - - if (unlikely(level < NILFS_BTREE_LEVEL_NODE_MIN || -- level > NILFS_BTREE_LEVEL_MAX || -+ level >= NILFS_BTREE_LEVEL_MAX || - nchildren < 0 || - nchildren > NILFS_BTREE_ROOT_NCHILDREN_MAX)) { - pr_crit("NILFS: bad btree root (inode number=%lu): level = %d, flags = 0x%x, nchildren = %d\n", -diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c -index 1be3398c96f6..1dd0bcc75536 100644 ---- a/fs/ocfs2/dlm/dlmmaster.c -+++ b/fs/ocfs2/dlm/dlmmaster.c -@@ -726,6 +726,19 @@ lookup: - if (tmpres) { - spin_unlock(&dlm->spinlock); - spin_lock(&tmpres->spinlock); -+ -+ /* -+ * Right after dlm spinlock was released, dlm_thread could have -+ * purged the lockres. Check if lockres got unhashed. If so -+ * start over. -+ */ -+ if (hlist_unhashed(&tmpres->hash_node)) { -+ spin_unlock(&tmpres->spinlock); -+ dlm_lockres_put(tmpres); -+ tmpres = NULL; -+ goto lookup; -+ } -+ - /* Wait on the thread that is mastering the resource */ - if (tmpres->owner == DLM_LOCK_RES_OWNER_UNKNOWN) { - __dlm_wait_on_lockres(tmpres); -diff --git a/include/acpi/acpixf.h b/include/acpi/acpixf.h -index fea6773f87fc..5d51f27549cc 100644 ---- a/include/acpi/acpixf.h -+++ b/include/acpi/acpixf.h -@@ -175,7 +175,7 @@ acpi_status __init acpi_load_tables(void); - */ - acpi_status __init acpi_reallocate_root_table(void); - --acpi_status __init acpi_find_root_pointer(acpi_size *rsdp_address); -+acpi_status __init acpi_find_root_pointer(acpi_physical_address * rsdp_address); - - acpi_status acpi_unload_table_id(acpi_owner_id id); - -diff --git a/include/linux/nilfs2_fs.h b/include/linux/nilfs2_fs.h -index 98755767c7b0..1108acaacfc6 100644 ---- a/include/linux/nilfs2_fs.h -+++ b/include/linux/nilfs2_fs.h -@@ -458,7 +458,7 @@ struct nilfs_btree_node { - /* level */ - #define NILFS_BTREE_LEVEL_DATA 0 - #define NILFS_BTREE_LEVEL_NODE_MIN (NILFS_BTREE_LEVEL_DATA + 1) --#define NILFS_BTREE_LEVEL_MAX 14 -+#define NILFS_BTREE_LEVEL_MAX 14 /* Max level (exclusive) */ - - /** - * struct nilfs_palloc_group_desc - block group descriptor -diff --git a/mm/memory-failure.c b/mm/memory-failure.c -index ffc7bf0458fb..9502057c3c54 100644 ---- a/mm/memory-failure.c -+++ b/mm/memory-failure.c -@@ -1149,10 +1149,10 @@ int memory_failure(unsigned long pfn, int trapno, int flags) - * The check (unnecessarily) ignores LRU pages being isolated and - * walked by the page reclaim code, however that's not a big loss. - */ -- if (!PageHuge(p) && !PageTransTail(p)) { -- if (!PageLRU(p)) -- shake_page(p, 0); -- if (!PageLRU(p)) { -+ if (!PageHuge(p)) { -+ if (!PageLRU(hpage)) -+ shake_page(hpage, 0); -+ if (!PageLRU(hpage)) { - /* - * shake_page could have turned it free. - */ -@@ -1723,12 +1723,12 @@ int soft_offline_page(struct page *page, int flags) - } else if (ret == 0) { /* for free pages */ - if (PageHuge(page)) { - set_page_hwpoison_huge_page(hpage); -- dequeue_hwpoisoned_huge_page(hpage); -- atomic_long_add(1 << compound_order(hpage), -+ if (!dequeue_hwpoisoned_huge_page(hpage)) -+ atomic_long_add(1 << compound_order(hpage), - &num_poisoned_pages); - } else { -- SetPageHWPoison(page); -- atomic_long_inc(&num_poisoned_pages); -+ if (!TestSetPageHWPoison(page)) -+ atomic_long_inc(&num_poisoned_pages); - } - } - unset_migratetype_isolate(page, MIGRATE_MOVABLE); -diff --git a/mm/page-writeback.c b/mm/page-writeback.c -index 51d8d15f48d7..656a5490f693 100644 ---- a/mm/page-writeback.c -+++ b/mm/page-writeback.c -@@ -601,7 +601,7 @@ static long long pos_ratio_polynom(unsigned long setpoint, - long x; - - x = div64_s64(((s64)setpoint - (s64)dirty) << RATELIMIT_CALC_SHIFT, -- limit - setpoint + 1); -+ (limit - setpoint) | 1); - pos_ratio = x; - pos_ratio = pos_ratio * x >> RATELIMIT_CALC_SHIFT; - pos_ratio = pos_ratio * x >> RATELIMIT_CALC_SHIFT; -@@ -828,7 +828,7 @@ static unsigned long bdi_position_ratio(struct backing_dev_info *bdi, - * scale global setpoint to bdi's: - * bdi_setpoint = setpoint * bdi_thresh / thresh - */ -- x = div_u64((u64)bdi_thresh << 16, thresh + 1); -+ x = div_u64((u64)bdi_thresh << 16, thresh | 1); - bdi_setpoint = setpoint * (u64)x >> 16; - /* - * Use span=(8*write_bw) in single bdi case as indicated by -@@ -843,7 +843,7 @@ static unsigned long bdi_position_ratio(struct backing_dev_info *bdi, - - if (bdi_dirty < x_intercept - span / 4) { - pos_ratio = div64_u64(pos_ratio * (x_intercept - bdi_dirty), -- x_intercept - bdi_setpoint + 1); -+ (x_intercept - bdi_setpoint) | 1); - } else - pos_ratio /= 4; - -diff --git a/sound/oss/sequencer.c b/sound/oss/sequencer.c -index 9b9f7d385134..1010ca1c9994 100644 ---- a/sound/oss/sequencer.c -+++ b/sound/oss/sequencer.c -@@ -683,13 +683,8 @@ static int seq_timing_event(unsigned char *event_rec) - break; - - case TMR_ECHO: -- if (seq_mode == SEQ_2) -- seq_copy_to_input(event_rec, 8); -- else -- { -- parm = (parm << 8 | SEQ_ECHO); -- seq_copy_to_input((unsigned char *) &parm, 4); -- } -+ parm = (parm << 8 | SEQ_ECHO); -+ seq_copy_to_input((unsigned char *) &parm, 4); - break; - - default:; -@@ -1330,7 +1325,6 @@ int sequencer_ioctl(int dev, struct file *file, unsigned int cmd, void __user *a - int mode = translate_mode(file); - struct synth_info inf; - struct seq_event_rec event_rec; -- unsigned long flags; - int __user *p = arg; - - orig_dev = dev = dev >> 4; -@@ -1485,9 +1479,7 @@ int sequencer_ioctl(int dev, struct file *file, unsigned int cmd, void __user *a - case SNDCTL_SEQ_OUTOFBAND: - if (copy_from_user(&event_rec, arg, sizeof(event_rec))) - return -EFAULT; -- spin_lock_irqsave(&lock,flags); - play_event(event_rec.arr); -- spin_unlock_irqrestore(&lock,flags); - return 0; - - case SNDCTL_MIDI_INFO: diff --git a/patch/kernel/odroidc2-default/patch-3.14.43-44.patch b/patch/kernel/odroidc2-default/patch-3.14.43-44.patch deleted file mode 100644 index 21cb75906a..0000000000 --- a/patch/kernel/odroidc2-default/patch-3.14.43-44.patch +++ /dev/null @@ -1,1680 +0,0 @@ -diff --git a/Makefile b/Makefile -index ae5f1e62812f..9f2471c6fbbe 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 3 - PATCHLEVEL = 14 --SUBLEVEL = 43 -+SUBLEVEL = 44 - EXTRAVERSION = - NAME = Remembering Coco - -@@ -244,7 +244,7 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \ - - HOSTCC = gcc - HOSTCXX = g++ --HOSTCFLAGS = -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer -+HOSTCFLAGS = -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer -std=gnu89 - HOSTCXXFLAGS = -O2 - - # Decide whether to build built-in, modular, or both. -@@ -382,7 +382,9 @@ KBUILD_CFLAGS := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \ - -fno-strict-aliasing -fno-common \ - -Werror-implicit-function-declaration \ - -Wno-format-security \ -- -fno-delete-null-pointer-checks -+ -fno-delete-null-pointer-checks \ -+ -std=gnu89 -+ - KBUILD_AFLAGS_KERNEL := - KBUILD_CFLAGS_KERNEL := - KBUILD_AFLAGS := -D__ASSEMBLY__ -diff --git a/arch/arm/boot/dts/imx27.dtsi b/arch/arm/boot/dts/imx27.dtsi -index da2eb7f6a5b2..6899990be272 100644 ---- a/arch/arm/boot/dts/imx27.dtsi -+++ b/arch/arm/boot/dts/imx27.dtsi -@@ -428,7 +428,7 @@ - - fec: ethernet@1002b000 { - compatible = "fsl,imx27-fec"; -- reg = <0x1002b000 0x4000>; -+ reg = <0x1002b000 0x1000>; - interrupts = <50>; - clocks = <&clks 48>, <&clks 67>; - clock-names = "ipg", "ahb"; -diff --git a/arch/arm/kernel/entry-common.S b/arch/arm/kernel/entry-common.S -index a2dcafdf1bc8..98dd389e3b3c 100644 ---- a/arch/arm/kernel/entry-common.S -+++ b/arch/arm/kernel/entry-common.S -@@ -32,7 +32,9 @@ ret_fast_syscall: - UNWIND(.fnstart ) - UNWIND(.cantunwind ) - disable_irq @ disable interrupts -- ldr r1, [tsk, #TI_FLAGS] -+ ldr r1, [tsk, #TI_FLAGS] @ re-check for syscall tracing -+ tst r1, #_TIF_SYSCALL_WORK -+ bne __sys_trace_return - tst r1, #_TIF_WORK_MASK - bne fast_work_pending - asm_trace_hardirqs_on -diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S -index f096e72262f4..1db685104ffc 100644 ---- a/arch/powerpc/kernel/vmlinux.lds.S -+++ b/arch/powerpc/kernel/vmlinux.lds.S -@@ -213,6 +213,7 @@ SECTIONS - *(.opd) - } - -+ . = ALIGN(256); - .got : AT(ADDR(.got) - LOAD_OFFSET) { - __toc_start = .; - #ifndef CONFIG_RELOCATABLE -diff --git a/arch/s390/crypto/ghash_s390.c b/arch/s390/crypto/ghash_s390.c -index 7940dc90e80b..b258110da952 100644 ---- a/arch/s390/crypto/ghash_s390.c -+++ b/arch/s390/crypto/ghash_s390.c -@@ -16,11 +16,12 @@ - #define GHASH_DIGEST_SIZE 16 - - struct ghash_ctx { -- u8 icv[16]; -- u8 key[16]; -+ u8 key[GHASH_BLOCK_SIZE]; - }; - - struct ghash_desc_ctx { -+ u8 icv[GHASH_BLOCK_SIZE]; -+ u8 key[GHASH_BLOCK_SIZE]; - u8 buffer[GHASH_BLOCK_SIZE]; - u32 bytes; - }; -@@ -28,8 +29,10 @@ struct ghash_desc_ctx { - static int ghash_init(struct shash_desc *desc) - { - struct ghash_desc_ctx *dctx = shash_desc_ctx(desc); -+ struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm); - - memset(dctx, 0, sizeof(*dctx)); -+ memcpy(dctx->key, ctx->key, GHASH_BLOCK_SIZE); - - return 0; - } -@@ -45,7 +48,6 @@ static int ghash_setkey(struct crypto_shash *tfm, - } - - memcpy(ctx->key, key, GHASH_BLOCK_SIZE); -- memset(ctx->icv, 0, GHASH_BLOCK_SIZE); - - return 0; - } -@@ -54,7 +56,6 @@ static int ghash_update(struct shash_desc *desc, - const u8 *src, unsigned int srclen) - { - struct ghash_desc_ctx *dctx = shash_desc_ctx(desc); -- struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm); - unsigned int n; - u8 *buf = dctx->buffer; - int ret; -@@ -70,7 +71,7 @@ static int ghash_update(struct shash_desc *desc, - src += n; - - if (!dctx->bytes) { -- ret = crypt_s390_kimd(KIMD_GHASH, ctx, buf, -+ ret = crypt_s390_kimd(KIMD_GHASH, dctx, buf, - GHASH_BLOCK_SIZE); - if (ret != GHASH_BLOCK_SIZE) - return -EIO; -@@ -79,7 +80,7 @@ static int ghash_update(struct shash_desc *desc, - - n = srclen & ~(GHASH_BLOCK_SIZE - 1); - if (n) { -- ret = crypt_s390_kimd(KIMD_GHASH, ctx, src, n); -+ ret = crypt_s390_kimd(KIMD_GHASH, dctx, src, n); - if (ret != n) - return -EIO; - src += n; -@@ -94,7 +95,7 @@ static int ghash_update(struct shash_desc *desc, - return 0; - } - --static int ghash_flush(struct ghash_ctx *ctx, struct ghash_desc_ctx *dctx) -+static int ghash_flush(struct ghash_desc_ctx *dctx) - { - u8 *buf = dctx->buffer; - int ret; -@@ -104,24 +105,24 @@ static int ghash_flush(struct ghash_ctx *ctx, struct ghash_desc_ctx *dctx) - - memset(pos, 0, dctx->bytes); - -- ret = crypt_s390_kimd(KIMD_GHASH, ctx, buf, GHASH_BLOCK_SIZE); -+ ret = crypt_s390_kimd(KIMD_GHASH, dctx, buf, GHASH_BLOCK_SIZE); - if (ret != GHASH_BLOCK_SIZE) - return -EIO; -+ -+ dctx->bytes = 0; - } - -- dctx->bytes = 0; - return 0; - } - - static int ghash_final(struct shash_desc *desc, u8 *dst) - { - struct ghash_desc_ctx *dctx = shash_desc_ctx(desc); -- struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm); - int ret; - -- ret = ghash_flush(ctx, dctx); -+ ret = ghash_flush(dctx); - if (!ret) -- memcpy(dst, ctx->icv, GHASH_BLOCK_SIZE); -+ memcpy(dst, dctx->icv, GHASH_BLOCK_SIZE); - return ret; - } - -diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c -index dcae8fa2bf04..aa0779372e3d 100644 ---- a/arch/x86/kvm/mmu.c -+++ b/arch/x86/kvm/mmu.c -@@ -4078,7 +4078,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa, - ++vcpu->kvm->stat.mmu_pte_write; - kvm_mmu_audit(vcpu, AUDIT_PRE_PTE_WRITE); - -- mask.cr0_wp = mask.cr4_pae = mask.nxe = 1; -+ mask.cr0_wp = mask.cr4_pae = mask.nxe = mask.smep_andnot_wp = 1; - for_each_gfn_indirect_valid_sp(vcpu->kvm, sp, gfn) { - if (detect_write_misaligned(sp, gpa, bytes) || - detect_write_flooding(sp)) { -diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c -index fc1aa7909690..726c969b8a81 100644 ---- a/drivers/acpi/osl.c -+++ b/drivers/acpi/osl.c -@@ -172,7 +172,7 @@ static void __init acpi_request_region (struct acpi_generic_address *gas, - request_mem_region(addr, length, desc); - } - --static int __init acpi_reserve_resources(void) -+static void __init acpi_reserve_resources(void) - { - acpi_request_region(&acpi_gbl_FADT.xpm1a_event_block, acpi_gbl_FADT.pm1_event_length, - "ACPI PM1a_EVT_BLK"); -@@ -201,10 +201,7 @@ static int __init acpi_reserve_resources(void) - if (!(acpi_gbl_FADT.gpe1_block_length & 0x1)) - acpi_request_region(&acpi_gbl_FADT.xgpe1_block, - acpi_gbl_FADT.gpe1_block_length, "ACPI GPE1_BLK"); -- -- return 0; - } --device_initcall(acpi_reserve_resources); - - void acpi_os_printf(const char *fmt, ...) - { -@@ -1792,6 +1789,7 @@ acpi_status __init acpi_os_initialize(void) - - acpi_status __init acpi_os_initialize1(void) - { -+ acpi_reserve_resources(); - kacpid_wq = alloc_workqueue("kacpid", 0, 1); - kacpi_notify_wq = alloc_workqueue("kacpi_notify", 0, 1); - kacpi_hotplug_wq = alloc_ordered_workqueue("kacpi_hotplug", 0); -diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c -index 36605abe5a67..b65d79cd43d5 100644 ---- a/drivers/ata/libahci.c -+++ b/drivers/ata/libahci.c -@@ -1693,8 +1693,7 @@ static void ahci_handle_port_interrupt(struct ata_port *ap, - if (unlikely(resetting)) - status &= ~PORT_IRQ_BAD_PMP; - -- /* if LPM is enabled, PHYRDY doesn't mean anything */ -- if (ap->link.lpm_policy > ATA_LPM_MAX_POWER) { -+ if (sata_lpm_ignore_phy_events(&ap->link)) { - status &= ~PORT_IRQ_PHYRDY; - ahci_scr_write(&ap->link, SCR_ERROR, SERR_PHYRDY_CHG); - } -diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c -index 538574f98e22..b1c0fcdf46fc 100644 ---- a/drivers/ata/libata-core.c -+++ b/drivers/ata/libata-core.c -@@ -6825,6 +6825,38 @@ u32 ata_wait_register(struct ata_port *ap, void __iomem *reg, u32 mask, u32 val, - return tmp; - } - -+/** -+ * sata_lpm_ignore_phy_events - test if PHY event should be ignored -+ * @link: Link receiving the event -+ * -+ * Test whether the received PHY event has to be ignored or not. -+ * -+ * LOCKING: -+ * None: -+ * -+ * RETURNS: -+ * True if the event has to be ignored. -+ */ -+bool sata_lpm_ignore_phy_events(struct ata_link *link) -+{ -+ unsigned long lpm_timeout = link->last_lpm_change + -+ msecs_to_jiffies(ATA_TMOUT_SPURIOUS_PHY); -+ -+ /* if LPM is enabled, PHYRDY doesn't mean anything */ -+ if (link->lpm_policy > ATA_LPM_MAX_POWER) -+ return true; -+ -+ /* ignore the first PHY event after the LPM policy changed -+ * as it is might be spurious -+ */ -+ if ((link->flags & ATA_LFLAG_CHANGED) && -+ time_before(jiffies, lpm_timeout)) -+ return true; -+ -+ return false; -+} -+EXPORT_SYMBOL_GPL(sata_lpm_ignore_phy_events); -+ - /* - * Dummy port_ops - */ -diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c -index 6d8757008318..c6c77b767a8d 100644 ---- a/drivers/ata/libata-eh.c -+++ b/drivers/ata/libata-eh.c -@@ -3488,6 +3488,9 @@ static int ata_eh_set_lpm(struct ata_link *link, enum ata_lpm_policy policy, - } - } - -+ link->last_lpm_change = jiffies; -+ link->flags |= ATA_LFLAG_CHANGED; -+ - return 0; - - fail: -diff --git a/drivers/gpio/gpio-kempld.c b/drivers/gpio/gpio-kempld.c -index c6d88173f5a2..fe6d4a135cab 100644 ---- a/drivers/gpio/gpio-kempld.c -+++ b/drivers/gpio/gpio-kempld.c -@@ -117,7 +117,7 @@ static int kempld_gpio_get_direction(struct gpio_chip *chip, unsigned offset) - = container_of(chip, struct kempld_gpio_data, chip); - struct kempld_device_data *pld = gpio->pld; - -- return kempld_gpio_get_bit(pld, KEMPLD_GPIO_DIR_NUM(offset), offset); -+ return !kempld_gpio_get_bit(pld, KEMPLD_GPIO_DIR_NUM(offset), offset); - } - - static int kempld_gpio_pincount(struct kempld_device_data *pld) -diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c -index c3664bc05acf..c4558bdb0584 100644 ---- a/drivers/gpu/drm/radeon/cik.c -+++ b/drivers/gpu/drm/radeon/cik.c -@@ -5360,7 +5360,7 @@ static int cik_pcie_gart_enable(struct radeon_device *rdev) - */ - /* set vm size, must be a multiple of 4 */ - WREG32(VM_CONTEXT1_PAGE_TABLE_START_ADDR, 0); -- WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn); -+ WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn - 1); - for (i = 1; i < 16; i++) { - if (i < 8) - WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR + (i << 2), -diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c -index f8c01b8d1594..392d94b94905 100644 ---- a/drivers/gpu/drm/radeon/ni.c -+++ b/drivers/gpu/drm/radeon/ni.c -@@ -1256,7 +1256,8 @@ static int cayman_pcie_gart_enable(struct radeon_device *rdev) - */ - for (i = 1; i < 8; i++) { - WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR + (i << 2), 0); -- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR + (i << 2), rdev->vm_manager.max_pfn); -+ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR + (i << 2), -+ rdev->vm_manager.max_pfn - 1); - WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR + (i << 2), - rdev->gart.table_addr >> 12); - } -diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c -index 2f2deccb3b78..49da9fc6b742 100644 ---- a/drivers/gpu/drm/radeon/si.c -+++ b/drivers/gpu/drm/radeon/si.c -@@ -4084,7 +4084,7 @@ static int si_pcie_gart_enable(struct radeon_device *rdev) - /* empty context1-15 */ - /* set vm size, must be a multiple of 4 */ - WREG32(VM_CONTEXT1_PAGE_TABLE_START_ADDR, 0); -- WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn); -+ WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn - 1); - /* Assign the pt base to something valid for now; the pts used for - * the VMs are determined by the application and setup and assigned - * on the fly in the vm part of radeon_gart.c -diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c -index 38d5a6334053..20b69bff5b34 100644 ---- a/drivers/hwmon/nct6775.c -+++ b/drivers/hwmon/nct6775.c -@@ -986,6 +986,7 @@ nct6775_create_attr_group(struct device *dev, struct sensor_template_group *tg, - (*t)->dev_attr.attr.name, tg->base + i); - if ((*t)->s2) { - a2 = &su->u.a2; -+ sysfs_attr_init(&a2->dev_attr.attr); - a2->dev_attr.attr.name = su->name; - a2->nr = (*t)->u.s.nr + i; - a2->index = (*t)->u.s.index; -@@ -996,6 +997,7 @@ nct6775_create_attr_group(struct device *dev, struct sensor_template_group *tg, - *attrs = &a2->dev_attr.attr; - } else { - a = &su->u.a1; -+ sysfs_attr_init(&a->dev_attr.attr); - a->dev_attr.attr.name = su->name; - a->index = (*t)->u.index + i; - a->dev_attr.attr.mode = -diff --git a/drivers/hwmon/ntc_thermistor.c b/drivers/hwmon/ntc_thermistor.c -index e76feb86a1d4..3660cb6fc68a 100644 ---- a/drivers/hwmon/ntc_thermistor.c -+++ b/drivers/hwmon/ntc_thermistor.c -@@ -181,8 +181,10 @@ static struct ntc_thermistor_platform_data * - ntc_thermistor_parse_dt(struct platform_device *pdev) - { - struct iio_channel *chan; -+ enum iio_chan_type type; - struct device_node *np = pdev->dev.of_node; - struct ntc_thermistor_platform_data *pdata; -+ int ret; - - if (!np) - return NULL; -@@ -195,6 +197,13 @@ ntc_thermistor_parse_dt(struct platform_device *pdev) - if (IS_ERR(chan)) - return ERR_CAST(chan); - -+ ret = iio_get_channel_type(chan, &type); -+ if (ret < 0) -+ return ERR_PTR(ret); -+ -+ if (type != IIO_VOLTAGE) -+ return ERR_PTR(-EINVAL); -+ - if (of_property_read_u32(np, "pullup-uv", &pdata->pullup_uv)) - return ERR_PTR(-ENODEV); - if (of_property_read_u32(np, "pullup-ohm", &pdata->pullup_ohm)) -diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c -index cfc5a2e6dcce..e824651a5a11 100644 ---- a/drivers/input/mouse/elantech.c -+++ b/drivers/input/mouse/elantech.c -@@ -314,7 +314,7 @@ static void elantech_report_semi_mt_data(struct input_dev *dev, - unsigned int x2, unsigned int y2) - { - elantech_set_slot(dev, 0, num_fingers != 0, x1, y1); -- elantech_set_slot(dev, 1, num_fingers == 2, x2, y2); -+ elantech_set_slot(dev, 1, num_fingers >= 2, x2, y2); - } - - /* -diff --git a/drivers/lguest/core.c b/drivers/lguest/core.c -index 0bf1e4edf04d..19da22249bd8 100644 ---- a/drivers/lguest/core.c -+++ b/drivers/lguest/core.c -@@ -176,7 +176,7 @@ static void unmap_switcher(void) - bool lguest_address_ok(const struct lguest *lg, - unsigned long addr, unsigned long len) - { -- return (addr+len) / PAGE_SIZE < lg->pfn_limit && (addr+len >= addr); -+ return addr+len <= lg->pfn_limit * PAGE_SIZE && (addr+len >= addr); - } - - /* -diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c -index 683e685ed697..9afd00b45f83 100644 ---- a/drivers/md/raid0.c -+++ b/drivers/md/raid0.c -@@ -531,6 +531,9 @@ static void raid0_make_request(struct mddev *mddev, struct bio *bio) - ? (sector & (chunk_sects-1)) - : sector_div(sector, chunk_sects)); - -+ /* Restore due to sector_div */ -+ sector = bio->bi_iter.bi_sector; -+ - if (sectors < bio_sectors(bio)) { - split = bio_split(bio, sectors, GFP_NOIO, fs_bio_set); - bio_chain(split, bio); -@@ -538,7 +541,6 @@ static void raid0_make_request(struct mddev *mddev, struct bio *bio) - split = bio; - } - -- sector = bio->bi_iter.bi_sector; - zone = find_zone(mddev->private, §or); - tmp_dev = map_sector(mddev, zone, sector, §or); - split->bi_bdev = tmp_dev->bdev; -diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c -index 3545fafe2027..b98c70e1f1a9 100644 ---- a/drivers/md/raid5.c -+++ b/drivers/md/raid5.c -@@ -1914,7 +1914,8 @@ static int resize_stripes(struct r5conf *conf, int newsize) - - conf->slab_cache = sc; - conf->active_name = 1-conf->active_name; -- conf->pool_size = newsize; -+ if (!err) -+ conf->pool_size = newsize; - return err; - } - -diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c -index 42706ea0ba85..201ce37426ab 100644 ---- a/drivers/mmc/host/atmel-mci.c -+++ b/drivers/mmc/host/atmel-mci.c -@@ -1300,7 +1300,7 @@ static void atmci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios) - - if (ios->clock) { - unsigned int clock_min = ~0U; -- u32 clkdiv; -+ int clkdiv; - - clk_prepare(host->mck); - unprepare_clk = true; -@@ -1329,7 +1329,12 @@ static void atmci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios) - /* Calculate clock divider */ - if (host->caps.has_odd_clk_div) { - clkdiv = DIV_ROUND_UP(host->bus_hz, clock_min) - 2; -- if (clkdiv > 511) { -+ if (clkdiv < 0) { -+ dev_warn(&mmc->class_dev, -+ "clock %u too fast; using %lu\n", -+ clock_min, host->bus_hz / 2); -+ clkdiv = 0; -+ } else if (clkdiv > 511) { - dev_warn(&mmc->class_dev, - "clock %u too slow; using %lu\n", - clock_min, host->bus_hz / (511 + 2)); -diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c -index 57d3967de32f..e8abd0f3a06c 100644 ---- a/drivers/net/wireless/rt2x00/rt2800usb.c -+++ b/drivers/net/wireless/rt2x00/rt2800usb.c -@@ -991,6 +991,7 @@ static struct usb_device_id rt2800usb_device_table[] = { - { USB_DEVICE(0x07d1, 0x3c17) }, - { USB_DEVICE(0x2001, 0x3317) }, - { USB_DEVICE(0x2001, 0x3c1b) }, -+ { USB_DEVICE(0x2001, 0x3c25) }, - /* Draytek */ - { USB_DEVICE(0x07fa, 0x7712) }, - /* DVICO */ -diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c -index 4933f02ce1d5..bc409ec43563 100644 ---- a/drivers/net/wireless/rtlwifi/usb.c -+++ b/drivers/net/wireless/rtlwifi/usb.c -@@ -126,7 +126,7 @@ static int _usbctrl_vendorreq_sync_read(struct usb_device *udev, u8 request, - - do { - status = usb_control_msg(udev, pipe, request, reqtype, value, -- index, pdata, len, 0); /*max. timeout*/ -+ index, pdata, len, 1000); - if (status < 0) { - /* firmware download is checksumed, don't retry */ - if ((value >= FW_8192C_START_ADDRESS && -diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h -index 1f426628a0a5..b5f22a9088e5 100644 ---- a/drivers/scsi/qla2xxx/qla_gbl.h -+++ b/drivers/scsi/qla2xxx/qla_gbl.h -@@ -728,8 +728,6 @@ extern void qla8044_set_idc_dontreset(struct scsi_qla_host *ha); - extern int qla8044_rd_direct(struct scsi_qla_host *vha, const uint32_t crb_reg); - extern void qla8044_wr_direct(struct scsi_qla_host *vha, - const uint32_t crb_reg, const uint32_t value); --extern inline void qla8044_set_qsnt_ready(struct scsi_qla_host *vha); --extern inline void qla8044_need_reset_handler(struct scsi_qla_host *vha); - extern int qla8044_device_state_handler(struct scsi_qla_host *vha); - extern void qla8044_clear_qsnt_ready(struct scsi_qla_host *vha); - extern void qla8044_clear_drv_active(struct qla_hw_data *); -diff --git a/drivers/scsi/qla2xxx/qla_nx2.c b/drivers/scsi/qla2xxx/qla_nx2.c -index f60989d729a8..24f69acdcd58 100644 ---- a/drivers/scsi/qla2xxx/qla_nx2.c -+++ b/drivers/scsi/qla2xxx/qla_nx2.c -@@ -146,7 +146,7 @@ qla8044_rmw_crb_reg(struct scsi_qla_host *vha, - return; - } - --inline void -+static inline void - qla8044_set_qsnt_ready(struct scsi_qla_host *vha) - { - uint32_t qsnt_state; -diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c -index e8abb731c7ec..a10706409927 100644 ---- a/drivers/scsi/sd.c -+++ b/drivers/scsi/sd.c -@@ -1599,6 +1599,7 @@ static unsigned int sd_completed_bytes(struct scsi_cmnd *scmd) - { - u64 start_lba = blk_rq_pos(scmd->request); - u64 end_lba = blk_rq_pos(scmd->request) + (scsi_bufflen(scmd) / 512); -+ u64 factor = scmd->device->sector_size / 512; - u64 bad_lba; - int info_valid; - /* -@@ -1620,16 +1621,9 @@ static unsigned int sd_completed_bytes(struct scsi_cmnd *scmd) - if (scsi_bufflen(scmd) <= scmd->device->sector_size) - return 0; - -- if (scmd->device->sector_size < 512) { -- /* only legitimate sector_size here is 256 */ -- start_lba <<= 1; -- end_lba <<= 1; -- } else { -- /* be careful ... don't want any overflows */ -- unsigned int factor = scmd->device->sector_size / 512; -- do_div(start_lba, factor); -- do_div(end_lba, factor); -- } -+ /* be careful ... don't want any overflows */ -+ do_div(start_lba, factor); -+ do_div(end_lba, factor); - - /* The bad lba was reported incorrectly, we have no idea where - * the error is. -@@ -2196,8 +2190,7 @@ got_data: - if (sector_size != 512 && - sector_size != 1024 && - sector_size != 2048 && -- sector_size != 4096 && -- sector_size != 256) { -+ sector_size != 4096) { - sd_printk(KERN_NOTICE, sdkp, "Unsupported sector size %d.\n", - sector_size); - /* -@@ -2248,8 +2241,6 @@ got_data: - sdkp->capacity <<= 2; - else if (sector_size == 1024) - sdkp->capacity <<= 1; -- else if (sector_size == 256) -- sdkp->capacity >>= 1; - - blk_queue_physical_block_size(sdp->request_queue, - sdkp->physical_block_size); -diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c -index 97892f258043..3bb6646bb406 100644 ---- a/drivers/scsi/storvsc_drv.c -+++ b/drivers/scsi/storvsc_drv.c -@@ -1625,8 +1625,7 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd) - break; - default: - vm_srb->data_in = UNKNOWN_TYPE; -- vm_srb->win8_extension.srb_flags |= (SRB_FLAGS_DATA_IN | -- SRB_FLAGS_DATA_OUT); -+ vm_srb->win8_extension.srb_flags |= SRB_FLAGS_NO_DATA_TRANSFER; - break; - } - -diff --git a/drivers/staging/gdm724x/gdm_mux.c b/drivers/staging/gdm724x/gdm_mux.c -index 2fa3a5a6580f..f2e6599eef33 100644 ---- a/drivers/staging/gdm724x/gdm_mux.c -+++ b/drivers/staging/gdm724x/gdm_mux.c -@@ -158,7 +158,7 @@ static int up_to_host(struct mux_rx *r) - unsigned int start_flag; - unsigned int payload_size; - unsigned short packet_type; -- int dummy_cnt; -+ int total_len; - u32 packet_size_sum = r->offset; - int index; - int ret = TO_HOST_INVALID_PACKET; -@@ -175,10 +175,10 @@ static int up_to_host(struct mux_rx *r) - break; - } - -- dummy_cnt = ALIGN(MUX_HEADER_SIZE + payload_size, 4); -+ total_len = ALIGN(MUX_HEADER_SIZE + payload_size, 4); - - if (len - packet_size_sum < -- MUX_HEADER_SIZE + payload_size + dummy_cnt) { -+ total_len) { - pr_err("invalid payload : %d %d %04x\n", - payload_size, len, packet_type); - break; -@@ -201,7 +201,7 @@ static int up_to_host(struct mux_rx *r) - break; - } - -- packet_size_sum += MUX_HEADER_SIZE + payload_size + dummy_cnt; -+ packet_size_sum += total_len; - if (len - packet_size_sum <= MUX_HEADER_SIZE + 2) { - ret = r->callback(NULL, - 0, -@@ -359,7 +359,6 @@ static int gdm_mux_send(void *priv_dev, void *data, int len, int tty_index, - struct mux_pkt_header *mux_header; - struct mux_tx *t = NULL; - static u32 seq_num = 1; -- int dummy_cnt; - int total_len; - int ret; - unsigned long flags; -@@ -372,9 +371,7 @@ static int gdm_mux_send(void *priv_dev, void *data, int len, int tty_index, - - spin_lock_irqsave(&mux_dev->write_lock, flags); - -- dummy_cnt = ALIGN(MUX_HEADER_SIZE + len, 4); -- -- total_len = len + MUX_HEADER_SIZE + dummy_cnt; -+ total_len = ALIGN(MUX_HEADER_SIZE + len, 4); - - t = alloc_mux_tx(total_len); - if (!t) { -@@ -390,7 +387,8 @@ static int gdm_mux_send(void *priv_dev, void *data, int len, int tty_index, - mux_header->packet_type = __cpu_to_le16(packet_type[tty_index]); - - memcpy(t->buf+MUX_HEADER_SIZE, data, len); -- memset(t->buf+MUX_HEADER_SIZE+len, 0, dummy_cnt); -+ memset(t->buf+MUX_HEADER_SIZE+len, 0, total_len - MUX_HEADER_SIZE - -+ len); - - t->len = total_len; - t->callback = cb; -diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211.h b/drivers/staging/rtl8187se/ieee80211/ieee80211.h -index 09ffd9bc8991..6ebdd3f35dd6 100644 ---- a/drivers/staging/rtl8187se/ieee80211/ieee80211.h -+++ b/drivers/staging/rtl8187se/ieee80211/ieee80211.h -@@ -1460,12 +1460,12 @@ extern void ieee80211_sta_ps_send_null_frame(struct ieee80211_device *ieee, - - extern const long ieee80211_wlan_frequencies[]; - --extern inline void ieee80211_increment_scans(struct ieee80211_device *ieee) -+static inline void ieee80211_increment_scans(struct ieee80211_device *ieee) - { - ieee->scans++; - } - --extern inline int ieee80211_get_scans(struct ieee80211_device *ieee) -+static inline int ieee80211_get_scans(struct ieee80211_device *ieee) - { - return ieee->scans; - } -diff --git a/drivers/staging/rtl8192e/rtllib.h b/drivers/staging/rtl8192e/rtllib.h -index 83f5f57373a6..59dc0782df44 100644 ---- a/drivers/staging/rtl8192e/rtllib.h -+++ b/drivers/staging/rtl8192e/rtllib.h -@@ -2761,7 +2761,6 @@ extern void rtllib_stop_scan(struct rtllib_device *ieee); - extern bool rtllib_act_scanning(struct rtllib_device *ieee, bool sync_scan); - extern void rtllib_stop_scan_syncro(struct rtllib_device *ieee); - extern void rtllib_start_scan_syncro(struct rtllib_device *ieee, u8 is_mesh); --extern inline struct sk_buff *rtllib_probe_req(struct rtllib_device *ieee); - extern u8 MgntQuery_MgntFrameTxRate(struct rtllib_device *ieee); - extern void rtllib_sta_ps_send_null_frame(struct rtllib_device *ieee, - short pwr); -@@ -2943,12 +2942,12 @@ void rtllib_softmac_scan_syncro(struct rtllib_device *ieee, u8 is_mesh); - - extern const long rtllib_wlan_frequencies[]; - --extern inline void rtllib_increment_scans(struct rtllib_device *ieee) -+static inline void rtllib_increment_scans(struct rtllib_device *ieee) - { - ieee->scans++; - } - --extern inline int rtllib_get_scans(struct rtllib_device *ieee) -+static inline int rtllib_get_scans(struct rtllib_device *ieee) - { - return ieee->scans; - } -diff --git a/drivers/staging/rtl8192e/rtllib_softmac.c b/drivers/staging/rtl8192e/rtllib_softmac.c -index 4bf72bc1ba7b..7b5093aa8683 100644 ---- a/drivers/staging/rtl8192e/rtllib_softmac.c -+++ b/drivers/staging/rtl8192e/rtllib_softmac.c -@@ -341,7 +341,7 @@ inline void softmac_ps_mgmt_xmit(struct sk_buff *skb, - } - } - --inline struct sk_buff *rtllib_probe_req(struct rtllib_device *ieee) -+static inline struct sk_buff *rtllib_probe_req(struct rtllib_device *ieee) - { - unsigned int len, rate_len; - u8 *tag; -diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211.h b/drivers/staging/rtl8192u/ieee80211/ieee80211.h -index bc64f05a7e6a..b1a0380ee596 100644 ---- a/drivers/staging/rtl8192u/ieee80211/ieee80211.h -+++ b/drivers/staging/rtl8192u/ieee80211/ieee80211.h -@@ -2250,7 +2250,7 @@ static inline void *ieee80211_priv(struct net_device *dev) - return ((struct ieee80211_device *)netdev_priv(dev))->priv; - } - --extern inline int ieee80211_is_empty_essid(const char *essid, int essid_len) -+static inline int ieee80211_is_empty_essid(const char *essid, int essid_len) - { - /* Single white space is for Linksys APs */ - if (essid_len == 1 && essid[0] == ' ') -@@ -2266,7 +2266,7 @@ extern inline int ieee80211_is_empty_essid(const char *essid, int essid_len) - return 1; - } - --extern inline int ieee80211_is_valid_mode(struct ieee80211_device *ieee, int mode) -+static inline int ieee80211_is_valid_mode(struct ieee80211_device *ieee, int mode) - { - /* - * It is possible for both access points and our device to support -@@ -2292,7 +2292,7 @@ extern inline int ieee80211_is_valid_mode(struct ieee80211_device *ieee, int mod - return 0; - } - --extern inline int ieee80211_get_hdrlen(u16 fc) -+static inline int ieee80211_get_hdrlen(u16 fc) - { - int hdrlen = IEEE80211_3ADDR_LEN; - -@@ -2578,12 +2578,12 @@ void ieee80211_softmac_scan_syncro(struct ieee80211_device *ieee); - - extern const long ieee80211_wlan_frequencies[]; - --extern inline void ieee80211_increment_scans(struct ieee80211_device *ieee) -+static inline void ieee80211_increment_scans(struct ieee80211_device *ieee) - { - ieee->scans++; - } - --extern inline int ieee80211_get_scans(struct ieee80211_device *ieee) -+static inline int ieee80211_get_scans(struct ieee80211_device *ieee) - { - return ieee->scans; - } -diff --git a/drivers/staging/wlags49_h2/wl_internal.h b/drivers/staging/wlags49_h2/wl_internal.h -index 78129e93920f..1ecb5cb44bd5 100644 ---- a/drivers/staging/wlags49_h2/wl_internal.h -+++ b/drivers/staging/wlags49_h2/wl_internal.h -@@ -1013,7 +1013,7 @@ static inline void wl_unlock(struct wl_private *lp, - /* Interrupt enable disable functions */ - /********************************************************************/ - --extern inline void wl_act_int_on(struct wl_private *lp) -+static inline void wl_act_int_on(struct wl_private *lp) - { - /* - * Only do something when the driver is handling -@@ -1025,7 +1025,7 @@ extern inline void wl_act_int_on(struct wl_private *lp) - } - } - --extern inline void wl_act_int_off(struct wl_private *lp) -+static inline void wl_act_int_off(struct wl_private *lp) - { - /* - * Only do something when the driver is handling -diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c -index 29f28808fc03..9b90cfacf75c 100644 ---- a/drivers/target/target_core_pscsi.c -+++ b/drivers/target/target_core_pscsi.c -@@ -520,6 +520,7 @@ static int pscsi_configure_device(struct se_device *dev) - " pdv_host_id: %d\n", pdv->pdv_host_id); - return -EINVAL; - } -+ pdv->pdv_lld_host = sh; - } - } else { - if (phv->phv_mode == PHV_VIRTUAL_HOST_ID) { -@@ -602,6 +603,8 @@ static void pscsi_free_device(struct se_device *dev) - if ((phv->phv_mode == PHV_LLD_SCSI_HOST_NO) && - (phv->phv_lld_host != NULL)) - scsi_host_put(phv->phv_lld_host); -+ else if (pdv->pdv_lld_host) -+ scsi_host_put(pdv->pdv_lld_host); - - if ((sd->type == TYPE_DISK) || (sd->type == TYPE_ROM)) - scsi_device_put(sd); -diff --git a/drivers/target/target_core_pscsi.h b/drivers/target/target_core_pscsi.h -index 1bd757dff8ee..820d3052b775 100644 ---- a/drivers/target/target_core_pscsi.h -+++ b/drivers/target/target_core_pscsi.h -@@ -45,6 +45,7 @@ struct pscsi_dev_virt { - int pdv_lun_id; - struct block_device *pdv_bd; - struct scsi_device *pdv_sd; -+ struct Scsi_Host *pdv_lld_host; - } ____cacheline_aligned; - - typedef enum phv_modes { -diff --git a/drivers/thermal/step_wise.c b/drivers/thermal/step_wise.c -index f251521baaa2..ee52ab7d3730 100644 ---- a/drivers/thermal/step_wise.c -+++ b/drivers/thermal/step_wise.c -@@ -146,9 +146,6 @@ static void thermal_zone_trip_update(struct thermal_zone_device *tz, int trip) - dev_dbg(&instance->cdev->device, "old_target=%d, target=%d\n", - old_target, (int)instance->target); - -- if (old_target == instance->target) -- continue; -- - /* Activate a passive thermal instance */ - if (old_target == THERMAL_NO_TARGET && - instance->target != THERMAL_NO_TARGET) -diff --git a/drivers/tty/hvc/hvc_xen.c b/drivers/tty/hvc/hvc_xen.c -index 8eb65f26fcae..59a7da7c6c5e 100644 ---- a/drivers/tty/hvc/hvc_xen.c -+++ b/drivers/tty/hvc/hvc_xen.c -@@ -289,7 +289,7 @@ static int xen_initial_domain_console_init(void) - return -ENOMEM; - } - -- info->irq = bind_virq_to_irq(VIRQ_CONSOLE, 0); -+ info->irq = bind_virq_to_irq(VIRQ_CONSOLE, 0, false); - info->vtermno = HVC_COOKIE; - - spin_lock(&xencons_lock); -diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c -index 2ebe47b78a3e..5bfd8076b21f 100644 ---- a/drivers/tty/n_gsm.c -+++ b/drivers/tty/n_gsm.c -@@ -3166,7 +3166,7 @@ static int gsmtty_break_ctl(struct tty_struct *tty, int state) - return gsmtty_modem_update(dlci, encode); - } - --static void gsmtty_remove(struct tty_driver *driver, struct tty_struct *tty) -+static void gsmtty_cleanup(struct tty_struct *tty) - { - struct gsm_dlci *dlci = tty->driver_data; - struct gsm_mux *gsm = dlci->gsm; -@@ -3174,7 +3174,6 @@ static void gsmtty_remove(struct tty_driver *driver, struct tty_struct *tty) - dlci_put(dlci); - dlci_put(gsm->dlci[0]); - mux_put(gsm); -- driver->ttys[tty->index] = NULL; - } - - /* Virtual ttys for the demux */ -@@ -3195,7 +3194,7 @@ static const struct tty_operations gsmtty_ops = { - .tiocmget = gsmtty_tiocmget, - .tiocmset = gsmtty_tiocmset, - .break_ctl = gsmtty_break_ctl, -- .remove = gsmtty_remove, -+ .cleanup = gsmtty_cleanup, - }; - - -diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c -index 05185b9d4495..f615712e8251 100644 ---- a/drivers/usb/host/xhci-ring.c -+++ b/drivers/usb/host/xhci-ring.c -@@ -2213,8 +2213,13 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td, - break; - case COMP_DEV_ERR: - case COMP_STALL: -+ frame->status = -EPROTO; -+ skip_td = true; -+ break; - case COMP_TX_ERR: - frame->status = -EPROTO; -+ if (event_trb != td->last_trb) -+ return 0; - skip_td = true; - break; - case COMP_STOP: -@@ -2822,7 +2827,7 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd) - xhci_halt(xhci); - hw_died: - spin_unlock(&xhci->lock); -- return -ESHUTDOWN; -+ return IRQ_HANDLED; - } - - /* -diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h -index 7225dd242bfa..70facb725105 100644 ---- a/drivers/usb/host/xhci.h -+++ b/drivers/usb/host/xhci.h -@@ -1268,7 +1268,7 @@ union xhci_trb { - * since the command ring is 64-byte aligned. - * It must also be greater than 16. - */ --#define TRBS_PER_SEGMENT 64 -+#define TRBS_PER_SEGMENT 256 - /* Allow two commands + a link TRB, along with any reserved command TRBs */ - #define MAX_RSVD_CMD_TRBS (TRBS_PER_SEGMENT - 3) - #define TRB_SEGMENT_SIZE (TRBS_PER_SEGMENT*16) -diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c -index 8d114b9733ed..02de4cf48a5b 100644 ---- a/drivers/usb/serial/cp210x.c -+++ b/drivers/usb/serial/cp210x.c -@@ -127,6 +127,7 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */ - { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */ - { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */ -+ { USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */ - { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */ - { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */ - { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */ -diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c -index e9bad928039f..521959370b66 100644 ---- a/drivers/usb/serial/pl2303.c -+++ b/drivers/usb/serial/pl2303.c -@@ -61,7 +61,6 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(DCU10_VENDOR_ID, DCU10_PRODUCT_ID) }, - { USB_DEVICE(SITECOM_VENDOR_ID, SITECOM_PRODUCT_ID) }, - { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_ID) }, -- { USB_DEVICE(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_ID) }, - { USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_SX1), - .driver_info = PL2303_QUIRK_UART_STATE_IDX0 }, - { USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_X65), -diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h -index 71fd9da1d6e7..e3b7af8adfb7 100644 ---- a/drivers/usb/serial/pl2303.h -+++ b/drivers/usb/serial/pl2303.h -@@ -62,10 +62,6 @@ - #define ALCATEL_VENDOR_ID 0x11f7 - #define ALCATEL_PRODUCT_ID 0x02df - --/* Samsung I330 phone cradle */ --#define SAMSUNG_VENDOR_ID 0x04e8 --#define SAMSUNG_PRODUCT_ID 0x8001 -- - #define SIEMENS_VENDOR_ID 0x11f5 - #define SIEMENS_PRODUCT_ID_SX1 0x0001 - #define SIEMENS_PRODUCT_ID_X65 0x0003 -diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c -index bf2bd40e5f2a..60afb39eb73c 100644 ---- a/drivers/usb/serial/visor.c -+++ b/drivers/usb/serial/visor.c -@@ -95,7 +95,7 @@ static const struct usb_device_id id_table[] = { - .driver_info = (kernel_ulong_t)&palm_os_4_probe }, - { USB_DEVICE(ACER_VENDOR_ID, ACER_S10_ID), - .driver_info = (kernel_ulong_t)&palm_os_4_probe }, -- { USB_DEVICE(SAMSUNG_VENDOR_ID, SAMSUNG_SCH_I330_ID), -+ { USB_DEVICE_INTERFACE_CLASS(SAMSUNG_VENDOR_ID, SAMSUNG_SCH_I330_ID, 0xff), - .driver_info = (kernel_ulong_t)&palm_os_4_probe }, - { USB_DEVICE(SAMSUNG_VENDOR_ID, SAMSUNG_SPH_I500_ID), - .driver_info = (kernel_ulong_t)&palm_os_4_probe }, -diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h -index 7f625306ea80..821e1e2f70f6 100644 ---- a/drivers/usb/storage/unusual_devs.h -+++ b/drivers/usb/storage/unusual_devs.h -@@ -760,6 +760,13 @@ UNUSUAL_DEV( 0x059f, 0x0643, 0x0000, 0x0000, - USB_SC_DEVICE, USB_PR_DEVICE, NULL, - US_FL_GO_SLOW ), - -+/* Reported by Christian Schaller */ -+UNUSUAL_DEV( 0x059f, 0x0651, 0x0000, 0x0000, -+ "LaCie", -+ "External HDD", -+ USB_SC_DEVICE, USB_PR_DEVICE, NULL, -+ US_FL_NO_WP_DETECT ), -+ - /* Submitted by Joel Bourquard - * Some versions of this device need the SubClass and Protocol overrides - * while others don't. -diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c -index a5cc476256f1..5af64e966ed6 100644 ---- a/drivers/xen/events/events_base.c -+++ b/drivers/xen/events/events_base.c -@@ -973,7 +973,7 @@ unsigned xen_evtchn_nr_channels(void) - } - EXPORT_SYMBOL_GPL(xen_evtchn_nr_channels); - --int bind_virq_to_irq(unsigned int virq, unsigned int cpu) -+int bind_virq_to_irq(unsigned int virq, unsigned int cpu, bool percpu) - { - struct evtchn_bind_virq bind_virq; - int evtchn, irq, ret; -@@ -987,8 +987,12 @@ int bind_virq_to_irq(unsigned int virq, unsigned int cpu) - if (irq < 0) - goto out; - -- irq_set_chip_and_handler_name(irq, &xen_percpu_chip, -- handle_percpu_irq, "virq"); -+ if (percpu) -+ irq_set_chip_and_handler_name(irq, &xen_percpu_chip, -+ handle_percpu_irq, "virq"); -+ else -+ irq_set_chip_and_handler_name(irq, &xen_dynamic_chip, -+ handle_edge_irq, "virq"); - - bind_virq.virq = virq; - bind_virq.vcpu = cpu; -@@ -1078,7 +1082,7 @@ int bind_virq_to_irqhandler(unsigned int virq, unsigned int cpu, - { - int irq, retval; - -- irq = bind_virq_to_irq(virq, cpu); -+ irq = bind_virq_to_irq(virq, cpu, irqflags & IRQF_PERCPU); - if (irq < 0) - return irq; - retval = request_irq(irq, handler, irqflags, devname, dev_id); -diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c -index 78f46089a077..35240a704413 100644 ---- a/fs/binfmt_elf.c -+++ b/fs/binfmt_elf.c -@@ -819,7 +819,7 @@ static int load_elf_binary(struct linux_binprm *bprm) - total_size = total_mapping_size(elf_phdata, - loc->elf_ex.e_phnum); - if (!total_size) { -- error = -EINVAL; -+ retval = -EINVAL; - goto out_free_dentry; - } - } -diff --git a/fs/dcache.c b/fs/dcache.c -index a9231c872342..1d7e8a3fb6cd 100644 ---- a/fs/dcache.c -+++ b/fs/dcache.c -@@ -1135,13 +1135,13 @@ ascend: - /* might go back up the wrong parent if we have had a rename. */ - if (need_seqretry(&rename_lock, seq)) - goto rename_retry; -- next = child->d_child.next; -- while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) { -+ /* go into the first sibling still alive */ -+ do { -+ next = child->d_child.next; - if (next == &this_parent->d_subdirs) - goto ascend; - child = list_entry(next, struct dentry, d_child); -- next = next->next; -- } -+ } while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)); - rcu_read_unlock(); - goto resume; - } -diff --git a/fs/ext4/ext4_jbd2.c b/fs/ext4/ext4_jbd2.c -index 3fe29de832c8..ff42208417b9 100644 ---- a/fs/ext4/ext4_jbd2.c -+++ b/fs/ext4/ext4_jbd2.c -@@ -87,6 +87,12 @@ int __ext4_journal_stop(const char *where, unsigned int line, handle_t *handle) - ext4_put_nojournal(handle); - return 0; - } -+ -+ if (!handle->h_transaction) { -+ err = jbd2_journal_stop(handle); -+ return handle->h_err ? handle->h_err : err; -+ } -+ - sb = handle->h_transaction->t_journal->j_private; - err = handle->h_err; - rc = jbd2_journal_stop(handle); -diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c -index 96a1ce159f51..4e237a6b4b33 100644 ---- a/fs/ext4/extents.c -+++ b/fs/ext4/extents.c -@@ -361,7 +361,7 @@ static int ext4_valid_extent(struct inode *inode, struct ext4_extent *ext) - ext4_lblk_t lblock = le32_to_cpu(ext->ee_block); - ext4_lblk_t last = lblock + len - 1; - -- if (lblock > last) -+ if (len == 0 || lblock > last) - return 0; - return ext4_data_block_valid(EXT4_SB(inode->i_sb), block, len); - } -diff --git a/fs/fhandle.c b/fs/fhandle.c -index 999ff5c3cab0..d59712dfa3e7 100644 ---- a/fs/fhandle.c -+++ b/fs/fhandle.c -@@ -195,8 +195,9 @@ static int handle_to_path(int mountdirfd, struct file_handle __user *ufh, - goto out_err; - } - /* copy the full handle */ -- if (copy_from_user(handle, ufh, -- sizeof(struct file_handle) + -+ *handle = f_handle; -+ if (copy_from_user(&handle->f_handle, -+ &ufh->f_handle, - f_handle.handle_bytes)) { - retval = -EFAULT; - goto out_handle; -diff --git a/fs/jbd2/recovery.c b/fs/jbd2/recovery.c -index bcbef08a4d8f..a5f72a36c6c8 100644 ---- a/fs/jbd2/recovery.c -+++ b/fs/jbd2/recovery.c -@@ -839,15 +839,23 @@ static int scan_revoke_records(journal_t *journal, struct buffer_head *bh, - { - jbd2_journal_revoke_header_t *header; - int offset, max; -+ int csum_size = 0; -+ __u32 rcount; - int record_len = 4; - - header = (jbd2_journal_revoke_header_t *) bh->b_data; - offset = sizeof(jbd2_journal_revoke_header_t); -- max = be32_to_cpu(header->r_count); -+ rcount = be32_to_cpu(header->r_count); - - if (!jbd2_revoke_block_csum_verify(journal, header)) - return -EINVAL; - -+ if (jbd2_journal_has_csum_v2or3(journal)) -+ csum_size = sizeof(struct jbd2_journal_revoke_tail); -+ if (rcount > journal->j_blocksize - csum_size) -+ return -EINVAL; -+ max = rcount; -+ - if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT)) - record_len = 8; - -diff --git a/fs/jbd2/revoke.c b/fs/jbd2/revoke.c -index d5e95a175c92..8ecf9b92f163 100644 ---- a/fs/jbd2/revoke.c -+++ b/fs/jbd2/revoke.c -@@ -583,7 +583,7 @@ static void write_one_revoke_record(journal_t *journal, - { - int csum_size = 0; - struct buffer_head *descriptor; -- int offset; -+ int sz, offset; - journal_header_t *header; - - /* If we are already aborting, this all becomes a noop. We -@@ -600,9 +600,14 @@ static void write_one_revoke_record(journal_t *journal, - if (jbd2_journal_has_csum_v2or3(journal)) - csum_size = sizeof(struct jbd2_journal_revoke_tail); - -+ if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT)) -+ sz = 8; -+ else -+ sz = 4; -+ - /* Make sure we have a descriptor with space left for the record */ - if (descriptor) { -- if (offset >= journal->j_blocksize - csum_size) { -+ if (offset + sz > journal->j_blocksize - csum_size) { - flush_descriptor(journal, descriptor, offset, write_op); - descriptor = NULL; - } -@@ -625,16 +630,13 @@ static void write_one_revoke_record(journal_t *journal, - *descriptorp = descriptor; - } - -- if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT)) { -+ if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT)) - * ((__be64 *)(&descriptor->b_data[offset])) = - cpu_to_be64(record->blocknr); -- offset += 8; -- -- } else { -+ else - * ((__be32 *)(&descriptor->b_data[offset])) = - cpu_to_be32(record->blocknr); -- offset += 4; -- } -+ offset += sz; - - *offsetp = offset; - } -diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c -index f8a5d6a166fb..ecc57071a1a9 100644 ---- a/fs/jbd2/transaction.c -+++ b/fs/jbd2/transaction.c -@@ -551,7 +551,6 @@ int jbd2_journal_extend(handle_t *handle, int nblocks) - int result; - int wanted; - -- WARN_ON(!transaction); - if (is_handle_aborted(handle)) - return -EROFS; - journal = transaction->t_journal; -@@ -627,7 +626,6 @@ int jbd2__journal_restart(handle_t *handle, int nblocks, gfp_t gfp_mask) - tid_t tid; - int need_to_start, ret; - -- WARN_ON(!transaction); - /* If we've had an abort of any type, don't even think about - * actually doing the restart! */ - if (is_handle_aborted(handle)) -@@ -791,7 +789,6 @@ do_get_write_access(handle_t *handle, struct journal_head *jh, - int need_copy = 0; - unsigned long start_lock, time_lock; - -- WARN_ON(!transaction); - if (is_handle_aborted(handle)) - return -EROFS; - journal = transaction->t_journal; -@@ -1057,7 +1054,6 @@ int jbd2_journal_get_create_access(handle_t *handle, struct buffer_head *bh) - int err; - - jbd_debug(5, "journal_head %p\n", jh); -- WARN_ON(!transaction); - err = -EROFS; - if (is_handle_aborted(handle)) - goto out; -@@ -1271,7 +1267,6 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh) - struct journal_head *jh; - int ret = 0; - -- WARN_ON(!transaction); - if (is_handle_aborted(handle)) - return -EROFS; - journal = transaction->t_journal; -@@ -1407,7 +1402,6 @@ int jbd2_journal_forget (handle_t *handle, struct buffer_head *bh) - int err = 0; - int was_modified = 0; - -- WARN_ON(!transaction); - if (is_handle_aborted(handle)) - return -EROFS; - journal = transaction->t_journal; -@@ -1538,8 +1532,22 @@ int jbd2_journal_stop(handle_t *handle) - tid_t tid; - pid_t pid; - -- if (!transaction) -- goto free_and_exit; -+ if (!transaction) { -+ /* -+ * Handle is already detached from the transaction so -+ * there is nothing to do other than decrease a refcount, -+ * or free the handle if refcount drops to zero -+ */ -+ if (--handle->h_ref > 0) { -+ jbd_debug(4, "h_ref %d -> %d\n", handle->h_ref + 1, -+ handle->h_ref); -+ return err; -+ } else { -+ if (handle->h_rsv_handle) -+ jbd2_free_handle(handle->h_rsv_handle); -+ goto free_and_exit; -+ } -+ } - journal = transaction->t_journal; - - J_ASSERT(journal_current_handle() == handle); -@@ -2381,7 +2389,6 @@ int jbd2_journal_file_inode(handle_t *handle, struct jbd2_inode *jinode) - transaction_t *transaction = handle->h_transaction; - journal_t *journal; - -- WARN_ON(!transaction); - if (is_handle_aborted(handle)) - return -EROFS; - journal = transaction->t_journal; -diff --git a/fs/omfs/inode.c b/fs/omfs/inode.c -index d8b0afde2179..2dba0caf1f4a 100644 ---- a/fs/omfs/inode.c -+++ b/fs/omfs/inode.c -@@ -361,7 +361,7 @@ nomem: - } - - enum { -- Opt_uid, Opt_gid, Opt_umask, Opt_dmask, Opt_fmask -+ Opt_uid, Opt_gid, Opt_umask, Opt_dmask, Opt_fmask, Opt_err - }; - - static const match_table_t tokens = { -@@ -370,6 +370,7 @@ static const match_table_t tokens = { - {Opt_umask, "umask=%o"}, - {Opt_dmask, "dmask=%o"}, - {Opt_fmask, "fmask=%o"}, -+ {Opt_err, NULL}, - }; - - static int parse_options(char *options, struct omfs_sb_info *sbi) -diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h -index ca52de5a5c97..bb5367d288fb 100644 ---- a/include/drm/drm_pciids.h -+++ b/include/drm/drm_pciids.h -@@ -186,6 +186,7 @@ - {0x1002, 0x6658, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_NEW_MEMMAP}, \ - {0x1002, 0x665c, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_NEW_MEMMAP}, \ - {0x1002, 0x665d, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_NEW_MEMMAP}, \ -+ {0x1002, 0x665f, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_NEW_MEMMAP}, \ - {0x1002, 0x6660, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_HAINAN|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \ - {0x1002, 0x6663, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_HAINAN|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \ - {0x1002, 0x6664, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_HAINAN|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \ -diff --git a/include/linux/libata.h b/include/linux/libata.h -index e13b3aef0b0c..b84e786ff990 100644 ---- a/include/linux/libata.h -+++ b/include/linux/libata.h -@@ -204,6 +204,7 @@ enum { - ATA_LFLAG_SW_ACTIVITY = (1 << 7), /* keep activity stats */ - ATA_LFLAG_NO_LPM = (1 << 8), /* disable LPM on this link */ - ATA_LFLAG_RST_ONCE = (1 << 9), /* limit recovery to one reset */ -+ ATA_LFLAG_CHANGED = (1 << 10), /* LPM state changed on this link */ - - /* struct ata_port flags */ - ATA_FLAG_SLAVE_POSS = (1 << 0), /* host supports slave dev */ -@@ -307,6 +308,12 @@ enum { - */ - ATA_TMOUT_PMP_SRST_WAIT = 5000, - -+ /* When the LPM policy is set to ATA_LPM_MAX_POWER, there might -+ * be a spurious PHY event, so ignore the first PHY event that -+ * occurs within 10s after the policy change. -+ */ -+ ATA_TMOUT_SPURIOUS_PHY = 10000, -+ - /* ATA bus states */ - BUS_UNKNOWN = 0, - BUS_DMA = 1, -@@ -785,6 +792,8 @@ struct ata_link { - struct ata_eh_context eh_context; - - struct ata_device device[ATA_MAX_DEVICES]; -+ -+ unsigned long last_lpm_change; /* when last LPM change happened */ - }; - #define ATA_LINK_CLEAR_BEGIN offsetof(struct ata_link, active_tag) - #define ATA_LINK_CLEAR_END offsetof(struct ata_link, device[0]) -@@ -1201,6 +1210,7 @@ extern struct ata_device *ata_dev_pair(struct ata_device *adev); - extern int ata_do_set_mode(struct ata_link *link, struct ata_device **r_failed_dev); - extern void ata_scsi_port_error_handler(struct Scsi_Host *host, struct ata_port *ap); - extern void ata_scsi_cmd_error_handler(struct Scsi_Host *host, struct ata_port *ap, struct list_head *eh_q); -+extern bool sata_lpm_ignore_phy_events(struct ata_link *link); - - extern int ata_cable_40wire(struct ata_port *ap); - extern int ata_cable_80wire(struct ata_port *ap); -diff --git a/include/xen/events.h b/include/xen/events.h -index c9c85cf84895..5d84cd0a51b7 100644 ---- a/include/xen/events.h -+++ b/include/xen/events.h -@@ -14,7 +14,7 @@ int bind_evtchn_to_irqhandler(unsigned int evtchn, - irq_handler_t handler, - unsigned long irqflags, const char *devname, - void *dev_id); --int bind_virq_to_irq(unsigned int virq, unsigned int cpu); -+int bind_virq_to_irq(unsigned int virq, unsigned int cpu, bool percpu); - int bind_virq_to_irqhandler(unsigned int virq, unsigned int cpu, - irq_handler_t handler, - unsigned long irqflags, const char *devname, -diff --git a/lib/strnlen_user.c b/lib/strnlen_user.c -index a28df5206d95..11649615c505 100644 ---- a/lib/strnlen_user.c -+++ b/lib/strnlen_user.c -@@ -57,7 +57,8 @@ static inline long do_strnlen_user(const char __user *src, unsigned long count, - return res + find_zero(data) + 1 - align; - } - res += sizeof(unsigned long); -- if (unlikely(max < sizeof(unsigned long))) -+ /* We already handled 'unsigned long' bytes. Did we do it all ? */ -+ if (unlikely(max <= sizeof(unsigned long))) - break; - max -= sizeof(unsigned long); - if (unlikely(__get_user(c,(unsigned long __user *)(src+res)))) -diff --git a/mm/mempolicy.c b/mm/mempolicy.c -index e8fff0fa1202..936866e72b1d 100644 ---- a/mm/mempolicy.c -+++ b/mm/mempolicy.c -@@ -2663,7 +2663,7 @@ static void __init check_numabalancing_enable(void) - if (numabalancing_override) - set_numabalancing_state(numabalancing_override == 1); - -- if (nr_node_ids > 1 && !numabalancing_override) { -+ if (num_online_nodes() > 1 && !numabalancing_override) { - pr_info("%s automatic NUMA balancing. " - "Configure with numa_balancing= or the " - "kernel.numa_balancing sysctl", -diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c -index 45f077c60348..5b7ef5bb90ed 100644 ---- a/net/ceph/osd_client.c -+++ b/net/ceph/osd_client.c -@@ -1932,20 +1932,29 @@ static void kick_requests(struct ceph_osd_client *osdc, bool force_resend, - err = __map_request(osdc, req, - force_resend || force_resend_writes); - dout("__map_request returned %d\n", err); -- if (err == 0) -- continue; /* no change and no osd was specified */ - if (err < 0) - continue; /* hrm! */ -- if (req->r_osd == NULL) { -- dout("tid %llu maps to no valid osd\n", req->r_tid); -- needmap++; /* request a newer map */ -- continue; -- } -+ if (req->r_osd == NULL || err > 0) { -+ if (req->r_osd == NULL) { -+ dout("lingering %p tid %llu maps to no osd\n", -+ req, req->r_tid); -+ /* -+ * A homeless lingering request makes -+ * no sense, as it's job is to keep -+ * a particular OSD connection open. -+ * Request a newer map and kick the -+ * request, knowing that it won't be -+ * resent until we actually get a map -+ * that can tell us where to send it. -+ */ -+ needmap++; -+ } - -- dout("kicking lingering %p tid %llu osd%d\n", req, req->r_tid, -- req->r_osd ? req->r_osd->o_osd : -1); -- __register_request(osdc, req); -- __unregister_linger_request(osdc, req); -+ dout("kicking lingering %p tid %llu osd%d\n", req, -+ req->r_tid, req->r_osd ? req->r_osd->o_osd : -1); -+ __register_request(osdc, req); -+ __unregister_linger_request(osdc, req); -+ } - } - reset_changed_osds(osdc); - mutex_unlock(&osdc->request_mutex); -diff --git a/net/mac80211/wep.c b/net/mac80211/wep.c -index 6ee2b5863572..f21b142dee1f 100644 ---- a/net/mac80211/wep.c -+++ b/net/mac80211/wep.c -@@ -98,8 +98,7 @@ static u8 *ieee80211_wep_add_iv(struct ieee80211_local *local, - - hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED); - -- if (WARN_ON(skb_tailroom(skb) < IEEE80211_WEP_ICV_LEN || -- skb_headroom(skb) < IEEE80211_WEP_IV_LEN)) -+ if (WARN_ON(skb_headroom(skb) < IEEE80211_WEP_IV_LEN)) - return NULL; - - hdrlen = ieee80211_hdrlen(hdr->frame_control); -@@ -169,6 +168,9 @@ int ieee80211_wep_encrypt(struct ieee80211_local *local, - size_t len; - u8 rc4key[3 + WLAN_KEY_LEN_WEP104]; - -+ if (WARN_ON(skb_tailroom(skb) < IEEE80211_WEP_ICV_LEN)) -+ return -1; -+ - iv = ieee80211_wep_add_iv(local, skb, keylen, keyidx); - if (!iv) - return -1; -diff --git a/net/socket.c b/net/socket.c -index 1b2c2d62ff20..b72fc137e1a6 100644 ---- a/net/socket.c -+++ b/net/socket.c -@@ -2007,14 +2007,12 @@ static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg, - int err, ctl_len, total_len; - - err = -EFAULT; -- if (MSG_CMSG_COMPAT & flags) { -- if (get_compat_msghdr(msg_sys, msg_compat)) -- return -EFAULT; -- } else { -+ if (MSG_CMSG_COMPAT & flags) -+ err = get_compat_msghdr(msg_sys, msg_compat); -+ else - err = copy_msghdr_from_user(msg_sys, msg); -- if (err) -- return err; -- } -+ if (err) -+ return err; - - if (msg_sys->msg_iovlen > UIO_FASTIOV) { - err = -EMSGSIZE; -@@ -2219,14 +2217,12 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg, - struct sockaddr __user *uaddr; - int __user *uaddr_len; - -- if (MSG_CMSG_COMPAT & flags) { -- if (get_compat_msghdr(msg_sys, msg_compat)) -- return -EFAULT; -- } else { -+ if (MSG_CMSG_COMPAT & flags) -+ err = get_compat_msghdr(msg_sys, msg_compat); -+ else - err = copy_msghdr_from_user(msg_sys, msg); -- if (err) -- return err; -- } -+ if (err) -+ return err; - - if (msg_sys->msg_iovlen > UIO_FASTIOV) { - err = -EMSGSIZE; -diff --git a/net/sunrpc/auth_gss/gss_rpc_xdr.c b/net/sunrpc/auth_gss/gss_rpc_xdr.c -index 1ec19f6f0c2b..eeeba5adee6d 100644 ---- a/net/sunrpc/auth_gss/gss_rpc_xdr.c -+++ b/net/sunrpc/auth_gss/gss_rpc_xdr.c -@@ -793,20 +793,26 @@ int gssx_dec_accept_sec_context(struct rpc_rqst *rqstp, - { - u32 value_follows; - int err; -+ struct page *scratch; -+ -+ scratch = alloc_page(GFP_KERNEL); -+ if (!scratch) -+ return -ENOMEM; -+ xdr_set_scratch_buffer(xdr, page_address(scratch), PAGE_SIZE); - - /* res->status */ - err = gssx_dec_status(xdr, &res->status); - if (err) -- return err; -+ goto out_free; - - /* res->context_handle */ - err = gssx_dec_bool(xdr, &value_follows); - if (err) -- return err; -+ goto out_free; - if (value_follows) { - err = gssx_dec_ctx(xdr, res->context_handle); - if (err) -- return err; -+ goto out_free; - } else { - res->context_handle = NULL; - } -@@ -814,11 +820,11 @@ int gssx_dec_accept_sec_context(struct rpc_rqst *rqstp, - /* res->output_token */ - err = gssx_dec_bool(xdr, &value_follows); - if (err) -- return err; -+ goto out_free; - if (value_follows) { - err = gssx_dec_buffer(xdr, res->output_token); - if (err) -- return err; -+ goto out_free; - } else { - res->output_token = NULL; - } -@@ -826,14 +832,17 @@ int gssx_dec_accept_sec_context(struct rpc_rqst *rqstp, - /* res->delegated_cred_handle */ - err = gssx_dec_bool(xdr, &value_follows); - if (err) -- return err; -+ goto out_free; - if (value_follows) { - /* we do not support upcall servers sending this data. */ -- return -EINVAL; -+ err = -EINVAL; -+ goto out_free; - } - - /* res->options */ - err = gssx_dec_option_array(xdr, &res->options); - -+out_free: -+ __free_page(scratch); - return err; - } -diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c -index 976493c4a695..50981b148121 100644 ---- a/sound/pci/hda/patch_conexant.c -+++ b/sound/pci/hda/patch_conexant.c -@@ -3591,6 +3591,14 @@ static const struct hda_codec_preset snd_hda_preset_conexant[] = { - .patch = patch_conexant_auto }, - { .id = 0x14f150b9, .name = "CX20665", - .patch = patch_conexant_auto }, -+ { .id = 0x14f150f1, .name = "CX20721", -+ .patch = patch_conexant_auto }, -+ { .id = 0x14f150f2, .name = "CX20722", -+ .patch = patch_conexant_auto }, -+ { .id = 0x14f150f3, .name = "CX20723", -+ .patch = patch_conexant_auto }, -+ { .id = 0x14f150f4, .name = "CX20724", -+ .patch = patch_conexant_auto }, - { .id = 0x14f1510f, .name = "CX20751/2", - .patch = patch_conexant_auto }, - { .id = 0x14f15110, .name = "CX20751/2", -@@ -3625,6 +3633,10 @@ MODULE_ALIAS("snd-hda-codec-id:14f150ab"); - MODULE_ALIAS("snd-hda-codec-id:14f150ac"); - MODULE_ALIAS("snd-hda-codec-id:14f150b8"); - MODULE_ALIAS("snd-hda-codec-id:14f150b9"); -+MODULE_ALIAS("snd-hda-codec-id:14f150f1"); -+MODULE_ALIAS("snd-hda-codec-id:14f150f2"); -+MODULE_ALIAS("snd-hda-codec-id:14f150f3"); -+MODULE_ALIAS("snd-hda-codec-id:14f150f4"); - MODULE_ALIAS("snd-hda-codec-id:14f1510f"); - MODULE_ALIAS("snd-hda-codec-id:14f15110"); - MODULE_ALIAS("snd-hda-codec-id:14f15111"); -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index ca26373ebe70..e2b567706297 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -4549,6 +4549,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK_VENDOR(0x104d, "Sony VAIO", ALC269_FIXUP_SONY_VAIO), - SND_PCI_QUIRK(0x10cf, 0x1475, "Lifebook", ALC269_FIXUP_LIFEBOOK), - SND_PCI_QUIRK(0x10cf, 0x15dc, "Lifebook T731", ALC269_FIXUP_LIFEBOOK_HP_PIN), -+ SND_PCI_QUIRK(0x10cf, 0x1757, "Lifebook E752", ALC269_FIXUP_LIFEBOOK_HP_PIN), - SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC), - SND_PCI_QUIRK(0x17aa, 0x20f2, "Thinkpad SL410/510", ALC269_FIXUP_SKU_IGNORE), - SND_PCI_QUIRK(0x17aa, 0x215e, "Thinkpad L512", ALC269_FIXUP_SKU_IGNORE), -diff --git a/sound/pci/hda/thinkpad_helper.c b/sound/pci/hda/thinkpad_helper.c -index 1eafc1a28193..8fe3b8c18ed4 100644 ---- a/sound/pci/hda/thinkpad_helper.c -+++ b/sound/pci/hda/thinkpad_helper.c -@@ -71,7 +71,6 @@ static void hda_fixup_thinkpad_acpi(struct hda_codec *codec, - if (led_set_func(TPACPI_LED_MUTE, false) >= 0) { - old_vmaster_hook = spec->vmaster_mute.hook; - spec->vmaster_mute.hook = update_tpacpi_mute_led; -- spec->vmaster_mute_enum = 1; - removefunc = false; - } - if (led_set_func(TPACPI_LED_MICMUTE, false) >= 0) { -diff --git a/sound/soc/codecs/mc13783.c b/sound/soc/codecs/mc13783.c -index 582c2bbd42cb..b85229345969 100644 ---- a/sound/soc/codecs/mc13783.c -+++ b/sound/soc/codecs/mc13783.c -@@ -634,14 +634,14 @@ static int mc13783_probe(struct snd_soc_codec *codec) - AUDIO_SSI_SEL, 0); - else - mc13xxx_reg_rmw(priv->mc13xxx, MC13783_AUDIO_CODEC, -- 0, AUDIO_SSI_SEL); -+ AUDIO_SSI_SEL, AUDIO_SSI_SEL); - - if (priv->dac_ssi_port == MC13783_SSI1_PORT) - mc13xxx_reg_rmw(priv->mc13xxx, MC13783_AUDIO_DAC, - AUDIO_SSI_SEL, 0); - else - mc13xxx_reg_rmw(priv->mc13xxx, MC13783_AUDIO_DAC, -- 0, AUDIO_SSI_SEL); -+ AUDIO_SSI_SEL, AUDIO_SSI_SEL); - - return 0; - } -diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c -index 2a0bfb848512..edfd4edaa864 100644 ---- a/sound/soc/codecs/wm8960.c -+++ b/sound/soc/codecs/wm8960.c -@@ -392,7 +392,7 @@ static const struct snd_soc_dapm_route audio_paths[] = { - { "Right Input Mixer", "Boost Switch", "Right Boost Mixer", }, - { "Right Input Mixer", NULL, "RINPUT1", }, /* Really Boost Switch */ - { "Right Input Mixer", NULL, "RINPUT2" }, -- { "Right Input Mixer", NULL, "LINPUT3" }, -+ { "Right Input Mixer", NULL, "RINPUT3" }, - - { "Left ADC", NULL, "Left Input Mixer" }, - { "Right ADC", NULL, "Right Input Mixer" }, -diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c -index d98e52f647d2..66aec0c3b7bb 100644 ---- a/sound/soc/codecs/wm8994.c -+++ b/sound/soc/codecs/wm8994.c -@@ -2745,7 +2745,7 @@ static struct { - }; - - static int fs_ratios[] = { -- 64, 128, 192, 256, 348, 512, 768, 1024, 1408, 1536 -+ 64, 128, 192, 256, 384, 512, 768, 1024, 1408, 1536 - }; - - static int bclk_divs[] = { -diff --git a/tools/vm/Makefile b/tools/vm/Makefile -index 3d907dacf2ac..c604f3ec628a 100644 ---- a/tools/vm/Makefile -+++ b/tools/vm/Makefile -@@ -3,7 +3,7 @@ - TARGETS=page-types slabinfo - - LIB_DIR = ../lib/api --LIBS = $(LIB_DIR)/libapikfs.a -+LIBS = $(LIB_DIR)/libapi.a - - CC = $(CROSS_COMPILE)gcc - CFLAGS = -Wall -Wextra -I../lib/ diff --git a/patch/kernel/odroidc2-default/patch-3.14.44-45.patch b/patch/kernel/odroidc2-default/patch-3.14.44-45.patch deleted file mode 100644 index 4f7aa254ec..0000000000 --- a/patch/kernel/odroidc2-default/patch-3.14.44-45.patch +++ /dev/null @@ -1,1273 +0,0 @@ -diff --git a/Makefile b/Makefile -index 9f2471c6fbbe..c92186c3efd7 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 3 - PATCHLEVEL = 14 --SUBLEVEL = 44 -+SUBLEVEL = 45 - EXTRAVERSION = - NAME = Remembering Coco - -diff --git a/arch/mips/kernel/irq.c b/arch/mips/kernel/irq.c -index d1fea7a054be..7479d8d847a6 100644 ---- a/arch/mips/kernel/irq.c -+++ b/arch/mips/kernel/irq.c -@@ -110,7 +110,7 @@ void __init init_IRQ(void) - #endif - } - --#ifdef DEBUG_STACKOVERFLOW -+#ifdef CONFIG_DEBUG_STACKOVERFLOW - static inline void check_stack_overflow(void) - { - unsigned long sp; -diff --git a/arch/x86/include/asm/segment.h b/arch/x86/include/asm/segment.h -index 6f1c3a8a33ab..bcc9a2f46c62 100644 ---- a/arch/x86/include/asm/segment.h -+++ b/arch/x86/include/asm/segment.h -@@ -212,10 +212,21 @@ - #define TLS_SIZE (GDT_ENTRY_TLS_ENTRIES * 8) - - #ifdef __KERNEL__ -+ -+/* -+ * early_idt_handler_array is an array of entry points referenced in the -+ * early IDT. For simplicity, it's a real array with one entry point -+ * every nine bytes. That leaves room for an optional 'push $0' if the -+ * vector has no error code (two bytes), a 'push $vector_number' (two -+ * bytes), and a jump to the common entry code (up to five bytes). -+ */ -+#define EARLY_IDT_HANDLER_SIZE 9 -+ - #ifndef __ASSEMBLY__ --extern const char early_idt_handlers[NUM_EXCEPTION_VECTORS][2+2+5]; -+ -+extern const char early_idt_handler_array[NUM_EXCEPTION_VECTORS][EARLY_IDT_HANDLER_SIZE]; - #ifdef CONFIG_TRACING --#define trace_early_idt_handlers early_idt_handlers -+# define trace_early_idt_handler_array early_idt_handler_array - #endif - - /* -diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c -index 85126ccbdf6b..5fc4ac7c6582 100644 ---- a/arch/x86/kernel/head64.c -+++ b/arch/x86/kernel/head64.c -@@ -162,7 +162,7 @@ asmlinkage void __init x86_64_start_kernel(char * real_mode_data) - clear_bss(); - - for (i = 0; i < NUM_EXCEPTION_VECTORS; i++) -- set_intr_gate(i, early_idt_handlers[i]); -+ set_intr_gate(i, early_idt_handler_array[i]); - load_idt((const struct desc_ptr *)&idt_descr); - - copy_bootdata(__va(real_mode_data)); -diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S -index f36bd42d6f0c..30a2aa3782fa 100644 ---- a/arch/x86/kernel/head_32.S -+++ b/arch/x86/kernel/head_32.S -@@ -477,21 +477,22 @@ is486: - __INIT - setup_once: - /* -- * Set up a idt with 256 entries pointing to ignore_int, -- * interrupt gates. It doesn't actually load idt - that needs -- * to be done on each CPU. Interrupts are enabled elsewhere, -- * when we can be relatively sure everything is ok. -+ * Set up a idt with 256 interrupt gates that push zero if there -+ * is no error code and then jump to early_idt_handler_common. -+ * It doesn't actually load the idt - that needs to be done on -+ * each CPU. Interrupts are enabled elsewhere, when we can be -+ * relatively sure everything is ok. - */ - - movl $idt_table,%edi -- movl $early_idt_handlers,%eax -+ movl $early_idt_handler_array,%eax - movl $NUM_EXCEPTION_VECTORS,%ecx - 1: - movl %eax,(%edi) - movl %eax,4(%edi) - /* interrupt gate, dpl=0, present */ - movl $(0x8E000000 + __KERNEL_CS),2(%edi) -- addl $9,%eax -+ addl $EARLY_IDT_HANDLER_SIZE,%eax - addl $8,%edi - loop 1b - -@@ -523,26 +524,28 @@ setup_once: - andl $0,setup_once_ref /* Once is enough, thanks */ - ret - --ENTRY(early_idt_handlers) -+ENTRY(early_idt_handler_array) - # 36(%esp) %eflags - # 32(%esp) %cs - # 28(%esp) %eip - # 24(%rsp) error code - i = 0 - .rept NUM_EXCEPTION_VECTORS -- .if (EXCEPTION_ERRCODE_MASK >> i) & 1 -- ASM_NOP2 -- .else -+ .ifeq (EXCEPTION_ERRCODE_MASK >> i) & 1 - pushl $0 # Dummy error code, to make stack frame uniform - .endif - pushl $i # 20(%esp) Vector number -- jmp early_idt_handler -+ jmp early_idt_handler_common - i = i + 1 -+ .fill early_idt_handler_array + i*EARLY_IDT_HANDLER_SIZE - ., 1, 0xcc - .endr --ENDPROC(early_idt_handlers) -+ENDPROC(early_idt_handler_array) - -- /* This is global to keep gas from relaxing the jumps */ --ENTRY(early_idt_handler) -+early_idt_handler_common: -+ /* -+ * The stack is the hardware frame, an error code or zero, and the -+ * vector number. -+ */ - cld - - cmpl $2,(%esp) # X86_TRAP_NMI -@@ -602,7 +605,7 @@ ex_entry: - is_nmi: - addl $8,%esp /* drop vector number and error code */ - iret --ENDPROC(early_idt_handler) -+ENDPROC(early_idt_handler_common) - - /* This is the default interrupt "handler" :-) */ - ALIGN -diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S -index a468c0a65c42..a2dc0add72ed 100644 ---- a/arch/x86/kernel/head_64.S -+++ b/arch/x86/kernel/head_64.S -@@ -321,26 +321,28 @@ bad_address: - jmp bad_address - - __INIT -- .globl early_idt_handlers --early_idt_handlers: -+ENTRY(early_idt_handler_array) - # 104(%rsp) %rflags - # 96(%rsp) %cs - # 88(%rsp) %rip - # 80(%rsp) error code - i = 0 - .rept NUM_EXCEPTION_VECTORS -- .if (EXCEPTION_ERRCODE_MASK >> i) & 1 -- ASM_NOP2 -- .else -+ .ifeq (EXCEPTION_ERRCODE_MASK >> i) & 1 - pushq $0 # Dummy error code, to make stack frame uniform - .endif - pushq $i # 72(%rsp) Vector number -- jmp early_idt_handler -+ jmp early_idt_handler_common - i = i + 1 -+ .fill early_idt_handler_array + i*EARLY_IDT_HANDLER_SIZE - ., 1, 0xcc - .endr -+ENDPROC(early_idt_handler_array) - --/* This is global to keep gas from relaxing the jumps */ --ENTRY(early_idt_handler) -+early_idt_handler_common: -+ /* -+ * The stack is the hardware frame, an error code or zero, and the -+ * vector number. -+ */ - cld - - cmpl $2,(%rsp) # X86_TRAP_NMI -@@ -412,7 +414,7 @@ ENTRY(early_idt_handler) - is_nmi: - addq $16,%rsp # drop vector number and error code - INTERRUPT_RETURN --ENDPROC(early_idt_handler) -+ENDPROC(early_idt_handler_common) - - __INITDATA - -diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c -index af2d4317b218..1fed139f8eae 100644 ---- a/arch/x86/net/bpf_jit_comp.c -+++ b/arch/x86/net/bpf_jit_comp.c -@@ -211,7 +211,12 @@ void bpf_jit_compile(struct sk_filter *fp) - } - cleanup_addr = proglen; /* epilogue address */ - -- for (pass = 0; pass < 10; pass++) { -+ /* JITed image shrinks with every pass and the loop iterates -+ * until the image stops shrinking. Very large bpf programs -+ * may converge on the last pass. In such case do one more -+ * pass to emit the final image -+ */ -+ for (pass = 0; pass < 10 || image; pass++) { - u8 seen_or_pass0 = (pass == 0) ? (SEEN_XREG | SEEN_DATAREF | SEEN_MEM) : seen; - /* no prologue/epilogue for trivial filters (RET something) */ - proglen = 0; -diff --git a/block/genhd.c b/block/genhd.c -index a8d586a729bb..9316f5fd416f 100644 ---- a/block/genhd.c -+++ b/block/genhd.c -@@ -422,9 +422,9 @@ int blk_alloc_devt(struct hd_struct *part, dev_t *devt) - /* allocate ext devt */ - idr_preload(GFP_KERNEL); - -- spin_lock(&ext_devt_lock); -+ spin_lock_bh(&ext_devt_lock); - idx = idr_alloc(&ext_devt_idr, part, 0, NR_EXT_DEVT, GFP_NOWAIT); -- spin_unlock(&ext_devt_lock); -+ spin_unlock_bh(&ext_devt_lock); - - idr_preload_end(); - if (idx < 0) -@@ -449,9 +449,9 @@ void blk_free_devt(dev_t devt) - return; - - if (MAJOR(devt) == BLOCK_EXT_MAJOR) { -- spin_lock(&ext_devt_lock); -+ spin_lock_bh(&ext_devt_lock); - idr_remove(&ext_devt_idr, blk_mangle_minor(MINOR(devt))); -- spin_unlock(&ext_devt_lock); -+ spin_unlock_bh(&ext_devt_lock); - } - } - -@@ -691,13 +691,13 @@ struct gendisk *get_gendisk(dev_t devt, int *partno) - } else { - struct hd_struct *part; - -- spin_lock(&ext_devt_lock); -+ spin_lock_bh(&ext_devt_lock); - part = idr_find(&ext_devt_idr, blk_mangle_minor(MINOR(devt))); - if (part && get_disk(part_to_disk(part))) { - *partno = part->partno; - disk = part_to_disk(part); - } -- spin_unlock(&ext_devt_lock); -+ spin_unlock_bh(&ext_devt_lock); - } - - return disk; -diff --git a/drivers/ata/pata_octeon_cf.c b/drivers/ata/pata_octeon_cf.c -index 83c4ddb1bc7f..08223cc980b0 100644 ---- a/drivers/ata/pata_octeon_cf.c -+++ b/drivers/ata/pata_octeon_cf.c -@@ -1069,7 +1069,7 @@ static struct of_device_id octeon_cf_match[] = { - }, - {}, - }; --MODULE_DEVICE_TABLE(of, octeon_i2c_match); -+MODULE_DEVICE_TABLE(of, octeon_cf_match); - - static struct platform_driver octeon_cf_driver = { - .probe = octeon_cf_probe, -diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c -index b2d0887b3d12..462307c36d65 100644 ---- a/drivers/gpu/drm/i915/intel_dp.c -+++ b/drivers/gpu/drm/i915/intel_dp.c -@@ -481,10 +481,8 @@ intel_dp_aux_ch(struct intel_dp *intel_dp, - DP_AUX_CH_CTL_RECEIVE_ERROR)) - continue; - if (status & DP_AUX_CH_CTL_DONE) -- break; -+ goto done; - } -- if (status & DP_AUX_CH_CTL_DONE) -- break; - } - - if ((status & DP_AUX_CH_CTL_DONE) == 0) { -@@ -493,6 +491,7 @@ intel_dp_aux_ch(struct intel_dp *intel_dp, - goto out; - } - -+done: - /* Check for timeout or receive error. - * Timeouts occur when the sink is not connected - */ -diff --git a/drivers/gpu/drm/i915/intel_i2c.c b/drivers/gpu/drm/i915/intel_i2c.c -index 1d02970ed395..81f8ec85a48a 100644 ---- a/drivers/gpu/drm/i915/intel_i2c.c -+++ b/drivers/gpu/drm/i915/intel_i2c.c -@@ -489,7 +489,7 @@ gmbus_xfer(struct i2c_adapter *adapter, - struct intel_gmbus, - adapter); - struct drm_i915_private *dev_priv = bus->dev_priv; -- int i, reg_offset; -+ int i = 0, inc, try = 0, reg_offset; - int ret = 0; - - intel_aux_display_runtime_get(dev_priv); -@@ -502,12 +502,14 @@ gmbus_xfer(struct i2c_adapter *adapter, - - reg_offset = dev_priv->gpio_mmio_base; - -+retry: - I915_WRITE(GMBUS0 + reg_offset, bus->reg0); - -- for (i = 0; i < num; i++) { -+ for (; i < num; i += inc) { -+ inc = 1; - if (gmbus_is_index_read(msgs, i, num)) { - ret = gmbus_xfer_index_read(dev_priv, &msgs[i]); -- i += 1; /* set i to the index of the read xfer */ -+ inc = 2; /* an index read is two msgs */ - } else if (msgs[i].flags & I2C_M_RD) { - ret = gmbus_xfer_read(dev_priv, &msgs[i], 0); - } else { -@@ -579,6 +581,18 @@ clear_err: - adapter->name, msgs[i].addr, - (msgs[i].flags & I2C_M_RD) ? 'r' : 'w', msgs[i].len); - -+ /* -+ * Passive adapters sometimes NAK the first probe. Retry the first -+ * message once on -ENXIO for GMBUS transfers; the bit banging algorithm -+ * has retries internally. See also the retry loop in -+ * drm_do_probe_ddc_edid, which bails out on the first -ENXIO. -+ */ -+ if (ret == -ENXIO && i == 0 && try++ == 0) { -+ DRM_DEBUG_KMS("GMBUS [%s] NAK on first message, retry\n", -+ adapter->name); -+ goto retry; -+ } -+ - goto out; - - timeout: -diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c -index e39026cc7d07..129915eca07b 100644 ---- a/drivers/gpu/drm/radeon/radeon_device.c -+++ b/drivers/gpu/drm/radeon/radeon_device.c -@@ -1337,6 +1337,21 @@ int radeon_device_init(struct radeon_device *rdev, - goto failed; - } - -+ /* -+ * Turks/Thames GPU will freeze whole laptop if DPM is not restarted -+ * after the CP ring have chew one packet at least. Hence here we stop -+ * and restart DPM after the radeon_ib_ring_tests(). -+ */ -+ if (rdev->pm.dpm_enabled && -+ (rdev->pm.pm_method == PM_METHOD_DPM) && -+ (rdev->family == CHIP_TURKS) && -+ (rdev->flags & RADEON_IS_MOBILITY)) { -+ mutex_lock(&rdev->pm.mutex); -+ radeon_dpm_disable(rdev); -+ radeon_dpm_enable(rdev); -+ mutex_unlock(&rdev->pm.mutex); -+ } -+ - if ((radeon_testing & 1)) { - if (rdev->accel_working) - radeon_test_moves(rdev); -diff --git a/drivers/iio/adc/twl6030-gpadc.c b/drivers/iio/adc/twl6030-gpadc.c -index 53a24ebb92c3..779dac5676d9 100644 ---- a/drivers/iio/adc/twl6030-gpadc.c -+++ b/drivers/iio/adc/twl6030-gpadc.c -@@ -1003,7 +1003,7 @@ static struct platform_driver twl6030_gpadc_driver = { - - module_platform_driver(twl6030_gpadc_driver); - --MODULE_ALIAS("platform: " DRIVER_NAME); -+MODULE_ALIAS("platform:" DRIVER_NAME); - MODULE_AUTHOR("Balaji T K "); - MODULE_AUTHOR("Graeme Gregory "); - MODULE_AUTHOR("Oleksandr Kozaruk variant->temp_scale_nano / 1000000; - *val2 = (st->variant->temp_scale_nano % 1000000); - return IIO_VAL_INT_PLUS_MICRO; -+ case IIO_PRESSURE: -+ /* 20 uBar = 0.002kPascal */ -+ *val = 0; -+ *val2 = 2000; -+ return IIO_VAL_INT_PLUS_MICRO; - default: - return -EINVAL; - } -@@ -480,10 +485,10 @@ static int adis16400_read_raw(struct iio_dev *indio_dev, - } - } - --#define ADIS16400_VOLTAGE_CHAN(addr, bits, name, si) { \ -+#define ADIS16400_VOLTAGE_CHAN(addr, bits, name, si, chn) { \ - .type = IIO_VOLTAGE, \ - .indexed = 1, \ -- .channel = 0, \ -+ .channel = chn, \ - .extend_name = name, \ - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW) | \ - BIT(IIO_CHAN_INFO_SCALE), \ -@@ -499,10 +504,10 @@ static int adis16400_read_raw(struct iio_dev *indio_dev, - } - - #define ADIS16400_SUPPLY_CHAN(addr, bits) \ -- ADIS16400_VOLTAGE_CHAN(addr, bits, "supply", ADIS16400_SCAN_SUPPLY) -+ ADIS16400_VOLTAGE_CHAN(addr, bits, "supply", ADIS16400_SCAN_SUPPLY, 0) - - #define ADIS16400_AUX_ADC_CHAN(addr, bits) \ -- ADIS16400_VOLTAGE_CHAN(addr, bits, NULL, ADIS16400_SCAN_ADC) -+ ADIS16400_VOLTAGE_CHAN(addr, bits, NULL, ADIS16400_SCAN_ADC, 1) - - #define ADIS16400_GYRO_CHAN(mod, addr, bits) { \ - .type = IIO_ANGL_VEL, \ -@@ -819,11 +824,6 @@ static const struct iio_info adis16400_info = { - .debugfs_reg_access = adis_debugfs_reg_access, - }; - --static const unsigned long adis16400_burst_scan_mask[] = { -- ~0UL, -- 0, --}; -- - static const char * const adis16400_status_error_msgs[] = { - [ADIS16400_DIAG_STAT_ZACCL_FAIL] = "Z-axis accelerometer self-test failure", - [ADIS16400_DIAG_STAT_YACCL_FAIL] = "Y-axis accelerometer self-test failure", -@@ -871,6 +871,20 @@ static const struct adis_data adis16400_data = { - BIT(ADIS16400_DIAG_STAT_POWER_LOW), - }; - -+static void adis16400_setup_chan_mask(struct adis16400_state *st) -+{ -+ const struct adis16400_chip_info *chip_info = st->variant; -+ unsigned i; -+ -+ for (i = 0; i < chip_info->num_channels; i++) { -+ const struct iio_chan_spec *ch = &chip_info->channels[i]; -+ -+ if (ch->scan_index >= 0 && -+ ch->scan_index != ADIS16400_SCAN_TIMESTAMP) -+ st->avail_scan_mask[0] |= BIT(ch->scan_index); -+ } -+} -+ - static int adis16400_probe(struct spi_device *spi) - { - struct adis16400_state *st; -@@ -894,8 +908,10 @@ static int adis16400_probe(struct spi_device *spi) - indio_dev->info = &adis16400_info; - indio_dev->modes = INDIO_DIRECT_MODE; - -- if (!(st->variant->flags & ADIS16400_NO_BURST)) -- indio_dev->available_scan_masks = adis16400_burst_scan_mask; -+ if (!(st->variant->flags & ADIS16400_NO_BURST)) { -+ adis16400_setup_chan_mask(st); -+ indio_dev->available_scan_masks = st->avail_scan_mask; -+ } - - ret = adis_init(&st->adis, indio_dev, spi, &adis16400_data); - if (ret) -diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c -index e824651a5a11..94eaaf0c49b3 100644 ---- a/drivers/input/mouse/elantech.c -+++ b/drivers/input/mouse/elantech.c -@@ -1271,10 +1271,11 @@ static bool elantech_is_signature_valid(const unsigned char *param) - return true; - - /* -- * Some models have a revision higher then 20. Meaning param[2] may -- * be 10 or 20, skip the rates check for these. -+ * Some hw_version >= 4 models have a revision higher then 20. Meaning -+ * that param[2] may be 10 or 20, skip the rates check for these. - */ -- if (param[0] == 0x46 && (param[1] & 0xef) == 0x0f && param[2] < 40) -+ if ((param[0] & 0x0f) >= 0x06 && (param[1] & 0xaf) == 0x0f && -+ param[2] < 40) - return true; - - for (i = 0; i < ARRAY_SIZE(rates); i++) -diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c -index b00e282ef166..53f09a8b0b72 100644 ---- a/drivers/input/mouse/synaptics.c -+++ b/drivers/input/mouse/synaptics.c -@@ -138,6 +138,10 @@ static const struct min_max_quirk min_max_pnpid_table[] = { - 1024, 5112, 2024, 4832 - }, - { -+ (const char * const []){"LEN2000", NULL}, -+ 1024, 5113, 2021, 4832 -+ }, -+ { - (const char * const []){"LEN2001", NULL}, - 1024, 5022, 2508, 4832 - }, -@@ -173,7 +177,7 @@ static const char * const topbuttonpad_pnp_ids[] = { - "LEN0047", - "LEN0048", - "LEN0049", -- "LEN2000", -+ "LEN2000", /* S540 */ - "LEN2001", /* Edge E431 */ - "LEN2002", /* Edge E531 */ - "LEN2003", -diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c -index 98e7cbf720a5..0be3f9d94322 100644 ---- a/drivers/net/phy/dp83640.c -+++ b/drivers/net/phy/dp83640.c -@@ -45,7 +45,7 @@ - #define PSF_TX 0x1000 - #define EXT_EVENT 1 - #define CAL_EVENT 7 --#define CAL_TRIGGER 7 -+#define CAL_TRIGGER 1 - #define PER_TRIGGER 6 - - #define MII_DP83640_MICR 0x11 -@@ -442,7 +442,9 @@ static int ptp_dp83640_enable(struct ptp_clock_info *ptp, - else - evnt |= EVNT_RISE; - } -+ mutex_lock(&clock->extreg_lock); - ext_write(0, phydev, PAGE5, PTP_EVNT, evnt); -+ mutex_unlock(&clock->extreg_lock); - return 0; - - case PTP_CLK_REQ_PEROUT: -@@ -463,6 +465,8 @@ static u8 status_frame_src[6] = { 0x08, 0x00, 0x17, 0x0B, 0x6B, 0x0F }; - - static void enable_status_frames(struct phy_device *phydev, bool on) - { -+ struct dp83640_private *dp83640 = phydev->priv; -+ struct dp83640_clock *clock = dp83640->clock; - u16 cfg0 = 0, ver; - - if (on) -@@ -470,9 +474,13 @@ static void enable_status_frames(struct phy_device *phydev, bool on) - - ver = (PSF_PTPVER & VERSIONPTP_MASK) << VERSIONPTP_SHIFT; - -+ mutex_lock(&clock->extreg_lock); -+ - ext_write(0, phydev, PAGE5, PSF_CFG0, cfg0); - ext_write(0, phydev, PAGE6, PSF_CFG1, ver); - -+ mutex_unlock(&clock->extreg_lock); -+ - if (!phydev->attached_dev) { - pr_warn("expected to find an attached netdevice\n"); - return; -@@ -1063,11 +1071,18 @@ static int dp83640_config_init(struct phy_device *phydev) - - if (clock->chosen && !list_empty(&clock->phylist)) - recalibrate(clock); -- else -+ else { -+ mutex_lock(&clock->extreg_lock); - enable_broadcast(phydev, clock->page, 1); -+ mutex_unlock(&clock->extreg_lock); -+ } - - enable_status_frames(phydev, true); -+ -+ mutex_lock(&clock->extreg_lock); - ext_write(0, phydev, PAGE4, PTP_CTL, PTP_ENABLE); -+ mutex_unlock(&clock->extreg_lock); -+ - return 0; - } - -diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c -index 1d568788c3e3..65cfc5a436c7 100644 ---- a/drivers/net/phy/phy.c -+++ b/drivers/net/phy/phy.c -@@ -965,12 +965,14 @@ int phy_init_eee(struct phy_device *phydev, bool clk_stop_enable) - { - /* According to 802.3az,the EEE is supported only in full duplex-mode. - * Also EEE feature is active when core is operating with MII, GMII -- * or RGMII. -+ * or RGMII (all kinds). Internal PHYs are also allowed to proceed and -+ * should return an error if they do not support EEE. - */ - if ((phydev->duplex == DUPLEX_FULL) && - ((phydev->interface == PHY_INTERFACE_MODE_MII) || - (phydev->interface == PHY_INTERFACE_MODE_GMII) || -- (phydev->interface == PHY_INTERFACE_MODE_RGMII))) { -+ (phydev->interface >= PHY_INTERFACE_MODE_RGMII && -+ phydev->interface <= PHY_INTERFACE_MODE_RGMII_TXID))) { - int eee_lp, eee_cap, eee_adv; - u32 lp, cap, adv; - int status; -diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c -index 7a206cffb062..d18e65398edc 100644 ---- a/drivers/net/xen-netback/xenbus.c -+++ b/drivers/net/xen-netback/xenbus.c -@@ -32,6 +32,8 @@ struct backend_info { - enum xenbus_state frontend_state; - struct xenbus_watch hotplug_status_watch; - u8 have_hotplug_status_watch:1; -+ -+ const char *hotplug_script; - }; - - static int connect_rings(struct backend_info *); -@@ -54,6 +56,7 @@ static int netback_remove(struct xenbus_device *dev) - xenvif_free(be->vif); - be->vif = NULL; - } -+ kfree(be->hotplug_script); - kfree(be); - dev_set_drvdata(&dev->dev, NULL); - return 0; -@@ -71,6 +74,7 @@ static int netback_probe(struct xenbus_device *dev, - struct xenbus_transaction xbt; - int err; - int sg; -+ const char *script; - struct backend_info *be = kzalloc(sizeof(struct backend_info), - GFP_KERNEL); - if (!be) { -@@ -157,6 +161,15 @@ static int netback_probe(struct xenbus_device *dev, - if (err) - pr_debug("Error writing feature-split-event-channels\n"); - -+ script = xenbus_read(XBT_NIL, dev->nodename, "script", NULL); -+ if (IS_ERR(script)) { -+ err = PTR_ERR(script); -+ xenbus_dev_fatal(dev, err, "reading script"); -+ goto fail; -+ } -+ -+ be->hotplug_script = script; -+ - err = xenbus_switch_state(dev, XenbusStateInitWait); - if (err) - goto fail; -@@ -187,22 +200,14 @@ static int netback_uevent(struct xenbus_device *xdev, - struct kobj_uevent_env *env) - { - struct backend_info *be = dev_get_drvdata(&xdev->dev); -- char *val; - -- val = xenbus_read(XBT_NIL, xdev->nodename, "script", NULL); -- if (IS_ERR(val)) { -- int err = PTR_ERR(val); -- xenbus_dev_fatal(xdev, err, "reading script"); -- return err; -- } else { -- if (add_uevent_var(env, "script=%s", val)) { -- kfree(val); -- return -ENOMEM; -- } -- kfree(val); -- } -+ if (!be) -+ return 0; -+ -+ if (add_uevent_var(env, "script=%s", be->hotplug_script)) -+ return -ENOMEM; - -- if (!be || !be->vif) -+ if (!be->vif) - return 0; - - return add_uevent_var(env, "vif=%s", be->vif->dev->name); -diff --git a/drivers/staging/ozwpan/ozusbsvc1.c b/drivers/staging/ozwpan/ozusbsvc1.c -index 617f51cdaea7..b58e87e951e7 100644 ---- a/drivers/staging/ozwpan/ozusbsvc1.c -+++ b/drivers/staging/ozwpan/ozusbsvc1.c -@@ -323,7 +323,11 @@ static void oz_usb_handle_ep_data(struct oz_usb_ctx *usb_ctx, - struct oz_multiple_fixed *body = - (struct oz_multiple_fixed *)data_hdr; - u8 *data = body->data; -- int n = (len - sizeof(struct oz_multiple_fixed)+1) -+ unsigned int n; -+ if (!body->unit_size || -+ len < sizeof(struct oz_multiple_fixed) - 1) -+ break; -+ n = (len - (sizeof(struct oz_multiple_fixed) - 1)) - / body->unit_size; - while (n--) { - oz_hcd_data_ind(usb_ctx->hport, body->endpoint, -@@ -386,10 +390,15 @@ void oz_usb_rx(struct oz_pd *pd, struct oz_elt *elt) - case OZ_GET_DESC_RSP: { - struct oz_get_desc_rsp *body = - (struct oz_get_desc_rsp *)usb_hdr; -- int data_len = elt->length - -- sizeof(struct oz_get_desc_rsp) + 1; -- u16 offs = le16_to_cpu(get_unaligned(&body->offset)); -- u16 total_size = -+ u16 offs, total_size; -+ u8 data_len; -+ -+ if (elt->length < sizeof(struct oz_get_desc_rsp) - 1) -+ break; -+ data_len = elt->length - -+ (sizeof(struct oz_get_desc_rsp) - 1); -+ offs = le16_to_cpu(get_unaligned(&body->offset)); -+ total_size = - le16_to_cpu(get_unaligned(&body->total_size)); - oz_dbg(ON, "USB_REQ_GET_DESCRIPTOR - cnf\n"); - oz_hcd_get_desc_cnf(usb_ctx->hport, body->req_id, -diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c -index 8ab46ad40f28..81951904186c 100644 ---- a/drivers/tty/n_tty.c -+++ b/drivers/tty/n_tty.c -@@ -186,6 +186,17 @@ static int receive_room(struct tty_struct *tty) - return left; - } - -+static inline int tty_copy_to_user(struct tty_struct *tty, -+ void __user *to, -+ const void *from, -+ unsigned long n) -+{ -+ struct n_tty_data *ldata = tty->disc_data; -+ -+ tty_audit_add_data(tty, to, n, ldata->icanon); -+ return copy_to_user(to, from, n); -+} -+ - /** - * n_tty_set_room - receive space - * @tty: terminal -@@ -2084,12 +2095,12 @@ static int canon_copy_from_read_buf(struct tty_struct *tty, - __func__, eol, found, n, c, size, more); - - if (n > size) { -- ret = copy_to_user(*b, read_buf_addr(ldata, tail), size); -+ ret = tty_copy_to_user(tty, *b, read_buf_addr(ldata, tail), size); - if (ret) - return -EFAULT; -- ret = copy_to_user(*b + size, ldata->read_buf, n - size); -+ ret = tty_copy_to_user(tty, *b + size, ldata->read_buf, n - size); - } else -- ret = copy_to_user(*b, read_buf_addr(ldata, tail), n); -+ ret = tty_copy_to_user(tty, *b, read_buf_addr(ldata, tail), n); - - if (ret) - return -EFAULT; -diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c -index d799140e53b6..1fd9bc695ab7 100644 ---- a/drivers/tty/serial/imx.c -+++ b/drivers/tty/serial/imx.c -@@ -907,6 +907,14 @@ static void dma_rx_callback(void *data) - - status = dmaengine_tx_status(chan, (dma_cookie_t)0, &state); - count = RX_BUF_SIZE - state.residue; -+ -+ if (readl(sport->port.membase + USR2) & USR2_IDLE) { -+ /* In condition [3] the SDMA counted up too early */ -+ count--; -+ -+ writel(USR2_IDLE, sport->port.membase + USR2); -+ } -+ - dev_dbg(sport->port.dev, "We get %d bytes.\n", count); - - if (count) { -diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c -index 02de4cf48a5b..73c7292f48e5 100644 ---- a/drivers/usb/serial/cp210x.c -+++ b/drivers/usb/serial/cp210x.c -@@ -128,6 +128,7 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */ - { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */ - { USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */ -+ { USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */ - { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */ - { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */ - { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */ -diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c -index 2d858f81ab33..bc77ea7cde48 100644 ---- a/drivers/usb/serial/ftdi_sio.c -+++ b/drivers/usb/serial/ftdi_sio.c -@@ -712,6 +712,7 @@ static const struct usb_device_id id_table_combined[] = { - { USB_DEVICE(XSENS_VID, XSENS_AWINDA_DONGLE_PID) }, - { USB_DEVICE(XSENS_VID, XSENS_AWINDA_STATION_PID) }, - { USB_DEVICE(XSENS_VID, XSENS_CONVERTER_PID) }, -+ { USB_DEVICE(XSENS_VID, XSENS_MTDEVBOARD_PID) }, - { USB_DEVICE(XSENS_VID, XSENS_MTW_PID) }, - { USB_DEVICE(FTDI_VID, FTDI_OMNI1509) }, - { USB_DEVICE(MOBILITY_VID, MOBILITY_USB_SERIAL_PID) }, -diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h -index 4e4f46f3c89c..792e054126de 100644 ---- a/drivers/usb/serial/ftdi_sio_ids.h -+++ b/drivers/usb/serial/ftdi_sio_ids.h -@@ -155,6 +155,7 @@ - #define XSENS_AWINDA_STATION_PID 0x0101 - #define XSENS_AWINDA_DONGLE_PID 0x0102 - #define XSENS_MTW_PID 0x0200 /* Xsens MTw */ -+#define XSENS_MTDEVBOARD_PID 0x0300 /* Motion Tracker Development Board */ - #define XSENS_CONVERTER_PID 0xD00D /* Xsens USB-serial converter */ - - /* Xsens devices using FTDI VID */ -diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c -index fa9f90049099..8adfc65b37dd 100644 ---- a/fs/btrfs/extent_io.c -+++ b/fs/btrfs/extent_io.c -@@ -4289,8 +4289,11 @@ int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, - } - ret = fiemap_fill_next_extent(fieinfo, em_start, disko, - em_len, flags); -- if (ret) -+ if (ret) { -+ if (ret == 1) -+ ret = 0; - goto out_free; -+ } - } - out_free: - free_extent_map(em); -diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c -index d04db817be5c..92cbfbf2599e 100644 ---- a/fs/btrfs/super.c -+++ b/fs/btrfs/super.c -@@ -906,6 +906,15 @@ find_root: - if (IS_ERR(new_root)) - return ERR_CAST(new_root); - -+ if (!(sb->s_flags & MS_RDONLY)) { -+ int ret; -+ down_read(&fs_info->cleanup_work_sem); -+ ret = btrfs_orphan_cleanup(new_root); -+ up_read(&fs_info->cleanup_work_sem); -+ if (ret) -+ return ERR_PTR(ret); -+ } -+ - dir_id = btrfs_root_dirid(&new_root->root_item); - setup_root: - location.objectid = dir_id; -diff --git a/kernel/trace/ring_buffer_benchmark.c b/kernel/trace/ring_buffer_benchmark.c -index a5457d577b98..6ad2e2d320fe 100644 ---- a/kernel/trace/ring_buffer_benchmark.c -+++ b/kernel/trace/ring_buffer_benchmark.c -@@ -455,7 +455,7 @@ static int __init ring_buffer_benchmark_init(void) - - if (producer_fifo >= 0) { - struct sched_param param = { -- .sched_priority = consumer_fifo -+ .sched_priority = producer_fifo - }; - sched_setscheduler(producer, SCHED_FIFO, ¶m); - } else -diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c -index c8e450132813..5bba3b35bec8 100644 ---- a/mm/memory_hotplug.c -+++ b/mm/memory_hotplug.c -@@ -1864,8 +1864,10 @@ void try_offline_node(int nid) - * wait_table may be allocated from boot memory, - * here only free if it's allocated by vmalloc. - */ -- if (is_vmalloc_addr(zone->wait_table)) -+ if (is_vmalloc_addr(zone->wait_table)) { - vfree(zone->wait_table); -+ zone->wait_table = NULL; -+ } - } - } - EXPORT_SYMBOL(try_offline_node); -diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c -index 9203d5a1943f..09152d11eb29 100644 ---- a/net/bridge/br_fdb.c -+++ b/net/bridge/br_fdb.c -@@ -705,9 +705,11 @@ static int __br_fdb_add(struct ndmsg *ndm, struct net_bridge_port *p, - int err = 0; - - if (ndm->ndm_flags & NTF_USE) { -+ local_bh_disable(); - rcu_read_lock(); - br_fdb_update(p->br, p, addr, vid, true); - rcu_read_unlock(); -+ local_bh_enable(); - } else { - spin_lock_bh(&p->br->hash_lock); - err = fdb_add_entry(p, addr, ndm->ndm_state, -diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c -index 93067ecdb9a2..11a2e6c8538f 100644 ---- a/net/bridge/br_multicast.c -+++ b/net/bridge/br_multicast.c -@@ -1056,7 +1056,7 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br, - - err = br_ip6_multicast_add_group(br, port, &grec->grec_mca, - vid); -- if (!err) -+ if (err) - break; - } - -diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c -index 526bf56f4d31..afeb8e07ee41 100644 ---- a/net/caif/caif_socket.c -+++ b/net/caif/caif_socket.c -@@ -332,6 +332,10 @@ static long caif_stream_data_wait(struct sock *sk, long timeo) - release_sock(sk); - timeo = schedule_timeout(timeo); - lock_sock(sk); -+ -+ if (sock_flag(sk, SOCK_DEAD)) -+ break; -+ - clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags); - } - -@@ -376,6 +380,10 @@ static int caif_stream_recvmsg(struct kiocb *iocb, struct socket *sock, - struct sk_buff *skb; - - lock_sock(sk); -+ if (sock_flag(sk, SOCK_DEAD)) { -+ err = -ECONNRESET; -+ goto unlock; -+ } - skb = skb_dequeue(&sk->sk_receive_queue); - caif_check_flow_release(sk); - -diff --git a/net/ceph/crush/mapper.c b/net/ceph/crush/mapper.c -index 074bb2a5e675..0a08902c539e 100644 ---- a/net/ceph/crush/mapper.c -+++ b/net/ceph/crush/mapper.c -@@ -290,6 +290,7 @@ static int is_out(const struct crush_map *map, - * @type: the type of item to choose - * @out: pointer to output vector - * @outpos: our position in that vector -+ * @out_size: size of the out vector - * @tries: number of attempts to make - * @recurse_tries: number of attempts to have recursive chooseleaf make - * @local_retries: localized retries -@@ -302,6 +303,7 @@ static int crush_choose_firstn(const struct crush_map *map, - const __u32 *weight, int weight_max, - int x, int numrep, int type, - int *out, int outpos, -+ int out_size, - unsigned int tries, - unsigned int recurse_tries, - unsigned int local_retries, -@@ -318,11 +320,12 @@ static int crush_choose_firstn(const struct crush_map *map, - int item = 0; - int itemtype; - int collide, reject; -+ int count = out_size; - - dprintk("CHOOSE%s bucket %d x %d outpos %d numrep %d\n", recurse_to_leaf ? "_LEAF" : "", - bucket->id, x, outpos, numrep); - -- for (rep = outpos; rep < numrep; rep++) { -+ for (rep = outpos; rep < numrep && count > 0 ; rep++) { - /* keep trying until we get a non-out, non-colliding item */ - ftotal = 0; - skip_rep = 0; -@@ -391,7 +394,7 @@ static int crush_choose_firstn(const struct crush_map *map, - map->buckets[-1-item], - weight, weight_max, - x, outpos+1, 0, -- out2, outpos, -+ out2, outpos, count, - recurse_tries, 0, - local_retries, - local_fallback_retries, -@@ -449,6 +452,7 @@ reject: - dprintk("CHOOSE got %d\n", item); - out[outpos] = item; - outpos++; -+ count--; - } - - dprintk("CHOOSE returns %d\n", outpos); -@@ -640,6 +644,7 @@ int crush_do_rule(const struct crush_map *map, - __u32 step; - int i, j; - int numrep; -+ int out_size; - /* - * the original choose_total_tries value was off by one (it - * counted "retries" and not "tries"). add one. -@@ -740,6 +745,7 @@ int crush_do_rule(const struct crush_map *map, - x, numrep, - curstep->arg2, - o+osize, j, -+ result_max-osize, - choose_tries, - recurse_tries, - choose_local_retries, -@@ -747,11 +753,13 @@ int crush_do_rule(const struct crush_map *map, - recurse_to_leaf, - c+osize); - } else { -+ out_size = ((numrep < (result_max-osize)) ? -+ numrep : (result_max-osize)); - crush_choose_indep( - map, - map->buckets[-1-w[i]], - weight, weight_max, -- x, numrep, numrep, -+ x, out_size, numrep, - curstep->arg2, - o+osize, j, - choose_tries, -@@ -760,7 +768,7 @@ int crush_do_rule(const struct crush_map *map, - recurse_to_leaf, - c+osize, - 0); -- osize += numrep; -+ osize += out_size; - } - } - -diff --git a/net/core/dev.c b/net/core/dev.c -index 73abbd77d72c..1b9e700c85b6 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -4903,7 +4903,7 @@ static int __netdev_upper_dev_link(struct net_device *dev, - if (__netdev_find_adj(upper_dev, dev, &upper_dev->all_adj_list.upper)) - return -EBUSY; - -- if (__netdev_find_adj(dev, upper_dev, &dev->all_adj_list.upper)) -+ if (__netdev_find_adj(dev, upper_dev, &dev->adj_list.upper)) - return -EEXIST; - - if (master && netdev_master_upper_dev_get(dev)) -diff --git a/net/ipv4/route.c b/net/ipv4/route.c -index b64330f25fbe..625615cdac86 100644 ---- a/net/ipv4/route.c -+++ b/net/ipv4/route.c -@@ -910,6 +910,10 @@ static int ip_error(struct sk_buff *skb) - bool send; - int code; - -+ /* IP on this device is disabled. */ -+ if (!in_dev) -+ goto out; -+ - net = dev_net(rt->dst.dev); - if (!IN_DEV_FORWARD(in_dev)) { - switch (rt->dst.error) { -diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c -index 7a436c517e44..9128d0aa4643 100644 ---- a/net/ipv4/tcp_minisocks.c -+++ b/net/ipv4/tcp_minisocks.c -@@ -297,7 +297,7 @@ void tcp_time_wait(struct sock *sk, int state, int timeo) - tw->tw_v6_daddr = sk->sk_v6_daddr; - tw->tw_v6_rcv_saddr = sk->sk_v6_rcv_saddr; - tw->tw_tclass = np->tclass; -- tw->tw_flowlabel = np->flow_label >> 12; -+ tw->tw_flowlabel = be32_to_cpu(np->flow_label & IPV6_FLOWLABEL_MASK); - tw->tw_ipv6only = np->ipv6only; - } - #endif -diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c -index b25e852625d8..21a3a9e90b10 100644 ---- a/net/ipv4/udp.c -+++ b/net/ipv4/udp.c -@@ -90,6 +90,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -1317,10 +1318,8 @@ csum_copy_err: - } - unlock_sock_fast(sk, slow); - -- if (noblock) -- return -EAGAIN; -- -- /* starting over for a new packet */ -+ /* starting over for a new packet, but check if we need to yield */ -+ cond_resched(); - msg->msg_flags &= ~MSG_TRUNC; - goto try_again; - } -@@ -1924,6 +1923,7 @@ void udp_v4_early_demux(struct sk_buff *skb) - struct sock *sk; - struct dst_entry *dst; - int dif = skb->dev->ifindex; -+ int ours; - - /* validate the packet */ - if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct udphdr))) -@@ -1933,14 +1933,24 @@ void udp_v4_early_demux(struct sk_buff *skb) - uh = udp_hdr(skb); - - if (skb->pkt_type == PACKET_BROADCAST || -- skb->pkt_type == PACKET_MULTICAST) -+ skb->pkt_type == PACKET_MULTICAST) { -+ struct in_device *in_dev = __in_dev_get_rcu(skb->dev); -+ -+ if (!in_dev) -+ return; -+ -+ ours = ip_check_mc_rcu(in_dev, iph->daddr, iph->saddr, -+ iph->protocol); -+ if (!ours) -+ return; - sk = __udp4_lib_mcast_demux_lookup(net, uh->dest, iph->daddr, - uh->source, iph->saddr, dif); -- else if (skb->pkt_type == PACKET_HOST) -+ } else if (skb->pkt_type == PACKET_HOST) { - sk = __udp4_lib_demux_lookup(net, uh->dest, iph->daddr, - uh->source, iph->saddr, dif); -- else -+ } else { - return; -+ } - - if (!sk) - return; -diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c -index 9d4332dba8ea..b50ae296537d 100644 ---- a/net/ipv6/tcp_ipv6.c -+++ b/net/ipv6/tcp_ipv6.c -@@ -905,7 +905,7 @@ static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb) - tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale, - tcp_time_stamp + tcptw->tw_ts_offset, - tcptw->tw_ts_recent, tcp_twsk_md5_key(tcptw), -- tw->tw_tclass, (tw->tw_flowlabel << 12)); -+ tw->tw_tclass, cpu_to_be32(tw->tw_flowlabel)); - - inet_twsk_put(tw); - } -diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c -index 20b63d2ab70f..38625a91ec94 100644 ---- a/net/ipv6/udp.c -+++ b/net/ipv6/udp.c -@@ -515,10 +515,8 @@ csum_copy_err: - } - unlock_sock_fast(sk, slow); - -- if (noblock) -- return -EAGAIN; -- -- /* starting over for a new packet */ -+ /* starting over for a new packet, but check if we need to yield */ -+ cond_resched(); - msg->msg_flags &= ~MSG_TRUNC; - goto try_again; - } -diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c -index 98532cfa7823..bdaed3130029 100644 ---- a/net/sched/sch_api.c -+++ b/net/sched/sch_api.c -@@ -812,10 +812,8 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent, - if (dev->flags & IFF_UP) - dev_deactivate(dev); - -- if (new && new->ops->attach) { -- new->ops->attach(new); -- num_q = 0; -- } -+ if (new && new->ops->attach) -+ goto skip; - - for (i = 0; i < num_q; i++) { - struct netdev_queue *dev_queue = dev_ingress_queue(dev); -@@ -831,12 +829,16 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent, - qdisc_destroy(old); - } - -+skip: - if (!ingress) { - notify_and_destroy(net, skb, n, classid, - dev->qdisc, new); - if (new && !new->ops->attach) - atomic_inc(&new->refcnt); - dev->qdisc = new ? : &noop_qdisc; -+ -+ if (new && new->ops->attach) -+ new->ops->attach(new); - } else { - notify_and_destroy(net, skb, n, classid, old, new); - } -diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c -index 94404f19f9de..4757f1cf6237 100644 ---- a/net/unix/af_unix.c -+++ b/net/unix/af_unix.c -@@ -1893,6 +1893,10 @@ static long unix_stream_data_wait(struct sock *sk, long timeo, - unix_state_unlock(sk); - timeo = freezable_schedule_timeout(timeo); - unix_state_lock(sk); -+ -+ if (sock_flag(sk, SOCK_DEAD)) -+ break; -+ - clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags); - } - -@@ -1957,6 +1961,10 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock, - struct sk_buff *skb, *last; - - unix_state_lock(sk); -+ if (sock_flag(sk, SOCK_DEAD)) { -+ err = -ECONNRESET; -+ goto unlock; -+ } - last = skb = skb_peek(&sk->sk_receive_queue); - again: - if (skb == NULL) { -diff --git a/net/wireless/wext-compat.c b/net/wireless/wext-compat.c -index 5661a54ac7ee..ae1fe6fd4ab6 100644 ---- a/net/wireless/wext-compat.c -+++ b/net/wireless/wext-compat.c -@@ -1331,6 +1331,8 @@ static struct iw_statistics *cfg80211_wireless_stats(struct net_device *dev) - memcpy(bssid, wdev->current_bss->pub.bssid, ETH_ALEN); - wdev_unlock(wdev); - -+ memset(&sinfo, 0, sizeof(sinfo)); -+ - if (rdev_get_station(rdev, dev, bssid, &sinfo)) - return NULL; - -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index e2b567706297..ba175226da78 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -2226,6 +2226,7 @@ static const struct hda_fixup alc882_fixups[] = { - static const struct snd_pci_quirk alc882_fixup_tbl[] = { - SND_PCI_QUIRK(0x1025, 0x006c, "Acer Aspire 9810", ALC883_FIXUP_ACER_EAPD), - SND_PCI_QUIRK(0x1025, 0x0090, "Acer Aspire", ALC883_FIXUP_ACER_EAPD), -+ SND_PCI_QUIRK(0x1025, 0x0107, "Acer Aspire", ALC883_FIXUP_ACER_EAPD), - SND_PCI_QUIRK(0x1025, 0x010a, "Acer Ferrari 5000", ALC883_FIXUP_ACER_EAPD), - SND_PCI_QUIRK(0x1025, 0x0110, "Acer Aspire", ALC883_FIXUP_ACER_EAPD), - SND_PCI_QUIRK(0x1025, 0x0112, "Acer Aspire 9303", ALC883_FIXUP_ACER_EAPD), -diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c -index 2d37b3fc3a21..c60103306b18 100644 ---- a/sound/usb/mixer.c -+++ b/sound/usb/mixer.c -@@ -891,6 +891,7 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval, - case USB_ID(0x046d, 0x081d): /* HD Webcam c510 */ - case USB_ID(0x046d, 0x0825): /* HD Webcam c270 */ - case USB_ID(0x046d, 0x0826): /* HD Webcam c525 */ -+ case USB_ID(0x046d, 0x08ca): /* Logitech Quickcam Fusion */ - case USB_ID(0x046d, 0x0991): - /* Most audio usb devices lie about volume resolution. - * Most Logitech webcams have res = 384. -diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c -index 621bc9ebb55e..b16be3944213 100644 ---- a/sound/usb/mixer_maps.c -+++ b/sound/usb/mixer_maps.c -@@ -428,6 +428,11 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = { - .map = ebox44_map, - }, - { -+ /* MAYA44 USB+ */ -+ .id = USB_ID(0x2573, 0x0008), -+ .map = maya44_map, -+ }, -+ { - /* KEF X300A */ - .id = USB_ID(0x27ac, 0x1000), - .map = scms_usb3318_map, diff --git a/patch/kernel/odroidc2-default/patch-3.14.45-46.patch b/patch/kernel/odroidc2-default/patch-3.14.45-46.patch deleted file mode 100644 index afcaa72bb9..0000000000 --- a/patch/kernel/odroidc2-default/patch-3.14.45-46.patch +++ /dev/null @@ -1,334 +0,0 @@ -diff --git a/Makefile b/Makefile -index c92186c3efd7..def39fdd9df4 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 3 - PATCHLEVEL = 14 --SUBLEVEL = 45 -+SUBLEVEL = 46 - EXTRAVERSION = - NAME = Remembering Coco - -diff --git a/arch/arm/kernel/hyp-stub.S b/arch/arm/kernel/hyp-stub.S -index 797b1a6a4906..7e666cfda634 100644 ---- a/arch/arm/kernel/hyp-stub.S -+++ b/arch/arm/kernel/hyp-stub.S -@@ -134,9 +134,7 @@ ENTRY(__hyp_stub_install_secondary) - mcr p15, 4, r7, c1, c1, 3 @ HSTR - - THUMB( orr r7, #(1 << 30) ) @ HSCTLR.TE --#ifdef CONFIG_CPU_BIG_ENDIAN -- orr r7, #(1 << 9) @ HSCTLR.EE --#endif -+ARM_BE8(orr r7, r7, #(1 << 25)) @ HSCTLR.EE - mcr p15, 4, r7, c1, c0, 0 @ HSCTLR - - mrc p15, 4, r7, c1, c1, 1 @ HDCR -diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c -index 26b03e1254ef..8ff2b3ca7ee9 100644 ---- a/drivers/bluetooth/ath3k.c -+++ b/drivers/bluetooth/ath3k.c -@@ -79,6 +79,7 @@ static const struct usb_device_id ath3k_table[] = { - { USB_DEVICE(0x0489, 0xe057) }, - { USB_DEVICE(0x0489, 0xe056) }, - { USB_DEVICE(0x0489, 0xe05f) }, -+ { USB_DEVICE(0x0489, 0xe076) }, - { USB_DEVICE(0x0489, 0xe078) }, - { USB_DEVICE(0x04c5, 0x1330) }, - { USB_DEVICE(0x04CA, 0x3004) }, -@@ -109,6 +110,7 @@ static const struct usb_device_id ath3k_table[] = { - { USB_DEVICE(0x13d3, 0x3402) }, - { USB_DEVICE(0x13d3, 0x3408) }, - { USB_DEVICE(0x13d3, 0x3432) }, -+ { USB_DEVICE(0x13d3, 0x3474) }, - - /* Atheros AR5BBU12 with sflash firmware */ - { USB_DEVICE(0x0489, 0xE02C) }, -@@ -133,6 +135,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = { - { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 }, -@@ -163,6 +166,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = { - { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 }, - - /* Atheros AR5BBU22 with sflash firmware */ - { USB_DEVICE(0x0489, 0xE036), .driver_info = BTUSB_ATH3012 }, -diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c -index 9eb1669962ef..c0e7a9aa97a4 100644 ---- a/drivers/bluetooth/btusb.c -+++ b/drivers/bluetooth/btusb.c -@@ -157,6 +157,7 @@ static const struct usb_device_id blacklist_table[] = { - { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 }, -@@ -187,6 +188,7 @@ static const struct usb_device_id blacklist_table[] = { - { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 }, - - /* Atheros AR5BBU12 with sflash firmware */ - { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE }, -diff --git a/drivers/crypto/caam/caamrng.c b/drivers/crypto/caam/caamrng.c -index 28486b19fc36..ae6dae8ef7ab 100644 ---- a/drivers/crypto/caam/caamrng.c -+++ b/drivers/crypto/caam/caamrng.c -@@ -56,7 +56,7 @@ - - /* Buffer, its dma address and lock */ - struct buf_data { -- u8 buf[RN_BUF_SIZE]; -+ u8 buf[RN_BUF_SIZE] ____cacheline_aligned; - dma_addr_t addr; - struct completion filled; - u32 hw_desc[DESC_JOB_O_LEN]; -diff --git a/drivers/gpu/drm/mgag200/mgag200_mode.c b/drivers/gpu/drm/mgag200/mgag200_mode.c -index 968374776db9..f2511a03e3e9 100644 ---- a/drivers/gpu/drm/mgag200/mgag200_mode.c -+++ b/drivers/gpu/drm/mgag200/mgag200_mode.c -@@ -1529,6 +1529,11 @@ static int mga_vga_mode_valid(struct drm_connector *connector, - return MODE_BANDWIDTH; - } - -+ if ((mode->hdisplay % 8) != 0 || (mode->hsync_start % 8) != 0 || -+ (mode->hsync_end % 8) != 0 || (mode->htotal % 8) != 0) { -+ return MODE_H_ILLEGAL; -+ } -+ - if (mode->crtc_hdisplay > 2048 || mode->crtc_hsync_start > 4096 || - mode->crtc_hsync_end > 4096 || mode->crtc_htotal > 4096 || - mode->crtc_vdisplay > 2048 || mode->crtc_vsync_start > 4096 || -diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c -index 8f580fda443f..ce211328bc1c 100644 ---- a/drivers/scsi/lpfc/lpfc_sli.c -+++ b/drivers/scsi/lpfc/lpfc_sli.c -@@ -265,6 +265,16 @@ lpfc_sli4_eq_get(struct lpfc_queue *q) - return NULL; - - q->hba_index = idx; -+ -+ /* -+ * insert barrier for instruction interlock : data from the hardware -+ * must have the valid bit checked before it can be copied and acted -+ * upon. Given what was seen in lpfc_sli4_cq_get() of speculative -+ * instructions allowing action on content before valid bit checked, -+ * add barrier here as well. May not be needed as "content" is a -+ * single 32-bit entity here (vs multi word structure for cq's). -+ */ -+ mb(); - return eqe; - } - -@@ -370,6 +380,17 @@ lpfc_sli4_cq_get(struct lpfc_queue *q) - - cqe = q->qe[q->hba_index].cqe; - q->hba_index = idx; -+ -+ /* -+ * insert barrier for instruction interlock : data from the hardware -+ * must have the valid bit checked before it can be copied and acted -+ * upon. Speculative instructions were allowing a bcopy at the start -+ * of lpfc_sli4_fp_handle_wcqe(), which is called immediately -+ * after our return, to copy data before the valid bit check above -+ * was done. As such, some of the copied data was stale. The barrier -+ * ensures the check is before any data is copied. -+ */ -+ mb(); - return cqe; - } - -diff --git a/fs/pipe.c b/fs/pipe.c -index 78fd0d0788db..46f1ab264a4c 100644 ---- a/fs/pipe.c -+++ b/fs/pipe.c -@@ -117,25 +117,27 @@ void pipe_wait(struct pipe_inode_info *pipe) - } - - static int --pipe_iov_copy_from_user(void *to, struct iovec *iov, unsigned long len, -- int atomic) -+pipe_iov_copy_from_user(void *addr, int *offset, struct iovec *iov, -+ size_t *remaining, int atomic) - { - unsigned long copy; - -- while (len > 0) { -+ while (*remaining > 0) { - while (!iov->iov_len) - iov++; -- copy = min_t(unsigned long, len, iov->iov_len); -+ copy = min_t(unsigned long, *remaining, iov->iov_len); - - if (atomic) { -- if (__copy_from_user_inatomic(to, iov->iov_base, copy)) -+ if (__copy_from_user_inatomic(addr + *offset, -+ iov->iov_base, copy)) - return -EFAULT; - } else { -- if (copy_from_user(to, iov->iov_base, copy)) -+ if (copy_from_user(addr + *offset, -+ iov->iov_base, copy)) - return -EFAULT; - } -- to += copy; -- len -= copy; -+ *offset += copy; -+ *remaining -= copy; - iov->iov_base += copy; - iov->iov_len -= copy; - } -@@ -143,25 +145,27 @@ pipe_iov_copy_from_user(void *to, struct iovec *iov, unsigned long len, - } - - static int --pipe_iov_copy_to_user(struct iovec *iov, const void *from, unsigned long len, -- int atomic) -+pipe_iov_copy_to_user(struct iovec *iov, void *addr, int *offset, -+ size_t *remaining, int atomic) - { - unsigned long copy; - -- while (len > 0) { -+ while (*remaining > 0) { - while (!iov->iov_len) - iov++; -- copy = min_t(unsigned long, len, iov->iov_len); -+ copy = min_t(unsigned long, *remaining, iov->iov_len); - - if (atomic) { -- if (__copy_to_user_inatomic(iov->iov_base, from, copy)) -+ if (__copy_to_user_inatomic(iov->iov_base, -+ addr + *offset, copy)) - return -EFAULT; - } else { -- if (copy_to_user(iov->iov_base, from, copy)) -+ if (copy_to_user(iov->iov_base, -+ addr + *offset, copy)) - return -EFAULT; - } -- from += copy; -- len -= copy; -+ *offset += copy; -+ *remaining -= copy; - iov->iov_base += copy; - iov->iov_len -= copy; - } -@@ -395,7 +399,7 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov, - struct pipe_buffer *buf = pipe->bufs + curbuf; - const struct pipe_buf_operations *ops = buf->ops; - void *addr; -- size_t chars = buf->len; -+ size_t chars = buf->len, remaining; - int error, atomic; - - if (chars > total_len) -@@ -409,9 +413,11 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov, - } - - atomic = !iov_fault_in_pages_write(iov, chars); -+ remaining = chars; - redo: - addr = ops->map(pipe, buf, atomic); -- error = pipe_iov_copy_to_user(iov, addr + buf->offset, chars, atomic); -+ error = pipe_iov_copy_to_user(iov, addr, &buf->offset, -+ &remaining, atomic); - ops->unmap(pipe, buf, addr); - if (unlikely(error)) { - /* -@@ -426,7 +432,6 @@ redo: - break; - } - ret += chars; -- buf->offset += chars; - buf->len -= chars; - - /* Was it a packet buffer? Clean up and exit */ -@@ -531,6 +536,7 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov, - if (ops->can_merge && offset + chars <= PAGE_SIZE) { - int error, atomic = 1; - void *addr; -+ size_t remaining = chars; - - error = ops->confirm(pipe, buf); - if (error) -@@ -539,8 +545,8 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov, - iov_fault_in_pages_read(iov, chars); - redo1: - addr = ops->map(pipe, buf, atomic); -- error = pipe_iov_copy_from_user(offset + addr, iov, -- chars, atomic); -+ error = pipe_iov_copy_from_user(addr, &offset, iov, -+ &remaining, atomic); - ops->unmap(pipe, buf, addr); - ret = error; - do_wakeup = 1; -@@ -575,6 +581,8 @@ redo1: - struct page *page = pipe->tmp_page; - char *src; - int error, atomic = 1; -+ int offset = 0; -+ size_t remaining; - - if (!page) { - page = alloc_page(GFP_HIGHUSER); -@@ -595,14 +603,15 @@ redo1: - chars = total_len; - - iov_fault_in_pages_read(iov, chars); -+ remaining = chars; - redo2: - if (atomic) - src = kmap_atomic(page); - else - src = kmap(page); - -- error = pipe_iov_copy_from_user(src, iov, chars, -- atomic); -+ error = pipe_iov_copy_from_user(src, &offset, iov, -+ &remaining, atomic); - if (atomic) - kunmap_atomic(src); - else -diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c -index 8a8631926a07..cb347e85f75e 100644 ---- a/kernel/trace/trace_events_filter.c -+++ b/kernel/trace/trace_events_filter.c -@@ -1399,19 +1399,24 @@ static int check_preds(struct filter_parse_state *ps) - { - int n_normal_preds = 0, n_logical_preds = 0; - struct postfix_elt *elt; -+ int cnt = 0; - - list_for_each_entry(elt, &ps->postfix, list) { -- if (elt->op == OP_NONE) -+ if (elt->op == OP_NONE) { -+ cnt++; - continue; -+ } - -+ cnt--; - if (elt->op == OP_AND || elt->op == OP_OR) { - n_logical_preds++; - continue; - } - n_normal_preds++; -+ WARN_ON_ONCE(cnt < 0); - } - -- if (!n_normal_preds || n_logical_preds >= n_normal_preds) { -+ if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) { - parse_error(ps, FILT_ERR_INVALID_FILTER, 0); - return -EINVAL; - } diff --git a/patch/kernel/odroidc2-default/patch-3.14.46-47.patch b/patch/kernel/odroidc2-default/patch-3.14.46-47.patch deleted file mode 100644 index 18d17c54b2..0000000000 --- a/patch/kernel/odroidc2-default/patch-3.14.46-47.patch +++ /dev/null @@ -1,944 +0,0 @@ -diff --git a/Documentation/virtual/kvm/api.txt b/Documentation/virtual/kvm/api.txt -index 6cd63a9010fb..bc6d61773ee2 100644 ---- a/Documentation/virtual/kvm/api.txt -+++ b/Documentation/virtual/kvm/api.txt -@@ -2344,7 +2344,8 @@ should be created before this ioctl is invoked. - - Possible features: - - KVM_ARM_VCPU_POWER_OFF: Starts the CPU in a power-off state. -- Depends on KVM_CAP_ARM_PSCI. -+ Depends on KVM_CAP_ARM_PSCI. If not set, the CPU will be powered on -+ and execute guest code when KVM_RUN is called. - - KVM_ARM_VCPU_EL1_32BIT: Starts the CPU in a 32bit mode. - Depends on KVM_CAP_ARM_EL1_32BIT (arm64 only). - -diff --git a/Makefile b/Makefile -index def39fdd9df4..f9041e6d4d19 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 3 - PATCHLEVEL = 14 --SUBLEVEL = 46 -+SUBLEVEL = 47 - EXTRAVERSION = - NAME = Remembering Coco - -diff --git a/arch/arm/include/asm/kvm_emulate.h b/arch/arm/include/asm/kvm_emulate.h -index 0fa90c962ac8..853e2becad18 100644 ---- a/arch/arm/include/asm/kvm_emulate.h -+++ b/arch/arm/include/asm/kvm_emulate.h -@@ -33,6 +33,11 @@ void kvm_inject_undefined(struct kvm_vcpu *vcpu); - void kvm_inject_dabt(struct kvm_vcpu *vcpu, unsigned long addr); - void kvm_inject_pabt(struct kvm_vcpu *vcpu, unsigned long addr); - -+static inline void vcpu_reset_hcr(struct kvm_vcpu *vcpu) -+{ -+ vcpu->arch.hcr = HCR_GUEST_MASK; -+} -+ - static inline bool vcpu_mode_is_32bit(struct kvm_vcpu *vcpu) - { - return 1; -diff --git a/arch/arm/kvm/guest.c b/arch/arm/kvm/guest.c -index b23a59c1c522..2786eae10c0d 100644 ---- a/arch/arm/kvm/guest.c -+++ b/arch/arm/kvm/guest.c -@@ -38,7 +38,6 @@ struct kvm_stats_debugfs_item debugfs_entries[] = { - - int kvm_arch_vcpu_setup(struct kvm_vcpu *vcpu) - { -- vcpu->arch.hcr = HCR_GUEST_MASK; - return 0; - } - -diff --git a/arch/arm/mach-dove/board-dt.c b/arch/arm/mach-dove/board-dt.c -index 49fa9abd09da..7a7a09a5d5ff 100644 ---- a/arch/arm/mach-dove/board-dt.c -+++ b/arch/arm/mach-dove/board-dt.c -@@ -26,7 +26,7 @@ static void __init dove_dt_init(void) - #ifdef CONFIG_CACHE_TAUROS2 - tauros2_init(0); - #endif -- BUG_ON(mvebu_mbus_dt_init()); -+ BUG_ON(mvebu_mbus_dt_init(false)); - of_platform_populate(NULL, of_default_bus_match_table, NULL, NULL); - } - -diff --git a/arch/arm/mach-imx/clk-imx6q.c b/arch/arm/mach-imx/clk-imx6q.c -index 01a5765a8b26..b509556f6cfd 100644 ---- a/arch/arm/mach-imx/clk-imx6q.c -+++ b/arch/arm/mach-imx/clk-imx6q.c -@@ -406,7 +406,7 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node) - clk[gpmi_io] = imx_clk_gate2("gpmi_io", "enfc", base + 0x78, 28); - clk[gpmi_apb] = imx_clk_gate2("gpmi_apb", "usdhc3", base + 0x78, 30); - clk[rom] = imx_clk_gate2("rom", "ahb", base + 0x7c, 0); -- clk[sata] = imx_clk_gate2("sata", "ipg", base + 0x7c, 4); -+ clk[sata] = imx_clk_gate2("sata", "ahb", base + 0x7c, 4); - clk[sdma] = imx_clk_gate2("sdma", "ahb", base + 0x7c, 6); - clk[spba] = imx_clk_gate2("spba", "ipg", base + 0x7c, 12); - clk[spdif] = imx_clk_gate2("spdif", "spdif_podf", base + 0x7c, 14); -diff --git a/arch/arm/mach-kirkwood/board-dt.c b/arch/arm/mach-kirkwood/board-dt.c -index 78188159484d..79e629da1c92 100644 ---- a/arch/arm/mach-kirkwood/board-dt.c -+++ b/arch/arm/mach-kirkwood/board-dt.c -@@ -116,7 +116,7 @@ static void __init kirkwood_dt_init(void) - */ - writel(readl(CPU_CONFIG) & ~CPU_CONFIG_ERROR_PROP, CPU_CONFIG); - -- BUG_ON(mvebu_mbus_dt_init()); -+ BUG_ON(mvebu_mbus_dt_init(false)); - - kirkwood_l2_init(); - -diff --git a/arch/arm/mach-mvebu/armada-370-xp.c b/arch/arm/mach-mvebu/armada-370-xp.c -index f6c9d1d85c14..79c3766a56fd 100644 ---- a/arch/arm/mach-mvebu/armada-370-xp.c -+++ b/arch/arm/mach-mvebu/armada-370-xp.c -@@ -41,7 +41,7 @@ static void __init armada_370_xp_timer_and_clk_init(void) - of_clk_init(NULL); - clocksource_of_init(); - coherency_init(); -- BUG_ON(mvebu_mbus_dt_init()); -+ BUG_ON(mvebu_mbus_dt_init(coherency_available())); - #ifdef CONFIG_CACHE_L2X0 - l2x0_of_init(0, ~0UL); - #endif -diff --git a/arch/arm/mach-mvebu/coherency.c b/arch/arm/mach-mvebu/coherency.c -index c295c10f9217..49bad4d66fa2 100644 ---- a/arch/arm/mach-mvebu/coherency.c -+++ b/arch/arm/mach-mvebu/coherency.c -@@ -121,6 +121,20 @@ static struct notifier_block mvebu_hwcc_platform_nb = { - .notifier_call = mvebu_hwcc_platform_notifier, - }; - -+/* -+ * Keep track of whether we have IO hardware coherency enabled or not. -+ * On Armada 370's we will not be using it for example. We need to make -+ * that available [through coherency_available()] so the mbus controller -+ * doesn't enable the IO coherency bit in the attribute bits of the -+ * chip selects. -+ */ -+static int coherency_enabled; -+ -+int coherency_available(void) -+{ -+ return coherency_enabled; -+} -+ - int __init coherency_init(void) - { - struct device_node *np; -@@ -164,6 +178,7 @@ int __init coherency_init(void) - coherency_base = of_iomap(np, 0); - coherency_cpu_base = of_iomap(np, 1); - set_cpu_coherent(cpu_logical_map(smp_processor_id()), 0); -+ coherency_enabled = 1; - of_node_put(np); - } - -diff --git a/arch/arm/mach-mvebu/coherency.h b/arch/arm/mach-mvebu/coherency.h -index 760226c41353..63e18c64a8e3 100644 ---- a/arch/arm/mach-mvebu/coherency.h -+++ b/arch/arm/mach-mvebu/coherency.h -@@ -17,6 +17,7 @@ - extern unsigned long coherency_phys_base; - - int set_cpu_coherent(unsigned int cpu_id, int smp_group_id); -+int coherency_available(void); - int coherency_init(void); - - #endif /* __MACH_370_XP_COHERENCY_H */ -diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h -index dd8ecfc3f995..681cb9080100 100644 ---- a/arch/arm64/include/asm/kvm_emulate.h -+++ b/arch/arm64/include/asm/kvm_emulate.h -@@ -38,6 +38,11 @@ void kvm_inject_undefined(struct kvm_vcpu *vcpu); - void kvm_inject_dabt(struct kvm_vcpu *vcpu, unsigned long addr); - void kvm_inject_pabt(struct kvm_vcpu *vcpu, unsigned long addr); - -+static inline void vcpu_reset_hcr(struct kvm_vcpu *vcpu) -+{ -+ vcpu->arch.hcr_el2 = HCR_GUEST_FLAGS; -+} -+ - static inline unsigned long *vcpu_pc(const struct kvm_vcpu *vcpu) - { - return (unsigned long *)&vcpu_gp_regs(vcpu)->regs.pc; -diff --git a/arch/arm64/kvm/guest.c b/arch/arm64/kvm/guest.c -index 08745578d54d..a8d81fa8c527 100644 ---- a/arch/arm64/kvm/guest.c -+++ b/arch/arm64/kvm/guest.c -@@ -38,7 +38,6 @@ struct kvm_stats_debugfs_item debugfs_entries[] = { - - int kvm_arch_vcpu_setup(struct kvm_vcpu *vcpu) - { -- vcpu->arch.hcr_el2 = HCR_GUEST_FLAGS; - return 0; - } - -diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c -index 3974881388bb..b76159a153a5 100644 ---- a/arch/arm64/mm/dma-mapping.c -+++ b/arch/arm64/mm/dma-mapping.c -@@ -54,8 +54,7 @@ static void *arm64_swiotlb_alloc_coherent(struct device *dev, size_t size, - - *dma_handle = phys_to_dma(dev, page_to_phys(page)); - addr = page_address(page); -- if (flags & __GFP_ZERO) -- memset(addr, 0, size); -+ memset(addr, 0, size); - return addr; - } else { - return swiotlb_alloc_coherent(dev, size, dma_handle, flags); -diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig -index 2f645c90e4d8..5dab54accc56 100644 ---- a/arch/x86/Kconfig -+++ b/arch/x86/Kconfig -@@ -160,7 +160,7 @@ config SBUS - - config NEED_DMA_MAP_STATE - def_bool y -- depends on X86_64 || INTEL_IOMMU || DMA_API_DEBUG -+ depends on X86_64 || INTEL_IOMMU || DMA_API_DEBUG || SWIOTLB - - config NEED_SG_DMA_LENGTH - def_bool y -diff --git a/arch/x86/kernel/cpu/microcode/intel_early.c b/arch/x86/kernel/cpu/microcode/intel_early.c -index 18f739129e72..43a07bf48dea 100644 ---- a/arch/x86/kernel/cpu/microcode/intel_early.c -+++ b/arch/x86/kernel/cpu/microcode/intel_early.c -@@ -321,7 +321,7 @@ get_matching_model_microcode(int cpu, unsigned long start, - unsigned int mc_saved_count = mc_saved_data->mc_saved_count; - int i; - -- while (leftover) { -+ while (leftover && mc_saved_count < ARRAY_SIZE(mc_saved_tmp)) { - mc_header = (struct microcode_header_intel *)ucode_ptr; - - mc_size = get_totalsize(mc_header); -diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c -index a1f5b1866cbe..490fee15fea5 100644 ---- a/arch/x86/kernel/kprobes/core.c -+++ b/arch/x86/kernel/kprobes/core.c -@@ -326,13 +326,16 @@ int __kprobes __copy_instruction(u8 *dest, u8 *src) - { - struct insn insn; - kprobe_opcode_t buf[MAX_INSN_SIZE]; -+ int length; - - kernel_insn_init(&insn, (void *)recover_probed_instruction(buf, (unsigned long)src)); - insn_get_length(&insn); -+ length = insn.length; -+ - /* Another subsystem puts a breakpoint, failed to recover */ - if (insn.opcode.bytes[0] == BREAKPOINT_INSTRUCTION) - return 0; -- memcpy(dest, insn.kaddr, insn.length); -+ memcpy(dest, insn.kaddr, length); - - #ifdef CONFIG_X86_64 - if (insn_rip_relative(&insn)) { -@@ -362,7 +365,7 @@ int __kprobes __copy_instruction(u8 *dest, u8 *src) - *(s32 *) disp = (s32) newdisp; - } - #endif -- return insn.length; -+ return length; - } - - static int __kprobes arch_copy_kprobe(struct kprobe *p) -diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c -index 9643eda60a52..074633411ea8 100644 ---- a/arch/x86/kvm/svm.c -+++ b/arch/x86/kvm/svm.c -@@ -495,8 +495,10 @@ static void skip_emulated_instruction(struct kvm_vcpu *vcpu) - { - struct vcpu_svm *svm = to_svm(vcpu); - -- if (svm->vmcb->control.next_rip != 0) -+ if (svm->vmcb->control.next_rip != 0) { -+ WARN_ON(!static_cpu_has(X86_FEATURE_NRIPS)); - svm->next_rip = svm->vmcb->control.next_rip; -+ } - - if (!svm->next_rip) { - if (emulate_instruction(vcpu, EMULTYPE_SKIP) != -@@ -4246,7 +4248,9 @@ static int svm_check_intercept(struct kvm_vcpu *vcpu, - break; - } - -- vmcb->control.next_rip = info->next_rip; -+ /* TODO: Advertise NRIPS to guest hypervisor unconditionally */ -+ if (static_cpu_has(X86_FEATURE_NRIPS)) -+ vmcb->control.next_rip = info->next_rip; - vmcb->control.exit_code = icpt_info.exit_code; - vmexit = nested_svm_exit_handled(svm); - -diff --git a/drivers/bus/mvebu-mbus.c b/drivers/bus/mvebu-mbus.c -index e990deed2d33..1aa0130a63d5 100644 ---- a/drivers/bus/mvebu-mbus.c -+++ b/drivers/bus/mvebu-mbus.c -@@ -701,7 +701,6 @@ static int __init mvebu_mbus_common_init(struct mvebu_mbus_state *mbus, - phys_addr_t sdramwins_phys_base, - size_t sdramwins_size) - { -- struct device_node *np; - int win; - - mbus->mbuswins_base = ioremap(mbuswins_phys_base, mbuswins_size); -@@ -714,12 +713,6 @@ static int __init mvebu_mbus_common_init(struct mvebu_mbus_state *mbus, - return -ENOMEM; - } - -- np = of_find_compatible_node(NULL, NULL, "marvell,coherency-fabric"); -- if (np) { -- mbus->hw_io_coherency = 1; -- of_node_put(np); -- } -- - for (win = 0; win < mbus->soc->num_wins; win++) - mvebu_mbus_disable_window(mbus, win); - -@@ -889,7 +882,7 @@ static void __init mvebu_mbus_get_pcie_resources(struct device_node *np, - } - } - --int __init mvebu_mbus_dt_init(void) -+int __init mvebu_mbus_dt_init(bool is_coherent) - { - struct resource mbuswins_res, sdramwins_res; - struct device_node *np, *controller; -@@ -928,6 +921,8 @@ int __init mvebu_mbus_dt_init(void) - return -EINVAL; - } - -+ mbus_state.hw_io_coherency = is_coherent; -+ - /* Get optional pcie-{mem,io}-aperture properties */ - mvebu_mbus_get_pcie_resources(np, &mbus_state.pcie_mem_aperture, - &mbus_state.pcie_io_aperture); -diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c -index c611bcc01f7e..3e623ab5e315 100644 ---- a/drivers/edac/sb_edac.c -+++ b/drivers/edac/sb_edac.c -@@ -765,7 +765,7 @@ static void get_memory_layout(const struct mem_ctl_info *mci) - u32 reg; - u64 limit, prv = 0; - u64 tmp_mb; -- u32 mb, kb; -+ u32 gb, mb; - u32 rir_way; - - /* -@@ -775,15 +775,17 @@ static void get_memory_layout(const struct mem_ctl_info *mci) - pvt->tolm = pvt->info.get_tolm(pvt); - tmp_mb = (1 + pvt->tolm) >> 20; - -- mb = div_u64_rem(tmp_mb, 1000, &kb); -- edac_dbg(0, "TOLM: %u.%03u GB (0x%016Lx)\n", mb, kb, (u64)pvt->tolm); -+ gb = div_u64_rem(tmp_mb, 1024, &mb); -+ edac_dbg(0, "TOLM: %u.%03u GB (0x%016Lx)\n", -+ gb, (mb*1000)/1024, (u64)pvt->tolm); - - /* Address range is already 45:25 */ - pvt->tohm = pvt->info.get_tohm(pvt); - tmp_mb = (1 + pvt->tohm) >> 20; - -- mb = div_u64_rem(tmp_mb, 1000, &kb); -- edac_dbg(0, "TOHM: %u.%03u GB (0x%016Lx)\n", mb, kb, (u64)pvt->tohm); -+ gb = div_u64_rem(tmp_mb, 1024, &mb); -+ edac_dbg(0, "TOHM: %u.%03u GB (0x%016Lx)\n", -+ gb, (mb*1000)/1024, (u64)pvt->tohm); - - /* - * Step 2) Get SAD range and SAD Interleave list -@@ -805,11 +807,11 @@ static void get_memory_layout(const struct mem_ctl_info *mci) - break; - - tmp_mb = (limit + 1) >> 20; -- mb = div_u64_rem(tmp_mb, 1000, &kb); -+ gb = div_u64_rem(tmp_mb, 1024, &mb); - edac_dbg(0, "SAD#%d %s up to %u.%03u GB (0x%016Lx) Interleave: %s reg=0x%08x\n", - n_sads, - get_dram_attr(reg), -- mb, kb, -+ gb, (mb*1000)/1024, - ((u64)tmp_mb) << 20L, - INTERLEAVE_MODE(reg) ? "8:6" : "[8:6]XOR[18:16]", - reg); -@@ -840,9 +842,9 @@ static void get_memory_layout(const struct mem_ctl_info *mci) - break; - tmp_mb = (limit + 1) >> 20; - -- mb = div_u64_rem(tmp_mb, 1000, &kb); -+ gb = div_u64_rem(tmp_mb, 1024, &mb); - edac_dbg(0, "TAD#%d: up to %u.%03u GB (0x%016Lx), socket interleave %d, memory interleave %d, TGT: %d, %d, %d, %d, reg=0x%08x\n", -- n_tads, mb, kb, -+ n_tads, gb, (mb*1000)/1024, - ((u64)tmp_mb) << 20L, - (u32)TAD_SOCK(reg), - (u32)TAD_CH(reg), -@@ -865,10 +867,10 @@ static void get_memory_layout(const struct mem_ctl_info *mci) - tad_ch_nilv_offset[j], - ®); - tmp_mb = TAD_OFFSET(reg) >> 20; -- mb = div_u64_rem(tmp_mb, 1000, &kb); -+ gb = div_u64_rem(tmp_mb, 1024, &mb); - edac_dbg(0, "TAD CH#%d, offset #%d: %u.%03u GB (0x%016Lx), reg=0x%08x\n", - i, j, -- mb, kb, -+ gb, (mb*1000)/1024, - ((u64)tmp_mb) << 20L, - reg); - } -@@ -890,10 +892,10 @@ static void get_memory_layout(const struct mem_ctl_info *mci) - - tmp_mb = RIR_LIMIT(reg) >> 20; - rir_way = 1 << RIR_WAY(reg); -- mb = div_u64_rem(tmp_mb, 1000, &kb); -+ gb = div_u64_rem(tmp_mb, 1024, &mb); - edac_dbg(0, "CH#%d RIR#%d, limit: %u.%03u GB (0x%016Lx), way: %d, reg=0x%08x\n", - i, j, -- mb, kb, -+ gb, (mb*1000)/1024, - ((u64)tmp_mb) << 20L, - rir_way, - reg); -@@ -904,10 +906,10 @@ static void get_memory_layout(const struct mem_ctl_info *mci) - ®); - tmp_mb = RIR_OFFSET(reg) << 6; - -- mb = div_u64_rem(tmp_mb, 1000, &kb); -+ gb = div_u64_rem(tmp_mb, 1024, &mb); - edac_dbg(0, "CH#%d RIR#%d INTL#%d, offset %u.%03u GB (0x%016Lx), tgt: %d, reg=0x%08x\n", - i, j, k, -- mb, kb, -+ gb, (mb*1000)/1024, - ((u64)tmp_mb) << 20L, - (u32)RIR_RNK_TGT(reg), - reg); -@@ -945,7 +947,7 @@ static int get_memory_error_data(struct mem_ctl_info *mci, - u8 ch_way, sck_way, pkg, sad_ha = 0; - u32 tad_offset; - u32 rir_way; -- u32 mb, kb; -+ u32 mb, gb; - u64 ch_addr, offset, limit = 0, prv = 0; - - -@@ -1183,10 +1185,10 @@ static int get_memory_error_data(struct mem_ctl_info *mci, - continue; - - limit = RIR_LIMIT(reg); -- mb = div_u64_rem(limit >> 20, 1000, &kb); -+ gb = div_u64_rem(limit >> 20, 1024, &mb); - edac_dbg(0, "RIR#%d, limit: %u.%03u GB (0x%016Lx), way: %d\n", - n_rir, -- mb, kb, -+ gb, (mb*1000)/1024, - limit, - 1 << RIR_WAY(reg)); - if (ch_addr <= limit) -diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c -index 019a04a31384..a467261b10b9 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c -+++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c -@@ -810,8 +810,11 @@ netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev) - tx_desc->ctrl.fence_size = (real_size / 16) & 0x3f; - tx_desc->ctrl.srcrb_flags = priv->ctrl_flags; - if (likely(skb->ip_summed == CHECKSUM_PARTIAL)) { -- tx_desc->ctrl.srcrb_flags |= cpu_to_be32(MLX4_WQE_CTRL_IP_CSUM | -- MLX4_WQE_CTRL_TCP_UDP_CSUM); -+ if (!skb->encapsulation) -+ tx_desc->ctrl.srcrb_flags |= cpu_to_be32(MLX4_WQE_CTRL_IP_CSUM | -+ MLX4_WQE_CTRL_TCP_UDP_CSUM); -+ else -+ tx_desc->ctrl.srcrb_flags |= cpu_to_be32(MLX4_WQE_CTRL_IP_CSUM); - ring->tx_csum++; - } - -diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c -index 528bff5ec91f..85d370e1ca79 100644 ---- a/drivers/scsi/hpsa.c -+++ b/drivers/scsi/hpsa.c -@@ -3984,10 +3984,6 @@ static int hpsa_kdump_hard_reset_controller(struct pci_dev *pdev) - - /* Save the PCI command register */ - pci_read_config_word(pdev, 4, &command_register); -- /* Turn the board off. This is so that later pci_restore_state() -- * won't turn the board on before the rest of config space is ready. -- */ -- pci_disable_device(pdev); - pci_save_state(pdev); - - /* find the first memory BAR, so we can find the cfg table */ -@@ -4035,11 +4031,6 @@ static int hpsa_kdump_hard_reset_controller(struct pci_dev *pdev) - goto unmap_cfgtable; - - pci_restore_state(pdev); -- rc = pci_enable_device(pdev); -- if (rc) { -- dev_warn(&pdev->dev, "failed to enable device.\n"); -- goto unmap_cfgtable; -- } - pci_write_config_word(pdev, 4, command_register); - - /* Some devices (notably the HP Smart Array 5i Controller) -@@ -4525,6 +4516,23 @@ static int hpsa_init_reset_devices(struct pci_dev *pdev) - if (!reset_devices) - return 0; - -+ /* kdump kernel is loading, we don't know in which state is -+ * the pci interface. The dev->enable_cnt is equal zero -+ * so we call enable+disable, wait a while and switch it on. -+ */ -+ rc = pci_enable_device(pdev); -+ if (rc) { -+ dev_warn(&pdev->dev, "Failed to enable PCI device\n"); -+ return -ENODEV; -+ } -+ pci_disable_device(pdev); -+ msleep(260); /* a randomly chosen number */ -+ rc = pci_enable_device(pdev); -+ if (rc) { -+ dev_warn(&pdev->dev, "failed to enable device.\n"); -+ return -ENODEV; -+ } -+ pci_set_master(pdev); - /* Reset the controller with a PCI power-cycle or via doorbell */ - rc = hpsa_kdump_hard_reset_controller(pdev); - -@@ -4533,10 +4541,11 @@ static int hpsa_init_reset_devices(struct pci_dev *pdev) - * "performant mode". Or, it might be 640x, which can't reset - * due to concerns about shared bbwc between 6402/6404 pair. - */ -- if (rc == -ENOTSUPP) -- return rc; /* just try to do the kdump anyhow. */ -- if (rc) -- return -ENODEV; -+ if (rc) { -+ if (rc != -ENOTSUPP) /* just try to do the kdump anyhow. */ -+ rc = -ENODEV; -+ goto out_disable; -+ } - - /* Now try to get the controller to respond to a no-op */ - dev_warn(&pdev->dev, "Waiting for controller to respond to no-op\n"); -@@ -4547,7 +4556,11 @@ static int hpsa_init_reset_devices(struct pci_dev *pdev) - dev_warn(&pdev->dev, "no-op failed%s\n", - (i < 11 ? "; re-trying" : "")); - } -- return 0; -+ -+out_disable: -+ -+ pci_disable_device(pdev); -+ return rc; - } - - static int hpsa_allocate_cmd_pool(struct ctlr_info *h) -@@ -4690,6 +4703,7 @@ static void hpsa_undo_allocations_after_kdump_soft_reset(struct ctlr_info *h) - iounmap(h->transtable); - if (h->cfgtable) - iounmap(h->cfgtable); -+ pci_disable_device(h->pdev); - pci_release_regions(h->pdev); - kfree(h); - } -diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c -index 93de3ba994e7..f8ffee4562d3 100644 ---- a/fs/btrfs/ctree.c -+++ b/fs/btrfs/ctree.c -@@ -2963,7 +2963,7 @@ done: - */ - if (!p->leave_spinning) - btrfs_set_path_blocking(p); -- if (ret < 0) -+ if (ret < 0 && !p->skip_release_on_error) - btrfs_release_path(p); - return ret; - } -diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h -index d3511cc17091..3b39eb4cb309 100644 ---- a/fs/btrfs/ctree.h -+++ b/fs/btrfs/ctree.h -@@ -608,6 +608,7 @@ struct btrfs_path { - unsigned int skip_locking:1; - unsigned int leave_spinning:1; - unsigned int search_commit_root:1; -+ unsigned int skip_release_on_error:1; - }; - - /* -@@ -3609,6 +3610,10 @@ struct btrfs_dir_item *btrfs_lookup_xattr(struct btrfs_trans_handle *trans, - int verify_dir_item(struct btrfs_root *root, - struct extent_buffer *leaf, - struct btrfs_dir_item *dir_item); -+struct btrfs_dir_item *btrfs_match_dir_item_name(struct btrfs_root *root, -+ struct btrfs_path *path, -+ const char *name, -+ int name_len); - - /* orphan.c */ - int btrfs_insert_orphan_item(struct btrfs_trans_handle *trans, -diff --git a/fs/btrfs/dir-item.c b/fs/btrfs/dir-item.c -index a0691df5dcea..9521a93b5303 100644 ---- a/fs/btrfs/dir-item.c -+++ b/fs/btrfs/dir-item.c -@@ -21,10 +21,6 @@ - #include "hash.h" - #include "transaction.h" - --static struct btrfs_dir_item *btrfs_match_dir_item_name(struct btrfs_root *root, -- struct btrfs_path *path, -- const char *name, int name_len); -- - /* - * insert a name into a directory, doing overflow properly if there is a hash - * collision. data_size indicates how big the item inserted should be. On -@@ -383,9 +379,9 @@ struct btrfs_dir_item *btrfs_lookup_xattr(struct btrfs_trans_handle *trans, - * this walks through all the entries in a dir item and finds one - * for a specific name. - */ --static struct btrfs_dir_item *btrfs_match_dir_item_name(struct btrfs_root *root, -- struct btrfs_path *path, -- const char *name, int name_len) -+struct btrfs_dir_item *btrfs_match_dir_item_name(struct btrfs_root *root, -+ struct btrfs_path *path, -+ const char *name, int name_len) - { - struct btrfs_dir_item *dir_item; - unsigned long name_ptr; -diff --git a/fs/btrfs/xattr.c b/fs/btrfs/xattr.c -index 488e987c3374..618e86ceede7 100644 ---- a/fs/btrfs/xattr.c -+++ b/fs/btrfs/xattr.c -@@ -29,6 +29,7 @@ - #include "xattr.h" - #include "disk-io.h" - #include "props.h" -+#include "locking.h" - - - ssize_t __btrfs_getxattr(struct inode *inode, const char *name, -@@ -91,7 +92,7 @@ static int do_setxattr(struct btrfs_trans_handle *trans, - struct inode *inode, const char *name, - const void *value, size_t size, int flags) - { -- struct btrfs_dir_item *di; -+ struct btrfs_dir_item *di = NULL; - struct btrfs_root *root = BTRFS_I(inode)->root; - struct btrfs_path *path; - size_t name_len = strlen(name); -@@ -103,84 +104,119 @@ static int do_setxattr(struct btrfs_trans_handle *trans, - path = btrfs_alloc_path(); - if (!path) - return -ENOMEM; -+ path->skip_release_on_error = 1; -+ -+ if (!value) { -+ di = btrfs_lookup_xattr(trans, root, path, btrfs_ino(inode), -+ name, name_len, -1); -+ if (!di && (flags & XATTR_REPLACE)) -+ ret = -ENODATA; -+ else if (di) -+ ret = btrfs_delete_one_dir_name(trans, root, path, di); -+ goto out; -+ } - -+ /* -+ * For a replace we can't just do the insert blindly. -+ * Do a lookup first (read-only btrfs_search_slot), and return if xattr -+ * doesn't exist. If it exists, fall down below to the insert/replace -+ * path - we can't race with a concurrent xattr delete, because the VFS -+ * locks the inode's i_mutex before calling setxattr or removexattr. -+ */ - if (flags & XATTR_REPLACE) { -- di = btrfs_lookup_xattr(trans, root, path, btrfs_ino(inode), name, -- name_len, -1); -- if (IS_ERR(di)) { -- ret = PTR_ERR(di); -- goto out; -- } else if (!di) { -+ ASSERT(mutex_is_locked(&inode->i_mutex)); -+ di = btrfs_lookup_xattr(NULL, root, path, btrfs_ino(inode), -+ name, name_len, 0); -+ if (!di) { - ret = -ENODATA; - goto out; - } -- ret = btrfs_delete_one_dir_name(trans, root, path, di); -- if (ret) -- goto out; - btrfs_release_path(path); -+ di = NULL; -+ } - -+ ret = btrfs_insert_xattr_item(trans, root, path, btrfs_ino(inode), -+ name, name_len, value, size); -+ if (ret == -EOVERFLOW) { - /* -- * remove the attribute -+ * We have an existing item in a leaf, split_leaf couldn't -+ * expand it. That item might have or not a dir_item that -+ * matches our target xattr, so lets check. - */ -- if (!value) -- goto out; -- } else { -- di = btrfs_lookup_xattr(NULL, root, path, btrfs_ino(inode), -- name, name_len, 0); -- if (IS_ERR(di)) { -- ret = PTR_ERR(di); -+ ret = 0; -+ btrfs_assert_tree_locked(path->nodes[0]); -+ di = btrfs_match_dir_item_name(root, path, name, name_len); -+ if (!di && !(flags & XATTR_REPLACE)) { -+ ret = -ENOSPC; - goto out; - } -- if (!di && !value) -- goto out; -- btrfs_release_path(path); -+ } else if (ret == -EEXIST) { -+ ret = 0; -+ di = btrfs_match_dir_item_name(root, path, name, name_len); -+ ASSERT(di); /* logic error */ -+ } else if (ret) { -+ goto out; - } - --again: -- ret = btrfs_insert_xattr_item(trans, root, path, btrfs_ino(inode), -- name, name_len, value, size); -- /* -- * If we're setting an xattr to a new value but the new value is say -- * exactly BTRFS_MAX_XATTR_SIZE, we could end up with EOVERFLOW getting -- * back from split_leaf. This is because it thinks we'll be extending -- * the existing item size, but we're asking for enough space to add the -- * item itself. So if we get EOVERFLOW just set ret to EEXIST and let -- * the rest of the function figure it out. -- */ -- if (ret == -EOVERFLOW) -+ if (di && (flags & XATTR_CREATE)) { - ret = -EEXIST; -+ goto out; -+ } - -- if (ret == -EEXIST) { -- if (flags & XATTR_CREATE) -- goto out; -+ if (di) { - /* -- * We can't use the path we already have since we won't have the -- * proper locking for a delete, so release the path and -- * re-lookup to delete the thing. -+ * We're doing a replace, and it must be atomic, that is, at -+ * any point in time we have either the old or the new xattr -+ * value in the tree. We don't want readers (getxattr and -+ * listxattrs) to miss a value, this is specially important -+ * for ACLs. - */ -- btrfs_release_path(path); -- di = btrfs_lookup_xattr(trans, root, path, btrfs_ino(inode), -- name, name_len, -1); -- if (IS_ERR(di)) { -- ret = PTR_ERR(di); -- goto out; -- } else if (!di) { -- /* Shouldn't happen but just in case... */ -- btrfs_release_path(path); -- goto again; -+ const int slot = path->slots[0]; -+ struct extent_buffer *leaf = path->nodes[0]; -+ const u16 old_data_len = btrfs_dir_data_len(leaf, di); -+ const u32 item_size = btrfs_item_size_nr(leaf, slot); -+ const u32 data_size = sizeof(*di) + name_len + size; -+ struct btrfs_item *item; -+ unsigned long data_ptr; -+ char *ptr; -+ -+ if (size > old_data_len) { -+ if (btrfs_leaf_free_space(root, leaf) < -+ (size - old_data_len)) { -+ ret = -ENOSPC; -+ goto out; -+ } - } - -- ret = btrfs_delete_one_dir_name(trans, root, path, di); -- if (ret) -- goto out; -+ if (old_data_len + name_len + sizeof(*di) == item_size) { -+ /* No other xattrs packed in the same leaf item. */ -+ if (size > old_data_len) -+ btrfs_extend_item(root, path, -+ size - old_data_len); -+ else if (size < old_data_len) -+ btrfs_truncate_item(root, path, data_size, 1); -+ } else { -+ /* There are other xattrs packed in the same item. */ -+ ret = btrfs_delete_one_dir_name(trans, root, path, di); -+ if (ret) -+ goto out; -+ btrfs_extend_item(root, path, data_size); -+ } - -+ item = btrfs_item_nr(slot); -+ ptr = btrfs_item_ptr(leaf, slot, char); -+ ptr += btrfs_item_size(leaf, item) - data_size; -+ di = (struct btrfs_dir_item *)ptr; -+ btrfs_set_dir_data_len(leaf, di, size); -+ data_ptr = ((unsigned long)(di + 1)) + name_len; -+ write_extent_buffer(leaf, value, data_ptr, size); -+ btrfs_mark_buffer_dirty(leaf); -+ } else { - /* -- * We have a value to set, so go back and try to insert it now. -+ * Insert, and we had space for the xattr, so path->slots[0] is -+ * where our xattr dir_item is and btrfs_insert_xattr_item() -+ * filled it. - */ -- if (value) { -- btrfs_release_path(path); -- goto again; -- } - } - out: - btrfs_free_path(path); -diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c -index 7fe30f655aa5..35f54bc96519 100644 ---- a/fs/ocfs2/file.c -+++ b/fs/ocfs2/file.c -@@ -2478,9 +2478,7 @@ static ssize_t ocfs2_file_splice_write(struct pipe_inode_info *pipe, - struct address_space *mapping = out->f_mapping; - struct inode *inode = mapping->host; - struct splice_desc sd = { -- .total_len = len, - .flags = flags, -- .pos = *ppos, - .u.file = out, - }; - -@@ -2490,6 +2488,12 @@ static ssize_t ocfs2_file_splice_write(struct pipe_inode_info *pipe, - out->f_path.dentry->d_name.len, - out->f_path.dentry->d_name.name, len); - -+ ret = generic_write_checks(out, ppos, &len, 0); -+ if (ret) -+ return ret; -+ sd.total_len = len; -+ sd.pos = *ppos; -+ - pipe_lock(pipe); - - splice_from_pipe_begin(&sd); -diff --git a/fs/splice.c b/fs/splice.c -index 12028fa41def..f345d53f94da 100644 ---- a/fs/splice.c -+++ b/fs/splice.c -@@ -1012,13 +1012,17 @@ generic_file_splice_write(struct pipe_inode_info *pipe, struct file *out, - struct address_space *mapping = out->f_mapping; - struct inode *inode = mapping->host; - struct splice_desc sd = { -- .total_len = len, - .flags = flags, -- .pos = *ppos, - .u.file = out, - }; - ssize_t ret; - -+ ret = generic_write_checks(out, ppos, &len, S_ISBLK(inode->i_mode)); -+ if (ret) -+ return ret; -+ sd.total_len = len; -+ sd.pos = *ppos; -+ - pipe_lock(pipe); - - splice_from_pipe_begin(&sd); -diff --git a/include/linux/mbus.h b/include/linux/mbus.h -index 345b8c53b897..550c88fb0267 100644 ---- a/include/linux/mbus.h -+++ b/include/linux/mbus.h -@@ -73,6 +73,6 @@ int mvebu_mbus_del_window(phys_addr_t base, size_t size); - int mvebu_mbus_init(const char *soc, phys_addr_t mbus_phys_base, - size_t mbus_size, phys_addr_t sdram_phys_base, - size_t sdram_size); --int mvebu_mbus_dt_init(void); -+int mvebu_mbus_dt_init(bool is_coherent); - - #endif /* __LINUX_MBUS_H */ -diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c -index c68e5e0628df..99de2409f731 100644 ---- a/net/netfilter/nf_tables_api.c -+++ b/net/netfilter/nf_tables_api.c -@@ -855,7 +855,10 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb, - - if (nla[NFTA_CHAIN_POLICY]) { - if ((chain != NULL && -- !(chain->flags & NFT_BASE_CHAIN)) || -+ !(chain->flags & NFT_BASE_CHAIN))) -+ return -EOPNOTSUPP; -+ -+ if (chain == NULL && - nla[NFTA_CHAIN_HOOK] == NULL) - return -EOPNOTSUPP; - -diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c -index 9e287cb56a04..54330fb5efaf 100644 ---- a/net/netfilter/nfnetlink_cthelper.c -+++ b/net/netfilter/nfnetlink_cthelper.c -@@ -77,6 +77,9 @@ nfnl_cthelper_parse_tuple(struct nf_conntrack_tuple *tuple, - if (!tb[NFCTH_TUPLE_L3PROTONUM] || !tb[NFCTH_TUPLE_L4PROTONUM]) - return -EINVAL; - -+ /* Not all fields are initialized so first zero the tuple */ -+ memset(tuple, 0, sizeof(struct nf_conntrack_tuple)); -+ - tuple->src.l3num = ntohs(nla_get_be16(tb[NFCTH_TUPLE_L3PROTONUM])); - tuple->dst.protonum = nla_get_u8(tb[NFCTH_TUPLE_L4PROTONUM]); - -@@ -86,7 +89,7 @@ nfnl_cthelper_parse_tuple(struct nf_conntrack_tuple *tuple, - static int - nfnl_cthelper_from_nlattr(struct nlattr *attr, struct nf_conn *ct) - { -- const struct nf_conn_help *help = nfct_help(ct); -+ struct nf_conn_help *help = nfct_help(ct); - - if (attr == NULL) - return -EINVAL; -@@ -94,7 +97,7 @@ nfnl_cthelper_from_nlattr(struct nlattr *attr, struct nf_conn *ct) - if (help->helper->data_len == 0) - return -EINVAL; - -- memcpy(&help->data, nla_data(attr), help->helper->data_len); -+ memcpy(help->data, nla_data(attr), help->helper->data_len); - return 0; - } - -diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c -index 7350723aeb15..969589590814 100644 ---- a/net/netfilter/nft_compat.c -+++ b/net/netfilter/nft_compat.c -@@ -82,6 +82,9 @@ nft_target_set_tgchk_param(struct xt_tgchk_param *par, - entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0; - break; - case AF_INET6: -+ if (proto) -+ entry->e6.ipv6.flags |= IP6T_F_PROTO; -+ - entry->e6.ipv6.proto = proto; - entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0; - break; -@@ -313,6 +316,9 @@ nft_match_set_mtchk_param(struct xt_mtchk_param *par, const struct nft_ctx *ctx, - entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0; - break; - case AF_INET6: -+ if (proto) -+ entry->e6.ipv6.flags |= IP6T_F_PROTO; -+ - entry->e6.ipv6.proto = proto; - entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0; - break; diff --git a/patch/kernel/odroidc2-default/patch-3.14.47-48.patch b/patch/kernel/odroidc2-default/patch-3.14.47-48.patch deleted file mode 100644 index 75b57f3192..0000000000 --- a/patch/kernel/odroidc2-default/patch-3.14.47-48.patch +++ /dev/null @@ -1,984 +0,0 @@ -diff --git a/Makefile b/Makefile -index f9041e6d4d19..25393e89051c 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 3 - PATCHLEVEL = 14 --SUBLEVEL = 47 -+SUBLEVEL = 48 - EXTRAVERSION = - NAME = Remembering Coco - -diff --git a/arch/arm/include/asm/kvm_mmu.h b/arch/arm/include/asm/kvm_mmu.h -index 9f7923193cda..7d35af3f3752 100644 ---- a/arch/arm/include/asm/kvm_mmu.h -+++ b/arch/arm/include/asm/kvm_mmu.h -@@ -117,13 +117,14 @@ static inline void kvm_set_s2pmd_writable(pmd_t *pmd) - (__boundary - 1 < (end) - 1)? __boundary: (end); \ - }) - -+#define kvm_pgd_index(addr) pgd_index(addr) -+ - static inline bool kvm_page_empty(void *ptr) - { - struct page *ptr_page = virt_to_page(ptr); - return page_count(ptr_page) == 1; - } - -- - #define kvm_pte_table_empty(ptep) kvm_page_empty(ptep) - #define kvm_pmd_table_empty(pmdp) kvm_page_empty(pmdp) - #define kvm_pud_table_empty(pudp) (0) -diff --git a/arch/arm/kvm/arm.c b/arch/arm/kvm/arm.c -index 2e74a617147d..f6a52a2a3724 100644 ---- a/arch/arm/kvm/arm.c -+++ b/arch/arm/kvm/arm.c -@@ -441,6 +441,7 @@ static void update_vttbr(struct kvm *kvm) - - static int kvm_vcpu_first_run_init(struct kvm_vcpu *vcpu) - { -+ struct kvm *kvm = vcpu->kvm; - int ret; - - if (likely(vcpu->arch.has_run_once)) -@@ -452,12 +453,20 @@ static int kvm_vcpu_first_run_init(struct kvm_vcpu *vcpu) - * Initialize the VGIC before running a vcpu the first time on - * this VM. - */ -- if (unlikely(!vgic_initialized(vcpu->kvm))) { -- ret = kvm_vgic_init(vcpu->kvm); -+ if (unlikely(!vgic_initialized(kvm))) { -+ ret = kvm_vgic_init(kvm); - if (ret) - return ret; - } - -+ /* -+ * Enable the arch timers only if we have an in-kernel VGIC -+ * and it has been properly initialized, since we cannot handle -+ * interrupts from the virtual timer with a userspace gic. -+ */ -+ if (irqchip_in_kernel(kvm) && vgic_initialized(kvm)) -+ kvm_timer_enable(kvm); -+ - return 0; - } - -diff --git a/arch/arm/kvm/interrupts.S b/arch/arm/kvm/interrupts.S -index 0d68d4073068..a1467e7689f5 100644 ---- a/arch/arm/kvm/interrupts.S -+++ b/arch/arm/kvm/interrupts.S -@@ -159,13 +159,9 @@ __kvm_vcpu_return: - @ Don't trap coprocessor accesses for host kernel - set_hstr vmexit - set_hdcr vmexit -- set_hcptr vmexit, (HCPTR_TTA | HCPTR_TCP(10) | HCPTR_TCP(11)) -+ set_hcptr vmexit, (HCPTR_TTA | HCPTR_TCP(10) | HCPTR_TCP(11)), after_vfp_restore - - #ifdef CONFIG_VFPv3 -- @ Save floating point registers we if let guest use them. -- tst r2, #(HCPTR_TCP(10) | HCPTR_TCP(11)) -- bne after_vfp_restore -- - @ Switch VFP/NEON hardware state to the host's - add r7, vcpu, #VCPU_VFP_GUEST - store_vfp_state r7 -@@ -177,6 +173,8 @@ after_vfp_restore: - @ Restore FPEXC_EN which we clobbered on entry - pop {r2} - VFPFMXR FPEXC, r2 -+#else -+after_vfp_restore: - #endif - - @ Reset Hyp-role -@@ -467,7 +465,7 @@ switch_to_guest_vfp: - push {r3-r7} - - @ NEON/VFP used. Turn on VFP access. -- set_hcptr vmexit, (HCPTR_TCP(10) | HCPTR_TCP(11)) -+ set_hcptr vmtrap, (HCPTR_TCP(10) | HCPTR_TCP(11)) - - @ Switch VFP/NEON hardware state to the guest's - add r7, r0, #VCPU_VFP_HOST -diff --git a/arch/arm/kvm/interrupts_head.S b/arch/arm/kvm/interrupts_head.S -index 76af93025574..2973b2d342fa 100644 ---- a/arch/arm/kvm/interrupts_head.S -+++ b/arch/arm/kvm/interrupts_head.S -@@ -578,8 +578,13 @@ vcpu .req r0 @ vcpu pointer always in r0 - .endm - - /* Configures the HCPTR (Hyp Coprocessor Trap Register) on entry/return -- * (hardware reset value is 0). Keep previous value in r2. */ --.macro set_hcptr operation, mask -+ * (hardware reset value is 0). Keep previous value in r2. -+ * An ISB is emited on vmexit/vmtrap, but executed on vmexit only if -+ * VFP wasn't already enabled (always executed on vmtrap). -+ * If a label is specified with vmexit, it is branched to if VFP wasn't -+ * enabled. -+ */ -+.macro set_hcptr operation, mask, label = none - mrc p15, 4, r2, c1, c1, 2 - ldr r3, =\mask - .if \operation == vmentry -@@ -588,6 +593,17 @@ vcpu .req r0 @ vcpu pointer always in r0 - bic r3, r2, r3 @ Don't trap defined coproc-accesses - .endif - mcr p15, 4, r3, c1, c1, 2 -+ .if \operation != vmentry -+ .if \operation == vmexit -+ tst r2, #(HCPTR_TCP(10) | HCPTR_TCP(11)) -+ beq 1f -+ .endif -+ isb -+ .if \label != none -+ b \label -+ .endif -+1: -+ .endif - .endm - - /* Configures the HDCR (Hyp Debug Configuration Register) on entry/return -diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c -index 524b4b57f650..c612e37166ad 100644 ---- a/arch/arm/kvm/mmu.c -+++ b/arch/arm/kvm/mmu.c -@@ -194,7 +194,7 @@ static void unmap_range(struct kvm *kvm, pgd_t *pgdp, - phys_addr_t addr = start, end = start + size; - phys_addr_t next; - -- pgd = pgdp + pgd_index(addr); -+ pgd = pgdp + kvm_pgd_index(addr); - do { - next = kvm_pgd_addr_end(addr, end); - if (!pgd_none(*pgd)) -@@ -264,7 +264,7 @@ static void stage2_flush_memslot(struct kvm *kvm, - phys_addr_t next; - pgd_t *pgd; - -- pgd = kvm->arch.pgd + pgd_index(addr); -+ pgd = kvm->arch.pgd + kvm_pgd_index(addr); - do { - next = kvm_pgd_addr_end(addr, end); - stage2_flush_puds(kvm, pgd, addr, next); -@@ -649,7 +649,7 @@ static pmd_t *stage2_get_pmd(struct kvm *kvm, struct kvm_mmu_memory_cache *cache - pud_t *pud; - pmd_t *pmd; - -- pgd = kvm->arch.pgd + pgd_index(addr); -+ pgd = kvm->arch.pgd + kvm_pgd_index(addr); - pud = pud_offset(pgd, addr); - if (pud_none(*pud)) { - if (!cache) -diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h -index 681cb9080100..91f33c2051f2 100644 ---- a/arch/arm64/include/asm/kvm_emulate.h -+++ b/arch/arm64/include/asm/kvm_emulate.h -@@ -41,6 +41,8 @@ void kvm_inject_pabt(struct kvm_vcpu *vcpu, unsigned long addr); - static inline void vcpu_reset_hcr(struct kvm_vcpu *vcpu) - { - vcpu->arch.hcr_el2 = HCR_GUEST_FLAGS; -+ if (test_bit(KVM_ARM_VCPU_EL1_32BIT, vcpu->arch.features)) -+ vcpu->arch.hcr_el2 &= ~HCR_RW; - } - - static inline unsigned long *vcpu_pc(const struct kvm_vcpu *vcpu) -diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_mmu.h -index 0d51874c838f..15a8a861264a 100644 ---- a/arch/arm64/include/asm/kvm_mmu.h -+++ b/arch/arm64/include/asm/kvm_mmu.h -@@ -69,6 +69,8 @@ - #define PTRS_PER_S2_PGD (1 << (KVM_PHYS_SHIFT - PGDIR_SHIFT)) - #define S2_PGD_ORDER get_order(PTRS_PER_S2_PGD * sizeof(pgd_t)) - -+#define kvm_pgd_index(addr) (((addr) >> PGDIR_SHIFT) & (PTRS_PER_S2_PGD - 1)) -+ - int create_hyp_mappings(void *from, void *to); - int create_hyp_io_mappings(void *from, void *to, phys_addr_t); - void free_boot_hyp_pgd(void); -diff --git a/arch/arm64/kvm/hyp.S b/arch/arm64/kvm/hyp.S -index 5dfc8331c385..3aaf3bc4ad8a 100644 ---- a/arch/arm64/kvm/hyp.S -+++ b/arch/arm64/kvm/hyp.S -@@ -629,6 +629,7 @@ ENTRY(__kvm_tlb_flush_vmid_ipa) - * Instead, we invalidate Stage-2 for this IPA, and the - * whole of Stage-1. Weep... - */ -+ lsr x1, x1, #12 - tlbi ipas2e1is, x1 - /* - * We have to ensure completion of the invalidation at Stage-2, -diff --git a/arch/arm64/kvm/reset.c b/arch/arm64/kvm/reset.c -index 70a7816535cd..0b4326578985 100644 ---- a/arch/arm64/kvm/reset.c -+++ b/arch/arm64/kvm/reset.c -@@ -90,7 +90,6 @@ int kvm_reset_vcpu(struct kvm_vcpu *vcpu) - if (!cpu_has_32bit_el1()) - return -EINVAL; - cpu_reset = &default_regs_reset32; -- vcpu->arch.hcr_el2 &= ~HCR_RW; - } else { - cpu_reset = &default_regs_reset; - } -diff --git a/arch/mips/include/asm/mach-generic/spaces.h b/arch/mips/include/asm/mach-generic/spaces.h -index 9488fa5f8866..afc96ecb9004 100644 ---- a/arch/mips/include/asm/mach-generic/spaces.h -+++ b/arch/mips/include/asm/mach-generic/spaces.h -@@ -94,7 +94,11 @@ - #endif - - #ifndef FIXADDR_TOP -+#ifdef CONFIG_KVM_GUEST -+#define FIXADDR_TOP ((unsigned long)(long)(int)0x7ffe0000) -+#else - #define FIXADDR_TOP ((unsigned long)(long)(int)0xfffe0000) - #endif -+#endif - - #endif /* __ASM_MACH_GENERIC_SPACES_H */ -diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c -index 38265dc85318..65dfbd0c196d 100644 ---- a/arch/powerpc/perf/core-book3s.c -+++ b/arch/powerpc/perf/core-book3s.c -@@ -124,7 +124,16 @@ static inline void power_pmu_bhrb_read(struct cpu_hw_events *cpuhw) {} - - static bool regs_use_siar(struct pt_regs *regs) - { -- return !!regs->result; -+ /* -+ * When we take a performance monitor exception the regs are setup -+ * using perf_read_regs() which overloads some fields, in particular -+ * regs->result to tell us whether to use SIAR. -+ * -+ * However if the regs are from another exception, eg. a syscall, then -+ * they have not been setup using perf_read_regs() and so regs->result -+ * is something random. -+ */ -+ return ((TRAP(regs) == 0xf00) && regs->result); - } - - /* -diff --git a/arch/sparc/kernel/ldc.c b/arch/sparc/kernel/ldc.c -index 27bb55485472..7ef28625c199 100644 ---- a/arch/sparc/kernel/ldc.c -+++ b/arch/sparc/kernel/ldc.c -@@ -2307,7 +2307,7 @@ void *ldc_alloc_exp_dring(struct ldc_channel *lp, unsigned int len, - if (len & (8UL - 1)) - return ERR_PTR(-EINVAL); - -- buf = kzalloc(len, GFP_KERNEL); -+ buf = kzalloc(len, GFP_ATOMIC); - if (!buf) - return ERR_PTR(-ENOMEM); - -diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig -index 5dab54accc56..96e743ac28f3 100644 ---- a/arch/x86/Kconfig -+++ b/arch/x86/Kconfig -@@ -2440,9 +2440,19 @@ config X86_DMA_REMAP - depends on STA2X11 - - config IOSF_MBI -- tristate -- default m -+ tristate "Intel System On Chip IOSF Sideband support" - depends on PCI -+ ---help--- -+ Enables sideband access to mailbox registers on SoC's. The sideband is -+ available on the following platforms. This list is not meant to be -+ exclusive. -+ - BayTrail -+ - Cherryview -+ - Braswell -+ - Quark -+ -+ You should say Y if you are running a kernel on one of these -+ platforms. - - source "net/Kconfig" - -diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h -index e9dc02968cf8..ac03bd7c8978 100644 ---- a/arch/x86/include/asm/kvm_host.h -+++ b/arch/x86/include/asm/kvm_host.h -@@ -571,7 +571,7 @@ struct kvm_arch { - struct kvm_pic *vpic; - struct kvm_ioapic *vioapic; - struct kvm_pit *vpit; -- int vapics_in_nmi_mode; -+ atomic_t vapics_in_nmi_mode; - struct mutex apic_map_lock; - struct kvm_apic_map *apic_map; - -diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c -index 298781d4cfb4..1406ffde3e35 100644 ---- a/arch/x86/kvm/i8254.c -+++ b/arch/x86/kvm/i8254.c -@@ -305,7 +305,7 @@ static void pit_do_work(struct kthread_work *work) - * LVT0 to NMI delivery. Other PIC interrupts are just sent to - * VCPU0, and only if its LVT0 is in EXTINT mode. - */ -- if (kvm->arch.vapics_in_nmi_mode > 0) -+ if (atomic_read(&kvm->arch.vapics_in_nmi_mode) > 0) - kvm_for_each_vcpu(i, vcpu, kvm) - kvm_apic_nmi_wd_deliver(vcpu); - } -diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c -index 453e5fbbb7ae..6456734a4ca6 100644 ---- a/arch/x86/kvm/lapic.c -+++ b/arch/x86/kvm/lapic.c -@@ -1109,10 +1109,10 @@ static void apic_manage_nmi_watchdog(struct kvm_lapic *apic, u32 lvt0_val) - if (!nmi_wd_enabled) { - apic_debug("Receive NMI setting on APIC_LVT0 " - "for cpu %d\n", apic->vcpu->vcpu_id); -- apic->vcpu->kvm->arch.vapics_in_nmi_mode++; -+ atomic_inc(&apic->vcpu->kvm->arch.vapics_in_nmi_mode); - } - } else if (nmi_wd_enabled) -- apic->vcpu->kvm->arch.vapics_in_nmi_mode--; -+ atomic_dec(&apic->vcpu->kvm->arch.vapics_in_nmi_mode); - } - - static int apic_reg_write(struct kvm_lapic *apic, u32 reg, u32 val) -diff --git a/arch/x86/pci/acpi.c b/arch/x86/pci/acpi.c -index 4f25ec077552..bf001382d170 100644 ---- a/arch/x86/pci/acpi.c -+++ b/arch/x86/pci/acpi.c -@@ -84,6 +84,17 @@ static const struct dmi_system_id pci_crs_quirks[] __initconst = { - DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies, LTD"), - }, - }, -+ /* https://bugs.launchpad.net/ubuntu/+source/alsa-driver/+bug/931368 */ -+ /* https://bugs.launchpad.net/ubuntu/+source/alsa-driver/+bug/1033299 */ -+ { -+ .callback = set_use_crs, -+ .ident = "Foxconn K8M890-8237A", -+ .matches = { -+ DMI_MATCH(DMI_BOARD_VENDOR, "Foxconn"), -+ DMI_MATCH(DMI_BOARD_NAME, "K8M890-8237A"), -+ DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies, LTD"), -+ }, -+ }, - - /* Now for the blacklist.. */ - -@@ -124,8 +135,10 @@ void __init pci_acpi_crs_quirks(void) - { - int year; - -- if (dmi_get_date(DMI_BIOS_DATE, &year, NULL, NULL) && year < 2008) -- pci_use_crs = false; -+ if (dmi_get_date(DMI_BIOS_DATE, &year, NULL, NULL) && year < 2008) { -+ if (iomem_resource.end <= 0xffffffff) -+ pci_use_crs = false; -+ } - - dmi_check_system(pci_crs_quirks); - -diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c -index 533a509439ca..fbc693b7d24f 100644 ---- a/drivers/cpufreq/intel_pstate.c -+++ b/drivers/cpufreq/intel_pstate.c -@@ -417,7 +417,7 @@ static void byt_set_pstate(struct cpudata *cpudata, int pstate) - - val |= vid; - -- wrmsrl(MSR_IA32_PERF_CTL, val); -+ wrmsrl_on_cpu(cpudata->cpu, MSR_IA32_PERF_CTL, val); - } - - #define BYT_BCLK_FREQS 5 -diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c -index 5967667e1a8f..1f354879bd06 100644 ---- a/drivers/crypto/talitos.c -+++ b/drivers/crypto/talitos.c -@@ -927,7 +927,8 @@ static int sg_to_link_tbl(struct scatterlist *sg, int sg_count, - sg_count--; - link_tbl_ptr--; - } -- be16_add_cpu(&link_tbl_ptr->len, cryptlen); -+ link_tbl_ptr->len = cpu_to_be16(be16_to_cpu(link_tbl_ptr->len) -+ + cryptlen); - - /* tag end of link table */ - link_tbl_ptr->j_extent = DESC_PTR_LNKTBL_RETURN; -@@ -2563,6 +2564,7 @@ static struct talitos_crypto_alg *talitos_alg_alloc(struct device *dev, - break; - default: - dev_err(dev, "unknown algorithm type %d\n", t_alg->algt.type); -+ kfree(t_alg); - return ERR_PTR(-EINVAL); - } - -diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c -index 9cbef59d404a..935974090aa0 100644 ---- a/drivers/iommu/amd_iommu.c -+++ b/drivers/iommu/amd_iommu.c -@@ -1922,9 +1922,15 @@ static void free_pt_##LVL (unsigned long __pt) \ - pt = (u64 *)__pt; \ - \ - for (i = 0; i < 512; ++i) { \ -+ /* PTE present? */ \ - if (!IOMMU_PTE_PRESENT(pt[i])) \ - continue; \ - \ -+ /* Large PTE? */ \ -+ if (PM_PTE_LEVEL(pt[i]) == 0 || \ -+ PM_PTE_LEVEL(pt[i]) == 7) \ -+ continue; \ -+ \ - p = (unsigned long)IOMMU_PTE_PAGE(pt[i]); \ - FN(p); \ - } \ -diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c -index 25f74191a788..62c3fb91e76f 100644 ---- a/drivers/net/phy/phy_device.c -+++ b/drivers/net/phy/phy_device.c -@@ -765,10 +765,11 @@ static int genphy_config_advert(struct phy_device *phydev) - if (phydev->supported & (SUPPORTED_1000baseT_Half | - SUPPORTED_1000baseT_Full)) { - adv |= ethtool_adv_to_mii_ctrl1000_t(advertise); -- if (adv != oldadv) -- changed = 1; - } - -+ if (adv != oldadv) -+ changed = 1; -+ - err = phy_write(phydev, MII_CTRL1000, adv); - if (err < 0) - return err; -diff --git a/fs/dcache.c b/fs/dcache.c -index 1d7e8a3fb6cd..aa24f7de1b92 100644 ---- a/fs/dcache.c -+++ b/fs/dcache.c -@@ -2905,17 +2905,6 @@ restart: - vfsmnt = &mnt->mnt; - continue; - } -- /* -- * Filesystems needing to implement special "root names" -- * should do so with ->d_dname() -- */ -- if (IS_ROOT(dentry) && -- (dentry->d_name.len != 1 || -- dentry->d_name.name[0] != '/')) { -- WARN(1, "Root dentry has weird name <%.*s>\n", -- (int) dentry->d_name.len, -- dentry->d_name.name); -- } - if (!error) - error = is_mounted(vfsmnt) ? 1 : 2; - break; -diff --git a/fs/inode.c b/fs/inode.c -index e846a32e8d6e..644875bcc846 100644 ---- a/fs/inode.c -+++ b/fs/inode.c -@@ -1631,8 +1631,8 @@ int file_remove_suid(struct file *file) - error = security_inode_killpriv(dentry); - if (!error && killsuid) - error = __remove_suid(dentry, killsuid); -- if (!error && (inode->i_sb->s_flags & MS_NOSEC)) -- inode->i_flags |= S_NOSEC; -+ if (!error) -+ inode_has_no_xattr(inode); - - return error; - } -diff --git a/fs/namespace.c b/fs/namespace.c -index 2faa7eacb62b..fc99d185a477 100644 ---- a/fs/namespace.c -+++ b/fs/namespace.c -@@ -3031,11 +3031,15 @@ bool fs_fully_visible(struct file_system_type *type) - if (mnt->mnt.mnt_root != mnt->mnt.mnt_sb->s_root) - continue; - -- /* This mount is not fully visible if there are any child mounts -- * that cover anything except for empty directories. -+ /* This mount is not fully visible if there are any -+ * locked child mounts that cover anything except for -+ * empty directories. - */ - list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) { - struct inode *inode = child->mnt_mountpoint->d_inode; -+ /* Only worry about locked mounts */ -+ if (!(mnt->mnt.mnt_flags & MNT_LOCKED)) -+ continue; - if (!S_ISDIR(inode->i_mode)) - goto next; - if (inode->i_nlink > 2) -diff --git a/include/kvm/arm_arch_timer.h b/include/kvm/arm_arch_timer.h -index 6d9aeddc09bf..327b155e7cc9 100644 ---- a/include/kvm/arm_arch_timer.h -+++ b/include/kvm/arm_arch_timer.h -@@ -60,7 +60,8 @@ struct arch_timer_cpu { - - #ifdef CONFIG_KVM_ARM_TIMER - int kvm_timer_hyp_init(void); --int kvm_timer_init(struct kvm *kvm); -+void kvm_timer_enable(struct kvm *kvm); -+void kvm_timer_init(struct kvm *kvm); - void kvm_timer_vcpu_reset(struct kvm_vcpu *vcpu, - const struct kvm_irq_level *irq); - void kvm_timer_vcpu_init(struct kvm_vcpu *vcpu); -@@ -73,11 +74,8 @@ static inline int kvm_timer_hyp_init(void) - return 0; - }; - --static inline int kvm_timer_init(struct kvm *kvm) --{ -- return 0; --} -- -+static inline void kvm_timer_enable(struct kvm *kvm) {} -+static inline void kvm_timer_init(struct kvm *kvm) {} - static inline void kvm_timer_vcpu_reset(struct kvm_vcpu *vcpu, - const struct kvm_irq_level *irq) {} - static inline void kvm_timer_vcpu_init(struct kvm_vcpu *vcpu) {} -diff --git a/include/net/netns/sctp.h b/include/net/netns/sctp.h -index 3573a81815ad..8ba379f9e467 100644 ---- a/include/net/netns/sctp.h -+++ b/include/net/netns/sctp.h -@@ -31,6 +31,7 @@ struct netns_sctp { - struct list_head addr_waitq; - struct timer_list addr_wq_timer; - struct list_head auto_asconf_splist; -+ /* Lock that protects both addr_waitq and auto_asconf_splist */ - spinlock_t addr_wq_lock; - - /* Lock that protects the local_addr_list writers */ -diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h -index 0dfcc92600e8..2c2d388f884f 100644 ---- a/include/net/sctp/structs.h -+++ b/include/net/sctp/structs.h -@@ -219,6 +219,10 @@ struct sctp_sock { - atomic_t pd_mode; - /* Receive to here while partial delivery is in effect. */ - struct sk_buff_head pd_lobby; -+ -+ /* These must be the last fields, as they will skipped on copies, -+ * like on accept and peeloff operations -+ */ - struct list_head auto_asconf_list; - int do_auto_asconf; - }; -diff --git a/net/bridge/br_ioctl.c b/net/bridge/br_ioctl.c -index a9a4a1b7863d..8d423bc649b9 100644 ---- a/net/bridge/br_ioctl.c -+++ b/net/bridge/br_ioctl.c -@@ -247,9 +247,7 @@ static int old_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd) - if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN)) - return -EPERM; - -- spin_lock_bh(&br->lock); - br_stp_set_bridge_priority(br, args[1]); -- spin_unlock_bh(&br->lock); - return 0; - - case BRCTL_SET_PORT_PRIORITY: -diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c -index 11a2e6c8538f..7bbc8fe25261 100644 ---- a/net/bridge/br_multicast.c -+++ b/net/bridge/br_multicast.c -@@ -1086,6 +1086,9 @@ static void br_multicast_add_router(struct net_bridge *br, - struct net_bridge_port *p; - struct hlist_node *slot = NULL; - -+ if (!hlist_unhashed(&port->rlist)) -+ return; -+ - hlist_for_each_entry(p, &br->router_list, rlist) { - if ((unsigned long) port >= (unsigned long) p) - break; -@@ -1113,12 +1116,8 @@ static void br_multicast_mark_router(struct net_bridge *br, - if (port->multicast_router != 1) - return; - -- if (!hlist_unhashed(&port->rlist)) -- goto timer; -- - br_multicast_add_router(br, port); - --timer: - mod_timer(&port->multicast_router_timer, - now + br->multicast_querier_interval); - } -diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c -index 189ba1e7d851..9a0005aee9ad 100644 ---- a/net/bridge/br_stp_if.c -+++ b/net/bridge/br_stp_if.c -@@ -243,12 +243,13 @@ bool br_stp_recalculate_bridge_id(struct net_bridge *br) - return true; - } - --/* called under bridge lock */ -+/* Acquires and releases bridge lock */ - void br_stp_set_bridge_priority(struct net_bridge *br, u16 newprio) - { - struct net_bridge_port *p; - int wasroot; - -+ spin_lock_bh(&br->lock); - wasroot = br_is_root_bridge(br); - - list_for_each_entry(p, &br->port_list, list) { -@@ -266,6 +267,7 @@ void br_stp_set_bridge_priority(struct net_bridge *br, u16 newprio) - br_port_state_selection(br); - if (br_is_root_bridge(br) && !wasroot) - br_become_root_bridge(br); -+ spin_unlock_bh(&br->lock); - } - - /* called under bridge lock */ -diff --git a/net/core/neighbour.c b/net/core/neighbour.c -index 7d95f69635c6..0f062c671da9 100644 ---- a/net/core/neighbour.c -+++ b/net/core/neighbour.c -@@ -976,6 +976,8 @@ int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb) - rc = 0; - if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE)) - goto out_unlock_bh; -+ if (neigh->dead) -+ goto out_dead; - - if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) { - if (NEIGH_VAR(neigh->parms, MCAST_PROBES) + -@@ -1032,6 +1034,13 @@ out_unlock_bh: - write_unlock(&neigh->lock); - local_bh_enable(); - return rc; -+ -+out_dead: -+ if (neigh->nud_state & NUD_STALE) -+ goto out_unlock_bh; -+ write_unlock_bh(&neigh->lock); -+ kfree_skb(skb); -+ return 1; - } - EXPORT_SYMBOL(__neigh_event_send); - -@@ -1095,6 +1104,8 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new, - if (!(flags & NEIGH_UPDATE_F_ADMIN) && - (old & (NUD_NOARP | NUD_PERMANENT))) - goto out; -+ if (neigh->dead) -+ goto out; - - if (!(new & NUD_VALID)) { - neigh_del_timer(neigh); -@@ -1244,6 +1255,8 @@ EXPORT_SYMBOL(neigh_update); - */ - void __neigh_set_probe_once(struct neighbour *neigh) - { -+ if (neigh->dead) -+ return; - neigh->updated = jiffies; - if (!(neigh->nud_state & NUD_FAILED)) - return; -diff --git a/net/core/skbuff.c b/net/core/skbuff.c -index 69ec61abfb37..8207f8d7f665 100644 ---- a/net/core/skbuff.c -+++ b/net/core/skbuff.c -@@ -368,9 +368,11 @@ refill: - for (order = NETDEV_FRAG_PAGE_MAX_ORDER; ;) { - gfp_t gfp = gfp_mask; - -- if (order) -+ if (order) { - gfp |= __GFP_COMP | __GFP_NOWARN | - __GFP_NOMEMALLOC; -+ gfp &= ~__GFP_WAIT; -+ } - nc->frag.page = alloc_pages(gfp, order); - if (likely(nc->frag.page)) - break; -diff --git a/net/core/sock.c b/net/core/sock.c -index 650dd58ebd05..8ebfa52e5d70 100644 ---- a/net/core/sock.c -+++ b/net/core/sock.c -@@ -1914,8 +1914,10 @@ bool skb_page_frag_refill(unsigned int sz, struct page_frag *pfrag, gfp_t prio) - do { - gfp_t gfp = prio; - -- if (order) -+ if (order) { - gfp |= __GFP_COMP | __GFP_NOWARN | __GFP_NORETRY; -+ gfp &= ~__GFP_WAIT; -+ } - pfrag->page = alloc_pages(gfp, order); - if (likely(pfrag->page)) { - pfrag->offset = 0; -diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c -index 07bd8edef417..951fe55b1671 100644 ---- a/net/ipv4/af_inet.c -+++ b/net/ipv4/af_inet.c -@@ -228,6 +228,8 @@ int inet_listen(struct socket *sock, int backlog) - err = 0; - if (err) - goto out; -+ -+ tcp_fastopen_init_key_once(true); - } - err = inet_csk_listen_start(sk, backlog); - if (err) -diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c -index 29d240b87af1..dc45221dc692 100644 ---- a/net/ipv4/tcp.c -+++ b/net/ipv4/tcp.c -@@ -2684,10 +2684,13 @@ static int do_tcp_setsockopt(struct sock *sk, int level, - - case TCP_FASTOPEN: - if (val >= 0 && ((1 << sk->sk_state) & (TCPF_CLOSE | -- TCPF_LISTEN))) -+ TCPF_LISTEN))) { -+ tcp_fastopen_init_key_once(true); -+ - err = fastopen_init_queue(sk, val); -- else -+ } else { - err = -EINVAL; -+ } - break; - case TCP_TIMESTAMP: - if (!tp->repair) -diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c -index f195d9316e55..ee6518d1afe5 100644 ---- a/net/ipv4/tcp_fastopen.c -+++ b/net/ipv4/tcp_fastopen.c -@@ -84,8 +84,6 @@ void tcp_fastopen_cookie_gen(__be32 src, __be32 dst, - __be32 path[4] = { src, dst, 0, 0 }; - struct tcp_fastopen_context *ctx; - -- tcp_fastopen_init_key_once(true); -- - rcu_read_lock(); - ctx = rcu_dereference(tcp_fastopen_ctx); - if (ctx) { -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index 48b181797d7b..84a60b82e235 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -1264,16 +1264,6 @@ static void packet_sock_destruct(struct sock *sk) - sk_refcnt_debug_dec(sk); - } - --static int fanout_rr_next(struct packet_fanout *f, unsigned int num) --{ -- int x = atomic_read(&f->rr_cur) + 1; -- -- if (x >= num) -- x = 0; -- -- return x; --} -- - static unsigned int fanout_demux_hash(struct packet_fanout *f, - struct sk_buff *skb, - unsigned int num) -@@ -1285,13 +1275,9 @@ static unsigned int fanout_demux_lb(struct packet_fanout *f, - struct sk_buff *skb, - unsigned int num) - { -- int cur, old; -+ unsigned int val = atomic_inc_return(&f->rr_cur); - -- cur = atomic_read(&f->rr_cur); -- while ((old = atomic_cmpxchg(&f->rr_cur, cur, -- fanout_rr_next(f, num))) != cur) -- cur = old; -- return cur; -+ return val % num; - } - - static unsigned int fanout_demux_cpu(struct packet_fanout *f, -@@ -1345,7 +1331,7 @@ static int packet_rcv_fanout(struct sk_buff *skb, struct net_device *dev, - struct packet_type *pt, struct net_device *orig_dev) - { - struct packet_fanout *f = pt->af_packet_priv; -- unsigned int num = f->num_members; -+ unsigned int num = ACCESS_ONCE(f->num_members); - struct packet_sock *po; - unsigned int idx; - -diff --git a/net/sctp/output.c b/net/sctp/output.c -index 740ca5f7add0..e39e6d561592 100644 ---- a/net/sctp/output.c -+++ b/net/sctp/output.c -@@ -599,7 +599,9 @@ out: - return err; - no_route: - kfree_skb(nskb); -- IP_INC_STATS(sock_net(asoc->base.sk), IPSTATS_MIB_OUTNOROUTES); -+ -+ if (asoc) -+ IP_INC_STATS(sock_net(asoc->base.sk), IPSTATS_MIB_OUTNOROUTES); - - /* FIXME: Returning the 'err' will effect all the associations - * associated with a socket, although only one of the paths of the -diff --git a/net/sctp/socket.c b/net/sctp/socket.c -index 604a6acdf92e..f940fdc540f5 100644 ---- a/net/sctp/socket.c -+++ b/net/sctp/socket.c -@@ -1532,8 +1532,10 @@ static void sctp_close(struct sock *sk, long timeout) - - /* Supposedly, no process has access to the socket, but - * the net layers still may. -+ * Also, sctp_destroy_sock() needs to be called with addr_wq_lock -+ * held and that should be grabbed before socket lock. - */ -- local_bh_disable(); -+ spin_lock_bh(&net->sctp.addr_wq_lock); - bh_lock_sock(sk); - - /* Hold the sock, since sk_common_release() will put sock_put() -@@ -1543,7 +1545,7 @@ static void sctp_close(struct sock *sk, long timeout) - sk_common_release(sk); - - bh_unlock_sock(sk); -- local_bh_enable(); -+ spin_unlock_bh(&net->sctp.addr_wq_lock); - - sock_put(sk); - -@@ -3511,6 +3513,7 @@ static int sctp_setsockopt_auto_asconf(struct sock *sk, char __user *optval, - if ((val && sp->do_auto_asconf) || (!val && !sp->do_auto_asconf)) - return 0; - -+ spin_lock_bh(&sock_net(sk)->sctp.addr_wq_lock); - if (val == 0 && sp->do_auto_asconf) { - list_del(&sp->auto_asconf_list); - sp->do_auto_asconf = 0; -@@ -3519,6 +3522,7 @@ static int sctp_setsockopt_auto_asconf(struct sock *sk, char __user *optval, - &sock_net(sk)->sctp.auto_asconf_splist); - sp->do_auto_asconf = 1; - } -+ spin_unlock_bh(&sock_net(sk)->sctp.addr_wq_lock); - return 0; - } - -@@ -4009,18 +4013,28 @@ static int sctp_init_sock(struct sock *sk) - local_bh_disable(); - percpu_counter_inc(&sctp_sockets_allocated); - sock_prot_inuse_add(net, sk->sk_prot, 1); -+ -+ /* Nothing can fail after this block, otherwise -+ * sctp_destroy_sock() will be called without addr_wq_lock held -+ */ - if (net->sctp.default_auto_asconf) { -+ spin_lock(&sock_net(sk)->sctp.addr_wq_lock); - list_add_tail(&sp->auto_asconf_list, - &net->sctp.auto_asconf_splist); - sp->do_auto_asconf = 1; -- } else -+ spin_unlock(&sock_net(sk)->sctp.addr_wq_lock); -+ } else { - sp->do_auto_asconf = 0; -+ } -+ - local_bh_enable(); - - return 0; - } - --/* Cleanup any SCTP per socket resources. */ -+/* Cleanup any SCTP per socket resources. Must be called with -+ * sock_net(sk)->sctp.addr_wq_lock held if sp->do_auto_asconf is true -+ */ - static void sctp_destroy_sock(struct sock *sk) - { - struct sctp_sock *sp; -@@ -6973,6 +6987,19 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk, - newinet->mc_list = NULL; - } - -+static inline void sctp_copy_descendant(struct sock *sk_to, -+ const struct sock *sk_from) -+{ -+ int ancestor_size = sizeof(struct inet_sock) + -+ sizeof(struct sctp_sock) - -+ offsetof(struct sctp_sock, auto_asconf_list); -+ -+ if (sk_from->sk_family == PF_INET6) -+ ancestor_size += sizeof(struct ipv6_pinfo); -+ -+ __inet_sk_copy_descendant(sk_to, sk_from, ancestor_size); -+} -+ - /* Populate the fields of the newsk from the oldsk and migrate the assoc - * and its messages to the newsk. - */ -@@ -6987,7 +7014,6 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk, - struct sk_buff *skb, *tmp; - struct sctp_ulpevent *event; - struct sctp_bind_hashbucket *head; -- struct list_head tmplist; - - /* Migrate socket buffer sizes and all the socket level options to the - * new socket. -@@ -6995,12 +7021,7 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk, - newsk->sk_sndbuf = oldsk->sk_sndbuf; - newsk->sk_rcvbuf = oldsk->sk_rcvbuf; - /* Brute force copy old sctp opt. */ -- if (oldsp->do_auto_asconf) { -- memcpy(&tmplist, &newsp->auto_asconf_list, sizeof(tmplist)); -- inet_sk_copy_descendant(newsk, oldsk); -- memcpy(&newsp->auto_asconf_list, &tmplist, sizeof(tmplist)); -- } else -- inet_sk_copy_descendant(newsk, oldsk); -+ sctp_copy_descendant(newsk, oldsk); - - /* Restore the ep value that was overwritten with the above structure - * copy. -diff --git a/virt/kvm/arm/arch_timer.c b/virt/kvm/arm/arch_timer.c -index 5081e809821f..c6fe40568690 100644 ---- a/virt/kvm/arm/arch_timer.c -+++ b/virt/kvm/arm/arch_timer.c -@@ -61,12 +61,14 @@ static void timer_disarm(struct arch_timer_cpu *timer) - - static void kvm_timer_inject_irq(struct kvm_vcpu *vcpu) - { -+ int ret; - struct arch_timer_cpu *timer = &vcpu->arch.timer_cpu; - - timer->cntv_ctl |= ARCH_TIMER_CTRL_IT_MASK; -- kvm_vgic_inject_irq(vcpu->kvm, vcpu->vcpu_id, -- timer->irq->irq, -- timer->irq->level); -+ ret = kvm_vgic_inject_irq(vcpu->kvm, vcpu->vcpu_id, -+ timer->irq->irq, -+ timer->irq->level); -+ WARN_ON(ret); - } - - static irqreturn_t kvm_arch_timer_handler(int irq, void *dev_id) -@@ -307,12 +309,24 @@ void kvm_timer_vcpu_terminate(struct kvm_vcpu *vcpu) - timer_disarm(timer); - } - --int kvm_timer_init(struct kvm *kvm) -+void kvm_timer_enable(struct kvm *kvm) - { -- if (timecounter && wqueue) { -- kvm->arch.timer.cntvoff = kvm_phys_timer_read(); -+ if (kvm->arch.timer.enabled) -+ return; -+ -+ /* -+ * There is a potential race here between VCPUs starting for the first -+ * time, which may be enabling the timer multiple times. That doesn't -+ * hurt though, because we're just setting a variable to the same -+ * variable that it already was. The important thing is that all -+ * VCPUs have the enabled variable set, before entering the guest, if -+ * the arch timers are enabled. -+ */ -+ if (timecounter && wqueue) - kvm->arch.timer.enabled = 1; -- } -+} - -- return 0; -+void kvm_timer_init(struct kvm *kvm) -+{ -+ kvm->arch.timer.cntvoff = kvm_phys_timer_read(); - } diff --git a/patch/kernel/odroidc2-default/patch-3.14.48-49.patch b/patch/kernel/odroidc2-default/patch-3.14.48-49.patch deleted file mode 100644 index 0757731673..0000000000 --- a/patch/kernel/odroidc2-default/patch-3.14.48-49.patch +++ /dev/null @@ -1,4026 +0,0 @@ -diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt -index 01ef408e205f..8faff12e7014 100644 ---- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt -+++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt -@@ -91,5 +91,5 @@ mpp61 61 gpo, dev(wen1), uart1(txd), audio(rclk) - mpp62 62 gpio, dev(a2), uart1(cts), tdm(drx), pcie(clkreq0), - audio(mclk), uart0(cts) - mpp63 63 gpo, spi0(sck), tclk --mpp64 64 gpio, spi0(miso), spi0-1(cs1) --mpp65 65 gpio, spi0(mosi), spi0-1(cs2) -+mpp64 64 gpio, spi0(miso), spi0(cs1) -+mpp65 65 gpio, spi0(mosi), spi0(cs2) -diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt -index bfa0a2e5e0cb..86dec67e5450 100644 ---- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt -+++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt -@@ -41,15 +41,15 @@ mpp20 20 gpio, ge0(rxd4), ge1(rxd2), lcd(d20), ptp(clk) - mpp21 21 gpio, ge0(rxd5), ge1(rxd3), lcd(d21), mem(bat) - mpp22 22 gpio, ge0(rxd6), ge1(rxctl), lcd(d22), sata0(prsnt) - mpp23 23 gpio, ge0(rxd7), ge1(rxclk), lcd(d23), sata1(prsnt) --mpp24 24 gpio, lcd(hsync), sata1(prsnt), nf(bootcs-re), tdm(rst) --mpp25 25 gpio, lcd(vsync), sata0(prsnt), nf(bootcs-we), tdm(pclk) --mpp26 26 gpio, lcd(clk), tdm(fsync), vdd(cpu1-pd) -+mpp24 24 gpio, lcd(hsync), sata1(prsnt), tdm(rst) -+mpp25 25 gpio, lcd(vsync), sata0(prsnt), tdm(pclk) -+mpp26 26 gpio, lcd(clk), tdm(fsync) - mpp27 27 gpio, lcd(e), tdm(dtx), ptp(trig) - mpp28 28 gpio, lcd(pwm), tdm(drx), ptp(evreq) --mpp29 29 gpio, lcd(ref-clk), tdm(int0), ptp(clk), vdd(cpu0-pd) -+mpp29 29 gpio, lcd(ref-clk), tdm(int0), ptp(clk) - mpp30 30 gpio, tdm(int1), sd0(clk) --mpp31 31 gpio, tdm(int2), sd0(cmd), vdd(cpu0-pd) --mpp32 32 gpio, tdm(int3), sd0(d0), vdd(cpu1-pd) -+mpp31 31 gpio, tdm(int2), sd0(cmd) -+mpp32 32 gpio, tdm(int3), sd0(d0) - mpp33 33 gpio, tdm(int4), sd0(d1), mem(bat) - mpp34 34 gpio, tdm(int5), sd0(d2), sata0(prsnt) - mpp35 35 gpio, tdm(int6), sd0(d3), sata1(prsnt) -@@ -57,21 +57,18 @@ mpp36 36 gpio, spi(mosi) - mpp37 37 gpio, spi(miso) - mpp38 38 gpio, spi(sck) - mpp39 39 gpio, spi(cs0) --mpp40 40 gpio, spi(cs1), uart2(cts), lcd(vga-hsync), vdd(cpu1-pd), -- pcie(clkreq0) -+mpp40 40 gpio, spi(cs1), uart2(cts), lcd(vga-hsync), pcie(clkreq0) - mpp41 41 gpio, spi(cs2), uart2(rts), lcd(vga-vsync), sata1(prsnt), - pcie(clkreq1) --mpp42 42 gpio, uart2(rxd), uart0(cts), tdm(int7), tdm-1(timer), -- vdd(cpu0-pd) --mpp43 43 gpio, uart2(txd), uart0(rts), spi(cs3), pcie(rstout), -- vdd(cpu2-3-pd){1} -+mpp42 42 gpio, uart2(rxd), uart0(cts), tdm(int7), tdm-1(timer) -+mpp43 43 gpio, uart2(txd), uart0(rts), spi(cs3), pcie(rstout) - mpp44 44 gpio, uart2(cts), uart3(rxd), spi(cs4), pcie(clkreq2), - mem(bat) - mpp45 45 gpio, uart2(rts), uart3(txd), spi(cs5), sata1(prsnt) - mpp46 46 gpio, uart3(rts), uart1(rts), spi(cs6), sata0(prsnt) - mpp47 47 gpio, uart3(cts), uart1(cts), spi(cs7), pcie(clkreq3), - ref(clkout) --mpp48 48 gpio, tclk, dev(burst/last) -+mpp48 48 gpio, dev(clkout), dev(burst/last) - - * Marvell Armada XP (mv78260 and mv78460 only) - -@@ -83,9 +80,9 @@ mpp51 51 gpio, dev(ad16) - mpp52 52 gpio, dev(ad17) - mpp53 53 gpio, dev(ad18) - mpp54 54 gpio, dev(ad19) --mpp55 55 gpio, dev(ad20), vdd(cpu0-pd) --mpp56 56 gpio, dev(ad21), vdd(cpu1-pd) --mpp57 57 gpio, dev(ad22), vdd(cpu2-3-pd){1} -+mpp55 55 gpio, dev(ad20) -+mpp56 56 gpio, dev(ad21) -+mpp57 57 gpio, dev(ad22) - mpp58 58 gpio, dev(ad23) - mpp59 59 gpio, dev(ad24) - mpp60 60 gpio, dev(ad25) -@@ -95,6 +92,3 @@ mpp63 63 gpio, dev(ad28) - mpp64 64 gpio, dev(ad29) - mpp65 65 gpio, dev(ad30) - mpp66 66 gpio, dev(ad31) -- --Notes: --* {1} vdd(cpu2-3-pd) only available on mv78460. -diff --git a/Documentation/devicetree/bindings/spi/spi_pl022.txt b/Documentation/devicetree/bindings/spi/spi_pl022.txt -index 22ed6797216d..4d1673ca8cf8 100644 ---- a/Documentation/devicetree/bindings/spi/spi_pl022.txt -+++ b/Documentation/devicetree/bindings/spi/spi_pl022.txt -@@ -4,9 +4,9 @@ Required properties: - - compatible : "arm,pl022", "arm,primecell" - - reg : Offset and length of the register set for the device - - interrupts : Should contain SPI controller interrupt -+- num-cs : total number of chipselects - - Optional properties: --- num-cs : total number of chipselects - - cs-gpios : should specify GPIOs used for chipselects. - The gpios will be referred to as reg = in the SPI child nodes. - If unspecified, a single SPI device without a chip select can be used. -diff --git a/Makefile b/Makefile -index 25393e89051c..fee84602e999 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 3 - PATCHLEVEL = 14 --SUBLEVEL = 48 -+SUBLEVEL = 49 - EXTRAVERSION = - NAME = Remembering Coco - -diff --git a/arch/arc/include/asm/cmpxchg.h b/arch/arc/include/asm/cmpxchg.h -index 03cd6894855d..90de5c528da2 100644 ---- a/arch/arc/include/asm/cmpxchg.h -+++ b/arch/arc/include/asm/cmpxchg.h -@@ -25,10 +25,11 @@ __cmpxchg(volatile void *ptr, unsigned long expected, unsigned long new) - " scond %3, [%1] \n" - " bnz 1b \n" - "2: \n" -- : "=&r"(prev) -- : "r"(ptr), "ir"(expected), -- "r"(new) /* can't be "ir". scond can't take limm for "b" */ -- : "cc"); -+ : "=&r"(prev) /* Early clobber, to prevent reg reuse */ -+ : "r"(ptr), /* Not "m": llock only supports reg direct addr mode */ -+ "ir"(expected), -+ "r"(new) /* can't be "ir". scond can't take LIMM for "b" */ -+ : "cc", "memory"); /* so that gcc knows memory is being written here */ - - return prev; - } -diff --git a/arch/arm64/kernel/vdso/Makefile b/arch/arm64/kernel/vdso/Makefile -index a268a9af0c2d..a622dd0be9c4 100644 ---- a/arch/arm64/kernel/vdso/Makefile -+++ b/arch/arm64/kernel/vdso/Makefile -@@ -15,6 +15,10 @@ ccflags-y := -shared -fno-common -fno-builtin - ccflags-y += -nostdlib -Wl,-soname=linux-vdso.so.1 \ - $(call cc-ldoption, -Wl$(comma)--hash-style=sysv) - -+# Workaround for bare-metal (ELF) toolchains that neglect to pass -shared -+# down to collect2, resulting in silent corruption of the vDSO image. -+ccflags-y += -Wl,-shared -+ - obj-y += vdso.o - extra-y += vdso.lds vdso-offsets.h - CPPFLAGS_vdso.lds += -P -C -U$(ARCH) -diff --git a/arch/arm64/mm/context.c b/arch/arm64/mm/context.c -index baa758d37021..76c1e6cd36fc 100644 ---- a/arch/arm64/mm/context.c -+++ b/arch/arm64/mm/context.c -@@ -92,6 +92,14 @@ static void reset_context(void *info) - unsigned int cpu = smp_processor_id(); - struct mm_struct *mm = current->active_mm; - -+ /* -+ * current->active_mm could be init_mm for the idle thread immediately -+ * after secondary CPU boot or hotplug. TTBR0_EL1 is already set to -+ * the reserved value, so no need to reset any context. -+ */ -+ if (mm == &init_mm) -+ return; -+ - smp_rmb(); - asid = cpu_last_asid + cpu; - -diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c -index 023747bf4dd7..e3a24b75e53c 100644 ---- a/arch/arm64/mm/hugetlbpage.c -+++ b/arch/arm64/mm/hugetlbpage.c -@@ -46,13 +46,13 @@ struct page *follow_huge_addr(struct mm_struct *mm, unsigned long address, - - int pmd_huge(pmd_t pmd) - { -- return !(pmd_val(pmd) & PMD_TABLE_BIT); -+ return pmd_val(pmd) && !(pmd_val(pmd) & PMD_TABLE_BIT); - } - - int pud_huge(pud_t pud) - { - #ifndef __PAGETABLE_PMD_FOLDED -- return !(pud_val(pud) & PUD_TABLE_BIT); -+ return pud_val(pud) && !(pud_val(pud) & PUD_TABLE_BIT); - #else - return 0; - #endif -diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c -index d0b4c2efda90..aeb95a15cc9a 100644 ---- a/arch/arm64/mm/init.c -+++ b/arch/arm64/mm/init.c -@@ -243,7 +243,7 @@ static void __init free_unused_memmap(void) - * memmap entries are valid from the bank end aligned to - * MAX_ORDER_NR_PAGES. - */ -- prev_end = ALIGN(start + __phys_to_pfn(reg->size), -+ prev_end = ALIGN(__phys_to_pfn(reg->base + reg->size), - MAX_ORDER_NR_PAGES); - } - -diff --git a/arch/mips/kvm/kvm_mips_emul.c b/arch/mips/kvm/kvm_mips_emul.c -index e75ef8219caf..c76f297b7149 100644 ---- a/arch/mips/kvm/kvm_mips_emul.c -+++ b/arch/mips/kvm/kvm_mips_emul.c -@@ -1626,7 +1626,7 @@ kvm_mips_complete_mmio_load(struct kvm_vcpu *vcpu, struct kvm_run *run) - if (vcpu->mmio_needed == 2) - *gpr = *(int16_t *) run->mmio.data; - else -- *gpr = *(int16_t *) run->mmio.data; -+ *gpr = *(uint16_t *)run->mmio.data; - - break; - case 1: -diff --git a/drivers/acpi/acpica/utxfinit.c b/drivers/acpi/acpica/utxfinit.c -index 246ef68681f4..2c3c578faa0a 100644 ---- a/drivers/acpi/acpica/utxfinit.c -+++ b/drivers/acpi/acpica/utxfinit.c -@@ -175,10 +175,12 @@ acpi_status __init acpi_enable_subsystem(u32 flags) - * Obtain a permanent mapping for the FACS. This is required for the - * Global Lock and the Firmware Waking Vector - */ -- status = acpi_tb_initialize_facs(); -- if (ACPI_FAILURE(status)) { -- ACPI_WARNING((AE_INFO, "Could not map the FACS table")); -- return_ACPI_STATUS(status); -+ if (!(flags & ACPI_NO_FACS_INIT)) { -+ status = acpi_tb_initialize_facs(); -+ if (ACPI_FAILURE(status)) { -+ ACPI_WARNING((AE_INFO, "Could not map the FACS table")); -+ return_ACPI_STATUS(status); -+ } - } - #endif /* !ACPI_REDUCED_HARDWARE */ - -diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c -index b48aefab57e8..60be8d0ef100 100644 ---- a/drivers/acpi/bus.c -+++ b/drivers/acpi/bus.c -@@ -450,6 +450,16 @@ static int __init acpi_bus_init_irq(void) - u8 acpi_gbl_permanent_mmap; - - -+/** -+ * acpi_early_init - Initialize ACPICA and populate the ACPI namespace. -+ * -+ * The ACPI tables are accessible after this, but the handling of events has not -+ * been initialized and the global lock is not available yet, so AML should not -+ * be executed at this point. -+ * -+ * Doing this before switching the EFI runtime services to virtual mode allows -+ * the EfiBootServices memory to be freed slightly earlier on boot. -+ */ - void __init acpi_early_init(void) - { - acpi_status status; -@@ -510,26 +520,42 @@ void __init acpi_early_init(void) - acpi_gbl_FADT.sci_interrupt = acpi_sci_override_gsi; - } - #endif -+ return; -+ -+ error0: -+ disable_acpi(); -+} -+ -+/** -+ * acpi_subsystem_init - Finalize the early initialization of ACPI. -+ * -+ * Switch over the platform to the ACPI mode (if possible), initialize the -+ * handling of ACPI events, install the interrupt and global lock handlers. -+ * -+ * Doing this too early is generally unsafe, but at the same time it needs to be -+ * done before all things that really depend on ACPI. The right spot appears to -+ * be before finalizing the EFI initialization. -+ */ -+void __init acpi_subsystem_init(void) -+{ -+ acpi_status status; -+ -+ if (acpi_disabled) -+ return; - - status = acpi_enable_subsystem(~ACPI_NO_ACPI_ENABLE); - if (ACPI_FAILURE(status)) { - printk(KERN_ERR PREFIX "Unable to enable ACPI\n"); -- goto error0; -+ disable_acpi(); -+ } else { -+ /* -+ * If the system is using ACPI then we can be reasonably -+ * confident that any regulators are managed by the firmware -+ * so tell the regulator core it has everything it needs to -+ * know. -+ */ -+ regulator_has_full_constraints(); - } -- -- /* -- * If the system is using ACPI then we can be reasonably -- * confident that any regulators are managed by the firmware -- * so tell the regulator core it has everything it needs to -- * know. -- */ -- regulator_has_full_constraints(); -- -- return; -- -- error0: -- disable_acpi(); -- return; - } - - static int __init acpi_bus_init(void) -diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c -index b1c0fcdf46fc..b0e6691faf18 100644 ---- a/drivers/ata/libata-core.c -+++ b/drivers/ata/libata-core.c -@@ -4173,9 +4173,10 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { - { "ST3320[68]13AS", "SD1[5-9]", ATA_HORKAGE_NONCQ | - ATA_HORKAGE_FIRMWARE_WARN }, - -- /* Seagate Momentus SpinPoint M8 seem to have FPMDA_AA issues */ -+ /* drives which fail FPDMA_AA activation (some may freeze afterwards) */ - { "ST1000LM024 HN-M101MBB", "2AR10001", ATA_HORKAGE_BROKEN_FPDMA_AA }, - { "ST1000LM024 HN-M101MBB", "2BA30001", ATA_HORKAGE_BROKEN_FPDMA_AA }, -+ { "VB0250EAVER", "HPG7", ATA_HORKAGE_BROKEN_FPDMA_AA }, - - /* Blacklist entries taken from Silicon Image 3124/3132 - Windows driver .inf file - also several Linux problem reports */ -@@ -4229,6 +4230,9 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { - { "Micron_M550*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, }, - { "Crucial_CT*M550SSD*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, }, - -+ /* devices that don't properly handle TRIM commands */ -+ { "SuperSSpeed S238*", NULL, ATA_HORKAGE_NOTRIM, }, -+ - /* - * Some WD SATA-I drives spin up and down erratically when the link - * is put into the slumber mode. We don't have full list of the -@@ -4533,7 +4537,8 @@ static unsigned int ata_dev_set_xfermode(struct ata_device *dev) - else /* In the ancient relic department - skip all of this */ - return 0; - -- err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 0); -+ /* On some disks, this command causes spin-up, so we need longer timeout */ -+ err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 15000); - - DPRINTK("EXIT, err_mask=%x\n", err_mask); - return err_mask; -diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c -index ef8567de6a75..6fecf0bde105 100644 ---- a/drivers/ata/libata-scsi.c -+++ b/drivers/ata/libata-scsi.c -@@ -2510,7 +2510,8 @@ static unsigned int ata_scsiop_read_cap(struct ata_scsi_args *args, u8 *rbuf) - rbuf[14] = (lowest_aligned >> 8) & 0x3f; - rbuf[15] = lowest_aligned; - -- if (ata_id_has_trim(args->id)) { -+ if (ata_id_has_trim(args->id) && -+ !(dev->horkage & ATA_HORKAGE_NOTRIM)) { - rbuf[14] |= 0x80; /* TPE */ - - if (ata_id_has_zero_after_trim(args->id)) -diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c -index 2495ee577a64..f0c15f9c2b2f 100644 ---- a/drivers/base/firmware_class.c -+++ b/drivers/base/firmware_class.c -@@ -544,10 +544,8 @@ static void fw_dev_release(struct device *dev) - kfree(fw_priv); - } - --static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env) -+static int do_firmware_uevent(struct firmware_priv *fw_priv, struct kobj_uevent_env *env) - { -- struct firmware_priv *fw_priv = to_firmware_priv(dev); -- - if (add_uevent_var(env, "FIRMWARE=%s", fw_priv->buf->fw_id)) - return -ENOMEM; - if (add_uevent_var(env, "TIMEOUT=%i", loading_timeout)) -@@ -558,6 +556,18 @@ static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env) - return 0; - } - -+static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env) -+{ -+ struct firmware_priv *fw_priv = to_firmware_priv(dev); -+ int err = 0; -+ -+ mutex_lock(&fw_lock); -+ if (fw_priv->buf) -+ err = do_firmware_uevent(fw_priv, env); -+ mutex_unlock(&fw_lock); -+ return err; -+} -+ - static struct class firmware_class = { - .name = "firmware", - .class_attrs = firmware_class_attrs, -diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c -index 2f9a3d8ecbbf..58559d75d02c 100644 ---- a/drivers/base/regmap/regmap.c -+++ b/drivers/base/regmap/regmap.c -@@ -808,11 +808,10 @@ EXPORT_SYMBOL_GPL(devm_regmap_init); - static void regmap_field_init(struct regmap_field *rm_field, - struct regmap *regmap, struct reg_field reg_field) - { -- int field_bits = reg_field.msb - reg_field.lsb + 1; - rm_field->regmap = regmap; - rm_field->reg = reg_field.reg; - rm_field->shift = reg_field.lsb; -- rm_field->mask = ((BIT(field_bits) - 1) << reg_field.lsb); -+ rm_field->mask = GENMASK(reg_field.msb, reg_field.lsb); - rm_field->id_size = reg_field.id_size; - rm_field->id_offset = reg_field.id_offset; - } -@@ -1947,7 +1946,7 @@ int regmap_bulk_read(struct regmap *map, unsigned int reg, void *val, - &ival); - if (ret != 0) - return ret; -- memcpy(val + (i * val_bytes), &ival, val_bytes); -+ map->format.format_val(val + (i * val_bytes), ival, 0); - } - } - -diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c -index 63688d3a6ea0..12be7cbfba4f 100644 ---- a/drivers/block/rbd.c -+++ b/drivers/block/rbd.c -@@ -1826,11 +1826,11 @@ static struct rbd_obj_request *rbd_obj_request_create(const char *object_name, - rbd_assert(obj_request_type_valid(type)); - - size = strlen(object_name) + 1; -- name = kmalloc(size, GFP_KERNEL); -+ name = kmalloc(size, GFP_NOIO); - if (!name) - return NULL; - -- obj_request = kmem_cache_zalloc(rbd_obj_request_cache, GFP_KERNEL); -+ obj_request = kmem_cache_zalloc(rbd_obj_request_cache, GFP_NOIO); - if (!obj_request) { - kfree(name); - return NULL; -diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c -index c0e7a9aa97a4..c23658e42fc3 100644 ---- a/drivers/bluetooth/btusb.c -+++ b/drivers/bluetooth/btusb.c -@@ -1293,6 +1293,8 @@ static int btusb_setup_intel(struct hci_dev *hdev) - } - fw_ptr = fw->data; - -+ kfree_skb(skb); -+ - /* This Intel specific command enables the manufacturer mode of the - * controller. - * -diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c -index 5c85350f4c3d..19e301f9d549 100644 ---- a/drivers/char/agp/intel-gtt.c -+++ b/drivers/char/agp/intel-gtt.c -@@ -586,7 +586,7 @@ static inline int needs_ilk_vtd_wa(void) - /* Query intel_iommu to see if we need the workaround. Presumably that - * was loaded first. - */ -- if ((gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB || -+ if ((gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_D_IG || - gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_M_IG) && - intel_iommu_gfx_mapped) - return 1; -diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c -index 102463ba745d..643bba7d6f81 100644 ---- a/drivers/char/tpm/tpm_ibmvtpm.c -+++ b/drivers/char/tpm/tpm_ibmvtpm.c -@@ -579,6 +579,9 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev, - goto cleanup; - } - -+ ibmvtpm->dev = dev; -+ ibmvtpm->vdev = vio_dev; -+ - crq_q = &ibmvtpm->crq_queue; - crq_q->crq_addr = (struct ibmvtpm_crq *)get_zeroed_page(GFP_KERNEL); - if (!crq_q->crq_addr) { -@@ -623,8 +626,6 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev, - - crq_q->index = 0; - -- ibmvtpm->dev = dev; -- ibmvtpm->vdev = vio_dev; - TPM_VPRIV(chip) = (void *)ibmvtpm; - - spin_lock_init(&ibmvtpm->rtce_lock); -diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c -index 831b48287a22..ddd03f8037a7 100644 ---- a/drivers/clocksource/exynos_mct.c -+++ b/drivers/clocksource/exynos_mct.c -@@ -422,15 +422,12 @@ static int exynos4_local_timer_setup(struct clock_event_device *evt) - exynos4_mct_write(TICK_BASE_CNT, mevt->base + MCT_L_TCNTB_OFFSET); - - if (mct_int_type == MCT_INT_SPI) { -- evt->irq = mct_irqs[MCT_L0_IRQ + cpu]; -- if (request_irq(evt->irq, exynos4_mct_tick_isr, -- IRQF_TIMER | IRQF_NOBALANCING, -- evt->name, mevt)) { -- pr_err("exynos-mct: cannot register IRQ %d\n", -- evt->irq); -+ -+ if (evt->irq == -1) - return -EIO; -- } -- irq_force_affinity(mct_irqs[MCT_L0_IRQ + cpu], cpumask_of(cpu)); -+ -+ irq_force_affinity(evt->irq, cpumask_of(cpu)); -+ enable_irq(evt->irq); - } else { - enable_percpu_irq(mct_irqs[MCT_L0_IRQ], 0); - } -@@ -443,10 +440,12 @@ static int exynos4_local_timer_setup(struct clock_event_device *evt) - static void exynos4_local_timer_stop(struct clock_event_device *evt) - { - evt->set_mode(CLOCK_EVT_MODE_UNUSED, evt); -- if (mct_int_type == MCT_INT_SPI) -- free_irq(evt->irq, this_cpu_ptr(&percpu_mct_tick)); -- else -+ if (mct_int_type == MCT_INT_SPI) { -+ if (evt->irq != -1) -+ disable_irq_nosync(evt->irq); -+ } else { - disable_percpu_irq(mct_irqs[MCT_L0_IRQ]); -+ } - } - - static int exynos4_mct_cpu_notify(struct notifier_block *self, -@@ -478,7 +477,7 @@ static struct notifier_block exynos4_mct_cpu_nb = { - - static void __init exynos4_timer_resources(struct device_node *np, void __iomem *base) - { -- int err; -+ int err, cpu; - struct mct_clock_event_device *mevt = this_cpu_ptr(&percpu_mct_tick); - struct clk *mct_clk, *tick_clk; - -@@ -505,7 +504,25 @@ static void __init exynos4_timer_resources(struct device_node *np, void __iomem - WARN(err, "MCT: can't request IRQ %d (%d)\n", - mct_irqs[MCT_L0_IRQ], err); - } else { -- irq_set_affinity(mct_irqs[MCT_L0_IRQ], cpumask_of(0)); -+ for_each_possible_cpu(cpu) { -+ int mct_irq = mct_irqs[MCT_L0_IRQ + cpu]; -+ struct mct_clock_event_device *pcpu_mevt = -+ per_cpu_ptr(&percpu_mct_tick, cpu); -+ -+ pcpu_mevt->evt.irq = -1; -+ -+ irq_set_status_flags(mct_irq, IRQ_NOAUTOEN); -+ if (request_irq(mct_irq, -+ exynos4_mct_tick_isr, -+ IRQF_TIMER | IRQF_NOBALANCING, -+ pcpu_mevt->name, pcpu_mevt)) { -+ pr_err("exynos-mct: cannot register IRQ (cpu%d)\n", -+ cpu); -+ -+ continue; -+ } -+ pcpu_mevt->evt.irq = mct_irq; -+ } - } - - err = register_cpu_notifier(&exynos4_mct_cpu_nb); -diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c -index e3d2052e7552..1adc039fe74d 100644 ---- a/drivers/cpuidle/cpuidle.c -+++ b/drivers/cpuidle/cpuidle.c -@@ -131,6 +131,9 @@ int cpuidle_idle_call(void) - - /* ask the governor for the next state */ - next_state = cpuidle_curr_governor->select(drv, dev); -+ if (next_state < 0) -+ return -EBUSY; -+ - if (need_resched()) { - dev->last_residency = 0; - /* give the governor an opportunity to reflect on the outcome */ -diff --git a/drivers/cpuidle/governors/menu.c b/drivers/cpuidle/governors/menu.c -index cf7f2f0e4ef5..027c484e1ec9 100644 ---- a/drivers/cpuidle/governors/menu.c -+++ b/drivers/cpuidle/governors/menu.c -@@ -297,7 +297,7 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev) - data->needs_update = 0; - } - -- data->last_state_idx = 0; -+ data->last_state_idx = CPUIDLE_DRIVER_STATE_START - 1; - data->exit_us = 0; - - /* Special case when user has set very strict latency requirement */ -diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c -index 394cbc5c93e3..6b2f01d60527 100644 ---- a/drivers/dma/mv_xor.c -+++ b/drivers/dma/mv_xor.c -@@ -316,7 +316,8 @@ static void __mv_xor_slot_cleanup(struct mv_xor_chan *mv_chan) - dma_cookie_t cookie = 0; - int busy = mv_chan_is_busy(mv_chan); - u32 current_desc = mv_chan_get_current_desc(mv_chan); -- int seen_current = 0; -+ int current_cleaned = 0; -+ struct mv_xor_desc *hw_desc; - - dev_dbg(mv_chan_to_devp(mv_chan), "%s %d\n", __func__, __LINE__); - dev_dbg(mv_chan_to_devp(mv_chan), "current_desc %x\n", current_desc); -@@ -328,38 +329,57 @@ static void __mv_xor_slot_cleanup(struct mv_xor_chan *mv_chan) - - list_for_each_entry_safe(iter, _iter, &mv_chan->chain, - chain_node) { -- prefetch(_iter); -- prefetch(&_iter->async_tx); - -- /* do not advance past the current descriptor loaded into the -- * hardware channel, subsequent descriptors are either in -- * process or have not been submitted -- */ -- if (seen_current) -- break; -+ /* clean finished descriptors */ -+ hw_desc = iter->hw_desc; -+ if (hw_desc->status & XOR_DESC_SUCCESS) { -+ cookie = mv_xor_run_tx_complete_actions(iter, mv_chan, -+ cookie); - -- /* stop the search if we reach the current descriptor and the -- * channel is busy -- */ -- if (iter->async_tx.phys == current_desc) { -- seen_current = 1; -- if (busy) -+ /* done processing desc, clean slot */ -+ mv_xor_clean_slot(iter, mv_chan); -+ -+ /* break if we did cleaned the current */ -+ if (iter->async_tx.phys == current_desc) { -+ current_cleaned = 1; -+ break; -+ } -+ } else { -+ if (iter->async_tx.phys == current_desc) { -+ current_cleaned = 0; - break; -+ } - } -- -- cookie = mv_xor_run_tx_complete_actions(iter, mv_chan, cookie); -- -- if (mv_xor_clean_slot(iter, mv_chan)) -- break; - } - - if ((busy == 0) && !list_empty(&mv_chan->chain)) { -- struct mv_xor_desc_slot *chain_head; -- chain_head = list_entry(mv_chan->chain.next, -- struct mv_xor_desc_slot, -- chain_node); -- -- mv_xor_start_new_chain(mv_chan, chain_head); -+ if (current_cleaned) { -+ /* -+ * current descriptor cleaned and removed, run -+ * from list head -+ */ -+ iter = list_entry(mv_chan->chain.next, -+ struct mv_xor_desc_slot, -+ chain_node); -+ mv_xor_start_new_chain(mv_chan, iter); -+ } else { -+ if (!list_is_last(&iter->chain_node, &mv_chan->chain)) { -+ /* -+ * descriptors are still waiting after -+ * current, trigger them -+ */ -+ iter = list_entry(iter->chain_node.next, -+ struct mv_xor_desc_slot, -+ chain_node); -+ mv_xor_start_new_chain(mv_chan, iter); -+ } else { -+ /* -+ * some descriptors are still waiting -+ * to be cleaned -+ */ -+ tasklet_schedule(&mv_chan->irq_tasklet); -+ } -+ } - } - - if (cookie > 0) -diff --git a/drivers/dma/mv_xor.h b/drivers/dma/mv_xor.h -index d0749229c875..5d14e4b21692 100644 ---- a/drivers/dma/mv_xor.h -+++ b/drivers/dma/mv_xor.h -@@ -33,6 +33,7 @@ - #define XOR_OPERATION_MODE_XOR 0 - #define XOR_OPERATION_MODE_MEMCPY 2 - #define XOR_DESCRIPTOR_SWAP BIT(14) -+#define XOR_DESC_SUCCESS 0x40000000 - - #define XOR_CURR_DESC(chan) (chan->mmr_high_base + 0x10 + (chan->idx * 4)) - #define XOR_NEXT_DESC(chan) (chan->mmr_high_base + 0x00 + (chan->idx * 4)) -diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c -index 3b7d32da1604..903db3cf288a 100644 ---- a/drivers/gpu/drm/drm_crtc.c -+++ b/drivers/gpu/drm/drm_crtc.c -@@ -2155,8 +2155,11 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, - if (!drm_core_check_feature(dev, DRIVER_MODESET)) - return -EINVAL; - -- /* For some reason crtc x/y offsets are signed internally. */ -- if (crtc_req->x > INT_MAX || crtc_req->y > INT_MAX) -+ /* -+ * Universal plane src offsets are only 16.16, prevent havoc for -+ * drivers using universal plane code internally. -+ */ -+ if (crtc_req->x & 0xffff0000 || crtc_req->y & 0xffff0000) - return -ERANGE; - - drm_modeset_lock_all(dev); -diff --git a/drivers/gpu/drm/qxl/qxl_cmd.c b/drivers/gpu/drm/qxl/qxl_cmd.c -index eb89653a7a17..c5e96a38f859 100644 ---- a/drivers/gpu/drm/qxl/qxl_cmd.c -+++ b/drivers/gpu/drm/qxl/qxl_cmd.c -@@ -505,6 +505,7 @@ int qxl_hw_surface_alloc(struct qxl_device *qdev, - - cmd = (struct qxl_surface_cmd *)qxl_release_map(qdev, release); - cmd->type = QXL_SURFACE_CMD_CREATE; -+ cmd->flags = QXL_SURF_FLAG_KEEP_DATA; - cmd->u.surface_create.format = surf->surf.format; - cmd->u.surface_create.width = surf->surf.width; - cmd->u.surface_create.height = surf->surf.height; -diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c -index 0bb86e6d41b4..56a13a915155 100644 ---- a/drivers/gpu/drm/qxl/qxl_ioctl.c -+++ b/drivers/gpu/drm/qxl/qxl_ioctl.c -@@ -122,8 +122,10 @@ static struct qxl_bo *qxlhw_handle_to_bo(struct qxl_device *qdev, - qobj = gem_to_qxl_bo(gobj); - - ret = qxl_release_list_add(release, qobj); -- if (ret) -+ if (ret) { -+ drm_gem_object_unreference_unlocked(gobj); - return NULL; -+ } - - return qobj; - } -diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c -index c4558bdb0584..2fd2fb3f735f 100644 ---- a/drivers/gpu/drm/radeon/cik.c -+++ b/drivers/gpu/drm/radeon/cik.c -@@ -4148,6 +4148,31 @@ void cik_compute_set_wptr(struct radeon_device *rdev, - WDOORBELL32(ring->doorbell_index, ring->wptr); - } - -+static void cik_compute_stop(struct radeon_device *rdev, -+ struct radeon_ring *ring) -+{ -+ u32 j, tmp; -+ -+ cik_srbm_select(rdev, ring->me, ring->pipe, ring->queue, 0); -+ /* Disable wptr polling. */ -+ tmp = RREG32(CP_PQ_WPTR_POLL_CNTL); -+ tmp &= ~WPTR_POLL_EN; -+ WREG32(CP_PQ_WPTR_POLL_CNTL, tmp); -+ /* Disable HQD. */ -+ if (RREG32(CP_HQD_ACTIVE) & 1) { -+ WREG32(CP_HQD_DEQUEUE_REQUEST, 1); -+ for (j = 0; j < rdev->usec_timeout; j++) { -+ if (!(RREG32(CP_HQD_ACTIVE) & 1)) -+ break; -+ udelay(1); -+ } -+ WREG32(CP_HQD_DEQUEUE_REQUEST, 0); -+ WREG32(CP_HQD_PQ_RPTR, 0); -+ WREG32(CP_HQD_PQ_WPTR, 0); -+ } -+ cik_srbm_select(rdev, 0, 0, 0, 0); -+} -+ - /** - * cik_cp_compute_enable - enable/disable the compute CP MEs - * -@@ -4161,6 +4186,15 @@ static void cik_cp_compute_enable(struct radeon_device *rdev, bool enable) - if (enable) - WREG32(CP_MEC_CNTL, 0); - else { -+ /* -+ * To make hibernation reliable we need to clear compute ring -+ * configuration before halting the compute ring. -+ */ -+ mutex_lock(&rdev->srbm_mutex); -+ cik_compute_stop(rdev,&rdev->ring[CAYMAN_RING_TYPE_CP1_INDEX]); -+ cik_compute_stop(rdev,&rdev->ring[CAYMAN_RING_TYPE_CP2_INDEX]); -+ mutex_unlock(&rdev->srbm_mutex); -+ - WREG32(CP_MEC_CNTL, (MEC_ME1_HALT | MEC_ME2_HALT)); - rdev->ring[CAYMAN_RING_TYPE_CP1_INDEX].ready = false; - rdev->ring[CAYMAN_RING_TYPE_CP2_INDEX].ready = false; -diff --git a/drivers/gpu/drm/radeon/cik_sdma.c b/drivers/gpu/drm/radeon/cik_sdma.c -index 66ba713ba7d7..e590aec50c7d 100644 ---- a/drivers/gpu/drm/radeon/cik_sdma.c -+++ b/drivers/gpu/drm/radeon/cik_sdma.c -@@ -266,6 +266,17 @@ static void cik_sdma_gfx_stop(struct radeon_device *rdev) - } - rdev->ring[R600_RING_TYPE_DMA_INDEX].ready = false; - rdev->ring[CAYMAN_RING_TYPE_DMA1_INDEX].ready = false; -+ -+ /* FIXME use something else than big hammer but after few days can not -+ * seem to find good combination so reset SDMA blocks as it seems we -+ * do not shut them down properly. This fix hibernation and does not -+ * affect suspend to ram. -+ */ -+ WREG32(SRBM_SOFT_RESET, SOFT_RESET_SDMA | SOFT_RESET_SDMA1); -+ (void)RREG32(SRBM_SOFT_RESET); -+ udelay(50); -+ WREG32(SRBM_SOFT_RESET, 0); -+ (void)RREG32(SRBM_SOFT_RESET); - } - - /** -diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c -index a8f9b463bf2a..e60972290be6 100644 ---- a/drivers/gpu/drm/radeon/radeon_gart.c -+++ b/drivers/gpu/drm/radeon/radeon_gart.c -@@ -251,8 +251,10 @@ void radeon_gart_unbind(struct radeon_device *rdev, unsigned offset, - } - } - } -- mb(); -- radeon_gart_tlb_flush(rdev); -+ if (rdev->gart.ptr) { -+ mb(); -+ radeon_gart_tlb_flush(rdev); -+ } - } - - /** -@@ -294,8 +296,10 @@ int radeon_gart_bind(struct radeon_device *rdev, unsigned offset, - } - } - } -- mb(); -- radeon_gart_tlb_flush(rdev); -+ if (rdev->gart.ptr) { -+ mb(); -+ radeon_gart_tlb_flush(rdev); -+ } - return 0; - } - -diff --git a/drivers/gpu/drm/radeon/radeon_irq_kms.c b/drivers/gpu/drm/radeon/radeon_irq_kms.c -index b3f0293ba0d8..f8b20e1c0820 100644 ---- a/drivers/gpu/drm/radeon/radeon_irq_kms.c -+++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c -@@ -79,10 +79,12 @@ static void radeon_hotplug_work_func(struct work_struct *work) - struct drm_mode_config *mode_config = &dev->mode_config; - struct drm_connector *connector; - -+ mutex_lock(&mode_config->mutex); - if (mode_config->num_connector) { - list_for_each_entry(connector, &mode_config->connector_list, head) - radeon_connector_hotplug(connector); - } -+ mutex_unlock(&mode_config->mutex); - /* Just fire off a uevent and let userspace tell us what to do */ - drm_helper_hpd_irq_event(dev); - } -diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c -index 11804cc1e11f..c9053f799abe 100644 ---- a/drivers/gpu/drm/radeon/si_dpm.c -+++ b/drivers/gpu/drm/radeon/si_dpm.c -@@ -2914,6 +2914,7 @@ static struct si_dpm_quirk si_dpm_quirk_list[] = { - /* PITCAIRN - https://bugs.freedesktop.org/show_bug.cgi?id=76490 */ - { PCI_VENDOR_ID_ATI, 0x6810, 0x1462, 0x3036, 0, 120000 }, - { PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0xe271, 0, 120000 }, -+ { PCI_VENDOR_ID_ATI, 0x6810, 0x174b, 0xe271, 85000, 90000 }, - { 0, 0, 0, 0 }, - }; - -diff --git a/drivers/hwmon/mcp3021.c b/drivers/hwmon/mcp3021.c -index d219c06a857b..972444a14cca 100644 ---- a/drivers/hwmon/mcp3021.c -+++ b/drivers/hwmon/mcp3021.c -@@ -31,14 +31,11 @@ - /* output format */ - #define MCP3021_SAR_SHIFT 2 - #define MCP3021_SAR_MASK 0x3ff -- - #define MCP3021_OUTPUT_RES 10 /* 10-bit resolution */ --#define MCP3021_OUTPUT_SCALE 4 - - #define MCP3221_SAR_SHIFT 0 - #define MCP3221_SAR_MASK 0xfff - #define MCP3221_OUTPUT_RES 12 /* 12-bit resolution */ --#define MCP3221_OUTPUT_SCALE 1 - - enum chips { - mcp3021, -@@ -54,7 +51,6 @@ struct mcp3021_data { - u16 sar_shift; - u16 sar_mask; - u8 output_res; -- u8 output_scale; - }; - - static int mcp3021_read16(struct i2c_client *client) -@@ -84,13 +80,7 @@ static int mcp3021_read16(struct i2c_client *client) - - static inline u16 volts_from_reg(struct mcp3021_data *data, u16 val) - { -- if (val == 0) -- return 0; -- -- val = val * data->output_scale - data->output_scale / 2; -- -- return val * DIV_ROUND_CLOSEST(data->vdd, -- (1 << data->output_res) * data->output_scale); -+ return DIV_ROUND_CLOSEST(data->vdd * val, 1 << data->output_res); - } - - static ssize_t show_in_input(struct device *dev, struct device_attribute *attr, -@@ -132,14 +122,12 @@ static int mcp3021_probe(struct i2c_client *client, - data->sar_shift = MCP3021_SAR_SHIFT; - data->sar_mask = MCP3021_SAR_MASK; - data->output_res = MCP3021_OUTPUT_RES; -- data->output_scale = MCP3021_OUTPUT_SCALE; - break; - - case mcp3221: - data->sar_shift = MCP3221_SAR_SHIFT; - data->sar_mask = MCP3221_SAR_MASK; - data->output_res = MCP3221_OUTPUT_RES; -- data->output_scale = MCP3221_OUTPUT_SCALE; - break; - } - -diff --git a/drivers/i2c/busses/i2c-at91.c b/drivers/i2c/busses/i2c-at91.c -index 8873d84e1d4f..50862c948217 100644 ---- a/drivers/i2c/busses/i2c-at91.c -+++ b/drivers/i2c/busses/i2c-at91.c -@@ -62,6 +62,9 @@ - #define AT91_TWI_UNRE 0x0080 /* Underrun Error */ - #define AT91_TWI_NACK 0x0100 /* Not Acknowledged */ - -+#define AT91_TWI_INT_MASK \ -+ (AT91_TWI_TXCOMP | AT91_TWI_RXRDY | AT91_TWI_TXRDY | AT91_TWI_NACK) -+ - #define AT91_TWI_IER 0x0024 /* Interrupt Enable Register */ - #define AT91_TWI_IDR 0x0028 /* Interrupt Disable Register */ - #define AT91_TWI_IMR 0x002c /* Interrupt Mask Register */ -@@ -117,13 +120,12 @@ static void at91_twi_write(struct at91_twi_dev *dev, unsigned reg, unsigned val) - - static void at91_disable_twi_interrupts(struct at91_twi_dev *dev) - { -- at91_twi_write(dev, AT91_TWI_IDR, -- AT91_TWI_TXCOMP | AT91_TWI_RXRDY | AT91_TWI_TXRDY); -+ at91_twi_write(dev, AT91_TWI_IDR, AT91_TWI_INT_MASK); - } - - static void at91_twi_irq_save(struct at91_twi_dev *dev) - { -- dev->imr = at91_twi_read(dev, AT91_TWI_IMR) & 0x7; -+ dev->imr = at91_twi_read(dev, AT91_TWI_IMR) & AT91_TWI_INT_MASK; - at91_disable_twi_interrupts(dev); - } - -@@ -213,6 +215,14 @@ static void at91_twi_write_data_dma_callback(void *data) - dma_unmap_single(dev->dev, sg_dma_address(&dev->dma.sg), - dev->buf_len, DMA_TO_DEVICE); - -+ /* -+ * When this callback is called, THR/TX FIFO is likely not to be empty -+ * yet. So we have to wait for TXCOMP or NACK bits to be set into the -+ * Status Register to be sure that the STOP bit has been sent and the -+ * transfer is completed. The NACK interrupt has already been enabled, -+ * we just have to enable TXCOMP one. -+ */ -+ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_TXCOMP); - at91_twi_write(dev, AT91_TWI_CR, AT91_TWI_STOP); - } - -@@ -307,7 +317,7 @@ static void at91_twi_read_data_dma_callback(void *data) - /* The last two bytes have to be read without using dma */ - dev->buf += dev->buf_len - 2; - dev->buf_len = 2; -- at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_RXRDY); -+ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_RXRDY | AT91_TWI_TXCOMP); - } - - static void at91_twi_read_data_dma(struct at91_twi_dev *dev) -@@ -368,7 +378,7 @@ static irqreturn_t atmel_twi_interrupt(int irq, void *dev_id) - /* catch error flags */ - dev->transfer_status |= status; - -- if (irqstatus & AT91_TWI_TXCOMP) { -+ if (irqstatus & (AT91_TWI_TXCOMP | AT91_TWI_NACK)) { - at91_disable_twi_interrupts(dev); - complete(&dev->cmd_complete); - } -@@ -381,6 +391,34 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev) - int ret; - bool has_unre_flag = dev->pdata->has_unre_flag; - -+ /* -+ * WARNING: the TXCOMP bit in the Status Register is NOT a clear on -+ * read flag but shows the state of the transmission at the time the -+ * Status Register is read. According to the programmer datasheet, -+ * TXCOMP is set when both holding register and internal shifter are -+ * empty and STOP condition has been sent. -+ * Consequently, we should enable NACK interrupt rather than TXCOMP to -+ * detect transmission failure. -+ * -+ * Besides, the TXCOMP bit is already set before the i2c transaction -+ * has been started. For read transactions, this bit is cleared when -+ * writing the START bit into the Control Register. So the -+ * corresponding interrupt can safely be enabled just after. -+ * However for write transactions managed by the CPU, we first write -+ * into THR, so TXCOMP is cleared. Then we can safely enable TXCOMP -+ * interrupt. If TXCOMP interrupt were enabled before writing into THR, -+ * the interrupt handler would be called immediately and the i2c command -+ * would be reported as completed. -+ * Also when a write transaction is managed by the DMA controller, -+ * enabling the TXCOMP interrupt in this function may lead to a race -+ * condition since we don't know whether the TXCOMP interrupt is enabled -+ * before or after the DMA has started to write into THR. So the TXCOMP -+ * interrupt is enabled later by at91_twi_write_data_dma_callback(). -+ * Immediately after in that DMA callback, we still need to send the -+ * STOP condition manually writing the corresponding bit into the -+ * Control Register. -+ */ -+ - dev_dbg(dev->dev, "transfer: %s %d bytes.\n", - (dev->msg->flags & I2C_M_RD) ? "read" : "write", dev->buf_len); - -@@ -411,26 +449,24 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev) - * seems to be the best solution. - */ - if (dev->use_dma && (dev->buf_len > AT91_I2C_DMA_THRESHOLD)) { -+ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_NACK); - at91_twi_read_data_dma(dev); -- /* -- * It is important to enable TXCOMP irq here because -- * doing it only when transferring the last two bytes -- * will mask NACK errors since TXCOMP is set when a -- * NACK occurs. -- */ -- at91_twi_write(dev, AT91_TWI_IER, -- AT91_TWI_TXCOMP); -- } else -+ } else { - at91_twi_write(dev, AT91_TWI_IER, -- AT91_TWI_TXCOMP | AT91_TWI_RXRDY); -+ AT91_TWI_TXCOMP | -+ AT91_TWI_NACK | -+ AT91_TWI_RXRDY); -+ } - } else { - if (dev->use_dma && (dev->buf_len > AT91_I2C_DMA_THRESHOLD)) { -+ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_NACK); - at91_twi_write_data_dma(dev); -- at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_TXCOMP); - } else { - at91_twi_write_next_byte(dev); - at91_twi_write(dev, AT91_TWI_IER, -- AT91_TWI_TXCOMP | AT91_TWI_TXRDY); -+ AT91_TWI_TXCOMP | -+ AT91_TWI_NACK | -+ AT91_TWI_TXRDY); - } - } - -diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c -index e6bf77d1ec08..ed4e45f53e20 100644 ---- a/drivers/iio/adc/at91_adc.c -+++ b/drivers/iio/adc/at91_adc.c -@@ -58,7 +58,7 @@ struct at91_adc_caps { - u8 ts_pen_detect_sensitivity; - - /* startup time calculate function */ -- u32 (*calc_startup_ticks)(u8 startup_time, u32 adc_clk_khz); -+ u32 (*calc_startup_ticks)(u32 startup_time, u32 adc_clk_khz); - - u8 num_channels; - struct at91_adc_reg_desc registers; -@@ -82,7 +82,7 @@ struct at91_adc_state { - u8 num_channels; - void __iomem *reg_base; - struct at91_adc_reg_desc *registers; -- u8 startup_time; -+ u32 startup_time; - u8 sample_hold_time; - bool sleep_mode; - struct iio_trigger **trig; -@@ -590,7 +590,7 @@ ret: - return ret; - } - --static u32 calc_startup_ticks_9260(u8 startup_time, u32 adc_clk_khz) -+static u32 calc_startup_ticks_9260(u32 startup_time, u32 adc_clk_khz) - { - /* - * Number of ticks needed to cover the startup time of the ADC -@@ -601,7 +601,7 @@ static u32 calc_startup_ticks_9260(u8 startup_time, u32 adc_clk_khz) - return round_up((startup_time * adc_clk_khz / 1000) - 1, 8) / 8; - } - --static u32 calc_startup_ticks_9x5(u8 startup_time, u32 adc_clk_khz) -+static u32 calc_startup_ticks_9x5(u32 startup_time, u32 adc_clk_khz) - { - /* - * For sama5d3x and at91sam9x5, the formula changes to: -diff --git a/drivers/iio/dac/ad5624r_spi.c b/drivers/iio/dac/ad5624r_spi.c -index e8199cce2aea..1e666510c672 100644 ---- a/drivers/iio/dac/ad5624r_spi.c -+++ b/drivers/iio/dac/ad5624r_spi.c -@@ -22,7 +22,7 @@ - #include "ad5624r.h" - - static int ad5624r_spi_write(struct spi_device *spi, -- u8 cmd, u8 addr, u16 val, u8 len) -+ u8 cmd, u8 addr, u16 val, u8 shift) - { - u32 data; - u8 msg[3]; -@@ -35,7 +35,7 @@ static int ad5624r_spi_write(struct spi_device *spi, - * 14-, 12-bit input code followed by 0, 2, or 4 don't care bits, - * for the AD5664R, AD5644R, and AD5624R, respectively. - */ -- data = (0 << 22) | (cmd << 19) | (addr << 16) | (val << (16 - len)); -+ data = (0 << 22) | (cmd << 19) | (addr << 16) | (val << shift); - msg[0] = data >> 16; - msg[1] = data >> 8; - msg[2] = data; -diff --git a/drivers/iio/temperature/tmp006.c b/drivers/iio/temperature/tmp006.c -index 84a0789c3d96..7a8050996b4e 100644 ---- a/drivers/iio/temperature/tmp006.c -+++ b/drivers/iio/temperature/tmp006.c -@@ -132,6 +132,9 @@ static int tmp006_write_raw(struct iio_dev *indio_dev, - struct tmp006_data *data = iio_priv(indio_dev); - int i; - -+ if (mask != IIO_CHAN_INFO_SAMP_FREQ) -+ return -EINVAL; -+ - for (i = 0; i < ARRAY_SIZE(tmp006_freqs); i++) - if ((val == tmp006_freqs[i][0]) && - (val2 == tmp006_freqs[i][1])) { -diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c -index 60142274fe4b..dd2b610552d5 100644 ---- a/drivers/infiniband/ulp/isert/ib_isert.c -+++ b/drivers/infiniband/ulp/isert/ib_isert.c -@@ -59,6 +59,8 @@ static int - isert_rdma_accept(struct isert_conn *isert_conn); - struct rdma_cm_id *isert_setup_id(struct isert_np *isert_np); - -+static void isert_release_work(struct work_struct *work); -+ - static void - isert_qp_event_callback(struct ib_event *e, void *context) - { -@@ -206,7 +208,7 @@ fail: - static void - isert_free_rx_descriptors(struct isert_conn *isert_conn) - { -- struct ib_device *ib_dev = isert_conn->conn_cm_id->device; -+ struct ib_device *ib_dev = isert_conn->conn_device->ib_device; - struct iser_rx_desc *rx_desc; - int i; - -@@ -534,6 +536,7 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event) - mutex_init(&isert_conn->conn_mutex); - spin_lock_init(&isert_conn->conn_lock); - INIT_LIST_HEAD(&isert_conn->conn_fr_pool); -+ INIT_WORK(&isert_conn->release_work, isert_release_work); - - isert_conn->conn_cm_id = cma_id; - isert_conn->responder_resources = event->param.conn.responder_resources; -@@ -647,9 +650,9 @@ out: - static void - isert_connect_release(struct isert_conn *isert_conn) - { -- struct ib_device *ib_dev = isert_conn->conn_cm_id->device; - struct isert_device *device = isert_conn->conn_device; - int cq_index; -+ struct ib_device *ib_dev = device->ib_device; - - pr_debug("Entering isert_connect_release(): >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n"); - -@@ -657,7 +660,8 @@ isert_connect_release(struct isert_conn *isert_conn) - isert_conn_free_fastreg_pool(isert_conn); - - isert_free_rx_descriptors(isert_conn); -- rdma_destroy_id(isert_conn->conn_cm_id); -+ if (isert_conn->conn_cm_id) -+ rdma_destroy_id(isert_conn->conn_cm_id); - - if (isert_conn->conn_qp) { - cq_index = ((struct isert_cq_desc *) -@@ -799,6 +803,7 @@ isert_disconnected_handler(struct rdma_cm_id *cma_id, - { - struct isert_np *isert_np = cma_id->context; - struct isert_conn *isert_conn; -+ bool terminating = false; - - if (isert_np->np_cm_id == cma_id) - return isert_np_cma_handler(cma_id->context, event); -@@ -806,21 +811,37 @@ isert_disconnected_handler(struct rdma_cm_id *cma_id, - isert_conn = cma_id->qp->qp_context; - - mutex_lock(&isert_conn->conn_mutex); -+ terminating = (isert_conn->state == ISER_CONN_TERMINATING); - isert_conn_terminate(isert_conn); - mutex_unlock(&isert_conn->conn_mutex); - - pr_info("conn %p completing conn_wait\n", isert_conn); - complete(&isert_conn->conn_wait); - -+ if (terminating) -+ goto out; -+ -+ mutex_lock(&isert_np->np_accept_mutex); -+ if (!list_empty(&isert_conn->conn_accept_node)) { -+ list_del_init(&isert_conn->conn_accept_node); -+ isert_put_conn(isert_conn); -+ queue_work(isert_release_wq, &isert_conn->release_work); -+ } -+ mutex_unlock(&isert_np->np_accept_mutex); -+ -+out: - return 0; - } - --static void -+static int - isert_connect_error(struct rdma_cm_id *cma_id) - { - struct isert_conn *isert_conn = cma_id->qp->qp_context; - -+ isert_conn->conn_cm_id = NULL; - isert_put_conn(isert_conn); -+ -+ return -1; - } - - static int -@@ -850,7 +871,7 @@ isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event) - case RDMA_CM_EVENT_REJECTED: /* FALLTHRU */ - case RDMA_CM_EVENT_UNREACHABLE: /* FALLTHRU */ - case RDMA_CM_EVENT_CONNECT_ERROR: -- isert_connect_error(cma_id); -+ ret = isert_connect_error(cma_id); - break; - default: - pr_err("Unhandled RDMA CMA event: %d\n", event->event); -@@ -2944,7 +2965,6 @@ static void isert_wait_conn(struct iscsi_conn *conn) - - wait_for_completion(&isert_conn->conn_wait_comp_err); - -- INIT_WORK(&isert_conn->release_work, isert_release_work); - queue_work(isert_release_wq, &isert_conn->release_work); - } - -diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c -index f37d63cf726b..825545cdfb10 100644 ---- a/drivers/leds/led-class.c -+++ b/drivers/leds/led-class.c -@@ -178,6 +178,7 @@ void led_classdev_resume(struct led_classdev *led_cdev) - } - EXPORT_SYMBOL_GPL(led_classdev_resume); - -+#ifdef CONFIG_PM_SLEEP - static int led_suspend(struct device *dev) - { - struct led_classdev *led_cdev = dev_get_drvdata(dev); -@@ -197,11 +198,9 @@ static int led_resume(struct device *dev) - - return 0; - } -+#endif - --static const struct dev_pm_ops leds_class_dev_pm_ops = { -- .suspend = led_suspend, -- .resume = led_resume, --}; -+static SIMPLE_DEV_PM_OPS(leds_class_dev_pm_ops, led_suspend, led_resume); - - /** - * led_classdev_register - register a new object of led_classdev class. -diff --git a/drivers/md/dm-stats.c b/drivers/md/dm-stats.c -index 28a90122a5a8..b3b0697a9fd7 100644 ---- a/drivers/md/dm-stats.c -+++ b/drivers/md/dm-stats.c -@@ -795,6 +795,8 @@ static int message_stats_create(struct mapped_device *md, - return -EINVAL; - - if (sscanf(argv[2], "/%u%c", &divisor, &dummy) == 1) { -+ if (!divisor) -+ return -EINVAL; - step = end - start; - if (do_div(step, divisor)) - step++; -diff --git a/drivers/md/md.c b/drivers/md/md.c -index 40959ee73583..b4067b9afd38 100644 ---- a/drivers/md/md.c -+++ b/drivers/md/md.c -@@ -6232,7 +6232,7 @@ static int update_array_info(struct mddev *mddev, mdu_array_info_t *info) - mddev->ctime != info->ctime || - mddev->level != info->level || - /* mddev->layout != info->layout || */ -- !mddev->persistent != info->not_persistent|| -+ mddev->persistent != !info->not_persistent || - mddev->chunk_sectors != info->chunk_size >> 9 || - /* ignore bottom 8 bits of state, and allow SB_BITMAP_PRESENT to change */ - ((state^info->state) & 0xfffffe00) -diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c -index b88757cd0d1d..a03178e91a79 100644 ---- a/drivers/md/persistent-data/dm-btree-remove.c -+++ b/drivers/md/persistent-data/dm-btree-remove.c -@@ -309,8 +309,8 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent, - - if (s < 0 && nr_center < -s) { - /* not enough in central node */ -- shift(left, center, nr_center); -- s = nr_center - target; -+ shift(left, center, -nr_center); -+ s += nr_center; - shift(left, right, s); - nr_right += s; - } else -@@ -323,7 +323,7 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent, - if (s > 0 && nr_center < s) { - /* not enough in central node */ - shift(center, right, nr_center); -- s = target - nr_center; -+ s -= nr_center; - shift(left, right, s); - nr_left -= s; - } else -diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c -index 200ac12a1d40..fdd3793e22f9 100644 ---- a/drivers/md/persistent-data/dm-btree.c -+++ b/drivers/md/persistent-data/dm-btree.c -@@ -255,7 +255,7 @@ int dm_btree_del(struct dm_btree_info *info, dm_block_t root) - int r; - struct del_stack *s; - -- s = kmalloc(sizeof(*s), GFP_KERNEL); -+ s = kmalloc(sizeof(*s), GFP_NOIO); - if (!s) - return -ENOMEM; - s->info = info; -diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c -index f4e22bcc7fb8..199c9ccd1f5d 100644 ---- a/drivers/md/persistent-data/dm-space-map-metadata.c -+++ b/drivers/md/persistent-data/dm-space-map-metadata.c -@@ -204,6 +204,27 @@ static void in(struct sm_metadata *smm) - smm->recursion_count++; - } - -+static int apply_bops(struct sm_metadata *smm) -+{ -+ int r = 0; -+ -+ while (!brb_empty(&smm->uncommitted)) { -+ struct block_op bop; -+ -+ r = brb_pop(&smm->uncommitted, &bop); -+ if (r) { -+ DMERR("bug in bop ring buffer"); -+ break; -+ } -+ -+ r = commit_bop(smm, &bop); -+ if (r) -+ break; -+ } -+ -+ return r; -+} -+ - static int out(struct sm_metadata *smm) - { - int r = 0; -@@ -216,21 +237,8 @@ static int out(struct sm_metadata *smm) - return -ENOMEM; - } - -- if (smm->recursion_count == 1) { -- while (!brb_empty(&smm->uncommitted)) { -- struct block_op bop; -- -- r = brb_pop(&smm->uncommitted, &bop); -- if (r) { -- DMERR("bug in bop ring buffer"); -- break; -- } -- -- r = commit_bop(smm, &bop); -- if (r) -- break; -- } -- } -+ if (smm->recursion_count == 1) -+ apply_bops(smm); - - smm->recursion_count--; - -@@ -702,6 +710,12 @@ static int sm_metadata_extend(struct dm_space_map *sm, dm_block_t extra_blocks) - } - old_len = smm->begin; - -+ r = apply_bops(smm); -+ if (r) { -+ DMERR("%s: apply_bops failed", __func__); -+ goto out; -+ } -+ - r = sm_ll_commit(&smm->ll); - if (r) - goto out; -@@ -771,6 +785,12 @@ int dm_sm_metadata_create(struct dm_space_map *sm, - if (r) - return r; - -+ r = apply_bops(smm); -+ if (r) { -+ DMERR("%s: apply_bops failed", __func__); -+ return r; -+ } -+ - return sm_metadata_commit(sm); - } - -diff --git a/drivers/media/dvb-frontends/af9013.c b/drivers/media/dvb-frontends/af9013.c -index fb504f1e9125..5930aee6b5d0 100644 ---- a/drivers/media/dvb-frontends/af9013.c -+++ b/drivers/media/dvb-frontends/af9013.c -@@ -606,6 +606,10 @@ static int af9013_set_frontend(struct dvb_frontend *fe) - } - } - -+ /* Return an error if can't find bandwidth or the right clock */ -+ if (i == ARRAY_SIZE(coeff_lut)) -+ return -EINVAL; -+ - ret = af9013_wr_regs(state, 0xae00, coeff_lut[i].val, - sizeof(coeff_lut[i].val)); - } -diff --git a/drivers/media/dvb-frontends/cx24116.c b/drivers/media/dvb-frontends/cx24116.c -index 2916d7c74a1d..7bc68b355c0b 100644 ---- a/drivers/media/dvb-frontends/cx24116.c -+++ b/drivers/media/dvb-frontends/cx24116.c -@@ -963,6 +963,10 @@ static int cx24116_send_diseqc_msg(struct dvb_frontend *fe, - struct cx24116_state *state = fe->demodulator_priv; - int i, ret; - -+ /* Validate length */ -+ if (d->msg_len > sizeof(d->msg)) -+ return -EINVAL; -+ - /* Dump DiSEqC message */ - if (debug) { - printk(KERN_INFO "cx24116: %s(", __func__); -@@ -974,10 +978,6 @@ static int cx24116_send_diseqc_msg(struct dvb_frontend *fe, - printk(") toneburst=%d\n", toneburst); - } - -- /* Validate length */ -- if (d->msg_len > (CX24116_ARGLEN - CX24116_DISEQC_MSGOFS)) -- return -EINVAL; -- - /* DiSEqC message */ - for (i = 0; i < d->msg_len; i++) - state->dsec_cmd.args[CX24116_DISEQC_MSGOFS + i] = d->msg[i]; -diff --git a/drivers/media/dvb-frontends/cx24117.c b/drivers/media/dvb-frontends/cx24117.c -index a6c3c9e2e897..d2eab0676d30 100644 ---- a/drivers/media/dvb-frontends/cx24117.c -+++ b/drivers/media/dvb-frontends/cx24117.c -@@ -1043,7 +1043,7 @@ static int cx24117_send_diseqc_msg(struct dvb_frontend *fe, - dev_dbg(&state->priv->i2c->dev, ")\n"); - - /* Validate length */ -- if (d->msg_len > 15) -+ if (d->msg_len > sizeof(d->msg)) - return -EINVAL; - - /* DiSEqC message */ -diff --git a/drivers/media/dvb-frontends/s5h1420.c b/drivers/media/dvb-frontends/s5h1420.c -index 93eeaf7118fd..0b4f8fe6bf99 100644 ---- a/drivers/media/dvb-frontends/s5h1420.c -+++ b/drivers/media/dvb-frontends/s5h1420.c -@@ -180,7 +180,7 @@ static int s5h1420_send_master_cmd (struct dvb_frontend* fe, - int result = 0; - - dprintk("enter %s\n", __func__); -- if (cmd->msg_len > 8) -+ if (cmd->msg_len > sizeof(cmd->msg)) - return -EINVAL; - - /* setup for DISEQC */ -diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c -index b1e21fc869c3..d71f5ef036e0 100644 ---- a/drivers/mmc/card/block.c -+++ b/drivers/mmc/card/block.c -@@ -205,6 +205,8 @@ static ssize_t power_ro_lock_show(struct device *dev, - - ret = snprintf(buf, PAGE_SIZE, "%d\n", locked); - -+ mmc_blk_put(md); -+ - return ret; - } - -@@ -1861,9 +1863,11 @@ static int mmc_blk_issue_rw_rq(struct mmc_queue *mq, struct request *rqc) - break; - case MMC_BLK_CMD_ERR: - ret = mmc_blk_cmd_err(md, card, brq, req, ret); -- if (!mmc_blk_reset(md, card->host, type)) -- break; -- goto cmd_abort; -+ if (mmc_blk_reset(md, card->host, type)) -+ goto cmd_abort; -+ if (!ret) -+ goto start_new_req; -+ break; - case MMC_BLK_RETRY: - if (retry++ < 5) - break; -diff --git a/drivers/mtd/maps/dc21285.c b/drivers/mtd/maps/dc21285.c -index f8a7dd14cee0..70a3db3ab856 100644 ---- a/drivers/mtd/maps/dc21285.c -+++ b/drivers/mtd/maps/dc21285.c -@@ -38,9 +38,9 @@ static void nw_en_write(void) - * we want to write a bit pattern XXX1 to Xilinx to enable - * the write gate, which will be open for about the next 2ms. - */ -- spin_lock_irqsave(&nw_gpio_lock, flags); -+ raw_spin_lock_irqsave(&nw_gpio_lock, flags); - nw_cpld_modify(CPLD_FLASH_WR_ENABLE, CPLD_FLASH_WR_ENABLE); -- spin_unlock_irqrestore(&nw_gpio_lock, flags); -+ raw_spin_unlock_irqrestore(&nw_gpio_lock, flags); - - /* - * let the ISA bus to catch on... -diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c -index 5073cbc796d8..32d5e40c6863 100644 ---- a/drivers/mtd/mtd_blkdevs.c -+++ b/drivers/mtd/mtd_blkdevs.c -@@ -199,6 +199,7 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode) - return -ERESTARTSYS; /* FIXME: busy loop! -arnd*/ - - mutex_lock(&dev->lock); -+ mutex_lock(&mtd_table_mutex); - - if (dev->open) - goto unlock; -@@ -222,6 +223,7 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode) - - unlock: - dev->open++; -+ mutex_unlock(&mtd_table_mutex); - mutex_unlock(&dev->lock); - blktrans_dev_put(dev); - return ret; -@@ -232,6 +234,7 @@ error_release: - error_put: - module_put(dev->tr->owner); - kref_put(&dev->ref, blktrans_dev_release); -+ mutex_unlock(&mtd_table_mutex); - mutex_unlock(&dev->lock); - blktrans_dev_put(dev); - return ret; -@@ -245,6 +248,7 @@ static void blktrans_release(struct gendisk *disk, fmode_t mode) - return; - - mutex_lock(&dev->lock); -+ mutex_lock(&mtd_table_mutex); - - if (--dev->open) - goto unlock; -@@ -258,6 +262,7 @@ static void blktrans_release(struct gendisk *disk, fmode_t mode) - __put_mtd_device(dev->mtd); - } - unlock: -+ mutex_unlock(&mtd_table_mutex); - mutex_unlock(&dev->lock); - blktrans_dev_put(dev); - } -diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c -index 9715a7ba164a..efc542d00c84 100644 ---- a/drivers/mtd/nand/nand_base.c -+++ b/drivers/mtd/nand/nand_base.c -@@ -2000,7 +2000,7 @@ static int nand_write_page_raw_syndrome(struct mtd_info *mtd, - oob += chip->ecc.prepad; - } - -- chip->read_buf(mtd, oob, eccbytes); -+ chip->write_buf(mtd, oob, eccbytes); - oob += eccbytes; - - if (chip->ecc.postpad) { -@@ -3063,7 +3063,7 @@ static int nand_flash_detect_onfi(struct mtd_info *mtd, struct nand_chip *chip, - int *busw) - { - struct nand_onfi_params *p = &chip->onfi_params; -- int i; -+ int i, j; - int val; - - /* Try ONFI for unknown chip or LP */ -@@ -3072,18 +3072,10 @@ static int nand_flash_detect_onfi(struct mtd_info *mtd, struct nand_chip *chip, - chip->read_byte(mtd) != 'F' || chip->read_byte(mtd) != 'I') - return 0; - -- /* -- * ONFI must be probed in 8-bit mode or with NAND_BUSWIDTH_AUTO, not -- * with NAND_BUSWIDTH_16 -- */ -- if (chip->options & NAND_BUSWIDTH_16) { -- pr_err("ONFI cannot be probed in 16-bit mode; aborting\n"); -- return 0; -- } -- - chip->cmdfunc(mtd, NAND_CMD_PARAM, 0, -1); - for (i = 0; i < 3; i++) { -- chip->read_buf(mtd, (uint8_t *)p, sizeof(*p)); -+ for (j = 0; j < sizeof(*p); j++) -+ ((uint8_t *)p)[j] = chip->read_byte(mtd); - if (onfi_crc16(ONFI_CRC_BASE, (uint8_t *)p, 254) == - le16_to_cpu(p->crc)) { - break; -diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c -index 5924f72dd493..f35ce8e50e65 100644 ---- a/drivers/net/wireless/ath/ath9k/main.c -+++ b/drivers/net/wireless/ath/ath9k/main.c -@@ -205,11 +205,13 @@ static bool ath_prepare_reset(struct ath_softc *sc) - ath_stop_ani(sc); - ath9k_hw_disable_interrupts(ah); - -- if (!ath_drain_all_txq(sc)) -- ret = false; -- -- if (!ath_stoprecv(sc)) -- ret = false; -+ if (AR_SREV_9300_20_OR_LATER(ah)) { -+ ret &= ath_stoprecv(sc); -+ ret &= ath_drain_all_txq(sc); -+ } else { -+ ret &= ath_drain_all_txq(sc); -+ ret &= ath_stoprecv(sc); -+ } - - return ret; - } -diff --git a/drivers/of/base.c b/drivers/of/base.c -index 3935614274eb..e99f329c905e 100644 ---- a/drivers/of/base.c -+++ b/drivers/of/base.c -@@ -77,7 +77,7 @@ EXPORT_SYMBOL(of_n_size_cells); - #ifdef CONFIG_NUMA - int __weak of_node_to_nid(struct device_node *np) - { -- return numa_node_id(); -+ return NUMA_NO_NODE; - } - #endif - -diff --git a/drivers/pcmcia/topic.h b/drivers/pcmcia/topic.h -index 615a45a8fe86..582688fe7505 100644 ---- a/drivers/pcmcia/topic.h -+++ b/drivers/pcmcia/topic.h -@@ -104,6 +104,9 @@ - #define TOPIC_EXCA_IF_CONTROL 0x3e /* 8 bit */ - #define TOPIC_EXCA_IFC_33V_ENA 0x01 - -+#define TOPIC_PCI_CFG_PPBCN 0x3e /* 16-bit */ -+#define TOPIC_PCI_CFG_PPBCN_WBEN 0x0400 -+ - static void topic97_zoom_video(struct pcmcia_socket *sock, int onoff) - { - struct yenta_socket *socket = container_of(sock, struct yenta_socket, socket); -@@ -138,6 +141,7 @@ static int topic97_override(struct yenta_socket *socket) - static int topic95_override(struct yenta_socket *socket) - { - u8 fctrl; -+ u16 ppbcn; - - /* enable 3.3V support for 16bit cards */ - fctrl = exca_readb(socket, TOPIC_EXCA_IF_CONTROL); -@@ -146,6 +150,18 @@ static int topic95_override(struct yenta_socket *socket) - /* tell yenta to use exca registers to power 16bit cards */ - socket->flags |= YENTA_16BIT_POWER_EXCA | YENTA_16BIT_POWER_DF; - -+ /* Disable write buffers to prevent lockups under load with numerous -+ Cardbus cards, observed on Tecra 500CDT and reported elsewhere on the -+ net. This is not a power-on default according to the datasheet -+ but some BIOSes seem to set it. */ -+ if (pci_read_config_word(socket->dev, TOPIC_PCI_CFG_PPBCN, &ppbcn) == 0 -+ && socket->dev->revision <= 7 -+ && (ppbcn & TOPIC_PCI_CFG_PPBCN_WBEN)) { -+ ppbcn &= ~TOPIC_PCI_CFG_PPBCN_WBEN; -+ pci_write_config_word(socket->dev, TOPIC_PCI_CFG_PPBCN, ppbcn); -+ dev_info(&socket->dev->dev, "Disabled ToPIC95 Cardbus write buffers.\n"); -+ } -+ - return 0; - } - -diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-370.c b/drivers/pinctrl/mvebu/pinctrl-armada-370.c -index ae1f760cbdd2..bb525b19be77 100644 ---- a/drivers/pinctrl/mvebu/pinctrl-armada-370.c -+++ b/drivers/pinctrl/mvebu/pinctrl-armada-370.c -@@ -358,11 +358,11 @@ static struct mvebu_mpp_mode mv88f6710_mpp_modes[] = { - MPP_MODE(64, - MPP_FUNCTION(0x0, "gpio", NULL), - MPP_FUNCTION(0x1, "spi0", "miso"), -- MPP_FUNCTION(0x2, "spi0-1", "cs1")), -+ MPP_FUNCTION(0x2, "spi0", "cs1")), - MPP_MODE(65, - MPP_FUNCTION(0x0, "gpio", NULL), - MPP_FUNCTION(0x1, "spi0", "mosi"), -- MPP_FUNCTION(0x2, "spi0-1", "cs2")), -+ MPP_FUNCTION(0x2, "spi0", "cs2")), - }; - - static struct mvebu_pinctrl_soc_info armada_370_pinctrl_info; -diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-xp.c b/drivers/pinctrl/mvebu/pinctrl-armada-xp.c -index 843a51f9d129..d918c5186061 100644 ---- a/drivers/pinctrl/mvebu/pinctrl-armada-xp.c -+++ b/drivers/pinctrl/mvebu/pinctrl-armada-xp.c -@@ -14,10 +14,7 @@ - * available: mv78230, mv78260 and mv78460. From a pin muxing - * perspective, the mv78230 has 49 MPP pins. The mv78260 and mv78460 - * both have 67 MPP pins (more GPIOs and address lines for the memory -- * bus mainly). The only difference between the mv78260 and the -- * mv78460 in terms of pin muxing is the addition of two functions on -- * pins 43 and 56 to access the VDD of the CPU2 and 3 (mv78260 has two -- * cores, mv78460 has four cores). -+ * bus mainly). - */ - - #include -@@ -159,20 +156,17 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = { - MPP_MODE(24, - MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x1, "sata1", "prsnt", V_MV78230_PLUS), -- MPP_VAR_FUNCTION(0x2, "nf", "bootcs-re", V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x3, "tdm", "rst", V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x4, "lcd", "hsync", V_MV78230_PLUS)), - MPP_MODE(25, - MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x1, "sata0", "prsnt", V_MV78230_PLUS), -- MPP_VAR_FUNCTION(0x2, "nf", "bootcs-we", V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x3, "tdm", "pclk", V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x4, "lcd", "vsync", V_MV78230_PLUS)), - MPP_MODE(26, - MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x3, "tdm", "fsync", V_MV78230_PLUS), -- MPP_VAR_FUNCTION(0x4, "lcd", "clk", V_MV78230_PLUS), -- MPP_VAR_FUNCTION(0x5, "vdd", "cpu1-pd", V_MV78230_PLUS)), -+ MPP_VAR_FUNCTION(0x4, "lcd", "clk", V_MV78230_PLUS)), - MPP_MODE(27, - MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x1, "ptp", "trig", V_MV78230_PLUS), -@@ -187,8 +181,7 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = { - MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x1, "ptp", "clk", V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x3, "tdm", "int0", V_MV78230_PLUS), -- MPP_VAR_FUNCTION(0x4, "lcd", "ref-clk", V_MV78230_PLUS), -- MPP_VAR_FUNCTION(0x5, "vdd", "cpu0-pd", V_MV78230_PLUS)), -+ MPP_VAR_FUNCTION(0x4, "lcd", "ref-clk", V_MV78230_PLUS)), - MPP_MODE(30, - MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x1, "sd0", "clk", V_MV78230_PLUS), -@@ -196,13 +189,11 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = { - MPP_MODE(31, - MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x1, "sd0", "cmd", V_MV78230_PLUS), -- MPP_VAR_FUNCTION(0x3, "tdm", "int2", V_MV78230_PLUS), -- MPP_VAR_FUNCTION(0x5, "vdd", "cpu0-pd", V_MV78230_PLUS)), -+ MPP_VAR_FUNCTION(0x3, "tdm", "int2", V_MV78230_PLUS)), - MPP_MODE(32, - MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x1, "sd0", "d0", V_MV78230_PLUS), -- MPP_VAR_FUNCTION(0x3, "tdm", "int3", V_MV78230_PLUS), -- MPP_VAR_FUNCTION(0x5, "vdd", "cpu1-pd", V_MV78230_PLUS)), -+ MPP_VAR_FUNCTION(0x3, "tdm", "int3", V_MV78230_PLUS)), - MPP_MODE(33, - MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x1, "sd0", "d1", V_MV78230_PLUS), -@@ -234,7 +225,6 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = { - MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x1, "spi", "cs1", V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x2, "uart2", "cts", V_MV78230_PLUS), -- MPP_VAR_FUNCTION(0x3, "vdd", "cpu1-pd", V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x4, "lcd", "vga-hsync", V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x5, "pcie", "clkreq0", V_MV78230_PLUS)), - MPP_MODE(41, -@@ -249,15 +239,13 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = { - MPP_VAR_FUNCTION(0x1, "uart2", "rxd", V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x2, "uart0", "cts", V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x3, "tdm", "int7", V_MV78230_PLUS), -- MPP_VAR_FUNCTION(0x4, "tdm-1", "timer", V_MV78230_PLUS), -- MPP_VAR_FUNCTION(0x5, "vdd", "cpu0-pd", V_MV78230_PLUS)), -+ MPP_VAR_FUNCTION(0x4, "tdm-1", "timer", V_MV78230_PLUS)), - MPP_MODE(43, - MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x1, "uart2", "txd", V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x2, "uart0", "rts", V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x3, "spi", "cs3", V_MV78230_PLUS), -- MPP_VAR_FUNCTION(0x4, "pcie", "rstout", V_MV78230_PLUS), -- MPP_VAR_FUNCTION(0x5, "vdd", "cpu2-3-pd", V_MV78460)), -+ MPP_VAR_FUNCTION(0x4, "pcie", "rstout", V_MV78230_PLUS)), - MPP_MODE(44, - MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x1, "uart2", "cts", V_MV78230_PLUS), -@@ -286,7 +274,7 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = { - MPP_VAR_FUNCTION(0x5, "pcie", "clkreq3", V_MV78230_PLUS)), - MPP_MODE(48, - MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), -- MPP_VAR_FUNCTION(0x1, "tclk", NULL, V_MV78230_PLUS), -+ MPP_VAR_FUNCTION(0x1, "dev", "clkout", V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x2, "dev", "burst/last", V_MV78230_PLUS)), - MPP_MODE(49, - MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS), -@@ -308,16 +296,13 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = { - MPP_VAR_FUNCTION(0x1, "dev", "ad19", V_MV78260_PLUS)), - MPP_MODE(55, - MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS), -- MPP_VAR_FUNCTION(0x1, "dev", "ad20", V_MV78260_PLUS), -- MPP_VAR_FUNCTION(0x2, "vdd", "cpu0-pd", V_MV78260_PLUS)), -+ MPP_VAR_FUNCTION(0x1, "dev", "ad20", V_MV78260_PLUS)), - MPP_MODE(56, - MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS), -- MPP_VAR_FUNCTION(0x1, "dev", "ad21", V_MV78260_PLUS), -- MPP_VAR_FUNCTION(0x2, "vdd", "cpu1-pd", V_MV78260_PLUS)), -+ MPP_VAR_FUNCTION(0x1, "dev", "ad21", V_MV78260_PLUS)), - MPP_MODE(57, - MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS), -- MPP_VAR_FUNCTION(0x1, "dev", "ad22", V_MV78260_PLUS), -- MPP_VAR_FUNCTION(0x2, "vdd", "cpu2-3-pd", V_MV78460)), -+ MPP_VAR_FUNCTION(0x1, "dev", "ad22", V_MV78260_PLUS)), - MPP_MODE(58, - MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS), - MPP_VAR_FUNCTION(0x1, "dev", "ad23", V_MV78260_PLUS)), -diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c -index fed4111ac31a..1beb232ef03b 100644 ---- a/drivers/platform/x86/dell-laptop.c -+++ b/drivers/platform/x86/dell-laptop.c -@@ -272,7 +272,6 @@ static struct dmi_system_id dell_quirks[] = { - }; - - static struct calling_interface_buffer *buffer; --static struct page *bufferpage; - static DEFINE_MUTEX(buffer_mutex); - - static int hwswitch_state; -@@ -825,12 +824,11 @@ static int __init dell_init(void) - * Allocate buffer below 4GB for SMI data--only 32-bit physical addr - * is passed to SMI handler. - */ -- bufferpage = alloc_page(GFP_KERNEL | GFP_DMA32); -- if (!bufferpage) { -+ buffer = (void *)__get_free_page(GFP_KERNEL | GFP_DMA32); -+ if (!buffer) { - ret = -ENOMEM; - goto fail_buffer; - } -- buffer = page_address(bufferpage); - - ret = dell_setup_rfkill(); - -@@ -892,7 +890,7 @@ fail_backlight: - cancel_delayed_work_sync(&dell_rfkill_work); - dell_cleanup_rfkill(); - fail_rfkill: -- free_page((unsigned long)bufferpage); -+ free_page((unsigned long)buffer); - fail_buffer: - platform_device_del(platform_device); - fail_platform_device2: -diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c -index 6dd060a0bb65..0d1a5d497ce0 100644 ---- a/drivers/platform/x86/ideapad-laptop.c -+++ b/drivers/platform/x86/ideapad-laptop.c -@@ -461,8 +461,9 @@ const struct ideapad_rfk_data ideapad_rfk_data[] = { - static int ideapad_rfk_set(void *data, bool blocked) - { - struct ideapad_rfk_priv *priv = data; -+ int opcode = ideapad_rfk_data[priv->dev].opcode; - -- return write_ec_cmd(priv->priv->adev->handle, priv->dev, !blocked); -+ return write_ec_cmd(priv->priv->adev->handle, opcode, !blocked); - } - - static struct rfkill_ops ideapad_rfk_ops = { -diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c -index 5d8d2dcd975e..427cb625af0a 100644 ---- a/drivers/regulator/core.c -+++ b/drivers/regulator/core.c -@@ -773,7 +773,7 @@ static int suspend_prepare(struct regulator_dev *rdev, suspend_state_t state) - static void print_constraints(struct regulator_dev *rdev) - { - struct regulation_constraints *constraints = rdev->constraints; -- char buf[80] = ""; -+ char buf[160] = ""; - int count = 0; - int ret; - -diff --git a/drivers/scsi/ipr.h b/drivers/scsi/ipr.h -index 0801f3df4b27..02edae714b0e 100644 ---- a/drivers/scsi/ipr.h -+++ b/drivers/scsi/ipr.h -@@ -264,7 +264,7 @@ - #define IPR_RUNTIME_RESET 0x40000000 - - #define IPR_IPL_INIT_MIN_STAGE_TIME 5 --#define IPR_IPL_INIT_DEFAULT_STAGE_TIME 15 -+#define IPR_IPL_INIT_DEFAULT_STAGE_TIME 30 - #define IPR_IPL_INIT_STAGE_UNKNOWN 0x0 - #define IPR_IPL_INIT_STAGE_TRANSOP 0xB0000000 - #define IPR_IPL_INIT_STAGE_MASK 0xff000000 -diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c -index 0a1dcb43d18b..13f4bef214dc 100644 ---- a/drivers/scsi/qla2xxx/qla_isr.c -+++ b/drivers/scsi/qla2xxx/qla_isr.c -@@ -572,8 +572,9 @@ qla2x00_async_event(scsi_qla_host_t *vha, struct rsp_que *rsp, uint16_t *mb) - struct device_reg_2xxx __iomem *reg = &ha->iobase->isp; - struct device_reg_24xx __iomem *reg24 = &ha->iobase->isp24; - struct device_reg_82xx __iomem *reg82 = &ha->iobase->isp82; -- uint32_t rscn_entry, host_pid; -+ uint32_t rscn_entry, host_pid, tmp_pid; - unsigned long flags; -+ fc_port_t *fcport = NULL; - - /* Setup to process RIO completion. */ - handle_cnt = 0; -@@ -968,6 +969,20 @@ skip_rio: - if (qla2x00_is_a_vp_did(vha, rscn_entry)) - break; - -+ /* -+ * Search for the rport related to this RSCN entry and mark it -+ * as lost. -+ */ -+ list_for_each_entry(fcport, &vha->vp_fcports, list) { -+ if (atomic_read(&fcport->state) != FCS_ONLINE) -+ continue; -+ tmp_pid = fcport->d_id.b24; -+ if (fcport->d_id.b24 == rscn_entry) { -+ qla2x00_mark_device_lost(vha, fcport, 0, 0); -+ break; -+ } -+ } -+ - atomic_set(&vha->loop_down_timer, 0); - vha->flags.management_server_logged_in = 0; - -diff --git a/drivers/scsi/scsi_transport_srp.c b/drivers/scsi/scsi_transport_srp.c -index e3e794ee7ddd..b85eaa0d75c2 100644 ---- a/drivers/scsi/scsi_transport_srp.c -+++ b/drivers/scsi/scsi_transport_srp.c -@@ -397,6 +397,36 @@ static void srp_reconnect_work(struct work_struct *work) - } - } - -+/** -+ * scsi_request_fn_active() - number of kernel threads inside scsi_request_fn() -+ * @shost: SCSI host for which to count the number of scsi_request_fn() callers. -+ * -+ * To do: add support for scsi-mq in this function. -+ */ -+static int scsi_request_fn_active(struct Scsi_Host *shost) -+{ -+ struct scsi_device *sdev; -+ struct request_queue *q; -+ int request_fn_active = 0; -+ -+ shost_for_each_device(sdev, shost) { -+ q = sdev->request_queue; -+ -+ spin_lock_irq(q->queue_lock); -+ request_fn_active += q->request_fn_active; -+ spin_unlock_irq(q->queue_lock); -+ } -+ -+ return request_fn_active; -+} -+ -+/* Wait until ongoing shost->hostt->queuecommand() calls have finished. */ -+static void srp_wait_for_queuecommand(struct Scsi_Host *shost) -+{ -+ while (scsi_request_fn_active(shost)) -+ msleep(20); -+} -+ - static void __rport_fail_io_fast(struct srp_rport *rport) - { - struct Scsi_Host *shost = rport_to_shost(rport); -@@ -410,8 +440,10 @@ static void __rport_fail_io_fast(struct srp_rport *rport) - - /* Involve the LLD if possible to terminate all I/O on the rport. */ - i = to_srp_internal(shost->transportt); -- if (i->f->terminate_rport_io) -+ if (i->f->terminate_rport_io) { -+ srp_wait_for_queuecommand(shost); - i->f->terminate_rport_io(rport); -+ } - } - - /** -@@ -505,27 +537,6 @@ void srp_start_tl_fail_timers(struct srp_rport *rport) - EXPORT_SYMBOL(srp_start_tl_fail_timers); - - /** -- * scsi_request_fn_active() - number of kernel threads inside scsi_request_fn() -- * @shost: SCSI host for which to count the number of scsi_request_fn() callers. -- */ --static int scsi_request_fn_active(struct Scsi_Host *shost) --{ -- struct scsi_device *sdev; -- struct request_queue *q; -- int request_fn_active = 0; -- -- shost_for_each_device(sdev, shost) { -- q = sdev->request_queue; -- -- spin_lock_irq(q->queue_lock); -- request_fn_active += q->request_fn_active; -- spin_unlock_irq(q->queue_lock); -- } -- -- return request_fn_active; --} -- --/** - * srp_reconnect_rport() - reconnect to an SRP target port - * @rport: SRP target port. - * -@@ -560,8 +571,7 @@ int srp_reconnect_rport(struct srp_rport *rport) - if (res) - goto out; - scsi_target_block(&shost->shost_gendev); -- while (scsi_request_fn_active(shost)) -- msleep(20); -+ srp_wait_for_queuecommand(shost); - res = rport->state != SRP_RPORT_LOST ? i->f->reconnect(rport) : -ENODEV; - pr_debug("%s (state %d): transport.reconnect() returned %d\n", - dev_name(&shost->shost_gendev), rport->state, res); -diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c -index d6563ec700d4..f3e3ae8af709 100644 ---- a/drivers/spi/spi.c -+++ b/drivers/spi/spi.c -@@ -834,9 +834,6 @@ void spi_finalize_current_message(struct spi_master *master) - - spin_lock_irqsave(&master->queue_lock, flags); - mesg = master->cur_msg; -- master->cur_msg = NULL; -- -- queue_kthread_work(&master->kworker, &master->pump_messages); - spin_unlock_irqrestore(&master->queue_lock, flags); - - if (master->cur_msg_prepared && master->unprepare_message) { -@@ -847,9 +844,13 @@ void spi_finalize_current_message(struct spi_master *master) - } - } - -- trace_spi_message_done(mesg); -- -+ spin_lock_irqsave(&master->queue_lock, flags); -+ master->cur_msg = NULL; - master->cur_msg_prepared = false; -+ queue_kthread_work(&master->kworker, &master->pump_messages); -+ spin_unlock_irqrestore(&master->queue_lock, flags); -+ -+ trace_spi_message_done(mesg); - - mesg->state = NULL; - if (mesg->complete) -diff --git a/drivers/staging/rtl8712/rtl8712_recv.c b/drivers/staging/rtl8712/rtl8712_recv.c -index ea965370d1ac..d060b1f4f092 100644 ---- a/drivers/staging/rtl8712/rtl8712_recv.c -+++ b/drivers/staging/rtl8712/rtl8712_recv.c -@@ -1075,7 +1075,8 @@ static int recvbuf2recvframe(struct _adapter *padapter, struct sk_buff *pskb) - /* for first fragment packet, driver need allocate 1536 + - * drvinfo_sz + RXDESC_SIZE to defrag packet. */ - if ((mf == 1) && (frag == 0)) -- alloc_sz = 1658;/*1658+6=1664, 1664 is 128 alignment.*/ -+ /*1658+6=1664, 1664 is 128 alignment.*/ -+ alloc_sz = max_t(u16, tmp_len, 1658); - else - alloc_sz = tmp_len; - /* 2 is for IP header 4 bytes alignment in QoS packet case. -diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c -index b61c555a5a8f..c8d7b3009c7e 100644 ---- a/drivers/target/iscsi/iscsi_target.c -+++ b/drivers/target/iscsi/iscsi_target.c -@@ -518,7 +518,7 @@ static struct iscsit_transport iscsi_target_transport = { - - static int __init iscsi_target_init_module(void) - { -- int ret = 0; -+ int ret = 0, size; - - pr_debug("iSCSI-Target "ISCSIT_VERSION"\n"); - -@@ -527,6 +527,7 @@ static int __init iscsi_target_init_module(void) - pr_err("Unable to allocate memory for iscsit_global\n"); - return -1; - } -+ spin_lock_init(&iscsit_global->ts_bitmap_lock); - mutex_init(&auth_id_lock); - spin_lock_init(&sess_idr_lock); - idr_init(&tiqn_idr); -@@ -536,15 +537,11 @@ static int __init iscsi_target_init_module(void) - if (ret < 0) - goto out; - -- ret = iscsi_thread_set_init(); -- if (ret < 0) -+ size = BITS_TO_LONGS(ISCSIT_BITMAP_BITS) * sizeof(long); -+ iscsit_global->ts_bitmap = vzalloc(size); -+ if (!iscsit_global->ts_bitmap) { -+ pr_err("Unable to allocate iscsit_global->ts_bitmap\n"); - goto configfs_out; -- -- if (iscsi_allocate_thread_sets(TARGET_THREAD_SET_COUNT) != -- TARGET_THREAD_SET_COUNT) { -- pr_err("iscsi_allocate_thread_sets() returned" -- " unexpected value!\n"); -- goto ts_out1; - } - - lio_qr_cache = kmem_cache_create("lio_qr_cache", -@@ -553,7 +550,7 @@ static int __init iscsi_target_init_module(void) - if (!lio_qr_cache) { - pr_err("nable to kmem_cache_create() for" - " lio_qr_cache\n"); -- goto ts_out2; -+ goto bitmap_out; - } - - lio_dr_cache = kmem_cache_create("lio_dr_cache", -@@ -597,10 +594,8 @@ dr_out: - kmem_cache_destroy(lio_dr_cache); - qr_out: - kmem_cache_destroy(lio_qr_cache); --ts_out2: -- iscsi_deallocate_thread_sets(); --ts_out1: -- iscsi_thread_set_free(); -+bitmap_out: -+ vfree(iscsit_global->ts_bitmap); - configfs_out: - iscsi_target_deregister_configfs(); - out: -@@ -610,8 +605,6 @@ out: - - static void __exit iscsi_target_cleanup_module(void) - { -- iscsi_deallocate_thread_sets(); -- iscsi_thread_set_free(); - iscsit_release_discovery_tpg(); - iscsit_unregister_transport(&iscsi_target_transport); - kmem_cache_destroy(lio_qr_cache); -@@ -621,6 +614,7 @@ static void __exit iscsi_target_cleanup_module(void) - - iscsi_target_deregister_configfs(); - -+ vfree(iscsit_global->ts_bitmap); - kfree(iscsit_global); - } - -@@ -3653,17 +3647,16 @@ static int iscsit_send_reject( - - void iscsit_thread_get_cpumask(struct iscsi_conn *conn) - { -- struct iscsi_thread_set *ts = conn->thread_set; - int ord, cpu; - /* -- * thread_id is assigned from iscsit_global->ts_bitmap from -- * within iscsi_thread_set.c:iscsi_allocate_thread_sets() -+ * bitmap_id is assigned from iscsit_global->ts_bitmap from -+ * within iscsit_start_kthreads() - * -- * Here we use thread_id to determine which CPU that this -- * iSCSI connection's iscsi_thread_set will be scheduled to -+ * Here we use bitmap_id to determine which CPU that this -+ * iSCSI connection's RX/TX threads will be scheduled to - * execute upon. - */ -- ord = ts->thread_id % cpumask_weight(cpu_online_mask); -+ ord = conn->bitmap_id % cpumask_weight(cpu_online_mask); - for_each_online_cpu(cpu) { - if (ord-- == 0) { - cpumask_set_cpu(cpu, conn->conn_cpumask); -@@ -3855,7 +3848,7 @@ check_rsp_state: - switch (state) { - case ISTATE_SEND_LOGOUTRSP: - if (!iscsit_logout_post_handler(cmd, conn)) -- goto restart; -+ return -ECONNRESET; - /* fall through */ - case ISTATE_SEND_STATUS: - case ISTATE_SEND_ASYNCMSG: -@@ -3883,8 +3876,6 @@ check_rsp_state: - - err: - return -1; --restart: -- return -EAGAIN; - } - - static int iscsit_handle_response_queue(struct iscsi_conn *conn) -@@ -3911,21 +3902,13 @@ static int iscsit_handle_response_queue(struct iscsi_conn *conn) - int iscsi_target_tx_thread(void *arg) - { - int ret = 0; -- struct iscsi_conn *conn; -- struct iscsi_thread_set *ts = arg; -+ struct iscsi_conn *conn = arg; - /* - * Allow ourselves to be interrupted by SIGINT so that a - * connection recovery / failure event can be triggered externally. - */ - allow_signal(SIGINT); - --restart: -- conn = iscsi_tx_thread_pre_handler(ts); -- if (!conn) -- goto out; -- -- ret = 0; -- - while (!kthread_should_stop()) { - /* - * Ensure that both TX and RX per connection kthreads -@@ -3934,11 +3917,9 @@ restart: - iscsit_thread_check_cpumask(conn, current, 1); - - wait_event_interruptible(conn->queues_wq, -- !iscsit_conn_all_queues_empty(conn) || -- ts->status == ISCSI_THREAD_SET_RESET); -+ !iscsit_conn_all_queues_empty(conn)); - -- if ((ts->status == ISCSI_THREAD_SET_RESET) || -- signal_pending(current)) -+ if (signal_pending(current)) - goto transport_err; - - get_immediate: -@@ -3949,15 +3930,14 @@ get_immediate: - ret = iscsit_handle_response_queue(conn); - if (ret == 1) - goto get_immediate; -- else if (ret == -EAGAIN) -- goto restart; -+ else if (ret == -ECONNRESET) -+ goto out; - else if (ret < 0) - goto transport_err; - } - - transport_err: - iscsit_take_action_for_connection_exit(conn); -- goto restart; - out: - return 0; - } -@@ -4046,8 +4026,7 @@ int iscsi_target_rx_thread(void *arg) - int ret; - u8 buffer[ISCSI_HDR_LEN], opcode; - u32 checksum = 0, digest = 0; -- struct iscsi_conn *conn = NULL; -- struct iscsi_thread_set *ts = arg; -+ struct iscsi_conn *conn = arg; - struct kvec iov; - /* - * Allow ourselves to be interrupted by SIGINT so that a -@@ -4055,11 +4034,6 @@ int iscsi_target_rx_thread(void *arg) - */ - allow_signal(SIGINT); - --restart: -- conn = iscsi_rx_thread_pre_handler(ts); -- if (!conn) -- goto out; -- - if (conn->conn_transport->transport_type == ISCSI_INFINIBAND) { - struct completion comp; - int rc; -@@ -4069,7 +4043,7 @@ restart: - if (rc < 0) - goto transport_err; - -- goto out; -+ goto transport_err; - } - - while (!kthread_should_stop()) { -@@ -4145,8 +4119,6 @@ transport_err: - if (!signal_pending(current)) - atomic_set(&conn->transport_failed, 1); - iscsit_take_action_for_connection_exit(conn); -- goto restart; --out: - return 0; - } - -@@ -4208,7 +4180,24 @@ int iscsit_close_connection( - if (conn->conn_transport->transport_type == ISCSI_TCP) - complete(&conn->conn_logout_comp); - -- iscsi_release_thread_set(conn); -+ if (!strcmp(current->comm, ISCSI_RX_THREAD_NAME)) { -+ if (conn->tx_thread && -+ cmpxchg(&conn->tx_thread_active, true, false)) { -+ send_sig(SIGINT, conn->tx_thread, 1); -+ kthread_stop(conn->tx_thread); -+ } -+ } else if (!strcmp(current->comm, ISCSI_TX_THREAD_NAME)) { -+ if (conn->rx_thread && -+ cmpxchg(&conn->rx_thread_active, true, false)) { -+ send_sig(SIGINT, conn->rx_thread, 1); -+ kthread_stop(conn->rx_thread); -+ } -+ } -+ -+ spin_lock(&iscsit_global->ts_bitmap_lock); -+ bitmap_release_region(iscsit_global->ts_bitmap, conn->bitmap_id, -+ get_order(1)); -+ spin_unlock(&iscsit_global->ts_bitmap_lock); - - iscsit_stop_timers_for_cmds(conn); - iscsit_stop_nopin_response_timer(conn); -@@ -4487,15 +4476,13 @@ static void iscsit_logout_post_handler_closesession( - struct iscsi_conn *conn) - { - struct iscsi_session *sess = conn->sess; -- -- iscsi_set_thread_clear(conn, ISCSI_CLEAR_TX_THREAD); -- iscsi_set_thread_set_signal(conn, ISCSI_SIGNAL_TX_THREAD); -+ int sleep = cmpxchg(&conn->tx_thread_active, true, false); - - atomic_set(&conn->conn_logout_remove, 0); - complete(&conn->conn_logout_comp); - - iscsit_dec_conn_usage_count(conn); -- iscsit_stop_session(sess, 1, 1); -+ iscsit_stop_session(sess, sleep, sleep); - iscsit_dec_session_usage_count(sess); - target_put_session(sess->se_sess); - } -@@ -4503,13 +4490,12 @@ static void iscsit_logout_post_handler_closesession( - static void iscsit_logout_post_handler_samecid( - struct iscsi_conn *conn) - { -- iscsi_set_thread_clear(conn, ISCSI_CLEAR_TX_THREAD); -- iscsi_set_thread_set_signal(conn, ISCSI_SIGNAL_TX_THREAD); -+ int sleep = cmpxchg(&conn->tx_thread_active, true, false); - - atomic_set(&conn->conn_logout_remove, 0); - complete(&conn->conn_logout_comp); - -- iscsit_cause_connection_reinstatement(conn, 1); -+ iscsit_cause_connection_reinstatement(conn, sleep); - iscsit_dec_conn_usage_count(conn); - } - -diff --git a/drivers/target/iscsi/iscsi_target_core.h b/drivers/target/iscsi/iscsi_target_core.h -index 1d4a8c86551f..825b579ebca8 100644 ---- a/drivers/target/iscsi/iscsi_target_core.h -+++ b/drivers/target/iscsi/iscsi_target_core.h -@@ -601,6 +601,11 @@ struct iscsi_conn { - struct iscsi_session *sess; - /* Pointer to thread_set in use for this conn's threads */ - struct iscsi_thread_set *thread_set; -+ int bitmap_id; -+ int rx_thread_active; -+ struct task_struct *rx_thread; -+ int tx_thread_active; -+ struct task_struct *tx_thread; - /* list_head for session connection list */ - struct list_head conn_list; - } ____cacheline_aligned; -@@ -869,10 +874,12 @@ struct iscsit_global { - /* Unique identifier used for the authentication daemon */ - u32 auth_id; - u32 inactive_ts; -+#define ISCSIT_BITMAP_BITS 262144 - /* Thread Set bitmap count */ - int ts_bitmap_count; - /* Thread Set bitmap pointer */ - unsigned long *ts_bitmap; -+ spinlock_t ts_bitmap_lock; - /* Used for iSCSI discovery session authentication */ - struct iscsi_node_acl discovery_acl; - struct iscsi_portal_group *discovery_tpg; -diff --git a/drivers/target/iscsi/iscsi_target_erl0.c b/drivers/target/iscsi/iscsi_target_erl0.c -index 0d1e6ee3e992..7396d90d96b2 100644 ---- a/drivers/target/iscsi/iscsi_target_erl0.c -+++ b/drivers/target/iscsi/iscsi_target_erl0.c -@@ -864,7 +864,10 @@ void iscsit_connection_reinstatement_rcfr(struct iscsi_conn *conn) - } - spin_unlock_bh(&conn->state_lock); - -- iscsi_thread_set_force_reinstatement(conn); -+ if (conn->tx_thread && conn->tx_thread_active) -+ send_sig(SIGINT, conn->tx_thread, 1); -+ if (conn->rx_thread && conn->rx_thread_active) -+ send_sig(SIGINT, conn->rx_thread, 1); - - sleep: - wait_for_completion(&conn->conn_wait_rcfr_comp); -@@ -889,10 +892,10 @@ void iscsit_cause_connection_reinstatement(struct iscsi_conn *conn, int sleep) - return; - } - -- if (iscsi_thread_set_force_reinstatement(conn) < 0) { -- spin_unlock_bh(&conn->state_lock); -- return; -- } -+ if (conn->tx_thread && conn->tx_thread_active) -+ send_sig(SIGINT, conn->tx_thread, 1); -+ if (conn->rx_thread && conn->rx_thread_active) -+ send_sig(SIGINT, conn->rx_thread, 1); - - atomic_set(&conn->connection_reinstatement, 1); - if (!sleep) { -diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c -index c5d3811a7b8c..449df092bfa0 100644 ---- a/drivers/target/iscsi/iscsi_target_login.c -+++ b/drivers/target/iscsi/iscsi_target_login.c -@@ -681,6 +681,51 @@ static void iscsi_post_login_start_timers(struct iscsi_conn *conn) - iscsit_start_nopin_timer(conn); - } - -+int iscsit_start_kthreads(struct iscsi_conn *conn) -+{ -+ int ret = 0; -+ -+ spin_lock(&iscsit_global->ts_bitmap_lock); -+ conn->bitmap_id = bitmap_find_free_region(iscsit_global->ts_bitmap, -+ ISCSIT_BITMAP_BITS, get_order(1)); -+ spin_unlock(&iscsit_global->ts_bitmap_lock); -+ -+ if (conn->bitmap_id < 0) { -+ pr_err("bitmap_find_free_region() failed for" -+ " iscsit_start_kthreads()\n"); -+ return -ENOMEM; -+ } -+ -+ conn->tx_thread = kthread_run(iscsi_target_tx_thread, conn, -+ "%s", ISCSI_TX_THREAD_NAME); -+ if (IS_ERR(conn->tx_thread)) { -+ pr_err("Unable to start iscsi_target_tx_thread\n"); -+ ret = PTR_ERR(conn->tx_thread); -+ goto out_bitmap; -+ } -+ conn->tx_thread_active = true; -+ -+ conn->rx_thread = kthread_run(iscsi_target_rx_thread, conn, -+ "%s", ISCSI_RX_THREAD_NAME); -+ if (IS_ERR(conn->rx_thread)) { -+ pr_err("Unable to start iscsi_target_rx_thread\n"); -+ ret = PTR_ERR(conn->rx_thread); -+ goto out_tx; -+ } -+ conn->rx_thread_active = true; -+ -+ return 0; -+out_tx: -+ kthread_stop(conn->tx_thread); -+ conn->tx_thread_active = false; -+out_bitmap: -+ spin_lock(&iscsit_global->ts_bitmap_lock); -+ bitmap_release_region(iscsit_global->ts_bitmap, conn->bitmap_id, -+ get_order(1)); -+ spin_unlock(&iscsit_global->ts_bitmap_lock); -+ return ret; -+} -+ - int iscsi_post_login_handler( - struct iscsi_np *np, - struct iscsi_conn *conn, -@@ -691,7 +736,7 @@ int iscsi_post_login_handler( - struct se_session *se_sess = sess->se_sess; - struct iscsi_portal_group *tpg = sess->tpg; - struct se_portal_group *se_tpg = &tpg->tpg_se_tpg; -- struct iscsi_thread_set *ts; -+ int rc; - - iscsit_inc_conn_usage_count(conn); - -@@ -706,7 +751,6 @@ int iscsi_post_login_handler( - /* - * SCSI Initiator -> SCSI Target Port Mapping - */ -- ts = iscsi_get_thread_set(); - if (!zero_tsih) { - iscsi_set_session_parameters(sess->sess_ops, - conn->param_list, 0); -@@ -733,9 +777,11 @@ int iscsi_post_login_handler( - sess->sess_ops->InitiatorName); - spin_unlock_bh(&sess->conn_lock); - -- iscsi_post_login_start_timers(conn); -+ rc = iscsit_start_kthreads(conn); -+ if (rc) -+ return rc; - -- iscsi_activate_thread_set(conn, ts); -+ iscsi_post_login_start_timers(conn); - /* - * Determine CPU mask to ensure connection's RX and TX kthreads - * are scheduled on the same CPU. -@@ -792,8 +838,11 @@ int iscsi_post_login_handler( - " iSCSI Target Portal Group: %hu\n", tpg->nsessions, tpg->tpgt); - spin_unlock_bh(&se_tpg->session_lock); - -+ rc = iscsit_start_kthreads(conn); -+ if (rc) -+ return rc; -+ - iscsi_post_login_start_timers(conn); -- iscsi_activate_thread_set(conn, ts); - /* - * Determine CPU mask to ensure connection's RX and TX kthreads - * are scheduled on the same CPU. -diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c -index 45b7b96f9ed3..8016aaa158f2 100644 ---- a/drivers/usb/core/devio.c -+++ b/drivers/usb/core/devio.c -@@ -513,7 +513,7 @@ static void async_completed(struct urb *urb) - snoop(&urb->dev->dev, "urb complete\n"); - snoop_urb(urb->dev, as->userurb, urb->pipe, urb->actual_length, - as->status, COMPLETE, NULL, 0); -- if ((urb->transfer_flags & URB_DIR_MASK) == USB_DIR_IN) -+ if ((urb->transfer_flags & URB_DIR_MASK) == URB_DIR_IN) - snoop_urb_data(urb, urb->actual_length); - - if (as->status < 0 && as->bulk_addr && as->status != -ECONNRESET && -@@ -1591,7 +1591,7 @@ static struct async *reap_as(struct dev_state *ps) - for (;;) { - __set_current_state(TASK_INTERRUPTIBLE); - as = async_getcompleted(ps); -- if (as) -+ if (as || !connected(ps)) - break; - if (signal_pending(current)) - break; -@@ -1614,7 +1614,7 @@ static int proc_reapurb(struct dev_state *ps, void __user *arg) - } - if (signal_pending(current)) - return -EINTR; -- return -EIO; -+ return -ENODEV; - } - - static int proc_reapurbnonblock(struct dev_state *ps, void __user *arg) -@@ -1623,10 +1623,11 @@ static int proc_reapurbnonblock(struct dev_state *ps, void __user *arg) - struct async *as; - - as = async_getcompleted(ps); -- retval = -EAGAIN; - if (as) { - retval = processcompl(as, (void __user * __user *)arg); - free_async(as); -+ } else { -+ retval = (connected(ps) ? -EAGAIN : -ENODEV); - } - return retval; - } -@@ -1756,7 +1757,7 @@ static int proc_reapurb_compat(struct dev_state *ps, void __user *arg) - } - if (signal_pending(current)) - return -EINTR; -- return -EIO; -+ return -ENODEV; - } - - static int proc_reapurbnonblock_compat(struct dev_state *ps, void __user *arg) -@@ -1764,11 +1765,12 @@ static int proc_reapurbnonblock_compat(struct dev_state *ps, void __user *arg) - int retval; - struct async *as; - -- retval = -EAGAIN; - as = async_getcompleted(ps); - if (as) { - retval = processcompl_compat(as, (void __user * __user *)arg); - free_async(as); -+ } else { -+ retval = (connected(ps) ? -EAGAIN : -ENODEV); - } - return retval; - } -@@ -1940,7 +1942,8 @@ static int proc_get_capabilities(struct dev_state *ps, void __user *arg) - { - __u32 caps; - -- caps = USBDEVFS_CAP_ZERO_PACKET | USBDEVFS_CAP_NO_PACKET_SIZE_LIM; -+ caps = USBDEVFS_CAP_ZERO_PACKET | USBDEVFS_CAP_NO_PACKET_SIZE_LIM | -+ USBDEVFS_CAP_REAP_AFTER_DISCONNECT; - if (!ps->dev->bus->no_stop_on_short) - caps |= USBDEVFS_CAP_BULK_CONTINUATION; - if (ps->dev->bus->sg_tablesize) -@@ -2001,6 +2004,32 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd, - return -EPERM; - - usb_lock_device(dev); -+ -+ /* Reap operations are allowed even after disconnection */ -+ switch (cmd) { -+ case USBDEVFS_REAPURB: -+ snoop(&dev->dev, "%s: REAPURB\n", __func__); -+ ret = proc_reapurb(ps, p); -+ goto done; -+ -+ case USBDEVFS_REAPURBNDELAY: -+ snoop(&dev->dev, "%s: REAPURBNDELAY\n", __func__); -+ ret = proc_reapurbnonblock(ps, p); -+ goto done; -+ -+#ifdef CONFIG_COMPAT -+ case USBDEVFS_REAPURB32: -+ snoop(&dev->dev, "%s: REAPURB32\n", __func__); -+ ret = proc_reapurb_compat(ps, p); -+ goto done; -+ -+ case USBDEVFS_REAPURBNDELAY32: -+ snoop(&dev->dev, "%s: REAPURBNDELAY32\n", __func__); -+ ret = proc_reapurbnonblock_compat(ps, p); -+ goto done; -+#endif -+ } -+ - if (!connected(ps)) { - usb_unlock_device(dev); - return -ENODEV; -@@ -2094,16 +2123,6 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd, - inode->i_mtime = CURRENT_TIME; - break; - -- case USBDEVFS_REAPURB32: -- snoop(&dev->dev, "%s: REAPURB32\n", __func__); -- ret = proc_reapurb_compat(ps, p); -- break; -- -- case USBDEVFS_REAPURBNDELAY32: -- snoop(&dev->dev, "%s: REAPURBNDELAY32\n", __func__); -- ret = proc_reapurbnonblock_compat(ps, p); -- break; -- - case USBDEVFS_IOCTL32: - snoop(&dev->dev, "%s: IOCTL32\n", __func__); - ret = proc_ioctl_compat(ps, ptr_to_compat(p)); -@@ -2115,16 +2134,6 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd, - ret = proc_unlinkurb(ps, p); - break; - -- case USBDEVFS_REAPURB: -- snoop(&dev->dev, "%s: REAPURB\n", __func__); -- ret = proc_reapurb(ps, p); -- break; -- -- case USBDEVFS_REAPURBNDELAY: -- snoop(&dev->dev, "%s: REAPURBNDELAY\n", __func__); -- ret = proc_reapurbnonblock(ps, p); -- break; -- - case USBDEVFS_DISCSIGNAL: - snoop(&dev->dev, "%s: DISCSIGNAL\n", __func__); - ret = proc_disconnectsignal(ps, p); -@@ -2161,6 +2170,8 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd, - ret = proc_disconnect_claim(ps, p); - break; - } -+ -+ done: - usb_unlock_device(dev); - if (ret >= 0) - inode->i_atime = CURRENT_TIME; -diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c -index 0985ff715c0c..a05fc58d9b60 100644 ---- a/drivers/usb/dwc3/ep0.c -+++ b/drivers/usb/dwc3/ep0.c -@@ -707,6 +707,10 @@ static int dwc3_ep0_std_request(struct dwc3 *dwc, struct usb_ctrlrequest *ctrl) - dev_vdbg(dwc->dev, "USB_REQ_SET_ISOCH_DELAY\n"); - ret = dwc3_ep0_set_isoch_delay(dwc, ctrl); - break; -+ case USB_REQ_SET_INTERFACE: -+ dev_vdbg(dwc->dev, "USB_REQ_SET_INTERFACE\n"); -+ dwc->start_config_issued = false; -+ /* Fall through */ - default: - dev_vdbg(dwc->dev, "Forwarding to gadget driver\n"); - ret = dwc3_ep0_delegate_req(dwc, ctrl); -diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c -index 8f6738d46b14..a57ad1f52f79 100644 ---- a/drivers/usb/dwc3/gadget.c -+++ b/drivers/usb/dwc3/gadget.c -@@ -299,6 +299,8 @@ int dwc3_send_gadget_generic_command(struct dwc3 *dwc, int cmd, u32 param) - if (!(reg & DWC3_DGCMD_CMDACT)) { - dev_vdbg(dwc->dev, "Command Complete --> %d\n", - DWC3_DGCMD_STATUS(reg)); -+ if (DWC3_DGCMD_STATUS(reg)) -+ return -EINVAL; - return 0; - } - -@@ -335,6 +337,8 @@ int dwc3_send_gadget_ep_cmd(struct dwc3 *dwc, unsigned ep, - if (!(reg & DWC3_DEPCMD_CMDACT)) { - dev_vdbg(dwc->dev, "Command Complete --> %d\n", - DWC3_DEPCMD_STATUS(reg)); -+ if (DWC3_DEPCMD_STATUS(reg)) -+ return -EINVAL; - return 0; - } - -diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c -index 9bce4f0e99be..f8893b32bbb6 100644 ---- a/drivers/usb/host/xhci-mem.c -+++ b/drivers/usb/host/xhci-mem.c -@@ -1331,10 +1331,10 @@ int xhci_endpoint_init(struct xhci_hcd *xhci, - /* Attempt to use the ring cache */ - if (virt_dev->num_rings_cached == 0) - return -ENOMEM; -+ virt_dev->num_rings_cached--; - virt_dev->eps[ep_index].new_ring = - virt_dev->ring_cache[virt_dev->num_rings_cached]; - virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL; -- virt_dev->num_rings_cached--; - xhci_reinit_cached_ring(xhci, virt_dev->eps[ep_index].new_ring, - 1, type); - } -diff --git a/drivers/usb/musb/musb_virthub.c b/drivers/usb/musb/musb_virthub.c -index 0241a3a0d63e..1e9bde4fe785 100644 ---- a/drivers/usb/musb/musb_virthub.c -+++ b/drivers/usb/musb/musb_virthub.c -@@ -273,9 +273,7 @@ static int musb_has_gadget(struct musb *musb) - #ifdef CONFIG_USB_MUSB_HOST - return 1; - #else -- if (musb->port_mode == MUSB_PORT_MODE_HOST) -- return 1; -- return musb->g.dev.driver != NULL; -+ return musb->port_mode == MUSB_PORT_MODE_HOST; - #endif - } - -diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c -index 73c7292f48e5..d11335d4395d 100644 ---- a/drivers/usb/serial/cp210x.c -+++ b/drivers/usb/serial/cp210x.c -@@ -187,6 +187,7 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(0x1FB9, 0x0602) }, /* Lake Shore Model 648 Magnet Power Supply */ - { USB_DEVICE(0x1FB9, 0x0700) }, /* Lake Shore Model 737 VSM Controller */ - { USB_DEVICE(0x1FB9, 0x0701) }, /* Lake Shore Model 776 Hall Matrix */ -+ { USB_DEVICE(0x2626, 0xEA60) }, /* Aruba Networks 7xxx USB Serial Console */ - { USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */ - { USB_DEVICE(0x3195, 0xF280) }, /* Link Instruments MSO-28 */ - { USB_DEVICE(0x3195, 0xF281) }, /* Link Instruments MSO-28 */ -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index 8b3484134ab0..096438e4fb0c 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -1755,6 +1755,7 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) }, - { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ - { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ -+ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */ - { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) }, - { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) }, - { } /* Terminating entry */ -diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c -index 9a08e18e09b9..3d66e9c5a95d 100644 ---- a/drivers/usb/serial/usb-serial.c -+++ b/drivers/usb/serial/usb-serial.c -@@ -1300,6 +1300,7 @@ static void __exit usb_serial_exit(void) - tty_unregister_driver(usb_serial_tty_driver); - put_tty_driver(usb_serial_tty_driver); - bus_unregister(&usb_serial_bus_type); -+ idr_destroy(&serial_minors); - } - - -diff --git a/drivers/watchdog/omap_wdt.c b/drivers/watchdog/omap_wdt.c -index 09cf0135e8ac..90a6406111f5 100644 ---- a/drivers/watchdog/omap_wdt.c -+++ b/drivers/watchdog/omap_wdt.c -@@ -134,6 +134,13 @@ static int omap_wdt_start(struct watchdog_device *wdog) - - pm_runtime_get_sync(wdev->dev); - -+ /* -+ * Make sure the watchdog is disabled. This is unfortunately required -+ * because writing to various registers with the watchdog running has no -+ * effect. -+ */ -+ omap_wdt_disable(wdev); -+ - /* initialize prescaler */ - while (readl_relaxed(base + OMAP_WATCHDOG_WPS) & 0x01) - cpu_relax(); -diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c -index bb7991c7e5c7..bfdeadb7c243 100644 ---- a/fs/9p/vfs_inode.c -+++ b/fs/9p/vfs_inode.c -@@ -540,8 +540,7 @@ static struct inode *v9fs_qid_iget(struct super_block *sb, - unlock_new_inode(inode); - return inode; - error: -- unlock_new_inode(inode); -- iput(inode); -+ iget_failed(inode); - return ERR_PTR(retval); - - } -diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c -index 59dc8e87647f..de8606c3a9da 100644 ---- a/fs/9p/vfs_inode_dotl.c -+++ b/fs/9p/vfs_inode_dotl.c -@@ -149,8 +149,7 @@ static struct inode *v9fs_qid_iget_dotl(struct super_block *sb, - unlock_new_inode(inode); - return inode; - error: -- unlock_new_inode(inode); -- iput(inode); -+ iget_failed(inode); - return ERR_PTR(retval); - - } -diff --git a/fs/bio.c b/fs/bio.c -index 8754e7b6eb49..b2b1451912b5 100644 ---- a/fs/bio.c -+++ b/fs/bio.c -@@ -1806,8 +1806,9 @@ EXPORT_SYMBOL(bio_endio_nodec); - * Allocates and returns a new bio which represents @sectors from the start of - * @bio, and updates @bio to represent the remaining sectors. - * -- * The newly allocated bio will point to @bio's bi_io_vec; it is the caller's -- * responsibility to ensure that @bio is not freed before the split. -+ * Unless this is a discard request the newly allocated bio will point -+ * to @bio's bi_io_vec; it is the caller's responsibility to ensure that -+ * @bio is not freed before the split. - */ - struct bio *bio_split(struct bio *bio, int sectors, - gfp_t gfp, struct bio_set *bs) -@@ -1817,7 +1818,15 @@ struct bio *bio_split(struct bio *bio, int sectors, - BUG_ON(sectors <= 0); - BUG_ON(sectors >= bio_sectors(bio)); - -- split = bio_clone_fast(bio, gfp, bs); -+ /* -+ * Discards need a mutable bio_vec to accommodate the payload -+ * required by the DSM TRIM and UNMAP commands. -+ */ -+ if (bio->bi_rw & REQ_DISCARD) -+ split = bio_clone_bioset(bio, gfp, bs); -+ else -+ split = bio_clone_fast(bio, gfp, bs); -+ - if (!split) - return NULL; - -diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c -index ab485e57b6fe..644942aeaeda 100644 ---- a/fs/btrfs/inode-map.c -+++ b/fs/btrfs/inode-map.c -@@ -281,7 +281,7 @@ void btrfs_unpin_free_ino(struct btrfs_root *root) - __btrfs_add_free_space(ctl, info->offset, count); - free: - rb_erase(&info->offset_index, rbroot); -- kfree(info); -+ kmem_cache_free(btrfs_free_space_cachep, info); - } - } - -diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c -index 3e16042338e4..d40ae42ba6d4 100644 ---- a/fs/btrfs/ioctl.c -+++ b/fs/btrfs/ioctl.c -@@ -2743,7 +2743,7 @@ out_unlock: - static long btrfs_ioctl_file_extent_same(struct file *file, - struct btrfs_ioctl_same_args __user *argp) - { -- struct btrfs_ioctl_same_args *same; -+ struct btrfs_ioctl_same_args *same = NULL; - struct btrfs_ioctl_same_extent_info *info; - struct inode *src = file_inode(file); - u64 off; -@@ -2773,6 +2773,7 @@ static long btrfs_ioctl_file_extent_same(struct file *file, - - if (IS_ERR(same)) { - ret = PTR_ERR(same); -+ same = NULL; - goto out; - } - -@@ -2843,6 +2844,7 @@ static long btrfs_ioctl_file_extent_same(struct file *file, - - out: - mnt_drop_write_file(file); -+ kfree(same); - return ret; - } - -diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c -index e6574d7b6642..a7c5277a728f 100644 ---- a/fs/ext4/indirect.c -+++ b/fs/ext4/indirect.c -@@ -576,7 +576,7 @@ int ext4_ind_map_blocks(handle_t *handle, struct inode *inode, - EXT4_FEATURE_RO_COMPAT_BIGALLOC)) { - EXT4_ERROR_INODE(inode, "Can't allocate blocks for " - "non-extent mapped inodes with bigalloc"); -- return -ENOSPC; -+ return -EUCLEAN; - } - - goal = ext4_find_goal(inode, map->m_lblk, partial); -diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c -index da03340fdb17..f9c63ae7276a 100644 ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -1357,7 +1357,7 @@ static void ext4_da_page_release_reservation(struct page *page, - unsigned int offset, - unsigned int length) - { -- int to_release = 0; -+ int to_release = 0, contiguous_blks = 0; - struct buffer_head *head, *bh; - unsigned int curr_off = 0; - struct inode *inode = page->mapping->host; -@@ -1378,14 +1378,23 @@ static void ext4_da_page_release_reservation(struct page *page, - - if ((offset <= curr_off) && (buffer_delay(bh))) { - to_release++; -+ contiguous_blks++; - clear_buffer_delay(bh); -+ } else if (contiguous_blks) { -+ lblk = page->index << -+ (PAGE_CACHE_SHIFT - inode->i_blkbits); -+ lblk += (curr_off >> inode->i_blkbits) - -+ contiguous_blks; -+ ext4_es_remove_extent(inode, lblk, contiguous_blks); -+ contiguous_blks = 0; - } - curr_off = next_off; - } while ((bh = bh->b_this_page) != head); - -- if (to_release) { -+ if (contiguous_blks) { - lblk = page->index << (PAGE_CACHE_SHIFT - inode->i_blkbits); -- ext4_es_remove_extent(inode, lblk, to_release); -+ lblk += (curr_off >> inode->i_blkbits) - contiguous_blks; -+ ext4_es_remove_extent(inode, lblk, contiguous_blks); - } - - /* If we have released all the blocks belonging to a cluster, then we -@@ -1744,19 +1753,32 @@ static int __ext4_journalled_writepage(struct page *page, - ext4_walk_page_buffers(handle, page_bufs, 0, len, - NULL, bget_one); - } -- /* As soon as we unlock the page, it can go away, but we have -- * references to buffers so we are safe */ -+ /* -+ * We need to release the page lock before we start the -+ * journal, so grab a reference so the page won't disappear -+ * out from under us. -+ */ -+ get_page(page); - unlock_page(page); - - handle = ext4_journal_start(inode, EXT4_HT_WRITE_PAGE, - ext4_writepage_trans_blocks(inode)); - if (IS_ERR(handle)) { - ret = PTR_ERR(handle); -- goto out; -+ put_page(page); -+ goto out_no_pagelock; - } -- - BUG_ON(!ext4_handle_valid(handle)); - -+ lock_page(page); -+ put_page(page); -+ if (page->mapping != mapping) { -+ /* The page got truncated from under us */ -+ ext4_journal_stop(handle); -+ ret = 0; -+ goto out; -+ } -+ - if (inline_data) { - ret = ext4_journal_get_write_access(handle, inode_bh); - -@@ -1781,6 +1803,8 @@ static int __ext4_journalled_writepage(struct page *page, - NULL, bput_one); - ext4_set_inode_state(inode, EXT4_STATE_JDATA); - out: -+ unlock_page(page); -+out_no_pagelock: - brelse(inode_bh); - return ret; - } -diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c -index 7620133f78bf..c4a5e4df8ca3 100644 ---- a/fs/ext4/mballoc.c -+++ b/fs/ext4/mballoc.c -@@ -4793,18 +4793,12 @@ do_more: - /* - * blocks being freed are metadata. these blocks shouldn't - * be used until this transaction is committed -+ * -+ * We use __GFP_NOFAIL because ext4_free_blocks() is not allowed -+ * to fail. - */ -- retry: -- new_entry = kmem_cache_alloc(ext4_free_data_cachep, GFP_NOFS); -- if (!new_entry) { -- /* -- * We use a retry loop because -- * ext4_free_blocks() is not allowed to fail. -- */ -- cond_resched(); -- congestion_wait(BLK_RW_ASYNC, HZ/50); -- goto retry; -- } -+ new_entry = kmem_cache_alloc(ext4_free_data_cachep, -+ GFP_NOFS|__GFP_NOFAIL); - new_entry->efd_start_cluster = bit; - new_entry->efd_group = block_group; - new_entry->efd_count = count_clusters; -diff --git a/fs/ext4/migrate.c b/fs/ext4/migrate.c -index 2ae73a80c19b..be92ed2609bc 100644 ---- a/fs/ext4/migrate.c -+++ b/fs/ext4/migrate.c -@@ -616,6 +616,7 @@ int ext4_ind_migrate(struct inode *inode) - struct ext4_inode_info *ei = EXT4_I(inode); - struct ext4_extent *ex; - unsigned int i, len; -+ ext4_lblk_t start, end; - ext4_fsblk_t blk; - handle_t *handle; - int ret; -@@ -629,6 +630,14 @@ int ext4_ind_migrate(struct inode *inode) - EXT4_FEATURE_RO_COMPAT_BIGALLOC)) - return -EOPNOTSUPP; - -+ /* -+ * In order to get correct extent info, force all delayed allocation -+ * blocks to be allocated, otherwise delayed allocation blocks may not -+ * be reflected and bypass the checks on extent header. -+ */ -+ if (test_opt(inode->i_sb, DELALLOC)) -+ ext4_alloc_da_blocks(inode); -+ - handle = ext4_journal_start(inode, EXT4_HT_MIGRATE, 1); - if (IS_ERR(handle)) - return PTR_ERR(handle); -@@ -646,11 +655,13 @@ int ext4_ind_migrate(struct inode *inode) - goto errout; - } - if (eh->eh_entries == 0) -- blk = len = 0; -+ blk = len = start = end = 0; - else { - len = le16_to_cpu(ex->ee_len); - blk = ext4_ext_pblock(ex); -- if (len > EXT4_NDIR_BLOCKS) { -+ start = le32_to_cpu(ex->ee_block); -+ end = start + len - 1; -+ if (end >= EXT4_NDIR_BLOCKS) { - ret = -EOPNOTSUPP; - goto errout; - } -@@ -658,7 +669,7 @@ int ext4_ind_migrate(struct inode *inode) - - ext4_clear_inode_flag(inode, EXT4_INODE_EXTENTS); - memset(ei->i_data, 0, sizeof(ei->i_data)); -- for (i=0; i < len; i++) -+ for (i = start; i <= end; i++) - ei->i_data[i] = cpu_to_le32(blk++); - ext4_mark_inode_dirty(handle, inode); - errout: -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index 9fb3e6c0c578..a07af5b7a575 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -832,6 +832,7 @@ static void ext4_put_super(struct super_block *sb) - dump_orphan_list(sb, sbi); - J_ASSERT(list_empty(&sbi->s_orphan)); - -+ sync_blockdev(sb->s_bdev); - invalidate_bdev(sb->s_bdev); - if (sbi->journal_bdev && sbi->journal_bdev != sb->s_bdev) { - /* -diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c -index 73f6bcb44ea8..faf00af7f3d7 100644 ---- a/fs/fuse/inode.c -+++ b/fs/fuse/inode.c -@@ -1026,6 +1026,7 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent) - goto err_fput; - - fuse_conn_init(fc); -+ fc->release = fuse_free_conn; - - fc->dev = sb->s_dev; - fc->sb = sb; -@@ -1040,7 +1041,6 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent) - fc->dont_mask = 1; - sb->s_flags |= MS_POSIXACL; - -- fc->release = fuse_free_conn; - fc->flags = d.flags; - fc->user_id = d.user_id; - fc->group_id = d.group_id; -diff --git a/fs/hpfs/super.c b/fs/hpfs/super.c -index 4534ff688b76..77b583da187f 100644 ---- a/fs/hpfs/super.c -+++ b/fs/hpfs/super.c -@@ -52,17 +52,20 @@ static void unmark_dirty(struct super_block *s) - } - - /* Filesystem error... */ --static char err_buf[1024]; -- - void hpfs_error(struct super_block *s, const char *fmt, ...) - { -+ struct va_format vaf; - va_list args; - - va_start(args, fmt); -- vsnprintf(err_buf, sizeof(err_buf), fmt, args); -+ -+ vaf.fmt = fmt; -+ vaf.va = &args; -+ -+ pr_err("filesystem error: %pV", &vaf); -+ - va_end(args); - -- printk("HPFS: filesystem error: %s", err_buf); - if (!hpfs_sb(s)->sb_was_error) { - if (hpfs_sb(s)->sb_err == 2) { - printk("; crashing the system because you wanted it\n"); -diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c -index 7f34f4716165..b892355f1944 100644 ---- a/fs/jbd2/checkpoint.c -+++ b/fs/jbd2/checkpoint.c -@@ -448,7 +448,7 @@ int jbd2_cleanup_journal_tail(journal_t *journal) - unsigned long blocknr; - - if (is_journal_aborted(journal)) -- return 1; -+ return -EIO; - - if (!jbd2_journal_get_log_tail(journal, &first_tid, &blocknr)) - return 1; -@@ -463,10 +463,9 @@ int jbd2_cleanup_journal_tail(journal_t *journal) - * jbd2_cleanup_journal_tail() doesn't get called all that often. - */ - if (journal->j_flags & JBD2_BARRIER) -- blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL); -+ blkdev_issue_flush(journal->j_fs_dev, GFP_NOFS, NULL); - -- __jbd2_update_log_tail(journal, first_tid, blocknr); -- return 0; -+ return __jbd2_update_log_tail(journal, first_tid, blocknr); - } - - -diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c -index f2d78a3dae43..e8d62d742435 100644 ---- a/fs/jbd2/journal.c -+++ b/fs/jbd2/journal.c -@@ -885,9 +885,10 @@ int jbd2_journal_get_log_tail(journal_t *journal, tid_t *tid, - * - * Requires j_checkpoint_mutex - */ --void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block) -+int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block) - { - unsigned long freed; -+ int ret; - - BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex)); - -@@ -897,7 +898,10 @@ void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block) - * space and if we lose sb update during power failure we'd replay - * old transaction with possibly newly overwritten data. - */ -- jbd2_journal_update_sb_log_tail(journal, tid, block, WRITE_FUA); -+ ret = jbd2_journal_update_sb_log_tail(journal, tid, block, WRITE_FUA); -+ if (ret) -+ goto out; -+ - write_lock(&journal->j_state_lock); - freed = block - journal->j_tail; - if (block < journal->j_tail) -@@ -913,6 +917,9 @@ void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block) - journal->j_tail_sequence = tid; - journal->j_tail = block; - write_unlock(&journal->j_state_lock); -+ -+out: -+ return ret; - } - - /* -@@ -1331,7 +1338,7 @@ static int journal_reset(journal_t *journal) - return jbd2_journal_start_thread(journal); - } - --static void jbd2_write_superblock(journal_t *journal, int write_op) -+static int jbd2_write_superblock(journal_t *journal, int write_op) - { - struct buffer_head *bh = journal->j_sb_buffer; - journal_superblock_t *sb = journal->j_superblock; -@@ -1370,7 +1377,10 @@ static void jbd2_write_superblock(journal_t *journal, int write_op) - printk(KERN_ERR "JBD2: Error %d detected when updating " - "journal superblock for %s.\n", ret, - journal->j_devname); -+ jbd2_journal_abort(journal, ret); - } -+ -+ return ret; - } - - /** -@@ -1383,10 +1393,11 @@ static void jbd2_write_superblock(journal_t *journal, int write_op) - * Update a journal's superblock information about log tail and write it to - * disk, waiting for the IO to complete. - */ --void jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid, -+int jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid, - unsigned long tail_block, int write_op) - { - journal_superblock_t *sb = journal->j_superblock; -+ int ret; - - BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex)); - jbd_debug(1, "JBD2: updating superblock (start %lu, seq %u)\n", -@@ -1395,13 +1406,18 @@ void jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid, - sb->s_sequence = cpu_to_be32(tail_tid); - sb->s_start = cpu_to_be32(tail_block); - -- jbd2_write_superblock(journal, write_op); -+ ret = jbd2_write_superblock(journal, write_op); -+ if (ret) -+ goto out; - - /* Log is no longer empty */ - write_lock(&journal->j_state_lock); - WARN_ON(!sb->s_sequence); - journal->j_flags &= ~JBD2_FLUSHED; - write_unlock(&journal->j_state_lock); -+ -+out: -+ return ret; - } - - /** -@@ -1952,7 +1968,14 @@ int jbd2_journal_flush(journal_t *journal) - return -EIO; - - mutex_lock(&journal->j_checkpoint_mutex); -- jbd2_cleanup_journal_tail(journal); -+ if (!err) { -+ err = jbd2_cleanup_journal_tail(journal); -+ if (err < 0) { -+ mutex_unlock(&journal->j_checkpoint_mutex); -+ goto out; -+ } -+ err = 0; -+ } - - /* Finally, mark the journal as really needing no recovery. - * This sets s_start==0 in the underlying superblock, which is -@@ -1968,7 +1991,8 @@ int jbd2_journal_flush(journal_t *journal) - J_ASSERT(journal->j_head == journal->j_tail); - J_ASSERT(journal->j_tail_sequence == journal->j_transaction_sequence); - write_unlock(&journal->j_state_lock); -- return 0; -+out: -+ return err; - } - - /** -diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c -index fa6d72131c19..4495cad189c3 100644 ---- a/fs/nfs/nfs3xdr.c -+++ b/fs/nfs/nfs3xdr.c -@@ -1342,7 +1342,7 @@ static void nfs3_xdr_enc_setacl3args(struct rpc_rqst *req, - if (args->npages != 0) - xdr_write_pages(xdr, args->pages, 0, args->len); - else -- xdr_reserve_space(xdr, NFS_ACL_INLINE_BUFSIZE); -+ xdr_reserve_space(xdr, args->len); - - error = nfsacl_encode(xdr->buf, base, args->inode, - (args->mask & NFS_ACL) ? -diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c -index b4f177f1d405..c402b672a474 100644 ---- a/fs/nfs/nfs4state.c -+++ b/fs/nfs/nfs4state.c -@@ -1482,6 +1482,8 @@ restart: - spin_unlock(&state->state_lock); - } - nfs4_put_open_state(state); -+ clear_bit(NFS4CLNT_RECLAIM_NOGRACE, -+ &state->flags); - spin_lock(&sp->so_lock); - goto restart; - } -diff --git a/fs/xfs/xfs_symlink.c b/fs/xfs/xfs_symlink.c -index 14e58f2c96bd..98d4948feba0 100644 ---- a/fs/xfs/xfs_symlink.c -+++ b/fs/xfs/xfs_symlink.c -@@ -102,7 +102,7 @@ xfs_readlink_bmap( - cur_chunk += sizeof(struct xfs_dsymlink_hdr); - } - -- memcpy(link + offset, bp->b_addr, byte_cnt); -+ memcpy(link + offset, cur_chunk, byte_cnt); - - pathlen -= byte_cnt; - offset += byte_cnt; -diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h -index 8fc12f80b616..69afb5780815 100644 ---- a/include/acpi/actypes.h -+++ b/include/acpi/actypes.h -@@ -561,6 +561,7 @@ typedef u64 acpi_integer; - #define ACPI_NO_ACPI_ENABLE 0x10 - #define ACPI_NO_DEVICE_INIT 0x20 - #define ACPI_NO_OBJECT_INIT 0x40 -+#define ACPI_NO_FACS_INIT 0x80 - - /* - * Initialization state -diff --git a/include/linux/acpi.h b/include/linux/acpi.h -index cd80aa80d03e..77af62187e7a 100644 ---- a/include/linux/acpi.h -+++ b/include/linux/acpi.h -@@ -402,6 +402,7 @@ extern acpi_status acpi_pci_osc_control_set(acpi_handle handle, - #define ACPI_OST_SC_INSERT_NOT_SUPPORTED 0x82 - - extern void acpi_early_init(void); -+extern void acpi_subsystem_init(void); - - extern int acpi_nvs_register(__u64 start, __u64 size); - -@@ -436,6 +437,7 @@ static inline const char *acpi_dev_name(struct acpi_device *adev) - } - - static inline void acpi_early_init(void) { } -+static inline void acpi_subsystem_init(void) { } - - static inline int early_acpi_boot_init(void) - { -diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h -index 0dae71e9971c..e1fb0f613a99 100644 ---- a/include/linux/jbd2.h -+++ b/include/linux/jbd2.h -@@ -1035,7 +1035,7 @@ struct buffer_head *jbd2_journal_get_descriptor_buffer(journal_t *journal); - int jbd2_journal_next_log_block(journal_t *, unsigned long long *); - int jbd2_journal_get_log_tail(journal_t *journal, tid_t *tid, - unsigned long *block); --void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block); -+int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block); - void jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block); - - /* Commit management */ -@@ -1157,7 +1157,7 @@ extern int jbd2_journal_recover (journal_t *journal); - extern int jbd2_journal_wipe (journal_t *, int); - extern int jbd2_journal_skip_recovery (journal_t *); - extern void jbd2_journal_update_sb_errno(journal_t *); --extern void jbd2_journal_update_sb_log_tail (journal_t *, tid_t, -+extern int jbd2_journal_update_sb_log_tail (journal_t *, tid_t, - unsigned long, int); - extern void __jbd2_journal_abort_hard (journal_t *); - extern void jbd2_journal_abort (journal_t *, int); -diff --git a/include/linux/libata.h b/include/linux/libata.h -index b84e786ff990..189c9ff97b29 100644 ---- a/include/linux/libata.h -+++ b/include/linux/libata.h -@@ -428,6 +428,7 @@ enum { - ATA_HORKAGE_NO_NCQ_TRIM = (1 << 19), /* don't use queued TRIM */ - ATA_HORKAGE_NOLPM = (1 << 20), /* don't use LPM */ - ATA_HORKAGE_WD_BROKEN_LPM = (1 << 21), /* some WDs have broken LPM */ -+ ATA_HORKAGE_NOTRIM = (1 << 24), /* don't use TRIM */ - - /* DMA mask for user DMA control: User visible values; DO NOT - renumber */ -diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h -index 53988cb3c05a..3a36a2c33aef 100644 ---- a/include/linux/nfs_xdr.h -+++ b/include/linux/nfs_xdr.h -@@ -1155,7 +1155,7 @@ struct nfs41_state_protection { - struct nfs4_op_map allow; - }; - --#define NFS4_EXCHANGE_ID_LEN (48) -+#define NFS4_EXCHANGE_ID_LEN (127) - struct nfs41_exchange_id_args { - struct nfs_client *client; - nfs4_verifier *verifier; -diff --git a/include/linux/of.h b/include/linux/of.h -index 3f8144dadaef..9f2698de732b 100644 ---- a/include/linux/of.h -+++ b/include/linux/of.h -@@ -517,7 +517,10 @@ static inline const char *of_prop_next_string(struct property *prop, - #if defined(CONFIG_OF) && defined(CONFIG_NUMA) - extern int of_node_to_nid(struct device_node *np); - #else --static inline int of_node_to_nid(struct device_node *device) { return 0; } -+static inline int of_node_to_nid(struct device_node *device) -+{ -+ return NUMA_NO_NODE; -+} - #endif - - static inline struct device_node *of_find_matching_node( -diff --git a/include/uapi/linux/usbdevice_fs.h b/include/uapi/linux/usbdevice_fs.h -index 0c65e4b12617..ef29266ef77a 100644 ---- a/include/uapi/linux/usbdevice_fs.h -+++ b/include/uapi/linux/usbdevice_fs.h -@@ -125,11 +125,12 @@ struct usbdevfs_hub_portinfo { - char port [127]; /* e.g. port 3 connects to device 27 */ - }; - --/* Device capability flags */ -+/* System and bus capability flags */ - #define USBDEVFS_CAP_ZERO_PACKET 0x01 - #define USBDEVFS_CAP_BULK_CONTINUATION 0x02 - #define USBDEVFS_CAP_NO_PACKET_SIZE_LIM 0x04 - #define USBDEVFS_CAP_BULK_SCATTER_GATHER 0x08 -+#define USBDEVFS_CAP_REAP_AFTER_DISCONNECT 0x10 - - /* USBDEVFS_DISCONNECT_CLAIM flags & struct */ - -diff --git a/init/main.c b/init/main.c -index 58c132d7de4b..008edceecf03 100644 ---- a/init/main.c -+++ b/init/main.c -@@ -643,6 +643,7 @@ asmlinkage void __init start_kernel(void) - - check_bugs(); - -+ acpi_subsystem_init(); - sfi_init_late(); - - if (efi_enabled(EFI_RUNTIME_SERVICES)) { -diff --git a/kernel/irq/devres.c b/kernel/irq/devres.c -index 1ef0606797c9..0296d6fd7d4e 100644 ---- a/kernel/irq/devres.c -+++ b/kernel/irq/devres.c -@@ -104,7 +104,7 @@ int devm_request_any_context_irq(struct device *dev, unsigned int irq, - return -ENOMEM; - - rc = request_any_context_irq(irq, handler, irqflags, devname, dev_id); -- if (rc) { -+ if (rc < 0) { - devres_free(dr); - return rc; - } -@@ -113,7 +113,7 @@ int devm_request_any_context_irq(struct device *dev, unsigned int irq, - dr->dev_id = dev_id; - devres_add(dev, dr); - -- return 0; -+ return rc; - } - EXPORT_SYMBOL(devm_request_any_context_irq); - -diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig -index 2fac9cc79b3d..9d1862866786 100644 ---- a/kernel/power/Kconfig -+++ b/kernel/power/Kconfig -@@ -191,7 +191,7 @@ config DPM_WATCHDOG - config DPM_WATCHDOG_TIMEOUT - int "Watchdog timeout in seconds" - range 1 120 -- default 12 -+ default 60 - depends on DPM_WATCHDOG - - config PM_TRACE -diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c -index a755ad70fe8f..02e7fb4edb93 100644 ---- a/kernel/printk/printk.c -+++ b/kernel/printk/printk.c -@@ -383,11 +383,11 @@ static int check_syslog_permissions(int type, bool from_file) - * already done the capabilities checks at open time. - */ - if (from_file && type != SYSLOG_ACTION_OPEN) -- return 0; -+ goto ok; - - if (syslog_action_restricted(type)) { - if (capable(CAP_SYSLOG)) -- return 0; -+ goto ok; - /* - * For historical reasons, accept CAP_SYS_ADMIN too, with - * a warning. -@@ -397,10 +397,11 @@ static int check_syslog_permissions(int type, bool from_file) - "CAP_SYS_ADMIN but no CAP_SYSLOG " - "(deprecated).\n", - current->comm, task_pid_nr(current)); -- return 0; -+ goto ok; - } - return -EPERM; - } -+ok: - return security_syslog(type); - } - -@@ -1126,10 +1127,6 @@ int do_syslog(int type, char __user *buf, int len, bool from_file) - if (error) - goto out; - -- error = security_syslog(type); -- if (error) -- return error; -- - switch (type) { - case SYSLOG_ACTION_CLOSE: /* Close log */ - break; -diff --git a/kernel/rcu/tiny.c b/kernel/rcu/tiny.c -index 1254f312d024..ae359f0302c4 100644 ---- a/kernel/rcu/tiny.c -+++ b/kernel/rcu/tiny.c -@@ -284,6 +284,11 @@ static void __rcu_process_callbacks(struct rcu_ctrlblk *rcp) - - /* Move the ready-to-invoke callbacks to a local list. */ - local_irq_save(flags); -+ if (rcp->donetail == &rcp->rcucblist) { -+ /* No callbacks ready, so just leave. */ -+ local_irq_restore(flags); -+ return; -+ } - RCU_TRACE(trace_rcu_batch_start(rcp->name, 0, rcp->qlen, -1)); - list = rcp->rcucblist; - rcp->rcucblist = *rcp->donetail; -diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h -index c8bd809cbd1c..c1be95c26046 100644 ---- a/kernel/trace/trace.h -+++ b/kernel/trace/trace.h -@@ -422,6 +422,7 @@ enum { - - TRACE_CONTROL_BIT, - -+ TRACE_BRANCH_BIT, - /* - * Abuse of the trace_recursion. - * As we need a way to maintain state if we are tracing the function -diff --git a/kernel/trace/trace_branch.c b/kernel/trace/trace_branch.c -index 697fb9bac8f0..60850b4fcb04 100644 ---- a/kernel/trace/trace_branch.c -+++ b/kernel/trace/trace_branch.c -@@ -37,9 +37,12 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect) - struct trace_branch *entry; - struct ring_buffer *buffer; - unsigned long flags; -- int cpu, pc; -+ int pc; - const char *p; - -+ if (current->trace_recursion & TRACE_BRANCH_BIT) -+ return; -+ - /* - * I would love to save just the ftrace_likely_data pointer, but - * this code can also be used by modules. Ugly things can happen -@@ -50,10 +53,10 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect) - if (unlikely(!tr)) - return; - -- local_irq_save(flags); -- cpu = raw_smp_processor_id(); -- data = per_cpu_ptr(tr->trace_buffer.data, cpu); -- if (atomic_inc_return(&data->disabled) != 1) -+ raw_local_irq_save(flags); -+ current->trace_recursion |= TRACE_BRANCH_BIT; -+ data = this_cpu_ptr(tr->trace_buffer.data); -+ if (atomic_read(&data->disabled)) - goto out; - - pc = preempt_count(); -@@ -82,8 +85,8 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect) - __buffer_unlock_commit(buffer, event); - - out: -- atomic_dec(&data->disabled); -- local_irq_restore(flags); -+ current->trace_recursion &= ~TRACE_BRANCH_BIT; -+ raw_local_irq_restore(flags); - } - - static inline -diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c -index cb347e85f75e..7b244d004d68 100644 ---- a/kernel/trace/trace_events_filter.c -+++ b/kernel/trace/trace_events_filter.c -@@ -1086,6 +1086,9 @@ static void parse_init(struct filter_parse_state *ps, - - static char infix_next(struct filter_parse_state *ps) - { -+ if (!ps->infix.cnt) -+ return 0; -+ - ps->infix.cnt--; - - return ps->infix.string[ps->infix.tail++]; -@@ -1101,6 +1104,9 @@ static char infix_peek(struct filter_parse_state *ps) - - static void infix_advance(struct filter_parse_state *ps) - { -+ if (!ps->infix.cnt) -+ return; -+ - ps->infix.cnt--; - ps->infix.tail++; - } -@@ -1413,7 +1419,9 @@ static int check_preds(struct filter_parse_state *ps) - continue; - } - n_normal_preds++; -- WARN_ON_ONCE(cnt < 0); -+ /* all ops should have operands */ -+ if (cnt < 0) -+ break; - } - - if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) { -diff --git a/lib/bitmap.c b/lib/bitmap.c -index e5c4ebe586ba..c0634aa923a6 100644 ---- a/lib/bitmap.c -+++ b/lib/bitmap.c -@@ -603,12 +603,12 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen, - unsigned a, b; - int c, old_c, totaldigits; - const char __user __force *ubuf = (const char __user __force *)buf; -- int exp_digit, in_range; -+ int at_start, in_range; - - totaldigits = c = 0; - bitmap_zero(maskp, nmaskbits); - do { -- exp_digit = 1; -+ at_start = 1; - in_range = 0; - a = b = 0; - -@@ -637,11 +637,10 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen, - break; - - if (c == '-') { -- if (exp_digit || in_range) -+ if (at_start || in_range) - return -EINVAL; - b = 0; - in_range = 1; -- exp_digit = 1; - continue; - } - -@@ -651,16 +650,18 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen, - b = b * 10 + (c - '0'); - if (!in_range) - a = b; -- exp_digit = 0; -+ at_start = 0; - totaldigits++; - } - if (!(a <= b)) - return -EINVAL; - if (b >= nmaskbits) - return -ERANGE; -- while (a <= b) { -- set_bit(a, maskp); -- a++; -+ if (!at_start) { -+ while (a <= b) { -+ set_bit(a, maskp); -+ a++; -+ } - } - } while (buflen && c == ','); - return 0; -diff --git a/net/9p/client.c b/net/9p/client.c -index 9186550d77a6..08046f39f09c 100644 ---- a/net/9p/client.c -+++ b/net/9p/client.c -@@ -839,7 +839,8 @@ static struct p9_req_t *p9_client_zc_rpc(struct p9_client *c, int8_t type, - if (err < 0) { - if (err == -EIO) - c->status = Disconnected; -- goto reterr; -+ if (err != -ERESTARTSYS) -+ goto reterr; - } - if (req->status == REQ_STATUS_ERROR) { - p9_debug(P9_DEBUG_ERROR, "req_status error %d\n", req->t_err); -diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c -index aade4a5c1c07..bde94d853b2b 100644 ---- a/net/ceph/osdmap.c -+++ b/net/ceph/osdmap.c -@@ -89,7 +89,7 @@ static int crush_decode_tree_bucket(void **p, void *end, - { - int j; - dout("crush_decode_tree_bucket %p to %p\n", *p, end); -- ceph_decode_32_safe(p, end, b->num_nodes, bad); -+ ceph_decode_8_safe(p, end, b->num_nodes, bad); - b->node_weights = kcalloc(b->num_nodes, sizeof(u32), GFP_NOFS); - if (b->node_weights == NULL) - return -ENOMEM; -diff --git a/net/mac80211/main.c b/net/mac80211/main.c -index c7a7a86afdb8..9e58c99e3bdc 100644 ---- a/net/mac80211/main.c -+++ b/net/mac80211/main.c -@@ -248,6 +248,7 @@ static void ieee80211_restart_work(struct work_struct *work) - { - struct ieee80211_local *local = - container_of(work, struct ieee80211_local, restart_work); -+ struct ieee80211_sub_if_data *sdata; - - /* wait for scan work complete */ - flush_workqueue(local->workqueue); -@@ -256,6 +257,8 @@ static void ieee80211_restart_work(struct work_struct *work) - "%s called with hardware scan in progress\n", __func__); - - rtnl_lock(); -+ list_for_each_entry(sdata, &local->interfaces, list) -+ flush_delayed_work(&sdata->dec_tailroom_needed_wk); - ieee80211_scan_cancel(local); - ieee80211_reconfig(local); - rtnl_unlock(); -diff --git a/net/sunrpc/backchannel_rqst.c b/net/sunrpc/backchannel_rqst.c -index e860d4f7ed2a..ab219685336c 100644 ---- a/net/sunrpc/backchannel_rqst.c -+++ b/net/sunrpc/backchannel_rqst.c -@@ -60,7 +60,7 @@ static void xprt_free_allocation(struct rpc_rqst *req) - - dprintk("RPC: free allocations for req= %p\n", req); - WARN_ON_ONCE(test_bit(RPC_BC_PA_IN_USE, &req->rq_bc_pa_state)); -- xbufp = &req->rq_private_buf; -+ xbufp = &req->rq_rcv_buf; - free_page((unsigned long)xbufp->head[0].iov_base); - xbufp = &req->rq_snd_buf; - free_page((unsigned long)xbufp->head[0].iov_base); -diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c -index 7e71e066198f..048550aacffc 100644 ---- a/security/integrity/evm/evm_main.c -+++ b/security/integrity/evm/evm_main.c -@@ -20,6 +20,7 @@ - #include - #include - #include -+#include - #include - #include "evm.h" - -@@ -275,6 +276,17 @@ static int evm_protect_xattr(struct dentry *dentry, const char *xattr_name, - iint = integrity_iint_find(dentry->d_inode); - if (iint && (iint->flags & IMA_NEW_FILE)) - return 0; -+ -+ /* exception for pseudo filesystems */ -+ if (dentry->d_inode->i_sb->s_magic == TMPFS_MAGIC -+ || dentry->d_inode->i_sb->s_magic == SYSFS_MAGIC) -+ return 0; -+ -+ integrity_audit_msg(AUDIT_INTEGRITY_METADATA, -+ dentry->d_inode, dentry->d_name.name, -+ "update_metadata", -+ integrity_status_msg[evm_status], -+ -EPERM, 0); - } - out: - if (evm_status != INTEGRITY_PASS) -diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h -index f79fa8be203c..5cb7de9046fa 100644 ---- a/security/integrity/ima/ima.h -+++ b/security/integrity/ima/ima.h -@@ -106,7 +106,7 @@ void ima_add_violation(struct file *file, const unsigned char *filename, - const char *op, const char *cause); - int ima_init_crypto(void); - void ima_putc(struct seq_file *m, void *data, int datalen); --void ima_print_digest(struct seq_file *m, u8 *digest, int size); -+void ima_print_digest(struct seq_file *m, u8 *digest, u32 size); - struct ima_template_desc *ima_template_desc_current(void); - int ima_init_template(void); - -diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c -index 468a3ba3c539..35f3c900f801 100644 ---- a/security/integrity/ima/ima_fs.c -+++ b/security/integrity/ima/ima_fs.c -@@ -186,9 +186,9 @@ static const struct file_operations ima_measurements_ops = { - .release = seq_release, - }; - --void ima_print_digest(struct seq_file *m, u8 *digest, int size) -+void ima_print_digest(struct seq_file *m, u8 *digest, u32 size) - { -- int i; -+ u32 i; - - for (i = 0; i < size; i++) - seq_printf(m, "%02x", *(digest + i)); -diff --git a/security/integrity/ima/ima_template_lib.c b/security/integrity/ima/ima_template_lib.c -index e8592e7bfc21..dcf77b77d2fc 100644 ---- a/security/integrity/ima/ima_template_lib.c -+++ b/security/integrity/ima/ima_template_lib.c -@@ -79,7 +79,8 @@ static void ima_show_template_data_ascii(struct seq_file *m, - enum data_formats datafmt, - struct ima_field_data *field_data) - { -- u8 *buf_ptr = field_data->data, buflen = field_data->len; -+ u8 *buf_ptr = field_data->data; -+ u32 buflen = field_data->len; - - switch (datafmt) { - case DATA_FMT_DIGEST_WITH_ALGO: -diff --git a/security/keys/keyring.c b/security/keys/keyring.c -index 2fb2576dc644..04d0d7c2ab0e 100644 ---- a/security/keys/keyring.c -+++ b/security/keys/keyring.c -@@ -1151,9 +1151,11 @@ void __key_link_end(struct key *keyring, - if (index_key->type == &key_type_keyring) - up_write(&keyring_serialise_link_sem); - -- if (edit && !edit->dead_leaf) { -- key_payload_reserve(keyring, -- keyring->datalen - KEYQUOTA_LINK_BYTES); -+ if (edit) { -+ if (!edit->dead_leaf) { -+ key_payload_reserve(keyring, -+ keyring->datalen - KEYQUOTA_LINK_BYTES); -+ } - assoc_array_cancel_edit(edit); - } - up_write(&keyring->sem); -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index ba175226da78..2f503c0836a9 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -3955,6 +3955,7 @@ enum { - ALC269_FIXUP_LIFEBOOK, - ALC269_FIXUP_LIFEBOOK_EXTMIC, - ALC269_FIXUP_LIFEBOOK_HP_PIN, -+ ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT, - ALC269_FIXUP_AMIC, - ALC269_FIXUP_DMIC, - ALC269VB_FIXUP_AMIC, -@@ -3973,6 +3974,7 @@ enum { - ALC269_FIXUP_DELL3_MIC_NO_PRESENCE, - ALC269_FIXUP_HEADSET_MODE, - ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC, -+ ALC269_FIXUP_ASPIRE_HEADSET_MIC, - ALC269_FIXUP_ASUS_X101_FUNC, - ALC269_FIXUP_ASUS_X101_VERB, - ALC269_FIXUP_ASUS_X101, -@@ -4096,6 +4098,10 @@ static const struct hda_fixup alc269_fixups[] = { - { } - }, - }, -+ [ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT] = { -+ .type = HDA_FIXUP_FUNC, -+ .v.func = alc269_fixup_pincfg_no_hp_to_lineout, -+ }, - [ALC269_FIXUP_AMIC] = { - .type = HDA_FIXUP_PINS, - .v.pins = (const struct hda_pintbl[]) { -@@ -4214,6 +4220,15 @@ static const struct hda_fixup alc269_fixups[] = { - .type = HDA_FIXUP_FUNC, - .v.func = alc_fixup_headset_mode_no_hp_mic, - }, -+ [ALC269_FIXUP_ASPIRE_HEADSET_MIC] = { -+ .type = HDA_FIXUP_PINS, -+ .v.pins = (const struct hda_pintbl[]) { -+ { 0x19, 0x01a1913c }, /* headset mic w/o jack detect */ -+ { } -+ }, -+ .chained = true, -+ .chain_id = ALC269_FIXUP_HEADSET_MODE, -+ }, - [ALC286_FIXUP_SONY_MIC_NO_PRESENCE] = { - .type = HDA_FIXUP_PINS, - .v.pins = (const struct hda_pintbl[]) { -@@ -4397,6 +4412,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x1025, 0x029b, "Acer 1810TZ", ALC269_FIXUP_INV_DMIC), - SND_PCI_QUIRK(0x1025, 0x0349, "Acer AOD260", ALC269_FIXUP_INV_DMIC), - SND_PCI_QUIRK(0x1025, 0x047c, "Acer AC700", ALC269_FIXUP_ACER_AC700), -+ SND_PCI_QUIRK(0x1025, 0x072d, "Acer Aspire V5-571G", ALC269_FIXUP_ASPIRE_HEADSET_MIC), -+ SND_PCI_QUIRK(0x1025, 0x080d, "Acer Aspire V5-122P", ALC269_FIXUP_ASPIRE_HEADSET_MIC), - SND_PCI_QUIRK(0x1025, 0x0740, "Acer AO725", ALC271_FIXUP_HP_GATE_MIC_JACK), - SND_PCI_QUIRK(0x1025, 0x0742, "Acer AO756", ALC271_FIXUP_HP_GATE_MIC_JACK), - SND_PCI_QUIRK_VENDOR(0x1025, "Acer Aspire", ALC271_FIXUP_DMIC), -@@ -4549,6 +4566,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x104d, 0x9084, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ), - SND_PCI_QUIRK_VENDOR(0x104d, "Sony VAIO", ALC269_FIXUP_SONY_VAIO), - SND_PCI_QUIRK(0x10cf, 0x1475, "Lifebook", ALC269_FIXUP_LIFEBOOK), -+ SND_PCI_QUIRK(0x10cf, 0x159f, "Lifebook E780", ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT), - SND_PCI_QUIRK(0x10cf, 0x15dc, "Lifebook T731", ALC269_FIXUP_LIFEBOOK_HP_PIN), - SND_PCI_QUIRK(0x10cf, 0x1757, "Lifebook E752", ALC269_FIXUP_LIFEBOOK_HP_PIN), - SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC), -diff --git a/sound/soc/codecs/wm5102.c b/sound/soc/codecs/wm5102.c -index ce9c8e14d4bd..fbee45c82a44 100644 ---- a/sound/soc/codecs/wm5102.c -+++ b/sound/soc/codecs/wm5102.c -@@ -41,7 +41,7 @@ struct wm5102_priv { - static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0); - static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0); - static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0); --static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0); -+static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0); - static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0); - - static const struct wm_adsp_region wm5102_dsp1_regions[] = { -diff --git a/sound/soc/codecs/wm5110.c b/sound/soc/codecs/wm5110.c -index 2c3c962d9a85..0fce853bda44 100644 ---- a/sound/soc/codecs/wm5110.c -+++ b/sound/soc/codecs/wm5110.c -@@ -167,7 +167,7 @@ static int wm5110_sysclk_ev(struct snd_soc_dapm_widget *w, - static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0); - static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0); - static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0); --static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0); -+static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0); - static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0); - - #define WM5110_NG_SRC(name, base) \ -diff --git a/sound/soc/codecs/wm8737.c b/sound/soc/codecs/wm8737.c -index 2f167a8ca01b..62bacb8536e6 100644 ---- a/sound/soc/codecs/wm8737.c -+++ b/sound/soc/codecs/wm8737.c -@@ -494,7 +494,8 @@ static int wm8737_set_bias_level(struct snd_soc_codec *codec, - - /* Fast VMID ramp at 2*2.5k */ - snd_soc_update_bits(codec, WM8737_MISC_BIAS_CONTROL, -- WM8737_VMIDSEL_MASK, 0x4); -+ WM8737_VMIDSEL_MASK, -+ 2 << WM8737_VMIDSEL_SHIFT); - - /* Bring VMID up */ - snd_soc_update_bits(codec, WM8737_POWER_MANAGEMENT, -@@ -508,7 +509,8 @@ static int wm8737_set_bias_level(struct snd_soc_codec *codec, - - /* VMID at 2*300k */ - snd_soc_update_bits(codec, WM8737_MISC_BIAS_CONTROL, -- WM8737_VMIDSEL_MASK, 2); -+ WM8737_VMIDSEL_MASK, -+ 1 << WM8737_VMIDSEL_SHIFT); - - break; - -diff --git a/sound/soc/codecs/wm8903.h b/sound/soc/codecs/wm8903.h -index db949311c0f2..0bb4a647755d 100644 ---- a/sound/soc/codecs/wm8903.h -+++ b/sound/soc/codecs/wm8903.h -@@ -172,7 +172,7 @@ extern int wm8903_mic_detect(struct snd_soc_codec *codec, - #define WM8903_VMID_BUF_ENA_WIDTH 1 /* VMID_BUF_ENA */ - - #define WM8903_VMID_RES_50K 2 --#define WM8903_VMID_RES_250K 3 -+#define WM8903_VMID_RES_250K 4 - #define WM8903_VMID_RES_5K 6 - - /* -diff --git a/sound/soc/codecs/wm8955.c b/sound/soc/codecs/wm8955.c -index 1c1fc6119758..475fc24c8ff6 100644 ---- a/sound/soc/codecs/wm8955.c -+++ b/sound/soc/codecs/wm8955.c -@@ -298,7 +298,7 @@ static int wm8955_configure_clocking(struct snd_soc_codec *codec) - snd_soc_update_bits(codec, WM8955_PLL_CONTROL_2, - WM8955_K_17_9_MASK, - (pll.k >> 9) & WM8955_K_17_9_MASK); -- snd_soc_update_bits(codec, WM8955_PLL_CONTROL_2, -+ snd_soc_update_bits(codec, WM8955_PLL_CONTROL_3, - WM8955_K_8_0_MASK, - pll.k & WM8955_K_8_0_MASK); - if (pll.k) -diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c -index edfd4edaa864..e04dbaa1de8f 100644 ---- a/sound/soc/codecs/wm8960.c -+++ b/sound/soc/codecs/wm8960.c -@@ -242,7 +242,7 @@ SOC_SINGLE("PCM Playback -6dB Switch", WM8960_DACCTL1, 7, 1, 0), - SOC_ENUM("ADC Polarity", wm8960_enum[0]), - SOC_SINGLE("ADC High Pass Filter Switch", WM8960_DACCTL1, 0, 1, 0), - --SOC_ENUM("DAC Polarity", wm8960_enum[2]), -+SOC_ENUM("DAC Polarity", wm8960_enum[1]), - SOC_SINGLE_BOOL_EXT("DAC Deemphasis Switch", 0, - wm8960_get_deemph, wm8960_put_deemph), - -diff --git a/sound/soc/codecs/wm8997.c b/sound/soc/codecs/wm8997.c -index 555115ee2159..1461ae611f31 100644 ---- a/sound/soc/codecs/wm8997.c -+++ b/sound/soc/codecs/wm8997.c -@@ -40,7 +40,7 @@ struct wm8997_priv { - static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0); - static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0); - static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0); --static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0); -+static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0); - static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0); - - static const struct reg_default wm8997_sysclk_reva_patch[] = { -diff --git a/sound/soc/fsl/imx-wm8962.c b/sound/soc/fsl/imx-wm8962.c -index 3a3d17ce6ba4..664452599497 100644 ---- a/sound/soc/fsl/imx-wm8962.c -+++ b/sound/soc/fsl/imx-wm8962.c -@@ -190,7 +190,7 @@ static int imx_wm8962_probe(struct platform_device *pdev) - dev_err(&pdev->dev, "audmux internal port setup failed\n"); - return ret; - } -- imx_audmux_v2_configure_port(ext_port, -+ ret = imx_audmux_v2_configure_port(ext_port, - IMX_AUDMUX_V2_PTCR_SYN, - IMX_AUDMUX_V2_PDCR_RXDSEL(int_port)); - if (ret) { diff --git a/patch/kernel/odroidc2-default/patch-3.14.49-50.patch b/patch/kernel/odroidc2-default/patch-3.14.49-50.patch deleted file mode 100644 index 41fc25a1c7..0000000000 --- a/patch/kernel/odroidc2-default/patch-3.14.49-50.patch +++ /dev/null @@ -1,700 +0,0 @@ -diff --git a/Makefile b/Makefile -index fee84602e999..d71c40a34b30 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 3 - PATCHLEVEL = 14 --SUBLEVEL = 49 -+SUBLEVEL = 50 - EXTRAVERSION = - NAME = Remembering Coco - -diff --git a/arch/arc/include/asm/ptrace.h b/arch/arc/include/asm/ptrace.h -index 1bfeec2c0558..2a58af7a2e3a 100644 ---- a/arch/arc/include/asm/ptrace.h -+++ b/arch/arc/include/asm/ptrace.h -@@ -63,7 +63,7 @@ struct callee_regs { - long r25, r24, r23, r22, r21, r20, r19, r18, r17, r16, r15, r14, r13; - }; - --#define instruction_pointer(regs) ((regs)->ret) -+#define instruction_pointer(regs) (unsigned long)((regs)->ret) - #define profile_pc(regs) instruction_pointer(regs) - - /* return 1 if user mode or 0 if kernel mode */ -diff --git a/arch/avr32/mach-at32ap/clock.c b/arch/avr32/mach-at32ap/clock.c -index 23b1a97fae7a..52c179bec0cc 100644 ---- a/arch/avr32/mach-at32ap/clock.c -+++ b/arch/avr32/mach-at32ap/clock.c -@@ -80,6 +80,9 @@ int clk_enable(struct clk *clk) - { - unsigned long flags; - -+ if (!clk) -+ return 0; -+ - spin_lock_irqsave(&clk_lock, flags); - __clk_enable(clk); - spin_unlock_irqrestore(&clk_lock, flags); -@@ -106,6 +109,9 @@ void clk_disable(struct clk *clk) - { - unsigned long flags; - -+ if (IS_ERR_OR_NULL(clk)) -+ return; -+ - spin_lock_irqsave(&clk_lock, flags); - __clk_disable(clk); - spin_unlock_irqrestore(&clk_lock, flags); -@@ -117,6 +123,9 @@ unsigned long clk_get_rate(struct clk *clk) - unsigned long flags; - unsigned long rate; - -+ if (!clk) -+ return 0; -+ - spin_lock_irqsave(&clk_lock, flags); - rate = clk->get_rate(clk); - spin_unlock_irqrestore(&clk_lock, flags); -@@ -129,6 +138,9 @@ long clk_round_rate(struct clk *clk, unsigned long rate) - { - unsigned long flags, actual_rate; - -+ if (!clk) -+ return 0; -+ - if (!clk->set_rate) - return -ENOSYS; - -@@ -145,6 +157,9 @@ int clk_set_rate(struct clk *clk, unsigned long rate) - unsigned long flags; - long ret; - -+ if (!clk) -+ return 0; -+ - if (!clk->set_rate) - return -ENOSYS; - -@@ -161,6 +176,9 @@ int clk_set_parent(struct clk *clk, struct clk *parent) - unsigned long flags; - int ret; - -+ if (!clk) -+ return 0; -+ - if (!clk->set_parent) - return -ENOSYS; - -@@ -174,7 +192,7 @@ EXPORT_SYMBOL(clk_set_parent); - - struct clk *clk_get_parent(struct clk *clk) - { -- return clk->parent; -+ return !clk ? NULL : clk->parent; - } - EXPORT_SYMBOL(clk_get_parent); - -diff --git a/arch/s390/kernel/sclp.S b/arch/s390/kernel/sclp.S -index 29bd7bec4176..1ecd47b5e250 100644 ---- a/arch/s390/kernel/sclp.S -+++ b/arch/s390/kernel/sclp.S -@@ -276,6 +276,8 @@ ENTRY(_sclp_print_early) - jno .Lesa2 - ahi %r15,-80 - stmh %r6,%r15,96(%r15) # store upper register halves -+ basr %r13,0 -+ lmh %r0,%r15,.Lzeroes-.(%r13) # clear upper register halves - .Lesa2: - #endif - lr %r10,%r2 # save string pointer -@@ -299,6 +301,8 @@ ENTRY(_sclp_print_early) - #endif - lm %r6,%r15,120(%r15) # restore registers - br %r14 -+.Lzeroes: -+ .fill 64,4,0 - - .LwritedataS4: - .long 0x00760005 # SCLP command for write data -diff --git a/arch/tile/kernel/setup.c b/arch/tile/kernel/setup.c -index 74c91729a62a..bdb3ecf8e168 100644 ---- a/arch/tile/kernel/setup.c -+++ b/arch/tile/kernel/setup.c -@@ -1146,7 +1146,7 @@ static void __init load_hv_initrd(void) - - void __init free_initrd_mem(unsigned long begin, unsigned long end) - { -- free_bootmem(__pa(begin), end - begin); -+ free_bootmem_late(__pa(begin), end - begin); - } - - static int __init setup_initrd(char *str) -diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c -index 78cbb2db5a85..ec5a3c7fac7a 100644 ---- a/arch/x86/boot/compressed/eboot.c -+++ b/arch/x86/boot/compressed/eboot.c -@@ -560,6 +560,10 @@ static efi_status_t setup_e820(struct boot_params *params, - unsigned int e820_type = 0; - unsigned long m = efi->efi_memmap; - -+#ifdef CONFIG_X86_64 -+ m |= (u64)efi->efi_memmap_hi << 32; -+#endif -+ - d = (efi_memory_desc_t *)(m + (i * efi->efi_memdesc_size)); - switch (d->type) { - case EFI_RESERVED_TYPE: -diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S -index c5b56ed10aff..a814c80eb580 100644 ---- a/arch/x86/boot/compressed/head_32.S -+++ b/arch/x86/boot/compressed/head_32.S -@@ -54,7 +54,7 @@ ENTRY(efi_pe_entry) - call reloc - reloc: - popl %ecx -- subl reloc, %ecx -+ subl $reloc, %ecx - movl %ecx, BP_code32_start(%eax) - - sub $0x4, %esp -diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c -index d8f80e733cf8..a7175855b6ed 100644 ---- a/block/blk-cgroup.c -+++ b/block/blk-cgroup.c -@@ -703,8 +703,12 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol, - return -EINVAL; - - disk = get_gendisk(MKDEV(major, minor), &part); -- if (!disk || part) -+ if (!disk) - return -EINVAL; -+ if (part) { -+ put_disk(disk); -+ return -EINVAL; -+ } - - rcu_read_lock(); - spin_lock_irq(disk->queue->queue_lock); -diff --git a/drivers/ata/libata-pmp.c b/drivers/ata/libata-pmp.c -index 7ccc084bf1df..85aa76116a30 100644 ---- a/drivers/ata/libata-pmp.c -+++ b/drivers/ata/libata-pmp.c -@@ -460,6 +460,13 @@ static void sata_pmp_quirks(struct ata_port *ap) - ATA_LFLAG_NO_SRST | - ATA_LFLAG_ASSUME_ATA; - } -+ } else if (vendor == 0x11ab && devid == 0x4140) { -+ /* Marvell 4140 quirks */ -+ ata_for_each_link(link, ap, EDGE) { -+ /* port 4 is for SEMB device and it doesn't like SRST */ -+ if (link->pmp == 4) -+ link->flags |= ATA_LFLAG_DISABLED; -+ } - } - } - -diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c -index a0966331a89b..c6f7e918b2b1 100644 ---- a/drivers/input/touchscreen/usbtouchscreen.c -+++ b/drivers/input/touchscreen/usbtouchscreen.c -@@ -625,6 +625,9 @@ static int dmc_tsc10_init(struct usbtouch_usb *usbtouch) - goto err_out; - } - -+ /* TSC-25 data sheet specifies a delay after the RESET command */ -+ msleep(150); -+ - /* set coordinate output rate */ - buf[0] = buf[1] = 0xFF; - ret = usb_control_msg(dev, usb_rcvctrlpipe (dev, 0), -diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c -index b96ee9d78aa3..9be97e0bd149 100644 ---- a/drivers/md/raid1.c -+++ b/drivers/md/raid1.c -@@ -336,7 +336,7 @@ static void raid1_end_read_request(struct bio *bio, int error) - spin_lock_irqsave(&conf->device_lock, flags); - if (r1_bio->mddev->degraded == conf->raid_disks || - (r1_bio->mddev->degraded == conf->raid_disks-1 && -- !test_bit(Faulty, &conf->mirrors[mirror].rdev->flags))) -+ test_bit(In_sync, &conf->mirrors[mirror].rdev->flags))) - uptodate = 1; - spin_unlock_irqrestore(&conf->device_lock, flags); - } -diff --git a/drivers/mmc/host/sdhci-esdhc.h b/drivers/mmc/host/sdhci-esdhc.h -index a7d9f95a7b03..7fd86becfd1a 100644 ---- a/drivers/mmc/host/sdhci-esdhc.h -+++ b/drivers/mmc/host/sdhci-esdhc.h -@@ -47,6 +47,6 @@ - #define ESDHC_DMA_SYSCTL 0x40c - #define ESDHC_DMA_SNOOP 0x00000040 - --#define ESDHC_HOST_CONTROL_RES 0x05 -+#define ESDHC_HOST_CONTROL_RES 0x01 - - #endif /* _DRIVERS_MMC_SDHCI_ESDHC_H */ -diff --git a/drivers/mmc/host/sdhci-pxav3.c b/drivers/mmc/host/sdhci-pxav3.c -index 561c6b4907a1..b80766699249 100644 ---- a/drivers/mmc/host/sdhci-pxav3.c -+++ b/drivers/mmc/host/sdhci-pxav3.c -@@ -257,6 +257,7 @@ static int sdhci_pxav3_probe(struct platform_device *pdev) - goto err_of_parse; - sdhci_get_of_property(pdev); - pdata = pxav3_get_mmc_pdata(dev); -+ pdev->dev.platform_data = pdata; - } else if (pdata) { - /* on-chip device */ - if (pdata->flags & PXA_FLAG_CARD_PERMANENT) -diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c -index a1d6986261a3..f3109828c6df 100644 ---- a/drivers/scsi/st.c -+++ b/drivers/scsi/st.c -@@ -1262,9 +1262,9 @@ static int st_open(struct inode *inode, struct file *filp) - spin_lock(&st_use_lock); - STp->in_use = 0; - spin_unlock(&st_use_lock); -- scsi_tape_put(STp); - if (resumed) - scsi_autopm_put_device(STp->device); -+ scsi_tape_put(STp); - return retval; - - } -diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c -index c8d7b3009c7e..55ec9b4b97cc 100644 ---- a/drivers/target/iscsi/iscsi_target.c -+++ b/drivers/target/iscsi/iscsi_target.c -@@ -4476,7 +4476,18 @@ static void iscsit_logout_post_handler_closesession( - struct iscsi_conn *conn) - { - struct iscsi_session *sess = conn->sess; -- int sleep = cmpxchg(&conn->tx_thread_active, true, false); -+ int sleep = 1; -+ /* -+ * Traditional iscsi/tcp will invoke this logic from TX thread -+ * context during session logout, so clear tx_thread_active and -+ * sleep if iscsit_close_connection() has not already occured. -+ * -+ * Since iser-target invokes this logic from it's own workqueue, -+ * always sleep waiting for RX/TX thread shutdown to complete -+ * within iscsit_close_connection(). -+ */ -+ if (conn->conn_transport->transport_type == ISCSI_TCP) -+ sleep = cmpxchg(&conn->tx_thread_active, true, false); - - atomic_set(&conn->conn_logout_remove, 0); - complete(&conn->conn_logout_comp); -@@ -4490,7 +4501,10 @@ static void iscsit_logout_post_handler_closesession( - static void iscsit_logout_post_handler_samecid( - struct iscsi_conn *conn) - { -- int sleep = cmpxchg(&conn->tx_thread_active, true, false); -+ int sleep = 1; -+ -+ if (conn->conn_transport->transport_type == ISCSI_TCP) -+ sleep = cmpxchg(&conn->tx_thread_active, true, false); - - atomic_set(&conn->conn_logout_remove, 0); - complete(&conn->conn_logout_comp); -@@ -4709,6 +4723,7 @@ int iscsit_release_sessions_for_tpg(struct iscsi_portal_group *tpg, int force) - struct iscsi_session *sess; - struct se_portal_group *se_tpg = &tpg->tpg_se_tpg; - struct se_session *se_sess, *se_sess_tmp; -+ LIST_HEAD(free_list); - int session_count = 0; - - spin_lock_bh(&se_tpg->session_lock); -@@ -4730,14 +4745,17 @@ int iscsit_release_sessions_for_tpg(struct iscsi_portal_group *tpg, int force) - } - atomic_set(&sess->session_reinstatement, 1); - spin_unlock(&sess->conn_lock); -- spin_unlock_bh(&se_tpg->session_lock); - -- iscsit_free_session(sess); -- spin_lock_bh(&se_tpg->session_lock); -+ list_move_tail(&se_sess->sess_list, &free_list); -+ } -+ spin_unlock_bh(&se_tpg->session_lock); - -+ list_for_each_entry_safe(se_sess, se_sess_tmp, &free_list, sess_list) { -+ sess = (struct iscsi_session *)se_sess->fabric_sess_ptr; -+ -+ iscsit_free_session(sess); - session_count++; - } -- spin_unlock_bh(&se_tpg->session_lock); - - pr_debug("Released %d iSCSI Session(s) from Target Portal" - " Group: %hu\n", session_count, tpg->tpgt); -diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c -index b9e16abb0fab..5c957658a04a 100644 ---- a/drivers/usb/host/xhci-hub.c -+++ b/drivers/usb/host/xhci-hub.c -@@ -480,10 +480,13 @@ static void xhci_hub_report_usb3_link_state(struct xhci_hcd *xhci, - u32 pls = status_reg & PORT_PLS_MASK; - - /* resume state is a xHCI internal state. -- * Do not report it to usb core. -+ * Do not report it to usb core, instead, pretend to be U3, -+ * thus usb core knows it's not ready for transfer - */ -- if (pls == XDEV_RESUME) -+ if (pls == XDEV_RESUME) { -+ *status |= USB_SS_PORT_LS_U3; - return; -+ } - - /* When the CAS bit is set then warm reset - * should be performed on port -@@ -584,7 +587,14 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd, - status |= USB_PORT_STAT_C_RESET << 16; - /* USB3.0 only */ - if (hcd->speed == HCD_USB3) { -- if ((raw_port_status & PORT_PLC)) -+ /* Port link change with port in resume state should not be -+ * reported to usbcore, as this is an internal state to be -+ * handled by xhci driver. Reporting PLC to usbcore may -+ * cause usbcore clearing PLC first and port change event -+ * irq won't be generated. -+ */ -+ if ((raw_port_status & PORT_PLC) && -+ (raw_port_status & PORT_PLS_MASK) != XDEV_RESUME) - status |= USB_PORT_STAT_C_LINK_STATE << 16; - if ((raw_port_status & PORT_WRC)) - status |= USB_PORT_STAT_C_BH_RESET << 16; -@@ -1114,10 +1124,10 @@ int xhci_bus_suspend(struct usb_hcd *hcd) - spin_lock_irqsave(&xhci->lock, flags); - - if (hcd->self.root_hub->do_remote_wakeup) { -- if (bus_state->resuming_ports) { -+ if (bus_state->resuming_ports || /* USB2 */ -+ bus_state->port_remote_wakeup) { /* USB3 */ - spin_unlock_irqrestore(&xhci->lock, flags); -- xhci_dbg(xhci, "suspend failed because " -- "a port is resuming\n"); -+ xhci_dbg(xhci, "suspend failed because a port is resuming\n"); - return -EBUSY; - } - } -diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c -index f615712e8251..bcc43a21fd12 100644 ---- a/drivers/usb/host/xhci-ring.c -+++ b/drivers/usb/host/xhci-ring.c -@@ -1740,6 +1740,9 @@ static void handle_port_status(struct xhci_hcd *xhci, - usb_hcd_resume_root_hub(hcd); - } - -+ if (hcd->speed == HCD_USB3 && (temp & PORT_PLS_MASK) == XDEV_INACTIVE) -+ bus_state->port_remote_wakeup &= ~(1 << faked_port_index); -+ - if ((temp & PORT_PLC) && (temp & PORT_PLS_MASK) == XDEV_RESUME) { - xhci_dbg(xhci, "port resume event for port %d\n", port_id); - -diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c -index 16f4f8dc1ae9..fc61e663b00a 100644 ---- a/drivers/usb/host/xhci.c -+++ b/drivers/usb/host/xhci.c -@@ -3424,6 +3424,9 @@ int xhci_discover_or_reset_device(struct usb_hcd *hcd, struct usb_device *udev) - return -EINVAL; - } - -+ if (virt_dev->tt_info) -+ old_active_eps = virt_dev->tt_info->active_eps; -+ - if (virt_dev->udev != udev) { - /* If the virt_dev and the udev does not match, this virt_dev - * may belong to another udev. -diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h -index 70facb725105..c167485e0653 100644 ---- a/drivers/usb/host/xhci.h -+++ b/drivers/usb/host/xhci.h -@@ -285,6 +285,7 @@ struct xhci_op_regs { - #define XDEV_U0 (0x0 << 5) - #define XDEV_U2 (0x2 << 5) - #define XDEV_U3 (0x3 << 5) -+#define XDEV_INACTIVE (0x6 << 5) - #define XDEV_RESUME (0xf << 5) - /* true: port has power (see HCC_PPC) */ - #define PORT_POWER (1 << 9) -diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h -index 821e1e2f70f6..da380a99c6b8 100644 ---- a/drivers/usb/storage/unusual_devs.h -+++ b/drivers/usb/storage/unusual_devs.h -@@ -2032,6 +2032,18 @@ UNUSUAL_DEV( 0x1908, 0x3335, 0x0200, 0x0200, - USB_SC_DEVICE, USB_PR_DEVICE, NULL, - US_FL_NO_READ_DISC_INFO ), - -+/* Reported by Oliver Neukum -+ * This device morphes spontaneously into another device if the access -+ * pattern of Windows isn't followed. Thus writable media would be dirty -+ * if the initial instance is used. So the device is limited to its -+ * virtual CD. -+ * And yes, the concept that BCD goes up to 9 is not heeded */ -+UNUSUAL_DEV( 0x19d2, 0x1225, 0x0000, 0xffff, -+ "ZTE,Incorporated", -+ "ZTE WCDMA Technologies MSM", -+ USB_SC_DEVICE, USB_PR_DEVICE, NULL, -+ US_FL_SINGLE_LUN ), -+ - /* Reported by Sven Geggus - * This encrypted pen drive returns bogus data for the initial READ(10). - */ -diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c -index 78987e481bc6..85095d7aa51c 100644 ---- a/drivers/vhost/vhost.c -+++ b/drivers/vhost/vhost.c -@@ -876,6 +876,7 @@ long vhost_dev_ioctl(struct vhost_dev *d, unsigned int ioctl, void __user *argp) - } - if (eventfp != d->log_file) { - filep = d->log_file; -+ d->log_file = eventfp; - ctx = d->log_ctx; - d->log_ctx = eventfp ? - eventfd_ctx_fileget(eventfp) : NULL; -diff --git a/fs/dcache.c b/fs/dcache.c -index aa24f7de1b92..3d2f27b4cd38 100644 ---- a/fs/dcache.c -+++ b/fs/dcache.c -@@ -587,6 +587,9 @@ repeat: - if (unlikely(d_unhashed(dentry))) - goto kill_it; - -+ if (unlikely(dentry->d_flags & DCACHE_DISCONNECTED)) -+ goto kill_it; -+ - if (unlikely(dentry->d_flags & DCACHE_OP_DELETE)) { - if (dentry->d_op->d_delete(dentry)) - goto kill_it; -diff --git a/kernel/irq/resend.c b/kernel/irq/resend.c -index 9065107f083e..7a5237a1bce5 100644 ---- a/kernel/irq/resend.c -+++ b/kernel/irq/resend.c -@@ -75,13 +75,21 @@ void check_irq_resend(struct irq_desc *desc, unsigned int irq) - !desc->irq_data.chip->irq_retrigger(&desc->irq_data)) { - #ifdef CONFIG_HARDIRQS_SW_RESEND - /* -- * If the interrupt has a parent irq and runs -- * in the thread context of the parent irq, -- * retrigger the parent. -+ * If the interrupt is running in the thread -+ * context of the parent irq we need to be -+ * careful, because we cannot trigger it -+ * directly. - */ -- if (desc->parent_irq && -- irq_settings_is_nested_thread(desc)) -+ if (irq_settings_is_nested_thread(desc)) { -+ /* -+ * If the parent_irq is valid, we -+ * retrigger the parent, otherwise we -+ * do nothing. -+ */ -+ if (!desc->parent_irq) -+ return; - irq = desc->parent_irq; -+ } - /* Set it pending and activate the softirq: */ - set_bit(irq, irqs_resend); - tasklet_schedule(&resend_tasklet); -diff --git a/mm/memory.c b/mm/memory.c -index 749e1c68d490..e9ddc7aceefa 100644 ---- a/mm/memory.c -+++ b/mm/memory.c -@@ -3234,6 +3234,10 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma, - - pte_unmap(page_table); - -+ /* File mapping without ->vm_ops ? */ -+ if (vma->vm_flags & VM_SHARED) -+ return VM_FAULT_SIGBUS; -+ - /* Check if we need to add a guard page to the stack */ - if (check_stack_guard_page(vma, address) < 0) - return VM_FAULT_SIGSEGV; -@@ -3502,6 +3506,9 @@ static int do_linear_fault(struct mm_struct *mm, struct vm_area_struct *vma, - - vma->vm_start) >> PAGE_SHIFT) + vma->vm_pgoff; - - pte_unmap(page_table); -+ /* The VMA was not fully populated on mmap() or missing VM_DONTEXPAND */ -+ if (!vma->vm_ops->fault) -+ return VM_FAULT_SIGBUS; - return __do_fault(mm, vma, address, pmd, pgoff, flags, orig_pte); - } - -@@ -3650,11 +3657,9 @@ static int handle_pte_fault(struct mm_struct *mm, - entry = ACCESS_ONCE(*pte); - if (!pte_present(entry)) { - if (pte_none(entry)) { -- if (vma->vm_ops) { -- if (likely(vma->vm_ops->fault)) -- return do_linear_fault(mm, vma, address, -+ if (vma->vm_ops) -+ return do_linear_fault(mm, vma, address, - pte, pmd, flags, entry); -- } - return do_anonymous_page(mm, vma, address, - pte, pmd, flags); - } -diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c -index 653ce5d9e6e0..5d8bc1f6b5a1 100644 ---- a/net/mac80211/debugfs_netdev.c -+++ b/net/mac80211/debugfs_netdev.c -@@ -712,6 +712,7 @@ void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata) - - debugfs_remove_recursive(sdata->vif.debugfs_dir); - sdata->vif.debugfs_dir = NULL; -+ sdata->debugfs.subdir_stations = NULL; - } - - void ieee80211_debugfs_rename_netdev(struct ieee80211_sub_if_data *sdata) -diff --git a/net/rds/ib_rdma.c b/net/rds/ib_rdma.c -index e8fdb172adbb..a985158d95d5 100644 ---- a/net/rds/ib_rdma.c -+++ b/net/rds/ib_rdma.c -@@ -759,8 +759,10 @@ void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents, - } - - ibmr = rds_ib_alloc_fmr(rds_ibdev); -- if (IS_ERR(ibmr)) -+ if (IS_ERR(ibmr)) { -+ rds_ib_dev_put(rds_ibdev); - return ibmr; -+ } - - ret = rds_ib_map_fmr(rds_ibdev, ibmr, sg, nents); - if (ret == 0) -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 2f503c0836a9..907371d87312 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -2282,7 +2282,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = { - SND_PCI_QUIRK(0x106b, 0x4300, "iMac 9,1", ALC889_FIXUP_IMAC91_VREF), - SND_PCI_QUIRK(0x106b, 0x4600, "MacbookPro 5,2", ALC889_FIXUP_IMAC91_VREF), - SND_PCI_QUIRK(0x106b, 0x4900, "iMac 9,1 Aluminum", ALC889_FIXUP_IMAC91_VREF), -- SND_PCI_QUIRK(0x106b, 0x4a00, "Macbook 5,2", ALC889_FIXUP_IMAC91_VREF), -+ SND_PCI_QUIRK(0x106b, 0x4a00, "Macbook 5,2", ALC889_FIXUP_MBA11_VREF), - - SND_PCI_QUIRK(0x1071, 0x8258, "Evesham Voyaeger", ALC882_FIXUP_EAPD), - SND_PCI_QUIRK(0x1462, 0x7350, "MSI-7350", ALC889_FIXUP_CD), -diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c -index b16be3944213..9a3e1076a5b1 100644 ---- a/sound/usb/mixer_maps.c -+++ b/sound/usb/mixer_maps.c -@@ -336,6 +336,20 @@ static const struct usbmix_name_map scms_usb3318_map[] = { - { 0 } - }; - -+/* Bose companion 5, the dB conversion factor is 16 instead of 256 */ -+static struct usbmix_dB_map bose_companion5_dB = {-5006, -6}; -+static struct usbmix_name_map bose_companion5_map[] = { -+ { 3, NULL, .dB = &bose_companion5_dB }, -+ { 0 } /* terminator */ -+}; -+ -+/* Dragonfly DAC 1.2, the dB conversion factor is 1 instead of 256 */ -+static struct usbmix_dB_map dragonfly_1_2_dB = {0, 5000}; -+static struct usbmix_name_map dragonfly_1_2_map[] = { -+ { 7, NULL, .dB = &dragonfly_1_2_dB }, -+ { 0 } /* terminator */ -+}; -+ - /* - * Control map entries - */ -@@ -442,6 +456,16 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = { - .id = USB_ID(0x25c4, 0x0003), - .map = scms_usb3318_map, - }, -+ { -+ /* Bose Companion 5 */ -+ .id = USB_ID(0x05a7, 0x1020), -+ .map = bose_companion5_map, -+ }, -+ { -+ /* Dragonfly DAC 1.2 */ -+ .id = USB_ID(0x21b4, 0x0081), -+ .map = dragonfly_1_2_map, -+ }, - { 0 } /* terminator */ - }; - -diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h -index 5293b5ac8b9d..7c24088bcaa4 100644 ---- a/sound/usb/quirks-table.h -+++ b/sound/usb/quirks-table.h -@@ -2516,6 +2516,74 @@ YAMAHA_DEVICE(0x7010, "UB99"), - } - }, - -+/* Steinberg devices */ -+{ -+ /* Steinberg MI2 */ -+ USB_DEVICE_VENDOR_SPEC(0x0a4e, 0x2040), -+ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { -+ .ifnum = QUIRK_ANY_INTERFACE, -+ .type = QUIRK_COMPOSITE, -+ .data = & (const struct snd_usb_audio_quirk[]) { -+ { -+ .ifnum = 0, -+ .type = QUIRK_AUDIO_STANDARD_INTERFACE -+ }, -+ { -+ .ifnum = 1, -+ .type = QUIRK_AUDIO_STANDARD_INTERFACE -+ }, -+ { -+ .ifnum = 2, -+ .type = QUIRK_AUDIO_STANDARD_INTERFACE -+ }, -+ { -+ .ifnum = 3, -+ .type = QUIRK_MIDI_FIXED_ENDPOINT, -+ .data = &(const struct snd_usb_midi_endpoint_info) { -+ .out_cables = 0x0001, -+ .in_cables = 0x0001 -+ } -+ }, -+ { -+ .ifnum = -1 -+ } -+ } -+ } -+}, -+{ -+ /* Steinberg MI4 */ -+ USB_DEVICE_VENDOR_SPEC(0x0a4e, 0x4040), -+ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { -+ .ifnum = QUIRK_ANY_INTERFACE, -+ .type = QUIRK_COMPOSITE, -+ .data = & (const struct snd_usb_audio_quirk[]) { -+ { -+ .ifnum = 0, -+ .type = QUIRK_AUDIO_STANDARD_INTERFACE -+ }, -+ { -+ .ifnum = 1, -+ .type = QUIRK_AUDIO_STANDARD_INTERFACE -+ }, -+ { -+ .ifnum = 2, -+ .type = QUIRK_AUDIO_STANDARD_INTERFACE -+ }, -+ { -+ .ifnum = 3, -+ .type = QUIRK_MIDI_FIXED_ENDPOINT, -+ .data = &(const struct snd_usb_midi_endpoint_info) { -+ .out_cables = 0x0001, -+ .in_cables = 0x0001 -+ } -+ }, -+ { -+ .ifnum = -1 -+ } -+ } -+ } -+}, -+ - /* TerraTec devices */ - { - USB_DEVICE_VENDOR_SPEC(0x0ccd, 0x0012), diff --git a/patch/kernel/odroidc2-default/patch-3.14.50-51.patch b/patch/kernel/odroidc2-default/patch-3.14.50-51.patch deleted file mode 100644 index edca85e3d6..0000000000 --- a/patch/kernel/odroidc2-default/patch-3.14.50-51.patch +++ /dev/null @@ -1,1929 +0,0 @@ -diff --git a/Documentation/ABI/testing/ima_policy b/Documentation/ABI/testing/ima_policy -index 4c3efe434806..750ab970fa95 100644 ---- a/Documentation/ABI/testing/ima_policy -+++ b/Documentation/ABI/testing/ima_policy -@@ -20,16 +20,18 @@ Description: - action: measure | dont_measure | appraise | dont_appraise | audit - condition:= base | lsm [option] - base: [[func=] [mask=] [fsmagic=] [fsuuid=] [uid=] -- [fowner]] -+ [euid=] [fowner=]] - lsm: [[subj_user=] [subj_role=] [subj_type=] - [obj_user=] [obj_role=] [obj_type=]] - option: [[appraise_type=]] [permit_directio] - - base: func:= [BPRM_CHECK][MMAP_CHECK][FILE_CHECK][MODULE_CHECK] -- mask:= [MAY_READ] [MAY_WRITE] [MAY_APPEND] [MAY_EXEC] -+ mask:= [[^]MAY_READ] [[^]MAY_WRITE] [[^]MAY_APPEND] -+ [[^]MAY_EXEC] - fsmagic:= hex value - fsuuid:= file system UUID (e.g 8bcbe394-4f13-4144-be8e-5aa9ea2ce2f6) - uid:= decimal value -+ euid:= decimal value - fowner:=decimal value - lsm: are LSM specific - option: appraise_type:= [imasig] -diff --git a/Makefile b/Makefile -index d71c40a34b30..83275d8ed880 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 3 - PATCHLEVEL = 14 --SUBLEVEL = 50 -+SUBLEVEL = 51 - EXTRAVERSION = - NAME = Remembering Coco - -diff --git a/arch/arm/include/asm/smp.h b/arch/arm/include/asm/smp.h -index 22a3b9b5d4a1..4157aec4e307 100644 ---- a/arch/arm/include/asm/smp.h -+++ b/arch/arm/include/asm/smp.h -@@ -74,6 +74,7 @@ struct secondary_data { - }; - extern struct secondary_data secondary_data; - extern volatile int pen_release; -+extern void secondary_startup(void); - - extern int __cpu_disable(void); - -diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c -index 4551efd28f8d..399af1e9f6e1 100644 ---- a/arch/arm/mach-omap2/omap_hwmod.c -+++ b/arch/arm/mach-omap2/omap_hwmod.c -@@ -2452,6 +2452,9 @@ static int of_dev_hwmod_lookup(struct device_node *np, - * registers. This address is needed early so the OCP registers that - * are part of the device's address space can be ioremapped properly. - * -+ * If SYSC access is not needed, the registers will not be remapped -+ * and non-availability of MPU access is not treated as an error. -+ * - * Returns 0 on success, -EINVAL if an invalid hwmod is passed, and - * -ENXIO on absent or invalid register target address space. - */ -@@ -2466,6 +2469,11 @@ static int __init _init_mpu_rt_base(struct omap_hwmod *oh, void *data, - - _save_mpu_port_index(oh); - -+ /* if we don't need sysc access we don't need to ioremap */ -+ if (!oh->class->sysc) -+ return 0; -+ -+ /* we can't continue without MPU PORT if we need sysc access */ - if (oh->_int_flags & _HWMOD_NO_MPU_PORT) - return -ENXIO; - -@@ -2475,8 +2483,10 @@ static int __init _init_mpu_rt_base(struct omap_hwmod *oh, void *data, - oh->name); - - /* Extract the IO space from device tree blob */ -- if (!np) -+ if (!np) { -+ pr_err("omap_hwmod: %s: no dt node\n", oh->name); - return -ENXIO; -+ } - - va_start = of_iomap(np, index + oh->mpu_rt_idx); - } else { -@@ -2535,13 +2545,11 @@ static int __init _init(struct omap_hwmod *oh, void *data) - oh->name, np->name); - } - -- if (oh->class->sysc) { -- r = _init_mpu_rt_base(oh, NULL, index, np); -- if (r < 0) { -- WARN(1, "omap_hwmod: %s: doesn't have mpu register target base\n", -- oh->name); -- return 0; -- } -+ r = _init_mpu_rt_base(oh, NULL, index, np); -+ if (r < 0) { -+ WARN(1, "omap_hwmod: %s: doesn't have mpu register target base\n", -+ oh->name); -+ return 0; - } - - r = _init_clocks(oh, NULL); -diff --git a/arch/arm/mach-realview/include/mach/memory.h b/arch/arm/mach-realview/include/mach/memory.h -index 2022e092f0ca..db09170e3832 100644 ---- a/arch/arm/mach-realview/include/mach/memory.h -+++ b/arch/arm/mach-realview/include/mach/memory.h -@@ -56,6 +56,8 @@ - #define PAGE_OFFSET1 (PAGE_OFFSET + 0x10000000) - #define PAGE_OFFSET2 (PAGE_OFFSET + 0x30000000) - -+#define PHYS_OFFSET PLAT_PHYS_OFFSET -+ - #define __phys_to_virt(phys) \ - ((phys) >= 0x80000000 ? (phys) - 0x80000000 + PAGE_OFFSET2 : \ - (phys) >= 0x20000000 ? (phys) - 0x20000000 + PAGE_OFFSET1 : \ -diff --git a/arch/arm/mach-sunxi/Makefile b/arch/arm/mach-sunxi/Makefile -index d9397202d6ec..27b168f121a1 100644 ---- a/arch/arm/mach-sunxi/Makefile -+++ b/arch/arm/mach-sunxi/Makefile -@@ -1,2 +1,2 @@ - obj-$(CONFIG_ARCH_SUNXI) += sunxi.o --obj-$(CONFIG_SMP) += platsmp.o headsmp.o -+obj-$(CONFIG_SMP) += platsmp.o -diff --git a/arch/arm/mach-sunxi/headsmp.S b/arch/arm/mach-sunxi/headsmp.S -deleted file mode 100644 -index a10d494fb37b..000000000000 ---- a/arch/arm/mach-sunxi/headsmp.S -+++ /dev/null -@@ -1,9 +0,0 @@ --#include --#include -- -- .section ".text.head", "ax" -- --ENTRY(sun6i_secondary_startup) -- msr cpsr_fsxc, #0xd3 -- b secondary_startup --ENDPROC(sun6i_secondary_startup) -diff --git a/arch/arm/mach-sunxi/platsmp.c b/arch/arm/mach-sunxi/platsmp.c -index 7b141d8342a1..0c7dbce033cc 100644 ---- a/arch/arm/mach-sunxi/platsmp.c -+++ b/arch/arm/mach-sunxi/platsmp.c -@@ -82,7 +82,7 @@ static int sun6i_smp_boot_secondary(unsigned int cpu, - spin_lock(&cpu_lock); - - /* Set CPU boot address */ -- writel(virt_to_phys(sun6i_secondary_startup), -+ writel(virt_to_phys(secondary_startup), - cpucfg_membase + CPUCFG_PRIVATE0_REG); - - /* Assert the CPU core in reset */ -diff --git a/arch/arm64/kernel/signal32.c b/arch/arm64/kernel/signal32.c -index 7ed72dc0fb0e..a966baccf1c0 100644 ---- a/arch/arm64/kernel/signal32.c -+++ b/arch/arm64/kernel/signal32.c -@@ -165,7 +165,8 @@ int copy_siginfo_to_user32(compat_siginfo_t __user *to, const siginfo_t *from) - * Other callers might not initialize the si_lsb field, - * so check explicitely for the right codes here. - */ -- if (from->si_code == BUS_MCEERR_AR || from->si_code == BUS_MCEERR_AO) -+ if (from->si_signo == SIGBUS && -+ (from->si_code == BUS_MCEERR_AR || from->si_code == BUS_MCEERR_AO)) - err |= __put_user(from->si_addr_lsb, &to->si_addr_lsb); - #endif - break; -@@ -192,8 +193,6 @@ int copy_siginfo_to_user32(compat_siginfo_t __user *to, const siginfo_t *from) - - int copy_siginfo_from_user32(siginfo_t *to, compat_siginfo_t __user *from) - { -- memset(to, 0, sizeof *to); -- - if (copy_from_user(to, from, __ARCH_SI_PREAMBLE_SIZE) || - copy_from_user(to->_sifields._pad, - from->_sifields._pad, SI_PAD_SIZE)) -diff --git a/arch/mips/include/asm/pgtable.h b/arch/mips/include/asm/pgtable.h -index 008324d1c261..b15495367d5c 100644 ---- a/arch/mips/include/asm/pgtable.h -+++ b/arch/mips/include/asm/pgtable.h -@@ -150,8 +150,39 @@ static inline void set_pte(pte_t *ptep, pte_t pteval) - * Make sure the buddy is global too (if it's !none, - * it better already be global) - */ -+#ifdef CONFIG_SMP -+ /* -+ * For SMP, multiple CPUs can race, so we need to do -+ * this atomically. -+ */ -+#ifdef CONFIG_64BIT -+#define LL_INSN "lld" -+#define SC_INSN "scd" -+#else /* CONFIG_32BIT */ -+#define LL_INSN "ll" -+#define SC_INSN "sc" -+#endif -+ unsigned long page_global = _PAGE_GLOBAL; -+ unsigned long tmp; -+ -+ __asm__ __volatile__ ( -+ " .set push\n" -+ " .set noreorder\n" -+ "1: " LL_INSN " %[tmp], %[buddy]\n" -+ " bnez %[tmp], 2f\n" -+ " or %[tmp], %[tmp], %[global]\n" -+ " " SC_INSN " %[tmp], %[buddy]\n" -+ " beqz %[tmp], 1b\n" -+ " nop\n" -+ "2:\n" -+ " .set pop" -+ : [buddy] "+m" (buddy->pte), -+ [tmp] "=&r" (tmp) -+ : [global] "r" (page_global)); -+#else /* !CONFIG_SMP */ - if (pte_none(*buddy)) - pte_val(*buddy) = pte_val(*buddy) | _PAGE_GLOBAL; -+#endif /* CONFIG_SMP */ - } - #endif - } -diff --git a/arch/mips/kernel/mips-mt-fpaff.c b/arch/mips/kernel/mips-mt-fpaff.c -index cb098628aee8..ca16964a2b5e 100644 ---- a/arch/mips/kernel/mips-mt-fpaff.c -+++ b/arch/mips/kernel/mips-mt-fpaff.c -@@ -154,7 +154,7 @@ asmlinkage long mipsmt_sys_sched_getaffinity(pid_t pid, unsigned int len, - unsigned long __user *user_mask_ptr) - { - unsigned int real_len; -- cpumask_t mask; -+ cpumask_t allowed, mask; - int retval; - struct task_struct *p; - -@@ -173,7 +173,8 @@ asmlinkage long mipsmt_sys_sched_getaffinity(pid_t pid, unsigned int len, - if (retval) - goto out_unlock; - -- cpumask_and(&mask, &p->thread.user_cpus_allowed, cpu_possible_mask); -+ cpumask_or(&allowed, &p->thread.user_cpus_allowed, &p->cpus_allowed); -+ cpumask_and(&mask, &allowed, cpu_active_mask); - - out_unlock: - read_unlock(&tasklist_lock); -diff --git a/arch/mips/kernel/signal32.c b/arch/mips/kernel/signal32.c -index 3d60f7750fa8..ea585cf80eb2 100644 ---- a/arch/mips/kernel/signal32.c -+++ b/arch/mips/kernel/signal32.c -@@ -370,8 +370,6 @@ int copy_siginfo_to_user32(compat_siginfo_t __user *to, const siginfo_t *from) - - int copy_siginfo_from_user32(siginfo_t *to, compat_siginfo_t __user *from) - { -- memset(to, 0, sizeof *to); -- - if (copy_from_user(to, from, 3*sizeof(int)) || - copy_from_user(to->_sifields._pad, - from->_sifields._pad, SI_PAD_SIZE32)) -diff --git a/arch/mips/mti-malta/malta-time.c b/arch/mips/mti-malta/malta-time.c -index 319009912142..d4ab447f7850 100644 ---- a/arch/mips/mti-malta/malta-time.c -+++ b/arch/mips/mti-malta/malta-time.c -@@ -168,14 +168,17 @@ unsigned int get_c0_compare_int(void) - - static void __init init_rtc(void) - { -- /* stop the clock whilst setting it up */ -- CMOS_WRITE(RTC_SET | RTC_24H, RTC_CONTROL); -+ unsigned char freq, ctrl; - -- /* 32KHz time base */ -- CMOS_WRITE(RTC_REF_CLCK_32KHZ, RTC_FREQ_SELECT); -+ /* Set 32KHz time base if not already set */ -+ freq = CMOS_READ(RTC_FREQ_SELECT); -+ if ((freq & RTC_DIV_CTL) != RTC_REF_CLCK_32KHZ) -+ CMOS_WRITE(RTC_REF_CLCK_32KHZ, RTC_FREQ_SELECT); - -- /* start the clock */ -- CMOS_WRITE(RTC_24H, RTC_CONTROL); -+ /* Ensure SET bit is clear so RTC can run */ -+ ctrl = CMOS_READ(RTC_CONTROL); -+ if (ctrl & RTC_SET) -+ CMOS_WRITE(ctrl & ~RTC_SET, RTC_CONTROL); - } - - void __init plat_time_init(void) -diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c -index 4e47db686b5d..e881e3f5f0ec 100644 ---- a/arch/powerpc/kernel/signal_32.c -+++ b/arch/powerpc/kernel/signal_32.c -@@ -967,8 +967,6 @@ int copy_siginfo_to_user32(struct compat_siginfo __user *d, const siginfo_t *s) - - int copy_siginfo_from_user32(siginfo_t *to, struct compat_siginfo __user *from) - { -- memset(to, 0, sizeof *to); -- - if (copy_from_user(to, from, 3*sizeof(int)) || - copy_from_user(to->_sifields._pad, - from->_sifields._pad, SI_PAD_SIZE32)) -diff --git a/arch/sparc/include/asm/visasm.h b/arch/sparc/include/asm/visasm.h -index 11fdf0ef50bb..50d6f16a1513 100644 ---- a/arch/sparc/include/asm/visasm.h -+++ b/arch/sparc/include/asm/visasm.h -@@ -28,16 +28,10 @@ - * Must preserve %o5 between VISEntryHalf and VISExitHalf */ - - #define VISEntryHalf \ -- rd %fprs, %o5; \ -- andcc %o5, FPRS_FEF, %g0; \ -- be,pt %icc, 297f; \ -- sethi %hi(298f), %g7; \ -- sethi %hi(VISenterhalf), %g1; \ -- jmpl %g1 + %lo(VISenterhalf), %g0; \ -- or %g7, %lo(298f), %g7; \ -- clr %o5; \ --297: wr %o5, FPRS_FEF, %fprs; \ --298: -+ VISEntry -+ -+#define VISExitHalf \ -+ VISExit - - #define VISEntryHalfFast(fail_label) \ - rd %fprs, %o5; \ -@@ -47,7 +41,7 @@ - ba,a,pt %xcc, fail_label; \ - 297: wr %o5, FPRS_FEF, %fprs; - --#define VISExitHalf \ -+#define VISExitHalfFast \ - wr %o5, 0, %fprs; - - #ifndef __ASSEMBLY__ -diff --git a/arch/sparc/lib/NG4memcpy.S b/arch/sparc/lib/NG4memcpy.S -index 140527a20e7d..83aeeb1dffdb 100644 ---- a/arch/sparc/lib/NG4memcpy.S -+++ b/arch/sparc/lib/NG4memcpy.S -@@ -240,8 +240,11 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - add %o0, 0x40, %o0 - bne,pt %icc, 1b - LOAD(prefetch, %g1 + 0x200, #n_reads_strong) -+#ifdef NON_USER_COPY -+ VISExitHalfFast -+#else - VISExitHalf -- -+#endif - brz,pn %o2, .Lexit - cmp %o2, 19 - ble,pn %icc, .Lsmall_unaligned -diff --git a/arch/sparc/lib/VISsave.S b/arch/sparc/lib/VISsave.S -index b320ae9e2e2e..a063d84336d6 100644 ---- a/arch/sparc/lib/VISsave.S -+++ b/arch/sparc/lib/VISsave.S -@@ -44,9 +44,8 @@ vis1: ldub [%g6 + TI_FPSAVED], %g3 - - stx %g3, [%g6 + TI_GSR] - 2: add %g6, %g1, %g3 -- cmp %o5, FPRS_DU -- be,pn %icc, 6f -- sll %g1, 3, %g1 -+ mov FPRS_DU | FPRS_DL | FPRS_FEF, %o5 -+ sll %g1, 3, %g1 - stb %o5, [%g3 + TI_FPSAVED] - rd %gsr, %g2 - add %g6, %g1, %g3 -@@ -80,65 +79,3 @@ vis1: ldub [%g6 + TI_FPSAVED], %g3 - .align 32 - 80: jmpl %g7 + %g0, %g0 - nop -- --6: ldub [%g3 + TI_FPSAVED], %o5 -- or %o5, FPRS_DU, %o5 -- add %g6, TI_FPREGS+0x80, %g2 -- stb %o5, [%g3 + TI_FPSAVED] -- -- sll %g1, 5, %g1 -- add %g6, TI_FPREGS+0xc0, %g3 -- wr %g0, FPRS_FEF, %fprs -- membar #Sync -- stda %f32, [%g2 + %g1] ASI_BLK_P -- stda %f48, [%g3 + %g1] ASI_BLK_P -- membar #Sync -- ba,pt %xcc, 80f -- nop -- -- .align 32 --80: jmpl %g7 + %g0, %g0 -- nop -- -- .align 32 --VISenterhalf: -- ldub [%g6 + TI_FPDEPTH], %g1 -- brnz,a,pn %g1, 1f -- cmp %g1, 1 -- stb %g0, [%g6 + TI_FPSAVED] -- stx %fsr, [%g6 + TI_XFSR] -- clr %o5 -- jmpl %g7 + %g0, %g0 -- wr %g0, FPRS_FEF, %fprs -- --1: bne,pn %icc, 2f -- srl %g1, 1, %g1 -- ba,pt %xcc, vis1 -- sub %g7, 8, %g7 --2: addcc %g6, %g1, %g3 -- sll %g1, 3, %g1 -- andn %o5, FPRS_DU, %g2 -- stb %g2, [%g3 + TI_FPSAVED] -- -- rd %gsr, %g2 -- add %g6, %g1, %g3 -- stx %g2, [%g3 + TI_GSR] -- add %g6, %g1, %g2 -- stx %fsr, [%g2 + TI_XFSR] -- sll %g1, 5, %g1 --3: andcc %o5, FPRS_DL, %g0 -- be,pn %icc, 4f -- add %g6, TI_FPREGS, %g2 -- -- add %g6, TI_FPREGS+0x40, %g3 -- membar #Sync -- stda %f0, [%g2 + %g1] ASI_BLK_P -- stda %f16, [%g3 + %g1] ASI_BLK_P -- membar #Sync -- ba,pt %xcc, 4f -- nop -- -- .align 32 --4: and %o5, FPRS_DU, %o5 -- jmpl %g7 + %g0, %g0 -- wr %o5, FPRS_FEF, %fprs -diff --git a/arch/sparc/lib/ksyms.c b/arch/sparc/lib/ksyms.c -index 323335b9cd2b..ac094de28ccf 100644 ---- a/arch/sparc/lib/ksyms.c -+++ b/arch/sparc/lib/ksyms.c -@@ -126,10 +126,6 @@ EXPORT_SYMBOL(copy_user_page); - void VISenter(void); - EXPORT_SYMBOL(VISenter); - --/* CRYPTO code needs this */ --void VISenterhalf(void); --EXPORT_SYMBOL(VISenterhalf); -- - extern void xor_vis_2(unsigned long, unsigned long *, unsigned long *); - extern void xor_vis_3(unsigned long, unsigned long *, unsigned long *, - unsigned long *); -diff --git a/arch/x86/kvm/lapic.h b/arch/x86/kvm/lapic.h -index 6a11845fd8b9..72051730caf1 100644 ---- a/arch/x86/kvm/lapic.h -+++ b/arch/x86/kvm/lapic.h -@@ -165,7 +165,7 @@ static inline u16 apic_logical_id(struct kvm_apic_map *map, u32 ldr) - - static inline bool kvm_apic_has_events(struct kvm_vcpu *vcpu) - { -- return vcpu->arch.apic->pending_events; -+ return kvm_vcpu_has_lapic(vcpu) && vcpu->arch.apic->pending_events; - } - - bool kvm_apic_pending_eoi(struct kvm_vcpu *vcpu, int vector); -diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c -index 201d09a7c46b..2302f10b1be6 100644 ---- a/arch/x86/xen/enlighten.c -+++ b/arch/x86/xen/enlighten.c -@@ -481,6 +481,7 @@ static void set_aliased_prot(void *v, pgprot_t prot) - pte_t pte; - unsigned long pfn; - struct page *page; -+ unsigned char dummy; - - ptep = lookup_address((unsigned long)v, &level); - BUG_ON(ptep == NULL); -@@ -490,6 +491,32 @@ static void set_aliased_prot(void *v, pgprot_t prot) - - pte = pfn_pte(pfn, prot); - -+ /* -+ * Careful: update_va_mapping() will fail if the virtual address -+ * we're poking isn't populated in the page tables. We don't -+ * need to worry about the direct map (that's always in the page -+ * tables), but we need to be careful about vmap space. In -+ * particular, the top level page table can lazily propagate -+ * entries between processes, so if we've switched mms since we -+ * vmapped the target in the first place, we might not have the -+ * top-level page table entry populated. -+ * -+ * We disable preemption because we want the same mm active when -+ * we probe the target and when we issue the hypercall. We'll -+ * have the same nominal mm, but if we're a kernel thread, lazy -+ * mm dropping could change our pgd. -+ * -+ * Out of an abundance of caution, this uses __get_user() to fault -+ * in the target address just in case there's some obscure case -+ * in which the target address isn't readable. -+ */ -+ -+ preempt_disable(); -+ -+ pagefault_disable(); /* Avoid warnings due to being atomic. */ -+ __get_user(dummy, (unsigned char __user __force *)v); -+ pagefault_enable(); -+ - if (HYPERVISOR_update_va_mapping((unsigned long)v, pte, 0)) - BUG(); - -@@ -501,6 +528,8 @@ static void set_aliased_prot(void *v, pgprot_t prot) - BUG(); - } else - kmap_flush_unused(); -+ -+ preempt_enable(); - } - - static void xen_alloc_ldt(struct desc_struct *ldt, unsigned entries) -@@ -508,6 +537,17 @@ static void xen_alloc_ldt(struct desc_struct *ldt, unsigned entries) - const unsigned entries_per_page = PAGE_SIZE / LDT_ENTRY_SIZE; - int i; - -+ /* -+ * We need to mark the all aliases of the LDT pages RO. We -+ * don't need to call vm_flush_aliases(), though, since that's -+ * only responsible for flushing aliases out the TLBs, not the -+ * page tables, and Xen will flush the TLB for us if needed. -+ * -+ * To avoid confusing future readers: none of this is necessary -+ * to load the LDT. The hypervisor only checks this when the -+ * LDT is faulted in due to subsequent descriptor access. -+ */ -+ - for(i = 0; i < entries; i += entries_per_page) - set_aliased_prot(ldt + i, PAGE_KERNEL_RO); - } -diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c -index 12be7cbfba4f..b583773e4ecb 100644 ---- a/drivers/block/rbd.c -+++ b/drivers/block/rbd.c -@@ -508,6 +508,7 @@ void rbd_warn(struct rbd_device *rbd_dev, const char *fmt, ...) - # define rbd_assert(expr) ((void) 0) - #endif /* !RBD_DEBUG */ - -+static void rbd_osd_copyup_callback(struct rbd_obj_request *obj_request); - static int rbd_img_obj_request_submit(struct rbd_obj_request *obj_request); - static void rbd_img_parent_read(struct rbd_obj_request *obj_request); - static void rbd_dev_remove_parent(struct rbd_device *rbd_dev); -@@ -1651,6 +1652,16 @@ static void rbd_osd_stat_callback(struct rbd_obj_request *obj_request) - obj_request_done_set(obj_request); - } - -+static void rbd_osd_call_callback(struct rbd_obj_request *obj_request) -+{ -+ dout("%s: obj %p\n", __func__, obj_request); -+ -+ if (obj_request_img_data_test(obj_request)) -+ rbd_osd_copyup_callback(obj_request); -+ else -+ obj_request_done_set(obj_request); -+} -+ - static void rbd_osd_req_callback(struct ceph_osd_request *osd_req, - struct ceph_msg *msg) - { -@@ -1689,6 +1700,8 @@ static void rbd_osd_req_callback(struct ceph_osd_request *osd_req, - rbd_osd_stat_callback(obj_request); - break; - case CEPH_OSD_OP_CALL: -+ rbd_osd_call_callback(obj_request); -+ break; - case CEPH_OSD_OP_NOTIFY_ACK: - case CEPH_OSD_OP_WATCH: - rbd_osd_trivial_callback(obj_request); -@@ -2275,13 +2288,15 @@ out_unwind: - } - - static void --rbd_img_obj_copyup_callback(struct rbd_obj_request *obj_request) -+rbd_osd_copyup_callback(struct rbd_obj_request *obj_request) - { - struct rbd_img_request *img_request; - struct rbd_device *rbd_dev; - struct page **pages; - u32 page_count; - -+ dout("%s: obj %p\n", __func__, obj_request); -+ - rbd_assert(obj_request->type == OBJ_REQUEST_BIO); - rbd_assert(obj_request_img_data_test(obj_request)); - img_request = obj_request->img_request; -@@ -2307,9 +2322,7 @@ rbd_img_obj_copyup_callback(struct rbd_obj_request *obj_request) - if (!obj_request->result) - obj_request->xferred = obj_request->length; - -- /* Finish up with the normal image object callback */ -- -- rbd_img_obj_callback(obj_request); -+ obj_request_done_set(obj_request); - } - - static void -@@ -2406,7 +2419,6 @@ rbd_img_obj_parent_read_full_callback(struct rbd_img_request *img_request) - - /* All set, send it off. */ - -- orig_request->callback = rbd_img_obj_copyup_callback; - osdc = &rbd_dev->rbd_client->client->osdc; - img_result = rbd_obj_request_submit(osdc, orig_request); - if (!img_result) -diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c -index f757a0f428bd..3beed38d306a 100644 ---- a/drivers/crypto/ixp4xx_crypto.c -+++ b/drivers/crypto/ixp4xx_crypto.c -@@ -904,7 +904,6 @@ static int ablk_perform(struct ablkcipher_request *req, int encrypt) - crypt->mode |= NPE_OP_NOT_IN_PLACE; - /* This was never tested by Intel - * for more than one dst buffer, I think. */ -- BUG_ON(req->dst->length < nbytes); - req_ctx->dst = NULL; - if (!chainup_buffers(dev, req->dst, nbytes, &dst_hook, - flags, DMA_FROM_DEVICE)) -diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c -index 6651177110f0..79a266934327 100644 ---- a/drivers/gpu/drm/radeon/radeon_combios.c -+++ b/drivers/gpu/drm/radeon/radeon_combios.c -@@ -1255,10 +1255,15 @@ struct radeon_encoder_lvds *radeon_combios_get_lvds_info(struct radeon_encoder - - if ((RBIOS16(tmp) == lvds->native_mode.hdisplay) && - (RBIOS16(tmp + 2) == lvds->native_mode.vdisplay)) { -+ u32 hss = (RBIOS16(tmp + 21) - RBIOS16(tmp + 19) - 1) * 8; -+ -+ if (hss > lvds->native_mode.hdisplay) -+ hss = (10 - 1) * 8; -+ - lvds->native_mode.htotal = lvds->native_mode.hdisplay + - (RBIOS16(tmp + 17) - RBIOS16(tmp + 19)) * 8; - lvds->native_mode.hsync_start = lvds->native_mode.hdisplay + -- (RBIOS16(tmp + 21) - RBIOS16(tmp + 19) - 1) * 8; -+ hss; - lvds->native_mode.hsync_end = lvds->native_mode.hsync_start + - (RBIOS8(tmp + 23) * 8); - -diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c -index 8e51b3a3e7b9..cc3dc0cb4fe3 100644 ---- a/drivers/md/bitmap.c -+++ b/drivers/md/bitmap.c -@@ -564,6 +564,8 @@ static int bitmap_read_sb(struct bitmap *bitmap) - if (err) - return err; - -+ err = -EINVAL; -+ - sb = kmap_atomic(sb_page); - - chunksize = le32_to_cpu(sb->chunksize); -diff --git a/drivers/md/md.c b/drivers/md/md.c -index b4067b9afd38..2ffd277eb311 100644 ---- a/drivers/md/md.c -+++ b/drivers/md/md.c -@@ -5645,8 +5645,7 @@ static int get_bitmap_file(struct mddev * mddev, void __user * arg) - char *ptr, *buf = NULL; - int err = -ENOMEM; - -- file = kmalloc(sizeof(*file), GFP_NOIO); -- -+ file = kzalloc(sizeof(*file), GFP_NOIO); - if (!file) - goto out; - -diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c -index 9be97e0bd149..47b7c3136807 100644 ---- a/drivers/md/raid1.c -+++ b/drivers/md/raid1.c -@@ -1477,6 +1477,7 @@ static void error(struct mddev *mddev, struct md_rdev *rdev) - { - char b[BDEVNAME_SIZE]; - struct r1conf *conf = mddev->private; -+ unsigned long flags; - - /* - * If it is not operational, then we have already marked it as dead -@@ -1496,14 +1497,13 @@ static void error(struct mddev *mddev, struct md_rdev *rdev) - return; - } - set_bit(Blocked, &rdev->flags); -+ spin_lock_irqsave(&conf->device_lock, flags); - if (test_and_clear_bit(In_sync, &rdev->flags)) { -- unsigned long flags; -- spin_lock_irqsave(&conf->device_lock, flags); - mddev->degraded++; - set_bit(Faulty, &rdev->flags); -- spin_unlock_irqrestore(&conf->device_lock, flags); - } else - set_bit(Faulty, &rdev->flags); -+ spin_unlock_irqrestore(&conf->device_lock, flags); - /* - * if recovery is running, make sure it aborts. - */ -@@ -1569,7 +1569,10 @@ static int raid1_spare_active(struct mddev *mddev) - * Find all failed disks within the RAID1 configuration - * and mark them readable. - * Called under mddev lock, so rcu protection not needed. -+ * device_lock used to avoid races with raid1_end_read_request -+ * which expects 'In_sync' flags and ->degraded to be consistent. - */ -+ spin_lock_irqsave(&conf->device_lock, flags); - for (i = 0; i < conf->raid_disks; i++) { - struct md_rdev *rdev = conf->mirrors[i].rdev; - struct md_rdev *repl = conf->mirrors[conf->raid_disks + i].rdev; -@@ -1599,7 +1602,6 @@ static int raid1_spare_active(struct mddev *mddev) - sysfs_notify_dirent_safe(rdev->sysfs_state); - } - } -- spin_lock_irqsave(&conf->device_lock, flags); - mddev->degraded -= count; - spin_unlock_irqrestore(&conf->device_lock, flags); - -diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c -index b4ddb7310e36..128dc2f75186 100644 ---- a/drivers/scsi/ipr.c -+++ b/drivers/scsi/ipr.c -@@ -592,9 +592,10 @@ static void ipr_trc_hook(struct ipr_cmnd *ipr_cmd, - { - struct ipr_trace_entry *trace_entry; - struct ipr_ioa_cfg *ioa_cfg = ipr_cmd->ioa_cfg; -+ unsigned int trace_index; - -- trace_entry = &ioa_cfg->trace[atomic_add_return -- (1, &ioa_cfg->trace_index)%IPR_NUM_TRACE_ENTRIES]; -+ trace_index = atomic_add_return(1, &ioa_cfg->trace_index) & IPR_TRACE_INDEX_MASK; -+ trace_entry = &ioa_cfg->trace[trace_index]; - trace_entry->time = jiffies; - trace_entry->op_code = ipr_cmd->ioarcb.cmd_pkt.cdb[0]; - trace_entry->type = type; -@@ -1044,10 +1045,15 @@ static void ipr_send_blocking_cmd(struct ipr_cmnd *ipr_cmd, - - static int ipr_get_hrrq_index(struct ipr_ioa_cfg *ioa_cfg) - { -+ unsigned int hrrq; -+ - if (ioa_cfg->hrrq_num == 1) -- return 0; -- else -- return (atomic_add_return(1, &ioa_cfg->hrrq_index) % (ioa_cfg->hrrq_num - 1)) + 1; -+ hrrq = 0; -+ else { -+ hrrq = atomic_add_return(1, &ioa_cfg->hrrq_index); -+ hrrq = (hrrq % (ioa_cfg->hrrq_num - 1)) + 1; -+ } -+ return hrrq; - } - - /** -@@ -6179,21 +6185,23 @@ static void ipr_scsi_done(struct ipr_cmnd *ipr_cmd) - struct ipr_ioa_cfg *ioa_cfg = ipr_cmd->ioa_cfg; - struct scsi_cmnd *scsi_cmd = ipr_cmd->scsi_cmd; - u32 ioasc = be32_to_cpu(ipr_cmd->s.ioasa.hdr.ioasc); -- unsigned long hrrq_flags; -+ unsigned long lock_flags; - - scsi_set_resid(scsi_cmd, be32_to_cpu(ipr_cmd->s.ioasa.hdr.residual_data_len)); - - if (likely(IPR_IOASC_SENSE_KEY(ioasc) == 0)) { - scsi_dma_unmap(scsi_cmd); - -- spin_lock_irqsave(ipr_cmd->hrrq->lock, hrrq_flags); -+ spin_lock_irqsave(ipr_cmd->hrrq->lock, lock_flags); - list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q); - scsi_cmd->scsi_done(scsi_cmd); -- spin_unlock_irqrestore(ipr_cmd->hrrq->lock, hrrq_flags); -+ spin_unlock_irqrestore(ipr_cmd->hrrq->lock, lock_flags); - } else { -- spin_lock_irqsave(ipr_cmd->hrrq->lock, hrrq_flags); -+ spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags); -+ spin_lock(&ipr_cmd->hrrq->_lock); - ipr_erp_start(ioa_cfg, ipr_cmd); -- spin_unlock_irqrestore(ipr_cmd->hrrq->lock, hrrq_flags); -+ spin_unlock(&ipr_cmd->hrrq->_lock); -+ spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags); - } - } - -diff --git a/drivers/scsi/ipr.h b/drivers/scsi/ipr.h -index 02edae714b0e..694ec20de7c0 100644 ---- a/drivers/scsi/ipr.h -+++ b/drivers/scsi/ipr.h -@@ -1459,6 +1459,7 @@ struct ipr_ioa_cfg { - - #define IPR_NUM_TRACE_INDEX_BITS 8 - #define IPR_NUM_TRACE_ENTRIES (1 << IPR_NUM_TRACE_INDEX_BITS) -+#define IPR_TRACE_INDEX_MASK (IPR_NUM_TRACE_ENTRIES - 1) - #define IPR_TRACE_SIZE (sizeof(struct ipr_trace_entry) * IPR_NUM_TRACE_ENTRIES) - char trace_start[8]; - #define IPR_TRACE_START_LABEL "trace" -diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c -index eb81c98386b9..721d839d6c54 100644 ---- a/drivers/scsi/sg.c -+++ b/drivers/scsi/sg.c -@@ -1694,6 +1694,9 @@ static int sg_start_req(Sg_request *srp, unsigned char *cmd) - md->from_user = 0; - } - -+ if (unlikely(iov_count > UIO_MAXIOV)) -+ return -EINVAL; -+ - if (iov_count) { - int len, size = sizeof(struct sg_iovec) * iov_count; - struct iovec *iov; -diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c -index 55ec9b4b97cc..9dbf17671439 100644 ---- a/drivers/target/iscsi/iscsi_target.c -+++ b/drivers/target/iscsi/iscsi_target.c -@@ -3937,7 +3937,13 @@ get_immediate: - } - - transport_err: -- iscsit_take_action_for_connection_exit(conn); -+ /* -+ * Avoid the normal connection failure code-path if this connection -+ * is still within LOGIN mode, and iscsi_np process context is -+ * responsible for cleaning up the early connection failure. -+ */ -+ if (conn->conn_state != TARG_CONN_STATE_IN_LOGIN) -+ iscsit_take_action_for_connection_exit(conn); - out: - return 0; - } -@@ -4023,7 +4029,7 @@ reject: - - int iscsi_target_rx_thread(void *arg) - { -- int ret; -+ int ret, rc; - u8 buffer[ISCSI_HDR_LEN], opcode; - u32 checksum = 0, digest = 0; - struct iscsi_conn *conn = arg; -@@ -4033,10 +4039,16 @@ int iscsi_target_rx_thread(void *arg) - * connection recovery / failure event can be triggered externally. - */ - allow_signal(SIGINT); -+ /* -+ * Wait for iscsi_post_login_handler() to complete before allowing -+ * incoming iscsi/tcp socket I/O, and/or failing the connection. -+ */ -+ rc = wait_for_completion_interruptible(&conn->rx_login_comp); -+ if (rc < 0) -+ return 0; - - if (conn->conn_transport->transport_type == ISCSI_INFINIBAND) { - struct completion comp; -- int rc; - - init_completion(&comp); - rc = wait_for_completion_interruptible(&comp); -diff --git a/drivers/target/iscsi/iscsi_target_core.h b/drivers/target/iscsi/iscsi_target_core.h -index 825b579ebca8..92abbe2f96ed 100644 ---- a/drivers/target/iscsi/iscsi_target_core.h -+++ b/drivers/target/iscsi/iscsi_target_core.h -@@ -604,6 +604,7 @@ struct iscsi_conn { - int bitmap_id; - int rx_thread_active; - struct task_struct *rx_thread; -+ struct completion rx_login_comp; - int tx_thread_active; - struct task_struct *tx_thread; - /* list_head for session connection list */ -diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c -index 449df092bfa0..01c27aac7bfb 100644 ---- a/drivers/target/iscsi/iscsi_target_login.c -+++ b/drivers/target/iscsi/iscsi_target_login.c -@@ -83,6 +83,7 @@ static struct iscsi_login *iscsi_login_init_conn(struct iscsi_conn *conn) - init_completion(&conn->conn_logout_comp); - init_completion(&conn->rx_half_close_comp); - init_completion(&conn->tx_half_close_comp); -+ init_completion(&conn->rx_login_comp); - spin_lock_init(&conn->cmd_lock); - spin_lock_init(&conn->conn_usage_lock); - spin_lock_init(&conn->immed_queue_lock); -@@ -716,6 +717,7 @@ int iscsit_start_kthreads(struct iscsi_conn *conn) - - return 0; - out_tx: -+ send_sig(SIGINT, conn->tx_thread, 1); - kthread_stop(conn->tx_thread); - conn->tx_thread_active = false; - out_bitmap: -@@ -726,7 +728,7 @@ out_bitmap: - return ret; - } - --int iscsi_post_login_handler( -+void iscsi_post_login_handler( - struct iscsi_np *np, - struct iscsi_conn *conn, - u8 zero_tsih) -@@ -736,7 +738,6 @@ int iscsi_post_login_handler( - struct se_session *se_sess = sess->se_sess; - struct iscsi_portal_group *tpg = sess->tpg; - struct se_portal_group *se_tpg = &tpg->tpg_se_tpg; -- int rc; - - iscsit_inc_conn_usage_count(conn); - -@@ -777,10 +778,6 @@ int iscsi_post_login_handler( - sess->sess_ops->InitiatorName); - spin_unlock_bh(&sess->conn_lock); - -- rc = iscsit_start_kthreads(conn); -- if (rc) -- return rc; -- - iscsi_post_login_start_timers(conn); - /* - * Determine CPU mask to ensure connection's RX and TX kthreads -@@ -789,15 +786,20 @@ int iscsi_post_login_handler( - iscsit_thread_get_cpumask(conn); - conn->conn_rx_reset_cpumask = 1; - conn->conn_tx_reset_cpumask = 1; -- -+ /* -+ * Wakeup the sleeping iscsi_target_rx_thread() now that -+ * iscsi_conn is in TARG_CONN_STATE_LOGGED_IN state. -+ */ -+ complete(&conn->rx_login_comp); - iscsit_dec_conn_usage_count(conn); -+ - if (stop_timer) { - spin_lock_bh(&se_tpg->session_lock); - iscsit_stop_time2retain_timer(sess); - spin_unlock_bh(&se_tpg->session_lock); - } - iscsit_dec_session_usage_count(sess); -- return 0; -+ return; - } - - iscsi_set_session_parameters(sess->sess_ops, conn->param_list, 1); -@@ -838,10 +840,6 @@ int iscsi_post_login_handler( - " iSCSI Target Portal Group: %hu\n", tpg->nsessions, tpg->tpgt); - spin_unlock_bh(&se_tpg->session_lock); - -- rc = iscsit_start_kthreads(conn); -- if (rc) -- return rc; -- - iscsi_post_login_start_timers(conn); - /* - * Determine CPU mask to ensure connection's RX and TX kthreads -@@ -850,10 +848,12 @@ int iscsi_post_login_handler( - iscsit_thread_get_cpumask(conn); - conn->conn_rx_reset_cpumask = 1; - conn->conn_tx_reset_cpumask = 1; -- -+ /* -+ * Wakeup the sleeping iscsi_target_rx_thread() now that -+ * iscsi_conn is in TARG_CONN_STATE_LOGGED_IN state. -+ */ -+ complete(&conn->rx_login_comp); - iscsit_dec_conn_usage_count(conn); -- -- return 0; - } - - static void iscsi_handle_login_thread_timeout(unsigned long data) -@@ -1418,23 +1418,12 @@ static int __iscsi_target_login_thread(struct iscsi_np *np) - if (ret < 0) - goto new_sess_out; - -- if (!conn->sess) { -- pr_err("struct iscsi_conn session pointer is NULL!\n"); -- goto new_sess_out; -- } -- - iscsi_stop_login_thread_timer(np); - -- if (signal_pending(current)) -- goto new_sess_out; -- - if (ret == 1) { - tpg_np = conn->tpg_np; - -- ret = iscsi_post_login_handler(np, conn, zero_tsih); -- if (ret < 0) -- goto new_sess_out; -- -+ iscsi_post_login_handler(np, conn, zero_tsih); - iscsit_deaccess_np(np, tpg, tpg_np); - } - -diff --git a/drivers/target/iscsi/iscsi_target_login.h b/drivers/target/iscsi/iscsi_target_login.h -index 29d098324b7f..55cbf4533544 100644 ---- a/drivers/target/iscsi/iscsi_target_login.h -+++ b/drivers/target/iscsi/iscsi_target_login.h -@@ -12,7 +12,8 @@ extern int iscsit_accept_np(struct iscsi_np *, struct iscsi_conn *); - extern int iscsit_get_login_rx(struct iscsi_conn *, struct iscsi_login *); - extern int iscsit_put_login_tx(struct iscsi_conn *, struct iscsi_login *, u32); - extern void iscsit_free_conn(struct iscsi_np *, struct iscsi_conn *); --extern int iscsi_post_login_handler(struct iscsi_np *, struct iscsi_conn *, u8); -+extern int iscsit_start_kthreads(struct iscsi_conn *); -+extern void iscsi_post_login_handler(struct iscsi_np *, struct iscsi_conn *, u8); - extern void iscsi_target_login_sess_out(struct iscsi_conn *, struct iscsi_np *, - bool, bool); - extern int iscsi_target_login_thread(void *); -diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c -index 582ba84075ec..25ad113c5978 100644 ---- a/drivers/target/iscsi/iscsi_target_nego.c -+++ b/drivers/target/iscsi/iscsi_target_nego.c -@@ -17,6 +17,7 @@ - ******************************************************************************/ - - #include -+#include - #include - #include - #include -@@ -361,10 +362,24 @@ static int iscsi_target_do_tx_login_io(struct iscsi_conn *conn, struct iscsi_log - ntohl(login_rsp->statsn), login->rsp_length); - - padding = ((-login->rsp_length) & 3); -+ /* -+ * Before sending the last login response containing the transition -+ * bit for full-feature-phase, go ahead and start up TX/RX threads -+ * now to avoid potential resource allocation failures after the -+ * final login response has been sent. -+ */ -+ if (login->login_complete) { -+ int rc = iscsit_start_kthreads(conn); -+ if (rc) { -+ iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR, -+ ISCSI_LOGIN_STATUS_NO_RESOURCES); -+ return -1; -+ } -+ } - - if (conn->conn_transport->iscsit_put_login_tx(conn, login, - login->rsp_length + padding) < 0) -- return -1; -+ goto err; - - login->rsp_length = 0; - mutex_lock(&sess->cmdsn_mutex); -@@ -373,6 +388,23 @@ static int iscsi_target_do_tx_login_io(struct iscsi_conn *conn, struct iscsi_log - mutex_unlock(&sess->cmdsn_mutex); - - return 0; -+ -+err: -+ if (login->login_complete) { -+ if (conn->rx_thread && conn->rx_thread_active) { -+ send_sig(SIGINT, conn->rx_thread, 1); -+ kthread_stop(conn->rx_thread); -+ } -+ if (conn->tx_thread && conn->tx_thread_active) { -+ send_sig(SIGINT, conn->tx_thread, 1); -+ kthread_stop(conn->tx_thread); -+ } -+ spin_lock(&iscsit_global->ts_bitmap_lock); -+ bitmap_release_region(iscsit_global->ts_bitmap, conn->bitmap_id, -+ get_order(1)); -+ spin_unlock(&iscsit_global->ts_bitmap_lock); -+ } -+ return -1; - } - - static void iscsi_target_sk_data_ready(struct sock *sk, int count) -diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c -index bcc43a21fd12..a365e9769fcc 100644 ---- a/drivers/usb/host/xhci-ring.c -+++ b/drivers/usb/host/xhci-ring.c -@@ -86,7 +86,7 @@ dma_addr_t xhci_trb_virt_to_dma(struct xhci_segment *seg, - return 0; - /* offset in TRBs */ - segment_offset = trb - seg->trbs; -- if (segment_offset > TRBS_PER_SEGMENT) -+ if (segment_offset >= TRBS_PER_SEGMENT) - return 0; - return seg->dma + (segment_offset * sizeof(*trb)); - } -diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c -index 74a9375a9bb5..89c55d4d9e54 100644 ---- a/drivers/usb/serial/sierra.c -+++ b/drivers/usb/serial/sierra.c -@@ -289,6 +289,7 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x68AA, 0xFF, 0xFF, 0xFF), - .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist - }, -+ { USB_DEVICE(0x1199, 0x68AB) }, /* Sierra Wireless AR8550 */ - /* AT&T Direct IP LTE modems */ - { USB_DEVICE_AND_INTERFACE_INFO(0x0F3D, 0x68AA, 0xFF, 0xFF, 0xFF), - .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist -diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c -index 073b4a19a8b0..ff3c98f1ea95 100644 ---- a/drivers/xen/gntdev.c -+++ b/drivers/xen/gntdev.c -@@ -529,12 +529,14 @@ static int gntdev_release(struct inode *inode, struct file *flip) - - pr_debug("priv %p\n", priv); - -+ mutex_lock(&priv->lock); - while (!list_empty(&priv->maps)) { - map = list_entry(priv->maps.next, struct grant_map, next); - list_del(&map->next); - gntdev_put_map(NULL /* already removed */, map); - } - WARN_ON(!list_empty(&priv->freeable_maps)); -+ mutex_unlock(&priv->lock); - - if (use_ptemod) - mmu_notifier_unregister(&priv->mn, priv->mm); -diff --git a/fs/dcache.c b/fs/dcache.c -index 3d2f27b4cd38..df323f809e03 100644 ---- a/fs/dcache.c -+++ b/fs/dcache.c -@@ -244,17 +244,8 @@ static void __d_free(struct rcu_head *head) - kmem_cache_free(dentry_cache, dentry); - } - --/* -- * no locks, please. -- */ --static void d_free(struct dentry *dentry) -+static void dentry_free(struct dentry *dentry) - { -- WARN_ON(!hlist_unhashed(&dentry->d_u.d_alias)); -- BUG_ON((int)dentry->d_lockref.count > 0); -- this_cpu_dec(nr_dentry); -- if (dentry->d_op && dentry->d_op->d_release) -- dentry->d_op->d_release(dentry); -- - /* if dentry was never visible to RCU, immediate free is OK */ - if (!(dentry->d_flags & DCACHE_RCUACCESS)) - __d_free(&dentry->d_u.d_rcu); -@@ -402,56 +393,6 @@ static void dentry_lru_add(struct dentry *dentry) - d_lru_add(dentry); - } - --/* -- * Remove a dentry with references from the LRU. -- * -- * If we are on the shrink list, then we can get to try_prune_one_dentry() and -- * lose our last reference through the parent walk. In this case, we need to -- * remove ourselves from the shrink list, not the LRU. -- */ --static void dentry_lru_del(struct dentry *dentry) --{ -- if (dentry->d_flags & DCACHE_LRU_LIST) { -- if (dentry->d_flags & DCACHE_SHRINK_LIST) -- return d_shrink_del(dentry); -- d_lru_del(dentry); -- } --} -- --/** -- * d_kill - kill dentry and return parent -- * @dentry: dentry to kill -- * @parent: parent dentry -- * -- * The dentry must already be unhashed and removed from the LRU. -- * -- * If this is the root of the dentry tree, return NULL. -- * -- * dentry->d_lock and parent->d_lock must be held by caller, and are dropped by -- * d_kill. -- */ --static struct dentry *d_kill(struct dentry *dentry, struct dentry *parent) -- __releases(dentry->d_lock) -- __releases(parent->d_lock) -- __releases(dentry->d_inode->i_lock) --{ -- __list_del_entry(&dentry->d_child); -- /* -- * Inform d_walk() that we are no longer attached to the -- * dentry tree -- */ -- dentry->d_flags |= DCACHE_DENTRY_KILLED; -- if (parent) -- spin_unlock(&parent->d_lock); -- dentry_iput(dentry); -- /* -- * dentry_iput drops the locks, at which point nobody (except -- * transient RCU lookups) can reach this dentry. -- */ -- d_free(dentry); -- return parent; --} -- - /** - * d_drop - drop a dentry - * @dentry: dentry to drop -@@ -509,7 +450,14 @@ dentry_kill(struct dentry *dentry, int unlock_on_failure) - __releases(dentry->d_lock) - { - struct inode *inode; -- struct dentry *parent; -+ struct dentry *parent = NULL; -+ bool can_free = true; -+ -+ if (unlikely(dentry->d_flags & DCACHE_DENTRY_KILLED)) { -+ can_free = dentry->d_flags & DCACHE_MAY_FREE; -+ spin_unlock(&dentry->d_lock); -+ goto out; -+ } - - inode = dentry->d_inode; - if (inode && !spin_trylock(&inode->i_lock)) { -@@ -520,9 +468,7 @@ relock: - } - return dentry; /* try again with same dentry */ - } -- if (IS_ROOT(dentry)) -- parent = NULL; -- else -+ if (!IS_ROOT(dentry)) - parent = dentry->d_parent; - if (parent && !spin_trylock(&parent->d_lock)) { - if (inode) -@@ -542,10 +488,40 @@ relock: - if ((dentry->d_flags & DCACHE_OP_PRUNE) && !d_unhashed(dentry)) - dentry->d_op->d_prune(dentry); - -- dentry_lru_del(dentry); -+ if (dentry->d_flags & DCACHE_LRU_LIST) { -+ if (!(dentry->d_flags & DCACHE_SHRINK_LIST)) -+ d_lru_del(dentry); -+ } - /* if it was on the hash then remove it */ - __d_drop(dentry); -- return d_kill(dentry, parent); -+ __list_del_entry(&dentry->d_child); -+ /* -+ * Inform d_walk() that we are no longer attached to the -+ * dentry tree -+ */ -+ dentry->d_flags |= DCACHE_DENTRY_KILLED; -+ if (parent) -+ spin_unlock(&parent->d_lock); -+ dentry_iput(dentry); -+ /* -+ * dentry_iput drops the locks, at which point nobody (except -+ * transient RCU lookups) can reach this dentry. -+ */ -+ BUG_ON((int)dentry->d_lockref.count > 0); -+ this_cpu_dec(nr_dentry); -+ if (dentry->d_op && dentry->d_op->d_release) -+ dentry->d_op->d_release(dentry); -+ -+ spin_lock(&dentry->d_lock); -+ if (dentry->d_flags & DCACHE_SHRINK_LIST) { -+ dentry->d_flags |= DCACHE_MAY_FREE; -+ can_free = false; -+ } -+ spin_unlock(&dentry->d_lock); -+out: -+ if (likely(can_free)) -+ dentry_free(dentry); -+ return parent; - } - - /* -@@ -817,65 +793,13 @@ restart: - } - EXPORT_SYMBOL(d_prune_aliases); - --/* -- * Try to throw away a dentry - free the inode, dput the parent. -- * Requires dentry->d_lock is held, and dentry->d_count == 0. -- * Releases dentry->d_lock. -- * -- * This may fail if locks cannot be acquired no problem, just try again. -- */ --static struct dentry * try_prune_one_dentry(struct dentry *dentry) -- __releases(dentry->d_lock) --{ -- struct dentry *parent; -- -- parent = dentry_kill(dentry, 0); -- /* -- * If dentry_kill returns NULL, we have nothing more to do. -- * if it returns the same dentry, trylocks failed. In either -- * case, just loop again. -- * -- * Otherwise, we need to prune ancestors too. This is necessary -- * to prevent quadratic behavior of shrink_dcache_parent(), but -- * is also expected to be beneficial in reducing dentry cache -- * fragmentation. -- */ -- if (!parent) -- return NULL; -- if (parent == dentry) -- return dentry; -- -- /* Prune ancestors. */ -- dentry = parent; -- while (dentry) { -- if (lockref_put_or_lock(&dentry->d_lockref)) -- return NULL; -- dentry = dentry_kill(dentry, 1); -- } -- return NULL; --} -- - static void shrink_dentry_list(struct list_head *list) - { -- struct dentry *dentry; -+ struct dentry *dentry, *parent; - -- rcu_read_lock(); -- for (;;) { -- dentry = list_entry_rcu(list->prev, struct dentry, d_lru); -- if (&dentry->d_lru == list) -- break; /* empty */ -- -- /* -- * Get the dentry lock, and re-verify that the dentry is -- * this on the shrinking list. If it is, we know that -- * DCACHE_SHRINK_LIST and DCACHE_LRU_LIST are set. -- */ -+ while (!list_empty(list)) { -+ dentry = list_entry(list->prev, struct dentry, d_lru); - spin_lock(&dentry->d_lock); -- if (dentry != list_entry(list->prev, struct dentry, d_lru)) { -- spin_unlock(&dentry->d_lock); -- continue; -- } -- - /* - * The dispose list is isolated and dentries are not accounted - * to the LRU here, so we can simply remove it from the list -@@ -887,30 +811,38 @@ static void shrink_dentry_list(struct list_head *list) - * We found an inuse dentry which was not removed from - * the LRU because of laziness during lookup. Do not free it. - */ -- if (dentry->d_lockref.count) { -+ if ((int)dentry->d_lockref.count > 0) { - spin_unlock(&dentry->d_lock); - continue; - } -- rcu_read_unlock(); - -+ parent = dentry_kill(dentry, 0); - /* -- * If 'try_to_prune()' returns a dentry, it will -- * be the same one we passed in, and d_lock will -- * have been held the whole time, so it will not -- * have been added to any other lists. We failed -- * to get the inode lock. -- * -- * We just add it back to the shrink list. -+ * If dentry_kill returns NULL, we have nothing more to do. - */ -- dentry = try_prune_one_dentry(dentry); -+ if (!parent) -+ continue; - -- rcu_read_lock(); -- if (dentry) { -+ if (unlikely(parent == dentry)) { -+ /* -+ * trylocks have failed and d_lock has been held the -+ * whole time, so it could not have been added to any -+ * other lists. Just add it back to the shrink list. -+ */ - d_shrink_add(dentry, list); - spin_unlock(&dentry->d_lock); -+ continue; - } -+ /* -+ * We need to prune ancestors too. This is necessary to prevent -+ * quadratic behavior of shrink_dcache_parent(), but is also -+ * expected to be beneficial in reducing dentry cache -+ * fragmentation. -+ */ -+ dentry = parent; -+ while (dentry && !lockref_put_or_lock(&dentry->d_lockref)) -+ dentry = dentry_kill(dentry, 1); - } -- rcu_read_unlock(); - } - - static enum lru_status -@@ -1264,34 +1196,23 @@ static enum d_walk_ret select_collect(void *_data, struct dentry *dentry) - if (data->start == dentry) - goto out; - -- /* -- * move only zero ref count dentries to the dispose list. -- * -- * Those which are presently on the shrink list, being processed -- * by shrink_dentry_list(), shouldn't be moved. Otherwise the -- * loop in shrink_dcache_parent() might not make any progress -- * and loop forever. -- */ -- if (dentry->d_lockref.count) { -- dentry_lru_del(dentry); -- } else if (!(dentry->d_flags & DCACHE_SHRINK_LIST)) { -- /* -- * We can't use d_lru_shrink_move() because we -- * need to get the global LRU lock and do the -- * LRU accounting. -- */ -- d_lru_del(dentry); -- d_shrink_add(dentry, &data->dispose); -+ if (dentry->d_flags & DCACHE_SHRINK_LIST) { - data->found++; -- ret = D_WALK_NORETRY; -+ } else { -+ if (dentry->d_flags & DCACHE_LRU_LIST) -+ d_lru_del(dentry); -+ if (!dentry->d_lockref.count) { -+ d_shrink_add(dentry, &data->dispose); -+ data->found++; -+ } - } - /* - * We can return to the caller if we have found some (this - * ensures forward progress). We'll be coming back to find - * the rest. - */ -- if (data->found && need_resched()) -- ret = D_WALK_QUIT; -+ if (!list_empty(&data->dispose)) -+ ret = need_resched() ? D_WALK_QUIT : D_WALK_NORETRY; - out: - return ret; - } -@@ -1321,45 +1242,35 @@ void shrink_dcache_parent(struct dentry *parent) - } - EXPORT_SYMBOL(shrink_dcache_parent); - --static enum d_walk_ret umount_collect(void *_data, struct dentry *dentry) -+static enum d_walk_ret umount_check(void *_data, struct dentry *dentry) - { -- struct select_data *data = _data; -- enum d_walk_ret ret = D_WALK_CONTINUE; -+ /* it has busy descendents; complain about those instead */ -+ if (!list_empty(&dentry->d_subdirs)) -+ return D_WALK_CONTINUE; - -- if (dentry->d_lockref.count) { -- dentry_lru_del(dentry); -- if (likely(!list_empty(&dentry->d_subdirs))) -- goto out; -- if (dentry == data->start && dentry->d_lockref.count == 1) -- goto out; -- printk(KERN_ERR -- "BUG: Dentry %p{i=%lx,n=%s}" -- " still in use (%d)" -- " [unmount of %s %s]\n", -+ /* root with refcount 1 is fine */ -+ if (dentry == _data && dentry->d_lockref.count == 1) -+ return D_WALK_CONTINUE; -+ -+ printk(KERN_ERR "BUG: Dentry %p{i=%lx,n=%pd} " -+ " still in use (%d) [unmount of %s %s]\n", - dentry, - dentry->d_inode ? - dentry->d_inode->i_ino : 0UL, -- dentry->d_name.name, -+ dentry, - dentry->d_lockref.count, - dentry->d_sb->s_type->name, - dentry->d_sb->s_id); -- BUG(); -- } else if (!(dentry->d_flags & DCACHE_SHRINK_LIST)) { -- /* -- * We can't use d_lru_shrink_move() because we -- * need to get the global LRU lock and do the -- * LRU accounting. -- */ -- if (dentry->d_flags & DCACHE_LRU_LIST) -- d_lru_del(dentry); -- d_shrink_add(dentry, &data->dispose); -- data->found++; -- ret = D_WALK_NORETRY; -- } --out: -- if (data->found && need_resched()) -- ret = D_WALK_QUIT; -- return ret; -+ WARN_ON(1); -+ return D_WALK_CONTINUE; -+} -+ -+static void do_one_tree(struct dentry *dentry) -+{ -+ shrink_dcache_parent(dentry); -+ d_walk(dentry, dentry, umount_check, NULL); -+ d_drop(dentry); -+ dput(dentry); - } - - /* -@@ -1369,40 +1280,15 @@ void shrink_dcache_for_umount(struct super_block *sb) - { - struct dentry *dentry; - -- if (down_read_trylock(&sb->s_umount)) -- BUG(); -+ WARN(down_read_trylock(&sb->s_umount), "s_umount should've been locked"); - - dentry = sb->s_root; - sb->s_root = NULL; -- for (;;) { -- struct select_data data; -- -- INIT_LIST_HEAD(&data.dispose); -- data.start = dentry; -- data.found = 0; -- -- d_walk(dentry, &data, umount_collect, NULL); -- if (!data.found) -- break; -- -- shrink_dentry_list(&data.dispose); -- cond_resched(); -- } -- d_drop(dentry); -- dput(dentry); -+ do_one_tree(dentry); - - while (!hlist_bl_empty(&sb->s_anon)) { -- struct select_data data; -- dentry = hlist_bl_entry(hlist_bl_first(&sb->s_anon), struct dentry, d_hash); -- -- INIT_LIST_HEAD(&data.dispose); -- data.start = NULL; -- data.found = 0; -- -- d_walk(dentry, &data, umount_collect, NULL); -- if (data.found) -- shrink_dentry_list(&data.dispose); -- cond_resched(); -+ dentry = dget(hlist_bl_entry(hlist_bl_first(&sb->s_anon), struct dentry, d_hash)); -+ do_one_tree(dentry); - } - } - -diff --git a/fs/namei.c b/fs/namei.c -index ccb8000f3459..c6fa07942b2a 100644 ---- a/fs/namei.c -+++ b/fs/namei.c -@@ -3171,7 +3171,7 @@ static struct file *path_openat(int dfd, struct filename *pathname, - - if (unlikely(file->f_flags & __O_TMPFILE)) { - error = do_tmpfile(dfd, pathname, nd, flags, op, file, &opened); -- goto out; -+ goto out2; - } - - error = path_init(dfd, pathname->name, flags | LOOKUP_PARENT, nd, &base); -@@ -3209,6 +3209,7 @@ out: - path_put(&nd->root); - if (base) - fput(base); -+out2: - if (!(opened & FILE_OPENED)) { - BUG_ON(!error); - put_filp(file); -diff --git a/fs/notify/mark.c b/fs/notify/mark.c -index 923fe4a5f503..6bffc3331df6 100644 ---- a/fs/notify/mark.c -+++ b/fs/notify/mark.c -@@ -293,16 +293,36 @@ void fsnotify_clear_marks_by_group_flags(struct fsnotify_group *group, - unsigned int flags) - { - struct fsnotify_mark *lmark, *mark; -+ LIST_HEAD(to_free); - -+ /* -+ * We have to be really careful here. Anytime we drop mark_mutex, e.g. -+ * fsnotify_clear_marks_by_inode() can come and free marks. Even in our -+ * to_free list so we have to use mark_mutex even when accessing that -+ * list. And freeing mark requires us to drop mark_mutex. So we can -+ * reliably free only the first mark in the list. That's why we first -+ * move marks to free to to_free list in one go and then free marks in -+ * to_free list one by one. -+ */ - mutex_lock_nested(&group->mark_mutex, SINGLE_DEPTH_NESTING); - list_for_each_entry_safe(mark, lmark, &group->marks_list, g_list) { -- if (mark->flags & flags) { -- fsnotify_get_mark(mark); -- fsnotify_destroy_mark_locked(mark, group); -- fsnotify_put_mark(mark); -- } -+ if (mark->flags & flags) -+ list_move(&mark->g_list, &to_free); - } - mutex_unlock(&group->mark_mutex); -+ -+ while (1) { -+ mutex_lock_nested(&group->mark_mutex, SINGLE_DEPTH_NESTING); -+ if (list_empty(&to_free)) { -+ mutex_unlock(&group->mark_mutex); -+ break; -+ } -+ mark = list_first_entry(&to_free, struct fsnotify_mark, g_list); -+ fsnotify_get_mark(mark); -+ fsnotify_destroy_mark_locked(mark, group); -+ mutex_unlock(&group->mark_mutex); -+ fsnotify_put_mark(mark); -+ } - } - - /* -diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c -index 19986959d149..fa742590bc3d 100644 ---- a/fs/ocfs2/dlmglue.c -+++ b/fs/ocfs2/dlmglue.c -@@ -3973,9 +3973,13 @@ static void ocfs2_downconvert_thread_do_work(struct ocfs2_super *osb) - osb->dc_work_sequence = osb->dc_wake_sequence; - - processed = osb->blocked_lock_count; -- while (processed) { -- BUG_ON(list_empty(&osb->blocked_lock_list)); -- -+ /* -+ * blocked lock processing in this loop might call iput which can -+ * remove items off osb->blocked_lock_list. Downconvert up to -+ * 'processed' number of locks, but stop short if we had some -+ * removed in ocfs2_mark_lockres_freeing when downconverting. -+ */ -+ while (processed && !list_empty(&osb->blocked_lock_list)) { - lockres = list_entry(osb->blocked_lock_list.next, - struct ocfs2_lock_res, l_blocked_list); - list_del_init(&lockres->l_blocked_list); -diff --git a/fs/signalfd.c b/fs/signalfd.c -index 424b7b65321f..148f8e7af882 100644 ---- a/fs/signalfd.c -+++ b/fs/signalfd.c -@@ -121,8 +121,9 @@ static int signalfd_copyinfo(struct signalfd_siginfo __user *uinfo, - * Other callers might not initialize the si_lsb field, - * so check explicitly for the right codes here. - */ -- if (kinfo->si_code == BUS_MCEERR_AR || -- kinfo->si_code == BUS_MCEERR_AO) -+ if (kinfo->si_signo == SIGBUS && -+ (kinfo->si_code == BUS_MCEERR_AR || -+ kinfo->si_code == BUS_MCEERR_AO)) - err |= __put_user((short) kinfo->si_addr_lsb, - &uinfo->ssi_addr_lsb); - #endif -diff --git a/include/linux/dcache.h b/include/linux/dcache.h -index 0f0eb1c1e676..2a23ecb4f71c 100644 ---- a/include/linux/dcache.h -+++ b/include/linux/dcache.h -@@ -221,6 +221,8 @@ struct dentry_operations { - #define DCACHE_SYMLINK_TYPE 0x00300000 /* Symlink */ - #define DCACHE_FILE_TYPE 0x00400000 /* Other file type */ - -+#define DCACHE_MAY_FREE 0x00800000 -+ - extern seqlock_t rename_lock; - - static inline int dname_external(const struct dentry *dentry) -diff --git a/include/uapi/linux/pci_regs.h b/include/uapi/linux/pci_regs.h -index 30db069bce62..788c5aa055d7 100644 ---- a/include/uapi/linux/pci_regs.h -+++ b/include/uapi/linux/pci_regs.h -@@ -319,6 +319,7 @@ - #define PCI_MSIX_PBA 8 /* Pending Bit Array offset */ - #define PCI_MSIX_PBA_BIR 0x00000007 /* BAR index */ - #define PCI_MSIX_PBA_OFFSET 0xfffffff8 /* Offset into specified BAR */ -+#define PCI_MSIX_FLAGS_BIRMASK PCI_MSIX_PBA_BIR /* deprecated */ - #define PCI_CAP_MSIX_SIZEOF 12 /* size of MSIX registers */ - - /* MSI-X Table entry format */ -diff --git a/ipc/mqueue.c b/ipc/mqueue.c -index c3b31179122c..9699d3f7989c 100644 ---- a/ipc/mqueue.c -+++ b/ipc/mqueue.c -@@ -143,7 +143,6 @@ static int msg_insert(struct msg_msg *msg, struct mqueue_inode_info *info) - if (!leaf) - return -ENOMEM; - INIT_LIST_HEAD(&leaf->msg_list); -- info->qsize += sizeof(*leaf); - } - leaf->priority = msg->m_type; - rb_link_node(&leaf->rb_node, parent, p); -@@ -188,7 +187,6 @@ try_again: - "lazy leaf delete!\n"); - rb_erase(&leaf->rb_node, &info->msg_tree); - if (info->node_cache) { -- info->qsize -= sizeof(*leaf); - kfree(leaf); - } else { - info->node_cache = leaf; -@@ -201,7 +199,6 @@ try_again: - if (list_empty(&leaf->msg_list)) { - rb_erase(&leaf->rb_node, &info->msg_tree); - if (info->node_cache) { -- info->qsize -= sizeof(*leaf); - kfree(leaf); - } else { - info->node_cache = leaf; -@@ -1026,7 +1023,6 @@ SYSCALL_DEFINE5(mq_timedsend, mqd_t, mqdes, const char __user *, u_msg_ptr, - /* Save our speculative allocation into the cache */ - INIT_LIST_HEAD(&new_leaf->msg_list); - info->node_cache = new_leaf; -- info->qsize += sizeof(*new_leaf); - new_leaf = NULL; - } else { - kfree(new_leaf); -@@ -1133,7 +1129,6 @@ SYSCALL_DEFINE5(mq_timedreceive, mqd_t, mqdes, char __user *, u_msg_ptr, - /* Save our speculative allocation into the cache */ - INIT_LIST_HEAD(&new_leaf->msg_list); - info->node_cache = new_leaf; -- info->qsize += sizeof(*new_leaf); - } else { - kfree(new_leaf); - } -diff --git a/kernel/signal.c b/kernel/signal.c -index 52f881db1ca0..15c22ee11156 100644 ---- a/kernel/signal.c -+++ b/kernel/signal.c -@@ -2768,7 +2768,8 @@ int copy_siginfo_to_user(siginfo_t __user *to, const siginfo_t *from) - * Other callers might not initialize the si_lsb field, - * so check explicitly for the right codes here. - */ -- if (from->si_code == BUS_MCEERR_AR || from->si_code == BUS_MCEERR_AO) -+ if (from->si_signo == SIGBUS && -+ (from->si_code == BUS_MCEERR_AR || from->si_code == BUS_MCEERR_AO)) - err |= __put_user(from->si_addr_lsb, &to->si_addr_lsb); - #endif - break; -@@ -3035,7 +3036,7 @@ COMPAT_SYSCALL_DEFINE3(rt_sigqueueinfo, - int, sig, - struct compat_siginfo __user *, uinfo) - { -- siginfo_t info; -+ siginfo_t info = {}; - int ret = copy_siginfo_from_user32(&info, uinfo); - if (unlikely(ret)) - return ret; -@@ -3081,7 +3082,7 @@ COMPAT_SYSCALL_DEFINE4(rt_tgsigqueueinfo, - int, sig, - struct compat_siginfo __user *, uinfo) - { -- siginfo_t info; -+ siginfo_t info = {}; - - if (copy_siginfo_from_user32(&info, uinfo)) - return -EFAULT; -diff --git a/mm/vmscan.c b/mm/vmscan.c -index b850ced69ed6..88edf53748ee 100644 ---- a/mm/vmscan.c -+++ b/mm/vmscan.c -@@ -871,21 +871,17 @@ static unsigned long shrink_page_list(struct list_head *page_list, - * - * 2) Global reclaim encounters a page, memcg encounters a - * page that is not marked for immediate reclaim or -- * the caller does not have __GFP_IO. In this case mark -+ * the caller does not have __GFP_FS (or __GFP_IO if it's -+ * simply going to swap, not to fs). In this case mark - * the page for immediate reclaim and continue scanning. - * -- * __GFP_IO is checked because a loop driver thread might -+ * Require may_enter_fs because we would wait on fs, which -+ * may not have submitted IO yet. And the loop driver might - * enter reclaim, and deadlock if it waits on a page for - * which it is needed to do the write (loop masks off - * __GFP_IO|__GFP_FS for this reason); but more thought - * would probably show more reasons. - * -- * Don't require __GFP_FS, since we're not going into the -- * FS, just waiting on its writeback completion. Worryingly, -- * ext4 gfs2 and xfs allocate pages with -- * grab_cache_page_write_begin(,,AOP_FLAG_NOFS), so testing -- * may_enter_fs here is liable to OOM on them. -- * - * 3) memcg encounters a page that is not already marked - * PageReclaim. memcg does not have any dirty pages - * throttling so we could easily OOM just because too many -@@ -902,7 +898,7 @@ static unsigned long shrink_page_list(struct list_head *page_list, - - /* Case 2 above */ - } else if (global_reclaim(sc) || -- !PageReclaim(page) || !(sc->gfp_mask & __GFP_IO)) { -+ !PageReclaim(page) || !may_enter_fs) { - /* - * This is slightly racy - end_page_writeback() - * might have just cleared PageReclaim, then -diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c -index 085c4964be99..9d8e420a80d9 100644 ---- a/security/integrity/ima/ima_policy.c -+++ b/security/integrity/ima/ima_policy.c -@@ -27,6 +27,8 @@ - #define IMA_UID 0x0008 - #define IMA_FOWNER 0x0010 - #define IMA_FSUUID 0x0020 -+#define IMA_INMASK 0x0040 -+#define IMA_EUID 0x0080 - - #define UNKNOWN 0 - #define MEASURE 0x0001 /* same as IMA_MEASURE */ -@@ -171,6 +173,9 @@ static bool ima_match_rules(struct ima_rule_entry *rule, - return false; - if ((rule->flags & IMA_MASK) && rule->mask != mask) - return false; -+ if ((rule->flags & IMA_INMASK) && -+ (!(rule->mask & mask) && func != POST_SETATTR)) -+ return false; - if ((rule->flags & IMA_FSMAGIC) - && rule->fsmagic != inode->i_sb->s_magic) - return false; -@@ -179,6 +184,16 @@ static bool ima_match_rules(struct ima_rule_entry *rule, - return false; - if ((rule->flags & IMA_UID) && !uid_eq(rule->uid, cred->uid)) - return false; -+ if (rule->flags & IMA_EUID) { -+ if (has_capability_noaudit(current, CAP_SETUID)) { -+ if (!uid_eq(rule->uid, cred->euid) -+ && !uid_eq(rule->uid, cred->suid) -+ && !uid_eq(rule->uid, cred->uid)) -+ return false; -+ } else if (!uid_eq(rule->uid, cred->euid)) -+ return false; -+ } -+ - if ((rule->flags & IMA_FOWNER) && !uid_eq(rule->fowner, inode->i_uid)) - return false; - for (i = 0; i < MAX_LSM_RULES; i++) { -@@ -350,7 +365,8 @@ enum { - Opt_audit, - Opt_obj_user, Opt_obj_role, Opt_obj_type, - Opt_subj_user, Opt_subj_role, Opt_subj_type, -- Opt_func, Opt_mask, Opt_fsmagic, Opt_uid, Opt_fowner, -+ Opt_func, Opt_mask, Opt_fsmagic, -+ Opt_uid, Opt_euid, Opt_fowner, - Opt_appraise_type, Opt_fsuuid, Opt_permit_directio - }; - -@@ -371,6 +387,7 @@ static match_table_t policy_tokens = { - {Opt_fsmagic, "fsmagic=%s"}, - {Opt_fsuuid, "fsuuid=%s"}, - {Opt_uid, "uid=%s"}, -+ {Opt_euid, "euid=%s"}, - {Opt_fowner, "fowner=%s"}, - {Opt_appraise_type, "appraise_type=%s"}, - {Opt_permit_directio, "permit_directio"}, -@@ -412,6 +429,7 @@ static void ima_log_string(struct audit_buffer *ab, char *key, char *value) - static int ima_parse_rule(char *rule, struct ima_rule_entry *entry) - { - struct audit_buffer *ab; -+ char *from; - char *p; - int result = 0; - -@@ -500,18 +518,23 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry) - if (entry->mask) - result = -EINVAL; - -- if ((strcmp(args[0].from, "MAY_EXEC")) == 0) -+ from = args[0].from; -+ if (*from == '^') -+ from++; -+ -+ if ((strcmp(from, "MAY_EXEC")) == 0) - entry->mask = MAY_EXEC; -- else if (strcmp(args[0].from, "MAY_WRITE") == 0) -+ else if (strcmp(from, "MAY_WRITE") == 0) - entry->mask = MAY_WRITE; -- else if (strcmp(args[0].from, "MAY_READ") == 0) -+ else if (strcmp(from, "MAY_READ") == 0) - entry->mask = MAY_READ; -- else if (strcmp(args[0].from, "MAY_APPEND") == 0) -+ else if (strcmp(from, "MAY_APPEND") == 0) - entry->mask = MAY_APPEND; - else - result = -EINVAL; - if (!result) -- entry->flags |= IMA_MASK; -+ entry->flags |= (*args[0].from == '^') -+ ? IMA_INMASK : IMA_MASK; - break; - case Opt_fsmagic: - ima_log_string(ab, "fsmagic", args[0].from); -@@ -542,6 +565,9 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry) - break; - case Opt_uid: - ima_log_string(ab, "uid", args[0].from); -+ case Opt_euid: -+ if (token == Opt_euid) -+ ima_log_string(ab, "euid", args[0].from); - - if (uid_valid(entry->uid)) { - result = -EINVAL; -@@ -550,11 +576,14 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry) - - result = strict_strtoul(args[0].from, 10, &lnum); - if (!result) { -- entry->uid = make_kuid(current_user_ns(), (uid_t)lnum); -- if (!uid_valid(entry->uid) || (((uid_t)lnum) != lnum)) -+ entry->uid = make_kuid(current_user_ns(), -+ (uid_t) lnum); -+ if (!uid_valid(entry->uid) || -+ (uid_t)lnum != lnum) - result = -EINVAL; - else -- entry->flags |= IMA_UID; -+ entry->flags |= (token == Opt_uid) -+ ? IMA_UID : IMA_EUID; - } - break; - case Opt_fowner: -diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c -index 51e208022cc8..7b0aac9d27ca 100644 ---- a/sound/pci/hda/patch_cirrus.c -+++ b/sound/pci/hda/patch_cirrus.c -@@ -1002,9 +1002,7 @@ static void cs4210_spdif_automute(struct hda_codec *codec, - - spec->spdif_present = spdif_present; - /* SPDIF TX on/off */ -- if (spdif_present) -- snd_hda_set_pin_ctl(codec, spdif_pin, -- spdif_present ? PIN_OUT : 0); -+ snd_hda_set_pin_ctl(codec, spdif_pin, spdif_present ? PIN_OUT : 0); - - cs_automute(codec); - } -diff --git a/sound/soc/codecs/pcm1681.c b/sound/soc/codecs/pcm1681.c -index 651e2fe2c31f..dfa9755da118 100644 ---- a/sound/soc/codecs/pcm1681.c -+++ b/sound/soc/codecs/pcm1681.c -@@ -102,7 +102,7 @@ static int pcm1681_set_deemph(struct snd_soc_codec *codec) - - if (val != -1) { - regmap_update_bits(priv->regmap, PCM1681_DEEMPH_CONTROL, -- PCM1681_DEEMPH_RATE_MASK, val); -+ PCM1681_DEEMPH_RATE_MASK, val << 3); - enable = 1; - } else - enable = 0; diff --git a/patch/kernel/odroidc2-default/patch-3.14.51-52.patch b/patch/kernel/odroidc2-default/patch-3.14.51-52.patch deleted file mode 100644 index 1af1483890..0000000000 --- a/patch/kernel/odroidc2-default/patch-3.14.51-52.patch +++ /dev/null @@ -1,568 +0,0 @@ -diff --git a/Makefile b/Makefile -index 83275d8ed880..3a5d4316c4c7 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 3 - PATCHLEVEL = 14 --SUBLEVEL = 51 -+SUBLEVEL = 52 - EXTRAVERSION = - NAME = Remembering Coco - -diff --git a/arch/arm64/kvm/inject_fault.c b/arch/arm64/kvm/inject_fault.c -index 81a02a8762b0..86825f8883de 100644 ---- a/arch/arm64/kvm/inject_fault.c -+++ b/arch/arm64/kvm/inject_fault.c -@@ -168,8 +168,8 @@ void kvm_inject_dabt(struct kvm_vcpu *vcpu, unsigned long addr) - { - if (!(vcpu->arch.hcr_el2 & HCR_RW)) - inject_abt32(vcpu, false, addr); -- -- inject_abt64(vcpu, false, addr); -+ else -+ inject_abt64(vcpu, false, addr); - } - - /** -@@ -184,8 +184,8 @@ void kvm_inject_pabt(struct kvm_vcpu *vcpu, unsigned long addr) - { - if (!(vcpu->arch.hcr_el2 & HCR_RW)) - inject_abt32(vcpu, true, addr); -- -- inject_abt64(vcpu, true, addr); -+ else -+ inject_abt64(vcpu, true, addr); - } - - /** -@@ -198,6 +198,6 @@ void kvm_inject_undefined(struct kvm_vcpu *vcpu) - { - if (!(vcpu->arch.hcr_el2 & HCR_RW)) - inject_undef32(vcpu); -- -- inject_undef64(vcpu); -+ else -+ inject_undef64(vcpu); - } -diff --git a/arch/arm64/mm/mmap.c b/arch/arm64/mm/mmap.c -index 8ed6cb1a900f..8f7ffffc63e9 100644 ---- a/arch/arm64/mm/mmap.c -+++ b/arch/arm64/mm/mmap.c -@@ -47,22 +47,14 @@ static int mmap_is_legacy(void) - return sysctl_legacy_va_layout; - } - --/* -- * Since get_random_int() returns the same value within a 1 jiffy window, we -- * will almost always get the same randomisation for the stack and mmap -- * region. This will mean the relative distance between stack and mmap will be -- * the same. -- * -- * To avoid this we can shift the randomness by 1 bit. -- */ - static unsigned long mmap_rnd(void) - { - unsigned long rnd = 0; - - if (current->flags & PF_RANDOMIZE) -- rnd = (long)get_random_int() & (STACK_RND_MASK >> 1); -+ rnd = (long)get_random_int() & STACK_RND_MASK; - -- return rnd << (PAGE_SHIFT + 1); -+ return rnd << PAGE_SHIFT; - } - - static unsigned long mmap_base(void) -diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c -index 2b946bc4212d..f3f71369adc7 100644 ---- a/drivers/base/regmap/regcache-rbtree.c -+++ b/drivers/base/regmap/regcache-rbtree.c -@@ -302,11 +302,20 @@ static int regcache_rbtree_insert_to_block(struct regmap *map, - if (!blk) - return -ENOMEM; - -- present = krealloc(rbnode->cache_present, -- BITS_TO_LONGS(blklen) * sizeof(*present), GFP_KERNEL); -- if (!present) { -- kfree(blk); -- return -ENOMEM; -+ if (BITS_TO_LONGS(blklen) > BITS_TO_LONGS(rbnode->blklen)) { -+ present = krealloc(rbnode->cache_present, -+ BITS_TO_LONGS(blklen) * sizeof(*present), -+ GFP_KERNEL); -+ if (!present) { -+ kfree(blk); -+ return -ENOMEM; -+ } -+ -+ memset(present + BITS_TO_LONGS(rbnode->blklen), 0, -+ (BITS_TO_LONGS(blklen) - BITS_TO_LONGS(rbnode->blklen)) -+ * sizeof(*present)); -+ } else { -+ present = rbnode->cache_present; - } - - /* insert the register value in the correct place in the rbnode block */ -diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c -index efe1b4761735..e88556ac8318 100644 ---- a/drivers/block/xen-blkfront.c -+++ b/drivers/block/xen-blkfront.c -@@ -1093,8 +1093,10 @@ static void blkif_completion(struct blk_shadow *s, struct blkfront_info *info, - * Add the used indirect page back to the list of - * available pages for indirect grefs. - */ -- indirect_page = pfn_to_page(s->indirect_grants[i]->pfn); -- list_add(&indirect_page->lru, &info->indirect_pages); -+ if (!info->feature_persistent) { -+ indirect_page = pfn_to_page(s->indirect_grants[i]->pfn); -+ list_add(&indirect_page->lru, &info->indirect_pages); -+ } - s->indirect_grants[i]->gref = GRANT_INVALID_REF; - list_add_tail(&s->indirect_grants[i]->node, &info->grants); - } -diff --git a/drivers/crypto/caam/caamhash.c b/drivers/crypto/caam/caamhash.c -index d97a03dbf42c..1489927bdda1 100644 ---- a/drivers/crypto/caam/caamhash.c -+++ b/drivers/crypto/caam/caamhash.c -@@ -900,13 +900,14 @@ static int ahash_final_ctx(struct ahash_request *req) - state->buflen_1; - u32 *sh_desc = ctx->sh_desc_fin, *desc; - dma_addr_t ptr = ctx->sh_desc_fin_dma; -- int sec4_sg_bytes; -+ int sec4_sg_bytes, sec4_sg_src_index; - int digestsize = crypto_ahash_digestsize(ahash); - struct ahash_edesc *edesc; - int ret = 0; - int sh_len; - -- sec4_sg_bytes = (1 + (buflen ? 1 : 0)) * sizeof(struct sec4_sg_entry); -+ sec4_sg_src_index = 1 + (buflen ? 1 : 0); -+ sec4_sg_bytes = sec4_sg_src_index * sizeof(struct sec4_sg_entry); - - /* allocate space for base edesc and hw desc commands, link tables */ - edesc = kmalloc(sizeof(struct ahash_edesc) + DESC_JOB_IO_LEN + -@@ -933,7 +934,7 @@ static int ahash_final_ctx(struct ahash_request *req) - state->buf_dma = try_buf_map_to_sec4_sg(jrdev, edesc->sec4_sg + 1, - buf, state->buf_dma, buflen, - last_buflen); -- (edesc->sec4_sg + sec4_sg_bytes - 1)->len |= SEC4_SG_LEN_FIN; -+ (edesc->sec4_sg + sec4_sg_src_index - 1)->len |= SEC4_SG_LEN_FIN; - - append_seq_in_ptr(desc, edesc->sec4_sg_dma, ctx->ctx_len + buflen, - LDST_SGF); -diff --git a/drivers/edac/ppc4xx_edac.c b/drivers/edac/ppc4xx_edac.c -index ef6b7e08f485..5c361f3c66aa 100644 ---- a/drivers/edac/ppc4xx_edac.c -+++ b/drivers/edac/ppc4xx_edac.c -@@ -921,7 +921,7 @@ static int ppc4xx_edac_init_csrows(struct mem_ctl_info *mci, u32 mcopt1) - */ - - for (row = 0; row < mci->nr_csrows; row++) { -- struct csrow_info *csi = &mci->csrows[row]; -+ struct csrow_info *csi = mci->csrows[row]; - - /* - * Get the configuration settings for this -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c -index a3480c13eb1b..9fe10d1ad2e4 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c -@@ -2475,7 +2475,7 @@ int vmw_execbuf_process(struct drm_file *file_priv, - - ret = vmw_resources_validate(sw_context); - if (unlikely(ret != 0)) -- goto out_err; -+ goto out_err_nores; - - if (throttle_us) { - ret = vmw_wait_lag(dev_priv, &dev_priv->fifo.marker_queue, -@@ -2511,6 +2511,7 @@ int vmw_execbuf_process(struct drm_file *file_priv, - vmw_resource_relocations_free(&sw_context->res_relocations); - - vmw_fifo_commit(dev_priv, command_size); -+ mutex_unlock(&dev_priv->binding_mutex); - - vmw_query_bo_switch_commit(dev_priv, sw_context); - ret = vmw_execbuf_fence_commands(file_priv, dev_priv, -@@ -2526,7 +2527,6 @@ int vmw_execbuf_process(struct drm_file *file_priv, - DRM_ERROR("Fence submission error. Syncing.\n"); - - vmw_resource_list_unreserve(&sw_context->resource_list, false); -- mutex_unlock(&dev_priv->binding_mutex); - - ttm_eu_fence_buffer_objects(&ticket, &sw_context->validate_nodes, - (void *) fence); -diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c -index e9d33ad59df5..3412b86e79fd 100644 ---- a/drivers/md/dm-thin-metadata.c -+++ b/drivers/md/dm-thin-metadata.c -@@ -1295,8 +1295,8 @@ static int __release_metadata_snap(struct dm_pool_metadata *pmd) - return r; - - disk_super = dm_block_data(copy); -- dm_sm_dec_block(pmd->metadata_sm, le64_to_cpu(disk_super->data_mapping_root)); -- dm_sm_dec_block(pmd->metadata_sm, le64_to_cpu(disk_super->device_details_root)); -+ dm_btree_del(&pmd->info, le64_to_cpu(disk_super->data_mapping_root)); -+ dm_btree_del(&pmd->details_info, le64_to_cpu(disk_super->device_details_root)); - dm_sm_dec_block(pmd->metadata_sm, held_root); - - return dm_tm_unlock(pmd->tm, copy); -diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c -index 1b3a09473452..30f9ef0c0d4f 100644 ---- a/drivers/scsi/libfc/fc_exch.c -+++ b/drivers/scsi/libfc/fc_exch.c -@@ -733,8 +733,6 @@ static bool fc_invoke_resp(struct fc_exch *ep, struct fc_seq *sp, - if (resp) { - resp(sp, fp, arg); - res = true; -- } else if (!IS_ERR(fp)) { -- fc_frame_free(fp); - } - - spin_lock_bh(&ep->ex_lock); -@@ -1596,7 +1594,8 @@ static void fc_exch_recv_seq_resp(struct fc_exch_mgr *mp, struct fc_frame *fp) - * If new exch resp handler is valid then call that - * first. - */ -- fc_invoke_resp(ep, sp, fp); -+ if (!fc_invoke_resp(ep, sp, fp)) -+ fc_frame_free(fp); - - fc_exch_release(ep); - return; -@@ -1695,7 +1694,8 @@ static void fc_exch_abts_resp(struct fc_exch *ep, struct fc_frame *fp) - fc_exch_hold(ep); - if (!rc) - fc_exch_delete(ep); -- fc_invoke_resp(ep, sp, fp); -+ if (!fc_invoke_resp(ep, sp, fp)) -+ fc_frame_free(fp); - if (has_rec) - fc_exch_timer_set(ep, ep->r_a_tov); - fc_exch_release(ep); -diff --git a/drivers/scsi/libfc/fc_fcp.c b/drivers/scsi/libfc/fc_fcp.c -index 1d7e76e8b447..ae6fc1a94568 100644 ---- a/drivers/scsi/libfc/fc_fcp.c -+++ b/drivers/scsi/libfc/fc_fcp.c -@@ -1039,11 +1039,26 @@ restart: - fc_fcp_pkt_hold(fsp); - spin_unlock_irqrestore(&si->scsi_queue_lock, flags); - -- if (!fc_fcp_lock_pkt(fsp)) { -+ spin_lock_bh(&fsp->scsi_pkt_lock); -+ if (!(fsp->state & FC_SRB_COMPL)) { -+ fsp->state |= FC_SRB_COMPL; -+ /* -+ * TODO: dropping scsi_pkt_lock and then reacquiring -+ * again around fc_fcp_cleanup_cmd() is required, -+ * since fc_fcp_cleanup_cmd() calls into -+ * fc_seq_set_resp() and that func preempts cpu using -+ * schedule. May be schedule and related code should be -+ * removed instead of unlocking here to avoid scheduling -+ * while atomic bug. -+ */ -+ spin_unlock_bh(&fsp->scsi_pkt_lock); -+ - fc_fcp_cleanup_cmd(fsp, error); -+ -+ spin_lock_bh(&fsp->scsi_pkt_lock); - fc_io_compl(fsp); -- fc_fcp_unlock_pkt(fsp); - } -+ spin_unlock_bh(&fsp->scsi_pkt_lock); - - fc_fcp_pkt_release(fsp); - spin_lock_irqsave(&si->scsi_queue_lock, flags); -diff --git a/drivers/scsi/scsi_pm.c b/drivers/scsi/scsi_pm.c -index 001e9ceda4c3..a59be67b92d5 100644 ---- a/drivers/scsi/scsi_pm.c -+++ b/drivers/scsi/scsi_pm.c -@@ -149,15 +149,15 @@ static int sdev_runtime_suspend(struct device *dev) - { - const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL; - struct scsi_device *sdev = to_scsi_device(dev); -- int err; -+ int err = 0; - -- err = blk_pre_runtime_suspend(sdev->request_queue); -- if (err) -- return err; -- if (pm && pm->runtime_suspend) -+ if (pm && pm->runtime_suspend) { -+ err = blk_pre_runtime_suspend(sdev->request_queue); -+ if (err) -+ return err; - err = pm->runtime_suspend(dev); -- blk_post_runtime_suspend(sdev->request_queue, err); -- -+ blk_post_runtime_suspend(sdev->request_queue, err); -+ } - return err; - } - -@@ -180,11 +180,11 @@ static int sdev_runtime_resume(struct device *dev) - const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL; - int err = 0; - -- blk_pre_runtime_resume(sdev->request_queue); -- if (pm && pm->runtime_resume) -+ if (pm && pm->runtime_resume) { -+ blk_pre_runtime_resume(sdev->request_queue); - err = pm->runtime_resume(dev); -- blk_post_runtime_resume(sdev->request_queue, err); -- -+ blk_post_runtime_resume(sdev->request_queue, err); -+ } - return err; - } - -diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h -index bb5367d288fb..7e9a0a6c655b 100644 ---- a/include/drm/drm_pciids.h -+++ b/include/drm/drm_pciids.h -@@ -172,6 +172,7 @@ - {0x1002, 0x6610, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_NEW_MEMMAP}, \ - {0x1002, 0x6611, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_NEW_MEMMAP}, \ - {0x1002, 0x6613, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_NEW_MEMMAP}, \ -+ {0x1002, 0x6617, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \ - {0x1002, 0x6620, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \ - {0x1002, 0x6621, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \ - {0x1002, 0x6623, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \ -diff --git a/ipc/sem.c b/ipc/sem.c -index bee555417312..e53c96f7db42 100644 ---- a/ipc/sem.c -+++ b/ipc/sem.c -@@ -253,6 +253,16 @@ static void sem_rcu_free(struct rcu_head *head) - } - - /* -+ * spin_unlock_wait() and !spin_is_locked() are not memory barriers, they -+ * are only control barriers. -+ * The code must pair with spin_unlock(&sem->lock) or -+ * spin_unlock(&sem_perm.lock), thus just the control barrier is insufficient. -+ * -+ * smp_rmb() is sufficient, as writes cannot pass the control barrier. -+ */ -+#define ipc_smp_acquire__after_spin_is_unlocked() smp_rmb() -+ -+/* - * Wait until all currently ongoing simple ops have completed. - * Caller must own sem_perm.lock. - * New simple ops cannot start, because simple ops first check -@@ -275,6 +285,7 @@ static void sem_wait_array(struct sem_array *sma) - sem = sma->sem_base + i; - spin_unlock_wait(&sem->lock); - } -+ ipc_smp_acquire__after_spin_is_unlocked(); - } - - /* -@@ -326,8 +337,13 @@ static inline int sem_lock(struct sem_array *sma, struct sembuf *sops, - - /* Then check that the global lock is free */ - if (!spin_is_locked(&sma->sem_perm.lock)) { -- /* spin_is_locked() is not a memory barrier */ -- smp_mb(); -+ /* -+ * We need a memory barrier with acquire semantics, -+ * otherwise we can race with another thread that does: -+ * complex_count++; -+ * spin_unlock(sem_perm.lock); -+ */ -+ ipc_smp_acquire__after_spin_is_unlocked(); - - /* Now repeat the test of complex_count: - * It can't change anymore until we drop sem->lock. -@@ -2055,17 +2071,28 @@ void exit_sem(struct task_struct *tsk) - rcu_read_lock(); - un = list_entry_rcu(ulp->list_proc.next, - struct sem_undo, list_proc); -- if (&un->list_proc == &ulp->list_proc) -- semid = -1; -- else -- semid = un->semid; -+ if (&un->list_proc == &ulp->list_proc) { -+ /* -+ * We must wait for freeary() before freeing this ulp, -+ * in case we raced with last sem_undo. There is a small -+ * possibility where we exit while freeary() didn't -+ * finish unlocking sem_undo_list. -+ */ -+ spin_unlock_wait(&ulp->lock); -+ rcu_read_unlock(); -+ break; -+ } -+ spin_lock(&ulp->lock); -+ semid = un->semid; -+ spin_unlock(&ulp->lock); - -+ /* exit_sem raced with IPC_RMID, nothing to do */ - if (semid == -1) { - rcu_read_unlock(); -- break; -+ continue; - } - -- sma = sem_obtain_object_check(tsk->nsproxy->ipc_ns, un->semid); -+ sma = sem_obtain_object_check(tsk->nsproxy->ipc_ns, semid); - /* exit_sem raced with IPC_RMID, nothing to do */ - if (IS_ERR(sma)) { - rcu_read_unlock(); -diff --git a/kernel/events/core.c b/kernel/events/core.c -index 60146febb9b3..3bf20e36a8e7 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -3562,28 +3562,21 @@ static void perf_event_for_each(struct perf_event *event, - mutex_unlock(&ctx->mutex); - } - --static int perf_event_period(struct perf_event *event, u64 __user *arg) --{ -- struct perf_event_context *ctx = event->ctx; -- int ret = 0, active; -+struct period_event { -+ struct perf_event *event; - u64 value; -+}; - -- if (!is_sampling_event(event)) -- return -EINVAL; -- -- if (copy_from_user(&value, arg, sizeof(value))) -- return -EFAULT; -- -- if (!value) -- return -EINVAL; -+static int __perf_event_period(void *info) -+{ -+ struct period_event *pe = info; -+ struct perf_event *event = pe->event; -+ struct perf_event_context *ctx = event->ctx; -+ u64 value = pe->value; -+ bool active; - -- raw_spin_lock_irq(&ctx->lock); -+ raw_spin_lock(&ctx->lock); - if (event->attr.freq) { -- if (value > sysctl_perf_event_sample_rate) { -- ret = -EINVAL; -- goto unlock; -- } -- - event->attr.sample_freq = value; - } else { - event->attr.sample_period = value; -@@ -3602,11 +3595,53 @@ static int perf_event_period(struct perf_event *event, u64 __user *arg) - event->pmu->start(event, PERF_EF_RELOAD); - perf_pmu_enable(ctx->pmu); - } -+ raw_spin_unlock(&ctx->lock); - --unlock: -+ return 0; -+} -+ -+static int perf_event_period(struct perf_event *event, u64 __user *arg) -+{ -+ struct period_event pe = { .event = event, }; -+ struct perf_event_context *ctx = event->ctx; -+ struct task_struct *task; -+ u64 value; -+ -+ if (!is_sampling_event(event)) -+ return -EINVAL; -+ -+ if (copy_from_user(&value, arg, sizeof(value))) -+ return -EFAULT; -+ -+ if (!value) -+ return -EINVAL; -+ -+ if (event->attr.freq && value > sysctl_perf_event_sample_rate) -+ return -EINVAL; -+ -+ task = ctx->task; -+ pe.value = value; -+ -+ if (!task) { -+ cpu_function_call(event->cpu, __perf_event_period, &pe); -+ return 0; -+ } -+ -+retry: -+ if (!task_function_call(task, __perf_event_period, &pe)) -+ return 0; -+ -+ raw_spin_lock_irq(&ctx->lock); -+ if (ctx->is_active) { -+ raw_spin_unlock_irq(&ctx->lock); -+ task = ctx->task; -+ goto retry; -+ } -+ -+ __perf_event_period(&pe); - raw_spin_unlock_irq(&ctx->lock); - -- return ret; -+ return 0; - } - - static const struct file_operations perf_fops; -@@ -4218,12 +4253,20 @@ static const struct file_operations perf_fops = { - * to user-space before waking everybody up. - */ - -+static inline struct fasync_struct **perf_event_fasync(struct perf_event *event) -+{ -+ /* only the parent has fasync state */ -+ if (event->parent) -+ event = event->parent; -+ return &event->fasync; -+} -+ - void perf_event_wakeup(struct perf_event *event) - { - ring_buffer_wakeup(event); - - if (event->pending_kill) { -- kill_fasync(&event->fasync, SIGIO, event->pending_kill); -+ kill_fasync(perf_event_fasync(event), SIGIO, event->pending_kill); - event->pending_kill = 0; - } - } -@@ -5432,7 +5475,7 @@ static int __perf_event_overflow(struct perf_event *event, - else - perf_event_output(event, data, regs); - -- if (event->fasync && event->pending_kill) { -+ if (*perf_event_fasync(event) && event->pending_kill) { - event->pending_wakeup = 1; - irq_work_queue(&event->pending); - } -diff --git a/mm/memory-failure.c b/mm/memory-failure.c -index 9502057c3c54..42aeb848b8e9 100644 ---- a/mm/memory-failure.c -+++ b/mm/memory-failure.c -@@ -1510,6 +1510,8 @@ static int get_any_page(struct page *page, unsigned long pfn, int flags) - */ - ret = __get_any_page(page, pfn, 0); - if (!PageLRU(page)) { -+ /* Drop page reference which is from __get_any_page() */ -+ put_page(page); - pr_info("soft_offline: %#lx: unknown non LRU page type %lx\n", - pfn, page->flags); - return -EIO; -diff --git a/scripts/kconfig/streamline_config.pl b/scripts/kconfig/streamline_config.pl -index 31331723e810..9969feefb720 100644 ---- a/scripts/kconfig/streamline_config.pl -+++ b/scripts/kconfig/streamline_config.pl -@@ -137,7 +137,7 @@ my $ksource = ($ARGV[0] ? $ARGV[0] : '.'); - my $kconfig = $ARGV[1]; - my $lsmod_file = $ENV{'LSMOD'}; - --my @makefiles = `find $ksource -name Makefile 2>/dev/null`; -+my @makefiles = `find $ksource -name Makefile -or -name Kbuild 2>/dev/null`; - chomp @makefiles; - - my %depends; diff --git a/patch/kernel/odroidc2-default/patch-3.14.52-53.patch b/patch/kernel/odroidc2-default/patch-3.14.52-53.patch deleted file mode 100644 index 857b37d07b..0000000000 --- a/patch/kernel/odroidc2-default/patch-3.14.52-53.patch +++ /dev/null @@ -1,940 +0,0 @@ -diff --git a/Documentation/ABI/testing/configfs-usb-gadget-loopback b/Documentation/ABI/testing/configfs-usb-gadget-loopback -index 9aae5bfb9908..06beefbcf061 100644 ---- a/Documentation/ABI/testing/configfs-usb-gadget-loopback -+++ b/Documentation/ABI/testing/configfs-usb-gadget-loopback -@@ -5,4 +5,4 @@ Description: - The attributes: - - qlen - depth of loopback queue -- bulk_buflen - buffer length -+ buflen - buffer length -diff --git a/Documentation/ABI/testing/configfs-usb-gadget-sourcesink b/Documentation/ABI/testing/configfs-usb-gadget-sourcesink -index 29477c319f61..bc7ff731aa0c 100644 ---- a/Documentation/ABI/testing/configfs-usb-gadget-sourcesink -+++ b/Documentation/ABI/testing/configfs-usb-gadget-sourcesink -@@ -9,4 +9,4 @@ Description: - isoc_maxpacket - 0 - 1023 (fs), 0 - 1024 (hs/ss) - isoc_mult - 0..2 (hs/ss only) - isoc_maxburst - 0..15 (ss only) -- qlen - buffer length -+ buflen - buffer length -diff --git a/Makefile b/Makefile -index 3a5d4316c4c7..86d227774ae6 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 3 - PATCHLEVEL = 14 --SUBLEVEL = 52 -+SUBLEVEL = 53 - EXTRAVERSION = - NAME = Remembering Coco - -diff --git a/arch/arm/mach-omap2/clockdomains7xx_data.c b/arch/arm/mach-omap2/clockdomains7xx_data.c -index 57d5df0c1fbd..7581e036bda6 100644 ---- a/arch/arm/mach-omap2/clockdomains7xx_data.c -+++ b/arch/arm/mach-omap2/clockdomains7xx_data.c -@@ -331,7 +331,7 @@ static struct clockdomain l4per2_7xx_clkdm = { - .dep_bit = DRA7XX_L4PER2_STATDEP_SHIFT, - .wkdep_srcs = l4per2_wkup_sleep_deps, - .sleepdep_srcs = l4per2_wkup_sleep_deps, -- .flags = CLKDM_CAN_HWSUP_SWSUP, -+ .flags = CLKDM_CAN_SWSUP, - }; - - static struct clockdomain mpu0_7xx_clkdm = { -diff --git a/arch/x86/crypto/ghash-clmulni-intel_glue.c b/arch/x86/crypto/ghash-clmulni-intel_glue.c -index a8d6f69f92a3..4bcf841e4701 100644 ---- a/arch/x86/crypto/ghash-clmulni-intel_glue.c -+++ b/arch/x86/crypto/ghash-clmulni-intel_glue.c -@@ -291,6 +291,7 @@ static struct ahash_alg ghash_async_alg = { - .cra_name = "ghash", - .cra_driver_name = "ghash-clmulni", - .cra_priority = 400, -+ .cra_ctxsize = sizeof(struct ghash_async_ctx), - .cra_flags = CRYPTO_ALG_TYPE_AHASH | CRYPTO_ALG_ASYNC, - .cra_blocksize = GHASH_BLOCK_SIZE, - .cra_type = &crypto_ahash_type, -diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c -index aa0779372e3d..dba56fb5e383 100644 ---- a/arch/x86/kvm/mmu.c -+++ b/arch/x86/kvm/mmu.c -@@ -381,12 +381,6 @@ static u64 __get_spte_lockless(u64 *sptep) - { - return ACCESS_ONCE(*sptep); - } -- --static bool __check_direct_spte_mmio_pf(u64 spte) --{ -- /* It is valid if the spte is zapped. */ -- return spte == 0ull; --} - #else - union split_spte { - struct { -@@ -502,23 +496,6 @@ retry: - - return spte.spte; - } -- --static bool __check_direct_spte_mmio_pf(u64 spte) --{ -- union split_spte sspte = (union split_spte)spte; -- u32 high_mmio_mask = shadow_mmio_mask >> 32; -- -- /* It is valid if the spte is zapped. */ -- if (spte == 0ull) -- return true; -- -- /* It is valid if the spte is being zapped. */ -- if (sspte.spte_low == 0ull && -- (sspte.spte_high & high_mmio_mask) == high_mmio_mask) -- return true; -- -- return false; --} - #endif - - static bool spte_is_locklessly_modifiable(u64 spte) -@@ -3215,21 +3192,6 @@ static bool quickly_check_mmio_pf(struct kvm_vcpu *vcpu, u64 addr, bool direct) - return vcpu_match_mmio_gva(vcpu, addr); - } - -- --/* -- * On direct hosts, the last spte is only allows two states -- * for mmio page fault: -- * - It is the mmio spte -- * - It is zapped or it is being zapped. -- * -- * This function completely checks the spte when the last spte -- * is not the mmio spte. -- */ --static bool check_direct_spte_mmio_pf(u64 spte) --{ -- return __check_direct_spte_mmio_pf(spte); --} -- - static u64 walk_shadow_page_get_mmio_spte(struct kvm_vcpu *vcpu, u64 addr) - { - struct kvm_shadow_walk_iterator iterator; -@@ -3272,13 +3234,6 @@ int handle_mmio_page_fault_common(struct kvm_vcpu *vcpu, u64 addr, bool direct) - } - - /* -- * It's ok if the gva is remapped by other cpus on shadow guest, -- * it's a BUG if the gfn is not a mmio page. -- */ -- if (direct && !check_direct_spte_mmio_pf(spte)) -- return RET_MMIO_PF_BUG; -- -- /* - * If the page table is zapped by other cpus, let CPU fault again on - * the address. - */ -diff --git a/arch/xtensa/include/asm/traps.h b/arch/xtensa/include/asm/traps.h -index 677bfcf4ee5d..28f33a8b7f5f 100644 ---- a/arch/xtensa/include/asm/traps.h -+++ b/arch/xtensa/include/asm/traps.h -@@ -25,30 +25,39 @@ static inline void spill_registers(void) - { - #if XCHAL_NUM_AREGS > 16 - __asm__ __volatile__ ( -- " call12 1f\n" -+ " call8 1f\n" - " _j 2f\n" - " retw\n" - " .align 4\n" - "1:\n" -+#if XCHAL_NUM_AREGS == 32 -+ " _entry a1, 32\n" -+ " addi a8, a0, 3\n" -+ " _entry a1, 16\n" -+ " mov a12, a12\n" -+ " retw\n" -+#else - " _entry a1, 48\n" -- " addi a12, a0, 3\n" --#if XCHAL_NUM_AREGS > 32 -- " .rept (" __stringify(XCHAL_NUM_AREGS) " - 32) / 12\n" -+ " call12 1f\n" -+ " retw\n" -+ " .align 4\n" -+ "1:\n" -+ " .rept (" __stringify(XCHAL_NUM_AREGS) " - 16) / 12\n" - " _entry a1, 48\n" - " mov a12, a0\n" - " .endr\n" --#endif -- " _entry a1, 48\n" -+ " _entry a1, 16\n" - #if XCHAL_NUM_AREGS % 12 == 0 -- " mov a8, a8\n" --#elif XCHAL_NUM_AREGS % 12 == 4 - " mov a12, a12\n" --#elif XCHAL_NUM_AREGS % 12 == 8 -+#elif XCHAL_NUM_AREGS % 12 == 4 - " mov a4, a4\n" -+#elif XCHAL_NUM_AREGS % 12 == 8 -+ " mov a8, a8\n" - #endif - " retw\n" -+#endif - "2:\n" -- : : : "a12", "a13", "memory"); -+ : : : "a8", "a9", "memory"); - #else - __asm__ __volatile__ ( - " mov a12, a12\n" -diff --git a/arch/xtensa/kernel/entry.S b/arch/xtensa/kernel/entry.S -index a06b7efaae82..cf8a354fa628 100644 ---- a/arch/xtensa/kernel/entry.S -+++ b/arch/xtensa/kernel/entry.S -@@ -568,12 +568,13 @@ user_exception_exit: - * (if we have restored WSBITS-1 frames). - */ - -+2: - #if XCHAL_HAVE_THREADPTR - l32i a3, a1, PT_THREADPTR - wur a3, threadptr - #endif - --2: j common_exception_exit -+ j common_exception_exit - - /* This is the kernel exception exit. - * We avoided to do a MOVSP when we entered the exception, but we -@@ -1792,7 +1793,7 @@ ENDPROC(system_call) - mov a12, a0 - .endr - #endif -- _entry a1, 48 -+ _entry a1, 16 - #if XCHAL_NUM_AREGS % 12 == 0 - mov a8, a8 - #elif XCHAL_NUM_AREGS % 12 == 4 -@@ -1816,7 +1817,7 @@ ENDPROC(system_call) - - ENTRY(_switch_to) - -- entry a1, 16 -+ entry a1, 48 - - mov a11, a3 # and 'next' (a3) - -diff --git a/drivers/auxdisplay/ks0108.c b/drivers/auxdisplay/ks0108.c -index 5b93852392b8..0d752851a1ee 100644 ---- a/drivers/auxdisplay/ks0108.c -+++ b/drivers/auxdisplay/ks0108.c -@@ -139,6 +139,7 @@ static int __init ks0108_init(void) - - ks0108_pardevice = parport_register_device(ks0108_parport, KS0108_NAME, - NULL, NULL, NULL, PARPORT_DEV_EXCL, NULL); -+ parport_put_port(ks0108_parport); - if (ks0108_pardevice == NULL) { - printk(KERN_ERR KS0108_NAME ": ERROR: " - "parport didn't register new device\n"); -diff --git a/drivers/base/devres.c b/drivers/base/devres.c -index 545c4de412c3..cbe0b58bab3c 100644 ---- a/drivers/base/devres.c -+++ b/drivers/base/devres.c -@@ -297,10 +297,10 @@ void * devres_get(struct device *dev, void *new_res, - if (!dr) { - add_dr(dev, &new_dr->node); - dr = new_dr; -- new_dr = NULL; -+ new_res = NULL; - } - spin_unlock_irqrestore(&dev->devres_lock, flags); -- devres_free(new_dr); -+ devres_free(new_res); - - return dr->data; - } -diff --git a/drivers/base/platform.c b/drivers/base/platform.c -index 9dbf4ef2b2a3..57d8f671d1f6 100644 ---- a/drivers/base/platform.c -+++ b/drivers/base/platform.c -@@ -354,9 +354,7 @@ int platform_device_add(struct platform_device *pdev) - - while (--i >= 0) { - struct resource *r = &pdev->resource[i]; -- unsigned long type = resource_type(r); -- -- if (type == IORESOURCE_MEM || type == IORESOURCE_IO) -+ if (r->parent) - release_resource(r); - } - -@@ -387,9 +385,7 @@ void platform_device_del(struct platform_device *pdev) - - for (i = 0; i < pdev->num_resources; i++) { - struct resource *r = &pdev->resource[i]; -- unsigned long type = resource_type(r); -- -- if (type == IORESOURCE_MEM || type == IORESOURCE_IO) -+ if (r->parent) - release_resource(r); - } - } -diff --git a/drivers/clk/versatile/clk-sp810.c b/drivers/clk/versatile/clk-sp810.c -index c6e86a9a2aa3..5122ef25f595 100644 ---- a/drivers/clk/versatile/clk-sp810.c -+++ b/drivers/clk/versatile/clk-sp810.c -@@ -128,8 +128,8 @@ static struct clk *clk_sp810_timerclken_of_get(struct of_phandle_args *clkspec, - { - struct clk_sp810 *sp810 = data; - -- if (WARN_ON(clkspec->args_count != 1 || clkspec->args[0] > -- ARRAY_SIZE(sp810->timerclken))) -+ if (WARN_ON(clkspec->args_count != 1 || -+ clkspec->args[0] >= ARRAY_SIZE(sp810->timerclken))) - return NULL; - - return sp810->timerclken[clkspec->args[0]].clk; -diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c -index c39c414c7751..8e3267a8bd4f 100644 ---- a/drivers/gpu/drm/qxl/qxl_display.c -+++ b/drivers/gpu/drm/qxl/qxl_display.c -@@ -136,9 +136,35 @@ static int qxl_add_monitors_config_modes(struct drm_connector *connector, - *pwidth = head->width; - *pheight = head->height; - drm_mode_probed_add(connector, mode); -+ /* remember the last custom size for mode validation */ -+ qdev->monitors_config_width = mode->hdisplay; -+ qdev->monitors_config_height = mode->vdisplay; - return 1; - } - -+static struct mode_size { -+ int w; -+ int h; -+} common_modes[] = { -+ { 640, 480}, -+ { 720, 480}, -+ { 800, 600}, -+ { 848, 480}, -+ {1024, 768}, -+ {1152, 768}, -+ {1280, 720}, -+ {1280, 800}, -+ {1280, 854}, -+ {1280, 960}, -+ {1280, 1024}, -+ {1440, 900}, -+ {1400, 1050}, -+ {1680, 1050}, -+ {1600, 1200}, -+ {1920, 1080}, -+ {1920, 1200} -+}; -+ - static int qxl_add_common_modes(struct drm_connector *connector, - unsigned pwidth, - unsigned pheight) -@@ -146,29 +172,6 @@ static int qxl_add_common_modes(struct drm_connector *connector, - struct drm_device *dev = connector->dev; - struct drm_display_mode *mode = NULL; - int i; -- struct mode_size { -- int w; -- int h; -- } common_modes[] = { -- { 640, 480}, -- { 720, 480}, -- { 800, 600}, -- { 848, 480}, -- {1024, 768}, -- {1152, 768}, -- {1280, 720}, -- {1280, 800}, -- {1280, 854}, -- {1280, 960}, -- {1280, 1024}, -- {1440, 900}, -- {1400, 1050}, -- {1680, 1050}, -- {1600, 1200}, -- {1920, 1080}, -- {1920, 1200} -- }; -- - for (i = 0; i < ARRAY_SIZE(common_modes); i++) { - mode = drm_cvt_mode(dev, common_modes[i].w, common_modes[i].h, - 60, false, false, false); -@@ -753,11 +756,22 @@ static int qxl_conn_get_modes(struct drm_connector *connector) - static int qxl_conn_mode_valid(struct drm_connector *connector, - struct drm_display_mode *mode) - { -+ struct drm_device *ddev = connector->dev; -+ struct qxl_device *qdev = ddev->dev_private; -+ int i; -+ - /* TODO: is this called for user defined modes? (xrandr --add-mode) - * TODO: check that the mode fits in the framebuffer */ -- DRM_DEBUG("%s: %dx%d status=%d\n", mode->name, mode->hdisplay, -- mode->vdisplay, mode->status); -- return MODE_OK; -+ -+ if(qdev->monitors_config_width == mode->hdisplay && -+ qdev->monitors_config_height == mode->vdisplay) -+ return MODE_OK; -+ -+ for (i = 0; i < ARRAY_SIZE(common_modes); i++) { -+ if (common_modes[i].w == mode->hdisplay && common_modes[i].h == mode->vdisplay) -+ return MODE_OK; -+ } -+ return MODE_BAD; - } - - static struct drm_encoder *qxl_best_encoder(struct drm_connector *connector) -diff --git a/drivers/gpu/drm/qxl/qxl_drv.h b/drivers/gpu/drm/qxl/qxl_drv.h -index 36ed40ba773f..8aa077ca8244 100644 ---- a/drivers/gpu/drm/qxl/qxl_drv.h -+++ b/drivers/gpu/drm/qxl/qxl_drv.h -@@ -325,6 +325,8 @@ struct qxl_device { - struct work_struct fb_work; - - struct drm_property *hotplug_mode_update_property; -+ int monitors_config_width; -+ int monitors_config_height; - }; - - /* forward declaration for QXL_INFO_IO */ -diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c -index 4d36b9e86275..17ae621dbdab 100644 ---- a/drivers/gpu/drm/radeon/radeon_connectors.c -+++ b/drivers/gpu/drm/radeon/radeon_connectors.c -@@ -71,6 +71,11 @@ void radeon_connector_hotplug(struct drm_connector *connector) - if (!radeon_hpd_sense(rdev, radeon_connector->hpd.hpd)) { - drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF); - } else if (radeon_dp_needs_link_train(radeon_connector)) { -+ /* Don't try to start link training before we -+ * have the dpcd */ -+ if (!radeon_dp_getdpcd(radeon_connector)) -+ return; -+ - /* set it to OFF so that drm_helper_connector_dpms() - * won't return immediately since the current state - * is ON at this point. -diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c -index 617c47f9ebe6..deabd2c8772d 100644 ---- a/drivers/hid/usbhid/hid-core.c -+++ b/drivers/hid/usbhid/hid-core.c -@@ -180,7 +180,7 @@ static void hid_io_error(struct hid_device *hid) - if (time_after(jiffies, usbhid->stop_retry)) { - - /* Retries failed, so do a port reset unless we lack bandwidth*/ -- if (test_bit(HID_NO_BANDWIDTH, &usbhid->iofl) -+ if (!test_bit(HID_NO_BANDWIDTH, &usbhid->iofl) - && !test_and_set_bit(HID_RESET_PENDING, &usbhid->iofl)) { - - schedule_work(&usbhid->reset_work); -diff --git a/drivers/iio/gyro/Kconfig b/drivers/iio/gyro/Kconfig -index ac2d69e34c8c..6f64c5cc5387 100644 ---- a/drivers/iio/gyro/Kconfig -+++ b/drivers/iio/gyro/Kconfig -@@ -93,7 +93,8 @@ config IIO_ST_GYRO_SPI_3AXIS - config ITG3200 - tristate "InvenSense ITG3200 Digital 3-Axis Gyroscope I2C driver" - depends on I2C -- select IIO_TRIGGERED_BUFFER if IIO_BUFFER -+ select IIO_BUFFER -+ select IIO_TRIGGERED_BUFFER - help - Say yes here to add support for the InvenSense ITG3200 digital - 3-axis gyroscope sensor. -diff --git a/drivers/iio/imu/adis16480.c b/drivers/iio/imu/adis16480.c -index dd4206cac62d..5e1b117d4e3b 100644 ---- a/drivers/iio/imu/adis16480.c -+++ b/drivers/iio/imu/adis16480.c -@@ -110,6 +110,10 @@ - struct adis16480_chip_info { - unsigned int num_channels; - const struct iio_chan_spec *channels; -+ unsigned int gyro_max_val; -+ unsigned int gyro_max_scale; -+ unsigned int accel_max_val; -+ unsigned int accel_max_scale; - }; - - struct adis16480 { -@@ -533,19 +537,21 @@ static int adis16480_set_filter_freq(struct iio_dev *indio_dev, - static int adis16480_read_raw(struct iio_dev *indio_dev, - const struct iio_chan_spec *chan, int *val, int *val2, long info) - { -+ struct adis16480 *st = iio_priv(indio_dev); -+ - switch (info) { - case IIO_CHAN_INFO_RAW: - return adis_single_conversion(indio_dev, chan, 0, val); - case IIO_CHAN_INFO_SCALE: - switch (chan->type) { - case IIO_ANGL_VEL: -- *val = 0; -- *val2 = IIO_DEGREE_TO_RAD(20000); /* 0.02 degree/sec */ -- return IIO_VAL_INT_PLUS_MICRO; -+ *val = st->chip_info->gyro_max_scale; -+ *val2 = st->chip_info->gyro_max_val; -+ return IIO_VAL_FRACTIONAL; - case IIO_ACCEL: -- *val = 0; -- *val2 = IIO_G_TO_M_S_2(800); /* 0.8 mg */ -- return IIO_VAL_INT_PLUS_MICRO; -+ *val = st->chip_info->accel_max_scale; -+ *val2 = st->chip_info->accel_max_val; -+ return IIO_VAL_FRACTIONAL; - case IIO_MAGN: - *val = 0; - *val2 = 100; /* 0.0001 gauss */ -@@ -702,18 +708,39 @@ static const struct adis16480_chip_info adis16480_chip_info[] = { - [ADIS16375] = { - .channels = adis16485_channels, - .num_channels = ARRAY_SIZE(adis16485_channels), -+ /* -+ * storing the value in rad/degree and the scale in degree -+ * gives us the result in rad and better precession than -+ * storing the scale directly in rad. -+ */ -+ .gyro_max_val = IIO_RAD_TO_DEGREE(22887), -+ .gyro_max_scale = 300, -+ .accel_max_val = IIO_M_S_2_TO_G(21973), -+ .accel_max_scale = 18, - }, - [ADIS16480] = { - .channels = adis16480_channels, - .num_channels = ARRAY_SIZE(adis16480_channels), -+ .gyro_max_val = IIO_RAD_TO_DEGREE(22500), -+ .gyro_max_scale = 450, -+ .accel_max_val = IIO_M_S_2_TO_G(12500), -+ .accel_max_scale = 5, - }, - [ADIS16485] = { - .channels = adis16485_channels, - .num_channels = ARRAY_SIZE(adis16485_channels), -+ .gyro_max_val = IIO_RAD_TO_DEGREE(22500), -+ .gyro_max_scale = 450, -+ .accel_max_val = IIO_M_S_2_TO_G(20000), -+ .accel_max_scale = 5, - }, - [ADIS16488] = { - .channels = adis16480_channels, - .num_channels = ARRAY_SIZE(adis16480_channels), -+ .gyro_max_val = IIO_RAD_TO_DEGREE(22500), -+ .gyro_max_scale = 450, -+ .accel_max_val = IIO_M_S_2_TO_G(22500), -+ .accel_max_scale = 18, - }, - }; - -diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c -index 0f1d9b2ccdfa..37b52bd44f86 100644 ---- a/drivers/iio/industrialio-buffer.c -+++ b/drivers/iio/industrialio-buffer.c -@@ -96,7 +96,7 @@ unsigned int iio_buffer_poll(struct file *filp, - struct iio_buffer *rb = indio_dev->buffer; - - if (!indio_dev->info) -- return -ENODEV; -+ return 0; - - poll_wait(filp, &rb->pollq, wait); - if (iio_buffer_data_available(rb)) -diff --git a/drivers/iio/industrialio-event.c b/drivers/iio/industrialio-event.c -index f9360f497ed4..05b59941c400 100644 ---- a/drivers/iio/industrialio-event.c -+++ b/drivers/iio/industrialio-event.c -@@ -83,7 +83,7 @@ static unsigned int iio_event_poll(struct file *filep, - unsigned int events = 0; - - if (!indio_dev->info) -- return -ENODEV; -+ return events; - - poll_wait(filep, &ev_int->wait, wait); - -diff --git a/drivers/of/address.c b/drivers/of/address.c -index 005c65715846..9eae613c2a52 100644 ---- a/drivers/of/address.c -+++ b/drivers/of/address.c -@@ -704,10 +704,10 @@ struct device_node *of_find_matching_node_by_address(struct device_node *from, - struct resource res; - - while (dn) { -- if (of_address_to_resource(dn, 0, &res)) -- continue; -- if (res.start == base_address) -+ if (!of_address_to_resource(dn, 0, &res) && -+ res.start == base_address) - return dn; -+ - dn = of_find_matching_node(dn, matches); - } - -diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c -index 27abeb40dfab..2afa4803280f 100644 ---- a/drivers/pci/quirks.c -+++ b/drivers/pci/quirks.c -@@ -2790,12 +2790,15 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x3c28, vtd_mask_spec_errors); - - static void fixup_ti816x_class(struct pci_dev *dev) - { -+ u32 class = dev->class; -+ - /* TI 816x devices do not have class code set when in PCIe boot mode */ -- dev_info(&dev->dev, "Setting PCI class for 816x PCIe device\n"); -- dev->class = PCI_CLASS_MULTIMEDIA_VIDEO; -+ dev->class = PCI_CLASS_MULTIMEDIA_VIDEO << 8; -+ dev_info(&dev->dev, "PCI class overridden (%#08x -> %#08x)\n", -+ class, dev->class); - } - DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_TI, 0xb800, -- PCI_CLASS_NOT_DEFINED, 0, fixup_ti816x_class); -+ PCI_CLASS_NOT_DEFINED, 0, fixup_ti816x_class); - - /* Some PCIe devices do not work reliably with the claimed maximum - * payload size supported. -diff --git a/drivers/s390/char/sclp_early.c b/drivers/s390/char/sclp_early.c -index 82f2c389b4d1..b334f68ebe46 100644 ---- a/drivers/s390/char/sclp_early.c -+++ b/drivers/s390/char/sclp_early.c -@@ -7,6 +7,7 @@ - #define KMSG_COMPONENT "sclp_early" - #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt - -+#include - #include - #include - #include -diff --git a/drivers/staging/comedi/drivers/adl_pci7x3x.c b/drivers/staging/comedi/drivers/adl_pci7x3x.c -index 6f622b4de698..927edd130ce9 100644 ---- a/drivers/staging/comedi/drivers/adl_pci7x3x.c -+++ b/drivers/staging/comedi/drivers/adl_pci7x3x.c -@@ -113,8 +113,20 @@ static int adl_pci7x3x_do_insn_bits(struct comedi_device *dev, - { - unsigned long reg = (unsigned long)s->private; - -- if (comedi_dio_update_state(s, data)) -- outl(s->state, dev->iobase + reg); -+ if (comedi_dio_update_state(s, data)) { -+ unsigned int val = s->state; -+ -+ if (s->n_chan == 16) { -+ /* -+ * It seems the PCI-7230 needs the 16-bit DO state -+ * to be shifted left by 16 bits before being written -+ * to the 32-bit register. Set the value in both -+ * halves of the register to be sure. -+ */ -+ val |= val << 16; -+ } -+ outl(val, dev->iobase + reg); -+ } - - data[1] = s->state; - -diff --git a/drivers/tty/serial/8250/8250_pnp.c b/drivers/tty/serial/8250/8250_pnp.c -index 682a2fbe5c06..2b22cc1e57a2 100644 ---- a/drivers/tty/serial/8250/8250_pnp.c -+++ b/drivers/tty/serial/8250/8250_pnp.c -@@ -364,6 +364,11 @@ static const struct pnp_device_id pnp_dev_table[] = { - /* Winbond CIR port, should not be probed. We should keep track - of it to prevent the legacy serial driver from probing it */ - { "WEC1022", CIR_PORT }, -+ /* -+ * SMSC IrCC SIR/FIR port, should not be probed by serial driver -+ * as well so its own driver can bind to it. -+ */ -+ { "SMCF010", CIR_PORT }, - { "", 0 } - }; - -diff --git a/drivers/tty/vt/consolemap.c b/drivers/tty/vt/consolemap.c -index 2978ca596a7f..0e75d2a76511 100644 ---- a/drivers/tty/vt/consolemap.c -+++ b/drivers/tty/vt/consolemap.c -@@ -540,6 +540,12 @@ int con_set_unimap(struct vc_data *vc, ushort ct, struct unipair __user *list) - - /* Save original vc_unipagdir_loc in case we allocate a new one */ - p = (struct uni_pagedir *)*vc->vc_uni_pagedir_loc; -+ -+ if (!p) { -+ err = -EINVAL; -+ -+ goto out_unlock; -+ } - if (p->readonly) { - console_unlock(); - return -EIO; -@@ -633,6 +639,7 @@ int con_set_unimap(struct vc_data *vc, ushort ct, struct unipair __user *list) - set_inverse_transl(vc, p, i); /* Update inverse translations */ - set_inverse_trans_unicode(vc, p); - -+out_unlock: - console_unlock(); - return err; - } -diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c -index a05fc58d9b60..965c9ac85d6f 100644 ---- a/drivers/usb/dwc3/ep0.c -+++ b/drivers/usb/dwc3/ep0.c -@@ -793,6 +793,11 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc, - unsigned maxp = ep0->endpoint.maxpacket; - - transfer_size += (maxp - (transfer_size % maxp)); -+ -+ /* Maximum of DWC3_EP0_BOUNCE_SIZE can only be received */ -+ if (transfer_size > DWC3_EP0_BOUNCE_SIZE) -+ transfer_size = DWC3_EP0_BOUNCE_SIZE; -+ - transferred = min_t(u32, ur->length, - transfer_size - length); - memcpy(ur->buf, dwc->ep0_bounce, transferred); -@@ -905,11 +910,14 @@ static void __dwc3_ep0_do_control_data(struct dwc3 *dwc, - return; - } - -- WARN_ON(req->request.length > DWC3_EP0_BOUNCE_SIZE); -- - maxpacket = dep->endpoint.maxpacket; - transfer_size = roundup(req->request.length, maxpacket); - -+ if (transfer_size > DWC3_EP0_BOUNCE_SIZE) { -+ dev_WARN(dwc->dev, "bounce buf can't handle req len\n"); -+ transfer_size = DWC3_EP0_BOUNCE_SIZE; -+ } -+ - dwc->ep0_bounced = true; - - /* -diff --git a/drivers/usb/host/ehci-sysfs.c b/drivers/usb/host/ehci-sysfs.c -index f6459dfb6f54..94054dad7710 100644 ---- a/drivers/usb/host/ehci-sysfs.c -+++ b/drivers/usb/host/ehci-sysfs.c -@@ -29,7 +29,7 @@ static ssize_t show_companion(struct device *dev, - int count = PAGE_SIZE; - char *ptr = buf; - -- ehci = hcd_to_ehci(bus_to_hcd(dev_get_drvdata(dev))); -+ ehci = hcd_to_ehci(dev_get_drvdata(dev)); - nports = HCS_N_PORTS(ehci->hcs_params); - - for (index = 0; index < nports; ++index) { -@@ -54,7 +54,7 @@ static ssize_t store_companion(struct device *dev, - struct ehci_hcd *ehci; - int portnum, new_owner; - -- ehci = hcd_to_ehci(bus_to_hcd(dev_get_drvdata(dev))); -+ ehci = hcd_to_ehci(dev_get_drvdata(dev)); - new_owner = PORT_OWNER; /* Owned by companion */ - if (sscanf(buf, "%d", &portnum) != 1) - return -EINVAL; -@@ -85,7 +85,7 @@ static ssize_t show_uframe_periodic_max(struct device *dev, - struct ehci_hcd *ehci; - int n; - -- ehci = hcd_to_ehci(bus_to_hcd(dev_get_drvdata(dev))); -+ ehci = hcd_to_ehci(dev_get_drvdata(dev)); - n = scnprintf(buf, PAGE_SIZE, "%d\n", ehci->uframe_periodic_max); - return n; - } -@@ -101,7 +101,7 @@ static ssize_t store_uframe_periodic_max(struct device *dev, - unsigned long flags; - ssize_t ret; - -- ehci = hcd_to_ehci(bus_to_hcd(dev_get_drvdata(dev))); -+ ehci = hcd_to_ehci(dev_get_drvdata(dev)); - if (kstrtouint(buf, 0, &uframe_periodic_max) < 0) - return -EINVAL; - -diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c -index bc77ea7cde48..7fb81dbbdc8d 100644 ---- a/drivers/usb/serial/ftdi_sio.c -+++ b/drivers/usb/serial/ftdi_sio.c -@@ -618,6 +618,10 @@ static const struct usb_device_id id_table_combined[] = { - { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, FTDI_SYNAPSE_SS200_PID) }, -+ { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX_PID) }, -+ { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX2_PID) }, -+ { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX2WI_PID) }, -+ { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX3_PID) }, - /* - * ELV devices: - */ -diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h -index 792e054126de..2943b97b2a83 100644 ---- a/drivers/usb/serial/ftdi_sio_ids.h -+++ b/drivers/usb/serial/ftdi_sio_ids.h -@@ -568,6 +568,14 @@ - */ - #define FTDI_SYNAPSE_SS200_PID 0x9090 /* SS200 - SNAP Stick 200 */ - -+/* -+ * CustomWare / ShipModul NMEA multiplexers product ids (FTDI_VID) -+ */ -+#define FTDI_CUSTOMWARE_MINIPLEX_PID 0xfd48 /* MiniPlex first generation NMEA Multiplexer */ -+#define FTDI_CUSTOMWARE_MINIPLEX2_PID 0xfd49 /* MiniPlex-USB and MiniPlex-2 series */ -+#define FTDI_CUSTOMWARE_MINIPLEX2WI_PID 0xfd4a /* MiniPlex-2Wi */ -+#define FTDI_CUSTOMWARE_MINIPLEX3_PID 0xfd4b /* MiniPlex-3 series */ -+ - - /********************************/ - /** third-party VID/PID combos **/ -diff --git a/drivers/usb/serial/symbolserial.c b/drivers/usb/serial/symbolserial.c -index 9fa7dd413e83..5e5e88209eeb 100644 ---- a/drivers/usb/serial/symbolserial.c -+++ b/drivers/usb/serial/symbolserial.c -@@ -96,7 +96,7 @@ exit: - - static int symbol_open(struct tty_struct *tty, struct usb_serial_port *port) - { -- struct symbol_private *priv = usb_get_serial_data(port->serial); -+ struct symbol_private *priv = usb_get_serial_port_data(port); - unsigned long flags; - int result = 0; - -@@ -122,7 +122,7 @@ static void symbol_close(struct usb_serial_port *port) - static void symbol_throttle(struct tty_struct *tty) - { - struct usb_serial_port *port = tty->driver_data; -- struct symbol_private *priv = usb_get_serial_data(port->serial); -+ struct symbol_private *priv = usb_get_serial_port_data(port); - - spin_lock_irq(&priv->lock); - priv->throttled = true; -@@ -132,7 +132,7 @@ static void symbol_throttle(struct tty_struct *tty) - static void symbol_unthrottle(struct tty_struct *tty) - { - struct usb_serial_port *port = tty->driver_data; -- struct symbol_private *priv = usb_get_serial_data(port->serial); -+ struct symbol_private *priv = usb_get_serial_port_data(port); - int result; - bool was_throttled; - -diff --git a/fs/hpfs/namei.c b/fs/hpfs/namei.c -index 1b39afdd86fd..5f60bb21905c 100644 ---- a/fs/hpfs/namei.c -+++ b/fs/hpfs/namei.c -@@ -8,6 +8,17 @@ - #include - #include "hpfs_fn.h" - -+static void hpfs_update_directory_times(struct inode *dir) -+{ -+ time_t t = get_seconds(); -+ if (t == dir->i_mtime.tv_sec && -+ t == dir->i_ctime.tv_sec) -+ return; -+ dir->i_mtime.tv_sec = dir->i_ctime.tv_sec = t; -+ dir->i_mtime.tv_nsec = dir->i_ctime.tv_nsec = 0; -+ hpfs_write_inode_nolock(dir); -+} -+ - static int hpfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode) - { - const unsigned char *name = dentry->d_name.name; -@@ -99,6 +110,7 @@ static int hpfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode) - result->i_mode = mode | S_IFDIR; - hpfs_write_inode_nolock(result); - } -+ hpfs_update_directory_times(dir); - d_instantiate(dentry, result); - hpfs_unlock(dir->i_sb); - return 0; -@@ -187,6 +199,7 @@ static int hpfs_create(struct inode *dir, struct dentry *dentry, umode_t mode, b - result->i_mode = mode | S_IFREG; - hpfs_write_inode_nolock(result); - } -+ hpfs_update_directory_times(dir); - d_instantiate(dentry, result); - hpfs_unlock(dir->i_sb); - return 0; -@@ -262,6 +275,7 @@ static int hpfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, de - insert_inode_hash(result); - - hpfs_write_inode_nolock(result); -+ hpfs_update_directory_times(dir); - d_instantiate(dentry, result); - brelse(bh); - hpfs_unlock(dir->i_sb); -@@ -340,6 +354,7 @@ static int hpfs_symlink(struct inode *dir, struct dentry *dentry, const char *sy - insert_inode_hash(result); - - hpfs_write_inode_nolock(result); -+ hpfs_update_directory_times(dir); - d_instantiate(dentry, result); - hpfs_unlock(dir->i_sb); - return 0; -@@ -423,6 +438,8 @@ again: - out1: - hpfs_brelse4(&qbh); - out: -+ if (!err) -+ hpfs_update_directory_times(dir); - hpfs_unlock(dir->i_sb); - return err; - } -@@ -477,6 +494,8 @@ static int hpfs_rmdir(struct inode *dir, struct dentry *dentry) - out1: - hpfs_brelse4(&qbh); - out: -+ if (!err) -+ hpfs_update_directory_times(dir); - hpfs_unlock(dir->i_sb); - return err; - } -@@ -595,7 +614,7 @@ static int hpfs_rename(struct inode *old_dir, struct dentry *old_dentry, - goto end1; - } - -- end: -+end: - hpfs_i(i)->i_parent_dir = new_dir->i_ino; - if (S_ISDIR(i->i_mode)) { - inc_nlink(new_dir); -@@ -610,6 +629,10 @@ static int hpfs_rename(struct inode *old_dir, struct dentry *old_dentry, - brelse(bh); - } - end1: -+ if (!err) { -+ hpfs_update_directory_times(old_dir); -+ hpfs_update_directory_times(new_dir); -+ } - hpfs_unlock(i->i_sb); - return err; - } -diff --git a/include/linux/iio/iio.h b/include/linux/iio/iio.h -index 75a8a20c8179..c2fb6f3ff44b 100644 ---- a/include/linux/iio/iio.h -+++ b/include/linux/iio/iio.h -@@ -593,6 +593,15 @@ int iio_str_to_fixpoint(const char *str, int fract_mult, int *integer, - #define IIO_DEGREE_TO_RAD(deg) (((deg) * 314159ULL + 9000000ULL) / 18000000ULL) - - /** -+ * IIO_RAD_TO_DEGREE() - Convert rad to degree -+ * @rad: A value in rad -+ * -+ * Returns the given value converted from rad to degree -+ */ -+#define IIO_RAD_TO_DEGREE(rad) \ -+ (((rad) * 18000000ULL + 314159ULL / 2) / 314159ULL) -+ -+/** - * IIO_G_TO_M_S_2() - Convert g to meter / second**2 - * @g: A value in g - * -@@ -600,4 +609,12 @@ int iio_str_to_fixpoint(const char *str, int fract_mult, int *integer, - */ - #define IIO_G_TO_M_S_2(g) ((g) * 980665ULL / 100000ULL) - -+/** -+ * IIO_M_S_2_TO_G() - Convert meter / second**2 to g -+ * @ms2: A value in meter / second**2 -+ * -+ * Returns the given value converted from meter / second**2 to g -+ */ -+#define IIO_M_S_2_TO_G(ms2) (((ms2) * 100000ULL + 980665ULL / 2) / 980665ULL) -+ - #endif /* _INDUSTRIAL_IO_H_ */ diff --git a/patch/kernel/odroidc2-default/patch-3.14.53-54.patch b/patch/kernel/odroidc2-default/patch-3.14.53-54.patch deleted file mode 100644 index 359aec8e72..0000000000 --- a/patch/kernel/odroidc2-default/patch-3.14.53-54.patch +++ /dev/null @@ -1,3567 +0,0 @@ -diff --git a/Makefile b/Makefile -index 86d227774ae6..22c91fa0411e 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,8 +1,8 @@ - VERSION = 3 - PATCHLEVEL = 14 --SUBLEVEL = 53 -+SUBLEVEL = 54 - EXTRAVERSION = --NAME = Remembering Coco -+NAME = Kernel Recipes 2015 - - # *DOCUMENTATION* - # To see a list of typical targets execute "make help" -diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig -index 65b788410bd9..9a406627b0ef 100644 ---- a/arch/arm64/Kconfig -+++ b/arch/arm64/Kconfig -@@ -68,6 +68,10 @@ config NO_IOPORT - config STACKTRACE_SUPPORT - def_bool y - -+config ILLEGAL_POINTER_VALUE -+ hex -+ default 0xdead000000000000 -+ - config LOCKDEP_SUPPORT - def_bool y - -@@ -302,6 +306,22 @@ menu "CPU Power Management" - - source "drivers/cpuidle/Kconfig" - -+config ARM64_ERRATUM_843419 -+ bool "Cortex-A53: 843419: A load or store might access an incorrect address" -+ depends on MODULES -+ default y -+ help -+ This option builds kernel modules using the large memory model in -+ order to avoid the use of the ADRP instruction, which can cause -+ a subsequent memory access to use an incorrect address on Cortex-A53 -+ parts up to r0p4. -+ -+ Note that the kernel itself must be linked with a version of ld -+ which fixes potentially affected ADRP instructions through the -+ use of veneers. -+ -+ If unsure, say Y. -+ - endmenu - - source "net/Kconfig" -diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile -index 2fceb71ac3b7..0ab1a34dab58 100644 ---- a/arch/arm64/Makefile -+++ b/arch/arm64/Makefile -@@ -34,6 +34,10 @@ comma = , - - CHECKFLAGS += -D__aarch64__ - -+ifeq ($(CONFIG_ARM64_ERRATUM_843419), y) -+CFLAGS_MODULE += -mcmodel=large -+endif -+ - # Default value - head-y := arch/arm64/kernel/head.o - -diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S -index 0b281fffda51..150492b6cd02 100644 ---- a/arch/arm64/kernel/head.S -+++ b/arch/arm64/kernel/head.S -@@ -203,6 +203,11 @@ CPU_LE( movk x0, #0x30d0, lsl #16 ) // Clear EE and E0E on LE systems - msr hstr_el2, xzr // Disable CP15 traps to EL2 - #endif - -+ /* EL2 debug */ -+ mrs x0, pmcr_el0 // Disable debug access traps -+ ubfx x0, x0, #11, #5 // to EL2 and allow access to -+ msr mdcr_el2, x0 // all PMU counters from EL1 -+ - /* Stage-2 translation */ - msr vttbr_el2, xzr - -diff --git a/arch/arm64/kernel/module.c b/arch/arm64/kernel/module.c -index 1eb1cc955139..e366329d96d8 100644 ---- a/arch/arm64/kernel/module.c -+++ b/arch/arm64/kernel/module.c -@@ -330,12 +330,14 @@ int apply_relocate_add(Elf64_Shdr *sechdrs, - ovf = reloc_insn_imm(RELOC_OP_PREL, loc, val, 0, 21, - AARCH64_INSN_IMM_ADR); - break; -+#ifndef CONFIG_ARM64_ERRATUM_843419 - case R_AARCH64_ADR_PREL_PG_HI21_NC: - overflow_check = false; - case R_AARCH64_ADR_PREL_PG_HI21: - ovf = reloc_insn_imm(RELOC_OP_PAGE, loc, val, 12, 21, - AARCH64_INSN_IMM_ADR); - break; -+#endif - case R_AARCH64_ADD_ABS_LO12_NC: - case R_AARCH64_LDST8_ABS_LO12_NC: - overflow_check = false; -diff --git a/arch/arm64/kernel/signal32.c b/arch/arm64/kernel/signal32.c -index a966baccf1c0..cbe646fa340b 100644 ---- a/arch/arm64/kernel/signal32.c -+++ b/arch/arm64/kernel/signal32.c -@@ -203,14 +203,32 @@ int copy_siginfo_from_user32(siginfo_t *to, compat_siginfo_t __user *from) - - /* - * VFP save/restore code. -+ * -+ * We have to be careful with endianness, since the fpsimd context-switch -+ * code operates on 128-bit (Q) register values whereas the compat ABI -+ * uses an array of 64-bit (D) registers. Consequently, we need to swap -+ * the two halves of each Q register when running on a big-endian CPU. - */ -+union __fpsimd_vreg { -+ __uint128_t raw; -+ struct { -+#ifdef __AARCH64EB__ -+ u64 hi; -+ u64 lo; -+#else -+ u64 lo; -+ u64 hi; -+#endif -+ }; -+}; -+ - static int compat_preserve_vfp_context(struct compat_vfp_sigframe __user *frame) - { - struct fpsimd_state *fpsimd = ¤t->thread.fpsimd_state; - compat_ulong_t magic = VFP_MAGIC; - compat_ulong_t size = VFP_STORAGE_SIZE; - compat_ulong_t fpscr, fpexc; -- int err = 0; -+ int i, err = 0; - - /* - * Save the hardware registers to the fpsimd_state structure. -@@ -226,10 +244,15 @@ static int compat_preserve_vfp_context(struct compat_vfp_sigframe __user *frame) - /* - * Now copy the FP registers. Since the registers are packed, - * we can copy the prefix we want (V0-V15) as it is. -- * FIXME: Won't work if big endian. - */ -- err |= __copy_to_user(&frame->ufp.fpregs, fpsimd->vregs, -- sizeof(frame->ufp.fpregs)); -+ for (i = 0; i < ARRAY_SIZE(frame->ufp.fpregs); i += 2) { -+ union __fpsimd_vreg vreg = { -+ .raw = fpsimd->vregs[i >> 1], -+ }; -+ -+ __put_user_error(vreg.lo, &frame->ufp.fpregs[i], err); -+ __put_user_error(vreg.hi, &frame->ufp.fpregs[i + 1], err); -+ } - - /* Create an AArch32 fpscr from the fpsr and the fpcr. */ - fpscr = (fpsimd->fpsr & VFP_FPSCR_STAT_MASK) | -@@ -254,7 +277,7 @@ static int compat_restore_vfp_context(struct compat_vfp_sigframe __user *frame) - compat_ulong_t magic = VFP_MAGIC; - compat_ulong_t size = VFP_STORAGE_SIZE; - compat_ulong_t fpscr; -- int err = 0; -+ int i, err = 0; - - __get_user_error(magic, &frame->magic, err); - __get_user_error(size, &frame->size, err); -@@ -264,12 +287,14 @@ static int compat_restore_vfp_context(struct compat_vfp_sigframe __user *frame) - if (magic != VFP_MAGIC || size != VFP_STORAGE_SIZE) - return -EINVAL; - -- /* -- * Copy the FP registers into the start of the fpsimd_state. -- * FIXME: Won't work if big endian. -- */ -- err |= __copy_from_user(fpsimd.vregs, frame->ufp.fpregs, -- sizeof(frame->ufp.fpregs)); -+ /* Copy the FP registers into the start of the fpsimd_state. */ -+ for (i = 0; i < ARRAY_SIZE(frame->ufp.fpregs); i += 2) { -+ union __fpsimd_vreg vreg; -+ -+ __get_user_error(vreg.lo, &frame->ufp.fpregs[i], err); -+ __get_user_error(vreg.hi, &frame->ufp.fpregs[i + 1], err); -+ fpsimd.vregs[i >> 1] = vreg.raw; -+ } - - /* Extract the fpsr and the fpcr from the fpscr */ - __get_user_error(fpscr, &frame->ufp.fpscr, err); -diff --git a/arch/arm64/kvm/hyp.S b/arch/arm64/kvm/hyp.S -index 3aaf3bc4ad8a..1343b2020891 100644 ---- a/arch/arm64/kvm/hyp.S -+++ b/arch/arm64/kvm/hyp.S -@@ -485,8 +485,6 @@ CPU_BE( rev w5, w5 ) - mrs x3, cntv_ctl_el0 - and x3, x3, #3 - str w3, [x0, #VCPU_TIMER_CNTV_CTL] -- bic x3, x3, #1 // Clear Enable -- msr cntv_ctl_el0, x3 - - isb - -@@ -494,6 +492,9 @@ CPU_BE( rev w5, w5 ) - str x3, [x0, #VCPU_TIMER_CNTV_CVAL] - - 1: -+ // Disable the virtual timer -+ msr cntv_ctl_el0, xzr -+ - // Allow physical timer/counter access for the host - mrs x2, cnthctl_el2 - orr x2, x2, #3 -diff --git a/arch/parisc/kernel/irq.c b/arch/parisc/kernel/irq.c -index 8ceac4785609..1ce320e4d3d8 100644 ---- a/arch/parisc/kernel/irq.c -+++ b/arch/parisc/kernel/irq.c -@@ -507,8 +507,8 @@ void do_cpu_irq_mask(struct pt_regs *regs) - struct pt_regs *old_regs; - unsigned long eirr_val; - int irq, cpu = smp_processor_id(); --#ifdef CONFIG_SMP - struct irq_desc *desc; -+#ifdef CONFIG_SMP - cpumask_t dest; - #endif - -@@ -521,8 +521,12 @@ void do_cpu_irq_mask(struct pt_regs *regs) - goto set_out; - irq = eirr_to_irq(eirr_val); - --#ifdef CONFIG_SMP -+ /* Filter out spurious interrupts, mostly from serial port at bootup */ - desc = irq_to_desc(irq); -+ if (unlikely(!desc->action)) -+ goto set_out; -+ -+#ifdef CONFIG_SMP - cpumask_copy(&dest, desc->irq_data.affinity); - if (irqd_is_per_cpu(&desc->irq_data) && - !cpu_isset(smp_processor_id(), dest)) { -diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S -index 7ef22e3387e0..0b8d26d3ba43 100644 ---- a/arch/parisc/kernel/syscall.S -+++ b/arch/parisc/kernel/syscall.S -@@ -821,7 +821,7 @@ cas2_action: - /* 64bit CAS */ - #ifdef CONFIG_64BIT - 19: ldd,ma 0(%sr3,%r26), %r29 -- sub,= %r29, %r25, %r0 -+ sub,*= %r29, %r25, %r0 - b,n cas2_end - 20: std,ma %r24, 0(%sr3,%r26) - copy %r0, %r28 -diff --git a/arch/powerpc/include/asm/pgtable-ppc64.h b/arch/powerpc/include/asm/pgtable-ppc64.h -index 7b3d54fae46f..7356053b1133 100644 ---- a/arch/powerpc/include/asm/pgtable-ppc64.h -+++ b/arch/powerpc/include/asm/pgtable-ppc64.h -@@ -135,7 +135,19 @@ - #define pte_iterate_hashed_end() } while(0) - - #ifdef CONFIG_PPC_HAS_HASH_64K --#define pte_pagesize_index(mm, addr, pte) get_slice_psize(mm, addr) -+/* -+ * We expect this to be called only for user addresses or kernel virtual -+ * addresses other than the linear mapping. -+ */ -+#define pte_pagesize_index(mm, addr, pte) \ -+ ({ \ -+ unsigned int psize; \ -+ if (is_kernel_addr(addr)) \ -+ psize = MMU_PAGE_4K; \ -+ else \ -+ psize = get_slice_psize(mm, addr); \ -+ psize; \ -+ }) - #else - #define pte_pagesize_index(mm, addr, pte) MMU_PAGE_4K - #endif -diff --git a/arch/powerpc/include/asm/rtas.h b/arch/powerpc/include/asm/rtas.h -index 9bd52c65e66f..14de1385dedb 100644 ---- a/arch/powerpc/include/asm/rtas.h -+++ b/arch/powerpc/include/asm/rtas.h -@@ -255,6 +255,7 @@ extern void rtas_power_off(void); - extern void rtas_halt(void); - extern void rtas_os_term(char *str); - extern int rtas_get_sensor(int sensor, int index, int *state); -+extern int rtas_get_sensor_fast(int sensor, int index, int *state); - extern int rtas_get_power_level(int powerdomain, int *level); - extern int rtas_set_power_level(int powerdomain, int level, int *setlevel); - extern bool rtas_indicator_present(int token, int *maxindex); -diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c -index 4cf674d7d5ae..c4bc8d6cfd79 100644 ---- a/arch/powerpc/kernel/rtas.c -+++ b/arch/powerpc/kernel/rtas.c -@@ -584,6 +584,23 @@ int rtas_get_sensor(int sensor, int index, int *state) - } - EXPORT_SYMBOL(rtas_get_sensor); - -+int rtas_get_sensor_fast(int sensor, int index, int *state) -+{ -+ int token = rtas_token("get-sensor-state"); -+ int rc; -+ -+ if (token == RTAS_UNKNOWN_SERVICE) -+ return -ENOENT; -+ -+ rc = rtas_call(token, 2, 2, state, sensor, index); -+ WARN_ON(rc == RTAS_BUSY || (rc >= RTAS_EXTENDED_DELAY_MIN && -+ rc <= RTAS_EXTENDED_DELAY_MAX)); -+ -+ if (rc < 0) -+ return rtas_error_rc(rc); -+ return rc; -+} -+ - bool rtas_indicator_present(int token, int *maxindex) - { - int proplen, count, i; -diff --git a/arch/powerpc/mm/hugepage-hash64.c b/arch/powerpc/mm/hugepage-hash64.c -index 5f5e6328c21c..5061c6f676da 100644 ---- a/arch/powerpc/mm/hugepage-hash64.c -+++ b/arch/powerpc/mm/hugepage-hash64.c -@@ -136,7 +136,6 @@ int __hash_page_thp(unsigned long ea, unsigned long access, unsigned long vsid, - BUG_ON(index >= 4096); - - vpn = hpt_vpn(ea, vsid, ssize); -- hash = hpt_hash(vpn, shift, ssize); - hpte_slot_array = get_hpte_slot_array(pmdp); - if (psize == MMU_PAGE_4K) { - /* -@@ -151,6 +150,7 @@ int __hash_page_thp(unsigned long ea, unsigned long access, unsigned long vsid, - valid = hpte_valid(hpte_slot_array, index); - if (valid) { - /* update the hpte bits */ -+ hash = hpt_hash(vpn, shift, ssize); - hidx = hpte_hash_index(hpte_slot_array, index); - if (hidx & _PTEIDX_SECONDARY) - hash = ~hash; -@@ -176,6 +176,7 @@ int __hash_page_thp(unsigned long ea, unsigned long access, unsigned long vsid, - if (!valid) { - unsigned long hpte_group; - -+ hash = hpt_hash(vpn, shift, ssize); - /* insert new entry */ - pa = pmd_pfn(__pmd(old_pmd)) << PAGE_SHIFT; - new_pmd |= _PAGE_HASHPTE; -diff --git a/arch/powerpc/platforms/pseries/ras.c b/arch/powerpc/platforms/pseries/ras.c -index 721c0586b284..50fd3ac7b7bf 100644 ---- a/arch/powerpc/platforms/pseries/ras.c -+++ b/arch/powerpc/platforms/pseries/ras.c -@@ -187,7 +187,8 @@ static irqreturn_t ras_epow_interrupt(int irq, void *dev_id) - int state; - int critical; - -- status = rtas_get_sensor(EPOW_SENSOR_TOKEN, EPOW_SENSOR_INDEX, &state); -+ status = rtas_get_sensor_fast(EPOW_SENSOR_TOKEN, EPOW_SENSOR_INDEX, -+ &state); - - if (state > 3) - critical = 1; /* Time Critical */ -diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S -index 06469ee0f26e..6d6ab2b0bdfa 100644 ---- a/arch/x86/kernel/entry_64.S -+++ b/arch/x86/kernel/entry_64.S -@@ -1702,11 +1702,12 @@ ENTRY(nmi) - * If the variable is not set and the stack is not the NMI - * stack then: - * o Set the special variable on the stack -- * o Copy the interrupt frame into a "saved" location on the stack -- * o Copy the interrupt frame into a "copy" location on the stack -+ * o Copy the interrupt frame into an "outermost" location on the -+ * stack -+ * o Copy the interrupt frame into an "iret" location on the stack - * o Continue processing the NMI - * If the variable is set or the previous stack is the NMI stack: -- * o Modify the "copy" location to jump to the repeate_nmi -+ * o Modify the "iret" location to jump to the repeat_nmi - * o return back to the first NMI - * - * Now on exit of the first NMI, we first clear the stack variable -@@ -1715,52 +1716,184 @@ ENTRY(nmi) - * a nested NMI that updated the copy interrupt stack frame, a - * jump will be made to the repeat_nmi code that will handle the second - * NMI. -+ * -+ * However, espfix prevents us from directly returning to userspace -+ * with a single IRET instruction. Similarly, IRET to user mode -+ * can fault. We therefore handle NMIs from user space like -+ * other IST entries. - */ - - /* Use %rdx as out temp variable throughout */ - pushq_cfi %rdx - CFI_REL_OFFSET rdx, 0 - -+ testb $3, CS-RIP+8(%rsp) -+ jz .Lnmi_from_kernel -+ -+ /* -+ * NMI from user mode. We need to run on the thread stack, but we -+ * can't go through the normal entry paths: NMIs are masked, and -+ * we don't want to enable interrupts, because then we'll end -+ * up in an awkward situation in which IRQs are on but NMIs -+ * are off. -+ */ -+ SWAPGS -+ cld -+ movq %rsp, %rdx -+ movq PER_CPU_VAR(kernel_stack), %rsp -+ addq $KERNEL_STACK_OFFSET, %rsp -+ pushq 5*8(%rdx) /* pt_regs->ss */ -+ pushq 4*8(%rdx) /* pt_regs->rsp */ -+ pushq 3*8(%rdx) /* pt_regs->flags */ -+ pushq 2*8(%rdx) /* pt_regs->cs */ -+ pushq 1*8(%rdx) /* pt_regs->rip */ -+ pushq $-1 /* pt_regs->orig_ax */ -+ pushq %rdi /* pt_regs->di */ -+ pushq %rsi /* pt_regs->si */ -+ pushq (%rdx) /* pt_regs->dx */ -+ pushq %rcx /* pt_regs->cx */ -+ pushq %rax /* pt_regs->ax */ -+ pushq %r8 /* pt_regs->r8 */ -+ pushq %r9 /* pt_regs->r9 */ -+ pushq %r10 /* pt_regs->r10 */ -+ pushq %r11 /* pt_regs->r11 */ -+ pushq %rbx /* pt_regs->rbx */ -+ pushq %rbp /* pt_regs->rbp */ -+ pushq %r12 /* pt_regs->r12 */ -+ pushq %r13 /* pt_regs->r13 */ -+ pushq %r14 /* pt_regs->r14 */ -+ pushq %r15 /* pt_regs->r15 */ -+ -+ /* -+ * At this point we no longer need to worry about stack damage -+ * due to nesting -- we're on the normal thread stack and we're -+ * done with the NMI stack. -+ */ -+ movq %rsp, %rdi -+ movq $-1, %rsi -+ call do_nmi -+ -+ /* -+ * Return back to user mode. We must *not* do the normal exit -+ * work, because we don't want to enable interrupts. Fortunately, -+ * do_nmi doesn't modify pt_regs. -+ */ -+ SWAPGS -+ -+ /* -+ * Open-code the entire return process for compatibility with varying -+ * register layouts across different kernel versions. -+ */ -+ addq $6*8, %rsp /* skip bx, bp, and r12-r15 */ -+ popq %r11 /* pt_regs->r11 */ -+ popq %r10 /* pt_regs->r10 */ -+ popq %r9 /* pt_regs->r9 */ -+ popq %r8 /* pt_regs->r8 */ -+ popq %rax /* pt_regs->ax */ -+ popq %rcx /* pt_regs->cx */ -+ popq %rdx /* pt_regs->dx */ -+ popq %rsi /* pt_regs->si */ -+ popq %rdi /* pt_regs->di */ -+ addq $8, %rsp /* skip orig_ax */ -+ INTERRUPT_RETURN -+ -+.Lnmi_from_kernel: - /* -- * If %cs was not the kernel segment, then the NMI triggered in user -- * space, which means it is definitely not nested. -+ * Here's what our stack frame will look like: -+ * +---------------------------------------------------------+ -+ * | original SS | -+ * | original Return RSP | -+ * | original RFLAGS | -+ * | original CS | -+ * | original RIP | -+ * +---------------------------------------------------------+ -+ * | temp storage for rdx | -+ * +---------------------------------------------------------+ -+ * | "NMI executing" variable | -+ * +---------------------------------------------------------+ -+ * | iret SS } Copied from "outermost" frame | -+ * | iret Return RSP } on each loop iteration; overwritten | -+ * | iret RFLAGS } by a nested NMI to force another | -+ * | iret CS } iteration if needed. | -+ * | iret RIP } | -+ * +---------------------------------------------------------+ -+ * | outermost SS } initialized in first_nmi; | -+ * | outermost Return RSP } will not be changed before | -+ * | outermost RFLAGS } NMI processing is done. | -+ * | outermost CS } Copied to "iret" frame on each | -+ * | outermost RIP } iteration. | -+ * +---------------------------------------------------------+ -+ * | pt_regs | -+ * +---------------------------------------------------------+ -+ * -+ * The "original" frame is used by hardware. Before re-enabling -+ * NMIs, we need to be done with it, and we need to leave enough -+ * space for the asm code here. -+ * -+ * We return by executing IRET while RSP points to the "iret" frame. -+ * That will either return for real or it will loop back into NMI -+ * processing. -+ * -+ * The "outermost" frame is copied to the "iret" frame on each -+ * iteration of the loop, so each iteration starts with the "iret" -+ * frame pointing to the final return target. - */ -- cmpl $__KERNEL_CS, 16(%rsp) -- jne first_nmi - - /* -- * Check the special variable on the stack to see if NMIs are -- * executing. -+ * Determine whether we're a nested NMI. -+ * -+ * If we interrupted kernel code between repeat_nmi and -+ * end_repeat_nmi, then we are a nested NMI. We must not -+ * modify the "iret" frame because it's being written by -+ * the outer NMI. That's okay; the outer NMI handler is -+ * about to about to call do_nmi anyway, so we can just -+ * resume the outer NMI. -+ */ -+ movq $repeat_nmi, %rdx -+ cmpq 8(%rsp), %rdx -+ ja 1f -+ movq $end_repeat_nmi, %rdx -+ cmpq 8(%rsp), %rdx -+ ja nested_nmi_out -+1: -+ -+ /* -+ * Now check "NMI executing". If it's set, then we're nested. -+ * This will not detect if we interrupted an outer NMI just -+ * before IRET. - */ - cmpl $1, -8(%rsp) - je nested_nmi - - /* -- * Now test if the previous stack was an NMI stack. -- * We need the double check. We check the NMI stack to satisfy the -- * race when the first NMI clears the variable before returning. -- * We check the variable because the first NMI could be in a -- * breakpoint routine using a breakpoint stack. -+ * Now test if the previous stack was an NMI stack. This covers -+ * the case where we interrupt an outer NMI after it clears -+ * "NMI executing" but before IRET. We need to be careful, though: -+ * there is one case in which RSP could point to the NMI stack -+ * despite there being no NMI active: naughty userspace controls -+ * RSP at the very beginning of the SYSCALL targets. We can -+ * pull a fast one on naughty userspace, though: we program -+ * SYSCALL to mask DF, so userspace cannot cause DF to be set -+ * if it controls the kernel's RSP. We set DF before we clear -+ * "NMI executing". - */ - lea 6*8(%rsp), %rdx - test_in_nmi rdx, 4*8(%rsp), nested_nmi, first_nmi -+ -+ /* Ah, it is within the NMI stack. */ -+ -+ testb $(X86_EFLAGS_DF >> 8), (3*8 + 1)(%rsp) -+ jz first_nmi /* RSP was user controlled. */ -+ -+ /* This is a nested NMI. */ -+ - CFI_REMEMBER_STATE - - nested_nmi: - /* -- * Do nothing if we interrupted the fixup in repeat_nmi. -- * It's about to repeat the NMI handler, so we are fine -- * with ignoring this one. -+ * Modify the "iret" frame to point to repeat_nmi, forcing another -+ * iteration of NMI handling. - */ -- movq $repeat_nmi, %rdx -- cmpq 8(%rsp), %rdx -- ja 1f -- movq $end_repeat_nmi, %rdx -- cmpq 8(%rsp), %rdx -- ja nested_nmi_out -- --1: -- /* Set up the interrupted NMIs stack to jump to repeat_nmi */ - leaq -1*8(%rsp), %rdx - movq %rdx, %rsp - CFI_ADJUST_CFA_OFFSET 1*8 -@@ -1779,60 +1912,23 @@ nested_nmi_out: - popq_cfi %rdx - CFI_RESTORE rdx - -- /* No need to check faults here */ -+ /* We are returning to kernel mode, so this cannot result in a fault. */ - INTERRUPT_RETURN - - CFI_RESTORE_STATE - first_nmi: -- /* -- * Because nested NMIs will use the pushed location that we -- * stored in rdx, we must keep that space available. -- * Here's what our stack frame will look like: -- * +-------------------------+ -- * | original SS | -- * | original Return RSP | -- * | original RFLAGS | -- * | original CS | -- * | original RIP | -- * +-------------------------+ -- * | temp storage for rdx | -- * +-------------------------+ -- * | NMI executing variable | -- * +-------------------------+ -- * | copied SS | -- * | copied Return RSP | -- * | copied RFLAGS | -- * | copied CS | -- * | copied RIP | -- * +-------------------------+ -- * | Saved SS | -- * | Saved Return RSP | -- * | Saved RFLAGS | -- * | Saved CS | -- * | Saved RIP | -- * +-------------------------+ -- * | pt_regs | -- * +-------------------------+ -- * -- * The saved stack frame is used to fix up the copied stack frame -- * that a nested NMI may change to make the interrupted NMI iret jump -- * to the repeat_nmi. The original stack frame and the temp storage -- * is also used by nested NMIs and can not be trusted on exit. -- */ -- /* Do not pop rdx, nested NMIs will corrupt that part of the stack */ -+ /* Restore rdx. */ - movq (%rsp), %rdx - CFI_RESTORE rdx - -- /* Set the NMI executing variable on the stack. */ -+ /* Set "NMI executing" on the stack. */ - pushq_cfi $1 - -- /* -- * Leave room for the "copied" frame -- */ -+ /* Leave room for the "iret" frame */ - subq $(5*8), %rsp - CFI_ADJUST_CFA_OFFSET 5*8 - -- /* Copy the stack frame to the Saved frame */ -+ /* Copy the "original" frame to the "outermost" frame */ - .rept 5 - pushq_cfi 11*8(%rsp) - .endr -@@ -1840,6 +1936,7 @@ first_nmi: - - /* Everything up to here is safe from nested NMIs */ - -+repeat_nmi: - /* - * If there was a nested NMI, the first NMI's iret will return - * here. But NMIs are still enabled and we can take another -@@ -1848,16 +1945,21 @@ first_nmi: - * it will just return, as we are about to repeat an NMI anyway. - * This makes it safe to copy to the stack frame that a nested - * NMI will update. -- */ --repeat_nmi: -- /* -- * Update the stack variable to say we are still in NMI (the update -- * is benign for the non-repeat case, where 1 was pushed just above -- * to this very stack slot). -+ * -+ * RSP is pointing to "outermost RIP". gsbase is unknown, but, if -+ * we're repeating an NMI, gsbase has the same value that it had on -+ * the first iteration. paranoid_entry will load the kernel -+ * gsbase if needed before we call do_nmi. -+ * -+ * Set "NMI executing" in case we came back here via IRET. - */ - movq $1, 10*8(%rsp) - -- /* Make another copy, this one may be modified by nested NMIs */ -+ /* -+ * Copy the "outermost" frame to the "iret" frame. NMIs that nest -+ * here must not modify the "iret" frame while we're writing to -+ * it or it will end up containing garbage. -+ */ - addq $(10*8), %rsp - CFI_ADJUST_CFA_OFFSET -10*8 - .rept 5 -@@ -1868,9 +1970,9 @@ repeat_nmi: - end_repeat_nmi: - - /* -- * Everything below this point can be preempted by a nested -- * NMI if the first NMI took an exception and reset our iret stack -- * so that we repeat another NMI. -+ * Everything below this point can be preempted by a nested NMI. -+ * If this happens, then the inner NMI will change the "iret" -+ * frame to point back to repeat_nmi. - */ - pushq_cfi $-1 /* ORIG_RAX: no syscall to restart */ - subq $ORIG_RAX-R15, %rsp -@@ -1885,28 +1987,10 @@ end_repeat_nmi: - call save_paranoid - DEFAULT_FRAME 0 - -- /* -- * Save off the CR2 register. If we take a page fault in the NMI then -- * it could corrupt the CR2 value. If the NMI preempts a page fault -- * handler before it was able to read the CR2 register, and then the -- * NMI itself takes a page fault, the page fault that was preempted -- * will read the information from the NMI page fault and not the -- * origin fault. Save it off and restore it if it changes. -- * Use the r12 callee-saved register. -- */ -- movq %cr2, %r12 -- - /* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */ - movq %rsp,%rdi - movq $-1,%rsi - call do_nmi -- -- /* Did the NMI take a page fault? Restore cr2 if it did */ -- movq %cr2, %rcx -- cmpq %rcx, %r12 -- je 1f -- movq %r12, %cr2 --1: - - testl %ebx,%ebx /* swapgs needed? */ - jnz nmi_restore -@@ -1916,9 +2000,23 @@ nmi_restore: - /* Pop the extra iret frame at once */ - RESTORE_ALL 6*8 - -- /* Clear the NMI executing stack variable */ -- movq $0, 5*8(%rsp) -- jmp irq_return -+ /* -+ * Clear "NMI executing". Set DF first so that we can easily -+ * distinguish the remaining code between here and IRET from -+ * the SYSCALL entry and exit paths. On a native kernel, we -+ * could just inspect RIP, but, on paravirt kernels, -+ * INTERRUPT_RETURN can translate into a jump into a -+ * hypercall page. -+ */ -+ std -+ movq $0, 5*8(%rsp) /* clear "NMI executing" */ -+ -+ /* -+ * INTERRUPT_RETURN reads the "iret" frame and exits the NMI -+ * stack in a single instruction. We are returning to kernel -+ * mode, so this cannot result in a fault. -+ */ -+ INTERRUPT_RETURN - CFI_ENDPROC - END(nmi) - -diff --git a/arch/x86/kernel/nmi.c b/arch/x86/kernel/nmi.c -index 6fcb49ce50a1..8facfb318a97 100644 ---- a/arch/x86/kernel/nmi.c -+++ b/arch/x86/kernel/nmi.c -@@ -392,15 +392,15 @@ static __kprobes void default_do_nmi(struct pt_regs *regs) - } - - /* -- * NMIs can hit breakpoints which will cause it to lose its -- * NMI context with the CPU when the breakpoint does an iret. -- */ --#ifdef CONFIG_X86_32 --/* -- * For i386, NMIs use the same stack as the kernel, and we can -- * add a workaround to the iret problem in C (preventing nested -- * NMIs if an NMI takes a trap). Simply have 3 states the NMI -- * can be in: -+ * NMIs can page fault or hit breakpoints which will cause it to lose -+ * its NMI context with the CPU when the breakpoint or page fault does an IRET. -+ * -+ * As a result, NMIs can nest if NMIs get unmasked due an IRET during -+ * NMI processing. On x86_64, the asm glue protects us from nested NMIs -+ * if the outer NMI came from kernel mode, but we can still nest if the -+ * outer NMI came from user mode. -+ * -+ * To handle these nested NMIs, we have three states: - * - * 1) not running - * 2) executing -@@ -414,15 +414,14 @@ static __kprobes void default_do_nmi(struct pt_regs *regs) - * (Note, the latch is binary, thus multiple NMIs triggering, - * when one is running, are ignored. Only one NMI is restarted.) - * -- * If an NMI hits a breakpoint that executes an iret, another -- * NMI can preempt it. We do not want to allow this new NMI -- * to run, but we want to execute it when the first one finishes. -- * We set the state to "latched", and the exit of the first NMI will -- * perform a dec_return, if the result is zero (NOT_RUNNING), then -- * it will simply exit the NMI handler. If not, the dec_return -- * would have set the state to NMI_EXECUTING (what we want it to -- * be when we are running). In this case, we simply jump back -- * to rerun the NMI handler again, and restart the 'latched' NMI. -+ * If an NMI executes an iret, another NMI can preempt it. We do not -+ * want to allow this new NMI to run, but we want to execute it when the -+ * first one finishes. We set the state to "latched", and the exit of -+ * the first NMI will perform a dec_return, if the result is zero -+ * (NOT_RUNNING), then it will simply exit the NMI handler. If not, the -+ * dec_return would have set the state to NMI_EXECUTING (what we want it -+ * to be when we are running). In this case, we simply jump back to -+ * rerun the NMI handler again, and restart the 'latched' NMI. - * - * No trap (breakpoint or page fault) should be hit before nmi_restart, - * thus there is no race between the first check of state for NOT_RUNNING -@@ -445,49 +444,36 @@ enum nmi_states { - static DEFINE_PER_CPU(enum nmi_states, nmi_state); - static DEFINE_PER_CPU(unsigned long, nmi_cr2); - --#define nmi_nesting_preprocess(regs) \ -- do { \ -- if (this_cpu_read(nmi_state) != NMI_NOT_RUNNING) { \ -- this_cpu_write(nmi_state, NMI_LATCHED); \ -- return; \ -- } \ -- this_cpu_write(nmi_state, NMI_EXECUTING); \ -- this_cpu_write(nmi_cr2, read_cr2()); \ -- } while (0); \ -- nmi_restart: -- --#define nmi_nesting_postprocess() \ -- do { \ -- if (unlikely(this_cpu_read(nmi_cr2) != read_cr2())) \ -- write_cr2(this_cpu_read(nmi_cr2)); \ -- if (this_cpu_dec_return(nmi_state)) \ -- goto nmi_restart; \ -- } while (0) --#else /* x86_64 */ -+#ifdef CONFIG_X86_64 - /* -- * In x86_64 things are a bit more difficult. This has the same problem -- * where an NMI hitting a breakpoint that calls iret will remove the -- * NMI context, allowing a nested NMI to enter. What makes this more -- * difficult is that both NMIs and breakpoints have their own stack. -- * When a new NMI or breakpoint is executed, the stack is set to a fixed -- * point. If an NMI is nested, it will have its stack set at that same -- * fixed address that the first NMI had, and will start corrupting the -- * stack. This is handled in entry_64.S, but the same problem exists with -- * the breakpoint stack. -+ * In x86_64, we need to handle breakpoint -> NMI -> breakpoint. Without -+ * some care, the inner breakpoint will clobber the outer breakpoint's -+ * stack. - * -- * If a breakpoint is being processed, and the debug stack is being used, -- * if an NMI comes in and also hits a breakpoint, the stack pointer -- * will be set to the same fixed address as the breakpoint that was -- * interrupted, causing that stack to be corrupted. To handle this case, -- * check if the stack that was interrupted is the debug stack, and if -- * so, change the IDT so that new breakpoints will use the current stack -- * and not switch to the fixed address. On return of the NMI, switch back -- * to the original IDT. -+ * If a breakpoint is being processed, and the debug stack is being -+ * used, if an NMI comes in and also hits a breakpoint, the stack -+ * pointer will be set to the same fixed address as the breakpoint that -+ * was interrupted, causing that stack to be corrupted. To handle this -+ * case, check if the stack that was interrupted is the debug stack, and -+ * if so, change the IDT so that new breakpoints will use the current -+ * stack and not switch to the fixed address. On return of the NMI, -+ * switch back to the original IDT. - */ - static DEFINE_PER_CPU(int, update_debug_stack); -+#endif - --static inline void nmi_nesting_preprocess(struct pt_regs *regs) -+dotraplinkage notrace void -+do_nmi(struct pt_regs *regs, long error_code) - { -+ if (this_cpu_read(nmi_state) != NMI_NOT_RUNNING) { -+ this_cpu_write(nmi_state, NMI_LATCHED); -+ return; -+ } -+ this_cpu_write(nmi_state, NMI_EXECUTING); -+ this_cpu_write(nmi_cr2, read_cr2()); -+nmi_restart: -+ -+#ifdef CONFIG_X86_64 - /* - * If we interrupted a breakpoint, it is possible that - * the nmi handler will have breakpoints too. We need to -@@ -498,22 +484,8 @@ static inline void nmi_nesting_preprocess(struct pt_regs *regs) - debug_stack_set_zero(); - this_cpu_write(update_debug_stack, 1); - } --} -- --static inline void nmi_nesting_postprocess(void) --{ -- if (unlikely(this_cpu_read(update_debug_stack))) { -- debug_stack_reset(); -- this_cpu_write(update_debug_stack, 0); -- } --} - #endif - --dotraplinkage notrace __kprobes void --do_nmi(struct pt_regs *regs, long error_code) --{ -- nmi_nesting_preprocess(regs); -- - nmi_enter(); - - inc_irq_stat(__nmi_count); -@@ -523,8 +495,17 @@ do_nmi(struct pt_regs *regs, long error_code) - - nmi_exit(); - -- /* On i386, may loop back to preprocess */ -- nmi_nesting_postprocess(); -+#ifdef CONFIG_X86_64 -+ if (unlikely(this_cpu_read(update_debug_stack))) { -+ debug_stack_reset(); -+ this_cpu_write(update_debug_stack, 0); -+ } -+#endif -+ -+ if (unlikely(this_cpu_read(nmi_cr2) != read_cr2())) -+ write_cr2(this_cpu_read(nmi_cr2)); -+ if (this_cpu_dec_return(nmi_state)) -+ goto nmi_restart; - } - - void stop_nmi(void) -diff --git a/arch/x86/mm/init_32.c b/arch/x86/mm/init_32.c -index e39504878aec..a7b5b3071072 100644 ---- a/arch/x86/mm/init_32.c -+++ b/arch/x86/mm/init_32.c -@@ -137,6 +137,7 @@ page_table_range_init_count(unsigned long start, unsigned long end) - - vaddr = start; - pgd_idx = pgd_index(vaddr); -+ pmd_idx = pmd_index(vaddr); - - for ( ; (pgd_idx < PTRS_PER_PGD) && (vaddr != end); pgd_idx++) { - for (; (pmd_idx < PTRS_PER_PMD) && (vaddr != end); -diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c -index b91ce75bd35d..d2102c4eefbf 100644 ---- a/block/blk-mq-sysfs.c -+++ b/block/blk-mq-sysfs.c -@@ -141,15 +141,26 @@ static ssize_t blk_mq_sysfs_completed_show(struct blk_mq_ctx *ctx, char *page) - - static ssize_t sysfs_list_show(char *page, struct list_head *list, char *msg) - { -- char *start_page = page; - struct request *rq; -+ int len = snprintf(page, PAGE_SIZE - 1, "%s:\n", msg); -+ -+ list_for_each_entry(rq, list, queuelist) { -+ const int rq_len = 2 * sizeof(rq) + 2; -+ -+ /* if the output will be truncated */ -+ if (PAGE_SIZE - 1 < len + rq_len) { -+ /* backspacing if it can't hold '\t...\n' */ -+ if (PAGE_SIZE - 1 < len + 5) -+ len -= rq_len; -+ len += snprintf(page + len, PAGE_SIZE - 1 - len, -+ "\t...\n"); -+ break; -+ } -+ len += snprintf(page + len, PAGE_SIZE - 1 - len, -+ "\t%p\n", rq); -+ } - -- page += sprintf(page, "%s:\n", msg); -- -- list_for_each_entry(rq, list, queuelist) -- page += sprintf(page, "\t%p\n", rq); -- -- return page - start_page; -+ return len; - } - - static ssize_t blk_mq_sysfs_rq_list_show(struct blk_mq_ctx *ctx, char *page) -diff --git a/drivers/base/node.c b/drivers/base/node.c -index bc9f43bf7e29..5f5160c9455f 100644 ---- a/drivers/base/node.c -+++ b/drivers/base/node.c -@@ -399,6 +399,16 @@ int register_mem_sect_under_node(struct memory_block *mem_blk, int nid) - for (pfn = sect_start_pfn; pfn <= sect_end_pfn; pfn++) { - int page_nid; - -+ /* -+ * memory block could have several absent sections from start. -+ * skip pfn range from absent section -+ */ -+ if (!pfn_present(pfn)) { -+ pfn = round_down(pfn + PAGES_PER_SECTION, -+ PAGES_PER_SECTION) - 1; -+ continue; -+ } -+ - page_nid = get_nid_for_pfn(pfn); - if (page_nid < 0) - continue; -diff --git a/drivers/block/nvme-core.c b/drivers/block/nvme-core.c -index 51824d1f23ea..2d3385d3c6a9 100644 ---- a/drivers/block/nvme-core.c -+++ b/drivers/block/nvme-core.c -@@ -2464,6 +2464,7 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id) - if (result) - goto release; - -+ kref_init(&dev->kref); - result = nvme_dev_start(dev); - if (result) { - if (result == -EBUSY) -@@ -2471,7 +2472,6 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id) - goto release_pools; - } - -- kref_init(&dev->kref); - result = nvme_dev_add(dev); - if (result) - goto shutdown; -diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c -index 79a266934327..fd2820ff9e5b 100644 ---- a/drivers/gpu/drm/radeon/radeon_combios.c -+++ b/drivers/gpu/drm/radeon/radeon_combios.c -@@ -3387,6 +3387,14 @@ void radeon_combios_asic_init(struct drm_device *dev) - rdev->pdev->subsystem_device == 0x30ae) - return; - -+ /* quirk for rs4xx HP Compaq dc5750 Small Form Factor to make it resume -+ * - it hangs on resume inside the dynclk 1 table. -+ */ -+ if (rdev->family == CHIP_RS480 && -+ rdev->pdev->subsystem_vendor == 0x103c && -+ rdev->pdev->subsystem_device == 0x280a) -+ return; -+ - /* DYN CLK 1 */ - table = combios_get_table_offset(dev, COMBIOS_DYN_CLK_1_TABLE); - if (table) -diff --git a/drivers/iio/gyro/Kconfig b/drivers/iio/gyro/Kconfig -index 6f64c5cc5387..ac2d69e34c8c 100644 ---- a/drivers/iio/gyro/Kconfig -+++ b/drivers/iio/gyro/Kconfig -@@ -93,8 +93,7 @@ config IIO_ST_GYRO_SPI_3AXIS - config ITG3200 - tristate "InvenSense ITG3200 Digital 3-Axis Gyroscope I2C driver" - depends on I2C -- select IIO_BUFFER -- select IIO_TRIGGERED_BUFFER -+ select IIO_TRIGGERED_BUFFER if IIO_BUFFER - help - Say yes here to add support for the InvenSense ITG3200 digital - 3-axis gyroscope sensor. -diff --git a/drivers/infiniband/core/uverbs.h b/drivers/infiniband/core/uverbs.h -index a283274a5a09..639557bdc0cd 100644 ---- a/drivers/infiniband/core/uverbs.h -+++ b/drivers/infiniband/core/uverbs.h -@@ -85,7 +85,7 @@ - */ - - struct ib_uverbs_device { -- struct kref ref; -+ atomic_t refcount; - int num_comp_vectors; - struct completion comp; - struct device *dev; -@@ -94,6 +94,7 @@ struct ib_uverbs_device { - struct cdev cdev; - struct rb_root xrcd_tree; - struct mutex xrcd_tree_mutex; -+ struct kobject kobj; - }; - - struct ib_uverbs_event_file { -diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c -index 2adc14372b94..5e66eab292d8 100644 ---- a/drivers/infiniband/core/uverbs_cmd.c -+++ b/drivers/infiniband/core/uverbs_cmd.c -@@ -2111,6 +2111,12 @@ ssize_t ib_uverbs_post_send(struct ib_uverbs_file *file, - next->send_flags = user_wr->send_flags; - - if (is_ud) { -+ if (next->opcode != IB_WR_SEND && -+ next->opcode != IB_WR_SEND_WITH_IMM) { -+ ret = -EINVAL; -+ goto out_put; -+ } -+ - next->wr.ud.ah = idr_read_ah(user_wr->wr.ud.ah, - file->ucontext); - if (!next->wr.ud.ah) { -@@ -2150,9 +2156,11 @@ ssize_t ib_uverbs_post_send(struct ib_uverbs_file *file, - user_wr->wr.atomic.compare_add; - next->wr.atomic.swap = user_wr->wr.atomic.swap; - next->wr.atomic.rkey = user_wr->wr.atomic.rkey; -+ case IB_WR_SEND: - break; - default: -- break; -+ ret = -EINVAL; -+ goto out_put; - } - } - -diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c -index 7a515c867674..8802d5ccd93d 100644 ---- a/drivers/infiniband/core/uverbs_main.c -+++ b/drivers/infiniband/core/uverbs_main.c -@@ -127,14 +127,18 @@ static int (*uverbs_ex_cmd_table[])(struct ib_uverbs_file *file, - static void ib_uverbs_add_one(struct ib_device *device); - static void ib_uverbs_remove_one(struct ib_device *device); - --static void ib_uverbs_release_dev(struct kref *ref) -+static void ib_uverbs_release_dev(struct kobject *kobj) - { - struct ib_uverbs_device *dev = -- container_of(ref, struct ib_uverbs_device, ref); -+ container_of(kobj, struct ib_uverbs_device, kobj); - -- complete(&dev->comp); -+ kfree(dev); - } - -+static struct kobj_type ib_uverbs_dev_ktype = { -+ .release = ib_uverbs_release_dev, -+}; -+ - static void ib_uverbs_release_event_file(struct kref *ref) - { - struct ib_uverbs_event_file *file = -@@ -298,13 +302,19 @@ static int ib_uverbs_cleanup_ucontext(struct ib_uverbs_file *file, - return context->device->dealloc_ucontext(context); - } - -+static void ib_uverbs_comp_dev(struct ib_uverbs_device *dev) -+{ -+ complete(&dev->comp); -+} -+ - static void ib_uverbs_release_file(struct kref *ref) - { - struct ib_uverbs_file *file = - container_of(ref, struct ib_uverbs_file, ref); - - module_put(file->device->ib_dev->owner); -- kref_put(&file->device->ref, ib_uverbs_release_dev); -+ if (atomic_dec_and_test(&file->device->refcount)) -+ ib_uverbs_comp_dev(file->device); - - kfree(file); - } -@@ -734,9 +744,7 @@ static int ib_uverbs_open(struct inode *inode, struct file *filp) - int ret; - - dev = container_of(inode->i_cdev, struct ib_uverbs_device, cdev); -- if (dev) -- kref_get(&dev->ref); -- else -+ if (!atomic_inc_not_zero(&dev->refcount)) - return -ENXIO; - - if (!try_module_get(dev->ib_dev->owner)) { -@@ -757,6 +765,7 @@ static int ib_uverbs_open(struct inode *inode, struct file *filp) - mutex_init(&file->mutex); - - filp->private_data = file; -+ kobject_get(&dev->kobj); - - return nonseekable_open(inode, filp); - -@@ -764,13 +773,16 @@ err_module: - module_put(dev->ib_dev->owner); - - err: -- kref_put(&dev->ref, ib_uverbs_release_dev); -+ if (atomic_dec_and_test(&dev->refcount)) -+ ib_uverbs_comp_dev(dev); -+ - return ret; - } - - static int ib_uverbs_close(struct inode *inode, struct file *filp) - { - struct ib_uverbs_file *file = filp->private_data; -+ struct ib_uverbs_device *dev = file->device; - - ib_uverbs_cleanup_ucontext(file, file->ucontext); - -@@ -778,6 +790,7 @@ static int ib_uverbs_close(struct inode *inode, struct file *filp) - kref_put(&file->async_file->ref, ib_uverbs_release_event_file); - - kref_put(&file->ref, ib_uverbs_release_file); -+ kobject_put(&dev->kobj); - - return 0; - } -@@ -873,10 +886,11 @@ static void ib_uverbs_add_one(struct ib_device *device) - if (!uverbs_dev) - return; - -- kref_init(&uverbs_dev->ref); -+ atomic_set(&uverbs_dev->refcount, 1); - init_completion(&uverbs_dev->comp); - uverbs_dev->xrcd_tree = RB_ROOT; - mutex_init(&uverbs_dev->xrcd_tree_mutex); -+ kobject_init(&uverbs_dev->kobj, &ib_uverbs_dev_ktype); - - spin_lock(&map_lock); - devnum = find_first_zero_bit(dev_map, IB_UVERBS_MAX_DEVICES); -@@ -903,6 +917,7 @@ static void ib_uverbs_add_one(struct ib_device *device) - cdev_init(&uverbs_dev->cdev, NULL); - uverbs_dev->cdev.owner = THIS_MODULE; - uverbs_dev->cdev.ops = device->mmap ? &uverbs_mmap_fops : &uverbs_fops; -+ uverbs_dev->cdev.kobj.parent = &uverbs_dev->kobj; - kobject_set_name(&uverbs_dev->cdev.kobj, "uverbs%d", uverbs_dev->devnum); - if (cdev_add(&uverbs_dev->cdev, base, 1)) - goto err_cdev; -@@ -933,9 +948,10 @@ err_cdev: - clear_bit(devnum, overflow_map); - - err: -- kref_put(&uverbs_dev->ref, ib_uverbs_release_dev); -+ if (atomic_dec_and_test(&uverbs_dev->refcount)) -+ ib_uverbs_comp_dev(uverbs_dev); - wait_for_completion(&uverbs_dev->comp); -- kfree(uverbs_dev); -+ kobject_put(&uverbs_dev->kobj); - return; - } - -@@ -955,9 +971,10 @@ static void ib_uverbs_remove_one(struct ib_device *device) - else - clear_bit(uverbs_dev->devnum - IB_UVERBS_MAX_DEVICES, overflow_map); - -- kref_put(&uverbs_dev->ref, ib_uverbs_release_dev); -+ if (atomic_dec_and_test(&uverbs_dev->refcount)) -+ ib_uverbs_comp_dev(uverbs_dev); - wait_for_completion(&uverbs_dev->comp); -- kfree(uverbs_dev); -+ kobject_put(&uverbs_dev->kobj); - } - - static char *uverbs_devnode(struct device *dev, umode_t *mode) -diff --git a/drivers/infiniband/hw/mlx4/ah.c b/drivers/infiniband/hw/mlx4/ah.c -index 170dca608042..1ddcebd84622 100644 ---- a/drivers/infiniband/hw/mlx4/ah.c -+++ b/drivers/infiniband/hw/mlx4/ah.c -@@ -147,9 +147,13 @@ int mlx4_ib_query_ah(struct ib_ah *ibah, struct ib_ah_attr *ah_attr) - enum rdma_link_layer ll; - - memset(ah_attr, 0, sizeof *ah_attr); -- ah_attr->sl = be32_to_cpu(ah->av.ib.sl_tclass_flowlabel) >> 28; - ah_attr->port_num = be32_to_cpu(ah->av.ib.port_pd) >> 24; - ll = rdma_port_get_link_layer(ibah->device, ah_attr->port_num); -+ if (ll == IB_LINK_LAYER_ETHERNET) -+ ah_attr->sl = be32_to_cpu(ah->av.eth.sl_tclass_flowlabel) >> 29; -+ else -+ ah_attr->sl = be32_to_cpu(ah->av.ib.sl_tclass_flowlabel) >> 28; -+ - ah_attr->dlid = ll == IB_LINK_LAYER_INFINIBAND ? be16_to_cpu(ah->av.ib.dlid) : 0; - if (ah->av.ib.stat_rate) - ah_attr->static_rate = ah->av.ib.stat_rate - MLX4_STAT_RATE_OFFSET; -diff --git a/drivers/infiniband/hw/mlx4/sysfs.c b/drivers/infiniband/hw/mlx4/sysfs.c -index db2ea31df832..b5e50c605933 100644 ---- a/drivers/infiniband/hw/mlx4/sysfs.c -+++ b/drivers/infiniband/hw/mlx4/sysfs.c -@@ -563,6 +563,8 @@ static int add_port(struct mlx4_ib_dev *dev, int port_num, int slave) - struct mlx4_port *p; - int i; - int ret; -+ int is_eth = rdma_port_get_link_layer(&dev->ib_dev, port_num) == -+ IB_LINK_LAYER_ETHERNET; - - p = kzalloc(sizeof *p, GFP_KERNEL); - if (!p) -@@ -580,7 +582,8 @@ static int add_port(struct mlx4_ib_dev *dev, int port_num, int slave) - - p->pkey_group.name = "pkey_idx"; - p->pkey_group.attrs = -- alloc_group_attrs(show_port_pkey, store_port_pkey, -+ alloc_group_attrs(show_port_pkey, -+ is_eth ? NULL : store_port_pkey, - dev->dev->caps.pkey_table_len[port_num]); - if (!p->pkey_group.attrs) { - ret = -ENOMEM; -diff --git a/drivers/infiniband/hw/qib/qib_keys.c b/drivers/infiniband/hw/qib/qib_keys.c -index 3b9afccaaade..eabe54738be6 100644 ---- a/drivers/infiniband/hw/qib/qib_keys.c -+++ b/drivers/infiniband/hw/qib/qib_keys.c -@@ -86,6 +86,10 @@ int qib_alloc_lkey(struct qib_mregion *mr, int dma_region) - * unrestricted LKEY. - */ - rkt->gen++; -+ /* -+ * bits are capped in qib_verbs.c to insure enough bits -+ * for generation number -+ */ - mr->lkey = (r << (32 - ib_qib_lkey_table_size)) | - ((((1 << (24 - ib_qib_lkey_table_size)) - 1) & rkt->gen) - << 8); -diff --git a/drivers/infiniband/hw/qib/qib_verbs.c b/drivers/infiniband/hw/qib/qib_verbs.c -index 092b0bb1bb78..c141b9b2493d 100644 ---- a/drivers/infiniband/hw/qib/qib_verbs.c -+++ b/drivers/infiniband/hw/qib/qib_verbs.c -@@ -40,6 +40,7 @@ - #include - #include - #include -+#include - - #include "qib.h" - #include "qib_common.h" -@@ -2086,10 +2087,16 @@ int qib_register_ib_device(struct qib_devdata *dd) - * the LKEY). The remaining bits act as a generation number or tag. - */ - spin_lock_init(&dev->lk_table.lock); -+ /* insure generation is at least 4 bits see keys.c */ -+ if (ib_qib_lkey_table_size > MAX_LKEY_TABLE_BITS) { -+ qib_dev_warn(dd, "lkey bits %u too large, reduced to %u\n", -+ ib_qib_lkey_table_size, MAX_LKEY_TABLE_BITS); -+ ib_qib_lkey_table_size = MAX_LKEY_TABLE_BITS; -+ } - dev->lk_table.max = 1 << ib_qib_lkey_table_size; - lk_tab_size = dev->lk_table.max * sizeof(*dev->lk_table.table); - dev->lk_table.table = (struct qib_mregion __rcu **) -- __get_free_pages(GFP_KERNEL, get_order(lk_tab_size)); -+ vmalloc(lk_tab_size); - if (dev->lk_table.table == NULL) { - ret = -ENOMEM; - goto err_lk; -@@ -2262,7 +2269,7 @@ err_tx: - sizeof(struct qib_pio_header), - dev->pio_hdrs, dev->pio_hdrs_phys); - err_hdrs: -- free_pages((unsigned long) dev->lk_table.table, get_order(lk_tab_size)); -+ vfree(dev->lk_table.table); - err_lk: - kfree(dev->qp_table); - err_qpt: -@@ -2316,8 +2323,7 @@ void qib_unregister_ib_device(struct qib_devdata *dd) - sizeof(struct qib_pio_header), - dev->pio_hdrs, dev->pio_hdrs_phys); - lk_tab_size = dev->lk_table.max * sizeof(*dev->lk_table.table); -- free_pages((unsigned long) dev->lk_table.table, -- get_order(lk_tab_size)); -+ vfree(dev->lk_table.table); - kfree(dev->qp_table); - } - -diff --git a/drivers/infiniband/hw/qib/qib_verbs.h b/drivers/infiniband/hw/qib/qib_verbs.h -index a01c7d2cf541..d34bc69f1f17 100644 ---- a/drivers/infiniband/hw/qib/qib_verbs.h -+++ b/drivers/infiniband/hw/qib/qib_verbs.h -@@ -647,6 +647,8 @@ struct qib_qpn_table { - struct qpn_map map[QPNMAP_ENTRIES]; - }; - -+#define MAX_LKEY_TABLE_BITS 23 -+ - struct qib_lkey_table { - spinlock_t lock; /* protect changes in this struct */ - u32 next; /* next unused index (speeds search) */ -diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c -index fb787c3e88d9..bb9f073a4e13 100644 ---- a/drivers/input/evdev.c -+++ b/drivers/input/evdev.c -@@ -240,19 +240,14 @@ static int evdev_flush(struct file *file, fl_owner_t id) - { - struct evdev_client *client = file->private_data; - struct evdev *evdev = client->evdev; -- int retval; - -- retval = mutex_lock_interruptible(&evdev->mutex); -- if (retval) -- return retval; -+ mutex_lock(&evdev->mutex); - -- if (!evdev->exist || client->revoked) -- retval = -ENODEV; -- else -- retval = input_flush_device(&evdev->handle, file); -+ if (evdev->exist && !client->revoked) -+ input_flush_device(&evdev->handle, file); - - mutex_unlock(&evdev->mutex); -- return retval; -+ return 0; - } - - static void evdev_free(struct device *dev) -diff --git a/drivers/isdn/gigaset/ser-gigaset.c b/drivers/isdn/gigaset/ser-gigaset.c -index 8c91fd5eb6fd..3ac9c4194814 100644 ---- a/drivers/isdn/gigaset/ser-gigaset.c -+++ b/drivers/isdn/gigaset/ser-gigaset.c -@@ -524,9 +524,18 @@ gigaset_tty_open(struct tty_struct *tty) - cs->hw.ser->tty = tty; - atomic_set(&cs->hw.ser->refcnt, 1); - init_completion(&cs->hw.ser->dead_cmp); -- - tty->disc_data = cs; - -+ /* Set the amount of data we're willing to receive per call -+ * from the hardware driver to half of the input buffer size -+ * to leave some reserve. -+ * Note: We don't do flow control towards the hardware driver. -+ * If more data is received than will fit into the input buffer, -+ * it will be dropped and an error will be logged. This should -+ * never happen as the device is slow and the buffer size ample. -+ */ -+ tty->receive_room = RBUFSIZE/2; -+ - /* OK.. Initialization of the datastructures and the HW is done.. Now - * startup system and notify the LL that we are ready to run - */ -diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c -index a46124ecafc7..73c9f579b042 100644 ---- a/drivers/md/raid10.c -+++ b/drivers/md/raid10.c -@@ -3585,6 +3585,7 @@ static struct r10conf *setup_conf(struct mddev *mddev) - /* far_copies must be 1 */ - conf->prev.stride = conf->dev_sectors; - } -+ conf->reshape_safe = conf->reshape_progress; - spin_lock_init(&conf->device_lock); - INIT_LIST_HEAD(&conf->retry_list); - -@@ -3793,7 +3794,6 @@ static int run(struct mddev *mddev) - } - conf->offset_diff = min_offset_diff; - -- conf->reshape_safe = conf->reshape_progress; - clear_bit(MD_RECOVERY_SYNC, &mddev->recovery); - clear_bit(MD_RECOVERY_CHECK, &mddev->recovery); - set_bit(MD_RECOVERY_RESHAPE, &mddev->recovery); -@@ -4138,6 +4138,7 @@ static int raid10_start_reshape(struct mddev *mddev) - conf->reshape_progress = size; - } else - conf->reshape_progress = 0; -+ conf->reshape_safe = conf->reshape_progress; - spin_unlock_irq(&conf->device_lock); - - if (mddev->delta_disks && mddev->bitmap) { -@@ -4204,6 +4205,7 @@ abort: - rdev->new_data_offset = rdev->data_offset; - smp_wmb(); - conf->reshape_progress = MaxSector; -+ conf->reshape_safe = MaxSector; - mddev->reshape_position = MaxSector; - spin_unlock_irq(&conf->device_lock); - return ret; -@@ -4556,6 +4558,7 @@ static void end_reshape(struct r10conf *conf) - md_finish_reshape(conf->mddev); - smp_wmb(); - conf->reshape_progress = MaxSector; -+ conf->reshape_safe = MaxSector; - spin_unlock_irq(&conf->device_lock); - - /* read-ahead size must cover two whole stripes, which is -diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c -index 5807185262fe..ee0015be1421 100644 ---- a/drivers/media/platform/omap3isp/isp.c -+++ b/drivers/media/platform/omap3isp/isp.c -@@ -824,14 +824,14 @@ static int isp_pipeline_link_notify(struct media_link *link, u32 flags, - int ret; - - if (notification == MEDIA_DEV_NOTIFY_POST_LINK_CH && -- !(link->flags & MEDIA_LNK_FL_ENABLED)) { -+ !(flags & MEDIA_LNK_FL_ENABLED)) { - /* Powering off entities is assumed to never fail. */ - isp_pipeline_pm_power(source, -sink_use); - isp_pipeline_pm_power(sink, -source_use); - return 0; - } - -- if (notification == MEDIA_DEV_NOTIFY_POST_LINK_CH && -+ if (notification == MEDIA_DEV_NOTIFY_PRE_LINK_CH && - (flags & MEDIA_LNK_FL_ENABLED)) { - - ret = isp_pipeline_pm_power(source, sink_use); -diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c -index 6a881ebe5b02..4a50b5049c51 100644 ---- a/drivers/mmc/core/core.c -+++ b/drivers/mmc/core/core.c -@@ -329,8 +329,10 @@ EXPORT_SYMBOL(mmc_start_bkops); - */ - static void mmc_wait_data_done(struct mmc_request *mrq) - { -- mrq->host->context_info.is_done_rcv = true; -- wake_up_interruptible(&mrq->host->context_info.wait); -+ struct mmc_context_info *context_info = &mrq->host->context_info; -+ -+ context_info->is_done_rcv = true; -+ wake_up_interruptible(&context_info->wait); - } - - static void mmc_wait_done(struct mmc_request *mrq) -diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c -index 32b0e7055b1e..0697d8f5f3cf 100644 ---- a/drivers/net/bonding/bond_main.c -+++ b/drivers/net/bonding/bond_main.c -@@ -636,6 +636,23 @@ static void bond_set_dev_addr(struct net_device *bond_dev, - call_netdevice_notifiers(NETDEV_CHANGEADDR, bond_dev); - } - -+static struct slave *bond_get_old_active(struct bonding *bond, -+ struct slave *new_active) -+{ -+ struct slave *slave; -+ struct list_head *iter; -+ -+ bond_for_each_slave(bond, slave, iter) { -+ if (slave == new_active) -+ continue; -+ -+ if (ether_addr_equal(bond->dev->dev_addr, slave->dev->dev_addr)) -+ return slave; -+ } -+ -+ return NULL; -+} -+ - /* - * bond_do_fail_over_mac - * -@@ -672,6 +689,9 @@ static void bond_do_fail_over_mac(struct bonding *bond, - - write_unlock_bh(&bond->curr_slave_lock); - -+ if (!old_active) -+ old_active = bond_get_old_active(bond, new_active); -+ - if (old_active) { - memcpy(tmp_mac, new_active->dev->dev_addr, ETH_ALEN); - memcpy(saddr.sa_data, old_active->dev->dev_addr, -@@ -1825,6 +1845,7 @@ static int bond_release_and_destroy(struct net_device *bond_dev, - bond_dev->priv_flags |= IFF_DISABLE_NETPOLL; - pr_info("%s: destroying bond %s.\n", - bond_dev->name, bond_dev->name); -+ bond_remove_proc_entry(bond); - unregister_netdevice(bond_dev); - } - return ret; -diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c -index bc65dc85a622..91e7286ab1e1 100644 ---- a/drivers/net/ethernet/broadcom/tg3.c -+++ b/drivers/net/ethernet/broadcom/tg3.c -@@ -10737,7 +10737,7 @@ static ssize_t tg3_show_temp(struct device *dev, - tg3_ape_scratchpad_read(tp, &temperature, attr->index, - sizeof(temperature)); - spin_unlock_bh(&tp->lock); -- return sprintf(buf, "%u\n", temperature); -+ return sprintf(buf, "%u\n", temperature * 1000); - } - - -diff --git a/drivers/net/ethernet/brocade/bna/bnad.c b/drivers/net/ethernet/brocade/bna/bnad.c -index 669eeb4eb247..f051783f5882 100644 ---- a/drivers/net/ethernet/brocade/bna/bnad.c -+++ b/drivers/net/ethernet/brocade/bna/bnad.c -@@ -674,6 +674,7 @@ bnad_cq_process(struct bnad *bnad, struct bna_ccb *ccb, int budget) - if (!next_cmpl->valid) - break; - } -+ packets++; - - /* TODO: BNA_CQ_EF_LOCAL ? */ - if (unlikely(flags & (BNA_CQ_EF_MAC_ERROR | -@@ -690,7 +691,6 @@ bnad_cq_process(struct bnad *bnad, struct bna_ccb *ccb, int budget) - else - bnad_cq_setup_skb_frags(rcb, skb, sop_ci, nvecs, len); - -- packets++; - rcb->rxq->rx_packets++; - rcb->rxq->rx_bytes += totlen; - ccb->bytes_per_intr += totlen; -diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c -index 8992b38578d5..e8a1baa87c95 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/eq.c -+++ b/drivers/net/ethernet/mellanox/mlx4/eq.c -@@ -557,7 +557,7 @@ static int mlx4_eq_int(struct mlx4_dev *dev, struct mlx4_eq *eq) - mlx4_dbg(dev, "%s: Sending MLX4_PORT_CHANGE_SUBTYPE_DOWN" - " to slave: %d, port:%d\n", - __func__, i, port); -- s_info = &priv->mfunc.master.vf_oper[slave].vport[port].state; -+ s_info = &priv->mfunc.master.vf_oper[i].vport[port].state; - if (IFLA_VF_LINK_STATE_AUTO == s_info->link_state) - mlx4_slave_event(dev, i, eqe); - } else { /* IB port */ -@@ -583,7 +583,7 @@ static int mlx4_eq_int(struct mlx4_dev *dev, struct mlx4_eq *eq) - for (i = 0; i < dev->num_slaves; i++) { - if (i == mlx4_master_func_num(dev)) - continue; -- s_info = &priv->mfunc.master.vf_oper[slave].vport[port].state; -+ s_info = &priv->mfunc.master.vf_oper[i].vport[port].state; - if (IFLA_VF_LINK_STATE_AUTO == s_info->link_state) - mlx4_slave_event(dev, i, eqe); - } -diff --git a/drivers/net/ethernet/stmicro/stmmac/descs.h b/drivers/net/ethernet/stmicro/stmmac/descs.h -index ad3996038018..799c2929c536 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/descs.h -+++ b/drivers/net/ethernet/stmicro/stmmac/descs.h -@@ -158,6 +158,8 @@ struct dma_desc { - u32 buffer2_size:13; - u32 reserved4:3; - } etx; /* -- enhanced -- */ -+ -+ u64 all_flags; - } des01; - unsigned int des2; - unsigned int des3; -diff --git a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c -index 7e6628a91514..59fb7f69841b 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c -+++ b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c -@@ -240,6 +240,7 @@ static int enh_desc_get_rx_status(void *data, struct stmmac_extra_stats *x, - static void enh_desc_init_rx_desc(struct dma_desc *p, int disable_rx_ic, - int mode, int end) - { -+ p->des01.all_flags = 0; - p->des01.erx.own = 1; - p->des01.erx.buffer1_size = BUF_SIZE_8KiB - 1; - -@@ -254,7 +255,7 @@ static void enh_desc_init_rx_desc(struct dma_desc *p, int disable_rx_ic, - - static void enh_desc_init_tx_desc(struct dma_desc *p, int mode, int end) - { -- p->des01.etx.own = 0; -+ p->des01.all_flags = 0; - if (mode == STMMAC_CHAIN_MODE) - ehn_desc_tx_set_on_chain(p, end); - else -diff --git a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c -index 35ad4f427ae2..48c3456445b2 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c -+++ b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c -@@ -123,6 +123,7 @@ static int ndesc_get_rx_status(void *data, struct stmmac_extra_stats *x, - static void ndesc_init_rx_desc(struct dma_desc *p, int disable_rx_ic, int mode, - int end) - { -+ p->des01.all_flags = 0; - p->des01.rx.own = 1; - p->des01.rx.buffer1_size = BUF_SIZE_2KiB - 1; - -@@ -137,7 +138,7 @@ static void ndesc_init_rx_desc(struct dma_desc *p, int disable_rx_ic, int mode, - - static void ndesc_init_tx_desc(struct dma_desc *p, int mode, int end) - { -- p->des01.tx.own = 0; -+ p->des01.all_flags = 0; - if (mode == STMMAC_CHAIN_MODE) - ndesc_tx_set_on_chain(p, end); - else -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -index 8543e1cfd55e..582e0b3cf5ba 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -@@ -1701,7 +1701,7 @@ static int alloc_dma_desc_resources(struct stmmac_priv *priv) - goto err_tx_skbuff; - - if (priv->extend_desc) { -- priv->dma_erx = dma_alloc_coherent(priv->device, rxsize * -+ priv->dma_erx = dma_zalloc_coherent(priv->device, rxsize * - sizeof(struct - dma_extended_desc), - &priv->dma_rx_phy, -@@ -1709,7 +1709,7 @@ static int alloc_dma_desc_resources(struct stmmac_priv *priv) - if (!priv->dma_erx) - goto err_dma; - -- priv->dma_etx = dma_alloc_coherent(priv->device, txsize * -+ priv->dma_etx = dma_zalloc_coherent(priv->device, txsize * - sizeof(struct - dma_extended_desc), - &priv->dma_tx_phy, -@@ -1721,7 +1721,7 @@ static int alloc_dma_desc_resources(struct stmmac_priv *priv) - goto err_dma; - } - } else { -- priv->dma_rx = dma_alloc_coherent(priv->device, rxsize * -+ priv->dma_rx = dma_zalloc_coherent(priv->device, rxsize * - sizeof(struct dma_desc), - &priv->dma_rx_phy, - GFP_KERNEL); -@@ -1730,7 +1730,7 @@ static int alloc_dma_desc_resources(struct stmmac_priv *priv) - memset((char *)priv->dma_rx, 0, rxsize * - sizeof(struct dma_desc)); - -- priv->dma_tx = dma_alloc_coherent(priv->device, txsize * -+ priv->dma_tx = dma_zalloc_coherent(priv->device, txsize * - sizeof(struct dma_desc), - &priv->dma_tx_phy, - GFP_KERNEL); -diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c -index f9e96c427558..23dc1316c1c2 100644 ---- a/drivers/net/usb/usbnet.c -+++ b/drivers/net/usb/usbnet.c -@@ -778,7 +778,7 @@ int usbnet_stop (struct net_device *net) - { - struct usbnet *dev = netdev_priv(net); - struct driver_info *info = dev->driver_info; -- int retval, pm; -+ int retval, pm, mpn; - - clear_bit(EVENT_DEV_OPEN, &dev->flags); - netif_stop_queue (net); -@@ -809,6 +809,8 @@ int usbnet_stop (struct net_device *net) - - usbnet_purge_paused_rxq(dev); - -+ mpn = !test_and_clear_bit(EVENT_NO_RUNTIME_PM, &dev->flags); -+ - /* deferred work (task, timer, softirq) must also stop. - * can't flush_scheduled_work() until we drop rtnl (later), - * else workers could deadlock; so make workers a NOP. -@@ -819,8 +821,7 @@ int usbnet_stop (struct net_device *net) - if (!pm) - usb_autopm_put_interface(dev->intf); - -- if (info->manage_power && -- !test_and_clear_bit(EVENT_NO_RUNTIME_PM, &dev->flags)) -+ if (info->manage_power && mpn) - info->manage_power(dev, 0); - else - usb_autopm_put_interface(dev->intf); -diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c -index 66c92a16da29..a35d1dedeffb 100644 ---- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c -+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c -@@ -314,6 +314,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = { - {RTL_USB_DEVICE(0x07b8, 0x8188, rtl92cu_hal_cfg)}, /*Abocom - Abocom*/ - {RTL_USB_DEVICE(0x07b8, 0x8189, rtl92cu_hal_cfg)}, /*Funai - Abocom*/ - {RTL_USB_DEVICE(0x0846, 0x9041, rtl92cu_hal_cfg)}, /*NetGear WNA1000M*/ -+ {RTL_USB_DEVICE(0x0846, 0x9043, rtl92cu_hal_cfg)}, /*NG WNA1000Mv2*/ - {RTL_USB_DEVICE(0x0b05, 0x17ba, rtl92cu_hal_cfg)}, /*ASUS-Edimax*/ - {RTL_USB_DEVICE(0x0bda, 0x5088, rtl92cu_hal_cfg)}, /*Thinkware-CC&C*/ - {RTL_USB_DEVICE(0x0df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/ -diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c -index ff3c98f1ea95..91cc44611062 100644 ---- a/drivers/xen/gntdev.c -+++ b/drivers/xen/gntdev.c -@@ -67,7 +67,7 @@ struct gntdev_priv { - * Only populated if populate_freeable_maps == 1 */ - struct list_head freeable_maps; - /* lock protects maps and freeable_maps */ -- spinlock_t lock; -+ struct mutex lock; - struct mm_struct *mm; - struct mmu_notifier mn; - }; -@@ -216,9 +216,9 @@ static void gntdev_put_map(struct gntdev_priv *priv, struct grant_map *map) - } - - if (populate_freeable_maps && priv) { -- spin_lock(&priv->lock); -+ mutex_lock(&priv->lock); - list_del(&map->next); -- spin_unlock(&priv->lock); -+ mutex_unlock(&priv->lock); - } - - if (map->pages && !use_ptemod) -@@ -387,9 +387,9 @@ static void gntdev_vma_close(struct vm_area_struct *vma) - * not do any unmapping, since that has been done prior to - * closing the vma, but it may still iterate the unmap_ops list. - */ -- spin_lock(&priv->lock); -+ mutex_lock(&priv->lock); - map->vma = NULL; -- spin_unlock(&priv->lock); -+ mutex_unlock(&priv->lock); - } - vma->vm_private_data = NULL; - gntdev_put_map(priv, map); -@@ -433,14 +433,14 @@ static void mn_invl_range_start(struct mmu_notifier *mn, - struct gntdev_priv *priv = container_of(mn, struct gntdev_priv, mn); - struct grant_map *map; - -- spin_lock(&priv->lock); -+ mutex_lock(&priv->lock); - list_for_each_entry(map, &priv->maps, next) { - unmap_if_in_range(map, start, end); - } - list_for_each_entry(map, &priv->freeable_maps, next) { - unmap_if_in_range(map, start, end); - } -- spin_unlock(&priv->lock); -+ mutex_unlock(&priv->lock); - } - - static void mn_invl_page(struct mmu_notifier *mn, -@@ -457,7 +457,7 @@ static void mn_release(struct mmu_notifier *mn, - struct grant_map *map; - int err; - -- spin_lock(&priv->lock); -+ mutex_lock(&priv->lock); - list_for_each_entry(map, &priv->maps, next) { - if (!map->vma) - continue; -@@ -476,7 +476,7 @@ static void mn_release(struct mmu_notifier *mn, - err = unmap_grant_pages(map, /* offset */ 0, map->count); - WARN_ON(err); - } -- spin_unlock(&priv->lock); -+ mutex_unlock(&priv->lock); - } - - static struct mmu_notifier_ops gntdev_mmu_ops = { -@@ -498,7 +498,7 @@ static int gntdev_open(struct inode *inode, struct file *flip) - - INIT_LIST_HEAD(&priv->maps); - INIT_LIST_HEAD(&priv->freeable_maps); -- spin_lock_init(&priv->lock); -+ mutex_init(&priv->lock); - - if (use_ptemod) { - priv->mm = get_task_mm(current); -@@ -574,10 +574,10 @@ static long gntdev_ioctl_map_grant_ref(struct gntdev_priv *priv, - return -EFAULT; - } - -- spin_lock(&priv->lock); -+ mutex_lock(&priv->lock); - gntdev_add_map(priv, map); - op.index = map->index << PAGE_SHIFT; -- spin_unlock(&priv->lock); -+ mutex_unlock(&priv->lock); - - if (copy_to_user(u, &op, sizeof(op)) != 0) - return -EFAULT; -@@ -596,7 +596,7 @@ static long gntdev_ioctl_unmap_grant_ref(struct gntdev_priv *priv, - return -EFAULT; - pr_debug("priv %p, del %d+%d\n", priv, (int)op.index, (int)op.count); - -- spin_lock(&priv->lock); -+ mutex_lock(&priv->lock); - map = gntdev_find_map_index(priv, op.index >> PAGE_SHIFT, op.count); - if (map) { - list_del(&map->next); -@@ -604,7 +604,7 @@ static long gntdev_ioctl_unmap_grant_ref(struct gntdev_priv *priv, - list_add_tail(&map->next, &priv->freeable_maps); - err = 0; - } -- spin_unlock(&priv->lock); -+ mutex_unlock(&priv->lock); - if (map) - gntdev_put_map(priv, map); - return err; -@@ -672,7 +672,7 @@ static long gntdev_ioctl_notify(struct gntdev_priv *priv, void __user *u) - out_flags = op.action; - out_event = op.event_channel_port; - -- spin_lock(&priv->lock); -+ mutex_lock(&priv->lock); - - list_for_each_entry(map, &priv->maps, next) { - uint64_t begin = map->index << PAGE_SHIFT; -@@ -700,7 +700,7 @@ static long gntdev_ioctl_notify(struct gntdev_priv *priv, void __user *u) - rc = 0; - - unlock_out: -- spin_unlock(&priv->lock); -+ mutex_unlock(&priv->lock); - - /* Drop the reference to the event channel we did not save in the map */ - if (out_flags & UNMAP_NOTIFY_SEND_EVENT) -@@ -750,7 +750,7 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma) - pr_debug("map %d+%d at %lx (pgoff %lx)\n", - index, count, vma->vm_start, vma->vm_pgoff); - -- spin_lock(&priv->lock); -+ mutex_lock(&priv->lock); - map = gntdev_find_map_index(priv, index, count); - if (!map) - goto unlock_out; -@@ -785,7 +785,7 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma) - map->flags |= GNTMAP_readonly; - } - -- spin_unlock(&priv->lock); -+ mutex_unlock(&priv->lock); - - if (use_ptemod) { - err = apply_to_page_range(vma->vm_mm, vma->vm_start, -@@ -813,11 +813,11 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma) - return 0; - - unlock_out: -- spin_unlock(&priv->lock); -+ mutex_unlock(&priv->lock); - return err; - - out_unlock_put: -- spin_unlock(&priv->lock); -+ mutex_unlock(&priv->lock); - out_put_map: - if (use_ptemod) - map->vma = NULL; -diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c -index a0b65a01fed7..86f86823a5f4 100644 ---- a/fs/btrfs/transaction.c -+++ b/fs/btrfs/transaction.c -@@ -1710,8 +1710,11 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans, - spin_unlock(&root->fs_info->trans_lock); - - wait_for_commit(root, prev_trans); -+ ret = prev_trans->aborted; - - btrfs_put_transaction(prev_trans); -+ if (ret) -+ goto cleanup_transaction; - } else { - spin_unlock(&root->fs_info->trans_lock); - } -diff --git a/fs/cifs/ioctl.c b/fs/cifs/ioctl.c -index dfc95646b88c..31df9bceedca 100644 ---- a/fs/cifs/ioctl.c -+++ b/fs/cifs/ioctl.c -@@ -67,6 +67,12 @@ static long cifs_ioctl_clone(unsigned int xid, struct file *dst_file, - goto out_drop_write; - } - -+ if (src_file.file->f_op->unlocked_ioctl != cifs_ioctl) { -+ rc = -EBADF; -+ cifs_dbg(VFS, "src file seems to be from a different filesystem type\n"); -+ goto out_fput; -+ } -+ - if ((!src_file.file->private_data) || (!dst_file->private_data)) { - rc = -EBADF; - cifs_dbg(VFS, "missing cifsFileInfo on copy range src file\n"); -diff --git a/fs/coredump.c b/fs/coredump.c -index a93f7e6ea4cf..72f97a56966f 100644 ---- a/fs/coredump.c -+++ b/fs/coredump.c -@@ -498,10 +498,10 @@ void do_coredump(const siginfo_t *siginfo) - const struct cred *old_cred; - struct cred *cred; - int retval = 0; -- int flag = 0; - int ispipe; - struct files_struct *displaced; -- bool need_nonrelative = false; -+ /* require nonrelative corefile path and be extra careful */ -+ bool need_suid_safe = false; - bool core_dumped = false; - static atomic_t core_dump_count = ATOMIC_INIT(0); - struct coredump_params cprm = { -@@ -535,9 +535,8 @@ void do_coredump(const siginfo_t *siginfo) - */ - if (__get_dumpable(cprm.mm_flags) == SUID_DUMP_ROOT) { - /* Setuid core dump mode */ -- flag = O_EXCL; /* Stop rewrite attacks */ - cred->fsuid = GLOBAL_ROOT_UID; /* Dump root private */ -- need_nonrelative = true; -+ need_suid_safe = true; - } - - retval = coredump_wait(siginfo->si_signo, &core_state); -@@ -618,7 +617,7 @@ void do_coredump(const siginfo_t *siginfo) - if (cprm.limit < binfmt->min_coredump) - goto fail_unlock; - -- if (need_nonrelative && cn.corename[0] != '/') { -+ if (need_suid_safe && cn.corename[0] != '/') { - printk(KERN_WARNING "Pid %d(%s) can only dump core "\ - "to fully qualified path!\n", - task_tgid_vnr(current), current->comm); -@@ -626,8 +625,35 @@ void do_coredump(const siginfo_t *siginfo) - goto fail_unlock; - } - -+ /* -+ * Unlink the file if it exists unless this is a SUID -+ * binary - in that case, we're running around with root -+ * privs and don't want to unlink another user's coredump. -+ */ -+ if (!need_suid_safe) { -+ mm_segment_t old_fs; -+ -+ old_fs = get_fs(); -+ set_fs(KERNEL_DS); -+ /* -+ * If it doesn't exist, that's fine. If there's some -+ * other problem, we'll catch it at the filp_open(). -+ */ -+ (void) sys_unlink((const char __user *)cn.corename); -+ set_fs(old_fs); -+ } -+ -+ /* -+ * There is a race between unlinking and creating the -+ * file, but if that causes an EEXIST here, that's -+ * fine - another process raced with us while creating -+ * the corefile, and the other process won. To userspace, -+ * what matters is that at least one of the two processes -+ * writes its coredump successfully, not which one. -+ */ - cprm.file = filp_open(cn.corename, -- O_CREAT | 2 | O_NOFOLLOW | O_LARGEFILE | flag, -+ O_CREAT | 2 | O_NOFOLLOW | -+ O_LARGEFILE | O_EXCL, - 0600); - if (IS_ERR(cprm.file)) - goto fail_unlock; -diff --git a/fs/hfs/bnode.c b/fs/hfs/bnode.c -index d3fa6bd9503e..221719eac5de 100644 ---- a/fs/hfs/bnode.c -+++ b/fs/hfs/bnode.c -@@ -288,7 +288,6 @@ static struct hfs_bnode *__hfs_bnode_create(struct hfs_btree *tree, u32 cnid) - page_cache_release(page); - goto fail; - } -- page_cache_release(page); - node->page[i] = page; - } - -@@ -398,11 +397,11 @@ node_error: - - void hfs_bnode_free(struct hfs_bnode *node) - { -- //int i; -+ int i; - -- //for (i = 0; i < node->tree->pages_per_bnode; i++) -- // if (node->page[i]) -- // page_cache_release(node->page[i]); -+ for (i = 0; i < node->tree->pages_per_bnode; i++) -+ if (node->page[i]) -+ page_cache_release(node->page[i]); - kfree(node); - } - -diff --git a/fs/hfs/brec.c b/fs/hfs/brec.c -index 9f4ee7f52026..6fc766df0461 100644 ---- a/fs/hfs/brec.c -+++ b/fs/hfs/brec.c -@@ -131,13 +131,16 @@ skip: - hfs_bnode_write(node, entry, data_off + key_len, entry_len); - hfs_bnode_dump(node); - -- if (new_node) { -- /* update parent key if we inserted a key -- * at the start of the first node -- */ -- if (!rec && new_node != node) -- hfs_brec_update_parent(fd); -+ /* -+ * update parent key if we inserted a key -+ * at the start of the node and it is not the new node -+ */ -+ if (!rec && new_node != node) { -+ hfs_bnode_read_key(node, fd->search_key, data_off + size); -+ hfs_brec_update_parent(fd); -+ } - -+ if (new_node) { - hfs_bnode_put(fd->bnode); - if (!new_node->parent) { - hfs_btree_inc_height(tree); -@@ -166,9 +169,6 @@ skip: - goto again; - } - -- if (!rec) -- hfs_brec_update_parent(fd); -- - return 0; - } - -@@ -366,6 +366,8 @@ again: - if (IS_ERR(parent)) - return PTR_ERR(parent); - __hfs_brec_find(parent, fd); -+ if (fd->record < 0) -+ return -ENOENT; - hfs_bnode_dump(parent); - rec = fd->record; - -diff --git a/fs/hfsplus/bnode.c b/fs/hfsplus/bnode.c -index 11c860204520..bedfe5f7d332 100644 ---- a/fs/hfsplus/bnode.c -+++ b/fs/hfsplus/bnode.c -@@ -456,7 +456,6 @@ static struct hfs_bnode *__hfs_bnode_create(struct hfs_btree *tree, u32 cnid) - page_cache_release(page); - goto fail; - } -- page_cache_release(page); - node->page[i] = page; - } - -@@ -568,13 +567,11 @@ node_error: - - void hfs_bnode_free(struct hfs_bnode *node) - { --#if 0 - int i; - - for (i = 0; i < node->tree->pages_per_bnode; i++) - if (node->page[i]) - page_cache_release(node->page[i]); --#endif - kfree(node); - } - -diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c -index 58258ad50d5f..7b945957e230 100644 ---- a/fs/nfs/nfs4proc.c -+++ b/fs/nfs/nfs4proc.c -@@ -2275,7 +2275,7 @@ static int _nfs4_do_open(struct inode *dir, - goto err_free_label; - state = ctx->state; - -- if ((opendata->o_arg.open_flags & O_EXCL) && -+ if ((opendata->o_arg.open_flags & (O_CREAT|O_EXCL)) == (O_CREAT|O_EXCL) && - (opendata->o_arg.createmode != NFS4_CREATE_GUARDED)) { - nfs4_exclusive_attrset(opendata, sattr); - -@@ -8368,6 +8368,7 @@ static const struct nfs4_minor_version_ops nfs_v4_2_minor_ops = { - .reboot_recovery_ops = &nfs41_reboot_recovery_ops, - .nograce_recovery_ops = &nfs41_nograce_recovery_ops, - .state_renewal_ops = &nfs41_state_renewal_ops, -+ .mig_recovery_ops = &nfs41_mig_recovery_ops, - }; - #endif - -diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c -index 27d7f2742592..11763ce73709 100644 ---- a/fs/nfs/pagelist.c -+++ b/fs/nfs/pagelist.c -@@ -60,8 +60,8 @@ EXPORT_SYMBOL_GPL(nfs_pgheader_init); - void nfs_set_pgio_error(struct nfs_pgio_header *hdr, int error, loff_t pos) - { - spin_lock(&hdr->lock); -- if (pos < hdr->io_start + hdr->good_bytes) { -- set_bit(NFS_IOHDR_ERROR, &hdr->flags); -+ if (!test_and_set_bit(NFS_IOHDR_ERROR, &hdr->flags) -+ || pos < hdr->io_start + hdr->good_bytes) { - clear_bit(NFS_IOHDR_EOF, &hdr->flags); - hdr->good_bytes = pos - hdr->io_start; - hdr->error = error; -diff --git a/fs/udf/inode.c b/fs/udf/inode.c -index 287cd5f23421..142d29e3ccdf 100644 ---- a/fs/udf/inode.c -+++ b/fs/udf/inode.c -@@ -1496,6 +1496,22 @@ static void udf_fill_inode(struct inode *inode, struct buffer_head *bh) - iinfo->i_checkpoint = le32_to_cpu(efe->checkpoint); - } - -+ /* -+ * Sanity check length of allocation descriptors and extended attrs to -+ * avoid integer overflows -+ */ -+ if (iinfo->i_lenEAttr > inode->i_sb->s_blocksize -+ || iinfo->i_lenAlloc > inode->i_sb->s_blocksize) { -+ make_bad_inode(inode); -+ return; -+ } -+ /* Now do exact checks */ -+ if (udf_file_entry_alloc_offset(inode) -+ + iinfo->i_lenAlloc > inode->i_sb->s_blocksize) { -+ make_bad_inode(inode); -+ return; -+ } -+ - switch (fe->icbTag.fileType) { - case ICBTAG_FILE_TYPE_DIRECTORY: - inode->i_op = &udf_dir_inode_operations; -diff --git a/include/net/ip.h b/include/net/ip.h -index 5128fa7a8302..476bab2d28b0 100644 ---- a/include/net/ip.h -+++ b/include/net/ip.h -@@ -154,6 +154,7 @@ static inline __u8 get_rtconn_flags(struct ipcm_cookie* ipc, struct sock* sk) - } - - /* datagram.c */ -+int __ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len); - int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len); - - void ip4_datagram_release_cb(struct sock *sk); -diff --git a/kernel/fork.c b/kernel/fork.c -index e2c685396295..1394fb3476d0 100644 ---- a/kernel/fork.c -+++ b/kernel/fork.c -@@ -1756,13 +1756,21 @@ static int check_unshare_flags(unsigned long unshare_flags) - CLONE_NEWUSER|CLONE_NEWPID)) - return -EINVAL; - /* -- * Not implemented, but pretend it works if there is nothing to -- * unshare. Note that unsharing CLONE_THREAD or CLONE_SIGHAND -- * needs to unshare vm. -+ * Not implemented, but pretend it works if there is nothing -+ * to unshare. Note that unsharing the address space or the -+ * signal handlers also need to unshare the signal queues (aka -+ * CLONE_THREAD). - */ - if (unshare_flags & (CLONE_THREAD | CLONE_SIGHAND | CLONE_VM)) { -- /* FIXME: get_task_mm() increments ->mm_users */ -- if (atomic_read(¤t->mm->mm_users) > 1) -+ if (!thread_group_empty(current)) -+ return -EINVAL; -+ } -+ if (unshare_flags & (CLONE_SIGHAND | CLONE_VM)) { -+ if (atomic_read(¤t->sighand->count) > 1) -+ return -EINVAL; -+ } -+ if (unshare_flags & CLONE_VM) { -+ if (!current_is_single_threaded()) - return -EINVAL; - } - -@@ -1831,16 +1839,16 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags) - if (unshare_flags & CLONE_NEWUSER) - unshare_flags |= CLONE_THREAD | CLONE_FS; - /* -- * If unsharing a thread from a thread group, must also unshare vm. -- */ -- if (unshare_flags & CLONE_THREAD) -- unshare_flags |= CLONE_VM; -- /* - * If unsharing vm, must also unshare signal handlers. - */ - if (unshare_flags & CLONE_VM) - unshare_flags |= CLONE_SIGHAND; - /* -+ * If unsharing a signal handlers, must also unshare the signal queues. -+ */ -+ if (unshare_flags & CLONE_SIGHAND) -+ unshare_flags |= CLONE_THREAD; -+ /* - * If unsharing namespace, must also unshare filesystem information. - */ - if (unshare_flags & CLONE_NEWNS) -diff --git a/mm/vmscan.c b/mm/vmscan.c -index 88edf53748ee..57af138d26a2 100644 ---- a/mm/vmscan.c -+++ b/mm/vmscan.c -@@ -1087,7 +1087,7 @@ cull_mlocked: - if (PageSwapCache(page)) - try_to_free_swap(page); - unlock_page(page); -- putback_lru_page(page); -+ list_add(&page->lru, &ret_pages); - continue; - - activate_locked: -diff --git a/net/bridge/br_mdb.c b/net/bridge/br_mdb.c -index b7b1914dfa25..27cf128ebc15 100644 ---- a/net/bridge/br_mdb.c -+++ b/net/bridge/br_mdb.c -@@ -347,7 +347,6 @@ static int br_mdb_add_group(struct net_bridge *br, struct net_bridge_port *port, - return -ENOMEM; - rcu_assign_pointer(*pp, p); - -- br_mdb_notify(br->dev, port, group, RTM_NEWMDB); - return 0; - } - -@@ -370,6 +369,7 @@ static int __br_mdb_add(struct net *net, struct net_bridge *br, - if (!p || p->br != br || p->state == BR_STATE_DISABLED) - return -EINVAL; - -+ memset(&ip, 0, sizeof(ip)); - ip.proto = entry->addr.proto; - if (ip.proto == htons(ETH_P_IP)) - ip.u.ip4 = entry->addr.u.ip4; -@@ -416,6 +416,7 @@ static int __br_mdb_del(struct net_bridge *br, struct br_mdb_entry *entry) - if (!netif_running(br->dev) || br->multicast_disabled) - return -EINVAL; - -+ memset(&ip, 0, sizeof(ip)); - ip.proto = entry->addr.proto; - if (ip.proto == htons(ETH_P_IP)) { - if (timer_pending(&br->ip4_querier.timer)) -diff --git a/net/core/datagram.c b/net/core/datagram.c -index a16ed7bbe376..13bc7dad7990 100644 ---- a/net/core/datagram.c -+++ b/net/core/datagram.c -@@ -130,6 +130,35 @@ out_noerr: - goto out; - } - -+static struct sk_buff *skb_set_peeked(struct sk_buff *skb) -+{ -+ struct sk_buff *nskb; -+ -+ if (skb->peeked) -+ return skb; -+ -+ /* We have to unshare an skb before modifying it. */ -+ if (!skb_shared(skb)) -+ goto done; -+ -+ nskb = skb_clone(skb, GFP_ATOMIC); -+ if (!nskb) -+ return ERR_PTR(-ENOMEM); -+ -+ skb->prev->next = nskb; -+ skb->next->prev = nskb; -+ nskb->prev = skb->prev; -+ nskb->next = skb->next; -+ -+ consume_skb(skb); -+ skb = nskb; -+ -+done: -+ skb->peeked = 1; -+ -+ return skb; -+} -+ - /** - * __skb_recv_datagram - Receive a datagram skbuff - * @sk: socket -@@ -164,7 +193,9 @@ out_noerr: - struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags, - int *peeked, int *off, int *err) - { -+ struct sk_buff_head *queue = &sk->sk_receive_queue; - struct sk_buff *skb, *last; -+ unsigned long cpu_flags; - long timeo; - /* - * Caller is allowed not to check sk->sk_err before skb_recv_datagram() -@@ -183,8 +214,6 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags, - * Look at current nfs client by the way... - * However, this function was correct in any case. 8) - */ -- unsigned long cpu_flags; -- struct sk_buff_head *queue = &sk->sk_receive_queue; - int _off = *off; - - last = (struct sk_buff *)queue; -@@ -198,7 +227,12 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags, - _off -= skb->len; - continue; - } -- skb->peeked = 1; -+ -+ skb = skb_set_peeked(skb); -+ error = PTR_ERR(skb); -+ if (IS_ERR(skb)) -+ goto unlock_err; -+ - atomic_inc(&skb->users); - } else - __skb_unlink(skb, queue); -@@ -222,6 +256,8 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags, - - return NULL; - -+unlock_err: -+ spin_unlock_irqrestore(&queue->lock, cpu_flags); - no_packet: - *err = error; - return NULL; -@@ -742,7 +778,8 @@ __sum16 __skb_checksum_complete_head(struct sk_buff *skb, int len) - if (likely(!sum)) { - if (unlikely(skb->ip_summed == CHECKSUM_COMPLETE)) - netdev_rx_csum_fault(skb->dev); -- skb->ip_summed = CHECKSUM_UNNECESSARY; -+ if (!skb_shared(skb)) -+ skb->ip_summed = CHECKSUM_UNNECESSARY; - } - return sum; - } -diff --git a/net/core/dev.c b/net/core/dev.c -index 1b9e700c85b6..ae3260fc133d 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -3214,6 +3214,8 @@ static int enqueue_to_backlog(struct sk_buff *skb, int cpu, - local_irq_save(flags); - - rps_lock(sd); -+ if (!netif_running(skb->dev)) -+ goto drop; - qlen = skb_queue_len(&sd->input_pkt_queue); - if (qlen <= netdev_max_backlog && !skb_flow_limit(skb, qlen)) { - if (skb_queue_len(&sd->input_pkt_queue)) { -@@ -3235,6 +3237,7 @@ enqueue: - goto enqueue; - } - -+drop: - sd->dropped++; - rps_unlock(sd); - -@@ -3551,8 +3554,6 @@ static int __netif_receive_skb_core(struct sk_buff *skb, bool pfmemalloc) - - pt_prev = NULL; - -- rcu_read_lock(); -- - another_round: - skb->skb_iif = skb->dev->ifindex; - -@@ -3562,7 +3563,7 @@ another_round: - skb->protocol == cpu_to_be16(ETH_P_8021AD)) { - skb = skb_vlan_untag(skb); - if (unlikely(!skb)) -- goto unlock; -+ goto out; - } - - #ifdef CONFIG_NET_CLS_ACT -@@ -3587,7 +3588,7 @@ skip_taps: - #ifdef CONFIG_NET_CLS_ACT - skb = handle_ing(skb, &pt_prev, &ret, orig_dev); - if (!skb) -- goto unlock; -+ goto out; - ncls: - #endif - -@@ -3602,7 +3603,7 @@ ncls: - if (vlan_do_receive(&skb)) - goto another_round; - else if (unlikely(!skb)) -- goto unlock; -+ goto out; - } - - rx_handler = rcu_dereference(skb->dev->rx_handler); -@@ -3614,7 +3615,7 @@ ncls: - switch (rx_handler(&skb)) { - case RX_HANDLER_CONSUMED: - ret = NET_RX_SUCCESS; -- goto unlock; -+ goto out; - case RX_HANDLER_ANOTHER: - goto another_round; - case RX_HANDLER_EXACT: -@@ -3666,8 +3667,6 @@ drop: - ret = NET_RX_DROP; - } - --unlock: -- rcu_read_unlock(); - out: - return ret; - } -@@ -3699,29 +3698,30 @@ static int __netif_receive_skb(struct sk_buff *skb) - - static int netif_receive_skb_internal(struct sk_buff *skb) - { -+ int ret; -+ - net_timestamp_check(netdev_tstamp_prequeue, skb); - - if (skb_defer_rx_timestamp(skb)) - return NET_RX_SUCCESS; - -+ rcu_read_lock(); -+ - #ifdef CONFIG_RPS - if (static_key_false(&rps_needed)) { - struct rps_dev_flow voidflow, *rflow = &voidflow; -- int cpu, ret; -- -- rcu_read_lock(); -- -- cpu = get_rps_cpu(skb->dev, skb, &rflow); -+ int cpu = get_rps_cpu(skb->dev, skb, &rflow); - - if (cpu >= 0) { - ret = enqueue_to_backlog(skb, cpu, &rflow->last_qtail); - rcu_read_unlock(); - return ret; - } -- rcu_read_unlock(); - } - #endif -- return __netif_receive_skb(skb); -+ ret = __netif_receive_skb(skb); -+ rcu_read_unlock(); -+ return ret; - } - - /** -@@ -4182,8 +4182,10 @@ static int process_backlog(struct napi_struct *napi, int quota) - unsigned int qlen; - - while ((skb = __skb_dequeue(&sd->process_queue))) { -+ rcu_read_lock(); - local_irq_enable(); - __netif_receive_skb(skb); -+ rcu_read_unlock(); - local_irq_disable(); - input_queue_head_incr(sd); - if (++work >= quota) { -@@ -5694,6 +5696,7 @@ static void rollback_registered_many(struct list_head *head) - unlist_netdevice(dev); - - dev->reg_state = NETREG_UNREGISTERING; -+ on_each_cpu(flush_backlog, dev, 1); - } - - synchronize_net(); -@@ -5951,7 +5954,8 @@ static int netif_alloc_netdev_queues(struct net_device *dev) - struct netdev_queue *tx; - size_t sz = count * sizeof(*tx); - -- BUG_ON(count < 1 || count > 0xffff); -+ if (count < 1 || count > 0xffff) -+ return -EINVAL; - - tx = kzalloc(sz, GFP_KERNEL | __GFP_NOWARN | __GFP_REPEAT); - if (!tx) { -@@ -6309,8 +6313,6 @@ void netdev_run_todo(void) - - dev->reg_state = NETREG_UNREGISTERED; - -- on_each_cpu(flush_backlog, dev, 1); -- - netdev_wait_allrefs(dev); - - /* paranoia */ -diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c -index 185c341fafbd..aeedc3a961a1 100644 ---- a/net/core/fib_rules.c -+++ b/net/core/fib_rules.c -@@ -621,15 +621,17 @@ static int dump_rules(struct sk_buff *skb, struct netlink_callback *cb, - { - int idx = 0; - struct fib_rule *rule; -+ int err = 0; - - rcu_read_lock(); - list_for_each_entry_rcu(rule, &ops->rules_list, list) { - if (idx < cb->args[1]) - goto skip; - -- if (fib_nl_fill_rule(skb, rule, NETLINK_CB(cb->skb).portid, -- cb->nlh->nlmsg_seq, RTM_NEWRULE, -- NLM_F_MULTI, ops) < 0) -+ err = fib_nl_fill_rule(skb, rule, NETLINK_CB(cb->skb).portid, -+ cb->nlh->nlmsg_seq, RTM_NEWRULE, -+ NLM_F_MULTI, ops); -+ if (err) - break; - skip: - idx++; -@@ -638,7 +640,7 @@ skip: - cb->args[1] = idx; - rules_ops_put(ops); - -- return skb->len; -+ return err; - } - - static int fib_nl_dumprule(struct sk_buff *skb, struct netlink_callback *cb) -@@ -654,7 +656,9 @@ static int fib_nl_dumprule(struct sk_buff *skb, struct netlink_callback *cb) - if (ops == NULL) - return -EAFNOSUPPORT; - -- return dump_rules(skb, cb, ops); -+ dump_rules(skb, cb, ops); -+ -+ return skb->len; - } - - rcu_read_lock(); -diff --git a/net/core/pktgen.c b/net/core/pktgen.c -index ca68d32b49ba..dbd797a62b3a 100644 ---- a/net/core/pktgen.c -+++ b/net/core/pktgen.c -@@ -3464,8 +3464,10 @@ static int pktgen_thread_worker(void *arg) - pktgen_rem_thread(t); - - /* Wait for kthread_stop */ -- while (!kthread_should_stop()) { -+ for (;;) { - set_current_state(TASK_INTERRUPTIBLE); -+ if (kthread_should_stop()) -+ break; - schedule(); - } - __set_current_state(TASK_RUNNING); -diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c -index 8aadd6a072a4..465092f8fb76 100644 ---- a/net/core/rtnetlink.c -+++ b/net/core/rtnetlink.c -@@ -1259,10 +1259,6 @@ static const struct nla_policy ifla_info_policy[IFLA_INFO_MAX+1] = { - [IFLA_INFO_SLAVE_DATA] = { .type = NLA_NESTED }, - }; - --static const struct nla_policy ifla_vfinfo_policy[IFLA_VF_INFO_MAX+1] = { -- [IFLA_VF_INFO] = { .type = NLA_NESTED }, --}; -- - static const struct nla_policy ifla_vf_policy[IFLA_VF_MAX+1] = { - [IFLA_VF_MAC] = { .len = sizeof(struct ifla_vf_mac) }, - [IFLA_VF_VLAN] = { .len = sizeof(struct ifla_vf_vlan) }, -@@ -1336,67 +1332,66 @@ static int validate_linkmsg(struct net_device *dev, struct nlattr *tb[]) - return 0; - } - --static int do_setvfinfo(struct net_device *dev, struct nlattr *attr) -+static int do_setvfinfo(struct net_device *dev, struct nlattr **tb) - { -- int rem, err = -EINVAL; -- struct nlattr *vf; - const struct net_device_ops *ops = dev->netdev_ops; -+ int err = -EINVAL; - -- nla_for_each_nested(vf, attr, rem) { -- switch (nla_type(vf)) { -- case IFLA_VF_MAC: { -- struct ifla_vf_mac *ivm; -- ivm = nla_data(vf); -- err = -EOPNOTSUPP; -- if (ops->ndo_set_vf_mac) -- err = ops->ndo_set_vf_mac(dev, ivm->vf, -- ivm->mac); -- break; -- } -- case IFLA_VF_VLAN: { -- struct ifla_vf_vlan *ivv; -- ivv = nla_data(vf); -- err = -EOPNOTSUPP; -- if (ops->ndo_set_vf_vlan) -- err = ops->ndo_set_vf_vlan(dev, ivv->vf, -- ivv->vlan, -- ivv->qos); -- break; -- } -- case IFLA_VF_TX_RATE: { -- struct ifla_vf_tx_rate *ivt; -- ivt = nla_data(vf); -- err = -EOPNOTSUPP; -- if (ops->ndo_set_vf_tx_rate) -- err = ops->ndo_set_vf_tx_rate(dev, ivt->vf, -- ivt->rate); -- break; -- } -- case IFLA_VF_SPOOFCHK: { -- struct ifla_vf_spoofchk *ivs; -- ivs = nla_data(vf); -- err = -EOPNOTSUPP; -- if (ops->ndo_set_vf_spoofchk) -- err = ops->ndo_set_vf_spoofchk(dev, ivs->vf, -- ivs->setting); -- break; -- } -- case IFLA_VF_LINK_STATE: { -- struct ifla_vf_link_state *ivl; -- ivl = nla_data(vf); -- err = -EOPNOTSUPP; -- if (ops->ndo_set_vf_link_state) -- err = ops->ndo_set_vf_link_state(dev, ivl->vf, -- ivl->link_state); -- break; -- } -- default: -- err = -EINVAL; -- break; -- } -- if (err) -- break; -+ if (tb[IFLA_VF_MAC]) { -+ struct ifla_vf_mac *ivm = nla_data(tb[IFLA_VF_MAC]); -+ -+ err = -EOPNOTSUPP; -+ if (ops->ndo_set_vf_mac) -+ err = ops->ndo_set_vf_mac(dev, ivm->vf, -+ ivm->mac); -+ if (err < 0) -+ return err; -+ } -+ -+ if (tb[IFLA_VF_VLAN]) { -+ struct ifla_vf_vlan *ivv = nla_data(tb[IFLA_VF_VLAN]); -+ -+ err = -EOPNOTSUPP; -+ if (ops->ndo_set_vf_vlan) -+ err = ops->ndo_set_vf_vlan(dev, ivv->vf, ivv->vlan, -+ ivv->qos); -+ if (err < 0) -+ return err; -+ } -+ -+ if (tb[IFLA_VF_TX_RATE]) { -+ struct ifla_vf_tx_rate *ivt = nla_data(tb[IFLA_VF_TX_RATE]); -+ -+ err = -EOPNOTSUPP; -+ if (ops->ndo_set_vf_tx_rate) -+ err = ops->ndo_set_vf_tx_rate(dev, ivt->vf, -+ ivt->rate); -+ if (err < 0) -+ return err; - } -+ -+ if (tb[IFLA_VF_SPOOFCHK]) { -+ struct ifla_vf_spoofchk *ivs = nla_data(tb[IFLA_VF_SPOOFCHK]); -+ -+ err = -EOPNOTSUPP; -+ if (ops->ndo_set_vf_spoofchk) -+ err = ops->ndo_set_vf_spoofchk(dev, ivs->vf, -+ ivs->setting); -+ if (err < 0) -+ return err; -+ } -+ -+ if (tb[IFLA_VF_LINK_STATE]) { -+ struct ifla_vf_link_state *ivl = nla_data(tb[IFLA_VF_LINK_STATE]); -+ -+ err = -EOPNOTSUPP; -+ if (ops->ndo_set_vf_link_state) -+ err = ops->ndo_set_vf_link_state(dev, ivl->vf, -+ ivl->link_state); -+ if (err < 0) -+ return err; -+ } -+ - return err; - } - -@@ -1579,14 +1574,21 @@ static int do_setlink(const struct sk_buff *skb, - } - - if (tb[IFLA_VFINFO_LIST]) { -+ struct nlattr *vfinfo[IFLA_VF_MAX + 1]; - struct nlattr *attr; - int rem; -+ - nla_for_each_nested(attr, tb[IFLA_VFINFO_LIST], rem) { -- if (nla_type(attr) != IFLA_VF_INFO) { -+ if (nla_type(attr) != IFLA_VF_INFO || -+ nla_len(attr) < NLA_HDRLEN) { - err = -EINVAL; - goto errout; - } -- err = do_setvfinfo(dev, attr); -+ err = nla_parse_nested(vfinfo, IFLA_VF_MAX, attr, -+ ifla_vf_policy); -+ if (err < 0) -+ goto errout; -+ err = do_setvfinfo(dev, vfinfo); - if (err < 0) - goto errout; - modified = 1; -diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c -index 951fe55b1671..f4c804dbd3b4 100644 ---- a/net/ipv4/af_inet.c -+++ b/net/ipv4/af_inet.c -@@ -1291,7 +1291,7 @@ static struct sk_buff *inet_gso_segment(struct sk_buff *skb, - - encap = SKB_GSO_CB(skb)->encap_level > 0; - if (encap) -- features = skb->dev->hw_enc_features & netif_skb_features(skb); -+ features &= skb->dev->hw_enc_features; - SKB_GSO_CB(skb)->encap_level += ihl; - - skb_reset_transport_header(skb); -diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c -index a3095fdefbed..f0c307cb6196 100644 ---- a/net/ipv4/datagram.c -+++ b/net/ipv4/datagram.c -@@ -20,7 +20,7 @@ - #include - #include - --int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) -+int __ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) - { - struct inet_sock *inet = inet_sk(sk); - struct sockaddr_in *usin = (struct sockaddr_in *) uaddr; -@@ -39,8 +39,6 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) - - sk_dst_reset(sk); - -- lock_sock(sk); -- - oif = sk->sk_bound_dev_if; - saddr = inet->inet_saddr; - if (ipv4_is_multicast(usin->sin_addr.s_addr)) { -@@ -81,9 +79,19 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) - sk_dst_set(sk, &rt->dst); - err = 0; - out: -- release_sock(sk); - return err; - } -+EXPORT_SYMBOL(__ip4_datagram_connect); -+ -+int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) -+{ -+ int res; -+ -+ lock_sock(sk); -+ res = __ip4_datagram_connect(sk, uaddr, addr_len); -+ release_sock(sk); -+ return res; -+} - EXPORT_SYMBOL(ip4_datagram_connect); - - /* Because UDP xmit path can manipulate sk_dst_cache without holding -diff --git a/net/ipv4/gre_offload.c b/net/ipv4/gre_offload.c -index 278836f1a5ad..0da513e7730a 100644 ---- a/net/ipv4/gre_offload.c -+++ b/net/ipv4/gre_offload.c -@@ -69,7 +69,7 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb, - skb->mac_len = skb_inner_network_offset(skb); - - /* segment inner packet. */ -- enc_features = skb->dev->hw_enc_features & netif_skb_features(skb); -+ enc_features = skb->dev->hw_enc_features & features; - segs = skb_mac_gso_segment(skb, enc_features); - if (!segs || IS_ERR(segs)) { - skb_gso_error_unwind(skb, protocol, ghl, mac_offset, mac_len); -diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c -index 9ff497d17545..3f3a424ef0d5 100644 ---- a/net/ipv4/ip_fragment.c -+++ b/net/ipv4/ip_fragment.c -@@ -357,7 +357,7 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb) - ihl = ip_hdrlen(skb); - - /* Determine the position of this fragment. */ -- end = offset + skb->len - ihl; -+ end = offset + skb->len - skb_network_offset(skb) - ihl; - err = -EINVAL; - - /* Is this the final fragment? */ -@@ -387,7 +387,7 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb) - goto err; - - err = -ENOMEM; -- if (pskb_pull(skb, ihl) == NULL) -+ if (!pskb_pull(skb, skb_network_offset(skb) + ihl)) - goto err; - - err = pskb_trim_rcsum(skb, end - offset); -@@ -628,6 +628,9 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev, - iph->frag_off = qp->q.max_size ? htons(IP_DF) : 0; - iph->tot_len = htons(len); - iph->tos |= ecn; -+ -+ ip_send_check(iph); -+ - IP_INC_STATS_BH(net, IPSTATS_MIB_REASMOKS); - qp->q.fragments = NULL; - qp->q.fragments_tail = NULL; -diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c -index 0a4af0920af3..2d4be69c64f4 100644 ---- a/net/ipv4/ip_tunnel.c -+++ b/net/ipv4/ip_tunnel.c -@@ -484,7 +484,8 @@ drop: - EXPORT_SYMBOL_GPL(ip_tunnel_rcv); - - static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb, -- struct rtable *rt, __be16 df) -+ struct rtable *rt, __be16 df, -+ const struct iphdr *inner_iph) - { - struct ip_tunnel *tunnel = netdev_priv(dev); - int pkt_size = skb->len - tunnel->hlen - dev->hard_header_len; -@@ -501,7 +502,8 @@ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb, - - if (skb->protocol == htons(ETH_P_IP)) { - if (!skb_is_gso(skb) && -- (df & htons(IP_DF)) && mtu < pkt_size) { -+ (inner_iph->frag_off & htons(IP_DF)) && -+ mtu < pkt_size) { - memset(IPCB(skb), 0, sizeof(*IPCB(skb))); - icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu)); - return -E2BIG; -@@ -632,7 +634,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, - goto tx_error; - } - -- if (tnl_update_pmtu(dev, skb, rt, tnl_params->frag_off)) { -+ if (tnl_update_pmtu(dev, skb, rt, tnl_params->frag_off, inner_iph)) { - ip_rt_put(rt); - goto tx_error; - } -diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c -index 21a3a9e90b10..6970e36ad7b8 100644 ---- a/net/ipv4/udp.c -+++ b/net/ipv4/udp.c -@@ -1957,12 +1957,19 @@ void udp_v4_early_demux(struct sk_buff *skb) - - skb->sk = sk; - skb->destructor = sock_edemux; -- dst = sk->sk_rx_dst; -+ dst = ACCESS_ONCE(sk->sk_rx_dst); - - if (dst) - dst = dst_check(dst, 0); -- if (dst) -- skb_dst_set_noref(skb, dst); -+ if (dst) { -+ /* DST_NOCACHE can not be used without taking a reference */ -+ if (dst->flags & DST_NOCACHE) { -+ if (likely(atomic_inc_not_zero(&dst->__refcnt))) -+ skb_dst_set(skb, dst); -+ } else { -+ skb_dst_set_noref(skb, dst); -+ } -+ } - } - - int udp_rcv(struct sk_buff *skb) -@@ -2510,7 +2517,7 @@ struct sk_buff *skb_udp_tunnel_segment(struct sk_buff *skb, - skb->protocol = htons(ETH_P_TEB); - - /* segment inner packet. */ -- enc_features = skb->dev->hw_enc_features & netif_skb_features(skb); -+ enc_features = skb->dev->hw_enc_features & features; - segs = skb_mac_gso_segment(skb, enc_features); - if (!segs || IS_ERR(segs)) { - skb_gso_error_unwind(skb, protocol, tnl_hlen, mac_offset, -diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c -index 841cfa2c4600..6b89b2a1ac74 100644 ---- a/net/ipv6/datagram.c -+++ b/net/ipv6/datagram.c -@@ -40,7 +40,7 @@ static bool ipv6_mapped_addr_any(const struct in6_addr *a) - return ipv6_addr_v4mapped(a) && (a->s6_addr32[3] == 0); - } - --int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) -+static int __ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) - { - struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr; - struct inet_sock *inet = inet_sk(sk); -@@ -56,7 +56,7 @@ int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) - if (usin->sin6_family == AF_INET) { - if (__ipv6_only_sock(sk)) - return -EAFNOSUPPORT; -- err = ip4_datagram_connect(sk, uaddr, addr_len); -+ err = __ip4_datagram_connect(sk, uaddr, addr_len); - goto ipv4_connected; - } - -@@ -98,9 +98,9 @@ int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) - sin.sin_addr.s_addr = daddr->s6_addr32[3]; - sin.sin_port = usin->sin6_port; - -- err = ip4_datagram_connect(sk, -- (struct sockaddr *) &sin, -- sizeof(sin)); -+ err = __ip4_datagram_connect(sk, -+ (struct sockaddr *) &sin, -+ sizeof(sin)); - - ipv4_connected: - if (err) -@@ -203,6 +203,16 @@ out: - fl6_sock_release(flowlabel); - return err; - } -+ -+int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) -+{ -+ int res; -+ -+ lock_sock(sk); -+ res = __ip6_datagram_connect(sk, uaddr, addr_len); -+ release_sock(sk); -+ return res; -+} - EXPORT_SYMBOL_GPL(ip6_datagram_connect); - - int ip6_datagram_connect_v6_only(struct sock *sk, struct sockaddr *uaddr, -diff --git a/net/ipv6/exthdrs_offload.c b/net/ipv6/exthdrs_offload.c -index 447a7fbd1bb6..f5e2ba1c18bf 100644 ---- a/net/ipv6/exthdrs_offload.c -+++ b/net/ipv6/exthdrs_offload.c -@@ -36,6 +36,6 @@ out: - return ret; - - out_rt: -- inet_del_offload(&rthdr_offload, IPPROTO_ROUTING); -+ inet6_del_offload(&rthdr_offload, IPPROTO_ROUTING); - goto out; - } -diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c -index 4a230b18dfe3..baffa3b7a328 100644 ---- a/net/ipv6/ip6_gre.c -+++ b/net/ipv6/ip6_gre.c -@@ -357,6 +357,7 @@ static void ip6gre_tunnel_uninit(struct net_device *dev) - struct ip6gre_net *ign = net_generic(net, ip6gre_net_id); - - ip6gre_tunnel_unlink(ign, netdev_priv(dev)); -+ ip6_tnl_dst_reset(netdev_priv(dev)); - dev_put(dev); - } - -diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c -index 51d54dc376f3..05c94d9c3776 100644 ---- a/net/ipv6/ip6_input.c -+++ b/net/ipv6/ip6_input.c -@@ -329,10 +329,10 @@ int ip6_mc_input(struct sk_buff *skb) - if (offset < 0) - goto out; - -- if (!ipv6_is_mld(skb, nexthdr, offset)) -- goto out; -+ if (ipv6_is_mld(skb, nexthdr, offset)) -+ deliver = true; - -- deliver = true; -+ goto out; - } - /* unknown RA - process it normally */ - } -diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c -index b2f091566f88..dc46ebae1987 100644 ---- a/net/ipv6/ip6_offload.c -+++ b/net/ipv6/ip6_offload.c -@@ -112,7 +112,7 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, - - encap = SKB_GSO_CB(skb)->encap_level > 0; - if (encap) -- features = skb->dev->hw_enc_features & netif_skb_features(skb); -+ features &= skb->dev->hw_enc_features; - SKB_GSO_CB(skb)->encap_level += sizeof(*ipv6h); - - ipv6h = ipv6_hdr(skb); -diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c -index 8737400af0a0..821d8dfb2ddd 100644 ---- a/net/ipv6/ip6mr.c -+++ b/net/ipv6/ip6mr.c -@@ -552,7 +552,7 @@ static void ipmr_mfc_seq_stop(struct seq_file *seq, void *v) - - if (it->cache == &mrt->mfc6_unres_queue) - spin_unlock_bh(&mfc_unres_lock); -- else if (it->cache == mrt->mfc6_cache_array) -+ else if (it->cache == &mrt->mfc6_cache_array[it->ct]) - read_unlock(&mrt_lock); - } - -diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c -index dca076f6252c..bc08a9ce3bd4 100644 ---- a/net/mac80211/tx.c -+++ b/net/mac80211/tx.c -@@ -297,9 +297,6 @@ ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx) - if (tx->sdata->vif.type == NL80211_IFTYPE_WDS) - return TX_CONTINUE; - -- if (tx->sdata->vif.type == NL80211_IFTYPE_MESH_POINT) -- return TX_CONTINUE; -- - if (tx->flags & IEEE80211_TX_PS_BUFFERED) - return TX_CONTINUE; - -diff --git a/net/mpls/mpls_gso.c b/net/mpls/mpls_gso.c -index 851cd880b0c0..0c970cbe0405 100644 ---- a/net/mpls/mpls_gso.c -+++ b/net/mpls/mpls_gso.c -@@ -47,7 +47,7 @@ static struct sk_buff *mpls_gso_segment(struct sk_buff *skb, - __skb_push(skb, skb->mac_len); - - /* Segment inner packet. */ -- mpls_features = skb->dev->mpls_features & netif_skb_features(skb); -+ mpls_features = skb->dev->mpls_features & features; - segs = skb_mac_gso_segment(skb, mpls_features); - - -diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c -index a0b0ea949192..fd9373c9f057 100644 ---- a/net/netlink/af_netlink.c -+++ b/net/netlink/af_netlink.c -@@ -115,6 +115,24 @@ static inline struct hlist_head *nl_portid_hashfn(struct nl_portid_hash *hash, u - return &hash->table[jhash_1word(portid, hash->rnd) & hash->mask]; - } - -+static struct sk_buff *netlink_to_full_skb(const struct sk_buff *skb, -+ gfp_t gfp_mask) -+{ -+ unsigned int len = skb_end_offset(skb); -+ struct sk_buff *new; -+ -+ new = alloc_skb(len, gfp_mask); -+ if (new == NULL) -+ return NULL; -+ -+ NETLINK_CB(new).portid = NETLINK_CB(skb).portid; -+ NETLINK_CB(new).dst_group = NETLINK_CB(skb).dst_group; -+ NETLINK_CB(new).creds = NETLINK_CB(skb).creds; -+ -+ memcpy(skb_put(new, len), skb->data, len); -+ return new; -+} -+ - int netlink_add_tap(struct netlink_tap *nt) - { - if (unlikely(nt->dev->type != ARPHRD_NETLINK)) -@@ -199,7 +217,11 @@ static int __netlink_deliver_tap_skb(struct sk_buff *skb, - int ret = -ENOMEM; - - dev_hold(dev); -- nskb = skb_clone(skb, GFP_ATOMIC); -+ -+ if (netlink_skb_is_mmaped(skb) || is_vmalloc_addr(skb->head)) -+ nskb = netlink_to_full_skb(skb, GFP_ATOMIC); -+ else -+ nskb = skb_clone(skb, GFP_ATOMIC); - if (nskb) { - nskb->dev = dev; - nskb->protocol = htons((u16) sk->sk_protocol); -@@ -271,11 +293,6 @@ static void netlink_rcv_wake(struct sock *sk) - } - - #ifdef CONFIG_NETLINK_MMAP --static bool netlink_skb_is_mmaped(const struct sk_buff *skb) --{ -- return NETLINK_CB(skb).flags & NETLINK_SKB_MMAPED; --} -- - static bool netlink_rx_is_mmaped(struct sock *sk) - { - return nlk_sk(sk)->rx_ring.pg_vec != NULL; -@@ -350,25 +367,52 @@ err1: - return NULL; - } - -+ -+static void -+__netlink_set_ring(struct sock *sk, struct nl_mmap_req *req, bool tx_ring, void **pg_vec, -+ unsigned int order) -+{ -+ struct netlink_sock *nlk = nlk_sk(sk); -+ struct sk_buff_head *queue; -+ struct netlink_ring *ring; -+ -+ queue = tx_ring ? &sk->sk_write_queue : &sk->sk_receive_queue; -+ ring = tx_ring ? &nlk->tx_ring : &nlk->rx_ring; -+ -+ spin_lock_bh(&queue->lock); -+ -+ ring->frame_max = req->nm_frame_nr - 1; -+ ring->head = 0; -+ ring->frame_size = req->nm_frame_size; -+ ring->pg_vec_pages = req->nm_block_size / PAGE_SIZE; -+ -+ swap(ring->pg_vec_len, req->nm_block_nr); -+ swap(ring->pg_vec_order, order); -+ swap(ring->pg_vec, pg_vec); -+ -+ __skb_queue_purge(queue); -+ spin_unlock_bh(&queue->lock); -+ -+ WARN_ON(atomic_read(&nlk->mapped)); -+ -+ if (pg_vec) -+ free_pg_vec(pg_vec, order, req->nm_block_nr); -+} -+ - static int netlink_set_ring(struct sock *sk, struct nl_mmap_req *req, -- bool closing, bool tx_ring) -+ bool tx_ring) - { - struct netlink_sock *nlk = nlk_sk(sk); - struct netlink_ring *ring; -- struct sk_buff_head *queue; - void **pg_vec = NULL; - unsigned int order = 0; -- int err; - - ring = tx_ring ? &nlk->tx_ring : &nlk->rx_ring; -- queue = tx_ring ? &sk->sk_write_queue : &sk->sk_receive_queue; - -- if (!closing) { -- if (atomic_read(&nlk->mapped)) -- return -EBUSY; -- if (atomic_read(&ring->pending)) -- return -EBUSY; -- } -+ if (atomic_read(&nlk->mapped)) -+ return -EBUSY; -+ if (atomic_read(&ring->pending)) -+ return -EBUSY; - - if (req->nm_block_nr) { - if (ring->pg_vec != NULL) -@@ -400,31 +444,19 @@ static int netlink_set_ring(struct sock *sk, struct nl_mmap_req *req, - return -EINVAL; - } - -- err = -EBUSY; - mutex_lock(&nlk->pg_vec_lock); -- if (closing || atomic_read(&nlk->mapped) == 0) { -- err = 0; -- spin_lock_bh(&queue->lock); -- -- ring->frame_max = req->nm_frame_nr - 1; -- ring->head = 0; -- ring->frame_size = req->nm_frame_size; -- ring->pg_vec_pages = req->nm_block_size / PAGE_SIZE; -- -- swap(ring->pg_vec_len, req->nm_block_nr); -- swap(ring->pg_vec_order, order); -- swap(ring->pg_vec, pg_vec); -- -- __skb_queue_purge(queue); -- spin_unlock_bh(&queue->lock); -- -- WARN_ON(atomic_read(&nlk->mapped)); -+ if (atomic_read(&nlk->mapped) == 0) { -+ __netlink_set_ring(sk, req, tx_ring, pg_vec, order); -+ mutex_unlock(&nlk->pg_vec_lock); -+ return 0; - } -+ - mutex_unlock(&nlk->pg_vec_lock); - - if (pg_vec) - free_pg_vec(pg_vec, order, req->nm_block_nr); -- return err; -+ -+ return -EBUSY; - } - - static void netlink_mm_open(struct vm_area_struct *vma) -@@ -812,7 +844,6 @@ static void netlink_ring_set_copied(struct sock *sk, struct sk_buff *skb) - } - - #else /* CONFIG_NETLINK_MMAP */ --#define netlink_skb_is_mmaped(skb) false - #define netlink_rx_is_mmaped(sk) false - #define netlink_tx_is_mmaped(sk) false - #define netlink_mmap sock_no_mmap -@@ -893,10 +924,10 @@ static void netlink_sock_destruct(struct sock *sk) - - memset(&req, 0, sizeof(req)); - if (nlk->rx_ring.pg_vec) -- netlink_set_ring(sk, &req, true, false); -+ __netlink_set_ring(sk, &req, false, NULL, 0); - memset(&req, 0, sizeof(req)); - if (nlk->tx_ring.pg_vec) -- netlink_set_ring(sk, &req, true, true); -+ __netlink_set_ring(sk, &req, true, NULL, 0); - } - #endif /* CONFIG_NETLINK_MMAP */ - -@@ -2190,7 +2221,7 @@ static int netlink_setsockopt(struct socket *sock, int level, int optname, - return -EINVAL; - if (copy_from_user(&req, optval, sizeof(req))) - return -EFAULT; -- err = netlink_set_ring(sk, &req, false, -+ err = netlink_set_ring(sk, &req, - optname == NETLINK_TX_RING); - break; - } -diff --git a/net/netlink/af_netlink.h b/net/netlink/af_netlink.h -index acbd774eeb7c..dcc89c74b514 100644 ---- a/net/netlink/af_netlink.h -+++ b/net/netlink/af_netlink.h -@@ -65,6 +65,15 @@ struct nl_portid_hash { - u32 rnd; - }; - -+static inline bool netlink_skb_is_mmaped(const struct sk_buff *skb) -+{ -+#ifdef CONFIG_NETLINK_MMAP -+ return NETLINK_CB(skb).flags & NETLINK_SKB_MMAPED; -+#else -+ return false; -+#endif /* CONFIG_NETLINK_MMAP */ -+} -+ - struct netlink_table { - struct nl_portid_hash hash; - struct hlist_head mc_list; -diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c -index 270b77dfac30..8bb1a5a9b02e 100644 ---- a/net/openvswitch/datapath.c -+++ b/net/openvswitch/datapath.c -@@ -803,7 +803,7 @@ static int ovs_flow_cmd_new_or_set(struct sk_buff *skb, struct genl_info *info) - if (IS_ERR(acts)) - goto error; - -- ovs_flow_mask_key(&masked_key, &key, &mask); -+ ovs_flow_mask_key(&masked_key, &key, true, &mask); - error = ovs_nla_copy_actions(a[OVS_FLOW_ATTR_ACTIONS], - &masked_key, 0, &acts); - if (error) { -diff --git a/net/openvswitch/flow_table.c b/net/openvswitch/flow_table.c -index 3c268b3d71c3..4877d5a212a2 100644 ---- a/net/openvswitch/flow_table.c -+++ b/net/openvswitch/flow_table.c -@@ -55,18 +55,21 @@ static u16 range_n_bytes(const struct sw_flow_key_range *range) - } - - void ovs_flow_mask_key(struct sw_flow_key *dst, const struct sw_flow_key *src, -- const struct sw_flow_mask *mask) -+ bool full, const struct sw_flow_mask *mask) - { -- const long *m = (long *)((u8 *)&mask->key + mask->range.start); -- const long *s = (long *)((u8 *)src + mask->range.start); -- long *d = (long *)((u8 *)dst + mask->range.start); -+ int start = full ? 0 : mask->range.start; -+ int len = full ? sizeof *dst : range_n_bytes(&mask->range); -+ const long *m = (const long *)((const u8 *)&mask->key + start); -+ const long *s = (const long *)((const u8 *)src + start); -+ long *d = (long *)((u8 *)dst + start); - int i; - -- /* The memory outside of the 'mask->range' are not set since -- * further operations on 'dst' only uses contents within -- * 'mask->range'. -+ /* If 'full' is true then all of 'dst' is fully initialized. Otherwise, -+ * if 'full' is false the memory outside of the 'mask->range' is left -+ * uninitialized. This can be used as an optimization when further -+ * operations on 'dst' only use contents within 'mask->range'. - */ -- for (i = 0; i < range_n_bytes(&mask->range); i += sizeof(long)) -+ for (i = 0; i < len; i += sizeof(long)) - *d++ = *s++ & *m++; - } - -@@ -436,7 +439,7 @@ static struct sw_flow *masked_flow_lookup(struct table_instance *ti, - u32 hash; - struct sw_flow_key masked_key; - -- ovs_flow_mask_key(&masked_key, unmasked, mask); -+ ovs_flow_mask_key(&masked_key, unmasked, false, mask); - hash = flow_hash(&masked_key, key_start, key_end); - head = find_bucket(ti, hash); - hlist_for_each_entry_rcu(flow, head, hash_node[ti->node_ver]) { -diff --git a/net/openvswitch/flow_table.h b/net/openvswitch/flow_table.h -index baaeb101924d..82e64a9b6416 100644 ---- a/net/openvswitch/flow_table.h -+++ b/net/openvswitch/flow_table.h -@@ -79,5 +79,5 @@ bool ovs_flow_cmp_unmasked_key(const struct sw_flow *flow, - struct sw_flow_match *match); - - void ovs_flow_mask_key(struct sw_flow_key *dst, const struct sw_flow_key *src, -- const struct sw_flow_mask *mask); -+ bool full, const struct sw_flow_mask *mask); - #endif /* flow_table.h */ -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index 84a60b82e235..fee7dcc28abd 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -2645,7 +2645,7 @@ static int packet_release(struct socket *sock) - static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 proto) - { - struct packet_sock *po = pkt_sk(sk); -- const struct net_device *dev_curr; -+ struct net_device *dev_curr; - __be16 proto_curr; - bool need_rehook; - -@@ -2669,15 +2669,13 @@ static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 proto) - - po->num = proto; - po->prot_hook.type = proto; -- -- if (po->prot_hook.dev) -- dev_put(po->prot_hook.dev); -- - po->prot_hook.dev = dev; - - po->ifindex = dev ? dev->ifindex : 0; - packet_cached_dev_assign(po, dev); - } -+ if (dev_curr) -+ dev_put(dev_curr); - - if (proto == 0 || !need_rehook) - goto out_unlock; -diff --git a/net/rds/info.c b/net/rds/info.c -index 9a6b4f66187c..140a44a5f7b7 100644 ---- a/net/rds/info.c -+++ b/net/rds/info.c -@@ -176,7 +176,7 @@ int rds_info_getsockopt(struct socket *sock, int optname, char __user *optval, - - /* check for all kinds of wrapping and the like */ - start = (unsigned long)optval; -- if (len < 0 || len + PAGE_SIZE - 1 < len || start + len < start) { -+ if (len < 0 || len > INT_MAX - PAGE_SIZE + 1 || start + len < start) { - ret = -EINVAL; - goto out; - } -diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c -index a62a215dd22e..1237a237495b 100644 ---- a/net/sctp/protocol.c -+++ b/net/sctp/protocol.c -@@ -1167,7 +1167,7 @@ static void sctp_v4_del_protocol(void) - unregister_inetaddr_notifier(&sctp_inetaddr_notifier); - } - --static int __net_init sctp_net_init(struct net *net) -+static int __net_init sctp_defaults_init(struct net *net) - { - int status; - -@@ -1260,12 +1260,6 @@ static int __net_init sctp_net_init(struct net *net) - - sctp_dbg_objcnt_init(net); - -- /* Initialize the control inode/socket for handling OOTB packets. */ -- if ((status = sctp_ctl_sock_init(net))) { -- pr_err("Failed to initialize the SCTP control sock\n"); -- goto err_ctl_sock_init; -- } -- - /* Initialize the local address list. */ - INIT_LIST_HEAD(&net->sctp.local_addr_list); - spin_lock_init(&net->sctp.local_addr_lock); -@@ -1281,9 +1275,6 @@ static int __net_init sctp_net_init(struct net *net) - - return 0; - --err_ctl_sock_init: -- sctp_dbg_objcnt_exit(net); -- sctp_proc_exit(net); - err_init_proc: - cleanup_sctp_mibs(net); - err_init_mibs: -@@ -1292,15 +1283,12 @@ err_sysctl_register: - return status; - } - --static void __net_exit sctp_net_exit(struct net *net) -+static void __net_exit sctp_defaults_exit(struct net *net) - { - /* Free the local address list */ - sctp_free_addr_wq(net); - sctp_free_local_addr_list(net); - -- /* Free the control endpoint. */ -- inet_ctl_sock_destroy(net->sctp.ctl_sock); -- - sctp_dbg_objcnt_exit(net); - - sctp_proc_exit(net); -@@ -1308,9 +1296,32 @@ static void __net_exit sctp_net_exit(struct net *net) - sctp_sysctl_net_unregister(net); - } - --static struct pernet_operations sctp_net_ops = { -- .init = sctp_net_init, -- .exit = sctp_net_exit, -+static struct pernet_operations sctp_defaults_ops = { -+ .init = sctp_defaults_init, -+ .exit = sctp_defaults_exit, -+}; -+ -+static int __net_init sctp_ctrlsock_init(struct net *net) -+{ -+ int status; -+ -+ /* Initialize the control inode/socket for handling OOTB packets. */ -+ status = sctp_ctl_sock_init(net); -+ if (status) -+ pr_err("Failed to initialize the SCTP control sock\n"); -+ -+ return status; -+} -+ -+static void __net_init sctp_ctrlsock_exit(struct net *net) -+{ -+ /* Free the control endpoint. */ -+ inet_ctl_sock_destroy(net->sctp.ctl_sock); -+} -+ -+static struct pernet_operations sctp_ctrlsock_ops = { -+ .init = sctp_ctrlsock_init, -+ .exit = sctp_ctrlsock_exit, - }; - - /* Initialize the universe into something sensible. */ -@@ -1444,8 +1455,11 @@ static __init int sctp_init(void) - sctp_v4_pf_init(); - sctp_v6_pf_init(); - -- status = sctp_v4_protosw_init(); -+ status = register_pernet_subsys(&sctp_defaults_ops); -+ if (status) -+ goto err_register_defaults; - -+ status = sctp_v4_protosw_init(); - if (status) - goto err_protosw_init; - -@@ -1453,9 +1467,9 @@ static __init int sctp_init(void) - if (status) - goto err_v6_protosw_init; - -- status = register_pernet_subsys(&sctp_net_ops); -+ status = register_pernet_subsys(&sctp_ctrlsock_ops); - if (status) -- goto err_register_pernet_subsys; -+ goto err_register_ctrlsock; - - status = sctp_v4_add_protocol(); - if (status) -@@ -1471,12 +1485,14 @@ out: - err_v6_add_protocol: - sctp_v4_del_protocol(); - err_add_protocol: -- unregister_pernet_subsys(&sctp_net_ops); --err_register_pernet_subsys: -+ unregister_pernet_subsys(&sctp_ctrlsock_ops); -+err_register_ctrlsock: - sctp_v6_protosw_exit(); - err_v6_protosw_init: - sctp_v4_protosw_exit(); - err_protosw_init: -+ unregister_pernet_subsys(&sctp_defaults_ops); -+err_register_defaults: - sctp_v4_pf_exit(); - sctp_v6_pf_exit(); - sctp_sysctl_unregister(); -@@ -1509,12 +1525,14 @@ static __exit void sctp_exit(void) - sctp_v6_del_protocol(); - sctp_v4_del_protocol(); - -- unregister_pernet_subsys(&sctp_net_ops); -+ unregister_pernet_subsys(&sctp_ctrlsock_ops); - - /* Free protosw registrations */ - sctp_v6_protosw_exit(); - sctp_v4_protosw_exit(); - -+ unregister_pernet_subsys(&sctp_defaults_ops); -+ - /* Unregister with socket layer. */ - sctp_v6_pf_exit(); - sctp_v4_pf_exit(); -diff --git a/net/tipc/socket.c b/net/tipc/socket.c -index 0ed0eaa62f29..830e40b329d6 100644 ---- a/net/tipc/socket.c -+++ b/net/tipc/socket.c -@@ -1681,6 +1681,7 @@ static int accept(struct socket *sock, struct socket *new_sock, int flags) - res = tipc_sk_create(sock_net(sock->sk), new_sock, 0, 1); - if (res) - goto exit; -+ security_sk_clone(sock->sk, new_sock->sk); - - new_sk = new_sock->sk; - new_tsock = tipc_sk(new_sk); -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 907371d87312..08e29311e17d 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -1193,7 +1193,7 @@ static const struct hda_fixup alc880_fixups[] = { - /* override all pins as BIOS on old Amilo is broken */ - .type = HDA_FIXUP_PINS, - .v.pins = (const struct hda_pintbl[]) { -- { 0x14, 0x0121411f }, /* HP */ -+ { 0x14, 0x0121401f }, /* HP */ - { 0x15, 0x99030120 }, /* speaker */ - { 0x16, 0x99030130 }, /* bass speaker */ - { 0x17, 0x411111f0 }, /* N/A */ -@@ -1213,7 +1213,7 @@ static const struct hda_fixup alc880_fixups[] = { - /* almost compatible with FUJITSU, but no bass and SPDIF */ - .type = HDA_FIXUP_PINS, - .v.pins = (const struct hda_pintbl[]) { -- { 0x14, 0x0121411f }, /* HP */ -+ { 0x14, 0x0121401f }, /* HP */ - { 0x15, 0x99030120 }, /* speaker */ - { 0x16, 0x411111f0 }, /* N/A */ - { 0x17, 0x411111f0 }, /* N/A */ -@@ -1421,7 +1421,7 @@ static const struct snd_pci_quirk alc880_fixup_tbl[] = { - SND_PCI_QUIRK(0x161f, 0x203d, "W810", ALC880_FIXUP_W810), - SND_PCI_QUIRK(0x161f, 0x205d, "Medion Rim 2150", ALC880_FIXUP_MEDION_RIM), - SND_PCI_QUIRK(0x1631, 0xe011, "PB 13201056", ALC880_FIXUP_6ST_AUTOMUTE), -- SND_PCI_QUIRK(0x1734, 0x107c, "FSC F1734", ALC880_FIXUP_F1734), -+ SND_PCI_QUIRK(0x1734, 0x107c, "FSC Amilo M1437", ALC880_FIXUP_FUJITSU), - SND_PCI_QUIRK(0x1734, 0x1094, "FSC Amilo M1451G", ALC880_FIXUP_FUJITSU), - SND_PCI_QUIRK(0x1734, 0x10ac, "FSC AMILO Xi 1526", ALC880_FIXUP_F1734), - SND_PCI_QUIRK(0x1734, 0x10b0, "FSC Amilo Pi1556", ALC880_FIXUP_FUJITSU), diff --git a/patch/kernel/odroidc2-default/patch-3.14.54-55.patch b/patch/kernel/odroidc2-default/patch-3.14.54-55.patch deleted file mode 100644 index 27d386a700..0000000000 --- a/patch/kernel/odroidc2-default/patch-3.14.54-55.patch +++ /dev/null @@ -1,2905 +0,0 @@ -diff --git a/Makefile b/Makefile -index 22c91fa0411e..97d18c1d27f2 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,8 +1,8 @@ - VERSION = 3 - PATCHLEVEL = 14 --SUBLEVEL = 54 -+SUBLEVEL = 55 - EXTRAVERSION = --NAME = Kernel Recipes 2015 -+NAME = Remembering Coco - - # *DOCUMENTATION* - # To see a list of typical targets execute "make help" -diff --git a/arch/arm/Makefile b/arch/arm/Makefile -index 08a9ef58d9c3..6ca3f2ebaa9c 100644 ---- a/arch/arm/Makefile -+++ b/arch/arm/Makefile -@@ -52,6 +52,14 @@ endif - - comma = , - -+# -+# The Scalar Replacement of Aggregates (SRA) optimization pass in GCC 4.9 and -+# later may result in code being generated that handles signed short and signed -+# char struct members incorrectly. So disable it. -+# (https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65932) -+# -+KBUILD_CFLAGS += $(call cc-option,-fno-ipa-sra) -+ - # This selects which instruction set is used. - # Note that GCC does not numerically define an architecture version - # macro, but instead defines a whole series of macros which makes -diff --git a/arch/arm/boot/dts/omap5-uevm.dts b/arch/arm/boot/dts/omap5-uevm.dts -index 002fa70180a5..1186a50fc1de 100644 ---- a/arch/arm/boot/dts/omap5-uevm.dts -+++ b/arch/arm/boot/dts/omap5-uevm.dts -@@ -111,8 +111,8 @@ - - i2c5_pins: pinmux_i2c5_pins { - pinctrl-single,pins = < -- 0x184 (PIN_INPUT | MUX_MODE0) /* i2c5_scl */ -- 0x186 (PIN_INPUT | MUX_MODE0) /* i2c5_sda */ -+ 0x186 (PIN_INPUT | MUX_MODE0) /* i2c5_scl */ -+ 0x188 (PIN_INPUT | MUX_MODE0) /* i2c5_sda */ - >; - }; - -diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c -index 04d63880037f..1e5a4fd25a50 100644 ---- a/arch/arm/kernel/signal.c -+++ b/arch/arm/kernel/signal.c -@@ -353,12 +353,17 @@ setup_return(struct pt_regs *regs, struct ksignal *ksig, - */ - thumb = handler & 1; - --#if __LINUX_ARM_ARCH__ >= 7 -+#if __LINUX_ARM_ARCH__ >= 6 - /* -- * Clear the If-Then Thumb-2 execution state -- * ARM spec requires this to be all 000s in ARM mode -- * Snapdragon S4/Krait misbehaves on a Thumb=>ARM -- * signal transition without this. -+ * Clear the If-Then Thumb-2 execution state. ARM spec -+ * requires this to be all 000s in ARM mode. Snapdragon -+ * S4/Krait misbehaves on a Thumb=>ARM signal transition -+ * without this. -+ * -+ * We must do this whenever we are running on a Thumb-2 -+ * capable CPU, which includes ARMv6T2. However, we elect -+ * to do this whenever we're on an ARMv6 or later CPU for -+ * simplicity. - */ - cpsr &= ~PSR_IT_MASK; - #endif -diff --git a/arch/hexagon/include/asm/barrier.h b/arch/hexagon/include/asm/barrier.h -deleted file mode 100644 -index 4e863daea25b..000000000000 ---- a/arch/hexagon/include/asm/barrier.h -+++ /dev/null -@@ -1,37 +0,0 @@ --/* -- * Memory barrier definitions for the Hexagon architecture -- * -- * Copyright (c) 2010-2011, The Linux Foundation. All rights reserved. -- * -- * This program is free software; you can redistribute it and/or modify -- * it under the terms of the GNU General Public License version 2 and -- * only version 2 as published by the Free Software Foundation. -- * -- * This program is distributed in the hope that it will be useful, -- * but WITHOUT ANY WARRANTY; without even the implied warranty of -- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -- * GNU General Public License for more details. -- * -- * You should have received a copy of the GNU General Public License -- * along with this program; if not, write to the Free Software -- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA -- * 02110-1301, USA. -- */ -- --#ifndef _ASM_BARRIER_H --#define _ASM_BARRIER_H -- --#define rmb() barrier() --#define read_barrier_depends() barrier() --#define wmb() barrier() --#define mb() barrier() --#define smp_rmb() barrier() --#define smp_read_barrier_depends() barrier() --#define smp_wmb() barrier() --#define smp_mb() barrier() -- --/* Set a value and use a memory barrier. Used by the scheduler somewhere. */ --#define set_mb(var, value) \ -- do { var = value; mb(); } while (0) -- --#endif /* _ASM_BARRIER_H */ -diff --git a/arch/m68k/include/asm/linkage.h b/arch/m68k/include/asm/linkage.h -index 5a822bb790f7..066e74f666ae 100644 ---- a/arch/m68k/include/asm/linkage.h -+++ b/arch/m68k/include/asm/linkage.h -@@ -4,4 +4,34 @@ - #define __ALIGN .align 4 - #define __ALIGN_STR ".align 4" - -+/* -+ * Make sure the compiler doesn't do anything stupid with the -+ * arguments on the stack - they are owned by the *caller*, not -+ * the callee. This just fools gcc into not spilling into them, -+ * and keeps it from doing tailcall recursion and/or using the -+ * stack slots for temporaries, since they are live and "used" -+ * all the way to the end of the function. -+ */ -+#define asmlinkage_protect(n, ret, args...) \ -+ __asmlinkage_protect##n(ret, ##args) -+#define __asmlinkage_protect_n(ret, args...) \ -+ __asm__ __volatile__ ("" : "=r" (ret) : "0" (ret), ##args) -+#define __asmlinkage_protect0(ret) \ -+ __asmlinkage_protect_n(ret) -+#define __asmlinkage_protect1(ret, arg1) \ -+ __asmlinkage_protect_n(ret, "m" (arg1)) -+#define __asmlinkage_protect2(ret, arg1, arg2) \ -+ __asmlinkage_protect_n(ret, "m" (arg1), "m" (arg2)) -+#define __asmlinkage_protect3(ret, arg1, arg2, arg3) \ -+ __asmlinkage_protect_n(ret, "m" (arg1), "m" (arg2), "m" (arg3)) -+#define __asmlinkage_protect4(ret, arg1, arg2, arg3, arg4) \ -+ __asmlinkage_protect_n(ret, "m" (arg1), "m" (arg2), "m" (arg3), \ -+ "m" (arg4)) -+#define __asmlinkage_protect5(ret, arg1, arg2, arg3, arg4, arg5) \ -+ __asmlinkage_protect_n(ret, "m" (arg1), "m" (arg2), "m" (arg3), \ -+ "m" (arg4), "m" (arg5)) -+#define __asmlinkage_protect6(ret, arg1, arg2, arg3, arg4, arg5, arg6) \ -+ __asmlinkage_protect_n(ret, "m" (arg1), "m" (arg2), "m" (arg3), \ -+ "m" (arg4), "m" (arg5), "m" (arg6)) -+ - #endif -diff --git a/arch/mips/mm/dma-default.c b/arch/mips/mm/dma-default.c -index 44b6dff5aba2..a1087593b3c2 100644 ---- a/arch/mips/mm/dma-default.c -+++ b/arch/mips/mm/dma-default.c -@@ -94,7 +94,7 @@ static gfp_t massage_gfp_flags(const struct device *dev, gfp_t gfp) - else - #endif - #if defined(CONFIG_ZONE_DMA) && !defined(CONFIG_ZONE_DMA32) -- if (dev->coherent_dma_mask < DMA_BIT_MASK(64)) -+ if (dev->coherent_dma_mask < DMA_BIT_MASK(sizeof(phys_addr_t) * 8)) - dma_flag = __GFP_DMA; - else - #endif -diff --git a/arch/powerpc/platforms/powernv/pci.c b/arch/powerpc/platforms/powernv/pci.c -index 52c1162bcee3..4ca00128ae34 100644 ---- a/arch/powerpc/platforms/powernv/pci.c -+++ b/arch/powerpc/platforms/powernv/pci.c -@@ -109,6 +109,7 @@ static void pnv_teardown_msi_irqs(struct pci_dev *pdev) - struct pci_controller *hose = pci_bus_to_host(pdev->bus); - struct pnv_phb *phb = hose->private_data; - struct msi_desc *entry; -+ irq_hw_number_t hwirq; - - if (WARN_ON(!phb)) - return; -@@ -116,10 +117,10 @@ static void pnv_teardown_msi_irqs(struct pci_dev *pdev) - list_for_each_entry(entry, &pdev->msi_list, list) { - if (entry->irq == NO_IRQ) - continue; -+ hwirq = virq_to_hw(entry->irq); - irq_set_msi_desc(entry->irq, NULL); -- msi_bitmap_free_hwirqs(&phb->msi_bmp, -- virq_to_hw(entry->irq) - phb->msi_base, 1); - irq_dispose_mapping(entry->irq); -+ msi_bitmap_free_hwirqs(&phb->msi_bmp, hwirq - phb->msi_base, 1); - } - } - #endif /* CONFIG_PCI_MSI */ -diff --git a/arch/powerpc/sysdev/fsl_msi.c b/arch/powerpc/sysdev/fsl_msi.c -index 77efbaec7b9c..4a9b36777775 100644 ---- a/arch/powerpc/sysdev/fsl_msi.c -+++ b/arch/powerpc/sysdev/fsl_msi.c -@@ -121,15 +121,16 @@ static void fsl_teardown_msi_irqs(struct pci_dev *pdev) - { - struct msi_desc *entry; - struct fsl_msi *msi_data; -+ irq_hw_number_t hwirq; - - list_for_each_entry(entry, &pdev->msi_list, list) { - if (entry->irq == NO_IRQ) - continue; -+ hwirq = virq_to_hw(entry->irq); - msi_data = irq_get_chip_data(entry->irq); - irq_set_msi_desc(entry->irq, NULL); -- msi_bitmap_free_hwirqs(&msi_data->bitmap, -- virq_to_hw(entry->irq), 1); - irq_dispose_mapping(entry->irq); -+ msi_bitmap_free_hwirqs(&msi_data->bitmap, hwirq, 1); - } - - return; -diff --git a/arch/powerpc/sysdev/mpic_pasemi_msi.c b/arch/powerpc/sysdev/mpic_pasemi_msi.c -index 38e62382070c..9e14d82287a1 100644 ---- a/arch/powerpc/sysdev/mpic_pasemi_msi.c -+++ b/arch/powerpc/sysdev/mpic_pasemi_msi.c -@@ -74,6 +74,7 @@ static int pasemi_msi_check_device(struct pci_dev *pdev, int nvec, int type) - static void pasemi_msi_teardown_msi_irqs(struct pci_dev *pdev) - { - struct msi_desc *entry; -+ irq_hw_number_t hwirq; - - pr_debug("pasemi_msi_teardown_msi_irqs, pdev %p\n", pdev); - -@@ -81,10 +82,11 @@ static void pasemi_msi_teardown_msi_irqs(struct pci_dev *pdev) - if (entry->irq == NO_IRQ) - continue; - -+ hwirq = virq_to_hw(entry->irq); - irq_set_msi_desc(entry->irq, NULL); -- msi_bitmap_free_hwirqs(&msi_mpic->msi_bitmap, -- virq_to_hw(entry->irq), ALLOC_CHUNK); - irq_dispose_mapping(entry->irq); -+ msi_bitmap_free_hwirqs(&msi_mpic->msi_bitmap, -+ hwirq, ALLOC_CHUNK); - } - - return; -diff --git a/arch/powerpc/sysdev/mpic_u3msi.c b/arch/powerpc/sysdev/mpic_u3msi.c -index 9a7aa0ed9c1c..dfc3486bf802 100644 ---- a/arch/powerpc/sysdev/mpic_u3msi.c -+++ b/arch/powerpc/sysdev/mpic_u3msi.c -@@ -124,15 +124,16 @@ static int u3msi_msi_check_device(struct pci_dev *pdev, int nvec, int type) - static void u3msi_teardown_msi_irqs(struct pci_dev *pdev) - { - struct msi_desc *entry; -+ irq_hw_number_t hwirq; - - list_for_each_entry(entry, &pdev->msi_list, list) { - if (entry->irq == NO_IRQ) - continue; - -+ hwirq = virq_to_hw(entry->irq); - irq_set_msi_desc(entry->irq, NULL); -- msi_bitmap_free_hwirqs(&msi_mpic->msi_bitmap, -- virq_to_hw(entry->irq), 1); - irq_dispose_mapping(entry->irq); -+ msi_bitmap_free_hwirqs(&msi_mpic->msi_bitmap, hwirq, 1); - } - - return; -diff --git a/arch/powerpc/sysdev/ppc4xx_msi.c b/arch/powerpc/sysdev/ppc4xx_msi.c -index 43948da837a7..c3e65129940b 100644 ---- a/arch/powerpc/sysdev/ppc4xx_msi.c -+++ b/arch/powerpc/sysdev/ppc4xx_msi.c -@@ -121,16 +121,17 @@ void ppc4xx_teardown_msi_irqs(struct pci_dev *dev) - { - struct msi_desc *entry; - struct ppc4xx_msi *msi_data = &ppc4xx_msi; -+ irq_hw_number_t hwirq; - - dev_dbg(&dev->dev, "PCIE-MSI: tearing down msi irqs\n"); - - list_for_each_entry(entry, &dev->msi_list, list) { - if (entry->irq == NO_IRQ) - continue; -+ hwirq = virq_to_hw(entry->irq); - irq_set_msi_desc(entry->irq, NULL); -- msi_bitmap_free_hwirqs(&msi_data->bitmap, -- virq_to_hw(entry->irq), 1); - irq_dispose_mapping(entry->irq); -+ msi_bitmap_free_hwirqs(&msi_data->bitmap, hwirq, 1); - } - } - -diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c -index 523f147b2470..b6ee63a69122 100644 ---- a/arch/x86/kernel/apic/apic.c -+++ b/arch/x86/kernel/apic/apic.c -@@ -359,6 +359,13 @@ static void __setup_APIC_LVTT(unsigned int clocks, int oneshot, int irqen) - apic_write(APIC_LVTT, lvtt_value); - - if (lvtt_value & APIC_LVT_TIMER_TSCDEADLINE) { -+ /* -+ * See Intel SDM: TSC-Deadline Mode chapter. In xAPIC mode, -+ * writing to the APIC LVTT and TSC_DEADLINE MSR isn't serialized. -+ * According to Intel, MFENCE can do the serialization here. -+ */ -+ asm volatile("mfence" : : : "memory"); -+ - printk_once(KERN_DEBUG "TSC deadline timer enabled\n"); - return; - } -diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S -index 6d6ab2b0bdfa..f2f2b97b7cc4 100644 ---- a/arch/x86/kernel/entry_64.S -+++ b/arch/x86/kernel/entry_64.S -@@ -1684,7 +1684,18 @@ END(error_exit) - /* runs on exception stack */ - ENTRY(nmi) - INTR_FRAME -+ /* -+ * Fix up the exception frame if we're on Xen. -+ * PARAVIRT_ADJUST_EXCEPTION_FRAME is guaranteed to push at most -+ * one value to the stack on native, so it may clobber the rdx -+ * scratch slot, but it won't clobber any of the important -+ * slots past it. -+ * -+ * Xen is a different story, because the Xen frame itself overlaps -+ * the "NMI executing" variable. -+ */ - PARAVIRT_ADJUST_EXCEPTION_FRAME -+ - /* - * We allow breakpoints in NMIs. If a breakpoint occurs, then - * the iretq it performs will take us out of NMI context. -@@ -1736,8 +1747,11 @@ ENTRY(nmi) - * we don't want to enable interrupts, because then we'll end - * up in an awkward situation in which IRQs are on but NMIs - * are off. -+ * -+ * We also must not push anything to the stack before switching -+ * stacks lest we corrupt the "NMI executing" variable. - */ -- SWAPGS -+ SWAPGS_UNSAFE_STACK - cld - movq %rsp, %rdx - movq PER_CPU_VAR(kernel_stack), %rsp -diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c -index 1b10af835c31..45c2045692bd 100644 ---- a/arch/x86/kernel/paravirt.c -+++ b/arch/x86/kernel/paravirt.c -@@ -40,10 +40,18 @@ - #include - #include - --/* nop stub */ --void _paravirt_nop(void) --{ --} -+/* -+ * nop stub, which must not clobber anything *including the stack* to -+ * avoid confusing the entry prologues. -+ */ -+extern void _paravirt_nop(void); -+asm (".pushsection .entry.text, \"ax\"\n" -+ ".global _paravirt_nop\n" -+ "_paravirt_nop:\n\t" -+ "ret\n\t" -+ ".size _paravirt_nop, . - _paravirt_nop\n\t" -+ ".type _paravirt_nop, @function\n\t" -+ ".popsection"); - - /* identity function, which can be inlined */ - u32 _paravirt_ident_32(u32 x) -diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c -index b20bced0090f..8bc924ff88ee 100644 ---- a/arch/x86/kernel/tsc.c -+++ b/arch/x86/kernel/tsc.c -@@ -21,6 +21,7 @@ - #include - #include - #include -+#include - - unsigned int __read_mostly cpu_khz; /* TSC clocks / usec, not used here */ - EXPORT_SYMBOL(cpu_khz); -@@ -1011,15 +1012,17 @@ EXPORT_SYMBOL_GPL(mark_tsc_unstable); - - static void __init check_system_tsc_reliable(void) - { --#ifdef CONFIG_MGEODE_LX -- /* RTSC counts during suspend */ -+#if defined(CONFIG_MGEODEGX1) || defined(CONFIG_MGEODE_LX) || defined(CONFIG_X86_GENERIC) -+ if (is_geode_lx()) { -+ /* RTSC counts during suspend */ - #define RTSC_SUSP 0x100 -- unsigned long res_low, res_high; -+ unsigned long res_low, res_high; - -- rdmsr_safe(MSR_GEODE_BUSCONT_CONF0, &res_low, &res_high); -- /* Geode_LX - the OLPC CPU has a very reliable TSC */ -- if (res_low & RTSC_SUSP) -- tsc_clocksource_reliable = 1; -+ rdmsr_safe(MSR_GEODE_BUSCONT_CONF0, &res_low, &res_high); -+ /* Geode_LX - the OLPC CPU has a very reliable TSC */ -+ if (res_low & RTSC_SUSP) -+ tsc_clocksource_reliable = 1; -+ } - #endif - if (boot_cpu_has(X86_FEATURE_TSC_RELIABLE)) - tsc_clocksource_reliable = 1; -diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c -index 074633411ea8..e23a539e2077 100644 ---- a/arch/x86/kvm/svm.c -+++ b/arch/x86/kvm/svm.c -@@ -496,7 +496,7 @@ static void skip_emulated_instruction(struct kvm_vcpu *vcpu) - struct vcpu_svm *svm = to_svm(vcpu); - - if (svm->vmcb->control.next_rip != 0) { -- WARN_ON(!static_cpu_has(X86_FEATURE_NRIPS)); -+ WARN_ON_ONCE(!static_cpu_has(X86_FEATURE_NRIPS)); - svm->next_rip = svm->vmcb->control.next_rip; - } - -diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c -index 2308a401a1c5..0029f59588bd 100644 ---- a/arch/x86/mm/init_64.c -+++ b/arch/x86/mm/init_64.c -@@ -1131,7 +1131,7 @@ void mark_rodata_ro(void) - * has been zapped already via cleanup_highmem(). - */ - all_end = roundup((unsigned long)_brk_end, PMD_SIZE); -- set_memory_nx(rodata_start, (all_end - rodata_start) >> PAGE_SHIFT); -+ set_memory_nx(text_end, (all_end - text_end) >> PAGE_SHIFT); - - rodata_test(); - -diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c -index abb81b0ad83f..ae7d543f23ed 100644 ---- a/arch/x86/platform/efi/efi.c -+++ b/arch/x86/platform/efi/efi.c -@@ -961,6 +961,70 @@ out: - } - - /* -+ * Iterate the EFI memory map in reverse order because the regions -+ * will be mapped top-down. The end result is the same as if we had -+ * mapped things forward, but doesn't require us to change the -+ * existing implementation of efi_map_region(). -+ */ -+static inline void *efi_map_next_entry_reverse(void *entry) -+{ -+ /* Initial call */ -+ if (!entry) -+ return memmap.map_end - memmap.desc_size; -+ -+ entry -= memmap.desc_size; -+ if (entry < memmap.map) -+ return NULL; -+ -+ return entry; -+} -+ -+/* -+ * efi_map_next_entry - Return the next EFI memory map descriptor -+ * @entry: Previous EFI memory map descriptor -+ * -+ * This is a helper function to iterate over the EFI memory map, which -+ * we do in different orders depending on the current configuration. -+ * -+ * To begin traversing the memory map @entry must be %NULL. -+ * -+ * Returns %NULL when we reach the end of the memory map. -+ */ -+static void *efi_map_next_entry(void *entry) -+{ -+ if (!efi_enabled(EFI_OLD_MEMMAP) && efi_enabled(EFI_64BIT)) { -+ /* -+ * Starting in UEFI v2.5 the EFI_PROPERTIES_TABLE -+ * config table feature requires us to map all entries -+ * in the same order as they appear in the EFI memory -+ * map. That is to say, entry N must have a lower -+ * virtual address than entry N+1. This is because the -+ * firmware toolchain leaves relative references in -+ * the code/data sections, which are split and become -+ * separate EFI memory regions. Mapping things -+ * out-of-order leads to the firmware accessing -+ * unmapped addresses. -+ * -+ * Since we need to map things this way whether or not -+ * the kernel actually makes use of -+ * EFI_PROPERTIES_TABLE, let's just switch to this -+ * scheme by default for 64-bit. -+ */ -+ return efi_map_next_entry_reverse(entry); -+ } -+ -+ /* Initial call */ -+ if (!entry) -+ return memmap.map; -+ -+ entry += memmap.desc_size; -+ if (entry >= memmap.map_end) -+ return NULL; -+ -+ return entry; -+} -+ -+/* - * Map the efi memory ranges of the runtime services and update new_mmap with - * virtual addresses. - */ -@@ -970,7 +1034,8 @@ static void * __init efi_map_regions(int *count, int *pg_shift) - unsigned long left = 0; - efi_memory_desc_t *md; - -- for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) { -+ p = NULL; -+ while ((p = efi_map_next_entry(p))) { - md = p; - if (!(md->attribute & EFI_MEMORY_RUNTIME)) { - #ifdef CONFIG_X86_64 -diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c -index 2302f10b1be6..4dca0d50762e 100644 ---- a/arch/x86/xen/enlighten.c -+++ b/arch/x86/xen/enlighten.c -@@ -33,6 +33,10 @@ - #include - #include - -+#ifdef CONFIG_KEXEC_CORE -+#include -+#endif -+ - #include - #include - #include -@@ -1844,6 +1848,21 @@ static struct notifier_block xen_hvm_cpu_notifier = { - .notifier_call = xen_hvm_cpu_notify, - }; - -+#ifdef CONFIG_KEXEC_CORE -+static void xen_hvm_shutdown(void) -+{ -+ native_machine_shutdown(); -+ if (kexec_in_progress) -+ xen_reboot(SHUTDOWN_soft_reset); -+} -+ -+static void xen_hvm_crash_shutdown(struct pt_regs *regs) -+{ -+ native_machine_crash_shutdown(regs); -+ xen_reboot(SHUTDOWN_soft_reset); -+} -+#endif -+ - static void __init xen_hvm_guest_init(void) - { - init_hvm_pv_info(); -@@ -1860,6 +1879,10 @@ static void __init xen_hvm_guest_init(void) - x86_init.irqs.intr_init = xen_init_IRQ; - xen_hvm_init_time_ops(); - xen_hvm_init_mmu_ops(); -+#ifdef CONFIG_KEXEC_CORE -+ machine_ops.shutdown = xen_hvm_shutdown; -+ machine_ops.crash_shutdown = xen_hvm_crash_shutdown; -+#endif - } - - static uint32_t __init xen_hvm_platform(void) -diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c -index d39fd610aa3b..1dca2a516bfd 100644 ---- a/drivers/base/regmap/regmap-debugfs.c -+++ b/drivers/base/regmap/regmap-debugfs.c -@@ -32,8 +32,7 @@ static DEFINE_MUTEX(regmap_debugfs_early_lock); - /* Calculate the length of a fixed format */ - static size_t regmap_calc_reg_len(int max_val, char *buf, size_t buf_size) - { -- snprintf(buf, buf_size, "%x", max_val); -- return strlen(buf); -+ return snprintf(NULL, 0, "%x", max_val); - } - - static ssize_t regmap_name_read_file(struct file *file, -@@ -432,7 +431,7 @@ static ssize_t regmap_access_read_file(struct file *file, - /* If we're in the region the user is trying to read */ - if (p >= *ppos) { - /* ...but not beyond it */ -- if (buf_pos >= count - 1 - tot_len) -+ if (buf_pos + tot_len + 1 >= count) - break; - - /* Format the register */ -diff --git a/drivers/clk/ti/clk-3xxx.c b/drivers/clk/ti/clk-3xxx.c -index d3230234f07b..8c7b048bd0ab 100644 ---- a/drivers/clk/ti/clk-3xxx.c -+++ b/drivers/clk/ti/clk-3xxx.c -@@ -174,7 +174,6 @@ static struct ti_dt_clk omap3xxx_clks[] = { - DT_CLK(NULL, "gpio2_ick", "gpio2_ick"), - DT_CLK(NULL, "wdt3_ick", "wdt3_ick"), - DT_CLK(NULL, "uart3_ick", "uart3_ick"), -- DT_CLK(NULL, "uart4_ick", "uart4_ick"), - DT_CLK(NULL, "gpt9_ick", "gpt9_ick"), - DT_CLK(NULL, "gpt8_ick", "gpt8_ick"), - DT_CLK(NULL, "gpt7_ick", "gpt7_ick"), -@@ -317,6 +316,7 @@ static struct ti_dt_clk am35xx_clks[] = { - static struct ti_dt_clk omap36xx_clks[] = { - DT_CLK(NULL, "omap_192m_alwon_fck", "omap_192m_alwon_fck"), - DT_CLK(NULL, "uart4_fck", "uart4_fck"), -+ DT_CLK(NULL, "uart4_ick", "uart4_ick"), - { .node_name = NULL }, - }; - -diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c -index b0972b3869c7..3ae48ee2f488 100644 ---- a/drivers/dma/dw/core.c -+++ b/drivers/dma/dw/core.c -@@ -1561,7 +1561,6 @@ int dw_dma_probe(struct dw_dma_chip *chip, struct dw_dma_platform_data *pdata) - INIT_LIST_HEAD(&dw->dma.channels); - for (i = 0; i < nr_channels; i++) { - struct dw_dma_chan *dwc = &dw->chan[i]; -- int r = nr_channels - i - 1; - - dwc->chan.device = &dw->dma; - dma_cookie_init(&dwc->chan); -@@ -1573,7 +1572,7 @@ int dw_dma_probe(struct dw_dma_chip *chip, struct dw_dma_platform_data *pdata) - - /* 7 is highest priority & 0 is lowest. */ - if (pdata->chan_priority == CHAN_PRIORITY_ASCENDING) -- dwc->priority = r; -+ dwc->priority = nr_channels - i - 1; - else - dwc->priority = i; - -@@ -1593,6 +1592,7 @@ int dw_dma_probe(struct dw_dma_chip *chip, struct dw_dma_platform_data *pdata) - /* Hardware configuration */ - if (autocfg) { - unsigned int dwc_params; -+ unsigned int r = DW_DMA_MAX_NR_CHANNELS - i - 1; - void __iomem *addr = chip->regs + r * sizeof(u32); - - dwc_params = dma_read_byaddr(addr, DWC_PARAMS); -diff --git a/drivers/gpu/drm/drm_lock.c b/drivers/gpu/drm/drm_lock.c -index f6452682141b..8b8b0e3fc2a8 100644 ---- a/drivers/gpu/drm/drm_lock.c -+++ b/drivers/gpu/drm/drm_lock.c -@@ -58,6 +58,9 @@ int drm_lock(struct drm_device *dev, void *data, struct drm_file *file_priv) - struct drm_master *master = file_priv->master; - int ret = 0; - -+ if (drm_core_check_feature(dev, DRIVER_MODESET)) -+ return -EINVAL; -+ - ++file_priv->lock_count; - - if (lock->context == DRM_KERNEL_CONTEXT) { -@@ -150,6 +153,9 @@ int drm_unlock(struct drm_device *dev, void *data, struct drm_file *file_priv) - struct drm_lock *lock = data; - struct drm_master *master = file_priv->master; - -+ if (drm_core_check_feature(dev, DRIVER_MODESET)) -+ return -EINVAL; -+ - if (lock->context == DRM_KERNEL_CONTEXT) { - DRM_ERROR("Process %d using kernel context %d\n", - task_pid_nr(current), lock->context); -diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c -index 8e3267a8bd4f..11f401ac6bdc 100644 ---- a/drivers/gpu/drm/qxl/qxl_display.c -+++ b/drivers/gpu/drm/qxl/qxl_display.c -@@ -552,7 +552,7 @@ static int qxl_crtc_mode_set(struct drm_crtc *crtc, - adjusted_mode->hdisplay, - adjusted_mode->vdisplay); - -- if (qcrtc->index == 0) -+ if (bo->is_primary == false) - recreate_primary = true; - - if (bo->surf.stride * bo->surf.height > qdev->vram_size) { -@@ -816,13 +816,15 @@ static enum drm_connector_status qxl_conn_detect( - drm_connector_to_qxl_output(connector); - struct drm_device *ddev = connector->dev; - struct qxl_device *qdev = ddev->dev_private; -- int connected; -+ bool connected = false; - - /* The first monitor is always connected */ -- connected = (output->index == 0) || -- (qdev->client_monitors_config && -- qdev->client_monitors_config->count > output->index && -- qxl_head_enabled(&qdev->client_monitors_config->heads[output->index])); -+ if (!qdev->client_monitors_config) { -+ if (output->index == 0) -+ connected = true; -+ } else -+ connected = qdev->client_monitors_config->count > output->index && -+ qxl_head_enabled(&qdev->client_monitors_config->heads[output->index]); - - DRM_DEBUG("#%d connected: %d\n", output->index, connected); - if (!connected) -diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c -index 20b69bff5b34..7393b76b6b63 100644 ---- a/drivers/hwmon/nct6775.c -+++ b/drivers/hwmon/nct6775.c -@@ -350,6 +350,10 @@ static const u16 NCT6775_REG_TEMP_CRIT[ARRAY_SIZE(nct6775_temp_label) - 1] - - /* NCT6776 specific data */ - -+/* STEP_UP_TIME and STEP_DOWN_TIME regs are swapped for all chips but NCT6775 */ -+#define NCT6776_REG_FAN_STEP_UP_TIME NCT6775_REG_FAN_STEP_DOWN_TIME -+#define NCT6776_REG_FAN_STEP_DOWN_TIME NCT6775_REG_FAN_STEP_UP_TIME -+ - static const s8 NCT6776_ALARM_BITS[] = { - 0, 1, 2, 3, 8, 21, 20, 16, /* in0.. in7 */ - 17, -1, -1, -1, -1, -1, -1, /* in8..in14 */ -@@ -3476,8 +3480,8 @@ static int nct6775_probe(struct platform_device *pdev) - data->REG_FAN_PULSES = NCT6776_REG_FAN_PULSES; - data->FAN_PULSE_SHIFT = NCT6775_FAN_PULSE_SHIFT; - data->REG_FAN_TIME[0] = NCT6775_REG_FAN_STOP_TIME; -- data->REG_FAN_TIME[1] = NCT6775_REG_FAN_STEP_UP_TIME; -- data->REG_FAN_TIME[2] = NCT6775_REG_FAN_STEP_DOWN_TIME; -+ data->REG_FAN_TIME[1] = NCT6776_REG_FAN_STEP_UP_TIME; -+ data->REG_FAN_TIME[2] = NCT6776_REG_FAN_STEP_DOWN_TIME; - data->REG_TOLERANCE_H = NCT6776_REG_TOLERANCE_H; - data->REG_PWM[0] = NCT6775_REG_PWM; - data->REG_PWM[1] = NCT6775_REG_FAN_START_OUTPUT; -@@ -3548,8 +3552,8 @@ static int nct6775_probe(struct platform_device *pdev) - data->REG_FAN_PULSES = NCT6779_REG_FAN_PULSES; - data->FAN_PULSE_SHIFT = NCT6775_FAN_PULSE_SHIFT; - data->REG_FAN_TIME[0] = NCT6775_REG_FAN_STOP_TIME; -- data->REG_FAN_TIME[1] = NCT6775_REG_FAN_STEP_UP_TIME; -- data->REG_FAN_TIME[2] = NCT6775_REG_FAN_STEP_DOWN_TIME; -+ data->REG_FAN_TIME[1] = NCT6776_REG_FAN_STEP_UP_TIME; -+ data->REG_FAN_TIME[2] = NCT6776_REG_FAN_STEP_DOWN_TIME; - data->REG_TOLERANCE_H = NCT6776_REG_TOLERANCE_H; - data->REG_PWM[0] = NCT6775_REG_PWM; - data->REG_PWM[1] = NCT6775_REG_FAN_START_OUTPUT; -@@ -3624,8 +3628,8 @@ static int nct6775_probe(struct platform_device *pdev) - data->REG_FAN_PULSES = NCT6779_REG_FAN_PULSES; - data->FAN_PULSE_SHIFT = NCT6775_FAN_PULSE_SHIFT; - data->REG_FAN_TIME[0] = NCT6775_REG_FAN_STOP_TIME; -- data->REG_FAN_TIME[1] = NCT6775_REG_FAN_STEP_UP_TIME; -- data->REG_FAN_TIME[2] = NCT6775_REG_FAN_STEP_DOWN_TIME; -+ data->REG_FAN_TIME[1] = NCT6776_REG_FAN_STEP_UP_TIME; -+ data->REG_FAN_TIME[2] = NCT6776_REG_FAN_STEP_DOWN_TIME; - data->REG_TOLERANCE_H = NCT6776_REG_TOLERANCE_H; - data->REG_PWM[0] = NCT6775_REG_PWM; - data->REG_PWM[1] = NCT6775_REG_FAN_START_OUTPUT; -diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c -index dd2b610552d5..a49ce4a6e72f 100644 ---- a/drivers/infiniband/ulp/isert/ib_isert.c -+++ b/drivers/infiniband/ulp/isert/ib_isert.c -@@ -2634,9 +2634,16 @@ isert_get_dataout(struct iscsi_conn *conn, struct iscsi_cmd *cmd, bool recovery) - static int - isert_immediate_queue(struct iscsi_conn *conn, struct iscsi_cmd *cmd, int state) - { -- int ret; -+ struct isert_cmd *isert_cmd = iscsit_priv_cmd(cmd); -+ int ret = 0; - - switch (state) { -+ case ISTATE_REMOVE: -+ spin_lock_bh(&conn->cmd_lock); -+ list_del_init(&cmd->i_conn_node); -+ spin_unlock_bh(&conn->cmd_lock); -+ isert_put_cmd(isert_cmd, true); -+ break; - case ISTATE_SEND_NOPIN_WANT_RESPONSE: - ret = isert_put_nopin(cmd, conn, false); - break; -diff --git a/drivers/macintosh/windfarm_core.c b/drivers/macintosh/windfarm_core.c -index 3ee198b65843..cc7ece1712b5 100644 ---- a/drivers/macintosh/windfarm_core.c -+++ b/drivers/macintosh/windfarm_core.c -@@ -435,7 +435,7 @@ int wf_unregister_client(struct notifier_block *nb) - { - mutex_lock(&wf_lock); - blocking_notifier_chain_unregister(&wf_client_list, nb); -- wf_client_count++; -+ wf_client_count--; - if (wf_client_count == 0) - wf_stop_thread(); - mutex_unlock(&wf_lock); -diff --git a/drivers/md/dm-cache-policy-cleaner.c b/drivers/md/dm-cache-policy-cleaner.c -index b04d1f904d07..2eca9084defe 100644 ---- a/drivers/md/dm-cache-policy-cleaner.c -+++ b/drivers/md/dm-cache-policy-cleaner.c -@@ -434,7 +434,7 @@ static struct dm_cache_policy *wb_create(dm_cblock_t cache_size, - static struct dm_cache_policy_type wb_policy_type = { - .name = "cleaner", - .version = {1, 0, 0}, -- .hint_size = 0, -+ .hint_size = 4, - .owner = THIS_MODULE, - .create = wb_create - }; -diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c -index 59715389b3cf..19cfd7affebe 100644 ---- a/drivers/md/dm-raid.c -+++ b/drivers/md/dm-raid.c -@@ -325,8 +325,7 @@ static int validate_region_size(struct raid_set *rs, unsigned long region_size) - */ - if (min_region_size > (1 << 13)) { - /* If not a power of 2, make it the next power of 2 */ -- if (min_region_size & (min_region_size - 1)) -- region_size = 1 << fls(region_size); -+ region_size = roundup_pow_of_two(min_region_size); - DMINFO("Choosing default region size of %lu sectors", - region_size); - } else { -diff --git a/drivers/md/md.c b/drivers/md/md.c -index 2ffd277eb311..31d14d88205b 100644 ---- a/drivers/md/md.c -+++ b/drivers/md/md.c -@@ -5285,6 +5285,8 @@ EXPORT_SYMBOL_GPL(md_stop_writes); - static void __md_stop(struct mddev *mddev) - { - mddev->ready = 0; -+ /* Ensure ->event_work is done */ -+ flush_workqueue(md_misc_wq); - mddev->pers->stop(mddev); - if (mddev->pers->sync_request && mddev->to_remove == NULL) - mddev->to_remove = &md_redundancy_group; -diff --git a/drivers/md/persistent-data/dm-btree-internal.h b/drivers/md/persistent-data/dm-btree-internal.h -index bf2b80d5c470..8731b6ea026b 100644 ---- a/drivers/md/persistent-data/dm-btree-internal.h -+++ b/drivers/md/persistent-data/dm-btree-internal.h -@@ -138,4 +138,10 @@ int lower_bound(struct btree_node *n, uint64_t key); - - extern struct dm_block_validator btree_node_validator; - -+/* -+ * Value type for upper levels of multi-level btrees. -+ */ -+extern void init_le64_type(struct dm_transaction_manager *tm, -+ struct dm_btree_value_type *vt); -+ - #endif /* DM_BTREE_INTERNAL_H */ -diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c -index a03178e91a79..7c0d75547ccf 100644 ---- a/drivers/md/persistent-data/dm-btree-remove.c -+++ b/drivers/md/persistent-data/dm-btree-remove.c -@@ -544,14 +544,6 @@ static int remove_raw(struct shadow_spine *s, struct dm_btree_info *info, - return r; - } - --static struct dm_btree_value_type le64_type = { -- .context = NULL, -- .size = sizeof(__le64), -- .inc = NULL, -- .dec = NULL, -- .equal = NULL --}; -- - int dm_btree_remove(struct dm_btree_info *info, dm_block_t root, - uint64_t *keys, dm_block_t *new_root) - { -@@ -559,12 +551,14 @@ int dm_btree_remove(struct dm_btree_info *info, dm_block_t root, - int index = 0, r = 0; - struct shadow_spine spine; - struct btree_node *n; -+ struct dm_btree_value_type le64_vt; - -+ init_le64_type(info->tm, &le64_vt); - init_shadow_spine(&spine, info); - for (level = 0; level < info->levels; level++) { - r = remove_raw(&spine, info, - (level == last_level ? -- &info->value_type : &le64_type), -+ &info->value_type : &le64_vt), - root, keys[level], (unsigned *)&index); - if (r < 0) - break; -diff --git a/drivers/md/persistent-data/dm-btree-spine.c b/drivers/md/persistent-data/dm-btree-spine.c -index 1b5e13ec7f96..0dee514ba4c5 100644 ---- a/drivers/md/persistent-data/dm-btree-spine.c -+++ b/drivers/md/persistent-data/dm-btree-spine.c -@@ -249,3 +249,40 @@ int shadow_root(struct shadow_spine *s) - { - return s->root; - } -+ -+static void le64_inc(void *context, const void *value_le) -+{ -+ struct dm_transaction_manager *tm = context; -+ __le64 v_le; -+ -+ memcpy(&v_le, value_le, sizeof(v_le)); -+ dm_tm_inc(tm, le64_to_cpu(v_le)); -+} -+ -+static void le64_dec(void *context, const void *value_le) -+{ -+ struct dm_transaction_manager *tm = context; -+ __le64 v_le; -+ -+ memcpy(&v_le, value_le, sizeof(v_le)); -+ dm_tm_dec(tm, le64_to_cpu(v_le)); -+} -+ -+static int le64_equal(void *context, const void *value1_le, const void *value2_le) -+{ -+ __le64 v1_le, v2_le; -+ -+ memcpy(&v1_le, value1_le, sizeof(v1_le)); -+ memcpy(&v2_le, value2_le, sizeof(v2_le)); -+ return v1_le == v2_le; -+} -+ -+void init_le64_type(struct dm_transaction_manager *tm, -+ struct dm_btree_value_type *vt) -+{ -+ vt->context = tm; -+ vt->size = sizeof(__le64); -+ vt->inc = le64_inc; -+ vt->dec = le64_dec; -+ vt->equal = le64_equal; -+} -diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c -index fdd3793e22f9..c7726cebc495 100644 ---- a/drivers/md/persistent-data/dm-btree.c -+++ b/drivers/md/persistent-data/dm-btree.c -@@ -667,12 +667,7 @@ static int insert(struct dm_btree_info *info, dm_block_t root, - struct btree_node *n; - struct dm_btree_value_type le64_type; - -- le64_type.context = NULL; -- le64_type.size = sizeof(__le64); -- le64_type.inc = NULL; -- le64_type.dec = NULL; -- le64_type.equal = NULL; -- -+ init_le64_type(info->tm, &le64_type); - init_shadow_spine(&spine, info); - - for (level = 0; level < (info->levels - 1); level++) { -diff --git a/drivers/mtd/nand/pxa3xx_nand.c b/drivers/mtd/nand/pxa3xx_nand.c -index d058b00ba218..eb3823e25638 100644 ---- a/drivers/mtd/nand/pxa3xx_nand.c -+++ b/drivers/mtd/nand/pxa3xx_nand.c -@@ -1463,6 +1463,9 @@ static int pxa3xx_nand_scan(struct mtd_info *mtd) - if (pdata->keep_config && !pxa3xx_nand_detect_config(info)) - goto KEEP_CONFIG; - -+ /* Set a default chunk size */ -+ info->chunk_size = 512; -+ - ret = pxa3xx_nand_sensing(info); - if (ret) { - dev_info(&info->pdev->dev, "There is no chip on cs %d!\n", -diff --git a/drivers/mtd/ubi/io.c b/drivers/mtd/ubi/io.c -index d36134925d31..db657f2168d7 100644 ---- a/drivers/mtd/ubi/io.c -+++ b/drivers/mtd/ubi/io.c -@@ -921,6 +921,11 @@ static int validate_vid_hdr(const struct ubi_device *ubi, - goto bad; - } - -+ if (data_size > ubi->leb_size) { -+ ubi_err("bad data_size"); -+ goto bad; -+ } -+ - if (vol_type == UBI_VID_STATIC) { - /* - * Although from high-level point of view static volumes may -diff --git a/drivers/mtd/ubi/vtbl.c b/drivers/mtd/ubi/vtbl.c -index d77b1c1d7c72..bebf49e0dbe9 100644 ---- a/drivers/mtd/ubi/vtbl.c -+++ b/drivers/mtd/ubi/vtbl.c -@@ -651,6 +651,7 @@ static int init_volumes(struct ubi_device *ubi, - if (ubi->corr_peb_count) - ubi_err("%d PEBs are corrupted and not used", - ubi->corr_peb_count); -+ return -ENOSPC; - } - ubi->rsvd_pebs += reserved_pebs; - ubi->avail_pebs -= reserved_pebs; -diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c -index c6b0b078ab99..2060fef7f2d2 100644 ---- a/drivers/mtd/ubi/wl.c -+++ b/drivers/mtd/ubi/wl.c -@@ -1974,6 +1974,7 @@ int ubi_wl_init(struct ubi_device *ubi, struct ubi_attach_info *ai) - if (ubi->corr_peb_count) - ubi_err("%d PEBs are corrupted and not used", - ubi->corr_peb_count); -+ err = -ENOSPC; - goto out_free; - } - ubi->avail_pebs -= reserved_pebs; -diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c -index 5f57e3d35e26..6adf9abdf955 100644 ---- a/drivers/scsi/3w-9xxx.c -+++ b/drivers/scsi/3w-9xxx.c -@@ -225,6 +225,17 @@ static const struct file_operations twa_fops = { - .llseek = noop_llseek, - }; - -+/* -+ * The controllers use an inline buffer instead of a mapped SGL for small, -+ * single entry buffers. Note that we treat a zero-length transfer like -+ * a mapped SGL. -+ */ -+static bool twa_command_mapped(struct scsi_cmnd *cmd) -+{ -+ return scsi_sg_count(cmd) != 1 || -+ scsi_bufflen(cmd) >= TW_MIN_SGL_LENGTH; -+} -+ - /* This function will complete an aen request from the isr */ - static int twa_aen_complete(TW_Device_Extension *tw_dev, int request_id) - { -@@ -1351,7 +1362,8 @@ static irqreturn_t twa_interrupt(int irq, void *dev_instance) - } - - /* Now complete the io */ -- scsi_dma_unmap(cmd); -+ if (twa_command_mapped(cmd)) -+ scsi_dma_unmap(cmd); - cmd->scsi_done(cmd); - tw_dev->state[request_id] = TW_S_COMPLETED; - twa_free_request_id(tw_dev, request_id); -@@ -1594,7 +1606,8 @@ static int twa_reset_device_extension(TW_Device_Extension *tw_dev) - struct scsi_cmnd *cmd = tw_dev->srb[i]; - - cmd->result = (DID_RESET << 16); -- scsi_dma_unmap(cmd); -+ if (twa_command_mapped(cmd)) -+ scsi_dma_unmap(cmd); - cmd->scsi_done(cmd); - } - } -@@ -1777,12 +1790,14 @@ static int twa_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_ - retval = twa_scsiop_execute_scsi(tw_dev, request_id, NULL, 0, NULL); - switch (retval) { - case SCSI_MLQUEUE_HOST_BUSY: -- scsi_dma_unmap(SCpnt); -+ if (twa_command_mapped(SCpnt)) -+ scsi_dma_unmap(SCpnt); - twa_free_request_id(tw_dev, request_id); - break; - case 1: - SCpnt->result = (DID_ERROR << 16); -- scsi_dma_unmap(SCpnt); -+ if (twa_command_mapped(SCpnt)) -+ scsi_dma_unmap(SCpnt); - done(SCpnt); - tw_dev->state[request_id] = TW_S_COMPLETED; - twa_free_request_id(tw_dev, request_id); -@@ -1843,8 +1858,7 @@ static int twa_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, - /* Map sglist from scsi layer to cmd packet */ - - if (scsi_sg_count(srb)) { -- if ((scsi_sg_count(srb) == 1) && -- (scsi_bufflen(srb) < TW_MIN_SGL_LENGTH)) { -+ if (!twa_command_mapped(srb)) { - if (srb->sc_data_direction == DMA_TO_DEVICE || - srb->sc_data_direction == DMA_BIDIRECTIONAL) - scsi_sg_copy_to_buffer(srb, -@@ -1917,7 +1931,7 @@ static void twa_scsiop_execute_scsi_complete(TW_Device_Extension *tw_dev, int re - { - struct scsi_cmnd *cmd = tw_dev->srb[request_id]; - -- if (scsi_bufflen(cmd) < TW_MIN_SGL_LENGTH && -+ if (!twa_command_mapped(cmd) && - (cmd->sc_data_direction == DMA_FROM_DEVICE || - cmd->sc_data_direction == DMA_BIDIRECTIONAL)) { - if (scsi_sg_count(cmd) == 1) { -diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c -index 96b6664bb1cf..787c8a883c3c 100644 ---- a/drivers/scsi/scsi_error.c -+++ b/drivers/scsi/scsi_error.c -@@ -2149,8 +2149,17 @@ int scsi_error_handler(void *data) - * We never actually get interrupted because kthread_run - * disables signal delivery for the created thread. - */ -- while (!kthread_should_stop()) { -+ while (true) { -+ /* -+ * The sequence in kthread_stop() sets the stop flag first -+ * then wakes the process. To avoid missed wakeups, the task -+ * should always be in a non running state before the stop -+ * flag is checked -+ */ - set_current_state(TASK_INTERRUPTIBLE); -+ if (kthread_should_stop()) -+ break; -+ - if ((shost->host_failed == 0 && shost->host_eh_scheduled == 0) || - shost->host_failed != shost->host_busy) { - SCSI_LOG_ERROR_RECOVERY(1, -diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c -index 458a1480dc07..ebd32379b178 100644 ---- a/drivers/spi/spi-pxa2xx.c -+++ b/drivers/spi/spi-pxa2xx.c -@@ -562,6 +562,10 @@ static irqreturn_t ssp_int(int irq, void *dev_id) - if (!(sccr1_reg & SSCR1_TIE)) - mask &= ~SSSR_TFS; - -+ /* Ignore RX timeout interrupt if it is disabled */ -+ if (!(sccr1_reg & SSCR1_TINTE)) -+ mask &= ~SSSR_TINT; -+ - if (!(status & mask)) - return IRQ_NONE; - -diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c -index f3e3ae8af709..d88492152be1 100644 ---- a/drivers/spi/spi.c -+++ b/drivers/spi/spi.c -@@ -1251,8 +1251,7 @@ static struct class spi_master_class = { - * - * The caller is responsible for assigning the bus number and initializing - * the master's methods before calling spi_register_master(); and (after errors -- * adding the device) calling spi_master_put() and kfree() to prevent a memory -- * leak. -+ * adding the device) calling spi_master_put() to prevent a memory leak. - */ - struct spi_master *spi_alloc_master(struct device *dev, unsigned size) - { -diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c -index 574066ff73f8..c771b37967b2 100644 ---- a/drivers/staging/android/ion/ion.c -+++ b/drivers/staging/android/ion/ion.c -@@ -1119,13 +1119,13 @@ struct ion_handle *ion_import_dma_buf(struct ion_client *client, int fd) - mutex_unlock(&client->lock); - goto end; - } -- mutex_unlock(&client->lock); - - handle = ion_handle_create(client, buffer); -- if (IS_ERR(handle)) -+ if (IS_ERR(handle)) { -+ mutex_unlock(&client->lock); - goto end; -+ } - -- mutex_lock(&client->lock); - ret = ion_handle_add(client, handle); - mutex_unlock(&client->lock); - if (ret) { -diff --git a/drivers/staging/comedi/drivers/usbduxsigma.c b/drivers/staging/comedi/drivers/usbduxsigma.c -index 88c60b6020c4..c4ee9fa1dc91 100644 ---- a/drivers/staging/comedi/drivers/usbduxsigma.c -+++ b/drivers/staging/comedi/drivers/usbduxsigma.c -@@ -575,37 +575,6 @@ static int usbduxsigma_ai_cmdtest(struct comedi_device *dev, - if (err) - return 3; - -- /* Step 4: fix up any arguments */ -- -- if (high_speed) { -- /* -- * every 2 channels get a time window of 125us. Thus, if we -- * sample all 16 channels we need 1ms. If we sample only one -- * channel we need only 125us -- */ -- devpriv->ai_interval = interval; -- devpriv->ai_timer = cmd->scan_begin_arg / (125000 * interval); -- } else { -- /* interval always 1ms */ -- devpriv->ai_interval = 1; -- devpriv->ai_timer = cmd->scan_begin_arg / 1000000; -- } -- if (devpriv->ai_timer < 1) -- err |= -EINVAL; -- -- if (cmd->stop_src == TRIG_COUNT) { -- /* data arrives as one packet */ -- devpriv->ai_sample_count = cmd->stop_arg; -- devpriv->ai_continuous = 0; -- } else { -- /* continuous acquisition */ -- devpriv->ai_continuous = 1; -- devpriv->ai_sample_count = 0; -- } -- -- if (err) -- return 4; -- - return 0; - } - -@@ -704,6 +673,33 @@ static int usbduxsigma_ai_cmd(struct comedi_device *dev, - - /* set current channel of the running acquisition to zero */ - s->async->cur_chan = 0; -+ -+ if (devpriv->high_speed) { -+ /* -+ * every 2 channels get a time window of 125us. Thus, if we -+ * sample all 16 channels we need 1ms. If we sample only one -+ * channel we need only 125us -+ */ -+ unsigned int interval = usbduxsigma_chans_to_interval(len); -+ -+ devpriv->ai_interval = interval; -+ devpriv->ai_timer = cmd->scan_begin_arg / (125000 * interval); -+ } else { -+ /* interval always 1ms */ -+ devpriv->ai_interval = 1; -+ devpriv->ai_timer = cmd->scan_begin_arg / 1000000; -+ } -+ -+ if (cmd->stop_src == TRIG_COUNT) { -+ /* data arrives as one packet */ -+ devpriv->ai_sample_count = cmd->stop_arg; -+ devpriv->ai_continuous = 0; -+ } else { -+ /* continuous acquisition */ -+ devpriv->ai_continuous = 1; -+ devpriv->ai_sample_count = 0; -+ } -+ - for (i = 0; i < len; i++) { - unsigned int chan = CR_CHAN(cmd->chanlist[i]); - -@@ -955,10 +951,24 @@ static int usbduxsigma_ao_cmdtest(struct comedi_device *dev, - if (err) - return 3; - -- /* Step 4: fix up any arguments */ -+ return 0; -+} -+ -+static int usbduxsigma_ao_cmd(struct comedi_device *dev, -+ struct comedi_subdevice *s) -+{ -+ struct usbduxsigma_private *devpriv = dev->private; -+ struct comedi_cmd *cmd = &s->async->cmd; -+ int ret; -+ int i; -+ -+ down(&devpriv->sem); -+ -+ /* set current channel of the running acquisition to zero */ -+ s->async->cur_chan = 0; - - /* we count in timer steps */ -- if (high_speed) { -+ if (cmd->convert_src == TRIG_TIMER) { - /* timing of the conversion itself: every 125 us */ - devpriv->ao_timer = cmd->convert_arg / 125000; - } else { -@@ -968,12 +978,9 @@ static int usbduxsigma_ao_cmdtest(struct comedi_device *dev, - */ - devpriv->ao_timer = cmd->scan_begin_arg / 1000000; - } -- if (devpriv->ao_timer < 1) -- err |= -EINVAL; -- - if (cmd->stop_src == TRIG_COUNT) { - /* not continuous, use counter */ -- if (high_speed) { -+ if (cmd->convert_src == TRIG_TIMER) { - /* high speed also scans everything at once */ - devpriv->ao_sample_count = cmd->stop_arg * - cmd->scan_end_arg; -@@ -992,24 +999,6 @@ static int usbduxsigma_ao_cmdtest(struct comedi_device *dev, - devpriv->ao_sample_count = 0; - } - -- if (err) -- return 4; -- -- return 0; --} -- --static int usbduxsigma_ao_cmd(struct comedi_device *dev, -- struct comedi_subdevice *s) --{ -- struct usbduxsigma_private *devpriv = dev->private; -- struct comedi_cmd *cmd = &s->async->cmd; -- int ret; -- int i; -- -- down(&devpriv->sem); -- -- /* set current channel of the running acquisition to zero */ -- s->async->cur_chan = 0; - for (i = 0; i < cmd->chanlist_len; ++i) - devpriv->ao_chanlist[i] = CR_CHAN(cmd->chanlist[i]); - -diff --git a/drivers/staging/speakup/fakekey.c b/drivers/staging/speakup/fakekey.c -index 4299cf45f947..5e1f16c36b49 100644 ---- a/drivers/staging/speakup/fakekey.c -+++ b/drivers/staging/speakup/fakekey.c -@@ -81,6 +81,7 @@ void speakup_fake_down_arrow(void) - __this_cpu_write(reporting_keystroke, true); - input_report_key(virt_keyboard, KEY_DOWN, PRESSED); - input_report_key(virt_keyboard, KEY_DOWN, RELEASED); -+ input_sync(virt_keyboard); - __this_cpu_write(reporting_keystroke, false); - - /* reenable preemption */ -diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c -index 062967c90b2a..3ecc887eea27 100644 ---- a/drivers/usb/core/config.c -+++ b/drivers/usb/core/config.c -@@ -113,7 +113,7 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno, - cfgno, inum, asnum, ep->desc.bEndpointAddress); - ep->ss_ep_comp.bmAttributes = 16; - } else if (usb_endpoint_xfer_isoc(&ep->desc) && -- desc->bmAttributes > 2) { -+ USB_SS_MULT(desc->bmAttributes) > 3) { - dev_warn(ddev, "Isoc endpoint has Mult of %d in " - "config %d interface %d altsetting %d ep %d: " - "setting to 3\n", desc->bmAttributes + 1, -@@ -122,7 +122,8 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno, - } - - if (usb_endpoint_xfer_isoc(&ep->desc)) -- max_tx = (desc->bMaxBurst + 1) * (desc->bmAttributes + 1) * -+ max_tx = (desc->bMaxBurst + 1) * -+ (USB_SS_MULT(desc->bmAttributes)) * - usb_endpoint_maxp(&ep->desc); - else if (usb_endpoint_xfer_int(&ep->desc)) - max_tx = usb_endpoint_maxp(&ep->desc) * -diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c -index b195fdb1effc..804acc700327 100644 ---- a/drivers/usb/core/quirks.c -+++ b/drivers/usb/core/quirks.c -@@ -54,6 +54,13 @@ static const struct usb_device_id usb_quirk_list[] = { - { USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT }, - { USB_DEVICE(0x046d, 0x0843), .driver_info = USB_QUIRK_DELAY_INIT }, - -+ /* Logitech ConferenceCam CC3000e */ -+ { USB_DEVICE(0x046d, 0x0847), .driver_info = USB_QUIRK_DELAY_INIT }, -+ { USB_DEVICE(0x046d, 0x0848), .driver_info = USB_QUIRK_DELAY_INIT }, -+ -+ /* Logitech PTZ Pro Camera */ -+ { USB_DEVICE(0x046d, 0x0853), .driver_info = USB_QUIRK_DELAY_INIT }, -+ - /* Logitech Quickcam Fusion */ - { USB_DEVICE(0x046d, 0x08c1), .driver_info = USB_QUIRK_RESET_RESUME }, - -@@ -78,6 +85,12 @@ static const struct usb_device_id usb_quirk_list[] = { - /* Philips PSC805 audio device */ - { USB_DEVICE(0x0471, 0x0155), .driver_info = USB_QUIRK_RESET_RESUME }, - -+ /* Plantronic Audio 655 DSP */ -+ { USB_DEVICE(0x047f, 0xc008), .driver_info = USB_QUIRK_RESET_RESUME }, -+ -+ /* Plantronic Audio 648 USB */ -+ { USB_DEVICE(0x047f, 0xc013), .driver_info = USB_QUIRK_RESET_RESUME }, -+ - /* Artisman Watchdog Dongle */ - { USB_DEVICE(0x04b4, 0x0526), .driver_info = - USB_QUIRK_CONFIG_INTF_STRINGS }, -diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c -index f8893b32bbb6..86bfaf904ab5 100644 ---- a/drivers/usb/host/xhci-mem.c -+++ b/drivers/usb/host/xhci-mem.c -@@ -1402,10 +1402,10 @@ int xhci_endpoint_init(struct xhci_hcd *xhci, - * use Event Data TRBs, and we don't chain in a link TRB on short - * transfers, we're basically dividing by 1. - * -- * xHCI 1.0 specification indicates that the Average TRB Length should -- * be set to 8 for control endpoints. -+ * xHCI 1.0 and 1.1 specification indicates that the Average TRB Length -+ * should be set to 8 for control endpoints. - */ -- if (usb_endpoint_xfer_control(&ep->desc) && xhci->hci_version == 0x100) -+ if (usb_endpoint_xfer_control(&ep->desc) && xhci->hci_version >= 0x100) - ep_ctx->tx_info |= cpu_to_le32(AVG_TRB_LENGTH_FOR_EP(8)); - else - ep_ctx->tx_info |= -diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c -index a365e9769fcc..86a0ddd8efb7 100644 ---- a/drivers/usb/host/xhci-ring.c -+++ b/drivers/usb/host/xhci-ring.c -@@ -3223,9 +3223,11 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags, - struct xhci_td *td; - struct scatterlist *sg; - int num_sgs; -- int trb_buff_len, this_sg_len, running_total; -+ int trb_buff_len, this_sg_len, running_total, ret; - unsigned int total_packet_count; -+ bool zero_length_needed; - bool first_trb; -+ int last_trb_num; - u64 addr; - bool more_trbs_coming; - -@@ -3241,13 +3243,27 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags, - total_packet_count = DIV_ROUND_UP(urb->transfer_buffer_length, - usb_endpoint_maxp(&urb->ep->desc)); - -- trb_buff_len = prepare_transfer(xhci, xhci->devs[slot_id], -+ ret = prepare_transfer(xhci, xhci->devs[slot_id], - ep_index, urb->stream_id, - num_trbs, urb, 0, mem_flags); -- if (trb_buff_len < 0) -- return trb_buff_len; -+ if (ret < 0) -+ return ret; - - urb_priv = urb->hcpriv; -+ -+ /* Deal with URB_ZERO_PACKET - need one more td/trb */ -+ zero_length_needed = urb->transfer_flags & URB_ZERO_PACKET && -+ urb_priv->length == 2; -+ if (zero_length_needed) { -+ num_trbs++; -+ xhci_dbg(xhci, "Creating zero length td.\n"); -+ ret = prepare_transfer(xhci, xhci->devs[slot_id], -+ ep_index, urb->stream_id, -+ 1, urb, 1, mem_flags); -+ if (ret < 0) -+ return ret; -+ } -+ - td = urb_priv->td[0]; - - /* -@@ -3277,6 +3293,7 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags, - trb_buff_len = urb->transfer_buffer_length; - - first_trb = true; -+ last_trb_num = zero_length_needed ? 2 : 1; - /* Queue the first TRB, even if it's zero-length */ - do { - u32 field = 0; -@@ -3294,12 +3311,15 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags, - /* Chain all the TRBs together; clear the chain bit in the last - * TRB to indicate it's the last TRB in the chain. - */ -- if (num_trbs > 1) { -+ if (num_trbs > last_trb_num) { - field |= TRB_CHAIN; -- } else { -- /* FIXME - add check for ZERO_PACKET flag before this */ -+ } else if (num_trbs == last_trb_num) { - td->last_trb = ep_ring->enqueue; - field |= TRB_IOC; -+ } else if (zero_length_needed && num_trbs == 1) { -+ trb_buff_len = 0; -+ urb_priv->td[1]->last_trb = ep_ring->enqueue; -+ field |= TRB_IOC; - } - - /* Only set interrupt on short packet for IN endpoints */ -@@ -3361,7 +3381,7 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags, - if (running_total + trb_buff_len > urb->transfer_buffer_length) - trb_buff_len = - urb->transfer_buffer_length - running_total; -- } while (running_total < urb->transfer_buffer_length); -+ } while (num_trbs > 0); - - check_trb_math(urb, num_trbs, running_total); - giveback_first_trb(xhci, slot_id, ep_index, urb->stream_id, -@@ -3379,7 +3399,9 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags, - int num_trbs; - struct xhci_generic_trb *start_trb; - bool first_trb; -+ int last_trb_num; - bool more_trbs_coming; -+ bool zero_length_needed; - int start_cycle; - u32 field, length_field; - -@@ -3410,7 +3432,6 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags, - num_trbs++; - running_total += TRB_MAX_BUFF_SIZE; - } -- /* FIXME: this doesn't deal with URB_ZERO_PACKET - need one more */ - - ret = prepare_transfer(xhci, xhci->devs[slot_id], - ep_index, urb->stream_id, -@@ -3419,6 +3440,20 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags, - return ret; - - urb_priv = urb->hcpriv; -+ -+ /* Deal with URB_ZERO_PACKET - need one more td/trb */ -+ zero_length_needed = urb->transfer_flags & URB_ZERO_PACKET && -+ urb_priv->length == 2; -+ if (zero_length_needed) { -+ num_trbs++; -+ xhci_dbg(xhci, "Creating zero length td.\n"); -+ ret = prepare_transfer(xhci, xhci->devs[slot_id], -+ ep_index, urb->stream_id, -+ 1, urb, 1, mem_flags); -+ if (ret < 0) -+ return ret; -+ } -+ - td = urb_priv->td[0]; - - /* -@@ -3440,7 +3475,7 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags, - trb_buff_len = urb->transfer_buffer_length; - - first_trb = true; -- -+ last_trb_num = zero_length_needed ? 2 : 1; - /* Queue the first TRB, even if it's zero-length */ - do { - u32 remainder = 0; -@@ -3457,12 +3492,15 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags, - /* Chain all the TRBs together; clear the chain bit in the last - * TRB to indicate it's the last TRB in the chain. - */ -- if (num_trbs > 1) { -+ if (num_trbs > last_trb_num) { - field |= TRB_CHAIN; -- } else { -- /* FIXME - add check for ZERO_PACKET flag before this */ -+ } else if (num_trbs == last_trb_num) { - td->last_trb = ep_ring->enqueue; - field |= TRB_IOC; -+ } else if (zero_length_needed && num_trbs == 1) { -+ trb_buff_len = 0; -+ urb_priv->td[1]->last_trb = ep_ring->enqueue; -+ field |= TRB_IOC; - } - - /* Only set interrupt on short packet for IN endpoints */ -@@ -3500,7 +3538,7 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags, - trb_buff_len = urb->transfer_buffer_length - running_total; - if (trb_buff_len > TRB_MAX_BUFF_SIZE) - trb_buff_len = TRB_MAX_BUFF_SIZE; -- } while (running_total < urb->transfer_buffer_length); -+ } while (num_trbs > 0); - - check_trb_math(urb, num_trbs, running_total); - giveback_first_trb(xhci, slot_id, ep_index, urb->stream_id, -@@ -3567,8 +3605,8 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *xhci, gfp_t mem_flags, - if (start_cycle == 0) - field |= 0x1; - -- /* xHCI 1.0 6.4.1.2.1: Transfer Type field */ -- if (xhci->hci_version == 0x100) { -+ /* xHCI 1.0/1.1 6.4.1.2.1: Transfer Type field */ -+ if (xhci->hci_version >= 0x100) { - if (urb->transfer_buffer_length > 0) { - if (setup->bRequestType & USB_DIR_IN) - field |= TRB_TX_TYPE(TRB_DATA_IN); -diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c -index fc61e663b00a..79c7b255e60a 100644 ---- a/drivers/usb/host/xhci.c -+++ b/drivers/usb/host/xhci.c -@@ -147,7 +147,8 @@ static int xhci_start(struct xhci_hcd *xhci) - "waited %u microseconds.\n", - XHCI_MAX_HALT_USEC); - if (!ret) -- xhci->xhc_state &= ~XHCI_STATE_HALTED; -+ xhci->xhc_state &= ~(XHCI_STATE_HALTED | XHCI_STATE_DYING); -+ - return ret; - } - -@@ -1319,6 +1320,11 @@ int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flags) - - if (usb_endpoint_xfer_isoc(&urb->ep->desc)) - size = urb->number_of_packets; -+ else if (usb_endpoint_is_bulk_out(&urb->ep->desc) && -+ urb->transfer_buffer_length > 0 && -+ urb->transfer_flags & URB_ZERO_PACKET && -+ !(urb->transfer_buffer_length % usb_endpoint_maxp(&urb->ep->desc))) -+ size = 2; - else - size = 1; - -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index 096438e4fb0c..c918075e5eae 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -276,6 +276,10 @@ static void option_instat_callback(struct urb *urb); - #define ZTE_PRODUCT_MF622 0x0001 - #define ZTE_PRODUCT_MF628 0x0015 - #define ZTE_PRODUCT_MF626 0x0031 -+#define ZTE_PRODUCT_ZM8620_X 0x0396 -+#define ZTE_PRODUCT_ME3620_MBIM 0x0426 -+#define ZTE_PRODUCT_ME3620_X 0x1432 -+#define ZTE_PRODUCT_ME3620_L 0x1433 - #define ZTE_PRODUCT_AC2726 0xfff1 - #define ZTE_PRODUCT_CDMA_TECH 0xfffe - #define ZTE_PRODUCT_AC8710T 0xffff -@@ -549,6 +553,18 @@ static const struct option_blacklist_info zte_mc2716_z_blacklist = { - .sendsetup = BIT(1) | BIT(2) | BIT(3), - }; - -+static const struct option_blacklist_info zte_me3620_mbim_blacklist = { -+ .reserved = BIT(2) | BIT(3) | BIT(4), -+}; -+ -+static const struct option_blacklist_info zte_me3620_xl_blacklist = { -+ .reserved = BIT(3) | BIT(4) | BIT(5), -+}; -+ -+static const struct option_blacklist_info zte_zm8620_x_blacklist = { -+ .reserved = BIT(3) | BIT(4) | BIT(5), -+}; -+ - static const struct option_blacklist_info huawei_cdc12_blacklist = { - .reserved = BIT(1) | BIT(2), - }; -@@ -1579,6 +1595,14 @@ static const struct usb_device_id option_ids[] = { - .driver_info = (kernel_ulong_t)&zte_ad3812_z_blacklist }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MC2716, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&zte_mc2716_z_blacklist }, -+ { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_ME3620_L), -+ .driver_info = (kernel_ulong_t)&zte_me3620_xl_blacklist }, -+ { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_ME3620_MBIM), -+ .driver_info = (kernel_ulong_t)&zte_me3620_mbim_blacklist }, -+ { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_ME3620_X), -+ .driver_info = (kernel_ulong_t)&zte_me3620_xl_blacklist }, -+ { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_ZM8620_X), -+ .driver_info = (kernel_ulong_t)&zte_zm8620_x_blacklist }, - { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x01) }, - { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x05) }, - { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x86, 0x10) }, -diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c -index 6c3734d2b45a..d3ea90bef84d 100644 ---- a/drivers/usb/serial/whiteheat.c -+++ b/drivers/usb/serial/whiteheat.c -@@ -80,6 +80,8 @@ static int whiteheat_firmware_download(struct usb_serial *serial, - static int whiteheat_firmware_attach(struct usb_serial *serial); - - /* function prototypes for the Connect Tech WhiteHEAT serial converter */ -+static int whiteheat_probe(struct usb_serial *serial, -+ const struct usb_device_id *id); - static int whiteheat_attach(struct usb_serial *serial); - static void whiteheat_release(struct usb_serial *serial); - static int whiteheat_port_probe(struct usb_serial_port *port); -@@ -116,6 +118,7 @@ static struct usb_serial_driver whiteheat_device = { - .description = "Connect Tech - WhiteHEAT", - .id_table = id_table_std, - .num_ports = 4, -+ .probe = whiteheat_probe, - .attach = whiteheat_attach, - .release = whiteheat_release, - .port_probe = whiteheat_port_probe, -@@ -217,6 +220,34 @@ static int whiteheat_firmware_attach(struct usb_serial *serial) - /***************************************************************************** - * Connect Tech's White Heat serial driver functions - *****************************************************************************/ -+ -+static int whiteheat_probe(struct usb_serial *serial, -+ const struct usb_device_id *id) -+{ -+ struct usb_host_interface *iface_desc; -+ struct usb_endpoint_descriptor *endpoint; -+ size_t num_bulk_in = 0; -+ size_t num_bulk_out = 0; -+ size_t min_num_bulk; -+ unsigned int i; -+ -+ iface_desc = serial->interface->cur_altsetting; -+ -+ for (i = 0; i < iface_desc->desc.bNumEndpoints; i++) { -+ endpoint = &iface_desc->endpoint[i].desc; -+ if (usb_endpoint_is_bulk_in(endpoint)) -+ ++num_bulk_in; -+ if (usb_endpoint_is_bulk_out(endpoint)) -+ ++num_bulk_out; -+ } -+ -+ min_num_bulk = COMMAND_PORT + 1; -+ if (num_bulk_in < min_num_bulk || num_bulk_out < min_num_bulk) -+ return -ENODEV; -+ -+ return 0; -+} -+ - static int whiteheat_attach(struct usb_serial *serial) - { - struct usb_serial_port *command_port; -diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c -index 8adfc65b37dd..332999288b51 100644 ---- a/fs/btrfs/extent_io.c -+++ b/fs/btrfs/extent_io.c -@@ -2681,7 +2681,8 @@ static int submit_extent_page(int rw, struct extent_io_tree *tree, - bio_end_io_t end_io_func, - int mirror_num, - unsigned long prev_bio_flags, -- unsigned long bio_flags) -+ unsigned long bio_flags, -+ bool force_bio_submit) - { - int ret = 0; - struct bio *bio; -@@ -2699,6 +2700,7 @@ static int submit_extent_page(int rw, struct extent_io_tree *tree, - contig = bio_end_sector(bio) == sector; - - if (prev_bio_flags != bio_flags || !contig || -+ force_bio_submit || - merge_bio(rw, tree, page, offset, page_size, bio, bio_flags) || - bio_add_page(bio, page, page_size, offset) < page_size) { - ret = submit_one_bio(rw, bio, mirror_num, -@@ -2790,7 +2792,8 @@ static int __do_readpage(struct extent_io_tree *tree, - get_extent_t *get_extent, - struct extent_map **em_cached, - struct bio **bio, int mirror_num, -- unsigned long *bio_flags, int rw) -+ unsigned long *bio_flags, int rw, -+ u64 *prev_em_start) - { - struct inode *inode = page->mapping->host; - u64 start = page_offset(page); -@@ -2838,6 +2841,7 @@ static int __do_readpage(struct extent_io_tree *tree, - } - while (cur <= end) { - unsigned long pnr = (last_byte >> PAGE_CACHE_SHIFT) + 1; -+ bool force_bio_submit = false; - - if (cur >= last_byte) { - char *userpage; -@@ -2888,6 +2892,49 @@ static int __do_readpage(struct extent_io_tree *tree, - block_start = em->block_start; - if (test_bit(EXTENT_FLAG_PREALLOC, &em->flags)) - block_start = EXTENT_MAP_HOLE; -+ -+ /* -+ * If we have a file range that points to a compressed extent -+ * and it's followed by a consecutive file range that points to -+ * to the same compressed extent (possibly with a different -+ * offset and/or length, so it either points to the whole extent -+ * or only part of it), we must make sure we do not submit a -+ * single bio to populate the pages for the 2 ranges because -+ * this makes the compressed extent read zero out the pages -+ * belonging to the 2nd range. Imagine the following scenario: -+ * -+ * File layout -+ * [0 - 8K] [8K - 24K] -+ * | | -+ * | | -+ * points to extent X, points to extent X, -+ * offset 4K, length of 8K offset 0, length 16K -+ * -+ * [extent X, compressed length = 4K uncompressed length = 16K] -+ * -+ * If the bio to read the compressed extent covers both ranges, -+ * it will decompress extent X into the pages belonging to the -+ * first range and then it will stop, zeroing out the remaining -+ * pages that belong to the other range that points to extent X. -+ * So here we make sure we submit 2 bios, one for the first -+ * range and another one for the third range. Both will target -+ * the same physical extent from disk, but we can't currently -+ * make the compressed bio endio callback populate the pages -+ * for both ranges because each compressed bio is tightly -+ * coupled with a single extent map, and each range can have -+ * an extent map with a different offset value relative to the -+ * uncompressed data of our extent and different lengths. This -+ * is a corner case so we prioritize correctness over -+ * non-optimal behavior (submitting 2 bios for the same extent). -+ */ -+ if (test_bit(EXTENT_FLAG_COMPRESSED, &em->flags) && -+ prev_em_start && *prev_em_start != (u64)-1 && -+ *prev_em_start != em->orig_start) -+ force_bio_submit = true; -+ -+ if (prev_em_start) -+ *prev_em_start = em->orig_start; -+ - free_extent_map(em); - em = NULL; - -@@ -2937,7 +2984,8 @@ static int __do_readpage(struct extent_io_tree *tree, - bdev, bio, pnr, - end_bio_extent_readpage, mirror_num, - *bio_flags, -- this_bio_flag); -+ this_bio_flag, -+ force_bio_submit); - if (!ret) { - nr++; - *bio_flags = this_bio_flag; -@@ -2964,7 +3012,8 @@ static inline void __do_contiguous_readpages(struct extent_io_tree *tree, - get_extent_t *get_extent, - struct extent_map **em_cached, - struct bio **bio, int mirror_num, -- unsigned long *bio_flags, int rw) -+ unsigned long *bio_flags, int rw, -+ u64 *prev_em_start) - { - struct inode *inode; - struct btrfs_ordered_extent *ordered; -@@ -2984,7 +3033,7 @@ static inline void __do_contiguous_readpages(struct extent_io_tree *tree, - - for (index = 0; index < nr_pages; index++) { - __do_readpage(tree, pages[index], get_extent, em_cached, bio, -- mirror_num, bio_flags, rw); -+ mirror_num, bio_flags, rw, prev_em_start); - page_cache_release(pages[index]); - } - } -@@ -2994,7 +3043,8 @@ static void __extent_readpages(struct extent_io_tree *tree, - int nr_pages, get_extent_t *get_extent, - struct extent_map **em_cached, - struct bio **bio, int mirror_num, -- unsigned long *bio_flags, int rw) -+ unsigned long *bio_flags, int rw, -+ u64 *prev_em_start) - { - u64 start = 0; - u64 end = 0; -@@ -3015,7 +3065,7 @@ static void __extent_readpages(struct extent_io_tree *tree, - index - first_index, start, - end, get_extent, em_cached, - bio, mirror_num, bio_flags, -- rw); -+ rw, prev_em_start); - start = page_start; - end = start + PAGE_CACHE_SIZE - 1; - first_index = index; -@@ -3026,7 +3076,8 @@ static void __extent_readpages(struct extent_io_tree *tree, - __do_contiguous_readpages(tree, &pages[first_index], - index - first_index, start, - end, get_extent, em_cached, bio, -- mirror_num, bio_flags, rw); -+ mirror_num, bio_flags, rw, -+ prev_em_start); - } - - static int __extent_read_full_page(struct extent_io_tree *tree, -@@ -3052,7 +3103,7 @@ static int __extent_read_full_page(struct extent_io_tree *tree, - } - - ret = __do_readpage(tree, page, get_extent, NULL, bio, mirror_num, -- bio_flags, rw); -+ bio_flags, rw, NULL); - return ret; - } - -@@ -3078,7 +3129,7 @@ int extent_read_full_page_nolock(struct extent_io_tree *tree, struct page *page, - int ret; - - ret = __do_readpage(tree, page, get_extent, NULL, &bio, mirror_num, -- &bio_flags, READ); -+ &bio_flags, READ, NULL); - if (bio) - ret = submit_one_bio(READ, bio, mirror_num, bio_flags); - return ret; -@@ -3347,7 +3398,7 @@ static int __extent_writepage(struct page *page, struct writeback_control *wbc, - sector, iosize, pg_offset, - bdev, &epd->bio, max_nr, - end_bio_extent_writepage, -- 0, 0, 0); -+ 0, 0, 0, false); - if (ret) - SetPageError(page); - } -@@ -3516,7 +3567,7 @@ static int write_one_eb(struct extent_buffer *eb, - ret = submit_extent_page(rw, tree, p, offset >> 9, - PAGE_CACHE_SIZE, 0, bdev, &epd->bio, - -1, end_bio_extent_buffer_writepage, -- 0, epd->bio_flags, bio_flags); -+ 0, epd->bio_flags, bio_flags, false); - epd->bio_flags = bio_flags; - if (ret) { - set_bit(EXTENT_BUFFER_IOERR, &eb->bflags); -@@ -3918,6 +3969,7 @@ int extent_readpages(struct extent_io_tree *tree, - struct page *page; - struct extent_map *em_cached = NULL; - int nr = 0; -+ u64 prev_em_start = (u64)-1; - - for (page_idx = 0; page_idx < nr_pages; page_idx++) { - page = list_entry(pages->prev, struct page, lru); -@@ -3934,12 +3986,12 @@ int extent_readpages(struct extent_io_tree *tree, - if (nr < ARRAY_SIZE(pagepool)) - continue; - __extent_readpages(tree, pagepool, nr, get_extent, &em_cached, -- &bio, 0, &bio_flags, READ); -+ &bio, 0, &bio_flags, READ, &prev_em_start); - nr = 0; - } - if (nr) - __extent_readpages(tree, pagepool, nr, get_extent, &em_cached, -- &bio, 0, &bio_flags, READ); -+ &bio, 0, &bio_flags, READ, &prev_em_start); - - if (em_cached) - free_extent_map(em_cached); -diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index 653cdd85e0f2..eaf8699ed559 100644 ---- a/fs/btrfs/inode.c -+++ b/fs/btrfs/inode.c -@@ -4668,7 +4668,8 @@ void btrfs_evict_inode(struct inode *inode) - goto no_delete; - } - /* do we really want it for ->i_nlink > 0 and zero btrfs_root_refs? */ -- btrfs_wait_ordered_range(inode, 0, (u64)-1); -+ if (!special_file(inode->i_mode)) -+ btrfs_wait_ordered_range(inode, 0, (u64)-1); - - if (root->fs_info->log_root_recovering) { - BUG_ON(test_bit(BTRFS_INODE_HAS_ORPHAN_ITEM, -diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c -index 4934347321d3..3299778391fd 100644 ---- a/fs/cifs/cifsencrypt.c -+++ b/fs/cifs/cifsencrypt.c -@@ -441,6 +441,48 @@ find_domain_name(struct cifs_ses *ses, const struct nls_table *nls_cp) - return 0; - } - -+/* Server has provided av pairs/target info in the type 2 challenge -+ * packet and we have plucked it and stored within smb session. -+ * We parse that blob here to find the server given timestamp -+ * as part of ntlmv2 authentication (or local current time as -+ * default in case of failure) -+ */ -+static __le64 -+find_timestamp(struct cifs_ses *ses) -+{ -+ unsigned int attrsize; -+ unsigned int type; -+ unsigned int onesize = sizeof(struct ntlmssp2_name); -+ unsigned char *blobptr; -+ unsigned char *blobend; -+ struct ntlmssp2_name *attrptr; -+ -+ if (!ses->auth_key.len || !ses->auth_key.response) -+ return 0; -+ -+ blobptr = ses->auth_key.response; -+ blobend = blobptr + ses->auth_key.len; -+ -+ while (blobptr + onesize < blobend) { -+ attrptr = (struct ntlmssp2_name *) blobptr; -+ type = le16_to_cpu(attrptr->type); -+ if (type == NTLMSSP_AV_EOL) -+ break; -+ blobptr += 2; /* advance attr type */ -+ attrsize = le16_to_cpu(attrptr->length); -+ blobptr += 2; /* advance attr size */ -+ if (blobptr + attrsize > blobend) -+ break; -+ if (type == NTLMSSP_AV_TIMESTAMP) { -+ if (attrsize == sizeof(u64)) -+ return *((__le64 *)blobptr); -+ } -+ blobptr += attrsize; /* advance attr value */ -+ } -+ -+ return cpu_to_le64(cifs_UnixTimeToNT(CURRENT_TIME)); -+} -+ - static int calc_ntlmv2_hash(struct cifs_ses *ses, char *ntlmv2_hash, - const struct nls_table *nls_cp) - { -@@ -637,6 +679,7 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp) - struct ntlmv2_resp *ntlmv2; - char ntlmv2_hash[16]; - unsigned char *tiblob = NULL; /* target info blob */ -+ __le64 rsp_timestamp; - - if (ses->server->negflavor == CIFS_NEGFLAVOR_EXTENDED) { - if (!ses->domainName) { -@@ -655,6 +698,12 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp) - } - } - -+ /* Must be within 5 minutes of the server (or in range +/-2h -+ * in case of Mac OS X), so simply carry over server timestamp -+ * (as Windows 7 does) -+ */ -+ rsp_timestamp = find_timestamp(ses); -+ - baselen = CIFS_SESS_KEY_SIZE + sizeof(struct ntlmv2_resp); - tilen = ses->auth_key.len; - tiblob = ses->auth_key.response; -@@ -671,8 +720,8 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp) - (ses->auth_key.response + CIFS_SESS_KEY_SIZE); - ntlmv2->blob_signature = cpu_to_le32(0x00000101); - ntlmv2->reserved = 0; -- /* Must be within 5 minutes of the server */ -- ntlmv2->time = cpu_to_le64(cifs_UnixTimeToNT(CURRENT_TIME)); -+ ntlmv2->time = rsp_timestamp; -+ - get_random_bytes(&ntlmv2->client_chal, sizeof(ntlmv2->client_chal)); - ntlmv2->reserved2 = 0; - -diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c -index 30f3eb5bc022..6aeb1de0fa23 100644 ---- a/fs/cifs/smb2ops.c -+++ b/fs/cifs/smb2ops.c -@@ -49,9 +49,13 @@ change_conf(struct TCP_Server_Info *server) - break; - default: - server->echoes = true; -- server->oplocks = true; -+ if (enable_oplocks) { -+ server->oplocks = true; -+ server->oplock_credits = 1; -+ } else -+ server->oplocks = false; -+ - server->echo_credits = 1; -- server->oplock_credits = 1; - } - server->credits -= server->echo_credits + server->oplock_credits; - return 0; -diff --git a/fs/dcache.c b/fs/dcache.c -index df323f809e03..65ccdf0e2854 100644 ---- a/fs/dcache.c -+++ b/fs/dcache.c -@@ -2787,6 +2787,13 @@ restart: - - if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) { - struct mount *parent = ACCESS_ONCE(mnt->mnt_parent); -+ /* Escaped? */ -+ if (dentry != vfsmnt->mnt_root) { -+ bptr = *buffer; -+ blen = *buflen; -+ error = 3; -+ break; -+ } - /* Global root? */ - if (mnt != parent) { - dentry = ACCESS_ONCE(mnt->mnt_mountpoint); -diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c -index b892355f1944..d4c7e470dec8 100644 ---- a/fs/jbd2/checkpoint.c -+++ b/fs/jbd2/checkpoint.c -@@ -475,14 +475,15 @@ int jbd2_cleanup_journal_tail(journal_t *journal) - * journal_clean_one_cp_list - * - * Find all the written-back checkpoint buffers in the given list and -- * release them. -+ * release them. If 'destroy' is set, clean all buffers unconditionally. - * - * Called with the journal locked. - * Called with j_list_lock held. - * Returns number of buffers reaped (for debug) - */ - --static int journal_clean_one_cp_list(struct journal_head *jh, int *released) -+static int journal_clean_one_cp_list(struct journal_head *jh, bool destroy, -+ int *released) - { - struct journal_head *last_jh; - struct journal_head *next_jh = jh; -@@ -496,7 +497,10 @@ static int journal_clean_one_cp_list(struct journal_head *jh, int *released) - do { - jh = next_jh; - next_jh = jh->b_cpnext; -- ret = __try_to_free_cp_buf(jh); -+ if (!destroy) -+ ret = __try_to_free_cp_buf(jh); -+ else -+ ret = __jbd2_journal_remove_checkpoint(jh) + 1; - if (ret) { - freed++; - if (ret == 2) { -@@ -521,13 +525,14 @@ static int journal_clean_one_cp_list(struct journal_head *jh, int *released) - * journal_clean_checkpoint_list - * - * Find all the written-back checkpoint buffers in the journal and release them. -+ * If 'destroy' is set, release all buffers unconditionally. - * - * Called with the journal locked. - * Called with j_list_lock held. - * Returns number of buffers reaped (for debug) - */ - --int __jbd2_journal_clean_checkpoint_list(journal_t *journal) -+int __jbd2_journal_clean_checkpoint_list(journal_t *journal, bool destroy) - { - transaction_t *transaction, *last_transaction, *next_transaction; - int ret = 0; -@@ -543,7 +548,7 @@ int __jbd2_journal_clean_checkpoint_list(journal_t *journal) - transaction = next_transaction; - next_transaction = transaction->t_cpnext; - ret += journal_clean_one_cp_list(transaction-> -- t_checkpoint_list, &released); -+ t_checkpoint_list, destroy, &released); - /* - * This function only frees up some memory if possible so we - * dont have an obligation to finish processing. Bail out if -@@ -559,7 +564,7 @@ int __jbd2_journal_clean_checkpoint_list(journal_t *journal) - * we can possibly see not yet submitted buffers on io_list - */ - ret += journal_clean_one_cp_list(transaction-> -- t_checkpoint_io_list, &released); -+ t_checkpoint_io_list, destroy, &released); - if (need_resched()) - goto out; - } while (transaction != last_transaction); -@@ -568,6 +573,28 @@ out: - } - - /* -+ * Remove buffers from all checkpoint lists as journal is aborted and we just -+ * need to free memory -+ */ -+void jbd2_journal_destroy_checkpoint(journal_t *journal) -+{ -+ /* -+ * We loop because __jbd2_journal_clean_checkpoint_list() may abort -+ * early due to a need of rescheduling. -+ */ -+ while (1) { -+ spin_lock(&journal->j_list_lock); -+ if (!journal->j_checkpoint_transactions) { -+ spin_unlock(&journal->j_list_lock); -+ break; -+ } -+ __jbd2_journal_clean_checkpoint_list(journal, true); -+ spin_unlock(&journal->j_list_lock); -+ cond_resched(); -+ } -+} -+ -+/* - * journal_remove_checkpoint: called after a buffer has been committed - * to disk (either by being write-back flushed to disk, or being - * committed to the log). -diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c -index 9181c2b22b3c..4207cf2caa87 100644 ---- a/fs/jbd2/commit.c -+++ b/fs/jbd2/commit.c -@@ -510,7 +510,7 @@ void jbd2_journal_commit_transaction(journal_t *journal) - * frees some memory - */ - spin_lock(&journal->j_list_lock); -- __jbd2_journal_clean_checkpoint_list(journal); -+ __jbd2_journal_clean_checkpoint_list(journal, false); - spin_unlock(&journal->j_list_lock); - - jbd_debug(3, "JBD2: commit phase 1\n"); -diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c -index e8d62d742435..3b607a8609c4 100644 ---- a/fs/jbd2/journal.c -+++ b/fs/jbd2/journal.c -@@ -1708,8 +1708,17 @@ int jbd2_journal_destroy(journal_t *journal) - while (journal->j_checkpoint_transactions != NULL) { - spin_unlock(&journal->j_list_lock); - mutex_lock(&journal->j_checkpoint_mutex); -- jbd2_log_do_checkpoint(journal); -+ err = jbd2_log_do_checkpoint(journal); - mutex_unlock(&journal->j_checkpoint_mutex); -+ /* -+ * If checkpointing failed, just free the buffers to avoid -+ * looping forever -+ */ -+ if (err) { -+ jbd2_journal_destroy_checkpoint(journal); -+ spin_lock(&journal->j_list_lock); -+ break; -+ } - spin_lock(&journal->j_list_lock); - } - -diff --git a/fs/namei.c b/fs/namei.c -index c6fa07942b2a..f4f6460b6958 100644 ---- a/fs/namei.c -+++ b/fs/namei.c -@@ -484,6 +484,24 @@ void path_put(const struct path *path) - } - EXPORT_SYMBOL(path_put); - -+/** -+ * path_connected - Verify that a path->dentry is below path->mnt.mnt_root -+ * @path: nameidate to verify -+ * -+ * Rename can sometimes move a file or directory outside of a bind -+ * mount, path_connected allows those cases to be detected. -+ */ -+static bool path_connected(const struct path *path) -+{ -+ struct vfsmount *mnt = path->mnt; -+ -+ /* Only bind mounts can have disconnected paths */ -+ if (mnt->mnt_root == mnt->mnt_sb->s_root) -+ return true; -+ -+ return is_subdir(path->dentry, mnt->mnt_root); -+} -+ - /* - * Path walking has 2 modes, rcu-walk and ref-walk (see - * Documentation/filesystems/path-lookup.txt). In situations when we can't -@@ -1149,6 +1167,8 @@ static int follow_dotdot_rcu(struct nameidata *nd) - goto failed; - nd->path.dentry = parent; - nd->seq = seq; -+ if (unlikely(!path_connected(&nd->path))) -+ goto failed; - break; - } - if (!follow_up_rcu(&nd->path)) -@@ -1242,7 +1262,7 @@ static void follow_mount(struct path *path) - } - } - --static void follow_dotdot(struct nameidata *nd) -+static int follow_dotdot(struct nameidata *nd) - { - if (!nd->root.mnt) - set_root(nd); -@@ -1258,6 +1278,10 @@ static void follow_dotdot(struct nameidata *nd) - /* rare case of legitimate dget_parent()... */ - nd->path.dentry = dget_parent(nd->path.dentry); - dput(old); -+ if (unlikely(!path_connected(&nd->path))) { -+ path_put(&nd->path); -+ return -ENOENT; -+ } - break; - } - if (!follow_up(&nd->path)) -@@ -1265,6 +1289,7 @@ static void follow_dotdot(struct nameidata *nd) - } - follow_mount(&nd->path); - nd->inode = nd->path.dentry->d_inode; -+ return 0; - } - - /* -@@ -1488,7 +1513,7 @@ static inline int handle_dots(struct nameidata *nd, int type) - if (follow_dotdot_rcu(nd)) - return -ECHILD; - } else -- follow_dotdot(nd); -+ return follow_dotdot(nd); - } - return 0; - } -@@ -2214,7 +2239,7 @@ mountpoint_last(struct nameidata *nd, struct path *path) - if (unlikely(nd->last_type != LAST_NORM)) { - error = handle_dots(nd, nd->last_type); - if (error) -- goto out; -+ return error; - dentry = dget(nd->path.dentry); - goto done; - } -diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h -index e1fb0f613a99..385593d748f6 100644 ---- a/include/linux/jbd2.h -+++ b/include/linux/jbd2.h -@@ -1042,8 +1042,9 @@ void jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block); - extern void jbd2_journal_commit_transaction(journal_t *); - - /* Checkpoint list management */ --int __jbd2_journal_clean_checkpoint_list(journal_t *journal); -+int __jbd2_journal_clean_checkpoint_list(journal_t *journal, bool destroy); - int __jbd2_journal_remove_checkpoint(struct journal_head *); -+void jbd2_journal_destroy_checkpoint(journal_t *journal); - void __jbd2_journal_insert_checkpoint(struct journal_head *, transaction_t *); - - -diff --git a/include/linux/security.h b/include/linux/security.h -index 2fc42d191f79..2a8f853750c7 100644 ---- a/include/linux/security.h -+++ b/include/linux/security.h -@@ -2452,7 +2452,7 @@ static inline int security_task_prctl(int option, unsigned long arg2, - unsigned long arg4, - unsigned long arg5) - { -- return cap_task_prctl(option, arg2, arg3, arg3, arg5); -+ return cap_task_prctl(option, arg2, arg3, arg4, arg5); - } - - static inline void security_task_to_inode(struct task_struct *p, struct inode *inode) -diff --git a/include/xen/interface/sched.h b/include/xen/interface/sched.h -index 9ce083960a25..f18490985fc8 100644 ---- a/include/xen/interface/sched.h -+++ b/include/xen/interface/sched.h -@@ -107,5 +107,13 @@ struct sched_watchdog { - #define SHUTDOWN_suspend 2 /* Clean up, save suspend info, kill. */ - #define SHUTDOWN_crash 3 /* Tell controller we've crashed. */ - #define SHUTDOWN_watchdog 4 /* Restart because watchdog time expired. */ -+/* -+ * Domain asked to perform 'soft reset' for it. The expected behavior is to -+ * reset internal Xen state for the domain returning it to the point where it -+ * was created but leaving the domain's memory contents and vCPU contexts -+ * intact. This will allow the domain to start over and set up all Xen specific -+ * interfaces again. -+ */ -+#define SHUTDOWN_soft_reset 5 - - #endif /* __XEN_PUBLIC_SCHED_H__ */ -diff --git a/ipc/msg.c b/ipc/msg.c -index 649853105a5d..4a036c619607 100644 ---- a/ipc/msg.c -+++ b/ipc/msg.c -@@ -202,13 +202,6 @@ static int newque(struct ipc_namespace *ns, struct ipc_params *params) - return retval; - } - -- /* ipc_addid() locks msq upon success. */ -- id = ipc_addid(&msg_ids(ns), &msq->q_perm, ns->msg_ctlmni); -- if (id < 0) { -- ipc_rcu_putref(msq, msg_rcu_free); -- return id; -- } -- - msq->q_stime = msq->q_rtime = 0; - msq->q_ctime = get_seconds(); - msq->q_cbytes = msq->q_qnum = 0; -@@ -218,6 +211,13 @@ static int newque(struct ipc_namespace *ns, struct ipc_params *params) - INIT_LIST_HEAD(&msq->q_receivers); - INIT_LIST_HEAD(&msq->q_senders); - -+ /* ipc_addid() locks msq upon success. */ -+ id = ipc_addid(&msg_ids(ns), &msq->q_perm, ns->msg_ctlmni); -+ if (id < 0) { -+ ipc_rcu_putref(msq, msg_rcu_free); -+ return id; -+ } -+ - ipc_unlock_object(&msq->q_perm); - rcu_read_unlock(); - -diff --git a/ipc/shm.c b/ipc/shm.c -index 76459616a7fa..ada866d768a6 100644 ---- a/ipc/shm.c -+++ b/ipc/shm.c -@@ -543,12 +543,6 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params) - if (IS_ERR(file)) - goto no_file; - -- id = ipc_addid(&shm_ids(ns), &shp->shm_perm, ns->shm_ctlmni); -- if (id < 0) { -- error = id; -- goto no_id; -- } -- - shp->shm_cprid = task_tgid_vnr(current); - shp->shm_lprid = 0; - shp->shm_atim = shp->shm_dtim = 0; -@@ -558,6 +552,12 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params) - shp->shm_file = file; - shp->shm_creator = current; - -+ id = ipc_addid(&shm_ids(ns), &shp->shm_perm, ns->shm_ctlmni); -+ if (id < 0) { -+ error = id; -+ goto no_id; -+ } -+ - /* - * shmid gets reported as "inode#" in /proc/pid/maps. - * proc-ps tools use this. Changing this will break them. -diff --git a/ipc/util.c b/ipc/util.c -index e1b4c6db8aa0..cdb19ce3f358 100644 ---- a/ipc/util.c -+++ b/ipc/util.c -@@ -277,6 +277,10 @@ int ipc_addid(struct ipc_ids *ids, struct kern_ipc_perm *new, int size) - rcu_read_lock(); - spin_lock(&new->lock); - -+ current_euid_egid(&euid, &egid); -+ new->cuid = new->uid = euid; -+ new->gid = new->cgid = egid; -+ - id = idr_alloc(&ids->ipcs_idr, new, - (next_id < 0) ? 0 : ipcid_to_idx(next_id), 0, - GFP_NOWAIT); -@@ -289,10 +293,6 @@ int ipc_addid(struct ipc_ids *ids, struct kern_ipc_perm *new, int size) - - ids->in_use++; - -- current_euid_egid(&euid, &egid); -- new->cuid = new->uid = euid; -- new->gid = new->cgid = egid; -- - if (next_id < 0) { - new->seq = ids->seq++; - if (ids->seq > IPCID_SEQ_MAX) -diff --git a/kernel/irq/proc.c b/kernel/irq/proc.c -index 095cd7230aef..56d7272199ff 100644 ---- a/kernel/irq/proc.c -+++ b/kernel/irq/proc.c -@@ -12,6 +12,7 @@ - #include - #include - #include -+#include - - #include "internals.h" - -@@ -326,18 +327,29 @@ void register_handler_proc(unsigned int irq, struct irqaction *action) - - void register_irq_proc(unsigned int irq, struct irq_desc *desc) - { -+ static DEFINE_MUTEX(register_lock); - char name [MAX_NAMELEN]; - -- if (!root_irq_dir || (desc->irq_data.chip == &no_irq_chip) || desc->dir) -+ if (!root_irq_dir || (desc->irq_data.chip == &no_irq_chip)) - return; - -+ /* -+ * irq directories are registered only when a handler is -+ * added, not when the descriptor is created, so multiple -+ * tasks might try to register at the same time. -+ */ -+ mutex_lock(®ister_lock); -+ -+ if (desc->dir) -+ goto out_unlock; -+ - memset(name, 0, MAX_NAMELEN); - sprintf(name, "%d", irq); - - /* create /proc/irq/1234 */ - desc->dir = proc_mkdir(name, root_irq_dir); - if (!desc->dir) -- return; -+ goto out_unlock; - - #ifdef CONFIG_SMP - /* create /proc/irq//smp_affinity */ -@@ -358,6 +370,9 @@ void register_irq_proc(unsigned int irq, struct irq_desc *desc) - - proc_create_data("spurious", 0444, desc->dir, - &irq_spurious_proc_fops, (void *)(long)irq); -+ -+out_unlock: -+ mutex_unlock(®ister_lock); - } - - void unregister_irq_proc(unsigned int irq, struct irq_desc *desc) -diff --git a/kernel/sched/core.c b/kernel/sched/core.c -index 5e973efc036e..a19262a7d70b 100644 ---- a/kernel/sched/core.c -+++ b/kernel/sched/core.c -@@ -2136,11 +2136,11 @@ static void finish_task_switch(struct rq *rq, struct task_struct *prev) - * If a task dies, then it sets TASK_DEAD in tsk->state and calls - * schedule one last time. The schedule call will never return, and - * the scheduled task must drop that reference. -- * The test for TASK_DEAD must occur while the runqueue locks are -- * still held, otherwise prev could be scheduled on another cpu, die -- * there before we look at prev->state, and then the reference would -- * be dropped twice. -- * Manfred Spraul -+ * -+ * We must observe prev->state before clearing prev->on_cpu (in -+ * finish_lock_switch), otherwise a concurrent wakeup can get prev -+ * running on another CPU and we could rave with its RUNNING -> DEAD -+ * transition, resulting in a double drop. - */ - prev_state = prev->state; - vtime_task_switch(prev); -diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h -index f964add50f38..835b6efa8bd6 100644 ---- a/kernel/sched/sched.h -+++ b/kernel/sched/sched.h -@@ -994,9 +994,10 @@ static inline void finish_lock_switch(struct rq *rq, struct task_struct *prev) - * After ->on_cpu is cleared, the task can be moved to a different CPU. - * We must ensure this doesn't happen until the switch is completely - * finished. -+ * -+ * Pairs with the control dependency and rmb in try_to_wake_up(). - */ -- smp_wmb(); -- prev->on_cpu = 0; -+ smp_store_release(&prev->on_cpu, 0); - #endif - #ifdef CONFIG_DEBUG_SPINLOCK - /* this is a valid case when another task releases the spinlock */ -diff --git a/mm/hugetlb.c b/mm/hugetlb.c -index c3e8660cb616..86cbb2f13715 100644 ---- a/mm/hugetlb.c -+++ b/mm/hugetlb.c -@@ -2615,6 +2615,14 @@ static int unmap_ref_private(struct mm_struct *mm, struct vm_area_struct *vma, - continue; - - /* -+ * Shared VMAs have their own reserves and do not affect -+ * MAP_PRIVATE accounting but it is possible that a shared -+ * VMA is using the same page so check and skip such VMAs. -+ */ -+ if (iter_vma->vm_flags & VM_MAYSHARE) -+ continue; -+ -+ /* - * Unmap the page from other VMAs without their own reserves. - * They get marked to be SIGKILLed if they fault in these - * areas. This is because a future no-page fault on this VMA -diff --git a/mm/slab.c b/mm/slab.c -index 0b1c2a58559d..844ea1e89568 100644 ---- a/mm/slab.c -+++ b/mm/slab.c -@@ -2271,9 +2271,16 @@ __kmem_cache_create (struct kmem_cache *cachep, unsigned long flags) - size += BYTES_PER_WORD; - } - #if FORCED_DEBUG && defined(CONFIG_DEBUG_PAGEALLOC) -- if (size >= kmalloc_size(INDEX_NODE + 1) -- && cachep->object_size > cache_line_size() -- && ALIGN(size, cachep->align) < PAGE_SIZE) { -+ /* -+ * To activate debug pagealloc, off-slab management is necessary -+ * requirement. In early phase of initialization, small sized slab -+ * doesn't get initialized so it would not be possible. So, we need -+ * to check size >= 256. It guarantees that all necessary small -+ * sized slab is initialized in current slab initialization sequence. -+ */ -+ if (!slab_early_init && size >= kmalloc_size(INDEX_NODE) && -+ size >= 256 && cachep->object_size > cache_line_size() && -+ ALIGN(size, cachep->align) < PAGE_SIZE) { - cachep->obj_offset += PAGE_SIZE - ALIGN(size, cachep->align); - size = PAGE_SIZE; - } -diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c -index aeedc3a961a1..99ae718b79be 100644 ---- a/net/core/fib_rules.c -+++ b/net/core/fib_rules.c -@@ -631,7 +631,7 @@ static int dump_rules(struct sk_buff *skb, struct netlink_callback *cb, - err = fib_nl_fill_rule(skb, rule, NETLINK_CB(cb->skb).portid, - cb->nlh->nlmsg_seq, RTM_NEWRULE, - NLM_F_MULTI, ops); -- if (err) -+ if (err < 0) - break; - skip: - idx++; -diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c -index a8027e73b6a2..a108953a8c2c 100644 ---- a/net/netfilter/ipvs/ip_vs_sync.c -+++ b/net/netfilter/ipvs/ip_vs_sync.c -@@ -612,7 +612,7 @@ static void ip_vs_sync_conn_v0(struct net *net, struct ip_vs_conn *cp, - pkts = atomic_add_return(1, &cp->in_pkts); - else - pkts = sysctl_sync_threshold(ipvs); -- ip_vs_sync_conn(net, cp->control, pkts); -+ ip_vs_sync_conn(net, cp, pkts); - } - } - -diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c -index 1692e7534759..c3d204973dbc 100644 ---- a/net/netfilter/ipvs/ip_vs_xmit.c -+++ b/net/netfilter/ipvs/ip_vs_xmit.c -@@ -129,7 +129,6 @@ static struct rtable *do_output_route4(struct net *net, __be32 daddr, - - memset(&fl4, 0, sizeof(fl4)); - fl4.daddr = daddr; -- fl4.saddr = (rt_mode & IP_VS_RT_MODE_CONNECT) ? *saddr : 0; - fl4.flowi4_flags = (rt_mode & IP_VS_RT_MODE_KNOWN_NH) ? - FLOWI_FLAG_KNOWN_NH : 0; - -diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c -index 4fd1ca94fd4a..71c46f463969 100644 ---- a/net/netfilter/nf_conntrack_expect.c -+++ b/net/netfilter/nf_conntrack_expect.c -@@ -202,7 +202,8 @@ static inline int expect_clash(const struct nf_conntrack_expect *a, - a->mask.src.u3.all[count] & b->mask.src.u3.all[count]; - } - -- return nf_ct_tuple_mask_cmp(&a->tuple, &b->tuple, &intersect_mask); -+ return nf_ct_tuple_mask_cmp(&a->tuple, &b->tuple, &intersect_mask) && -+ nf_ct_zone(a->master) == nf_ct_zone(b->master); - } - - static inline int expect_matches(const struct nf_conntrack_expect *a, -diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c -index b9f0e0374322..7d5dcd2a9092 100644 ---- a/net/netfilter/nf_conntrack_netlink.c -+++ b/net/netfilter/nf_conntrack_netlink.c -@@ -2927,11 +2927,6 @@ ctnetlink_create_expect(struct net *net, u16 zone, - } - - err = nf_ct_expect_related_report(exp, portid, report); -- if (err < 0) -- goto err_exp; -- -- return 0; --err_exp: - nf_ct_expect_put(exp); - err_ct: - nf_ct_put(ct); -diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c -index 969589590814..82273b83de8e 100644 ---- a/net/netfilter/nft_compat.c -+++ b/net/netfilter/nft_compat.c -@@ -594,6 +594,13 @@ struct nft_xt { - - static struct nft_expr_type nft_match_type; - -+static bool nft_match_cmp(const struct xt_match *match, -+ const char *name, u32 rev, u32 family) -+{ -+ return strcmp(match->name, name) == 0 && match->revision == rev && -+ (match->family == NFPROTO_UNSPEC || match->family == family); -+} -+ - static const struct nft_expr_ops * - nft_match_select_ops(const struct nft_ctx *ctx, - const struct nlattr * const tb[]) -@@ -601,7 +608,7 @@ nft_match_select_ops(const struct nft_ctx *ctx, - struct nft_xt *nft_match; - struct xt_match *match; - char *mt_name; -- __u32 rev, family; -+ u32 rev, family; - - if (tb[NFTA_MATCH_NAME] == NULL || - tb[NFTA_MATCH_REV] == NULL || -@@ -616,8 +623,7 @@ nft_match_select_ops(const struct nft_ctx *ctx, - list_for_each_entry(nft_match, &nft_match_list, head) { - struct xt_match *match = nft_match->ops.data; - -- if (strcmp(match->name, mt_name) == 0 && -- match->revision == rev && match->family == family) { -+ if (nft_match_cmp(match, mt_name, rev, family)) { - if (!try_module_get(match->me)) - return ERR_PTR(-ENOENT); - -@@ -669,6 +675,13 @@ static LIST_HEAD(nft_target_list); - - static struct nft_expr_type nft_target_type; - -+static bool nft_target_cmp(const struct xt_target *tg, -+ const char *name, u32 rev, u32 family) -+{ -+ return strcmp(tg->name, name) == 0 && tg->revision == rev && -+ (tg->family == NFPROTO_UNSPEC || tg->family == family); -+} -+ - static const struct nft_expr_ops * - nft_target_select_ops(const struct nft_ctx *ctx, - const struct nlattr * const tb[]) -@@ -676,7 +689,7 @@ nft_target_select_ops(const struct nft_ctx *ctx, - struct nft_xt *nft_target; - struct xt_target *target; - char *tg_name; -- __u32 rev, family; -+ u32 rev, family; - - if (tb[NFTA_TARGET_NAME] == NULL || - tb[NFTA_TARGET_REV] == NULL || -@@ -691,8 +704,7 @@ nft_target_select_ops(const struct nft_ctx *ctx, - list_for_each_entry(nft_target, &nft_target_list, head) { - struct xt_target *target = nft_target->ops.data; - -- if (strcmp(target->name, tg_name) == 0 && -- target->revision == rev && target->family == family) { -+ if (nft_target_cmp(target, tg_name, rev, family)) { - if (!try_module_get(target->me)) - return ERR_PTR(-ENOENT); - -diff --git a/sound/arm/Kconfig b/sound/arm/Kconfig -index 885683a3b0bd..e0406211716b 100644 ---- a/sound/arm/Kconfig -+++ b/sound/arm/Kconfig -@@ -9,6 +9,14 @@ menuconfig SND_ARM - Drivers that are implemented on ASoC can be found in - "ALSA for SoC audio support" section. - -+config SND_PXA2XX_LIB -+ tristate -+ select SND_AC97_CODEC if SND_PXA2XX_LIB_AC97 -+ select SND_DMAENGINE_PCM -+ -+config SND_PXA2XX_LIB_AC97 -+ bool -+ - if SND_ARM - - config SND_ARMAACI -@@ -21,13 +29,6 @@ config SND_PXA2XX_PCM - tristate - select SND_PCM - --config SND_PXA2XX_LIB -- tristate -- select SND_AC97_CODEC if SND_PXA2XX_LIB_AC97 -- --config SND_PXA2XX_LIB_AC97 -- bool -- - config SND_PXA2XX_AC97 - tristate "AC97 driver for the Intel PXA2xx chip" - depends on ARCH_PXA -diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c -index 7b0aac9d27ca..3c90743fa50b 100644 ---- a/sound/pci/hda/patch_cirrus.c -+++ b/sound/pci/hda/patch_cirrus.c -@@ -637,6 +637,7 @@ static const struct snd_pci_quirk cs4208_mac_fixup_tbl[] = { - SND_PCI_QUIRK(0x106b, 0x5e00, "MacBookPro 11,2", CS4208_MBP11), - SND_PCI_QUIRK(0x106b, 0x7100, "MacBookAir 6,1", CS4208_MBA6), - SND_PCI_QUIRK(0x106b, 0x7200, "MacBookAir 6,2", CS4208_MBA6), -+ SND_PCI_QUIRK(0x106b, 0x7b00, "MacBookPro 12,1", CS4208_MBP11), - {} /* terminator */ - }; - -diff --git a/sound/soc/dwc/designware_i2s.c b/sound/soc/dwc/designware_i2s.c -index 2f6357578616..1b6cbbc95456 100644 ---- a/sound/soc/dwc/designware_i2s.c -+++ b/sound/soc/dwc/designware_i2s.c -@@ -100,10 +100,10 @@ static inline void i2s_clear_irqs(struct dw_i2s_dev *dev, u32 stream) - - if (stream == SNDRV_PCM_STREAM_PLAYBACK) { - for (i = 0; i < 4; i++) -- i2s_write_reg(dev->i2s_base, TOR(i), 0); -+ i2s_read_reg(dev->i2s_base, TOR(i)); - } else { - for (i = 0; i < 4; i++) -- i2s_write_reg(dev->i2s_base, ROR(i), 0); -+ i2s_read_reg(dev->i2s_base, ROR(i)); - } - } - -diff --git a/sound/soc/pxa/Kconfig b/sound/soc/pxa/Kconfig -index 6473052b6899..9f4ea3f2bbb5 100644 ---- a/sound/soc/pxa/Kconfig -+++ b/sound/soc/pxa/Kconfig -@@ -1,7 +1,6 @@ - config SND_PXA2XX_SOC - tristate "SoC Audio for the Intel PXA2xx chip" - depends on ARCH_PXA -- select SND_ARM - select SND_PXA2XX_LIB - help - Say Y or M if you want to add support for codecs attached to -@@ -24,7 +23,6 @@ config SND_PXA2XX_AC97 - config SND_PXA2XX_SOC_AC97 - tristate - select AC97_BUS -- select SND_ARM - select SND_PXA2XX_LIB_AC97 - select SND_SOC_AC97_BUS - -diff --git a/sound/soc/pxa/pxa2xx-ac97.c b/sound/soc/pxa/pxa2xx-ac97.c -index ae956e3f4b9d..593e3202fc35 100644 ---- a/sound/soc/pxa/pxa2xx-ac97.c -+++ b/sound/soc/pxa/pxa2xx-ac97.c -@@ -49,7 +49,7 @@ static struct snd_ac97_bus_ops pxa2xx_ac97_ops = { - .reset = pxa2xx_ac97_cold_reset, - }; - --static unsigned long pxa2xx_ac97_pcm_stereo_in_req = 12; -+static unsigned long pxa2xx_ac97_pcm_stereo_in_req = 11; - static struct snd_dmaengine_dai_dma_data pxa2xx_ac97_pcm_stereo_in = { - .addr = __PREG(PCDR), - .addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES, -@@ -57,7 +57,7 @@ static struct snd_dmaengine_dai_dma_data pxa2xx_ac97_pcm_stereo_in = { - .filter_data = &pxa2xx_ac97_pcm_stereo_in_req, - }; - --static unsigned long pxa2xx_ac97_pcm_stereo_out_req = 11; -+static unsigned long pxa2xx_ac97_pcm_stereo_out_req = 12; - static struct snd_dmaengine_dai_dma_data pxa2xx_ac97_pcm_stereo_out = { - .addr = __PREG(PCDR), - .addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES, -diff --git a/sound/synth/emux/emux_oss.c b/sound/synth/emux/emux_oss.c -index daf61abc3670..646b66703bd8 100644 ---- a/sound/synth/emux/emux_oss.c -+++ b/sound/synth/emux/emux_oss.c -@@ -69,7 +69,8 @@ snd_emux_init_seq_oss(struct snd_emux *emu) - struct snd_seq_oss_reg *arg; - struct snd_seq_device *dev; - -- if (snd_seq_device_new(emu->card, 0, SNDRV_SEQ_DEV_ID_OSS, -+ /* using device#1 here for avoiding conflicts with OPL3 */ -+ if (snd_seq_device_new(emu->card, 1, SNDRV_SEQ_DEV_ID_OSS, - sizeof(struct snd_seq_oss_reg), &dev) < 0) - return; - -diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c -index 8b0e1c9234d9..8801d5cdafae 100644 ---- a/tools/perf/builtin-stat.c -+++ b/tools/perf/builtin-stat.c -@@ -1108,7 +1108,7 @@ static void abs_printout(int cpu, int nr, struct perf_evsel *evsel, double avg) - static void print_aggr(char *prefix) - { - struct perf_evsel *counter; -- int cpu, cpu2, s, s2, id, nr; -+ int cpu, s, s2, id, nr; - double uval; - u64 ena, run, val; - -@@ -1121,8 +1121,7 @@ static void print_aggr(char *prefix) - val = ena = run = 0; - nr = 0; - for (cpu = 0; cpu < perf_evsel__nr_cpus(counter); cpu++) { -- cpu2 = perf_evsel__cpus(counter)->map[cpu]; -- s2 = aggr_get_id(evsel_list->cpus, cpu2); -+ s2 = aggr_get_id(perf_evsel__cpus(counter), cpu); - if (s2 != id) - continue; - val += counter->counts->cpu[cpu].val; -diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c -index 893f8e2df928..96592f7bfa9f 100644 ---- a/tools/perf/util/header.c -+++ b/tools/perf/util/header.c -@@ -1715,7 +1715,7 @@ static int process_nrcpus(struct perf_file_section *section __maybe_unused, - if (ph->needs_swap) - nr = bswap_32(nr); - -- ph->env.nr_cpus_online = nr; -+ ph->env.nr_cpus_avail = nr; - - ret = readn(fd, &nr, sizeof(nr)); - if (ret != sizeof(nr)) -@@ -1724,7 +1724,7 @@ static int process_nrcpus(struct perf_file_section *section __maybe_unused, - if (ph->needs_swap) - nr = bswap_32(nr); - -- ph->env.nr_cpus_avail = nr; -+ ph->env.nr_cpus_online = nr; - return 0; - } - -diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c -index e4e6249b87d4..24a506974610 100644 ---- a/tools/perf/util/hist.c -+++ b/tools/perf/util/hist.c -@@ -160,6 +160,9 @@ void hists__calc_col_len(struct hists *hists, struct hist_entry *h) - hists__new_col_len(hists, HISTC_LOCAL_WEIGHT, 12); - hists__new_col_len(hists, HISTC_GLOBAL_WEIGHT, 12); - -+ if (h->srcline) -+ hists__new_col_len(hists, HISTC_SRCLINE, strlen(h->srcline)); -+ - if (h->transaction) - hists__new_col_len(hists, HISTC_TRANSACTION, - hist_entry__transaction_len()); -diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c -index 516d19fb999b..8bd904bd9009 100644 ---- a/tools/perf/util/symbol-elf.c -+++ b/tools/perf/util/symbol-elf.c -@@ -1100,8 +1100,6 @@ out_close: - static int kcore__init(struct kcore *kcore, char *filename, int elfclass, - bool temp) - { -- GElf_Ehdr *ehdr; -- - kcore->elfclass = elfclass; - - if (temp) -@@ -1118,9 +1116,7 @@ static int kcore__init(struct kcore *kcore, char *filename, int elfclass, - if (!gelf_newehdr(kcore->elf, elfclass)) - goto out_end; - -- ehdr = gelf_getehdr(kcore->elf, &kcore->ehdr); -- if (!ehdr) -- goto out_end; -+ memset(&kcore->ehdr, 0, sizeof(GElf_Ehdr)); - - return 0; - -@@ -1177,23 +1173,18 @@ static int kcore__copy_hdr(struct kcore *from, struct kcore *to, size_t count) - static int kcore__add_phdr(struct kcore *kcore, int idx, off_t offset, - u64 addr, u64 len) - { -- GElf_Phdr gphdr; -- GElf_Phdr *phdr; -- -- phdr = gelf_getphdr(kcore->elf, idx, &gphdr); -- if (!phdr) -- return -1; -- -- phdr->p_type = PT_LOAD; -- phdr->p_flags = PF_R | PF_W | PF_X; -- phdr->p_offset = offset; -- phdr->p_vaddr = addr; -- phdr->p_paddr = 0; -- phdr->p_filesz = len; -- phdr->p_memsz = len; -- phdr->p_align = page_size; -- -- if (!gelf_update_phdr(kcore->elf, idx, phdr)) -+ GElf_Phdr phdr = { -+ .p_type = PT_LOAD, -+ .p_flags = PF_R | PF_W | PF_X, -+ .p_offset = offset, -+ .p_vaddr = addr, -+ .p_paddr = 0, -+ .p_filesz = len, -+ .p_memsz = len, -+ .p_align = page_size, -+ }; -+ -+ if (!gelf_update_phdr(kcore->elf, idx, &phdr)) - return -1; - - return 0; -diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c -index eed250e9c218..d7d950f51b55 100644 ---- a/virt/kvm/kvm_main.c -+++ b/virt/kvm/kvm_main.c -@@ -2797,10 +2797,25 @@ static void kvm_io_bus_destroy(struct kvm_io_bus *bus) - static inline int kvm_io_bus_cmp(const struct kvm_io_range *r1, - const struct kvm_io_range *r2) - { -- if (r1->addr < r2->addr) -+ gpa_t addr1 = r1->addr; -+ gpa_t addr2 = r2->addr; -+ -+ if (addr1 < addr2) - return -1; -- if (r1->addr + r1->len > r2->addr + r2->len) -+ -+ /* If r2->len == 0, match the exact address. If r2->len != 0, -+ * accept any overlapping write. Any order is acceptable for -+ * overlapping ranges, because kvm_io_bus_get_first_dev ensures -+ * we process all of them. -+ */ -+ if (r2->len) { -+ addr1 += r1->len; -+ addr2 += r2->len; -+ } -+ -+ if (addr1 > addr2) - return 1; -+ - return 0; - } - diff --git a/patch/kernel/odroidc2-default/patch-3.14.55-56.patch b/patch/kernel/odroidc2-default/patch-3.14.55-56.patch deleted file mode 100644 index 83b202c465..0000000000 --- a/patch/kernel/odroidc2-default/patch-3.14.55-56.patch +++ /dev/null @@ -1,782 +0,0 @@ -diff --git a/Makefile b/Makefile -index 97d18c1d27f2..2a13d9d63880 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 3 - PATCHLEVEL = 14 --SUBLEVEL = 55 -+SUBLEVEL = 56 - EXTRAVERSION = - NAME = Remembering Coco - -diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile -index 0ab1a34dab58..dcc26850727d 100644 ---- a/arch/arm64/Makefile -+++ b/arch/arm64/Makefile -@@ -35,7 +35,7 @@ comma = , - CHECKFLAGS += -D__aarch64__ - - ifeq ($(CONFIG_ARM64_ERRATUM_843419), y) --CFLAGS_MODULE += -mcmodel=large -+KBUILD_CFLAGS_MODULE += -mcmodel=large - endif - - # Default value -diff --git a/arch/sparc/crypto/aes_glue.c b/arch/sparc/crypto/aes_glue.c -index ded4cee35318..dc78cdd43e0a 100644 ---- a/arch/sparc/crypto/aes_glue.c -+++ b/arch/sparc/crypto/aes_glue.c -@@ -433,6 +433,7 @@ static struct crypto_alg algs[] = { { - .blkcipher = { - .min_keysize = AES_MIN_KEY_SIZE, - .max_keysize = AES_MAX_KEY_SIZE, -+ .ivsize = AES_BLOCK_SIZE, - .setkey = aes_set_key, - .encrypt = cbc_encrypt, - .decrypt = cbc_decrypt, -@@ -452,6 +453,7 @@ static struct crypto_alg algs[] = { { - .blkcipher = { - .min_keysize = AES_MIN_KEY_SIZE, - .max_keysize = AES_MAX_KEY_SIZE, -+ .ivsize = AES_BLOCK_SIZE, - .setkey = aes_set_key, - .encrypt = ctr_crypt, - .decrypt = ctr_crypt, -diff --git a/arch/sparc/crypto/camellia_glue.c b/arch/sparc/crypto/camellia_glue.c -index 641f55cb61c3..eb87d6dd86b1 100644 ---- a/arch/sparc/crypto/camellia_glue.c -+++ b/arch/sparc/crypto/camellia_glue.c -@@ -274,6 +274,7 @@ static struct crypto_alg algs[] = { { - .blkcipher = { - .min_keysize = CAMELLIA_MIN_KEY_SIZE, - .max_keysize = CAMELLIA_MAX_KEY_SIZE, -+ .ivsize = CAMELLIA_BLOCK_SIZE, - .setkey = camellia_set_key, - .encrypt = cbc_encrypt, - .decrypt = cbc_decrypt, -diff --git a/arch/sparc/crypto/des_glue.c b/arch/sparc/crypto/des_glue.c -index d11500972994..1359bfc544e4 100644 ---- a/arch/sparc/crypto/des_glue.c -+++ b/arch/sparc/crypto/des_glue.c -@@ -429,6 +429,7 @@ static struct crypto_alg algs[] = { { - .blkcipher = { - .min_keysize = DES_KEY_SIZE, - .max_keysize = DES_KEY_SIZE, -+ .ivsize = DES_BLOCK_SIZE, - .setkey = des_set_key, - .encrypt = cbc_encrypt, - .decrypt = cbc_decrypt, -@@ -485,6 +486,7 @@ static struct crypto_alg algs[] = { { - .blkcipher = { - .min_keysize = DES3_EDE_KEY_SIZE, - .max_keysize = DES3_EDE_KEY_SIZE, -+ .ivsize = DES3_EDE_BLOCK_SIZE, - .setkey = des3_ede_set_key, - .encrypt = cbc3_encrypt, - .decrypt = cbc3_decrypt, -diff --git a/arch/x86/include/asm/preempt.h b/arch/x86/include/asm/preempt.h -index b39e194f6c8d..999b4a3e65f5 100644 ---- a/arch/x86/include/asm/preempt.h -+++ b/arch/x86/include/asm/preempt.h -@@ -105,9 +105,9 @@ static __always_inline bool __preempt_count_dec_and_test(void) - /* - * Returns true when we need to resched and can (barring IRQ state). - */ --static __always_inline bool should_resched(void) -+static __always_inline bool should_resched(int preempt_offset) - { -- return unlikely(!__this_cpu_read_4(__preempt_count)); -+ return unlikely(__this_cpu_read_4(__preempt_count) == preempt_offset); - } - - #ifdef CONFIG_PREEMPT -diff --git a/crypto/ahash.c b/crypto/ahash.c -index a92dc382f781..865ef923eda6 100644 ---- a/crypto/ahash.c -+++ b/crypto/ahash.c -@@ -465,7 +465,8 @@ static int ahash_prepare_alg(struct ahash_alg *alg) - struct crypto_alg *base = &alg->halg.base; - - if (alg->halg.digestsize > PAGE_SIZE / 8 || -- alg->halg.statesize > PAGE_SIZE / 8) -+ alg->halg.statesize > PAGE_SIZE / 8 || -+ alg->halg.statesize == 0) - return -EINVAL; - - base->cra_type = &crypto_ahash_type; -diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c -index b583773e4ecb..2ea515509ca6 100644 ---- a/drivers/block/rbd.c -+++ b/drivers/block/rbd.c -@@ -4851,7 +4851,6 @@ static int rbd_dev_probe_parent(struct rbd_device *rbd_dev) - out_err: - if (parent) { - rbd_dev_unparent(rbd_dev); -- kfree(rbd_dev->header_name); - rbd_dev_destroy(parent); - } else { - rbd_put_client(rbdc); -diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c -index 7903e0ed3c75..a5846b34fdd9 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c -+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c -@@ -183,8 +183,30 @@ nouveau_fbcon_sync(struct fb_info *info) - return 0; - } - -+static int -+nouveau_fbcon_open(struct fb_info *info, int user) -+{ -+ struct nouveau_fbdev *fbcon = info->par; -+ struct nouveau_drm *drm = nouveau_drm(fbcon->dev); -+ int ret = pm_runtime_get_sync(drm->dev->dev); -+ if (ret < 0 && ret != -EACCES) -+ return ret; -+ return 0; -+} -+ -+static int -+nouveau_fbcon_release(struct fb_info *info, int user) -+{ -+ struct nouveau_fbdev *fbcon = info->par; -+ struct nouveau_drm *drm = nouveau_drm(fbcon->dev); -+ pm_runtime_put(drm->dev->dev); -+ return 0; -+} -+ - static struct fb_ops nouveau_fbcon_ops = { - .owner = THIS_MODULE, -+ .fb_open = nouveau_fbcon_open, -+ .fb_release = nouveau_fbcon_release, - .fb_check_var = drm_fb_helper_check_var, - .fb_set_par = drm_fb_helper_set_par, - .fb_fillrect = nouveau_fbcon_fillrect, -@@ -200,6 +222,8 @@ static struct fb_ops nouveau_fbcon_ops = { - - static struct fb_ops nouveau_fbcon_sw_ops = { - .owner = THIS_MODULE, -+ .fb_open = nouveau_fbcon_open, -+ .fb_release = nouveau_fbcon_release, - .fb_check_var = drm_fb_helper_check_var, - .fb_set_par = drm_fb_helper_set_par, - .fb_fillrect = cfb_fillrect, -diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c -index 11d06c7b5afa..1af604a4512a 100644 ---- a/drivers/gpu/drm/radeon/radeon_display.c -+++ b/drivers/gpu/drm/radeon/radeon_display.c -@@ -1479,18 +1479,8 @@ int radeon_modeset_init(struct radeon_device *rdev) - radeon_fbdev_init(rdev); - drm_kms_helper_poll_init(rdev->ddev); - -- if (rdev->pm.dpm_enabled) { -- /* do dpm late init */ -- ret = radeon_pm_late_init(rdev); -- if (ret) { -- rdev->pm.dpm_enabled = false; -- DRM_ERROR("radeon_pm_late_init failed, disabling dpm\n"); -- } -- /* set the dpm state for PX since there won't be -- * a modeset to call this. -- */ -- radeon_pm_compute_clocks(rdev); -- } -+ /* do pm late init */ -+ ret = radeon_pm_late_init(rdev); - - return 0; - } -diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c -index 0095ee7fce34..214adc6d2a68 100644 ---- a/drivers/gpu/drm/radeon/radeon_pm.c -+++ b/drivers/gpu/drm/radeon/radeon_pm.c -@@ -1153,14 +1153,6 @@ static int radeon_pm_init_old(struct radeon_device *rdev) - INIT_DELAYED_WORK(&rdev->pm.dynpm_idle_work, radeon_dynpm_idle_work_handler); - - if (rdev->pm.num_power_states > 1) { -- /* where's the best place to put these? */ -- ret = device_create_file(rdev->dev, &dev_attr_power_profile); -- if (ret) -- DRM_ERROR("failed to create device file for power profile\n"); -- ret = device_create_file(rdev->dev, &dev_attr_power_method); -- if (ret) -- DRM_ERROR("failed to create device file for power method\n"); -- - if (radeon_debugfs_pm_init(rdev)) { - DRM_ERROR("Failed to register debugfs file for PM!\n"); - } -@@ -1218,20 +1210,6 @@ static int radeon_pm_init_dpm(struct radeon_device *rdev) - goto dpm_failed; - rdev->pm.dpm_enabled = true; - -- ret = device_create_file(rdev->dev, &dev_attr_power_dpm_state); -- if (ret) -- DRM_ERROR("failed to create device file for dpm state\n"); -- ret = device_create_file(rdev->dev, &dev_attr_power_dpm_force_performance_level); -- if (ret) -- DRM_ERROR("failed to create device file for dpm state\n"); -- /* XXX: these are noops for dpm but are here for backwards compat */ -- ret = device_create_file(rdev->dev, &dev_attr_power_profile); -- if (ret) -- DRM_ERROR("failed to create device file for power profile\n"); -- ret = device_create_file(rdev->dev, &dev_attr_power_method); -- if (ret) -- DRM_ERROR("failed to create device file for power method\n"); -- - if (radeon_debugfs_pm_init(rdev)) { - DRM_ERROR("Failed to register debugfs file for dpm!\n"); - } -@@ -1371,9 +1349,44 @@ int radeon_pm_late_init(struct radeon_device *rdev) - int ret = 0; - - if (rdev->pm.pm_method == PM_METHOD_DPM) { -- mutex_lock(&rdev->pm.mutex); -- ret = radeon_dpm_late_enable(rdev); -- mutex_unlock(&rdev->pm.mutex); -+ if (rdev->pm.dpm_enabled) { -+ ret = device_create_file(rdev->dev, &dev_attr_power_dpm_state); -+ if (ret) -+ DRM_ERROR("failed to create device file for dpm state\n"); -+ ret = device_create_file(rdev->dev, &dev_attr_power_dpm_force_performance_level); -+ if (ret) -+ DRM_ERROR("failed to create device file for dpm state\n"); -+ /* XXX: these are noops for dpm but are here for backwards compat */ -+ ret = device_create_file(rdev->dev, &dev_attr_power_profile); -+ if (ret) -+ DRM_ERROR("failed to create device file for power profile\n"); -+ ret = device_create_file(rdev->dev, &dev_attr_power_method); -+ if (ret) -+ DRM_ERROR("failed to create device file for power method\n"); -+ -+ mutex_lock(&rdev->pm.mutex); -+ ret = radeon_dpm_late_enable(rdev); -+ mutex_unlock(&rdev->pm.mutex); -+ if (ret) { -+ rdev->pm.dpm_enabled = false; -+ DRM_ERROR("radeon_pm_late_init failed, disabling dpm\n"); -+ } else { -+ /* set the dpm state for PX since there won't be -+ * a modeset to call this. -+ */ -+ radeon_pm_compute_clocks(rdev); -+ } -+ } -+ } else { -+ if (rdev->pm.num_power_states > 1) { -+ /* where's the best place to put these? */ -+ ret = device_create_file(rdev->dev, &dev_attr_power_profile); -+ if (ret) -+ DRM_ERROR("failed to create device file for power profile\n"); -+ ret = device_create_file(rdev->dev, &dev_attr_power_method); -+ if (ret) -+ DRM_ERROR("failed to create device file for power method\n"); -+ } - } - return ret; - } -diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c -index d0bdac0498ce..f7439c556413 100644 ---- a/drivers/i2c/busses/i2c-designware-platdrv.c -+++ b/drivers/i2c/busses/i2c-designware-platdrv.c -@@ -28,6 +28,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -53,6 +54,22 @@ static u32 i2c_dw_get_clk_rate_khz(struct dw_i2c_dev *dev) - } - - #ifdef CONFIG_ACPI -+/* -+ * The HCNT/LCNT information coming from ACPI should be the most accurate -+ * for given platform. However, some systems get it wrong. On such systems -+ * we get better results by calculating those based on the input clock. -+ */ -+static const struct dmi_system_id dw_i2c_no_acpi_params[] = { -+ { -+ .ident = "Dell Inspiron 7348", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 7348"), -+ }, -+ }, -+ { } -+}; -+ - static void dw_i2c_acpi_params(struct platform_device *pdev, char method[], - u16 *hcnt, u16 *lcnt, u32 *sda_hold) - { -@@ -60,6 +77,9 @@ static void dw_i2c_acpi_params(struct platform_device *pdev, char method[], - acpi_handle handle = ACPI_HANDLE(&pdev->dev); - union acpi_object *obj; - -+ if (dmi_check_system(dw_i2c_no_acpi_params)) -+ return; -+ - if (ACPI_FAILURE(acpi_evaluate_object(handle, method, NULL, &buf))) - return; - -diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c -index d3c5d6216575..32812d3e5411 100644 ---- a/drivers/i2c/busses/i2c-rcar.c -+++ b/drivers/i2c/busses/i2c-rcar.c -@@ -712,15 +712,16 @@ static int rcar_i2c_probe(struct platform_device *pdev) - return ret; - } - -+ pm_runtime_enable(dev); -+ platform_set_drvdata(pdev, priv); -+ - ret = i2c_add_numbered_adapter(adap); - if (ret < 0) { - dev_err(dev, "reg adap failed: %d\n", ret); -+ pm_runtime_disable(dev); - return ret; - } - -- pm_runtime_enable(dev); -- platform_set_drvdata(pdev, priv); -- - dev_info(dev, "probed\n"); - - return 0; -diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c -index 79a211782766..a272988f8f10 100644 ---- a/drivers/i2c/busses/i2c-s3c2410.c -+++ b/drivers/i2c/busses/i2c-s3c2410.c -@@ -1198,17 +1198,19 @@ static int s3c24xx_i2c_probe(struct platform_device *pdev) - i2c->adap.nr = i2c->pdata->bus_num; - i2c->adap.dev.of_node = pdev->dev.of_node; - -+ platform_set_drvdata(pdev, i2c); -+ -+ pm_runtime_enable(&pdev->dev); -+ - ret = i2c_add_numbered_adapter(&i2c->adap); - if (ret < 0) { - dev_err(&pdev->dev, "failed to add bus to i2c core\n"); -+ pm_runtime_disable(&pdev->dev); - s3c24xx_i2c_deregister_cpufreq(i2c); - clk_unprepare(i2c->clk); - return ret; - } - -- platform_set_drvdata(pdev, i2c); -- -- pm_runtime_enable(&pdev->dev); - pm_runtime_enable(&i2c->adap.dev); - - dev_info(&pdev->dev, "%s: S3C I2C adapter\n", dev_name(&i2c->adap.dev)); -diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c -index c1120eb96d86..b94e4648c199 100644 ---- a/drivers/md/dm-thin.c -+++ b/drivers/md/dm-thin.c -@@ -2373,7 +2373,7 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, char **argv) - metadata_low_callback, - pool); - if (r) -- goto out_free_pt; -+ goto out_flags_changed; - - pt->callbacks.congested_fn = pool_is_congested; - dm_table_add_target_callbacks(ti->table, &pt->callbacks); -diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c -index 6c9c16d76935..f606b5ba611f 100644 ---- a/drivers/net/ppp/pppoe.c -+++ b/drivers/net/ppp/pppoe.c -@@ -313,7 +313,6 @@ static void pppoe_flush_dev(struct net_device *dev) - if (po->pppoe_dev == dev && - sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND | PPPOX_ZOMBIE)) { - pppox_unbind_sock(sk); -- sk->sk_state = PPPOX_ZOMBIE; - sk->sk_state_change(sk); - po->pppoe_dev = NULL; - dev_put(dev); -diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c -index 5d194093f3e1..816d511e34d3 100644 ---- a/drivers/net/usb/asix_devices.c -+++ b/drivers/net/usb/asix_devices.c -@@ -465,19 +465,7 @@ static int ax88772_bind(struct usbnet *dev, struct usb_interface *intf) - return ret; - } - -- ret = asix_sw_reset(dev, AX_SWRESET_IPPD | AX_SWRESET_PRL); -- if (ret < 0) -- return ret; -- -- msleep(150); -- -- ret = asix_sw_reset(dev, AX_SWRESET_CLEAR); -- if (ret < 0) -- return ret; -- -- msleep(150); -- -- ret = asix_sw_reset(dev, embd_phy ? AX_SWRESET_IPRL : AX_SWRESET_PRTE); -+ ax88772_reset(dev); - - /* Read PHYID register *AFTER* the PHY was reset properly */ - phyid = asix_get_phyid(dev); -@@ -890,7 +878,7 @@ static const struct driver_info ax88772_info = { - .unbind = ax88772_unbind, - .status = asix_status, - .link_reset = ax88772_link_reset, -- .reset = ax88772_reset, -+ .reset = ax88772_link_reset, - .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_LINK_INTR | FLAG_MULTI_PACKET, - .rx_fixup = asix_rx_fixup_common, - .tx_fixup = asix_tx_fixup, -diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c -index 6244f9cf8ae3..0529defbdf73 100644 ---- a/fs/btrfs/backref.c -+++ b/fs/btrfs/backref.c -@@ -1692,7 +1692,6 @@ static int iterate_inode_extrefs(u64 inum, struct btrfs_root *fs_root, - int found = 0; - struct extent_buffer *eb; - struct btrfs_inode_extref *extref; -- struct extent_buffer *leaf; - u32 item_size; - u32 cur_offset; - unsigned long ptr; -@@ -1720,9 +1719,8 @@ static int iterate_inode_extrefs(u64 inum, struct btrfs_root *fs_root, - btrfs_set_lock_blocking_rw(eb, BTRFS_READ_LOCK); - btrfs_release_path(path); - -- leaf = path->nodes[0]; -- item_size = btrfs_item_size_nr(leaf, slot); -- ptr = btrfs_item_ptr_offset(leaf, slot); -+ item_size = btrfs_item_size_nr(eb, slot); -+ ptr = btrfs_item_ptr_offset(eb, slot); - cur_offset = 0; - - while (cur_offset < item_size) { -@@ -1736,7 +1734,7 @@ static int iterate_inode_extrefs(u64 inum, struct btrfs_root *fs_root, - if (ret) - break; - -- cur_offset += btrfs_inode_extref_name_len(leaf, extref); -+ cur_offset += btrfs_inode_extref_name_len(eb, extref); - cur_offset += sizeof(*extref); - } - btrfs_tree_read_unlock_blocking(eb); -diff --git a/include/asm-generic/preempt.h b/include/asm-generic/preempt.h -index 1cd3f5d767a8..54352f4dde1a 100644 ---- a/include/asm-generic/preempt.h -+++ b/include/asm-generic/preempt.h -@@ -74,9 +74,10 @@ static __always_inline bool __preempt_count_dec_and_test(void) - /* - * Returns true when we need to resched and can (barring IRQ state). - */ --static __always_inline bool should_resched(void) -+static __always_inline bool should_resched(int preempt_offset) - { -- return unlikely(!preempt_count() && tif_need_resched()); -+ return unlikely(preempt_count() == preempt_offset && -+ tif_need_resched()); - } - - #ifdef CONFIG_PREEMPT -diff --git a/include/linux/preempt.h b/include/linux/preempt.h -index 1841b58cf173..411a5c6371da 100644 ---- a/include/linux/preempt.h -+++ b/include/linux/preempt.h -@@ -22,7 +22,8 @@ - #if defined(CONFIG_DEBUG_PREEMPT) || defined(CONFIG_PREEMPT_TRACER) - extern void preempt_count_add(int val); - extern void preempt_count_sub(int val); --#define preempt_count_dec_and_test() ({ preempt_count_sub(1); should_resched(); }) -+#define preempt_count_dec_and_test() \ -+ ({ preempt_count_sub(1); should_resched(0); }) - #else - #define preempt_count_add(val) __preempt_count_add(val) - #define preempt_count_sub(val) __preempt_count_sub(val) -@@ -61,7 +62,7 @@ do { \ - - #define preempt_check_resched() \ - do { \ -- if (should_resched()) \ -+ if (should_resched(0)) \ - __preempt_schedule(); \ - } while (0) - -diff --git a/include/linux/preempt_mask.h b/include/linux/preempt_mask.h -index dbeec4d4a3be..5cb25f17331a 100644 ---- a/include/linux/preempt_mask.h -+++ b/include/linux/preempt_mask.h -@@ -71,13 +71,21 @@ - */ - #define in_nmi() (preempt_count() & NMI_MASK) - -+/* -+ * The preempt_count offset after preempt_disable(); -+ */ - #if defined(CONFIG_PREEMPT_COUNT) --# define PREEMPT_CHECK_OFFSET 1 -+# define PREEMPT_DISABLE_OFFSET PREEMPT_OFFSET - #else --# define PREEMPT_CHECK_OFFSET 0 -+# define PREEMPT_DISABLE_OFFSET 0 - #endif - - /* -+ * The preempt_count offset after spin_lock() -+ */ -+#define PREEMPT_LOCK_OFFSET PREEMPT_DISABLE_OFFSET -+ -+/* - * The preempt_count offset needed for things like: - * - * spin_lock_bh() -@@ -90,7 +98,7 @@ - * - * Work as expected. - */ --#define SOFTIRQ_LOCK_OFFSET (SOFTIRQ_DISABLE_OFFSET + PREEMPT_CHECK_OFFSET) -+#define SOFTIRQ_LOCK_OFFSET (SOFTIRQ_DISABLE_OFFSET + PREEMPT_LOCK_OFFSET) - - /* - * Are we running in atomic context? WARNING: this macro cannot -@@ -106,7 +114,7 @@ - * (used by the scheduler, *after* releasing the kernel lock) - */ - #define in_atomic_preempt_off() \ -- ((preempt_count() & ~PREEMPT_ACTIVE) != PREEMPT_CHECK_OFFSET) -+ ((preempt_count() & ~PREEMPT_ACTIVE) != PREEMPT_DISABLE_OFFSET) - - #ifdef CONFIG_PREEMPT_COUNT - # define preemptible() (preempt_count() == 0 && !irqs_disabled()) -diff --git a/include/linux/sched.h b/include/linux/sched.h -index 91fe6a38b307..ec6000f66e75 100644 ---- a/include/linux/sched.h -+++ b/include/linux/sched.h -@@ -2647,12 +2647,6 @@ extern int _cond_resched(void); - - extern int __cond_resched_lock(spinlock_t *lock); - --#ifdef CONFIG_PREEMPT_COUNT --#define PREEMPT_LOCK_OFFSET PREEMPT_OFFSET --#else --#define PREEMPT_LOCK_OFFSET 0 --#endif -- - #define cond_resched_lock(lock) ({ \ - __might_sleep(__FILE__, __LINE__, PREEMPT_LOCK_OFFSET); \ - __cond_resched_lock(lock); \ -diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h -index ab3133797ff7..d8bec47b6edd 100644 ---- a/include/linux/skbuff.h -+++ b/include/linux/skbuff.h -@@ -2347,6 +2347,9 @@ static inline void skb_postpull_rcsum(struct sk_buff *skb, - { - if (skb->ip_summed == CHECKSUM_COMPLETE) - skb->csum = csum_sub(skb->csum, csum_partial(start, len, 0)); -+ else if (skb->ip_summed == CHECKSUM_PARTIAL && -+ skb_checksum_start_offset(skb) < 0) -+ skb->ip_summed = CHECKSUM_NONE; - } - - unsigned char *skb_pull_rcsum(struct sk_buff *skb, unsigned int len); -diff --git a/include/net/af_unix.h b/include/net/af_unix.h -index a175ba4a7adb..dfe4ddfbb43c 100644 ---- a/include/net/af_unix.h -+++ b/include/net/af_unix.h -@@ -64,7 +64,11 @@ struct unix_sock { - #define UNIX_GC_MAYBE_CYCLE 1 - struct socket_wq peer_wq; - }; --#define unix_sk(__sk) ((struct unix_sock *)__sk) -+ -+static inline struct unix_sock *unix_sk(struct sock *sk) -+{ -+ return (struct unix_sock *)sk; -+} - - #define peer_wait peer_wq.wait - -diff --git a/include/net/sock.h b/include/net/sock.h -index 0c79a740e97d..ff4f825647a5 100644 ---- a/include/net/sock.h -+++ b/include/net/sock.h -@@ -805,6 +805,14 @@ static inline __must_check int sk_add_backlog(struct sock *sk, struct sk_buff *s - if (sk_rcvqueues_full(sk, skb, limit)) - return -ENOBUFS; - -+ /* -+ * If the skb was allocated from pfmemalloc reserves, only -+ * allow SOCK_MEMALLOC sockets to use it as this socket is -+ * helping free memory -+ */ -+ if (skb_pfmemalloc(skb) && !sock_flag(sk, SOCK_MEMALLOC)) -+ return -ENOMEM; -+ - __sk_add_backlog(sk, skb); - sk->sk_backlog.len += skb->truesize; - return 0; -diff --git a/kernel/sched/core.c b/kernel/sched/core.c -index a19262a7d70b..bbe957762ace 100644 ---- a/kernel/sched/core.c -+++ b/kernel/sched/core.c -@@ -4113,7 +4113,7 @@ static void __cond_resched(void) - - int __sched _cond_resched(void) - { -- if (should_resched()) { -+ if (should_resched(0)) { - __cond_resched(); - return 1; - } -@@ -4131,7 +4131,7 @@ EXPORT_SYMBOL(_cond_resched); - */ - int __cond_resched_lock(spinlock_t *lock) - { -- int resched = should_resched(); -+ int resched = should_resched(PREEMPT_LOCK_OFFSET); - int ret = 0; - - lockdep_assert_held(lock); -@@ -4153,7 +4153,7 @@ int __sched __cond_resched_softirq(void) - { - BUG_ON(!in_softirq()); - -- if (should_resched()) { -+ if (should_resched(SOFTIRQ_DISABLE_OFFSET)) { - local_bh_enable(); - __cond_resched(); - local_bh_disable(); -diff --git a/kernel/workqueue.c b/kernel/workqueue.c -index 423c9e37a9e7..646a8b81bee1 100644 ---- a/kernel/workqueue.c -+++ b/kernel/workqueue.c -@@ -1475,13 +1475,13 @@ static void __queue_delayed_work(int cpu, struct workqueue_struct *wq, - timer_stats_timer_set_start_info(&dwork->timer); - - dwork->wq = wq; -+ /* timer isn't guaranteed to run in this cpu, record earlier */ -+ if (cpu == WORK_CPU_UNBOUND) -+ cpu = raw_smp_processor_id(); - dwork->cpu = cpu; - timer->expires = jiffies + delay; - -- if (unlikely(cpu != WORK_CPU_UNBOUND)) -- add_timer_on(timer, cpu); -- else -- add_timer(timer); -+ add_timer_on(timer, cpu); - } - - /** -diff --git a/net/core/ethtool.c b/net/core/ethtool.c -index 30071dec287a..0b39ab6f7675 100644 ---- a/net/core/ethtool.c -+++ b/net/core/ethtool.c -@@ -1080,7 +1080,7 @@ static int ethtool_get_strings(struct net_device *dev, void __user *useraddr) - - gstrings.len = ret; - -- data = kmalloc(gstrings.len * ETH_GSTRING_LEN, GFP_USER); -+ data = kcalloc(gstrings.len, ETH_GSTRING_LEN, GFP_USER); - if (!data) - return -ENOMEM; - -diff --git a/net/core/skbuff.c b/net/core/skbuff.c -index 8207f8d7f665..366f7ff741b7 100644 ---- a/net/core/skbuff.c -+++ b/net/core/skbuff.c -@@ -2862,11 +2862,12 @@ EXPORT_SYMBOL(skb_append_datato_frags); - */ - unsigned char *skb_pull_rcsum(struct sk_buff *skb, unsigned int len) - { -+ unsigned char *data = skb->data; -+ - BUG_ON(len > skb->len); -- skb->len -= len; -- BUG_ON(skb->len < skb->data_len); -- skb_postpull_rcsum(skb, skb->data, len); -- return skb->data += len; -+ __skb_pull(skb, len); -+ skb_postpull_rcsum(skb, data, len); -+ return skb->data; - } - EXPORT_SYMBOL_GPL(skb_pull_rcsum); - -diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c -index 85d9d94c0a3c..3679bd6000d7 100644 ---- a/net/l2tp/l2tp_core.c -+++ b/net/l2tp/l2tp_core.c -@@ -1435,7 +1435,7 @@ static void l2tp_tunnel_del_work(struct work_struct *work) - tunnel = container_of(work, struct l2tp_tunnel, del_work); - sk = l2tp_tunnel_sock_lookup(tunnel); - if (!sk) -- return; -+ goto out; - - sock = sk->sk_socket; - -@@ -1456,6 +1456,8 @@ static void l2tp_tunnel_del_work(struct work_struct *work) - } - - l2tp_tunnel_sock_put(sk); -+out: -+ l2tp_tunnel_dec_refcount(tunnel); - } - - /* Create a socket for the tunnel, if one isn't set up by -@@ -1785,8 +1787,13 @@ EXPORT_SYMBOL_GPL(l2tp_tunnel_create); - */ - int l2tp_tunnel_delete(struct l2tp_tunnel *tunnel) - { -+ l2tp_tunnel_inc_refcount(tunnel); - l2tp_tunnel_closeall(tunnel); -- return (false == queue_work(l2tp_wq, &tunnel->del_work)); -+ if (false == queue_work(l2tp_wq, &tunnel->del_work)) { -+ l2tp_tunnel_dec_refcount(tunnel); -+ return 1; -+ } -+ return 0; - } - EXPORT_SYMBOL_GPL(l2tp_tunnel_delete); - -diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c -index 4757f1cf6237..4affedbe0206 100644 ---- a/net/unix/af_unix.c -+++ b/net/unix/af_unix.c -@@ -1956,6 +1956,11 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock, - goto out; - } - -+ if (flags & MSG_PEEK) -+ skip = sk_peek_offset(sk, flags); -+ else -+ skip = 0; -+ - do { - int chunk; - struct sk_buff *skb, *last; -@@ -2002,7 +2007,6 @@ again: - break; - } - -- skip = sk_peek_offset(sk, flags); - while (skip >= unix_skb_len(skb)) { - skip -= unix_skb_len(skb); - last = skb; -@@ -2066,6 +2070,16 @@ again: - - sk_peek_offset_fwd(sk, chunk); - -+ if (UNIXCB(skb).fp) -+ break; -+ -+ skip = 0; -+ last = skb; -+ unix_state_lock(sk); -+ skb = skb_peek_next(skb, &sk->sk_receive_queue); -+ if (skb) -+ goto again; -+ unix_state_unlock(sk); - break; - } - } while (size); diff --git a/patch/kernel/odroidc2-default/patch-3.14.56-57.patch b/patch/kernel/odroidc2-default/patch-3.14.56-57.patch deleted file mode 100644 index 1f24437264..0000000000 --- a/patch/kernel/odroidc2-default/patch-3.14.56-57.patch +++ /dev/null @@ -1,975 +0,0 @@ -diff --git a/Makefile b/Makefile -index 2a13d9d63880..51ee14329c47 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 3 - PATCHLEVEL = 14 --SUBLEVEL = 56 -+SUBLEVEL = 57 - EXTRAVERSION = - NAME = Remembering Coco - -diff --git a/arch/arm64/kernel/stacktrace.c b/arch/arm64/kernel/stacktrace.c -index 38f0558f0c0a..c3b6c63ea5fb 100644 ---- a/arch/arm64/kernel/stacktrace.c -+++ b/arch/arm64/kernel/stacktrace.c -@@ -48,11 +48,7 @@ int unwind_frame(struct stackframe *frame) - - frame->sp = fp + 0x10; - frame->fp = *(unsigned long *)(fp); -- /* -- * -4 here because we care about the PC at time of bl, -- * not where the return will go. -- */ -- frame->pc = *(unsigned long *)(fp + 8) - 4; -+ frame->pc = *(unsigned long *)(fp + 8); - - return 0; - } -diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c -index c4bc8d6cfd79..e6b028d3b1e7 100644 ---- a/arch/powerpc/kernel/rtas.c -+++ b/arch/powerpc/kernel/rtas.c -@@ -1041,6 +1041,9 @@ asmlinkage int ppc_rtas(struct rtas_args __user *uargs) - if (!capable(CAP_SYS_ADMIN)) - return -EPERM; - -+ if (!rtas.entry) -+ return -EINVAL; -+ - if (copy_from_user(&args, uargs, 3 * sizeof(u32)) != 0) - return -EFAULT; - -diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c -index 4dca0d50762e..a7fab60bdeeb 100644 ---- a/arch/x86/xen/enlighten.c -+++ b/arch/x86/xen/enlighten.c -@@ -33,7 +33,7 @@ - #include - #include - --#ifdef CONFIG_KEXEC_CORE -+#ifdef CONFIG_KEXEC - #include - #endif - -@@ -1848,7 +1848,7 @@ static struct notifier_block xen_hvm_cpu_notifier = { - .notifier_call = xen_hvm_cpu_notify, - }; - --#ifdef CONFIG_KEXEC_CORE -+#ifdef CONFIG_KEXEC - static void xen_hvm_shutdown(void) - { - native_machine_shutdown(); -@@ -1879,7 +1879,7 @@ static void __init xen_hvm_guest_init(void) - x86_init.irqs.intr_init = xen_init_IRQ; - xen_hvm_init_time_ops(); - xen_hvm_init_mmu_ops(); --#ifdef CONFIG_KEXEC_CORE -+#ifdef CONFIG_KEXEC - machine_ops.shutdown = xen_hvm_shutdown; - machine_ops.crash_shutdown = xen_hvm_crash_shutdown; - #endif -diff --git a/crypto/ablkcipher.c b/crypto/ablkcipher.c -index 40886c489903..520729d898fe 100644 ---- a/crypto/ablkcipher.c -+++ b/crypto/ablkcipher.c -@@ -695,7 +695,7 @@ struct crypto_ablkcipher *crypto_alloc_ablkcipher(const char *alg_name, - err: - if (err != -EAGAIN) - break; -- if (signal_pending(current)) { -+ if (fatal_signal_pending(current)) { - err = -EINTR; - break; - } -diff --git a/crypto/algapi.c b/crypto/algapi.c -index 00d8d939733b..daf2f653b131 100644 ---- a/crypto/algapi.c -+++ b/crypto/algapi.c -@@ -325,7 +325,7 @@ static void crypto_wait_for_test(struct crypto_larval *larval) - crypto_alg_tested(larval->alg.cra_driver_name, 0); - } - -- err = wait_for_completion_interruptible(&larval->completion); -+ err = wait_for_completion_killable(&larval->completion); - WARN_ON(err); - - out: -diff --git a/crypto/api.c b/crypto/api.c -index 2a81e98a0021..7db2e89a3114 100644 ---- a/crypto/api.c -+++ b/crypto/api.c -@@ -172,7 +172,7 @@ static struct crypto_alg *crypto_larval_wait(struct crypto_alg *alg) - struct crypto_larval *larval = (void *)alg; - long timeout; - -- timeout = wait_for_completion_interruptible_timeout( -+ timeout = wait_for_completion_killable_timeout( - &larval->completion, 60 * HZ); - - alg = larval->adult; -@@ -435,7 +435,7 @@ struct crypto_tfm *crypto_alloc_base(const char *alg_name, u32 type, u32 mask) - err: - if (err != -EAGAIN) - break; -- if (signal_pending(current)) { -+ if (fatal_signal_pending(current)) { - err = -EINTR; - break; - } -@@ -552,7 +552,7 @@ void *crypto_alloc_tfm(const char *alg_name, - err: - if (err != -EAGAIN) - break; -- if (signal_pending(current)) { -+ if (fatal_signal_pending(current)) { - err = -EINTR; - break; - } -diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c -index 43665d0d0905..c7666f401381 100644 ---- a/crypto/crypto_user.c -+++ b/crypto/crypto_user.c -@@ -361,7 +361,7 @@ static struct crypto_alg *crypto_user_aead_alg(const char *name, u32 type, - err = PTR_ERR(alg); - if (err != -EAGAIN) - break; -- if (signal_pending(current)) { -+ if (fatal_signal_pending(current)) { - err = -EINTR; - break; - } -diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c -index 2ea515509ca6..eb3dff3500c2 100644 ---- a/drivers/block/rbd.c -+++ b/drivers/block/rbd.c -@@ -94,6 +94,8 @@ static int atomic_dec_return_safe(atomic_t *v) - #define RBD_MINORS_PER_MAJOR 256 - #define RBD_SINGLE_MAJOR_PART_SHIFT 4 - -+#define RBD_MAX_PARENT_CHAIN_LEN 16 -+ - #define RBD_SNAP_DEV_NAME_PREFIX "snap_" - #define RBD_MAX_SNAP_NAME_LEN \ - (NAME_MAX - (sizeof (RBD_SNAP_DEV_NAME_PREFIX) - 1)) -@@ -411,7 +413,7 @@ static ssize_t rbd_add_single_major(struct bus_type *bus, const char *buf, - size_t count); - static ssize_t rbd_remove_single_major(struct bus_type *bus, const char *buf, - size_t count); --static int rbd_dev_image_probe(struct rbd_device *rbd_dev, bool mapping); -+static int rbd_dev_image_probe(struct rbd_device *rbd_dev, int depth); - static void rbd_spec_put(struct rbd_spec *spec); - - static int rbd_dev_id_to_minor(int dev_id) -@@ -3443,6 +3445,9 @@ static int rbd_init_disk(struct rbd_device *rbd_dev) - blk_queue_io_opt(q, segment_size); - - blk_queue_merge_bvec(q, rbd_merge_bvec); -+ if (!ceph_test_opt(rbd_dev->rbd_client->client, NOCRC)) -+ q->backing_dev_info.capabilities |= BDI_CAP_STABLE_WRITES; -+ - disk->queue = q; - - q->queuedata = rbd_dev; -@@ -4819,44 +4824,50 @@ out_err: - return ret; - } - --static int rbd_dev_probe_parent(struct rbd_device *rbd_dev) -+/* -+ * @depth is rbd_dev_image_probe() -> rbd_dev_probe_parent() -> -+ * rbd_dev_image_probe() recursion depth, which means it's also the -+ * length of the already discovered part of the parent chain. -+ */ -+static int rbd_dev_probe_parent(struct rbd_device *rbd_dev, int depth) - { - struct rbd_device *parent = NULL; -- struct rbd_spec *parent_spec; -- struct rbd_client *rbdc; - int ret; - - if (!rbd_dev->parent_spec) - return 0; -- /* -- * We need to pass a reference to the client and the parent -- * spec when creating the parent rbd_dev. Images related by -- * parent/child relationships always share both. -- */ -- parent_spec = rbd_spec_get(rbd_dev->parent_spec); -- rbdc = __rbd_get_client(rbd_dev->rbd_client); - -- ret = -ENOMEM; -- parent = rbd_dev_create(rbdc, parent_spec); -- if (!parent) -+ if (++depth > RBD_MAX_PARENT_CHAIN_LEN) { -+ pr_info("parent chain is too long (%d)\n", depth); -+ ret = -EINVAL; - goto out_err; -+ } - -- ret = rbd_dev_image_probe(parent, false); -+ parent = rbd_dev_create(rbd_dev->rbd_client, rbd_dev->parent_spec); -+ if (!parent) { -+ ret = -ENOMEM; -+ goto out_err; -+ } -+ -+ /* -+ * Images related by parent/child relationships always share -+ * rbd_client and spec/parent_spec, so bump their refcounts. -+ */ -+ __rbd_get_client(rbd_dev->rbd_client); -+ rbd_spec_get(rbd_dev->parent_spec); -+ -+ ret = rbd_dev_image_probe(parent, depth); - if (ret < 0) - goto out_err; -+ - rbd_dev->parent = parent; - atomic_set(&rbd_dev->parent_ref, 1); -- - return 0; -+ - out_err: -- if (parent) { -- rbd_dev_unparent(rbd_dev); -+ rbd_dev_unparent(rbd_dev); -+ if (parent) - rbd_dev_destroy(parent); -- } else { -- rbd_put_client(rbdc); -- rbd_spec_put(parent_spec); -- } -- - return ret; - } - -@@ -4972,7 +4983,7 @@ static void rbd_dev_image_release(struct rbd_device *rbd_dev) - * parent), initiate a watch on its header object before using that - * object to get detailed information about the rbd image. - */ --static int rbd_dev_image_probe(struct rbd_device *rbd_dev, bool mapping) -+static int rbd_dev_image_probe(struct rbd_device *rbd_dev, int depth) - { - int ret; - -@@ -4992,7 +5003,7 @@ static int rbd_dev_image_probe(struct rbd_device *rbd_dev, bool mapping) - if (ret) - goto err_out_format; - -- if (mapping) { -+ if (!depth) { - ret = rbd_dev_header_watch_sync(rbd_dev); - if (ret) - goto out_header_name; -@@ -5009,7 +5020,7 @@ static int rbd_dev_image_probe(struct rbd_device *rbd_dev, bool mapping) - if (ret) - goto err_out_probe; - -- ret = rbd_dev_probe_parent(rbd_dev); -+ ret = rbd_dev_probe_parent(rbd_dev, depth); - if (ret) - goto err_out_probe; - -@@ -5020,7 +5031,7 @@ static int rbd_dev_image_probe(struct rbd_device *rbd_dev, bool mapping) - err_out_probe: - rbd_dev_unprobe(rbd_dev); - err_out_watch: -- if (mapping) -+ if (!depth) - rbd_dev_header_unwatch_sync(rbd_dev); - out_header_name: - kfree(rbd_dev->header_name); -@@ -5087,7 +5098,7 @@ static ssize_t do_rbd_add(struct bus_type *bus, - rbdc = NULL; /* rbd_dev now owns this */ - spec = NULL; /* rbd_dev now owns this */ - -- rc = rbd_dev_image_probe(rbd_dev, true); -+ rc = rbd_dev_image_probe(rbd_dev, 0); - if (rc < 0) - goto err_out_rbd_dev; - -diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c -index e88556ac8318..d4285270f20c 100644 ---- a/drivers/block/xen-blkfront.c -+++ b/drivers/block/xen-blkfront.c -@@ -1917,7 +1917,8 @@ static void blkback_changed(struct xenbus_device *dev, - break; - /* Missed the backend's Closing state -- fallthrough */ - case XenbusStateClosing: -- blkfront_closing(info); -+ if (info) -+ blkfront_closing(info); - break; - } - } -diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c -index c51469051e41..958b26dcac8a 100644 ---- a/drivers/gpu/drm/i915/intel_display.c -+++ b/drivers/gpu/drm/i915/intel_display.c -@@ -1451,6 +1451,8 @@ static void i9xx_enable_pll(struct intel_crtc *crtc) - - I915_WRITE(reg, dpll); - -+ I915_WRITE(reg, dpll); -+ - /* Wait for the clocks to stabilize. */ - POSTING_READ(reg); - udelay(150); -diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c -index 27c3fd89e8ce..e85525427d9c 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_gem.c -+++ b/drivers/gpu/drm/nouveau/nouveau_gem.c -@@ -196,11 +196,12 @@ nouveau_gem_info(struct drm_file *file_priv, struct drm_gem_object *gem, - struct nouveau_bo *nvbo = nouveau_gem_object(gem); - struct nouveau_vma *vma; - -- if (nvbo->bo.mem.mem_type == TTM_PL_TT) -+ if (is_power_of_2(nvbo->valid_domains)) -+ rep->domain = nvbo->valid_domains; -+ else if (nvbo->bo.mem.mem_type == TTM_PL_TT) - rep->domain = NOUVEAU_GEM_DOMAIN_GART; - else - rep->domain = NOUVEAU_GEM_DOMAIN_VRAM; -- - rep->offset = nvbo->bo.offset; - if (cli->base.vm) { - vma = nouveau_bo_vma_find(nvbo, cli->base.vm); -diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h -index b837e9f9f8ce..1f14f32853ef 100644 ---- a/drivers/gpu/drm/radeon/radeon.h -+++ b/drivers/gpu/drm/radeon/radeon.h -@@ -1551,6 +1551,7 @@ struct radeon_pm { - struct device *int_hwmon_dev; - /* dpm */ - bool dpm_enabled; -+ bool sysfs_initialized; - struct radeon_dpm dpm; - }; - -diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c -index 214adc6d2a68..0b00de55b2a4 100644 ---- a/drivers/gpu/drm/radeon/radeon_pm.c -+++ b/drivers/gpu/drm/radeon/radeon_pm.c -@@ -1350,19 +1350,23 @@ int radeon_pm_late_init(struct radeon_device *rdev) - - if (rdev->pm.pm_method == PM_METHOD_DPM) { - if (rdev->pm.dpm_enabled) { -- ret = device_create_file(rdev->dev, &dev_attr_power_dpm_state); -- if (ret) -- DRM_ERROR("failed to create device file for dpm state\n"); -- ret = device_create_file(rdev->dev, &dev_attr_power_dpm_force_performance_level); -- if (ret) -- DRM_ERROR("failed to create device file for dpm state\n"); -- /* XXX: these are noops for dpm but are here for backwards compat */ -- ret = device_create_file(rdev->dev, &dev_attr_power_profile); -- if (ret) -- DRM_ERROR("failed to create device file for power profile\n"); -- ret = device_create_file(rdev->dev, &dev_attr_power_method); -- if (ret) -- DRM_ERROR("failed to create device file for power method\n"); -+ if (!rdev->pm.sysfs_initialized) { -+ ret = device_create_file(rdev->dev, &dev_attr_power_dpm_state); -+ if (ret) -+ DRM_ERROR("failed to create device file for dpm state\n"); -+ ret = device_create_file(rdev->dev, &dev_attr_power_dpm_force_performance_level); -+ if (ret) -+ DRM_ERROR("failed to create device file for dpm state\n"); -+ /* XXX: these are noops for dpm but are here for backwards compat */ -+ ret = device_create_file(rdev->dev, &dev_attr_power_profile); -+ if (ret) -+ DRM_ERROR("failed to create device file for power profile\n"); -+ ret = device_create_file(rdev->dev, &dev_attr_power_method); -+ if (ret) -+ DRM_ERROR("failed to create device file for power method\n"); -+ if (!ret) -+ rdev->pm.sysfs_initialized = true; -+ } - - mutex_lock(&rdev->pm.mutex); - ret = radeon_dpm_late_enable(rdev); -@@ -1378,7 +1382,8 @@ int radeon_pm_late_init(struct radeon_device *rdev) - } - } - } else { -- if (rdev->pm.num_power_states > 1) { -+ if ((rdev->pm.num_power_states > 1) && -+ (!rdev->pm.sysfs_initialized)) { - /* where's the best place to put these? */ - ret = device_create_file(rdev->dev, &dev_attr_power_profile); - if (ret) -@@ -1386,6 +1391,8 @@ int radeon_pm_late_init(struct radeon_device *rdev) - ret = device_create_file(rdev->dev, &dev_attr_power_method); - if (ret) - DRM_ERROR("failed to create device file for power method\n"); -+ if (!ret) -+ rdev->pm.sysfs_initialized = true; - } - } - return ret; -diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c -index c3239170d8b7..5311cac12132 100644 ---- a/drivers/infiniband/core/cm.c -+++ b/drivers/infiniband/core/cm.c -@@ -860,6 +860,11 @@ retest: - case IB_CM_SIDR_REQ_RCVD: - spin_unlock_irq(&cm_id_priv->lock); - cm_reject_sidr_req(cm_id_priv, IB_SIDR_REJECT); -+ spin_lock_irq(&cm.lock); -+ if (!RB_EMPTY_NODE(&cm_id_priv->sidr_id_node)) -+ rb_erase(&cm_id_priv->sidr_id_node, -+ &cm.remote_sidr_table); -+ spin_unlock_irq(&cm.lock); - break; - case IB_CM_REQ_SENT: - ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg); -@@ -3099,7 +3104,10 @@ int ib_send_cm_sidr_rep(struct ib_cm_id *cm_id, - spin_unlock_irqrestore(&cm_id_priv->lock, flags); - - spin_lock_irqsave(&cm.lock, flags); -- rb_erase(&cm_id_priv->sidr_id_node, &cm.remote_sidr_table); -+ if (!RB_EMPTY_NODE(&cm_id_priv->sidr_id_node)) { -+ rb_erase(&cm_id_priv->sidr_id_node, &cm.remote_sidr_table); -+ RB_CLEAR_NODE(&cm_id_priv->sidr_id_node); -+ } - spin_unlock_irqrestore(&cm.lock, flags); - return 0; - -diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c -index 935974090aa0..b0cb66208c8b 100644 ---- a/drivers/iommu/amd_iommu.c -+++ b/drivers/iommu/amd_iommu.c -@@ -2152,8 +2152,8 @@ static void set_dte_entry(u16 devid, struct protection_domain *domain, bool ats) - static void clear_dte_entry(u16 devid) - { - /* remove entry from the device table seen by the hardware */ -- amd_iommu_dev_table[devid].data[0] = IOMMU_PTE_P | IOMMU_PTE_TV; -- amd_iommu_dev_table[devid].data[1] = 0; -+ amd_iommu_dev_table[devid].data[0] = IOMMU_PTE_P | IOMMU_PTE_TV; -+ amd_iommu_dev_table[devid].data[1] &= DTE_FLAG_MASK; - - amd_iommu_apply_erratum_63(devid); - } -diff --git a/drivers/iommu/amd_iommu_types.h b/drivers/iommu/amd_iommu_types.h -index e400fbe411de..e0c39940f659 100644 ---- a/drivers/iommu/amd_iommu_types.h -+++ b/drivers/iommu/amd_iommu_types.h -@@ -283,6 +283,7 @@ - #define IOMMU_PTE_IR (1ULL << 61) - #define IOMMU_PTE_IW (1ULL << 62) - -+#define DTE_FLAG_MASK (0x3ffULL << 32) - #define DTE_FLAG_IOTLB (0x01UL << 32) - #define DTE_FLAG_GV (0x01ULL << 55) - #define DTE_GLX_SHIFT (56) -diff --git a/drivers/md/md.c b/drivers/md/md.c -index 31d14d88205b..af837313d431 100644 ---- a/drivers/md/md.c -+++ b/drivers/md/md.c -@@ -7775,8 +7775,7 @@ static int remove_and_add_spares(struct mddev *mddev, - !test_bit(Bitmap_sync, &rdev->flags))) - continue; - -- if (rdev->saved_raid_disk < 0) -- rdev->recovery_offset = 0; -+ rdev->recovery_offset = 0; - if (mddev->pers-> - hot_add_disk(mddev, rdev) == 0) { - if (sysfs_link_rdev(mddev, rdev)) -diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c -index 7c0d75547ccf..92cd09f3c69b 100644 ---- a/drivers/md/persistent-data/dm-btree-remove.c -+++ b/drivers/md/persistent-data/dm-btree-remove.c -@@ -301,11 +301,16 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent, - { - int s; - uint32_t max_entries = le32_to_cpu(left->header.max_entries); -- unsigned target = (nr_left + nr_center + nr_right) / 3; -- BUG_ON(target > max_entries); -+ unsigned total = nr_left + nr_center + nr_right; -+ unsigned target_right = total / 3; -+ unsigned remainder = (target_right * 3) != total; -+ unsigned target_left = target_right + remainder; -+ -+ BUG_ON(target_left > max_entries); -+ BUG_ON(target_right > max_entries); - - if (nr_left < nr_right) { -- s = nr_left - target; -+ s = nr_left - target_left; - - if (s < 0 && nr_center < -s) { - /* not enough in central node */ -@@ -316,10 +321,10 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent, - } else - shift(left, center, s); - -- shift(center, right, target - nr_right); -+ shift(center, right, target_right - nr_right); - - } else { -- s = target - nr_right; -+ s = target_right - nr_right; - if (s > 0 && nr_center < s) { - /* not enough in central node */ - shift(center, right, nr_center); -@@ -329,7 +334,7 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent, - } else - shift(center, right, s); - -- shift(left, center, nr_left - target); -+ shift(left, center, nr_left - target_left); - } - - *key_ptr(parent, c->index) = center->keys[0]; -diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c -index c7726cebc495..d6e47033b5e0 100644 ---- a/drivers/md/persistent-data/dm-btree.c -+++ b/drivers/md/persistent-data/dm-btree.c -@@ -523,7 +523,7 @@ static int btree_split_beneath(struct shadow_spine *s, uint64_t key) - - r = new_block(s->info, &right); - if (r < 0) { -- /* FIXME: put left */ -+ unlock_block(s->info, left); - return r; - } - -diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c -index 47b7c3136807..0d91644e80eb 100644 ---- a/drivers/md/raid1.c -+++ b/drivers/md/raid1.c -@@ -2251,7 +2251,7 @@ static int narrow_write_error(struct r1bio *r1_bio, int i) - bio_trim(wbio, sector - r1_bio->sector, sectors); - wbio->bi_iter.bi_sector += rdev->data_offset; - wbio->bi_bdev = rdev->bdev; -- if (submit_bio_wait(WRITE, wbio) == 0) -+ if (submit_bio_wait(WRITE, wbio) < 0) - /* failure! */ - ok = rdev_set_badblocks(rdev, sector, - sectors, 0) -diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c -index 73c9f579b042..19bc2e1aee26 100644 ---- a/drivers/md/raid10.c -+++ b/drivers/md/raid10.c -@@ -2604,7 +2604,7 @@ static int narrow_write_error(struct r10bio *r10_bio, int i) - choose_data_offset(r10_bio, rdev) + - (sector - r10_bio->sector)); - wbio->bi_bdev = rdev->bdev; -- if (submit_bio_wait(WRITE, wbio) == 0) -+ if (submit_bio_wait(WRITE, wbio) < 0) - /* Failure! */ - ok = rdev_set_badblocks(rdev, sector, - sectors, 0) -diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c -index b98c70e1f1a9..1c829a0b234b 100644 ---- a/drivers/md/raid5.c -+++ b/drivers/md/raid5.c -@@ -3029,6 +3029,8 @@ static void handle_stripe_clean_event(struct r5conf *conf, - } - if (!discard_pending && - test_bit(R5_Discard, &sh->dev[sh->pd_idx].flags)) { -+ int hash = sh->hash_lock_index; -+ - clear_bit(R5_Discard, &sh->dev[sh->pd_idx].flags); - clear_bit(R5_UPTODATE, &sh->dev[sh->pd_idx].flags); - if (sh->qd_idx >= 0) { -@@ -3042,9 +3044,9 @@ static void handle_stripe_clean_event(struct r5conf *conf, - * no updated data, so remove it from hash list and the stripe - * will be reinitialized - */ -- spin_lock_irq(&conf->device_lock); -+ spin_lock_irq(conf->hash_locks + hash); - remove_hash(sh); -- spin_unlock_irq(&conf->device_lock); -+ spin_unlock_irq(conf->hash_locks + hash); - if (test_bit(STRIPE_SYNC_REQUESTED, &sh->state)) - set_bit(STRIPE_HANDLE, &sh->state); - -diff --git a/drivers/net/ethernet/sfc/selftest.c b/drivers/net/ethernet/sfc/selftest.c -index 26641817a9c7..c9fcf6fa5479 100644 ---- a/drivers/net/ethernet/sfc/selftest.c -+++ b/drivers/net/ethernet/sfc/selftest.c -@@ -46,7 +46,7 @@ struct efx_loopback_payload { - struct iphdr ip; - struct udphdr udp; - __be16 iteration; -- const char msg[64]; -+ char msg[64]; - } __packed; - - /* Loopback test source MAC address */ -diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c -index 1fc2e5a26b52..a72cac46f699 100644 ---- a/drivers/net/wireless/ath/ath9k/init.c -+++ b/drivers/net/wireless/ath/ath9k/init.c -@@ -956,6 +956,7 @@ static void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw) - hw->max_rate_tries = 10; - hw->sta_data_size = sizeof(struct ath_node); - hw->vif_data_size = sizeof(struct ath_vif); -+ hw->extra_tx_headroom = 4; - - hw->wiphy->available_antennas_rx = BIT(ah->caps.max_rxchains) - 1; - hw->wiphy->available_antennas_tx = BIT(ah->caps.max_txchains) - 1; -diff --git a/drivers/net/wireless/iwlwifi/dvm/lib.c b/drivers/net/wireless/iwlwifi/dvm/lib.c -index 576f7ee38ca5..78a155e11183 100644 ---- a/drivers/net/wireless/iwlwifi/dvm/lib.c -+++ b/drivers/net/wireless/iwlwifi/dvm/lib.c -@@ -1022,7 +1022,7 @@ static void iwlagn_wowlan_program_keys(struct ieee80211_hw *hw, - u8 *pn = seq.ccmp.pn; - - ieee80211_get_key_rx_seq(key, i, &seq); -- aes_sc->pn = cpu_to_le64( -+ aes_sc[i].pn = cpu_to_le64( - (u64)pn[5] | - ((u64)pn[4] << 8) | - ((u64)pn[3] << 16) | -diff --git a/drivers/net/wireless/iwlwifi/iwl-7000.c b/drivers/net/wireless/iwlwifi/iwl-7000.c -index e1d546665ae8..28e18de9f429 100644 ---- a/drivers/net/wireless/iwlwifi/iwl-7000.c -+++ b/drivers/net/wireless/iwlwifi/iwl-7000.c -@@ -222,5 +222,5 @@ const struct iwl_cfg iwl7265_n_cfg = { - }; - - MODULE_FIRMWARE(IWL7260_MODULE_FIRMWARE(IWL7260_UCODE_API_OK)); --MODULE_FIRMWARE(IWL3160_MODULE_FIRMWARE(IWL3160_UCODE_API_OK)); -+MODULE_FIRMWARE(IWL3160_MODULE_FIRMWARE(IWL7260_UCODE_API_OK)); - MODULE_FIRMWARE(IWL7265_MODULE_FIRMWARE(IWL7260_UCODE_API_OK)); -diff --git a/drivers/net/wireless/iwlwifi/mvm/d3.c b/drivers/net/wireless/iwlwifi/mvm/d3.c -index f36a7ee0267f..8e844d580cc6 100644 ---- a/drivers/net/wireless/iwlwifi/mvm/d3.c -+++ b/drivers/net/wireless/iwlwifi/mvm/d3.c -@@ -297,12 +297,12 @@ static void iwl_mvm_wowlan_program_keys(struct ieee80211_hw *hw, - u8 *pn = seq.ccmp.pn; - - ieee80211_get_key_rx_seq(key, i, &seq); -- aes_sc->pn = cpu_to_le64((u64)pn[5] | -- ((u64)pn[4] << 8) | -- ((u64)pn[3] << 16) | -- ((u64)pn[2] << 24) | -- ((u64)pn[1] << 32) | -- ((u64)pn[0] << 40)); -+ aes_sc[i].pn = cpu_to_le64((u64)pn[5] | -+ ((u64)pn[4] << 8) | -+ ((u64)pn[3] << 16) | -+ ((u64)pn[2] << 24) | -+ ((u64)pn[1] << 32) | -+ ((u64)pn[0] << 40)); - } - data->use_rsc_tsc = true; - break; -diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c -index 1ac33d9cd396..988f9fec0bff 100644 ---- a/drivers/net/wireless/iwlwifi/pcie/drv.c -+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c -@@ -396,6 +396,11 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = { - {IWL_PCI_DEVICE(0x095A, 0x5590, iwl7265_2ac_cfg)}, - {IWL_PCI_DEVICE(0x095B, 0x5290, iwl7265_2ac_cfg)}, - {IWL_PCI_DEVICE(0x095A, 0x5490, iwl7265_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x095A, 0x5F10, iwl7265_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x095B, 0x5212, iwl7265_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x095B, 0x520A, iwl7265_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x095A, 0x9000, iwl7265_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x095A, 0x9400, iwl7265_2ac_cfg)}, - #endif /* CONFIG_IWLMVM */ - - {0} -diff --git a/drivers/power/bq24190_charger.c b/drivers/power/bq24190_charger.c -index e4c95e1a6733..d0e8236a6404 100644 ---- a/drivers/power/bq24190_charger.c -+++ b/drivers/power/bq24190_charger.c -@@ -1208,7 +1208,7 @@ static irqreturn_t bq24190_irq_handler_thread(int irq, void *data) - { - struct bq24190_dev_info *bdi = data; - bool alert_userspace = false; -- u8 ss_reg, f_reg; -+ u8 ss_reg = 0, f_reg = 0; - int ret; - - pm_runtime_get_sync(bdi->dev); -diff --git a/drivers/scsi/mvsas/mv_sas.c b/drivers/scsi/mvsas/mv_sas.c -index 4c0b8b4e1d40..42b1f3318e59 100644 ---- a/drivers/scsi/mvsas/mv_sas.c -+++ b/drivers/scsi/mvsas/mv_sas.c -@@ -988,6 +988,8 @@ static void mvs_slot_free(struct mvs_info *mvi, u32 rx_desc) - static void mvs_slot_task_free(struct mvs_info *mvi, struct sas_task *task, - struct mvs_slot_info *slot, u32 slot_idx) - { -+ if (!slot) -+ return; - if (!slot->task) - return; - if (!sas_protocol_ata(task->task_proto)) -diff --git a/drivers/staging/iio/adc/mxs-lradc.c b/drivers/staging/iio/adc/mxs-lradc.c -index 27e1a6e62d06..503846c3e620 100644 ---- a/drivers/staging/iio/adc/mxs-lradc.c -+++ b/drivers/staging/iio/adc/mxs-lradc.c -@@ -920,11 +920,12 @@ static int mxs_lradc_read_raw(struct iio_dev *iio_dev, - case IIO_CHAN_INFO_OFFSET: - if (chan->type == IIO_TEMP) { - /* The calculated value from the ADC is in Kelvin, we -- * want Celsius for hwmon so the offset is -- * -272.15 * scale -+ * want Celsius for hwmon so the offset is -273.15 -+ * The offset is applied before scaling so it is -+ * actually -213.15 * 4 / 1.012 = -1079.644268 - */ -- *val = -1075; -- *val2 = 691699; -+ *val = -1079; -+ *val2 = 644268; - - return IIO_VAL_INT_PLUS_MICRO; - } -diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c -index 5892eab03874..996f8f3fd423 100644 ---- a/drivers/tty/serial/8250/8250_pci.c -+++ b/drivers/tty/serial/8250/8250_pci.c -@@ -1772,6 +1772,9 @@ pci_wch_ch353_setup(struct serial_private *priv, - #define PCI_DEVICE_ID_SUNIX_1999 0x1999 - - -+#define PCI_DEVICE_ID_EXAR_XR17V4358 0x4358 -+#define PCI_DEVICE_ID_EXAR_XR17V8358 0x8358 -+ - /* Unknown vendors/cards - this should not be in linux/pci_ids.h */ - #define PCI_SUBDEVICE_ID_UNKNOWN_0x1584 0x1584 - #define PCI_SUBDEVICE_ID_UNKNOWN_0x1588 0x1588 -@@ -2266,6 +2269,20 @@ static struct pci_serial_quirk pci_serial_quirks[] __refdata = { - .subdevice = PCI_ANY_ID, - .setup = pci_xr17v35x_setup, - }, -+ { -+ .vendor = PCI_VENDOR_ID_EXAR, -+ .device = PCI_DEVICE_ID_EXAR_XR17V4358, -+ .subvendor = PCI_ANY_ID, -+ .subdevice = PCI_ANY_ID, -+ .setup = pci_xr17v35x_setup, -+ }, -+ { -+ .vendor = PCI_VENDOR_ID_EXAR, -+ .device = PCI_DEVICE_ID_EXAR_XR17V8358, -+ .subvendor = PCI_ANY_ID, -+ .subdevice = PCI_ANY_ID, -+ .setup = pci_xr17v35x_setup, -+ }, - /* - * Xircom cards - */ -@@ -2706,6 +2723,8 @@ enum pci_board_num_t { - pbn_exar_XR17V352, - pbn_exar_XR17V354, - pbn_exar_XR17V358, -+ pbn_exar_XR17V4358, -+ pbn_exar_XR17V8358, - pbn_exar_ibm_saturn, - pbn_pasemi_1682M, - pbn_ni8430_2, -@@ -3375,6 +3394,22 @@ static struct pciserial_board pci_boards[] = { - .reg_shift = 0, - .first_offset = 0, - }, -+ [pbn_exar_XR17V4358] = { -+ .flags = FL_BASE0, -+ .num_ports = 12, -+ .base_baud = 7812500, -+ .uart_offset = 0x400, -+ .reg_shift = 0, -+ .first_offset = 0, -+ }, -+ [pbn_exar_XR17V8358] = { -+ .flags = FL_BASE0, -+ .num_ports = 16, -+ .base_baud = 7812500, -+ .uart_offset = 0x400, -+ .reg_shift = 0, -+ .first_offset = 0, -+ }, - [pbn_exar_ibm_saturn] = { - .flags = FL_BASE0, - .num_ports = 1, -@@ -4731,7 +4766,7 @@ static struct pci_device_id serial_pci_tbl[] = { - 0, - 0, pbn_exar_XR17C158 }, - /* -- * Exar Corp. XR17V35[248] Dual/Quad/Octal PCIe UARTs -+ * Exar Corp. XR17V[48]35[248] Dual/Quad/Octal/Hexa PCIe UARTs - */ - { PCI_VENDOR_ID_EXAR, PCI_DEVICE_ID_EXAR_XR17V352, - PCI_ANY_ID, PCI_ANY_ID, -@@ -4745,7 +4780,14 @@ static struct pci_device_id serial_pci_tbl[] = { - PCI_ANY_ID, PCI_ANY_ID, - 0, - 0, pbn_exar_XR17V358 }, -- -+ { PCI_VENDOR_ID_EXAR, PCI_DEVICE_ID_EXAR_XR17V4358, -+ PCI_ANY_ID, PCI_ANY_ID, -+ 0, -+ 0, pbn_exar_XR17V4358 }, -+ { PCI_VENDOR_ID_EXAR, PCI_DEVICE_ID_EXAR_XR17V8358, -+ PCI_ANY_ID, PCI_ANY_ID, -+ 0, -+ 0, pbn_exar_XR17V8358 }, - /* - * Topic TP560 Data/Fax/Voice 56k modem (reported by Evan Clarke) - */ -diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c -index eb3399f4c1ed..44af2b02d701 100644 ---- a/drivers/usb/host/xhci-pci.c -+++ b/drivers/usb/host/xhci-pci.c -@@ -140,6 +140,7 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) - xhci->quirks |= XHCI_SPURIOUS_WAKEUP; - - xhci->quirks |= XHCI_SPURIOUS_REBOOT; -+ xhci->quirks |= XHCI_SPURIOUS_WAKEUP; - } - if (pdev->vendor == PCI_VENDOR_ID_ETRON && - pdev->device == PCI_DEVICE_ID_ASROCK_P67) { -diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c -index 86a0ddd8efb7..bd993fe00e0c 100644 ---- a/drivers/usb/host/xhci-ring.c -+++ b/drivers/usb/host/xhci-ring.c -@@ -2417,6 +2417,7 @@ static int handle_tx_event(struct xhci_hcd *xhci, - u32 trb_comp_code; - int ret = 0; - int td_num = 0; -+ bool handling_skipped_tds = false; - - slot_id = TRB_TO_SLOT_ID(le32_to_cpu(event->flags)); - xdev = xhci->devs[slot_id]; -@@ -2550,6 +2551,10 @@ static int handle_tx_event(struct xhci_hcd *xhci, - ep->skip = true; - xhci_dbg(xhci, "Miss service interval error, set skip flag\n"); - goto cleanup; -+ case COMP_PING_ERR: -+ ep->skip = true; -+ xhci_dbg(xhci, "No Ping response error, Skip one Isoc TD\n"); -+ goto cleanup; - default: - if (xhci_is_vendor_info_code(xhci, trb_comp_code)) { - status = 0; -@@ -2681,13 +2686,18 @@ static int handle_tx_event(struct xhci_hcd *xhci, - ep, &status); - - cleanup: -+ -+ -+ handling_skipped_tds = ep->skip && -+ trb_comp_code != COMP_MISSED_INT && -+ trb_comp_code != COMP_PING_ERR; -+ - /* -- * Do not update event ring dequeue pointer if ep->skip is set. -- * Will roll back to continue process missed tds. -+ * Do not update event ring dequeue pointer if we're in a loop -+ * processing missed tds. - */ -- if (trb_comp_code == COMP_MISSED_INT || !ep->skip) { -+ if (!handling_skipped_tds) - inc_deq(xhci, xhci->event_ring); -- } - - if (ret) { - urb = td->urb; -@@ -2722,7 +2732,7 @@ cleanup: - * Process them as short transfer until reach the td pointed by - * the event. - */ -- } while (ep->skip && trb_comp_code != COMP_MISSED_INT); -+ } while (handling_skipped_tds); - - return 0; - } -diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c -index 486d710a5293..6aeea1936aea 100644 ---- a/drivers/vhost/scsi.c -+++ b/drivers/vhost/scsi.c -@@ -1139,7 +1139,7 @@ tcm_vhost_send_evt(struct vhost_scsi *vs, - * lun[4-7] need to be zero according to virtio-scsi spec. - */ - evt->event.lun[0] = 0x01; -- evt->event.lun[1] = tpg->tport_tpgt & 0xFF; -+ evt->event.lun[1] = tpg->tport_tpgt; - if (lun->unpacked_lun >= 256) - evt->event.lun[2] = lun->unpacked_lun >> 8 | 0x40 ; - evt->event.lun[3] = lun->unpacked_lun & 0xFF; -@@ -2004,12 +2004,12 @@ tcm_vhost_make_tpg(struct se_wwn *wwn, - struct tcm_vhost_tport, tport_wwn); - - struct tcm_vhost_tpg *tpg; -- unsigned long tpgt; -+ u16 tpgt; - int ret; - - if (strstr(name, "tpgt_") != name) - return ERR_PTR(-EINVAL); -- if (kstrtoul(name + 5, 10, &tpgt) || tpgt > UINT_MAX) -+ if (kstrtou16(name + 5, 10, &tpgt) || tpgt >= VHOST_SCSI_MAX_TARGET) - return ERR_PTR(-EINVAL); - - tpg = kzalloc(sizeof(struct tcm_vhost_tpg), GFP_KERNEL); -diff --git a/include/sound/wm8904.h b/include/sound/wm8904.h -index 898be3a8db9a..6d8f8fba3341 100644 ---- a/include/sound/wm8904.h -+++ b/include/sound/wm8904.h -@@ -119,7 +119,7 @@ - #define WM8904_MIC_REGS 2 - #define WM8904_GPIO_REGS 4 - #define WM8904_DRC_REGS 4 --#define WM8904_EQ_REGS 25 -+#define WM8904_EQ_REGS 24 - - /** - * DRC configurations are specified with a label and a set of register -diff --git a/kernel/module.c b/kernel/module.c -index 1d679a6c942f..49f17c27bf11 100644 ---- a/kernel/module.c -+++ b/kernel/module.c -@@ -915,11 +915,15 @@ void symbol_put_addr(void *addr) - if (core_kernel_text(a)) - return; - -- /* module_text_address is safe here: we're supposed to have reference -- * to module from symbol_get, so it can't go away. */ -+ /* -+ * Even though we hold a reference on the module; we still need to -+ * disable preemption in order to safely traverse the data structure. -+ */ -+ preempt_disable(); - modaddr = __module_text_address(a); - BUG_ON(!modaddr); - module_put(modaddr); -+ preempt_enable(); - } - EXPORT_SYMBOL_GPL(symbol_put_addr); - -diff --git a/mm/filemap.c b/mm/filemap.c -index 217cfd3b3264..ca9efc6fff3b 100644 ---- a/mm/filemap.c -+++ b/mm/filemap.c -@@ -2509,6 +2509,11 @@ again: - break; - } - -+ if (fatal_signal_pending(current)) { -+ status = -EINTR; -+ break; -+ } -+ - status = a_ops->write_begin(file, mapping, pos, bytes, flags, - &page, &fsdata); - if (unlikely(status < 0)) -@@ -2546,10 +2551,6 @@ again: - written += copied; - - balance_dirty_pages_ratelimited(mapping); -- if (fatal_signal_pending(current)) { -- status = -EINTR; -- break; -- } - } while (iov_iter_count(i)); - - return written ? written : status; diff --git a/patch/kernel/odroidc2-default/patch-3.14.57-58.patch b/patch/kernel/odroidc2-default/patch-3.14.57-58.patch deleted file mode 100644 index 56aed0cc10..0000000000 --- a/patch/kernel/odroidc2-default/patch-3.14.57-58.patch +++ /dev/null @@ -1,1007 +0,0 @@ -diff --git a/Makefile b/Makefile -index 51ee14329c47..48a4d0b37c10 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 3 - PATCHLEVEL = 14 --SUBLEVEL = 57 -+SUBLEVEL = 58 - EXTRAVERSION = - NAME = Remembering Coco - -diff --git a/arch/arm/common/edma.c b/arch/arm/common/edma.c -index 5339009b3c0c..4873697b0958 100644 ---- a/arch/arm/common/edma.c -+++ b/arch/arm/common/edma.c -@@ -404,7 +404,8 @@ static irqreturn_t dma_irq_handler(int irq, void *data) - BIT(slot)); - if (edma_cc[ctlr]->intr_data[channel].callback) - edma_cc[ctlr]->intr_data[channel].callback( -- channel, EDMA_DMA_COMPLETE, -+ EDMA_CTLR_CHAN(ctlr, channel), -+ EDMA_DMA_COMPLETE, - edma_cc[ctlr]->intr_data[channel].data); - } - } while (sh_ipr); -@@ -458,7 +459,8 @@ static irqreturn_t dma_ccerr_handler(int irq, void *data) - if (edma_cc[ctlr]->intr_data[k]. - callback) { - edma_cc[ctlr]->intr_data[k]. -- callback(k, -+ callback( -+ EDMA_CTLR_CHAN(ctlr, k), - EDMA_DMA_CC_ERROR, - edma_cc[ctlr]->intr_data - [k].data); -diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c -index 42f2fb8c5a00..887b19e915ee 100644 ---- a/arch/arm/mm/dma-mapping.c -+++ b/arch/arm/mm/dma-mapping.c -@@ -1411,12 +1411,19 @@ static int arm_iommu_mmap_attrs(struct device *dev, struct vm_area_struct *vma, - unsigned long uaddr = vma->vm_start; - unsigned long usize = vma->vm_end - vma->vm_start; - struct page **pages = __iommu_get_pages(cpu_addr, attrs); -+ unsigned long nr_pages = PAGE_ALIGN(size) >> PAGE_SHIFT; -+ unsigned long off = vma->vm_pgoff; - - vma->vm_page_prot = __get_dma_pgprot(attrs, vma->vm_page_prot); - - if (!pages) - return -ENXIO; - -+ if (off >= nr_pages || (usize >> PAGE_SHIFT) > nr_pages - off) -+ return -ENXIO; -+ -+ pages += off; -+ - do { - int ret = vm_insert_page(vma, uaddr, *pages++); - if (ret) { -diff --git a/arch/arm/plat-orion/common.c b/arch/arm/plat-orion/common.c -index 830ff07f3385..410e60e0e6de 100644 ---- a/arch/arm/plat-orion/common.c -+++ b/arch/arm/plat-orion/common.c -@@ -499,7 +499,7 @@ void __init orion_ge00_switch_init(struct dsa_platform_data *d, int irq) - - d->netdev = &orion_ge00.dev; - for (i = 0; i < d->nr_chips; i++) -- d->chip[i].mii_bus = &orion_ge00_shared.dev; -+ d->chip[i].mii_bus = &orion_ge_mvmdio.dev; - orion_switch_device.dev.platform_data = d; - - platform_device_register(&orion_switch_device); -diff --git a/arch/arm64/include/asm/ptrace.h b/arch/arm64/include/asm/ptrace.h -index 0e7fa4963735..428ae6f7a23b 100644 ---- a/arch/arm64/include/asm/ptrace.h -+++ b/arch/arm64/include/asm/ptrace.h -@@ -71,14 +71,14 @@ - #define compat_sp regs[13] - #define compat_lr regs[14] - #define compat_sp_hyp regs[15] --#define compat_sp_irq regs[16] --#define compat_lr_irq regs[17] --#define compat_sp_svc regs[18] --#define compat_lr_svc regs[19] --#define compat_sp_abt regs[20] --#define compat_lr_abt regs[21] --#define compat_sp_und regs[22] --#define compat_lr_und regs[23] -+#define compat_lr_irq regs[16] -+#define compat_sp_irq regs[17] -+#define compat_lr_svc regs[18] -+#define compat_sp_svc regs[19] -+#define compat_lr_abt regs[20] -+#define compat_sp_abt regs[21] -+#define compat_lr_und regs[22] -+#define compat_sp_und regs[23] - #define compat_r8_fiq regs[24] - #define compat_r9_fiq regs[25] - #define compat_r10_fiq regs[26] -diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c -index e6bddd5b9da3..e5194f3028ba 100644 ---- a/arch/x86/kernel/cpu/common.c -+++ b/arch/x86/kernel/cpu/common.c -@@ -280,10 +280,9 @@ __setup("nosmap", setup_disable_smap); - - static __always_inline void setup_smap(struct cpuinfo_x86 *c) - { -- unsigned long eflags; -+ unsigned long eflags = native_save_fl(); - - /* This should have been cleared long ago */ -- raw_local_save_flags(eflags); - BUG_ON(eflags & X86_EFLAGS_AC); - - if (cpu_has(c, X86_FEATURE_SMAP)) { -diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S -index a2dc0add72ed..761fd69df6d9 100644 ---- a/arch/x86/kernel/head_64.S -+++ b/arch/x86/kernel/head_64.S -@@ -65,6 +65,9 @@ startup_64: - * tables and then reload them. - */ - -+ /* Sanitize CPU configuration */ -+ call verify_cpu -+ - /* - * Compute the delta between the address I am compiled to run at and the - * address I am actually running at. -@@ -174,6 +177,9 @@ ENTRY(secondary_startup_64) - * after the boot processor executes this code. - */ - -+ /* Sanitize CPU configuration */ -+ call verify_cpu -+ - movq $(init_level4_pgt - __START_KERNEL_map), %rax - 1: - -@@ -288,6 +294,8 @@ ENTRY(secondary_startup_64) - pushq %rax # target address in negative space - lretq - -+#include "verify_cpu.S" -+ - #ifdef CONFIG_HOTPLUG_CPU - /* - * Boot CPU0 entry point. It's called from play_dead(). Everything has been set -diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c -index ce72964b2f46..040718106629 100644 ---- a/arch/x86/kernel/setup.c -+++ b/arch/x86/kernel/setup.c -@@ -1178,6 +1178,14 @@ void __init setup_arch(char **cmdline_p) - clone_pgd_range(initial_page_table + KERNEL_PGD_BOUNDARY, - swapper_pg_dir + KERNEL_PGD_BOUNDARY, - KERNEL_PGD_PTRS); -+ -+ /* -+ * sync back low identity map too. It is used for example -+ * in the 32-bit EFI stub. -+ */ -+ clone_pgd_range(initial_page_table, -+ swapper_pg_dir + KERNEL_PGD_BOUNDARY, -+ min(KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY)); - #endif - - tboot_probe(); -diff --git a/arch/x86/kernel/verify_cpu.S b/arch/x86/kernel/verify_cpu.S -index b9242bacbe59..4cf401f581e7 100644 ---- a/arch/x86/kernel/verify_cpu.S -+++ b/arch/x86/kernel/verify_cpu.S -@@ -34,10 +34,11 @@ - #include - - verify_cpu: -- pushfl # Save caller passed flags -- pushl $0 # Kill any dangerous flags -- popfl -+ pushf # Save caller passed flags -+ push $0 # Kill any dangerous flags -+ popf - -+#ifndef __x86_64__ - pushfl # standard way to check for cpuid - popl %eax - movl %eax,%ebx -@@ -48,6 +49,7 @@ verify_cpu: - popl %eax - cmpl %eax,%ebx - jz verify_cpu_no_longmode # cpu has no cpuid -+#endif - - movl $0x0,%eax # See if cpuid 1 is implemented - cpuid -@@ -130,10 +132,10 @@ verify_cpu_sse_test: - jmp verify_cpu_sse_test # try again - - verify_cpu_no_longmode: -- popfl # Restore caller passed flags -+ popf # Restore caller passed flags - movl $1,%eax - ret - verify_cpu_sse_ok: -- popfl # Restore caller passed flags -+ popf # Restore caller passed flags - xorl %eax, %eax - ret -diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c -index 8ff2b3ca7ee9..2a09de8d6d71 100644 ---- a/drivers/bluetooth/ath3k.c -+++ b/drivers/bluetooth/ath3k.c -@@ -90,6 +90,7 @@ static const struct usb_device_id ath3k_table[] = { - { USB_DEVICE(0x04CA, 0x300b) }, - { USB_DEVICE(0x04CA, 0x3010) }, - { USB_DEVICE(0x0930, 0x0219) }, -+ { USB_DEVICE(0x0930, 0x021c) }, - { USB_DEVICE(0x0930, 0x0220) }, - { USB_DEVICE(0x0930, 0x0227) }, - { USB_DEVICE(0x0b05, 0x17d0) }, -@@ -101,6 +102,7 @@ static const struct usb_device_id ath3k_table[] = { - { USB_DEVICE(0x0CF3, 0x311F) }, - { USB_DEVICE(0x0cf3, 0x3121) }, - { USB_DEVICE(0x0CF3, 0x817a) }, -+ { USB_DEVICE(0x0CF3, 0x817b) }, - { USB_DEVICE(0x0cf3, 0xe003) }, - { USB_DEVICE(0x0CF3, 0xE004) }, - { USB_DEVICE(0x0CF3, 0xE005) }, -@@ -146,6 +148,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = { - { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 }, -@@ -157,6 +160,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = { - { USB_DEVICE(0x0cf3, 0x311F), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0CF3, 0x817a), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0CF3, 0x817b), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 }, -diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c -index c23658e42fc3..5d5e99902475 100644 ---- a/drivers/bluetooth/btusb.c -+++ b/drivers/bluetooth/btusb.c -@@ -168,6 +168,7 @@ static const struct usb_device_id blacklist_table[] = { - { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 }, -@@ -179,6 +180,7 @@ static const struct usb_device_id blacklist_table[] = { - { USB_DEVICE(0x0cf3, 0x311f), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0cf3, 0x817b), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 }, -diff --git a/drivers/net/can/sja1000/sja1000.c b/drivers/net/can/sja1000/sja1000.c -index f17c3018b7c7..c2d0559115d3 100644 ---- a/drivers/net/can/sja1000/sja1000.c -+++ b/drivers/net/can/sja1000/sja1000.c -@@ -184,6 +184,9 @@ static void sja1000_start(struct net_device *dev) - priv->write_reg(priv, SJA1000_RXERR, 0x0); - priv->read_reg(priv, SJA1000_ECC); - -+ /* clear interrupt flags */ -+ priv->read_reg(priv, SJA1000_IR); -+ - /* leave reset mode */ - set_normal_mode(dev); - } -diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c -index 96fc7fe8519f..c089fa1ceea9 100644 ---- a/drivers/net/ethernet/marvell/mvneta.c -+++ b/drivers/net/ethernet/marvell/mvneta.c -@@ -950,7 +950,7 @@ static void mvneta_defaults_set(struct mvneta_port *pp) - /* Set CPU queue access map - all CPUs have access to all RX - * queues and to all TX queues - */ -- for (cpu = 0; cpu < CONFIG_NR_CPUS; cpu++) -+ for_each_present_cpu(cpu) - mvreg_write(pp, MVNETA_CPU_MAP(cpu), - (MVNETA_CPU_RXQ_ACCESS_ALL_MASK | - MVNETA_CPU_TXQ_ACCESS_ALL_MASK)); -diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c -index 0d02fba94536..54004a6e2820 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/cmd.c -+++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c -@@ -1987,7 +1987,7 @@ int mlx4_multi_func_init(struct mlx4_dev *dev) - spin_lock_init(&s_state->lock); - } - -- memset(&priv->mfunc.master.cmd_eqe, 0, dev->caps.eqe_size); -+ memset(&priv->mfunc.master.cmd_eqe, 0, sizeof(struct mlx4_eqe)); - priv->mfunc.master.cmd_eqe.type = MLX4_EVENT_TYPE_CMD; - INIT_WORK(&priv->mfunc.master.comm_work, - mlx4_master_comm_channel); -diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c -index e8a1baa87c95..44c2df923fa3 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/eq.c -+++ b/drivers/net/ethernet/mellanox/mlx4/eq.c -@@ -183,7 +183,7 @@ static void slave_event(struct mlx4_dev *dev, u8 slave, struct mlx4_eqe *eqe) - return; - } - -- memcpy(s_eqe, eqe, dev->caps.eqe_size - 1); -+ memcpy(s_eqe, eqe, sizeof(struct mlx4_eqe) - 1); - s_eqe->slave_id = slave; - /* ensure all information is written before setting the ownersip bit */ - wmb(); -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c -index c5f9cb85c8ef..ff08be535a4d 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c -@@ -731,10 +731,13 @@ static int stmmac_get_ts_info(struct net_device *dev, - { - struct stmmac_priv *priv = netdev_priv(dev); - -- if ((priv->hwts_tx_en) && (priv->hwts_rx_en)) { -+ if ((priv->dma_cap.time_stamp || priv->dma_cap.atime_stamp)) { - -- info->so_timestamping = SOF_TIMESTAMPING_TX_HARDWARE | -+ info->so_timestamping = SOF_TIMESTAMPING_TX_SOFTWARE | -+ SOF_TIMESTAMPING_TX_HARDWARE | -+ SOF_TIMESTAMPING_RX_SOFTWARE | - SOF_TIMESTAMPING_RX_HARDWARE | -+ SOF_TIMESTAMPING_SOFTWARE | - SOF_TIMESTAMPING_RAW_HARDWARE; - - if (priv->ptp_clock) -diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c -index e8c21f911b6f..6185874a088e 100644 ---- a/drivers/net/macvtap.c -+++ b/drivers/net/macvtap.c -@@ -68,7 +68,7 @@ static const struct proto_ops macvtap_socket_ops; - #define TUN_OFFLOADS (NETIF_F_HW_CSUM | NETIF_F_TSO_ECN | NETIF_F_TSO | \ - NETIF_F_TSO6 | NETIF_F_UFO) - #define RX_OFFLOADS (NETIF_F_GRO | NETIF_F_LRO) --#define TAP_FEATURES (NETIF_F_GSO | NETIF_F_SG) -+#define TAP_FEATURES (NETIF_F_GSO | NETIF_F_SG | NETIF_F_FRAGLIST) - - static struct macvlan_dev *macvtap_get_vlan_rcu(const struct net_device *dev) - { -diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c -index f606b5ba611f..5aa563136373 100644 ---- a/drivers/net/ppp/pppoe.c -+++ b/drivers/net/ppp/pppoe.c -@@ -569,7 +569,7 @@ static int pppoe_release(struct socket *sock) - - po = pppox_sk(sk); - -- if (sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND | PPPOX_ZOMBIE)) { -+ if (po->pppoe_dev) { - dev_put(po->pppoe_dev); - po->pppoe_dev = NULL; - } -diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c -index 841b60831df1..5c150a0c5ee2 100644 ---- a/drivers/net/virtio_net.c -+++ b/drivers/net/virtio_net.c -@@ -1652,9 +1652,9 @@ static int virtnet_probe(struct virtio_device *vdev) - /* Do we support "hardware" checksums? */ - if (virtio_has_feature(vdev, VIRTIO_NET_F_CSUM)) { - /* This opens up the world of extra features. */ -- dev->hw_features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST; -+ dev->hw_features |= NETIF_F_HW_CSUM | NETIF_F_SG; - if (csum) -- dev->features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST; -+ dev->features |= NETIF_F_HW_CSUM | NETIF_F_SG; - - if (virtio_has_feature(vdev, VIRTIO_NET_F_GSO)) { - dev->hw_features |= NETIF_F_TSO | NETIF_F_UFO -diff --git a/drivers/net/wireless/mwifiex/debugfs.c b/drivers/net/wireless/mwifiex/debugfs.c -index a5f9875cfd6e..f84e5d7e8bbe 100644 ---- a/drivers/net/wireless/mwifiex/debugfs.c -+++ b/drivers/net/wireless/mwifiex/debugfs.c -@@ -637,7 +637,7 @@ mwifiex_rdeeprom_read(struct file *file, char __user *ubuf, - (struct mwifiex_private *) file->private_data; - unsigned long addr = get_zeroed_page(GFP_KERNEL); - char *buf = (char *) addr; -- int pos = 0, ret = 0, i; -+ int pos, ret, i; - u8 value[MAX_EEPROM_DATA]; - - if (!buf) -@@ -645,7 +645,7 @@ mwifiex_rdeeprom_read(struct file *file, char __user *ubuf, - - if (saved_offset == -1) { - /* No command has been given */ -- pos += snprintf(buf, PAGE_SIZE, "0"); -+ pos = snprintf(buf, PAGE_SIZE, "0"); - goto done; - } - -@@ -654,17 +654,17 @@ mwifiex_rdeeprom_read(struct file *file, char __user *ubuf, - (u16) saved_bytes, value); - if (ret) { - ret = -EINVAL; -- goto done; -+ goto out_free; - } - -- pos += snprintf(buf, PAGE_SIZE, "%d %d ", saved_offset, saved_bytes); -+ pos = snprintf(buf, PAGE_SIZE, "%d %d ", saved_offset, saved_bytes); - - for (i = 0; i < saved_bytes; i++) -- pos += snprintf(buf + strlen(buf), PAGE_SIZE, "%d ", value[i]); -- -- ret = simple_read_from_buffer(ubuf, count, ppos, buf, pos); -+ pos += scnprintf(buf + pos, PAGE_SIZE - pos, "%d ", value[i]); - - done: -+ ret = simple_read_from_buffer(ubuf, count, ppos, buf, pos); -+out_free: - free_page(addr); - return ret; - } -diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c -index bbd5888e316b..11c7fcc1048f 100644 ---- a/drivers/staging/rtl8712/usb_intf.c -+++ b/drivers/staging/rtl8712/usb_intf.c -@@ -144,6 +144,7 @@ static struct usb_device_id rtl871x_usb_id_tbl[] = { - {USB_DEVICE(0x0DF6, 0x0058)}, - {USB_DEVICE(0x0DF6, 0x0049)}, - {USB_DEVICE(0x0DF6, 0x004C)}, -+ {USB_DEVICE(0x0DF6, 0x006C)}, - {USB_DEVICE(0x0DF6, 0x0064)}, - /* Skyworth */ - {USB_DEVICE(0x14b2, 0x3300)}, -diff --git a/drivers/usb/class/usblp.c b/drivers/usb/class/usblp.c -index 0924ee40a966..b9adc2ec49dd 100644 ---- a/drivers/usb/class/usblp.c -+++ b/drivers/usb/class/usblp.c -@@ -869,11 +869,11 @@ static int usblp_wwait(struct usblp *usblp, int nonblock) - - add_wait_queue(&usblp->wwait, &waita); - for (;;) { -- set_current_state(TASK_INTERRUPTIBLE); - if (mutex_lock_interruptible(&usblp->mut)) { - rc = -EINTR; - break; - } -+ set_current_state(TASK_INTERRUPTIBLE); - rc = usblp_wtest(usblp, nonblock); - mutex_unlock(&usblp->mut); - if (rc <= 0) -diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c -index ec69b90475c7..d7e0b3651907 100644 ---- a/drivers/usb/musb/musb_core.c -+++ b/drivers/usb/musb/musb_core.c -@@ -132,7 +132,7 @@ static inline struct musb *dev_to_musb(struct device *dev) - /*-------------------------------------------------------------------------*/ - - #ifndef CONFIG_BLACKFIN --static int musb_ulpi_read(struct usb_phy *phy, u32 offset) -+static int musb_ulpi_read(struct usb_phy *phy, u32 reg) - { - void __iomem *addr = phy->io_priv; - int i = 0; -@@ -151,7 +151,7 @@ static int musb_ulpi_read(struct usb_phy *phy, u32 offset) - * ULPICarKitControlDisableUTMI after clearing POWER_SUSPENDM. - */ - -- musb_writeb(addr, MUSB_ULPI_REG_ADDR, (u8)offset); -+ musb_writeb(addr, MUSB_ULPI_REG_ADDR, (u8)reg); - musb_writeb(addr, MUSB_ULPI_REG_CONTROL, - MUSB_ULPI_REG_REQ | MUSB_ULPI_RDN_WR); - -@@ -176,7 +176,7 @@ out: - return ret; - } - --static int musb_ulpi_write(struct usb_phy *phy, u32 offset, u32 data) -+static int musb_ulpi_write(struct usb_phy *phy, u32 val, u32 reg) - { - void __iomem *addr = phy->io_priv; - int i = 0; -@@ -191,8 +191,8 @@ static int musb_ulpi_write(struct usb_phy *phy, u32 offset, u32 data) - power &= ~MUSB_POWER_SUSPENDM; - musb_writeb(addr, MUSB_POWER, power); - -- musb_writeb(addr, MUSB_ULPI_REG_ADDR, (u8)offset); -- musb_writeb(addr, MUSB_ULPI_REG_DATA, (u8)data); -+ musb_writeb(addr, MUSB_ULPI_REG_ADDR, (u8)reg); -+ musb_writeb(addr, MUSB_ULPI_REG_DATA, (u8)val); - musb_writeb(addr, MUSB_ULPI_REG_CONTROL, MUSB_ULPI_REG_REQ); - - while (!(musb_readb(addr, MUSB_ULPI_REG_CONTROL) -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index c918075e5eae..bdbe642e6569 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -162,6 +162,7 @@ static void option_instat_callback(struct urb *urb); - #define NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_HIGHSPEED 0x9001 - #define NOVATELWIRELESS_PRODUCT_E362 0x9010 - #define NOVATELWIRELESS_PRODUCT_E371 0x9011 -+#define NOVATELWIRELESS_PRODUCT_U620L 0x9022 - #define NOVATELWIRELESS_PRODUCT_G2 0xA010 - #define NOVATELWIRELESS_PRODUCT_MC551 0xB001 - -@@ -354,6 +355,7 @@ static void option_instat_callback(struct urb *urb); - /* This is the 4G XS Stick W14 a.k.a. Mobilcom Debitel Surf-Stick * - * It seems to contain a Qualcomm QSC6240/6290 chipset */ - #define FOUR_G_SYSTEMS_PRODUCT_W14 0x9603 -+#define FOUR_G_SYSTEMS_PRODUCT_W100 0x9b01 - - /* iBall 3.5G connect wireless modem */ - #define IBALL_3_5G_CONNECT 0x9605 -@@ -527,6 +529,11 @@ static const struct option_blacklist_info four_g_w14_blacklist = { - .sendsetup = BIT(0) | BIT(1), - }; - -+static const struct option_blacklist_info four_g_w100_blacklist = { -+ .sendsetup = BIT(1) | BIT(2), -+ .reserved = BIT(3), -+}; -+ - static const struct option_blacklist_info alcatel_x200_blacklist = { - .sendsetup = BIT(0) | BIT(1), - .reserved = BIT(4), -@@ -1060,6 +1067,7 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC551, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_E362, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_E371, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_U620L, 0xff, 0x00, 0x00) }, - - { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01) }, - { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01A) }, -@@ -1641,6 +1649,9 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14), - .driver_info = (kernel_ulong_t)&four_g_w14_blacklist - }, -+ { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W100), -+ .driver_info = (kernel_ulong_t)&four_g_w100_blacklist -+ }, - { USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, SPEEDUP_PRODUCT_SU9800, 0xff) }, - { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) }, - { USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) }, -diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c -index ec7cea585663..113913823ff3 100644 ---- a/drivers/usb/serial/ti_usb_3410_5052.c -+++ b/drivers/usb/serial/ti_usb_3410_5052.c -@@ -159,6 +159,7 @@ static const struct usb_device_id ti_id_table_3410[] = { - { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_STEREO_PLUG_ID) }, - { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_STRIP_PORT_ID) }, - { USB_DEVICE(TI_VENDOR_ID, FRI2_PRODUCT_ID) }, -+ { USB_DEVICE(HONEYWELL_VENDOR_ID, HONEYWELL_HGI80_PRODUCT_ID) }, - { } /* terminator */ - }; - -@@ -191,6 +192,7 @@ static const struct usb_device_id ti_id_table_combined[] = { - { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_PRODUCT_ID) }, - { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_STRIP_PORT_ID) }, - { USB_DEVICE(TI_VENDOR_ID, FRI2_PRODUCT_ID) }, -+ { USB_DEVICE(HONEYWELL_VENDOR_ID, HONEYWELL_HGI80_PRODUCT_ID) }, - { } /* terminator */ - }; - -diff --git a/drivers/usb/serial/ti_usb_3410_5052.h b/drivers/usb/serial/ti_usb_3410_5052.h -index 4a2423e84d55..98f35c656c02 100644 ---- a/drivers/usb/serial/ti_usb_3410_5052.h -+++ b/drivers/usb/serial/ti_usb_3410_5052.h -@@ -56,6 +56,10 @@ - #define ABBOTT_PRODUCT_ID ABBOTT_STEREO_PLUG_ID - #define ABBOTT_STRIP_PORT_ID 0x3420 - -+/* Honeywell vendor and product IDs */ -+#define HONEYWELL_VENDOR_ID 0x10ac -+#define HONEYWELL_HGI80_PRODUCT_ID 0x0102 /* Honeywell HGI80 */ -+ - /* Commands */ - #define TI_GET_VERSION 0x01 - #define TI_GET_PORT_STATUS 0x02 -diff --git a/include/net/inet_common.h b/include/net/inet_common.h -index fe7994c48b75..fd1da045dabc 100644 ---- a/include/net/inet_common.h -+++ b/include/net/inet_common.h -@@ -40,7 +40,8 @@ int inet_ctl_sock_create(struct sock **sk, unsigned short family, - - static inline void inet_ctl_sock_destroy(struct sock *sk) - { -- sk_release_kernel(sk); -+ if (sk) -+ sk_release_kernel(sk); - } - - #endif -diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c -index d9fb93451442..eda534f61acf 100644 ---- a/net/bluetooth/hidp/core.c -+++ b/net/bluetooth/hidp/core.c -@@ -415,6 +415,20 @@ static void hidp_idle_timeout(unsigned long arg) - { - struct hidp_session *session = (struct hidp_session *) arg; - -+ /* The HIDP user-space API only contains calls to add and remove -+ * devices. There is no way to forward events of any kind. Therefore, -+ * we have to forcefully disconnect a device on idle-timeouts. This is -+ * unfortunate and weird API design, but it is spec-compliant and -+ * required for backwards-compatibility. Hence, on idle-timeout, we -+ * signal driver-detach events, so poll() will be woken up with an -+ * error-condition on both sockets. -+ */ -+ -+ session->intr_sock->sk->sk_err = EUNATCH; -+ session->ctrl_sock->sk->sk_err = EUNATCH; -+ wake_up_interruptible(sk_sleep(session->intr_sock->sk)); -+ wake_up_interruptible(sk_sleep(session->ctrl_sock->sk)); -+ - hidp_session_terminate(session); - } - -diff --git a/net/core/dst.c b/net/core/dst.c -index 15b6792e6ebb..c07070544e3f 100644 ---- a/net/core/dst.c -+++ b/net/core/dst.c -@@ -283,7 +283,7 @@ void dst_release(struct dst_entry *dst) - - newrefcnt = atomic_dec_return(&dst->__refcnt); - WARN_ON(newrefcnt < 0); -- if (unlikely(dst->flags & DST_NOCACHE) && !newrefcnt) -+ if (!newrefcnt && unlikely(dst->flags & DST_NOCACHE)) - call_rcu(&dst->rcu_head, dst_destroy_rcu); - } - } -diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c -index 1149fc2290e2..a3d7ccfe154d 100644 ---- a/net/ipv4/ipmr.c -+++ b/net/ipv4/ipmr.c -@@ -1674,8 +1674,8 @@ static inline int ipmr_forward_finish(struct sk_buff *skb) - { - struct ip_options *opt = &(IPCB(skb)->opt); - -- IP_INC_STATS_BH(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTFORWDATAGRAMS); -- IP_ADD_STATS_BH(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTOCTETS, skb->len); -+ IP_INC_STATS(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTFORWDATAGRAMS); -+ IP_ADD_STATS(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTOCTETS, skb->len); - - if (unlikely(opt->optlen)) - ip_forward_options(skb); -@@ -1737,7 +1737,7 @@ static void ipmr_queue_xmit(struct net *net, struct mr_table *mrt, - * to blackhole. - */ - -- IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_FRAGFAILS); -+ IP_INC_STATS(dev_net(dev), IPSTATS_MIB_FRAGFAILS); - ip_rt_put(rt); - goto out_free; - } -diff --git a/net/irda/irlmp.c b/net/irda/irlmp.c -index 98ad6ec4bd3c..8ad149478e19 100644 ---- a/net/irda/irlmp.c -+++ b/net/irda/irlmp.c -@@ -1876,7 +1876,7 @@ static void *irlmp_seq_hb_idx(struct irlmp_iter_state *iter, loff_t *off) - for (element = hashbin_get_first(iter->hashbin); - element != NULL; - element = hashbin_get_next(iter->hashbin)) { -- if (!off || *off-- == 0) { -+ if (!off || (*off)-- == 0) { - /* NB: hashbin left locked */ - return element; - } -diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c -index c9535a976b56..fcb2b171b897 100644 ---- a/net/mac80211/mlme.c -+++ b/net/mac80211/mlme.c -@@ -2869,7 +2869,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata, - - if (ifmgd->rssi_min_thold != ifmgd->rssi_max_thold && - ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) { -- int sig = ifmgd->ave_beacon_signal; -+ int sig = ifmgd->ave_beacon_signal / 16; - int last_sig = ifmgd->last_ave_beacon_signal; - - /* -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index fee7dcc28abd..c53684eeddb3 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -2642,22 +2642,40 @@ static int packet_release(struct socket *sock) - * Attach a packet hook. - */ - --static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 proto) -+static int packet_do_bind(struct sock *sk, const char *name, int ifindex, -+ __be16 proto) - { - struct packet_sock *po = pkt_sk(sk); - struct net_device *dev_curr; - __be16 proto_curr; - bool need_rehook; -+ struct net_device *dev = NULL; -+ int ret = 0; -+ bool unlisted = false; - -- if (po->fanout) { -- if (dev) -- dev_put(dev); -- -+ if (po->fanout) - return -EINVAL; -- } - - lock_sock(sk); - spin_lock(&po->bind_lock); -+ rcu_read_lock(); -+ -+ if (name) { -+ dev = dev_get_by_name_rcu(sock_net(sk), name); -+ if (!dev) { -+ ret = -ENODEV; -+ goto out_unlock; -+ } -+ } else if (ifindex) { -+ dev = dev_get_by_index_rcu(sock_net(sk), ifindex); -+ if (!dev) { -+ ret = -ENODEV; -+ goto out_unlock; -+ } -+ } -+ -+ if (dev) -+ dev_hold(dev); - - proto_curr = po->prot_hook.type; - dev_curr = po->prot_hook.dev; -@@ -2665,14 +2683,29 @@ static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 proto) - need_rehook = proto_curr != proto || dev_curr != dev; - - if (need_rehook) { -- unregister_prot_hook(sk, true); -+ if (po->running) { -+ rcu_read_unlock(); -+ __unregister_prot_hook(sk, true); -+ rcu_read_lock(); -+ dev_curr = po->prot_hook.dev; -+ if (dev) -+ unlisted = !dev_get_by_index_rcu(sock_net(sk), -+ dev->ifindex); -+ } - - po->num = proto; - po->prot_hook.type = proto; -- po->prot_hook.dev = dev; - -- po->ifindex = dev ? dev->ifindex : 0; -- packet_cached_dev_assign(po, dev); -+ if (unlikely(unlisted)) { -+ dev_put(dev); -+ po->prot_hook.dev = NULL; -+ po->ifindex = -1; -+ packet_cached_dev_reset(po); -+ } else { -+ po->prot_hook.dev = dev; -+ po->ifindex = dev ? dev->ifindex : 0; -+ packet_cached_dev_assign(po, dev); -+ } - } - if (dev_curr) - dev_put(dev_curr); -@@ -2680,7 +2713,7 @@ static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 proto) - if (proto == 0 || !need_rehook) - goto out_unlock; - -- if (!dev || (dev->flags & IFF_UP)) { -+ if (!unlisted && (!dev || (dev->flags & IFF_UP))) { - register_prot_hook(sk); - } else { - sk->sk_err = ENETDOWN; -@@ -2689,9 +2722,10 @@ static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 proto) - } - - out_unlock: -+ rcu_read_unlock(); - spin_unlock(&po->bind_lock); - release_sock(sk); -- return 0; -+ return ret; - } - - /* -@@ -2703,8 +2737,6 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, - { - struct sock *sk = sock->sk; - char name[15]; -- struct net_device *dev; -- int err = -ENODEV; - - /* - * Check legality -@@ -2714,19 +2746,13 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, - return -EINVAL; - strlcpy(name, uaddr->sa_data, sizeof(name)); - -- dev = dev_get_by_name(sock_net(sk), name); -- if (dev) -- err = packet_do_bind(sk, dev, pkt_sk(sk)->num); -- return err; -+ return packet_do_bind(sk, name, 0, pkt_sk(sk)->num); - } - - static int packet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) - { - struct sockaddr_ll *sll = (struct sockaddr_ll *)uaddr; - struct sock *sk = sock->sk; -- struct net_device *dev = NULL; -- int err; -- - - /* - * Check legality -@@ -2737,16 +2763,8 @@ static int packet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len - if (sll->sll_family != AF_PACKET) - return -EINVAL; - -- if (sll->sll_ifindex) { -- err = -ENODEV; -- dev = dev_get_by_index(sock_net(sk), sll->sll_ifindex); -- if (dev == NULL) -- goto out; -- } -- err = packet_do_bind(sk, dev, sll->sll_protocol ? : pkt_sk(sk)->num); -- --out: -- return err; -+ return packet_do_bind(sk, NULL, sll->sll_ifindex, -+ sll->sll_protocol ? : pkt_sk(sk)->num); - } - - static struct proto packet_proto = { -diff --git a/net/rds/connection.c b/net/rds/connection.c -index 378c3a6acf84..f5fb7d6b7c41 100644 ---- a/net/rds/connection.c -+++ b/net/rds/connection.c -@@ -183,6 +183,12 @@ static struct rds_connection *__rds_conn_create(__be32 laddr, __be32 faddr, - } - } - -+ if (trans == NULL) { -+ kmem_cache_free(rds_conn_slab, conn); -+ conn = ERR_PTR(-ENODEV); -+ goto out; -+ } -+ - conn->c_trans = trans; - - ret = trans->conn_alloc(conn, gfp); -diff --git a/net/rds/tcp_recv.c b/net/rds/tcp_recv.c -index 4fac4f2bb9dc..8b33d9967b56 100644 ---- a/net/rds/tcp_recv.c -+++ b/net/rds/tcp_recv.c -@@ -234,8 +234,15 @@ static int rds_tcp_data_recv(read_descriptor_t *desc, struct sk_buff *skb, - } - - to_copy = min(tc->t_tinc_data_rem, left); -- pskb_pull(clone, offset); -- pskb_trim(clone, to_copy); -+ if (!pskb_pull(clone, offset) || -+ pskb_trim(clone, to_copy)) { -+ pr_warn("rds_tcp_data_recv: pull/trim failed " -+ "left %zu data_rem %zu skb_len %d\n", -+ left, tc->t_tinc_data_rem, skb->len); -+ kfree_skb(clone); -+ desc->error = -ENOMEM; -+ goto out; -+ } - skb_queue_tail(&tinc->ti_skb_list, clone); - - rdsdebug("skb %p data %p len %d off %u to_copy %zu -> " -diff --git a/sound/usb/midi.c b/sound/usb/midi.c -index c7aa71ee775b..9123fc518f07 100644 ---- a/sound/usb/midi.c -+++ b/sound/usb/midi.c -@@ -174,6 +174,8 @@ struct snd_usb_midi_in_endpoint { - u8 running_status_length; - } ports[0x10]; - u8 seen_f5; -+ bool in_sysex; -+ u8 last_cin; - u8 error_resubmit; - int current_port; - }; -@@ -465,6 +467,39 @@ static void snd_usbmidi_maudio_broken_running_status_input( - } - - /* -+ * QinHeng CH345 is buggy: every second packet inside a SysEx has not CIN 4 -+ * but the previously seen CIN, but still with three data bytes. -+ */ -+static void ch345_broken_sysex_input(struct snd_usb_midi_in_endpoint *ep, -+ uint8_t *buffer, int buffer_length) -+{ -+ unsigned int i, cin, length; -+ -+ for (i = 0; i + 3 < buffer_length; i += 4) { -+ if (buffer[i] == 0 && i > 0) -+ break; -+ cin = buffer[i] & 0x0f; -+ if (ep->in_sysex && -+ cin == ep->last_cin && -+ (buffer[i + 1 + (cin == 0x6)] & 0x80) == 0) -+ cin = 0x4; -+#if 0 -+ if (buffer[i + 1] == 0x90) { -+ /* -+ * Either a corrupted running status or a real note-on -+ * message; impossible to detect reliably. -+ */ -+ } -+#endif -+ length = snd_usbmidi_cin_length[cin]; -+ snd_usbmidi_input_data(ep, 0, &buffer[i + 1], length); -+ ep->in_sysex = cin == 0x4; -+ if (!ep->in_sysex) -+ ep->last_cin = cin; -+ } -+} -+ -+/* - * CME protocol: like the standard protocol, but SysEx commands are sent as a - * single USB packet preceded by a 0x0F byte. - */ -@@ -650,6 +685,12 @@ static struct usb_protocol_ops snd_usbmidi_cme_ops = { - .output_packet = snd_usbmidi_output_standard_packet, - }; - -+static struct usb_protocol_ops snd_usbmidi_ch345_broken_sysex_ops = { -+ .input = ch345_broken_sysex_input, -+ .output = snd_usbmidi_standard_output, -+ .output_packet = snd_usbmidi_output_standard_packet, -+}; -+ - /* - * AKAI MPD16 protocol: - * -@@ -1326,6 +1367,7 @@ static int snd_usbmidi_out_endpoint_create(struct snd_usb_midi* umidi, - * Various chips declare a packet size larger than 4 bytes, but - * do not actually work with larger packets: - */ -+ case USB_ID(0x0a67, 0x5011): /* Medeli DD305 */ - case USB_ID(0x0a92, 0x1020): /* ESI M4U */ - case USB_ID(0x1430, 0x474b): /* RedOctane GH MIDI INTERFACE */ - case USB_ID(0x15ca, 0x0101): /* Textech USB Midi Cable */ -@@ -2290,6 +2332,10 @@ int snd_usbmidi_create(struct snd_card *card, - - err = snd_usbmidi_detect_per_port_endpoints(umidi, endpoints); - break; -+ case QUIRK_MIDI_CH345: -+ umidi->usb_protocol_ops = &snd_usbmidi_ch345_broken_sysex_ops; -+ err = snd_usbmidi_detect_per_port_endpoints(umidi, endpoints); -+ break; - default: - snd_printd(KERN_ERR "invalid quirk type %d\n", quirk->type); - err = -ENXIO; -diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h -index 7c24088bcaa4..c600d4277974 100644 ---- a/sound/usb/quirks-table.h -+++ b/sound/usb/quirks-table.h -@@ -2875,6 +2875,17 @@ YAMAHA_DEVICE(0x7010, "UB99"), - .idProduct = 0x1020, - }, - -+/* QinHeng devices */ -+{ -+ USB_DEVICE(0x1a86, 0x752d), -+ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { -+ .vendor_name = "QinHeng", -+ .product_name = "CH345", -+ .ifnum = 1, -+ .type = QUIRK_MIDI_CH345 -+ } -+}, -+ - /* KeithMcMillen Stringport */ - { - USB_DEVICE(0x1f38, 0x0001), -diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c -index 827d40441ec7..901f87dea827 100644 ---- a/sound/usb/quirks.c -+++ b/sound/usb/quirks.c -@@ -526,6 +526,7 @@ int snd_usb_create_quirk(struct snd_usb_audio *chip, - [QUIRK_MIDI_CME] = create_any_midi_quirk, - [QUIRK_MIDI_AKAI] = create_any_midi_quirk, - [QUIRK_MIDI_FTDI] = create_any_midi_quirk, -+ [QUIRK_MIDI_CH345] = create_any_midi_quirk, - [QUIRK_AUDIO_STANDARD_INTERFACE] = create_standard_audio_quirk, - [QUIRK_AUDIO_FIXED_ENDPOINT] = create_fixed_stream_quirk, - [QUIRK_AUDIO_EDIROL_UAXX] = create_uaxx_quirk, -diff --git a/sound/usb/usbaudio.h b/sound/usb/usbaudio.h -index 5d2fe0530745..e5b2c30a8e90 100644 ---- a/sound/usb/usbaudio.h -+++ b/sound/usb/usbaudio.h -@@ -84,6 +84,7 @@ enum quirk_type { - QUIRK_MIDI_AKAI, - QUIRK_MIDI_US122L, - QUIRK_MIDI_FTDI, -+ QUIRK_MIDI_CH345, - QUIRK_AUDIO_STANDARD_INTERFACE, - QUIRK_AUDIO_FIXED_ENDPOINT, - QUIRK_AUDIO_EDIROL_UAXX, diff --git a/patch/kernel/odroidc2-default/patch-3.14.58-59.patch b/patch/kernel/odroidc2-default/patch-3.14.58-59.patch deleted file mode 100644 index 6340ce2951..0000000000 --- a/patch/kernel/odroidc2-default/patch-3.14.58-59.patch +++ /dev/null @@ -1,1452 +0,0 @@ -diff --git a/Makefile b/Makefile -index 48a4d0b37c10..c2a6ec4d8803 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 3 - PATCHLEVEL = 14 --SUBLEVEL = 58 -+SUBLEVEL = 59 - EXTRAVERSION = - NAME = Remembering Coco - -diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c -index 586f2f7f6993..df420af7e2ae 100644 ---- a/drivers/firewire/ohci.c -+++ b/drivers/firewire/ohci.c -@@ -3675,6 +3675,11 @@ static int pci_probe(struct pci_dev *dev, - - reg_write(ohci, OHCI1394_IsoXmitIntMaskSet, ~0); - ohci->it_context_support = reg_read(ohci, OHCI1394_IsoXmitIntMaskSet); -+ /* JMicron JMB38x often shows 0 at first read, just ignore it */ -+ if (!ohci->it_context_support) { -+ ohci_notice(ohci, "overriding IsoXmitIntMask\n"); -+ ohci->it_context_support = 0xf; -+ } - reg_write(ohci, OHCI1394_IsoXmitIntMaskClear, ~0); - ohci->it_context_mask = ohci->it_context_support; - ohci->n_it = hweight32(ohci->it_context_mask); -diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c -index 4d3258dd0a88..2c535fc5887d 100644 ---- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c -+++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c -@@ -1018,13 +1018,12 @@ static int atl1c_setup_ring_resources(struct atl1c_adapter *adapter) - sizeof(struct atl1c_recv_ret_status) * rx_desc_count + - 8 * 4; - -- ring_header->desc = pci_alloc_consistent(pdev, ring_header->size, -- &ring_header->dma); -+ ring_header->desc = dma_zalloc_coherent(&pdev->dev, ring_header->size, -+ &ring_header->dma, GFP_KERNEL); - if (unlikely(!ring_header->desc)) { -- dev_err(&pdev->dev, "pci_alloc_consistend failed\n"); -+ dev_err(&pdev->dev, "could not get memory for DMA buffer\n"); - goto err_nomem; - } -- memset(ring_header->desc, 0, ring_header->size); - /* init TPD ring */ - - tpd_ring[0].dma = roundup(ring_header->dma, 8); -diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c -index 957f0ffe31c4..58f1a09d6f1d 100644 ---- a/drivers/net/ethernet/renesas/sh_eth.c -+++ b/drivers/net/ethernet/renesas/sh_eth.c -@@ -1424,6 +1424,7 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota) - if (mdp->cd->shift_rd0) - desc_status >>= 16; - -+ skb = mdp->rx_skbuff[entry]; - if (desc_status & (RD_RFS1 | RD_RFS2 | RD_RFS3 | RD_RFS4 | - RD_RFS5 | RD_RFS6 | RD_RFS10)) { - ndev->stats.rx_errors++; -@@ -1439,12 +1440,11 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota) - ndev->stats.rx_missed_errors++; - if (desc_status & RD_RFS10) - ndev->stats.rx_over_errors++; -- } else { -+ } else if (skb) { - if (!mdp->cd->hw_swap) - sh_eth_soft_swap( - phys_to_virt(ALIGN(rxdesc->addr, 4)), - pkt_len + 2); -- skb = mdp->rx_skbuff[entry]; - mdp->rx_skbuff[entry] = NULL; - if (mdp->cd->rpadir) - skb_reserve(skb, NET_IP_ALIGN); -diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c -index f8c90ea75108..7a1ff5797f12 100644 ---- a/drivers/net/phy/broadcom.c -+++ b/drivers/net/phy/broadcom.c -@@ -848,7 +848,7 @@ static struct mdio_device_id __maybe_unused broadcom_tbl[] = { - { PHY_ID_BCM5421, 0xfffffff0 }, - { PHY_ID_BCM5461, 0xfffffff0 }, - { PHY_ID_BCM5464, 0xfffffff0 }, -- { PHY_ID_BCM5482, 0xfffffff0 }, -+ { PHY_ID_BCM5481, 0xfffffff0 }, - { PHY_ID_BCM5482, 0xfffffff0 }, - { PHY_ID_BCM50610, 0xfffffff0 }, - { PHY_ID_BCM50610M, 0xfffffff0 }, -diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c -index 1dc628ffce2b..0710214df2bf 100644 ---- a/drivers/net/ppp/pptp.c -+++ b/drivers/net/ppp/pptp.c -@@ -420,6 +420,9 @@ static int pptp_bind(struct socket *sock, struct sockaddr *uservaddr, - struct pptp_opt *opt = &po->proto.pptp; - int error = 0; - -+ if (sockaddr_len < sizeof(struct sockaddr_pppox)) -+ return -EINVAL; -+ - lock_sock(sk); - - opt->src_addr = sp->sa_addr.pptp; -@@ -441,6 +444,9 @@ static int pptp_connect(struct socket *sock, struct sockaddr *uservaddr, - struct flowi4 fl4; - int error = 0; - -+ if (sockaddr_len < sizeof(struct sockaddr_pppox)) -+ return -EINVAL; -+ - if (sp->sa_protocol != PX_PROTO_PPTP) - return -EINVAL; - -diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c -index db21af8de9f6..3580938246b0 100644 ---- a/drivers/net/usb/qmi_wwan.c -+++ b/drivers/net/usb/qmi_wwan.c -@@ -755,6 +755,7 @@ static const struct usb_device_id products[] = { - {QMI_FIXED_INTF(0x2357, 0x9000, 4)}, /* TP-LINK MA260 */ - {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */ - {QMI_FIXED_INTF(0x1bc7, 0x1201, 2)}, /* Telit LE920 */ -+ {QMI_FIXED_INTF(0x1c9e, 0x9b01, 3)}, /* XS Stick W100-2 from 4G Systems */ - {QMI_FIXED_INTF(0x0b3c, 0xc000, 4)}, /* Olivetti Olicard 100 */ - {QMI_FIXED_INTF(0x0b3c, 0xc001, 4)}, /* Olivetti Olicard 120 */ - {QMI_FIXED_INTF(0x0b3c, 0xc002, 4)}, /* Olivetti Olicard 140 */ -diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c -index d7049c393a33..2aca88715632 100644 ---- a/drivers/usb/class/cdc-acm.c -+++ b/drivers/usb/class/cdc-acm.c -@@ -1810,6 +1810,11 @@ static const struct usb_device_id acm_ids[] = { - }, - #endif - -+ /* Exclude Infineon Flash Loader utility */ -+ { USB_DEVICE(0x058b, 0x0041), -+ .driver_info = IGNORE_DEVICE, -+ }, -+ - /* control interfaces without any protocol set */ - { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM, - USB_CDC_PROTO_NONE) }, -diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c -index 3ecc887eea27..12d14f91c4d3 100644 ---- a/drivers/usb/core/config.c -+++ b/drivers/usb/core/config.c -@@ -116,7 +116,8 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno, - USB_SS_MULT(desc->bmAttributes) > 3) { - dev_warn(ddev, "Isoc endpoint has Mult of %d in " - "config %d interface %d altsetting %d ep %d: " -- "setting to 3\n", desc->bmAttributes + 1, -+ "setting to 3\n", -+ USB_SS_MULT(desc->bmAttributes), - cfgno, inum, asnum, ep->desc.bEndpointAddress); - ep->ss_ep_comp.bmAttributes = 2; - } -diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c -index 1847a7d38026..fa114bcedabf 100644 ---- a/drivers/usb/core/hub.c -+++ b/drivers/usb/core/hub.c -@@ -130,6 +130,10 @@ struct usb_hub *usb_hub_to_struct_hub(struct usb_device *hdev) - - static int usb_device_supports_lpm(struct usb_device *udev) - { -+ /* Some devices have trouble with LPM */ -+ if (udev->quirks & USB_QUIRK_NO_LPM) -+ return 0; -+ - /* USB 2.1 (and greater) devices indicate LPM support through - * their USB 2.0 Extended Capabilities BOS descriptor. - */ -@@ -4350,6 +4354,8 @@ hub_port_init (struct usb_hub *hub, struct usb_device *udev, int port1, - goto fail; - } - -+ usb_detect_quirks(udev); -+ - if (udev->wusb == 0 && le16_to_cpu(udev->descriptor.bcdUSB) >= 0x0201) { - retval = usb_get_bos_descriptor(udev); - if (!retval) { -@@ -4595,7 +4601,6 @@ static void hub_port_connect_change(struct usb_hub *hub, int port1, - if (status < 0) - goto loop; - -- usb_detect_quirks(udev); - if (udev->quirks & USB_QUIRK_DELAY_INIT) - msleep(1000); - -diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c -index 804acc700327..00addda9ad53 100644 ---- a/drivers/usb/core/quirks.c -+++ b/drivers/usb/core/quirks.c -@@ -205,6 +205,12 @@ static const struct usb_device_id usb_amd_resume_quirk_list[] = { - /* Logitech Optical Mouse M90/M100 */ - { USB_DEVICE(0x046d, 0xc05a), .driver_info = USB_QUIRK_RESET_RESUME }, - -+ /* Blackmagic Design Intensity Shuttle */ -+ { USB_DEVICE(0x1edb, 0xbd3b), .driver_info = USB_QUIRK_NO_LPM }, -+ -+ /* Blackmagic Design UltraStudio SDI */ -+ { USB_DEVICE(0x1edb, 0xbd4f), .driver_info = USB_QUIRK_NO_LPM }, -+ - { } /* terminating entry must be last */ - }; - -diff --git a/drivers/usb/host/whci/qset.c b/drivers/usb/host/whci/qset.c -index dc31c425ce01..9f1c0538b211 100644 ---- a/drivers/usb/host/whci/qset.c -+++ b/drivers/usb/host/whci/qset.c -@@ -377,6 +377,10 @@ static int qset_fill_page_list(struct whc *whc, struct whc_std *std, gfp_t mem_f - if (std->pl_virt == NULL) - return -ENOMEM; - std->dma_addr = dma_map_single(whc->wusbhc.dev, std->pl_virt, pl_len, DMA_TO_DEVICE); -+ if (dma_mapping_error(whc->wusbhc.dev, std->dma_addr)) { -+ kfree(std->pl_virt); -+ return -EFAULT; -+ } - - for (p = 0; p < std->num_pointers; p++) { - std->pl_virt[p].buf_ptr = cpu_to_le64(dma_addr); -diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c -index d11335d4395d..c2bdc5f2a4b1 100644 ---- a/drivers/usb/serial/cp210x.c -+++ b/drivers/usb/serial/cp210x.c -@@ -132,7 +132,6 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */ - { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */ - { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */ -- { USB_DEVICE(0x10C4, 0xEA80) }, /* Silicon Labs factory default */ - { USB_DEVICE(0x10C4, 0xEA71) }, /* Infinity GPS-MIC-1 Radio Monophone */ - { USB_DEVICE(0x10C4, 0xF001) }, /* Elan Digital Systems USBscope50 */ - { USB_DEVICE(0x10C4, 0xF002) }, /* Elan Digital Systems USBwave12 */ -diff --git a/drivers/usb/serial/usb-serial-simple.c b/drivers/usb/serial/usb-serial-simple.c -index fb79775447b0..efb727a49262 100644 ---- a/drivers/usb/serial/usb-serial-simple.c -+++ b/drivers/usb/serial/usb-serial-simple.c -@@ -47,6 +47,7 @@ DEVICE(funsoft, FUNSOFT_IDS); - - /* Infineon Flashloader driver */ - #define FLASHLOADER_IDS() \ -+ { USB_DEVICE_INTERFACE_CLASS(0x058b, 0x0041, USB_CLASS_CDC_DATA) }, \ - { USB_DEVICE(0x8087, 0x0716) } - DEVICE(flashloader, FLASHLOADER_IDS); - -diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c -index 0a841ddd6843..17bc3b5ac263 100644 ---- a/fs/btrfs/file.c -+++ b/fs/btrfs/file.c -@@ -751,8 +751,16 @@ next_slot: - } - - btrfs_item_key_to_cpu(leaf, &key, path->slots[0]); -- if (key.objectid > ino || -- key.type > BTRFS_EXTENT_DATA_KEY || key.offset >= end) -+ -+ if (key.objectid > ino) -+ break; -+ if (WARN_ON_ONCE(key.objectid < ino) || -+ key.type < BTRFS_EXTENT_DATA_KEY) { -+ ASSERT(del_nr == 0); -+ path->slots[0]++; -+ goto next_slot; -+ } -+ if (key.type > BTRFS_EXTENT_DATA_KEY || key.offset >= end) - break; - - fi = btrfs_item_ptr(leaf, path->slots[0], -@@ -771,8 +779,8 @@ next_slot: - btrfs_file_extent_inline_len(leaf, - path->slots[0], fi); - } else { -- WARN_ON(1); -- extent_end = search_start; -+ /* can't happen */ -+ BUG(); - } - - if (extent_end <= search_start) { -diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index eaf8699ed559..7f0dcfc58cbf 100644 ---- a/fs/btrfs/inode.c -+++ b/fs/btrfs/inode.c -@@ -1238,8 +1238,14 @@ next_slot: - num_bytes = 0; - btrfs_item_key_to_cpu(leaf, &found_key, path->slots[0]); - -- if (found_key.objectid > ino || -- found_key.type > BTRFS_EXTENT_DATA_KEY || -+ if (found_key.objectid > ino) -+ break; -+ if (WARN_ON_ONCE(found_key.objectid < ino) || -+ found_key.type < BTRFS_EXTENT_DATA_KEY) { -+ path->slots[0]++; -+ goto next_slot; -+ } -+ if (found_key.type > BTRFS_EXTENT_DATA_KEY || - found_key.offset > end) - break; - -diff --git a/fs/ext4/ext4_jbd2.c b/fs/ext4/ext4_jbd2.c -index ff42208417b9..0b3af57acaef 100644 ---- a/fs/ext4/ext4_jbd2.c -+++ b/fs/ext4/ext4_jbd2.c -@@ -88,13 +88,13 @@ int __ext4_journal_stop(const char *where, unsigned int line, handle_t *handle) - return 0; - } - -+ err = handle->h_err; - if (!handle->h_transaction) { -- err = jbd2_journal_stop(handle); -- return handle->h_err ? handle->h_err : err; -+ rc = jbd2_journal_stop(handle); -+ return err ? err : rc; - } - - sb = handle->h_transaction->t_journal->j_private; -- err = handle->h_err; - rc = jbd2_journal_stop(handle); - - if (!err) -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index a07af5b7a575..c05fc3aef69f 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -404,9 +404,13 @@ static void ext4_handle_error(struct super_block *sb) - smp_wmb(); - sb->s_flags |= MS_RDONLY; - } -- if (test_opt(sb, ERRORS_PANIC)) -+ if (test_opt(sb, ERRORS_PANIC)) { -+ if (EXT4_SB(sb)->s_journal && -+ !(EXT4_SB(sb)->s_journal->j_flags & JBD2_REC_ERR)) -+ return; - panic("EXT4-fs (device %s): panic forced after error\n", - sb->s_id); -+ } - } - - #define ext4_error_ratelimit(sb) \ -@@ -595,8 +599,12 @@ void __ext4_abort(struct super_block *sb, const char *function, - jbd2_journal_abort(EXT4_SB(sb)->s_journal, -EIO); - save_error_info(sb, function, line); - } -- if (test_opt(sb, ERRORS_PANIC)) -+ if (test_opt(sb, ERRORS_PANIC)) { -+ if (EXT4_SB(sb)->s_journal && -+ !(EXT4_SB(sb)->s_journal->j_flags & JBD2_REC_ERR)) -+ return; - panic("EXT4-fs panic from previous error\n"); -+ } - } - - void __ext4_msg(struct super_block *sb, -diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c -index 3b607a8609c4..ef5f39a73c51 100644 ---- a/fs/jbd2/journal.c -+++ b/fs/jbd2/journal.c -@@ -2088,8 +2088,12 @@ static void __journal_abort_soft (journal_t *journal, int errno) - - __jbd2_journal_abort_hard(journal); - -- if (errno) -+ if (errno) { - jbd2_journal_update_sb_errno(journal); -+ write_lock(&journal->j_state_lock); -+ journal->j_flags |= JBD2_REC_ERR; -+ write_unlock(&journal->j_state_lock); -+ } - } - - /** -diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c -index 6659ce545f15..b6b426c75e4c 100644 ---- a/fs/nfs/inode.c -+++ b/fs/nfs/inode.c -@@ -1675,7 +1675,11 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr) - nfsi->attrtimeo_timestamp = now; - } - } -- invalid &= ~NFS_INO_INVALID_ATTR; -+ -+ /* Don't declare attrcache up to date if there were no attrs! */ -+ if (fattr->valid != 0) -+ invalid &= ~NFS_INO_INVALID_ATTR; -+ - /* Don't invalidate the data if we were to blame */ - if (!(S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode) - || S_ISLNK(inode->i_mode))) -diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c -index d3f606255b99..d4fbaaee993a 100644 ---- a/fs/nfs/nfs4client.c -+++ b/fs/nfs/nfs4client.c -@@ -33,7 +33,7 @@ static int nfs_get_cb_ident_idr(struct nfs_client *clp, int minorversion) - return ret; - idr_preload(GFP_KERNEL); - spin_lock(&nn->nfs_client_lock); -- ret = idr_alloc(&nn->cb_ident_idr, clp, 0, 0, GFP_NOWAIT); -+ ret = idr_alloc(&nn->cb_ident_idr, clp, 1, 0, GFP_NOWAIT); - if (ret >= 0) - clp->cl_cb_ident = ret; - spin_unlock(&nn->nfs_client_lock); -diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c -index b2427623dd6c..cc0aeb9e81a2 100644 ---- a/fs/ocfs2/namei.c -+++ b/fs/ocfs2/namei.c -@@ -345,6 +345,8 @@ static int ocfs2_mknod(struct inode *dir, - mlog_errno(status); - goto leave; - } -+ /* update inode->i_mode after mask with "umask". */ -+ inode->i_mode = mode; - - handle = ocfs2_start_trans(osb, ocfs2_mknod_credits(osb->sb, - S_ISDIR(mode), -diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h -index 385593d748f6..e137e962834b 100644 ---- a/include/linux/jbd2.h -+++ b/include/linux/jbd2.h -@@ -1007,6 +1007,7 @@ struct journal_s - #define JBD2_ABORT_ON_SYNCDATA_ERR 0x040 /* Abort the journal on file - * data write error in ordered - * mode */ -+#define JBD2_REC_ERR 0x080 /* The errno in the sb has been recorded */ - - /* - * Function declarations for the journaling transaction and buffer -diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h -index 8b96ae2a38fe..5ef39160bd47 100644 ---- a/include/linux/usb/quirks.h -+++ b/include/linux/usb/quirks.h -@@ -36,4 +36,7 @@ - /* device can't handle device_qualifier descriptor requests */ - #define USB_QUIRK_DEVICE_QUALIFIER 0x00000100 - -+/* device can't handle Link Power Management */ -+#define USB_QUIRK_NO_LPM BIT(10) -+ - #endif /* __LINUX_USB_QUIRKS_H */ -diff --git a/include/net/af_unix.h b/include/net/af_unix.h -index dfe4ddfbb43c..e830c3dff61a 100644 ---- a/include/net/af_unix.h -+++ b/include/net/af_unix.h -@@ -63,6 +63,7 @@ struct unix_sock { - #define UNIX_GC_CANDIDATE 0 - #define UNIX_GC_MAYBE_CYCLE 1 - struct socket_wq peer_wq; -+ wait_queue_t peer_wake; - }; - - static inline struct unix_sock *unix_sk(struct sock *sk) -diff --git a/include/net/ip6_tunnel.h b/include/net/ip6_tunnel.h -index a5593dab6af7..ef9557683fec 100644 ---- a/include/net/ip6_tunnel.h -+++ b/include/net/ip6_tunnel.h -@@ -79,11 +79,12 @@ static inline void ip6tunnel_xmit(struct sk_buff *skb, struct net_device *dev) - err = ip6_local_out(skb); - - if (net_xmit_eval(err) == 0) { -- struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats); -+ struct pcpu_sw_netstats *tstats = get_cpu_ptr(dev->tstats); - u64_stats_update_begin(&tstats->syncp); - tstats->tx_bytes += pkt_len; - tstats->tx_packets++; - u64_stats_update_end(&tstats->syncp); -+ put_cpu_ptr(tstats); - } else { - stats->tx_errors++; - stats->tx_aborted_errors++; -diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h -index 7b9ec5837496..62d2b169df01 100644 ---- a/include/net/ip_tunnels.h -+++ b/include/net/ip_tunnels.h -@@ -166,12 +166,13 @@ static inline void iptunnel_xmit_stats(int err, - struct pcpu_sw_netstats __percpu *stats) - { - if (err > 0) { -- struct pcpu_sw_netstats *tstats = this_cpu_ptr(stats); -+ struct pcpu_sw_netstats *tstats = get_cpu_ptr(stats); - - u64_stats_update_begin(&tstats->syncp); - tstats->tx_bytes += err; - tstats->tx_packets++; - u64_stats_update_end(&tstats->syncp); -+ put_cpu_ptr(tstats); - } else if (err < 0) { - err_stats->tx_errors++; - err_stats->tx_aborted_errors++; -diff --git a/include/net/ipv6.h b/include/net/ipv6.h -index a60948d7bcea..30a8da3bb259 100644 ---- a/include/net/ipv6.h -+++ b/include/net/ipv6.h -@@ -489,6 +489,7 @@ struct ip6_create_arg { - u32 user; - const struct in6_addr *src; - const struct in6_addr *dst; -+ int iif; - u8 ecn; - }; - -diff --git a/include/net/sock.h b/include/net/sock.h -index ff4f825647a5..031717ab68cb 100644 ---- a/include/net/sock.h -+++ b/include/net/sock.h -@@ -374,6 +374,7 @@ struct sock { - sk_no_check : 2, - sk_userlocks : 4, - sk_protocol : 8, -+#define SK_PROTOCOL_MAX U8_MAX - sk_type : 16; - kmemcheck_bitfield_end(flags); - int sk_wmem_queued; -@@ -700,6 +701,8 @@ enum sock_flags { - SOCK_SELECT_ERR_QUEUE, /* Wake select on error queue */ - }; - -+#define SK_FLAGS_TIMESTAMP ((1UL << SOCK_TIMESTAMP) | (1UL << SOCK_TIMESTAMPING_RX_SOFTWARE)) -+ - static inline void sock_copy_flags(struct sock *nsk, struct sock *osk) - { - nsk->sk_flags = osk->sk_flags; -diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c -index c35c3f48fc0f..1428c3ff3341 100644 ---- a/net/ax25/af_ax25.c -+++ b/net/ax25/af_ax25.c -@@ -806,6 +806,9 @@ static int ax25_create(struct net *net, struct socket *sock, int protocol, - struct sock *sk; - ax25_cb *ax25; - -+ if (protocol < 0 || protocol > SK_PROTOCOL_MAX) -+ return -EINVAL; -+ - if (!net_eq(net, &init_net)) - return -EAFNOSUPPORT; - -diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c -index 316dd4e0af39..cd7d93d3ef7a 100644 ---- a/net/bluetooth/sco.c -+++ b/net/bluetooth/sco.c -@@ -459,6 +459,9 @@ static int sco_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_le - if (!addr || addr->sa_family != AF_BLUETOOTH) - return -EINVAL; - -+ if (addr_len < sizeof(struct sockaddr_sco)) -+ return -EINVAL; -+ - lock_sock(sk); - - if (sk->sk_state != BT_OPEN) { -diff --git a/net/core/scm.c b/net/core/scm.c -index b442e7e25e60..d30eb057fa7b 100644 ---- a/net/core/scm.c -+++ b/net/core/scm.c -@@ -306,6 +306,8 @@ void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm) - err = put_user(cmlen, &cm->cmsg_len); - if (!err) { - cmlen = CMSG_SPACE(i*sizeof(int)); -+ if (msg->msg_controllen < cmlen) -+ cmlen = msg->msg_controllen; - msg->msg_control += cmlen; - msg->msg_controllen -= cmlen; - } -diff --git a/net/core/skbuff.c b/net/core/skbuff.c -index 366f7ff741b7..9ac664d8da33 100644 ---- a/net/core/skbuff.c -+++ b/net/core/skbuff.c -@@ -3997,7 +3997,8 @@ static struct sk_buff *skb_reorder_vlan_header(struct sk_buff *skb) - return NULL; - } - -- memmove(skb->data - ETH_HLEN, skb->data - VLAN_ETH_HLEN, 2 * ETH_ALEN); -+ memmove(skb->data - ETH_HLEN, skb->data - skb->mac_len - VLAN_HLEN, -+ 2 * ETH_ALEN); - skb->mac_header += VLAN_HLEN; - return skb; - } -diff --git a/net/core/sock.c b/net/core/sock.c -index 8ebfa52e5d70..3b687b3c28b4 100644 ---- a/net/core/sock.c -+++ b/net/core/sock.c -@@ -422,8 +422,6 @@ static void sock_warn_obsolete_bsdism(const char *name) - } - } - --#define SK_FLAGS_TIMESTAMP ((1UL << SOCK_TIMESTAMP) | (1UL << SOCK_TIMESTAMPING_RX_SOFTWARE)) -- - static void sock_disable_timestamp(struct sock *sk, unsigned long flags) - { - if (sk->sk_flags & flags) { -diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c -index 4c04848953bd..630f972c20d2 100644 ---- a/net/decnet/af_decnet.c -+++ b/net/decnet/af_decnet.c -@@ -677,6 +677,9 @@ static int dn_create(struct net *net, struct socket *sock, int protocol, - { - struct sock *sk; - -+ if (protocol < 0 || protocol > SK_PROTOCOL_MAX) -+ return -EINVAL; -+ - if (!net_eq(net, &init_net)) - return -EAFNOSUPPORT; - -diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c -index f4c804dbd3b4..a91e465b7449 100644 ---- a/net/ipv4/af_inet.c -+++ b/net/ipv4/af_inet.c -@@ -260,6 +260,9 @@ static int inet_create(struct net *net, struct socket *sock, int protocol, - int try_loading_module = 0; - int err; - -+ if (protocol < 0 || protocol >= IPPROTO_MAX) -+ return -EINVAL; -+ - sock->state = SS_UNCONNECTED; - - /* Look for the requested type/protocol pair. */ -diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c -index a3d7ccfe154d..42809cf91488 100644 ---- a/net/ipv4/ipmr.c -+++ b/net/ipv4/ipmr.c -@@ -136,7 +136,7 @@ static int __ipmr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb, - struct mfc_cache *c, struct rtmsg *rtm); - static void mroute_netlink_event(struct mr_table *mrt, struct mfc_cache *mfc, - int cmd); --static void mroute_clean_tables(struct mr_table *mrt); -+static void mroute_clean_tables(struct mr_table *mrt, bool all); - static void ipmr_expire_process(unsigned long arg); - - #ifdef CONFIG_IP_MROUTE_MULTIPLE_TABLES -@@ -348,7 +348,7 @@ static struct mr_table *ipmr_new_table(struct net *net, u32 id) - static void ipmr_free_table(struct mr_table *mrt) - { - del_timer_sync(&mrt->ipmr_expire_timer); -- mroute_clean_tables(mrt); -+ mroute_clean_tables(mrt, true); - kfree(mrt); - } - -@@ -1201,7 +1201,7 @@ static int ipmr_mfc_add(struct net *net, struct mr_table *mrt, - * Close the multicast socket, and clear the vif tables etc - */ - --static void mroute_clean_tables(struct mr_table *mrt) -+static void mroute_clean_tables(struct mr_table *mrt, bool all) - { - int i; - LIST_HEAD(list); -@@ -1210,8 +1210,9 @@ static void mroute_clean_tables(struct mr_table *mrt) - /* Shut down all active vif entries */ - - for (i = 0; i < mrt->maxvif; i++) { -- if (!(mrt->vif_table[i].flags & VIFF_STATIC)) -- vif_delete(mrt, i, 0, &list); -+ if (!all && (mrt->vif_table[i].flags & VIFF_STATIC)) -+ continue; -+ vif_delete(mrt, i, 0, &list); - } - unregister_netdevice_many(&list); - -@@ -1219,7 +1220,7 @@ static void mroute_clean_tables(struct mr_table *mrt) - - for (i = 0; i < MFC_LINES; i++) { - list_for_each_entry_safe(c, next, &mrt->mfc_cache_array[i], list) { -- if (c->mfc_flags & MFC_STATIC) -+ if (!all && (c->mfc_flags & MFC_STATIC)) - continue; - list_del_rcu(&c->list); - mroute_netlink_event(mrt, c, RTM_DELROUTE); -@@ -1254,7 +1255,7 @@ static void mrtsock_destruct(struct sock *sk) - NETCONFA_IFINDEX_ALL, - net->ipv4.devconf_all); - RCU_INIT_POINTER(mrt->mroute_sk, NULL); -- mroute_clean_tables(mrt); -+ mroute_clean_tables(mrt, false); - } - } - rtnl_unlock(); -diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c -index 9fbd69efa999..5b10c59ba8a9 100644 ---- a/net/ipv4/tcp_input.c -+++ b/net/ipv4/tcp_input.c -@@ -5577,6 +5577,7 @@ discard: - } - - tp->rcv_nxt = TCP_SKB_CB(skb)->seq + 1; -+ tp->copied_seq = tp->rcv_nxt; - tp->rcv_wup = TCP_SKB_CB(skb)->seq + 1; - - /* RFC1323: The window in SYN & SYN/ACK segments is -diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c -index e2f8bd0d35ed..1b2a53e625cc 100644 ---- a/net/ipv4/tcp_ipv4.c -+++ b/net/ipv4/tcp_ipv4.c -@@ -998,7 +998,8 @@ int tcp_md5_do_add(struct sock *sk, const union tcp_md5_addr *addr, - } - - md5sig = rcu_dereference_protected(tp->md5sig_info, -- sock_owned_by_user(sk)); -+ sock_owned_by_user(sk) || -+ lockdep_is_held(&sk->sk_lock.slock)); - if (!md5sig) { - md5sig = kmalloc(sizeof(*md5sig), gfp); - if (!md5sig) -diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c -index d935889f1008..e56aa09f04d1 100644 ---- a/net/ipv6/af_inet6.c -+++ b/net/ipv6/af_inet6.c -@@ -110,6 +110,9 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol, - int try_loading_module = 0; - int err; - -+ if (protocol < 0 || protocol >= IPPROTO_MAX) -+ return -EINVAL; -+ - /* Look for the requested type/protocol pair. */ - lookup_protocol: - err = -ESOCKTNOSUPPORT; -diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c -index baffa3b7a328..bbc5e64ee984 100644 ---- a/net/ipv6/ip6_gre.c -+++ b/net/ipv6/ip6_gre.c -@@ -1558,13 +1558,11 @@ static int ip6gre_changelink(struct net_device *dev, struct nlattr *tb[], - return -EEXIST; - } else { - t = nt; -- -- ip6gre_tunnel_unlink(ign, t); -- ip6gre_tnl_change(t, &p, !tb[IFLA_MTU]); -- ip6gre_tunnel_link(ign, t); -- netdev_state_change(dev); - } - -+ ip6gre_tunnel_unlink(ign, t); -+ ip6gre_tnl_change(t, &p, !tb[IFLA_MTU]); -+ ip6gre_tunnel_link(ign, t); - return 0; - } - -diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c -index 821d8dfb2ddd..9ad561152eb6 100644 ---- a/net/ipv6/ip6mr.c -+++ b/net/ipv6/ip6mr.c -@@ -120,7 +120,7 @@ static void mr6_netlink_event(struct mr6_table *mrt, struct mfc6_cache *mfc, - int cmd); - static int ip6mr_rtm_dumproute(struct sk_buff *skb, - struct netlink_callback *cb); --static void mroute_clean_tables(struct mr6_table *mrt); -+static void mroute_clean_tables(struct mr6_table *mrt, bool all); - static void ipmr_expire_process(unsigned long arg); - - #ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES -@@ -337,7 +337,7 @@ static struct mr6_table *ip6mr_new_table(struct net *net, u32 id) - static void ip6mr_free_table(struct mr6_table *mrt) - { - del_timer(&mrt->ipmr_expire_timer); -- mroute_clean_tables(mrt); -+ mroute_clean_tables(mrt, true); - kfree(mrt); - } - -@@ -1536,7 +1536,7 @@ static int ip6mr_mfc_add(struct net *net, struct mr6_table *mrt, - * Close the multicast socket, and clear the vif tables etc - */ - --static void mroute_clean_tables(struct mr6_table *mrt) -+static void mroute_clean_tables(struct mr6_table *mrt, bool all) - { - int i; - LIST_HEAD(list); -@@ -1546,8 +1546,9 @@ static void mroute_clean_tables(struct mr6_table *mrt) - * Shut down all active vif entries - */ - for (i = 0; i < mrt->maxvif; i++) { -- if (!(mrt->vif6_table[i].flags & VIFF_STATIC)) -- mif6_delete(mrt, i, &list); -+ if (!all && (mrt->vif6_table[i].flags & VIFF_STATIC)) -+ continue; -+ mif6_delete(mrt, i, &list); - } - unregister_netdevice_many(&list); - -@@ -1556,7 +1557,7 @@ static void mroute_clean_tables(struct mr6_table *mrt) - */ - for (i = 0; i < MFC6_LINES; i++) { - list_for_each_entry_safe(c, next, &mrt->mfc6_cache_array[i], list) { -- if (c->mfc_flags & MFC_STATIC) -+ if (!all && (c->mfc_flags & MFC_STATIC)) - continue; - write_lock_bh(&mrt_lock); - list_del(&c->list); -@@ -1619,7 +1620,7 @@ int ip6mr_sk_done(struct sock *sk) - net->ipv6.devconf_all); - write_unlock_bh(&mrt_lock); - -- mroute_clean_tables(mrt); -+ mroute_clean_tables(mrt, false); - err = 0; - break; - } -diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c -index 761e4586ab5f..0b1bf2d17abf 100644 ---- a/net/ipv6/mcast.c -+++ b/net/ipv6/mcast.c -@@ -1636,7 +1636,6 @@ out: - if (!err) { - ICMP6MSGOUT_INC_STATS(net, idev, ICMPV6_MLD2_REPORT); - ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS); -- IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUTMCAST, payload_len); - } else { - IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS); - } -@@ -2000,7 +1999,6 @@ out: - if (!err) { - ICMP6MSGOUT_INC_STATS(net, idev, type); - ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS); -- IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUTMCAST, full_len); - } else - IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS); - -diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c -index 767ab8da8218..883d62362a9f 100644 ---- a/net/ipv6/netfilter/nf_conntrack_reasm.c -+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c -@@ -184,7 +184,7 @@ static void nf_ct_frag6_expire(unsigned long data) - /* Creation primitives. */ - static inline struct frag_queue *fq_find(struct net *net, __be32 id, - u32 user, struct in6_addr *src, -- struct in6_addr *dst, u8 ecn) -+ struct in6_addr *dst, int iif, u8 ecn) - { - struct inet_frag_queue *q; - struct ip6_create_arg arg; -@@ -194,6 +194,7 @@ static inline struct frag_queue *fq_find(struct net *net, __be32 id, - arg.user = user; - arg.src = src; - arg.dst = dst; -+ arg.iif = iif; - arg.ecn = ecn; - - read_lock_bh(&nf_frags.lock); -@@ -602,7 +603,7 @@ struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb, u32 user) - local_bh_enable(); - - fq = fq_find(net, fhdr->identification, user, &hdr->saddr, &hdr->daddr, -- ip6_frag_ecn(hdr)); -+ skb->dev ? skb->dev->ifindex : 0, ip6_frag_ecn(hdr)); - if (fq == NULL) { - pr_debug("Can't find and can't create new queue\n"); - goto ret_orig; -diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c -index cc85a9ba5010..9c15250eac1d 100644 ---- a/net/ipv6/reassembly.c -+++ b/net/ipv6/reassembly.c -@@ -111,7 +111,10 @@ bool ip6_frag_match(struct inet_frag_queue *q, void *a) - return fq->id == arg->id && - fq->user == arg->user && - ipv6_addr_equal(&fq->saddr, arg->src) && -- ipv6_addr_equal(&fq->daddr, arg->dst); -+ ipv6_addr_equal(&fq->daddr, arg->dst) && -+ (arg->iif == fq->iif || -+ !(ipv6_addr_type(arg->dst) & (IPV6_ADDR_MULTICAST | -+ IPV6_ADDR_LINKLOCAL))); - } - EXPORT_SYMBOL(ip6_frag_match); - -@@ -180,7 +183,7 @@ static void ip6_frag_expire(unsigned long data) - - static __inline__ struct frag_queue * - fq_find(struct net *net, __be32 id, const struct in6_addr *src, -- const struct in6_addr *dst, u8 ecn) -+ const struct in6_addr *dst, int iif, u8 ecn) - { - struct inet_frag_queue *q; - struct ip6_create_arg arg; -@@ -190,6 +193,7 @@ fq_find(struct net *net, __be32 id, const struct in6_addr *src, - arg.user = IP6_DEFRAG_LOCAL_DELIVER; - arg.src = src; - arg.dst = dst; -+ arg.iif = iif; - arg.ecn = ecn; - - read_lock(&ip6_frags.lock); -@@ -558,7 +562,7 @@ static int ipv6_frag_rcv(struct sk_buff *skb) - IPSTATS_MIB_REASMFAILS, evicted); - - fq = fq_find(net, fhdr->identification, &hdr->saddr, &hdr->daddr, -- ip6_frag_ecn(hdr)); -+ skb->dev ? skb->dev->ifindex : 0, ip6_frag_ecn(hdr)); - if (fq != NULL) { - int ret; - -diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c -index 54747c25c86c..f945293c17f0 100644 ---- a/net/irda/af_irda.c -+++ b/net/irda/af_irda.c -@@ -1103,6 +1103,9 @@ static int irda_create(struct net *net, struct socket *sock, int protocol, - - IRDA_DEBUG(2, "%s()\n", __func__); - -+ if (protocol < 0 || protocol > SK_PROTOCOL_MAX) -+ return -EINVAL; -+ - if (net != &init_net) - return -EAFNOSUPPORT; - -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index c53684eeddb3..25d329a18616 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -2091,6 +2091,15 @@ static void tpacket_destruct_skb(struct sk_buff *skb) - sock_wfree(skb); - } - -+static void tpacket_set_protocol(const struct net_device *dev, -+ struct sk_buff *skb) -+{ -+ if (dev->type == ARPHRD_ETHER) { -+ skb_reset_mac_header(skb); -+ skb->protocol = eth_hdr(skb)->h_proto; -+ } -+} -+ - static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb, - void *frame, struct net_device *dev, int size_max, - __be16 proto, unsigned char *addr, int hlen) -@@ -2127,8 +2136,6 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb, - skb_reserve(skb, hlen); - skb_reset_network_header(skb); - -- if (!packet_use_direct_xmit(po)) -- skb_probe_transport_header(skb, 0); - if (unlikely(po->tp_tx_has_off)) { - int off_min, off_max, off; - off_min = po->tp_hdrlen - sizeof(struct sockaddr_ll); -@@ -2178,6 +2185,8 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb, - dev->hard_header_len); - if (unlikely(err)) - return err; -+ if (!skb->protocol) -+ tpacket_set_protocol(dev, skb); - - data += dev->hard_header_len; - to_write -= dev->hard_header_len; -@@ -2212,6 +2221,8 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb, - len = ((to_write > len_max) ? len_max : to_write); - } - -+ skb_probe_transport_header(skb, 0); -+ - return tp_len; - } - -@@ -2537,8 +2548,8 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) - len += vnet_hdr_len; - } - -- if (!packet_use_direct_xmit(po)) -- skb_probe_transport_header(skb, reserve); -+ skb_probe_transport_header(skb, reserve); -+ - if (unlikely(extra_len == 4)) - skb->no_fcs = 1; - -diff --git a/net/sctp/auth.c b/net/sctp/auth.c -index fb7976aee61c..603c3bbc5923 100644 ---- a/net/sctp/auth.c -+++ b/net/sctp/auth.c -@@ -800,8 +800,8 @@ int sctp_auth_ep_set_hmacs(struct sctp_endpoint *ep, - if (!has_sha1) - return -EINVAL; - -- memcpy(ep->auth_hmacs_list->hmac_ids, &hmacs->shmac_idents[0], -- hmacs->shmac_num_idents * sizeof(__u16)); -+ for (i = 0; i < hmacs->shmac_num_idents; i++) -+ ep->auth_hmacs_list->hmac_ids[i] = htons(hmacs->shmac_idents[i]); - ep->auth_hmacs_list->param_hdr.length = htons(sizeof(sctp_paramhdr_t) + - hmacs->shmac_num_idents * sizeof(__u16)); - return 0; -diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c -index 2b1738ef9394..1b9b4528b5f3 100644 ---- a/net/sctp/ipv6.c -+++ b/net/sctp/ipv6.c -@@ -638,6 +638,7 @@ static struct sock *sctp_v6_create_accept_sk(struct sock *sk, - struct sock *newsk; - struct ipv6_pinfo *newnp, *np = inet6_sk(sk); - struct sctp6_sock *newsctp6sk; -+ struct ipv6_txoptions *opt; - - newsk = sk_alloc(sock_net(sk), PF_INET6, GFP_KERNEL, sk->sk_prot); - if (!newsk) -@@ -657,6 +658,13 @@ static struct sock *sctp_v6_create_accept_sk(struct sock *sk, - - memcpy(newnp, np, sizeof(struct ipv6_pinfo)); - -+ rcu_read_lock(); -+ opt = rcu_dereference(np->opt); -+ if (opt) -+ opt = ipv6_dup_options(newsk, opt); -+ RCU_INIT_POINTER(newnp->opt, opt); -+ rcu_read_unlock(); -+ - /* Initialize sk's sport, dport, rcv_saddr and daddr for getsockname() - * and getpeername(). - */ -diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c -index df06b13a50f6..557d7a7d95b0 100644 ---- a/net/sctp/sm_make_chunk.c -+++ b/net/sctp/sm_make_chunk.c -@@ -1652,7 +1652,7 @@ static sctp_cookie_param_t *sctp_pack_cookie(const struct sctp_endpoint *ep, - - /* Set an expiration time for the cookie. */ - cookie->c.expiration = ktime_add(asoc->cookie_life, -- ktime_get()); -+ ktime_get_real()); - - /* Copy the peer's init packet. */ - memcpy(&cookie->c.peer_init[0], init_chunk->chunk_hdr, -@@ -1780,7 +1780,7 @@ no_hmac: - if (sock_flag(ep->base.sk, SOCK_TIMESTAMP)) - kt = skb_get_ktime(skb); - else -- kt = ktime_get(); -+ kt = ktime_get_real(); - - if (!asoc && ktime_compare(bear_cookie->expiration, kt) < 0) { - /* -diff --git a/net/sctp/socket.c b/net/sctp/socket.c -index f940fdc540f5..a7400f65b9b5 100644 ---- a/net/sctp/socket.c -+++ b/net/sctp/socket.c -@@ -6985,6 +6985,9 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk, - newinet->mc_ttl = 1; - newinet->mc_index = 0; - newinet->mc_list = NULL; -+ -+ if (newsk->sk_flags & SK_FLAGS_TIMESTAMP) -+ net_enable_timestamp(); - } - - static inline void sctp_copy_descendant(struct sock *sk_to, -@@ -7165,6 +7168,13 @@ struct proto sctp_prot = { - - #if IS_ENABLED(CONFIG_IPV6) - -+#include -+static void sctp_v6_destroy_sock(struct sock *sk) -+{ -+ sctp_destroy_sock(sk); -+ inet6_destroy_sock(sk); -+} -+ - struct proto sctpv6_prot = { - .name = "SCTPv6", - .owner = THIS_MODULE, -@@ -7174,7 +7184,7 @@ struct proto sctpv6_prot = { - .accept = sctp_accept, - .ioctl = sctp_ioctl, - .init = sctp_init_sock, -- .destroy = sctp_destroy_sock, -+ .destroy = sctp_v6_destroy_sock, - .shutdown = sctp_shutdown, - .setsockopt = sctp_setsockopt, - .getsockopt = sctp_getsockopt, -diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c -index 4affedbe0206..ae0d0654f8c4 100644 ---- a/net/unix/af_unix.c -+++ b/net/unix/af_unix.c -@@ -316,6 +316,118 @@ found: - return s; - } - -+/* Support code for asymmetrically connected dgram sockets -+ * -+ * If a datagram socket is connected to a socket not itself connected -+ * to the first socket (eg, /dev/log), clients may only enqueue more -+ * messages if the present receive queue of the server socket is not -+ * "too large". This means there's a second writeability condition -+ * poll and sendmsg need to test. The dgram recv code will do a wake -+ * up on the peer_wait wait queue of a socket upon reception of a -+ * datagram which needs to be propagated to sleeping would-be writers -+ * since these might not have sent anything so far. This can't be -+ * accomplished via poll_wait because the lifetime of the server -+ * socket might be less than that of its clients if these break their -+ * association with it or if the server socket is closed while clients -+ * are still connected to it and there's no way to inform "a polling -+ * implementation" that it should let go of a certain wait queue -+ * -+ * In order to propagate a wake up, a wait_queue_t of the client -+ * socket is enqueued on the peer_wait queue of the server socket -+ * whose wake function does a wake_up on the ordinary client socket -+ * wait queue. This connection is established whenever a write (or -+ * poll for write) hit the flow control condition and broken when the -+ * association to the server socket is dissolved or after a wake up -+ * was relayed. -+ */ -+ -+static int unix_dgram_peer_wake_relay(wait_queue_t *q, unsigned mode, int flags, -+ void *key) -+{ -+ struct unix_sock *u; -+ wait_queue_head_t *u_sleep; -+ -+ u = container_of(q, struct unix_sock, peer_wake); -+ -+ __remove_wait_queue(&unix_sk(u->peer_wake.private)->peer_wait, -+ q); -+ u->peer_wake.private = NULL; -+ -+ /* relaying can only happen while the wq still exists */ -+ u_sleep = sk_sleep(&u->sk); -+ if (u_sleep) -+ wake_up_interruptible_poll(u_sleep, key); -+ -+ return 0; -+} -+ -+static int unix_dgram_peer_wake_connect(struct sock *sk, struct sock *other) -+{ -+ struct unix_sock *u, *u_other; -+ int rc; -+ -+ u = unix_sk(sk); -+ u_other = unix_sk(other); -+ rc = 0; -+ spin_lock(&u_other->peer_wait.lock); -+ -+ if (!u->peer_wake.private) { -+ u->peer_wake.private = other; -+ __add_wait_queue(&u_other->peer_wait, &u->peer_wake); -+ -+ rc = 1; -+ } -+ -+ spin_unlock(&u_other->peer_wait.lock); -+ return rc; -+} -+ -+static void unix_dgram_peer_wake_disconnect(struct sock *sk, -+ struct sock *other) -+{ -+ struct unix_sock *u, *u_other; -+ -+ u = unix_sk(sk); -+ u_other = unix_sk(other); -+ spin_lock(&u_other->peer_wait.lock); -+ -+ if (u->peer_wake.private == other) { -+ __remove_wait_queue(&u_other->peer_wait, &u->peer_wake); -+ u->peer_wake.private = NULL; -+ } -+ -+ spin_unlock(&u_other->peer_wait.lock); -+} -+ -+static void unix_dgram_peer_wake_disconnect_wakeup(struct sock *sk, -+ struct sock *other) -+{ -+ unix_dgram_peer_wake_disconnect(sk, other); -+ wake_up_interruptible_poll(sk_sleep(sk), -+ POLLOUT | -+ POLLWRNORM | -+ POLLWRBAND); -+} -+ -+/* preconditions: -+ * - unix_peer(sk) == other -+ * - association is stable -+ */ -+static int unix_dgram_peer_wake_me(struct sock *sk, struct sock *other) -+{ -+ int connected; -+ -+ connected = unix_dgram_peer_wake_connect(sk, other); -+ -+ if (unix_recvq_full(other)) -+ return 1; -+ -+ if (connected) -+ unix_dgram_peer_wake_disconnect(sk, other); -+ -+ return 0; -+} -+ - static inline int unix_writable(struct sock *sk) - { - return (atomic_read(&sk->sk_wmem_alloc) << 2) <= sk->sk_sndbuf; -@@ -420,6 +532,8 @@ static void unix_release_sock(struct sock *sk, int embrion) - skpair->sk_state_change(skpair); - sk_wake_async(skpair, SOCK_WAKE_WAITD, POLL_HUP); - } -+ -+ unix_dgram_peer_wake_disconnect(sk, skpair); - sock_put(skpair); /* It may now die */ - unix_peer(sk) = NULL; - } -@@ -653,6 +767,7 @@ static struct sock *unix_create1(struct net *net, struct socket *sock) - INIT_LIST_HEAD(&u->link); - mutex_init(&u->readlock); /* single task reading lock */ - init_waitqueue_head(&u->peer_wait); -+ init_waitqueue_func_entry(&u->peer_wake, unix_dgram_peer_wake_relay); - unix_insert_socket(unix_sockets_unbound(sk), sk); - out: - if (sk == NULL) -@@ -1020,6 +1135,8 @@ restart: - if (unix_peer(sk)) { - struct sock *old_peer = unix_peer(sk); - unix_peer(sk) = other; -+ unix_dgram_peer_wake_disconnect_wakeup(sk, old_peer); -+ - unix_state_double_unlock(sk, other); - - if (other != old_peer) -@@ -1459,6 +1576,7 @@ static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock, - struct scm_cookie tmp_scm; - int max_level; - int data_len = 0; -+ int sk_locked; - - if (NULL == siocb->scm) - siocb->scm = &tmp_scm; -@@ -1536,12 +1654,14 @@ restart: - goto out_free; - } - -+ sk_locked = 0; - unix_state_lock(other); -+restart_locked: - err = -EPERM; - if (!unix_may_send(sk, other)) - goto out_unlock; - -- if (sock_flag(other, SOCK_DEAD)) { -+ if (unlikely(sock_flag(other, SOCK_DEAD))) { - /* - * Check with 1003.1g - what should - * datagram error -@@ -1549,10 +1669,14 @@ restart: - unix_state_unlock(other); - sock_put(other); - -+ if (!sk_locked) -+ unix_state_lock(sk); -+ - err = 0; -- unix_state_lock(sk); - if (unix_peer(sk) == other) { - unix_peer(sk) = NULL; -+ unix_dgram_peer_wake_disconnect_wakeup(sk, other); -+ - unix_state_unlock(sk); - - unix_dgram_disconnected(sk, other); -@@ -1578,21 +1702,38 @@ restart: - goto out_unlock; - } - -- if (unix_peer(other) != sk && unix_recvq_full(other)) { -- if (!timeo) { -- err = -EAGAIN; -- goto out_unlock; -+ if (unlikely(unix_peer(other) != sk && unix_recvq_full(other))) { -+ if (timeo) { -+ timeo = unix_wait_for_peer(other, timeo); -+ -+ err = sock_intr_errno(timeo); -+ if (signal_pending(current)) -+ goto out_free; -+ -+ goto restart; - } - -- timeo = unix_wait_for_peer(other, timeo); -+ if (!sk_locked) { -+ unix_state_unlock(other); -+ unix_state_double_lock(sk, other); -+ } - -- err = sock_intr_errno(timeo); -- if (signal_pending(current)) -- goto out_free; -+ if (unix_peer(sk) != other || -+ unix_dgram_peer_wake_me(sk, other)) { -+ err = -EAGAIN; -+ sk_locked = 1; -+ goto out_unlock; -+ } - -- goto restart; -+ if (!sk_locked) { -+ sk_locked = 1; -+ goto restart_locked; -+ } - } - -+ if (unlikely(sk_locked)) -+ unix_state_unlock(sk); -+ - if (sock_flag(other, SOCK_RCVTSTAMP)) - __net_timestamp(skb); - maybe_add_creds(skb, sock, other); -@@ -1606,6 +1747,8 @@ restart: - return len; - - out_unlock: -+ if (sk_locked) -+ unix_state_unlock(sk); - unix_state_unlock(other); - out_free: - kfree_skb(skb); -@@ -1947,14 +2090,7 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock, - memset(&tmp_scm, 0, sizeof(tmp_scm)); - } - -- err = mutex_lock_interruptible(&u->readlock); -- if (unlikely(err)) { -- /* recvmsg() in non blocking mode is supposed to return -EAGAIN -- * sk_rcvtimeo is not honored by mutex_lock_interruptible() -- */ -- err = noblock ? -EAGAIN : -ERESTARTSYS; -- goto out; -- } -+ mutex_lock(&u->readlock); - - if (flags & MSG_PEEK) - skip = sk_peek_offset(sk, flags); -@@ -1995,12 +2131,12 @@ again: - - timeo = unix_stream_data_wait(sk, timeo, last); - -- if (signal_pending(current) -- || mutex_lock_interruptible(&u->readlock)) { -+ if (signal_pending(current)) { - err = sock_intr_errno(timeo); - goto out; - } - -+ mutex_lock(&u->readlock); - continue; - unlock: - unix_state_unlock(sk); -@@ -2263,14 +2399,16 @@ static unsigned int unix_dgram_poll(struct file *file, struct socket *sock, - return mask; - - writable = unix_writable(sk); -- other = unix_peer_get(sk); -- if (other) { -- if (unix_peer(other) != sk) { -- sock_poll_wait(file, &unix_sk(other)->peer_wait, wait); -- if (unix_recvq_full(other)) -- writable = 0; -- } -- sock_put(other); -+ if (writable) { -+ unix_state_lock(sk); -+ -+ other = unix_peer(sk); -+ if (other && unix_peer(other) != sk && -+ unix_recvq_full(other) && -+ unix_dgram_peer_wake_me(sk, other)) -+ writable = 0; -+ -+ unix_state_unlock(sk); - } - - if (writable) -diff --git a/security/keys/gc.c b/security/keys/gc.c -index 009d9370c8fd..4a780333c22c 100644 ---- a/security/keys/gc.c -+++ b/security/keys/gc.c -@@ -143,6 +143,12 @@ static noinline void key_gc_unused_keys(struct list_head *keys) - kdebug("- %u", key->serial); - key_check(key); - -+ /* Throw away the key data if the key is instantiated */ -+ if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags) && -+ !test_bit(KEY_FLAG_NEGATIVE, &key->flags) && -+ key->type->destroy) -+ key->type->destroy(key); -+ - security_key_free(key); - - /* deal with the user's key tracking and quota */ -@@ -157,10 +163,6 @@ static noinline void key_gc_unused_keys(struct list_head *keys) - if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags)) - atomic_dec(&key->user->nikeys); - -- /* now throw away the key memory */ -- if (key->type->destroy) -- key->type->destroy(key); -- - key_user_put(key->user); - - kfree(key->description); -diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c -index cee72ce64222..cb1eef9ed4fd 100644 ---- a/security/keys/keyctl.c -+++ b/security/keys/keyctl.c -@@ -744,16 +744,16 @@ long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen) - - /* the key is probably readable - now try to read it */ - can_read_key: -- ret = key_validate(key); -- if (ret == 0) { -- ret = -EOPNOTSUPP; -- if (key->type->read) { -- /* read the data with the semaphore held (since we -- * might sleep) */ -- down_read(&key->sem); -+ ret = -EOPNOTSUPP; -+ if (key->type->read) { -+ /* Read the data with the semaphore held (since we might sleep) -+ * to protect against the key being updated or revoked. -+ */ -+ down_read(&key->sem); -+ ret = key_validate(key); -+ if (ret == 0) - ret = key->type->read(key, buffer, buflen); -- up_read(&key->sem); -- } -+ up_read(&key->sem); - } - - error2: -diff --git a/tools/net/Makefile b/tools/net/Makefile -index ee577ea03ba5..ddf888010652 100644 ---- a/tools/net/Makefile -+++ b/tools/net/Makefile -@@ -4,6 +4,9 @@ CC = gcc - LEX = flex - YACC = bison - -+CFLAGS += -Wall -O2 -+CFLAGS += -D__EXPORTED_HEADERS__ -I../../include/uapi -I../../include -+ - %.yacc.c: %.y - $(YACC) -o $@ -d $< - -@@ -12,15 +15,13 @@ YACC = bison - - all : bpf_jit_disasm bpf_dbg bpf_asm - --bpf_jit_disasm : CFLAGS = -Wall -O2 -DPACKAGE='bpf_jit_disasm' -+bpf_jit_disasm : CFLAGS += -DPACKAGE='bpf_jit_disasm' - bpf_jit_disasm : LDLIBS = -lopcodes -lbfd -ldl - bpf_jit_disasm : bpf_jit_disasm.o - --bpf_dbg : CFLAGS = -Wall -O2 - bpf_dbg : LDLIBS = -lreadline - bpf_dbg : bpf_dbg.o - --bpf_asm : CFLAGS = -Wall -O2 -I. - bpf_asm : LDLIBS = - bpf_asm : bpf_asm.o bpf_exp.yacc.o bpf_exp.lex.o - bpf_exp.lex.o : bpf_exp.yacc.c diff --git a/patch/kernel/odroidc2-default/patch-3.14.59-60.patch b/patch/kernel/odroidc2-default/patch-3.14.59-60.patch deleted file mode 100644 index 81b3b40909..0000000000 --- a/patch/kernel/odroidc2-default/patch-3.14.59-60.patch +++ /dev/null @@ -1,1636 +0,0 @@ -diff --git a/Makefile b/Makefile -index c2a6ec4d8803..502255cebc9a 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 3 - PATCHLEVEL = 14 --SUBLEVEL = 59 -+SUBLEVEL = 60 - EXTRAVERSION = - NAME = Remembering Coco - -diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h -index 91f33c2051f2..eeab71a884cb 100644 ---- a/arch/arm64/include/asm/kvm_emulate.h -+++ b/arch/arm64/include/asm/kvm_emulate.h -@@ -86,11 +86,13 @@ static inline void vcpu_set_thumb(struct kvm_vcpu *vcpu) - *vcpu_cpsr(vcpu) |= COMPAT_PSR_T_BIT; - } - -+/* -+ * vcpu_reg should always be passed a register number coming from a -+ * read of ESR_EL2. Otherwise, it may give the wrong result on AArch32 -+ * with banked registers. -+ */ - static inline unsigned long *vcpu_reg(const struct kvm_vcpu *vcpu, u8 reg_num) - { -- if (vcpu_mode_is_32bit(vcpu)) -- return vcpu_reg32(vcpu, reg_num); -- - return (unsigned long *)&vcpu_gp_regs(vcpu)->regs.regs[reg_num]; - } - -diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c -index b1269dac1289..bfe4a42d4f1f 100644 ---- a/arch/arm64/kernel/ptrace.c -+++ b/arch/arm64/kernel/ptrace.c -@@ -51,6 +51,12 @@ - */ - void ptrace_disable(struct task_struct *child) - { -+ /* -+ * This would be better off in core code, but PTRACE_DETACH has -+ * grown its fair share of arch-specific worts and changing it -+ * is likely to cause regressions on obscure architectures. -+ */ -+ user_disable_single_step(child); - } - - #ifdef CONFIG_HAVE_HW_BREAKPOINT -diff --git a/arch/arm64/kvm/inject_fault.c b/arch/arm64/kvm/inject_fault.c -index 86825f8883de..f527a37ac979 100644 ---- a/arch/arm64/kvm/inject_fault.c -+++ b/arch/arm64/kvm/inject_fault.c -@@ -48,7 +48,7 @@ static void prepare_fault32(struct kvm_vcpu *vcpu, u32 mode, u32 vect_offset) - - /* Note: These now point to the banked copies */ - *vcpu_spsr(vcpu) = new_spsr_value; -- *vcpu_reg(vcpu, 14) = *vcpu_pc(vcpu) + return_offset; -+ *vcpu_reg32(vcpu, 14) = *vcpu_pc(vcpu) + return_offset; - - /* Branch to exception vector */ - if (sctlr & (1 << 13)) -diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c -index f8dc7e8fce6f..c23c77312354 100644 ---- a/arch/arm64/mm/mmu.c -+++ b/arch/arm64/mm/mmu.c -@@ -374,6 +374,9 @@ void __init paging_init(void) - - empty_zero_page = virt_to_page(zero_page); - -+ /* Ensure the zero page is visible to the page table walker */ -+ dsb(ishst); -+ - /* - * TTBR0 is only used for the identity mapping at this stage. Make it - * point to zero page to avoid speculatively fetching new entries. -diff --git a/arch/mn10300/Kconfig b/arch/mn10300/Kconfig -index a648de1b1096..b78e48fb5f45 100644 ---- a/arch/mn10300/Kconfig -+++ b/arch/mn10300/Kconfig -@@ -1,6 +1,7 @@ - config MN10300 - def_bool y - select HAVE_OPROFILE -+ select HAVE_UID16 - select GENERIC_IRQ_SHOW - select ARCH_WANT_IPC_PARSE_VERSION - select HAVE_ARCH_TRACEHOOK -@@ -37,9 +38,6 @@ config HIGHMEM - config NUMA - def_bool n - --config UID16 -- def_bool y -- - config RWSEM_GENERIC_SPINLOCK - def_bool y - -diff --git a/arch/openrisc/Kconfig b/arch/openrisc/Kconfig -index 9488209a5253..191cd8e8b5da 100644 ---- a/arch/openrisc/Kconfig -+++ b/arch/openrisc/Kconfig -@@ -16,6 +16,7 @@ config OPENRISC - select GENERIC_IRQ_SHOW - select GENERIC_IOMAP - select GENERIC_CPU_DEVICES -+ select HAVE_UID16 - select GENERIC_ATOMIC64 - select GENERIC_CLOCKEVENTS - select GENERIC_STRNCPY_FROM_USER -@@ -29,9 +30,6 @@ config MMU - config HAVE_DMA_ATTRS - def_bool y - --config UID16 -- def_bool y -- - config RWSEM_GENERIC_SPINLOCK - def_bool y - -diff --git a/arch/powerpc/include/asm/cmpxchg.h b/arch/powerpc/include/asm/cmpxchg.h -index d463c68fe7f0..99897f6645c1 100644 ---- a/arch/powerpc/include/asm/cmpxchg.h -+++ b/arch/powerpc/include/asm/cmpxchg.h -@@ -18,12 +18,12 @@ __xchg_u32(volatile void *p, unsigned long val) - unsigned long prev; - - __asm__ __volatile__( -- PPC_RELEASE_BARRIER -+ PPC_ATOMIC_ENTRY_BARRIER - "1: lwarx %0,0,%2 \n" - PPC405_ERR77(0,%2) - " stwcx. %3,0,%2 \n\ - bne- 1b" -- PPC_ACQUIRE_BARRIER -+ PPC_ATOMIC_EXIT_BARRIER - : "=&r" (prev), "+m" (*(volatile unsigned int *)p) - : "r" (p), "r" (val) - : "cc", "memory"); -@@ -61,12 +61,12 @@ __xchg_u64(volatile void *p, unsigned long val) - unsigned long prev; - - __asm__ __volatile__( -- PPC_RELEASE_BARRIER -+ PPC_ATOMIC_ENTRY_BARRIER - "1: ldarx %0,0,%2 \n" - PPC405_ERR77(0,%2) - " stdcx. %3,0,%2 \n\ - bne- 1b" -- PPC_ACQUIRE_BARRIER -+ PPC_ATOMIC_EXIT_BARRIER - : "=&r" (prev), "+m" (*(volatile unsigned long *)p) - : "r" (p), "r" (val) - : "cc", "memory"); -@@ -152,14 +152,14 @@ __cmpxchg_u32(volatile unsigned int *p, unsigned long old, unsigned long new) - unsigned int prev; - - __asm__ __volatile__ ( -- PPC_RELEASE_BARRIER -+ PPC_ATOMIC_ENTRY_BARRIER - "1: lwarx %0,0,%2 # __cmpxchg_u32\n\ - cmpw 0,%0,%3\n\ - bne- 2f\n" - PPC405_ERR77(0,%2) - " stwcx. %4,0,%2\n\ - bne- 1b" -- PPC_ACQUIRE_BARRIER -+ PPC_ATOMIC_EXIT_BARRIER - "\n\ - 2:" - : "=&r" (prev), "+m" (*p) -@@ -198,13 +198,13 @@ __cmpxchg_u64(volatile unsigned long *p, unsigned long old, unsigned long new) - unsigned long prev; - - __asm__ __volatile__ ( -- PPC_RELEASE_BARRIER -+ PPC_ATOMIC_ENTRY_BARRIER - "1: ldarx %0,0,%2 # __cmpxchg_u64\n\ - cmpd 0,%0,%3\n\ - bne- 2f\n\ - stdcx. %4,0,%2\n\ - bne- 1b" -- PPC_ACQUIRE_BARRIER -+ PPC_ATOMIC_EXIT_BARRIER - "\n\ - 2:" - : "=&r" (prev), "+m" (*p) -diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h -index ce17815b8b55..92c538d5ed19 100644 ---- a/arch/powerpc/include/asm/reg.h -+++ b/arch/powerpc/include/asm/reg.h -@@ -108,6 +108,7 @@ - #define MSR_TS_T __MASK(MSR_TS_T_LG) /* Transaction Transactional */ - #define MSR_TS_MASK (MSR_TS_T | MSR_TS_S) /* Transaction State bits */ - #define MSR_TM_ACTIVE(x) (((x) & MSR_TS_MASK) != 0) /* Transaction active? */ -+#define MSR_TM_RESV(x) (((x) & MSR_TS_MASK) == MSR_TS_MASK) /* Reserved */ - #define MSR_TM_TRANSACTIONAL(x) (((x) & MSR_TS_MASK) == MSR_TS_T) - #define MSR_TM_SUSPENDED(x) (((x) & MSR_TS_MASK) == MSR_TS_S) - -diff --git a/arch/powerpc/include/asm/synch.h b/arch/powerpc/include/asm/synch.h -index e682a7143edb..c50868681f9e 100644 ---- a/arch/powerpc/include/asm/synch.h -+++ b/arch/powerpc/include/asm/synch.h -@@ -44,7 +44,7 @@ static inline void isync(void) - MAKE_LWSYNC_SECTION_ENTRY(97, __lwsync_fixup); - #define PPC_ACQUIRE_BARRIER "\n" stringify_in_c(__PPC_ACQUIRE_BARRIER) - #define PPC_RELEASE_BARRIER stringify_in_c(LWSYNC) "\n" --#define PPC_ATOMIC_ENTRY_BARRIER "\n" stringify_in_c(LWSYNC) "\n" -+#define PPC_ATOMIC_ENTRY_BARRIER "\n" stringify_in_c(sync) "\n" - #define PPC_ATOMIC_EXIT_BARRIER "\n" stringify_in_c(sync) "\n" - #else - #define PPC_ACQUIRE_BARRIER -diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c -index 31d021506d21..6e15abf30eb8 100644 ---- a/arch/powerpc/kernel/process.c -+++ b/arch/powerpc/kernel/process.c -@@ -545,6 +545,24 @@ static void tm_reclaim_thread(struct thread_struct *thr, - msr_diff &= MSR_FP | MSR_VEC | MSR_VSX | MSR_FE0 | MSR_FE1; - } - -+ /* -+ * Use the current MSR TM suspended bit to track if we have -+ * checkpointed state outstanding. -+ * On signal delivery, we'd normally reclaim the checkpointed -+ * state to obtain stack pointer (see:get_tm_stackpointer()). -+ * This will then directly return to userspace without going -+ * through __switch_to(). However, if the stack frame is bad, -+ * we need to exit this thread which calls __switch_to() which -+ * will again attempt to reclaim the already saved tm state. -+ * Hence we need to check that we've not already reclaimed -+ * this state. -+ * We do this using the current MSR, rather tracking it in -+ * some specific thread_struct bit, as it has the additional -+ * benifit of checking for a potential TM bad thing exception. -+ */ -+ if (!MSR_TM_SUSPENDED(mfmsr())) -+ return; -+ - tm_reclaim(thr, thr->regs->msr, cause); - - /* Having done the reclaim, we now have the checkpointed -diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c -index e881e3f5f0ec..da3054691d61 100644 ---- a/arch/powerpc/kernel/signal_32.c -+++ b/arch/powerpc/kernel/signal_32.c -@@ -876,6 +876,15 @@ static long restore_tm_user_regs(struct pt_regs *regs, - return 1; - #endif /* CONFIG_SPE */ - -+ /* Get the top half of the MSR from the user context */ -+ if (__get_user(msr_hi, &tm_sr->mc_gregs[PT_MSR])) -+ return 1; -+ msr_hi <<= 32; -+ /* If TM bits are set to the reserved value, it's an invalid context */ -+ if (MSR_TM_RESV(msr_hi)) -+ return 1; -+ /* Pull in the MSR TM bits from the user context */ -+ regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr_hi & MSR_TS_MASK); - /* Now, recheckpoint. This loads up all of the checkpointed (older) - * registers, including FP and V[S]Rs. After recheckpointing, the - * transactional versions should be loaded. -@@ -885,11 +894,6 @@ static long restore_tm_user_regs(struct pt_regs *regs, - current->thread.tm_texasr |= TEXASR_FS; - /* This loads the checkpointed FP/VEC state, if used */ - tm_recheckpoint(¤t->thread, msr); -- /* Get the top half of the MSR */ -- if (__get_user(msr_hi, &tm_sr->mc_gregs[PT_MSR])) -- return 1; -- /* Pull in MSR TM from user context */ -- regs->msr = (regs->msr & ~MSR_TS_MASK) | ((msr_hi<<32) & MSR_TS_MASK); - - /* This loads the speculative FP/VEC state, if used */ - if (msr & MSR_FP) { -diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c -index d501dc4dc3e6..dd27d63e112c 100644 ---- a/arch/powerpc/kernel/signal_64.c -+++ b/arch/powerpc/kernel/signal_64.c -@@ -428,6 +428,10 @@ static long restore_tm_sigcontexts(struct pt_regs *regs, - - /* get MSR separately, transfer the LE bit if doing signal return */ - err |= __get_user(msr, &sc->gp_regs[PT_MSR]); -+ /* Don't allow reserved mode. */ -+ if (MSR_TM_RESV(msr)) -+ return -EINVAL; -+ - /* pull in MSR TM from user context */ - regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr & MSR_TS_MASK); - -diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c -index 7a25d9218a05..975681b67dba 100644 ---- a/arch/powerpc/kvm/book3s_hv.c -+++ b/arch/powerpc/kvm/book3s_hv.c -@@ -166,6 +166,12 @@ static void kvmppc_core_vcpu_put_hv(struct kvm_vcpu *vcpu) - - static void kvmppc_set_msr_hv(struct kvm_vcpu *vcpu, u64 msr) - { -+ /* -+ * Check for illegal transactional state bit combination -+ * and if we find it, force the TS field to a safe state. -+ */ -+ if ((msr & MSR_TS_MASK) == MSR_TS_MASK) -+ msr &= ~MSR_TS_MASK; - vcpu->arch.shregs.msr = msr; - kvmppc_end_cede(vcpu); - } -diff --git a/arch/x86/include/asm/boot.h b/arch/x86/include/asm/boot.h -index 4fa687a47a62..6b8d6e8cd449 100644 ---- a/arch/x86/include/asm/boot.h -+++ b/arch/x86/include/asm/boot.h -@@ -27,7 +27,7 @@ - #define BOOT_HEAP_SIZE 0x400000 - #else /* !CONFIG_KERNEL_BZIP2 */ - --#define BOOT_HEAP_SIZE 0x8000 -+#define BOOT_HEAP_SIZE 0x10000 - - #endif /* !CONFIG_KERNEL_BZIP2 */ - -diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c -index a6aa91f77654..9c1f8e85e9de 100644 ---- a/arch/x86/kernel/reboot.c -+++ b/arch/x86/kernel/reboot.c -@@ -180,6 +180,14 @@ static struct dmi_system_id __initdata reboot_dmi_table[] = { - DMI_MATCH(DMI_PRODUCT_NAME, "iMac9,1"), - }, - }, -+ { /* Handle problems with rebooting on the iMac10,1. */ -+ .callback = set_pci_reboot, -+ .ident = "Apple iMac10,1", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "iMac10,1"), -+ }, -+ }, - - /* ASRock */ - { /* Handle problems with rebooting on ASRock Q1900DC-ITX */ -diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c -index b88fc86309bc..5d3e60156683 100644 ---- a/arch/x86/kernel/signal.c -+++ b/arch/x86/kernel/signal.c -@@ -682,12 +682,15 @@ handle_signal(struct ksignal *ksig, struct pt_regs *regs) - signal_setup_done(failed, ksig, test_thread_flag(TIF_SINGLESTEP)); - } - --#ifdef CONFIG_X86_32 --#define NR_restart_syscall __NR_restart_syscall --#else /* !CONFIG_X86_32 */ --#define NR_restart_syscall \ -- test_thread_flag(TIF_IA32) ? __NR_ia32_restart_syscall : __NR_restart_syscall --#endif /* CONFIG_X86_32 */ -+static inline unsigned long get_nr_restart_syscall(const struct pt_regs *regs) -+{ -+#if defined(CONFIG_X86_32) || !defined(CONFIG_X86_64) -+ return __NR_restart_syscall; -+#else /* !CONFIG_X86_32 && CONFIG_X86_64 */ -+ return test_thread_flag(TIF_IA32) ? __NR_ia32_restart_syscall : -+ __NR_restart_syscall | (regs->orig_ax & __X32_SYSCALL_BIT); -+#endif /* CONFIG_X86_32 || !CONFIG_X86_64 */ -+} - - /* - * Note that 'init' is a special process: it doesn't get signals it doesn't -@@ -716,7 +719,7 @@ static void do_signal(struct pt_regs *regs) - break; - - case -ERESTART_RESTARTBLOCK: -- regs->ax = NR_restart_syscall; -+ regs->ax = get_nr_restart_syscall(regs); - regs->ip -= 2; - break; - } -diff --git a/arch/x86/xen/suspend.c b/arch/x86/xen/suspend.c -index 45329c8c226e..39e12c10b931 100644 ---- a/arch/x86/xen/suspend.c -+++ b/arch/x86/xen/suspend.c -@@ -30,7 +30,8 @@ void xen_arch_hvm_post_suspend(int suspend_cancelled) - { - #ifdef CONFIG_XEN_PVHVM - int cpu; -- xen_hvm_init_shared_info(); -+ if (!suspend_cancelled) -+ xen_hvm_init_shared_info(); - xen_callback_vector(); - xen_unplug_emulated_devices(); - if (xen_feature(XENFEAT_hvm_safe_pvclock)) { -diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c -index 8b4fa2c4e661..108ddc311369 100644 ---- a/drivers/char/ipmi/ipmi_si_intf.c -+++ b/drivers/char/ipmi/ipmi_si_intf.c -@@ -1152,14 +1152,14 @@ static int smi_start_processing(void *send_info, - - new_smi->intf = intf; - -- /* Try to claim any interrupts. */ -- if (new_smi->irq_setup) -- new_smi->irq_setup(new_smi); -- - /* Set up the timer that drives the interface. */ - setup_timer(&new_smi->si_timer, smi_timeout, (long)new_smi); - smi_mod_timer(new_smi, jiffies + SI_TIMEOUT_JIFFIES); - -+ /* Try to claim any interrupts. */ -+ if (new_smi->irq_setup) -+ new_smi->irq_setup(new_smi); -+ - /* - * Check if the user forcefully enabled the daemon. - */ -diff --git a/drivers/connector/connector.c b/drivers/connector/connector.c -index a36749f1e44a..cc4fee674f21 100644 ---- a/drivers/connector/connector.c -+++ b/drivers/connector/connector.c -@@ -154,26 +154,21 @@ static int cn_call_callback(struct sk_buff *skb) - * - * It checks skb, netlink header and msg sizes, and calls callback helper. - */ --static void cn_rx_skb(struct sk_buff *__skb) -+static void cn_rx_skb(struct sk_buff *skb) - { - struct nlmsghdr *nlh; -- struct sk_buff *skb; - int len, err; - -- skb = skb_get(__skb); -- - if (skb->len >= NLMSG_HDRLEN) { - nlh = nlmsg_hdr(skb); - len = nlmsg_len(nlh); - - if (len < (int)sizeof(struct cn_msg) || - skb->len < nlh->nlmsg_len || -- len > CONNECTOR_MAX_MSG_SIZE) { -- kfree_skb(skb); -+ len > CONNECTOR_MAX_MSG_SIZE) - return; -- } - -- err = cn_call_callback(skb); -+ err = cn_call_callback(skb_get(skb)); - if (err < 0) - kfree_skb(skb); - } -diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c -index d92c7d9b959a..51f18bf75fa6 100644 ---- a/drivers/hid/hid-core.c -+++ b/drivers/hid/hid-core.c -@@ -1506,7 +1506,7 @@ int hid_connect(struct hid_device *hdev, unsigned int connect_mask) - "Multi-Axis Controller" - }; - const char *type, *bus; -- char buf[64]; -+ char buf[64] = ""; - unsigned int i; - int len; - int ret; -diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c -index 38ceac5053a0..0ed6731396ef 100644 ---- a/drivers/isdn/i4l/isdn_ppp.c -+++ b/drivers/isdn/i4l/isdn_ppp.c -@@ -301,6 +301,8 @@ isdn_ppp_open(int min, struct file *file) - is->compflags = 0; - - is->reset = isdn_ppp_ccp_reset_alloc(is); -+ if (!is->reset) -+ return -ENOMEM; - - is->lp = NULL; - is->mp_seqno = 0; /* MP sequence number */ -@@ -320,6 +322,10 @@ isdn_ppp_open(int min, struct file *file) - * VJ header compression init - */ - is->slcomp = slhc_init(16, 16); /* not necessary for 2. link in bundle */ -+ if (IS_ERR(is->slcomp)) { -+ isdn_ppp_ccp_reset_free(is); -+ return PTR_ERR(is->slcomp); -+ } - #endif - #ifdef CONFIG_IPPP_FILTER - is->pass_filter = NULL; -@@ -568,10 +574,8 @@ isdn_ppp_ioctl(int min, struct file *file, unsigned int cmd, unsigned long arg) - is->maxcid = val; - #ifdef CONFIG_ISDN_PPP_VJ - sltmp = slhc_init(16, val); -- if (!sltmp) { -- printk(KERN_ERR "ippp, can't realloc slhc struct\n"); -- return -ENOMEM; -- } -+ if (IS_ERR(sltmp)) -+ return PTR_ERR(sltmp); - if (is->slcomp) - slhc_free(is->slcomp); - is->slcomp = sltmp; -diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c -index 0697d8f5f3cf..91b15062ffbf 100644 ---- a/drivers/net/bonding/bond_main.c -+++ b/drivers/net/bonding/bond_main.c -@@ -1181,7 +1181,6 @@ static int bond_master_upper_dev_link(struct net_device *bond_dev, - err = netdev_master_upper_dev_link_private(slave_dev, bond_dev, slave); - if (err) - return err; -- slave_dev->flags |= IFF_SLAVE; - rtmsg_ifinfo(RTM_NEWLINK, slave_dev, IFF_SLAVE, GFP_KERNEL); - return 0; - } -@@ -1363,6 +1362,9 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev) - } - } - -+ /* set slave flag before open to prevent IPv6 addrconf */ -+ slave_dev->flags |= IFF_SLAVE; -+ - /* open the slave since the application closed it */ - res = dev_open(slave_dev); - if (res) { -@@ -1617,6 +1619,7 @@ err_close: - dev_close(slave_dev); - - err_restore_mac: -+ slave_dev->flags &= ~IFF_SLAVE; - if (!bond->params.fail_over_mac || - bond->params.mode != BOND_MODE_ACTIVEBACKUP) { - /* XXX TODO - fom follow mode needs to change master's -diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c -index 5a1897d86e94..a2d7d5f066f1 100644 ---- a/drivers/net/ppp/ppp_generic.c -+++ b/drivers/net/ppp/ppp_generic.c -@@ -716,10 +716,8 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - val &= 0xffff; - } - vj = slhc_init(val2+1, val+1); -- if (!vj) { -- netdev_err(ppp->dev, -- "PPP: no memory (VJ compressor)\n"); -- err = -ENOMEM; -+ if (IS_ERR(vj)) { -+ err = PTR_ERR(vj); - break; - } - ppp_lock(ppp); -diff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c -index 1252d9c726a7..b52eabc168a0 100644 ---- a/drivers/net/slip/slhc.c -+++ b/drivers/net/slip/slhc.c -@@ -84,8 +84,9 @@ static long decode(unsigned char **cpp); - static unsigned char * put16(unsigned char *cp, unsigned short x); - static unsigned short pull16(unsigned char **cpp); - --/* Initialize compression data structure -+/* Allocate compression data structure - * slots must be in range 0 to 255 (zero meaning no compression) -+ * Returns pointer to structure or ERR_PTR() on error. - */ - struct slcompress * - slhc_init(int rslots, int tslots) -@@ -94,11 +95,14 @@ slhc_init(int rslots, int tslots) - register struct cstate *ts; - struct slcompress *comp; - -+ if (rslots < 0 || rslots > 255 || tslots < 0 || tslots > 255) -+ return ERR_PTR(-EINVAL); -+ - comp = kzalloc(sizeof(struct slcompress), GFP_KERNEL); - if (! comp) - goto out_fail; - -- if ( rslots > 0 && rslots < 256 ) { -+ if (rslots > 0) { - size_t rsize = rslots * sizeof(struct cstate); - comp->rstate = kzalloc(rsize, GFP_KERNEL); - if (! comp->rstate) -@@ -106,7 +110,7 @@ slhc_init(int rslots, int tslots) - comp->rslot_limit = rslots - 1; - } - -- if ( tslots > 0 && tslots < 256 ) { -+ if (tslots > 0) { - size_t tsize = tslots * sizeof(struct cstate); - comp->tstate = kzalloc(tsize, GFP_KERNEL); - if (! comp->tstate) -@@ -141,7 +145,7 @@ out_free2: - out_free: - kfree(comp); - out_fail: -- return NULL; -+ return ERR_PTR(-ENOMEM); - } - - -diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c -index 87526443841f..0641fccdc954 100644 ---- a/drivers/net/slip/slip.c -+++ b/drivers/net/slip/slip.c -@@ -164,7 +164,7 @@ static int sl_alloc_bufs(struct slip *sl, int mtu) - if (cbuff == NULL) - goto err_exit; - slcomp = slhc_init(16, 16); -- if (slcomp == NULL) -+ if (IS_ERR(slcomp)) - goto err_exit; - #endif - spin_lock_bh(&sl->lock); -diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c -index c28e2dafb3f0..20465111984a 100644 ---- a/drivers/net/team/team.c -+++ b/drivers/net/team/team.c -@@ -1838,10 +1838,10 @@ static int team_vlan_rx_kill_vid(struct net_device *dev, __be16 proto, u16 vid) - struct team *team = netdev_priv(dev); - struct team_port *port; - -- rcu_read_lock(); -- list_for_each_entry_rcu(port, &team->port_list, list) -+ mutex_lock(&team->lock); -+ list_for_each_entry(port, &team->port_list, list) - vlan_vid_del(port->dev, proto, vid); -- rcu_read_unlock(); -+ mutex_unlock(&team->lock); - - return 0; - } -diff --git a/drivers/net/veth.c b/drivers/net/veth.c -index c0e7c64765ab..6da55394bd75 100644 ---- a/drivers/net/veth.c -+++ b/drivers/net/veth.c -@@ -116,12 +116,6 @@ static netdev_tx_t veth_xmit(struct sk_buff *skb, struct net_device *dev) - kfree_skb(skb); - goto drop; - } -- /* don't change ip_summed == CHECKSUM_PARTIAL, as that -- * will cause bad checksum on forwarded packets -- */ -- if (skb->ip_summed == CHECKSUM_NONE && -- rcv->features & NETIF_F_RXCSUM) -- skb->ip_summed = CHECKSUM_UNNECESSARY; - - if (likely(dev_forward_skb(rcv, skb) == NET_RX_SUCCESS)) { - struct pcpu_vstats *stats = this_cpu_ptr(dev->vstats); -diff --git a/drivers/parisc/iommu-helpers.h b/drivers/parisc/iommu-helpers.h -index 8c33491b21fe..c6aa38883466 100644 ---- a/drivers/parisc/iommu-helpers.h -+++ b/drivers/parisc/iommu-helpers.h -@@ -104,7 +104,11 @@ iommu_coalesce_chunks(struct ioc *ioc, struct device *dev, - struct scatterlist *contig_sg; /* contig chunk head */ - unsigned long dma_offset, dma_len; /* start/len of DMA stream */ - unsigned int n_mappings = 0; -- unsigned int max_seg_size = dma_get_max_seg_size(dev); -+ unsigned int max_seg_size = min(dma_get_max_seg_size(dev), -+ (unsigned)DMA_CHUNK_SIZE); -+ unsigned int max_seg_boundary = dma_get_seg_boundary(dev) + 1; -+ if (max_seg_boundary) /* check if the addition above didn't overflow */ -+ max_seg_size = min(max_seg_size, max_seg_boundary); - - while (nents > 0) { - -@@ -139,14 +143,11 @@ iommu_coalesce_chunks(struct ioc *ioc, struct device *dev, - - /* - ** First make sure current dma stream won't -- ** exceed DMA_CHUNK_SIZE if we coalesce the -+ ** exceed max_seg_size if we coalesce the - ** next entry. - */ -- if(unlikely(ALIGN(dma_len + dma_offset + startsg->length, -- IOVP_SIZE) > DMA_CHUNK_SIZE)) -- break; -- -- if (startsg->length + dma_len > max_seg_size) -+ if (unlikely(ALIGN(dma_len + dma_offset + startsg->length, IOVP_SIZE) > -+ max_seg_size)) - break; - - /* -diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c -index 79c7b255e60a..c8e693c22014 100644 ---- a/drivers/usb/host/xhci.c -+++ b/drivers/usb/host/xhci.c -@@ -4696,8 +4696,16 @@ int xhci_update_hub_device(struct usb_hcd *hcd, struct usb_device *hdev, - ctrl_ctx->add_flags |= cpu_to_le32(SLOT_FLAG); - slot_ctx = xhci_get_slot_ctx(xhci, config_cmd->in_ctx); - slot_ctx->dev_info |= cpu_to_le32(DEV_HUB); -+ /* -+ * refer to section 6.2.2: MTT should be 0 for full speed hub, -+ * but it may be already set to 1 when setup an xHCI virtual -+ * device, so clear it anyway. -+ */ - if (tt->multi) - slot_ctx->dev_info |= cpu_to_le32(DEV_MTT); -+ else if (hdev->speed == USB_SPEED_FULL) -+ slot_ctx->dev_info &= cpu_to_le32(~DEV_MTT); -+ - if (xhci->hci_version > 0x95) { - xhci_dbg(xhci, "xHCI version %x needs hub " - "TT think time and number of ports\n", -@@ -4885,6 +4893,10 @@ static int __init xhci_hcd_init(void) - BUILD_BUG_ON(sizeof(struct xhci_intr_reg) != 8*32/8); - /* xhci_run_regs has eight fields and embeds 128 xhci_intr_regs */ - BUILD_BUG_ON(sizeof(struct xhci_run_regs) != (8+8*128)*32/8); -+ -+ if (usb_disabled()) -+ return -ENODEV; -+ - return 0; - unreg_pci: - xhci_unregister_pci(); -diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c -index c2bdc5f2a4b1..b4fc4091e3f8 100644 ---- a/drivers/usb/serial/cp210x.c -+++ b/drivers/usb/serial/cp210x.c -@@ -160,6 +160,7 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(0x17F4, 0xAAAA) }, /* Wavesense Jazz blood glucose meter */ - { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */ - { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */ -+ { USB_DEVICE(0x18EF, 0xE025) }, /* ELV Marble Sound Board 1 */ - { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */ - { USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */ - { USB_DEVICE(0x1BA4, 0x0002) }, /* Silicon Labs 358x factory default */ -diff --git a/drivers/usb/serial/ipaq.c b/drivers/usb/serial/ipaq.c -index f51a5d52c0ed..ec1b8f2c1183 100644 ---- a/drivers/usb/serial/ipaq.c -+++ b/drivers/usb/serial/ipaq.c -@@ -531,7 +531,8 @@ static int ipaq_open(struct tty_struct *tty, - * through. Since this has a reasonably high failure rate, we retry - * several times. - */ -- while (retries--) { -+ while (retries) { -+ retries--; - result = usb_control_msg(serial->dev, - usb_sndctrlpipe(serial->dev, 0), 0x22, 0x21, - 0x1, 0, NULL, 0, 100); -diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c -index 91cc44611062..7ffbb9390628 100644 ---- a/drivers/xen/gntdev.c -+++ b/drivers/xen/gntdev.c -@@ -765,7 +765,7 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma) - - vma->vm_ops = &gntdev_vmops; - -- vma->vm_flags |= VM_DONTEXPAND | VM_DONTDUMP; -+ vma->vm_flags |= VM_DONTEXPAND | VM_DONTDUMP | VM_IO; - - if (use_ptemod) - vma->vm_flags |= VM_DONTCOPY; -diff --git a/include/linux/sched.h b/include/linux/sched.h -index ec6000f66e75..7d6152a6700c 100644 ---- a/include/linux/sched.h -+++ b/include/linux/sched.h -@@ -755,6 +755,7 @@ struct user_struct { - unsigned long mq_bytes; /* How many bytes can be allocated to mqueue? */ - #endif - unsigned long locked_shm; /* How many pages of mlocked shm ? */ -+ unsigned long unix_inflight; /* How many files in flight in unix sockets */ - - #ifdef CONFIG_KEYS - struct key *uid_keyring; /* UID specific keyring */ -diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h -index a747a77ea584..fad4082c50d9 100644 ---- a/include/linux/syscalls.h -+++ b/include/linux/syscalls.h -@@ -507,7 +507,7 @@ asmlinkage long sys_chown(const char __user *filename, - asmlinkage long sys_lchown(const char __user *filename, - uid_t user, gid_t group); - asmlinkage long sys_fchown(unsigned int fd, uid_t user, gid_t group); --#ifdef CONFIG_UID16 -+#ifdef CONFIG_HAVE_UID16 - asmlinkage long sys_chown16(const char __user *filename, - old_uid_t user, old_gid_t group); - asmlinkage long sys_lchown16(const char __user *filename, -diff --git a/include/linux/types.h b/include/linux/types.h -index 4d118ba11349..83db8e5974dc 100644 ---- a/include/linux/types.h -+++ b/include/linux/types.h -@@ -35,7 +35,7 @@ typedef __kernel_gid16_t gid16_t; - - typedef unsigned long uintptr_t; - --#ifdef CONFIG_UID16 -+#ifdef CONFIG_HAVE_UID16 - /* This is defined by include/asm-{arch}/posix_types.h */ - typedef __kernel_old_uid_t old_uid_t; - typedef __kernel_old_gid_t old_gid_t; -diff --git a/include/net/inet_ecn.h b/include/net/inet_ecn.h -index 3bd22795c3e2..194723c2e7bb 100644 ---- a/include/net/inet_ecn.h -+++ b/include/net/inet_ecn.h -@@ -111,11 +111,24 @@ static inline void ipv4_copy_dscp(unsigned int dscp, struct iphdr *inner) - - struct ipv6hdr; - --static inline int IP6_ECN_set_ce(struct ipv6hdr *iph) -+/* Note: -+ * IP_ECN_set_ce() has to tweak IPV4 checksum when setting CE, -+ * meaning both changes have no effect on skb->csum if/when CHECKSUM_COMPLETE -+ * In IPv6 case, no checksum compensates the change in IPv6 header, -+ * so we have to update skb->csum. -+ */ -+static inline int IP6_ECN_set_ce(struct sk_buff *skb, struct ipv6hdr *iph) - { -+ __be32 from, to; -+ - if (INET_ECN_is_not_ect(ipv6_get_dsfield(iph))) - return 0; -- *(__be32*)iph |= htonl(INET_ECN_CE << 20); -+ -+ from = *(__be32 *)iph; -+ to = from | htonl(INET_ECN_CE << 20); -+ *(__be32 *)iph = to; -+ if (skb->ip_summed == CHECKSUM_COMPLETE) -+ skb->csum = csum_add(csum_sub(skb->csum, from), to); - return 1; - } - -@@ -142,7 +155,7 @@ static inline int INET_ECN_set_ce(struct sk_buff *skb) - case cpu_to_be16(ETH_P_IPV6): - if (skb_network_header(skb) + sizeof(struct ipv6hdr) <= - skb_tail_pointer(skb)) -- return IP6_ECN_set_ce(ipv6_hdr(skb)); -+ return IP6_ECN_set_ce(skb, ipv6_hdr(skb)); - break; - } - -diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c -index 9a0005aee9ad..15022fdfab70 100644 ---- a/net/bridge/br_stp_if.c -+++ b/net/bridge/br_stp_if.c -@@ -128,7 +128,10 @@ static void br_stp_start(struct net_bridge *br) - char *argv[] = { BR_STP_PROG, br->dev->name, "start", NULL }; - char *envp[] = { NULL }; - -- r = call_usermodehelper(BR_STP_PROG, argv, envp, UMH_WAIT_PROC); -+ if (net_eq(dev_net(br->dev), &init_net)) -+ r = call_usermodehelper(BR_STP_PROG, argv, envp, UMH_WAIT_PROC); -+ else -+ r = -ENOENT; - - spin_lock_bh(&br->lock); - -diff --git a/net/core/dst.c b/net/core/dst.c -index c07070544e3f..74d1ad1285d0 100644 ---- a/net/core/dst.c -+++ b/net/core/dst.c -@@ -280,10 +280,11 @@ void dst_release(struct dst_entry *dst) - { - if (dst) { - int newrefcnt; -+ unsigned short nocache = dst->flags & DST_NOCACHE; - - newrefcnt = atomic_dec_return(&dst->__refcnt); - WARN_ON(newrefcnt < 0); -- if (!newrefcnt && unlikely(dst->flags & DST_NOCACHE)) -+ if (!newrefcnt && unlikely(nocache)) - call_rcu(&dst->rcu_head, dst_destroy_rcu); - } - } -diff --git a/net/ipv4/tcp_yeah.c b/net/ipv4/tcp_yeah.c -index 1a8d271f994d..f9f52e75b149 100644 ---- a/net/ipv4/tcp_yeah.c -+++ b/net/ipv4/tcp_yeah.c -@@ -223,7 +223,7 @@ static u32 tcp_yeah_ssthresh(struct sock *sk) { - yeah->fast_count = 0; - yeah->reno_count = max(yeah->reno_count>>1, 2U); - -- return tp->snd_cwnd - reduction; -+ return max_t(int, tp->snd_cwnd - reduction, 2); - } - - static struct tcp_congestion_ops tcp_yeah __read_mostly = { -diff --git a/net/ipv6/addrlabel.c b/net/ipv6/addrlabel.c -index b30ad3741b46..d5c918975c8c 100644 ---- a/net/ipv6/addrlabel.c -+++ b/net/ipv6/addrlabel.c -@@ -558,7 +558,7 @@ static int ip6addrlbl_get(struct sk_buff *in_skb, struct nlmsghdr* nlh) - - rcu_read_lock(); - p = __ipv6_addr_label(net, addr, ipv6_addr_type(addr), ifal->ifal_index); -- if (p && ip6addrlbl_hold(p)) -+ if (p && !ip6addrlbl_hold(p)) - p = NULL; - lseq = ip6addrlbl_table.seq; - rcu_read_unlock(); -diff --git a/net/ipv6/xfrm6_mode_tunnel.c b/net/ipv6/xfrm6_mode_tunnel.c -index cb04f7a16b5e..c5d6a936e70c 100644 ---- a/net/ipv6/xfrm6_mode_tunnel.c -+++ b/net/ipv6/xfrm6_mode_tunnel.c -@@ -83,7 +83,7 @@ static inline void ipip6_ecn_decapsulate(struct sk_buff *skb) - struct ipv6hdr *inner_iph = ipipv6_hdr(skb); - - if (INET_ECN_is_ce(ipv6_get_dsfield(outer_iph))) -- IP6_ECN_set_ce(inner_iph); -+ IP6_ECN_set_ce(skb, inner_iph); - } - - /* Add encapsulation header. -diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c -index 5a940dbd74a3..f0229223bf91 100644 ---- a/net/phonet/af_phonet.c -+++ b/net/phonet/af_phonet.c -@@ -377,6 +377,10 @@ static int phonet_rcv(struct sk_buff *skb, struct net_device *dev, - struct sockaddr_pn sa; - u16 len; - -+ skb = skb_share_check(skb, GFP_ATOMIC); -+ if (!skb) -+ return NET_RX_DROP; -+ - /* check we have at least a full Phonet header */ - if (!pskb_pull(skb, sizeof(struct phonethdr))) - goto out; -diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c -index 3e287a3fa03b..af1da3188865 100644 ---- a/net/sctp/sm_statefuns.c -+++ b/net/sctp/sm_statefuns.c -@@ -4833,7 +4833,8 @@ sctp_disposition_t sctp_sf_do_9_1_prm_abort( - - retval = SCTP_DISPOSITION_CONSUME; - -- sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort)); -+ if (abort) -+ sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort)); - - /* Even if we can't send the ABORT due to low memory delete the - * TCB. This is a departure from our typical NOMEM handling. -@@ -4970,7 +4971,8 @@ sctp_disposition_t sctp_sf_cookie_wait_prm_abort( - SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT)); - retval = SCTP_DISPOSITION_CONSUME; - -- sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort)); -+ if (abort) -+ sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort)); - - sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE, - SCTP_STATE(SCTP_STATE_CLOSED)); -diff --git a/net/sctp/socket.c b/net/sctp/socket.c -index a7400f65b9b5..2072600b74c9 100644 ---- a/net/sctp/socket.c -+++ b/net/sctp/socket.c -@@ -1517,8 +1517,7 @@ static void sctp_close(struct sock *sk, long timeout) - struct sctp_chunk *chunk; - - chunk = sctp_make_abort_user(asoc, NULL, 0); -- if (chunk) -- sctp_primitive_ABORT(net, asoc, chunk); -+ sctp_primitive_ABORT(net, asoc, chunk); - } else - sctp_primitive_SHUTDOWN(net, asoc, NULL); - } -diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c -index dfa532f00d88..48273d94484d 100644 ---- a/net/sctp/sysctl.c -+++ b/net/sctp/sysctl.c -@@ -310,7 +310,7 @@ static int proc_sctp_do_hmac_alg(struct ctl_table *ctl, int write, - struct ctl_table tbl; - bool changed = false; - char *none = "none"; -- char tmp[8]; -+ char tmp[8] = {0}; - int ret; - - memset(&tbl, 0, sizeof(struct ctl_table)); -diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c -index ae0d0654f8c4..0cd18c240250 100644 ---- a/net/unix/af_unix.c -+++ b/net/unix/af_unix.c -@@ -1486,6 +1486,21 @@ static void unix_destruct_scm(struct sk_buff *skb) - sock_wfree(skb); - } - -+/* -+ * The "user->unix_inflight" variable is protected by the garbage -+ * collection lock, and we just read it locklessly here. If you go -+ * over the limit, there might be a tiny race in actually noticing -+ * it across threads. Tough. -+ */ -+static inline bool too_many_unix_fds(struct task_struct *p) -+{ -+ struct user_struct *user = current_user(); -+ -+ if (unlikely(user->unix_inflight > task_rlimit(p, RLIMIT_NOFILE))) -+ return !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN); -+ return false; -+} -+ - #define MAX_RECURSION_LEVEL 4 - - static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb) -@@ -1494,6 +1509,9 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb) - unsigned char max_level = 0; - int unix_sock_count = 0; - -+ if (too_many_unix_fds(current)) -+ return -ETOOMANYREFS; -+ - for (i = scm->fp->count - 1; i >= 0; i--) { - struct sock *sk = unix_get_socket(scm->fp->fp[i]); - -@@ -1515,10 +1533,8 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb) - if (!UNIXCB(skb).fp) - return -ENOMEM; - -- if (unix_sock_count) { -- for (i = scm->fp->count - 1; i >= 0; i--) -- unix_inflight(scm->fp->fp[i]); -- } -+ for (i = scm->fp->count - 1; i >= 0; i--) -+ unix_inflight(scm->fp->fp[i]); - return max_level; - } - -diff --git a/net/unix/garbage.c b/net/unix/garbage.c -index 9bc73f87f64a..06730fe6ad9d 100644 ---- a/net/unix/garbage.c -+++ b/net/unix/garbage.c -@@ -125,9 +125,12 @@ struct sock *unix_get_socket(struct file *filp) - void unix_inflight(struct file *fp) - { - struct sock *s = unix_get_socket(fp); -+ -+ spin_lock(&unix_gc_lock); -+ - if (s) { - struct unix_sock *u = unix_sk(s); -- spin_lock(&unix_gc_lock); -+ - if (atomic_long_inc_return(&u->inflight) == 1) { - BUG_ON(!list_empty(&u->link)); - list_add_tail(&u->link, &gc_inflight_list); -@@ -135,22 +138,27 @@ void unix_inflight(struct file *fp) - BUG_ON(list_empty(&u->link)); - } - unix_tot_inflight++; -- spin_unlock(&unix_gc_lock); - } -+ fp->f_cred->user->unix_inflight++; -+ spin_unlock(&unix_gc_lock); - } - - void unix_notinflight(struct file *fp) - { - struct sock *s = unix_get_socket(fp); -+ -+ spin_lock(&unix_gc_lock); -+ - if (s) { - struct unix_sock *u = unix_sk(s); -- spin_lock(&unix_gc_lock); -+ - BUG_ON(list_empty(&u->link)); - if (atomic_long_dec_and_test(&u->inflight)) - list_del_init(&u->link); - unix_tot_inflight--; -- spin_unlock(&unix_gc_lock); - } -+ fp->f_cred->user->unix_inflight--; -+ spin_unlock(&unix_gc_lock); - } - - static void scan_inflight(struct sock *x, void (*func)(struct unix_sock *), -diff --git a/scripts/recordmcount.pl b/scripts/recordmcount.pl -index 513f7bd85cb7..eb341b76a489 100755 ---- a/scripts/recordmcount.pl -+++ b/scripts/recordmcount.pl -@@ -265,7 +265,8 @@ if ($arch eq "x86_64") { - - } elsif ($arch eq "powerpc") { - $local_regex = "^[0-9a-fA-F]+\\s+t\\s+(\\.?\\S+)"; -- $function_regex = "^([0-9a-fA-F]+)\\s+<(\\.?.*?)>:"; -+ # See comment in the sparc64 section for why we use '\w'. -+ $function_regex = "^([0-9a-fA-F]+)\\s+<(\\.?\\w*?)>:"; - $mcount_regex = "^\\s*([0-9a-fA-F]+):.*\\s\\.?_mcount\$"; - - if ($bits == 64) { -diff --git a/sound/core/control.c b/sound/core/control.c -index f2082a35b890..3fcead61f0ef 100644 ---- a/sound/core/control.c -+++ b/sound/core/control.c -@@ -1325,6 +1325,8 @@ static int snd_ctl_tlv_ioctl(struct snd_ctl_file *file, - return -EFAULT; - if (tlv.length < sizeof(unsigned int) * 2) - return -EINVAL; -+ if (!tlv.numid) -+ return -EINVAL; - down_read(&card->controls_rwsem); - kctl = snd_ctl_find_numid(card, tlv.numid); - if (kctl == NULL) { -diff --git a/sound/core/hrtimer.c b/sound/core/hrtimer.c -index b8b31c433d64..14d483d6b3b0 100644 ---- a/sound/core/hrtimer.c -+++ b/sound/core/hrtimer.c -@@ -90,7 +90,7 @@ static int snd_hrtimer_start(struct snd_timer *t) - struct snd_hrtimer *stime = t->private_data; - - atomic_set(&stime->running, 0); -- hrtimer_cancel(&stime->hrt); -+ hrtimer_try_to_cancel(&stime->hrt); - hrtimer_start(&stime->hrt, ns_to_ktime(t->sticks * resolution), - HRTIMER_MODE_REL); - atomic_set(&stime->running, 1); -@@ -101,6 +101,7 @@ static int snd_hrtimer_stop(struct snd_timer *t) - { - struct snd_hrtimer *stime = t->private_data; - atomic_set(&stime->running, 0); -+ hrtimer_try_to_cancel(&stime->hrt); - return 0; - } - -diff --git a/sound/core/pcm_compat.c b/sound/core/pcm_compat.c -index c4ac3c1e19af..1bb1a43c7d03 100644 ---- a/sound/core/pcm_compat.c -+++ b/sound/core/pcm_compat.c -@@ -236,10 +236,15 @@ static int snd_pcm_ioctl_hw_params_compat(struct snd_pcm_substream *substream, - if (! (runtime = substream->runtime)) - return -ENOTTY; - -- /* only fifo_size is different, so just copy all */ -- data = memdup_user(data32, sizeof(*data32)); -- if (IS_ERR(data)) -- return PTR_ERR(data); -+ data = kmalloc(sizeof(*data), GFP_KERNEL); -+ if (!data) -+ return -ENOMEM; -+ -+ /* only fifo_size (RO from userspace) is different, so just copy all */ -+ if (copy_from_user(data, data32, sizeof(*data32))) { -+ err = -EFAULT; -+ goto error; -+ } - - if (refine) - err = snd_pcm_hw_refine(substream, data); -diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c -index 4dc6bae80e15..ecfbf5f39d38 100644 ---- a/sound/core/seq/seq_clientmgr.c -+++ b/sound/core/seq/seq_clientmgr.c -@@ -1950,7 +1950,7 @@ static int snd_seq_ioctl_remove_events(struct snd_seq_client *client, - * No restrictions so for a user client we can clear - * the whole fifo - */ -- if (client->type == USER_CLIENT) -+ if (client->type == USER_CLIENT && client->data.user.fifo) - snd_seq_fifo_clear(client->data.user.fifo); - } - -diff --git a/sound/core/seq/seq_compat.c b/sound/core/seq/seq_compat.c -index 81f7c109dc46..65175902a68a 100644 ---- a/sound/core/seq/seq_compat.c -+++ b/sound/core/seq/seq_compat.c -@@ -49,11 +49,12 @@ static int snd_seq_call_port_info_ioctl(struct snd_seq_client *client, unsigned - struct snd_seq_port_info *data; - mm_segment_t fs; - -- data = memdup_user(data32, sizeof(*data32)); -- if (IS_ERR(data)) -- return PTR_ERR(data); -+ data = kmalloc(sizeof(*data), GFP_KERNEL); -+ if (!data) -+ return -ENOMEM; - -- if (get_user(data->flags, &data32->flags) || -+ if (copy_from_user(data, data32, sizeof(*data32)) || -+ get_user(data->flags, &data32->flags) || - get_user(data->time_queue, &data32->time_queue)) - goto error; - data->kernel = NULL; -diff --git a/sound/core/seq/seq_queue.c b/sound/core/seq/seq_queue.c -index f9077361c119..4c9aa462de9b 100644 ---- a/sound/core/seq/seq_queue.c -+++ b/sound/core/seq/seq_queue.c -@@ -144,8 +144,10 @@ static struct snd_seq_queue *queue_new(int owner, int locked) - static void queue_delete(struct snd_seq_queue *q) - { - /* stop and release the timer */ -+ mutex_lock(&q->timer_mutex); - snd_seq_timer_stop(q->timer); - snd_seq_timer_close(q); -+ mutex_unlock(&q->timer_mutex); - /* wait until access free */ - snd_use_lock_sync(&q->use_lock); - /* release resources... */ -diff --git a/sound/core/timer.c b/sound/core/timer.c -index 6ddcf06f52f9..4e436fe53afa 100644 ---- a/sound/core/timer.c -+++ b/sound/core/timer.c -@@ -73,7 +73,7 @@ struct snd_timer_user { - struct timespec tstamp; /* trigger tstamp */ - wait_queue_head_t qchange_sleep; - struct fasync_struct *fasync; -- struct mutex tread_sem; -+ struct mutex ioctl_lock; - }; - - /* list of timers */ -@@ -215,11 +215,13 @@ static void snd_timer_check_master(struct snd_timer_instance *master) - slave->slave_id == master->slave_id) { - list_move_tail(&slave->open_list, &master->slave_list_head); - spin_lock_irq(&slave_active_lock); -+ spin_lock(&master->timer->lock); - slave->master = master; - slave->timer = master->timer; - if (slave->flags & SNDRV_TIMER_IFLG_RUNNING) - list_add_tail(&slave->active_list, - &master->slave_active_head); -+ spin_unlock(&master->timer->lock); - spin_unlock_irq(&slave_active_lock); - } - } -@@ -345,15 +347,18 @@ int snd_timer_close(struct snd_timer_instance *timeri) - timer->hw.close) - timer->hw.close(timer); - /* remove slave links */ -+ spin_lock_irq(&slave_active_lock); -+ spin_lock(&timer->lock); - list_for_each_entry_safe(slave, tmp, &timeri->slave_list_head, - open_list) { -- spin_lock_irq(&slave_active_lock); -- _snd_timer_stop(slave, 1, SNDRV_TIMER_EVENT_RESOLUTION); - list_move_tail(&slave->open_list, &snd_timer_slave_list); - slave->master = NULL; - slave->timer = NULL; -- spin_unlock_irq(&slave_active_lock); -+ list_del_init(&slave->ack_list); -+ list_del_init(&slave->active_list); - } -+ spin_unlock(&timer->lock); -+ spin_unlock_irq(&slave_active_lock); - mutex_unlock(®ister_mutex); - } - out: -@@ -440,9 +445,12 @@ static int snd_timer_start_slave(struct snd_timer_instance *timeri) - - spin_lock_irqsave(&slave_active_lock, flags); - timeri->flags |= SNDRV_TIMER_IFLG_RUNNING; -- if (timeri->master) -+ if (timeri->master && timeri->timer) { -+ spin_lock(&timeri->timer->lock); - list_add_tail(&timeri->active_list, - &timeri->master->slave_active_head); -+ spin_unlock(&timeri->timer->lock); -+ } - spin_unlock_irqrestore(&slave_active_lock, flags); - return 1; /* delayed start */ - } -@@ -488,6 +496,8 @@ static int _snd_timer_stop(struct snd_timer_instance * timeri, - if (!keep_flag) { - spin_lock_irqsave(&slave_active_lock, flags); - timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING; -+ list_del_init(&timeri->ack_list); -+ list_del_init(&timeri->active_list); - spin_unlock_irqrestore(&slave_active_lock, flags); - } - goto __end; -@@ -693,7 +703,7 @@ void snd_timer_interrupt(struct snd_timer * timer, unsigned long ticks_left) - } else { - ti->flags &= ~SNDRV_TIMER_IFLG_RUNNING; - if (--timer->running) -- list_del(&ti->active_list); -+ list_del_init(&ti->active_list); - } - if ((timer->hw.flags & SNDRV_TIMER_HW_TASKLET) || - (ti->flags & SNDRV_TIMER_IFLG_FAST)) -@@ -1256,7 +1266,7 @@ static int snd_timer_user_open(struct inode *inode, struct file *file) - return -ENOMEM; - spin_lock_init(&tu->qlock); - init_waitqueue_head(&tu->qchange_sleep); -- mutex_init(&tu->tread_sem); -+ mutex_init(&tu->ioctl_lock); - tu->ticks = 1; - tu->queue_size = 128; - tu->queue = kmalloc(tu->queue_size * sizeof(struct snd_timer_read), -@@ -1276,8 +1286,10 @@ static int snd_timer_user_release(struct inode *inode, struct file *file) - if (file->private_data) { - tu = file->private_data; - file->private_data = NULL; -+ mutex_lock(&tu->ioctl_lock); - if (tu->timeri) - snd_timer_close(tu->timeri); -+ mutex_unlock(&tu->ioctl_lock); - kfree(tu->queue); - kfree(tu->tqueue); - kfree(tu); -@@ -1515,7 +1527,6 @@ static int snd_timer_user_tselect(struct file *file, - int err = 0; - - tu = file->private_data; -- mutex_lock(&tu->tread_sem); - if (tu->timeri) { - snd_timer_close(tu->timeri); - tu->timeri = NULL; -@@ -1559,7 +1570,6 @@ static int snd_timer_user_tselect(struct file *file, - } - - __err: -- mutex_unlock(&tu->tread_sem); - return err; - } - -@@ -1772,7 +1782,7 @@ enum { - SNDRV_TIMER_IOCTL_PAUSE_OLD = _IO('T', 0x23), - }; - --static long snd_timer_user_ioctl(struct file *file, unsigned int cmd, -+static long __snd_timer_user_ioctl(struct file *file, unsigned int cmd, - unsigned long arg) - { - struct snd_timer_user *tu; -@@ -1789,17 +1799,11 @@ static long snd_timer_user_ioctl(struct file *file, unsigned int cmd, - { - int xarg; - -- mutex_lock(&tu->tread_sem); -- if (tu->timeri) { /* too late */ -- mutex_unlock(&tu->tread_sem); -+ if (tu->timeri) /* too late */ - return -EBUSY; -- } -- if (get_user(xarg, p)) { -- mutex_unlock(&tu->tread_sem); -+ if (get_user(xarg, p)) - return -EFAULT; -- } - tu->tread = xarg ? 1 : 0; -- mutex_unlock(&tu->tread_sem); - return 0; - } - case SNDRV_TIMER_IOCTL_GINFO: -@@ -1832,6 +1836,18 @@ static long snd_timer_user_ioctl(struct file *file, unsigned int cmd, - return -ENOTTY; - } - -+static long snd_timer_user_ioctl(struct file *file, unsigned int cmd, -+ unsigned long arg) -+{ -+ struct snd_timer_user *tu = file->private_data; -+ long ret; -+ -+ mutex_lock(&tu->ioctl_lock); -+ ret = __snd_timer_user_ioctl(file, cmd, arg); -+ mutex_unlock(&tu->ioctl_lock); -+ return ret; -+} -+ - static int snd_timer_user_fasync(int fd, struct file * file, int on) - { - struct snd_timer_user *tu; -diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c -index 84e8879cc372..305fb6174af0 100644 ---- a/sound/pci/hda/hda_intel.c -+++ b/sound/pci/hda/hda_intel.c -@@ -1124,6 +1124,36 @@ static unsigned int azx_get_response(struct hda_bus *bus, - return azx_rirb_get_response(bus, addr); - } - -+#ifdef CONFIG_PM_SLEEP -+/* put codec down to D3 at hibernation for Intel SKL+; -+ * otherwise BIOS may still access the codec and screw up the driver -+ */ -+#define IS_SKL(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0xa170) -+#define IS_SKL_LP(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x9d70) -+#define IS_BXT(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x5a98) -+#define IS_SKL_PLUS(pci) (IS_SKL(pci) || IS_SKL_LP(pci) || IS_BXT(pci)) -+ -+static int azx_freeze_noirq(struct device *dev) -+{ -+ struct pci_dev *pci = to_pci_dev(dev); -+ -+ if (IS_SKL_PLUS(pci)) -+ pci_set_power_state(pci, PCI_D3hot); -+ -+ return 0; -+} -+ -+static int azx_thaw_noirq(struct device *dev) -+{ -+ struct pci_dev *pci = to_pci_dev(dev); -+ -+ if (IS_SKL_PLUS(pci)) -+ pci_set_power_state(pci, PCI_D0); -+ -+ return 0; -+} -+#endif /* CONFIG_PM_SLEEP */ -+ - #ifdef CONFIG_PM - static void azx_power_notify(struct hda_bus *bus, bool power_up); - #endif -@@ -3072,6 +3102,10 @@ static int azx_runtime_idle(struct device *dev) - #ifdef CONFIG_PM - static const struct dev_pm_ops azx_pm = { - SET_SYSTEM_SLEEP_PM_OPS(azx_suspend, azx_resume) -+#ifdef CONFIG_PM_SLEEP -+ .freeze_noirq = azx_freeze_noirq, -+ .thaw_noirq = azx_thaw_noirq, -+#endif - SET_RUNTIME_PM_OPS(azx_runtime_suspend, azx_runtime_resume, azx_runtime_idle) - }; - -@@ -3996,6 +4030,11 @@ static DEFINE_PCI_DEVICE_TABLE(azx_ids) = { - .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH }, - { PCI_DEVICE(0x8086, 0x8d21), - .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH }, -+ /* Lewisburg */ -+ { PCI_DEVICE(0x8086, 0xa1f0), -+ .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH }, -+ { PCI_DEVICE(0x8086, 0xa270), -+ .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH }, - /* Lynx Point-LP */ - { PCI_DEVICE(0x8086, 0x9c20), - .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH }, -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 08e29311e17d..bd0b986f7d50 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -1825,6 +1825,7 @@ enum { - ALC889_FIXUP_MBA11_VREF, - ALC889_FIXUP_MBA21_VREF, - ALC889_FIXUP_MP11_VREF, -+ ALC889_FIXUP_MP41_VREF, - ALC882_FIXUP_INV_DMIC, - ALC882_FIXUP_NO_PRIMARY_HP, - ALC887_FIXUP_ASUS_BASS, -@@ -1912,7 +1913,7 @@ static void alc889_fixup_mbp_vref(struct hda_codec *codec, - const struct hda_fixup *fix, int action) - { - struct alc_spec *spec = codec->spec; -- static hda_nid_t nids[2] = { 0x14, 0x15 }; -+ static hda_nid_t nids[3] = { 0x14, 0x15, 0x19 }; - int i; - - if (action != HDA_FIXUP_ACT_INIT) -@@ -2200,6 +2201,12 @@ static const struct hda_fixup alc882_fixups[] = { - .chained = true, - .chain_id = ALC885_FIXUP_MACPRO_GPIO, - }, -+ [ALC889_FIXUP_MP41_VREF] = { -+ .type = HDA_FIXUP_FUNC, -+ .v.func = alc889_fixup_mbp_vref, -+ .chained = true, -+ .chain_id = ALC885_FIXUP_MACPRO_GPIO, -+ }, - [ALC882_FIXUP_INV_DMIC] = { - .type = HDA_FIXUP_FUNC, - .v.func = alc_fixup_inv_dmic_0x12, -@@ -2278,7 +2285,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = { - SND_PCI_QUIRK(0x106b, 0x3f00, "Macbook 5,1", ALC889_FIXUP_IMAC91_VREF), - SND_PCI_QUIRK(0x106b, 0x4000, "MacbookPro 5,1", ALC889_FIXUP_IMAC91_VREF), - SND_PCI_QUIRK(0x106b, 0x4100, "Macmini 3,1", ALC889_FIXUP_IMAC91_VREF), -- SND_PCI_QUIRK(0x106b, 0x4200, "Mac Pro 5,1", ALC885_FIXUP_MACPRO_GPIO), -+ SND_PCI_QUIRK(0x106b, 0x4200, "Mac Pro 4,1/5,1", ALC889_FIXUP_MP41_VREF), - SND_PCI_QUIRK(0x106b, 0x4300, "iMac 9,1", ALC889_FIXUP_IMAC91_VREF), - SND_PCI_QUIRK(0x106b, 0x4600, "MacbookPro 5,2", ALC889_FIXUP_IMAC91_VREF), - SND_PCI_QUIRK(0x106b, 0x4900, "iMac 9,1 Aluminum", ALC889_FIXUP_IMAC91_VREF), -@@ -5337,6 +5344,7 @@ static const struct hda_fixup alc662_fixups[] = { - static const struct snd_pci_quirk alc662_fixup_tbl[] = { - SND_PCI_QUIRK(0x1019, 0x9087, "ECS", ALC662_FIXUP_ASUS_MODE2), - SND_PCI_QUIRK(0x1025, 0x022f, "Acer Aspire One", ALC662_FIXUP_INV_DMIC), -+ SND_PCI_QUIRK(0x1025, 0x0241, "Packard Bell DOTS", ALC662_FIXUP_INV_DMIC), - SND_PCI_QUIRK(0x1025, 0x0308, "Acer Aspire 8942G", ALC662_FIXUP_ASPIRE), - SND_PCI_QUIRK(0x1025, 0x031c, "Gateway NV79", ALC662_FIXUP_SKU_IGNORE), - SND_PCI_QUIRK(0x1025, 0x0349, "eMachines eM250", ALC662_FIXUP_INV_DMIC), -diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c -index 231b26471a63..9326e586559b 100644 ---- a/sound/pci/hda/patch_sigmatel.c -+++ b/sound/pci/hda/patch_sigmatel.c -@@ -723,6 +723,7 @@ static bool hp_bnb2011_with_dock(struct hda_codec *codec) - static bool hp_blike_system(u32 subsystem_id) - { - switch (subsystem_id) { -+ case 0x103c1473: /* HP ProBook 6550b */ - case 0x103c1520: - case 0x103c1521: - case 0x103c1523: -diff --git a/sound/pci/rme96.c b/sound/pci/rme96.c -index 0236363c301f..8dcc834222c4 100644 ---- a/sound/pci/rme96.c -+++ b/sound/pci/rme96.c -@@ -742,10 +742,11 @@ snd_rme96_playback_setrate(struct rme96 *rme96, - { - /* change to/from double-speed: reset the DAC (if available) */ - snd_rme96_reset_dac(rme96); -+ return 1; /* need to restore volume */ - } else { - writel(rme96->wcreg, rme96->iobase + RME96_IO_CONTROL_REGISTER); -+ return 0; - } -- return 0; - } - - static int -@@ -983,6 +984,7 @@ snd_rme96_playback_hw_params(struct snd_pcm_substream *substream, - struct rme96 *rme96 = snd_pcm_substream_chip(substream); - struct snd_pcm_runtime *runtime = substream->runtime; - int err, rate, dummy; -+ bool apply_dac_volume = false; - - runtime->dma_area = (void __force *)(rme96->iobase + - RME96_IO_PLAY_BUFFER); -@@ -996,24 +998,26 @@ snd_rme96_playback_hw_params(struct snd_pcm_substream *substream, - { - /* slave clock */ - if ((int)params_rate(params) != rate) { -- spin_unlock_irq(&rme96->lock); -- return -EIO; -- } -- } else if ((err = snd_rme96_playback_setrate(rme96, params_rate(params))) < 0) { -- spin_unlock_irq(&rme96->lock); -- return err; -- } -- if ((err = snd_rme96_playback_setformat(rme96, params_format(params))) < 0) { -- spin_unlock_irq(&rme96->lock); -- return err; -+ err = -EIO; -+ goto error; -+ } -+ } else { -+ err = snd_rme96_playback_setrate(rme96, params_rate(params)); -+ if (err < 0) -+ goto error; -+ apply_dac_volume = err > 0; /* need to restore volume later? */ - } -+ -+ err = snd_rme96_playback_setformat(rme96, params_format(params)); -+ if (err < 0) -+ goto error; - snd_rme96_setframelog(rme96, params_channels(params), 1); - if (rme96->capture_periodsize != 0) { - if (params_period_size(params) << rme96->playback_frlog != - rme96->capture_periodsize) - { -- spin_unlock_irq(&rme96->lock); -- return -EBUSY; -+ err = -EBUSY; -+ goto error; - } - } - rme96->playback_periodsize = -@@ -1024,9 +1028,16 @@ snd_rme96_playback_hw_params(struct snd_pcm_substream *substream, - rme96->wcreg &= ~(RME96_WCR_PRO | RME96_WCR_DOLBY | RME96_WCR_EMP); - writel(rme96->wcreg |= rme96->wcreg_spdif_stream, rme96->iobase + RME96_IO_CONTROL_REGISTER); - } -+ -+ err = 0; -+ error: - spin_unlock_irq(&rme96->lock); -- -- return 0; -+ if (apply_dac_volume) { -+ usleep_range(3000, 10000); -+ snd_rme96_apply_dac_volume(rme96); -+ } -+ -+ return err; - } - - static int -diff --git a/sound/soc/codecs/arizona.c b/sound/soc/codecs/arizona.c -index e4295fee8f13..20aa99125607 100644 ---- a/sound/soc/codecs/arizona.c -+++ b/sound/soc/codecs/arizona.c -@@ -1171,7 +1171,7 @@ static int arizona_hw_params(struct snd_pcm_substream *substream, - int chan_limit = arizona->pdata.max_channels_clocked[dai->id - 1]; - int bclk, lrclk, wl, frame, bclk_target; - -- if (params_rate(params) % 8000) -+ if (params_rate(params) % 4000) - rates = &arizona_44k1_bclk_rates[0]; - else - rates = &arizona_48k_bclk_rates[0]; -diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c -index 799348e9cdd0..c8c8f6d1e882 100644 ---- a/sound/soc/codecs/wm8962.c -+++ b/sound/soc/codecs/wm8962.c -@@ -364,8 +364,8 @@ static struct reg_default wm8962_reg[] = { - { 16924, 0x0059 }, /* R16924 - HDBASS_PG_1 */ - { 16925, 0x999A }, /* R16925 - HDBASS_PG_0 */ - -- { 17048, 0x0083 }, /* R17408 - HPF_C_1 */ -- { 17049, 0x98AD }, /* R17409 - HPF_C_0 */ -+ { 17408, 0x0083 }, /* R17408 - HPF_C_1 */ -+ { 17409, 0x98AD }, /* R17409 - HPF_C_0 */ - - { 17920, 0x007F }, /* R17920 - ADCL_RETUNE_C1_1 */ - { 17921, 0xFFFF }, /* R17921 - ADCL_RETUNE_C1_0 */ -diff --git a/sound/soc/codecs/wm8974.c b/sound/soc/codecs/wm8974.c -index 15f45c7bd833..31bd73066790 100644 ---- a/sound/soc/codecs/wm8974.c -+++ b/sound/soc/codecs/wm8974.c -@@ -587,6 +587,7 @@ static const struct regmap_config wm8974_regmap = { - .max_register = WM8974_MONOMIX, - .reg_defaults = wm8974_reg_defaults, - .num_reg_defaults = ARRAY_SIZE(wm8974_reg_defaults), -+ .cache_type = REGCACHE_FLAT, - }; - - static int wm8974_probe(struct snd_soc_codec *codec) -diff --git a/sound/soc/soc-compress.c b/sound/soc/soc-compress.c -index 4f98ff14cf12..e5601f9a7bd7 100644 ---- a/sound/soc/soc-compress.c -+++ b/sound/soc/soc-compress.c -@@ -665,17 +665,34 @@ int soc_new_compress(struct snd_soc_pcm_runtime *rtd, int num) - struct snd_pcm *be_pcm; - char new_name[64]; - int ret = 0, direction = 0; -+ int playback = 0, capture = 0; - - /* check client and interface hw capabilities */ - snprintf(new_name, sizeof(new_name), "%s %s-%d", - rtd->dai_link->stream_name, codec_dai->name, num); - - if (codec_dai->driver->playback.channels_min) -+ playback = 1; -+ if (codec_dai->driver->capture.channels_min) -+ capture = 1; -+ -+ capture = capture && cpu_dai->driver->capture.channels_min; -+ playback = playback && cpu_dai->driver->playback.channels_min; -+ -+ /* -+ * Compress devices are unidirectional so only one of the directions -+ * should be set, check for that (xor) -+ */ -+ if (playback + capture != 1) { -+ dev_err(rtd->card->dev, "Invalid direction for compress P %d, C %d\n", -+ playback, capture); -+ return -EINVAL; -+ } -+ -+ if(playback) - direction = SND_COMPRESS_PLAYBACK; -- else if (codec_dai->driver->capture.channels_min) -- direction = SND_COMPRESS_CAPTURE; - else -- return -EINVAL; -+ direction = SND_COMPRESS_CAPTURE; - - compr = kzalloc(sizeof(*compr), GFP_KERNEL); - if (compr == NULL) { diff --git a/patch/kernel/odroidc2-default/patch-3.14.60-61.patch b/patch/kernel/odroidc2-default/patch-3.14.60-61.patch deleted file mode 100644 index 9b42d08069..0000000000 --- a/patch/kernel/odroidc2-default/patch-3.14.60-61.patch +++ /dev/null @@ -1,2765 +0,0 @@ -diff --git a/Makefile b/Makefile -index 502255cebc9a..fbf4ec689957 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 3 - PATCHLEVEL = 14 --SUBLEVEL = 60 -+SUBLEVEL = 61 - EXTRAVERSION = - NAME = Remembering Coco - -diff --git a/arch/parisc/include/uapi/asm/mman.h b/arch/parisc/include/uapi/asm/mman.h -index 294d251ca7b2..2ae13ce592e8 100644 ---- a/arch/parisc/include/uapi/asm/mman.h -+++ b/arch/parisc/include/uapi/asm/mman.h -@@ -46,16 +46,6 @@ - #define MADV_DONTFORK 10 /* don't inherit across fork */ - #define MADV_DOFORK 11 /* do inherit across fork */ - --/* The range 12-64 is reserved for page size specification. */ --#define MADV_4K_PAGES 12 /* Use 4K pages */ --#define MADV_16K_PAGES 14 /* Use 16K pages */ --#define MADV_64K_PAGES 16 /* Use 64K pages */ --#define MADV_256K_PAGES 18 /* Use 256K pages */ --#define MADV_1M_PAGES 20 /* Use 1 Megabyte pages */ --#define MADV_4M_PAGES 22 /* Use 4 Megabyte pages */ --#define MADV_16M_PAGES 24 /* Use 16 Megabyte pages */ --#define MADV_64M_PAGES 26 /* Use 64 Megabyte pages */ -- - #define MADV_MERGEABLE 65 /* KSM may merge identical pages */ - #define MADV_UNMERGEABLE 66 /* KSM may not merge identical pages */ - -diff --git a/arch/parisc/include/uapi/asm/siginfo.h b/arch/parisc/include/uapi/asm/siginfo.h -index d7034728f377..1c75565d984b 100644 ---- a/arch/parisc/include/uapi/asm/siginfo.h -+++ b/arch/parisc/include/uapi/asm/siginfo.h -@@ -1,6 +1,10 @@ - #ifndef _PARISC_SIGINFO_H - #define _PARISC_SIGINFO_H - -+#if defined(__LP64__) -+#define __ARCH_SI_PREAMBLE_SIZE (4 * sizeof(int)) -+#endif -+ - #include - - #undef NSIGTRAP -diff --git a/arch/parisc/kernel/signal.c b/arch/parisc/kernel/signal.c -index 1cba8f29bb49..78bb6dd88e03 100644 ---- a/arch/parisc/kernel/signal.c -+++ b/arch/parisc/kernel/signal.c -@@ -442,6 +442,55 @@ handle_signal(unsigned long sig, siginfo_t *info, struct k_sigaction *ka, - regs->gr[28]); - } - -+/* -+ * Check how the syscall number gets loaded into %r20 within -+ * the delay branch in userspace and adjust as needed. -+ */ -+ -+static void check_syscallno_in_delay_branch(struct pt_regs *regs) -+{ -+ u32 opcode, source_reg; -+ u32 __user *uaddr; -+ int err; -+ -+ /* Usually we don't have to restore %r20 (the system call number) -+ * because it gets loaded in the delay slot of the branch external -+ * instruction via the ldi instruction. -+ * In some cases a register-to-register copy instruction might have -+ * been used instead, in which case we need to copy the syscall -+ * number into the source register before returning to userspace. -+ */ -+ -+ /* A syscall is just a branch, so all we have to do is fiddle the -+ * return pointer so that the ble instruction gets executed again. -+ */ -+ regs->gr[31] -= 8; /* delayed branching */ -+ -+ /* Get assembler opcode of code in delay branch */ -+ uaddr = (unsigned int *) ((regs->gr[31] & ~3) + 4); -+ err = get_user(opcode, uaddr); -+ if (err) -+ return; -+ -+ /* Check if delay branch uses "ldi int,%r20" */ -+ if ((opcode & 0xffff0000) == 0x34140000) -+ return; /* everything ok, just return */ -+ -+ /* Check if delay branch uses "nop" */ -+ if (opcode == INSN_NOP) -+ return; -+ -+ /* Check if delay branch uses "copy %rX,%r20" */ -+ if ((opcode & 0xffe0ffff) == 0x08000254) { -+ source_reg = (opcode >> 16) & 31; -+ regs->gr[source_reg] = regs->gr[20]; -+ return; -+ } -+ -+ pr_warn("syscall restart: %s (pid %d): unexpected opcode 0x%08x\n", -+ current->comm, task_pid_nr(current), opcode); -+} -+ - static inline void - syscall_restart(struct pt_regs *regs, struct k_sigaction *ka) - { -@@ -464,10 +513,7 @@ syscall_restart(struct pt_regs *regs, struct k_sigaction *ka) - } - /* fallthrough */ - case -ERESTARTNOINTR: -- /* A syscall is just a branch, so all -- * we have to do is fiddle the return pointer. -- */ -- regs->gr[31] -= 8; /* delayed branching */ -+ check_syscallno_in_delay_branch(regs); - break; - } - } -@@ -516,15 +562,9 @@ insert_restart_trampoline(struct pt_regs *regs) - } - case -ERESTARTNOHAND: - case -ERESTARTSYS: -- case -ERESTARTNOINTR: { -- /* Hooray for delayed branching. We don't -- * have to restore %r20 (the system call -- * number) because it gets loaded in the delay -- * slot of the branch external instruction. -- */ -- regs->gr[31] -= 8; -+ case -ERESTARTNOINTR: -+ check_syscallno_in_delay_branch(regs); - return; -- } - default: - break; - } -diff --git a/arch/sh/include/uapi/asm/unistd_64.h b/arch/sh/include/uapi/asm/unistd_64.h -index e6820c86e8c7..47ebd5b5ed55 100644 ---- a/arch/sh/include/uapi/asm/unistd_64.h -+++ b/arch/sh/include/uapi/asm/unistd_64.h -@@ -278,7 +278,7 @@ - #define __NR_fsetxattr 256 - #define __NR_getxattr 257 - #define __NR_lgetxattr 258 --#define __NR_fgetxattr 269 -+#define __NR_fgetxattr 259 - #define __NR_listxattr 260 - #define __NR_llistxattr 261 - #define __NR_flistxattr 262 -diff --git a/crypto/af_alg.c b/crypto/af_alg.c -index 1de4beeb25f8..1971f3ccb09a 100644 ---- a/crypto/af_alg.c -+++ b/crypto/af_alg.c -@@ -125,6 +125,23 @@ int af_alg_release(struct socket *sock) - } - EXPORT_SYMBOL_GPL(af_alg_release); - -+void af_alg_release_parent(struct sock *sk) -+{ -+ struct alg_sock *ask = alg_sk(sk); -+ bool last; -+ -+ sk = ask->parent; -+ ask = alg_sk(sk); -+ -+ lock_sock(sk); -+ last = !--ask->refcnt; -+ release_sock(sk); -+ -+ if (last) -+ sock_put(sk); -+} -+EXPORT_SYMBOL_GPL(af_alg_release_parent); -+ - static int alg_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) - { - struct sock *sk = sock->sk; -@@ -132,6 +149,7 @@ static int alg_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) - struct sockaddr_alg *sa = (void *)uaddr; - const struct af_alg_type *type; - void *private; -+ int err; - - if (sock->state == SS_CONNECTED) - return -EINVAL; -@@ -157,16 +175,22 @@ static int alg_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) - return PTR_ERR(private); - } - -+ err = -EBUSY; - lock_sock(sk); -+ if (ask->refcnt) -+ goto unlock; - - swap(ask->type, type); - swap(ask->private, private); - -+ err = 0; -+ -+unlock: - release_sock(sk); - - alg_do_release(type, private); - -- return 0; -+ return err; - } - - static int alg_setkey(struct sock *sk, char __user *ukey, -@@ -199,11 +223,15 @@ static int alg_setsockopt(struct socket *sock, int level, int optname, - struct sock *sk = sock->sk; - struct alg_sock *ask = alg_sk(sk); - const struct af_alg_type *type; -- int err = -ENOPROTOOPT; -+ int err = -EBUSY; - - lock_sock(sk); -+ if (ask->refcnt) -+ goto unlock; -+ - type = ask->type; - -+ err = -ENOPROTOOPT; - if (level != SOL_ALG || !type) - goto unlock; - -@@ -247,14 +275,13 @@ int af_alg_accept(struct sock *sk, struct socket *newsock) - security_sk_clone(sk, sk2); - - err = type->accept(ask->private, sk2); -- if (err) { -- sk_free(sk2); -+ if (err) - goto unlock; -- } - - sk2->sk_family = PF_ALG; - -- sock_hold(sk); -+ if (!ask->refcnt++) -+ sock_hold(sk); - alg_sk(sk2)->parent = sk; - alg_sk(sk2)->type = type; - -diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c -index 850246206b12..c542c0d88afd 100644 ---- a/crypto/algif_hash.c -+++ b/crypto/algif_hash.c -@@ -51,7 +51,8 @@ static int hash_sendmsg(struct kiocb *unused, struct socket *sock, - - lock_sock(sk); - if (!ctx->more) { -- err = crypto_ahash_init(&ctx->req); -+ err = af_alg_wait_for_completion(crypto_ahash_init(&ctx->req), -+ &ctx->completion); - if (err) - goto unlock; - } -@@ -131,6 +132,7 @@ static ssize_t hash_sendpage(struct socket *sock, struct page *page, - } else { - if (!ctx->more) { - err = crypto_ahash_init(&ctx->req); -+ err = af_alg_wait_for_completion(err, &ctx->completion); - if (err) - goto unlock; - } -@@ -192,9 +194,14 @@ static int hash_accept(struct socket *sock, struct socket *newsock, int flags) - struct sock *sk2; - struct alg_sock *ask2; - struct hash_ctx *ctx2; -+ bool more; - int err; - -- err = crypto_ahash_export(req, state); -+ lock_sock(sk); -+ more = ctx->more; -+ err = more ? crypto_ahash_export(req, state) : 0; -+ release_sock(sk); -+ - if (err) - return err; - -@@ -205,7 +212,10 @@ static int hash_accept(struct socket *sock, struct socket *newsock, int flags) - sk2 = newsock->sk; - ask2 = alg_sk(sk2); - ctx2 = ask2->private; -- ctx2->more = 1; -+ ctx2->more = more; -+ -+ if (!more) -+ return err; - - err = crypto_ahash_import(&ctx2->req, state); - if (err) { -diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c -index c7666f401381..a3dfc0d83107 100644 ---- a/crypto/crypto_user.c -+++ b/crypto/crypto_user.c -@@ -477,6 +477,7 @@ static int crypto_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh) - if (link->dump == NULL) - return -EINVAL; - -+ down_read(&crypto_alg_sem); - list_for_each_entry(alg, &crypto_alg_list, cra_list) - dump_alloc += CRYPTO_REPORT_MAXSIZE; - -@@ -486,8 +487,11 @@ static int crypto_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh) - .done = link->done, - .min_dump_alloc = dump_alloc, - }; -- return netlink_dump_start(crypto_nlsk, skb, nlh, &c); -+ err = netlink_dump_start(crypto_nlsk, skb, nlh, &c); - } -+ up_read(&crypto_alg_sem); -+ -+ return err; - } - - err = nlmsg_parse(nlh, crypto_msg_min[type], attrs, CRYPTOCFGA_MAX, -diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c -index cc5f102bebf3..111614b48f96 100644 ---- a/drivers/ata/ahci.c -+++ b/drivers/ata/ahci.c -@@ -249,6 +249,26 @@ static const struct pci_device_id ahci_pci_tbl[] = { - { PCI_VDEVICE(INTEL, 0x3b2b), board_ahci }, /* PCH RAID */ - { PCI_VDEVICE(INTEL, 0x3b2c), board_ahci }, /* PCH RAID */ - { PCI_VDEVICE(INTEL, 0x3b2f), board_ahci }, /* PCH AHCI */ -+ { PCI_VDEVICE(INTEL, 0x19b0), board_ahci }, /* DNV AHCI */ -+ { PCI_VDEVICE(INTEL, 0x19b1), board_ahci }, /* DNV AHCI */ -+ { PCI_VDEVICE(INTEL, 0x19b2), board_ahci }, /* DNV AHCI */ -+ { PCI_VDEVICE(INTEL, 0x19b3), board_ahci }, /* DNV AHCI */ -+ { PCI_VDEVICE(INTEL, 0x19b4), board_ahci }, /* DNV AHCI */ -+ { PCI_VDEVICE(INTEL, 0x19b5), board_ahci }, /* DNV AHCI */ -+ { PCI_VDEVICE(INTEL, 0x19b6), board_ahci }, /* DNV AHCI */ -+ { PCI_VDEVICE(INTEL, 0x19b7), board_ahci }, /* DNV AHCI */ -+ { PCI_VDEVICE(INTEL, 0x19bE), board_ahci }, /* DNV AHCI */ -+ { PCI_VDEVICE(INTEL, 0x19bF), board_ahci }, /* DNV AHCI */ -+ { PCI_VDEVICE(INTEL, 0x19c0), board_ahci }, /* DNV AHCI */ -+ { PCI_VDEVICE(INTEL, 0x19c1), board_ahci }, /* DNV AHCI */ -+ { PCI_VDEVICE(INTEL, 0x19c2), board_ahci }, /* DNV AHCI */ -+ { PCI_VDEVICE(INTEL, 0x19c3), board_ahci }, /* DNV AHCI */ -+ { PCI_VDEVICE(INTEL, 0x19c4), board_ahci }, /* DNV AHCI */ -+ { PCI_VDEVICE(INTEL, 0x19c5), board_ahci }, /* DNV AHCI */ -+ { PCI_VDEVICE(INTEL, 0x19c6), board_ahci }, /* DNV AHCI */ -+ { PCI_VDEVICE(INTEL, 0x19c7), board_ahci }, /* DNV AHCI */ -+ { PCI_VDEVICE(INTEL, 0x19cE), board_ahci }, /* DNV AHCI */ -+ { PCI_VDEVICE(INTEL, 0x19cF), board_ahci }, /* DNV AHCI */ - { PCI_VDEVICE(INTEL, 0x1c02), board_ahci }, /* CPT AHCI */ - { PCI_VDEVICE(INTEL, 0x1c03), board_ahci }, /* CPT AHCI */ - { PCI_VDEVICE(INTEL, 0x1c04), board_ahci }, /* CPT RAID */ -diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c -index b65d79cd43d5..8b24a7bb573b 100644 ---- a/drivers/ata/libahci.c -+++ b/drivers/ata/libahci.c -@@ -487,8 +487,8 @@ void ahci_save_initial_config(struct device *dev, - } - } - -- /* fabricate port_map from cap.nr_ports */ -- if (!port_map) { -+ /* fabricate port_map from cap.nr_ports for < AHCI 1.3 */ -+ if (!port_map && vers < 0x10300) { - port_map = (1 << ahci_nr_ports(cap)) - 1; - dev_warn(dev, "forcing PORTS_IMPL to 0x%x\n", port_map); - -@@ -1253,6 +1253,15 @@ static int ahci_exec_polled_cmd(struct ata_port *ap, int pmp, - ata_tf_to_fis(tf, pmp, is_cmd, fis); - ahci_fill_cmd_slot(pp, 0, cmd_fis_len | flags | (pmp << 12)); - -+ /* set port value for softreset of Port Multiplier */ -+ if (pp->fbs_enabled && pp->fbs_last_dev != pmp) { -+ tmp = readl(port_mmio + PORT_FBS); -+ tmp &= ~(PORT_FBS_DEV_MASK | PORT_FBS_DEC); -+ tmp |= pmp << PORT_FBS_DEV_OFFSET; -+ writel(tmp, port_mmio + PORT_FBS); -+ pp->fbs_last_dev = pmp; -+ } -+ - /* issue & wait */ - writel(1, port_mmio + PORT_CMD_ISSUE); - -diff --git a/drivers/base/memory.c b/drivers/base/memory.c -index bece691cb5d9..3e2a3059b1f8 100644 ---- a/drivers/base/memory.c -+++ b/drivers/base/memory.c -@@ -311,6 +311,10 @@ static int memory_subsys_offline(struct device *dev) - if (mem->state == MEM_OFFLINE) - return 0; - -+ /* Can't offline block with non-present sections */ -+ if (mem->section_count != sections_per_block) -+ return -EINVAL; -+ - return memory_block_change_state(mem, MEM_OFFLINE, MEM_ONLINE); - } - -diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c -index 643bba7d6f81..9eab751efeea 100644 ---- a/drivers/char/tpm/tpm_ibmvtpm.c -+++ b/drivers/char/tpm/tpm_ibmvtpm.c -@@ -490,7 +490,7 @@ static void ibmvtpm_crq_process(struct ibmvtpm_crq *crq, - } - ibmvtpm->rtce_size = be16_to_cpu(crq->len); - ibmvtpm->rtce_buf = kmalloc(ibmvtpm->rtce_size, -- GFP_KERNEL); -+ GFP_ATOMIC); - if (!ibmvtpm->rtce_buf) { - dev_err(ibmvtpm->dev, "Failed to allocate memory for rtce buffer\n"); - return; -diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c -index deabd2c8772d..ced6d61c1787 100644 ---- a/drivers/hid/usbhid/hid-core.c -+++ b/drivers/hid/usbhid/hid-core.c -@@ -492,8 +492,6 @@ static void hid_ctrl(struct urb *urb) - struct usbhid_device *usbhid = hid->driver_data; - int unplug = 0, status = urb->status; - -- spin_lock(&usbhid->lock); -- - switch (status) { - case 0: /* success */ - if (usbhid->ctrl[usbhid->ctrltail].dir == USB_DIR_IN) -@@ -513,6 +511,8 @@ static void hid_ctrl(struct urb *urb) - hid_warn(urb->dev, "ctrl urb status %d received\n", status); - } - -+ spin_lock(&usbhid->lock); -+ - if (unplug) { - usbhid->ctrltail = usbhid->ctrlhead; - } else { -diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c -index 422a9fdeb53e..6eb9dc9ef8f3 100644 ---- a/drivers/md/dm-mpath.c -+++ b/drivers/md/dm-mpath.c -@@ -1626,11 +1626,8 @@ static int multipath_ioctl(struct dm_target *ti, unsigned int cmd, - /* - * Only pass ioctls through if the device sizes match exactly. - */ -- if (!bdev || ti->len != i_size_read(bdev->bd_inode) >> SECTOR_SHIFT) { -- int err = scsi_verify_blk_ioctl(NULL, cmd); -- if (err) -- r = err; -- } -+ if (!r && ti->len != i_size_read(bdev->bd_inode) >> SECTOR_SHIFT) -+ r = scsi_verify_blk_ioctl(NULL, cmd); - - if (r == -ENOTCONN && !fatal_signal_pending(current)) - queue_work(kmultipathd, &m->process_queued_ios); -diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c -index d6e47033b5e0..7ba85e2b146b 100644 ---- a/drivers/md/persistent-data/dm-btree.c -+++ b/drivers/md/persistent-data/dm-btree.c -@@ -471,8 +471,10 @@ static int btree_split_sibling(struct shadow_spine *s, dm_block_t root, - - r = insert_at(sizeof(__le64), pn, parent_index + 1, - le64_to_cpu(rn->keys[0]), &location); -- if (r) -+ if (r) { -+ unlock_block(s->info, right); - return r; -+ } - - if (key < le64_to_cpu(rn->keys[0])) { - unlock_block(s->info, right); -diff --git a/drivers/media/pci/saa7134/saa7134-alsa.c b/drivers/media/pci/saa7134/saa7134-alsa.c -index dd67c8a400cc..6bac4a53da1d 100644 ---- a/drivers/media/pci/saa7134/saa7134-alsa.c -+++ b/drivers/media/pci/saa7134/saa7134-alsa.c -@@ -1145,6 +1145,8 @@ static int alsa_device_init(struct saa7134_dev *dev) - - static int alsa_device_exit(struct saa7134_dev *dev) - { -+ if (!snd_saa7134_cards[dev->nr]) -+ return 1; - - snd_card_free(snd_saa7134_cards[dev->nr]); - snd_saa7134_cards[dev->nr] = NULL; -@@ -1194,7 +1196,8 @@ static void saa7134_alsa_exit(void) - int idx; - - for (idx = 0; idx < SNDRV_CARDS; idx++) { -- snd_card_free(snd_saa7134_cards[idx]); -+ if (snd_saa7134_cards[idx]) -+ snd_card_free(snd_saa7134_cards[idx]); - } - - saa7134_dmasound_init = NULL; -diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c -index fca336b65351..2bece37d0228 100644 ---- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c -+++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c -@@ -264,7 +264,7 @@ static int put_v4l2_create32(struct v4l2_create_buffers *kp, struct v4l2_create_ - - struct v4l2_standard32 { - __u32 index; -- __u32 id[2]; /* __u64 would get the alignment wrong */ -+ compat_u64 id; - __u8 name[24]; - struct v4l2_fract frameperiod; /* Frames, not fields */ - __u32 framelines; -@@ -284,7 +284,7 @@ static int put_v4l2_standard32(struct v4l2_standard *kp, struct v4l2_standard32 - { - if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_standard32)) || - put_user(kp->index, &up->index) || -- copy_to_user(up->id, &kp->id, sizeof(__u64)) || -+ put_user(kp->id, &up->id) || - copy_to_user(up->name, kp->name, 24) || - copy_to_user(&up->frameperiod, &kp->frameperiod, sizeof(kp->frameperiod)) || - put_user(kp->framelines, &up->framelines) || -@@ -576,10 +576,10 @@ struct v4l2_input32 { - __u32 type; /* Type of input */ - __u32 audioset; /* Associated audios (bitfield) */ - __u32 tuner; /* Associated tuner */ -- v4l2_std_id std; -+ compat_u64 std; - __u32 status; - __u32 reserved[4]; --} __attribute__ ((packed)); -+}; - - /* The 64-bit v4l2_input struct has extra padding at the end of the struct. - Otherwise it is identical to the 32-bit version. */ -@@ -719,6 +719,7 @@ static int put_v4l2_ext_controls32(struct v4l2_ext_controls *kp, struct v4l2_ext - struct v4l2_event32 { - __u32 type; - union { -+ compat_s64 value64; - __u8 data[64]; - } u; - __u32 pending; -diff --git a/drivers/media/v4l2-core/videobuf2-dma-contig.c b/drivers/media/v4l2-core/videobuf2-dma-contig.c -index 33d3871d1e13..63aeac93a95e 100644 ---- a/drivers/media/v4l2-core/videobuf2-dma-contig.c -+++ b/drivers/media/v4l2-core/videobuf2-dma-contig.c -@@ -117,7 +117,8 @@ static void vb2_dc_prepare(void *buf_priv) - if (!sgt || buf->db_attach) - return; - -- dma_sync_sg_for_device(buf->dev, sgt->sgl, sgt->nents, buf->dma_dir); -+ dma_sync_sg_for_device(buf->dev, sgt->sgl, sgt->orig_nents, -+ buf->dma_dir); - } - - static void vb2_dc_finish(void *buf_priv) -@@ -129,7 +130,7 @@ static void vb2_dc_finish(void *buf_priv) - if (!sgt || buf->db_attach) - return; - -- dma_sync_sg_for_cpu(buf->dev, sgt->sgl, sgt->nents, buf->dma_dir); -+ dma_sync_sg_for_cpu(buf->dev, sgt->sgl, sgt->orig_nents, buf->dma_dir); - } - - /*********************************************/ -diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c -index 3c7d6d7623c1..e638993ac626 100644 ---- a/drivers/mtd/mtdpart.c -+++ b/drivers/mtd/mtdpart.c -@@ -635,8 +635,10 @@ int add_mtd_partitions(struct mtd_info *master, - - for (i = 0; i < nbparts; i++) { - slave = allocate_partition(master, parts + i, i, cur_offset); -- if (IS_ERR(slave)) -+ if (IS_ERR(slave)) { -+ del_mtd_partitions(master); - return PTR_ERR(slave); -+ } - - mutex_lock(&mtd_partitions_mutex); - list_add(&slave->list, &mtd_partitions); -diff --git a/drivers/net/wireless/ti/wlcore/io.h b/drivers/net/wireless/ti/wlcore/io.h -index 07e3d6a049ad..e11c1adf2aad 100644 ---- a/drivers/net/wireless/ti/wlcore/io.h -+++ b/drivers/net/wireless/ti/wlcore/io.h -@@ -203,19 +203,23 @@ static inline int __must_check wlcore_write_reg(struct wl1271 *wl, int reg, - - static inline void wl1271_power_off(struct wl1271 *wl) - { -- int ret; -+ int ret = 0; - - if (!test_bit(WL1271_FLAG_GPIO_POWER, &wl->flags)) - return; - -- ret = wl->if_ops->power(wl->dev, false); -+ if (wl->if_ops->power) -+ ret = wl->if_ops->power(wl->dev, false); - if (!ret) - clear_bit(WL1271_FLAG_GPIO_POWER, &wl->flags); - } - - static inline int wl1271_power_on(struct wl1271 *wl) - { -- int ret = wl->if_ops->power(wl->dev, true); -+ int ret = 0; -+ -+ if (wl->if_ops->power) -+ ret = wl->if_ops->power(wl->dev, true); - if (ret == 0) - set_bit(WL1271_FLAG_GPIO_POWER, &wl->flags); - -diff --git a/drivers/net/wireless/ti/wlcore/spi.c b/drivers/net/wireless/ti/wlcore/spi.c -index b2c018dccf18..c675163b0d40 100644 ---- a/drivers/net/wireless/ti/wlcore/spi.c -+++ b/drivers/net/wireless/ti/wlcore/spi.c -@@ -72,7 +72,10 @@ - */ - #define SPI_AGGR_BUFFER_SIZE (4 * PAGE_SIZE) - --#define WSPI_MAX_NUM_OF_CHUNKS (SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE) -+/* Maximum number of SPI write chunks */ -+#define WSPI_MAX_NUM_OF_CHUNKS \ -+ ((SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE) + 1) -+ - - struct wl12xx_spi_glue { - struct device *dev; -@@ -270,9 +273,10 @@ static int __must_check wl12xx_spi_raw_write(struct device *child, int addr, - void *buf, size_t len, bool fixed) - { - struct wl12xx_spi_glue *glue = dev_get_drvdata(child->parent); -- struct spi_transfer t[2 * (WSPI_MAX_NUM_OF_CHUNKS + 1)]; -+ /* SPI write buffers - 2 for each chunk */ -+ struct spi_transfer t[2 * WSPI_MAX_NUM_OF_CHUNKS]; - struct spi_message m; -- u32 commands[WSPI_MAX_NUM_OF_CHUNKS]; -+ u32 commands[WSPI_MAX_NUM_OF_CHUNKS]; /* 1 command per chunk */ - u32 *cmd; - u32 chunk_len; - int i; -diff --git a/drivers/pci/bus.c b/drivers/pci/bus.c -index 38901665c770..f16c43dd6d04 100644 ---- a/drivers/pci/bus.c -+++ b/drivers/pci/bus.c -@@ -147,6 +147,8 @@ static int pci_bus_alloc_from_region(struct pci_bus *bus, struct resource *res, - type_mask |= IORESOURCE_IO | IORESOURCE_MEM; - - pci_bus_for_each_resource(bus, r, i) { -+ resource_size_t min_used = min; -+ - if (!r) - continue; - -@@ -170,12 +172,12 @@ static int pci_bus_alloc_from_region(struct pci_bus *bus, struct resource *res, - * overrides "min". - */ - if (avail.start) -- min = avail.start; -+ min_used = avail.start; - - max = avail.end; - - /* Ok, try it out.. */ -- ret = allocate_resource(r, res, size, min, max, -+ ret = allocate_resource(r, res, size, min_used, max, - align, alignf, alignf_data); - if (ret == 0) - return 0; -diff --git a/drivers/remoteproc/remoteproc_debugfs.c b/drivers/remoteproc/remoteproc_debugfs.c -index 9d30809bb407..916af5096f57 100644 ---- a/drivers/remoteproc/remoteproc_debugfs.c -+++ b/drivers/remoteproc/remoteproc_debugfs.c -@@ -156,7 +156,7 @@ rproc_recovery_write(struct file *filp, const char __user *user_buf, - char buf[10]; - int ret; - -- if (count > sizeof(buf)) -+ if (count < 1 || count > sizeof(buf)) - return count; - - ret = copy_from_user(buf, user_buf, count); -diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c -index 5f8c6d2f4df7..0e46e8d1d7bc 100644 ---- a/drivers/spi/spi-atmel.c -+++ b/drivers/spi/spi-atmel.c -@@ -593,7 +593,8 @@ static int atmel_spi_next_xfer_dma_submit(struct spi_master *master, - - *plen = len; - -- if (atmel_spi_dma_slave_config(as, &slave_config, 8)) -+ if (atmel_spi_dma_slave_config(as, &slave_config, -+ xfer->bits_per_word)) - goto err_exit; - - /* Send both scatterlists */ -diff --git a/drivers/spi/spi-ti-qspi.c b/drivers/spi/spi-ti-qspi.c -index 3d09265b5133..1454a0c42aac 100644 ---- a/drivers/spi/spi-ti-qspi.c -+++ b/drivers/spi/spi-ti-qspi.c -@@ -364,11 +364,10 @@ static int ti_qspi_start_transfer_one(struct spi_master *master, - - mutex_unlock(&qspi->list_lock); - -+ ti_qspi_write(qspi, qspi->cmd | QSPI_INVAL, QSPI_SPI_CMD_REG); - m->status = status; - spi_finalize_current_message(master); - -- ti_qspi_write(qspi, qspi->cmd | QSPI_INVAL, QSPI_SPI_CMD_REG); -- - return status; - } - -diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c -index d88492152be1..72ed3d147687 100644 ---- a/drivers/spi/spi.c -+++ b/drivers/spi/spi.c -@@ -1268,7 +1268,7 @@ struct spi_master *spi_alloc_master(struct device *dev, unsigned size) - master->bus_num = -1; - master->num_chipselect = 1; - master->dev.class = &spi_master_class; -- master->dev.parent = get_device(dev); -+ master->dev.parent = dev; - spi_master_set_devdata(master, &master[1]); - - return master; -diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c -index 143deb62467d..12446e9a4435 100644 ---- a/drivers/tty/tty_buffer.c -+++ b/drivers/tty/tty_buffer.c -@@ -411,7 +411,7 @@ receive_buf(struct tty_struct *tty, struct tty_buffer *head, int count) - count = disc->ops->receive_buf2(tty, p, f, count); - else { - count = min_t(int, count, tty->receive_room); -- if (count) -+ if (count && disc->ops->receive_buf) - disc->ops->receive_buf(tty, p, f, count); - } - head->read += count; -diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c -index 39988fa91294..b17df1000250 100644 ---- a/drivers/tty/tty_io.c -+++ b/drivers/tty/tty_io.c -@@ -2581,6 +2581,28 @@ static int tiocsetd(struct tty_struct *tty, int __user *p) - } - - /** -+ * tiocgetd - get line discipline -+ * @tty: tty device -+ * @p: pointer to user data -+ * -+ * Retrieves the line discipline id directly from the ldisc. -+ * -+ * Locking: waits for ldisc reference (in case the line discipline -+ * is changing or the tty is being hungup) -+ */ -+ -+static int tiocgetd(struct tty_struct *tty, int __user *p) -+{ -+ struct tty_ldisc *ld; -+ int ret; -+ -+ ld = tty_ldisc_ref_wait(tty); -+ ret = put_user(ld->ops->num, p); -+ tty_ldisc_deref(ld); -+ return ret; -+} -+ -+/** - * send_break - performed time break - * @tty: device to break on - * @duration: timeout in mS -@@ -2794,7 +2816,7 @@ long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - case TIOCGSID: - return tiocgsid(tty, real_tty, p); - case TIOCGETD: -- return put_user(tty->ldisc->ops->num, (int __user *)p); -+ return tiocgetd(tty, p); - case TIOCSETD: - return tiocsetd(tty, p); - case TIOCVHANGUP: -diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c -index fa114bcedabf..648e7eccdde9 100644 ---- a/drivers/usb/core/hub.c -+++ b/drivers/usb/core/hub.c -@@ -5225,7 +5225,6 @@ static int usb_reset_and_verify_device(struct usb_device *udev) - usb_set_usb2_hardware_lpm(udev, 0); - - bos = udev->bos; -- udev->bos = NULL; - - /* Disable LPM and LTM while we reset the device and reinstall the alt - * settings. Device-initiated LPM settings, and system exit latency -@@ -5334,8 +5333,11 @@ done: - usb_set_usb2_hardware_lpm(udev, 1); - usb_unlocked_enable_lpm(udev); - usb_enable_ltm(udev); -- usb_release_bos_descriptor(udev); -- udev->bos = bos; -+ /* release the new BOS descriptor allocated by hub_port_init() */ -+ if (udev->bos != bos) { -+ usb_release_bos_descriptor(udev); -+ udev->bos = bos; -+ } - return 0; - - re_enumerate: -diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c -index 5c957658a04a..7f01f165e77b 100644 ---- a/drivers/usb/host/xhci-hub.c -+++ b/drivers/usb/host/xhci-hub.c -@@ -612,8 +612,30 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd, - if ((raw_port_status & PORT_RESET) || - !(raw_port_status & PORT_PE)) - return 0xffffffff; -- if (time_after_eq(jiffies, -- bus_state->resume_done[wIndex])) { -+ /* did port event handler already start resume timing? */ -+ if (!bus_state->resume_done[wIndex]) { -+ /* If not, maybe we are in a host initated resume? */ -+ if (test_bit(wIndex, &bus_state->resuming_ports)) { -+ /* Host initated resume doesn't time the resume -+ * signalling using resume_done[]. -+ * It manually sets RESUME state, sleeps 20ms -+ * and sets U0 state. This should probably be -+ * changed, but not right now. -+ */ -+ } else { -+ /* port resume was discovered now and here, -+ * start resume timing -+ */ -+ unsigned long timeout = jiffies + -+ msecs_to_jiffies(USB_RESUME_TIMEOUT); -+ -+ set_bit(wIndex, &bus_state->resuming_ports); -+ bus_state->resume_done[wIndex] = timeout; -+ mod_timer(&hcd->rh_timer, timeout); -+ } -+ /* Has resume been signalled for USB_RESUME_TIME yet? */ -+ } else if (time_after_eq(jiffies, -+ bus_state->resume_done[wIndex])) { - int time_left; - - xhci_dbg(xhci, "Resume USB2 port %d\n", -@@ -654,13 +676,24 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd, - } else { - /* - * The resume has been signaling for less than -- * 20ms. Report the port status as SUSPEND, -- * let the usbcore check port status again -- * and clear resume signaling later. -+ * USB_RESUME_TIME. Report the port status as SUSPEND, -+ * let the usbcore check port status again and clear -+ * resume signaling later. - */ - status |= USB_PORT_STAT_SUSPEND; - } - } -+ /* -+ * Clear stale usb2 resume signalling variables in case port changed -+ * state during resume signalling. For example on error -+ */ -+ if ((bus_state->resume_done[wIndex] || -+ test_bit(wIndex, &bus_state->resuming_ports)) && -+ (raw_port_status & PORT_PLS_MASK) != XDEV_U3 && -+ (raw_port_status & PORT_PLS_MASK) != XDEV_RESUME) { -+ bus_state->resume_done[wIndex] = 0; -+ clear_bit(wIndex, &bus_state->resuming_ports); -+ } - if ((raw_port_status & PORT_PLS_MASK) == XDEV_U0 - && (raw_port_status & PORT_POWER) - && (bus_state->suspended_ports & (1 << wIndex))) { -@@ -989,6 +1022,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, - if ((temp & PORT_PE) == 0) - goto error; - -+ set_bit(wIndex, &bus_state->resuming_ports); - xhci_set_link_state(xhci, port_array, wIndex, - XDEV_RESUME); - spin_unlock_irqrestore(&xhci->lock, flags); -@@ -996,6 +1030,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, - spin_lock_irqsave(&xhci->lock, flags); - xhci_set_link_state(xhci, port_array, wIndex, - XDEV_U0); -+ clear_bit(wIndex, &bus_state->resuming_ports); - } - bus_state->port_c_suspend |= 1 << wIndex; - -diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c -index bd993fe00e0c..3bfe81c6229a 100644 ---- a/drivers/usb/host/xhci-ring.c -+++ b/drivers/usb/host/xhci-ring.c -@@ -1768,7 +1768,8 @@ static void handle_port_status(struct xhci_hcd *xhci, - */ - bogus_port_status = true; - goto cleanup; -- } else { -+ } else if (!test_bit(faked_port_index, -+ &bus_state->resuming_ports)) { - xhci_dbg(xhci, "resume HS port %d\n", port_id); - bus_state->resume_done[faked_port_index] = jiffies + - msecs_to_jiffies(USB_RESUME_TIMEOUT); -diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c -index c8e693c22014..27688e3b0a4c 100644 ---- a/drivers/usb/host/xhci.c -+++ b/drivers/usb/host/xhci.c -@@ -4866,6 +4866,9 @@ static int __init xhci_hcd_init(void) - { - int retval; - -+ if (usb_disabled()) -+ return -ENODEV; -+ - retval = xhci_register_pci(); - if (retval < 0) { - pr_debug("Problem registering PCI driver.\n"); -@@ -4894,9 +4897,6 @@ static int __init xhci_hcd_init(void) - /* xhci_run_regs has eight fields and embeds 128 xhci_intr_regs */ - BUILD_BUG_ON(sizeof(struct xhci_run_regs) != (8+8*128)*32/8); - -- if (usb_disabled()) -- return -ENODEV; -- - return 0; - unreg_pci: - xhci_unregister_pci(); -diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c -index b4fc4091e3f8..02e6fe228a63 100644 ---- a/drivers/usb/serial/cp210x.c -+++ b/drivers/usb/serial/cp210x.c -@@ -98,6 +98,7 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(0x10C4, 0x81AC) }, /* MSD Dash Hawk */ - { USB_DEVICE(0x10C4, 0x81AD) }, /* INSYS USB Modem */ - { USB_DEVICE(0x10C4, 0x81C8) }, /* Lipowsky Industrie Elektronik GmbH, Baby-JTAG */ -+ { USB_DEVICE(0x10C4, 0x81D7) }, /* IAI Corp. RCB-CV-USB USB to RS485 Adaptor */ - { USB_DEVICE(0x10C4, 0x81E2) }, /* Lipowsky Industrie Elektronik GmbH, Baby-LIN */ - { USB_DEVICE(0x10C4, 0x81E7) }, /* Aerocomm Radio */ - { USB_DEVICE(0x10C4, 0x81E8) }, /* Zephyr Bioharness */ -diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c -index 7fb81dbbdc8d..b5d8e2544b8f 100644 ---- a/drivers/usb/serial/ftdi_sio.c -+++ b/drivers/usb/serial/ftdi_sio.c -@@ -837,6 +837,7 @@ static const struct usb_device_id id_table_combined[] = { - { USB_DEVICE(FTDI_VID, FTDI_TURTELIZER_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_USB60F) }, -+ { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_SCU18) }, - { USB_DEVICE(FTDI_VID, FTDI_REU_TINY_PID) }, - - /* Papouch devices based on FTDI chip */ -diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h -index 2943b97b2a83..7850071c0ae1 100644 ---- a/drivers/usb/serial/ftdi_sio_ids.h -+++ b/drivers/usb/serial/ftdi_sio_ids.h -@@ -615,6 +615,7 @@ - */ - #define RATOC_VENDOR_ID 0x0584 - #define RATOC_PRODUCT_ID_USB60F 0xb020 -+#define RATOC_PRODUCT_ID_SCU18 0xb03a - - /* - * Infineon Technologies -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index bdbe642e6569..81f6a572f016 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -269,6 +269,8 @@ static void option_instat_callback(struct urb *urb); - #define TELIT_PRODUCT_CC864_SINGLE 0x1006 - #define TELIT_PRODUCT_DE910_DUAL 0x1010 - #define TELIT_PRODUCT_UE910_V2 0x1012 -+#define TELIT_PRODUCT_LE922_USBCFG0 0x1042 -+#define TELIT_PRODUCT_LE922_USBCFG3 0x1043 - #define TELIT_PRODUCT_LE920 0x1200 - #define TELIT_PRODUCT_LE910 0x1201 - -@@ -623,6 +625,16 @@ static const struct option_blacklist_info telit_le920_blacklist = { - .reserved = BIT(1) | BIT(5), - }; - -+static const struct option_blacklist_info telit_le922_blacklist_usbcfg0 = { -+ .sendsetup = BIT(2), -+ .reserved = BIT(0) | BIT(1) | BIT(3), -+}; -+ -+static const struct option_blacklist_info telit_le922_blacklist_usbcfg3 = { -+ .sendsetup = BIT(0), -+ .reserved = BIT(1) | BIT(2) | BIT(3), -+}; -+ - static const struct usb_device_id option_ids[] = { - { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) }, - { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) }, -@@ -1168,6 +1180,10 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_SINGLE) }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_DE910_DUAL) }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UE910_V2) }, -+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG0), -+ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 }, -+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG3), -+ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910), - .driver_info = (kernel_ulong_t)&telit_le910_blacklist }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920), -@@ -1679,7 +1695,7 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_P) }, - { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, -- { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX) }, -+ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX, 0xff) }, - { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PLXX), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, - { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, -diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c -index 60afb39eb73c..337a0be89fcf 100644 ---- a/drivers/usb/serial/visor.c -+++ b/drivers/usb/serial/visor.c -@@ -544,6 +544,11 @@ static int treo_attach(struct usb_serial *serial) - (serial->num_interrupt_in == 0)) - return 0; - -+ if (serial->num_bulk_in < 2 || serial->num_interrupt_in < 2) { -+ dev_err(&serial->interface->dev, "missing endpoints\n"); -+ return -ENODEV; -+ } -+ - /* - * It appears that Treos and Kyoceras want to use the - * 1st bulk in endpoint to communicate with the 2nd bulk out endpoint, -@@ -597,8 +602,10 @@ static int clie_5_attach(struct usb_serial *serial) - */ - - /* some sanity check */ -- if (serial->num_ports < 2) -- return -1; -+ if (serial->num_bulk_out < 2) { -+ dev_err(&serial->interface->dev, "missing bulk out endpoints\n"); -+ return -ENODEV; -+ } - - /* port 0 now uses the modified endpoint Address */ - port = serial->port[0]; -diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c -index 35240a704413..6eb8df76e17c 100644 ---- a/fs/binfmt_elf.c -+++ b/fs/binfmt_elf.c -@@ -679,16 +679,16 @@ static int load_elf_binary(struct linux_binprm *bprm) - */ - would_dump(bprm, interpreter); - -- retval = kernel_read(interpreter, 0, bprm->buf, -- BINPRM_BUF_SIZE); -- if (retval != BINPRM_BUF_SIZE) { -+ /* Get the exec headers */ -+ retval = kernel_read(interpreter, 0, -+ (void *)&loc->interp_elf_ex, -+ sizeof(loc->interp_elf_ex)); -+ if (retval != sizeof(loc->interp_elf_ex)) { - if (retval >= 0) - retval = -EIO; - goto out_free_dentry; - } - -- /* Get the exec headers */ -- loc->interp_elf_ex = *((struct elfhdr *)bprm->buf); - break; - } - elf_ppnt++; -diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h -index 2a6830a7af33..96fe2c175a73 100644 ---- a/fs/ext4/ext4.h -+++ b/fs/ext4/ext4.h -@@ -26,6 +26,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -724,19 +725,55 @@ struct move_extent { - <= (EXT4_GOOD_OLD_INODE_SIZE + \ - (einode)->i_extra_isize)) \ - -+/* -+ * We use an encoding that preserves the times for extra epoch "00": -+ * -+ * extra msb of adjust for signed -+ * epoch 32-bit 32-bit tv_sec to -+ * bits time decoded 64-bit tv_sec 64-bit tv_sec valid time range -+ * 0 0 1 -0x80000000..-0x00000001 0x000000000 1901-12-13..1969-12-31 -+ * 0 0 0 0x000000000..0x07fffffff 0x000000000 1970-01-01..2038-01-19 -+ * 0 1 1 0x080000000..0x0ffffffff 0x100000000 2038-01-19..2106-02-07 -+ * 0 1 0 0x100000000..0x17fffffff 0x100000000 2106-02-07..2174-02-25 -+ * 1 0 1 0x180000000..0x1ffffffff 0x200000000 2174-02-25..2242-03-16 -+ * 1 0 0 0x200000000..0x27fffffff 0x200000000 2242-03-16..2310-04-04 -+ * 1 1 1 0x280000000..0x2ffffffff 0x300000000 2310-04-04..2378-04-22 -+ * 1 1 0 0x300000000..0x37fffffff 0x300000000 2378-04-22..2446-05-10 -+ * -+ * Note that previous versions of the kernel on 64-bit systems would -+ * incorrectly use extra epoch bits 1,1 for dates between 1901 and -+ * 1970. e2fsck will correct this, assuming that it is run on the -+ * affected filesystem before 2242. -+ */ -+ - static inline __le32 ext4_encode_extra_time(struct timespec *time) - { -- return cpu_to_le32((sizeof(time->tv_sec) > 4 ? -- (time->tv_sec >> 32) & EXT4_EPOCH_MASK : 0) | -- ((time->tv_nsec << EXT4_EPOCH_BITS) & EXT4_NSEC_MASK)); -+ u32 extra = sizeof(time->tv_sec) > 4 ? -+ ((time->tv_sec - (s32)time->tv_sec) >> 32) & EXT4_EPOCH_MASK : 0; -+ return cpu_to_le32(extra | (time->tv_nsec << EXT4_EPOCH_BITS)); - } - - static inline void ext4_decode_extra_time(struct timespec *time, __le32 extra) - { -- if (sizeof(time->tv_sec) > 4) -- time->tv_sec |= (__u64)(le32_to_cpu(extra) & EXT4_EPOCH_MASK) -- << 32; -- time->tv_nsec = (le32_to_cpu(extra) & EXT4_NSEC_MASK) >> EXT4_EPOCH_BITS; -+ if (unlikely(sizeof(time->tv_sec) > 4 && -+ (extra & cpu_to_le32(EXT4_EPOCH_MASK)))) { -+#if LINUX_VERSION_CODE < KERNEL_VERSION(4,20,0) -+ /* Handle legacy encoding of pre-1970 dates with epoch -+ * bits 1,1. We assume that by kernel version 4.20, -+ * everyone will have run fsck over the affected -+ * filesystems to correct the problem. (This -+ * backwards compatibility may be removed before this -+ * time, at the discretion of the ext4 developers.) -+ */ -+ u64 extra_bits = le32_to_cpu(extra) & EXT4_EPOCH_MASK; -+ if (extra_bits == 3 && ((time->tv_sec) & 0x80000000) != 0) -+ extra_bits = 0; -+ time->tv_sec += extra_bits << 32; -+#else -+ time->tv_sec += (u64)(le32_to_cpu(extra) & EXT4_EPOCH_MASK) << 32; -+#endif -+ } -+ time->tv_nsec = (le32_to_cpu(extra) & EXT4_NSEC_MASK) >> EXT4_EPOCH_BITS; - } - - #define EXT4_INODE_SET_XTIME(xtime, inode, raw_inode) \ -diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c -index 2400ad1c3d12..831cb305c63f 100644 ---- a/fs/ext4/resize.c -+++ b/fs/ext4/resize.c -@@ -1030,7 +1030,7 @@ exit_free: - * do not copy the full number of backups at this time. The resize - * which changed s_groups_count will backup again. - */ --static void update_backups(struct super_block *sb, int blk_off, char *data, -+static void update_backups(struct super_block *sb, sector_t blk_off, char *data, - int size, int meta_bg) - { - struct ext4_sb_info *sbi = EXT4_SB(sb); -@@ -1055,7 +1055,7 @@ static void update_backups(struct super_block *sb, int blk_off, char *data, - group = ext4_list_backups(sb, &three, &five, &seven); - last = sbi->s_groups_count; - } else { -- group = ext4_meta_bg_first_group(sb, group) + 1; -+ group = ext4_get_group_number(sb, blk_off) + 1; - last = (ext4_group_t)(group + EXT4_DESC_PER_BLOCK(sb) - 2); - } - -diff --git a/fs/fat/dir.c b/fs/fat/dir.c -index 3963ede84eb0..75bf5e717ed8 100644 ---- a/fs/fat/dir.c -+++ b/fs/fat/dir.c -@@ -614,9 +614,9 @@ parse_record: - int status = fat_parse_long(inode, &cpos, &bh, &de, - &unicode, &nr_slots); - if (status < 0) { -- ctx->pos = cpos; -+ bh = NULL; - ret = status; -- goto out; -+ goto end_of_dir; - } else if (status == PARSE_INVALID) - goto record_end; - else if (status == PARSE_NOT_LONGNAME) -@@ -658,8 +658,9 @@ parse_record: - fill_len = short_len; - - start_filldir: -- if (!fake_offset) -- ctx->pos = cpos - (nr_slots + 1) * sizeof(struct msdos_dir_entry); -+ ctx->pos = cpos - (nr_slots + 1) * sizeof(struct msdos_dir_entry); -+ if (fake_offset && ctx->pos < 2) -+ ctx->pos = 2; - - if (!memcmp(de->name, MSDOS_DOT, MSDOS_NAME)) { - if (!dir_emit_dot(file, ctx)) -@@ -685,14 +686,19 @@ record_end: - fake_offset = 0; - ctx->pos = cpos; - goto get_new; -+ - end_of_dir: -- ctx->pos = cpos; -+ if (fake_offset && cpos < 2) -+ ctx->pos = 2; -+ else -+ ctx->pos = cpos; - fill_failed: - brelse(bh); - if (unicode) - __putname(unicode); - out: - mutex_unlock(&sbi->s_lock); -+ - return ret; - } - -diff --git a/fs/fscache/netfs.c b/fs/fscache/netfs.c -index 989f39401547..96e48c67271b 100644 ---- a/fs/fscache/netfs.c -+++ b/fs/fscache/netfs.c -@@ -22,6 +22,7 @@ static LIST_HEAD(fscache_netfs_list); - int __fscache_register_netfs(struct fscache_netfs *netfs) - { - struct fscache_netfs *ptr; -+ struct fscache_cookie *cookie; - int ret; - - _enter("{%s}", netfs->name); -@@ -29,29 +30,25 @@ int __fscache_register_netfs(struct fscache_netfs *netfs) - INIT_LIST_HEAD(&netfs->link); - - /* allocate a cookie for the primary index */ -- netfs->primary_index = -- kmem_cache_zalloc(fscache_cookie_jar, GFP_KERNEL); -+ cookie = kmem_cache_zalloc(fscache_cookie_jar, GFP_KERNEL); - -- if (!netfs->primary_index) { -+ if (!cookie) { - _leave(" = -ENOMEM"); - return -ENOMEM; - } - - /* initialise the primary index cookie */ -- atomic_set(&netfs->primary_index->usage, 1); -- atomic_set(&netfs->primary_index->n_children, 0); -- atomic_set(&netfs->primary_index->n_active, 1); -+ atomic_set(&cookie->usage, 1); -+ atomic_set(&cookie->n_children, 0); -+ atomic_set(&cookie->n_active, 1); - -- netfs->primary_index->def = &fscache_fsdef_netfs_def; -- netfs->primary_index->parent = &fscache_fsdef_index; -- netfs->primary_index->netfs_data = netfs; -- netfs->primary_index->flags = 1 << FSCACHE_COOKIE_ENABLED; -+ cookie->def = &fscache_fsdef_netfs_def; -+ cookie->parent = &fscache_fsdef_index; -+ cookie->netfs_data = netfs; -+ cookie->flags = 1 << FSCACHE_COOKIE_ENABLED; - -- atomic_inc(&netfs->primary_index->parent->usage); -- atomic_inc(&netfs->primary_index->parent->n_children); -- -- spin_lock_init(&netfs->primary_index->lock); -- INIT_HLIST_HEAD(&netfs->primary_index->backing_objects); -+ spin_lock_init(&cookie->lock); -+ INIT_HLIST_HEAD(&cookie->backing_objects); - - /* check the netfs type is not already present */ - down_write(&fscache_addremove_sem); -@@ -62,6 +59,10 @@ int __fscache_register_netfs(struct fscache_netfs *netfs) - goto already_registered; - } - -+ atomic_inc(&cookie->parent->usage); -+ atomic_inc(&cookie->parent->n_children); -+ -+ netfs->primary_index = cookie; - list_add(&netfs->link, &fscache_netfs_list); - ret = 0; - -@@ -71,11 +72,8 @@ int __fscache_register_netfs(struct fscache_netfs *netfs) - already_registered: - up_write(&fscache_addremove_sem); - -- if (ret < 0) { -- netfs->primary_index->parent = NULL; -- __fscache_cookie_put(netfs->primary_index); -- netfs->primary_index = NULL; -- } -+ if (ret < 0) -+ kmem_cache_free(fscache_cookie_jar, cookie); - - _leave(" = %d", ret); - return ret; -diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c -index ecc57071a1a9..a8c65539fbd2 100644 ---- a/fs/jbd2/transaction.c -+++ b/fs/jbd2/transaction.c -@@ -2066,6 +2066,7 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh, - - if (!buffer_dirty(bh)) { - /* bdflush has written it. We can drop it now */ -+ __jbd2_journal_remove_checkpoint(jh); - goto zap_buffer; - } - -@@ -2095,6 +2096,7 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh, - /* The orphan record's transaction has - * committed. We can cleanse this buffer */ - clear_buffer_jbddirty(bh); -+ __jbd2_journal_remove_checkpoint(jh); - goto zap_buffer; - } - } -diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c -index 1dd0bcc75536..96cbbe9e7030 100644 ---- a/fs/ocfs2/dlm/dlmmaster.c -+++ b/fs/ocfs2/dlm/dlmmaster.c -@@ -2459,6 +2459,11 @@ static int dlm_migrate_lockres(struct dlm_ctxt *dlm, - spin_lock(&dlm->master_lock); - ret = dlm_add_migration_mle(dlm, res, mle, &oldmle, name, - namelen, target, dlm->node_num); -+ /* get an extra reference on the mle. -+ * otherwise the assert_master from the new -+ * master will destroy this. -+ */ -+ dlm_get_mle_inuse(mle); - spin_unlock(&dlm->master_lock); - spin_unlock(&dlm->spinlock); - -@@ -2494,6 +2499,7 @@ fail: - if (mle_added) { - dlm_mle_detach_hb_events(dlm, mle); - dlm_put_mle(mle); -+ dlm_put_mle_inuse(mle); - } else if (mle) { - kmem_cache_free(dlm_mle_cache, mle); - mle = NULL; -@@ -2511,17 +2517,6 @@ fail: - * ensure that all assert_master work is flushed. */ - flush_workqueue(dlm->dlm_worker); - -- /* get an extra reference on the mle. -- * otherwise the assert_master from the new -- * master will destroy this. -- * also, make sure that all callers of dlm_get_mle -- * take both dlm->spinlock and dlm->master_lock */ -- spin_lock(&dlm->spinlock); -- spin_lock(&dlm->master_lock); -- dlm_get_mle_inuse(mle); -- spin_unlock(&dlm->master_lock); -- spin_unlock(&dlm->spinlock); -- - /* notify new node and send all lock state */ - /* call send_one_lockres with migration flag. - * this serves as notice to the target node that a -@@ -3246,6 +3241,15 @@ top: - mle->new_master != dead_node) - continue; - -+ if (mle->new_master == dead_node && mle->inuse) { -+ mlog(ML_NOTICE, "%s: target %u died during " -+ "migration from %u, the MLE is " -+ "still keep used, ignore it!\n", -+ dlm->name, dead_node, -+ mle->master); -+ continue; -+ } -+ - /* If we have reached this point, this mle needs to be - * removed from the list and freed. */ - dlm_clean_migration_mle(dlm, mle); -diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c -index fe29f7978f81..4b93d96d244f 100644 ---- a/fs/ocfs2/dlm/dlmrecovery.c -+++ b/fs/ocfs2/dlm/dlmrecovery.c -@@ -2332,6 +2332,8 @@ static void dlm_do_local_recovery_cleanup(struct dlm_ctxt *dlm, u8 dead_node) - break; - } - } -+ dlm_lockres_clear_refmap_bit(dlm, res, -+ dead_node); - spin_unlock(&res->spinlock); - continue; - } -diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c -index cc0aeb9e81a2..5e260e14cdd6 100644 ---- a/fs/ocfs2/namei.c -+++ b/fs/ocfs2/namei.c -@@ -340,13 +340,11 @@ static int ocfs2_mknod(struct inode *dir, - goto leave; - } - -- status = posix_acl_create(dir, &mode, &default_acl, &acl); -+ status = posix_acl_create(dir, &inode->i_mode, &default_acl, &acl); - if (status) { - mlog_errno(status); - goto leave; - } -- /* update inode->i_mode after mask with "umask". */ -- inode->i_mode = mode; - - handle = ocfs2_start_trans(osb, ocfs2_mknod_credits(osb->sb, - S_ISDIR(mode), -diff --git a/fs/proc/fd.c b/fs/proc/fd.c -index 985ea881b5bc..c06a1f97ac22 100644 ---- a/fs/proc/fd.c -+++ b/fs/proc/fd.c -@@ -283,11 +283,19 @@ static struct dentry *proc_lookupfd(struct inode *dir, struct dentry *dentry, - */ - int proc_fd_permission(struct inode *inode, int mask) - { -- int rv = generic_permission(inode, mask); -+ struct task_struct *p; -+ int rv; -+ -+ rv = generic_permission(inode, mask); - if (rv == 0) -- return 0; -- if (task_tgid(current) == proc_pid(inode)) -+ return rv; -+ -+ rcu_read_lock(); -+ p = pid_task(proc_pid(inode), PIDTYPE_PID); -+ if (p && same_thread_group(p, current)) - rv = 0; -+ rcu_read_unlock(); -+ - return rv; - } - -diff --git a/fs/sysv/inode.c b/fs/sysv/inode.c -index c327d4ee1235..7b3792e5844a 100644 ---- a/fs/sysv/inode.c -+++ b/fs/sysv/inode.c -@@ -161,14 +161,8 @@ void sysv_set_inode(struct inode *inode, dev_t rdev) - inode->i_fop = &sysv_dir_operations; - inode->i_mapping->a_ops = &sysv_aops; - } else if (S_ISLNK(inode->i_mode)) { -- if (inode->i_blocks) { -- inode->i_op = &sysv_symlink_inode_operations; -- inode->i_mapping->a_ops = &sysv_aops; -- } else { -- inode->i_op = &sysv_fast_symlink_inode_operations; -- nd_terminate_link(SYSV_I(inode)->i_data, inode->i_size, -- sizeof(SYSV_I(inode)->i_data) - 1); -- } -+ inode->i_op = &sysv_symlink_inode_operations; -+ inode->i_mapping->a_ops = &sysv_aops; - } else - init_special_inode(inode, inode->i_mode, rdev); - } -diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h -index d61c11170213..2f38daaab3d7 100644 ---- a/include/crypto/if_alg.h -+++ b/include/crypto/if_alg.h -@@ -30,6 +30,8 @@ struct alg_sock { - - struct sock *parent; - -+ unsigned int refcnt; -+ - const struct af_alg_type *type; - void *private; - }; -@@ -64,6 +66,7 @@ int af_alg_register_type(const struct af_alg_type *type); - int af_alg_unregister_type(const struct af_alg_type *type); - - int af_alg_release(struct socket *sock); -+void af_alg_release_parent(struct sock *sk); - int af_alg_accept(struct sock *sk, struct socket *newsock); - - int af_alg_make_sg(struct af_alg_sgl *sgl, void __user *addr, int len, -@@ -80,11 +83,6 @@ static inline struct alg_sock *alg_sk(struct sock *sk) - return (struct alg_sock *)sk; - } - --static inline void af_alg_release_parent(struct sock *sk) --{ -- sock_put(alg_sk(sk)->parent); --} -- - static inline void af_alg_init_completion(struct af_alg_completion *completion) - { - init_completion(&completion->completion); -diff --git a/include/linux/signal.h b/include/linux/signal.h -index 2ac423bdb676..53944e50e421 100644 ---- a/include/linux/signal.h -+++ b/include/linux/signal.h -@@ -247,7 +247,6 @@ extern int sigprocmask(int, sigset_t *, sigset_t *); - extern void set_current_blocked(sigset_t *); - extern void __set_current_blocked(const sigset_t *); - extern int show_unhandled_signals; --extern int sigsuspend(sigset_t *); - - struct sigaction { - #ifndef __ARCH_HAS_IRIX_SIGACTION -diff --git a/kernel/signal.c b/kernel/signal.c -index 15c22ee11156..d8db156e5f5c 100644 ---- a/kernel/signal.c -+++ b/kernel/signal.c -@@ -3550,7 +3550,7 @@ SYSCALL_DEFINE0(pause) - - #endif - --int sigsuspend(sigset_t *set) -+static int sigsuspend(sigset_t *set) - { - current->saved_sigmask = current->blocked; - set_current_blocked(set); -diff --git a/kernel/trace/trace_printk.c b/kernel/trace/trace_printk.c -index 2900817ba65c..7c8cef653166 100644 ---- a/kernel/trace/trace_printk.c -+++ b/kernel/trace/trace_printk.c -@@ -269,6 +269,7 @@ static const char **find_next(void *v, loff_t *pos) - if (*pos < last_index + start_index) - return __start___tracepoint_str + (*pos - last_index); - -+ start_index += last_index; - return find_next_mod_format(start_index, v, fmt, pos); - } - -diff --git a/scripts/recordmcount.h b/scripts/recordmcount.h -index 49b582a225b0..b9897e2be404 100644 ---- a/scripts/recordmcount.h -+++ b/scripts/recordmcount.h -@@ -377,7 +377,7 @@ static void nop_mcount(Elf_Shdr const *const relhdr, - - if (mcountsym == Elf_r_sym(relp) && !is_fake_mcount(relp)) { - if (make_nop) -- ret = make_nop((void *)ehdr, shdr->sh_offset + relp->r_offset); -+ ret = make_nop((void *)ehdr, _w(shdr->sh_offset) + _w(relp->r_offset)); - if (warn_on_notrace_sect && !once) { - printf("Section %s has mcount callers being ignored\n", - txtname); -diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c -index 048550aacffc..596a2020fe2c 100644 ---- a/security/integrity/evm/evm_main.c -+++ b/security/integrity/evm/evm_main.c -@@ -22,6 +22,7 @@ - #include - #include - #include -+#include - #include "evm.h" - - int evm_initialized; -@@ -133,7 +134,7 @@ static enum integrity_status evm_verify_hmac(struct dentry *dentry, - xattr_value_len, calc.digest); - if (rc) - break; -- rc = memcmp(xattr_data->digest, calc.digest, -+ rc = crypto_memneq(xattr_data->digest, calc.digest, - sizeof(calc.digest)); - if (rc) - rc = -EINVAL; -diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c -index 7403f348ed14..91525fafe73b 100644 ---- a/sound/core/compress_offload.c -+++ b/sound/core/compress_offload.c -@@ -44,6 +44,13 @@ - #include - #include - -+/* struct snd_compr_codec_caps overflows the ioctl bit size for some -+ * architectures, so we need to disable the relevant ioctls. -+ */ -+#if _IOC_SIZEBITS < 14 -+#define COMPR_CODEC_CAPS_OVERFLOW -+#endif -+ - /* TODO: - * - add substream support for multiple devices in case of - * SND_DYNAMIC_MINORS is not used -@@ -438,6 +445,7 @@ out: - return retval; - } - -+#ifndef COMPR_CODEC_CAPS_OVERFLOW - static int - snd_compr_get_codec_caps(struct snd_compr_stream *stream, unsigned long arg) - { -@@ -461,6 +469,7 @@ out: - kfree(caps); - return retval; - } -+#endif /* !COMPR_CODEC_CAPS_OVERFLOW */ - - /* revisit this with snd_pcm_preallocate_xxx */ - static int snd_compr_allocate_buffer(struct snd_compr_stream *stream, -@@ -799,9 +808,11 @@ static long snd_compr_ioctl(struct file *f, unsigned int cmd, unsigned long arg) - case _IOC_NR(SNDRV_COMPRESS_GET_CAPS): - retval = snd_compr_get_caps(stream, arg); - break; -+#ifndef COMPR_CODEC_CAPS_OVERFLOW - case _IOC_NR(SNDRV_COMPRESS_GET_CODEC_CAPS): - retval = snd_compr_get_codec_caps(stream, arg); - break; -+#endif - case _IOC_NR(SNDRV_COMPRESS_SET_PARAMS): - retval = snd_compr_set_params(stream, arg); - break; -diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c -index 4c1cc51772e6..7417f96cea6e 100644 ---- a/sound/core/oss/pcm_oss.c -+++ b/sound/core/oss/pcm_oss.c -@@ -834,7 +834,8 @@ static int choose_rate(struct snd_pcm_substream *substream, - return snd_pcm_hw_param_near(substream, params, SNDRV_PCM_HW_PARAM_RATE, best_rate, NULL); - } - --static int snd_pcm_oss_change_params(struct snd_pcm_substream *substream) -+static int snd_pcm_oss_change_params(struct snd_pcm_substream *substream, -+ bool trylock) - { - struct snd_pcm_runtime *runtime = substream->runtime; - struct snd_pcm_hw_params *params, *sparams; -@@ -848,7 +849,10 @@ static int snd_pcm_oss_change_params(struct snd_pcm_substream *substream) - struct snd_mask sformat_mask; - struct snd_mask mask; - -- if (mutex_lock_interruptible(&runtime->oss.params_lock)) -+ if (trylock) { -+ if (!(mutex_trylock(&runtime->oss.params_lock))) -+ return -EAGAIN; -+ } else if (mutex_lock_interruptible(&runtime->oss.params_lock)) - return -EINTR; - sw_params = kmalloc(sizeof(*sw_params), GFP_KERNEL); - params = kmalloc(sizeof(*params), GFP_KERNEL); -@@ -1091,7 +1095,7 @@ static int snd_pcm_oss_get_active_substream(struct snd_pcm_oss_file *pcm_oss_fil - if (asubstream == NULL) - asubstream = substream; - if (substream->runtime->oss.params) { -- err = snd_pcm_oss_change_params(substream); -+ err = snd_pcm_oss_change_params(substream, false); - if (err < 0) - return err; - } -@@ -1130,7 +1134,7 @@ static int snd_pcm_oss_make_ready(struct snd_pcm_substream *substream) - return 0; - runtime = substream->runtime; - if (runtime->oss.params) { -- err = snd_pcm_oss_change_params(substream); -+ err = snd_pcm_oss_change_params(substream, false); - if (err < 0) - return err; - } -@@ -2168,7 +2172,7 @@ static int snd_pcm_oss_get_space(struct snd_pcm_oss_file *pcm_oss_file, int stre - runtime = substream->runtime; - - if (runtime->oss.params && -- (err = snd_pcm_oss_change_params(substream)) < 0) -+ (err = snd_pcm_oss_change_params(substream, false)) < 0) - return err; - - info.fragsize = runtime->oss.period_bytes; -@@ -2804,7 +2808,12 @@ static int snd_pcm_oss_mmap(struct file *file, struct vm_area_struct *area) - return -EIO; - - if (runtime->oss.params) { -- if ((err = snd_pcm_oss_change_params(substream)) < 0) -+ /* use mutex_trylock() for params_lock for avoiding a deadlock -+ * between mmap_sem and params_lock taken by -+ * copy_from/to_user() in snd_pcm_oss_write/read() -+ */ -+ err = snd_pcm_oss_change_params(substream, true); -+ if (err < 0) - return err; - } - #ifdef CONFIG_SND_PCM_OSS_PLUGINS -diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c -index 7b596b5751db..500765f20843 100644 ---- a/sound/core/rawmidi.c -+++ b/sound/core/rawmidi.c -@@ -934,31 +934,36 @@ static long snd_rawmidi_kernel_read1(struct snd_rawmidi_substream *substream, - unsigned long flags; - long result = 0, count1; - struct snd_rawmidi_runtime *runtime = substream->runtime; -+ unsigned long appl_ptr; - -+ spin_lock_irqsave(&runtime->lock, flags); - while (count > 0 && runtime->avail) { - count1 = runtime->buffer_size - runtime->appl_ptr; - if (count1 > count) - count1 = count; -- spin_lock_irqsave(&runtime->lock, flags); - if (count1 > (int)runtime->avail) - count1 = runtime->avail; -+ -+ /* update runtime->appl_ptr before unlocking for userbuf */ -+ appl_ptr = runtime->appl_ptr; -+ runtime->appl_ptr += count1; -+ runtime->appl_ptr %= runtime->buffer_size; -+ runtime->avail -= count1; -+ - if (kernelbuf) -- memcpy(kernelbuf + result, runtime->buffer + runtime->appl_ptr, count1); -+ memcpy(kernelbuf + result, runtime->buffer + appl_ptr, count1); - if (userbuf) { - spin_unlock_irqrestore(&runtime->lock, flags); - if (copy_to_user(userbuf + result, -- runtime->buffer + runtime->appl_ptr, count1)) { -+ runtime->buffer + appl_ptr, count1)) { - return result > 0 ? result : -EFAULT; - } - spin_lock_irqsave(&runtime->lock, flags); - } -- runtime->appl_ptr += count1; -- runtime->appl_ptr %= runtime->buffer_size; -- runtime->avail -= count1; -- spin_unlock_irqrestore(&runtime->lock, flags); - result += count1; - count -= count1; - } -+ spin_unlock_irqrestore(&runtime->lock, flags); - return result; - } - -@@ -1161,8 +1166,9 @@ static long snd_rawmidi_kernel_write1(struct snd_rawmidi_substream *substream, - unsigned long flags; - long count1, result; - struct snd_rawmidi_runtime *runtime = substream->runtime; -+ unsigned long appl_ptr; - -- if (snd_BUG_ON(!kernelbuf && !userbuf)) -+ if (!kernelbuf && !userbuf) - return -EINVAL; - if (snd_BUG_ON(!runtime->buffer)) - return -EINVAL; -@@ -1181,12 +1187,19 @@ static long snd_rawmidi_kernel_write1(struct snd_rawmidi_substream *substream, - count1 = count; - if (count1 > (long)runtime->avail) - count1 = runtime->avail; -+ -+ /* update runtime->appl_ptr before unlocking for userbuf */ -+ appl_ptr = runtime->appl_ptr; -+ runtime->appl_ptr += count1; -+ runtime->appl_ptr %= runtime->buffer_size; -+ runtime->avail -= count1; -+ - if (kernelbuf) -- memcpy(runtime->buffer + runtime->appl_ptr, -+ memcpy(runtime->buffer + appl_ptr, - kernelbuf + result, count1); - else if (userbuf) { - spin_unlock_irqrestore(&runtime->lock, flags); -- if (copy_from_user(runtime->buffer + runtime->appl_ptr, -+ if (copy_from_user(runtime->buffer + appl_ptr, - userbuf + result, count1)) { - spin_lock_irqsave(&runtime->lock, flags); - result = result > 0 ? result : -EFAULT; -@@ -1194,9 +1207,6 @@ static long snd_rawmidi_kernel_write1(struct snd_rawmidi_substream *substream, - } - spin_lock_irqsave(&runtime->lock, flags); - } -- runtime->appl_ptr += count1; -- runtime->appl_ptr %= runtime->buffer_size; -- runtime->avail -= count1; - result += count1; - count -= count1; - } -diff --git a/sound/core/seq/oss/seq_oss_synth.c b/sound/core/seq/oss/seq_oss_synth.c -index c5b773a1eea9..4a09c3085ca4 100644 ---- a/sound/core/seq/oss/seq_oss_synth.c -+++ b/sound/core/seq/oss/seq_oss_synth.c -@@ -310,7 +310,7 @@ snd_seq_oss_synth_cleanup(struct seq_oss_devinfo *dp) - struct seq_oss_synth *rec; - struct seq_oss_synthinfo *info; - -- if (snd_BUG_ON(dp->max_synthdev >= SNDRV_SEQ_OSS_MAX_SYNTH_DEVS)) -+ if (snd_BUG_ON(dp->max_synthdev > SNDRV_SEQ_OSS_MAX_SYNTH_DEVS)) - return; - for (i = 0; i < dp->max_synthdev; i++) { - info = &dp->synths[i]; -diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c -index ecfbf5f39d38..08865dcbf5f1 100644 ---- a/sound/core/seq/seq_clientmgr.c -+++ b/sound/core/seq/seq_clientmgr.c -@@ -678,6 +678,9 @@ static int deliver_to_subscribers(struct snd_seq_client *client, - else - down_read(&grp->list_mutex); - list_for_each_entry(subs, &grp->list_head, src_list) { -+ /* both ports ready? */ -+ if (atomic_read(&subs->ref_count) != 2) -+ continue; - event->dest = subs->info.dest; - if (subs->info.flags & SNDRV_SEQ_PORT_SUBS_TIMESTAMP) - /* convert time according to flag with subscription */ -diff --git a/sound/core/seq/seq_ports.c b/sound/core/seq/seq_ports.c -index 9516e5ce3aad..67c91d226552 100644 ---- a/sound/core/seq/seq_ports.c -+++ b/sound/core/seq/seq_ports.c -@@ -175,10 +175,6 @@ struct snd_seq_client_port *snd_seq_create_port(struct snd_seq_client *client, - } - - /* */ --enum group_type { -- SRC_LIST, DEST_LIST --}; -- - static int subscribe_port(struct snd_seq_client *client, - struct snd_seq_client_port *port, - struct snd_seq_port_subs_info *grp, -@@ -205,6 +201,20 @@ static struct snd_seq_client_port *get_client_port(struct snd_seq_addr *addr, - return NULL; - } - -+static void delete_and_unsubscribe_port(struct snd_seq_client *client, -+ struct snd_seq_client_port *port, -+ struct snd_seq_subscribers *subs, -+ bool is_src, bool ack); -+ -+static inline struct snd_seq_subscribers * -+get_subscriber(struct list_head *p, bool is_src) -+{ -+ if (is_src) -+ return list_entry(p, struct snd_seq_subscribers, src_list); -+ else -+ return list_entry(p, struct snd_seq_subscribers, dest_list); -+} -+ - /* - * remove all subscribers on the list - * this is called from port_delete, for each src and dest list. -@@ -212,7 +222,7 @@ static struct snd_seq_client_port *get_client_port(struct snd_seq_addr *addr, - static void clear_subscriber_list(struct snd_seq_client *client, - struct snd_seq_client_port *port, - struct snd_seq_port_subs_info *grp, -- int grptype) -+ int is_src) - { - struct list_head *p, *n; - -@@ -221,15 +231,13 @@ static void clear_subscriber_list(struct snd_seq_client *client, - struct snd_seq_client *c; - struct snd_seq_client_port *aport; - -- if (grptype == SRC_LIST) { -- subs = list_entry(p, struct snd_seq_subscribers, src_list); -+ subs = get_subscriber(p, is_src); -+ if (is_src) - aport = get_client_port(&subs->info.dest, &c); -- } else { -- subs = list_entry(p, struct snd_seq_subscribers, dest_list); -+ else - aport = get_client_port(&subs->info.sender, &c); -- } -- list_del(p); -- unsubscribe_port(client, port, grp, &subs->info, 0); -+ delete_and_unsubscribe_port(client, port, subs, is_src, false); -+ - if (!aport) { - /* looks like the connected port is being deleted. - * we decrease the counter, and when both ports are deleted -@@ -237,21 +245,14 @@ static void clear_subscriber_list(struct snd_seq_client *client, - */ - if (atomic_dec_and_test(&subs->ref_count)) - kfree(subs); -- } else { -- /* ok we got the connected port */ -- struct snd_seq_port_subs_info *agrp; -- agrp = (grptype == SRC_LIST) ? &aport->c_dest : &aport->c_src; -- down_write(&agrp->list_mutex); -- if (grptype == SRC_LIST) -- list_del(&subs->dest_list); -- else -- list_del(&subs->src_list); -- up_write(&agrp->list_mutex); -- unsubscribe_port(c, aport, agrp, &subs->info, 1); -- kfree(subs); -- snd_seq_port_unlock(aport); -- snd_seq_client_unlock(c); -+ continue; - } -+ -+ /* ok we got the connected port */ -+ delete_and_unsubscribe_port(c, aport, subs, !is_src, true); -+ kfree(subs); -+ snd_seq_port_unlock(aport); -+ snd_seq_client_unlock(c); - } - } - -@@ -264,8 +265,8 @@ static int port_delete(struct snd_seq_client *client, - snd_use_lock_sync(&port->use_lock); - - /* clear subscribers info */ -- clear_subscriber_list(client, port, &port->c_src, SRC_LIST); -- clear_subscriber_list(client, port, &port->c_dest, DEST_LIST); -+ clear_subscriber_list(client, port, &port->c_src, true); -+ clear_subscriber_list(client, port, &port->c_dest, false); - - if (port->private_free) - port->private_free(port->private_data); -@@ -484,85 +485,120 @@ static int match_subs_info(struct snd_seq_port_subscribe *r, - return 0; - } - -- --/* connect two ports */ --int snd_seq_port_connect(struct snd_seq_client *connector, -- struct snd_seq_client *src_client, -- struct snd_seq_client_port *src_port, -- struct snd_seq_client *dest_client, -- struct snd_seq_client_port *dest_port, -- struct snd_seq_port_subscribe *info) -+static int check_and_subscribe_port(struct snd_seq_client *client, -+ struct snd_seq_client_port *port, -+ struct snd_seq_subscribers *subs, -+ bool is_src, bool exclusive, bool ack) - { -- struct snd_seq_port_subs_info *src = &src_port->c_src; -- struct snd_seq_port_subs_info *dest = &dest_port->c_dest; -- struct snd_seq_subscribers *subs, *s; -- int err, src_called = 0; -- unsigned long flags; -- int exclusive; -+ struct snd_seq_port_subs_info *grp; -+ struct list_head *p; -+ struct snd_seq_subscribers *s; -+ int err; - -- subs = kzalloc(sizeof(*subs), GFP_KERNEL); -- if (! subs) -- return -ENOMEM; -- -- subs->info = *info; -- atomic_set(&subs->ref_count, 2); -- -- down_write(&src->list_mutex); -- down_write_nested(&dest->list_mutex, SINGLE_DEPTH_NESTING); -- -- exclusive = info->flags & SNDRV_SEQ_PORT_SUBS_EXCLUSIVE ? 1 : 0; -+ grp = is_src ? &port->c_src : &port->c_dest; - err = -EBUSY; -+ down_write(&grp->list_mutex); - if (exclusive) { -- if (! list_empty(&src->list_head) || ! list_empty(&dest->list_head)) -+ if (!list_empty(&grp->list_head)) - goto __error; - } else { -- if (src->exclusive || dest->exclusive) -+ if (grp->exclusive) - goto __error; - /* check whether already exists */ -- list_for_each_entry(s, &src->list_head, src_list) { -- if (match_subs_info(info, &s->info)) -- goto __error; -- } -- list_for_each_entry(s, &dest->list_head, dest_list) { -- if (match_subs_info(info, &s->info)) -+ list_for_each(p, &grp->list_head) { -+ s = get_subscriber(p, is_src); -+ if (match_subs_info(&subs->info, &s->info)) - goto __error; - } - } - -- if ((err = subscribe_port(src_client, src_port, src, info, -- connector->number != src_client->number)) < 0) -- goto __error; -- src_called = 1; -- -- if ((err = subscribe_port(dest_client, dest_port, dest, info, -- connector->number != dest_client->number)) < 0) -+ err = subscribe_port(client, port, grp, &subs->info, ack); -+ if (err < 0) { -+ grp->exclusive = 0; - goto __error; -+ } - - /* add to list */ -- write_lock_irqsave(&src->list_lock, flags); -- // write_lock(&dest->list_lock); // no other lock yet -- list_add_tail(&subs->src_list, &src->list_head); -- list_add_tail(&subs->dest_list, &dest->list_head); -- // write_unlock(&dest->list_lock); // no other lock yet -- write_unlock_irqrestore(&src->list_lock, flags); -+ write_lock_irq(&grp->list_lock); -+ if (is_src) -+ list_add_tail(&subs->src_list, &grp->list_head); -+ else -+ list_add_tail(&subs->dest_list, &grp->list_head); -+ grp->exclusive = exclusive; -+ atomic_inc(&subs->ref_count); -+ write_unlock_irq(&grp->list_lock); -+ err = 0; -+ -+ __error: -+ up_write(&grp->list_mutex); -+ return err; -+} - -- src->exclusive = dest->exclusive = exclusive; -+static void delete_and_unsubscribe_port(struct snd_seq_client *client, -+ struct snd_seq_client_port *port, -+ struct snd_seq_subscribers *subs, -+ bool is_src, bool ack) -+{ -+ struct snd_seq_port_subs_info *grp; -+ -+ grp = is_src ? &port->c_src : &port->c_dest; -+ down_write(&grp->list_mutex); -+ write_lock_irq(&grp->list_lock); -+ if (is_src) -+ list_del(&subs->src_list); -+ else -+ list_del(&subs->dest_list); -+ grp->exclusive = 0; -+ write_unlock_irq(&grp->list_lock); -+ up_write(&grp->list_mutex); -+ -+ unsubscribe_port(client, port, grp, &subs->info, ack); -+} -+ -+/* connect two ports */ -+int snd_seq_port_connect(struct snd_seq_client *connector, -+ struct snd_seq_client *src_client, -+ struct snd_seq_client_port *src_port, -+ struct snd_seq_client *dest_client, -+ struct snd_seq_client_port *dest_port, -+ struct snd_seq_port_subscribe *info) -+{ -+ struct snd_seq_subscribers *subs; -+ bool exclusive; -+ int err; -+ -+ subs = kzalloc(sizeof(*subs), GFP_KERNEL); -+ if (!subs) -+ return -ENOMEM; -+ -+ subs->info = *info; -+ atomic_set(&subs->ref_count, 0); -+ INIT_LIST_HEAD(&subs->src_list); -+ INIT_LIST_HEAD(&subs->dest_list); -+ -+ exclusive = !!(info->flags & SNDRV_SEQ_PORT_SUBS_EXCLUSIVE); -+ -+ err = check_and_subscribe_port(src_client, src_port, subs, true, -+ exclusive, -+ connector->number != src_client->number); -+ if (err < 0) -+ goto error; -+ err = check_and_subscribe_port(dest_client, dest_port, subs, false, -+ exclusive, -+ connector->number != dest_client->number); -+ if (err < 0) -+ goto error_dest; - -- up_write(&dest->list_mutex); -- up_write(&src->list_mutex); - return 0; - -- __error: -- if (src_called) -- unsubscribe_port(src_client, src_port, src, info, -- connector->number != src_client->number); -+ error_dest: -+ delete_and_unsubscribe_port(src_client, src_port, subs, true, -+ connector->number != src_client->number); -+ error: - kfree(subs); -- up_write(&dest->list_mutex); -- up_write(&src->list_mutex); - return err; - } - -- - /* remove the connection */ - int snd_seq_port_disconnect(struct snd_seq_client *connector, - struct snd_seq_client *src_client, -@@ -572,37 +608,28 @@ int snd_seq_port_disconnect(struct snd_seq_client *connector, - struct snd_seq_port_subscribe *info) - { - struct snd_seq_port_subs_info *src = &src_port->c_src; -- struct snd_seq_port_subs_info *dest = &dest_port->c_dest; - struct snd_seq_subscribers *subs; - int err = -ENOENT; -- unsigned long flags; - - down_write(&src->list_mutex); -- down_write_nested(&dest->list_mutex, SINGLE_DEPTH_NESTING); -- - /* look for the connection */ - list_for_each_entry(subs, &src->list_head, src_list) { - if (match_subs_info(info, &subs->info)) { -- write_lock_irqsave(&src->list_lock, flags); -- // write_lock(&dest->list_lock); // no lock yet -- list_del(&subs->src_list); -- list_del(&subs->dest_list); -- // write_unlock(&dest->list_lock); -- write_unlock_irqrestore(&src->list_lock, flags); -- src->exclusive = dest->exclusive = 0; -- unsubscribe_port(src_client, src_port, src, info, -- connector->number != src_client->number); -- unsubscribe_port(dest_client, dest_port, dest, info, -- connector->number != dest_client->number); -- kfree(subs); -+ atomic_dec(&subs->ref_count); /* mark as not ready */ - err = 0; - break; - } - } -- -- up_write(&dest->list_mutex); - up_write(&src->list_mutex); -- return err; -+ if (err < 0) -+ return err; -+ -+ delete_and_unsubscribe_port(src_client, src_port, subs, true, -+ connector->number != src_client->number); -+ delete_and_unsubscribe_port(dest_client, dest_port, subs, false, -+ connector->number != dest_client->number); -+ kfree(subs); -+ return 0; - } - - -diff --git a/sound/core/seq/seq_timer.c b/sound/core/seq/seq_timer.c -index 24d44b2f61ac..6ec30a98a92a 100644 ---- a/sound/core/seq/seq_timer.c -+++ b/sound/core/seq/seq_timer.c -@@ -92,6 +92,9 @@ void snd_seq_timer_delete(struct snd_seq_timer **tmr) - - void snd_seq_timer_defaults(struct snd_seq_timer * tmr) - { -+ unsigned long flags; -+ -+ spin_lock_irqsave(&tmr->lock, flags); - /* setup defaults */ - tmr->ppq = 96; /* 96 PPQ */ - tmr->tempo = 500000; /* 120 BPM */ -@@ -107,21 +110,25 @@ void snd_seq_timer_defaults(struct snd_seq_timer * tmr) - tmr->preferred_resolution = seq_default_timer_resolution; - - tmr->skew = tmr->skew_base = SKEW_BASE; -+ spin_unlock_irqrestore(&tmr->lock, flags); - } - --void snd_seq_timer_reset(struct snd_seq_timer * tmr) -+static void seq_timer_reset(struct snd_seq_timer *tmr) - { -- unsigned long flags; -- -- spin_lock_irqsave(&tmr->lock, flags); -- - /* reset time & songposition */ - tmr->cur_time.tv_sec = 0; - tmr->cur_time.tv_nsec = 0; - - tmr->tick.cur_tick = 0; - tmr->tick.fraction = 0; -+} -+ -+void snd_seq_timer_reset(struct snd_seq_timer *tmr) -+{ -+ unsigned long flags; - -+ spin_lock_irqsave(&tmr->lock, flags); -+ seq_timer_reset(tmr); - spin_unlock_irqrestore(&tmr->lock, flags); - } - -@@ -140,8 +147,11 @@ static void snd_seq_timer_interrupt(struct snd_timer_instance *timeri, - tmr = q->timer; - if (tmr == NULL) - return; -- if (!tmr->running) -+ spin_lock_irqsave(&tmr->lock, flags); -+ if (!tmr->running) { -+ spin_unlock_irqrestore(&tmr->lock, flags); - return; -+ } - - resolution *= ticks; - if (tmr->skew != tmr->skew_base) { -@@ -150,8 +160,6 @@ static void snd_seq_timer_interrupt(struct snd_timer_instance *timeri, - (((resolution & 0xffff) * tmr->skew) >> 16); - } - -- spin_lock_irqsave(&tmr->lock, flags); -- - /* update timer */ - snd_seq_inc_time_nsec(&tmr->cur_time, resolution); - -@@ -298,26 +306,30 @@ int snd_seq_timer_open(struct snd_seq_queue *q) - t->callback = snd_seq_timer_interrupt; - t->callback_data = q; - t->flags |= SNDRV_TIMER_IFLG_AUTO; -+ spin_lock_irq(&tmr->lock); - tmr->timeri = t; -+ spin_unlock_irq(&tmr->lock); - return 0; - } - - int snd_seq_timer_close(struct snd_seq_queue *q) - { - struct snd_seq_timer *tmr; -+ struct snd_timer_instance *t; - - tmr = q->timer; - if (snd_BUG_ON(!tmr)) - return -EINVAL; -- if (tmr->timeri) { -- snd_timer_stop(tmr->timeri); -- snd_timer_close(tmr->timeri); -- tmr->timeri = NULL; -- } -+ spin_lock_irq(&tmr->lock); -+ t = tmr->timeri; -+ tmr->timeri = NULL; -+ spin_unlock_irq(&tmr->lock); -+ if (t) -+ snd_timer_close(t); - return 0; - } - --int snd_seq_timer_stop(struct snd_seq_timer * tmr) -+static int seq_timer_stop(struct snd_seq_timer *tmr) - { - if (! tmr->timeri) - return -EINVAL; -@@ -328,6 +340,17 @@ int snd_seq_timer_stop(struct snd_seq_timer * tmr) - return 0; - } - -+int snd_seq_timer_stop(struct snd_seq_timer *tmr) -+{ -+ unsigned long flags; -+ int err; -+ -+ spin_lock_irqsave(&tmr->lock, flags); -+ err = seq_timer_stop(tmr); -+ spin_unlock_irqrestore(&tmr->lock, flags); -+ return err; -+} -+ - static int initialize_timer(struct snd_seq_timer *tmr) - { - struct snd_timer *t; -@@ -360,13 +383,13 @@ static int initialize_timer(struct snd_seq_timer *tmr) - return 0; - } - --int snd_seq_timer_start(struct snd_seq_timer * tmr) -+static int seq_timer_start(struct snd_seq_timer *tmr) - { - if (! tmr->timeri) - return -EINVAL; - if (tmr->running) -- snd_seq_timer_stop(tmr); -- snd_seq_timer_reset(tmr); -+ seq_timer_stop(tmr); -+ seq_timer_reset(tmr); - if (initialize_timer(tmr) < 0) - return -EINVAL; - snd_timer_start(tmr->timeri, tmr->ticks); -@@ -375,14 +398,25 @@ int snd_seq_timer_start(struct snd_seq_timer * tmr) - return 0; - } - --int snd_seq_timer_continue(struct snd_seq_timer * tmr) -+int snd_seq_timer_start(struct snd_seq_timer *tmr) -+{ -+ unsigned long flags; -+ int err; -+ -+ spin_lock_irqsave(&tmr->lock, flags); -+ err = seq_timer_start(tmr); -+ spin_unlock_irqrestore(&tmr->lock, flags); -+ return err; -+} -+ -+static int seq_timer_continue(struct snd_seq_timer *tmr) - { - if (! tmr->timeri) - return -EINVAL; - if (tmr->running) - return -EBUSY; - if (! tmr->initialized) { -- snd_seq_timer_reset(tmr); -+ seq_timer_reset(tmr); - if (initialize_timer(tmr) < 0) - return -EINVAL; - } -@@ -392,11 +426,24 @@ int snd_seq_timer_continue(struct snd_seq_timer * tmr) - return 0; - } - -+int snd_seq_timer_continue(struct snd_seq_timer *tmr) -+{ -+ unsigned long flags; -+ int err; -+ -+ spin_lock_irqsave(&tmr->lock, flags); -+ err = seq_timer_continue(tmr); -+ spin_unlock_irqrestore(&tmr->lock, flags); -+ return err; -+} -+ - /* return current 'real' time. use timeofday() to get better granularity. */ - snd_seq_real_time_t snd_seq_timer_get_cur_time(struct snd_seq_timer *tmr) - { - snd_seq_real_time_t cur_time; -+ unsigned long flags; - -+ spin_lock_irqsave(&tmr->lock, flags); - cur_time = tmr->cur_time; - if (tmr->running) { - struct timeval tm; -@@ -412,7 +459,7 @@ snd_seq_real_time_t snd_seq_timer_get_cur_time(struct snd_seq_timer *tmr) - } - snd_seq_sanity_real_time(&cur_time); - } -- -+ spin_unlock_irqrestore(&tmr->lock, flags); - return cur_time; - } - -diff --git a/sound/core/seq/seq_virmidi.c b/sound/core/seq/seq_virmidi.c -index 4b50e604276d..0fa691e01384 100644 ---- a/sound/core/seq/seq_virmidi.c -+++ b/sound/core/seq/seq_virmidi.c -@@ -254,9 +254,13 @@ static int snd_virmidi_output_open(struct snd_rawmidi_substream *substream) - */ - static int snd_virmidi_input_close(struct snd_rawmidi_substream *substream) - { -+ struct snd_virmidi_dev *rdev = substream->rmidi->private_data; - struct snd_virmidi *vmidi = substream->runtime->private_data; -- snd_midi_event_free(vmidi->parser); -+ -+ write_lock_irq(&rdev->filelist_lock); - list_del(&vmidi->list); -+ write_unlock_irq(&rdev->filelist_lock); -+ snd_midi_event_free(vmidi->parser); - substream->runtime->private_data = NULL; - kfree(vmidi); - return 0; -diff --git a/sound/core/timer.c b/sound/core/timer.c -index 4e436fe53afa..d90d8f4b85fe 100644 ---- a/sound/core/timer.c -+++ b/sound/core/timer.c -@@ -300,8 +300,7 @@ int snd_timer_open(struct snd_timer_instance **ti, - return 0; - } - --static int _snd_timer_stop(struct snd_timer_instance *timeri, -- int keep_flag, int event); -+static int _snd_timer_stop(struct snd_timer_instance *timeri, int event); - - /* - * close a timer instance -@@ -343,7 +342,7 @@ int snd_timer_close(struct snd_timer_instance *timeri) - spin_unlock_irq(&timer->lock); - mutex_lock(®ister_mutex); - list_del(&timeri->open_list); -- if (timer && list_empty(&timer->open_list_head) && -+ if (list_empty(&timer->open_list_head) && - timer->hw.close) - timer->hw.close(timer); - /* remove slave links */ -@@ -415,7 +414,7 @@ static void snd_timer_notify1(struct snd_timer_instance *ti, int event) - spin_lock_irqsave(&timer->lock, flags); - list_for_each_entry(ts, &ti->slave_active_head, active_list) - if (ts->ccallback) -- ts->ccallback(ti, event + 100, &tstamp, resolution); -+ ts->ccallback(ts, event + 100, &tstamp, resolution); - spin_unlock_irqrestore(&timer->lock, flags); - } - -@@ -444,6 +443,10 @@ static int snd_timer_start_slave(struct snd_timer_instance *timeri) - unsigned long flags; - - spin_lock_irqsave(&slave_active_lock, flags); -+ if (timeri->flags & SNDRV_TIMER_IFLG_RUNNING) { -+ spin_unlock_irqrestore(&slave_active_lock, flags); -+ return -EBUSY; -+ } - timeri->flags |= SNDRV_TIMER_IFLG_RUNNING; - if (timeri->master && timeri->timer) { - spin_lock(&timeri->timer->lock); -@@ -468,23 +471,30 @@ int snd_timer_start(struct snd_timer_instance *timeri, unsigned int ticks) - return -EINVAL; - if (timeri->flags & SNDRV_TIMER_IFLG_SLAVE) { - result = snd_timer_start_slave(timeri); -- snd_timer_notify1(timeri, SNDRV_TIMER_EVENT_START); -+ if (result >= 0) -+ snd_timer_notify1(timeri, SNDRV_TIMER_EVENT_START); - return result; - } - timer = timeri->timer; - if (timer == NULL) - return -EINVAL; - spin_lock_irqsave(&timer->lock, flags); -+ if (timeri->flags & (SNDRV_TIMER_IFLG_RUNNING | -+ SNDRV_TIMER_IFLG_START)) { -+ result = -EBUSY; -+ goto unlock; -+ } - timeri->ticks = timeri->cticks = ticks; - timeri->pticks = 0; - result = snd_timer_start1(timer, timeri, ticks); -+ unlock: - spin_unlock_irqrestore(&timer->lock, flags); -- snd_timer_notify1(timeri, SNDRV_TIMER_EVENT_START); -+ if (result >= 0) -+ snd_timer_notify1(timeri, SNDRV_TIMER_EVENT_START); - return result; - } - --static int _snd_timer_stop(struct snd_timer_instance * timeri, -- int keep_flag, int event) -+static int _snd_timer_stop(struct snd_timer_instance *timeri, int event) - { - struct snd_timer *timer; - unsigned long flags; -@@ -493,19 +503,30 @@ static int _snd_timer_stop(struct snd_timer_instance * timeri, - return -ENXIO; - - if (timeri->flags & SNDRV_TIMER_IFLG_SLAVE) { -- if (!keep_flag) { -- spin_lock_irqsave(&slave_active_lock, flags); -- timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING; -- list_del_init(&timeri->ack_list); -- list_del_init(&timeri->active_list); -+ spin_lock_irqsave(&slave_active_lock, flags); -+ if (!(timeri->flags & SNDRV_TIMER_IFLG_RUNNING)) { - spin_unlock_irqrestore(&slave_active_lock, flags); -+ return -EBUSY; - } -+ if (timeri->timer) -+ spin_lock(&timeri->timer->lock); -+ timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING; -+ list_del_init(&timeri->ack_list); -+ list_del_init(&timeri->active_list); -+ if (timeri->timer) -+ spin_unlock(&timeri->timer->lock); -+ spin_unlock_irqrestore(&slave_active_lock, flags); - goto __end; - } - timer = timeri->timer; - if (!timer) - return -EINVAL; - spin_lock_irqsave(&timer->lock, flags); -+ if (!(timeri->flags & (SNDRV_TIMER_IFLG_RUNNING | -+ SNDRV_TIMER_IFLG_START))) { -+ spin_unlock_irqrestore(&timer->lock, flags); -+ return -EBUSY; -+ } - list_del_init(&timeri->ack_list); - list_del_init(&timeri->active_list); - if ((timeri->flags & SNDRV_TIMER_IFLG_RUNNING) && -@@ -520,9 +541,7 @@ static int _snd_timer_stop(struct snd_timer_instance * timeri, - } - } - } -- if (!keep_flag) -- timeri->flags &= -- ~(SNDRV_TIMER_IFLG_RUNNING | SNDRV_TIMER_IFLG_START); -+ timeri->flags &= ~(SNDRV_TIMER_IFLG_RUNNING | SNDRV_TIMER_IFLG_START); - spin_unlock_irqrestore(&timer->lock, flags); - __end: - if (event != SNDRV_TIMER_EVENT_RESOLUTION) -@@ -541,7 +560,7 @@ int snd_timer_stop(struct snd_timer_instance *timeri) - unsigned long flags; - int err; - -- err = _snd_timer_stop(timeri, 0, SNDRV_TIMER_EVENT_STOP); -+ err = _snd_timer_stop(timeri, SNDRV_TIMER_EVENT_STOP); - if (err < 0) - return err; - timer = timeri->timer; -@@ -571,10 +590,15 @@ int snd_timer_continue(struct snd_timer_instance *timeri) - if (! timer) - return -EINVAL; - spin_lock_irqsave(&timer->lock, flags); -+ if (timeri->flags & SNDRV_TIMER_IFLG_RUNNING) { -+ result = -EBUSY; -+ goto unlock; -+ } - if (!timeri->cticks) - timeri->cticks = 1; - timeri->pticks = 0; - result = snd_timer_start1(timer, timeri, timer->sticks); -+ unlock: - spin_unlock_irqrestore(&timer->lock, flags); - snd_timer_notify1(timeri, SNDRV_TIMER_EVENT_CONTINUE); - return result; -@@ -585,7 +609,7 @@ int snd_timer_continue(struct snd_timer_instance *timeri) - */ - int snd_timer_pause(struct snd_timer_instance * timeri) - { -- return _snd_timer_stop(timeri, 0, SNDRV_TIMER_EVENT_PAUSE); -+ return _snd_timer_stop(timeri, SNDRV_TIMER_EVENT_PAUSE); - } - - /* -@@ -702,8 +726,8 @@ void snd_timer_interrupt(struct snd_timer * timer, unsigned long ticks_left) - ti->cticks = ti->ticks; - } else { - ti->flags &= ~SNDRV_TIMER_IFLG_RUNNING; -- if (--timer->running) -- list_del_init(&ti->active_list); -+ --timer->running; -+ list_del_init(&ti->active_list); - } - if ((timer->hw.flags & SNDRV_TIMER_HW_TASKLET) || - (ti->flags & SNDRV_TIMER_IFLG_FAST)) -diff --git a/sound/drivers/dummy.c b/sound/drivers/dummy.c -index 915b4d7fbb23..8946cef245fc 100644 ---- a/sound/drivers/dummy.c -+++ b/sound/drivers/dummy.c -@@ -109,6 +109,9 @@ struct dummy_timer_ops { - snd_pcm_uframes_t (*pointer)(struct snd_pcm_substream *); - }; - -+#define get_dummy_ops(substream) \ -+ (*(const struct dummy_timer_ops **)(substream)->runtime->private_data) -+ - struct dummy_model { - const char *name; - int (*playback_constraints)(struct snd_pcm_runtime *runtime); -@@ -137,7 +140,6 @@ struct snd_dummy { - int iobox; - struct snd_kcontrol *cd_volume_ctl; - struct snd_kcontrol *cd_switch_ctl; -- const struct dummy_timer_ops *timer_ops; - }; - - /* -@@ -231,6 +233,8 @@ struct dummy_model *dummy_models[] = { - */ - - struct dummy_systimer_pcm { -+ /* ops must be the first item */ -+ const struct dummy_timer_ops *timer_ops; - spinlock_t lock; - struct timer_list timer; - unsigned long base_time; -@@ -368,6 +372,8 @@ static struct dummy_timer_ops dummy_systimer_ops = { - */ - - struct dummy_hrtimer_pcm { -+ /* ops must be the first item */ -+ const struct dummy_timer_ops *timer_ops; - ktime_t base_time; - ktime_t period_time; - atomic_t running; -@@ -494,31 +500,25 @@ static struct dummy_timer_ops dummy_hrtimer_ops = { - - static int dummy_pcm_trigger(struct snd_pcm_substream *substream, int cmd) - { -- struct snd_dummy *dummy = snd_pcm_substream_chip(substream); -- - switch (cmd) { - case SNDRV_PCM_TRIGGER_START: - case SNDRV_PCM_TRIGGER_RESUME: -- return dummy->timer_ops->start(substream); -+ return get_dummy_ops(substream)->start(substream); - case SNDRV_PCM_TRIGGER_STOP: - case SNDRV_PCM_TRIGGER_SUSPEND: -- return dummy->timer_ops->stop(substream); -+ return get_dummy_ops(substream)->stop(substream); - } - return -EINVAL; - } - - static int dummy_pcm_prepare(struct snd_pcm_substream *substream) - { -- struct snd_dummy *dummy = snd_pcm_substream_chip(substream); -- -- return dummy->timer_ops->prepare(substream); -+ return get_dummy_ops(substream)->prepare(substream); - } - - static snd_pcm_uframes_t dummy_pcm_pointer(struct snd_pcm_substream *substream) - { -- struct snd_dummy *dummy = snd_pcm_substream_chip(substream); -- -- return dummy->timer_ops->pointer(substream); -+ return get_dummy_ops(substream)->pointer(substream); - } - - static struct snd_pcm_hardware dummy_pcm_hardware = { -@@ -564,17 +564,19 @@ static int dummy_pcm_open(struct snd_pcm_substream *substream) - struct snd_dummy *dummy = snd_pcm_substream_chip(substream); - struct dummy_model *model = dummy->model; - struct snd_pcm_runtime *runtime = substream->runtime; -+ const struct dummy_timer_ops *ops; - int err; - -- dummy->timer_ops = &dummy_systimer_ops; -+ ops = &dummy_systimer_ops; - #ifdef CONFIG_HIGH_RES_TIMERS - if (hrtimer) -- dummy->timer_ops = &dummy_hrtimer_ops; -+ ops = &dummy_hrtimer_ops; - #endif - -- err = dummy->timer_ops->create(substream); -+ err = ops->create(substream); - if (err < 0) - return err; -+ get_dummy_ops(substream) = ops; - - runtime->hw = dummy->pcm_hw; - if (substream->pcm->device & 1) { -@@ -596,7 +598,7 @@ static int dummy_pcm_open(struct snd_pcm_substream *substream) - err = model->capture_constraints(substream->runtime); - } - if (err < 0) { -- dummy->timer_ops->free(substream); -+ get_dummy_ops(substream)->free(substream); - return err; - } - return 0; -@@ -604,8 +606,7 @@ static int dummy_pcm_open(struct snd_pcm_substream *substream) - - static int dummy_pcm_close(struct snd_pcm_substream *substream) - { -- struct snd_dummy *dummy = snd_pcm_substream_chip(substream); -- dummy->timer_ops->free(substream); -+ get_dummy_ops(substream)->free(substream); - return 0; - } - -diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c -index 3c90743fa50b..eef182bea2ad 100644 ---- a/sound/pci/hda/patch_cirrus.c -+++ b/sound/pci/hda/patch_cirrus.c -@@ -617,6 +617,7 @@ enum { - CS4208_MAC_AUTO, - CS4208_MBA6, - CS4208_MBP11, -+ CS4208_MACMINI, - CS4208_GPIO0, - }; - -@@ -624,6 +625,7 @@ static const struct hda_model_fixup cs4208_models[] = { - { .id = CS4208_GPIO0, .name = "gpio0" }, - { .id = CS4208_MBA6, .name = "mba6" }, - { .id = CS4208_MBP11, .name = "mbp11" }, -+ { .id = CS4208_MACMINI, .name = "macmini" }, - {} - }; - -@@ -635,6 +637,7 @@ static const struct snd_pci_quirk cs4208_fixup_tbl[] = { - /* codec SSID matching */ - static const struct snd_pci_quirk cs4208_mac_fixup_tbl[] = { - SND_PCI_QUIRK(0x106b, 0x5e00, "MacBookPro 11,2", CS4208_MBP11), -+ SND_PCI_QUIRK(0x106b, 0x6c00, "MacMini 7,1", CS4208_MACMINI), - SND_PCI_QUIRK(0x106b, 0x7100, "MacBookAir 6,1", CS4208_MBA6), - SND_PCI_QUIRK(0x106b, 0x7200, "MacBookAir 6,2", CS4208_MBA6), - SND_PCI_QUIRK(0x106b, 0x7b00, "MacBookPro 12,1", CS4208_MBP11), -@@ -667,6 +670,24 @@ static void cs4208_fixup_mac(struct hda_codec *codec, - snd_hda_apply_fixup(codec, action); - } - -+/* MacMini 7,1 has the inverted jack detection */ -+static void cs4208_fixup_macmini(struct hda_codec *codec, -+ const struct hda_fixup *fix, int action) -+{ -+ static const struct hda_pintbl pincfgs[] = { -+ { 0x18, 0x00ab9150 }, /* mic (audio-in) jack: disable detect */ -+ { 0x21, 0x004be140 }, /* SPDIF: disable detect */ -+ { } -+ }; -+ -+ if (action == HDA_FIXUP_ACT_PRE_PROBE) { -+ /* HP pin (0x10) has an inverted detection */ -+ codec->inv_jack_detect = 1; -+ /* disable the bogus Mic and SPDIF jack detections */ -+ snd_hda_apply_pincfgs(codec, pincfgs); -+ } -+} -+ - static int cs4208_spdif_sw_put(struct snd_kcontrol *kcontrol, - struct snd_ctl_elem_value *ucontrol) - { -@@ -710,6 +731,12 @@ static const struct hda_fixup cs4208_fixups[] = { - .chained = true, - .chain_id = CS4208_GPIO0, - }, -+ [CS4208_MACMINI] = { -+ .type = HDA_FIXUP_FUNC, -+ .v.func = cs4208_fixup_macmini, -+ .chained = true, -+ .chain_id = CS4208_GPIO0, -+ }, - [CS4208_GPIO0] = { - .type = HDA_FIXUP_FUNC, - .v.func = cs4208_fixup_gpio0, -diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c -index 611110a3f1a4..55ce39df9cd7 100644 ---- a/sound/pci/hda/patch_hdmi.c -+++ b/sound/pci/hda/patch_hdmi.c -@@ -426,7 +426,8 @@ static int hdmi_eld_ctl_get(struct snd_kcontrol *kcontrol, - eld = &per_pin->sink_eld; - - mutex_lock(&per_pin->lock); -- if (eld->eld_size > ARRAY_SIZE(ucontrol->value.bytes.data)) { -+ if (eld->eld_size > ARRAY_SIZE(ucontrol->value.bytes.data) || -+ eld->eld_size > ELD_MAX_SIZE) { - mutex_unlock(&per_pin->lock); - snd_BUG(); - return -EINVAL; -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index bd0b986f7d50..eeb5b68e9e3e 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -2266,6 +2266,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = { - SND_PCI_QUIRK(0x104d, 0x9047, "Sony Vaio TT", ALC889_FIXUP_VAIO_TT), - SND_PCI_QUIRK(0x104d, 0x905a, "Sony Vaio Z", ALC882_FIXUP_NO_PRIMARY_HP), - SND_PCI_QUIRK(0x104d, 0x9043, "Sony Vaio VGC-LN51JGB", ALC882_FIXUP_NO_PRIMARY_HP), -+ SND_PCI_QUIRK(0x104d, 0x9044, "Sony VAIO AiO", ALC882_FIXUP_NO_PRIMARY_HP), - - /* All Apple entries are in codec SSIDs */ - SND_PCI_QUIRK(0x106b, 0x00a0, "MacBookPro 3,1", ALC889_FIXUP_MBP_VREF), -diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c -index e28704e1274a..431a89b75ff3 100644 ---- a/sound/soc/soc-pcm.c -+++ b/sound/soc/soc-pcm.c -@@ -1404,7 +1404,8 @@ int dpcm_be_dai_hw_free(struct snd_soc_pcm_runtime *fe, int stream) - (be->dpcm[stream].state != SND_SOC_DPCM_STATE_PREPARE) && - (be->dpcm[stream].state != SND_SOC_DPCM_STATE_HW_FREE) && - (be->dpcm[stream].state != SND_SOC_DPCM_STATE_PAUSED) && -- (be->dpcm[stream].state != SND_SOC_DPCM_STATE_STOP)) -+ (be->dpcm[stream].state != SND_SOC_DPCM_STATE_STOP) && -+ (be->dpcm[stream].state != SND_SOC_DPCM_STATE_SUSPEND)) - continue; - - dev_dbg(be->dev, "ASoC: hw_free BE %s\n", -diff --git a/sound/usb/midi.c b/sound/usb/midi.c -index 9123fc518f07..424c1e874bd3 100644 ---- a/sound/usb/midi.c -+++ b/sound/usb/midi.c -@@ -2365,7 +2365,6 @@ int snd_usbmidi_create(struct snd_card *card, - else - err = snd_usbmidi_create_endpoints(umidi, endpoints); - if (err < 0) { -- snd_usbmidi_free(umidi); - return err; - } - -diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c -index 901f87dea827..9a599b1bc6ba 100644 ---- a/sound/usb/quirks.c -+++ b/sound/usb/quirks.c -@@ -1128,8 +1128,12 @@ void snd_usb_set_interface_quirk(struct usb_device *dev) - * "Playback Design" products need a 50ms delay after setting the - * USB interface. - */ -- if (le16_to_cpu(dev->descriptor.idVendor) == 0x23ba) -+ switch (le16_to_cpu(dev->descriptor.idVendor)) { -+ case 0x23ba: /* Playback Design */ -+ case 0x0644: /* TEAC Corp. */ - mdelay(50); -+ break; -+ } - } - - void snd_usb_ctl_msg_quirk(struct usb_device *dev, unsigned int pipe, -@@ -1144,6 +1148,14 @@ void snd_usb_ctl_msg_quirk(struct usb_device *dev, unsigned int pipe, - (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS) - mdelay(20); - -+ /* -+ * "TEAC Corp." products need a 20ms delay after each -+ * class compliant request -+ */ -+ if ((le16_to_cpu(dev->descriptor.idVendor) == 0x0644) && -+ (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS) -+ mdelay(20); -+ - /* Marantz/Denon devices with USB DAC functionality need a delay - * after each class compliant request - */ diff --git a/patch/kernel/odroidc2-default/patch-3.14.61-62.patch b/patch/kernel/odroidc2-default/patch-3.14.61-62.patch deleted file mode 100644 index 0ff567447d..0000000000 --- a/patch/kernel/odroidc2-default/patch-3.14.61-62.patch +++ /dev/null @@ -1,2180 +0,0 @@ -diff --git a/Makefile b/Makefile -index fbf4ec689957..b738f644c71e 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 3 - PATCHLEVEL = 14 --SUBLEVEL = 61 -+SUBLEVEL = 62 - EXTRAVERSION = - NAME = Remembering Coco - -diff --git a/arch/arm/boot/dts/kirkwood-ts219.dtsi b/arch/arm/boot/dts/kirkwood-ts219.dtsi -index 911f3a8cee23..f4227da77265 100644 ---- a/arch/arm/boot/dts/kirkwood-ts219.dtsi -+++ b/arch/arm/boot/dts/kirkwood-ts219.dtsi -@@ -47,7 +47,7 @@ - }; - poweroff@12100 { - compatible = "qnap,power-off"; -- reg = <0x12000 0x100>; -+ reg = <0x12100 0x100>; - clocks = <&gate_clk 7>; - }; - spi@10600 { -diff --git a/arch/arm/common/icst.c b/arch/arm/common/icst.c -index 2dc6da70ae59..d7ed252708c5 100644 ---- a/arch/arm/common/icst.c -+++ b/arch/arm/common/icst.c -@@ -16,7 +16,7 @@ - */ - #include - #include -- -+#include - #include - - /* -@@ -29,7 +29,11 @@ EXPORT_SYMBOL(icst525_s2div); - - unsigned long icst_hz(const struct icst_params *p, struct icst_vco vco) - { -- return p->ref * 2 * (vco.v + 8) / ((vco.r + 2) * p->s2div[vco.s]); -+ u64 dividend = p->ref * 2 * (u64)(vco.v + 8); -+ u32 divisor = (vco.r + 2) * p->s2div[vco.s]; -+ -+ do_div(dividend, divisor); -+ return (unsigned long)dividend; - } - - EXPORT_SYMBOL(icst_hz); -@@ -58,6 +62,7 @@ icst_hz_to_vco(const struct icst_params *p, unsigned long freq) - - if (f > p->vco_min && f <= p->vco_max) - break; -+ i++; - } while (i < 8); - - if (i >= 8) -diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S -index fdedc31e0f40..093eff182d63 100644 ---- a/arch/arm/mm/proc-v7.S -+++ b/arch/arm/mm/proc-v7.S -@@ -95,7 +95,7 @@ ENDPROC(cpu_v7_dcache_clean_area) - .equ cpu_v7_suspend_size, 4 * 9 - #ifdef CONFIG_ARM_CPU_SUSPEND - ENTRY(cpu_v7_do_suspend) -- stmfd sp!, {r4 - r10, lr} -+ stmfd sp!, {r4 - r11, lr} - mrc p15, 0, r4, c13, c0, 0 @ FCSE/PID - mrc p15, 0, r5, c13, c0, 3 @ User r/o thread ID - stmia r0!, {r4 - r5} -@@ -112,7 +112,7 @@ ENTRY(cpu_v7_do_suspend) - mrc p15, 0, r9, c1, c0, 1 @ Auxiliary control register - mrc p15, 0, r10, c1, c0, 2 @ Co-processor access control - stmia r0, {r5 - r11} -- ldmfd sp!, {r4 - r10, pc} -+ ldmfd sp!, {r4 - r11, pc} - ENDPROC(cpu_v7_do_suspend) - - ENTRY(cpu_v7_do_resume) -diff --git a/arch/m32r/kernel/setup.c b/arch/m32r/kernel/setup.c -index 0392112a5d70..a5ecef7188ba 100644 ---- a/arch/m32r/kernel/setup.c -+++ b/arch/m32r/kernel/setup.c -@@ -81,7 +81,10 @@ static struct resource code_resource = { - }; - - unsigned long memory_start; -+EXPORT_SYMBOL(memory_start); -+ - unsigned long memory_end; -+EXPORT_SYMBOL(memory_end); - - void __init setup_arch(char **); - int get_cpuinfo(char *); -diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S -index 818dce344e82..b3bad672e5d9 100644 ---- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S -+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S -@@ -1805,7 +1805,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S) - - /* Emulate H_SET_DABR/X on P8 for the sake of compat mode guests */ - 2: rlwimi r5, r4, 5, DAWRX_DR | DAWRX_DW -- rlwimi r5, r4, 1, DAWRX_WT -+ rlwimi r5, r4, 2, DAWRX_WT - clrrdi r4, r4, 3 - std r4, VCPU_DAWR(r3) - std r5, VCPU_DAWRX(r3) -diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c -index fed892de9baf..bdd2a44fbb1a 100644 ---- a/arch/x86/mm/pageattr.c -+++ b/arch/x86/mm/pageattr.c -@@ -33,7 +33,7 @@ struct cpa_data { - pgd_t *pgd; - pgprot_t mask_set; - pgprot_t mask_clr; -- int numpages; -+ unsigned long numpages; - int flags; - unsigned long pfn; - unsigned force_split : 1; -@@ -1289,7 +1289,7 @@ static int __change_page_attr_set_clr(struct cpa_data *cpa, int checkalias) - * CPA operation. Either a large page has been - * preserved or a single page update happened. - */ -- BUG_ON(cpa->numpages > numpages); -+ BUG_ON(cpa->numpages > numpages || !cpa->numpages); - numpages -= cpa->numpages; - if (cpa->flags & (CPA_PAGES_ARRAY | CPA_ARRAY)) - cpa->curpage++; -diff --git a/block/blk-core.c b/block/blk-core.c -index e45b321cf6a0..46be0cddf819 100644 ---- a/block/blk-core.c -+++ b/block/blk-core.c -@@ -3164,6 +3164,9 @@ int blk_pre_runtime_suspend(struct request_queue *q) - { - int ret = 0; - -+ if (!q->dev) -+ return ret; -+ - spin_lock_irq(q->queue_lock); - if (q->nr_pending) { - ret = -EBUSY; -@@ -3191,6 +3194,9 @@ EXPORT_SYMBOL(blk_pre_runtime_suspend); - */ - void blk_post_runtime_suspend(struct request_queue *q, int err) - { -+ if (!q->dev) -+ return; -+ - spin_lock_irq(q->queue_lock); - if (!err) { - q->rpm_status = RPM_SUSPENDED; -@@ -3215,6 +3221,9 @@ EXPORT_SYMBOL(blk_post_runtime_suspend); - */ - void blk_pre_runtime_resume(struct request_queue *q) - { -+ if (!q->dev) -+ return; -+ - spin_lock_irq(q->queue_lock); - q->rpm_status = RPM_RESUMING; - spin_unlock_irq(q->queue_lock); -@@ -3237,6 +3246,9 @@ EXPORT_SYMBOL(blk_pre_runtime_resume); - */ - void blk_post_runtime_resume(struct request_queue *q, int err) - { -+ if (!q->dev) -+ return; -+ - spin_lock_irq(q->queue_lock); - if (!err) { - q->rpm_status = RPM_ACTIVE; -diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c -index de5ab4876a89..951ecd52226c 100644 ---- a/drivers/gpu/drm/i915/i915_gem.c -+++ b/drivers/gpu/drm/i915/i915_gem.c -@@ -3655,6 +3655,7 @@ unlock: - int i915_gem_set_caching_ioctl(struct drm_device *dev, void *data, - struct drm_file *file) - { -+ struct drm_i915_private *dev_priv = dev->dev_private; - struct drm_i915_gem_caching *args = data; - struct drm_i915_gem_object *obj; - enum i915_cache_level level; -@@ -3674,9 +3675,11 @@ int i915_gem_set_caching_ioctl(struct drm_device *dev, void *data, - return -EINVAL; - } - -+ intel_runtime_pm_get(dev_priv); -+ - ret = i915_mutex_lock_interruptible(dev); - if (ret) -- return ret; -+ goto rpm_put; - - obj = to_intel_bo(drm_gem_object_lookup(dev, file, args->handle)); - if (&obj->base == NULL) { -@@ -3689,6 +3692,9 @@ int i915_gem_set_caching_ioctl(struct drm_device *dev, void *data, - drm_gem_object_unreference(&obj->base); - unlock: - mutex_unlock(&dev->struct_mutex); -+rpm_put: -+ intel_runtime_pm_put(dev_priv); -+ - return ret; - } - -diff --git a/drivers/iio/adc/ad7793.c b/drivers/iio/adc/ad7793.c -index 4dddeabdfbb0..5da07546e182 100644 ---- a/drivers/iio/adc/ad7793.c -+++ b/drivers/iio/adc/ad7793.c -@@ -101,7 +101,7 @@ - #define AD7795_CH_AIN1M_AIN1M 8 /* AIN1(-) - AIN1(-) */ - - /* ID Register Bit Designations (AD7793_REG_ID) */ --#define AD7785_ID 0xB -+#define AD7785_ID 0x3 - #define AD7792_ID 0xA - #define AD7793_ID 0xB - #define AD7794_ID 0xF -diff --git a/drivers/iio/dac/ad5064.c b/drivers/iio/dac/ad5064.c -index f03b92fd3803..aac16fecdfa8 100644 ---- a/drivers/iio/dac/ad5064.c -+++ b/drivers/iio/dac/ad5064.c -@@ -113,12 +113,16 @@ enum ad5064_type { - ID_AD5065, - ID_AD5628_1, - ID_AD5628_2, -+ ID_AD5629_1, -+ ID_AD5629_2, - ID_AD5648_1, - ID_AD5648_2, - ID_AD5666_1, - ID_AD5666_2, - ID_AD5668_1, - ID_AD5668_2, -+ ID_AD5669_1, -+ ID_AD5669_2, - }; - - static int ad5064_write(struct ad5064_state *st, unsigned int cmd, -@@ -291,7 +295,7 @@ static const struct iio_chan_spec_ext_info ad5064_ext_info[] = { - { }, - }; - --#define AD5064_CHANNEL(chan, addr, bits) { \ -+#define AD5064_CHANNEL(chan, addr, bits, _shift) { \ - .type = IIO_VOLTAGE, \ - .indexed = 1, \ - .output = 1, \ -@@ -303,36 +307,39 @@ static const struct iio_chan_spec_ext_info ad5064_ext_info[] = { - .sign = 'u', \ - .realbits = (bits), \ - .storagebits = 16, \ -- .shift = 20 - bits, \ -+ .shift = (_shift), \ - }, \ - .ext_info = ad5064_ext_info, \ - } - --#define DECLARE_AD5064_CHANNELS(name, bits) \ -+#define DECLARE_AD5064_CHANNELS(name, bits, shift) \ - const struct iio_chan_spec name[] = { \ -- AD5064_CHANNEL(0, 0, bits), \ -- AD5064_CHANNEL(1, 1, bits), \ -- AD5064_CHANNEL(2, 2, bits), \ -- AD5064_CHANNEL(3, 3, bits), \ -- AD5064_CHANNEL(4, 4, bits), \ -- AD5064_CHANNEL(5, 5, bits), \ -- AD5064_CHANNEL(6, 6, bits), \ -- AD5064_CHANNEL(7, 7, bits), \ -+ AD5064_CHANNEL(0, 0, bits, shift), \ -+ AD5064_CHANNEL(1, 1, bits, shift), \ -+ AD5064_CHANNEL(2, 2, bits, shift), \ -+ AD5064_CHANNEL(3, 3, bits, shift), \ -+ AD5064_CHANNEL(4, 4, bits, shift), \ -+ AD5064_CHANNEL(5, 5, bits, shift), \ -+ AD5064_CHANNEL(6, 6, bits, shift), \ -+ AD5064_CHANNEL(7, 7, bits, shift), \ - } - --#define DECLARE_AD5065_CHANNELS(name, bits) \ -+#define DECLARE_AD5065_CHANNELS(name, bits, shift) \ - const struct iio_chan_spec name[] = { \ -- AD5064_CHANNEL(0, 0, bits), \ -- AD5064_CHANNEL(1, 3, bits), \ -+ AD5064_CHANNEL(0, 0, bits, shift), \ -+ AD5064_CHANNEL(1, 3, bits, shift), \ - } - --static DECLARE_AD5064_CHANNELS(ad5024_channels, 12); --static DECLARE_AD5064_CHANNELS(ad5044_channels, 14); --static DECLARE_AD5064_CHANNELS(ad5064_channels, 16); -+static DECLARE_AD5064_CHANNELS(ad5024_channels, 12, 8); -+static DECLARE_AD5064_CHANNELS(ad5044_channels, 14, 6); -+static DECLARE_AD5064_CHANNELS(ad5064_channels, 16, 4); - --static DECLARE_AD5065_CHANNELS(ad5025_channels, 12); --static DECLARE_AD5065_CHANNELS(ad5045_channels, 14); --static DECLARE_AD5065_CHANNELS(ad5065_channels, 16); -+static DECLARE_AD5065_CHANNELS(ad5025_channels, 12, 8); -+static DECLARE_AD5065_CHANNELS(ad5045_channels, 14, 6); -+static DECLARE_AD5065_CHANNELS(ad5065_channels, 16, 4); -+ -+static DECLARE_AD5064_CHANNELS(ad5629_channels, 12, 4); -+static DECLARE_AD5064_CHANNELS(ad5669_channels, 16, 0); - - static const struct ad5064_chip_info ad5064_chip_info_tbl[] = { - [ID_AD5024] = { -@@ -382,6 +389,18 @@ static const struct ad5064_chip_info ad5064_chip_info_tbl[] = { - .channels = ad5024_channels, - .num_channels = 8, - }, -+ [ID_AD5629_1] = { -+ .shared_vref = true, -+ .internal_vref = 2500000, -+ .channels = ad5629_channels, -+ .num_channels = 8, -+ }, -+ [ID_AD5629_2] = { -+ .shared_vref = true, -+ .internal_vref = 5000000, -+ .channels = ad5629_channels, -+ .num_channels = 8, -+ }, - [ID_AD5648_1] = { - .shared_vref = true, - .internal_vref = 2500000, -@@ -418,6 +437,18 @@ static const struct ad5064_chip_info ad5064_chip_info_tbl[] = { - .channels = ad5064_channels, - .num_channels = 8, - }, -+ [ID_AD5669_1] = { -+ .shared_vref = true, -+ .internal_vref = 2500000, -+ .channels = ad5669_channels, -+ .num_channels = 8, -+ }, -+ [ID_AD5669_2] = { -+ .shared_vref = true, -+ .internal_vref = 5000000, -+ .channels = ad5669_channels, -+ .num_channels = 8, -+ }, - }; - - static inline unsigned int ad5064_num_vref(struct ad5064_state *st) -@@ -598,10 +629,16 @@ static int ad5064_i2c_write(struct ad5064_state *st, unsigned int cmd, - unsigned int addr, unsigned int val) - { - struct i2c_client *i2c = to_i2c_client(st->dev); -+ int ret; - - st->data.i2c[0] = (cmd << 4) | addr; - put_unaligned_be16(val, &st->data.i2c[1]); -- return i2c_master_send(i2c, st->data.i2c, 3); -+ -+ ret = i2c_master_send(i2c, st->data.i2c, 3); -+ if (ret < 0) -+ return ret; -+ -+ return 0; - } - - static int ad5064_i2c_probe(struct i2c_client *i2c, -@@ -617,12 +654,12 @@ static int ad5064_i2c_remove(struct i2c_client *i2c) - } - - static const struct i2c_device_id ad5064_i2c_ids[] = { -- {"ad5629-1", ID_AD5628_1}, -- {"ad5629-2", ID_AD5628_2}, -- {"ad5629-3", ID_AD5628_2}, /* similar enough to ad5629-2 */ -- {"ad5669-1", ID_AD5668_1}, -- {"ad5669-2", ID_AD5668_2}, -- {"ad5669-3", ID_AD5668_2}, /* similar enough to ad5669-2 */ -+ {"ad5629-1", ID_AD5629_1}, -+ {"ad5629-2", ID_AD5629_2}, -+ {"ad5629-3", ID_AD5629_2}, /* similar enough to ad5629-2 */ -+ {"ad5669-1", ID_AD5669_1}, -+ {"ad5669-2", ID_AD5669_2}, -+ {"ad5669-3", ID_AD5669_2}, /* similar enough to ad5669-2 */ - {} - }; - MODULE_DEVICE_TABLE(i2c, ad5064_i2c_ids); -diff --git a/drivers/iio/dac/mcp4725.c b/drivers/iio/dac/mcp4725.c -index 7d9f5c31d2fc..0cedc81be312 100644 ---- a/drivers/iio/dac/mcp4725.c -+++ b/drivers/iio/dac/mcp4725.c -@@ -301,6 +301,7 @@ static int mcp4725_probe(struct i2c_client *client, - data->client = client; - - indio_dev->dev.parent = &client->dev; -+ indio_dev->name = id->name; - indio_dev->info = &mcp4725_info; - indio_dev->channels = &mcp4725_channel; - indio_dev->num_channels = 1; -diff --git a/drivers/iio/imu/adis_buffer.c b/drivers/iio/imu/adis_buffer.c -index cb32b593f1c5..36607d52fee0 100644 ---- a/drivers/iio/imu/adis_buffer.c -+++ b/drivers/iio/imu/adis_buffer.c -@@ -43,7 +43,7 @@ int adis_update_scan_mode(struct iio_dev *indio_dev, - return -ENOMEM; - - rx = adis->buffer; -- tx = rx + indio_dev->scan_bytes; -+ tx = rx + scan_count; - - spi_message_init(&adis->msg); - -diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c -index 37b52bd44f86..a9164b51b5dc 100644 ---- a/drivers/iio/industrialio-buffer.c -+++ b/drivers/iio/industrialio-buffer.c -@@ -830,7 +830,7 @@ int iio_scan_mask_set(struct iio_dev *indio_dev, - if (trialmask == NULL) - return -ENOMEM; - if (!indio_dev->masklength) { -- WARN_ON("Trying to set scanmask prior to registering buffer\n"); -+ WARN(1, "Trying to set scanmask prior to registering buffer\n"); - goto err_invalid_mask; - } - bitmap_copy(trialmask, buffer->scan_mask, indio_dev->masklength); -diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c -index acc911a836ca..a7b073b5e263 100644 ---- a/drivers/iio/industrialio-core.c -+++ b/drivers/iio/industrialio-core.c -@@ -589,7 +589,7 @@ int __iio_device_attr_init(struct device_attribute *dev_attr, - break; - case IIO_SEPARATE: - if (!chan->indexed) { -- WARN_ON("Differential channels must be indexed\n"); -+ WARN(1, "Differential channels must be indexed\n"); - ret = -EINVAL; - goto error_free_full_postfix; - } -diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c -index 94eaaf0c49b3..9e497e4041a6 100644 ---- a/drivers/input/mouse/elantech.c -+++ b/drivers/input/mouse/elantech.c -@@ -1111,7 +1111,7 @@ static int elantech_set_input_params(struct psmouse *psmouse) - input_set_abs_params(dev, ABS_TOOL_WIDTH, ETP_WMIN_V2, - ETP_WMAX_V2, 0, 0); - } -- input_mt_init_slots(dev, 2, 0); -+ input_mt_init_slots(dev, 2, INPUT_MT_SEMI_MT); - input_set_abs_params(dev, ABS_MT_POSITION_X, x_min, x_max, 0, 0); - input_set_abs_params(dev, ABS_MT_POSITION_Y, y_min, y_max, 0, 0); - break; -@@ -1387,6 +1387,13 @@ static const struct dmi_system_id no_hw_res_dmi_table[] = { - DMI_MATCH(DMI_PRODUCT_NAME, "U2442"), - }, - }, -+ { -+ /* Fujitsu LIFEBOOK U745 does not work with crc_enabled == 0 */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK U745"), -+ }, -+ }, - #endif - { } - }; -diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h -index dd6d14d2337f..a4baf9677a45 100644 ---- a/drivers/input/serio/i8042-x86ia64io.h -+++ b/drivers/input/serio/i8042-x86ia64io.h -@@ -258,6 +258,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = { - }, - }, - { -+ /* Fujitsu Lifebook U745 */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK U745"), -+ }, -+ }, -+ { - /* Fujitsu T70H */ - .matches = { - DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), -diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c -index 158156543410..2d7bb594626c 100644 ---- a/drivers/iommu/dmar.c -+++ b/drivers/iommu/dmar.c -@@ -986,7 +986,7 @@ void dmar_disable_qi(struct intel_iommu *iommu) - - raw_spin_lock_irqsave(&iommu->register_lock, flags); - -- sts = dmar_readq(iommu->reg + DMAR_GSTS_REG); -+ sts = readl(iommu->reg + DMAR_GSTS_REG); - if (!(sts & DMA_GSTS_QIES)) - goto end; - -diff --git a/drivers/iommu/intel_irq_remapping.c b/drivers/iommu/intel_irq_remapping.c -index ef5f65dbafe9..ffad080db013 100644 ---- a/drivers/iommu/intel_irq_remapping.c -+++ b/drivers/iommu/intel_irq_remapping.c -@@ -489,7 +489,7 @@ static void iommu_disable_irq_remapping(struct intel_iommu *iommu) - - raw_spin_lock_irqsave(&iommu->register_lock, flags); - -- sts = dmar_readq(iommu->reg + DMAR_GSTS_REG); -+ sts = readl(iommu->reg + DMAR_GSTS_REG); - if (!(sts & DMA_GSTS_IRES)) - goto end; - -diff --git a/drivers/net/wan/x25_asy.c b/drivers/net/wan/x25_asy.c -index 5895f1978691..e98de425f8e0 100644 ---- a/drivers/net/wan/x25_asy.c -+++ b/drivers/net/wan/x25_asy.c -@@ -545,16 +545,12 @@ static void x25_asy_receive_buf(struct tty_struct *tty, - - static int x25_asy_open_tty(struct tty_struct *tty) - { -- struct x25_asy *sl = tty->disc_data; -+ struct x25_asy *sl; - int err; - - if (tty->ops->write == NULL) - return -EOPNOTSUPP; - -- /* First make sure we're not already connected. */ -- if (sl && sl->magic == X25_ASY_MAGIC) -- return -EEXIST; -- - /* OK. Find a free X.25 channel to use. */ - sl = x25_asy_alloc(); - if (sl == NULL) -diff --git a/drivers/phy/phy-twl4030-usb.c b/drivers/phy/phy-twl4030-usb.c -index aaac3594f83b..452b637be676 100644 ---- a/drivers/phy/phy-twl4030-usb.c -+++ b/drivers/phy/phy-twl4030-usb.c -@@ -777,6 +777,7 @@ static int twl4030_usb_remove(struct platform_device *pdev) - struct twl4030_usb *twl = platform_get_drvdata(pdev); - int val; - -+ usb_remove_phy(&twl->phy); - pm_runtime_get_sync(twl->dev); - cancel_delayed_work(&twl->id_workaround_work); - device_remove_file(twl->dev, &dev_attr_vbus); -diff --git a/drivers/platform/x86/intel_scu_ipcutil.c b/drivers/platform/x86/intel_scu_ipcutil.c -index 02bc5a6343c3..aa454241489c 100644 ---- a/drivers/platform/x86/intel_scu_ipcutil.c -+++ b/drivers/platform/x86/intel_scu_ipcutil.c -@@ -49,7 +49,7 @@ struct scu_ipc_data { - - static int scu_reg_access(u32 cmd, struct scu_ipc_data *data) - { -- int count = data->count; -+ unsigned int count = data->count; - - if (count == 0 || count == 3 || count > 4) - return -EINVAL; -diff --git a/drivers/scsi/device_handler/scsi_dh_rdac.c b/drivers/scsi/device_handler/scsi_dh_rdac.c -index 4b9cf93f3fb6..d233170cd439 100644 ---- a/drivers/scsi/device_handler/scsi_dh_rdac.c -+++ b/drivers/scsi/device_handler/scsi_dh_rdac.c -@@ -569,7 +569,7 @@ static int mode_select_handle_sense(struct scsi_device *sdev, - /* - * Command Lock contention - */ -- err = SCSI_DH_RETRY; -+ err = SCSI_DH_IMM_RETRY; - break; - default: - break; -@@ -619,6 +619,8 @@ retry: - err = mode_select_handle_sense(sdev, h->sense); - if (err == SCSI_DH_RETRY && retry_cnt--) - goto retry; -+ if (err == SCSI_DH_IMM_RETRY) -+ goto retry; - } - if (err == SCSI_DH_OK) { - h->state = RDAC_STATE_ACTIVE; -diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c -index f28ea070d3df..bd5fd3b7e178 100644 ---- a/drivers/scsi/hosts.c -+++ b/drivers/scsi/hosts.c -@@ -308,6 +308,17 @@ static void scsi_host_dev_release(struct device *dev) - kfree(queuedata); - } - -+ if (shost->shost_state == SHOST_CREATED) { -+ /* -+ * Free the shost_dev device name here if scsi_host_alloc() -+ * and scsi_host_put() have been called but neither -+ * scsi_host_add() nor scsi_host_remove() has been called. -+ * This avoids that the memory allocated for the shost_dev -+ * name is leaked. -+ */ -+ kfree(dev_name(&shost->shost_dev)); -+ } -+ - scsi_destroy_command_freelist(shost); - if (shost->bqt) - blk_free_tags(shost->bqt); -diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c -index 262ab837a704..8790e8640acd 100644 ---- a/drivers/scsi/scsi_devinfo.c -+++ b/drivers/scsi/scsi_devinfo.c -@@ -205,6 +205,7 @@ static struct { - {"Intel", "Multi-Flex", NULL, BLIST_NO_RSOC}, - {"iRiver", "iFP Mass Driver", NULL, BLIST_NOT_LOCKABLE | BLIST_INQUIRY_36}, - {"LASOUND", "CDX7405", "3.10", BLIST_MAX5LUN | BLIST_SINGLELUN}, -+ {"Marvell", "Console", NULL, BLIST_SKIP_VPD_PAGES}, - {"MATSHITA", "PD-1", NULL, BLIST_FORCELUN | BLIST_SINGLELUN}, - {"MATSHITA", "DMC-LC5", NULL, BLIST_NOT_LOCKABLE | BLIST_INQUIRY_36}, - {"MATSHITA", "DMC-LC40", NULL, BLIST_NOT_LOCKABLE | BLIST_INQUIRY_36}, -diff --git a/drivers/scsi/scsi_pm.c b/drivers/scsi/scsi_pm.c -index a59be67b92d5..88e136c716e9 100644 ---- a/drivers/scsi/scsi_pm.c -+++ b/drivers/scsi/scsi_pm.c -@@ -151,13 +151,13 @@ static int sdev_runtime_suspend(struct device *dev) - struct scsi_device *sdev = to_scsi_device(dev); - int err = 0; - -- if (pm && pm->runtime_suspend) { -- err = blk_pre_runtime_suspend(sdev->request_queue); -- if (err) -- return err; -+ err = blk_pre_runtime_suspend(sdev->request_queue); -+ if (err) -+ return err; -+ if (pm && pm->runtime_suspend) - err = pm->runtime_suspend(dev); -- blk_post_runtime_suspend(sdev->request_queue, err); -- } -+ blk_post_runtime_suspend(sdev->request_queue, err); -+ - return err; - } - -@@ -180,11 +180,11 @@ static int sdev_runtime_resume(struct device *dev) - const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL; - int err = 0; - -- if (pm && pm->runtime_resume) { -- blk_pre_runtime_resume(sdev->request_queue); -+ blk_pre_runtime_resume(sdev->request_queue); -+ if (pm && pm->runtime_resume) - err = pm->runtime_resume(dev); -- blk_post_runtime_resume(sdev->request_queue, err); -- } -+ blk_post_runtime_resume(sdev->request_queue, err); -+ - return err; - } - -diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c -index 665acbf83693..5706bb89f6a0 100644 ---- a/drivers/scsi/scsi_sysfs.c -+++ b/drivers/scsi/scsi_sysfs.c -@@ -882,7 +882,7 @@ sdev_store_queue_ramp_up_period(struct device *dev, - return -EINVAL; - - sdev->queue_ramp_up_period = msecs_to_jiffies(period); -- return period; -+ return count; - } - - static struct device_attribute sdev_attr_queue_ramp_up_period = -@@ -1123,31 +1123,25 @@ static void __scsi_remove_target(struct scsi_target *starget) - void scsi_remove_target(struct device *dev) - { - struct Scsi_Host *shost = dev_to_shost(dev->parent); -- struct scsi_target *starget, *last = NULL; -+ struct scsi_target *starget, *last_target = NULL; - unsigned long flags; - -- /* remove targets being careful to lookup next entry before -- * deleting the last -- */ -+restart: - spin_lock_irqsave(shost->host_lock, flags); - list_for_each_entry(starget, &shost->__targets, siblings) { -- if (starget->state == STARGET_DEL) -+ if (starget->state == STARGET_DEL || -+ starget == last_target) - continue; - if (starget->dev.parent == dev || &starget->dev == dev) { -- /* assuming new targets arrive at the end */ - kref_get(&starget->reap_ref); -+ last_target = starget; - spin_unlock_irqrestore(shost->host_lock, flags); -- if (last) -- scsi_target_reap(last); -- last = starget; - __scsi_remove_target(starget); -- spin_lock_irqsave(shost->host_lock, flags); -+ scsi_target_reap(starget); -+ goto restart; - } - } - spin_unlock_irqrestore(shost->host_lock, flags); -- -- if (last) -- scsi_target_reap(last); - } - EXPORT_SYMBOL(scsi_remove_target); - -diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c -index a10706409927..614531c14777 100644 ---- a/drivers/scsi/sd.c -+++ b/drivers/scsi/sd.c -@@ -3129,8 +3129,8 @@ static int sd_suspend_common(struct device *dev, bool ignore_stop_errors) - struct scsi_disk *sdkp = scsi_disk_get_from_dev(dev); - int ret = 0; - -- if (!sdkp) -- return 0; /* this can happen */ -+ if (!sdkp) /* E.g.: runtime suspend following sd_remove() */ -+ return 0; - - if (sdkp->WCE && sdkp->media_present) { - sd_printk(KERN_NOTICE, sdkp, "Synchronizing SCSI cache\n"); -@@ -3171,6 +3171,9 @@ static int sd_resume(struct device *dev) - struct scsi_disk *sdkp = scsi_disk_get_from_dev(dev); - int ret = 0; - -+ if (!sdkp) /* E.g.: runtime resume at the start of sd_probe() */ -+ return 0; -+ - if (!sdkp->device->manage_start_stop) - goto done; - -diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c -index 721d839d6c54..0be16bf5f0cd 100644 ---- a/drivers/scsi/sg.c -+++ b/drivers/scsi/sg.c -@@ -1258,7 +1258,7 @@ sg_mmap(struct file *filp, struct vm_area_struct *vma) - } - - sfp->mmap_called = 1; -- vma->vm_flags |= VM_DONTEXPAND | VM_DONTDUMP; -+ vma->vm_flags |= VM_IO | VM_DONTEXPAND | VM_DONTDUMP; - vma->vm_private_data = sfp; - vma->vm_ops = &sg_mmap_vm_ops; - return 0; -diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c -index 40d85929aefe..2d3d11021bb6 100644 ---- a/drivers/scsi/sr.c -+++ b/drivers/scsi/sr.c -@@ -142,6 +142,9 @@ static int sr_runtime_suspend(struct device *dev) - { - struct scsi_cd *cd = dev_get_drvdata(dev); - -+ if (!cd) /* E.g.: runtime suspend following sr_remove() */ -+ return 0; -+ - if (cd->media_present) - return -EBUSY; - else -@@ -995,6 +998,7 @@ static int sr_remove(struct device *dev) - - blk_queue_prep_rq(cd->device->request_queue, scsi_prep_fn); - del_gendisk(cd->disk); -+ dev_set_drvdata(dev, NULL); - - mutex_lock(&sr_ref_mutex); - kref_put(&cd->kref, sr_kref_release); -diff --git a/drivers/staging/iio/adc/lpc32xx_adc.c b/drivers/staging/iio/adc/lpc32xx_adc.c -index a876ce755351..22818550efd3 100644 ---- a/drivers/staging/iio/adc/lpc32xx_adc.c -+++ b/drivers/staging/iio/adc/lpc32xx_adc.c -@@ -76,7 +76,7 @@ static int lpc32xx_read_raw(struct iio_dev *indio_dev, - - if (mask == IIO_CHAN_INFO_RAW) { - mutex_lock(&indio_dev->mlock); -- clk_enable(info->clk); -+ clk_prepare_enable(info->clk); - /* Measurement setup */ - __raw_writel(AD_INTERNAL | (chan->address) | AD_REFp | AD_REFm, - LPC32XX_ADC_SELECT(info->adc_base)); -@@ -84,7 +84,7 @@ static int lpc32xx_read_raw(struct iio_dev *indio_dev, - __raw_writel(AD_PDN_CTRL | AD_STROBE, - LPC32XX_ADC_CTRL(info->adc_base)); - wait_for_completion(&info->completion); /* set by ISR */ -- clk_disable(info->clk); -+ clk_disable_unprepare(info->clk); - *val = info->value; - mutex_unlock(&indio_dev->mlock); - -diff --git a/drivers/staging/speakup/selection.c b/drivers/staging/speakup/selection.c -index ca04d3669acc..34a6deef1d6c 100644 ---- a/drivers/staging/speakup/selection.c -+++ b/drivers/staging/speakup/selection.c -@@ -140,7 +140,9 @@ static void __speakup_paste_selection(struct work_struct *work) - struct tty_ldisc *ld; - DECLARE_WAITQUEUE(wait, current); - -- ld = tty_ldisc_ref_wait(tty); -+ ld = tty_ldisc_ref(tty); -+ if (!ld) -+ goto tty_unref; - tty_buffer_lock_exclusive(&vc->port); - - add_wait_queue(&vc->paste_wait, &wait); -@@ -160,6 +162,7 @@ static void __speakup_paste_selection(struct work_struct *work) - - tty_buffer_unlock_exclusive(&vc->port); - tty_ldisc_deref(ld); -+tty_unref: - tty_kref_put(tty); - } - -diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c -index 9dbf17671439..c066e6e298c3 100644 ---- a/drivers/target/iscsi/iscsi_target.c -+++ b/drivers/target/iscsi/iscsi_target.c -@@ -4027,6 +4027,17 @@ reject: - return iscsit_add_reject(conn, ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf); - } - -+static bool iscsi_target_check_conn_state(struct iscsi_conn *conn) -+{ -+ bool ret; -+ -+ spin_lock_bh(&conn->state_lock); -+ ret = (conn->conn_state != TARG_CONN_STATE_LOGGED_IN); -+ spin_unlock_bh(&conn->state_lock); -+ -+ return ret; -+} -+ - int iscsi_target_rx_thread(void *arg) - { - int ret, rc; -@@ -4044,7 +4055,7 @@ int iscsi_target_rx_thread(void *arg) - * incoming iscsi/tcp socket I/O, and/or failing the connection. - */ - rc = wait_for_completion_interruptible(&conn->rx_login_comp); -- if (rc < 0) -+ if (rc < 0 || iscsi_target_check_conn_state(conn)) - return 0; - - if (conn->conn_transport->transport_type == ISCSI_INFINIBAND) { -diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c -index 1c0088fe9e99..83465617ad6d 100644 ---- a/drivers/target/iscsi/iscsi_target_configfs.c -+++ b/drivers/target/iscsi/iscsi_target_configfs.c -@@ -1876,7 +1876,8 @@ static void lio_tpg_release_fabric_acl( - } - - /* -- * Called with spin_lock_bh(struct se_portal_group->session_lock) held.. -+ * Called with spin_lock_irq(struct se_portal_group->session_lock) held -+ * or not held. - * - * Also, this function calls iscsit_inc_session_usage_count() on the - * struct iscsi_session in question. -@@ -1884,19 +1885,32 @@ static void lio_tpg_release_fabric_acl( - static int lio_tpg_shutdown_session(struct se_session *se_sess) - { - struct iscsi_session *sess = se_sess->fabric_sess_ptr; -+ struct se_portal_group *se_tpg = se_sess->se_tpg; -+ bool local_lock = false; -+ -+ if (!spin_is_locked(&se_tpg->session_lock)) { -+ spin_lock_irq(&se_tpg->session_lock); -+ local_lock = true; -+ } - - spin_lock(&sess->conn_lock); - if (atomic_read(&sess->session_fall_back_to_erl0) || - atomic_read(&sess->session_logout) || - (sess->time2retain_timer_flags & ISCSI_TF_EXPIRED)) { - spin_unlock(&sess->conn_lock); -+ if (local_lock) -+ spin_unlock_irq(&sess->conn_lock); - return 0; - } - atomic_set(&sess->session_reinstatement, 1); - spin_unlock(&sess->conn_lock); - - iscsit_stop_time2retain_timer(sess); -+ spin_unlock_irq(&se_tpg->session_lock); -+ - iscsit_stop_session(sess, 1, 1); -+ if (!local_lock) -+ spin_lock_irq(&se_tpg->session_lock); - - return 1; - } -diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c -index 25ad113c5978..abbac7fe64e2 100644 ---- a/drivers/target/iscsi/iscsi_target_nego.c -+++ b/drivers/target/iscsi/iscsi_target_nego.c -@@ -393,6 +393,7 @@ err: - if (login->login_complete) { - if (conn->rx_thread && conn->rx_thread_active) { - send_sig(SIGINT, conn->rx_thread, 1); -+ complete(&conn->rx_login_comp); - kthread_stop(conn->rx_thread); - } - if (conn->tx_thread && conn->tx_thread_active) { -diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c -index e49616eeb1cc..c3f9b9920d8d 100644 ---- a/drivers/tty/pty.c -+++ b/drivers/tty/pty.c -@@ -617,7 +617,14 @@ static void pty_unix98_remove(struct tty_driver *driver, struct tty_struct *tty) - /* this is called once with whichever end is closed last */ - static void pty_unix98_shutdown(struct tty_struct *tty) - { -- devpts_kill_index(tty->driver_data, tty->index); -+ struct inode *ptmx_inode; -+ -+ if (tty->driver->subtype == PTY_TYPE_MASTER) -+ ptmx_inode = tty->driver_data; -+ else -+ ptmx_inode = tty->link->driver_data; -+ devpts_kill_index(ptmx_inode, tty->index); -+ devpts_del_ref(ptmx_inode); - } - - static const struct tty_operations ptm_unix98_ops = { -@@ -708,6 +715,18 @@ static int ptmx_open(struct inode *inode, struct file *filp) - set_bit(TTY_PTY_LOCK, &tty->flags); /* LOCK THE SLAVE */ - tty->driver_data = inode; - -+ /* -+ * In the case where all references to ptmx inode are dropped and we -+ * still have /dev/tty opened pointing to the master/slave pair (ptmx -+ * is closed/released before /dev/tty), we must make sure that the inode -+ * is still valid when we call the final pty_unix98_shutdown, thus we -+ * hold an additional reference to the ptmx inode. For the same /dev/tty -+ * last close case, we also need to make sure the super_block isn't -+ * destroyed (devpts instance unmounted), before /dev/tty is closed and -+ * on its release devpts_kill_index is called. -+ */ -+ devpts_add_ref(inode); -+ - tty_add_file(tty, filp); - - slave_inode = devpts_pty_new(inode, -diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c -index 996f8f3fd423..1e1fed47eabc 100644 ---- a/drivers/tty/serial/8250/8250_pci.c -+++ b/drivers/tty/serial/8250/8250_pci.c -@@ -1613,6 +1613,9 @@ static int pci_eg20t_init(struct pci_dev *dev) - #endif - } - -+#define PCI_DEVICE_ID_EXAR_XR17V4358 0x4358 -+#define PCI_DEVICE_ID_EXAR_XR17V8358 0x8358 -+ - static int - pci_xr17c154_setup(struct serial_private *priv, - const struct pciserial_board *board, -@@ -1622,6 +1625,15 @@ pci_xr17c154_setup(struct serial_private *priv, - return pci_default_setup(priv, board, port, idx); - } - -+static inline int -+xr17v35x_has_slave(struct serial_private *priv) -+{ -+ const int dev_id = priv->dev->device; -+ -+ return ((dev_id == PCI_DEVICE_ID_EXAR_XR17V4358) || -+ (dev_id == PCI_DEVICE_ID_EXAR_XR17V8358)); -+} -+ - static int - pci_xr17v35x_setup(struct serial_private *priv, - const struct pciserial_board *board, -@@ -1636,6 +1648,13 @@ pci_xr17v35x_setup(struct serial_private *priv, - port->port.flags |= UPF_EXAR_EFR; - - /* -+ * Setup the uart clock for the devices on expansion slot to -+ * half the clock speed of the main chip (which is 125MHz) -+ */ -+ if (xr17v35x_has_slave(priv) && idx >= 8) -+ port->port.uartclk = (7812500 * 16 / 2); -+ -+ /* - * Setup Multipurpose Input/Output pins. - */ - if (idx == 0) { -@@ -1772,9 +1791,6 @@ pci_wch_ch353_setup(struct serial_private *priv, - #define PCI_DEVICE_ID_SUNIX_1999 0x1999 - - --#define PCI_DEVICE_ID_EXAR_XR17V4358 0x4358 --#define PCI_DEVICE_ID_EXAR_XR17V8358 0x8358 -- - /* Unknown vendors/cards - this should not be in linux/pci_ids.h */ - #define PCI_SUBDEVICE_ID_UNKNOWN_0x1584 0x1584 - #define PCI_SUBDEVICE_ID_UNKNOWN_0x1588 0x1588 -diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c -index 27688e3b0a4c..b63507bbf74b 100644 ---- a/drivers/usb/host/xhci.c -+++ b/drivers/usb/host/xhci.c -@@ -1523,7 +1523,9 @@ int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status) - xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb, - "HW died, freeing TD."); - urb_priv = urb->hcpriv; -- for (i = urb_priv->td_cnt; i < urb_priv->length; i++) { -+ for (i = urb_priv->td_cnt; -+ i < urb_priv->length && xhci->devs[urb->dev->slot_id]; -+ i++) { - td = urb_priv->td[i]; - if (!list_empty(&td->td_list)) - list_del_init(&td->td_list); -diff --git a/fs/aio.c b/fs/aio.c -index 3241659491b1..0612022162ad 100644 ---- a/fs/aio.c -+++ b/fs/aio.c -@@ -1375,11 +1375,16 @@ static ssize_t aio_setup_single_vector(struct kiocb *kiocb, - unsigned long *nr_segs, - struct iovec *iovec) - { -- if (unlikely(!access_ok(!rw, buf, kiocb->ki_nbytes))) -+ size_t len = kiocb->ki_nbytes; -+ -+ if (len > MAX_RW_COUNT) -+ len = MAX_RW_COUNT; -+ -+ if (unlikely(!access_ok(!rw, buf, len))) - return -EFAULT; - - iovec->iov_base = buf; -- iovec->iov_len = kiocb->ki_nbytes; -+ iovec->iov_len = len; - *nr_segs = 1; - return 0; - } -diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c -index 0529defbdf73..9b8447e4ac3f 100644 ---- a/fs/btrfs/backref.c -+++ b/fs/btrfs/backref.c -@@ -1264,7 +1264,8 @@ char *btrfs_ref_to_path(struct btrfs_root *fs_root, struct btrfs_path *path, - read_extent_buffer(eb, dest + bytes_left, - name_off, name_len); - if (eb != eb_in) { -- btrfs_tree_read_unlock_blocking(eb); -+ if (!path->skip_locking) -+ btrfs_tree_read_unlock_blocking(eb); - free_extent_buffer(eb); - } - ret = inode_ref_info(parent, 0, fs_root, path, &found_key); -@@ -1283,9 +1284,10 @@ char *btrfs_ref_to_path(struct btrfs_root *fs_root, struct btrfs_path *path, - eb = path->nodes[0]; - /* make sure we can use eb after releasing the path */ - if (eb != eb_in) { -- atomic_inc(&eb->refs); -- btrfs_tree_read_lock(eb); -- btrfs_set_lock_blocking_rw(eb, BTRFS_READ_LOCK); -+ if (!path->skip_locking) -+ btrfs_set_lock_blocking_rw(eb, BTRFS_READ_LOCK); -+ path->nodes[0] = NULL; -+ path->locks[0] = 0; - } - btrfs_release_path(path); - iref = btrfs_item_ptr(eb, slot, struct btrfs_inode_ref); -diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c -index 12e35566d2fc..cc4790f11795 100644 ---- a/fs/btrfs/delayed-inode.c -+++ b/fs/btrfs/delayed-inode.c -@@ -1686,7 +1686,7 @@ int btrfs_should_delete_dir_index(struct list_head *del_list, - * - */ - int btrfs_readdir_delayed_dir_index(struct dir_context *ctx, -- struct list_head *ins_list) -+ struct list_head *ins_list, bool *emitted) - { - struct btrfs_dir_item *di; - struct btrfs_delayed_item *curr, *next; -@@ -1730,6 +1730,7 @@ int btrfs_readdir_delayed_dir_index(struct dir_context *ctx, - - if (over) - return 1; -+ *emitted = true; - } - return 0; - } -diff --git a/fs/btrfs/delayed-inode.h b/fs/btrfs/delayed-inode.h -index f70119f25421..0167853c84ae 100644 ---- a/fs/btrfs/delayed-inode.h -+++ b/fs/btrfs/delayed-inode.h -@@ -144,7 +144,7 @@ void btrfs_put_delayed_items(struct list_head *ins_list, - int btrfs_should_delete_dir_index(struct list_head *del_list, - u64 index); - int btrfs_readdir_delayed_dir_index(struct dir_context *ctx, -- struct list_head *ins_list); -+ struct list_head *ins_list, bool *emitted); - - /* for init */ - int __init btrfs_delayed_inode_init(void); -diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index 7f0dcfc58cbf..08824fe6ef44 100644 ---- a/fs/btrfs/inode.c -+++ b/fs/btrfs/inode.c -@@ -5205,6 +5205,7 @@ static int btrfs_real_readdir(struct file *file, struct dir_context *ctx) - char *name_ptr; - int name_len; - int is_curr = 0; /* ctx->pos points to the current index? */ -+ bool emitted; - - /* FIXME, use a real flag for deciding about the key type */ - if (root->fs_info->tree_root == root) -@@ -5233,6 +5234,7 @@ static int btrfs_real_readdir(struct file *file, struct dir_context *ctx) - if (ret < 0) - goto err; - -+ emitted = false; - while (1) { - leaf = path->nodes[0]; - slot = path->slots[0]; -@@ -5312,6 +5314,7 @@ skip: - - if (over) - goto nopos; -+ emitted = true; - di_len = btrfs_dir_name_len(leaf, di) + - btrfs_dir_data_len(leaf, di) + sizeof(*di); - di_cur += di_len; -@@ -5324,11 +5327,20 @@ next: - if (key_type == BTRFS_DIR_INDEX_KEY) { - if (is_curr) - ctx->pos++; -- ret = btrfs_readdir_delayed_dir_index(ctx, &ins_list); -+ ret = btrfs_readdir_delayed_dir_index(ctx, &ins_list, &emitted); - if (ret) - goto nopos; - } - -+ /* -+ * If we haven't emitted any dir entry, we must not touch ctx->pos as -+ * it was was set to the termination value in previous call. We assume -+ * that "." and ".." were emitted if we reach this point and set the -+ * termination value as well for an empty directory. -+ */ -+ if (ctx->pos > 2 && !emitted) -+ goto nopos; -+ - /* Reached end of directory/root. Bump pos past the last item. */ - ctx->pos++; - -diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c -index 3299778391fd..0bd335a393f8 100644 ---- a/fs/cifs/cifsencrypt.c -+++ b/fs/cifs/cifsencrypt.c -@@ -710,7 +710,7 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp) - - ses->auth_key.response = kmalloc(baselen + tilen, GFP_KERNEL); - if (!ses->auth_key.response) { -- rc = ENOMEM; -+ rc = -ENOMEM; - ses->auth_key.len = 0; - goto setup_ntlmv2_rsp_ret; - } -diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c -index b334a89d6a66..1320d1ecc630 100644 ---- a/fs/cifs/readdir.c -+++ b/fs/cifs/readdir.c -@@ -849,6 +849,7 @@ int cifs_readdir(struct file *file, struct dir_context *ctx) - * if buggy server returns . and .. late do we want to - * check for that here? - */ -+ *tmp_buf = 0; - rc = cifs_filldir(current_entry, file, ctx, - tmp_buf, max_len); - if (rc) { -diff --git a/fs/devpts/inode.c b/fs/devpts/inode.c -index a726b9f29cb7..61af24e379ad 100644 ---- a/fs/devpts/inode.c -+++ b/fs/devpts/inode.c -@@ -564,6 +564,26 @@ void devpts_kill_index(struct inode *ptmx_inode, int idx) - mutex_unlock(&allocated_ptys_lock); - } - -+/* -+ * pty code needs to hold extra references in case of last /dev/tty close -+ */ -+ -+void devpts_add_ref(struct inode *ptmx_inode) -+{ -+ struct super_block *sb = pts_sb_from_inode(ptmx_inode); -+ -+ atomic_inc(&sb->s_active); -+ ihold(ptmx_inode); -+} -+ -+void devpts_del_ref(struct inode *ptmx_inode) -+{ -+ struct super_block *sb = pts_sb_from_inode(ptmx_inode); -+ -+ iput(ptmx_inode); -+ deactivate_super(sb); -+} -+ - /** - * devpts_pty_new -- create a new inode in /dev/pts/ - * @ptmx_inode: inode of the master -diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c -index 831cb305c63f..ae8ce49c0437 100644 ---- a/fs/ext4/resize.c -+++ b/fs/ext4/resize.c -@@ -186,7 +186,7 @@ static struct ext4_new_flex_group_data *alloc_flex_gd(unsigned long flexbg_size) - if (flex_gd == NULL) - goto out3; - -- if (flexbg_size >= UINT_MAX / sizeof(struct ext4_new_flex_group_data)) -+ if (flexbg_size >= UINT_MAX / sizeof(struct ext4_new_group_data)) - goto out2; - flex_gd->count = flexbg_size; - -diff --git a/fs/fuse/file.c b/fs/fuse/file.c -index d8a60270581c..f9785e3c63ac 100644 ---- a/fs/fuse/file.c -+++ b/fs/fuse/file.c -@@ -1006,6 +1006,7 @@ static ssize_t fuse_fill_write_pages(struct fuse_req *req, - tmp = iov_iter_copy_from_user_atomic(page, ii, offset, bytes); - flush_dcache_page(page); - -+ iov_iter_advance(ii, tmp); - if (!tmp) { - unlock_page(page); - page_cache_release(page); -@@ -1018,7 +1019,6 @@ static ssize_t fuse_fill_write_pages(struct fuse_req *req, - req->page_descs[req->num_pages].length = tmp; - req->num_pages++; - -- iov_iter_advance(ii, tmp); - count += tmp; - pos += tmp; - offset += tmp; -diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c -index 7b945957e230..45a7dd36b4a6 100644 ---- a/fs/nfs/nfs4proc.c -+++ b/fs/nfs/nfs4proc.c -@@ -1169,6 +1169,7 @@ static void __update_open_stateid(struct nfs4_state *state, nfs4_stateid *open_s - * Protect the call to nfs4_state_set_mode_locked and - * serialise the stateid update - */ -+ spin_lock(&state->owner->so_lock); - write_seqlock(&state->seqlock); - if (deleg_stateid != NULL) { - nfs4_stateid_copy(&state->stateid, deleg_stateid); -@@ -1177,7 +1178,6 @@ static void __update_open_stateid(struct nfs4_state *state, nfs4_stateid *open_s - if (open_stateid != NULL) - nfs_set_open_stateid_locked(state, open_stateid, fmode); - write_sequnlock(&state->seqlock); -- spin_lock(&state->owner->so_lock); - update_open_stateflags(state, fmode); - spin_unlock(&state->owner->so_lock); - } -diff --git a/fs/proc/array.c b/fs/proc/array.c -index baf3464bbce0..ca4a64b4b119 100644 ---- a/fs/proc/array.c -+++ b/fs/proc/array.c -@@ -391,7 +391,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns, - - state = *get_task_state(task); - vsize = eip = esp = 0; -- permitted = ptrace_may_access(task, PTRACE_MODE_READ | PTRACE_MODE_NOAUDIT); -+ permitted = ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS | PTRACE_MODE_NOAUDIT); - mm = get_task_mm(task); - if (mm) { - vsize = task_vsize(mm); -diff --git a/fs/proc/base.c b/fs/proc/base.c -index 489ba8caafc0..be78847782c4 100644 ---- a/fs/proc/base.c -+++ b/fs/proc/base.c -@@ -239,7 +239,7 @@ out: - - static int proc_pid_auxv(struct task_struct *task, char *buffer) - { -- struct mm_struct *mm = mm_access(task, PTRACE_MODE_READ); -+ struct mm_struct *mm = mm_access(task, PTRACE_MODE_READ_FSCREDS); - int res = PTR_ERR(mm); - if (mm && !IS_ERR(mm)) { - unsigned int nwords = 0; -@@ -269,7 +269,7 @@ static int proc_pid_wchan(struct task_struct *task, char *buffer) - wchan = get_wchan(task); - - if (lookup_symbol_name(wchan, symname) < 0) -- if (!ptrace_may_access(task, PTRACE_MODE_READ)) -+ if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS)) - return 0; - else - return sprintf(buffer, "%lu", wchan); -@@ -283,7 +283,7 @@ static int lock_trace(struct task_struct *task) - int err = mutex_lock_killable(&task->signal->cred_guard_mutex); - if (err) - return err; -- if (!ptrace_may_access(task, PTRACE_MODE_ATTACH)) { -+ if (!ptrace_may_access(task, PTRACE_MODE_ATTACH_FSCREDS)) { - mutex_unlock(&task->signal->cred_guard_mutex); - return -EPERM; - } -@@ -557,7 +557,7 @@ static int proc_fd_access_allowed(struct inode *inode) - */ - task = get_proc_task(inode); - if (task) { -- allowed = ptrace_may_access(task, PTRACE_MODE_READ); -+ allowed = ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS); - put_task_struct(task); - } - return allowed; -@@ -592,7 +592,7 @@ static bool has_pid_permissions(struct pid_namespace *pid, - return true; - if (in_group_p(pid->pid_gid)) - return true; -- return ptrace_may_access(task, PTRACE_MODE_READ); -+ return ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS); - } - - -@@ -707,7 +707,7 @@ static int __mem_open(struct inode *inode, struct file *file, unsigned int mode) - if (!task) - return -ESRCH; - -- mm = mm_access(task, mode); -+ mm = mm_access(task, mode | PTRACE_MODE_FSCREDS); - put_task_struct(task); - - if (IS_ERR(mm)) -@@ -1760,7 +1760,7 @@ static int map_files_d_revalidate(struct dentry *dentry, unsigned int flags) - if (!task) - goto out_notask; - -- mm = mm_access(task, PTRACE_MODE_READ); -+ mm = mm_access(task, PTRACE_MODE_READ_FSCREDS); - if (IS_ERR_OR_NULL(mm)) - goto out; - -@@ -1895,7 +1895,7 @@ static struct dentry *proc_map_files_lookup(struct inode *dir, - goto out; - - result = -EACCES; -- if (!ptrace_may_access(task, PTRACE_MODE_READ)) -+ if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS)) - goto out_put_task; - - result = -ENOENT; -@@ -1952,7 +1952,7 @@ proc_map_files_readdir(struct file *file, struct dir_context *ctx) - goto out; - - ret = -EACCES; -- if (!ptrace_may_access(task, PTRACE_MODE_READ)) -+ if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS)) - goto out_put_task; - - ret = 0; -@@ -2431,7 +2431,7 @@ static int do_io_accounting(struct task_struct *task, char *buffer, int whole) - if (result) - return result; - -- if (!ptrace_may_access(task, PTRACE_MODE_READ)) { -+ if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS)) { - result = -EACCES; - goto out_unlock; - } -diff --git a/fs/proc/namespaces.c b/fs/proc/namespaces.c -index 9ae46b87470d..a05ed26075e3 100644 ---- a/fs/proc/namespaces.c -+++ b/fs/proc/namespaces.c -@@ -119,7 +119,7 @@ static void *proc_ns_follow_link(struct dentry *dentry, struct nameidata *nd) - if (!task) - goto out; - -- if (!ptrace_may_access(task, PTRACE_MODE_READ)) -+ if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS)) - goto out_put_task; - - ns_path.dentry = proc_ns_get_dentry(sb, task, ei->ns.ns_ops); -@@ -152,7 +152,7 @@ static int proc_ns_readlink(struct dentry *dentry, char __user *buffer, int bufl - if (!task) - goto out; - -- if (!ptrace_may_access(task, PTRACE_MODE_READ)) -+ if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS)) - goto out_put_task; - - len = -ENOENT; -diff --git a/fs/udf/inode.c b/fs/udf/inode.c -index 142d29e3ccdf..5808bfe95126 100644 ---- a/fs/udf/inode.c -+++ b/fs/udf/inode.c -@@ -2062,14 +2062,29 @@ void udf_write_aext(struct inode *inode, struct extent_position *epos, - epos->offset += adsize; - } - -+/* -+ * Only 1 indirect extent in a row really makes sense but allow upto 16 in case -+ * someone does some weird stuff. -+ */ -+#define UDF_MAX_INDIR_EXTS 16 -+ - int8_t udf_next_aext(struct inode *inode, struct extent_position *epos, - struct kernel_lb_addr *eloc, uint32_t *elen, int inc) - { - int8_t etype; -+ unsigned int indirections = 0; - - while ((etype = udf_current_aext(inode, epos, eloc, elen, inc)) == - (EXT_NEXT_EXTENT_ALLOCDECS >> 30)) { - int block; -+ -+ if (++indirections > UDF_MAX_INDIR_EXTS) { -+ udf_err(inode->i_sb, -+ "too many indirect extents in inode %lu\n", -+ inode->i_ino); -+ return -1; -+ } -+ - epos->block = *eloc; - epos->offset = sizeof(struct allocExtDesc); - brelse(epos->bh); -diff --git a/fs/udf/unicode.c b/fs/udf/unicode.c -index 44b815e57f94..685fbd8a2937 100644 ---- a/fs/udf/unicode.c -+++ b/fs/udf/unicode.c -@@ -132,11 +132,15 @@ int udf_CS0toUTF8(struct ustr *utf_o, const struct ustr *ocu_i) - if (c < 0x80U) - utf_o->u_name[utf_o->u_len++] = (uint8_t)c; - else if (c < 0x800U) { -+ if (utf_o->u_len > (UDF_NAME_LEN - 4)) -+ break; - utf_o->u_name[utf_o->u_len++] = - (uint8_t)(0xc0 | (c >> 6)); - utf_o->u_name[utf_o->u_len++] = - (uint8_t)(0x80 | (c & 0x3f)); - } else { -+ if (utf_o->u_len > (UDF_NAME_LEN - 5)) -+ break; - utf_o->u_name[utf_o->u_len++] = - (uint8_t)(0xe0 | (c >> 12)); - utf_o->u_name[utf_o->u_len++] = -@@ -177,17 +181,22 @@ int udf_CS0toUTF8(struct ustr *utf_o, const struct ustr *ocu_i) - static int udf_UTF8toCS0(dstring *ocu, struct ustr *utf, int length) - { - unsigned c, i, max_val, utf_char; -- int utf_cnt, u_len; -+ int utf_cnt, u_len, u_ch; - - memset(ocu, 0, sizeof(dstring) * length); - ocu[0] = 8; - max_val = 0xffU; -+ u_ch = 1; - - try_again: - u_len = 0U; - utf_char = 0U; - utf_cnt = 0U; - for (i = 0U; i < utf->u_len; i++) { -+ /* Name didn't fit? */ -+ if (u_len + 1 + u_ch >= length) -+ return 0; -+ - c = (uint8_t)utf->u_name[i]; - - /* Complete a multi-byte UTF-8 character */ -@@ -229,6 +238,7 @@ try_again: - if (max_val == 0xffU) { - max_val = 0xffffU; - ocu[0] = (uint8_t)0x10U; -+ u_ch = 2; - goto try_again; - } - goto error_out; -@@ -281,7 +291,7 @@ static int udf_CS0toNLS(struct nls_table *nls, struct ustr *utf_o, - c = (c << 8) | ocu[i++]; - - len = nls->uni2char(c, &utf_o->u_name[utf_o->u_len], -- UDF_NAME_LEN - utf_o->u_len); -+ UDF_NAME_LEN - 2 - utf_o->u_len); - /* Valid character? */ - if (len >= 0) - utf_o->u_len += len; -@@ -299,15 +309,19 @@ static int udf_NLStoCS0(struct nls_table *nls, dstring *ocu, struct ustr *uni, - int len; - unsigned i, max_val; - uint16_t uni_char; -- int u_len; -+ int u_len, u_ch; - - memset(ocu, 0, sizeof(dstring) * length); - ocu[0] = 8; - max_val = 0xffU; -+ u_ch = 1; - - try_again: - u_len = 0U; - for (i = 0U; i < uni->u_len; i++) { -+ /* Name didn't fit? */ -+ if (u_len + 1 + u_ch >= length) -+ return 0; - len = nls->char2uni(&uni->u_name[i], uni->u_len - i, &uni_char); - if (!len) - continue; -@@ -320,6 +334,7 @@ try_again: - if (uni_char > max_val) { - max_val = 0xffffU; - ocu[0] = (uint8_t)0x10U; -+ u_ch = 2; - goto try_again; - } - -diff --git a/include/linux/compiler.h b/include/linux/compiler.h -index 2472740d7ab2..6977192bdb59 100644 ---- a/include/linux/compiler.h -+++ b/include/linux/compiler.h -@@ -131,7 +131,7 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect); - */ - #define if(cond, ...) __trace_if( (cond , ## __VA_ARGS__) ) - #define __trace_if(cond) \ -- if (__builtin_constant_p((cond)) ? !!(cond) : \ -+ if (__builtin_constant_p(!!(cond)) ? !!(cond) : \ - ({ \ - int ______r; \ - static struct ftrace_branch_data \ -diff --git a/include/linux/devpts_fs.h b/include/linux/devpts_fs.h -index 251a2090a554..e0ee0b3000b2 100644 ---- a/include/linux/devpts_fs.h -+++ b/include/linux/devpts_fs.h -@@ -19,6 +19,8 @@ - - int devpts_new_index(struct inode *ptmx_inode); - void devpts_kill_index(struct inode *ptmx_inode, int idx); -+void devpts_add_ref(struct inode *ptmx_inode); -+void devpts_del_ref(struct inode *ptmx_inode); - /* mknod in devpts */ - struct inode *devpts_pty_new(struct inode *ptmx_inode, dev_t device, int index, - void *priv); -@@ -32,6 +34,8 @@ void devpts_pty_kill(struct inode *inode); - /* Dummy stubs in the no-pty case */ - static inline int devpts_new_index(struct inode *ptmx_inode) { return -EINVAL; } - static inline void devpts_kill_index(struct inode *ptmx_inode, int idx) { } -+static inline void devpts_add_ref(struct inode *ptmx_inode) { } -+static inline void devpts_del_ref(struct inode *ptmx_inode) { } - static inline struct inode *devpts_pty_new(struct inode *ptmx_inode, - dev_t device, int index, void *priv) - { -diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h -index cc79eff4a1ad..608d90444b6f 100644 ---- a/include/linux/ptrace.h -+++ b/include/linux/ptrace.h -@@ -56,7 +56,29 @@ extern void exit_ptrace(struct task_struct *tracer); - #define PTRACE_MODE_READ 0x01 - #define PTRACE_MODE_ATTACH 0x02 - #define PTRACE_MODE_NOAUDIT 0x04 --/* Returns true on success, false on denial. */ -+#define PTRACE_MODE_FSCREDS 0x08 -+#define PTRACE_MODE_REALCREDS 0x10 -+ -+/* shorthands for READ/ATTACH and FSCREDS/REALCREDS combinations */ -+#define PTRACE_MODE_READ_FSCREDS (PTRACE_MODE_READ | PTRACE_MODE_FSCREDS) -+#define PTRACE_MODE_READ_REALCREDS (PTRACE_MODE_READ | PTRACE_MODE_REALCREDS) -+#define PTRACE_MODE_ATTACH_FSCREDS (PTRACE_MODE_ATTACH | PTRACE_MODE_FSCREDS) -+#define PTRACE_MODE_ATTACH_REALCREDS (PTRACE_MODE_ATTACH | PTRACE_MODE_REALCREDS) -+ -+/** -+ * ptrace_may_access - check whether the caller is permitted to access -+ * a target task. -+ * @task: target task -+ * @mode: selects type of access and caller credentials -+ * -+ * Returns true on success, false on denial. -+ * -+ * One of the flags PTRACE_MODE_FSCREDS and PTRACE_MODE_REALCREDS must -+ * be set in @mode to specify whether the access was requested through -+ * a filesystem syscall (should use effective capabilities and fsuid -+ * of the caller) or through an explicit syscall such as -+ * process_vm_writev or ptrace (and should use the real credentials). -+ */ - extern bool ptrace_may_access(struct task_struct *task, unsigned int mode); - - static inline int ptrace_reparented(struct task_struct *child) -diff --git a/include/linux/radix-tree.h b/include/linux/radix-tree.h -index e8be53ecfc45..16604454e95f 100644 ---- a/include/linux/radix-tree.h -+++ b/include/linux/radix-tree.h -@@ -320,12 +320,28 @@ void **radix_tree_next_chunk(struct radix_tree_root *root, - struct radix_tree_iter *iter, unsigned flags); - - /** -+ * radix_tree_iter_retry - retry this chunk of the iteration -+ * @iter: iterator state -+ * -+ * If we iterate over a tree protected only by the RCU lock, a race -+ * against deletion or creation may result in seeing a slot for which -+ * radix_tree_deref_retry() returns true. If so, call this function -+ * and continue the iteration. -+ */ -+static inline __must_check -+void **radix_tree_iter_retry(struct radix_tree_iter *iter) -+{ -+ iter->next_index = iter->index; -+ return NULL; -+} -+ -+/** - * radix_tree_chunk_size - get current chunk size - * - * @iter: pointer to radix tree iterator - * Returns: current chunk size - */ --static __always_inline unsigned -+static __always_inline long - radix_tree_chunk_size(struct radix_tree_iter *iter) - { - return iter->next_index - iter->index; -@@ -359,9 +375,9 @@ radix_tree_next_slot(void **slot, struct radix_tree_iter *iter, unsigned flags) - return slot + offset + 1; - } - } else { -- unsigned size = radix_tree_chunk_size(iter) - 1; -+ long size = radix_tree_chunk_size(iter); - -- while (size--) { -+ while (--size > 0) { - slot++; - iter->index++; - if (likely(*slot)) -diff --git a/kernel/events/core.c b/kernel/events/core.c -index 3bf20e36a8e7..bfd91336e888 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -3096,7 +3096,7 @@ find_lively_task_by_vpid(pid_t vpid) - - /* Reuse ptrace permission checks for now. */ - err = -EACCES; -- if (!ptrace_may_access(task, PTRACE_MODE_READ)) -+ if (!ptrace_may_access(task, PTRACE_MODE_READ_REALCREDS)) - goto errout; - - return task; -@@ -5945,6 +5945,10 @@ static int perf_tp_filter_match(struct perf_event *event, - { - void *record = data->raw->data; - -+ /* only top level events have filters set */ -+ if (event->parent) -+ event = event->parent; -+ - if (likely(!event->filter) || filter_match_preds(event->filter, record)) - return 1; - return 0; -diff --git a/kernel/futex.c b/kernel/futex.c -index fda2950f2ce4..b125c385a257 100644 ---- a/kernel/futex.c -+++ b/kernel/futex.c -@@ -2648,6 +2648,11 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags, - if (q.pi_state && (q.pi_state->owner != current)) { - spin_lock(q.lock_ptr); - ret = fixup_pi_state_owner(uaddr2, &q, current); -+ /* -+ * Drop the reference to the pi state which -+ * the requeue_pi() code acquired for us. -+ */ -+ free_pi_state(q.pi_state); - spin_unlock(q.lock_ptr); - } - } else { -@@ -2774,7 +2779,7 @@ SYSCALL_DEFINE3(get_robust_list, int, pid, - } - - ret = -EPERM; -- if (!ptrace_may_access(p, PTRACE_MODE_READ)) -+ if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS)) - goto err_unlock; - - head = p->robust_list; -diff --git a/kernel/futex_compat.c b/kernel/futex_compat.c -index f9f44fd4d34d..3888617a1f9e 100644 ---- a/kernel/futex_compat.c -+++ b/kernel/futex_compat.c -@@ -155,7 +155,7 @@ COMPAT_SYSCALL_DEFINE3(get_robust_list, int, pid, - } - - ret = -EPERM; -- if (!ptrace_may_access(p, PTRACE_MODE_READ)) -+ if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS)) - goto err_unlock; - - head = p->compat_robust_list; -diff --git a/kernel/kcmp.c b/kernel/kcmp.c -index 0aa69ea1d8fd..3a47fa998fe0 100644 ---- a/kernel/kcmp.c -+++ b/kernel/kcmp.c -@@ -122,8 +122,8 @@ SYSCALL_DEFINE5(kcmp, pid_t, pid1, pid_t, pid2, int, type, - &task2->signal->cred_guard_mutex); - if (ret) - goto err; -- if (!ptrace_may_access(task1, PTRACE_MODE_READ) || -- !ptrace_may_access(task2, PTRACE_MODE_READ)) { -+ if (!ptrace_may_access(task1, PTRACE_MODE_READ_REALCREDS) || -+ !ptrace_may_access(task2, PTRACE_MODE_READ_REALCREDS)) { - ret = -EPERM; - goto err_unlock; - } -diff --git a/kernel/module.c b/kernel/module.c -index 49f17c27bf11..e40617fac8ad 100644 ---- a/kernel/module.c -+++ b/kernel/module.c -@@ -3381,6 +3381,11 @@ static inline int is_arm_mapping_symbol(const char *str) - && (str[2] == '\0' || str[2] == '.'); - } - -+static const char *symname(struct module *mod, unsigned int symnum) -+{ -+ return mod->strtab + mod->symtab[symnum].st_name; -+} -+ - static const char *get_ksymbol(struct module *mod, - unsigned long addr, - unsigned long *size, -@@ -3403,15 +3408,15 @@ static const char *get_ksymbol(struct module *mod, - - /* We ignore unnamed symbols: they're uninformative - * and inserted at a whim. */ -+ if (*symname(mod, i) == '\0' -+ || is_arm_mapping_symbol(symname(mod, i))) -+ continue; -+ - if (mod->symtab[i].st_value <= addr -- && mod->symtab[i].st_value > mod->symtab[best].st_value -- && *(mod->strtab + mod->symtab[i].st_name) != '\0' -- && !is_arm_mapping_symbol(mod->strtab + mod->symtab[i].st_name)) -+ && mod->symtab[i].st_value > mod->symtab[best].st_value) - best = i; - if (mod->symtab[i].st_value > addr -- && mod->symtab[i].st_value < nextval -- && *(mod->strtab + mod->symtab[i].st_name) != '\0' -- && !is_arm_mapping_symbol(mod->strtab + mod->symtab[i].st_name)) -+ && mod->symtab[i].st_value < nextval) - nextval = mod->symtab[i].st_value; - } - -@@ -3422,7 +3427,7 @@ static const char *get_ksymbol(struct module *mod, - *size = nextval - mod->symtab[best].st_value; - if (offset) - *offset = addr - mod->symtab[best].st_value; -- return mod->strtab + mod->symtab[best].st_name; -+ return symname(mod, best); - } - - /* For kallsyms to ask for address resolution. NULL means not found. Careful -@@ -3523,8 +3528,7 @@ int module_get_kallsym(unsigned int symnum, unsigned long *value, char *type, - if (symnum < mod->num_symtab) { - *value = mod->symtab[symnum].st_value; - *type = mod->symtab[symnum].st_info; -- strlcpy(name, mod->strtab + mod->symtab[symnum].st_name, -- KSYM_NAME_LEN); -+ strlcpy(name, symname(mod, symnum), KSYM_NAME_LEN); - strlcpy(module_name, mod->name, MODULE_NAME_LEN); - *exported = is_exported(name, *value, mod); - preempt_enable(); -@@ -3541,7 +3545,7 @@ static unsigned long mod_find_symname(struct module *mod, const char *name) - unsigned int i; - - for (i = 0; i < mod->num_symtab; i++) -- if (strcmp(name, mod->strtab+mod->symtab[i].st_name) == 0 && -+ if (strcmp(name, symname(mod, i)) == 0 && - mod->symtab[i].st_info != 'U') - return mod->symtab[i].st_value; - return 0; -@@ -3583,7 +3587,7 @@ int module_kallsyms_on_each_symbol(int (*fn)(void *, const char *, - if (mod->state == MODULE_STATE_UNFORMED) - continue; - for (i = 0; i < mod->num_symtab; i++) { -- ret = fn(data, mod->strtab + mod->symtab[i].st_name, -+ ret = fn(data, symname(mod, i), - mod, mod->symtab[i].st_value); - if (ret != 0) - return ret; -diff --git a/kernel/ptrace.c b/kernel/ptrace.c -index be9760f8284a..4524314ecbb4 100644 ---- a/kernel/ptrace.c -+++ b/kernel/ptrace.c -@@ -225,6 +225,14 @@ static int ptrace_has_cap(struct user_namespace *ns, unsigned int mode) - static int __ptrace_may_access(struct task_struct *task, unsigned int mode) - { - const struct cred *cred = current_cred(), *tcred; -+ int dumpable = 0; -+ kuid_t caller_uid; -+ kgid_t caller_gid; -+ -+ if (!(mode & PTRACE_MODE_FSCREDS) == !(mode & PTRACE_MODE_REALCREDS)) { -+ WARN(1, "denying ptrace access check without PTRACE_MODE_*CREDS\n"); -+ return -EPERM; -+ } - - /* May we inspect the given task? - * This check is used both for attaching with ptrace -@@ -234,18 +242,33 @@ static int __ptrace_may_access(struct task_struct *task, unsigned int mode) - * because setting up the necessary parent/child relationship - * or halting the specified task is impossible. - */ -- int dumpable = 0; -+ - /* Don't let security modules deny introspection */ - if (same_thread_group(task, current)) - return 0; - rcu_read_lock(); -+ if (mode & PTRACE_MODE_FSCREDS) { -+ caller_uid = cred->fsuid; -+ caller_gid = cred->fsgid; -+ } else { -+ /* -+ * Using the euid would make more sense here, but something -+ * in userland might rely on the old behavior, and this -+ * shouldn't be a security problem since -+ * PTRACE_MODE_REALCREDS implies that the caller explicitly -+ * used a syscall that requests access to another process -+ * (and not a filesystem syscall to procfs). -+ */ -+ caller_uid = cred->uid; -+ caller_gid = cred->gid; -+ } - tcred = __task_cred(task); -- if (uid_eq(cred->uid, tcred->euid) && -- uid_eq(cred->uid, tcred->suid) && -- uid_eq(cred->uid, tcred->uid) && -- gid_eq(cred->gid, tcred->egid) && -- gid_eq(cred->gid, tcred->sgid) && -- gid_eq(cred->gid, tcred->gid)) -+ if (uid_eq(caller_uid, tcred->euid) && -+ uid_eq(caller_uid, tcred->suid) && -+ uid_eq(caller_uid, tcred->uid) && -+ gid_eq(caller_gid, tcred->egid) && -+ gid_eq(caller_gid, tcred->sgid) && -+ gid_eq(caller_gid, tcred->gid)) - goto ok; - if (ptrace_has_cap(tcred->user_ns, mode)) - goto ok; -@@ -312,7 +335,7 @@ static int ptrace_attach(struct task_struct *task, long request, - goto out; - - task_lock(task); -- retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH); -+ retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH_REALCREDS); - task_unlock(task); - if (retval) - goto unlock_creds; -diff --git a/lib/dma-debug.c b/lib/dma-debug.c -index 98f2d7e91a91..1cbfc16d0b37 100644 ---- a/lib/dma-debug.c -+++ b/lib/dma-debug.c -@@ -1165,7 +1165,7 @@ static inline bool overlap(void *addr, unsigned long len, void *start, void *end - - static void check_for_illegal_area(struct device *dev, void *addr, unsigned long len) - { -- if (overlap(addr, len, _text, _etext) || -+ if (overlap(addr, len, _stext, _etext) || - overlap(addr, len, __start_rodata, __end_rodata)) - err_printk(dev, NULL, "DMA-API: device driver maps memory from kernel text or rodata [addr=%p] [len=%lu]\n", addr, len); - } -@@ -1440,7 +1440,7 @@ void debug_dma_alloc_coherent(struct device *dev, size_t size, - entry->type = dma_debug_coherent; - entry->dev = dev; - entry->pfn = page_to_pfn(virt_to_page(virt)); -- entry->offset = (size_t) virt & PAGE_MASK; -+ entry->offset = (size_t) virt & ~PAGE_MASK; - entry->size = size; - entry->dev_addr = dma_addr; - entry->direction = DMA_BIDIRECTIONAL; -@@ -1456,7 +1456,7 @@ void debug_dma_free_coherent(struct device *dev, size_t size, - .type = dma_debug_coherent, - .dev = dev, - .pfn = page_to_pfn(virt_to_page(virt)), -- .offset = (size_t) virt & PAGE_MASK, -+ .offset = (size_t) virt & ~PAGE_MASK, - .dev_addr = addr, - .size = size, - .direction = DMA_BIDIRECTIONAL, -diff --git a/lib/dump_stack.c b/lib/dump_stack.c -index f23b63f0a1c3..1e21b4682666 100644 ---- a/lib/dump_stack.c -+++ b/lib/dump_stack.c -@@ -25,6 +25,7 @@ static atomic_t dump_lock = ATOMIC_INIT(-1); - - asmlinkage void dump_stack(void) - { -+ unsigned long flags; - int was_locked; - int old; - int cpu; -@@ -33,9 +34,8 @@ asmlinkage void dump_stack(void) - * Permit this cpu to perform nested stack dumps while serialising - * against other CPUs - */ -- preempt_disable(); -- - retry: -+ local_irq_save(flags); - cpu = smp_processor_id(); - old = atomic_cmpxchg(&dump_lock, -1, cpu); - if (old == -1) { -@@ -43,6 +43,7 @@ retry: - } else if (old == cpu) { - was_locked = 1; - } else { -+ local_irq_restore(flags); - cpu_relax(); - goto retry; - } -@@ -52,7 +53,7 @@ retry: - if (!was_locked) - atomic_set(&dump_lock, -1); - -- preempt_enable(); -+ local_irq_restore(flags); - } - #else - asmlinkage void dump_stack(void) -diff --git a/lib/klist.c b/lib/klist.c -index 358a368a2947..2e59aecbec0d 100644 ---- a/lib/klist.c -+++ b/lib/klist.c -@@ -282,9 +282,9 @@ void klist_iter_init_node(struct klist *k, struct klist_iter *i, - struct klist_node *n) - { - i->i_klist = k; -- i->i_cur = n; -- if (n) -- kref_get(&n->n_ref); -+ i->i_cur = NULL; -+ if (n && kref_get_unless_zero(&n->n_ref)) -+ i->i_cur = n; - } - EXPORT_SYMBOL_GPL(klist_iter_init_node); - -diff --git a/lib/radix-tree.c b/lib/radix-tree.c -index 7e30d2a7f346..7fdc4121e44c 100644 ---- a/lib/radix-tree.c -+++ b/lib/radix-tree.c -@@ -977,9 +977,13 @@ radix_tree_gang_lookup(struct radix_tree_root *root, void **results, - return 0; - - radix_tree_for_each_slot(slot, root, &iter, first_index) { -- results[ret] = indirect_to_ptr(rcu_dereference_raw(*slot)); -+ results[ret] = rcu_dereference_raw(*slot); - if (!results[ret]) - continue; -+ if (radix_tree_is_indirect_ptr(results[ret])) { -+ slot = radix_tree_iter_retry(&iter); -+ continue; -+ } - if (++ret == max_items) - break; - } -@@ -1056,9 +1060,13 @@ radix_tree_gang_lookup_tag(struct radix_tree_root *root, void **results, - return 0; - - radix_tree_for_each_tagged(slot, root, &iter, first_index, tag) { -- results[ret] = indirect_to_ptr(rcu_dereference_raw(*slot)); -+ results[ret] = rcu_dereference_raw(*slot); - if (!results[ret]) - continue; -+ if (radix_tree_is_indirect_ptr(results[ret])) { -+ slot = radix_tree_iter_retry(&iter); -+ continue; -+ } - if (++ret == max_items) - break; - } -diff --git a/mm/memcontrol.c b/mm/memcontrol.c -index b58d4fbe6c48..51d7cc8bb5f1 100644 ---- a/mm/memcontrol.c -+++ b/mm/memcontrol.c -@@ -5858,16 +5858,17 @@ static void __mem_cgroup_usage_unregister_event(struct mem_cgroup *memcg, - swap_buffers: - /* Swap primary and spare array */ - thresholds->spare = thresholds->primary; -- /* If all events are unregistered, free the spare array */ -- if (!new) { -- kfree(thresholds->spare); -- thresholds->spare = NULL; -- } - - rcu_assign_pointer(thresholds->primary, new); - - /* To be sure that nobody uses thresholds */ - synchronize_rcu(); -+ -+ /* If all events are unregistered, free the spare array */ -+ if (!new) { -+ kfree(thresholds->spare); -+ thresholds->spare = NULL; -+ } - unlock: - mutex_unlock(&memcg->thresholds_lock); - } -diff --git a/mm/memory-failure.c b/mm/memory-failure.c -index 42aeb848b8e9..580dbc22ef74 100644 ---- a/mm/memory-failure.c -+++ b/mm/memory-failure.c -@@ -1509,7 +1509,7 @@ static int get_any_page(struct page *page, unsigned long pfn, int flags) - * Did it turn free? - */ - ret = __get_any_page(page, pfn, 0); -- if (!PageLRU(page)) { -+ if (ret == 1 && !PageLRU(page)) { - /* Drop page reference which is from __get_any_page() */ - put_page(page); - pr_info("soft_offline: %#lx: unknown non LRU page type %lx\n", -diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c -index 5bba3b35bec8..35e14c784bef 100644 ---- a/mm/memory_hotplug.c -+++ b/mm/memory_hotplug.c -@@ -1220,23 +1220,30 @@ int is_mem_section_removable(unsigned long start_pfn, unsigned long nr_pages) - */ - static int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn) - { -- unsigned long pfn; -+ unsigned long pfn, sec_end_pfn; - struct zone *zone = NULL; - struct page *page; - int i; -- for (pfn = start_pfn; -+ for (pfn = start_pfn, sec_end_pfn = SECTION_ALIGN_UP(start_pfn); - pfn < end_pfn; -- pfn += MAX_ORDER_NR_PAGES) { -- i = 0; -- /* This is just a CONFIG_HOLES_IN_ZONE check.*/ -- while ((i < MAX_ORDER_NR_PAGES) && !pfn_valid_within(pfn + i)) -- i++; -- if (i == MAX_ORDER_NR_PAGES) -+ pfn = sec_end_pfn + 1, sec_end_pfn += PAGES_PER_SECTION) { -+ /* Make sure the memory section is present first */ -+ if (!present_section_nr(pfn_to_section_nr(pfn))) - continue; -- page = pfn_to_page(pfn + i); -- if (zone && page_zone(page) != zone) -- return 0; -- zone = page_zone(page); -+ for (; pfn < sec_end_pfn && pfn < end_pfn; -+ pfn += MAX_ORDER_NR_PAGES) { -+ i = 0; -+ /* This is just a CONFIG_HOLES_IN_ZONE check.*/ -+ while ((i < MAX_ORDER_NR_PAGES) && -+ !pfn_valid_within(pfn + i)) -+ i++; -+ if (i == MAX_ORDER_NR_PAGES) -+ continue; -+ page = pfn_to_page(pfn + i); -+ if (zone && page_zone(page) != zone) -+ return 0; -+ zone = page_zone(page); -+ } - } - return 1; - } -diff --git a/mm/process_vm_access.c b/mm/process_vm_access.c -index fd26d0433509..e739825be8b3 100644 ---- a/mm/process_vm_access.c -+++ b/mm/process_vm_access.c -@@ -298,7 +298,7 @@ static ssize_t process_vm_rw_core(pid_t pid, const struct iovec *lvec, - goto free_proc_pages; - } - -- mm = mm_access(task, PTRACE_MODE_ATTACH); -+ mm = mm_access(task, PTRACE_MODE_ATTACH_REALCREDS); - if (!mm || IS_ERR(mm)) { - rc = IS_ERR(mm) ? PTR_ERR(mm) : -ESRCH; - /* -diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c -index 9ad561152eb6..8b61288e5746 100644 ---- a/net/ipv6/ip6mr.c -+++ b/net/ipv6/ip6mr.c -@@ -336,7 +336,7 @@ static struct mr6_table *ip6mr_new_table(struct net *net, u32 id) - - static void ip6mr_free_table(struct mr6_table *mrt) - { -- del_timer(&mrt->ipmr_expire_timer); -+ del_timer_sync(&mrt->ipmr_expire_timer); - mroute_clean_tables(mrt, true); - kfree(mrt); - } -diff --git a/scripts/bloat-o-meter b/scripts/bloat-o-meter -index 549d0ab8c662..dabd2a4cb4e5 100755 ---- a/scripts/bloat-o-meter -+++ b/scripts/bloat-o-meter -@@ -56,8 +56,8 @@ for name in common: - delta.sort() - delta.reverse() - --print "add/remove: %s/%s grow/shrink: %s/%s up/down: %s/%s (%s)" % \ -- (add, remove, grow, shrink, up, -down, up-down) --print "%-40s %7s %7s %+7s" % ("function", "old", "new", "delta") -+print("add/remove: %s/%s grow/shrink: %s/%s up/down: %s/%s (%s)" % \ -+ (add, remove, grow, shrink, up, -down, up-down)) -+print("%-40s %7s %7s %+7s" % ("function", "old", "new", "delta")) - for d, n in delta: -- if d: print "%-40s %7s %7s %+7d" % (n, old.get(n,"-"), new.get(n,"-"), d) -+ if d: print("%-40s %7s %7s %+7d" % (n, old.get(n,"-"), new.get(n,"-"), d)) -diff --git a/security/commoncap.c b/security/commoncap.c -index 963dc5981661..a484506445d7 100644 ---- a/security/commoncap.c -+++ b/security/commoncap.c -@@ -142,12 +142,17 @@ int cap_ptrace_access_check(struct task_struct *child, unsigned int mode) - { - int ret = 0; - const struct cred *cred, *child_cred; -+ const kernel_cap_t *caller_caps; - - rcu_read_lock(); - cred = current_cred(); - child_cred = __task_cred(child); -+ if (mode & PTRACE_MODE_FSCREDS) -+ caller_caps = &cred->cap_effective; -+ else -+ caller_caps = &cred->cap_permitted; - if (cred->user_ns == child_cred->user_ns && -- cap_issubset(child_cred->cap_permitted, cred->cap_permitted)) -+ cap_issubset(child_cred->cap_permitted, *caller_caps)) - goto out; - if (ns_capable(child_cred->user_ns, CAP_SYS_PTRACE)) - goto out; -diff --git a/sound/core/seq/seq_ports.c b/sound/core/seq/seq_ports.c -index 67c91d226552..ee0522a8f730 100644 ---- a/sound/core/seq/seq_ports.c -+++ b/sound/core/seq/seq_ports.c -@@ -540,19 +540,22 @@ static void delete_and_unsubscribe_port(struct snd_seq_client *client, - bool is_src, bool ack) - { - struct snd_seq_port_subs_info *grp; -+ struct list_head *list; -+ bool empty; - - grp = is_src ? &port->c_src : &port->c_dest; -+ list = is_src ? &subs->src_list : &subs->dest_list; - down_write(&grp->list_mutex); - write_lock_irq(&grp->list_lock); -- if (is_src) -- list_del(&subs->src_list); -- else -- list_del(&subs->dest_list); -+ empty = list_empty(list); -+ if (!empty) -+ list_del_init(list); - grp->exclusive = 0; - write_unlock_irq(&grp->list_lock); - up_write(&grp->list_mutex); - -- unsubscribe_port(client, port, grp, &subs->info, ack); -+ if (!empty) -+ unsubscribe_port(client, port, grp, &subs->info, ack); - } - - /* connect two ports */ -diff --git a/tools/lib/traceevent/event-parse.c b/tools/lib/traceevent/event-parse.c -index 30e8e0c3f117..56b8a3e00522 100644 ---- a/tools/lib/traceevent/event-parse.c -+++ b/tools/lib/traceevent/event-parse.c -@@ -4249,13 +4249,12 @@ static void pretty_print(struct trace_seq *s, void *data, int size, struct event - sizeof(long) != 8) { - char *p; - -- ls = 2; - /* make %l into %ll */ -- p = strchr(format, 'l'); -- if (p) -+ if (ls == 1 && (p = strchr(format, 'l'))) - memmove(p+1, p, strlen(p)+1); - else if (strcmp(format, "%p") == 0) - strcpy(format, "0x%llx"); -+ ls = 2; - } - switch (ls) { - case -2: -diff --git a/tools/perf/Documentation/perf-trace.txt b/tools/perf/Documentation/perf-trace.txt -index fae38d9a44a4..65d6a7a88c53 100644 ---- a/tools/perf/Documentation/perf-trace.txt -+++ b/tools/perf/Documentation/perf-trace.txt -@@ -59,7 +59,6 @@ OPTIONS - --verbose=:: - Verbosity level. - ---i:: - --no-inherit:: - Child tasks do not inherit counters. - diff --git a/patch/kernel/odroidc2-default/patch-3.14.62-63.patch b/patch/kernel/odroidc2-default/patch-3.14.62-63.patch deleted file mode 100644 index 5dcb8ea0c1..0000000000 --- a/patch/kernel/odroidc2-default/patch-3.14.62-63.patch +++ /dev/null @@ -1,4346 +0,0 @@ -diff --git a/Makefile b/Makefile -index b738f644c71e..0843ef4cc0a4 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 3 - PATCHLEVEL = 14 --SUBLEVEL = 62 -+SUBLEVEL = 63 - EXTRAVERSION = - NAME = Remembering Coco - -diff --git a/arch/arc/kernel/unwind.c b/arch/arc/kernel/unwind.c -index e550b117ec4f..2d6a36ea8aaf 100644 ---- a/arch/arc/kernel/unwind.c -+++ b/arch/arc/kernel/unwind.c -@@ -986,42 +986,13 @@ int arc_unwind(struct unwind_frame_info *frame) - (const u8 *)(fde + - 1) + - *fde, ptrType); -- if (pc >= endLoc) -+ if (pc >= endLoc) { - fde = NULL; -- } else -- fde = NULL; -- } -- if (fde == NULL) { -- for (fde = table->address, tableSize = table->size; -- cie = NULL, tableSize > sizeof(*fde) -- && tableSize - sizeof(*fde) >= *fde; -- tableSize -= sizeof(*fde) + *fde, -- fde += 1 + *fde / sizeof(*fde)) { -- cie = cie_for_fde(fde, table); -- if (cie == &bad_cie) { - cie = NULL; -- break; - } -- if (cie == NULL -- || cie == ¬_fde -- || (ptrType = fde_pointer_type(cie)) < 0) -- continue; -- ptr = (const u8 *)(fde + 2); -- startLoc = read_pointer(&ptr, -- (const u8 *)(fde + 1) + -- *fde, ptrType); -- if (!startLoc) -- continue; -- if (!(ptrType & DW_EH_PE_indirect)) -- ptrType &= -- DW_EH_PE_FORM | DW_EH_PE_signed; -- endLoc = -- startLoc + read_pointer(&ptr, -- (const u8 *)(fde + -- 1) + -- *fde, ptrType); -- if (pc >= startLoc && pc < endLoc) -- break; -+ } else { -+ fde = NULL; -+ cie = NULL; - } - } - } -diff --git a/arch/arm/boot/dts/wm8650.dtsi b/arch/arm/boot/dts/wm8650.dtsi -index 7525982262ac..2897c1ac47d8 100644 ---- a/arch/arm/boot/dts/wm8650.dtsi -+++ b/arch/arm/boot/dts/wm8650.dtsi -@@ -187,6 +187,15 @@ - interrupts = <43>; - }; - -+ sdhc@d800a000 { -+ compatible = "wm,wm8505-sdhc"; -+ reg = <0xd800a000 0x400>; -+ interrupts = <20>, <21>; -+ clocks = <&clksdhc>; -+ bus-width = <4>; -+ sdon-inverted; -+ }; -+ - fb: fb@d8050800 { - compatible = "wm,wm8505-fb"; - reg = <0xd8050800 0x200>; -diff --git a/arch/mips/kvm/kvm_locore.S b/arch/mips/kvm/kvm_locore.S -index 03a2db58b22d..ba5ce99c021d 100644 ---- a/arch/mips/kvm/kvm_locore.S -+++ b/arch/mips/kvm/kvm_locore.S -@@ -159,9 +159,11 @@ FEXPORT(__kvm_mips_vcpu_run) - - FEXPORT(__kvm_mips_load_asid) - /* Set the ASID for the Guest Kernel */ -- INT_SLL t0, t0, 1 /* with kseg0 @ 0x40000000, kernel */ -- /* addresses shift to 0x80000000 */ -- bltz t0, 1f /* If kernel */ -+ PTR_L t0, VCPU_COP0(k1) -+ LONG_L t0, COP0_STATUS(t0) -+ andi t0, KSU_USER | ST0_ERL | ST0_EXL -+ xori t0, KSU_USER -+ bnez t0, 1f /* If kernel */ - INT_ADDIU t1, k1, VCPU_GUEST_KERNEL_ASID /* (BD) */ - INT_ADDIU t1, k1, VCPU_GUEST_USER_ASID /* else user */ - 1: -@@ -438,9 +440,11 @@ __kvm_mips_return_to_guest: - mtc0 t0, CP0_EPC - - /* Set the ASID for the Guest Kernel */ -- INT_SLL t0, t0, 1 /* with kseg0 @ 0x40000000, kernel */ -- /* addresses shift to 0x80000000 */ -- bltz t0, 1f /* If kernel */ -+ PTR_L t0, VCPU_COP0(k1) -+ LONG_L t0, COP0_STATUS(t0) -+ andi t0, KSU_USER | ST0_ERL | ST0_EXL -+ xori t0, KSU_USER -+ bnez t0, 1f /* If kernel */ - INT_ADDIU t1, k1, VCPU_GUEST_KERNEL_ASID /* (BD) */ - INT_ADDIU t1, k1, VCPU_GUEST_USER_ASID /* else user */ - 1: -diff --git a/arch/mips/kvm/kvm_mips.c b/arch/mips/kvm/kvm_mips.c -index 897c605263f2..12d850b68763 100644 ---- a/arch/mips/kvm/kvm_mips.c -+++ b/arch/mips/kvm/kvm_mips.c -@@ -313,7 +313,7 @@ struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm, unsigned int id) - - if (!gebase) { - err = -ENOMEM; -- goto out_free_cpu; -+ goto out_uninit_cpu; - } - kvm_info("Allocated %d bytes for KVM Exception Handlers @ %p\n", - ALIGN(size, PAGE_SIZE), gebase); -@@ -373,6 +373,9 @@ struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm, unsigned int id) - out_free_gebase: - kfree(gebase); - -+out_uninit_cpu: -+ kvm_vcpu_uninit(vcpu); -+ - out_free_cpu: - kfree(vcpu); - -diff --git a/arch/mips/kvm/kvm_mips_emul.c b/arch/mips/kvm/kvm_mips_emul.c -index c76f297b7149..33085819cd89 100644 ---- a/arch/mips/kvm/kvm_mips_emul.c -+++ b/arch/mips/kvm/kvm_mips_emul.c -@@ -935,7 +935,7 @@ kvm_mips_emulate_cache(uint32_t inst, uint32_t *opc, uint32_t cause, - - base = (inst >> 21) & 0x1f; - op_inst = (inst >> 16) & 0x1f; -- offset = inst & 0xffff; -+ offset = (int16_t)inst; - cache = (inst >> 16) & 0x3; - op = (inst >> 18) & 0x7; - -diff --git a/arch/s390/mm/extable.c b/arch/s390/mm/extable.c -index 4d1ee88864e8..18c8b819b0aa 100644 ---- a/arch/s390/mm/extable.c -+++ b/arch/s390/mm/extable.c -@@ -52,12 +52,16 @@ void sort_extable(struct exception_table_entry *start, - int i; - - /* Normalize entries to being relative to the start of the section */ -- for (p = start, i = 0; p < finish; p++, i += 8) -+ for (p = start, i = 0; p < finish; p++, i += 8) { - p->insn += i; -+ p->fixup += i + 4; -+ } - sort(start, finish - start, sizeof(*start), cmp_ex, NULL); - /* Denormalize all entries */ -- for (p = start, i = 0; p < finish; p++, i += 8) -+ for (p = start, i = 0; p < finish; p++, i += 8) { - p->insn -= i; -+ p->fixup -= i + 4; -+ } - } - - #ifdef CONFIG_MODULES -diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c -index 25db14a33d03..47ae8d757773 100644 ---- a/arch/sparc/kernel/sys_sparc_64.c -+++ b/arch/sparc/kernel/sys_sparc_64.c -@@ -412,7 +412,7 @@ out: - - SYSCALL_DEFINE1(sparc64_personality, unsigned long, personality) - { -- int ret; -+ long ret; - - if (personality(current->personality) == PER_LINUX32 && - personality(personality) == PER_LINUX) -diff --git a/arch/um/os-Linux/start_up.c b/arch/um/os-Linux/start_up.c -index 337518c5042a..b412c62486f0 100644 ---- a/arch/um/os-Linux/start_up.c -+++ b/arch/um/os-Linux/start_up.c -@@ -95,6 +95,8 @@ static int start_ptraced_child(void) - { - int pid, n, status; - -+ fflush(stdout); -+ - pid = fork(); - if (pid == 0) - ptrace_child(); -diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c -index ae7d543f23ed..8894f5bc4620 100644 ---- a/arch/x86/platform/efi/efi.c -+++ b/arch/x86/platform/efi/efi.c -@@ -248,12 +248,19 @@ static efi_status_t __init phys_efi_set_virtual_address_map( - efi_memory_desc_t *virtual_map) - { - efi_status_t status; -+ unsigned long flags; - - efi_call_phys_prelog(); -+ -+ /* Disable interrupts around EFI calls: */ -+ local_irq_save(flags); - status = efi_call_phys4(efi_phys.set_virtual_address_map, - memory_map_size, descriptor_size, - descriptor_version, virtual_map); -+ local_irq_restore(flags); -+ - efi_call_phys_epilog(); -+ - return status; - } - -diff --git a/arch/x86/platform/efi/efi_32.c b/arch/x86/platform/efi/efi_32.c -index 9ee3491e31fb..be4e7eb41674 100644 ---- a/arch/x86/platform/efi/efi_32.c -+++ b/arch/x86/platform/efi/efi_32.c -@@ -33,11 +33,10 @@ - - /* - * To make EFI call EFI runtime service in physical addressing mode we need -- * prelog/epilog before/after the invocation to disable interrupt, to -- * claim EFI runtime service handler exclusively and to duplicate a memory in -- * low memory space say 0 - 3G. -+ * prolog/epilog before/after the invocation to claim the EFI runtime service -+ * handler exclusively and to duplicate a memory mapping in low memory space, -+ * say 0 - 3G. - */ --static unsigned long efi_rt_eflags; - - void efi_sync_low_kernel_mappings(void) {} - void __init efi_dump_pagetable(void) {} -@@ -59,8 +58,6 @@ void efi_call_phys_prelog(void) - { - struct desc_ptr gdt_descr; - -- local_irq_save(efi_rt_eflags); -- - load_cr3(initial_page_table); - __flush_tlb_all(); - -@@ -79,8 +76,6 @@ void efi_call_phys_epilog(void) - - load_cr3(swapper_pg_dir); - __flush_tlb_all(); -- -- local_irq_restore(efi_rt_eflags); - } - - void __init efi_runtime_mkexec(void) -diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c -index 666b74a09092..b1be0425c686 100644 ---- a/arch/x86/platform/efi/efi_64.c -+++ b/arch/x86/platform/efi/efi_64.c -@@ -41,7 +41,6 @@ - #include - - static pgd_t *save_pgd __initdata; --static unsigned long efi_flags __initdata; - - /* - * We allocate runtime services regions bottom-up, starting from -4G, i.e. -@@ -87,7 +86,6 @@ void __init efi_call_phys_prelog(void) - return; - - early_code_mapping_set_exec(1); -- local_irq_save(efi_flags); - - n_pgds = DIV_ROUND_UP((max_pfn << PAGE_SHIFT), PGDIR_SIZE); - save_pgd = kmalloc(n_pgds * sizeof(pgd_t), GFP_KERNEL); -@@ -115,7 +113,6 @@ void __init efi_call_phys_epilog(void) - set_pgd(pgd_offset_k(pgd * PGDIR_SIZE), save_pgd[pgd]); - kfree(save_pgd); - __flush_tlb_all(); -- local_irq_restore(efi_flags); - early_code_mapping_set_exec(0); - } - -diff --git a/block/partitions/mac.c b/block/partitions/mac.c -index 76d8ba6379a9..bd5b91465230 100644 ---- a/block/partitions/mac.c -+++ b/block/partitions/mac.c -@@ -32,7 +32,7 @@ int mac_partition(struct parsed_partitions *state) - Sector sect; - unsigned char *data; - int slot, blocks_in_map; -- unsigned secsize; -+ unsigned secsize, datasize, partoffset; - #ifdef CONFIG_PPC_PMAC - int found_root = 0; - int found_root_goodness = 0; -@@ -50,10 +50,14 @@ int mac_partition(struct parsed_partitions *state) - } - secsize = be16_to_cpu(md->block_size); - put_dev_sector(sect); -- data = read_part_sector(state, secsize/512, §); -+ datasize = round_down(secsize, 512); -+ data = read_part_sector(state, datasize / 512, §); - if (!data) - return -1; -- part = (struct mac_partition *) (data + secsize%512); -+ partoffset = secsize % 512; -+ if (partoffset + sizeof(*part) > datasize) -+ return -1; -+ part = (struct mac_partition *) (data + partoffset); - if (be16_to_cpu(part->signature) != MAC_PARTITION_MAGIC) { - put_dev_sector(sect); - return 0; /* not a MacOS disk */ -diff --git a/crypto/async_tx/async_memcpy.c b/crypto/async_tx/async_memcpy.c -index f8c0b8dbeb75..88bc8e6b2a54 100644 ---- a/crypto/async_tx/async_memcpy.c -+++ b/crypto/async_tx/async_memcpy.c -@@ -53,7 +53,7 @@ async_memcpy(struct page *dest, struct page *src, unsigned int dest_offset, - struct dmaengine_unmap_data *unmap = NULL; - - if (device) -- unmap = dmaengine_get_unmap_data(device->dev, 2, GFP_NOIO); -+ unmap = dmaengine_get_unmap_data(device->dev, 2, GFP_NOWAIT); - - if (unmap && is_dma_copy_aligned(device, src_offset, dest_offset, len)) { - unsigned long dma_prep_flags = 0; -diff --git a/crypto/async_tx/async_pq.c b/crypto/async_tx/async_pq.c -index d05327caf69d..7eb264e65267 100644 ---- a/crypto/async_tx/async_pq.c -+++ b/crypto/async_tx/async_pq.c -@@ -176,7 +176,7 @@ async_gen_syndrome(struct page **blocks, unsigned int offset, int disks, - BUG_ON(disks > 255 || !(P(blocks, disks) || Q(blocks, disks))); - - if (device) -- unmap = dmaengine_get_unmap_data(device->dev, disks, GFP_NOIO); -+ unmap = dmaengine_get_unmap_data(device->dev, disks, GFP_NOWAIT); - - if (unmap && - (src_cnt <= dma_maxpq(device, 0) || -@@ -294,7 +294,7 @@ async_syndrome_val(struct page **blocks, unsigned int offset, int disks, - BUG_ON(disks < 4); - - if (device) -- unmap = dmaengine_get_unmap_data(device->dev, disks, GFP_NOIO); -+ unmap = dmaengine_get_unmap_data(device->dev, disks, GFP_NOWAIT); - - if (unmap && disks <= dma_maxpq(device, 0) && - is_dma_pq_aligned(device, offset, 0, len)) { -diff --git a/crypto/async_tx/async_raid6_recov.c b/crypto/async_tx/async_raid6_recov.c -index 934a84981495..8fab6275ea1f 100644 ---- a/crypto/async_tx/async_raid6_recov.c -+++ b/crypto/async_tx/async_raid6_recov.c -@@ -41,7 +41,7 @@ async_sum_product(struct page *dest, struct page **srcs, unsigned char *coef, - u8 *a, *b, *c; - - if (dma) -- unmap = dmaengine_get_unmap_data(dma->dev, 3, GFP_NOIO); -+ unmap = dmaengine_get_unmap_data(dma->dev, 3, GFP_NOWAIT); - - if (unmap) { - struct device *dev = dma->dev; -@@ -105,7 +105,7 @@ async_mult(struct page *dest, struct page *src, u8 coef, size_t len, - u8 *d, *s; - - if (dma) -- unmap = dmaengine_get_unmap_data(dma->dev, 3, GFP_NOIO); -+ unmap = dmaengine_get_unmap_data(dma->dev, 3, GFP_NOWAIT); - - if (unmap) { - dma_addr_t dma_dest[2]; -diff --git a/crypto/async_tx/async_xor.c b/crypto/async_tx/async_xor.c -index e1bce26cd4f9..da75777f2b3f 100644 ---- a/crypto/async_tx/async_xor.c -+++ b/crypto/async_tx/async_xor.c -@@ -182,7 +182,7 @@ async_xor(struct page *dest, struct page **src_list, unsigned int offset, - BUG_ON(src_cnt <= 1); - - if (device) -- unmap = dmaengine_get_unmap_data(device->dev, src_cnt+1, GFP_NOIO); -+ unmap = dmaengine_get_unmap_data(device->dev, src_cnt+1, GFP_NOWAIT); - - if (unmap && is_dma_xor_aligned(device, offset, 0, len)) { - struct dma_async_tx_descriptor *tx; -@@ -278,7 +278,7 @@ async_xor_val(struct page *dest, struct page **src_list, unsigned int offset, - BUG_ON(src_cnt <= 1); - - if (device) -- unmap = dmaengine_get_unmap_data(device->dev, src_cnt, GFP_NOIO); -+ unmap = dmaengine_get_unmap_data(device->dev, src_cnt, GFP_NOWAIT); - - if (unmap && src_cnt <= device->max_xor && - is_dma_xor_aligned(device, offset, 0, len)) { -diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c -index 136803c47cdb..96e5ed188636 100644 ---- a/drivers/ata/libata-sff.c -+++ b/drivers/ata/libata-sff.c -@@ -997,12 +997,9 @@ static inline int ata_hsm_ok_in_wq(struct ata_port *ap, - static void ata_hsm_qc_complete(struct ata_queued_cmd *qc, int in_wq) - { - struct ata_port *ap = qc->ap; -- unsigned long flags; - - if (ap->ops->error_handler) { - if (in_wq) { -- spin_lock_irqsave(ap->lock, flags); -- - /* EH might have kicked in while host lock is - * released. - */ -@@ -1014,8 +1011,6 @@ static void ata_hsm_qc_complete(struct ata_queued_cmd *qc, int in_wq) - } else - ata_port_freeze(ap); - } -- -- spin_unlock_irqrestore(ap->lock, flags); - } else { - if (likely(!(qc->err_mask & AC_ERR_HSM))) - ata_qc_complete(qc); -@@ -1024,10 +1019,8 @@ static void ata_hsm_qc_complete(struct ata_queued_cmd *qc, int in_wq) - } - } else { - if (in_wq) { -- spin_lock_irqsave(ap->lock, flags); - ata_sff_irq_on(ap); - ata_qc_complete(qc); -- spin_unlock_irqrestore(ap->lock, flags); - } else - ata_qc_complete(qc); - } -@@ -1048,9 +1041,10 @@ int ata_sff_hsm_move(struct ata_port *ap, struct ata_queued_cmd *qc, - { - struct ata_link *link = qc->dev->link; - struct ata_eh_info *ehi = &link->eh_info; -- unsigned long flags = 0; - int poll_next; - -+ lockdep_assert_held(ap->lock); -+ - WARN_ON_ONCE((qc->flags & ATA_QCFLAG_ACTIVE) == 0); - - /* Make sure ata_sff_qc_issue() does not throw things -@@ -1112,14 +1106,6 @@ fsm_start: - } - } - -- /* Send the CDB (atapi) or the first data block (ata pio out). -- * During the state transition, interrupt handler shouldn't -- * be invoked before the data transfer is complete and -- * hsm_task_state is changed. Hence, the following locking. -- */ -- if (in_wq) -- spin_lock_irqsave(ap->lock, flags); -- - if (qc->tf.protocol == ATA_PROT_PIO) { - /* PIO data out protocol. - * send first data block. -@@ -1135,9 +1121,6 @@ fsm_start: - /* send CDB */ - atapi_send_cdb(ap, qc); - -- if (in_wq) -- spin_unlock_irqrestore(ap->lock, flags); -- - /* if polling, ata_sff_pio_task() handles the rest. - * otherwise, interrupt handler takes over from here. - */ -@@ -1361,12 +1344,14 @@ static void ata_sff_pio_task(struct work_struct *work) - u8 status; - int poll_next; - -+ spin_lock_irq(ap->lock); -+ - BUG_ON(ap->sff_pio_task_link == NULL); - /* qc can be NULL if timeout occurred */ - qc = ata_qc_from_tag(ap, link->active_tag); - if (!qc) { - ap->sff_pio_task_link = NULL; -- return; -+ goto out_unlock; - } - - fsm_start: -@@ -1381,11 +1366,14 @@ fsm_start: - */ - status = ata_sff_busy_wait(ap, ATA_BUSY, 5); - if (status & ATA_BUSY) { -+ spin_unlock_irq(ap->lock); - ata_msleep(ap, 2); -+ spin_lock_irq(ap->lock); -+ - status = ata_sff_busy_wait(ap, ATA_BUSY, 10); - if (status & ATA_BUSY) { - ata_sff_queue_pio_task(link, ATA_SHORT_PAUSE); -- return; -+ goto out_unlock; - } - } - -@@ -1402,6 +1390,8 @@ fsm_start: - */ - if (poll_next) - goto fsm_start; -+out_unlock: -+ spin_unlock_irq(ap->lock); - } - - /** -diff --git a/drivers/ata/sata_sil.c b/drivers/ata/sata_sil.c -index b7695e804635..fa94fba8fa21 100644 ---- a/drivers/ata/sata_sil.c -+++ b/drivers/ata/sata_sil.c -@@ -631,6 +631,9 @@ static void sil_dev_config(struct ata_device *dev) - unsigned int n, quirks = 0; - unsigned char model_num[ATA_ID_PROD_LEN + 1]; - -+ /* This controller doesn't support trim */ -+ dev->horkage |= ATA_HORKAGE_NOTRIM; -+ - ata_id_c_string(dev->id, model_num, ATA_ID_PROD, sizeof(model_num)); - - for (n = 0; sil_blacklist[n].product; n++) -diff --git a/drivers/clocksource/vt8500_timer.c b/drivers/clocksource/vt8500_timer.c -index 1098ed3b9b89..dc45ddb36117 100644 ---- a/drivers/clocksource/vt8500_timer.c -+++ b/drivers/clocksource/vt8500_timer.c -@@ -50,6 +50,8 @@ - - #define msecs_to_loops(t) (loops_per_jiffy / 1000 * HZ * t) - -+#define MIN_OSCR_DELTA 16 -+ - static void __iomem *regbase; - - static cycle_t vt8500_timer_read(struct clocksource *cs) -@@ -80,7 +82,7 @@ static int vt8500_timer_set_next_event(unsigned long cycles, - cpu_relax(); - writel((unsigned long)alarm, regbase + TIMER_MATCH_VAL); - -- if ((signed)(alarm - clocksource.read(&clocksource)) <= 16) -+ if ((signed)(alarm - clocksource.read(&clocksource)) <= MIN_OSCR_DELTA) - return -ETIME; - - writel(1, regbase + TIMER_IER_VAL); -@@ -160,7 +162,7 @@ static void __init vt8500_timer_init(struct device_node *np) - pr_err("%s: setup_irq failed for %s\n", __func__, - clockevent.name); - clockevents_config_and_register(&clockevent, VT8500_TIMER_HZ, -- 4, 0xf0000000); -+ MIN_OSCR_DELTA * 2, 0xf0000000); - } - - CLOCKSOURCE_OF_DECLARE(vt8500, "via,vt8500-timer", vt8500_timer_init); -diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c -index 3ae48ee2f488..df79cb0bf04e 100644 ---- a/drivers/dma/dw/core.c -+++ b/drivers/dma/dw/core.c -@@ -176,7 +176,7 @@ static void dwc_initialize(struct dw_dma_chan *dwc) - - /*----------------------------------------------------------------------*/ - --static inline unsigned int dwc_fast_fls(unsigned long long v) -+static inline unsigned int dwc_fast_ffs(unsigned long long v) - { - /* - * We can be a lot more clever here, but this should take care -@@ -720,7 +720,7 @@ dwc_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dest, dma_addr_t src, - dw->data_width[dwc->dst_master]); - - src_width = dst_width = min_t(unsigned int, data_width, -- dwc_fast_fls(src | dest | len)); -+ dwc_fast_ffs(src | dest | len)); - - ctllo = DWC_DEFAULT_CTLLO(chan) - | DWC_CTLL_DST_WIDTH(dst_width) -@@ -799,7 +799,7 @@ dwc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl, - - switch (direction) { - case DMA_MEM_TO_DEV: -- reg_width = __fls(sconfig->dst_addr_width); -+ reg_width = __ffs(sconfig->dst_addr_width); - reg = sconfig->dst_addr; - ctllo = (DWC_DEFAULT_CTLLO(chan) - | DWC_CTLL_DST_WIDTH(reg_width) -@@ -819,7 +819,7 @@ dwc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl, - len = sg_dma_len(sg); - - mem_width = min_t(unsigned int, -- data_width, dwc_fast_fls(mem | len)); -+ data_width, dwc_fast_ffs(mem | len)); - - slave_sg_todev_fill_desc: - desc = dwc_desc_get(dwc); -@@ -859,7 +859,7 @@ slave_sg_todev_fill_desc: - } - break; - case DMA_DEV_TO_MEM: -- reg_width = __fls(sconfig->src_addr_width); -+ reg_width = __ffs(sconfig->src_addr_width); - reg = sconfig->src_addr; - ctllo = (DWC_DEFAULT_CTLLO(chan) - | DWC_CTLL_SRC_WIDTH(reg_width) -@@ -879,7 +879,7 @@ slave_sg_todev_fill_desc: - len = sg_dma_len(sg); - - mem_width = min_t(unsigned int, -- data_width, dwc_fast_fls(mem | len)); -+ data_width, dwc_fast_ffs(mem | len)); - - slave_sg_fromdev_fill_desc: - desc = dwc_desc_get(dwc); -diff --git a/drivers/edac/edac_device.c b/drivers/edac/edac_device.c -index 592af5f0cf39..53587377e672 100644 ---- a/drivers/edac/edac_device.c -+++ b/drivers/edac/edac_device.c -@@ -435,16 +435,13 @@ void edac_device_workq_setup(struct edac_device_ctl_info *edac_dev, - */ - void edac_device_workq_teardown(struct edac_device_ctl_info *edac_dev) - { -- int status; -- - if (!edac_dev->edac_check) - return; - -- status = cancel_delayed_work(&edac_dev->work); -- if (status == 0) { -- /* workq instance might be running, wait for it */ -- flush_workqueue(edac_workqueue); -- } -+ edac_dev->op_state = OP_OFFLINE; -+ -+ cancel_delayed_work_sync(&edac_dev->work); -+ flush_workqueue(edac_workqueue); - } - - /* -diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c -index 33edd6766344..19dc0bc9b136 100644 ---- a/drivers/edac/edac_mc.c -+++ b/drivers/edac/edac_mc.c -@@ -584,18 +584,10 @@ static void edac_mc_workq_setup(struct mem_ctl_info *mci, unsigned msec, - */ - static void edac_mc_workq_teardown(struct mem_ctl_info *mci) - { -- int status; -- -- if (mci->op_state != OP_RUNNING_POLL) -- return; -- -- status = cancel_delayed_work(&mci->work); -- if (status == 0) { -- edac_dbg(0, "not canceled, flush the queue\n"); -+ mci->op_state = OP_OFFLINE; - -- /* workq instance might be running, wait for it */ -- flush_workqueue(edac_workqueue); -- } -+ cancel_delayed_work_sync(&mci->work); -+ flush_workqueue(edac_workqueue); - } - - /* -diff --git a/drivers/edac/edac_pci.c b/drivers/edac/edac_pci.c -index 2cf44b4db80c..b4b38603b804 100644 ---- a/drivers/edac/edac_pci.c -+++ b/drivers/edac/edac_pci.c -@@ -274,13 +274,12 @@ static void edac_pci_workq_setup(struct edac_pci_ctl_info *pci, - */ - static void edac_pci_workq_teardown(struct edac_pci_ctl_info *pci) - { -- int status; -- - edac_dbg(0, "\n"); - -- status = cancel_delayed_work(&pci->work); -- if (status == 0) -- flush_workqueue(edac_workqueue); -+ pci->op_state = OP_OFFLINE; -+ -+ cancel_delayed_work_sync(&pci->work); -+ flush_workqueue(edac_workqueue); - } - - /* -diff --git a/drivers/gpu/drm/ast/ast_drv.h b/drivers/gpu/drm/ast/ast_drv.h -index 9833a1b1acc1..3fc122306f1f 100644 ---- a/drivers/gpu/drm/ast/ast_drv.h -+++ b/drivers/gpu/drm/ast/ast_drv.h -@@ -296,6 +296,7 @@ int ast_framebuffer_init(struct drm_device *dev, - int ast_fbdev_init(struct drm_device *dev); - void ast_fbdev_fini(struct drm_device *dev); - void ast_fbdev_set_suspend(struct drm_device *dev, int state); -+void ast_fbdev_set_base(struct ast_private *ast, unsigned long gpu_addr); - - struct ast_bo { - struct ttm_buffer_object bo; -diff --git a/drivers/gpu/drm/ast/ast_fb.c b/drivers/gpu/drm/ast/ast_fb.c -index a28640f47c27..b55b6b1c9fe2 100644 ---- a/drivers/gpu/drm/ast/ast_fb.c -+++ b/drivers/gpu/drm/ast/ast_fb.c -@@ -367,3 +367,10 @@ void ast_fbdev_set_suspend(struct drm_device *dev, int state) - - fb_set_suspend(ast->fbdev->helper.fbdev, state); - } -+ -+void ast_fbdev_set_base(struct ast_private *ast, unsigned long gpu_addr) -+{ -+ ast->fbdev->helper.fbdev->fix.smem_start = -+ ast->fbdev->helper.fbdev->apertures->ranges[0].base + gpu_addr; -+ ast->fbdev->helper.fbdev->fix.smem_len = ast->vram_size - gpu_addr; -+} -diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c -index d830b38e54f6..c0f284230a39 100644 ---- a/drivers/gpu/drm/ast/ast_main.c -+++ b/drivers/gpu/drm/ast/ast_main.c -@@ -312,6 +312,7 @@ int ast_driver_load(struct drm_device *dev, unsigned long flags) - dev->mode_config.min_height = 0; - dev->mode_config.preferred_depth = 24; - dev->mode_config.prefer_shadow = 1; -+ dev->mode_config.fb_base = pci_resource_start(ast->dev->pdev, 0); - - if (ast->chip == AST2100 || - ast->chip == AST2200 || -diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c -index d2e56e95d886..cea916fa164b 100644 ---- a/drivers/gpu/drm/ast/ast_mode.c -+++ b/drivers/gpu/drm/ast/ast_mode.c -@@ -509,6 +509,8 @@ static int ast_crtc_do_set_base(struct drm_crtc *crtc, - ret = ttm_bo_kmap(&bo->bo, 0, bo->bo.num_pages, &bo->kmap); - if (ret) - DRM_ERROR("failed to kmap fbcon\n"); -+ else -+ ast_fbdev_set_base(ast, gpu_addr); - } - ast_bo_unreserve(bo); - -diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c -index 958b26dcac8a..0a9d1fd32994 100644 ---- a/drivers/gpu/drm/i915/intel_display.c -+++ b/drivers/gpu/drm/i915/intel_display.c -@@ -8821,11 +8821,21 @@ connected_sink_compute_bpp(struct intel_connector * connector, - pipe_config->pipe_bpp = connector->base.display_info.bpc*3; - } - -- /* Clamp bpp to 8 on screens without EDID 1.4 */ -- if (connector->base.display_info.bpc == 0 && bpp > 24) { -- DRM_DEBUG_KMS("clamping display bpp (was %d) to default limit of 24\n", -- bpp); -- pipe_config->pipe_bpp = 24; -+ /* Clamp bpp to default limit on screens without EDID 1.4 */ -+ if (connector->base.display_info.bpc == 0) { -+ int type = connector->base.connector_type; -+ int clamp_bpp = 24; -+ -+ /* Fall back to 18 bpp when DP sink capability is unknown. */ -+ if (type == DRM_MODE_CONNECTOR_DisplayPort || -+ type == DRM_MODE_CONNECTOR_eDP) -+ clamp_bpp = 18; -+ -+ if (bpp > clamp_bpp) { -+ DRM_DEBUG_KMS("clamping display bpp (was %d) to default limit of %d\n", -+ bpp, clamp_bpp); -+ pipe_config->pipe_bpp = clamp_bpp; -+ } - } - } - -diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c -index 56a13a915155..0928c5e2bafd 100644 ---- a/drivers/gpu/drm/qxl/qxl_ioctl.c -+++ b/drivers/gpu/drm/qxl/qxl_ioctl.c -@@ -168,7 +168,8 @@ static int qxl_process_single_command(struct qxl_device *qdev, - cmd->command_size)) - return -EFAULT; - -- reloc_info = kmalloc(sizeof(struct qxl_reloc_info) * cmd->relocs_num, GFP_KERNEL); -+ reloc_info = kmalloc_array(cmd->relocs_num, -+ sizeof(struct qxl_reloc_info), GFP_KERNEL); - if (!reloc_info) - return -ENOMEM; - -diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c -index 2fa3cf615a67..6a3b5f92219f 100644 ---- a/drivers/gpu/drm/radeon/radeon_atombios.c -+++ b/drivers/gpu/drm/radeon/radeon_atombios.c -@@ -436,7 +436,9 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev, - } - - /* Fujitsu D3003-S2 board lists DVI-I as DVI-D and VGA */ -- if (((dev->pdev->device == 0x9802) || (dev->pdev->device == 0x9806)) && -+ if (((dev->pdev->device == 0x9802) || -+ (dev->pdev->device == 0x9805) || -+ (dev->pdev->device == 0x9806)) && - (dev->pdev->subsystem_vendor == 0x1734) && - (dev->pdev->subsystem_device == 0x11bd)) { - if (*connector_type == DRM_MODE_CONNECTOR_VGA) { -@@ -447,14 +449,6 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev, - } - } - -- /* Fujitsu D3003-S2 board lists DVI-I as DVI-I and VGA */ -- if ((dev->pdev->device == 0x9805) && -- (dev->pdev->subsystem_vendor == 0x1734) && -- (dev->pdev->subsystem_device == 0x11bd)) { -- if (*connector_type == DRM_MODE_CONNECTOR_VGA) -- return false; -- } -- - return true; - } - -diff --git a/drivers/gpu/drm/radeon/radeon_irq_kms.c b/drivers/gpu/drm/radeon/radeon_irq_kms.c -index f8b20e1c0820..614144d34aea 100644 ---- a/drivers/gpu/drm/radeon/radeon_irq_kms.c -+++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c -@@ -79,6 +79,11 @@ static void radeon_hotplug_work_func(struct work_struct *work) - struct drm_mode_config *mode_config = &dev->mode_config; - struct drm_connector *connector; - -+ /* we can race here at startup, some boards seem to trigger -+ * hotplug irqs when they shouldn't. */ -+ if (!rdev->mode_info.mode_config_initialized) -+ return; -+ - mutex_lock(&mode_config->mutex); - if (mode_config->num_connector) { - list_for_each_entry(connector, &mode_config->connector_list, head) -diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c -index 0b00de55b2a4..9a559140e4a3 100644 ---- a/drivers/gpu/drm/radeon/radeon_pm.c -+++ b/drivers/gpu/drm/radeon/radeon_pm.c -@@ -915,8 +915,6 @@ static void radeon_dpm_change_power_state_locked(struct radeon_device *rdev) - - /* update display watermarks based on new power state */ - radeon_bandwidth_update(rdev); -- /* update displays */ -- radeon_dpm_display_configuration_changed(rdev); - - rdev->pm.dpm.current_active_crtcs = rdev->pm.dpm.new_active_crtcs; - rdev->pm.dpm.current_active_crtc_count = rdev->pm.dpm.new_active_crtc_count; -@@ -936,6 +934,9 @@ static void radeon_dpm_change_power_state_locked(struct radeon_device *rdev) - - radeon_dpm_post_set_power_state(rdev); - -+ /* update displays */ -+ radeon_dpm_display_configuration_changed(rdev); -+ - if (rdev->asic->dpm.force_performance_level) { - if (rdev->pm.dpm.thermal_active) { - enum radeon_dpm_forced_level level = rdev->pm.dpm.forced_level; -@@ -1364,8 +1365,7 @@ int radeon_pm_late_init(struct radeon_device *rdev) - ret = device_create_file(rdev->dev, &dev_attr_power_method); - if (ret) - DRM_ERROR("failed to create device file for power method\n"); -- if (!ret) -- rdev->pm.sysfs_initialized = true; -+ rdev->pm.sysfs_initialized = true; - } - - mutex_lock(&rdev->pm.mutex); -diff --git a/drivers/gpu/drm/radeon/radeon_sa.c b/drivers/gpu/drm/radeon/radeon_sa.c -index c0625805cdd7..a1d684266549 100644 ---- a/drivers/gpu/drm/radeon/radeon_sa.c -+++ b/drivers/gpu/drm/radeon/radeon_sa.c -@@ -349,8 +349,13 @@ int radeon_sa_bo_new(struct radeon_device *rdev, - /* see if we can skip over some allocations */ - } while (radeon_sa_bo_next_hole(sa_manager, fences, tries)); - -+ for (i = 0; i < RADEON_NUM_RINGS; ++i) -+ radeon_fence_ref(fences[i]); -+ - spin_unlock(&sa_manager->wq.lock); - r = radeon_fence_wait_any(rdev, fences, false); -+ for (i = 0; i < RADEON_NUM_RINGS; ++i) -+ radeon_fence_unref(&fences[i]); - spin_lock(&sa_manager->wq.lock); - /* if we have nothing to wait for block */ - if (r == -ENOENT && block) { -diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c -index 45a9a03efc06..2d50433b8c72 100644 ---- a/drivers/gpu/drm/radeon/radeon_ttm.c -+++ b/drivers/gpu/drm/radeon/radeon_ttm.c -@@ -623,7 +623,7 @@ static int radeon_ttm_tt_populate(struct ttm_tt *ttm) - 0, PAGE_SIZE, - PCI_DMA_BIDIRECTIONAL); - if (pci_dma_mapping_error(rdev->pdev, gtt->ttm.dma_address[i])) { -- while (--i) { -+ while (i--) { - pci_unmap_page(rdev->pdev, gtt->ttm.dma_address[i], - PAGE_SIZE, PCI_DMA_BIDIRECTIONAL); - gtt->ttm.dma_address[i] = 0; -diff --git a/drivers/gpu/drm/radeon/rv770_dpm.c b/drivers/gpu/drm/radeon/rv770_dpm.c -index 8fcb932a3a55..aaefb10aa09e 100644 ---- a/drivers/gpu/drm/radeon/rv770_dpm.c -+++ b/drivers/gpu/drm/radeon/rv770_dpm.c -@@ -1415,7 +1415,7 @@ int rv770_resume_smc(struct radeon_device *rdev) - int rv770_set_sw_state(struct radeon_device *rdev) - { - if (rv770_send_msg_to_smc(rdev, PPSMC_MSG_SwitchToSwState) != PPSMC_Result_OK) -- return -EINVAL; -+ DRM_ERROR("rv770_set_sw_state failed\n"); - return 0; - } - -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c -index 0771dcbf9ed0..7c48070cf9d8 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c -@@ -25,6 +25,7 @@ - * - **************************************************************************/ - #include -+#include - - #include - #include "vmwgfx_drv.h" -@@ -1383,6 +1384,12 @@ static int vmw_probe(struct pci_dev *pdev, const struct pci_device_id *ent) - static int __init vmwgfx_init(void) - { - int ret; -+ -+#ifdef CONFIG_VGA_CONSOLE -+ if (vgacon_text_force()) -+ return -EINVAL; -+#endif -+ - ret = drm_pci_init(&driver, &vmw_pci_driver); - if (ret) - DRM_ERROR("Failed initializing DRM.\n"); -diff --git a/drivers/gpu/vga/vgaarb.c b/drivers/gpu/vga/vgaarb.c -index af0259708358..bbb554d586d4 100644 ---- a/drivers/gpu/vga/vgaarb.c -+++ b/drivers/gpu/vga/vgaarb.c -@@ -392,8 +392,10 @@ int vga_get(struct pci_dev *pdev, unsigned int rsrc, int interruptible) - set_current_state(interruptible ? - TASK_INTERRUPTIBLE : - TASK_UNINTERRUPTIBLE); -- if (signal_pending(current)) { -- rc = -EINTR; -+ if (interruptible && signal_pending(current)) { -+ __set_current_state(TASK_RUNNING); -+ remove_wait_queue(&vga_wait_queue, &wait); -+ rc = -ERESTARTSYS; - break; - } - schedule(); -diff --git a/drivers/hwmon/ads1015.c b/drivers/hwmon/ads1015.c -index 126516414c11..44223f5d92d8 100644 ---- a/drivers/hwmon/ads1015.c -+++ b/drivers/hwmon/ads1015.c -@@ -126,7 +126,7 @@ static int ads1015_reg_to_mv(struct i2c_client *client, unsigned int channel, - struct ads1015_data *data = i2c_get_clientdata(client); - unsigned int pga = data->channel_data[channel].pga; - int fullscale = fullscale_table[pga]; -- const unsigned mask = data->id == ads1115 ? 0x7fff : 0x7ff0; -+ const int mask = data->id == ads1115 ? 0x7fff : 0x7ff0; - - return DIV_ROUND_CLOSEST(reg * fullscale, mask); - } -diff --git a/drivers/infiniband/hw/cxgb3/iwch_cm.c b/drivers/infiniband/hw/cxgb3/iwch_cm.c -index 095bb046e2c8..875348699e6e 100644 ---- a/drivers/infiniband/hw/cxgb3/iwch_cm.c -+++ b/drivers/infiniband/hw/cxgb3/iwch_cm.c -@@ -149,7 +149,7 @@ static int iwch_l2t_send(struct t3cdev *tdev, struct sk_buff *skb, struct l2t_en - error = l2t_send(tdev, skb, l2e); - if (error < 0) - kfree_skb(skb); -- return error; -+ return error < 0 ? error : 0; - } - - int iwch_cxgb3_ofld_send(struct t3cdev *tdev, struct sk_buff *skb) -@@ -165,7 +165,7 @@ int iwch_cxgb3_ofld_send(struct t3cdev *tdev, struct sk_buff *skb) - error = cxgb3_ofld_send(tdev, skb); - if (error < 0) - kfree_skb(skb); -- return error; -+ return error < 0 ? error : 0; - } - - static void release_tid(struct t3cdev *tdev, u32 hwtid, struct sk_buff *skb) -diff --git a/drivers/infiniband/hw/qib/qib_verbs_mcast.c b/drivers/infiniband/hw/qib/qib_verbs_mcast.c -index dabb697b1c2a..48ba1c3e945a 100644 ---- a/drivers/infiniband/hw/qib/qib_verbs_mcast.c -+++ b/drivers/infiniband/hw/qib/qib_verbs_mcast.c -@@ -286,15 +286,13 @@ int qib_multicast_detach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid) - struct qib_ibdev *dev = to_idev(ibqp->device); - struct qib_ibport *ibp = to_iport(ibqp->device, qp->port_num); - struct qib_mcast *mcast = NULL; -- struct qib_mcast_qp *p, *tmp; -+ struct qib_mcast_qp *p, *tmp, *delp = NULL; - struct rb_node *n; - int last = 0; - int ret; - -- if (ibqp->qp_num <= 1 || qp->state == IB_QPS_RESET) { -- ret = -EINVAL; -- goto bail; -- } -+ if (ibqp->qp_num <= 1 || qp->state == IB_QPS_RESET) -+ return -EINVAL; - - spin_lock_irq(&ibp->lock); - -@@ -303,8 +301,7 @@ int qib_multicast_detach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid) - while (1) { - if (n == NULL) { - spin_unlock_irq(&ibp->lock); -- ret = -EINVAL; -- goto bail; -+ return -EINVAL; - } - - mcast = rb_entry(n, struct qib_mcast, rb_node); -@@ -328,6 +325,7 @@ int qib_multicast_detach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid) - */ - list_del_rcu(&p->list); - mcast->n_attached--; -+ delp = p; - - /* If this was the last attached QP, remove the GID too. */ - if (list_empty(&mcast->qp_list)) { -@@ -338,15 +336,16 @@ int qib_multicast_detach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid) - } - - spin_unlock_irq(&ibp->lock); -+ /* QP not attached */ -+ if (!delp) -+ return -EINVAL; -+ /* -+ * Wait for any list walkers to finish before freeing the -+ * list element. -+ */ -+ wait_event(mcast->wait, atomic_read(&mcast->refcount) <= 1); -+ qib_mcast_qp_free(delp); - -- if (p) { -- /* -- * Wait for any list walkers to finish before freeing the -- * list element. -- */ -- wait_event(mcast->wait, atomic_read(&mcast->refcount) <= 1); -- qib_mcast_qp_free(p); -- } - if (last) { - atomic_dec(&mcast->refcount); - wait_event(mcast->wait, !atomic_read(&mcast->refcount)); -@@ -355,11 +354,7 @@ int qib_multicast_detach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid) - dev->n_mcast_grps_allocated--; - spin_unlock_irq(&dev->n_mcast_grps_lock); - } -- -- ret = 0; -- --bail: -- return ret; -+ return 0; - } - - int qib_mcast_tree_empty(struct qib_ibport *ibp) -diff --git a/drivers/irqchip/irq-versatile-fpga.c b/drivers/irqchip/irq-versatile-fpga.c -index 3ae2bb8d9cf2..21a44b168d46 100644 ---- a/drivers/irqchip/irq-versatile-fpga.c -+++ b/drivers/irqchip/irq-versatile-fpga.c -@@ -204,7 +204,12 @@ int __init fpga_irq_of_init(struct device_node *node, - if (!parent_irq) - parent_irq = -1; - -+#ifdef CONFIG_ARCH_VERSATILE -+ fpga_irq_init(base, node->name, IRQ_SIC_START, parent_irq, valid_mask, -+ node); -+#else - fpga_irq_init(base, node->name, 0, parent_irq, valid_mask, node); -+#endif - - writel(clear_mask, base + IRQ_ENABLE_CLEAR); - writel(clear_mask, base + FIQ_ENABLE_CLEAR); -diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c -index fbcb6225f794..74a5786ddcce 100644 ---- a/drivers/md/bcache/btree.c -+++ b/drivers/md/bcache/btree.c -@@ -1641,6 +1641,7 @@ static void bch_btree_gc(struct cache_set *c) - do { - ret = btree_root(gc_root, c, &op, &writes, &stats); - closure_sync(&writes); -+ cond_resched(); - - if (ret && ret != -EAGAIN) - pr_warn("gc failed!"); -@@ -2037,8 +2038,10 @@ int bch_btree_insert_check_key(struct btree *b, struct btree_op *op, - rw_lock(true, b, b->level); - - if (b->key.ptr[0] != btree_ptr || -- b->seq != seq + 1) -+ b->seq != seq + 1) { -+ op->lock = b->level; - goto out; -+ } - } - - SET_KEY_PTRS(check_key, 1); -diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c -index 24a3a1546caa..1b6beb1e3142 100644 ---- a/drivers/md/bcache/super.c -+++ b/drivers/md/bcache/super.c -@@ -712,6 +712,8 @@ static void bcache_device_link(struct bcache_device *d, struct cache_set *c, - WARN(sysfs_create_link(&d->kobj, &c->kobj, "cache") || - sysfs_create_link(&c->kobj, &d->kobj, d->name), - "Couldn't create device <-> cache set symlinks"); -+ -+ clear_bit(BCACHE_DEV_UNLINK_DONE, &d->flags); - } - - static void bcache_device_detach(struct bcache_device *d) -@@ -882,8 +884,11 @@ void bch_cached_dev_run(struct cached_dev *dc) - buf[SB_LABEL_SIZE] = '\0'; - env[2] = kasprintf(GFP_KERNEL, "CACHED_LABEL=%s", buf); - -- if (atomic_xchg(&dc->running, 1)) -+ if (atomic_xchg(&dc->running, 1)) { -+ kfree(env[1]); -+ kfree(env[2]); - return; -+ } - - if (!d->c && - BDEV_STATE(&dc->sb) != BDEV_STATE_NONE) { -@@ -2081,8 +2086,10 @@ static int __init bcache_init(void) - closure_debug_init(); - - bcache_major = register_blkdev(0, "bcache"); -- if (bcache_major < 0) -+ if (bcache_major < 0) { -+ unregister_reboot_notifier(&reboot); - return bcache_major; -+ } - - if (!(bcache_wq = create_workqueue("bcache")) || - !(bcache_kobj = kobject_create_and_add("bcache", fs_kobj)) || -diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c -index f4300e4c0114..d6525c12c8d8 100644 ---- a/drivers/md/bcache/writeback.c -+++ b/drivers/md/bcache/writeback.c -@@ -323,6 +323,10 @@ void bcache_dev_sectors_dirty_add(struct cache_set *c, unsigned inode, - - static bool dirty_pred(struct keybuf *buf, struct bkey *k) - { -+ struct cached_dev *dc = container_of(buf, struct cached_dev, writeback_keys); -+ -+ BUG_ON(KEY_INODE(k) != dc->disk.id); -+ - return KEY_DIRTY(k); - } - -@@ -372,11 +376,24 @@ next: - } - } - -+/* -+ * Returns true if we scanned the entire disk -+ */ - static bool refill_dirty(struct cached_dev *dc) - { - struct keybuf *buf = &dc->writeback_keys; -+ struct bkey start = KEY(dc->disk.id, 0, 0); - struct bkey end = KEY(dc->disk.id, MAX_KEY_OFFSET, 0); -- bool searched_from_start = false; -+ struct bkey start_pos; -+ -+ /* -+ * make sure keybuf pos is inside the range for this disk - at bringup -+ * we might not be attached yet so this disk's inode nr isn't -+ * initialized then -+ */ -+ if (bkey_cmp(&buf->last_scanned, &start) < 0 || -+ bkey_cmp(&buf->last_scanned, &end) > 0) -+ buf->last_scanned = start; - - if (dc->partial_stripes_expensive) { - refill_full_stripes(dc); -@@ -384,14 +401,20 @@ static bool refill_dirty(struct cached_dev *dc) - return false; - } - -- if (bkey_cmp(&buf->last_scanned, &end) >= 0) { -- buf->last_scanned = KEY(dc->disk.id, 0, 0); -- searched_from_start = true; -- } -- -+ start_pos = buf->last_scanned; - bch_refill_keybuf(dc->disk.c, buf, &end, dirty_pred); - -- return bkey_cmp(&buf->last_scanned, &end) >= 0 && searched_from_start; -+ if (bkey_cmp(&buf->last_scanned, &end) < 0) -+ return false; -+ -+ /* -+ * If we get to the end start scanning again from the beginning, and -+ * only scan up to where we initially started scanning from: -+ */ -+ buf->last_scanned = start; -+ bch_refill_keybuf(dc->disk.c, buf, &start_pos, dirty_pred); -+ -+ return bkey_cmp(&buf->last_scanned, &start_pos) >= 0; - } - - static int bch_writeback_thread(void *arg) -diff --git a/drivers/md/bcache/writeback.h b/drivers/md/bcache/writeback.h -index e2f8598937ac..afe7ecada503 100644 ---- a/drivers/md/bcache/writeback.h -+++ b/drivers/md/bcache/writeback.h -@@ -63,7 +63,8 @@ static inline bool should_writeback(struct cached_dev *dc, struct bio *bio, - - static inline void bch_writeback_queue(struct cached_dev *dc) - { -- wake_up_process(dc->writeback_thread); -+ if (!IS_ERR_OR_NULL(dc->writeback_thread)) -+ wake_up_process(dc->writeback_thread); - } - - static inline void bch_writeback_add(struct cached_dev *dc) -diff --git a/drivers/md/dm-exception-store.h b/drivers/md/dm-exception-store.h -index 0b2536247cf5..84e27708ad97 100644 ---- a/drivers/md/dm-exception-store.h -+++ b/drivers/md/dm-exception-store.h -@@ -70,7 +70,7 @@ struct dm_exception_store_type { - * Update the metadata with this exception. - */ - void (*commit_exception) (struct dm_exception_store *store, -- struct dm_exception *e, -+ struct dm_exception *e, int valid, - void (*callback) (void *, int success), - void *callback_context); - -diff --git a/drivers/md/dm-snap-persistent.c b/drivers/md/dm-snap-persistent.c -index d6e88178d22c..d3272acc0f0e 100644 ---- a/drivers/md/dm-snap-persistent.c -+++ b/drivers/md/dm-snap-persistent.c -@@ -700,7 +700,7 @@ static int persistent_prepare_exception(struct dm_exception_store *store, - } - - static void persistent_commit_exception(struct dm_exception_store *store, -- struct dm_exception *e, -+ struct dm_exception *e, int valid, - void (*callback) (void *, int success), - void *callback_context) - { -@@ -709,6 +709,9 @@ static void persistent_commit_exception(struct dm_exception_store *store, - struct core_exception ce; - struct commit_callback *cb; - -+ if (!valid) -+ ps->valid = 0; -+ - ce.old_chunk = e->old_chunk; - ce.new_chunk = e->new_chunk; - write_exception(ps, ps->current_committed++, &ce); -diff --git a/drivers/md/dm-snap-transient.c b/drivers/md/dm-snap-transient.c -index 1ce9a2586e41..31439d53cf7e 100644 ---- a/drivers/md/dm-snap-transient.c -+++ b/drivers/md/dm-snap-transient.c -@@ -52,12 +52,12 @@ static int transient_prepare_exception(struct dm_exception_store *store, - } - - static void transient_commit_exception(struct dm_exception_store *store, -- struct dm_exception *e, -+ struct dm_exception *e, int valid, - void (*callback) (void *, int success), - void *callback_context) - { - /* Just succeed */ -- callback(callback_context, 1); -+ callback(callback_context, valid); - } - - static void transient_usage(struct dm_exception_store *store, -diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c -index c356a10b9ba5..2e9117630dbe 100644 ---- a/drivers/md/dm-snap.c -+++ b/drivers/md/dm-snap.c -@@ -1388,8 +1388,9 @@ static void __invalidate_snapshot(struct dm_snapshot *s, int err) - dm_table_event(s->ti->table); - } - --static void pending_complete(struct dm_snap_pending_exception *pe, int success) -+static void pending_complete(void *context, int success) - { -+ struct dm_snap_pending_exception *pe = context; - struct dm_exception *e; - struct dm_snapshot *s = pe->snap; - struct bio *origin_bios = NULL; -@@ -1460,24 +1461,13 @@ out: - free_pending_exception(pe); - } - --static void commit_callback(void *context, int success) --{ -- struct dm_snap_pending_exception *pe = context; -- -- pending_complete(pe, success); --} -- - static void complete_exception(struct dm_snap_pending_exception *pe) - { - struct dm_snapshot *s = pe->snap; - -- if (unlikely(pe->copy_error)) -- pending_complete(pe, 0); -- -- else -- /* Update the metadata if we are persistent */ -- s->store->type->commit_exception(s->store, &pe->e, -- commit_callback, pe); -+ /* Update the metadata if we are persistent */ -+ s->store->type->commit_exception(s->store, &pe->e, !pe->copy_error, -+ pending_complete, pe); - } - - /* -diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c -index 3412b86e79fd..7768de60f699 100644 ---- a/drivers/md/dm-thin-metadata.c -+++ b/drivers/md/dm-thin-metadata.c -@@ -1205,6 +1205,12 @@ static int __reserve_metadata_snap(struct dm_pool_metadata *pmd) - dm_block_t held_root; - - /* -+ * We commit to ensure the btree roots which we increment in a -+ * moment are up to date. -+ */ -+ __commit_transaction(pmd); -+ -+ /* - * Copy the superblock. - */ - dm_sm_inc_block(pmd->metadata_sm, THIN_SUPERBLOCK_LOCATION); -diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c -index b94e4648c199..d633a3921b3c 100644 ---- a/drivers/md/dm-thin.c -+++ b/drivers/md/dm-thin.c -@@ -1619,6 +1619,7 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode) - case PM_WRITE: - if (old_mode != new_mode) - notify_of_pool_mode_change(pool, "write"); -+ pool->pf.error_if_no_space = pt->requested_pf.error_if_no_space; - dm_pool_metadata_read_write(pool->pmd); - pool->process_bio = process_bio; - pool->process_discard = process_discard; -@@ -2567,8 +2568,8 @@ static void pool_postsuspend(struct dm_target *ti) - struct pool_c *pt = ti->private; - struct pool *pool = pt->pool; - -- cancel_delayed_work(&pool->waker); -- cancel_delayed_work(&pool->no_space_timeout); -+ cancel_delayed_work_sync(&pool->waker); -+ cancel_delayed_work_sync(&pool->no_space_timeout); - flush_workqueue(pool->wq); - (void) commit(pool); - } -diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c -index 7ba85e2b146b..7b4bb1f09b01 100644 ---- a/drivers/md/persistent-data/dm-btree.c -+++ b/drivers/md/persistent-data/dm-btree.c -@@ -250,6 +250,16 @@ static void pop_frame(struct del_stack *s) - dm_tm_unlock(s->tm, f->b); - } - -+static void unlock_all_frames(struct del_stack *s) -+{ -+ struct frame *f; -+ -+ while (unprocessed_frames(s)) { -+ f = s->spine + s->top--; -+ dm_tm_unlock(s->tm, f->b); -+ } -+} -+ - int dm_btree_del(struct dm_btree_info *info, dm_block_t root) - { - int r; -@@ -306,9 +316,13 @@ int dm_btree_del(struct dm_btree_info *info, dm_block_t root) - pop_frame(s); - } - } -- - out: -+ if (r) { -+ /* cleanup all frames of del_stack */ -+ unlock_all_frames(s); -+ } - kfree(s); -+ - return r; - } - EXPORT_SYMBOL_GPL(dm_btree_del); -diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c -index 199c9ccd1f5d..032ee39a0e9b 100644 ---- a/drivers/md/persistent-data/dm-space-map-metadata.c -+++ b/drivers/md/persistent-data/dm-space-map-metadata.c -@@ -136,7 +136,7 @@ static int brb_push(struct bop_ring_buffer *brb, - return 0; - } - --static int brb_pop(struct bop_ring_buffer *brb, struct block_op *result) -+static int brb_peek(struct bop_ring_buffer *brb, struct block_op *result) - { - struct block_op *bop; - -@@ -147,6 +147,14 @@ static int brb_pop(struct bop_ring_buffer *brb, struct block_op *result) - result->type = bop->type; - result->block = bop->block; - -+ return 0; -+} -+ -+static int brb_pop(struct bop_ring_buffer *brb) -+{ -+ if (brb_empty(brb)) -+ return -ENODATA; -+ - brb->begin = brb_next(brb, brb->begin); - - return 0; -@@ -211,7 +219,7 @@ static int apply_bops(struct sm_metadata *smm) - while (!brb_empty(&smm->uncommitted)) { - struct block_op bop; - -- r = brb_pop(&smm->uncommitted, &bop); -+ r = brb_peek(&smm->uncommitted, &bop); - if (r) { - DMERR("bug in bop ring buffer"); - break; -@@ -220,6 +228,8 @@ static int apply_bops(struct sm_metadata *smm) - r = commit_bop(smm, &bop); - if (r) - break; -+ -+ brb_pop(&smm->uncommitted); - } - - return r; -@@ -681,7 +691,6 @@ static struct dm_space_map bootstrap_ops = { - static int sm_metadata_extend(struct dm_space_map *sm, dm_block_t extra_blocks) - { - int r, i; -- enum allocation_event ev; - struct sm_metadata *smm = container_of(sm, struct sm_metadata, sm); - dm_block_t old_len = smm->ll.nr_blocks; - -@@ -703,11 +712,12 @@ static int sm_metadata_extend(struct dm_space_map *sm, dm_block_t extra_blocks) - * allocate any new blocks. - */ - do { -- for (i = old_len; !r && i < smm->begin; i++) { -- r = sm_ll_inc(&smm->ll, i, &ev); -- if (r) -- goto out; -- } -+ for (i = old_len; !r && i < smm->begin; i++) -+ r = add_bop(smm, BOP_INC, i); -+ -+ if (r) -+ goto out; -+ - old_len = smm->begin; - - r = apply_bops(smm); -@@ -752,7 +762,6 @@ int dm_sm_metadata_create(struct dm_space_map *sm, - { - int r; - dm_block_t i; -- enum allocation_event ev; - struct sm_metadata *smm = container_of(sm, struct sm_metadata, sm); - - smm->begin = superblock + 1; -@@ -780,7 +789,7 @@ int dm_sm_metadata_create(struct dm_space_map *sm, - * allocated blocks that they were built from. - */ - for (i = superblock; !r && i < smm->begin; i++) -- r = sm_ll_inc(&smm->ll, i, &ev); -+ r = add_bop(smm, BOP_INC, i); - - if (r) - return r; -diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c -index 1f925e856974..46a984291b7d 100644 ---- a/drivers/media/dvb-core/dvb_frontend.c -+++ b/drivers/media/dvb-core/dvb_frontend.c -@@ -2195,9 +2195,9 @@ static int dvb_frontend_ioctl_legacy(struct file *file, - dev_dbg(fe->dvb->device, "%s: current delivery system on cache: %d, V3 type: %d\n", - __func__, c->delivery_system, fe->ops.info.type); - -- /* Force the CAN_INVERSION_AUTO bit on. If the frontend doesn't -- * do it, it is done for it. */ -- info->caps |= FE_CAN_INVERSION_AUTO; -+ /* Set CAN_INVERSION_AUTO bit on in other than oneshot mode */ -+ if (!(fepriv->tune_mode_flags & FE_TUNE_MODE_ONESHOT)) -+ info->caps |= FE_CAN_INVERSION_AUTO; - err = 0; - break; - } -diff --git a/drivers/media/dvb-frontends/tda1004x.c b/drivers/media/dvb-frontends/tda1004x.c -index a2631be7ffac..08e0f0dd8728 100644 ---- a/drivers/media/dvb-frontends/tda1004x.c -+++ b/drivers/media/dvb-frontends/tda1004x.c -@@ -903,9 +903,18 @@ static int tda1004x_get_fe(struct dvb_frontend *fe) - { - struct dtv_frontend_properties *fe_params = &fe->dtv_property_cache; - struct tda1004x_state* state = fe->demodulator_priv; -+ int status; - - dprintk("%s\n", __func__); - -+ status = tda1004x_read_byte(state, TDA1004X_STATUS_CD); -+ if (status == -1) -+ return -EIO; -+ -+ /* Only update the properties cache if device is locked */ -+ if (!(status & 8)) -+ return 0; -+ - // inversion status - fe_params->inversion = INVERSION_OFF; - if (tda1004x_read_byte(state, TDA1004X_CONFC1) & 0x20) -diff --git a/drivers/media/usb/gspca/ov534.c b/drivers/media/usb/gspca/ov534.c -index 90f0d637cd9d..cd05840abc91 100644 ---- a/drivers/media/usb/gspca/ov534.c -+++ b/drivers/media/usb/gspca/ov534.c -@@ -1490,8 +1490,13 @@ static void sd_set_streamparm(struct gspca_dev *gspca_dev, - struct v4l2_fract *tpf = &cp->timeperframe; - struct sd *sd = (struct sd *) gspca_dev; - -- /* Set requested framerate */ -- sd->frame_rate = tpf->denominator / tpf->numerator; -+ if (tpf->numerator == 0 || tpf->denominator == 0) -+ /* Set default framerate */ -+ sd->frame_rate = 30; -+ else -+ /* Set requested framerate */ -+ sd->frame_rate = tpf->denominator / tpf->numerator; -+ - if (gspca_dev->streaming) - set_frame_rate(gspca_dev); - -diff --git a/drivers/media/usb/gspca/topro.c b/drivers/media/usb/gspca/topro.c -index 640c2fe760b3..a6fbb2a07979 100644 ---- a/drivers/media/usb/gspca/topro.c -+++ b/drivers/media/usb/gspca/topro.c -@@ -4792,7 +4792,11 @@ static void sd_set_streamparm(struct gspca_dev *gspca_dev, - struct v4l2_fract *tpf = &cp->timeperframe; - int fr, i; - -- sd->framerate = tpf->denominator / tpf->numerator; -+ if (tpf->numerator == 0 || tpf->denominator == 0) -+ sd->framerate = 30; -+ else -+ sd->framerate = tpf->denominator / tpf->numerator; -+ - if (gspca_dev->streaming) - setframerate(gspca_dev, v4l2_ctrl_g_ctrl(gspca_dev->exposure)); - -diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c -index d71f5ef036e0..92aeb1d2b41b 100644 ---- a/drivers/mmc/card/block.c -+++ b/drivers/mmc/card/block.c -@@ -62,8 +62,7 @@ MODULE_ALIAS("mmc:block"); - #define MMC_SANITIZE_REQ_TIMEOUT 240000 - #define MMC_EXTRACT_INDEX_FROM_ARG(x) ((x & 0x00FF0000) >> 16) - --#define mmc_req_rel_wr(req) (((req->cmd_flags & REQ_FUA) || \ -- (req->cmd_flags & REQ_META)) && \ -+#define mmc_req_rel_wr(req) ((req->cmd_flags & REQ_FUA) && \ - (rq_data_dir(req) == WRITE)) - #define PACKED_CMD_VER 0x01 - #define PACKED_CMD_WR 0x02 -@@ -1328,13 +1327,9 @@ static void mmc_blk_rw_rq_prep(struct mmc_queue_req *mqrq, - - /* - * Reliable writes are used to implement Forced Unit Access and -- * REQ_META accesses, and are supported only on MMCs. -- * -- * XXX: this really needs a good explanation of why REQ_META -- * is treated special. -+ * are supported only on MMCs. - */ -- bool do_rel_wr = ((req->cmd_flags & REQ_FUA) || -- (req->cmd_flags & REQ_META)) && -+ bool do_rel_wr = (req->cmd_flags & REQ_FUA) && - (rq_data_dir(req) == WRITE) && - (md->flags & MMC_BLK_REL_WR); - -diff --git a/drivers/mmc/core/sdio.c b/drivers/mmc/core/sdio.c -index 4d721c6e2af0..ae360b3b4fda 100644 ---- a/drivers/mmc/core/sdio.c -+++ b/drivers/mmc/core/sdio.c -@@ -670,7 +670,7 @@ try_again: - */ - if (!powered_resume && (rocr & ocr & R4_18V_PRESENT)) { - err = mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_180, -- ocr); -+ ocr_card); - if (err == -EAGAIN) { - sdio_reset(host); - mmc_go_idle(host); -diff --git a/drivers/mmc/host/mmci.c b/drivers/mmc/host/mmci.c -index b93122636531..8103db25db69 100644 ---- a/drivers/mmc/host/mmci.c -+++ b/drivers/mmc/host/mmci.c -@@ -1860,7 +1860,7 @@ static struct amba_id mmci_ids[] = { - { - .id = 0x00280180, - .mask = 0x00ffffff, -- .data = &variant_u300, -+ .data = &variant_nomadik, - }, - { - .id = 0x00480180, -diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c -index 881bf89acfcc..75d3c28940f1 100644 ---- a/drivers/mmc/host/sdhci.c -+++ b/drivers/mmc/host/sdhci.c -@@ -2663,7 +2663,7 @@ static int sdhci_runtime_pm_put(struct sdhci_host *host) - - static void sdhci_runtime_pm_bus_on(struct sdhci_host *host) - { -- if (host->runtime_suspended || host->bus_on) -+ if (host->bus_on) - return; - host->bus_on = true; - pm_runtime_get_noresume(host->mmc->parent); -@@ -2671,7 +2671,7 @@ static void sdhci_runtime_pm_bus_on(struct sdhci_host *host) - - static void sdhci_runtime_pm_bus_off(struct sdhci_host *host) - { -- if (host->runtime_suspended || !host->bus_on) -+ if (!host->bus_on) - return; - host->bus_on = false; - pm_runtime_put_noidle(host->mmc->parent); -diff --git a/drivers/net/can/sja1000/sja1000.c b/drivers/net/can/sja1000/sja1000.c -index c2d0559115d3..732a8ed571c2 100644 ---- a/drivers/net/can/sja1000/sja1000.c -+++ b/drivers/net/can/sja1000/sja1000.c -@@ -187,6 +187,9 @@ static void sja1000_start(struct net_device *dev) - /* clear interrupt flags */ - priv->read_reg(priv, SJA1000_IR); - -+ /* clear interrupt flags */ -+ priv->read_reg(priv, SJA1000_IR); -+ - /* leave reset mode */ - set_normal_mode(dev); - } -diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c -index 52c42fd49510..a5735a7797f8 100644 ---- a/drivers/net/can/usb/ems_usb.c -+++ b/drivers/net/can/usb/ems_usb.c -@@ -117,6 +117,9 @@ MODULE_LICENSE("GPL v2"); - */ - #define EMS_USB_ARM7_CLOCK 8000000 - -+#define CPC_TX_QUEUE_TRIGGER_LOW 25 -+#define CPC_TX_QUEUE_TRIGGER_HIGH 35 -+ - /* - * CAN-Message representation in a CPC_MSG. Message object type is - * CPC_MSG_TYPE_CAN_FRAME or CPC_MSG_TYPE_RTR_FRAME or -@@ -278,6 +281,11 @@ static void ems_usb_read_interrupt_callback(struct urb *urb) - switch (urb->status) { - case 0: - dev->free_slots = dev->intr_in_buffer[1]; -+ if(dev->free_slots > CPC_TX_QUEUE_TRIGGER_HIGH){ -+ if (netif_queue_stopped(netdev)){ -+ netif_wake_queue(netdev); -+ } -+ } - break; - - case -ECONNRESET: /* unlink */ -@@ -529,8 +537,6 @@ static void ems_usb_write_bulk_callback(struct urb *urb) - /* Release context */ - context->echo_index = MAX_TX_URBS; - -- if (netif_queue_stopped(netdev)) -- netif_wake_queue(netdev); - } - - /* -@@ -590,7 +596,7 @@ static int ems_usb_start(struct ems_usb *dev) - int err, i; - - dev->intr_in_buffer[0] = 0; -- dev->free_slots = 15; /* initial size */ -+ dev->free_slots = 50; /* initial size */ - - for (i = 0; i < MAX_RX_URBS; i++) { - struct urb *urb = NULL; -@@ -841,7 +847,7 @@ static netdev_tx_t ems_usb_start_xmit(struct sk_buff *skb, struct net_device *ne - - /* Slow down tx path */ - if (atomic_read(&dev->active_tx_urbs) >= MAX_TX_URBS || -- dev->free_slots < 5) { -+ dev->free_slots < CPC_TX_QUEUE_TRIGGER_LOW) { - netif_stop_queue(netdev); - } - } -diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h -index 1fbeaa9dd202..6ef93562c6b7 100644 ---- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h -+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h -@@ -2401,10 +2401,13 @@ void bnx2x_igu_clear_sb_gen(struct bnx2x *bp, u8 func, u8 idu_sb_id, - AEU_INPUTS_ATTN_BITS_IGU_PARITY_ERROR | \ - AEU_INPUTS_ATTN_BITS_MISC_PARITY_ERROR) - --#define HW_PRTY_ASSERT_SET_3 (AEU_INPUTS_ATTN_BITS_MCP_LATCHED_ROM_PARITY | \ -- AEU_INPUTS_ATTN_BITS_MCP_LATCHED_UMP_RX_PARITY | \ -- AEU_INPUTS_ATTN_BITS_MCP_LATCHED_UMP_TX_PARITY | \ -- AEU_INPUTS_ATTN_BITS_MCP_LATCHED_SCPAD_PARITY) -+#define HW_PRTY_ASSERT_SET_3_WITHOUT_SCPAD \ -+ (AEU_INPUTS_ATTN_BITS_MCP_LATCHED_ROM_PARITY | \ -+ AEU_INPUTS_ATTN_BITS_MCP_LATCHED_UMP_RX_PARITY | \ -+ AEU_INPUTS_ATTN_BITS_MCP_LATCHED_UMP_TX_PARITY) -+ -+#define HW_PRTY_ASSERT_SET_3 (HW_PRTY_ASSERT_SET_3_WITHOUT_SCPAD | \ -+ AEU_INPUTS_ATTN_BITS_MCP_LATCHED_SCPAD_PARITY) - - #define HW_PRTY_ASSERT_SET_4 (AEU_INPUTS_ATTN_BITS_PGLUE_PARITY_ERROR | \ - AEU_INPUTS_ATTN_BITS_ATC_PARITY_ERROR) -diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c -index 242874041ba4..e157adb85b2a 100644 ---- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c -+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c -@@ -4631,9 +4631,7 @@ static bool bnx2x_check_blocks_with_parity3(struct bnx2x *bp, u32 sig, - res |= true; - break; - case AEU_INPUTS_ATTN_BITS_MCP_LATCHED_SCPAD_PARITY: -- if (print) -- _print_next_block((*par_num)++, -- "MCP SCPAD"); -+ (*par_num)++; - /* clear latched SCPAD PATIRY from MCP */ - REG_WR(bp, MISC_REG_AEU_CLR_LATCH_SIGNAL, - 1UL << 10); -@@ -4695,6 +4693,7 @@ static bool bnx2x_parity_attn(struct bnx2x *bp, bool *global, bool print, - (sig[3] & HW_PRTY_ASSERT_SET_3) || - (sig[4] & HW_PRTY_ASSERT_SET_4)) { - int par_num = 0; -+ - DP(NETIF_MSG_HW, "Was parity error: HW block parity attention:\n" - "[0]:0x%08x [1]:0x%08x [2]:0x%08x [3]:0x%08x [4]:0x%08x\n", - sig[0] & HW_PRTY_ASSERT_SET_0, -@@ -4702,9 +4701,18 @@ static bool bnx2x_parity_attn(struct bnx2x *bp, bool *global, bool print, - sig[2] & HW_PRTY_ASSERT_SET_2, - sig[3] & HW_PRTY_ASSERT_SET_3, - sig[4] & HW_PRTY_ASSERT_SET_4); -- if (print) -- netdev_err(bp->dev, -- "Parity errors detected in blocks: "); -+ if (print) { -+ if (((sig[0] & HW_PRTY_ASSERT_SET_0) || -+ (sig[1] & HW_PRTY_ASSERT_SET_1) || -+ (sig[2] & HW_PRTY_ASSERT_SET_2) || -+ (sig[4] & HW_PRTY_ASSERT_SET_4)) || -+ (sig[3] & HW_PRTY_ASSERT_SET_3_WITHOUT_SCPAD)) { -+ netdev_err(bp->dev, -+ "Parity errors detected in blocks: "); -+ } else { -+ print = false; -+ } -+ } - res |= bnx2x_check_blocks_with_parity0(bp, - sig[0] & HW_PRTY_ASSERT_SET_0, &par_num, print); - res |= bnx2x_check_blocks_with_parity1(bp, -diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c -index 988f9fec0bff..d8c1b69d0f66 100644 ---- a/drivers/net/wireless/iwlwifi/pcie/drv.c -+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c -@@ -367,6 +367,7 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = { - {IWL_PCI_DEVICE(0x095B, 0x5310, iwl7265_2ac_cfg)}, - {IWL_PCI_DEVICE(0x095B, 0x5302, iwl7265_n_cfg)}, - {IWL_PCI_DEVICE(0x095B, 0x5210, iwl7265_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x095A, 0x5C10, iwl7265_2ac_cfg)}, - {IWL_PCI_DEVICE(0x095A, 0x5012, iwl7265_2ac_cfg)}, - {IWL_PCI_DEVICE(0x095A, 0x5412, iwl7265_2ac_cfg)}, - {IWL_PCI_DEVICE(0x095A, 0x5410, iwl7265_2ac_cfg)}, -@@ -383,10 +384,10 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = { - {IWL_PCI_DEVICE(0x095A, 0x9012, iwl7265_2ac_cfg)}, - {IWL_PCI_DEVICE(0x095A, 0x9110, iwl7265_2ac_cfg)}, - {IWL_PCI_DEVICE(0x095A, 0x9112, iwl7265_2ac_cfg)}, -- {IWL_PCI_DEVICE(0x095A, 0x9210, iwl7265_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x095B, 0x9210, iwl7265_2ac_cfg)}, - {IWL_PCI_DEVICE(0x095B, 0x9200, iwl7265_2ac_cfg)}, - {IWL_PCI_DEVICE(0x095A, 0x9510, iwl7265_2ac_cfg)}, -- {IWL_PCI_DEVICE(0x095A, 0x9310, iwl7265_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x095B, 0x9310, iwl7265_2ac_cfg)}, - {IWL_PCI_DEVICE(0x095A, 0x9410, iwl7265_2ac_cfg)}, - {IWL_PCI_DEVICE(0x095A, 0x5020, iwl7265_2n_cfg)}, - {IWL_PCI_DEVICE(0x095A, 0x502A, iwl7265_2n_cfg)}, -diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c -index 7c7a388c85ab..126f641a9582 100644 ---- a/drivers/pci/hotplug/acpiphp_glue.c -+++ b/drivers/pci/hotplug/acpiphp_glue.c -@@ -1133,8 +1133,10 @@ int acpiphp_enable_slot(struct acpiphp_slot *slot) - { - pci_lock_rescan_remove(); - -- if (slot->flags & SLOT_IS_GOING_AWAY) -+ if (slot->flags & SLOT_IS_GOING_AWAY) { -+ pci_unlock_rescan_remove(); - return -ENODEV; -+ } - - mutex_lock(&slot->crit_sect); - /* configure all functions */ -diff --git a/drivers/pci/pcie/aer/aerdrv.c b/drivers/pci/pcie/aer/aerdrv.c -index 0bf82a20a0fb..48d21e0edd56 100644 ---- a/drivers/pci/pcie/aer/aerdrv.c -+++ b/drivers/pci/pcie/aer/aerdrv.c -@@ -262,7 +262,6 @@ static struct aer_rpc *aer_alloc_rpc(struct pcie_device *dev) - rpc->rpd = dev; - INIT_WORK(&rpc->dpc_handler, aer_isr); - mutex_init(&rpc->rpc_mutex); -- init_waitqueue_head(&rpc->wait_release); - - /* Use PCIe bus function to store rpc into PCIe device */ - set_service_data(dev, rpc); -@@ -285,8 +284,7 @@ static void aer_remove(struct pcie_device *dev) - if (rpc->isr) - free_irq(dev->irq, dev); - -- wait_event(rpc->wait_release, rpc->prod_idx == rpc->cons_idx); -- -+ flush_work(&rpc->dpc_handler); - aer_disable_rootport(rpc); - kfree(rpc); - set_service_data(dev, NULL); -diff --git a/drivers/pci/pcie/aer/aerdrv.h b/drivers/pci/pcie/aer/aerdrv.h -index 84420b7c9456..945c939a86c5 100644 ---- a/drivers/pci/pcie/aer/aerdrv.h -+++ b/drivers/pci/pcie/aer/aerdrv.h -@@ -72,7 +72,6 @@ struct aer_rpc { - * recovery on the same - * root port hierarchy - */ -- wait_queue_head_t wait_release; - }; - - struct aer_broadcast_data { -diff --git a/drivers/pci/pcie/aer/aerdrv_core.c b/drivers/pci/pcie/aer/aerdrv_core.c -index b2c8881da764..777edcc4aab6 100644 ---- a/drivers/pci/pcie/aer/aerdrv_core.c -+++ b/drivers/pci/pcie/aer/aerdrv_core.c -@@ -785,8 +785,6 @@ void aer_isr(struct work_struct *work) - while (get_e_source(rpc, &e_src)) - aer_isr_one_error(p_device, &e_src); - mutex_unlock(&rpc->rpc_mutex); -- -- wake_up(&rpc->wait_release); - } - - /** -diff --git a/drivers/pci/xen-pcifront.c b/drivers/pci/xen-pcifront.c -index 179b8edc2262..318d535e337d 100644 ---- a/drivers/pci/xen-pcifront.c -+++ b/drivers/pci/xen-pcifront.c -@@ -52,7 +52,7 @@ struct pcifront_device { - }; - - struct pcifront_sd { -- int domain; -+ struct pci_sysdata sd; - struct pcifront_device *pdev; - }; - -@@ -66,7 +66,9 @@ static inline void pcifront_init_sd(struct pcifront_sd *sd, - unsigned int domain, unsigned int bus, - struct pcifront_device *pdev) - { -- sd->domain = domain; -+ /* Because we do not expose that information via XenBus. */ -+ sd->sd.node = first_online_node; -+ sd->sd.domain = domain; - sd->pdev = pdev; - } - -@@ -464,8 +466,8 @@ static int pcifront_scan_root(struct pcifront_device *pdev, - dev_info(&pdev->xdev->dev, "Creating PCI Frontend Bus %04x:%02x\n", - domain, bus); - -- bus_entry = kmalloc(sizeof(*bus_entry), GFP_KERNEL); -- sd = kmalloc(sizeof(*sd), GFP_KERNEL); -+ bus_entry = kzalloc(sizeof(*bus_entry), GFP_KERNEL); -+ sd = kzalloc(sizeof(*sd), GFP_KERNEL); - if (!bus_entry || !sd) { - err = -ENOMEM; - goto err_out; -diff --git a/drivers/power/wm831x_power.c b/drivers/power/wm831x_power.c -index 3bed2f55cf7d..3ccadf631d45 100644 ---- a/drivers/power/wm831x_power.c -+++ b/drivers/power/wm831x_power.c -@@ -567,7 +567,7 @@ static int wm831x_power_probe(struct platform_device *pdev) - - irq = wm831x_irq(wm831x, platform_get_irq_byname(pdev, "SYSLO")); - ret = request_threaded_irq(irq, NULL, wm831x_syslo_irq, -- IRQF_TRIGGER_RISING, "System power low", -+ IRQF_TRIGGER_RISING | IRQF_ONESHOT, "System power low", - power); - if (ret != 0) { - dev_err(&pdev->dev, "Failed to request SYSLO IRQ %d: %d\n", -@@ -577,7 +577,7 @@ static int wm831x_power_probe(struct platform_device *pdev) - - irq = wm831x_irq(wm831x, platform_get_irq_byname(pdev, "PWR SRC")); - ret = request_threaded_irq(irq, NULL, wm831x_pwr_src_irq, -- IRQF_TRIGGER_RISING, "Power source", -+ IRQF_TRIGGER_RISING | IRQF_ONESHOT, "Power source", - power); - if (ret != 0) { - dev_err(&pdev->dev, "Failed to request PWR SRC IRQ %d: %d\n", -@@ -590,7 +590,7 @@ static int wm831x_power_probe(struct platform_device *pdev) - platform_get_irq_byname(pdev, - wm831x_bat_irqs[i])); - ret = request_threaded_irq(irq, NULL, wm831x_bat_irq, -- IRQF_TRIGGER_RISING, -+ IRQF_TRIGGER_RISING | IRQF_ONESHOT, - wm831x_bat_irqs[i], - power); - if (ret != 0) { -diff --git a/drivers/powercap/intel_rapl.c b/drivers/powercap/intel_rapl.c -index 3c6768378a94..4048d7f5babd 100644 ---- a/drivers/powercap/intel_rapl.c -+++ b/drivers/powercap/intel_rapl.c -@@ -1194,10 +1194,13 @@ static int rapl_detect_domains(struct rapl_package *rp, int cpu) - - for (rd = rp->domains; rd < rp->domains + rp->nr_domains; rd++) { - /* check if the domain is locked by BIOS */ -- if (rapl_read_data_raw(rd, FW_LOCK, false, &locked)) { -+ ret = rapl_read_data_raw(rd, FW_LOCK, false, &locked); -+ if (ret) -+ return ret; -+ if (locked) { - pr_info("RAPL package %d domain %s locked by BIOS\n", - rp->id, rd->name); -- rd->state |= DOMAIN_STATE_BIOS_LOCKED; -+ rd->state |= DOMAIN_STATE_BIOS_LOCKED; - } - } - -diff --git a/drivers/s390/block/dasd_alias.c b/drivers/s390/block/dasd_alias.c -index a2597e683e79..6a64e86e8ccd 100644 ---- a/drivers/s390/block/dasd_alias.c -+++ b/drivers/s390/block/dasd_alias.c -@@ -264,8 +264,10 @@ void dasd_alias_disconnect_device_from_lcu(struct dasd_device *device) - spin_unlock_irqrestore(&lcu->lock, flags); - cancel_work_sync(&lcu->suc_data.worker); - spin_lock_irqsave(&lcu->lock, flags); -- if (device == lcu->suc_data.device) -+ if (device == lcu->suc_data.device) { -+ dasd_put_device(device); - lcu->suc_data.device = NULL; -+ } - } - was_pending = 0; - if (device == lcu->ruac_data.device) { -@@ -273,8 +275,10 @@ void dasd_alias_disconnect_device_from_lcu(struct dasd_device *device) - was_pending = 1; - cancel_delayed_work_sync(&lcu->ruac_data.dwork); - spin_lock_irqsave(&lcu->lock, flags); -- if (device == lcu->ruac_data.device) -+ if (device == lcu->ruac_data.device) { -+ dasd_put_device(device); - lcu->ruac_data.device = NULL; -+ } - } - private->lcu = NULL; - spin_unlock_irqrestore(&lcu->lock, flags); -@@ -549,8 +553,10 @@ static void lcu_update_work(struct work_struct *work) - if ((rc && (rc != -EOPNOTSUPP)) || (lcu->flags & NEED_UAC_UPDATE)) { - DBF_DEV_EVENT(DBF_WARNING, device, "could not update" - " alias data in lcu (rc = %d), retry later", rc); -- schedule_delayed_work(&lcu->ruac_data.dwork, 30*HZ); -+ if (!schedule_delayed_work(&lcu->ruac_data.dwork, 30*HZ)) -+ dasd_put_device(device); - } else { -+ dasd_put_device(device); - lcu->ruac_data.device = NULL; - lcu->flags &= ~UPDATE_PENDING; - } -@@ -593,8 +599,10 @@ static int _schedule_lcu_update(struct alias_lcu *lcu, - */ - if (!usedev) - return -EINVAL; -+ dasd_get_device(usedev); - lcu->ruac_data.device = usedev; -- schedule_delayed_work(&lcu->ruac_data.dwork, 0); -+ if (!schedule_delayed_work(&lcu->ruac_data.dwork, 0)) -+ dasd_put_device(usedev); - return 0; - } - -@@ -722,7 +730,7 @@ static int reset_summary_unit_check(struct alias_lcu *lcu, - ASCEBC((char *) &cqr->magic, 4); - ccw = cqr->cpaddr; - ccw->cmd_code = DASD_ECKD_CCW_RSCK; -- ccw->flags = 0 ; -+ ccw->flags = CCW_FLAG_SLI; - ccw->count = 16; - ccw->cda = (__u32)(addr_t) cqr->data; - ((char *)cqr->data)[0] = reason; -@@ -926,6 +934,7 @@ static void summary_unit_check_handling_work(struct work_struct *work) - /* 3. read new alias configuration */ - _schedule_lcu_update(lcu, device); - lcu->suc_data.device = NULL; -+ dasd_put_device(device); - spin_unlock_irqrestore(&lcu->lock, flags); - } - -@@ -985,6 +994,8 @@ void dasd_alias_handle_summary_unit_check(struct dasd_device *device, - } - lcu->suc_data.reason = reason; - lcu->suc_data.device = device; -+ dasd_get_device(device); - spin_unlock(&lcu->lock); -- schedule_work(&lcu->suc_data.worker); -+ if (!schedule_work(&lcu->suc_data.worker)) -+ dasd_put_device(device); - }; -diff --git a/drivers/scsi/megaraid/megaraid_sas.h b/drivers/scsi/megaraid/megaraid_sas.h -index 34452ea386ac..52636cfbab8f 100644 ---- a/drivers/scsi/megaraid/megaraid_sas.h -+++ b/drivers/scsi/megaraid/megaraid_sas.h -@@ -334,6 +334,8 @@ enum MR_EVT_ARGS { - MR_EVT_ARGS_GENERIC, - }; - -+ -+#define SGE_BUFFER_SIZE 4096 - /* - * define constants for device list query options - */ -diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c -index c80afde97e96..9f833f1504cc 100644 ---- a/drivers/scsi/megaraid/megaraid_sas_base.c -+++ b/drivers/scsi/megaraid/megaraid_sas_base.c -@@ -3821,7 +3821,7 @@ static int megasas_init_fw(struct megasas_instance *instance) - } - } - instance->max_sectors_per_req = instance->max_num_sge * -- PAGE_SIZE / 512; -+ SGE_BUFFER_SIZE / 512; - if (tmp_sectors && (instance->max_sectors_per_req > tmp_sectors)) - instance->max_sectors_per_req = tmp_sectors; - -@@ -5281,6 +5281,9 @@ static int megasas_mgmt_compat_ioctl_fw(struct file *file, unsigned long arg) - int i; - int error = 0; - compat_uptr_t ptr; -+ unsigned long local_raw_ptr; -+ u32 local_sense_off; -+ u32 local_sense_len; - - if (clear_user(ioc, sizeof(*ioc))) - return -EFAULT; -@@ -5298,9 +5301,15 @@ static int megasas_mgmt_compat_ioctl_fw(struct file *file, unsigned long arg) - * sense_len is not null, so prepare the 64bit value under - * the same condition. - */ -- if (ioc->sense_len) { -+ if (get_user(local_raw_ptr, ioc->frame.raw) || -+ get_user(local_sense_off, &ioc->sense_off) || -+ get_user(local_sense_len, &ioc->sense_len)) -+ return -EFAULT; -+ -+ -+ if (local_sense_len) { - void __user **sense_ioc_ptr = -- (void __user **)(ioc->frame.raw + ioc->sense_off); -+ (void __user **)((u8*)local_raw_ptr + local_sense_off); - compat_uptr_t *sense_cioc_ptr = - (compat_uptr_t *)(cioc->frame.raw + cioc->sense_off); - if (get_user(ptr, sense_cioc_ptr) || -diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c -index eba183c428cf..3643bbf5456d 100644 ---- a/drivers/scsi/ses.c -+++ b/drivers/scsi/ses.c -@@ -70,6 +70,7 @@ static int ses_probe(struct device *dev) - static int ses_recv_diag(struct scsi_device *sdev, int page_code, - void *buf, int bufflen) - { -+ int ret; - unsigned char cmd[] = { - RECEIVE_DIAGNOSTIC, - 1, /* Set PCV bit */ -@@ -78,9 +79,26 @@ static int ses_recv_diag(struct scsi_device *sdev, int page_code, - bufflen & 0xff, - 0 - }; -+ unsigned char recv_page_code; - -- return scsi_execute_req(sdev, cmd, DMA_FROM_DEVICE, buf, bufflen, -+ ret = scsi_execute_req(sdev, cmd, DMA_FROM_DEVICE, buf, bufflen, - NULL, SES_TIMEOUT, SES_RETRIES, NULL); -+ if (unlikely(!ret)) -+ return ret; -+ -+ recv_page_code = ((unsigned char *)buf)[0]; -+ -+ if (likely(recv_page_code == page_code)) -+ return ret; -+ -+ /* successful diagnostic but wrong page code. This happens to some -+ * USB devices, just print a message and pretend there was an error */ -+ -+ sdev_printk(KERN_ERR, sdev, -+ "Wrong diagnostic page; asked for %d got %u\n", -+ page_code, recv_page_code); -+ -+ return -EINVAL; - } - - static int ses_send_diag(struct scsi_device *sdev, int page_code, -@@ -436,7 +454,15 @@ static void ses_enclosure_data_process(struct enclosure_device *edev, - if (desc_ptr) - desc_ptr += len; - -- if (addl_desc_ptr) -+ if (addl_desc_ptr && -+ /* only find additional descriptions for specific devices */ -+ (type_ptr[0] == ENCLOSURE_COMPONENT_DEVICE || -+ type_ptr[0] == ENCLOSURE_COMPONENT_ARRAY_DEVICE || -+ type_ptr[0] == ENCLOSURE_COMPONENT_SAS_EXPANDER || -+ /* these elements are optional */ -+ type_ptr[0] == ENCLOSURE_COMPONENT_SCSI_TARGET_PORT || -+ type_ptr[0] == ENCLOSURE_COMPONENT_SCSI_INITIATOR_PORT || -+ type_ptr[0] == ENCLOSURE_COMPONENT_CONTROLLER_ELECTRONICS)) - addl_desc_ptr += addl_desc_ptr[1] + 2; - - } -diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c -index 3bb6646bb406..f9da66fa850b 100644 ---- a/drivers/scsi/storvsc_drv.c -+++ b/drivers/scsi/storvsc_drv.c -@@ -1610,8 +1610,7 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd) - vm_srb->win8_extension.time_out_value = 60; - - vm_srb->win8_extension.srb_flags |= -- (SRB_FLAGS_QUEUE_ACTION_ENABLE | -- SRB_FLAGS_DISABLE_SYNCH_TRANSFER); -+ SRB_FLAGS_DISABLE_SYNCH_TRANSFER; - - /* Build the SRB */ - switch (scmnd->sc_data_direction) { -diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c -index f89b24a09b19..231d63caa663 100644 ---- a/drivers/target/target_core_sbc.c -+++ b/drivers/target/target_core_sbc.c -@@ -314,7 +314,8 @@ sbc_setup_write_same(struct se_cmd *cmd, unsigned char *flags, struct sbc_ops *o - return 0; - } - --static sense_reason_t xdreadwrite_callback(struct se_cmd *cmd, bool success) -+static sense_reason_t xdreadwrite_callback(struct se_cmd *cmd, bool success, -+ int *post_ret) - { - unsigned char *buf, *addr; - struct scatterlist *sg; -@@ -378,7 +379,8 @@ sbc_execute_rw(struct se_cmd *cmd) - cmd->data_direction); - } - --static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success) -+static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success, -+ int *post_ret) - { - struct se_device *dev = cmd->se_dev; - -@@ -388,8 +390,10 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success) - * sent to the backend driver. - */ - spin_lock_irq(&cmd->t_state_lock); -- if ((cmd->transport_state & CMD_T_SENT) && !cmd->scsi_status) -+ if ((cmd->transport_state & CMD_T_SENT) && !cmd->scsi_status) { - cmd->se_cmd_flags |= SCF_COMPARE_AND_WRITE_POST; -+ *post_ret = 1; -+ } - spin_unlock_irq(&cmd->t_state_lock); - - /* -@@ -401,7 +405,8 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success) - return TCM_NO_SENSE; - } - --static sense_reason_t compare_and_write_callback(struct se_cmd *cmd, bool success) -+static sense_reason_t compare_and_write_callback(struct se_cmd *cmd, bool success, -+ int *post_ret) - { - struct se_device *dev = cmd->se_dev; - struct scatterlist *write_sg = NULL, *sg; -@@ -497,11 +502,11 @@ static sense_reason_t compare_and_write_callback(struct se_cmd *cmd, bool succes - - if (block_size < PAGE_SIZE) { - sg_set_page(&write_sg[i], m.page, block_size, -- block_size); -+ m.piter.sg->offset + block_size); - } else { - sg_miter_next(&m); - sg_set_page(&write_sg[i], m.page, block_size, -- 0); -+ m.piter.sg->offset); - } - len -= block_size; - i++; -diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c -index 6fc38903046c..7afea9b59e2c 100644 ---- a/drivers/target/target_core_transport.c -+++ b/drivers/target/target_core_transport.c -@@ -1581,7 +1581,7 @@ bool target_stop_cmd(struct se_cmd *cmd, unsigned long *flags) - void transport_generic_request_failure(struct se_cmd *cmd, - sense_reason_t sense_reason) - { -- int ret = 0; -+ int ret = 0, post_ret = 0; - - pr_debug("-----[ Storage Engine Exception for cmd: %p ITT: 0x%08x" - " CDB: 0x%02x\n", cmd, cmd->se_tfo->get_task_tag(cmd), -@@ -1604,7 +1604,7 @@ void transport_generic_request_failure(struct se_cmd *cmd, - */ - if ((cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE) && - cmd->transport_complete_callback) -- cmd->transport_complete_callback(cmd, false); -+ cmd->transport_complete_callback(cmd, false, &post_ret); - - switch (sense_reason) { - case TCM_NON_EXISTENT_LUN: -@@ -1940,11 +1940,13 @@ static void target_complete_ok_work(struct work_struct *work) - */ - if (cmd->transport_complete_callback) { - sense_reason_t rc; -+ bool caw = (cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE); -+ bool zero_dl = !(cmd->data_length); -+ int post_ret = 0; - -- rc = cmd->transport_complete_callback(cmd, true); -- if (!rc && !(cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE_POST)) { -- if ((cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE) && -- !cmd->data_length) -+ rc = cmd->transport_complete_callback(cmd, true, &post_ret); -+ if (!rc && !post_ret) { -+ if (caw && zero_dl) - goto queue_rsp; - - return; -diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c -index 2aca88715632..584514c7ed1f 100644 ---- a/drivers/usb/class/cdc-acm.c -+++ b/drivers/usb/class/cdc-acm.c -@@ -1810,6 +1810,11 @@ static const struct usb_device_id acm_ids[] = { - }, - #endif - -+ /*Samsung phone in firmware update mode */ -+ { USB_DEVICE(0x04e8, 0x685d), -+ .driver_info = IGNORE_DEVICE, -+ }, -+ - /* Exclude Infineon Flash Loader utility */ - { USB_DEVICE(0x058b, 0x0041), - .driver_info = IGNORE_DEVICE, -diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c -index 02e6fe228a63..21bf168981f9 100644 ---- a/drivers/usb/serial/cp210x.c -+++ b/drivers/usb/serial/cp210x.c -@@ -162,6 +162,8 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */ - { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */ - { USB_DEVICE(0x18EF, 0xE025) }, /* ELV Marble Sound Board 1 */ -+ { USB_DEVICE(0x1901, 0x0190) }, /* GE B850 CP2105 Recorder interface */ -+ { USB_DEVICE(0x1901, 0x0193) }, /* GE B650 CP2104 PMC interface */ - { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */ - { USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */ - { USB_DEVICE(0x1BA4, 0x0002) }, /* Silicon Labs 358x factory default */ -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index 81f6a572f016..9bab34cf01d4 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -315,6 +315,7 @@ static void option_instat_callback(struct urb *urb); - #define TOSHIBA_PRODUCT_G450 0x0d45 - - #define ALINK_VENDOR_ID 0x1e0e -+#define SIMCOM_PRODUCT_SIM7100E 0x9001 /* Yes, ALINK_VENDOR_ID */ - #define ALINK_PRODUCT_PH300 0x9100 - #define ALINK_PRODUCT_3GU 0x9200 - -@@ -615,6 +616,10 @@ static const struct option_blacklist_info zte_1255_blacklist = { - .reserved = BIT(3) | BIT(4), - }; - -+static const struct option_blacklist_info simcom_sim7100e_blacklist = { -+ .reserved = BIT(5) | BIT(6), -+}; -+ - static const struct option_blacklist_info telit_le910_blacklist = { - .sendsetup = BIT(0), - .reserved = BIT(1) | BIT(2), -@@ -1130,6 +1135,8 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC650) }, - { USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC680) }, - { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6000)}, /* ZTE AC8700 */ -+ { USB_DEVICE_AND_INTERFACE_INFO(QUALCOMM_VENDOR_ID, 0x6001, 0xff, 0xff, 0xff), /* 4G LTE usb-modem U901 */ -+ .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, - { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */ - { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */ - { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */ -@@ -1645,6 +1652,8 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE(ALINK_VENDOR_ID, 0x9000) }, - { USB_DEVICE(ALINK_VENDOR_ID, ALINK_PRODUCT_PH300) }, - { USB_DEVICE_AND_INTERFACE_INFO(ALINK_VENDOR_ID, ALINK_PRODUCT_3GU, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE(ALINK_VENDOR_ID, SIMCOM_PRODUCT_SIM7100E), -+ .driver_info = (kernel_ulong_t)&simcom_sim7100e_blacklist }, - { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200), - .driver_info = (kernel_ulong_t)&alcatel_x200_blacklist - }, -diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c -index fed0ce198ae3..64eba4f51f71 100644 ---- a/drivers/virtio/virtio.c -+++ b/drivers/virtio/virtio.c -@@ -249,6 +249,7 @@ static int virtio_init(void) - static void __exit virtio_exit(void) - { - bus_unregister(&virtio_bus); -+ ida_destroy(&virtio_index_ida); - } - core_initcall(virtio_init); - module_exit(virtio_exit); -diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c -index f48d5fc352a9..469051b01fbf 100644 ---- a/fs/btrfs/disk-io.c -+++ b/fs/btrfs/disk-io.c -@@ -2336,6 +2336,7 @@ int open_ctree(struct super_block *sb, - if (btrfs_check_super_csum(bh->b_data)) { - printk(KERN_ERR "BTRFS: superblock checksum mismatch\n"); - err = -EINVAL; -+ brelse(bh); - goto fail_alloc; - } - -diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index 08824fe6ef44..fb37441a592f 100644 ---- a/fs/btrfs/inode.c -+++ b/fs/btrfs/inode.c -@@ -7511,15 +7511,28 @@ int btrfs_readpage(struct file *file, struct page *page) - static int btrfs_writepage(struct page *page, struct writeback_control *wbc) - { - struct extent_io_tree *tree; -- -+ struct inode *inode = page->mapping->host; -+ int ret; - - if (current->flags & PF_MEMALLOC) { - redirty_page_for_writepage(wbc, page); - unlock_page(page); - return 0; - } -+ -+ /* -+ * If we are under memory pressure we will call this directly from the -+ * VM, we need to make sure we have the inode referenced for the ordered -+ * extent. If not just return like we didn't do anything. -+ */ -+ if (!igrab(inode)) { -+ redirty_page_for_writepage(wbc, page); -+ return AOP_WRITEPAGE_ACTIVATE; -+ } - tree = &BTRFS_I(page->mapping->host)->io_tree; -- return extent_write_full_page(tree, page, btrfs_get_extent, wbc); -+ ret = extent_write_full_page(tree, page, btrfs_get_extent, wbc); -+ btrfs_add_delayed_iput(inode); -+ return ret; - } - - static int btrfs_writepages(struct address_space *mapping, -@@ -8612,9 +8625,11 @@ static int btrfs_symlink(struct inode *dir, struct dentry *dentry, - /* - * 2 items for inode item and ref - * 2 items for dir items -+ * 1 item for updating parent inode item -+ * 1 item for the inline extent item - * 1 item for xattr if selinux is on - */ -- trans = btrfs_start_transaction(root, 5); -+ trans = btrfs_start_transaction(root, 7); - if (IS_ERR(trans)) - return PTR_ERR(trans); - -diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c -index 20d793542096..0fd23ab3b4ad 100644 ---- a/fs/btrfs/send.c -+++ b/fs/btrfs/send.c -@@ -1377,7 +1377,21 @@ static int read_symlink(struct btrfs_root *root, - ret = btrfs_search_slot(NULL, root, &key, path, 0, 0); - if (ret < 0) - goto out; -- BUG_ON(ret); -+ if (ret) { -+ /* -+ * An empty symlink inode. Can happen in rare error paths when -+ * creating a symlink (transaction committed before the inode -+ * eviction handler removed the symlink inode items and a crash -+ * happened in between or the subvol was snapshoted in between). -+ * Print an informative message to dmesg/syslog so that the user -+ * can delete the symlink. -+ */ -+ btrfs_err(root->fs_info, -+ "Found empty symlink inode %llu at root %llu", -+ ino, root->root_key.objectid); -+ ret = -EIO; -+ goto out; -+ } - - ei = btrfs_item_ptr(path->nodes[0], path->slots[0], - struct btrfs_file_extent_item); -diff --git a/fs/dcache.c b/fs/dcache.c -index 65ccdf0e2854..9b235362efcd 100644 ---- a/fs/dcache.c -+++ b/fs/dcache.c -@@ -439,42 +439,12 @@ void d_drop(struct dentry *dentry) - } - EXPORT_SYMBOL(d_drop); - --/* -- * Finish off a dentry we've decided to kill. -- * dentry->d_lock must be held, returns with it unlocked. -- * If ref is non-zero, then decrement the refcount too. -- * Returns dentry requiring refcount drop, or NULL if we're done. -- */ --static struct dentry * --dentry_kill(struct dentry *dentry, int unlock_on_failure) -- __releases(dentry->d_lock) -+static void __dentry_kill(struct dentry *dentry) - { -- struct inode *inode; - struct dentry *parent = NULL; - bool can_free = true; -- -- if (unlikely(dentry->d_flags & DCACHE_DENTRY_KILLED)) { -- can_free = dentry->d_flags & DCACHE_MAY_FREE; -- spin_unlock(&dentry->d_lock); -- goto out; -- } -- -- inode = dentry->d_inode; -- if (inode && !spin_trylock(&inode->i_lock)) { --relock: -- if (unlock_on_failure) { -- spin_unlock(&dentry->d_lock); -- cpu_relax(); -- } -- return dentry; /* try again with same dentry */ -- } - if (!IS_ROOT(dentry)) - parent = dentry->d_parent; -- if (parent && !spin_trylock(&parent->d_lock)) { -- if (inode) -- spin_unlock(&inode->i_lock); -- goto relock; -- } - - /* - * The dentry is now unrecoverably dead to the world. -@@ -518,9 +488,74 @@ relock: - can_free = false; - } - spin_unlock(&dentry->d_lock); --out: - if (likely(can_free)) - dentry_free(dentry); -+} -+ -+/* -+ * Finish off a dentry we've decided to kill. -+ * dentry->d_lock must be held, returns with it unlocked. -+ * If ref is non-zero, then decrement the refcount too. -+ * Returns dentry requiring refcount drop, or NULL if we're done. -+ */ -+static struct dentry *dentry_kill(struct dentry *dentry) -+ __releases(dentry->d_lock) -+{ -+ struct inode *inode = dentry->d_inode; -+ struct dentry *parent = NULL; -+ -+ if (inode && unlikely(!spin_trylock(&inode->i_lock))) -+ goto failed; -+ -+ if (!IS_ROOT(dentry)) { -+ parent = dentry->d_parent; -+ if (unlikely(!spin_trylock(&parent->d_lock))) { -+ if (inode) -+ spin_unlock(&inode->i_lock); -+ goto failed; -+ } -+ } -+ -+ __dentry_kill(dentry); -+ return parent; -+ -+failed: -+ spin_unlock(&dentry->d_lock); -+ cpu_relax(); -+ return dentry; /* try again with same dentry */ -+} -+ -+static inline struct dentry *lock_parent(struct dentry *dentry) -+{ -+ struct dentry *parent = dentry->d_parent; -+ if (IS_ROOT(dentry)) -+ return NULL; -+ if (unlikely((int)dentry->d_lockref.count < 0)) -+ return NULL; -+ if (likely(spin_trylock(&parent->d_lock))) -+ return parent; -+ rcu_read_lock(); -+ spin_unlock(&dentry->d_lock); -+again: -+ parent = ACCESS_ONCE(dentry->d_parent); -+ spin_lock(&parent->d_lock); -+ /* -+ * We can't blindly lock dentry until we are sure -+ * that we won't violate the locking order. -+ * Any changes of dentry->d_parent must have -+ * been done with parent->d_lock held, so -+ * spin_lock() above is enough of a barrier -+ * for checking if it's still our child. -+ */ -+ if (unlikely(parent != dentry->d_parent)) { -+ spin_unlock(&parent->d_lock); -+ goto again; -+ } -+ rcu_read_unlock(); -+ if (parent != dentry) -+ spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED); -+ else -+ parent = NULL; - return parent; - } - -@@ -580,7 +615,7 @@ repeat: - return; - - kill_it: -- dentry = dentry_kill(dentry, 1); -+ dentry = dentry_kill(dentry); - if (dentry) - goto repeat; - } -@@ -798,8 +833,11 @@ static void shrink_dentry_list(struct list_head *list) - struct dentry *dentry, *parent; - - while (!list_empty(list)) { -+ struct inode *inode; - dentry = list_entry(list->prev, struct dentry, d_lru); - spin_lock(&dentry->d_lock); -+ parent = lock_parent(dentry); -+ - /* - * The dispose list is isolated and dentries are not accounted - * to the LRU here, so we can simply remove it from the list -@@ -813,26 +851,33 @@ static void shrink_dentry_list(struct list_head *list) - */ - if ((int)dentry->d_lockref.count > 0) { - spin_unlock(&dentry->d_lock); -+ if (parent) -+ spin_unlock(&parent->d_lock); - continue; - } - -- parent = dentry_kill(dentry, 0); -- /* -- * If dentry_kill returns NULL, we have nothing more to do. -- */ -- if (!parent) -+ -+ if (unlikely(dentry->d_flags & DCACHE_DENTRY_KILLED)) { -+ bool can_free = dentry->d_flags & DCACHE_MAY_FREE; -+ spin_unlock(&dentry->d_lock); -+ if (parent) -+ spin_unlock(&parent->d_lock); -+ if (can_free) -+ dentry_free(dentry); - continue; -+ } - -- if (unlikely(parent == dentry)) { -- /* -- * trylocks have failed and d_lock has been held the -- * whole time, so it could not have been added to any -- * other lists. Just add it back to the shrink list. -- */ -+ inode = dentry->d_inode; -+ if (inode && unlikely(!spin_trylock(&inode->i_lock))) { - d_shrink_add(dentry, list); - spin_unlock(&dentry->d_lock); -+ if (parent) -+ spin_unlock(&parent->d_lock); - continue; - } -+ -+ __dentry_kill(dentry); -+ - /* - * We need to prune ancestors too. This is necessary to prevent - * quadratic behavior of shrink_dcache_parent(), but is also -@@ -840,8 +885,26 @@ static void shrink_dentry_list(struct list_head *list) - * fragmentation. - */ - dentry = parent; -- while (dentry && !lockref_put_or_lock(&dentry->d_lockref)) -- dentry = dentry_kill(dentry, 1); -+ while (dentry && !lockref_put_or_lock(&dentry->d_lockref)) { -+ parent = lock_parent(dentry); -+ if (dentry->d_lockref.count != 1) { -+ dentry->d_lockref.count--; -+ spin_unlock(&dentry->d_lock); -+ if (parent) -+ spin_unlock(&parent->d_lock); -+ break; -+ } -+ inode = dentry->d_inode; /* can't be NULL */ -+ if (unlikely(!spin_trylock(&inode->i_lock))) { -+ spin_unlock(&dentry->d_lock); -+ if (parent) -+ spin_unlock(&parent->d_lock); -+ cpu_relax(); -+ continue; -+ } -+ __dentry_kill(dentry); -+ dentry = parent; -+ } - } - } - -diff --git a/fs/hostfs/hostfs_kern.c b/fs/hostfs/hostfs_kern.c -index fe649d325b1f..ce653dfb0ae3 100644 ---- a/fs/hostfs/hostfs_kern.c -+++ b/fs/hostfs/hostfs_kern.c -@@ -720,15 +720,13 @@ static int hostfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, - - init_special_inode(inode, mode, dev); - err = do_mknod(name, mode, MAJOR(dev), MINOR(dev)); -- if (!err) -+ if (err) - goto out_free; - - err = read_name(inode, name); - __putname(name); - if (err) - goto out_put; -- if (err) -- goto out_put; - - d_instantiate(dentry, inode); - return 0; -diff --git a/fs/lockd/host.c b/fs/lockd/host.c -index 969d589c848d..b5f3c3ab0d5f 100644 ---- a/fs/lockd/host.c -+++ b/fs/lockd/host.c -@@ -116,7 +116,7 @@ static struct nlm_host *nlm_alloc_host(struct nlm_lookup_host_info *ni, - atomic_inc(&nsm->sm_count); - else { - host = NULL; -- nsm = nsm_get_handle(ni->sap, ni->salen, -+ nsm = nsm_get_handle(ni->net, ni->sap, ni->salen, - ni->hostname, ni->hostname_len); - if (unlikely(nsm == NULL)) { - dprintk("lockd: %s failed; no nsm handle\n", -@@ -534,17 +534,18 @@ static struct nlm_host *next_host_state(struct hlist_head *cache, - - /** - * nlm_host_rebooted - Release all resources held by rebooted host -+ * @net: network namespace - * @info: pointer to decoded results of NLM_SM_NOTIFY call - * - * We were notified that the specified host has rebooted. Release - * all resources held by that peer. - */ --void nlm_host_rebooted(const struct nlm_reboot *info) -+void nlm_host_rebooted(const struct net *net, const struct nlm_reboot *info) - { - struct nsm_handle *nsm; - struct nlm_host *host; - -- nsm = nsm_reboot_lookup(info); -+ nsm = nsm_reboot_lookup(net, info); - if (unlikely(nsm == NULL)) - return; - -diff --git a/fs/lockd/mon.c b/fs/lockd/mon.c -index 6ae664b489af..13fac49aff7f 100644 ---- a/fs/lockd/mon.c -+++ b/fs/lockd/mon.c -@@ -51,7 +51,6 @@ struct nsm_res { - }; - - static const struct rpc_program nsm_program; --static LIST_HEAD(nsm_handles); - static DEFINE_SPINLOCK(nsm_lock); - - /* -@@ -259,33 +258,35 @@ void nsm_unmonitor(const struct nlm_host *host) - } - } - --static struct nsm_handle *nsm_lookup_hostname(const char *hostname, -- const size_t len) -+static struct nsm_handle *nsm_lookup_hostname(const struct list_head *nsm_handles, -+ const char *hostname, const size_t len) - { - struct nsm_handle *nsm; - -- list_for_each_entry(nsm, &nsm_handles, sm_link) -+ list_for_each_entry(nsm, nsm_handles, sm_link) - if (strlen(nsm->sm_name) == len && - memcmp(nsm->sm_name, hostname, len) == 0) - return nsm; - return NULL; - } - --static struct nsm_handle *nsm_lookup_addr(const struct sockaddr *sap) -+static struct nsm_handle *nsm_lookup_addr(const struct list_head *nsm_handles, -+ const struct sockaddr *sap) - { - struct nsm_handle *nsm; - -- list_for_each_entry(nsm, &nsm_handles, sm_link) -+ list_for_each_entry(nsm, nsm_handles, sm_link) - if (rpc_cmp_addr(nsm_addr(nsm), sap)) - return nsm; - return NULL; - } - --static struct nsm_handle *nsm_lookup_priv(const struct nsm_private *priv) -+static struct nsm_handle *nsm_lookup_priv(const struct list_head *nsm_handles, -+ const struct nsm_private *priv) - { - struct nsm_handle *nsm; - -- list_for_each_entry(nsm, &nsm_handles, sm_link) -+ list_for_each_entry(nsm, nsm_handles, sm_link) - if (memcmp(nsm->sm_priv.data, priv->data, - sizeof(priv->data)) == 0) - return nsm; -@@ -350,6 +351,7 @@ static struct nsm_handle *nsm_create_handle(const struct sockaddr *sap, - - /** - * nsm_get_handle - Find or create a cached nsm_handle -+ * @net: network namespace - * @sap: pointer to socket address of handle to find - * @salen: length of socket address - * @hostname: pointer to C string containing hostname to find -@@ -362,11 +364,13 @@ static struct nsm_handle *nsm_create_handle(const struct sockaddr *sap, - * @hostname cannot be found in the handle cache. Returns NULL if - * an error occurs. - */ --struct nsm_handle *nsm_get_handle(const struct sockaddr *sap, -+struct nsm_handle *nsm_get_handle(const struct net *net, -+ const struct sockaddr *sap, - const size_t salen, const char *hostname, - const size_t hostname_len) - { - struct nsm_handle *cached, *new = NULL; -+ struct lockd_net *ln = net_generic(net, lockd_net_id); - - if (hostname && memchr(hostname, '/', hostname_len) != NULL) { - if (printk_ratelimit()) { -@@ -381,9 +385,10 @@ retry: - spin_lock(&nsm_lock); - - if (nsm_use_hostnames && hostname != NULL) -- cached = nsm_lookup_hostname(hostname, hostname_len); -+ cached = nsm_lookup_hostname(&ln->nsm_handles, -+ hostname, hostname_len); - else -- cached = nsm_lookup_addr(sap); -+ cached = nsm_lookup_addr(&ln->nsm_handles, sap); - - if (cached != NULL) { - atomic_inc(&cached->sm_count); -@@ -397,7 +402,7 @@ retry: - } - - if (new != NULL) { -- list_add(&new->sm_link, &nsm_handles); -+ list_add(&new->sm_link, &ln->nsm_handles); - spin_unlock(&nsm_lock); - dprintk("lockd: created nsm_handle for %s (%s)\n", - new->sm_name, new->sm_addrbuf); -@@ -414,19 +419,22 @@ retry: - - /** - * nsm_reboot_lookup - match NLMPROC_SM_NOTIFY arguments to an nsm_handle -+ * @net: network namespace - * @info: pointer to NLMPROC_SM_NOTIFY arguments - * - * Returns a matching nsm_handle if found in the nsm cache. The returned - * nsm_handle's reference count is bumped. Otherwise returns NULL if some - * error occurred. - */ --struct nsm_handle *nsm_reboot_lookup(const struct nlm_reboot *info) -+struct nsm_handle *nsm_reboot_lookup(const struct net *net, -+ const struct nlm_reboot *info) - { - struct nsm_handle *cached; -+ struct lockd_net *ln = net_generic(net, lockd_net_id); - - spin_lock(&nsm_lock); - -- cached = nsm_lookup_priv(&info->priv); -+ cached = nsm_lookup_priv(&ln->nsm_handles, &info->priv); - if (unlikely(cached == NULL)) { - spin_unlock(&nsm_lock); - dprintk("lockd: never saw rebooted peer '%.*s' before\n", -diff --git a/fs/lockd/netns.h b/fs/lockd/netns.h -index 5010b55628b4..414da99744e9 100644 ---- a/fs/lockd/netns.h -+++ b/fs/lockd/netns.h -@@ -16,6 +16,7 @@ struct lockd_net { - spinlock_t nsm_clnt_lock; - unsigned int nsm_users; - struct rpc_clnt *nsm_clnt; -+ struct list_head nsm_handles; - }; - - extern int lockd_net_id; -diff --git a/fs/lockd/svc.c b/fs/lockd/svc.c -index 59a53f664005..bb1ad4df024d 100644 ---- a/fs/lockd/svc.c -+++ b/fs/lockd/svc.c -@@ -583,6 +583,7 @@ static int lockd_init_net(struct net *net) - INIT_DELAYED_WORK(&ln->grace_period_end, grace_ender); - INIT_LIST_HEAD(&ln->grace_list); - spin_lock_init(&ln->nsm_clnt_lock); -+ INIT_LIST_HEAD(&ln->nsm_handles); - return 0; - } - -diff --git a/fs/lockd/svc4proc.c b/fs/lockd/svc4proc.c -index b147d1ae71fd..09c576f26c7b 100644 ---- a/fs/lockd/svc4proc.c -+++ b/fs/lockd/svc4proc.c -@@ -421,7 +421,7 @@ nlm4svc_proc_sm_notify(struct svc_rqst *rqstp, struct nlm_reboot *argp, - return rpc_system_err; - } - -- nlm_host_rebooted(argp); -+ nlm_host_rebooted(SVC_NET(rqstp), argp); - return rpc_success; - } - -diff --git a/fs/lockd/svcproc.c b/fs/lockd/svcproc.c -index 21171f0c6477..fb26b9f522e7 100644 ---- a/fs/lockd/svcproc.c -+++ b/fs/lockd/svcproc.c -@@ -464,7 +464,7 @@ nlmsvc_proc_sm_notify(struct svc_rqst *rqstp, struct nlm_reboot *argp, - return rpc_system_err; - } - -- nlm_host_rebooted(argp); -+ nlm_host_rebooted(SVC_NET(rqstp), argp); - return rpc_success; - } - -diff --git a/fs/namei.c b/fs/namei.c -index f4f6460b6958..c24781f07cf3 100644 ---- a/fs/namei.c -+++ b/fs/namei.c -@@ -3085,6 +3085,10 @@ opened: - goto exit_fput; - } - out: -+ if (unlikely(error > 0)) { -+ WARN_ON(1); -+ error = -EINVAL; -+ } - if (got_write) - mnt_drop_write(nd->path.mnt); - path_put(&save_parent); -diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c -index 45a7dd36b4a6..3b5e86fd2800 100644 ---- a/fs/nfs/nfs4proc.c -+++ b/fs/nfs/nfs4proc.c -@@ -2187,9 +2187,9 @@ static int _nfs4_open_and_get_state(struct nfs4_opendata *opendata, - dentry = d_add_unique(dentry, igrab(state->inode)); - if (dentry == NULL) { - dentry = opendata->dentry; -- } else if (dentry != ctx->dentry) { -+ } else { - dput(ctx->dentry); -- ctx->dentry = dget(dentry); -+ ctx->dentry = dentry; - } - nfs_set_verifier(dentry, - nfs_save_change_attribute(opendata->dir->d_inode)); -diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c -index c402b672a474..1c02b300dc5d 100644 ---- a/fs/nfs/nfs4state.c -+++ b/fs/nfs/nfs4state.c -@@ -1482,7 +1482,7 @@ restart: - spin_unlock(&state->state_lock); - } - nfs4_put_open_state(state); -- clear_bit(NFS4CLNT_RECLAIM_NOGRACE, -+ clear_bit(NFS_STATE_RECLAIM_NOGRACE, - &state->flags); - spin_lock(&sp->so_lock); - goto restart; -diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c -index eaa7374305a3..6b1d8498d208 100644 ---- a/fs/proc/task_mmu.c -+++ b/fs/proc/task_mmu.c -@@ -165,7 +165,7 @@ static void *m_start(struct seq_file *m, loff_t *pos) - if (!priv->task) - return ERR_PTR(-ESRCH); - -- mm = mm_access(priv->task, PTRACE_MODE_READ); -+ mm = mm_access(priv->task, PTRACE_MODE_READ_FSCREDS); - if (!mm || IS_ERR(mm)) - return mm; - down_read(&mm->mmap_sem); -@@ -1182,7 +1182,7 @@ static ssize_t pagemap_read(struct file *file, char __user *buf, - if (!pm.buffer) - goto out_task; - -- mm = mm_access(task, PTRACE_MODE_READ); -+ mm = mm_access(task, PTRACE_MODE_READ_FSCREDS); - ret = PTR_ERR(mm); - if (!mm || IS_ERR(mm)) - goto out_free; -diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c -index 678455d2d683..f9db7e9f6966 100644 ---- a/fs/proc/task_nommu.c -+++ b/fs/proc/task_nommu.c -@@ -216,7 +216,7 @@ static void *m_start(struct seq_file *m, loff_t *pos) - if (!priv->task) - return ERR_PTR(-ESRCH); - -- mm = mm_access(priv->task, PTRACE_MODE_READ); -+ mm = mm_access(priv->task, PTRACE_MODE_READ_FSCREDS); - if (!mm || IS_ERR(mm)) { - put_task_struct(priv->task); - priv->task = NULL; -diff --git a/fs/splice.c b/fs/splice.c -index f345d53f94da..e64f59960ec5 100644 ---- a/fs/splice.c -+++ b/fs/splice.c -@@ -949,6 +949,7 @@ ssize_t __splice_from_pipe(struct pipe_inode_info *pipe, struct splice_desc *sd, - - splice_from_pipe_begin(sd); - do { -+ cond_resched(); - ret = splice_from_pipe_next(pipe, sd); - if (ret > 0) - ret = splice_from_pipe_feed(pipe, sd, actor); -@@ -1175,7 +1176,7 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd, - long ret, bytes; - umode_t i_mode; - size_t len; -- int i, flags; -+ int i, flags, more; - - /* - * We require the input being a regular file, as we don't want to -@@ -1218,6 +1219,7 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd, - * Don't block on output, we have to drain the direct pipe. - */ - sd->flags &= ~SPLICE_F_NONBLOCK; -+ more = sd->flags & SPLICE_F_MORE; - - while (len) { - size_t read_len; -@@ -1231,6 +1233,15 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd, - sd->total_len = read_len; - - /* -+ * If more data is pending, set SPLICE_F_MORE -+ * If this is the last data and SPLICE_F_MORE was not set -+ * initially, clears it. -+ */ -+ if (read_len < len) -+ sd->flags |= SPLICE_F_MORE; -+ else if (!more) -+ sd->flags &= ~SPLICE_F_MORE; -+ /* - * NOTE: nonblocking mode only applies to the input. We - * must not do the output in nonblocking mode as then we - * could get stuck data in the internal pipe: -diff --git a/include/asm-generic/cputime_nsecs.h b/include/asm-generic/cputime_nsecs.h -index 2c9e62c2bfd0..f55fb04501ec 100644 ---- a/include/asm-generic/cputime_nsecs.h -+++ b/include/asm-generic/cputime_nsecs.h -@@ -70,7 +70,7 @@ typedef u64 __nocast cputime64_t; - */ - static inline cputime_t timespec_to_cputime(const struct timespec *val) - { -- u64 ret = val->tv_sec * NSEC_PER_SEC + val->tv_nsec; -+ u64 ret = (u64)val->tv_sec * NSEC_PER_SEC + val->tv_nsec; - return (__force cputime_t) ret; - } - static inline void cputime_to_timespec(const cputime_t ct, struct timespec *val) -@@ -86,7 +86,8 @@ static inline void cputime_to_timespec(const cputime_t ct, struct timespec *val) - */ - static inline cputime_t timeval_to_cputime(const struct timeval *val) - { -- u64 ret = val->tv_sec * NSEC_PER_SEC + val->tv_usec * NSEC_PER_USEC; -+ u64 ret = (u64)val->tv_sec * NSEC_PER_SEC + -+ val->tv_usec * NSEC_PER_USEC; - return (__force cputime_t) ret; - } - static inline void cputime_to_timeval(const cputime_t ct, struct timeval *val) -diff --git a/include/linux/enclosure.h b/include/linux/enclosure.h -index 9a33c5f7e126..f6c229e2bffa 100644 ---- a/include/linux/enclosure.h -+++ b/include/linux/enclosure.h -@@ -29,7 +29,11 @@ - /* A few generic types ... taken from ses-2 */ - enum enclosure_component_type { - ENCLOSURE_COMPONENT_DEVICE = 0x01, -+ ENCLOSURE_COMPONENT_CONTROLLER_ELECTRONICS = 0x07, -+ ENCLOSURE_COMPONENT_SCSI_TARGET_PORT = 0x14, -+ ENCLOSURE_COMPONENT_SCSI_INITIATOR_PORT = 0x15, - ENCLOSURE_COMPONENT_ARRAY_DEVICE = 0x17, -+ ENCLOSURE_COMPONENT_SAS_EXPANDER = 0x18, - }; - - /* ses-2 common element status */ -diff --git a/include/linux/lockd/lockd.h b/include/linux/lockd/lockd.h -index dcaad79f54ed..0adf073f13b3 100644 ---- a/include/linux/lockd/lockd.h -+++ b/include/linux/lockd/lockd.h -@@ -236,7 +236,8 @@ void nlm_rebind_host(struct nlm_host *); - struct nlm_host * nlm_get_host(struct nlm_host *); - void nlm_shutdown_hosts(void); - void nlm_shutdown_hosts_net(struct net *net); --void nlm_host_rebooted(const struct nlm_reboot *); -+void nlm_host_rebooted(const struct net *net, -+ const struct nlm_reboot *); - - /* - * Host monitoring -@@ -244,11 +245,13 @@ void nlm_host_rebooted(const struct nlm_reboot *); - int nsm_monitor(const struct nlm_host *host); - void nsm_unmonitor(const struct nlm_host *host); - --struct nsm_handle *nsm_get_handle(const struct sockaddr *sap, -+struct nsm_handle *nsm_get_handle(const struct net *net, -+ const struct sockaddr *sap, - const size_t salen, - const char *hostname, - const size_t hostname_len); --struct nsm_handle *nsm_reboot_lookup(const struct nlm_reboot *info); -+struct nsm_handle *nsm_reboot_lookup(const struct net *net, -+ const struct nlm_reboot *info); - void nsm_release(struct nsm_handle *nsm); - - /* -diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h -index 0ae5807480f4..1e122cc9ea3e 100644 ---- a/include/linux/nfs_fs.h -+++ b/include/linux/nfs_fs.h -@@ -580,9 +580,7 @@ static inline int nfs3_proc_setacls(struct inode *inode, struct posix_acl *acl, - - static inline loff_t nfs_size_to_loff_t(__u64 size) - { -- if (size > (__u64) OFFSET_MAX - 1) -- return OFFSET_MAX - 1; -- return (loff_t) size; -+ return min_t(u64, size, OFFSET_MAX); - } - - static inline ino_t -diff --git a/include/linux/tracepoint.h b/include/linux/tracepoint.h -index 7159a0a933df..97c8689c7e51 100644 ---- a/include/linux/tracepoint.h -+++ b/include/linux/tracepoint.h -@@ -14,8 +14,11 @@ - * See the file COPYING for more details. - */ - -+#include - #include - #include -+#include -+#include - #include - #include - -@@ -126,6 +129,9 @@ static inline void tracepoint_synchronize_unregister(void) - void *it_func; \ - void *__data; \ - \ -+ if (!cpu_online(raw_smp_processor_id())) \ -+ return; \ -+ \ - if (!(cond)) \ - return; \ - prercu; \ -diff --git a/include/net/af_unix.h b/include/net/af_unix.h -index e830c3dff61a..7bb69c9c3c43 100644 ---- a/include/net/af_unix.h -+++ b/include/net/af_unix.h -@@ -6,8 +6,8 @@ - #include - #include - --void unix_inflight(struct file *fp); --void unix_notinflight(struct file *fp); -+void unix_inflight(struct user_struct *user, struct file *fp); -+void unix_notinflight(struct user_struct *user, struct file *fp); - void unix_gc(void); - void wait_for_unix_gc(void); - struct sock *unix_get_socket(struct file *filp); -diff --git a/include/net/scm.h b/include/net/scm.h -index 262532d111f5..59fa93c01d2a 100644 ---- a/include/net/scm.h -+++ b/include/net/scm.h -@@ -21,6 +21,7 @@ struct scm_creds { - struct scm_fp_list { - short count; - short max; -+ struct user_struct *user; - struct file *fp[SCM_MAX_FD]; - }; - -diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h -index e4b9e011d2a1..42606764d830 100644 ---- a/include/target/target_core_base.h -+++ b/include/target/target_core_base.h -@@ -513,7 +513,7 @@ struct se_cmd { - sense_reason_t (*execute_cmd)(struct se_cmd *); - sense_reason_t (*execute_rw)(struct se_cmd *, struct scatterlist *, - u32, enum dma_data_direction); -- sense_reason_t (*transport_complete_callback)(struct se_cmd *, bool); -+ sense_reason_t (*transport_complete_callback)(struct se_cmd *, bool, int *); - - unsigned char *t_task_cdb; - unsigned char __t_task_cdb[TCM_MAX_COMMAND_SIZE]; -diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c -index ebb8a9e937fa..2c2e5e70e4f3 100644 ---- a/kernel/irq/manage.c -+++ b/kernel/irq/manage.c -@@ -1230,6 +1230,7 @@ static struct irqaction *__free_irq(unsigned int irq, void *dev_id) - if (!desc) - return NULL; - -+ chip_bus_lock(desc); - raw_spin_lock_irqsave(&desc->lock, flags); - - /* -@@ -1243,7 +1244,7 @@ static struct irqaction *__free_irq(unsigned int irq, void *dev_id) - if (!action) { - WARN(1, "Trying to free already-free IRQ %d\n", irq); - raw_spin_unlock_irqrestore(&desc->lock, flags); -- -+ chip_bus_sync_unlock(desc); - return NULL; - } - -@@ -1266,6 +1267,7 @@ static struct irqaction *__free_irq(unsigned int irq, void *dev_id) - #endif - - raw_spin_unlock_irqrestore(&desc->lock, flags); -+ chip_bus_sync_unlock(desc); - - unregister_handler_proc(irq, action); - -@@ -1339,9 +1341,7 @@ void free_irq(unsigned int irq, void *dev_id) - desc->affinity_notify = NULL; - #endif - -- chip_bus_lock(desc); - kfree(__free_irq(irq, dev_id)); -- chip_bus_sync_unlock(desc); - } - EXPORT_SYMBOL(free_irq); - -diff --git a/kernel/resource.c b/kernel/resource.c -index 3f285dce9347..449282e48bb1 100644 ---- a/kernel/resource.c -+++ b/kernel/resource.c -@@ -961,9 +961,10 @@ struct resource * __request_region(struct resource *parent, - if (!conflict) - break; - if (conflict != parent) { -- parent = conflict; -- if (!(conflict->flags & IORESOURCE_BUSY)) -+ if (!(conflict->flags & IORESOURCE_BUSY)) { -+ parent = conflict; - continue; -+ } - } - if (conflict->flags & flags & IORESOURCE_MUXED) { - add_wait_queue(&muxed_resource_wait, &wait); -diff --git a/kernel/sched/core.c b/kernel/sched/core.c -index bbe957762ace..46afc8cd69dd 100644 ---- a/kernel/sched/core.c -+++ b/kernel/sched/core.c -@@ -937,6 +937,13 @@ inline int task_curr(const struct task_struct *p) - return cpu_curr(task_cpu(p)) == p; - } - -+/* -+ * switched_from, switched_to and prio_changed must _NOT_ drop rq->lock, -+ * use the balance_callback list if you want balancing. -+ * -+ * this means any call to check_class_changed() must be followed by a call to -+ * balance_callback(). -+ */ - static inline void check_class_changed(struct rq *rq, struct task_struct *p, - const struct sched_class *prev_class, - int oldprio) -@@ -1423,8 +1430,12 @@ ttwu_do_wakeup(struct rq *rq, struct task_struct *p, int wake_flags) - - p->state = TASK_RUNNING; - #ifdef CONFIG_SMP -- if (p->sched_class->task_woken) -+ if (p->sched_class->task_woken) { -+ /* -+ * XXX can drop rq->lock; most likely ok. -+ */ - p->sched_class->task_woken(rq, p); -+ } - - if (rq->idle_stamp) { - u64 delta = rq_clock(rq) - rq->idle_stamp; -@@ -1685,7 +1696,6 @@ out: - */ - int wake_up_process(struct task_struct *p) - { -- WARN_ON(task_is_stopped_or_traced(p)); - return try_to_wake_up(p, TASK_NORMAL, 0); - } - EXPORT_SYMBOL(wake_up_process); -@@ -2179,18 +2189,30 @@ static inline void pre_schedule(struct rq *rq, struct task_struct *prev) - } - - /* rq->lock is NOT held, but preemption is disabled */ --static inline void post_schedule(struct rq *rq) -+static void __balance_callback(struct rq *rq) - { -- if (rq->post_schedule) { -- unsigned long flags; -+ struct callback_head *head, *next; -+ void (*func)(struct rq *rq); -+ unsigned long flags; - -- raw_spin_lock_irqsave(&rq->lock, flags); -- if (rq->curr->sched_class->post_schedule) -- rq->curr->sched_class->post_schedule(rq); -- raw_spin_unlock_irqrestore(&rq->lock, flags); -+ raw_spin_lock_irqsave(&rq->lock, flags); -+ head = rq->balance_callback; -+ rq->balance_callback = NULL; -+ while (head) { -+ func = (void (*)(struct rq *))head->func; -+ next = head->next; -+ head->next = NULL; -+ head = next; - -- rq->post_schedule = 0; -+ func(rq); - } -+ raw_spin_unlock_irqrestore(&rq->lock, flags); -+} -+ -+static inline void balance_callback(struct rq *rq) -+{ -+ if (unlikely(rq->balance_callback)) -+ __balance_callback(rq); - } - - #else -@@ -2199,7 +2221,7 @@ static inline void pre_schedule(struct rq *rq, struct task_struct *p) - { - } - --static inline void post_schedule(struct rq *rq) -+static inline void balance_callback(struct rq *rq) - { - } - -@@ -2220,7 +2242,7 @@ asmlinkage void schedule_tail(struct task_struct *prev) - * FIXME: do we need to worry about rq being invalidated by the - * task_switch? - */ -- post_schedule(rq); -+ balance_callback(rq); - - #ifdef __ARCH_WANT_UNLOCKED_CTXSW - /* In this case, finish_task_switch does not reenable preemption */ -@@ -2732,7 +2754,7 @@ need_resched: - } else - raw_spin_unlock_irq(&rq->lock); - -- post_schedule(rq); -+ balance_callback(rq); - - sched_preempt_enable_no_resched(); - if (need_resched()) -@@ -2994,7 +3016,11 @@ void rt_mutex_setprio(struct task_struct *p, int prio) - - check_class_changed(rq, p, prev_class, oldprio); - out_unlock: -+ preempt_disable(); /* avoid rq from going away on us */ - __task_rq_unlock(rq); -+ -+ balance_callback(rq); -+ preempt_enable(); - } - #endif - -@@ -3500,10 +3526,17 @@ change: - enqueue_task(rq, p, 0); - - check_class_changed(rq, p, prev_class, oldprio); -+ preempt_disable(); /* avoid rq from going away on us */ - task_rq_unlock(rq, p, &flags); - - rt_mutex_adjust_pi(p); - -+ /* -+ * Run balance callbacks after we've adjusted the PI chain. -+ */ -+ balance_callback(rq); -+ preempt_enable(); -+ - return 0; - } - -@@ -5386,13 +5419,13 @@ static int init_rootdomain(struct root_domain *rd) - { - memset(rd, 0, sizeof(*rd)); - -- if (!alloc_cpumask_var(&rd->span, GFP_KERNEL)) -+ if (!zalloc_cpumask_var(&rd->span, GFP_KERNEL)) - goto out; -- if (!alloc_cpumask_var(&rd->online, GFP_KERNEL)) -+ if (!zalloc_cpumask_var(&rd->online, GFP_KERNEL)) - goto free_span; -- if (!alloc_cpumask_var(&rd->dlo_mask, GFP_KERNEL)) -+ if (!zalloc_cpumask_var(&rd->dlo_mask, GFP_KERNEL)) - goto free_online; -- if (!alloc_cpumask_var(&rd->rto_mask, GFP_KERNEL)) -+ if (!zalloc_cpumask_var(&rd->rto_mask, GFP_KERNEL)) - goto free_dlo_mask; - - init_dl_bw(&rd->dl_bw); -@@ -6902,7 +6935,7 @@ void __init sched_init(void) - rq->sd = NULL; - rq->rd = NULL; - rq->cpu_power = SCHED_POWER_SCALE; -- rq->post_schedule = 0; -+ rq->balance_callback = NULL; - rq->active_balance = 0; - rq->next_balance = jiffies; - rq->push_cpu = 0; -diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c -index 8d3c5ddfdfdd..6ab59bb2947b 100644 ---- a/kernel/sched/deadline.c -+++ b/kernel/sched/deadline.c -@@ -210,6 +210,25 @@ static inline int has_pushable_dl_tasks(struct rq *rq) - - static int push_dl_task(struct rq *rq); - -+static DEFINE_PER_CPU(struct callback_head, dl_push_head); -+static DEFINE_PER_CPU(struct callback_head, dl_pull_head); -+ -+static void push_dl_tasks(struct rq *); -+static void pull_dl_task(struct rq *); -+ -+static inline void queue_push_tasks(struct rq *rq) -+{ -+ if (!has_pushable_dl_tasks(rq)) -+ return; -+ -+ queue_balance_callback(rq, &per_cpu(dl_push_head, rq->cpu), push_dl_tasks); -+} -+ -+static inline void queue_pull_task(struct rq *rq) -+{ -+ queue_balance_callback(rq, &per_cpu(dl_pull_head, rq->cpu), pull_dl_task); -+} -+ - #else - - static inline -@@ -232,6 +251,13 @@ void dec_dl_migration(struct sched_dl_entity *dl_se, struct dl_rq *dl_rq) - { - } - -+static inline void queue_push_tasks(struct rq *rq) -+{ -+} -+ -+static inline void queue_pull_task(struct rq *rq) -+{ -+} - #endif /* CONFIG_SMP */ - - static void enqueue_task_dl(struct rq *rq, struct task_struct *p, int flags); -@@ -1005,7 +1031,7 @@ struct task_struct *pick_next_task_dl(struct rq *rq) - #endif - - #ifdef CONFIG_SMP -- rq->post_schedule = has_pushable_dl_tasks(rq); -+ queue_push_tasks(rq); - #endif /* CONFIG_SMP */ - - return p; -@@ -1336,15 +1362,16 @@ static void push_dl_tasks(struct rq *rq) - ; - } - --static int pull_dl_task(struct rq *this_rq) -+static void pull_dl_task(struct rq *this_rq) - { -- int this_cpu = this_rq->cpu, ret = 0, cpu; -+ int this_cpu = this_rq->cpu, cpu; - struct task_struct *p; -+ bool resched = false; - struct rq *src_rq; - u64 dmin = LONG_MAX; - - if (likely(!dl_overloaded(this_rq))) -- return 0; -+ return; - - /* - * Match the barrier from dl_set_overloaded; this guarantees that if we -@@ -1399,7 +1426,7 @@ static int pull_dl_task(struct rq *this_rq) - src_rq->curr->dl.deadline)) - goto skip; - -- ret = 1; -+ resched = true; - - deactivate_task(src_rq, p, 0); - set_task_cpu(p, this_cpu); -@@ -1412,7 +1439,8 @@ skip: - double_unlock_balance(this_rq, src_rq); - } - -- return ret; -+ if (resched) -+ resched_task(this_rq->curr); - } - - static void pre_schedule_dl(struct rq *rq, struct task_struct *prev) -@@ -1422,11 +1450,6 @@ static void pre_schedule_dl(struct rq *rq, struct task_struct *prev) - pull_dl_task(rq); - } - --static void post_schedule_dl(struct rq *rq) --{ -- push_dl_tasks(rq); --} -- - /* - * Since the task is not running and a reschedule is not going to happen - * anytime soon on its runqueue, we try pushing it away now. -@@ -1529,7 +1552,7 @@ static void switched_from_dl(struct rq *rq, struct task_struct *p) - * from an overloaded cpu, if any. - */ - if (!rq->dl.dl_nr_running) -- pull_dl_task(rq); -+ queue_pull_task(rq); - #endif - } - -@@ -1539,8 +1562,6 @@ static void switched_from_dl(struct rq *rq, struct task_struct *p) - */ - static void switched_to_dl(struct rq *rq, struct task_struct *p) - { -- int check_resched = 1; -- - /* - * If p is throttled, don't consider the possibility - * of preempting rq->curr, the check will be done right -@@ -1551,12 +1572,12 @@ static void switched_to_dl(struct rq *rq, struct task_struct *p) - - if (p->on_rq || rq->curr != p) { - #ifdef CONFIG_SMP -- if (rq->dl.overloaded && push_dl_task(rq) && rq != task_rq(p)) -- /* Only reschedule if pushing failed */ -- check_resched = 0; --#endif /* CONFIG_SMP */ -- if (check_resched && task_has_dl_policy(rq->curr)) -+ if (rq->dl.overloaded) -+ queue_push_tasks(rq); -+#else -+ if (task_has_dl_policy(rq->curr)) - check_preempt_curr_dl(rq, p, 0); -+#endif /* CONFIG_SMP */ - } - } - -@@ -1576,15 +1597,14 @@ static void prio_changed_dl(struct rq *rq, struct task_struct *p, - * or lowering its prio, so... - */ - if (!rq->dl.overloaded) -- pull_dl_task(rq); -+ queue_pull_task(rq); - - /* - * If we now have a earlier deadline task than p, - * then reschedule, provided p is still on this - * runqueue. - */ -- if (dl_time_before(rq->dl.earliest_dl.curr, p->dl.deadline) && -- rq->curr == p) -+ if (dl_time_before(rq->dl.earliest_dl.curr, p->dl.deadline)) - resched_task(p); - #else - /* -@@ -1615,7 +1635,6 @@ const struct sched_class dl_sched_class = { - .rq_online = rq_online_dl, - .rq_offline = rq_offline_dl, - .pre_schedule = pre_schedule_dl, -- .post_schedule = post_schedule_dl, - .task_woken = task_woken_dl, - #endif - -diff --git a/kernel/sched/idle_task.c b/kernel/sched/idle_task.c -index 516c3d9ceea1..d08678d38d12 100644 ---- a/kernel/sched/idle_task.c -+++ b/kernel/sched/idle_task.c -@@ -19,11 +19,6 @@ static void pre_schedule_idle(struct rq *rq, struct task_struct *prev) - idle_exit_fair(rq); - rq_last_tick_reset(rq); - } -- --static void post_schedule_idle(struct rq *rq) --{ -- idle_enter_fair(rq); --} - #endif /* CONFIG_SMP */ - /* - * Idle tasks are unconditionally rescheduled: -@@ -37,8 +32,7 @@ static struct task_struct *pick_next_task_idle(struct rq *rq) - { - schedstat_inc(rq, sched_goidle); - #ifdef CONFIG_SMP -- /* Trigger the post schedule to do an idle_enter for CFS */ -- rq->post_schedule = 1; -+ idle_enter_fair(rq); - #endif - return rq->idle; - } -@@ -102,7 +96,6 @@ const struct sched_class idle_sched_class = { - #ifdef CONFIG_SMP - .select_task_rq = select_task_rq_idle, - .pre_schedule = pre_schedule_idle, -- .post_schedule = post_schedule_idle, - #endif - - .set_curr_task = set_curr_task_idle, -diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c -index 27b8e836307f..0fb72ae876e7 100644 ---- a/kernel/sched/rt.c -+++ b/kernel/sched/rt.c -@@ -315,6 +315,25 @@ static inline int has_pushable_tasks(struct rq *rq) - return !plist_head_empty(&rq->rt.pushable_tasks); - } - -+static DEFINE_PER_CPU(struct callback_head, rt_push_head); -+static DEFINE_PER_CPU(struct callback_head, rt_pull_head); -+ -+static void push_rt_tasks(struct rq *); -+static void pull_rt_task(struct rq *); -+ -+static inline void queue_push_tasks(struct rq *rq) -+{ -+ if (!has_pushable_tasks(rq)) -+ return; -+ -+ queue_balance_callback(rq, &per_cpu(rt_push_head, rq->cpu), push_rt_tasks); -+} -+ -+static inline void queue_pull_task(struct rq *rq) -+{ -+ queue_balance_callback(rq, &per_cpu(rt_pull_head, rq->cpu), pull_rt_task); -+} -+ - static void enqueue_pushable_task(struct rq *rq, struct task_struct *p) - { - plist_del(&p->pushable_tasks, &rq->rt.pushable_tasks); -@@ -359,6 +378,9 @@ void dec_rt_migration(struct sched_rt_entity *rt_se, struct rt_rq *rt_rq) - { - } - -+static inline void queue_push_tasks(struct rq *rq) -+{ -+} - #endif /* CONFIG_SMP */ - - static inline int on_rt_rq(struct sched_rt_entity *rt_se) -@@ -1349,11 +1371,7 @@ static struct task_struct *pick_next_task_rt(struct rq *rq) - dequeue_pushable_task(rq, p); - - #ifdef CONFIG_SMP -- /* -- * We detect this state here so that we can avoid taking the RQ -- * lock again later if there is no need to push -- */ -- rq->post_schedule = has_pushable_tasks(rq); -+ queue_push_tasks(rq); - #endif - - return p; -@@ -1641,14 +1659,15 @@ static void push_rt_tasks(struct rq *rq) - ; - } - --static int pull_rt_task(struct rq *this_rq) -+static void pull_rt_task(struct rq *this_rq) - { -- int this_cpu = this_rq->cpu, ret = 0, cpu; -+ int this_cpu = this_rq->cpu, cpu; -+ bool resched = false; - struct task_struct *p; - struct rq *src_rq; - - if (likely(!rt_overloaded(this_rq))) -- return 0; -+ return; - - /* - * Match the barrier from rt_set_overloaded; this guarantees that if we -@@ -1705,7 +1724,7 @@ static int pull_rt_task(struct rq *this_rq) - if (p->prio < src_rq->curr->prio) - goto skip; - -- ret = 1; -+ resched = true; - - deactivate_task(src_rq, p, 0); - set_task_cpu(p, this_cpu); -@@ -1721,7 +1740,8 @@ skip: - double_unlock_balance(this_rq, src_rq); - } - -- return ret; -+ if (resched) -+ resched_task(this_rq->curr); - } - - static void pre_schedule_rt(struct rq *rq, struct task_struct *prev) -@@ -1731,11 +1751,6 @@ static void pre_schedule_rt(struct rq *rq, struct task_struct *prev) - pull_rt_task(rq); - } - --static void post_schedule_rt(struct rq *rq) --{ -- push_rt_tasks(rq); --} -- - /* - * If we are not running and we are not going to reschedule soon, we should - * try to push tasks away now -@@ -1829,8 +1844,7 @@ static void switched_from_rt(struct rq *rq, struct task_struct *p) - if (!p->on_rq || rq->rt.rt_nr_running) - return; - -- if (pull_rt_task(rq)) -- resched_task(rq->curr); -+ queue_pull_task(rq); - } - - void init_sched_rt_class(void) -@@ -1851,8 +1865,6 @@ void init_sched_rt_class(void) - */ - static void switched_to_rt(struct rq *rq, struct task_struct *p) - { -- int check_resched = 1; -- - /* - * If we are already running, then there's nothing - * that needs to be done. But if we are not running -@@ -1862,13 +1874,12 @@ static void switched_to_rt(struct rq *rq, struct task_struct *p) - */ - if (p->on_rq && rq->curr != p) { - #ifdef CONFIG_SMP -- if (rq->rt.overloaded && push_rt_task(rq) && -- /* Don't resched if we changed runqueues */ -- rq != task_rq(p)) -- check_resched = 0; --#endif /* CONFIG_SMP */ -- if (check_resched && p->prio < rq->curr->prio) -+ if (rq->rt.overloaded) -+ queue_push_tasks(rq); -+#else -+ if (p->prio < rq->curr->prio) - resched_task(rq->curr); -+#endif /* CONFIG_SMP */ - } - } - -@@ -1889,14 +1900,13 @@ prio_changed_rt(struct rq *rq, struct task_struct *p, int oldprio) - * may need to pull tasks to this runqueue. - */ - if (oldprio < p->prio) -- pull_rt_task(rq); -+ queue_pull_task(rq); -+ - /* - * If there's a higher priority task waiting to run -- * then reschedule. Note, the above pull_rt_task -- * can release the rq lock and p could migrate. -- * Only reschedule if p is still on the same runqueue. -+ * then reschedule. - */ -- if (p->prio > rq->rt.highest_prio.curr && rq->curr == p) -+ if (p->prio > rq->rt.highest_prio.curr) - resched_task(p); - #else - /* For UP simply resched on drop of prio */ -@@ -2008,7 +2018,6 @@ const struct sched_class rt_sched_class = { - .rq_online = rq_online_rt, - .rq_offline = rq_offline_rt, - .pre_schedule = pre_schedule_rt, -- .post_schedule = post_schedule_rt, - .task_woken = task_woken_rt, - .switched_from = switched_from_rt, - #endif -diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h -index 835b6efa8bd6..675e147a86f2 100644 ---- a/kernel/sched/sched.h -+++ b/kernel/sched/sched.h -@@ -587,9 +587,10 @@ struct rq { - - unsigned long cpu_power; - -+ struct callback_head *balance_callback; -+ - unsigned char idle_balance; - /* For active balancing */ -- int post_schedule; - int active_balance; - int push_cpu; - struct cpu_stop_work active_balance_work; -@@ -690,6 +691,21 @@ extern int migrate_swap(struct task_struct *, struct task_struct *); - - #ifdef CONFIG_SMP - -+static inline void -+queue_balance_callback(struct rq *rq, -+ struct callback_head *head, -+ void (*func)(struct rq *rq)) -+{ -+ lockdep_assert_held(&rq->lock); -+ -+ if (unlikely(head->next)) -+ return; -+ -+ head->func = (void (*)(struct callback_head *))func; -+ head->next = rq->balance_callback; -+ rq->balance_callback = head; -+} -+ - #define rcu_dereference_check_sched_domain(p) \ - rcu_dereference_check((p), \ - lockdep_is_held(&sched_domains_mutex)) -@@ -1131,7 +1147,6 @@ struct sched_class { - void (*migrate_task_rq)(struct task_struct *p, int next_cpu); - - void (*pre_schedule) (struct rq *this_rq, struct task_struct *task); -- void (*post_schedule) (struct rq *this_rq); - void (*task_waking) (struct task_struct *task); - void (*task_woken) (struct rq *this_rq, struct task_struct *task); - -diff --git a/kernel/time/posix-clock.c b/kernel/time/posix-clock.c -index ce033c7aa2e8..9cff0ab82b63 100644 ---- a/kernel/time/posix-clock.c -+++ b/kernel/time/posix-clock.c -@@ -69,10 +69,10 @@ static ssize_t posix_clock_read(struct file *fp, char __user *buf, - static unsigned int posix_clock_poll(struct file *fp, poll_table *wait) - { - struct posix_clock *clk = get_posix_clock(fp); -- int result = 0; -+ unsigned int result = 0; - - if (!clk) -- return -ENODEV; -+ return POLLERR; - - if (clk->ops.poll) - result = clk->ops.poll(clk, fp, wait); -diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c -index da41de9dc319..c798ed2fc281 100644 ---- a/kernel/trace/ring_buffer.c -+++ b/kernel/trace/ring_buffer.c -@@ -1949,12 +1949,6 @@ rb_set_commit_to_write(struct ring_buffer_per_cpu *cpu_buffer) - goto again; - } - --static void rb_reset_reader_page(struct ring_buffer_per_cpu *cpu_buffer) --{ -- cpu_buffer->read_stamp = cpu_buffer->reader_page->page->time_stamp; -- cpu_buffer->reader_page->read = 0; --} -- - static void rb_inc_iter(struct ring_buffer_iter *iter) - { - struct ring_buffer_per_cpu *cpu_buffer = iter->cpu_buffer; -@@ -3592,7 +3586,7 @@ rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer) - - /* Finally update the reader page to the new head */ - cpu_buffer->reader_page = reader; -- rb_reset_reader_page(cpu_buffer); -+ cpu_buffer->reader_page->read = 0; - - if (overwrite != cpu_buffer->last_overrun) { - cpu_buffer->lost_events = overwrite - cpu_buffer->last_overrun; -@@ -3602,6 +3596,10 @@ rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer) - goto again; - - out: -+ /* Update the read_stamp on the first event */ -+ if (reader && reader->read == 0) -+ cpu_buffer->read_stamp = reader->page->time_stamp; -+ - arch_spin_unlock(&cpu_buffer->lock); - local_irq_restore(flags); - -diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c -index c6646a58d23e..bb1ac9cbe30a 100644 ---- a/kernel/trace/trace_events.c -+++ b/kernel/trace/trace_events.c -@@ -606,7 +606,8 @@ t_next(struct seq_file *m, void *v, loff_t *pos) - * The ftrace subsystem is for showing formats only. - * They can not be enabled or disabled via the event files. - */ -- if (call->class && call->class->reg) -+ if (call->class && call->class->reg && -+ !(call->flags & TRACE_EVENT_FL_IGNORE_ENABLE)) - return file; - } - -diff --git a/kernel/workqueue.c b/kernel/workqueue.c -index 646a8b81bee1..423c9e37a9e7 100644 ---- a/kernel/workqueue.c -+++ b/kernel/workqueue.c -@@ -1475,13 +1475,13 @@ static void __queue_delayed_work(int cpu, struct workqueue_struct *wq, - timer_stats_timer_set_start_info(&dwork->timer); - - dwork->wq = wq; -- /* timer isn't guaranteed to run in this cpu, record earlier */ -- if (cpu == WORK_CPU_UNBOUND) -- cpu = raw_smp_processor_id(); - dwork->cpu = cpu; - timer->expires = jiffies + delay; - -- add_timer_on(timer, cpu); -+ if (unlikely(cpu != WORK_CPU_UNBOUND)) -+ add_timer_on(timer, cpu); -+ else -+ add_timer(timer); - } - - /** -diff --git a/lib/devres.c b/lib/devres.c -index 823533138fa0..20afaf181b27 100644 ---- a/lib/devres.c -+++ b/lib/devres.c -@@ -423,7 +423,7 @@ void pcim_iounmap_regions(struct pci_dev *pdev, int mask) - if (!iomap) - return; - -- for (i = 0; i < DEVICE_COUNT_RESOURCE; i++) { -+ for (i = 0; i < PCIM_IOMAP_MAX; i++) { - if (!(mask & (1 << i))) - continue; - -diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c -index 2e87eecec8f6..04dd542697a7 100644 ---- a/net/ceph/messenger.c -+++ b/net/ceph/messenger.c -@@ -2279,7 +2279,7 @@ static int read_partial_message(struct ceph_connection *con) - con->in_base_pos = -front_len - middle_len - data_len - - sizeof(m->footer); - con->in_tag = CEPH_MSGR_TAG_READY; -- return 0; -+ return 1; - } else if ((s64)seq - (s64)con->in_seq > 1) { - pr_err("read_partial_message bad seq %lld expected %lld\n", - seq, con->in_seq + 1); -@@ -2312,7 +2312,7 @@ static int read_partial_message(struct ceph_connection *con) - sizeof(m->footer); - con->in_tag = CEPH_MSGR_TAG_READY; - con->in_seq++; -- return 0; -+ return 1; - } - - BUG_ON(!con->in_msg); -diff --git a/net/core/scm.c b/net/core/scm.c -index d30eb057fa7b..cad57a1390dd 100644 ---- a/net/core/scm.c -+++ b/net/core/scm.c -@@ -87,6 +87,7 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp) - *fplp = fpl; - fpl->count = 0; - fpl->max = SCM_MAX_FD; -+ fpl->user = NULL; - } - fpp = &fpl->fp[fpl->count]; - -@@ -107,6 +108,10 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp) - *fpp++ = file; - fpl->count++; - } -+ -+ if (!fpl->user) -+ fpl->user = get_uid(current_user()); -+ - return num; - } - -@@ -119,6 +124,7 @@ void __scm_destroy(struct scm_cookie *scm) - scm->fp = NULL; - for (i=fpl->count-1; i>=0; i--) - fput(fpl->fp[i]); -+ free_uid(fpl->user); - kfree(fpl); - } - } -@@ -337,6 +343,7 @@ struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl) - for (i = 0; i < fpl->count; i++) - get_file(fpl->fp[i]); - new_fpl->max = new_fpl->count; -+ new_fpl->user = get_uid(fpl->user); - } - return new_fpl; - } -diff --git a/net/ipv4/netfilter/ipt_rpfilter.c b/net/ipv4/netfilter/ipt_rpfilter.c -index c49dcd0284a0..56dd8ac6d28b 100644 ---- a/net/ipv4/netfilter/ipt_rpfilter.c -+++ b/net/ipv4/netfilter/ipt_rpfilter.c -@@ -61,9 +61,7 @@ static bool rpfilter_lookup_reverse(struct flowi4 *fl4, - if (FIB_RES_DEV(res) == dev) - dev_match = true; - #endif -- if (dev_match || flags & XT_RPFILTER_LOOSE) -- return FIB_RES_NH(res).nh_scope <= RT_SCOPE_HOST; -- return dev_match; -+ return dev_match || flags & XT_RPFILTER_LOOSE; - } - - static bool rpfilter_is_local(const struct sk_buff *skb) -diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c -index 3f0ec063d7f8..7b74fca4d850 100644 ---- a/net/ipv6/addrconf.c -+++ b/net/ipv6/addrconf.c -@@ -4793,6 +4793,21 @@ int addrconf_sysctl_forward(struct ctl_table *ctl, int write, - return ret; - } - -+static -+int addrconf_sysctl_mtu(struct ctl_table *ctl, int write, -+ void __user *buffer, size_t *lenp, loff_t *ppos) -+{ -+ struct inet6_dev *idev = ctl->extra1; -+ int min_mtu = IPV6_MIN_MTU; -+ struct ctl_table lctl; -+ -+ lctl = *ctl; -+ lctl.extra1 = &min_mtu; -+ lctl.extra2 = idev ? &idev->dev->mtu : NULL; -+ -+ return proc_dointvec_minmax(&lctl, write, buffer, lenp, ppos); -+} -+ - static void dev_disable_change(struct inet6_dev *idev) - { - struct netdev_notifier_info info; -@@ -4944,7 +4959,7 @@ static struct addrconf_sysctl_table - .data = &ipv6_devconf.mtu6, - .maxlen = sizeof(int), - .mode = 0644, -- .proc_handler = proc_dointvec, -+ .proc_handler = addrconf_sysctl_mtu, - }, - { - .procname = "accept_ra", -diff --git a/net/ipv6/netfilter/ip6t_SYNPROXY.c b/net/ipv6/netfilter/ip6t_SYNPROXY.c -index a0d17270117c..bd174540eb21 100644 ---- a/net/ipv6/netfilter/ip6t_SYNPROXY.c -+++ b/net/ipv6/netfilter/ip6t_SYNPROXY.c -@@ -37,12 +37,13 @@ synproxy_build_ip(struct sk_buff *skb, const struct in6_addr *saddr, - } - - static void --synproxy_send_tcp(const struct sk_buff *skb, struct sk_buff *nskb, -+synproxy_send_tcp(const struct synproxy_net *snet, -+ const struct sk_buff *skb, struct sk_buff *nskb, - struct nf_conntrack *nfct, enum ip_conntrack_info ctinfo, - struct ipv6hdr *niph, struct tcphdr *nth, - unsigned int tcp_hdr_size) - { -- struct net *net = nf_ct_net((struct nf_conn *)nfct); -+ struct net *net = nf_ct_net(snet->tmpl); - struct dst_entry *dst; - struct flowi6 fl6; - -@@ -83,7 +84,8 @@ free_nskb: - } - - static void --synproxy_send_client_synack(const struct sk_buff *skb, const struct tcphdr *th, -+synproxy_send_client_synack(const struct synproxy_net *snet, -+ const struct sk_buff *skb, const struct tcphdr *th, - const struct synproxy_options *opts) - { - struct sk_buff *nskb; -@@ -119,7 +121,7 @@ synproxy_send_client_synack(const struct sk_buff *skb, const struct tcphdr *th, - - synproxy_build_options(nth, opts); - -- synproxy_send_tcp(skb, nskb, skb->nfct, IP_CT_ESTABLISHED_REPLY, -+ synproxy_send_tcp(snet, skb, nskb, skb->nfct, IP_CT_ESTABLISHED_REPLY, - niph, nth, tcp_hdr_size); - } - -@@ -163,7 +165,7 @@ synproxy_send_server_syn(const struct synproxy_net *snet, - - synproxy_build_options(nth, opts); - -- synproxy_send_tcp(skb, nskb, &snet->tmpl->ct_general, IP_CT_NEW, -+ synproxy_send_tcp(snet, skb, nskb, &snet->tmpl->ct_general, IP_CT_NEW, - niph, nth, tcp_hdr_size); - } - -@@ -203,7 +205,7 @@ synproxy_send_server_ack(const struct synproxy_net *snet, - - synproxy_build_options(nth, opts); - -- synproxy_send_tcp(skb, nskb, NULL, 0, niph, nth, tcp_hdr_size); -+ synproxy_send_tcp(snet, skb, nskb, NULL, 0, niph, nth, tcp_hdr_size); - } - - static void -@@ -241,7 +243,7 @@ synproxy_send_client_ack(const struct synproxy_net *snet, - - synproxy_build_options(nth, opts); - -- synproxy_send_tcp(skb, nskb, NULL, 0, niph, nth, tcp_hdr_size); -+ synproxy_send_tcp(snet, skb, nskb, NULL, 0, niph, nth, tcp_hdr_size); - } - - static bool -@@ -301,7 +303,7 @@ synproxy_tg6(struct sk_buff *skb, const struct xt_action_param *par) - XT_SYNPROXY_OPT_SACK_PERM | - XT_SYNPROXY_OPT_ECN); - -- synproxy_send_client_synack(skb, th, &opts); -+ synproxy_send_client_synack(snet, skb, th, &opts); - return NF_DROP; - - } else if (th->ack && !(th->fin || th->rst || th->syn)) { -diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c -index 7d050ed6fe5a..6d28bd434ce8 100644 ---- a/net/mac80211/mesh_pathtbl.c -+++ b/net/mac80211/mesh_pathtbl.c -@@ -746,10 +746,8 @@ void mesh_plink_broken(struct sta_info *sta) - static void mesh_path_node_reclaim(struct rcu_head *rp) - { - struct mpath_node *node = container_of(rp, struct mpath_node, rcu); -- struct ieee80211_sub_if_data *sdata = node->mpath->sdata; - - del_timer_sync(&node->mpath->timer); -- atomic_dec(&sdata->u.mesh.mpaths); - kfree(node->mpath); - kfree(node); - } -@@ -757,8 +755,9 @@ static void mesh_path_node_reclaim(struct rcu_head *rp) - /* needs to be called with the corresponding hashwlock taken */ - static void __mesh_path_del(struct mesh_table *tbl, struct mpath_node *node) - { -- struct mesh_path *mpath; -- mpath = node->mpath; -+ struct mesh_path *mpath = node->mpath; -+ struct ieee80211_sub_if_data *sdata = node->mpath->sdata; -+ - spin_lock(&mpath->state_lock); - mpath->flags |= MESH_PATH_RESOLVING; - if (mpath->is_gate) -@@ -766,6 +765,7 @@ static void __mesh_path_del(struct mesh_table *tbl, struct mpath_node *node) - hlist_del_rcu(&node->list); - call_rcu(&node->rcu, mesh_path_node_reclaim); - spin_unlock(&mpath->state_lock); -+ atomic_dec(&sdata->u.mesh.mpaths); - atomic_dec(&tbl->entries); - } - -diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c -index 99de2409f731..4e8d90b8fc01 100644 ---- a/net/netfilter/nf_tables_api.c -+++ b/net/netfilter/nf_tables_api.c -@@ -3316,9 +3316,9 @@ EXPORT_SYMBOL_GPL(nft_data_init); - */ - void nft_data_uninit(const struct nft_data *data, enum nft_data_types type) - { -- switch (type) { -- case NFT_DATA_VALUE: -+ if (type < NFT_DATA_VERDICT) - return; -+ switch (type) { - case NFT_DATA_VERDICT: - return nft_verdict_uninit(data); - default: -diff --git a/net/rds/send.c b/net/rds/send.c -index a82fb660ec00..44222c0607c7 100644 ---- a/net/rds/send.c -+++ b/net/rds/send.c -@@ -955,11 +955,13 @@ int rds_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, - release_sock(sk); - } - -- /* racing with another thread binding seems ok here */ -+ lock_sock(sk); - if (daddr == 0 || rs->rs_bound_addr == 0) { -+ release_sock(sk); - ret = -ENOTCONN; /* XXX not a great errno */ - goto out; - } -+ release_sock(sk); - - /* size of rm including all sgs */ - ret = rds_rm_size(msg, payload_len); -diff --git a/net/rfkill/core.c b/net/rfkill/core.c -index ed7e0b4e7f90..4b9dc2460772 100644 ---- a/net/rfkill/core.c -+++ b/net/rfkill/core.c -@@ -49,7 +49,6 @@ - struct rfkill { - spinlock_t lock; - -- const char *name; - enum rfkill_type type; - - unsigned long state; -@@ -73,6 +72,7 @@ struct rfkill { - struct delayed_work poll_work; - struct work_struct uevent_work; - struct work_struct sync_work; -+ char name[]; - }; - #define to_rfkill(d) container_of(d, struct rfkill, dev) - -@@ -861,14 +861,14 @@ struct rfkill * __must_check rfkill_alloc(const char *name, - if (WARN_ON(type == RFKILL_TYPE_ALL || type >= NUM_RFKILL_TYPES)) - return NULL; - -- rfkill = kzalloc(sizeof(*rfkill), GFP_KERNEL); -+ rfkill = kzalloc(sizeof(*rfkill) + strlen(name) + 1, GFP_KERNEL); - if (!rfkill) - return NULL; - - spin_lock_init(&rfkill->lock); - INIT_LIST_HEAD(&rfkill->node); - rfkill->type = type; -- rfkill->name = name; -+ strcpy(rfkill->name, name); - rfkill->ops = ops; - rfkill->data = ops_data; - -@@ -1078,17 +1078,6 @@ static unsigned int rfkill_fop_poll(struct file *file, poll_table *wait) - return res; - } - --static bool rfkill_readable(struct rfkill_data *data) --{ -- bool r; -- -- mutex_lock(&data->mtx); -- r = !list_empty(&data->events); -- mutex_unlock(&data->mtx); -- -- return r; --} -- - static ssize_t rfkill_fop_read(struct file *file, char __user *buf, - size_t count, loff_t *pos) - { -@@ -1105,8 +1094,11 @@ static ssize_t rfkill_fop_read(struct file *file, char __user *buf, - goto out; - } - mutex_unlock(&data->mtx); -+ /* since we re-check and it just compares pointers, -+ * using !list_empty() without locking isn't a problem -+ */ - ret = wait_event_interruptible(data->read_wait, -- rfkill_readable(data)); -+ !list_empty(&data->events)); - mutex_lock(&data->mtx); - - if (ret) -diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c -index 0adc66caae2f..07edbcd8697e 100644 ---- a/net/sunrpc/cache.c -+++ b/net/sunrpc/cache.c -@@ -1230,7 +1230,7 @@ int qword_get(char **bpp, char *dest, int bufsize) - if (bp[0] == '\\' && bp[1] == 'x') { - /* HEX STRING */ - bp += 2; -- while (len < bufsize) { -+ while (len < bufsize - 1) { - int h, l; - - h = hex_to_bin(bp[0]); -diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c -index 0cd18c240250..ab2eeb1cb32c 100644 ---- a/net/unix/af_unix.c -+++ b/net/unix/af_unix.c -@@ -1469,7 +1469,7 @@ static void unix_detach_fds(struct scm_cookie *scm, struct sk_buff *skb) - UNIXCB(skb).fp = NULL; - - for (i = scm->fp->count-1; i >= 0; i--) -- unix_notinflight(scm->fp->fp[i]); -+ unix_notinflight(scm->fp->user, scm->fp->fp[i]); - } - - static void unix_destruct_scm(struct sk_buff *skb) -@@ -1534,7 +1534,7 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb) - return -ENOMEM; - - for (i = scm->fp->count - 1; i >= 0; i--) -- unix_inflight(scm->fp->fp[i]); -+ unix_inflight(scm->fp->user, scm->fp->fp[i]); - return max_level; - } - -diff --git a/net/unix/garbage.c b/net/unix/garbage.c -index 06730fe6ad9d..a72182d6750f 100644 ---- a/net/unix/garbage.c -+++ b/net/unix/garbage.c -@@ -122,7 +122,7 @@ struct sock *unix_get_socket(struct file *filp) - * descriptor if it is for an AF_UNIX socket. - */ - --void unix_inflight(struct file *fp) -+void unix_inflight(struct user_struct *user, struct file *fp) - { - struct sock *s = unix_get_socket(fp); - -@@ -139,11 +139,11 @@ void unix_inflight(struct file *fp) - } - unix_tot_inflight++; - } -- fp->f_cred->user->unix_inflight++; -+ user->unix_inflight++; - spin_unlock(&unix_gc_lock); - } - --void unix_notinflight(struct file *fp) -+void unix_notinflight(struct user_struct *user, struct file *fp) - { - struct sock *s = unix_get_socket(fp); - -@@ -157,7 +157,7 @@ void unix_notinflight(struct file *fp) - list_del_init(&u->link); - unix_tot_inflight--; - } -- fp->f_cred->user->unix_inflight--; -+ user->unix_inflight--; - spin_unlock(&unix_gc_lock); - } - -diff --git a/scripts/recordmcount.c b/scripts/recordmcount.c -index 9c22317778eb..ee625e3a56ba 100644 ---- a/scripts/recordmcount.c -+++ b/scripts/recordmcount.c -@@ -189,6 +189,20 @@ static void *mmap_file(char const *fname) - addr = umalloc(sb.st_size); - uread(fd_map, addr, sb.st_size); - } -+ if (sb.st_nlink != 1) { -+ /* file is hard-linked, break the hard link */ -+ close(fd_map); -+ if (unlink(fname) < 0) { -+ perror(fname); -+ fail_file(); -+ } -+ fd_map = open(fname, O_RDWR | O_CREAT, sb.st_mode); -+ if (fd_map < 0) { -+ perror(fname); -+ fail_file(); -+ } -+ uwrite(fd_map, addr, sb.st_size); -+ } - return addr; - } - -diff --git a/tools/Makefile b/tools/Makefile -index feec3ad5fd09..6e8ac8982149 100644 ---- a/tools/Makefile -+++ b/tools/Makefile -@@ -24,6 +24,10 @@ help: - @echo ' from the kernel command line to build and install one of' - @echo ' the tools above' - @echo '' -+ @echo ' $$ make tools/all' -+ @echo '' -+ @echo ' builds all tools.' -+ @echo '' - @echo ' $$ make tools/install' - @echo '' - @echo ' installs all tools.' -@@ -58,6 +62,11 @@ turbostat x86_energy_perf_policy: FORCE - tmon: FORCE - $(call descend,thermal/$@) - -+all: acpi cgroup cpupower firewire lguest \ -+ perf selftests turbostat usb \ -+ virtio vm net x86_energy_perf_policy \ -+ tmon -+ - acpi_install: - $(call descend,power/$(@:_install=),install) - -diff --git a/virt/kvm/async_pf.c b/virt/kvm/async_pf.c -index f2c80d5451c3..919095029528 100644 ---- a/virt/kvm/async_pf.c -+++ b/virt/kvm/async_pf.c -@@ -152,7 +152,7 @@ int kvm_setup_async_pf(struct kvm_vcpu *vcpu, gva_t gva, gfn_t gfn, - * do alloc nowait since if we are going to sleep anyway we - * may as well sleep faulting in page - */ -- work = kmem_cache_zalloc(async_pf_cache, GFP_NOWAIT); -+ work = kmem_cache_zalloc(async_pf_cache, GFP_NOWAIT | __GFP_NOWARN); - if (!work) - return 0; - diff --git a/patch/kernel/odroidc2-default/patch-3.14.63-64.patch b/patch/kernel/odroidc2-default/patch-3.14.63-64.patch deleted file mode 100644 index 1e253d6ab3..0000000000 --- a/patch/kernel/odroidc2-default/patch-3.14.63-64.patch +++ /dev/null @@ -1,2736 +0,0 @@ -diff --git a/Makefile b/Makefile -index 0843ef4cc0a4..de41fa82652f 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 3 - PATCHLEVEL = 14 --SUBLEVEL = 63 -+SUBLEVEL = 64 - EXTRAVERSION = - NAME = Remembering Coco - -diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c -index 81e6ae0220bc..887535c4c93d 100644 ---- a/arch/mips/kernel/traps.c -+++ b/arch/mips/kernel/traps.c -@@ -688,15 +688,15 @@ static int simulate_sync(struct pt_regs *regs, unsigned int opcode) - asmlinkage void do_ov(struct pt_regs *regs) - { - enum ctx_state prev_state; -- siginfo_t info; -+ siginfo_t info = { -+ .si_signo = SIGFPE, -+ .si_code = FPE_INTOVF, -+ .si_addr = (void __user *)regs->cp0_epc, -+ }; - - prev_state = exception_enter(); - die_if_kernel("Integer overflow", regs); - -- info.si_code = FPE_INTOVF; -- info.si_signo = SIGFPE; -- info.si_errno = 0; -- info.si_addr = (void __user *) regs->cp0_epc; - force_sig_info(SIGFPE, &info, current); - exception_exit(prev_state); - } -@@ -797,7 +797,7 @@ out: - static void do_trap_or_bp(struct pt_regs *regs, unsigned int code, - const char *str) - { -- siginfo_t info; -+ siginfo_t info = { 0 }; - char b[40]; - - #ifdef CONFIG_KGDB_LOW_LEVEL_TRAP -@@ -825,7 +825,6 @@ static void do_trap_or_bp(struct pt_regs *regs, unsigned int code, - else - info.si_code = FPE_INTOVF; - info.si_signo = SIGFPE; -- info.si_errno = 0; - info.si_addr = (void __user *) regs->cp0_epc; - force_sig_info(SIGFPE, &info, current); - break; -diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S -index 92a2e9333620..b74ac9c5710b 100644 ---- a/arch/x86/ia32/ia32entry.S -+++ b/arch/x86/ia32/ia32entry.S -@@ -422,6 +422,7 @@ ENTRY(ia32_syscall) - /*CFI_REL_OFFSET cs,CS-RIP*/ - CFI_REL_OFFSET rip,RIP-RIP - PARAVIRT_ADJUST_EXCEPTION_FRAME -+ ASM_CLAC /* Do this early to minimize exposure */ - SWAPGS - /* - * No need to follow this irqs on/off section: the syscall -diff --git a/arch/x86/kernel/acpi/sleep.c b/arch/x86/kernel/acpi/sleep.c -index 3a2ae4c88948..398c7a908c17 100644 ---- a/arch/x86/kernel/acpi/sleep.c -+++ b/arch/x86/kernel/acpi/sleep.c -@@ -16,6 +16,7 @@ - #include - #include - -+#include - #include "../../realmode/rm/wakeup.h" - #include "sleep.h" - -@@ -107,7 +108,13 @@ int x86_acpi_suspend_lowlevel(void) - saved_magic = 0x123456789abcdef0L; - #endif /* CONFIG_64BIT */ - -+ /* -+ * Pause/unpause graph tracing around do_suspend_lowlevel as it has -+ * inconsistent call/return info after it jumps to the wakeup vector. -+ */ -+ pause_graph_tracing(); - do_suspend_lowlevel(); -+ unpause_graph_tracing(); - return 0; - } - -diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c -index 6fecf0bde105..1e82d2a1e205 100644 ---- a/drivers/ata/libata-scsi.c -+++ b/drivers/ata/libata-scsi.c -@@ -674,19 +674,18 @@ static int ata_ioc32(struct ata_port *ap) - int ata_sas_scsi_ioctl(struct ata_port *ap, struct scsi_device *scsidev, - int cmd, void __user *arg) - { -- int val = -EINVAL, rc = -EINVAL; -+ unsigned long val; -+ int rc = -EINVAL; - unsigned long flags; - - switch (cmd) { -- case ATA_IOC_GET_IO32: -+ case HDIO_GET_32BIT: - spin_lock_irqsave(ap->lock, flags); - val = ata_ioc32(ap); - spin_unlock_irqrestore(ap->lock, flags); -- if (copy_to_user(arg, &val, 1)) -- return -EFAULT; -- return 0; -+ return put_user(val, (unsigned long __user *)arg); - -- case ATA_IOC_SET_IO32: -+ case HDIO_SET_32BIT: - val = (unsigned long) arg; - rc = 0; - spin_lock_irqsave(ap->lock, flags); -diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c -index b335c6ab5efe..b2dd473237e8 100644 ---- a/drivers/edac/edac_mc_sysfs.c -+++ b/drivers/edac/edac_mc_sysfs.c -@@ -973,21 +973,26 @@ nomem: - */ - int edac_create_sysfs_mci_device(struct mem_ctl_info *mci) - { -+ char *name; - int i, err; - - /* - * The memory controller needs its own bus, in order to avoid - * namespace conflicts at /sys/bus/edac. - */ -- mci->bus->name = kasprintf(GFP_KERNEL, "mc%d", mci->mc_idx); -- if (!mci->bus->name) -+ name = kasprintf(GFP_KERNEL, "mc%d", mci->mc_idx); -+ if (!name) - return -ENOMEM; - -+ mci->bus->name = name; -+ - edac_dbg(0, "creating bus %s\n", mci->bus->name); - - err = bus_register(mci->bus); -- if (err < 0) -+ if (err < 0) { -+ kfree(name); - return err; -+ } - - /* get the /sys/devices/system/edac subsys reference */ - mci->dev.type = &mci_attr_type; -@@ -1071,7 +1076,8 @@ fail: - fail2: - device_unregister(&mci->dev); - bus_unregister(mci->bus); -- kfree(mci->bus->name); -+ kfree(name); -+ - return err; - } - -@@ -1102,10 +1108,12 @@ void edac_remove_sysfs_mci_device(struct mem_ctl_info *mci) - - void edac_unregister_sysfs(struct mem_ctl_info *mci) - { -+ const char *name = mci->bus->name; -+ - edac_dbg(1, "Unregistering device %s\n", dev_name(&mci->dev)); - device_unregister(&mci->dev); - bus_unregister(mci->bus); -- kfree(mci->bus->name); -+ kfree(name); - } - - static void mc_attr_release(struct device *dev) -diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c -index c0f284230a39..ed8d93cbd1ca 100644 ---- a/drivers/gpu/drm/ast/ast_main.c -+++ b/drivers/gpu/drm/ast/ast_main.c -@@ -124,7 +124,7 @@ static int ast_get_dram_info(struct drm_device *dev) - } while (ast_read32(ast, 0x10000) != 0x01); - data = ast_read32(ast, 0x10004); - -- if (data & 0x400) -+ if (data & 0x40) - ast->dram_bus_width = 16; - else - ast->dram_bus_width = 32; -diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c -index a49ce4a6e72f..1320a81df792 100644 ---- a/drivers/infiniband/ulp/isert/ib_isert.c -+++ b/drivers/infiniband/ulp/isert/ib_isert.c -@@ -2071,6 +2071,24 @@ isert_put_response(struct iscsi_conn *conn, struct iscsi_cmd *cmd) - return isert_post_response(isert_conn, isert_cmd); - } - -+static void -+isert_aborted_task(struct iscsi_conn *conn, struct iscsi_cmd *cmd) -+{ -+ struct isert_cmd *isert_cmd = iscsit_priv_cmd(cmd); -+ struct isert_conn *isert_conn = (struct isert_conn *)conn->context; -+ struct isert_device *device = isert_conn->conn_device; -+ -+ spin_lock_bh(&conn->cmd_lock); -+ if (!list_empty(&cmd->i_conn_node)) -+ list_del_init(&cmd->i_conn_node); -+ spin_unlock_bh(&conn->cmd_lock); -+ -+ if (cmd->data_direction == DMA_TO_DEVICE) -+ iscsit_stop_dataout_timer(cmd); -+ -+ device->unreg_rdma_mem(isert_cmd, isert_conn); -+} -+ - static int - isert_put_nopin(struct iscsi_cmd *cmd, struct iscsi_conn *conn, - bool nopout_response) -@@ -2999,6 +3017,7 @@ static struct iscsit_transport iser_target_transport = { - .iscsit_get_dataout = isert_get_dataout, - .iscsit_queue_data_in = isert_put_datain, - .iscsit_queue_status = isert_put_response, -+ .iscsit_aborted_task = isert_aborted_task, - }; - - static int __init isert_init(void) -diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c -index 0097b8dae5bc..727a88d9a708 100644 ---- a/drivers/infiniband/ulp/srpt/ib_srpt.c -+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c -@@ -3093,6 +3093,14 @@ static void srpt_queue_tm_rsp(struct se_cmd *cmd) - srpt_queue_response(cmd); - } - -+static void srpt_aborted_task(struct se_cmd *cmd) -+{ -+ struct srpt_send_ioctx *ioctx = container_of(cmd, -+ struct srpt_send_ioctx, cmd); -+ -+ srpt_unmap_sg_to_ib_sge(ioctx->ch, ioctx); -+} -+ - static int srpt_queue_status(struct se_cmd *cmd) - { - struct srpt_send_ioctx *ioctx; -@@ -3940,6 +3948,7 @@ static struct target_core_fabric_ops srpt_template = { - .queue_data_in = srpt_queue_data_in, - .queue_status = srpt_queue_status, - .queue_tm_rsp = srpt_queue_tm_rsp, -+ .aborted_task = srpt_aborted_task, - /* - * Setup function pointers for generic logic in - * target_core_fabric_configfs.c -diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c -index 28b4bea7c109..a8e52ef6e266 100644 ---- a/drivers/iommu/amd_iommu_init.c -+++ b/drivers/iommu/amd_iommu_init.c -@@ -226,6 +226,10 @@ static enum iommu_init_state init_state = IOMMU_START_STATE; - static int amd_iommu_enable_interrupts(void); - static int __init iommu_go_to_state(enum iommu_init_state state); - -+static int iommu_pc_get_set_reg_val(struct amd_iommu *iommu, -+ u8 bank, u8 cntr, u8 fxn, -+ u64 *value, bool is_write); -+ - static inline void update_last_devid(u16 devid) - { - if (devid > amd_iommu_last_bdf) -@@ -1182,8 +1186,8 @@ static void init_iommu_perf_ctr(struct amd_iommu *iommu) - amd_iommu_pc_present = true; - - /* Check if the performance counters can be written to */ -- if ((0 != amd_iommu_pc_get_set_reg_val(0, 0, 0, 0, &val, true)) || -- (0 != amd_iommu_pc_get_set_reg_val(0, 0, 0, 0, &val2, false)) || -+ if ((0 != iommu_pc_get_set_reg_val(iommu, 0, 0, 0, &val, true)) || -+ (0 != iommu_pc_get_set_reg_val(iommu, 0, 0, 0, &val2, false)) || - (val != val2)) { - pr_err("AMD-Vi: Unable to write to IOMMU perf counter.\n"); - amd_iommu_pc_present = false; -@@ -2314,22 +2318,15 @@ u8 amd_iommu_pc_get_max_counters(u16 devid) - } - EXPORT_SYMBOL(amd_iommu_pc_get_max_counters); - --int amd_iommu_pc_get_set_reg_val(u16 devid, u8 bank, u8 cntr, u8 fxn, -+static int iommu_pc_get_set_reg_val(struct amd_iommu *iommu, -+ u8 bank, u8 cntr, u8 fxn, - u64 *value, bool is_write) - { -- struct amd_iommu *iommu; - u32 offset; - u32 max_offset_lim; - -- /* Make sure the IOMMU PC resource is available */ -- if (!amd_iommu_pc_present) -- return -ENODEV; -- -- /* Locate the iommu associated with the device ID */ -- iommu = amd_iommu_rlookup_table[devid]; -- - /* Check for valid iommu and pc register indexing */ -- if (WARN_ON((iommu == NULL) || (fxn > 0x28) || (fxn & 7))) -+ if (WARN_ON((fxn > 0x28) || (fxn & 7))) - return -ENODEV; - - offset = (u32)(((0x40|bank) << 12) | (cntr << 8) | fxn); -@@ -2353,3 +2350,16 @@ int amd_iommu_pc_get_set_reg_val(u16 devid, u8 bank, u8 cntr, u8 fxn, - return 0; - } - EXPORT_SYMBOL(amd_iommu_pc_get_set_reg_val); -+ -+int amd_iommu_pc_get_set_reg_val(u16 devid, u8 bank, u8 cntr, u8 fxn, -+ u64 *value, bool is_write) -+{ -+ struct amd_iommu *iommu = amd_iommu_rlookup_table[devid]; -+ -+ /* Make sure the IOMMU PC resource is available */ -+ if (!amd_iommu_pc_present || iommu == NULL) -+ return -ENODEV; -+ -+ return iommu_pc_get_set_reg_val(iommu, bank, cntr, fxn, -+ value, is_write); -+} -diff --git a/drivers/mtd/ubi/upd.c b/drivers/mtd/ubi/upd.c -index 2a1b6e037e1a..0134ba32a057 100644 ---- a/drivers/mtd/ubi/upd.c -+++ b/drivers/mtd/ubi/upd.c -@@ -193,7 +193,7 @@ int ubi_start_leb_change(struct ubi_device *ubi, struct ubi_volume *vol, - vol->changing_leb = 1; - vol->ch_lnum = req->lnum; - -- vol->upd_buf = vmalloc(req->bytes); -+ vol->upd_buf = vmalloc(ALIGN((int)req->bytes, ubi->min_io_size)); - if (!vol->upd_buf) - return -ENOMEM; - -diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c -index 1817f3f2b02d..f46c0a6c5016 100644 ---- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c -+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c -@@ -684,6 +684,20 @@ static void tcm_qla2xxx_queue_tm_rsp(struct se_cmd *se_cmd) - qlt_xmit_tm_rsp(mcmd); - } - -+static void tcm_qla2xxx_aborted_task(struct se_cmd *se_cmd) -+{ -+ struct qla_tgt_cmd *cmd = container_of(se_cmd, -+ struct qla_tgt_cmd, se_cmd); -+ struct scsi_qla_host *vha = cmd->vha; -+ struct qla_hw_data *ha = vha->hw; -+ -+ if (!cmd->sg_mapped) -+ return; -+ -+ pci_unmap_sg(ha->pdev, cmd->sg, cmd->sg_cnt, cmd->dma_data_direction); -+ cmd->sg_mapped = 0; -+} -+ - /* Local pointer to allocated TCM configfs fabric module */ - struct target_fabric_configfs *tcm_qla2xxx_fabric_configfs; - struct target_fabric_configfs *tcm_qla2xxx_npiv_fabric_configfs; -@@ -1886,6 +1900,7 @@ static struct target_core_fabric_ops tcm_qla2xxx_ops = { - .queue_data_in = tcm_qla2xxx_queue_data_in, - .queue_status = tcm_qla2xxx_queue_status, - .queue_tm_rsp = tcm_qla2xxx_queue_tm_rsp, -+ .aborted_task = tcm_qla2xxx_aborted_task, - /* - * Setup function pointers for generic logic in - * target_core_fabric_configfs.c -@@ -1935,6 +1950,7 @@ static struct target_core_fabric_ops tcm_qla2xxx_npiv_ops = { - .queue_data_in = tcm_qla2xxx_queue_data_in, - .queue_status = tcm_qla2xxx_queue_status, - .queue_tm_rsp = tcm_qla2xxx_queue_tm_rsp, -+ .aborted_task = tcm_qla2xxx_aborted_task, - /* - * Setup function pointers for generic logic in - * target_core_fabric_configfs.c -diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c -index c066e6e298c3..5600eab07865 100644 ---- a/drivers/target/iscsi/iscsi_target.c -+++ b/drivers/target/iscsi/iscsi_target.c -@@ -500,6 +500,18 @@ static int iscsit_queue_rsp(struct iscsi_conn *conn, struct iscsi_cmd *cmd) - return 0; - } - -+static void iscsit_aborted_task(struct iscsi_conn *conn, struct iscsi_cmd *cmd) -+{ -+ bool scsi_cmd = (cmd->iscsi_opcode == ISCSI_OP_SCSI_CMD); -+ -+ spin_lock_bh(&conn->cmd_lock); -+ if (!list_empty(&cmd->i_conn_node)) -+ list_del_init(&cmd->i_conn_node); -+ spin_unlock_bh(&conn->cmd_lock); -+ -+ __iscsit_free_cmd(cmd, scsi_cmd, true); -+} -+ - static struct iscsit_transport iscsi_target_transport = { - .name = "iSCSI/TCP", - .transport_type = ISCSI_TCP, -@@ -514,6 +526,7 @@ static struct iscsit_transport iscsi_target_transport = { - .iscsit_response_queue = iscsit_response_queue, - .iscsit_queue_data_in = iscsit_queue_rsp, - .iscsit_queue_status = iscsit_queue_rsp, -+ .iscsit_aborted_task = iscsit_aborted_task, - }; - - static int __init iscsi_target_init_module(void) -diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c -index 83465617ad6d..4a28c5f0dfd1 100644 ---- a/drivers/target/iscsi/iscsi_target_configfs.c -+++ b/drivers/target/iscsi/iscsi_target_configfs.c -@@ -1815,6 +1815,13 @@ static void lio_queue_tm_rsp(struct se_cmd *se_cmd) - iscsit_add_cmd_to_response_queue(cmd, cmd->conn, cmd->i_state); - } - -+static void lio_aborted_task(struct se_cmd *se_cmd) -+{ -+ struct iscsi_cmd *cmd = container_of(se_cmd, struct iscsi_cmd, se_cmd); -+ -+ cmd->conn->conn_transport->iscsit_aborted_task(cmd->conn, cmd); -+} -+ - static char *lio_tpg_get_endpoint_wwn(struct se_portal_group *se_tpg) - { - struct iscsi_portal_group *tpg = se_tpg->se_tpg_fabric_ptr; -@@ -2013,6 +2020,7 @@ int iscsi_target_register_configfs(void) - fabric->tf_ops.queue_data_in = &lio_queue_data_in; - fabric->tf_ops.queue_status = &lio_queue_status; - fabric->tf_ops.queue_tm_rsp = &lio_queue_tm_rsp; -+ fabric->tf_ops.aborted_task = &lio_aborted_task; - /* - * Setup function pointers for generic logic in target_core_fabric_configfs.c - */ -diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c -index 1e406af4ee47..2e96ae6cf3c1 100644 ---- a/drivers/target/iscsi/iscsi_target_util.c -+++ b/drivers/target/iscsi/iscsi_target_util.c -@@ -705,8 +705,8 @@ void iscsit_release_cmd(struct iscsi_cmd *cmd) - } - EXPORT_SYMBOL(iscsit_release_cmd); - --static void __iscsit_free_cmd(struct iscsi_cmd *cmd, bool scsi_cmd, -- bool check_queues) -+void __iscsit_free_cmd(struct iscsi_cmd *cmd, bool scsi_cmd, -+ bool check_queues) - { - struct iscsi_conn *conn = cmd->conn; - -diff --git a/drivers/target/iscsi/iscsi_target_util.h b/drivers/target/iscsi/iscsi_target_util.h -index 561a424d1980..a68508c4fec8 100644 ---- a/drivers/target/iscsi/iscsi_target_util.h -+++ b/drivers/target/iscsi/iscsi_target_util.h -@@ -30,6 +30,7 @@ extern void iscsit_remove_cmd_from_tx_queues(struct iscsi_cmd *, struct iscsi_co - extern bool iscsit_conn_all_queues_empty(struct iscsi_conn *); - extern void iscsit_free_queue_reqs_for_conn(struct iscsi_conn *); - extern void iscsit_release_cmd(struct iscsi_cmd *); -+extern void __iscsit_free_cmd(struct iscsi_cmd *, bool, bool); - extern void iscsit_free_cmd(struct iscsi_cmd *, bool); - extern int iscsit_check_session_usage_count(struct iscsi_session *); - extern void iscsit_dec_session_usage_count(struct iscsi_session *); -diff --git a/drivers/target/loopback/tcm_loop.c b/drivers/target/loopback/tcm_loop.c -index 67c802c93ef3..fd974d69458b 100644 ---- a/drivers/target/loopback/tcm_loop.c -+++ b/drivers/target/loopback/tcm_loop.c -@@ -892,6 +892,11 @@ static void tcm_loop_queue_tm_rsp(struct se_cmd *se_cmd) - wake_up(&tl_tmr->tl_tmr_wait); - } - -+static void tcm_loop_aborted_task(struct se_cmd *se_cmd) -+{ -+ return; -+} -+ - static char *tcm_loop_dump_proto_id(struct tcm_loop_hba *tl_hba) - { - switch (tl_hba->tl_proto_id) { -@@ -1456,6 +1461,7 @@ static int tcm_loop_register_configfs(void) - fabric->tf_ops.queue_data_in = &tcm_loop_queue_data_in; - fabric->tf_ops.queue_status = &tcm_loop_queue_status; - fabric->tf_ops.queue_tm_rsp = &tcm_loop_queue_tm_rsp; -+ fabric->tf_ops.aborted_task = &tcm_loop_aborted_task; - - /* - * Setup function pointers for generic logic in target_core_fabric_configfs.c -diff --git a/drivers/target/sbp/sbp_target.c b/drivers/target/sbp/sbp_target.c -index 24884cac19ce..ad04ea928e4f 100644 ---- a/drivers/target/sbp/sbp_target.c -+++ b/drivers/target/sbp/sbp_target.c -@@ -1846,6 +1846,11 @@ static void sbp_queue_tm_rsp(struct se_cmd *se_cmd) - { - } - -+static void sbp_aborted_task(struct se_cmd *se_cmd) -+{ -+ return; -+} -+ - static int sbp_check_stop_free(struct se_cmd *se_cmd) - { - struct sbp_target_request *req = container_of(se_cmd, -@@ -2526,6 +2531,7 @@ static struct target_core_fabric_ops sbp_ops = { - .queue_data_in = sbp_queue_data_in, - .queue_status = sbp_queue_status, - .queue_tm_rsp = sbp_queue_tm_rsp, -+ .aborted_task = sbp_aborted_task, - .check_stop_free = sbp_check_stop_free, - - .fabric_make_wwn = sbp_make_tport, -diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c -index f30385385544..756def38c77a 100644 ---- a/drivers/target/target_core_configfs.c -+++ b/drivers/target/target_core_configfs.c -@@ -457,6 +457,10 @@ static int target_fabric_tf_ops_check( - pr_err("Missing tfo->queue_tm_rsp()\n"); - return -EINVAL; - } -+ if (!tfo->aborted_task) { -+ pr_err("Missing tfo->aborted_task()\n"); -+ return -EINVAL; -+ } - /* - * We at least require tfo->fabric_make_wwn(), tfo->fabric_drop_wwn() - * tfo->fabric_make_tpg() and tfo->fabric_drop_tpg() in -diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c -index 093b8cb85de7..e366b812f0e1 100644 ---- a/drivers/target/target_core_device.c -+++ b/drivers/target/target_core_device.c -@@ -1577,6 +1577,49 @@ struct se_device *target_alloc_device(struct se_hba *hba, const char *name) - return dev; - } - -+/* -+ * Check if the underlying struct block_device request_queue supports -+ * the QUEUE_FLAG_DISCARD bit for UNMAP/WRITE_SAME in SCSI + TRIM -+ * in ATA and we need to set TPE=1 -+ */ -+bool target_configure_unmap_from_queue(struct se_dev_attrib *attrib, -+ struct request_queue *q, int block_size) -+{ -+ if (!blk_queue_discard(q)) -+ return false; -+ -+ attrib->max_unmap_lba_count = (q->limits.max_discard_sectors << 9) / -+ block_size; -+ /* -+ * Currently hardcoded to 1 in Linux/SCSI code.. -+ */ -+ attrib->max_unmap_block_desc_count = 1; -+ attrib->unmap_granularity = q->limits.discard_granularity / block_size; -+ attrib->unmap_granularity_alignment = q->limits.discard_alignment / -+ block_size; -+ return true; -+} -+EXPORT_SYMBOL(target_configure_unmap_from_queue); -+ -+/* -+ * Convert from blocksize advertised to the initiator to the 512 byte -+ * units unconditionally used by the Linux block layer. -+ */ -+sector_t target_to_linux_sector(struct se_device *dev, sector_t lb) -+{ -+ switch (dev->dev_attrib.block_size) { -+ case 4096: -+ return lb << 3; -+ case 2048: -+ return lb << 2; -+ case 1024: -+ return lb << 1; -+ default: -+ return lb; -+ } -+} -+EXPORT_SYMBOL(target_to_linux_sector); -+ - int target_configure_device(struct se_device *dev) - { - struct se_hba *hba = dev->se_hba; -diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c -index b199f1e21d0e..6fe5b503f6e1 100644 ---- a/drivers/target/target_core_file.c -+++ b/drivers/target/target_core_file.c -@@ -164,25 +164,11 @@ static int fd_configure_device(struct se_device *dev) - " block_device blocks: %llu logical_block_size: %d\n", - dev_size, div_u64(dev_size, fd_dev->fd_block_size), - fd_dev->fd_block_size); -- /* -- * Check if the underlying struct block_device request_queue supports -- * the QUEUE_FLAG_DISCARD bit for UNMAP/WRITE_SAME in SCSI + TRIM -- * in ATA and we need to set TPE=1 -- */ -- if (blk_queue_discard(q)) { -- dev->dev_attrib.max_unmap_lba_count = -- q->limits.max_discard_sectors; -- /* -- * Currently hardcoded to 1 in Linux/SCSI code.. -- */ -- dev->dev_attrib.max_unmap_block_desc_count = 1; -- dev->dev_attrib.unmap_granularity = -- q->limits.discard_granularity >> 9; -- dev->dev_attrib.unmap_granularity_alignment = -- q->limits.discard_alignment; -+ -+ if (target_configure_unmap_from_queue(&dev->dev_attrib, q, -+ fd_dev->fd_block_size)) - pr_debug("IFILE: BLOCK Discard support available," -- " disabled by default\n"); -- } -+ " disabled by default\n"); - /* - * Enable write same emulation for IBLOCK and use 0xFFFF as - * the smaller WRITE_SAME(10) only has a two-byte block count. -@@ -545,9 +531,12 @@ fd_do_unmap(struct se_cmd *cmd, void *priv, sector_t lba, sector_t nolb) - if (S_ISBLK(inode->i_mode)) { - /* The backend is block device, use discard */ - struct block_device *bdev = inode->i_bdev; -+ struct se_device *dev = cmd->se_dev; - -- ret = blkdev_issue_discard(bdev, lba, -- nolb, GFP_KERNEL, 0); -+ ret = blkdev_issue_discard(bdev, -+ target_to_linux_sector(dev, lba), -+ target_to_linux_sector(dev, nolb), -+ GFP_KERNEL, 0); - if (ret < 0) { - pr_warn("FILEIO: blkdev_issue_discard() failed: %d\n", - ret); -diff --git a/drivers/target/target_core_iblock.c b/drivers/target/target_core_iblock.c -index feefe24a88f7..357b9fb61499 100644 ---- a/drivers/target/target_core_iblock.c -+++ b/drivers/target/target_core_iblock.c -@@ -126,27 +126,11 @@ static int iblock_configure_device(struct se_device *dev) - dev->dev_attrib.hw_max_sectors = queue_max_hw_sectors(q); - dev->dev_attrib.hw_queue_depth = q->nr_requests; - -- /* -- * Check if the underlying struct block_device request_queue supports -- * the QUEUE_FLAG_DISCARD bit for UNMAP/WRITE_SAME in SCSI + TRIM -- * in ATA and we need to set TPE=1 -- */ -- if (blk_queue_discard(q)) { -- dev->dev_attrib.max_unmap_lba_count = -- q->limits.max_discard_sectors; -- -- /* -- * Currently hardcoded to 1 in Linux/SCSI code.. -- */ -- dev->dev_attrib.max_unmap_block_desc_count = 1; -- dev->dev_attrib.unmap_granularity = -- q->limits.discard_granularity >> 9; -- dev->dev_attrib.unmap_granularity_alignment = -- q->limits.discard_alignment; -- -+ if (target_configure_unmap_from_queue(&dev->dev_attrib, q, -+ dev->dev_attrib.hw_block_size)) - pr_debug("IBLOCK: BLOCK Discard support available," -- " disabled by default\n"); -- } -+ " disabled by default\n"); -+ - /* - * Enable write same emulation for IBLOCK and use 0xFFFF as - * the smaller WRITE_SAME(10) only has a two-byte block count. -@@ -418,9 +402,13 @@ iblock_do_unmap(struct se_cmd *cmd, void *priv, - sector_t lba, sector_t nolb) - { - struct block_device *bdev = priv; -+ struct se_device *dev = cmd->se_dev; - int ret; - -- ret = blkdev_issue_discard(bdev, lba, nolb, GFP_KERNEL, 0); -+ ret = blkdev_issue_discard(bdev, -+ target_to_linux_sector(dev, lba), -+ target_to_linux_sector(dev, nolb), -+ GFP_KERNEL, 0); - if (ret < 0) { - pr_err("blkdev_issue_discard() failed: %d\n", ret); - return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE; -@@ -460,8 +448,10 @@ iblock_execute_write_same(struct se_cmd *cmd) - struct scatterlist *sg; - struct bio *bio; - struct bio_list list; -- sector_t block_lba = cmd->t_task_lba; -- sector_t sectors = sbc_get_write_same_sectors(cmd); -+ struct se_device *dev = cmd->se_dev; -+ sector_t block_lba = target_to_linux_sector(dev, cmd->t_task_lba); -+ sector_t sectors = target_to_linux_sector(dev, -+ sbc_get_write_same_sectors(cmd)); - - sg = &cmd->t_data_sg[0]; - -@@ -670,12 +660,12 @@ iblock_execute_rw(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents, - enum dma_data_direction data_direction) - { - struct se_device *dev = cmd->se_dev; -+ sector_t block_lba = target_to_linux_sector(dev, cmd->t_task_lba); - struct iblock_req *ibr; - struct bio *bio, *bio_start; - struct bio_list list; - struct scatterlist *sg; - u32 sg_num = sgl_nents; -- sector_t block_lba; - unsigned bio_cnt; - int rw = 0; - int i; -@@ -701,24 +691,6 @@ iblock_execute_rw(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents, - rw = READ; - } - -- /* -- * Convert the blocksize advertised to the initiator to the 512 byte -- * units unconditionally used by the Linux block layer. -- */ -- if (dev->dev_attrib.block_size == 4096) -- block_lba = (cmd->t_task_lba << 3); -- else if (dev->dev_attrib.block_size == 2048) -- block_lba = (cmd->t_task_lba << 2); -- else if (dev->dev_attrib.block_size == 1024) -- block_lba = (cmd->t_task_lba << 1); -- else if (dev->dev_attrib.block_size == 512) -- block_lba = cmd->t_task_lba; -- else { -- pr_err("Unsupported SCSI -> BLOCK LBA conversion:" -- " %u\n", dev->dev_attrib.block_size); -- return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE; -- } -- - ibr = kzalloc(sizeof(struct iblock_req), GFP_KERNEL); - if (!ibr) - goto fail; -diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c -index 70c638f730af..47a90d631a90 100644 ---- a/drivers/target/target_core_tmr.c -+++ b/drivers/target/target_core_tmr.c -@@ -76,25 +76,29 @@ void core_tmr_release_req( - } - - spin_lock_irqsave(&dev->se_tmr_lock, flags); -- list_del(&tmr->tmr_list); -+ list_del_init(&tmr->tmr_list); - spin_unlock_irqrestore(&dev->se_tmr_lock, flags); - - kfree(tmr); - } - --static void core_tmr_handle_tas_abort( -- struct se_node_acl *tmr_nacl, -- struct se_cmd *cmd, -- int tas) -+static void core_tmr_handle_tas_abort(struct se_cmd *cmd, int tas) - { -+ unsigned long flags; -+ bool remove = true, send_tas; - /* - * TASK ABORTED status (TAS) bit support -- */ -- if ((tmr_nacl && -- (tmr_nacl == cmd->se_sess->se_node_acl)) || tas) -+ */ -+ spin_lock_irqsave(&cmd->t_state_lock, flags); -+ send_tas = (cmd->transport_state & CMD_T_TAS); -+ spin_unlock_irqrestore(&cmd->t_state_lock, flags); -+ -+ if (send_tas) { -+ remove = false; - transport_send_task_abort(cmd); -+ } - -- transport_cmd_finish_abort(cmd, 0); -+ transport_cmd_finish_abort(cmd, remove); - } - - static int target_check_cdb_and_preempt(struct list_head *list, -@@ -112,6 +116,47 @@ static int target_check_cdb_and_preempt(struct list_head *list, - return 1; - } - -+static bool __target_check_io_state(struct se_cmd *se_cmd, -+ struct se_session *tmr_sess, int tas) -+{ -+ struct se_session *sess = se_cmd->se_sess; -+ -+ assert_spin_locked(&sess->sess_cmd_lock); -+ WARN_ON_ONCE(!irqs_disabled()); -+ /* -+ * If command already reached CMD_T_COMPLETE state within -+ * target_complete_cmd() or CMD_T_FABRIC_STOP due to shutdown, -+ * this se_cmd has been passed to fabric driver and will -+ * not be aborted. -+ * -+ * Otherwise, obtain a local se_cmd->cmd_kref now for TMR -+ * ABORT_TASK + LUN_RESET for CMD_T_ABORTED processing as -+ * long as se_cmd->cmd_kref is still active unless zero. -+ */ -+ spin_lock(&se_cmd->t_state_lock); -+ if (se_cmd->transport_state & (CMD_T_COMPLETE | CMD_T_FABRIC_STOP)) { -+ pr_debug("Attempted to abort io tag: %u already complete or" -+ " fabric stop, skipping\n", -+ se_cmd->se_tfo->get_task_tag(se_cmd)); -+ spin_unlock(&se_cmd->t_state_lock); -+ return false; -+ } -+ if (sess->sess_tearing_down || se_cmd->cmd_wait_set) { -+ pr_debug("Attempted to abort io tag: %u already shutdown," -+ " skipping\n", se_cmd->se_tfo->get_task_tag(se_cmd)); -+ spin_unlock(&se_cmd->t_state_lock); -+ return false; -+ } -+ se_cmd->transport_state |= CMD_T_ABORTED; -+ -+ if ((tmr_sess != se_cmd->se_sess) && tas) -+ se_cmd->transport_state |= CMD_T_TAS; -+ -+ spin_unlock(&se_cmd->t_state_lock); -+ -+ return kref_get_unless_zero(&se_cmd->cmd_kref); -+} -+ - void core_tmr_abort_task( - struct se_device *dev, - struct se_tmr_req *tmr, -@@ -134,33 +179,19 @@ void core_tmr_abort_task( - printk("ABORT_TASK: Found referenced %s task_tag: %u\n", - se_cmd->se_tfo->get_fabric_name(), ref_tag); - -- spin_lock(&se_cmd->t_state_lock); -- if (se_cmd->transport_state & CMD_T_COMPLETE) { -- printk("ABORT_TASK: ref_tag: %u already complete, skipping\n", ref_tag); -- spin_unlock(&se_cmd->t_state_lock); -+ if (!__target_check_io_state(se_cmd, se_sess, 0)) { - spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags); -+ target_put_sess_cmd(se_sess, se_cmd); - goto out; - } -- se_cmd->transport_state |= CMD_T_ABORTED; -- spin_unlock(&se_cmd->t_state_lock); - - list_del_init(&se_cmd->se_cmd_list); -- kref_get(&se_cmd->cmd_kref); - spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags); - - cancel_work_sync(&se_cmd->work); - transport_wait_for_tasks(se_cmd); -- /* -- * Now send SAM_STAT_TASK_ABORTED status for the referenced -- * se_cmd descriptor.. -- */ -- transport_send_task_abort(se_cmd); -- /* -- * Also deal with possible extra acknowledge reference.. -- */ -- if (se_cmd->se_cmd_flags & SCF_ACK_KREF) -- target_put_sess_cmd(se_sess, se_cmd); - -+ transport_cmd_finish_abort(se_cmd, true); - target_put_sess_cmd(se_sess, se_cmd); - - printk("ABORT_TASK: Sending TMR_FUNCTION_COMPLETE for" -@@ -182,9 +213,11 @@ static void core_tmr_drain_tmr_list( - struct list_head *preempt_and_abort_list) - { - LIST_HEAD(drain_tmr_list); -+ struct se_session *sess; - struct se_tmr_req *tmr_p, *tmr_pp; - struct se_cmd *cmd; - unsigned long flags; -+ bool rc; - /* - * Release all pending and outgoing TMRs aside from the received - * LUN_RESET tmr.. -@@ -210,17 +243,39 @@ static void core_tmr_drain_tmr_list( - if (target_check_cdb_and_preempt(preempt_and_abort_list, cmd)) - continue; - -+ sess = cmd->se_sess; -+ if (WARN_ON_ONCE(!sess)) -+ continue; -+ -+ spin_lock(&sess->sess_cmd_lock); - spin_lock(&cmd->t_state_lock); -- if (!(cmd->transport_state & CMD_T_ACTIVE)) { -+ if (!(cmd->transport_state & CMD_T_ACTIVE) || -+ (cmd->transport_state & CMD_T_FABRIC_STOP)) { - spin_unlock(&cmd->t_state_lock); -+ spin_unlock(&sess->sess_cmd_lock); - continue; - } - if (cmd->t_state == TRANSPORT_ISTATE_PROCESSING) { - spin_unlock(&cmd->t_state_lock); -+ spin_unlock(&sess->sess_cmd_lock); - continue; - } -+ if (sess->sess_tearing_down || cmd->cmd_wait_set) { -+ spin_unlock(&cmd->t_state_lock); -+ spin_unlock(&sess->sess_cmd_lock); -+ continue; -+ } -+ cmd->transport_state |= CMD_T_ABORTED; - spin_unlock(&cmd->t_state_lock); - -+ rc = kref_get_unless_zero(&cmd->cmd_kref); -+ if (!rc) { -+ printk("LUN_RESET TMR: non-zero kref_get_unless_zero\n"); -+ spin_unlock(&sess->sess_cmd_lock); -+ continue; -+ } -+ spin_unlock(&sess->sess_cmd_lock); -+ - list_move_tail(&tmr_p->tmr_list, &drain_tmr_list); - } - spin_unlock_irqrestore(&dev->se_tmr_lock, flags); -@@ -234,20 +289,26 @@ static void core_tmr_drain_tmr_list( - (preempt_and_abort_list) ? "Preempt" : "", tmr_p, - tmr_p->function, tmr_p->response, cmd->t_state); - -+ cancel_work_sync(&cmd->work); -+ transport_wait_for_tasks(cmd); -+ - transport_cmd_finish_abort(cmd, 1); -+ target_put_sess_cmd(cmd->se_sess, cmd); - } - } - - static void core_tmr_drain_state_list( - struct se_device *dev, - struct se_cmd *prout_cmd, -- struct se_node_acl *tmr_nacl, -+ struct se_session *tmr_sess, - int tas, - struct list_head *preempt_and_abort_list) - { - LIST_HEAD(drain_task_list); -+ struct se_session *sess; - struct se_cmd *cmd, *next; - unsigned long flags; -+ int rc; - - /* - * Complete outstanding commands with TASK_ABORTED SAM status. -@@ -286,6 +347,16 @@ static void core_tmr_drain_state_list( - if (prout_cmd == cmd) - continue; - -+ sess = cmd->se_sess; -+ if (WARN_ON_ONCE(!sess)) -+ continue; -+ -+ spin_lock(&sess->sess_cmd_lock); -+ rc = __target_check_io_state(cmd, tmr_sess, tas); -+ spin_unlock(&sess->sess_cmd_lock); -+ if (!rc) -+ continue; -+ - list_move_tail(&cmd->state_list, &drain_task_list); - cmd->state_active = false; - } -@@ -293,7 +364,7 @@ static void core_tmr_drain_state_list( - - while (!list_empty(&drain_task_list)) { - cmd = list_entry(drain_task_list.next, struct se_cmd, state_list); -- list_del(&cmd->state_list); -+ list_del_init(&cmd->state_list); - - pr_debug("LUN_RESET: %s cmd: %p" - " ITT/CmdSN: 0x%08x/0x%08x, i_state: %d, t_state: %d" -@@ -317,16 +388,11 @@ static void core_tmr_drain_state_list( - * loop above, but we do it down here given that - * cancel_work_sync may block. - */ -- if (cmd->t_state == TRANSPORT_COMPLETE) -- cancel_work_sync(&cmd->work); -- -- spin_lock_irqsave(&cmd->t_state_lock, flags); -- target_stop_cmd(cmd, &flags); -- -- cmd->transport_state |= CMD_T_ABORTED; -- spin_unlock_irqrestore(&cmd->t_state_lock, flags); -+ cancel_work_sync(&cmd->work); -+ transport_wait_for_tasks(cmd); - -- core_tmr_handle_tas_abort(tmr_nacl, cmd, tas); -+ core_tmr_handle_tas_abort(cmd, tas); -+ target_put_sess_cmd(cmd->se_sess, cmd); - } - } - -@@ -338,6 +404,7 @@ int core_tmr_lun_reset( - { - struct se_node_acl *tmr_nacl = NULL; - struct se_portal_group *tmr_tpg = NULL; -+ struct se_session *tmr_sess = NULL; - int tas; - /* - * TASK_ABORTED status bit, this is configurable via ConfigFS -@@ -356,8 +423,9 @@ int core_tmr_lun_reset( - * or struct se_device passthrough.. - */ - if (tmr && tmr->task_cmd && tmr->task_cmd->se_sess) { -- tmr_nacl = tmr->task_cmd->se_sess->se_node_acl; -- tmr_tpg = tmr->task_cmd->se_sess->se_tpg; -+ tmr_sess = tmr->task_cmd->se_sess; -+ tmr_nacl = tmr_sess->se_node_acl; -+ tmr_tpg = tmr_sess->se_tpg; - if (tmr_nacl && tmr_tpg) { - pr_debug("LUN_RESET: TMR caller fabric: %s" - " initiator port %s\n", -@@ -370,7 +438,7 @@ int core_tmr_lun_reset( - dev->transport->name, tas); - - core_tmr_drain_tmr_list(dev, tmr, preempt_and_abort_list); -- core_tmr_drain_state_list(dev, prout_cmd, tmr_nacl, tas, -+ core_tmr_drain_state_list(dev, prout_cmd, tmr_sess, tas, - preempt_and_abort_list); - - /* -diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c -index 7afea9b59e2c..cbf927a67160 100644 ---- a/drivers/target/target_core_transport.c -+++ b/drivers/target/target_core_transport.c -@@ -509,9 +509,6 @@ void transport_deregister_session(struct se_session *se_sess) - } - EXPORT_SYMBOL(transport_deregister_session); - --/* -- * Called with cmd->t_state_lock held. -- */ - static void target_remove_from_state_list(struct se_cmd *cmd) - { - struct se_device *dev = cmd->se_dev; -@@ -536,10 +533,6 @@ static int transport_cmd_check_stop(struct se_cmd *cmd, bool remove_from_lists, - { - unsigned long flags; - -- spin_lock_irqsave(&cmd->t_state_lock, flags); -- if (write_pending) -- cmd->t_state = TRANSPORT_WRITE_PENDING; -- - if (remove_from_lists) { - target_remove_from_state_list(cmd); - -@@ -549,6 +542,10 @@ static int transport_cmd_check_stop(struct se_cmd *cmd, bool remove_from_lists, - cmd->se_lun = NULL; - } - -+ spin_lock_irqsave(&cmd->t_state_lock, flags); -+ if (write_pending) -+ cmd->t_state = TRANSPORT_WRITE_PENDING; -+ - /* - * Determine if frontend context caller is requesting the stopping of - * this command for frontend exceptions. -@@ -603,9 +600,20 @@ static void transport_lun_remove_cmd(struct se_cmd *cmd) - - void transport_cmd_finish_abort(struct se_cmd *cmd, int remove) - { -+ bool ack_kref = (cmd->se_cmd_flags & SCF_ACK_KREF); -+ -+ if (cmd->se_cmd_flags & SCF_SE_LUN_CMD) -+ transport_lun_remove_cmd(cmd); -+ /* -+ * Allow the fabric driver to unmap any resources before -+ * releasing the descriptor via TFO->release_cmd() -+ */ -+ if (remove) -+ cmd->se_tfo->aborted_task(cmd); -+ - if (transport_cmd_check_stop_to_fabric(cmd)) - return; -- if (remove) -+ if (remove && ack_kref) - transport_put_cmd(cmd); - } - -@@ -673,7 +681,7 @@ void target_complete_cmd(struct se_cmd *cmd, u8 scsi_status) - * Check for case where an explicit ABORT_TASK has been received - * and transport_wait_for_tasks() will be waiting for completion.. - */ -- if (cmd->transport_state & CMD_T_ABORTED && -+ if (cmd->transport_state & CMD_T_ABORTED || - cmd->transport_state & CMD_T_STOP) { - spin_unlock_irqrestore(&cmd->t_state_lock, flags); - complete_all(&cmd->t_transport_stop_comp); -@@ -1746,19 +1754,21 @@ static bool target_handle_task_attr(struct se_cmd *cmd) - return true; - } - -+static int __transport_check_aborted_status(struct se_cmd *, int); -+ - void target_execute_cmd(struct se_cmd *cmd) - { - /* -- * If the received CDB has aleady been aborted stop processing it here. -- */ -- if (transport_check_aborted_status(cmd, 1)) -- return; -- -- /* - * Determine if frontend context caller is requesting the stopping of - * this command for frontend exceptions. -+ * -+ * If the received CDB has aleady been aborted stop processing it here. - */ - spin_lock_irq(&cmd->t_state_lock); -+ if (__transport_check_aborted_status(cmd, 1)) { -+ spin_unlock_irq(&cmd->t_state_lock); -+ return; -+ } - if (cmd->transport_state & CMD_T_STOP) { - pr_debug("%s:%d CMD_T_STOP for ITT: 0x%08x\n", - __func__, __LINE__, -@@ -2076,20 +2086,14 @@ static inline void transport_free_pages(struct se_cmd *cmd) - } - - /** -- * transport_release_cmd - free a command -- * @cmd: command to free -+ * transport_put_cmd - release a reference to a command -+ * @cmd: command to release - * -- * This routine unconditionally frees a command, and reference counting -- * or list removal must be done in the caller. -+ * This routine releases our reference to the command and frees it if possible. - */ --static int transport_release_cmd(struct se_cmd *cmd) -+static int transport_put_cmd(struct se_cmd *cmd) - { - BUG_ON(!cmd->se_tfo); -- -- if (cmd->se_cmd_flags & SCF_SCSI_TMR_CDB) -- core_tmr_release_req(cmd->se_tmr_req); -- if (cmd->t_task_cdb != cmd->__t_task_cdb) -- kfree(cmd->t_task_cdb); - /* - * If this cmd has been setup with target_get_sess_cmd(), drop - * the kref and call ->release_cmd() in kref callback. -@@ -2097,18 +2101,6 @@ static int transport_release_cmd(struct se_cmd *cmd) - return target_put_sess_cmd(cmd->se_sess, cmd); - } - --/** -- * transport_put_cmd - release a reference to a command -- * @cmd: command to release -- * -- * This routine releases our reference to the command and frees it if possible. -- */ --static int transport_put_cmd(struct se_cmd *cmd) --{ -- transport_free_pages(cmd); -- return transport_release_cmd(cmd); --} -- - void *transport_kmap_data_sg(struct se_cmd *cmd) - { - struct scatterlist *sg = cmd->t_data_sg; -@@ -2296,34 +2288,59 @@ static void transport_write_pending_qf(struct se_cmd *cmd) - } - } - --int transport_generic_free_cmd(struct se_cmd *cmd, int wait_for_tasks) -+static bool -+__transport_wait_for_tasks(struct se_cmd *, bool, bool *, bool *, -+ unsigned long *flags); -+ -+static void target_wait_free_cmd(struct se_cmd *cmd, bool *aborted, bool *tas) - { - unsigned long flags; -+ -+ spin_lock_irqsave(&cmd->t_state_lock, flags); -+ __transport_wait_for_tasks(cmd, true, aborted, tas, &flags); -+ spin_unlock_irqrestore(&cmd->t_state_lock, flags); -+} -+ -+int transport_generic_free_cmd(struct se_cmd *cmd, int wait_for_tasks) -+{ - int ret = 0; -+ bool aborted = false, tas = false; - - if (!(cmd->se_cmd_flags & SCF_SE_LUN_CMD)) { - if (wait_for_tasks && (cmd->se_cmd_flags & SCF_SCSI_TMR_CDB)) -- transport_wait_for_tasks(cmd); -+ target_wait_free_cmd(cmd, &aborted, &tas); - -- ret = transport_release_cmd(cmd); -+ if (!aborted || tas) -+ ret = transport_put_cmd(cmd); - } else { - if (wait_for_tasks) -- transport_wait_for_tasks(cmd); -+ target_wait_free_cmd(cmd, &aborted, &tas); - /* - * Handle WRITE failure case where transport_generic_new_cmd() - * has already added se_cmd to state_list, but fabric has - * failed command before I/O submission. - */ -- if (cmd->state_active) { -- spin_lock_irqsave(&cmd->t_state_lock, flags); -+ if (cmd->state_active) - target_remove_from_state_list(cmd); -- spin_unlock_irqrestore(&cmd->t_state_lock, flags); -- } - - if (cmd->se_lun) - transport_lun_remove_cmd(cmd); - -- ret = transport_put_cmd(cmd); -+ if (!aborted || tas) -+ ret = transport_put_cmd(cmd); -+ } -+ /* -+ * If the task has been internally aborted due to TMR ABORT_TASK -+ * or LUN_RESET, target_core_tmr.c is responsible for performing -+ * the remaining calls to target_put_sess_cmd(), and not the -+ * callers of this function. -+ */ -+ if (aborted) { -+ pr_debug("Detected CMD_T_ABORTED for ITT: %u\n", -+ cmd->se_tfo->get_task_tag(cmd)); -+ wait_for_completion(&cmd->cmd_wait_comp); -+ cmd->se_tfo->release_cmd(cmd); -+ ret = 1; - } - return ret; - } -@@ -2366,24 +2383,44 @@ out: - } - EXPORT_SYMBOL(target_get_sess_cmd); - -+static void target_free_cmd_mem(struct se_cmd *cmd) -+{ -+ transport_free_pages(cmd); -+ -+ if (cmd->se_cmd_flags & SCF_SCSI_TMR_CDB) -+ core_tmr_release_req(cmd->se_tmr_req); -+ if (cmd->t_task_cdb != cmd->__t_task_cdb) -+ kfree(cmd->t_task_cdb); -+} -+ - static void target_release_cmd_kref(struct kref *kref) - { - struct se_cmd *se_cmd = container_of(kref, struct se_cmd, cmd_kref); - struct se_session *se_sess = se_cmd->se_sess; -+ bool fabric_stop; - - if (list_empty(&se_cmd->se_cmd_list)) { - spin_unlock(&se_sess->sess_cmd_lock); -+ target_free_cmd_mem(se_cmd); - se_cmd->se_tfo->release_cmd(se_cmd); - return; - } -- if (se_sess->sess_tearing_down && se_cmd->cmd_wait_set) { -+ -+ spin_lock(&se_cmd->t_state_lock); -+ fabric_stop = (se_cmd->transport_state & CMD_T_FABRIC_STOP); -+ spin_unlock(&se_cmd->t_state_lock); -+ -+ if (se_cmd->cmd_wait_set || fabric_stop) { -+ list_del_init(&se_cmd->se_cmd_list); - spin_unlock(&se_sess->sess_cmd_lock); -+ target_free_cmd_mem(se_cmd); - complete(&se_cmd->cmd_wait_comp); - return; - } -- list_del(&se_cmd->se_cmd_list); -+ list_del_init(&se_cmd->se_cmd_list); - spin_unlock(&se_sess->sess_cmd_lock); - -+ target_free_cmd_mem(se_cmd); - se_cmd->se_tfo->release_cmd(se_cmd); - } - -@@ -2394,6 +2431,7 @@ static void target_release_cmd_kref(struct kref *kref) - int target_put_sess_cmd(struct se_session *se_sess, struct se_cmd *se_cmd) - { - if (!se_sess) { -+ target_free_cmd_mem(se_cmd); - se_cmd->se_tfo->release_cmd(se_cmd); - return 1; - } -@@ -2411,6 +2449,7 @@ void target_sess_cmd_list_set_waiting(struct se_session *se_sess) - { - struct se_cmd *se_cmd; - unsigned long flags; -+ int rc; - - spin_lock_irqsave(&se_sess->sess_cmd_lock, flags); - if (se_sess->sess_tearing_down) { -@@ -2420,8 +2459,15 @@ void target_sess_cmd_list_set_waiting(struct se_session *se_sess) - se_sess->sess_tearing_down = 1; - list_splice_init(&se_sess->sess_cmd_list, &se_sess->sess_wait_list); - -- list_for_each_entry(se_cmd, &se_sess->sess_wait_list, se_cmd_list) -- se_cmd->cmd_wait_set = 1; -+ list_for_each_entry(se_cmd, &se_sess->sess_wait_list, se_cmd_list) { -+ rc = kref_get_unless_zero(&se_cmd->cmd_kref); -+ if (rc) { -+ se_cmd->cmd_wait_set = 1; -+ spin_lock(&se_cmd->t_state_lock); -+ se_cmd->transport_state |= CMD_T_FABRIC_STOP; -+ spin_unlock(&se_cmd->t_state_lock); -+ } -+ } - - spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags); - } -@@ -2434,15 +2480,25 @@ void target_wait_for_sess_cmds(struct se_session *se_sess) - { - struct se_cmd *se_cmd, *tmp_cmd; - unsigned long flags; -+ bool tas; - - list_for_each_entry_safe(se_cmd, tmp_cmd, - &se_sess->sess_wait_list, se_cmd_list) { -- list_del(&se_cmd->se_cmd_list); -+ list_del_init(&se_cmd->se_cmd_list); - - pr_debug("Waiting for se_cmd: %p t_state: %d, fabric state:" - " %d\n", se_cmd, se_cmd->t_state, - se_cmd->se_tfo->get_cmd_state(se_cmd)); - -+ spin_lock_irqsave(&se_cmd->t_state_lock, flags); -+ tas = (se_cmd->transport_state & CMD_T_TAS); -+ spin_unlock_irqrestore(&se_cmd->t_state_lock, flags); -+ -+ if (!target_put_sess_cmd(se_sess, se_cmd)) { -+ if (tas) -+ target_put_sess_cmd(se_sess, se_cmd); -+ } -+ - wait_for_completion(&se_cmd->cmd_wait_comp); - pr_debug("After cmd_wait_comp: se_cmd: %p t_state: %d" - " fabric state: %d\n", se_cmd, se_cmd->t_state, -@@ -2485,34 +2541,38 @@ int transport_clear_lun_ref(struct se_lun *lun) - return 0; - } - --/** -- * transport_wait_for_tasks - wait for completion to occur -- * @cmd: command to wait -- * -- * Called from frontend fabric context to wait for storage engine -- * to pause and/or release frontend generated struct se_cmd. -- */ --bool transport_wait_for_tasks(struct se_cmd *cmd) -+static bool -+__transport_wait_for_tasks(struct se_cmd *cmd, bool fabric_stop, -+ bool *aborted, bool *tas, unsigned long *flags) -+ __releases(&cmd->t_state_lock) -+ __acquires(&cmd->t_state_lock) - { -- unsigned long flags; - -- spin_lock_irqsave(&cmd->t_state_lock, flags); -+ assert_spin_locked(&cmd->t_state_lock); -+ WARN_ON_ONCE(!irqs_disabled()); -+ -+ if (fabric_stop) -+ cmd->transport_state |= CMD_T_FABRIC_STOP; -+ -+ if (cmd->transport_state & CMD_T_ABORTED) -+ *aborted = true; -+ -+ if (cmd->transport_state & CMD_T_TAS) -+ *tas = true; -+ - if (!(cmd->se_cmd_flags & SCF_SE_LUN_CMD) && -- !(cmd->se_cmd_flags & SCF_SCSI_TMR_CDB)) { -- spin_unlock_irqrestore(&cmd->t_state_lock, flags); -+ !(cmd->se_cmd_flags & SCF_SCSI_TMR_CDB)) - return false; -- } - - if (!(cmd->se_cmd_flags & SCF_SUPPORTED_SAM_OPCODE) && -- !(cmd->se_cmd_flags & SCF_SCSI_TMR_CDB)) { -- spin_unlock_irqrestore(&cmd->t_state_lock, flags); -+ !(cmd->se_cmd_flags & SCF_SCSI_TMR_CDB)) - return false; -- } - -- if (!(cmd->transport_state & CMD_T_ACTIVE)) { -- spin_unlock_irqrestore(&cmd->t_state_lock, flags); -+ if (!(cmd->transport_state & CMD_T_ACTIVE)) -+ return false; -+ -+ if (fabric_stop && *aborted) - return false; -- } - - cmd->transport_state |= CMD_T_STOP; - -@@ -2521,20 +2581,37 @@ bool transport_wait_for_tasks(struct se_cmd *cmd) - cmd, cmd->se_tfo->get_task_tag(cmd), - cmd->se_tfo->get_cmd_state(cmd), cmd->t_state); - -- spin_unlock_irqrestore(&cmd->t_state_lock, flags); -+ spin_unlock_irqrestore(&cmd->t_state_lock, *flags); - - wait_for_completion(&cmd->t_transport_stop_comp); - -- spin_lock_irqsave(&cmd->t_state_lock, flags); -+ spin_lock_irqsave(&cmd->t_state_lock, *flags); - cmd->transport_state &= ~(CMD_T_ACTIVE | CMD_T_STOP); - - pr_debug("wait_for_tasks: Stopped wait_for_completion(" - "&cmd->t_transport_stop_comp) for ITT: 0x%08x\n", - cmd->se_tfo->get_task_tag(cmd)); - -+ return true; -+} -+ -+/** -+ * transport_wait_for_tasks - wait for completion to occur -+ * @cmd: command to wait -+ * -+ * Called from frontend fabric context to wait for storage engine -+ * to pause and/or release frontend generated struct se_cmd. -+ */ -+bool transport_wait_for_tasks(struct se_cmd *cmd) -+{ -+ unsigned long flags; -+ bool ret, aborted = false, tas = false; -+ -+ spin_lock_irqsave(&cmd->t_state_lock, flags); -+ ret = __transport_wait_for_tasks(cmd, false, &aborted, &tas, &flags); - spin_unlock_irqrestore(&cmd->t_state_lock, flags); - -- return true; -+ return ret; - } - EXPORT_SYMBOL(transport_wait_for_tasks); - -@@ -2820,24 +2897,51 @@ after_reason: - } - EXPORT_SYMBOL(transport_send_check_condition_and_sense); - --int transport_check_aborted_status(struct se_cmd *cmd, int send_status) -+static int __transport_check_aborted_status(struct se_cmd *cmd, int send_status) -+ __releases(&cmd->t_state_lock) -+ __acquires(&cmd->t_state_lock) - { -+ assert_spin_locked(&cmd->t_state_lock); -+ WARN_ON_ONCE(!irqs_disabled()); -+ - if (!(cmd->transport_state & CMD_T_ABORTED)) - return 0; - -- if (!send_status || (cmd->se_cmd_flags & SCF_SENT_DELAYED_TAS)) -+ /* -+ * If cmd has been aborted but either no status is to be sent or it has -+ * already been sent, just return -+ */ -+ if (!send_status || !(cmd->se_cmd_flags & SCF_SEND_DELAYED_TAS)) { -+ if (send_status) -+ cmd->se_cmd_flags |= SCF_SEND_DELAYED_TAS; - return 1; -+ } - -- pr_debug("Sending delayed SAM_STAT_TASK_ABORTED status for CDB: 0x%02x ITT: 0x%08x\n", -- cmd->t_task_cdb[0], cmd->se_tfo->get_task_tag(cmd)); -+ pr_debug("Sending delayed SAM_STAT_TASK_ABORTED status for CDB:" -+ " 0x%02x ITT: 0x%08x\n", cmd->t_task_cdb[0], -+ cmd->se_tfo->get_task_tag(cmd)); - -- cmd->se_cmd_flags |= SCF_SENT_DELAYED_TAS; -+ cmd->se_cmd_flags &= ~SCF_SEND_DELAYED_TAS; - cmd->scsi_status = SAM_STAT_TASK_ABORTED; - trace_target_cmd_complete(cmd); -+ -+ spin_unlock_irq(&cmd->t_state_lock); - cmd->se_tfo->queue_status(cmd); -+ spin_lock_irq(&cmd->t_state_lock); - - return 1; - } -+ -+int transport_check_aborted_status(struct se_cmd *cmd, int send_status) -+{ -+ int ret; -+ -+ spin_lock_irq(&cmd->t_state_lock); -+ ret = __transport_check_aborted_status(cmd, send_status); -+ spin_unlock_irq(&cmd->t_state_lock); -+ -+ return ret; -+} - EXPORT_SYMBOL(transport_check_aborted_status); - - void transport_send_task_abort(struct se_cmd *cmd) -@@ -2845,7 +2949,7 @@ void transport_send_task_abort(struct se_cmd *cmd) - unsigned long flags; - - spin_lock_irqsave(&cmd->t_state_lock, flags); -- if (cmd->se_cmd_flags & (SCF_SENT_CHECK_CONDITION | SCF_SENT_DELAYED_TAS)) { -+ if (cmd->se_cmd_flags & (SCF_SENT_CHECK_CONDITION)) { - spin_unlock_irqrestore(&cmd->t_state_lock, flags); - return; - } -@@ -2859,11 +2963,17 @@ void transport_send_task_abort(struct se_cmd *cmd) - */ - if (cmd->data_direction == DMA_TO_DEVICE) { - if (cmd->se_tfo->write_pending_status(cmd) != 0) { -- cmd->transport_state |= CMD_T_ABORTED; -- smp_mb__after_atomic_inc(); -+ spin_lock_irqsave(&cmd->t_state_lock, flags); -+ if (cmd->se_cmd_flags & SCF_SEND_DELAYED_TAS) { -+ spin_unlock_irqrestore(&cmd->t_state_lock, flags); -+ goto send_abort; -+ } -+ cmd->se_cmd_flags |= SCF_SEND_DELAYED_TAS; -+ spin_unlock_irqrestore(&cmd->t_state_lock, flags); - return; - } - } -+send_abort: - cmd->scsi_status = SAM_STAT_TASK_ABORTED; - - transport_lun_remove_cmd(cmd); -@@ -2881,8 +2991,17 @@ static void target_tmr_work(struct work_struct *work) - struct se_cmd *cmd = container_of(work, struct se_cmd, work); - struct se_device *dev = cmd->se_dev; - struct se_tmr_req *tmr = cmd->se_tmr_req; -+ unsigned long flags; - int ret; - -+ spin_lock_irqsave(&cmd->t_state_lock, flags); -+ if (cmd->transport_state & CMD_T_ABORTED) { -+ tmr->response = TMR_FUNCTION_REJECTED; -+ spin_unlock_irqrestore(&cmd->t_state_lock, flags); -+ goto check_stop; -+ } -+ spin_unlock_irqrestore(&cmd->t_state_lock, flags); -+ - switch (tmr->function) { - case TMR_ABORT_TASK: - core_tmr_abort_task(dev, tmr, cmd->se_sess); -@@ -2910,9 +3029,17 @@ static void target_tmr_work(struct work_struct *work) - break; - } - -+ spin_lock_irqsave(&cmd->t_state_lock, flags); -+ if (cmd->transport_state & CMD_T_ABORTED) { -+ spin_unlock_irqrestore(&cmd->t_state_lock, flags); -+ goto check_stop; -+ } - cmd->t_state = TRANSPORT_ISTATE_PROCESSING; -+ spin_unlock_irqrestore(&cmd->t_state_lock, flags); -+ - cmd->se_tfo->queue_tm_rsp(cmd); - -+check_stop: - transport_cmd_check_stop_to_fabric(cmd); - } - -diff --git a/drivers/target/tcm_fc/tcm_fc.h b/drivers/target/tcm_fc/tcm_fc.h -index 752863acecb8..4f4b97161228 100644 ---- a/drivers/target/tcm_fc/tcm_fc.h -+++ b/drivers/target/tcm_fc/tcm_fc.h -@@ -163,6 +163,7 @@ int ft_write_pending_status(struct se_cmd *); - u32 ft_get_task_tag(struct se_cmd *); - int ft_get_cmd_state(struct se_cmd *); - void ft_queue_tm_resp(struct se_cmd *); -+void ft_aborted_task(struct se_cmd *); - - /* - * other internal functions. -diff --git a/drivers/target/tcm_fc/tfc_cmd.c b/drivers/target/tcm_fc/tfc_cmd.c -index d22cdc77e9d4..f5fd515b2bee 100644 ---- a/drivers/target/tcm_fc/tfc_cmd.c -+++ b/drivers/target/tcm_fc/tfc_cmd.c -@@ -426,6 +426,11 @@ void ft_queue_tm_resp(struct se_cmd *se_cmd) - ft_send_resp_code(cmd, code); - } - -+void ft_aborted_task(struct se_cmd *se_cmd) -+{ -+ return; -+} -+ - static void ft_send_work(struct work_struct *work); - - /* -diff --git a/drivers/target/tcm_fc/tfc_conf.c b/drivers/target/tcm_fc/tfc_conf.c -index e879da81ad93..b8b5a719a784 100644 ---- a/drivers/target/tcm_fc/tfc_conf.c -+++ b/drivers/target/tcm_fc/tfc_conf.c -@@ -536,6 +536,7 @@ static struct target_core_fabric_ops ft_fabric_ops = { - .queue_data_in = ft_queue_data_in, - .queue_status = ft_queue_status, - .queue_tm_rsp = ft_queue_tm_resp, -+ .aborted_task = ft_aborted_task, - /* - * Setup function pointers for generic logic in - * target_core_fabric_configfs.c -diff --git a/drivers/usb/gadget/tcm_usb_gadget.c b/drivers/usb/gadget/tcm_usb_gadget.c -index 460c266b8e24..cdec2492ff40 100644 ---- a/drivers/usb/gadget/tcm_usb_gadget.c -+++ b/drivers/usb/gadget/tcm_usb_gadget.c -@@ -1471,6 +1471,11 @@ static void usbg_queue_tm_rsp(struct se_cmd *se_cmd) - { - } - -+static void usbg_aborted_task(struct se_cmd *se_cmd) -+{ -+ return; -+} -+ - static const char *usbg_check_wwn(const char *name) - { - const char *n; -@@ -1897,6 +1902,7 @@ static struct target_core_fabric_ops usbg_ops = { - .queue_data_in = usbg_send_read_response, - .queue_status = usbg_send_status_response, - .queue_tm_rsp = usbg_queue_tm_rsp, -+ .aborted_task = usbg_aborted_task, - .check_stop_free = usbg_check_stop_free, - - .fabric_make_wwn = usbg_make_tport, -diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c -index 21bf168981f9..922723edd6b0 100644 ---- a/drivers/usb/serial/cp210x.c -+++ b/drivers/usb/serial/cp210x.c -@@ -164,6 +164,7 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(0x18EF, 0xE025) }, /* ELV Marble Sound Board 1 */ - { USB_DEVICE(0x1901, 0x0190) }, /* GE B850 CP2105 Recorder interface */ - { USB_DEVICE(0x1901, 0x0193) }, /* GE B650 CP2104 PMC interface */ -+ { USB_DEVICE(0x19CF, 0x3000) }, /* Parrot NMEA GPS Flight Recorder */ - { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */ - { USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */ - { USB_DEVICE(0x1BA4, 0x0002) }, /* Silicon Labs 358x factory default */ -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index 9bab34cf01d4..24366a2afea6 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -271,6 +271,7 @@ static void option_instat_callback(struct urb *urb); - #define TELIT_PRODUCT_UE910_V2 0x1012 - #define TELIT_PRODUCT_LE922_USBCFG0 0x1042 - #define TELIT_PRODUCT_LE922_USBCFG3 0x1043 -+#define TELIT_PRODUCT_LE922_USBCFG5 0x1045 - #define TELIT_PRODUCT_LE920 0x1200 - #define TELIT_PRODUCT_LE910 0x1201 - -@@ -1140,6 +1141,8 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */ - { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */ - { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */ -+ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9003), /* Quectel UC20 */ -+ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, - { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) }, - { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) }, - { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6003), -@@ -1191,6 +1194,8 @@ static const struct usb_device_id option_ids[] = { - .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG3), - .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG5, 0xff), -+ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910), - .driver_info = (kernel_ulong_t)&telit_le910_blacklist }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920), -diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c -index 6aeea1936aea..8f48f2bf34d4 100644 ---- a/drivers/vhost/scsi.c -+++ b/drivers/vhost/scsi.c -@@ -539,6 +539,11 @@ static void tcm_vhost_queue_tm_rsp(struct se_cmd *se_cmd) - return; - } - -+static void tcm_vhost_aborted_task(struct se_cmd *se_cmd) -+{ -+ return; -+} -+ - static void tcm_vhost_free_evt(struct vhost_scsi *vs, struct tcm_vhost_evt *evt) - { - vs->vs_events_nr--; -@@ -2173,6 +2178,7 @@ static struct target_core_fabric_ops tcm_vhost_ops = { - .queue_data_in = tcm_vhost_queue_data_in, - .queue_status = tcm_vhost_queue_status, - .queue_tm_rsp = tcm_vhost_queue_tm_rsp, -+ .aborted_task = tcm_vhost_aborted_task, - /* - * Setup callers for generic logic in target_core_fabric_configfs.c - */ -diff --git a/fs/bio.c b/fs/bio.c -index b2b1451912b5..6d8cf434bf94 100644 ---- a/fs/bio.c -+++ b/fs/bio.c -@@ -1096,9 +1096,12 @@ int bio_uncopy_user(struct bio *bio) - ret = __bio_copy_iov(bio, bmd->sgvecs, bmd->nr_sgvecs, - bio_data_dir(bio) == READ, - 0, bmd->is_our_pages); -- else if (bmd->is_our_pages) -- bio_for_each_segment_all(bvec, bio, i) -- __free_page(bvec->bv_page); -+ else { -+ ret = -EINTR; -+ if (bmd->is_our_pages) -+ bio_for_each_segment_all(bvec, bio, i) -+ __free_page(bvec->bv_page); -+ } - } - kfree(bmd); - bio_put(bio); -diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c -index f3264bd7a83d..3f709ab0223b 100644 ---- a/fs/cifs/cifssmb.c -+++ b/fs/cifs/cifssmb.c -@@ -1399,11 +1399,10 @@ openRetry: - * current bigbuf. - */ - static int --cifs_readv_discard(struct TCP_Server_Info *server, struct mid_q_entry *mid) -+discard_remaining_data(struct TCP_Server_Info *server) - { - unsigned int rfclen = get_rfc1002_length(server->smallbuf); - int remaining = rfclen + 4 - server->total_read; -- struct cifs_readdata *rdata = mid->callback_data; - - while (remaining > 0) { - int length; -@@ -1417,10 +1416,20 @@ cifs_readv_discard(struct TCP_Server_Info *server, struct mid_q_entry *mid) - remaining -= length; - } - -- dequeue_mid(mid, rdata->result); - return 0; - } - -+static int -+cifs_readv_discard(struct TCP_Server_Info *server, struct mid_q_entry *mid) -+{ -+ int length; -+ struct cifs_readdata *rdata = mid->callback_data; -+ -+ length = discard_remaining_data(server); -+ dequeue_mid(mid, rdata->result); -+ return length; -+} -+ - int - cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid) - { -@@ -1449,6 +1458,12 @@ cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid) - return length; - server->total_read += length; - -+ if (server->ops->is_status_pending && -+ server->ops->is_status_pending(buf, server, 0)) { -+ discard_remaining_data(server); -+ return -1; -+ } -+ - /* Was the SMB read successful? */ - rdata->result = server->ops->map_error(buf, false); - if (rdata->result != 0) { -diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c -index 348792911e1f..ae375dff03da 100644 ---- a/fs/cifs/smb2pdu.c -+++ b/fs/cifs/smb2pdu.c -@@ -1004,21 +1004,25 @@ parse_lease_state(struct TCP_Server_Info *server, struct smb2_create_rsp *rsp, - { - char *data_offset; - struct create_context *cc; -- unsigned int next = 0; -+ unsigned int next; -+ unsigned int remaining; - char *name; - - data_offset = (char *)rsp + 4 + le32_to_cpu(rsp->CreateContextsOffset); -+ remaining = le32_to_cpu(rsp->CreateContextsLength); - cc = (struct create_context *)data_offset; -- do { -- cc = (struct create_context *)((char *)cc + next); -+ while (remaining >= sizeof(struct create_context)) { - name = le16_to_cpu(cc->NameOffset) + (char *)cc; -- if (le16_to_cpu(cc->NameLength) != 4 || -- strncmp(name, "RqLs", 4)) { -- next = le32_to_cpu(cc->Next); -- continue; -- } -- return server->ops->parse_lease_buf(cc, epoch); -- } while (next != 0); -+ if (le16_to_cpu(cc->NameLength) == 4 && -+ strncmp(name, "RqLs", 4) == 0) -+ return server->ops->parse_lease_buf(cc, epoch); -+ -+ next = le32_to_cpu(cc->Next); -+ if (!next) -+ break; -+ remaining -= next; -+ cc = (struct create_context *)((char *)cc + next); -+ } - - return 0; - } -diff --git a/fs/jffs2/README.Locking b/fs/jffs2/README.Locking -index 3ea36554107f..8918ac905a3b 100644 ---- a/fs/jffs2/README.Locking -+++ b/fs/jffs2/README.Locking -@@ -2,10 +2,6 @@ - JFFS2 LOCKING DOCUMENTATION - --------------------------- - --At least theoretically, JFFS2 does not require the Big Kernel Lock --(BKL), which was always helpfully obtained for it by Linux 2.4 VFS --code. It has its own locking, as described below. -- - This document attempts to describe the existing locking rules for - JFFS2. It is not expected to remain perfectly up to date, but ought to - be fairly close. -@@ -69,6 +65,7 @@ Ordering constraints: - any f->sem held. - 2. Never attempt to lock two file mutexes in one thread. - No ordering rules have been made for doing so. -+ 3. Never lock a page cache page with f->sem held. - - - erase_completion_lock spinlock -diff --git a/fs/jffs2/build.c b/fs/jffs2/build.c -index a3750f902adc..c1f04947d7dc 100644 ---- a/fs/jffs2/build.c -+++ b/fs/jffs2/build.c -@@ -49,7 +49,8 @@ next_inode(int *i, struct jffs2_inode_cache *ic, struct jffs2_sb_info *c) - - - static void jffs2_build_inode_pass1(struct jffs2_sb_info *c, -- struct jffs2_inode_cache *ic) -+ struct jffs2_inode_cache *ic, -+ int *dir_hardlinks) - { - struct jffs2_full_dirent *fd; - -@@ -68,19 +69,21 @@ static void jffs2_build_inode_pass1(struct jffs2_sb_info *c, - dbg_fsbuild("child \"%s\" (ino #%u) of dir ino #%u doesn't exist!\n", - fd->name, fd->ino, ic->ino); - jffs2_mark_node_obsolete(c, fd->raw); -+ /* Clear the ic/raw union so it doesn't cause problems later. */ -+ fd->ic = NULL; - continue; - } - -+ /* From this point, fd->raw is no longer used so we can set fd->ic */ -+ fd->ic = child_ic; -+ child_ic->pino_nlink++; -+ /* If we appear (at this stage) to have hard-linked directories, -+ * set a flag to trigger a scan later */ - if (fd->type == DT_DIR) { -- if (child_ic->pino_nlink) { -- JFFS2_ERROR("child dir \"%s\" (ino #%u) of dir ino #%u appears to be a hard link\n", -- fd->name, fd->ino, ic->ino); -- /* TODO: What do we do about it? */ -- } else { -- child_ic->pino_nlink = ic->ino; -- } -- } else -- child_ic->pino_nlink++; -+ child_ic->flags |= INO_FLAGS_IS_DIR; -+ if (child_ic->pino_nlink > 1) -+ *dir_hardlinks = 1; -+ } - - dbg_fsbuild("increased nlink for child \"%s\" (ino #%u)\n", fd->name, fd->ino); - /* Can't free scan_dents so far. We might need them in pass 2 */ -@@ -94,8 +97,7 @@ static void jffs2_build_inode_pass1(struct jffs2_sb_info *c, - */ - static int jffs2_build_filesystem(struct jffs2_sb_info *c) - { -- int ret; -- int i; -+ int ret, i, dir_hardlinks = 0; - struct jffs2_inode_cache *ic; - struct jffs2_full_dirent *fd; - struct jffs2_full_dirent *dead_fds = NULL; -@@ -119,7 +121,7 @@ static int jffs2_build_filesystem(struct jffs2_sb_info *c) - /* Now scan the directory tree, increasing nlink according to every dirent found. */ - for_each_inode(i, c, ic) { - if (ic->scan_dents) { -- jffs2_build_inode_pass1(c, ic); -+ jffs2_build_inode_pass1(c, ic, &dir_hardlinks); - cond_resched(); - } - } -@@ -155,6 +157,20 @@ static int jffs2_build_filesystem(struct jffs2_sb_info *c) - } - - dbg_fsbuild("pass 2a complete\n"); -+ -+ if (dir_hardlinks) { -+ /* If we detected directory hardlinks earlier, *hopefully* -+ * they are gone now because some of the links were from -+ * dead directories which still had some old dirents lying -+ * around and not yet garbage-collected, but which have -+ * been discarded above. So clear the pino_nlink field -+ * in each directory, so that the final scan below can -+ * print appropriate warnings. */ -+ for_each_inode(i, c, ic) { -+ if (ic->flags & INO_FLAGS_IS_DIR) -+ ic->pino_nlink = 0; -+ } -+ } - dbg_fsbuild("freeing temporary data structures\n"); - - /* Finally, we can scan again and free the dirent structs */ -@@ -162,6 +178,33 @@ static int jffs2_build_filesystem(struct jffs2_sb_info *c) - while(ic->scan_dents) { - fd = ic->scan_dents; - ic->scan_dents = fd->next; -+ /* We do use the pino_nlink field to count nlink of -+ * directories during fs build, so set it to the -+ * parent ino# now. Now that there's hopefully only -+ * one. */ -+ if (fd->type == DT_DIR) { -+ if (!fd->ic) { -+ /* We'll have complained about it and marked the coresponding -+ raw node obsolete already. Just skip it. */ -+ continue; -+ } -+ -+ /* We *have* to have set this in jffs2_build_inode_pass1() */ -+ BUG_ON(!(fd->ic->flags & INO_FLAGS_IS_DIR)); -+ -+ /* We clear ic->pino_nlink ∀ directories' ic *only* if dir_hardlinks -+ * is set. Otherwise, we know this should never trigger anyway, so -+ * we don't do the check. And ic->pino_nlink still contains the nlink -+ * value (which is 1). */ -+ if (dir_hardlinks && fd->ic->pino_nlink) { -+ JFFS2_ERROR("child dir \"%s\" (ino #%u) of dir ino #%u is also hard linked from dir ino #%u\n", -+ fd->name, fd->ino, ic->ino, fd->ic->pino_nlink); -+ /* Should we unlink it from its previous parent? */ -+ } -+ -+ /* For directories, ic->pino_nlink holds that parent inode # */ -+ fd->ic->pino_nlink = ic->ino; -+ } - jffs2_free_full_dirent(fd); - } - ic->scan_dents = NULL; -@@ -240,11 +283,7 @@ static void jffs2_build_remove_unlinked_inode(struct jffs2_sb_info *c, - - /* Reduce nlink of the child. If it's now zero, stick it on the - dead_fds list to be cleaned up later. Else just free the fd */ -- -- if (fd->type == DT_DIR) -- child_ic->pino_nlink = 0; -- else -- child_ic->pino_nlink--; -+ child_ic->pino_nlink--; - - if (!child_ic->pino_nlink) { - dbg_fsbuild("inode #%u (\"%s\") now has no links; adding to dead_fds list.\n", -diff --git a/fs/jffs2/file.c b/fs/jffs2/file.c -index 256cd19a3b78..d2570ae2e998 100644 ---- a/fs/jffs2/file.c -+++ b/fs/jffs2/file.c -@@ -139,39 +139,33 @@ static int jffs2_write_begin(struct file *filp, struct address_space *mapping, - struct page *pg; - struct inode *inode = mapping->host; - struct jffs2_inode_info *f = JFFS2_INODE_INFO(inode); -- struct jffs2_sb_info *c = JFFS2_SB_INFO(inode->i_sb); -- struct jffs2_raw_inode ri; -- uint32_t alloc_len = 0; - pgoff_t index = pos >> PAGE_CACHE_SHIFT; - uint32_t pageofs = index << PAGE_CACHE_SHIFT; - int ret = 0; - -- jffs2_dbg(1, "%s()\n", __func__); -- -- if (pageofs > inode->i_size) { -- ret = jffs2_reserve_space(c, sizeof(ri), &alloc_len, -- ALLOC_NORMAL, JFFS2_SUMMARY_INODE_SIZE); -- if (ret) -- return ret; -- } -- -- mutex_lock(&f->sem); - pg = grab_cache_page_write_begin(mapping, index, flags); -- if (!pg) { -- if (alloc_len) -- jffs2_complete_reservation(c); -- mutex_unlock(&f->sem); -+ if (!pg) - return -ENOMEM; -- } - *pagep = pg; - -- if (alloc_len) { -+ jffs2_dbg(1, "%s()\n", __func__); -+ -+ if (pageofs > inode->i_size) { - /* Make new hole frag from old EOF to new page */ -+ struct jffs2_sb_info *c = JFFS2_SB_INFO(inode->i_sb); -+ struct jffs2_raw_inode ri; - struct jffs2_full_dnode *fn; -+ uint32_t alloc_len; - - jffs2_dbg(1, "Writing new hole frag 0x%x-0x%x between current EOF and new page\n", - (unsigned int)inode->i_size, pageofs); - -+ ret = jffs2_reserve_space(c, sizeof(ri), &alloc_len, -+ ALLOC_NORMAL, JFFS2_SUMMARY_INODE_SIZE); -+ if (ret) -+ goto out_page; -+ -+ mutex_lock(&f->sem); - memset(&ri, 0, sizeof(ri)); - - ri.magic = cpu_to_je16(JFFS2_MAGIC_BITMASK); -@@ -198,6 +192,7 @@ static int jffs2_write_begin(struct file *filp, struct address_space *mapping, - if (IS_ERR(fn)) { - ret = PTR_ERR(fn); - jffs2_complete_reservation(c); -+ mutex_unlock(&f->sem); - goto out_page; - } - ret = jffs2_add_full_dnode_to_inode(c, f, fn); -@@ -212,10 +207,12 @@ static int jffs2_write_begin(struct file *filp, struct address_space *mapping, - jffs2_mark_node_obsolete(c, fn->raw); - jffs2_free_full_dnode(fn); - jffs2_complete_reservation(c); -+ mutex_unlock(&f->sem); - goto out_page; - } - jffs2_complete_reservation(c); - inode->i_size = pageofs; -+ mutex_unlock(&f->sem); - } - - /* -@@ -224,18 +221,18 @@ static int jffs2_write_begin(struct file *filp, struct address_space *mapping, - * case of a short-copy. - */ - if (!PageUptodate(pg)) { -+ mutex_lock(&f->sem); - ret = jffs2_do_readpage_nolock(inode, pg); -+ mutex_unlock(&f->sem); - if (ret) - goto out_page; - } -- mutex_unlock(&f->sem); - jffs2_dbg(1, "end write_begin(). pg->flags %lx\n", pg->flags); - return ret; - - out_page: - unlock_page(pg); - page_cache_release(pg); -- mutex_unlock(&f->sem); - return ret; - } - -diff --git a/fs/jffs2/gc.c b/fs/jffs2/gc.c -index 5a2dec2b064c..95d5880a63ee 100644 ---- a/fs/jffs2/gc.c -+++ b/fs/jffs2/gc.c -@@ -1296,14 +1296,17 @@ static int jffs2_garbage_collect_dnode(struct jffs2_sb_info *c, struct jffs2_era - BUG_ON(start > orig_start); - } - -- /* First, use readpage() to read the appropriate page into the page cache */ -- /* Q: What happens if we actually try to GC the _same_ page for which commit_write() -- * triggered garbage collection in the first place? -- * A: I _think_ it's OK. read_cache_page shouldn't deadlock, we'll write out the -- * page OK. We'll actually write it out again in commit_write, which is a little -- * suboptimal, but at least we're correct. -- */ -+ /* The rules state that we must obtain the page lock *before* f->sem, so -+ * drop f->sem temporarily. Since we also hold c->alloc_sem, nothing's -+ * actually going to *change* so we're safe; we only allow reading. -+ * -+ * It is important to note that jffs2_write_begin() will ensure that its -+ * page is marked Uptodate before allocating space. That means that if we -+ * end up here trying to GC the *same* page that jffs2_write_begin() is -+ * trying to write out, read_cache_page() will not deadlock. */ -+ mutex_unlock(&f->sem); - pg_ptr = jffs2_gc_fetch_page(c, f, start, &pg); -+ mutex_lock(&f->sem); - - if (IS_ERR(pg_ptr)) { - pr_warn("read_cache_page() returned error: %ld\n", -diff --git a/fs/jffs2/nodelist.h b/fs/jffs2/nodelist.h -index fa35ff79ab35..0637271f3770 100644 ---- a/fs/jffs2/nodelist.h -+++ b/fs/jffs2/nodelist.h -@@ -194,6 +194,7 @@ struct jffs2_inode_cache { - #define INO_STATE_CLEARING 6 /* In clear_inode() */ - - #define INO_FLAGS_XATTR_CHECKED 0x01 /* has no duplicate xattr_ref */ -+#define INO_FLAGS_IS_DIR 0x02 /* is a directory */ - - #define RAWNODE_CLASS_INODE_CACHE 0 - #define RAWNODE_CLASS_XATTR_DATUM 1 -@@ -249,7 +250,10 @@ struct jffs2_readinode_info - - struct jffs2_full_dirent - { -- struct jffs2_raw_node_ref *raw; -+ union { -+ struct jffs2_raw_node_ref *raw; -+ struct jffs2_inode_cache *ic; /* Just during part of build */ -+ }; - struct jffs2_full_dirent *next; - uint32_t version; - uint32_t ino; /* == zero for unlink */ -diff --git a/fs/locks.c b/fs/locks.c -index 2c61c4e9368c..f3197830f07e 100644 ---- a/fs/locks.c -+++ b/fs/locks.c -@@ -2007,7 +2007,6 @@ int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd, - goto out; - } - --again: - error = flock_to_posix_lock(filp, file_lock, &flock); - if (error) - goto out; -@@ -2038,19 +2037,22 @@ again: - * Attempt to detect a close/fcntl race and recover by - * releasing the lock that was just acquired. - */ -- /* -- * we need that spin_lock here - it prevents reordering between -- * update of inode->i_flock and check for it done in close(). -- * rcu_read_lock() wouldn't do. -- */ -- spin_lock(¤t->files->file_lock); -- f = fcheck(fd); -- spin_unlock(¤t->files->file_lock); -- if (!error && f != filp && flock.l_type != F_UNLCK) { -- flock.l_type = F_UNLCK; -- goto again; -+ if (!error && file_lock->fl_type != F_UNLCK) { -+ /* -+ * We need that spin_lock here - it prevents reordering between -+ * update of inode->i_flock and check for it done in -+ * close(). rcu_read_lock() wouldn't do. -+ */ -+ spin_lock(¤t->files->file_lock); -+ f = fcheck(fd); -+ spin_unlock(¤t->files->file_lock); -+ if (f != filp) { -+ file_lock->fl_type = F_UNLCK; -+ error = do_lock_file_wait(filp, cmd, file_lock); -+ WARN_ON_ONCE(error); -+ error = -EBADF; -+ } - } -- - out: - locks_free_lock(file_lock); - return error; -@@ -2125,7 +2127,6 @@ int fcntl_setlk64(unsigned int fd, struct file *filp, unsigned int cmd, - goto out; - } - --again: - error = flock64_to_posix_lock(filp, file_lock, &flock); - if (error) - goto out; -@@ -2156,14 +2157,22 @@ again: - * Attempt to detect a close/fcntl race and recover by - * releasing the lock that was just acquired. - */ -- spin_lock(¤t->files->file_lock); -- f = fcheck(fd); -- spin_unlock(¤t->files->file_lock); -- if (!error && f != filp && flock.l_type != F_UNLCK) { -- flock.l_type = F_UNLCK; -- goto again; -+ if (!error && file_lock->fl_type != F_UNLCK) { -+ /* -+ * We need that spin_lock here - it prevents reordering between -+ * update of inode->i_flock and check for it done in -+ * close(). rcu_read_lock() wouldn't do. -+ */ -+ spin_lock(¤t->files->file_lock); -+ f = fcheck(fd); -+ spin_unlock(¤t->files->file_lock); -+ if (f != filp) { -+ file_lock->fl_type = F_UNLCK; -+ error = do_lock_file_wait(filp, cmd, file_lock); -+ WARN_ON_ONCE(error); -+ error = -EBADF; -+ } - } -- - out: - locks_free_lock(file_lock); - return error; -diff --git a/include/linux/ata.h b/include/linux/ata.h -index f2f4d8da97c0..f7ff6554a354 100644 ---- a/include/linux/ata.h -+++ b/include/linux/ata.h -@@ -484,8 +484,8 @@ enum ata_tf_protocols { - }; - - enum ata_ioctls { -- ATA_IOC_GET_IO32 = 0x309, -- ATA_IOC_SET_IO32 = 0x324, -+ ATA_IOC_GET_IO32 = 0x309, /* HDIO_GET_32BIT */ -+ ATA_IOC_SET_IO32 = 0x324, /* HDIO_SET_32BIT */ - }; - - /* core structures */ -diff --git a/include/linux/libata.h b/include/linux/libata.h -index 189c9ff97b29..a445209be917 100644 ---- a/include/linux/libata.h -+++ b/include/linux/libata.h -@@ -712,7 +712,7 @@ struct ata_device { - union { - u16 id[ATA_ID_WORDS]; /* IDENTIFY xxx DEVICE data */ - u32 gscr[SATA_PMP_GSCR_DWORDS]; /* PMP GSCR block */ -- }; -+ } ____cacheline_aligned; - - /* DEVSLP Timing Variables from Identify Device Data Log */ - u8 devslp_timing[ATA_LOG_DEVSLP_SIZE]; -diff --git a/include/target/iscsi/iscsi_transport.h b/include/target/iscsi/iscsi_transport.h -index d1fb912740f3..0d7a62fea895 100644 ---- a/include/target/iscsi/iscsi_transport.h -+++ b/include/target/iscsi/iscsi_transport.h -@@ -21,6 +21,7 @@ struct iscsit_transport { - int (*iscsit_get_dataout)(struct iscsi_conn *, struct iscsi_cmd *, bool); - int (*iscsit_queue_data_in)(struct iscsi_conn *, struct iscsi_cmd *); - int (*iscsit_queue_status)(struct iscsi_conn *, struct iscsi_cmd *); -+ void (*iscsit_aborted_task)(struct iscsi_conn *, struct iscsi_cmd *); - }; - - static inline void *iscsit_priv_cmd(struct iscsi_cmd *cmd) -diff --git a/include/target/target_core_backend.h b/include/target/target_core_backend.h -index f5915b39386a..522ae25a61a7 100644 ---- a/include/target/target_core_backend.h -+++ b/include/target/target_core_backend.h -@@ -94,4 +94,8 @@ sense_reason_t transport_generic_map_mem_to_cmd(struct se_cmd *, - - void array_free(void *array, int n); - -+sector_t target_to_linux_sector(struct se_device *dev, sector_t lb); -+bool target_configure_unmap_from_queue(struct se_dev_attrib *attrib, -+ struct request_queue *q, int block_size); -+ - #endif /* TARGET_CORE_BACKEND_H */ -diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h -index 42606764d830..3beb2fed86aa 100644 ---- a/include/target/target_core_base.h -+++ b/include/target/target_core_base.h -@@ -162,7 +162,7 @@ enum se_cmd_flags_table { - SCF_SENT_CHECK_CONDITION = 0x00000800, - SCF_OVERFLOW_BIT = 0x00001000, - SCF_UNDERFLOW_BIT = 0x00002000, -- SCF_SENT_DELAYED_TAS = 0x00004000, -+ SCF_SEND_DELAYED_TAS = 0x00004000, - SCF_ALUA_NON_OPTIMIZED = 0x00008000, - SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC = 0x00020000, - SCF_ACK_KREF = 0x00040000, -@@ -528,6 +528,8 @@ struct se_cmd { - #define CMD_T_DEV_ACTIVE (1 << 7) - #define CMD_T_REQUEST_STOP (1 << 8) - #define CMD_T_BUSY (1 << 9) -+#define CMD_T_TAS (1 << 10) -+#define CMD_T_FABRIC_STOP (1 << 11) - spinlock_t t_state_lock; - struct completion t_transport_stop_comp; - -diff --git a/include/target/target_core_fabric.h b/include/target/target_core_fabric.h -index 0218d689b3d7..1d1043644b9b 100644 ---- a/include/target/target_core_fabric.h -+++ b/include/target/target_core_fabric.h -@@ -62,6 +62,7 @@ struct target_core_fabric_ops { - int (*queue_data_in)(struct se_cmd *); - int (*queue_status)(struct se_cmd *); - void (*queue_tm_rsp)(struct se_cmd *); -+ void (*aborted_task)(struct se_cmd *); - /* - * fabric module calls for target_core_fabric_configfs.c - */ -diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c -index 2bb95a7a8809..c14565bde887 100644 ---- a/sound/core/control_compat.c -+++ b/sound/core/control_compat.c -@@ -170,6 +170,19 @@ struct snd_ctl_elem_value32 { - unsigned char reserved[128]; - }; - -+#ifdef CONFIG_X86_X32 -+/* x32 has a different alignment for 64bit values from ia32 */ -+struct snd_ctl_elem_value_x32 { -+ struct snd_ctl_elem_id id; -+ unsigned int indirect; /* bit-field causes misalignment */ -+ union { -+ s32 integer[128]; -+ unsigned char data[512]; -+ s64 integer64[64]; -+ } value; -+ unsigned char reserved[128]; -+}; -+#endif /* CONFIG_X86_X32 */ - - /* get the value type and count of the control */ - static int get_ctl_type(struct snd_card *card, struct snd_ctl_elem_id *id, -@@ -219,9 +232,11 @@ static int get_elem_size(int type, int count) - - static int copy_ctl_value_from_user(struct snd_card *card, - struct snd_ctl_elem_value *data, -- struct snd_ctl_elem_value32 __user *data32, -+ void __user *userdata, -+ void __user *valuep, - int *typep, int *countp) - { -+ struct snd_ctl_elem_value32 __user *data32 = userdata; - int i, type, size; - int uninitialized_var(count); - unsigned int indirect; -@@ -239,8 +254,9 @@ static int copy_ctl_value_from_user(struct snd_card *card, - if (type == SNDRV_CTL_ELEM_TYPE_BOOLEAN || - type == SNDRV_CTL_ELEM_TYPE_INTEGER) { - for (i = 0; i < count; i++) { -+ s32 __user *intp = valuep; - int val; -- if (get_user(val, &data32->value.integer[i])) -+ if (get_user(val, &intp[i])) - return -EFAULT; - data->value.integer.value[i] = val; - } -@@ -250,8 +266,7 @@ static int copy_ctl_value_from_user(struct snd_card *card, - printk(KERN_ERR "snd_ioctl32_ctl_elem_value: unknown type %d\n", type); - return -EINVAL; - } -- if (copy_from_user(data->value.bytes.data, -- data32->value.data, size)) -+ if (copy_from_user(data->value.bytes.data, valuep, size)) - return -EFAULT; - } - -@@ -261,7 +276,8 @@ static int copy_ctl_value_from_user(struct snd_card *card, - } - - /* restore the value to 32bit */ --static int copy_ctl_value_to_user(struct snd_ctl_elem_value32 __user *data32, -+static int copy_ctl_value_to_user(void __user *userdata, -+ void __user *valuep, - struct snd_ctl_elem_value *data, - int type, int count) - { -@@ -270,22 +286,22 @@ static int copy_ctl_value_to_user(struct snd_ctl_elem_value32 __user *data32, - if (type == SNDRV_CTL_ELEM_TYPE_BOOLEAN || - type == SNDRV_CTL_ELEM_TYPE_INTEGER) { - for (i = 0; i < count; i++) { -+ s32 __user *intp = valuep; - int val; - val = data->value.integer.value[i]; -- if (put_user(val, &data32->value.integer[i])) -+ if (put_user(val, &intp[i])) - return -EFAULT; - } - } else { - size = get_elem_size(type, count); -- if (copy_to_user(data32->value.data, -- data->value.bytes.data, size)) -+ if (copy_to_user(valuep, data->value.bytes.data, size)) - return -EFAULT; - } - return 0; - } - --static int snd_ctl_elem_read_user_compat(struct snd_card *card, -- struct snd_ctl_elem_value32 __user *data32) -+static int ctl_elem_read_user(struct snd_card *card, -+ void __user *userdata, void __user *valuep) - { - struct snd_ctl_elem_value *data; - int err, type, count; -@@ -294,7 +310,9 @@ static int snd_ctl_elem_read_user_compat(struct snd_card *card, - if (data == NULL) - return -ENOMEM; - -- if ((err = copy_ctl_value_from_user(card, data, data32, &type, &count)) < 0) -+ err = copy_ctl_value_from_user(card, data, userdata, valuep, -+ &type, &count); -+ if (err < 0) - goto error; - - snd_power_lock(card); -@@ -303,14 +321,15 @@ static int snd_ctl_elem_read_user_compat(struct snd_card *card, - err = snd_ctl_elem_read(card, data); - snd_power_unlock(card); - if (err >= 0) -- err = copy_ctl_value_to_user(data32, data, type, count); -+ err = copy_ctl_value_to_user(userdata, valuep, data, -+ type, count); - error: - kfree(data); - return err; - } - --static int snd_ctl_elem_write_user_compat(struct snd_ctl_file *file, -- struct snd_ctl_elem_value32 __user *data32) -+static int ctl_elem_write_user(struct snd_ctl_file *file, -+ void __user *userdata, void __user *valuep) - { - struct snd_ctl_elem_value *data; - struct snd_card *card = file->card; -@@ -320,7 +339,9 @@ static int snd_ctl_elem_write_user_compat(struct snd_ctl_file *file, - if (data == NULL) - return -ENOMEM; - -- if ((err = copy_ctl_value_from_user(card, data, data32, &type, &count)) < 0) -+ err = copy_ctl_value_from_user(card, data, userdata, valuep, -+ &type, &count); -+ if (err < 0) - goto error; - - snd_power_lock(card); -@@ -329,12 +350,39 @@ static int snd_ctl_elem_write_user_compat(struct snd_ctl_file *file, - err = snd_ctl_elem_write(card, file, data); - snd_power_unlock(card); - if (err >= 0) -- err = copy_ctl_value_to_user(data32, data, type, count); -+ err = copy_ctl_value_to_user(userdata, valuep, data, -+ type, count); - error: - kfree(data); - return err; - } - -+static int snd_ctl_elem_read_user_compat(struct snd_card *card, -+ struct snd_ctl_elem_value32 __user *data32) -+{ -+ return ctl_elem_read_user(card, data32, &data32->value); -+} -+ -+static int snd_ctl_elem_write_user_compat(struct snd_ctl_file *file, -+ struct snd_ctl_elem_value32 __user *data32) -+{ -+ return ctl_elem_write_user(file, data32, &data32->value); -+} -+ -+#ifdef CONFIG_X86_X32 -+static int snd_ctl_elem_read_user_x32(struct snd_card *card, -+ struct snd_ctl_elem_value_x32 __user *data32) -+{ -+ return ctl_elem_read_user(card, data32, &data32->value); -+} -+ -+static int snd_ctl_elem_write_user_x32(struct snd_ctl_file *file, -+ struct snd_ctl_elem_value_x32 __user *data32) -+{ -+ return ctl_elem_write_user(file, data32, &data32->value); -+} -+#endif /* CONFIG_X86_X32 */ -+ - /* add or replace a user control */ - static int snd_ctl_elem_add_compat(struct snd_ctl_file *file, - struct snd_ctl_elem_info32 __user *data32, -@@ -393,6 +441,10 @@ enum { - SNDRV_CTL_IOCTL_ELEM_WRITE32 = _IOWR('U', 0x13, struct snd_ctl_elem_value32), - SNDRV_CTL_IOCTL_ELEM_ADD32 = _IOWR('U', 0x17, struct snd_ctl_elem_info32), - SNDRV_CTL_IOCTL_ELEM_REPLACE32 = _IOWR('U', 0x18, struct snd_ctl_elem_info32), -+#ifdef CONFIG_X86_X32 -+ SNDRV_CTL_IOCTL_ELEM_READ_X32 = _IOWR('U', 0x12, struct snd_ctl_elem_value_x32), -+ SNDRV_CTL_IOCTL_ELEM_WRITE_X32 = _IOWR('U', 0x13, struct snd_ctl_elem_value_x32), -+#endif /* CONFIG_X86_X32 */ - }; - - static inline long snd_ctl_ioctl_compat(struct file *file, unsigned int cmd, unsigned long arg) -@@ -431,6 +483,12 @@ static inline long snd_ctl_ioctl_compat(struct file *file, unsigned int cmd, uns - return snd_ctl_elem_add_compat(ctl, argp, 0); - case SNDRV_CTL_IOCTL_ELEM_REPLACE32: - return snd_ctl_elem_add_compat(ctl, argp, 1); -+#ifdef CONFIG_X86_X32 -+ case SNDRV_CTL_IOCTL_ELEM_READ_X32: -+ return snd_ctl_elem_read_user_x32(ctl->card, argp); -+ case SNDRV_CTL_IOCTL_ELEM_WRITE_X32: -+ return snd_ctl_elem_write_user_x32(ctl, argp); -+#endif /* CONFIG_X86_X32 */ - } - - down_read(&snd_ioctl_rwsem); -diff --git a/sound/core/rawmidi_compat.c b/sound/core/rawmidi_compat.c -index 5268c1f58c25..09a89094dcf7 100644 ---- a/sound/core/rawmidi_compat.c -+++ b/sound/core/rawmidi_compat.c -@@ -94,9 +94,58 @@ static int snd_rawmidi_ioctl_status_compat(struct snd_rawmidi_file *rfile, - return 0; - } - -+#ifdef CONFIG_X86_X32 -+/* X32 ABI has 64bit timespec and 64bit alignment */ -+struct snd_rawmidi_status_x32 { -+ s32 stream; -+ u32 rsvd; /* alignment */ -+ struct timespec tstamp; -+ u32 avail; -+ u32 xruns; -+ unsigned char reserved[16]; -+} __attribute__((packed)); -+ -+#define put_timespec(src, dst) copy_to_user(dst, src, sizeof(*dst)) -+ -+static int snd_rawmidi_ioctl_status_x32(struct snd_rawmidi_file *rfile, -+ struct snd_rawmidi_status_x32 __user *src) -+{ -+ int err; -+ struct snd_rawmidi_status status; -+ -+ if (rfile->output == NULL) -+ return -EINVAL; -+ if (get_user(status.stream, &src->stream)) -+ return -EFAULT; -+ -+ switch (status.stream) { -+ case SNDRV_RAWMIDI_STREAM_OUTPUT: -+ err = snd_rawmidi_output_status(rfile->output, &status); -+ break; -+ case SNDRV_RAWMIDI_STREAM_INPUT: -+ err = snd_rawmidi_input_status(rfile->input, &status); -+ break; -+ default: -+ return -EINVAL; -+ } -+ if (err < 0) -+ return err; -+ -+ if (put_timespec(&status.tstamp, &src->tstamp) || -+ put_user(status.avail, &src->avail) || -+ put_user(status.xruns, &src->xruns)) -+ return -EFAULT; -+ -+ return 0; -+} -+#endif /* CONFIG_X86_X32 */ -+ - enum { - SNDRV_RAWMIDI_IOCTL_PARAMS32 = _IOWR('W', 0x10, struct snd_rawmidi_params32), - SNDRV_RAWMIDI_IOCTL_STATUS32 = _IOWR('W', 0x20, struct snd_rawmidi_status32), -+#ifdef CONFIG_X86_X32 -+ SNDRV_RAWMIDI_IOCTL_STATUS_X32 = _IOWR('W', 0x20, struct snd_rawmidi_status_x32), -+#endif /* CONFIG_X86_X32 */ - }; - - static long snd_rawmidi_ioctl_compat(struct file *file, unsigned int cmd, unsigned long arg) -@@ -115,6 +164,10 @@ static long snd_rawmidi_ioctl_compat(struct file *file, unsigned int cmd, unsign - return snd_rawmidi_ioctl_params_compat(rfile, argp); - case SNDRV_RAWMIDI_IOCTL_STATUS32: - return snd_rawmidi_ioctl_status_compat(rfile, argp); -+#ifdef CONFIG_X86_X32 -+ case SNDRV_RAWMIDI_IOCTL_STATUS_X32: -+ return snd_rawmidi_ioctl_status_x32(rfile, argp); -+#endif /* CONFIG_X86_X32 */ - } - return -ENOIOCTLCMD; - } -diff --git a/sound/core/seq/oss/seq_oss.c b/sound/core/seq/oss/seq_oss.c -index 8d4d5e853efe..ab774954c985 100644 ---- a/sound/core/seq/oss/seq_oss.c -+++ b/sound/core/seq/oss/seq_oss.c -@@ -150,8 +150,6 @@ odev_release(struct inode *inode, struct file *file) - if ((dp = file->private_data) == NULL) - return 0; - -- snd_seq_oss_drain_write(dp); -- - mutex_lock(®ister_mutex); - snd_seq_oss_release(dp); - mutex_unlock(®ister_mutex); -diff --git a/sound/core/seq/oss/seq_oss_device.h b/sound/core/seq/oss/seq_oss_device.h -index c0154a959d55..2464112b08ad 100644 ---- a/sound/core/seq/oss/seq_oss_device.h -+++ b/sound/core/seq/oss/seq_oss_device.h -@@ -131,7 +131,6 @@ int snd_seq_oss_write(struct seq_oss_devinfo *dp, const char __user *buf, int co - unsigned int snd_seq_oss_poll(struct seq_oss_devinfo *dp, struct file *file, poll_table * wait); - - void snd_seq_oss_reset(struct seq_oss_devinfo *dp); --void snd_seq_oss_drain_write(struct seq_oss_devinfo *dp); - - /* */ - void snd_seq_oss_process_queue(struct seq_oss_devinfo *dp, abstime_t time); -diff --git a/sound/core/seq/oss/seq_oss_init.c b/sound/core/seq/oss/seq_oss_init.c -index b3f39b5ed742..f9e09e458227 100644 ---- a/sound/core/seq/oss/seq_oss_init.c -+++ b/sound/core/seq/oss/seq_oss_init.c -@@ -457,23 +457,6 @@ snd_seq_oss_release(struct seq_oss_devinfo *dp) - - - /* -- * Wait until the queue is empty (if we don't have nonblock) -- */ --void --snd_seq_oss_drain_write(struct seq_oss_devinfo *dp) --{ -- if (! dp->timer->running) -- return; -- if (is_write_mode(dp->file_mode) && !is_nonblock_mode(dp->file_mode) && -- dp->writeq) { -- debug_printk(("syncing..\n")); -- while (snd_seq_oss_writeq_sync(dp->writeq)) -- ; -- } --} -- -- --/* - * reset sequencer devices - */ - void -diff --git a/sound/core/timer_compat.c b/sound/core/timer_compat.c -index e05802ae6e1b..2e908225d754 100644 ---- a/sound/core/timer_compat.c -+++ b/sound/core/timer_compat.c -@@ -70,13 +70,14 @@ static int snd_timer_user_status_compat(struct file *file, - struct snd_timer_status32 __user *_status) - { - struct snd_timer_user *tu; -- struct snd_timer_status status; -+ struct snd_timer_status32 status; - - tu = file->private_data; - if (snd_BUG_ON(!tu->timeri)) - return -ENXIO; - memset(&status, 0, sizeof(status)); -- status.tstamp = tu->tstamp; -+ status.tstamp.tv_sec = tu->tstamp.tv_sec; -+ status.tstamp.tv_nsec = tu->tstamp.tv_nsec; - status.resolution = snd_timer_resolution(tu->timeri); - status.lost = tu->timeri->lost; - status.overrun = tu->overrun; -@@ -88,12 +89,21 @@ static int snd_timer_user_status_compat(struct file *file, - return 0; - } - -+#ifdef CONFIG_X86_X32 -+/* X32 ABI has the same struct as x86-64 */ -+#define snd_timer_user_status_x32(file, s) \ -+ snd_timer_user_status(file, s) -+#endif /* CONFIG_X86_X32 */ -+ - /* - */ - - enum { - SNDRV_TIMER_IOCTL_INFO32 = _IOR('T', 0x11, struct snd_timer_info32), - SNDRV_TIMER_IOCTL_STATUS32 = _IOW('T', 0x14, struct snd_timer_status32), -+#ifdef CONFIG_X86_X32 -+ SNDRV_TIMER_IOCTL_STATUS_X32 = _IOW('T', 0x14, struct snd_timer_status), -+#endif /* CONFIG_X86_X32 */ - }; - - static long snd_timer_user_ioctl_compat(struct file *file, unsigned int cmd, unsigned long arg) -@@ -122,6 +132,10 @@ static long snd_timer_user_ioctl_compat(struct file *file, unsigned int cmd, uns - return snd_timer_user_info_compat(file, argp); - case SNDRV_TIMER_IOCTL_STATUS32: - return snd_timer_user_status_compat(file, argp); -+#ifdef CONFIG_X86_X32 -+ case SNDRV_TIMER_IOCTL_STATUS_X32: -+ return snd_timer_user_status_x32(file, argp); -+#endif /* CONFIG_X86_X32 */ - } - return -ENOIOCTLCMD; - } -diff --git a/sound/pci/rme9652/hdsp.c b/sound/pci/rme9652/hdsp.c -index bd90c80bb494..4bc0d66377d6 100644 ---- a/sound/pci/rme9652/hdsp.c -+++ b/sound/pci/rme9652/hdsp.c -@@ -2917,7 +2917,7 @@ static int snd_hdsp_get_dds_offset(struct snd_kcontrol *kcontrol, struct snd_ctl - { - struct hdsp *hdsp = snd_kcontrol_chip(kcontrol); - -- ucontrol->value.enumerated.item[0] = hdsp_dds_offset(hdsp); -+ ucontrol->value.integer.value[0] = hdsp_dds_offset(hdsp); - return 0; - } - -@@ -2929,7 +2929,7 @@ static int snd_hdsp_put_dds_offset(struct snd_kcontrol *kcontrol, struct snd_ctl - - if (!snd_hdsp_use_is_exclusive(hdsp)) - return -EBUSY; -- val = ucontrol->value.enumerated.item[0]; -+ val = ucontrol->value.integer.value[0]; - spin_lock_irq(&hdsp->lock); - if (val != hdsp_dds_offset(hdsp)) - change = (hdsp_set_dds_offset(hdsp, val) == 0) ? 1 : 0; -diff --git a/sound/pci/rme9652/hdspm.c b/sound/pci/rme9652/hdspm.c -index 21167503a3f9..dec173081798 100644 ---- a/sound/pci/rme9652/hdspm.c -+++ b/sound/pci/rme9652/hdspm.c -@@ -1602,6 +1602,9 @@ static void hdspm_set_dds_value(struct hdspm *hdspm, int rate) - { - u64 n; - -+ if (snd_BUG_ON(rate <= 0)) -+ return; -+ - if (rate >= 112000) - rate /= 4; - else if (rate >= 56000) -@@ -2224,6 +2227,8 @@ static int hdspm_get_system_sample_rate(struct hdspm *hdspm) - } else { - /* slave mode, return external sample rate */ - rate = hdspm_external_sample_rate(hdspm); -+ if (!rate) -+ rate = hdspm->system_sample_rate; - } - } - -@@ -2269,8 +2274,11 @@ static int snd_hdspm_put_system_sample_rate(struct snd_kcontrol *kcontrol, - ucontrol) - { - struct hdspm *hdspm = snd_kcontrol_chip(kcontrol); -+ int rate = ucontrol->value.integer.value[0]; - -- hdspm_set_dds_value(hdspm, ucontrol->value.enumerated.item[0]); -+ if (rate < 27000 || rate > 207000) -+ return -EINVAL; -+ hdspm_set_dds_value(hdspm, ucontrol->value.integer.value[0]); - return 0; - } - -@@ -4469,7 +4477,7 @@ static int snd_hdspm_get_tco_word_term(struct snd_kcontrol *kcontrol, - { - struct hdspm *hdspm = snd_kcontrol_chip(kcontrol); - -- ucontrol->value.enumerated.item[0] = hdspm->tco->term; -+ ucontrol->value.integer.value[0] = hdspm->tco->term; - - return 0; - } -@@ -4480,8 +4488,8 @@ static int snd_hdspm_put_tco_word_term(struct snd_kcontrol *kcontrol, - { - struct hdspm *hdspm = snd_kcontrol_chip(kcontrol); - -- if (hdspm->tco->term != ucontrol->value.enumerated.item[0]) { -- hdspm->tco->term = ucontrol->value.enumerated.item[0]; -+ if (hdspm->tco->term != ucontrol->value.integer.value[0]) { -+ hdspm->tco->term = ucontrol->value.integer.value[0]; - - hdspm_tco_write(hdspm); - diff --git a/patch/kernel/odroidc2-default/patch-3.14.64-65.patch b/patch/kernel/odroidc2-default/patch-3.14.64-65.patch deleted file mode 100644 index 73548c75ef..0000000000 --- a/patch/kernel/odroidc2-default/patch-3.14.64-65.patch +++ /dev/null @@ -1,1518 +0,0 @@ -diff --git a/Documentation/filesystems/efivarfs.txt b/Documentation/filesystems/efivarfs.txt -index c477af086e65..686a64bba775 100644 ---- a/Documentation/filesystems/efivarfs.txt -+++ b/Documentation/filesystems/efivarfs.txt -@@ -14,3 +14,10 @@ filesystem. - efivarfs is typically mounted like this, - - mount -t efivarfs none /sys/firmware/efi/efivars -+ -+Due to the presence of numerous firmware bugs where removing non-standard -+UEFI variables causes the system firmware to fail to POST, efivarfs -+files that are not well-known standardized variables are created -+as immutable files. This doesn't prevent removal - "chattr -i" will work - -+but it does prevent this kind of failure from being accomplished -+accidentally. -diff --git a/Makefile b/Makefile -index de41fa82652f..a19c22a77728 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 3 - PATCHLEVEL = 14 --SUBLEVEL = 64 -+SUBLEVEL = 65 - EXTRAVERSION = - NAME = Remembering Coco - -diff --git a/arch/powerpc/kernel/module_64.c b/arch/powerpc/kernel/module_64.c -index 12664c130d73..78a859ec4946 100644 ---- a/arch/powerpc/kernel/module_64.c -+++ b/arch/powerpc/kernel/module_64.c -@@ -202,7 +202,7 @@ static void dedotify(Elf64_Sym *syms, unsigned int numsyms, char *strtab) - if (syms[i].st_shndx == SHN_UNDEF) { - char *name = strtab + syms[i].st_name; - if (name[0] == '.') -- memmove(name, name+1, strlen(name)); -+ syms[i].st_name++; - } - } - } -diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S -index b3bad672e5d9..87fa70f8472a 100644 ---- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S -+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S -@@ -1148,6 +1148,20 @@ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S) - std r6, VCPU_ACOP(r9) - stw r7, VCPU_GUEST_PID(r9) - std r8, VCPU_WORT(r9) -+ /* -+ * Restore various registers to 0, where non-zero values -+ * set by the guest could disrupt the host. -+ */ -+ li r0, 0 -+ mtspr SPRN_IAMR, r0 -+ mtspr SPRN_CIABR, r0 -+ mtspr SPRN_DAWRX, r0 -+ mtspr SPRN_TCSCR, r0 -+ mtspr SPRN_WORT, r0 -+ /* Set MMCRS to 1<<31 to freeze and disable the SPMC counters */ -+ li r0, 1 -+ sldi r0, r0, 31 -+ mtspr SPRN_MMCRS, r0 - 8: - - /* Save and reset AMR and UAMOR before turning on the MMU */ -diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c -index 80c22a3ca688..b6fc5fc64cef 100644 ---- a/arch/x86/kvm/vmx.c -+++ b/arch/x86/kvm/vmx.c -@@ -1555,6 +1555,13 @@ static void add_atomic_switch_msr(struct vcpu_vmx *vmx, unsigned msr, - return; - } - break; -+ case MSR_IA32_PEBS_ENABLE: -+ /* PEBS needs a quiescent period after being disabled (to write -+ * a record). Disabling PEBS through VMX MSR swapping doesn't -+ * provide that period, so a CPU could write host's record into -+ * guest's memory. -+ */ -+ wrmsrl(MSR_IA32_PEBS_ENABLE, 0); - } - - for (i = 0; i < m->nr; ++i) -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 1777f89875fb..8db66424be97 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -1991,6 +1991,8 @@ static void accumulate_steal_time(struct kvm_vcpu *vcpu) - - static void record_steal_time(struct kvm_vcpu *vcpu) - { -+ accumulate_steal_time(vcpu); -+ - if (!(vcpu->arch.st.msr_val & KVM_MSR_ENABLED)) - return; - -@@ -2123,12 +2125,6 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info) - if (!(data & KVM_MSR_ENABLED)) - break; - -- vcpu->arch.st.last_steal = current->sched_info.run_delay; -- -- preempt_disable(); -- accumulate_steal_time(vcpu); -- preempt_enable(); -- - kvm_make_request(KVM_REQ_STEAL_UPDATE, vcpu); - - break; -@@ -2818,7 +2814,6 @@ void kvm_arch_vcpu_load(struct kvm_vcpu *vcpu, int cpu) - vcpu->cpu = cpu; - } - -- accumulate_steal_time(vcpu); - kvm_make_request(KVM_REQ_STEAL_UPDATE, vcpu); - } - -diff --git a/crypto/af_alg.c b/crypto/af_alg.c -index 1971f3ccb09a..eeb2fb239934 100644 ---- a/crypto/af_alg.c -+++ b/crypto/af_alg.c -@@ -125,23 +125,6 @@ int af_alg_release(struct socket *sock) - } - EXPORT_SYMBOL_GPL(af_alg_release); - --void af_alg_release_parent(struct sock *sk) --{ -- struct alg_sock *ask = alg_sk(sk); -- bool last; -- -- sk = ask->parent; -- ask = alg_sk(sk); -- -- lock_sock(sk); -- last = !--ask->refcnt; -- release_sock(sk); -- -- if (last) -- sock_put(sk); --} --EXPORT_SYMBOL_GPL(af_alg_release_parent); -- - static int alg_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) - { - struct sock *sk = sock->sk; -@@ -149,7 +132,6 @@ static int alg_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) - struct sockaddr_alg *sa = (void *)uaddr; - const struct af_alg_type *type; - void *private; -- int err; - - if (sock->state == SS_CONNECTED) - return -EINVAL; -@@ -175,22 +157,16 @@ static int alg_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) - return PTR_ERR(private); - } - -- err = -EBUSY; - lock_sock(sk); -- if (ask->refcnt) -- goto unlock; - - swap(ask->type, type); - swap(ask->private, private); - -- err = 0; -- --unlock: - release_sock(sk); - - alg_do_release(type, private); - -- return err; -+ return 0; - } - - static int alg_setkey(struct sock *sk, char __user *ukey, -@@ -223,15 +199,11 @@ static int alg_setsockopt(struct socket *sock, int level, int optname, - struct sock *sk = sock->sk; - struct alg_sock *ask = alg_sk(sk); - const struct af_alg_type *type; -- int err = -EBUSY; -+ int err = -ENOPROTOOPT; - - lock_sock(sk); -- if (ask->refcnt) -- goto unlock; -- - type = ask->type; - -- err = -ENOPROTOOPT; - if (level != SOL_ALG || !type) - goto unlock; - -@@ -280,8 +252,7 @@ int af_alg_accept(struct sock *sk, struct socket *newsock) - - sk2->sk_family = PF_ALG; - -- if (!ask->refcnt++) -- sock_hold(sk); -+ sock_hold(sk); - alg_sk(sk2)->parent = sk; - alg_sk(sk2)->type = type; - -diff --git a/drivers/firmware/efi/efivars.c b/drivers/firmware/efi/efivars.c -index 3dc248239197..f04ce007bf7f 100644 ---- a/drivers/firmware/efi/efivars.c -+++ b/drivers/firmware/efi/efivars.c -@@ -219,7 +219,8 @@ efivar_store_raw(struct efivar_entry *entry, const char *buf, size_t count) - } - - if ((new_var->Attributes & ~EFI_VARIABLE_MASK) != 0 || -- efivar_validate(new_var, new_var->Data, new_var->DataSize) == false) { -+ efivar_validate(new_var->VendorGuid, new_var->VariableName, -+ new_var->Data, new_var->DataSize) == false) { - printk(KERN_ERR "efivars: Malformed variable content\n"); - return -EINVAL; - } -@@ -334,7 +335,8 @@ static ssize_t efivar_create(struct file *filp, struct kobject *kobj, - return -EACCES; - - if ((new_var->Attributes & ~EFI_VARIABLE_MASK) != 0 || -- efivar_validate(new_var, new_var->Data, new_var->DataSize) == false) { -+ efivar_validate(new_var->VendorGuid, new_var->VariableName, -+ new_var->Data, new_var->DataSize) == false) { - printk(KERN_ERR "efivars: Malformed variable content\n"); - return -EINVAL; - } -@@ -409,35 +411,27 @@ efivar_create_sysfs_entry(struct efivar_entry *new_var) - { - int i, short_name_size; - char *short_name; -- unsigned long variable_name_size; -- efi_char16_t *variable_name; -- -- variable_name = new_var->var.VariableName; -- variable_name_size = ucs2_strlen(variable_name) * sizeof(efi_char16_t); -+ unsigned long utf8_name_size; -+ efi_char16_t *variable_name = new_var->var.VariableName; - - /* -- * Length of the variable bytes in ASCII, plus the '-' separator, -+ * Length of the variable bytes in UTF8, plus the '-' separator, - * plus the GUID, plus trailing NUL - */ -- short_name_size = variable_name_size / sizeof(efi_char16_t) -- + 1 + EFI_VARIABLE_GUID_LEN + 1; -- -- short_name = kzalloc(short_name_size, GFP_KERNEL); -+ utf8_name_size = ucs2_utf8size(variable_name); -+ short_name_size = utf8_name_size + 1 + EFI_VARIABLE_GUID_LEN + 1; - -+ short_name = kmalloc(short_name_size, GFP_KERNEL); - if (!short_name) - return 1; - -- /* Convert Unicode to normal chars (assume top bits are 0), -- ala UTF-8 */ -- for (i=0; i < (int)(variable_name_size / sizeof(efi_char16_t)); i++) { -- short_name[i] = variable_name[i] & 0xFF; -- } -+ ucs2_as_utf8(short_name, variable_name, short_name_size); -+ - /* This is ugly, but necessary to separate one vendor's - private variables from another's. */ -- -- *(short_name + strlen(short_name)) = '-'; -+ short_name[utf8_name_size] = '-'; - efi_guid_unparse(&new_var->var.VendorGuid, -- short_name + strlen(short_name)); -+ short_name + utf8_name_size + 1); - - new_var->kobj.kset = efivars_kset; - -diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c -index e6125522860a..4e2f46938bf0 100644 ---- a/drivers/firmware/efi/vars.c -+++ b/drivers/firmware/efi/vars.c -@@ -42,7 +42,7 @@ DECLARE_WORK(efivar_work, NULL); - EXPORT_SYMBOL_GPL(efivar_work); - - static bool --validate_device_path(struct efi_variable *var, int match, u8 *buffer, -+validate_device_path(efi_char16_t *var_name, int match, u8 *buffer, - unsigned long len) - { - struct efi_generic_dev_path *node; -@@ -75,7 +75,7 @@ validate_device_path(struct efi_variable *var, int match, u8 *buffer, - } - - static bool --validate_boot_order(struct efi_variable *var, int match, u8 *buffer, -+validate_boot_order(efi_char16_t *var_name, int match, u8 *buffer, - unsigned long len) - { - /* An array of 16-bit integers */ -@@ -86,18 +86,18 @@ validate_boot_order(struct efi_variable *var, int match, u8 *buffer, - } - - static bool --validate_load_option(struct efi_variable *var, int match, u8 *buffer, -+validate_load_option(efi_char16_t *var_name, int match, u8 *buffer, - unsigned long len) - { - u16 filepathlength; - int i, desclength = 0, namelen; - -- namelen = ucs2_strnlen(var->VariableName, sizeof(var->VariableName)); -+ namelen = ucs2_strnlen(var_name, EFI_VAR_NAME_LEN); - - /* Either "Boot" or "Driver" followed by four digits of hex */ - for (i = match; i < match+4; i++) { -- if (var->VariableName[i] > 127 || -- hex_to_bin(var->VariableName[i] & 0xff) < 0) -+ if (var_name[i] > 127 || -+ hex_to_bin(var_name[i] & 0xff) < 0) - return true; - } - -@@ -132,12 +132,12 @@ validate_load_option(struct efi_variable *var, int match, u8 *buffer, - /* - * And, finally, check the filepath - */ -- return validate_device_path(var, match, buffer + desclength + 6, -+ return validate_device_path(var_name, match, buffer + desclength + 6, - filepathlength); - } - - static bool --validate_uint16(struct efi_variable *var, int match, u8 *buffer, -+validate_uint16(efi_char16_t *var_name, int match, u8 *buffer, - unsigned long len) - { - /* A single 16-bit integer */ -@@ -148,7 +148,7 @@ validate_uint16(struct efi_variable *var, int match, u8 *buffer, - } - - static bool --validate_ascii_string(struct efi_variable *var, int match, u8 *buffer, -+validate_ascii_string(efi_char16_t *var_name, int match, u8 *buffer, - unsigned long len) - { - int i; -@@ -165,67 +165,133 @@ validate_ascii_string(struct efi_variable *var, int match, u8 *buffer, - } - - struct variable_validate { -+ efi_guid_t vendor; - char *name; -- bool (*validate)(struct efi_variable *var, int match, u8 *data, -+ bool (*validate)(efi_char16_t *var_name, int match, u8 *data, - unsigned long len); - }; - -+/* -+ * This is the list of variables we need to validate, as well as the -+ * whitelist for what we think is safe not to default to immutable. -+ * -+ * If it has a validate() method that's not NULL, it'll go into the -+ * validation routine. If not, it is assumed valid, but still used for -+ * whitelisting. -+ * -+ * Note that it's sorted by {vendor,name}, but globbed names must come after -+ * any other name with the same prefix. -+ */ - static const struct variable_validate variable_validate[] = { -- { "BootNext", validate_uint16 }, -- { "BootOrder", validate_boot_order }, -- { "DriverOrder", validate_boot_order }, -- { "Boot*", validate_load_option }, -- { "Driver*", validate_load_option }, -- { "ConIn", validate_device_path }, -- { "ConInDev", validate_device_path }, -- { "ConOut", validate_device_path }, -- { "ConOutDev", validate_device_path }, -- { "ErrOut", validate_device_path }, -- { "ErrOutDev", validate_device_path }, -- { "Timeout", validate_uint16 }, -- { "Lang", validate_ascii_string }, -- { "PlatformLang", validate_ascii_string }, -- { "", NULL }, -+ { EFI_GLOBAL_VARIABLE_GUID, "BootNext", validate_uint16 }, -+ { EFI_GLOBAL_VARIABLE_GUID, "BootOrder", validate_boot_order }, -+ { EFI_GLOBAL_VARIABLE_GUID, "Boot*", validate_load_option }, -+ { EFI_GLOBAL_VARIABLE_GUID, "DriverOrder", validate_boot_order }, -+ { EFI_GLOBAL_VARIABLE_GUID, "Driver*", validate_load_option }, -+ { EFI_GLOBAL_VARIABLE_GUID, "ConIn", validate_device_path }, -+ { EFI_GLOBAL_VARIABLE_GUID, "ConInDev", validate_device_path }, -+ { EFI_GLOBAL_VARIABLE_GUID, "ConOut", validate_device_path }, -+ { EFI_GLOBAL_VARIABLE_GUID, "ConOutDev", validate_device_path }, -+ { EFI_GLOBAL_VARIABLE_GUID, "ErrOut", validate_device_path }, -+ { EFI_GLOBAL_VARIABLE_GUID, "ErrOutDev", validate_device_path }, -+ { EFI_GLOBAL_VARIABLE_GUID, "Lang", validate_ascii_string }, -+ { EFI_GLOBAL_VARIABLE_GUID, "OsIndications", NULL }, -+ { EFI_GLOBAL_VARIABLE_GUID, "PlatformLang", validate_ascii_string }, -+ { EFI_GLOBAL_VARIABLE_GUID, "Timeout", validate_uint16 }, -+ { LINUX_EFI_CRASH_GUID, "*", NULL }, -+ { NULL_GUID, "", NULL }, - }; - -+static bool -+variable_matches(const char *var_name, size_t len, const char *match_name, -+ int *match) -+{ -+ for (*match = 0; ; (*match)++) { -+ char c = match_name[*match]; -+ char u = var_name[*match]; -+ -+ /* Wildcard in the matching name means we've matched */ -+ if (c == '*') -+ return true; -+ -+ /* Case sensitive match */ -+ if (!c && *match == len) -+ return true; -+ -+ if (c != u) -+ return false; -+ -+ if (!c) -+ return true; -+ } -+ return true; -+} -+ - bool --efivar_validate(struct efi_variable *var, u8 *data, unsigned long len) -+efivar_validate(efi_guid_t vendor, efi_char16_t *var_name, u8 *data, -+ unsigned long data_size) - { - int i; -- u16 *unicode_name = var->VariableName; -+ unsigned long utf8_size; -+ u8 *utf8_name; - -- for (i = 0; variable_validate[i].validate != NULL; i++) { -- const char *name = variable_validate[i].name; -- int match; -+ utf8_size = ucs2_utf8size(var_name); -+ utf8_name = kmalloc(utf8_size + 1, GFP_KERNEL); -+ if (!utf8_name) -+ return false; - -- for (match = 0; ; match++) { -- char c = name[match]; -- u16 u = unicode_name[match]; -+ ucs2_as_utf8(utf8_name, var_name, utf8_size); -+ utf8_name[utf8_size] = '\0'; - -- /* All special variables are plain ascii */ -- if (u > 127) -- return true; -+ for (i = 0; variable_validate[i].name[0] != '\0'; i++) { -+ const char *name = variable_validate[i].name; -+ int match = 0; - -- /* Wildcard in the matching name means we've matched */ -- if (c == '*') -- return variable_validate[i].validate(var, -- match, data, len); -+ if (efi_guidcmp(vendor, variable_validate[i].vendor)) -+ continue; - -- /* Case sensitive match */ -- if (c != u) -+ if (variable_matches(utf8_name, utf8_size+1, name, &match)) { -+ if (variable_validate[i].validate == NULL) - break; -- -- /* Reached the end of the string while matching */ -- if (!c) -- return variable_validate[i].validate(var, -- match, data, len); -+ kfree(utf8_name); -+ return variable_validate[i].validate(var_name, match, -+ data, data_size); - } - } -- -+ kfree(utf8_name); - return true; - } - EXPORT_SYMBOL_GPL(efivar_validate); - -+bool -+efivar_variable_is_removable(efi_guid_t vendor, const char *var_name, -+ size_t len) -+{ -+ int i; -+ bool found = false; -+ int match = 0; -+ -+ /* -+ * Check if our variable is in the validated variables list -+ */ -+ for (i = 0; variable_validate[i].name[0] != '\0'; i++) { -+ if (efi_guidcmp(variable_validate[i].vendor, vendor)) -+ continue; -+ -+ if (variable_matches(var_name, len, -+ variable_validate[i].name, &match)) { -+ found = true; -+ break; -+ } -+ } -+ -+ /* -+ * If it's in our list, it is removable. -+ */ -+ return found; -+} -+EXPORT_SYMBOL_GPL(efivar_variable_is_removable); -+ - static efi_status_t - check_var_size(u32 attributes, unsigned long size) - { -@@ -805,7 +871,7 @@ int efivar_entry_set_get_size(struct efivar_entry *entry, u32 attributes, - - *set = false; - -- if (efivar_validate(&entry->var, data, *size) == false) -+ if (efivar_validate(*vendor, name, data, *size) == false) - return -EINVAL; - - /* -diff --git a/fs/efivarfs/file.c b/fs/efivarfs/file.c -index 8dd524f32284..08f105a06fbf 100644 ---- a/fs/efivarfs/file.c -+++ b/fs/efivarfs/file.c -@@ -10,6 +10,7 @@ - #include - #include - #include -+#include - - #include "internal.h" - -@@ -108,9 +109,79 @@ out_free: - return size; - } - -+static int -+efivarfs_ioc_getxflags(struct file *file, void __user *arg) -+{ -+ struct inode *inode = file->f_mapping->host; -+ unsigned int i_flags; -+ unsigned int flags = 0; -+ -+ i_flags = inode->i_flags; -+ if (i_flags & S_IMMUTABLE) -+ flags |= FS_IMMUTABLE_FL; -+ -+ if (copy_to_user(arg, &flags, sizeof(flags))) -+ return -EFAULT; -+ return 0; -+} -+ -+static int -+efivarfs_ioc_setxflags(struct file *file, void __user *arg) -+{ -+ struct inode *inode = file->f_mapping->host; -+ unsigned int flags; -+ unsigned int i_flags = 0; -+ int error; -+ -+ if (!inode_owner_or_capable(inode)) -+ return -EACCES; -+ -+ if (copy_from_user(&flags, arg, sizeof(flags))) -+ return -EFAULT; -+ -+ if (flags & ~FS_IMMUTABLE_FL) -+ return -EOPNOTSUPP; -+ -+ if (!capable(CAP_LINUX_IMMUTABLE)) -+ return -EPERM; -+ -+ if (flags & FS_IMMUTABLE_FL) -+ i_flags |= S_IMMUTABLE; -+ -+ -+ error = mnt_want_write_file(file); -+ if (error) -+ return error; -+ -+ mutex_lock(&inode->i_mutex); -+ inode->i_flags &= ~S_IMMUTABLE; -+ inode->i_flags |= i_flags; -+ mutex_unlock(&inode->i_mutex); -+ -+ mnt_drop_write_file(file); -+ -+ return 0; -+} -+ -+long -+efivarfs_file_ioctl(struct file *file, unsigned int cmd, unsigned long p) -+{ -+ void __user *arg = (void __user *)p; -+ -+ switch (cmd) { -+ case FS_IOC_GETFLAGS: -+ return efivarfs_ioc_getxflags(file, arg); -+ case FS_IOC_SETFLAGS: -+ return efivarfs_ioc_setxflags(file, arg); -+ } -+ -+ return -ENOTTY; -+} -+ - const struct file_operations efivarfs_file_operations = { - .open = simple_open, - .read = efivarfs_file_read, - .write = efivarfs_file_write, - .llseek = no_llseek, -+ .unlocked_ioctl = efivarfs_file_ioctl, - }; -diff --git a/fs/efivarfs/inode.c b/fs/efivarfs/inode.c -index 07ab49745e31..7e7318f10575 100644 ---- a/fs/efivarfs/inode.c -+++ b/fs/efivarfs/inode.c -@@ -15,7 +15,8 @@ - #include "internal.h" - - struct inode *efivarfs_get_inode(struct super_block *sb, -- const struct inode *dir, int mode, dev_t dev) -+ const struct inode *dir, int mode, -+ dev_t dev, bool is_removable) - { - struct inode *inode = new_inode(sb); - -@@ -23,6 +24,7 @@ struct inode *efivarfs_get_inode(struct super_block *sb, - inode->i_ino = get_next_ino(); - inode->i_mode = mode; - inode->i_atime = inode->i_mtime = inode->i_ctime = CURRENT_TIME; -+ inode->i_flags = is_removable ? 0 : S_IMMUTABLE; - switch (mode & S_IFMT) { - case S_IFREG: - inode->i_fop = &efivarfs_file_operations; -@@ -102,22 +104,17 @@ static void efivarfs_hex_to_guid(const char *str, efi_guid_t *guid) - static int efivarfs_create(struct inode *dir, struct dentry *dentry, - umode_t mode, bool excl) - { -- struct inode *inode; -+ struct inode *inode = NULL; - struct efivar_entry *var; - int namelen, i = 0, err = 0; -+ bool is_removable = false; - - if (!efivarfs_valid_name(dentry->d_name.name, dentry->d_name.len)) - return -EINVAL; - -- inode = efivarfs_get_inode(dir->i_sb, dir, mode, 0); -- if (!inode) -- return -ENOMEM; -- - var = kzalloc(sizeof(struct efivar_entry), GFP_KERNEL); -- if (!var) { -- err = -ENOMEM; -- goto out; -- } -+ if (!var) -+ return -ENOMEM; - - /* length of the variable name itself: remove GUID and separator */ - namelen = dentry->d_name.len - EFI_VARIABLE_GUID_LEN - 1; -@@ -125,6 +122,16 @@ static int efivarfs_create(struct inode *dir, struct dentry *dentry, - efivarfs_hex_to_guid(dentry->d_name.name + namelen + 1, - &var->var.VendorGuid); - -+ if (efivar_variable_is_removable(var->var.VendorGuid, -+ dentry->d_name.name, namelen)) -+ is_removable = true; -+ -+ inode = efivarfs_get_inode(dir->i_sb, dir, mode, 0, is_removable); -+ if (!inode) { -+ err = -ENOMEM; -+ goto out; -+ } -+ - for (i = 0; i < namelen; i++) - var->var.VariableName[i] = dentry->d_name.name[i]; - -@@ -138,7 +145,8 @@ static int efivarfs_create(struct inode *dir, struct dentry *dentry, - out: - if (err) { - kfree(var); -- iput(inode); -+ if (inode) -+ iput(inode); - } - return err; - } -diff --git a/fs/efivarfs/internal.h b/fs/efivarfs/internal.h -index b5ff16addb7c..b4505188e799 100644 ---- a/fs/efivarfs/internal.h -+++ b/fs/efivarfs/internal.h -@@ -15,7 +15,8 @@ extern const struct file_operations efivarfs_file_operations; - extern const struct inode_operations efivarfs_dir_inode_operations; - extern bool efivarfs_valid_name(const char *str, int len); - extern struct inode *efivarfs_get_inode(struct super_block *sb, -- const struct inode *dir, int mode, dev_t dev); -+ const struct inode *dir, int mode, dev_t dev, -+ bool is_removable); - - extern struct list_head efivarfs_list; - -diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c -index becc725a1953..a3a30f84f917 100644 ---- a/fs/efivarfs/super.c -+++ b/fs/efivarfs/super.c -@@ -118,8 +118,9 @@ static int efivarfs_callback(efi_char16_t *name16, efi_guid_t vendor, - struct dentry *dentry, *root = sb->s_root; - unsigned long size = 0; - char *name; -- int len, i; -+ int len; - int err = -ENOMEM; -+ bool is_removable = false; - - entry = kmalloc(sizeof(*entry), GFP_KERNEL); - if (!entry) -@@ -128,15 +129,17 @@ static int efivarfs_callback(efi_char16_t *name16, efi_guid_t vendor, - memcpy(entry->var.VariableName, name16, name_size); - memcpy(&(entry->var.VendorGuid), &vendor, sizeof(efi_guid_t)); - -- len = ucs2_strlen(entry->var.VariableName); -+ len = ucs2_utf8size(entry->var.VariableName); - - /* name, plus '-', plus GUID, plus NUL*/ - name = kmalloc(len + 1 + EFI_VARIABLE_GUID_LEN + 1, GFP_KERNEL); - if (!name) - goto fail; - -- for (i = 0; i < len; i++) -- name[i] = entry->var.VariableName[i] & 0xFF; -+ ucs2_as_utf8(name, entry->var.VariableName, len); -+ -+ if (efivar_variable_is_removable(entry->var.VendorGuid, name, len)) -+ is_removable = true; - - name[len] = '-'; - -@@ -144,7 +147,8 @@ static int efivarfs_callback(efi_char16_t *name16, efi_guid_t vendor, - - name[len + EFI_VARIABLE_GUID_LEN+1] = '\0'; - -- inode = efivarfs_get_inode(sb, root->d_inode, S_IFREG | 0644, 0); -+ inode = efivarfs_get_inode(sb, root->d_inode, S_IFREG | 0644, 0, -+ is_removable); - if (!inode) - goto fail_name; - -@@ -200,7 +204,7 @@ static int efivarfs_fill_super(struct super_block *sb, void *data, int silent) - sb->s_d_op = &efivarfs_d_ops; - sb->s_time_gran = 1; - -- inode = efivarfs_get_inode(sb, NULL, S_IFDIR | 0755, 0); -+ inode = efivarfs_get_inode(sb, NULL, S_IFDIR | 0755, 0, true); - if (!inode) - return -ENOMEM; - inode->i_op = &efivarfs_dir_inode_operations; -diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h -index 2f38daaab3d7..d61c11170213 100644 ---- a/include/crypto/if_alg.h -+++ b/include/crypto/if_alg.h -@@ -30,8 +30,6 @@ struct alg_sock { - - struct sock *parent; - -- unsigned int refcnt; -- - const struct af_alg_type *type; - void *private; - }; -@@ -66,7 +64,6 @@ int af_alg_register_type(const struct af_alg_type *type); - int af_alg_unregister_type(const struct af_alg_type *type); - - int af_alg_release(struct socket *sock); --void af_alg_release_parent(struct sock *sk); - int af_alg_accept(struct sock *sk, struct socket *newsock); - - int af_alg_make_sg(struct af_alg_sgl *sgl, void __user *addr, int len, -@@ -83,6 +80,11 @@ static inline struct alg_sock *alg_sk(struct sock *sk) - return (struct alg_sock *)sk; - } - -+static inline void af_alg_release_parent(struct sock *sk) -+{ -+ sock_put(alg_sk(sk)->parent); -+} -+ - static inline void af_alg_init_completion(struct af_alg_completion *completion) - { - init_completion(&completion->completion); -diff --git a/include/linux/efi.h b/include/linux/efi.h -index 0a819e7a60c9..b39a4651360a 100644 ---- a/include/linux/efi.h -+++ b/include/linux/efi.h -@@ -792,8 +792,10 @@ struct efivars { - * and we use a page for reading/writing. - */ - -+#define EFI_VAR_NAME_LEN 1024 -+ - struct efi_variable { -- efi_char16_t VariableName[1024/sizeof(efi_char16_t)]; -+ efi_char16_t VariableName[EFI_VAR_NAME_LEN/sizeof(efi_char16_t)]; - efi_guid_t VendorGuid; - unsigned long DataSize; - __u8 Data[1024]; -@@ -864,7 +866,10 @@ int efivar_entry_iter(int (*func)(struct efivar_entry *, void *), - struct efivar_entry *efivar_entry_find(efi_char16_t *name, efi_guid_t guid, - struct list_head *head, bool remove); - --bool efivar_validate(struct efi_variable *var, u8 *data, unsigned long len); -+bool efivar_validate(efi_guid_t vendor, efi_char16_t *var_name, u8 *data, -+ unsigned long data_size); -+bool efivar_variable_is_removable(efi_guid_t vendor, const char *name, -+ size_t len); - - extern struct work_struct efivar_work; - void efivar_run_worker(void); -diff --git a/include/linux/module.h b/include/linux/module.h -index eaf60ff9ba94..adea1d663a06 100644 ---- a/include/linux/module.h -+++ b/include/linux/module.h -@@ -227,6 +227,12 @@ struct module_ref { - unsigned long decs; - } __attribute((aligned(2 * sizeof(unsigned long)))); - -+struct mod_kallsyms { -+ Elf_Sym *symtab; -+ unsigned int num_symtab; -+ char *strtab; -+}; -+ - struct module { - enum module_state state; - -@@ -314,14 +320,9 @@ struct module { - #endif - - #ifdef CONFIG_KALLSYMS -- /* -- * We keep the symbol and string tables for kallsyms. -- * The core_* fields below are temporary, loader-only (they -- * could really be discarded after module init). -- */ -- Elf_Sym *symtab, *core_symtab; -- unsigned int num_symtab, core_num_syms; -- char *strtab, *core_strtab; -+ /* Protected by RCU and/or module_mutex: use rcu_dereference() */ -+ struct mod_kallsyms *kallsyms; -+ struct mod_kallsyms core_kallsyms; - - /* Section attributes */ - struct module_sect_attrs *sect_attrs; -diff --git a/include/linux/tracepoint.h b/include/linux/tracepoint.h -index 97c8689c7e51..326f8b238c31 100644 ---- a/include/linux/tracepoint.h -+++ b/include/linux/tracepoint.h -@@ -129,9 +129,6 @@ static inline void tracepoint_synchronize_unregister(void) - void *it_func; \ - void *__data; \ - \ -- if (!cpu_online(raw_smp_processor_id())) \ -- return; \ -- \ - if (!(cond)) \ - return; \ - prercu; \ -@@ -265,15 +262,19 @@ static inline void tracepoint_synchronize_unregister(void) - * "void *__data, proto" as the callback prototype. - */ - #define DECLARE_TRACE_NOARGS(name) \ -- __DECLARE_TRACE(name, void, , 1, void *__data, __data) -+ __DECLARE_TRACE(name, void, , \ -+ cpu_online(raw_smp_processor_id()), \ -+ void *__data, __data) - - #define DECLARE_TRACE(name, proto, args) \ -- __DECLARE_TRACE(name, PARAMS(proto), PARAMS(args), 1, \ -- PARAMS(void *__data, proto), \ -- PARAMS(__data, args)) -+ __DECLARE_TRACE(name, PARAMS(proto), PARAMS(args), \ -+ cpu_online(raw_smp_processor_id()), \ -+ PARAMS(void *__data, proto), \ -+ PARAMS(__data, args)) - - #define DECLARE_TRACE_CONDITION(name, proto, args, cond) \ -- __DECLARE_TRACE(name, PARAMS(proto), PARAMS(args), PARAMS(cond), \ -+ __DECLARE_TRACE(name, PARAMS(proto), PARAMS(args), \ -+ cpu_online(raw_smp_processor_id()) && (PARAMS(cond)), \ - PARAMS(void *__data, proto), \ - PARAMS(__data, args)) - -diff --git a/include/linux/ucs2_string.h b/include/linux/ucs2_string.h -index cbb20afdbc01..bb679b48f408 100644 ---- a/include/linux/ucs2_string.h -+++ b/include/linux/ucs2_string.h -@@ -11,4 +11,8 @@ unsigned long ucs2_strlen(const ucs2_char_t *s); - unsigned long ucs2_strsize(const ucs2_char_t *data, unsigned long maxlength); - int ucs2_strncmp(const ucs2_char_t *a, const ucs2_char_t *b, size_t len); - -+unsigned long ucs2_utf8size(const ucs2_char_t *src); -+unsigned long ucs2_as_utf8(u8 *dest, const ucs2_char_t *src, -+ unsigned long maxlength); -+ - #endif /* _LINUX_UCS2_STRING_H_ */ -diff --git a/kernel/module.c b/kernel/module.c -index e40617fac8ad..3a311a1d26d7 100644 ---- a/kernel/module.c -+++ b/kernel/module.c -@@ -180,6 +180,9 @@ struct load_info { - struct _ddebug *debug; - unsigned int num_debug; - bool sig_ok; -+#ifdef CONFIG_KALLSYMS -+ unsigned long mod_kallsyms_init_off; -+#endif - struct { - unsigned int sym, str, mod, vers, info, pcpu; - } index; -@@ -2320,8 +2323,20 @@ static void layout_symtab(struct module *mod, struct load_info *info) - strsect->sh_entsize = get_offset(mod, &mod->init_size, strsect, - info->index.str) | INIT_OFFSET_MASK; - pr_debug("\t%s\n", info->secstrings + strsect->sh_name); -+ -+ /* We'll tack temporary mod_kallsyms on the end. */ -+ mod->init_size = ALIGN(mod->init_size, -+ __alignof__(struct mod_kallsyms)); -+ info->mod_kallsyms_init_off = mod->init_size; -+ mod->init_size += sizeof(struct mod_kallsyms); -+ mod->init_size = debug_align(mod->init_size); - } - -+/* -+ * We use the full symtab and strtab which layout_symtab arranged to -+ * be appended to the init section. Later we switch to the cut-down -+ * core-only ones. -+ */ - static void add_kallsyms(struct module *mod, const struct load_info *info) - { - unsigned int i, ndst; -@@ -2330,28 +2345,33 @@ static void add_kallsyms(struct module *mod, const struct load_info *info) - char *s; - Elf_Shdr *symsec = &info->sechdrs[info->index.sym]; - -- mod->symtab = (void *)symsec->sh_addr; -- mod->num_symtab = symsec->sh_size / sizeof(Elf_Sym); -+ /* Set up to point into init section. */ -+ mod->kallsyms = mod->module_init + info->mod_kallsyms_init_off; -+ -+ mod->kallsyms->symtab = (void *)symsec->sh_addr; -+ mod->kallsyms->num_symtab = symsec->sh_size / sizeof(Elf_Sym); - /* Make sure we get permanent strtab: don't use info->strtab. */ -- mod->strtab = (void *)info->sechdrs[info->index.str].sh_addr; -+ mod->kallsyms->strtab = (void *)info->sechdrs[info->index.str].sh_addr; - - /* Set types up while we still have access to sections. */ -- for (i = 0; i < mod->num_symtab; i++) -- mod->symtab[i].st_info = elf_type(&mod->symtab[i], info); -- -- mod->core_symtab = dst = mod->module_core + info->symoffs; -- mod->core_strtab = s = mod->module_core + info->stroffs; -- src = mod->symtab; -- for (ndst = i = 0; i < mod->num_symtab; i++) { -+ for (i = 0; i < mod->kallsyms->num_symtab; i++) -+ mod->kallsyms->symtab[i].st_info -+ = elf_type(&mod->kallsyms->symtab[i], info); -+ -+ /* Now populate the cut down core kallsyms for after init. */ -+ mod->core_kallsyms.symtab = dst = mod->module_core + info->symoffs; -+ mod->core_kallsyms.strtab = s = mod->module_core + info->stroffs; -+ src = mod->kallsyms->symtab; -+ for (ndst = i = 0; i < mod->kallsyms->num_symtab; i++) { - if (i == 0 || - is_core_symbol(src+i, info->sechdrs, info->hdr->e_shnum)) { - dst[ndst] = src[i]; -- dst[ndst++].st_name = s - mod->core_strtab; -- s += strlcpy(s, &mod->strtab[src[i].st_name], -+ dst[ndst++].st_name = s - mod->core_kallsyms.strtab; -+ s += strlcpy(s, &mod->kallsyms->strtab[src[i].st_name], - KSYM_NAME_LEN) + 1; - } - } -- mod->core_num_syms = ndst; -+ mod->core_kallsyms.num_symtab = ndst; - } - #else - static inline void layout_symtab(struct module *mod, struct load_info *info) -@@ -3089,9 +3109,8 @@ static int do_init_module(struct module *mod) - module_put(mod); - trim_init_extable(mod); - #ifdef CONFIG_KALLSYMS -- mod->num_symtab = mod->core_num_syms; -- mod->symtab = mod->core_symtab; -- mod->strtab = mod->core_strtab; -+ /* Switch to core kallsyms now init is done: kallsyms may be walking! */ -+ rcu_assign_pointer(mod->kallsyms, &mod->core_kallsyms); - #endif - unset_module_init_ro_nx(mod); - module_free(mod, mod->module_init); -@@ -3381,9 +3400,9 @@ static inline int is_arm_mapping_symbol(const char *str) - && (str[2] == '\0' || str[2] == '.'); - } - --static const char *symname(struct module *mod, unsigned int symnum) -+static const char *symname(struct mod_kallsyms *kallsyms, unsigned int symnum) - { -- return mod->strtab + mod->symtab[symnum].st_name; -+ return kallsyms->strtab + kallsyms->symtab[symnum].st_name; - } - - static const char *get_ksymbol(struct module *mod, -@@ -3393,6 +3412,7 @@ static const char *get_ksymbol(struct module *mod, - { - unsigned int i, best = 0; - unsigned long nextval; -+ struct mod_kallsyms *kallsyms = rcu_dereference_sched(mod->kallsyms); - - /* At worse, next value is at end of module */ - if (within_module_init(addr, mod)) -@@ -3402,32 +3422,32 @@ static const char *get_ksymbol(struct module *mod, - - /* Scan for closest preceding symbol, and next symbol. (ELF - starts real symbols at 1). */ -- for (i = 1; i < mod->num_symtab; i++) { -- if (mod->symtab[i].st_shndx == SHN_UNDEF) -+ for (i = 1; i < kallsyms->num_symtab; i++) { -+ if (kallsyms->symtab[i].st_shndx == SHN_UNDEF) - continue; - - /* We ignore unnamed symbols: they're uninformative - * and inserted at a whim. */ -- if (*symname(mod, i) == '\0' -- || is_arm_mapping_symbol(symname(mod, i))) -+ if (*symname(kallsyms, i) == '\0' -+ || is_arm_mapping_symbol(symname(kallsyms, i))) - continue; - -- if (mod->symtab[i].st_value <= addr -- && mod->symtab[i].st_value > mod->symtab[best].st_value) -+ if (kallsyms->symtab[i].st_value <= addr -+ && kallsyms->symtab[i].st_value > kallsyms->symtab[best].st_value) - best = i; -- if (mod->symtab[i].st_value > addr -- && mod->symtab[i].st_value < nextval) -- nextval = mod->symtab[i].st_value; -+ if (kallsyms->symtab[i].st_value > addr -+ && kallsyms->symtab[i].st_value < nextval) -+ nextval = kallsyms->symtab[i].st_value; - } - - if (!best) - return NULL; - - if (size) -- *size = nextval - mod->symtab[best].st_value; -+ *size = nextval - kallsyms->symtab[best].st_value; - if (offset) -- *offset = addr - mod->symtab[best].st_value; -- return symname(mod, best); -+ *offset = addr - kallsyms->symtab[best].st_value; -+ return symname(kallsyms, best); - } - - /* For kallsyms to ask for address resolution. NULL means not found. Careful -@@ -3523,18 +3543,21 @@ int module_get_kallsym(unsigned int symnum, unsigned long *value, char *type, - - preempt_disable(); - list_for_each_entry_rcu(mod, &modules, list) { -+ struct mod_kallsyms *kallsyms; -+ - if (mod->state == MODULE_STATE_UNFORMED) - continue; -- if (symnum < mod->num_symtab) { -- *value = mod->symtab[symnum].st_value; -- *type = mod->symtab[symnum].st_info; -- strlcpy(name, symname(mod, symnum), KSYM_NAME_LEN); -+ kallsyms = rcu_dereference_sched(mod->kallsyms); -+ if (symnum < kallsyms->num_symtab) { -+ *value = kallsyms->symtab[symnum].st_value; -+ *type = kallsyms->symtab[symnum].st_info; -+ strlcpy(name, symname(kallsyms, symnum), KSYM_NAME_LEN); - strlcpy(module_name, mod->name, MODULE_NAME_LEN); - *exported = is_exported(name, *value, mod); - preempt_enable(); - return 0; - } -- symnum -= mod->num_symtab; -+ symnum -= kallsyms->num_symtab; - } - preempt_enable(); - return -ERANGE; -@@ -3543,11 +3566,12 @@ int module_get_kallsym(unsigned int symnum, unsigned long *value, char *type, - static unsigned long mod_find_symname(struct module *mod, const char *name) - { - unsigned int i; -+ struct mod_kallsyms *kallsyms = rcu_dereference_sched(mod->kallsyms); - -- for (i = 0; i < mod->num_symtab; i++) -- if (strcmp(name, symname(mod, i)) == 0 && -- mod->symtab[i].st_info != 'U') -- return mod->symtab[i].st_value; -+ for (i = 0; i < kallsyms->num_symtab; i++) -+ if (strcmp(name, symname(kallsyms, i)) == 0 && -+ kallsyms->symtab[i].st_info != 'U') -+ return kallsyms->symtab[i].st_value; - return 0; - } - -@@ -3584,11 +3608,14 @@ int module_kallsyms_on_each_symbol(int (*fn)(void *, const char *, - int ret; - - list_for_each_entry(mod, &modules, list) { -+ /* We hold module_mutex: no need for rcu_dereference_sched */ -+ struct mod_kallsyms *kallsyms = mod->kallsyms; -+ - if (mod->state == MODULE_STATE_UNFORMED) - continue; -- for (i = 0; i < mod->num_symtab; i++) { -- ret = fn(data, symname(mod, i), -- mod, mod->symtab[i].st_value); -+ for (i = 0; i < kallsyms->num_symtab; i++) { -+ ret = fn(data, symname(kallsyms, i), -+ mod, kallsyms->symtab[i].st_value); - if (ret != 0) - return ret; - } -diff --git a/lib/ucs2_string.c b/lib/ucs2_string.c -index 6f500ef2301d..f0b323abb4c6 100644 ---- a/lib/ucs2_string.c -+++ b/lib/ucs2_string.c -@@ -49,3 +49,65 @@ ucs2_strncmp(const ucs2_char_t *a, const ucs2_char_t *b, size_t len) - } - } - EXPORT_SYMBOL(ucs2_strncmp); -+ -+unsigned long -+ucs2_utf8size(const ucs2_char_t *src) -+{ -+ unsigned long i; -+ unsigned long j = 0; -+ -+ for (i = 0; i < ucs2_strlen(src); i++) { -+ u16 c = src[i]; -+ -+ if (c >= 0x800) -+ j += 3; -+ else if (c >= 0x80) -+ j += 2; -+ else -+ j += 1; -+ } -+ -+ return j; -+} -+EXPORT_SYMBOL(ucs2_utf8size); -+ -+/* -+ * copy at most maxlength bytes of whole utf8 characters to dest from the -+ * ucs2 string src. -+ * -+ * The return value is the number of characters copied, not including the -+ * final NUL character. -+ */ -+unsigned long -+ucs2_as_utf8(u8 *dest, const ucs2_char_t *src, unsigned long maxlength) -+{ -+ unsigned int i; -+ unsigned long j = 0; -+ unsigned long limit = ucs2_strnlen(src, maxlength); -+ -+ for (i = 0; maxlength && i < limit; i++) { -+ u16 c = src[i]; -+ -+ if (c >= 0x800) { -+ if (maxlength < 3) -+ break; -+ maxlength -= 3; -+ dest[j++] = 0xe0 | (c & 0xf000) >> 12; -+ dest[j++] = 0x80 | (c & 0x0fc0) >> 6; -+ dest[j++] = 0x80 | (c & 0x003f); -+ } else if (c >= 0x80) { -+ if (maxlength < 2) -+ break; -+ maxlength -= 2; -+ dest[j++] = 0xc0 | (c & 0x7c0) >> 6; -+ dest[j++] = 0x80 | (c & 0x03f); -+ } else { -+ maxlength -= 1; -+ dest[j++] = c & 0x7f; -+ } -+ } -+ if (maxlength) -+ dest[j] = '\0'; -+ return j; -+} -+EXPORT_SYMBOL(ucs2_as_utf8); -diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c -index 31bf2586fb84..864408026202 100644 ---- a/net/mac80211/agg-rx.c -+++ b/net/mac80211/agg-rx.c -@@ -290,7 +290,7 @@ void ieee80211_process_addba_request(struct ieee80211_local *local, - } - - /* prepare A-MPDU MLME for Rx aggregation */ -- tid_agg_rx = kmalloc(sizeof(struct tid_ampdu_rx), GFP_KERNEL); -+ tid_agg_rx = kzalloc(sizeof(*tid_agg_rx), GFP_KERNEL); - if (!tid_agg_rx) - goto end; - -diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c -index c1b5b73c5b91..c3111e2b6fa0 100644 ---- a/net/mac80211/rc80211_minstrel_ht.c -+++ b/net/mac80211/rc80211_minstrel_ht.c -@@ -463,7 +463,7 @@ minstrel_aggr_check(struct ieee80211_sta *pubsta, struct sk_buff *skb) - if (skb_get_queue_mapping(skb) == IEEE80211_AC_VO) - return; - -- ieee80211_start_tx_ba_session(pubsta, tid, 5000); -+ ieee80211_start_tx_ba_session(pubsta, tid, 0); - } - - static void -diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c -index c8717c1d082e..87dd619fb2e9 100644 ---- a/net/wireless/wext-core.c -+++ b/net/wireless/wext-core.c -@@ -342,6 +342,39 @@ static const int compat_event_type_size[] = { - - /* IW event code */ - -+static void wireless_nlevent_flush(void) -+{ -+ struct sk_buff *skb; -+ struct net *net; -+ -+ ASSERT_RTNL(); -+ -+ for_each_net(net) { -+ while ((skb = skb_dequeue(&net->wext_nlevents))) -+ rtnl_notify(skb, net, 0, RTNLGRP_LINK, NULL, -+ GFP_KERNEL); -+ } -+} -+ -+static int wext_netdev_notifier_call(struct notifier_block *nb, -+ unsigned long state, void *ptr) -+{ -+ /* -+ * When a netdev changes state in any way, flush all pending messages -+ * to avoid them going out in a strange order, e.g. RTM_NEWLINK after -+ * RTM_DELLINK, or with IFF_UP after without IFF_UP during dev_close() -+ * or similar - all of which could otherwise happen due to delays from -+ * schedule_work(). -+ */ -+ wireless_nlevent_flush(); -+ -+ return NOTIFY_OK; -+} -+ -+static struct notifier_block wext_netdev_notifier = { -+ .notifier_call = wext_netdev_notifier_call, -+}; -+ - static int __net_init wext_pernet_init(struct net *net) - { - skb_queue_head_init(&net->wext_nlevents); -@@ -360,7 +393,12 @@ static struct pernet_operations wext_pernet_ops = { - - static int __init wireless_nlevent_init(void) - { -- return register_pernet_subsys(&wext_pernet_ops); -+ int err = register_pernet_subsys(&wext_pernet_ops); -+ -+ if (err) -+ return err; -+ -+ return register_netdevice_notifier(&wext_netdev_notifier); - } - - subsys_initcall(wireless_nlevent_init); -@@ -368,17 +406,8 @@ subsys_initcall(wireless_nlevent_init); - /* Process events generated by the wireless layer or the driver. */ - static void wireless_nlevent_process(struct work_struct *work) - { -- struct sk_buff *skb; -- struct net *net; -- - rtnl_lock(); -- -- for_each_net(net) { -- while ((skb = skb_dequeue(&net->wext_nlevents))) -- rtnl_notify(skb, net, 0, RTNLGRP_LINK, NULL, -- GFP_KERNEL); -- } -- -+ wireless_nlevent_flush(); - rtnl_unlock(); - } - -diff --git a/sound/soc/codecs/wm8958-dsp2.c b/sound/soc/codecs/wm8958-dsp2.c -index d4248e00160e..4f736197f6ee 100644 ---- a/sound/soc/codecs/wm8958-dsp2.c -+++ b/sound/soc/codecs/wm8958-dsp2.c -@@ -459,7 +459,7 @@ static int wm8958_put_mbc_enum(struct snd_kcontrol *kcontrol, - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec); - struct wm8994 *control = wm8994->wm8994; -- int value = ucontrol->value.integer.value[0]; -+ int value = ucontrol->value.enumerated.item[0]; - int reg; - - /* Don't allow on the fly reconfiguration */ -@@ -549,7 +549,7 @@ static int wm8958_put_vss_enum(struct snd_kcontrol *kcontrol, - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec); - struct wm8994 *control = wm8994->wm8994; -- int value = ucontrol->value.integer.value[0]; -+ int value = ucontrol->value.enumerated.item[0]; - int reg; - - /* Don't allow on the fly reconfiguration */ -@@ -582,7 +582,7 @@ static int wm8958_put_vss_hpf_enum(struct snd_kcontrol *kcontrol, - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec); - struct wm8994 *control = wm8994->wm8994; -- int value = ucontrol->value.integer.value[0]; -+ int value = ucontrol->value.enumerated.item[0]; - int reg; - - /* Don't allow on the fly reconfiguration */ -@@ -749,7 +749,7 @@ static int wm8958_put_enh_eq_enum(struct snd_kcontrol *kcontrol, - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec); - struct wm8994 *control = wm8994->wm8994; -- int value = ucontrol->value.integer.value[0]; -+ int value = ucontrol->value.enumerated.item[0]; - int reg; - - /* Don't allow on the fly reconfiguration */ -diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c -index 66aec0c3b7bb..355b07e4fe2a 100644 ---- a/sound/soc/codecs/wm8994.c -+++ b/sound/soc/codecs/wm8994.c -@@ -360,7 +360,7 @@ static int wm8994_put_drc_enum(struct snd_kcontrol *kcontrol, - struct wm8994 *control = wm8994->wm8994; - struct wm8994_pdata *pdata = &control->pdata; - int drc = wm8994_get_drc(kcontrol->id.name); -- int value = ucontrol->value.integer.value[0]; -+ int value = ucontrol->value.enumerated.item[0]; - - if (drc < 0) - return drc; -@@ -467,7 +467,7 @@ static int wm8994_put_retune_mobile_enum(struct snd_kcontrol *kcontrol, - struct wm8994 *control = wm8994->wm8994; - struct wm8994_pdata *pdata = &control->pdata; - int block = wm8994_get_retune_mobile_block(kcontrol->id.name); -- int value = ucontrol->value.integer.value[0]; -+ int value = ucontrol->value.enumerated.item[0]; - - if (block < 0) - return block; -diff --git a/tools/testing/selftests/efivarfs/efivarfs.sh b/tools/testing/selftests/efivarfs/efivarfs.sh -index 77edcdcc016b..057278448515 100644 ---- a/tools/testing/selftests/efivarfs/efivarfs.sh -+++ b/tools/testing/selftests/efivarfs/efivarfs.sh -@@ -88,7 +88,11 @@ test_delete() - exit 1 - fi - -- rm $file -+ rm $file 2>/dev/null -+ if [ $? -ne 0 ]; then -+ chattr -i $file -+ rm $file -+ fi - - if [ -e $file ]; then - echo "$file couldn't be deleted" >&2 -@@ -111,6 +115,7 @@ test_zero_size_delete() - exit 1 - fi - -+ chattr -i $file - printf "$attrs" > $file - - if [ -e $file ]; then -@@ -141,7 +146,11 @@ test_valid_filenames() - echo "$file could not be created" >&2 - ret=1 - else -- rm $file -+ rm $file 2>/dev/null -+ if [ $? -ne 0 ]; then -+ chattr -i $file -+ rm $file -+ fi - fi - done - -@@ -174,7 +183,11 @@ test_invalid_filenames() - - if [ -e $file ]; then - echo "Creating $file should have failed" >&2 -- rm $file -+ rm $file 2>/dev/null -+ if [ $? -ne 0 ]; then -+ chattr -i $file -+ rm $file -+ fi - ret=1 - fi - done -diff --git a/tools/testing/selftests/efivarfs/open-unlink.c b/tools/testing/selftests/efivarfs/open-unlink.c -index 8c0764407b3c..4af74f733036 100644 ---- a/tools/testing/selftests/efivarfs/open-unlink.c -+++ b/tools/testing/selftests/efivarfs/open-unlink.c -@@ -1,10 +1,68 @@ -+#include - #include - #include - #include - #include -+#include - #include - #include - #include -+#include -+ -+static int set_immutable(const char *path, int immutable) -+{ -+ unsigned int flags; -+ int fd; -+ int rc; -+ int error; -+ -+ fd = open(path, O_RDONLY); -+ if (fd < 0) -+ return fd; -+ -+ rc = ioctl(fd, FS_IOC_GETFLAGS, &flags); -+ if (rc < 0) { -+ error = errno; -+ close(fd); -+ errno = error; -+ return rc; -+ } -+ -+ if (immutable) -+ flags |= FS_IMMUTABLE_FL; -+ else -+ flags &= ~FS_IMMUTABLE_FL; -+ -+ rc = ioctl(fd, FS_IOC_SETFLAGS, &flags); -+ error = errno; -+ close(fd); -+ errno = error; -+ return rc; -+} -+ -+static int get_immutable(const char *path) -+{ -+ unsigned int flags; -+ int fd; -+ int rc; -+ int error; -+ -+ fd = open(path, O_RDONLY); -+ if (fd < 0) -+ return fd; -+ -+ rc = ioctl(fd, FS_IOC_GETFLAGS, &flags); -+ if (rc < 0) { -+ error = errno; -+ close(fd); -+ errno = error; -+ return rc; -+ } -+ close(fd); -+ if (flags & FS_IMMUTABLE_FL) -+ return 1; -+ return 0; -+} - - int main(int argc, char **argv) - { -@@ -27,7 +85,7 @@ int main(int argc, char **argv) - buf[4] = 0; - - /* create a test variable */ -- fd = open(path, O_WRONLY | O_CREAT); -+ fd = open(path, O_WRONLY | O_CREAT, 0600); - if (fd < 0) { - perror("open(O_WRONLY)"); - return EXIT_FAILURE; -@@ -41,6 +99,18 @@ int main(int argc, char **argv) - - close(fd); - -+ rc = get_immutable(path); -+ if (rc < 0) { -+ perror("ioctl(FS_IOC_GETFLAGS)"); -+ return EXIT_FAILURE; -+ } else if (rc) { -+ rc = set_immutable(path, 0); -+ if (rc < 0) { -+ perror("ioctl(FS_IOC_SETFLAGS)"); -+ return EXIT_FAILURE; -+ } -+ } -+ - fd = open(path, O_RDONLY); - if (fd < 0) { - perror("open");