diff --git a/config/linux-sun5i-default.config b/config/linux-sun5i-default.config new file mode 100644 index 0000000000..e0efbbda09 --- /dev/null +++ b/config/linux-sun5i-default.config @@ -0,0 +1,2420 @@ +# +# Automatically generated file; DO NOT EDIT. +# Linux/arm 3.4.104 Kernel Configuration +# +CONFIG_ARM=y +CONFIG_SYS_SUPPORTS_APM_EMULATION=y +CONFIG_GENERIC_GPIO=y +# CONFIG_ARCH_USES_GETTIMEOFFSET is not set +CONFIG_GENERIC_CLOCKEVENTS=y +CONFIG_KTIME_SCALAR=y +CONFIG_HAVE_PROC_CPU=y +CONFIG_STACKTRACE_SUPPORT=y +CONFIG_HAVE_LATENCYTOP_SUPPORT=y +CONFIG_LOCKDEP_SUPPORT=y +CONFIG_TRACE_IRQFLAGS_SUPPORT=y +CONFIG_HARDIRQS_SW_RESEND=y +CONFIG_GENERIC_IRQ_PROBE=y +CONFIG_RWSEM_GENERIC_SPINLOCK=y +CONFIG_ARCH_HAS_CPUFREQ=y +CONFIG_ARCH_HAS_CPU_IDLE_WAIT=y +CONFIG_GENERIC_HWEIGHT=y +CONFIG_GENERIC_CALIBRATE_DELAY=y +CONFIG_ZONE_DMA=y +CONFIG_NEED_DMA_MAP_STATE=y +CONFIG_VECTORS_BASE=0xffff0000 +CONFIG_ARM_PATCH_PHYS_VIRT=y +CONFIG_NEED_MACH_IO_H=y +CONFIG_GENERIC_BUG=y +CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config" +CONFIG_HAVE_IRQ_WORK=y +CONFIG_IRQ_WORK=y + +# +# General setup +# +CONFIG_EXPERIMENTAL=y +CONFIG_BROKEN_ON_SMP=y +CONFIG_INIT_ENV_ARG_LIMIT=32 +CONFIG_CROSS_COMPILE="" +CONFIG_LOCALVERSION="" +CONFIG_LOCALVERSION_AUTO=y +CONFIG_HAVE_KERNEL_GZIP=y +CONFIG_HAVE_KERNEL_LZMA=y +CONFIG_HAVE_KERNEL_XZ=y +CONFIG_HAVE_KERNEL_LZO=y +CONFIG_KERNEL_GZIP=y +# CONFIG_KERNEL_LZMA is not set +# CONFIG_KERNEL_XZ is not set +# CONFIG_KERNEL_LZO is not set +CONFIG_DEFAULT_HOSTNAME="(none)" +CONFIG_SWAP=y +CONFIG_SYSVIPC=y +CONFIG_SYSVIPC_SYSCTL=y +# CONFIG_POSIX_MQUEUE is not set +CONFIG_BSD_PROCESS_ACCT=y +CONFIG_BSD_PROCESS_ACCT_V3=y +# CONFIG_FHANDLE is not set +CONFIG_TASKSTATS=y +CONFIG_TASK_DELAY_ACCT=y +CONFIG_TASK_XACCT=y +CONFIG_TASK_IO_ACCOUNTING=y +CONFIG_AUDIT=y +# CONFIG_AUDITSYSCALL is not set +# CONFIG_AUDIT_LOGINUID_IMMUTABLE is not set +CONFIG_HAVE_GENERIC_HARDIRQS=y +SUN4I_GPIO_UGLY=y + +# +# IRQ subsystem +# +CONFIG_GENERIC_HARDIRQS=y +CONFIG_GENERIC_IRQ_SHOW=y + +# +# RCU Subsystem +# +CONFIG_TINY_PREEMPT_RCU=y +CONFIG_PREEMPT_RCU=y +# CONFIG_TREE_RCU_TRACE is not set +# CONFIG_RCU_BOOST is not set +CONFIG_IKCONFIG=y +CONFIG_IKCONFIG_PROC=y +CONFIG_LOG_BUF_SHIFT=19 +CONFIG_CGROUPS=y +# CONFIG_CGROUP_DEBUG is not set +CONFIG_CGROUP_FREEZER=y +CONFIG_CGROUP_DEVICE=y +CONFIG_CPUSETS=y +CONFIG_PROC_PID_CPUSET=y +CONFIG_CGROUP_CPUACCT=y +CONFIG_RESOURCE_COUNTERS=y +# CONFIG_CGROUP_MEM_RES_CTLR is not set +# CONFIG_CGROUP_PERF is not set +# CONFIG_CGROUP_SCHED is not set +CONFIG_BLK_CGROUP=y +# CONFIG_DEBUG_BLK_CGROUP is not set +# CONFIG_CHECKPOINT_RESTORE is not set +CONFIG_NAMESPACES=y +CONFIG_UTS_NS=y +CONFIG_IPC_NS=y +CONFIG_USER_NS=y +CONFIG_PID_NS=y +CONFIG_NET_NS=y +# CONFIG_SCHED_AUTOGROUP is not set +# CONFIG_SYSFS_DEPRECATED is not set +CONFIG_RELAY=y +CONFIG_BLK_DEV_INITRD=y +CONFIG_INITRAMFS_SOURCE="" +CONFIG_RD_GZIP=y +CONFIG_RD_BZIP2=y +CONFIG_RD_LZMA=y +CONFIG_RD_XZ=y +CONFIG_RD_LZO=y +# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set +CONFIG_SYSCTL=y +CONFIG_ANON_INODES=y +CONFIG_PANIC_TIMEOUT=0 +# CONFIG_EXPERT is not set +CONFIG_UID16=y +# CONFIG_SYSCTL_SYSCALL is not set +CONFIG_KALLSYMS=y +CONFIG_KALLSYMS_ALL=y +CONFIG_HOTPLUG=y +CONFIG_PRINTK=y +CONFIG_BUG=y +CONFIG_ELF_CORE=y +CONFIG_BASE_FULL=y +CONFIG_FUTEX=y +CONFIG_EPOLL=y +CONFIG_SIGNALFD=y +CONFIG_TIMERFD=y +CONFIG_EVENTFD=y +CONFIG_SHMEM=y +CONFIG_AIO=y +# CONFIG_EMBEDDED is not set +CONFIG_HAVE_PERF_EVENTS=y +CONFIG_PERF_USE_VMALLOC=y + +# +# Kernel Performance Events And Counters +# +CONFIG_PERF_EVENTS=y +CONFIG_PERF_COUNTERS=y +# CONFIG_DEBUG_PERF_USE_VMALLOC is not set +CONFIG_VM_EVENT_COUNTERS=y +CONFIG_SLUB_DEBUG=y +# CONFIG_COMPAT_BRK is not set +# CONFIG_SLAB is not set +CONFIG_SLUB=y +# CONFIG_PROFILING is not set +CONFIG_HAVE_OPROFILE=y +# CONFIG_KPROBES is not set +# CONFIG_JUMP_LABEL is not set +CONFIG_HAVE_KPROBES=y +CONFIG_HAVE_KRETPROBES=y +CONFIG_HAVE_DMA_ATTRS=y +CONFIG_HAVE_DMA_CONTIGUOUS=y +CONFIG_HAVE_REGS_AND_STACK_ACCESS_API=y +CONFIG_HAVE_CLK=y +CONFIG_HAVE_DMA_API_DEBUG=y +CONFIG_HAVE_HW_BREAKPOINT=y +CONFIG_HAVE_ARCH_JUMP_LABEL=y +CONFIG_HAVE_ARCH_SECCOMP_FILTER=y + +# +# GCOV-based kernel profiling +# +# CONFIG_GCOV_KERNEL is not set +CONFIG_HAVE_GENERIC_DMA_COHERENT=y +CONFIG_SLABINFO=y +CONFIG_RT_MUTEXES=y +CONFIG_BASE_SMALL=0 +CONFIG_MODULES=y +CONFIG_MODULE_FORCE_LOAD=y +CONFIG_MODULE_UNLOAD=y +# CONFIG_MODULE_FORCE_UNLOAD is not set +CONFIG_MODVERSIONS=y +CONFIG_MODULE_SRCVERSION_ALL=y +CONFIG_BLOCK=y +CONFIG_LBDAF=y +CONFIG_BLK_DEV_BSG=y +# CONFIG_BLK_DEV_BSGLIB is not set +CONFIG_BLK_DEV_INTEGRITY=y +# CONFIG_BLK_DEV_THROTTLING is not set + +# +# Partition Types +# +CONFIG_PARTITION_ADVANCED=y +# CONFIG_ACORN_PARTITION is not set +CONFIG_OSF_PARTITION=y +CONFIG_AMIGA_PARTITION=y +# CONFIG_ATARI_PARTITION is not set +CONFIG_MAC_PARTITION=y +CONFIG_MSDOS_PARTITION=y +CONFIG_BSD_DISKLABEL=y +CONFIG_MINIX_SUBPARTITION=y +CONFIG_SOLARIS_X86_PARTITION=y +CONFIG_UNIXWARE_DISKLABEL=y +# CONFIG_LDM_PARTITION is not set +CONFIG_SGI_PARTITION=y +# CONFIG_ULTRIX_PARTITION is not set +CONFIG_SUN_PARTITION=y +CONFIG_KARMA_PARTITION=y +CONFIG_EFI_PARTITION=y +# CONFIG_SYSV68_PARTITION is not set +CONFIG_SUNXI_NAND_PARTITION=y + +# +# IO Schedulers +# +CONFIG_IOSCHED_NOOP=y +CONFIG_IOSCHED_DEADLINE=y +CONFIG_IOSCHED_CFQ=y +CONFIG_CFQ_GROUP_IOSCHED=y +# CONFIG_DEFAULT_DEADLINE is not set +CONFIG_DEFAULT_CFQ=y +# CONFIG_DEFAULT_NOOP is not set +CONFIG_DEFAULT_IOSCHED="cfq" +# CONFIG_INLINE_SPIN_TRYLOCK is not set +# CONFIG_INLINE_SPIN_TRYLOCK_BH is not set +# CONFIG_INLINE_SPIN_LOCK is not set +# CONFIG_INLINE_SPIN_LOCK_BH is not set +# CONFIG_INLINE_SPIN_LOCK_IRQ is not set +# CONFIG_INLINE_SPIN_LOCK_IRQSAVE is not set +CONFIG_UNINLINE_SPIN_UNLOCK=y +# CONFIG_INLINE_SPIN_UNLOCK_BH is not set +# CONFIG_INLINE_SPIN_UNLOCK_IRQ is not set +# CONFIG_INLINE_SPIN_UNLOCK_IRQRESTORE is not set +# CONFIG_INLINE_READ_TRYLOCK is not set +# CONFIG_INLINE_READ_LOCK is not set +# CONFIG_INLINE_READ_LOCK_BH is not set +# CONFIG_INLINE_READ_LOCK_IRQ is not set +# CONFIG_INLINE_READ_LOCK_IRQSAVE is not set +# CONFIG_INLINE_READ_UNLOCK is not set +# CONFIG_INLINE_READ_UNLOCK_BH is not set +# CONFIG_INLINE_READ_UNLOCK_IRQ is not set +# CONFIG_INLINE_READ_UNLOCK_IRQRESTORE is not set +# CONFIG_INLINE_WRITE_TRYLOCK is not set +# CONFIG_INLINE_WRITE_LOCK is not set +# CONFIG_INLINE_WRITE_LOCK_BH is not set +# CONFIG_INLINE_WRITE_LOCK_IRQ is not set +# CONFIG_INLINE_WRITE_LOCK_IRQSAVE is not set +# CONFIG_INLINE_WRITE_UNLOCK is not set +# CONFIG_INLINE_WRITE_UNLOCK_BH is not set +# CONFIG_INLINE_WRITE_UNLOCK_IRQ is not set +# CONFIG_INLINE_WRITE_UNLOCK_IRQRESTORE is not set +# CONFIG_MUTEX_SPIN_ON_OWNER is not set +CONFIG_FREEZER=y + +# +# System Type +# +CONFIG_MMU=y +# CONFIG_ARCH_INTEGRATOR is not set +# CONFIG_ARCH_REALVIEW is not set +# CONFIG_ARCH_VERSATILE is not set +# CONFIG_ARCH_VEXPRESS is not set +# CONFIG_ARCH_AT91 is not set +# CONFIG_ARCH_BCMRING is not set +# CONFIG_ARCH_HIGHBANK is not set +# CONFIG_ARCH_CLPS711X is not set +# CONFIG_ARCH_CNS3XXX is not set +# CONFIG_ARCH_GEMINI is not set +# CONFIG_ARCH_PRIMA2 is not set +# CONFIG_ARCH_EBSA110 is not set +# CONFIG_ARCH_EP93XX is not set +# CONFIG_ARCH_FOOTBRIDGE is not set +# CONFIG_ARCH_MXC is not set +# CONFIG_ARCH_MXS is not set +# CONFIG_ARCH_NETX is not set +# CONFIG_ARCH_H720X is not set +# CONFIG_ARCH_IOP13XX is not set +# CONFIG_ARCH_IOP32X is not set +# CONFIG_ARCH_IOP33X is not set +# CONFIG_ARCH_IXP23XX is not set +# CONFIG_ARCH_IXP2000 is not set +# CONFIG_ARCH_IXP4XX is not set +# CONFIG_ARCH_DOVE is not set +# CONFIG_ARCH_KIRKWOOD is not set +# CONFIG_ARCH_LPC32XX is not set +# CONFIG_ARCH_MV78XX0 is not set +# CONFIG_ARCH_ORION5X is not set +# CONFIG_ARCH_MMP is not set +# CONFIG_ARCH_KS8695 is not set +# CONFIG_ARCH_W90X900 is not set +# CONFIG_ARCH_TEGRA is not set +# CONFIG_ARCH_PICOXCELL is not set +# CONFIG_ARCH_SUN4I is not set +CONFIG_ARCH_SUN5I=y +# CONFIG_ARCH_SUN7I is not set +# CONFIG_ARCH_PNX4008 is not set +# CONFIG_ARCH_PXA is not set +# CONFIG_ARCH_MSM is not set +# CONFIG_ARCH_SHMOBILE is not set +# CONFIG_ARCH_RPC is not set +# CONFIG_ARCH_SA1100 is not set +# CONFIG_ARCH_S3C24XX is not set +# CONFIG_ARCH_S3C64XX is not set +# CONFIG_ARCH_S5P64X0 is not set +# CONFIG_ARCH_S5PC100 is not set +# CONFIG_ARCH_S5PV210 is not set +# CONFIG_ARCH_EXYNOS is not set +# CONFIG_ARCH_SHARK is not set +# CONFIG_ARCH_U300 is not set +# CONFIG_ARCH_U8500 is not set +# CONFIG_ARCH_NOMADIK is not set +# CONFIG_ARCH_DAVINCI is not set +# CONFIG_ARCH_OMAP is not set +# CONFIG_PLAT_SPEAR is not set +# CONFIG_ARCH_VT8500 is not set +# CONFIG_ARCH_ZYNQ is not set +# CONFIG_GPIO_PCA953X is not set +# CONFIG_KEYBOARD_GPIO_POLLED is not set + +# +# System MMU +# + +# +# Allwinner's sunxi options +# +CONFIG_SW_DEBUG_UART=1 +CONFIG_SUNXI_MULTIPLATFORM=y +CONFIG_SUNXI_SCALING_MIN=60 +CONFIG_PLAT_SUNXI=y + +# +# Processor Type +# +CONFIG_CPU_V7=y +CONFIG_CPU_32v6K=y +CONFIG_CPU_32v7=y +CONFIG_CPU_ABRT_EV7=y +CONFIG_CPU_PABRT_V7=y +CONFIG_CPU_CACHE_V7=y +CONFIG_CPU_CACHE_VIPT=y +CONFIG_CPU_COPY_V6=y +CONFIG_CPU_TLB_V7=y +CONFIG_CPU_HAS_ASID=y +CONFIG_CPU_CP15=y +CONFIG_CPU_CP15_MMU=y + +# +# Processor Features +# +# CONFIG_ARM_LPAE is not set +# CONFIG_ARCH_PHYS_ADDR_T_64BIT is not set +CONFIG_ARM_THUMB=y +# CONFIG_ARM_THUMBEE is not set +CONFIG_SWP_EMULATE=y +# CONFIG_CPU_ICACHE_DISABLE is not set +# CONFIG_CPU_DCACHE_DISABLE is not set +# CONFIG_CPU_BPREDICT_DISABLE is not set +# CONFIG_CACHE_L2X0 is not set +CONFIG_ARM_L1_CACHE_SHIFT_6=y +CONFIG_ARM_L1_CACHE_SHIFT=6 +CONFIG_ARM_DMA_MEM_BUFFERABLE=y +CONFIG_ARM_NR_BANKS=8 +CONFIG_CPU_HAS_PMU=y +# CONFIG_ARM_ERRATA_430973 is not set +# CONFIG_ARM_ERRATA_458693 is not set +# CONFIG_ARM_ERRATA_460075 is not set +# CONFIG_ARM_ERRATA_720789 is not set +# CONFIG_ARM_ERRATA_743622 is not set +# CONFIG_ARM_ERRATA_751472 is not set +# CONFIG_ARM_ERRATA_754322 is not set +# CONFIG_ARM_ERRATA_775420 is not set +# CONFIG_FIQ_DEBUGGER is not set + +# +# Bus support +# +CONFIG_ARM_AMBA=y +# CONFIG_PCI_SYSCALL is not set +# CONFIG_ARCH_SUPPORTS_MSI is not set +# CONFIG_PCCARD is not set + +# +# Kernel Features +# +# CONFIG_NO_HZ is not set +# CONFIG_HIGH_RES_TIMERS is not set +CONFIG_GENERIC_CLOCKEVENTS_BUILD=y +# CONFIG_ARM_ARCH_TIMER is not set +CONFIG_VMSPLIT_3G=y +# CONFIG_VMSPLIT_2G is not set +# CONFIG_VMSPLIT_1G is not set +CONFIG_PAGE_OFFSET=0xC0000000 +CONFIG_ARCH_NR_GPIO=0 +# CONFIG_PREEMPT_NONE is not set +# CONFIG_PREEMPT_VOLUNTARY is not set +CONFIG_PREEMPT=y +CONFIG_PREEMPT_COUNT=y +CONFIG_HZ=100 +# CONFIG_THUMB2_KERNEL is not set +CONFIG_AEABI=y +CONFIG_OABI_COMPAT=y +# CONFIG_ARCH_SPARSEMEM_DEFAULT is not set +# CONFIG_ARCH_SELECT_MEMORY_MODEL is not set +CONFIG_HAVE_ARCH_PFN_VALID=y +CONFIG_HIGHMEM=y +# CONFIG_HIGHPTE is not set +CONFIG_HW_PERF_EVENTS=y +CONFIG_SELECT_MEMORY_MODEL=y +CONFIG_FLATMEM_MANUAL=y +CONFIG_FLATMEM=y +CONFIG_FLAT_NODE_MEM_MAP=y +CONFIG_HAVE_MEMBLOCK=y +CONFIG_MEMORY_ISOLATION=y +CONFIG_PAGEFLAGS_EXTENDED=y +CONFIG_SPLIT_PTLOCK_CPUS=4 +CONFIG_COMPACTION=y +CONFIG_MIGRATION=y +# CONFIG_PHYS_ADDR_T_64BIT is not set +CONFIG_ZONE_DMA_FLAG=1 +CONFIG_BOUNCE=y +CONFIG_VIRT_TO_BUS=y +CONFIG_KSM=y +CONFIG_DEFAULT_MMAP_MIN_ADDR=4096 +CONFIG_NEED_PER_CPU_KM=y +# CONFIG_CLEANCACHE is not set +CONFIG_FORCE_MAX_ZONEORDER=11 +CONFIG_ALIGNMENT_TRAP=y +# CONFIG_UACCESS_WITH_MEMCPY is not set +# CONFIG_SECCOMP is not set +# CONFIG_CC_STACKPROTECTOR is not set +# CONFIG_DEPRECATED_PARAM_STRUCT is not set +# CONFIG_ARM_FLUSH_CONSOLE_ON_RESTART is not set + +# +# Boot options +# +# CONFIG_USE_OF is not set +CONFIG_ZBOOT_ROM_TEXT=0 +CONFIG_ZBOOT_ROM_BSS=0 +CONFIG_CMDLINE="mem=448M@0x40000000 console=ttyS0,115200" +CONFIG_CMDLINE_FROM_BOOTLOADER=y +# CONFIG_CMDLINE_EXTEND is not set +# CONFIG_CMDLINE_FORCE is not set +# CONFIG_XIP_KERNEL is not set +# CONFIG_KEXEC is not set +# CONFIG_CRASH_DUMP is not set +# CONFIG_AUTO_ZRELADDR is not set + +# +# CPU Power Management +# + +# +# CPU Frequency scaling +# +# CONFIG_CPU_FREQ is not set +# CONFIG_CPU_IDLE is not set +# CONFIG_ARCH_NEEDS_CPU_IDLE_COUPLED is not set + +# +# Floating point emulation +# + +# +# At least one emulation must be selected +# +# CONFIG_FPE_NWFPE is not set +# CONFIG_FPE_FASTFPE is not set +CONFIG_VFP=y +CONFIG_VFPv3=y +CONFIG_NEON=y + +# +# Userspace binary formats +# +CONFIG_BINFMT_ELF=y +CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE=y +CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS=y +# CONFIG_HAVE_AOUT is not set +CONFIG_BINFMT_MISC=y + +# +# Power management options +# +CONFIG_SUSPEND=y +CONFIG_SUSPEND_FREEZER=y +CONFIG_HAS_WAKELOCK=y +CONFIG_WAKELOCK=y +CONFIG_PM_SLEEP=y +# CONFIG_PM_AUTOSLEEP is not set +# CONFIG_PM_WAKELOCKS is not set +# CONFIG_PM_RUNTIME is not set +CONFIG_PM=y +# CONFIG_PM_DEBUG is not set +# CONFIG_APM_EMULATION is not set +CONFIG_PM_CLK=y +CONFIG_CPU_PM=y +# CONFIG_SUSPEND_TIME is not set +CONFIG_ARCH_SUSPEND_POSSIBLE=y +CONFIG_ARM_CPU_SUSPEND=y +CONFIG_NET=y + +# +# Networking options +# +CONFIG_PACKET=y +CONFIG_UNIX=y +# CONFIG_UNIX_DIAG is not set +CONFIG_XFRM=y +CONFIG_XFRM_USER=y +# CONFIG_XFRM_SUB_POLICY is not set +# CONFIG_XFRM_MIGRATE is not set +# CONFIG_XFRM_STATISTICS is not set +CONFIG_XFRM_IPCOMP=y +CONFIG_NET_KEY=y +# CONFIG_NET_KEY_MIGRATE is not set +CONFIG_INET=y +CONFIG_IP_MULTICAST=y +# CONFIG_IP_ADVANCED_ROUTER is not set +# CONFIG_IP_PNP is not set +CONFIG_NET_IPIP=y +# CONFIG_NET_IPGRE_DEMUX is not set +CONFIG_IP_MROUTE=y +CONFIG_IP_PIMSM_V1=y +CONFIG_IP_PIMSM_V2=y +# CONFIG_ARPD is not set +CONFIG_SYN_COOKIES=y +CONFIG_INET_AH=y +CONFIG_INET_ESP=y +CONFIG_INET_IPCOMP=y +CONFIG_INET_XFRM_TUNNEL=y +CONFIG_INET_TUNNEL=y +CONFIG_INET_XFRM_MODE_TRANSPORT=y +CONFIG_INET_XFRM_MODE_TUNNEL=y +CONFIG_INET_XFRM_MODE_BEET=y +CONFIG_INET_LRO=y +# CONFIG_INET_DIAG is not set +# CONFIG_TCP_CONG_ADVANCED is not set +CONFIG_TCP_CONG_CUBIC=y +CONFIG_DEFAULT_TCP_CONG="cubic" +# CONFIG_TCP_MD5SIG is not set +# CONFIG_IPV6 is not set +# CONFIG_ANDROID_PARANOID_NETWORK is not set +CONFIG_NET_ACTIVITY_STATS=y +CONFIG_NETWORK_SECMARK=y +# CONFIG_NETWORK_PHY_TIMESTAMPING is not set +# CONFIG_NETFILTER is not set +# CONFIG_IP_DCCP is not set +# CONFIG_IP_SCTP is not set +# CONFIG_RDS is not set +# CONFIG_TIPC is not set +# CONFIG_ATM is not set +# CONFIG_L2TP is not set +CONFIG_STP=y +CONFIG_GARP=y +CONFIG_BRIDGE=y +CONFIG_BRIDGE_IGMP_SNOOPING=y +# CONFIG_NET_DSA is not set +CONFIG_VLAN_8021Q=y +CONFIG_VLAN_8021Q_GVRP=y +# CONFIG_DECNET is not set +CONFIG_LLC=y +# CONFIG_LLC2 is not set +# CONFIG_IPX is not set +# CONFIG_ATALK is not set +# CONFIG_X25 is not set +# CONFIG_LAPB is not set +# CONFIG_ECONET is not set +# CONFIG_WAN_ROUTER is not set +# CONFIG_PHONET is not set +# CONFIG_IEEE802154 is not set +# CONFIG_NET_SCHED is not set +# CONFIG_DCB is not set +# CONFIG_BATMAN_ADV is not set +# CONFIG_OPENVSWITCH is not set +# CONFIG_NETPRIO_CGROUP is not set +CONFIG_BQL=y +CONFIG_HAVE_BPF_JIT=y +# CONFIG_BPF_JIT is not set + +# +# Network testing +# +CONFIG_NET_PKTGEN=m +# CONFIG_HAMRADIO is not set +# CONFIG_CAN is not set +# CONFIG_IRDA is not set +# CONFIG_BT is not set +# CONFIG_AF_RXRPC is not set +CONFIG_WIRELESS=y +CONFIG_WIRELESS_EXT=y +CONFIG_WEXT_CORE=y +CONFIG_WEXT_PROC=y +CONFIG_WEXT_PRIV=y +CONFIG_CFG80211=y +# CONFIG_NL80211_TESTMODE is not set +# CONFIG_CFG80211_DEVELOPER_WARNINGS is not set +# CONFIG_CFG80211_REG_DEBUG is not set +CONFIG_CFG80211_DEFAULT_PS=y +# CONFIG_CFG80211_DEBUGFS is not set +# CONFIG_CFG80211_INTERNAL_REGDB is not set +CONFIG_CFG80211_WEXT=y +CONFIG_WIRELESS_EXT_SYSFS=y +# CONFIG_LIB80211 is not set +# CONFIG_CFG80211_ALLOW_RECONNECT is not set +CONFIG_MAC80211=y +CONFIG_MAC80211_HAS_RC=y +CONFIG_MAC80211_RC_MINSTREL=y +CONFIG_MAC80211_RC_MINSTREL_HT=y +CONFIG_MAC80211_RC_DEFAULT_MINSTREL=y +CONFIG_MAC80211_RC_DEFAULT="minstrel_ht" +# CONFIG_MAC80211_MESH is not set +# CONFIG_MAC80211_LEDS is not set +# CONFIG_MAC80211_DEBUGFS is not set +# CONFIG_MAC80211_DEBUG_MENU is not set +# CONFIG_WIMAX is not set +# CONFIG_RFKILL is not set +# CONFIG_RFKILL_REGULATOR is not set +# CONFIG_NET_9P is not set +# CONFIG_CAIF is not set +# CONFIG_CEPH_LIB is not set +# CONFIG_NFC is not set + +# +# Device Drivers +# + +# +# Generic Driver Options +# +CONFIG_UEVENT_HELPER_PATH="" +CONFIG_DEVTMPFS=y +CONFIG_DEVTMPFS_MOUNT=y +CONFIG_STANDALONE=y +CONFIG_PREVENT_FIRMWARE_BUILD=y +CONFIG_FW_LOADER=y +# CONFIG_FIRMWARE_IN_KERNEL is not set +CONFIG_EXTRA_FIRMWARE="" +# CONFIG_DEBUG_DRIVER is not set +# CONFIG_DEBUG_DEVRES is not set +# CONFIG_SYS_HYPERVISOR is not set +# CONFIG_GENERIC_CPU_DEVICES is not set +CONFIG_REGMAP=y +CONFIG_REGMAP_I2C=y +CONFIG_REGMAP_SPI=y +# CONFIG_DMA_SHARED_BUFFER is not set +# CONFIG_SYNC is not set +CONFIG_CMA=y +# CONFIG_CMA_DEBUG is not set + +# +# Default contiguous memory area size: +# +CONFIG_CMA_SIZE_MBYTES=192 +CONFIG_CMA_SIZE_SEL_MBYTES=y +# CONFIG_CMA_SIZE_SEL_PERCENTAGE is not set +# CONFIG_CMA_SIZE_SEL_MIN is not set +# CONFIG_CMA_SIZE_SEL_MAX is not set +CONFIG_CMA_ALIGNMENT=8 +CONFIG_CMA_AREAS=7 +CONFIG_CONNECTOR=y +CONFIG_PROC_EVENTS=y +# CONFIG_MTD is not set +# CONFIG_PARPORT is not set +CONFIG_BLK_DEV=y +# CONFIG_BLK_DEV_COW_COMMON is not set +CONFIG_BLK_DEV_LOOP=y +CONFIG_BLK_DEV_LOOP_MIN_COUNT=8 +CONFIG_BLK_DEV_CRYPTOLOOP=y +# CONFIG_BLK_DEV_DRBD is not set +# CONFIG_BLK_DEV_NBD is not set +CONFIG_BLK_DEV_UB=y +CONFIG_BLK_DEV_RAM=y +CONFIG_BLK_DEV_RAM_COUNT=4 +CONFIG_BLK_DEV_RAM_SIZE=4096 +# CONFIG_BLK_DEV_XIP is not set +# CONFIG_CDROM_PKTCDVD is not set +# CONFIG_ATA_OVER_ETH is not set +# CONFIG_MG_DISK is not set +# CONFIG_BLK_DEV_RBD is not set +CONFIG_SUNXI_NAND=y +CONFIG_SUNXI_NAND_COMPAT_DEV=y +# CONFIG_SUNXI_NAND_TEST is not set + +# +# Misc devices +# +# CONFIG_SENSORS_LIS3LV02D is not set +# CONFIG_AD525X_DPOT is not set +# CONFIG_SUNXI_DBGREG is not set +# CONFIG_ATMEL_PWM is not set +# CONFIG_SUNXI_PWM is not set +# CONFIG_ICS932S401 is not set +# CONFIG_ENCLOSURE_SERVICES is not set +# CONFIG_APDS9802ALS is not set +# CONFIG_ISL29003 is not set +# CONFIG_ISL29020 is not set +# CONFIG_SENSORS_TSL2550 is not set +# CONFIG_SENSORS_BH1780 is not set +# CONFIG_SENSORS_BH1770 is not set +# CONFIG_SENSORS_APDS990X is not set +# CONFIG_HMC6352 is not set +# CONFIG_SENSORS_AK8975 is not set +# CONFIG_DS1682 is not set +# CONFIG_TI_DAC7512 is not set +# CONFIG_UID_STAT is not set +# CONFIG_BMP085 is not set +# CONFIG_USB_SWITCH_FSA9480 is not set +# CONFIG_C2PORT is not set + +# +# EEPROM support +# +# CONFIG_EEPROM_AT24 is not set +# CONFIG_EEPROM_AT25 is not set +# CONFIG_EEPROM_LEGACY is not set +# CONFIG_EEPROM_MAX6875 is not set +# CONFIG_EEPROM_93CX6 is not set +# CONFIG_EEPROM_93XX46 is not set +# CONFIG_IWMC3200TOP is not set + +# +# Texas Instruments shared transport line discipline +# +# CONFIG_TI_ST is not set +# CONFIG_SENSORS_LIS3_SPI is not set +# CONFIG_SENSORS_LIS3_I2C is not set + +# +# Altera FPGA firmware download module +# +# CONFIG_ALTERA_STAPL is not set + +# +# SCSI device support +# +CONFIG_SCSI_MOD=y +# CONFIG_RAID_ATTRS is not set +CONFIG_SCSI=y +CONFIG_SCSI_DMA=y +# CONFIG_SCSI_TGT is not set +# CONFIG_SCSI_NETLINK is not set +CONFIG_SCSI_PROC_FS=y + +# +# SCSI support type (disk, tape, CD-ROM) +# +CONFIG_BLK_DEV_SD=y +# CONFIG_CHR_DEV_ST is not set +# CONFIG_CHR_DEV_OSST is not set +CONFIG_BLK_DEV_SR=y +CONFIG_BLK_DEV_SR_VENDOR=y +# CONFIG_CHR_DEV_SG is not set +# CONFIG_CHR_DEV_SCH is not set +CONFIG_SCSI_MULTI_LUN=y +# CONFIG_SCSI_CONSTANTS is not set +# CONFIG_SCSI_LOGGING is not set +# CONFIG_SCSI_SCAN_ASYNC is not set +CONFIG_SCSI_WAIT_SCAN=m + +# +# SCSI Transports +# +# CONFIG_SCSI_SPI_ATTRS is not set +# CONFIG_SCSI_FC_ATTRS is not set +# CONFIG_SCSI_ISCSI_ATTRS is not set +# CONFIG_SCSI_SAS_ATTRS is not set +# CONFIG_SCSI_SAS_LIBSAS is not set +# CONFIG_SCSI_SRP_ATTRS is not set +CONFIG_SCSI_LOWLEVEL=y +# CONFIG_ISCSI_TCP is not set +# CONFIG_ISCSI_BOOT_SYSFS is not set +# CONFIG_LIBFC is not set +# CONFIG_LIBFCOE is not set +# CONFIG_SCSI_DEBUG is not set +# CONFIG_SCSI_DH is not set +# CONFIG_SCSI_OSD_INITIATOR is not set +# CONFIG_ATA is not set +CONFIG_MD=y +CONFIG_BLK_DEV_MD=y +CONFIG_MD_AUTODETECT=y +CONFIG_MD_LINEAR=y +# CONFIG_MD_RAID0 is not set +# CONFIG_MD_RAID1 is not set +# CONFIG_MD_RAID10 is not set +# CONFIG_MD_RAID456 is not set +CONFIG_MD_MULTIPATH=y +CONFIG_MD_FAULTY=y +CONFIG_BLK_DEV_DM_BUILTIN=y +CONFIG_BLK_DEV_DM=y +# CONFIG_DM_DEBUG is not set +CONFIG_DM_CRYPT=y +CONFIG_DM_SNAPSHOT=y +# CONFIG_DM_THIN_PROVISIONING is not set +CONFIG_DM_MIRROR=y +# CONFIG_DM_RAID is not set +# CONFIG_DM_LOG_USERSPACE is not set +CONFIG_DM_ZERO=y +CONFIG_DM_MULTIPATH=y +CONFIG_DM_MULTIPATH_QL=y +CONFIG_DM_MULTIPATH_ST=y +# CONFIG_DM_DELAY is not set +# CONFIG_DM_UEVENT is not set +# CONFIG_DM_FLAKEY is not set +# CONFIG_DM_VERITY is not set +# CONFIG_TARGET_CORE is not set +CONFIG_NETDEVICES=y +CONFIG_NET_CORE=y +# CONFIG_BONDING is not set +# CONFIG_DUMMY is not set +# CONFIG_EQUALIZER is not set +CONFIG_MII=y +# CONFIG_NET_TEAM is not set +# CONFIG_MACVLAN is not set +# CONFIG_NETCONSOLE is not set +# CONFIG_NETPOLL is not set +# CONFIG_NET_POLL_CONTROLLER is not set +# CONFIG_TUN is not set +# CONFIG_VETH is not set + +# +# CAIF transport drivers +# +CONFIG_ETHERNET=y +CONFIG_NET_VENDOR_BROADCOM=y +# CONFIG_B44 is not set +# CONFIG_NET_CALXEDA_XGMAC is not set +CONFIG_NET_VENDOR_CHELSIO=y +CONFIG_NET_VENDOR_CIRRUS=y +# CONFIG_CS89x0 is not set +# CONFIG_DM9000 is not set +# CONFIG_DNET is not set +CONFIG_NET_VENDOR_FARADAY=y +# CONFIG_FTMAC100 is not set +# CONFIG_FTGMAC100 is not set +CONFIG_NET_VENDOR_INTEL=y +CONFIG_NET_VENDOR_I825XX=y +CONFIG_NET_VENDOR_MARVELL=y +CONFIG_NET_VENDOR_MICREL=y +# CONFIG_KS8851 is not set +# CONFIG_KS8851_MLL is not set +CONFIG_NET_VENDOR_MICROCHIP=y +# CONFIG_ENC28J60 is not set +CONFIG_NET_VENDOR_NATSEMI=y +CONFIG_NET_VENDOR_8390=y +# CONFIG_AX88796 is not set +# CONFIG_ETHOC is not set +CONFIG_NET_VENDOR_SEEQ=y +# CONFIG_SEEQ8005 is not set +CONFIG_NET_VENDOR_SMSC=y +# CONFIG_SMC91X is not set +# CONFIG_SMC911X is not set +# CONFIG_SMSC911X is not set +CONFIG_NET_VENDOR_STMICRO=y +# CONFIG_STMMAC_ETH is not set +CONFIG_SUNXI_EMAC=m +CONFIG_PHYLIB=y + +# +# MII PHY device drivers +# +# CONFIG_AMD_PHY is not set +# CONFIG_MARVELL_PHY is not set +# CONFIG_DAVICOM_PHY is not set +# CONFIG_QSEMI_PHY is not set +# CONFIG_LXT_PHY is not set +# CONFIG_CICADA_PHY is not set +# CONFIG_VITESSE_PHY is not set +# CONFIG_SMSC_PHY is not set +# CONFIG_BROADCOM_PHY is not set +# CONFIG_ICPLUS_PHY is not set +# CONFIG_REALTEK_PHY is not set +# CONFIG_NATIONAL_PHY is not set +# CONFIG_STE10XP is not set +# CONFIG_LSI_ET1011C_PHY is not set +# CONFIG_MICREL_PHY is not set +# CONFIG_FIXED_PHY is not set +# CONFIG_MDIO_BITBANG is not set +# CONFIG_MICREL_KS8995MA is not set +# CONFIG_PPP is not set +# CONFIG_SLIP is not set + +# +# USB Network Adapters +# +# CONFIG_USB_CATC is not set +# CONFIG_USB_KAWETH is not set +# CONFIG_USB_PEGASUS is not set +# CONFIG_USB_RTL8150 is not set +# CONFIG_USB_USBNET is not set +# CONFIG_USB_IPHETH is not set +CONFIG_WLAN=y +# CONFIG_LIBERTAS_THINFIRM is not set +# CONFIG_AT76C50X_USB is not set +# CONFIG_USB_ZD1201 is not set +# CONFIG_USB_NET_RNDIS_WLAN is not set +# CONFIG_RTL8187 is not set +# CONFIG_MAC80211_HWSIM is not set +# CONFIG_WIFI_CONTROL_FUNC is not set +# CONFIG_ATH_COMMON is not set +# CONFIG_B43 is not set +# CONFIG_B43LEGACY is not set +# CONFIG_BCMDHD is not set +# CONFIG_BRCMFMAC is not set +CONFIG_BCM4330=m +# CONFIG_HOSTAP is not set +# CONFIG_IWM is not set +# CONFIG_LIBERTAS is not set +# CONFIG_P54_COMMON is not set +# CONFIG_RT2X00 is not set +# CONFIG_RTL8192CU is not set +# CONFIG_WL1251 is not set +# CONFIG_WL12XX_MENU is not set +# CONFIG_ZD1211RW is not set +# CONFIG_MWIFIEX is not set +CONFIG_RTL8192CU_SW=m +# CONFIG_RTL8188EU is not set +# CONFIG_RTL8189ES is not set +# CONFIG_RTL8723AS is not set +# CONFIG_RTXX7X_SW is not set + +# +# Enable WiMAX (Networking options) to see the WiMAX drivers +# +# CONFIG_WAN is not set +# CONFIG_ISDN is not set + +# +# Input device support +# +CONFIG_INPUT=y +CONFIG_INPUT_FF_MEMLESS=y +CONFIG_INPUT_POLLDEV=y +# CONFIG_INPUT_SPARSEKMAP is not set + +# +# Userland interfaces +# +CONFIG_INPUT_MOUSEDEV=y +# CONFIG_INPUT_MOUSEDEV_PSAUX is not set +CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024 +CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768 +# CONFIG_INPUT_JOYDEV is not set +CONFIG_INPUT_EVDEV=y +# CONFIG_INPUT_EVBUG is not set +# CONFIG_INPUT_KEYRESET is not set + +# +# Input Device Drivers +# +CONFIG_INPUT_KEYBOARD=y +# CONFIG_KEYBOARD_ADP5588 is not set +# CONFIG_KEYBOARD_ADP5589 is not set +CONFIG_KEYBOARD_ATKBD=y +# CONFIG_KEYBOARD_QT1070 is not set +# CONFIG_KEYBOARD_QT2160 is not set +# CONFIG_KEYBOARD_LKKBD is not set +# CONFIG_KEYBOARD_GPIO is not set +# CONFIG_KEYBOARD_TCA6416 is not set +# CONFIG_KEYBOARD_TCA8418 is not set +# CONFIG_KEYBOARD_MATRIX is not set +# CONFIG_KEYBOARD_LM8323 is not set +# CONFIG_KEYBOARD_MAX7359 is not set +# CONFIG_KEYBOARD_MCS is not set +# CONFIG_KEYBOARD_MPR121 is not set +# CONFIG_KEYBOARD_NEWTON is not set +# CONFIG_KEYBOARD_OPENCORES is not set +# CONFIG_KEYBOARD_SAMSUNG is not set +# CONFIG_KEYBOARD_STOWAWAY is not set +# CONFIG_KEYBOARD_SUNKBD is not set +# CONFIG_KEYBOARD_OMAP4 is not set +# CONFIG_KEYBOARD_XTKBD is not set +CONFIG_KEYBOARD_SUN4IKEYPAD=m +CONFIG_KEYBOARD_SUN4I_KEYBOARD=m +# CONFIG_KEYBOARD_SUN4I_KEYBOARD_FEX is not set +CONFIG_KEYBOARD_HV2605_KEYBOARD=m +# CONFIG_IR_SUNXI is not set +# CONFIG_INPUT_MOUSE is not set +# CONFIG_INPUT_JOYSTICK is not set +# CONFIG_INPUT_TABLET is not set +CONFIG_INPUT_TOUCHSCREEN=y +# CONFIG_TOUCHSCREEN_ADS7846 is not set +# CONFIG_TOUCHSCREEN_AD7877 is not set +# CONFIG_TOUCHSCREEN_AD7879 is not set +# CONFIG_TOUCHSCREEN_ATMEL_MXT is not set +# CONFIG_TOUCHSCREEN_AUO_PIXCIR is not set +# CONFIG_TOUCHSCREEN_BU21013 is not set +# CONFIG_TOUCHSCREEN_CY8CTMG110 is not set +# CONFIG_TOUCHSCREEN_CYTTSP_CORE is not set +# CONFIG_TOUCHSCREEN_DYNAPRO is not set +# CONFIG_TOUCHSCREEN_HAMPSHIRE is not set +# CONFIG_TOUCHSCREEN_EETI is not set +# CONFIG_TOUCHSCREEN_EGALAX is not set +# CONFIG_TOUCHSCREEN_FUJITSU is not set +# CONFIG_TOUCHSCREEN_ILI210X is not set +# CONFIG_TOUCHSCREEN_GUNZE is not set +# CONFIG_TOUCHSCREEN_ELO is not set +# CONFIG_TOUCHSCREEN_WACOM_W8001 is not set +# CONFIG_TOUCHSCREEN_MAX11801 is not set +# CONFIG_TOUCHSCREEN_MCS5000 is not set +# CONFIG_TOUCHSCREEN_MTOUCH is not set +# CONFIG_TOUCHSCREEN_INEXIO is not set +# CONFIG_TOUCHSCREEN_MK712 is not set +# CONFIG_TOUCHSCREEN_PENMOUNT is not set +# CONFIG_TOUCHSCREEN_SYNAPTICS_I2C_RMI is not set +# CONFIG_TOUCHSCREEN_TOUCHRIGHT is not set +# CONFIG_TOUCHSCREEN_TOUCHWIN is not set +# CONFIG_TOUCHSCREEN_PIXCIR is not set +# CONFIG_TOUCHSCREEN_USB_COMPOSITE is not set +# CONFIG_TOUCHSCREEN_TOUCHIT213 is not set +# CONFIG_TOUCHSCREEN_TSC_SERIO is not set +# CONFIG_TOUCHSCREEN_TSC2005 is not set +# CONFIG_TOUCHSCREEN_TSC2007 is not set +# CONFIG_TOUCHSCREEN_W90X900 is not set +# CONFIG_TOUCHSCREEN_ST1232 is not set +# CONFIG_TOUCHSCREEN_TPS6507X is not set +CONFIG_TOUCHSCREEN_GT801=m +# CONFIG_TOUCHSCREEN_GT801_2PLUS1_TS is not set +CONFIG_TOUCHSCREEN_GT811=m +CONFIG_TOUCHSCREEN_GT818=m +CONFIG_TOUCHSCREEN_SUN4I_TS=m +CONFIG_TOUCHSCREEN_FT5X_TS=m +CONFIG_TOUCHSCREEN_ZT8031=m +# CONFIG_TOUCHSCREEN_COASIA is not set +# CONFIG_INPUT_MISC is not set + +# +# Hardware I/O ports +# +CONFIG_SERIO=y +CONFIG_SERIO_SERPORT=y +# CONFIG_SERIO_AMBAKMI is not set +CONFIG_SERIO_LIBPS2=y +# CONFIG_SERIO_RAW is not set +# CONFIG_SERIO_ALTERA_PS2 is not set +# CONFIG_SERIO_PS2MULT is not set +# CONFIG_GAMEPORT is not set +# CONFIG_GSENSOR is not set + +# +# Character devices +# +CONFIG_VT=y +CONFIG_CONSOLE_TRANSLATIONS=y +CONFIG_VT_CONSOLE=y +CONFIG_VT_CONSOLE_SLEEP=y +CONFIG_HW_CONSOLE=y +CONFIG_VT_HW_CONSOLE_BINDING=y +CONFIG_UNIX98_PTYS=y +CONFIG_DEVPTS_MULTIPLE_INSTANCES=y +# CONFIG_LEGACY_PTYS is not set +CONFIG_SERIAL_NONSTANDARD=y +# CONFIG_N_HDLC is not set +# CONFIG_N_GSM is not set +# CONFIG_TRACE_SINK is not set +CONFIG_DEVMEM=y +# CONFIG_DEVKMEM is not set +# CONFIG_STALDRV is not set + +# +# Serial drivers +# +CONFIG_SERIAL_8250=y +CONFIG_SERIAL_8250_CONSOLE=y +CONFIG_SERIAL_8250_SUNXI=y +CONFIG_SERIAL_8250_NR_UARTS=4 +CONFIG_SERIAL_8250_RUNTIME_UARTS=4 +# CONFIG_SERIAL_8250_EXTENDED is not set + +# +# Non-8250 serial port support +# +# CONFIG_SERIAL_AMBA_PL010 is not set +# CONFIG_SERIAL_AMBA_PL011 is not set +# CONFIG_SERIAL_MAX3100 is not set +# CONFIG_SERIAL_MAX3107 is not set +CONFIG_SERIAL_CORE=y +CONFIG_SERIAL_CORE_CONSOLE=y +# CONFIG_SERIAL_TIMBERDALE is not set +# CONFIG_SERIAL_ALTERA_JTAGUART is not set +# CONFIG_SERIAL_ALTERA_UART is not set +# CONFIG_SERIAL_IFX6X60 is not set +# CONFIG_SERIAL_XILINX_PS_UART is not set +# CONFIG_HVC_DCC is not set +# CONFIG_IPMI_HANDLER is not set +# CONFIG_HW_RANDOM is not set +# CONFIG_R3964 is not set +# CONFIG_RAW_DRIVER is not set +# CONFIG_TCG_TPM is not set +# CONFIG_DCC_TTY is not set +# CONFIG_RAMOOPS is not set +CONFIG_I2C=y +CONFIG_I2C_BOARDINFO=y +CONFIG_I2C_COMPAT=y +CONFIG_I2C_CHARDEV=y +# CONFIG_I2C_MUX is not set +CONFIG_I2C_HELPER_AUTO=y + +# +# I2C Hardware Bus support +# + +# +# I2C system bus drivers (mostly embedded / system-on-chip) +# +# CONFIG_I2C_DESIGNWARE_PLATFORM is not set +# CONFIG_I2C_GPIO is not set +# CONFIG_I2C_OCORES is not set +# CONFIG_I2C_PCA_PLATFORM is not set +# CONFIG_I2C_PXA_PCI is not set +# CONFIG_I2C_SIMTEC is not set +CONFIG_I2C_SUNXI=y +# CONFIG_SUNXI_IIC_PRINT_TRANSFER_INFO is not set +# CONFIG_I2C_XILINX is not set + +# +# External I2C/SMBus adapter drivers +# +# CONFIG_I2C_DIOLAN_U2C is not set +# CONFIG_I2C_PARPORT_LIGHT is not set +# CONFIG_I2C_TAOS_EVM is not set +# CONFIG_I2C_TINY_USB is not set + +# +# Other I2C/SMBus bus drivers +# +# CONFIG_I2C_STUB is not set +# CONFIG_I2C_DEBUG_CORE is not set +# CONFIG_I2C_DEBUG_ALGO is not set +# CONFIG_I2C_DEBUG_BUS is not set +CONFIG_SPI=y +# CONFIG_SPI_DEBUG is not set +CONFIG_SPI_MASTER=y + +# +# SPI Master Controller Drivers +# +# CONFIG_SPI_ALTERA is not set +# CONFIG_SPI_BITBANG is not set +# CONFIG_SPI_GPIO is not set +# CONFIG_SPI_OC_TINY is not set +# CONFIG_SPI_PL022 is not set +# CONFIG_SPI_PXA2XX_PCI is not set +CONFIG_SPI_SUNXI=y +CONFIG_SPI_SUNXI_NDMA=y +# CONFIG_SPI_XILINX is not set +# CONFIG_SPI_DESIGNWARE is not set + +# +# SPI Protocol Masters +# +# CONFIG_SPI_SPIDEV is not set +# CONFIG_SPI_TLE62X0 is not set +# CONFIG_HSI is not set + +# +# PPS support +# +# CONFIG_PPS is not set + +# +# PPS generators support +# + +# +# PTP clock support +# + +# +# Enable Device Drivers -> PPS to see the PTP clock options. +# +CONFIG_ARCH_WANT_OPTIONAL_GPIOLIB=y +CONFIG_GPIOLIB=y +# CONFIG_DEBUG_GPIO is not set +CONFIG_GPIO_SYSFS=y + +# +# Memory mapped GPIO drivers: +# +# CONFIG_GPIO_GENERIC_PLATFORM is not set +# CONFIG_GPIO_PL061 is not set +CONFIG_GPIO_SUNXI=m + +# +# I2C GPIO expanders: +# +# CONFIG_GPIO_MAX7300 is not set +# CONFIG_GPIO_MAX732X is not set +# CONFIG_GPIO_PCF857X is not set +# CONFIG_GPIO_SX150X is not set +# CONFIG_GPIO_ADP5588 is not set + +# +# PCI GPIO expanders: +# + +# +# SPI GPIO expanders: +# +# CONFIG_GPIO_MAX7301 is not set +# CONFIG_GPIO_MCP23S08 is not set +# CONFIG_GPIO_MC33880 is not set +# CONFIG_GPIO_74X164 is not set + +# +# AC97 GPIO expanders: +# + +# +# MODULbus GPIO expanders: +# +CONFIG_W1=m +CONFIG_W1_CON=y +CONFIG_W1_SUNXI=m + +# +# 1-wire Bus Masters +# +# CONFIG_W1_MASTER_DS2490 is not set +# CONFIG_W1_MASTER_DS2482 is not set +# CONFIG_W1_MASTER_DS1WM is not set +CONFIG_W1_MASTER_GPIO=m + +# +# 1-wire Slaves +# +# CONFIG_W1_SLAVE_THERM is not set +# CONFIG_W1_SLAVE_SMEM is not set +# CONFIG_W1_SLAVE_DS2408 is not set +# CONFIG_W1_SLAVE_DS2423 is not set +# CONFIG_W1_SLAVE_DS2431 is not set +# CONFIG_W1_SLAVE_DS2433 is not set +# CONFIG_W1_SLAVE_DS2760 is not set +# CONFIG_W1_SLAVE_DS2780 is not set +# CONFIG_W1_SLAVE_DS2781 is not set +# CONFIG_W1_SLAVE_BQ27000 is not set +CONFIG_POWER_SUPPLY=y +CONFIG_AW_AXP=y +# CONFIG_AW_AXP18 is not set +# CONFIG_AW_AXP19 is not set +CONFIG_AW_AXP20=y +CONFIG_AXP_CHARGEINIT=y +CONFIG_AXP_CHGCHANGE=y +CONFIG_AXP_HWMON=y +# CONFIG_POWER_SUPPLY_DEBUG is not set +# CONFIG_AXP152 is not set +# CONFIG_PDA_POWER is not set +# CONFIG_TEST_POWER is not set +# CONFIG_BATTERY_DS2780 is not set +# CONFIG_BATTERY_DS2781 is not set +# CONFIG_BATTERY_DS2782 is not set +# CONFIG_BATTERY_SBS is not set +# CONFIG_BATTERY_BQ27x00 is not set +# CONFIG_BATTERY_MAX17040 is not set +# CONFIG_BATTERY_MAX17042 is not set +# CONFIG_CHARGER_MAX8903 is not set +# CONFIG_CHARGER_LP8727 is not set +# CONFIG_CHARGER_GPIO is not set +# CONFIG_CHARGER_MANAGER is not set +# CONFIG_CHARGER_SMB347 is not set +CONFIG_HWMON=y +# CONFIG_HWMON_VID is not set +# CONFIG_HWMON_DEBUG_CHIP is not set + +# +# Native drivers +# +CONFIG_SENSORS_MMA7660=m +# CONFIG_SENSORS_AD7314 is not set +# CONFIG_SENSORS_AD7414 is not set +# CONFIG_SENSORS_AD7418 is not set +# CONFIG_SENSORS_ADCXX is not set +# CONFIG_SENSORS_ADM1021 is not set +# CONFIG_SENSORS_ADM1025 is not set +# CONFIG_SENSORS_ADM1026 is not set +# CONFIG_SENSORS_ADM1029 is not set +# CONFIG_SENSORS_ADM1031 is not set +# CONFIG_SENSORS_ADM9240 is not set +# CONFIG_SENSORS_ADT7411 is not set +# CONFIG_SENSORS_ADT7462 is not set +# CONFIG_SENSORS_ADT7470 is not set +# CONFIG_SENSORS_ADT7475 is not set +# CONFIG_SENSORS_ASC7621 is not set +# CONFIG_SENSORS_ATXP1 is not set +# CONFIG_SENSORS_DS620 is not set +# CONFIG_SENSORS_DS1621 is not set +# CONFIG_SENSORS_F71805F is not set +# CONFIG_SENSORS_F71882FG is not set +# CONFIG_SENSORS_F75375S is not set +# CONFIG_SENSORS_G760A is not set +# CONFIG_SENSORS_GL518SM is not set +# CONFIG_SENSORS_GL520SM is not set +# CONFIG_SENSORS_GPIO_FAN is not set +# CONFIG_SENSORS_IT87 is not set +# CONFIG_SENSORS_JC42 is not set +# CONFIG_SENSORS_LINEAGE is not set +# CONFIG_SENSORS_LM63 is not set +# CONFIG_SENSORS_LM70 is not set +# CONFIG_SENSORS_LM73 is not set +# CONFIG_SENSORS_LM75 is not set +# CONFIG_SENSORS_LM77 is not set +# CONFIG_SENSORS_LM78 is not set +# CONFIG_SENSORS_LM80 is not set +# CONFIG_SENSORS_LM83 is not set +# CONFIG_SENSORS_LM85 is not set +# CONFIG_SENSORS_LM87 is not set +# CONFIG_SENSORS_LM90 is not set +# CONFIG_SENSORS_LM92 is not set +# CONFIG_SENSORS_LM93 is not set +# CONFIG_SENSORS_LTC4151 is not set +# CONFIG_SENSORS_LTC4215 is not set +# CONFIG_SENSORS_LTC4245 is not set +# CONFIG_SENSORS_LTC4261 is not set +# CONFIG_SENSORS_LM95241 is not set +# CONFIG_SENSORS_LM95245 is not set +# CONFIG_SENSORS_MAX1111 is not set +# CONFIG_SENSORS_MAX16065 is not set +# CONFIG_SENSORS_MAX1619 is not set +# CONFIG_SENSORS_MAX1668 is not set +# CONFIG_SENSORS_MAX6639 is not set +# CONFIG_SENSORS_MAX6642 is not set +# CONFIG_SENSORS_MAX6650 is not set +# CONFIG_SENSORS_MCP3021 is not set +# CONFIG_SENSORS_NTC_THERMISTOR is not set +# CONFIG_SENSORS_PC87360 is not set +# CONFIG_SENSORS_PC87427 is not set +# CONFIG_SENSORS_PCF8591 is not set +# CONFIG_PMBUS is not set +# CONFIG_SENSORS_SHT15 is not set +# CONFIG_SENSORS_SHT21 is not set +# CONFIG_SENSORS_SMM665 is not set +# CONFIG_SENSORS_DME1737 is not set +# CONFIG_SENSORS_EMC1403 is not set +# CONFIG_SENSORS_EMC2103 is not set +# CONFIG_SENSORS_EMC6W201 is not set +# CONFIG_SENSORS_SMSC47M1 is not set +# CONFIG_SENSORS_SMSC47M192 is not set +# CONFIG_SENSORS_SMSC47B397 is not set +# CONFIG_SENSORS_SCH56XX_COMMON is not set +# CONFIG_SENSORS_SCH5627 is not set +# CONFIG_SENSORS_SCH5636 is not set +# CONFIG_SENSORS_ADS1015 is not set +# CONFIG_SENSORS_ADS7828 is not set +# CONFIG_SENSORS_ADS7871 is not set +# CONFIG_SENSORS_AMC6821 is not set +# CONFIG_SENSORS_THMC50 is not set +# CONFIG_SENSORS_TMP102 is not set +# CONFIG_SENSORS_TMP401 is not set +# CONFIG_SENSORS_TMP421 is not set +# CONFIG_SENSORS_VT1211 is not set +# CONFIG_SENSORS_W83781D is not set +# CONFIG_SENSORS_W83791D is not set +# CONFIG_SENSORS_W83792D is not set +# CONFIG_SENSORS_W83793 is not set +# CONFIG_SENSORS_W83795 is not set +# CONFIG_SENSORS_W83L785TS is not set +# CONFIG_SENSORS_W83L786NG is not set +# CONFIG_SENSORS_W83627HF is not set +# CONFIG_SENSORS_W83627EHF is not set +# CONFIG_THERMAL is not set +# CONFIG_WATCHDOG is not set +CONFIG_SSB_POSSIBLE=y + +# +# Sonics Silicon Backplane +# +# CONFIG_SSB is not set +CONFIG_BCMA_POSSIBLE=y + +# +# Broadcom specific AMBA +# +# CONFIG_BCMA is not set + +# +# Multifunction device drivers +# +# CONFIG_MFD_CORE is not set +# CONFIG_MFD_88PM860X is not set +# CONFIG_MFD_SM501 is not set +# CONFIG_MFD_ASIC3 is not set +# CONFIG_HTC_EGPIO is not set +# CONFIG_HTC_PASIC3 is not set +# CONFIG_HTC_I2CPLD is not set +# CONFIG_TPS6105X is not set +# CONFIG_TPS65010 is not set +# CONFIG_TPS6507X is not set +# CONFIG_MFD_TPS65217 is not set +# CONFIG_MFD_TPS6586X is not set +# CONFIG_MFD_TPS65910 is not set +# CONFIG_MFD_TPS65912_I2C is not set +# CONFIG_MFD_TPS65912_SPI is not set +# CONFIG_TWL4030_CORE is not set +# CONFIG_TWL6040_CORE is not set +# CONFIG_MFD_STMPE is not set +# CONFIG_MFD_TC3589X is not set +# CONFIG_MFD_TMIO is not set +# CONFIG_MFD_T7L66XB is not set +# CONFIG_MFD_TC6387XB is not set +# CONFIG_MFD_TC6393XB is not set +# CONFIG_PMIC_DA903X is not set +# CONFIG_MFD_DA9052_SPI is not set +# CONFIG_MFD_DA9052_I2C is not set +# CONFIG_PMIC_ADP5520 is not set +# CONFIG_MFD_MAX8925 is not set +# CONFIG_MFD_MAX8997 is not set +# CONFIG_MFD_MAX8998 is not set +# CONFIG_MFD_S5M_CORE is not set +# CONFIG_MFD_WM8400 is not set +# CONFIG_MFD_WM831X_I2C is not set +# CONFIG_MFD_WM831X_SPI is not set +# CONFIG_MFD_WM8350_I2C is not set +# CONFIG_MFD_WM8994 is not set +# CONFIG_MFD_PCF50633 is not set +# CONFIG_MFD_MC13XXX is not set +# CONFIG_ABX500_CORE is not set +# CONFIG_EZX_PCAP is not set +# CONFIG_MFD_WL1273_CORE is not set +# CONFIG_MFD_TPS65090 is not set +# CONFIG_MFD_AAT2870_CORE is not set +# CONFIG_MFD_RC5T583 is not set +CONFIG_REGULATOR=y +# CONFIG_REGULATOR_DEBUG is not set +# CONFIG_REGULATOR_DUMMY is not set +# CONFIG_REGULATOR_FIXED_VOLTAGE is not set +# CONFIG_REGULATOR_VIRTUAL_CONSUMER is not set +# CONFIG_REGULATOR_USERSPACE_CONSUMER is not set +# CONFIG_REGULATOR_GPIO is not set +# CONFIG_REGULATOR_AD5398 is not set +# CONFIG_REGULATOR_ISL6271A is not set +# CONFIG_REGULATOR_MAX1586 is not set +# CONFIG_REGULATOR_MAX8649 is not set +# CONFIG_REGULATOR_MAX8660 is not set +# CONFIG_REGULATOR_MAX8952 is not set +# CONFIG_REGULATOR_LP3971 is not set +# CONFIG_REGULATOR_LP3972 is not set +# CONFIG_REGULATOR_TPS62360 is not set +# CONFIG_REGULATOR_TPS65023 is not set +# CONFIG_REGULATOR_TPS6507X is not set +# CONFIG_REGULATOR_TPS6524X is not set +CONFIG_MEDIA_SUPPORT=y + +# +# Multimedia core support +# +# CONFIG_MEDIA_CONTROLLER is not set +# CONFIG_VIDEO_DEV is not set +# CONFIG_DVB_CORE is not set +# CONFIG_VIDEO_MEDIA is not set + +# +# Multimedia drivers +# +CONFIG_RC_CORE=y +CONFIG_LIRC=y +CONFIG_RC_MAP=y +CONFIG_IR_NEC_DECODER=y +CONFIG_IR_RC5_DECODER=y +CONFIG_IR_RC6_DECODER=y +CONFIG_IR_JVC_DECODER=y +CONFIG_IR_SONY_DECODER=y +CONFIG_IR_RC5_SZ_DECODER=y +CONFIG_IR_SANYO_DECODER=y +CONFIG_IR_MCE_KBD_DECODER=y +CONFIG_IR_LIRC_CODEC=y +# CONFIG_RC_ATI_REMOTE is not set +# CONFIG_IR_IMON is not set +# CONFIG_IR_MCEUSB is not set +# CONFIG_IR_REDRAT3 is not set +# CONFIG_IR_STREAMZAP is not set +# CONFIG_RC_LOOPBACK is not set +# CONFIG_IR_GPIO_CIR is not set +CONFIG_VIDEO_SUNXI_CEDAR=m +CONFIG_VIDEO_DECODER_SUNXI=m +# CONFIG_VIDEO_AVS_COUNTER is not set +# CONFIG_AUDIO_ENGINE is not set +CONFIG_PA_CONTROL=y +CONFIG_PA_CONFIG=y + +# +# Graphics support +# +# CONFIG_DRM is not set +# CONFIG_ION is not set +CONFIG_MALI=m +CONFIG_MALI400=m +# CONFIG_MALI400_DEBUG is not set +# CONFIG_MALI400_GPU_UTILIZATION is not set +CONFIG_UMP=m +# CONFIG_UMP_DEBUG is not set +# CONFIG_VGASTATE is not set +# CONFIG_VIDEO_OUTPUT_CONTROL is not set +CONFIG_FB=y +# CONFIG_FIRMWARE_EDID is not set +# CONFIG_FB_DDC is not set +# CONFIG_FB_BOOT_VESA_SUPPORT is not set +CONFIG_FB_CFB_FILLRECT=y +CONFIG_FB_CFB_COPYAREA=y +CONFIG_FB_CFB_IMAGEBLIT=y +# CONFIG_FB_CFB_REV_PIXELS_IN_BYTE is not set +# CONFIG_FB_SYS_FILLRECT is not set +# CONFIG_FB_SYS_COPYAREA is not set +# CONFIG_FB_SYS_IMAGEBLIT is not set +# CONFIG_FB_FOREIGN_ENDIAN is not set +# CONFIG_FB_SYS_FOPS is not set +# CONFIG_FB_WMT_GE_ROPS is not set +# CONFIG_FB_SVGALIB is not set +# CONFIG_FB_MACMODES is not set +# CONFIG_FB_BACKLIGHT is not set +CONFIG_FB_MODE_HELPERS=y +# CONFIG_FB_TILEBLITTING is not set + +# +# Frame buffer hardware drivers +# +CONFIG_FB_SUNXI=y +CONFIG_FB_SUNXI_RESERVED_MEM=y +CONFIG_FB_SUNXI_UMP=y +CONFIG_FB_SUNXI_LCD=y +# CONFIG_FB_SUNXI_HDMI is not set +# CONFIG_HDMI_CEC is not set +# CONFIG_FB_ARMCLCD is not set +# CONFIG_FB_UVESA is not set +# CONFIG_FB_S1D13XXX is not set +# CONFIG_FB_SMSCUFX is not set +# CONFIG_FB_UDL is not set +# CONFIG_FB_VIRTUAL is not set +# CONFIG_FB_METRONOME is not set +# CONFIG_FB_BROADSHEET is not set +# CONFIG_EXYNOS_VIDEO is not set +# CONFIG_BACKLIGHT_LCD_SUPPORT is not set + +# +# Console display driver support +# +CONFIG_DUMMY_CONSOLE=y +CONFIG_FRAMEBUFFER_CONSOLE=y +# CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY is not set +# CONFIG_FRAMEBUFFER_CONSOLE_ROTATION is not set +# CONFIG_FONTS is not set +CONFIG_FONT_8x8=y +CONFIG_FONT_8x16=y +# CONFIG_LOGO is not set +CONFIG_SOUND=y +# CONFIG_SOUND_OSS_CORE is not set +CONFIG_SND=y +CONFIG_SND_TIMER=y +CONFIG_SND_PCM=y +CONFIG_SND_JACK=y +# CONFIG_SND_SEQUENCER is not set +# CONFIG_SND_MIXER_OSS is not set +# CONFIG_SND_PCM_OSS is not set +# CONFIG_SND_DYNAMIC_MINORS is not set +CONFIG_SND_SUPPORT_OLD_API=y +CONFIG_SND_VERBOSE_PROCFS=y +# CONFIG_SND_VERBOSE_PRINTK is not set +# CONFIG_SND_DEBUG is not set +# CONFIG_SND_RAWMIDI_SEQ is not set +# CONFIG_SND_OPL3_LIB_SEQ is not set +# CONFIG_SND_OPL4_LIB_SEQ is not set +# CONFIG_SND_SBAWE_SEQ is not set +# CONFIG_SND_EMU10K1_SEQ is not set +CONFIG_SND_DRIVERS=y +# CONFIG_SND_DUMMY is not set +# CONFIG_SND_ALOOP is not set +# CONFIG_SND_MTPAV is not set +# CONFIG_SND_SERIAL_U16550 is not set +# CONFIG_SND_MPU401 is not set +CONFIG_SND_ARM=y +# CONFIG_SND_ARMAACI is not set +CONFIG_SND_SPI=y +CONFIG_SND_USB=y +# CONFIG_SND_USB_AUDIO is not set +# CONFIG_SND_USB_UA101 is not set +# CONFIG_SND_USB_CAIAQ is not set +# CONFIG_SND_USB_6FIRE is not set +CONFIG_SND_SOC=y +CONFIG_SOUND_SUNXI=y +CONFIG_SND_SUNXI_SOC_CODEC=y +CONFIG_SND_SUNXI_SOC_HDMIAUDIO=y +CONFIG_SND_SUNXI_SOC_SPDIF=m +CONFIG_SND_SUNXI_SOC_I2S_INTERFACE=m +CONFIG_SND_SOC_I2C_AND_SPI=y +# CONFIG_SND_SOC_ALL_CODECS is not set +# CONFIG_SOUND_PRIME is not set +CONFIG_HID_SUPPORT=y +CONFIG_HID=y +# CONFIG_HID_BATTERY_STRENGTH is not set +# CONFIG_HIDRAW is not set +# CONFIG_UHID is not set + +# +# USB Input Devices +# +CONFIG_USB_HID=y +# CONFIG_HID_PID is not set +# CONFIG_USB_HIDDEV is not set + +# +# Special HID drivers +# +CONFIG_HID_A4TECH=y +# CONFIG_HID_ACRUX is not set +CONFIG_HID_APPLE=y +CONFIG_HID_BELKIN=y +CONFIG_HID_CHERRY=y +CONFIG_HID_CHICONY=y +# CONFIG_HID_PRODIKEYS is not set +CONFIG_HID_CYPRESS=y +# CONFIG_HID_DRAGONRISE is not set +# CONFIG_HID_EMS_FF is not set +CONFIG_HID_EZKEY=y +# CONFIG_HID_HOLTEK is not set +# CONFIG_HID_KEYTOUCH is not set +CONFIG_HID_KYE=y +# CONFIG_HID_UCLOGIC is not set +# CONFIG_HID_WALTOP is not set +# CONFIG_HID_GYRATION is not set +# CONFIG_HID_TWINHAN is not set +CONFIG_HID_KENSINGTON=y +# CONFIG_HID_LCPOWER is not set +CONFIG_HID_LOGITECH=y +CONFIG_HID_LOGITECH_DJ=m +# CONFIG_LOGITECH_FF is not set +# CONFIG_LOGIRUMBLEPAD2_FF is not set +# CONFIG_LOGIG940_FF is not set +# CONFIG_LOGIWHEELS_FF is not set +CONFIG_HID_MICROSOFT=y +CONFIG_HID_MONTEREY=y +# CONFIG_HID_MULTITOUCH is not set +# CONFIG_HID_NTRIG is not set +# CONFIG_HID_ORTEK is not set +# CONFIG_HID_PANTHERLORD is not set +# CONFIG_HID_PETALYNX is not set +# CONFIG_HID_PICOLCD is not set +# CONFIG_HID_PRIMAX is not set +# CONFIG_HID_ROCCAT is not set +# CONFIG_HID_SAITEK is not set +# CONFIG_HID_SAMSUNG is not set +# CONFIG_HID_SONY is not set +# CONFIG_HID_SPEEDLINK is not set +# CONFIG_HID_SUNPLUS is not set +# CONFIG_HID_GREENASIA is not set +# CONFIG_HID_SMARTJOYPLUS is not set +# CONFIG_HID_TIVO is not set +# CONFIG_HID_TOPSEED is not set +# CONFIG_HID_THRUSTMASTER is not set +# CONFIG_HID_ZEROPLUS is not set +# CONFIG_HID_ZYDACRON is not set +CONFIG_USB_ARCH_HAS_OHCI=y +CONFIG_USB_ARCH_HAS_EHCI=y +# CONFIG_USB_ARCH_HAS_XHCI is not set +CONFIG_USB_SUPPORT=y +CONFIG_USB_COMMON=y +CONFIG_USB_ARCH_HAS_HCD=y +CONFIG_USB=y +# CONFIG_USB_DEBUG is not set +# CONFIG_USB_ANNOUNCE_NEW_DEVICES is not set + +# +# Miscellaneous USB options +# +# CONFIG_USB_DEVICEFS is not set +CONFIG_USB_DEVICE_CLASS=y +# CONFIG_USB_DYNAMIC_MINORS is not set +# CONFIG_USB_DWC3 is not set +# CONFIG_USB_MON is not set +# CONFIG_USB_WUSB_CBAF is not set + +# +# USB Host Controller Drivers +# +# CONFIG_USB_C67X00_HCD is not set +CONFIG_USB_EHCI_HCD=y +CONFIG_USB_EHCI_ROOT_HUB_TT=y +CONFIG_USB_EHCI_TT_NEWSCHED=y +# CONFIG_USB_OXU210HP_HCD is not set +# CONFIG_USB_ISP116X_HCD is not set +# CONFIG_USB_ISP1760_HCD is not set +# CONFIG_USB_ISP1362_HCD is not set +CONFIG_USB_OHCI_HCD=y +# CONFIG_USB_OHCI_HCD_PLATFORM is not set +# CONFIG_USB_EHCI_HCD_PLATFORM is not set +# CONFIG_USB_OHCI_BIG_ENDIAN_DESC is not set +# CONFIG_USB_OHCI_BIG_ENDIAN_MMIO is not set +CONFIG_USB_OHCI_LITTLE_ENDIAN=y +# CONFIG_USB_SL811_HCD is not set +# CONFIG_USB_R8A66597_HCD is not set +CONFIG_USB_SUNXI_EHCI=y +CONFIG_USB_SUNXI_OHCI=y +CONFIG_USB_SUNXI_COMMON=y +CONFIG_USB_SW_SUNXI_HCD0=y +# CONFIG_USB_MUSB_HDRC is not set +# CONFIG_USB_RENESAS_USBHS is not set + +# +# USB Device Class drivers +# +# CONFIG_USB_ACM is not set +# CONFIG_USB_PRINTER is not set +# CONFIG_USB_WDM is not set +# CONFIG_USB_TMC is not set + +# +# NOTE: USB_STORAGE depends on SCSI but BLK_DEV_SD may +# + +# +# also be needed; see USB_STORAGE Help for more info +# +CONFIG_USB_STORAGE=y +# CONFIG_USB_STORAGE_DEBUG is not set +CONFIG_USB_STORAGE_REALTEK=y +CONFIG_USB_STORAGE_DATAFAB=y +CONFIG_USB_STORAGE_FREECOM=y +CONFIG_USB_STORAGE_ISD200=y +CONFIG_USB_STORAGE_USBAT=y +CONFIG_USB_STORAGE_SDDR09=y +CONFIG_USB_STORAGE_SDDR55=y +CONFIG_USB_STORAGE_JUMPSHOT=y +CONFIG_USB_STORAGE_ALAUDA=y +CONFIG_USB_STORAGE_ONETOUCH=y +CONFIG_USB_STORAGE_KARMA=y +CONFIG_USB_STORAGE_CYPRESS_ATACB=y +CONFIG_USB_STORAGE_ENE_UB6250=y +# CONFIG_USB_LIBUSUAL is not set + +# +# USB Imaging devices +# +# CONFIG_USB_MDC800 is not set +# CONFIG_USB_MICROTEK is not set + +# +# USB port drivers +# +# CONFIG_USB_SERIAL is not set + +# +# USB Miscellaneous drivers +# +# CONFIG_USB_EMI62 is not set +# CONFIG_USB_EMI26 is not set +# CONFIG_USB_ADUTUX is not set +# CONFIG_USB_SEVSEG is not set +# CONFIG_USB_RIO500 is not set +# CONFIG_USB_LEGOTOWER is not set +# CONFIG_USB_LCD is not set +# CONFIG_USB_LED is not set +CONFIG_USB_CYPRESS_CY7C63=m +# CONFIG_USB_CYTHERM is not set +# CONFIG_USB_IDMOUSE is not set +# CONFIG_USB_FTDI_ELAN is not set +# CONFIG_USB_APPLEDISPLAY is not set +# CONFIG_USB_SISUSBVGA is not set +# CONFIG_USB_LD is not set +# CONFIG_USB_TRANCEVIBRATOR is not set +# CONFIG_USB_IOWARRIOR is not set +# CONFIG_USB_TEST is not set +# CONFIG_USB_ISIGHTFW is not set +# CONFIG_USB_YUREX is not set +CONFIG_USB_GADGET=y +# CONFIG_USB_GADGET_DEBUG is not set +# CONFIG_USB_GADGET_DEBUG_FILES is not set +# CONFIG_USB_GADGET_DEBUG_FS is not set +CONFIG_USB_GADGET_VBUS_DRAW=2 +CONFIG_USB_GADGET_STORAGE_NUM_BUFFERS=2 +# CONFIG_USB_FUSB300 is not set +# CONFIG_USB_R8A66597 is not set +# CONFIG_USB_MV_UDC is not set +# CONFIG_USB_M66592 is not set +# CONFIG_USB_NET2272 is not set +# CONFIG_USB_SW_SUNXI_UDC0_SELECT is not set +# CONFIG_USB_DUMMY_HCD is not set +CONFIG_USB_SW_SUNXI_UDC0=y +# CONFIG_USB_ZERO is not set +# CONFIG_USB_AUDIO is not set +# CONFIG_USB_ETH is not set +# CONFIG_USB_G_NCM is not set +# CONFIG_USB_GADGETFS is not set +# CONFIG_USB_FUNCTIONFS is not set +# CONFIG_USB_FILE_STORAGE is not set +# CONFIG_USB_MASS_STORAGE is not set +# CONFIG_USB_G_SERIAL is not set +# CONFIG_USB_MIDI_GADGET is not set +# CONFIG_USB_G_PRINTER is not set +CONFIG_USB_G_ANDROID=y +# CONFIG_USB_CDC_COMPOSITE is not set +# CONFIG_USB_G_ACM_MS is not set +# CONFIG_USB_G_MULTI is not set +# CONFIG_USB_G_HID is not set +# CONFIG_USB_G_DBGP is not set + +# +# OTG and related infrastructure +# +# CONFIG_USB_OTG_WAKELOCK is not set +# CONFIG_USB_GPIO_VBUS is not set +# CONFIG_USB_ULPI is not set +# CONFIG_NOP_USB_XCEIV is not set +CONFIG_USB_SW_SUNXI_USB=y +CONFIG_USB_SW_SUNXI_USB_MANAGER=y +# CONFIG_USB_SW_SUNXI_USB0_HOST_ONLY is not set +CONFIG_USB_SW_SUNXI_USB0_OTG=y +# CONFIG_USB_SW_SUNXI_USB0_DEVICE_ONLY is not set +# CONFIG_USB_SW_SUNXI_USB0_NULL is not set +CONFIG_USB_SW_SUNXI_USB_DEBUG=y +CONFIG_MMC=y +# CONFIG_MMC_DEBUG is not set +CONFIG_MMC_UNSAFE_RESUME=y +# CONFIG_MMC_CLKGATE is not set +# CONFIG_MMC_EMBEDDED_SDIO is not set +# CONFIG_MMC_PARANOID_SD_INIT is not set + +# +# MMC/SD/SDIO Card Drivers +# +CONFIG_MMC_BLOCK=y +CONFIG_MMC_BLOCK_MINORS=8 +# CONFIG_MMC_BLOCK_BOUNCE is not set +# CONFIG_MMC_BLOCK_DEFERRED_RESUME is not set +# CONFIG_SDIO_UART is not set +# CONFIG_MMC_TEST is not set + +# +# MMC/SD/SDIO Host Controller Drivers +# +# CONFIG_MMC_ARMMMCI is not set +# CONFIG_MMC_SDHCI is not set +# CONFIG_MMC_DW is not set +CONFIG_MMC_SUNXI_NEW=y +# CONFIG_MMC_DEBUG_SUNXI is not set +CONFIG_MMC_PRE_DBGLVL_SUNXI=0 +# CONFIG_MMC_VUB300 is not set +# CONFIG_MMC_USHC is not set + +# +# MMC/SD/SDIO Card Power Management Drivers +# +CONFIG_MMC_SUNXI_POWER_CONTROL=y + +# +# SUNXI MMC/SD/SDIO Host Controller Drivers +# +# CONFIG_MEMSTICK is not set +CONFIG_NEW_LEDS=y +CONFIG_LEDS_CLASS=y + +# +# LED drivers +# +CONFIG_LEDS_SUNXI=y +# CONFIG_LEDS_LM3530 is not set +# CONFIG_LEDS_PCA9532 is not set +# CONFIG_LEDS_GPIO is not set +# CONFIG_LEDS_LP3944 is not set +# CONFIG_LEDS_LP5521 is not set +# CONFIG_LEDS_LP5523 is not set +# CONFIG_LEDS_PCA955X is not set +# CONFIG_LEDS_PCA9633 is not set +# CONFIG_LEDS_DAC124S085 is not set +# CONFIG_LEDS_REGULATOR is not set +# CONFIG_LEDS_BD2802 is not set +# CONFIG_LEDS_LT3593 is not set +# CONFIG_LEDS_RENESAS_TPU is not set +# CONFIG_LEDS_TCA6507 is not set +# CONFIG_LEDS_OT200 is not set +CONFIG_LEDS_TRIGGERS=y + +# +# LED Triggers +# +CONFIG_LEDS_TRIGGER_TIMER=y +CONFIG_LEDS_TRIGGER_HEARTBEAT=y +# CONFIG_LEDS_TRIGGER_BACKLIGHT is not set +# CONFIG_LEDS_TRIGGER_CPU is not set +# CONFIG_LEDS_TRIGGER_GPIO is not set +# CONFIG_LEDS_TRIGGER_DEFAULT_ON is not set + +# +# iptables trigger is under Netfilter config (LED target) +# +CONFIG_SWITCH=y +# CONFIG_SWITCH_GPIO is not set +# CONFIG_ACCESSIBILITY is not set +CONFIG_RTC_LIB=y +CONFIG_RTC_CLASS=y +CONFIG_RTC_HCTOSYS=y +CONFIG_RTC_HCTOSYS_DEVICE="rtc0" +# CONFIG_RTC_DEBUG is not set + +# +# RTC interfaces +# +CONFIG_RTC_INTF_SYSFS=y +CONFIG_RTC_INTF_PROC=y +CONFIG_RTC_INTF_DEV=y +# CONFIG_RTC_INTF_DEV_UIE_EMUL is not set +# CONFIG_RTC_DRV_TEST is not set + +# +# I2C RTC drivers +# +# CONFIG_RTC_DRV_DS1307 is not set +# CONFIG_RTC_DRV_DS1374 is not set +# CONFIG_RTC_DRV_DS1672 is not set +# CONFIG_RTC_DRV_DS3232 is not set +# CONFIG_RTC_DRV_MAX6900 is not set +# CONFIG_RTC_DRV_RS5C372 is not set +# CONFIG_RTC_DRV_ISL1208 is not set +# CONFIG_RTC_DRV_ISL12022 is not set +# CONFIG_RTC_DRV_X1205 is not set +# CONFIG_RTC_DRV_PCF8563 is not set +CONFIG_RTC_DRV_SUN5I=y +# CONFIG_RTC_DRV_PCF8583 is not set +# CONFIG_RTC_DRV_M41T80 is not set +# CONFIG_RTC_DRV_BQ32K is not set +# CONFIG_RTC_DRV_S35390A is not set +# CONFIG_RTC_DRV_FM3130 is not set +# CONFIG_RTC_DRV_RX8581 is not set +# CONFIG_RTC_DRV_RX8025 is not set +# CONFIG_RTC_DRV_EM3027 is not set +# CONFIG_RTC_DRV_RV3029C2 is not set + +# +# SPI RTC drivers +# +# CONFIG_RTC_DRV_M41T93 is not set +# CONFIG_RTC_DRV_M41T94 is not set +# CONFIG_RTC_DRV_DS1305 is not set +# CONFIG_RTC_DRV_DS1390 is not set +# CONFIG_RTC_DRV_MAX6902 is not set +# CONFIG_RTC_DRV_R9701 is not set +# CONFIG_RTC_DRV_RS5C348 is not set +# CONFIG_RTC_DRV_DS3234 is not set +# CONFIG_RTC_DRV_PCF2123 is not set + +# +# Platform RTC drivers +# +# CONFIG_RTC_DRV_CMOS is not set +# CONFIG_RTC_DRV_DS1286 is not set +# CONFIG_RTC_DRV_DS1511 is not set +# CONFIG_RTC_DRV_DS1553 is not set +# CONFIG_RTC_DRV_DS1742 is not set +# CONFIG_RTC_DRV_STK17TA8 is not set +# CONFIG_RTC_DRV_M48T86 is not set +# CONFIG_RTC_DRV_M48T35 is not set +# CONFIG_RTC_DRV_M48T59 is not set +# CONFIG_RTC_DRV_MSM6242 is not set +# CONFIG_RTC_DRV_BQ4802 is not set +# CONFIG_RTC_DRV_RP5C01 is not set +# CONFIG_RTC_DRV_V3020 is not set + +# +# on-CPU RTC drivers +# +# CONFIG_RTC_DRV_PL030 is not set +# CONFIG_RTC_DRV_PL031 is not set +# CONFIG_DMADEVICES is not set +# CONFIG_AUXDISPLAY is not set +# CONFIG_UIO is not set + +# +# Virtio drivers +# +# CONFIG_VIRTIO_BALLOON is not set +# CONFIG_VIRTIO_MMIO is not set + +# +# Microsoft Hyper-V guest support +# +CONFIG_STAGING=y +# CONFIG_USBIP_CORE is not set +# CONFIG_W35UND is not set +# CONFIG_PRISM2_USB is not set +# CONFIG_ECHO is not set +# CONFIG_ASUS_OLED is not set +# CONFIG_RTLLIB is not set +# CONFIG_R8712U is not set +# CONFIG_RTS5139 is not set +# CONFIG_TRANZPORT is not set +# CONFIG_LINE6_USB is not set +# CONFIG_VT6656 is not set +# CONFIG_IIO is not set +# CONFIG_FB_SM7XX is not set +# CONFIG_USB_ENESTORAGE is not set +# CONFIG_BCM_WIMAX is not set +# CONFIG_FT1000 is not set + +# +# Speakup console speech +# +# CONFIG_SPEAKUP is not set +# CONFIG_TOUCHSCREEN_CLEARPAD_TM1217 is not set +# CONFIG_TOUCHSCREEN_SYNAPTICS_I2C_RMI4 is not set +# CONFIG_STAGING_MEDIA is not set + +# +# Android +# +# CONFIG_ANDROID is not set +# CONFIG_PHONE is not set +# CONFIG_USB_WPAN_HCD is not set + +# +# Hardware Spinlock drivers +# +CONFIG_IOMMU_SUPPORT=y + +# +# Remoteproc drivers (EXPERIMENTAL) +# + +# +# Rpmsg drivers (EXPERIMENTAL) +# +# CONFIG_VIRT_DRIVERS is not set +# CONFIG_PM_DEVFREQ is not set + +# +# File systems +# +CONFIG_EXT2_FS=y +# CONFIG_EXT2_FS_XATTR is not set +# CONFIG_EXT2_FS_XIP is not set +CONFIG_EXT3_FS=y +CONFIG_EXT3_DEFAULTS_TO_ORDERED=y +CONFIG_EXT3_FS_XATTR=y +# CONFIG_EXT3_FS_POSIX_ACL is not set +# CONFIG_EXT3_FS_SECURITY is not set +CONFIG_EXT4_FS=y +CONFIG_EXT4_FS_XATTR=y +CONFIG_EXT4_FS_POSIX_ACL=y +CONFIG_EXT4_FS_SECURITY=y +# CONFIG_EXT4_DEBUG is not set +CONFIG_JBD=y +# CONFIG_JBD_DEBUG is not set +CONFIG_JBD2=y +# CONFIG_JBD2_DEBUG is not set +CONFIG_FS_MBCACHE=y +# CONFIG_REISERFS_FS is not set +# CONFIG_JFS_FS is not set +# CONFIG_XFS_FS is not set +# CONFIG_GFS2_FS is not set +# CONFIG_OCFS2_FS is not set +# CONFIG_BTRFS_FS is not set +# CONFIG_NILFS2_FS is not set +CONFIG_FS_POSIX_ACL=y +CONFIG_FILE_LOCKING=y +CONFIG_FSNOTIFY=y +CONFIG_DNOTIFY=y +CONFIG_INOTIFY_USER=y +# CONFIG_FANOTIFY is not set +CONFIG_QUOTA=y +CONFIG_QUOTA_NETLINK_INTERFACE=y +# CONFIG_PRINT_QUOTA_WARNING is not set +# CONFIG_QUOTA_DEBUG is not set +# CONFIG_QFMT_V1 is not set +# CONFIG_QFMT_V2 is not set +CONFIG_QUOTACTL=y +# CONFIG_AUTOFS4_FS is not set +CONFIG_FUSE_FS=y +CONFIG_CUSE=y +CONFIG_GENERIC_ACL=y + +# +# Caches +# +CONFIG_FSCACHE=y +CONFIG_FSCACHE_STATS=y +# CONFIG_FSCACHE_HISTOGRAM is not set +# CONFIG_FSCACHE_DEBUG is not set +# CONFIG_FSCACHE_OBJECT_LIST is not set +CONFIG_CACHEFILES=y +# CONFIG_CACHEFILES_DEBUG is not set +# CONFIG_CACHEFILES_HISTOGRAM is not set + +# +# CD-ROM/DVD Filesystems +# +# CONFIG_ISO9660_FS is not set +# CONFIG_UDF_FS is not set + +# +# DOS/FAT/NT Filesystems +# +CONFIG_FAT_FS=y +CONFIG_MSDOS_FS=y +CONFIG_VFAT_FS=y +CONFIG_FAT_DEFAULT_CODEPAGE=437 +CONFIG_FAT_DEFAULT_IOCHARSET="iso8859-1" +CONFIG_NTFS_FS=y +# CONFIG_NTFS_DEBUG is not set +CONFIG_NTFS_RW=y + +# +# Pseudo filesystems +# +CONFIG_PROC_FS=y +CONFIG_PROC_SYSCTL=y +CONFIG_PROC_PAGE_MONITOR=y +CONFIG_SYSFS=y +CONFIG_TMPFS=y +CONFIG_TMPFS_POSIX_ACL=y +CONFIG_TMPFS_XATTR=y +# CONFIG_HUGETLB_PAGE is not set +CONFIG_CONFIGFS_FS=y +# CONFIG_MISC_FILESYSTEMS is not set +CONFIG_NETWORK_FILESYSTEMS=y +CONFIG_NFS_FS=y +# CONFIG_NFS_V3 is not set +# CONFIG_NFS_V4 is not set +# CONFIG_NFS_FSCACHE is not set +# CONFIG_NFSD is not set +CONFIG_LOCKD=y +CONFIG_NFS_COMMON=y +CONFIG_SUNRPC=y +# CONFIG_SUNRPC_DEBUG is not set +# CONFIG_CEPH_FS is not set +CONFIG_CIFS=y +# CONFIG_CIFS_STATS is not set +# CONFIG_CIFS_WEAK_PW_HASH is not set +# CONFIG_CIFS_XATTR is not set +# CONFIG_CIFS_DEBUG2 is not set +# CONFIG_CIFS_FSCACHE is not set +# CONFIG_NCP_FS is not set +# CONFIG_CODA_FS is not set +# CONFIG_AFS_FS is not set +CONFIG_NLS=y +CONFIG_NLS_DEFAULT="utf8" +CONFIG_NLS_CODEPAGE_437=y +# CONFIG_NLS_CODEPAGE_737 is not set +# CONFIG_NLS_CODEPAGE_775 is not set +# CONFIG_NLS_CODEPAGE_850 is not set +# CONFIG_NLS_CODEPAGE_852 is not set +# CONFIG_NLS_CODEPAGE_855 is not set +# CONFIG_NLS_CODEPAGE_857 is not set +# CONFIG_NLS_CODEPAGE_860 is not set +# CONFIG_NLS_CODEPAGE_861 is not set +# CONFIG_NLS_CODEPAGE_862 is not set +# CONFIG_NLS_CODEPAGE_863 is not set +# CONFIG_NLS_CODEPAGE_864 is not set +# CONFIG_NLS_CODEPAGE_865 is not set +# CONFIG_NLS_CODEPAGE_866 is not set +# CONFIG_NLS_CODEPAGE_869 is not set +CONFIG_NLS_CODEPAGE_936=y +CONFIG_NLS_CODEPAGE_950=y +CONFIG_NLS_CODEPAGE_932=y +CONFIG_NLS_CODEPAGE_949=y +# CONFIG_NLS_CODEPAGE_874 is not set +# CONFIG_NLS_ISO8859_8 is not set +# CONFIG_NLS_CODEPAGE_1250 is not set +# CONFIG_NLS_CODEPAGE_1251 is not set +CONFIG_NLS_ASCII=y +CONFIG_NLS_ISO8859_1=y +# CONFIG_NLS_ISO8859_2 is not set +# CONFIG_NLS_ISO8859_3 is not set +# CONFIG_NLS_ISO8859_4 is not set +# CONFIG_NLS_ISO8859_5 is not set +# CONFIG_NLS_ISO8859_6 is not set +# CONFIG_NLS_ISO8859_7 is not set +# CONFIG_NLS_ISO8859_9 is not set +# CONFIG_NLS_ISO8859_13 is not set +# CONFIG_NLS_ISO8859_14 is not set +# CONFIG_NLS_ISO8859_15 is not set +# CONFIG_NLS_KOI8_R is not set +# CONFIG_NLS_KOI8_U is not set +CONFIG_NLS_UTF8=y +# CONFIG_DLM is not set + +# +# Kernel hacking +# +CONFIG_PRINTK_TIME=y +CONFIG_DEFAULT_MESSAGE_LOGLEVEL=4 +# CONFIG_ENABLE_WARN_DEPRECATED is not set +CONFIG_ENABLE_MUST_CHECK=y +CONFIG_FRAME_WARN=2048 +CONFIG_MAGIC_SYSRQ=y +CONFIG_STRIP_ASM_SYMS=y +# CONFIG_UNUSED_SYMBOLS is not set +CONFIG_DEBUG_FS=y +# CONFIG_HEADERS_CHECK is not set +# CONFIG_DEBUG_SECTION_MISMATCH is not set +CONFIG_DEBUG_KERNEL=y +CONFIG_DEBUG_SHIRQ=y +# CONFIG_LOCKUP_DETECTOR is not set +# CONFIG_HARDLOCKUP_DETECTOR_NMI is not set +# CONFIG_HARDLOCKUP_DETECTOR_OTHER_CPU is not set +# CONFIG_HARDLOCKUP_DETECTOR is not set +CONFIG_DETECT_HUNG_TASK=y +CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=120 +# CONFIG_BOOTPARAM_HUNG_TASK_PANIC is not set +CONFIG_BOOTPARAM_HUNG_TASK_PANIC_VALUE=0 +CONFIG_SCHED_DEBUG=y +CONFIG_SCHEDSTATS=y +CONFIG_TIMER_STATS=y +# CONFIG_DEBUG_OBJECTS is not set +# CONFIG_SLUB_DEBUG_ON is not set +# CONFIG_SLUB_STATS is not set +# CONFIG_DEBUG_KMEMLEAK is not set +CONFIG_DEBUG_PREEMPT=y +# CONFIG_DEBUG_RT_MUTEXES is not set +# CONFIG_RT_MUTEX_TESTER is not set +# CONFIG_DEBUG_SPINLOCK is not set +# CONFIG_DEBUG_MUTEXES is not set +# CONFIG_DEBUG_LOCK_ALLOC is not set +# CONFIG_PROVE_LOCKING is not set +# CONFIG_SPARSE_RCU_POINTER is not set +# CONFIG_LOCK_STAT is not set +# CONFIG_DEBUG_ATOMIC_SLEEP is not set +# CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set +CONFIG_STACKTRACE=y +# CONFIG_DEBUG_STACK_USAGE is not set +# CONFIG_DEBUG_KOBJECT is not set +# CONFIG_DEBUG_HIGHMEM is not set +CONFIG_DEBUG_BUGVERBOSE=y +CONFIG_DEBUG_INFO=y +# CONFIG_DEBUG_INFO_REDUCED is not set +# CONFIG_DEBUG_VM is not set +# CONFIG_DEBUG_WRITECOUNT is not set +CONFIG_DEBUG_MEMORY_INIT=y +CONFIG_DEBUG_LIST=y +# CONFIG_TEST_LIST_SORT is not set +# CONFIG_DEBUG_SG is not set +# CONFIG_DEBUG_NOTIFIERS is not set +# CONFIG_DEBUG_CREDENTIALS is not set +CONFIG_BOOT_PRINTK_DELAY=y +# CONFIG_RCU_TORTURE_TEST is not set +# CONFIG_RCU_TRACE is not set +# CONFIG_BACKTRACE_SELF_TEST is not set +# CONFIG_DEBUG_BLOCK_EXT_DEVT is not set +CONFIG_DEBUG_FORCE_WEAK_PER_CPU=y +# CONFIG_LKDTM is not set +# CONFIG_FAULT_INJECTION is not set +# CONFIG_LATENCYTOP is not set +# CONFIG_DEBUG_PAGEALLOC is not set +CONFIG_HAVE_FUNCTION_TRACER=y +CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y +CONFIG_HAVE_DYNAMIC_FTRACE=y +CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y +CONFIG_HAVE_C_RECORDMCOUNT=y +CONFIG_TRACING_SUPPORT=y +# CONFIG_FTRACE is not set +CONFIG_DYNAMIC_DEBUG=y +# CONFIG_DMA_API_DEBUG is not set +# CONFIG_ATOMIC64_SELFTEST is not set +# CONFIG_SAMPLES is not set +CONFIG_HAVE_ARCH_KGDB=y +# CONFIG_KGDB is not set +# CONFIG_TEST_KSTRTOX is not set +CONFIG_STRICT_DEVMEM=y +CONFIG_ARM_UNWIND=y +# CONFIG_DEBUG_USER is not set +# CONFIG_DEBUG_RODATA is not set +CONFIG_DEBUG_LL=y +CONFIG_DEBUG_LL_UART_NONE=y +# CONFIG_DEBUG_ICEDCC is not set +# CONFIG_DEBUG_SEMIHOSTING is not set +# CONFIG_EARLY_PRINTK is not set +# CONFIG_OC_ETM is not set + +# +# Security options +# +# CONFIG_KEYS is not set +# CONFIG_SECURITY_DMESG_RESTRICT is not set +# CONFIG_SECURITY is not set +CONFIG_SECURITYFS=y +CONFIG_DEFAULT_SECURITY_DAC=y +CONFIG_DEFAULT_SECURITY="" +CONFIG_CRYPTO=y + +# +# Crypto core or helper +# +CONFIG_CRYPTO_ALGAPI=y +CONFIG_CRYPTO_ALGAPI2=y +CONFIG_CRYPTO_AEAD=y +CONFIG_CRYPTO_AEAD2=y +CONFIG_CRYPTO_BLKCIPHER=y +CONFIG_CRYPTO_BLKCIPHER2=y +CONFIG_CRYPTO_HASH=y +CONFIG_CRYPTO_HASH2=y +CONFIG_CRYPTO_RNG=y +CONFIG_CRYPTO_RNG2=y +CONFIG_CRYPTO_PCOMP=y +CONFIG_CRYPTO_PCOMP2=y +CONFIG_CRYPTO_MANAGER=y +CONFIG_CRYPTO_MANAGER2=y +# CONFIG_CRYPTO_USER is not set +# CONFIG_CRYPTO_MANAGER_DISABLE_TESTS is not set +CONFIG_CRYPTO_GF128MUL=y +# CONFIG_CRYPTO_NULL is not set +CONFIG_CRYPTO_WORKQUEUE=y +# CONFIG_CRYPTO_CRYPTD is not set +CONFIG_CRYPTO_AUTHENC=y +# CONFIG_CRYPTO_TEST is not set + +# +# Authenticated Encryption with Associated Data +# +# CONFIG_CRYPTO_CCM is not set +# CONFIG_CRYPTO_GCM is not set +CONFIG_CRYPTO_SEQIV=y + +# +# Block modes +# +CONFIG_CRYPTO_CBC=y +# CONFIG_CRYPTO_CTR is not set +# CONFIG_CRYPTO_CTS is not set +CONFIG_CRYPTO_ECB=y +# CONFIG_CRYPTO_LRW is not set +# CONFIG_CRYPTO_PCBC is not set +# CONFIG_CRYPTO_XTS is not set + +# +# Hash modes +# +CONFIG_CRYPTO_HMAC=y +# CONFIG_CRYPTO_XCBC is not set +# CONFIG_CRYPTO_VMAC is not set + +# +# Digest +# +CONFIG_CRYPTO_CRC32C=y +# CONFIG_CRYPTO_GHASH is not set +CONFIG_CRYPTO_MD4=y +CONFIG_CRYPTO_MD5=y +# CONFIG_CRYPTO_MICHAEL_MIC is not set +# CONFIG_CRYPTO_RMD128 is not set +# CONFIG_CRYPTO_RMD160 is not set +# CONFIG_CRYPTO_RMD256 is not set +# CONFIG_CRYPTO_RMD320 is not set +CONFIG_CRYPTO_SHA1=y +# CONFIG_CRYPTO_SHA256 is not set +# CONFIG_CRYPTO_SHA512 is not set +# CONFIG_CRYPTO_TGR192 is not set +# CONFIG_CRYPTO_WP512 is not set + +# +# Ciphers +# +CONFIG_CRYPTO_AES=y +# CONFIG_CRYPTO_ANUBIS is not set +CONFIG_CRYPTO_ARC4=y +# CONFIG_CRYPTO_BLOWFISH is not set +# CONFIG_CRYPTO_CAMELLIA is not set +# CONFIG_CRYPTO_CAST5 is not set +# CONFIG_CRYPTO_CAST6 is not set +CONFIG_CRYPTO_DES=y +# CONFIG_CRYPTO_FCRYPT is not set +# CONFIG_CRYPTO_KHAZAD is not set +# CONFIG_CRYPTO_SALSA20 is not set +# CONFIG_CRYPTO_SEED is not set +# CONFIG_CRYPTO_SERPENT is not set +# CONFIG_CRYPTO_TEA is not set +# CONFIG_CRYPTO_TWOFISH is not set + +# +# Compression +# +CONFIG_CRYPTO_DEFLATE=y +CONFIG_CRYPTO_ZLIB=y +CONFIG_CRYPTO_LZO=y + +# +# Random Number Generation +# +# CONFIG_CRYPTO_ANSI_CPRNG is not set +# CONFIG_CRYPTO_USER_API_HASH is not set +# CONFIG_CRYPTO_USER_API_SKCIPHER is not set +# CONFIG_CRYPTO_HW is not set +# CONFIG_BINARY_PRINTF is not set + +# +# Library routines +# +CONFIG_BITREVERSE=y +CONFIG_GENERIC_PCI_IOMAP=y +CONFIG_GENERIC_IO=y +# CONFIG_CRC_CCITT is not set +CONFIG_CRC16=y +CONFIG_CRC_T10DIF=y +CONFIG_CRC_ITU_T=y +CONFIG_CRC32=y +# CONFIG_CRC32_SELFTEST is not set +CONFIG_CRC32_SLICEBY8=y +# CONFIG_CRC32_SLICEBY4 is not set +# CONFIG_CRC32_SARWATE is not set +# CONFIG_CRC32_BIT is not set +# CONFIG_CRC7 is not set +CONFIG_LIBCRC32C=y +# CONFIG_CRC8 is not set +CONFIG_AUDIT_GENERIC=y +CONFIG_ZLIB_INFLATE=y +CONFIG_ZLIB_DEFLATE=y +CONFIG_LZO_COMPRESS=y +CONFIG_LZO_DECOMPRESS=y +CONFIG_XZ_DEC=y +CONFIG_XZ_DEC_X86=y +CONFIG_XZ_DEC_POWERPC=y +CONFIG_XZ_DEC_IA64=y +CONFIG_XZ_DEC_ARM=y +CONFIG_XZ_DEC_ARMTHUMB=y +CONFIG_XZ_DEC_SPARC=y +CONFIG_XZ_DEC_BCJ=y +# CONFIG_XZ_DEC_TEST is not set +CONFIG_DECOMPRESS_GZIP=y +CONFIG_DECOMPRESS_BZIP2=y +CONFIG_DECOMPRESS_LZMA=y +CONFIG_DECOMPRESS_XZ=y +CONFIG_DECOMPRESS_LZO=y +CONFIG_HAS_IOMEM=y +CONFIG_HAS_IOPORT=y +CONFIG_HAS_DMA=y +CONFIG_DQL=y +CONFIG_NLATTR=y +CONFIG_AVERAGE=y +# CONFIG_CORDIC is not set diff --git a/config/olinux-som-a13.fex b/config/olinux-som-a13.fex new file mode 100644 index 0000000000..1d97d0cd17 --- /dev/null +++ b/config/olinux-som-a13.fex @@ -0,0 +1,677 @@ +[product] +version = "1.0" +machine = "A13-EVB-V1.0" + +[target] +boot_clock = 1008 +dcdc2_vol = 1400 +dcdc3_vol = 1200 +ldo2_vol = 3000 +ldo3_vol = 3300 +ldo4_vol = 3300 +pll4_freq = 960 +pll6_freq = 720 + +[card_boot] +logical_start = 40960 +sprite_gpio0 = + +[card_boot0_para] +card_ctrl = 0 +card_high_speed = 1 +card_line = 4 +sdc_d1 = port:PF00<2><1> +sdc_d0 = port:PF01<2><1> +sdc_clk = port:PF02<2><1> +sdc_cmd = port:PF03<2><1> +sdc_d3 = port:PF04<2><1> +sdc_d2 = port:PF05<2><1> + +[twi_para] +twi_port = 0 +twi_scl = port:PB00<2><1> +twi_sda = port:PB01<2><1> + +[uart_para] +uart_debug_port = 0 +uart_debug_tx = port:PG03<4><1> +uart_debug_rx = port:PG04<4><1> + +[jtag_para] +jtag_enable = 0 +jtag_ms = port:PF00<4><1> +jtag_ck = port:PF05<4><1> +jtag_do = port:PF03<4><1> +jtag_di = port:PF01<4><1> + +[dram_para] +dram_baseaddr = 0x40000000 +dram_clk = 408 +dram_type = 3 +dram_rank_num = 1 +dram_chip_density = 4096 +dram_io_width = 16 +dram_bus_width = 16 +dram_cas = 9 +dram_zq = 0x7b +dram_odt_en = 0 +dram_size = 512 +dram_tpr0 = 0x42d899b7 +dram_tpr1 = 0xa090 +dram_tpr2 = 0x22a00 +dram_tpr3 = 0x0 +dram_tpr4 = 0x0 +dram_tpr5 = 0x0 +dram_emr1 = 0x0 +dram_emr2 = 0x10 +dram_emr3 = 0x0 + +[nand_para] +nand_used = 1 +nand_we = port:PC00<2> +nand_ale = port:PC01<2> +nand_cle = port:PC02<2> +nand_ce1 = port:PC03<2> +nand_ce0 = port:PC04<2> +nand_nre = port:PC05<2> +nand_rb0 = port:PC06<2> +nand_rb1 = port:PC07<2> +nand_d0 = port:PC08<2> +nand_d1 = port:PC09<2> +nand_d2 = port:PC10<2> +nand_d3 = port:PC11<2> +nand_d4 = port:PC12<2> +nand_d5 = port:PC13<2> +nand_d6 = port:PC14<2> +nand_d7 = port:PC15<2> +nand_wp = +nand_ce2 = +nand_ce3 = +nand_ce4 = +nand_ce5 = +nand_ce6 = +nand_ce7 = +nand_spi = +nand_ndqs = port:PC19<2> + +[mali_para] +mali_used = 1 +mali_clkdiv = 2 + +[twi0_para] +twi0_used = 1 +twi0_scl = port:PB00<2> +twi0_sda = port:PB01<2> + +[twi1_para] +twi1_used = 1 +twi1_scl = port:PB15<2> +twi1_sda = port:PB16<2> + +[twi2_para] +twi2_used = 1 +twi2_scl = port:PB17<2> +twi2_sda = port:PB18<2> + +[uart_para0] +uart_used = 0 +uart_port = 0 +uart_type = 2 +uart_tx = port:PB19<2><1> +uart_rx = port:PB20<2><1> + +[uart_para1] +uart_used = 1 +uart_port = 1 +uart_type = 2 +uart_tx = port:PG03<4><1> +uart_rx = port:PG04<4><1> + +[uart_para3] +uart_used = 1 +uart_port = 1 +uart_type = 2 +uart_tx = port:PG09<3><1> +uart_rx = port:PG10<3><1> + +[spi1_para] +spi_used = 0 +spi_cs0 = port:PG09<2> +spi_cs1 = port:PG13<2> +spi_sclk = port:PG10<2> +spi_mosi = port:PG11<2> +spi_miso = port:PG12<2> + +[spi2_para] +spi_used = 0 +spi_cs0 = port:PE00<4> +spi_sclk = port:PE01<4> +spi_mosi = port:PE02<4> +spi_miso = port:PE03<4> + +[spi_devices] +spi_dev_num = 1 + +[spi_board0] +modalias = "spidev" +max_speed_hz = 1000000 +bus_num = 2 +chip_select = 0 +mode = 3 +full_duplex = 0 +manual_cs = 0 + +[rtp_para] +rtp_used = 1 +rtp_screen_size = 5 +rtp_regidity_level = 5 +rtp_press_threshold_enable = 0 +rtp_press_threshold = 0x1f40 +rtp_sensitive_level = 0xf +rtp_exchange_x_y_flag = 0 + +[ctp_para] +ctp_used = 0 +ctp_name = "ft5x_ts" +ctp_twi_id = 2 +ctp_twi_addr = 0x70 +ctp_screen_max_x = 800 +ctp_screen_max_y = 480 +ctp_revert_x_flag = 0 +ctp_revert_y_flag = 0 +ctp_exchange_x_y_flag = 0 +ctp_int_port = port:PH21<6> +ctp_wakeup = port:PB13<1><1> +ctp_io_port = port:PH21<0> + +[tkey_para] +tkey_used = 0 +tkey_name = "hv_keypad" +tkey_twi_id = 2 +tkey_twi_addr = 0x62 +tkey_int = + +[motor_para] +motor_used = 0 +motor_shake = + +[disp_init] +disp_init_enable = 1 +disp_mode = 0 +screen0_output_type = 1 +screen0_output_mode = 5 +screen1_output_type = 1 +screen1_output_mode = 5 +fb0_framebuffer_num = 2 +fb0_format = 9 +fb0_pixel_sequence = 2 +fb0_scaler_mode_enable = 0 +fb1_framebuffer_num = 2 +fb1_format = 9 +fb1_pixel_sequence = 2 +fb1_scaler_mode_enable = 0 +lcd0_backlight = 5 +lcd0_bright = 50 +lcd0_saturation = 50 +lcd0_hue = 50 + +[lcd0_para] +lcd_used = 1 +lcd_x = 800 +lcd_y = 480 +lcd_dclk_freq = 33 +lcd_pwm_not_used = 0 +lcd_pwm_ch = 0 +lcd_pwm_freq = 10000 +lcd_pwm_pol = 0 +lcd_if = 0 +lcd_hbp = 46 +lcd_ht = 1055 +lcd_vbp = 23 +lcd_vt = 1050 +lcd_hv_if = 0 +lcd_hv_smode = 0 +lcd_hv_s888_if = 0 +lcd_hv_syuv_if = 0 +lcd_hv_vspw = 1 +lcd_hv_hspw = 30 +lcd_lvds_ch = 0 +lcd_lvds_mode = 0 +lcd_lvds_bitwidth = 0 +lcd_lvds_io_cross = 0 +lcd_cpu_if = 0 +lcd_frm = 0 +lcd_io_cfg0 = 268435456 +lcd_gamma_correction_en = 0 +lcd_gamma_tbl_0 = 0x0 +lcd_gamma_tbl_1 = 0x10101 +lcd_gamma_tbl_255 = 0xffffff +lcd_bl_en_used = 1 +lcd_bl_en = port:power1<1><0><1> +lcd_power_used = 0 +lcd_power = port:PB10<1><0><1> +lcd_pwm_used = 1 +lcd_pwm = port:PB02<2><0> +lcd_gpio_0 = +lcd_gpio_1 = +lcd_gpio_2 = +lcd_gpio_3 = +lcdd0 = port:PD00<2><0> +lcdd1 = port:PD01<2><0> +lcdd2 = port:PD02<2><0> +lcdd3 = port:PD03<2><0> +lcdd4 = port:PD04<2><0> +lcdd5 = port:PD05<2><0> +lcdd6 = port:PD06<2><0> +lcdd7 = port:PD07<2><0> +lcdd8 = port:PD08<2><0> +lcdd9 = port:PD09<2><0> +lcdd10 = port:PD10<2><0> +lcdd11 = port:PD11<2><0> +lcdd12 = port:PD12<2><0> +lcdd13 = port:PD13<2><0> +lcdd14 = port:PD14<2><0> +lcdd15 = port:PD15<2><0> +lcdd16 = port:PD16<2><0> +lcdd17 = port:PD17<2><0> +lcdd18 = port:PD18<2><0> +lcdd19 = port:PD19<2><0> +lcdd20 = port:PD20<2><0> +lcdd21 = port:PD21<2><0> +lcdd22 = port:PD22<2><0> +lcdd23 = port:PD23<2><0> +lcdclk = port:PD24<2><0> +lcdde = port:PD25<2><0> +lcdhsync = port:PD26<2><0> +lcdvsync = port:PD27<2><0> + +[tv_out_dac_para] +dac_used = 1 +dac0_src = 0 + +[hdmi_para] +hdmi_used = 0 + +[csi0_para] +csi_used = 0 +csi_mode = 0 +csi_dev_qty = 1 +csi_stby_mode = 1 +csi_mname = "gc0308" +csi_twi_id = 2 +csi_twi_addr = 0x42 +csi_if = 0 +csi_vflip = 0 +csi_hflip = 1 +csi_iovdd = "" +csi_avdd = "" +csi_dvdd = "" +csi_flash_pol = 1 +csi_mname_b = "" +csi_twi_id_b = 1 +csi_twi_addr_b = 0x78 +csi_if_b = 0 +csi_vflip_b = 1 +csi_hflip_b = 0 +csi_iovdd_b = "" +csi_avdd_b = "" +csi_dvdd_b = "" +csi_flash_pol_b = 1 +csi_pck = port:PE00<3> +csi_ck = port:PE01<3> +csi_hsync = port:PE02<3> +csi_vsync = port:PE03<3> +csi_d0 = port:PE04<3> +csi_d1 = port:PE05<3> +csi_d2 = port:PE06<3> +csi_d3 = port:PE07<3> +csi_d4 = port:PE08<3> +csi_d5 = port:PE09<3> +csi_d6 = port:PE10<3> +csi_d7 = port:PE11<3> +csi_reset = port:power3<1><0> +csi_power_en = +csi_stby = port:PB10<1><1> +csi_flash = +csi_af_en = +csi_reset_b = +csi_power_en_b = +csi_stby_b = +csi_flash_b = +csi_af_en_b = + +[csi1_para] +csi_used = 0 +csi_mode = 0 +csi_dev_qty = 1 +csi_stby_mode = 1 +csi_mname = "" +csi_twi_id = 1 +csi_twi_addr = 0xba +csi_if = 0 +csi_vflip = 0 +csi_hflip = 0 +csi_iovdd = "" +csi_avdd = "" +csi_dvdd = "" +csi_flash_pol = 1 +csi_mname_b = "" +csi_twi_id_b = 1 +csi_twi_addr_b = 0x78 +csi_if_b = 0 +csi_vflip_b = 1 +csi_hflip_b = 0 +csi_iovdd_b = "" +csi_avdd_b = "" +csi_dvdd_b = "" +csi_flash_pol_b = 1 +csi_reset = +csi_power_en = +csi_stby = +csi_flash = +csi_af_en = +csi_reset_b = +csi_power_en_b = +csi_stby_b = +csi_flash_b = +csi_af_en_b = + +[mmc0_para] +sdc_used = 1 +sdc_detmode = 3 +bus_width = 4 +sdc_d1 = port:PF00<2><1><2> +sdc_d0 = port:PF01<2><1><2> +sdc_clk = port:PF02<2><1><2> +sdc_cmd = port:PF03<2><1><2> +sdc_d3 = port:PF04<2><1><2> +sdc_d2 = port:PF05<2><1><2> +sdc_det = port:PG00<0><0> +sdc_use_wp = 0 +sdc_wp = + +[mmc1_para] +sdc_used = 0 +sdc_detmode = +bus_width = +sdc_cmd = +sdc_clk = +sdc_d0 = +sdc_d1 = +sdc_d2 = +sdc_d3 = +sdc_det = +sdc_use_wp = +sdc_wp = + +[mmc2_para] +sdc_used = 0 +sdc_detmode = 3 +bus_width = 4 +sdc_cmd = port:PE08<4><1><2> +sdc_clk = port:PE09<4><1><2> +sdc_d0 = port:PE04<4><1><2> +sdc_d1 = port:PE05<4><1><2> +sdc_d2 = port:PE06<4><1><2> +sdc_d3 = port:PE07<4><1><2> +sdc_det = +sdc_use_wp = 0 +sdc_wp = + +[ms_para] +ms_used = 0 +ms_bs = +ms_clk = +ms_d0 = +ms_d1 = +ms_d2 = +ms_d3 = +ms_det = + +[keypad_para] +kp_used = 0 +kp_in_size = +kp_out_size = +kp_in0 = +kp_in1 = +kp_in2 = +kp_in3 = +kp_in4 = +kp_in5 = +kp_in6 = +kp_in7 = +kp_out0 = +kp_out1 = +kp_out2 = +kp_out3 = +kp_out4 = +kp_out5 = +kp_out6 = +kp_out7 = + +[usbc0] +usb_used = 1 +usb_port_type = 1 +usb_detect_type = 0 +usb_id_gpio = +usb_det_vbus_gpio = port:PG01<0><0> +usb_drv_vbus_gpio = port:PG11<1><0><0> +usb_host_init_state = 1 +usb_controller_type = 0 + +[usbc1] +usb_used = 1 +usb_port_type = 1 +usb_detect_type = 0 +usb_id_gpio = port:PG02<0><0> +usb_det_vbus_gpio = port:PG01<0><0> +usb_drv_vbus_gpio = port:PG12<1><0><0> +usb_host_init_state = 1 +usb_controller_type = 0 + +[usb_feature] +vendor_id = 6353 +mass_storage_id = 1 +adb_id = 2 +manufacturer_name = "USB Developer" +product_name = "Android" +serial_number = "20080411" + +[msc_feature] +vendor_name = "USB 2.0" +product_name = "USB Flash Driver" +release = 100 +luns = 3 + +[gsensor_para] +gsensor_used = 0 +gsensor_name = "bma222" +gsensor_twi_id = 1 +gsensor_twi_addr = 0x18 +gsensor_int1 = +gsensor_int2 = + +[gps_para] +gps_used = 0 +gps_spi_id = +gps_spi_cs_num = +gps_lradc = +gps_clk = +gps_sign = +gps_mag = +gps_vcc_en = +gps_osc_en = +gps_rx_en = + +[sdio_wifi_para] +sdio_wifi_used = 0 +sdio_wifi_sdc_id = +sdio_wifi_mod_sel = + +[usb_wifi_para] +usb_wifi_used = 1 +usb_wifi_usbc_num = 0 + +[3g_para] +3g_used = 0 +3g_name = +3g_usbc_num = +3g_on_off = +3g_reset = +3g_poweron = +3g_wakeup_out = +3g_wakeup_in = + +[gy_para] +gy_used = 0 +gy_twi_id = 1 +gy_twi_addr = 0 +gy_int1 = +gy_int2 = + +[ls_para] +ls_used = 0 +ls_name = "ltr501als" +ls_twi_id = 1 +ls_twi_addr = +ls_int = + +[compass_para] +compass_used = 0 +compass_twi_id = +compass_twi_addr = +compass_int = + +[bt_para] +bt_used = 0 +bt_uart_id = +bt_mod_type = + +[i2s_para] +i2s_used = 0 +i2s_channel = +i2s_mclk = +i2s_bclk = +i2s_lrclk = +i2s_dout0 = +i2s_dout1 = +i2s_dout2 = +i2s_dout3 = +i2s_din = + +[spdif_para] +spdif_used = 0 +spdif_mclk = +spdif_dout = +spdif_din = + +[audio_para] +audio_used = 1 +capture_used = 1 +playback_used = 1 +audio_lr_change = 0 + +[ir_para] +ir_used = 0 +ir0_rx = port:PB04<2> + +[rtc_para] +rtc_used = 0 +rtc_name = "pcf8563" +rtc_twi_id = 1 +rtc_twi_addr = 81 + +[pmu_para] +pmu_used = 0 +pmu_twi_addr = 52 +pmu_twi_id = 0 +pmu_irq_id = 0 +pmu_battery_rdc = 200 +pmu_battery_cap = 2600 +pmu_init_chgcur = 300 +pmu_earlysuspend_chgcur = 600 +pmu_suspend_chgcur = 1000 +pmu_resume_chgcur = 300 +pmu_shutdown_chgcur = 1000 +pmu_init_chgvol = 4200 +pmu_init_chgend_rate = 15 +pmu_init_chg_enabled = 1 +pmu_init_adc_freq = 100 +pmu_init_adc_freqc = 100 +pmu_init_chg_pretime = 50 +pmu_init_chg_csttime = 720 +pmu_bat_para1 = 0 +pmu_bat_para2 = 0 +pmu_bat_para3 = 1 +pmu_bat_para4 = 5 +pmu_bat_para5 = 7 +pmu_bat_para6 = 13 +pmu_bat_para7 = 16 +pmu_bat_para8 = 26 +pmu_bat_para9 = 36 +pmu_bat_para10 = 46 +pmu_bat_para11 = 53 +pmu_bat_para12 = 61 +pmu_bat_para13 = 73 +pmu_bat_para14 = 84 +pmu_bat_para15 = 92 +pmu_bat_para16 = 100 +pmu_usbvol = 4000 +pmu_usbcur = 0 +pmu_usbvol_pc = 4000 +pmu_usbcur_pc = 0 +pmu_pwroff_vol = 3300 +pmu_pwron_vol = 2900 +pmu_pekoff_time = 6000 +pmu_pekoff_en = 1 +pmu_peklong_time = 1500 +pmu_pekon_time = 1000 +pmu_pwrok_time = 64 +pmu_pwrnoe_time = 2000 +pmu_intotp_en = 1 +pmu_used2 = 0 +pmu_adpdet = +pmu_init_chgcur2 = 400 +pmu_earlysuspend_chgcur2 = 600 +pmu_suspend_chgcur2 = 1200 +pmu_resume_chgcur2 = 400 +pmu_shutdown_chgcur2 = 1200 +pmu_suspendpwroff_vol = 3500 +pmu_batdeten = 1 + +[recovery_key] +key_min = 4 +key_max = 6 + +[gpio_para] +gpio_used = 1 +gpio_num = 15 +gpio_pin_1 = port:PB03<1> +gpio_pin_2 = port:PB04<1> +gpio_pin_3 = port:PB10<1> +gpio_pin_4 = port:PB02<0> +gpio_pin_5 = port:PE05<1><0> +gpio_pin_6 = port:PE04<1><1> +gpio_pin_7 = port:PE07<0> +gpio_pin_8 = port:PE08<1> +gpio_pin_9 = port:PE09<1> +gpio_pin_10 = port:PE10<1> +gpio_pin_11 = port:PE11<1> +gpio_pin_12 = port:PG09<1> +gpio_pin_13 = port:PG10<1> +gpio_pin_14 = port:PG11<1> +gpio_pin_15 = port:PE01<1><0> + +[pwm0_para] +pwm_used = 1 +pwm_period = 10000 +pwm_duty_percent = 99 + +[leds_para] +leds_used = 1 +leds_num = 1 +leds_pin_1 = port:PG09<1><0> +leds_name_1 = "green:pg09:led1" +leds_default_1 = 0 +leds_trigger_1 = "heartbeat" + diff --git a/configuration.sh b/configuration.sh index 04a626b044..b6986ace6a 100644 --- a/configuration.sh +++ b/configuration.sh @@ -76,6 +76,15 @@ MODULES_NEXT="bonding" ;; + olinux-som-a13)#enabled + #description A13 single core 512Mb SoM + #build 6 + LINUXFAMILY="sun5i" + BOOTCONFIG="A13-OLinuXino_defconfig" + MODULES="gpio_sunxi spi_sunxi" + MODULES_NEXT="bonding" + ;; + cubieboard)#enabled #description A10 single core 1Gb SoC #build 6 @@ -299,7 +308,7 @@ # board family configurations case $LINUXFAMILY in - sun4i|sun7i|sun8i|sun6i|sun9i) + sun4i|sun5i|sun7i|sun8i|sun6i|sun9i) [[ -z $LINUXCONFIG && $BRANCH == "default" ]] && LINUXCONFIG="linux-"$LINUXFAMILY-"$BRANCH" [[ -z $LINUXCONFIG && $BRANCH != "default" ]] && LINUXCONFIG="linux-sunxi-"$BRANCH # Kernel diff --git a/patch/kernel/sun5i-default/0010-patch-3.4.104-105.patch b/patch/kernel/sun5i-default/0010-patch-3.4.104-105.patch new file mode 100644 index 0000000000..599ba3c885 --- /dev/null +++ b/patch/kernel/sun5i-default/0010-patch-3.4.104-105.patch @@ -0,0 +1,2995 @@ +diff --git a/Documentation/cgroups/cpusets.txt b/Documentation/cgroups/cpusets.txt +index cefd3d8bbd11..a52a39f8a8d4 100644 +--- a/Documentation/cgroups/cpusets.txt ++++ b/Documentation/cgroups/cpusets.txt +@@ -345,14 +345,14 @@ the named feature on. + The implementation is simple. + + Setting the flag 'cpuset.memory_spread_page' turns on a per-process flag +-PF_SPREAD_PAGE for each task that is in that cpuset or subsequently ++PFA_SPREAD_PAGE for each task that is in that cpuset or subsequently + joins that cpuset. The page allocation calls for the page cache +-is modified to perform an inline check for this PF_SPREAD_PAGE task ++is modified to perform an inline check for this PFA_SPREAD_PAGE task + flag, and if set, a call to a new routine cpuset_mem_spread_node() + returns the node to prefer for the allocation. + + Similarly, setting 'cpuset.memory_spread_slab' turns on the flag +-PF_SPREAD_SLAB, and appropriately marked slab caches will allocate ++PFA_SPREAD_SLAB, and appropriately marked slab caches will allocate + pages from the node returned by cpuset_mem_spread_node(). + + The cpuset_mem_spread_node() routine is also simple. It uses the +diff --git a/Makefile b/Makefile +index b66396efb001..cf2c8a82ca3e 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 4 +-SUBLEVEL = 104 ++SUBLEVEL = 105 + EXTRAVERSION = + NAME = Saber-toothed Squirrel + +diff --git a/arch/arm/mm/alignment.c b/arch/arm/mm/alignment.c +index fc000e3ac44e..17f4ea2fe3cf 100644 +--- a/arch/arm/mm/alignment.c ++++ b/arch/arm/mm/alignment.c +@@ -39,6 +39,7 @@ + * This code is not portable to processors with late data abort handling. + */ + #define CODING_BITS(i) (i & 0x0e000000) ++#define COND_BITS(i) (i & 0xf0000000) + + #define LDST_I_BIT(i) (i & (1 << 26)) /* Immediate constant */ + #define LDST_P_BIT(i) (i & (1 << 24)) /* Preindex */ +@@ -813,6 +814,8 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs) + break; + + case 0x04000000: /* ldr or str immediate */ ++ if (COND_BITS(instr) == 0xf0000000) /* NEON VLDn, VSTn */ ++ goto bad; + offset.un = OFFSET_BITS(instr); + handler = do_alignment_ldrstr; + break; +diff --git a/arch/mips/boot/compressed/decompress.c b/arch/mips/boot/compressed/decompress.c +index 5cad0faefa17..ca51d69a99ff 100644 +--- a/arch/mips/boot/compressed/decompress.c ++++ b/arch/mips/boot/compressed/decompress.c +@@ -13,6 +13,7 @@ + + #include + #include ++#include + + #include + +diff --git a/arch/mips/kernel/mcount.S b/arch/mips/kernel/mcount.S +index 4c968e7efb74..55eca41c91c2 100644 +--- a/arch/mips/kernel/mcount.S ++++ b/arch/mips/kernel/mcount.S +@@ -119,7 +119,11 @@ NESTED(_mcount, PT_SIZE, ra) + nop + #endif + b ftrace_stub ++#ifdef CONFIG_32BIT ++ addiu sp, sp, 8 ++#else + nop ++#endif + + static_trace: + MCOUNT_SAVE_REGS +@@ -129,6 +133,9 @@ static_trace: + move a1, AT /* arg2: parent's return address */ + + MCOUNT_RESTORE_REGS ++#ifdef CONFIG_32BIT ++ addiu sp, sp, 8 ++#endif + .globl ftrace_stub + ftrace_stub: + RETURN_BACK +@@ -177,6 +184,11 @@ NESTED(ftrace_graph_caller, PT_SIZE, ra) + jal prepare_ftrace_return + nop + MCOUNT_RESTORE_REGS ++#ifndef CONFIG_DYNAMIC_FTRACE ++#ifdef CONFIG_32BIT ++ addiu sp, sp, 8 ++#endif ++#endif + RETURN_BACK + END(ftrace_graph_caller) + +diff --git a/arch/parisc/Makefile b/arch/parisc/Makefile +index 19ab7b2ea1cd..ac93ca20b7e2 100644 +--- a/arch/parisc/Makefile ++++ b/arch/parisc/Makefile +@@ -51,7 +51,12 @@ cflags-y := -pipe + + # These flags should be implied by an hppa-linux configuration, but they + # are not in gcc 3.2. +-cflags-y += -mno-space-regs -mfast-indirect-calls ++cflags-y += -mno-space-regs ++ ++# -mfast-indirect-calls is only relevant for 32-bit kernels. ++ifndef CONFIG_64BIT ++cflags-y += -mfast-indirect-calls ++endif + + # Currently we save and restore fpregs on all kernel entry/interruption paths. + # If that gets optimized, we might need to disable the use of fpregs in the +diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c +index 53c973ebc0c8..0f250d12a18c 100644 +--- a/arch/s390/kvm/kvm-s390.c ++++ b/arch/s390/kvm/kvm-s390.c +@@ -566,17 +566,6 @@ rerun_vcpu: + + BUG_ON(vcpu->kvm->arch.float_int.local_int[vcpu->vcpu_id] == NULL); + +- switch (kvm_run->exit_reason) { +- case KVM_EXIT_S390_SIEIC: +- case KVM_EXIT_UNKNOWN: +- case KVM_EXIT_INTR: +- case KVM_EXIT_S390_RESET: +- case KVM_EXIT_S390_UCONTROL: +- break; +- default: +- BUG(); +- } +- + vcpu->arch.sie_block->gpsw.mask = kvm_run->psw_mask; + vcpu->arch.sie_block->gpsw.addr = kvm_run->psw_addr; + if (kvm_run->kvm_dirty_regs & KVM_SYNC_PREFIX) { +diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c +index d28c59588ad3..c7dbf029c5f7 100644 +--- a/arch/x86/kernel/smpboot.c ++++ b/arch/x86/kernel/smpboot.c +@@ -1248,6 +1248,9 @@ static void remove_siblinginfo(int cpu) + + for_each_cpu(sibling, cpu_sibling_mask(cpu)) + cpumask_clear_cpu(cpu, cpu_sibling_mask(sibling)); ++ for_each_cpu(sibling, cpu_llc_shared_mask(cpu)) ++ cpumask_clear_cpu(cpu, cpu_llc_shared_mask(sibling)); ++ cpumask_clear(cpu_llc_shared_mask(cpu)); + cpumask_clear(cpu_sibling_mask(cpu)); + cpumask_clear(cpu_core_mask(cpu)); + c->phys_proc_id = 0; +diff --git a/block/genhd.c b/block/genhd.c +index d815a0fb52dd..60f7e6ce76b4 100644 +--- a/block/genhd.c ++++ b/block/genhd.c +@@ -27,10 +27,10 @@ struct kobject *block_depr; + /* for extended dynamic devt allocation, currently only one major is used */ + #define NR_EXT_DEVT (1 << MINORBITS) + +-/* For extended devt allocation. ext_devt_mutex prevents look up ++/* For extended devt allocation. ext_devt_lock prevents look up + * results from going away underneath its user. + */ +-static DEFINE_MUTEX(ext_devt_mutex); ++static DEFINE_SPINLOCK(ext_devt_lock); + static DEFINE_IDR(ext_devt_idr); + + static struct device_type disk_type; +@@ -420,13 +420,13 @@ int blk_alloc_devt(struct hd_struct *part, dev_t *devt) + do { + if (!idr_pre_get(&ext_devt_idr, GFP_KERNEL)) + return -ENOMEM; +- mutex_lock(&ext_devt_mutex); ++ spin_lock(&ext_devt_lock); + rc = idr_get_new(&ext_devt_idr, part, &idx); + if (!rc && idx >= NR_EXT_DEVT) { + idr_remove(&ext_devt_idr, idx); + rc = -EBUSY; + } +- mutex_unlock(&ext_devt_mutex); ++ spin_unlock(&ext_devt_lock); + } while (rc == -EAGAIN); + + if (rc) +@@ -447,15 +447,13 @@ int blk_alloc_devt(struct hd_struct *part, dev_t *devt) + */ + void blk_free_devt(dev_t devt) + { +- might_sleep(); +- + if (devt == MKDEV(0, 0)) + return; + + if (MAJOR(devt) == BLOCK_EXT_MAJOR) { +- mutex_lock(&ext_devt_mutex); ++ spin_lock(&ext_devt_lock); + idr_remove(&ext_devt_idr, blk_mangle_minor(MINOR(devt))); +- mutex_unlock(&ext_devt_mutex); ++ spin_unlock(&ext_devt_lock); + } + } + +@@ -662,7 +660,6 @@ void del_gendisk(struct gendisk *disk) + if (!sysfs_deprecated) + sysfs_remove_link(block_depr, dev_name(disk_to_dev(disk))); + device_del(disk_to_dev(disk)); +- blk_free_devt(disk_to_dev(disk)->devt); + } + EXPORT_SYMBOL(del_gendisk); + +@@ -687,13 +684,13 @@ struct gendisk *get_gendisk(dev_t devt, int *partno) + } else { + struct hd_struct *part; + +- mutex_lock(&ext_devt_mutex); ++ spin_lock(&ext_devt_lock); + part = idr_find(&ext_devt_idr, blk_mangle_minor(MINOR(devt))); + if (part && get_disk(part_to_disk(part))) { + *partno = part->partno; + disk = part_to_disk(part); + } +- mutex_unlock(&ext_devt_mutex); ++ spin_unlock(&ext_devt_lock); + } + + return disk; +@@ -1101,6 +1098,7 @@ static void disk_release(struct device *dev) + { + struct gendisk *disk = dev_to_disk(dev); + ++ blk_free_devt(dev->devt); + disk_release_events(disk); + kfree(disk->random); + disk_replace_part_tbl(disk, NULL); +diff --git a/block/partition-generic.c b/block/partition-generic.c +index 7b8b8d17764c..daafc85ca683 100644 +--- a/block/partition-generic.c ++++ b/block/partition-generic.c +@@ -211,6 +211,7 @@ static const struct attribute_group *part_attr_groups[] = { + static void part_release(struct device *dev) + { + struct hd_struct *p = dev_to_part(dev); ++ blk_free_devt(dev->devt); + free_part_stats(p); + free_part_info(p); + kfree(p); +@@ -253,7 +254,6 @@ void delete_partition(struct gendisk *disk, int partno) + rcu_assign_pointer(ptbl->last_lookup, NULL); + kobject_put(part->holder_dir); + device_del(part_to_dev(part)); +- blk_free_devt(part_devt(part)); + + hd_struct_put(part); + } +diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c +index 6cba4282588b..e1180ce63e45 100644 +--- a/drivers/acpi/processor_idle.c ++++ b/drivers/acpi/processor_idle.c +@@ -1195,9 +1195,9 @@ int acpi_processor_cst_has_changed(struct acpi_processor *pr) + + if (pr->id == 0 && cpuidle_get_driver() == &acpi_idle_driver) { + +- cpuidle_pause_and_lock(); + /* Protect against cpu-hotplug */ + get_online_cpus(); ++ cpuidle_pause_and_lock(); + + /* Disable all cpuidle devices */ + for_each_online_cpu(cpu) { +@@ -1222,8 +1222,8 @@ int acpi_processor_cst_has_changed(struct acpi_processor *pr) + cpuidle_enable_device(&_pr->power.dev); + } + } +- put_online_cpus(); + cpuidle_resume_and_unlock(); ++ put_online_cpus(); + } + + return 0; +diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c +index 0a450eb517e0..d366a75e6705 100644 +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -305,6 +305,14 @@ static const struct pci_device_id ahci_pci_tbl[] = { + { PCI_VDEVICE(INTEL, 0x9c85), board_ahci }, /* Wildcat Point-LP RAID */ + { PCI_VDEVICE(INTEL, 0x9c87), board_ahci }, /* Wildcat Point-LP RAID */ + { PCI_VDEVICE(INTEL, 0x9c8f), board_ahci }, /* Wildcat Point-LP RAID */ ++ { PCI_VDEVICE(INTEL, 0x8c82), board_ahci }, /* 9 Series AHCI */ ++ { PCI_VDEVICE(INTEL, 0x8c83), board_ahci }, /* 9 Series AHCI */ ++ { PCI_VDEVICE(INTEL, 0x8c84), board_ahci }, /* 9 Series RAID */ ++ { PCI_VDEVICE(INTEL, 0x8c85), board_ahci }, /* 9 Series RAID */ ++ { PCI_VDEVICE(INTEL, 0x8c86), board_ahci }, /* 9 Series RAID */ ++ { PCI_VDEVICE(INTEL, 0x8c87), board_ahci }, /* 9 Series RAID */ ++ { PCI_VDEVICE(INTEL, 0x8c8e), board_ahci }, /* 9 Series RAID */ ++ { PCI_VDEVICE(INTEL, 0x8c8f), board_ahci }, /* 9 Series RAID */ + + /* JMicron 360/1/3/5/6, match class to avoid IDE function */ + { PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID, +@@ -435,6 +443,8 @@ static const struct pci_device_id ahci_pci_tbl[] = { + .driver_data = board_ahci_yes_fbs }, /* 88se9125 */ + { PCI_DEVICE(0x1b4b, 0x917a), + .driver_data = board_ahci_yes_fbs }, /* 88se9172 */ ++ { PCI_DEVICE(0x1b4b, 0x9182), ++ .driver_data = board_ahci_yes_fbs }, /* 88se9182 */ + { PCI_DEVICE(0x1b4b, 0x9192), + .driver_data = board_ahci_yes_fbs }, /* 88se9172 on some Gigabyte */ + { PCI_DEVICE(0x1b4b, 0x91a3), +diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c +index 9f165a81d0ea..2f081a316b56 100644 +--- a/drivers/ata/ata_piix.c ++++ b/drivers/ata/ata_piix.c +@@ -362,6 +362,14 @@ static const struct pci_device_id piix_pci_tbl[] = { + { 0x8086, 0x0F21, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_byt }, + /* SATA Controller IDE (Coleto Creek) */ + { 0x8086, 0x23a6, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata }, ++ /* SATA Controller IDE (9 Series) */ ++ { 0x8086, 0x8c88, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_snb }, ++ /* SATA Controller IDE (9 Series) */ ++ { 0x8086, 0x8c89, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_snb }, ++ /* SATA Controller IDE (9 Series) */ ++ { 0x8086, 0x8c80, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb }, ++ /* SATA Controller IDE (9 Series) */ ++ { 0x8086, 0x8c81, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb }, + + { } /* terminate list */ + }; +diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c +index ca72d1f67282..e5545427b46b 100644 +--- a/drivers/base/regmap/regmap.c ++++ b/drivers/base/regmap/regmap.c +@@ -48,7 +48,7 @@ bool regmap_readable(struct regmap *map, unsigned int reg) + + bool regmap_volatile(struct regmap *map, unsigned int reg) + { +- if (!regmap_readable(map, reg)) ++ if (!map->format.format_write && !regmap_readable(map, reg)) + return false; + + if (map->volatile_reg) +diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c +index 98a8c05d4f23..d4550f9962b5 100644 +--- a/drivers/bluetooth/hci_ldisc.c ++++ b/drivers/bluetooth/hci_ldisc.c +@@ -118,10 +118,6 @@ static inline struct sk_buff *hci_uart_dequeue(struct hci_uart *hu) + + int hci_uart_tx_wakeup(struct hci_uart *hu) + { +- struct tty_struct *tty = hu->tty; +- struct hci_dev *hdev = hu->hdev; +- struct sk_buff *skb; +- + if (test_and_set_bit(HCI_UART_SENDING, &hu->tx_state)) { + set_bit(HCI_UART_TX_WAKEUP, &hu->tx_state); + return 0; +@@ -129,6 +125,22 @@ int hci_uart_tx_wakeup(struct hci_uart *hu) + + BT_DBG(""); + ++ schedule_work(&hu->write_work); ++ ++ return 0; ++} ++ ++static void hci_uart_write_work(struct work_struct *work) ++{ ++ struct hci_uart *hu = container_of(work, struct hci_uart, write_work); ++ struct tty_struct *tty = hu->tty; ++ struct hci_dev *hdev = hu->hdev; ++ struct sk_buff *skb; ++ ++ /* REVISIT: should we cope with bad skbs or ->write() returning ++ * and error value ? ++ */ ++ + restart: + clear_bit(HCI_UART_TX_WAKEUP, &hu->tx_state); + +@@ -153,7 +165,6 @@ restart: + goto restart; + + clear_bit(HCI_UART_SENDING, &hu->tx_state); +- return 0; + } + + /* ------- Interface to HCI layer ------ */ +@@ -264,6 +275,8 @@ static int hci_uart_tty_open(struct tty_struct *tty) + hu->tty = tty; + tty->receive_room = 65536; + ++ INIT_WORK(&hu->write_work, hci_uart_write_work); ++ + spin_lock_init(&hu->rx_lock); + + /* Flush any pending characters in the driver and line discipline. */ +@@ -298,6 +311,8 @@ static void hci_uart_tty_close(struct tty_struct *tty) + if (hdev) + hci_uart_close(hdev); + ++ cancel_work_sync(&hu->write_work); ++ + if (test_and_clear_bit(HCI_UART_PROTO_SET, &hu->flags)) { + if (hdev) { + hci_unregister_dev(hdev); +diff --git a/drivers/bluetooth/hci_uart.h b/drivers/bluetooth/hci_uart.h +index 6cf6ab22ad21..af93d83e503a 100644 +--- a/drivers/bluetooth/hci_uart.h ++++ b/drivers/bluetooth/hci_uart.h +@@ -66,6 +66,8 @@ struct hci_uart { + unsigned long flags; + unsigned long hdev_flags; + ++ struct work_struct write_work; ++ + struct hci_uart_proto *proto; + void *priv; + +diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c +index a2c9e56c0c1a..d9e359abc419 100644 +--- a/drivers/gpu/drm/i915/intel_bios.c ++++ b/drivers/gpu/drm/i915/intel_bios.c +@@ -651,7 +651,7 @@ init_vbt_defaults(struct drm_i915_private *dev_priv) + DRM_DEBUG_KMS("Set default to SSC at %dMHz\n", dev_priv->lvds_ssc_freq); + } + +-static int __init intel_no_opregion_vbt_callback(const struct dmi_system_id *id) ++static int intel_no_opregion_vbt_callback(const struct dmi_system_id *id) + { + DRM_DEBUG_KMS("Falling back to manually reading VBT from " + "VBIOS ROM for %s\n", +diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c +index a83f7acdbe03..b4f71c22e07d 100644 +--- a/drivers/gpu/drm/i915/intel_crt.c ++++ b/drivers/gpu/drm/i915/intel_crt.c +@@ -564,7 +564,7 @@ static const struct drm_encoder_funcs intel_crt_enc_funcs = { + .destroy = intel_encoder_destroy, + }; + +-static int __init intel_no_crt_dmi_callback(const struct dmi_system_id *id) ++static int intel_no_crt_dmi_callback(const struct dmi_system_id *id) + { + DRM_DEBUG_KMS("Skipping CRT initialization for %s\n", id->ident); + return 1; +diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c +index b695ab48ebf0..77190cc774cb 100644 +--- a/drivers/gpu/drm/i915/intel_lvds.c ++++ b/drivers/gpu/drm/i915/intel_lvds.c +@@ -619,7 +619,7 @@ static const struct drm_encoder_funcs intel_lvds_enc_funcs = { + .destroy = intel_encoder_destroy, + }; + +-static int __init intel_no_lvds_dmi_callback(const struct dmi_system_id *id) ++static int intel_no_lvds_dmi_callback(const struct dmi_system_id *id) + { + DRM_DEBUG_KMS("Skipping LVDS initialization for %s\n", id->ident); + return 1; +diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c +index 6d0c32b9e8aa..1ce67435918b 100644 +--- a/drivers/gpu/drm/radeon/radeon_atombios.c ++++ b/drivers/gpu/drm/radeon/radeon_atombios.c +@@ -463,6 +463,13 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev, + } + } + ++ /* Fujitsu D3003-S2 board lists DVI-I as DVI-I and VGA */ ++ if ((dev->pdev->device == 0x9805) && ++ (dev->pdev->subsystem_vendor == 0x1734) && ++ (dev->pdev->subsystem_device == 0x11bd)) { ++ if (*connector_type == DRM_MODE_CONNECTOR_VGA) ++ return false; ++ } + + return true; + } +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c +index a0c2f12b1e1b..decca8251bfa 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c +@@ -163,8 +163,9 @@ void vmw_fifo_release(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo) + + mutex_lock(&dev_priv->hw_mutex); + ++ vmw_write(dev_priv, SVGA_REG_SYNC, SVGA_SYNC_GENERIC); + while (vmw_read(dev_priv, SVGA_REG_BUSY) != 0) +- vmw_write(dev_priv, SVGA_REG_SYNC, SVGA_SYNC_GENERIC); ++ ; + + dev_priv->last_read_seqno = ioread32(fifo_mem + SVGA_FIFO_FENCE); + +diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c +index d93ea6417d15..f2c2ffedeff5 100644 +--- a/drivers/input/mouse/elantech.c ++++ b/drivers/input/mouse/elantech.c +@@ -1218,6 +1218,13 @@ static bool elantech_is_signature_valid(const unsigned char *param) + if (param[1] == 0) + return true; + ++ /* ++ * Some models have a revision higher then 20. Meaning param[2] may ++ * be 10 or 20, skip the rates check for these. ++ */ ++ if (param[0] == 0x46 && (param[1] & 0xef) == 0x0f && param[2] < 40) ++ return true; ++ + for (i = 0; i < ARRAY_SIZE(rates); i++) + if (param[2] == rates[i]) + return false; +diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c +index 326e19459ee6..32b1363f7ace 100644 +--- a/drivers/input/mouse/synaptics.c ++++ b/drivers/input/mouse/synaptics.c +@@ -517,10 +517,61 @@ static int synaptics_parse_hw_state(const unsigned char buf[], + ((buf[0] & 0x04) >> 1) | + ((buf[3] & 0x04) >> 2)); + ++ if ((SYN_CAP_ADV_GESTURE(priv->ext_cap_0c) || ++ SYN_CAP_IMAGE_SENSOR(priv->ext_cap_0c)) && ++ hw->w == 2) { ++ synaptics_parse_agm(buf, priv, hw); ++ return 1; ++ } ++ ++ hw->x = (((buf[3] & 0x10) << 8) | ++ ((buf[1] & 0x0f) << 8) | ++ buf[4]); ++ hw->y = (((buf[3] & 0x20) << 7) | ++ ((buf[1] & 0xf0) << 4) | ++ buf[5]); ++ hw->z = buf[2]; ++ + hw->left = (buf[0] & 0x01) ? 1 : 0; + hw->right = (buf[0] & 0x02) ? 1 : 0; + +- if (SYN_CAP_CLICKPAD(priv->ext_cap_0c)) { ++ if (SYN_CAP_FORCEPAD(priv->ext_cap_0c)) { ++ /* ++ * ForcePads, like Clickpads, use middle button ++ * bits to report primary button clicks. ++ * Unfortunately they report primary button not ++ * only when user presses on the pad above certain ++ * threshold, but also when there are more than one ++ * finger on the touchpad, which interferes with ++ * out multi-finger gestures. ++ */ ++ if (hw->z == 0) { ++ /* No contacts */ ++ priv->press = priv->report_press = false; ++ } else if (hw->w >= 4 && ((buf[0] ^ buf[3]) & 0x01)) { ++ /* ++ * Single-finger touch with pressure above ++ * the threshold. If pressure stays long ++ * enough, we'll start reporting primary ++ * button. We rely on the device continuing ++ * sending data even if finger does not ++ * move. ++ */ ++ if (!priv->press) { ++ priv->press_start = jiffies; ++ priv->press = true; ++ } else if (time_after(jiffies, ++ priv->press_start + ++ msecs_to_jiffies(50))) { ++ priv->report_press = true; ++ } ++ } else { ++ priv->press = false; ++ } ++ ++ hw->left = priv->report_press; ++ ++ } else if (SYN_CAP_CLICKPAD(priv->ext_cap_0c)) { + /* + * Clickpad's button is transmitted as middle button, + * however, since it is primary button, we will report +@@ -539,21 +590,6 @@ static int synaptics_parse_hw_state(const unsigned char buf[], + hw->down = ((buf[0] ^ buf[3]) & 0x02) ? 1 : 0; + } + +- if ((SYN_CAP_ADV_GESTURE(priv->ext_cap_0c) || +- SYN_CAP_IMAGE_SENSOR(priv->ext_cap_0c)) && +- hw->w == 2) { +- synaptics_parse_agm(buf, priv, hw); +- return 1; +- } +- +- hw->x = (((buf[3] & 0x10) << 8) | +- ((buf[1] & 0x0f) << 8) | +- buf[4]); +- hw->y = (((buf[3] & 0x20) << 7) | +- ((buf[1] & 0xf0) << 4) | +- buf[5]); +- hw->z = buf[2]; +- + if (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) && + ((buf[0] ^ buf[3]) & 0x02)) { + switch (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) & ~0x01) { +diff --git a/drivers/input/mouse/synaptics.h b/drivers/input/mouse/synaptics.h +index fd26ccca13d7..ac1b77354cac 100644 +--- a/drivers/input/mouse/synaptics.h ++++ b/drivers/input/mouse/synaptics.h +@@ -77,6 +77,11 @@ + * 2 0x08 image sensor image sensor tracks 5 fingers, but only + * reports 2. + * 2 0x20 report min query 0x0f gives min coord reported ++ * 2 0x80 forcepad forcepad is a variant of clickpad that ++ * does not have physical buttons but rather ++ * uses pressure above certain threshold to ++ * report primary clicks. Forcepads also have ++ * clickpad bit set. + */ + #define SYN_CAP_CLICKPAD(ex0c) ((ex0c) & 0x100000) /* 1-button ClickPad */ + #define SYN_CAP_CLICKPAD2BTN(ex0c) ((ex0c) & 0x000100) /* 2-button ClickPad */ +@@ -85,6 +90,7 @@ + #define SYN_CAP_ADV_GESTURE(ex0c) ((ex0c) & 0x080000) + #define SYN_CAP_REDUCED_FILTERING(ex0c) ((ex0c) & 0x000400) + #define SYN_CAP_IMAGE_SENSOR(ex0c) ((ex0c) & 0x000800) ++#define SYN_CAP_FORCEPAD(ex0c) ((ex0c) & 0x008000) + + /* synaptics modes query bits */ + #define SYN_MODE_ABSOLUTE(m) ((m) & (1 << 7)) +@@ -174,6 +180,11 @@ struct synaptics_data { + */ + struct synaptics_hw_state agm; + bool agm_pending; /* new AGM packet received */ ++ ++ /* ForcePad handling */ ++ unsigned long press_start; ++ bool press; ++ bool report_press; + }; + + void synaptics_module_init(void); +diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h +index 0ec9abbe31fe..1291673bd57e 100644 +--- a/drivers/input/serio/i8042-x86ia64io.h ++++ b/drivers/input/serio/i8042-x86ia64io.h +@@ -458,6 +458,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv4 Notebook PC"), + }, + }, ++ { ++ /* Avatar AVIU-145A6 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Intel"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "IC4I"), ++ }, ++ }, + { } + }; + +@@ -601,6 +608,14 @@ static const struct dmi_system_id __initconst i8042_dmi_notimeout_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv4 Notebook PC"), + }, + }, ++ { ++ /* Fujitsu U574 laptop */ ++ /* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK U574"), ++ }, ++ }, + { } + }; + +diff --git a/drivers/input/serio/serport.c b/drivers/input/serio/serport.c +index 8755f5f3ad37..e4ecf3b64794 100644 +--- a/drivers/input/serio/serport.c ++++ b/drivers/input/serio/serport.c +@@ -21,6 +21,7 @@ + #include + #include + #include ++#include + + MODULE_AUTHOR("Vojtech Pavlik "); + MODULE_DESCRIPTION("Input device TTY line discipline"); +@@ -196,28 +197,55 @@ static ssize_t serport_ldisc_read(struct tty_struct * tty, struct file * file, u + return 0; + } + ++static void serport_set_type(struct tty_struct *tty, unsigned long type) ++{ ++ struct serport *serport = tty->disc_data; ++ ++ serport->id.proto = type & 0x000000ff; ++ serport->id.id = (type & 0x0000ff00) >> 8; ++ serport->id.extra = (type & 0x00ff0000) >> 16; ++} ++ + /* + * serport_ldisc_ioctl() allows to set the port protocol, and device ID + */ + +-static int serport_ldisc_ioctl(struct tty_struct * tty, struct file * file, unsigned int cmd, unsigned long arg) ++static int serport_ldisc_ioctl(struct tty_struct *tty, struct file *file, ++ unsigned int cmd, unsigned long arg) + { +- struct serport *serport = (struct serport*) tty->disc_data; +- unsigned long type; +- + if (cmd == SPIOCSTYPE) { ++ unsigned long type; ++ + if (get_user(type, (unsigned long __user *) arg)) + return -EFAULT; + +- serport->id.proto = type & 0x000000ff; +- serport->id.id = (type & 0x0000ff00) >> 8; +- serport->id.extra = (type & 0x00ff0000) >> 16; ++ serport_set_type(tty, type); ++ return 0; ++ } ++ ++ return -EINVAL; ++} ++ ++#ifdef CONFIG_COMPAT ++#define COMPAT_SPIOCSTYPE _IOW('q', 0x01, compat_ulong_t) ++static long serport_ldisc_compat_ioctl(struct tty_struct *tty, ++ struct file *file, ++ unsigned int cmd, unsigned long arg) ++{ ++ if (cmd == COMPAT_SPIOCSTYPE) { ++ void __user *uarg = compat_ptr(arg); ++ compat_ulong_t compat_type; ++ ++ if (get_user(compat_type, (compat_ulong_t __user *)uarg)) ++ return -EFAULT; + ++ serport_set_type(tty, compat_type); + return 0; + } + + return -EINVAL; + } ++#endif + + static void serport_ldisc_write_wakeup(struct tty_struct * tty) + { +@@ -241,6 +269,9 @@ static struct tty_ldisc_ops serport_ldisc = { + .close = serport_ldisc_close, + .read = serport_ldisc_read, + .ioctl = serport_ldisc_ioctl, ++#ifdef CONFIG_COMPAT ++ .compat_ioctl = serport_ldisc_compat_ioctl, ++#endif + .receive_buf = serport_ldisc_receive, + .write_wakeup = serport_ldisc_write_wakeup + }; +diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c +index 535c3e276fc7..926989d6419f 100644 +--- a/drivers/md/dm-crypt.c ++++ b/drivers/md/dm-crypt.c +@@ -1566,6 +1566,7 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv) + unsigned int key_size, opt_params; + unsigned long long tmpll; + int ret; ++ size_t iv_size_padding; + struct dm_arg_set as; + const char *opt_string; + char dummy; +@@ -1602,12 +1603,23 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv) + + cc->dmreq_start = sizeof(struct ablkcipher_request); + cc->dmreq_start += crypto_ablkcipher_reqsize(any_tfm(cc)); +- cc->dmreq_start = ALIGN(cc->dmreq_start, crypto_tfm_ctx_alignment()); +- cc->dmreq_start += crypto_ablkcipher_alignmask(any_tfm(cc)) & +- ~(crypto_tfm_ctx_alignment() - 1); ++ cc->dmreq_start = ALIGN(cc->dmreq_start, __alignof__(struct dm_crypt_request)); ++ ++ if (crypto_ablkcipher_alignmask(any_tfm(cc)) < CRYPTO_MINALIGN) { ++ /* Allocate the padding exactly */ ++ iv_size_padding = -(cc->dmreq_start + sizeof(struct dm_crypt_request)) ++ & crypto_ablkcipher_alignmask(any_tfm(cc)); ++ } else { ++ /* ++ * If the cipher requires greater alignment than kmalloc ++ * alignment, we don't know the exact position of the ++ * initialization vector. We must assume worst case. ++ */ ++ iv_size_padding = crypto_ablkcipher_alignmask(any_tfm(cc)); ++ } + + cc->req_pool = mempool_create_kmalloc_pool(MIN_IOS, cc->dmreq_start + +- sizeof(struct dm_crypt_request) + cc->iv_size); ++ sizeof(struct dm_crypt_request) + iv_size_padding + cc->iv_size); + if (!cc->req_pool) { + ti->error = "Cannot allocate crypt request mempool"; + goto bad; +diff --git a/drivers/net/can/at91_can.c b/drivers/net/can/at91_can.c +index 6ea905c2cf6d..12328068822e 100644 +--- a/drivers/net/can/at91_can.c ++++ b/drivers/net/can/at91_can.c +@@ -1115,7 +1115,9 @@ static int at91_open(struct net_device *dev) + struct at91_priv *priv = netdev_priv(dev); + int err; + +- clk_enable(priv->clk); ++ err = clk_prepare_enable(priv->clk); ++ if (err) ++ return err; + + /* check or determine and set bittime */ + err = open_candev(dev); +@@ -1139,7 +1141,7 @@ static int at91_open(struct net_device *dev) + out_close: + close_candev(dev); + out: +- clk_disable(priv->clk); ++ clk_disable_unprepare(priv->clk); + + return err; + } +@@ -1156,7 +1158,7 @@ static int at91_close(struct net_device *dev) + at91_chip_stop(dev, CAN_STATE_STOPPED); + + free_irq(dev->irq, dev); +- clk_disable(priv->clk); ++ clk_disable_unprepare(priv->clk); + + close_candev(dev); + +diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c +index 75e9233aabaf..b523e656dc0b 100644 +--- a/drivers/net/can/flexcan.c ++++ b/drivers/net/can/flexcan.c +@@ -123,7 +123,9 @@ + FLEXCAN_ESR_BOFF_INT | FLEXCAN_ESR_ERR_INT) + + /* FLEXCAN interrupt flag register (IFLAG) bits */ +-#define FLEXCAN_TX_BUF_ID 8 ++/* Errata ERR005829 step7: Reserve first valid MB */ ++#define FLEXCAN_TX_BUF_RESERVED 8 ++#define FLEXCAN_TX_BUF_ID 9 + #define FLEXCAN_IFLAG_BUF(x) BIT(x) + #define FLEXCAN_IFLAG_RX_FIFO_OVERFLOW BIT(7) + #define FLEXCAN_IFLAG_RX_FIFO_WARN BIT(6) +@@ -134,6 +136,17 @@ + + /* FLEXCAN message buffers */ + #define FLEXCAN_MB_CNT_CODE(x) (((x) & 0xf) << 24) ++#define FLEXCAN_MB_CODE_RX_INACTIVE (0x0 << 24) ++#define FLEXCAN_MB_CODE_RX_EMPTY (0x4 << 24) ++#define FLEXCAN_MB_CODE_RX_FULL (0x2 << 24) ++#define FLEXCAN_MB_CODE_RX_OVERRRUN (0x6 << 24) ++#define FLEXCAN_MB_CODE_RX_RANSWER (0xa << 24) ++ ++#define FLEXCAN_MB_CODE_TX_INACTIVE (0x8 << 24) ++#define FLEXCAN_MB_CODE_TX_ABORT (0x9 << 24) ++#define FLEXCAN_MB_CODE_TX_DATA (0xc << 24) ++#define FLEXCAN_MB_CODE_TX_TANSWER (0xe << 24) ++ + #define FLEXCAN_MB_CNT_SRR BIT(22) + #define FLEXCAN_MB_CNT_IDE BIT(21) + #define FLEXCAN_MB_CNT_RTR BIT(20) +@@ -306,6 +319,14 @@ static int flexcan_start_xmit(struct sk_buff *skb, struct net_device *dev) + flexcan_write(can_id, ®s->cantxfg[FLEXCAN_TX_BUF_ID].can_id); + flexcan_write(ctrl, ®s->cantxfg[FLEXCAN_TX_BUF_ID].can_ctrl); + ++ /* Errata ERR005829 step8: ++ * Write twice INACTIVE(0x8) code to first MB. ++ */ ++ flexcan_write(FLEXCAN_MB_CODE_TX_INACTIVE, ++ ®s->cantxfg[FLEXCAN_TX_BUF_RESERVED].can_ctrl); ++ flexcan_write(FLEXCAN_MB_CODE_TX_INACTIVE, ++ ®s->cantxfg[FLEXCAN_TX_BUF_RESERVED].can_ctrl); ++ + return NETDEV_TX_OK; + } + +@@ -612,6 +633,9 @@ static irqreturn_t flexcan_irq(int irq, void *dev_id) + if (reg_iflag1 & (1 << FLEXCAN_TX_BUF_ID)) { + stats->tx_bytes += can_get_echo_skb(dev, 0); + stats->tx_packets++; ++ /* after sending a RTR frame mailbox is in RX mode */ ++ flexcan_write(FLEXCAN_MB_CODE_TX_INACTIVE, ++ ®s->cantxfg[FLEXCAN_TX_BUF_ID].can_ctrl); + flexcan_write((1 << FLEXCAN_TX_BUF_ID), ®s->iflag1); + netif_wake_queue(dev); + } +@@ -669,6 +693,7 @@ static int flexcan_chip_start(struct net_device *dev) + struct flexcan_regs __iomem *regs = priv->base; + int err; + u32 reg_mcr, reg_ctrl; ++ int i; + + /* enable module */ + flexcan_chip_enable(priv); +@@ -734,8 +759,18 @@ static int flexcan_chip_start(struct net_device *dev) + netdev_dbg(dev, "%s: writing ctrl=0x%08x", __func__, reg_ctrl); + flexcan_write(reg_ctrl, ®s->ctrl); + +- /* Abort any pending TX, mark Mailbox as INACTIVE */ +- flexcan_write(FLEXCAN_MB_CNT_CODE(0x4), ++ /* clear and invalidate all mailboxes first */ ++ for (i = FLEXCAN_TX_BUF_ID; i < ARRAY_SIZE(regs->cantxfg); i++) { ++ flexcan_write(FLEXCAN_MB_CODE_RX_INACTIVE, ++ ®s->cantxfg[i].can_ctrl); ++ } ++ ++ /* Errata ERR005829: mark first TX mailbox as INACTIVE */ ++ flexcan_write(FLEXCAN_MB_CODE_TX_INACTIVE, ++ ®s->cantxfg[FLEXCAN_TX_BUF_RESERVED].can_ctrl); ++ ++ /* mark TX mailbox as INACTIVE */ ++ flexcan_write(FLEXCAN_MB_CODE_TX_INACTIVE, + ®s->cantxfg[FLEXCAN_TX_BUF_ID].can_ctrl); + + /* acceptance mask/acceptance code (accept everything) */ +diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c +index 307611ae831d..d8e4562a3863 100644 +--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c ++++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c +@@ -969,8 +969,6 @@ static irqreturn_t ixgbevf_msix_clean_tx(int irq, void *data) + r_idx = find_first_bit(q_vector->txr_idx, adapter->num_tx_queues); + for (i = 0; i < q_vector->txr_count; i++) { + tx_ring = &(adapter->tx_ring[r_idx]); +- tx_ring->total_bytes = 0; +- tx_ring->total_packets = 0; + ixgbevf_clean_tx_irq(adapter, tx_ring); + r_idx = find_next_bit(q_vector->txr_idx, adapter->num_tx_queues, + r_idx + 1); +@@ -994,16 +992,6 @@ static irqreturn_t ixgbevf_msix_clean_rx(int irq, void *data) + struct ixgbe_hw *hw = &adapter->hw; + struct ixgbevf_ring *rx_ring; + int r_idx; +- int i; +- +- r_idx = find_first_bit(q_vector->rxr_idx, adapter->num_rx_queues); +- for (i = 0; i < q_vector->rxr_count; i++) { +- rx_ring = &(adapter->rx_ring[r_idx]); +- rx_ring->total_bytes = 0; +- rx_ring->total_packets = 0; +- r_idx = find_next_bit(q_vector->rxr_idx, adapter->num_rx_queues, +- r_idx + 1); +- } + + if (!q_vector->rxr_count) + return IRQ_HANDLED; +diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c +index 1208b753f62f..513baa0b5bee 100644 +--- a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c +@@ -1210,11 +1210,14 @@ static void rtl92c_dm_refresh_rate_adaptive_mask(struct ieee80211_hw *hw) + if (rtlhal->interface == INTF_PCI) { + rcu_read_lock(); + sta = ieee80211_find_sta(mac->vif, mac->bssid); ++ if (!sta) ++ goto out_unlock; + } + rtlpriv->cfg->ops->update_rate_tbl(hw, sta, + p_ra->ratr_state); + + p_ra->pre_ratr_state = p_ra->ratr_state; ++ out_unlock: + if (rtlhal->interface == INTF_PCI) + rcu_read_unlock(); + } +diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c +index 52a9c338fa47..2c4cdcecbe39 100644 +--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c +@@ -306,6 +306,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = { + {RTL_USB_DEVICE(0x0bda, 0x5088, rtl92cu_hal_cfg)}, /*Thinkware-CC&C*/ + {RTL_USB_DEVICE(0x0df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/ + {RTL_USB_DEVICE(0x0df6, 0x005c, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/ ++ {RTL_USB_DEVICE(0x0df6, 0x0070, rtl92cu_hal_cfg)}, /*Sitecom - 150N */ + {RTL_USB_DEVICE(0x0df6, 0x0077, rtl92cu_hal_cfg)}, /*Sitecom-WLA2100V2*/ + {RTL_USB_DEVICE(0x0eb0, 0x9071, rtl92cu_hal_cfg)}, /*NO Brand - Etop*/ + {RTL_USB_DEVICE(0x4856, 0x0091, rtl92cu_hal_cfg)}, /*NetweeN - Feixun*/ +diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c +index 82c3fd4bc938..1243d2f5bffa 100644 +--- a/drivers/scsi/libiscsi.c ++++ b/drivers/scsi/libiscsi.c +@@ -718,11 +718,21 @@ __iscsi_conn_send_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr, + return NULL; + } + ++ if (data_size > ISCSI_DEF_MAX_RECV_SEG_LEN) { ++ iscsi_conn_printk(KERN_ERR, conn, "Invalid buffer len of %u for login task. Max len is %u\n", data_size, ISCSI_DEF_MAX_RECV_SEG_LEN); ++ return NULL; ++ } ++ + task = conn->login_task; + } else { + if (session->state != ISCSI_STATE_LOGGED_IN) + return NULL; + ++ if (data_size != 0) { ++ iscsi_conn_printk(KERN_ERR, conn, "Can not send data buffer of len %u for op 0x%x\n", data_size, opcode); ++ return NULL; ++ } ++ + BUG_ON(conn->c_stage == ISCSI_CONN_INITIAL_STAGE); + BUG_ON(conn->c_stage == ISCSI_CONN_STOPPED); + +diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c +index b3f0b0f6d44b..dcc39b612780 100644 +--- a/drivers/scsi/scsi_error.c ++++ b/drivers/scsi/scsi_error.c +@@ -916,6 +916,15 @@ int scsi_eh_get_sense(struct list_head *work_q, + SCSI_SENSE_VALID(scmd)) + continue; + ++ if (status_byte(scmd->result) != CHECK_CONDITION) ++ /* ++ * don't request sense if there's no check condition ++ * status because the error we're processing isn't one ++ * that has a sense code (and some devices get ++ * confused by sense requests out of the blue) ++ */ ++ continue; ++ + SCSI_LOG_ERROR_RECOVERY(2, scmd_printk(KERN_INFO, scmd, + "%s: requesting sense\n", + current->comm)); +diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c +index d7ac2c095cc9..56d02e071d7a 100644 +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -4297,6 +4297,7 @@ static void iscsit_logout_post_handler_diffcid( + { + struct iscsi_conn *l_conn; + struct iscsi_session *sess = conn->sess; ++ bool conn_found = false; + + if (!sess) + return; +@@ -4305,12 +4306,13 @@ static void iscsit_logout_post_handler_diffcid( + list_for_each_entry(l_conn, &sess->sess_conn_list, conn_list) { + if (l_conn->cid == cid) { + iscsit_inc_conn_usage_count(l_conn); ++ conn_found = true; + break; + } + } + spin_unlock_bh(&sess->conn_lock); + +- if (!l_conn) ++ if (!conn_found) + return; + + if (l_conn->sock) +diff --git a/drivers/target/iscsi/iscsi_target_parameters.c b/drivers/target/iscsi/iscsi_target_parameters.c +index 8a8ff238c231..ed4abadc3df6 100644 +--- a/drivers/target/iscsi/iscsi_target_parameters.c ++++ b/drivers/target/iscsi/iscsi_target_parameters.c +@@ -552,7 +552,7 @@ int iscsi_copy_param_list( + param_list = kzalloc(sizeof(struct iscsi_param_list), GFP_KERNEL); + if (!param_list) { + pr_err("Unable to allocate memory for struct iscsi_param_list.\n"); +- goto err_out; ++ return -1; + } + INIT_LIST_HEAD(¶m_list->param_list); + INIT_LIST_HEAD(¶m_list->extra_response_list); +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index e0d4d901e99d..62a9e44bfef6 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -3729,9 +3729,10 @@ static void hub_events(void) + + hub = list_entry(tmp, struct usb_hub, event_list); + kref_get(&hub->kref); ++ hdev = hub->hdev; ++ usb_get_dev(hdev); + spin_unlock_irq(&hub_event_lock); + +- hdev = hub->hdev; + hub_dev = hub->intfdev; + intf = to_usb_interface(hub_dev); + dev_dbg(hub_dev, "state %d ports %d chg %04x evt %04x\n", +@@ -3946,6 +3947,7 @@ static void hub_events(void) + usb_autopm_put_interface(intf); + loop_disconnected: + usb_unlock_device(hdev); ++ usb_put_dev(hdev); + kref_put(&hub->kref, hub_release); + + } /* end while (1) */ +diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c +index 99b58d84553a..6da443532c70 100644 +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -563,9 +563,6 @@ static int __devexit dwc3_remove(struct platform_device *pdev) + + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + +- pm_runtime_put(&pdev->dev); +- pm_runtime_disable(&pdev->dev); +- + dwc3_debugfs_exit(dwc); + + switch (dwc->mode) { +@@ -586,6 +583,9 @@ static int __devexit dwc3_remove(struct platform_device *pdev) + + dwc3_core_exit(dwc); + ++ pm_runtime_put(&pdev->dev); ++ pm_runtime_disable(&pdev->dev); ++ + return 0; + } + +diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c +index a94eabd76ad8..56ec28bff136 100644 +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -463,7 +463,8 @@ void xhci_test_and_clear_bit(struct xhci_hcd *xhci, __le32 __iomem **port_array, + } + + /* Updates Link Status for super Speed port */ +-static void xhci_hub_report_link_state(u32 *status, u32 status_reg) ++static void xhci_hub_report_link_state(struct xhci_hcd *xhci, ++ u32 *status, u32 status_reg) + { + u32 pls = status_reg & PORT_PLS_MASK; + +@@ -502,7 +503,8 @@ static void xhci_hub_report_link_state(u32 *status, u32 status_reg) + * in which sometimes the port enters compliance mode + * caused by a delay on the host-device negotiation. + */ +- if (pls == USB_SS_PORT_LS_COMP_MOD) ++ if ((xhci->quirks & XHCI_COMP_MODE_QUIRK) && ++ (pls == USB_SS_PORT_LS_COMP_MOD)) + pls |= USB_PORT_STAT_CONNECTION; + } + +@@ -680,7 +682,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, + } + /* Update Port Link State for super speed ports*/ + if (hcd->speed == HCD_USB3) { +- xhci_hub_report_link_state(&status, temp); ++ xhci_hub_report_link_state(xhci, &status, temp); + /* + * Verify if all USB3 Ports Have entered U0 already. + * Delete Compliance Mode Timer if so. +diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c +index 197685852638..aa38b1ff45ae 100644 +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -1813,7 +1813,7 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci) + } + + num_ports = HCS_MAX_PORTS(xhci->hcs_params1); +- for (i = 0; i < num_ports; i++) { ++ for (i = 0; i < num_ports && xhci->rh_bw; i++) { + struct xhci_interval_bw_table *bwt = &xhci->rh_bw[i].bw_table; + for (j = 0; j < XHCI_MAX_INTERVAL; j++) { + struct list_head *ep = &bwt->interval_bw[j].endpoints; +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index 121a05207d8b..8425e9e9e127 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -750,6 +750,7 @@ static struct usb_device_id id_table_combined [] = { + { USB_DEVICE(FTDI_VID, FTDI_NDI_AURORA_SCU_PID), + .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk }, + { USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) }, ++ { USB_DEVICE(NOVITUS_VID, NOVITUS_BONO_E_PID) }, + { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_S03_PID) }, + { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_59_PID) }, + { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_57A_PID) }, +@@ -959,6 +960,8 @@ static struct usb_device_id id_table_combined [] = { + { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_4_PID) }, + /* ekey Devices */ + { USB_DEVICE(FTDI_VID, FTDI_EKEY_CONV_USB_PID) }, ++ /* GE Healthcare devices */ ++ { USB_DEVICE(GE_HEALTHCARE_VID, GE_HEALTHCARE_NEMO_TRACKER_PID) }, + { }, /* Optional parameter entry */ + { } /* Terminating entry */ + }; +diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h +index 0eb2e97bcb4a..7628b91017ba 100644 +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -828,6 +828,12 @@ + #define TELLDUS_TELLSTICK_PID 0x0C30 /* RF control dongle 433 MHz using FT232RL */ + + /* ++ * NOVITUS printers ++ */ ++#define NOVITUS_VID 0x1a28 ++#define NOVITUS_BONO_E_PID 0x6010 ++ ++/* + * RT Systems programming cables for various ham radios + */ + #define RTSYSTEMS_VID 0x2100 /* Vendor ID */ +@@ -1376,3 +1382,9 @@ + * ekey biometric systems GmbH (http://ekey.net/) + */ + #define FTDI_EKEY_CONV_USB_PID 0xCB08 /* Converter USB */ ++ ++/* ++ * GE Healthcare devices ++ */ ++#define GE_HEALTHCARE_VID 0x1901 ++#define GE_HEALTHCARE_NEMO_TRACKER_PID 0x0015 +diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c +index bd79d68b51c1..e3ddec02f032 100644 +--- a/drivers/usb/serial/sierra.c ++++ b/drivers/usb/serial/sierra.c +@@ -296,14 +296,19 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x1199, 0x68A2), /* Sierra Wireless MC77xx in QMI mode */ + .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist + }, +- { USB_DEVICE(0x1199, 0x68A3), /* Sierra Wireless Direct IP modems */ ++ /* Sierra Wireless Direct IP modems */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x68A3, 0xFF, 0xFF, 0xFF), ++ .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist ++ }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x68AA, 0xFF, 0xFF, 0xFF), + .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist + }, + /* AT&T Direct IP LTE modems */ + { USB_DEVICE_AND_INTERFACE_INFO(0x0F3D, 0x68AA, 0xFF, 0xFF, 0xFF), + .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist + }, +- { USB_DEVICE(0x0f3d, 0x68A3), /* Airprime/Sierra Wireless Direct IP modems */ ++ /* Airprime/Sierra Wireless Direct IP modems */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x0F3D, 0x68A3, 0xFF, 0xFF, 0xFF), + .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist + }, + +diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h +index 1d9fc30f3ac3..a280945d2236 100644 +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -93,6 +93,12 @@ UNUSUAL_DEV( 0x03f0, 0x4002, 0x0001, 0x0001, + "PhotoSmart R707", + USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_FIX_CAPACITY), + ++UNUSUAL_DEV( 0x03f3, 0x0001, 0x0000, 0x9999, ++ "Adaptec", ++ "USBConnect 2000", ++ USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_euscsi_init, ++ US_FL_SCM_MULT_TARG ), ++ + /* Reported by Sebastian Kapfer + * and Olaf Hering (different bcd's, same vendor/product) + * for USB floppies that need the SINGLE_LUN enforcement. +@@ -733,6 +739,12 @@ UNUSUAL_DEV( 0x059b, 0x0001, 0x0100, 0x0100, + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_SINGLE_LUN ), + ++UNUSUAL_DEV( 0x059b, 0x0040, 0x0100, 0x0100, ++ "Iomega", ++ "Jaz USB Adapter", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_SINGLE_LUN ), ++ + /* Reported by */ + UNUSUAL_DEV( 0x059f, 0x0643, 0x0000, 0x0000, + "LaCie", +@@ -1105,6 +1117,18 @@ UNUSUAL_DEV( 0x0851, 0x1543, 0x0200, 0x0200, + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_NOT_LOCKABLE), + ++UNUSUAL_DEV( 0x085a, 0x0026, 0x0100, 0x0133, ++ "Xircom", ++ "PortGear USB-SCSI (Mac USB Dock)", ++ USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_euscsi_init, ++ US_FL_SCM_MULT_TARG ), ++ ++UNUSUAL_DEV( 0x085a, 0x0028, 0x0100, 0x0133, ++ "Xircom", ++ "PortGear USB to SCSI Converter", ++ USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_euscsi_init, ++ US_FL_SCM_MULT_TARG ), ++ + /* Submitted by Jan De Luyck */ + UNUSUAL_DEV( 0x08bd, 0x1100, 0x0000, 0x0000, + "CITIZEN", +@@ -1925,6 +1949,14 @@ UNUSUAL_DEV( 0x152d, 0x2329, 0x0100, 0x0100, + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_IGNORE_RESIDUE | US_FL_SANE_SENSE ), + ++/* Entrega Technologies U1-SC25 (later Xircom PortGear PGSCSI) ++ * and Mac USB Dock USB-SCSI */ ++UNUSUAL_DEV( 0x1645, 0x0007, 0x0100, 0x0133, ++ "Entrega Technologies", ++ "USB to SCSI Converter", ++ USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_euscsi_init, ++ US_FL_SCM_MULT_TARG ), ++ + /* Reported by Robert Schedel + * Note: this is a 'super top' device like the above 14cd/6600 device */ + UNUSUAL_DEV( 0x1652, 0x6600, 0x0201, 0x0201, +@@ -1940,6 +1972,12 @@ UNUSUAL_DEV( 0x177f, 0x0400, 0x0000, 0x0000, + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_BULK_IGNORE_TAG | US_FL_MAX_SECTORS_64 ), + ++UNUSUAL_DEV( 0x1822, 0x0001, 0x0000, 0x9999, ++ "Ariston Technologies", ++ "iConnect USB to SCSI adapter", ++ USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_euscsi_init, ++ US_FL_SCM_MULT_TARG ), ++ + /* Reported by Hans de Goede + * These Appotech controllers are found in Picture Frames, they provide a + * (buggy) emulation of a cdrom drive which contains the windows software +diff --git a/drivers/uwb/lc-dev.c b/drivers/uwb/lc-dev.c +index 5241f1d0ef7a..3c9e9295f73c 100644 +--- a/drivers/uwb/lc-dev.c ++++ b/drivers/uwb/lc-dev.c +@@ -441,16 +441,19 @@ void uwbd_dev_onair(struct uwb_rc *rc, struct uwb_beca_e *bce) + uwb_dev->mac_addr = *bce->mac_addr; + uwb_dev->dev_addr = bce->dev_addr; + dev_set_name(&uwb_dev->dev, macbuf); ++ ++ /* plug the beacon cache */ ++ bce->uwb_dev = uwb_dev; ++ uwb_dev->bce = bce; ++ uwb_bce_get(bce); /* released in uwb_dev_sys_release() */ ++ + result = uwb_dev_add(uwb_dev, &rc->uwb_dev.dev, rc); + if (result < 0) { + dev_err(dev, "new device %s: cannot instantiate device\n", + macbuf); + goto error_dev_add; + } +- /* plug the beacon cache */ +- bce->uwb_dev = uwb_dev; +- uwb_dev->bce = bce; +- uwb_bce_get(bce); /* released in uwb_dev_sys_release() */ ++ + dev_info(dev, "uwb device (mac %s dev %s) connected to %s %s\n", + macbuf, devbuf, rc->uwb_dev.dev.parent->bus->name, + dev_name(rc->uwb_dev.dev.parent)); +@@ -458,6 +461,8 @@ void uwbd_dev_onair(struct uwb_rc *rc, struct uwb_beca_e *bce) + return; + + error_dev_add: ++ bce->uwb_dev = NULL; ++ uwb_bce_put(bce); + kfree(uwb_dev); + return; + } +diff --git a/drivers/xen/manage.c b/drivers/xen/manage.c +index 412b96cc5305..8da1ed1cf3c8 100644 +--- a/drivers/xen/manage.c ++++ b/drivers/xen/manage.c +@@ -109,16 +109,11 @@ static void do_suspend(void) + + shutting_down = SHUTDOWN_SUSPEND; + +-#ifdef CONFIG_PREEMPT +- /* If the kernel is preemptible, we need to freeze all the processes +- to prevent them from being in the middle of a pagetable update +- during suspend. */ + err = freeze_processes(); + if (err) { + printk(KERN_ERR "xen suspend: freeze failed %d\n", err); + goto out; + } +-#endif + + err = dpm_suspend_start(PMSG_FREEZE); + if (err) { +@@ -170,10 +165,8 @@ out_resume: + clock_was_set(); + + out_thaw: +-#ifdef CONFIG_PREEMPT + thaw_processes(); + out: +-#endif + shutting_down = SHUTDOWN_INVALID; + } + #endif /* CONFIG_HIBERNATE_CALLBACKS */ +diff --git a/fs/buffer.c b/fs/buffer.c +index 9bf31ac982e1..f235e1834e39 100644 +--- a/fs/buffer.c ++++ b/fs/buffer.c +@@ -971,7 +971,8 @@ grow_dev_page(struct block_device *bdev, sector_t block, + bh = page_buffers(page); + if (bh->b_size == size) { + end_block = init_page_buffers(page, bdev, +- index << sizebits, size); ++ (sector_t)index << sizebits, ++ size); + goto done; + } + if (!try_to_free_buffers(page)) +@@ -992,7 +993,8 @@ grow_dev_page(struct block_device *bdev, sector_t block, + */ + spin_lock(&inode->i_mapping->private_lock); + link_dev_buffers(page, bh); +- end_block = init_page_buffers(page, bdev, index << sizebits, size); ++ end_block = init_page_buffers(page, bdev, (sector_t)index << sizebits, ++ size); + spin_unlock(&inode->i_mapping->private_lock); + done: + ret = (block < end_block) ? 1 : -ENXIO; +diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h +index 29224866f743..521ba9d18ce6 100644 +--- a/fs/ext4/ext4.h ++++ b/fs/ext4/ext4.h +@@ -1674,7 +1674,7 @@ ext4_group_first_block_no(struct super_block *sb, ext4_group_t group_no) + /* + * Special error return code only used by dx_probe() and its callers. + */ +-#define ERR_BAD_DX_DIR -75000 ++#define ERR_BAD_DX_DIR (-(MAX_ERRNO - 1)) + + void ext4_get_group_no_and_offset(struct super_block *sb, ext4_fsblk_t blocknr, + ext4_group_t *blockgrpp, ext4_grpblk_t *offsetp); +diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c +index 54ad9a54cd89..665e55ca208c 100644 +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -861,7 +861,7 @@ static struct buffer_head * ext4_find_entry (struct inode *dir, + buffer */ + int num = 0; + ext4_lblk_t nblocks; +- int i, err; ++ int i, err = 0; + int namelen; + + *res_dir = NULL; +@@ -886,7 +886,11 @@ static struct buffer_head * ext4_find_entry (struct inode *dir, + * return. Otherwise, fall back to doing a search the + * old fashioned way. + */ +- if (bh || (err != ERR_BAD_DX_DIR)) ++ if (err == -ENOENT) ++ return NULL; ++ if (err && err != ERR_BAD_DX_DIR) ++ return ERR_PTR(err); ++ if (bh) + return bh; + dxtrace(printk(KERN_DEBUG "ext4_find_entry: dx failed, " + "falling back\n")); +@@ -917,6 +921,11 @@ restart: + } + num++; + bh = ext4_getblk(NULL, dir, b++, 0, &err); ++ if (unlikely(err)) { ++ if (ra_max == 0) ++ return ERR_PTR(err); ++ break; ++ } + bh_use[ra_max] = bh; + if (bh) + ll_rw_block(READ | REQ_META | REQ_PRIO, +@@ -1026,6 +1035,8 @@ static struct dentry *ext4_lookup(struct inode *dir, struct dentry *dentry, stru + return ERR_PTR(-ENAMETOOLONG); + + bh = ext4_find_entry(dir, &dentry->d_name, &de); ++ if (IS_ERR(bh)) ++ return (struct dentry *) bh; + inode = NULL; + if (bh) { + __u32 ino = le32_to_cpu(de->inode); +@@ -1063,6 +1074,8 @@ struct dentry *ext4_get_parent(struct dentry *child) + struct buffer_head *bh; + + bh = ext4_find_entry(child->d_inode, &dotdot, &de); ++ if (IS_ERR(bh)) ++ return (struct dentry *) bh; + if (!bh) + return ERR_PTR(-ENOENT); + ino = le32_to_cpu(de->inode); +@@ -2137,6 +2150,8 @@ static int ext4_rmdir(struct inode *dir, struct dentry *dentry) + + retval = -ENOENT; + bh = ext4_find_entry(dir, &dentry->d_name, &de); ++ if (IS_ERR(bh)) ++ return PTR_ERR(bh); + if (!bh) + goto end_rmdir; + +@@ -2202,6 +2217,8 @@ static int ext4_unlink(struct inode *dir, struct dentry *dentry) + + retval = -ENOENT; + bh = ext4_find_entry(dir, &dentry->d_name, &de); ++ if (IS_ERR(bh)) ++ return PTR_ERR(bh); + if (!bh) + goto end_unlink; + +@@ -2418,6 +2435,8 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry, + ext4_handle_sync(handle); + + old_bh = ext4_find_entry(old_dir, &old_dentry->d_name, &old_de); ++ if (IS_ERR(old_bh)) ++ return PTR_ERR(old_bh); + /* + * Check for inode number is _not_ due to possible IO errors. + * We might rmdir the source, keep it as pwd of some process +@@ -2431,6 +2450,11 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry, + + new_inode = new_dentry->d_inode; + new_bh = ext4_find_entry(new_dir, &new_dentry->d_name, &new_de); ++ if (IS_ERR(new_bh)) { ++ retval = PTR_ERR(new_bh); ++ new_bh = NULL; ++ goto end_rename; ++ } + if (new_bh) { + if (!new_inode) { + brelse(new_bh); +@@ -2509,7 +2533,9 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry, + struct ext4_dir_entry_2 *old_de2; + + old_bh2 = ext4_find_entry(old_dir, &old_dentry->d_name, &old_de2); +- if (old_bh2) { ++ if (IS_ERR(old_bh2)) { ++ retval = PTR_ERR(old_bh2); ++ } else if (old_bh2) { + retval = ext4_delete_entry(handle, old_dir, + old_de2, old_bh2); + brelse(old_bh2); +diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c +index 50992c3025c2..a43e43c835d1 100644 +--- a/fs/ext4/resize.c ++++ b/fs/ext4/resize.c +@@ -528,6 +528,7 @@ handle_bb: + bh = bclean(handle, sb, block); + if (IS_ERR(bh)) { + err = PTR_ERR(bh); ++ bh = NULL; + goto out; + } + if (ext4_bg_has_super(sb, group)) { +@@ -556,6 +557,7 @@ handle_ib: + bh = bclean(handle, sb, block); + if (IS_ERR(bh)) { + err = PTR_ERR(bh); ++ bh = NULL; + goto out; + } + +diff --git a/fs/namei.c b/fs/namei.c +index c42791914f82..5974fb573f5a 100644 +--- a/fs/namei.c ++++ b/fs/namei.c +@@ -553,24 +553,22 @@ static int complete_walk(struct nameidata *nd) + + static __always_inline void set_root(struct nameidata *nd) + { +- if (!nd->root.mnt) +- get_fs_root(current->fs, &nd->root); ++ get_fs_root(current->fs, &nd->root); + } + + static int link_path_walk(const char *, struct nameidata *); + +-static __always_inline void set_root_rcu(struct nameidata *nd) ++static __always_inline unsigned set_root_rcu(struct nameidata *nd) + { +- if (!nd->root.mnt) { +- struct fs_struct *fs = current->fs; +- unsigned seq; ++ struct fs_struct *fs = current->fs; ++ unsigned seq, res; + +- do { +- seq = read_seqcount_begin(&fs->seq); +- nd->root = fs->root; +- nd->seq = __read_seqcount_begin(&nd->root.dentry->d_seq); +- } while (read_seqcount_retry(&fs->seq, seq)); +- } ++ do { ++ seq = read_seqcount_begin(&fs->seq); ++ nd->root = fs->root; ++ res = __read_seqcount_begin(&nd->root.dentry->d_seq); ++ } while (read_seqcount_retry(&fs->seq, seq)); ++ return res; + } + + static __always_inline int __vfs_follow_link(struct nameidata *nd, const char *link) +@@ -928,7 +926,8 @@ static void follow_mount_rcu(struct nameidata *nd) + + static int follow_dotdot_rcu(struct nameidata *nd) + { +- set_root_rcu(nd); ++ if (!nd->root.mnt) ++ set_root_rcu(nd); + + while (1) { + if (nd->path.dentry == nd->root.dentry && +@@ -1031,7 +1030,8 @@ static void follow_mount(struct path *path) + + static void follow_dotdot(struct nameidata *nd) + { +- set_root(nd); ++ if (!nd->root.mnt) ++ set_root(nd); + + while(1) { + struct dentry *old = nd->path.dentry; +@@ -1633,7 +1633,7 @@ static int path_init(int dfd, const char *name, unsigned int flags, + if (flags & LOOKUP_RCU) { + br_read_lock(vfsmount_lock); + rcu_read_lock(); +- set_root_rcu(nd); ++ nd->seq = set_root_rcu(nd); + } else { + set_root(nd); + path_get(&nd->root); +diff --git a/fs/namespace.c b/fs/namespace.c +index 4e465397e456..f0f2e067c5df 100644 +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -1066,6 +1066,9 @@ void umount_tree(struct mount *mnt, int propagate, struct list_head *kill) + for (p = mnt; p; p = next_mnt(p, mnt)) + list_move(&p->mnt_hash, &tmp_list); + ++ list_for_each_entry(p, &tmp_list, mnt_hash) ++ list_del_init(&p->mnt_child); ++ + if (propagate) + propagate_umount(&tmp_list); + +@@ -1076,7 +1079,6 @@ void umount_tree(struct mount *mnt, int propagate, struct list_head *kill) + if (p->mnt_ns) + __mnt_make_shortterm(p); + p->mnt_ns = NULL; +- list_del_init(&p->mnt_child); + if (mnt_has_parent(p)) { + p->mnt_parent->mnt_ghosts++; + dentry_reset_mounted(p->mnt_mountpoint); +@@ -1679,7 +1681,7 @@ static int do_remount(struct path *path, int flags, int mnt_flags, + err = do_remount_sb(sb, flags, data, 0); + if (!err) { + br_write_lock(vfsmount_lock); +- mnt_flags |= mnt->mnt.mnt_flags & MNT_PROPAGATION_MASK; ++ mnt_flags |= mnt->mnt.mnt_flags & ~MNT_USER_SETTABLE_MASK; + mnt->mnt.mnt_flags = mnt_flags; + br_write_unlock(vfsmount_lock); + } +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 01afcd575920..527a4fc12546 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -2063,23 +2063,23 @@ static void nfs4_close_prepare(struct rpc_task *task, void *data) + is_rdwr = test_bit(NFS_O_RDWR_STATE, &state->flags); + is_rdonly = test_bit(NFS_O_RDONLY_STATE, &state->flags); + is_wronly = test_bit(NFS_O_WRONLY_STATE, &state->flags); +- /* Calculate the current open share mode */ +- calldata->arg.fmode = 0; +- if (is_rdonly || is_rdwr) +- calldata->arg.fmode |= FMODE_READ; +- if (is_wronly || is_rdwr) +- calldata->arg.fmode |= FMODE_WRITE; + /* Calculate the change in open mode */ ++ calldata->arg.fmode = 0; + if (state->n_rdwr == 0) { +- if (state->n_rdonly == 0) { +- call_close |= is_rdonly || is_rdwr; +- calldata->arg.fmode &= ~FMODE_READ; +- } +- if (state->n_wronly == 0) { +- call_close |= is_wronly || is_rdwr; +- calldata->arg.fmode &= ~FMODE_WRITE; +- } +- } ++ if (state->n_rdonly == 0) ++ call_close |= is_rdonly; ++ else if (is_rdonly) ++ calldata->arg.fmode |= FMODE_READ; ++ if (state->n_wronly == 0) ++ call_close |= is_wronly; ++ else if (is_wronly) ++ calldata->arg.fmode |= FMODE_WRITE; ++ } else if (is_rdwr) ++ calldata->arg.fmode |= FMODE_READ|FMODE_WRITE; ++ ++ if (calldata->arg.fmode == 0) ++ call_close |= is_rdwr; ++ + spin_unlock(&state->owner->so_lock); + + if (!call_close) { +diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c +index e3abfde27863..36620e65158b 100644 +--- a/fs/nfsd/vfs.c ++++ b/fs/nfsd/vfs.c +@@ -508,6 +508,9 @@ set_nfsv4_acl_one(struct dentry *dentry, struct posix_acl *pacl, char *key) + char *buf = NULL; + int error = 0; + ++ if (!pacl) ++ return vfs_setxattr(dentry, key, NULL, 0, 0); ++ + buflen = posix_acl_xattr_size(pacl->a_count); + buf = kmalloc(buflen, GFP_KERNEL); + error = -ENOMEM; +diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c +index aa526bebee3f..204bfcf06314 100644 +--- a/fs/nilfs2/inode.c ++++ b/fs/nilfs2/inode.c +@@ -24,6 +24,7 @@ + #include + #include + #include ++#include + #include + #include + #include "nilfs.h" +@@ -195,10 +196,10 @@ static int nilfs_writepage(struct page *page, struct writeback_control *wbc) + + static int nilfs_set_page_dirty(struct page *page) + { ++ struct inode *inode = page->mapping->host; + int ret = __set_page_dirty_nobuffers(page); + + if (page_has_buffers(page)) { +- struct inode *inode = page->mapping->host; + unsigned nr_dirty = 0; + struct buffer_head *bh, *head; + +@@ -221,6 +222,10 @@ static int nilfs_set_page_dirty(struct page *page) + + if (nr_dirty) + nilfs_set_file_dirty(inode, nr_dirty); ++ } else if (ret) { ++ unsigned nr_dirty = 1 << (PAGE_CACHE_SHIFT - inode->i_blkbits); ++ ++ nilfs_set_file_dirty(inode, nr_dirty); + } + return ret; + } +diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c +index 005261c333b0..dbc372e2f71d 100644 +--- a/fs/ocfs2/dlm/dlmmaster.c ++++ b/fs/ocfs2/dlm/dlmmaster.c +@@ -653,12 +653,9 @@ void dlm_lockres_clear_refmap_bit(struct dlm_ctxt *dlm, + clear_bit(bit, res->refmap); + } + +- +-void dlm_lockres_grab_inflight_ref(struct dlm_ctxt *dlm, ++static void __dlm_lockres_grab_inflight_ref(struct dlm_ctxt *dlm, + struct dlm_lock_resource *res) + { +- assert_spin_locked(&res->spinlock); +- + res->inflight_locks++; + + mlog(0, "%s: res %.*s, inflight++: now %u, %ps()\n", dlm->name, +@@ -666,6 +663,13 @@ void dlm_lockres_grab_inflight_ref(struct dlm_ctxt *dlm, + __builtin_return_address(0)); + } + ++void dlm_lockres_grab_inflight_ref(struct dlm_ctxt *dlm, ++ struct dlm_lock_resource *res) ++{ ++ assert_spin_locked(&res->spinlock); ++ __dlm_lockres_grab_inflight_ref(dlm, res); ++} ++ + void dlm_lockres_drop_inflight_ref(struct dlm_ctxt *dlm, + struct dlm_lock_resource *res) + { +@@ -855,10 +859,8 @@ lookup: + /* finally add the lockres to its hash bucket */ + __dlm_insert_lockres(dlm, res); + +- /* Grab inflight ref to pin the resource */ +- spin_lock(&res->spinlock); +- dlm_lockres_grab_inflight_ref(dlm, res); +- spin_unlock(&res->spinlock); ++ /* since this lockres is new it doesn't not require the spinlock */ ++ __dlm_lockres_grab_inflight_ref(dlm, res); + + /* get an extra ref on the mle in case this is a BLOCK + * if so, the creator of the BLOCK may try to put the last +diff --git a/fs/pnode.c b/fs/pnode.c +index ab5fa9e1a79a..f61dcb4f994c 100644 +--- a/fs/pnode.c ++++ b/fs/pnode.c +@@ -333,8 +333,10 @@ static void __propagate_umount(struct mount *mnt) + * umount the child only if the child has no + * other children + */ +- if (child && list_empty(&child->mnt_mounts)) ++ if (child && list_empty(&child->mnt_mounts)) { ++ list_del_init(&child->mnt_child); + list_move_tail(&child->mnt_hash, &mnt->mnt_hash); ++ } + } + } + +diff --git a/include/linux/cpuset.h b/include/linux/cpuset.h +index 668f66baac7b..bb48be7994c1 100644 +--- a/include/linux/cpuset.h ++++ b/include/linux/cpuset.h +@@ -74,12 +74,12 @@ extern int cpuset_slab_spread_node(void); + + static inline int cpuset_do_page_mem_spread(void) + { +- return current->flags & PF_SPREAD_PAGE; ++ return task_spread_page(current); + } + + static inline int cpuset_do_slab_mem_spread(void) + { +- return current->flags & PF_SPREAD_SLAB; ++ return task_spread_slab(current); + } + + extern int current_cpuset_is_being_rebound(void); +diff --git a/include/linux/jiffies.h b/include/linux/jiffies.h +index f5df3dcfe811..f4e8578f7caa 100644 +--- a/include/linux/jiffies.h ++++ b/include/linux/jiffies.h +@@ -259,23 +259,11 @@ extern unsigned long preset_lpj; + #define SEC_JIFFIE_SC (32 - SHIFT_HZ) + #endif + #define NSEC_JIFFIE_SC (SEC_JIFFIE_SC + 29) +-#define USEC_JIFFIE_SC (SEC_JIFFIE_SC + 19) + #define SEC_CONVERSION ((unsigned long)((((u64)NSEC_PER_SEC << SEC_JIFFIE_SC) +\ + TICK_NSEC -1) / (u64)TICK_NSEC)) + + #define NSEC_CONVERSION ((unsigned long)((((u64)1 << NSEC_JIFFIE_SC) +\ + TICK_NSEC -1) / (u64)TICK_NSEC)) +-#define USEC_CONVERSION \ +- ((unsigned long)((((u64)NSEC_PER_USEC << USEC_JIFFIE_SC) +\ +- TICK_NSEC -1) / (u64)TICK_NSEC)) +-/* +- * USEC_ROUND is used in the timeval to jiffie conversion. See there +- * for more details. It is the scaled resolution rounding value. Note +- * that it is a 64-bit value. Since, when it is applied, we are already +- * in jiffies (albit scaled), it is nothing but the bits we will shift +- * off. +- */ +-#define USEC_ROUND (u64)(((u64)1 << USEC_JIFFIE_SC) - 1) + /* + * The maximum jiffie value is (MAX_INT >> 1). Here we translate that + * into seconds. The 64-bit case will overflow if we are not careful, +diff --git a/include/linux/mount.h b/include/linux/mount.h +index d7029f4a191a..2044aacc0d2b 100644 +--- a/include/linux/mount.h ++++ b/include/linux/mount.h +@@ -42,7 +42,9 @@ struct mnt_namespace; + * flag, consider how it interacts with shared mounts. + */ + #define MNT_SHARED_MASK (MNT_UNBINDABLE) +-#define MNT_PROPAGATION_MASK (MNT_SHARED | MNT_UNBINDABLE) ++#define MNT_USER_SETTABLE_MASK (MNT_NOSUID | MNT_NODEV | MNT_NOEXEC \ ++ | MNT_NOATIME | MNT_NODIRATIME | MNT_RELATIME \ ++ | MNT_READONLY) + + + #define MNT_INTERNAL 0x4000 +diff --git a/include/linux/sched.h b/include/linux/sched.h +index 8cd5cb80223c..56d8233c5de7 100644 +--- a/include/linux/sched.h ++++ b/include/linux/sched.h +@@ -1833,8 +1834,6 @@ extern void thread_group_times(struct task_struct *p, cputime_t *ut, cputime_t * + #define PF_KTHREAD 0x00200000 /* I am a kernel thread */ + #define PF_RANDOMIZE 0x00400000 /* randomize virtual address space */ + #define PF_SWAPWRITE 0x00800000 /* Allowed to write to swap */ +-#define PF_SPREAD_PAGE 0x01000000 /* Spread page cache over cpuset */ +-#define PF_SPREAD_SLAB 0x02000000 /* Spread some slab caches over cpuset */ + #define PF_THREAD_BOUND 0x04000000 /* Thread bound to specific cpu */ + #define PF_MCE_EARLY 0x08000000 /* Early kill for mce process policy */ + #define PF_MEMPOLICY 0x10000000 /* Non-default NUMA mempolicy */ +@@ -1866,6 +1865,20 @@ extern void thread_group_times(struct task_struct *p, cputime_t *ut, cputime_t * + #define tsk_used_math(p) ((p)->flags & PF_USED_MATH) + #define used_math() tsk_used_math(current) + ++/* Per-process atomic flags. */ ++#define PFA_SPREAD_PAGE 1 /* Spread page cache over cpuset */ ++#define PFA_SPREAD_SLAB 2 /* Spread some slab caches over cpuset */ ++ ++#define TASK_PFA_TEST(name, func) \ ++ static inline bool task_##func(struct task_struct *p) \ ++ { return test_bit(PFA_##name, &p->atomic_flags); } ++#define TASK_PFA_SET(name, func) \ ++ static inline void task_set_##func(struct task_struct *p) \ ++ { set_bit(PFA_##name, &p->atomic_flags); } ++#define TASK_PFA_CLEAR(name, func) \ ++ static inline void task_clear_##func(struct task_struct *p) \ ++ { clear_bit(PFA_##name, &p->atomic_flags); } ++ + /* + * task->jobctl flags + */ +@@ -1957,6 +1970,14 @@ static inline int set_cpus_allowed(struct task_struct *p, cpumask_t new_mask) + } + #endif + ++TASK_PFA_TEST(SPREAD_PAGE, spread_page) ++TASK_PFA_SET(SPREAD_PAGE, spread_page) ++TASK_PFA_CLEAR(SPREAD_PAGE, spread_page) ++ ++TASK_PFA_TEST(SPREAD_SLAB, spread_slab) ++TASK_PFA_SET(SPREAD_SLAB, spread_slab) ++TASK_PFA_CLEAR(SPREAD_SLAB, spread_slab) ++ + /* + * Do not use outside of architecture code which knows its limitations. + * +diff --git a/include/net/regulatory.h b/include/net/regulatory.h +index a5f79933e211..8d64abfcaac2 100644 +--- a/include/net/regulatory.h ++++ b/include/net/regulatory.h +@@ -97,7 +97,7 @@ struct ieee80211_reg_rule { + + struct ieee80211_regdomain { + u32 n_reg_rules; +- char alpha2[2]; ++ char alpha2[3]; + u8 dfs_region; + struct ieee80211_reg_rule reg_rules[]; + }; +diff --git a/init/Kconfig b/init/Kconfig +index 6cfd71d06463..f1b0e7828ee2 100644 +--- a/init/Kconfig ++++ b/init/Kconfig +@@ -560,6 +560,7 @@ config LOG_BUF_SHIFT + int "Kernel log buffer size (16 => 64KB, 17 => 128KB)" + range 12 21 + default 17 ++ depends on PRINTK + help + Select kernel log buffer size as a power of 2. + Examples: +diff --git a/kernel/cgroup.c b/kernel/cgroup.c +index 7c8f4f7d0c71..c776f8941175 100644 +--- a/kernel/cgroup.c ++++ b/kernel/cgroup.c +@@ -3838,6 +3838,11 @@ static int cgroup_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode) + { + struct cgroup *c_parent = dentry->d_parent->d_fsdata; + ++ /* Do not accept '\n' to prevent making /proc//cgroup unparsable. ++ */ ++ if (strchr(dentry->d_name.name, '\n')) ++ return -EINVAL; ++ + /* the vfs holds inode->i_mutex already */ + return cgroup_create(c_parent, dentry, mode | S_IFDIR); + } +diff --git a/kernel/cpuset.c b/kernel/cpuset.c +index 9cb82b9aeb73..7f3bde5c50fe 100644 +--- a/kernel/cpuset.c ++++ b/kernel/cpuset.c +@@ -326,13 +326,14 @@ static void cpuset_update_task_spread_flag(struct cpuset *cs, + struct task_struct *tsk) + { + if (is_spread_page(cs)) +- tsk->flags |= PF_SPREAD_PAGE; ++ task_set_spread_page(tsk); + else +- tsk->flags &= ~PF_SPREAD_PAGE; ++ task_clear_spread_page(tsk); ++ + if (is_spread_slab(cs)) +- tsk->flags |= PF_SPREAD_SLAB; ++ task_set_spread_slab(tsk); + else +- tsk->flags &= ~PF_SPREAD_SLAB; ++ task_clear_spread_slab(tsk); + } + + /* +diff --git a/kernel/events/core.c b/kernel/events/core.c +index 685ce46b2aff..04662972802a 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -36,6 +36,7 @@ + #include + #include + #include ++#include + + #include "internal.h" + +@@ -1702,6 +1703,16 @@ retry: + */ + if (ctx->is_active) { + raw_spin_unlock_irq(&ctx->lock); ++ /* ++ * Reload the task pointer, it might have been changed by ++ * a concurrent perf_event_context_sched_out(). ++ */ ++ task = ctx->task; ++ /* ++ * Reload the task pointer, it might have been changed by ++ * a concurrent perf_event_context_sched_out(). ++ */ ++ task = ctx->task; + goto retry; + } + +@@ -3350,6 +3361,25 @@ static long perf_ioctl(struct file *file, unsigned int cmd, unsigned long arg) + return 0; + } + ++#ifdef CONFIG_COMPAT ++static long perf_compat_ioctl(struct file *file, unsigned int cmd, ++ unsigned long arg) ++{ ++ switch (_IOC_NR(cmd)) { ++ case _IOC_NR(PERF_EVENT_IOC_SET_FILTER): ++ /* Fix up pointer size (usually 4 -> 8 in 32-on-64-bit case */ ++ if (_IOC_SIZE(cmd) == sizeof(compat_uptr_t)) { ++ cmd &= ~IOCSIZE_MASK; ++ cmd |= sizeof(void *) << IOCSIZE_SHIFT; ++ } ++ break; ++ } ++ return perf_ioctl(file, cmd, arg); ++} ++#else ++# define perf_compat_ioctl NULL ++#endif ++ + int perf_event_task_enable(void) + { + struct perf_event *event; +@@ -3821,7 +3851,7 @@ static const struct file_operations perf_fops = { + .read = perf_read, + .poll = perf_poll, + .unlocked_ioctl = perf_ioctl, +- .compat_ioctl = perf_ioctl, ++ .compat_ioctl = perf_compat_ioctl, + .mmap = perf_mmap, + .fasync = perf_fasync, + }; +@@ -7117,8 +7147,10 @@ int perf_event_init_task(struct task_struct *child) + + for_each_task_context_nr(ctxn) { + ret = perf_event_init_context(child, ctxn); +- if (ret) ++ if (ret) { ++ perf_event_free_task(child); + return ret; ++ } + } + + return 0; +diff --git a/kernel/fork.c b/kernel/fork.c +index 621c547dabb1..878dcb2eec55 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -1285,7 +1285,7 @@ static struct task_struct *copy_process(unsigned long clone_flags, + goto bad_fork_cleanup_policy; + retval = audit_alloc(p); + if (retval) +- goto bad_fork_cleanup_policy; ++ goto bad_fork_cleanup_perf; + /* copy all the process information */ + retval = copy_semundo(clone_flags, p); + if (retval) +@@ -1480,8 +1480,9 @@ bad_fork_cleanup_semundo: + exit_sem(p); + bad_fork_cleanup_audit: + audit_free(p); +-bad_fork_cleanup_policy: ++bad_fork_cleanup_perf: + perf_event_free_task(p); ++bad_fork_cleanup_policy: + #ifdef CONFIG_NUMA + mpol_put(p->mempolicy); + bad_fork_cleanup_cgroup: +diff --git a/kernel/futex.c b/kernel/futex.c +index 9396b7b853f7..41dfb1866f95 100644 +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -2460,6 +2460,7 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags, + * shared futexes. We need to compare the keys: + */ + if (match_futex(&q.key, &key2)) { ++ queue_unlock(&q, hb); + ret = -EINVAL; + goto out_put_keys; + } +diff --git a/kernel/time.c b/kernel/time.c +index ba744cf80696..a09529030093 100644 +--- a/kernel/time.c ++++ b/kernel/time.c +@@ -487,17 +487,20 @@ EXPORT_SYMBOL(usecs_to_jiffies); + * that a remainder subtract here would not do the right thing as the + * resolution values don't fall on second boundries. I.e. the line: + * nsec -= nsec % TICK_NSEC; is NOT a correct resolution rounding. ++ * Note that due to the small error in the multiplier here, this ++ * rounding is incorrect for sufficiently large values of tv_nsec, but ++ * well formed timespecs should have tv_nsec < NSEC_PER_SEC, so we're ++ * OK. + * + * Rather, we just shift the bits off the right. + * + * The >> (NSEC_JIFFIE_SC - SEC_JIFFIE_SC) converts the scaled nsec + * value to a scaled second value. + */ +-unsigned long +-timespec_to_jiffies(const struct timespec *value) ++static unsigned long ++__timespec_to_jiffies(unsigned long sec, long nsec) + { +- unsigned long sec = value->tv_sec; +- long nsec = value->tv_nsec + TICK_NSEC - 1; ++ nsec = nsec + TICK_NSEC - 1; + + if (sec >= MAX_SEC_IN_JIFFIES){ + sec = MAX_SEC_IN_JIFFIES; +@@ -508,6 +511,13 @@ timespec_to_jiffies(const struct timespec *value) + (NSEC_JIFFIE_SC - SEC_JIFFIE_SC))) >> SEC_JIFFIE_SC; + + } ++ ++unsigned long ++timespec_to_jiffies(const struct timespec *value) ++{ ++ return __timespec_to_jiffies(value->tv_sec, value->tv_nsec); ++} ++ + EXPORT_SYMBOL(timespec_to_jiffies); + + void +@@ -524,31 +534,27 @@ jiffies_to_timespec(const unsigned long jiffies, struct timespec *value) + } + EXPORT_SYMBOL(jiffies_to_timespec); + +-/* Same for "timeval" ++/* ++ * We could use a similar algorithm to timespec_to_jiffies (with a ++ * different multiplier for usec instead of nsec). But this has a ++ * problem with rounding: we can't exactly add TICK_NSEC - 1 to the ++ * usec value, since it's not necessarily integral. + * +- * Well, almost. The problem here is that the real system resolution is +- * in nanoseconds and the value being converted is in micro seconds. +- * Also for some machines (those that use HZ = 1024, in-particular), +- * there is a LARGE error in the tick size in microseconds. +- +- * The solution we use is to do the rounding AFTER we convert the +- * microsecond part. Thus the USEC_ROUND, the bits to be shifted off. +- * Instruction wise, this should cost only an additional add with carry +- * instruction above the way it was done above. ++ * We could instead round in the intermediate scaled representation ++ * (i.e. in units of 1/2^(large scale) jiffies) but that's also ++ * perilous: the scaling introduces a small positive error, which ++ * combined with a division-rounding-upward (i.e. adding 2^(scale) - 1 ++ * units to the intermediate before shifting) leads to accidental ++ * overflow and overestimates. ++ * ++ * At the cost of one additional multiplication by a constant, just ++ * use the timespec implementation. + */ + unsigned long + timeval_to_jiffies(const struct timeval *value) + { +- unsigned long sec = value->tv_sec; +- long usec = value->tv_usec; +- +- if (sec >= MAX_SEC_IN_JIFFIES){ +- sec = MAX_SEC_IN_JIFFIES; +- usec = 0; +- } +- return (((u64)sec * SEC_CONVERSION) + +- (((u64)usec * USEC_CONVERSION + USEC_ROUND) >> +- (USEC_JIFFIE_SC - SEC_JIFFIE_SC))) >> SEC_JIFFIE_SC; ++ return __timespec_to_jiffies(value->tv_sec, ++ value->tv_usec * NSEC_PER_USEC); + } + EXPORT_SYMBOL(timeval_to_jiffies); + +diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c +@@ -456,18 +456,26 @@ + static enum alarmtimer_restart alarm_handle_timer(struct alarm *alarm, + ktime_t now) + { ++ unsigned long flags; + struct k_itimer *ptr = container_of(alarm, struct k_itimer, + it.alarm.alarmtimer); +- if (posix_timer_event(ptr, 0) != 0) +- ptr->it_overrun++; ++ enum alarmtimer_restart result = ALARMTIMER_NORESTART; ++ ++ spin_lock_irqsave(&ptr->it_lock, flags); ++ if ((ptr->it_sigev_notify & ~SIGEV_THREAD_ID) != SIGEV_NONE) { ++ if (posix_timer_event(ptr, 0) != 0) ++ ptr->it_overrun++; ++ } + + /* Re-add periodic timers */ + if (ptr->it.alarm.interval.tv64) { + ptr->it_overrun += alarm_forward(alarm, now, + ptr->it.alarm.interval); +- return ALARMTIMER_RESTART; ++ result = ALARMTIMER_RESTART; + } +- return ALARMTIMER_NORESTART; ++ spin_unlock_irqrestore(&ptr->it_lock, flags); ++ ++ return result; + } + + /** +@@ -533,18 +541,22 @@ + * @new_timer: k_itimer pointer + * @cur_setting: itimerspec data to fill + * +- * Copies the itimerspec data out from the k_itimer ++ * Copies out the current itimerspec data + */ + static void alarm_timer_get(struct k_itimer *timr, + struct itimerspec *cur_setting) + { +- memset(cur_setting, 0, sizeof(struct itimerspec)); ++ ktime_t relative_expiry_time = ++ alarm_expires_remaining(&(timr->it.alarm.alarmtimer)); ++ ++ if (ktime_to_ns(relative_expiry_time) > 0) { ++ cur_setting->it_value = ktime_to_timespec(relative_expiry_time); ++ } else { ++ cur_setting->it_value.tv_sec = 0; ++ cur_setting->it_value.tv_nsec = 0; ++ } + +- cur_setting->it_interval = +- ktime_to_timespec(timr->it.alarm.interval); +- cur_setting->it_value = +- ktime_to_timespec(timr->it.alarm.alarmtimer.node.expires); +- return; ++ cur_setting->it_interval = ktime_to_timespec(timr->it.alarm.interval); + } + + /** +diff --git a/mm/migrate.c b/mm/migrate.c +index 5f588b1f2f6d..98b998ffa3af 100644 +--- a/mm/migrate.c ++++ b/mm/migrate.c +@@ -139,8 +139,11 @@ static int remove_migration_pte(struct page *new, struct vm_area_struct *vma, + + get_page(new); + pte = pte_mkold(mk_pte(new, vma->vm_page_prot)); ++ ++ /* Recheck VMA as permissions can change since migration started */ + if (is_write_migration_entry(entry)) +- pte = pte_mkwrite(pte); ++ pte = maybe_mkwrite(pte, vma); ++ + #ifdef CONFIG_HUGETLB_PAGE + if (PageHuge(new)) + pte = pte_mkhuge(pte); +diff --git a/mm/percpu-vm.c b/mm/percpu-vm.c +index 405d331804c3..6f3db3707024 100644 +--- a/mm/percpu-vm.c ++++ b/mm/percpu-vm.c +@@ -108,7 +108,7 @@ static int pcpu_alloc_pages(struct pcpu_chunk *chunk, + int page_start, int page_end) + { + const gfp_t gfp = GFP_KERNEL | __GFP_HIGHMEM | __GFP_COLD; +- unsigned int cpu; ++ unsigned int cpu, tcpu; + int i; + + for_each_possible_cpu(cpu) { +@@ -116,14 +116,23 @@ static int pcpu_alloc_pages(struct pcpu_chunk *chunk, + struct page **pagep = &pages[pcpu_page_idx(cpu, i)]; + + *pagep = alloc_pages_node(cpu_to_node(cpu), gfp, 0); +- if (!*pagep) { +- pcpu_free_pages(chunk, pages, populated, +- page_start, page_end); +- return -ENOMEM; +- } ++ if (!*pagep) ++ goto err; + } + } + return 0; ++ ++err: ++ while (--i >= page_start) ++ __free_page(pages[pcpu_page_idx(cpu, i)]); ++ ++ for_each_possible_cpu(tcpu) { ++ if (tcpu == cpu) ++ break; ++ for (i = page_start; i < page_end; i++) ++ __free_page(pages[pcpu_page_idx(tcpu, i)]); ++ } ++ return -ENOMEM; + } + + /** +@@ -263,6 +272,7 @@ err: + __pcpu_unmap_pages(pcpu_chunk_addr(chunk, tcpu, page_start), + page_end - page_start); + } ++ pcpu_post_unmap_tlb_flush(chunk, page_start, page_end); + return err; + } + +diff --git a/mm/percpu.c b/mm/percpu.c +index 13b2eefabfdd..5f6042b61ca8 100644 +--- a/mm/percpu.c ++++ b/mm/percpu.c +@@ -1907,6 +1907,8 @@ void __init setup_per_cpu_areas(void) + + if (pcpu_setup_first_chunk(ai, fc) < 0) + panic("Failed to initialize percpu areas."); ++ ++ pcpu_free_alloc_info(ai); + } + + #endif /* CONFIG_SMP */ +diff --git a/mm/shmem.c b/mm/shmem.c +index 4bb5a80dd13b..0b77082409f4 100644 +--- a/mm/shmem.c ++++ b/mm/shmem.c +@@ -1725,8 +1725,10 @@ static int shmem_rename(struct inode *old_dir, struct dentry *old_dentry, struct + + if (new_dentry->d_inode) { + (void) shmem_unlink(new_dir, new_dentry); +- if (they_are_dirs) ++ if (they_are_dirs) { ++ drop_nlink(new_dentry->d_inode); + drop_nlink(old_dir); ++ } + } else if (they_are_dirs) { + drop_nlink(old_dir); + inc_nlink(new_dir); +diff --git a/mm/slab.c b/mm/slab.c +index 3eb1c38e2c30..3714dd9c5877 100644 +--- a/mm/slab.c ++++ b/mm/slab.c +@@ -3321,7 +3321,7 @@ static inline void *____cache_alloc(struct kmem_cache *cachep, gfp_t flags) + + #ifdef CONFIG_NUMA + /* +- * Try allocating on another node if PF_SPREAD_SLAB|PF_MEMPOLICY. ++ * Try allocating on another node if PFA_SPREAD_SLAB|PF_MEMPOLICY. + * + * If we are in_interrupt, then process context, including cpusets and + * mempolicy, may not apply and should not be used for allocation policy. +@@ -3562,7 +3562,7 @@ __do_cache_alloc(struct kmem_cache *cache, gfp_t flags) + { + void *objp; + +- if (unlikely(current->flags & (PF_SPREAD_SLAB | PF_MEMPOLICY))) { ++ if (unlikely((current->flags & PF_MEMPOLICY) || cpuset_do_slab_mem_spread())) { + objp = alternate_node_alloc(cache, flags); + if (objp) + goto out; +diff --git a/net/ceph/auth_x.c b/net/ceph/auth_x.c +index 96238ba95f2b..de6662b14e1f 100644 +--- a/net/ceph/auth_x.c ++++ b/net/ceph/auth_x.c +@@ -13,8 +13,6 @@ + #include "auth_x.h" + #include "auth_x_protocol.h" + +-#define TEMP_TICKET_BUF_LEN 256 +- + static void ceph_x_validate_tickets(struct ceph_auth_client *ac, int *pneed); + + static int ceph_x_is_authenticated(struct ceph_auth_client *ac) +@@ -64,7 +62,7 @@ static int ceph_x_encrypt(struct ceph_crypto_key *secret, + } + + static int ceph_x_decrypt(struct ceph_crypto_key *secret, +- void **p, void *end, void *obuf, size_t olen) ++ void **p, void *end, void **obuf, size_t olen) + { + struct ceph_x_encrypt_header head; + size_t head_len = sizeof(head); +@@ -75,8 +73,14 @@ static int ceph_x_decrypt(struct ceph_crypto_key *secret, + return -EINVAL; + + dout("ceph_x_decrypt len %d\n", len); +- ret = ceph_decrypt2(secret, &head, &head_len, obuf, &olen, +- *p, len); ++ if (*obuf == NULL) { ++ *obuf = kmalloc(len, GFP_NOFS); ++ if (!*obuf) ++ return -ENOMEM; ++ olen = len; ++ } ++ ++ ret = ceph_decrypt2(secret, &head, &head_len, *obuf, &olen, *p, len); + if (ret) + return ret; + if (head.struct_v != 1 || le64_to_cpu(head.magic) != CEPHX_ENC_MAGIC) +@@ -129,139 +133,120 @@ static void remove_ticket_handler(struct ceph_auth_client *ac, + kfree(th); + } + +-static int ceph_x_proc_ticket_reply(struct ceph_auth_client *ac, +- struct ceph_crypto_key *secret, +- void *buf, void *end) ++static int process_one_ticket(struct ceph_auth_client *ac, ++ struct ceph_crypto_key *secret, ++ void **p, void *end) + { + struct ceph_x_info *xi = ac->private; +- int num; +- void *p = buf; ++ int type; ++ u8 tkt_struct_v, blob_struct_v; ++ struct ceph_x_ticket_handler *th; ++ void *dbuf = NULL; ++ void *dp, *dend; ++ int dlen; ++ char is_enc; ++ struct timespec validity; ++ struct ceph_crypto_key old_key; ++ void *ticket_buf = NULL; ++ void *tp, *tpend; ++ struct ceph_timespec new_validity; ++ struct ceph_crypto_key new_session_key; ++ struct ceph_buffer *new_ticket_blob; ++ unsigned long new_expires, new_renew_after; ++ u64 new_secret_id; + int ret; +- char *dbuf; +- char *ticket_buf; +- u8 reply_struct_v; + +- dbuf = kmalloc(TEMP_TICKET_BUF_LEN, GFP_NOFS); +- if (!dbuf) +- return -ENOMEM; ++ ceph_decode_need(p, end, sizeof(u32) + 1, bad); + +- ret = -ENOMEM; +- ticket_buf = kmalloc(TEMP_TICKET_BUF_LEN, GFP_NOFS); +- if (!ticket_buf) +- goto out_dbuf; ++ type = ceph_decode_32(p); ++ dout(" ticket type %d %s\n", type, ceph_entity_type_name(type)); + +- ceph_decode_need(&p, end, 1 + sizeof(u32), bad); +- reply_struct_v = ceph_decode_8(&p); +- if (reply_struct_v != 1) ++ tkt_struct_v = ceph_decode_8(p); ++ if (tkt_struct_v != 1) + goto bad; +- num = ceph_decode_32(&p); +- dout("%d tickets\n", num); +- while (num--) { +- int type; +- u8 tkt_struct_v, blob_struct_v; +- struct ceph_x_ticket_handler *th; +- void *dp, *dend; +- int dlen; +- char is_enc; +- struct timespec validity; +- struct ceph_crypto_key old_key; +- void *tp, *tpend; +- struct ceph_timespec new_validity; +- struct ceph_crypto_key new_session_key; +- struct ceph_buffer *new_ticket_blob; +- unsigned long new_expires, new_renew_after; +- u64 new_secret_id; +- +- ceph_decode_need(&p, end, sizeof(u32) + 1, bad); +- +- type = ceph_decode_32(&p); +- dout(" ticket type %d %s\n", type, ceph_entity_type_name(type)); +- +- tkt_struct_v = ceph_decode_8(&p); +- if (tkt_struct_v != 1) +- goto bad; +- +- th = get_ticket_handler(ac, type); +- if (IS_ERR(th)) { +- ret = PTR_ERR(th); +- goto out; +- } + +- /* blob for me */ +- dlen = ceph_x_decrypt(secret, &p, end, dbuf, +- TEMP_TICKET_BUF_LEN); +- if (dlen <= 0) { +- ret = dlen; +- goto out; +- } +- dout(" decrypted %d bytes\n", dlen); +- dend = dbuf + dlen; +- dp = dbuf; ++ th = get_ticket_handler(ac, type); ++ if (IS_ERR(th)) { ++ ret = PTR_ERR(th); ++ goto out; ++ } + +- tkt_struct_v = ceph_decode_8(&dp); +- if (tkt_struct_v != 1) +- goto bad; ++ /* blob for me */ ++ dlen = ceph_x_decrypt(secret, p, end, &dbuf, 0); ++ if (dlen <= 0) { ++ ret = dlen; ++ goto out; ++ } ++ dout(" decrypted %d bytes\n", dlen); ++ dp = dbuf; ++ dend = dp + dlen; + +- memcpy(&old_key, &th->session_key, sizeof(old_key)); +- ret = ceph_crypto_key_decode(&new_session_key, &dp, dend); +- if (ret) +- goto out; ++ tkt_struct_v = ceph_decode_8(&dp); ++ if (tkt_struct_v != 1) ++ goto bad; + +- ceph_decode_copy(&dp, &new_validity, sizeof(new_validity)); +- ceph_decode_timespec(&validity, &new_validity); +- new_expires = get_seconds() + validity.tv_sec; +- new_renew_after = new_expires - (validity.tv_sec / 4); +- dout(" expires=%lu renew_after=%lu\n", new_expires, +- new_renew_after); ++ memcpy(&old_key, &th->session_key, sizeof(old_key)); ++ ret = ceph_crypto_key_decode(&new_session_key, &dp, dend); ++ if (ret) ++ goto out; + +- /* ticket blob for service */ +- ceph_decode_8_safe(&p, end, is_enc, bad); +- tp = ticket_buf; +- if (is_enc) { +- /* encrypted */ +- dout(" encrypted ticket\n"); +- dlen = ceph_x_decrypt(&old_key, &p, end, ticket_buf, +- TEMP_TICKET_BUF_LEN); +- if (dlen < 0) { +- ret = dlen; +- goto out; +- } +- dlen = ceph_decode_32(&tp); +- } else { +- /* unencrypted */ +- ceph_decode_32_safe(&p, end, dlen, bad); +- ceph_decode_need(&p, end, dlen, bad); +- ceph_decode_copy(&p, ticket_buf, dlen); ++ ceph_decode_copy(&dp, &new_validity, sizeof(new_validity)); ++ ceph_decode_timespec(&validity, &new_validity); ++ new_expires = get_seconds() + validity.tv_sec; ++ new_renew_after = new_expires - (validity.tv_sec / 4); ++ dout(" expires=%lu renew_after=%lu\n", new_expires, ++ new_renew_after); ++ ++ /* ticket blob for service */ ++ ceph_decode_8_safe(p, end, is_enc, bad); ++ if (is_enc) { ++ /* encrypted */ ++ dout(" encrypted ticket\n"); ++ dlen = ceph_x_decrypt(&old_key, p, end, &ticket_buf, 0); ++ if (dlen < 0) { ++ ret = dlen; ++ goto out; + } +- tpend = tp + dlen; +- dout(" ticket blob is %d bytes\n", dlen); +- ceph_decode_need(&tp, tpend, 1 + sizeof(u64), bad); +- blob_struct_v = ceph_decode_8(&tp); +- new_secret_id = ceph_decode_64(&tp); +- ret = ceph_decode_buffer(&new_ticket_blob, &tp, tpend); +- if (ret) ++ tp = ticket_buf; ++ dlen = ceph_decode_32(&tp); ++ } else { ++ /* unencrypted */ ++ ceph_decode_32_safe(p, end, dlen, bad); ++ ticket_buf = kmalloc(dlen, GFP_NOFS); ++ if (!ticket_buf) { ++ ret = -ENOMEM; + goto out; +- +- /* all is well, update our ticket */ +- ceph_crypto_key_destroy(&th->session_key); +- if (th->ticket_blob) +- ceph_buffer_put(th->ticket_blob); +- th->session_key = new_session_key; +- th->ticket_blob = new_ticket_blob; +- th->validity = new_validity; +- th->secret_id = new_secret_id; +- th->expires = new_expires; +- th->renew_after = new_renew_after; +- dout(" got ticket service %d (%s) secret_id %lld len %d\n", +- type, ceph_entity_type_name(type), th->secret_id, +- (int)th->ticket_blob->vec.iov_len); +- xi->have_keys |= th->service; ++ } ++ tp = ticket_buf; ++ ceph_decode_need(p, end, dlen, bad); ++ ceph_decode_copy(p, ticket_buf, dlen); + } ++ tpend = tp + dlen; ++ dout(" ticket blob is %d bytes\n", dlen); ++ ceph_decode_need(&tp, tpend, 1 + sizeof(u64), bad); ++ blob_struct_v = ceph_decode_8(&tp); ++ new_secret_id = ceph_decode_64(&tp); ++ ret = ceph_decode_buffer(&new_ticket_blob, &tp, tpend); ++ if (ret) ++ goto out; ++ ++ /* all is well, update our ticket */ ++ ceph_crypto_key_destroy(&th->session_key); ++ if (th->ticket_blob) ++ ceph_buffer_put(th->ticket_blob); ++ th->session_key = new_session_key; ++ th->ticket_blob = new_ticket_blob; ++ th->validity = new_validity; ++ th->secret_id = new_secret_id; ++ th->expires = new_expires; ++ th->renew_after = new_renew_after; ++ dout(" got ticket service %d (%s) secret_id %lld len %d\n", ++ type, ceph_entity_type_name(type), th->secret_id, ++ (int)th->ticket_blob->vec.iov_len); ++ xi->have_keys |= th->service; + +- ret = 0; + out: + kfree(ticket_buf); +-out_dbuf: + kfree(dbuf); + return ret; + +@@ -270,6 +255,34 @@ bad: + goto out; + } + ++static int ceph_x_proc_ticket_reply(struct ceph_auth_client *ac, ++ struct ceph_crypto_key *secret, ++ void *buf, void *end) ++{ ++ void *p = buf; ++ u8 reply_struct_v; ++ u32 num; ++ int ret; ++ ++ ceph_decode_8_safe(&p, end, reply_struct_v, bad); ++ if (reply_struct_v != 1) ++ return -EINVAL; ++ ++ ceph_decode_32_safe(&p, end, num, bad); ++ dout("%d tickets\n", num); ++ ++ while (num--) { ++ ret = process_one_ticket(ac, secret, &p, end); ++ if (ret) ++ return ret; ++ } ++ ++ return 0; ++ ++bad: ++ return -EINVAL; ++} ++ + static int ceph_x_build_authorizer(struct ceph_auth_client *ac, + struct ceph_x_ticket_handler *th, + struct ceph_x_authorizer *au) +@@ -583,13 +596,14 @@ static int ceph_x_verify_authorizer_reply(struct ceph_auth_client *ac, + struct ceph_x_ticket_handler *th; + int ret = 0; + struct ceph_x_authorize_reply reply; ++ void *preply = &reply; + void *p = au->reply_buf; + void *end = p + sizeof(au->reply_buf); + + th = get_ticket_handler(ac, au->service); + if (IS_ERR(th)) + return PTR_ERR(th); +- ret = ceph_x_decrypt(&th->session_key, &p, end, &reply, sizeof(reply)); ++ ret = ceph_x_decrypt(&th->session_key, &p, end, &preply, sizeof(reply)); + if (ret < 0) + return ret; + if (ret != sizeof(reply)) +diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c +index 6765da36f78f..bc293c087de6 100644 +--- a/net/ceph/mon_client.c ++++ b/net/ceph/mon_client.c +@@ -1042,7 +1042,15 @@ static struct ceph_msg *mon_alloc_msg(struct ceph_connection *con, + if (!m) { + pr_info("alloc_msg unknown type %d\n", type); + *skip = 1; ++ } else if (front_len > m->front_max) { ++ pr_warning("mon_alloc_msg front %d > prealloc %d (%u#%llu)\n", ++ front_len, m->front_max, ++ (unsigned int)con->peer_name.type, ++ le64_to_cpu(con->peer_name.num)); ++ ceph_msg_put(m); ++ m = ceph_msg_new(type, front_len, GFP_NOFS, false); + } ++ + return m; + } + +diff --git a/net/core/dev.c b/net/core/dev.c +index b47375d9d956..0770364832a1 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -5546,13 +5546,8 @@ int register_netdevice(struct net_device *dev) + dev->features |= NETIF_F_SOFT_FEATURES; + dev->wanted_features = dev->features & dev->hw_features; + +- /* Turn on no cache copy if HW is doing checksum */ + if (!(dev->flags & IFF_LOOPBACK)) { + dev->hw_features |= NETIF_F_NOCACHE_COPY; +- if (dev->features & NETIF_F_ALL_CSUM) { +- dev->wanted_features |= NETIF_F_NOCACHE_COPY; +- dev->features |= NETIF_F_NOCACHE_COPY; +- } + } + + /* Make NETIF_F_HIGHDMA inheritable to VLAN devices. +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index fd6843371f2e..6c34bc98bce7 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -150,6 +150,9 @@ static void ipv4_link_failure(struct sk_buff *skb); + static void ip_rt_update_pmtu(struct dst_entry *dst, u32 mtu); + static int rt_garbage_collect(struct dst_ops *ops); + ++static void __rt_garbage_collect(struct work_struct *w); ++static DECLARE_WORK(rt_gc_worker, __rt_garbage_collect); ++ + static void ipv4_dst_ifdown(struct dst_entry *dst, struct net_device *dev, + int how) + { +@@ -977,12 +980,13 @@ static void rt_emergency_hash_rebuild(struct net *net) + and when load increases it reduces to limit cache size. + */ + +-static int rt_garbage_collect(struct dst_ops *ops) ++static void __do_rt_garbage_collect(int elasticity, int min_interval) + { + static unsigned long expire = RT_GC_TIMEOUT; + static unsigned long last_gc; + static int rover; + static int equilibrium; ++ static DEFINE_SPINLOCK(rt_gc_lock); + struct rtable *rth; + struct rtable __rcu **rthp; + unsigned long now = jiffies; +@@ -994,9 +998,11 @@ static int rt_garbage_collect(struct dst_ops *ops) + * do not make it too frequently. + */ + ++ spin_lock_bh(&rt_gc_lock); ++ + RT_CACHE_STAT_INC(gc_total); + +- if (now - last_gc < ip_rt_gc_min_interval && ++ if (now - last_gc < min_interval && + entries < ip_rt_max_size) { + RT_CACHE_STAT_INC(gc_ignored); + goto out; +@@ -1004,7 +1010,7 @@ static int rt_garbage_collect(struct dst_ops *ops) + + entries = dst_entries_get_slow(&ipv4_dst_ops); + /* Calculate number of entries, which we want to expire now. */ +- goal = entries - (ip_rt_gc_elasticity << rt_hash_log); ++ goal = entries - (elasticity << rt_hash_log); + if (goal <= 0) { + if (equilibrium < ipv4_dst_ops.gc_thresh) + equilibrium = ipv4_dst_ops.gc_thresh; +@@ -1021,7 +1027,7 @@ static int rt_garbage_collect(struct dst_ops *ops) + equilibrium = entries - goal; + } + +- if (now - last_gc >= ip_rt_gc_min_interval) ++ if (now - last_gc >= min_interval) + last_gc = now; + + if (goal <= 0) { +@@ -1086,15 +1092,34 @@ static int rt_garbage_collect(struct dst_ops *ops) + if (net_ratelimit()) + pr_warn("dst cache overflow\n"); + RT_CACHE_STAT_INC(gc_dst_overflow); +- return 1; ++ goto out; + + work_done: +- expire += ip_rt_gc_min_interval; ++ expire += min_interval; + if (expire > ip_rt_gc_timeout || + dst_entries_get_fast(&ipv4_dst_ops) < ipv4_dst_ops.gc_thresh || + dst_entries_get_slow(&ipv4_dst_ops) < ipv4_dst_ops.gc_thresh) + expire = ip_rt_gc_timeout; +-out: return 0; ++out: ++ spin_unlock_bh(&rt_gc_lock); ++} ++ ++static void __rt_garbage_collect(struct work_struct *w) ++{ ++ __do_rt_garbage_collect(ip_rt_gc_elasticity, ip_rt_gc_min_interval); ++} ++ ++static int rt_garbage_collect(struct dst_ops *ops) ++{ ++ if (!work_pending(&rt_gc_worker)) ++ schedule_work(&rt_gc_worker); ++ ++ if (dst_entries_get_fast(&ipv4_dst_ops) >= ip_rt_max_size || ++ dst_entries_get_slow(&ipv4_dst_ops) >= ip_rt_max_size) { ++ RT_CACHE_STAT_INC(gc_dst_overflow); ++ return 1; ++ } ++ return 0; + } + + /* +@@ -1151,7 +1176,7 @@ static struct rtable *rt_intern_hash(unsigned hash, struct rtable *rt, + unsigned long now; + u32 min_score; + int chain_length; +- int attempts = !in_softirq(); ++ int attempts = 1; + + restart: + chain_length = 0; +@@ -1287,14 +1312,15 @@ restart: + can be released. Try to shrink route cache, + it is most likely it holds some neighbour records. + */ +- if (attempts-- > 0) { +- int saved_elasticity = ip_rt_gc_elasticity; +- int saved_int = ip_rt_gc_min_interval; +- ip_rt_gc_elasticity = 1; +- ip_rt_gc_min_interval = 0; +- rt_garbage_collect(&ipv4_dst_ops); +- ip_rt_gc_min_interval = saved_int; +- ip_rt_gc_elasticity = saved_elasticity; ++ if (!in_softirq() && attempts-- > 0) { ++ static DEFINE_SPINLOCK(lock); ++ ++ if (spin_trylock(&lock)) { ++ __do_rt_garbage_collect(1, 0); ++ spin_unlock(&lock); ++ } else { ++ spin_unlock_wait(&lock); ++ } + goto restart; + } + +diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c +index 98fd7384c446..ef9052f8c90b 100644 +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -1366,7 +1366,7 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb, + fptr = (struct frag_hdr *)(skb_network_header(skb) + unfrag_ip6hlen); + fptr->nexthdr = nexthdr; + fptr->reserved = 0; +- ipv6_select_ident(fptr, (struct rt6_info *)skb_dst(skb)); ++ fptr->identification = skb_shinfo(skb)->ip6_frag_id; + + /* Fragment the skb. ipv6 header and the remaining fields of the + * fragment header are updated in ipv6_gso_segment() +diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c +index 82ed7dfb7b80..cf7821b7c0ca 100644 +--- a/net/l2tp/l2tp_ppp.c ++++ b/net/l2tp/l2tp_ppp.c +@@ -774,7 +774,8 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, + /* If PMTU discovery was enabled, use the MTU that was discovered */ + dst = sk_dst_get(tunnel->sock); + if (dst != NULL) { +- u32 pmtu = dst_mtu(__sk_dst_get(tunnel->sock)); ++ u32 pmtu = dst_mtu(dst); ++ + if (pmtu != 0) + session->mtu = session->mru = pmtu - + PPPOL2TP_HEADER_OVERHEAD; +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index add9f94cd733..52646f9ecc80 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -5059,6 +5059,9 @@ int cfg80211_testmode_reply(struct sk_buff *skb) + void *hdr = ((void **)skb->cb)[1]; + struct nlattr *data = ((void **)skb->cb)[2]; + ++ /* clear CB data for netlink core to own from now on */ ++ memset(skb->cb, 0, sizeof(skb->cb)); ++ + if (WARN_ON(!rdev->testmode_info)) { + kfree_skb(skb); + return -EINVAL; +@@ -5085,6 +5088,9 @@ void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp) + void *hdr = ((void **)skb->cb)[1]; + struct nlattr *data = ((void **)skb->cb)[2]; + ++ /* clear CB data for netlink core to own from now on */ ++ memset(skb->cb, 0, sizeof(skb->cb)); ++ + nla_nest_end(skb, data); + genlmsg_end(skb, hdr); + genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), skb, 0, +diff --git a/scripts/tags.sh b/scripts/tags.sh +index cf7b12fee573..246e4f6bc2ad 100755 +--- a/scripts/tags.sh ++++ b/scripts/tags.sh +@@ -153,7 +153,10 @@ exuberant() + --regex-c++='/CLEARPAGEFLAG_NOOP\(([^,)]*).*/ClearPage\1/' \ + --regex-c++='/__CLEARPAGEFLAG_NOOP\(([^,)]*).*/__ClearPage\1/' \ + --regex-c++='/TESTCLEARFLAG_FALSE\(([^,)]*).*/TestClearPage\1/' \ +- --regex-c++='/__TESTCLEARFLAG_FALSE\(([^,)]*).*/__TestClearPage\1/' ++ --regex-c++='/__TESTCLEARFLAG_FALSE\(([^,)]*).*/__TestClearPage\1/'\ ++ --regex-c++='/TASK_PFA_TEST\([^,]*,\s*([^)]*)\)/task_\1/' \ ++ --regex-c++='/TASK_PFA_SET\([^,]*,\s*([^)]*)\)/task_set_\1/' \ ++ --regex-c++='/TASK_PFA_CLEAR\([^,]*,\s*([^)]*)\)/task_clear_\1/' + + all_kconfigs | xargs $1 -a \ + --langdef=kconfig --language-force=kconfig \ +@@ -195,7 +198,10 @@ emacs() + --regex='/CLEARPAGEFLAG_NOOP\(([^,)]*).*/ClearPage\1/' \ + --regex='/__CLEARPAGEFLAG_NOOP\(([^,)]*).*/__ClearPage\1/' \ + --regex='/TESTCLEARFLAG_FALSE\(([^,)]*).*/TestClearPage\1/' \ +- --regex='/__TESTCLEARFLAG_FALSE\(([^,)]*).*/__TestClearPage\1/' ++ --regex='/__TESTCLEARFLAG_FALSE\(([^,)]*).*/__TestClearPage\1/'\ ++ --regex='/TASK_PFA_TEST\([^,]*,\s*([^)]*)\)/task_\1/' \ ++ --regex='/TASK_PFA_SET\([^,]*,\s*([^)]*)\)/task_set_\1/' \ ++ --regex='/TASK_PFA_CLEAR\([^,]*,\s*([^)]*)\)/task_clear_\1/' + + all_kconfigs | xargs $1 -a \ + --regex='/^[ \t]*\(\(menu\)*config\)[ \t]+\([a-zA-Z0-9_]+\)/\3/' +diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c +index 370fc56d2de7..629257585501 100644 +--- a/sound/core/pcm_lib.c ++++ b/sound/core/pcm_lib.c +@@ -1693,14 +1693,16 @@ static int snd_pcm_lib_ioctl_fifo_size(struct snd_pcm_substream *substream, + { + struct snd_pcm_hw_params *params = arg; + snd_pcm_format_t format; +- int channels, width; ++ int channels; ++ ssize_t frame_size; + + params->fifo_size = substream->runtime->hw.fifo_size; + if (!(substream->runtime->hw.info & SNDRV_PCM_INFO_FIFO_IN_FRAMES)) { + format = params_format(params); + channels = params_channels(params); +- width = snd_pcm_format_physical_width(format); +- params->fifo_size /= width * channels; ++ frame_size = snd_pcm_format_size(format, channels); ++ if (frame_size > 0) ++ params->fifo_size /= (unsigned)frame_size; + } + return 0; + } +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 36284b8562f0..9461a004f08b 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -811,6 +811,7 @@ static void alc_auto_init_amp(struct hda_codec *codec, int type) + case 0x10ec0885: + case 0x10ec0887: + /*case 0x10ec0889:*/ /* this causes an SPDIF problem */ ++ case 0x10ec0900: + alc889_coef_init(codec); + break; + case 0x10ec0888: +@@ -5516,6 +5517,7 @@ static int patch_alc882(struct hda_codec *codec) + switch (codec->vendor_id) { + case 0x10ec0882: + case 0x10ec0885: ++ case 0x10ec0900: + break; + default: + /* ALC883 and variants */ +diff --git a/sound/soc/samsung/i2s.c b/sound/soc/samsung/i2s.c +index 6ac7b8281a02..9998719cc02f 100644 +--- a/sound/soc/samsung/i2s.c ++++ b/sound/soc/samsung/i2s.c +@@ -392,7 +392,7 @@ static int i2s_set_sysclk(struct snd_soc_dai *dai, + if (dir == SND_SOC_CLOCK_IN) + rfs = 0; + +- if ((rfs && other->rfs && (other->rfs != rfs)) || ++ if ((rfs && other && other->rfs && (other->rfs != rfs)) || + (any_active(i2s) && + (((dir == SND_SOC_CLOCK_IN) + && !(mod & MOD_CDCLKCON)) || +diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c +index c88d9741b9e7..34c1fbb5b20b 100644 +--- a/sound/soc/soc-core.c ++++ b/sound/soc/soc-core.c +@@ -2799,7 +2799,7 @@ int snd_soc_bytes_put(struct snd_kcontrol *kcontrol, + unsigned int val; + void *data; + +- if (!codec->using_regmap) ++ if (!codec->using_regmap || !params->num_regs) + return -EINVAL; + + data = ucontrol->value.bytes.data; diff --git a/patch/kernel/sun5i-default/0011-patch-3.4.105-106.patch b/patch/kernel/sun5i-default/0011-patch-3.4.105-106.patch new file mode 100644 index 0000000000..74a594751e --- /dev/null +++ b/patch/kernel/sun5i-default/0011-patch-3.4.105-106.patch @@ -0,0 +1,6633 @@ +diff --git a/Documentation/lzo.txt b/Documentation/lzo.txt +new file mode 100644 +index 000000000000..ea45dd3901e3 +--- /dev/null ++++ b/Documentation/lzo.txt +@@ -0,0 +1,164 @@ ++ ++LZO stream format as understood by Linux's LZO decompressor ++=========================================================== ++ ++Introduction ++ ++ This is not a specification. No specification seems to be publicly available ++ for the LZO stream format. This document describes what input format the LZO ++ decompressor as implemented in the Linux kernel understands. The file subject ++ of this analysis is lib/lzo/lzo1x_decompress_safe.c. No analysis was made on ++ the compressor nor on any other implementations though it seems likely that ++ the format matches the standard one. The purpose of this document is to ++ better understand what the code does in order to propose more efficient fixes ++ for future bug reports. ++ ++Description ++ ++ The stream is composed of a series of instructions, operands, and data. The ++ instructions consist in a few bits representing an opcode, and bits forming ++ the operands for the instruction, whose size and position depend on the ++ opcode and on the number of literals copied by previous instruction. The ++ operands are used to indicate : ++ ++ - a distance when copying data from the dictionary (past output buffer) ++ - a length (number of bytes to copy from dictionary) ++ - the number of literals to copy, which is retained in variable "state" ++ as a piece of information for next instructions. ++ ++ Optionally depending on the opcode and operands, extra data may follow. These ++ extra data can be a complement for the operand (eg: a length or a distance ++ encoded on larger values), or a literal to be copied to the output buffer. ++ ++ The first byte of the block follows a different encoding from other bytes, it ++ seems to be optimized for literal use only, since there is no dictionary yet ++ prior to that byte. ++ ++ Lengths are always encoded on a variable size starting with a small number ++ of bits in the operand. If the number of bits isn't enough to represent the ++ length, up to 255 may be added in increments by consuming more bytes with a ++ rate of at most 255 per extra byte (thus the compression ratio cannot exceed ++ around 255:1). The variable length encoding using #bits is always the same : ++ ++ length = byte & ((1 << #bits) - 1) ++ if (!length) { ++ length = ((1 << #bits) - 1) ++ length += 255*(number of zero bytes) ++ length += first-non-zero-byte ++ } ++ length += constant (generally 2 or 3) ++ ++ For references to the dictionary, distances are relative to the output ++ pointer. Distances are encoded using very few bits belonging to certain ++ ranges, resulting in multiple copy instructions using different encodings. ++ Certain encodings involve one extra byte, others involve two extra bytes ++ forming a little-endian 16-bit quantity (marked LE16 below). ++ ++ After any instruction except the large literal copy, 0, 1, 2 or 3 literals ++ are copied before starting the next instruction. The number of literals that ++ were copied may change the meaning and behaviour of the next instruction. In ++ practice, only one instruction needs to know whether 0, less than 4, or more ++ literals were copied. This is the information stored in the variable ++ in this implementation. This number of immediate literals to be copied is ++ generally encoded in the last two bits of the instruction but may also be ++ taken from the last two bits of an extra operand (eg: distance). ++ ++ End of stream is declared when a block copy of distance 0 is seen. Only one ++ instruction may encode this distance (0001HLLL), it takes one LE16 operand ++ for the distance, thus requiring 3 bytes. ++ ++ IMPORTANT NOTE : in the code some length checks are missing because certain ++ instructions are called under the assumption that a certain number of bytes ++ follow because it has already been garanteed before parsing the instructions. ++ They just have to "refill" this credit if they consume extra bytes. This is ++ an implementation design choice independant on the algorithm or encoding. ++ ++Byte sequences ++ ++ First byte encoding : ++ ++ 0..17 : follow regular instruction encoding, see below. It is worth ++ noting that codes 16 and 17 will represent a block copy from ++ the dictionary which is empty, and that they will always be ++ invalid at this place. ++ ++ 18..21 : copy 0..3 literals ++ state = (byte - 17) = 0..3 [ copy literals ] ++ skip byte ++ ++ 22..255 : copy literal string ++ length = (byte - 17) = 4..238 ++ state = 4 [ don't copy extra literals ] ++ skip byte ++ ++ Instruction encoding : ++ ++ 0 0 0 0 X X X X (0..15) ++ Depends on the number of literals copied by the last instruction. ++ If last instruction did not copy any literal (state == 0), this ++ encoding will be a copy of 4 or more literal, and must be interpreted ++ like this : ++ ++ 0 0 0 0 L L L L (0..15) : copy long literal string ++ length = 3 + (L ?: 15 + (zero_bytes * 255) + non_zero_byte) ++ state = 4 (no extra literals are copied) ++ ++ If last instruction used to copy between 1 to 3 literals (encoded in ++ the instruction's opcode or distance), the instruction is a copy of a ++ 2-byte block from the dictionary within a 1kB distance. It is worth ++ noting that this instruction provides little savings since it uses 2 ++ bytes to encode a copy of 2 other bytes but it encodes the number of ++ following literals for free. It must be interpreted like this : ++ ++ 0 0 0 0 D D S S (0..15) : copy 2 bytes from <= 1kB distance ++ length = 2 ++ state = S (copy S literals after this block) ++ Always followed by exactly one byte : H H H H H H H H ++ distance = (H << 2) + D + 1 ++ ++ If last instruction used to copy 4 or more literals (as detected by ++ state == 4), the instruction becomes a copy of a 3-byte block from the ++ dictionary from a 2..3kB distance, and must be interpreted like this : ++ ++ 0 0 0 0 D D S S (0..15) : copy 3 bytes from 2..3 kB distance ++ length = 3 ++ state = S (copy S literals after this block) ++ Always followed by exactly one byte : H H H H H H H H ++ distance = (H << 2) + D + 2049 ++ ++ 0 0 0 1 H L L L (16..31) ++ Copy of a block within 16..48kB distance (preferably less than 10B) ++ length = 2 + (L ?: 7 + (zero_bytes * 255) + non_zero_byte) ++ Always followed by exactly one LE16 : D D D D D D D D : D D D D D D S S ++ distance = 16384 + (H << 14) + D ++ state = S (copy S literals after this block) ++ End of stream is reached if distance == 16384 ++ ++ 0 0 1 L L L L L (32..63) ++ Copy of small block within 16kB distance (preferably less than 34B) ++ length = 2 + (L ?: 31 + (zero_bytes * 255) + non_zero_byte) ++ Always followed by exactly one LE16 : D D D D D D D D : D D D D D D S S ++ distance = D + 1 ++ state = S (copy S literals after this block) ++ ++ 0 1 L D D D S S (64..127) ++ Copy 3-4 bytes from block within 2kB distance ++ state = S (copy S literals after this block) ++ length = 3 + L ++ Always followed by exactly one byte : H H H H H H H H ++ distance = (H << 3) + D + 1 ++ ++ 1 L L D D D S S (128..255) ++ Copy 5-8 bytes from block within 2kB distance ++ state = S (copy S literals after this block) ++ length = 5 + L ++ Always followed by exactly one byte : H H H H H H H H ++ distance = (H << 3) + D + 1 ++ ++Authors ++ ++ This document was written by Willy Tarreau on 2014/07/19 during an ++ analysis of the decompression code available in Linux 3.16-rc5. The code is ++ tricky, it is possible that this document contains mistakes or that a few ++ corner cases were overlooked. In any case, please report any doubt, fix, or ++ proposed updates to the author(s) so that the document can be updated. +diff --git a/Makefile b/Makefile +index cf2c8a82ca3e..649f1462ebf8 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 4 +-SUBLEVEL = 105 ++SUBLEVEL = 106 + EXTRAVERSION = + NAME = Saber-toothed Squirrel + +diff --git a/arch/m68k/mm/hwtest.c b/arch/m68k/mm/hwtest.c +index 2c7dde3c6430..2a5259fd23eb 100644 +--- a/arch/m68k/mm/hwtest.c ++++ b/arch/m68k/mm/hwtest.c +@@ -28,9 +28,11 @@ + int hwreg_present( volatile void *regp ) + { + int ret = 0; ++ unsigned long flags; + long save_sp, save_vbr; + long tmp_vectors[3]; + ++ local_irq_save(flags); + __asm__ __volatile__ + ( "movec %/vbr,%2\n\t" + "movel #Lberr1,%4@(8)\n\t" +@@ -46,6 +48,7 @@ int hwreg_present( volatile void *regp ) + : "=&d" (ret), "=&r" (save_sp), "=&r" (save_vbr) + : "a" (regp), "a" (tmp_vectors) + ); ++ local_irq_restore(flags); + + return( ret ); + } +@@ -58,9 +61,11 @@ EXPORT_SYMBOL(hwreg_present); + int hwreg_write( volatile void *regp, unsigned short val ) + { + int ret; ++ unsigned long flags; + long save_sp, save_vbr; + long tmp_vectors[3]; + ++ local_irq_save(flags); + __asm__ __volatile__ + ( "movec %/vbr,%2\n\t" + "movel #Lberr2,%4@(8)\n\t" +@@ -78,6 +83,7 @@ int hwreg_write( volatile void *regp, unsigned short val ) + : "=&d" (ret), "=&r" (save_sp), "=&r" (save_vbr) + : "a" (regp), "a" (tmp_vectors), "g" (val) + ); ++ local_irq_restore(flags); + + return( ret ); + } +diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c +index 0bc485b3cd60..6d64efe77026 100644 +--- a/arch/mips/mm/tlbex.c ++++ b/arch/mips/mm/tlbex.c +@@ -1041,6 +1041,7 @@ static void __cpuinit build_update_entries(u32 **p, unsigned int tmp, + struct mips_huge_tlb_info { + int huge_pte; + int restore_scratch; ++ bool need_reload_pte; + }; + + static struct mips_huge_tlb_info __cpuinit +@@ -1055,6 +1056,7 @@ build_fast_tlb_refill_handler (u32 **p, struct uasm_label **l, + + rv.huge_pte = scratch; + rv.restore_scratch = 0; ++ rv.need_reload_pte = false; + + if (check_for_high_segbits) { + UASM_i_MFC0(p, tmp, C0_BADVADDR); +@@ -1247,6 +1249,7 @@ static void __cpuinit build_r4000_tlb_refill_handler(void) + } else { + htlb_info.huge_pte = K0; + htlb_info.restore_scratch = 0; ++ htlb_info.need_reload_pte = true; + vmalloc_mode = refill_noscratch; + /* + * create the plain linear handler +@@ -1283,6 +1286,8 @@ static void __cpuinit build_r4000_tlb_refill_handler(void) + } + #ifdef CONFIG_HUGETLB_PAGE + uasm_l_tlb_huge_update(&l, p); ++ if (htlb_info.need_reload_pte) ++ UASM_i_LW(&p, htlb_info.huge_pte, 0, K1); + build_huge_update_entries(&p, htlb_info.huge_pte, K1); + build_huge_tlb_write_entry(&p, &l, &r, K0, tlb_random, + htlb_info.restore_scratch); +diff --git a/arch/mips/oprofile/backtrace.c b/arch/mips/oprofile/backtrace.c +index 6854ed5097d2..83a1dfd8f0e3 100644 +--- a/arch/mips/oprofile/backtrace.c ++++ b/arch/mips/oprofile/backtrace.c +@@ -92,7 +92,7 @@ static inline int unwind_user_frame(struct stackframe *old_frame, + /* This marks the end of the previous function, + which means we overran. */ + break; +- stack_size = (unsigned) stack_adjustment; ++ stack_size = (unsigned long) stack_adjustment; + } else if (is_ra_save_ins(&ip)) { + int ra_slot = ip.i_format.simmediate; + if (ra_slot < 0) +diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S +index e500969bea0c..c3fc39ee57a5 100644 +--- a/arch/powerpc/kernel/entry_64.S ++++ b/arch/powerpc/kernel/entry_64.S +@@ -813,7 +813,13 @@ user_work: + b .ret_from_except_lite + + 1: bl .save_nvgprs ++ /* ++ * Use a non volatile GPR to save and restore our thread_info flags ++ * across the call to restore_interrupts. ++ */ ++ mr r30,r4 + bl .restore_interrupts ++ mr r4,r30 + addi r3,r1,STACK_FRAME_OVERHEAD + bl .do_notify_resume + b .ret_from_except +diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c +index 10e13b331d38..df69bcb13c79 100644 +--- a/arch/s390/kvm/interrupt.c ++++ b/arch/s390/kvm/interrupt.c +@@ -43,6 +43,7 @@ static int __interrupt_is_deliverable(struct kvm_vcpu *vcpu, + return 0; + if (vcpu->arch.sie_block->gcr[0] & 0x2000ul) + return 1; ++ return 0; + case KVM_S390_INT_EMERGENCY: + if (psw_extint_disabled(vcpu)) + return 0; +diff --git a/arch/x86/include/asm/desc.h b/arch/x86/include/asm/desc.h +index e95822d683f4..fa9c8c7bc500 100644 +--- a/arch/x86/include/asm/desc.h ++++ b/arch/x86/include/asm/desc.h +@@ -250,7 +250,8 @@ static inline void native_load_tls(struct thread_struct *t, unsigned int cpu) + gdt[GDT_ENTRY_TLS_MIN + i] = t->tls_array[i]; + } + +-#define _LDT_empty(info) \ ++/* This intentionally ignores lm, since 32-bit apps don't have that field. */ ++#define LDT_empty(info) \ + ((info)->base_addr == 0 && \ + (info)->limit == 0 && \ + (info)->contents == 0 && \ +@@ -260,11 +261,18 @@ static inline void native_load_tls(struct thread_struct *t, unsigned int cpu) + (info)->seg_not_present == 1 && \ + (info)->useable == 0) + +-#ifdef CONFIG_X86_64 +-#define LDT_empty(info) (_LDT_empty(info) && ((info)->lm == 0)) +-#else +-#define LDT_empty(info) (_LDT_empty(info)) +-#endif ++/* Lots of programs expect an all-zero user_desc to mean "no segment at all". */ ++static inline bool LDT_zero(const struct user_desc *info) ++{ ++ return (info->base_addr == 0 && ++ info->limit == 0 && ++ info->contents == 0 && ++ info->read_exec_only == 0 && ++ info->seg_32bit == 0 && ++ info->limit_in_pages == 0 && ++ info->seg_not_present == 0 && ++ info->useable == 0); ++} + + static inline void clear_LDT(void) + { +diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h +index 5939f44fe0c0..06ec1fe26d98 100644 +--- a/arch/x86/include/asm/elf.h ++++ b/arch/x86/include/asm/elf.h +@@ -155,8 +155,9 @@ do { \ + #define elf_check_arch(x) \ + ((x)->e_machine == EM_X86_64) + +-#define compat_elf_check_arch(x) \ +- (elf_check_arch_ia32(x) || (x)->e_machine == EM_X86_64) ++#define compat_elf_check_arch(x) \ ++ (elf_check_arch_ia32(x) || \ ++ (IS_ENABLED(CONFIG_X86_X32_ABI) && (x)->e_machine == EM_X86_64)) + + #if __USER32_DS != __USER_DS + # error "The following code assumes __USER32_DS == __USER_DS" +diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h +index 944471f4d142..4f787579b329 100644 +--- a/arch/x86/include/asm/kvm_host.h ++++ b/arch/x86/include/asm/kvm_host.h +@@ -453,6 +453,7 @@ struct kvm_vcpu_arch { + u64 mmio_gva; + unsigned access; + gfn_t mmio_gfn; ++ u64 mmio_gen; + + struct kvm_pmu pmu; + +@@ -881,6 +882,20 @@ static inline void kvm_inject_gp(struct kvm_vcpu *vcpu, u32 error_code) + kvm_queue_exception_e(vcpu, GP_VECTOR, error_code); + } + ++static inline u64 get_canonical(u64 la) ++{ ++ return ((int64_t)la << 16) >> 16; ++} ++ ++static inline bool is_noncanonical_address(u64 la) ++{ ++#ifdef CONFIG_X86_64 ++ return get_canonical(la) != la; ++#else ++ return false; ++#endif ++} ++ + #define TSS_IOPB_BASE_OFFSET 0x66 + #define TSS_BASE_SIZE 0x68 + #define TSS_IOPB_SIZE (65536 / 8) +@@ -939,7 +954,7 @@ int kvm_arch_interrupt_allowed(struct kvm_vcpu *vcpu); + int kvm_cpu_get_interrupt(struct kvm_vcpu *v); + + void kvm_define_shared_msr(unsigned index, u32 msr); +-void kvm_set_shared_msr(unsigned index, u64 val, u64 mask); ++int kvm_set_shared_msr(unsigned index, u64 val, u64 mask); + + bool kvm_is_linear_rip(struct kvm_vcpu *vcpu, unsigned long linear_rip); + +diff --git a/arch/x86/include/asm/page_32_types.h b/arch/x86/include/asm/page_32_types.h +index ade619ff9e2a..88dae6b3d7d5 100644 +--- a/arch/x86/include/asm/page_32_types.h ++++ b/arch/x86/include/asm/page_32_types.h +@@ -18,7 +18,6 @@ + #define THREAD_ORDER 1 + #define THREAD_SIZE (PAGE_SIZE << THREAD_ORDER) + +-#define STACKFAULT_STACK 0 + #define DOUBLEFAULT_STACK 1 + #define NMI_STACK 0 + #define DEBUG_STACK 0 +diff --git a/arch/x86/include/asm/page_64_types.h b/arch/x86/include/asm/page_64_types.h +index 7639dbf5d223..a9e9937b9a62 100644 +--- a/arch/x86/include/asm/page_64_types.h ++++ b/arch/x86/include/asm/page_64_types.h +@@ -14,12 +14,11 @@ + #define IRQ_STACK_ORDER 2 + #define IRQ_STACK_SIZE (PAGE_SIZE << IRQ_STACK_ORDER) + +-#define STACKFAULT_STACK 1 +-#define DOUBLEFAULT_STACK 2 +-#define NMI_STACK 3 +-#define DEBUG_STACK 4 +-#define MCE_STACK 5 +-#define N_EXCEPTION_STACKS 5 /* hw limit: 7 */ ++#define DOUBLEFAULT_STACK 1 ++#define NMI_STACK 2 ++#define DEBUG_STACK 3 ++#define MCE_STACK 4 ++#define N_EXCEPTION_STACKS 4 /* hw limit: 7 */ + + #define PUD_PAGE_SIZE (_AC(1, UL) << PUD_SHIFT) + #define PUD_PAGE_MASK (~(PUD_PAGE_SIZE-1)) +diff --git a/arch/x86/include/asm/vmx.h b/arch/x86/include/asm/vmx.h +index 31f180c21ce9..504d1cf9def8 100644 +--- a/arch/x86/include/asm/vmx.h ++++ b/arch/x86/include/asm/vmx.h +@@ -279,6 +279,8 @@ enum vmcs_field { + #define EXIT_REASON_APIC_ACCESS 44 + #define EXIT_REASON_EPT_VIOLATION 48 + #define EXIT_REASON_EPT_MISCONFIG 49 ++#define EXIT_REASON_INVEPT 50 ++#define EXIT_REASON_INVVPID 53 + #define EXIT_REASON_WBINVD 54 + #define EXIT_REASON_XSETBV 55 + +diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c +index edc24480469f..cb5b54e796eb 100644 +--- a/arch/x86/kernel/apic/apic.c ++++ b/arch/x86/kernel/apic/apic.c +@@ -1229,7 +1229,7 @@ void __cpuinit setup_local_APIC(void) + unsigned int value, queued; + int i, j, acked = 0; + unsigned long long tsc = 0, ntsc; +- long long max_loops = cpu_khz; ++ long long max_loops = cpu_khz ? cpu_khz : 1000000; + + if (cpu_has_tsc) + rdtscll(tsc); +@@ -1325,7 +1325,7 @@ void __cpuinit setup_local_APIC(void) + acked); + break; + } +- if (cpu_has_tsc) { ++ if (cpu_has_tsc && cpu_khz) { + rdtscll(ntsc); + max_loops = (cpu_khz << 10) - (ntsc - tsc); + } else +diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c +index cf79302198a6..114db0fee86c 100644 +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -142,6 +142,8 @@ EXPORT_PER_CPU_SYMBOL_GPL(gdt_page); + + static int __init x86_xsave_setup(char *s) + { ++ if (strlen(s)) ++ return 0; + setup_clear_cpu_cap(X86_FEATURE_XSAVE); + setup_clear_cpu_cap(X86_FEATURE_XSAVEOPT); + return 1; +diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c +index 3e6ff6cbf42a..e7a64dd602d9 100644 +--- a/arch/x86/kernel/cpu/intel.c ++++ b/arch/x86/kernel/cpu/intel.c +@@ -143,6 +143,21 @@ static void __cpuinit early_init_intel(struct cpuinfo_x86 *c) + setup_clear_cpu_cap(X86_FEATURE_ERMS); + } + } ++ ++ /* ++ * Intel Quark Core DevMan_001.pdf section 6.4.11 ++ * "The operating system also is required to invalidate (i.e., flush) ++ * the TLB when any changes are made to any of the page table entries. ++ * The operating system must reload CR3 to cause the TLB to be flushed" ++ * ++ * As a result cpu_has_pge() in arch/x86/include/asm/tlbflush.h should ++ * be false so that __flush_tlb_all() causes CR3 insted of CR4.PGE ++ * to be modified ++ */ ++ if (c->x86 == 5 && c->x86_model == 9) { ++ pr_info("Disabling PGE capability bit\n"); ++ setup_clear_cpu_cap(X86_FEATURE_PGE); ++ } + } + + #ifdef CONFIG_X86_32 +diff --git a/arch/x86/kernel/dumpstack_64.c b/arch/x86/kernel/dumpstack_64.c +index 17107bd6e1f0..e8206060a0a8 100644 +--- a/arch/x86/kernel/dumpstack_64.c ++++ b/arch/x86/kernel/dumpstack_64.c +@@ -24,7 +24,6 @@ static char x86_stack_ids[][8] = { + [ DEBUG_STACK-1 ] = "#DB", + [ NMI_STACK-1 ] = "NMI", + [ DOUBLEFAULT_STACK-1 ] = "#DF", +- [ STACKFAULT_STACK-1 ] = "#SS", + [ MCE_STACK-1 ] = "#MC", + #if DEBUG_STKSZ > EXCEPTION_STKSZ + [ N_EXCEPTION_STACKS ... +diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S +index 42b055e24691..45f9c70f1246 100644 +--- a/arch/x86/kernel/entry_64.S ++++ b/arch/x86/kernel/entry_64.S +@@ -912,13 +912,16 @@ ENTRY(native_iret) + jnz native_irq_return_ldt + #endif + ++.global native_irq_return_iret + native_irq_return_iret: ++ /* ++ * This may fault. Non-paranoid faults on return to userspace are ++ * handled by fixup_bad_iret. These include #SS, #GP, and #NP. ++ * Double-faults due to espfix64 are handled in do_double_fault. ++ * Other faults here are fatal. ++ */ + iretq + +- .section __ex_table,"a" +- .quad native_irq_return_iret, bad_iret +- .previous +- + #ifdef CONFIG_X86_ESPFIX64 + native_irq_return_ldt: + pushq_cfi %rax +@@ -945,25 +948,6 @@ native_irq_return_ldt: + jmp native_irq_return_iret + #endif + +- .section .fixup,"ax" +-bad_iret: +- /* +- * The iret traps when the %cs or %ss being restored is bogus. +- * We've lost the original trap vector and error code. +- * #GPF is the most likely one to get for an invalid selector. +- * So pretend we completed the iret and took the #GPF in user mode. +- * +- * We are now running with the kernel GS after exception recovery. +- * But error_entry expects us to have user GS to match the user %cs, +- * so swap back. +- */ +- pushq $0 +- +- SWAPGS +- jmp general_protection +- +- .previous +- + /* edi: workmask, edx: work */ + retint_careful: + CFI_RESTORE_STATE +@@ -1011,37 +995,6 @@ ENTRY(retint_kernel) + CFI_ENDPROC + END(common_interrupt) + +- /* +- * If IRET takes a fault on the espfix stack, then we +- * end up promoting it to a doublefault. In that case, +- * modify the stack to make it look like we just entered +- * the #GP handler from user space, similar to bad_iret. +- */ +-#ifdef CONFIG_X86_ESPFIX64 +- ALIGN +-__do_double_fault: +- XCPT_FRAME 1 RDI+8 +- movq RSP(%rdi),%rax /* Trap on the espfix stack? */ +- sarq $PGDIR_SHIFT,%rax +- cmpl $ESPFIX_PGD_ENTRY,%eax +- jne do_double_fault /* No, just deliver the fault */ +- cmpl $__KERNEL_CS,CS(%rdi) +- jne do_double_fault +- movq RIP(%rdi),%rax +- cmpq $native_irq_return_iret,%rax +- jne do_double_fault /* This shouldn't happen... */ +- movq PER_CPU_VAR(kernel_stack),%rax +- subq $(6*8-KERNEL_STACK_OFFSET),%rax /* Reset to original stack */ +- movq %rax,RSP(%rdi) +- movq $0,(%rax) /* Missing (lost) #GP error code */ +- movq $general_protection,RIP(%rdi) +- retq +- CFI_ENDPROC +-END(__do_double_fault) +-#else +-# define __do_double_fault do_double_fault +-#endif +- + /* + * End of kprobes section + */ +@@ -1217,7 +1170,7 @@ zeroentry overflow do_overflow + zeroentry bounds do_bounds + zeroentry invalid_op do_invalid_op + zeroentry device_not_available do_device_not_available +-paranoiderrorentry double_fault __do_double_fault ++paranoiderrorentry double_fault do_double_fault + zeroentry coprocessor_segment_overrun do_coprocessor_segment_overrun + errorentry invalid_TSS do_invalid_TSS + errorentry segment_not_present do_segment_not_present +@@ -1431,7 +1384,7 @@ apicinterrupt XEN_HVM_EVTCHN_CALLBACK \ + + paranoidzeroentry_ist debug do_debug DEBUG_STACK + paranoidzeroentry_ist int3 do_int3 DEBUG_STACK +-paranoiderrorentry stack_segment do_stack_segment ++errorentry stack_segment do_stack_segment + #ifdef CONFIG_XEN + zeroentry xen_debug do_debug + zeroentry xen_int3 do_int3 +@@ -1541,16 +1494,15 @@ error_sti: + + /* + * There are two places in the kernel that can potentially fault with +- * usergs. Handle them here. The exception handlers after iret run with +- * kernel gs again, so don't set the user space flag. B stepping K8s +- * sometimes report an truncated RIP for IRET exceptions returning to +- * compat mode. Check for these here too. ++ * usergs. Handle them here. B stepping K8s sometimes report a ++ * truncated RIP for IRET exceptions returning to compat mode. Check ++ * for these here too. + */ + error_kernelspace: + incl %ebx + leaq native_irq_return_iret(%rip),%rcx + cmpq %rcx,RIP+8(%rsp) +- je error_swapgs ++ je error_bad_iret + movl %ecx,%eax /* zero extend */ + cmpq %rax,RIP+8(%rsp) + je bstep_iret +@@ -1561,7 +1513,15 @@ error_kernelspace: + bstep_iret: + /* Fix truncated RIP */ + movq %rcx,RIP+8(%rsp) +- jmp error_swapgs ++ /* fall through */ ++ ++error_bad_iret: ++ SWAPGS ++ mov %rsp,%rdi ++ call fixup_bad_iret ++ mov %rax,%rsp ++ decl %ebx /* Return to usergs */ ++ jmp error_sti + CFI_ENDPROC + END(error_entry) + +diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c +index e554e5ad2fe8..226f28413f76 100644 +--- a/arch/x86/kernel/kvm.c ++++ b/arch/x86/kernel/kvm.c +@@ -258,7 +258,14 @@ do_async_page_fault(struct pt_regs *regs, unsigned long error_code) + static void __init paravirt_ops_setup(void) + { + pv_info.name = "KVM"; +- pv_info.paravirt_enabled = 1; ++ ++ /* ++ * KVM isn't paravirt in the sense of paravirt_enabled. A KVM ++ * guest kernel works like a bare metal kernel with additional ++ * features, and paravirt_enabled is about features that are ++ * missing. ++ */ ++ pv_info.paravirt_enabled = 0; + + if (kvm_para_has_feature(KVM_FEATURE_NOP_IO_DELAY)) + pv_cpu_ops.io_delay = kvm_io_delay; +diff --git a/arch/x86/kernel/kvmclock.c b/arch/x86/kernel/kvmclock.c +index f8492da65bfc..5e3f91bb6ec3 100644 +--- a/arch/x86/kernel/kvmclock.c ++++ b/arch/x86/kernel/kvmclock.c +@@ -212,7 +212,6 @@ void __init kvmclock_init(void) + #endif + kvm_get_preset_lpj(); + clocksource_register_hz(&kvm_clock, NSEC_PER_SEC); +- pv_info.paravirt_enabled = 1; + pv_info.name = "KVM"; + + if (kvm_para_has_feature(KVM_FEATURE_CLOCKSOURCE_STABLE_BIT)) +diff --git a/arch/x86/kernel/tls.c b/arch/x86/kernel/tls.c +index 9d9d2f9e77a5..9d25a6eef1e1 100644 +--- a/arch/x86/kernel/tls.c ++++ b/arch/x86/kernel/tls.c +@@ -27,6 +27,42 @@ static int get_free_idx(void) + return -ESRCH; + } + ++static bool tls_desc_okay(const struct user_desc *info) ++{ ++ /* ++ * For historical reasons (i.e. no one ever documented how any ++ * of the segmentation APIs work), user programs can and do ++ * assume that a struct user_desc that's all zeros except for ++ * entry_number means "no segment at all". This never actually ++ * worked. In fact, up to Linux 3.19, a struct user_desc like ++ * this would create a 16-bit read-write segment with base and ++ * limit both equal to zero. ++ * ++ * That was close enough to "no segment at all" until we ++ * hardened this function to disallow 16-bit TLS segments. Fix ++ * it up by interpreting these zeroed segments the way that they ++ * were almost certainly intended to be interpreted. ++ * ++ * The correct way to ask for "no segment at all" is to specify ++ * a user_desc that satisfies LDT_empty. To keep everything ++ * working, we accept both. ++ * ++ * Note that there's a similar kludge in modify_ldt -- look at ++ * the distinction between modes 1 and 0x11. ++ */ ++ if (LDT_empty(info) || LDT_zero(info)) ++ return true; ++ ++ /* ++ * espfix is required for 16-bit data segments, but espfix ++ * only works for LDT segments. ++ */ ++ if (!info->seg_32bit) ++ return false; ++ ++ return true; ++} ++ + static void set_tls_desc(struct task_struct *p, int idx, + const struct user_desc *info, int n) + { +@@ -40,7 +76,7 @@ static void set_tls_desc(struct task_struct *p, int idx, + cpu = get_cpu(); + + while (n-- > 0) { +- if (LDT_empty(info)) ++ if (LDT_empty(info) || LDT_zero(info)) + desc->a = desc->b = 0; + else + fill_ldt(desc, info); +@@ -66,6 +102,9 @@ int do_set_thread_area(struct task_struct *p, int idx, + if (copy_from_user(&info, u_info, sizeof(info))) + return -EFAULT; + ++ if (!tls_desc_okay(&info)) ++ return -EINVAL; ++ + if (idx == -1) + idx = info.entry_number; + +@@ -196,6 +235,7 @@ int regset_tls_set(struct task_struct *target, const struct user_regset *regset, + { + struct user_desc infobuf[GDT_ENTRY_TLS_ENTRIES]; + const struct user_desc *info; ++ int i; + + if (pos >= GDT_ENTRY_TLS_ENTRIES * sizeof(struct user_desc) || + (pos % sizeof(struct user_desc)) != 0 || +@@ -209,6 +249,10 @@ int regset_tls_set(struct task_struct *target, const struct user_regset *regset, + else + info = infobuf; + ++ for (i = 0; i < count / sizeof(struct user_desc); i++) ++ if (!tls_desc_okay(info + i)) ++ return -EINVAL; ++ + set_tls_desc(target, + GDT_ENTRY_TLS_MIN + (pos / sizeof(struct user_desc)), + info, count / sizeof(struct user_desc)); +diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c +index ff9281f16029..9bfe95fda57c 100644 +--- a/arch/x86/kernel/traps.c ++++ b/arch/x86/kernel/traps.c +@@ -213,29 +213,41 @@ DO_ERROR(X86_TRAP_OLD_MF, SIGFPE, "coprocessor segment overrun", + coprocessor_segment_overrun) + DO_ERROR(X86_TRAP_TS, SIGSEGV, "invalid TSS", invalid_TSS) + DO_ERROR(X86_TRAP_NP, SIGBUS, "segment not present", segment_not_present) +-#ifdef CONFIG_X86_32 + DO_ERROR(X86_TRAP_SS, SIGBUS, "stack segment", stack_segment) +-#endif + DO_ERROR_INFO(X86_TRAP_AC, SIGBUS, "alignment check", alignment_check, + BUS_ADRALN, 0) + + #ifdef CONFIG_X86_64 + /* Runs on IST stack */ +-dotraplinkage void do_stack_segment(struct pt_regs *regs, long error_code) +-{ +- if (notify_die(DIE_TRAP, "stack segment", regs, error_code, +- X86_TRAP_SS, SIGBUS) == NOTIFY_STOP) +- return; +- preempt_conditional_sti(regs); +- do_trap(X86_TRAP_SS, SIGBUS, "stack segment", regs, error_code, NULL); +- preempt_conditional_cli(regs); +-} +- + dotraplinkage void do_double_fault(struct pt_regs *regs, long error_code) + { + static const char str[] = "double fault"; + struct task_struct *tsk = current; + ++#ifdef CONFIG_X86_ESPFIX64 ++ extern unsigned char native_irq_return_iret[]; ++ ++ /* ++ * If IRET takes a non-IST fault on the espfix64 stack, then we ++ * end up promoting it to a doublefault. In that case, modify ++ * the stack to make it look like we just entered the #GP ++ * handler from user space, similar to bad_iret. ++ */ ++ if (((long)regs->sp >> PGDIR_SHIFT) == ESPFIX_PGD_ENTRY && ++ regs->cs == __KERNEL_CS && ++ regs->ip == (unsigned long)native_irq_return_iret) ++ { ++ struct pt_regs *normal_regs = task_pt_regs(current); ++ ++ /* Fake a #GP(0) from userspace. */ ++ memmove(&normal_regs->ip, (void *)regs->sp, 5*8); ++ normal_regs->orig_ax = 0; /* Missing (lost) #GP error code */ ++ regs->ip = (unsigned long)general_protection; ++ regs->sp = (unsigned long)&normal_regs->orig_ax; ++ return; ++ } ++#endif ++ + /* Return not checked because double check cannot be ignored */ + notify_die(DIE_TRAP, str, regs, error_code, X86_TRAP_DF, SIGSEGV); + +@@ -332,7 +344,7 @@ dotraplinkage void __kprobes do_int3(struct pt_regs *regs, long error_code) + * for scheduling or signal handling. The actual stack switch is done in + * entry.S + */ +-asmlinkage __kprobes struct pt_regs *sync_regs(struct pt_regs *eregs) ++asmlinkage notrace __kprobes struct pt_regs *sync_regs(struct pt_regs *eregs) + { + struct pt_regs *regs = eregs; + /* Did already sync */ +@@ -351,6 +363,35 @@ asmlinkage __kprobes struct pt_regs *sync_regs(struct pt_regs *eregs) + *regs = *eregs; + return regs; + } ++ ++struct bad_iret_stack { ++ void *error_entry_ret; ++ struct pt_regs regs; ++}; ++ ++asmlinkage notrace __kprobes ++struct bad_iret_stack *fixup_bad_iret(struct bad_iret_stack *s) ++{ ++ /* ++ * This is called from entry_64.S early in handling a fault ++ * caused by a bad iret to user mode. To handle the fault ++ * correctly, we want move our stack frame to task_pt_regs ++ * and we want to pretend that the exception came from the ++ * iret target. ++ */ ++ struct bad_iret_stack *new_stack = ++ container_of(task_pt_regs(current), ++ struct bad_iret_stack, regs); ++ ++ /* Copy the IRET target to the new stack. */ ++ memmove(&new_stack->regs.ip, (void *)s->regs.sp, 5*8); ++ ++ /* Copy the remainder of the stack from the current stack. */ ++ memmove(new_stack, s, offsetof(struct bad_iret_stack, regs.ip)); ++ ++ BUG_ON(!user_mode_vm(&new_stack->regs)); ++ return new_stack; ++} + #endif + + /* +@@ -694,7 +735,7 @@ void __init trap_init(void) + set_intr_gate(X86_TRAP_OLD_MF, &coprocessor_segment_overrun); + set_intr_gate(X86_TRAP_TS, &invalid_TSS); + set_intr_gate(X86_TRAP_NP, &segment_not_present); +- set_intr_gate_ist(X86_TRAP_SS, &stack_segment, STACKFAULT_STACK); ++ set_intr_gate(X86_TRAP_SS, stack_segment); + set_intr_gate(X86_TRAP_GP, &general_protection); + set_intr_gate(X86_TRAP_SPURIOUS, &spurious_interrupt_bug); + set_intr_gate(X86_TRAP_MF, &coprocessor_error); +diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c +index fc0a147e3727..8652aa408ae0 100644 +--- a/arch/x86/kernel/tsc.c ++++ b/arch/x86/kernel/tsc.c +@@ -959,14 +959,17 @@ void __init tsc_init(void) + + x86_init.timers.tsc_pre_init(); + +- if (!cpu_has_tsc) ++ if (!cpu_has_tsc) { ++ setup_clear_cpu_cap(X86_FEATURE_TSC_DEADLINE_TIMER); + return; ++ } + + tsc_khz = x86_platform.calibrate_tsc(); + cpu_khz = tsc_khz; + + if (!tsc_khz) { + mark_tsc_unstable("could not calculate TSC khz"); ++ setup_clear_cpu_cap(X86_FEATURE_TSC_DEADLINE_TIMER); + return; + } + +diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c +index 83756223f8aa..91e8680ec239 100644 +--- a/arch/x86/kvm/emulate.c ++++ b/arch/x86/kvm/emulate.c +@@ -459,11 +459,6 @@ register_address_increment(struct x86_emulate_ctxt *ctxt, unsigned long *reg, in + *reg = (*reg & ~ad_mask(ctxt)) | ((*reg + inc) & ad_mask(ctxt)); + } + +-static inline void jmp_rel(struct x86_emulate_ctxt *ctxt, int rel) +-{ +- register_address_increment(ctxt, &ctxt->_eip, rel); +-} +- + static u32 desc_limit_scaled(struct desc_struct *desc) + { + u32 limit = get_desc_limit(desc); +@@ -537,6 +532,40 @@ static int emulate_nm(struct x86_emulate_ctxt *ctxt) + return emulate_exception(ctxt, NM_VECTOR, 0, false); + } + ++static inline int assign_eip_far(struct x86_emulate_ctxt *ctxt, ulong dst, ++ int cs_l) ++{ ++ switch (ctxt->op_bytes) { ++ case 2: ++ ctxt->_eip = (u16)dst; ++ break; ++ case 4: ++ ctxt->_eip = (u32)dst; ++ break; ++#ifdef CONFIG_X86_64 ++ case 8: ++ if ((cs_l && is_noncanonical_address(dst)) || ++ (!cs_l && (dst >> 32) != 0)) ++ return emulate_gp(ctxt, 0); ++ ctxt->_eip = dst; ++ break; ++#endif ++ default: ++ WARN(1, "unsupported eip assignment size\n"); ++ } ++ return X86EMUL_CONTINUE; ++} ++ ++static inline int assign_eip_near(struct x86_emulate_ctxt *ctxt, ulong dst) ++{ ++ return assign_eip_far(ctxt, dst, ctxt->mode == X86EMUL_MODE_PROT64); ++} ++ ++static inline int jmp_rel(struct x86_emulate_ctxt *ctxt, int rel) ++{ ++ return assign_eip_near(ctxt, ctxt->_eip + rel); ++} ++ + static u16 get_segment_selector(struct x86_emulate_ctxt *ctxt, unsigned seg) + { + u16 selector; +@@ -1224,11 +1253,13 @@ static int write_segment_descriptor(struct x86_emulate_ctxt *ctxt, + } + + /* Does not support long mode */ +-static int load_segment_descriptor(struct x86_emulate_ctxt *ctxt, +- u16 selector, int seg) ++static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt, ++ u16 selector, int seg, u8 cpl, ++ bool in_task_switch, ++ struct desc_struct *desc) + { + struct desc_struct seg_desc; +- u8 dpl, rpl, cpl; ++ u8 dpl, rpl; + unsigned err_vec = GP_VECTOR; + u32 err_code = 0; + bool null_selector = !(selector & ~0x3); /* 0000-0003 are null */ +@@ -1279,7 +1310,6 @@ static int load_segment_descriptor(struct x86_emulate_ctxt *ctxt, + + rpl = selector & 3; + dpl = seg_desc.dpl; +- cpl = ctxt->ops->cpl(ctxt); + + switch (seg) { + case VCPU_SREG_SS: +@@ -1336,12 +1366,21 @@ static int load_segment_descriptor(struct x86_emulate_ctxt *ctxt, + } + load: + ctxt->ops->set_segment(ctxt, selector, &seg_desc, 0, seg); ++ if (desc) ++ *desc = seg_desc; + return X86EMUL_CONTINUE; + exception: + emulate_exception(ctxt, err_vec, err_code, true); + return X86EMUL_PROPAGATE_FAULT; + } + ++static int load_segment_descriptor(struct x86_emulate_ctxt *ctxt, ++ u16 selector, int seg) ++{ ++ u8 cpl = ctxt->ops->cpl(ctxt); ++ return __load_segment_descriptor(ctxt, selector, seg, cpl, false, NULL); ++} ++ + static void write_register_operand(struct operand *op) + { + /* The 4-byte case *is* correct: in 64-bit mode we zero-extend. */ +@@ -1681,17 +1720,31 @@ static int em_iret(struct x86_emulate_ctxt *ctxt) + static int em_jmp_far(struct x86_emulate_ctxt *ctxt) + { + int rc; +- unsigned short sel; ++ unsigned short sel, old_sel; ++ struct desc_struct old_desc, new_desc; ++ const struct x86_emulate_ops *ops = ctxt->ops; ++ u8 cpl = ctxt->ops->cpl(ctxt); ++ ++ /* Assignment of RIP may only fail in 64-bit mode */ ++ if (ctxt->mode == X86EMUL_MODE_PROT64) ++ ops->get_segment(ctxt, &old_sel, &old_desc, NULL, ++ VCPU_SREG_CS); + + memcpy(&sel, ctxt->src.valptr + ctxt->op_bytes, 2); + +- rc = load_segment_descriptor(ctxt, sel, VCPU_SREG_CS); ++ rc = __load_segment_descriptor(ctxt, sel, VCPU_SREG_CS, cpl, false, ++ &new_desc); + if (rc != X86EMUL_CONTINUE) + return rc; + +- ctxt->_eip = 0; +- memcpy(&ctxt->_eip, ctxt->src.valptr, ctxt->op_bytes); +- return X86EMUL_CONTINUE; ++ rc = assign_eip_far(ctxt, ctxt->src.val, new_desc.l); ++ if (rc != X86EMUL_CONTINUE) { ++ WARN_ON(ctxt->mode != X86EMUL_MODE_PROT64); ++ /* assigning eip failed; restore the old cs */ ++ ops->set_segment(ctxt, old_sel, &old_desc, 0, VCPU_SREG_CS); ++ return rc; ++ } ++ return rc; + } + + static int em_grp2(struct x86_emulate_ctxt *ctxt) +@@ -1785,13 +1838,15 @@ static int em_grp45(struct x86_emulate_ctxt *ctxt) + case 2: /* call near abs */ { + long int old_eip; + old_eip = ctxt->_eip; +- ctxt->_eip = ctxt->src.val; ++ rc = assign_eip_near(ctxt, ctxt->src.val); ++ if (rc != X86EMUL_CONTINUE) ++ break; + ctxt->src.val = old_eip; + rc = em_push(ctxt); + break; + } + case 4: /* jmp abs */ +- ctxt->_eip = ctxt->src.val; ++ rc = assign_eip_near(ctxt, ctxt->src.val); + break; + case 5: /* jmp far */ + rc = em_jmp_far(ctxt); +@@ -1823,26 +1878,43 @@ static int em_cmpxchg8b(struct x86_emulate_ctxt *ctxt) + + static int em_ret(struct x86_emulate_ctxt *ctxt) + { +- ctxt->dst.type = OP_REG; +- ctxt->dst.addr.reg = &ctxt->_eip; +- ctxt->dst.bytes = ctxt->op_bytes; +- return em_pop(ctxt); ++ int rc; ++ unsigned long eip; ++ ++ rc = emulate_pop(ctxt, &eip, ctxt->op_bytes); ++ if (rc != X86EMUL_CONTINUE) ++ return rc; ++ ++ return assign_eip_near(ctxt, eip); + } + + static int em_ret_far(struct x86_emulate_ctxt *ctxt) + { + int rc; +- unsigned long cs; ++ unsigned long eip, cs; ++ u16 old_cs; ++ struct desc_struct old_desc, new_desc; ++ const struct x86_emulate_ops *ops = ctxt->ops; ++ ++ if (ctxt->mode == X86EMUL_MODE_PROT64) ++ ops->get_segment(ctxt, &old_cs, &old_desc, NULL, ++ VCPU_SREG_CS); + +- rc = emulate_pop(ctxt, &ctxt->_eip, ctxt->op_bytes); ++ rc = emulate_pop(ctxt, &eip, ctxt->op_bytes); + if (rc != X86EMUL_CONTINUE) + return rc; +- if (ctxt->op_bytes == 4) +- ctxt->_eip = (u32)ctxt->_eip; + rc = emulate_pop(ctxt, &cs, ctxt->op_bytes); + if (rc != X86EMUL_CONTINUE) + return rc; +- rc = load_segment_descriptor(ctxt, (u16)cs, VCPU_SREG_CS); ++ rc = __load_segment_descriptor(ctxt, (u16)cs, VCPU_SREG_CS, 0, false, ++ &new_desc); ++ if (rc != X86EMUL_CONTINUE) ++ return rc; ++ rc = assign_eip_far(ctxt, eip, new_desc.l); ++ if (rc != X86EMUL_CONTINUE) { ++ WARN_ON(ctxt->mode != X86EMUL_MODE_PROT64); ++ ops->set_segment(ctxt, old_cs, &old_desc, 0, VCPU_SREG_CS); ++ } + return rc; + } + +@@ -2091,7 +2163,7 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt) + { + struct x86_emulate_ops *ops = ctxt->ops; + struct desc_struct cs, ss; +- u64 msr_data; ++ u64 msr_data, rcx, rdx; + int usermode; + u16 cs_sel = 0, ss_sel = 0; + +@@ -2107,6 +2179,9 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt) + else + usermode = X86EMUL_MODE_PROT32; + ++ rcx = ctxt->regs[VCPU_REGS_RCX]; ++ rdx = ctxt->regs[VCPU_REGS_RDX]; ++ + cs.dpl = 3; + ss.dpl = 3; + ops->get_msr(ctxt, MSR_IA32_SYSENTER_CS, &msr_data); +@@ -2124,6 +2199,9 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt) + ss_sel = cs_sel + 8; + cs.d = 0; + cs.l = 1; ++ if (is_noncanonical_address(rcx) || ++ is_noncanonical_address(rdx)) ++ return emulate_gp(ctxt, 0); + break; + } + cs_sel |= SELECTOR_RPL_MASK; +@@ -2132,8 +2210,8 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt) + ops->set_segment(ctxt, cs_sel, &cs, 0, VCPU_SREG_CS); + ops->set_segment(ctxt, ss_sel, &ss, 0, VCPU_SREG_SS); + +- ctxt->_eip = ctxt->regs[VCPU_REGS_RDX]; +- ctxt->regs[VCPU_REGS_RSP] = ctxt->regs[VCPU_REGS_RCX]; ++ ctxt->_eip = rdx; ++ ctxt->regs[VCPU_REGS_RSP] = rcx; + + return X86EMUL_CONTINUE; + } +@@ -2222,6 +2300,7 @@ static int load_state_from_tss16(struct x86_emulate_ctxt *ctxt, + struct tss_segment_16 *tss) + { + int ret; ++ u8 cpl; + + ctxt->_eip = tss->ip; + ctxt->eflags = tss->flag | 2; +@@ -2244,23 +2323,30 @@ static int load_state_from_tss16(struct x86_emulate_ctxt *ctxt, + set_segment_selector(ctxt, tss->ss, VCPU_SREG_SS); + set_segment_selector(ctxt, tss->ds, VCPU_SREG_DS); + ++ cpl = tss->cs & 3; ++ + /* + * Now load segment descriptors. If fault happenes at this stage + * it is handled in a context of new task + */ +- ret = load_segment_descriptor(ctxt, tss->ldt, VCPU_SREG_LDTR); ++ ret = __load_segment_descriptor(ctxt, tss->ldt, VCPU_SREG_LDTR, cpl, ++ true, NULL); + if (ret != X86EMUL_CONTINUE) + return ret; +- ret = load_segment_descriptor(ctxt, tss->es, VCPU_SREG_ES); ++ ret = __load_segment_descriptor(ctxt, tss->es, VCPU_SREG_ES, cpl, ++ true, NULL); + if (ret != X86EMUL_CONTINUE) + return ret; +- ret = load_segment_descriptor(ctxt, tss->cs, VCPU_SREG_CS); ++ ret = __load_segment_descriptor(ctxt, tss->cs, VCPU_SREG_CS, cpl, ++ true, NULL); + if (ret != X86EMUL_CONTINUE) + return ret; +- ret = load_segment_descriptor(ctxt, tss->ss, VCPU_SREG_SS); ++ ret = __load_segment_descriptor(ctxt, tss->ss, VCPU_SREG_SS, cpl, ++ true, NULL); + if (ret != X86EMUL_CONTINUE) + return ret; +- ret = load_segment_descriptor(ctxt, tss->ds, VCPU_SREG_DS); ++ ret = __load_segment_descriptor(ctxt, tss->ds, VCPU_SREG_DS, cpl, ++ true, NULL); + if (ret != X86EMUL_CONTINUE) + return ret; + +@@ -2339,6 +2425,7 @@ static int load_state_from_tss32(struct x86_emulate_ctxt *ctxt, + struct tss_segment_32 *tss) + { + int ret; ++ u8 cpl; + + if (ctxt->ops->set_cr(ctxt, 3, tss->cr3)) + return emulate_gp(ctxt, 0); +@@ -2357,7 +2444,8 @@ static int load_state_from_tss32(struct x86_emulate_ctxt *ctxt, + + /* + * SDM says that segment selectors are loaded before segment +- * descriptors ++ * descriptors. This is important because CPL checks will ++ * use CS.RPL. + */ + set_segment_selector(ctxt, tss->ldt_selector, VCPU_SREG_LDTR); + set_segment_selector(ctxt, tss->es, VCPU_SREG_ES); +@@ -2371,43 +2459,45 @@ static int load_state_from_tss32(struct x86_emulate_ctxt *ctxt, + * If we're switching between Protected Mode and VM86, we need to make + * sure to update the mode before loading the segment descriptors so + * that the selectors are interpreted correctly. +- * +- * Need to get rflags to the vcpu struct immediately because it +- * influences the CPL which is checked at least when loading the segment +- * descriptors and when pushing an error code to the new kernel stack. +- * +- * TODO Introduce a separate ctxt->ops->set_cpl callback + */ +- if (ctxt->eflags & X86_EFLAGS_VM) ++ if (ctxt->eflags & X86_EFLAGS_VM) { + ctxt->mode = X86EMUL_MODE_VM86; +- else ++ cpl = 3; ++ } else { + ctxt->mode = X86EMUL_MODE_PROT32; +- +- ctxt->ops->set_rflags(ctxt, ctxt->eflags); ++ cpl = tss->cs & 3; ++ } + + /* + * Now load segment descriptors. If fault happenes at this stage + * it is handled in a context of new task + */ +- ret = load_segment_descriptor(ctxt, tss->ldt_selector, VCPU_SREG_LDTR); ++ ret = __load_segment_descriptor(ctxt, tss->ldt_selector, VCPU_SREG_LDTR, ++ cpl, true, NULL); + if (ret != X86EMUL_CONTINUE) + return ret; +- ret = load_segment_descriptor(ctxt, tss->es, VCPU_SREG_ES); ++ ret = __load_segment_descriptor(ctxt, tss->es, VCPU_SREG_ES, cpl, ++ true, NULL); + if (ret != X86EMUL_CONTINUE) + return ret; +- ret = load_segment_descriptor(ctxt, tss->cs, VCPU_SREG_CS); ++ ret = __load_segment_descriptor(ctxt, tss->cs, VCPU_SREG_CS, cpl, ++ true, NULL); + if (ret != X86EMUL_CONTINUE) + return ret; +- ret = load_segment_descriptor(ctxt, tss->ss, VCPU_SREG_SS); ++ ret = __load_segment_descriptor(ctxt, tss->ss, VCPU_SREG_SS, cpl, ++ true, NULL); + if (ret != X86EMUL_CONTINUE) + return ret; +- ret = load_segment_descriptor(ctxt, tss->ds, VCPU_SREG_DS); ++ ret = __load_segment_descriptor(ctxt, tss->ds, VCPU_SREG_DS, cpl, ++ true, NULL); + if (ret != X86EMUL_CONTINUE) + return ret; +- ret = load_segment_descriptor(ctxt, tss->fs, VCPU_SREG_FS); ++ ret = __load_segment_descriptor(ctxt, tss->fs, VCPU_SREG_FS, cpl, ++ true, NULL); + if (ret != X86EMUL_CONTINUE) + return ret; +- ret = load_segment_descriptor(ctxt, tss->gs, VCPU_SREG_GS); ++ ret = __load_segment_descriptor(ctxt, tss->gs, VCPU_SREG_GS, cpl, ++ true, NULL); + if (ret != X86EMUL_CONTINUE) + return ret; + +@@ -2629,10 +2719,13 @@ static int em_das(struct x86_emulate_ctxt *ctxt) + + static int em_call(struct x86_emulate_ctxt *ctxt) + { ++ int rc; + long rel = ctxt->src.val; + + ctxt->src.val = (unsigned long)ctxt->_eip; +- jmp_rel(ctxt, rel); ++ rc = jmp_rel(ctxt, rel); ++ if (rc != X86EMUL_CONTINUE) ++ return rc; + return em_push(ctxt); + } + +@@ -2641,34 +2734,50 @@ static int em_call_far(struct x86_emulate_ctxt *ctxt) + u16 sel, old_cs; + ulong old_eip; + int rc; ++ struct desc_struct old_desc, new_desc; ++ const struct x86_emulate_ops *ops = ctxt->ops; ++ int cpl = ctxt->ops->cpl(ctxt); + +- old_cs = get_segment_selector(ctxt, VCPU_SREG_CS); + old_eip = ctxt->_eip; ++ ops->get_segment(ctxt, &old_cs, &old_desc, NULL, VCPU_SREG_CS); + + memcpy(&sel, ctxt->src.valptr + ctxt->op_bytes, 2); +- if (load_segment_descriptor(ctxt, sel, VCPU_SREG_CS)) ++ rc = __load_segment_descriptor(ctxt, sel, VCPU_SREG_CS, cpl, false, ++ &new_desc); ++ if (rc != X86EMUL_CONTINUE) + return X86EMUL_CONTINUE; + +- ctxt->_eip = 0; +- memcpy(&ctxt->_eip, ctxt->src.valptr, ctxt->op_bytes); ++ rc = assign_eip_far(ctxt, ctxt->src.val, new_desc.l); ++ if (rc != X86EMUL_CONTINUE) ++ goto fail; + + ctxt->src.val = old_cs; + rc = em_push(ctxt); + if (rc != X86EMUL_CONTINUE) +- return rc; ++ goto fail; + + ctxt->src.val = old_eip; +- return em_push(ctxt); ++ rc = em_push(ctxt); ++ /* If we failed, we tainted the memory, but the very least we should ++ restore cs */ ++ if (rc != X86EMUL_CONTINUE) ++ goto fail; ++ return rc; ++fail: ++ ops->set_segment(ctxt, old_cs, &old_desc, 0, VCPU_SREG_CS); ++ return rc; ++ + } + + static int em_ret_near_imm(struct x86_emulate_ctxt *ctxt) + { + int rc; ++ unsigned long eip; + +- ctxt->dst.type = OP_REG; +- ctxt->dst.addr.reg = &ctxt->_eip; +- ctxt->dst.bytes = ctxt->op_bytes; +- rc = emulate_pop(ctxt, &ctxt->dst.val, ctxt->op_bytes); ++ rc = emulate_pop(ctxt, &eip, ctxt->op_bytes); ++ if (rc != X86EMUL_CONTINUE) ++ return rc; ++ rc = assign_eip_near(ctxt, eip); + if (rc != X86EMUL_CONTINUE) + return rc; + register_address_increment(ctxt, &ctxt->regs[VCPU_REGS_RSP], ctxt->src.val); +@@ -2977,20 +3086,24 @@ static int em_lmsw(struct x86_emulate_ctxt *ctxt) + + static int em_loop(struct x86_emulate_ctxt *ctxt) + { ++ int rc = X86EMUL_CONTINUE; ++ + register_address_increment(ctxt, &ctxt->regs[VCPU_REGS_RCX], -1); + if ((address_mask(ctxt, ctxt->regs[VCPU_REGS_RCX]) != 0) && + (ctxt->b == 0xe2 || test_cc(ctxt->b ^ 0x5, ctxt->eflags))) +- jmp_rel(ctxt, ctxt->src.val); ++ rc = jmp_rel(ctxt, ctxt->src.val); + +- return X86EMUL_CONTINUE; ++ return rc; + } + + static int em_jcxz(struct x86_emulate_ctxt *ctxt) + { ++ int rc = X86EMUL_CONTINUE; ++ + if (address_mask(ctxt, ctxt->regs[VCPU_REGS_RCX]) == 0) +- jmp_rel(ctxt, ctxt->src.val); ++ rc = jmp_rel(ctxt, ctxt->src.val); + +- return X86EMUL_CONTINUE; ++ return rc; + } + + static int em_in(struct x86_emulate_ctxt *ctxt) +@@ -4168,7 +4281,7 @@ special_insn: + break; + case 0x70 ... 0x7f: /* jcc (short) */ + if (test_cc(ctxt->b, ctxt->eflags)) +- jmp_rel(ctxt, ctxt->src.val); ++ rc = jmp_rel(ctxt, ctxt->src.val); + break; + case 0x8d: /* lea r16/r32, m */ + ctxt->dst.val = ctxt->src.addr.mem.ea; +@@ -4207,7 +4320,7 @@ special_insn: + break; + case 0xe9: /* jmp rel */ + case 0xeb: /* jmp rel short */ +- jmp_rel(ctxt, ctxt->src.val); ++ rc = jmp_rel(ctxt, ctxt->src.val); + ctxt->dst.type = OP_NONE; /* Disable writeback. */ + break; + case 0xf4: /* hlt */ +@@ -4310,7 +4423,7 @@ twobyte_insn: + break; + case 0x80 ... 0x8f: /* jnz rel, etc*/ + if (test_cc(ctxt->b, ctxt->eflags)) +- jmp_rel(ctxt, ctxt->src.val); ++ rc = jmp_rel(ctxt, ctxt->src.val); + break; + case 0x90 ... 0x9f: /* setcc r/m8 */ + ctxt->dst.val = test_cc(ctxt->b, ctxt->eflags); +diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c +index d68f99df690c..db336f9f2c8c 100644 +--- a/arch/x86/kvm/i8254.c ++++ b/arch/x86/kvm/i8254.c +@@ -263,8 +263,10 @@ void __kvm_migrate_pit_timer(struct kvm_vcpu *vcpu) + return; + + timer = &pit->pit_state.pit_timer.timer; ++ mutex_lock(&pit->pit_state.lock); + if (hrtimer_cancel(timer)) + hrtimer_start_expires(timer, HRTIMER_MODE_ABS); ++ mutex_unlock(&pit->pit_state.lock); + } + + static void destroy_pit_timer(struct kvm_pit *pit) +diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c +index fd6dec6ffa47..84f4bca0ca2c 100644 +--- a/arch/x86/kvm/mmu.c ++++ b/arch/x86/kvm/mmu.c +@@ -2842,7 +2842,7 @@ static void mmu_sync_roots(struct kvm_vcpu *vcpu) + if (!VALID_PAGE(vcpu->arch.mmu.root_hpa)) + return; + +- vcpu_clear_mmio_info(vcpu, ~0ul); ++ vcpu_clear_mmio_info(vcpu, MMIO_GVA_ANY); + kvm_mmu_audit(vcpu, AUDIT_PRE_SYNC); + if (vcpu->arch.mmu.root_level == PT64_ROOT_LEVEL) { + hpa_t root = vcpu->arch.mmu.root_hpa; +diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c +index b567285efceb..86c74c0cd876 100644 +--- a/arch/x86/kvm/svm.c ++++ b/arch/x86/kvm/svm.c +@@ -3212,7 +3212,7 @@ static int wrmsr_interception(struct vcpu_svm *svm) + + + svm->next_rip = kvm_rip_read(&svm->vcpu) + 2; +- if (svm_set_msr(&svm->vcpu, ecx, data)) { ++ if (kvm_set_msr(&svm->vcpu, ecx, data)) { + trace_kvm_msr_write_ex(ecx, data); + kvm_inject_gp(&svm->vcpu, 0); + } else { +@@ -3494,9 +3494,9 @@ static int handle_exit(struct kvm_vcpu *vcpu) + + if (exit_code >= ARRAY_SIZE(svm_exit_handlers) + || !svm_exit_handlers[exit_code]) { +- kvm_run->exit_reason = KVM_EXIT_UNKNOWN; +- kvm_run->hw.hardware_exit_reason = exit_code; +- return 0; ++ WARN_ONCE(1, "vmx: unexpected exit reason 0x%x\n", exit_code); ++ kvm_queue_exception(vcpu, UD_VECTOR); ++ return 1; + } + + return svm_exit_handlers[exit_code](svm); +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index 617b00b4857b..2eb4e5af8816 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -388,6 +388,7 @@ struct vcpu_vmx { + u16 fs_sel, gs_sel, ldt_sel; + int gs_ldt_reload_needed; + int fs_reload_needed; ++ unsigned long vmcs_host_cr4; /* May not match real cr4 */ + } host_state; + struct { + int vm86_active; +@@ -2209,12 +2210,15 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, u32 msr_index, u64 data) + break; + msr = find_msr_entry(vmx, msr_index); + if (msr) { ++ u64 old_msr_data = msr->data; + msr->data = data; + if (msr - vmx->guest_msrs < vmx->save_nmsrs) { + preempt_disable(); +- kvm_set_shared_msr(msr->index, msr->data, +- msr->mask); ++ ret = kvm_set_shared_msr(msr->index, msr->data, ++ msr->mask); + preempt_enable(); ++ if (ret) ++ msr->data = old_msr_data; + } + break; + } +@@ -3622,16 +3626,21 @@ static void vmx_disable_intercept_for_msr(u32 msr, bool longmode_only) + * Note that host-state that does change is set elsewhere. E.g., host-state + * that is set differently for each CPU is set in vmx_vcpu_load(), not here. + */ +-static void vmx_set_constant_host_state(void) ++static void vmx_set_constant_host_state(struct vcpu_vmx *vmx) + { + u32 low32, high32; + unsigned long tmpl; + struct desc_ptr dt; ++ unsigned long cr4; + + vmcs_writel(HOST_CR0, read_cr0() | X86_CR0_TS); /* 22.2.3 */ +- vmcs_writel(HOST_CR4, read_cr4()); /* 22.2.3, 22.2.5 */ + vmcs_writel(HOST_CR3, read_cr3()); /* 22.2.3 FIXME: shadow tables */ + ++ /* Save the most likely value for this task's CR4 in the VMCS. */ ++ cr4 = read_cr4(); ++ vmcs_writel(HOST_CR4, cr4); /* 22.2.3, 22.2.5 */ ++ vmx->host_state.vmcs_host_cr4 = cr4; ++ + vmcs_write16(HOST_CS_SELECTOR, __KERNEL_CS); /* 22.2.4 */ + vmcs_write16(HOST_DS_SELECTOR, __KERNEL_DS); /* 22.2.4 */ + vmcs_write16(HOST_ES_SELECTOR, __KERNEL_DS); /* 22.2.4 */ +@@ -3753,7 +3762,7 @@ static int vmx_vcpu_setup(struct vcpu_vmx *vmx) + + vmcs_write16(HOST_FS_SELECTOR, 0); /* 22.2.4 */ + vmcs_write16(HOST_GS_SELECTOR, 0); /* 22.2.4 */ +- vmx_set_constant_host_state(); ++ vmx_set_constant_host_state(vmx); + #ifdef CONFIG_X86_64 + rdmsrl(MSR_FS_BASE, a); + vmcs_writel(HOST_FS_BASE, a); /* 22.2.4 */ +@@ -4539,7 +4548,7 @@ static int handle_wrmsr(struct kvm_vcpu *vcpu) + u64 data = (vcpu->arch.regs[VCPU_REGS_RAX] & -1u) + | ((u64)(vcpu->arch.regs[VCPU_REGS_RDX] & -1u) << 32); + +- if (vmx_set_msr(vcpu, ecx, data) != 0) { ++ if (kvm_set_msr(vcpu, ecx, data) != 0) { + trace_kvm_msr_write_ex(ecx, data); + kvm_inject_gp(vcpu, 0); + return 1; +@@ -5557,6 +5566,18 @@ static int handle_vmptrst(struct kvm_vcpu *vcpu) + return 1; + } + ++static int handle_invept(struct kvm_vcpu *vcpu) ++{ ++ kvm_queue_exception(vcpu, UD_VECTOR); ++ return 1; ++} ++ ++static int handle_invvpid(struct kvm_vcpu *vcpu) ++{ ++ kvm_queue_exception(vcpu, UD_VECTOR); ++ return 1; ++} ++ + /* + * The exit handlers return 1 if the exit was handled fully and guest execution + * may resume. Otherwise they set the kvm_run parameter to indicate what needs +@@ -5599,6 +5620,8 @@ static int (*kvm_vmx_exit_handlers[])(struct kvm_vcpu *vcpu) = { + [EXIT_REASON_PAUSE_INSTRUCTION] = handle_pause, + [EXIT_REASON_MWAIT_INSTRUCTION] = handle_invalid_op, + [EXIT_REASON_MONITOR_INSTRUCTION] = handle_invalid_op, ++ [EXIT_REASON_INVEPT] = handle_invept, ++ [EXIT_REASON_INVVPID] = handle_invvpid, + }; + + static const int kvm_vmx_max_exit_handlers = +@@ -5783,6 +5806,7 @@ static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu) + case EXIT_REASON_VMPTRST: case EXIT_REASON_VMREAD: + case EXIT_REASON_VMRESUME: case EXIT_REASON_VMWRITE: + case EXIT_REASON_VMOFF: case EXIT_REASON_VMON: ++ case EXIT_REASON_INVEPT: case EXIT_REASON_INVVPID: + /* + * VMX instructions trap unconditionally. This allows L1 to + * emulate them for its L2 guest, i.e., allows 3-level nesting! +@@ -5912,10 +5936,10 @@ static int vmx_handle_exit(struct kvm_vcpu *vcpu) + && kvm_vmx_exit_handlers[exit_reason]) + return kvm_vmx_exit_handlers[exit_reason](vcpu); + else { +- vcpu->run->exit_reason = KVM_EXIT_UNKNOWN; +- vcpu->run->hw.hardware_exit_reason = exit_reason; ++ WARN_ONCE(1, "vmx: unexpected exit reason 0x%x\n", exit_reason); ++ kvm_queue_exception(vcpu, UD_VECTOR); ++ return 1; + } +- return 0; + } + + static void update_cr8_intercept(struct kvm_vcpu *vcpu, int tpr, int irr) +@@ -6101,6 +6125,7 @@ static void atomic_switch_perf_msrs(struct vcpu_vmx *vmx) + static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu) + { + struct vcpu_vmx *vmx = to_vmx(vcpu); ++ unsigned long cr4; + + if (is_guest_mode(vcpu) && !vmx->nested.nested_run_pending) { + struct vmcs12 *vmcs12 = get_vmcs12(vcpu); +@@ -6131,6 +6156,12 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu) + if (test_bit(VCPU_REGS_RIP, (unsigned long *)&vcpu->arch.regs_dirty)) + vmcs_writel(GUEST_RIP, vcpu->arch.regs[VCPU_REGS_RIP]); + ++ cr4 = read_cr4(); ++ if (unlikely(cr4 != vmx->host_state.vmcs_host_cr4)) { ++ vmcs_writel(HOST_CR4, cr4); ++ vmx->host_state.vmcs_host_cr4 = cr4; ++ } ++ + /* When single-stepping over STI and MOV SS, we must clear the + * corresponding interruptibility bits in the guest state. Otherwise + * vmentry fails as it then expects bit 14 (BS) in pending debug +@@ -6589,7 +6620,7 @@ static void prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12) + * Other fields are different per CPU, and will be set later when + * vmx_vcpu_load() is called, and when vmx_save_host_state() is called. + */ +- vmx_set_constant_host_state(); ++ vmx_set_constant_host_state(vmx); + + /* + * HOST_RSP is normally set correctly in vmx_vcpu_run() just before +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 4b1be290f6e3..318a2454366f 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -220,19 +220,24 @@ static void kvm_shared_msr_cpu_online(void) + shared_msr_update(i, shared_msrs_global.msrs[i]); + } + +-void kvm_set_shared_msr(unsigned slot, u64 value, u64 mask) ++int kvm_set_shared_msr(unsigned slot, u64 value, u64 mask) + { + struct kvm_shared_msrs *smsr = &__get_cpu_var(shared_msrs); ++ int err; + + if (((value ^ smsr->values[slot].curr) & mask) == 0) +- return; ++ return 0; + smsr->values[slot].curr = value; +- wrmsrl(shared_msrs_global.msrs[slot], value); ++ err = checking_wrmsrl(shared_msrs_global.msrs[slot], value); ++ if (err) ++ return 1; ++ + if (!smsr->registered) { + smsr->urn.on_user_return = kvm_on_user_return; + user_return_notifier_register(&smsr->urn); + smsr->registered = true; + } ++ return 0; + } + EXPORT_SYMBOL_GPL(kvm_set_shared_msr); + +@@ -858,7 +863,6 @@ void kvm_enable_efer_bits(u64 mask) + } + EXPORT_SYMBOL_GPL(kvm_enable_efer_bits); + +- + /* + * Writes msr value into into the appropriate "register". + * Returns 0 on success, non-0 otherwise. +@@ -866,8 +870,34 @@ EXPORT_SYMBOL_GPL(kvm_enable_efer_bits); + */ + int kvm_set_msr(struct kvm_vcpu *vcpu, u32 msr_index, u64 data) + { ++ switch (msr_index) { ++ case MSR_FS_BASE: ++ case MSR_GS_BASE: ++ case MSR_KERNEL_GS_BASE: ++ case MSR_CSTAR: ++ case MSR_LSTAR: ++ if (is_noncanonical_address(data)) ++ return 1; ++ break; ++ case MSR_IA32_SYSENTER_EIP: ++ case MSR_IA32_SYSENTER_ESP: ++ /* ++ * IA32_SYSENTER_ESP and IA32_SYSENTER_EIP cause #GP if ++ * non-canonical address is written on Intel but not on ++ * AMD (which ignores the top 32-bits, because it does ++ * not implement 64-bit SYSENTER). ++ * ++ * 64-bit code should hence be able to write a non-canonical ++ * value on AMD. Making the address canonical ensures that ++ * vmentry does not fail on Intel after writing a non-canonical ++ * value, and that something deterministic happens if the guest ++ * invokes 64-bit SYSENTER. ++ */ ++ data = get_canonical(data); ++ } + return kvm_x86_ops->set_msr(vcpu, msr_index, data); + } ++EXPORT_SYMBOL_GPL(kvm_set_msr); + + /* + * Adapt set_msr() to msr_io()'s calling convention +diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h +index cb80c293cdd8..1ce5611fdb09 100644 +--- a/arch/x86/kvm/x86.h ++++ b/arch/x86/kvm/x86.h +@@ -78,15 +78,23 @@ static inline void vcpu_cache_mmio_info(struct kvm_vcpu *vcpu, + vcpu->arch.mmio_gva = gva & PAGE_MASK; + vcpu->arch.access = access; + vcpu->arch.mmio_gfn = gfn; ++ vcpu->arch.mmio_gen = kvm_memslots(vcpu->kvm)->generation; ++} ++ ++static inline bool vcpu_match_mmio_gen(struct kvm_vcpu *vcpu) ++{ ++ return vcpu->arch.mmio_gen == kvm_memslots(vcpu->kvm)->generation; + } + + /* +- * Clear the mmio cache info for the given gva, +- * specially, if gva is ~0ul, we clear all mmio cache info. ++ * Clear the mmio cache info for the given gva. If gva is MMIO_GVA_ANY, we ++ * clear all mmio cache info. + */ ++#define MMIO_GVA_ANY (~(gva_t)0) ++ + static inline void vcpu_clear_mmio_info(struct kvm_vcpu *vcpu, gva_t gva) + { +- if (gva != (~0ul) && vcpu->arch.mmio_gva != (gva & PAGE_MASK)) ++ if (gva != MMIO_GVA_ANY && vcpu->arch.mmio_gva != (gva & PAGE_MASK)) + return; + + vcpu->arch.mmio_gva = 0; +@@ -94,7 +102,8 @@ static inline void vcpu_clear_mmio_info(struct kvm_vcpu *vcpu, gva_t gva) + + static inline bool vcpu_match_mmio_gva(struct kvm_vcpu *vcpu, unsigned long gva) + { +- if (vcpu->arch.mmio_gva && vcpu->arch.mmio_gva == (gva & PAGE_MASK)) ++ if (vcpu_match_mmio_gen(vcpu) && vcpu->arch.mmio_gva && ++ vcpu->arch.mmio_gva == (gva & PAGE_MASK)) + return true; + + return false; +@@ -102,7 +111,8 @@ static inline bool vcpu_match_mmio_gva(struct kvm_vcpu *vcpu, unsigned long gva) + + static inline bool vcpu_match_mmio_gpa(struct kvm_vcpu *vcpu, gpa_t gpa) + { +- if (vcpu->arch.mmio_gfn && vcpu->arch.mmio_gfn == gpa >> PAGE_SHIFT) ++ if (vcpu_match_mmio_gen(vcpu) && vcpu->arch.mmio_gfn && ++ vcpu->arch.mmio_gfn == gpa >> PAGE_SHIFT) + return true; + + return false; +diff --git a/arch/xtensa/include/asm/unistd.h b/arch/xtensa/include/asm/unistd.h +index 798ee6d285a1..7ab1f52f1fdd 100644 +--- a/arch/xtensa/include/asm/unistd.h ++++ b/arch/xtensa/include/asm/unistd.h +@@ -394,7 +394,8 @@ __SYSCALL(174, sys_chroot, 1) + #define __NR_pivot_root 175 + __SYSCALL(175, sys_pivot_root, 2) + #define __NR_umount 176 +-__SYSCALL(176, sys_umount, 2) ++__SYSCALL(176, sys_oldumount, 1) ++#define __ARCH_WANT_SYS_OLDUMOUNT + #define __NR_swapoff 177 + __SYSCALL(177, sys_swapoff, 1) + #define __NR_sync 178 +diff --git a/block/blk-settings.c b/block/blk-settings.c +index b74cc58bc038..14f1d3083cae 100644 +--- a/block/blk-settings.c ++++ b/block/blk-settings.c +@@ -538,7 +538,7 @@ int blk_stack_limits(struct queue_limits *t, struct queue_limits *b, + bottom = max(b->physical_block_size, b->io_min) + alignment; + + /* Verify that top and bottom intervals line up */ +- if (max(top, bottom) & (min(top, bottom) - 1)) { ++ if (max(top, bottom) % min(top, bottom)) { + t->misaligned = 1; + ret = -1; + } +@@ -579,7 +579,7 @@ int blk_stack_limits(struct queue_limits *t, struct queue_limits *b, + + /* Find lowest common alignment_offset */ + t->alignment_offset = lcm(t->alignment_offset, alignment) +- & (max(t->physical_block_size, t->io_min) - 1); ++ % max(t->physical_block_size, t->io_min); + + /* Verify that new alignment_offset is on a logical block boundary */ + if (t->alignment_offset & (t->logical_block_size - 1)) { +diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c +index 9a87daa6f4fb..f1c00c9aec1a 100644 +--- a/block/scsi_ioctl.c ++++ b/block/scsi_ioctl.c +@@ -505,7 +505,7 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode, + + if (bytes && blk_rq_map_kern(q, rq, buffer, bytes, __GFP_WAIT)) { + err = DRIVER_ERROR << 24; +- goto out; ++ goto error; + } + + memset(sense, 0, sizeof(sense)); +@@ -515,7 +515,6 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode, + + blk_execute_rq(q, disk, rq, 0); + +-out: + err = rq->errors & 0xff; /* only 8 bit SCSI status */ + if (err) { + if (rq->sense_len && rq->sense) { +diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c +index d366a75e6705..ca9a287b5864 100644 +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -313,6 +313,11 @@ static const struct pci_device_id ahci_pci_tbl[] = { + { PCI_VDEVICE(INTEL, 0x8c87), board_ahci }, /* 9 Series RAID */ + { PCI_VDEVICE(INTEL, 0x8c8e), board_ahci }, /* 9 Series RAID */ + { PCI_VDEVICE(INTEL, 0x8c8f), board_ahci }, /* 9 Series RAID */ ++ { PCI_VDEVICE(INTEL, 0xa103), board_ahci }, /* Sunrise Point-H AHCI */ ++ { PCI_VDEVICE(INTEL, 0xa103), board_ahci }, /* Sunrise Point-H RAID */ ++ { PCI_VDEVICE(INTEL, 0xa105), board_ahci }, /* Sunrise Point-H RAID */ ++ { PCI_VDEVICE(INTEL, 0xa107), board_ahci }, /* Sunrise Point-H RAID */ ++ { PCI_VDEVICE(INTEL, 0xa10f), board_ahci }, /* Sunrise Point-H RAID */ + + /* JMicron 360/1/3/5/6, match class to avoid IDE function */ + { PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID, +diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c +index d8af325a6bda..3723e5ec2b4d 100644 +--- a/drivers/ata/libata-sff.c ++++ b/drivers/ata/libata-sff.c +@@ -2008,13 +2008,15 @@ static int ata_bus_softreset(struct ata_port *ap, unsigned int devmask, + + DPRINTK("ata%u: bus reset via SRST\n", ap->print_id); + +- /* software reset. causes dev0 to be selected */ +- iowrite8(ap->ctl, ioaddr->ctl_addr); +- udelay(20); /* FIXME: flush */ +- iowrite8(ap->ctl | ATA_SRST, ioaddr->ctl_addr); +- udelay(20); /* FIXME: flush */ +- iowrite8(ap->ctl, ioaddr->ctl_addr); +- ap->last_ctl = ap->ctl; ++ if (ap->ioaddr.ctl_addr) { ++ /* software reset. causes dev0 to be selected */ ++ iowrite8(ap->ctl, ioaddr->ctl_addr); ++ udelay(20); /* FIXME: flush */ ++ iowrite8(ap->ctl | ATA_SRST, ioaddr->ctl_addr); ++ udelay(20); /* FIXME: flush */ ++ iowrite8(ap->ctl, ioaddr->ctl_addr); ++ ap->last_ctl = ap->ctl; ++ } + + /* wait the port to become ready */ + return ata_sff_wait_after_reset(&ap->link, devmask, deadline); +@@ -2215,10 +2217,6 @@ void ata_sff_error_handler(struct ata_port *ap) + + spin_unlock_irqrestore(ap->lock, flags); + +- /* ignore ata_sff_softreset if ctl isn't accessible */ +- if (softreset == ata_sff_softreset && !ap->ioaddr.ctl_addr) +- softreset = NULL; +- + /* ignore built-in hardresets if SCR access is not available */ + if ((hardreset == sata_std_hardreset || + hardreset == sata_sff_hardreset) && !sata_scr_valid(&ap->link)) +diff --git a/drivers/ata/pata_serverworks.c b/drivers/ata/pata_serverworks.c +index 71eaf385e970..5929dde07c91 100644 +--- a/drivers/ata/pata_serverworks.c ++++ b/drivers/ata/pata_serverworks.c +@@ -252,12 +252,18 @@ static void serverworks_set_dmamode(struct ata_port *ap, struct ata_device *adev + pci_write_config_byte(pdev, 0x54, ultra_cfg); + } + +-static struct scsi_host_template serverworks_sht = { ++static struct scsi_host_template serverworks_osb4_sht = { ++ ATA_BMDMA_SHT(DRV_NAME), ++ .sg_tablesize = LIBATA_DUMB_MAX_PRD, ++}; ++ ++static struct scsi_host_template serverworks_csb_sht = { + ATA_BMDMA_SHT(DRV_NAME), + }; + + static struct ata_port_operations serverworks_osb4_port_ops = { + .inherits = &ata_bmdma_port_ops, ++ .qc_prep = ata_bmdma_dumb_qc_prep, + .cable_detect = serverworks_cable_detect, + .mode_filter = serverworks_osb4_filter, + .set_piomode = serverworks_set_piomode, +@@ -266,6 +272,7 @@ static struct ata_port_operations serverworks_osb4_port_ops = { + + static struct ata_port_operations serverworks_csb_port_ops = { + .inherits = &serverworks_osb4_port_ops, ++ .qc_prep = ata_bmdma_qc_prep, + .mode_filter = serverworks_csb_filter, + }; + +@@ -405,6 +412,7 @@ static int serverworks_init_one(struct pci_dev *pdev, const struct pci_device_id + } + }; + const struct ata_port_info *ppi[] = { &info[id->driver_data], NULL }; ++ struct scsi_host_template *sht = &serverworks_csb_sht; + int rc; + + rc = pcim_enable_device(pdev); +@@ -418,6 +426,7 @@ static int serverworks_init_one(struct pci_dev *pdev, const struct pci_device_id + /* Select non UDMA capable OSB4 if we can't do fixups */ + if (rc < 0) + ppi[0] = &info[1]; ++ sht = &serverworks_osb4_sht; + } + /* setup CSB5/CSB6 : South Bridge and IDE option RAID */ + else if ((pdev->device == PCI_DEVICE_ID_SERVERWORKS_CSB5IDE) || +@@ -434,7 +443,7 @@ static int serverworks_init_one(struct pci_dev *pdev, const struct pci_device_id + ppi[1] = &ata_dummy_port_info; + } + +- return ata_pci_bmdma_init_one(pdev, ppi, &serverworks_sht, NULL, 0); ++ return ata_pci_bmdma_init_one(pdev, ppi, sht, NULL, 0); + } + + #ifdef CONFIG_PM +diff --git a/drivers/base/core.c b/drivers/base/core.c +index e28ce9898af4..32e86d6f141c 100644 +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -718,12 +718,12 @@ class_dir_create_and_add(struct class *class, struct kobject *parent_kobj) + return &dir->kobj; + } + ++static DEFINE_MUTEX(gdp_mutex); + + static struct kobject *get_device_parent(struct device *dev, + struct device *parent) + { + if (dev->class) { +- static DEFINE_MUTEX(gdp_mutex); + struct kobject *kobj = NULL; + struct kobject *parent_kobj; + struct kobject *k; +@@ -787,7 +787,9 @@ static void cleanup_glue_dir(struct device *dev, struct kobject *glue_dir) + glue_dir->kset != &dev->class->p->glue_dirs) + return; + ++ mutex_lock(&gdp_mutex); + kobject_put(glue_dir); ++ mutex_unlock(&gdp_mutex); + } + + static void cleanup_device_parent(struct device *dev) +diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c +index 5401814c874d..b7a4fe586f8a 100644 +--- a/drivers/base/firmware_class.c ++++ b/drivers/base/firmware_class.c +@@ -588,6 +588,9 @@ request_firmware(const struct firmware **firmware_p, const char *name, + struct firmware_priv *fw_priv; + int ret; + ++ if (!name || name[0] == '\0') ++ return -EINVAL; ++ + fw_priv = _request_firmware_prepare(firmware_p, name, device, true, + false); + if (IS_ERR_OR_NULL(fw_priv)) +diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c +index 8ab1eab90be7..1db12895110a 100644 +--- a/drivers/base/regmap/regmap-debugfs.c ++++ b/drivers/base/regmap/regmap-debugfs.c +@@ -244,7 +244,12 @@ static const struct file_operations regmap_access_fops = { + + void regmap_debugfs_init(struct regmap *map) + { +- map->debugfs = debugfs_create_dir(dev_name(map->dev), ++ const char *devname = "dummy"; ++ ++ if (map->dev) ++ devname = dev_name(map->dev); ++ ++ map->debugfs = debugfs_create_dir(devname, + regmap_debugfs_root); + if (!map->debugfs) { + dev_warn(map->dev, "Failed to create debugfs directory\n"); +diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c +index e5545427b46b..8e81f85b1ba0 100644 +--- a/drivers/base/regmap/regmap.c ++++ b/drivers/base/regmap/regmap.c +@@ -600,6 +600,11 @@ int regmap_bulk_write(struct regmap *map, unsigned int reg, const void *val, + if (val_bytes == 1) { + wval = (void *)val; + } else { ++ if (!val_count) { ++ ret = -EINVAL; ++ goto out; ++ } ++ + wval = kmemdup(val, val_count * val_bytes, GFP_KERNEL); + if (!wval) { + ret = -ENOMEM; +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 3cc242535012..155a61841e2b 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -304,6 +304,9 @@ static void btusb_intr_complete(struct urb *urb) + BT_ERR("%s corrupted event packet", hdev->name); + hdev->stat.err_rx++; + } ++ } else if (urb->status == -ENOENT) { ++ /* Avoid suspend failed when usb_kill_urb */ ++ return; + } + + if (!test_bit(BTUSB_INTR_RUNNING, &data->flags)) +@@ -392,6 +395,9 @@ static void btusb_bulk_complete(struct urb *urb) + BT_ERR("%s corrupted ACL packet", hdev->name); + hdev->stat.err_rx++; + } ++ } else if (urb->status == -ENOENT) { ++ /* Avoid suspend failed when usb_kill_urb */ ++ return; + } + + if (!test_bit(BTUSB_BULK_RUNNING, &data->flags)) +@@ -486,6 +492,9 @@ static void btusb_isoc_complete(struct urb *urb) + hdev->stat.err_rx++; + } + } ++ } else if (urb->status == -ENOENT) { ++ /* Avoid suspend failed when usb_kill_urb */ ++ return; + } + + if (!test_bit(BTUSB_ISOC_RUNNING, &data->flags)) +diff --git a/drivers/char/random.c b/drivers/char/random.c +index 1052fc4cae66..85172faa1569 100644 +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -932,8 +932,8 @@ static void extract_buf(struct entropy_store *r, __u8 *out) + * pool while mixing, and hash one final time. + */ + sha_transform(hash.w, extract, workspace); +- memset(extract, 0, sizeof(extract)); +- memset(workspace, 0, sizeof(workspace)); ++ memzero_explicit(extract, sizeof(extract)); ++ memzero_explicit(workspace, sizeof(workspace)); + + /* + * In case the hash function has some recognizable output +@@ -956,7 +956,7 @@ static void extract_buf(struct entropy_store *r, __u8 *out) + } + + memcpy(out, &hash, EXTRACT_SIZE); +- memset(&hash, 0, sizeof(hash)); ++ memzero_explicit(&hash, sizeof(hash)); + } + + static ssize_t extract_entropy(struct entropy_store *r, void *buf, +@@ -989,7 +989,7 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf, + } + + /* Wipe data just returned from memory */ +- memset(tmp, 0, sizeof(tmp)); ++ memzero_explicit(tmp, sizeof(tmp)); + + return ret; + } +@@ -1027,7 +1027,7 @@ static ssize_t extract_entropy_user(struct entropy_store *r, void __user *buf, + } + + /* Wipe data just returned from memory */ +- memset(tmp, 0, sizeof(tmp)); ++ memzero_explicit(tmp, sizeof(tmp)); + + return ret; + } +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index 7f2f149ae40f..cf864ef8d181 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -371,7 +371,18 @@ show_one(cpuinfo_max_freq, cpuinfo.max_freq); + show_one(cpuinfo_transition_latency, cpuinfo.transition_latency); + show_one(scaling_min_freq, min); + show_one(scaling_max_freq, max); +-show_one(scaling_cur_freq, cur); ++ ++static ssize_t show_scaling_cur_freq( ++ struct cpufreq_policy *policy, char *buf) ++{ ++ ssize_t ret; ++ ++ if (cpufreq_driver && cpufreq_driver->setpolicy && cpufreq_driver->get) ++ ret = sprintf(buf, "%u\n", cpufreq_driver->get(policy->cpu)); ++ else ++ ret = sprintf(buf, "%u\n", policy->cur); ++ return ret; ++} + + static int __cpufreq_set_policy(struct cpufreq_policy *data, + struct cpufreq_policy *policy); +@@ -818,11 +829,11 @@ static int cpufreq_add_dev_interface(unsigned int cpu, + if (ret) + goto err_out_kobj_put; + } +- if (cpufreq_driver->target) { +- ret = sysfs_create_file(&policy->kobj, &scaling_cur_freq.attr); +- if (ret) +- goto err_out_kobj_put; +- } ++ ++ ret = sysfs_create_file(&policy->kobj, &scaling_cur_freq.attr); ++ if (ret) ++ goto err_out_kobj_put; ++ + if (cpufreq_driver->bios_limit) { + ret = sysfs_create_file(&policy->kobj, &bios_limit.attr); + if (ret) +diff --git a/drivers/edac/mpc85xx_edac.c b/drivers/edac/mpc85xx_edac.c +index 73464a62adf7..0f0bf1a2ae1a 100644 +--- a/drivers/edac/mpc85xx_edac.c ++++ b/drivers/edac/mpc85xx_edac.c +@@ -577,7 +577,8 @@ static int __devinit mpc85xx_l2_err_probe(struct platform_device *op) + if (edac_op_state == EDAC_OPSTATE_INT) { + pdata->irq = irq_of_parse_and_map(op->dev.of_node, 0); + res = devm_request_irq(&op->dev, pdata->irq, +- mpc85xx_l2_isr, IRQF_DISABLED, ++ mpc85xx_l2_isr, ++ IRQF_DISABLED | IRQF_SHARED, + "[EDAC] L2 err", edac_dev); + if (res < 0) { + printk(KERN_ERR +diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c +index b558810b2da0..b449572cb800 100644 +--- a/drivers/firewire/core-cdev.c ++++ b/drivers/firewire/core-cdev.c +@@ -1619,8 +1619,7 @@ static int dispatch_ioctl(struct client *client, + _IOC_SIZE(cmd) > sizeof(buffer)) + return -ENOTTY; + +- if (_IOC_DIR(cmd) == _IOC_READ) +- memset(&buffer, 0, _IOC_SIZE(cmd)); ++ memset(&buffer, 0, sizeof(buffer)); + + if (_IOC_DIR(cmd) & _IOC_WRITE) + if (copy_from_user(&buffer, arg, _IOC_SIZE(cmd))) +diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c +index df62c393f2f5..01434ef9e00f 100644 +--- a/drivers/gpu/drm/radeon/evergreen.c ++++ b/drivers/gpu/drm/radeon/evergreen.c +@@ -1176,6 +1176,7 @@ void evergreen_mc_stop(struct radeon_device *rdev, struct evergreen_mc_save *sav + WREG32(EVERGREEN_CRTC_UPDATE_LOCK + crtc_offsets[i], 1); + tmp |= EVERGREEN_CRTC_BLANK_DATA_EN; + WREG32(EVERGREEN_CRTC_BLANK_CONTROL + crtc_offsets[i], tmp); ++ WREG32(EVERGREEN_CRTC_UPDATE_LOCK + crtc_offsets[i], 0); + } + } else { + tmp = RREG32(EVERGREEN_CRTC_CONTROL + crtc_offsets[i]); +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c +index 00fb5aa2bf77..7ca1d472d7cb 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c +@@ -1915,6 +1915,14 @@ int vmw_du_connector_fill_modes(struct drm_connector *connector, + DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC) + }; + int i; ++ u32 assumed_bpp = 2; ++ ++ /* ++ * If using screen objects, then assume 32-bpp because that's what the ++ * SVGA device is assuming ++ */ ++ if (dev_priv->sou_priv) ++ assumed_bpp = 4; + + /* Add preferred mode */ + { +@@ -1925,8 +1933,9 @@ int vmw_du_connector_fill_modes(struct drm_connector *connector, + mode->vdisplay = du->pref_height; + vmw_guess_mode_timing(mode); + +- if (vmw_kms_validate_mode_vram(dev_priv, mode->hdisplay * 2, +- mode->vdisplay)) { ++ if (vmw_kms_validate_mode_vram(dev_priv, ++ mode->hdisplay * assumed_bpp, ++ mode->vdisplay)) { + drm_mode_probed_add(connector, mode); + } else { + drm_mode_destroy(dev, mode); +@@ -1948,7 +1957,8 @@ int vmw_du_connector_fill_modes(struct drm_connector *connector, + bmode->vdisplay > max_height) + continue; + +- if (!vmw_kms_validate_mode_vram(dev_priv, bmode->hdisplay * 2, ++ if (!vmw_kms_validate_mode_vram(dev_priv, ++ bmode->hdisplay * assumed_bpp, + bmode->vdisplay)) + continue; + +diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c +index f4c3d28cd1fc..3c8b2c473b81 100644 +--- a/drivers/hv/channel.c ++++ b/drivers/hv/channel.c +@@ -207,8 +207,10 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size, + ret = vmbus_post_msg(open_msg, + sizeof(struct vmbus_channel_open_channel)); + +- if (ret != 0) ++ if (ret != 0) { ++ err = ret; + goto error1; ++ } + + t = wait_for_completion_timeout(&open_info->waitevent, 5*HZ); + if (t == 0) { +@@ -400,7 +402,6 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer, + u32 next_gpadl_handle; + unsigned long flags; + int ret = 0; +- int t; + + next_gpadl_handle = atomic_read(&vmbus_connection.next_gpadl_handle); + atomic_inc(&vmbus_connection.next_gpadl_handle); +@@ -447,9 +448,7 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer, + + } + } +- t = wait_for_completion_timeout(&msginfo->waitevent, 5*HZ); +- BUG_ON(t == 0); +- ++ wait_for_completion(&msginfo->waitevent); + + /* At this point, we received the gpadl created msg */ + *gpadl_handle = gpadlmsg->gpadl; +@@ -472,7 +471,7 @@ int vmbus_teardown_gpadl(struct vmbus_channel *channel, u32 gpadl_handle) + struct vmbus_channel_gpadl_teardown *msg; + struct vmbus_channel_msginfo *info; + unsigned long flags; +- int ret, t; ++ int ret; + + info = kmalloc(sizeof(*info) + + sizeof(struct vmbus_channel_gpadl_teardown), GFP_KERNEL); +@@ -494,11 +493,12 @@ int vmbus_teardown_gpadl(struct vmbus_channel *channel, u32 gpadl_handle) + ret = vmbus_post_msg(msg, + sizeof(struct vmbus_channel_gpadl_teardown)); + +- BUG_ON(ret != 0); +- t = wait_for_completion_timeout(&info->waitevent, 5*HZ); +- BUG_ON(t == 0); ++ if (ret) ++ goto post_msg_err; ++ ++ wait_for_completion(&info->waitevent); + +- /* Received a torndown response */ ++post_msg_err: + spin_lock_irqsave(&vmbus_connection.channelmsg_lock, flags); + list_del(&info->msglistentry); + spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags); +@@ -531,11 +531,28 @@ void vmbus_close(struct vmbus_channel *channel) + + ret = vmbus_post_msg(msg, sizeof(struct vmbus_channel_close_channel)); + +- BUG_ON(ret != 0); ++ if (ret) { ++ pr_err("Close failed: close post msg return is %d\n", ret); ++ /* ++ * If we failed to post the close msg, ++ * it is perhaps better to leak memory. ++ */ ++ return; ++ } ++ + /* Tear down the gpadl for the channel's ring buffer */ +- if (channel->ringbuffer_gpadlhandle) +- vmbus_teardown_gpadl(channel, +- channel->ringbuffer_gpadlhandle); ++ if (channel->ringbuffer_gpadlhandle) { ++ ret = vmbus_teardown_gpadl(channel, ++ channel->ringbuffer_gpadlhandle); ++ if (ret) { ++ pr_err("Close failed: teardown gpadl return %d\n", ret); ++ /* ++ * If we failed to teardown gpadl, ++ * it is perhaps better to leak memory. ++ */ ++ return; ++ } ++ } + + /* Cleanup the ring buffers for this channel */ + hv_ringbuffer_cleanup(&channel->outbound); +@@ -543,8 +560,6 @@ void vmbus_close(struct vmbus_channel *channel) + + free_pages((unsigned long)channel->ringbuffer_pages, + get_order(channel->ringbuffer_pagecount * PAGE_SIZE)); +- +- + } + EXPORT_SYMBOL_GPL(vmbus_close); + +diff --git a/drivers/hv/connection.c b/drivers/hv/connection.c +index 650c9f0b6642..2d52a1b15b35 100644 +--- a/drivers/hv/connection.c ++++ b/drivers/hv/connection.c +@@ -294,10 +294,21 @@ int vmbus_post_msg(void *buffer, size_t buflen) + * insufficient resources. Retry the operation a couple of + * times before giving up. + */ +- while (retries < 3) { +- ret = hv_post_message(conn_id, 1, buffer, buflen); +- if (ret != HV_STATUS_INSUFFICIENT_BUFFERS) ++ while (retries < 10) { ++ ret = hv_post_message(conn_id, 1, buffer, buflen); ++ ++ switch (ret) { ++ case HV_STATUS_INSUFFICIENT_BUFFERS: ++ ret = -ENOMEM; ++ case -ENOMEM: ++ break; ++ case HV_STATUS_SUCCESS: + return ret; ++ default: ++ pr_err("hv_post_msg() failed; error code:%d\n", ret); ++ return -EINVAL; ++ } ++ + retries++; + msleep(100); + } +diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c +index ff0b71a7e8e1..6bd8e81cfd9d 100644 +--- a/drivers/infiniband/ulp/srpt/ib_srpt.c ++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c +@@ -2146,6 +2146,7 @@ static int srpt_create_ch_ib(struct srpt_rdma_ch *ch) + if (!qp_init) + goto out; + ++retry: + ch->cq = ib_create_cq(sdev->device, srpt_completion, NULL, ch, + ch->rq_size + srp_sq_size, 0); + if (IS_ERR(ch->cq)) { +@@ -2169,6 +2170,13 @@ static int srpt_create_ch_ib(struct srpt_rdma_ch *ch) + ch->qp = ib_create_qp(sdev->pd, qp_init); + if (IS_ERR(ch->qp)) { + ret = PTR_ERR(ch->qp); ++ if (ret == -ENOMEM) { ++ srp_sq_size /= 2; ++ if (srp_sq_size >= MIN_SRPT_SQ_SIZE) { ++ ib_destroy_cq(ch->cq); ++ goto retry; ++ } ++ } + printk(KERN_ERR "failed to create_qp ret= %d\n", ret); + goto err_destroy_cq; + } +diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c +index 4c6a72d3d48c..9854a1ff5ab5 100644 +--- a/drivers/input/mouse/alps.c ++++ b/drivers/input/mouse/alps.c +@@ -787,7 +787,13 @@ static psmouse_ret_t alps_process_byte(struct psmouse *psmouse) + struct alps_data *priv = psmouse->private; + const struct alps_model_info *model = priv->i; + +- if ((psmouse->packet[0] & 0xc8) == 0x08) { /* PS/2 packet */ ++ /* ++ * Check if we are dealing with a bare PS/2 packet, presumably from ++ * a device connected to the external PS/2 port. Because bare PS/2 ++ * protocol does not have enough constant bits to self-synchronize ++ * properly we only do this if the device is fully synchronized. ++ */ ++ if (!psmouse->out_of_sync_cnt && (psmouse->packet[0] & 0xc8) == 0x08) { + if (psmouse->pktcnt == 3) { + alps_report_bare_ps2_packet(psmouse, psmouse->packet, + true); +@@ -1619,6 +1625,9 @@ int alps_init(struct psmouse *psmouse) + /* We are having trouble resyncing ALPS touchpads so disable it for now */ + psmouse->resync_time = 0; + ++ /* Allow 2 invalid packets without resetting device */ ++ psmouse->resetafter = psmouse->pktsize * 2; ++ + return 0; + + init_fail: +diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c +index 32b1363f7ace..97e5f6f797b4 100644 +--- a/drivers/input/mouse/synaptics.c ++++ b/drivers/input/mouse/synaptics.c +@@ -506,6 +506,8 @@ static void synaptics_parse_agm(const unsigned char buf[], + priv->agm_pending = true; + } + ++static bool is_forcepad; ++ + static int synaptics_parse_hw_state(const unsigned char buf[], + struct synaptics_data *priv, + struct synaptics_hw_state *hw) +@@ -535,7 +537,7 @@ static int synaptics_parse_hw_state(const unsigned char buf[], + hw->left = (buf[0] & 0x01) ? 1 : 0; + hw->right = (buf[0] & 0x02) ? 1 : 0; + +- if (SYN_CAP_FORCEPAD(priv->ext_cap_0c)) { ++ if (is_forcepad) { + /* + * ForcePads, like Clickpads, use middle button + * bits to report primary button clicks. +@@ -1512,6 +1514,18 @@ static const struct dmi_system_id min_max_dmi_table[] __initconst = { + { } + }; + ++static const struct dmi_system_id forcepad_dmi_table[] __initconst = { ++#if defined(CONFIG_DMI) && defined(CONFIG_X86) ++ { ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "HP EliteBook Folio 1040 G1"), ++ }, ++ }, ++#endif ++ { } ++}; ++ + void __init synaptics_module_init(void) + { + const struct dmi_system_id *min_max_dmi; +@@ -1522,6 +1536,12 @@ void __init synaptics_module_init(void) + min_max_dmi = dmi_first_match(min_max_dmi_table); + if (min_max_dmi) + quirk_min_max = min_max_dmi->driver_data; ++ ++ /* ++ * Unfortunately ForcePad capability is not exported over PS/2, ++ * so we have to resort to checking DMI. ++ */ ++ is_forcepad = dmi_check_system(forcepad_dmi_table); + } + + static int __synaptics_init(struct psmouse *psmouse, bool absolute_mode) +diff --git a/drivers/input/mouse/synaptics.h b/drivers/input/mouse/synaptics.h +index ac1b77354cac..20d861b4e326 100644 +--- a/drivers/input/mouse/synaptics.h ++++ b/drivers/input/mouse/synaptics.h +@@ -76,12 +76,9 @@ + * for noise. + * 2 0x08 image sensor image sensor tracks 5 fingers, but only + * reports 2. ++ * 2 0x01 uniform clickpad whole clickpad moves instead of being ++ * hinged at the top. + * 2 0x20 report min query 0x0f gives min coord reported +- * 2 0x80 forcepad forcepad is a variant of clickpad that +- * does not have physical buttons but rather +- * uses pressure above certain threshold to +- * report primary clicks. Forcepads also have +- * clickpad bit set. + */ + #define SYN_CAP_CLICKPAD(ex0c) ((ex0c) & 0x100000) /* 1-button ClickPad */ + #define SYN_CAP_CLICKPAD2BTN(ex0c) ((ex0c) & 0x000100) /* 2-button ClickPad */ +@@ -90,7 +87,6 @@ + #define SYN_CAP_ADV_GESTURE(ex0c) ((ex0c) & 0x080000) + #define SYN_CAP_REDUCED_FILTERING(ex0c) ((ex0c) & 0x000400) + #define SYN_CAP_IMAGE_SENSOR(ex0c) ((ex0c) & 0x000800) +-#define SYN_CAP_FORCEPAD(ex0c) ((ex0c) & 0x008000) + + /* synaptics modes query bits */ + #define SYN_MODE_ABSOLUTE(m) ((m) & (1 << 7)) +diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h +index 1291673bd57e..ce715b1bee46 100644 +--- a/drivers/input/serio/i8042-x86ia64io.h ++++ b/drivers/input/serio/i8042-x86ia64io.h +@@ -101,6 +101,12 @@ static const struct dmi_system_id __initconst i8042_dmi_noloop_table[] = { + }, + { + .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "X750LN"), ++ }, ++ }, ++ { ++ .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Compaq"), + DMI_MATCH(DMI_PRODUCT_NAME , "ProLiant"), + DMI_MATCH(DMI_PRODUCT_VERSION, "8500"), +@@ -609,6 +615,22 @@ static const struct dmi_system_id __initconst i8042_dmi_notimeout_table[] = { + }, + }, + { ++ /* Fujitsu A544 laptop */ ++ /* https://bugzilla.redhat.com/show_bug.cgi?id=1111138 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK A544"), ++ }, ++ }, ++ { ++ /* Fujitsu AH544 laptop */ ++ /* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK AH544"), ++ }, ++ }, ++ { + /* Fujitsu U574 laptop */ + /* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */ + .matches = { +diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c +index 6f99500790b3..535b09cd3cd8 100644 +--- a/drivers/md/dm-bufio.c ++++ b/drivers/md/dm-bufio.c +@@ -467,6 +467,7 @@ static void __relink_lru(struct dm_buffer *b, int dirty) + b->list_mode = dirty; + list_del(&b->lru_list); + list_add(&b->lru_list, &c->lru[dirty]); ++ b->last_accessed = jiffies; + } + + /*---------------------------------------------------------------- +@@ -1378,9 +1379,9 @@ static void drop_buffers(struct dm_bufio_client *c) + + /* + * Test if the buffer is unused and too old, and commit it. +- * At if noio is set, we must not do any I/O because we hold +- * dm_bufio_clients_lock and we would risk deadlock if the I/O gets rerouted to +- * different bufio client. ++ * And if GFP_NOFS is used, we must not do any I/O because we hold ++ * dm_bufio_clients_lock and we would risk deadlock if the I/O gets ++ * rerouted to different bufio client. + */ + static int __cleanup_old_buffer(struct dm_buffer *b, gfp_t gfp, + unsigned long max_jiffies) +@@ -1388,7 +1389,7 @@ static int __cleanup_old_buffer(struct dm_buffer *b, gfp_t gfp, + if (jiffies - b->last_accessed < max_jiffies) + return 1; + +- if (!(gfp & __GFP_IO)) { ++ if (!(gfp & __GFP_FS)) { + if (test_bit(B_READING, &b->state) || + test_bit(B_WRITING, &b->state) || + test_bit(B_DIRTY, &b->state)) +@@ -1427,7 +1428,7 @@ static int shrink(struct shrinker *shrinker, struct shrink_control *sc) + unsigned long r; + unsigned long nr_to_scan = sc->nr_to_scan; + +- if (sc->gfp_mask & __GFP_IO) ++ if (sc->gfp_mask & __GFP_FS) + dm_bufio_lock(c); + else if (!dm_bufio_trylock(c)) + return !nr_to_scan ? 0 : -1; +diff --git a/drivers/md/dm-log-userspace-transfer.c b/drivers/md/dm-log-userspace-transfer.c +index 08d9a207259a..c69d0b787746 100644 +--- a/drivers/md/dm-log-userspace-transfer.c ++++ b/drivers/md/dm-log-userspace-transfer.c +@@ -272,7 +272,7 @@ int dm_ulog_tfr_init(void) + + r = cn_add_callback(&ulog_cn_id, "dmlogusr", cn_ulog_callback); + if (r) { +- cn_del_callback(&ulog_cn_id); ++ kfree(prealloced_cn_msg); + return r; + } + +diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c +index ead5ca99a749..5dea02cff622 100644 +--- a/drivers/md/dm-raid.c ++++ b/drivers/md/dm-raid.c +@@ -592,8 +592,7 @@ struct dm_raid_superblock { + __le32 layout; + __le32 stripe_sectors; + +- __u8 pad[452]; /* Round struct to 512 bytes. */ +- /* Always set to 0 when writing. */ ++ /* Remainder of a logical block is zero-filled when writing (see super_sync()). */ + } __packed; + + static int read_disk_sb(struct md_rdev *rdev, int size) +@@ -628,7 +627,7 @@ static void super_sync(struct mddev *mddev, struct md_rdev *rdev) + if ((r->raid_disk >= 0) && test_bit(Faulty, &r->flags)) + failed_devices |= (1ULL << r->raid_disk); + +- memset(sb, 0, sizeof(*sb)); ++ memset(sb + 1, 0, rdev->sb_size - sizeof(*sb)); + + sb->magic = cpu_to_le32(DM_RAID_MAGIC); + sb->features = cpu_to_le32(0); /* No features yet */ +@@ -663,7 +662,11 @@ static int super_load(struct md_rdev *rdev, struct md_rdev *refdev) + uint64_t events_sb, events_refsb; + + rdev->sb_start = 0; +- rdev->sb_size = sizeof(*sb); ++ rdev->sb_size = bdev_logical_block_size(rdev->meta_bdev); ++ if (rdev->sb_size < sizeof(*sb) || rdev->sb_size > PAGE_SIZE) { ++ DMERR("superblock size of a logical block is no longer valid"); ++ return -EINVAL; ++ } + + ret = read_disk_sb(rdev, rdev->sb_size); + if (ret) +diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c +index c2cdefa1651e..d4f7f9537db2 100644 +--- a/drivers/net/can/dev.c ++++ b/drivers/net/can/dev.c +@@ -359,7 +359,7 @@ void can_free_echo_skb(struct net_device *dev, unsigned int idx) + BUG_ON(idx >= priv->echo_skb_max); + + if (priv->echo_skb[idx]) { +- kfree_skb(priv->echo_skb[idx]); ++ dev_kfree_skb_any(priv->echo_skb[idx]); + priv->echo_skb[idx] = NULL; + } + } +diff --git a/drivers/net/can/usb/esd_usb2.c b/drivers/net/can/usb/esd_usb2.c +index 09b1da5bc512..6c8423411dd8 100644 +--- a/drivers/net/can/usb/esd_usb2.c ++++ b/drivers/net/can/usb/esd_usb2.c +@@ -1094,6 +1094,7 @@ static void esd_usb2_disconnect(struct usb_interface *intf) + } + } + unlink_all_urbs(dev); ++ kfree(dev); + } + } + +diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c +index f5b9de48bb82..c19f9447b200 100644 +--- a/drivers/net/macvtap.c ++++ b/drivers/net/macvtap.c +@@ -17,6 +17,7 @@ + #include + #include + ++#include + #include + #include + #include +@@ -578,6 +579,8 @@ static int macvtap_skb_from_vnet_hdr(struct sk_buff *skb, + break; + case VIRTIO_NET_HDR_GSO_UDP: + gso_type = SKB_GSO_UDP; ++ if (skb->protocol == htons(ETH_P_IPV6)) ++ ipv6_proxy_select_ident(skb); + break; + default: + return -EINVAL; +@@ -634,6 +637,8 @@ static int macvtap_skb_to_vnet_hdr(const struct sk_buff *skb, + if (skb->ip_summed == CHECKSUM_PARTIAL) { + vnet_hdr->flags = VIRTIO_NET_HDR_F_NEEDS_CSUM; + vnet_hdr->csum_start = skb_checksum_start_offset(skb); ++ if (vlan_tx_tag_present(skb)) ++ vnet_hdr->csum_start += VLAN_HLEN; + vnet_hdr->csum_offset = skb->csum_offset; + } else if (skb->ip_summed == CHECKSUM_UNNECESSARY) { + vnet_hdr->flags = VIRTIO_NET_HDR_F_DATA_VALID; +diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c +index 21d7151fb0ab..1207bb19ba58 100644 +--- a/drivers/net/ppp/ppp_generic.c ++++ b/drivers/net/ppp/ppp_generic.c +@@ -588,7 +588,7 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg) + if (file == ppp->owner) + ppp_shutdown_interface(ppp); + } +- if (atomic_long_read(&file->f_count) <= 2) { ++ if (atomic_long_read(&file->f_count) < 2) { + ppp_release(NULL, file); + err = 0; + } else +diff --git a/drivers/net/tun.c b/drivers/net/tun.c +index 5b1a1b51fdb0..84b95c9b15f6 100644 +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -64,6 +64,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -696,6 +697,8 @@ static ssize_t tun_get_user(struct tun_struct *tun, + break; + } + ++ skb_reset_network_header(skb); ++ + if (gso.gso_type != VIRTIO_NET_HDR_GSO_NONE) { + pr_debug("GSO!\n"); + switch (gso.gso_type & ~VIRTIO_NET_HDR_GSO_ECN) { +@@ -707,6 +710,8 @@ static ssize_t tun_get_user(struct tun_struct *tun, + break; + case VIRTIO_NET_HDR_GSO_UDP: + skb_shinfo(skb)->gso_type = SKB_GSO_UDP; ++ if (skb->protocol == htons(ETH_P_IPV6)) ++ ipv6_proxy_select_ident(skb); + break; + default: + tun->dev->stats.rx_frame_errors++; +diff --git a/drivers/net/wireless/rt2x00/rt2800.h b/drivers/net/wireless/rt2x00/rt2800.h +index 063bfa8b91f4..9105493445bd 100644 +--- a/drivers/net/wireless/rt2x00/rt2800.h ++++ b/drivers/net/wireless/rt2x00/rt2800.h +@@ -1751,7 +1751,7 @@ struct mac_iveiv_entry { + * 2 - drop tx power by 12dBm, + * 3 - increase tx power by 6dBm + */ +-#define BBP1_TX_POWER_CTRL FIELD8(0x07) ++#define BBP1_TX_POWER_CTRL FIELD8(0x03) + #define BBP1_TX_ANTENNA FIELD8(0x18) + + /* +diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c +index 664e93d2a682..49baf0cfe304 100644 +--- a/drivers/net/wireless/rt2x00/rt2800usb.c ++++ b/drivers/net/wireless/rt2x00/rt2800usb.c +@@ -1081,6 +1081,7 @@ static struct usb_device_id rt2800usb_device_table[] = { + /* Ovislink */ + { USB_DEVICE(0x1b75, 0x3071) }, + { USB_DEVICE(0x1b75, 0x3072) }, ++ { USB_DEVICE(0x1b75, 0xa200) }, + /* Para */ + { USB_DEVICE(0x20b8, 0x8888) }, + /* Pegatron */ +diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c +index 4d792a242c5e..c5bdbe94aec8 100644 +--- a/drivers/net/wireless/rt2x00/rt2x00queue.c ++++ b/drivers/net/wireless/rt2x00/rt2x00queue.c +@@ -148,55 +148,29 @@ void rt2x00queue_align_frame(struct sk_buff *skb) + skb_trim(skb, frame_length); + } + +-void rt2x00queue_insert_l2pad(struct sk_buff *skb, unsigned int header_length) ++/* ++ * H/W needs L2 padding between the header and the paylod if header size ++ * is not 4 bytes aligned. ++ */ ++void rt2x00queue_insert_l2pad(struct sk_buff *skb, unsigned int hdr_len) + { +- unsigned int payload_length = skb->len - header_length; +- unsigned int header_align = ALIGN_SIZE(skb, 0); +- unsigned int payload_align = ALIGN_SIZE(skb, header_length); +- unsigned int l2pad = payload_length ? L2PAD_SIZE(header_length) : 0; ++ unsigned int l2pad = (skb->len > hdr_len) ? L2PAD_SIZE(hdr_len) : 0; + +- /* +- * Adjust the header alignment if the payload needs to be moved more +- * than the header. +- */ +- if (payload_align > header_align) +- header_align += 4; +- +- /* There is nothing to do if no alignment is needed */ +- if (!header_align) ++ if (!l2pad) + return; + +- /* Reserve the amount of space needed in front of the frame */ +- skb_push(skb, header_align); +- +- /* +- * Move the header. +- */ +- memmove(skb->data, skb->data + header_align, header_length); +- +- /* Move the payload, if present and if required */ +- if (payload_length && payload_align) +- memmove(skb->data + header_length + l2pad, +- skb->data + header_length + l2pad + payload_align, +- payload_length); +- +- /* Trim the skb to the correct size */ +- skb_trim(skb, header_length + l2pad + payload_length); ++ skb_push(skb, l2pad); ++ memmove(skb->data, skb->data + l2pad, hdr_len); + } + +-void rt2x00queue_remove_l2pad(struct sk_buff *skb, unsigned int header_length) ++void rt2x00queue_remove_l2pad(struct sk_buff *skb, unsigned int hdr_len) + { +- /* +- * L2 padding is only present if the skb contains more than just the +- * IEEE 802.11 header. +- */ +- unsigned int l2pad = (skb->len > header_length) ? +- L2PAD_SIZE(header_length) : 0; ++ unsigned int l2pad = (skb->len > hdr_len) ? L2PAD_SIZE(hdr_len) : 0; + + if (!l2pad) + return; + +- memmove(skb->data + l2pad, skb->data, header_length); ++ memmove(skb->data + l2pad, skb->data, hdr_len); + skb_pull(skb, l2pad); + } + +diff --git a/drivers/of/address.c b/drivers/of/address.c +index 66d96f14c274..c059ce1dd338 100644 +--- a/drivers/of/address.c ++++ b/drivers/of/address.c +@@ -328,6 +328,21 @@ static struct of_bus *of_match_bus(struct device_node *np) + return NULL; + } + ++static int of_empty_ranges_quirk(void) ++{ ++ if (IS_ENABLED(CONFIG_PPC)) { ++ /* To save cycles, we cache the result */ ++ static int quirk_state = -1; ++ ++ if (quirk_state < 0) ++ quirk_state = ++ of_machine_is_compatible("Power Macintosh") || ++ of_machine_is_compatible("MacRISC"); ++ return quirk_state; ++ } ++ return false; ++} ++ + static int of_translate_one(struct device_node *parent, struct of_bus *bus, + struct of_bus *pbus, u32 *addr, + int na, int ns, int pna, const char *rprop) +@@ -353,12 +368,10 @@ static int of_translate_one(struct device_node *parent, struct of_bus *bus, + * This code is only enabled on powerpc. --gcl + */ + ranges = of_get_property(parent, rprop, &rlen); +-#if !defined(CONFIG_PPC) +- if (ranges == NULL) { ++ if (ranges == NULL && !of_empty_ranges_quirk()) { + pr_err("OF: no ranges; cannot translate\n"); + return 1; + } +-#endif /* !defined(CONFIG_PPC) */ + if (ranges == NULL || rlen == 0) { + offset = of_read_number(addr, na); + memset(addr, 0, pna * 4); +diff --git a/drivers/of/base.c b/drivers/of/base.c +index 1c207f23b114..d439d0611559 100644 +--- a/drivers/of/base.c ++++ b/drivers/of/base.c +@@ -716,52 +716,6 @@ int of_property_read_string(struct device_node *np, const char *propname, + EXPORT_SYMBOL_GPL(of_property_read_string); + + /** +- * of_property_read_string_index - Find and read a string from a multiple +- * strings property. +- * @np: device node from which the property value is to be read. +- * @propname: name of the property to be searched. +- * @index: index of the string in the list of strings +- * @out_string: pointer to null terminated return string, modified only if +- * return value is 0. +- * +- * Search for a property in a device tree node and retrieve a null +- * terminated string value (pointer to data, not a copy) in the list of strings +- * contained in that property. +- * Returns 0 on success, -EINVAL if the property does not exist, -ENODATA if +- * property does not have a value, and -EILSEQ if the string is not +- * null-terminated within the length of the property data. +- * +- * The out_string pointer is modified only if a valid string can be decoded. +- */ +-int of_property_read_string_index(struct device_node *np, const char *propname, +- int index, const char **output) +-{ +- struct property *prop = of_find_property(np, propname, NULL); +- int i = 0; +- size_t l = 0, total = 0; +- const char *p; +- +- if (!prop) +- return -EINVAL; +- if (!prop->value) +- return -ENODATA; +- if (strnlen(prop->value, prop->length) >= prop->length) +- return -EILSEQ; +- +- p = prop->value; +- +- for (i = 0; total < prop->length; total += l, p += l) { +- l = strlen(p) + 1; +- if (i++ == index) { +- *output = p; +- return 0; +- } +- } +- return -ENODATA; +-} +-EXPORT_SYMBOL_GPL(of_property_read_string_index); +- +-/** + * of_property_match_string() - Find string in a list and return index + * @np: pointer to node containing string list property + * @propname: string list property name +@@ -787,7 +741,7 @@ int of_property_match_string(struct device_node *np, const char *propname, + end = p + prop->length; + + for (i = 0; p < end; i++, p += l) { +- l = strlen(p) + 1; ++ l = strnlen(p, end - p) + 1; + if (p + l > end) + return -EILSEQ; + pr_debug("comparing %s with %s\n", string, p); +@@ -799,39 +753,41 @@ int of_property_match_string(struct device_node *np, const char *propname, + EXPORT_SYMBOL_GPL(of_property_match_string); + + /** +- * of_property_count_strings - Find and return the number of strings from a +- * multiple strings property. ++ * of_property_read_string_util() - Utility helper for parsing string properties + * @np: device node from which the property value is to be read. + * @propname: name of the property to be searched. ++ * @out_strs: output array of string pointers. ++ * @sz: number of array elements to read. ++ * @skip: Number of strings to skip over at beginning of list. + * +- * Search for a property in a device tree node and retrieve the number of null +- * terminated string contain in it. Returns the number of strings on +- * success, -EINVAL if the property does not exist, -ENODATA if property +- * does not have a value, and -EILSEQ if the string is not null-terminated +- * within the length of the property data. ++ * Don't call this function directly. It is a utility helper for the ++ * of_property_read_string*() family of functions. + */ +-int of_property_count_strings(struct device_node *np, const char *propname) ++int of_property_read_string_helper(struct device_node *np, const char *propname, ++ const char **out_strs, size_t sz, int skip) + { + struct property *prop = of_find_property(np, propname, NULL); +- int i = 0; +- size_t l = 0, total = 0; +- const char *p; ++ int l = 0, i = 0; ++ const char *p, *end; + + if (!prop) + return -EINVAL; + if (!prop->value) + return -ENODATA; +- if (strnlen(prop->value, prop->length) >= prop->length) +- return -EILSEQ; +- + p = prop->value; ++ end = p + prop->length; + +- for (i = 0; total < prop->length; total += l, p += l, i++) +- l = strlen(p) + 1; +- +- return i; ++ for (i = 0; p < end && (!out_strs || i < skip + sz); i++, p += l) { ++ l = strnlen(p, end - p) + 1; ++ if (p + l > end) ++ return -EILSEQ; ++ if (out_strs && i >= skip) ++ *out_strs++ = p; ++ } ++ i -= skip; ++ return i <= 0 ? -ENODATA : i; + } +-EXPORT_SYMBOL_GPL(of_property_count_strings); ++EXPORT_SYMBOL_GPL(of_property_read_string_helper); + + /** + * of_parse_phandle - Resolve a phandle property to a device_node pointer +diff --git a/drivers/of/selftest.c b/drivers/of/selftest.c +index f24ffd7088d2..5a0771cc8987 100644 +--- a/drivers/of/selftest.c ++++ b/drivers/of/selftest.c +@@ -120,8 +120,9 @@ static void __init of_selftest_parse_phandle_with_args(void) + pr_info("end - %s\n", passed_all ? "PASS" : "FAIL"); + } + +-static void __init of_selftest_property_match_string(void) ++static void __init of_selftest_property_string(void) + { ++ const char *strings[4]; + struct device_node *np; + int rc; + +@@ -139,13 +140,66 @@ static void __init of_selftest_property_match_string(void) + rc = of_property_match_string(np, "phandle-list-names", "third"); + selftest(rc == 2, "third expected:0 got:%i\n", rc); + rc = of_property_match_string(np, "phandle-list-names", "fourth"); +- selftest(rc == -ENODATA, "unmatched string; rc=%i", rc); ++ selftest(rc == -ENODATA, "unmatched string; rc=%i\n", rc); + rc = of_property_match_string(np, "missing-property", "blah"); +- selftest(rc == -EINVAL, "missing property; rc=%i", rc); ++ selftest(rc == -EINVAL, "missing property; rc=%i\n", rc); + rc = of_property_match_string(np, "empty-property", "blah"); +- selftest(rc == -ENODATA, "empty property; rc=%i", rc); ++ selftest(rc == -ENODATA, "empty property; rc=%i\n", rc); + rc = of_property_match_string(np, "unterminated-string", "blah"); +- selftest(rc == -EILSEQ, "unterminated string; rc=%i", rc); ++ selftest(rc == -EILSEQ, "unterminated string; rc=%i\n", rc); ++ ++ /* of_property_count_strings() tests */ ++ rc = of_property_count_strings(np, "string-property"); ++ selftest(rc == 1, "Incorrect string count; rc=%i\n", rc); ++ rc = of_property_count_strings(np, "phandle-list-names"); ++ selftest(rc == 3, "Incorrect string count; rc=%i\n", rc); ++ rc = of_property_count_strings(np, "unterminated-string"); ++ selftest(rc == -EILSEQ, "unterminated string; rc=%i\n", rc); ++ rc = of_property_count_strings(np, "unterminated-string-list"); ++ selftest(rc == -EILSEQ, "unterminated string array; rc=%i\n", rc); ++ ++ /* of_property_read_string_index() tests */ ++ rc = of_property_read_string_index(np, "string-property", 0, strings); ++ selftest(rc == 0 && !strcmp(strings[0], "foobar"), "of_property_read_string_index() failure; rc=%i\n", rc); ++ strings[0] = NULL; ++ rc = of_property_read_string_index(np, "string-property", 1, strings); ++ selftest(rc == -ENODATA && strings[0] == NULL, "of_property_read_string_index() failure; rc=%i\n", rc); ++ rc = of_property_read_string_index(np, "phandle-list-names", 0, strings); ++ selftest(rc == 0 && !strcmp(strings[0], "first"), "of_property_read_string_index() failure; rc=%i\n", rc); ++ rc = of_property_read_string_index(np, "phandle-list-names", 1, strings); ++ selftest(rc == 0 && !strcmp(strings[0], "second"), "of_property_read_string_index() failure; rc=%i\n", rc); ++ rc = of_property_read_string_index(np, "phandle-list-names", 2, strings); ++ selftest(rc == 0 && !strcmp(strings[0], "third"), "of_property_read_string_index() failure; rc=%i\n", rc); ++ strings[0] = NULL; ++ rc = of_property_read_string_index(np, "phandle-list-names", 3, strings); ++ selftest(rc == -ENODATA && strings[0] == NULL, "of_property_read_string_index() failure; rc=%i\n", rc); ++ strings[0] = NULL; ++ rc = of_property_read_string_index(np, "unterminated-string", 0, strings); ++ selftest(rc == -EILSEQ && strings[0] == NULL, "of_property_read_string_index() failure; rc=%i\n", rc); ++ rc = of_property_read_string_index(np, "unterminated-string-list", 0, strings); ++ selftest(rc == 0 && !strcmp(strings[0], "first"), "of_property_read_string_index() failure; rc=%i\n", rc); ++ strings[0] = NULL; ++ rc = of_property_read_string_index(np, "unterminated-string-list", 2, strings); /* should fail */ ++ selftest(rc == -EILSEQ && strings[0] == NULL, "of_property_read_string_index() failure; rc=%i\n", rc); ++ strings[1] = NULL; ++ ++ /* of_property_read_string_array() tests */ ++ rc = of_property_read_string_array(np, "string-property", strings, 4); ++ selftest(rc == 1, "Incorrect string count; rc=%i\n", rc); ++ rc = of_property_read_string_array(np, "phandle-list-names", strings, 4); ++ selftest(rc == 3, "Incorrect string count; rc=%i\n", rc); ++ rc = of_property_read_string_array(np, "unterminated-string", strings, 4); ++ selftest(rc == -EILSEQ, "unterminated string; rc=%i\n", rc); ++ /* -- An incorrectly formed string should cause a failure */ ++ rc = of_property_read_string_array(np, "unterminated-string-list", strings, 4); ++ selftest(rc == -EILSEQ, "unterminated string array; rc=%i\n", rc); ++ /* -- parsing the correctly formed strings should still work: */ ++ strings[2] = NULL; ++ rc = of_property_read_string_array(np, "unterminated-string-list", strings, 2); ++ selftest(rc == 2 && strings[2] == NULL, "of_property_read_string_array() failure; rc=%i\n", rc); ++ strings[1] = NULL; ++ rc = of_property_read_string_array(np, "phandle-list-names", strings, 1); ++ selftest(rc == 1 && strings[1] == NULL, "Overwrote end of string array; rc=%i, str='%s'\n", rc, strings[1]); + } + + static int __init of_selftest(void) +@@ -161,7 +215,7 @@ static int __init of_selftest(void) + + pr_info("start of selftest - you will see error messages\n"); + of_selftest_parse_phandle_with_args(); +- of_selftest_property_match_string(); ++ of_selftest_property_string(); + pr_info("end of selftest - %s\n", selftest_passed ? "PASS" : "FAIL"); + return 0; + } +diff --git a/drivers/pci/hotplug/pciehp_core.c b/drivers/pci/hotplug/pciehp_core.c +index 9e39df969560..75dc402f0347 100644 +--- a/drivers/pci/hotplug/pciehp_core.c ++++ b/drivers/pci/hotplug/pciehp_core.c +@@ -237,6 +237,13 @@ static int pciehp_probe(struct pcie_device *dev) + else if (pciehp_acpi_slot_detection_check(dev->port)) + goto err_out_none; + ++ if (!dev->port->subordinate) { ++ /* Can happen if we run out of bus numbers during probe */ ++ dev_err(&dev->device, ++ "Hotplug bridge without secondary bus, ignoring\n"); ++ goto err_out_none; ++ } ++ + ctrl = pcie_init(dev); + if (!ctrl) { + dev_err(&dev->device, "Controller initialization failed\n"); +diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c +index a55e248618cd..985ada79191e 100644 +--- a/drivers/pci/pci-sysfs.c ++++ b/drivers/pci/pci-sysfs.c +@@ -173,7 +173,7 @@ static ssize_t modalias_show(struct device *dev, struct device_attribute *attr, + { + struct pci_dev *pci_dev = to_pci_dev(dev); + +- return sprintf(buf, "pci:v%08Xd%08Xsv%08Xsd%08Xbc%02Xsc%02Xi%02x\n", ++ return sprintf(buf, "pci:v%08Xd%08Xsv%08Xsd%08Xbc%02Xsc%02Xi%02X\n", + pci_dev->vendor, pci_dev->device, + pci_dev->subsystem_vendor, pci_dev->subsystem_device, + (u8)(pci_dev->class >> 16), (u8)(pci_dev->class >> 8), +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 61bc33ed1116..e587d0035a74 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -28,6 +28,7 @@ + #include + #include + #include ++#include + #include /* isa_dma_bridge_buggy */ + #include "pci.h" + +@@ -291,6 +292,25 @@ static void __devinit quirk_citrine(struct pci_dev *dev) + } + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_IBM, PCI_DEVICE_ID_IBM_CITRINE, quirk_citrine); + ++/* On IBM Crocodile ipr SAS adapters, expand BAR to system page size */ ++static void quirk_extend_bar_to_page(struct pci_dev *dev) ++{ ++ int i; ++ ++ for (i = 0; i < PCI_STD_RESOURCE_END; i++) { ++ struct resource *r = &dev->resource[i]; ++ ++ if (r->flags & IORESOURCE_MEM && resource_size(r) < PAGE_SIZE) { ++ r->end = PAGE_SIZE - 1; ++ r->start = 0; ++ r->flags |= IORESOURCE_UNSET; ++ dev_info(&dev->dev, "expanded BAR %d to page size: %pR\n", ++ i, r); ++ } ++ } ++} ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_IBM, 0x034a, quirk_extend_bar_to_page); ++ + /* + * S3 868 and 968 chips report region size equal to 32M, but they decode 64M. + * If it's needed, re-allocate the region. +diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c +index c1a3fd8e1243..4d047316e831 100644 +--- a/drivers/platform/x86/acer-wmi.c ++++ b/drivers/platform/x86/acer-wmi.c +@@ -523,6 +523,17 @@ static const struct dmi_system_id video_vendor_dmi_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 4750"), + }, + }, ++ { ++ /* ++ * Note no video_set_backlight_video_vendor, we must use the ++ * acer interface, as there is no native backlight interface. ++ */ ++ .ident = "Acer KAV80", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "KAV80"), ++ }, ++ }, + {} + }; + +diff --git a/drivers/platform/x86/samsung-laptop.c b/drivers/platform/x86/samsung-laptop.c +index de9f432cf22d..28c1bdb2e59b 100644 +--- a/drivers/platform/x86/samsung-laptop.c ++++ b/drivers/platform/x86/samsung-laptop.c +@@ -1517,6 +1517,16 @@ static struct dmi_system_id __initdata samsung_dmi_table[] = { + }, + .driver_data = &samsung_broken_acpi_video, + }, ++ { ++ .callback = samsung_dmi_matched, ++ .ident = "NC210", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "NC210/NC110"), ++ DMI_MATCH(DMI_BOARD_NAME, "NC210/NC110"), ++ }, ++ .driver_data = &samsung_broken_acpi_video, ++ }, + { }, + }; + MODULE_DEVICE_TABLE(dmi, samsung_dmi_table); +diff --git a/drivers/power/charger-manager.c b/drivers/power/charger-manager.c +index 4c449b26de46..102267fc713d 100644 +--- a/drivers/power/charger-manager.c ++++ b/drivers/power/charger-manager.c +@@ -808,6 +808,11 @@ static int charger_manager_probe(struct platform_device *pdev) + goto err_no_charger_stat; + } + ++ if (!desc->psy_fuel_gauge) { ++ dev_err(&pdev->dev, "No fuel gauge power supply defined\n"); ++ return -EINVAL; ++ } ++ + /* Counting index only */ + while (desc->psy_charger_stat[i]) + i++; +diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c +index dcc39b612780..185971c2b41e 100644 +--- a/drivers/scsi/scsi_error.c ++++ b/drivers/scsi/scsi_error.c +@@ -1679,8 +1679,10 @@ static void scsi_restart_operations(struct Scsi_Host *shost) + * is no point trying to lock the door of an off-line device. + */ + shost_for_each_device(sdev, shost) { +- if (scsi_device_online(sdev) && sdev->locked) ++ if (scsi_device_online(sdev) && sdev->was_reset && sdev->locked) { + scsi_eh_lock_door(sdev); ++ sdev->was_reset = 0; ++ } + } + + /* +diff --git a/drivers/spi/spi-dw-mid.c b/drivers/spi/spi-dw-mid.c +index b9f0192758d6..efc494a65b43 100644 +--- a/drivers/spi/spi-dw-mid.c ++++ b/drivers/spi/spi-dw-mid.c +@@ -89,7 +89,10 @@ err_exit: + + static void mid_spi_dma_exit(struct dw_spi *dws) + { ++ dmaengine_terminate_all(dws->txchan); + dma_release_channel(dws->txchan); ++ ++ dmaengine_terminate_all(dws->rxchan); + dma_release_channel(dws->rxchan); + } + +@@ -136,7 +139,7 @@ static int mid_spi_dma_transfer(struct dw_spi *dws, int cs_change) + txconf.dst_addr = dws->dma_addr; + txconf.dst_maxburst = LNW_DMA_MSIZE_16; + txconf.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES; +- txconf.dst_addr_width = DMA_SLAVE_BUSWIDTH_2_BYTES; ++ txconf.dst_addr_width = dws->dma_width; + txconf.device_fc = false; + + txchan->device->device_control(txchan, DMA_SLAVE_CONFIG, +@@ -159,7 +162,7 @@ static int mid_spi_dma_transfer(struct dw_spi *dws, int cs_change) + rxconf.src_addr = dws->dma_addr; + rxconf.src_maxburst = LNW_DMA_MSIZE_16; + rxconf.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES; +- rxconf.src_addr_width = DMA_SLAVE_BUSWIDTH_2_BYTES; ++ rxconf.src_addr_width = dws->dma_width; + rxconf.device_fc = false; + + rxchan->device->device_control(rxchan, DMA_SLAVE_CONFIG, +diff --git a/drivers/spi/spi-pl022.c b/drivers/spi/spi-pl022.c +index 469eb28e8328..e3b845ae93c6 100644 +--- a/drivers/spi/spi-pl022.c ++++ b/drivers/spi/spi-pl022.c +@@ -1061,7 +1061,7 @@ err_rxdesc: + pl022->sgt_tx.nents, DMA_TO_DEVICE); + err_tx_sgmap: + dma_unmap_sg(rxchan->device->dev, pl022->sgt_rx.sgl, +- pl022->sgt_tx.nents, DMA_FROM_DEVICE); ++ pl022->sgt_rx.nents, DMA_FROM_DEVICE); + err_rx_sgmap: + sg_free_table(&pl022->sgt_tx); + err_alloc_tx_sg: +diff --git a/drivers/staging/iio/impedance-analyzer/ad5933.c b/drivers/staging/iio/impedance-analyzer/ad5933.c +index cd82b56d58af..2db80b1fda82 100644 +--- a/drivers/staging/iio/impedance-analyzer/ad5933.c ++++ b/drivers/staging/iio/impedance-analyzer/ad5933.c +@@ -109,15 +109,44 @@ static struct ad5933_platform_data ad5933_default_pdata = { + }; + + static struct iio_chan_spec ad5933_channels[] = { +- IIO_CHAN(IIO_TEMP, 0, 1, 1, NULL, 0, 0, 0, +- 0, AD5933_REG_TEMP_DATA, IIO_ST('s', 14, 16, 0), 0), +- /* Ring Channels */ +- IIO_CHAN(IIO_VOLTAGE, 0, 1, 0, "real_raw", 0, 0, +- IIO_CHAN_INFO_SCALE_SEPARATE_BIT, +- AD5933_REG_REAL_DATA, 0, IIO_ST('s', 16, 16, 0), 0), +- IIO_CHAN(IIO_VOLTAGE, 0, 1, 0, "imag_raw", 0, 0, +- IIO_CHAN_INFO_SCALE_SEPARATE_BIT, +- AD5933_REG_IMAG_DATA, 1, IIO_ST('s', 16, 16, 0), 0), ++ { ++ .type = IIO_TEMP, ++ .indexed = 1, ++ .processed_val = 1, ++ .channel = 0, ++ .address = AD5933_REG_TEMP_DATA, ++ .scan_type = { ++ .sign = 's', ++ .realbits = 14, ++ .storagebits = 16, ++ }, ++ }, { /* Ring Channels */ ++ .type = IIO_VOLTAGE, ++ .indexed = 1, ++ .channel = 0, ++ .extend_name = "real", ++ .info_mask = IIO_CHAN_INFO_SCALE_SEPARATE_BIT, ++ .address = AD5933_REG_REAL_DATA, ++ .scan_index = 0, ++ .scan_type = { ++ .sign = 's', ++ .realbits = 16, ++ .storagebits = 16, ++ }, ++ }, { ++ .type = IIO_VOLTAGE, ++ .indexed = 1, ++ .channel = 0, ++ .extend_name = "imag", ++ .info_mask = IIO_CHAN_INFO_SCALE_SEPARATE_BIT, ++ .address = AD5933_REG_IMAG_DATA, ++ .scan_index = 1, ++ .scan_type = { ++ .sign = 's', ++ .realbits = 16, ++ .storagebits = 16, ++ }, ++ }, + }; + + static int ad5933_i2c_write(struct i2c_client *client, +diff --git a/drivers/staging/iio/meter/ade7758_ring.c b/drivers/staging/iio/meter/ade7758_ring.c +index c45b23bb1229..629a6ed2c6ed 100644 +--- a/drivers/staging/iio/meter/ade7758_ring.c ++++ b/drivers/staging/iio/meter/ade7758_ring.c +@@ -96,7 +96,7 @@ static int ade7758_ring_preenable(struct iio_dev *indio_dev) + size_t d_size; + unsigned channel; + +- if (!bitmap_empty(indio_dev->active_scan_mask, indio_dev->masklength)) ++ if (bitmap_empty(indio_dev->active_scan_mask, indio_dev->masklength)) + return -EINVAL; + + channel = find_first_bit(indio_dev->active_scan_mask, +diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c +index 34df0b2a630e..b4b308ef6cf5 100644 +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -3284,8 +3284,7 @@ static void transport_complete_qf(struct se_cmd *cmd) + + if (cmd->se_cmd_flags & SCF_TRANSPORT_TASK_SENSE) { + ret = cmd->se_tfo->queue_status(cmd); +- if (ret) +- goto out; ++ goto out; + } + + switch (cmd->data_direction) { +diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c +index d53f39668044..6f8f985e7805 100644 +--- a/drivers/tty/serial/8250/8250_pci.c ++++ b/drivers/tty/serial/8250/8250_pci.c +@@ -1164,6 +1164,7 @@ pci_xr17c154_setup(struct serial_private *priv, + #define PCI_DEVICE_ID_PLX_CRONYX_OMEGA 0xc001 + #define PCI_DEVICE_ID_INTEL_PATSBURG_KT 0x1d3d + #define PCI_DEVICE_ID_BROADCOM_TRUMANAGE 0x160a ++#define PCI_DEVICE_ID_INTEL_QRK_UART 0x0936 + + /* Unknown vendors/cards - this should not be in linux/pci_ids.h */ + #define PCI_SUBDEVICE_ID_UNKNOWN_0x1584 0x1584 +@@ -1686,6 +1687,13 @@ static struct pci_serial_quirk pci_serial_quirks[] __refdata = { + .init = pci_eg20t_init, + .setup = pci_default_setup, + }, ++ { ++ .vendor = PCI_VENDOR_ID_INTEL, ++ .device = PCI_DEVICE_ID_INTEL_QRK_UART, ++ .subvendor = PCI_ANY_ID, ++ .subdevice = PCI_ANY_ID, ++ .setup = pci_default_setup, ++ }, + /* + * Cronyx Omega PCI (PLX-chip based) + */ +@@ -1894,6 +1902,7 @@ enum pci_board_num_t { + pbn_ADDIDATA_PCIe_4_3906250, + pbn_ADDIDATA_PCIe_8_3906250, + pbn_ce4100_1_115200, ++ pbn_qrk, + pbn_omegapci, + pbn_NETMOS9900_2s_115200, + pbn_brcm_trumanage, +@@ -2592,6 +2601,12 @@ static struct pciserial_board pci_boards[] __devinitdata = { + .base_baud = 921600, + .reg_shift = 2, + }, ++ [pbn_qrk] = { ++ .flags = FL_BASE0, ++ .num_ports = 1, ++ .base_baud = 2764800, ++ .reg_shift = 2, ++ }, + [pbn_omegapci] = { + .flags = FL_BASE0, + .num_ports = 8, +@@ -4164,6 +4179,12 @@ static struct pci_device_id serial_pci_tbl[] = { + pbn_ce4100_1_115200 }, + + /* ++ * Intel Quark x1000 ++ */ ++ { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_QRK_UART, ++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, ++ pbn_qrk }, ++ /* + * Cronyx Omega PCI + */ + { PCI_VENDOR_ID_PLX, PCI_DEVICE_ID_PLX_CRONYX_OMEGA, +diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c +index 4185cc5332ab..82aac2920e19 100644 +--- a/drivers/tty/serial/serial_core.c ++++ b/drivers/tty/serial/serial_core.c +@@ -355,7 +355,7 @@ uart_get_baud_rate(struct uart_port *port, struct ktermios *termios, + * The spd_hi, spd_vhi, spd_shi, spd_warp kludge... + * Die! Die! Die! + */ +- if (baud == 38400) ++ if (try == 0 && baud == 38400) + baud = altbaud; + + /* +diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c +index b28d6356a142..a07eb4c068a0 100644 +--- a/drivers/tty/tty_io.c ++++ b/drivers/tty/tty_io.c +@@ -1633,6 +1633,8 @@ int tty_release(struct inode *inode, struct file *filp) + int devpts; + int idx; + char buf[64]; ++ long timeout = 0; ++ int once = 1; + + if (tty_paranoia_check(tty, inode, __func__)) + return 0; +@@ -1713,11 +1715,18 @@ int tty_release(struct inode *inode, struct file *filp) + if (!do_sleep) + break; + +- printk(KERN_WARNING "%s: %s: read/write wait queue active!\n", ++ if (once) { ++ once = 0; ++ printk(KERN_WARNING "%s: %s: read/write wait queue active!\n", + __func__, tty_name(tty, buf)); ++ } + tty_unlock(); + mutex_unlock(&tty_mutex); +- schedule(); ++ schedule_timeout_killable(timeout); ++ if (timeout < 120 * HZ) ++ timeout = 2 * timeout + 1; ++ else ++ timeout = MAX_SCHEDULE_TIMEOUT; + } + + /* +diff --git a/drivers/tty/vt/consolemap.c b/drivers/tty/vt/consolemap.c +index 8308fc7cdc26..87025d01aaec 100644 +--- a/drivers/tty/vt/consolemap.c ++++ b/drivers/tty/vt/consolemap.c +@@ -518,6 +518,10 @@ int con_set_unimap(struct vc_data *vc, ushort ct, struct unipair __user *list) + + /* Save original vc_unipagdir_loc in case we allocate a new one */ + p = (struct uni_pagedir *)*vc->vc_uni_pagedir_loc; ++ ++ if (!p) ++ return -EINVAL; ++ + if (p->readonly) return -EIO; + + if (!ct) return 0; +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index 2f2540ff21f6..8f4a628d3382 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -910,11 +910,12 @@ static void acm_tty_set_termios(struct tty_struct *tty, + /* FIXME: Needs to clear unsupported bits in the termios */ + acm->clocal = ((termios->c_cflag & CLOCAL) != 0); + +- if (!newline.dwDTERate) { ++ if (C_BAUD(tty) == B0) { + newline.dwDTERate = acm->line.dwDTERate; + newctrl &= ~ACM_CTRL_DTR; +- } else ++ } else if (termios_old && (termios_old->c_cflag & CBAUD) == B0) { + newctrl |= ACM_CTRL_DTR; ++ } + + if (newctrl != acm->ctrlout) + acm_set_control(acm, acm->ctrlout = newctrl); +@@ -1601,6 +1602,7 @@ static const struct usb_device_id acm_ids[] = { + { USB_DEVICE(0x0572, 0x1328), /* Shiro / Aztech USB MODEM UM-3100 */ + .driver_info = NO_UNION_NORMAL, /* has no union descriptor */ + }, ++ { USB_DEVICE(0x2184, 0x001c) }, /* GW Instek AFG-2225 */ + { USB_DEVICE(0x22b8, 0x6425), /* Motorola MOTOMAGX phones */ + }, + /* Motorola H24 HSPA module: */ +diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c +index e2cc8df3d87b..6baeada782eb 100644 +--- a/drivers/usb/core/hcd.c ++++ b/drivers/usb/core/hcd.c +@@ -1882,6 +1882,8 @@ int usb_alloc_streams(struct usb_interface *interface, + return -EINVAL; + if (dev->speed != USB_SPEED_SUPER) + return -EINVAL; ++ if (dev->state < USB_STATE_CONFIGURED) ++ return -ENODEV; + + /* Streams only apply to bulk endpoints. */ + for (i = 0; i < num_eps; i++) +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index 62a9e44bfef6..93f2538b16cc 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -1638,8 +1638,10 @@ void usb_set_device_state(struct usb_device *udev, + || new_state == USB_STATE_SUSPENDED) + ; /* No change to wakeup settings */ + else if (new_state == USB_STATE_CONFIGURED) +- wakeup = udev->actconfig->desc.bmAttributes +- & USB_CONFIG_ATT_WAKEUP; ++ wakeup = (udev->quirks & ++ USB_QUIRK_IGNORE_REMOTE_WAKEUP) ? 0 : ++ udev->actconfig->desc.bmAttributes & ++ USB_CONFIG_ATT_WAKEUP; + else + wakeup = 0; + } +@@ -3359,6 +3361,9 @@ check_highspeed (struct usb_hub *hub, struct usb_device *udev, int port1) + struct usb_qualifier_descriptor *qual; + int status; + ++ if (udev->quirks & USB_QUIRK_DEVICE_QUALIFIER) ++ return; ++ + qual = kmalloc (sizeof *qual, GFP_KERNEL); + if (qual == NULL) + return; +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index bcde6f65b1c6..980a9d8c6504 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -88,6 +88,12 @@ static const struct usb_device_id usb_quirk_list[] = { + { USB_DEVICE(0x04e8, 0x6601), .driver_info = + USB_QUIRK_CONFIG_INTF_STRINGS }, + ++ { USB_DEVICE(0x04f3, 0x009b), .driver_info = ++ USB_QUIRK_DEVICE_QUALIFIER }, ++ ++ { USB_DEVICE(0x04f3, 0x016f), .driver_info = ++ USB_QUIRK_DEVICE_QUALIFIER }, ++ + /* Roland SC-8820 */ + { USB_DEVICE(0x0582, 0x0007), .driver_info = USB_QUIRK_RESET_RESUME }, + +@@ -158,6 +164,10 @@ static const struct usb_device_id usb_interface_quirk_list[] = { + { USB_VENDOR_AND_INTERFACE_INFO(0x046d, USB_CLASS_VIDEO, 1, 0), + .driver_info = USB_QUIRK_RESET_RESUME }, + ++ /* ASUS Base Station(T100) */ ++ { USB_DEVICE(0x0b05, 0x17e0), .driver_info = ++ USB_QUIRK_IGNORE_REMOTE_WAKEUP }, ++ + { } /* terminating entry must be last */ + }; + +diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c +index 5bf2bc00821b..8a7a8ee176fa 100644 +--- a/drivers/usb/dwc3/ep0.c ++++ b/drivers/usb/dwc3/ep0.c +@@ -209,7 +209,7 @@ static void dwc3_ep0_stall_and_restart(struct dwc3 *dwc) + struct dwc3_ep *dep = dwc->eps[0]; + + /* stall is always issued on EP0 */ +- __dwc3_gadget_ep_set_halt(dep, 1); ++ __dwc3_gadget_ep_set_halt(dep, 1, false); + dep->flags = DWC3_EP_ENABLED; + dwc->delayed_status = false; + +@@ -382,7 +382,7 @@ static int dwc3_ep0_handle_feature(struct dwc3 *dwc, + return -EINVAL; + if (set == 0 && (dep->flags & DWC3_EP_WEDGE)) + break; +- ret = __dwc3_gadget_ep_set_halt(dep, set); ++ ret = __dwc3_gadget_ep_set_halt(dep, set, true); + if (ret) + return -EINVAL; + break; +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index 895497d42270..1acb3a419539 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -485,12 +485,11 @@ static int __dwc3_gadget_ep_enable(struct dwc3_ep *dep, + if (!usb_endpoint_xfer_isoc(desc)) + return 0; + +- memset(&trb_link, 0, sizeof(trb_link)); +- + /* Link TRB for ISOC. The HWO bit is never reset */ + trb_st_hw = &dep->trb_pool[0]; + + trb_link = &dep->trb_pool[DWC3_TRB_NUM - 1]; ++ memset(trb_link, 0, sizeof(*trb_link)); + + trb_link->bpl = lower_32_bits(dwc3_trb_dma_offset(dep, trb_st_hw)); + trb_link->bph = upper_32_bits(dwc3_trb_dma_offset(dep, trb_st_hw)); +@@ -533,7 +532,7 @@ static int __dwc3_gadget_ep_disable(struct dwc3_ep *dep) + + /* make sure HW endpoint isn't stalled */ + if (dep->flags & DWC3_EP_STALL) +- __dwc3_gadget_ep_set_halt(dep, 0); ++ __dwc3_gadget_ep_set_halt(dep, 0, false); + + reg = dwc3_readl(dwc->regs, DWC3_DALEPENA); + reg &= ~DWC3_DALEPENA_EP(dep->number); +@@ -1078,7 +1077,7 @@ out0: + return ret; + } + +-int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value) ++int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value, int protocol) + { + struct dwc3_gadget_ep_cmd_params params; + struct dwc3 *dwc = dep->dwc; +@@ -1087,6 +1086,14 @@ int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value) + memset(¶ms, 0x00, sizeof(params)); + + if (value) { ++ if (!protocol && ((dep->direction && dep->flags & DWC3_EP_BUSY) || ++ (!list_empty(&dep->req_queued) || ++ !list_empty(&dep->request_list)))) { ++ dev_dbg(dwc->dev, "%s: pending request, cannot halt\n", ++ dep->name); ++ return -EAGAIN; ++ } ++ + if (dep->number == 0 || dep->number == 1) { + /* + * Whenever EP0 is stalled, we will restart +@@ -1135,7 +1142,7 @@ static int dwc3_gadget_ep_set_halt(struct usb_ep *ep, int value) + goto out; + } + +- ret = __dwc3_gadget_ep_set_halt(dep, value); ++ ret = __dwc3_gadget_ep_set_halt(dep, value, false); + out: + spin_unlock_irqrestore(&dwc->lock, flags); + +diff --git a/drivers/usb/dwc3/gadget.h b/drivers/usb/dwc3/gadget.h +index a8600084348c..6f498fc4f568 100644 +--- a/drivers/usb/dwc3/gadget.h ++++ b/drivers/usb/dwc3/gadget.h +@@ -108,7 +108,7 @@ void dwc3_ep0_interrupt(struct dwc3 *dwc, + void dwc3_ep0_out_start(struct dwc3 *dwc); + int dwc3_gadget_ep0_queue(struct usb_ep *ep, struct usb_request *request, + gfp_t gfp_flags); +-int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value); ++int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value, int protocol); + int dwc3_send_gadget_ep_cmd(struct dwc3 *dwc, unsigned ep, + unsigned cmd, struct dwc3_gadget_ep_cmd_params *params); + +diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c +index 8882d654b0d1..c8835d591b37 100644 +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -118,20 +118,6 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) + xhci->quirks |= XHCI_SPURIOUS_REBOOT; + xhci->quirks |= XHCI_AVOID_BEI; + } +- if (pdev->vendor == PCI_VENDOR_ID_INTEL && +- (pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_XHCI || +- pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI)) { +- /* Workaround for occasional spurious wakeups from S5 (or +- * any other sleep) on Haswell machines with LPT and LPT-LP +- * with the new Intel BIOS +- */ +- /* Limit the quirk to only known vendors, as this triggers +- * yet another BIOS bug on some other machines +- * https://bugzilla.kernel.org/show_bug.cgi?id=66171 +- */ +- if (pdev->subsystem_vendor == PCI_VENDOR_ID_HP) +- xhci->quirks |= XHCI_SPURIOUS_WAKEUP; +- } + if (pdev->vendor == PCI_VENDOR_ID_ETRON && + pdev->device == PCI_DEVICE_ID_ASROCK_P67) { + xhci->quirks |= XHCI_RESET_ON_RESUME; +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index ac339570a805..19074db60896 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -128,6 +128,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */ + { USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */ + { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */ ++ { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */ + { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */ + { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */ + { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */ +@@ -160,7 +161,9 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */ + { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */ + { USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */ ++ { USB_DEVICE(0x1BA4, 0x0002) }, /* Silicon Labs 358x factory default */ + { USB_DEVICE(0x1BE3, 0x07A6) }, /* WAGO 750-923 USB Service Cable */ ++ { USB_DEVICE(0x1D6F, 0x0010) }, /* Seluxit ApS RF Dongle */ + { USB_DEVICE(0x1E29, 0x0102) }, /* Festo CPX-USB */ + { USB_DEVICE(0x1E29, 0x0501) }, /* Festo CMSP */ + { USB_DEVICE(0x1FB9, 0x0100) }, /* Lake Shore Model 121 Current Source */ +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index 8425e9e9e127..a89433bd5314 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -156,6 +156,7 @@ static struct ftdi_sio_quirk ftdi_8u2232c_quirk = { + * /sys/bus/usb/ftdi_sio/new_id, then send patch/report! + */ + static struct usb_device_id id_table_combined [] = { ++ { USB_DEVICE(FTDI_VID, FTDI_BRICK_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_ZEITCONTROL_TAGTRACE_MIFARE_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_CTI_MINI_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_CTI_NANO_PID) }, +@@ -685,6 +686,10 @@ static struct usb_device_id id_table_combined [] = { + { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_5_PID) }, + { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_6_PID) }, + { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_7_PID) }, ++ { USB_DEVICE(XSENS_VID, XSENS_AWINDA_DONGLE_PID) }, ++ { USB_DEVICE(XSENS_VID, XSENS_AWINDA_STATION_PID) }, ++ { USB_DEVICE(XSENS_VID, XSENS_CONVERTER_PID) }, ++ { USB_DEVICE(XSENS_VID, XSENS_MTW_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_OMNI1509) }, + { USB_DEVICE(MOBILITY_VID, MOBILITY_USB_SERIAL_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_ACTIVE_ROBOTS_PID) }, +diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h +index 7628b91017ba..64ee791687d9 100644 +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -30,6 +30,12 @@ + + /*** third-party PIDs (using FTDI_VID) ***/ + ++/* ++ * Certain versions of the official Windows FTDI driver reprogrammed ++ * counterfeit FTDI devices to PID 0. Support these devices anyway. ++ */ ++#define FTDI_BRICK_PID 0x0000 ++ + #define FTDI_LUMEL_PD12_PID 0x6002 + + /* +@@ -142,12 +148,19 @@ + /* + * Xsens Technologies BV products (http://www.xsens.com). + */ +-#define XSENS_CONVERTER_0_PID 0xD388 +-#define XSENS_CONVERTER_1_PID 0xD389 ++#define XSENS_VID 0x2639 ++#define XSENS_AWINDA_STATION_PID 0x0101 ++#define XSENS_AWINDA_DONGLE_PID 0x0102 ++#define XSENS_MTW_PID 0x0200 /* Xsens MTw */ ++#define XSENS_CONVERTER_PID 0xD00D /* Xsens USB-serial converter */ ++ ++/* Xsens devices using FTDI VID */ ++#define XSENS_CONVERTER_0_PID 0xD388 /* Xsens USB converter */ ++#define XSENS_CONVERTER_1_PID 0xD389 /* Xsens Wireless Receiver */ + #define XSENS_CONVERTER_2_PID 0xD38A +-#define XSENS_CONVERTER_3_PID 0xD38B +-#define XSENS_CONVERTER_4_PID 0xD38C +-#define XSENS_CONVERTER_5_PID 0xD38D ++#define XSENS_CONVERTER_3_PID 0xD38B /* Xsens USB-serial converter */ ++#define XSENS_CONVERTER_4_PID 0xD38C /* Xsens Wireless Receiver */ ++#define XSENS_CONVERTER_5_PID 0xD38D /* Xsens Awinda Station */ + #define XSENS_CONVERTER_6_PID 0xD38E + #define XSENS_CONVERTER_7_PID 0xD38F + +diff --git a/drivers/usb/serial/kobil_sct.c b/drivers/usb/serial/kobil_sct.c +index 4a9a75eb9b95..c3a53acda67a 100644 +--- a/drivers/usb/serial/kobil_sct.c ++++ b/drivers/usb/serial/kobil_sct.c +@@ -447,7 +447,7 @@ static int kobil_write(struct tty_struct *tty, struct usb_serial_port *port, + ); + + priv->cur_pos = priv->cur_pos + length; +- result = usb_submit_urb(port->write_urb, GFP_NOIO); ++ result = usb_submit_urb(port->write_urb, GFP_ATOMIC); + dbg("%s - port %d Send write URB returns: %i", + __func__, port->number, result); + todo = priv->filled - priv->cur_pos; +@@ -463,7 +463,7 @@ static int kobil_write(struct tty_struct *tty, struct usb_serial_port *port, + if (priv->device_type == KOBIL_ADAPTER_B_PRODUCT_ID || + priv->device_type == KOBIL_ADAPTER_K_PRODUCT_ID) { + result = usb_submit_urb(port->interrupt_in_urb, +- GFP_NOIO); ++ GFP_ATOMIC); + dbg("%s - port %d Send read URB returns: %i", + __func__, port->number, result); + } +diff --git a/drivers/usb/serial/opticon.c b/drivers/usb/serial/opticon.c +index 1f850065d159..58b7cecd682f 100644 +--- a/drivers/usb/serial/opticon.c ++++ b/drivers/usb/serial/opticon.c +@@ -293,7 +293,7 @@ static int opticon_write(struct tty_struct *tty, struct usb_serial_port *port, + + /* The conncected devices do not have a bulk write endpoint, + * to transmit data to de barcode device the control endpoint is used */ +- dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_NOIO); ++ dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_ATOMIC); + if (!dr) { + dev_err(&port->dev, "out of memory\n"); + count = -ENOMEM; +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 703ebe7eaa93..d8232df2c211 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -269,6 +269,7 @@ static void option_instat_callback(struct urb *urb); + #define TELIT_PRODUCT_DE910_DUAL 0x1010 + #define TELIT_PRODUCT_UE910_V2 0x1012 + #define TELIT_PRODUCT_LE920 0x1200 ++#define TELIT_PRODUCT_LE910 0x1201 + + /* ZTE PRODUCTS */ + #define ZTE_VENDOR_ID 0x19d2 +@@ -362,6 +363,7 @@ static void option_instat_callback(struct urb *urb); + + /* Haier products */ + #define HAIER_VENDOR_ID 0x201e ++#define HAIER_PRODUCT_CE81B 0x10f8 + #define HAIER_PRODUCT_CE100 0x2009 + + /* Cinterion (formerly Siemens) products */ +@@ -589,6 +591,11 @@ static const struct option_blacklist_info zte_1255_blacklist = { + .reserved = BIT(3) | BIT(4), + }; + ++static const struct option_blacklist_info telit_le910_blacklist = { ++ .sendsetup = BIT(0), ++ .reserved = BIT(1) | BIT(2), ++}; ++ + static const struct option_blacklist_info telit_le920_blacklist = { + .sendsetup = BIT(0), + .reserved = BIT(1) | BIT(5), +@@ -1138,6 +1145,8 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_SINGLE) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_DE910_DUAL) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UE910_V2) }, ++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910), ++ .driver_info = (kernel_ulong_t)&telit_le910_blacklist }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920), + .driver_info = (kernel_ulong_t)&telit_le920_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */ +@@ -1614,7 +1623,8 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) }, + { USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) }, + { USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) }, + { USB_DEVICE(VTION_VENDOR_ID, 0x1a20) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(HAIER_VENDOR_ID, HAIER_PRODUCT_CE81B, 0xff, 0xff, 0xff) }, + /* Pirelli */ + { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_C100_1)}, + { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_C100_2)}, +diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c +index c70109e5d60b..d8d26f4f14dd 100644 +--- a/drivers/usb/storage/transport.c ++++ b/drivers/usb/storage/transport.c +@@ -1120,6 +1120,31 @@ int usb_stor_Bulk_transport(struct scsi_cmnd *srb, struct us_data *us) + */ + if (result == USB_STOR_XFER_LONG) + fake_sense = 1; ++ ++ /* ++ * Sometimes a device will mistakenly skip the data phase ++ * and go directly to the status phase without sending a ++ * zero-length packet. If we get a 13-byte response here, ++ * check whether it really is a CSW. ++ */ ++ if (result == USB_STOR_XFER_SHORT && ++ srb->sc_data_direction == DMA_FROM_DEVICE && ++ transfer_length - scsi_get_resid(srb) == ++ US_BULK_CS_WRAP_LEN) { ++ struct scatterlist *sg = NULL; ++ unsigned int offset = 0; ++ ++ if (usb_stor_access_xfer_buf((unsigned char *) bcs, ++ US_BULK_CS_WRAP_LEN, srb, &sg, ++ &offset, FROM_XFER_BUF) == ++ US_BULK_CS_WRAP_LEN && ++ bcs->Signature == ++ cpu_to_le32(US_BULK_CS_SIGN)) { ++ US_DEBUGP("Device skipped data phase\n"); ++ scsi_set_resid(srb, transfer_length); ++ goto skipped_data_phase; ++ } ++ } + } + + /* See flow chart on pg 15 of the Bulk Only Transport spec for +@@ -1155,6 +1180,7 @@ int usb_stor_Bulk_transport(struct scsi_cmnd *srb, struct us_data *us) + if (result != USB_STOR_XFER_GOOD) + return USB_STOR_TRANSPORT_ERROR; + ++ skipped_data_phase: + /* check bulk status */ + residue = le32_to_cpu(bcs->Residue); + US_DEBUGP("Bulk Status S 0x%x T 0x%x R %u Stat 0x%x\n", +diff --git a/drivers/video/console/bitblit.c b/drivers/video/console/bitblit.c +index 28b1a834906b..6cbb2069531d 100644 +--- a/drivers/video/console/bitblit.c ++++ b/drivers/video/console/bitblit.c +@@ -205,7 +205,6 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info, + static void bit_clear_margins(struct vc_data *vc, struct fb_info *info, + int bottom_only) + { +- int bgshift = (vc->vc_hi_font_mask) ? 13 : 12; + unsigned int cw = vc->vc_font.width; + unsigned int ch = vc->vc_font.height; + unsigned int rw = info->var.xres - (vc->vc_cols*cw); +@@ -214,7 +213,7 @@ static void bit_clear_margins(struct vc_data *vc, struct fb_info *info, + unsigned int bs = info->var.yres - bh; + struct fb_fillrect region; + +- region.color = attr_bgcol_ec(bgshift, vc, info); ++ region.color = 0; + region.rop = ROP_COPY; + + if (rw && !bottom_only) { +diff --git a/drivers/video/console/fbcon_ccw.c b/drivers/video/console/fbcon_ccw.c +index 41b32ae23dac..5a3cbf6dff4d 100644 +--- a/drivers/video/console/fbcon_ccw.c ++++ b/drivers/video/console/fbcon_ccw.c +@@ -197,9 +197,8 @@ static void ccw_clear_margins(struct vc_data *vc, struct fb_info *info, + unsigned int bh = info->var.xres - (vc->vc_rows*ch); + unsigned int bs = vc->vc_rows*ch; + struct fb_fillrect region; +- int bgshift = (vc->vc_hi_font_mask) ? 13 : 12; + +- region.color = attr_bgcol_ec(bgshift,vc,info); ++ region.color = 0; + region.rop = ROP_COPY; + + if (rw && !bottom_only) { +diff --git a/drivers/video/console/fbcon_cw.c b/drivers/video/console/fbcon_cw.c +index 6a737827beb1..7d3fd9bda66c 100644 +--- a/drivers/video/console/fbcon_cw.c ++++ b/drivers/video/console/fbcon_cw.c +@@ -181,9 +181,8 @@ static void cw_clear_margins(struct vc_data *vc, struct fb_info *info, + unsigned int bh = info->var.xres - (vc->vc_rows*ch); + unsigned int rs = info->var.yres - rw; + struct fb_fillrect region; +- int bgshift = (vc->vc_hi_font_mask) ? 13 : 12; + +- region.color = attr_bgcol_ec(bgshift,vc,info); ++ region.color = 0; + region.rop = ROP_COPY; + + if (rw && !bottom_only) { +diff --git a/drivers/video/console/fbcon_ud.c b/drivers/video/console/fbcon_ud.c +index ff0872c0498b..19e3714abfe8 100644 +--- a/drivers/video/console/fbcon_ud.c ++++ b/drivers/video/console/fbcon_ud.c +@@ -227,9 +227,8 @@ static void ud_clear_margins(struct vc_data *vc, struct fb_info *info, + unsigned int rw = info->var.xres - (vc->vc_cols*cw); + unsigned int bh = info->var.yres - (vc->vc_rows*ch); + struct fb_fillrect region; +- int bgshift = (vc->vc_hi_font_mask) ? 13 : 12; + +- region.color = attr_bgcol_ec(bgshift,vc,info); ++ region.color = 0; + region.rop = ROP_COPY; + + if (rw && !bottom_only) { +diff --git a/drivers/virtio/virtio_pci.c b/drivers/virtio/virtio_pci.c +index 2e03d416b9af..a41f264dc23d 100644 +--- a/drivers/virtio/virtio_pci.c ++++ b/drivers/virtio/virtio_pci.c +@@ -745,6 +745,7 @@ static int virtio_pci_restore(struct device *dev) + struct pci_dev *pci_dev = to_pci_dev(dev); + struct virtio_pci_device *vp_dev = pci_get_drvdata(pci_dev); + struct virtio_driver *drv; ++ unsigned status = 0; + int ret; + + drv = container_of(vp_dev->vdev.dev.driver, +@@ -755,14 +756,40 @@ static int virtio_pci_restore(struct device *dev) + return ret; + + pci_set_master(pci_dev); ++ /* We always start by resetting the device, in case a previous ++ * driver messed it up. */ ++ vp_reset(&vp_dev->vdev); ++ ++ /* Acknowledge that we've seen the device. */ ++ status |= VIRTIO_CONFIG_S_ACKNOWLEDGE; ++ vp_set_status(&vp_dev->vdev, status); ++ ++ /* Maybe driver failed before freeze. ++ * Restore the failed status, for debugging. */ ++ status |= vp_dev->saved_status & VIRTIO_CONFIG_S_FAILED; ++ vp_set_status(&vp_dev->vdev, status); ++ ++ if (!drv) ++ return 0; ++ ++ /* We have a driver! */ ++ status |= VIRTIO_CONFIG_S_DRIVER; ++ vp_set_status(&vp_dev->vdev, status); ++ + vp_finalize_features(&vp_dev->vdev); + +- if (drv && drv->restore) ++ if (drv->restore) { + ret = drv->restore(&vp_dev->vdev); ++ if (ret) { ++ status |= VIRTIO_CONFIG_S_FAILED; ++ vp_set_status(&vp_dev->vdev, status); ++ return ret; ++ } ++ } + + /* Finally, tell the device we're all set */ +- if (!ret) +- vp_set_status(&vp_dev->vdev, vp_dev->saved_status); ++ status |= VIRTIO_CONFIG_S_DRIVER_OK; ++ vp_set_status(&vp_dev->vdev, status); + + return ret; + } +diff --git a/fs/btrfs/file-item.c b/fs/btrfs/file-item.c +index 5d158d320233..6eab2dd16e94 100644 +--- a/fs/btrfs/file-item.c ++++ b/fs/btrfs/file-item.c +@@ -393,7 +393,7 @@ int btrfs_lookup_csums_range(struct btrfs_root *root, u64 start, u64 end, + ret = 0; + fail: + while (ret < 0 && !list_empty(&tmplist)) { +- sums = list_entry(&tmplist, struct btrfs_ordered_sum, list); ++ sums = list_entry(tmplist.next, struct btrfs_ordered_sum, list); + list_del(&sums->list); + kfree(sums); + } +diff --git a/fs/buffer.c b/fs/buffer.c +index f235e1834e39..ed2dc709883a 100644 +--- a/fs/buffer.c ++++ b/fs/buffer.c +@@ -1982,6 +1982,7 @@ int generic_write_end(struct file *file, struct address_space *mapping, + struct page *page, void *fsdata) + { + struct inode *inode = mapping->host; ++ loff_t old_size = inode->i_size; + int i_size_changed = 0; + + copied = block_write_end(file, mapping, pos, len, copied, page, fsdata); +@@ -2001,6 +2002,8 @@ int generic_write_end(struct file *file, struct address_space *mapping, + unlock_page(page); + page_cache_release(page); + ++ if (old_size < pos) ++ pagecache_isize_extended(inode, old_size, pos); + /* + * Don't mark the inode dirty under page lock. First, it unnecessarily + * makes the holding time of page lock longer. Second, it forces lock +@@ -2221,6 +2224,11 @@ static int cont_expand_zero(struct file *file, struct address_space *mapping, + err = 0; + + balance_dirty_pages_ratelimited(mapping); ++ ++ if (unlikely(fatal_signal_pending(current))) { ++ err = -EINTR; ++ goto out; ++ } + } + + /* page covers the boundary, find the boundary offset */ +diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c +index 11030b2fd3b4..b5b9b4086143 100644 +--- a/fs/ecryptfs/inode.c ++++ b/fs/ecryptfs/inode.c +@@ -1093,7 +1093,7 @@ ecryptfs_setxattr(struct dentry *dentry, const char *name, const void *value, + } + + rc = vfs_setxattr(lower_dentry, name, value, size, flags); +- if (!rc) ++ if (!rc && dentry->d_inode) + fsstack_copy_attr_all(dentry->d_inode, lower_dentry->d_inode); + out: + return rc; +diff --git a/fs/ext3/super.c b/fs/ext3/super.c +index ef4c812c7a63..564f9429b3b1 100644 +--- a/fs/ext3/super.c ++++ b/fs/ext3/super.c +@@ -1292,13 +1292,6 @@ set_qf_format: + "not specified."); + return 0; + } +- } else { +- if (sbi->s_jquota_fmt) { +- ext3_msg(sb, KERN_ERR, "error: journaled quota format " +- "specified with no journaling " +- "enabled."); +- return 0; +- } + } + #endif + return 1; +diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h +index 521ba9d18ce6..b9cdb6df8d2b 100644 +--- a/fs/ext4/ext4.h ++++ b/fs/ext4/ext4.h +@@ -1891,6 +1891,7 @@ int ext4_get_block(struct inode *inode, sector_t iblock, + struct buffer_head *bh_result, int create); + + extern struct inode *ext4_iget(struct super_block *, unsigned long); ++extern struct inode *ext4_iget_normal(struct super_block *, unsigned long); + extern int ext4_write_inode(struct inode *, struct writeback_control *); + extern int ext4_setattr(struct dentry *, struct iattr *); + extern int ext4_getattr(struct vfsmount *mnt, struct dentry *dentry, +diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c +index 75c4f36bced8..97ca4b6fb2a9 100644 +--- a/fs/ext4/ialloc.c ++++ b/fs/ext4/ialloc.c +@@ -725,6 +725,10 @@ got: + struct buffer_head *block_bitmap_bh; + + block_bitmap_bh = ext4_read_block_bitmap(sb, group); ++ if (!block_bitmap_bh) { ++ err = -EIO; ++ goto out; ++ } + BUFFER_TRACE(block_bitmap_bh, "get block bitmap access"); + err = ext4_journal_get_write_access(handle, block_bitmap_bh); + if (err) { +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index 5b6dcba304b1..9e9db425c613 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -157,16 +157,14 @@ void ext4_evict_inode(struct inode *inode) + goto no_delete; + } + +- if (!is_bad_inode(inode)) +- dquot_initialize(inode); ++ if (is_bad_inode(inode)) ++ goto no_delete; ++ dquot_initialize(inode); + + if (ext4_should_order_data(inode)) + ext4_begin_ordered_truncate(inode, 0); + truncate_inode_pages(&inode->i_data, 0); + +- if (is_bad_inode(inode)) +- goto no_delete; +- + handle = ext4_journal_start(inode, ext4_blocks_for_truncate(inode)+3); + if (IS_ERR(handle)) { + ext4_std_error(inode->i_sb, PTR_ERR(handle)); +@@ -2410,6 +2408,20 @@ static int ext4_nonda_switch(struct super_block *sb) + return 0; + } + ++/* We always reserve for an inode update; the superblock could be there too */ ++static int ext4_da_write_credits(struct inode *inode, loff_t pos, unsigned len) ++{ ++ if (likely(EXT4_HAS_RO_COMPAT_FEATURE(inode->i_sb, ++ EXT4_FEATURE_RO_COMPAT_LARGE_FILE))) ++ return 1; ++ ++ if (pos + len <= 0x7fffffffULL) ++ return 1; ++ ++ /* We might need to update the superblock to set LARGE_FILE */ ++ return 2; ++} ++ + static int ext4_da_write_begin(struct file *file, struct address_space *mapping, + loff_t pos, unsigned len, unsigned flags, + struct page **pagep, void **fsdata) +@@ -2436,7 +2448,8 @@ retry: + * to journalling the i_disksize update if writes to the end + * of file which has an already mapped buffer. + */ +- handle = ext4_journal_start(inode, 1); ++ handle = ext4_journal_start(inode, ++ ext4_da_write_credits(inode, pos, len)); + if (IS_ERR(handle)) { + ret = PTR_ERR(handle); + goto out; +@@ -3840,6 +3853,13 @@ bad_inode: + return ERR_PTR(ret); + } + ++struct inode *ext4_iget_normal(struct super_block *sb, unsigned long ino) ++{ ++ if (ino < EXT4_FIRST_INO(sb) && ino != EXT4_ROOT_INO) ++ return ERR_PTR(-EIO); ++ return ext4_iget(sb, ino); ++} ++ + static int ext4_inode_blocks_set(handle_t *handle, + struct ext4_inode *raw_inode, + struct ext4_inode_info *ei) +diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c +index 665e55ca208c..dc5852301da7 100644 +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -1051,7 +1051,7 @@ static struct dentry *ext4_lookup(struct inode *dir, struct dentry *dentry, stru + dentry->d_name.name); + return ERR_PTR(-EIO); + } +- inode = ext4_iget(dir->i_sb, ino); ++ inode = ext4_iget_normal(dir->i_sb, ino); + if (inode == ERR_PTR(-ESTALE)) { + EXT4_ERROR_INODE(dir, + "deleted inode referenced: %u", +@@ -1087,7 +1087,7 @@ struct dentry *ext4_get_parent(struct dentry *child) + return ERR_PTR(-EIO); + } + +- return d_obtain_alias(ext4_iget(child->d_inode->i_sb, ino)); ++ return d_obtain_alias(ext4_iget_normal(child->d_inode->i_sb, ino)); + } + + #define S_SHIFT 12 +@@ -1421,31 +1421,38 @@ static int make_indexed_dir(handle_t *handle, struct dentry *dentry, + hinfo.hash_version += EXT4_SB(dir->i_sb)->s_hash_unsigned; + hinfo.seed = EXT4_SB(dir->i_sb)->s_hash_seed; + ext4fs_dirhash(name, namelen, &hinfo); ++ memset(frames, 0, sizeof(frames)); + frame = frames; + frame->entries = entries; + frame->at = entries; + frame->bh = bh; + bh = bh2; + +- ext4_handle_dirty_metadata(handle, dir, frame->bh); +- ext4_handle_dirty_metadata(handle, dir, bh); ++ retval = ext4_handle_dirty_metadata(handle, dir, frame->bh); ++ if (retval) ++ goto out_frames; ++ retval = ext4_handle_dirty_metadata(handle, dir, bh); ++ if (retval) ++ goto out_frames; + + de = do_split(handle,dir, &bh, frame, &hinfo, &retval); + if (!de) { +- /* +- * Even if the block split failed, we have to properly write +- * out all the changes we did so far. Otherwise we can end up +- * with corrupted filesystem. +- */ +- ext4_mark_inode_dirty(handle, dir); +- dx_release(frames); +- return retval; ++ goto out_frames; + } + dx_release(frames); + + retval = add_dirent_to_buf(handle, dentry, inode, de, bh); + brelse(bh); + return retval; ++out_frames: ++ /* ++ * Even if the block split failed, we have to properly write ++ * out all the changes we did so far. Otherwise we can end up ++ * with corrupted filesystem. ++ */ ++ ext4_mark_inode_dirty(handle, dir); ++ dx_release(frames); ++ return retval; + } + + /* +@@ -1992,7 +1999,7 @@ int ext4_orphan_add(handle_t *handle, struct inode *inode) + struct ext4_iloc iloc; + int err = 0, rc; + +- if (!ext4_handle_valid(handle)) ++ if (!ext4_handle_valid(handle) || is_bad_inode(inode)) + return 0; + + mutex_lock(&EXT4_SB(sb)->s_orphan_lock); +diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c +index a43e43c835d1..cfd321104250 100644 +--- a/fs/ext4/resize.c ++++ b/fs/ext4/resize.c +@@ -991,7 +991,7 @@ static void update_backups(struct super_block *sb, + (err = ext4_journal_restart(handle, EXT4_MAX_TRANS_DATA))) + break; + +- bh = sb_getblk(sb, group * bpg + blk_off); ++ bh = sb_getblk(sb, ((ext4_fsblk_t)group) * bpg + blk_off); + if (!bh) { + err = -ENOMEM; + break; +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index f0e4e46867f7..92ea560efcc7 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -1041,7 +1041,7 @@ static struct inode *ext4_nfs_get_inode(struct super_block *sb, + * Currently we don't know the generation for parent directory, so + * a generation of 0 means "accept any" + */ +- inode = ext4_iget(sb, ino); ++ inode = ext4_iget_normal(sb, ino); + if (IS_ERR(inode)) + return ERR_CAST(inode); + if (generation && inode->i_generation != generation) { +@@ -1642,13 +1642,6 @@ static int parse_options(char *options, struct super_block *sb, + "not specified"); + return 0; + } +- } else { +- if (sbi->s_jquota_fmt) { +- ext4_msg(sb, KERN_ERR, "journaled quota format " +- "specified with no journaling " +- "enabled"); +- return 0; +- } + } + #endif + if (test_opt(sb, DIOREAD_NOLOCK)) { +diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c +index 5743e9db8027..96455e6988fe 100644 +--- a/fs/ext4/xattr.c ++++ b/fs/ext4/xattr.c +@@ -144,14 +144,28 @@ ext4_listxattr(struct dentry *dentry, char *buffer, size_t size) + } + + static int +-ext4_xattr_check_names(struct ext4_xattr_entry *entry, void *end) ++ext4_xattr_check_names(struct ext4_xattr_entry *entry, void *end, ++ void *value_start) + { +- while (!IS_LAST_ENTRY(entry)) { +- struct ext4_xattr_entry *next = EXT4_XATTR_NEXT(entry); ++ struct ext4_xattr_entry *e = entry; ++ ++ while (!IS_LAST_ENTRY(e)) { ++ struct ext4_xattr_entry *next = EXT4_XATTR_NEXT(e); + if ((void *)next >= end) + return -EIO; +- entry = next; ++ e = next; + } ++ ++ while (!IS_LAST_ENTRY(entry)) { ++ if (entry->e_value_size != 0 && ++ (value_start + le16_to_cpu(entry->e_value_offs) < ++ (void *)e + sizeof(__u32) || ++ value_start + le16_to_cpu(entry->e_value_offs) + ++ le32_to_cpu(entry->e_value_size) > end)) ++ return -EIO; ++ entry = EXT4_XATTR_NEXT(entry); ++ } ++ + return 0; + } + +@@ -161,7 +175,8 @@ ext4_xattr_check_block(struct buffer_head *bh) + if (BHDR(bh)->h_magic != cpu_to_le32(EXT4_XATTR_MAGIC) || + BHDR(bh)->h_blocks != cpu_to_le32(1)) + return -EIO; +- return ext4_xattr_check_names(BFIRST(bh), bh->b_data + bh->b_size); ++ return ext4_xattr_check_names(BFIRST(bh), bh->b_data + bh->b_size, ++ bh->b_data); + } + + static inline int +@@ -274,7 +289,7 @@ ext4_xattr_ibody_get(struct inode *inode, int name_index, const char *name, + header = IHDR(inode, raw_inode); + entry = IFIRST(header); + end = (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size; +- error = ext4_xattr_check_names(entry, end); ++ error = ext4_xattr_check_names(entry, end, entry); + if (error) + goto cleanup; + error = ext4_xattr_find_entry(&entry, name_index, name, +@@ -402,7 +417,7 @@ ext4_xattr_ibody_list(struct dentry *dentry, char *buffer, size_t buffer_size) + raw_inode = ext4_raw_inode(&iloc); + header = IHDR(inode, raw_inode); + end = (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size; +- error = ext4_xattr_check_names(IFIRST(header), end); ++ error = ext4_xattr_check_names(IFIRST(header), end, IFIRST(header)); + if (error) + goto cleanup; + error = ext4_xattr_list_entries(dentry, IFIRST(header), +@@ -914,7 +929,8 @@ ext4_xattr_ibody_find(struct inode *inode, struct ext4_xattr_info *i, + is->s.here = is->s.first; + is->s.end = (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size; + if (ext4_test_inode_state(inode, EXT4_STATE_XATTR)) { +- error = ext4_xattr_check_names(IFIRST(header), is->s.end); ++ error = ext4_xattr_check_names(IFIRST(header), is->s.end, ++ IFIRST(header)); + if (error) + return error; + /* Find the named attribute. */ +diff --git a/fs/ioprio.c b/fs/ioprio.c +index 0f1b9515213b..0dd6a2a7ae82 100644 +--- a/fs/ioprio.c ++++ b/fs/ioprio.c +@@ -153,14 +153,16 @@ out: + + int ioprio_best(unsigned short aprio, unsigned short bprio) + { +- unsigned short aclass = IOPRIO_PRIO_CLASS(aprio); +- unsigned short bclass = IOPRIO_PRIO_CLASS(bprio); ++ unsigned short aclass; ++ unsigned short bclass; + +- if (aclass == IOPRIO_CLASS_NONE) +- aclass = IOPRIO_CLASS_BE; +- if (bclass == IOPRIO_CLASS_NONE) +- bclass = IOPRIO_CLASS_BE; ++ if (!ioprio_valid(aprio)) ++ aprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, IOPRIO_NORM); ++ if (!ioprio_valid(bprio)) ++ bprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, IOPRIO_NORM); + ++ aclass = IOPRIO_PRIO_CLASS(aprio); ++ bclass = IOPRIO_PRIO_CLASS(bprio); + if (aclass == bclass) + return min(aprio, bprio); + if (aclass > bclass) +diff --git a/fs/lockd/mon.c b/fs/lockd/mon.c +index 606a8dd8818c..0a68e0b22839 100644 +--- a/fs/lockd/mon.c ++++ b/fs/lockd/mon.c +@@ -114,6 +114,12 @@ static int nsm_mon_unmon(struct nsm_handle *nsm, u32 proc, struct nsm_res *res, + + msg.rpc_proc = &clnt->cl_procinfo[proc]; + status = rpc_call_sync(clnt, &msg, 0); ++ if (status == -ECONNREFUSED) { ++ dprintk("lockd: NSM upcall RPC failed, status=%d, forcing rebind\n", ++ status); ++ rpc_force_rebind(clnt); ++ status = rpc_call_sync(clnt, &msg, RPC_TASK_SOFTCONN); ++ } + if (status < 0) + dprintk("lockd: NSM upcall RPC failed, status=%d\n", + status); +diff --git a/fs/namespace.c b/fs/namespace.c +index f0f2e067c5df..f7be8d9c1cd6 100644 +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -2508,6 +2508,9 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root, + /* make sure we can reach put_old from new_root */ + if (!is_path_reachable(real_mount(old.mnt), old.dentry, &new)) + goto out4; ++ /* make certain new is below the root */ ++ if (!is_path_reachable(new_mnt, new.dentry, &root)) ++ goto out4; + br_write_lock(vfsmount_lock); + detach_mnt(new_mnt, &parent_path); + detach_mnt(root_mnt, &root_parent); +diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c +index 9bb4e5c541b0..a6d59054e8b3 100644 +--- a/fs/nfs/inode.c ++++ b/fs/nfs/inode.c +@@ -512,7 +512,7 @@ int nfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat) + { + struct inode *inode = dentry->d_inode; + int need_atime = NFS_I(inode)->cache_validity & NFS_INO_INVALID_ATIME; +- int err; ++ int err = 0; + + /* Flush out writes to the server in order to update c/mtime. */ + if (S_ISREG(inode->i_mode)) { +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 527a4fc12546..3d344ab0bdb3 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -1740,6 +1740,28 @@ static int nfs4_open_expired(struct nfs4_state_owner *sp, struct nfs4_state *sta + return ret; + } + ++static void nfs_finish_clear_delegation_stateid(struct nfs4_state *state) ++{ ++ nfs_remove_bad_delegation(state->inode); ++ write_seqlock(&state->seqlock); ++ nfs4_stateid_copy(&state->stateid, &state->open_stateid); ++ write_sequnlock(&state->seqlock); ++ clear_bit(NFS_DELEGATED_STATE, &state->flags); ++} ++ ++static void nfs40_clear_delegation_stateid(struct nfs4_state *state) ++{ ++ if (rcu_access_pointer(NFS_I(state->inode)->delegation) != NULL) ++ nfs_finish_clear_delegation_stateid(state); ++} ++ ++static int nfs40_open_expired(struct nfs4_state_owner *sp, struct nfs4_state *state) ++{ ++ /* NFSv4.0 doesn't allow for delegation recovery on open expire */ ++ nfs40_clear_delegation_stateid(state); ++ return nfs4_open_expired(sp, state); ++} ++ + #if defined(CONFIG_NFS_V4_1) + static int nfs41_check_expired_stateid(struct nfs4_state *state, nfs4_stateid *stateid, unsigned int flags) + { +@@ -5796,7 +5818,7 @@ static int nfs41_proc_async_sequence(struct nfs_client *clp, struct rpc_cred *cr + int ret = 0; + + if ((renew_flags & NFS4_RENEW_TIMEOUT) == 0) +- return 0; ++ return -EAGAIN; + task = _nfs41_proc_sequence(clp, cred, &nfs41_sequence_ops); + if (IS_ERR(task)) + ret = PTR_ERR(task); +@@ -6547,7 +6569,7 @@ static const struct nfs4_state_recovery_ops nfs41_reboot_recovery_ops = { + static const struct nfs4_state_recovery_ops nfs40_nograce_recovery_ops = { + .owner_flag_bit = NFS_OWNER_RECLAIM_NOGRACE, + .state_flag_bit = NFS_STATE_RECLAIM_NOGRACE, +- .recover_open = nfs4_open_expired, ++ .recover_open = nfs40_open_expired, + .recover_lock = nfs4_lock_expired, + .establish_clid = nfs4_init_clientid, + .get_clid_cred = nfs4_get_setclientid_cred, +diff --git a/fs/nfs/nfs4renewd.c b/fs/nfs/nfs4renewd.c +index dc484c0eae7f..78071cf90079 100644 +--- a/fs/nfs/nfs4renewd.c ++++ b/fs/nfs/nfs4renewd.c +@@ -88,10 +88,18 @@ nfs4_renew_state(struct work_struct *work) + } + nfs_expire_all_delegations(clp); + } else { ++ int ret; ++ + /* Queue an asynchronous RENEW. */ +- ops->sched_state_renewal(clp, cred, renew_flags); ++ ret = ops->sched_state_renewal(clp, cred, renew_flags); + put_rpccred(cred); +- goto out_exp; ++ switch (ret) { ++ default: ++ goto out_exp; ++ case -EAGAIN: ++ case -ENOMEM: ++ break; ++ } + } + } else { + dprintk("%s: failed to call renewd. Reason: lease not expired \n", +diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c +index 461816beff13..c4600b59744a 100644 +--- a/fs/nfs/nfs4state.c ++++ b/fs/nfs/nfs4state.c +@@ -1515,7 +1515,8 @@ restart: + if (status < 0) { + set_bit(ops->owner_flag_bit, &sp->so_flags); + nfs4_put_state_owner(sp); +- return nfs4_recovery_handle_error(clp, status); ++ status = nfs4_recovery_handle_error(clp, status); ++ return (status != 0) ? status : -EAGAIN; + } + + nfs4_put_state_owner(sp); +@@ -1524,7 +1525,7 @@ restart: + spin_unlock(&clp->cl_lock); + } + rcu_read_unlock(); +- return status; ++ return 0; + } + + static int nfs4_check_lease(struct nfs_client *clp) +@@ -1796,23 +1797,18 @@ static void nfs4_state_manager(struct nfs_client *clp) + if (test_bit(NFS4CLNT_RECLAIM_REBOOT, &clp->cl_state)) { + status = nfs4_do_reclaim(clp, + clp->cl_mvops->reboot_recovery_ops); +- if (test_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state) || +- test_bit(NFS4CLNT_SESSION_RESET, &clp->cl_state)) +- continue; +- nfs4_state_end_reclaim_reboot(clp); +- if (test_bit(NFS4CLNT_RECLAIM_NOGRACE, &clp->cl_state)) ++ if (status == -EAGAIN) + continue; + if (status < 0) + goto out_error; ++ nfs4_state_end_reclaim_reboot(clp); + } + + /* Now recover expired state... */ + if (test_and_clear_bit(NFS4CLNT_RECLAIM_NOGRACE, &clp->cl_state)) { + status = nfs4_do_reclaim(clp, + clp->cl_mvops->nograce_recovery_ops); +- if (test_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state) || +- test_bit(NFS4CLNT_SESSION_RESET, &clp->cl_state) || +- test_bit(NFS4CLNT_RECLAIM_REBOOT, &clp->cl_state)) ++ if (status == -EAGAIN) + continue; + if (status < 0) + goto out_error; +diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c +index 22beaff3544a..b2ce878080be 100644 +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -1132,7 +1132,8 @@ static bool need_wrongsec_check(struct svc_rqst *rqstp) + */ + if (argp->opcnt == resp->opcnt) + return false; +- ++ if (next->opnum == OP_ILLEGAL) ++ return false; + nextd = OPDESC(next); + /* + * Rest of 2.6.3.1.1: certain operations will return WRONGSEC +diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c +index 48bc91d60fce..97d91f046265 100644 +--- a/fs/notify/fanotify/fanotify_user.c ++++ b/fs/notify/fanotify/fanotify_user.c +@@ -67,7 +67,7 @@ static int create_fd(struct fsnotify_group *group, struct fsnotify_event *event) + + pr_debug("%s: group=%p event=%p\n", __func__, group, event); + +- client_fd = get_unused_fd(); ++ client_fd = get_unused_fd_flags(group->fanotify_data.f_flags); + if (client_fd < 0) + return client_fd; + +diff --git a/fs/super.c b/fs/super.c +index 3c520a5ed715..d0154e52c76b 100644 +--- a/fs/super.c ++++ b/fs/super.c +@@ -69,6 +69,8 @@ static int prune_super(struct shrinker *shrink, struct shrink_control *sc) + + total_objects = sb->s_nr_dentry_unused + + sb->s_nr_inodes_unused + fs_objects + 1; ++ if (!total_objects) ++ total_objects = 1; + + if (sc->nr_to_scan) { + int dentries; +diff --git a/fs/ubifs/commit.c b/fs/ubifs/commit.c +index fb3b5c813a30..b2ca12fd593b 100644 +--- a/fs/ubifs/commit.c ++++ b/fs/ubifs/commit.c +@@ -166,15 +166,10 @@ static int do_commit(struct ubifs_info *c) + err = ubifs_orphan_end_commit(c); + if (err) + goto out; +- old_ltail_lnum = c->ltail_lnum; +- err = ubifs_log_end_commit(c, new_ltail_lnum); +- if (err) +- goto out; + err = dbg_check_old_index(c, &zroot); + if (err) + goto out; + +- mutex_lock(&c->mst_mutex); + c->mst_node->cmt_no = cpu_to_le64(c->cmt_no); + c->mst_node->log_lnum = cpu_to_le32(new_ltail_lnum); + c->mst_node->root_lnum = cpu_to_le32(zroot.lnum); +@@ -203,8 +198,9 @@ static int do_commit(struct ubifs_info *c) + c->mst_node->flags |= cpu_to_le32(UBIFS_MST_NO_ORPHS); + else + c->mst_node->flags &= ~cpu_to_le32(UBIFS_MST_NO_ORPHS); +- err = ubifs_write_master(c); +- mutex_unlock(&c->mst_mutex); ++ ++ old_ltail_lnum = c->ltail_lnum; ++ err = ubifs_log_end_commit(c, new_ltail_lnum); + if (err) + goto out; + +diff --git a/fs/ubifs/log.c b/fs/ubifs/log.c +index f9fd068d1ae0..843beda25767 100644 +--- a/fs/ubifs/log.c ++++ b/fs/ubifs/log.c +@@ -110,10 +110,14 @@ static inline long long empty_log_bytes(const struct ubifs_info *c) + h = (long long)c->lhead_lnum * c->leb_size + c->lhead_offs; + t = (long long)c->ltail_lnum * c->leb_size; + +- if (h >= t) ++ if (h > t) + return c->log_bytes - h + t; +- else ++ else if (h != t) + return t - h; ++ else if (c->lhead_lnum != c->ltail_lnum) ++ return 0; ++ else ++ return c->log_bytes; + } + + /** +@@ -453,9 +457,9 @@ out: + * @ltail_lnum: new log tail LEB number + * + * This function is called on when the commit operation was finished. It +- * moves log tail to new position and unmaps LEBs which contain obsolete data. +- * Returns zero in case of success and a negative error code in case of +- * failure. ++ * moves log tail to new position and updates the master node so that it stores ++ * the new log tail LEB number. Returns zero in case of success and a negative ++ * error code in case of failure. + */ + int ubifs_log_end_commit(struct ubifs_info *c, int ltail_lnum) + { +@@ -483,7 +487,12 @@ int ubifs_log_end_commit(struct ubifs_info *c, int ltail_lnum) + spin_unlock(&c->buds_lock); + + err = dbg_check_bud_bytes(c); ++ if (err) ++ goto out; + ++ err = ubifs_write_master(c); ++ ++out: + mutex_unlock(&c->log_mutex); + return err; + } +diff --git a/fs/ubifs/master.c b/fs/ubifs/master.c +index 278c2382e8c2..bb9f48107815 100644 +--- a/fs/ubifs/master.c ++++ b/fs/ubifs/master.c +@@ -352,10 +352,9 @@ int ubifs_read_master(struct ubifs_info *c) + * ubifs_write_master - write master node. + * @c: UBIFS file-system description object + * +- * This function writes the master node. The caller has to take the +- * @c->mst_mutex lock before calling this function. Returns zero in case of +- * success and a negative error code in case of failure. The master node is +- * written twice to enable recovery. ++ * This function writes the master node. Returns zero in case of success and a ++ * negative error code in case of failure. The master node is written twice to ++ * enable recovery. + */ + int ubifs_write_master(struct ubifs_info *c) + { +diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c +index d867bd97bc60..129bb488ce75 100644 +--- a/fs/ubifs/super.c ++++ b/fs/ubifs/super.c +@@ -1984,7 +1984,6 @@ static struct ubifs_info *alloc_ubifs_info(struct ubi_volume_desc *ubi) + mutex_init(&c->lp_mutex); + mutex_init(&c->tnc_mutex); + mutex_init(&c->log_mutex); +- mutex_init(&c->mst_mutex); + mutex_init(&c->umount_mutex); + mutex_init(&c->bu_mutex); + mutex_init(&c->write_reserve_mutex); +diff --git a/fs/ubifs/ubifs.h b/fs/ubifs/ubifs.h +index 3f962617e29b..cd62067aea85 100644 +--- a/fs/ubifs/ubifs.h ++++ b/fs/ubifs/ubifs.h +@@ -1041,7 +1041,6 @@ struct ubifs_debug_info; + * + * @mst_node: master node + * @mst_offs: offset of valid master node +- * @mst_mutex: protects the master node area, @mst_node, and @mst_offs + * + * @max_bu_buf_len: maximum bulk-read buffer length + * @bu_mutex: protects the pre-allocated bulk-read buffer and @c->bu +@@ -1281,7 +1280,6 @@ struct ubifs_info { + + struct ubifs_mst_node *mst_node; + int mst_offs; +- struct mutex mst_mutex; + + int max_bu_buf_len; + struct mutex bu_mutex; +diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h +index 757f98066d6b..53baa0d7c34f 100644 +--- a/include/drm/drm_pciids.h ++++ b/include/drm/drm_pciids.h +@@ -56,7 +56,6 @@ + {0x1002, 0x4C64, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV250|RADEON_IS_MOBILITY}, \ + {0x1002, 0x4C66, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV250|RADEON_IS_MOBILITY}, \ + {0x1002, 0x4C67, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV250|RADEON_IS_MOBILITY}, \ +- {0x1002, 0x4C6E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV280|RADEON_IS_MOBILITY}, \ + {0x1002, 0x4E44, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R300}, \ + {0x1002, 0x4E45, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R300}, \ + {0x1002, 0x4E46, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R300}, \ +diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h +index 4d4ac24a263e..01b7047b60df 100644 +--- a/include/linux/blkdev.h ++++ b/include/linux/blkdev.h +@@ -1069,10 +1069,9 @@ static inline int queue_alignment_offset(struct request_queue *q) + static inline int queue_limit_alignment_offset(struct queue_limits *lim, sector_t sector) + { + unsigned int granularity = max(lim->physical_block_size, lim->io_min); +- unsigned int alignment = (sector << 9) & (granularity - 1); ++ unsigned int alignment = sector_div(sector, granularity >> 9) << 9; + +- return (granularity + lim->alignment_offset - alignment) +- & (granularity - 1); ++ return (granularity + lim->alignment_offset - alignment) % granularity; + } + + static inline int bdev_alignment_offset(struct block_device *bdev) +diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h +index 7970e31c8c0e..ea9cffe22ec4 100644 +--- a/include/linux/compiler-gcc.h ++++ b/include/linux/compiler-gcc.h +@@ -37,6 +37,9 @@ + __asm__ ("" : "=r"(__ptr) : "0"(ptr)); \ + (typeof(ptr)) (__ptr + (off)); }) + ++/* Make the optimizer believe the variable can be manipulated arbitrarily. */ ++#define OPTIMIZER_HIDE_VAR(var) __asm__ ("" : "=r" (var) : "0" (var)) ++ + #ifdef __CHECKER__ + #define __must_be_array(arr) 0 + #else +diff --git a/include/linux/compiler-gcc5.h b/include/linux/compiler-gcc5.h +new file mode 100644 +index 000000000000..cdd1cc202d51 +--- /dev/null ++++ b/include/linux/compiler-gcc5.h +@@ -0,0 +1,66 @@ ++#ifndef __LINUX_COMPILER_H ++#error "Please don't include directly, include instead." ++#endif ++ ++#define __used __attribute__((__used__)) ++#define __must_check __attribute__((warn_unused_result)) ++#define __compiler_offsetof(a, b) __builtin_offsetof(a, b) ++ ++/* Mark functions as cold. gcc will assume any path leading to a call ++ to them will be unlikely. This means a lot of manual unlikely()s ++ are unnecessary now for any paths leading to the usual suspects ++ like BUG(), printk(), panic() etc. [but let's keep them for now for ++ older compilers] ++ ++ Early snapshots of gcc 4.3 don't support this and we can't detect this ++ in the preprocessor, but we can live with this because they're unreleased. ++ Maketime probing would be overkill here. ++ ++ gcc also has a __attribute__((__hot__)) to move hot functions into ++ a special section, but I don't see any sense in this right now in ++ the kernel context */ ++#define __cold __attribute__((__cold__)) ++ ++#define __UNIQUE_ID(prefix) __PASTE(__PASTE(__UNIQUE_ID_, prefix), __COUNTER__) ++ ++#ifndef __CHECKER__ ++# define __compiletime_warning(message) __attribute__((warning(message))) ++# define __compiletime_error(message) __attribute__((error(message))) ++#endif /* __CHECKER__ */ ++ ++/* ++ * Mark a position in code as unreachable. This can be used to ++ * suppress control flow warnings after asm blocks that transfer ++ * control elsewhere. ++ * ++ * Early snapshots of gcc 4.5 don't support this and we can't detect ++ * this in the preprocessor, but we can live with this because they're ++ * unreleased. Really, we need to have autoconf for the kernel. ++ */ ++#define unreachable() __builtin_unreachable() ++ ++/* Mark a function definition as prohibited from being cloned. */ ++#define __noclone __attribute__((__noclone__)) ++ ++/* ++ * Tell the optimizer that something else uses this function or variable. ++ */ ++#define __visible __attribute__((externally_visible)) ++ ++/* ++ * GCC 'asm goto' miscompiles certain code sequences: ++ * ++ * http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58670 ++ * ++ * Work it around via a compiler barrier quirk suggested by Jakub Jelinek. ++ * Fixed in GCC 4.8.2 and later versions. ++ * ++ * (asm goto is automatically volatile - the naming reflects this.) ++ */ ++#define asm_volatile_goto(x...) do { asm goto(x); asm (""); } while (0) ++ ++#ifdef CONFIG_ARCH_USE_BUILTIN_BSWAP ++#define __HAVE_BUILTIN_BSWAP32__ ++#define __HAVE_BUILTIN_BSWAP64__ ++#define __HAVE_BUILTIN_BSWAP16__ ++#endif /* CONFIG_ARCH_USE_BUILTIN_BSWAP */ +diff --git a/include/linux/compiler-intel.h b/include/linux/compiler-intel.h +index cba9593c4047..1a97cac7dcb2 100644 +--- a/include/linux/compiler-intel.h ++++ b/include/linux/compiler-intel.h +@@ -15,6 +15,7 @@ + */ + #undef barrier + #undef RELOC_HIDE ++#undef OPTIMIZER_HIDE_VAR + + #define barrier() __memory_barrier() + +@@ -23,6 +24,12 @@ + __ptr = (unsigned long) (ptr); \ + (typeof(ptr)) (__ptr + (off)); }) + ++/* This should act as an optimization barrier on var. ++ * Given that this compiler does not have inline assembly, a compiler barrier ++ * is the best we can do. ++ */ ++#define OPTIMIZER_HIDE_VAR(var) barrier() ++ + /* Intel ECC compiler doesn't support __builtin_types_compatible_p() */ + #define __must_be_array(a) 0 + +diff --git a/include/linux/khugepaged.h b/include/linux/khugepaged.h +index 6b394f0b5148..eeb307985715 100644 +--- a/include/linux/khugepaged.h ++++ b/include/linux/khugepaged.h +@@ -6,7 +6,8 @@ + #ifdef CONFIG_TRANSPARENT_HUGEPAGE + extern int __khugepaged_enter(struct mm_struct *mm); + extern void __khugepaged_exit(struct mm_struct *mm); +-extern int khugepaged_enter_vma_merge(struct vm_area_struct *vma); ++extern int khugepaged_enter_vma_merge(struct vm_area_struct *vma, ++ unsigned long vm_flags); + + #define khugepaged_enabled() \ + (transparent_hugepage_flags & \ +@@ -35,13 +36,13 @@ static inline void khugepaged_exit(struct mm_struct *mm) + __khugepaged_exit(mm); + } + +-static inline int khugepaged_enter(struct vm_area_struct *vma) ++static inline int khugepaged_enter(struct vm_area_struct *vma, ++ unsigned long vm_flags) + { + if (!test_bit(MMF_VM_HUGEPAGE, &vma->vm_mm->flags)) + if ((khugepaged_always() || +- (khugepaged_req_madv() && +- vma->vm_flags & VM_HUGEPAGE)) && +- !(vma->vm_flags & VM_NOHUGEPAGE)) ++ (khugepaged_req_madv() && (vm_flags & VM_HUGEPAGE))) && ++ !(vm_flags & VM_NOHUGEPAGE)) + if (__khugepaged_enter(vma->vm_mm)) + return -ENOMEM; + return 0; +@@ -54,11 +55,13 @@ static inline int khugepaged_fork(struct mm_struct *mm, struct mm_struct *oldmm) + static inline void khugepaged_exit(struct mm_struct *mm) + { + } +-static inline int khugepaged_enter(struct vm_area_struct *vma) ++static inline int khugepaged_enter(struct vm_area_struct *vma, ++ unsigned long vm_flags) + { + return 0; + } +-static inline int khugepaged_enter_vma_merge(struct vm_area_struct *vma) ++static inline int khugepaged_enter_vma_merge(struct vm_area_struct *vma, ++ unsigned long vm_flags) + { + return 0; + } +diff --git a/include/linux/mm.h b/include/linux/mm.h +index dbca4b21b7d3..656b4e968991 100644 +--- a/include/linux/mm.h ++++ b/include/linux/mm.h +@@ -953,6 +953,7 @@ static inline void unmap_shared_mapping_range(struct address_space *mapping, + + extern void truncate_pagecache(struct inode *inode, loff_t old, loff_t new); + extern void truncate_setsize(struct inode *inode, loff_t newsize); ++void pagecache_isize_extended(struct inode *inode, loff_t from, loff_t to); + extern int vmtruncate(struct inode *inode, loff_t offset); + extern int vmtruncate_range(struct inode *inode, loff_t offset, loff_t end); + void truncate_pagecache_range(struct inode *inode, loff_t offset, loff_t end); +diff --git a/include/linux/of.h b/include/linux/of.h +index fa7fb1d97458..ac58796df055 100644 +--- a/include/linux/of.h ++++ b/include/linux/of.h +@@ -212,14 +212,12 @@ extern int of_property_read_u64(const struct device_node *np, + extern int of_property_read_string(struct device_node *np, + const char *propname, + const char **out_string); +-extern int of_property_read_string_index(struct device_node *np, +- const char *propname, +- int index, const char **output); + extern int of_property_match_string(struct device_node *np, + const char *propname, + const char *string); +-extern int of_property_count_strings(struct device_node *np, +- const char *propname); ++extern int of_property_read_string_helper(struct device_node *np, ++ const char *propname, ++ const char **out_strs, size_t sz, int index); + extern int of_device_is_compatible(const struct device_node *device, + const char *); + extern int of_device_is_available(const struct device_node *device); +@@ -304,15 +302,9 @@ static inline int of_property_read_string(struct device_node *np, + return -ENOSYS; + } + +-static inline int of_property_read_string_index(struct device_node *np, +- const char *propname, int index, +- const char **out_string) +-{ +- return -ENOSYS; +-} +- +-static inline int of_property_count_strings(struct device_node *np, +- const char *propname) ++static inline int of_property_read_string_helper(struct device_node *np, ++ const char *propname, ++ const char **out_strs, size_t sz, int index) + { + return -ENOSYS; + } +@@ -352,6 +344,70 @@ static inline int of_machine_is_compatible(const char *compat) + #endif /* CONFIG_OF */ + + /** ++ * of_property_read_string_array() - Read an array of strings from a multiple ++ * strings property. ++ * @np: device node from which the property value is to be read. ++ * @propname: name of the property to be searched. ++ * @out_strs: output array of string pointers. ++ * @sz: number of array elements to read. ++ * ++ * Search for a property in a device tree node and retrieve a list of ++ * terminated string values (pointer to data, not a copy) in that property. ++ * ++ * If @out_strs is NULL, the number of strings in the property is returned. ++ */ ++static inline int of_property_read_string_array(struct device_node *np, ++ const char *propname, const char **out_strs, ++ size_t sz) ++{ ++ return of_property_read_string_helper(np, propname, out_strs, sz, 0); ++} ++ ++/** ++ * of_property_count_strings() - Find and return the number of strings from a ++ * multiple strings property. ++ * @np: device node from which the property value is to be read. ++ * @propname: name of the property to be searched. ++ * ++ * Search for a property in a device tree node and retrieve the number of null ++ * terminated string contain in it. Returns the number of strings on ++ * success, -EINVAL if the property does not exist, -ENODATA if property ++ * does not have a value, and -EILSEQ if the string is not null-terminated ++ * within the length of the property data. ++ */ ++static inline int of_property_count_strings(struct device_node *np, ++ const char *propname) ++{ ++ return of_property_read_string_helper(np, propname, NULL, 0, 0); ++} ++ ++/** ++ * of_property_read_string_index() - Find and read a string from a multiple ++ * strings property. ++ * @np: device node from which the property value is to be read. ++ * @propname: name of the property to be searched. ++ * @index: index of the string in the list of strings ++ * @out_string: pointer to null terminated return string, modified only if ++ * return value is 0. ++ * ++ * Search for a property in a device tree node and retrieve a null ++ * terminated string value (pointer to data, not a copy) in the list of strings ++ * contained in that property. ++ * Returns 0 on success, -EINVAL if the property does not exist, -ENODATA if ++ * property does not have a value, and -EILSEQ if the string is not ++ * null-terminated within the length of the property data. ++ * ++ * The out_string pointer is modified only if a valid string can be decoded. ++ */ ++static inline int of_property_read_string_index(struct device_node *np, ++ const char *propname, ++ int index, const char **output) ++{ ++ int rc = of_property_read_string_helper(np, propname, output, 1, index); ++ return rc < 0 ? rc : 0; ++} ++ ++/** + * of_property_read_bool - Findfrom a property + * @np: device node from which the property value is to be read. + * @propname: name of the property to be searched. +diff --git a/include/linux/oom.h b/include/linux/oom.h +index 3d7647536b03..d6ed7b05e31c 100644 +--- a/include/linux/oom.h ++++ b/include/linux/oom.h +@@ -45,6 +45,10 @@ extern int test_set_oom_score_adj(int new_val); + + extern unsigned int oom_badness(struct task_struct *p, struct mem_cgroup *memcg, + const nodemask_t *nodemask, unsigned long totalpages); ++ ++extern int oom_kills_count(void); ++extern void note_oom_kill(void); ++ + extern int try_set_zonelist_oom(struct zonelist *zonelist, gfp_t gfp_flags); + extern void clear_zonelist_oom(struct zonelist *zonelist, gfp_t gfp_flags); + +diff --git a/include/linux/string.h b/include/linux/string.h +index e033564f10ba..3d9feb70dc20 100644 +--- a/include/linux/string.h ++++ b/include/linux/string.h +@@ -133,7 +133,7 @@ int bprintf(u32 *bin_buf, size_t size, const char *fmt, ...) __printf(3, 4); + #endif + + extern ssize_t memory_read_from_buffer(void *to, size_t count, loff_t *ppos, +- const void *from, size_t available); ++ const void *from, size_t available); + + /** + * strstarts - does @str start with @prefix? +@@ -144,5 +144,7 @@ static inline bool strstarts(const char *str, const char *prefix) + { + return strncmp(str, prefix, strlen(prefix)) == 0; + } ++ ++void memzero_explicit(void *s, size_t count); + #endif + #endif /* _LINUX_STRING_H_ */ +diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h +index 3e93de7ecbc3..d0d2af09dcc6 100644 +--- a/include/linux/usb/quirks.h ++++ b/include/linux/usb/quirks.h +@@ -30,4 +30,10 @@ + descriptor */ + #define USB_QUIRK_DELAY_INIT 0x00000040 + ++/* device generates spurious wakeup, ignore remote wakeup capability */ ++#define USB_QUIRK_IGNORE_REMOTE_WAKEUP 0x00000200 ++ ++/* device can't handle device_qualifier descriptor requests */ ++#define USB_QUIRK_DEVICE_QUALIFIER 0x00000100 ++ + #endif /* __LINUX_USB_QUIRKS_H */ +diff --git a/include/net/ipv6.h b/include/net/ipv6.h +index 117eaa578d0d..8898a191929a 100644 +--- a/include/net/ipv6.h ++++ b/include/net/ipv6.h +@@ -485,6 +485,7 @@ static inline int ipv6_addr_diff(const struct in6_addr *a1, const struct in6_add + } + + extern void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt); ++void ipv6_proxy_select_ident(struct sk_buff *skb); + + /* + * Prototypes exported by ipv6 +diff --git a/kernel/audit_tree.c b/kernel/audit_tree.c +index 0caf1f8de0fb..8a142844318f 100644 +--- a/kernel/audit_tree.c ++++ b/kernel/audit_tree.c +@@ -154,6 +154,7 @@ static struct audit_chunk *alloc_chunk(int count) + chunk->owners[i].index = i; + } + fsnotify_init_mark(&chunk->mark, audit_tree_destroy_watch); ++ chunk->mark.mask = FS_IN_IGNORED; + return chunk; + } + +diff --git a/kernel/freezer.c b/kernel/freezer.c +index 11f82a4d4eae..2f8ecd994d47 100644 +--- a/kernel/freezer.c ++++ b/kernel/freezer.c +@@ -36,6 +36,9 @@ bool freezing_slow_path(struct task_struct *p) + if (p->flags & PF_NOFREEZE) + return false; + ++ if (test_thread_flag(TIF_MEMDIE)) ++ return false; ++ + if (pm_nosig_freezing || cgroup_freezing(p)) + return true; + +diff --git a/kernel/futex.c b/kernel/futex.c +index 41dfb1866f95..6b320c2ad6fa 100644 +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -212,6 +212,8 @@ static void drop_futex_key_refs(union futex_key *key) + case FUT_OFF_MMSHARED: + mmdrop(key->private.mm); + break; ++ default: ++ smp_mb(); /* explicit MB (B) */ + } + } + +@@ -484,8 +486,14 @@ static struct futex_pi_state * alloc_pi_state(void) + return pi_state; + } + ++/* ++ * Must be called with the hb lock held. ++ */ + static void free_pi_state(struct futex_pi_state *pi_state) + { ++ if (!pi_state) ++ return; ++ + if (!atomic_dec_and_test(&pi_state->refcount)) + return; + +@@ -1399,15 +1407,6 @@ static int futex_requeue(u32 __user *uaddr1, unsigned int flags, + } + + retry: +- if (pi_state != NULL) { +- /* +- * We will have to lookup the pi_state again, so free this one +- * to keep the accounting correct. +- */ +- free_pi_state(pi_state); +- pi_state = NULL; +- } +- + ret = get_futex_key(uaddr1, flags & FLAGS_SHARED, &key1, VERIFY_READ); + if (unlikely(ret != 0)) + goto out; +@@ -1495,6 +1494,8 @@ retry_private: + case 0: + break; + case -EFAULT: ++ free_pi_state(pi_state); ++ pi_state = NULL; + double_unlock_hb(hb1, hb2); + put_futex_key(&key2); + put_futex_key(&key1); +@@ -1504,6 +1505,8 @@ retry_private: + goto out; + case -EAGAIN: + /* The owner was exiting, try again. */ ++ free_pi_state(pi_state); ++ pi_state = NULL; + double_unlock_hb(hb1, hb2); + put_futex_key(&key2); + put_futex_key(&key1); +@@ -1580,6 +1583,7 @@ retry_private: + } + + out_unlock: ++ free_pi_state(pi_state); + double_unlock_hb(hb1, hb2); + + /* +@@ -1596,8 +1600,6 @@ out_put_keys: + out_put_key1: + put_futex_key(&key1); + out: +- if (pi_state != NULL) +- free_pi_state(pi_state); + return ret ? ret : task_count; + } + +diff --git a/kernel/posix-timers.c b/kernel/posix-timers.c +index e885be1e8a11..02824a5c2693 100644 +--- a/kernel/posix-timers.c ++++ b/kernel/posix-timers.c +@@ -589,6 +589,7 @@ SYSCALL_DEFINE3(timer_create, const clockid_t, which_clock, + goto out; + } + } else { ++ memset(&event.sigev_value, 0, sizeof(event.sigev_value)); + event.sigev_notify = SIGEV_SIGNAL; + event.sigev_signo = SIGALRM; + event.sigev_value.sival_int = new_timer->it_id; +diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c +index 52a18173c845..dd875cbe0d1a 100644 +--- a/kernel/power/hibernate.c ++++ b/kernel/power/hibernate.c +@@ -486,8 +486,14 @@ int hibernation_restore(int platform_mode) + error = dpm_suspend_start(PMSG_QUIESCE); + if (!error) { + error = resume_target_kernel(platform_mode); +- dpm_resume_end(PMSG_RECOVER); ++ /* ++ * The above should either succeed and jump to the new kernel, ++ * or return with an error. Otherwise things are just ++ * undefined, so let's be paranoid. ++ */ ++ BUG_ON(!error); + } ++ dpm_resume_end(PMSG_RECOVER); + pm_restore_gfp_mask(); + ftrace_start(); + resume_console(); +diff --git a/kernel/power/process.c b/kernel/power/process.c +index f27d0c8cd9e8..286ff570f3b7 100644 +--- a/kernel/power/process.c ++++ b/kernel/power/process.c +@@ -114,6 +114,28 @@ static int try_to_freeze_tasks(bool user_only) + return todo ? -EBUSY : 0; + } + ++/* ++ * Returns true if all freezable tasks (except for current) are frozen already ++ */ ++static bool check_frozen_processes(void) ++{ ++ struct task_struct *g, *p; ++ bool ret = true; ++ ++ read_lock(&tasklist_lock); ++ for_each_process_thread(g, p) { ++ if (p != current && !freezer_should_skip(p) && ++ !frozen(p)) { ++ ret = false; ++ goto done; ++ } ++ } ++done: ++ read_unlock(&tasklist_lock); ++ ++ return ret; ++} ++ + /** + * freeze_processes - Signal user space processes to enter the refrigerator. + * +@@ -122,6 +144,7 @@ static int try_to_freeze_tasks(bool user_only) + int freeze_processes(void) + { + int error; ++ int oom_kills_saved; + + error = __usermodehelper_disable(UMH_FREEZING); + if (error) +@@ -132,12 +155,27 @@ int freeze_processes(void) + + printk("Freezing user space processes ... "); + pm_freezing = true; ++ oom_kills_saved = oom_kills_count(); + error = try_to_freeze_tasks(true); + if (!error) { +- printk("done."); + __usermodehelper_set_disable_depth(UMH_DISABLED); + oom_killer_disable(); ++ ++ /* ++ * There might have been an OOM kill while we were ++ * freezing tasks and the killed task might be still ++ * on the way out so we have to double check for race. ++ */ ++ if (oom_kills_count() != oom_kills_saved && ++ !check_frozen_processes()) { ++ __usermodehelper_set_disable_depth(UMH_ENABLED); ++ printk("OOM in progress."); ++ error = -EBUSY; ++ goto done; ++ } ++ printk("done."); + } ++done: + printk("\n"); + BUG_ON(in_atomic()); + +diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c +index c9ce09addacd..4d0a209ecfda 100644 +--- a/kernel/trace/trace_syscalls.c ++++ b/kernel/trace/trace_syscalls.c +@@ -309,7 +309,7 @@ void ftrace_syscall_enter(void *ignore, struct pt_regs *regs, long id) + int pc; + + syscall_nr = syscall_get_nr(current, regs); +- if (syscall_nr < 0) ++ if (syscall_nr < 0 || syscall_nr >= NR_syscalls) + return; + if (!test_bit(syscall_nr, enabled_enter_syscalls)) + return; +@@ -349,7 +349,7 @@ void ftrace_syscall_exit(void *ignore, struct pt_regs *regs, long ret) + int pc; + + syscall_nr = syscall_get_nr(current, regs); +- if (syscall_nr < 0) ++ if (syscall_nr < 0 || syscall_nr >= NR_syscalls) + return; + if (!test_bit(syscall_nr, enabled_exit_syscalls)) + return; +@@ -519,6 +519,8 @@ static void perf_syscall_enter(void *ignore, struct pt_regs *regs, long id) + int size; + + syscall_nr = syscall_get_nr(current, regs); ++ if (syscall_nr < 0 || syscall_nr >= NR_syscalls) ++ return; + if (!test_bit(syscall_nr, enabled_perf_enter_syscalls)) + return; + +@@ -593,6 +595,8 @@ static void perf_syscall_exit(void *ignore, struct pt_regs *regs, long ret) + int size; + + syscall_nr = syscall_get_nr(current, regs); ++ if (syscall_nr < 0 || syscall_nr >= NR_syscalls) ++ return; + if (!test_bit(syscall_nr, enabled_perf_exit_syscalls)) + return; + +diff --git a/lib/bitmap.c b/lib/bitmap.c +index b5a8b6ad2454..6ccf2120b406 100644 +--- a/lib/bitmap.c ++++ b/lib/bitmap.c +@@ -131,7 +131,9 @@ void __bitmap_shift_right(unsigned long *dst, + lower = src[off + k]; + if (left && off + k == lim - 1) + lower &= mask; +- dst[k] = upper << (BITS_PER_LONG - rem) | lower >> rem; ++ dst[k] = lower >> rem; ++ if (rem) ++ dst[k] |= upper << (BITS_PER_LONG - rem); + if (left && k == lim - 1) + dst[k] &= mask; + } +@@ -172,7 +174,9 @@ void __bitmap_shift_left(unsigned long *dst, + upper = src[k]; + if (left && k == lim - 1) + upper &= (1UL << left) - 1; +- dst[k + off] = lower >> (BITS_PER_LONG - rem) | upper << rem; ++ dst[k + off] = upper << rem; ++ if (rem) ++ dst[k + off] |= lower >> (BITS_PER_LONG - rem); + if (left && k + off == lim - 1) + dst[k + off] &= (1UL << left) - 1; + } +diff --git a/lib/lzo/lzo1x_decompress_safe.c b/lib/lzo/lzo1x_decompress_safe.c +index 8563081e8da3..a1c387f6afba 100644 +--- a/lib/lzo/lzo1x_decompress_safe.c ++++ b/lib/lzo/lzo1x_decompress_safe.c +@@ -19,31 +19,21 @@ + #include + #include "lzodefs.h" + +-#define HAVE_IP(t, x) \ +- (((size_t)(ip_end - ip) >= (size_t)(t + x)) && \ +- (((t + x) >= t) && ((t + x) >= x))) ++#define HAVE_IP(x) ((size_t)(ip_end - ip) >= (size_t)(x)) ++#define HAVE_OP(x) ((size_t)(op_end - op) >= (size_t)(x)) ++#define NEED_IP(x) if (!HAVE_IP(x)) goto input_overrun ++#define NEED_OP(x) if (!HAVE_OP(x)) goto output_overrun ++#define TEST_LB(m_pos) if ((m_pos) < out) goto lookbehind_overrun + +-#define HAVE_OP(t, x) \ +- (((size_t)(op_end - op) >= (size_t)(t + x)) && \ +- (((t + x) >= t) && ((t + x) >= x))) +- +-#define NEED_IP(t, x) \ +- do { \ +- if (!HAVE_IP(t, x)) \ +- goto input_overrun; \ +- } while (0) +- +-#define NEED_OP(t, x) \ +- do { \ +- if (!HAVE_OP(t, x)) \ +- goto output_overrun; \ +- } while (0) +- +-#define TEST_LB(m_pos) \ +- do { \ +- if ((m_pos) < out) \ +- goto lookbehind_overrun; \ +- } while (0) ++/* This MAX_255_COUNT is the maximum number of times we can add 255 to a base ++ * count without overflowing an integer. The multiply will overflow when ++ * multiplying 255 by more than MAXINT/255. The sum will overflow earlier ++ * depending on the base count. Since the base count is taken from a u8 ++ * and a few bits, it is safe to assume that it will always be lower than ++ * or equal to 2*255, thus we can always prevent any overflow by accepting ++ * two less 255 steps. See Documentation/lzo.txt for more information. ++ */ ++#define MAX_255_COUNT ((((size_t)~0) / 255) - 2) + + int lzo1x_decompress_safe(const unsigned char *in, size_t in_len, + unsigned char *out, size_t *out_len) +@@ -75,17 +65,24 @@ int lzo1x_decompress_safe(const unsigned char *in, size_t in_len, + if (t < 16) { + if (likely(state == 0)) { + if (unlikely(t == 0)) { ++ size_t offset; ++ const unsigned char *ip_last = ip; ++ + while (unlikely(*ip == 0)) { +- t += 255; + ip++; +- NEED_IP(1, 0); ++ NEED_IP(1); + } +- t += 15 + *ip++; ++ offset = ip - ip_last; ++ if (unlikely(offset > MAX_255_COUNT)) ++ return LZO_E_ERROR; ++ ++ offset = (offset << 8) - offset; ++ t += offset + 15 + *ip++; + } + t += 3; + copy_literal_run: + #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) +- if (likely(HAVE_IP(t, 15) && HAVE_OP(t, 15))) { ++ if (likely(HAVE_IP(t + 15) && HAVE_OP(t + 15))) { + const unsigned char *ie = ip + t; + unsigned char *oe = op + t; + do { +@@ -101,8 +98,8 @@ copy_literal_run: + } else + #endif + { +- NEED_OP(t, 0); +- NEED_IP(t, 3); ++ NEED_OP(t); ++ NEED_IP(t + 3); + do { + *op++ = *ip++; + } while (--t > 0); +@@ -115,7 +112,7 @@ copy_literal_run: + m_pos -= t >> 2; + m_pos -= *ip++ << 2; + TEST_LB(m_pos); +- NEED_OP(2, 0); ++ NEED_OP(2); + op[0] = m_pos[0]; + op[1] = m_pos[1]; + op += 2; +@@ -136,13 +133,20 @@ copy_literal_run: + } else if (t >= 32) { + t = (t & 31) + (3 - 1); + if (unlikely(t == 2)) { ++ size_t offset; ++ const unsigned char *ip_last = ip; ++ + while (unlikely(*ip == 0)) { +- t += 255; + ip++; +- NEED_IP(1, 0); ++ NEED_IP(1); + } +- t += 31 + *ip++; +- NEED_IP(2, 0); ++ offset = ip - ip_last; ++ if (unlikely(offset > MAX_255_COUNT)) ++ return LZO_E_ERROR; ++ ++ offset = (offset << 8) - offset; ++ t += offset + 31 + *ip++; ++ NEED_IP(2); + } + m_pos = op - 1; + next = get_unaligned_le16(ip); +@@ -154,13 +158,20 @@ copy_literal_run: + m_pos -= (t & 8) << 11; + t = (t & 7) + (3 - 1); + if (unlikely(t == 2)) { ++ size_t offset; ++ const unsigned char *ip_last = ip; ++ + while (unlikely(*ip == 0)) { +- t += 255; + ip++; +- NEED_IP(1, 0); ++ NEED_IP(1); + } +- t += 7 + *ip++; +- NEED_IP(2, 0); ++ offset = ip - ip_last; ++ if (unlikely(offset > MAX_255_COUNT)) ++ return LZO_E_ERROR; ++ ++ offset = (offset << 8) - offset; ++ t += offset + 7 + *ip++; ++ NEED_IP(2); + } + next = get_unaligned_le16(ip); + ip += 2; +@@ -174,7 +185,7 @@ copy_literal_run: + #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) + if (op - m_pos >= 8) { + unsigned char *oe = op + t; +- if (likely(HAVE_OP(t, 15))) { ++ if (likely(HAVE_OP(t + 15))) { + do { + COPY8(op, m_pos); + op += 8; +@@ -184,7 +195,7 @@ copy_literal_run: + m_pos += 8; + } while (op < oe); + op = oe; +- if (HAVE_IP(6, 0)) { ++ if (HAVE_IP(6)) { + state = next; + COPY4(op, ip); + op += next; +@@ -192,7 +203,7 @@ copy_literal_run: + continue; + } + } else { +- NEED_OP(t, 0); ++ NEED_OP(t); + do { + *op++ = *m_pos++; + } while (op < oe); +@@ -201,7 +212,7 @@ copy_literal_run: + #endif + { + unsigned char *oe = op + t; +- NEED_OP(t, 0); ++ NEED_OP(t); + op[0] = m_pos[0]; + op[1] = m_pos[1]; + op += 2; +@@ -214,15 +225,15 @@ match_next: + state = next; + t = next; + #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) +- if (likely(HAVE_IP(6, 0) && HAVE_OP(4, 0))) { ++ if (likely(HAVE_IP(6) && HAVE_OP(4))) { + COPY4(op, ip); + op += t; + ip += t; + } else + #endif + { +- NEED_IP(t, 3); +- NEED_OP(t, 0); ++ NEED_IP(t + 3); ++ NEED_OP(t); + while (t > 0) { + *op++ = *ip++; + t--; +diff --git a/lib/string.c b/lib/string.c +index e5878de4f101..43d0781daf47 100644 +--- a/lib/string.c ++++ b/lib/string.c +@@ -586,6 +586,22 @@ void *memset(void *s, int c, size_t count) + EXPORT_SYMBOL(memset); + #endif + ++/** ++ * memzero_explicit - Fill a region of memory (e.g. sensitive ++ * keying data) with 0s. ++ * @s: Pointer to the start of the area. ++ * @count: The size of the area. ++ * ++ * memzero_explicit() doesn't need an arch-specific version as ++ * it just invokes the one of memset() implicitly. ++ */ ++void memzero_explicit(void *s, size_t count) ++{ ++ memset(s, 0, count); ++ OPTIMIZER_HIDE_VAR(s); ++} ++EXPORT_SYMBOL(memzero_explicit); ++ + #ifndef __HAVE_ARCH_MEMCPY + /** + * memcpy - Copy one area of memory to another +diff --git a/mm/huge_memory.c b/mm/huge_memory.c +index 3da5c0bff3b0..8978c1bf91e4 100644 +--- a/mm/huge_memory.c ++++ b/mm/huge_memory.c +@@ -711,7 +711,7 @@ int do_huge_pmd_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma, + if (haddr >= vma->vm_start && haddr + HPAGE_PMD_SIZE <= vma->vm_end) { + if (unlikely(anon_vma_prepare(vma))) + return VM_FAULT_OOM; +- if (unlikely(khugepaged_enter(vma))) ++ if (unlikely(khugepaged_enter(vma, vma->vm_flags))) + return VM_FAULT_OOM; + page = alloc_hugepage_vma(transparent_hugepage_defrag(vma), + vma, haddr, numa_node_id(), 0); +@@ -1505,7 +1505,7 @@ int hugepage_madvise(struct vm_area_struct *vma, + * register it here without waiting a page fault that + * may not happen any time soon. + */ +- if (unlikely(khugepaged_enter_vma_merge(vma))) ++ if (unlikely(khugepaged_enter_vma_merge(vma, *vm_flags))) + return -ENOMEM; + break; + case MADV_NOHUGEPAGE: +@@ -1637,7 +1637,8 @@ int __khugepaged_enter(struct mm_struct *mm) + return 0; + } + +-int khugepaged_enter_vma_merge(struct vm_area_struct *vma) ++int khugepaged_enter_vma_merge(struct vm_area_struct *vma, ++ unsigned long vm_flags) + { + unsigned long hstart, hend; + if (!vma->anon_vma) +@@ -1653,11 +1654,11 @@ int khugepaged_enter_vma_merge(struct vm_area_struct *vma) + * If is_pfn_mapping() is true is_learn_pfn_mapping() must be + * true too, verify it here. + */ +- VM_BUG_ON(is_linear_pfn_mapping(vma) || vma->vm_flags & VM_NO_THP); ++ VM_BUG_ON(is_linear_pfn_mapping(vma) || vm_flags & VM_NO_THP); + hstart = (vma->vm_start + ~HPAGE_PMD_MASK) & HPAGE_PMD_MASK; + hend = vma->vm_end & HPAGE_PMD_MASK; + if (hstart < hend) +- return khugepaged_enter(vma); ++ return khugepaged_enter(vma, vm_flags); + return 0; + } + +diff --git a/mm/memory.c b/mm/memory.c +index ffd74f370e8d..c34e60a950aa 100644 +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -1164,8 +1164,10 @@ again: + if (unlikely(page_mapcount(page) < 0)) + print_bad_pte(vma, addr, ptent, page); + force_flush = !__tlb_remove_page(tlb, page); +- if (force_flush) ++ if (force_flush) { ++ addr += PAGE_SIZE; + break; ++ } + continue; + } + /* +diff --git a/mm/mmap.c b/mm/mmap.c +index 69367e43e52e..94fdbe8f3b99 100644 +--- a/mm/mmap.c ++++ b/mm/mmap.c +@@ -826,7 +826,7 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm, + end, prev->vm_pgoff, NULL); + if (err) + return NULL; +- khugepaged_enter_vma_merge(prev); ++ khugepaged_enter_vma_merge(prev, vm_flags); + return prev; + } + +@@ -845,7 +845,7 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm, + next->vm_pgoff - pglen, NULL); + if (err) + return NULL; +- khugepaged_enter_vma_merge(area); ++ khugepaged_enter_vma_merge(area, vm_flags); + return area; + } + +@@ -1820,7 +1820,7 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address) + } + } + vma_unlock_anon_vma(vma); +- khugepaged_enter_vma_merge(vma); ++ khugepaged_enter_vma_merge(vma, vma->vm_flags); + return error; + } + #endif /* CONFIG_STACK_GROWSUP || CONFIG_IA64 */ +@@ -1871,7 +1871,7 @@ int expand_downwards(struct vm_area_struct *vma, + } + } + vma_unlock_anon_vma(vma); +- khugepaged_enter_vma_merge(vma); ++ khugepaged_enter_vma_merge(vma, vma->vm_flags); + return error; + } + +diff --git a/mm/oom_kill.c b/mm/oom_kill.c +index 597ecac5731a..cb1f046faa68 100644 +--- a/mm/oom_kill.c ++++ b/mm/oom_kill.c +@@ -435,6 +435,23 @@ static void dump_header(struct task_struct *p, gfp_t gfp_mask, int order, + dump_tasks(memcg, nodemask); + } + ++/* ++ * Number of OOM killer invocations (including memcg OOM killer). ++ * Primarily used by PM freezer to check for potential races with ++ * OOM killed frozen task. ++ */ ++static atomic_t oom_kills = ATOMIC_INIT(0); ++ ++int oom_kills_count(void) ++{ ++ return atomic_read(&oom_kills); ++} ++ ++void note_oom_kill(void) ++{ ++ atomic_inc(&oom_kills); ++} ++ + #define K(x) ((x) << (PAGE_SHIFT-10)) + static void oom_kill_process(struct task_struct *p, gfp_t gfp_mask, int order, + unsigned int points, unsigned long totalpages, +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index ff0b0997b953..2891a9059f8a 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -1982,6 +1982,14 @@ __alloc_pages_may_oom(gfp_t gfp_mask, unsigned int order, + } + + /* ++ * PM-freezer should be notified that there might be an OOM killer on ++ * its way to kill and wake somebody up. This is too early and we might ++ * end up not killing anything but false positives are acceptable. ++ * See freeze_processes. ++ */ ++ note_oom_kill(); ++ ++ /* + * Go through the zonelist yet one more time, keep very high watermark + * here, this is only to catch a parallel oom killing, we must fail if + * we're still under heavy pressure. +diff --git a/mm/page_cgroup.c b/mm/page_cgroup.c +index 1ccbd714059c..b7693fdc6bb5 100644 +--- a/mm/page_cgroup.c ++++ b/mm/page_cgroup.c +@@ -170,6 +170,7 @@ static void free_page_cgroup(void *addr) + sizeof(struct page_cgroup) * PAGES_PER_SECTION; + + BUG_ON(PageReserved(page)); ++ kmemleak_free(addr); + free_pages_exact(addr, table_size); + } + } +diff --git a/mm/percpu.c b/mm/percpu.c +index 5f6042b61ca8..13b2eefabfdd 100644 +--- a/mm/percpu.c ++++ b/mm/percpu.c +@@ -1907,8 +1907,6 @@ void __init setup_per_cpu_areas(void) + + if (pcpu_setup_first_chunk(ai, fc) < 0) + panic("Failed to initialize percpu areas."); +- +- pcpu_free_alloc_info(ai); + } + + #endif /* CONFIG_SMP */ +diff --git a/mm/truncate.c b/mm/truncate.c +index f38055cb8af6..57625f7ed8e1 100644 +--- a/mm/truncate.c ++++ b/mm/truncate.c +@@ -20,6 +20,7 @@ + #include /* grr. try_to_release_page, + do_invalidatepage */ + #include ++#include + #include "internal.h" + + +@@ -571,16 +572,70 @@ EXPORT_SYMBOL(truncate_pagecache); + */ + void truncate_setsize(struct inode *inode, loff_t newsize) + { +- loff_t oldsize; +- +- oldsize = inode->i_size; ++ loff_t oldsize = inode->i_size; + i_size_write(inode, newsize); + ++ if (newsize > oldsize) ++ pagecache_isize_extended(inode, oldsize, newsize); + truncate_pagecache(inode, oldsize, newsize); + } + EXPORT_SYMBOL(truncate_setsize); + + /** ++ * pagecache_isize_extended - update pagecache after extension of i_size ++ * @inode: inode for which i_size was extended ++ * @from: original inode size ++ * @to: new inode size ++ * ++ * Handle extension of inode size either caused by extending truncate or by ++ * write starting after current i_size. We mark the page straddling current ++ * i_size RO so that page_mkwrite() is called on the nearest write access to ++ * the page. This way filesystem can be sure that page_mkwrite() is called on ++ * the page before user writes to the page via mmap after the i_size has been ++ * changed. ++ * ++ * The function must be called after i_size is updated so that page fault ++ * coming after we unlock the page will already see the new i_size. ++ * The function must be called while we still hold i_mutex - this not only ++ * makes sure i_size is stable but also that userspace cannot observe new ++ * i_size value before we are prepared to store mmap writes at new inode size. ++ */ ++void pagecache_isize_extended(struct inode *inode, loff_t from, loff_t to) ++{ ++ int bsize = 1 << inode->i_blkbits; ++ loff_t rounded_from; ++ struct page *page; ++ pgoff_t index; ++ ++ WARN_ON(to > inode->i_size); ++ ++ if (from >= to || bsize == PAGE_CACHE_SIZE) ++ return; ++ /* Page straddling @from will not have any hole block created? */ ++ rounded_from = round_up(from, bsize); ++ if (to <= rounded_from || !(rounded_from & (PAGE_CACHE_SIZE - 1))) ++ return; ++ ++ index = from >> PAGE_CACHE_SHIFT; ++ page = find_lock_page(inode->i_mapping, index); ++ /* Page not cached? Nothing to do */ ++ if (!page) ++ return; ++ /* ++ * See clear_page_dirty_for_io() for details why set_page_dirty() ++ * is needed. ++ */ ++ if (page_mkclean(page)) ++ set_page_dirty(page); ++ unlock_page(page); ++ page_cache_release(page); ++} ++EXPORT_SYMBOL(pagecache_isize_extended); ++ ++/** ++ * truncate_pagecache_range - unmap and remove pagecache that is hole-punched ++ * @inode: inode ++ * @lstart: offset of beginning of hole + * vmtruncate - unmap mappings "freed" by truncate() syscall + * @inode: inode of the file used + * @newsize: file offset to start truncating +diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c +index 605156f13899..61e2494dc188 100644 +--- a/net/bluetooth/smp.c ++++ b/net/bluetooth/smp.c +@@ -325,8 +325,11 @@ static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth, + } + + /* Not Just Works/Confirm results in MITM Authentication */ +- if (method != JUST_CFM) ++ if (method != JUST_CFM) { + set_bit(SMP_FLAG_MITM_AUTH, &smp->smp_flags); ++ if (hcon->pending_sec_level < BT_SECURITY_HIGH) ++ hcon->pending_sec_level = BT_SECURITY_HIGH; ++ } + + /* If both devices have Keyoard-Display I/O, the master + * Confirms and the slave Enters the passkey. +diff --git a/net/ceph/crypto.c b/net/ceph/crypto.c +index 9da7fdd3cd8a..3d1be9911b8e 100644 +--- a/net/ceph/crypto.c ++++ b/net/ceph/crypto.c +@@ -89,11 +89,82 @@ static struct crypto_blkcipher *ceph_crypto_alloc_cipher(void) + + static const u8 *aes_iv = (u8 *)CEPH_AES_IV; + ++/* ++ * Should be used for buffers allocated with ceph_kvmalloc(). ++ * Currently these are encrypt out-buffer (ceph_buffer) and decrypt ++ * in-buffer (msg front). ++ * ++ * Dispose of @sgt with teardown_sgtable(). ++ * ++ * @prealloc_sg is to avoid memory allocation inside sg_alloc_table() ++ * in cases where a single sg is sufficient. No attempt to reduce the ++ * number of sgs by squeezing physically contiguous pages together is ++ * made though, for simplicity. ++ */ ++static int setup_sgtable(struct sg_table *sgt, struct scatterlist *prealloc_sg, ++ const void *buf, unsigned int buf_len) ++{ ++ struct scatterlist *sg; ++ const bool is_vmalloc = is_vmalloc_addr(buf); ++ unsigned int off = offset_in_page(buf); ++ unsigned int chunk_cnt = 1; ++ unsigned int chunk_len = PAGE_ALIGN(off + buf_len); ++ int i; ++ int ret; ++ ++ if (buf_len == 0) { ++ memset(sgt, 0, sizeof(*sgt)); ++ return -EINVAL; ++ } ++ ++ if (is_vmalloc) { ++ chunk_cnt = chunk_len >> PAGE_SHIFT; ++ chunk_len = PAGE_SIZE; ++ } ++ ++ if (chunk_cnt > 1) { ++ ret = sg_alloc_table(sgt, chunk_cnt, GFP_NOFS); ++ if (ret) ++ return ret; ++ } else { ++ WARN_ON(chunk_cnt != 1); ++ sg_init_table(prealloc_sg, 1); ++ sgt->sgl = prealloc_sg; ++ sgt->nents = sgt->orig_nents = 1; ++ } ++ ++ for_each_sg(sgt->sgl, sg, sgt->orig_nents, i) { ++ struct page *page; ++ unsigned int len = min(chunk_len - off, buf_len); ++ ++ if (is_vmalloc) ++ page = vmalloc_to_page(buf); ++ else ++ page = virt_to_page(buf); ++ ++ sg_set_page(sg, page, len, off); ++ ++ off = 0; ++ buf += len; ++ buf_len -= len; ++ } ++ WARN_ON(buf_len != 0); ++ ++ return 0; ++} ++ ++static void teardown_sgtable(struct sg_table *sgt) ++{ ++ if (sgt->orig_nents > 1) ++ sg_free_table(sgt); ++} ++ + static int ceph_aes_encrypt(const void *key, int key_len, + void *dst, size_t *dst_len, + const void *src, size_t src_len) + { +- struct scatterlist sg_in[2], sg_out[1]; ++ struct scatterlist sg_in[2], prealloc_sg; ++ struct sg_table sg_out; + struct crypto_blkcipher *tfm = ceph_crypto_alloc_cipher(); + struct blkcipher_desc desc = { .tfm = tfm, .flags = 0 }; + int ret; +@@ -109,16 +180,18 @@ static int ceph_aes_encrypt(const void *key, int key_len, + + *dst_len = src_len + zero_padding; + +- crypto_blkcipher_setkey((void *)tfm, key, key_len); + sg_init_table(sg_in, 2); + sg_set_buf(&sg_in[0], src, src_len); + sg_set_buf(&sg_in[1], pad, zero_padding); +- sg_init_table(sg_out, 1); +- sg_set_buf(sg_out, dst, *dst_len); ++ ret = setup_sgtable(&sg_out, &prealloc_sg, dst, *dst_len); ++ if (ret) ++ goto out_tfm; ++ ++ crypto_blkcipher_setkey((void *)tfm, key, key_len); + iv = crypto_blkcipher_crt(tfm)->iv; + ivsize = crypto_blkcipher_ivsize(tfm); +- + memcpy(iv, aes_iv, ivsize); ++ + /* + print_hex_dump(KERN_ERR, "enc key: ", DUMP_PREFIX_NONE, 16, 1, + key, key_len, 1); +@@ -127,16 +200,22 @@ static int ceph_aes_encrypt(const void *key, int key_len, + print_hex_dump(KERN_ERR, "enc pad: ", DUMP_PREFIX_NONE, 16, 1, + pad, zero_padding, 1); + */ +- ret = crypto_blkcipher_encrypt(&desc, sg_out, sg_in, ++ ret = crypto_blkcipher_encrypt(&desc, sg_out.sgl, sg_in, + src_len + zero_padding); +- crypto_free_blkcipher(tfm); +- if (ret < 0) ++ if (ret < 0) { + pr_err("ceph_aes_crypt failed %d\n", ret); ++ goto out_sg; ++ } + /* + print_hex_dump(KERN_ERR, "enc out: ", DUMP_PREFIX_NONE, 16, 1, + dst, *dst_len, 1); + */ +- return 0; ++ ++out_sg: ++ teardown_sgtable(&sg_out); ++out_tfm: ++ crypto_free_blkcipher(tfm); ++ return ret; + } + + static int ceph_aes_encrypt2(const void *key, int key_len, void *dst, +@@ -144,7 +223,8 @@ static int ceph_aes_encrypt2(const void *key, int key_len, void *dst, + const void *src1, size_t src1_len, + const void *src2, size_t src2_len) + { +- struct scatterlist sg_in[3], sg_out[1]; ++ struct scatterlist sg_in[3], prealloc_sg; ++ struct sg_table sg_out; + struct crypto_blkcipher *tfm = ceph_crypto_alloc_cipher(); + struct blkcipher_desc desc = { .tfm = tfm, .flags = 0 }; + int ret; +@@ -160,17 +240,19 @@ static int ceph_aes_encrypt2(const void *key, int key_len, void *dst, + + *dst_len = src1_len + src2_len + zero_padding; + +- crypto_blkcipher_setkey((void *)tfm, key, key_len); + sg_init_table(sg_in, 3); + sg_set_buf(&sg_in[0], src1, src1_len); + sg_set_buf(&sg_in[1], src2, src2_len); + sg_set_buf(&sg_in[2], pad, zero_padding); +- sg_init_table(sg_out, 1); +- sg_set_buf(sg_out, dst, *dst_len); ++ ret = setup_sgtable(&sg_out, &prealloc_sg, dst, *dst_len); ++ if (ret) ++ goto out_tfm; ++ ++ crypto_blkcipher_setkey((void *)tfm, key, key_len); + iv = crypto_blkcipher_crt(tfm)->iv; + ivsize = crypto_blkcipher_ivsize(tfm); +- + memcpy(iv, aes_iv, ivsize); ++ + /* + print_hex_dump(KERN_ERR, "enc key: ", DUMP_PREFIX_NONE, 16, 1, + key, key_len, 1); +@@ -181,23 +263,30 @@ static int ceph_aes_encrypt2(const void *key, int key_len, void *dst, + print_hex_dump(KERN_ERR, "enc pad: ", DUMP_PREFIX_NONE, 16, 1, + pad, zero_padding, 1); + */ +- ret = crypto_blkcipher_encrypt(&desc, sg_out, sg_in, ++ ret = crypto_blkcipher_encrypt(&desc, sg_out.sgl, sg_in, + src1_len + src2_len + zero_padding); +- crypto_free_blkcipher(tfm); +- if (ret < 0) ++ if (ret < 0) { + pr_err("ceph_aes_crypt2 failed %d\n", ret); ++ goto out_sg; ++ } + /* + print_hex_dump(KERN_ERR, "enc out: ", DUMP_PREFIX_NONE, 16, 1, + dst, *dst_len, 1); + */ +- return 0; ++ ++out_sg: ++ teardown_sgtable(&sg_out); ++out_tfm: ++ crypto_free_blkcipher(tfm); ++ return ret; + } + + static int ceph_aes_decrypt(const void *key, int key_len, + void *dst, size_t *dst_len, + const void *src, size_t src_len) + { +- struct scatterlist sg_in[1], sg_out[2]; ++ struct sg_table sg_in; ++ struct scatterlist sg_out[2], prealloc_sg; + struct crypto_blkcipher *tfm = ceph_crypto_alloc_cipher(); + struct blkcipher_desc desc = { .tfm = tfm }; + char pad[16]; +@@ -209,16 +298,16 @@ static int ceph_aes_decrypt(const void *key, int key_len, + if (IS_ERR(tfm)) + return PTR_ERR(tfm); + +- crypto_blkcipher_setkey((void *)tfm, key, key_len); +- sg_init_table(sg_in, 1); + sg_init_table(sg_out, 2); +- sg_set_buf(sg_in, src, src_len); + sg_set_buf(&sg_out[0], dst, *dst_len); + sg_set_buf(&sg_out[1], pad, sizeof(pad)); ++ ret = setup_sgtable(&sg_in, &prealloc_sg, src, src_len); ++ if (ret) ++ goto out_tfm; + ++ crypto_blkcipher_setkey((void *)tfm, key, key_len); + iv = crypto_blkcipher_crt(tfm)->iv; + ivsize = crypto_blkcipher_ivsize(tfm); +- + memcpy(iv, aes_iv, ivsize); + + /* +@@ -227,12 +316,10 @@ static int ceph_aes_decrypt(const void *key, int key_len, + print_hex_dump(KERN_ERR, "dec in: ", DUMP_PREFIX_NONE, 16, 1, + src, src_len, 1); + */ +- +- ret = crypto_blkcipher_decrypt(&desc, sg_out, sg_in, src_len); +- crypto_free_blkcipher(tfm); ++ ret = crypto_blkcipher_decrypt(&desc, sg_out, sg_in.sgl, src_len); + if (ret < 0) { + pr_err("ceph_aes_decrypt failed %d\n", ret); +- return ret; ++ goto out_sg; + } + + if (src_len <= *dst_len) +@@ -250,7 +337,12 @@ static int ceph_aes_decrypt(const void *key, int key_len, + print_hex_dump(KERN_ERR, "dec out: ", DUMP_PREFIX_NONE, 16, 1, + dst, *dst_len, 1); + */ +- return 0; ++ ++out_sg: ++ teardown_sgtable(&sg_in); ++out_tfm: ++ crypto_free_blkcipher(tfm); ++ return ret; + } + + static int ceph_aes_decrypt2(const void *key, int key_len, +@@ -258,7 +350,8 @@ static int ceph_aes_decrypt2(const void *key, int key_len, + void *dst2, size_t *dst2_len, + const void *src, size_t src_len) + { +- struct scatterlist sg_in[1], sg_out[3]; ++ struct sg_table sg_in; ++ struct scatterlist sg_out[3], prealloc_sg; + struct crypto_blkcipher *tfm = ceph_crypto_alloc_cipher(); + struct blkcipher_desc desc = { .tfm = tfm }; + char pad[16]; +@@ -270,17 +363,17 @@ static int ceph_aes_decrypt2(const void *key, int key_len, + if (IS_ERR(tfm)) + return PTR_ERR(tfm); + +- sg_init_table(sg_in, 1); +- sg_set_buf(sg_in, src, src_len); + sg_init_table(sg_out, 3); + sg_set_buf(&sg_out[0], dst1, *dst1_len); + sg_set_buf(&sg_out[1], dst2, *dst2_len); + sg_set_buf(&sg_out[2], pad, sizeof(pad)); ++ ret = setup_sgtable(&sg_in, &prealloc_sg, src, src_len); ++ if (ret) ++ goto out_tfm; + + crypto_blkcipher_setkey((void *)tfm, key, key_len); + iv = crypto_blkcipher_crt(tfm)->iv; + ivsize = crypto_blkcipher_ivsize(tfm); +- + memcpy(iv, aes_iv, ivsize); + + /* +@@ -289,12 +382,10 @@ static int ceph_aes_decrypt2(const void *key, int key_len, + print_hex_dump(KERN_ERR, "dec in: ", DUMP_PREFIX_NONE, 16, 1, + src, src_len, 1); + */ +- +- ret = crypto_blkcipher_decrypt(&desc, sg_out, sg_in, src_len); +- crypto_free_blkcipher(tfm); ++ ret = crypto_blkcipher_decrypt(&desc, sg_out, sg_in.sgl, src_len); + if (ret < 0) { + pr_err("ceph_aes_decrypt failed %d\n", ret); +- return ret; ++ goto out_sg; + } + + if (src_len <= *dst1_len) +@@ -324,7 +415,11 @@ static int ceph_aes_decrypt2(const void *key, int key_len, + dst2, *dst2_len, 1); + */ + +- return 0; ++out_sg: ++ teardown_sgtable(&sg_in); ++out_tfm: ++ crypto_free_blkcipher(tfm); ++ return ret; + } + + +diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c +index 7827436ae843..330be870c1ef 100644 +--- a/net/ipv4/ip_output.c ++++ b/net/ipv4/ip_output.c +@@ -1346,10 +1346,10 @@ struct sk_buff *__ip_make_skb(struct sock *sk, + iph->ihl = 5; + iph->tos = inet->tos; + iph->frag_off = df; +- ip_select_ident(skb, sk); + iph->ttl = ttl; + iph->protocol = sk->sk_protocol; + ip_copy_addrs(iph, fl4); ++ ip_select_ident(skb, sk); + + if (opt) { + iph->ihl += opt->optlen>>2; +diff --git a/net/ipv6/Makefile b/net/ipv6/Makefile +index 686934acfac1..4b20d5606f6d 100644 +--- a/net/ipv6/Makefile ++++ b/net/ipv6/Makefile +@@ -37,6 +37,6 @@ obj-$(CONFIG_NETFILTER) += netfilter/ + obj-$(CONFIG_IPV6_SIT) += sit.o + obj-$(CONFIG_IPV6_TUNNEL) += ip6_tunnel.o + +-obj-y += addrconf_core.o exthdrs_core.o ++obj-y += addrconf_core.o exthdrs_core.o output_core.o + + obj-$(subst m,y,$(CONFIG_IPV6)) += inet6_hashtables.o +diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c +new file mode 100644 +index 000000000000..a6126c62a9be +--- /dev/null ++++ b/net/ipv6/output_core.c +@@ -0,0 +1,38 @@ ++#include ++#include ++#include ++#include ++ ++/* This function exists only for tap drivers that must support broken ++ * clients requesting UFO without specifying an IPv6 fragment ID. ++ * ++ * This is similar to ipv6_select_ident() but we use an independent hash ++ * seed to limit information leakage. ++ */ ++void ipv6_proxy_select_ident(struct sk_buff *skb) ++{ ++ static u32 ip6_proxy_idents_hashrnd __read_mostly; ++ static bool hashrnd_initialized = false; ++ struct in6_addr buf[2]; ++ struct in6_addr *addrs; ++ u32 hash, id; ++ ++ addrs = skb_header_pointer(skb, ++ skb_network_offset(skb) + ++ offsetof(struct ipv6hdr, saddr), ++ sizeof(buf), buf); ++ if (!addrs) ++ return; ++ ++ if (unlikely(!hashrnd_initialized)) { ++ hashrnd_initialized = true; ++ get_random_bytes(&ip6_proxy_idents_hashrnd, ++ sizeof(ip6_proxy_idents_hashrnd)); ++ } ++ hash = __ipv6_addr_jhash(&addrs[1], ip6_proxy_idents_hashrnd); ++ hash = __ipv6_addr_jhash(&addrs[0], hash); ++ ++ id = ip_idents_reserve(hash, 1); ++ skb_shinfo(skb)->ip6_frag_id = htonl(id); ++} ++EXPORT_SYMBOL_GPL(ipv6_proxy_select_ident); +diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c +index 95a04f02f30b..9f32756a302a 100644 +--- a/net/mac80211/iface.c ++++ b/net/mac80211/iface.c +@@ -395,10 +395,12 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, + u32 hw_reconf_flags = 0; + int i; + enum nl80211_channel_type orig_ct; ++ bool cancel_scan; + + clear_bit(SDATA_STATE_RUNNING, &sdata->state); + +- if (local->scan_sdata == sdata) ++ cancel_scan = local->scan_sdata == sdata; ++ if (cancel_scan) + ieee80211_scan_cancel(local); + + /* +@@ -562,6 +564,9 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, + + ieee80211_recalc_ps(local, -1); + ++ if (cancel_scan) ++ flush_delayed_work(&local->scan_work); ++ + if (local->open_count == 0) { + if (local->ops->napi_poll) + napi_disable(&local->napi); +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index f5ed86388555..32929b07269f 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -1486,11 +1486,14 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx) + sc = le16_to_cpu(hdr->seq_ctrl); + frag = sc & IEEE80211_SCTL_FRAG; + +- if (likely((!ieee80211_has_morefrags(fc) && frag == 0) || +- is_multicast_ether_addr(hdr->addr1))) { +- /* not fragmented */ ++ if (likely(!ieee80211_has_morefrags(fc) && frag == 0)) ++ goto out; ++ ++ if (is_multicast_ether_addr(hdr->addr1)) { ++ rx->local->dot11MulticastReceivedFrameCount++; + goto out; + } ++ + I802_DEBUG_INC(rx->local->rx_handlers_fragments); + + if (skb_linearize(rx->skb)) +@@ -1583,10 +1586,7 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx) + out: + if (rx->sta) + rx->sta->rx_packets++; +- if (is_multicast_ether_addr(hdr->addr1)) +- rx->local->dot11MulticastReceivedFrameCount++; +- else +- ieee80211_led_rx(rx->local); ++ ieee80211_led_rx(rx->local); + return RX_CONTINUE; + } + +diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c +index c487715698ab..d96b7f6a3b44 100644 +--- a/security/integrity/evm/evm_main.c ++++ b/security/integrity/evm/evm_main.c +@@ -282,9 +282,12 @@ int evm_inode_setxattr(struct dentry *dentry, const char *xattr_name, + { + const struct evm_ima_xattr_data *xattr_data = xattr_value; + +- if ((strcmp(xattr_name, XATTR_NAME_EVM) == 0) +- && (xattr_data->type == EVM_XATTR_HMAC)) +- return -EPERM; ++ if (strcmp(xattr_name, XATTR_NAME_EVM) == 0) { ++ if (!xattr_value_len) ++ return -EINVAL; ++ if (xattr_data->type != EVM_IMA_XATTR_DIGSIG) ++ return -EPERM; ++ } + return evm_protect_xattr(dentry, xattr_name, xattr_value, + xattr_value_len); + } +diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c +index 639e5c4028ff..cbae6d392087 100644 +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -436,6 +436,7 @@ next_inode: + list_entry(sbsec->isec_head.next, + struct inode_security_struct, list); + struct inode *inode = isec->inode; ++ list_del_init(&isec->list); + spin_unlock(&sbsec->isec_lock); + inode = igrab(inode); + if (inode) { +@@ -444,7 +445,6 @@ next_inode: + iput(inode); + } + spin_lock(&sbsec->isec_lock); +- list_del_init(&isec->list); + goto next_inode; + } + spin_unlock(&sbsec->isec_lock); +diff --git a/sound/core/pcm_compat.c b/sound/core/pcm_compat.c +index 91cdf9435fec..4dbb66ef435d 100644 +--- a/sound/core/pcm_compat.c ++++ b/sound/core/pcm_compat.c +@@ -204,6 +204,8 @@ static int snd_pcm_status_user_compat(struct snd_pcm_substream *substream, + if (err < 0) + return err; + ++ if (clear_user(src, sizeof(*src))) ++ return -EFAULT; + if (put_user(status.state, &src->state) || + put_user(status.trigger_tstamp.tv_sec, &src->trigger_tstamp.tv_sec) || + put_user(status.trigger_tstamp.tv_nsec, &src->trigger_tstamp.tv_nsec) || +diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c +index d776291d09a0..3a907935fa09 100644 +--- a/sound/core/pcm_native.c ++++ b/sound/core/pcm_native.c +@@ -3171,7 +3171,7 @@ static const struct vm_operations_struct snd_pcm_vm_ops_data_fault = { + + #ifndef ARCH_HAS_DMA_MMAP_COHERENT + /* This should be defined / handled globally! */ +-#ifdef CONFIG_ARM ++#if defined(CONFIG_ARM) || defined(CONFIG_ARM64) + #define ARCH_HAS_DMA_MMAP_COHERENT + #endif + #endif +diff --git a/sound/pci/emu10k1/emu10k1_callback.c b/sound/pci/emu10k1/emu10k1_callback.c +index a0afa5057488..f35284be7b02 100644 +--- a/sound/pci/emu10k1/emu10k1_callback.c ++++ b/sound/pci/emu10k1/emu10k1_callback.c +@@ -85,6 +85,8 @@ snd_emu10k1_ops_setup(struct snd_emux *emux) + * get more voice for pcm + * + * terminate most inactive voice and give it as a pcm voice. ++ * ++ * voice_lock is already held. + */ + int + snd_emu10k1_synth_get_voice(struct snd_emu10k1 *hw) +@@ -92,12 +94,10 @@ snd_emu10k1_synth_get_voice(struct snd_emu10k1 *hw) + struct snd_emux *emu; + struct snd_emux_voice *vp; + struct best_voice best[V_END]; +- unsigned long flags; + int i; + + emu = hw->synth; + +- spin_lock_irqsave(&emu->voice_lock, flags); + lookup_voices(emu, hw, best, 1); /* no OFF voices */ + for (i = 0; i < V_END; i++) { + if (best[i].voice >= 0) { +@@ -113,11 +113,9 @@ snd_emu10k1_synth_get_voice(struct snd_emu10k1 *hw) + vp->emu->num_voices--; + vp->ch = -1; + vp->state = SNDRV_EMUX_ST_OFF; +- spin_unlock_irqrestore(&emu->voice_lock, flags); + return ch; + } + } +- spin_unlock_irqrestore(&emu->voice_lock, flags); + + /* not found */ + return -ENOMEM; +diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c +index f0b8d8e38f71..c40b7ca7a143 100644 +--- a/sound/soc/codecs/sgtl5000.c ++++ b/sound/soc/codecs/sgtl5000.c +@@ -1313,8 +1313,7 @@ static int sgtl5000_probe(struct snd_soc_codec *codec) + + /* enable small pop, introduce 400ms delay in turning off */ + snd_soc_update_bits(codec, SGTL5000_CHIP_REF_CTRL, +- SGTL5000_SMALL_POP, +- SGTL5000_SMALL_POP); ++ SGTL5000_SMALL_POP, 1); + + /* disable short cut detector */ + snd_soc_write(codec, SGTL5000_CHIP_SHORT_CTRL, 0); +diff --git a/sound/soc/codecs/sgtl5000.h b/sound/soc/codecs/sgtl5000.h +index d3a68bbfea00..0bd6e1cd8200 100644 +--- a/sound/soc/codecs/sgtl5000.h ++++ b/sound/soc/codecs/sgtl5000.h +@@ -275,7 +275,7 @@ + #define SGTL5000_BIAS_CTRL_MASK 0x000e + #define SGTL5000_BIAS_CTRL_SHIFT 1 + #define SGTL5000_BIAS_CTRL_WIDTH 3 +-#define SGTL5000_SMALL_POP 0x0001 ++#define SGTL5000_SMALL_POP 0 + + /* + * SGTL5000_CHIP_MIC_CTRL +diff --git a/sound/soc/sh/fsi.c b/sound/soc/sh/fsi.c +index 91b728774dba..eb0599f29768 100644 +--- a/sound/soc/sh/fsi.c ++++ b/sound/soc/sh/fsi.c +@@ -1393,8 +1393,7 @@ static const struct snd_soc_dai_ops fsi_dai_ops = { + static struct snd_pcm_hardware fsi_pcm_hardware = { + .info = SNDRV_PCM_INFO_INTERLEAVED | + SNDRV_PCM_INFO_MMAP | +- SNDRV_PCM_INFO_MMAP_VALID | +- SNDRV_PCM_INFO_PAUSE, ++ SNDRV_PCM_INFO_MMAP_VALID, + .formats = FSI_FMTS, + .rates = FSI_RATES, + .rate_min = 8000, +diff --git a/sound/usb/card.c b/sound/usb/card.c +index 658ea1118a8e..43fca5231628 100644 +--- a/sound/usb/card.c ++++ b/sound/usb/card.c +@@ -568,18 +568,19 @@ static void snd_usb_audio_disconnect(struct usb_device *dev, + { + struct snd_card *card; + struct list_head *p; ++ bool was_shutdown; + + if (chip == (void *)-1L) + return; + + card = chip->card; + down_write(&chip->shutdown_rwsem); ++ was_shutdown = chip->shutdown; + chip->shutdown = 1; + up_write(&chip->shutdown_rwsem); + + mutex_lock(®ister_mutex); +- chip->num_interfaces--; +- if (chip->num_interfaces <= 0) { ++ if (!was_shutdown) { + snd_card_disconnect(card); + /* release the pcm resources */ + list_for_each(p, &chip->pcm_list) { +@@ -593,6 +594,10 @@ static void snd_usb_audio_disconnect(struct usb_device *dev, + list_for_each(p, &chip->mixer_list) { + snd_usb_mixer_disconnect(p); + } ++ } ++ ++ chip->num_interfaces--; ++ if (chip->num_interfaces <= 0) { + usb_chip[chip->index] = NULL; + mutex_unlock(®ister_mutex); + snd_card_free_when_closed(card); +diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h +index 915bc2cf73d9..5ef357983d92 100644 +--- a/sound/usb/quirks-table.h ++++ b/sound/usb/quirks-table.h +@@ -301,6 +301,36 @@ YAMAHA_DEVICE(0x105d, NULL), + } + } + }, ++{ ++ USB_DEVICE(0x0499, 0x1509), ++ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { ++ /* .vendor_name = "Yamaha", */ ++ /* .product_name = "Steinberg UR22", */ ++ .ifnum = QUIRK_ANY_INTERFACE, ++ .type = QUIRK_COMPOSITE, ++ .data = (const struct snd_usb_audio_quirk[]) { ++ { ++ .ifnum = 1, ++ .type = QUIRK_AUDIO_STANDARD_INTERFACE ++ }, ++ { ++ .ifnum = 2, ++ .type = QUIRK_AUDIO_STANDARD_INTERFACE ++ }, ++ { ++ .ifnum = 3, ++ .type = QUIRK_MIDI_YAMAHA ++ }, ++ { ++ .ifnum = 4, ++ .type = QUIRK_IGNORE_INTERFACE ++ }, ++ { ++ .ifnum = -1 ++ } ++ } ++ } ++}, + YAMAHA_DEVICE(0x2000, "DGP-7"), + YAMAHA_DEVICE(0x2001, "DGP-5"), + YAMAHA_DEVICE(0x2002, NULL), +diff --git a/virt/kvm/iommu.c b/virt/kvm/iommu.c +index defc9baa9a45..3225903ec91b 100644 +--- a/virt/kvm/iommu.c ++++ b/virt/kvm/iommu.c +@@ -43,13 +43,13 @@ static void kvm_iommu_put_pages(struct kvm *kvm, + gfn_t base_gfn, unsigned long npages); + + static pfn_t kvm_pin_pages(struct kvm *kvm, struct kvm_memory_slot *slot, +- gfn_t gfn, unsigned long size) ++ gfn_t gfn, unsigned long npages) + { + gfn_t end_gfn; + pfn_t pfn; + + pfn = gfn_to_pfn_memslot(kvm, slot, gfn); +- end_gfn = gfn + (size >> PAGE_SHIFT); ++ end_gfn = gfn + npages; + gfn += 1; + + if (is_error_pfn(pfn)) +@@ -117,7 +117,7 @@ int kvm_iommu_map_pages(struct kvm *kvm, struct kvm_memory_slot *slot) + * Pin all pages we are about to map in memory. This is + * important because we unmap and unpin in 4kb steps later. + */ +- pfn = kvm_pin_pages(kvm, slot, gfn, page_size); ++ pfn = kvm_pin_pages(kvm, slot, gfn, page_size >> PAGE_SHIFT); + if (is_error_pfn(pfn)) { + gfn += 1; + continue; +@@ -129,7 +129,7 @@ int kvm_iommu_map_pages(struct kvm *kvm, struct kvm_memory_slot *slot) + if (r) { + printk(KERN_ERR "kvm_iommu_map_address:" + "iommu failed to map pfn=%llx\n", pfn); +- kvm_unpin_pages(kvm, pfn, page_size); ++ kvm_unpin_pages(kvm, pfn, page_size >> PAGE_SHIFT); + goto unmap_pages; + } + +diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c +index bc5ed1412382..f4732bd2816c 100644 +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -52,6 +52,7 @@ + + #include + #include ++#include + #include + #include + +@@ -1744,6 +1745,9 @@ static long kvm_vcpu_ioctl(struct file *filp, + if (vcpu->kvm->mm != current->mm) + return -EIO; + ++ if (unlikely(_IOC_TYPE(ioctl) != KVMIO)) ++ return -EINVAL; ++ + #if defined(CONFIG_S390) || defined(CONFIG_PPC) + /* + * Special cases: vcpu ioctls that are asynchronous to vcpu execution, diff --git a/patch/kernel/sun5i-default/0012-patch-3.4.106-107.patch b/patch/kernel/sun5i-default/0012-patch-3.4.106-107.patch new file mode 100644 index 0000000000..0d9f7b8ef7 --- /dev/null +++ b/patch/kernel/sun5i-default/0012-patch-3.4.106-107.patch @@ -0,0 +1,8078 @@ +diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt +index 63740dae90a0..c7523c419c88 100644 +--- a/Documentation/kernel-parameters.txt ++++ b/Documentation/kernel-parameters.txt +@@ -979,6 +979,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted. + i8042.notimeout [HW] Ignore timeout condition signalled by controller + i8042.reset [HW] Reset the controller during init and cleanup + i8042.unlock [HW] Unlock (ignore) the keylock ++ i8042.kbdreset [HW] Reset device connected to KBD port + + i810= [HW,DRM] + +diff --git a/Makefile b/Makefile +index 649f1462ebf8..f53f41a8dd09 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 4 +-SUBLEVEL = 106 ++SUBLEVEL = 107 + EXTRAVERSION = + NAME = Saber-toothed Squirrel + +diff --git a/arch/alpha/mm/fault.c b/arch/alpha/mm/fault.c +index 5eecab1a84ef..f153733fb938 100644 +--- a/arch/alpha/mm/fault.c ++++ b/arch/alpha/mm/fault.c +@@ -149,6 +149,8 @@ do_page_fault(unsigned long address, unsigned long mmcsr, + if (unlikely(fault & VM_FAULT_ERROR)) { + if (fault & VM_FAULT_OOM) + goto out_of_memory; ++ else if (fault & VM_FAULT_SIGSEGV) ++ goto bad_area; + else if (fault & VM_FAULT_SIGBUS) + goto do_sigbus; + BUG(); +diff --git a/arch/arm/mm/proc-xscale.S b/arch/arm/mm/proc-xscale.S +index 98821530ae70..98646d0808ab 100644 +--- a/arch/arm/mm/proc-xscale.S ++++ b/arch/arm/mm/proc-xscale.S +@@ -531,7 +531,7 @@ ENTRY(cpu_xscale_do_suspend) + mrc p15, 0, r5, c15, c1, 0 @ CP access reg + mrc p15, 0, r6, c13, c0, 0 @ PID + mrc p15, 0, r7, c3, c0, 0 @ domain ID +- mrc p15, 0, r8, c1, c1, 0 @ auxiliary control reg ++ mrc p15, 0, r8, c1, c0, 1 @ auxiliary control reg + mrc p15, 0, r9, c1, c0, 0 @ control reg + bic r4, r4, #2 @ clear frequency change bit + stmia r0, {r4 - r9} @ store cp regs +@@ -548,7 +548,7 @@ ENTRY(cpu_xscale_do_resume) + mcr p15, 0, r6, c13, c0, 0 @ PID + mcr p15, 0, r7, c3, c0, 0 @ domain ID + mcr p15, 0, r1, c2, c0, 0 @ translation table base addr +- mcr p15, 0, r8, c1, c1, 0 @ auxiliary control reg ++ mcr p15, 0, r8, c1, c0, 1 @ auxiliary control reg + mov r0, r9 @ control register + b cpu_resume_mmu + ENDPROC(cpu_xscale_do_resume) +diff --git a/arch/avr32/mm/fault.c b/arch/avr32/mm/fault.c +index f7040a1e399f..632b649c7be0 100644 +--- a/arch/avr32/mm/fault.c ++++ b/arch/avr32/mm/fault.c +@@ -136,6 +136,8 @@ good_area: + if (unlikely(fault & VM_FAULT_ERROR)) { + if (fault & VM_FAULT_OOM) + goto out_of_memory; ++ else if (fault & VM_FAULT_SIGSEGV) ++ goto bad_area; + else if (fault & VM_FAULT_SIGBUS) + goto do_sigbus; + BUG(); +diff --git a/arch/cris/mm/fault.c b/arch/cris/mm/fault.c +index b4760d86e1bb..b07c00c01696 100644 +--- a/arch/cris/mm/fault.c ++++ b/arch/cris/mm/fault.c +@@ -167,6 +167,8 @@ do_page_fault(unsigned long address, struct pt_regs *regs, + if (unlikely(fault & VM_FAULT_ERROR)) { + if (fault & VM_FAULT_OOM) + goto out_of_memory; ++ else if (fault & VM_FAULT_SIGSEGV) ++ goto bad_area; + else if (fault & VM_FAULT_SIGBUS) + goto do_sigbus; + BUG(); +diff --git a/arch/frv/mm/fault.c b/arch/frv/mm/fault.c +index 331c1e2cfb67..854549617dd2 100644 +--- a/arch/frv/mm/fault.c ++++ b/arch/frv/mm/fault.c +@@ -166,6 +166,8 @@ asmlinkage void do_page_fault(int datammu, unsigned long esr0, unsigned long ear + if (unlikely(fault & VM_FAULT_ERROR)) { + if (fault & VM_FAULT_OOM) + goto out_of_memory; ++ else if (fault & VM_FAULT_SIGSEGV) ++ goto bad_area; + else if (fault & VM_FAULT_SIGBUS) + goto do_sigbus; + BUG(); +diff --git a/arch/ia64/mm/fault.c b/arch/ia64/mm/fault.c +index 02d29c2a132a..3c820ea4212f 100644 +--- a/arch/ia64/mm/fault.c ++++ b/arch/ia64/mm/fault.c +@@ -162,6 +162,8 @@ ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *re + */ + if (fault & VM_FAULT_OOM) { + goto out_of_memory; ++ } else if (fault & VM_FAULT_SIGSEGV) { ++ goto bad_area; + } else if (fault & VM_FAULT_SIGBUS) { + signal = SIGBUS; + goto bad_area; +diff --git a/arch/m32r/mm/fault.c b/arch/m32r/mm/fault.c +index 3cdfa9c1d091..06827fc92bbf 100644 +--- a/arch/m32r/mm/fault.c ++++ b/arch/m32r/mm/fault.c +@@ -198,6 +198,8 @@ good_area: + if (unlikely(fault & VM_FAULT_ERROR)) { + if (fault & VM_FAULT_OOM) + goto out_of_memory; ++ else if (fault & VM_FAULT_SIGSEGV) ++ goto bad_area; + else if (fault & VM_FAULT_SIGBUS) + goto do_sigbus; + BUG(); +diff --git a/arch/m68k/mm/fault.c b/arch/m68k/mm/fault.c +index 6b020a8461e7..8646409adf5b 100644 +--- a/arch/m68k/mm/fault.c ++++ b/arch/m68k/mm/fault.c +@@ -146,6 +146,8 @@ good_area: + if (unlikely(fault & VM_FAULT_ERROR)) { + if (fault & VM_FAULT_OOM) + goto out_of_memory; ++ else if (fault & VM_FAULT_SIGSEGV) ++ goto map_err; + else if (fault & VM_FAULT_SIGBUS) + goto bus_err; + BUG(); +diff --git a/arch/microblaze/mm/fault.c b/arch/microblaze/mm/fault.c +index c38a265846de..c7fe3da48593 100644 +--- a/arch/microblaze/mm/fault.c ++++ b/arch/microblaze/mm/fault.c +@@ -214,6 +214,8 @@ good_area: + if (unlikely(fault & VM_FAULT_ERROR)) { + if (fault & VM_FAULT_OOM) + goto out_of_memory; ++ else if (fault & VM_FAULT_SIGSEGV) ++ goto bad_area; + else if (fault & VM_FAULT_SIGBUS) + goto do_sigbus; + BUG(); +diff --git a/arch/mips/kernel/irq_cpu.c b/arch/mips/kernel/irq_cpu.c +index 972263bcf403..0ed44bef070d 100644 +--- a/arch/mips/kernel/irq_cpu.c ++++ b/arch/mips/kernel/irq_cpu.c +@@ -55,6 +55,8 @@ static struct irq_chip mips_cpu_irq_controller = { + .irq_mask_ack = mask_mips_irq, + .irq_unmask = unmask_mips_irq, + .irq_eoi = unmask_mips_irq, ++ .irq_disable = mask_mips_irq, ++ .irq_enable = unmask_mips_irq, + }; + + /* +@@ -91,6 +93,8 @@ static struct irq_chip mips_mt_cpu_irq_controller = { + .irq_mask_ack = mips_mt_cpu_irq_ack, + .irq_unmask = unmask_mips_irq, + .irq_eoi = unmask_mips_irq, ++ .irq_disable = mask_mips_irq, ++ .irq_enable = unmask_mips_irq, + }; + + void __init mips_cpu_irq_init(void) +diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c +index ba9376bf52a1..7c2c1afe73f3 100644 +--- a/arch/mips/kernel/smp.c ++++ b/arch/mips/kernel/smp.c +@@ -105,10 +105,10 @@ asmlinkage __cpuinit void start_secondary(void) + if ((read_c0_tcbind() & TCBIND_CURTC) == 0) + #endif /* CONFIG_MIPS_MT_SMTC */ + cpu_probe(); +- cpu_report(); + per_cpu_trap_init(); + mips_clockevent_init(); + mp_ops->init_secondary(); ++ cpu_report(); + + /* + * XXX parity protection should be folded in here when it's converted +diff --git a/arch/mips/loongson/common/Makefile b/arch/mips/loongson/common/Makefile +index e526488df655..ce415f70ca86 100644 +--- a/arch/mips/loongson/common/Makefile ++++ b/arch/mips/loongson/common/Makefile +@@ -10,7 +10,8 @@ obj-$(CONFIG_GENERIC_GPIO) += gpio.o + # Serial port support + # + obj-$(CONFIG_EARLY_PRINTK) += early_printk.o +-obj-$(CONFIG_SERIAL_8250) += serial.o ++loongson-serial-$(CONFIG_SERIAL_8250) := serial.o ++obj-y += $(loongson-serial-m) $(loongson-serial-y) + obj-$(CONFIG_LOONGSON_UART_BASE) += uart_base.o + obj-$(CONFIG_LOONGSON_MC146818) += rtc.o + +diff --git a/arch/mips/mm/fault.c b/arch/mips/mm/fault.c +index c14f6dfed995..5c9ba6a536d1 100644 +--- a/arch/mips/mm/fault.c ++++ b/arch/mips/mm/fault.c +@@ -155,6 +155,8 @@ good_area: + if (unlikely(fault & VM_FAULT_ERROR)) { + if (fault & VM_FAULT_OOM) + goto out_of_memory; ++ else if (fault & VM_FAULT_SIGSEGV) ++ goto bad_area; + else if (fault & VM_FAULT_SIGBUS) + goto do_sigbus; + BUG(); +diff --git a/arch/mn10300/mm/fault.c b/arch/mn10300/mm/fault.c +index 90f346f7392d..eb411b3cd7e9 100644 +--- a/arch/mn10300/mm/fault.c ++++ b/arch/mn10300/mm/fault.c +@@ -255,6 +255,8 @@ good_area: + if (unlikely(fault & VM_FAULT_ERROR)) { + if (fault & VM_FAULT_OOM) + goto out_of_memory; ++ else if (fault & VM_FAULT_SIGSEGV) ++ goto bad_area; + else if (fault & VM_FAULT_SIGBUS) + goto do_sigbus; + BUG(); +diff --git a/arch/openrisc/mm/fault.c b/arch/openrisc/mm/fault.c +index a5dce82f864b..162abfbced69 100644 +--- a/arch/openrisc/mm/fault.c ++++ b/arch/openrisc/mm/fault.c +@@ -163,6 +163,8 @@ good_area: + if (unlikely(fault & VM_FAULT_ERROR)) { + if (fault & VM_FAULT_OOM) + goto out_of_memory; ++ else if (fault & VM_FAULT_SIGSEGV) ++ goto bad_area; + else if (fault & VM_FAULT_SIGBUS) + goto do_sigbus; + BUG(); +diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c +index 18162ce4261e..a9b765a999ef 100644 +--- a/arch/parisc/mm/fault.c ++++ b/arch/parisc/mm/fault.c +@@ -210,6 +210,8 @@ good_area: + */ + if (fault & VM_FAULT_OOM) + goto out_of_memory; ++ else if (fault & VM_FAULT_SIGSEGV) ++ goto bad_area; + else if (fault & VM_FAULT_SIGBUS) + goto bad_area; + BUG(); +diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c +index 08ffcf52a856..3d30a4af627f 100644 +--- a/arch/powerpc/mm/fault.c ++++ b/arch/powerpc/mm/fault.c +@@ -419,7 +419,11 @@ good_area: + */ + fault = handle_mm_fault(mm, vma, address, flags); + if (unlikely(fault & (VM_FAULT_RETRY|VM_FAULT_ERROR))) { +- int rc = mm_fault_error(regs, address, fault); ++ int rc; ++ ++ if (fault & VM_FAULT_SIGSEGV) ++ goto bad_area; ++ rc = mm_fault_error(regs, address, fault); + if (rc >= MM_FAULT_RETURN) + return rc; + } +diff --git a/arch/powerpc/platforms/cell/spu_fault.c b/arch/powerpc/platforms/cell/spu_fault.c +index 641e7273d75a..62f3e4e48a0b 100644 +--- a/arch/powerpc/platforms/cell/spu_fault.c ++++ b/arch/powerpc/platforms/cell/spu_fault.c +@@ -75,7 +75,7 @@ int spu_handle_mm_fault(struct mm_struct *mm, unsigned long ea, + if (*flt & VM_FAULT_OOM) { + ret = -ENOMEM; + goto out_unlock; +- } else if (*flt & VM_FAULT_SIGBUS) { ++ } else if (*flt & (VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV)) { + ret = -EFAULT; + goto out_unlock; + } +diff --git a/arch/powerpc/platforms/cell/spufs/inode.c b/arch/powerpc/platforms/cell/spufs/inode.c +index ad697f84b945..7c8557662198 100644 +--- a/arch/powerpc/platforms/cell/spufs/inode.c ++++ b/arch/powerpc/platforms/cell/spufs/inode.c +@@ -164,7 +164,7 @@ static void spufs_prune_dir(struct dentry *dir) + struct dentry *dentry, *tmp; + + mutex_lock(&dir->d_inode->i_mutex); +- list_for_each_entry_safe(dentry, tmp, &dir->d_subdirs, d_u.d_child) { ++ list_for_each_entry_safe(dentry, tmp, &dir->d_subdirs, d_child) { + spin_lock(&dentry->d_lock); + if (!(d_unhashed(dentry)) && dentry->d_inode) { + dget_dlock(dentry); +@@ -222,7 +222,7 @@ out: + * - free child's inode if possible + * - free child + */ +- list_for_each_entry_safe(dentry, tmp, &dir->d_subdirs, d_u.d_child) { ++ list_for_each_entry_safe(dentry, tmp, &dir->d_subdirs, d_child) { + dput(dentry); + } + +diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c +index eab3492a45c5..7729c6c07d60 100644 +--- a/arch/powerpc/xmon/xmon.c ++++ b/arch/powerpc/xmon/xmon.c +@@ -285,10 +285,11 @@ static inline void disable_surveillance(void) + args.token = rtas_token("set-indicator"); + if (args.token == RTAS_UNKNOWN_SERVICE) + return; +- args.nargs = 3; +- args.nret = 1; ++ args.token = cpu_to_be32(args.token); ++ args.nargs = cpu_to_be32(3); ++ args.nret = cpu_to_be32(1); + args.rets = &args.args[3]; +- args.args[0] = SURVEILLANCE_TOKEN; ++ args.args[0] = cpu_to_be32(SURVEILLANCE_TOKEN); + args.args[1] = 0; + args.args[2] = 0; + enter_rtas(__pa(&args)); +diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c +index f2b11ee3fb3a..68ba1bb834bb 100644 +--- a/arch/s390/mm/fault.c ++++ b/arch/s390/mm/fault.c +@@ -237,6 +237,12 @@ static noinline void do_fault_error(struct pt_regs *regs, int fault) + do_no_context(regs); + else + pagefault_out_of_memory(); ++ } else if (fault & VM_FAULT_SIGSEGV) { ++ /* Kernel mode? Handle exceptions or die */ ++ if (!user_mode(regs)) ++ do_no_context(regs); ++ else ++ do_sigsegv(regs, SEGV_MAPERR); + } else if (fault & VM_FAULT_SIGBUS) { + /* Kernel mode? Handle exceptions or die */ + if (!(regs->psw.mask & PSW_MASK_PSTATE)) +diff --git a/arch/score/mm/fault.c b/arch/score/mm/fault.c +index 47b600e4b2c5..b3744ca70be6 100644 +--- a/arch/score/mm/fault.c ++++ b/arch/score/mm/fault.c +@@ -110,6 +110,8 @@ survive: + if (unlikely(fault & VM_FAULT_ERROR)) { + if (fault & VM_FAULT_OOM) + goto out_of_memory; ++ else if (fault & VM_FAULT_SIGSEGV) ++ goto bad_area; + else if (fault & VM_FAULT_SIGBUS) + goto do_sigbus; + BUG(); +diff --git a/arch/sh/mm/fault_32.c b/arch/sh/mm/fault_32.c +index e99b104d967a..a4919631ce03 100644 +--- a/arch/sh/mm/fault_32.c ++++ b/arch/sh/mm/fault_32.c +@@ -206,6 +206,8 @@ good_area: + goto out_of_memory; + else if (fault & VM_FAULT_SIGBUS) + goto do_sigbus; ++ else if (fault & VM_FAULT_SIGSEGV) ++ goto bad_area; + BUG(); + } + if (fault & VM_FAULT_MAJOR) { +diff --git a/arch/sh/mm/tlbflush_64.c b/arch/sh/mm/tlbflush_64.c +index 11c5a18f10ed..92f0df95cf83 100644 +--- a/arch/sh/mm/tlbflush_64.c ++++ b/arch/sh/mm/tlbflush_64.c +@@ -194,6 +194,8 @@ good_area: + goto out_of_memory; + else if (fault & VM_FAULT_SIGBUS) + goto do_sigbus; ++ else if (fault & VM_FAULT_SIGSEGV) ++ goto bad_area; + BUG(); + } + +diff --git a/arch/sparc/mm/fault_32.c b/arch/sparc/mm/fault_32.c +index df3155a17991..5c6238d72076 100644 +--- a/arch/sparc/mm/fault_32.c ++++ b/arch/sparc/mm/fault_32.c +@@ -300,6 +300,8 @@ good_area: + if (unlikely(fault & VM_FAULT_ERROR)) { + if (fault & VM_FAULT_OOM) + goto out_of_memory; ++ else if (fault & VM_FAULT_SIGSEGV) ++ goto bad_area; + else if (fault & VM_FAULT_SIGBUS) + goto do_sigbus; + BUG(); +diff --git a/arch/sparc/mm/fault_64.c b/arch/sparc/mm/fault_64.c +index 1387acafc62c..0dc7b9094a29 100644 +--- a/arch/sparc/mm/fault_64.c ++++ b/arch/sparc/mm/fault_64.c +@@ -443,6 +443,8 @@ good_area: + if (unlikely(fault & VM_FAULT_ERROR)) { + if (fault & VM_FAULT_OOM) + goto out_of_memory; ++ else if (fault & VM_FAULT_SIGSEGV) ++ goto bad_area; + else if (fault & VM_FAULT_SIGBUS) + goto do_sigbus; + BUG(); +diff --git a/arch/tile/mm/fault.c b/arch/tile/mm/fault.c +index 22e58f51ed23..a362926d513a 100644 +--- a/arch/tile/mm/fault.c ++++ b/arch/tile/mm/fault.c +@@ -433,6 +433,8 @@ good_area: + if (unlikely(fault & VM_FAULT_ERROR)) { + if (fault & VM_FAULT_OOM) + goto out_of_memory; ++ else if (fault & VM_FAULT_SIGSEGV) ++ goto bad_area; + else if (fault & VM_FAULT_SIGBUS) + goto do_sigbus; + BUG(); +diff --git a/arch/um/kernel/trap.c b/arch/um/kernel/trap.c +index dafc94715950..f79ffc901d0e 100644 +--- a/arch/um/kernel/trap.c ++++ b/arch/um/kernel/trap.c +@@ -69,6 +69,8 @@ good_area: + if (unlikely(fault & VM_FAULT_ERROR)) { + if (fault & VM_FAULT_OOM) { + goto out_of_memory; ++ } else if (fault & VM_FAULT_SIGSEGV) { ++ goto out; + } else if (fault & VM_FAULT_SIGBUS) { + err = -EACCES; + goto out; +diff --git a/arch/x86/include/asm/ldt.h b/arch/x86/include/asm/ldt.h +index 46727eb37bfe..6e1aaf73852a 100644 +--- a/arch/x86/include/asm/ldt.h ++++ b/arch/x86/include/asm/ldt.h +@@ -28,6 +28,13 @@ struct user_desc { + unsigned int seg_not_present:1; + unsigned int useable:1; + #ifdef __x86_64__ ++ /* ++ * Because this bit is not present in 32-bit user code, user ++ * programs can pass uninitialized values here. Therefore, in ++ * any context in which a user_desc comes from a 32-bit program, ++ * the kernel must act as though lm == 0, regardless of the ++ * actual value. ++ */ + unsigned int lm:1; + #endif + }; +diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h +index ccb805966f68..e92e1e4d7a5e 100644 +--- a/arch/x86/include/asm/msr-index.h ++++ b/arch/x86/include/asm/msr-index.h +@@ -130,6 +130,7 @@ + #define MSR_AMD64_PATCH_LOADER 0xc0010020 + #define MSR_AMD64_OSVW_ID_LENGTH 0xc0010140 + #define MSR_AMD64_OSVW_STATUS 0xc0010141 ++#define MSR_AMD64_LS_CFG 0xc0011020 + #define MSR_AMD64_DC_CFG 0xc0011022 + #define MSR_AMD64_IBSFETCHCTL 0xc0011030 + #define MSR_AMD64_IBSFETCHLINAD 0xc0011031 +diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c +index a9c8a46dd7d3..5beec8abd37e 100644 +--- a/arch/x86/kernel/cpu/amd.c ++++ b/arch/x86/kernel/cpu/amd.c +@@ -417,6 +417,16 @@ static void __cpuinit early_init_amd_mc(struct cpuinfo_x86 *c) + + c->x86_coreid_bits = bits; + #endif ++ ++ /* F16h erratum 793, CVE-2013-6885 */ ++ if (c->x86 == 0x16 && c->x86_model <= 0xf) { ++ u64 val; ++ ++ if (!rdmsrl_amd_safe(MSR_AMD64_LS_CFG, &val) && ++ !(val & BIT(15))) ++ wrmsrl_amd_safe(MSR_AMD64_LS_CFG, val | BIT(15)); ++ } ++ + } + + static void __cpuinit bsp_init_amd(struct cpuinfo_x86 *c) +diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c +index 646d192b18a2..c465584c2517 100644 +--- a/arch/x86/kernel/cpu/mshyperv.c ++++ b/arch/x86/kernel/cpu/mshyperv.c +@@ -55,6 +55,7 @@ static struct clocksource hyperv_cs = { + .rating = 400, /* use this when running on Hyperv*/ + .read = read_hv_clock, + .mask = CLOCKSOURCE_MASK(64), ++ .flags = CLOCK_SOURCE_IS_CONTINUOUS, + }; + + static void __init ms_hyperv_init_platform(void) +diff --git a/arch/x86/kernel/kprobes.c b/arch/x86/kernel/kprobes.c +index e213fc8408d2..15d3c454e5e3 100644 +--- a/arch/x86/kernel/kprobes.c ++++ b/arch/x86/kernel/kprobes.c +@@ -1003,6 +1003,15 @@ int __kprobes setjmp_pre_handler(struct kprobe *p, struct pt_regs *regs) + regs->flags &= ~X86_EFLAGS_IF; + trace_hardirqs_off(); + regs->ip = (unsigned long)(jp->entry); ++ ++ /* ++ * jprobes use jprobe_return() which skips the normal return ++ * path of the function, and this messes up the accounting of the ++ * function graph tracer to get messed up. ++ * ++ * Pause function graph tracing while performing the jprobe function. ++ */ ++ pause_graph_tracing(); + return 1; + } + +@@ -1028,24 +1037,25 @@ int __kprobes longjmp_break_handler(struct kprobe *p, struct pt_regs *regs) + struct kprobe_ctlblk *kcb = get_kprobe_ctlblk(); + u8 *addr = (u8 *) (regs->ip - 1); + struct jprobe *jp = container_of(p, struct jprobe, kp); ++ void *saved_sp = kcb->jprobe_saved_sp; + + if ((addr > (u8 *) jprobe_return) && + (addr < (u8 *) jprobe_return_end)) { +- if (stack_addr(regs) != kcb->jprobe_saved_sp) { ++ if (stack_addr(regs) != saved_sp) { + struct pt_regs *saved_regs = &kcb->jprobe_saved_regs; + printk(KERN_ERR + "current sp %p does not match saved sp %p\n", +- stack_addr(regs), kcb->jprobe_saved_sp); ++ stack_addr(regs), saved_sp); + printk(KERN_ERR "Saved registers for jprobe %p\n", jp); + show_registers(saved_regs); + printk(KERN_ERR "Current registers\n"); + show_registers(regs); + BUG(); + } ++ /* It's OK to start function graph tracing again */ ++ unpause_graph_tracing(); + *regs = kcb->jprobe_saved_regs; +- memcpy((kprobe_opcode_t *)(kcb->jprobe_saved_sp), +- kcb->jprobes_stack, +- MIN_STACK_SIZE(kcb->jprobe_saved_sp)); ++ memcpy(saved_sp, kcb->jprobes_stack, MIN_STACK_SIZE(saved_sp)); + preempt_enable_no_resched(); + return 1; + } +diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c +index 43d8b48b23e6..bb390e1ba600 100644 +--- a/arch/x86/kernel/process_64.c ++++ b/arch/x86/kernel/process_64.c +@@ -286,24 +286,9 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p) + + fpu = switch_fpu_prepare(prev_p, next_p, cpu); + +- /* +- * Reload esp0, LDT and the page table pointer: +- */ ++ /* Reload esp0 and ss1. */ + load_sp0(tss, next); + +- /* +- * Switch DS and ES. +- * This won't pick up thread selector changes, but I guess that is ok. +- */ +- savesegment(es, prev->es); +- if (unlikely(next->es | prev->es)) +- loadsegment(es, next->es); +- +- savesegment(ds, prev->ds); +- if (unlikely(next->ds | prev->ds)) +- loadsegment(ds, next->ds); +- +- + /* We must save %fs and %gs before load_TLS() because + * %fs and %gs may be cleared by load_TLS(). + * +@@ -312,41 +297,101 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p) + savesegment(fs, fsindex); + savesegment(gs, gsindex); + ++ /* ++ * Load TLS before restoring any segments so that segment loads ++ * reference the correct GDT entries. ++ */ + load_TLS(next, cpu); + + /* +- * Leave lazy mode, flushing any hypercalls made here. +- * This must be done before restoring TLS segments so +- * the GDT and LDT are properly updated, and must be +- * done before math_state_restore, so the TS bit is up +- * to date. ++ * Leave lazy mode, flushing any hypercalls made here. This ++ * must be done after loading TLS entries in the GDT but before ++ * loading segments that might reference them, and and it must ++ * be done before math_state_restore, so the TS bit is up to ++ * date. + */ + arch_end_context_switch(next_p); + ++ /* Switch DS and ES. ++ * ++ * Reading them only returns the selectors, but writing them (if ++ * nonzero) loads the full descriptor from the GDT or LDT. The ++ * LDT for next is loaded in switch_mm, and the GDT is loaded ++ * above. ++ * ++ * We therefore need to write new values to the segment ++ * registers on every context switch unless both the new and old ++ * values are zero. ++ * ++ * Note that we don't need to do anything for CS and SS, as ++ * those are saved and restored as part of pt_regs. ++ */ ++ savesegment(es, prev->es); ++ if (unlikely(next->es | prev->es)) ++ loadsegment(es, next->es); ++ ++ savesegment(ds, prev->ds); ++ if (unlikely(next->ds | prev->ds)) ++ loadsegment(ds, next->ds); ++ + /* + * Switch FS and GS. + * +- * Segment register != 0 always requires a reload. Also +- * reload when it has changed. When prev process used 64bit +- * base always reload to avoid an information leak. ++ * These are even more complicated than FS and GS: they have ++ * 64-bit bases are that controlled by arch_prctl. Those bases ++ * only differ from the values in the GDT or LDT if the selector ++ * is 0. ++ * ++ * Loading the segment register resets the hidden base part of ++ * the register to 0 or the value from the GDT / LDT. If the ++ * next base address zero, writing 0 to the segment register is ++ * much faster than using wrmsr to explicitly zero the base. ++ * ++ * The thread_struct.fs and thread_struct.gs values are 0 ++ * if the fs and gs bases respectively are not overridden ++ * from the values implied by fsindex and gsindex. They ++ * are nonzero, and store the nonzero base addresses, if ++ * the bases are overridden. ++ * ++ * (fs != 0 && fsindex != 0) || (gs != 0 && gsindex != 0) should ++ * be impossible. ++ * ++ * Therefore we need to reload the segment registers if either ++ * the old or new selector is nonzero, and we need to override ++ * the base address if next thread expects it to be overridden. ++ * ++ * This code is unnecessarily slow in the case where the old and ++ * new indexes are zero and the new base is nonzero -- it will ++ * unnecessarily write 0 to the selector before writing the new ++ * base address. ++ * ++ * Note: This all depends on arch_prctl being the only way that ++ * user code can override the segment base. Once wrfsbase and ++ * wrgsbase are enabled, most of this code will need to change. + */ + if (unlikely(fsindex | next->fsindex | prev->fs)) { + loadsegment(fs, next->fsindex); ++ + /* +- * Check if the user used a selector != 0; if yes +- * clear 64bit base, since overloaded base is always +- * mapped to the Null selector ++ * If user code wrote a nonzero value to FS, then it also ++ * cleared the overridden base address. ++ * ++ * XXX: if user code wrote 0 to FS and cleared the base ++ * address itself, we won't notice and we'll incorrectly ++ * restore the prior base address next time we reschdule ++ * the process. + */ + if (fsindex) + prev->fs = 0; + } +- /* when next process has a 64bit base use it */ + if (next->fs) + wrmsrl(MSR_FS_BASE, next->fs); + prev->fsindex = fsindex; + + if (unlikely(gsindex | next->gsindex | prev->gs)) { + load_gs_index(next->gsindex); ++ ++ /* This works (and fails) the same way as fsindex above. */ + if (gsindex) + prev->gs = 0; + } +diff --git a/arch/x86/kernel/tls.c b/arch/x86/kernel/tls.c +index 9d25a6eef1e1..fe2e363fa87a 100644 +--- a/arch/x86/kernel/tls.c ++++ b/arch/x86/kernel/tls.c +@@ -60,6 +60,22 @@ static bool tls_desc_okay(const struct user_desc *info) + if (!info->seg_32bit) + return false; + ++ /* Only allow data segments in the TLS array. */ ++ if (info->contents > 1) ++ return false; ++ ++ /* ++ * Non-present segments with DPL 3 present an interesting attack ++ * surface. The kernel should handle such segments correctly, ++ * but TLS is very difficult to protect in a sandbox, so prevent ++ * such segments from being created. ++ * ++ * If userspace needs to remove a TLS entry, it can still delete ++ * it outright. ++ */ ++ if (info->seg_not_present) ++ return false; ++ + return true; + } + +diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c +index 4a0a2e810b4b..b723f2e09f44 100644 +--- a/arch/x86/mm/fault.c ++++ b/arch/x86/mm/fault.c +@@ -887,6 +887,8 @@ mm_fault_error(struct pt_regs *regs, unsigned long error_code, + if (fault & (VM_FAULT_SIGBUS|VM_FAULT_HWPOISON| + VM_FAULT_HWPOISON_LARGE)) + do_sigbus(regs, error_code, address, fault); ++ else if (fault & VM_FAULT_SIGSEGV) ++ bad_area_nosemaphore(regs, error_code, address); + else + BUG(); + } +diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c +index 5c1ae28825cd..75f9e5d80d02 100644 +--- a/arch/x86/mm/mmap.c ++++ b/arch/x86/mm/mmap.c +@@ -35,12 +35,12 @@ struct __read_mostly va_alignment va_align = { + .flags = -1, + }; + +-static unsigned int stack_maxrandom_size(void) ++static unsigned long stack_maxrandom_size(void) + { +- unsigned int max = 0; ++ unsigned long max = 0; + if ((current->flags & PF_RANDOMIZE) && + !(current->personality & ADDR_NO_RANDOMIZE)) { +- max = ((-1U) & STACK_RND_MASK) << PAGE_SHIFT; ++ max = ((-1UL) & STACK_RND_MASK) << PAGE_SHIFT; + } + + return max; +diff --git a/arch/x86/um/sys_call_table_32.c b/arch/x86/um/sys_call_table_32.c +index 68d1dc91b37b..bd8b159cbb53 100644 +--- a/arch/x86/um/sys_call_table_32.c ++++ b/arch/x86/um/sys_call_table_32.c +@@ -43,7 +43,7 @@ typedef asmlinkage void (*sys_call_ptr_t)(void); + + extern asmlinkage void sys_ni_syscall(void); + +-const sys_call_ptr_t sys_call_table[] __cacheline_aligned = { ++const sys_call_ptr_t sys_call_table[] ____cacheline_aligned = { + /* + * Smells like a compiler bug -- it doesn't work + * when the & below is removed. +diff --git a/arch/x86/um/sys_call_table_64.c b/arch/x86/um/sys_call_table_64.c +index 9924776f4265..cbdab949926d 100644 +--- a/arch/x86/um/sys_call_table_64.c ++++ b/arch/x86/um/sys_call_table_64.c +@@ -48,7 +48,7 @@ typedef void (*sys_call_ptr_t)(void); + + extern void sys_ni_syscall(void); + +-const sys_call_ptr_t sys_call_table[] __cacheline_aligned = { ++const sys_call_ptr_t sys_call_table[] ____cacheline_aligned = { + /* + * Smells like a compiler bug -- it doesn't work + * when the & below is removed. +diff --git a/arch/x86/vdso/vma.c b/arch/x86/vdso/vma.c +index 00aaf047b39f..47aa1080c00a 100644 +--- a/arch/x86/vdso/vma.c ++++ b/arch/x86/vdso/vma.c +@@ -117,23 +117,39 @@ subsys_initcall(init_vdso); + + struct linux_binprm; + +-/* Put the vdso above the (randomized) stack with another randomized offset. +- This way there is no hole in the middle of address space. +- To save memory make sure it is still in the same PTE as the stack top. +- This doesn't give that many random bits */ ++/* ++ * Put the vdso above the (randomized) stack with another randomized ++ * offset. This way there is no hole in the middle of address space. ++ * To save memory make sure it is still in the same PTE as the stack ++ * top. This doesn't give that many random bits. ++ * ++ * Note that this algorithm is imperfect: the distribution of the vdso ++ * start address within a PMD is biased toward the end. ++ * ++ */ + static unsigned long vdso_addr(unsigned long start, unsigned len) + { + unsigned long addr, end; + unsigned offset; +- end = (start + PMD_SIZE - 1) & PMD_MASK; ++ ++ /* ++ * Round up the start address. It can start out unaligned as a result ++ * of stack start randomization. ++ */ ++ start = PAGE_ALIGN(start); ++ ++ /* Round the lowest possible end address up to a PMD boundary. */ ++ end = (start + len + PMD_SIZE - 1) & PMD_MASK; + if (end >= TASK_SIZE_MAX) + end = TASK_SIZE_MAX; + end -= len; +- /* This loses some more bits than a modulo, but is cheaper */ +- offset = get_random_int() & (PTRS_PER_PTE - 1); +- addr = start + (offset << PAGE_SHIFT); +- if (addr >= end) +- addr = end; ++ ++ if (end > start) { ++ offset = get_random_int() % (((end - start) >> PAGE_SHIFT) + 1); ++ addr = start + (offset << PAGE_SHIFT); ++ } else { ++ addr = start; ++ } + + /* + * page-align it here so that get_unmapped_area doesn't +diff --git a/arch/xtensa/mm/fault.c b/arch/xtensa/mm/fault.c +index b17885a0b508..b3877be25ab3 100644 +--- a/arch/xtensa/mm/fault.c ++++ b/arch/xtensa/mm/fault.c +@@ -108,6 +108,8 @@ good_area: + if (unlikely(fault & VM_FAULT_ERROR)) { + if (fault & VM_FAULT_OOM) + goto out_of_memory; ++ else if (fault & VM_FAULT_SIGSEGV) ++ goto bad_area; + else if (fault & VM_FAULT_SIGBUS) + goto do_sigbus; + BUG(); +diff --git a/block/genhd.c b/block/genhd.c +index 60f7e6ce76b4..7a2a8dc9bc5f 100644 +--- a/block/genhd.c ++++ b/block/genhd.c +@@ -1069,9 +1069,16 @@ int disk_expand_part_tbl(struct gendisk *disk, int partno) + struct disk_part_tbl *old_ptbl = disk->part_tbl; + struct disk_part_tbl *new_ptbl; + int len = old_ptbl ? old_ptbl->len : 0; +- int target = partno + 1; ++ int i, target; + size_t size; +- int i; ++ ++ /* ++ * check for int overflow, since we can get here from blkpg_ioctl() ++ * with a user passed 'partno'. ++ */ ++ target = partno + 1; ++ if (target < 0) ++ return -EINVAL; + + /* disk_max_parts() is zero during initialization, ignore if so */ + if (disk_max_parts(disk) && target > disk_max_parts(disk)) +diff --git a/crypto/af_alg.c b/crypto/af_alg.c +index bf948e134981..6ef6e2ad344e 100644 +--- a/crypto/af_alg.c ++++ b/crypto/af_alg.c +@@ -449,6 +449,9 @@ void af_alg_complete(struct crypto_async_request *req, int err) + { + struct af_alg_completion *completion = req->data; + ++ if (err == -EINPROGRESS) ++ return; ++ + completion->err = err; + complete(&completion->completion); + } +diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c +index ca9a287b5864..6fc61eb07b7b 100644 +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -61,6 +61,8 @@ enum board_ids { + /* board IDs by feature in alphabetical order */ + board_ahci, + board_ahci_ign_iferr, ++ board_ahci_nomsi, ++ board_ahci_noncq, + board_ahci_nosntf, + board_ahci_yes_fbs, + +@@ -121,6 +123,20 @@ static const struct ata_port_info ahci_port_info[] = { + .udma_mask = ATA_UDMA6, + .port_ops = &ahci_ops, + }, ++ [board_ahci_nomsi] = { ++ AHCI_HFLAGS (AHCI_HFLAG_NO_MSI), ++ .flags = AHCI_FLAG_COMMON, ++ .pio_mask = ATA_PIO4, ++ .udma_mask = ATA_UDMA6, ++ .port_ops = &ahci_ops, ++ }, ++ [board_ahci_noncq] = { ++ AHCI_HFLAGS (AHCI_HFLAG_NO_NCQ), ++ .flags = AHCI_FLAG_COMMON, ++ .pio_mask = ATA_PIO4, ++ .udma_mask = ATA_UDMA6, ++ .port_ops = &ahci_ops, ++ }, + [board_ahci_nosntf] = + { + AHCI_HFLAGS (AHCI_HFLAG_NO_SNTF), +@@ -313,6 +329,9 @@ static const struct pci_device_id ahci_pci_tbl[] = { + { PCI_VDEVICE(INTEL, 0x8c87), board_ahci }, /* 9 Series RAID */ + { PCI_VDEVICE(INTEL, 0x8c8e), board_ahci }, /* 9 Series RAID */ + { PCI_VDEVICE(INTEL, 0x8c8f), board_ahci }, /* 9 Series RAID */ ++ { PCI_VDEVICE(INTEL, 0x9d03), board_ahci }, /* Sunrise Point-LP AHCI */ ++ { PCI_VDEVICE(INTEL, 0x9d05), board_ahci }, /* Sunrise Point-LP RAID */ ++ { PCI_VDEVICE(INTEL, 0x9d07), board_ahci }, /* Sunrise Point-LP RAID */ + { PCI_VDEVICE(INTEL, 0xa103), board_ahci }, /* Sunrise Point-H AHCI */ + { PCI_VDEVICE(INTEL, 0xa103), board_ahci }, /* Sunrise Point-H RAID */ + { PCI_VDEVICE(INTEL, 0xa105), board_ahci }, /* Sunrise Point-H RAID */ +@@ -469,6 +488,13 @@ static const struct pci_device_id ahci_pci_tbl[] = { + { PCI_VDEVICE(ASMEDIA, 0x0611), board_ahci }, /* ASM1061 */ + { PCI_VDEVICE(ASMEDIA, 0x0612), board_ahci }, /* ASM1062 */ + ++ /* ++ * Samsung SSDs found on some macbooks. NCQ times out if MSI is ++ * enabled. https://bugzilla.kernel.org/show_bug.cgi?id=60731 ++ */ ++ { PCI_VDEVICE(SAMSUNG, 0x1600), board_ahci_nomsi }, ++ { PCI_VDEVICE(SAMSUNG, 0xa800), board_ahci_nomsi }, ++ + /* Enmotus */ + { PCI_DEVICE(0x1c44, 0x8000), board_ahci }, + +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index 6b922365d5e9..adaf994abb79 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -4712,7 +4712,10 @@ static struct ata_queued_cmd *ata_qc_new(struct ata_port *ap) + return NULL; + + for (i = 0, tag = ap->last_tag + 1; i < max_queue; i++, tag++) { +- tag = tag < max_queue ? tag : 0; ++ if (ap->flags & ATA_FLAG_LOWTAG) ++ tag = i; ++ else ++ tag = tag < max_queue ? tag : 0; + + /* the last tag is reserved for internal command. */ + if (tag == ATA_TAG_INTERNAL) +diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c +index 3723e5ec2b4d..fad2734a46d0 100644 +--- a/drivers/ata/libata-sff.c ++++ b/drivers/ata/libata-sff.c +@@ -1333,7 +1333,19 @@ void ata_sff_flush_pio_task(struct ata_port *ap) + DPRINTK("ENTER\n"); + + cancel_delayed_work_sync(&ap->sff_pio_task); ++ ++ /* ++ * We wanna reset the HSM state to IDLE. If we do so without ++ * grabbing the port lock, critical sections protected by it which ++ * expect the HSM state to stay stable may get surprised. For ++ * example, we may set IDLE in between the time ++ * __ata_sff_port_intr() checks for HSM_ST_IDLE and before it calls ++ * ata_sff_hsm_move() causing ata_sff_hsm_move() to BUG(). ++ */ ++ spin_lock_irq(ap->lock); + ap->hsm_task_state = HSM_ST_IDLE; ++ spin_unlock_irq(ap->lock); ++ + ap->sff_pio_task_link = NULL; + + if (ata_msg_ctl(ap)) +diff --git a/drivers/ata/sata_dwc_460ex.c b/drivers/ata/sata_dwc_460ex.c +index 69f7cde49c6b..9d6eb14b4bed 100644 +--- a/drivers/ata/sata_dwc_460ex.c ++++ b/drivers/ata/sata_dwc_460ex.c +@@ -791,7 +791,7 @@ static int dma_dwc_init(struct sata_dwc_device *hsdev, int irq) + if (err) { + dev_err(host_pvt.dwc_dev, "%s: dma_request_interrupts returns" + " %d\n", __func__, err); +- goto error_out; ++ return err; + } + + /* Enabe DMA */ +@@ -802,11 +802,6 @@ static int dma_dwc_init(struct sata_dwc_device *hsdev, int irq) + sata_dma_regs); + + return 0; +- +-error_out: +- dma_dwc_exit(hsdev); +- +- return err; + } + + static int sata_dwc_scr_read(struct ata_link *link, unsigned int scr, u32 *val) +@@ -1634,7 +1629,7 @@ static int sata_dwc_probe(struct platform_device *ofdev) + char *ver = (char *)&versionr; + u8 *base = NULL; + int err = 0; +- int irq, rc; ++ int irq; + struct ata_host *host; + struct ata_port_info pi = sata_dwc_port_info[0]; + const struct ata_port_info *ppi[] = { &pi, NULL }; +@@ -1688,7 +1683,7 @@ static int sata_dwc_probe(struct platform_device *ofdev) + if (irq == NO_IRQ) { + dev_err(&ofdev->dev, "no SATA DMA irq\n"); + err = -ENODEV; +- goto error_out; ++ goto error_iomap; + } + + /* Get physical SATA DMA register base address */ +@@ -1697,14 +1692,16 @@ static int sata_dwc_probe(struct platform_device *ofdev) + dev_err(&ofdev->dev, "ioremap failed for AHBDMA register" + " address\n"); + err = -ENODEV; +- goto error_out; ++ goto error_iomap; + } + + /* Save dev for later use in dev_xxx() routines */ + host_pvt.dwc_dev = &ofdev->dev; + + /* Initialize AHB DMAC */ +- dma_dwc_init(hsdev, irq); ++ err = dma_dwc_init(hsdev, irq); ++ if (err) ++ goto error_dma_iomap; + + /* Enable SATA Interrupts */ + sata_dwc_enable_interrupts(hsdev); +@@ -1722,9 +1719,8 @@ static int sata_dwc_probe(struct platform_device *ofdev) + * device discovery process, invoking our port_start() handler & + * error_handler() to execute a dummy Softreset EH session + */ +- rc = ata_host_activate(host, irq, sata_dwc_isr, 0, &sata_dwc_sht); +- +- if (rc != 0) ++ err = ata_host_activate(host, irq, sata_dwc_isr, 0, &sata_dwc_sht); ++ if (err) + dev_err(&ofdev->dev, "failed to activate host"); + + dev_set_drvdata(&ofdev->dev, host); +@@ -1733,7 +1729,8 @@ static int sata_dwc_probe(struct platform_device *ofdev) + error_out: + /* Free SATA DMA resources */ + dma_dwc_exit(hsdev); +- ++error_dma_iomap: ++ iounmap((void __iomem *)host_pvt.sata_dma_regs); + error_iomap: + iounmap(base); + error_kmalloc: +@@ -1754,6 +1751,7 @@ static int sata_dwc_remove(struct platform_device *ofdev) + /* Free SATA DMA resources */ + dma_dwc_exit(hsdev); + ++ iounmap((void __iomem *)host_pvt.sata_dma_regs); + iounmap(hsdev->reg_base); + kfree(hsdev); + kfree(host); +diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c +index d6577b93bee3..3d3b59a9adcf 100644 +--- a/drivers/ata/sata_fsl.c ++++ b/drivers/ata/sata_fsl.c +@@ -1426,7 +1426,7 @@ static int sata_fsl_probe(struct platform_device *ofdev) + host_priv->csr_base = csr_base; + + irq = irq_of_parse_and_map(ofdev->dev.of_node, 0); +- if (irq < 0) { ++ if (!irq) { + dev_err(&ofdev->dev, "invalid irq from platform\n"); + goto error_exit_with_cleanup; + } +diff --git a/drivers/ata/sata_sil24.c b/drivers/ata/sata_sil24.c +index e7e610aa9a7a..cb68aa3f72a6 100644 +--- a/drivers/ata/sata_sil24.c ++++ b/drivers/ata/sata_sil24.c +@@ -246,7 +246,7 @@ enum { + /* host flags */ + SIL24_COMMON_FLAGS = ATA_FLAG_SATA | ATA_FLAG_PIO_DMA | + ATA_FLAG_NCQ | ATA_FLAG_ACPI_SATA | +- ATA_FLAG_AN | ATA_FLAG_PMP, ++ ATA_FLAG_AN | ATA_FLAG_PMP | ATA_FLAG_LOWTAG, + SIL24_FLAG_PCIX_IRQ_WOC = (1 << 24), /* IRQ loss errata on PCI-X */ + + IRQ_STAT_4PORTS = 0xf, +diff --git a/drivers/base/bus.c b/drivers/base/bus.c +index b850cecb147b..0f682f7d0797 100644 +--- a/drivers/base/bus.c ++++ b/drivers/base/bus.c +@@ -245,13 +245,15 @@ static ssize_t store_drivers_probe(struct bus_type *bus, + const char *buf, size_t count) + { + struct device *dev; ++ int err = -EINVAL; + + dev = bus_find_device_by_name(bus, NULL, buf); + if (!dev) + return -ENODEV; +- if (bus_rescan_devices_helper(dev, NULL) != 0) +- return -EINVAL; +- return count; ++ if (bus_rescan_devices_helper(dev, NULL) == 0) ++ err = count; ++ put_device(dev); ++ return err; + } + #endif + +diff --git a/drivers/base/core.c b/drivers/base/core.c +index 32e86d6f141c..aeaf0e183f24 100644 +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -1494,34 +1494,11 @@ static void device_create_release(struct device *dev) + kfree(dev); + } + +-/** +- * device_create_vargs - creates a device and registers it with sysfs +- * @class: pointer to the struct class that this device should be registered to +- * @parent: pointer to the parent struct device of this new device, if any +- * @devt: the dev_t for the char device to be added +- * @drvdata: the data to be added to the device for callbacks +- * @fmt: string for the device's name +- * @args: va_list for the device's name +- * +- * This function can be used by char device classes. A struct device +- * will be created in sysfs, registered to the specified class. +- * +- * A "dev" file will be created, showing the dev_t for the device, if +- * the dev_t is not 0,0. +- * If a pointer to a parent struct device is passed in, the newly created +- * struct device will be a child of that device in sysfs. +- * The pointer to the struct device will be returned from the call. +- * Any further sysfs files that might be required can be created using this +- * pointer. +- * +- * Returns &struct device pointer on success, or ERR_PTR() on error. +- * +- * Note: the struct class passed to this function must have previously +- * been created with a call to class_create(). +- */ +-struct device *device_create_vargs(struct class *class, struct device *parent, +- dev_t devt, void *drvdata, const char *fmt, +- va_list args) ++static struct device * ++device_create_groups_vargs(struct class *class, struct device *parent, ++ dev_t devt, void *drvdata, ++ const struct attribute_group **groups, ++ const char *fmt, va_list args) + { + struct device *dev = NULL; + int retval = -ENODEV; +@@ -1538,6 +1515,7 @@ struct device *device_create_vargs(struct class *class, struct device *parent, + dev->devt = devt; + dev->class = class; + dev->parent = parent; ++ dev->groups = groups; + dev->release = device_create_release; + dev_set_drvdata(dev, drvdata); + +@@ -1555,6 +1533,39 @@ error: + put_device(dev); + return ERR_PTR(retval); + } ++ ++/** ++ * device_create_vargs - creates a device and registers it with sysfs ++ * @class: pointer to the struct class that this device should be registered to ++ * @parent: pointer to the parent struct device of this new device, if any ++ * @devt: the dev_t for the char device to be added ++ * @drvdata: the data to be added to the device for callbacks ++ * @fmt: string for the device's name ++ * @args: va_list for the device's name ++ * ++ * This function can be used by char device classes. A struct device ++ * will be created in sysfs, registered to the specified class. ++ * ++ * A "dev" file will be created, showing the dev_t for the device, if ++ * the dev_t is not 0,0. ++ * If a pointer to a parent struct device is passed in, the newly created ++ * struct device will be a child of that device in sysfs. ++ * The pointer to the struct device will be returned from the call. ++ * Any further sysfs files that might be required can be created using this ++ * pointer. ++ * ++ * Returns &struct device pointer on success, or ERR_PTR() on error. ++ * ++ * Note: the struct class passed to this function must have previously ++ * been created with a call to class_create(). ++ */ ++struct device *device_create_vargs(struct class *class, struct device *parent, ++ dev_t devt, void *drvdata, const char *fmt, ++ va_list args) ++{ ++ return device_create_groups_vargs(class, parent, devt, drvdata, NULL, ++ fmt, args); ++} + EXPORT_SYMBOL_GPL(device_create_vargs); + + /** +@@ -1594,6 +1605,50 @@ struct device *device_create(struct class *class, struct device *parent, + } + EXPORT_SYMBOL_GPL(device_create); + ++/** ++ * device_create_with_groups - creates a device and registers it with sysfs ++ * @class: pointer to the struct class that this device should be registered to ++ * @parent: pointer to the parent struct device of this new device, if any ++ * @devt: the dev_t for the char device to be added ++ * @drvdata: the data to be added to the device for callbacks ++ * @groups: NULL-terminated list of attribute groups to be created ++ * @fmt: string for the device's name ++ * ++ * This function can be used by char device classes. A struct device ++ * will be created in sysfs, registered to the specified class. ++ * Additional attributes specified in the groups parameter will also ++ * be created automatically. ++ * ++ * A "dev" file will be created, showing the dev_t for the device, if ++ * the dev_t is not 0,0. ++ * If a pointer to a parent struct device is passed in, the newly created ++ * struct device will be a child of that device in sysfs. ++ * The pointer to the struct device will be returned from the call. ++ * Any further sysfs files that might be required can be created using this ++ * pointer. ++ * ++ * Returns &struct device pointer on success, or ERR_PTR() on error. ++ * ++ * Note: the struct class passed to this function must have previously ++ * been created with a call to class_create(). ++ */ ++struct device *device_create_with_groups(struct class *class, ++ struct device *parent, dev_t devt, ++ void *drvdata, ++ const struct attribute_group **groups, ++ const char *fmt, ...) ++{ ++ va_list vargs; ++ struct device *dev; ++ ++ va_start(vargs, fmt); ++ dev = device_create_groups_vargs(class, parent, devt, drvdata, groups, ++ fmt, vargs); ++ va_end(vargs); ++ return dev; ++} ++EXPORT_SYMBOL_GPL(device_create_with_groups); ++ + static int __match_devt(struct device *dev, void *data) + { + dev_t *devt = data; +diff --git a/drivers/block/drbd/drbd_req.c b/drivers/block/drbd/drbd_req.c +index be984e073666..43da22658348 100644 +--- a/drivers/block/drbd/drbd_req.c ++++ b/drivers/block/drbd/drbd_req.c +@@ -1184,6 +1184,7 @@ int drbd_merge_bvec(struct request_queue *q, struct bvec_merge_data *bvm, struct + struct request_queue * const b = + mdev->ldev->backing_bdev->bd_disk->queue; + if (b->merge_bvec_fn) { ++ bvm->bi_bdev = mdev->ldev->backing_bdev; + backing_limit = b->merge_bvec_fn(b, bvm, bvec); + limit = min(limit, backing_limit); + } +diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c +index d02f761d84ec..02fbbf7be9f9 100644 +--- a/drivers/bluetooth/ath3k.c ++++ b/drivers/bluetooth/ath3k.c +@@ -62,47 +62,53 @@ static struct usb_device_id ath3k_table[] = { + { USB_DEVICE(0x0CF3, 0x3000) }, + + /* Atheros AR3011 with sflash firmware*/ ++ { USB_DEVICE(0x0489, 0xE027) }, ++ { USB_DEVICE(0x0489, 0xE03D) }, ++ { USB_DEVICE(0x0930, 0x0215) }, + { USB_DEVICE(0x0CF3, 0x3002) }, + { USB_DEVICE(0x0CF3, 0xE019) }, + { USB_DEVICE(0x13d3, 0x3304) }, +- { USB_DEVICE(0x0930, 0x0215) }, +- { USB_DEVICE(0x0489, 0xE03D) }, +- { USB_DEVICE(0x0489, 0xE027) }, + + /* Atheros AR9285 Malbec with sflash firmware */ + { USB_DEVICE(0x03F0, 0x311D) }, + + /* Atheros AR3012 with sflash firmware*/ ++ { USB_DEVICE(0x0489, 0xe04d) }, ++ { USB_DEVICE(0x0489, 0xe04e) }, ++ { USB_DEVICE(0x0489, 0xe057) }, ++ { USB_DEVICE(0x0489, 0xe056) }, ++ { USB_DEVICE(0x0489, 0xe078) }, ++ { USB_DEVICE(0x04c5, 0x1330) }, ++ { USB_DEVICE(0x04CA, 0x3004) }, ++ { USB_DEVICE(0x04CA, 0x3005) }, ++ { USB_DEVICE(0x04CA, 0x3006) }, ++ { USB_DEVICE(0x04CA, 0x3008) }, ++ { USB_DEVICE(0x04CA, 0x3010) }, ++ { USB_DEVICE(0x0930, 0x0219) }, ++ { USB_DEVICE(0x0930, 0x0227) }, ++ { USB_DEVICE(0x0b05, 0x17d0) }, + { USB_DEVICE(0x0CF3, 0x0036) }, + { USB_DEVICE(0x0CF3, 0x3004) }, + { USB_DEVICE(0x0CF3, 0x3008) }, + { USB_DEVICE(0x0CF3, 0x311D) }, ++ { USB_DEVICE(0x0cf3, 0x3121) }, + { USB_DEVICE(0x0CF3, 0x817a) }, +- { USB_DEVICE(0x13d3, 0x3375) }, +- { USB_DEVICE(0x04CA, 0x3004) }, +- { USB_DEVICE(0x04CA, 0x3005) }, +- { USB_DEVICE(0x04CA, 0x3006) }, +- { USB_DEVICE(0x04CA, 0x3008) }, +- { USB_DEVICE(0x13d3, 0x3362) }, ++ { USB_DEVICE(0x0cf3, 0xe003) }, + { USB_DEVICE(0x0CF3, 0xE004) }, + { USB_DEVICE(0x0CF3, 0xE005) }, +- { USB_DEVICE(0x0930, 0x0219) }, +- { USB_DEVICE(0x0489, 0xe057) }, ++ { USB_DEVICE(0x13d3, 0x3362) }, ++ { USB_DEVICE(0x13d3, 0x3375) }, + { USB_DEVICE(0x13d3, 0x3393) }, +- { USB_DEVICE(0x0489, 0xe04e) }, +- { USB_DEVICE(0x0489, 0xe056) }, +- { USB_DEVICE(0x0489, 0xe04d) }, +- { USB_DEVICE(0x04c5, 0x1330) }, + { USB_DEVICE(0x13d3, 0x3402) }, +- { USB_DEVICE(0x0cf3, 0x3121) }, +- { USB_DEVICE(0x0cf3, 0xe003) }, ++ { USB_DEVICE(0x13d3, 0x3408) }, ++ { USB_DEVICE(0x13d3, 0x3432) }, + + /* Atheros AR5BBU12 with sflash firmware */ + { USB_DEVICE(0x0489, 0xE02C) }, + + /* Atheros AR5BBU22 with sflash firmware */ +- { USB_DEVICE(0x0489, 0xE03C) }, + { USB_DEVICE(0x0489, 0xE036) }, ++ { USB_DEVICE(0x0489, 0xE03C) }, + + { } /* Terminating entry */ + }; +@@ -115,29 +121,35 @@ MODULE_DEVICE_TABLE(usb, ath3k_table); + static struct usb_device_id ath3k_blist_tbl[] = { + + /* Atheros AR3012 with sflash firmware*/ ++ { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0CF3, 0x0036), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0x311D), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0CF3, 0x817a), .driver_info = BTUSB_ATH3012 }, +- { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 }, +- { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 }, +- { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 }, +- { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 }, +- { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 }, +- { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 }, +- { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, +- { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 }, +- { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 }, +- { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 }, +- { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 }, +- { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, +- { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 }, +- { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 }, + + /* Atheros AR5BBU22 with sflash firmware */ + { USB_DEVICE(0x0489, 0xE03C), .driver_info = BTUSB_ATH3012 }, +@@ -149,6 +161,8 @@ static struct usb_device_id ath3k_blist_tbl[] = { + #define USB_REQ_DFU_DNLOAD 1 + #define BULK_SIZE 4096 + #define FW_HDR_SIZE 20 ++#define TIMEGAP_USEC_MIN 50 ++#define TIMEGAP_USEC_MAX 100 + + static int ath3k_load_firmware(struct usb_device *udev, + const struct firmware *firmware) +@@ -179,6 +193,9 @@ static int ath3k_load_firmware(struct usb_device *udev, + count -= 20; + + while (count) { ++ /* workaround the compatibility issue with xHCI controller*/ ++ usleep_range(TIMEGAP_USEC_MIN, TIMEGAP_USEC_MAX); ++ + size = min_t(uint, count, BULK_SIZE); + pipe = usb_sndbulkpipe(udev, 0x02); + memcpy(send_buf, firmware->data + sent, size); +@@ -255,6 +272,9 @@ static int ath3k_load_fwfile(struct usb_device *udev, + count -= size; + + while (count) { ++ /* workaround the compatibility issue with xHCI controller*/ ++ usleep_range(TIMEGAP_USEC_MIN, TIMEGAP_USEC_MAX); ++ + size = min_t(uint, count, BULK_SIZE); + pipe = usb_sndbulkpipe(udev, 0x02); + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 155a61841e2b..ddb2b873a112 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -55,6 +55,7 @@ static struct usb_driver btusb_driver; + #define BTUSB_BROKEN_ISOC 0x20 + #define BTUSB_WRONG_SCO_MTU 0x40 + #define BTUSB_ATH3012 0x80 ++#define BTUSB_INTEL_BOOT 0x200 + + static struct usb_device_id btusb_table[] = { + /* Generic Bluetooth USB device */ +@@ -107,18 +108,25 @@ static struct usb_device_id btusb_table[] = { + { USB_DEVICE(0x0c10, 0x0000) }, + + /* Broadcom BCM20702A0 */ ++ { USB_DEVICE(0x0489, 0xe042) }, ++ { USB_DEVICE(0x04ca, 0x2003) }, + { USB_DEVICE(0x0b05, 0x17b5) }, + { USB_DEVICE(0x0b05, 0x17cb) }, +- { USB_DEVICE(0x04ca, 0x2003) }, +- { USB_DEVICE(0x0489, 0xe042) }, + { USB_DEVICE(0x413c, 0x8197) }, + + /* Foxconn - Hon Hai */ + { USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01) }, + +- /*Broadcom devices with vendor specific id */ ++ /* Broadcom devices with vendor specific id */ + { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01) }, + ++ /* ASUSTek Computer - Broadcom based */ ++ { USB_VENDOR_AND_INTERFACE_INFO(0x0b05, 0xff, 0x01, 0x01) }, ++ ++ /* Intel Bluetooth USB Bootloader (RAM module) */ ++ { USB_DEVICE(0x8087, 0x0a5a), ++ .driver_info = BTUSB_INTEL_BOOT | BTUSB_BROKEN_ISOC }, ++ + { } /* Terminating entry */ + }; + +@@ -132,52 +140,58 @@ static struct usb_device_id blacklist_table[] = { + { USB_DEVICE(0x0a5c, 0x2033), .driver_info = BTUSB_IGNORE }, + + /* Atheros 3011 with sflash firmware */ ++ { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE }, ++ { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE }, ++ { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE }, + { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE }, + { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE }, + { USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE }, +- { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE }, +- { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE }, +- { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE }, + + /* Atheros AR9285 Malbec with sflash firmware */ + { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE }, + + /* Atheros 3012 with sflash firmware */ ++ { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 }, +- { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 }, +- { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 }, +- { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 }, +- { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 }, +- { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 }, +- { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 }, +- { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, +- { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 }, +- { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 }, +- { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 }, +- { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 }, +- { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, +- { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 }, +- { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 }, + + /* Atheros AR5BBU12 with sflash firmware */ + { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE }, + + /* Atheros AR5BBU12 with sflash firmware */ +- { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 }, + + /* Broadcom BCM2035 */ +- { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU }, +- { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU }, + { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 }, ++ { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU }, ++ { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU }, + + /* Broadcom BCM2045 */ + { USB_DEVICE(0x0a5c, 0x2039), .driver_info = BTUSB_WRONG_SCO_MTU }, +@@ -1050,6 +1064,9 @@ static int btusb_probe(struct usb_interface *intf, + hdev->send = btusb_send_frame; + hdev->notify = btusb_notify; + ++ if (id->driver_info & BTUSB_INTEL_BOOT) ++ set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks); ++ + /* Interface numbers are hardcoded in the specification */ + data->isoc = usb_ifnum_to_if(data->udev, 1); + +diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c +index 112c16e08471..7cb3cb94c672 100644 +--- a/drivers/gpio/gpiolib.c ++++ b/drivers/gpio/gpiolib.c +@@ -60,6 +60,7 @@ struct gpio_desc { + #define FLAG_ACTIVE_LOW 7 /* sysfs value has active low */ + #define FLAG_OPEN_DRAIN 8 /* Gpio is open drain type */ + #define FLAG_OPEN_SOURCE 9 /* Gpio is open source type */ ++#define FLAG_SYSFS_DIR 10 /* show sysfs direction attribute */ + + #define ID_SHIFT 16 /* add new flags before this one */ + +@@ -319,7 +320,7 @@ static ssize_t gpio_value_store(struct device *dev, + return status; + } + +-static const DEVICE_ATTR(value, 0644, ++static DEVICE_ATTR(value, 0644, + gpio_value_show, gpio_value_store); + + static irqreturn_t gpio_sysfs_irq(int irq, void *priv) +@@ -542,17 +543,47 @@ static ssize_t gpio_active_low_store(struct device *dev, + return status ? : size; + } + +-static const DEVICE_ATTR(active_low, 0644, ++static DEVICE_ATTR(active_low, 0644, + gpio_active_low_show, gpio_active_low_store); + +-static const struct attribute *gpio_attrs[] = { ++static umode_t gpio_is_visible(struct kobject *kobj, struct attribute *attr, ++ int n) ++{ ++ struct device *dev = container_of(kobj, struct device, kobj); ++ struct gpio_desc *desc = dev_get_drvdata(dev); ++ unsigned gpio = desc - gpio_desc; ++ umode_t mode = attr->mode; ++ bool show_direction = test_bit(FLAG_SYSFS_DIR, &desc->flags); ++ ++ if (attr == &dev_attr_direction.attr) { ++ if (!show_direction) ++ mode = 0; ++ } else if (attr == &dev_attr_edge.attr) { ++ if (gpio_to_irq(gpio) < 0) ++ mode = 0; ++ if (!show_direction && test_bit(FLAG_IS_OUT, &desc->flags)) ++ mode = 0; ++ } ++ ++ return mode; ++} ++ ++static struct attribute *gpio_attrs[] = { ++ &dev_attr_direction.attr, ++ &dev_attr_edge.attr, + &dev_attr_value.attr, + &dev_attr_active_low.attr, + NULL, + }; + +-static const struct attribute_group gpio_attr_group = { +- .attrs = (struct attribute **) gpio_attrs, ++static const struct attribute_group gpio_group = { ++ .attrs = gpio_attrs, ++ .is_visible = gpio_is_visible, ++}; ++ ++static const struct attribute_group *gpio_groups[] = { ++ &gpio_group, ++ NULL + }; + + /* +@@ -589,16 +620,13 @@ static ssize_t chip_ngpio_show(struct device *dev, + } + static DEVICE_ATTR(ngpio, 0444, chip_ngpio_show, NULL); + +-static const struct attribute *gpiochip_attrs[] = { ++static struct attribute *gpiochip_attrs[] = { + &dev_attr_base.attr, + &dev_attr_label.attr, + &dev_attr_ngpio.attr, + NULL, + }; +- +-static const struct attribute_group gpiochip_attr_group = { +- .attrs = (struct attribute **) gpiochip_attrs, +-}; ++ATTRIBUTE_GROUPS(gpiochip); + + /* + * /sys/class/gpio/export ... write-only +@@ -704,8 +732,9 @@ int gpio_export(unsigned gpio, bool direction_may_change) + { + unsigned long flags; + struct gpio_desc *desc; +- int status = -EINVAL; ++ int status; + const char *ioname = NULL; ++ struct device *dev; + + /* can't export until sysfs is available ... */ + if (!gpio_class.p) { +@@ -713,59 +742,50 @@ int gpio_export(unsigned gpio, bool direction_may_change) + return -ENOENT; + } + +- if (!gpio_is_valid(gpio)) +- goto done; ++ if (!gpio_is_valid(gpio)) { ++ pr_debug("%s: gpio %d is not valid\n", __func__, gpio); ++ return -EINVAL; ++ } + + mutex_lock(&sysfs_lock); + + spin_lock_irqsave(&gpio_lock, flags); + desc = &gpio_desc[gpio]; +- if (test_bit(FLAG_REQUESTED, &desc->flags) +- && !test_bit(FLAG_EXPORT, &desc->flags)) { +- status = 0; +- if (!desc->chip->direction_input +- || !desc->chip->direction_output) +- direction_may_change = false; ++ if (!test_bit(FLAG_REQUESTED, &desc->flags) || ++ test_bit(FLAG_EXPORT, &desc->flags)) { ++ spin_unlock_irqrestore(&gpio_lock, flags); ++ pr_debug("%s: gpio %d unavailable (requested=%d, exported=%d)\n", ++ __func__, gpio, ++ test_bit(FLAG_REQUESTED, &desc->flags), ++ test_bit(FLAG_EXPORT, &desc->flags)); ++ return -EPERM; + } ++ ++ if (desc->chip->direction_input && desc->chip->direction_output && ++ direction_may_change) { ++ set_bit(FLAG_SYSFS_DIR, &desc->flags); ++ } ++ + spin_unlock_irqrestore(&gpio_lock, flags); + + if (desc->chip->names && desc->chip->names[gpio - desc->chip->base]) + ioname = desc->chip->names[gpio - desc->chip->base]; + +- if (status == 0) { +- struct device *dev; +- +- dev = device_create(&gpio_class, desc->chip->dev, MKDEV(0, 0), +- desc, ioname ? ioname : "gpio%u", gpio); +- if (!IS_ERR(dev)) { +- status = sysfs_create_group(&dev->kobj, +- &gpio_attr_group); +- +- if (!status && direction_may_change) +- status = device_create_file(dev, +- &dev_attr_direction); +- +- if (!status && gpio_to_irq(gpio) >= 0 +- && (direction_may_change +- || !test_bit(FLAG_IS_OUT, +- &desc->flags))) +- status = device_create_file(dev, +- &dev_attr_edge); +- +- if (status != 0) +- device_unregister(dev); +- } else +- status = PTR_ERR(dev); +- if (status == 0) +- set_bit(FLAG_EXPORT, &desc->flags); ++ dev = device_create_with_groups(&gpio_class, desc->chip->dev, ++ MKDEV(0, 0), desc, gpio_groups, ++ ioname ? ioname : "gpio%u", gpio); ++ if (IS_ERR(dev)) { ++ status = PTR_ERR(dev); ++ goto fail_unlock; + } + ++ set_bit(FLAG_EXPORT, &desc->flags); + mutex_unlock(&sysfs_lock); ++ return 0; + +-done: +- if (status) +- pr_debug("%s: gpio%d status %d\n", __func__, gpio, status); +- ++fail_unlock: ++ mutex_unlock(&sysfs_lock); ++ pr_debug("%s: gpio%d status %d\n", __func__, gpio, status); + return status; + } + EXPORT_SYMBOL_GPL(gpio_export); +@@ -805,6 +825,7 @@ int gpio_export_link(struct device *dev, const char *name, unsigned gpio) + if (tdev != NULL) { + status = sysfs_create_link(&dev->kobj, &tdev->kobj, + name); ++ put_device(tdev); + } else { + status = -ENODEV; + } +@@ -855,7 +876,7 @@ int gpio_sysfs_set_active_low(unsigned gpio, int value) + } + + status = sysfs_set_active_low(desc, dev, value); +- ++ put_device(dev); + unlock: + mutex_unlock(&sysfs_lock); + +@@ -893,6 +914,7 @@ void gpio_unexport(unsigned gpio) + dev = class_find_device(&gpio_class, NULL, desc, match_export); + if (dev) { + gpio_setup_irq(desc, dev, 0); ++ clear_bit(FLAG_SYSFS_DIR, &desc->flags); + clear_bit(FLAG_EXPORT, &desc->flags); + } else + status = -ENODEV; +@@ -924,13 +946,13 @@ static int gpiochip_export(struct gpio_chip *chip) + + /* use chip->base for the ID; it's already known to be unique */ + mutex_lock(&sysfs_lock); +- dev = device_create(&gpio_class, chip->dev, MKDEV(0, 0), chip, +- "gpiochip%d", chip->base); +- if (!IS_ERR(dev)) { +- status = sysfs_create_group(&dev->kobj, +- &gpiochip_attr_group); +- } else ++ dev = device_create_with_groups(&gpio_class, chip->dev, MKDEV(0, 0), ++ chip, gpiochip_groups, ++ "gpiochip%d", chip->base); ++ if (IS_ERR(dev)) + status = PTR_ERR(dev); ++ else ++ status = 0; + chip->exported = (status == 0); + mutex_unlock(&sysfs_lock); + +@@ -1081,19 +1103,18 @@ int gpiochip_add(struct gpio_chip *chip) + ? (1 << FLAG_IS_OUT) + : 0; + } +- } + +- of_gpiochip_add(chip); ++ of_gpiochip_add(chip); ++ } + + unlock: + spin_unlock_irqrestore(&gpio_lock, flags); + +- if (status) +- goto fail; +- + status = gpiochip_export(chip); +- if (status) ++ if (status) { ++ of_gpiochip_remove(chip); + goto fail; ++ } + + pr_info("gpiochip_add: registered GPIOs %d to %d on device: %s\n", + chip->base, chip->base + chip->ngpio - 1, +diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c +index 2ac4ded0de99..b1f1d105e8c7 100644 +--- a/drivers/gpu/drm/i915/i915_gem.c ++++ b/drivers/gpu/drm/i915/i915_gem.c +@@ -2193,6 +2193,13 @@ static int sandybridge_write_fence_reg(struct drm_i915_gem_object *obj, + int regnum = obj->fence_reg; + uint64_t val; + ++ /* Adjust fence size to match tiled area */ ++ if (obj->tiling_mode != I915_TILING_NONE) { ++ uint32_t row_size = obj->stride * ++ (obj->tiling_mode == I915_TILING_Y ? 32 : 8); ++ size = (size / row_size) * row_size; ++ } ++ + val = (uint64_t)((obj->gtt_offset + size - 4096) & + 0xfffff000) << 32; + val |= obj->gtt_offset & 0xfffff000; +@@ -2230,6 +2237,13 @@ static int i965_write_fence_reg(struct drm_i915_gem_object *obj, + int regnum = obj->fence_reg; + uint64_t val; + ++ /* Adjust fence size to match tiled area */ ++ if (obj->tiling_mode != I915_TILING_NONE) { ++ uint32_t row_size = obj->stride * ++ (obj->tiling_mode == I915_TILING_Y ? 32 : 8); ++ size = (size / row_size) * row_size; ++ } ++ + val = (uint64_t)((obj->gtt_offset + size - 4096) & + 0xfffff000) << 32; + val |= obj->gtt_offset & 0xfffff000; +diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c +index 77190cc774cb..3febe292034a 100644 +--- a/drivers/gpu/drm/i915/intel_lvds.c ++++ b/drivers/gpu/drm/i915/intel_lvds.c +@@ -932,6 +932,17 @@ bool intel_lvds_init(struct drm_device *dev) + int pipe; + u8 pin; + ++ /* ++ * Unlock registers and just leave them unlocked. Do this before ++ * checking quirk lists to avoid bogus WARNINGs. ++ */ ++ if (HAS_PCH_SPLIT(dev)) { ++ I915_WRITE(PCH_PP_CONTROL, ++ I915_READ(PCH_PP_CONTROL) | PANEL_UNLOCK_REGS); ++ } else { ++ I915_WRITE(PP_CONTROL, ++ I915_READ(PP_CONTROL) | PANEL_UNLOCK_REGS); ++ } + if (!intel_lvds_supported(dev)) + return false; + +@@ -1109,19 +1120,6 @@ out: + pwm = I915_READ(BLC_PWM_PCH_CTL1); + pwm |= PWM_PCH_ENABLE; + I915_WRITE(BLC_PWM_PCH_CTL1, pwm); +- /* +- * Unlock registers and just +- * leave them unlocked +- */ +- I915_WRITE(PCH_PP_CONTROL, +- I915_READ(PCH_PP_CONTROL) | PANEL_UNLOCK_REGS); +- } else { +- /* +- * Unlock registers and just +- * leave them unlocked +- */ +- I915_WRITE(PP_CONTROL, +- I915_READ(PP_CONTROL) | PANEL_UNLOCK_REGS); + } + dev_priv->lid_notifier.notifier_call = intel_lid_notify; + if (acpi_lid_notifier_register(&dev_priv->lid_notifier)) { +diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c +index 9b46238b9692..b7316869f59e 100644 +--- a/drivers/gpu/drm/radeon/radeon_kms.c ++++ b/drivers/gpu/drm/radeon/radeon_kms.c +@@ -428,6 +428,8 @@ int radeon_get_vblank_timestamp_kms(struct drm_device *dev, int crtc, + + /* Get associated drm_crtc: */ + drmcrtc = &rdev->mode_info.crtcs[crtc]->base; ++ if (!drmcrtc) ++ return -EINVAL; + + /* Helper routine in DRM core does all the work: */ + return drm_calc_vbltimestamp_from_scanoutpos(dev, crtc, max_error, +diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c +index 49b55edc55b6..15042d0ca035 100644 +--- a/drivers/gpu/drm/radeon/radeon_ttm.c ++++ b/drivers/gpu/drm/radeon/radeon_ttm.c +@@ -188,7 +188,7 @@ static void radeon_evict_flags(struct ttm_buffer_object *bo, + rbo = container_of(bo, struct radeon_bo, tbo); + switch (bo->mem.mem_type) { + case TTM_PL_VRAM: +- if (rbo->rdev->ring[RADEON_RING_TYPE_GFX_INDEX].ready == false) ++ if (rbo->rdev->ring[radeon_copy_ring_index(rbo->rdev)].ready == false) + radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_CPU); + else + radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_GTT); +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c +index 7e0743358dff..992b46bbadfb 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c +@@ -485,14 +485,7 @@ void vmw_fence_obj_flush(struct vmw_fence_obj *fence) + + static void vmw_fence_destroy(struct vmw_fence_obj *fence) + { +- struct vmw_fence_manager *fman = fence->fman; +- + kfree(fence); +- /* +- * Free kernel space accounting. +- */ +- ttm_mem_global_free(vmw_mem_glob(fman->dev_priv), +- fman->fence_size); + } + + int vmw_fence_create(struct vmw_fence_manager *fman, +@@ -500,20 +493,12 @@ int vmw_fence_create(struct vmw_fence_manager *fman, + uint32_t mask, + struct vmw_fence_obj **p_fence) + { +- struct ttm_mem_global *mem_glob = vmw_mem_glob(fman->dev_priv); + struct vmw_fence_obj *fence; + int ret; + +- ret = ttm_mem_global_alloc(mem_glob, fman->fence_size, +- false, false); +- if (unlikely(ret != 0)) +- return ret; +- + fence = kzalloc(sizeof(*fence), GFP_KERNEL); +- if (unlikely(fence == NULL)) { +- ret = -ENOMEM; +- goto out_no_object; +- } ++ if (unlikely(fence == NULL)) ++ return -ENOMEM; + + ret = vmw_fence_obj_init(fman, fence, seqno, mask, + vmw_fence_destroy); +@@ -525,8 +510,6 @@ int vmw_fence_create(struct vmw_fence_manager *fman, + + out_err_init: + kfree(fence); +-out_no_object: +- ttm_mem_global_free(mem_glob, fman->fence_size); + return ret; + } + +@@ -1049,6 +1032,8 @@ int vmw_event_fence_action_create(struct drm_file *file_priv, + if (ret != 0) + goto out_no_queue; + ++ return 0; ++ + out_no_queue: + event->base.destroy(&event->base); + out_no_event: +@@ -1123,17 +1108,10 @@ int vmw_fence_event_ioctl(struct drm_device *dev, void *data, + + BUG_ON(fence == NULL); + +- if (arg->flags & DRM_VMW_FE_FLAG_REQ_TIME) +- ret = vmw_event_fence_action_create(file_priv, fence, +- arg->flags, +- arg->user_data, +- true); +- else +- ret = vmw_event_fence_action_create(file_priv, fence, +- arg->flags, +- arg->user_data, +- true); +- ++ ret = vmw_event_fence_action_create(file_priv, fence, ++ arg->flags, ++ arg->user_data, ++ true); + if (unlikely(ret != 0)) { + if (ret != -ERESTARTSYS) + DRM_ERROR("Failed to attach event to fence.\n"); +diff --git a/drivers/hid/hid-roccat-pyra.c b/drivers/hid/hid-roccat-pyra.c +index df05c1b1064f..53466474b420 100644 +--- a/drivers/hid/hid-roccat-pyra.c ++++ b/drivers/hid/hid-roccat-pyra.c +@@ -35,6 +35,8 @@ static struct class *pyra_class; + static void profile_activated(struct pyra_device *pyra, + unsigned int new_profile) + { ++ if (new_profile >= ARRAY_SIZE(pyra->profile_settings)) ++ return; + pyra->actual_profile = new_profile; + pyra->actual_cpi = pyra->profile_settings[pyra->actual_profile].y_cpi; + } +@@ -299,10 +301,15 @@ static ssize_t pyra_sysfs_write_settings(struct file *fp, + int retval = 0; + int difference; + struct pyra_roccat_report roccat_report; ++ struct pyra_settings const *settings; + + if (off != 0 || count != sizeof(struct pyra_settings)) + return -EINVAL; + ++ settings = (struct pyra_settings const *)buf; ++ if (settings->startup_profile >= ARRAY_SIZE(pyra->profile_settings)) ++ return -EINVAL; ++ + mutex_lock(&pyra->pyra_lock); + difference = memcmp(buf, &pyra->settings, sizeof(struct pyra_settings)); + if (difference) { +diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c +index 10619b34bd31..1ec309dbacde 100644 +--- a/drivers/hv/vmbus_drv.c ++++ b/drivers/hv/vmbus_drv.c +@@ -681,7 +681,7 @@ int vmbus_device_register(struct hv_device *child_device_obj) + if (ret) + pr_err("Unable to register child device\n"); + else +- pr_info("child device %s registered\n", ++ pr_debug("child device %s registered\n", + dev_name(&child_device_obj->device)); + + return ret; +@@ -693,14 +693,14 @@ int vmbus_device_register(struct hv_device *child_device_obj) + */ + void vmbus_device_unregister(struct hv_device *device_obj) + { ++ pr_debug("child device %s unregistered\n", ++ dev_name(&device_obj->device)); ++ + /* + * Kick off the process of unregistering the device. + * This will call vmbus_remove() and eventually vmbus_device_release() + */ + device_unregister(&device_obj->device); +- +- pr_info("child device %s unregistered\n", +- dev_name(&device_obj->device)); + } + + +diff --git a/drivers/i2c/busses/i2c-davinci.c b/drivers/i2c/busses/i2c-davinci.c +index 79b4bcb3b85c..1837fe6677b9 100644 +--- a/drivers/i2c/busses/i2c-davinci.c ++++ b/drivers/i2c/busses/i2c-davinci.c +@@ -416,11 +416,9 @@ i2c_davinci_xfer_msg(struct i2c_adapter *adap, struct i2c_msg *msg, int stop) + if (dev->cmd_err & DAVINCI_I2C_STR_NACK) { + if (msg->flags & I2C_M_IGNORE_NAK) + return msg->len; +- if (stop) { +- w = davinci_i2c_read_reg(dev, DAVINCI_I2C_MDR_REG); +- w |= DAVINCI_I2C_MDR_STP; +- davinci_i2c_write_reg(dev, DAVINCI_I2C_MDR_REG, w); +- } ++ w = davinci_i2c_read_reg(dev, DAVINCI_I2C_MDR_REG); ++ w |= DAVINCI_I2C_MDR_STP; ++ davinci_i2c_write_reg(dev, DAVINCI_I2C_MDR_REG, w); + return -EREMOTEIO; + } + return -EIO; +diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c +index 42f7b257feb0..b4e8db847a34 100644 +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -979,9 +979,19 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id + } + + ep_irq_in = &intf->cur_altsetting->endpoint[1].desc; +- usb_fill_bulk_urb(xpad->bulk_out, udev, +- usb_sndbulkpipe(udev, ep_irq_in->bEndpointAddress), +- xpad->bdata, XPAD_PKT_LEN, xpad_bulk_out, xpad); ++ if (usb_endpoint_is_bulk_out(ep_irq_in)) { ++ usb_fill_bulk_urb(xpad->bulk_out, udev, ++ usb_sndbulkpipe(udev, ++ ep_irq_in->bEndpointAddress), ++ xpad->bdata, XPAD_PKT_LEN, ++ xpad_bulk_out, xpad); ++ } else { ++ usb_fill_int_urb(xpad->bulk_out, udev, ++ usb_sndintpipe(udev, ++ ep_irq_in->bEndpointAddress), ++ xpad->bdata, XPAD_PKT_LEN, ++ xpad_bulk_out, xpad, 0); ++ } + + /* + * Submit the int URB immediately rather than waiting for open +diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h +index ce715b1bee46..78227f32d6fa 100644 +--- a/drivers/input/serio/i8042-x86ia64io.h ++++ b/drivers/input/serio/i8042-x86ia64io.h +@@ -408,6 +408,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = { + }, + }, + { ++ /* Acer Aspire 7738 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 7738"), ++ }, ++ }, ++ { + /* Gericom Bellagio */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Gericom"), +@@ -721,6 +728,35 @@ static const struct dmi_system_id __initconst i8042_dmi_dritek_table[] = { + { } + }; + ++/* ++ * Some laptops need keyboard reset before probing for the trackpad to get ++ * it detected, initialised & finally work. ++ */ ++static const struct dmi_system_id __initconst i8042_dmi_kbdreset_table[] = { ++ { ++ /* Gigabyte P35 v2 - Elantech touchpad */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "P35V2"), ++ }, ++ }, ++ { ++ /* Aorus branded Gigabyte X3 Plus - Elantech touchpad */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "X3"), ++ }, ++ }, ++ { ++ /* Gigabyte P34 - Elantech touchpad */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "P34"), ++ }, ++ }, ++ { } ++}; ++ + #endif /* CONFIG_X86 */ + + #ifdef CONFIG_PNP +@@ -1001,6 +1037,9 @@ static int __init i8042_platform_init(void) + if (dmi_check_system(i8042_dmi_dritek_table)) + i8042_dritek = true; + ++ if (dmi_check_system(i8042_dmi_kbdreset_table)) ++ i8042_kbdreset = true; ++ + /* + * A20 was already enabled during early kernel init. But some buggy + * BIOSes (in MSI Laptops) require A20 to be enabled using 8042 to +diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c +index 86564414b75a..178e75d6bb06 100644 +--- a/drivers/input/serio/i8042.c ++++ b/drivers/input/serio/i8042.c +@@ -67,6 +67,10 @@ static bool i8042_notimeout; + module_param_named(notimeout, i8042_notimeout, bool, 0); + MODULE_PARM_DESC(notimeout, "Ignore timeouts signalled by i8042"); + ++static bool i8042_kbdreset; ++module_param_named(kbdreset, i8042_kbdreset, bool, 0); ++MODULE_PARM_DESC(kbdreset, "Reset device connected to KBD port"); ++ + #ifdef CONFIG_X86 + static bool i8042_dritek; + module_param_named(dritek, i8042_dritek, bool, 0); +@@ -783,6 +787,16 @@ static int __init i8042_check_aux(void) + return -1; + + /* ++ * Reset keyboard (needed on some laptops to successfully detect ++ * touchpad, e.g., some Gigabyte laptop models with Elantech ++ * touchpads). ++ */ ++ if (i8042_kbdreset) { ++ pr_warn("Attempting to reset device connected to KBD port\n"); ++ i8042_kbd_write(NULL, (unsigned char) 0xff); ++ } ++ ++/* + * Test AUX IRQ delivery to make sure BIOS did not grab the IRQ and + * used it for a PCI card or somethig else. + */ +diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c +index dd255c578ad9..28af276cff9f 100644 +--- a/drivers/iommu/intel-iommu.c ++++ b/drivers/iommu/intel-iommu.c +@@ -1792,7 +1792,7 @@ static int __domain_mapping(struct dmar_domain *domain, unsigned long iov_pfn, + struct dma_pte *first_pte = NULL, *pte = NULL; + phys_addr_t uninitialized_var(pteval); + int addr_width = agaw_to_width(domain->agaw) - VTD_PAGE_SHIFT; +- unsigned long sg_res; ++ unsigned long sg_res = 0; + unsigned int largepage_lvl = 0; + unsigned long lvl_pages = 0; + +@@ -1803,10 +1803,8 @@ static int __domain_mapping(struct dmar_domain *domain, unsigned long iov_pfn, + + prot &= DMA_PTE_READ | DMA_PTE_WRITE | DMA_PTE_SNP; + +- if (sg) +- sg_res = 0; +- else { +- sg_res = nr_pages + 1; ++ if (!sg) { ++ sg_res = nr_pages; + pteval = ((phys_addr_t)phys_pfn << VTD_PAGE_SHIFT) | prot; + } + +diff --git a/drivers/mfd/tc6393xb.c b/drivers/mfd/tc6393xb.c +index 9612264f0e6d..b69d91b50d99 100644 +--- a/drivers/mfd/tc6393xb.c ++++ b/drivers/mfd/tc6393xb.c +@@ -263,6 +263,17 @@ static int tc6393xb_ohci_disable(struct platform_device *dev) + return 0; + } + ++static int tc6393xb_ohci_suspend(struct platform_device *dev) ++{ ++ struct tc6393xb_platform_data *tcpd = dev_get_platdata(dev->dev.parent); ++ ++ /* We can't properly store/restore OHCI state, so fail here */ ++ if (tcpd->resume_restore) ++ return -EBUSY; ++ ++ return tc6393xb_ohci_disable(dev); ++} ++ + static int tc6393xb_fb_enable(struct platform_device *dev) + { + struct tc6393xb *tc6393xb = dev_get_drvdata(dev->dev.parent); +@@ -403,7 +414,7 @@ static struct mfd_cell __devinitdata tc6393xb_cells[] = { + .num_resources = ARRAY_SIZE(tc6393xb_ohci_resources), + .resources = tc6393xb_ohci_resources, + .enable = tc6393xb_ohci_enable, +- .suspend = tc6393xb_ohci_disable, ++ .suspend = tc6393xb_ohci_suspend, + .resume = tc6393xb_ohci_enable, + .disable = tc6393xb_ohci_disable, + }, +diff --git a/drivers/mtd/ubi/upd.c b/drivers/mtd/ubi/upd.c +index 425bf5a3edd4..068a2466d060 100644 +--- a/drivers/mtd/ubi/upd.c ++++ b/drivers/mtd/ubi/upd.c +@@ -135,6 +135,10 @@ int ubi_start_update(struct ubi_device *ubi, struct ubi_volume *vol, + ubi_assert(!vol->updating && !vol->changing_leb); + vol->updating = 1; + ++ vol->upd_buf = vmalloc(ubi->leb_size); ++ if (!vol->upd_buf) ++ return -ENOMEM; ++ + err = set_update_marker(ubi, vol); + if (err) + return err; +@@ -154,14 +158,12 @@ int ubi_start_update(struct ubi_device *ubi, struct ubi_volume *vol, + err = clear_update_marker(ubi, vol, 0); + if (err) + return err; ++ ++ vfree(vol->upd_buf); + vol->updating = 0; + return 0; + } + +- vol->upd_buf = vmalloc(ubi->leb_size); +- if (!vol->upd_buf) +- return -ENOMEM; +- + vol->upd_ebs = div_u64(bytes + vol->usable_leb_size - 1, + vol->usable_leb_size); + vol->upd_bytes = bytes; +diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c +index d4f7f9537db2..88c39e42cf5a 100644 +--- a/drivers/net/can/dev.c ++++ b/drivers/net/can/dev.c +@@ -612,10 +612,14 @@ static int can_changelink(struct net_device *dev, + if (dev->flags & IFF_UP) + return -EBUSY; + cm = nla_data(data[IFLA_CAN_CTRLMODE]); +- if (cm->flags & ~priv->ctrlmode_supported) ++ ++ /* check whether changed bits are allowed to be modified */ ++ if (cm->mask & ~priv->ctrlmode_supported) + return -EOPNOTSUPP; ++ ++ /* clear bits to be modified and copy the flag values */ + priv->ctrlmode &= ~cm->mask; +- priv->ctrlmode |= cm->flags; ++ priv->ctrlmode |= (cm->flags & cm->mask); + } + + if (data[IFLA_CAN_BITTIMING]) { +diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c +index d2f91f737871..925c7e16a1c0 100644 +--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c ++++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c +@@ -737,7 +737,7 @@ static int peak_usb_create_dev(struct peak_usb_adapter *peak_usb_adapter, + dev_err(&intf->dev, "%s: couldn't alloc cmd buffer\n", + PCAN_USB_DRIVER_NAME); + err = -ENOMEM; +- goto lbl_set_intf_data; ++ goto lbl_free_candev; + } + + dev->udev = usb_dev; +@@ -776,7 +776,7 @@ static int peak_usb_create_dev(struct peak_usb_adapter *peak_usb_adapter, + err = register_candev(netdev); + if (err) { + dev_err(&intf->dev, "couldn't register CAN device: %d\n", err); +- goto lbl_free_cmd_buf; ++ goto lbl_restore_intf_data; + } + + if (dev->prev_siblings) +@@ -789,14 +789,14 @@ static int peak_usb_create_dev(struct peak_usb_adapter *peak_usb_adapter, + if (dev->adapter->dev_init) { + err = dev->adapter->dev_init(dev); + if (err) +- goto lbl_free_cmd_buf; ++ goto lbl_unregister_candev; + } + + /* set bus off */ + if (dev->adapter->dev_set_bus) { + err = dev->adapter->dev_set_bus(dev, 0); + if (err) +- goto lbl_free_cmd_buf; ++ goto lbl_unregister_candev; + } + + /* get device number early */ +@@ -808,11 +808,14 @@ static int peak_usb_create_dev(struct peak_usb_adapter *peak_usb_adapter, + + return 0; + +-lbl_free_cmd_buf: +- kfree(dev->cmd_buf); ++lbl_unregister_candev: ++ unregister_candev(netdev); + +-lbl_set_intf_data: ++lbl_restore_intf_data: + usb_set_intfdata(intf, dev->prev_siblings); ++ kfree(dev->cmd_buf); ++ ++lbl_free_candev: + free_candev(netdev); + + return err; +diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c +index c95913a09737..5fe28be94de1 100644 +--- a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c ++++ b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c +@@ -333,8 +333,6 @@ static int pcan_usb_pro_send_req(struct peak_usb_device *dev, int req_id, + if (!(dev->state & PCAN_USB_STATE_CONNECTED)) + return 0; + +- memset(req_addr, '\0', req_size); +- + req_type = USB_TYPE_VENDOR | USB_RECIP_OTHER; + + switch (req_id) { +@@ -345,6 +343,7 @@ static int pcan_usb_pro_send_req(struct peak_usb_device *dev, int req_id, + default: + p = usb_rcvctrlpipe(dev->udev, 0); + req_type |= USB_DIR_IN; ++ memset(req_addr, '\0', req_size); + break; + } + +diff --git a/drivers/net/wireless/ath/ath5k/qcu.c b/drivers/net/wireless/ath/ath5k/qcu.c +index 30b50f934172..19ba20473cd7 100644 +--- a/drivers/net/wireless/ath/ath5k/qcu.c ++++ b/drivers/net/wireless/ath/ath5k/qcu.c +@@ -223,13 +223,7 @@ ath5k_hw_setup_tx_queue(struct ath5k_hw *ah, enum ath5k_tx_queue queue_type, + } else { + switch (queue_type) { + case AR5K_TX_QUEUE_DATA: +- for (queue = AR5K_TX_QUEUE_ID_DATA_MIN; +- ah->ah_txq[queue].tqi_type != +- AR5K_TX_QUEUE_INACTIVE; queue++) { +- +- if (queue > AR5K_TX_QUEUE_ID_DATA_MAX) +- return -EINVAL; +- } ++ queue = queue_info->tqi_subtype; + break; + case AR5K_TX_QUEUE_UAPSD: + queue = AR5K_TX_QUEUE_ID_UAPSD; +diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h +index f49be96aba75..d4f09b4088b5 100644 +--- a/drivers/net/wireless/ath/ath9k/hw.h ++++ b/drivers/net/wireless/ath/ath9k/hw.h +@@ -181,8 +181,8 @@ + #define PAPRD_IDEAL_AGC2_PWR_RANGE 0xe0 + + enum ath_hw_txq_subtype { +- ATH_TXQ_AC_BE = 0, +- ATH_TXQ_AC_BK = 1, ++ ATH_TXQ_AC_BK = 0, ++ ATH_TXQ_AC_BE = 1, + ATH_TXQ_AC_VI = 2, + ATH_TXQ_AC_VO = 3, + }; +diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c +index f7bd2532269c..2d628f97e18c 100644 +--- a/drivers/net/wireless/ath/ath9k/mac.c ++++ b/drivers/net/wireless/ath/ath9k/mac.c +@@ -303,14 +303,7 @@ int ath9k_hw_setuptxqueue(struct ath_hw *ah, enum ath9k_tx_queue type, + q = ATH9K_NUM_TX_QUEUES - 3; + break; + case ATH9K_TX_QUEUE_DATA: +- for (q = 0; q < ATH9K_NUM_TX_QUEUES; q++) +- if (ah->txq[q].tqi_type == +- ATH9K_TX_QUEUE_INACTIVE) +- break; +- if (q == ATH9K_NUM_TX_QUEUES) { +- ath_err(common, "No available TX queue\n"); +- return -1; +- } ++ q = qinfo->tqi_subtype; + break; + default: + ath_err(common, "Invalid TX queue type: %u\n", type); +diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c +index 63e0199f7c78..d62ad0b1516d 100644 +--- a/drivers/pci/probe.c ++++ b/drivers/pci/probe.c +@@ -254,14 +254,17 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type, + res->flags |= IORESOURCE_SIZEALIGN; + if (res->flags & IORESOURCE_IO) { + l &= PCI_BASE_ADDRESS_IO_MASK; ++ sz &= PCI_BASE_ADDRESS_IO_MASK; + mask = PCI_BASE_ADDRESS_IO_MASK & (u32) IO_SPACE_LIMIT; + } else { + l &= PCI_BASE_ADDRESS_MEM_MASK; ++ sz &= PCI_BASE_ADDRESS_MEM_MASK; + mask = (u32)PCI_BASE_ADDRESS_MEM_MASK; + } + } else { + res->flags |= (l & IORESOURCE_ROM_ENABLE); + l &= PCI_ROM_ADDRESS_MASK; ++ sz &= PCI_ROM_ADDRESS_MASK; + mask = (u32)PCI_ROM_ADDRESS_MASK; + } + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index e587d0035a74..ffde183ac1b3 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -327,19 +327,52 @@ static void __devinit quirk_s3_64M(struct pci_dev *dev) + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_S3, PCI_DEVICE_ID_S3_868, quirk_s3_64M); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_S3, PCI_DEVICE_ID_S3_968, quirk_s3_64M); + ++static void quirk_io(struct pci_dev *dev, int pos, unsigned size, ++ const char *name) ++{ ++ u32 region; ++ struct pci_bus_region bus_region; ++ struct resource *res = dev->resource + pos; ++ ++ pci_read_config_dword(dev, PCI_BASE_ADDRESS_0 + (pos << 2), ®ion); ++ ++ if (!region) ++ return; ++ ++ res->name = pci_name(dev); ++ res->flags = region & ~PCI_BASE_ADDRESS_IO_MASK; ++ res->flags |= ++ (IORESOURCE_IO | IORESOURCE_PCI_FIXED | IORESOURCE_SIZEALIGN); ++ region &= ~(size - 1); ++ ++ /* Convert from PCI bus to resource space */ ++ bus_region.start = region; ++ bus_region.end = region + size - 1; ++ pcibios_bus_to_resource(dev->bus, res, &bus_region); ++ ++ dev_info(&dev->dev, FW_BUG "%s quirk: reg 0x%x: %pR\n", ++ name, PCI_BASE_ADDRESS_0 + (pos << 2), res); ++} ++ + /* + * Some CS5536 BIOSes (for example, the Soekris NET5501 board w/ comBIOS + * ver. 1.33 20070103) don't set the correct ISA PCI region header info. + * BAR0 should be 8 bytes; instead, it may be set to something like 8k + * (which conflicts w/ BAR1's memory range). ++ * ++ * CS553x's ISA PCI BARs may also be read-only (ref: ++ * https://bugzilla.kernel.org/show_bug.cgi?id=85991 - Comment #4 forward). + */ + static void __devinit quirk_cs5536_vsa(struct pci_dev *dev) + { ++ static char *name = "CS5536 ISA bridge"; ++ + if (pci_resource_len(dev, 0) != 8) { +- struct resource *res = &dev->resource[0]; +- res->end = res->start + 8 - 1; +- dev_info(&dev->dev, "CS5536 ISA bridge bug detected " +- "(incorrect header); workaround applied.\n"); ++ quirk_io(dev, 0, 8, name); /* SMB */ ++ quirk_io(dev, 1, 256, name); /* GPIO */ ++ quirk_io(dev, 2, 64, name); /* MFGPT */ ++ dev_info(&dev->dev, "%s bug detected (incorrect header); workaround applied\n", ++ name); + } + } + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_CS5536_ISA, quirk_cs5536_vsa); +diff --git a/drivers/platform/x86/hp_accel.c b/drivers/platform/x86/hp_accel.c +index 0076feae0ce3..be6b6482da57 100644 +--- a/drivers/platform/x86/hp_accel.c ++++ b/drivers/platform/x86/hp_accel.c +@@ -237,6 +237,7 @@ static struct dmi_system_id lis3lv02d_dmi_ids[] = { + AXIS_DMI_MATCH("HPB64xx", "HP ProBook 64", xy_swap), + AXIS_DMI_MATCH("HPB64xx", "HP EliteBook 84", xy_swap), + AXIS_DMI_MATCH("HPB65xx", "HP ProBook 65", x_inverted), ++ AXIS_DMI_MATCH("HPZBook15", "HP ZBook 15", x_inverted), + { NULL, } + /* Laptop models without axis info (yet): + * "NC6910" "HP Compaq 6910" +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index c18f0fd1577f..0d71557cf7a3 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -1395,12 +1395,14 @@ void regulator_put(struct regulator *regulator) + device_remove_file(regulator->dev, ®ulator->dev_attr); + kfree(regulator->dev_attr.attr.name); + } ++ mutex_lock(&rdev->mutex); + kfree(regulator->supply_name); + list_del(®ulator->list); + kfree(regulator); + + rdev->open_count--; + rdev->exclusive = 0; ++ mutex_unlock(&rdev->mutex); + + module_put(rdev->owner); + mutex_unlock(®ulator_list_mutex); +diff --git a/drivers/s390/char/con3215.c b/drivers/s390/char/con3215.c +index 4f9f1dcc1551..fa47d8de304a 100644 +--- a/drivers/s390/char/con3215.c ++++ b/drivers/s390/char/con3215.c +@@ -997,12 +997,26 @@ static int tty3215_write(struct tty_struct * tty, + const unsigned char *buf, int count) + { + struct raw3215_info *raw; ++ int i, written; + + if (!tty) + return 0; + raw = (struct raw3215_info *) tty->driver_data; +- raw3215_write(raw, buf, count); +- return count; ++ written = count; ++ while (count > 0) { ++ for (i = 0; i < count; i++) ++ if (buf[i] == '\t' || buf[i] == '\n') ++ break; ++ raw3215_write(raw, buf, i); ++ count -= i; ++ buf += i; ++ if (count > 0) { ++ raw3215_putchar(raw, *buf); ++ count--; ++ buf++; ++ } ++ } ++ return written; + } + + /* +@@ -1149,7 +1163,7 @@ static int __init tty3215_init(void) + driver->subtype = SYSTEM_TYPE_TTY; + driver->init_termios = tty_std_termios; + driver->init_termios.c_iflag = IGNBRK | IGNPAR; +- driver->init_termios.c_oflag = ONLCR | XTABS; ++ driver->init_termios.c_oflag = ONLCR; + driver->init_termios.c_lflag = ISIG; + driver->flags = TTY_DRIVER_REAL_RAW; + tty_set_operations(driver, &tty3215_ops); +diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c +index 165e4dd865d9..a57f85ac96c8 100644 +--- a/drivers/scsi/NCR5380.c ++++ b/drivers/scsi/NCR5380.c +@@ -2662,14 +2662,14 @@ static void NCR5380_dma_complete(NCR5380_instance * instance) { + * + * Purpose : abort a command + * +- * Inputs : cmd - the Scsi_Cmnd to abort, code - code to set the +- * host byte of the result field to, if zero DID_ABORTED is ++ * Inputs : cmd - the Scsi_Cmnd to abort, code - code to set the ++ * host byte of the result field to, if zero DID_ABORTED is + * used. + * +- * Returns : 0 - success, -1 on failure. ++ * Returns : SUCCESS - success, FAILED on failure. + * +- * XXX - there is no way to abort the command that is currently +- * connected, you have to wait for it to complete. If this is ++ * XXX - there is no way to abort the command that is currently ++ * connected, you have to wait for it to complete. If this is + * a problem, we could implement longjmp() / setjmp(), setjmp() + * called where the loop started in NCR5380_main(). + * +@@ -2719,7 +2719,7 @@ static int NCR5380_abort(Scsi_Cmnd * cmd) { + * aborted flag and get back into our main loop. + */ + +- return 0; ++ return SUCCESS; + } + #endif + +diff --git a/drivers/scsi/aha1740.c b/drivers/scsi/aha1740.c +index a3e6ed353917..d0fa3e7196d6 100644 +--- a/drivers/scsi/aha1740.c ++++ b/drivers/scsi/aha1740.c +@@ -550,7 +550,7 @@ static int aha1740_eh_abort_handler (Scsi_Cmnd *dummy) + * quiet as possible... + */ + +- return 0; ++ return SUCCESS; + } + + static struct scsi_host_template aha1740_template = { +diff --git a/drivers/scsi/atari_NCR5380.c b/drivers/scsi/atari_NCR5380.c +index 2db79b469d9e..589c2a3f629a 100644 +--- a/drivers/scsi/atari_NCR5380.c ++++ b/drivers/scsi/atari_NCR5380.c +@@ -2638,7 +2638,7 @@ static void NCR5380_reselect(struct Scsi_Host *instance) + * host byte of the result field to, if zero DID_ABORTED is + * used. + * +- * Returns : 0 - success, -1 on failure. ++ * Returns : SUCCESS - success, FAILED on failure. + * + * XXX - there is no way to abort the command that is currently + * connected, you have to wait for it to complete. If this is +diff --git a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c +index c1c6a92a0b98..cabfbf359988 100644 +--- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c ++++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c +@@ -406,6 +406,7 @@ static int bnx2fc_rcv(struct sk_buff *skb, struct net_device *dev, + struct fc_frame_header *fh; + struct fcoe_rcv_info *fr; + struct fcoe_percpu_s *bg; ++ struct sk_buff *tmp_skb; + unsigned short oxid; + + interface = container_of(ptype, struct bnx2fc_interface, +@@ -417,6 +418,12 @@ static int bnx2fc_rcv(struct sk_buff *skb, struct net_device *dev, + goto err; + } + ++ tmp_skb = skb_share_check(skb, GFP_ATOMIC); ++ if (!tmp_skb) ++ goto err; ++ ++ skb = tmp_skb; ++ + if (unlikely(eth_hdr(skb)->h_proto != htons(ETH_P_FCOE))) { + printk(KERN_ERR PFX "bnx2fc_rcv: Wrong FC type frame\n"); + goto err; +diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c +index 4d39a9ffc081..152fe62d7c80 100644 +--- a/drivers/scsi/megaraid.c ++++ b/drivers/scsi/megaraid.c +@@ -1967,7 +1967,7 @@ megaraid_abort_and_reset(adapter_t *adapter, Scsi_Cmnd *cmd, int aor) + cmd->device->id, cmd->device->lun); + + if(list_empty(&adapter->pending_list)) +- return FALSE; ++ return FAILED; + + list_for_each_safe(pos, next, &adapter->pending_list) { + +@@ -1990,7 +1990,7 @@ megaraid_abort_and_reset(adapter_t *adapter, Scsi_Cmnd *cmd, int aor) + (aor==SCB_ABORT) ? "ABORTING":"RESET", + scb->idx); + +- return FALSE; ++ return FAILED; + } + else { + +@@ -2015,12 +2015,12 @@ megaraid_abort_and_reset(adapter_t *adapter, Scsi_Cmnd *cmd, int aor) + list_add_tail(SCSI_LIST(cmd), + &adapter->completed_list); + +- return TRUE; ++ return SUCCESS; + } + } + } + +- return FALSE; ++ return FAILED; + } + + static inline int +diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c +index 618870033dd0..bacd344f4626 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_base.c ++++ b/drivers/scsi/megaraid/megaraid_sas_base.c +@@ -919,7 +919,7 @@ megasas_issue_blocked_abort_cmd(struct megasas_instance *instance, + abort_fr->abort_mfi_phys_addr_hi = 0; + + cmd->sync_cmd = 1; +- cmd->cmd_status = 0xFF; ++ cmd->cmd_status = ENODATA; + + instance->instancet->issue_dcmd(instance, cmd); + +diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c +index 05973a491310..7f6746a642e6 100644 +--- a/drivers/scsi/sd.c ++++ b/drivers/scsi/sd.c +@@ -2238,7 +2238,10 @@ sd_read_cache_type(struct scsi_disk *sdkp, unsigned char *buffer) + } + + sdkp->DPOFUA = (data.device_specific & 0x10) != 0; +- if (sdkp->DPOFUA && !sdkp->device->use_10_for_rw) { ++ if (sdp->broken_fua) { ++ sd_printk(KERN_NOTICE, sdkp, "Disabling FUA\n"); ++ sdkp->DPOFUA = 0; ++ } else if (sdkp->DPOFUA && !sdkp->device->use_10_for_rw) { + sd_printk(KERN_NOTICE, sdkp, + "Uses READ/WRITE(6), disabling FUA\n"); + sdkp->DPOFUA = 0; +diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c +index 446c02379c80..a0df0fbf2db9 100644 +--- a/drivers/scsi/storvsc_drv.c ++++ b/drivers/scsi/storvsc_drv.c +@@ -1359,13 +1359,12 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd) + if (ret == -EAGAIN) { + /* no more space */ + +- if (cmd_request->bounce_sgl_count) { ++ if (cmd_request->bounce_sgl_count) + destroy_bounce_buffer(cmd_request->bounce_sgl, + cmd_request->bounce_sgl_count); + +- ret = SCSI_MLQUEUE_DEVICE_BUSY; +- goto queue_error; +- } ++ ret = SCSI_MLQUEUE_DEVICE_BUSY; ++ goto queue_error; + } + + return 0; +diff --git a/drivers/scsi/sun3_NCR5380.c b/drivers/scsi/sun3_NCR5380.c +index 7e12a2e4e0a3..9aaf0840d0ac 100644 +--- a/drivers/scsi/sun3_NCR5380.c ++++ b/drivers/scsi/sun3_NCR5380.c +@@ -2624,15 +2624,15 @@ static void NCR5380_reselect (struct Scsi_Host *instance) + * Purpose : abort a command + * + * Inputs : cmd - the struct scsi_cmnd to abort, code - code to set the +- * host byte of the result field to, if zero DID_ABORTED is ++ * host byte of the result field to, if zero DID_ABORTED is + * used. + * +- * Returns : 0 - success, -1 on failure. ++ * Returns : SUCCESS - success, FAILED on failure. + * +- * XXX - there is no way to abort the command that is currently +- * connected, you have to wait for it to complete. If this is ++ * XXX - there is no way to abort the command that is currently ++ * connected, you have to wait for it to complete. If this is + * a problem, we could implement longjmp() / setjmp(), setjmp() +- * called where the loop started in NCR5380_main(). ++ * called where the loop started in NCR5380_main(). + */ + + static int NCR5380_abort(struct scsi_cmnd *cmd) +diff --git a/drivers/spi/spi-dw-mid.c b/drivers/spi/spi-dw-mid.c +index efc494a65b43..f15f6241671a 100644 +--- a/drivers/spi/spi-dw-mid.c ++++ b/drivers/spi/spi-dw-mid.c +@@ -219,7 +219,6 @@ int dw_spi_mid_init(struct dw_spi *dws) + iounmap(clk_reg); + + dws->num_cs = 16; +- dws->fifo_len = 40; /* FIFO has 40 words buffer */ + + #ifdef CONFIG_SPI_DW_MID_DMA + dws->dma_priv = kzalloc(sizeof(struct mid_dma), GFP_KERNEL); +diff --git a/drivers/spi/spi-dw.c b/drivers/spi/spi-dw.c +index d1a495f64e2d..cce2d7b90aad 100644 +--- a/drivers/spi/spi-dw.c ++++ b/drivers/spi/spi-dw.c +@@ -394,9 +394,6 @@ static void pump_transfers(unsigned long data) + chip = dws->cur_chip; + spi = message->spi; + +- if (unlikely(!chip->clk_div)) +- chip->clk_div = dws->max_freq / chip->speed_hz; +- + if (message->state == ERROR_STATE) { + message->status = -EIO; + goto early_exit; +@@ -438,7 +435,7 @@ static void pump_transfers(unsigned long data) + if (transfer->speed_hz) { + speed = chip->speed_hz; + +- if (transfer->speed_hz != speed) { ++ if ((transfer->speed_hz != speed) || (!chip->clk_div)) { + speed = transfer->speed_hz; + if (speed > dws->max_freq) { + printk(KERN_ERR "MRST SPI0: unsupported" +@@ -677,7 +674,6 @@ static int dw_spi_setup(struct spi_device *spi) + dev_err(&spi->dev, "No max speed HZ parameter\n"); + return -EINVAL; + } +- chip->speed_hz = spi->max_speed_hz; + + chip->tmode = 0; /* Tx & Rx */ + /* Default SPI mode is SCPOL = 0, SCPH = 0 */ +@@ -784,13 +780,13 @@ static void spi_hw_init(struct dw_spi *dws) + */ + if (!dws->fifo_len) { + u32 fifo; +- for (fifo = 2; fifo <= 257; fifo++) { ++ for (fifo = 1; fifo < 256; fifo++) { + dw_writew(dws, DW_SPI_TXFLTR, fifo); + if (fifo != dw_readw(dws, DW_SPI_TXFLTR)) + break; + } + +- dws->fifo_len = (fifo == 257) ? 0 : fifo; ++ dws->fifo_len = (fifo == 1) ? 0 : fifo; + dw_writew(dws, DW_SPI_TXFLTR, 0); + } + } +diff --git a/drivers/staging/comedi/drivers/cb_pcidas64.c b/drivers/staging/comedi/drivers/cb_pcidas64.c +index 915157d47805..6f743df82542 100644 +--- a/drivers/staging/comedi/drivers/cb_pcidas64.c ++++ b/drivers/staging/comedi/drivers/cb_pcidas64.c +@@ -423,6 +423,29 @@ static const struct comedi_lrange ai_ranges_64xx = { + } + }; + ++static const uint8_t ai_range_code_64xx[8] = { ++ 0x0, 0x1, 0x2, 0x3, /* bipolar 10, 5, 2,5, 1.25 */ ++ 0x8, 0x9, 0xa, 0xb /* unipolar 10, 5, 2.5, 1.25 */ ++}; ++ ++/* analog input ranges for 64-Mx boards */ ++static const struct comedi_lrange ai_ranges_64_mx = { ++ 7, { ++ BIP_RANGE(5), ++ BIP_RANGE(2.5), ++ BIP_RANGE(1.25), ++ BIP_RANGE(0.625), ++ UNI_RANGE(5), ++ UNI_RANGE(2.5), ++ UNI_RANGE(1.25) ++ } ++}; ++ ++static const uint8_t ai_range_code_64_mx[7] = { ++ 0x0, 0x1, 0x2, 0x3, /* bipolar 5, 2.5, 1.25, 0.625 */ ++ 0x9, 0xa, 0xb /* unipolar 5, 2.5, 1.25 */ ++}; ++ + /* analog input ranges for 60xx boards */ + static const struct comedi_lrange ai_ranges_60xx = { + 4, +@@ -434,6 +457,10 @@ static const struct comedi_lrange ai_ranges_60xx = { + } + }; + ++static const uint8_t ai_range_code_60xx[4] = { ++ 0x0, 0x1, 0x4, 0x7 /* bipolar 10, 5, 0.5, 0.05 */ ++}; ++ + /* analog input ranges for 6030, etc boards */ + static const struct comedi_lrange ai_ranges_6030 = { + 14, +@@ -455,6 +482,11 @@ static const struct comedi_lrange ai_ranges_6030 = { + } + }; + ++static const uint8_t ai_range_code_6030[14] = { ++ 0x0, 0x1, 0x2, 0x3, 0x4, 0x5, 0x6, /* bip 10, 5, 2, 1, 0.5, 0.2, 0.1 */ ++ 0x9, 0xa, 0xb, 0xc, 0xd, 0xe, 0xf /* uni 10, 5, 2, 1, 0.5, 0.2, 0.1 */ ++}; ++ + /* analog input ranges for 6052, etc boards */ + static const struct comedi_lrange ai_ranges_6052 = { + 15, +@@ -477,6 +509,11 @@ static const struct comedi_lrange ai_ranges_6052 = { + } + }; + ++static const uint8_t ai_range_code_6052[15] = { ++ 0x0, 0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7, /* bipolar 10 ... 0.05 */ ++ 0x9, 0xa, 0xb, 0xc, 0xd, 0xe, 0xf /* unipolar 10 ... 0.1 */ ++}; ++ + /* analog input ranges for 4020 board */ + static const struct comedi_lrange ai_ranges_4020 = { + 2, +@@ -561,6 +598,7 @@ struct pcidas64_board { + int ai_bits; /* analog input resolution */ + int ai_speed; /* fastest conversion period in ns */ + const struct comedi_lrange *ai_range_table; ++ const uint8_t *ai_range_code; + int ao_nchan; /* number of analog out channels */ + int ao_bits; /* analog output resolution */ + int ao_scan_speed; /* analog output speed (for a scan, not conversion) */ +@@ -619,6 +657,7 @@ static const struct pcidas64_board pcidas64_boards[] = { + .ao_scan_speed = 10000, + .layout = LAYOUT_64XX, + .ai_range_table = &ai_ranges_64xx, ++ .ai_range_code = ai_range_code_64xx, + .ao_range_table = &ao_ranges_64xx, + .ao_range_code = ao_range_code_64xx, + .ai_fifo = &ai_fifo_64xx, +@@ -635,6 +674,7 @@ static const struct pcidas64_board pcidas64_boards[] = { + .ao_scan_speed = 10000, + .layout = LAYOUT_64XX, + .ai_range_table = &ai_ranges_64xx, ++ .ai_range_code = ai_range_code_64xx, + .ao_range_table = &ao_ranges_64xx, + .ao_range_code = ao_range_code_64xx, + .ai_fifo = &ai_fifo_64xx, +@@ -650,7 +690,8 @@ static const struct pcidas64_board pcidas64_boards[] = { + .ao_bits = 16, + .ao_scan_speed = 10000, + .layout = LAYOUT_64XX, +- .ai_range_table = &ai_ranges_64xx, ++ .ai_range_table = &ai_ranges_64_mx, ++ .ai_range_code = ai_range_code_64_mx, + .ao_range_table = &ao_ranges_64xx, + .ao_range_code = ao_range_code_64xx, + .ai_fifo = &ai_fifo_64xx, +@@ -666,7 +707,8 @@ static const struct pcidas64_board pcidas64_boards[] = { + .ao_bits = 16, + .ao_scan_speed = 10000, + .layout = LAYOUT_64XX, +- .ai_range_table = &ai_ranges_64xx, ++ .ai_range_table = &ai_ranges_64_mx, ++ .ai_range_code = ai_range_code_64_mx, + .ao_range_table = &ao_ranges_64xx, + .ao_range_code = ao_range_code_64xx, + .ai_fifo = &ai_fifo_64xx, +@@ -682,7 +724,8 @@ static const struct pcidas64_board pcidas64_boards[] = { + .ao_bits = 16, + .ao_scan_speed = 10000, + .layout = LAYOUT_64XX, +- .ai_range_table = &ai_ranges_64xx, ++ .ai_range_table = &ai_ranges_64_mx, ++ .ai_range_code = ai_range_code_64_mx, + .ao_range_table = &ao_ranges_64xx, + .ao_range_code = ao_range_code_64xx, + .ai_fifo = &ai_fifo_64xx, +@@ -698,6 +741,7 @@ static const struct pcidas64_board pcidas64_boards[] = { + .ao_bits = 16, + .layout = LAYOUT_60XX, + .ai_range_table = &ai_ranges_60xx, ++ .ai_range_code = ai_range_code_60xx, + .ao_range_table = &ao_ranges_60xx, + .ao_range_code = ao_range_code_60xx, + .ai_fifo = &ai_fifo_60xx, +@@ -714,6 +758,7 @@ static const struct pcidas64_board pcidas64_boards[] = { + .ao_scan_speed = 100000, + .layout = LAYOUT_60XX, + .ai_range_table = &ai_ranges_60xx, ++ .ai_range_code = ai_range_code_60xx, + .ao_range_table = &ao_ranges_60xx, + .ao_range_code = ao_range_code_60xx, + .ai_fifo = &ai_fifo_60xx, +@@ -729,6 +774,7 @@ static const struct pcidas64_board pcidas64_boards[] = { + .ao_scan_speed = 100000, + .layout = LAYOUT_60XX, + .ai_range_table = &ai_ranges_60xx, ++ .ai_range_code = ai_range_code_60xx, + .ao_range_table = &ao_ranges_60xx, + .ao_range_code = ao_range_code_60xx, + .ai_fifo = &ai_fifo_60xx, +@@ -745,6 +791,7 @@ static const struct pcidas64_board pcidas64_boards[] = { + .ao_scan_speed = 100000, + .layout = LAYOUT_60XX, + .ai_range_table = &ai_ranges_60xx, ++ .ai_range_code = ai_range_code_60xx, + .ao_range_table = &ao_ranges_60xx, + .ao_range_code = ao_range_code_60xx, + .ai_fifo = &ai_fifo_60xx, +@@ -761,6 +808,7 @@ static const struct pcidas64_board pcidas64_boards[] = { + .ao_scan_speed = 10000, + .layout = LAYOUT_60XX, + .ai_range_table = &ai_ranges_6030, ++ .ai_range_code = ai_range_code_6030, + .ao_range_table = &ao_ranges_6030, + .ao_range_code = ao_range_code_6030, + .ai_fifo = &ai_fifo_60xx, +@@ -777,6 +825,7 @@ static const struct pcidas64_board pcidas64_boards[] = { + .ao_scan_speed = 10000, + .layout = LAYOUT_60XX, + .ai_range_table = &ai_ranges_6030, ++ .ai_range_code = ai_range_code_6030, + .ao_range_table = &ao_ranges_6030, + .ao_range_code = ao_range_code_6030, + .ai_fifo = &ai_fifo_60xx, +@@ -791,6 +840,7 @@ static const struct pcidas64_board pcidas64_boards[] = { + .ao_nchan = 0, + .layout = LAYOUT_60XX, + .ai_range_table = &ai_ranges_6030, ++ .ai_range_code = ai_range_code_6030, + .ai_fifo = &ai_fifo_60xx, + .has_8255 = 0, + }, +@@ -803,6 +853,7 @@ static const struct pcidas64_board pcidas64_boards[] = { + .ao_nchan = 0, + .layout = LAYOUT_60XX, + .ai_range_table = &ai_ranges_6030, ++ .ai_range_code = ai_range_code_6030, + .ai_fifo = &ai_fifo_60xx, + .has_8255 = 0, + }, +@@ -816,6 +867,7 @@ static const struct pcidas64_board pcidas64_boards[] = { + .ao_scan_speed = 0, + .layout = LAYOUT_60XX, + .ai_range_table = &ai_ranges_60xx, ++ .ai_range_code = ai_range_code_60xx, + .ai_fifo = &ai_fifo_60xx, + .has_8255 = 0, + }, +@@ -830,6 +882,7 @@ static const struct pcidas64_board pcidas64_boards[] = { + .ao_scan_speed = 100000, + .layout = LAYOUT_60XX, + .ai_range_table = &ai_ranges_60xx, ++ .ai_range_code = ai_range_code_60xx, + .ao_range_table = &ao_ranges_60xx, + .ao_range_code = ao_range_code_60xx, + .ai_fifo = &ai_fifo_60xx, +@@ -846,6 +899,7 @@ static const struct pcidas64_board pcidas64_boards[] = { + .ao_scan_speed = 100000, + .layout = LAYOUT_60XX, + .ai_range_table = &ai_ranges_60xx, ++ .ai_range_code = ai_range_code_60xx, + .ao_range_table = &ao_ranges_60xx, + .ao_range_code = ao_range_code_60xx, + .ai_fifo = &ai_fifo_60xx, +@@ -862,6 +916,7 @@ static const struct pcidas64_board pcidas64_boards[] = { + .ao_scan_speed = 1000, + .layout = LAYOUT_60XX, + .ai_range_table = &ai_ranges_6052, ++ .ai_range_code = ai_range_code_6052, + .ao_range_table = &ao_ranges_6030, + .ao_range_code = ao_range_code_6030, + .ai_fifo = &ai_fifo_60xx, +@@ -878,6 +933,7 @@ static const struct pcidas64_board pcidas64_boards[] = { + .ao_scan_speed = 3333, + .layout = LAYOUT_60XX, + .ai_range_table = &ai_ranges_6052, ++ .ai_range_code = ai_range_code_6052, + .ao_range_table = &ao_ranges_6030, + .ao_range_code = ao_range_code_6030, + .ai_fifo = &ai_fifo_60xx, +@@ -894,6 +950,7 @@ static const struct pcidas64_board pcidas64_boards[] = { + .ao_scan_speed = 1000, + .layout = LAYOUT_60XX, + .ai_range_table = &ai_ranges_6052, ++ .ai_range_code = ai_range_code_6052, + .ao_range_table = &ao_ranges_6030, + .ao_range_code = ao_range_code_6030, + .ai_fifo = &ai_fifo_60xx, +@@ -910,6 +967,7 @@ static const struct pcidas64_board pcidas64_boards[] = { + .ao_scan_speed = 1000, + .layout = LAYOUT_60XX, + .ai_range_table = &ai_ranges_6052, ++ .ai_range_code = ai_range_code_6052, + .ao_range_table = &ao_ranges_6030, + .ao_range_code = ao_range_code_6030, + .ai_fifo = &ai_fifo_60xx, +@@ -942,6 +1000,7 @@ static const struct pcidas64_board pcidas64_boards[] = { + .ao_scan_speed = 10000, + .layout = LAYOUT_64XX, + .ai_range_table = &ai_ranges_64xx, ++ .ai_range_code = ai_range_code_64xx, + .ai_fifo = ai_fifo_64xx, + .has_8255 = 1, + }, +@@ -954,7 +1013,8 @@ static const struct pcidas64_board pcidas64_boards[] = { + .ao_nchan = 0, + .ao_scan_speed = 10000, + .layout = LAYOUT_64XX, +- .ai_range_table = &ai_ranges_64xx, ++ .ai_range_table = &ai_ranges_64_mx, ++ .ai_range_code = ai_range_code_64_mx, + .ai_fifo = ai_fifo_64xx, + .has_8255 = 1, + }, +@@ -967,7 +1027,8 @@ static const struct pcidas64_board pcidas64_boards[] = { + .ao_nchan = 0, + .ao_scan_speed = 10000, + .layout = LAYOUT_64XX, +- .ai_range_table = &ai_ranges_64xx, ++ .ai_range_table = &ai_ranges_64_mx, ++ .ai_range_code = ai_range_code_64_mx, + .ai_fifo = ai_fifo_64xx, + .has_8255 = 1, + }, +@@ -980,7 +1041,8 @@ static const struct pcidas64_board pcidas64_boards[] = { + .ao_nchan = 0, + .ao_scan_speed = 10000, + .layout = LAYOUT_64XX, +- .ai_range_table = &ai_ranges_64xx, ++ .ai_range_table = &ai_ranges_64_mx, ++ .ai_range_code = ai_range_code_64_mx, + .ai_fifo = ai_fifo_64xx, + .has_8255 = 1, + }, +@@ -993,7 +1055,8 @@ static const struct pcidas64_board pcidas64_boards[] = { + .ao_nchan = 2, + .ao_scan_speed = 10000, + .layout = LAYOUT_64XX, +- .ai_range_table = &ai_ranges_64xx, ++ .ai_range_table = &ai_ranges_64_mx, ++ .ai_range_code = ai_range_code_64_mx, + .ai_fifo = ai_fifo_64xx, + .has_8255 = 1, + }, +@@ -1006,7 +1069,8 @@ static const struct pcidas64_board pcidas64_boards[] = { + .ao_nchan = 2, + .ao_scan_speed = 10000, + .layout = LAYOUT_64XX, +- .ai_range_table = &ai_ranges_64xx, ++ .ai_range_table = &ai_ranges_64_mx, ++ .ai_range_code = ai_range_code_64_mx, + .ai_fifo = ai_fifo_64xx, + .has_8255 = 1, + }, +@@ -1019,7 +1083,8 @@ static const struct pcidas64_board pcidas64_boards[] = { + .ao_nchan = 2, + .ao_scan_speed = 10000, + .layout = LAYOUT_64XX, +- .ai_range_table = &ai_ranges_64xx, ++ .ai_range_table = &ai_ranges_64_mx, ++ .ai_range_code = ai_range_code_64_mx, + .ai_fifo = ai_fifo_64xx, + .has_8255 = 1, + }, +@@ -1257,45 +1322,7 @@ module_exit(driver_cb_pcidas_cleanup_module); + static unsigned int ai_range_bits_6xxx(const struct comedi_device *dev, + unsigned int range_index) + { +- const struct comedi_krange *range = +- &board(dev)->ai_range_table->range[range_index]; +- unsigned int bits = 0; +- +- switch (range->max) { +- case 10000000: +- bits = 0x000; +- break; +- case 5000000: +- bits = 0x100; +- break; +- case 2000000: +- case 2500000: +- bits = 0x200; +- break; +- case 1000000: +- case 1250000: +- bits = 0x300; +- break; +- case 500000: +- bits = 0x400; +- break; +- case 200000: +- case 250000: +- bits = 0x500; +- break; +- case 100000: +- bits = 0x600; +- break; +- case 50000: +- bits = 0x700; +- break; +- default: +- comedi_error(dev, "bug! in ai_range_bits_6xxx"); +- break; +- } +- if (range->min == 0) +- bits += 0x900; +- return bits; ++ return board(dev)->ai_range_code[range_index] << 8; + } + + static unsigned int hw_revision(const struct comedi_device *dev, +diff --git a/drivers/staging/iio/events.h b/drivers/staging/iio/events.h +index c25f0e3c92e9..a6f999c12072 100644 +--- a/drivers/staging/iio/events.h ++++ b/drivers/staging/iio/events.h +@@ -90,7 +90,7 @@ enum iio_event_direction { + + #define IIO_EVENT_CODE_EXTRACT_TYPE(mask) ((mask >> 56) & 0xFF) + +-#define IIO_EVENT_CODE_EXTRACT_DIR(mask) ((mask >> 48) & 0xCF) ++#define IIO_EVENT_CODE_EXTRACT_DIR(mask) ((mask >> 48) & 0x7F) + + #define IIO_EVENT_CODE_EXTRACT_CHAN_TYPE(mask) ((mask >> 32) & 0xFF) + +diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c +index 4c05ed6beccc..8d57ab3a54b0 100644 +--- a/drivers/target/iscsi/iscsi_target_util.c ++++ b/drivers/target/iscsi/iscsi_target_util.c +@@ -1480,15 +1480,15 @@ static int iscsit_do_tx_data( + struct iscsi_conn *conn, + struct iscsi_data_count *count) + { +- int data = count->data_length, total_tx = 0, tx_loop = 0, iov_len; ++ int ret, iov_len; + struct kvec *iov_p; + struct msghdr msg; + + if (!conn || !conn->sock || !conn->conn_ops) + return -1; + +- if (data <= 0) { +- pr_err("Data length is: %d\n", data); ++ if (count->data_length <= 0) { ++ pr_err("Data length is: %d\n", count->data_length); + return -1; + } + +@@ -1497,20 +1497,16 @@ static int iscsit_do_tx_data( + iov_p = count->iov; + iov_len = count->iov_count; + +- while (total_tx < data) { +- tx_loop = kernel_sendmsg(conn->sock, &msg, iov_p, iov_len, +- (data - total_tx)); +- if (tx_loop <= 0) { +- pr_debug("tx_loop: %d total_tx %d\n", +- tx_loop, total_tx); +- return tx_loop; +- } +- total_tx += tx_loop; +- pr_debug("tx_loop: %d, total_tx: %d, data: %d\n", +- tx_loop, total_tx, data); ++ ret = kernel_sendmsg(conn->sock, &msg, iov_p, iov_len, ++ count->data_length); ++ if (ret != count->data_length) { ++ pr_err("Unexpected ret: %d send data %d\n", ++ ret, count->data_length); ++ return -EPIPE; + } ++ pr_debug("ret: %d, sent data: %d\n", ret, count->data_length); + +- return total_tx; ++ return ret; + } + + int rx_data( +diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c +index d8b0aee35632..1b7d2c0abd7e 100644 +--- a/drivers/tty/serial/samsung.c ++++ b/drivers/tty/serial/samsung.c +@@ -524,11 +524,15 @@ static void s3c24xx_serial_pm(struct uart_port *port, unsigned int level, + unsigned int old) + { + struct s3c24xx_uart_port *ourport = to_ourport(port); ++ int timeout = 10000; + + ourport->pm_level = level; + + switch (level) { + case 3: ++ while (--timeout && !s3c24xx_serial_txempty_nofifo(port)) ++ udelay(100); ++ + if (!IS_ERR(ourport->baudclk) && ourport->baudclk != NULL) + clk_disable(ourport->baudclk); + +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index 8f4a628d3382..05325773ab94 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -1108,10 +1108,11 @@ next_desc: + } else { + control_interface = usb_ifnum_to_if(usb_dev, union_header->bMasterInterface0); + data_interface = usb_ifnum_to_if(usb_dev, (data_interface_num = union_header->bSlaveInterface0)); +- if (!control_interface || !data_interface) { +- dev_dbg(&intf->dev, "no interfaces\n"); +- return -ENODEV; +- } ++ } ++ ++ if (!control_interface || !data_interface) { ++ dev_dbg(&intf->dev, "no interfaces\n"); ++ return -ENODEV; + } + + if (data_interface_num != call_interface_num) +@@ -1429,6 +1430,7 @@ static void acm_disconnect(struct usb_interface *intf) + &dev_attr_wCountryCodes); + device_remove_file(&acm->control->dev, + &dev_attr_iCountryCodeRelDate); ++ kfree(acm->country_codes); + } + device_remove_file(&acm->control->dev, &dev_attr_bmCapabilities); + usb_set_intfdata(acm->control, NULL); +diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c +index 6ed7e7c787d8..cc1004a2f9cd 100644 +--- a/drivers/usb/core/config.c ++++ b/drivers/usb/core/config.c +@@ -201,6 +201,17 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum, + if (n == 0) + n = 9; /* 32 ms = 2^(9-1) uframes */ + j = 16; ++ ++ /* ++ * Adjust bInterval for quirked devices. ++ * This quirk fixes bIntervals reported in ++ * linear microframes. ++ */ ++ if (to_usb_device(ddev)->quirks & ++ USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL) { ++ n = clamp(fls(d->bInterval), i, j); ++ i = j = n; ++ } + break; + default: /* USB_SPEED_FULL or _LOW */ + /* For low-speed, 10 ms is the official minimum. +diff --git a/drivers/usb/core/inode.c b/drivers/usb/core/inode.c +index d2b9af59cba9..b283a652f155 100644 +--- a/drivers/usb/core/inode.c ++++ b/drivers/usb/core/inode.c +@@ -211,7 +211,7 @@ static void update_bus(struct dentry *bus) + + mutex_lock(&bus->d_inode->i_mutex); + +- list_for_each_entry(dev, &bus->d_subdirs, d_u.d_child) ++ list_for_each_entry(dev, &bus->d_subdirs, d_child) + if (dev->d_inode) + update_dev(dev); + +@@ -228,7 +228,7 @@ static void update_sb(struct super_block *sb) + + mutex_lock_nested(&root->d_inode->i_mutex, I_MUTEX_PARENT); + +- list_for_each_entry(bus, &root->d_subdirs, d_u.d_child) { ++ list_for_each_entry(bus, &root->d_subdirs, d_child) { + if (bus->d_inode) { + switch (S_IFMT & bus->d_inode->i_mode) { + case S_IFDIR: +@@ -342,7 +342,7 @@ static int usbfs_empty (struct dentry *dentry) + + spin_lock(&dentry->d_lock); + list_for_each(list, &dentry->d_subdirs) { +- struct dentry *de = list_entry(list, struct dentry, d_u.d_child); ++ struct dentry *de = list_entry(list, struct dentry, d_child); + + spin_lock_nested(&de->d_lock, DENTRY_D_LOCK_NESTED); + if (usbfs_positive(de)) { +diff --git a/drivers/usb/core/otg_whitelist.h b/drivers/usb/core/otg_whitelist.h +index e8cdce571bb1..2753cec61aaf 100644 +--- a/drivers/usb/core/otg_whitelist.h ++++ b/drivers/usb/core/otg_whitelist.h +@@ -59,6 +59,11 @@ static int is_targeted(struct usb_device *dev) + le16_to_cpu(dev->descriptor.idProduct) == 0xbadd)) + return 0; + ++ /* OTG PET device is always targeted (see OTG 2.0 ECN 6.4.2) */ ++ if ((le16_to_cpu(dev->descriptor.idVendor) == 0x1a0a && ++ le16_to_cpu(dev->descriptor.idProduct) == 0x0200)) ++ return 1; ++ + /* NOTE: can't use usb_match_id() since interface caches + * aren't set up yet. this is cut/paste from that code. + */ +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index 980a9d8c6504..9fac46d41f4d 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -43,6 +43,9 @@ static const struct usb_device_id usb_quirk_list[] = { + /* Creative SB Audigy 2 NX */ + { USB_DEVICE(0x041e, 0x3020), .driver_info = USB_QUIRK_RESET_RESUME }, + ++ /* Microsoft Wireless Laser Mouse 6000 Receiver */ ++ { USB_DEVICE(0x045e, 0x00e1), .driver_info = USB_QUIRK_RESET_RESUME }, ++ + /* Microsoft LifeCam-VX700 v2.0 */ + { USB_DEVICE(0x045e, 0x0770), .driver_info = USB_QUIRK_RESET_RESUME }, + +@@ -149,6 +152,10 @@ static const struct usb_device_id usb_quirk_list[] = { + /* SKYMEDI USB_DRIVE */ + { USB_DEVICE(0x1516, 0x8628), .driver_info = USB_QUIRK_RESET_RESUME }, + ++ /* Razer - Razer Blade Keyboard */ ++ { USB_DEVICE(0x1532, 0x0116), .driver_info = ++ USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL }, ++ + /* BUILDWIN Photo Frame */ + { USB_DEVICE(0x1908, 0x1315), .driver_info = + USB_QUIRK_HONOR_BNUMINTERFACES }, +@@ -168,6 +175,10 @@ static const struct usb_device_id usb_interface_quirk_list[] = { + { USB_DEVICE(0x0b05, 0x17e0), .driver_info = + USB_QUIRK_IGNORE_REMOTE_WAKEUP }, + ++ /* Protocol and OTG Electrical Test Device */ ++ { USB_DEVICE(0x1a0a, 0x0200), .driver_info = ++ USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL }, ++ + { } /* terminating entry must be last */ + }; + +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index 1acb3a419539..b7f89268c0f4 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -851,6 +851,9 @@ static void dwc3_prepare_trbs(struct dwc3_ep *dep, bool starting) + if (last_one) + break; + } ++ ++ if (last_one) ++ break; + } else { + dma = req->request.dma; + length = req->request.length; +diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c +index 90dcf54cd7e8..1f230edfedf9 100644 +--- a/drivers/usb/host/pci-quirks.c ++++ b/drivers/usb/host/pci-quirks.c +@@ -470,7 +470,8 @@ static void __devinit quirk_usb_handoff_ohci(struct pci_dev *pdev) + { + void __iomem *base; + u32 control; +- u32 fminterval; ++ u32 fminterval = 0; ++ bool no_fminterval = false; + int cnt; + + if (!mmio_resource_enabled(pdev, 0)) +@@ -480,6 +481,13 @@ static void __devinit quirk_usb_handoff_ohci(struct pci_dev *pdev) + if (base == NULL) + return; + ++ /* ++ * ULi M5237 OHCI controller locks the whole system when accessing ++ * the OHCI_FMINTERVAL offset. ++ */ ++ if (pdev->vendor == PCI_VENDOR_ID_AL && pdev->device == 0x5237) ++ no_fminterval = true; ++ + control = readl(base + OHCI_CONTROL); + + /* On PA-RISC, PDC can leave IR set incorrectly; ignore it there. */ +@@ -518,7 +526,9 @@ static void __devinit quirk_usb_handoff_ohci(struct pci_dev *pdev) + } + + /* software reset of the controller, preserving HcFmInterval */ +- fminterval = readl(base + OHCI_FMINTERVAL); ++ if (!no_fminterval) ++ fminterval = readl(base + OHCI_FMINTERVAL); ++ + writel(OHCI_HCR, base + OHCI_CMDSTATUS); + + /* reset requires max 10 us delay */ +@@ -527,7 +537,9 @@ static void __devinit quirk_usb_handoff_ohci(struct pci_dev *pdev) + break; + udelay(1); + } +- writel(fminterval, base + OHCI_FMINTERVAL); ++ ++ if (!no_fminterval) ++ writel(fminterval, base + OHCI_FMINTERVAL); + + /* Now the controller is safely in SUSPEND and nothing can wake it up */ + iounmap(base); +diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c +index c8835d591b37..c9e39d453f6b 100644 +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -238,7 +238,7 @@ static int xhci_pci_suspend(struct usb_hcd *hcd, bool do_wakeup) + xhci->shared_hcd->state != HC_STATE_SUSPENDED) + return -EINVAL; + +- retval = xhci_suspend(xhci); ++ retval = xhci_suspend(xhci, do_wakeup); + + return retval; + } +diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c +index 95e8648ade45..950edebba8f1 100644 +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -1178,9 +1178,8 @@ static void handle_reset_ep_completion(struct xhci_hcd *xhci, + false); + xhci_ring_cmd_db(xhci); + } else { +- /* Clear our internal halted state and restart the ring(s) */ ++ /* Clear our internal halted state */ + xhci->devs[slot_id]->eps[ep_index].ep_state &= ~EP_HALTED; +- ring_doorbell_for_active_rings(xhci, slot_id, ep_index); + } + } + +@@ -1916,23 +1915,12 @@ static int finish_td(struct xhci_hcd *xhci, struct xhci_td *td, + ep->stopped_trb = event_trb; + return 0; + } else { +- if (trb_comp_code == COMP_STALL) { +- /* The transfer is completed from the driver's +- * perspective, but we need to issue a set dequeue +- * command for this stalled endpoint to move the dequeue +- * pointer past the TD. We can't do that here because +- * the halt condition must be cleared first. Let the +- * USB class driver clear the stall later. +- */ +- ep->stopped_td = td; +- ep->stopped_trb = event_trb; +- ep->stopped_stream = ep_ring->stream_id; +- } else if (xhci_requires_manual_halt_cleanup(xhci, +- ep_ctx, trb_comp_code)) { +- /* Other types of errors halt the endpoint, but the +- * class driver doesn't call usb_reset_endpoint() unless +- * the error is -EPIPE. Clear the halted status in the +- * xHCI hardware manually. ++ if (trb_comp_code == COMP_STALL || ++ xhci_requires_manual_halt_cleanup(xhci, ep_ctx, ++ trb_comp_code)) { ++ /* Issue a reset endpoint command to clear the host side * halt, followed by a set dequeue command to move the ++ * dequeue pointer past the TD. ++ * The class driver clears the device side halt later. + */ + xhci_cleanup_halted_endpoint(xhci, + slot_id, ep_index, ep_ring->stream_id, +@@ -2052,9 +2040,7 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td, + else + td->urb->actual_length = 0; + +- xhci_cleanup_halted_endpoint(xhci, +- slot_id, ep_index, 0, td, event_trb); +- return finish_td(xhci, td, event_trb, event, ep, status, true); ++ return finish_td(xhci, td, event_trb, event, ep, status, false); + } + /* + * Did we transfer any data, despite the errors that might have +@@ -2606,17 +2592,8 @@ cleanup: + if (ret) { + urb = td->urb; + urb_priv = urb->hcpriv; +- /* Leave the TD around for the reset endpoint function +- * to use(but only if it's not a control endpoint, +- * since we already queued the Set TR dequeue pointer +- * command for stalled control endpoints). +- */ +- if (usb_endpoint_xfer_control(&urb->ep->desc) || +- (trb_comp_code != COMP_STALL && +- trb_comp_code != COMP_BABBLE)) +- xhci_urb_free_priv(xhci, urb_priv); +- else +- kfree(urb_priv); ++ ++ xhci_urb_free_priv(xhci, urb_priv); + + usb_hcd_unlink_urb_from_ep(bus_to_hcd(urb->dev->bus), urb); + if ((urb->actual_length != urb->transfer_buffer_length && +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 424d9cf9d9a0..d96652d3fb54 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -33,6 +33,8 @@ + #define DRIVER_AUTHOR "Sarah Sharp" + #define DRIVER_DESC "'eXtensible' Host Controller (xHC) Driver" + ++#define PORT_WAKE_BITS (PORT_WKOC_E | PORT_WKDISC_E | PORT_WKCONN_E) ++ + /* Some 0.95 hardware can't handle the chain bit on a Link TRB being cleared */ + static int link_quirk; + module_param(link_quirk, int, S_IRUGO | S_IWUSR); +@@ -884,19 +886,57 @@ static void xhci_clear_command_ring(struct xhci_hcd *xhci) + xhci_set_cmd_ring_deq(xhci); + } + ++static void xhci_disable_port_wake_on_bits(struct xhci_hcd *xhci) ++{ ++ int port_index; ++ __le32 __iomem **port_array; ++ unsigned long flags; ++ u32 t1, t2; ++ ++ spin_lock_irqsave(&xhci->lock, flags); ++ ++ /* disble usb3 ports Wake bits*/ ++ port_index = xhci->num_usb3_ports; ++ port_array = xhci->usb3_ports; ++ while (port_index--) { ++ t1 = readl(port_array[port_index]); ++ t1 = xhci_port_state_to_neutral(t1); ++ t2 = t1 & ~PORT_WAKE_BITS; ++ if (t1 != t2) ++ writel(t2, port_array[port_index]); ++ } ++ ++ /* disble usb2 ports Wake bits*/ ++ port_index = xhci->num_usb2_ports; ++ port_array = xhci->usb2_ports; ++ while (port_index--) { ++ t1 = readl(port_array[port_index]); ++ t1 = xhci_port_state_to_neutral(t1); ++ t2 = t1 & ~PORT_WAKE_BITS; ++ if (t1 != t2) ++ writel(t2, port_array[port_index]); ++ } ++ ++ spin_unlock_irqrestore(&xhci->lock, flags); ++} ++ + /* + * Stop HC (not bus-specific) + * + * This is called when the machine transition into S3/S4 mode. + * + */ +-int xhci_suspend(struct xhci_hcd *xhci) ++int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup) + { + int rc = 0; + unsigned int delay = XHCI_MAX_HALT_USEC; + struct usb_hcd *hcd = xhci_to_hcd(xhci); + u32 command; + ++ /* Clear root port wake on bits if wakeup not allowed. */ ++ if (!do_wakeup) ++ xhci_disable_port_wake_on_bits(xhci); ++ + /* Don't poll the roothubs on bus suspend. */ + xhci_dbg(xhci, "%s: stopping port polling.\n", __func__); + clear_bit(HCD_FLAG_POLL_RH, &hcd->flags); +@@ -2851,61 +2891,31 @@ void xhci_cleanup_stalled_ring(struct xhci_hcd *xhci, + } + } + +-/* Deal with stalled endpoints. The core should have sent the control message +- * to clear the halt condition. However, we need to make the xHCI hardware +- * reset its sequence number, since a device will expect a sequence number of +- * zero after the halt condition is cleared. ++/* Called when clearing halted device. The core should have sent the control ++ * message to clear the device halt condition. The host side of the halt should ++ * already be cleared with a reset endpoint command issued when the STALL tx ++ * event was received. ++ * + * Context: in_interrupt + */ ++ + void xhci_endpoint_reset(struct usb_hcd *hcd, + struct usb_host_endpoint *ep) + { + struct xhci_hcd *xhci; +- struct usb_device *udev; +- unsigned int ep_index; +- unsigned long flags; +- int ret; +- struct xhci_virt_ep *virt_ep; + + xhci = hcd_to_xhci(hcd); +- udev = (struct usb_device *) ep->hcpriv; +- /* Called with a root hub endpoint (or an endpoint that wasn't added +- * with xhci_add_endpoint() +- */ +- if (!ep->hcpriv) +- return; +- ep_index = xhci_get_endpoint_index(&ep->desc); +- virt_ep = &xhci->devs[udev->slot_id]->eps[ep_index]; +- if (!virt_ep->stopped_td) { +- xhci_dbg(xhci, "Endpoint 0x%x not halted, refusing to reset.\n", +- ep->desc.bEndpointAddress); +- return; +- } +- if (usb_endpoint_xfer_control(&ep->desc)) { +- xhci_dbg(xhci, "Control endpoint stall already handled.\n"); +- return; +- } +- +- xhci_dbg(xhci, "Queueing reset endpoint command\n"); +- spin_lock_irqsave(&xhci->lock, flags); +- ret = xhci_queue_reset_ep(xhci, udev->slot_id, ep_index); + /* +- * Can't change the ring dequeue pointer until it's transitioned to the +- * stopped state, which is only upon a successful reset endpoint +- * command. Better hope that last command worked! ++ * We might need to implement the config ep cmd in xhci 4.8.1 note: ++ * The Reset Endpoint Command may only be issued to endpoints in the ++ * Halted state. If software wishes reset the Data Toggle or Sequence ++ * Number of an endpoint that isn't in the Halted state, then software ++ * may issue a Configure Endpoint Command with the Drop and Add bits set ++ * for the target endpoint. that is in the Stopped state. + */ +- if (!ret) { +- xhci_cleanup_stalled_ring(xhci, udev, ep_index); +- kfree(virt_ep->stopped_td); +- xhci_ring_cmd_db(xhci); +- } +- virt_ep->stopped_td = NULL; +- virt_ep->stopped_trb = NULL; +- virt_ep->stopped_stream = 0; +- spin_unlock_irqrestore(&xhci->lock, flags); +- +- if (ret) +- xhci_warn(xhci, "FIXME allocate a new ring segment\n"); ++ /* For now just print debug to follow the situation */ ++ xhci_dbg(xhci, "Endpoint 0x%x ep reset callback called\n", ++ ep->desc.bEndpointAddress); + } + + static int xhci_check_streams_endpoint(struct xhci_hcd *xhci, +diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h +index 2b7fe0b1c249..6c8093509511 100644 +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -1729,7 +1729,7 @@ void xhci_shutdown(struct usb_hcd *hcd); + int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks); + + #ifdef CONFIG_PM +-int xhci_suspend(struct xhci_hcd *xhci); ++int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup); + int xhci_resume(struct xhci_hcd *xhci, bool hibernated); + #else + #define xhci_suspend NULL +diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c +index 00bd2a5e0362..056dc6e4a9f9 100644 +--- a/drivers/usb/renesas_usbhs/mod_gadget.c ++++ b/drivers/usb/renesas_usbhs/mod_gadget.c +@@ -672,6 +672,9 @@ static int __usbhsg_ep_set_halt_wedge(struct usb_ep *ep, int halt, int wedge) + struct device *dev = usbhsg_gpriv_to_dev(gpriv); + unsigned long flags; + ++ if (!pipe) ++ return -EINVAL; ++ + usbhsg_pipe_disable(uep); + + dev_dbg(dev, "set halt %d (pipe %d)\n", +diff --git a/drivers/usb/serial/console.c b/drivers/usb/serial/console.c +index 1ee6b2ab0f89..87302ddec0a4 100644 +--- a/drivers/usb/serial/console.c ++++ b/drivers/usb/serial/console.c +@@ -47,6 +47,8 @@ static struct console usbcons; + * ------------------------------------------------------------ + */ + ++static const struct tty_operations usb_console_fake_tty_ops = { ++}; + + /* + * The parsing of the command line works exactly like the +@@ -141,14 +143,17 @@ static int usb_console_setup(struct console *co, char *options) + goto reset_open_count; + } + kref_init(&tty->kref); +- tty_port_tty_set(&port->port, tty); + tty->driver = usb_serial_tty_driver; + tty->index = co->index; ++ INIT_LIST_HEAD(&tty->tty_files); ++ kref_get(&tty->driver->kref); ++ tty->ops = &usb_console_fake_tty_ops; + if (tty_init_termios(tty)) { + retval = -ENOMEM; + err("no more memory"); +- goto free_tty; ++ goto put_tty; + } ++ tty_port_tty_set(&port->port, tty); + } + + /* only call the device specific open if this +@@ -170,7 +175,7 @@ static int usb_console_setup(struct console *co, char *options) + serial->type->set_termios(tty, port, &dummy); + + tty_port_tty_set(&port->port, NULL); +- kfree(tty); ++ tty_kref_put(tty); + } + set_bit(ASYNCB_INITIALIZED, &port->port.flags); + } +@@ -186,8 +191,8 @@ static int usb_console_setup(struct console *co, char *options) + + fail: + tty_port_tty_set(&port->port, NULL); +- free_tty: +- kfree(tty); ++ put_tty: ++ tty_kref_put(tty); + reset_open_count: + port->port.count = 0; + usb_autopm_put_interface(serial->interface); +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index 19074db60896..813793714bea 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -126,9 +126,12 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */ + { USB_DEVICE(0x10C4, 0x8664) }, /* AC-Services CAN-IF */ + { USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */ ++ { USB_DEVICE(0x10C4, 0x8856) }, /* CEL EM357 ZigBee USB Stick - LR */ ++ { USB_DEVICE(0x10C4, 0x8857) }, /* CEL EM357 ZigBee USB Stick */ + { USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */ + { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */ + { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */ ++ { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */ + { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */ + { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */ + { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */ +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index a89433bd5314..4bfcfa785823 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -494,6 +494,39 @@ static struct usb_device_id id_table_combined [] = { + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_01FD_PID) }, + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_01FE_PID) }, + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_01FF_PID) }, ++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_4701_PID) }, ++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9300_PID) }, ++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9301_PID) }, ++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9302_PID) }, ++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9303_PID) }, ++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9304_PID) }, ++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9305_PID) }, ++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9306_PID) }, ++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9307_PID) }, ++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9308_PID) }, ++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9309_PID) }, ++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_930A_PID) }, ++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_930B_PID) }, ++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_930C_PID) }, ++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_930D_PID) }, ++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_930E_PID) }, ++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_930F_PID) }, ++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9310_PID) }, ++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9311_PID) }, ++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9312_PID) }, ++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9313_PID) }, ++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9314_PID) }, ++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9315_PID) }, ++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9316_PID) }, ++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9317_PID) }, ++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9318_PID) }, ++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9319_PID) }, ++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_931A_PID) }, ++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_931B_PID) }, ++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_931C_PID) }, ++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_931D_PID) }, ++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_931E_PID) }, ++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_931F_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_PERLE_ULTRAPORT_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_PIEGROUP_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_TNC_X_PID) }, +diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h +index 64ee791687d9..ecb4dee48caf 100644 +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -920,8 +920,8 @@ + #define BAYER_CONTOUR_CABLE_PID 0x6001 + + /* +- * The following are the values for the Matrix Orbital FTDI Range +- * Anything in this range will use an FT232RL. ++ * Matrix Orbital Intelligent USB displays. ++ * http://www.matrixorbital.com + */ + #define MTXORB_VID 0x1B3D + #define MTXORB_FTDI_RANGE_0100_PID 0x0100 +@@ -1180,8 +1180,39 @@ + #define MTXORB_FTDI_RANGE_01FD_PID 0x01FD + #define MTXORB_FTDI_RANGE_01FE_PID 0x01FE + #define MTXORB_FTDI_RANGE_01FF_PID 0x01FF +- +- ++#define MTXORB_FTDI_RANGE_4701_PID 0x4701 ++#define MTXORB_FTDI_RANGE_9300_PID 0x9300 ++#define MTXORB_FTDI_RANGE_9301_PID 0x9301 ++#define MTXORB_FTDI_RANGE_9302_PID 0x9302 ++#define MTXORB_FTDI_RANGE_9303_PID 0x9303 ++#define MTXORB_FTDI_RANGE_9304_PID 0x9304 ++#define MTXORB_FTDI_RANGE_9305_PID 0x9305 ++#define MTXORB_FTDI_RANGE_9306_PID 0x9306 ++#define MTXORB_FTDI_RANGE_9307_PID 0x9307 ++#define MTXORB_FTDI_RANGE_9308_PID 0x9308 ++#define MTXORB_FTDI_RANGE_9309_PID 0x9309 ++#define MTXORB_FTDI_RANGE_930A_PID 0x930A ++#define MTXORB_FTDI_RANGE_930B_PID 0x930B ++#define MTXORB_FTDI_RANGE_930C_PID 0x930C ++#define MTXORB_FTDI_RANGE_930D_PID 0x930D ++#define MTXORB_FTDI_RANGE_930E_PID 0x930E ++#define MTXORB_FTDI_RANGE_930F_PID 0x930F ++#define MTXORB_FTDI_RANGE_9310_PID 0x9310 ++#define MTXORB_FTDI_RANGE_9311_PID 0x9311 ++#define MTXORB_FTDI_RANGE_9312_PID 0x9312 ++#define MTXORB_FTDI_RANGE_9313_PID 0x9313 ++#define MTXORB_FTDI_RANGE_9314_PID 0x9314 ++#define MTXORB_FTDI_RANGE_9315_PID 0x9315 ++#define MTXORB_FTDI_RANGE_9316_PID 0x9316 ++#define MTXORB_FTDI_RANGE_9317_PID 0x9317 ++#define MTXORB_FTDI_RANGE_9318_PID 0x9318 ++#define MTXORB_FTDI_RANGE_9319_PID 0x9319 ++#define MTXORB_FTDI_RANGE_931A_PID 0x931A ++#define MTXORB_FTDI_RANGE_931B_PID 0x931B ++#define MTXORB_FTDI_RANGE_931C_PID 0x931C ++#define MTXORB_FTDI_RANGE_931D_PID 0x931D ++#define MTXORB_FTDI_RANGE_931E_PID 0x931E ++#define MTXORB_FTDI_RANGE_931F_PID 0x931F + + /* + * The Mobility Lab (TML) +diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c +index 66d806ee9f3e..0879ac7fd2cb 100644 +--- a/drivers/usb/serial/keyspan.c ++++ b/drivers/usb/serial/keyspan.c +@@ -323,24 +323,28 @@ static void usa26_indat_callback(struct urb *urb) + if ((data[0] & 0x80) == 0) { + /* no errors on individual bytes, only + possible overrun err */ +- if (data[0] & RXERROR_OVERRUN) +- err = TTY_OVERRUN; +- else +- err = 0; ++ if (data[0] & RXERROR_OVERRUN) { ++ tty_insert_flip_char(tty, 0, TTY_OVERRUN); ++ } + for (i = 1; i < urb->actual_length ; ++i) +- tty_insert_flip_char(tty, data[i], err); ++ tty_insert_flip_char(tty, data[i], TTY_NORMAL); + } else { + /* some bytes had errors, every byte has status */ + dbg("%s - RX error!!!!", __func__); + for (i = 0; i + 1 < urb->actual_length; i += 2) { +- int stat = data[i], flag = 0; +- if (stat & RXERROR_OVERRUN) +- flag |= TTY_OVERRUN; +- if (stat & RXERROR_FRAMING) +- flag |= TTY_FRAME; +- if (stat & RXERROR_PARITY) +- flag |= TTY_PARITY; ++ int stat = data[i]; ++ int flag = TTY_NORMAL; ++ ++ if (stat & RXERROR_OVERRUN) { ++ tty_insert_flip_char(tty, 0, ++ TTY_OVERRUN); ++ } + /* XXX should handle break (0x10) */ ++ if (stat & RXERROR_PARITY) ++ flag = TTY_PARITY; ++ else if (stat & RXERROR_FRAMING) ++ flag = TTY_FRAME; ++ + tty_insert_flip_char(tty, data[i+1], flag); + } + } +@@ -712,14 +716,19 @@ static void usa49_indat_callback(struct urb *urb) + } else { + /* some bytes had errors, every byte has status */ + for (i = 0; i + 1 < urb->actual_length; i += 2) { +- int stat = data[i], flag = 0; +- if (stat & RXERROR_OVERRUN) +- flag |= TTY_OVERRUN; +- if (stat & RXERROR_FRAMING) +- flag |= TTY_FRAME; +- if (stat & RXERROR_PARITY) +- flag |= TTY_PARITY; ++ int stat = data[i]; ++ int flag = TTY_NORMAL; ++ ++ if (stat & RXERROR_OVERRUN) { ++ tty_insert_flip_char(tty, 0, ++ TTY_OVERRUN); ++ } + /* XXX should handle break (0x10) */ ++ if (stat & RXERROR_PARITY) ++ flag = TTY_PARITY; ++ else if (stat & RXERROR_FRAMING) ++ flag = TTY_FRAME; ++ + tty_insert_flip_char(tty, data[i+1], flag); + } + } +@@ -779,14 +788,19 @@ static void usa49wg_indat_callback(struct urb *urb) + * some bytes had errors, every byte has status + */ + for (x = 0; x + 1 < len; x += 2) { +- int stat = data[i], flag = 0; +- if (stat & RXERROR_OVERRUN) +- flag |= TTY_OVERRUN; +- if (stat & RXERROR_FRAMING) +- flag |= TTY_FRAME; +- if (stat & RXERROR_PARITY) +- flag |= TTY_PARITY; ++ int stat = data[i]; ++ int flag = TTY_NORMAL; ++ ++ if (stat & RXERROR_OVERRUN) { ++ tty_insert_flip_char(tty, 0, ++ TTY_OVERRUN); ++ } + /* XXX should handle break (0x10) */ ++ if (stat & RXERROR_PARITY) ++ flag = TTY_PARITY; ++ else if (stat & RXERROR_FRAMING) ++ flag = TTY_FRAME; ++ + tty_insert_flip_char(tty, + data[i+1], flag); + i += 2; +@@ -844,25 +858,32 @@ static void usa90_indat_callback(struct urb *urb) + if ((data[0] & 0x80) == 0) { + /* no errors on individual bytes, only + possible overrun err*/ +- if (data[0] & RXERROR_OVERRUN) +- err = TTY_OVERRUN; +- else +- err = 0; ++ if (data[0] & RXERROR_OVERRUN) { ++ tty_insert_flip_char(tty, 0, ++ TTY_OVERRUN); ++ } + for (i = 1; i < urb->actual_length ; ++i) + tty_insert_flip_char(tty, data[i], +- err); ++ TTY_NORMAL); + } else { + /* some bytes had errors, every byte has status */ + dbg("%s - RX error!!!!", __func__); + for (i = 0; i + 1 < urb->actual_length; i += 2) { +- int stat = data[i], flag = 0; +- if (stat & RXERROR_OVERRUN) +- flag |= TTY_OVERRUN; +- if (stat & RXERROR_FRAMING) +- flag |= TTY_FRAME; +- if (stat & RXERROR_PARITY) +- flag |= TTY_PARITY; ++ int stat = data[i]; ++ int flag = TTY_NORMAL; ++ ++ if (stat & RXERROR_OVERRUN) { ++ tty_insert_flip_char( ++ tty, 0, ++ TTY_OVERRUN); ++ } ++ + /* XXX should handle break (0x10) */ ++ if (stat & RXERROR_PARITY) ++ flag = TTY_PARITY; ++ else if (stat & RXERROR_FRAMING) ++ flag = TTY_FRAME; ++ + tty_insert_flip_char(tty, data[i+1], + flag); + } +diff --git a/drivers/usb/serial/ssu100.c b/drivers/usb/serial/ssu100.c +index d19fa6a9d247..f425507d999a 100644 +--- a/drivers/usb/serial/ssu100.c ++++ b/drivers/usb/serial/ssu100.c +@@ -598,10 +598,10 @@ static void ssu100_update_lsr(struct usb_serial_port *port, u8 lsr, + if (*tty_flag == TTY_NORMAL) + *tty_flag = TTY_FRAME; + } +- if (lsr & UART_LSR_OE){ ++ if (lsr & UART_LSR_OE) { + priv->icount.overrun++; +- if (*tty_flag == TTY_NORMAL) +- *tty_flag = TTY_OVERRUN; ++ tty_insert_flip_char(tty_port_tty_get(&port->port), ++ 0, TTY_OVERRUN); + } + } + +@@ -622,11 +622,8 @@ static int ssu100_process_packet(struct urb *urb, + if ((len >= 4) && + (packet[0] == 0x1b) && (packet[1] == 0x1b) && + ((packet[2] == 0x00) || (packet[2] == 0x01))) { +- if (packet[2] == 0x00) { ++ if (packet[2] == 0x00) + ssu100_update_lsr(port, packet[3], &flag); +- if (flag == TTY_OVERRUN) +- tty_insert_flip_char(tty, 0, TTY_OVERRUN); +- } + if (packet[2] == 0x01) + ssu100_update_msr(port, packet[3]); + +diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c +index 3a7fd6f6af4f..248a198dc974 100644 +--- a/drivers/usb/storage/scsiglue.c ++++ b/drivers/usb/storage/scsiglue.c +@@ -242,6 +242,10 @@ static int slave_configure(struct scsi_device *sdev) + US_FL_SCM_MULT_TARG)) && + us->protocol == USB_PR_BULK) + us->use_last_sector_hacks = 1; ++ ++ /* A few buggy USB-ATA bridges don't understand FUA */ ++ if (us->fflags & US_FL_BROKEN_FUA) ++ sdev->broken_fua = 1; + } else { + + /* Non-disk-type devices don't need to blacklist any pages +diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h +index a280945d2236..25174beb8d8d 100644 +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -1940,6 +1940,13 @@ UNUSUAL_DEV( 0x14cd, 0x6600, 0x0201, 0x0201, + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_IGNORE_RESIDUE ), + ++/* Reported by Michael Büsch */ ++UNUSUAL_DEV( 0x152d, 0x0567, 0x0114, 0x0114, ++ "JMicron", ++ "USB to ATA/ATAPI Bridge", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_BROKEN_FUA ), ++ + /* Reported by Alexandre Oliva + * JMicron responds to USN and several other SCSI ioctls with a + * residue that causes subsequent I/O requests to fail. */ +@@ -1949,6 +1956,13 @@ UNUSUAL_DEV( 0x152d, 0x2329, 0x0100, 0x0100, + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_IGNORE_RESIDUE | US_FL_SANE_SENSE ), + ++/* Reported by Dmitry Nezhevenko */ ++UNUSUAL_DEV( 0x152d, 0x2566, 0x0114, 0x0114, ++ "JMicron", ++ "USB to ATA/ATAPI Bridge", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_BROKEN_FUA ), ++ + /* Entrega Technologies U1-SC25 (later Xircom PortGear PGSCSI) + * and Mac USB Dock USB-SCSI */ + UNUSUAL_DEV( 0x1645, 0x0007, 0x0100, 0x0133, +diff --git a/drivers/video/logo/logo.c b/drivers/video/logo/logo.c +index 080c35b34bbb..cc5dbb5b2f71 100644 +--- a/drivers/video/logo/logo.c ++++ b/drivers/video/logo/logo.c +@@ -25,6 +25,21 @@ static bool nologo; + module_param(nologo, bool, 0); + MODULE_PARM_DESC(nologo, "Disables startup logo"); + ++/* ++ * Logos are located in the initdata, and will be freed in kernel_init. ++ * Use late_init to mark the logos as freed to prevent any further use. ++ */ ++ ++static bool logos_freed; ++ ++static int __init fb_logo_late_init(void) ++{ ++ logos_freed = true; ++ return 0; ++} ++ ++late_initcall(fb_logo_late_init); ++ + /* logo's are marked __initdata. Use __init_refok to tell + * modpost that it is intended that this function uses data + * marked __initdata. +@@ -33,7 +48,7 @@ const struct linux_logo * __init_refok fb_find_logo(int depth) + { + const struct linux_logo *logo = NULL; + +- if (nologo) ++ if (nologo || logos_freed) + return NULL; + + if (depth >= 1) { +diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c +index 984c501c258f..cc02a9b36219 100644 +--- a/drivers/virtio/virtio.c ++++ b/drivers/virtio/virtio.c +@@ -9,33 +9,32 @@ static unsigned int dev_index; + static ssize_t device_show(struct device *_d, + struct device_attribute *attr, char *buf) + { +- struct virtio_device *dev = container_of(_d,struct virtio_device,dev); ++ struct virtio_device *dev = dev_to_virtio(_d); + return sprintf(buf, "0x%04x\n", dev->id.device); + } + static ssize_t vendor_show(struct device *_d, + struct device_attribute *attr, char *buf) + { +- struct virtio_device *dev = container_of(_d,struct virtio_device,dev); ++ struct virtio_device *dev = dev_to_virtio(_d); + return sprintf(buf, "0x%04x\n", dev->id.vendor); + } + static ssize_t status_show(struct device *_d, + struct device_attribute *attr, char *buf) + { +- struct virtio_device *dev = container_of(_d,struct virtio_device,dev); ++ struct virtio_device *dev = dev_to_virtio(_d); + return sprintf(buf, "0x%08x\n", dev->config->get_status(dev)); + } + static ssize_t modalias_show(struct device *_d, + struct device_attribute *attr, char *buf) + { +- struct virtio_device *dev = container_of(_d,struct virtio_device,dev); +- ++ struct virtio_device *dev = dev_to_virtio(_d); + return sprintf(buf, "virtio:d%08Xv%08X\n", + dev->id.device, dev->id.vendor); + } + static ssize_t features_show(struct device *_d, + struct device_attribute *attr, char *buf) + { +- struct virtio_device *dev = container_of(_d, struct virtio_device, dev); ++ struct virtio_device *dev = dev_to_virtio(_d); + unsigned int i; + ssize_t len = 0; + +@@ -70,7 +69,7 @@ static inline int virtio_id_match(const struct virtio_device *dev, + static int virtio_dev_match(struct device *_dv, struct device_driver *_dr) + { + unsigned int i; +- struct virtio_device *dev = container_of(_dv,struct virtio_device,dev); ++ struct virtio_device *dev = dev_to_virtio(_dv); + const struct virtio_device_id *ids; + + ids = container_of(_dr, struct virtio_driver, driver)->id_table; +@@ -82,7 +81,7 @@ static int virtio_dev_match(struct device *_dv, struct device_driver *_dr) + + static int virtio_uevent(struct device *_dv, struct kobj_uevent_env *env) + { +- struct virtio_device *dev = container_of(_dv,struct virtio_device,dev); ++ struct virtio_device *dev = dev_to_virtio(_dv); + + return add_uevent_var(env, "MODALIAS=virtio:d%08Xv%08X", + dev->id.device, dev->id.vendor); +@@ -110,7 +109,7 @@ EXPORT_SYMBOL_GPL(virtio_check_driver_offered_feature); + static int virtio_dev_probe(struct device *_d) + { + int err, i; +- struct virtio_device *dev = container_of(_d,struct virtio_device,dev); ++ struct virtio_device *dev = dev_to_virtio(_d); + struct virtio_driver *drv = container_of(dev->dev.driver, + struct virtio_driver, driver); + u32 device_features; +@@ -148,7 +147,7 @@ static int virtio_dev_probe(struct device *_d) + + static int virtio_dev_remove(struct device *_d) + { +- struct virtio_device *dev = container_of(_d,struct virtio_device,dev); ++ struct virtio_device *dev = dev_to_virtio(_d); + struct virtio_driver *drv = container_of(dev->dev.driver, + struct virtio_driver, driver); + +diff --git a/drivers/virtio/virtio_pci.c b/drivers/virtio/virtio_pci.c +index a41f264dc23d..cc56763ff96d 100644 +--- a/drivers/virtio/virtio_pci.c ++++ b/drivers/virtio/virtio_pci.c +@@ -624,11 +624,13 @@ static struct virtio_config_ops virtio_pci_config_ops = { + + static void virtio_pci_release_dev(struct device *_d) + { +- /* +- * No need for a release method as we allocate/free +- * all devices together with the pci devices. +- * Provide an empty one to avoid getting a warning from core. +- */ ++ struct virtio_device *vdev = dev_to_virtio(_d); ++ struct virtio_pci_device *vp_dev = to_vp_device(vdev); ++ ++ /* As struct device is a kobject, it's not safe to ++ * free the memory (including the reference counter itself) ++ * until it's release callback. */ ++ kfree(vp_dev); + } + + /* the PCI probing function */ +@@ -716,7 +718,6 @@ static void __devexit virtio_pci_remove(struct pci_dev *pci_dev) + pci_iounmap(pci_dev, vp_dev->ioaddr); + pci_release_regions(pci_dev); + pci_disable_device(pci_dev); +- kfree(vp_dev); + } + + #ifdef CONFIG_PM +diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c +index a1e6c990cd41..a86a78d8e614 100644 +--- a/fs/9p/vfs_inode_dotl.c ++++ b/fs/9p/vfs_inode_dotl.c +@@ -81,7 +81,7 @@ static struct dentry *v9fs_dentry_from_dir_inode(struct inode *inode) + spin_lock(&inode->i_lock); + /* Directory should have only one entry. */ + BUG_ON(S_ISDIR(inode->i_mode) && !list_is_singular(&inode->i_dentry)); +- dentry = list_entry(inode->i_dentry.next, struct dentry, d_alias); ++ dentry = list_entry(inode->i_dentry.next, struct dentry, d_u.d_alias); + spin_unlock(&inode->i_lock); + return dentry; + } +diff --git a/fs/affs/amigaffs.c b/fs/affs/amigaffs.c +index 52a6407682e6..43a8f374b4a0 100644 +--- a/fs/affs/amigaffs.c ++++ b/fs/affs/amigaffs.c +@@ -132,7 +132,7 @@ affs_fix_dcache(struct dentry *dentry, u32 entry_ino) + head = &inode->i_dentry; + next = head->next; + while (next != head) { +- dentry = list_entry(next, struct dentry, d_alias); ++ dentry = list_entry(next, struct dentry, d_u.d_alias); + if (entry_ino == (u32)(long)dentry->d_fsdata) { + dentry->d_fsdata = data; + break; +diff --git a/fs/autofs4/expire.c b/fs/autofs4/expire.c +index b1cdb0ae5ca6..54effed1ce59 100644 +--- a/fs/autofs4/expire.c ++++ b/fs/autofs4/expire.c +@@ -100,7 +100,7 @@ static struct dentry *get_next_positive_subdir(struct dentry *prev, + p = prev; + spin_lock(&p->d_lock); + again: +- next = p->d_u.d_child.next; ++ next = p->d_child.next; + start: + if (next == &root->d_subdirs) { + spin_unlock(&p->d_lock); +@@ -109,7 +109,7 @@ start: + return NULL; + } + +- q = list_entry(next, struct dentry, d_u.d_child); ++ q = list_entry(next, struct dentry, d_child); + + spin_lock_nested(&q->d_lock, DENTRY_D_LOCK_NESTED); + /* Negative dentry - try next */ +@@ -166,13 +166,13 @@ again: + goto relock; + } + spin_unlock(&p->d_lock); +- next = p->d_u.d_child.next; ++ next = p->d_child.next; + p = parent; + if (next != &parent->d_subdirs) + break; + } + } +- ret = list_entry(next, struct dentry, d_u.d_child); ++ ret = list_entry(next, struct dentry, d_child); + + spin_lock_nested(&ret->d_lock, DENTRY_D_LOCK_NESTED); + /* Negative dentry - try next */ +@@ -457,7 +457,7 @@ found: + spin_lock(&sbi->lookup_lock); + spin_lock(&expired->d_parent->d_lock); + spin_lock_nested(&expired->d_lock, DENTRY_D_LOCK_NESTED); +- list_move(&expired->d_parent->d_subdirs, &expired->d_u.d_child); ++ list_move(&expired->d_parent->d_subdirs, &expired->d_child); + spin_unlock(&expired->d_lock); + spin_unlock(&expired->d_parent->d_lock); + spin_unlock(&sbi->lookup_lock); +diff --git a/fs/autofs4/root.c b/fs/autofs4/root.c +index 8c4292f89eef..411760477c4b 100644 +--- a/fs/autofs4/root.c ++++ b/fs/autofs4/root.c +@@ -651,7 +651,7 @@ static void autofs_clear_leaf_automount_flags(struct dentry *dentry) + /* only consider parents below dentrys in the root */ + if (IS_ROOT(parent->d_parent)) + return; +- d_child = &dentry->d_u.d_child; ++ d_child = &dentry->d_child; + /* Set parent managed if it's becoming empty */ + if (d_child->next == &parent->d_subdirs && + d_child->prev == &parent->d_subdirs) +diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c +index a009b9e322ac..6dacccef7790 100644 +--- a/fs/binfmt_elf.c ++++ b/fs/binfmt_elf.c +@@ -539,11 +539,12 @@ out: + + static unsigned long randomize_stack_top(unsigned long stack_top) + { +- unsigned int random_variable = 0; ++ unsigned long random_variable = 0; + + if ((current->flags & PF_RANDOMIZE) && + !(current->personality & ADDR_NO_RANDOMIZE)) { +- random_variable = get_random_int() & STACK_RND_MASK; ++ random_variable = (unsigned long) get_random_int(); ++ random_variable &= STACK_RND_MASK; + random_variable <<= PAGE_SHIFT; + } + #ifdef CONFIG_STACK_GROWSUP +diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c +index a7ffc88a7dbe..7c23cd9c2136 100644 +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -3556,12 +3556,6 @@ static int btrfs_destroy_pinned_extent(struct btrfs_root *root, + if (ret) + break; + +- /* opt_discard */ +- if (btrfs_test_opt(root, DISCARD)) +- ret = btrfs_error_discard_extent(root, start, +- end + 1 - start, +- NULL); +- + clear_extent_dirty(unpin, start, end, GFP_NOFS); + btrfs_error_unpin_extent_range(root, start, end); + cond_resched(); +diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c +index 224ce21cc0ac..cf6e7f4a4f4c 100644 +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -4892,7 +4892,8 @@ void btrfs_prepare_extent_commit(struct btrfs_trans_handle *trans, + update_global_block_rsv(fs_info); + } + +-static int unpin_extent_range(struct btrfs_root *root, u64 start, u64 end) ++static int unpin_extent_range(struct btrfs_root *root, u64 start, u64 end, ++ const bool return_free_space) + { + struct btrfs_fs_info *fs_info = root->fs_info; + struct btrfs_block_group_cache *cache = NULL; +@@ -4912,7 +4913,8 @@ static int unpin_extent_range(struct btrfs_root *root, u64 start, u64 end) + + if (start < cache->last_byte_to_unpin) { + len = min(len, cache->last_byte_to_unpin - start); +- btrfs_add_free_space(cache, start, len); ++ if (return_free_space) ++ btrfs_add_free_space(cache, start, len); + } + + start += len; +@@ -4960,7 +4962,7 @@ int btrfs_finish_extent_commit(struct btrfs_trans_handle *trans, + end + 1 - start, NULL); + + clear_extent_dirty(unpin, start, end, GFP_NOFS); +- unpin_extent_range(root, start, end); ++ unpin_extent_range(root, start, end, true); + cond_resched(); + } + +@@ -8008,7 +8010,7 @@ out: + + int btrfs_error_unpin_extent_range(struct btrfs_root *root, u64 start, u64 end) + { +- return unpin_extent_range(root, start, end); ++ return unpin_extent_range(root, start, end, false); + } + + int btrfs_error_discard_extent(struct btrfs_root *root, u64 bytenr, +diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c +index 3e8094be4604..455b64336628 100644 +--- a/fs/ceph/dir.c ++++ b/fs/ceph/dir.c +@@ -104,7 +104,7 @@ static unsigned fpos_off(loff_t p) + /* + * When possible, we try to satisfy a readdir by peeking at the + * dcache. We make this work by carefully ordering dentries on +- * d_u.d_child when we initially get results back from the MDS, and ++ * d_child when we initially get results back from the MDS, and + * falling back to a "normal" sync readdir if any dentries in the dir + * are dropped. + * +@@ -140,11 +140,11 @@ static int __dcache_readdir(struct file *filp, + p = parent->d_subdirs.prev; + dout(" initial p %p/%p\n", p->prev, p->next); + } else { +- p = last->d_u.d_child.prev; ++ p = last->d_child.prev; + } + + more: +- dentry = list_entry(p, struct dentry, d_u.d_child); ++ dentry = list_entry(p, struct dentry, d_child); + di = ceph_dentry(dentry); + while (1) { + dout(" p %p/%p %s d_subdirs %p/%p\n", p->prev, p->next, +@@ -166,7 +166,7 @@ more: + !dentry->d_inode ? " null" : ""); + spin_unlock(&dentry->d_lock); + p = p->prev; +- dentry = list_entry(p, struct dentry, d_u.d_child); ++ dentry = list_entry(p, struct dentry, d_child); + di = ceph_dentry(dentry); + } + +diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c +index 81613bced19f..1ea77206a0d5 100644 +--- a/fs/ceph/inode.c ++++ b/fs/ceph/inode.c +@@ -869,9 +869,9 @@ static void ceph_set_dentry_offset(struct dentry *dn) + + spin_lock(&dir->d_lock); + spin_lock_nested(&dn->d_lock, DENTRY_D_LOCK_NESTED); +- list_move(&dn->d_u.d_child, &dir->d_subdirs); ++ list_move(&dn->d_child, &dir->d_subdirs); + dout("set_dentry_offset %p %lld (%p %p)\n", dn, di->offset, +- dn->d_u.d_child.prev, dn->d_u.d_child.next); ++ dn->d_child.prev, dn->d_child.next); + spin_unlock(&dn->d_lock); + spin_unlock(&dir->d_lock); + } +@@ -1262,7 +1262,7 @@ retry_lookup: + /* reorder parent's d_subdirs */ + spin_lock(&parent->d_lock); + spin_lock_nested(&dn->d_lock, DENTRY_D_LOCK_NESTED); +- list_move(&dn->d_u.d_child, &parent->d_subdirs); ++ list_move(&dn->d_child, &parent->d_subdirs); + spin_unlock(&dn->d_lock); + spin_unlock(&parent->d_lock); + } +diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c +index 8d6ac6bec9e9..2c2acc03b24e 100644 +--- a/fs/cifs/inode.c ++++ b/fs/cifs/inode.c +@@ -833,7 +833,7 @@ inode_has_hashed_dentries(struct inode *inode) + struct dentry *dentry; + + spin_lock(&inode->i_lock); +- list_for_each_entry(dentry, &inode->i_dentry, d_alias) { ++ list_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) { + if (!d_unhashed(dentry) || IS_ROOT(dentry)) { + spin_unlock(&inode->i_lock); + return true; +diff --git a/fs/coda/cache.c b/fs/coda/cache.c +index 690157876184..4b2e5cb502f6 100644 +--- a/fs/coda/cache.c ++++ b/fs/coda/cache.c +@@ -95,7 +95,7 @@ static void coda_flag_children(struct dentry *parent, int flag) + spin_lock(&parent->d_lock); + list_for_each(child, &parent->d_subdirs) + { +- de = list_entry(child, struct dentry, d_u.d_child); ++ de = list_entry(child, struct dentry, d_child); + /* don't know what to do with negative dentries */ + if ( ! de->d_inode ) + continue; +diff --git a/fs/dcache.c b/fs/dcache.c +index 09e2eda55c57..8038a780696f 100644 +--- a/fs/dcache.c ++++ b/fs/dcache.c +@@ -43,7 +43,7 @@ + /* + * Usage: + * dcache->d_inode->i_lock protects: +- * - i_dentry, d_alias, d_inode of aliases ++ * - i_dentry, d_u.d_alias, d_inode of aliases + * dcache_hash_bucket lock protects: + * - the dcache hash table + * s_anon bl list spinlock protects: +@@ -58,7 +58,7 @@ + * - d_unhashed() + * - d_parent and d_subdirs + * - childrens' d_child and d_parent +- * - d_alias, d_inode ++ * - d_u.d_alias, d_inode + * + * Ordering: + * dentry->d_inode->i_lock +@@ -202,7 +202,6 @@ static void __d_free(struct rcu_head *head) + { + struct dentry *dentry = container_of(head, struct dentry, d_u.d_rcu); + +- WARN_ON(!list_empty(&dentry->d_alias)); + if (dname_external(dentry)) + kfree(dentry->d_name.name); + kmem_cache_free(dentry_cache, dentry); +@@ -213,6 +212,7 @@ static void __d_free(struct rcu_head *head) + */ + static void d_free(struct dentry *dentry) + { ++ WARN_ON(!list_empty(&dentry->d_u.d_alias)); + BUG_ON(dentry->d_count); + this_cpu_dec(nr_dentry); + if (dentry->d_op && dentry->d_op->d_release) +@@ -251,7 +251,7 @@ static void dentry_iput(struct dentry * dentry) + struct inode *inode = dentry->d_inode; + if (inode) { + dentry->d_inode = NULL; +- list_del_init(&dentry->d_alias); ++ list_del_init(&dentry->d_u.d_alias); + spin_unlock(&dentry->d_lock); + spin_unlock(&inode->i_lock); + if (!inode->i_nlink) +@@ -275,7 +275,7 @@ static void dentry_unlink_inode(struct dentry * dentry) + { + struct inode *inode = dentry->d_inode; + dentry->d_inode = NULL; +- list_del_init(&dentry->d_alias); ++ list_del_init(&dentry->d_u.d_alias); + dentry_rcuwalk_barrier(dentry); + spin_unlock(&dentry->d_lock); + spin_unlock(&inode->i_lock); +@@ -368,9 +368,9 @@ static struct dentry *d_kill(struct dentry *dentry, struct dentry *parent) + __releases(parent->d_lock) + __releases(dentry->d_inode->i_lock) + { +- list_del(&dentry->d_u.d_child); ++ __list_del_entry(&dentry->d_child); + /* +- * Inform try_to_ascend() that we are no longer attached to the ++ * Inform ascending readers that we are no longer attached to the + * dentry tree + */ + dentry->d_flags |= DCACHE_DENTRY_KILLED; +@@ -686,7 +686,7 @@ static struct dentry *__d_find_alias(struct inode *inode, int want_discon) + + again: + discon_alias = NULL; +- list_for_each_entry(alias, &inode->i_dentry, d_alias) { ++ list_for_each_entry(alias, &inode->i_dentry, d_u.d_alias) { + spin_lock(&alias->d_lock); + if (S_ISDIR(inode->i_mode) || !d_unhashed(alias)) { + if (IS_ROOT(alias) && +@@ -739,7 +739,7 @@ void d_prune_aliases(struct inode *inode) + struct dentry *dentry; + restart: + spin_lock(&inode->i_lock); +- list_for_each_entry(dentry, &inode->i_dentry, d_alias) { ++ list_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) { + spin_lock(&dentry->d_lock); + if (!dentry->d_count) { + __dget_dlock(dentry); +@@ -919,7 +919,7 @@ static void shrink_dcache_for_umount_subtree(struct dentry *dentry) + /* descend to the first leaf in the current subtree */ + while (!list_empty(&dentry->d_subdirs)) + dentry = list_entry(dentry->d_subdirs.next, +- struct dentry, d_u.d_child); ++ struct dentry, d_child); + + /* consume the dentries from this leaf up through its parents + * until we find one with children or run out altogether */ +@@ -951,17 +951,17 @@ static void shrink_dcache_for_umount_subtree(struct dentry *dentry) + + if (IS_ROOT(dentry)) { + parent = NULL; +- list_del(&dentry->d_u.d_child); ++ list_del(&dentry->d_child); + } else { + parent = dentry->d_parent; + parent->d_count--; +- list_del(&dentry->d_u.d_child); ++ list_del(&dentry->d_child); + } + + inode = dentry->d_inode; + if (inode) { + dentry->d_inode = NULL; +- list_del_init(&dentry->d_alias); ++ list_del_init(&dentry->d_u.d_alias); + if (dentry->d_op && dentry->d_op->d_iput) + dentry->d_op->d_iput(dentry, inode); + else +@@ -979,7 +979,7 @@ static void shrink_dcache_for_umount_subtree(struct dentry *dentry) + } while (list_empty(&dentry->d_subdirs)); + + dentry = list_entry(dentry->d_subdirs.next, +- struct dentry, d_u.d_child); ++ struct dentry, d_child); + } + } + +@@ -1011,34 +1011,6 @@ void shrink_dcache_for_umount(struct super_block *sb) + } + } + +-/* +- * This tries to ascend one level of parenthood, but +- * we can race with renaming, so we need to re-check +- * the parenthood after dropping the lock and check +- * that the sequence number still matches. +- */ +-static struct dentry *try_to_ascend(struct dentry *old, int locked, unsigned seq) +-{ +- struct dentry *new = old->d_parent; +- +- rcu_read_lock(); +- spin_unlock(&old->d_lock); +- spin_lock(&new->d_lock); +- +- /* +- * might go back up the wrong parent if we have had a rename +- * or deletion +- */ +- if (new != old->d_parent || +- (old->d_flags & DCACHE_DENTRY_KILLED) || +- (!locked && read_seqretry(&rename_lock, seq))) { +- spin_unlock(&new->d_lock); +- new = NULL; +- } +- rcu_read_unlock(); +- return new; +-} +- + + /* + * Search for at least 1 mount point in the dentry's subdirs. +@@ -1072,7 +1044,7 @@ repeat: + resume: + while (next != &this_parent->d_subdirs) { + struct list_head *tmp = next; +- struct dentry *dentry = list_entry(tmp, struct dentry, d_u.d_child); ++ struct dentry *dentry = list_entry(tmp, struct dentry, d_child); + next = tmp->next; + + spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED); +@@ -1094,30 +1066,48 @@ resume: + /* + * All done at this level ... ascend and resume the search. + */ ++ rcu_read_lock(); ++ascend: + if (this_parent != parent) { + struct dentry *child = this_parent; +- this_parent = try_to_ascend(this_parent, locked, seq); +- if (!this_parent) ++ this_parent = child->d_parent; ++ ++ spin_unlock(&child->d_lock); ++ spin_lock(&this_parent->d_lock); ++ ++ /* might go back up the wrong parent if we have had a rename */ ++ if (!locked && read_seqretry(&rename_lock, seq)) + goto rename_retry; +- next = child->d_u.d_child.next; ++ next = child->d_child.next; ++ while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) { ++ if (next == &this_parent->d_subdirs) ++ goto ascend; ++ child = list_entry(next, struct dentry, d_child); ++ next = next->next; ++ } ++ rcu_read_unlock(); + goto resume; + } +- spin_unlock(&this_parent->d_lock); + if (!locked && read_seqretry(&rename_lock, seq)) + goto rename_retry; ++ spin_unlock(&this_parent->d_lock); ++ rcu_read_unlock(); + if (locked) + write_sequnlock(&rename_lock); + return 0; /* No mount points found in tree */ + positive: + if (!locked && read_seqretry(&rename_lock, seq)) +- goto rename_retry; ++ goto rename_retry_unlocked; + if (locked) + write_sequnlock(&rename_lock); + return 1; + + rename_retry: ++ spin_unlock(&this_parent->d_lock); ++ rcu_read_unlock(); + if (locked) + goto again; ++rename_retry_unlocked: + locked = 1; + write_seqlock(&rename_lock); + goto again; +@@ -1155,7 +1145,7 @@ repeat: + resume: + while (next != &this_parent->d_subdirs) { + struct list_head *tmp = next; +- struct dentry *dentry = list_entry(tmp, struct dentry, d_u.d_child); ++ struct dentry *dentry = list_entry(tmp, struct dentry, d_child); + next = tmp->next; + + spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED); +@@ -1182,6 +1172,7 @@ resume: + */ + if (found && need_resched()) { + spin_unlock(&dentry->d_lock); ++ rcu_read_lock(); + goto out; + } + +@@ -1201,23 +1192,40 @@ resume: + /* + * All done at this level ... ascend and resume the search. + */ ++ rcu_read_lock(); ++ascend: + if (this_parent != parent) { + struct dentry *child = this_parent; +- this_parent = try_to_ascend(this_parent, locked, seq); +- if (!this_parent) ++ this_parent = child->d_parent; ++ ++ spin_unlock(&child->d_lock); ++ spin_lock(&this_parent->d_lock); ++ ++ /* might go back up the wrong parent if we have had a rename */ ++ if (!locked && read_seqretry(&rename_lock, seq)) + goto rename_retry; +- next = child->d_u.d_child.next; ++ next = child->d_child.next; ++ while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) { ++ if (next == &this_parent->d_subdirs) ++ goto ascend; ++ child = list_entry(next, struct dentry, d_child); ++ next = next->next; ++ } ++ rcu_read_unlock(); + goto resume; + } + out: +- spin_unlock(&this_parent->d_lock); + if (!locked && read_seqretry(&rename_lock, seq)) + goto rename_retry; ++ spin_unlock(&this_parent->d_lock); ++ rcu_read_unlock(); + if (locked) + write_sequnlock(&rename_lock); + return found; + + rename_retry: ++ spin_unlock(&this_parent->d_lock); ++ rcu_read_unlock(); + if (found) + return found; + if (locked) +@@ -1292,8 +1300,8 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name) + INIT_HLIST_BL_NODE(&dentry->d_hash); + INIT_LIST_HEAD(&dentry->d_lru); + INIT_LIST_HEAD(&dentry->d_subdirs); +- INIT_LIST_HEAD(&dentry->d_alias); +- INIT_LIST_HEAD(&dentry->d_u.d_child); ++ INIT_LIST_HEAD(&dentry->d_u.d_alias); ++ INIT_LIST_HEAD(&dentry->d_child); + d_set_d_op(dentry, dentry->d_sb->s_d_op); + + this_cpu_inc(nr_dentry); +@@ -1323,7 +1331,7 @@ struct dentry *d_alloc(struct dentry * parent, const struct qstr *name) + */ + __dget_dlock(parent); + dentry->d_parent = parent; +- list_add(&dentry->d_u.d_child, &parent->d_subdirs); ++ list_add(&dentry->d_child, &parent->d_subdirs); + spin_unlock(&parent->d_lock); + + return dentry; +@@ -1380,7 +1388,7 @@ static void __d_instantiate(struct dentry *dentry, struct inode *inode) + if (inode) { + if (unlikely(IS_AUTOMOUNT(inode))) + dentry->d_flags |= DCACHE_NEED_AUTOMOUNT; +- list_add(&dentry->d_alias, &inode->i_dentry); ++ list_add(&dentry->d_u.d_alias, &inode->i_dentry); + } + dentry->d_inode = inode; + dentry_rcuwalk_barrier(dentry); +@@ -1405,7 +1413,7 @@ static void __d_instantiate(struct dentry *dentry, struct inode *inode) + + void d_instantiate(struct dentry *entry, struct inode * inode) + { +- BUG_ON(!list_empty(&entry->d_alias)); ++ BUG_ON(!list_empty(&entry->d_u.d_alias)); + if (inode) + spin_lock(&inode->i_lock); + __d_instantiate(entry, inode); +@@ -1444,7 +1452,7 @@ static struct dentry *__d_instantiate_unique(struct dentry *entry, + return NULL; + } + +- list_for_each_entry(alias, &inode->i_dentry, d_alias) { ++ list_for_each_entry(alias, &inode->i_dentry, d_u.d_alias) { + struct qstr *qstr = &alias->d_name; + + /* +@@ -1470,7 +1478,7 @@ struct dentry *d_instantiate_unique(struct dentry *entry, struct inode *inode) + { + struct dentry *result; + +- BUG_ON(!list_empty(&entry->d_alias)); ++ BUG_ON(!list_empty(&entry->d_u.d_alias)); + + if (inode) + spin_lock(&inode->i_lock); +@@ -1513,7 +1521,7 @@ static struct dentry * __d_find_any_alias(struct inode *inode) + + if (list_empty(&inode->i_dentry)) + return NULL; +- alias = list_first_entry(&inode->i_dentry, struct dentry, d_alias); ++ alias = list_first_entry(&inode->i_dentry, struct dentry, d_u.d_alias); + __dget(alias); + return alias; + } +@@ -1587,7 +1595,7 @@ struct dentry *d_obtain_alias(struct inode *inode) + spin_lock(&tmp->d_lock); + tmp->d_inode = inode; + tmp->d_flags |= DCACHE_DISCONNECTED; +- list_add(&tmp->d_alias, &inode->i_dentry); ++ list_add(&tmp->d_u.d_alias, &inode->i_dentry); + hlist_bl_lock(&tmp->d_sb->s_anon); + hlist_bl_add_head(&tmp->d_hash, &tmp->d_sb->s_anon); + hlist_bl_unlock(&tmp->d_sb->s_anon); +@@ -1996,7 +2004,7 @@ int d_validate(struct dentry *dentry, struct dentry *dparent) + struct dentry *child; + + spin_lock(&dparent->d_lock); +- list_for_each_entry(child, &dparent->d_subdirs, d_u.d_child) { ++ list_for_each_entry(child, &dparent->d_subdirs, d_child) { + if (dentry == child) { + spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED); + __dget_dlock(dentry); +@@ -2243,8 +2251,8 @@ static void __d_move(struct dentry * dentry, struct dentry * target) + /* Unhash the target: dput() will then get rid of it */ + __d_drop(target); + +- list_del(&dentry->d_u.d_child); +- list_del(&target->d_u.d_child); ++ list_del(&dentry->d_child); ++ list_del(&target->d_child); + + /* Switch the names.. */ + switch_names(dentry, target); +@@ -2254,15 +2262,15 @@ static void __d_move(struct dentry * dentry, struct dentry * target) + if (IS_ROOT(dentry)) { + dentry->d_parent = target->d_parent; + target->d_parent = target; +- INIT_LIST_HEAD(&target->d_u.d_child); ++ INIT_LIST_HEAD(&target->d_child); + } else { + swap(dentry->d_parent, target->d_parent); + + /* And add them back to the (new) parent lists */ +- list_add(&target->d_u.d_child, &target->d_parent->d_subdirs); ++ list_add(&target->d_child, &target->d_parent->d_subdirs); + } + +- list_add(&dentry->d_u.d_child, &dentry->d_parent->d_subdirs); ++ list_add(&dentry->d_child, &dentry->d_parent->d_subdirs); + + write_seqcount_end(&target->d_seq); + write_seqcount_end(&dentry->d_seq); +@@ -2369,18 +2377,18 @@ static void __d_materialise_dentry(struct dentry *dentry, struct dentry *anon) + swap(dentry->d_name.hash, anon->d_name.hash); + + dentry->d_parent = (aparent == anon) ? dentry : aparent; +- list_del(&dentry->d_u.d_child); ++ list_del(&dentry->d_child); + if (!IS_ROOT(dentry)) +- list_add(&dentry->d_u.d_child, &dentry->d_parent->d_subdirs); ++ list_add(&dentry->d_child, &dentry->d_parent->d_subdirs); + else +- INIT_LIST_HEAD(&dentry->d_u.d_child); ++ INIT_LIST_HEAD(&dentry->d_child); + + anon->d_parent = (dparent == dentry) ? anon : dparent; +- list_del(&anon->d_u.d_child); ++ list_del(&anon->d_child); + if (!IS_ROOT(anon)) +- list_add(&anon->d_u.d_child, &anon->d_parent->d_subdirs); ++ list_add(&anon->d_child, &anon->d_parent->d_subdirs); + else +- INIT_LIST_HEAD(&anon->d_u.d_child); ++ INIT_LIST_HEAD(&anon->d_child); + + write_seqcount_end(&dentry->d_seq); + write_seqcount_end(&anon->d_seq); +@@ -2934,7 +2942,7 @@ repeat: + resume: + while (next != &this_parent->d_subdirs) { + struct list_head *tmp = next; +- struct dentry *dentry = list_entry(tmp, struct dentry, d_u.d_child); ++ struct dentry *dentry = list_entry(tmp, struct dentry, d_child); + next = tmp->next; + + spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED); +@@ -2955,26 +2963,43 @@ resume: + } + spin_unlock(&dentry->d_lock); + } ++ rcu_read_lock(); ++ascend: + if (this_parent != root) { + struct dentry *child = this_parent; + if (!(this_parent->d_flags & DCACHE_GENOCIDE)) { + this_parent->d_flags |= DCACHE_GENOCIDE; + this_parent->d_count--; + } +- this_parent = try_to_ascend(this_parent, locked, seq); +- if (!this_parent) ++ this_parent = child->d_parent; ++ ++ spin_unlock(&child->d_lock); ++ spin_lock(&this_parent->d_lock); ++ ++ /* might go back up the wrong parent if we have had a rename */ ++ if (!locked && read_seqretry(&rename_lock, seq)) + goto rename_retry; +- next = child->d_u.d_child.next; ++ next = child->d_child.next; ++ while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) { ++ if (next == &this_parent->d_subdirs) ++ goto ascend; ++ child = list_entry(next, struct dentry, d_child); ++ next = next->next; ++ } ++ rcu_read_unlock(); + goto resume; + } +- spin_unlock(&this_parent->d_lock); + if (!locked && read_seqretry(&rename_lock, seq)) + goto rename_retry; ++ spin_unlock(&this_parent->d_lock); ++ rcu_read_unlock(); + if (locked) + write_sequnlock(&rename_lock); + return; + + rename_retry: ++ spin_unlock(&this_parent->d_lock); ++ rcu_read_unlock(); + if (locked) + goto again; + locked = 1; +diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c +index 9dc6e76b7a90..47d64e9282bf 100644 +--- a/fs/debugfs/inode.c ++++ b/fs/debugfs/inode.c +@@ -539,7 +539,7 @@ void debugfs_remove_recursive(struct dentry *dentry) + parent = dentry; + down: + mutex_lock(&parent->d_inode->i_mutex); +- list_for_each_entry_safe(child, next, &parent->d_subdirs, d_u.d_child) { ++ list_for_each_entry_safe(child, next, &parent->d_subdirs, d_child) { + if (!debugfs_positive(child)) + continue; + +@@ -560,8 +560,8 @@ void debugfs_remove_recursive(struct dentry *dentry) + mutex_lock(&parent->d_inode->i_mutex); + + if (child != dentry) { +- next = list_entry(child->d_u.d_child.next, struct dentry, +- d_u.d_child); ++ next = list_entry(child->d_child.next, struct dentry, ++ d_child); + goto up; + } + +diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c +index ea9931281557..3d0633891f28 100644 +--- a/fs/ecryptfs/crypto.c ++++ b/fs/ecryptfs/crypto.c +@@ -2044,7 +2044,6 @@ ecryptfs_decode_from_filename(unsigned char *dst, size_t *dst_size, + break; + case 2: + dst[dst_byte_offset++] |= (src_byte); +- dst[dst_byte_offset] = 0; + current_bit_offset = 0; + break; + } +diff --git a/fs/ecryptfs/file.c b/fs/ecryptfs/file.c +index d45ba4568128..f04aa3303464 100644 +--- a/fs/ecryptfs/file.c ++++ b/fs/ecryptfs/file.c +@@ -195,24 +195,12 @@ static int ecryptfs_open(struct inode *inode, struct file *file) + { + int rc = 0; + struct ecryptfs_crypt_stat *crypt_stat = NULL; +- struct ecryptfs_mount_crypt_stat *mount_crypt_stat; + struct dentry *ecryptfs_dentry = file->f_path.dentry; + /* Private value of ecryptfs_dentry allocated in + * ecryptfs_lookup() */ + struct dentry *lower_dentry; + struct ecryptfs_file_info *file_info; + +- mount_crypt_stat = &ecryptfs_superblock_to_private( +- ecryptfs_dentry->d_sb)->mount_crypt_stat; +- if ((mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED) +- && ((file->f_flags & O_WRONLY) || (file->f_flags & O_RDWR) +- || (file->f_flags & O_CREAT) || (file->f_flags & O_TRUNC) +- || (file->f_flags & O_APPEND))) { +- printk(KERN_WARNING "Mount has encrypted view enabled; " +- "files may only be read\n"); +- rc = -EPERM; +- goto out; +- } + /* Released in ecryptfs_release or end of function if failure */ + file_info = kmem_cache_zalloc(ecryptfs_file_info_cache, GFP_KERNEL); + ecryptfs_set_file_private(file, file_info); +diff --git a/fs/ecryptfs/main.c b/fs/ecryptfs/main.c +index 240832e8b289..93b7bec021bc 100644 +--- a/fs/ecryptfs/main.c ++++ b/fs/ecryptfs/main.c +@@ -494,6 +494,7 @@ static struct dentry *ecryptfs_mount(struct file_system_type *fs_type, int flags + { + struct super_block *s; + struct ecryptfs_sb_info *sbi; ++ struct ecryptfs_mount_crypt_stat *mount_crypt_stat; + struct ecryptfs_dentry_info *root_info; + const char *err = "Getting sb failed"; + struct inode *inode; +@@ -512,6 +513,7 @@ static struct dentry *ecryptfs_mount(struct file_system_type *fs_type, int flags + err = "Error parsing options"; + goto out; + } ++ mount_crypt_stat = &sbi->mount_crypt_stat; + + s = sget(fs_type, NULL, set_anon_super, NULL); + if (IS_ERR(s)) { +@@ -557,11 +559,19 @@ static struct dentry *ecryptfs_mount(struct file_system_type *fs_type, int flags + + /** + * Set the POSIX ACL flag based on whether they're enabled in the lower +- * mount. Force a read-only eCryptfs mount if the lower mount is ro. +- * Allow a ro eCryptfs mount even when the lower mount is rw. ++ * mount. + */ + s->s_flags = flags & ~MS_POSIXACL; +- s->s_flags |= path.dentry->d_sb->s_flags & (MS_RDONLY | MS_POSIXACL); ++ s->s_flags |= path.dentry->d_sb->s_flags & MS_POSIXACL; ++ ++ /** ++ * Force a read-only eCryptfs mount when: ++ * 1) The lower mount is ro ++ * 2) The ecryptfs_encrypted_view mount option is specified ++ */ ++ if (path.dentry->d_sb->s_flags & MS_RDONLY || ++ mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED) ++ s->s_flags |= MS_RDONLY; + + s->s_maxbytes = path.dentry->d_sb->s_maxbytes; + s->s_blocksize = path.dentry->d_sb->s_blocksize; +diff --git a/fs/exportfs/expfs.c b/fs/exportfs/expfs.c +index b05acb796135..3bbf5e75df0a 100644 +--- a/fs/exportfs/expfs.c ++++ b/fs/exportfs/expfs.c +@@ -50,7 +50,7 @@ find_acceptable_alias(struct dentry *result, + + inode = result->d_inode; + spin_lock(&inode->i_lock); +- list_for_each_entry(dentry, &inode->i_dentry, d_alias) { ++ list_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) { + dget(dentry); + spin_unlock(&inode->i_lock); + if (toput) +diff --git a/fs/ext4/fsync.c b/fs/ext4/fsync.c +index a8d03a4d3f8b..019c29c89824 100644 +--- a/fs/ext4/fsync.c ++++ b/fs/ext4/fsync.c +@@ -139,7 +139,7 @@ static int ext4_sync_parent(struct inode *inode) + spin_lock(&inode->i_lock); + if (!list_empty(&inode->i_dentry)) { + dentry = list_first_entry(&inode->i_dentry, +- struct dentry, d_alias); ++ struct dentry, d_u.d_alias); + dget(dentry); + } + spin_unlock(&inode->i_lock); +diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c +index b35bd64fb548..f8458342593d 100644 +--- a/fs/fs-writeback.c ++++ b/fs/fs-writeback.c +@@ -402,7 +402,6 @@ writeback_single_inode(struct inode *inode, struct bdi_writeback *wb, + + /* Set I_SYNC, reset I_DIRTY_PAGES */ + inode->i_state |= I_SYNC; +- inode->i_state &= ~I_DIRTY_PAGES; + spin_unlock(&inode->i_lock); + spin_unlock(&wb->list_lock); + +@@ -425,9 +424,28 @@ writeback_single_inode(struct inode *inode, struct bdi_writeback *wb, + * write_inode() + */ + spin_lock(&inode->i_lock); ++ + dirty = inode->i_state & I_DIRTY; +- inode->i_state &= ~(I_DIRTY_SYNC | I_DIRTY_DATASYNC); ++ inode->i_state &= ~I_DIRTY; ++ ++ /* ++ * Paired with smp_mb() in __mark_inode_dirty(). This allows ++ * __mark_inode_dirty() to test i_state without grabbing i_lock - ++ * either they see the I_DIRTY bits cleared or we see the dirtied ++ * inode. ++ * ++ * I_DIRTY_PAGES is always cleared together above even if @mapping ++ * still has dirty pages. The flag is reinstated after smp_mb() if ++ * necessary. This guarantees that either __mark_inode_dirty() ++ * sees clear I_DIRTY_PAGES or we see PAGECACHE_TAG_DIRTY. ++ */ ++ smp_mb(); ++ ++ if (mapping_tagged(mapping, PAGECACHE_TAG_DIRTY)) ++ inode->i_state |= I_DIRTY_PAGES; ++ + spin_unlock(&inode->i_lock); ++ + /* Don't write the inode if only I_DIRTY_PAGES was set */ + if (dirty & (I_DIRTY_SYNC | I_DIRTY_DATASYNC)) { + int err = write_inode(inode, wbc); +@@ -453,7 +471,6 @@ writeback_single_inode(struct inode *inode, struct bdi_writeback *wb, + * We didn't write back all the pages. nfs_writepages() + * sometimes bales out without doing anything. + */ +- inode->i_state |= I_DIRTY_PAGES; + if (wbc->nr_to_write <= 0) { + /* + * slice used up: queue for next turn +@@ -1074,12 +1091,11 @@ void __mark_inode_dirty(struct inode *inode, int flags) + } + + /* +- * make sure that changes are seen by all cpus before we test i_state +- * -- mikulas ++ * Paired with smp_mb() in __writeback_single_inode() for the ++ * following lockless i_state test. See there for details. + */ + smp_mb(); + +- /* avoid the locking if we can */ + if ((inode->i_state & flags) == flags) + return; + +diff --git a/fs/isofs/rock.c b/fs/isofs/rock.c +index ee62cc0c2499..17809499c752 100644 +--- a/fs/isofs/rock.c ++++ b/fs/isofs/rock.c +@@ -30,6 +30,7 @@ struct rock_state { + int cont_size; + int cont_extent; + int cont_offset; ++ int cont_loops; + struct inode *inode; + }; + +@@ -73,6 +74,9 @@ static void init_rock_state(struct rock_state *rs, struct inode *inode) + rs->inode = inode; + } + ++/* Maximum number of Rock Ridge continuation entries */ ++#define RR_MAX_CE_ENTRIES 32 ++ + /* + * Returns 0 if the caller should continue scanning, 1 if the scan must end + * and -ve on error. +@@ -105,6 +109,8 @@ static int rock_continue(struct rock_state *rs) + goto out; + } + ret = -EIO; ++ if (++rs->cont_loops >= RR_MAX_CE_ENTRIES) ++ goto out; + bh = sb_bread(rs->inode->i_sb, rs->cont_extent); + if (bh) { + memcpy(rs->buffer, bh->b_data + rs->cont_offset, +@@ -356,6 +362,9 @@ repeat: + rs.cont_size = isonum_733(rr->u.CE.size); + break; + case SIG('E', 'R'): ++ /* Invalid length of ER tag id? */ ++ if (rr->u.ER.len_id + offsetof(struct rock_ridge, u.ER.data) > rr->len) ++ goto out; + ISOFS_SB(inode->i_sb)->s_rock = 1; + printk(KERN_DEBUG "ISO 9660 Extensions: "); + { +diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c +index b6f17c0b7718..33c8624f2286 100644 +--- a/fs/jfs/jfs_dtree.c ++++ b/fs/jfs/jfs_dtree.c +@@ -3103,7 +3103,7 @@ int jfs_readdir(struct file *filp, void *dirent, filldir_t filldir) + * self "." + */ + filp->f_pos = 1; +- if (filldir(dirent, ".", 1, 0, ip->i_ino, ++ if (filldir(dirent, ".", 1, 1, ip->i_ino, + DT_DIR)) + return 0; + } +@@ -3111,7 +3111,7 @@ int jfs_readdir(struct file *filp, void *dirent, filldir_t filldir) + * parent ".." + */ + filp->f_pos = 2; +- if (filldir(dirent, "..", 2, 1, PARENT(ip), DT_DIR)) ++ if (filldir(dirent, "..", 2, 2, PARENT(ip), DT_DIR)) + return 0; + + /* +diff --git a/fs/libfs.c b/fs/libfs.c +index 18d08f5db53a..65c126f0d5e0 100644 +--- a/fs/libfs.c ++++ b/fs/libfs.c +@@ -104,18 +104,18 @@ loff_t dcache_dir_lseek(struct file *file, loff_t offset, int origin) + + spin_lock(&dentry->d_lock); + /* d_lock not required for cursor */ +- list_del(&cursor->d_u.d_child); ++ list_del(&cursor->d_child); + p = dentry->d_subdirs.next; + while (n && p != &dentry->d_subdirs) { + struct dentry *next; +- next = list_entry(p, struct dentry, d_u.d_child); ++ next = list_entry(p, struct dentry, d_child); + spin_lock_nested(&next->d_lock, DENTRY_D_LOCK_NESTED); + if (simple_positive(next)) + n--; + spin_unlock(&next->d_lock); + p = p->next; + } +- list_add_tail(&cursor->d_u.d_child, p); ++ list_add_tail(&cursor->d_child, p); + spin_unlock(&dentry->d_lock); + } + } +@@ -139,7 +139,7 @@ int dcache_readdir(struct file * filp, void * dirent, filldir_t filldir) + { + struct dentry *dentry = filp->f_path.dentry; + struct dentry *cursor = filp->private_data; +- struct list_head *p, *q = &cursor->d_u.d_child; ++ struct list_head *p, *q = &cursor->d_child; + ino_t ino; + int i = filp->f_pos; + +@@ -165,7 +165,7 @@ int dcache_readdir(struct file * filp, void * dirent, filldir_t filldir) + + for (p=q->next; p != &dentry->d_subdirs; p=p->next) { + struct dentry *next; +- next = list_entry(p, struct dentry, d_u.d_child); ++ next = list_entry(p, struct dentry, d_child); + spin_lock_nested(&next->d_lock, DENTRY_D_LOCK_NESTED); + if (!simple_positive(next)) { + spin_unlock(&next->d_lock); +@@ -289,7 +289,7 @@ int simple_empty(struct dentry *dentry) + int ret = 0; + + spin_lock(&dentry->d_lock); +- list_for_each_entry(child, &dentry->d_subdirs, d_u.d_child) { ++ list_for_each_entry(child, &dentry->d_subdirs, d_child) { + spin_lock_nested(&child->d_lock, DENTRY_D_LOCK_NESTED); + if (simple_positive(child)) { + spin_unlock(&child->d_lock); +diff --git a/fs/ncpfs/dir.c b/fs/ncpfs/dir.c +index 9560fd7f5c7a..ba792a0ab9f2 100644 +--- a/fs/ncpfs/dir.c ++++ b/fs/ncpfs/dir.c +@@ -391,7 +391,7 @@ ncp_dget_fpos(struct dentry *dentry, struct dentry *parent, unsigned long fpos) + spin_lock(&parent->d_lock); + next = parent->d_subdirs.next; + while (next != &parent->d_subdirs) { +- dent = list_entry(next, struct dentry, d_u.d_child); ++ dent = list_entry(next, struct dentry, d_child); + if ((unsigned long)dent->d_fsdata == fpos) { + if (dent->d_inode) + dget(dent); +diff --git a/fs/ncpfs/ioctl.c b/fs/ncpfs/ioctl.c +index 6958adfaff08..0a76def69d95 100644 +--- a/fs/ncpfs/ioctl.c ++++ b/fs/ncpfs/ioctl.c +@@ -445,7 +445,6 @@ static long __ncp_ioctl(struct inode *inode, unsigned int cmd, unsigned long arg + result = -EIO; + } + } +- result = 0; + } + mutex_unlock(&server->root_setup_lock); + +diff --git a/fs/ncpfs/ncplib_kernel.h b/fs/ncpfs/ncplib_kernel.h +index 32c06587351a..6d5e7c56c79d 100644 +--- a/fs/ncpfs/ncplib_kernel.h ++++ b/fs/ncpfs/ncplib_kernel.h +@@ -194,7 +194,7 @@ ncp_renew_dentries(struct dentry *parent) + spin_lock(&parent->d_lock); + next = parent->d_subdirs.next; + while (next != &parent->d_subdirs) { +- dentry = list_entry(next, struct dentry, d_u.d_child); ++ dentry = list_entry(next, struct dentry, d_child); + + if (dentry->d_fsdata == NULL) + ncp_age_dentry(server, dentry); +@@ -216,7 +216,7 @@ ncp_invalidate_dircache_entries(struct dentry *parent) + spin_lock(&parent->d_lock); + next = parent->d_subdirs.next; + while (next != &parent->d_subdirs) { +- dentry = list_entry(next, struct dentry, d_u.d_child); ++ dentry = list_entry(next, struct dentry, d_child); + dentry->d_fsdata = NULL; + ncp_age_dentry(server, dentry); + next = next->next; +diff --git a/fs/nfs/getroot.c b/fs/nfs/getroot.c +index 4ca6f5c8038e..b242f69557fd 100644 +--- a/fs/nfs/getroot.c ++++ b/fs/nfs/getroot.c +@@ -62,7 +62,7 @@ static int nfs_superblock_set_dummy_root(struct super_block *sb, struct inode *i + */ + spin_lock(&sb->s_root->d_inode->i_lock); + spin_lock(&sb->s_root->d_lock); +- list_del_init(&sb->s_root->d_alias); ++ list_del_init(&sb->s_root->d_u.d_alias); + spin_unlock(&sb->s_root->d_lock); + spin_unlock(&sb->s_root->d_inode->i_lock); + } +diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c +index c8e9f637153a..ebf3f592ae14 100644 +--- a/fs/nfsd/nfs4callback.c ++++ b/fs/nfsd/nfs4callback.c +@@ -784,8 +784,12 @@ static bool nfsd41_cb_get_slot(struct nfs4_client *clp, struct rpc_task *task) + { + if (test_and_set_bit(0, &clp->cl_cb_slot_busy) != 0) { + rpc_sleep_on(&clp->cl_cb_waitq, task, NULL); +- dprintk("%s slot is busy\n", __func__); +- return false; ++ /* Race breaker */ ++ if (test_and_set_bit(0, &clp->cl_cb_slot_busy) != 0) { ++ dprintk("%s slot is busy\n", __func__); ++ return false; ++ } ++ rpc_wake_up_queued_task(&clp->cl_cb_waitq, task); + } + return true; + } +diff --git a/fs/nilfs2/nilfs.h b/fs/nilfs2/nilfs.h +index 250add84da76..161a10c89cb7 100644 +--- a/fs/nilfs2/nilfs.h ++++ b/fs/nilfs2/nilfs.h +@@ -128,7 +128,6 @@ enum { + * @ti_save: Backup of journal_info field of task_struct + * @ti_flags: Flags + * @ti_count: Nest level +- * @ti_garbage: List of inode to be put when releasing semaphore + */ + struct nilfs_transaction_info { + u32 ti_magic; +@@ -137,7 +136,6 @@ struct nilfs_transaction_info { + one of other filesystems has a bug. */ + unsigned short ti_flags; + unsigned short ti_count; +- struct list_head ti_garbage; + }; + + /* ti_magic */ +diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c +index e0a5a181fa46..7bb866c5e4d5 100644 +--- a/fs/nilfs2/segment.c ++++ b/fs/nilfs2/segment.c +@@ -302,7 +302,6 @@ static void nilfs_transaction_lock(struct super_block *sb, + ti->ti_count = 0; + ti->ti_save = cur_ti; + ti->ti_magic = NILFS_TI_MAGIC; +- INIT_LIST_HEAD(&ti->ti_garbage); + current->journal_info = ti; + + for (;;) { +@@ -329,8 +328,6 @@ static void nilfs_transaction_unlock(struct super_block *sb) + + up_write(&nilfs->ns_segctor_sem); + current->journal_info = ti->ti_save; +- if (!list_empty(&ti->ti_garbage)) +- nilfs_dispose_list(nilfs, &ti->ti_garbage, 0); + } + + static void *nilfs_segctor_map_segsum_entry(struct nilfs_sc_info *sci, +@@ -743,6 +740,15 @@ static void nilfs_dispose_list(struct the_nilfs *nilfs, + } + } + ++static void nilfs_iput_work_func(struct work_struct *work) ++{ ++ struct nilfs_sc_info *sci = container_of(work, struct nilfs_sc_info, ++ sc_iput_work); ++ struct the_nilfs *nilfs = sci->sc_super->s_fs_info; ++ ++ nilfs_dispose_list(nilfs, &sci->sc_iput_queue, 0); ++} ++ + static int nilfs_test_metadata_dirty(struct the_nilfs *nilfs, + struct nilfs_root *root) + { +@@ -1896,8 +1902,9 @@ static int nilfs_segctor_collect_dirty_files(struct nilfs_sc_info *sci, + static void nilfs_segctor_drop_written_files(struct nilfs_sc_info *sci, + struct the_nilfs *nilfs) + { +- struct nilfs_transaction_info *ti = current->journal_info; + struct nilfs_inode_info *ii, *n; ++ int during_mount = !(sci->sc_super->s_flags & MS_ACTIVE); ++ int defer_iput = false; + + spin_lock(&nilfs->ns_inode_lock); + list_for_each_entry_safe(ii, n, &sci->sc_dirty_files, i_dirty) { +@@ -1908,9 +1915,24 @@ static void nilfs_segctor_drop_written_files(struct nilfs_sc_info *sci, + clear_bit(NILFS_I_BUSY, &ii->i_state); + brelse(ii->i_bh); + ii->i_bh = NULL; +- list_move_tail(&ii->i_dirty, &ti->ti_garbage); ++ list_del_init(&ii->i_dirty); ++ if (!ii->vfs_inode.i_nlink || during_mount) { ++ /* ++ * Defer calling iput() to avoid deadlocks if ++ * i_nlink == 0 or mount is not yet finished. ++ */ ++ list_add_tail(&ii->i_dirty, &sci->sc_iput_queue); ++ defer_iput = true; ++ } else { ++ spin_unlock(&nilfs->ns_inode_lock); ++ iput(&ii->vfs_inode); ++ spin_lock(&nilfs->ns_inode_lock); ++ } + } + spin_unlock(&nilfs->ns_inode_lock); ++ ++ if (defer_iput) ++ schedule_work(&sci->sc_iput_work); + } + + /* +@@ -2577,6 +2599,8 @@ static struct nilfs_sc_info *nilfs_segctor_new(struct super_block *sb, + INIT_LIST_HEAD(&sci->sc_segbufs); + INIT_LIST_HEAD(&sci->sc_write_logs); + INIT_LIST_HEAD(&sci->sc_gc_inodes); ++ INIT_LIST_HEAD(&sci->sc_iput_queue); ++ INIT_WORK(&sci->sc_iput_work, nilfs_iput_work_func); + init_timer(&sci->sc_timer); + + sci->sc_interval = HZ * NILFS_SC_DEFAULT_TIMEOUT; +@@ -2603,6 +2627,8 @@ static void nilfs_segctor_write_out(struct nilfs_sc_info *sci) + ret = nilfs_segctor_construct(sci, SC_LSEG_SR); + nilfs_transaction_unlock(sci->sc_super); + ++ flush_work(&sci->sc_iput_work); ++ + } while (ret && retrycount-- > 0); + } + +@@ -2627,6 +2653,9 @@ static void nilfs_segctor_destroy(struct nilfs_sc_info *sci) + || sci->sc_seq_request != sci->sc_seq_done); + spin_unlock(&sci->sc_state_lock); + ++ if (flush_work(&sci->sc_iput_work)) ++ flag = true; ++ + if (flag || !nilfs_segctor_confirm(sci)) + nilfs_segctor_write_out(sci); + +@@ -2636,6 +2665,12 @@ static void nilfs_segctor_destroy(struct nilfs_sc_info *sci) + nilfs_dispose_list(nilfs, &sci->sc_dirty_files, 1); + } + ++ if (!list_empty(&sci->sc_iput_queue)) { ++ nilfs_warning(sci->sc_super, __func__, ++ "iput queue is not empty\n"); ++ nilfs_dispose_list(nilfs, &sci->sc_iput_queue, 1); ++ } ++ + WARN_ON(!list_empty(&sci->sc_segbufs)); + WARN_ON(!list_empty(&sci->sc_write_logs)); + +diff --git a/fs/nilfs2/segment.h b/fs/nilfs2/segment.h +index 38a1d0013314..a48d6de1e02c 100644 +--- a/fs/nilfs2/segment.h ++++ b/fs/nilfs2/segment.h +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + #include + #include "nilfs.h" + +@@ -92,6 +93,8 @@ struct nilfs_segsum_pointer { + * @sc_nblk_inc: Block count of current generation + * @sc_dirty_files: List of files to be written + * @sc_gc_inodes: List of GC inodes having blocks to be written ++ * @sc_iput_queue: list of inodes for which iput should be done ++ * @sc_iput_work: work struct to defer iput call + * @sc_freesegs: array of segment numbers to be freed + * @sc_nfreesegs: number of segments on @sc_freesegs + * @sc_dsync_inode: inode whose data pages are written for a sync operation +@@ -135,6 +138,8 @@ struct nilfs_sc_info { + + struct list_head sc_dirty_files; + struct list_head sc_gc_inodes; ++ struct list_head sc_iput_queue; ++ struct work_struct sc_iput_work; + + __u64 *sc_freesegs; + size_t sc_nfreesegs; +diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c +index ccb14d3fc0de..e5b6db6634d1 100644 +--- a/fs/notify/fsnotify.c ++++ b/fs/notify/fsnotify.c +@@ -63,14 +63,14 @@ void __fsnotify_update_child_dentry_flags(struct inode *inode) + spin_lock(&inode->i_lock); + /* run all of the dentries associated with this inode. Since this is a + * directory, there damn well better only be one item on this list */ +- list_for_each_entry(alias, &inode->i_dentry, d_alias) { ++ list_for_each_entry(alias, &inode->i_dentry, d_u.d_alias) { + struct dentry *child; + + /* run all of the children of the original inode and fix their + * d_flags to indicate parental interest (their parent is the + * original inode) */ + spin_lock(&alias->d_lock); +- list_for_each_entry(child, &alias->d_subdirs, d_u.d_child) { ++ list_for_each_entry(child, &alias->d_subdirs, d_child) { + if (!child->d_inode) + continue; + +diff --git a/fs/notify/inode_mark.c b/fs/notify/inode_mark.c +index b13c00ac48eb..df6daccf49ba 100644 +--- a/fs/notify/inode_mark.c ++++ b/fs/notify/inode_mark.c +@@ -282,20 +282,25 @@ void fsnotify_unmount_inodes(struct list_head *list) + spin_unlock(&inode->i_lock); + + /* In case the dropping of a reference would nuke next_i. */ +- if ((&next_i->i_sb_list != list) && +- atomic_read(&next_i->i_count)) { ++ while (&next_i->i_sb_list != list) { + spin_lock(&next_i->i_lock); +- if (!(next_i->i_state & (I_FREEING | I_WILL_FREE))) { ++ if (!(next_i->i_state & (I_FREEING | I_WILL_FREE)) && ++ atomic_read(&next_i->i_count)) { + __iget(next_i); + need_iput = next_i; ++ spin_unlock(&next_i->i_lock); ++ break; + } + spin_unlock(&next_i->i_lock); ++ next_i = list_entry(next_i->i_sb_list.next, ++ struct inode, i_sb_list); + } + + /* +- * We can safely drop inode_sb_list_lock here because we hold +- * references on both inode and next_i. Also no new inodes +- * will be added since the umount has begun. ++ * We can safely drop inode_sb_list_lock here because either ++ * we actually hold references on both inode and next_i or ++ * end of list. Also no new inodes will be added since the ++ * umount has begun. + */ + spin_unlock(&inode_sb_list_lock); + +diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c +index 340bd02839be..e9829ca38fd7 100644 +--- a/fs/ocfs2/aops.c ++++ b/fs/ocfs2/aops.c +@@ -917,7 +917,7 @@ void ocfs2_unlock_and_free_pages(struct page **pages, int num_pages) + } + } + +-static void ocfs2_free_write_ctxt(struct ocfs2_write_ctxt *wc) ++static void ocfs2_unlock_pages(struct ocfs2_write_ctxt *wc) + { + int i; + +@@ -938,7 +938,11 @@ static void ocfs2_free_write_ctxt(struct ocfs2_write_ctxt *wc) + page_cache_release(wc->w_target_page); + } + ocfs2_unlock_and_free_pages(wc->w_pages, wc->w_num_pages); ++} + ++static void ocfs2_free_write_ctxt(struct ocfs2_write_ctxt *wc) ++{ ++ ocfs2_unlock_pages(wc); + brelse(wc->w_di_bh); + kfree(wc); + } +@@ -2059,11 +2063,19 @@ out_write_size: + di->i_mtime_nsec = di->i_ctime_nsec = cpu_to_le32(inode->i_mtime.tv_nsec); + ocfs2_journal_dirty(handle, wc->w_di_bh); + ++ /* unlock pages before dealloc since it needs acquiring j_trans_barrier ++ * lock, or it will cause a deadlock since journal commit threads holds ++ * this lock and will ask for the page lock when flushing the data. ++ * put it here to preserve the unlock order. ++ */ ++ ocfs2_unlock_pages(wc); ++ + ocfs2_commit_trans(osb, handle); + + ocfs2_run_deallocs(osb, &wc->w_dealloc); + +- ocfs2_free_write_ctxt(wc); ++ brelse(wc->w_di_bh); ++ kfree(wc); + + return copied; + } +diff --git a/fs/ocfs2/dcache.c b/fs/ocfs2/dcache.c +index e5ba34818332..26977cc14ae4 100644 +--- a/fs/ocfs2/dcache.c ++++ b/fs/ocfs2/dcache.c +@@ -175,7 +175,7 @@ struct dentry *ocfs2_find_local_alias(struct inode *inode, + + spin_lock(&inode->i_lock); + list_for_each(p, &inode->i_dentry) { +- dentry = list_entry(p, struct dentry, d_alias); ++ dentry = list_entry(p, struct dentry, d_u.d_alias); + + spin_lock(&dentry->d_lock); + if (ocfs2_match_dentry(dentry, parent_blkno, skip_unhashed)) { +diff --git a/fs/proc/stat.c b/fs/proc/stat.c +index e296572c73ed..f65c5da2ac76 100644 +--- a/fs/proc/stat.c ++++ b/fs/proc/stat.c +@@ -159,7 +159,7 @@ static int show_stat(struct seq_file *p, void *v) + + /* sum again ? it could be updated? */ + for_each_irq_nr(j) +- seq_put_decimal_ull(p, ' ', kstat_irqs(j)); ++ seq_put_decimal_ull(p, ' ', kstat_irqs_usr(j)); + + seq_printf(p, + "\nctxt %llu\n" +diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c +index 8df7fd28cca7..bc179339eb26 100644 +--- a/fs/proc/task_mmu.c ++++ b/fs/proc/task_mmu.c +@@ -985,9 +985,19 @@ out: + return ret; + } + ++static int pagemap_open(struct inode *inode, struct file *file) ++{ ++ /* do not disclose physical addresses to unprivileged ++ userspace (closes a rowhammer attack vector) */ ++ if (!capable(CAP_SYS_ADMIN)) ++ return -EPERM; ++ return 0; ++} ++ + const struct file_operations proc_pagemap_operations = { + .llseek = mem_lseek, /* borrow this */ + .read = pagemap_read, ++ .open = pagemap_open, + }; + #endif /* CONFIG_PROC_PAGE_MONITOR */ + +diff --git a/fs/udf/dir.c b/fs/udf/dir.c +index eb8bfe2b89a5..56341af63acb 100644 +--- a/fs/udf/dir.c ++++ b/fs/udf/dir.c +@@ -163,7 +163,8 @@ static int do_udf_readdir(struct inode *dir, struct file *filp, + struct kernel_lb_addr tloc = lelb_to_cpu(cfi.icb.extLocation); + + iblock = udf_get_lb_pblock(dir->i_sb, &tloc, 0); +- flen = udf_get_filename(dir->i_sb, nameptr, fname, lfi); ++ flen = udf_get_filename(dir->i_sb, nameptr, lfi, fname, ++ UDF_NAME_LEN); + dt_type = DT_UNKNOWN; + } + +diff --git a/fs/udf/inode.c b/fs/udf/inode.c +index aa70035fb402..8053ee75d297 100644 +--- a/fs/udf/inode.c ++++ b/fs/udf/inode.c +@@ -1392,6 +1392,20 @@ static void udf_fill_inode(struct inode *inode, struct buffer_head *bh) + iinfo->i_lenEAttr; + } + ++ /* Sanity checks for files in ICB so that we don't get confused later */ ++ if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) { ++ /* ++ * For file in ICB data is stored in allocation descriptor ++ * so sizes should match ++ */ ++ if (iinfo->i_lenAlloc != inode->i_size) ++ return; ++ /* File in ICB has to fit in there... */ ++ if (inode->i_size > inode->i_sb->s_blocksize - ++ udf_file_entry_alloc_offset(inode)) ++ return; ++ } ++ + switch (fe->icbTag.fileType) { + case ICBTAG_FILE_TYPE_DIRECTORY: + inode->i_op = &udf_dir_inode_operations; +diff --git a/fs/udf/namei.c b/fs/udf/namei.c +index 78bff11169ea..407c1296b7c7 100644 +--- a/fs/udf/namei.c ++++ b/fs/udf/namei.c +@@ -233,7 +233,8 @@ static struct fileIdentDesc *udf_find_entry(struct inode *dir, + if (!lfi) + continue; + +- flen = udf_get_filename(dir->i_sb, nameptr, fname, lfi); ++ flen = udf_get_filename(dir->i_sb, nameptr, lfi, fname, ++ UDF_NAME_LEN); + if (flen && udf_match(flen, fname, child->len, child->name)) + goto out_ok; + } +diff --git a/fs/udf/symlink.c b/fs/udf/symlink.c +index d7c6dbe4194b..0422b7b8369f 100644 +--- a/fs/udf/symlink.c ++++ b/fs/udf/symlink.c +@@ -30,49 +30,73 @@ + #include + #include "udf_i.h" + +-static void udf_pc_to_char(struct super_block *sb, unsigned char *from, +- int fromlen, unsigned char *to) ++static int udf_pc_to_char(struct super_block *sb, unsigned char *from, ++ int fromlen, unsigned char *to, int tolen) + { + struct pathComponent *pc; + int elen = 0; ++ int comp_len; + unsigned char *p = to; + ++ /* Reserve one byte for terminating \0 */ ++ tolen--; + while (elen < fromlen) { + pc = (struct pathComponent *)(from + elen); ++ elen += sizeof(struct pathComponent); + switch (pc->componentType) { + case 1: + /* + * Symlink points to some place which should be agreed + * upon between originator and receiver of the media. Ignore. + */ +- if (pc->lengthComponentIdent > 0) ++ if (pc->lengthComponentIdent > 0) { ++ elen += pc->lengthComponentIdent; + break; ++ } + /* Fall through */ + case 2: ++ if (tolen == 0) ++ return -ENAMETOOLONG; + p = to; + *p++ = '/'; ++ tolen--; + break; + case 3: ++ if (tolen < 3) ++ return -ENAMETOOLONG; + memcpy(p, "../", 3); + p += 3; ++ tolen -= 3; + break; + case 4: ++ if (tolen < 2) ++ return -ENAMETOOLONG; + memcpy(p, "./", 2); + p += 2; ++ tolen -= 2; + /* that would be . - just ignore */ + break; + case 5: +- p += udf_get_filename(sb, pc->componentIdent, p, +- pc->lengthComponentIdent); ++ elen += pc->lengthComponentIdent; ++ if (elen > fromlen) ++ return -EIO; ++ comp_len = udf_get_filename(sb, pc->componentIdent, ++ pc->lengthComponentIdent, ++ p, tolen); ++ p += comp_len; ++ tolen -= comp_len; ++ if (tolen == 0) ++ return -ENAMETOOLONG; + *p++ = '/'; ++ tolen--; + break; + } +- elen += sizeof(struct pathComponent) + pc->lengthComponentIdent; + } + if (p > to + 1) + p[-1] = '\0'; + else + p[0] = '\0'; ++ return 0; + } + + static int udf_symlink_filler(struct file *file, struct page *page) +@@ -80,11 +104,17 @@ static int udf_symlink_filler(struct file *file, struct page *page) + struct inode *inode = page->mapping->host; + struct buffer_head *bh = NULL; + unsigned char *symlink; +- int err = -EIO; ++ int err; + unsigned char *p = kmap(page); + struct udf_inode_info *iinfo; + uint32_t pos; + ++ /* We don't support symlinks longer than one block */ ++ if (inode->i_size > inode->i_sb->s_blocksize) { ++ err = -ENAMETOOLONG; ++ goto out_unmap; ++ } ++ + iinfo = UDF_I(inode); + pos = udf_block_map(inode, 0); + +@@ -94,14 +124,18 @@ static int udf_symlink_filler(struct file *file, struct page *page) + } else { + bh = sb_bread(inode->i_sb, pos); + +- if (!bh) +- goto out; ++ if (!bh) { ++ err = -EIO; ++ goto out_unlock_inode; ++ } + + symlink = bh->b_data; + } + +- udf_pc_to_char(inode->i_sb, symlink, inode->i_size, p); ++ err = udf_pc_to_char(inode->i_sb, symlink, inode->i_size, p, PAGE_SIZE); + brelse(bh); ++ if (err) ++ goto out_unlock_inode; + + up_read(&iinfo->i_data_sem); + SetPageUptodate(page); +@@ -109,9 +143,10 @@ static int udf_symlink_filler(struct file *file, struct page *page) + unlock_page(page); + return 0; + +-out: ++out_unlock_inode: + up_read(&iinfo->i_data_sem); + SetPageError(page); ++out_unmap: + kunmap(page); + unlock_page(page); + return err; +diff --git a/fs/udf/udfdecl.h b/fs/udf/udfdecl.h +index ebe10314e512..375f64884c7b 100644 +--- a/fs/udf/udfdecl.h ++++ b/fs/udf/udfdecl.h +@@ -207,7 +207,8 @@ udf_get_lb_pblock(struct super_block *sb, struct kernel_lb_addr *loc, + } + + /* unicode.c */ +-extern int udf_get_filename(struct super_block *, uint8_t *, uint8_t *, int); ++extern int udf_get_filename(struct super_block *, uint8_t *, int, uint8_t *, ++ int); + extern int udf_put_filename(struct super_block *, const uint8_t *, uint8_t *, + int); + extern int udf_build_ustr(struct ustr *, dstring *, int); +diff --git a/fs/udf/unicode.c b/fs/udf/unicode.c +index 44b815e57f94..d29c06fbf4ce 100644 +--- a/fs/udf/unicode.c ++++ b/fs/udf/unicode.c +@@ -28,7 +28,8 @@ + + #include "udf_sb.h" + +-static int udf_translate_to_linux(uint8_t *, uint8_t *, int, uint8_t *, int); ++static int udf_translate_to_linux(uint8_t *, int, uint8_t *, int, uint8_t *, ++ int); + + static int udf_char_to_ustr(struct ustr *dest, const uint8_t *src, int strlen) + { +@@ -333,8 +334,8 @@ try_again: + return u_len + 1; + } + +-int udf_get_filename(struct super_block *sb, uint8_t *sname, uint8_t *dname, +- int flen) ++int udf_get_filename(struct super_block *sb, uint8_t *sname, int slen, ++ uint8_t *dname, int dlen) + { + struct ustr *filename, *unifilename; + int len = 0; +@@ -347,7 +348,7 @@ int udf_get_filename(struct super_block *sb, uint8_t *sname, uint8_t *dname, + if (!unifilename) + goto out1; + +- if (udf_build_ustr_exact(unifilename, sname, flen)) ++ if (udf_build_ustr_exact(unifilename, sname, slen)) + goto out2; + + if (UDF_QUERY_FLAG(sb, UDF_FLAG_UTF8)) { +@@ -366,7 +367,8 @@ int udf_get_filename(struct super_block *sb, uint8_t *sname, uint8_t *dname, + } else + goto out2; + +- len = udf_translate_to_linux(dname, filename->u_name, filename->u_len, ++ len = udf_translate_to_linux(dname, dlen, ++ filename->u_name, filename->u_len, + unifilename->u_name, unifilename->u_len); + out2: + kfree(unifilename); +@@ -403,10 +405,12 @@ int udf_put_filename(struct super_block *sb, const uint8_t *sname, + #define EXT_MARK '.' + #define CRC_MARK '#' + #define EXT_SIZE 5 ++/* Number of chars we need to store generated CRC to make filename unique */ ++#define CRC_LEN 5 + +-static int udf_translate_to_linux(uint8_t *newName, uint8_t *udfName, +- int udfLen, uint8_t *fidName, +- int fidNameLen) ++static int udf_translate_to_linux(uint8_t *newName, int newLen, ++ uint8_t *udfName, int udfLen, ++ uint8_t *fidName, int fidNameLen) + { + int index, newIndex = 0, needsCRC = 0; + int extIndex = 0, newExtIndex = 0, hasExt = 0; +@@ -440,7 +444,7 @@ static int udf_translate_to_linux(uint8_t *newName, uint8_t *udfName, + newExtIndex = newIndex; + } + } +- if (newIndex < 256) ++ if (newIndex < newLen) + newName[newIndex++] = curr; + else + needsCRC = 1; +@@ -468,13 +472,13 @@ static int udf_translate_to_linux(uint8_t *newName, uint8_t *udfName, + } + ext[localExtIndex++] = curr; + } +- maxFilenameLen = 250 - localExtIndex; ++ maxFilenameLen = newLen - CRC_LEN - localExtIndex; + if (newIndex > maxFilenameLen) + newIndex = maxFilenameLen; + else + newIndex = newExtIndex; +- } else if (newIndex > 250) +- newIndex = 250; ++ } else if (newIndex > newLen - CRC_LEN) ++ newIndex = newLen - CRC_LEN; + newName[newIndex++] = CRC_MARK; + valueCRC = crc_itu_t(0, fidName, fidNameLen); + newName[newIndex++] = hexChar[(valueCRC & 0xf000) >> 12]; +diff --git a/include/linux/dcache.h b/include/linux/dcache.h +index 1332df02d8f2..31e55bf1df6d 100644 +--- a/include/linux/dcache.h ++++ b/include/linux/dcache.h +@@ -105,15 +105,15 @@ struct dentry { + void *d_fsdata; /* fs-specific data */ + + struct list_head d_lru; /* LRU list */ ++ struct list_head d_child; /* child of parent list */ ++ struct list_head d_subdirs; /* our children */ + /* +- * d_child and d_rcu can share memory ++ * d_alias and d_rcu can share memory + */ + union { +- struct list_head d_child; /* child of parent list */ ++ struct list_head d_alias; /* inode alias list */ + struct rcu_head d_rcu; + } d_u; +- struct list_head d_subdirs; /* our children */ +- struct list_head d_alias; /* inode alias list */ + }; + + /* +diff --git a/include/linux/device.h b/include/linux/device.h +index 5ad17cccdd71..e93fed98878a 100644 +--- a/include/linux/device.h ++++ b/include/linux/device.h +@@ -835,6 +835,11 @@ extern __printf(5, 6) + struct device *device_create(struct class *cls, struct device *parent, + dev_t devt, void *drvdata, + const char *fmt, ...); ++extern __printf(6, 7) ++struct device *device_create_with_groups(struct class *cls, ++ struct device *parent, dev_t devt, void *drvdata, ++ const struct attribute_group **groups, ++ const char *fmt, ...); + extern void device_destroy(struct class *cls, dev_t devt); + + /* +diff --git a/include/linux/kernel_stat.h b/include/linux/kernel_stat.h +index 2fbd9053c2df..8e62498eeab3 100644 +--- a/include/linux/kernel_stat.h ++++ b/include/linux/kernel_stat.h +@@ -104,8 +104,13 @@ static inline unsigned int kstat_irqs(unsigned int irq) + + return sum; + } ++static inline unsigned int kstat_irqs_usr(unsigned int irq) ++{ ++ return kstat_irqs(irq); ++} + #else + extern unsigned int kstat_irqs(unsigned int irq); ++extern unsigned int kstat_irqs_usr(unsigned int irq); + #endif + + /* +diff --git a/include/linux/libata.h b/include/linux/libata.h +index dd16deb27dd8..764cd54dfea7 100644 +--- a/include/linux/libata.h ++++ b/include/linux/libata.h +@@ -207,6 +207,7 @@ enum { + ATA_FLAG_SW_ACTIVITY = (1 << 22), /* driver supports sw activity + * led */ + ATA_FLAG_NO_DIPM = (1 << 23), /* host not happy with DIPM */ ++ ATA_FLAG_LOWTAG = (1 << 24), /* host wants lowest available tag */ + + /* bits 24:31 of ap->flags are reserved for LLD specific flags */ + +diff --git a/include/linux/mm.h b/include/linux/mm.h +index 656b4e968991..ceebf63ef5da 100644 +--- a/include/linux/mm.h ++++ b/include/linux/mm.h +@@ -841,6 +841,7 @@ static inline int page_mapped(struct page *page) + #define VM_FAULT_WRITE 0x0008 /* Special case for get_user_pages */ + #define VM_FAULT_HWPOISON 0x0010 /* Hit poisoned small page */ + #define VM_FAULT_HWPOISON_LARGE 0x0020 /* Hit poisoned large page. Index encoded in upper bits */ ++#define VM_FAULT_SIGSEGV 0x0040 + + #define VM_FAULT_NOPAGE 0x0100 /* ->fault installed the pte, not return page */ + #define VM_FAULT_LOCKED 0x0200 /* ->fault locked the returned page */ +@@ -848,8 +849,8 @@ static inline int page_mapped(struct page *page) + + #define VM_FAULT_HWPOISON_LARGE_MASK 0xf000 /* encodes hpage index for large hwpoison */ + +-#define VM_FAULT_ERROR (VM_FAULT_OOM | VM_FAULT_SIGBUS | VM_FAULT_HWPOISON | \ +- VM_FAULT_HWPOISON_LARGE) ++#define VM_FAULT_ERROR (VM_FAULT_OOM | VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV | \ ++ VM_FAULT_HWPOISON | VM_FAULT_HWPOISON_LARGE) + + /* Encode hstate index for a hwpoisoned large page */ + #define VM_FAULT_SET_HINDEX(x) ((x) << 12) +@@ -1456,7 +1457,7 @@ extern int expand_downwards(struct vm_area_struct *vma, + #if VM_GROWSUP + extern int expand_upwards(struct vm_area_struct *vma, unsigned long address); + #else +- #define expand_upwards(vma, address) do { } while (0) ++ #define expand_upwards(vma, address) (0) + #endif + + /* Look up the first VMA which satisfies addr < vm_end, NULL if none. */ +diff --git a/include/linux/rmap.h b/include/linux/rmap.h +index fd07c4542cee..5a6cbf785265 100644 +--- a/include/linux/rmap.h ++++ b/include/linux/rmap.h +@@ -37,6 +37,16 @@ struct anon_vma { + atomic_t refcount; + + /* ++ * Count of child anon_vmas and VMAs which points to this anon_vma. ++ * ++ * This counter is used for making decision about reusing anon_vma ++ * instead of forking new one. See comments in function anon_vma_clone. ++ */ ++ unsigned degree; ++ ++ struct anon_vma *parent; /* Parent of this anon_vma */ ++ ++ /* + * NOTE: the LSB of the head.next is set by + * mm_take_all_locks() _after_ taking the above lock. So the + * head must only be read/written after taking the above lock +diff --git a/include/linux/sysfs.h b/include/linux/sysfs.h +index 0010009b2f00..caf2e56bdf21 100644 +--- a/include/linux/sysfs.h ++++ b/include/linux/sysfs.h +@@ -80,6 +80,15 @@ struct attribute_group { + + #define __ATTR_NULL { .attr = { .name = NULL } } + ++#define ATTRIBUTE_GROUPS(name) \ ++static const struct attribute_group name##_group = { \ ++ .attrs = name##_attrs, \ ++}; \ ++static const struct attribute_group *name##_groups[] = { \ ++ &name##_group, \ ++ NULL, \ ++} ++ + #define attr_name(_attr) (_attr).attr.name + + struct file; +diff --git a/include/linux/time.h b/include/linux/time.h +index 03dce74e217c..bf1bb618b352 100644 +--- a/include/linux/time.h ++++ b/include/linux/time.h +@@ -189,6 +189,19 @@ extern void getboottime(struct timespec *ts); + extern void monotonic_to_bootbased(struct timespec *ts); + extern void get_monotonic_boottime(struct timespec *ts); + ++static inline bool timeval_valid(const struct timeval *tv) ++{ ++ /* Dates before 1970 are bogus */ ++ if (tv->tv_sec < 0) ++ return false; ++ ++ /* Can't have more microseconds then a second */ ++ if (tv->tv_usec < 0 || tv->tv_usec >= USEC_PER_SEC) ++ return false; ++ ++ return true; ++} ++ + extern struct timespec timespec_trunc(struct timespec t, unsigned gran); + extern int timekeeping_valid_for_hres(void); + extern u64 timekeeping_max_deferment(void); +diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h +index d0d2af09dcc6..0972470bb072 100644 +--- a/include/linux/usb/quirks.h ++++ b/include/linux/usb/quirks.h +@@ -36,4 +36,15 @@ + /* device can't handle device_qualifier descriptor requests */ + #define USB_QUIRK_DEVICE_QUALIFIER 0x00000100 + ++/* ++ * For high speed and super speed interupt endpoints, the USB 2.0 and ++ * USB 3.0 spec require the interval in microframes ++ * (1 microframe = 125 microseconds) to be calculated as ++ * interval = 2 ^ (bInterval-1). ++ * ++ * Devices with this quirk report their bInterval as the result of this ++ * calculation instead of the exponent variable used in the calculation. ++ */ ++#define USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL 0x00000080 ++ + #endif /* __LINUX_USB_QUIRKS_H */ +diff --git a/include/linux/usb_usual.h b/include/linux/usb_usual.h +index 17df3600bcef..f2000e9804ea 100644 +--- a/include/linux/usb_usual.h ++++ b/include/linux/usb_usual.h +@@ -64,7 +64,9 @@ + US_FLAG(NO_READ_CAPACITY_16, 0x00080000) \ + /* cannot handle READ_CAPACITY_16 */ \ + US_FLAG(INITIAL_READ10, 0x00100000) \ +- /* Initial READ(10) (and others) must be retried */ ++ /* Initial READ(10) (and others) must be retried */ \ ++ US_FLAG(BROKEN_FUA, 0x01000000) \ ++ /* Cannot handle FUA in WRITE or READ CDBs */ \ + + #define US_FLAG(name, value) US_FL_##name = value , + enum { US_DO_ALL_FLAGS }; +diff --git a/include/linux/virtio.h b/include/linux/virtio.h +index 2b779bf80cc0..f73e2c76bd8a 100644 +--- a/include/linux/virtio.h ++++ b/include/linux/virtio.h +@@ -75,7 +75,11 @@ struct virtio_device { + void *priv; + }; + +-#define dev_to_virtio(dev) container_of(dev, struct virtio_device, dev) ++static inline struct virtio_device *dev_to_virtio(struct device *_dev) ++{ ++ return container_of(_dev, struct virtio_device, dev); ++} ++ + int register_virtio_device(struct virtio_device *dev); + void unregister_virtio_device(struct virtio_device *dev); + +diff --git a/include/linux/writeback.h b/include/linux/writeback.h +index a2b84f598e2b..dd8d4918de2e 100644 +--- a/include/linux/writeback.h ++++ b/include/linux/writeback.h +@@ -186,7 +186,6 @@ int write_cache_pages(struct address_space *mapping, + struct writeback_control *wbc, writepage_t writepage, + void *data); + int do_writepages(struct address_space *mapping, struct writeback_control *wbc); +-void set_page_dirty_balance(struct page *page, int page_mkwrite); + void writeback_set_ratelimit(void); + void tag_pages_for_writeback(struct address_space *mapping, + pgoff_t start, pgoff_t end); +diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h +index a2ef81466b00..43c8bbcdb512 100644 +--- a/include/net/sctp/sctp.h ++++ b/include/net/sctp/sctp.h +@@ -524,6 +524,11 @@ static inline void sctp_assoc_pending_pmtu(struct sctp_association *asoc) + asoc->pmtu_pending = 0; + } + ++static inline bool sctp_chunk_pending(const struct sctp_chunk *chunk) ++{ ++ return !list_empty(&chunk->list); ++} ++ + /* Walk through a list of TLV parameters. Don't trust the + * individual parameter lengths and instead depend on + * the chunk length to indicate when to stop. Make sure +diff --git a/include/net/sctp/sm.h b/include/net/sctp/sm.h +index 9148632b8204..4d1be75e3857 100644 +--- a/include/net/sctp/sm.h ++++ b/include/net/sctp/sm.h +@@ -251,9 +251,9 @@ struct sctp_chunk *sctp_make_asconf_update_ip(struct sctp_association *, + int, __be16); + struct sctp_chunk *sctp_make_asconf_set_prim(struct sctp_association *asoc, + union sctp_addr *addr); +-int sctp_verify_asconf(const struct sctp_association *asoc, +- struct sctp_paramhdr *param_hdr, void *chunk_end, +- struct sctp_paramhdr **errp); ++bool sctp_verify_asconf(const struct sctp_association *asoc, ++ struct sctp_chunk *chunk, bool addr_param_needed, ++ struct sctp_paramhdr **errp); + struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc, + struct sctp_chunk *asconf); + int sctp_process_asconf_ack(struct sctp_association *asoc, +diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h +index ba9698852321..d2f5f44d50f8 100644 +--- a/include/scsi/scsi_device.h ++++ b/include/scsi/scsi_device.h +@@ -153,6 +153,7 @@ struct scsi_device { + unsigned no_read_capacity_16:1; /* Avoid READ_CAPACITY_16 cmds */ + unsigned try_rc_10_first:1; /* Try READ_CAPACACITY_10 first */ + unsigned is_visible:1; /* is the device visible in sysfs */ ++ unsigned broken_fua:1; /* Don't set FUA bit */ + + DECLARE_BITMAP(supported_events, SDEV_EVT_MAXBITS); /* supported events */ + struct list_head event_list; /* asserted events */ +diff --git a/include/sound/ak4113.h b/include/sound/ak4113.h +index 2609048c1d44..3a34f6edc2d1 100644 +--- a/include/sound/ak4113.h ++++ b/include/sound/ak4113.h +@@ -286,7 +286,7 @@ struct ak4113 { + ak4113_write_t *write; + ak4113_read_t *read; + void *private_data; +- unsigned int init:1; ++ atomic_t wq_processing; + spinlock_t lock; + unsigned char regmap[AK4113_WRITABLE_REGS]; + struct snd_kcontrol *kctls[AK4113_CONTROLS]; +diff --git a/include/sound/ak4114.h b/include/sound/ak4114.h +index 3ce69fd92523..69441161009c 100644 +--- a/include/sound/ak4114.h ++++ b/include/sound/ak4114.h +@@ -168,7 +168,7 @@ struct ak4114 { + ak4114_write_t * write; + ak4114_read_t * read; + void * private_data; +- unsigned int init: 1; ++ atomic_t wq_processing; + spinlock_t lock; + unsigned char regmap[7]; + unsigned char txcsb[5]; +diff --git a/kernel/cgroup.c b/kernel/cgroup.c +index c776f8941175..34eda955e887 100644 +--- a/kernel/cgroup.c ++++ b/kernel/cgroup.c +@@ -898,7 +898,7 @@ static void cgroup_clear_directory(struct dentry *dentry) + spin_lock(&dentry->d_lock); + node = dentry->d_subdirs.next; + while (node != &dentry->d_subdirs) { +- struct dentry *d = list_entry(node, struct dentry, d_u.d_child); ++ struct dentry *d = list_entry(node, struct dentry, d_child); + + spin_lock_nested(&d->d_lock, DENTRY_D_LOCK_NESTED); + list_del_init(node); +@@ -932,7 +932,7 @@ static void cgroup_d_remove_dir(struct dentry *dentry) + parent = dentry->d_parent; + spin_lock(&parent->d_lock); + spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED); +- list_del_init(&dentry->d_u.d_child); ++ list_del_init(&dentry->d_child); + spin_unlock(&dentry->d_lock); + spin_unlock(&parent->d_lock); + remove_dir(dentry); +diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h +index 8e5c56b3b7d9..5a414405deef 100644 +--- a/kernel/irq/internals.h ++++ b/kernel/irq/internals.h +@@ -74,6 +74,14 @@ extern void irq_percpu_disable(struct irq_desc *desc, unsigned int cpu); + extern void mask_irq(struct irq_desc *desc); + extern void unmask_irq(struct irq_desc *desc); + ++#ifdef CONFIG_SPARSE_IRQ ++extern void irq_lock_sparse(void); ++extern void irq_unlock_sparse(void); ++#else ++static inline void irq_lock_sparse(void) { } ++static inline void irq_unlock_sparse(void) { } ++#endif ++ + extern void init_kstat_irqs(struct irq_desc *desc, int node, int nr); + + irqreturn_t handle_irq_event_percpu(struct irq_desc *desc, struct irqaction *action); +diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c +index 8ab8e9390297..07d45516b540 100644 +--- a/kernel/irq/irqdesc.c ++++ b/kernel/irq/irqdesc.c +@@ -131,6 +131,16 @@ static void free_masks(struct irq_desc *desc) + static inline void free_masks(struct irq_desc *desc) { } + #endif + ++void irq_lock_sparse(void) ++{ ++ mutex_lock(&sparse_irq_lock); ++} ++ ++void irq_unlock_sparse(void) ++{ ++ mutex_unlock(&sparse_irq_lock); ++} ++ + static struct irq_desc *alloc_desc(int irq, int node, struct module *owner) + { + struct irq_desc *desc; +@@ -167,6 +177,12 @@ static void free_desc(unsigned int irq) + + unregister_irq_proc(irq, desc); + ++ /* ++ * sparse_irq_lock protects also show_interrupts() and ++ * kstat_irq_usr(). Once we deleted the descriptor from the ++ * sparse tree we can free it. Access in proc will fail to ++ * lookup the descriptor. ++ */ + mutex_lock(&sparse_irq_lock); + delete_irq_desc(irq); + mutex_unlock(&sparse_irq_lock); +@@ -489,6 +505,15 @@ void dynamic_irq_cleanup(unsigned int irq) + raw_spin_unlock_irqrestore(&desc->lock, flags); + } + ++/** ++ * kstat_irqs_cpu - Get the statistics for an interrupt on a cpu ++ * @irq: The interrupt number ++ * @cpu: The cpu number ++ * ++ * Returns the sum of interrupt counts on @cpu since boot for ++ * @irq. The caller must ensure that the interrupt is not removed ++ * concurrently. ++ */ + unsigned int kstat_irqs_cpu(unsigned int irq, int cpu) + { + struct irq_desc *desc = irq_to_desc(irq); +@@ -497,6 +522,14 @@ unsigned int kstat_irqs_cpu(unsigned int irq, int cpu) + *per_cpu_ptr(desc->kstat_irqs, cpu) : 0; + } + ++/** ++ * kstat_irqs - Get the statistics for an interrupt ++ * @irq: The interrupt number ++ * ++ * Returns the sum of interrupt counts on all cpus since boot for ++ * @irq. The caller must ensure that the interrupt is not removed ++ * concurrently. ++ */ + unsigned int kstat_irqs(unsigned int irq) + { + struct irq_desc *desc = irq_to_desc(irq); +@@ -509,3 +542,22 @@ unsigned int kstat_irqs(unsigned int irq) + sum += *per_cpu_ptr(desc->kstat_irqs, cpu); + return sum; + } ++ ++/** ++ * kstat_irqs_usr - Get the statistics for an interrupt ++ * @irq: The interrupt number ++ * ++ * Returns the sum of interrupt counts on all cpus since boot for ++ * @irq. Contrary to kstat_irqs() this can be called from any ++ * preemptible context. It's protected against concurrent removal of ++ * an interrupt descriptor when sparse irqs are enabled. ++ */ ++unsigned int kstat_irqs_usr(unsigned int irq) ++{ ++ int sum; ++ ++ irq_lock_sparse(); ++ sum = kstat_irqs(irq); ++ irq_unlock_sparse(); ++ return sum; ++} +diff --git a/kernel/irq/proc.c b/kernel/irq/proc.c +index 4bd4faa6323a..fb655f5f9689 100644 +--- a/kernel/irq/proc.c ++++ b/kernel/irq/proc.c +@@ -15,6 +15,23 @@ + + #include "internals.h" + ++/* ++ * Access rules: ++ * ++ * procfs protects read/write of /proc/irq/N/ files against a ++ * concurrent free of the interrupt descriptor. remove_proc_entry() ++ * immediately prevents new read/writes to happen and waits for ++ * already running read/write functions to complete. ++ * ++ * We remove the proc entries first and then delete the interrupt ++ * descriptor from the radix tree and free it. So it is guaranteed ++ * that irq_to_desc(N) is valid as long as the read/writes are ++ * permitted by procfs. ++ * ++ * The read from /proc/interrupts is a different problem because there ++ * is no protection. So the lookup and the access to irqdesc ++ * information must be protected by sparse_irq_lock. ++ */ + static struct proc_dir_entry *root_irq_dir; + + #ifdef CONFIG_SMP +@@ -441,9 +458,10 @@ int show_interrupts(struct seq_file *p, void *v) + seq_putc(p, '\n'); + } + ++ irq_lock_sparse(); + desc = irq_to_desc(i); + if (!desc) +- return 0; ++ goto outsparse; + + raw_spin_lock_irqsave(&desc->lock, flags); + for_each_online_cpu(j) +@@ -481,6 +499,8 @@ int show_interrupts(struct seq_file *p, void *v) + seq_putc(p, '\n'); + out: + raw_spin_unlock_irqrestore(&desc->lock, flags); ++outsparse: ++ irq_unlock_sparse(); + return 0; + } + #endif +diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c +index 526c77d1b655..71429db2af2f 100644 +--- a/kernel/sched/rt.c ++++ b/kernel/sched/rt.c +@@ -1293,7 +1293,12 @@ select_task_rq_rt(struct task_struct *p, int sd_flag, int flags) + (p->rt.nr_cpus_allowed > 1)) { + int target = find_lowest_rq(p); + +- if (target != -1) ++ /* ++ * Don't bother moving it if the destination CPU is ++ * not running a lower priority task. ++ */ ++ if (target != -1 && ++ p->prio < cpu_rq(target)->rt.highest_prio.curr) + cpu = target; + } + rcu_read_unlock(); +@@ -1570,6 +1575,16 @@ static struct rq *find_lock_lowest_rq(struct task_struct *task, struct rq *rq) + + lowest_rq = cpu_rq(cpu); + ++ if (lowest_rq->rt.highest_prio.curr <= task->prio) { ++ /* ++ * Target rq has tasks of equal or higher priority, ++ * retrying does not release any lock and is unlikely ++ * to yield a different result. ++ */ ++ lowest_rq = NULL; ++ break; ++ } ++ + /* if the prio of this runqueue changed, try again */ + if (double_lock_balance(rq, lowest_rq)) { + /* +diff --git a/kernel/time.c b/kernel/time.c +index a09529030093..0864d70da80d 100644 +--- a/kernel/time.c ++++ b/kernel/time.c +@@ -186,6 +186,10 @@ SYSCALL_DEFINE2(settimeofday, struct timeval __user *, tv, + if (tv) { + if (copy_from_user(&user_tv, tv, sizeof(*tv))) + return -EFAULT; ++ ++ if (!timeval_valid(&user_tv)) ++ return -EINVAL; ++ + new_ts.tv_sec = user_tv.tv_sec; + new_ts.tv_nsec = user_tv.tv_usec * NSEC_PER_USEC; + } +diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c +index 8b707100286b..e32587e7a6ca 100644 +--- a/kernel/time/ntp.c ++++ b/kernel/time/ntp.c +@@ -660,6 +660,17 @@ int do_adjtimex(struct timex *txc) + return result; + } + ++ /* ++ * Check for potential multiplication overflows that can ++ * only happen on 64-bit systems: ++ */ ++ if ((txc->modes & ADJ_FREQUENCY) && (BITS_PER_LONG == 64)) { ++ if (LLONG_MIN / PPM_SCALE > txc->freq) ++ return -EINVAL; ++ if (LLONG_MAX / PPM_SCALE < txc->freq) ++ return -EINVAL; ++ } ++ + getnstimeofday(&ts); + + spin_lock_irq(&ntp_lock); +diff --git a/lib/checksum.c b/lib/checksum.c +index 12dceb27ff20..33f29f0197b7 100644 +--- a/lib/checksum.c ++++ b/lib/checksum.c +@@ -179,6 +179,15 @@ csum_partial_copy(const void *src, void *dst, int len, __wsum sum) + EXPORT_SYMBOL(csum_partial_copy); + + #ifndef csum_tcpudp_nofold ++static inline u32 from64to32(u64 x) ++{ ++ /* add up 32-bit and 32-bit for 32+c bit */ ++ x = (x & 0xffffffff) + (x >> 32); ++ /* add up carry.. */ ++ x = (x & 0xffffffff) + (x >> 32); ++ return (u32)x; ++} ++ + __wsum csum_tcpudp_nofold(__be32 saddr, __be32 daddr, + unsigned short len, + unsigned short proto, +@@ -193,8 +202,7 @@ __wsum csum_tcpudp_nofold(__be32 saddr, __be32 daddr, + #else + s += (proto + len) << 8; + #endif +- s += (s >> 32); +- return (__force __wsum)s; ++ return (__force __wsum)from64to32(s); + } + EXPORT_SYMBOL(csum_tcpudp_nofold); + #endif +diff --git a/mm/ksm.c b/mm/ksm.c +index 47c885368890..77c71185fb79 100644 +--- a/mm/ksm.c ++++ b/mm/ksm.c +@@ -342,7 +342,7 @@ static int break_ksm(struct vm_area_struct *vma, unsigned long addr) + else + ret = VM_FAULT_WRITE; + put_page(page); +- } while (!(ret & (VM_FAULT_WRITE | VM_FAULT_SIGBUS | VM_FAULT_OOM))); ++ } while (!(ret & (VM_FAULT_WRITE | VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV | VM_FAULT_OOM))); + /* + * We must loop because handle_mm_fault() may back out if there's + * any difficulty e.g. if pte accessed bit gets updated concurrently. +diff --git a/mm/memory.c b/mm/memory.c +index c34e60a950aa..45cd14f0c7bf 100644 +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -847,20 +847,20 @@ copy_one_pte(struct mm_struct *dst_mm, struct mm_struct *src_mm, + if (!pte_file(pte)) { + swp_entry_t entry = pte_to_swp_entry(pte); + +- if (swap_duplicate(entry) < 0) +- return entry.val; +- +- /* make sure dst_mm is on swapoff's mmlist. */ +- if (unlikely(list_empty(&dst_mm->mmlist))) { +- spin_lock(&mmlist_lock); +- if (list_empty(&dst_mm->mmlist)) +- list_add(&dst_mm->mmlist, +- &src_mm->mmlist); +- spin_unlock(&mmlist_lock); +- } +- if (likely(!non_swap_entry(entry))) ++ if (likely(!non_swap_entry(entry))) { ++ if (swap_duplicate(entry) < 0) ++ return entry.val; ++ ++ /* make sure dst_mm is on swapoff's mmlist. */ ++ if (unlikely(list_empty(&dst_mm->mmlist))) { ++ spin_lock(&mmlist_lock); ++ if (list_empty(&dst_mm->mmlist)) ++ list_add(&dst_mm->mmlist, ++ &src_mm->mmlist); ++ spin_unlock(&mmlist_lock); ++ } + rss[MM_SWAPENTS]++; +- else if (is_migration_entry(entry)) { ++ } else if (is_migration_entry(entry)) { + page = migration_entry_to_page(entry); + + if (PageAnon(page)) +@@ -1787,7 +1787,7 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm, + else + return -EFAULT; + } +- if (ret & VM_FAULT_SIGBUS) ++ if (ret & (VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV)) + return i ? i : -EFAULT; + BUG(); + } +@@ -1891,7 +1891,7 @@ int fixup_user_fault(struct task_struct *tsk, struct mm_struct *mm, + return -ENOMEM; + if (ret & (VM_FAULT_HWPOISON | VM_FAULT_HWPOISON_LARGE)) + return -EHWPOISON; +- if (ret & VM_FAULT_SIGBUS) ++ if (ret & (VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV)) + return -EFAULT; + BUG(); + } +@@ -2681,18 +2681,25 @@ reuse: + if (!dirty_page) + return ret; + +- /* +- * Yes, Virginia, this is actually required to prevent a race +- * with clear_page_dirty_for_io() from clearing the page dirty +- * bit after it clear all dirty ptes, but before a racing +- * do_wp_page installs a dirty pte. +- * +- * __do_fault is protected similarly. +- */ + if (!page_mkwrite) { +- wait_on_page_locked(dirty_page); +- set_page_dirty_balance(dirty_page, page_mkwrite); ++ struct address_space *mapping; ++ int dirtied; ++ ++ lock_page(dirty_page); ++ dirtied = set_page_dirty(dirty_page); ++ VM_BUG_ON(dirty_page); ++ mapping = dirty_page->mapping; ++ unlock_page(dirty_page); ++ ++ if (dirtied && mapping) { ++ /* ++ * Some device drivers do not set page.mapping ++ * but still dirty their pages ++ */ ++ balance_dirty_pages_ratelimited(mapping); ++ } + } ++ + put_page(dirty_page); + if (page_mkwrite) { + struct address_space *mapping = dirty_page->mapping; +@@ -3137,7 +3144,7 @@ static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned lo + if (prev && prev->vm_end == address) + return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM; + +- expand_downwards(vma, address - PAGE_SIZE); ++ return expand_downwards(vma, address - PAGE_SIZE); + } + if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) { + struct vm_area_struct *next = vma->vm_next; +@@ -3146,7 +3153,7 @@ static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned lo + if (next && next->vm_start == address + PAGE_SIZE) + return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM; + +- expand_upwards(vma, address + PAGE_SIZE); ++ return expand_upwards(vma, address + PAGE_SIZE); + } + return 0; + } +@@ -3168,7 +3175,7 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma, + + /* Check if we need to add a guard page to the stack */ + if (check_stack_guard_page(vma, address) < 0) +- return VM_FAULT_SIGBUS; ++ return VM_FAULT_SIGSEGV; + + /* Use the zero-page for reads */ + if (!(flags & FAULT_FLAG_WRITE)) { +diff --git a/mm/mmap.c b/mm/mmap.c +index 94fdbe8f3b99..208e70f1006d 100644 +--- a/mm/mmap.c ++++ b/mm/mmap.c +@@ -567,9 +567,12 @@ again: remove_next = 1 + (end > next->vm_end); + * shrinking vma had, to cover any anon pages imported. + */ + if (exporter && exporter->anon_vma && !importer->anon_vma) { +- if (anon_vma_clone(importer, exporter)) +- return -ENOMEM; ++ int error; ++ + importer->anon_vma = exporter->anon_vma; ++ error = anon_vma_clone(importer, exporter); ++ if (error) ++ return error; + } + } + +@@ -1727,14 +1730,17 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns + { + struct mm_struct *mm = vma->vm_mm; + struct rlimit *rlim = current->signal->rlim; +- unsigned long new_start; ++ unsigned long new_start, actual_size; + + /* address space limit tests */ + if (!may_expand_vm(mm, grow)) + return -ENOMEM; + + /* Stack limit test */ +- if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur)) ++ actual_size = size; ++ if (size && (vma->vm_flags & (VM_GROWSUP | VM_GROWSDOWN))) ++ actual_size -= PAGE_SIZE; ++ if (actual_size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur)) + return -ENOMEM; + + /* mlock limit tests */ +diff --git a/mm/page-writeback.c b/mm/page-writeback.c +index 2a13b7997ac6..057884c2b4d9 100644 +--- a/mm/page-writeback.c ++++ b/mm/page-writeback.c +@@ -1394,16 +1394,6 @@ pause: + bdi_start_background_writeback(bdi); + } + +-void set_page_dirty_balance(struct page *page, int page_mkwrite) +-{ +- if (set_page_dirty(page) || page_mkwrite) { +- struct address_space *mapping = page_mapping(page); +- +- if (mapping) +- balance_dirty_pages_ratelimited(mapping); +- } +-} +- + static DEFINE_PER_CPU(int, bdp_ratelimits); + + /* +@@ -1981,32 +1971,25 @@ EXPORT_SYMBOL(account_page_writeback); + * page dirty in that case, but not all the buffers. This is a "bottom-up" + * dirtying, whereas __set_page_dirty_buffers() is a "top-down" dirtying. + * +- * Most callers have locked the page, which pins the address_space in memory. +- * But zap_pte_range() does not lock the page, however in that case the +- * mapping is pinned by the vma's ->vm_file reference. +- * +- * We take care to handle the case where the page was truncated from the +- * mapping by re-checking page_mapping() inside tree_lock. ++ * The caller must ensure this doesn't race with truncation. Most will simply ++ * hold the page lock, but e.g. zap_pte_range() calls with the page mapped and ++ * the pte lock held, which also locks out truncat + */ + int __set_page_dirty_nobuffers(struct page *page) + { + if (!TestSetPageDirty(page)) { + struct address_space *mapping = page_mapping(page); +- struct address_space *mapping2; + unsigned long flags; + + if (!mapping) + return 1; + + spin_lock_irqsave(&mapping->tree_lock, flags); +- mapping2 = page_mapping(page); +- if (mapping2) { /* Race with truncate? */ +- BUG_ON(mapping2 != mapping); +- WARN_ON_ONCE(!PagePrivate(page) && !PageUptodate(page)); +- account_page_dirtied(page, mapping); +- radix_tree_tag_set(&mapping->page_tree, +- page_index(page), PAGECACHE_TAG_DIRTY); +- } ++ BUG_ON(page_mapping(page) != mapping); ++ WARN_ON_ONCE(!PagePrivate(page) && !PageUptodate(page)); ++ account_page_dirtied(page, mapping); ++ radix_tree_tag_set(&mapping->page_tree, page_index(page), ++ PAGECACHE_TAG_DIRTY); + spin_unlock_irqrestore(&mapping->tree_lock, flags); + if (mapping->host) { + /* !PageAnon && !swapper_space */ +@@ -2163,12 +2146,10 @@ int clear_page_dirty_for_io(struct page *page) + /* + * We carefully synchronise fault handlers against + * installing a dirty pte and marking the page dirty +- * at this point. We do this by having them hold the +- * page lock at some point after installing their +- * pte, but before marking the page dirty. +- * Pages are always locked coming in here, so we get +- * the desired exclusion. See mm/memory.c:do_wp_page() +- * for more comments. ++ * at this point. We do this by having them hold the ++ * page lock while dirtying the page, and pages are ++ * always locked coming in here, so we get the desired ++ * exclusion. + */ + if (TestClearPageDirty(page)) { + dec_zone_page_state(page, NR_FILE_DIRTY); +diff --git a/mm/rmap.c b/mm/rmap.c +index 695eaff55d77..57f503b185a9 100644 +--- a/mm/rmap.c ++++ b/mm/rmap.c +@@ -72,6 +72,8 @@ static inline struct anon_vma *anon_vma_alloc(void) + anon_vma = kmem_cache_alloc(anon_vma_cachep, GFP_KERNEL); + if (anon_vma) { + atomic_set(&anon_vma->refcount, 1); ++ anon_vma->degree = 1; /* Reference for first vma */ ++ anon_vma->parent = anon_vma; + /* + * Initialise the anon_vma root to point to itself. If called + * from fork, the root will be reset to the parents anon_vma. +@@ -193,6 +195,8 @@ int anon_vma_prepare(struct vm_area_struct *vma) + if (likely(!vma->anon_vma)) { + vma->anon_vma = anon_vma; + anon_vma_chain_link(vma, avc, anon_vma); ++ /* vma reference or self-parent link for new root */ ++ anon_vma->degree++; + allocated = NULL; + avc = NULL; + } +@@ -241,6 +245,14 @@ static inline void unlock_anon_vma_root(struct anon_vma *root) + /* + * Attach the anon_vmas from src to dst. + * Returns 0 on success, -ENOMEM on failure. ++ * ++ * If dst->anon_vma is NULL this function tries to find and reuse existing ++ * anon_vma which has no vmas and only one child anon_vma. This prevents ++ * degradation of anon_vma hierarchy to endless linear chain in case of ++ * constantly forking task. On the other hand, an anon_vma with more than one ++ * child isn't reused even if there was no alive vma, thus rmap walker has a ++ * good chance of avoiding scanning the whole hierarchy when it searches where ++ * page is mapped. + */ + int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src) + { +@@ -261,11 +273,32 @@ int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src) + anon_vma = pavc->anon_vma; + root = lock_anon_vma_root(root, anon_vma); + anon_vma_chain_link(dst, avc, anon_vma); ++ ++ /* ++ * Reuse existing anon_vma if its degree lower than two, ++ * that means it has no vma and only one anon_vma child. ++ * ++ * Do not chose parent anon_vma, otherwise first child ++ * will always reuse it. Root anon_vma is never reused: ++ * it has self-parent reference and at least one child. ++ */ ++ if (!dst->anon_vma && anon_vma != src->anon_vma && ++ anon_vma->degree < 2) ++ dst->anon_vma = anon_vma; + } ++ if (dst->anon_vma) ++ dst->anon_vma->degree++; + unlock_anon_vma_root(root); + return 0; + + enomem_failure: ++ /* ++ * dst->anon_vma is dropped here otherwise its degree can be incorrectly ++ * decremented in unlink_anon_vmas(). ++ * We can safely do this because callers of anon_vma_clone() don't care ++ * about dst->anon_vma if anon_vma_clone() failed. ++ */ ++ dst->anon_vma = NULL; + unlink_anon_vmas(dst); + return -ENOMEM; + } +@@ -329,6 +362,9 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma) + if (!pvma->anon_vma) + return 0; + ++ /* Drop inherited anon_vma, we'll reuse existing or allocate new. */ ++ vma->anon_vma = NULL; ++ + /* + * First, attach the new VMA to the parent VMA's anon_vmas, + * so rmap can find non-COWed pages in child processes. +@@ -336,6 +372,10 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma) + if (anon_vma_clone(vma, pvma)) + return -ENOMEM; + ++ /* An existing anon_vma has been reused, all done then. */ ++ if (vma->anon_vma) ++ return 0; ++ + /* Then add our own anon_vma. */ + anon_vma = anon_vma_alloc(); + if (!anon_vma) +@@ -349,6 +389,7 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma) + * lock any of the anon_vmas in this anon_vma tree. + */ + anon_vma->root = pvma->anon_vma->root; ++ anon_vma->parent = pvma->anon_vma; + /* + * With refcounts, an anon_vma can stay around longer than the + * process it belongs to. The root anon_vma needs to be pinned until +@@ -359,6 +400,7 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma) + vma->anon_vma = anon_vma; + anon_vma_lock(anon_vma); + anon_vma_chain_link(vma, avc, anon_vma); ++ anon_vma->parent->degree++; + anon_vma_unlock(anon_vma); + + return 0; +@@ -389,12 +431,16 @@ void unlink_anon_vmas(struct vm_area_struct *vma) + * Leave empty anon_vmas on the list - we'll need + * to free them outside the lock. + */ +- if (list_empty(&anon_vma->head)) ++ if (list_empty(&anon_vma->head)) { ++ anon_vma->parent->degree--; + continue; ++ } + + list_del(&avc->same_vma); + anon_vma_chain_free(avc); + } ++ if (vma->anon_vma) ++ vma->anon_vma->degree--; + unlock_anon_vma_root(root); + + /* +@@ -405,6 +451,7 @@ void unlink_anon_vmas(struct vm_area_struct *vma) + list_for_each_entry_safe(avc, next, &vma->anon_vma_chain, same_vma) { + struct anon_vma *anon_vma = avc->anon_vma; + ++ BUG_ON(anon_vma->degree); + put_anon_vma(anon_vma); + + list_del(&avc->same_vma); +diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c +index 3bb535b08822..c11fd9ea78c9 100644 +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -3239,7 +3239,7 @@ static inline int l2cap_information_rsp(struct l2cap_conn *conn, + struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data; + u16 type, result; + +- if (cmd_len != sizeof(*rsp)) ++ if (cmd_len < sizeof(*rsp)) + return -EPROTO; + + type = __le16_to_cpu(rsp->type); +@@ -3445,7 +3445,7 @@ static inline int l2cap_move_channel_confirm_rsp(struct l2cap_conn *conn, + struct l2cap_move_chan_cfm_rsp *rsp = data; + u16 icid; + +- if (cmd_len < sizeof(*rsp)) ++ if (cmd_len != sizeof(*rsp)) + return -EPROTO; + + icid = le16_to_cpu(rsp->icid); +diff --git a/net/caif/chnl_net.c b/net/caif/chnl_net.c +index d09340e1523f..b8d940398adc 100644 +--- a/net/caif/chnl_net.c ++++ b/net/caif/chnl_net.c +@@ -467,7 +467,6 @@ static int ipcaif_newlink(struct net *src_net, struct net_device *dev, + ASSERT_RTNL(); + caifdev = netdev_priv(dev); + caif_netlink_parms(data, &caifdev->conn_req); +- dev_net_set(caifdev->netdev, src_net); + + ret = register_netdevice(dev); + if (ret) +diff --git a/net/compat.c b/net/compat.c +index 2c774d889d39..5b1750930916 100644 +--- a/net/compat.c ++++ b/net/compat.c +@@ -71,6 +71,13 @@ int get_compat_msghdr(struct msghdr *kmsg, struct compat_msghdr __user *umsg) + __get_user(kmsg->msg_controllen, &umsg->msg_controllen) || + __get_user(kmsg->msg_flags, &umsg->msg_flags)) + return -EFAULT; ++ ++ if (!tmp1) ++ kmsg->msg_namelen = 0; ++ ++ if (kmsg->msg_namelen < 0) ++ return -EINVAL; ++ + if (kmsg->msg_namelen > sizeof(struct sockaddr_storage)) + kmsg->msg_namelen = sizeof(struct sockaddr_storage); + kmsg->msg_name = compat_ptr(tmp1); +diff --git a/net/core/dev.c b/net/core/dev.c +index 0770364832a1..901495216f85 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -2143,12 +2143,14 @@ netdev_features_t netif_skb_features(struct sk_buff *skb) + if (skb_shinfo(skb)->gso_segs > skb->dev->gso_max_segs) + features &= ~NETIF_F_GSO_MASK; + +- if (protocol == htons(ETH_P_8021Q)) { +- struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data; +- protocol = veh->h_vlan_encapsulated_proto; +- } else if (!vlan_tx_tag_present(skb)) { +- return harmonize_features(skb, protocol, features); +- } ++ if (!vlan_tx_tag_present(skb)) { ++ if (unlikely(protocol == htons(ETH_P_8021Q))) { ++ struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data; ++ protocol = veh->h_vlan_encapsulated_proto; ++ } else { ++ return harmonize_features(skb, protocol, features); ++ } ++ } + + features &= (skb->dev->vlan_features | NETIF_F_HW_VLAN_TX); + +diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c +index 5bb77a691327..2cfcfb7efa91 100644 +--- a/net/ipv6/ip6_fib.c ++++ b/net/ipv6/ip6_fib.c +@@ -633,6 +633,29 @@ insert_above: + return ln; + } + ++static void fib6_purge_rt(struct rt6_info *rt, struct fib6_node *fn, ++ struct net *net) ++{ ++ if (atomic_read(&rt->rt6i_ref) != 1) { ++ /* This route is used as dummy address holder in some split ++ * nodes. It is not leaked, but it still holds other resources, ++ * which must be released in time. So, scan ascendant nodes ++ * and replace dummy references to this route with references ++ * to still alive ones. ++ */ ++ while (fn) { ++ if (!(fn->fn_flags & RTN_RTINFO) && fn->leaf == rt) { ++ fn->leaf = fib6_find_prefix(net, fn); ++ atomic_inc(&fn->leaf->rt6i_ref); ++ rt6_release(rt); ++ } ++ fn = fn->parent; ++ } ++ /* No more references are possible at this point. */ ++ BUG_ON(atomic_read(&rt->rt6i_ref) != 1); ++ } ++} ++ + /* + * Insert routing information in a node. + */ +@@ -723,11 +746,12 @@ add: + rt->dst.rt6_next = iter->dst.rt6_next; + atomic_inc(&rt->rt6i_ref); + inet6_rt_notify(RTM_NEWROUTE, rt, info); +- rt6_release(iter); + if (!(fn->fn_flags & RTN_RTINFO)) { + info->nl_net->ipv6.rt6_stats->fib_route_nodes++; + fn->fn_flags |= RTN_RTINFO; + } ++ fib6_purge_rt(iter, fn, info->nl_net); ++ rt6_release(iter); + } + + return 0; +@@ -1229,24 +1253,7 @@ static void fib6_del_route(struct fib6_node *fn, struct rt6_info **rtp, + fn = fib6_repair_tree(net, fn); + } + +- if (atomic_read(&rt->rt6i_ref) != 1) { +- /* This route is used as dummy address holder in some split +- * nodes. It is not leaked, but it still holds other resources, +- * which must be released in time. So, scan ascendant nodes +- * and replace dummy references to this route with references +- * to still alive ones. +- */ +- while (fn) { +- if (!(fn->fn_flags & RTN_RTINFO) && fn->leaf == rt) { +- fn->leaf = fib6_find_prefix(net, fn); +- atomic_inc(&fn->leaf->rt6i_ref); +- rt6_release(rt); +- } +- fn = fn->parent; +- } +- /* No more references are possible at this point. */ +- BUG_ON(atomic_read(&rt->rt6i_ref) != 1); +- } ++ fib6_purge_rt(rt, fn, net); + + inet6_rt_notify(RTM_DELROUTE, rt, info); + rt6_release(rt); +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index 32929b07269f..24f2a4135edf 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -1486,14 +1486,14 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx) + sc = le16_to_cpu(hdr->seq_ctrl); + frag = sc & IEEE80211_SCTL_FRAG; + +- if (likely(!ieee80211_has_morefrags(fc) && frag == 0)) +- goto out; +- + if (is_multicast_ether_addr(hdr->addr1)) { + rx->local->dot11MulticastReceivedFrameCount++; +- goto out; ++ goto out_no_led; + } + ++ if (likely(!ieee80211_has_morefrags(fc) && frag == 0)) ++ goto out; ++ + I802_DEBUG_INC(rx->local->rx_handlers_fragments); + + if (skb_linearize(rx->skb)) +@@ -1584,9 +1584,10 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx) + status->rx_flags |= IEEE80211_RX_FRAGMENTED; + + out: ++ ieee80211_led_rx(rx->local); ++ out_no_led: + if (rx->sta) + rx->sta->rx_packets++; +- ieee80211_led_rx(rx->local); + return RX_CONTINUE; + } + +diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c +index 00bdb1d9d690..abdb4755f382 100644 +--- a/net/netfilter/ipvs/ip_vs_core.c ++++ b/net/netfilter/ipvs/ip_vs_core.c +@@ -662,16 +662,24 @@ static inline int ip_vs_gather_frags_v6(struct sk_buff *skb, u_int32_t user) + } + #endif + +-static int ip_vs_route_me_harder(int af, struct sk_buff *skb) ++static int ip_vs_route_me_harder(int af, struct sk_buff *skb, ++ unsigned int hooknum) + { ++ if (!sysctl_snat_reroute(skb)) ++ return 0; ++ /* Reroute replies only to remote clients (FORWARD and LOCAL_OUT) */ ++ if (NF_INET_LOCAL_IN == hooknum) ++ return 0; + #ifdef CONFIG_IP_VS_IPV6 + if (af == AF_INET6) { +- if (sysctl_snat_reroute(skb) && ip6_route_me_harder(skb) != 0) ++ struct dst_entry *dst = skb_dst(skb); ++ ++ if (dst->dev && !(dst->dev->flags & IFF_LOOPBACK) && ++ ip6_route_me_harder(skb) != 0) + return 1; + } else + #endif +- if ((sysctl_snat_reroute(skb) || +- skb_rtable(skb)->rt_flags & RTCF_LOCAL) && ++ if (!(skb_rtable(skb)->rt_flags & RTCF_LOCAL) && + ip_route_me_harder(skb, RTN_LOCAL) != 0) + return 1; + +@@ -782,7 +790,8 @@ static int handle_response_icmp(int af, struct sk_buff *skb, + union nf_inet_addr *snet, + __u8 protocol, struct ip_vs_conn *cp, + struct ip_vs_protocol *pp, +- unsigned int offset, unsigned int ihl) ++ unsigned int offset, unsigned int ihl, ++ unsigned int hooknum) + { + unsigned int verdict = NF_DROP; + +@@ -812,7 +821,7 @@ static int handle_response_icmp(int af, struct sk_buff *skb, + #endif + ip_vs_nat_icmp(skb, pp, cp, 1); + +- if (ip_vs_route_me_harder(af, skb)) ++ if (ip_vs_route_me_harder(af, skb, hooknum)) + goto out; + + /* do the statistics and put it back */ +@@ -908,7 +917,7 @@ static int ip_vs_out_icmp(struct sk_buff *skb, int *related, + + snet.ip = iph->saddr; + return handle_response_icmp(AF_INET, skb, &snet, cih->protocol, cp, +- pp, offset, ihl); ++ pp, offset, ihl, hooknum); + } + + #ifdef CONFIG_IP_VS_IPV6 +@@ -985,7 +994,8 @@ static int ip_vs_out_icmp_v6(struct sk_buff *skb, int *related, + + snet.in6 = iph->saddr; + return handle_response_icmp(AF_INET6, skb, &snet, cih->nexthdr, cp, +- pp, offset, sizeof(struct ipv6hdr)); ++ pp, offset, sizeof(struct ipv6hdr), ++ hooknum); + } + #endif + +@@ -1018,7 +1028,7 @@ static inline int is_tcp_reset(const struct sk_buff *skb, int nh_len) + */ + static unsigned int + handle_response(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd, +- struct ip_vs_conn *cp, int ihl) ++ struct ip_vs_conn *cp, int ihl, unsigned int hooknum) + { + struct ip_vs_protocol *pp = pd->pp; + +@@ -1056,7 +1066,7 @@ handle_response(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd, + * if it came from this machine itself. So re-compute + * the routing information. + */ +- if (ip_vs_route_me_harder(af, skb)) ++ if (ip_vs_route_me_harder(af, skb, hooknum)) + goto drop; + + IP_VS_DBG_PKT(10, af, pp, skb, 0, "After SNAT"); +@@ -1169,7 +1179,7 @@ ip_vs_out(unsigned int hooknum, struct sk_buff *skb, int af) + cp = pp->conn_out_get(af, skb, &iph, iph.len, 0); + + if (likely(cp)) +- return handle_response(af, skb, pd, cp, iph.len); ++ return handle_response(af, skb, pd, cp, iph.len, hooknum); + if (sysctl_nat_icmp_send(net) && + (pp->protocol == IPPROTO_TCP || + pp->protocol == IPPROTO_UDP || +diff --git a/net/sctp/associola.c b/net/sctp/associola.c +index da54d2922f51..d014b053ad26 100644 +--- a/net/sctp/associola.c ++++ b/net/sctp/associola.c +@@ -1272,7 +1272,6 @@ void sctp_assoc_update(struct sctp_association *asoc, + asoc->peer.peer_hmacs = new->peer.peer_hmacs; + new->peer.peer_hmacs = NULL; + +- sctp_auth_key_put(asoc->asoc_shared_key); + sctp_auth_asoc_init_active_key(asoc, GFP_ATOMIC); + } + +@@ -1638,6 +1637,8 @@ struct sctp_chunk *sctp_assoc_lookup_asconf_ack( + * ack chunk whose serial number matches that of the request. + */ + list_for_each_entry(ack, &asoc->asconf_ack_list, transmitted_list) { ++ if (sctp_chunk_pending(ack)) ++ continue; + if (ack->subh.addip_hdr->serial == serial) { + sctp_chunk_hold(ack); + return ack; +diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c +index adb028746270..f1249b36837c 100644 +--- a/net/sctp/sm_make_chunk.c ++++ b/net/sctp/sm_make_chunk.c +@@ -2569,7 +2569,10 @@ do_addr_param: + + addr_param = param.v + sizeof(sctp_addip_param_t); + +- af = sctp_get_af_specific(param_type2af(param.p->type)); ++ af = sctp_get_af_specific(param_type2af(addr_param->p.type)); ++ if (af == NULL) ++ break; ++ + af->from_addr_param(&addr, addr_param, + htons(asoc->peer.port), 0); + +@@ -3068,50 +3071,63 @@ static __be16 sctp_process_asconf_param(struct sctp_association *asoc, + return SCTP_ERROR_NO_ERROR; + } + +-/* Verify the ASCONF packet before we process it. */ +-int sctp_verify_asconf(const struct sctp_association *asoc, +- struct sctp_paramhdr *param_hdr, void *chunk_end, +- struct sctp_paramhdr **errp) { +- sctp_addip_param_t *asconf_param; ++/* Verify the ASCONF packet before we process it. */ ++bool sctp_verify_asconf(const struct sctp_association *asoc, ++ struct sctp_chunk *chunk, bool addr_param_needed, ++ struct sctp_paramhdr **errp) ++{ ++ sctp_addip_chunk_t *addip = (sctp_addip_chunk_t *) chunk->chunk_hdr; + union sctp_params param; +- int length, plen; ++ bool addr_param_seen = false; + +- param.v = (sctp_paramhdr_t *) param_hdr; +- while (param.v <= chunk_end - sizeof(sctp_paramhdr_t)) { +- length = ntohs(param.p->length); +- *errp = param.p; +- +- if (param.v > chunk_end - length || +- length < sizeof(sctp_paramhdr_t)) +- return 0; ++ sctp_walk_params(param, addip, addip_hdr.params) { ++ size_t length = ntohs(param.p->length); + ++ *errp = param.p; + switch (param.p->type) { ++ case SCTP_PARAM_ERR_CAUSE: ++ break; ++ case SCTP_PARAM_IPV4_ADDRESS: ++ if (length != sizeof(sctp_ipv4addr_param_t)) ++ return false; ++ addr_param_seen = true; ++ break; ++ case SCTP_PARAM_IPV6_ADDRESS: ++ if (length != sizeof(sctp_ipv6addr_param_t)) ++ return false; ++ addr_param_seen = true; ++ break; + case SCTP_PARAM_ADD_IP: + case SCTP_PARAM_DEL_IP: + case SCTP_PARAM_SET_PRIMARY: +- asconf_param = (sctp_addip_param_t *)param.v; +- plen = ntohs(asconf_param->param_hdr.length); +- if (plen < sizeof(sctp_addip_param_t) + +- sizeof(sctp_paramhdr_t)) +- return 0; ++ /* In ASCONF chunks, these need to be first. */ ++ if (addr_param_needed && !addr_param_seen) ++ return false; ++ length = ntohs(param.addip->param_hdr.length); ++ if (length < sizeof(sctp_addip_param_t) + ++ sizeof(sctp_paramhdr_t)) ++ return false; + break; + case SCTP_PARAM_SUCCESS_REPORT: + case SCTP_PARAM_ADAPTATION_LAYER_IND: + if (length != sizeof(sctp_addip_param_t)) +- return 0; +- ++ return false; + break; + default: +- break; ++ /* This is unkown to us, reject! */ ++ return false; + } +- +- param.v += WORD_ROUND(length); + } + +- if (param.v != chunk_end) +- return 0; ++ /* Remaining sanity checks. */ ++ if (addr_param_needed && !addr_param_seen) ++ return false; ++ if (!addr_param_needed && addr_param_seen) ++ return false; ++ if (param.v != chunk->chunk_end) ++ return false; + +- return 1; ++ return true; + } + + /* Process an incoming ASCONF chunk with the next expected serial no. and +@@ -3120,16 +3136,17 @@ int sctp_verify_asconf(const struct sctp_association *asoc, + struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc, + struct sctp_chunk *asconf) + { ++ sctp_addip_chunk_t *addip = (sctp_addip_chunk_t *) asconf->chunk_hdr; ++ bool all_param_pass = true; ++ union sctp_params param; + sctp_addiphdr_t *hdr; + union sctp_addr_param *addr_param; + sctp_addip_param_t *asconf_param; + struct sctp_chunk *asconf_ack; +- + __be16 err_code; + int length = 0; + int chunk_len; + __u32 serial; +- int all_param_pass = 1; + + chunk_len = ntohs(asconf->chunk_hdr->length) - sizeof(sctp_chunkhdr_t); + hdr = (sctp_addiphdr_t *)asconf->skb->data; +@@ -3157,9 +3174,14 @@ struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc, + goto done; + + /* Process the TLVs contained within the ASCONF chunk. */ +- while (chunk_len > 0) { ++ sctp_walk_params(param, addip, addip_hdr.params) { ++ /* Skip preceeding address parameters. */ ++ if (param.p->type == SCTP_PARAM_IPV4_ADDRESS || ++ param.p->type == SCTP_PARAM_IPV6_ADDRESS) ++ continue; ++ + err_code = sctp_process_asconf_param(asoc, asconf, +- asconf_param); ++ param.addip); + /* ADDIP 4.1 A7) + * If an error response is received for a TLV parameter, + * all TLVs with no response before the failed TLV are +@@ -3167,28 +3189,20 @@ struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc, + * the failed response are considered unsuccessful unless + * a specific success indication is present for the parameter. + */ +- if (SCTP_ERROR_NO_ERROR != err_code) +- all_param_pass = 0; +- ++ if (err_code != SCTP_ERROR_NO_ERROR) ++ all_param_pass = false; + if (!all_param_pass) +- sctp_add_asconf_response(asconf_ack, +- asconf_param->crr_id, err_code, +- asconf_param); ++ sctp_add_asconf_response(asconf_ack, param.addip->crr_id, ++ err_code, param.addip); + + /* ADDIP 4.3 D11) When an endpoint receiving an ASCONF to add + * an IP address sends an 'Out of Resource' in its response, it + * MUST also fail any subsequent add or delete requests bundled + * in the ASCONF. + */ +- if (SCTP_ERROR_RSRC_LOW == err_code) ++ if (err_code == SCTP_ERROR_RSRC_LOW) + goto done; +- +- /* Move to the next ASCONF param. */ +- length = ntohs(asconf_param->param_hdr.length); +- asconf_param = (void *)asconf_param + length; +- chunk_len -= length; + } +- + done: + asoc->peer.addip_serial++; + +diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c +index 5ac33b600538..a6a300630af4 100644 +--- a/net/sctp/sm_statefuns.c ++++ b/net/sctp/sm_statefuns.c +@@ -3516,9 +3516,7 @@ sctp_disposition_t sctp_sf_do_asconf(const struct sctp_endpoint *ep, + struct sctp_chunk *asconf_ack = NULL; + struct sctp_paramhdr *err_param = NULL; + sctp_addiphdr_t *hdr; +- union sctp_addr_param *addr_param; + __u32 serial; +- int length; + + if (!sctp_vtag_verify(chunk, asoc)) { + sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG, +@@ -3543,17 +3541,8 @@ sctp_disposition_t sctp_sf_do_asconf(const struct sctp_endpoint *ep, + hdr = (sctp_addiphdr_t *)chunk->skb->data; + serial = ntohl(hdr->serial); + +- addr_param = (union sctp_addr_param *)hdr->params; +- length = ntohs(addr_param->p.length); +- if (length < sizeof(sctp_paramhdr_t)) +- return sctp_sf_violation_paramlen(ep, asoc, type, arg, +- (void *)addr_param, commands); +- + /* Verify the ASCONF chunk before processing it. */ +- if (!sctp_verify_asconf(asoc, +- (sctp_paramhdr_t *)((void *)addr_param + length), +- (void *)chunk->chunk_end, +- &err_param)) ++ if (!sctp_verify_asconf(asoc, chunk, true, &err_param)) + return sctp_sf_violation_paramlen(ep, asoc, type, arg, + (void *)err_param, commands); + +@@ -3670,10 +3659,7 @@ sctp_disposition_t sctp_sf_do_asconf_ack(const struct sctp_endpoint *ep, + rcvd_serial = ntohl(addip_hdr->serial); + + /* Verify the ASCONF-ACK chunk before processing it. */ +- if (!sctp_verify_asconf(asoc, +- (sctp_paramhdr_t *)addip_hdr->params, +- (void *)asconf_ack->chunk_end, +- &err_param)) ++ if (!sctp_verify_asconf(asoc, asconf_ack, false, &err_param)) + return sctp_sf_violation_paramlen(ep, asoc, type, arg, + (void *)err_param, commands); + +diff --git a/net/socket.c b/net/socket.c +index cc3fc4d4263e..025f7f4d2d80 100644 +--- a/net/socket.c ++++ b/net/socket.c +@@ -1908,6 +1908,9 @@ static int copy_msghdr_from_user(struct msghdr *kmsg, + if (copy_from_user(kmsg, umsg, sizeof(struct msghdr))) + return -EFAULT; + ++ if (kmsg->msg_name == NULL) ++ kmsg->msg_namelen = 0; ++ + if (kmsg->msg_namelen < 0) + return -EINVAL; + +diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c +index 4c23cfc0296c..a0769e1d4b8e 100644 +--- a/net/sunrpc/svcsock.c ++++ b/net/sunrpc/svcsock.c +@@ -1055,17 +1055,12 @@ static int receive_cb_reply(struct svc_sock *svsk, struct svc_rqst *rqstp) + xid = *p++; + calldir = *p; + +- if (bc_xprt) +- req = xprt_lookup_rqst(bc_xprt, xid); +- +- if (!req) { +- printk(KERN_NOTICE +- "%s: Got unrecognized reply: " +- "calldir 0x%x xpt_bc_xprt %p xid %08x\n", +- __func__, ntohl(calldir), +- bc_xprt, xid); ++ if (!bc_xprt) + return -EAGAIN; +- } ++ spin_lock_bh(&bc_xprt->transport_lock); ++ req = xprt_lookup_rqst(bc_xprt, xid); ++ if (!req) ++ goto unlock_notfound; + + memcpy(&req->rq_private_buf, &req->rq_rcv_buf, sizeof(struct xdr_buf)); + /* +@@ -1076,11 +1071,21 @@ static int receive_cb_reply(struct svc_sock *svsk, struct svc_rqst *rqstp) + dst = &req->rq_private_buf.head[0]; + src = &rqstp->rq_arg.head[0]; + if (dst->iov_len < src->iov_len) +- return -EAGAIN; /* whatever; just giving up. */ ++ goto unlock_eagain; /* whatever; just giving up. */ + memcpy(dst->iov_base, src->iov_base, src->iov_len); + xprt_complete_rqst(req->rq_task, svsk->sk_reclen); + rqstp->rq_arg.len = 0; ++ spin_unlock_bh(&bc_xprt->transport_lock); + return 0; ++unlock_notfound: ++ printk(KERN_NOTICE ++ "%s: Got unrecognized reply: " ++ "calldir 0x%x xpt_bc_xprt %p xid %08x\n", ++ __func__, ntohl(calldir), ++ bc_xprt, ntohl(xid)); ++unlock_eagain: ++ spin_unlock_bh(&bc_xprt->transport_lock); ++ return -EAGAIN; + } + + static int copy_pages_to_kvecs(struct kvec *vec, struct page **pages, int len) +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index 52646f9ecc80..63c18079683a 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -1868,6 +1868,9 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info) + if (!rdev->ops->get_key) + return -EOPNOTSUPP; + ++ if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)) ++ return -ENOENT; ++ + msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); + if (!msg) + return -ENOMEM; +@@ -1885,10 +1888,6 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info) + if (mac_addr) + NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr); + +- if (pairwise && mac_addr && +- !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)) +- return -ENOENT; +- + err = rdev->ops->get_key(&rdev->wiphy, dev, key_idx, pairwise, + mac_addr, &cookie, get_key_callback); + +@@ -2060,7 +2059,7 @@ static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info) + wdev_lock(dev->ieee80211_ptr); + err = nl80211_key_allowed(dev->ieee80211_ptr); + +- if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr && ++ if (key.type == NL80211_KEYTYPE_GROUP && mac_addr && + !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)) + err = -ENOENT; + +diff --git a/scripts/recordmcount.pl b/scripts/recordmcount.pl +index 858966ab019c..679218b56ede 100755 +--- a/scripts/recordmcount.pl ++++ b/scripts/recordmcount.pl +@@ -262,7 +262,6 @@ if ($arch eq "x86_64") { + # force flags for this arch + $ld .= " -m shlelf_linux"; + $objcopy .= " -O elf32-sh-linux"; +- $cc .= " -m32"; + + } elsif ($arch eq "powerpc") { + $local_regex = "^[0-9a-fA-F]+\\s+t\\s+(\\.?\\S+)"; +diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c +index 2d1bb8af7696..a02f92302a52 100644 +--- a/security/keys/encrypted-keys/encrypted.c ++++ b/security/keys/encrypted-keys/encrypted.c +@@ -1016,10 +1016,13 @@ static int __init init_encrypted(void) + ret = encrypted_shash_alloc(); + if (ret < 0) + return ret; ++ ret = aes_get_sizes(); ++ if (ret < 0) ++ goto out; + ret = register_key_type(&key_type_encrypted); + if (ret < 0) + goto out; +- return aes_get_sizes(); ++ return 0; + out: + encrypted_shash_release(); + return ret; +diff --git a/security/keys/gc.c b/security/keys/gc.c +index a42b45531aac..87632bd17b3e 100644 +--- a/security/keys/gc.c ++++ b/security/keys/gc.c +@@ -188,12 +188,12 @@ static noinline void key_gc_unused_key(struct key *key) + if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags)) + atomic_dec(&key->user->nikeys); + +- key_user_put(key->user); +- + /* now throw away the key memory */ + if (key->type->destroy) + key->type->destroy(key); + ++ key_user_put(key->user); ++ + kfree(key->description); + + #ifdef KEY_DEBUGGING +diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c +index 3068d16cf128..0a9891e7ba94 100644 +--- a/security/selinux/selinuxfs.c ++++ b/security/selinux/selinuxfs.c +@@ -1191,7 +1191,7 @@ static void sel_remove_entries(struct dentry *de) + spin_lock(&de->d_lock); + node = de->d_subdirs.next; + while (node != &de->d_subdirs) { +- struct dentry *d = list_entry(node, struct dentry, d_u.d_child); ++ struct dentry *d = list_entry(node, struct dentry, d_child); + + spin_lock_nested(&d->d_lock, DENTRY_D_LOCK_NESTED); + list_del_init(node); +@@ -1694,12 +1694,12 @@ static void sel_remove_classes(void) + + list_for_each(class_node, &class_dir->d_subdirs) { + struct dentry *class_subdir = list_entry(class_node, +- struct dentry, d_u.d_child); ++ struct dentry, d_child); + struct list_head *class_subdir_node; + + list_for_each(class_subdir_node, &class_subdir->d_subdirs) { + struct dentry *d = list_entry(class_subdir_node, +- struct dentry, d_u.d_child); ++ struct dentry, d_child); + + if (d->d_inode) + if (d->d_inode->i_mode & S_IFDIR) +diff --git a/sound/core/seq/seq_dummy.c b/sound/core/seq/seq_dummy.c +index dbc550716790..f60d81497f28 100644 +--- a/sound/core/seq/seq_dummy.c ++++ b/sound/core/seq/seq_dummy.c +@@ -82,36 +82,6 @@ struct snd_seq_dummy_port { + static int my_client = -1; + + /* +- * unuse callback - send ALL_SOUNDS_OFF and RESET_CONTROLLERS events +- * to subscribers. +- * Note: this callback is called only after all subscribers are removed. +- */ +-static int +-dummy_unuse(void *private_data, struct snd_seq_port_subscribe *info) +-{ +- struct snd_seq_dummy_port *p; +- int i; +- struct snd_seq_event ev; +- +- p = private_data; +- memset(&ev, 0, sizeof(ev)); +- if (p->duplex) +- ev.source.port = p->connect; +- else +- ev.source.port = p->port; +- ev.dest.client = SNDRV_SEQ_ADDRESS_SUBSCRIBERS; +- ev.type = SNDRV_SEQ_EVENT_CONTROLLER; +- for (i = 0; i < 16; i++) { +- ev.data.control.channel = i; +- ev.data.control.param = MIDI_CTL_ALL_SOUNDS_OFF; +- snd_seq_kernel_client_dispatch(p->client, &ev, 0, 0); +- ev.data.control.param = MIDI_CTL_RESET_CONTROLLERS; +- snd_seq_kernel_client_dispatch(p->client, &ev, 0, 0); +- } +- return 0; +-} +- +-/* + * event input callback - just redirect events to subscribers + */ + static int +@@ -175,7 +145,6 @@ create_port(int idx, int type) + | SNDRV_SEQ_PORT_TYPE_PORT; + memset(&pcb, 0, sizeof(pcb)); + pcb.owner = THIS_MODULE; +- pcb.unuse = dummy_unuse; + pcb.event_input = dummy_input; + pcb.private_free = dummy_free; + pcb.private_data = rec; +diff --git a/sound/i2c/other/ak4113.c b/sound/i2c/other/ak4113.c +index dde5c9c92132..e1ab3ad87adb 100644 +--- a/sound/i2c/other/ak4113.c ++++ b/sound/i2c/other/ak4113.c +@@ -56,8 +56,7 @@ static inline unsigned char reg_read(struct ak4113 *ak4113, unsigned char reg) + + static void snd_ak4113_free(struct ak4113 *chip) + { +- chip->init = 1; /* don't schedule new work */ +- mb(); ++ atomic_inc(&chip->wq_processing); /* don't schedule new work */ + cancel_delayed_work_sync(&chip->work); + kfree(chip); + } +@@ -89,6 +88,7 @@ int snd_ak4113_create(struct snd_card *card, ak4113_read_t *read, + chip->write = write; + chip->private_data = private_data; + INIT_DELAYED_WORK(&chip->work, ak4113_stats); ++ atomic_set(&chip->wq_processing, 0); + + for (reg = 0; reg < AK4113_WRITABLE_REGS ; reg++) + chip->regmap[reg] = pgm[reg]; +@@ -139,13 +139,11 @@ static void ak4113_init_regs(struct ak4113 *chip) + + void snd_ak4113_reinit(struct ak4113 *chip) + { +- chip->init = 1; +- mb(); +- flush_delayed_work_sync(&chip->work); ++ if (atomic_inc_return(&chip->wq_processing) == 1) ++ cancel_delayed_work_sync(&chip->work); + ak4113_init_regs(chip); + /* bring up statistics / event queing */ +- chip->init = 0; +- if (chip->kctls[0]) ++ if (atomic_dec_and_test(&chip->wq_processing)) + schedule_delayed_work(&chip->work, HZ / 10); + } + EXPORT_SYMBOL_GPL(snd_ak4113_reinit); +@@ -632,8 +630,9 @@ static void ak4113_stats(struct work_struct *work) + { + struct ak4113 *chip = container_of(work, struct ak4113, work.work); + +- if (!chip->init) ++ if (atomic_inc_return(&chip->wq_processing) == 1) + snd_ak4113_check_rate_and_errors(chip, chip->check_flags); + +- schedule_delayed_work(&chip->work, HZ / 10); ++ if (atomic_dec_and_test(&chip->wq_processing)) ++ schedule_delayed_work(&chip->work, HZ / 10); + } +diff --git a/sound/i2c/other/ak4114.c b/sound/i2c/other/ak4114.c +index fdf3c1b65e38..4c6b37967da7 100644 +--- a/sound/i2c/other/ak4114.c ++++ b/sound/i2c/other/ak4114.c +@@ -66,8 +66,7 @@ static void reg_dump(struct ak4114 *ak4114) + + static void snd_ak4114_free(struct ak4114 *chip) + { +- chip->init = 1; /* don't schedule new work */ +- mb(); ++ atomic_inc(&chip->wq_processing); /* don't schedule new work */ + cancel_delayed_work_sync(&chip->work); + kfree(chip); + } +@@ -100,6 +99,7 @@ int snd_ak4114_create(struct snd_card *card, + chip->write = write; + chip->private_data = private_data; + INIT_DELAYED_WORK(&chip->work, ak4114_stats); ++ atomic_set(&chip->wq_processing, 0); + + for (reg = 0; reg < 7; reg++) + chip->regmap[reg] = pgm[reg]; +@@ -152,13 +152,11 @@ static void ak4114_init_regs(struct ak4114 *chip) + + void snd_ak4114_reinit(struct ak4114 *chip) + { +- chip->init = 1; +- mb(); +- flush_delayed_work_sync(&chip->work); ++ if (atomic_inc_return(&chip->wq_processing) == 1) ++ cancel_delayed_work_sync(&chip->work); + ak4114_init_regs(chip); + /* bring up statistics / event queing */ +- chip->init = 0; +- if (chip->kctls[0]) ++ if (atomic_dec_and_test(&chip->wq_processing)) + schedule_delayed_work(&chip->work, HZ / 10); + } + +@@ -612,10 +610,10 @@ static void ak4114_stats(struct work_struct *work) + { + struct ak4114 *chip = container_of(work, struct ak4114, work.work); + +- if (!chip->init) ++ if (atomic_inc_return(&chip->wq_processing) == 1) + snd_ak4114_check_rate_and_errors(chip, chip->check_flags); +- +- schedule_delayed_work(&chip->work, HZ / 10); ++ if (atomic_dec_and_test(&chip->wq_processing)) ++ schedule_delayed_work(&chip->work, HZ / 10); + } + + EXPORT_SYMBOL(snd_ak4114_create); +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index 33e538f76909..f461737e4e6c 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -2685,6 +2685,7 @@ static int __devinit azx_create(struct snd_card *card, struct pci_dev *pci, + struct azx *chip; + int i, err; + unsigned short gcap; ++ unsigned int dma_bits = 64; + static struct snd_device_ops ops = { + .dev_free = azx_dev_free, + }; +@@ -2780,9 +2781,14 @@ static int __devinit azx_create(struct snd_card *card, struct pci_dev *pci, + gcap = azx_readw(chip, GCAP); + snd_printdd(SFX "chipset global capabilities = 0x%x\n", gcap); + ++ /* AMD devices support 40 or 48bit DMA, take the safe one */ ++ if (chip->pci->vendor == PCI_VENDOR_ID_AMD) ++ dma_bits = 40; ++ + /* disable SB600 64bit support for safety */ + if (chip->pci->vendor == PCI_VENDOR_ID_ATI) { + struct pci_dev *p_smbus; ++ dma_bits = 40; + p_smbus = pci_get_device(PCI_VENDOR_ID_ATI, + PCI_DEVICE_ID_ATI_SBX00_SMBUS, + NULL); +@@ -2812,9 +2818,11 @@ static int __devinit azx_create(struct snd_card *card, struct pci_dev *pci, + } + + /* allow 64bit DMA address if supported by H/W */ +- if ((gcap & ICH6_GCAP_64OK) && !pci_set_dma_mask(pci, DMA_BIT_MASK(64))) +- pci_set_consistent_dma_mask(pci, DMA_BIT_MASK(64)); +- else { ++ if (!(gcap & ICH6_GCAP_64OK)) ++ dma_bits = 32; ++ if (!pci_set_dma_mask(pci, DMA_BIT_MASK(dma_bits))) { ++ pci_set_consistent_dma_mask(pci, DMA_BIT_MASK(dma_bits)); ++ } else { + pci_set_dma_mask(pci, DMA_BIT_MASK(32)); + pci_set_consistent_dma_mask(pci, DMA_BIT_MASK(32)); + } +diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c +index 137b67f8e69a..606f87aa24d9 100644 +--- a/sound/pci/hda/patch_sigmatel.c ++++ b/sound/pci/hda/patch_sigmatel.c +@@ -4246,9 +4246,9 @@ static void stac_store_hints(struct hda_codec *codec) + spec->gpio_mask; + } + if (get_int_hint(codec, "gpio_dir", &spec->gpio_dir)) +- spec->gpio_mask &= spec->gpio_mask; +- if (get_int_hint(codec, "gpio_data", &spec->gpio_data)) + spec->gpio_dir &= spec->gpio_mask; ++ if (get_int_hint(codec, "gpio_data", &spec->gpio_data)) ++ spec->gpio_data &= spec->gpio_mask; + if (get_int_hint(codec, "eapd_mask", &spec->eapd_mask)) + spec->eapd_mask &= spec->gpio_mask; + if (get_int_hint(codec, "gpio_mute", &spec->gpio_mute)) +diff --git a/sound/soc/atmel/atmel_ssc_dai.c b/sound/soc/atmel/atmel_ssc_dai.c +index 354341ec0f42..8d7d29c73c8a 100644 +--- a/sound/soc/atmel/atmel_ssc_dai.c ++++ b/sound/soc/atmel/atmel_ssc_dai.c +@@ -341,7 +341,6 @@ static int atmel_ssc_hw_params(struct snd_pcm_substream *substream, + struct atmel_pcm_dma_params *dma_params; + int dir, channels, bits; + u32 tfmr, rfmr, tcmr, rcmr; +- int start_event; + int ret; + + /* +@@ -460,19 +459,10 @@ static int atmel_ssc_hw_params(struct snd_pcm_substream *substream, + * The SSC transmit clock is obtained from the BCLK signal on + * on the TK line, and the SSC receive clock is + * generated from the transmit clock. +- * +- * For single channel data, one sample is transferred +- * on the falling edge of the LRC clock. +- * For two channel data, one sample is +- * transferred on both edges of the LRC clock. + */ +- start_event = ((channels == 1) +- ? SSC_START_FALLING_RF +- : SSC_START_EDGE_RF); +- + rcmr = SSC_BF(RCMR_PERIOD, 0) + | SSC_BF(RCMR_STTDLY, START_DELAY) +- | SSC_BF(RCMR_START, start_event) ++ | SSC_BF(RCMR_START, SSC_START_FALLING_RF) + | SSC_BF(RCMR_CKI, SSC_CKI_RISING) + | SSC_BF(RCMR_CKO, SSC_CKO_NONE) + | SSC_BF(RCMR_CKS, SSC_CKS_CLOCK); +@@ -480,14 +470,14 @@ static int atmel_ssc_hw_params(struct snd_pcm_substream *substream, + rfmr = SSC_BF(RFMR_FSEDGE, SSC_FSEDGE_POSITIVE) + | SSC_BF(RFMR_FSOS, SSC_FSOS_NONE) + | SSC_BF(RFMR_FSLEN, 0) +- | SSC_BF(RFMR_DATNB, 0) ++ | SSC_BF(RFMR_DATNB, (channels - 1)) + | SSC_BIT(RFMR_MSBF) + | SSC_BF(RFMR_LOOP, 0) + | SSC_BF(RFMR_DATLEN, (bits - 1)); + + tcmr = SSC_BF(TCMR_PERIOD, 0) + | SSC_BF(TCMR_STTDLY, START_DELAY) +- | SSC_BF(TCMR_START, start_event) ++ | SSC_BF(TCMR_START, SSC_START_FALLING_RF) + | SSC_BF(TCMR_CKI, SSC_CKI_FALLING) + | SSC_BF(TCMR_CKO, SSC_CKO_NONE) + | SSC_BF(TCMR_CKS, SSC_CKS_PIN); +@@ -496,7 +486,7 @@ static int atmel_ssc_hw_params(struct snd_pcm_substream *substream, + | SSC_BF(TFMR_FSDEN, 0) + | SSC_BF(TFMR_FSOS, SSC_FSOS_NONE) + | SSC_BF(TFMR_FSLEN, 0) +- | SSC_BF(TFMR_DATNB, 0) ++ | SSC_BF(TFMR_DATNB, (channels - 1)) + | SSC_BIT(TFMR_MSBF) + | SSC_BF(TFMR_DATDEF, 0) + | SSC_BF(TFMR_DATLEN, (bits - 1)); +diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c +index c40b7ca7a143..87cbf14bbdcd 100644 +--- a/sound/soc/codecs/sgtl5000.c ++++ b/sound/soc/codecs/sgtl5000.c +@@ -1238,6 +1238,9 @@ static int sgtl5000_enable_regulators(struct snd_soc_codec *codec) + /* wait for all power rails bring up */ + udelay(10); + ++ /* Need 8 clocks before I2C accesses */ ++ udelay(1); ++ + /* read chip information */ + reg = snd_soc_read(codec, SGTL5000_CHIP_ID); + if (((reg & SGTL5000_PARTID_MASK) >> SGTL5000_PARTID_SHIFT) != +diff --git a/sound/soc/codecs/sigmadsp.c b/sound/soc/codecs/sigmadsp.c +index 4068f2491232..bb3878c9625f 100644 +--- a/sound/soc/codecs/sigmadsp.c ++++ b/sound/soc/codecs/sigmadsp.c +@@ -176,6 +176,13 @@ static int _process_sigma_firmware(struct device *dev, + goto done; + } + ++ if (ssfw_head->version != 1) { ++ dev_err(dev, ++ "Failed to load firmware: Invalid version %d. Supported firmware versions: 1\n", ++ ssfw_head->version); ++ goto done; ++ } ++ + crc = crc32(0, fw->data + sizeof(*ssfw_head), + fw->size - sizeof(*ssfw_head)); + pr_debug("%s: crc=%x\n", __func__, crc); +diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c +index ddb0d904a353..a09d7eb1f02f 100644 +--- a/sound/soc/codecs/wm8960.c ++++ b/sound/soc/codecs/wm8960.c +@@ -496,7 +496,7 @@ static struct { + { 22050, 2 }, + { 24000, 2 }, + { 16000, 3 }, +- { 11250, 4 }, ++ { 11025, 4 }, + { 12000, 4 }, + { 8000, 5 }, + }; +diff --git a/sound/usb/midi.c b/sound/usb/midi.c +index e5fee1800a4f..de86e7487def 100644 +--- a/sound/usb/midi.c ++++ b/sound/usb/midi.c +@@ -364,6 +364,8 @@ static void snd_usbmidi_error_timer(unsigned long data) + if (in && in->error_resubmit) { + in->error_resubmit = 0; + for (j = 0; j < INPUT_URBS; ++j) { ++ if (atomic_read(&in->urbs[j]->use_count)) ++ continue; + in->urbs[j]->dev = umidi->dev; + snd_usbmidi_submit_urb(in->urbs[j], GFP_ATOMIC); + } +diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c +index 2b67823e8205..c419aa30d544 100644 +--- a/sound/usb/mixer.c ++++ b/sound/usb/mixer.c +@@ -834,6 +834,7 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval, + case USB_ID(0x046d, 0x0807): /* Logitech Webcam C500 */ + case USB_ID(0x046d, 0x0808): + case USB_ID(0x046d, 0x0809): ++ case USB_ID(0x046d, 0x0819): /* Logitech Webcam C210 */ + case USB_ID(0x046d, 0x081b): /* HD Webcam c310 */ + case USB_ID(0x046d, 0x081d): /* HD Webcam c510 */ + case USB_ID(0x046d, 0x0825): /* HD Webcam c270 */ +diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c +index 0e4e909d111e..1e0798f6539b 100644 +--- a/sound/usb/mixer_maps.c ++++ b/sound/usb/mixer_maps.c +@@ -304,8 +304,11 @@ static struct usbmix_name_map hercules_usb51_map[] = { + { 0 } /* terminator */ + }; + +-static const struct usbmix_name_map kef_x300a_map[] = { +- { 10, NULL }, /* firmware locks up (?) when we try to access this FU */ ++/* some (all?) SCMS USB3318 devices are affected by a firmware lock up ++ * when anything attempts to access FU 10 (control) ++ */ ++static const struct usbmix_name_map scms_usb3318_map[] = { ++ { 10, NULL }, + { 0 } + }; + +@@ -377,8 +380,14 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = { + .ignore_ctl_error = 1, + }, + { ++ /* KEF X300A */ + .id = USB_ID(0x27ac, 0x1000), +- .map = kef_x300a_map, ++ .map = scms_usb3318_map, ++ }, ++ { ++ /* Arcam rPAC */ ++ .id = USB_ID(0x25c4, 0x0003), ++ .map = scms_usb3318_map, + }, + { 0 } /* terminator */ + }; diff --git a/patch/kernel/sun5i-default/0013-patch-3.4.107-108.patch b/patch/kernel/sun5i-default/0013-patch-3.4.107-108.patch new file mode 100644 index 0000000000..0cdca0e45e --- /dev/null +++ b/patch/kernel/sun5i-default/0013-patch-3.4.107-108.patch @@ -0,0 +1,5644 @@ +diff --git a/Makefile b/Makefile +index f53f41a8dd09..5056e1bba7e8 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 4 +-SUBLEVEL = 107 ++SUBLEVEL = 108 + EXTRAVERSION = + NAME = Saber-toothed Squirrel + +diff --git a/arch/alpha/kernel/pci-sysfs.c b/arch/alpha/kernel/pci-sysfs.c +index 53649c7d0068..1a333558f656 100644 +--- a/arch/alpha/kernel/pci-sysfs.c ++++ b/arch/alpha/kernel/pci-sysfs.c +@@ -84,7 +84,7 @@ static int pci_mmap_resource(struct kobject *kobj, + if (iomem_is_exclusive(res->start)) + return -EINVAL; + +- pcibios_resource_to_bus(pdev, &bar, res); ++ pcibios_resource_to_bus(pdev->bus, &bar, res); + vma->vm_pgoff += bar.start >> (PAGE_SHIFT - (sparse ? 5 : 0)); + mmap_type = res->flags & IORESOURCE_MEM ? pci_mmap_mem : pci_mmap_io; + +@@ -140,7 +140,7 @@ static int sparse_mem_mmap_fits(struct pci_dev *pdev, int num) + long dense_offset; + unsigned long sparse_size; + +- pcibios_resource_to_bus(pdev, &bar, &pdev->resource[num]); ++ pcibios_resource_to_bus(pdev->bus, &bar, &pdev->resource[num]); + + /* All core logic chips have 4G sparse address space, except + CIA which has 16G (see xxx_SPARSE_MEM and xxx_DENSE_MEM +diff --git a/arch/arm/mach-at91/pm.h b/arch/arm/mach-at91/pm.h +index 89f56f3a802e..8c3f8e89d2ae 100644 +--- a/arch/arm/mach-at91/pm.h ++++ b/arch/arm/mach-at91/pm.h +@@ -38,7 +38,7 @@ static inline void at91rm9200_standby(void) + " mcr p15, 0, %0, c7, c0, 4\n\t" + " str %5, [%1, %2]" + : +- : "r" (0), "r" (AT91_BASE_SYS), "r" (AT91RM9200_SDRAMC_LPR), ++ : "r" (0), "r" (at91_ramc_base[0]), "r" (AT91RM9200_SDRAMC_LPR), + "r" (1), "r" (AT91RM9200_SDRAMC_SRR), + "r" (lpr)); + } +diff --git a/arch/arm/mach-pxa/corgi.c b/arch/arm/mach-pxa/corgi.c +index c1fe32db4755..f801fe8b3e5e 100644 +--- a/arch/arm/mach-pxa/corgi.c ++++ b/arch/arm/mach-pxa/corgi.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -711,6 +712,8 @@ static void __init corgi_init(void) + sharpsl_nand_partitions[1].size = 53 * 1024 * 1024; + + platform_add_devices(devices, ARRAY_SIZE(devices)); ++ ++ regulator_has_full_constraints(); + } + + static void __init fixup_corgi(struct tag *tags, char **cmdline, +diff --git a/arch/arm/mach-pxa/hx4700.c b/arch/arm/mach-pxa/hx4700.c +index b83b95a29503..f35a30f19874 100644 +--- a/arch/arm/mach-pxa/hx4700.c ++++ b/arch/arm/mach-pxa/hx4700.c +@@ -881,6 +881,8 @@ static void __init hx4700_init(void) + mdelay(10); + gpio_set_value(GPIO71_HX4700_ASIC3_nRESET, 1); + mdelay(10); ++ ++ regulator_has_full_constraints(); + } + + MACHINE_START(H4700, "HP iPAQ HX4700") +diff --git a/arch/arm/mach-pxa/poodle.c b/arch/arm/mach-pxa/poodle.c +index 89d98c832189..39d10683d1f1 100644 +--- a/arch/arm/mach-pxa/poodle.c ++++ b/arch/arm/mach-pxa/poodle.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -452,6 +453,7 @@ static void __init poodle_init(void) + pxa_set_i2c_info(NULL); + i2c_register_board_info(0, ARRAY_AND_SIZE(poodle_i2c_devices)); + poodle_init_spi(); ++ regulator_has_full_constraints(); + } + + static void __init fixup_poodle(struct tag *tags, char **cmdline, +diff --git a/arch/arm/mach-pxa/spitz.c b/arch/arm/mach-pxa/spitz.c +index df2ab0fb2ace..a1647d0c769f 100644 +--- a/arch/arm/mach-pxa/spitz.c ++++ b/arch/arm/mach-pxa/spitz.c +@@ -968,6 +968,8 @@ static void __init spitz_init(void) + spitz_nor_init(); + spitz_nand_init(); + spitz_i2c_init(); ++ ++ regulator_has_full_constraints(); + } + + static void __init spitz_fixup(struct tag *tags, char **cmdline, +diff --git a/arch/arm/mach-sa1100/pm.c b/arch/arm/mach-sa1100/pm.c +index 2fa499ec6afe..69bbe4e55aa0 100644 +--- a/arch/arm/mach-sa1100/pm.c ++++ b/arch/arm/mach-sa1100/pm.c +@@ -80,6 +80,7 @@ static int sa11x0_pm_enter(suspend_state_t state) + /* + * Ensure not to come back here if it wasn't intended + */ ++ RCSR = RCSR_SMR; + PSPR = 0; + + /* +diff --git a/arch/powerpc/boot/dts/fsl/pq3-etsec2-0.dtsi b/arch/powerpc/boot/dts/fsl/pq3-etsec2-0.dtsi +index 1382fec9e8c5..7fcb1ac0f232 100644 +--- a/arch/powerpc/boot/dts/fsl/pq3-etsec2-0.dtsi ++++ b/arch/powerpc/boot/dts/fsl/pq3-etsec2-0.dtsi +@@ -50,6 +50,7 @@ ethernet@b0000 { + fsl,num_tx_queues = <0x8>; + fsl,magic-packet; + local-mac-address = [ 00 00 00 00 00 00 ]; ++ ranges; + + queue-group@b0000 { + #address-cells = <1>; +diff --git a/arch/powerpc/boot/dts/fsl/pq3-etsec2-1.dtsi b/arch/powerpc/boot/dts/fsl/pq3-etsec2-1.dtsi +index 221cd2ea5b31..9f25427c1527 100644 +--- a/arch/powerpc/boot/dts/fsl/pq3-etsec2-1.dtsi ++++ b/arch/powerpc/boot/dts/fsl/pq3-etsec2-1.dtsi +@@ -50,6 +50,7 @@ ethernet@b1000 { + fsl,num_tx_queues = <0x8>; + fsl,magic-packet; + local-mac-address = [ 00 00 00 00 00 00 ]; ++ ranges; + + queue-group@b1000 { + #address-cells = <1>; +diff --git a/arch/powerpc/boot/dts/fsl/pq3-etsec2-2.dtsi b/arch/powerpc/boot/dts/fsl/pq3-etsec2-2.dtsi +index 61456c317609..cd7c318ab131 100644 +--- a/arch/powerpc/boot/dts/fsl/pq3-etsec2-2.dtsi ++++ b/arch/powerpc/boot/dts/fsl/pq3-etsec2-2.dtsi +@@ -49,6 +49,7 @@ ethernet@b2000 { + fsl,num_tx_queues = <0x8>; + fsl,magic-packet; + local-mac-address = [ 00 00 00 00 00 00 ]; ++ ranges; + + queue-group@b2000 { + #address-cells = <1>; +diff --git a/arch/powerpc/kernel/pci_of_scan.c b/arch/powerpc/kernel/pci_of_scan.c +index 89dde171a6fa..55551a823bd3 100644 +--- a/arch/powerpc/kernel/pci_of_scan.c ++++ b/arch/powerpc/kernel/pci_of_scan.c +@@ -111,7 +111,7 @@ static void of_pci_parse_addrs(struct device_node *node, struct pci_dev *dev) + res->name = pci_name(dev); + region.start = base; + region.end = base + size - 1; +- pcibios_bus_to_resource(dev, res, ®ion); ++ pcibios_bus_to_resource(dev->bus, res, ®ion); + } + } + +@@ -276,7 +276,7 @@ void __devinit of_scan_pci_bridge(struct pci_dev *dev) + res->flags = flags; + region.start = of_read_number(&ranges[1], 2); + region.end = region.start + size - 1; +- pcibios_bus_to_resource(dev, res, ®ion); ++ pcibios_bus_to_resource(dev->bus, res, ®ion); + } + sprintf(bus->name, "PCI Bus %04x:%02x", pci_domain_nr(bus), + bus->number); +diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c +index 5da8e8df5922..79a17f798ef8 100644 +--- a/arch/powerpc/platforms/powernv/pci-ioda.c ++++ b/arch/powerpc/platforms/powernv/pci-ioda.c +@@ -392,7 +392,7 @@ static void __devinit pnv_ioda_setup_pe_segments(struct pci_dev *dev) + + /* Setup IO segments */ + if (io_res.start < io_res.end) { +- pcibios_resource_to_bus(dev, ®ion, &io_res); ++ pcibios_resource_to_bus(dev->bus, ®ion, &io_res); + pos = region.start; + i = pos / phb->ioda.io_segsize; + while(i < phb->ioda.total_pe && pos <= region.end) { +@@ -422,7 +422,7 @@ static void __devinit pnv_ioda_setup_pe_segments(struct pci_dev *dev) + + /* Setup M32 segments */ + if (m32_res.start < m32_res.end) { +- pcibios_resource_to_bus(dev, ®ion, &m32_res); ++ pcibios_resource_to_bus(dev->bus, ®ion, &m32_res); + pos = region.start; + i = pos / phb->ioda.m32_segsize; + while(i < phb->ioda.total_pe && pos <= region.end) { +diff --git a/arch/powerpc/sysdev/axonram.c b/arch/powerpc/sysdev/axonram.c +index 1c16141c031c..1fea24944ff4 100644 +--- a/arch/powerpc/sysdev/axonram.c ++++ b/arch/powerpc/sysdev/axonram.c +@@ -155,7 +155,7 @@ axon_ram_direct_access(struct block_device *device, sector_t sector, + } + + *kaddr = (void *)(bank->ph_addr + offset); +- *pfn = virt_to_phys(kaddr) >> PAGE_SHIFT; ++ *pfn = virt_to_phys(*kaddr) >> PAGE_SHIFT; + + return 0; + } +diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c +index 0f250d12a18c..7e6ac1f829e7 100644 +--- a/arch/s390/kvm/kvm-s390.c ++++ b/arch/s390/kvm/kvm-s390.c +@@ -347,7 +347,7 @@ int kvm_arch_vcpu_setup(struct kvm_vcpu *vcpu) + vcpu->arch.sie_block->ecb = 6; + vcpu->arch.sie_block->eca = 0xC1002001U; + vcpu->arch.sie_block->fac = (int) (long) facilities; +- hrtimer_init(&vcpu->arch.ckc_timer, CLOCK_REALTIME, HRTIMER_MODE_ABS); ++ hrtimer_init(&vcpu->arch.ckc_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL); + tasklet_init(&vcpu->arch.tasklet, kvm_s390_tasklet, + (unsigned long) vcpu); + vcpu->arch.ckc_timer.function = kvm_s390_idle_wakeup; +diff --git a/arch/sparc/kernel/pci.c b/arch/sparc/kernel/pci.c +index 8c5c9a5675b4..ab5f471aa6e9 100644 +--- a/arch/sparc/kernel/pci.c ++++ b/arch/sparc/kernel/pci.c +@@ -409,7 +409,7 @@ static void __devinit pci_cfg_fake_ranges(struct pci_dev *dev, + res2.flags = res->flags; + region.start = base; + region.end = limit + 0xfff; +- pcibios_bus_to_resource(dev, &res2, ®ion); ++ pcibios_bus_to_resource(dev->bus, &res2, ®ion); + if (!res->start) + res->start = res2.start; + if (!res->end) +@@ -427,7 +427,7 @@ static void __devinit pci_cfg_fake_ranges(struct pci_dev *dev, + IORESOURCE_MEM); + region.start = base; + region.end = limit + 0xfffff; +- pcibios_bus_to_resource(dev, res, ®ion); ++ pcibios_bus_to_resource(dev->bus, res, ®ion); + } + + pci_read_config_word(dev, PCI_PREF_MEMORY_BASE, &mem_base_lo); +@@ -458,7 +458,7 @@ static void __devinit pci_cfg_fake_ranges(struct pci_dev *dev, + IORESOURCE_MEM | IORESOURCE_PREFETCH); + region.start = base; + region.end = limit + 0xfffff; +- pcibios_bus_to_resource(dev, res, ®ion); ++ pcibios_bus_to_resource(dev->bus, res, ®ion); + } + } + +@@ -480,7 +480,7 @@ static void __devinit apb_fake_ranges(struct pci_dev *dev, + res->flags = IORESOURCE_IO; + region.start = (first << 21); + region.end = (last << 21) + ((1 << 21) - 1); +- pcibios_bus_to_resource(dev, res, ®ion); ++ pcibios_bus_to_resource(dev->bus, res, ®ion); + + pci_read_config_byte(dev, APB_MEM_ADDRESS_MAP, &map); + apb_calc_first_last(map, &first, &last); +@@ -488,7 +488,7 @@ static void __devinit apb_fake_ranges(struct pci_dev *dev, + res->flags = IORESOURCE_MEM; + region.start = (first << 29); + region.end = (last << 29) + ((1 << 29) - 1); +- pcibios_bus_to_resource(dev, res, ®ion); ++ pcibios_bus_to_resource(dev->bus, res, ®ion); + } + + static void __devinit pci_of_scan_bus(struct pci_pbm_info *pbm, +@@ -579,7 +579,7 @@ static void __devinit of_scan_pci_bridge(struct pci_pbm_info *pbm, + res->flags = flags; + region.start = GET_64BIT(ranges, 1); + region.end = region.start + size - 1; +- pcibios_bus_to_resource(dev, res, ®ion); ++ pcibios_bus_to_resource(dev->bus, res, ®ion); + } + after_ranges: + sprintf(bus->name, "PCI Bus %04x:%02x", pci_domain_nr(bus), +diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig +index 917c1098775b..eda8cb92702f 100644 +--- a/arch/x86/Kconfig ++++ b/arch/x86/Kconfig +@@ -129,7 +129,7 @@ config SBUS + bool + + config NEED_DMA_MAP_STATE +- def_bool (X86_64 || INTEL_IOMMU || DMA_API_DEBUG) ++ def_bool (X86_64 || INTEL_IOMMU || DMA_API_DEBUG || SWIOTLB) + + config NEED_SG_DMA_LENGTH + def_bool y +diff --git a/arch/x86/crypto/aesni-intel_glue.c b/arch/x86/crypto/aesni-intel_glue.c +index c799352e24fc..51afabd65cbf 100644 +--- a/arch/x86/crypto/aesni-intel_glue.c ++++ b/arch/x86/crypto/aesni-intel_glue.c +@@ -1203,7 +1203,7 @@ static int __driver_rfc4106_decrypt(struct aead_request *req) + src = kmalloc(req->cryptlen + req->assoclen, GFP_ATOMIC); + if (!src) + return -ENOMEM; +- assoc = (src + req->cryptlen + auth_tag_len); ++ assoc = (src + req->cryptlen); + scatterwalk_map_and_copy(src, req->src, 0, req->cryptlen, 0); + scatterwalk_map_and_copy(assoc, req->assoc, 0, + req->assoclen, 0); +@@ -1228,7 +1228,7 @@ static int __driver_rfc4106_decrypt(struct aead_request *req) + scatterwalk_done(&src_sg_walk, 0, 0); + scatterwalk_done(&assoc_sg_walk, 0, 0); + } else { +- scatterwalk_map_and_copy(dst, req->dst, 0, req->cryptlen, 1); ++ scatterwalk_map_and_copy(dst, req->dst, 0, tempCipherLen, 1); + kfree(src); + } + return retval; +diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S +index 45f9c70f1246..8b49131c7df6 100644 +--- a/arch/x86/kernel/entry_64.S ++++ b/arch/x86/kernel/entry_64.S +@@ -414,11 +414,14 @@ ENTRY(ret_from_fork) + testl $3, CS-ARGOFFSET(%rsp) # from kernel_thread? + jz retint_restore_args + +- testl $_TIF_IA32, TI_flags(%rcx) # 32-bit compat task needs IRET +- jnz int_ret_from_sys_call +- +- RESTORE_TOP_OF_STACK %rdi, -ARGOFFSET +- jmp ret_from_sys_call # go to the SYSRET fastpath ++ /* ++ * By the time we get here, we have no idea whether our pt_regs, ++ * ti flags, and ti status came from the 64-bit SYSCALL fast path, ++ * the slow path, or one of the ia32entry paths. ++ * Use int_ret_from_sys_call to return, since it can safely handle ++ * all of the above. ++ */ ++ jmp int_ret_from_sys_call + + CFI_ENDPROC + END(ret_from_fork) +diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c +index d398f317f5e0..310cb013458d 100644 +--- a/arch/x86/kernel/reboot.c ++++ b/arch/x86/kernel/reboot.c +@@ -439,6 +439,17 @@ static struct dmi_system_id __initdata pci_reboot_dmi_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "iMac9,1"), + }, + }, ++ ++ /* ASRock */ ++ { /* Handle problems with rebooting on ASRock Q1900DC-ITX */ ++ .callback = set_pci_reboot, ++ .ident = "ASRock Q1900DC-ITX", ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "ASRock"), ++ DMI_MATCH(DMI_BOARD_NAME, "Q1900DC-ITX"), ++ }, ++ }, ++ + { /* Handle problems with rebooting on the Latitude E6320. */ + .callback = set_pci_reboot, + .ident = "Dell Latitude E6320", +@@ -690,9 +701,12 @@ void native_machine_shutdown(void) + /* Make certain I only run on the appropriate processor */ + set_cpus_allowed_ptr(current, cpumask_of(reboot_cpu_id)); + +- /* O.K Now that I'm on the appropriate processor, +- * stop all of the others. ++ /* ++ * O.K Now that I'm on the appropriate processor, stop all of the ++ * others. Also disable the local irq to not receive the per-cpu ++ * timer interrupt which may trigger scheduler's load balance. + */ ++ local_irq_disable(); + stop_other_cpus(); + #endif + +diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c +index 9bfe95fda57c..adc049fef8ca 100644 +--- a/arch/x86/kernel/traps.c ++++ b/arch/x86/kernel/traps.c +@@ -435,7 +435,7 @@ dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code) + * then it's very likely the result of an icebp/int01 trap. + * User wants a sigtrap for that. + */ +- if (!dr6 && user_mode(regs)) ++ if (!dr6 && user_mode_vm(regs)) + user_icebp = 1; + + /* Catch kmemcheck conditions first of all! */ +diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c +index 91e8680ec239..db08e669228c 100644 +--- a/arch/x86/kvm/emulate.c ++++ b/arch/x86/kvm/emulate.c +@@ -4246,7 +4246,8 @@ int x86_emulate_insn(struct x86_emulate_ctxt *ctxt) + if (rc != X86EMUL_CONTINUE) + goto done; + } +- ctxt->dst.orig_val = ctxt->dst.val; ++ /* Copy full 64-bit value for CMPXCHG8B. */ ++ ctxt->dst.orig_val64 = ctxt->dst.val64; + + special_insn: + +diff --git a/arch/x86/vdso/vdso32/sigreturn.S b/arch/x86/vdso/vdso32/sigreturn.S +index 31776d0efc8c..d7ec4e251c0a 100644 +--- a/arch/x86/vdso/vdso32/sigreturn.S ++++ b/arch/x86/vdso/vdso32/sigreturn.S +@@ -17,6 +17,7 @@ + .text + .globl __kernel_sigreturn + .type __kernel_sigreturn,@function ++ nop /* this guy is needed for .LSTARTFDEDLSI1 below (watch for HACK) */ + ALIGN + __kernel_sigreturn: + .LSTART_sigreturn: +diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c +index 8c5ad89a65a5..89cff3724db4 100644 +--- a/drivers/acpi/video.c ++++ b/drivers/acpi/video.c +@@ -1872,6 +1872,17 @@ EXPORT_SYMBOL(acpi_video_unregister); + + static int __init acpi_video_init(void) + { ++ /* ++ * Let the module load even if ACPI is disabled (e.g. due to ++ * a broken BIOS) so that i915.ko can still be loaded on such ++ * old systems without an AcpiOpRegion. ++ * ++ * acpi_video_register() will report -ENODEV later as well due ++ * to acpi_disabled when i915.ko tries to register itself afterwards. ++ */ ++ if (acpi_disabled) ++ return 0; ++ + dmi_check_system(video_dmi_table); + + if (intel_opregion_present()) +diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c +index 35fc56981875..eac37055456c 100644 +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -773,10 +773,6 @@ static int __init nbd_init(void) + return -EINVAL; + } + +- nbd_dev = kcalloc(nbds_max, sizeof(*nbd_dev), GFP_KERNEL); +- if (!nbd_dev) +- return -ENOMEM; +- + part_shift = 0; + if (max_part > 0) { + part_shift = fls(max_part); +@@ -798,6 +794,10 @@ static int __init nbd_init(void) + if (nbds_max > 1UL << (MINORBITS - part_shift)) + return -EINVAL; + ++ nbd_dev = kcalloc(nbds_max, sizeof(*nbd_dev), GFP_KERNEL); ++ if (!nbd_dev) ++ return -ENOMEM; ++ + for (i = 0; i < nbds_max; i++) { + struct gendisk *disk = alloc_disk(1 << part_shift); + if (!disk) +diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c +index 02fbbf7be9f9..8a084bffd068 100644 +--- a/drivers/bluetooth/ath3k.c ++++ b/drivers/bluetooth/ath3k.c +@@ -101,6 +101,7 @@ static struct usb_device_id ath3k_table[] = { + { USB_DEVICE(0x13d3, 0x3393) }, + { USB_DEVICE(0x13d3, 0x3402) }, + { USB_DEVICE(0x13d3, 0x3408) }, ++ { USB_DEVICE(0x13d3, 0x3423) }, + { USB_DEVICE(0x13d3, 0x3432) }, + + /* Atheros AR5BBU12 with sflash firmware */ +@@ -149,6 +150,7 @@ static struct usb_device_id ath3k_blist_tbl[] = { + { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 }, + + /* Atheros AR5BBU22 with sflash firmware */ +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index ddb2b873a112..7c0b21ebd33b 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -179,6 +179,7 @@ static struct usb_device_id blacklist_table[] = { + { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 }, + + /* Atheros AR5BBU12 with sflash firmware */ +diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c +index a81f4694f322..96f4a503ff9d 100644 +--- a/drivers/char/virtio_console.c ++++ b/drivers/char/virtio_console.c +@@ -124,6 +124,7 @@ struct ports_device { + * notification + */ + struct work_struct control_work; ++ struct work_struct config_work; + + struct list_head ports; + +@@ -1555,10 +1556,21 @@ static void config_intr(struct virtio_device *vdev) + + portdev = vdev->priv; + ++ if (!use_multiport(portdev)) ++ schedule_work(&portdev->config_work); ++} ++ ++static void config_work_handler(struct work_struct *work) ++{ ++ struct ports_device *portdev; ++ ++ portdev = container_of(work, struct ports_device, control_work); + if (!use_multiport(portdev)) { ++ struct virtio_device *vdev; + struct port *port; + u16 rows, cols; + ++ vdev = portdev->vdev; + vdev->config->get(vdev, + offsetof(struct virtio_console_config, cols), + &cols, sizeof(u16)); +@@ -1752,12 +1764,14 @@ static int __devinit virtcons_probe(struct virtio_device *vdev) + spin_lock_init(&portdev->ports_lock); + INIT_LIST_HEAD(&portdev->ports); + ++ INIT_WORK(&portdev->config_work, &config_work_handler); ++ INIT_WORK(&portdev->control_work, &control_work_handler); ++ + if (multiport) { + unsigned int nr_added_bufs; + + spin_lock_init(&portdev->c_ivq_lock); + spin_lock_init(&portdev->c_ovq_lock); +- INIT_WORK(&portdev->control_work, &control_work_handler); + + nr_added_bufs = fill_queue(portdev->c_ivq, + &portdev->c_ivq_lock); +@@ -1825,6 +1839,8 @@ static void virtcons_remove(struct virtio_device *vdev) + /* Finish up work that's lined up */ + if (use_multiport(portdev)) + cancel_work_sync(&portdev->control_work); ++ else ++ cancel_work_sync(&portdev->config_work); + + list_for_each_entry_safe(port, port2, &portdev->ports, list) + unplug_port(port); +@@ -1866,6 +1882,7 @@ static int virtcons_freeze(struct virtio_device *vdev) + + virtqueue_disable_cb(portdev->c_ivq); + cancel_work_sync(&portdev->control_work); ++ cancel_work_sync(&portdev->config_work); + /* + * Once more: if control_work_handler() was running, it would + * enable the cb as the last step. +diff --git a/drivers/cpufreq/speedstep-lib.c b/drivers/cpufreq/speedstep-lib.c +index 7047821a7f8a..4ab7a2156672 100644 +--- a/drivers/cpufreq/speedstep-lib.c ++++ b/drivers/cpufreq/speedstep-lib.c +@@ -400,6 +400,7 @@ unsigned int speedstep_get_freqs(enum speedstep_processor processor, + + pr_debug("previous speed is %u\n", prev_speed); + ++ preempt_disable(); + local_irq_save(flags); + + /* switch to low state */ +@@ -464,6 +465,8 @@ unsigned int speedstep_get_freqs(enum speedstep_processor processor, + + out: + local_irq_restore(flags); ++ preempt_enable(); ++ + return ret; + } + EXPORT_SYMBOL_GPL(speedstep_get_freqs); +diff --git a/drivers/cpufreq/speedstep-smi.c b/drivers/cpufreq/speedstep-smi.c +index 6a457fcaaad5..b01926df5b1b 100644 +--- a/drivers/cpufreq/speedstep-smi.c ++++ b/drivers/cpufreq/speedstep-smi.c +@@ -188,6 +188,7 @@ static void speedstep_set_state(unsigned int state) + return; + + /* Disable IRQs */ ++ preempt_disable(); + local_irq_save(flags); + + command = (smi_sig & 0xffffff00) | (smi_cmd & 0xff); +@@ -198,9 +199,19 @@ static void speedstep_set_state(unsigned int state) + + do { + if (retry) { ++ /* ++ * We need to enable interrupts, otherwise the blockage ++ * won't resolve. ++ * ++ * We disable preemption so that other processes don't ++ * run. If other processes were running, they could ++ * submit more DMA requests, making the blockage worse. ++ */ + pr_debug("retry %u, previous result %u, waiting...\n", + retry, result); ++ local_irq_enable(); + mdelay(retry * 50); ++ local_irq_disable(); + } + retry++; + __asm__ __volatile__( +@@ -217,6 +228,7 @@ static void speedstep_set_state(unsigned int state) + + /* enable IRQs */ + local_irq_restore(flags); ++ preempt_enable(); + + if (new_state == state) + pr_debug("change to %u MHz succeeded after %u tries " +diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c +index 0924c30dce0b..593ff71c2b63 100644 +--- a/drivers/edac/sb_edac.c ++++ b/drivers/edac/sb_edac.c +@@ -672,7 +672,7 @@ static void get_memory_layout(const struct mem_ctl_info *mci) + u32 reg; + u64 limit, prv = 0; + u64 tmp_mb; +- u32 mb, kb; ++ u32 gb, mb; + u32 rir_way; + + /* +@@ -685,9 +685,9 @@ static void get_memory_layout(const struct mem_ctl_info *mci) + pvt->tolm = GET_TOLM(reg); + tmp_mb = (1 + pvt->tolm) >> 20; + +- mb = div_u64_rem(tmp_mb, 1000, &kb); +- debugf0("TOLM: %u.%03u GB (0x%016Lx)\n", +- mb, kb, (u64)pvt->tolm); ++ gb = div_u64_rem(tmp_mb, 1024, &mb); ++ debugf0("TOHM: %u.%03u GB (0x%016Lx)\n", ++ gb, (mb*1000)/1024, (u64)pvt->tohm); + + /* Address range is already 45:25 */ + pci_read_config_dword(pvt->pci_sad1, TOHM, +@@ -695,9 +695,9 @@ static void get_memory_layout(const struct mem_ctl_info *mci) + pvt->tohm = GET_TOHM(reg); + tmp_mb = (1 + pvt->tohm) >> 20; + +- mb = div_u64_rem(tmp_mb, 1000, &kb); ++ gb = div_u64_rem(tmp_mb, 1024, &mb); + debugf0("TOHM: %u.%03u GB (0x%016Lx)", +- mb, kb, (u64)pvt->tohm); ++ gb, (mb*1000)/1024, (u64)pvt->tohm); + + /* + * Step 2) Get SAD range and SAD Interleave list +@@ -719,11 +719,11 @@ static void get_memory_layout(const struct mem_ctl_info *mci) + break; + + tmp_mb = (limit + 1) >> 20; +- mb = div_u64_rem(tmp_mb, 1000, &kb); ++ gb = div_u64_rem(tmp_mb, 1000, &mb); + debugf0("SAD#%d %s up to %u.%03u GB (0x%016Lx) %s reg=0x%08x\n", + n_sads, + get_dram_attr(reg), +- mb, kb, ++ gb, (mb*1000)/1024, + ((u64)tmp_mb) << 20L, + INTERLEAVE_MODE(reg) ? "Interleave: 8:6" : "Interleave: [8:6]XOR[18:16]", + reg); +@@ -753,9 +753,9 @@ static void get_memory_layout(const struct mem_ctl_info *mci) + break; + tmp_mb = (limit + 1) >> 20; + +- mb = div_u64_rem(tmp_mb, 1000, &kb); ++ gb = div_u64_rem(tmp_mb, 1000, &mb); + debugf0("TAD#%d: up to %u.%03u GB (0x%016Lx), socket interleave %d, memory interleave %d, TGT: %d, %d, %d, %d, reg=0x%08x\n", +- n_tads, mb, kb, ++ n_tads, gb, (mb*1000)/1024, + ((u64)tmp_mb) << 20L, + (u32)TAD_SOCK(reg), + (u32)TAD_CH(reg), +@@ -778,10 +778,10 @@ static void get_memory_layout(const struct mem_ctl_info *mci) + tad_ch_nilv_offset[j], + ®); + tmp_mb = TAD_OFFSET(reg) >> 20; +- mb = div_u64_rem(tmp_mb, 1000, &kb); ++ gb = div_u64_rem(tmp_mb, 1024, &mb); + debugf0("TAD CH#%d, offset #%d: %u.%03u GB (0x%016Lx), reg=0x%08x\n", + i, j, +- mb, kb, ++ gb, (mb*1000)/1024, + ((u64)tmp_mb) << 20L, + reg); + } +@@ -803,10 +803,10 @@ static void get_memory_layout(const struct mem_ctl_info *mci) + + tmp_mb = RIR_LIMIT(reg) >> 20; + rir_way = 1 << RIR_WAY(reg); +- mb = div_u64_rem(tmp_mb, 1000, &kb); ++ gb = div_u64_rem(tmp_mb, 1024, &mb); + debugf0("CH#%d RIR#%d, limit: %u.%03u GB (0x%016Lx), way: %d, reg=0x%08x\n", + i, j, +- mb, kb, ++ gb, (mb*1000)/1024, + ((u64)tmp_mb) << 20L, + rir_way, + reg); +@@ -817,10 +817,10 @@ static void get_memory_layout(const struct mem_ctl_info *mci) + ®); + tmp_mb = RIR_OFFSET(reg) << 6; + +- mb = div_u64_rem(tmp_mb, 1000, &kb); ++ gb = div_u64_rem(tmp_mb, 1024, &mb); + debugf0("CH#%d RIR#%d INTL#%d, offset %u.%03u GB (0x%016Lx), tgt: %d, reg=0x%08x\n", + i, j, k, +- mb, kb, ++ gb, (mb*1000)/1024, + ((u64)tmp_mb) << 20L, + (u32)RIR_RNK_TGT(reg), + reg); +@@ -858,7 +858,7 @@ static int get_memory_error_data(struct mem_ctl_info *mci, + u8 ch_way,sck_way; + u32 tad_offset; + u32 rir_way; +- u32 mb, kb; ++ u32 gb, mb; + u64 ch_addr, offset, limit, prv = 0; + + +@@ -1084,10 +1084,10 @@ static int get_memory_error_data(struct mem_ctl_info *mci, + continue; + + limit = RIR_LIMIT(reg); +- mb = div_u64_rem(limit >> 20, 1000, &kb); ++ gb = div_u64_rem(limit >> 20, 1024, &mb); + debugf0("RIR#%d, limit: %u.%03u GB (0x%016Lx), way: %d\n", + n_rir, +- mb, kb, ++ gb, (mb*1000)/1024, + limit, + 1 << RIR_WAY(reg)); + if (ch_addr <= limit) +diff --git a/drivers/gpio/gpio-tps65912.c b/drivers/gpio/gpio-tps65912.c +index 79e66c002350..2712680c1337 100644 +--- a/drivers/gpio/gpio-tps65912.c ++++ b/drivers/gpio/gpio-tps65912.c +@@ -26,9 +26,12 @@ struct tps65912_gpio_data { + struct gpio_chip gpio_chip; + }; + ++#define to_tgd(gc) container_of(gc, struct tps65912_gpio_data, gpio_chip) ++ + static int tps65912_gpio_get(struct gpio_chip *gc, unsigned offset) + { +- struct tps65912 *tps65912 = container_of(gc, struct tps65912, gpio); ++ struct tps65912_gpio_data *tps65912_gpio = to_tgd(gc); ++ struct tps65912 *tps65912 = tps65912_gpio->tps65912; + int val; + + val = tps65912_reg_read(tps65912, TPS65912_GPIO1 + offset); +@@ -42,7 +45,8 @@ static int tps65912_gpio_get(struct gpio_chip *gc, unsigned offset) + static void tps65912_gpio_set(struct gpio_chip *gc, unsigned offset, + int value) + { +- struct tps65912 *tps65912 = container_of(gc, struct tps65912, gpio); ++ struct tps65912_gpio_data *tps65912_gpio = to_tgd(gc); ++ struct tps65912 *tps65912 = tps65912_gpio->tps65912; + + if (value) + tps65912_set_bits(tps65912, TPS65912_GPIO1 + offset, +@@ -55,7 +59,8 @@ static void tps65912_gpio_set(struct gpio_chip *gc, unsigned offset, + static int tps65912_gpio_output(struct gpio_chip *gc, unsigned offset, + int value) + { +- struct tps65912 *tps65912 = container_of(gc, struct tps65912, gpio); ++ struct tps65912_gpio_data *tps65912_gpio = to_tgd(gc); ++ struct tps65912 *tps65912 = tps65912_gpio->tps65912; + + /* Set the initial value */ + tps65912_gpio_set(gc, offset, value); +@@ -66,7 +71,8 @@ static int tps65912_gpio_output(struct gpio_chip *gc, unsigned offset, + + static int tps65912_gpio_input(struct gpio_chip *gc, unsigned offset) + { +- struct tps65912 *tps65912 = container_of(gc, struct tps65912, gpio); ++ struct tps65912_gpio_data *tps65912_gpio = to_tgd(gc); ++ struct tps65912 *tps65912 = tps65912_gpio->tps65912; + + return tps65912_clear_bits(tps65912, TPS65912_GPIO1 + offset, + GPIO_CFG_MASK); +diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c +index 8d1724c42b60..5325c20fd706 100644 +--- a/drivers/gpu/drm/radeon/atombios_dp.c ++++ b/drivers/gpu/drm/radeon/atombios_dp.c +@@ -777,10 +777,8 @@ static int radeon_dp_link_train_init(struct radeon_dp_link_train_info *dp_info) + radeon_write_dpcd_reg(dp_info->radeon_connector, + DP_DOWNSPREAD_CTRL, 0); + +- if ((dp_info->connector->connector_type == DRM_MODE_CONNECTOR_eDP) && +- (dig->panel_mode == DP_PANEL_MODE_INTERNAL_DP2_MODE)) { ++ if (dig->panel_mode == DP_PANEL_MODE_INTERNAL_DP2_MODE) + radeon_write_dpcd_reg(dp_info->radeon_connector, DP_EDP_CONFIGURATION_SET, 1); +- } + + /* set the lane count on the sink */ + tmp = dp_info->dp_lane_count; +diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c +index 01434ef9e00f..c5fe79e67ed9 100644 +--- a/drivers/gpu/drm/radeon/evergreen.c ++++ b/drivers/gpu/drm/radeon/evergreen.c +@@ -3474,6 +3474,9 @@ int evergreen_init(struct radeon_device *rdev) + } + } + ++ /* posting read */ ++ RREG32(SRBM_STATUS); ++ + return 0; + } + +diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c +index 40ed0e5b95a3..8ec5b8553873 100644 +--- a/drivers/gpu/drm/radeon/r100.c ++++ b/drivers/gpu/drm/radeon/r100.c +@@ -726,6 +726,10 @@ int r100_irq_set(struct radeon_device *rdev) + tmp |= RADEON_FP2_DETECT_MASK; + } + WREG32(RADEON_GEN_INT_CNTL, tmp); ++ ++ /* read back to post the write */ ++ RREG32(RADEON_GEN_INT_CNTL); ++ + return 0; + } + +diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c +index 1555cd694111..9c7062d970ee 100644 +--- a/drivers/gpu/drm/radeon/r600.c ++++ b/drivers/gpu/drm/radeon/r600.c +@@ -3184,6 +3184,9 @@ int r600_irq_set(struct radeon_device *rdev) + WREG32(DC_HOT_PLUG_DETECT3_INT_CONTROL, hpd3); + } + ++ /* posting read */ ++ RREG32(R_000E50_SRBM_STATUS); ++ + return 0; + } + +diff --git a/drivers/gpu/drm/radeon/radeon_bios.c b/drivers/gpu/drm/radeon/radeon_bios.c +index d306cc8fdeaa..ef56e4ed89d2 100644 +--- a/drivers/gpu/drm/radeon/radeon_bios.c ++++ b/drivers/gpu/drm/radeon/radeon_bios.c +@@ -76,7 +76,7 @@ static bool igp_read_bios_from_vram(struct radeon_device *rdev) + + static bool radeon_read_bios(struct radeon_device *rdev) + { +- uint8_t __iomem *bios; ++ uint8_t __iomem *bios, val1, val2; + size_t size; + + rdev->bios = NULL; +@@ -86,15 +86,19 @@ static bool radeon_read_bios(struct radeon_device *rdev) + return false; + } + +- if (size == 0 || bios[0] != 0x55 || bios[1] != 0xaa) { ++ val1 = readb(&bios[0]); ++ val2 = readb(&bios[1]); ++ ++ if (size == 0 || val1 != 0x55 || val2 != 0xaa) { + pci_unmap_rom(rdev->pdev, bios); + return false; + } +- rdev->bios = kmemdup(bios, size, GFP_KERNEL); ++ rdev->bios = kzalloc(size, GFP_KERNEL); + if (rdev->bios == NULL) { + pci_unmap_rom(rdev->pdev, bios); + return false; + } ++ memcpy_fromio(rdev->bios, bios, size); + pci_unmap_rom(rdev->pdev, bios); + return true; + } +diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c +index cf723c4297a9..f3ee36036487 100644 +--- a/drivers/gpu/drm/radeon/radeon_cs.c ++++ b/drivers/gpu/drm/radeon/radeon_cs.c +@@ -167,11 +167,13 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data) + u32 ring = RADEON_CS_RING_GFX; + s32 priority = 0; + ++ INIT_LIST_HEAD(&p->validated); ++ + if (!cs->num_chunks) { + return 0; + } ++ + /* get chunks */ +- INIT_LIST_HEAD(&p->validated); + p->idx = 0; + p->chunk_ib_idx = -1; + p->chunk_relocs_idx = -1; +diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c +index 739eb0d0d12d..07b6dbf68152 100644 +--- a/drivers/gpu/drm/radeon/rs600.c ++++ b/drivers/gpu/drm/radeon/rs600.c +@@ -585,6 +585,10 @@ int rs600_irq_set(struct radeon_device *rdev) + WREG32(R_006540_DxMODE_INT_MASK, mode_int); + WREG32(R_007D08_DC_HOT_PLUG_DETECT1_INT_CONTROL, hpd1); + WREG32(R_007D18_DC_HOT_PLUG_DETECT2_INT_CONTROL, hpd2); ++ ++ /* posting read */ ++ RREG32(R_000040_GEN_INT_CNTL); ++ + return 0; + } + +diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c +index e710073923e9..068b21f0d7df 100644 +--- a/drivers/gpu/drm/radeon/si.c ++++ b/drivers/gpu/drm/radeon/si.c +@@ -4126,6 +4126,9 @@ int si_init(struct radeon_device *rdev) + return -EINVAL; + } + ++ /* posting read */ ++ RREG32(SRBM_STATUS); ++ + return 0; + } + +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c +index db50604ac216..e43341a53fac 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c +@@ -547,21 +547,6 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset) + goto out_err1; + } + +- ret = ttm_bo_init_mm(&dev_priv->bdev, TTM_PL_VRAM, +- (dev_priv->vram_size >> PAGE_SHIFT)); +- if (unlikely(ret != 0)) { +- DRM_ERROR("Failed initializing memory manager for VRAM.\n"); +- goto out_err2; +- } +- +- dev_priv->has_gmr = true; +- if (ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_GMR, +- dev_priv->max_gmr_ids) != 0) { +- DRM_INFO("No GMR memory available. " +- "Graphics memory resources are very limited.\n"); +- dev_priv->has_gmr = false; +- } +- + dev_priv->mmio_mtrr = drm_mtrr_add(dev_priv->mmio_start, + dev_priv->mmio_size, DRM_MTRR_WC); + +@@ -618,6 +603,22 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset) + ret = vmw_3d_resource_inc(dev_priv, true); + if (unlikely(ret != 0)) + goto out_no_fifo; ++ ++ ret = ttm_bo_init_mm(&dev_priv->bdev, TTM_PL_VRAM, ++ (dev_priv->vram_size >> PAGE_SHIFT)); ++ if (unlikely(ret != 0)) { ++ DRM_ERROR("Failed initializing memory manager for VRAM.\n"); ++ goto out_no_vram; ++ } ++ ++ dev_priv->has_gmr = true; ++ if (ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_GMR, ++ dev_priv->max_gmr_ids) != 0) { ++ DRM_INFO("No GMR memory available. " ++ "Graphics memory resources are very limited.\n"); ++ dev_priv->has_gmr = false; ++ } ++ + vmw_kms_save_vga(dev_priv); + + /* Start kms and overlay systems, needs fifo. */ +@@ -663,6 +664,10 @@ out_no_kms: + vmw_kms_restore_vga(dev_priv); + vmw_3d_resource_dec(dev_priv, false); + } ++out_no_vram: ++ if (dev_priv->has_gmr) ++ (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR); ++ (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM); + out_no_fifo: + vmw_fence_manager_takedown(dev_priv->fman); + out_no_fman: +@@ -677,9 +682,6 @@ out_err4: + out_err3: + drm_mtrr_del(dev_priv->mmio_mtrr, dev_priv->mmio_start, + dev_priv->mmio_size, DRM_MTRR_WC); +- if (dev_priv->has_gmr) +- (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR); +- (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM); + out_err2: + (void)ttm_bo_device_release(&dev_priv->bdev); + out_err1: +@@ -709,6 +711,11 @@ static int vmw_driver_unload(struct drm_device *dev) + } + vmw_kms_close(dev_priv); + vmw_overlay_close(dev_priv); ++ ++ if (dev_priv->has_gmr) ++ (void)ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR); ++ (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM); ++ + vmw_fence_manager_takedown(dev_priv->fman); + if (dev_priv->stealth) + pci_release_region(dev->pdev, 2); +@@ -719,9 +726,6 @@ static int vmw_driver_unload(struct drm_device *dev) + iounmap(dev_priv->mmio_virt); + drm_mtrr_del(dev_priv->mmio_mtrr, dev_priv->mmio_start, + dev_priv->mmio_size, DRM_MTRR_WC); +- if (dev_priv->has_gmr) +- (void)ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR); +- (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM); + (void)ttm_bo_device_release(&dev_priv->bdev); + vmw_ttm_global_release(dev_priv); + idr_destroy(&dev_priv->surface_idr); +diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c +index a84112322071..d0254beb6d90 100644 +--- a/drivers/infiniband/core/umem.c ++++ b/drivers/infiniband/core/umem.c +@@ -94,6 +94,14 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr, + if (dmasync) + dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs); + ++ /* ++ * If the combination of the addr and size requested for this memory ++ * region causes an integer overflow, return error. ++ */ ++ if (((addr + size) < addr) || ++ PAGE_ALIGN(addr + size) < (addr + size)) ++ return ERR_PTR(-EINVAL); ++ + if (!can_do_mlock()) + return ERR_PTR(-EPERM); + +diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c +index 604556d73d25..5b51e4e6e7f9 100644 +--- a/drivers/infiniband/core/uverbs_main.c ++++ b/drivers/infiniband/core/uverbs_main.c +@@ -451,6 +451,7 @@ static void ib_uverbs_async_handler(struct ib_uverbs_file *file, + + entry->desc.async.element = element; + entry->desc.async.event_type = event; ++ entry->desc.async.reserved = 0; + entry->counter = counter; + + list_add_tail(&entry->list, &file->async_file->event_list); +diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c +index 259b0670b51c..df76538042ee 100644 +--- a/drivers/infiniband/hw/mlx4/mad.c ++++ b/drivers/infiniband/hw/mlx4/mad.c +@@ -44,6 +44,14 @@ enum { + MLX4_IB_VENDOR_CLASS2 = 0xa + }; + ++/* Counters should be saturate once they reach their maximum value */ ++#define ASSIGN_32BIT_COUNTER(counter, value) do {\ ++ if ((value) > (u32)~0U) \ ++ counter = cpu_to_be32((u32)~0U); \ ++ else \ ++ counter = cpu_to_be32(value); \ ++} while (0) ++ + int mlx4_MAD_IFC(struct mlx4_ib_dev *dev, int ignore_mkey, int ignore_bkey, + int port, struct ib_wc *in_wc, struct ib_grh *in_grh, + void *in_mad, void *response_mad) +@@ -304,10 +312,14 @@ static int ib_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num, + static void edit_counter(struct mlx4_counter *cnt, + struct ib_pma_portcounters *pma_cnt) + { +- pma_cnt->port_xmit_data = cpu_to_be32((be64_to_cpu(cnt->tx_bytes)>>2)); +- pma_cnt->port_rcv_data = cpu_to_be32((be64_to_cpu(cnt->rx_bytes)>>2)); +- pma_cnt->port_xmit_packets = cpu_to_be32(be64_to_cpu(cnt->tx_frames)); +- pma_cnt->port_rcv_packets = cpu_to_be32(be64_to_cpu(cnt->rx_frames)); ++ ASSIGN_32BIT_COUNTER(pma_cnt->port_xmit_data, ++ (be64_to_cpu(cnt->tx_bytes) >> 2)); ++ ASSIGN_32BIT_COUNTER(pma_cnt->port_rcv_data, ++ (be64_to_cpu(cnt->rx_bytes) >> 2)); ++ ASSIGN_32BIT_COUNTER(pma_cnt->port_xmit_packets, ++ be64_to_cpu(cnt->tx_frames)); ++ ASSIGN_32BIT_COUNTER(pma_cnt->port_rcv_packets, ++ be64_to_cpu(cnt->rx_frames)); + } + + static int iboe_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num, +diff --git a/drivers/infiniband/hw/qib/qib.h b/drivers/infiniband/hw/qib/qib.h +index 6b811e3e8bd1..c7d4ef18cd40 100644 +--- a/drivers/infiniband/hw/qib/qib.h ++++ b/drivers/infiniband/hw/qib/qib.h +@@ -1013,12 +1013,6 @@ struct qib_devdata { + /* control high-level access to EEPROM */ + struct mutex eep_lock; + uint64_t traffic_wds; +- /* active time is kept in seconds, but logged in hours */ +- atomic_t active_time; +- /* Below are nominal shadow of EEPROM, new since last EEPROM update */ +- uint8_t eep_st_errs[QIB_EEP_LOG_CNT]; +- uint8_t eep_st_new_errs[QIB_EEP_LOG_CNT]; +- uint16_t eep_hrs; + /* + * masks for which bits of errs, hwerrs that cause + * each of the counters to increment. +@@ -1235,8 +1229,7 @@ int qib_twsi_blk_rd(struct qib_devdata *dd, int dev, int addr, void *buffer, + int qib_twsi_blk_wr(struct qib_devdata *dd, int dev, int addr, + const void *buffer, int len); + void qib_get_eeprom_info(struct qib_devdata *); +-int qib_update_eeprom_log(struct qib_devdata *dd); +-void qib_inc_eeprom_err(struct qib_devdata *dd, u32 eidx, u32 incr); ++#define qib_inc_eeprom_err(dd, eidx, incr) + void qib_dump_lookup_output_queue(struct qib_devdata *); + void qib_force_pio_avail_update(struct qib_devdata *); + void qib_clear_symerror_on_linkup(unsigned long opaque); +diff --git a/drivers/infiniband/hw/qib/qib_eeprom.c b/drivers/infiniband/hw/qib/qib_eeprom.c +index 92d9cfe98a68..161ef71d6d42 100644 +--- a/drivers/infiniband/hw/qib/qib_eeprom.c ++++ b/drivers/infiniband/hw/qib/qib_eeprom.c +@@ -263,189 +263,8 @@ void qib_get_eeprom_info(struct qib_devdata *dd) + qib_dev_err(dd, "Board SN %s did not pass functional " + "test: %s\n", dd->serial, ifp->if_comment); + +- memcpy(&dd->eep_st_errs, &ifp->if_errcntp, QIB_EEP_LOG_CNT); +- /* +- * Power-on (actually "active") hours are kept as little-endian value +- * in EEPROM, but as seconds in a (possibly as small as 24-bit) +- * atomic_t while running. +- */ +- atomic_set(&dd->active_time, 0); +- dd->eep_hrs = ifp->if_powerhour[0] | (ifp->if_powerhour[1] << 8); +- + done: + vfree(buf); + + bail:; + } +- +-/** +- * qib_update_eeprom_log - copy active-time and error counters to eeprom +- * @dd: the qlogic_ib device +- * +- * Although the time is kept as seconds in the qib_devdata struct, it is +- * rounded to hours for re-write, as we have only 16 bits in EEPROM. +- * First-cut code reads whole (expected) struct qib_flash, modifies, +- * re-writes. Future direction: read/write only what we need, assuming +- * that the EEPROM had to have been "good enough" for driver init, and +- * if not, we aren't making it worse. +- * +- */ +-int qib_update_eeprom_log(struct qib_devdata *dd) +-{ +- void *buf; +- struct qib_flash *ifp; +- int len, hi_water; +- uint32_t new_time, new_hrs; +- u8 csum; +- int ret, idx; +- unsigned long flags; +- +- /* first, check if we actually need to do anything. */ +- ret = 0; +- for (idx = 0; idx < QIB_EEP_LOG_CNT; ++idx) { +- if (dd->eep_st_new_errs[idx]) { +- ret = 1; +- break; +- } +- } +- new_time = atomic_read(&dd->active_time); +- +- if (ret == 0 && new_time < 3600) +- goto bail; +- +- /* +- * The quick-check above determined that there is something worthy +- * of logging, so get current contents and do a more detailed idea. +- * read full flash, not just currently used part, since it may have +- * been written with a newer definition +- */ +- len = sizeof(struct qib_flash); +- buf = vmalloc(len); +- ret = 1; +- if (!buf) { +- qib_dev_err(dd, "Couldn't allocate memory to read %u " +- "bytes from eeprom for logging\n", len); +- goto bail; +- } +- +- /* Grab semaphore and read current EEPROM. If we get an +- * error, let go, but if not, keep it until we finish write. +- */ +- ret = mutex_lock_interruptible(&dd->eep_lock); +- if (ret) { +- qib_dev_err(dd, "Unable to acquire EEPROM for logging\n"); +- goto free_bail; +- } +- ret = qib_twsi_blk_rd(dd, dd->twsi_eeprom_dev, 0, buf, len); +- if (ret) { +- mutex_unlock(&dd->eep_lock); +- qib_dev_err(dd, "Unable read EEPROM for logging\n"); +- goto free_bail; +- } +- ifp = (struct qib_flash *)buf; +- +- csum = flash_csum(ifp, 0); +- if (csum != ifp->if_csum) { +- mutex_unlock(&dd->eep_lock); +- qib_dev_err(dd, "EEPROM cks err (0x%02X, S/B 0x%02X)\n", +- csum, ifp->if_csum); +- ret = 1; +- goto free_bail; +- } +- hi_water = 0; +- spin_lock_irqsave(&dd->eep_st_lock, flags); +- for (idx = 0; idx < QIB_EEP_LOG_CNT; ++idx) { +- int new_val = dd->eep_st_new_errs[idx]; +- if (new_val) { +- /* +- * If we have seen any errors, add to EEPROM values +- * We need to saturate at 0xFF (255) and we also +- * would need to adjust the checksum if we were +- * trying to minimize EEPROM traffic +- * Note that we add to actual current count in EEPROM, +- * in case it was altered while we were running. +- */ +- new_val += ifp->if_errcntp[idx]; +- if (new_val > 0xFF) +- new_val = 0xFF; +- if (ifp->if_errcntp[idx] != new_val) { +- ifp->if_errcntp[idx] = new_val; +- hi_water = offsetof(struct qib_flash, +- if_errcntp) + idx; +- } +- /* +- * update our shadow (used to minimize EEPROM +- * traffic), to match what we are about to write. +- */ +- dd->eep_st_errs[idx] = new_val; +- dd->eep_st_new_errs[idx] = 0; +- } +- } +- /* +- * Now update active-time. We would like to round to the nearest hour +- * but unless atomic_t are sure to be proper signed ints we cannot, +- * because we need to account for what we "transfer" to EEPROM and +- * if we log an hour at 31 minutes, then we would need to set +- * active_time to -29 to accurately count the _next_ hour. +- */ +- if (new_time >= 3600) { +- new_hrs = new_time / 3600; +- atomic_sub((new_hrs * 3600), &dd->active_time); +- new_hrs += dd->eep_hrs; +- if (new_hrs > 0xFFFF) +- new_hrs = 0xFFFF; +- dd->eep_hrs = new_hrs; +- if ((new_hrs & 0xFF) != ifp->if_powerhour[0]) { +- ifp->if_powerhour[0] = new_hrs & 0xFF; +- hi_water = offsetof(struct qib_flash, if_powerhour); +- } +- if ((new_hrs >> 8) != ifp->if_powerhour[1]) { +- ifp->if_powerhour[1] = new_hrs >> 8; +- hi_water = offsetof(struct qib_flash, if_powerhour) + 1; +- } +- } +- /* +- * There is a tiny possibility that we could somehow fail to write +- * the EEPROM after updating our shadows, but problems from holding +- * the spinlock too long are a much bigger issue. +- */ +- spin_unlock_irqrestore(&dd->eep_st_lock, flags); +- if (hi_water) { +- /* we made some change to the data, uopdate cksum and write */ +- csum = flash_csum(ifp, 1); +- ret = eeprom_write_with_enable(dd, 0, buf, hi_water + 1); +- } +- mutex_unlock(&dd->eep_lock); +- if (ret) +- qib_dev_err(dd, "Failed updating EEPROM\n"); +- +-free_bail: +- vfree(buf); +-bail: +- return ret; +-} +- +-/** +- * qib_inc_eeprom_err - increment one of the four error counters +- * that are logged to EEPROM. +- * @dd: the qlogic_ib device +- * @eidx: 0..3, the counter to increment +- * @incr: how much to add +- * +- * Each counter is 8-bits, and saturates at 255 (0xFF). They +- * are copied to the EEPROM (aka flash) whenever qib_update_eeprom_log() +- * is called, but it can only be called in a context that allows sleep. +- * This function can be called even at interrupt level. +- */ +-void qib_inc_eeprom_err(struct qib_devdata *dd, u32 eidx, u32 incr) +-{ +- uint new_val; +- unsigned long flags; +- +- spin_lock_irqsave(&dd->eep_st_lock, flags); +- new_val = dd->eep_st_new_errs[eidx] + incr; +- if (new_val > 255) +- new_val = 255; +- dd->eep_st_new_errs[eidx] = new_val; +- spin_unlock_irqrestore(&dd->eep_st_lock, flags); +-} +diff --git a/drivers/infiniband/hw/qib/qib_iba6120.c b/drivers/infiniband/hw/qib/qib_iba6120.c +index d0c64d514813..eb60abd69a72 100644 +--- a/drivers/infiniband/hw/qib/qib_iba6120.c ++++ b/drivers/infiniband/hw/qib/qib_iba6120.c +@@ -2674,8 +2674,6 @@ static void qib_get_6120_faststats(unsigned long opaque) + spin_lock_irqsave(&dd->eep_st_lock, flags); + traffic_wds -= dd->traffic_wds; + dd->traffic_wds += traffic_wds; +- if (traffic_wds >= QIB_TRAFFIC_ACTIVE_THRESHOLD) +- atomic_add(5, &dd->active_time); /* S/B #define */ + spin_unlock_irqrestore(&dd->eep_st_lock, flags); + + qib_chk_6120_errormask(dd); +diff --git a/drivers/infiniband/hw/qib/qib_iba7220.c b/drivers/infiniband/hw/qib/qib_iba7220.c +index 3c722f79d6f6..b62c7f26a963 100644 +--- a/drivers/infiniband/hw/qib/qib_iba7220.c ++++ b/drivers/infiniband/hw/qib/qib_iba7220.c +@@ -3292,8 +3292,6 @@ static void qib_get_7220_faststats(unsigned long opaque) + spin_lock_irqsave(&dd->eep_st_lock, flags); + traffic_wds -= dd->traffic_wds; + dd->traffic_wds += traffic_wds; +- if (traffic_wds >= QIB_TRAFFIC_ACTIVE_THRESHOLD) +- atomic_add(5, &dd->active_time); /* S/B #define */ + spin_unlock_irqrestore(&dd->eep_st_lock, flags); + done: + mod_timer(&dd->stats_timer, jiffies + HZ * ACTIVITY_TIMER); +diff --git a/drivers/infiniband/hw/qib/qib_iba7322.c b/drivers/infiniband/hw/qib/qib_iba7322.c +index d25205309d45..0d8e3487a5a3 100644 +--- a/drivers/infiniband/hw/qib/qib_iba7322.c ++++ b/drivers/infiniband/hw/qib/qib_iba7322.c +@@ -4841,8 +4841,6 @@ static void qib_get_7322_faststats(unsigned long opaque) + spin_lock_irqsave(&ppd->dd->eep_st_lock, flags); + traffic_wds -= ppd->dd->traffic_wds; + ppd->dd->traffic_wds += traffic_wds; +- if (traffic_wds >= QIB_TRAFFIC_ACTIVE_THRESHOLD) +- atomic_add(ACTIVITY_TIMER, &ppd->dd->active_time); + spin_unlock_irqrestore(&ppd->dd->eep_st_lock, flags); + if (ppd->cpspec->qdr_dfe_on && (ppd->link_speed_active & + QIB_IB_QDR) && +diff --git a/drivers/infiniband/hw/qib/qib_init.c b/drivers/infiniband/hw/qib/qib_init.c +index cf0cd30adc8d..0776dd0d0f51 100644 +--- a/drivers/infiniband/hw/qib/qib_init.c ++++ b/drivers/infiniband/hw/qib/qib_init.c +@@ -765,7 +765,6 @@ static void qib_shutdown_device(struct qib_devdata *dd) + dd->f_quiet_serdes(ppd); + } + +- qib_update_eeprom_log(dd); + } + + /** +diff --git a/drivers/infiniband/hw/qib/qib_sysfs.c b/drivers/infiniband/hw/qib/qib_sysfs.c +index dae51604cfcd..c01cb116a89a 100644 +--- a/drivers/infiniband/hw/qib/qib_sysfs.c ++++ b/drivers/infiniband/hw/qib/qib_sysfs.c +@@ -550,28 +550,6 @@ bail: + return ret < 0 ? ret : count; + } + +-static ssize_t show_logged_errs(struct device *device, +- struct device_attribute *attr, char *buf) +-{ +- struct qib_ibdev *dev = +- container_of(device, struct qib_ibdev, ibdev.dev); +- struct qib_devdata *dd = dd_from_dev(dev); +- int idx, count; +- +- /* force consistency with actual EEPROM */ +- if (qib_update_eeprom_log(dd) != 0) +- return -ENXIO; +- +- count = 0; +- for (idx = 0; idx < QIB_EEP_LOG_CNT; ++idx) { +- count += scnprintf(buf + count, PAGE_SIZE - count, "%d%c", +- dd->eep_st_errs[idx], +- idx == (QIB_EEP_LOG_CNT - 1) ? '\n' : ' '); +- } +- +- return count; +-} +- + /* + * Dump tempsense regs. in decimal, to ease shell-scripts. + */ +@@ -618,7 +596,6 @@ static DEVICE_ATTR(nctxts, S_IRUGO, show_nctxts, NULL); + static DEVICE_ATTR(nfreectxts, S_IRUGO, show_nfreectxts, NULL); + static DEVICE_ATTR(serial, S_IRUGO, show_serial, NULL); + static DEVICE_ATTR(boardversion, S_IRUGO, show_boardversion, NULL); +-static DEVICE_ATTR(logged_errors, S_IRUGO, show_logged_errs, NULL); + static DEVICE_ATTR(tempsense, S_IRUGO, show_tempsense, NULL); + static DEVICE_ATTR(localbus_info, S_IRUGO, show_localbus_info, NULL); + static DEVICE_ATTR(chip_reset, S_IWUSR, NULL, store_chip_reset); +@@ -632,7 +609,6 @@ static struct device_attribute *qib_attributes[] = { + &dev_attr_nfreectxts, + &dev_attr_serial, + &dev_attr_boardversion, +- &dev_attr_logged_errors, + &dev_attr_tempsense, + &dev_attr_localbus_info, + &dev_attr_chip_reset, +diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c +index 97e5f6f797b4..6d6198a3d52f 100644 +--- a/drivers/input/mouse/synaptics.c ++++ b/drivers/input/mouse/synaptics.c +@@ -274,8 +274,14 @@ static int synaptics_resolution(struct psmouse *psmouse) + } + } + +- if (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 7 && +- SYN_CAP_MIN_DIMENSIONS(priv->ext_cap_0c)) { ++ if (SYN_CAP_MIN_DIMENSIONS(priv->ext_cap_0c) && ++ (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 7 || ++ /* ++ * Firmware v8.1 does not report proper number of extended ++ * capabilities, but has been proven to report correct min ++ * coordinates. ++ */ ++ SYN_ID_FULL(priv->identity) == 0x801)) { + if (synaptics_send_cmd(psmouse, SYN_QUE_EXT_MIN_COORDS, resp)) { + psmouse_warn(psmouse, + "device claims to have min coordinates query, but I'm not able to read it.\n"); +@@ -506,6 +512,18 @@ static void synaptics_parse_agm(const unsigned char buf[], + priv->agm_pending = true; + } + ++static void synaptics_parse_ext_buttons(const unsigned char buf[], ++ struct synaptics_data *priv, ++ struct synaptics_hw_state *hw) ++{ ++ unsigned int ext_bits = ++ (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) + 1) >> 1; ++ unsigned int ext_mask = (1U << ext_bits) - 1; ++ ++ hw->ext_buttons = buf[4] & ext_mask; ++ hw->ext_buttons |= (buf[5] & ext_mask) << ext_bits; ++} ++ + static bool is_forcepad; + + static int synaptics_parse_hw_state(const unsigned char buf[], +@@ -592,28 +610,9 @@ static int synaptics_parse_hw_state(const unsigned char buf[], + hw->down = ((buf[0] ^ buf[3]) & 0x02) ? 1 : 0; + } + +- if (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) && ++ if (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) > 0 && + ((buf[0] ^ buf[3]) & 0x02)) { +- switch (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) & ~0x01) { +- default: +- /* +- * if nExtBtn is greater than 8 it should be +- * considered invalid and treated as 0 +- */ +- break; +- case 8: +- hw->ext_buttons |= ((buf[5] & 0x08)) ? 0x80 : 0; +- hw->ext_buttons |= ((buf[4] & 0x08)) ? 0x40 : 0; +- case 6: +- hw->ext_buttons |= ((buf[5] & 0x04)) ? 0x20 : 0; +- hw->ext_buttons |= ((buf[4] & 0x04)) ? 0x10 : 0; +- case 4: +- hw->ext_buttons |= ((buf[5] & 0x02)) ? 0x08 : 0; +- hw->ext_buttons |= ((buf[4] & 0x02)) ? 0x04 : 0; +- case 2: +- hw->ext_buttons |= ((buf[5] & 0x01)) ? 0x02 : 0; +- hw->ext_buttons |= ((buf[4] & 0x01)) ? 0x01 : 0; +- } ++ synaptics_parse_ext_buttons(buf, priv, hw); + } + } else { + hw->x = (((buf[1] & 0x1f) << 8) | buf[2]); +@@ -675,12 +674,35 @@ static void synaptics_report_semi_mt_data(struct input_dev *dev, + } + } + ++static void synaptics_report_ext_buttons(struct psmouse *psmouse, ++ const struct synaptics_hw_state *hw) ++{ ++ struct input_dev *dev = psmouse->dev; ++ struct synaptics_data *priv = psmouse->private; ++ int ext_bits = (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) + 1) >> 1; ++ int i; ++ ++ if (!SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap)) ++ return; ++ ++ /* Bug in FW 8.1, buttons are reported only when ExtBit is 1 */ ++ if (SYN_ID_FULL(priv->identity) == 0x801 && ++ !((psmouse->packet[0] ^ psmouse->packet[3]) & 0x02)) ++ return; ++ ++ for (i = 0; i < ext_bits; i++) { ++ input_report_key(dev, BTN_0 + 2 * i, ++ hw->ext_buttons & (1 << i)); ++ input_report_key(dev, BTN_1 + 2 * i, ++ hw->ext_buttons & (1 << (i + ext_bits))); ++ } ++} ++ + static void synaptics_report_buttons(struct psmouse *psmouse, + const struct synaptics_hw_state *hw) + { + struct input_dev *dev = psmouse->dev; + struct synaptics_data *priv = psmouse->private; +- int i; + + input_report_key(dev, BTN_LEFT, hw->left); + input_report_key(dev, BTN_RIGHT, hw->right); +@@ -693,8 +715,7 @@ static void synaptics_report_buttons(struct psmouse *psmouse, + input_report_key(dev, BTN_BACK, hw->down); + } + +- for (i = 0; i < SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap); i++) +- input_report_key(dev, BTN_0 + i, hw->ext_buttons & (1 << i)); ++ synaptics_report_ext_buttons(psmouse, hw); + } + + static void synaptics_report_slot(struct input_dev *dev, int slot, +diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c +index ea5dd289fe2a..489d7fbcec51 100644 +--- a/drivers/md/dm-io.c ++++ b/drivers/md/dm-io.c +@@ -298,6 +298,18 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where, + sector_t remaining = where->count; + struct request_queue *q = bdev_get_queue(where->bdev); + sector_t discard_sectors; ++ unsigned int uninitialized_var(special_cmd_max_sectors); ++ ++ /* ++ * Reject unsupported discard and write same requests. ++ */ ++ if (rw & REQ_DISCARD) { ++ special_cmd_max_sectors = q->limits.max_discard_sectors; ++ if (special_cmd_max_sectors == 0) { ++ dec_count(io, region, -EOPNOTSUPP); ++ return; ++ } ++ } + + /* + * where->count may be zero if rw holds a flush and we need to +@@ -321,7 +333,7 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where, + store_io_and_region_in_bio(bio, io, region); + + if (rw & REQ_DISCARD) { +- discard_sectors = min_t(sector_t, q->limits.max_discard_sectors, remaining); ++ discard_sectors = min_t(sector_t, special_cmd_max_sectors, remaining); + bio->bi_size = discard_sectors << SECTOR_SHIFT; + remaining -= discard_sectors; + } else while (remaining) { +diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c +index a3cf259275af..3afb9cdbdd14 100644 +--- a/drivers/md/dm-raid1.c ++++ b/drivers/md/dm-raid1.c +@@ -603,6 +603,15 @@ static void write_callback(unsigned long error, void *context) + return; + } + ++ /* ++ * If the bio is discard, return an error, but do not ++ * degrade the array. ++ */ ++ if (bio->bi_rw & REQ_DISCARD) { ++ bio_endio(bio, -EOPNOTSUPP); ++ return; ++ } ++ + for (i = 0; i < ms->nr_mirrors; i++) + if (test_bit(i, &error)) + fail_mirror(ms->mirror + i, DM_RAID1_WRITE_ERROR); +diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c +index b092338d5966..696a16bbf835 100644 +--- a/drivers/md/dm-snap.c ++++ b/drivers/md/dm-snap.c +@@ -1444,8 +1444,6 @@ out: + full_bio->bi_end_io = pe->full_bio_end_io; + full_bio->bi_private = pe->full_bio_private; + } +- free_pending_exception(pe); +- + increment_pending_exceptions_done_count(); + + up_write(&s->lock); +@@ -1462,6 +1460,8 @@ out: + } + + retry_origin_bios(s, origin_bios); ++ ++ free_pending_exception(pe); + } + + static void commit_callback(void *context, int success) +diff --git a/drivers/md/dm.c b/drivers/md/dm.c +index 0cf8c519d07e..3bfbccc3f0a7 100644 +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -2232,7 +2232,7 @@ int dm_setup_md_queue(struct mapped_device *md) + return 0; + } + +-static struct mapped_device *dm_find_md(dev_t dev) ++struct mapped_device *dm_get_md(dev_t dev) + { + struct mapped_device *md; + unsigned minor = MINOR(dev); +@@ -2243,12 +2243,15 @@ static struct mapped_device *dm_find_md(dev_t dev) + spin_lock(&_minor_lock); + + md = idr_find(&_minor_idr, minor); +- if (md && (md == MINOR_ALLOCED || +- (MINOR(disk_devt(dm_disk(md))) != minor) || +- dm_deleting_md(md) || +- test_bit(DMF_FREEING, &md->flags))) { +- md = NULL; +- goto out; ++ if (md) { ++ if ((md == MINOR_ALLOCED || ++ (MINOR(disk_devt(dm_disk(md))) != minor) || ++ dm_deleting_md(md) || ++ test_bit(DMF_FREEING, &md->flags))) { ++ md = NULL; ++ goto out; ++ } ++ dm_get(md); + } + + out: +@@ -2256,16 +2259,6 @@ out: + + return md; + } +- +-struct mapped_device *dm_get_md(dev_t dev) +-{ +- struct mapped_device *md = dm_find_md(dev); +- +- if (md) +- dm_get(md); +- +- return md; +-} + EXPORT_SYMBOL_GPL(dm_get_md); + + void *dm_get_mdptr(struct mapped_device *md) +@@ -2302,10 +2295,16 @@ static void __dm_destroy(struct mapped_device *md, bool wait) + set_bit(DMF_FREEING, &md->flags); + spin_unlock(&_minor_lock); + ++ /* ++ * Take suspend_lock so that presuspend and postsuspend methods ++ * do not race with internal suspend. ++ */ ++ mutex_lock(&md->suspend_lock); + if (!dm_suspended_md(md)) { + dm_table_presuspend_targets(map); + dm_table_postsuspend_targets(map); + } ++ mutex_unlock(&md->suspend_lock); + + /* + * Rare, but there may be I/O requests still going to complete, +diff --git a/drivers/mtd/ubi/misc.c b/drivers/mtd/ubi/misc.c +index f6a7d7ac4b98..b14ab4384743 100644 +--- a/drivers/mtd/ubi/misc.c ++++ b/drivers/mtd/ubi/misc.c +@@ -74,6 +74,8 @@ int ubi_check_volume(struct ubi_device *ubi, int vol_id) + for (i = 0; i < vol->used_ebs; i++) { + int size; + ++ cond_resched(); ++ + if (i == vol->used_ebs - 1) + size = vol->last_eb_bytes; + else +diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c +index 88c39e42cf5a..81a00e4d6de6 100644 +--- a/drivers/net/can/dev.c ++++ b/drivers/net/can/dev.c +@@ -475,6 +475,11 @@ struct sk_buff *alloc_can_skb(struct net_device *dev, struct can_frame **cf) + skb->protocol = htons(ETH_P_CAN); + skb->pkt_type = PACKET_BROADCAST; + skb->ip_summed = CHECKSUM_UNNECESSARY; ++ ++ skb_reset_mac_header(skb); ++ skb_reset_network_header(skb); ++ skb_reset_transport_header(skb); ++ + *cf = (struct can_frame *)skb_put(skb, sizeof(struct can_frame)); + memset(*cf, 0, sizeof(struct can_frame)); + +diff --git a/drivers/net/ethernet/amd/pcnet32.c b/drivers/net/ethernet/amd/pcnet32.c +index 86b6d8e4e6cd..d63b322c73ae 100644 +--- a/drivers/net/ethernet/amd/pcnet32.c ++++ b/drivers/net/ethernet/amd/pcnet32.c +@@ -1526,7 +1526,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev) + { + struct pcnet32_private *lp; + int i, media; +- int fdx, mii, fset, dxsuflo; ++ int fdx, mii, fset, dxsuflo, sram; + int chip_version; + char *chipname; + struct net_device *dev; +@@ -1563,7 +1563,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev) + } + + /* initialize variables */ +- fdx = mii = fset = dxsuflo = 0; ++ fdx = mii = fset = dxsuflo = sram = 0; + chip_version = (chip_version >> 12) & 0xffff; + + switch (chip_version) { +@@ -1596,6 +1596,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev) + chipname = "PCnet/FAST III 79C973"; /* PCI */ + fdx = 1; + mii = 1; ++ sram = 1; + break; + case 0x2626: + chipname = "PCnet/Home 79C978"; /* PCI */ +@@ -1619,6 +1620,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev) + chipname = "PCnet/FAST III 79C975"; /* PCI */ + fdx = 1; + mii = 1; ++ sram = 1; + break; + case 0x2628: + chipname = "PCnet/PRO 79C976"; +@@ -1647,6 +1649,31 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev) + dxsuflo = 1; + } + ++ /* ++ * The Am79C973/Am79C975 controllers come with 12K of SRAM ++ * which we can use for the Tx/Rx buffers but most importantly, ++ * the use of SRAM allow us to use the BCR18:NOUFLO bit to avoid ++ * Tx fifo underflows. ++ */ ++ if (sram) { ++ /* ++ * The SRAM is being configured in two steps. First we ++ * set the SRAM size in the BCR25:SRAM_SIZE bits. According ++ * to the datasheet, each bit corresponds to a 512-byte ++ * page so we can have at most 24 pages. The SRAM_SIZE ++ * holds the value of the upper 8 bits of the 16-bit SRAM size. ++ * The low 8-bits start at 0x00 and end at 0xff. So the ++ * address range is from 0x0000 up to 0x17ff. Therefore, ++ * the SRAM_SIZE is set to 0x17. The next step is to set ++ * the BCR26:SRAM_BND midway through so the Tx and Rx ++ * buffers can share the SRAM equally. ++ */ ++ a->write_bcr(ioaddr, 25, 0x17); ++ a->write_bcr(ioaddr, 26, 0xc); ++ /* And finally enable the NOUFLO bit */ ++ a->write_bcr(ioaddr, 18, a->read_bcr(ioaddr, 18) | (1 << 11)); ++ } ++ + dev = alloc_etherdev(sizeof(*lp)); + if (!dev) { + ret = -ENOMEM; +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +index b8e7f3e082e9..1e274e72b8f5 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +@@ -10934,6 +10934,10 @@ static int __devinit bnx2x_init_dev(struct pci_dev *pdev, + /* clean indirect addresses */ + pci_write_config_dword(bp->pdev, PCICFG_GRC_ADDRESS, + PCICFG_VENDOR_ID_OFFSET); ++ ++ /* Set PCIe reset type to fundamental for EEH recovery */ ++ pdev->needs_freset = 1; ++ + /* + * Clean the following indirect addresses for all functions since it + * is not used by the driver. +diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c +index d16800f5168a..56299e929791 100644 +--- a/drivers/net/team/team.c ++++ b/drivers/net/team/team.c +@@ -39,9 +39,7 @@ + + static struct team_port *team_port_get_rcu(const struct net_device *dev) + { +- struct team_port *port = rcu_dereference(dev->rx_handler_data); +- +- return team_port_exists(dev) ? port : NULL; ++ return rcu_dereference(dev->rx_handler_data); + } + + static struct team_port *team_port_get_rtnl(const struct net_device *dev) +diff --git a/drivers/net/wireless/ath/ath5k/reset.c b/drivers/net/wireless/ath/ath5k/reset.c +index 200f165c0c6d..2cc3f4132550 100644 +--- a/drivers/net/wireless/ath/ath5k/reset.c ++++ b/drivers/net/wireless/ath/ath5k/reset.c +@@ -476,7 +476,7 @@ ath5k_hw_wisoc_reset(struct ath5k_hw *ah, u32 flags) + regval = ioread32(reg); + iowrite32(regval | val, reg); + regval = ioread32(reg); +- usleep_range(100, 150); ++ udelay(100); /* NB: should be atomic */ + + /* Bring BB/MAC out of reset */ + iowrite32(regval & ~val, reg); +diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c +index 410018c4c528..bad4ee30728a 100644 +--- a/drivers/net/xen-netback/xenbus.c ++++ b/drivers/net/xen-netback/xenbus.c +@@ -27,6 +27,8 @@ struct backend_info { + enum xenbus_state frontend_state; + struct xenbus_watch hotplug_status_watch; + u8 have_hotplug_status_watch:1; ++ ++ const char *hotplug_script; + }; + + static int connect_rings(struct backend_info *); +@@ -45,6 +47,7 @@ static int netback_remove(struct xenbus_device *dev) + xenvif_disconnect(be->vif); + be->vif = NULL; + } ++ kfree(be->hotplug_script); + kfree(be); + dev_set_drvdata(&dev->dev, NULL); + return 0; +@@ -62,6 +65,7 @@ static int netback_probe(struct xenbus_device *dev, + struct xenbus_transaction xbt; + int err; + int sg; ++ const char *script; + struct backend_info *be = kzalloc(sizeof(struct backend_info), + GFP_KERNEL); + if (!be) { +@@ -122,6 +126,15 @@ static int netback_probe(struct xenbus_device *dev, + goto fail; + } + ++ script = xenbus_read(XBT_NIL, dev->nodename, "script", NULL); ++ if (IS_ERR(script)) { ++ err = PTR_ERR(script); ++ xenbus_dev_fatal(dev, err, "reading script"); ++ goto fail; ++ } ++ ++ be->hotplug_script = script; ++ + err = xenbus_switch_state(dev, XenbusStateInitWait); + if (err) + goto fail; +@@ -150,22 +163,14 @@ static int netback_uevent(struct xenbus_device *xdev, + struct kobj_uevent_env *env) + { + struct backend_info *be = dev_get_drvdata(&xdev->dev); +- char *val; + +- val = xenbus_read(XBT_NIL, xdev->nodename, "script", NULL); +- if (IS_ERR(val)) { +- int err = PTR_ERR(val); +- xenbus_dev_fatal(xdev, err, "reading script"); +- return err; +- } else { +- if (add_uevent_var(env, "script=%s", val)) { +- kfree(val); +- return -ENOMEM; +- } +- kfree(val); +- } ++ if (!be) ++ return 0; ++ ++ if (add_uevent_var(env, "script=%s", be->hotplug_script)) ++ return -ENOMEM; + +- if (!be || !be->vif) ++ if (!be->vif) + return 0; + + return add_uevent_var(env, "vif=%s", be->vif->dev->name); +diff --git a/drivers/pci/hotplug.c b/drivers/pci/hotplug.c +index 2b5352a7dffc..3b70f5c11df6 100644 +--- a/drivers/pci/hotplug.c ++++ b/drivers/pci/hotplug.c +@@ -27,7 +27,7 @@ int pci_uevent(struct device *dev, struct kobj_uevent_env *env) + if (add_uevent_var(env, "PCI_SLOT_NAME=%s", pci_name(pdev))) + return -ENOMEM; + +- if (add_uevent_var(env, "MODALIAS=pci:v%08Xd%08Xsv%08Xsd%08Xbc%02Xsc%02Xi%02x", ++ if (add_uevent_var(env, "MODALIAS=pci:v%08Xd%08Xsv%08Xsd%08Xbc%02Xsc%02Xi%02X", + pdev->vendor, pdev->device, + pdev->subsystem_vendor, pdev->subsystem_device, + (u8)(pdev->class >> 16), (u8)(pdev->class >> 8), +diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c +index d62ad0b1516d..868440f83939 100644 +--- a/drivers/pci/probe.c ++++ b/drivers/pci/probe.c +@@ -44,12 +44,10 @@ int no_pci_devices(void) + } + EXPORT_SYMBOL(no_pci_devices); + +-static struct pci_host_bridge *pci_host_bridge(struct pci_dev *dev) ++static struct pci_host_bridge *pci_host_bridge(struct pci_bus *bus) + { +- struct pci_bus *bus; + struct pci_host_bridge *bridge; + +- bus = dev->bus; + while (bus->parent) + bus = bus->parent; + +@@ -66,10 +64,10 @@ static bool resource_contains(struct resource *res1, struct resource *res2) + return res1->start <= res2->start && res1->end >= res2->end; + } + +-void pcibios_resource_to_bus(struct pci_dev *dev, struct pci_bus_region *region, ++void pcibios_resource_to_bus(struct pci_bus *bus, struct pci_bus_region *region, + struct resource *res) + { +- struct pci_host_bridge *bridge = pci_host_bridge(dev); ++ struct pci_host_bridge *bridge = pci_host_bridge(bus); + struct pci_host_bridge_window *window; + resource_size_t offset = 0; + +@@ -94,10 +92,10 @@ static bool region_contains(struct pci_bus_region *region1, + return region1->start <= region2->start && region1->end >= region2->end; + } + +-void pcibios_bus_to_resource(struct pci_dev *dev, struct resource *res, ++void pcibios_bus_to_resource(struct pci_bus *bus, struct resource *res, + struct pci_bus_region *region) + { +- struct pci_host_bridge *bridge = pci_host_bridge(dev); ++ struct pci_host_bridge *bridge = pci_host_bridge(bus); + struct pci_host_bridge_window *window; + struct pci_bus_region bus_region; + resource_size_t offset = 0; +@@ -298,11 +296,11 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type, + pci_write_config_dword(dev, pos + 4, 0); + region.start = 0; + region.end = sz64; +- pcibios_bus_to_resource(dev, res, ®ion); ++ pcibios_bus_to_resource(dev->bus, res, ®ion); + } else { + region.start = l64; + region.end = l64 + sz64; +- pcibios_bus_to_resource(dev, res, ®ion); ++ pcibios_bus_to_resource(dev->bus, res, ®ion); + dev_printk(KERN_DEBUG, &dev->dev, "reg %x: %pR\n", + pos, res); + } +@@ -314,7 +312,7 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type, + + region.start = l; + region.end = l + sz; +- pcibios_bus_to_resource(dev, res, ®ion); ++ pcibios_bus_to_resource(dev->bus, res, ®ion); + + dev_printk(KERN_DEBUG, &dev->dev, "reg %x: %pR\n", pos, res); + } +@@ -373,7 +371,7 @@ static void __devinit pci_read_bridge_io(struct pci_bus *child) + res2.flags = res->flags; + region.start = base; + region.end = limit + 0xfff; +- pcibios_bus_to_resource(dev, &res2, ®ion); ++ pcibios_bus_to_resource(dev->bus, &res2, ®ion); + if (!res->start) + res->start = res2.start; + if (!res->end) +@@ -399,7 +397,7 @@ static void __devinit pci_read_bridge_mmio(struct pci_bus *child) + res->flags = (mem_base_lo & PCI_MEMORY_RANGE_TYPE_MASK) | IORESOURCE_MEM; + region.start = base; + region.end = limit + 0xfffff; +- pcibios_bus_to_resource(dev, res, ®ion); ++ pcibios_bus_to_resource(dev->bus, res, ®ion); + dev_printk(KERN_DEBUG, &dev->dev, " bridge window %pR\n", res); + } + } +@@ -448,7 +446,7 @@ static void __devinit pci_read_bridge_mmio_pref(struct pci_bus *child) + res->flags |= IORESOURCE_MEM_64; + region.start = base; + region.end = limit + 0xfffff; +- pcibios_bus_to_resource(dev, res, ®ion); ++ pcibios_bus_to_resource(dev->bus, res, ®ion); + dev_printk(KERN_DEBUG, &dev->dev, " bridge window %pR\n", res); + } + } +@@ -1063,24 +1061,24 @@ int pci_setup_device(struct pci_dev *dev) + region.end = 0x1F7; + res = &dev->resource[0]; + res->flags = LEGACY_IO_RESOURCE; +- pcibios_bus_to_resource(dev, res, ®ion); ++ pcibios_bus_to_resource(dev->bus, res, ®ion); + region.start = 0x3F6; + region.end = 0x3F6; + res = &dev->resource[1]; + res->flags = LEGACY_IO_RESOURCE; +- pcibios_bus_to_resource(dev, res, ®ion); ++ pcibios_bus_to_resource(dev->bus, res, ®ion); + } + if ((progif & 4) == 0) { + region.start = 0x170; + region.end = 0x177; + res = &dev->resource[2]; + res->flags = LEGACY_IO_RESOURCE; +- pcibios_bus_to_resource(dev, res, ®ion); ++ pcibios_bus_to_resource(dev->bus, res, ®ion); + region.start = 0x376; + region.end = 0x376; + res = &dev->resource[3]; + res->flags = LEGACY_IO_RESOURCE; +- pcibios_bus_to_resource(dev, res, ®ion); ++ pcibios_bus_to_resource(dev->bus, res, ®ion); + } + } + break; +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index ffde183ac1b3..c0300242db86 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -393,7 +393,7 @@ static void __devinit quirk_io_region(struct pci_dev *dev, unsigned region, + /* Convert from PCI bus to resource space. */ + bus_region.start = res->start; + bus_region.end = res->end; +- pcibios_bus_to_resource(dev, res, &bus_region); ++ pcibios_bus_to_resource(dev->bus, res, &bus_region); + + if (pci_claim_resource(dev, nr) == 0) + dev_info(&dev->dev, "quirk: %pR claimed by %s\n", +diff --git a/drivers/pci/rom.c b/drivers/pci/rom.c +index 48ebdb237f3f..336b999a716d 100644 +--- a/drivers/pci/rom.c ++++ b/drivers/pci/rom.c +@@ -31,7 +31,7 @@ int pci_enable_rom(struct pci_dev *pdev) + if (!res->flags) + return -1; + +- pcibios_resource_to_bus(pdev, ®ion, res); ++ pcibios_resource_to_bus(pdev->bus, ®ion, res); + pci_read_config_dword(pdev, pdev->rom_base_reg, &rom_addr); + rom_addr &= ~PCI_ROM_ADDRESS_MASK; + rom_addr |= region.start | PCI_ROM_ADDRESS_ENABLE; +@@ -69,6 +69,7 @@ size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, size_t size) + { + void __iomem *image; + int last_image; ++ unsigned length; + + image = rom; + do { +@@ -91,9 +92,9 @@ size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, size_t size) + if (readb(pds + 3) != 'R') + break; + last_image = readb(pds + 21) & 0x80; +- /* this length is reliable */ +- image += readw(pds + 16) * 512; +- } while (!last_image); ++ length = readw(pds + 16); ++ image += length * 512; ++ } while (length && !last_image); + + /* never return a size larger than the PCI resource window */ + /* there are known ROMs that get the size wrong */ +diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c +index 8fa2d4be88de..244ada411369 100644 +--- a/drivers/pci/setup-bus.c ++++ b/drivers/pci/setup-bus.c +@@ -408,7 +408,7 @@ void pci_setup_cardbus(struct pci_bus *bus) + bus->secondary, bus->subordinate); + + res = bus->resource[0]; +- pcibios_resource_to_bus(bridge, ®ion, res); ++ pcibios_resource_to_bus(bridge->bus, ®ion, res); + if (res->flags & IORESOURCE_IO) { + /* + * The IO resource is allocated a range twice as large as it +@@ -422,7 +422,7 @@ void pci_setup_cardbus(struct pci_bus *bus) + } + + res = bus->resource[1]; +- pcibios_resource_to_bus(bridge, ®ion, res); ++ pcibios_resource_to_bus(bridge->bus, ®ion, res); + if (res->flags & IORESOURCE_IO) { + dev_info(&bridge->dev, " bridge window %pR\n", res); + pci_write_config_dword(bridge, PCI_CB_IO_BASE_1, +@@ -432,7 +432,7 @@ void pci_setup_cardbus(struct pci_bus *bus) + } + + res = bus->resource[2]; +- pcibios_resource_to_bus(bridge, ®ion, res); ++ pcibios_resource_to_bus(bridge->bus, ®ion, res); + if (res->flags & IORESOURCE_MEM) { + dev_info(&bridge->dev, " bridge window %pR\n", res); + pci_write_config_dword(bridge, PCI_CB_MEMORY_BASE_0, +@@ -442,7 +442,7 @@ void pci_setup_cardbus(struct pci_bus *bus) + } + + res = bus->resource[3]; +- pcibios_resource_to_bus(bridge, ®ion, res); ++ pcibios_resource_to_bus(bridge->bus, ®ion, res); + if (res->flags & IORESOURCE_MEM) { + dev_info(&bridge->dev, " bridge window %pR\n", res); + pci_write_config_dword(bridge, PCI_CB_MEMORY_BASE_1, +@@ -473,7 +473,7 @@ static void pci_setup_bridge_io(struct pci_bus *bus) + + /* Set up the top and bottom of the PCI I/O segment for this bus. */ + res = bus->resource[0]; +- pcibios_resource_to_bus(bridge, ®ion, res); ++ pcibios_resource_to_bus(bridge->bus, ®ion, res); + if (res->flags & IORESOURCE_IO) { + pci_read_config_dword(bridge, PCI_IO_BASE, &l); + l &= 0xffff0000; +@@ -504,7 +504,7 @@ static void pci_setup_bridge_mmio(struct pci_bus *bus) + + /* Set up the top and bottom of the PCI Memory segment for this bus. */ + res = bus->resource[1]; +- pcibios_resource_to_bus(bridge, ®ion, res); ++ pcibios_resource_to_bus(bridge->bus, ®ion, res); + if (res->flags & IORESOURCE_MEM) { + l = (region.start >> 16) & 0xfff0; + l |= region.end & 0xfff00000; +@@ -530,7 +530,7 @@ static void pci_setup_bridge_mmio_pref(struct pci_bus *bus) + /* Set up PREF base/limit. */ + bu = lu = 0; + res = bus->resource[2]; +- pcibios_resource_to_bus(bridge, ®ion, res); ++ pcibios_resource_to_bus(bridge->bus, ®ion, res); + if (res->flags & IORESOURCE_PREFETCH) { + l = (region.start >> 16) & 0xfff0; + l |= region.end & 0xfff00000; +diff --git a/drivers/pci/setup-res.c b/drivers/pci/setup-res.c +index be76ebacf486..d427277e43ec 100644 +--- a/drivers/pci/setup-res.c ++++ b/drivers/pci/setup-res.c +@@ -50,7 +50,7 @@ void pci_update_resource(struct pci_dev *dev, int resno) + if (res->flags & IORESOURCE_PCI_FIXED) + return; + +- pcibios_resource_to_bus(dev, ®ion, res); ++ pcibios_resource_to_bus(dev->bus, ®ion, res); + + new = region.start | (res->flags & PCI_REGION_FLAG_MASK); + if (res->flags & IORESOURCE_IO) +diff --git a/drivers/pcmcia/i82092.c b/drivers/pcmcia/i82092.c +index 4e8831bdb6ef..099034b39812 100644 +--- a/drivers/pcmcia/i82092.c ++++ b/drivers/pcmcia/i82092.c +@@ -610,7 +610,7 @@ static int i82092aa_set_mem_map(struct pcmcia_socket *socket, struct pccard_mem_ + + enter("i82092aa_set_mem_map"); + +- pcibios_resource_to_bus(sock_info->dev, ®ion, mem->res); ++ pcibios_resource_to_bus(sock_info->dev->bus, ®ion, mem->res); + + map = mem->map; + if (map > 4) { +diff --git a/drivers/pcmcia/yenta_socket.c b/drivers/pcmcia/yenta_socket.c +index d07f9ac8c41d..13e76f9bdbcf 100644 +--- a/drivers/pcmcia/yenta_socket.c ++++ b/drivers/pcmcia/yenta_socket.c +@@ -445,7 +445,7 @@ static int yenta_set_mem_map(struct pcmcia_socket *sock, struct pccard_mem_map * + unsigned int start, stop, card_start; + unsigned short word; + +- pcibios_resource_to_bus(socket->dev, ®ion, mem->res); ++ pcibios_resource_to_bus(socket->dev->bus, ®ion, mem->res); + + map = mem->map; + start = region.start; +@@ -709,7 +709,7 @@ static int yenta_allocate_res(struct yenta_socket *socket, int nr, unsigned type + region.start = config_readl(socket, addr_start) & mask; + region.end = config_readl(socket, addr_end) | ~mask; + if (region.start && region.end > region.start && !override_bios) { +- pcibios_bus_to_resource(dev, res, ®ion); ++ pcibios_bus_to_resource(dev->bus, res, ®ion); + if (pci_claim_resource(dev, PCI_BRIDGE_RESOURCES + nr) == 0) + return 0; + dev_printk(KERN_INFO, &dev->dev, +@@ -1033,7 +1033,7 @@ static void yenta_config_init(struct yenta_socket *socket) + struct pci_dev *dev = socket->dev; + struct pci_bus_region region; + +- pcibios_resource_to_bus(socket->dev, ®ion, &dev->resource[0]); ++ pcibios_resource_to_bus(socket->dev->bus, ®ion, &dev->resource[0]); + + config_writel(socket, CB_LEGACY_MODE_BASE, 0); + config_writel(socket, PCI_BASE_ADDRESS_0, region.start); +diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c +index 375756fa95cf..348560a0a4c8 100644 +--- a/drivers/scsi/be2iscsi/be_main.c ++++ b/drivers/scsi/be2iscsi/be_main.c +@@ -424,7 +424,6 @@ static struct beiscsi_hba *beiscsi_hba_alloc(struct pci_dev *pcidev) + "iscsi_host_alloc failed\n"); + return NULL; + } +- shost->dma_boundary = pcidev->dma_mask; + shost->max_id = BE2_MAX_SESSIONS; + shost->max_channel = 0; + shost->max_cmd_len = BEISCSI_MAX_CMD_LEN; +@@ -4399,9 +4398,9 @@ free_port: + hba_free: + if (phba->msix_enabled) + pci_disable_msix(phba->pcidev); +- iscsi_host_remove(phba->shost); + pci_dev_put(phba->pcidev); + iscsi_host_free(phba->shost); ++ pci_set_drvdata(pcidev, NULL); + disable_pci: + pci_disable_device(pcidev); + return ret; +diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c +index bc88cabcfd43..f5ccdcdf2cab 100644 +--- a/drivers/scsi/hpsa.c ++++ b/drivers/scsi/hpsa.c +@@ -3507,10 +3507,6 @@ static __devinit int hpsa_kdump_hard_reset_controller(struct pci_dev *pdev) + + /* Save the PCI command register */ + pci_read_config_word(pdev, 4, &command_register); +- /* Turn the board off. This is so that later pci_restore_state() +- * won't turn the board on before the rest of config space is ready. +- */ +- pci_disable_device(pdev); + pci_save_state(pdev); + + /* find the first memory BAR, so we can find the cfg table */ +@@ -3534,7 +3530,7 @@ static __devinit int hpsa_kdump_hard_reset_controller(struct pci_dev *pdev) + } + rc = write_driver_ver_to_cfgtable(cfgtable); + if (rc) +- goto unmap_vaddr; ++ goto unmap_cfgtable; + + /* If reset via doorbell register is supported, use that. + * There are two such methods. Favor the newest method. +@@ -3558,11 +3554,6 @@ static __devinit int hpsa_kdump_hard_reset_controller(struct pci_dev *pdev) + goto unmap_cfgtable; + + pci_restore_state(pdev); +- rc = pci_enable_device(pdev); +- if (rc) { +- dev_warn(&pdev->dev, "failed to enable device.\n"); +- goto unmap_cfgtable; +- } + pci_write_config_word(pdev, 4, command_register); + + /* Some devices (notably the HP Smart Array 5i Controller) +@@ -4064,10 +4055,37 @@ static void __devinit hpsa_hba_inquiry(struct ctlr_info *h) + static __devinit int hpsa_init_reset_devices(struct pci_dev *pdev) + { + int rc, i; ++ void __iomem *vaddr; + + if (!reset_devices) + return 0; + ++ /* kdump kernel is loading, we don't know in which state is ++ * the pci interface. The dev->enable_cnt is equal zero ++ * so we call enable+disable, wait a while and switch it on. ++ */ ++ rc = pci_enable_device(pdev); ++ if (rc) { ++ dev_warn(&pdev->dev, "Failed to enable PCI device\n"); ++ return -ENODEV; ++ } ++ pci_disable_device(pdev); ++ msleep(260); /* a randomly chosen number */ ++ rc = pci_enable_device(pdev); ++ if (rc) { ++ dev_warn(&pdev->dev, "failed to enable device.\n"); ++ return -ENODEV; ++ } ++ pci_set_master(pdev); ++ ++ vaddr = pci_ioremap_bar(pdev, 0); ++ if (vaddr == NULL) { ++ rc = -ENOMEM; ++ goto out_disable; ++ } ++ writel(SA5_INTR_OFF, vaddr + SA5_REPLY_INTR_MASK_OFFSET); ++ iounmap(vaddr); ++ + /* Reset the controller with a PCI power-cycle or via doorbell */ + rc = hpsa_kdump_hard_reset_controller(pdev); + +@@ -4076,10 +4094,11 @@ static __devinit int hpsa_init_reset_devices(struct pci_dev *pdev) + * "performant mode". Or, it might be 640x, which can't reset + * due to concerns about shared bbwc between 6402/6404 pair. + */ +- if (rc == -ENOTSUPP) +- return rc; /* just try to do the kdump anyhow. */ +- if (rc) +- return -ENODEV; ++ if (rc) { ++ if (rc != -ENOTSUPP) /* just try to do the kdump anyhow. */ ++ rc = -ENODEV; ++ goto out_disable; ++ } + + /* Now try to get the controller to respond to a no-op */ + dev_warn(&pdev->dev, "Waiting for controller to respond to no-op\n"); +@@ -4090,7 +4109,11 @@ static __devinit int hpsa_init_reset_devices(struct pci_dev *pdev) + dev_warn(&pdev->dev, "no-op failed%s\n", + (i < 11 ? "; re-trying" : "")); + } +- return 0; ++ ++out_disable: ++ ++ pci_disable_device(pdev); ++ return rc; + } + + static __devinit int hpsa_allocate_cmd_pool(struct ctlr_info *h) +@@ -4191,6 +4214,7 @@ static void hpsa_undo_allocations_after_kdump_soft_reset(struct ctlr_info *h) + iounmap(h->transtable); + if (h->cfgtable) + iounmap(h->cfgtable); ++ pci_disable_device(h->pdev); + pci_release_regions(h->pdev); + kfree(h); + } +diff --git a/drivers/scsi/libsas/sas_discover.c b/drivers/scsi/libsas/sas_discover.c +index 629a0865b130..5fbacde78d85 100644 +--- a/drivers/scsi/libsas/sas_discover.c ++++ b/drivers/scsi/libsas/sas_discover.c +@@ -446,6 +446,7 @@ static void sas_revalidate_domain(struct work_struct *work) + struct sas_discovery_event *ev = to_sas_discovery_event(work); + struct asd_sas_port *port = ev->port; + struct sas_ha_struct *ha = port->ha; ++ struct domain_device *ddev = port->port_dev; + + /* prevent revalidation from finding sata links in recovery */ + mutex_lock(&ha->disco_mutex); +@@ -460,8 +461,9 @@ static void sas_revalidate_domain(struct work_struct *work) + SAS_DPRINTK("REVALIDATING DOMAIN on port %d, pid:%d\n", port->id, + task_pid_nr(current)); + +- if (port->port_dev) +- res = sas_ex_revalidate_domain(port->port_dev); ++ if (ddev && (ddev->dev_type == SAS_FANOUT_EXPANDER_DEVICE || ++ ddev->dev_type == SAS_EDGE_EXPANDER_DEVICE)) ++ res = sas_ex_revalidate_domain(ddev); + + SAS_DPRINTK("done REVALIDATING DOMAIN on port %d, pid:%d, res 0x%x\n", + port->id, task_pid_nr(current), res); +diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c +index ac99b46dc4a4..a30f7a06ee41 100644 +--- a/drivers/scsi/scsi_lib.c ++++ b/drivers/scsi/scsi_lib.c +@@ -1209,9 +1209,11 @@ int scsi_prep_state_check(struct scsi_device *sdev, struct request *req) + "rejecting I/O to dead device\n"); + ret = BLKPREP_KILL; + break; +- case SDEV_QUIESCE: + case SDEV_BLOCK: + case SDEV_CREATED_BLOCK: ++ ret = BLKPREP_DEFER; ++ break; ++ case SDEV_QUIESCE: + /* + * If the devices is blocked we defer normal commands. + */ +diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c +index eacd46bb36b9..fb119ce06ae5 100644 +--- a/drivers/scsi/sg.c ++++ b/drivers/scsi/sg.c +@@ -498,7 +498,7 @@ static ssize_t + sg_new_read(Sg_fd * sfp, char __user *buf, size_t count, Sg_request * srp) + { + sg_io_hdr_t *hp = &srp->header; +- int err = 0; ++ int err = 0, err2; + int len; + + if (count < SZ_SG_IO_HDR) { +@@ -527,8 +527,8 @@ sg_new_read(Sg_fd * sfp, char __user *buf, size_t count, Sg_request * srp) + goto err_out; + } + err_out: +- err = sg_finish_rem_req(srp); +- return (0 == err) ? count : err; ++ err2 = sg_finish_rem_req(srp); ++ return err ? : err2 ? : count; + } + + static ssize_t +diff --git a/drivers/scsi/sym53c8xx_2/sym_glue.c b/drivers/scsi/sym53c8xx_2/sym_glue.c +index 36d1ed7817eb..1e3d7891b72c 100644 +--- a/drivers/scsi/sym53c8xx_2/sym_glue.c ++++ b/drivers/scsi/sym53c8xx_2/sym_glue.c +@@ -1609,7 +1609,7 @@ sym_iomap_device(struct sym_device *device) + struct pci_bus_region bus_addr; + int i = 2; + +- pcibios_resource_to_bus(pdev, &bus_addr, &pdev->resource[1]); ++ pcibios_resource_to_bus(pdev->bus, &bus_addr, &pdev->resource[1]); + device->mmio_base = bus_addr.start; + + if (device->chip.features & FE_RAM) { +@@ -1619,7 +1619,8 @@ sym_iomap_device(struct sym_device *device) + */ + if (!pdev->resource[i].flags) + i++; +- pcibios_resource_to_bus(pdev, &bus_addr, &pdev->resource[i]); ++ pcibios_resource_to_bus(pdev->bus, &bus_addr, ++ &pdev->resource[i]); + device->ram_base = bus_addr.start; + } + +diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c +index 830adbed1d7a..1556db966188 100644 +--- a/drivers/spi/spidev.c ++++ b/drivers/spi/spidev.c +@@ -241,7 +241,10 @@ static int spidev_message(struct spidev_data *spidev, + k_tmp->len = u_tmp->len; + + total += k_tmp->len; +- if (total > bufsiz) { ++ /* Check total length of transfers. Also check each ++ * transfer length to avoid arithmetic overflow. ++ */ ++ if (total > bufsiz || k_tmp->len > bufsiz) { + status = -EMSGSIZE; + goto done; + } +diff --git a/drivers/staging/comedi/comedi_compat32.c b/drivers/staging/comedi/comedi_compat32.c +index 41a7a62ba49a..a8a0c0f8b24c 100644 +--- a/drivers/staging/comedi/comedi_compat32.c ++++ b/drivers/staging/comedi/comedi_compat32.c +@@ -271,7 +271,7 @@ static int compat_cmd(struct file *file, unsigned long arg) + { + struct comedi_cmd __user *cmd; + struct comedi32_cmd_struct __user *cmd32; +- int rc; ++ int rc, err; + + cmd32 = compat_ptr(arg); + cmd = compat_alloc_user_space(sizeof(*cmd)); +@@ -280,7 +280,15 @@ static int compat_cmd(struct file *file, unsigned long arg) + if (rc) + return rc; + +- return translated_ioctl(file, COMEDI_CMD, (unsigned long)cmd); ++ rc = translated_ioctl(file, COMEDI_CMD, (unsigned long)cmd); ++ if (rc == -EAGAIN) { ++ /* Special case: copy cmd back to user. */ ++ err = put_compat_cmd(cmd32, cmd); ++ if (err) ++ rc = err; ++ } ++ ++ return rc; + } + + /* Handle 32-bit COMEDI_CMDTEST ioctl. */ +diff --git a/drivers/staging/vt6655/rf.c b/drivers/staging/vt6655/rf.c +index b8ec783e55e0..30033635317c 100644 +--- a/drivers/staging/vt6655/rf.c ++++ b/drivers/staging/vt6655/rf.c +@@ -1029,6 +1029,7 @@ unsigned char byPwrdBm = 0; + break; + case RATE_6M: + case RATE_9M: ++ case RATE_12M: + case RATE_18M: + byPwr = pDevice->abyOFDMPwrTbl[uCH]; + if (pDevice->byRFType == RF_UW2452) { +diff --git a/drivers/target/iscsi/iscsi_target_tq.c b/drivers/target/iscsi/iscsi_target_tq.c +index 977e1cf90e83..4f447fd39779 100644 +--- a/drivers/target/iscsi/iscsi_target_tq.c ++++ b/drivers/target/iscsi/iscsi_target_tq.c +@@ -26,36 +26,22 @@ + #include "iscsi_target_tq.h" + #include "iscsi_target.h" + +-static LIST_HEAD(active_ts_list); + static LIST_HEAD(inactive_ts_list); +-static DEFINE_SPINLOCK(active_ts_lock); + static DEFINE_SPINLOCK(inactive_ts_lock); + static DEFINE_SPINLOCK(ts_bitmap_lock); + +-static void iscsi_add_ts_to_active_list(struct iscsi_thread_set *ts) +-{ +- spin_lock(&active_ts_lock); +- list_add_tail(&ts->ts_list, &active_ts_list); +- iscsit_global->active_ts++; +- spin_unlock(&active_ts_lock); +-} +- + extern void iscsi_add_ts_to_inactive_list(struct iscsi_thread_set *ts) + { ++ if (!list_empty(&ts->ts_list)) { ++ WARN_ON(1); ++ return; ++ } + spin_lock(&inactive_ts_lock); + list_add_tail(&ts->ts_list, &inactive_ts_list); + iscsit_global->inactive_ts++; + spin_unlock(&inactive_ts_lock); + } + +-static void iscsi_del_ts_from_active_list(struct iscsi_thread_set *ts) +-{ +- spin_lock(&active_ts_lock); +- list_del(&ts->ts_list); +- iscsit_global->active_ts--; +- spin_unlock(&active_ts_lock); +-} +- + static struct iscsi_thread_set *iscsi_get_ts_from_inactive_list(void) + { + struct iscsi_thread_set *ts; +@@ -69,7 +55,7 @@ static struct iscsi_thread_set *iscsi_get_ts_from_inactive_list(void) + list_for_each_entry(ts, &inactive_ts_list, ts_list) + break; + +- list_del(&ts->ts_list); ++ list_del_init(&ts->ts_list); + iscsit_global->inactive_ts--; + spin_unlock(&inactive_ts_lock); + +@@ -220,8 +206,6 @@ static void iscsi_deallocate_extra_thread_sets(void) + + void iscsi_activate_thread_set(struct iscsi_conn *conn, struct iscsi_thread_set *ts) + { +- iscsi_add_ts_to_active_list(ts); +- + spin_lock_bh(&ts->ts_state_lock); + conn->thread_set = ts; + ts->conn = conn; +@@ -424,7 +408,6 @@ struct iscsi_conn *iscsi_rx_thread_pre_handler(struct iscsi_thread_set *ts) + + if (ts->delay_inactive && (--ts->thread_count == 0)) { + spin_unlock_bh(&ts->ts_state_lock); +- iscsi_del_ts_from_active_list(ts); + + if (!iscsit_global->in_shutdown) + iscsi_deallocate_extra_thread_sets(); +@@ -477,7 +460,6 @@ struct iscsi_conn *iscsi_tx_thread_pre_handler(struct iscsi_thread_set *ts) + + if (ts->delay_inactive && (--ts->thread_count == 0)) { + spin_unlock_bh(&ts->ts_state_lock); +- iscsi_del_ts_from_active_list(ts); + + if (!iscsit_global->in_shutdown) + iscsi_deallocate_extra_thread_sets(); +diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c +index d34577dbfd25..808267456eed 100644 +--- a/drivers/target/target_core_pscsi.c ++++ b/drivers/target/target_core_pscsi.c +@@ -1165,7 +1165,7 @@ static u32 pscsi_get_device_type(struct se_device *dev) + struct pscsi_dev_virt *pdv = dev->dev_ptr; + struct scsi_device *sd = pdv->pdv_sd; + +- return sd->type; ++ return (sd) ? sd->type : TYPE_NO_LUN; + } + + static sector_t pscsi_get_blocks(struct se_device *dev) +diff --git a/drivers/target/tcm_fc/tfc_io.c b/drivers/target/tcm_fc/tfc_io.c +index dc7c0db26e20..8d5cf53886e9 100644 +--- a/drivers/target/tcm_fc/tfc_io.c ++++ b/drivers/target/tcm_fc/tfc_io.c +@@ -330,7 +330,7 @@ void ft_invl_hw_context(struct ft_cmd *cmd) + ep = fc_seq_exch(seq); + if (ep) { + lport = ep->lp; +- if (lport && (ep->xid <= lport->lro_xid)) ++ if (lport && (ep->xid <= lport->lro_xid)) { + /* + * "ddp_done" trigger invalidation of HW + * specific DDP context +@@ -345,6 +345,7 @@ void ft_invl_hw_context(struct ft_cmd *cmd) + * identified using ep->xid) + */ + cmd->was_ddp_setup = 0; ++ } + } + } + } +diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c +index cf9a1911d4ab..bc955d7a1d00 100644 +--- a/drivers/tty/pty.c ++++ b/drivers/tty/pty.c +@@ -173,6 +173,9 @@ static int pty_signal(struct tty_struct *tty, int sig) + unsigned long flags; + struct pid *pgrp; + ++ if (sig != SIGINT && sig != SIGQUIT && sig != SIGTSTP) ++ return -EINVAL; ++ + if (tty->link) { + spin_lock_irqsave(&tty->link->ctrl_lock, flags); + pgrp = get_pid(tty->link->pgrp); +diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c +index 6f8f985e7805..e4aada5b4954 100644 +--- a/drivers/tty/serial/8250/8250_pci.c ++++ b/drivers/tty/serial/8250/8250_pci.c +@@ -67,7 +67,7 @@ static void moan_device(const char *str, struct pci_dev *dev) + "Please send the output of lspci -vv, this\n" + "message (0x%04x,0x%04x,0x%04x,0x%04x), the\n" + "manufacturer and name of serial board or\n" +- "modem board to rmk+serial@arm.linux.org.uk.\n", ++ "modem board to .\n", + pci_name(dev), str, dev->vendor, dev->device, + dev->subsystem_vendor, dev->subsystem_device); + } +diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c +index a07eb4c068a0..5f0b4a445b97 100644 +--- a/drivers/tty/tty_io.c ++++ b/drivers/tty/tty_io.c +@@ -941,8 +941,8 @@ EXPORT_SYMBOL(start_tty); + /* We limit tty time update visibility to every 8 seconds or so. */ + static void tty_update_time(struct timespec *time) + { +- unsigned long sec = get_seconds() & ~7; +- if ((long)(sec - time->tv_sec) > 0) ++ unsigned long sec = get_seconds(); ++ if (abs(sec - time->tv_sec) & ~7) + time->tv_sec = sec; + } + +diff --git a/drivers/tty/tty_ioctl.c b/drivers/tty/tty_ioctl.c +index f8d03da536dd..9ab33c729f02 100644 +--- a/drivers/tty/tty_ioctl.c ++++ b/drivers/tty/tty_ioctl.c +@@ -153,11 +153,17 @@ void tty_wait_until_sent(struct tty_struct *tty, long timeout) + #endif + if (!timeout) + timeout = MAX_SCHEDULE_TIMEOUT; ++ + if (wait_event_interruptible_timeout(tty->write_wait, +- !tty_chars_in_buffer(tty), timeout) >= 0) { +- if (tty->ops->wait_until_sent) +- tty->ops->wait_until_sent(tty, timeout); ++ !tty_chars_in_buffer(tty), timeout) < 0) { ++ return; + } ++ ++ if (timeout == MAX_SCHEDULE_TIMEOUT) ++ timeout = 0; ++ ++ if (tty->ops->wait_until_sent) ++ tty->ops->wait_until_sent(tty, timeout); + } + EXPORT_SYMBOL(tty_wait_until_sent); + +diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c +index 268294c71c11..334a7b279c49 100644 +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -498,6 +498,7 @@ void invert_screen(struct vc_data *vc, int offset, int count, int viewed) + #endif + if (DO_UPDATE(vc)) + do_update_region(vc, (unsigned long) p, count); ++ notify_update(vc); + } + + /* used by selection: complement pointer position */ +@@ -514,6 +515,7 @@ void complement_pos(struct vc_data *vc, int offset) + scr_writew(old, screenpos(vc, old_offset, 1)); + if (DO_UPDATE(vc)) + vc->vc_sw->con_putc(vc, old, oldy, oldx); ++ notify_update(vc); + } + + old_offset = offset; +@@ -531,8 +533,8 @@ void complement_pos(struct vc_data *vc, int offset) + oldy = (offset >> 1) / vc->vc_cols; + vc->vc_sw->con_putc(vc, new, oldy, oldx); + } ++ notify_update(vc); + } +- + } + + static void insert_char(struct vc_data *vc, unsigned int nr) +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index 05325773ab94..25bc1d6e7d58 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -1008,6 +1008,7 @@ static int acm_probe(struct usb_interface *intf, + unsigned long quirks; + int num_rx_buf; + int i; ++ unsigned int elength = 0; + int combined_interfaces = 0; + + /* normal quirks */ +@@ -1043,6 +1044,12 @@ static int acm_probe(struct usb_interface *intf, + } + + while (buflen > 0) { ++ elength = buffer[0]; ++ if (!elength) { ++ dev_err(&intf->dev, "skipping garbage byte\n"); ++ elength = 1; ++ goto next_desc; ++ } + if (buffer[1] != USB_DT_CS_INTERFACE) { + dev_err(&intf->dev, "skipping garbage\n"); + goto next_desc; +@@ -1050,6 +1057,8 @@ static int acm_probe(struct usb_interface *intf, + + switch (buffer[2]) { + case USB_CDC_UNION_TYPE: /* we've found it */ ++ if (elength < sizeof(struct usb_cdc_union_desc)) ++ goto next_desc; + if (union_header) { + dev_err(&intf->dev, "More than one " + "union descriptor, skipping ...\n"); +@@ -1058,31 +1067,38 @@ static int acm_probe(struct usb_interface *intf, + union_header = (struct usb_cdc_union_desc *)buffer; + break; + case USB_CDC_COUNTRY_TYPE: /* export through sysfs*/ ++ if (elength < sizeof(struct usb_cdc_country_functional_desc)) ++ goto next_desc; + cfd = (struct usb_cdc_country_functional_desc *)buffer; + break; + case USB_CDC_HEADER_TYPE: /* maybe check version */ + break; /* for now we ignore it */ + case USB_CDC_ACM_TYPE: ++ if (elength < 4) ++ goto next_desc; + ac_management_function = buffer[3]; + break; + case USB_CDC_CALL_MANAGEMENT_TYPE: ++ if (elength < 5) ++ goto next_desc; + call_management_function = buffer[3]; + call_interface_num = buffer[4]; + if ( (quirks & NOT_A_MODEM) == 0 && (call_management_function & 3) != 3) + dev_err(&intf->dev, "This device cannot do calls on its own. It is not a modem.\n"); + break; + default: +- /* there are LOTS more CDC descriptors that ++ /* ++ * there are LOTS more CDC descriptors that + * could legitimately be found here. + */ + dev_dbg(&intf->dev, "Ignoring descriptor: " +- "type %02x, length %d\n", +- buffer[2], buffer[0]); ++ "type %02x, length %ud\n", ++ buffer[2], elength); + break; + } + next_desc: +- buflen -= buffer[0]; +- buffer += buffer[0]; ++ buflen -= elength; ++ buffer += elength; + } + + if (!union_header) { +diff --git a/drivers/usb/core/buffer.c b/drivers/usb/core/buffer.c +index b0585e623ba9..19fa68a732f3 100644 +--- a/drivers/usb/core/buffer.c ++++ b/drivers/usb/core/buffer.c +@@ -22,17 +22,25 @@ + */ + + /* FIXME tune these based on pool statistics ... */ +-static const size_t pool_max[HCD_BUFFER_POOLS] = { +- /* platforms without dma-friendly caches might need to +- * prevent cacheline sharing... +- */ +- 32, +- 128, +- 512, +- PAGE_SIZE / 2 +- /* bigger --> allocate pages */ ++static size_t pool_max[HCD_BUFFER_POOLS] = { ++ 32, 128, 512, 2048, + }; + ++void __init usb_init_pool_max(void) ++{ ++ /* ++ * The pool_max values must never be smaller than ++ * ARCH_KMALLOC_MINALIGN. ++ */ ++ if (ARCH_KMALLOC_MINALIGN <= 32) ++ ; /* Original value is okay */ ++ else if (ARCH_KMALLOC_MINALIGN <= 64) ++ pool_max[0] = 64; ++ else if (ARCH_KMALLOC_MINALIGN <= 128) ++ pool_max[0] = 0; /* Don't use this pool */ ++ else ++ BUILD_BUG(); /* We don't allow this */ ++} + + /* SETUP primitives */ + +diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c +index 371fe69caba6..d2ae3d94b58b 100644 +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -444,6 +444,7 @@ static void async_completed(struct urb *urb) + as->status = urb->status; + signr = as->signr; + if (signr) { ++ memset(&sinfo, 0, sizeof(sinfo)); + sinfo.si_signo = as->signr; + sinfo.si_errno = as->status; + sinfo.si_code = SI_ASYNCIO; +@@ -2091,6 +2092,7 @@ static void usbdev_remove(struct usb_device *udev) + wake_up_all(&ps->wait); + list_del_init(&ps->list); + if (ps->discsignr) { ++ memset(&sinfo, 0, sizeof(sinfo)); + sinfo.si_signo = ps->discsignr; + sinfo.si_errno = EPIPE; + sinfo.si_code = SI_ASYNCIO; +diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c +index 35bc3baa8427..621ea00feeb6 100644 +--- a/drivers/usb/core/driver.c ++++ b/drivers/usb/core/driver.c +@@ -1686,6 +1686,18 @@ static int autosuspend_check(struct usb_device *udev) + dev_dbg(&udev->dev, "remote wakeup needed for autosuspend\n"); + return -EOPNOTSUPP; + } ++ ++ /* ++ * If the device is a direct child of the root hub and the HCD ++ * doesn't handle wakeup requests, don't allow autosuspend when ++ * wakeup is needed. ++ */ ++ if (w && udev->parent == udev->bus->root_hub && ++ bus_to_hcd(udev->bus)->cant_recv_wakeups) { ++ dev_dbg(&udev->dev, "HCD doesn't handle wakeup requests\n"); ++ return -EOPNOTSUPP; ++ } ++ + udev->do_remote_wakeup = w; + return 0; + } +diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c +index 6baeada782eb..f1d0e3ca46b5 100644 +--- a/drivers/usb/core/hcd.c ++++ b/drivers/usb/core/hcd.c +@@ -1528,6 +1528,7 @@ static int unlink1(struct usb_hcd *hcd, struct urb *urb, int status) + int usb_hcd_unlink_urb (struct urb *urb, int status) + { + struct usb_hcd *hcd; ++ struct usb_device *udev = urb->dev; + int retval = -EIDRM; + unsigned long flags; + +@@ -1539,20 +1540,19 @@ int usb_hcd_unlink_urb (struct urb *urb, int status) + spin_lock_irqsave(&hcd_urb_unlink_lock, flags); + if (atomic_read(&urb->use_count) > 0) { + retval = 0; +- usb_get_dev(urb->dev); ++ usb_get_dev(udev); + } + spin_unlock_irqrestore(&hcd_urb_unlink_lock, flags); + if (retval == 0) { + hcd = bus_to_hcd(urb->dev->bus); + retval = unlink1(hcd, urb, status); +- usb_put_dev(urb->dev); ++ if (retval == 0) ++ retval = -EINPROGRESS; ++ else if (retval != -EIDRM && retval != -EBUSY) ++ dev_dbg(&udev->dev, "hcd_unlink_urb %p fail %d\n", ++ urb, retval); ++ usb_put_dev(udev); + } +- +- if (retval == 0) +- retval = -EINPROGRESS; +- else if (retval != -EIDRM && retval != -EBUSY) +- dev_dbg(&urb->dev->dev, "hcd_unlink_urb %p fail %d\n", +- urb, retval); + return retval; + } + +diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c +index c74ba7bbc748..89669608d932 100644 +--- a/drivers/usb/core/usb.c ++++ b/drivers/usb/core/usb.c +@@ -1010,6 +1010,7 @@ static int __init usb_init(void) + pr_info("%s: USB support disabled\n", usbcore_name); + return 0; + } ++ usb_init_pool_max(); + + retval = usb_debugfs_init(); + if (retval) +diff --git a/drivers/usb/gadget/inode.c b/drivers/usb/gadget/inode.c +index d9eaaa3b3e44..093e9075deee 100644 +--- a/drivers/usb/gadget/inode.c ++++ b/drivers/usb/gadget/inode.c +@@ -570,6 +570,7 @@ static ssize_t ep_aio_read_retry(struct kiocb *iocb) + break; + } + kfree(priv->buf); ++ kfree(priv->iv); + kfree(priv); + return len; + } +@@ -591,6 +592,7 @@ static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req) + */ + if (priv->iv == NULL || unlikely(req->actual == 0)) { + kfree(req->buf); ++ kfree(priv->iv); + kfree(priv); + iocb->private = NULL; + /* aio_complete() reports bytes-transferred _and_ faults */ +@@ -626,7 +628,7 @@ ep_aio_rwtail( + struct usb_request *req; + ssize_t value; + +- priv = kmalloc(sizeof *priv, GFP_KERNEL); ++ priv = kzalloc(sizeof *priv, GFP_KERNEL); + if (!priv) { + value = -ENOMEM; + fail: +@@ -634,11 +636,19 @@ fail: + return value; + } + iocb->private = priv; +- priv->iv = iv; ++ if (iv) { ++ priv->iv = kmemdup(iv, nr_segs * sizeof(struct iovec), ++ GFP_KERNEL); ++ if (!priv->iv) { ++ kfree(priv); ++ goto fail; ++ } ++ } + priv->nr_segs = nr_segs; + + value = get_ready_ep(iocb->ki_filp->f_flags, epdata); + if (unlikely(value < 0)) { ++ kfree(priv->iv); + kfree(priv); + goto fail; + } +@@ -672,6 +682,7 @@ fail: + mutex_unlock(&epdata->lock); + + if (unlikely(value)) { ++ kfree(priv->iv); + kfree(priv); + put_ep(epdata); + } else +diff --git a/drivers/usb/host/isp1760-hcd.c b/drivers/usb/host/isp1760-hcd.c +index fc72d44bf787..949303f08557 100644 +--- a/drivers/usb/host/isp1760-hcd.c ++++ b/drivers/usb/host/isp1760-hcd.c +@@ -2242,6 +2242,9 @@ struct usb_hcd *isp1760_register(phys_addr_t res_start, resource_size_t res_len, + hcd->rsrc_start = res_start; + hcd->rsrc_len = res_len; + ++ /* This driver doesn't support wakeup requests */ ++ hcd->cant_recv_wakeups = 1; ++ + ret = usb_add_hcd(hcd, irq, irqflags); + if (ret) + goto err_unmap; +diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c +index 56ec28bff136..a6d4393668f5 100644 +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -383,6 +383,10 @@ static void xhci_clear_port_change_bit(struct xhci_hcd *xhci, u16 wValue, + status = PORT_PLC; + port_change_bit = "link state"; + break; ++ case USB_PORT_FEAT_C_PORT_CONFIG_ERROR: ++ status = PORT_CEC; ++ port_change_bit = "config error"; ++ break; + default: + /* Should never happen */ + return; +@@ -617,6 +621,8 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, + status |= USB_PORT_STAT_C_LINK_STATE << 16; + if ((temp & PORT_WRC)) + status |= USB_PORT_STAT_C_BH_RESET << 16; ++ if ((temp & PORT_CEC)) ++ status |= USB_PORT_STAT_C_CONFIG_ERROR << 16; + } + + if (hcd->speed != HCD_USB3) { +@@ -904,6 +910,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, + case USB_PORT_FEAT_C_OVER_CURRENT: + case USB_PORT_FEAT_C_ENABLE: + case USB_PORT_FEAT_C_PORT_LINK_STATE: ++ case USB_PORT_FEAT_C_PORT_CONFIG_ERROR: + xhci_clear_port_change_bit(xhci, wValue, wIndex, + port_array[wIndex], temp); + break; +@@ -957,7 +964,7 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf) + */ + status = bus_state->resuming_ports; + +- mask = PORT_CSC | PORT_PEC | PORT_OCC | PORT_PLC | PORT_WRC; ++ mask = PORT_CSC | PORT_PEC | PORT_OCC | PORT_PLC | PORT_WRC | PORT_CEC; + + spin_lock_irqsave(&xhci->lock, flags); + /* For each port, did anything change? If so, set that bit in buf. */ +diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c +index c9e39d453f6b..710b2e98b846 100644 +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -36,6 +36,9 @@ + + #define PCI_DEVICE_ID_INTEL_LYNXPOINT_XHCI 0x8c31 + #define PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI 0x9c31 ++#define PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI 0x22b5 ++#define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI 0xa12f ++#define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI 0x9d2f + + static const char hcd_name[] = "xhci_hcd"; + +@@ -102,6 +105,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) + if (pdev->vendor == PCI_VENDOR_ID_AMD) + xhci->quirks |= XHCI_TRUST_TX_LENGTH; + ++ if (pdev->vendor == PCI_VENDOR_ID_INTEL) ++ xhci->quirks |= XHCI_AVOID_BEI; + if (pdev->vendor == PCI_VENDOR_ID_INTEL && + pdev->device == PCI_DEVICE_ID_INTEL_PANTHERPOINT_XHCI) { + xhci->quirks |= XHCI_EP_LIMIT_QUIRK; +@@ -116,7 +121,12 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) + * PPT chipsets. + */ + xhci->quirks |= XHCI_SPURIOUS_REBOOT; +- xhci->quirks |= XHCI_AVOID_BEI; ++ } ++ if (pdev->vendor == PCI_VENDOR_ID_INTEL && ++ (pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI || ++ pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI || ++ pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI)) { ++ xhci->quirks |= XHCI_PME_STUCK_QUIRK; + } + if (pdev->vendor == PCI_VENDOR_ID_ETRON && + pdev->device == PCI_DEVICE_ID_ASROCK_P67) { +@@ -131,6 +141,21 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) + xhci->quirks |= XHCI_RESET_ON_RESUME; + } + ++/* ++ * Make sure PME works on some Intel xHCI controllers by writing 1 to clear ++ * the Internal PME flag bit in vendor specific PMCTRL register at offset 0x80a4 ++ */ ++static void xhci_pme_quirk(struct xhci_hcd *xhci) ++{ ++ u32 val; ++ void __iomem *reg; ++ ++ reg = (void __iomem *) xhci->cap_regs + 0x80a4; ++ val = readl(reg); ++ writel(val | BIT(28), reg); ++ readl(reg); ++} ++ + /* called during probe() after chip reset completes */ + static int xhci_pci_setup(struct usb_hcd *hcd) + { +@@ -238,6 +263,9 @@ static int xhci_pci_suspend(struct usb_hcd *hcd, bool do_wakeup) + xhci->shared_hcd->state != HC_STATE_SUSPENDED) + return -EINVAL; + ++ if (xhci->quirks & XHCI_PME_STUCK_QUIRK) ++ xhci_pme_quirk(xhci); ++ + retval = xhci_suspend(xhci, do_wakeup); + + return retval; +@@ -268,6 +296,9 @@ static int xhci_pci_resume(struct usb_hcd *hcd, bool hibernated) + if (usb_is_intel_switchable_xhci(pdev)) + usb_enable_xhci_ports(pdev); + ++ if (xhci->quirks & XHCI_PME_STUCK_QUIRK) ++ xhci_pme_quirk(xhci); ++ + retval = xhci_resume(xhci, hibernated); + return retval; + } +diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c +index 950edebba8f1..e47a4e12b297 100644 +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -2049,7 +2049,7 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td, + if (event_trb != ep_ring->dequeue) { + /* The event was for the status stage */ + if (event_trb == td->last_trb) { +- if (td->urb->actual_length != 0) { ++ if (td->urb_length_set) { + /* Don't overwrite a previously set error code + */ + if ((*status == -EINPROGRESS || *status == 0) && +@@ -2063,7 +2063,13 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td, + td->urb->transfer_buffer_length; + } + } else { +- /* Maybe the event was for the data stage? */ ++ /* ++ * Maybe the event was for the data stage? If so, update ++ * already the actual_length of the URB and flag it as ++ * set, so that it is not overwritten in the event for ++ * the last TRB. ++ */ ++ td->urb_length_set = true; + td->urb->actual_length = + td->urb->transfer_buffer_length - + EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)); +diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h +index 6c8093509511..80b3d8559b09 100644 +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -1,3 +1,4 @@ ++ + /* + * xHCI host controller driver + * +@@ -88,9 +89,10 @@ struct xhci_cap_regs { + #define HCS_IST(p) (((p) >> 0) & 0xf) + /* bits 4:7, max number of Event Ring segments */ + #define HCS_ERST_MAX(p) (((p) >> 4) & 0xf) ++/* bits 21:25 Hi 5 bits of Scratchpad buffers SW must allocate for the HW */ + /* bit 26 Scratchpad restore - for save/restore HW state - not used yet */ +-/* bits 27:31 number of Scratchpad buffers SW must allocate for the HW */ +-#define HCS_MAX_SCRATCHPAD(p) (((p) >> 27) & 0x1f) ++/* bits 27:31 Lo 5 bits of Scratchpad buffers SW must allocate for the HW */ ++#define HCS_MAX_SCRATCHPAD(p) ((((p) >> 16) & 0x3e0) | (((p) >> 27) & 0x1f)) + + /* HCSPARAMS3 - hcs_params3 - bitmasks */ + /* bits 0:7, Max U1 to U0 latency for the roothub ports */ +@@ -1254,6 +1256,8 @@ struct xhci_td { + struct xhci_segment *start_seg; + union xhci_trb *first_trb; + union xhci_trb *last_trb; ++ /* actual_length of the URB has already been set */ ++ bool urb_length_set; + }; + + /* xHCI command default timeout value */ +@@ -1511,6 +1515,7 @@ struct xhci_hcd { + #define XHCI_PLAT (1 << 16) + #define XHCI_SLOW_SUSPEND (1 << 17) + #define XHCI_SPURIOUS_WAKEUP (1 << 18) ++#define XHCI_PME_STUCK_QUIRK (1 << 20) + unsigned int num_active_eps; + unsigned int limit_active_eps; + /* There are two roothubs to keep track of bus suspend info for */ +diff --git a/drivers/usb/serial/bus.c b/drivers/usb/serial/bus.c +index ed8adb052ca7..358d2d6d760a 100644 +--- a/drivers/usb/serial/bus.c ++++ b/drivers/usb/serial/bus.c +@@ -52,6 +52,7 @@ static int usb_serial_device_probe(struct device *dev) + { + struct usb_serial_driver *driver; + struct usb_serial_port *port; ++ struct device *tty_dev; + int retval = 0; + int minor; + +@@ -71,12 +72,20 @@ static int usb_serial_device_probe(struct device *dev) + retval = device_create_file(dev, &dev_attr_port_number); + if (retval) { + if (driver->port_remove) +- retval = driver->port_remove(port); ++ driver->port_remove(port); + goto exit; + } + + minor = port->number; +- tty_register_device(usb_serial_tty_driver, minor, dev); ++ tty_dev = tty_register_device(usb_serial_tty_driver, minor, dev); ++ if (IS_ERR(tty_dev)) { ++ retval = PTR_ERR(tty_dev); ++ device_remove_file(dev, &dev_attr_port_number); ++ if (driver->port_remove) ++ driver->port_remove(port); ++ goto exit; ++ } ++ + dev_info(&port->serial->dev->dev, + "%s converter now attached to ttyUSB%d\n", + driver->description, minor); +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index 813793714bea..5c289fc2bc5a 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -63,6 +63,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x0846, 0x1100) }, /* NetGear Managed Switch M4100 series, M5300 series, M7100 series */ + { USB_DEVICE(0x08e6, 0x5501) }, /* Gemalto Prox-PU/CU contactless smartcard reader */ + { USB_DEVICE(0x08FD, 0x000A) }, /* Digianswer A/S , ZigBee/802.15.4 MAC Device */ ++ { USB_DEVICE(0x0908, 0x01FF) }, /* Siemens RUGGEDCOM USB Serial Console */ + { USB_DEVICE(0x0BED, 0x1100) }, /* MEI (TM) Cashflow-SC Bill/Voucher Acceptor */ + { USB_DEVICE(0x0BED, 0x1101) }, /* MEI series 2000 Combo Acceptor */ + { USB_DEVICE(0x0FCF, 0x1003) }, /* Dynastream ANT development board */ +@@ -152,6 +153,8 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x166A, 0x0305) }, /* Clipsal C-5000CT2 C-Bus Spectrum Colour Touchscreen */ + { USB_DEVICE(0x166A, 0x0401) }, /* Clipsal L51xx C-Bus Architectural Dimmer */ + { USB_DEVICE(0x166A, 0x0101) }, /* Clipsal 5560884 C-Bus Multi-room Audio Matrix Switcher */ ++ { USB_DEVICE(0x16C0, 0x09B0) }, /* Lunatico Seletek */ ++ { USB_DEVICE(0x16C0, 0x09B1) }, /* Lunatico Seletek */ + { USB_DEVICE(0x16D6, 0x0001) }, /* Jablotron serial interface */ + { USB_DEVICE(0x16DC, 0x0010) }, /* W-IE-NE-R Plein & Baus GmbH PL512 Power Supply */ + { USB_DEVICE(0x16DC, 0x0011) }, /* W-IE-NE-R Plein & Baus GmbH RCM Remote Control for MARATON Power Supply */ +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index 4bfcfa785823..06abee68cb4f 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -628,6 +628,7 @@ static struct usb_device_id id_table_combined [] = { + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID), + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, ++ { USB_DEVICE(FTDI_VID, FTDI_SYNAPSE_SS200_PID) }, + /* + * ELV devices: + */ +@@ -823,6 +824,8 @@ static struct usb_device_id id_table_combined [] = { + { USB_DEVICE(FTDI_VID, FTDI_ELSTER_UNICOM_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_PROPOX_JTAGCABLEII_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_PROPOX_ISPCABLEIII_PID) }, ++ { USB_DEVICE(FTDI_VID, CYBER_CORTEX_AV_PID), ++ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_PID), + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_H_PID), +@@ -1000,6 +1003,23 @@ static struct usb_device_id id_table_combined [] = { + { USB_DEVICE(FTDI_VID, FTDI_EKEY_CONV_USB_PID) }, + /* GE Healthcare devices */ + { USB_DEVICE(GE_HEALTHCARE_VID, GE_HEALTHCARE_NEMO_TRACKER_PID) }, ++ /* Active Research (Actisense) devices */ ++ { USB_DEVICE(FTDI_VID, ACTISENSE_NDC_PID) }, ++ { USB_DEVICE(FTDI_VID, ACTISENSE_USG_PID) }, ++ { USB_DEVICE(FTDI_VID, ACTISENSE_NGT_PID) }, ++ { USB_DEVICE(FTDI_VID, ACTISENSE_NGW_PID) }, ++ { USB_DEVICE(FTDI_VID, ACTISENSE_D9AC_PID) }, ++ { USB_DEVICE(FTDI_VID, ACTISENSE_D9AD_PID) }, ++ { USB_DEVICE(FTDI_VID, ACTISENSE_D9AE_PID) }, ++ { USB_DEVICE(FTDI_VID, ACTISENSE_D9AF_PID) }, ++ { USB_DEVICE(FTDI_VID, CHETCO_SEAGAUGE_PID) }, ++ { USB_DEVICE(FTDI_VID, CHETCO_SEASWITCH_PID) }, ++ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_NMEA2000_PID) }, ++ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_ETHERNET_PID) }, ++ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_WIFI_PID) }, ++ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_DISPLAY_PID) }, ++ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_LITE_PID) }, ++ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_ANALOG_PID) }, + { }, /* Optional parameter entry */ + { } /* Terminating entry */ + }; +@@ -1930,8 +1950,12 @@ static int ftdi_8u2232c_probe(struct usb_serial *serial) + + dbg("%s", __func__); + +- if ((udev->manufacturer && !strcmp(udev->manufacturer, "CALAO Systems")) || +- (udev->product && !strcmp(udev->product, "BeagleBone/XDS100V2"))) ++ if (udev->manufacturer && !strcmp(udev->manufacturer, "CALAO Systems")) ++ return ftdi_jtag_probe(serial); ++ ++ if (udev->product && ++ (!strcmp(udev->product, "BeagleBone/XDS100V2") || ++ !strcmp(udev->product, "SNAP Connect E10"))) + return ftdi_jtag_probe(serial); + + return 0; +diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h +index ecb4dee48caf..105b9826d8d6 100644 +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -38,6 +38,9 @@ + + #define FTDI_LUMEL_PD12_PID 0x6002 + ++/* Cyber Cortex AV by Fabulous Silicon (http://fabuloussilicon.com) */ ++#define CYBER_CORTEX_AV_PID 0x8698 ++ + /* + * Marvell OpenRD Base, Client + * http://www.open-rd.org +@@ -558,6 +561,12 @@ + */ + #define FTDI_NT_ORIONLXM_PID 0x7c90 /* OrionLXm Substation Automation Platform */ + ++/* ++ * Synapse Wireless product ids (FTDI_VID) ++ * http://www.synapse-wireless.com ++ */ ++#define FTDI_SYNAPSE_SS200_PID 0x9090 /* SS200 - SNAP Stick 200 */ ++ + + /********************************/ + /** third-party VID/PID combos **/ +@@ -1432,3 +1441,23 @@ + */ + #define GE_HEALTHCARE_VID 0x1901 + #define GE_HEALTHCARE_NEMO_TRACKER_PID 0x0015 ++ ++/* ++ * Active Research (Actisense) devices ++ */ ++#define ACTISENSE_NDC_PID 0xD9A8 /* NDC USB Serial Adapter */ ++#define ACTISENSE_USG_PID 0xD9A9 /* USG USB Serial Adapter */ ++#define ACTISENSE_NGT_PID 0xD9AA /* NGT NMEA2000 Interface */ ++#define ACTISENSE_NGW_PID 0xD9AB /* NGW NMEA2000 Gateway */ ++#define ACTISENSE_D9AC_PID 0xD9AC /* Actisense Reserved */ ++#define ACTISENSE_D9AD_PID 0xD9AD /* Actisense Reserved */ ++#define ACTISENSE_D9AE_PID 0xD9AE /* Actisense Reserved */ ++#define ACTISENSE_D9AF_PID 0xD9AF /* Actisense Reserved */ ++#define CHETCO_SEAGAUGE_PID 0xA548 /* SeaGauge USB Adapter */ ++#define CHETCO_SEASWITCH_PID 0xA549 /* SeaSwitch USB Adapter */ ++#define CHETCO_SEASMART_NMEA2000_PID 0xA54A /* SeaSmart NMEA2000 Gateway */ ++#define CHETCO_SEASMART_ETHERNET_PID 0xA54B /* SeaSmart Ethernet Gateway */ ++#define CHETCO_SEASMART_WIFI_PID 0xA5AC /* SeaSmart Wifi Gateway */ ++#define CHETCO_SEASMART_DISPLAY_PID 0xA5AD /* SeaSmart NMEA2000 Display */ ++#define CHETCO_SEASMART_LITE_PID 0xA5AE /* SeaSmart Lite USB Adapter */ ++#define CHETCO_SEASMART_ANALOG_PID 0xA5AF /* SeaSmart Analog Adapter */ +diff --git a/drivers/video/arkfb.c b/drivers/video/arkfb.c +index 555dd4c64f5b..65196fe348e4 100644 +--- a/drivers/video/arkfb.c ++++ b/drivers/video/arkfb.c +@@ -1014,7 +1014,7 @@ static int __devinit ark_pci_probe(struct pci_dev *dev, const struct pci_device_ + + vga_res.flags = IORESOURCE_IO; + +- pcibios_bus_to_resource(dev, &vga_res, &bus_reg); ++ pcibios_bus_to_resource(dev->bus, &vga_res, &bus_reg); + + par->state.vgabase = (void __iomem *) vga_res.start; + +diff --git a/drivers/video/s3fb.c b/drivers/video/s3fb.c +index 2c80246b18b8..7b7af8c8706d 100644 +--- a/drivers/video/s3fb.c ++++ b/drivers/video/s3fb.c +@@ -1172,7 +1172,7 @@ static int __devinit s3_pci_probe(struct pci_dev *dev, const struct pci_device_i + + vga_res.flags = IORESOURCE_IO; + +- pcibios_bus_to_resource(dev, &vga_res, &bus_reg); ++ pcibios_bus_to_resource(dev->bus, &vga_res, &bus_reg); + + par->state.vgabase = (void __iomem *) vga_res.start; + +diff --git a/drivers/video/vt8623fb.c b/drivers/video/vt8623fb.c +index 4e74d262cf3e..dfecf02fad37 100644 +--- a/drivers/video/vt8623fb.c ++++ b/drivers/video/vt8623fb.c +@@ -727,7 +727,7 @@ static int __devinit vt8623_pci_probe(struct pci_dev *dev, const struct pci_devi + + vga_res.flags = IORESOURCE_IO; + +- pcibios_bus_to_resource(dev, &vga_res, &bus_reg); ++ pcibios_bus_to_resource(dev->bus, &vga_res, &bus_reg); + + par->state.vgabase = (void __iomem *) vga_res.start; + +diff --git a/drivers/xen/xen-pciback/conf_space.c b/drivers/xen/xen-pciback/conf_space.c +index 30d7be026c18..bb8cb697f65a 100644 +--- a/drivers/xen/xen-pciback/conf_space.c ++++ b/drivers/xen/xen-pciback/conf_space.c +@@ -16,8 +16,8 @@ + #include "conf_space.h" + #include "conf_space_quirks.h" + +-static bool permissive; +-module_param(permissive, bool, 0644); ++bool xen_pcibk_permissive; ++module_param_named(permissive, xen_pcibk_permissive, bool, 0644); + + /* This is where xen_pcibk_read_config_byte, xen_pcibk_read_config_word, + * xen_pcibk_write_config_word, and xen_pcibk_write_config_byte are created. */ +@@ -262,7 +262,7 @@ int xen_pcibk_config_write(struct pci_dev *dev, int offset, int size, u32 value) + * This means that some fields may still be read-only because + * they have entries in the config_field list that intercept + * the write and do nothing. */ +- if (dev_data->permissive || permissive) { ++ if (dev_data->permissive || xen_pcibk_permissive) { + switch (size) { + case 1: + err = pci_write_config_byte(dev, offset, +diff --git a/drivers/xen/xen-pciback/conf_space.h b/drivers/xen/xen-pciback/conf_space.h +index e56c934ad137..62461a8ba1d6 100644 +--- a/drivers/xen/xen-pciback/conf_space.h ++++ b/drivers/xen/xen-pciback/conf_space.h +@@ -64,6 +64,8 @@ struct config_field_entry { + void *data; + }; + ++extern bool xen_pcibk_permissive; ++ + #define OFFSET(cfg_entry) ((cfg_entry)->base_offset+(cfg_entry)->field->offset) + + /* Add fields to a device - the add_fields macro expects to get a pointer to +diff --git a/drivers/xen/xen-pciback/conf_space_header.c b/drivers/xen/xen-pciback/conf_space_header.c +index 3daf862d739d..1667a9089a4a 100644 +--- a/drivers/xen/xen-pciback/conf_space_header.c ++++ b/drivers/xen/xen-pciback/conf_space_header.c +@@ -9,6 +9,10 @@ + #include "pciback.h" + #include "conf_space.h" + ++struct pci_cmd_info { ++ u16 val; ++}; ++ + struct pci_bar_info { + u32 val; + u32 len_val; +@@ -18,22 +22,36 @@ struct pci_bar_info { + #define is_enable_cmd(value) ((value)&(PCI_COMMAND_MEMORY|PCI_COMMAND_IO)) + #define is_master_cmd(value) ((value)&PCI_COMMAND_MASTER) + +-static int command_read(struct pci_dev *dev, int offset, u16 *value, void *data) ++/* Bits guests are allowed to control in permissive mode. */ ++#define PCI_COMMAND_GUEST (PCI_COMMAND_MASTER|PCI_COMMAND_SPECIAL| \ ++ PCI_COMMAND_INVALIDATE|PCI_COMMAND_VGA_PALETTE| \ ++ PCI_COMMAND_WAIT|PCI_COMMAND_FAST_BACK) ++ ++static void *command_init(struct pci_dev *dev, int offset) + { +- int i; +- int ret; +- +- ret = xen_pcibk_read_config_word(dev, offset, value, data); +- if (!pci_is_enabled(dev)) +- return ret; +- +- for (i = 0; i < PCI_ROM_RESOURCE; i++) { +- if (dev->resource[i].flags & IORESOURCE_IO) +- *value |= PCI_COMMAND_IO; +- if (dev->resource[i].flags & IORESOURCE_MEM) +- *value |= PCI_COMMAND_MEMORY; ++ struct pci_cmd_info *cmd = kmalloc(sizeof(*cmd), GFP_KERNEL); ++ int err; ++ ++ if (!cmd) ++ return ERR_PTR(-ENOMEM); ++ ++ err = pci_read_config_word(dev, PCI_COMMAND, &cmd->val); ++ if (err) { ++ kfree(cmd); ++ return ERR_PTR(err); + } + ++ return cmd; ++} ++ ++static int command_read(struct pci_dev *dev, int offset, u16 *value, void *data) ++{ ++ int ret = pci_read_config_word(dev, offset, value); ++ const struct pci_cmd_info *cmd = data; ++ ++ *value &= PCI_COMMAND_GUEST; ++ *value |= cmd->val & ~PCI_COMMAND_GUEST; ++ + return ret; + } + +@@ -41,6 +59,8 @@ static int command_write(struct pci_dev *dev, int offset, u16 value, void *data) + { + struct xen_pcibk_dev_data *dev_data; + int err; ++ u16 val; ++ struct pci_cmd_info *cmd = data; + + dev_data = pci_get_drvdata(dev); + if (!pci_is_enabled(dev) && is_enable_cmd(value)) { +@@ -83,6 +103,19 @@ static int command_write(struct pci_dev *dev, int offset, u16 value, void *data) + } + } + ++ cmd->val = value; ++ ++ if (!xen_pcibk_permissive && (!dev_data || !dev_data->permissive)) ++ return 0; ++ ++ /* Only allow the guest to control certain bits. */ ++ err = pci_read_config_word(dev, offset, &val); ++ if (err || val == value) ++ return err; ++ ++ value &= PCI_COMMAND_GUEST; ++ value |= val & ~PCI_COMMAND_GUEST; ++ + return pci_write_config_word(dev, offset, value); + } + +@@ -282,6 +315,8 @@ static const struct config_field header_common[] = { + { + .offset = PCI_COMMAND, + .size = 2, ++ .init = command_init, ++ .release = bar_release, + .u.w.read = command_read, + .u.w.write = command_write, + }, +diff --git a/fs/autofs4/dev-ioctl.c b/fs/autofs4/dev-ioctl.c +index aa9103f8f01b..ace3eea163f0 100644 +--- a/fs/autofs4/dev-ioctl.c ++++ b/fs/autofs4/dev-ioctl.c +@@ -95,7 +95,7 @@ static int check_dev_ioctl_version(int cmd, struct autofs_dev_ioctl *param) + */ + static struct autofs_dev_ioctl *copy_dev_ioctl(struct autofs_dev_ioctl __user *in) + { +- struct autofs_dev_ioctl tmp; ++ struct autofs_dev_ioctl tmp, *res; + + if (copy_from_user(&tmp, in, sizeof(tmp))) + return ERR_PTR(-EFAULT); +@@ -103,7 +103,14 @@ static struct autofs_dev_ioctl *copy_dev_ioctl(struct autofs_dev_ioctl __user *i + if (tmp.size < sizeof(tmp)) + return ERR_PTR(-EINVAL); + +- return memdup_user(in, tmp.size); ++ if (tmp.size > (PATH_MAX + sizeof(tmp))) ++ return ERR_PTR(-ENAMETOOLONG); ++ ++ res = memdup_user(in, tmp.size); ++ if (!IS_ERR(res)) ++ res->size = tmp.size; ++ ++ return res; + } + + static inline void free_dev_ioctl(struct autofs_dev_ioctl *param) +diff --git a/fs/cifs/file.c b/fs/cifs/file.c +index 0898d99b5f7b..f069765b5f79 100644 +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -1613,6 +1613,7 @@ refind_writable: + cifsFileInfo_put(inv_file); + spin_lock(&cifs_file_list_lock); + ++refind; ++ inv_file = NULL; + goto refind_writable; + } + } +diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c +index 47d64e9282bf..7b65755114fe 100644 +--- a/fs/debugfs/inode.c ++++ b/fs/debugfs/inode.c +@@ -238,10 +238,19 @@ static int debugfs_show_options(struct seq_file *m, struct dentry *root) + return 0; + } + ++static void debugfs_evict_inode(struct inode *inode) ++{ ++ truncate_inode_pages(&inode->i_data, 0); ++ end_writeback(inode); ++ if (S_ISLNK(inode->i_mode)) ++ kfree(inode->i_private); ++} ++ + static const struct super_operations debugfs_super_operations = { + .statfs = simple_statfs, + .remount_fs = debugfs_remount, + .show_options = debugfs_show_options, ++ .evict_inode = debugfs_evict_inode, + }; + + static int debug_fill_super(struct super_block *sb, void *data, int silent) +@@ -459,23 +468,14 @@ static int __debugfs_remove(struct dentry *dentry, struct dentry *parent) + int ret = 0; + + if (debugfs_positive(dentry)) { +- if (dentry->d_inode) { +- dget(dentry); +- switch (dentry->d_inode->i_mode & S_IFMT) { +- case S_IFDIR: +- ret = simple_rmdir(parent->d_inode, dentry); +- break; +- case S_IFLNK: +- kfree(dentry->d_inode->i_private); +- /* fall through */ +- default: +- simple_unlink(parent->d_inode, dentry); +- break; +- } +- if (!ret) +- d_delete(dentry); +- dput(dentry); +- } ++ dget(dentry); ++ if (S_ISDIR(dentry->d_inode->i_mode)) ++ ret = simple_rmdir(parent->d_inode, dentry); ++ else ++ simple_unlink(parent->d_inode, dentry); ++ if (!ret) ++ d_delete(dentry); ++ dput(dentry); + } + return ret; + } +diff --git a/fs/ecryptfs/file.c b/fs/ecryptfs/file.c +index f04aa3303464..e33e0e49c18d 100644 +--- a/fs/ecryptfs/file.c ++++ b/fs/ecryptfs/file.c +@@ -306,9 +306,22 @@ ecryptfs_unlocked_ioctl(struct file *file, unsigned int cmd, unsigned long arg) + + if (ecryptfs_file_to_private(file)) + lower_file = ecryptfs_file_to_lower(file); +- if (lower_file && lower_file->f_op && lower_file->f_op->unlocked_ioctl) ++ if (!(lower_file && lower_file->f_op && lower_file->f_op->unlocked_ioctl)) ++ return rc; ++ ++ switch (cmd) { ++ case FITRIM: ++ case FS_IOC_GETFLAGS: ++ case FS_IOC_SETFLAGS: ++ case FS_IOC_GETVERSION: ++ case FS_IOC_SETVERSION: + rc = lower_file->f_op->unlocked_ioctl(lower_file, cmd, arg); +- return rc; ++ fsstack_copy_attr_all(file->f_path.dentry->d_inode, ++ lower_file->f_path.dentry->d_inode); ++ return rc; ++ default: ++ return rc; ++ } + } + + #ifdef CONFIG_COMPAT +@@ -320,9 +333,22 @@ ecryptfs_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg) + + if (ecryptfs_file_to_private(file)) + lower_file = ecryptfs_file_to_lower(file); +- if (lower_file && lower_file->f_op && lower_file->f_op->compat_ioctl) ++ if (!(lower_file && lower_file->f_op && lower_file->f_op->compat_ioctl)) ++ return rc; ++ ++ switch (cmd) { ++ case FITRIM: ++ case FS_IOC32_GETFLAGS: ++ case FS_IOC32_SETFLAGS: ++ case FS_IOC32_GETVERSION: ++ case FS_IOC32_SETVERSION: + rc = lower_file->f_op->compat_ioctl(lower_file, cmd, arg); +- return rc; ++ fsstack_copy_attr_all(file->f_path.dentry->d_inode, ++ lower_file->f_path.dentry->d_inode); ++ return rc; ++ default: ++ return rc; ++ } + } + #endif + +diff --git a/fs/exec.c b/fs/exec.c +index 5b9dfbe84b19..91d238fd1ea2 100644 +--- a/fs/exec.c ++++ b/fs/exec.c +@@ -1248,6 +1248,45 @@ void install_exec_creds(struct linux_binprm *bprm) + } + EXPORT_SYMBOL(install_exec_creds); + ++static void bprm_fill_uid(struct linux_binprm *bprm) ++{ ++ struct inode *inode; ++ unsigned int mode; ++ uid_t uid; ++ gid_t gid; ++ ++ /* clear any previous set[ug]id data from a previous binary */ ++ bprm->cred->euid = current_euid(); ++ bprm->cred->egid = current_egid(); ++ ++ if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) ++ return; ++ ++ inode = bprm->file->f_path.dentry->d_inode; ++ mode = ACCESS_ONCE(inode->i_mode); ++ if (!(mode & (S_ISUID|S_ISGID))) ++ return; ++ ++ /* Be careful if suid/sgid is set */ ++ mutex_lock(&inode->i_mutex); ++ ++ /* reload atomically mode/uid/gid now that lock held */ ++ mode = inode->i_mode; ++ uid = inode->i_uid; ++ gid = inode->i_gid; ++ mutex_unlock(&inode->i_mutex); ++ ++ if (mode & S_ISUID) { ++ bprm->per_clear |= PER_CLEAR_ON_SETID; ++ bprm->cred->euid = uid; ++ } ++ ++ if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) { ++ bprm->per_clear |= PER_CLEAR_ON_SETID; ++ bprm->cred->egid = gid; ++ } ++} ++ + /* + * determine how safe it is to execute the proposed program + * - the caller must hold ->cred_guard_mutex to protect against +@@ -1297,37 +1336,12 @@ static int check_unsafe_exec(struct linux_binprm *bprm) + */ + int prepare_binprm(struct linux_binprm *bprm) + { +- umode_t mode; +- struct inode * inode = bprm->file->f_path.dentry->d_inode; + int retval; + +- mode = inode->i_mode; + if (bprm->file->f_op == NULL) + return -EACCES; + +- /* clear any previous set[ug]id data from a previous binary */ +- bprm->cred->euid = current_euid(); +- bprm->cred->egid = current_egid(); +- +- if (!(bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) && +- !task_no_new_privs(current)) { +- /* Set-uid? */ +- if (mode & S_ISUID) { +- bprm->per_clear |= PER_CLEAR_ON_SETID; +- bprm->cred->euid = inode->i_uid; +- } +- +- /* Set-gid? */ +- /* +- * If setgid is set but no group execute bit then this +- * is a candidate for mandatory locking, not a setgid +- * executable. +- */ +- if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) { +- bprm->per_clear |= PER_CLEAR_ON_SETID; +- bprm->cred->egid = inode->i_gid; +- } +- } ++ bprm_fill_uid(bprm); + + /* fill in binprm security blob */ + retval = security_bprm_set_creds(bprm); +diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c +index f4246cfc8d87..0949b833557e 100644 +--- a/fs/fuse/dev.c ++++ b/fs/fuse/dev.c +@@ -717,8 +717,8 @@ static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep) + + newpage = buf->page; + +- if (WARN_ON(!PageUptodate(newpage))) +- return -EIO; ++ if (!PageUptodate(newpage)) ++ SetPageUptodate(newpage); + + ClearPageMappedToDisk(newpage); + +@@ -1634,6 +1634,9 @@ copy_finish: + static int fuse_notify(struct fuse_conn *fc, enum fuse_notify_code code, + unsigned int size, struct fuse_copy_state *cs) + { ++ /* Don't try to move pages (yet) */ ++ cs->move_pages = 0; ++ + switch (code) { + case FUSE_NOTIFY_POLL: + return fuse_notify_poll(fc, size, cs); +diff --git a/fs/hfsplus/brec.c b/fs/hfsplus/brec.c +index 2a734cfccc92..7429c409ec00 100644 +--- a/fs/hfsplus/brec.c ++++ b/fs/hfsplus/brec.c +@@ -130,13 +130,16 @@ skip: + hfs_bnode_write(node, entry, data_off + key_len, entry_len); + hfs_bnode_dump(node); + +- if (new_node) { +- /* update parent key if we inserted a key +- * at the start of the first node +- */ +- if (!rec && new_node != node) +- hfs_brec_update_parent(fd); ++ /* ++ * update parent key if we inserted a key ++ * at the start of the node and it is not the new node ++ */ ++ if (!rec && new_node != node) { ++ hfs_bnode_read_key(node, fd->search_key, data_off + size); ++ hfs_brec_update_parent(fd); ++ } + ++ if (new_node) { + hfs_bnode_put(fd->bnode); + if (!new_node->parent) { + hfs_btree_inc_height(tree); +@@ -166,9 +169,6 @@ skip: + goto again; + } + +- if (!rec) +- hfs_brec_update_parent(fd); +- + return 0; + } + +@@ -368,6 +368,8 @@ again: + if (IS_ERR(parent)) + return PTR_ERR(parent); + __hfs_brec_find(parent, fd); ++ if (fd->record < 0) ++ return -ENOENT; + hfs_bnode_dump(parent); + rec = fd->record; + +diff --git a/fs/jffs2/scan.c b/fs/jffs2/scan.c +index 7654e87b0428..9ad5ba4b299b 100644 +--- a/fs/jffs2/scan.c ++++ b/fs/jffs2/scan.c +@@ -510,6 +510,10 @@ static int jffs2_scan_eraseblock (struct jffs2_sb_info *c, struct jffs2_eraseblo + sumlen = c->sector_size - je32_to_cpu(sm->offset); + sumptr = buf + buf_size - sumlen; + ++ /* sm->offset maybe wrong but MAGIC maybe right */ ++ if (sumlen > c->sector_size) ++ goto full_scan; ++ + /* Now, make sure the summary itself is available */ + if (sumlen > buf_size) { + /* Need to kmalloc for this. */ +@@ -544,6 +548,7 @@ static int jffs2_scan_eraseblock (struct jffs2_sb_info *c, struct jffs2_eraseblo + } + } + ++full_scan: + buf_ofs = jeb->offset; + + if (!buf_size) { +diff --git a/fs/namei.c b/fs/namei.c +index 5974fb573f5a..bdcd70544fce 100644 +--- a/fs/namei.c ++++ b/fs/namei.c +@@ -579,7 +579,8 @@ static __always_inline int __vfs_follow_link(struct nameidata *nd, const char *l + goto fail; + + if (*link == '/') { +- set_root(nd); ++ if (!nd->root.mnt) ++ set_root(nd); + path_put(&nd->path); + nd->path = nd->root; + path_get(&nd->root); +diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c +index 27c2969a9d02..3abfd5af9cb7 100644 +--- a/fs/nfs/callback_xdr.c ++++ b/fs/nfs/callback_xdr.c +@@ -463,8 +463,10 @@ static __be32 decode_cb_sequence_args(struct svc_rqst *rqstp, + + for (i = 0; i < args->csa_nrclists; i++) { + status = decode_rc_list(xdr, &args->csa_rclists[i]); +- if (status) ++ if (status) { ++ args->csa_nrclists = i; + goto out_free; ++ } + } + } + status = 0; +diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c +index 16d16e56cc39..62261deb0569 100644 +--- a/fs/nfs/delegation.c ++++ b/fs/nfs/delegation.c +@@ -148,8 +148,8 @@ void nfs_inode_reclaim_delegation(struct inode *inode, struct rpc_cred *cred, + &delegation->flags); + NFS_I(inode)->delegation_state = delegation->type; + spin_unlock(&delegation->lock); +- put_rpccred(oldcred); + rcu_read_unlock(); ++ put_rpccred(oldcred); + } else { + /* We appear to have raced with a delegation return. */ + spin_unlock(&delegation->lock); +diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c +index b2e3ff347620..ecdbae19a766 100644 +--- a/fs/nilfs2/btree.c ++++ b/fs/nilfs2/btree.c +@@ -31,6 +31,8 @@ + #include "alloc.h" + #include "dat.h" + ++static void __nilfs_btree_init(struct nilfs_bmap *bmap); ++ + static struct nilfs_btree_path *nilfs_btree_alloc_path(void) + { + struct nilfs_btree_path *path; +@@ -368,6 +370,34 @@ static int nilfs_btree_node_broken(const struct nilfs_btree_node *node, + return ret; + } + ++/** ++ * nilfs_btree_root_broken - verify consistency of btree root node ++ * @node: btree root node to be examined ++ * @ino: inode number ++ * ++ * Return Value: If node is broken, 1 is returned. Otherwise, 0 is returned. ++ */ ++static int nilfs_btree_root_broken(const struct nilfs_btree_node *node, ++ unsigned long ino) ++{ ++ int level, flags, nchildren; ++ int ret = 0; ++ ++ level = nilfs_btree_node_get_level(node); ++ flags = nilfs_btree_node_get_flags(node); ++ nchildren = nilfs_btree_node_get_nchildren(node); ++ ++ if (unlikely(level < NILFS_BTREE_LEVEL_NODE_MIN || ++ level > NILFS_BTREE_LEVEL_MAX || ++ nchildren < 0 || ++ nchildren > NILFS_BTREE_ROOT_NCHILDREN_MAX)) { ++ pr_crit("NILFS: bad btree root (inode number=%lu): level = %d, flags = 0x%x, nchildren = %d\n", ++ ino, level, flags, nchildren); ++ ret = 1; ++ } ++ return ret; ++} ++ + int nilfs_btree_broken_node_block(struct buffer_head *bh) + { + int ret; +@@ -1713,7 +1743,7 @@ nilfs_btree_commit_convert_and_insert(struct nilfs_bmap *btree, + + /* convert and insert */ + dat = NILFS_BMAP_USE_VBN(btree) ? nilfs_bmap_get_dat(btree) : NULL; +- nilfs_btree_init(btree); ++ __nilfs_btree_init(btree); + if (nreq != NULL) { + nilfs_bmap_commit_alloc_ptr(btree, dreq, dat); + nilfs_bmap_commit_alloc_ptr(btree, nreq, dat); +@@ -2294,12 +2324,23 @@ static const struct nilfs_bmap_operations nilfs_btree_ops_gc = { + .bop_gather_data = NULL, + }; + +-int nilfs_btree_init(struct nilfs_bmap *bmap) ++static void __nilfs_btree_init(struct nilfs_bmap *bmap) + { + bmap->b_ops = &nilfs_btree_ops; + bmap->b_nchildren_per_block = + NILFS_BTREE_NODE_NCHILDREN_MAX(nilfs_btree_node_size(bmap)); +- return 0; ++} ++ ++int nilfs_btree_init(struct nilfs_bmap *bmap) ++{ ++ int ret = 0; ++ ++ __nilfs_btree_init(bmap); ++ ++ if (nilfs_btree_root_broken(nilfs_btree_get_root(bmap), ++ bmap->b_inode->i_ino)) ++ ret = -EIO; ++ return ret; + } + + void nilfs_btree_init_gc(struct nilfs_bmap *bmap) +diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c +index 8021098ff507..dc799343e825 100644 +--- a/fs/ocfs2/file.c ++++ b/fs/ocfs2/file.c +@@ -2387,10 +2387,14 @@ out_dio: + /* buffered aio wouldn't have proper lock coverage today */ + BUG_ON(ret == -EIOCBQUEUED && !(file->f_flags & O_DIRECT)); + ++ if (unlikely(written <= 0)) ++ goto no_sync; ++ + if (((file->f_flags & O_DSYNC) && !direct_io) || IS_SYNC(inode) || + ((file->f_flags & O_DIRECT) && !direct_io)) { +- ret = filemap_fdatawrite_range(file->f_mapping, *ppos, +- *ppos + count - 1); ++ ret = filemap_fdatawrite_range(file->f_mapping, ++ iocb->ki_pos - written, ++ iocb->ki_pos - 1); + if (ret < 0) + written = ret; + +@@ -2403,10 +2407,12 @@ out_dio: + } + + if (!ret) +- ret = filemap_fdatawait_range(file->f_mapping, *ppos, +- *ppos + count - 1); ++ ret = filemap_fdatawait_range(file->f_mapping, ++ iocb->ki_pos - written, ++ iocb->ki_pos - 1); + } + ++no_sync: + /* + * deep in g_f_a_w_n()->ocfs2_direct_IO we pass in a ocfs2_dio_end_io + * function pointer which is called when o_direct io completes so that +@@ -2468,9 +2474,7 @@ static ssize_t ocfs2_file_splice_write(struct pipe_inode_info *pipe, + struct address_space *mapping = out->f_mapping; + struct inode *inode = mapping->host; + struct splice_desc sd = { +- .total_len = len, + .flags = flags, +- .pos = *ppos, + .u.file = out, + }; + +@@ -2480,6 +2484,12 @@ static ssize_t ocfs2_file_splice_write(struct pipe_inode_info *pipe, + out->f_path.dentry->d_name.len, + out->f_path.dentry->d_name.name, len); + ++ ret = generic_write_checks(out, ppos, &len, 0); ++ if (ret) ++ return ret; ++ sd.total_len = len; ++ sd.pos = *ppos; ++ + if (pipe->inode) + mutex_lock_nested(&pipe->inode->i_mutex, I_MUTEX_PARENT); + +diff --git a/fs/splice.c b/fs/splice.c +index bed6a3c29355..67c5210e7ce7 100644 +--- a/fs/splice.c ++++ b/fs/splice.c +@@ -991,13 +991,17 @@ generic_file_splice_write(struct pipe_inode_info *pipe, struct file *out, + struct address_space *mapping = out->f_mapping; + struct inode *inode = mapping->host; + struct splice_desc sd = { +- .total_len = len, + .flags = flags, +- .pos = *ppos, + .u.file = out, + }; + ssize_t ret; + ++ ret = generic_write_checks(out, ppos, &len, S_ISBLK(inode->i_mode)); ++ if (ret) ++ return ret; ++ sd.total_len = len; ++ sd.pos = *ppos; ++ + pipe_lock(pipe); + + splice_from_pipe_begin(&sd); +diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h +index 4053cbd4490e..ddce23d5fc28 100644 +--- a/include/linux/blk_types.h ++++ b/include/linux/blk_types.h +@@ -144,7 +144,9 @@ enum rq_flag_bits { + __REQ_ELVPRIV, /* elevator private data attached */ + __REQ_FAILED, /* set if the request failed */ + __REQ_QUIET, /* don't worry about errors */ +- __REQ_PREEMPT, /* set for "ide_preempt" requests */ ++ __REQ_PREEMPT, /* set for "ide_preempt" requests and also ++ for requests for which the SCSI "quiesce" ++ state must be ignored. */ + __REQ_ALLOCED, /* request came from our alloc pool */ + __REQ_COPY_USER, /* contains copies of user pages */ + __REQ_FLUSH_SEQ, /* request for flush sequence */ +diff --git a/include/linux/fsnotify.h b/include/linux/fsnotify.h +index a6dfe6944564..fac26cbae59b 100644 +--- a/include/linux/fsnotify.h ++++ b/include/linux/fsnotify.h +@@ -101,8 +101,10 @@ static inline void fsnotify_move(struct inode *old_dir, struct inode *new_dir, + new_dir_mask |= FS_ISDIR; + } + +- fsnotify(old_dir, old_dir_mask, old_dir, FSNOTIFY_EVENT_INODE, old_name, fs_cookie); +- fsnotify(new_dir, new_dir_mask, new_dir, FSNOTIFY_EVENT_INODE, new_name, fs_cookie); ++ fsnotify(old_dir, old_dir_mask, source, FSNOTIFY_EVENT_INODE, old_name, ++ fs_cookie); ++ fsnotify(new_dir, new_dir_mask, source, FSNOTIFY_EVENT_INODE, new_name, ++ fs_cookie); + + if (target) + fsnotify_link_count(target); +diff --git a/include/linux/pci.h b/include/linux/pci.h +index e444f5b49118..469c9536c5e5 100644 +--- a/include/linux/pci.h ++++ b/include/linux/pci.h +@@ -648,9 +648,9 @@ void pci_fixup_cardbus(struct pci_bus *); + + /* Generic PCI functions used internally */ + +-void pcibios_resource_to_bus(struct pci_dev *dev, struct pci_bus_region *region, ++void pcibios_resource_to_bus(struct pci_bus *bus, struct pci_bus_region *region, + struct resource *res); +-void pcibios_bus_to_resource(struct pci_dev *dev, struct resource *res, ++void pcibios_bus_to_resource(struct pci_bus *bus, struct resource *res, + struct pci_bus_region *region); + void pcibios_scan_specific_bus(int busn); + extern struct pci_bus *pci_find_bus(int domain, int busnr); +diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h +index 815cc4b12c4a..feb77716a90f 100644 +--- a/include/linux/usb/hcd.h ++++ b/include/linux/usb/hcd.h +@@ -126,6 +126,7 @@ struct usb_hcd { + unsigned wireless:1; /* Wireless USB HCD */ + unsigned authorized_default:1; + unsigned has_tt:1; /* Integrated TT in root hub */ ++ unsigned cant_recv_wakeups:1; + + unsigned int irq; /* irq allocated */ + void __iomem *regs; /* device memory/io */ +@@ -399,6 +400,7 @@ extern const struct dev_pm_ops usb_hcd_pci_pm_ops; + #endif /* CONFIG_PCI */ + + /* pci-ish (pdev null is ok) buffer alloc/mapping support */ ++void usb_init_pool_max(void); + int hcd_buffer_create(struct usb_hcd *hcd); + void hcd_buffer_destroy(struct usb_hcd *hcd); + +diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c +index 67b847dfa2bb..d1342c2514d3 100644 +--- a/kernel/debug/kdb/kdb_main.c ++++ b/kernel/debug/kdb/kdb_main.c +@@ -2598,7 +2598,7 @@ static int kdb_summary(int argc, const char **argv) + #define K(x) ((x) << (PAGE_SHIFT - 10)) + kdb_printf("\nMemTotal: %8lu kB\nMemFree: %8lu kB\n" + "Buffers: %8lu kB\n", +- val.totalram, val.freeram, val.bufferram); ++ K(val.totalram), K(val.freeram), K(val.bufferram)); + return 0; + } + +diff --git a/kernel/events/core.c b/kernel/events/core.c +index 04662972802a..461b6e0007b1 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -3877,6 +3877,13 @@ static void perf_pending_event(struct irq_work *entry) + { + struct perf_event *event = container_of(entry, + struct perf_event, pending); ++ int rctx; ++ ++ rctx = perf_swevent_get_recursion_context(); ++ /* ++ * If we 'fail' here, that's OK, it means recursion is already disabled ++ * and we won't recurse 'further'. ++ */ + + if (event->pending_disable) { + event->pending_disable = 0; +@@ -3887,6 +3894,9 @@ static void perf_pending_event(struct irq_work *entry) + event->pending_wakeup = 0; + perf_event_wakeup(event); + } ++ ++ if (rctx >= 0) ++ perf_swevent_put_recursion_context(rctx); + } + + /* +diff --git a/kernel/printk.c b/kernel/printk.c +index 544c0215939a..cb72d9c406cd 100644 +--- a/kernel/printk.c ++++ b/kernel/printk.c +@@ -126,7 +126,7 @@ static struct console *exclusive_console; + */ + struct console_cmdline + { +- char name[8]; /* Name of the driver */ ++ char name[16]; /* Name of the driver */ + int index; /* Minor dev. to use */ + char *options; /* Options for the driver */ + #ifdef CONFIG_A11Y_BRAILLE_CONSOLE +@@ -1498,6 +1498,7 @@ void register_console(struct console *newcon) + */ + for (i = 0; i < MAX_CMDLINECONSOLES && console_cmdline[i].name[0]; + i++) { ++ BUILD_BUG_ON(sizeof(console_cmdline[i].name) != sizeof(newcon->name)); + if (strcmp(console_cmdline[i].name, newcon->name) != 0) + continue; + if (newcon->index >= 0 && +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 5701cb9a673f..2f8363e0a1ec 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -4031,10 +4031,13 @@ void rt_mutex_setprio(struct task_struct *p, int prio) + if (running) + p->sched_class->put_prev_task(rq, p); + +- if (rt_prio(prio)) ++ if (rt_prio(prio)) { + p->sched_class = &rt_sched_class; +- else ++ } else { ++ if (rt_prio(oldprio)) ++ p->rt.timeout = 0; + p->sched_class = &fair_sched_class; ++ } + + p->prio = prio; + +diff --git a/kernel/softirq.c b/kernel/softirq.c +index 671f9594e368..5cc401e6d3b4 100644 +--- a/kernel/softirq.c ++++ b/kernel/softirq.c +@@ -194,22 +194,28 @@ void local_bh_enable_ip(unsigned long ip) + EXPORT_SYMBOL(local_bh_enable_ip); + + /* +- * We restart softirq processing MAX_SOFTIRQ_RESTART times, +- * and we fall back to softirqd after that. ++ * We restart softirq processing for at most MAX_SOFTIRQ_RESTART times, ++ * but break the loop if need_resched() is set or after 2 ms. ++ * The MAX_SOFTIRQ_TIME provides a nice upper bound in most cases, but in ++ * certain cases, such as stop_machine(), jiffies may cease to ++ * increment and so we need the MAX_SOFTIRQ_RESTART limit as ++ * well to make sure we eventually return from this method. + * +- * This number has been established via experimentation. ++ * These limits have been established via experimentation. + * The two things to balance is latency against fairness - + * we want to handle softirqs as soon as possible, but they + * should not be able to lock up the box. + */ ++#define MAX_SOFTIRQ_TIME msecs_to_jiffies(2) + #define MAX_SOFTIRQ_RESTART 10 + + asmlinkage void __do_softirq(void) + { + struct softirq_action *h; + __u32 pending; +- int max_restart = MAX_SOFTIRQ_RESTART; ++ unsigned long end = jiffies + MAX_SOFTIRQ_TIME; + int cpu; ++ int max_restart = MAX_SOFTIRQ_RESTART; + + pending = local_softirq_pending(); + account_system_vtime(current); +@@ -255,11 +261,13 @@ restart: + local_irq_disable(); + + pending = local_softirq_pending(); +- if (pending && --max_restart) +- goto restart; ++ if (pending) { ++ if (time_before(jiffies, end) && !need_resched() && ++ --max_restart) ++ goto restart; + +- if (pending) + wakeup_softirqd(); ++ } + + lockdep_softirq_exit(); + +diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c +index 5b6bd45bc58b..ffea326b1bc5 100644 +--- a/kernel/trace/ftrace.c ++++ b/kernel/trace/ftrace.c +@@ -1014,6 +1014,12 @@ ftrace_filter_lseek(struct file *file, loff_t offset, int whence) + return ret; + } + ++#ifdef CONFIG_FUNCTION_GRAPH_TRACER ++static int ftrace_graph_active; ++#else ++# define ftrace_graph_active 0 ++#endif ++ + #ifdef CONFIG_DYNAMIC_FTRACE + + #ifndef CONFIG_FTRACE_MCOUNT_RECORD +@@ -2056,24 +2062,36 @@ static int ftrace_shutdown(struct ftrace_ops *ops, int command) + + static void ftrace_startup_sysctl(void) + { ++ int command; ++ + if (unlikely(ftrace_disabled)) + return; + + /* Force update next time */ + saved_ftrace_func = NULL; + /* ftrace_start_up is true if we want ftrace running */ +- if (ftrace_start_up) +- ftrace_run_update_code(FTRACE_UPDATE_CALLS); ++ if (ftrace_start_up) { ++ command = FTRACE_UPDATE_CALLS; ++ if (ftrace_graph_active) ++ command |= FTRACE_START_FUNC_RET; ++ ftrace_startup_enable(command); ++ } + } + + static void ftrace_shutdown_sysctl(void) + { ++ int command; ++ + if (unlikely(ftrace_disabled)) + return; + + /* ftrace_start_up is true if ftrace is running */ +- if (ftrace_start_up) +- ftrace_run_update_code(FTRACE_DISABLE_CALLS); ++ if (ftrace_start_up) { ++ command = FTRACE_DISABLE_CALLS; ++ if (ftrace_graph_active) ++ command |= FTRACE_STOP_FUNC_RET; ++ ftrace_run_update_code(command); ++ } + } + + static cycle_t ftrace_update_time; +@@ -4445,12 +4463,12 @@ ftrace_enable_sysctl(struct ctl_table *table, int write, + + if (ftrace_enabled) { + +- ftrace_startup_sysctl(); +- + /* we are starting ftrace again */ + if (ftrace_ops_list != &ftrace_list_end) + update_ftrace_function(); + ++ ftrace_startup_sysctl(); ++ + } else { + /* stopping ftrace calls (just send to ftrace_stub) */ + ftrace_trace_function = ftrace_stub; +@@ -4465,7 +4483,6 @@ ftrace_enable_sysctl(struct ctl_table *table, int write, + + #ifdef CONFIG_FUNCTION_GRAPH_TRACER + +-static int ftrace_graph_active; + static struct notifier_block ftrace_suspend_notifier; + + int ftrace_graph_entry_stub(struct ftrace_graph_ent *trace) +diff --git a/mm/hugetlb.c b/mm/hugetlb.c +index efd682099a0a..bc36e280ce8b 100644 +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -2401,9 +2401,10 @@ void __unmap_hugepage_range(struct vm_area_struct *vma, unsigned long start, + continue; + + /* +- * HWPoisoned hugepage is already unmapped and dropped reference ++ * Migrating hugepage or HWPoisoned hugepage is already ++ * unmapped and its refcount is dropped + */ +- if (unlikely(is_hugetlb_entry_hwpoisoned(pte))) ++ if (unlikely(!pte_present(pte))) + continue; + + page = pte_page(pte); +@@ -2813,6 +2814,7 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma, + struct page *pagecache_page = NULL; + static DEFINE_MUTEX(hugetlb_instantiation_mutex); + struct hstate *h = hstate_vma(vma); ++ int need_wait_lock = 0; + + address &= huge_page_mask(h); + +@@ -2846,6 +2848,16 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma, + ret = 0; + + /* ++ * entry could be a migration/hwpoison entry at this point, so this ++ * check prevents the kernel from going below assuming that we have ++ * a active hugepage in pagecache. This goto expects the 2nd page fault, ++ * and is_hugetlb_entry_(migration|hwpoisoned) check will properly ++ * handle it. ++ */ ++ if (!pte_present(entry)) ++ goto out_mutex; ++ ++ /* + * If we are going to COW the mapping later, we examine the pending + * reservations for this page now. This will ensure that any + * allocations necessary to record that reservation occur outside the +@@ -2864,29 +2876,32 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma, + vma, address); + } + ++ spin_lock(&mm->page_table_lock); ++ ++ /* Check for a racing update before calling hugetlb_cow */ ++ if (unlikely(!pte_same(entry, huge_ptep_get(ptep)))) ++ goto out_page_table_lock; ++ + /* + * hugetlb_cow() requires page locks of pte_page(entry) and + * pagecache_page, so here we need take the former one + * when page != pagecache_page or !pagecache_page. +- * Note that locking order is always pagecache_page -> page, +- * so no worry about deadlock. + */ + page = pte_page(entry); +- get_page(page); + if (page != pagecache_page) +- lock_page(page); ++ if (!trylock_page(page)) { ++ need_wait_lock = 1; ++ goto out_page_table_lock; ++ } + +- spin_lock(&mm->page_table_lock); +- /* Check for a racing update before calling hugetlb_cow */ +- if (unlikely(!pte_same(entry, huge_ptep_get(ptep)))) +- goto out_page_table_lock; ++ get_page(page); + + + if (flags & FAULT_FLAG_WRITE) { + if (!pte_write(entry)) { + ret = hugetlb_cow(mm, vma, address, ptep, entry, + pagecache_page); +- goto out_page_table_lock; ++ goto out_put_page; + } + entry = pte_mkdirty(entry); + } +@@ -2895,6 +2910,10 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma, + flags & FAULT_FLAG_WRITE)) + update_mmu_cache(vma, address, ptep); + ++out_put_page: ++ if (page != pagecache_page) ++ unlock_page(page); ++ put_page(page); + out_page_table_lock: + spin_unlock(&mm->page_table_lock); + +@@ -3034,7 +3053,22 @@ void hugetlb_change_protection(struct vm_area_struct *vma, + continue; + if (huge_pmd_unshare(mm, &address, ptep)) + continue; +- if (!huge_pte_none(huge_ptep_get(ptep))) { ++ pte = huge_ptep_get(ptep); ++ if (unlikely(is_hugetlb_entry_hwpoisoned(pte))) ++ continue; ++ if (unlikely(is_hugetlb_entry_migration(pte))) { ++ swp_entry_t entry = pte_to_swp_entry(pte); ++ ++ if (is_write_migration_entry(entry)) { ++ pte_t newpte; ++ ++ make_migration_entry_read(&entry); ++ newpte = swp_entry_to_pte(entry); ++ set_huge_pte_at(mm, address, ptep, newpte); ++ } ++ continue; ++ } ++ if (!huge_pte_none(pte)) { + pte = huge_ptep_get_and_clear(mm, address, ptep); + pte = pte_mkhuge(pte_modify(pte, newprot)); + set_huge_pte_at(mm, address, ptep, pte); +diff --git a/mm/memory.c b/mm/memory.c +index 45cd14f0c7bf..02aef93416f2 100644 +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -3845,7 +3845,7 @@ int generic_access_phys(struct vm_area_struct *vma, unsigned long addr, + if (follow_phys(vma, addr, write, &prot, &phys_addr)) + return -EINVAL; + +- maddr = ioremap_prot(phys_addr, PAGE_SIZE, prot); ++ maddr = ioremap_prot(phys_addr, PAGE_ALIGN(len + offset), prot); + if (write) + memcpy_toio(maddr + offset, buf, len); + else +diff --git a/mm/mmap.c b/mm/mmap.c +index 208e70f1006d..cb6456d35860 100644 +--- a/mm/mmap.c ++++ b/mm/mmap.c +@@ -112,7 +112,7 @@ struct percpu_counter vm_committed_as ____cacheline_aligned_in_smp; + */ + int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin) + { +- unsigned long free, allowed; ++ long free, allowed; + + vm_acct_memory(pages); + +diff --git a/mm/nommu.c b/mm/nommu.c +index d3afb4765c8a..3f282f9cc13f 100644 +--- a/mm/nommu.c ++++ b/mm/nommu.c +@@ -1916,7 +1916,7 @@ EXPORT_SYMBOL(unmap_mapping_range); + */ + int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin) + { +- unsigned long free, allowed; ++ long free, allowed; + + vm_acct_memory(pages); + +diff --git a/mm/page-writeback.c b/mm/page-writeback.c +index 057884c2b4d9..ecd1c4c4207c 100644 +--- a/mm/page-writeback.c ++++ b/mm/page-writeback.c +@@ -716,7 +716,7 @@ static unsigned long bdi_position_ratio(struct backing_dev_info *bdi, + * scale global setpoint to bdi's: + * bdi_setpoint = setpoint * bdi_thresh / thresh + */ +- x = div_u64((u64)bdi_thresh << 16, thresh + 1); ++ x = div_u64((u64)bdi_thresh << 16, thresh | 1); + bdi_setpoint = setpoint * (u64)x >> 16; + /* + * Use span=(8*write_bw) in single bdi case as indicated by +@@ -766,8 +766,11 @@ static void bdi_update_write_bandwidth(struct backing_dev_info *bdi, + * bw * elapsed + write_bandwidth * (period - elapsed) + * write_bandwidth = --------------------------------------------------- + * period ++ * ++ * @written may have decreased due to account_page_redirty(). ++ * Avoid underflowing @bw calculation. + */ +- bw = written - bdi->written_stamp; ++ bw = written - min(written, bdi->written_stamp); + bw *= HZ; + if (unlikely(elapsed > period)) { + do_div(bw, elapsed); +@@ -831,7 +834,7 @@ static void global_update_bandwidth(unsigned long thresh, + unsigned long now) + { + static DEFINE_SPINLOCK(dirty_lock); +- static unsigned long update_time; ++ static unsigned long update_time = INITIAL_JIFFIES; + + /* + * check locklessly first to optimize away locking for the most time +diff --git a/mm/slub.c b/mm/slub.c +index 54ac6e90a1fa..aff06374dd5c 100644 +--- a/mm/slub.c ++++ b/mm/slub.c +@@ -1882,18 +1882,24 @@ redo: + /* Unfreeze all the cpu partial slabs */ + static void unfreeze_partials(struct kmem_cache *s) + { +- struct kmem_cache_node *n = NULL; ++ struct kmem_cache_node *n = NULL, *n2 = NULL; + struct kmem_cache_cpu *c = this_cpu_ptr(s->cpu_slab); + struct page *page, *discard_page = NULL; + + while ((page = c->partial)) { +- enum slab_modes { M_PARTIAL, M_FREE }; +- enum slab_modes l, m; + struct page new; + struct page old; + + c->partial = page->next; +- l = M_FREE; ++ ++ n2 = get_node(s, page_to_nid(page)); ++ if (n != n2) { ++ if (n) ++ spin_unlock(&n->list_lock); ++ ++ n = n2; ++ spin_lock(&n->list_lock); ++ } + + do { + +@@ -1906,43 +1912,17 @@ static void unfreeze_partials(struct kmem_cache *s) + + new.frozen = 0; + +- if (!new.inuse && (!n || n->nr_partial > s->min_partial)) +- m = M_FREE; +- else { +- struct kmem_cache_node *n2 = get_node(s, +- page_to_nid(page)); +- +- m = M_PARTIAL; +- if (n != n2) { +- if (n) +- spin_unlock(&n->list_lock); +- +- n = n2; +- spin_lock(&n->list_lock); +- } +- } +- +- if (l != m) { +- if (l == M_PARTIAL) { +- remove_partial(n, page); +- stat(s, FREE_REMOVE_PARTIAL); +- } else { +- add_partial(n, page, +- DEACTIVATE_TO_TAIL); +- stat(s, FREE_ADD_PARTIAL); +- } +- +- l = m; +- } +- + } while (!cmpxchg_double_slab(s, page, + old.freelist, old.counters, + new.freelist, new.counters, + "unfreezing slab")); + +- if (m == M_FREE) { ++ if (unlikely(!new.inuse && n->nr_partial > s->min_partial)) { + page->next = discard_page; + discard_page = page; ++ } else { ++ add_partial(n, page, DEACTIVATE_TO_TAIL); ++ stat(s, FREE_ADD_PARTIAL); + } + } + +diff --git a/net/can/af_can.c b/net/can/af_can.c +index 0ce2ad0696da..7d9dff2227d1 100644 +--- a/net/can/af_can.c ++++ b/net/can/af_can.c +@@ -244,6 +244,9 @@ int can_send(struct sk_buff *skb, int loop) + } + + skb->protocol = htons(ETH_P_CAN); ++ skb->ip_summed = CHECKSUM_UNNECESSARY; ++ ++ skb_reset_mac_header(skb); + skb_reset_network_header(skb); + skb_reset_transport_header(skb); + +diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c +index 3cd37e9d91a6..43c6dd8da602 100644 +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -1144,14 +1144,10 @@ static const struct nla_policy ifla_vfinfo_policy[IFLA_VF_INFO_MAX+1] = { + }; + + static const struct nla_policy ifla_vf_policy[IFLA_VF_MAX+1] = { +- [IFLA_VF_MAC] = { .type = NLA_BINARY, +- .len = sizeof(struct ifla_vf_mac) }, +- [IFLA_VF_VLAN] = { .type = NLA_BINARY, +- .len = sizeof(struct ifla_vf_vlan) }, +- [IFLA_VF_TX_RATE] = { .type = NLA_BINARY, +- .len = sizeof(struct ifla_vf_tx_rate) }, +- [IFLA_VF_SPOOFCHK] = { .type = NLA_BINARY, +- .len = sizeof(struct ifla_vf_spoofchk) }, ++ [IFLA_VF_MAC] = { .len = sizeof(struct ifla_vf_mac) }, ++ [IFLA_VF_VLAN] = { .len = sizeof(struct ifla_vf_vlan) }, ++ [IFLA_VF_TX_RATE] = { .len = sizeof(struct ifla_vf_tx_rate) }, ++ [IFLA_VF_SPOOFCHK] = { .len = sizeof(struct ifla_vf_spoofchk) }, + }; + + static const struct nla_policy ifla_port_policy[IFLA_PORT_MAX+1] = { +@@ -1698,10 +1694,10 @@ static int rtnl_group_changelink(struct net *net, int group, + struct ifinfomsg *ifm, + struct nlattr **tb) + { +- struct net_device *dev; ++ struct net_device *dev, *aux; + int err; + +- for_each_netdev(net, dev) { ++ for_each_netdev_safe(net, dev, aux) { + if (dev->group == group) { + err = do_setlink(dev, ifm, tb, NULL, 0); + if (err < 0) +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index c8643a3d2658..4cfba3d5ad2c 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -95,7 +95,7 @@ static u32 *ipv6_cow_metrics(struct dst_entry *dst, unsigned long old) + u32 *p = NULL; + + if (!(rt->dst.flags & DST_HOST)) +- return NULL; ++ return dst_cow_metrics_generic(dst, old); + + if (!rt->rt6i_peer) + rt6_bind_peer(rt, 1); +diff --git a/net/irda/ircomm/ircomm_tty.c b/net/irda/ircomm/ircomm_tty.c +index 6b9d5a0e42f9..20fec0d90049 100644 +--- a/net/irda/ircomm/ircomm_tty.c ++++ b/net/irda/ircomm/ircomm_tty.c +@@ -843,7 +843,9 @@ static void ircomm_tty_wait_until_sent(struct tty_struct *tty, int timeout) + orig_jiffies = jiffies; + + /* Set poll time to 200 ms */ +- poll_time = IRDA_MIN(timeout, msecs_to_jiffies(200)); ++ poll_time = msecs_to_jiffies(200); ++ if (timeout) ++ poll_time = min_t(unsigned long, timeout, poll_time); + + spin_lock_irqsave(&self->spinlock, flags); + while (self->tx_skb && self->tx_skb->len) { +diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c +index 64d3ce5ea1a0..df2b6ace510d 100644 +--- a/net/mac80211/agg-rx.c ++++ b/net/mac80211/agg-rx.c +@@ -49,8 +49,6 @@ static void ieee80211_free_tid_rx(struct rcu_head *h) + container_of(h, struct tid_ampdu_rx, rcu_head); + int i; + +- del_timer_sync(&tid_rx->reorder_timer); +- + for (i = 0; i < tid_rx->buf_size; i++) + dev_kfree_skb(tid_rx->reorder_buf[i]); + kfree(tid_rx->reorder_buf); +@@ -94,6 +92,12 @@ void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid, + + del_timer_sync(&tid_rx->session_timer); + ++ /* make sure ieee80211_sta_reorder_release() doesn't re-arm the timer */ ++ spin_lock_bh(&tid_rx->reorder_lock); ++ tid_rx->removed = true; ++ spin_unlock_bh(&tid_rx->reorder_lock); ++ del_timer_sync(&tid_rx->reorder_timer); ++ + call_rcu(&tid_rx->rcu_head, ieee80211_free_tid_rx); + } + +diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h +index 226be1364ef3..ca07c5e76bfe 100644 +--- a/net/mac80211/ieee80211_i.h ++++ b/net/mac80211/ieee80211_i.h +@@ -54,11 +54,25 @@ struct ieee80211_local; + + #define TU_TO_EXP_TIME(x) (jiffies + usecs_to_jiffies((x) * 1024)) + +-#define IEEE80211_DEFAULT_UAPSD_QUEUES \ +- (IEEE80211_WMM_IE_STA_QOSINFO_AC_BK | \ +- IEEE80211_WMM_IE_STA_QOSINFO_AC_BE | \ +- IEEE80211_WMM_IE_STA_QOSINFO_AC_VI | \ +- IEEE80211_WMM_IE_STA_QOSINFO_AC_VO) ++/* ++ * Some APs experience problems when working with U-APSD. Decreasing the ++ * probability of that happening by using legacy mode for all ACs but VO isn't ++ * enough. ++ * ++ * Cisco 4410N originally forced us to enable VO by default only because it ++ * treated non-VO ACs as legacy. ++ * ++ * However some APs (notably Netgear R7000) silently reclassify packets to ++ * different ACs. Since u-APSD ACs require trigger frames for frame retrieval ++ * clients would never see some frames (e.g. ARP responses) or would fetch them ++ * accidentally after a long time. ++ * ++ * It makes little sense to enable u-APSD queues by default because it needs ++ * userspace applications to be aware of it to actually take advantage of the ++ * possible additional powersavings. Implicitly depending on driver autotrigger ++ * frame support doesn't make much sense. ++ */ ++#define IEEE80211_DEFAULT_UAPSD_QUEUES 0 + + #define IEEE80211_DEFAULT_MAX_SP_LEN \ + IEEE80211_WMM_IE_STA_QOSINFO_SP_ALL +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index 24f2a4135edf..6202d0504122 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -668,9 +668,10 @@ static void ieee80211_sta_reorder_release(struct ieee80211_hw *hw, + + set_release_timer: + +- mod_timer(&tid_agg_rx->reorder_timer, +- tid_agg_rx->reorder_time[j] + 1 + +- HT_RX_REORDER_BUF_TIMEOUT); ++ if (!tid_agg_rx->removed) ++ mod_timer(&tid_agg_rx->reorder_timer, ++ tid_agg_rx->reorder_time[j] + 1 + ++ HT_RX_REORDER_BUF_TIMEOUT); + } else { + del_timer(&tid_agg_rx->reorder_timer); + } +@@ -1926,6 +1927,9 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx) + hdr = (struct ieee80211_hdr *) skb->data; + mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen); + ++ if (ieee80211_drop_unencrypted(rx, hdr->frame_control)) ++ return RX_DROP_MONITOR; ++ + /* frame is in RMC, don't forward */ + if (ieee80211_is_data(hdr->frame_control) && + is_multicast_ether_addr(hdr->addr1) && +diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h +index 249f4d087936..4e6ece8d6f06 100644 +--- a/net/mac80211/sta_info.h ++++ b/net/mac80211/sta_info.h +@@ -106,6 +106,7 @@ enum ieee80211_sta_info_flags { + * @buf_size: reorder buffer size at receiver + * @failed_bar_ssn: ssn of the last failed BAR tx attempt + * @bar_pending: BAR needs to be re-sent ++ * @removed: this session is removed (but might have been found due to RCU) + * + * This structure's lifetime is managed by RCU, assignments to + * the array holding it must hold the aggregation mutex. +@@ -169,6 +170,7 @@ struct tid_ampdu_rx { + u16 buf_size; + u16 timeout; + u8 dialog_token; ++ bool removed; + }; + + /** +diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c +index b7fc3dd4b8ef..f4f24bee99c2 100644 +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -544,9 +544,11 @@ ieee80211_tx_h_check_control_port_protocol(struct ieee80211_tx_data *tx) + { + struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb); + +- if (unlikely(tx->sdata->control_port_protocol == tx->skb->protocol && +- tx->sdata->control_port_no_encrypt)) +- info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT; ++ if (unlikely(tx->sdata->control_port_protocol == tx->skb->protocol)) { ++ if (tx->sdata->control_port_no_encrypt) ++ info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT; ++ info->flags |= IEEE80211_TX_CTL_USE_MINRATE; ++ } + + return TX_CONTINUE; + } +diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c +index e39f693dd3e4..fe3c8d7c83f7 100644 +--- a/net/netfilter/ipvs/ip_vs_ftp.c ++++ b/net/netfilter/ipvs/ip_vs_ftp.c +@@ -183,6 +183,8 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp, + struct nf_conn *ct; + struct net *net; + ++ *diff = 0; ++ + #ifdef CONFIG_IP_VS_IPV6 + /* This application helper doesn't work with IPv6 yet, + * so turn this into a no-op for IPv6 packets +@@ -191,8 +193,6 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp, + return 1; + #endif + +- *diff = 0; +- + /* Only useful for established sessions */ + if (cp->state != IP_VS_TCP_S_ESTABLISHED) + return 1; +@@ -318,6 +318,9 @@ static int ip_vs_ftp_in(struct ip_vs_app *app, struct ip_vs_conn *cp, + struct ip_vs_conn *n_cp; + struct net *net; + ++ /* no diff required for incoming packets */ ++ *diff = 0; ++ + #ifdef CONFIG_IP_VS_IPV6 + /* This application helper doesn't work with IPv6 yet, + * so turn this into a no-op for IPv6 packets +@@ -326,9 +329,6 @@ static int ip_vs_ftp_in(struct ip_vs_app *app, struct ip_vs_conn *cp, + return 1; + #endif + +- /* no diff required for incoming packets */ +- *diff = 0; +- + /* Only useful for established sessions */ + if (cp->state != IP_VS_TCP_S_ESTABLISHED) + return 1; +diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c +index 8a0d6d6889f0..6a5555c5d2b7 100644 +--- a/net/netfilter/ipvs/ip_vs_sync.c ++++ b/net/netfilter/ipvs/ip_vs_sync.c +@@ -763,6 +763,8 @@ static void ip_vs_proc_conn(struct net *net, struct ip_vs_conn_param *param, + IP_VS_DBG(2, "BACKUP, add new conn. failed\n"); + return; + } ++ if (!(flags & IP_VS_CONN_F_TEMPLATE)) ++ kfree(param->pe_data); + } else if (!cp->dest) { + dest = ip_vs_try_bind_dest(cp); + if (dest) +@@ -1064,6 +1066,7 @@ static inline int ip_vs_proc_sync_conn(struct net *net, __u8 *p, __u8 *msg_end) + (opt_flags & IPVS_OPT_F_SEQ_DATA ? &opt : NULL) + ); + #endif ++ ip_vs_pe_put(param.pe); + return 0; + /* Error exit */ + out: +diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c +index ce60cf0f6c11..9139a2642b9c 100644 +--- a/net/netfilter/nf_queue.c ++++ b/net/netfilter/nf_queue.c +@@ -255,7 +255,7 @@ int nf_queue(struct sk_buff *skb, + * returned by nf_queue. For instance, callers rely on -ECANCELED to mean + * 'ignore this hook'. + */ +- if (IS_ERR(segs)) ++ if (IS_ERR_OR_NULL(segs)) + goto out_err; + queued = 0; + err = 0; +diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c +index 72bb07f57f97..eb5086cc8515 100644 +--- a/net/netfilter/xt_socket.c ++++ b/net/netfilter/xt_socket.c +@@ -205,12 +205,13 @@ static int + extract_icmp6_fields(const struct sk_buff *skb, + unsigned int outside_hdrlen, + int *protocol, +- struct in6_addr **raddr, +- struct in6_addr **laddr, ++ const struct in6_addr **raddr, ++ const struct in6_addr **laddr, + __be16 *rport, +- __be16 *lport) ++ __be16 *lport, ++ struct ipv6hdr *ipv6_var) + { +- struct ipv6hdr *inside_iph, _inside_iph; ++ const struct ipv6hdr *inside_iph; + struct icmp6hdr *icmph, _icmph; + __be16 *ports, _ports[2]; + u8 inside_nexthdr; +@@ -225,12 +226,14 @@ extract_icmp6_fields(const struct sk_buff *skb, + if (icmph->icmp6_type & ICMPV6_INFOMSG_MASK) + return 1; + +- inside_iph = skb_header_pointer(skb, outside_hdrlen + sizeof(_icmph), sizeof(_inside_iph), &_inside_iph); ++ inside_iph = skb_header_pointer(skb, outside_hdrlen + sizeof(_icmph), ++ sizeof(*ipv6_var), ipv6_var); + if (inside_iph == NULL) + return 1; + inside_nexthdr = inside_iph->nexthdr; + +- inside_hdrlen = ipv6_skip_exthdr(skb, outside_hdrlen + sizeof(_icmph) + sizeof(_inside_iph), ++ inside_hdrlen = ipv6_skip_exthdr(skb, outside_hdrlen + sizeof(_icmph) + ++ sizeof(*ipv6_var), + &inside_nexthdr, &inside_fragoff); + if (inside_hdrlen < 0) + return 1; /* hjm: Packet has no/incomplete transport layer headers. */ +@@ -258,10 +261,10 @@ extract_icmp6_fields(const struct sk_buff *skb, + static bool + socket_mt6_v1(const struct sk_buff *skb, struct xt_action_param *par) + { +- struct ipv6hdr *iph = ipv6_hdr(skb); ++ struct ipv6hdr ipv6_var, *iph = ipv6_hdr(skb); + struct udphdr _hdr, *hp = NULL; + struct sock *sk; +- struct in6_addr *daddr, *saddr; ++ const struct in6_addr *daddr, *saddr; + __be16 dport, sport; + int thoff, tproto; + const struct xt_socket_mtinfo1 *info = (struct xt_socket_mtinfo1 *) par->matchinfo; +@@ -285,7 +288,7 @@ socket_mt6_v1(const struct sk_buff *skb, struct xt_action_param *par) + + } else if (tproto == IPPROTO_ICMPV6) { + if (extract_icmp6_fields(skb, thoff, &tproto, &saddr, &daddr, +- &sport, &dport)) ++ &sport, &dport, &ipv6_var)) + return NULL; + } else { + return NULL; +diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c +index e66341ec455c..a92d635e0780 100644 +--- a/net/openvswitch/datapath.c ++++ b/net/openvswitch/datapath.c +@@ -269,8 +269,10 @@ static int queue_gso_packets(int dp_ifindex, struct sk_buff *skb, + int err; + + segs = skb_gso_segment(skb, NETIF_F_SG | NETIF_F_HW_CSUM); +- if (IS_ERR(skb)) +- return PTR_ERR(skb); ++ if (IS_ERR(segs)) ++ return PTR_ERR(segs); ++ if (segs == NULL) ++ return -EINVAL; + + /* Queue all of the segments. */ + skb = segs; +diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c +index 76cb304f3f1a..af4dd9e1fe8f 100644 +--- a/net/sunrpc/cache.c ++++ b/net/sunrpc/cache.c +@@ -911,7 +911,7 @@ static unsigned int cache_poll(struct file *filp, poll_table *wait, + poll_wait(filp, &queue_wait, wait); + + /* alway allow write */ +- mask = POLL_OUT | POLLWRNORM; ++ mask = POLLOUT | POLLWRNORM; + + if (!rp) + return mask; +diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c +index 745973b729af..5547bd8e6f42 100644 +--- a/net/sunrpc/xprtrdma/verbs.c ++++ b/net/sunrpc/xprtrdma/verbs.c +@@ -485,7 +485,7 @@ rpcrdma_ia_open(struct rpcrdma_xprt *xprt, struct sockaddr *addr, int memreg) + if (rc) { + dprintk("RPC: %s: ib_query_device failed %d\n", + __func__, rc); +- goto out2; ++ goto out3; + } + + if (devattr.device_cap_flags & IB_DEVICE_LOCAL_DMA_LKEY) { +@@ -587,7 +587,7 @@ rpcrdma_ia_open(struct rpcrdma_xprt *xprt, struct sockaddr *addr, int memreg) + printk(KERN_ERR "%s: invalid memory registration mode %d\n", + __func__, memreg); + rc = -EINVAL; +- goto out2; ++ goto out3; + } + dprintk("RPC: %s: memory registration strategy is %d\n", + __func__, memreg); +@@ -596,6 +596,10 @@ rpcrdma_ia_open(struct rpcrdma_xprt *xprt, struct sockaddr *addr, int memreg) + ia->ri_memreg_strategy = memreg; + + return 0; ++ ++out3: ++ ib_dealloc_pd(ia->ri_pd); ++ ia->ri_pd = NULL; + out2: + rdma_destroy_id(ia->ri_id); + ia->ri_id = NULL; +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index 63c18079683a..263cbd81bbe6 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -2810,6 +2810,14 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info) + if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms)) + return -EINVAL; + ++ /* HT requires QoS, but if we don't have that just ignore HT/VHT ++ * as userspace might just pass through the capabilities from the IEs ++ * directly, rather than enforcing this restriction and returning an ++ * error in this case. ++ */ ++ if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) ++ params.ht_capa = NULL; ++ + switch (dev->ieee80211_ptr->iftype) { + case NL80211_IFTYPE_AP: + case NL80211_IFTYPE_AP_VLAN: +diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c +index 95a338c89f99..11dd2fbd476f 100644 +--- a/net/xfrm/xfrm_output.c ++++ b/net/xfrm/xfrm_output.c +@@ -151,6 +151,8 @@ static int xfrm_output_gso(struct sk_buff *skb) + kfree_skb(skb); + if (IS_ERR(segs)) + return PTR_ERR(segs); ++ if (segs == NULL) ++ return -EINVAL; + + do { + struct sk_buff *nskb = segs->next; +diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c +index 0a9891e7ba94..3bf90453d794 100644 +--- a/security/selinux/selinuxfs.c ++++ b/security/selinux/selinuxfs.c +@@ -150,7 +150,7 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf, + goto out; + + /* No partial writes. */ +- length = EINVAL; ++ length = -EINVAL; + if (*ppos != 0) + goto out; + +diff --git a/security/smack/smack.h b/security/smack/smack.h +index 4ede719922ed..cde4cc1d26d0 100644 +--- a/security/smack/smack.h ++++ b/security/smack/smack.h +@@ -298,6 +298,16 @@ static inline char *smk_of_current(void) + return smk_of_task(current_security()); + } + ++static inline char *smk_of_task_struct(const struct task_struct *t) ++{ ++ char *skp; ++ ++ rcu_read_lock(); ++ skp = smk_of_task(__task_cred(t)->security); ++ rcu_read_unlock(); ++ return skp; ++} ++ + /* + * logging functions + */ +diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c +index 45c32f074166..82df24d19a9f 100644 +--- a/security/smack/smack_lsm.c ++++ b/security/smack/smack_lsm.c +@@ -41,8 +41,6 @@ + #include + #include "smack.h" + +-#define task_security(task) (task_cred_xxx((task), security)) +- + #define TRANS_TRUE "TRUE" + #define TRANS_TRUE_SIZE 4 + +@@ -164,7 +162,7 @@ static int smack_ptrace_access_check(struct task_struct *ctp, unsigned int mode) + if (rc != 0) + return rc; + +- tsp = smk_of_task(task_security(ctp)); ++ tsp = smk_of_task_struct(ctp); + smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK); + smk_ad_setfield_u_tsk(&ad, ctp); + +@@ -190,7 +188,7 @@ static int smack_ptrace_traceme(struct task_struct *ptp) + if (rc != 0) + return rc; + +- tsp = smk_of_task(task_security(ptp)); ++ tsp = smk_of_task_struct(ptp); + smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK); + smk_ad_setfield_u_tsk(&ad, ptp); + +@@ -1518,7 +1516,7 @@ static int smk_curacc_on_task(struct task_struct *p, int access, + + smk_ad_init(&ad, caller, LSM_AUDIT_DATA_TASK); + smk_ad_setfield_u_tsk(&ad, p); +- return smk_curacc(smk_of_task(task_security(p)), access, &ad); ++ return smk_curacc(smk_of_task_struct(p), access, &ad); + } + + /** +@@ -1564,7 +1562,7 @@ static int smack_task_getsid(struct task_struct *p) + */ + static void smack_task_getsecid(struct task_struct *p, u32 *secid) + { +- *secid = smack_to_secid(smk_of_task(task_security(p))); ++ *secid = smack_to_secid(smk_of_task_struct(p)); + } + + /** +@@ -1676,7 +1674,7 @@ static int smack_task_kill(struct task_struct *p, struct siginfo *info, + * can write the receiver. + */ + if (secid == 0) +- return smk_curacc(smk_of_task(task_security(p)), MAY_WRITE, ++ return smk_curacc(smk_of_task_struct(p), MAY_WRITE, + &ad); + /* + * If the secid isn't 0 we're dealing with some USB IO +@@ -1684,7 +1682,7 @@ static int smack_task_kill(struct task_struct *p, struct siginfo *info, + * we can't take privilege into account. + */ + return smk_access(smack_from_secid(secid), +- smk_of_task(task_security(p)), MAY_WRITE, &ad); ++ smk_of_task_struct(p), MAY_WRITE, &ad); + } + + /** +@@ -1697,9 +1695,13 @@ static int smack_task_wait(struct task_struct *p) + { + struct smk_audit_info ad; + char *sp = smk_of_current(); +- char *tsp = smk_of_forked(task_security(p)); ++ char *tsp; + int rc; + ++ rcu_read_lock(); ++ tsp = smk_of_forked(__task_cred(p)->security); ++ rcu_read_unlock(); ++ + /* we don't log here, we can be overriden */ + rc = smk_access(tsp, sp, MAY_WRITE, NULL); + if (rc == 0) +@@ -1736,7 +1738,7 @@ static int smack_task_wait(struct task_struct *p) + static void smack_task_to_inode(struct task_struct *p, struct inode *inode) + { + struct inode_smack *isp = inode->i_security; +- isp->smk_inode = smk_of_task(task_security(p)); ++ isp->smk_inode = smk_of_task_struct(p); + } + + /* +@@ -2719,7 +2721,7 @@ static int smack_getprocattr(struct task_struct *p, char *name, char **value) + if (strcmp(name, "current") != 0) + return -EINVAL; + +- cp = kstrdup(smk_of_task(task_security(p)), GFP_KERNEL); ++ cp = kstrdup(smk_of_task_struct(p), GFP_KERNEL); + if (cp == NULL) + return -ENOMEM; + +diff --git a/sound/core/control.c b/sound/core/control.c +index e773d5ed1e9a..8fb4d24b920d 100644 +--- a/sound/core/control.c ++++ b/sound/core/control.c +@@ -1164,6 +1164,10 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file, + + if (info->count < 1) + return -EINVAL; ++ if (!*info->id.name) ++ return -EINVAL; ++ if (strnlen(info->id.name, sizeof(info->id.name)) >= sizeof(info->id.name)) ++ return -EINVAL; + access = info->access == 0 ? SNDRV_CTL_ELEM_ACCESS_READWRITE : + (info->access & (SNDRV_CTL_ELEM_ACCESS_READWRITE| + SNDRV_CTL_ELEM_ACCESS_INACTIVE| +diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c +index 3a907935fa09..65195a1b3da6 100644 +--- a/sound/core/pcm_native.c ++++ b/sound/core/pcm_native.c +@@ -1382,6 +1382,8 @@ static int snd_pcm_do_drain_init(struct snd_pcm_substream *substream, int state) + if (! snd_pcm_playback_empty(substream)) { + snd_pcm_do_start(substream, SNDRV_PCM_STATE_DRAINING); + snd_pcm_post_start(substream, SNDRV_PCM_STATE_DRAINING); ++ } else { ++ runtime->status->state = SNDRV_PCM_STATE_SETUP; + } + break; + case SNDRV_PCM_STATE_RUNNING: +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 9461a004f08b..b16a37f633c5 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -759,7 +759,7 @@ static void alc_auto_setup_eapd(struct hda_codec *codec, bool on) + { + /* We currently only handle front, HP */ + static hda_nid_t pins[] = { +- 0x0f, 0x10, 0x14, 0x15, 0 ++ 0x0f, 0x10, 0x14, 0x15, 0x17, 0 + }; + hda_nid_t *p; + for (p = pins; *p; p++) +diff --git a/sound/pci/riptide/riptide.c b/sound/pci/riptide/riptide.c +index 0481d94aac9b..c1cdd02d09ad 100644 +--- a/sound/pci/riptide/riptide.c ++++ b/sound/pci/riptide/riptide.c +@@ -2026,32 +2026,43 @@ snd_riptide_joystick_probe(struct pci_dev *pci, const struct pci_device_id *id) + { + static int dev; + struct gameport *gameport; ++ int ret; + + if (dev >= SNDRV_CARDS) + return -ENODEV; ++ + if (!enable[dev]) { +- dev++; +- return -ENOENT; ++ ret = -ENOENT; ++ goto inc_dev; + } + +- if (!joystick_port[dev++]) +- return 0; ++ if (!joystick_port[dev]) { ++ ret = 0; ++ goto inc_dev; ++ } + + gameport = gameport_allocate_port(); +- if (!gameport) +- return -ENOMEM; ++ if (!gameport) { ++ ret = -ENOMEM; ++ goto inc_dev; ++ } + if (!request_region(joystick_port[dev], 8, "Riptide gameport")) { + snd_printk(KERN_WARNING + "Riptide: cannot grab gameport 0x%x\n", + joystick_port[dev]); + gameport_free_port(gameport); +- return -EBUSY; ++ ret = -EBUSY; ++ goto inc_dev; + } + + gameport->io = joystick_port[dev]; + gameport_register_port(gameport); + pci_set_drvdata(pci, gameport); +- return 0; ++ ++ ret = 0; ++inc_dev: ++ dev++; ++ return ret; + } + + static void __devexit snd_riptide_joystick_remove(struct pci_dev *pci) +diff --git a/sound/pci/rme9652/hdspm.c b/sound/pci/rme9652/hdspm.c +index bc030a2088da..85d7f55eb99a 100644 +--- a/sound/pci/rme9652/hdspm.c ++++ b/sound/pci/rme9652/hdspm.c +@@ -5968,6 +5968,9 @@ static int snd_hdspm_playback_open(struct snd_pcm_substream *substream) + snd_pcm_hw_constraint_minmax(runtime, + SNDRV_PCM_HW_PARAM_PERIOD_SIZE, + 64, 8192); ++ snd_pcm_hw_constraint_minmax(runtime, ++ SNDRV_PCM_HW_PARAM_PERIODS, ++ 2, 2); + break; + } + +@@ -6042,6 +6045,9 @@ static int snd_hdspm_capture_open(struct snd_pcm_substream *substream) + snd_pcm_hw_constraint_minmax(runtime, + SNDRV_PCM_HW_PARAM_PERIOD_SIZE, + 64, 8192); ++ snd_pcm_hw_constraint_minmax(runtime, ++ SNDRV_PCM_HW_PARAM_PERIODS, ++ 2, 2); + break; + } + +diff --git a/sound/soc/codecs/adav80x.c b/sound/soc/codecs/adav80x.c +index ebd7b37b902b..81e0e2732318 100644 +--- a/sound/soc/codecs/adav80x.c ++++ b/sound/soc/codecs/adav80x.c +@@ -307,7 +307,7 @@ static int adav80x_put_deemph(struct snd_kcontrol *kcontrol, + { + struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); + struct adav80x *adav80x = snd_soc_codec_get_drvdata(codec); +- unsigned int deemph = ucontrol->value.enumerated.item[0]; ++ unsigned int deemph = ucontrol->value.integer.value[0]; + + if (deemph > 1) + return -EINVAL; +@@ -323,7 +323,7 @@ static int adav80x_get_deemph(struct snd_kcontrol *kcontrol, + struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); + struct adav80x *adav80x = snd_soc_codec_get_drvdata(codec); + +- ucontrol->value.enumerated.item[0] = adav80x->deemph; ++ ucontrol->value.integer.value[0] = adav80x->deemph; + return 0; + }; + +diff --git a/sound/soc/codecs/ak4641.c b/sound/soc/codecs/ak4641.c +index c4d165a4bddf..e1773e0c193f 100644 +--- a/sound/soc/codecs/ak4641.c ++++ b/sound/soc/codecs/ak4641.c +@@ -74,7 +74,7 @@ static int ak4641_put_deemph(struct snd_kcontrol *kcontrol, + { + struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); + struct ak4641_priv *ak4641 = snd_soc_codec_get_drvdata(codec); +- int deemph = ucontrol->value.enumerated.item[0]; ++ int deemph = ucontrol->value.integer.value[0]; + + if (deemph > 1) + return -EINVAL; +@@ -90,7 +90,7 @@ static int ak4641_get_deemph(struct snd_kcontrol *kcontrol, + struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); + struct ak4641_priv *ak4641 = snd_soc_codec_get_drvdata(codec); + +- ucontrol->value.enumerated.item[0] = ak4641->deemph; ++ ucontrol->value.integer.value[0] = ak4641->deemph; + return 0; + }; + +diff --git a/sound/soc/codecs/cs4271.c b/sound/soc/codecs/cs4271.c +index bf7141280a74..f9e2bdaf91f1 100644 +--- a/sound/soc/codecs/cs4271.c ++++ b/sound/soc/codecs/cs4271.c +@@ -261,7 +261,7 @@ static int cs4271_get_deemph(struct snd_kcontrol *kcontrol, + struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); + struct cs4271_private *cs4271 = snd_soc_codec_get_drvdata(codec); + +- ucontrol->value.enumerated.item[0] = cs4271->deemph; ++ ucontrol->value.integer.value[0] = cs4271->deemph; + return 0; + } + +@@ -271,7 +271,7 @@ static int cs4271_put_deemph(struct snd_kcontrol *kcontrol, + struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); + struct cs4271_private *cs4271 = snd_soc_codec_get_drvdata(codec); + +- cs4271->deemph = ucontrol->value.enumerated.item[0]; ++ cs4271->deemph = ucontrol->value.integer.value[0]; + return cs4271_set_deemph(codec); + } + +diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c +index 87cbf14bbdcd..e8a7608ff3de 100644 +--- a/sound/soc/codecs/sgtl5000.c ++++ b/sound/soc/codecs/sgtl5000.c +@@ -1107,13 +1107,7 @@ static int sgtl5000_set_power_regs(struct snd_soc_codec *codec) + /* Enable VDDC charge pump */ + ana_pwr |= SGTL5000_VDDC_CHRGPMP_POWERUP; + } else if (vddio >= 3100 && vdda >= 3100) { +- /* +- * if vddio and vddd > 3.1v, +- * charge pump should be clean before set ana_pwr +- */ +- snd_soc_update_bits(codec, SGTL5000_CHIP_ANA_POWER, +- SGTL5000_VDDC_CHRGPMP_POWERUP, 0); +- ++ ana_pwr &= ~SGTL5000_VDDC_CHRGPMP_POWERUP; + /* VDDC use VDDIO rail */ + lreg_ctrl |= SGTL5000_VDDC_ASSN_OVRD; + lreg_ctrl |= SGTL5000_VDDC_MAN_ASSN_VDDIO << +diff --git a/sound/soc/codecs/wm2000.c b/sound/soc/codecs/wm2000.c +index bb9f07037485..fb1f0a719396 100644 +--- a/sound/soc/codecs/wm2000.c ++++ b/sound/soc/codecs/wm2000.c +@@ -581,7 +581,7 @@ static int wm2000_anc_mode_get(struct snd_kcontrol *kcontrol, + struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); + struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev); + +- ucontrol->value.enumerated.item[0] = wm2000->anc_active; ++ ucontrol->value.integer.value[0] = wm2000->anc_active; + + return 0; + } +@@ -591,7 +591,7 @@ static int wm2000_anc_mode_put(struct snd_kcontrol *kcontrol, + { + struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); + struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev); +- int anc_active = ucontrol->value.enumerated.item[0]; ++ int anc_active = ucontrol->value.integer.value[0]; + + if (anc_active > 1) + return -EINVAL; +@@ -607,7 +607,7 @@ static int wm2000_speaker_get(struct snd_kcontrol *kcontrol, + struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); + struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev); + +- ucontrol->value.enumerated.item[0] = wm2000->spk_ena; ++ ucontrol->value.integer.value[0] = wm2000->spk_ena; + + return 0; + } +@@ -617,7 +617,7 @@ static int wm2000_speaker_put(struct snd_kcontrol *kcontrol, + { + struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); + struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev); +- int val = ucontrol->value.enumerated.item[0]; ++ int val = ucontrol->value.integer.value[0]; + + if (val > 1) + return -EINVAL; +diff --git a/sound/soc/codecs/wm8731.c b/sound/soc/codecs/wm8731.c +index 8b5afc1d2e60..3616b5b76837 100644 +--- a/sound/soc/codecs/wm8731.c ++++ b/sound/soc/codecs/wm8731.c +@@ -120,7 +120,7 @@ static int wm8731_get_deemph(struct snd_kcontrol *kcontrol, + struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); + struct wm8731_priv *wm8731 = snd_soc_codec_get_drvdata(codec); + +- ucontrol->value.enumerated.item[0] = wm8731->deemph; ++ ucontrol->value.integer.value[0] = wm8731->deemph; + + return 0; + } +@@ -130,7 +130,7 @@ static int wm8731_put_deemph(struct snd_kcontrol *kcontrol, + { + struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); + struct wm8731_priv *wm8731 = snd_soc_codec_get_drvdata(codec); +- int deemph = ucontrol->value.enumerated.item[0]; ++ int deemph = ucontrol->value.integer.value[0]; + int ret = 0; + + if (deemph > 1) +diff --git a/sound/soc/codecs/wm8903.c b/sound/soc/codecs/wm8903.c +index 7775854212f5..776653d3960f 100644 +--- a/sound/soc/codecs/wm8903.c ++++ b/sound/soc/codecs/wm8903.c +@@ -445,7 +445,7 @@ static int wm8903_get_deemph(struct snd_kcontrol *kcontrol, + struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); + struct wm8903_priv *wm8903 = snd_soc_codec_get_drvdata(codec); + +- ucontrol->value.enumerated.item[0] = wm8903->deemph; ++ ucontrol->value.integer.value[0] = wm8903->deemph; + + return 0; + } +@@ -455,7 +455,7 @@ static int wm8903_put_deemph(struct snd_kcontrol *kcontrol, + { + struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); + struct wm8903_priv *wm8903 = snd_soc_codec_get_drvdata(codec); +- int deemph = ucontrol->value.enumerated.item[0]; ++ int deemph = ucontrol->value.integer.value[0]; + int ret = 0; + + if (deemph > 1) +diff --git a/sound/soc/codecs/wm8904.c b/sound/soc/codecs/wm8904.c +index c93e360b6706..19f30401b14c 100644 +--- a/sound/soc/codecs/wm8904.c ++++ b/sound/soc/codecs/wm8904.c +@@ -528,7 +528,7 @@ static int wm8904_get_deemph(struct snd_kcontrol *kcontrol, + struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); + struct wm8904_priv *wm8904 = snd_soc_codec_get_drvdata(codec); + +- ucontrol->value.enumerated.item[0] = wm8904->deemph; ++ ucontrol->value.integer.value[0] = wm8904->deemph; + return 0; + } + +@@ -537,7 +537,7 @@ static int wm8904_put_deemph(struct snd_kcontrol *kcontrol, + { + struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); + struct wm8904_priv *wm8904 = snd_soc_codec_get_drvdata(codec); +- int deemph = ucontrol->value.enumerated.item[0]; ++ int deemph = ucontrol->value.integer.value[0]; + + if (deemph > 1) + return -EINVAL; +diff --git a/sound/soc/codecs/wm8955.c b/sound/soc/codecs/wm8955.c +index 61fe97433e73..4696f6668259 100644 +--- a/sound/soc/codecs/wm8955.c ++++ b/sound/soc/codecs/wm8955.c +@@ -393,7 +393,7 @@ static int wm8955_get_deemph(struct snd_kcontrol *kcontrol, + struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); + struct wm8955_priv *wm8955 = snd_soc_codec_get_drvdata(codec); + +- ucontrol->value.enumerated.item[0] = wm8955->deemph; ++ ucontrol->value.integer.value[0] = wm8955->deemph; + return 0; + } + +@@ -402,7 +402,7 @@ static int wm8955_put_deemph(struct snd_kcontrol *kcontrol, + { + struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); + struct wm8955_priv *wm8955 = snd_soc_codec_get_drvdata(codec); +- int deemph = ucontrol->value.enumerated.item[0]; ++ int deemph = ucontrol->value.integer.value[0]; + + if (deemph > 1) + return -EINVAL; +diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c +index a09d7eb1f02f..a3e4831bbe39 100644 +--- a/sound/soc/codecs/wm8960.c ++++ b/sound/soc/codecs/wm8960.c +@@ -132,7 +132,7 @@ static int wm8960_get_deemph(struct snd_kcontrol *kcontrol, + struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); + struct wm8960_priv *wm8960 = snd_soc_codec_get_drvdata(codec); + +- ucontrol->value.enumerated.item[0] = wm8960->deemph; ++ ucontrol->value.integer.value[0] = wm8960->deemph; + return 0; + } + +@@ -141,7 +141,7 @@ static int wm8960_put_deemph(struct snd_kcontrol *kcontrol, + { + struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); + struct wm8960_priv *wm8960 = snd_soc_codec_get_drvdata(codec); +- int deemph = ucontrol->value.enumerated.item[0]; ++ int deemph = ucontrol->value.integer.value[0]; + + if (deemph > 1) + return -EINVAL; +diff --git a/sound/soc/omap/omap-pcm.c b/sound/soc/omap/omap-pcm.c +index 5a649da9122a..96bce55a7462 100644 +--- a/sound/soc/omap/omap-pcm.c ++++ b/sound/soc/omap/omap-pcm.c +@@ -333,7 +333,7 @@ static struct snd_pcm_ops omap_pcm_ops = { + .mmap = omap_pcm_mmap, + }; + +-static u64 omap_pcm_dmamask = DMA_BIT_MASK(64); ++static u64 omap_pcm_dmamask = DMA_BIT_MASK(32); + + static int omap_pcm_preallocate_dma_buffer(struct snd_pcm *pcm, + int stream) +@@ -384,7 +384,7 @@ static int omap_pcm_new(struct snd_soc_pcm_runtime *rtd) + if (!card->dev->dma_mask) + card->dev->dma_mask = &omap_pcm_dmamask; + if (!card->dev->coherent_dma_mask) +- card->dev->coherent_dma_mask = DMA_BIT_MASK(64); ++ card->dev->coherent_dma_mask = DMA_BIT_MASK(32); + + if (pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream) { + ret = omap_pcm_preallocate_dma_buffer(pcm, +diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c +index fb95069c0437..040d1016fb20 100644 +--- a/sound/usb/mixer_quirks.c ++++ b/sound/usb/mixer_quirks.c +@@ -64,6 +64,7 @@ static const struct rc_config { + { USB_ID(0x041e, 0x3040), 2, 2, 6, 6, 2, 0x6e91 }, /* Live! 24-bit */ + { USB_ID(0x041e, 0x3042), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 */ + { USB_ID(0x041e, 0x30df), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 Pro */ ++ { USB_ID(0x041e, 0x3237), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 Pro */ + { USB_ID(0x041e, 0x3048), 2, 2, 6, 6, 2, 0x6e91 }, /* Toshiba SB0500 */ + }; + +diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h +index 5ef357983d92..2ad5d772cd92 100644 +--- a/sound/usb/quirks-table.h ++++ b/sound/usb/quirks-table.h +@@ -1871,6 +1871,36 @@ YAMAHA_DEVICE(0x7010, "UB99"), + } + } + }, ++{ ++ USB_DEVICE(0x0582, 0x0159), ++ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { ++ /* .vendor_name = "Roland", */ ++ /* .product_name = "UA-22", */ ++ .ifnum = QUIRK_ANY_INTERFACE, ++ .type = QUIRK_COMPOSITE, ++ .data = (const struct snd_usb_audio_quirk[]) { ++ { ++ .ifnum = 0, ++ .type = QUIRK_AUDIO_STANDARD_INTERFACE ++ }, ++ { ++ .ifnum = 1, ++ .type = QUIRK_AUDIO_STANDARD_INTERFACE ++ }, ++ { ++ .ifnum = 2, ++ .type = QUIRK_MIDI_FIXED_ENDPOINT, ++ .data = & (const struct snd_usb_midi_endpoint_info) { ++ .out_cables = 0x0001, ++ .in_cables = 0x0001 ++ } ++ }, ++ { ++ .ifnum = -1 ++ } ++ } ++ } ++}, + + /* Guillemot devices */ + { +diff --git a/tools/perf/Makefile b/tools/perf/Makefile +index 2db7ba001c63..331647c8ce65 100644 +--- a/tools/perf/Makefile ++++ b/tools/perf/Makefile +@@ -816,10 +816,10 @@ $(OUTPUT)util/rbtree.o: ../../lib/rbtree.c $(OUTPUT)PERF-CFLAGS + $(QUIET_CC)$(CC) -o $@ -c $(ALL_CFLAGS) -DETC_PERFCONFIG='"$(ETC_PERFCONFIG_SQ)"' $< + + $(OUTPUT)util/scripting-engines/trace-event-perl.o: util/scripting-engines/trace-event-perl.c $(OUTPUT)PERF-CFLAGS +- $(QUIET_CC)$(CC) -o $@ -c $(ALL_CFLAGS) $(PERL_EMBED_CCOPTS) -Wno-redundant-decls -Wno-strict-prototypes -Wno-unused-parameter -Wno-shadow $< ++ $(QUIET_CC)$(CC) -o $@ -c $(ALL_CFLAGS) $(PERL_EMBED_CCOPTS) -Wno-redundant-decls -Wno-strict-prototypes -Wno-unused-parameter -Wno-shadow -Wno-undef -Wno-switch-default $< + + $(OUTPUT)scripts/perl/Perf-Trace-Util/Context.o: scripts/perl/Perf-Trace-Util/Context.c $(OUTPUT)PERF-CFLAGS +- $(QUIET_CC)$(CC) -o $@ -c $(ALL_CFLAGS) $(PERL_EMBED_CCOPTS) -Wno-redundant-decls -Wno-strict-prototypes -Wno-unused-parameter -Wno-nested-externs $< ++ $(QUIET_CC)$(CC) -o $@ -c $(ALL_CFLAGS) $(PERL_EMBED_CCOPTS) -Wno-redundant-decls -Wno-strict-prototypes -Wno-unused-parameter -Wno-nested-externs -Wno-undef -Wno-switch-default $< + + $(OUTPUT)util/scripting-engines/trace-event-python.o: util/scripting-engines/trace-event-python.c $(OUTPUT)PERF-CFLAGS + $(QUIET_CC)$(CC) -o $@ -c $(ALL_CFLAGS) $(PYTHON_EMBED_CCOPTS) -Wno-redundant-decls -Wno-strict-prototypes -Wno-unused-parameter -Wno-shadow $< diff --git a/patch/kernel/sun5i-default/0014-patch-3.4.108-109.patch b/patch/kernel/sun5i-default/0014-patch-3.4.108-109.patch new file mode 100644 index 0000000000..47549c8ff6 --- /dev/null +++ b/patch/kernel/sun5i-default/0014-patch-3.4.108-109.patch @@ -0,0 +1,5116 @@ +diff --git a/Documentation/networking/rds.txt b/Documentation/networking/rds.txt +index c67077cbeb80..e1a3d59bbe0f 100644 +--- a/Documentation/networking/rds.txt ++++ b/Documentation/networking/rds.txt +@@ -62,11 +62,10 @@ Socket Interface + ================ + + AF_RDS, PF_RDS, SOL_RDS +- These constants haven't been assigned yet, because RDS isn't in +- mainline yet. Currently, the kernel module assigns some constant +- and publishes it to user space through two sysctl files +- /proc/sys/net/rds/pf_rds +- /proc/sys/net/rds/sol_rds ++ AF_RDS and PF_RDS are the domain type to be used with socket(2) ++ to create RDS sockets. SOL_RDS is the socket-level to be used ++ with setsockopt(2) and getsockopt(2) for RDS specific socket ++ options. + + fd = socket(PF_RDS, SOCK_SEQPACKET, 0); + This creates a new, unbound RDS socket. +diff --git a/Documentation/pinctrl.txt b/Documentation/pinctrl.txt +index d97bccf46147..d4647168eba0 100644 +--- a/Documentation/pinctrl.txt ++++ b/Documentation/pinctrl.txt +@@ -72,7 +72,6 @@ static struct pinctrl_desc foo_desc = { + .name = "foo", + .pins = foo_pins, + .npins = ARRAY_SIZE(foo_pins), +- .maxpin = 63, + .owner = THIS_MODULE, + }; + +@@ -166,8 +165,8 @@ static const char *foo_get_group_name(struct pinctrl_dev *pctldev, + } + + static int foo_get_group_pins(struct pinctrl_dev *pctldev, unsigned selector, +- unsigned ** const pins, +- unsigned * const num_pins) ++ const unsigned **pins, ++ unsigned *num_pins) + { + *pins = (unsigned *) foo_groups[selector].pins; + *num_pins = foo_groups[selector].num_pins; +@@ -1043,7 +1042,7 @@ The semantics of the pinctrl APIs are: + + Usually the pin control core handled the get/put pair and call out to the + device drivers bookkeeping operations, like checking available functions and +-the associated pins, whereas the enable/disable pass on to the pin controller ++the associated pins, whereas select_state pass on to the pin controller + driver which takes care of activating and/or deactivating the mux setting by + quickly poking some registers. + +@@ -1089,8 +1088,9 @@ function, but with different named in the mapping as described under + "Advanced mapping" above. So that for an SPI device, we have two states named + "pos-A" and "pos-B". + +-This snippet first muxes the function in the pins defined by group A, enables +-it, disables and releases it, and muxes it in on the pins defined by group B: ++This snippet first initializes a state object for both groups (in foo_probe()), ++then muxes the function in the pins defined by group A, and finally muxes it in ++on the pins defined by group B: + + #include + +diff --git a/Makefile b/Makefile +index 5056e1bba7e8..7337720d6599 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 4 +-SUBLEVEL = 108 ++SUBLEVEL = 109 + EXTRAVERSION = + NAME = Saber-toothed Squirrel + +diff --git a/arch/arm/boot/dts/imx27.dtsi b/arch/arm/boot/dts/imx27.dtsi +index bc5e7d5ddd54..9cc8ed2310e7 100644 +--- a/arch/arm/boot/dts/imx27.dtsi ++++ b/arch/arm/boot/dts/imx27.dtsi +@@ -208,7 +208,7 @@ + + fec: fec@1002b000 { + compatible = "fsl,imx27-fec"; +- reg = <0x1002b000 0x4000>; ++ reg = <0x1002b000 0x1000>; + interrupts = <50>; + status = "disabled"; + }; +diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h +index 38050b1c4800..dfc980ba7416 100644 +--- a/arch/arm/include/asm/elf.h ++++ b/arch/arm/include/asm/elf.h +@@ -116,7 +116,7 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs); + the loader. We need to make sure that it is out of the way of the program + that it will "exec", and that there is sufficient room for the brk. */ + +-#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3) ++#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2) + + /* When the program starts, a1 contains a pointer to a function to be + registered with atexit, as per the SVR4 ABI. A value of 0 means we +diff --git a/arch/arm/mach-pxa/Kconfig b/arch/arm/mach-pxa/Kconfig +index fe2d1f80ef50..2f8b17163a51 100644 +--- a/arch/arm/mach-pxa/Kconfig ++++ b/arch/arm/mach-pxa/Kconfig +@@ -718,4 +718,13 @@ config PXA_HAVE_ISA_IRQS + config PXA310_ULPI + bool + ++config PXA_SYSTEMS_CPLDS ++ tristate "Motherboard cplds" ++ default ARCH_LUBBOCK || MACH_MAINSTONE ++ help ++ This driver supports the Lubbock and Mainstone multifunction chip ++ found on the pxa25x development platform system (Lubbock) and pxa27x ++ development platform system (Mainstone). This IO board supports the ++ interrupts handling, ethernet controller, flash chips, etc ... ++ + endif +diff --git a/arch/arm/mach-pxa/Makefile b/arch/arm/mach-pxa/Makefile +index be0f7df8685c..318c0d756bc7 100644 +--- a/arch/arm/mach-pxa/Makefile ++++ b/arch/arm/mach-pxa/Makefile +@@ -103,4 +103,5 @@ led-$(CONFIG_ARCH_PXA_IDP) += leds-idp.o + + obj-$(CONFIG_LEDS) += $(led-y) + ++obj-$(CONFIG_PXA_SYSTEMS_CPLDS) += pxa_cplds_irqs.o + obj-$(CONFIG_TOSA_BT) += tosa-bt.o +diff --git a/arch/arm/mach-pxa/include/mach/lubbock.h b/arch/arm/mach-pxa/include/mach/lubbock.h +index 2a086e8373eb..b20b97e1df4c 100644 +--- a/arch/arm/mach-pxa/include/mach/lubbock.h ++++ b/arch/arm/mach-pxa/include/mach/lubbock.h +@@ -35,7 +35,9 @@ + #define LUB_GP __LUB_REG(LUBBOCK_FPGA_PHYS + 0x100) + + /* Board specific IRQs */ +-#define LUBBOCK_IRQ(x) (IRQ_BOARD_START + (x)) ++#define LUBBOCK_NR_IRQS IRQ_BOARD_START ++ ++#define LUBBOCK_IRQ(x) (LUBBOCK_NR_IRQS + (x)) + #define LUBBOCK_SD_IRQ LUBBOCK_IRQ(0) + #define LUBBOCK_SA1111_IRQ LUBBOCK_IRQ(1) + #define LUBBOCK_USB_IRQ LUBBOCK_IRQ(2) /* usb connect */ +@@ -45,8 +47,7 @@ + #define LUBBOCK_USB_DISC_IRQ LUBBOCK_IRQ(6) /* usb disconnect */ + #define LUBBOCK_LAST_IRQ LUBBOCK_IRQ(6) + +-#define LUBBOCK_SA1111_IRQ_BASE (IRQ_BOARD_START + 16) +-#define LUBBOCK_NR_IRQS (IRQ_BOARD_START + 16 + 55) ++#define LUBBOCK_SA1111_IRQ_BASE (LUBBOCK_NR_IRQS + 32) + + #ifndef __ASSEMBLY__ + extern void lubbock_set_misc_wr(unsigned int mask, unsigned int set); +diff --git a/arch/arm/mach-pxa/include/mach/mainstone.h b/arch/arm/mach-pxa/include/mach/mainstone.h +index 1bfc4e822a41..e82a7d31104e 100644 +--- a/arch/arm/mach-pxa/include/mach/mainstone.h ++++ b/arch/arm/mach-pxa/include/mach/mainstone.h +@@ -120,7 +120,9 @@ + #define MST_PCMCIA_PWR_VCC_50 0x4 /* voltage VCC = 5.0V */ + + /* board specific IRQs */ +-#define MAINSTONE_IRQ(x) (IRQ_BOARD_START + (x)) ++#define MAINSTONE_NR_IRQS IRQ_BOARD_START ++ ++#define MAINSTONE_IRQ(x) (MAINSTONE_NR_IRQS + (x)) + #define MAINSTONE_MMC_IRQ MAINSTONE_IRQ(0) + #define MAINSTONE_USIM_IRQ MAINSTONE_IRQ(1) + #define MAINSTONE_USBC_IRQ MAINSTONE_IRQ(2) +@@ -136,6 +138,4 @@ + #define MAINSTONE_S1_STSCHG_IRQ MAINSTONE_IRQ(14) + #define MAINSTONE_S1_IRQ MAINSTONE_IRQ(15) + +-#define MAINSTONE_NR_IRQS (IRQ_BOARD_START + 16) +- + #endif +diff --git a/arch/arm/mach-pxa/lubbock.c b/arch/arm/mach-pxa/lubbock.c +index 6bb3f47b1f14..799f31f2c7ff 100644 +--- a/arch/arm/mach-pxa/lubbock.c ++++ b/arch/arm/mach-pxa/lubbock.c +@@ -12,6 +12,7 @@ + * published by the Free Software Foundation. + */ + #include ++#include + #include + #include + #include +@@ -120,84 +121,6 @@ void lubbock_set_misc_wr(unsigned int mask, unsigned int set) + } + EXPORT_SYMBOL(lubbock_set_misc_wr); + +-static unsigned long lubbock_irq_enabled; +- +-static void lubbock_mask_irq(struct irq_data *d) +-{ +- int lubbock_irq = (d->irq - LUBBOCK_IRQ(0)); +- LUB_IRQ_MASK_EN = (lubbock_irq_enabled &= ~(1 << lubbock_irq)); +-} +- +-static void lubbock_unmask_irq(struct irq_data *d) +-{ +- int lubbock_irq = (d->irq - LUBBOCK_IRQ(0)); +- /* the irq can be acknowledged only if deasserted, so it's done here */ +- LUB_IRQ_SET_CLR &= ~(1 << lubbock_irq); +- LUB_IRQ_MASK_EN = (lubbock_irq_enabled |= (1 << lubbock_irq)); +-} +- +-static struct irq_chip lubbock_irq_chip = { +- .name = "FPGA", +- .irq_ack = lubbock_mask_irq, +- .irq_mask = lubbock_mask_irq, +- .irq_unmask = lubbock_unmask_irq, +-}; +- +-static void lubbock_irq_handler(unsigned int irq, struct irq_desc *desc) +-{ +- unsigned long pending = LUB_IRQ_SET_CLR & lubbock_irq_enabled; +- do { +- /* clear our parent irq */ +- desc->irq_data.chip->irq_ack(&desc->irq_data); +- if (likely(pending)) { +- irq = LUBBOCK_IRQ(0) + __ffs(pending); +- generic_handle_irq(irq); +- } +- pending = LUB_IRQ_SET_CLR & lubbock_irq_enabled; +- } while (pending); +-} +- +-static void __init lubbock_init_irq(void) +-{ +- int irq; +- +- pxa25x_init_irq(); +- +- /* setup extra lubbock irqs */ +- for (irq = LUBBOCK_IRQ(0); irq <= LUBBOCK_LAST_IRQ; irq++) { +- irq_set_chip_and_handler(irq, &lubbock_irq_chip, +- handle_level_irq); +- set_irq_flags(irq, IRQF_VALID | IRQF_PROBE); +- } +- +- irq_set_chained_handler(PXA_GPIO_TO_IRQ(0), lubbock_irq_handler); +- irq_set_irq_type(PXA_GPIO_TO_IRQ(0), IRQ_TYPE_EDGE_FALLING); +-} +- +-#ifdef CONFIG_PM +- +-static void lubbock_irq_resume(void) +-{ +- LUB_IRQ_MASK_EN = lubbock_irq_enabled; +-} +- +-static struct syscore_ops lubbock_irq_syscore_ops = { +- .resume = lubbock_irq_resume, +-}; +- +-static int __init lubbock_irq_device_init(void) +-{ +- if (machine_is_lubbock()) { +- register_syscore_ops(&lubbock_irq_syscore_ops); +- return 0; +- } +- return -ENODEV; +-} +- +-device_initcall(lubbock_irq_device_init); +- +-#endif +- + static int lubbock_udc_is_connected(void) + { + return (LUB_MISC_RD & (1 << 9)) == 0; +@@ -380,11 +303,38 @@ static struct platform_device lubbock_flash_device[2] = { + }, + }; + ++static struct resource lubbock_cplds_resources[] = { ++ [0] = { ++ .start = LUBBOCK_FPGA_PHYS + 0xc0, ++ .end = LUBBOCK_FPGA_PHYS + 0xe0 - 1, ++ .flags = IORESOURCE_MEM, ++ }, ++ [1] = { ++ .start = PXA_GPIO_TO_IRQ(0), ++ .end = PXA_GPIO_TO_IRQ(0), ++ .flags = IORESOURCE_IRQ | IORESOURCE_IRQ_LOWEDGE, ++ }, ++ [2] = { ++ .start = LUBBOCK_IRQ(0), ++ .end = LUBBOCK_IRQ(6), ++ .flags = IORESOURCE_IRQ, ++ }, ++}; ++ ++static struct platform_device lubbock_cplds_device = { ++ .name = "pxa_cplds_irqs", ++ .id = -1, ++ .resource = &lubbock_cplds_resources[0], ++ .num_resources = 3, ++}; ++ ++ + static struct platform_device *devices[] __initdata = { + &sa1111_device, + &smc91x_device, + &lubbock_flash_device[0], + &lubbock_flash_device[1], ++ &lubbock_cplds_device, + }; + + static struct pxafb_mode_info sharp_lm8v31_mode = { +@@ -553,7 +503,7 @@ MACHINE_START(LUBBOCK, "Intel DBPXA250 Development Platform (aka Lubbock)") + /* Maintainer: MontaVista Software Inc. */ + .map_io = lubbock_map_io, + .nr_irqs = LUBBOCK_NR_IRQS, +- .init_irq = lubbock_init_irq, ++ .init_irq = pxa25x_init_irq, + .handle_irq = pxa25x_handle_irq, + .timer = &pxa_timer, + .init_machine = lubbock_init, +diff --git a/arch/arm/mach-pxa/mainstone.c b/arch/arm/mach-pxa/mainstone.c +index 1aebaf719462..3d679dbc3cc6 100644 +--- a/arch/arm/mach-pxa/mainstone.c ++++ b/arch/arm/mach-pxa/mainstone.c +@@ -13,6 +13,7 @@ + * published by the Free Software Foundation. + */ + #include ++#include + #include + #include + #include +@@ -120,92 +121,6 @@ static unsigned long mainstone_pin_config[] = { + GPIO1_GPIO | WAKEUP_ON_EDGE_BOTH, + }; + +-static unsigned long mainstone_irq_enabled; +- +-static void mainstone_mask_irq(struct irq_data *d) +-{ +- int mainstone_irq = (d->irq - MAINSTONE_IRQ(0)); +- MST_INTMSKENA = (mainstone_irq_enabled &= ~(1 << mainstone_irq)); +-} +- +-static void mainstone_unmask_irq(struct irq_data *d) +-{ +- int mainstone_irq = (d->irq - MAINSTONE_IRQ(0)); +- /* the irq can be acknowledged only if deasserted, so it's done here */ +- MST_INTSETCLR &= ~(1 << mainstone_irq); +- MST_INTMSKENA = (mainstone_irq_enabled |= (1 << mainstone_irq)); +-} +- +-static struct irq_chip mainstone_irq_chip = { +- .name = "FPGA", +- .irq_ack = mainstone_mask_irq, +- .irq_mask = mainstone_mask_irq, +- .irq_unmask = mainstone_unmask_irq, +-}; +- +-static void mainstone_irq_handler(unsigned int irq, struct irq_desc *desc) +-{ +- unsigned long pending = MST_INTSETCLR & mainstone_irq_enabled; +- do { +- /* clear useless edge notification */ +- desc->irq_data.chip->irq_ack(&desc->irq_data); +- if (likely(pending)) { +- irq = MAINSTONE_IRQ(0) + __ffs(pending); +- generic_handle_irq(irq); +- } +- pending = MST_INTSETCLR & mainstone_irq_enabled; +- } while (pending); +-} +- +-static void __init mainstone_init_irq(void) +-{ +- int irq; +- +- pxa27x_init_irq(); +- +- /* setup extra Mainstone irqs */ +- for(irq = MAINSTONE_IRQ(0); irq <= MAINSTONE_IRQ(15); irq++) { +- irq_set_chip_and_handler(irq, &mainstone_irq_chip, +- handle_level_irq); +- if (irq == MAINSTONE_IRQ(10) || irq == MAINSTONE_IRQ(14)) +- set_irq_flags(irq, IRQF_VALID | IRQF_PROBE | IRQF_NOAUTOEN); +- else +- set_irq_flags(irq, IRQF_VALID | IRQF_PROBE); +- } +- set_irq_flags(MAINSTONE_IRQ(8), 0); +- set_irq_flags(MAINSTONE_IRQ(12), 0); +- +- MST_INTMSKENA = 0; +- MST_INTSETCLR = 0; +- +- irq_set_chained_handler(PXA_GPIO_TO_IRQ(0), mainstone_irq_handler); +- irq_set_irq_type(PXA_GPIO_TO_IRQ(0), IRQ_TYPE_EDGE_FALLING); +-} +- +-#ifdef CONFIG_PM +- +-static void mainstone_irq_resume(void) +-{ +- MST_INTMSKENA = mainstone_irq_enabled; +-} +- +-static struct syscore_ops mainstone_irq_syscore_ops = { +- .resume = mainstone_irq_resume, +-}; +- +-static int __init mainstone_irq_device_init(void) +-{ +- if (machine_is_mainstone()) +- register_syscore_ops(&mainstone_irq_syscore_ops); +- +- return 0; +-} +- +-device_initcall(mainstone_irq_device_init); +- +-#endif +- +- + static struct resource smc91x_resources[] = { + [0] = { + .start = (MST_ETH_PHYS + 0x300), +@@ -483,11 +398,37 @@ static struct platform_device mst_gpio_keys_device = { + }, + }; + ++static struct resource mst_cplds_resources[] = { ++ [0] = { ++ .start = MST_FPGA_PHYS + 0xc0, ++ .end = MST_FPGA_PHYS + 0xe0 - 1, ++ .flags = IORESOURCE_MEM, ++ }, ++ [1] = { ++ .start = PXA_GPIO_TO_IRQ(0), ++ .end = PXA_GPIO_TO_IRQ(0), ++ .flags = IORESOURCE_IRQ | IORESOURCE_IRQ_LOWEDGE, ++ }, ++ [2] = { ++ .start = MAINSTONE_IRQ(0), ++ .end = MAINSTONE_IRQ(15), ++ .flags = IORESOURCE_IRQ, ++ }, ++}; ++ ++static struct platform_device mst_cplds_device = { ++ .name = "pxa_cplds_irqs", ++ .id = -1, ++ .resource = &mst_cplds_resources[0], ++ .num_resources = 3, ++}; ++ + static struct platform_device *platform_devices[] __initdata = { + &smc91x_device, + &mst_flash_device[0], + &mst_flash_device[1], + &mst_gpio_keys_device, ++ &mst_cplds_device, + }; + + static struct pxaohci_platform_data mainstone_ohci_platform_data = { +@@ -618,7 +559,7 @@ MACHINE_START(MAINSTONE, "Intel HCDDBBVA0 Development Platform (aka Mainstone)") + .atag_offset = 0x100, /* BLOB boot parameter setting */ + .map_io = mainstone_map_io, + .nr_irqs = MAINSTONE_NR_IRQS, +- .init_irq = mainstone_init_irq, ++ .init_irq = pxa27x_init_irq, + .handle_irq = pxa27x_handle_irq, + .timer = &pxa_timer, + .init_machine = mainstone_init, +diff --git a/arch/arm/mach-pxa/pxa_cplds_irqs.c b/arch/arm/mach-pxa/pxa_cplds_irqs.c +new file mode 100644 +index 000000000000..f1aeb54fabe3 +--- /dev/null ++++ b/arch/arm/mach-pxa/pxa_cplds_irqs.c +@@ -0,0 +1,200 @@ ++/* ++ * Intel Reference Systems cplds ++ * ++ * Copyright (C) 2014 Robert Jarzmik ++ * ++ * This program is free software; you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License as published by ++ * the Free Software Foundation; either version 2 of the License, or ++ * (at your option) any later version. ++ * ++ * Cplds motherboard driver, supporting lubbock and mainstone SoC board. ++ */ ++ ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++ ++#define FPGA_IRQ_MASK_EN 0x0 ++#define FPGA_IRQ_SET_CLR 0x10 ++ ++#define CPLDS_NB_IRQ 32 ++ ++struct cplds { ++ void __iomem *base; ++ int irq; ++ unsigned int irq_mask; ++ struct gpio_desc *gpio0; ++ struct irq_domain *irqdomain; ++}; ++ ++static irqreturn_t cplds_irq_handler(int in_irq, void *d) ++{ ++ struct cplds *fpga = d; ++ unsigned long pending; ++ unsigned int bit; ++ ++ pending = readl(fpga->base + FPGA_IRQ_SET_CLR) & fpga->irq_mask; ++ for_each_set_bit(bit, &pending, CPLDS_NB_IRQ) ++ generic_handle_irq(irq_find_mapping(fpga->irqdomain, bit)); ++ ++ return IRQ_HANDLED; ++} ++ ++static void cplds_irq_mask_ack(struct irq_data *d) ++{ ++ struct cplds *fpga = irq_data_get_irq_chip_data(d); ++ unsigned int cplds_irq = irqd_to_hwirq(d); ++ unsigned int set, bit = BIT(cplds_irq); ++ ++ fpga->irq_mask &= ~bit; ++ writel(fpga->irq_mask, fpga->base + FPGA_IRQ_MASK_EN); ++ set = readl(fpga->base + FPGA_IRQ_SET_CLR); ++ writel(set & ~bit, fpga->base + FPGA_IRQ_SET_CLR); ++} ++ ++static void cplds_irq_unmask(struct irq_data *d) ++{ ++ struct cplds *fpga = irq_data_get_irq_chip_data(d); ++ unsigned int cplds_irq = irqd_to_hwirq(d); ++ unsigned int bit = BIT(cplds_irq); ++ ++ fpga->irq_mask |= bit; ++ writel(fpga->irq_mask, fpga->base + FPGA_IRQ_MASK_EN); ++} ++ ++static struct irq_chip cplds_irq_chip = { ++ .name = "pxa_cplds", ++ .irq_mask_ack = cplds_irq_mask_ack, ++ .irq_unmask = cplds_irq_unmask, ++ .flags = IRQCHIP_MASK_ON_SUSPEND | IRQCHIP_SKIP_SET_WAKE, ++}; ++ ++static int cplds_irq_domain_map(struct irq_domain *d, unsigned int irq, ++ irq_hw_number_t hwirq) ++{ ++ struct cplds *fpga = d->host_data; ++ ++ irq_set_chip_and_handler(irq, &cplds_irq_chip, handle_level_irq); ++ irq_set_chip_data(irq, fpga); ++ ++ return 0; ++} ++ ++static const struct irq_domain_ops cplds_irq_domain_ops = { ++ .xlate = irq_domain_xlate_twocell, ++ .map = cplds_irq_domain_map, ++}; ++ ++static int cplds_resume(struct platform_device *pdev) ++{ ++ struct cplds *fpga = platform_get_drvdata(pdev); ++ ++ writel(fpga->irq_mask, fpga->base + FPGA_IRQ_MASK_EN); ++ ++ return 0; ++} ++ ++static int cplds_probe(struct platform_device *pdev) ++{ ++ struct resource *res; ++ struct cplds *fpga; ++ int ret; ++ unsigned int base_irq = 0; ++ unsigned long irqflags = 0; ++ ++ fpga = devm_kzalloc(&pdev->dev, sizeof(*fpga), GFP_KERNEL); ++ if (!fpga) ++ return -ENOMEM; ++ ++ res = platform_get_resource(pdev, IORESOURCE_IRQ, 0); ++ if (res) { ++ fpga->irq = (unsigned int)res->start; ++ irqflags = res->flags; ++ } ++ if (!fpga->irq) ++ return -ENODEV; ++ ++ base_irq = platform_get_irq(pdev, 1); ++ if (base_irq < 0) ++ base_irq = 0; ++ ++ res = platform_get_resource(pdev, IORESOURCE_MEM, 0); ++ fpga->base = devm_ioremap_resource(&pdev->dev, res); ++ if (IS_ERR(fpga->base)) ++ return PTR_ERR(fpga->base); ++ ++ platform_set_drvdata(pdev, fpga); ++ ++ writel(fpga->irq_mask, fpga->base + FPGA_IRQ_MASK_EN); ++ writel(0, fpga->base + FPGA_IRQ_SET_CLR); ++ ++ ret = devm_request_irq(&pdev->dev, fpga->irq, cplds_irq_handler, ++ irqflags, dev_name(&pdev->dev), fpga); ++ if (ret == -ENOSYS) ++ return -EPROBE_DEFER; ++ ++ if (ret) { ++ dev_err(&pdev->dev, "couldn't request main irq%d: %d\n", ++ fpga->irq, ret); ++ return ret; ++ } ++ ++ irq_set_irq_wake(fpga->irq, 1); ++ fpga->irqdomain = irq_domain_add_linear(pdev->dev.of_node, ++ CPLDS_NB_IRQ, ++ &cplds_irq_domain_ops, fpga); ++ if (!fpga->irqdomain) ++ return -ENODEV; ++ ++ if (base_irq) { ++ ret = irq_create_strict_mappings(fpga->irqdomain, base_irq, 0, ++ CPLDS_NB_IRQ); ++ if (ret) { ++ dev_err(&pdev->dev, "couldn't create the irq mapping %d..%d\n", ++ base_irq, base_irq + CPLDS_NB_IRQ); ++ return ret; ++ } ++ } ++ ++ return 0; ++} ++ ++static int cplds_remove(struct platform_device *pdev) ++{ ++ struct cplds *fpga = platform_get_drvdata(pdev); ++ ++ irq_set_chip_and_handler(fpga->irq, NULL, NULL); ++ ++ return 0; ++} ++ ++static const struct of_device_id cplds_id_table[] = { ++ { .compatible = "intel,lubbock-cplds-irqs", }, ++ { .compatible = "intel,mainstone-cplds-irqs", }, ++ { } ++}; ++MODULE_DEVICE_TABLE(of, cplds_id_table); ++ ++static struct platform_driver cplds_driver = { ++ .driver = { ++ .name = "pxa_cplds_irqs", ++ .of_match_table = of_match_ptr(cplds_id_table), ++ }, ++ .probe = cplds_probe, ++ .remove = cplds_remove, ++ .resume = cplds_resume, ++}; ++ ++module_platform_driver(cplds_driver); ++ ++MODULE_DESCRIPTION("PXA Cplds interrupts driver"); ++MODULE_AUTHOR("Robert Jarzmik "); ++MODULE_LICENSE("GPL"); +diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c +index 62135849f48b..ad941453340a 100644 +--- a/arch/arm/net/bpf_jit_32.c ++++ b/arch/arm/net/bpf_jit_32.c +@@ -52,6 +52,7 @@ + #define SEEN_DATA (1 << (BPF_MEMWORDS + 3)) + + #define FLAG_NEED_X_RESET (1 << 0) ++#define FLAG_IMM_OVERFLOW (1 << 1) + + struct jit_ctx { + const struct sk_filter *skf; +@@ -286,6 +287,15 @@ static u16 imm_offset(u32 k, struct jit_ctx *ctx) + /* PC in ARM mode == address of the instruction + 8 */ + imm = offset - (8 + ctx->idx * 4); + ++ if (imm & ~0xfff) { ++ /* ++ * literal pool is too far, signal it into flags. we ++ * can only detect it on the second pass unfortunately. ++ */ ++ ctx->flags |= FLAG_IMM_OVERFLOW; ++ return 0; ++ } ++ + return imm; + } + +@@ -817,6 +827,14 @@ b_epilogue: + default: + return -1; + } ++ ++ if (ctx->flags & FLAG_IMM_OVERFLOW) ++ /* ++ * this instruction generated an overflow when ++ * trying to access the literal pool, so ++ * delegate this filter to the kernel interpreter. ++ */ ++ return -1; + } + + /* compute offsets only during the first pass */ +@@ -876,7 +894,14 @@ void bpf_jit_compile(struct sk_filter *fp) + + ctx.idx = 0; + build_prologue(&ctx); +- build_body(&ctx); ++ if (build_body(&ctx) < 0) { ++#if __LINUX_ARM_ARCH__ < 7 ++ if (ctx.imm_count) ++ kfree(ctx.imms); ++#endif ++ bpf_jit_binary_free(header); ++ goto out; ++ } + build_epilogue(&ctx); + + flush_icache_range((u32)ctx.target, (u32)(ctx.target + ctx.idx)); +diff --git a/arch/c6x/kernel/time.c b/arch/c6x/kernel/time.c +index 356ee84cad95..04845aaf5985 100644 +--- a/arch/c6x/kernel/time.c ++++ b/arch/c6x/kernel/time.c +@@ -49,7 +49,7 @@ u64 sched_clock(void) + return (tsc * sched_clock_multiplier) >> SCHED_CLOCK_SHIFT; + } + +-void time_init(void) ++void __init time_init(void) + { + u64 tmp = (u64)NSEC_PER_SEC << SCHED_CLOCK_SHIFT; + +diff --git a/arch/mips/kernel/irq.c b/arch/mips/kernel/irq.c +index a5aa43d07c8e..9cd8cbf9bd43 100644 +--- a/arch/mips/kernel/irq.c ++++ b/arch/mips/kernel/irq.c +@@ -110,7 +110,7 @@ void __init init_IRQ(void) + #endif + } + +-#ifdef DEBUG_STACKOVERFLOW ++#ifdef CONFIG_DEBUG_STACKOVERFLOW + static inline void check_stack_overflow(void) + { + unsigned long sp; +diff --git a/arch/mips/power/hibernate.S b/arch/mips/power/hibernate.S +index 5bf34ec89669..2ca17353fc0c 100644 +--- a/arch/mips/power/hibernate.S ++++ b/arch/mips/power/hibernate.S +@@ -31,6 +31,8 @@ LEAF(swsusp_arch_suspend) + END(swsusp_arch_suspend) + + LEAF(swsusp_arch_resume) ++ /* Avoid TLB mismatch during and after kernel resume */ ++ jal local_flush_tlb_all + PTR_L t0, restore_pblist + 0: + PTR_L t1, PBE_ADDRESS(t0) /* source */ +@@ -44,7 +46,6 @@ LEAF(swsusp_arch_resume) + bne t1, t3, 1b + PTR_L t0, PBE_NEXT(t0) + bnez t0, 0b +- jal local_flush_tlb_all /* Avoid TLB mismatch after kernel resume */ + PTR_LA t0, saved_regs + PTR_L ra, PT_R31(t0) + PTR_L sp, PT_R29(t0) +diff --git a/arch/powerpc/kernel/cacheinfo.c b/arch/powerpc/kernel/cacheinfo.c +index b4437e8a7a8f..334254c5292e 100644 +--- a/arch/powerpc/kernel/cacheinfo.c ++++ b/arch/powerpc/kernel/cacheinfo.c +@@ -62,12 +62,22 @@ struct cache_type_info { + }; + + /* These are used to index the cache_type_info array. */ +-#define CACHE_TYPE_UNIFIED 0 +-#define CACHE_TYPE_INSTRUCTION 1 +-#define CACHE_TYPE_DATA 2 ++#define CACHE_TYPE_UNIFIED 0 /* cache-size, cache-block-size, etc. */ ++#define CACHE_TYPE_UNIFIED_D 1 /* d-cache-size, d-cache-block-size, etc */ ++#define CACHE_TYPE_INSTRUCTION 2 ++#define CACHE_TYPE_DATA 3 + + static const struct cache_type_info cache_type_info[] = { + { ++ /* Embedded systems that use cache-size, cache-block-size, ++ * etc. for the Unified (typically L2) cache. */ ++ .name = "Unified", ++ .size_prop = "cache-size", ++ .line_size_props = { "cache-line-size", ++ "cache-block-size", }, ++ .nr_sets_prop = "cache-sets", ++ }, ++ { + /* PowerPC Processor binding says the [di]-cache-* + * must be equal on unified caches, so just use + * d-cache properties. */ +@@ -293,7 +303,8 @@ static struct cache *cache_find_first_sibling(struct cache *cache) + { + struct cache *iter; + +- if (cache->type == CACHE_TYPE_UNIFIED) ++ if (cache->type == CACHE_TYPE_UNIFIED || ++ cache->type == CACHE_TYPE_UNIFIED_D) + return cache; + + list_for_each_entry(iter, &cache_list, list) +@@ -324,15 +335,27 @@ static bool cache_node_is_unified(const struct device_node *np) + return of_get_property(np, "cache-unified", NULL); + } + +-static struct cache *__cpuinit cache_do_one_devnode_unified(struct device_node *node, int level) ++/* ++ * Unified caches can have two different sets of tags. Most embedded ++ * use cache-size, etc. for the unified cache size, but open firmware systems ++ * use d-cache-size, etc. Check on initialization for which type we have, and ++ * return the appropriate structure type. Assume it's embedded if it isn't ++ * open firmware. If it's yet a 3rd type, then there will be missing entries ++ * in /sys/devices/system/cpu/cpu0/cache/index2/, and this code will need ++ * to be extended further. ++ */ ++static int cache_is_unified_d(const struct device_node *np) + { +- struct cache *cache; ++ return of_get_property(np, ++ cache_type_info[CACHE_TYPE_UNIFIED_D].size_prop, NULL) ? ++ CACHE_TYPE_UNIFIED_D : CACHE_TYPE_UNIFIED; ++} + ++static struct cache *__cpuinit cache_do_one_devnode_unified(struct device_node *node, int level) ++{ + pr_debug("creating L%d ucache for %s\n", level, node->full_name); + +- cache = new_cache(CACHE_TYPE_UNIFIED, level, node); +- +- return cache; ++ return new_cache(cache_is_unified_d(node), level, node); + } + + static struct cache *__cpuinit cache_do_one_devnode_split(struct device_node *node, int level) +diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S +index 7703569b5d4f..6be807d29b1d 100644 +--- a/arch/powerpc/kernel/vmlinux.lds.S ++++ b/arch/powerpc/kernel/vmlinux.lds.S +@@ -213,6 +213,7 @@ SECTIONS + *(.opd) + } + ++ . = ALIGN(256); + .got : AT(ADDR(.got) - LOAD_OFFSET) { + __toc_start = .; + *(.got) +diff --git a/arch/powerpc/perf/callchain.c b/arch/powerpc/perf/callchain.c +index e8a18d1cc7c9..a9bd794652c9 100644 +--- a/arch/powerpc/perf/callchain.c ++++ b/arch/powerpc/perf/callchain.c +@@ -243,7 +243,7 @@ static void perf_callchain_user_64(struct perf_callchain_entry *entry, + sp = regs->gpr[1]; + perf_callchain_store(entry, next_ip); + +- for (;;) { ++ while (entry->nr < PERF_MAX_STACK_DEPTH) { + fp = (unsigned long __user *) sp; + if (!valid_user_sp(sp, 1) || read_user_stack_64(fp, &next_sp)) + return; +diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c +index 0f1b706506ed..27672762746b 100644 +--- a/arch/powerpc/platforms/pseries/dlpar.c ++++ b/arch/powerpc/platforms/pseries/dlpar.c +@@ -416,6 +416,12 @@ static ssize_t dlpar_cpu_probe(const char *buf, size_t count) + goto out; + } + ++ rc = dlpar_acquire_drc(drc_index); ++ if (rc) { ++ rc = -EINVAL; ++ goto out; ++ } ++ + dn = dlpar_configure_connector(drc_index); + if (!dn) { + rc = -EINVAL; +@@ -436,13 +442,6 @@ static ssize_t dlpar_cpu_probe(const char *buf, size_t count) + kfree(dn->full_name); + dn->full_name = cpu_name; + +- rc = dlpar_acquire_drc(drc_index); +- if (rc) { +- dlpar_free_cc_nodes(dn); +- rc = -EINVAL; +- goto out; +- } +- + rc = dlpar_attach_node(dn); + if (rc) { + dlpar_release_drc(drc_index); +diff --git a/arch/s390/crypto/ghash_s390.c b/arch/s390/crypto/ghash_s390.c +index b1bd170f24b1..c2dac2e0e56a 100644 +--- a/arch/s390/crypto/ghash_s390.c ++++ b/arch/s390/crypto/ghash_s390.c +@@ -16,11 +16,12 @@ + #define GHASH_DIGEST_SIZE 16 + + struct ghash_ctx { +- u8 icv[16]; +- u8 key[16]; ++ u8 key[GHASH_BLOCK_SIZE]; + }; + + struct ghash_desc_ctx { ++ u8 icv[GHASH_BLOCK_SIZE]; ++ u8 key[GHASH_BLOCK_SIZE]; + u8 buffer[GHASH_BLOCK_SIZE]; + u32 bytes; + }; +@@ -28,8 +29,10 @@ struct ghash_desc_ctx { + static int ghash_init(struct shash_desc *desc) + { + struct ghash_desc_ctx *dctx = shash_desc_ctx(desc); ++ struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm); + + memset(dctx, 0, sizeof(*dctx)); ++ memcpy(dctx->key, ctx->key, GHASH_BLOCK_SIZE); + + return 0; + } +@@ -45,7 +48,6 @@ static int ghash_setkey(struct crypto_shash *tfm, + } + + memcpy(ctx->key, key, GHASH_BLOCK_SIZE); +- memset(ctx->icv, 0, GHASH_BLOCK_SIZE); + + return 0; + } +@@ -54,7 +56,6 @@ static int ghash_update(struct shash_desc *desc, + const u8 *src, unsigned int srclen) + { + struct ghash_desc_ctx *dctx = shash_desc_ctx(desc); +- struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm); + unsigned int n; + u8 *buf = dctx->buffer; + int ret; +@@ -70,7 +71,7 @@ static int ghash_update(struct shash_desc *desc, + src += n; + + if (!dctx->bytes) { +- ret = crypt_s390_kimd(KIMD_GHASH, ctx, buf, ++ ret = crypt_s390_kimd(KIMD_GHASH, dctx, buf, + GHASH_BLOCK_SIZE); + BUG_ON(ret != GHASH_BLOCK_SIZE); + } +@@ -78,7 +79,7 @@ static int ghash_update(struct shash_desc *desc, + + n = srclen & ~(GHASH_BLOCK_SIZE - 1); + if (n) { +- ret = crypt_s390_kimd(KIMD_GHASH, ctx, src, n); ++ ret = crypt_s390_kimd(KIMD_GHASH, dctx, src, n); + BUG_ON(ret != n); + src += n; + srclen -= n; +@@ -92,7 +93,7 @@ static int ghash_update(struct shash_desc *desc, + return 0; + } + +-static void ghash_flush(struct ghash_ctx *ctx, struct ghash_desc_ctx *dctx) ++static int ghash_flush(struct ghash_desc_ctx *dctx) + { + u8 *buf = dctx->buffer; + int ret; +@@ -102,20 +103,19 @@ static void ghash_flush(struct ghash_ctx *ctx, struct ghash_desc_ctx *dctx) + + memset(pos, 0, dctx->bytes); + +- ret = crypt_s390_kimd(KIMD_GHASH, ctx, buf, GHASH_BLOCK_SIZE); ++ ret = crypt_s390_kimd(KIMD_GHASH, dctx, buf, GHASH_BLOCK_SIZE); + BUG_ON(ret != GHASH_BLOCK_SIZE); +- } + +- dctx->bytes = 0; ++ dctx->bytes = 0; ++ } + } + + static int ghash_final(struct shash_desc *desc, u8 *dst) + { + struct ghash_desc_ctx *dctx = shash_desc_ctx(desc); +- struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm); + +- ghash_flush(ctx, dctx); +- memcpy(dst, ctx->icv, GHASH_BLOCK_SIZE); ++ ghash_flush(dctx); ++ memcpy(dst, dtx->icv, GHASH_BLOCK_SIZE); + + return 0; + } +diff --git a/arch/s390/kernel/suspend.c b/arch/s390/kernel/suspend.c +index aa1494d0e380..42068041733c 100644 +--- a/arch/s390/kernel/suspend.c ++++ b/arch/s390/kernel/suspend.c +@@ -9,6 +9,8 @@ + #include + #include + #include ++#include ++#include + #include + + /* +@@ -137,6 +139,8 @@ int pfn_is_nosave(unsigned long pfn) + { + unsigned long nosave_begin_pfn = PFN_DOWN(__pa(&__nosave_begin)); + unsigned long nosave_end_pfn = PFN_DOWN(__pa(&__nosave_end)); ++ unsigned long eshared_pfn = PFN_DOWN(__pa(&_eshared)) - 1; ++ unsigned long stext_pfn = PFN_DOWN(__pa(&_stext)); + + /* Always save lowcore pages (LC protection might be enabled). */ + if (pfn <= LC_PAGES) +@@ -144,6 +148,8 @@ int pfn_is_nosave(unsigned long pfn) + if (pfn >= nosave_begin_pfn && pfn < nosave_end_pfn) + return 1; + /* Skip memory holes and read-only pages (NSS, DCSS, ...). */ ++ if (pfn >= stext_pfn && pfn <= eshared_pfn) ++ return ipl_info.type == IPL_TYPE_NSS ? 1 : 0; + if (tprot(PFN_PHYS(pfn))) + return 1; + return 0; +diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c +index e5a45dbd26ac..f641458e86b4 100644 +--- a/arch/s390/kvm/priv.c ++++ b/arch/s390/kvm/priv.c +@@ -218,6 +218,7 @@ static void handle_stsi_3_2_2(struct kvm_vcpu *vcpu, struct sysinfo_3_2_2 *mem) + for (n = mem->count - 1; n > 0 ; n--) + memcpy(&mem->vm[n], &mem->vm[n - 1], sizeof(mem->vm[0])); + ++ memset(&mem->vm[0], 0, sizeof(mem->vm[0])); + mem->vm[0].cpus_total = cpus; + mem->vm[0].cpus_configured = cpus; + mem->vm[0].cpus_standby = 0; +diff --git a/arch/x86/include/asm/i387.h b/arch/x86/include/asm/i387.h +index 257d9cca214f..1262fb6a9df6 100644 +--- a/arch/x86/include/asm/i387.h ++++ b/arch/x86/include/asm/i387.h +@@ -23,8 +23,32 @@ extern int dump_fpu(struct pt_regs *, struct user_i387_struct *); + extern void math_state_restore(void); + + extern bool irq_fpu_usable(void); +-extern void kernel_fpu_begin(void); +-extern void kernel_fpu_end(void); ++ ++/* ++ * Careful: __kernel_fpu_begin/end() must be called with preempt disabled ++ * and they don't touch the preempt state on their own. ++ * If you enable preemption after __kernel_fpu_begin(), preempt notifier ++ * should call the __kernel_fpu_end() to prevent the kernel/user FPU ++ * state from getting corrupted. KVM for example uses this model. ++ * ++ * All other cases use kernel_fpu_begin/end() which disable preemption ++ * during kernel FPU usage. ++ */ ++extern void __kernel_fpu_begin(void); ++extern void __kernel_fpu_end(void); ++ ++static inline void kernel_fpu_begin(void) ++{ ++ WARN_ON_ONCE(!irq_fpu_usable()); ++ preempt_disable(); ++ __kernel_fpu_begin(); ++} ++ ++static inline void kernel_fpu_end(void) ++{ ++ __kernel_fpu_end(); ++ preempt_enable(); ++} + + /* + * Some instructions like VIA's padlock instructions generate a spurious +diff --git a/arch/x86/include/asm/iommu_table.h b/arch/x86/include/asm/iommu_table.h +index f229b13a5f30..0c5482257fc3 100644 +--- a/arch/x86/include/asm/iommu_table.h ++++ b/arch/x86/include/asm/iommu_table.h +@@ -79,11 +79,12 @@ struct iommu_table_entry { + * d). Similar to the 'init', except that this gets called from pci_iommu_init + * where we do have a memory allocator. + * +- * The standard vs the _FINISH differs in that the _FINISH variant will +- * continue detecting other IOMMUs in the call list after the +- * the detection routine returns a positive number. The _FINISH will +- * stop the execution chain. Both will still call the 'init' and +- * 'late_init' functions if they are set. ++ * The standard IOMMU_INIT differs from the IOMMU_INIT_FINISH variant ++ * in that the former will continue detecting other IOMMUs in the call ++ * list after the detection routine returns a positive number, while the ++ * latter will stop the execution chain upon first successful detection. ++ * Both variants will still call the 'init' and 'late_init' functions if ++ * they are set. + */ + #define IOMMU_INIT_FINISH(_detect, _depend, _init, _late_init) \ + __IOMMU_INIT(_detect, _depend, _init, _late_init, 1) +diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c +index 0d2db0e7caf4..9eeaed48d0bf 100644 +--- a/arch/x86/kernel/cpu/mcheck/mce.c ++++ b/arch/x86/kernel/cpu/mcheck/mce.c +@@ -652,11 +652,14 @@ EXPORT_SYMBOL_GPL(machine_check_poll); + static int mce_no_way_out(struct mce *m, char **msg) + { + int i; ++ char *tmp; + + for (i = 0; i < banks; i++) { + m->status = mce_rdmsrl(MSR_IA32_MCx_STATUS(i)); +- if (mce_severity(m, tolerant, msg) >= MCE_PANIC_SEVERITY) ++ if (mce_severity(m, tolerant, &tmp) >= MCE_PANIC_SEVERITY) { ++ *msg = tmp; + return 1; ++ } + } + return 0; + } +diff --git a/arch/x86/kernel/i387.c b/arch/x86/kernel/i387.c +index 6610e811fb39..7aa728d72b60 100644 +--- a/arch/x86/kernel/i387.c ++++ b/arch/x86/kernel/i387.c +@@ -77,29 +77,26 @@ bool irq_fpu_usable(void) + } + EXPORT_SYMBOL(irq_fpu_usable); + +-void kernel_fpu_begin(void) ++void __kernel_fpu_begin(void) + { + struct task_struct *me = current; + +- WARN_ON_ONCE(!irq_fpu_usable()); +- preempt_disable(); + if (__thread_has_fpu(me)) { + __save_init_fpu(me); + __thread_clear_has_fpu(me); +- /* We do 'stts()' in kernel_fpu_end() */ ++ /* We do 'stts()' in __kernel_fpu_end() */ + } else { + percpu_write(fpu_owner_task, NULL); + clts(); + } + } +-EXPORT_SYMBOL(kernel_fpu_begin); ++EXPORT_SYMBOL(__kernel_fpu_begin); + +-void kernel_fpu_end(void) ++void __kernel_fpu_end(void) + { + stts(); +- preempt_enable(); + } +-EXPORT_SYMBOL(kernel_fpu_end); ++EXPORT_SYMBOL(__kernel_fpu_end); + + void unlazy_fpu(struct task_struct *tsk) + { +diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c +index 84f4bca0ca2c..2da1a8c9173e 100644 +--- a/arch/x86/kvm/mmu.c ++++ b/arch/x86/kvm/mmu.c +@@ -3658,7 +3658,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa, + ++vcpu->kvm->stat.mmu_pte_write; + kvm_mmu_audit(vcpu, AUDIT_PRE_PTE_WRITE); + +- mask.cr0_wp = mask.cr4_pae = mask.nxe = 1; ++ mask.cr0_wp = mask.cr4_pae = mask.nxe = mask.smep_andnot_wp = 1; + for_each_gfn_indirect_valid_sp(vcpu->kvm, sp, gfn, node) { + if (detect_write_misaligned(sp, gpa, bytes) || + detect_write_flooding(sp)) { +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index 2eb4e5af8816..4ad0d7171d6c 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -1455,8 +1455,12 @@ static void __vmx_load_host_state(struct vcpu_vmx *vmx) + #ifdef CONFIG_X86_64 + wrmsrl(MSR_KERNEL_GS_BASE, vmx->msr_host_kernel_gs_base); + #endif +- if (user_has_fpu()) +- clts(); ++ /* ++ * If the FPU is not active (through the host task or ++ * the guest vcpu), then restore the cr0.TS bit. ++ */ ++ if (!user_has_fpu() && !vmx->vcpu.guest_fpu_loaded) ++ stts(); + load_gdt(&__get_cpu_var(host_gdt)); + } + +@@ -3633,7 +3637,7 @@ static void vmx_set_constant_host_state(struct vcpu_vmx *vmx) + struct desc_ptr dt; + unsigned long cr4; + +- vmcs_writel(HOST_CR0, read_cr0() | X86_CR0_TS); /* 22.2.3 */ ++ vmcs_writel(HOST_CR0, read_cr0() & ~X86_CR0_TS); /* 22.2.3 */ + vmcs_writel(HOST_CR3, read_cr3()); /* 22.2.3 FIXME: shadow tables */ + + /* Save the most likely value for this task's CR4 in the VMCS. */ +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 318a2454366f..4ad2b7bb382e 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -5907,7 +5907,7 @@ void kvm_load_guest_fpu(struct kvm_vcpu *vcpu) + */ + kvm_put_guest_xcr0(vcpu); + vcpu->guest_fpu_loaded = 1; +- unlazy_fpu(current); ++ __kernel_fpu_begin(); + fpu_restore_checking(&vcpu->arch.guest_fpu); + trace_kvm_fpu(1); + } +@@ -5921,6 +5921,7 @@ void kvm_put_guest_fpu(struct kvm_vcpu *vcpu) + + vcpu->guest_fpu_loaded = 0; + fpu_save_init(&vcpu->arch.guest_fpu); ++ __kernel_fpu_end(); + ++vcpu->stat.fpu_reload; + kvm_make_request(KVM_REQ_DEACTIVATE_FPU, vcpu); + trace_kvm_fpu(0); +diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c +index 0597f95b6da6..95f9934e8050 100644 +--- a/arch/x86/net/bpf_jit_comp.c ++++ b/arch/x86/net/bpf_jit_comp.c +@@ -155,7 +155,12 @@ void bpf_jit_compile(struct sk_filter *fp) + } + cleanup_addr = proglen; /* epilogue address */ + +- for (pass = 0; pass < 10; pass++) { ++ /* JITed image shrinks with every pass and the loop iterates ++ * until the image stops shrinking. Very large bpf programs ++ * may converge on the last pass. In such case do one more ++ * pass to emit the final image ++ */ ++ for (pass = 0; pass < 10 || image; pass++) { + u8 seen_or_pass0 = (pass == 0) ? (SEEN_XREG | SEEN_DATAREF | SEEN_MEM) : seen; + /* no prologue/epilogue for trivial filters (RET something) */ + proglen = 0; +diff --git a/block/genhd.c b/block/genhd.c +index 7a2a8dc9bc5f..618ca1aaa858 100644 +--- a/block/genhd.c ++++ b/block/genhd.c +@@ -420,13 +420,13 @@ int blk_alloc_devt(struct hd_struct *part, dev_t *devt) + do { + if (!idr_pre_get(&ext_devt_idr, GFP_KERNEL)) + return -ENOMEM; +- spin_lock(&ext_devt_lock); ++ spin_lock_bh(&ext_devt_lock); + rc = idr_get_new(&ext_devt_idr, part, &idx); + if (!rc && idx >= NR_EXT_DEVT) { + idr_remove(&ext_devt_idr, idx); + rc = -EBUSY; + } +- spin_unlock(&ext_devt_lock); ++ spin_unlock_bh(&ext_devt_lock); + } while (rc == -EAGAIN); + + if (rc) +@@ -451,9 +451,9 @@ void blk_free_devt(dev_t devt) + return; + + if (MAJOR(devt) == BLOCK_EXT_MAJOR) { +- spin_lock(&ext_devt_lock); ++ spin_lock_bh(&ext_devt_lock); + idr_remove(&ext_devt_idr, blk_mangle_minor(MINOR(devt))); +- spin_unlock(&ext_devt_lock); ++ spin_unlock_bh(&ext_devt_lock); + } + } + +@@ -684,13 +684,13 @@ struct gendisk *get_gendisk(dev_t devt, int *partno) + } else { + struct hd_struct *part; + +- spin_lock(&ext_devt_lock); ++ spin_lock_bh(&ext_devt_lock); + part = idr_find(&ext_devt_idr, blk_mangle_minor(MINOR(devt))); + if (part && get_disk(part_to_disk(part))) { + *partno = part->partno; + disk = part_to_disk(part); + } +- spin_unlock(&ext_devt_lock); ++ spin_unlock_bh(&ext_devt_lock); + } + + return disk; +diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c +index 6fc61eb07b7b..1338f1f79582 100644 +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -67,6 +67,7 @@ enum board_ids { + board_ahci_yes_fbs, + + /* board IDs for specific chipsets in alphabetical order */ ++ board_ahci_avn, + board_ahci_mcp65, + board_ahci_mcp77, + board_ahci_mcp89, +@@ -85,6 +86,8 @@ enum board_ids { + static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent); + static int ahci_vt8251_hardreset(struct ata_link *link, unsigned int *class, + unsigned long deadline); ++static int ahci_avn_hardreset(struct ata_link *link, unsigned int *class, ++ unsigned long deadline); + static int ahci_p5wdh_hardreset(struct ata_link *link, unsigned int *class, + unsigned long deadline); + #ifdef CONFIG_PM +@@ -106,6 +109,11 @@ static struct ata_port_operations ahci_p5wdh_ops = { + .hardreset = ahci_p5wdh_hardreset, + }; + ++static struct ata_port_operations ahci_avn_ops = { ++ .inherits = &ahci_ops, ++ .hardreset = ahci_avn_hardreset, ++}; ++ + static const struct ata_port_info ahci_port_info[] = { + /* by features */ + [board_ahci] = +@@ -154,6 +162,12 @@ static const struct ata_port_info ahci_port_info[] = { + .port_ops = &ahci_ops, + }, + /* by chipsets */ ++ [board_ahci_avn] = { ++ .flags = AHCI_FLAG_COMMON, ++ .pio_mask = ATA_PIO4, ++ .udma_mask = ATA_UDMA6, ++ .port_ops = &ahci_avn_ops, ++ }, + [board_ahci_mcp65] = + { + AHCI_HFLAGS (AHCI_HFLAG_NO_FPDMA_AA | AHCI_HFLAG_NO_PMP | +@@ -300,14 +314,14 @@ static const struct pci_device_id ahci_pci_tbl[] = { + { PCI_VDEVICE(INTEL, 0x1f27), board_ahci }, /* Avoton RAID */ + { PCI_VDEVICE(INTEL, 0x1f2e), board_ahci }, /* Avoton RAID */ + { PCI_VDEVICE(INTEL, 0x1f2f), board_ahci }, /* Avoton RAID */ +- { PCI_VDEVICE(INTEL, 0x1f32), board_ahci }, /* Avoton AHCI */ +- { PCI_VDEVICE(INTEL, 0x1f33), board_ahci }, /* Avoton AHCI */ +- { PCI_VDEVICE(INTEL, 0x1f34), board_ahci }, /* Avoton RAID */ +- { PCI_VDEVICE(INTEL, 0x1f35), board_ahci }, /* Avoton RAID */ +- { PCI_VDEVICE(INTEL, 0x1f36), board_ahci }, /* Avoton RAID */ +- { PCI_VDEVICE(INTEL, 0x1f37), board_ahci }, /* Avoton RAID */ +- { PCI_VDEVICE(INTEL, 0x1f3e), board_ahci }, /* Avoton RAID */ +- { PCI_VDEVICE(INTEL, 0x1f3f), board_ahci }, /* Avoton RAID */ ++ { PCI_VDEVICE(INTEL, 0x1f32), board_ahci_avn }, /* Avoton AHCI */ ++ { PCI_VDEVICE(INTEL, 0x1f33), board_ahci_avn }, /* Avoton AHCI */ ++ { PCI_VDEVICE(INTEL, 0x1f34), board_ahci_avn }, /* Avoton RAID */ ++ { PCI_VDEVICE(INTEL, 0x1f35), board_ahci_avn }, /* Avoton RAID */ ++ { PCI_VDEVICE(INTEL, 0x1f36), board_ahci_avn }, /* Avoton RAID */ ++ { PCI_VDEVICE(INTEL, 0x1f37), board_ahci_avn }, /* Avoton RAID */ ++ { PCI_VDEVICE(INTEL, 0x1f3e), board_ahci_avn }, /* Avoton RAID */ ++ { PCI_VDEVICE(INTEL, 0x1f3f), board_ahci_avn }, /* Avoton RAID */ + { PCI_VDEVICE(INTEL, 0x8d02), board_ahci }, /* Wellsburg AHCI */ + { PCI_VDEVICE(INTEL, 0x8d04), board_ahci }, /* Wellsburg RAID */ + { PCI_VDEVICE(INTEL, 0x8d06), board_ahci }, /* Wellsburg RAID */ +@@ -671,6 +685,78 @@ static int ahci_p5wdh_hardreset(struct ata_link *link, unsigned int *class, + return rc; + } + ++/* ++ * ahci_avn_hardreset - attempt more aggressive recovery of Avoton ports. ++ * ++ * It has been observed with some SSDs that the timing of events in the ++ * link synchronization phase can leave the port in a state that can not ++ * be recovered by a SATA-hard-reset alone. The failing signature is ++ * SStatus.DET stuck at 1 ("Device presence detected but Phy ++ * communication not established"). It was found that unloading and ++ * reloading the driver when this problem occurs allows the drive ++ * connection to be recovered (DET advanced to 0x3). The critical ++ * component of reloading the driver is that the port state machines are ++ * reset by bouncing "port enable" in the AHCI PCS configuration ++ * register. So, reproduce that effect by bouncing a port whenever we ++ * see DET==1 after a reset. ++ */ ++static int ahci_avn_hardreset(struct ata_link *link, unsigned int *class, ++ unsigned long deadline) ++{ ++ const unsigned long *timing = sata_ehc_deb_timing(&link->eh_context); ++ struct ata_port *ap = link->ap; ++ struct ahci_port_priv *pp = ap->private_data; ++ u8 *d2h_fis = pp->rx_fis + RX_FIS_D2H_REG; ++ unsigned long tmo = deadline - jiffies; ++ struct ata_taskfile tf; ++ bool online; ++ int rc, i; ++ ++ DPRINTK("ENTER\n"); ++ ++ ahci_stop_engine(ap); ++ ++ for (i = 0; i < 2; i++) { ++ u16 val; ++ u32 sstatus; ++ int port = ap->port_no; ++ struct ata_host *host = ap->host; ++ struct pci_dev *pdev = to_pci_dev(host->dev); ++ ++ /* clear D2H reception area to properly wait for D2H FIS */ ++ ata_tf_init(link->device, &tf); ++ tf.command = ATA_BUSY; ++ ata_tf_to_fis(&tf, 0, 0, d2h_fis); ++ ++ rc = sata_link_hardreset(link, timing, deadline, &online, ++ ahci_check_ready); ++ ++ if (sata_scr_read(link, SCR_STATUS, &sstatus) != 0 || ++ (sstatus & 0xf) != 1) ++ break; ++ ++ ata_link_printk(link, KERN_INFO, "avn bounce port%d\n", ++ port); ++ ++ pci_read_config_word(pdev, 0x92, &val); ++ val &= ~(1 << port); ++ pci_write_config_word(pdev, 0x92, val); ++ ata_msleep(ap, 1000); ++ val |= 1 << port; ++ pci_write_config_word(pdev, 0x92, val); ++ deadline += tmo; ++ } ++ ++ ahci_start_engine(ap); ++ ++ if (online) ++ *class = ahci_dev_classify(ap); ++ ++ DPRINTK("EXIT, rc=%d, class=%u\n", rc, *class); ++ return rc; ++} ++ ++ + #ifdef CONFIG_PM + static int ahci_pci_device_suspend(struct pci_dev *pdev, pm_message_t mesg) + { +diff --git a/drivers/ata/ahci.h b/drivers/ata/ahci.h +index c2594ddf25b0..57eb1c212a4c 100644 +--- a/drivers/ata/ahci.h ++++ b/drivers/ata/ahci.h +@@ -320,6 +320,7 @@ extern struct device_attribute *ahci_sdev_attrs[]; + extern struct ata_port_operations ahci_ops; + extern struct ata_port_operations ahci_pmp_retry_srst_ops; + ++unsigned int ahci_dev_classify(struct ata_port *ap); + void ahci_fill_cmd_slot(struct ahci_port_priv *pp, unsigned int tag, + u32 opts); + void ahci_save_initial_config(struct device *dev, +diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c +index 60f41cd2c330..30cdba79d7ae 100644 +--- a/drivers/ata/libahci.c ++++ b/drivers/ata/libahci.c +@@ -1139,7 +1139,7 @@ static void ahci_dev_config(struct ata_device *dev) + } + } + +-static unsigned int ahci_dev_classify(struct ata_port *ap) ++unsigned int ahci_dev_classify(struct ata_port *ap) + { + void __iomem *port_mmio = ahci_port_base(ap); + struct ata_taskfile tf; +@@ -1153,6 +1153,7 @@ static unsigned int ahci_dev_classify(struct ata_port *ap) + + return ata_dev_classify(&tf); + } ++EXPORT_SYMBOL_GPL(ahci_dev_classify); + + void ahci_fill_cmd_slot(struct ahci_port_priv *pp, unsigned int tag, + u32 opts) +@@ -1670,8 +1671,7 @@ static void ahci_port_intr(struct ata_port *ap) + if (unlikely(resetting)) + status &= ~PORT_IRQ_BAD_PMP; + +- /* if LPM is enabled, PHYRDY doesn't mean anything */ +- if (ap->link.lpm_policy > ATA_LPM_MAX_POWER) { ++ if (sata_lpm_ignore_phy_events(&ap->link)) { + status &= ~PORT_IRQ_PHYRDY; + ahci_scr_write(&ap->link, SCR_ERROR, SERR_PHYRDY_CHG); + } +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index adaf994abb79..0a6767b9939c 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -6657,6 +6657,38 @@ u32 ata_wait_register(struct ata_port *ap, void __iomem *reg, u32 mask, u32 val, + return tmp; + } + ++/** ++ * sata_lpm_ignore_phy_events - test if PHY event should be ignored ++ * @link: Link receiving the event ++ * ++ * Test whether the received PHY event has to be ignored or not. ++ * ++ * LOCKING: ++ * None: ++ * ++ * RETURNS: ++ * True if the event has to be ignored. ++ */ ++bool sata_lpm_ignore_phy_events(struct ata_link *link) ++{ ++ unsigned long lpm_timeout = link->last_lpm_change + ++ msecs_to_jiffies(ATA_TMOUT_SPURIOUS_PHY); ++ ++ /* if LPM is enabled, PHYRDY doesn't mean anything */ ++ if (link->lpm_policy > ATA_LPM_MAX_POWER) ++ return true; ++ ++ /* ignore the first PHY event after the LPM policy changed ++ * as it is might be spurious ++ */ ++ if ((link->flags & ATA_LFLAG_CHANGED) && ++ time_before(jiffies, lpm_timeout)) ++ return true; ++ ++ return false; ++} ++EXPORT_SYMBOL_GPL(sata_lpm_ignore_phy_events); ++ + /* + * Dummy port_ops + */ +diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c +index 37fb4d6069a2..033b8cd497ac 100644 +--- a/drivers/ata/libata-eh.c ++++ b/drivers/ata/libata-eh.c +@@ -3424,6 +3424,9 @@ static int ata_eh_set_lpm(struct ata_link *link, enum ata_lpm_policy policy, + } + } + ++ link->last_lpm_change = jiffies; ++ link->flags |= ATA_LFLAG_CHANGED; ++ + return 0; + + fail: +diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c +index 8a084bffd068..52be498c2d1c 100644 +--- a/drivers/bluetooth/ath3k.c ++++ b/drivers/bluetooth/ath3k.c +@@ -64,6 +64,7 @@ static struct usb_device_id ath3k_table[] = { + /* Atheros AR3011 with sflash firmware*/ + { USB_DEVICE(0x0489, 0xE027) }, + { USB_DEVICE(0x0489, 0xE03D) }, ++ { USB_DEVICE(0x04F2, 0xAFF1) }, + { USB_DEVICE(0x0930, 0x0215) }, + { USB_DEVICE(0x0CF3, 0x3002) }, + { USB_DEVICE(0x0CF3, 0xE019) }, +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 7c0b21ebd33b..f8a58db55055 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -142,6 +142,7 @@ static struct usb_device_id blacklist_table[] = { + /* Atheros 3011 with sflash firmware */ + { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE }, + { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE }, ++ { USB_DEVICE(0x04f2, 0xaff1), .driver_info = BTUSB_IGNORE }, + { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE }, + { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE }, + { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE }, +diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c +index bdecba5de3a4..e53994978ce8 100644 +--- a/drivers/char/ipmi/ipmi_si_intf.c ++++ b/drivers/char/ipmi/ipmi_si_intf.c +@@ -2668,7 +2668,7 @@ static int wait_for_msg_done(struct smi_info *smi_info) + smi_result == SI_SM_CALL_WITH_TICK_DELAY) { + schedule_timeout_uninterruptible(1); + smi_result = smi_info->handlers->event( +- smi_info->si_sm, 100); ++ smi_info->si_sm, jiffies_to_usecs(1)); + } else if (smi_result == SI_SM_CALL_WITHOUT_DELAY) { + smi_result = smi_info->handlers->event( + smi_info->si_sm, 0); +diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c +index b1f1d105e8c7..e1c744d7370a 100644 +--- a/drivers/gpu/drm/i915/i915_gem.c ++++ b/drivers/gpu/drm/i915/i915_gem.c +@@ -1779,9 +1779,6 @@ i915_gem_retire_requests_ring(struct intel_ring_buffer *ring) + uint32_t seqno; + int i; + +- if (list_empty(&ring->request_list)) +- return; +- + WARN_ON(i915_verify_lists(ring->dev)); + + seqno = ring->get_seqno(ring); +diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c +index d51c08da3f69..af6790ccb8a9 100644 +--- a/drivers/gpu/drm/radeon/atombios_crtc.c ++++ b/drivers/gpu/drm/radeon/atombios_crtc.c +@@ -318,8 +318,10 @@ atombios_set_crtc_dtd_timing(struct drm_crtc *crtc, + misc |= ATOM_COMPOSITESYNC; + if (mode->flags & DRM_MODE_FLAG_INTERLACE) + misc |= ATOM_INTERLACE; +- if (mode->flags & DRM_MODE_FLAG_DBLSCAN) ++ if (mode->flags & DRM_MODE_FLAG_DBLCLK) + misc |= ATOM_DOUBLE_CLOCK_MODE; ++ if (mode->flags & DRM_MODE_FLAG_DBLSCAN) ++ misc |= ATOM_H_REPLICATIONBY2 | ATOM_V_REPLICATIONBY2; + + args.susModeMiscInfo.usAccess = cpu_to_le16(misc); + args.ucCRTC = radeon_crtc->crtc_id; +@@ -362,8 +364,10 @@ static void atombios_crtc_set_timing(struct drm_crtc *crtc, + misc |= ATOM_COMPOSITESYNC; + if (mode->flags & DRM_MODE_FLAG_INTERLACE) + misc |= ATOM_INTERLACE; +- if (mode->flags & DRM_MODE_FLAG_DBLSCAN) ++ if (mode->flags & DRM_MODE_FLAG_DBLCLK) + misc |= ATOM_DOUBLE_CLOCK_MODE; ++ if (mode->flags & DRM_MODE_FLAG_DBLSCAN) ++ misc |= ATOM_H_REPLICATIONBY2 | ATOM_V_REPLICATIONBY2; + + args.susModeMiscInfo.usAccess = cpu_to_le16(misc); + args.ucCRTC = radeon_crtc->crtc_id; +diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c +index c5fe79e67ed9..db4df97b7872 100644 +--- a/drivers/gpu/drm/radeon/evergreen.c ++++ b/drivers/gpu/drm/radeon/evergreen.c +@@ -1079,7 +1079,7 @@ int evergreen_pcie_gart_enable(struct radeon_device *rdev) + WREG32(MC_VM_MB_L1_TLB2_CNTL, tmp); + WREG32(MC_VM_MB_L1_TLB3_CNTL, tmp); + WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12); +- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12); ++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1); + WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12); + WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) | + RANGE_PROTECTION_FAULT_ENABLE_DEFAULT); +diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c +index 461262eee79a..1f451796407b 100644 +--- a/drivers/gpu/drm/radeon/ni.c ++++ b/drivers/gpu/drm/radeon/ni.c +@@ -1075,7 +1075,7 @@ int cayman_pcie_gart_enable(struct radeon_device *rdev) + L2_CACHE_BIGK_FRAGMENT_SIZE(6)); + /* setup context0 */ + WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12); +- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12); ++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1); + WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12); + WREG32(VM_CONTEXT0_PROTECTION_FAULT_DEFAULT_ADDR, + (u32)(rdev->dummy_page.addr >> 12)); +diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c +index 9c7062d970ee..d441aed782ad 100644 +--- a/drivers/gpu/drm/radeon/r600.c ++++ b/drivers/gpu/drm/radeon/r600.c +@@ -930,7 +930,7 @@ int r600_pcie_gart_enable(struct radeon_device *rdev) + WREG32(MC_VM_L1_TLB_MCB_RD_SEM_CNTL, tmp | ENABLE_SEMAPHORE_MODE); + WREG32(MC_VM_L1_TLB_MCB_WR_SEM_CNTL, tmp | ENABLE_SEMAPHORE_MODE); + WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12); +- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12); ++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1); + WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12); + WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) | + RANGE_PROTECTION_FAULT_ENABLE_DEFAULT); +diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c +index f3ee36036487..d66d2cdf4f0a 100644 +--- a/drivers/gpu/drm/radeon/radeon_cs.c ++++ b/drivers/gpu/drm/radeon/radeon_cs.c +@@ -49,7 +49,7 @@ int radeon_cs_parser_relocs(struct radeon_cs_parser *p) + if (p->relocs_ptr == NULL) { + return -ENOMEM; + } +- p->relocs = kcalloc(p->nrelocs, sizeof(struct radeon_cs_reloc), GFP_KERNEL); ++ p->relocs = drm_calloc_large(p->nrelocs, sizeof(struct radeon_bo_list)); + if (p->relocs == NULL) { + return -ENOMEM; + } +@@ -324,7 +324,7 @@ static void radeon_cs_parser_fini(struct radeon_cs_parser *parser, int error) + } + } + kfree(parser->track); +- kfree(parser->relocs); ++ drm_free_large(parser->relocs); + kfree(parser->relocs_ptr); + for (i = 0; i < parser->nchunks; i++) { + kfree(parser->chunks[i].kdata); +diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c +index 1ec1255520ad..3358730be78b 100644 +--- a/drivers/gpu/drm/radeon/rv770.c ++++ b/drivers/gpu/drm/radeon/rv770.c +@@ -158,7 +158,7 @@ int rv770_pcie_gart_enable(struct radeon_device *rdev) + WREG32(MC_VM_MB_L1_TLB2_CNTL, tmp); + WREG32(MC_VM_MB_L1_TLB3_CNTL, tmp); + WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12); +- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12); ++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1); + WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12); + WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) | + RANGE_PROTECTION_FAULT_ENABLE_DEFAULT); +diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c +index 068b21f0d7df..3b6e641decd0 100644 +--- a/drivers/gpu/drm/radeon/si.c ++++ b/drivers/gpu/drm/radeon/si.c +@@ -2537,7 +2537,7 @@ int si_pcie_gart_enable(struct radeon_device *rdev) + L2_CACHE_BIGK_FRAGMENT_SIZE(0)); + /* setup context0 */ + WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12); +- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12); ++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1); + WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12); + WREG32(VM_CONTEXT0_PROTECTION_FAULT_DEFAULT_ADDR, + (u32)(rdev->dummy_page.addr >> 12)); +@@ -2555,7 +2555,7 @@ int si_pcie_gart_enable(struct radeon_device *rdev) + */ + /* set vm size, must be a multiple of 4 */ + WREG32(VM_CONTEXT1_PAGE_TABLE_START_ADDR, 0); +- WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn); ++ WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn - 1); + for (i = 1; i < 16; i++) { + if (i < 8) + WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR + (i << 2), +diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c +index 3c8b2c473b81..980ef7e174fb 100644 +--- a/drivers/hv/channel.c ++++ b/drivers/hv/channel.c +@@ -177,7 +177,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size, + GFP_KERNEL); + if (!open_info) { + err = -ENOMEM; +- goto error0; ++ goto error_gpadl; + } + + init_completion(&open_info->waitevent); +@@ -193,7 +193,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size, + + if (userdatalen > MAX_USER_DEFINED_BYTES) { + err = -EINVAL; +- goto error0; ++ goto error_gpadl; + } + + if (userdatalen) +@@ -234,6 +234,9 @@ error1: + list_del(&open_info->msglistentry); + spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags); + ++error_gpadl: ++ vmbus_teardown_gpadl(newchannel, newchannel->ringbuffer_gpadlhandle); ++ + error0: + free_pages((unsigned long)out, + get_order(send_ringbuffer_size + recv_ringbuffer_size)); +diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c +index 9ffbfc575a0c..bcf67af0a07c 100644 +--- a/drivers/hv/channel_mgmt.c ++++ b/drivers/hv/channel_mgmt.c +@@ -531,7 +531,7 @@ int vmbus_request_offers(void) + { + struct vmbus_channel_message_header *msg; + struct vmbus_channel_msginfo *msginfo; +- int ret, t; ++ int ret; + + msginfo = kmalloc(sizeof(*msginfo) + + sizeof(struct vmbus_channel_message_header), +@@ -539,8 +539,6 @@ int vmbus_request_offers(void) + if (!msginfo) + return -ENOMEM; + +- init_completion(&msginfo->waitevent); +- + msg = (struct vmbus_channel_message_header *)msginfo->msg; + + msg->msgtype = CHANNELMSG_REQUESTOFFERS; +@@ -554,14 +552,6 @@ int vmbus_request_offers(void) + goto cleanup; + } + +- t = wait_for_completion_timeout(&msginfo->waitevent, 5*HZ); +- if (t == 0) { +- ret = -ETIMEDOUT; +- goto cleanup; +- } +- +- +- + cleanup: + kfree(msginfo); + +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index 67432e200c63..8987a9ac0309 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -759,36 +759,43 @@ static int cma_get_net_info(void *hdr, enum rdma_port_space ps, + return 0; + } + ++static __be16 ss_get_port(const struct sockaddr_storage *ss) ++{ ++ if (ss->ss_family == AF_INET) ++ return ((struct sockaddr_in *)ss)->sin_port; ++ else if (ss->ss_family == AF_INET6) ++ return ((struct sockaddr_in6 *)ss)->sin6_port; ++ BUG(); ++} ++ + static void cma_save_net_info(struct rdma_addr *addr, + struct rdma_addr *listen_addr, + u8 ip_ver, __be16 port, + union cma_ip_addr *src, union cma_ip_addr *dst) + { +- struct sockaddr_in *listen4, *ip4; +- struct sockaddr_in6 *listen6, *ip6; ++ struct sockaddr_in *ip4; ++ struct sockaddr_in6 *ip6; + + switch (ip_ver) { + case 4: +- listen4 = (struct sockaddr_in *) &listen_addr->src_addr; + ip4 = (struct sockaddr_in *) &addr->src_addr; +- ip4->sin_family = listen4->sin_family; ++ ip4->sin_family = AF_INET;; + ip4->sin_addr.s_addr = dst->ip4.addr; +- ip4->sin_port = listen4->sin_port; ++ ip4->sin_port = ss_get_port(&listen_addr->src_addr); + + ip4 = (struct sockaddr_in *) &addr->dst_addr; +- ip4->sin_family = listen4->sin_family; ++ ip4->sin_family = AF_INET; + ip4->sin_addr.s_addr = src->ip4.addr; + ip4->sin_port = port; + break; + case 6: +- listen6 = (struct sockaddr_in6 *) &listen_addr->src_addr; + ip6 = (struct sockaddr_in6 *) &addr->src_addr; +- ip6->sin6_family = listen6->sin6_family; ++ ip6->sin6_family = AF_INET6; + ip6->sin6_addr = dst->ip6; +- ip6->sin6_port = listen6->sin6_port; ++ ip6->sin6_port = ss_get_port(&listen_addr->src_addr); + + ip6 = (struct sockaddr_in6 *) &addr->dst_addr; +- ip6->sin6_family = listen6->sin6_family; ++ ip6->sin6_family = AF_INET6; + ip6->sin6_addr = src->ip6; + ip6->sin6_port = port; + break; +diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c +index d0254beb6d90..c1fef27010d4 100644 +--- a/drivers/infiniband/core/umem.c ++++ b/drivers/infiniband/core/umem.c +@@ -94,6 +94,9 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr, + if (dmasync) + dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs); + ++ if (!size) ++ return ERR_PTR(-EINVAL); ++ + /* + * If the combination of the addr and size requested for this memory + * region causes an integer overflow, return error. +diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c +index 3a7848966627..b53548c153be 100644 +--- a/drivers/infiniband/hw/mlx4/qp.c ++++ b/drivers/infiniband/hw/mlx4/qp.c +@@ -1670,8 +1670,7 @@ static int build_lso_seg(struct mlx4_wqe_lso_seg *wqe, struct ib_send_wr *wr, + + memcpy(wqe->header, wr->wr.ud.header, wr->wr.ud.hlen); + +- *lso_hdr_sz = cpu_to_be32((wr->wr.ud.mss - wr->wr.ud.hlen) << 16 | +- wr->wr.ud.hlen); ++ *lso_hdr_sz = cpu_to_be32(wr->wr.ud.mss << 16 | wr->wr.ud.hlen); + *lso_seg_len = halign; + return 0; + } +diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c +index f2c2ffedeff5..8eeff9e13319 100644 +--- a/drivers/input/mouse/elantech.c ++++ b/drivers/input/mouse/elantech.c +@@ -313,7 +313,7 @@ static void elantech_report_semi_mt_data(struct input_dev *dev, + unsigned int x2, unsigned int y2) + { + elantech_set_slot(dev, 0, num_fingers != 0, x1, y1); +- elantech_set_slot(dev, 1, num_fingers == 2, x2, y2); ++ elantech_set_slot(dev, 1, num_fingers >= 2, x2, y2); + } + + /* +@@ -783,6 +783,21 @@ static psmouse_ret_t elantech_process_byte(struct psmouse *psmouse) + } + + /* ++ * This writes the reg_07 value again to the hardware at the end of every ++ * set_rate call because the register loses its value. reg_07 allows setting ++ * absolute mode on v4 hardware ++ */ ++static void elantech_set_rate_restore_reg_07(struct psmouse *psmouse, ++ unsigned int rate) ++{ ++ struct elantech_data *etd = psmouse->private; ++ ++ etd->original_set_rate(psmouse, rate); ++ if (elantech_write_reg(psmouse, 0x07, etd->reg_07)) ++ psmouse_err(psmouse, "restoring reg_07 failed\n"); ++} ++ ++/* + * Put the touchpad into absolute mode + */ + static int elantech_set_absolute_mode(struct psmouse *psmouse) +@@ -980,6 +995,8 @@ static int elantech_get_resolution_v4(struct psmouse *psmouse, + * Asus K53SV 0x450f01 78, 15, 0c 2 hw buttons + * Asus G46VW 0x460f02 00, 18, 0c 2 hw buttons + * Asus G750JX 0x360f00 00, 16, 0c 2 hw buttons ++ * Asus TP500LN 0x381f17 10, 14, 0e clickpad ++ * Asus X750JN 0x381f17 10, 14, 0e clickpad + * Asus UX31 0x361f00 20, 15, 0e clickpad + * Asus UX32VD 0x361f02 00, 15, 0e clickpad + * Avatar AVIU-145A2 0x361f00 ? clickpad +@@ -1219,10 +1236,11 @@ static bool elantech_is_signature_valid(const unsigned char *param) + return true; + + /* +- * Some models have a revision higher then 20. Meaning param[2] may +- * be 10 or 20, skip the rates check for these. ++ * Some hw_version >= 4 models have a revision higher then 20. Meaning ++ * that param[2] may be 10 or 20, skip the rates check for these. + */ +- if (param[0] == 0x46 && (param[1] & 0xef) == 0x0f && param[2] < 40) ++ if ((param[0] & 0x0f) >= 0x06 && (param[1] & 0xaf) == 0x0f && ++ param[2] < 40) + return true; + + for (i = 0; i < ARRAY_SIZE(rates); i++) +@@ -1427,6 +1445,11 @@ int elantech_init(struct psmouse *psmouse) + goto init_fail; + } + ++ if (etd->fw_version == 0x381f17) { ++ etd->original_set_rate = psmouse->set_rate; ++ psmouse->set_rate = elantech_set_rate_restore_reg_07; ++ } ++ + if (elantech_set_input_params(psmouse)) { + psmouse_err(psmouse, "failed to query touchpad range.\n"); + goto init_fail; +diff --git a/drivers/input/mouse/elantech.h b/drivers/input/mouse/elantech.h +index 46db3be45ac9..4d1b220cbdfc 100644 +--- a/drivers/input/mouse/elantech.h ++++ b/drivers/input/mouse/elantech.h +@@ -137,6 +137,7 @@ struct elantech_data { + struct finger_pos mt[ETP_MAX_FINGERS]; + unsigned char parity[256]; + int (*send_cmd)(struct psmouse *psmouse, unsigned char c, unsigned char *param); ++ void (*original_set_rate)(struct psmouse *psmouse, unsigned int rate); + }; + + #ifdef CONFIG_MOUSE_PS2_ELANTECH +diff --git a/drivers/lguest/core.c b/drivers/lguest/core.c +index b5fdcb78a75b..34842e5e8b55 100644 +--- a/drivers/lguest/core.c ++++ b/drivers/lguest/core.c +@@ -171,7 +171,7 @@ static void unmap_switcher(void) + bool lguest_address_ok(const struct lguest *lg, + unsigned long addr, unsigned long len) + { +- return (addr+len) / PAGE_SIZE < lg->pfn_limit && (addr+len >= addr); ++ return addr+len <= lg->pfn_limit * PAGE_SIZE && (addr+len >= addr); + } + + /* +diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c +index 926989d6419f..a1bd68885c7c 100644 +--- a/drivers/md/dm-crypt.c ++++ b/drivers/md/dm-crypt.c +@@ -782,11 +782,10 @@ static int crypt_convert(struct crypt_config *cc, + + switch (r) { + /* async */ ++ case -EINPROGRESS: + case -EBUSY: + wait_for_completion(&ctx->restart); + INIT_COMPLETION(ctx->restart); +- /* fall through*/ +- case -EINPROGRESS: + this_cc->req = NULL; + ctx->sector++; + continue; +@@ -1195,10 +1194,8 @@ static void kcryptd_async_done(struct crypto_async_request *async_req, + struct dm_crypt_io *io = container_of(ctx, struct dm_crypt_io, ctx); + struct crypt_config *cc = io->target->private; + +- if (error == -EINPROGRESS) { +- complete(&ctx->restart); ++ if (error == -EINPROGRESS) + return; +- } + + if (!error && cc->iv_gen_ops && cc->iv_gen_ops->post) + error = cc->iv_gen_ops->post(cc, iv_of_dmreq(cc, dmreq), dmreq); +@@ -1209,12 +1206,15 @@ static void kcryptd_async_done(struct crypto_async_request *async_req, + mempool_free(req_of_dmreq(cc, dmreq), cc->req_pool); + + if (!atomic_dec_and_test(&ctx->pending)) +- return; ++ goto done; + + if (bio_data_dir(io->base_bio) == READ) + kcryptd_crypt_read_done(io); + else + kcryptd_crypt_write_io_submit(io, 1); ++done: ++ if (!completion_done(&ctx->restart)) ++ complete(&ctx->restart); + } + + static void kcryptd_crypt(struct work_struct *work) +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 17e2f526457c..83dba060525b 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -5431,9 +5431,9 @@ static int get_bitmap_file(struct mddev * mddev, void __user * arg) + int err = -ENOMEM; + + if (md_allow_write(mddev)) +- file = kmalloc(sizeof(*file), GFP_NOIO); ++ file = kzalloc(sizeof(*file), GFP_NOIO); + else +- file = kmalloc(sizeof(*file), GFP_KERNEL); ++ file = kzalloc(sizeof(*file), GFP_KERNEL); + + if (!file) + goto out; +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index c276ad09ace9..7a218e81eb39 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -1622,7 +1622,8 @@ static int resize_stripes(struct r5conf *conf, int newsize) + + conf->slab_cache = sc; + conf->active_name = 1-conf->active_name; +- conf->pool_size = newsize; ++ if (!err) ++ conf->pool_size = newsize; + return err; + } + +diff --git a/drivers/memstick/core/mspro_block.c b/drivers/memstick/core/mspro_block.c +index 9729b92fbfdd..f8449d534a25 100644 +--- a/drivers/memstick/core/mspro_block.c ++++ b/drivers/memstick/core/mspro_block.c +@@ -760,7 +760,7 @@ static int mspro_block_complete_req(struct memstick_dev *card, int error) + + if (error || (card->current_mrq.tpc == MSPRO_CMD_STOP)) { + if (msb->data_dir == READ) { +- for (cnt = 0; cnt < msb->current_seg; cnt++) ++ for (cnt = 0; cnt < msb->current_seg; cnt++) { + t_len += msb->req_sg[cnt].length + / msb->page_size; + +@@ -768,6 +768,7 @@ static int mspro_block_complete_req(struct memstick_dev *card, int error) + t_len += msb->current_page - 1; + + t_len *= msb->page_size; ++ } + } + } else + t_len = blk_rq_bytes(msb->block_req); +diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c +index ba821fe70bca..eef126126478 100644 +--- a/drivers/mmc/core/core.c ++++ b/drivers/mmc/core/core.c +@@ -2370,6 +2370,7 @@ int mmc_pm_notify(struct notifier_block *notify_block, + switch (mode) { + case PM_HIBERNATION_PREPARE: + case PM_SUSPEND_PREPARE: ++ case PM_RESTORE_PREPARE: + + spin_lock_irqsave(&host->lock, flags); + host->rescan_disable = 1; +diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c +index e6f08d945709..c300cc4dcda0 100644 +--- a/drivers/mmc/host/atmel-mci.c ++++ b/drivers/mmc/host/atmel-mci.c +@@ -1125,7 +1125,7 @@ static void atmci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios) + + if (ios->clock) { + unsigned int clock_min = ~0U; +- u32 clkdiv; ++ int clkdiv; + + spin_lock_bh(&host->lock); + if (!host->mode_reg) { +@@ -1150,7 +1150,12 @@ static void atmci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios) + /* Calculate clock divider */ + if (host->caps.has_odd_clk_div) { + clkdiv = DIV_ROUND_UP(host->bus_hz, clock_min) - 2; +- if (clkdiv > 511) { ++ if (clkdiv < 0) { ++ dev_warn(&mmc->class_dev, ++ "clock %u too fast; using %lu\n", ++ clock_min, host->bus_hz / 2); ++ clkdiv = 0; ++ } else if (clkdiv > 511) { + dev_warn(&mmc->class_dev, + "clock %u too slow; using %lu\n", + clock_min, host->bus_hz / (511 + 2)); +diff --git a/drivers/mtd/ubi/cdev.c b/drivers/mtd/ubi/cdev.c +index ad76592fb2f4..7ac2c05783f3 100644 +--- a/drivers/mtd/ubi/cdev.c ++++ b/drivers/mtd/ubi/cdev.c +@@ -475,7 +475,7 @@ static long vol_cdev_ioctl(struct file *file, unsigned int cmd, + /* Validate the request */ + err = -EINVAL; + if (req.lnum < 0 || req.lnum >= vol->reserved_pebs || +- req.bytes < 0 || req.lnum >= vol->usable_leb_size) ++ req.bytes < 0 || req.bytes > vol->usable_leb_size) + break; + if (req.dtype != UBI_LONGTERM && req.dtype != UBI_SHORTTERM && + req.dtype != UBI_UNKNOWN) +diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c +index 2455d620d96b..9abc0ea6702e 100644 +--- a/drivers/mtd/ubi/eba.c ++++ b/drivers/mtd/ubi/eba.c +@@ -1261,7 +1261,8 @@ int ubi_eba_init_scan(struct ubi_device *ubi, struct ubi_scan_info *si) + * during re-size. + */ + ubi_scan_move_to_list(sv, seb, &si->erase); +- vol->eba_tbl[seb->lnum] = seb->pnum; ++ else ++ vol->eba_tbl[seb->lnum] = seb->pnum; + } + } + +diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c +index 7c1a9bf8ac86..284d144ff5a6 100644 +--- a/drivers/mtd/ubi/wl.c ++++ b/drivers/mtd/ubi/wl.c +@@ -666,7 +666,7 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk, + int cancel) + { + int err, scrubbing = 0, torture = 0, protect = 0, erroneous = 0; +- int vol_id = -1, uninitialized_var(lnum); ++ int vol_id = -1, lnum = -1; + struct ubi_wl_entry *e1, *e2; + struct ubi_vid_hdr *vid_hdr; + +diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c +index 8d8908d2a9b1..b7a7524c8693 100644 +--- a/drivers/net/ethernet/intel/e1000/e1000_main.c ++++ b/drivers/net/ethernet/intel/e1000/e1000_main.c +@@ -144,6 +144,11 @@ static bool e1000_clean_rx_irq(struct e1000_adapter *adapter, + static bool e1000_clean_jumbo_rx_irq(struct e1000_adapter *adapter, + struct e1000_rx_ring *rx_ring, + int *work_done, int work_to_do); ++static void e1000_alloc_dummy_rx_buffers(struct e1000_adapter *adapter, ++ struct e1000_rx_ring *rx_ring, ++ int cleaned_count) ++{ ++} + static void e1000_alloc_rx_buffers(struct e1000_adapter *adapter, + struct e1000_rx_ring *rx_ring, + int cleaned_count); +@@ -3545,8 +3550,11 @@ static int e1000_change_mtu(struct net_device *netdev, int new_mtu) + msleep(1); + /* e1000_down has a dependency on max_frame_size */ + hw->max_frame_size = max_frame; +- if (netif_running(netdev)) ++ if (netif_running(netdev)) { ++ /* prevent buffers from being reallocated */ ++ adapter->alloc_rx_buf = e1000_alloc_dummy_rx_buffers; + e1000_down(adapter); ++ } + + /* NOTE: netdev_alloc_skb reserves 16 bytes, and typically NET_IP_ALIGN + * means we reserve 2 more, this pushes us to allocate from the next +diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c +index 2c4cdcecbe39..091c85f461a1 100644 +--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c +@@ -357,6 +357,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = { + {RTL_USB_DEVICE(0x2001, 0x3307, rtl92cu_hal_cfg)}, /*D-Link-Cameo*/ + {RTL_USB_DEVICE(0x2001, 0x3309, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/ + {RTL_USB_DEVICE(0x2001, 0x330a, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/ ++ {RTL_USB_DEVICE(0x2001, 0x330d, rtl92cu_hal_cfg)}, /*D-Link DWA-131 */ + {RTL_USB_DEVICE(0x2019, 0xab2b, rtl92cu_hal_cfg)}, /*Planex -Abocom*/ + {RTL_USB_DEVICE(0x20f4, 0x624d, rtl92cu_hal_cfg)}, /*TRENDNet*/ + {RTL_USB_DEVICE(0x2357, 0x0100, rtl92cu_hal_cfg)}, /*TP-Link WN8200ND*/ +diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c +index 2b6faa069e9a..9b6cb583883a 100644 +--- a/drivers/net/wireless/rtlwifi/usb.c ++++ b/drivers/net/wireless/rtlwifi/usb.c +@@ -119,7 +119,7 @@ static int _usbctrl_vendorreq_sync_read(struct usb_device *udev, u8 request, + + do { + status = usb_control_msg(udev, pipe, request, reqtype, value, +- index, pdata, len, 0); /*max. timeout*/ ++ index, pdata, len, 1000); + if (status < 0) { + /* firmware download is checksumed, don't retry */ + if ((value >= FW_8192C_START_ADDRESS && +diff --git a/drivers/platform/x86/compal-laptop.c b/drivers/platform/x86/compal-laptop.c +index 1887e2f166a4..67938889f5b6 100644 +--- a/drivers/platform/x86/compal-laptop.c ++++ b/drivers/platform/x86/compal-laptop.c +@@ -1047,7 +1047,13 @@ static int __devinit compal_probe(struct platform_device *pdev) + + /* Power supply */ + initialize_power_supply_data(data); +- power_supply_register(&compal_device->dev, &data->psy); ++ err = power_supply_register(&compal_device->dev, &data->psy); ++ if (err < 0) { ++ hwmon_device_unregister(data->hwmon_dev); ++ sysfs_remove_group(&pdev->dev.kobj, ++ &compal_attribute_group); ++ kfree(data); ++ } + + platform_set_drvdata(pdev, data); + +diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c +index 3868ab2397c6..fb37df690b9a 100644 +--- a/drivers/scsi/3w-9xxx.c ++++ b/drivers/scsi/3w-9xxx.c +@@ -149,7 +149,6 @@ static int twa_reset_sequence(TW_Device_Extension *tw_dev, int soft_reset); + static int twa_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, char *cdb, int use_sg, TW_SG_Entry *sglistarg); + static void twa_scsiop_execute_scsi_complete(TW_Device_Extension *tw_dev, int request_id); + static char *twa_string_lookup(twa_message_type *table, unsigned int aen_code); +-static void twa_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id); + + /* Functions */ + +@@ -1352,11 +1351,11 @@ static irqreturn_t twa_interrupt(int irq, void *dev_instance) + } + + /* Now complete the io */ ++ scsi_dma_unmap(cmd); ++ cmd->scsi_done(cmd); + tw_dev->state[request_id] = TW_S_COMPLETED; + twa_free_request_id(tw_dev, request_id); + tw_dev->posted_request_count--; +- tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]); +- twa_unmap_scsi_data(tw_dev, request_id); + } + + /* Check for valid status after each drain */ +@@ -1414,26 +1413,6 @@ static void twa_load_sgl(TW_Device_Extension *tw_dev, TW_Command_Full *full_comm + } + } /* End twa_load_sgl() */ + +-/* This function will perform a pci-dma mapping for a scatter gather list */ +-static int twa_map_scsi_sg_data(TW_Device_Extension *tw_dev, int request_id) +-{ +- int use_sg; +- struct scsi_cmnd *cmd = tw_dev->srb[request_id]; +- +- use_sg = scsi_dma_map(cmd); +- if (!use_sg) +- return 0; +- else if (use_sg < 0) { +- TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1c, "Failed to map scatter gather list"); +- return 0; +- } +- +- cmd->SCp.phase = TW_PHASE_SGLIST; +- cmd->SCp.have_data_in = use_sg; +- +- return use_sg; +-} /* End twa_map_scsi_sg_data() */ +- + /* This function will poll for a response interrupt of a request */ + static int twa_poll_response(TW_Device_Extension *tw_dev, int request_id, int seconds) + { +@@ -1612,9 +1591,11 @@ static int twa_reset_device_extension(TW_Device_Extension *tw_dev) + (tw_dev->state[i] != TW_S_INITIAL) && + (tw_dev->state[i] != TW_S_COMPLETED)) { + if (tw_dev->srb[i]) { +- tw_dev->srb[i]->result = (DID_RESET << 16); +- tw_dev->srb[i]->scsi_done(tw_dev->srb[i]); +- twa_unmap_scsi_data(tw_dev, i); ++ struct scsi_cmnd *cmd = tw_dev->srb[i]; ++ ++ cmd->result = (DID_RESET << 16); ++ scsi_dma_unmap(cmd); ++ cmd->scsi_done(cmd); + } + } + } +@@ -1793,21 +1774,18 @@ static int twa_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_ + /* Save the scsi command for use by the ISR */ + tw_dev->srb[request_id] = SCpnt; + +- /* Initialize phase to zero */ +- SCpnt->SCp.phase = TW_PHASE_INITIAL; +- + retval = twa_scsiop_execute_scsi(tw_dev, request_id, NULL, 0, NULL); + switch (retval) { + case SCSI_MLQUEUE_HOST_BUSY: ++ scsi_dma_unmap(SCpnt); + twa_free_request_id(tw_dev, request_id); +- twa_unmap_scsi_data(tw_dev, request_id); + break; + case 1: +- tw_dev->state[request_id] = TW_S_COMPLETED; +- twa_free_request_id(tw_dev, request_id); +- twa_unmap_scsi_data(tw_dev, request_id); + SCpnt->result = (DID_ERROR << 16); ++ scsi_dma_unmap(SCpnt); + done(SCpnt); ++ tw_dev->state[request_id] = TW_S_COMPLETED; ++ twa_free_request_id(tw_dev, request_id); + retval = 0; + } + out: +@@ -1875,8 +1853,8 @@ static int twa_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, + command_packet->sg_list[0].address = TW_CPU_TO_SGL(tw_dev->generic_buffer_phys[request_id]); + command_packet->sg_list[0].length = cpu_to_le32(TW_MIN_SGL_LENGTH); + } else { +- sg_count = twa_map_scsi_sg_data(tw_dev, request_id); +- if (sg_count == 0) ++ sg_count = scsi_dma_map(srb); ++ if (sg_count < 0) + goto out; + + scsi_for_each_sg(srb, sg, sg_count, i) { +@@ -1991,15 +1969,6 @@ static char *twa_string_lookup(twa_message_type *table, unsigned int code) + return(table[index].text); + } /* End twa_string_lookup() */ + +-/* This function will perform a pci-dma unmap */ +-static void twa_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id) +-{ +- struct scsi_cmnd *cmd = tw_dev->srb[request_id]; +- +- if (cmd->SCp.phase == TW_PHASE_SGLIST) +- scsi_dma_unmap(cmd); +-} /* End twa_unmap_scsi_data() */ +- + /* This function gets called when a disk is coming on-line */ + static int twa_slave_configure(struct scsi_device *sdev) + { +diff --git a/drivers/scsi/3w-9xxx.h b/drivers/scsi/3w-9xxx.h +index 040f7214e5b7..0fdc83cfa0e1 100644 +--- a/drivers/scsi/3w-9xxx.h ++++ b/drivers/scsi/3w-9xxx.h +@@ -324,11 +324,6 @@ static twa_message_type twa_error_table[] = { + #define TW_CURRENT_DRIVER_BUILD 0 + #define TW_CURRENT_DRIVER_BRANCH 0 + +-/* Phase defines */ +-#define TW_PHASE_INITIAL 0 +-#define TW_PHASE_SINGLE 1 +-#define TW_PHASE_SGLIST 2 +- + /* Misc defines */ + #define TW_9550SX_DRAIN_COMPLETED 0xFFFF + #define TW_SECTOR_SIZE 512 +diff --git a/drivers/scsi/3w-sas.c b/drivers/scsi/3w-sas.c +index 13e39e1fdfe2..c555ccb119d1 100644 +--- a/drivers/scsi/3w-sas.c ++++ b/drivers/scsi/3w-sas.c +@@ -303,26 +303,6 @@ static int twl_post_command_packet(TW_Device_Extension *tw_dev, int request_id) + return 0; + } /* End twl_post_command_packet() */ + +-/* This function will perform a pci-dma mapping for a scatter gather list */ +-static int twl_map_scsi_sg_data(TW_Device_Extension *tw_dev, int request_id) +-{ +- int use_sg; +- struct scsi_cmnd *cmd = tw_dev->srb[request_id]; +- +- use_sg = scsi_dma_map(cmd); +- if (!use_sg) +- return 0; +- else if (use_sg < 0) { +- TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1, "Failed to map scatter gather list"); +- return 0; +- } +- +- cmd->SCp.phase = TW_PHASE_SGLIST; +- cmd->SCp.have_data_in = use_sg; +- +- return use_sg; +-} /* End twl_map_scsi_sg_data() */ +- + /* This function hands scsi cdb's to the firmware */ + static int twl_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, char *cdb, int use_sg, TW_SG_Entry_ISO *sglistarg) + { +@@ -370,8 +350,8 @@ static int twl_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, + if (!sglistarg) { + /* Map sglist from scsi layer to cmd packet */ + if (scsi_sg_count(srb)) { +- sg_count = twl_map_scsi_sg_data(tw_dev, request_id); +- if (sg_count == 0) ++ sg_count = scsi_dma_map(srb); ++ if (sg_count <= 0) + goto out; + + scsi_for_each_sg(srb, sg, sg_count, i) { +@@ -1116,15 +1096,6 @@ out: + return retval; + } /* End twl_initialize_device_extension() */ + +-/* This function will perform a pci-dma unmap */ +-static void twl_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id) +-{ +- struct scsi_cmnd *cmd = tw_dev->srb[request_id]; +- +- if (cmd->SCp.phase == TW_PHASE_SGLIST) +- scsi_dma_unmap(cmd); +-} /* End twl_unmap_scsi_data() */ +- + /* This function will handle attention interrupts */ + static int twl_handle_attention_interrupt(TW_Device_Extension *tw_dev) + { +@@ -1265,11 +1236,11 @@ static irqreturn_t twl_interrupt(int irq, void *dev_instance) + } + + /* Now complete the io */ ++ scsi_dma_unmap(cmd); ++ cmd->scsi_done(cmd); + tw_dev->state[request_id] = TW_S_COMPLETED; + twl_free_request_id(tw_dev, request_id); + tw_dev->posted_request_count--; +- tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]); +- twl_unmap_scsi_data(tw_dev, request_id); + } + + /* Check for another response interrupt */ +@@ -1414,10 +1385,12 @@ static int twl_reset_device_extension(TW_Device_Extension *tw_dev, int ioctl_res + if ((tw_dev->state[i] != TW_S_FINISHED) && + (tw_dev->state[i] != TW_S_INITIAL) && + (tw_dev->state[i] != TW_S_COMPLETED)) { +- if (tw_dev->srb[i]) { +- tw_dev->srb[i]->result = (DID_RESET << 16); +- tw_dev->srb[i]->scsi_done(tw_dev->srb[i]); +- twl_unmap_scsi_data(tw_dev, i); ++ struct scsi_cmnd *cmd = tw_dev->srb[i]; ++ ++ if (cmd) { ++ cmd->result = (DID_RESET << 16); ++ scsi_dma_unmap(cmd); ++ cmd->scsi_done(cmd); + } + } + } +@@ -1521,9 +1494,6 @@ static int twl_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_ + /* Save the scsi command for use by the ISR */ + tw_dev->srb[request_id] = SCpnt; + +- /* Initialize phase to zero */ +- SCpnt->SCp.phase = TW_PHASE_INITIAL; +- + retval = twl_scsiop_execute_scsi(tw_dev, request_id, NULL, 0, NULL); + if (retval) { + tw_dev->state[request_id] = TW_S_COMPLETED; +diff --git a/drivers/scsi/3w-sas.h b/drivers/scsi/3w-sas.h +index d474892701d4..fec6449c7595 100644 +--- a/drivers/scsi/3w-sas.h ++++ b/drivers/scsi/3w-sas.h +@@ -103,10 +103,6 @@ static char *twl_aen_severity_table[] = + #define TW_CURRENT_DRIVER_BUILD 0 + #define TW_CURRENT_DRIVER_BRANCH 0 + +-/* Phase defines */ +-#define TW_PHASE_INITIAL 0 +-#define TW_PHASE_SGLIST 2 +- + /* Misc defines */ + #define TW_SECTOR_SIZE 512 + #define TW_MAX_UNITS 32 +diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c +index 7fe96ff60c58..86bc5f9212d6 100644 +--- a/drivers/scsi/3w-xxxx.c ++++ b/drivers/scsi/3w-xxxx.c +@@ -1283,32 +1283,6 @@ static int tw_initialize_device_extension(TW_Device_Extension *tw_dev) + return 0; + } /* End tw_initialize_device_extension() */ + +-static int tw_map_scsi_sg_data(struct pci_dev *pdev, struct scsi_cmnd *cmd) +-{ +- int use_sg; +- +- dprintk(KERN_WARNING "3w-xxxx: tw_map_scsi_sg_data()\n"); +- +- use_sg = scsi_dma_map(cmd); +- if (use_sg < 0) { +- printk(KERN_WARNING "3w-xxxx: tw_map_scsi_sg_data(): pci_map_sg() failed.\n"); +- return 0; +- } +- +- cmd->SCp.phase = TW_PHASE_SGLIST; +- cmd->SCp.have_data_in = use_sg; +- +- return use_sg; +-} /* End tw_map_scsi_sg_data() */ +- +-static void tw_unmap_scsi_data(struct pci_dev *pdev, struct scsi_cmnd *cmd) +-{ +- dprintk(KERN_WARNING "3w-xxxx: tw_unmap_scsi_data()\n"); +- +- if (cmd->SCp.phase == TW_PHASE_SGLIST) +- scsi_dma_unmap(cmd); +-} /* End tw_unmap_scsi_data() */ +- + /* This function will reset a device extension */ + static int tw_reset_device_extension(TW_Device_Extension *tw_dev) + { +@@ -1331,8 +1305,8 @@ static int tw_reset_device_extension(TW_Device_Extension *tw_dev) + srb = tw_dev->srb[i]; + if (srb != NULL) { + srb->result = (DID_RESET << 16); +- tw_dev->srb[i]->scsi_done(tw_dev->srb[i]); +- tw_unmap_scsi_data(tw_dev->tw_pci_dev, tw_dev->srb[i]); ++ scsi_dma_unmap(srb); ++ srb->scsi_done(srb); + } + } + } +@@ -1779,8 +1753,8 @@ static int tw_scsiop_read_write(TW_Device_Extension *tw_dev, int request_id) + command_packet->byte8.io.lba = lba; + command_packet->byte6.block_count = num_sectors; + +- use_sg = tw_map_scsi_sg_data(tw_dev->tw_pci_dev, tw_dev->srb[request_id]); +- if (!use_sg) ++ use_sg = scsi_dma_map(srb); ++ if (use_sg <= 0) + return 1; + + scsi_for_each_sg(tw_dev->srb[request_id], sg, use_sg, i) { +@@ -1967,9 +1941,6 @@ static int tw_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_c + /* Save the scsi command for use by the ISR */ + tw_dev->srb[request_id] = SCpnt; + +- /* Initialize phase to zero */ +- SCpnt->SCp.phase = TW_PHASE_INITIAL; +- + switch (*command) { + case READ_10: + case READ_6: +@@ -2196,12 +2167,11 @@ static irqreturn_t tw_interrupt(int irq, void *dev_instance) + + /* Now complete the io */ + if ((error != TW_ISR_DONT_COMPLETE)) { ++ scsi_dma_unmap(tw_dev->srb[request_id]); ++ tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]); + tw_dev->state[request_id] = TW_S_COMPLETED; + tw_state_request_finish(tw_dev, request_id); + tw_dev->posted_request_count--; +- tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]); +- +- tw_unmap_scsi_data(tw_dev->tw_pci_dev, tw_dev->srb[request_id]); + } + } + +diff --git a/drivers/scsi/3w-xxxx.h b/drivers/scsi/3w-xxxx.h +index 49dcf03c631a..1d31858766ce 100644 +--- a/drivers/scsi/3w-xxxx.h ++++ b/drivers/scsi/3w-xxxx.h +@@ -195,11 +195,6 @@ static unsigned char tw_sense_table[][4] = + #define TW_AEN_SMART_FAIL 0x000F + #define TW_AEN_SBUF_FAIL 0x0024 + +-/* Phase defines */ +-#define TW_PHASE_INITIAL 0 +-#define TW_PHASE_SINGLE 1 +-#define TW_PHASE_SGLIST 2 +- + /* Misc defines */ + #define TW_ALIGNMENT_6000 64 /* 64 bytes */ + #define TW_ALIGNMENT_7000 4 /* 4 bytes */ +diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c +index bfd87fab39aa..3e0f71c155a3 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c ++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c +@@ -1426,11 +1426,11 @@ megasas_build_ldio_fusion(struct megasas_instance *instance, + fp_possible = io_info.fpOkForIo; + } + +- /* Use smp_processor_id() for now until cmd->request->cpu is CPU ++ /* Use raw_smp_processor_id() for now until cmd->request->cpu is CPU + id by default, not CPU group id, otherwise all MSI-X queues won't + be utilized */ + cmd->request_desc->SCSIIO.MSIxIndex = instance->msix_vectors ? +- smp_processor_id() % instance->msix_vectors : 0; ++ raw_smp_processor_id() % instance->msix_vectors : 0; + + if (fp_possible) { + megasas_set_pd_lba(io_request, scp->cmd_len, &io_info, scp, +diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c +index cf8dfab9489f..28a635c66f3e 100644 +--- a/drivers/scsi/scsi_devinfo.c ++++ b/drivers/scsi/scsi_devinfo.c +@@ -222,6 +222,7 @@ static struct { + {"PIONEER", "CD-ROM DRM-604X", NULL, BLIST_FORCELUN | BLIST_SINGLELUN}, + {"PIONEER", "CD-ROM DRM-624X", NULL, BLIST_FORCELUN | BLIST_SINGLELUN}, + {"Promise", "", NULL, BLIST_SPARSELUN}, ++ {"QNAP", "iSCSI Storage", NULL, BLIST_MAX_1024}, + {"QUANTUM", "XP34301", "1071", BLIST_NOTQ}, + {"REGAL", "CDC-4X", NULL, BLIST_MAX5LUN | BLIST_SINGLELUN}, + {"SanDisk", "ImageMate CF-SD1", NULL, BLIST_FORCELUN}, +diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c +index 348840e80921..37abf4fdc8d7 100644 +--- a/drivers/scsi/scsi_scan.c ++++ b/drivers/scsi/scsi_scan.c +@@ -888,6 +888,12 @@ static int scsi_add_lun(struct scsi_device *sdev, unsigned char *inq_result, + */ + if (*bflags & BLIST_MAX_512) + blk_queue_max_hw_sectors(sdev->request_queue, 512); ++ /* ++ * Max 1024 sector transfer length for targets that report incorrect ++ * max/optimal lengths and relied on the old block layer safe default ++ */ ++ else if (*bflags & BLIST_MAX_1024) ++ blk_queue_max_hw_sectors(sdev->request_queue, 1024); + + /* + * Some devices may not want to have a start command automatically +diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c +index 7f6746a642e6..97aa6c647da9 100644 +--- a/drivers/scsi/sd.c ++++ b/drivers/scsi/sd.c +@@ -1423,6 +1423,7 @@ static unsigned int sd_completed_bytes(struct scsi_cmnd *scmd) + { + u64 start_lba = blk_rq_pos(scmd->request); + u64 end_lba = blk_rq_pos(scmd->request) + (scsi_bufflen(scmd) / 512); ++ u64 factor = scmd->device->sector_size / 512; + u64 bad_lba; + int info_valid; + /* +@@ -1444,16 +1445,10 @@ static unsigned int sd_completed_bytes(struct scsi_cmnd *scmd) + if (scsi_bufflen(scmd) <= scmd->device->sector_size) + return 0; + +- if (scmd->device->sector_size < 512) { +- /* only legitimate sector_size here is 256 */ +- start_lba <<= 1; +- end_lba <<= 1; +- } else { +- /* be careful ... don't want any overflows */ +- u64 factor = scmd->device->sector_size / 512; +- do_div(start_lba, factor); +- do_div(end_lba, factor); +- } ++ /* be careful ... don't want any overflows */ ++ factor = scmd->device->sector_size / 512; ++ do_div(start_lba, factor); ++ do_div(end_lba, factor); + + /* The bad lba was reported incorrectly, we have no idea where + * the error is. +@@ -1984,8 +1979,7 @@ got_data: + if (sector_size != 512 && + sector_size != 1024 && + sector_size != 2048 && +- sector_size != 4096 && +- sector_size != 256) { ++ sector_size != 4096) { + sd_printk(KERN_NOTICE, sdkp, "Unsupported sector size %d.\n", + sector_size); + /* +@@ -2034,8 +2028,6 @@ got_data: + sdkp->capacity <<= 2; + else if (sector_size == 1024) + sdkp->capacity <<= 1; +- else if (sector_size == 256) +- sdkp->capacity >>= 1; + + blk_queue_physical_block_size(sdp->request_queue, + sdkp->physical_block_size); +diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c +index a0df0fbf2db9..4ae776995e2a 100644 +--- a/drivers/scsi/storvsc_drv.c ++++ b/drivers/scsi/storvsc_drv.c +@@ -610,21 +610,22 @@ static unsigned int copy_to_bounce_buffer(struct scatterlist *orig_sgl, + if (bounce_sgl[j].length == PAGE_SIZE) { + /* full..move to next entry */ + sg_kunmap_atomic(bounce_addr); ++ bounce_addr = 0; + j++; ++ } + +- /* if we need to use another bounce buffer */ +- if (srclen || i != orig_sgl_count - 1) +- bounce_addr = sg_kmap_atomic(bounce_sgl,j); ++ /* if we need to use another bounce buffer */ ++ if (srclen && bounce_addr == 0) ++ bounce_addr = sg_kmap_atomic(bounce_sgl, j); + +- } else if (srclen == 0 && i == orig_sgl_count - 1) { +- /* unmap the last bounce that is < PAGE_SIZE */ +- sg_kunmap_atomic(bounce_addr); +- } + } + + sg_kunmap_atomic(src_addr - orig_sgl[i].offset); + } + ++ if (bounce_addr) ++ sg_kunmap_atomic(bounce_addr); ++ + local_irq_restore(flags); + + return total_copied; +diff --git a/drivers/staging/ozwpan/ozusbsvc1.c b/drivers/staging/ozwpan/ozusbsvc1.c +index 66bd576bb5e9..ca61576dc46a 100644 +--- a/drivers/staging/ozwpan/ozusbsvc1.c ++++ b/drivers/staging/ozwpan/ozusbsvc1.c +@@ -314,7 +314,11 @@ void oz_usb_handle_ep_data(struct oz_usb_ctx *usb_ctx, + struct oz_multiple_fixed *body = + (struct oz_multiple_fixed *)data_hdr; + u8 *data = body->data; +- int n = (len - sizeof(struct oz_multiple_fixed)+1) ++ unsigned int n; ++ if (!body->unit_size || ++ len < sizeof(struct oz_multiple_fixed) - 1) ++ break; ++ n = (len - (sizeof(struct oz_multiple_fixed) - 1)) + / body->unit_size; + while (n--) { + oz_hcd_data_ind(usb_ctx->hport, body->endpoint, +@@ -376,10 +380,15 @@ void oz_usb_rx(struct oz_pd *pd, struct oz_elt *elt) + case OZ_GET_DESC_RSP: { + struct oz_get_desc_rsp *body = + (struct oz_get_desc_rsp *)usb_hdr; +- int data_len = elt->length - +- sizeof(struct oz_get_desc_rsp) + 1; +- u16 offs = le16_to_cpu(get_unaligned(&body->offset)); +- u16 total_size = ++ u16 offs, total_size; ++ u8 data_len; ++ ++ if (elt->length < sizeof(struct oz_get_desc_rsp) - 1) ++ break; ++ data_len = elt->length - ++ (sizeof(struct oz_get_desc_rsp) - 1); ++ offs = le16_to_cpu(get_unaligned(&body->offset)); ++ total_size = + le16_to_cpu(get_unaligned(&body->total_size)); + oz_trace("USB_REQ_GET_DESCRIPTOR - cnf\n"); + oz_hcd_get_desc_cnf(usb_ctx->hport, body->req_id, +diff --git a/drivers/staging/panel/panel.c b/drivers/staging/panel/panel.c +index 6183573f112f..5d4b4f07f4b8 100644 +--- a/drivers/staging/panel/panel.c ++++ b/drivers/staging/panel/panel.c +@@ -273,11 +273,11 @@ static unsigned char lcd_bits[LCD_PORTS][LCD_BITS][BIT_STATES]; + * LCD types + */ + #define LCD_TYPE_NONE 0 +-#define LCD_TYPE_OLD 1 +-#define LCD_TYPE_KS0074 2 +-#define LCD_TYPE_HANTRONIX 3 +-#define LCD_TYPE_NEXCOM 4 +-#define LCD_TYPE_CUSTOM 5 ++#define LCD_TYPE_CUSTOM 1 ++#define LCD_TYPE_OLD 2 ++#define LCD_TYPE_KS0074 3 ++#define LCD_TYPE_HANTRONIX 4 ++#define LCD_TYPE_NEXCOM 5 + + /* + * keypad types +@@ -455,8 +455,7 @@ MODULE_PARM_DESC(keypad_enabled, "Deprecated option, use keypad_type instead"); + static int lcd_type = -1; + module_param(lcd_type, int, 0000); + MODULE_PARM_DESC(lcd_type, +- "LCD type: 0=none, 1=old //, 2=serial ks0074, " +- "3=hantronix //, 4=nexcom //, 5=compiled-in"); ++ "LCD type: 0=none, 1=compiled-in, 2=old, 3=serial ks0074, 4=hantronix, 5=nexcom"); + + static int lcd_proto = -1; + module_param(lcd_proto, int, 0000); +diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c +index 808267456eed..ec7e71c1e86c 100644 +--- a/drivers/target/target_core_pscsi.c ++++ b/drivers/target/target_core_pscsi.c +@@ -567,6 +567,7 @@ static struct se_device *pscsi_create_virtdevice( + " pdv_host_id: %d\n", pdv->pdv_host_id); + return ERR_PTR(-EINVAL); + } ++ pdv->pdv_lld_host = sh; + } + } else { + if (phv->phv_mode == PHV_VIRTUAL_HOST_ID) { +@@ -653,6 +654,8 @@ static void pscsi_free_device(void *p) + if ((phv->phv_mode == PHV_LLD_SCSI_HOST_NO) && + (phv->phv_lld_host != NULL)) + scsi_host_put(phv->phv_lld_host); ++ else if (pdv->pdv_lld_host) ++ scsi_host_put(pdv->pdv_lld_host); + + if ((sd->type == TYPE_DISK) || (sd->type == TYPE_ROM)) + scsi_device_put(sd); +diff --git a/drivers/target/target_core_pscsi.h b/drivers/target/target_core_pscsi.h +index 43f1c419e8e5..6c23c9443dd4 100644 +--- a/drivers/target/target_core_pscsi.h ++++ b/drivers/target/target_core_pscsi.h +@@ -45,6 +45,7 @@ struct pscsi_dev_virt { + int pdv_lun_id; + struct block_device *pdv_bd; + struct scsi_device *pdv_sd; ++ struct Scsi_Host *pdv_lld_host; + struct se_hba *pdv_se_hba; + } ____cacheline_aligned; + +diff --git a/drivers/tty/hvc/hvc_xen.c b/drivers/tty/hvc/hvc_xen.c +index 944eaeb8e0cf..160b1f38c5df 100644 +--- a/drivers/tty/hvc/hvc_xen.c ++++ b/drivers/tty/hvc/hvc_xen.c +@@ -290,7 +290,7 @@ static int xen_initial_domain_console_init(void) + return -ENOMEM; + } + +- info->irq = bind_virq_to_irq(VIRQ_CONSOLE, 0); ++ info->irq = bind_virq_to_irq(VIRQ_CONSOLE, 0, false); + info->vtermno = HVC_COOKIE; + + spin_lock(&xencons_lock); +@@ -300,11 +300,27 @@ static int xen_initial_domain_console_init(void) + return 0; + } + ++static void xen_console_update_evtchn(struct xencons_info *info) ++{ ++ if (xen_hvm_domain()) { ++ uint64_t v; ++ int err; ++ ++ err = hvm_get_parameter(HVM_PARAM_CONSOLE_EVTCHN, &v); ++ if (!err && v) ++ info->evtchn = v; ++ } else ++ info->evtchn = xen_start_info->console.domU.evtchn; ++} ++ + void xen_console_resume(void) + { + struct xencons_info *info = vtermno_to_xencons(HVC_COOKIE); +- if (info != NULL && info->irq) ++ if (info != NULL && info->irq) { ++ if (!xen_initial_domain()) ++ xen_console_update_evtchn(info); + rebind_evtchn_irq(info->evtchn, info->irq); ++ } + } + + static void xencons_disconnect_backend(struct xencons_info *info) +diff --git a/drivers/tty/serial/of_serial.c b/drivers/tty/serial/of_serial.c +index 6563cad09293..746e771c2789 100644 +--- a/drivers/tty/serial/of_serial.c ++++ b/drivers/tty/serial/of_serial.c +@@ -192,7 +192,6 @@ static struct of_device_id __devinitdata of_platform_serial_table[] = { + { .compatible = "ibm,qpace-nwp-serial", + .data = (void *)PORT_NWPSERIAL, }, + #endif +- { .type = "serial", .data = (void *)PORT_UNKNOWN, }, + { /* end of list */ }, + }; + +diff --git a/drivers/tty/serial/uartlite.c b/drivers/tty/serial/uartlite.c +index 6cd414341d5e..d9706e734b76 100644 +--- a/drivers/tty/serial/uartlite.c ++++ b/drivers/tty/serial/uartlite.c +@@ -573,7 +573,8 @@ MODULE_DEVICE_TABLE(of, ulite_of_match); + + static int __devinit ulite_probe(struct platform_device *pdev) + { +- struct resource *res, *res2; ++ struct resource *res; ++ int irq; + int id = pdev->id; + #ifdef CONFIG_OF + const __be32 *prop; +@@ -587,11 +588,11 @@ static int __devinit ulite_probe(struct platform_device *pdev) + if (!res) + return -ENODEV; + +- res2 = platform_get_resource(pdev, IORESOURCE_IRQ, 0); +- if (!res2) +- return -ENODEV; ++ irq = platform_get_irq(pdev, 0); ++ if (irq <= 0) ++ return -ENXIO; + +- return ulite_assign(&pdev->dev, id, res->start, res2->start); ++ return ulite_assign(&pdev->dev, id, res->start, irq); + } + + static int __devexit ulite_remove(struct platform_device *pdev) +diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c +index b627363352e5..778c39a85962 100644 +--- a/drivers/tty/serial/xilinx_uartps.c ++++ b/drivers/tty/serial/xilinx_uartps.c +@@ -941,9 +941,9 @@ static struct uart_driver xuartps_uart_driver = { + **/ + static int __devinit xuartps_probe(struct platform_device *pdev) + { +- int rc; ++ int rc, irq; + struct uart_port *port; +- struct resource *res, *res2; ++ struct resource *res; + int clk = 0; + + #ifdef CONFIG_OF +@@ -964,9 +964,9 @@ static int __devinit xuartps_probe(struct platform_device *pdev) + if (!res) + return -ENODEV; + +- res2 = platform_get_resource(pdev, IORESOURCE_IRQ, 0); +- if (!res2) +- return -ENODEV; ++ irq = platform_get_irq(pdev, 0); ++ if (irq <= 0) ++ return -ENXIO; + + /* Initialize the port structure */ + port = xuartps_get_port(); +@@ -980,7 +980,7 @@ static int __devinit xuartps_probe(struct platform_device *pdev) + * and triggers invocation of the config_port() entry point. + */ + port->mapbase = res->start; +- port->irq = res2->start; ++ port->irq = irq; + port->dev = &pdev->dev; + port->uartclk = clk; + dev_set_drvdata(&pdev->dev, port); +diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c +index e5fa34e5423f..c65c93959f89 100644 +--- a/drivers/usb/class/cdc-wdm.c ++++ b/drivers/usb/class/cdc-wdm.c +@@ -268,7 +268,7 @@ static void wdm_int_callback(struct urb *urb) + case USB_CDC_NOTIFY_RESPONSE_AVAILABLE: + dev_dbg(&desc->intf->dev, + "NOTIFY_RESPONSE_AVAILABLE received: index %d len %d", +- dr->wIndex, dr->wLength); ++ le16_to_cpu(dr->wIndex), le16_to_cpu(dr->wLength)); + break; + + case USB_CDC_NOTIFY_NETWORK_CONNECTION: +@@ -281,7 +281,9 @@ static void wdm_int_callback(struct urb *urb) + clear_bit(WDM_POLL_RUNNING, &desc->flags); + dev_err(&desc->intf->dev, + "unknown notification %d received: index %d len %d\n", +- dr->bNotificationType, dr->wIndex, dr->wLength); ++ dr->bNotificationType, ++ le16_to_cpu(dr->wIndex), ++ le16_to_cpu(dr->wLength)); + goto exit; + } + +@@ -425,7 +427,7 @@ static ssize_t wdm_write + USB_RECIP_INTERFACE); + req->bRequest = USB_CDC_SEND_ENCAPSULATED_COMMAND; + req->wValue = 0; +- req->wIndex = desc->inum; ++ req->wIndex = desc->inum; /* already converted */ + req->wLength = cpu_to_le16(count); + set_bit(WDM_IN_USE, &desc->flags); + desc->outbuf = buf; +@@ -438,7 +440,7 @@ static ssize_t wdm_write + dev_err(&desc->intf->dev, "Tx URB error: %d\n", rv); + } else { + dev_dbg(&desc->intf->dev, "Tx URB has been submitted index=%d", +- req->wIndex); ++ le16_to_cpu(req->wIndex)); + } + out: + usb_autopm_put_interface(desc->intf); +@@ -782,7 +784,7 @@ static int wdm_create(struct usb_interface *intf, struct usb_endpoint_descriptor + desc->irq->bRequestType = (USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE); + desc->irq->bRequest = USB_CDC_GET_ENCAPSULATED_RESPONSE; + desc->irq->wValue = 0; +- desc->irq->wIndex = desc->inum; ++ desc->irq->wIndex = desc->inum; /* already converted */ + desc->irq->wLength = cpu_to_le16(desc->wMaxCommand); + + usb_fill_control_urb( +diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c +index e47a4e12b297..5e93425424f6 100644 +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -2129,8 +2129,13 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td, + break; + case COMP_DEV_ERR: + case COMP_STALL: ++ frame->status = -EPROTO; ++ skip_td = true; ++ break; + case COMP_TX_ERR: + frame->status = -EPROTO; ++ if (event_trb != td->last_trb) ++ return 0; + skip_td = true; + break; + case COMP_STOP: +@@ -2738,7 +2743,7 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd) + xhci_halt(xhci); + hw_died: + spin_unlock(&xhci->lock); +- return -ESHUTDOWN; ++ return IRQ_HANDLED; + } + + /* +diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h +index 80b3d8559b09..855f084a9a32 100644 +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -1233,7 +1233,7 @@ union xhci_trb { + * since the command ring is 64-byte aligned. + * It must also be greater than 16. + */ +-#define TRBS_PER_SEGMENT 64 ++#define TRBS_PER_SEGMENT 256 + /* Allow two commands + a link TRB, along with any reserved command TRBs */ + #define MAX_RSVD_CMD_TRBS (TRBS_PER_SEGMENT - 3) + #define SEGMENT_SIZE (TRBS_PER_SEGMENT*16) +diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c +index a2b4008dc069..d3481c497be9 100644 +--- a/drivers/usb/musb/musb_core.c ++++ b/drivers/usb/musb/musb_core.c +@@ -1544,16 +1544,30 @@ irqreturn_t musb_interrupt(struct musb *musb) + (devctl & MUSB_DEVCTL_HM) ? "host" : "peripheral", + musb->int_usb, musb->int_tx, musb->int_rx); + +- /* the core can interrupt us for multiple reasons; docs have +- * a generic interrupt flowchart to follow ++ /** ++ * According to Mentor Graphics' documentation, flowchart on page 98, ++ * IRQ should be handled as follows: ++ * ++ * . Resume IRQ ++ * . Session Request IRQ ++ * . VBUS Error IRQ ++ * . Suspend IRQ ++ * . Connect IRQ ++ * . Disconnect IRQ ++ * . Reset/Babble IRQ ++ * . SOF IRQ (we're not using this one) ++ * . Endpoint 0 IRQ ++ * . TX Endpoints ++ * . RX Endpoints ++ * ++ * We will be following that flowchart in order to avoid any problems ++ * that might arise with internal Finite State Machine. + */ ++ + if (musb->int_usb) + retval |= musb_stage0_irq(musb, musb->int_usb, + devctl, power); + +- /* "stage 1" is handling endpoint irqs */ +- +- /* handle endpoint 0 first */ + if (musb->int_tx & 1) { + if (devctl & MUSB_DEVCTL_HM) + retval |= musb_h_ep0_irq(musb); +@@ -1561,43 +1575,37 @@ irqreturn_t musb_interrupt(struct musb *musb) + retval |= musb_g_ep0_irq(musb); + } + +- /* RX on endpoints 1-15 */ +- reg = musb->int_rx >> 1; ++ reg = musb->int_tx >> 1; + ep_num = 1; + while (reg) { + if (reg & 1) { +- /* musb_ep_select(musb->mregs, ep_num); */ +- /* REVISIT just retval = ep->rx_irq(...) */ + retval = IRQ_HANDLED; + if (devctl & MUSB_DEVCTL_HM) { + if (is_host_capable()) +- musb_host_rx(musb, ep_num); ++ musb_host_tx(musb, ep_num); + } else { + if (is_peripheral_capable()) +- musb_g_rx(musb, ep_num); ++ musb_g_tx(musb, ep_num); + } + } +- + reg >>= 1; + ep_num++; + } + +- /* TX on endpoints 1-15 */ +- reg = musb->int_tx >> 1; ++ reg = musb->int_rx >> 1; + ep_num = 1; + while (reg) { + if (reg & 1) { +- /* musb_ep_select(musb->mregs, ep_num); */ +- /* REVISIT just retval |= ep->tx_irq(...) */ + retval = IRQ_HANDLED; + if (devctl & MUSB_DEVCTL_HM) { + if (is_host_capable()) +- musb_host_tx(musb, ep_num); ++ musb_host_rx(musb, ep_num); + } else { + if (is_peripheral_capable()) +- musb_g_tx(musb, ep_num); ++ musb_g_rx(musb, ep_num); + } + } ++ + reg >>= 1; + ep_num++; + } +diff --git a/drivers/usb/otg/otg_fsm.c b/drivers/usb/otg/otg_fsm.c +index ade131a8ae5e..e87edda1fe22 100644 +--- a/drivers/usb/otg/otg_fsm.c ++++ b/drivers/usb/otg/otg_fsm.c +@@ -138,9 +138,9 @@ int otg_set_state(struct otg_fsm *fsm, enum usb_otg_state new_state) + break; + case OTG_STATE_B_PERIPHERAL: + otg_chrg_vbus(fsm, 0); +- otg_loc_conn(fsm, 1); + otg_loc_sof(fsm, 0); + otg_set_protocol(fsm, PROTO_GADGET); ++ otg_loc_conn(fsm, 1); + break; + case OTG_STATE_B_WAIT_ACON: + otg_chrg_vbus(fsm, 0); +@@ -200,10 +200,10 @@ int otg_set_state(struct otg_fsm *fsm, enum usb_otg_state new_state) + + break; + case OTG_STATE_A_PERIPHERAL: +- otg_loc_conn(fsm, 1); + otg_loc_sof(fsm, 0); + otg_set_protocol(fsm, PROTO_GADGET); + otg_drv_vbus(fsm, 1); ++ otg_loc_conn(fsm, 1); + break; + case OTG_STATE_A_WAIT_VFALL: + otg_drv_vbus(fsm, 0); +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index 5c289fc2bc5a..29bf38309252 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -133,6 +133,8 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */ + { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */ + { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */ ++ { USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */ ++ { USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */ + { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */ + { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */ + { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */ +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index 06abee68cb4f..1e4899c2d5f1 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -723,6 +723,7 @@ static struct usb_device_id id_table_combined [] = { + { USB_DEVICE(XSENS_VID, XSENS_AWINDA_DONGLE_PID) }, + { USB_DEVICE(XSENS_VID, XSENS_AWINDA_STATION_PID) }, + { USB_DEVICE(XSENS_VID, XSENS_CONVERTER_PID) }, ++ { USB_DEVICE(XSENS_VID, XSENS_MTDEVBOARD_PID) }, + { USB_DEVICE(XSENS_VID, XSENS_MTW_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_OMNI1509) }, + { USB_DEVICE(MOBILITY_VID, MOBILITY_USB_SERIAL_PID) }, +diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h +index 105b9826d8d6..1fee973f100a 100644 +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -155,6 +155,7 @@ + #define XSENS_AWINDA_STATION_PID 0x0101 + #define XSENS_AWINDA_DONGLE_PID 0x0102 + #define XSENS_MTW_PID 0x0200 /* Xsens MTw */ ++#define XSENS_MTDEVBOARD_PID 0x0300 /* Motion Tracker Development Board */ + #define XSENS_CONVERTER_PID 0xD00D /* Xsens USB-serial converter */ + + /* Xsens devices using FTDI VID */ +diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c +index 3e450b4e9c5f..723ed876f318 100644 +--- a/drivers/usb/serial/pl2303.c ++++ b/drivers/usb/serial/pl2303.c +@@ -67,7 +67,6 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(DCU10_VENDOR_ID, DCU10_PRODUCT_ID) }, + { USB_DEVICE(SITECOM_VENDOR_ID, SITECOM_PRODUCT_ID) }, + { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_ID) }, +- { USB_DEVICE(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_ID) }, + { USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_SX1) }, + { USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_X65) }, + { USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_X75) }, +diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h +index 71fd9da1d6e7..e3b7af8adfb7 100644 +--- a/drivers/usb/serial/pl2303.h ++++ b/drivers/usb/serial/pl2303.h +@@ -62,10 +62,6 @@ + #define ALCATEL_VENDOR_ID 0x11f7 + #define ALCATEL_PRODUCT_ID 0x02df + +-/* Samsung I330 phone cradle */ +-#define SAMSUNG_VENDOR_ID 0x04e8 +-#define SAMSUNG_PRODUCT_ID 0x8001 +- + #define SIEMENS_VENDOR_ID 0x11f5 + #define SIEMENS_PRODUCT_ID_SX1 0x0001 + #define SIEMENS_PRODUCT_ID_X65 0x0003 +diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c +index b3afd19341f1..c5cf350ea8ce 100644 +--- a/drivers/usb/serial/visor.c ++++ b/drivers/usb/serial/visor.c +@@ -101,7 +101,7 @@ static struct usb_device_id id_table [] = { + .driver_info = (kernel_ulong_t)&palm_os_4_probe }, + { USB_DEVICE(ACER_VENDOR_ID, ACER_S10_ID), + .driver_info = (kernel_ulong_t)&palm_os_4_probe }, +- { USB_DEVICE(SAMSUNG_VENDOR_ID, SAMSUNG_SCH_I330_ID), ++ { USB_DEVICE_INTERFACE_CLASS(SAMSUNG_VENDOR_ID, SAMSUNG_SCH_I330_ID, 0xff), + .driver_info = (kernel_ulong_t)&palm_os_4_probe }, + { USB_DEVICE(SAMSUNG_VENDOR_ID, SAMSUNG_SPH_I500_ID), + .driver_info = (kernel_ulong_t)&palm_os_4_probe }, +diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h +index 25174beb8d8d..d0ecaf9ff415 100644 +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -752,6 +752,13 @@ UNUSUAL_DEV( 0x059f, 0x0643, 0x0000, 0x0000, + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_GO_SLOW ), + ++/* Reported by Christian Schaller */ ++UNUSUAL_DEV( 0x059f, 0x0651, 0x0000, 0x0000, ++ "LaCie", ++ "External HDD", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_NO_WP_DETECT ), ++ + /* Submitted by Joel Bourquard + * Some versions of this device need the SubClass and Protocol overrides + * while others don't. +diff --git a/drivers/xen/events.c b/drivers/xen/events.c +index 9161f06564eb..d6e2deee7bf0 100644 +--- a/drivers/xen/events.c ++++ b/drivers/xen/events.c +@@ -563,8 +563,8 @@ static unsigned int __startup_pirq(unsigned int irq) + pirq_query_unmask(irq); + + evtchn_to_irq[evtchn] = irq; +- bind_evtchn_to_cpu(evtchn, 0); + info->evtchn = evtchn; ++ bind_evtchn_to_cpu(evtchn, 0); + + out: + unmask_evtchn(evtchn); +@@ -906,7 +906,7 @@ static int find_virq(unsigned int virq, unsigned int cpu) + return rc; + } + +-int bind_virq_to_irq(unsigned int virq, unsigned int cpu) ++int bind_virq_to_irq(unsigned int virq, unsigned int cpu, bool percpu) + { + struct evtchn_bind_virq bind_virq; + int evtchn, irq, ret; +@@ -920,8 +920,12 @@ int bind_virq_to_irq(unsigned int virq, unsigned int cpu) + if (irq == -1) + goto out; + +- irq_set_chip_and_handler_name(irq, &xen_percpu_chip, +- handle_percpu_irq, "virq"); ++ if (percpu) ++ irq_set_chip_and_handler_name(irq, &xen_percpu_chip, ++ handle_percpu_irq, "virq"); ++ else ++ irq_set_chip_and_handler_name(irq, &xen_dynamic_chip, ++ handle_edge_irq, "virq"); + + bind_virq.virq = virq; + bind_virq.vcpu = cpu; +@@ -1042,7 +1046,7 @@ int bind_virq_to_irqhandler(unsigned int virq, unsigned int cpu, + { + int irq, retval; + +- irq = bind_virq_to_irq(virq, cpu); ++ irq = bind_virq_to_irq(virq, cpu, irqflags & IRQF_PERCPU); + if (irq < 0) + return irq; + retval = request_irq(irq, handler, irqflags, devname, dev_id); +diff --git a/firmware/ihex2fw.c b/firmware/ihex2fw.c +index cf38e159131a..08d90e25abf0 100644 +--- a/firmware/ihex2fw.c ++++ b/firmware/ihex2fw.c +@@ -86,6 +86,7 @@ int main(int argc, char **argv) + case 'j': + include_jump = 1; + break; ++ default: + return usage(); + } + } +diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c +index 6dacccef7790..a181b58cedd5 100644 +--- a/fs/binfmt_elf.c ++++ b/fs/binfmt_elf.c +@@ -742,6 +742,7 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs) + i < loc->elf_ex.e_phnum; i++, elf_ppnt++) { + int elf_prot = 0, elf_flags; + unsigned long k, vaddr; ++ unsigned long total_size = 0; + + if (elf_ppnt->p_type != PT_LOAD) + continue; +@@ -805,10 +806,16 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs) + #else + load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr); + #endif ++ total_size = total_mapping_size(elf_phdata, ++ loc->elf_ex.e_phnum); ++ if (!total_size) { ++ error = -EINVAL; ++ goto out_free_dentry; ++ } + } + + error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt, +- elf_prot, elf_flags, 0); ++ elf_prot, elf_flags, total_size); + if (BAD_ADDR(error)) { + send_sig(SIGKILL, current, 0); + retval = IS_ERR((void *)error) ? +diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c +index cf6e7f4a4f4c..f4576dc0cf29 100644 +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -5939,12 +5939,11 @@ static int __btrfs_free_reserved_extent(struct btrfs_root *root, + return -ENOSPC; + } + +- if (btrfs_test_opt(root, DISCARD)) +- ret = btrfs_discard_extent(root, start, len, NULL); +- + if (pin) + pin_down_extent(root, cache, start, len, 1); + else { ++ if (btrfs_test_opt(root, DISCARD)) ++ ret = btrfs_discard_extent(root, start, len, NULL); + btrfs_add_free_space(cache, start, len); + btrfs_update_reserved_bytes(cache, len, RESERVE_FREE); + } +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index 3a65f4343416..d46c48187636 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -2374,6 +2374,11 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd, + if (off + len == src->i_size) + len = ALIGN(src->i_size, bs) - off; + ++ if (len == 0) { ++ ret = 0; ++ goto out_unlock; ++ } ++ + /* verify the end result is block aligned */ + if (!IS_ALIGNED(off, bs) || !IS_ALIGNED(off + len, bs) || + !IS_ALIGNED(destoff, bs)) +diff --git a/fs/btrfs/xattr.c b/fs/btrfs/xattr.c +index e7a5659087e6..0ee73d128162 100644 +--- a/fs/btrfs/xattr.c ++++ b/fs/btrfs/xattr.c +@@ -310,21 +310,40 @@ const struct xattr_handler *btrfs_xattr_handlers[] = { + /* + * Check if the attribute is in a supported namespace. + * +- * This applied after the check for the synthetic attributes in the system ++ * This is applied after the check for the synthetic attributes in the system + * namespace. + */ +-static bool btrfs_is_valid_xattr(const char *name) ++static int btrfs_is_valid_xattr(const char *name) + { +- return !strncmp(name, XATTR_SECURITY_PREFIX, +- XATTR_SECURITY_PREFIX_LEN) || +- !strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN) || +- !strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN) || +- !strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN); ++ int len = strlen(name); ++ int prefixlen = 0; ++ ++ if (!strncmp(name, XATTR_SECURITY_PREFIX, ++ XATTR_SECURITY_PREFIX_LEN)) ++ prefixlen = XATTR_SECURITY_PREFIX_LEN; ++ else if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN)) ++ prefixlen = XATTR_SYSTEM_PREFIX_LEN; ++ else if (!strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN)) ++ prefixlen = XATTR_TRUSTED_PREFIX_LEN; ++ else if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN)) ++ prefixlen = XATTR_USER_PREFIX_LEN; ++ else ++ return -EOPNOTSUPP; ++ ++ /* ++ * The name cannot consist of just prefix ++ */ ++ if (len <= prefixlen) ++ return -EINVAL; ++ ++ return 0; + } + + ssize_t btrfs_getxattr(struct dentry *dentry, const char *name, + void *buffer, size_t size) + { ++ int ret; ++ + /* + * If this is a request for a synthetic attribute in the system.* + * namespace use the generic infrastructure to resolve a handler +@@ -333,8 +352,9 @@ ssize_t btrfs_getxattr(struct dentry *dentry, const char *name, + if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN)) + return generic_getxattr(dentry, name, buffer, size); + +- if (!btrfs_is_valid_xattr(name)) +- return -EOPNOTSUPP; ++ ret = btrfs_is_valid_xattr(name); ++ if (ret) ++ return ret; + return __btrfs_getxattr(dentry->d_inode, name, buffer, size); + } + +@@ -342,6 +362,7 @@ int btrfs_setxattr(struct dentry *dentry, const char *name, const void *value, + size_t size, int flags) + { + struct btrfs_root *root = BTRFS_I(dentry->d_inode)->root; ++ int ret; + + /* + * The permission on security.* and system.* is not checked +@@ -358,8 +379,9 @@ int btrfs_setxattr(struct dentry *dentry, const char *name, const void *value, + if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN)) + return generic_setxattr(dentry, name, value, size, flags); + +- if (!btrfs_is_valid_xattr(name)) +- return -EOPNOTSUPP; ++ ret = btrfs_is_valid_xattr(name); ++ if (ret) ++ return ret; + + if (size == 0) + value = ""; /* empty EA, do not remove */ +@@ -371,6 +393,7 @@ int btrfs_setxattr(struct dentry *dentry, const char *name, const void *value, + int btrfs_removexattr(struct dentry *dentry, const char *name) + { + struct btrfs_root *root = BTRFS_I(dentry->d_inode)->root; ++ int ret; + + /* + * The permission on security.* and system.* is not checked +@@ -387,8 +410,9 @@ int btrfs_removexattr(struct dentry *dentry, const char *name) + if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN)) + return generic_removexattr(dentry, name); + +- if (!btrfs_is_valid_xattr(name)) +- return -EOPNOTSUPP; ++ ret = btrfs_is_valid_xattr(name); ++ if (ret) ++ return ret; + + return __btrfs_setxattr(NULL, dentry->d_inode, name, NULL, 0, + XATTR_REPLACE); +diff --git a/fs/dcache.c b/fs/dcache.c +index 8038a780696f..d071ea768057 100644 +--- a/fs/dcache.c ++++ b/fs/dcache.c +@@ -1204,13 +1204,13 @@ ascend: + /* might go back up the wrong parent if we have had a rename */ + if (!locked && read_seqretry(&rename_lock, seq)) + goto rename_retry; +- next = child->d_child.next; +- while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) { ++ /* go into the first sibling still alive */ ++ do { ++ next = child->d_child.next; + if (next == &this_parent->d_subdirs) + goto ascend; + child = list_entry(next, struct dentry, d_child); +- next = next->next; +- } ++ } while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)); + rcu_read_unlock(); + goto resume; + } +diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c +index 4296a6f800a0..bbe09a975003 100644 +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -320,7 +320,7 @@ static int ext4_valid_extent(struct inode *inode, struct ext4_extent *ext) + ext4_lblk_t lblock = le32_to_cpu(ext->ee_block); + ext4_lblk_t last = lblock + len - 1; + +- if (lblock > last) ++ if (len == 0 || lblock > last) + return 0; + return ext4_data_block_valid(EXT4_SB(inode->i_sb), block, len); + } +@@ -4365,13 +4365,6 @@ long ext4_fallocate(struct file *file, int mode, loff_t offset, loff_t len) + struct ext4_map_blocks map; + unsigned int credits, blkbits = inode->i_blkbits; + +- /* +- * currently supporting (pre)allocate mode for extent-based +- * files _only_ +- */ +- if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))) +- return -EOPNOTSUPP; +- + /* Return error if mode is not supported */ + if (mode & ~(FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE)) + return -EOPNOTSUPP; +@@ -4392,6 +4385,15 @@ long ext4_fallocate(struct file *file, int mode, loff_t offset, loff_t len) + */ + credits = ext4_chunk_trans_blocks(inode, max_blocks); + mutex_lock(&inode->i_mutex); ++ ++ /* ++ * We only support preallocation for extent-based files only ++ */ ++ if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))) { ++ mutex_unlock(&inode->i_mutex); ++ return -EOPNOTSUPP; ++ } ++ + ret = inode_newsize_ok(inode, (len + offset)); + if (ret) { + mutex_unlock(&inode->i_mutex); +diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c +index dc5852301da7..e1e1d467c6f9 100644 +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -1469,7 +1469,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry, + struct inode *inode) + { + struct inode *dir = dentry->d_parent->d_inode; +- struct buffer_head *bh; ++ struct buffer_head *bh = NULL; + struct ext4_dir_entry_2 *de; + struct super_block *sb; + int retval; +@@ -1484,7 +1484,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry, + if (is_dx(dir)) { + retval = ext4_dx_add_entry(handle, dentry, inode); + if (!retval || (retval != ERR_BAD_DX_DIR)) +- return retval; ++ goto out; + ext4_clear_inode_flag(dir, EXT4_INODE_INDEX); + dx_fallback++; + ext4_mark_inode_dirty(handle, dir); +@@ -1495,14 +1495,15 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry, + if(!bh) + return retval; + retval = add_dirent_to_buf(handle, dentry, inode, NULL, bh); +- if (retval != -ENOSPC) { +- brelse(bh); +- return retval; +- } ++ if (retval != -ENOSPC) ++ goto out; + + if (blocks == 1 && !dx_fallback && +- EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX)) +- return make_indexed_dir(handle, dentry, inode, bh); ++ EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX)) { ++ retval = make_indexed_dir(handle, dentry, inode, bh); ++ bh = NULL; /* make_indexed_dir releases bh */ ++ goto out; ++ } + brelse(bh); + } + bh = ext4_append(handle, dir, &block, &retval); +@@ -1512,6 +1513,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry, + de->inode = 0; + de->rec_len = ext4_rec_len_to_disk(blocksize, blocksize); + retval = add_dirent_to_buf(handle, dentry, inode, de, bh); ++out: + brelse(bh); + if (retval == 0) + ext4_set_inode_state(inode, EXT4_STATE_NEWENTRY); +diff --git a/fs/fhandle.c b/fs/fhandle.c +index a48e4a139be1..f7c18e97d852 100644 +--- a/fs/fhandle.c ++++ b/fs/fhandle.c +@@ -198,8 +198,9 @@ static int handle_to_path(int mountdirfd, struct file_handle __user *ufh, + goto out_err; + } + /* copy the full handle */ +- if (copy_from_user(handle, ufh, +- sizeof(struct file_handle) + ++ *handle = f_handle; ++ if (copy_from_user(&handle->f_handle, ++ &ufh->f_handle, + f_handle.handle_bytes)) { + retval = -EFAULT; + goto out_handle; +diff --git a/fs/namei.c b/fs/namei.c +index bdcd70544fce..9c4b9b811d7b 100644 +--- a/fs/namei.c ++++ b/fs/namei.c +@@ -1314,7 +1314,8 @@ static inline int walk_component(struct nameidata *nd, struct path *path, + } + if (should_follow_link(inode, follow)) { + if (nd->flags & LOOKUP_RCU) { +- if (unlikely(unlazy_walk(nd, path->dentry))) { ++ if (unlikely(nd->path.mnt != path->mnt || ++ unlazy_walk(nd, path->dentry))) { + terminate_walk(nd); + return -ECHILD; + } +diff --git a/fs/nfs/callback.c b/fs/nfs/callback.c +index 38a44c679a0a..0184e91eb4fa 100644 +--- a/fs/nfs/callback.c ++++ b/fs/nfs/callback.c +@@ -156,6 +156,7 @@ nfs41_callback_svc(void *vrqstp) + struct rpc_rqst, rq_bc_list); + list_del(&req->rq_bc_list); + spin_unlock_bh(&serv->sv_cb_lock); ++ finish_wait(&serv->sv_cb_waitq, &wq); + dprintk("Invoking bc_svc_process()\n"); + error = bc_svc_process(serv, req, rqstp); + dprintk("bc_svc_process() returned w/ error code= %d\n", +@@ -163,8 +164,9 @@ nfs41_callback_svc(void *vrqstp) + } else { + spin_unlock_bh(&serv->sv_cb_lock); + schedule(); ++ finish_wait(&serv->sv_cb_waitq, &wq); + } +- finish_wait(&serv->sv_cb_waitq, &wq); ++ flush_signals(current); + } + return 0; + } +diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c +index a4b87c69fbbb..6143a1ea63b1 100644 +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -3364,10 +3364,17 @@ static int check_stateid_generation(stateid_t *in, stateid_t *ref, bool has_sess + return nfserr_old_stateid; + } + ++static __be32 nfsd4_check_openowner_confirmed(struct nfs4_ol_stateid *ols) ++{ ++ if (ols->st_stateowner->so_is_open_owner && ++ !(openowner(ols->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED)) ++ return nfserr_bad_stateid; ++ return nfs_ok; ++} ++ + __be32 nfs4_validate_stateid(struct nfs4_client *cl, stateid_t *stateid) + { + struct nfs4_stid *s; +- struct nfs4_ol_stateid *ols; + __be32 status; + + if (STALE_STATEID(stateid)) +@@ -3381,11 +3388,7 @@ __be32 nfs4_validate_stateid(struct nfs4_client *cl, stateid_t *stateid) + return status; + if (!(s->sc_type & (NFS4_OPEN_STID | NFS4_LOCK_STID))) + return nfs_ok; +- ols = openlockstateid(s); +- if (ols->st_stateowner->so_is_open_owner +- && !(openowner(ols->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED)) +- return nfserr_bad_stateid; +- return nfs_ok; ++ return nfsd4_check_openowner_confirmed(openlockstateid(s)); + } + + static __be32 nfsd4_lookup_stateid(stateid_t *stateid, unsigned char typemask, struct nfs4_stid **s) +@@ -3452,8 +3455,8 @@ nfs4_preprocess_stateid_op(struct nfsd4_compound_state *cstate, + status = nfs4_check_fh(current_fh, stp); + if (status) + goto out; +- if (stp->st_stateowner->so_is_open_owner +- && !(openowner(stp->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED)) ++ status = nfsd4_check_openowner_confirmed(stp); ++ if (status) + goto out; + status = nfs4_check_openmode(stp, flags); + if (status) +diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c +index 4db777d3dc05..c8bc7ea199f5 100644 +--- a/fs/nfsd/nfsctl.c ++++ b/fs/nfsd/nfsctl.c +@@ -1163,15 +1163,15 @@ static int __init init_nfsd(void) + int retval; + printk(KERN_INFO "Installing knfsd (copyright (C) 1996 okir@monad.swb.de).\n"); + +- retval = register_cld_notifier(); +- if (retval) +- return retval; + retval = register_pernet_subsys(&nfsd_net_ops); + if (retval < 0) +- goto out_unregister_notifier; +- retval = nfsd4_init_slabs(); ++ return retval; ++ retval = register_cld_notifier(); + if (retval) + goto out_unregister_pernet; ++ retval = nfsd4_init_slabs(); ++ if (retval) ++ goto out_unregister_notifier; + nfs4_state_init(); + retval = nfsd_fault_inject_init(); /* nfsd fault injection controls */ + if (retval) +@@ -1209,10 +1209,10 @@ out_free_stat: + nfsd_fault_inject_cleanup(); + out_free_slabs: + nfsd4_free_slabs(); +-out_unregister_pernet: +- unregister_pernet_subsys(&nfsd_net_ops); + out_unregister_notifier: + unregister_cld_notifier(); ++out_unregister_pernet: ++ unregister_pernet_subsys(&nfsd_net_ops); + return retval; + } + +@@ -1228,8 +1228,8 @@ static void __exit exit_nfsd(void) + nfsd4_free_slabs(); + nfsd_fault_inject_cleanup(); + unregister_filesystem(&nfsd_fs_type); +- unregister_pernet_subsys(&nfsd_net_ops); + unregister_cld_notifier(); ++ unregister_pernet_subsys(&nfsd_net_ops); + } + + MODULE_AUTHOR("Olaf Kirch "); +diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c +index ecdbae19a766..090d8ce25bd1 100644 +--- a/fs/nilfs2/btree.c ++++ b/fs/nilfs2/btree.c +@@ -388,7 +388,7 @@ static int nilfs_btree_root_broken(const struct nilfs_btree_node *node, + nchildren = nilfs_btree_node_get_nchildren(node); + + if (unlikely(level < NILFS_BTREE_LEVEL_NODE_MIN || +- level > NILFS_BTREE_LEVEL_MAX || ++ level >= NILFS_BTREE_LEVEL_MAX || + nchildren < 0 || + nchildren > NILFS_BTREE_ROOT_NCHILDREN_MAX)) { + pr_crit("NILFS: bad btree root (inode number=%lu): level = %d, flags = 0x%x, nchildren = %d\n", +diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c +index dbc372e2f71d..7ba6ac187edd 100644 +--- a/fs/ocfs2/dlm/dlmmaster.c ++++ b/fs/ocfs2/dlm/dlmmaster.c +@@ -729,6 +729,19 @@ lookup: + if (tmpres) { + spin_unlock(&dlm->spinlock); + spin_lock(&tmpres->spinlock); ++ ++ /* ++ * Right after dlm spinlock was released, dlm_thread could have ++ * purged the lockres. Check if lockres got unhashed. If so ++ * start over. ++ */ ++ if (hlist_unhashed(&tmpres->hash_node)) { ++ spin_unlock(&tmpres->spinlock); ++ dlm_lockres_put(tmpres); ++ tmpres = NULL; ++ goto lookup; ++ } ++ + /* Wait on the thread that is mastering the resource */ + if (tmpres->owner == DLM_LOCK_RES_OWNER_UNKNOWN) { + __dlm_wait_on_lockres(tmpres); +diff --git a/fs/omfs/inode.c b/fs/omfs/inode.c +index dbc842222589..798dedcd44ef 100644 +--- a/fs/omfs/inode.c ++++ b/fs/omfs/inode.c +@@ -361,7 +361,7 @@ nomem: + } + + enum { +- Opt_uid, Opt_gid, Opt_umask, Opt_dmask, Opt_fmask ++ Opt_uid, Opt_gid, Opt_umask, Opt_dmask, Opt_fmask, Opt_err + }; + + static const match_table_t tokens = { +@@ -370,6 +370,7 @@ static const match_table_t tokens = { + {Opt_umask, "umask=%o"}, + {Opt_dmask, "dmask=%o"}, + {Opt_fmask, "fmask=%o"}, ++ {Opt_err, NULL}, + }; + + static int parse_options(char *options, struct omfs_sb_info *sbi) +diff --git a/fs/pipe.c b/fs/pipe.c +index 1667e6fe0416..abfb93525ca6 100644 +--- a/fs/pipe.c ++++ b/fs/pipe.c +@@ -104,25 +104,27 @@ void pipe_wait(struct pipe_inode_info *pipe) + } + + static int +-pipe_iov_copy_from_user(void *to, struct iovec *iov, unsigned long len, +- int atomic) ++pipe_iov_copy_from_user(void *addr, int *offset, struct iovec *iov, ++ size_t *remaining, int atomic) + { + unsigned long copy; + +- while (len > 0) { ++ while (*remaining > 0) { + while (!iov->iov_len) + iov++; +- copy = min_t(unsigned long, len, iov->iov_len); ++ copy = min_t(unsigned long, *remaining, iov->iov_len); + + if (atomic) { +- if (__copy_from_user_inatomic(to, iov->iov_base, copy)) ++ if (__copy_from_user_inatomic(addr + *offset, ++ iov->iov_base, copy)) + return -EFAULT; + } else { +- if (copy_from_user(to, iov->iov_base, copy)) ++ if (copy_from_user(addr + *offset, ++ iov->iov_base, copy)) + return -EFAULT; + } +- to += copy; +- len -= copy; ++ *offset += copy; ++ *remaining -= copy; + iov->iov_base += copy; + iov->iov_len -= copy; + } +@@ -130,25 +132,27 @@ pipe_iov_copy_from_user(void *to, struct iovec *iov, unsigned long len, + } + + static int +-pipe_iov_copy_to_user(struct iovec *iov, const void *from, unsigned long len, +- int atomic) ++pipe_iov_copy_to_user(struct iovec *iov, void *addr, int *offset, ++ size_t *remaining, int atomic) + { + unsigned long copy; + +- while (len > 0) { ++ while (*remaining > 0) { + while (!iov->iov_len) + iov++; +- copy = min_t(unsigned long, len, iov->iov_len); ++ copy = min_t(unsigned long, *remaining, iov->iov_len); + + if (atomic) { +- if (__copy_to_user_inatomic(iov->iov_base, from, copy)) ++ if (__copy_to_user_inatomic(iov->iov_base, ++ addr + *offset, copy)) + return -EFAULT; + } else { +- if (copy_to_user(iov->iov_base, from, copy)) ++ if (copy_to_user(iov->iov_base, ++ addr + *offset, copy)) + return -EFAULT; + } +- from += copy; +- len -= copy; ++ *offset += copy; ++ *remaining -= copy; + iov->iov_base += copy; + iov->iov_len -= copy; + } +@@ -384,7 +388,7 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov, + struct pipe_buffer *buf = pipe->bufs + curbuf; + const struct pipe_buf_operations *ops = buf->ops; + void *addr; +- size_t chars = buf->len; ++ size_t chars = buf->len, remaining; + int error, atomic; + + if (chars > total_len) +@@ -398,9 +402,11 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov, + } + + atomic = !iov_fault_in_pages_write(iov, chars); ++ remaining = chars; + redo: + addr = ops->map(pipe, buf, atomic); +- error = pipe_iov_copy_to_user(iov, addr + buf->offset, chars, atomic); ++ error = pipe_iov_copy_to_user(iov, addr, &buf->offset, ++ &remaining, atomic); + ops->unmap(pipe, buf, addr); + if (unlikely(error)) { + /* +@@ -415,7 +421,6 @@ redo: + break; + } + ret += chars; +- buf->offset += chars; + buf->len -= chars; + + /* Was it a packet buffer? Clean up and exit */ +@@ -522,6 +527,7 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov, + if (ops->can_merge && offset + chars <= PAGE_SIZE) { + int error, atomic = 1; + void *addr; ++ size_t remaining = chars; + + error = ops->confirm(pipe, buf); + if (error) +@@ -530,8 +536,8 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov, + iov_fault_in_pages_read(iov, chars); + redo1: + addr = ops->map(pipe, buf, atomic); +- error = pipe_iov_copy_from_user(offset + addr, iov, +- chars, atomic); ++ error = pipe_iov_copy_from_user(addr, &offset, iov, ++ &remaining, atomic); + ops->unmap(pipe, buf, addr); + ret = error; + do_wakeup = 1; +@@ -566,6 +572,8 @@ redo1: + struct page *page = pipe->tmp_page; + char *src; + int error, atomic = 1; ++ int offset = 0; ++ size_t remaining; + + if (!page) { + page = alloc_page(GFP_HIGHUSER); +@@ -586,14 +594,15 @@ redo1: + chars = total_len; + + iov_fault_in_pages_read(iov, chars); ++ remaining = chars; + redo2: + if (atomic) + src = kmap_atomic(page); + else + src = kmap(page); + +- error = pipe_iov_copy_from_user(src, iov, chars, +- atomic); ++ error = pipe_iov_copy_from_user(src, &offset, iov, ++ &remaining, atomic); + if (atomic) + kunmap_atomic(src); + else +diff --git a/fs/udf/inode.c b/fs/udf/inode.c +index 8053ee75d297..330ec8cfeb63 100644 +--- a/fs/udf/inode.c ++++ b/fs/udf/inode.c +@@ -1392,6 +1392,19 @@ static void udf_fill_inode(struct inode *inode, struct buffer_head *bh) + iinfo->i_lenEAttr; + } + ++ /* ++ * Sanity check length of allocation descriptors and extended attrs to ++ * avoid integer overflows ++ */ ++ if (iinfo->i_lenEAttr > inode->i_sb->s_blocksize || iinfo->i_lenAlloc > inode->i_sb->s_blocksize) { ++ make_bad_inode(inode); ++ return; ++ } ++ /* Now do exact checks */ ++ if (udf_file_entry_alloc_offset(inode) + iinfo->i_lenAlloc > inode->i_sb->s_blocksize) { ++ make_bad_inode(inode); ++ return; ++ } + /* Sanity checks for files in ICB so that we don't get confused later */ + if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) { + /* +diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h +index e8bcc4742e0e..6d52429f80bc 100644 +--- a/include/acpi/actypes.h ++++ b/include/acpi/actypes.h +@@ -198,9 +198,29 @@ typedef int INT32; + typedef s32 acpi_native_int; + + typedef u32 acpi_size; ++ ++#ifdef ACPI_32BIT_PHYSICAL_ADDRESS ++ ++/* ++ * OSPMs can define this to shrink the size of the structures for 32-bit ++ * none PAE environment. ASL compiler may always define this to generate ++ * 32-bit OSPM compliant tables. ++ */ + typedef u32 acpi_io_address; + typedef u32 acpi_physical_address; + ++#else /* ACPI_32BIT_PHYSICAL_ADDRESS */ ++ ++/* ++ * It is reported that, after some calculations, the physical addresses can ++ * wrap over the 32-bit boundary on 32-bit PAE environment. ++ * https://bugzilla.kernel.org/show_bug.cgi?id=87971 ++ */ ++typedef u64 acpi_io_address; ++typedef u64 acpi_physical_address; ++ ++#endif /* ACPI_32BIT_PHYSICAL_ADDRESS */ ++ + #define ACPI_MAX_PTR ACPI_UINT32_MAX + #define ACPI_SIZE_MAX ACPI_UINT32_MAX + +diff --git a/include/acpi/platform/acenv.h b/include/acpi/platform/acenv.h +index 5af3ed52ef98..b9f921012043 100644 +--- a/include/acpi/platform/acenv.h ++++ b/include/acpi/platform/acenv.h +@@ -75,6 +75,7 @@ + #define ACPI_CONSTANT_EVAL_ONLY + #define ACPI_LARGE_NAMESPACE_NODE + #define ACPI_DATA_TABLE_DISASSEMBLY ++#define ACPI_32BIT_PHYSICAL_ADDRESS + #endif + + #ifdef ACPI_EXEC_APP +diff --git a/include/linux/jhash.h b/include/linux/jhash.h +index 47cb09edec1a..348c6f47e4cc 100644 +--- a/include/linux/jhash.h ++++ b/include/linux/jhash.h +@@ -145,11 +145,11 @@ static inline u32 jhash2(const u32 *k, u32 length, u32 initval) + } + + +-/* jhash_3words - hash exactly 3, 2 or 1 word(s) */ +-static inline u32 jhash_3words(u32 a, u32 b, u32 c, u32 initval) ++/* __jhash_nwords - hash exactly 3, 2 or 1 word(s) */ ++static inline u32 __jhash_nwords(u32 a, u32 b, u32 c, u32 initval) + { +- a += JHASH_INITVAL; +- b += JHASH_INITVAL; ++ a += initval; ++ b += initval; + c += initval; + + __jhash_final(a, b, c); +@@ -157,14 +157,19 @@ static inline u32 jhash_3words(u32 a, u32 b, u32 c, u32 initval) + return c; + } + ++static inline u32 jhash_3words(u32 a, u32 b, u32 c, u32 initval) ++{ ++ return __jhash_nwords(a, b, c, initval + JHASH_INITVAL + (3 << 2)); ++} ++ + static inline u32 jhash_2words(u32 a, u32 b, u32 initval) + { +- return jhash_3words(a, b, 0, initval); ++ return __jhash_nwords(a, b, 0, initval + JHASH_INITVAL + (2 << 2)); + } + + static inline u32 jhash_1word(u32 a, u32 initval) + { +- return jhash_3words(a, 0, 0, initval); ++ return __jhash_nwords(a, 0, 0, initval + JHASH_INITVAL + (1 << 2)); + } + + #endif /* _LINUX_JHASH_H */ +diff --git a/include/linux/libata.h b/include/linux/libata.h +index 764cd54dfea7..35e7f71cd8a5 100644 +--- a/include/linux/libata.h ++++ b/include/linux/libata.h +@@ -182,6 +182,7 @@ enum { + ATA_LFLAG_DISABLED = (1 << 6), /* link is disabled */ + ATA_LFLAG_SW_ACTIVITY = (1 << 7), /* keep activity stats */ + ATA_LFLAG_NO_LPM = (1 << 8), /* disable LPM on this link */ ++ ATA_LFLAG_CHANGED = (1 << 10), /* LPM state changed on this link */ + + /* struct ata_port flags */ + ATA_FLAG_SLAVE_POSS = (1 << 0), /* host supports slave dev */ +@@ -285,6 +286,12 @@ enum { + */ + ATA_TMOUT_PMP_SRST_WAIT = 5000, + ++ /* When the LPM policy is set to ATA_LPM_MAX_POWER, there might ++ * be a spurious PHY event, so ignore the first PHY event that ++ * occurs within 10s after the policy change. ++ */ ++ ATA_TMOUT_SPURIOUS_PHY = 10000, ++ + /* ATA bus states */ + BUS_UNKNOWN = 0, + BUS_DMA = 1, +@@ -727,6 +734,8 @@ struct ata_link { + struct ata_eh_context eh_context; + + struct ata_device device[ATA_MAX_DEVICES]; ++ ++ unsigned long last_lpm_change; /* when last LPM change happened */ + }; + #define ATA_LINK_CLEAR_BEGIN offsetof(struct ata_link, active_tag) + #define ATA_LINK_CLEAR_END offsetof(struct ata_link, device[0]) +@@ -1065,6 +1074,7 @@ extern struct ata_device *ata_dev_pair(struct ata_device *adev); + extern int ata_do_set_mode(struct ata_link *link, struct ata_device **r_failed_dev); + extern void ata_scsi_port_error_handler(struct Scsi_Host *host, struct ata_port *ap); + extern void ata_scsi_cmd_error_handler(struct Scsi_Host *host, struct ata_port *ap, struct list_head *eh_q); ++extern bool sata_lpm_ignore_phy_events(struct ata_link *link); + + extern int ata_cable_40wire(struct ata_port *ap); + extern int ata_cable_80wire(struct ata_port *ap); +diff --git a/include/linux/nilfs2_fs.h b/include/linux/nilfs2_fs.h +index 89bd4a4dcfb4..25c6891e6302 100644 +--- a/include/linux/nilfs2_fs.h ++++ b/include/linux/nilfs2_fs.h +@@ -458,7 +458,7 @@ struct nilfs_btree_node { + /* level */ + #define NILFS_BTREE_LEVEL_DATA 0 + #define NILFS_BTREE_LEVEL_NODE_MIN (NILFS_BTREE_LEVEL_DATA + 1) +-#define NILFS_BTREE_LEVEL_MAX 14 ++#define NILFS_BTREE_LEVEL_MAX 14 /* Max level (exclusive) */ + + /** + * struct nilfs_palloc_group_desc - block group descriptor +diff --git a/include/scsi/scsi_devinfo.h b/include/scsi/scsi_devinfo.h +index b4ddd3b18b4c..fc8cdff83a50 100644 +--- a/include/scsi/scsi_devinfo.h ++++ b/include/scsi/scsi_devinfo.h +@@ -30,4 +30,5 @@ + #define BLIST_RETRY_HWERROR 0x400000 /* retry HARDWARE_ERROR */ + #define BLIST_MAX_512 0x800000 /* maximum 512 sector cdb length */ + #define BLIST_ATTACH_PQ3 0x1000000 /* Scan: Attach to PQ3 devices */ ++#define BLIST_MAX_1024 0x40000000 /* maximum 1024 sector cdb length */ + #endif +diff --git a/include/sound/emu10k1.h b/include/sound/emu10k1.h +index 4f865df42f0f..7ee55e3ff4fe 100644 +--- a/include/sound/emu10k1.h ++++ b/include/sound/emu10k1.h +@@ -43,7 +43,8 @@ + + #define EMUPAGESIZE 4096 + #define MAXREQVOICES 8 +-#define MAXPAGES 8192 ++#define MAXPAGES0 4096 /* 32 bit mode */ ++#define MAXPAGES1 8192 /* 31 bit mode */ + #define RESERVED 0 + #define NUM_MIDI 16 + #define NUM_G 64 /* use all channels */ +@@ -52,8 +53,7 @@ + + /* FIXME? - according to the OSS driver the EMU10K1 needs a 29 bit DMA mask */ + #define EMU10K1_DMA_MASK 0x7fffffffUL /* 31bit */ +-#define AUDIGY_DMA_MASK 0x7fffffffUL /* 31bit FIXME - 32 should work? */ +- /* See ALSA bug #1276 - rlrevell */ ++#define AUDIGY_DMA_MASK 0xffffffffUL /* 32bit mode */ + + #define TMEMSIZE 256*1024 + #define TMEMSIZEREG 4 +@@ -470,8 +470,11 @@ + + #define MAPB 0x0d /* Cache map B */ + +-#define MAP_PTE_MASK 0xffffe000 /* The 19 MSBs of the PTE indexed by the PTI */ +-#define MAP_PTI_MASK 0x00001fff /* The 13 bit index to one of the 8192 PTE dwords */ ++#define MAP_PTE_MASK0 0xfffff000 /* The 20 MSBs of the PTE indexed by the PTI */ ++#define MAP_PTI_MASK0 0x00000fff /* The 12 bit index to one of the 4096 PTE dwords */ ++ ++#define MAP_PTE_MASK1 0xffffe000 /* The 19 MSBs of the PTE indexed by the PTI */ ++#define MAP_PTI_MASK1 0x00001fff /* The 13 bit index to one of the 8192 PTE dwords */ + + /* 0x0e, 0x0f: Not used */ + +@@ -1708,6 +1711,7 @@ struct snd_emu10k1 { + unsigned short model; /* subsystem id */ + unsigned int card_type; /* EMU10K1_CARD_* */ + unsigned int ecard_ctrl; /* ecard control bits */ ++ unsigned int address_mode; /* address mode */ + unsigned long dma_mask; /* PCI DMA mask */ + unsigned int delay_pcm_irq; /* in samples */ + int max_cache_pages; /* max memory size / PAGE_SIZE */ +diff --git a/include/xen/events.h b/include/xen/events.h +index 04399b28e821..f9cb6306511f 100644 +--- a/include/xen/events.h ++++ b/include/xen/events.h +@@ -12,7 +12,7 @@ int bind_evtchn_to_irqhandler(unsigned int evtchn, + irq_handler_t handler, + unsigned long irqflags, const char *devname, + void *dev_id); +-int bind_virq_to_irq(unsigned int virq, unsigned int cpu); ++int bind_virq_to_irq(unsigned int virq, unsigned int cpu, bool percpu); + int bind_virq_to_irqhandler(unsigned int virq, unsigned int cpu, + irq_handler_t handler, + unsigned long irqflags, const char *devname, +diff --git a/kernel/ptrace.c b/kernel/ptrace.c +index a1432369be50..d9e71e311027 100644 +--- a/kernel/ptrace.c ++++ b/kernel/ptrace.c +@@ -632,6 +632,8 @@ static int ptrace_setsiginfo(struct task_struct *child, const siginfo_t *info) + static int ptrace_resume(struct task_struct *child, long request, + unsigned long data) + { ++ bool need_siglock; ++ + if (!valid_signal(data)) + return -EIO; + +@@ -659,8 +661,26 @@ static int ptrace_resume(struct task_struct *child, long request, + user_disable_single_step(child); + } + ++ /* ++ * Change ->exit_code and ->state under siglock to avoid the race ++ * with wait_task_stopped() in between; a non-zero ->exit_code will ++ * wrongly look like another report from tracee. ++ * ++ * Note that we need siglock even if ->exit_code == data and/or this ++ * status was not reported yet, the new status must not be cleared by ++ * wait_task_stopped() after resume. ++ * ++ * If data == 0 we do not care if wait_task_stopped() reports the old ++ * status and clears the code too; this can't race with the tracee, it ++ * takes siglock after resume. ++ */ ++ need_siglock = data && !thread_group_empty(current); ++ if (need_siglock) ++ spin_lock_irq(&child->sighand->siglock); + child->exit_code = data; + wake_up_state(child, __TASK_TRACED); ++ if (need_siglock) ++ spin_unlock_irq(&child->sighand->siglock); + + return 0; + } +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 2f8363e0a1ec..15be43522c8b 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -4396,8 +4396,13 @@ recheck: + + if (running) + p->sched_class->set_curr_task(rq); +- if (on_rq) +- enqueue_task(rq, p, 0); ++ if (on_rq) { ++ /* ++ * We enqueue to tail when the priority of a task is ++ * increased (user space view). ++ */ ++ enqueue_task(rq, p, oldprio <= p->prio ? ENQUEUE_HEAD : 0); ++ } + + check_class_changed(rq, p, prev_class, oldprio); + task_rq_unlock(rq, p, &flags); +diff --git a/kernel/trace/ring_buffer_benchmark.c b/kernel/trace/ring_buffer_benchmark.c +index a5457d577b98..6ad2e2d320fe 100644 +--- a/kernel/trace/ring_buffer_benchmark.c ++++ b/kernel/trace/ring_buffer_benchmark.c +@@ -455,7 +455,7 @@ static int __init ring_buffer_benchmark_init(void) + + if (producer_fifo >= 0) { + struct sched_param param = { +- .sched_priority = consumer_fifo ++ .sched_priority = producer_fifo + }; + sched_setscheduler(producer, SCHED_FIFO, ¶m); + } else +diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c +index 289197a2d334..3b04aec58700 100644 +--- a/kernel/trace/trace_events_filter.c ++++ b/kernel/trace/trace_events_filter.c +@@ -1357,19 +1357,25 @@ static int check_preds(struct filter_parse_state *ps) + { + int n_normal_preds = 0, n_logical_preds = 0; + struct postfix_elt *elt; ++ int cnt = 0; + + list_for_each_entry(elt, &ps->postfix, list) { +- if (elt->op == OP_NONE) ++ if (elt->op == OP_NONE) { ++ cnt++; + continue; ++ } + + if (elt->op == OP_AND || elt->op == OP_OR) { + n_logical_preds++; ++ cnt--; + continue; + } ++ cnt--; + n_normal_preds++; ++ WARN_ON_ONCE(cnt < 0); + } + +- if (!n_normal_preds || n_logical_preds >= n_normal_preds) { ++ if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) { + parse_error(ps, FILT_ERR_INVALID_FILTER, 0); + return -EINVAL; + } +diff --git a/mm/memory-failure.c b/mm/memory-failure.c +index 97eec2174769..c957a370bff8 100644 +--- a/mm/memory-failure.c ++++ b/mm/memory-failure.c +@@ -1095,10 +1095,10 @@ int memory_failure(unsigned long pfn, int trapno, int flags) + * The check (unnecessarily) ignores LRU pages being isolated and + * walked by the page reclaim code, however that's not a big loss. + */ +- if (!PageHuge(p) && !PageTransTail(p)) { +- if (!PageLRU(p)) +- shake_page(p, 0); +- if (!PageLRU(p)) { ++ if (!PageHuge(p)) { ++ if (!PageLRU(hpage)) ++ shake_page(hpage, 0); ++ if (!PageLRU(hpage)) { + /* + * shake_page could have turned it free. + */ +diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c +index 5ba0c844d508..3cb93e85d221 100644 +--- a/net/bridge/br_fdb.c ++++ b/net/bridge/br_fdb.c +@@ -440,7 +440,7 @@ void br_fdb_update(struct net_bridge *br, struct net_bridge_port *source, + fdb->updated = jiffies; + } + } else { +- spin_lock(&br->hash_lock); ++ spin_lock_bh(&br->hash_lock); + if (likely(!fdb_find(head, addr))) { + fdb = fdb_create(head, source, addr); + if (fdb) +@@ -449,7 +449,7 @@ void br_fdb_update(struct net_bridge *br, struct net_bridge_port *source, + /* else we lose race and someone else inserts + * it first, don't bother updating + */ +- spin_unlock(&br->hash_lock); ++ spin_unlock_bh(&br->hash_lock); + } + } + +@@ -665,9 +665,11 @@ int br_fdb_add(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg) + } + + if (ndm->ndm_flags & NTF_USE) { ++ local_bh_disable(); + rcu_read_lock(); + br_fdb_update(p->br, p, addr); + rcu_read_unlock(); ++ local_bh_enable(); + } else { + spin_lock_bh(&p->br->hash_lock); + err = fdb_add_entry(p, addr, ndm->ndm_state, nlh->nlmsg_flags); +diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c +index 0b870d75a542..a41051a1bca5 100644 +--- a/net/bridge/br_multicast.c ++++ b/net/bridge/br_multicast.c +@@ -972,7 +972,7 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br, + } + + err = br_ip6_multicast_add_group(br, port, &grec->grec_mca); +- if (!err) ++ if (err) + break; + } + +@@ -991,6 +991,9 @@ static void br_multicast_add_router(struct net_bridge *br, + struct net_bridge_port *p; + struct hlist_node *n, *slot = NULL; + ++ if (!hlist_unhashed(&port->rlist)) ++ return; ++ + hlist_for_each_entry(p, n, &br->router_list, rlist) { + if ((unsigned long) port >= (unsigned long) p) + break; +@@ -1018,12 +1021,8 @@ static void br_multicast_mark_router(struct net_bridge *br, + if (port->multicast_router != 1) + return; + +- if (!hlist_unhashed(&port->rlist)) +- goto timer; +- + br_multicast_add_router(br, port); + +-timer: + mod_timer(&port->multicast_router_timer, + now + br->multicast_querier_interval); + } +diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c +index e54ef82fdad7..5ba424839939 100644 +--- a/net/bridge/br_netfilter.c ++++ b/net/bridge/br_netfilter.c +@@ -818,12 +818,12 @@ static unsigned int br_nf_forward_arp(unsigned int hook, struct sk_buff *skb, + return NF_STOLEN; + } + +-#if IS_ENABLED(CONFIG_NF_CONNTRACK_IPV4) ++#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV4) + static int br_nf_dev_queue_xmit(struct sk_buff *skb) + { + int ret; + +- if (skb->nfct != NULL && skb->protocol == htons(ETH_P_IP) && ++ if (skb->protocol == htons(ETH_P_IP) && + skb->len + nf_bridge_mtu_reduction(skb) > skb->dev->mtu && + !skb_is_gso(skb)) { + if (br_parse_ip_options(skb)) +diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c +index cb9085272dd7..9f471c32d209 100644 +--- a/net/ipv4/ping.c ++++ b/net/ipv4/ping.c +@@ -138,6 +138,7 @@ static void ping_v4_unhash(struct sock *sk) + if (sk_hashed(sk)) { + write_lock_bh(&ping_table.lock); + hlist_nulls_del(&sk->sk_nulls_node); ++ sk_nulls_node_init(&sk->sk_nulls_node); + sock_put(sk); + isk->inet_num = 0; + isk->inet_sport = 0; +diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c +index 7949b5d1663f..5f8c20b67da2 100644 +--- a/net/ipv4/udp.c ++++ b/net/ipv4/udp.c +@@ -1251,10 +1251,8 @@ csum_copy_err: + UDP_INC_STATS_USER(sock_net(sk), UDP_MIB_INERRORS, is_udplite); + unlock_sock_fast(sk, slow); + +- if (noblock) +- return -EAGAIN; +- +- /* starting over for a new packet */ ++ /* starting over for a new packet, but check if we need to yield */ ++ cond_resched(); + msg->msg_flags &= ~MSG_TRUNC; + goto try_again; + } +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 4cfba3d5ad2c..23b33048ea98 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -1661,6 +1661,17 @@ void rt6_redirect(const struct in6_addr *dest, const struct in6_addr *src, + goto out; + } + ++#ifdef CONFIG_IPV6_MULTIPLE_TABLES ++ if (rt == net->ipv6.ip6_blk_hole_entry || ++ rt == net->ipv6.ip6_prohibit_entry) { ++ if (net_ratelimit()) ++ printk(KERN_DEBUG "rt6_redirect: source isn't a valid" \ ++ " nexthop for redirect target " \ ++ "(blackhole or prohibited)\n"); ++ goto out; ++ } ++#endif ++ + /* + * We have finally decided to accept it. + */ +diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c +index ef9052f8c90b..2f99b12b717e 100644 +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -451,10 +451,8 @@ csum_copy_err: + } + unlock_sock_fast(sk, slow); + +- if (noblock) +- return -EAGAIN; +- +- /* starting over for a new packet */ ++ /* starting over for a new packet, but check if we need to yield */ ++ cond_resched(); + msg->msg_flags &= ~MSG_TRUNC; + goto try_again; + } +diff --git a/net/mac80211/wep.c b/net/mac80211/wep.c +index 7aa31bbfaa3b..9464f92b1447 100644 +--- a/net/mac80211/wep.c ++++ b/net/mac80211/wep.c +@@ -97,8 +97,7 @@ static u8 *ieee80211_wep_add_iv(struct ieee80211_local *local, + + hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED); + +- if (WARN_ON(skb_tailroom(skb) < WEP_ICV_LEN || +- skb_headroom(skb) < WEP_IV_LEN)) ++ if (WARN_ON(skb_headroom(skb) < WEP_IV_LEN)) + return NULL; + + hdrlen = ieee80211_hdrlen(hdr->frame_control); +@@ -160,6 +159,9 @@ int ieee80211_wep_encrypt(struct ieee80211_local *local, + size_t len; + u8 rc4key[3 + WLAN_KEY_LEN_WEP104]; + ++ if (WARN_ON(skb_tailroom(skb) < WEP_ICV_LEN)) ++ return -1; ++ + iv = ieee80211_wep_add_iv(local, skb, keylen, keyidx); + if (!iv) + return -1; +diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c +index cbc5bfd8c8e4..f2ed4a996290 100644 +--- a/net/netfilter/ipvs/ip_vs_ctl.c ++++ b/net/netfilter/ipvs/ip_vs_ctl.c +@@ -3689,6 +3689,9 @@ void __net_exit ip_vs_control_net_cleanup_sysctl(struct net *net) + cancel_delayed_work_sync(&ipvs->defense_work); + cancel_work_sync(&ipvs->defense_work.work); + unregister_net_sysctl_table(ipvs->sysctl_hdr); ++ ++ if (!net_eq(net, &init_net)) ++ kfree(ipvs->sysctl_tbl); + } + + #else +diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c +index bde7d69b440d..e89563655030 100644 +--- a/net/rose/af_rose.c ++++ b/net/rose/af_rose.c +@@ -194,7 +194,8 @@ static void rose_kill_by_device(struct net_device *dev) + + if (rose->device == dev) { + rose_disconnect(s, ENETUNREACH, ROSE_OUT_OF_ORDER, 0); +- rose->neighbour->use--; ++ if (rose->neighbour) ++ rose->neighbour->use--; + rose->device = NULL; + } + } +diff --git a/net/socket.c b/net/socket.c +index 025f7f4d2d80..f5ce151e0e3b 100644 +--- a/net/socket.c ++++ b/net/socket.c +@@ -1934,14 +1934,12 @@ static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg, + int err, ctl_len, iov_size, total_len; + + err = -EFAULT; +- if (MSG_CMSG_COMPAT & flags) { +- if (get_compat_msghdr(msg_sys, msg_compat)) +- return -EFAULT; +- } else { ++ if (MSG_CMSG_COMPAT & flags) ++ err = get_compat_msghdr(msg_sys, msg_compat); ++ else + err = copy_msghdr_from_user(msg_sys, msg); +- if (err) +- return err; +- } ++ if (err) ++ return err; + + /* do not move before msg_sys is valid */ + err = -EMSGSIZE; +@@ -2149,14 +2147,12 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg, + struct sockaddr __user *uaddr; + int __user *uaddr_len; + +- if (MSG_CMSG_COMPAT & flags) { +- if (get_compat_msghdr(msg_sys, msg_compat)) +- return -EFAULT; +- } else { ++ if (MSG_CMSG_COMPAT & flags) ++ err = get_compat_msghdr(msg_sys, msg_compat); ++ else + err = copy_msghdr_from_user(msg_sys, msg); +- if (err) +- return err; +- } ++ if (err) ++ return err; + + err = -EMSGSIZE; + if (msg_sys->msg_iovlen > UIO_MAXIOV) +diff --git a/security/selinux/nlmsgtab.c b/security/selinux/nlmsgtab.c +index 0920ea3bf599..5776921d6209 100644 +--- a/security/selinux/nlmsgtab.c ++++ b/security/selinux/nlmsgtab.c +@@ -100,6 +100,12 @@ static struct nlmsg_perm nlmsg_xfrm_perms[] = + { XFRM_MSG_FLUSHPOLICY, NETLINK_XFRM_SOCKET__NLMSG_WRITE }, + { XFRM_MSG_NEWAE, NETLINK_XFRM_SOCKET__NLMSG_WRITE }, + { XFRM_MSG_GETAE, NETLINK_XFRM_SOCKET__NLMSG_READ }, ++ { XFRM_MSG_REPORT, NETLINK_XFRM_SOCKET__NLMSG_READ }, ++ { XFRM_MSG_MIGRATE, NETLINK_XFRM_SOCKET__NLMSG_WRITE }, ++ { XFRM_MSG_NEWSADINFO, NETLINK_XFRM_SOCKET__NLMSG_READ }, ++ { XFRM_MSG_GETSADINFO, NETLINK_XFRM_SOCKET__NLMSG_READ }, ++ { XFRM_MSG_GETSPDINFO, NETLINK_XFRM_SOCKET__NLMSG_READ }, ++ { XFRM_MSG_MAPPING, NETLINK_XFRM_SOCKET__NLMSG_READ }, + }; + + static struct nlmsg_perm nlmsg_audit_perms[] = +diff --git a/sound/pci/emu10k1/emu10k1.c b/sound/pci/emu10k1/emu10k1.c +index 790c65d980c8..aefde0175846 100644 +--- a/sound/pci/emu10k1/emu10k1.c ++++ b/sound/pci/emu10k1/emu10k1.c +@@ -181,8 +181,10 @@ static int __devinit snd_card_emu10k1_probe(struct pci_dev *pci, + } + #endif + +- strcpy(card->driver, emu->card_capabilities->driver); +- strcpy(card->shortname, emu->card_capabilities->name); ++ strlcpy(card->driver, emu->card_capabilities->driver, ++ sizeof(card->driver)); ++ strlcpy(card->shortname, emu->card_capabilities->name, ++ sizeof(card->shortname)); + snprintf(card->longname, sizeof(card->longname), + "%s (rev.%d, serial:0x%x) at 0x%lx, irq %i", + card->shortname, emu->revision, emu->serial, emu->port, emu->irq); +diff --git a/sound/pci/emu10k1/emu10k1_callback.c b/sound/pci/emu10k1/emu10k1_callback.c +index f35284be7b02..829595078fa1 100644 +--- a/sound/pci/emu10k1/emu10k1_callback.c ++++ b/sound/pci/emu10k1/emu10k1_callback.c +@@ -415,7 +415,7 @@ start_voice(struct snd_emux_voice *vp) + snd_emu10k1_ptr_write(hw, Z2, ch, 0); + + /* invalidate maps */ +- temp = (hw->silent_page.addr << 1) | MAP_PTI_MASK; ++ temp = (hw->silent_page.addr << hw->address_mode) | (hw->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0); + snd_emu10k1_ptr_write(hw, MAPA, ch, temp); + snd_emu10k1_ptr_write(hw, MAPB, ch, temp); + #if 0 +@@ -436,7 +436,7 @@ start_voice(struct snd_emux_voice *vp) + snd_emu10k1_ptr_write(hw, CDF, ch, sample); + + /* invalidate maps */ +- temp = ((unsigned int)hw->silent_page.addr << 1) | MAP_PTI_MASK; ++ temp = ((unsigned int)hw->silent_page.addr << hw_address_mode) | (hw->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0); + snd_emu10k1_ptr_write(hw, MAPA, ch, temp); + snd_emu10k1_ptr_write(hw, MAPB, ch, temp); + +diff --git a/sound/pci/emu10k1/emu10k1_main.c b/sound/pci/emu10k1/emu10k1_main.c +index a78fdf466fa7..124ae93d3748 100644 +--- a/sound/pci/emu10k1/emu10k1_main.c ++++ b/sound/pci/emu10k1/emu10k1_main.c +@@ -282,7 +282,7 @@ static int snd_emu10k1_init(struct snd_emu10k1 *emu, int enable_ir, int resume) + snd_emu10k1_ptr_write(emu, TCB, 0, 0); /* taken from original driver */ + snd_emu10k1_ptr_write(emu, TCBS, 0, 4); /* taken from original driver */ + +- silent_page = (emu->silent_page.addr << 1) | MAP_PTI_MASK; ++ silent_page = (emu->silent_page.addr << emu->address_mode) | (emu->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0); + for (ch = 0; ch < NUM_G; ch++) { + snd_emu10k1_ptr_write(emu, MAPA, ch, silent_page); + snd_emu10k1_ptr_write(emu, MAPB, ch, silent_page); +@@ -348,6 +348,11 @@ static int snd_emu10k1_init(struct snd_emu10k1 *emu, int enable_ir, int resume) + outl(reg | A_IOCFG_GPOUT0, emu->port + A_IOCFG); + } + ++ if (emu->address_mode == 0) { ++ /* use 16M in 4G */ ++ outl(inl(emu->port + HCFG) | HCFG_EXPANDED_MEM, emu->port + HCFG); ++ } ++ + return 0; + } + +@@ -1390,7 +1395,7 @@ static struct snd_emu_chip_details emu_chip_details[] = { + * + */ + {.vendor = 0x1102, .device = 0x0008, .subsystem = 0x20011102, +- .driver = "Audigy2", .name = "SB Audigy 2 ZS Notebook [SB0530]", ++ .driver = "Audigy2", .name = "Audigy 2 ZS Notebook [SB0530]", + .id = "Audigy2", + .emu10k2_chip = 1, + .ca0108_chip = 1, +@@ -1540,7 +1545,7 @@ static struct snd_emu_chip_details emu_chip_details[] = { + .adc_1361t = 1, /* 24 bit capture instead of 16bit */ + .ac97_chip = 1} , + {.vendor = 0x1102, .device = 0x0004, .subsystem = 0x10051102, +- .driver = "Audigy2", .name = "SB Audigy 2 Platinum EX [SB0280]", ++ .driver = "Audigy2", .name = "Audigy 2 Platinum EX [SB0280]", + .id = "Audigy2", + .emu10k2_chip = 1, + .ca0102_chip = 1, +@@ -1844,8 +1849,10 @@ int __devinit snd_emu10k1_create(struct snd_card *card, + + is_audigy = emu->audigy = c->emu10k2_chip; + ++ /* set addressing mode */ ++ emu->address_mode = is_audigy ? 0 : 1; + /* set the DMA transfer mask */ +- emu->dma_mask = is_audigy ? AUDIGY_DMA_MASK : EMU10K1_DMA_MASK; ++ emu->dma_mask = emu->address_mode ? EMU10K1_DMA_MASK : AUDIGY_DMA_MASK; + if (pci_set_dma_mask(pci, emu->dma_mask) < 0 || + pci_set_consistent_dma_mask(pci, emu->dma_mask) < 0) { + snd_printk(KERN_ERR "architecture does not support PCI busmaster DMA with mask 0x%lx\n", emu->dma_mask); +@@ -1868,7 +1875,7 @@ int __devinit snd_emu10k1_create(struct snd_card *card, + + emu->max_cache_pages = max_cache_bytes >> PAGE_SHIFT; + if (snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV, snd_dma_pci_data(pci), +- 32 * 1024, &emu->ptb_pages) < 0) { ++ (emu->address_mode ? 32 : 16) * 1024, &emu->ptb_pages) < 0) { + err = -ENOMEM; + goto error; + } +@@ -1967,8 +1974,8 @@ int __devinit snd_emu10k1_create(struct snd_card *card, + + /* Clear silent pages and set up pointers */ + memset(emu->silent_page.area, 0, PAGE_SIZE); +- silent_page = emu->silent_page.addr << 1; +- for (idx = 0; idx < MAXPAGES; idx++) ++ silent_page = emu->silent_page.addr << emu->address_mode; ++ for (idx = 0; idx < (emu->address_mode ? MAXPAGES1 : MAXPAGES0); idx++) + ((u32 *)emu->ptb_pages.area)[idx] = cpu_to_le32(silent_page | idx); + + /* set up voice indices */ +diff --git a/sound/pci/emu10k1/emupcm.c b/sound/pci/emu10k1/emupcm.c +index e22b8e2bbd88..c673d2b31510 100644 +--- a/sound/pci/emu10k1/emupcm.c ++++ b/sound/pci/emu10k1/emupcm.c +@@ -379,7 +379,7 @@ static void snd_emu10k1_pcm_init_voice(struct snd_emu10k1 *emu, + snd_emu10k1_ptr_write(emu, Z1, voice, 0); + snd_emu10k1_ptr_write(emu, Z2, voice, 0); + /* invalidate maps */ +- silent_page = ((unsigned int)emu->silent_page.addr << 1) | MAP_PTI_MASK; ++ silent_page = ((unsigned int)emu->silent_page.addr << emu->address_mode) | (emu->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0); + snd_emu10k1_ptr_write(emu, MAPA, voice, silent_page); + snd_emu10k1_ptr_write(emu, MAPB, voice, silent_page); + /* modulation envelope */ +diff --git a/sound/pci/emu10k1/emuproc.c b/sound/pci/emu10k1/emuproc.c +index bc38dd4d071f..9c499e6bae06 100644 +--- a/sound/pci/emu10k1/emuproc.c ++++ b/sound/pci/emu10k1/emuproc.c +@@ -241,31 +241,22 @@ static void snd_emu10k1_proc_spdif_read(struct snd_info_entry *entry, + struct snd_emu10k1 *emu = entry->private_data; + u32 value; + u32 value2; +- unsigned long flags; + u32 rate; + + if (emu->card_capabilities->emu_model) { +- spin_lock_irqsave(&emu->emu_lock, flags); + snd_emu1010_fpga_read(emu, 0x38, &value); +- spin_unlock_irqrestore(&emu->emu_lock, flags); + if ((value & 0x1) == 0) { +- spin_lock_irqsave(&emu->emu_lock, flags); + snd_emu1010_fpga_read(emu, 0x2a, &value); + snd_emu1010_fpga_read(emu, 0x2b, &value2); +- spin_unlock_irqrestore(&emu->emu_lock, flags); + rate = 0x1770000 / (((value << 5) | value2)+1); + snd_iprintf(buffer, "ADAT Locked : %u\n", rate); + } else { + snd_iprintf(buffer, "ADAT Unlocked\n"); + } +- spin_lock_irqsave(&emu->emu_lock, flags); + snd_emu1010_fpga_read(emu, 0x20, &value); +- spin_unlock_irqrestore(&emu->emu_lock, flags); + if ((value & 0x4) == 0) { +- spin_lock_irqsave(&emu->emu_lock, flags); + snd_emu1010_fpga_read(emu, 0x28, &value); + snd_emu1010_fpga_read(emu, 0x29, &value2); +- spin_unlock_irqrestore(&emu->emu_lock, flags); + rate = 0x1770000 / (((value << 5) | value2)+1); + snd_iprintf(buffer, "SPDIF Locked : %d\n", rate); + } else { +@@ -410,14 +401,11 @@ static void snd_emu_proc_emu1010_reg_read(struct snd_info_entry *entry, + { + struct snd_emu10k1 *emu = entry->private_data; + u32 value; +- unsigned long flags; + int i; + snd_iprintf(buffer, "EMU1010 Registers:\n\n"); + + for(i = 0; i < 0x40; i+=1) { +- spin_lock_irqsave(&emu->emu_lock, flags); + snd_emu1010_fpga_read(emu, i, &value); +- spin_unlock_irqrestore(&emu->emu_lock, flags); + snd_iprintf(buffer, "%02X: %08X, %02X\n", i, value, (value >> 8) & 0x7f); + } + } +diff --git a/sound/pci/emu10k1/memory.c b/sound/pci/emu10k1/memory.c +index 4f502a2bdc3c..87b7c65fa033 100644 +--- a/sound/pci/emu10k1/memory.c ++++ b/sound/pci/emu10k1/memory.c +@@ -34,10 +34,11 @@ + * aligned pages in others + */ + #define __set_ptb_entry(emu,page,addr) \ +- (((u32 *)(emu)->ptb_pages.area)[page] = cpu_to_le32(((addr) << 1) | (page))) ++ (((u32 *)(emu)->ptb_pages.area)[page] = cpu_to_le32(((addr) << (emu->address_mode)) | (page))) + + #define UNIT_PAGES (PAGE_SIZE / EMUPAGESIZE) +-#define MAX_ALIGN_PAGES (MAXPAGES / UNIT_PAGES) ++#define MAX_ALIGN_PAGES0 (MAXPAGES0 / UNIT_PAGES) ++#define MAX_ALIGN_PAGES1 (MAXPAGES1 / UNIT_PAGES) + /* get aligned page from offset address */ + #define get_aligned_page(offset) ((offset) >> PAGE_SHIFT) + /* get offset address from aligned page */ +@@ -124,7 +125,7 @@ static int search_empty_map_area(struct snd_emu10k1 *emu, int npages, struct lis + } + page = blk->mapped_page + blk->pages; + } +- size = MAX_ALIGN_PAGES - page; ++ size = (emu->address_mode ? MAX_ALIGN_PAGES1 : MAX_ALIGN_PAGES0) - page; + if (size >= max_size) { + *nextp = pos; + return page; +@@ -181,7 +182,7 @@ static int unmap_memblk(struct snd_emu10k1 *emu, struct snd_emu10k1_memblk *blk) + q = get_emu10k1_memblk(p, mapped_link); + end_page = q->mapped_page; + } else +- end_page = MAX_ALIGN_PAGES; ++ end_page = (emu->address_mode ? MAX_ALIGN_PAGES1 : MAX_ALIGN_PAGES0); + + /* remove links */ + list_del(&blk->mapped_link); +@@ -305,7 +306,7 @@ snd_emu10k1_alloc_pages(struct snd_emu10k1 *emu, struct snd_pcm_substream *subst + if (snd_BUG_ON(!emu)) + return NULL; + if (snd_BUG_ON(runtime->dma_bytes <= 0 || +- runtime->dma_bytes >= MAXPAGES * EMUPAGESIZE)) ++ runtime->dma_bytes >= (emu->address_mode ? MAXPAGES1 : MAXPAGES0) * EMUPAGESIZE)) + return NULL; + hdr = emu->memhdr; + if (snd_BUG_ON(!hdr)) +diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c +index c74a044284b0..f70115e143ec 100644 +--- a/sound/pci/hda/hda_codec.c ++++ b/sound/pci/hda/hda_codec.c +@@ -2093,6 +2093,16 @@ _snd_hda_find_mixer_ctl(struct hda_codec *codec, + return snd_ctl_find_id(codec->bus->card, &id); + } + ++/* meta hook to call each driver's vmaster hook */ ++static void vmaster_hook(void *private_data, int enabled) ++{ ++ struct hda_vmaster_mute_hook *hook = private_data; ++ ++ if (hook->mute_mode != HDA_VMUTE_FOLLOW_MASTER) ++ enabled = hook->mute_mode; ++ hook->hook(hook->codec, enabled); ++} ++ + /** + * snd_hda_find_mixer_ctl - Find a mixer control element with the given name + * @codec: HD-audio codec +@@ -2520,9 +2530,9 @@ int snd_hda_add_vmaster_hook(struct hda_codec *codec, + + if (!hook->hook || !hook->sw_kctl) + return 0; +- snd_ctl_add_vmaster_hook(hook->sw_kctl, hook->hook, codec); + hook->codec = codec; + hook->mute_mode = HDA_VMUTE_FOLLOW_MASTER; ++ snd_ctl_add_vmaster_hook(hook->sw_kctl, vmaster_hook, hook); + if (!expose_enum_ctl) + return 0; + kctl = snd_ctl_new1(&vmaster_mute_mode, hook); +@@ -2540,14 +2550,7 @@ void snd_hda_sync_vmaster_hook(struct hda_vmaster_mute_hook *hook) + { + if (!hook->hook || !hook->codec) + return; +- switch (hook->mute_mode) { +- case HDA_VMUTE_FOLLOW_MASTER: +- snd_ctl_sync_vmaster_hook(hook->sw_kctl); +- break; +- default: +- hook->hook(hook->codec, hook->mute_mode); +- break; +- } ++ snd_ctl_sync_vmaster_hook(hook->sw_kctl); + } + EXPORT_SYMBOL_HDA(snd_hda_sync_vmaster_hook); + +diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c +index 20cfc5b44710..ba80c2f7e047 100644 +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -4606,6 +4606,14 @@ static const struct hda_codec_preset snd_hda_preset_conexant[] = { + .patch = patch_conexant_auto }, + { .id = 0x14f150b9, .name = "CX20665", + .patch = patch_conexant_auto }, ++ { .id = 0x14f150f1, .name = "CX20721", ++ .patch = patch_conexant_auto }, ++ { .id = 0x14f150f2, .name = "CX20722", ++ .patch = patch_conexant_auto }, ++ { .id = 0x14f150f3, .name = "CX20723", ++ .patch = patch_conexant_auto }, ++ { .id = 0x14f150f4, .name = "CX20724", ++ .patch = patch_conexant_auto }, + { .id = 0x14f1510f, .name = "CX20751/2", + .patch = patch_conexant_auto }, + { .id = 0x14f15110, .name = "CX20751/2", +@@ -4640,6 +4648,10 @@ MODULE_ALIAS("snd-hda-codec-id:14f150ab"); + MODULE_ALIAS("snd-hda-codec-id:14f150ac"); + MODULE_ALIAS("snd-hda-codec-id:14f150b8"); + MODULE_ALIAS("snd-hda-codec-id:14f150b9"); ++MODULE_ALIAS("snd-hda-codec-id:14f150f1"); ++MODULE_ALIAS("snd-hda-codec-id:14f150f2"); ++MODULE_ALIAS("snd-hda-codec-id:14f150f3"); ++MODULE_ALIAS("snd-hda-codec-id:14f150f4"); + MODULE_ALIAS("snd-hda-codec-id:14f1510f"); + MODULE_ALIAS("snd-hda-codec-id:14f15110"); + MODULE_ALIAS("snd-hda-codec-id:14f15111"); +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index b16a37f633c5..bf1f0abf415b 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5412,6 +5412,7 @@ static const struct alc_fixup alc882_fixups[] = { + static const struct snd_pci_quirk alc882_fixup_tbl[] = { + SND_PCI_QUIRK(0x1025, 0x006c, "Acer Aspire 9810", ALC883_FIXUP_ACER_EAPD), + SND_PCI_QUIRK(0x1025, 0x0090, "Acer Aspire", ALC883_FIXUP_ACER_EAPD), ++ SND_PCI_QUIRK(0x1025, 0x0107, "Acer Aspire", ALC883_FIXUP_ACER_EAPD), + SND_PCI_QUIRK(0x1025, 0x010a, "Acer Ferrari 5000", ALC883_FIXUP_ACER_EAPD), + SND_PCI_QUIRK(0x1025, 0x0110, "Acer Aspire", ALC883_FIXUP_ACER_EAPD), + SND_PCI_QUIRK(0x1025, 0x0112, "Acer Aspire 9303", ALC883_FIXUP_ACER_EAPD), +diff --git a/sound/soc/codecs/cs4271.c b/sound/soc/codecs/cs4271.c +index f9e2bdaf91f1..54059324d942 100644 +--- a/sound/soc/codecs/cs4271.c ++++ b/sound/soc/codecs/cs4271.c +@@ -475,10 +475,10 @@ static int cs4271_probe(struct snd_soc_codec *codec) + if (gpio_nreset >= 0) { + /* Reset codec */ + gpio_direction_output(gpio_nreset, 0); +- udelay(1); ++ mdelay(1); + gpio_set_value(gpio_nreset, 1); + /* Give the codec time to wake up */ +- udelay(1); ++ mdelay(1); + } + + cs4271->gpio_nreset = gpio_nreset; +diff --git a/sound/soc/codecs/wm8741.c b/sound/soc/codecs/wm8741.c +index 3941f50bf187..90deecddb6ac 100644 +--- a/sound/soc/codecs/wm8741.c ++++ b/sound/soc/codecs/wm8741.c +@@ -105,7 +105,7 @@ static struct { + }; + + static unsigned int rates_11289[] = { +- 44100, 88235, ++ 44100, 88200, + }; + + static struct snd_pcm_hw_constraint_list constraints_11289 = { +@@ -132,7 +132,7 @@ static struct snd_pcm_hw_constraint_list constraints_16384 = { + }; + + static unsigned int rates_16934[] = { +- 44100, 88235, ++ 44100, 88200, + }; + + static struct snd_pcm_hw_constraint_list constraints_16934 = { +@@ -150,7 +150,7 @@ static struct snd_pcm_hw_constraint_list constraints_18432 = { + }; + + static unsigned int rates_22579[] = { +- 44100, 88235, 1764000 ++ 44100, 88200, 176400 + }; + + static struct snd_pcm_hw_constraint_list constraints_22579 = { +@@ -168,7 +168,7 @@ static struct snd_pcm_hw_constraint_list constraints_24576 = { + }; + + static unsigned int rates_36864[] = { +- 48000, 96000, 19200 ++ 48000, 96000, 192000 + }; + + static struct snd_pcm_hw_constraint_list constraints_36864 = { +diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c +index a3e4831bbe39..ed986e6d10c4 100644 +--- a/sound/soc/codecs/wm8960.c ++++ b/sound/soc/codecs/wm8960.c +@@ -333,7 +333,7 @@ static const struct snd_soc_dapm_route audio_paths[] = { + { "Right Input Mixer", "Boost Switch", "Right Boost Mixer", }, + { "Right Input Mixer", NULL, "RINPUT1", }, /* Really Boost Switch */ + { "Right Input Mixer", NULL, "RINPUT2" }, +- { "Right Input Mixer", NULL, "LINPUT3" }, ++ { "Right Input Mixer", NULL, "RINPUT3" }, + + { "Left ADC", NULL, "Left Input Mixer" }, + { "Right ADC", NULL, "Right Input Mixer" }, +diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c +index d9924d76f713..c93c573f967a 100644 +--- a/sound/soc/codecs/wm8994.c ++++ b/sound/soc/codecs/wm8994.c +@@ -2636,7 +2636,7 @@ static struct { + }; + + static int fs_ratios[] = { +- 64, 128, 192, 256, 348, 512, 768, 1024, 1408, 1536 ++ 64, 128, 192, 256, 384, 512, 768, 1024, 1408, 1536 + }; + + static int bclk_divs[] = { +diff --git a/sound/synth/emux/emux_oss.c b/sound/synth/emux/emux_oss.c +index 319754cf6208..daf61abc3670 100644 +--- a/sound/synth/emux/emux_oss.c ++++ b/sound/synth/emux/emux_oss.c +@@ -118,12 +118,8 @@ snd_emux_open_seq_oss(struct snd_seq_oss_arg *arg, void *closure) + if (snd_BUG_ON(!arg || !emu)) + return -ENXIO; + +- mutex_lock(&emu->register_mutex); +- +- if (!snd_emux_inc_count(emu)) { +- mutex_unlock(&emu->register_mutex); ++ if (!snd_emux_inc_count(emu)) + return -EFAULT; +- } + + memset(&callback, 0, sizeof(callback)); + callback.owner = THIS_MODULE; +@@ -135,7 +131,6 @@ snd_emux_open_seq_oss(struct snd_seq_oss_arg *arg, void *closure) + if (p == NULL) { + snd_printk(KERN_ERR "can't create port\n"); + snd_emux_dec_count(emu); +- mutex_unlock(&emu->register_mutex); + return -ENOMEM; + } + +@@ -148,8 +143,6 @@ snd_emux_open_seq_oss(struct snd_seq_oss_arg *arg, void *closure) + reset_port_mode(p, arg->seq_mode); + + snd_emux_reset_port(p); +- +- mutex_unlock(&emu->register_mutex); + return 0; + } + +@@ -195,13 +188,11 @@ snd_emux_close_seq_oss(struct snd_seq_oss_arg *arg) + if (snd_BUG_ON(!emu)) + return -ENXIO; + +- mutex_lock(&emu->register_mutex); + snd_emux_sounds_off_all(p); + snd_soundfont_close_check(emu->sflist, SF_CLIENT_NO(p->chset.port)); + snd_seq_event_port_detach(p->chset.client, p->chset.port); + snd_emux_dec_count(emu); + +- mutex_unlock(&emu->register_mutex); + return 0; + } + +diff --git a/sound/synth/emux/emux_seq.c b/sound/synth/emux/emux_seq.c +index 7778b8e19782..a0209204ae48 100644 +--- a/sound/synth/emux/emux_seq.c ++++ b/sound/synth/emux/emux_seq.c +@@ -124,12 +124,10 @@ snd_emux_detach_seq(struct snd_emux *emu) + if (emu->voices) + snd_emux_terminate_all(emu); + +- mutex_lock(&emu->register_mutex); + if (emu->client >= 0) { + snd_seq_delete_kernel_client(emu->client); + emu->client = -1; + } +- mutex_unlock(&emu->register_mutex); + } + + +@@ -269,8 +267,8 @@ snd_emux_event_input(struct snd_seq_event *ev, int direct, void *private_data, + /* + * increment usage count + */ +-int +-snd_emux_inc_count(struct snd_emux *emu) ++static int ++__snd_emux_inc_count(struct snd_emux *emu) + { + emu->used++; + if (!try_module_get(emu->ops.owner)) +@@ -284,12 +282,21 @@ snd_emux_inc_count(struct snd_emux *emu) + return 1; + } + ++int snd_emux_inc_count(struct snd_emux *emu) ++{ ++ int ret; ++ ++ mutex_lock(&emu->register_mutex); ++ ret = __snd_emux_inc_count(emu); ++ mutex_unlock(&emu->register_mutex); ++ return ret; ++} + + /* + * decrease usage count + */ +-void +-snd_emux_dec_count(struct snd_emux *emu) ++static void ++__snd_emux_dec_count(struct snd_emux *emu) + { + module_put(emu->card->module); + emu->used--; +@@ -298,6 +305,12 @@ snd_emux_dec_count(struct snd_emux *emu) + module_put(emu->ops.owner); + } + ++void snd_emux_dec_count(struct snd_emux *emu) ++{ ++ mutex_lock(&emu->register_mutex); ++ __snd_emux_dec_count(emu); ++ mutex_unlock(&emu->register_mutex); ++} + + /* + * Routine that is called upon a first use of a particular port +@@ -317,7 +330,7 @@ snd_emux_use(void *private_data, struct snd_seq_port_subscribe *info) + + mutex_lock(&emu->register_mutex); + snd_emux_init_port(p); +- snd_emux_inc_count(emu); ++ __snd_emux_inc_count(emu); + mutex_unlock(&emu->register_mutex); + return 0; + } +@@ -340,7 +353,7 @@ snd_emux_unuse(void *private_data, struct snd_seq_port_subscribe *info) + + mutex_lock(&emu->register_mutex); + snd_emux_sounds_off_all(p); +- snd_emux_dec_count(emu); ++ __snd_emux_dec_count(emu); + mutex_unlock(&emu->register_mutex); + return 0; + } +diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c +index 1e0798f6539b..851786ffa639 100644 +--- a/sound/usb/mixer_maps.c ++++ b/sound/usb/mixer_maps.c +@@ -380,6 +380,11 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = { + .ignore_ctl_error = 1, + }, + { ++ /* MAYA44 USB+ */ ++ .id = USB_ID(0x2573, 0x0008), ++ .map = maya44_map, ++ }, ++ { + /* KEF X300A */ + .id = USB_ID(0x27ac, 0x1000), + .map = scms_usb3318_map, diff --git a/patch/kernel/sun5i-default/0015-patch-3.4.109-110.patch b/patch/kernel/sun5i-default/0015-patch-3.4.109-110.patch new file mode 100644 index 0000000000..2178866456 --- /dev/null +++ b/patch/kernel/sun5i-default/0015-patch-3.4.109-110.patch @@ -0,0 +1,2308 @@ +diff --git a/Documentation/networking/pktgen.txt b/Documentation/networking/pktgen.txt +index 75e4fd708ccb..a03239c4163d 100644 +--- a/Documentation/networking/pktgen.txt ++++ b/Documentation/networking/pktgen.txt +@@ -24,17 +24,33 @@ For monitoring and control pktgen creates: + /proc/net/pktgen/ethX + + +-Viewing threads +-=============== +-/proc/net/pktgen/kpktgend_0 +-Name: kpktgend_0 max_before_softirq: 10000 +-Running: +-Stopped: eth1 +-Result: OK: max_before_softirq=10000 ++Kernel threads ++============== ++Pktgen creates a thread for each CPU with affinity to that CPU. ++Which is controlled through procfile /proc/net/pktgen/kpktgend_X. ++ ++Example: /proc/net/pktgen/kpktgend_0 ++ ++ Running: ++ Stopped: eth4@0 ++ Result: OK: add_device=eth4@0 ++ ++Most important are the devices assigned to the thread. + +-Most important the devices assigned to thread. Note! A device can only belong +-to one thread. ++The two basic thread commands are: ++ * add_device DEVICE@NAME -- adds a single device ++ * rem_device_all -- remove all associated devices + ++When adding a device to a thread, a corrosponding procfile is created ++which is used for configuring this device. Thus, device names need to ++be unique. ++ ++To support adding the same device to multiple threads, which is useful ++with multi queue NICs, a the device naming scheme is extended with "@": ++ device@something ++ ++The part after "@" can be anything, but it is custom to use the thread ++number. + + Viewing devices + =============== +@@ -42,29 +58,32 @@ Viewing devices + Parm section holds configured info. Current hold running stats. + Result is printed after run or after interruption. Example: + +-/proc/net/pktgen/eth1 ++/proc/net/pktgen/eth4@0 + +-Params: count 10000000 min_pkt_size: 60 max_pkt_size: 60 +- frags: 0 delay: 0 clone_skb: 1000000 ifname: eth1 ++ Params: count 100000 min_pkt_size: 60 max_pkt_size: 60 ++ frags: 0 delay: 0 clone_skb: 64 ifname: eth4@0 + flows: 0 flowlen: 0 +- dst_min: 10.10.11.2 dst_max: +- src_min: src_max: +- src_mac: 00:00:00:00:00:00 dst_mac: 00:04:23:AC:FD:82 +- udp_src_min: 9 udp_src_max: 9 udp_dst_min: 9 udp_dst_max: 9 +- src_mac_count: 0 dst_mac_count: 0 +- Flags: +-Current: +- pkts-sofar: 10000000 errors: 39664 +- started: 1103053986245187us stopped: 1103053999346329us idle: 880401us +- seq_num: 10000011 cur_dst_mac_offset: 0 cur_src_mac_offset: 0 +- cur_saddr: 0x10a0a0a cur_daddr: 0x20b0a0a +- cur_udp_dst: 9 cur_udp_src: 9 ++ queue_map_min: 0 queue_map_max: 0 ++ dst_min: 192.168.81.2 dst_max: ++ src_min: src_max: ++ src_mac: 90:e2:ba:0a:56:b4 dst_mac: 00:1b:21:3c:9d:f8 ++ udp_src_min: 9 udp_src_max: 109 udp_dst_min: 9 udp_dst_max: 9 ++ src_mac_count: 0 dst_mac_count: 0 ++ Flags: UDPSRC_RND NO_TIMESTAMP QUEUE_MAP_CPU ++ Current: ++ pkts-sofar: 100000 errors: 0 ++ started: 623913381008us stopped: 623913396439us idle: 25us ++ seq_num: 100001 cur_dst_mac_offset: 0 cur_src_mac_offset: 0 ++ cur_saddr: 192.168.8.3 cur_daddr: 192.168.81.2 ++ cur_udp_dst: 9 cur_udp_src: 42 ++ cur_queue_map: + flows: 0 +-Result: OK: 13101142(c12220741+d880401) usec, 10000000 (60byte,0frags) +- 763292pps 390Mb/sec (390805504bps) errors: 39664 ++ Result: OK: 15430(c15405d25) usec, 100000 (60byte,0frags) ++ 6480562pps 3110Mb/sec (3110669760bps) errors: 0 + +-Configuring threads and devices +-================================ ++ ++Configuring devices ++=================== + This is done via the /proc interface easiest done via pgset in the scripts + + Examples: +@@ -177,6 +196,8 @@ Note when adding devices to a specific CPU there good idea to also assign + /proc/irq/XX/smp_affinity so the TX-interrupts gets bound to the same CPU. + as this reduces cache bouncing when freeing skb's. + ++Plus using the device flag QUEUE_MAP_CPU, which maps the SKBs TX queue ++to the running threads CPU (directly from smp_processor_id()). + + Current commands and configuration options + ========================================== +diff --git a/Makefile b/Makefile +index 7337720d6599..e99e5a5d571b 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 4 +-SUBLEVEL = 109 ++SUBLEVEL = 110 + EXTRAVERSION = + NAME = Saber-toothed Squirrel + +diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c +index ad941453340a..7702641520ea 100644 +--- a/arch/arm/net/bpf_jit_32.c ++++ b/arch/arm/net/bpf_jit_32.c +@@ -899,7 +899,7 @@ void bpf_jit_compile(struct sk_filter *fp) + if (ctx.imm_count) + kfree(ctx.imms); + #endif +- bpf_jit_binary_free(header); ++ module_free(NULL, ctx.target); + goto out; + } + build_epilogue(&ctx); +diff --git a/arch/s390/crypto/ghash_s390.c b/arch/s390/crypto/ghash_s390.c +index c2dac2e0e56a..69b5a4b873e2 100644 +--- a/arch/s390/crypto/ghash_s390.c ++++ b/arch/s390/crypto/ghash_s390.c +@@ -115,7 +115,7 @@ static int ghash_final(struct shash_desc *desc, u8 *dst) + struct ghash_desc_ctx *dctx = shash_desc_ctx(desc); + + ghash_flush(dctx); +- memcpy(dst, dtx->icv, GHASH_BLOCK_SIZE); ++ memcpy(dst, dctx->icv, GHASH_BLOCK_SIZE); + + return 0; + } +diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h +index 4f787579b329..d60facb1a9d4 100644 +--- a/arch/x86/include/asm/kvm_host.h ++++ b/arch/x86/include/asm/kvm_host.h +@@ -509,7 +509,7 @@ struct kvm_arch { + struct kvm_pic *vpic; + struct kvm_ioapic *vioapic; + struct kvm_pit *vpit; +- int vapics_in_nmi_mode; ++ atomic_t vapics_in_nmi_mode; + + unsigned int tss_addr; + struct page *apic_access_page; +diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c +index db336f9f2c8c..eaad49aa5bed 100644 +--- a/arch/x86/kvm/i8254.c ++++ b/arch/x86/kvm/i8254.c +@@ -317,7 +317,7 @@ static void pit_do_work(struct work_struct *work) + * LVT0 to NMI delivery. Other PIC interrupts are just sent to + * VCPU0, and only if its LVT0 is in EXTINT mode. + */ +- if (kvm->arch.vapics_in_nmi_mode > 0) ++ if (atomic_read(&kvm->arch.vapics_in_nmi_mode) > 0) + kvm_for_each_vcpu(i, vcpu, kvm) + kvm_apic_nmi_wd_deliver(vcpu); + } +diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c +index 578613da251e..53454a6775bf 100644 +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -761,10 +761,10 @@ static void apic_manage_nmi_watchdog(struct kvm_lapic *apic, u32 lvt0_val) + if (!nmi_wd_enabled) { + apic_debug("Receive NMI setting on APIC_LVT0 " + "for cpu %d\n", apic->vcpu->vcpu_id); +- apic->vcpu->kvm->arch.vapics_in_nmi_mode++; ++ atomic_inc(&apic->vcpu->kvm->arch.vapics_in_nmi_mode); + } + } else if (nmi_wd_enabled) +- apic->vcpu->kvm->arch.vapics_in_nmi_mode--; ++ atomic_dec(&apic->vcpu->kvm->arch.vapics_in_nmi_mode); + } + + static int apic_reg_write(struct kvm_lapic *apic, u32 reg, u32 val) +@@ -1257,6 +1257,7 @@ void kvm_apic_post_state_restore(struct kvm_vcpu *vcpu) + + apic_update_ppr(apic); + hrtimer_cancel(&apic->lapic_timer.timer); ++ apic_manage_nmi_watchdog(apic, apic_get_reg(apic, APIC_LVT0)); + update_divide_count(apic); + start_apic_timer(apic); + apic->irr_pending = true; +diff --git a/arch/x86/pci/acpi.c b/arch/x86/pci/acpi.c +index ed2835e148b5..65cf4f22bd6e 100644 +--- a/arch/x86/pci/acpi.c ++++ b/arch/x86/pci/acpi.c +@@ -70,6 +70,17 @@ static const struct dmi_system_id pci_use_crs_table[] __initconst = { + DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies, LTD"), + }, + }, ++ /* https://bugs.launchpad.net/ubuntu/+source/alsa-driver/+bug/931368 */ ++ /* https://bugs.launchpad.net/ubuntu/+source/alsa-driver/+bug/1033299 */ ++ { ++ .callback = set_use_crs, ++ .ident = "Foxconn K8M890-8237A", ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "Foxconn"), ++ DMI_MATCH(DMI_BOARD_NAME, "K8M890-8237A"), ++ DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies, LTD"), ++ }, ++ }, + + /* Now for the blacklist.. */ + +diff --git a/drivers/acpi/acpica/utxface.c b/drivers/acpi/acpica/utxface.c +index afa94f51ff0b..0985ab722bb9 100644 +--- a/drivers/acpi/acpica/utxface.c ++++ b/drivers/acpi/acpica/utxface.c +@@ -166,10 +166,12 @@ acpi_status acpi_enable_subsystem(u32 flags) + * Obtain a permanent mapping for the FACS. This is required for the + * Global Lock and the Firmware Waking Vector + */ +- status = acpi_tb_initialize_facs(); +- if (ACPI_FAILURE(status)) { +- ACPI_WARNING((AE_INFO, "Could not map the FACS table")); +- return_ACPI_STATUS(status); ++ if (!(flags & ACPI_NO_FACS_INIT)) { ++ status = acpi_tb_initialize_facs(); ++ if (ACPI_FAILURE(status)) { ++ ACPI_WARNING((AE_INFO, "Could not map the FACS table")); ++ return_ACPI_STATUS(status); ++ } + } + #endif /* !ACPI_REDUCED_HARDWARE */ + +diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c +index 8e81f85b1ba0..0ac67aca7905 100644 +--- a/drivers/base/regmap/regmap.c ++++ b/drivers/base/regmap/regmap.c +@@ -784,7 +784,7 @@ int regmap_bulk_read(struct regmap *map, unsigned int reg, void *val, + ret = regmap_read(map, reg + i, &ival); + if (ret != 0) + return ret; +- memcpy(val + (i * val_bytes), &ival, val_bytes); ++ map->format.format_val(val + (i * val_bytes), ival); + } + } + +diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c +index 52be498c2d1c..4b8e03fc3281 100644 +--- a/drivers/bluetooth/ath3k.c ++++ b/drivers/bluetooth/ath3k.c +@@ -104,6 +104,7 @@ static struct usb_device_id ath3k_table[] = { + { USB_DEVICE(0x13d3, 0x3408) }, + { USB_DEVICE(0x13d3, 0x3423) }, + { USB_DEVICE(0x13d3, 0x3432) }, ++ { USB_DEVICE(0x13d3, 0x3474) }, + + /* Atheros AR5BBU12 with sflash firmware */ + { USB_DEVICE(0x0489, 0xE02C) }, +@@ -153,6 +154,7 @@ static struct usb_device_id ath3k_blist_tbl[] = { + { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 }, + + /* Atheros AR5BBU22 with sflash firmware */ + { USB_DEVICE(0x0489, 0xE03C), .driver_info = BTUSB_ATH3012 }, +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index f8a58db55055..bbd1e6c7a4e9 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -182,6 +182,7 @@ static struct usb_device_id blacklist_table[] = { + { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 }, + + /* Atheros AR5BBU12 with sflash firmware */ + { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE }, +diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c +index 7f025fb620de..4e985cd97618 100644 +--- a/drivers/char/agp/intel-gtt.c ++++ b/drivers/char/agp/intel-gtt.c +@@ -1194,7 +1194,7 @@ static inline int needs_idle_maps(void) + /* Query intel_iommu to see if we need the workaround. Presumably that + * was loaded first. + */ +- if ((gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB || ++ if ((gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_D_IG || + gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_M_IG) && + intel_iommu_gfx_mapped) + return 1; +diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c +index 921039e56f87..a759fdcd6f6b 100644 +--- a/drivers/crypto/talitos.c ++++ b/drivers/crypto/talitos.c +@@ -2653,6 +2653,7 @@ static struct talitos_crypto_alg *talitos_alg_alloc(struct device *dev, + break; + default: + dev_err(dev, "unknown algorithm type %d\n", t_alg->algt.type); ++ kfree(t_alg); + return ERR_PTR(-EINVAL); + } + +diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c +index fa5d55fea46c..c8fecbcb892b 100644 +--- a/drivers/dma/mv_xor.c ++++ b/drivers/dma/mv_xor.c +@@ -390,7 +390,8 @@ static void __mv_xor_slot_cleanup(struct mv_xor_chan *mv_chan) + dma_cookie_t cookie = 0; + int busy = mv_chan_is_busy(mv_chan); + u32 current_desc = mv_chan_get_current_desc(mv_chan); +- int seen_current = 0; ++ int current_cleaned = 0; ++ struct mv_xor_desc *hw_desc; + + dev_dbg(mv_chan->device->common.dev, "%s %d\n", __func__, __LINE__); + dev_dbg(mv_chan->device->common.dev, "current_desc %x\n", current_desc); +@@ -402,38 +403,57 @@ static void __mv_xor_slot_cleanup(struct mv_xor_chan *mv_chan) + + list_for_each_entry_safe(iter, _iter, &mv_chan->chain, + chain_node) { +- prefetch(_iter); +- prefetch(&_iter->async_tx); + +- /* do not advance past the current descriptor loaded into the +- * hardware channel, subsequent descriptors are either in +- * process or have not been submitted +- */ +- if (seen_current) +- break; ++ /* clean finished descriptors */ ++ hw_desc = iter->hw_desc; ++ if (hw_desc->status & XOR_DESC_SUCCESS) { ++ cookie = mv_xor_run_tx_complete_actions(iter, mv_chan, ++ cookie); + +- /* stop the search if we reach the current descriptor and the +- * channel is busy +- */ +- if (iter->async_tx.phys == current_desc) { +- seen_current = 1; +- if (busy) ++ /* done processing desc, clean slot */ ++ mv_xor_clean_slot(iter, mv_chan); ++ ++ /* break if we did cleaned the current */ ++ if (iter->async_tx.phys == current_desc) { ++ current_cleaned = 1; ++ break; ++ } ++ } else { ++ if (iter->async_tx.phys == current_desc) { ++ current_cleaned = 0; + break; ++ } + } +- +- cookie = mv_xor_run_tx_complete_actions(iter, mv_chan, cookie); +- +- if (mv_xor_clean_slot(iter, mv_chan)) +- break; + } + + if ((busy == 0) && !list_empty(&mv_chan->chain)) { +- struct mv_xor_desc_slot *chain_head; +- chain_head = list_entry(mv_chan->chain.next, +- struct mv_xor_desc_slot, +- chain_node); +- +- mv_xor_start_new_chain(mv_chan, chain_head); ++ if (current_cleaned) { ++ /* ++ * current descriptor cleaned and removed, run ++ * from list head ++ */ ++ iter = list_entry(mv_chan->chain.next, ++ struct mv_xor_desc_slot, ++ chain_node); ++ mv_xor_start_new_chain(mv_chan, iter); ++ } else { ++ if (!list_is_last(&iter->chain_node, &mv_chan->chain)) { ++ /* ++ * descriptors are still waiting after ++ * current, trigger them ++ */ ++ iter = list_entry(iter->chain_node.next, ++ struct mv_xor_desc_slot, ++ chain_node); ++ mv_xor_start_new_chain(mv_chan, iter); ++ } else { ++ /* ++ * some descriptors are still waiting ++ * to be cleaned ++ */ ++ tasklet_schedule(&mv_chan->irq_tasklet); ++ } ++ } + } + + if (cookie > 0) +diff --git a/drivers/dma/mv_xor.h b/drivers/dma/mv_xor.h +index 654876b7ba1d..0af03772da3b 100644 +--- a/drivers/dma/mv_xor.h ++++ b/drivers/dma/mv_xor.h +@@ -30,6 +30,7 @@ + #define XOR_OPERATION_MODE_XOR 0 + #define XOR_OPERATION_MODE_MEMCPY 2 + #define XOR_OPERATION_MODE_MEMSET 4 ++#define XOR_DESC_SUCCESS 0x40000000 + + #define XOR_CURR_DESC(chan) (chan->mmr_base + 0x210 + (chan->idx * 4)) + #define XOR_NEXT_DESC(chan) (chan->mmr_base + 0x200 + (chan->idx * 4)) +diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c +index e1c744d7370a..b1f1d105e8c7 100644 +--- a/drivers/gpu/drm/i915/i915_gem.c ++++ b/drivers/gpu/drm/i915/i915_gem.c +@@ -1779,6 +1779,9 @@ i915_gem_retire_requests_ring(struct intel_ring_buffer *ring) + uint32_t seqno; + int i; + ++ if (list_empty(&ring->request_list)) ++ return; ++ + WARN_ON(i915_verify_lists(ring->dev)); + + seqno = ring->get_seqno(ring); +diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c +index db4df97b7872..c5fe79e67ed9 100644 +--- a/drivers/gpu/drm/radeon/evergreen.c ++++ b/drivers/gpu/drm/radeon/evergreen.c +@@ -1079,7 +1079,7 @@ int evergreen_pcie_gart_enable(struct radeon_device *rdev) + WREG32(MC_VM_MB_L1_TLB2_CNTL, tmp); + WREG32(MC_VM_MB_L1_TLB3_CNTL, tmp); + WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12); +- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1); ++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12); + WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12); + WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) | + RANGE_PROTECTION_FAULT_ENABLE_DEFAULT); +diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c +index 1f451796407b..461262eee79a 100644 +--- a/drivers/gpu/drm/radeon/ni.c ++++ b/drivers/gpu/drm/radeon/ni.c +@@ -1075,7 +1075,7 @@ int cayman_pcie_gart_enable(struct radeon_device *rdev) + L2_CACHE_BIGK_FRAGMENT_SIZE(6)); + /* setup context0 */ + WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12); +- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1); ++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12); + WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12); + WREG32(VM_CONTEXT0_PROTECTION_FAULT_DEFAULT_ADDR, + (u32)(rdev->dummy_page.addr >> 12)); +diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c +index d441aed782ad..9c7062d970ee 100644 +--- a/drivers/gpu/drm/radeon/r600.c ++++ b/drivers/gpu/drm/radeon/r600.c +@@ -930,7 +930,7 @@ int r600_pcie_gart_enable(struct radeon_device *rdev) + WREG32(MC_VM_L1_TLB_MCB_RD_SEM_CNTL, tmp | ENABLE_SEMAPHORE_MODE); + WREG32(MC_VM_L1_TLB_MCB_WR_SEM_CNTL, tmp | ENABLE_SEMAPHORE_MODE); + WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12); +- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1); ++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12); + WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12); + WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) | + RANGE_PROTECTION_FAULT_ENABLE_DEFAULT); +diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c +index d66d2cdf4f0a..f3ee36036487 100644 +--- a/drivers/gpu/drm/radeon/radeon_cs.c ++++ b/drivers/gpu/drm/radeon/radeon_cs.c +@@ -49,7 +49,7 @@ int radeon_cs_parser_relocs(struct radeon_cs_parser *p) + if (p->relocs_ptr == NULL) { + return -ENOMEM; + } +- p->relocs = drm_calloc_large(p->nrelocs, sizeof(struct radeon_bo_list)); ++ p->relocs = kcalloc(p->nrelocs, sizeof(struct radeon_cs_reloc), GFP_KERNEL); + if (p->relocs == NULL) { + return -ENOMEM; + } +@@ -324,7 +324,7 @@ static void radeon_cs_parser_fini(struct radeon_cs_parser *parser, int error) + } + } + kfree(parser->track); +- drm_free_large(parser->relocs); ++ kfree(parser->relocs); + kfree(parser->relocs_ptr); + for (i = 0; i < parser->nchunks; i++) { + kfree(parser->chunks[i].kdata); +diff --git a/drivers/gpu/drm/radeon/radeon_irq_kms.c b/drivers/gpu/drm/radeon/radeon_irq_kms.c +index 645dcbf6490b..77c456d624bf 100644 +--- a/drivers/gpu/drm/radeon/radeon_irq_kms.c ++++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c +@@ -51,10 +51,12 @@ static void radeon_hotplug_work_func(struct work_struct *work) + struct drm_mode_config *mode_config = &dev->mode_config; + struct drm_connector *connector; + ++ mutex_lock(&mode_config->mutex); + if (mode_config->num_connector) { + list_for_each_entry(connector, &mode_config->connector_list, head) + radeon_connector_hotplug(connector); + } ++ mutex_unlock(&mode_config->mutex); + /* Just fire off a uevent and let userspace tell us what to do */ + drm_helper_hpd_irq_event(dev); + } +diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c +index 3358730be78b..1ec1255520ad 100644 +--- a/drivers/gpu/drm/radeon/rv770.c ++++ b/drivers/gpu/drm/radeon/rv770.c +@@ -158,7 +158,7 @@ int rv770_pcie_gart_enable(struct radeon_device *rdev) + WREG32(MC_VM_MB_L1_TLB2_CNTL, tmp); + WREG32(MC_VM_MB_L1_TLB3_CNTL, tmp); + WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12); +- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1); ++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12); + WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12); + WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) | + RANGE_PROTECTION_FAULT_ENABLE_DEFAULT); +diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c +index 3b6e641decd0..6609a23983d0 100644 +--- a/drivers/gpu/drm/radeon/si.c ++++ b/drivers/gpu/drm/radeon/si.c +@@ -2537,7 +2537,7 @@ int si_pcie_gart_enable(struct radeon_device *rdev) + L2_CACHE_BIGK_FRAGMENT_SIZE(0)); + /* setup context0 */ + WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12); +- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1); ++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12); + WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12); + WREG32(VM_CONTEXT0_PROTECTION_FAULT_DEFAULT_ADDR, + (u32)(rdev->dummy_page.addr >> 12)); +diff --git a/drivers/infiniband/hw/qib/qib.h b/drivers/infiniband/hw/qib/qib.h +index c7d4ef18cd40..dcff64f6ced2 100644 +--- a/drivers/infiniband/hw/qib/qib.h ++++ b/drivers/infiniband/hw/qib/qib.h +@@ -1429,6 +1429,10 @@ extern struct mutex qib_mutex; + qib_get_unit_name((dd)->unit), ##__VA_ARGS__); \ + } while (0) + ++#define qib_dev_warn(dd, fmt, ...) \ ++ dev_warn(&(dd)->pcidev->dev, "%s: " fmt, \ ++ qib_get_unit_name((dd)->unit), ##__VA_ARGS__) ++ + #define qib_dev_porterr(dd, port, fmt, ...) \ + do { \ + dev_err(&(dd)->pcidev->dev, "%s: IB%u:%u " fmt, \ +diff --git a/drivers/infiniband/hw/qib/qib_keys.c b/drivers/infiniband/hw/qib/qib_keys.c +index 8fd19a47df0c..ca6e6cfd7b8f 100644 +--- a/drivers/infiniband/hw/qib/qib_keys.c ++++ b/drivers/infiniband/hw/qib/qib_keys.c +@@ -69,6 +69,10 @@ int qib_alloc_lkey(struct qib_lkey_table *rkt, struct qib_mregion *mr) + * unrestricted LKEY. + */ + rkt->gen++; ++ /* ++ * bits are capped in qib_verbs.c to insure enough bits ++ * for generation number ++ */ + mr->lkey = (r << (32 - ib_qib_lkey_table_size)) | + ((((1 << (24 - ib_qib_lkey_table_size)) - 1) & rkt->gen) + << 8); +diff --git a/drivers/infiniband/hw/qib/qib_verbs.c b/drivers/infiniband/hw/qib/qib_verbs.c +index 7b6c3bffa9d9..395d9d619af3 100644 +--- a/drivers/infiniband/hw/qib/qib_verbs.c ++++ b/drivers/infiniband/hw/qib/qib_verbs.c +@@ -40,6 +40,7 @@ + #include + #include + #include ++#include + + #include "qib.h" + #include "qib_common.h" +@@ -2058,10 +2059,16 @@ int qib_register_ib_device(struct qib_devdata *dd) + * the LKEY). The remaining bits act as a generation number or tag. + */ + spin_lock_init(&dev->lk_table.lock); ++ /* insure generation is at least 4 bits see keys.c */ ++ if (ib_qib_lkey_table_size > MAX_LKEY_TABLE_BITS) { ++ qib_dev_warn(dd, "lkey bits %u too large, reduced to %u\n", ++ ib_qib_lkey_table_size, MAX_LKEY_TABLE_BITS); ++ ib_qib_lkey_table_size = MAX_LKEY_TABLE_BITS; ++ } + dev->lk_table.max = 1 << ib_qib_lkey_table_size; + lk_tab_size = dev->lk_table.max * sizeof(*dev->lk_table.table); + dev->lk_table.table = (struct qib_mregion **) +- __get_free_pages(GFP_KERNEL, get_order(lk_tab_size)); ++ vmalloc(lk_tab_size); + if (dev->lk_table.table == NULL) { + ret = -ENOMEM; + goto err_lk; +@@ -2231,7 +2238,7 @@ err_tx: + sizeof(struct qib_pio_header), + dev->pio_hdrs, dev->pio_hdrs_phys); + err_hdrs: +- free_pages((unsigned long) dev->lk_table.table, get_order(lk_tab_size)); ++ vfree(dev->lk_table.table); + err_lk: + kfree(dev->qp_table); + err_qpt: +@@ -2285,7 +2292,6 @@ void qib_unregister_ib_device(struct qib_devdata *dd) + sizeof(struct qib_pio_header), + dev->pio_hdrs, dev->pio_hdrs_phys); + lk_tab_size = dev->lk_table.max * sizeof(*dev->lk_table.table); +- free_pages((unsigned long) dev->lk_table.table, +- get_order(lk_tab_size)); ++ vfree(dev->lk_table.table); + kfree(dev->qp_table); + } +diff --git a/drivers/infiniband/hw/qib/qib_verbs.h b/drivers/infiniband/hw/qib/qib_verbs.h +index 0c19ef0c4123..66f7f62388b0 100644 +--- a/drivers/infiniband/hw/qib/qib_verbs.h ++++ b/drivers/infiniband/hw/qib/qib_verbs.h +@@ -622,6 +622,8 @@ struct qib_qpn_table { + struct qpn_map map[QPNMAP_ENTRIES]; + }; + ++#define MAX_LKEY_TABLE_BITS 23 ++ + struct qib_lkey_table { + spinlock_t lock; /* protect changes in this struct */ + u32 next; /* next unused index (speeds search) */ +diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c +index c32a9093159a..47a789ea26bc 100644 +--- a/drivers/mmc/card/block.c ++++ b/drivers/mmc/card/block.c +@@ -1372,9 +1372,11 @@ static int mmc_blk_issue_rw_rq(struct mmc_queue *mq, struct request *rqc) + break; + case MMC_BLK_CMD_ERR: + ret = mmc_blk_cmd_err(md, card, brq, req, ret); +- if (!mmc_blk_reset(md, card->host, type)) +- break; +- goto cmd_abort; ++ if (mmc_blk_reset(md, card->host, type)) ++ goto cmd_abort; ++ if (!ret) ++ goto start_new_req; ++ break; + case MMC_BLK_RETRY: + if (retry++ < 5) + break; +diff --git a/drivers/mtd/maps/dc21285.c b/drivers/mtd/maps/dc21285.c +index 080f06053bd4..86598a1d8bde 100644 +--- a/drivers/mtd/maps/dc21285.c ++++ b/drivers/mtd/maps/dc21285.c +@@ -38,9 +38,9 @@ static void nw_en_write(void) + * we want to write a bit pattern XXX1 to Xilinx to enable + * the write gate, which will be open for about the next 2ms. + */ +- spin_lock_irqsave(&nw_gpio_lock, flags); ++ raw_spin_lock_irqsave(&nw_gpio_lock, flags); + nw_cpld_modify(CPLD_FLASH_WR_ENABLE, CPLD_FLASH_WR_ENABLE); +- spin_unlock_irqrestore(&nw_gpio_lock, flags); ++ raw_spin_unlock_irqrestore(&nw_gpio_lock, flags); + + /* + * let the ISA bus to catch on... +diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c +index f1f06715d4e0..1917f7d21c88 100644 +--- a/drivers/mtd/mtd_blkdevs.c ++++ b/drivers/mtd/mtd_blkdevs.c +@@ -214,6 +214,7 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode) + return -ERESTARTSYS; /* FIXME: busy loop! -arnd*/ + + mutex_lock(&dev->lock); ++ mutex_lock(&mtd_table_mutex); + + if (dev->open) + goto unlock; +@@ -237,6 +238,7 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode) + + unlock: + dev->open++; ++ mutex_unlock(&mtd_table_mutex); + mutex_unlock(&dev->lock); + blktrans_dev_put(dev); + return ret; +@@ -247,6 +249,7 @@ error_release: + error_put: + module_put(dev->tr->owner); + kref_put(&dev->ref, blktrans_dev_release); ++ mutex_unlock(&mtd_table_mutex); + mutex_unlock(&dev->lock); + blktrans_dev_put(dev); + return ret; +@@ -261,6 +264,7 @@ static int blktrans_release(struct gendisk *disk, fmode_t mode) + return ret; + + mutex_lock(&dev->lock); ++ mutex_lock(&mtd_table_mutex); + + if (--dev->open) + goto unlock; +@@ -273,6 +277,7 @@ static int blktrans_release(struct gendisk *disk, fmode_t mode) + __put_mtd_device(dev->mtd); + } + unlock: ++ mutex_unlock(&mtd_table_mutex); + mutex_unlock(&dev->lock); + blktrans_dev_put(dev); + return ret; +diff --git a/drivers/net/ethernet/stmicro/stmmac/descs.h b/drivers/net/ethernet/stmicro/stmmac/descs.h +index 9820ec842cc0..e93a0bf128be 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/descs.h ++++ b/drivers/net/ethernet/stmicro/stmmac/descs.h +@@ -153,6 +153,8 @@ struct dma_desc { + u32 buffer2_size:13; + u32 reserved4:3; + } etx; /* -- enhanced -- */ ++ ++ u64 all_flags; + } des01; + unsigned int des2; + unsigned int des3; +diff --git a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c +index ad1b627f8ec2..e0db6f66e92e 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c ++++ b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c +@@ -232,6 +232,7 @@ static void enh_desc_init_rx_desc(struct dma_desc *p, unsigned int ring_size, + { + int i; + for (i = 0; i < ring_size; i++) { ++ p->des01.all_flags = 0; + p->des01.erx.own = 1; + p->des01.erx.buffer1_size = BUF_SIZE_8KiB - 1; + +@@ -248,7 +249,7 @@ static void enh_desc_init_tx_desc(struct dma_desc *p, unsigned int ring_size) + int i; + + for (i = 0; i < ring_size; i++) { +- p->des01.etx.own = 0; ++ p->des01.all_flags = 0; + ehn_desc_tx_set_on_ring_chain(p, (i == ring_size - 1)); + p++; + } +@@ -271,6 +272,7 @@ static void enh_desc_set_tx_owner(struct dma_desc *p) + + static void enh_desc_set_rx_owner(struct dma_desc *p) + { ++ p->des01.all_flags = 0; + p->des01.erx.own = 1; + } + +diff --git a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c +index 25953bb45a73..9703340c3115 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c ++++ b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c +@@ -126,6 +126,7 @@ static void ndesc_init_rx_desc(struct dma_desc *p, unsigned int ring_size, + { + int i; + for (i = 0; i < ring_size; i++) { ++ p->des01.all_flags = 0; + p->des01.rx.own = 1; + p->des01.rx.buffer1_size = BUF_SIZE_2KiB - 1; + +@@ -141,7 +142,7 @@ static void ndesc_init_tx_desc(struct dma_desc *p, unsigned int ring_size) + { + int i; + for (i = 0; i < ring_size; i++) { +- p->des01.tx.own = 0; ++ p->des01.all_flags = 0; + ndesc_tx_set_on_ring_chain(p, (i == (ring_size - 1))); + p++; + } +@@ -164,6 +165,7 @@ static void ndesc_set_tx_owner(struct dma_desc *p) + + static void ndesc_set_rx_owner(struct dma_desc *p) + { ++ p->des01.all_flags = 0; + p->des01.rx.own = 1; + } + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 9bdfaba4e308..88c8645e2f52 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -424,19 +424,17 @@ static void init_dma_desc_rings(struct net_device *dev) + priv->rx_skbuff = + kmalloc(sizeof(struct sk_buff *) * rxsize, GFP_KERNEL); + priv->dma_rx = +- (struct dma_desc *)dma_alloc_coherent(priv->device, +- rxsize * +- sizeof(struct dma_desc), +- &priv->dma_rx_phy, +- GFP_KERNEL); ++ (struct dma_desc *)dma_zalloc_coherent(priv->device, rxsize * ++ sizeof(struct dma_desc), ++ &priv->dma_rx_phy, ++ GFP_KERNEL); + priv->tx_skbuff = kmalloc(sizeof(struct sk_buff *) * txsize, + GFP_KERNEL); + priv->dma_tx = +- (struct dma_desc *)dma_alloc_coherent(priv->device, +- txsize * +- sizeof(struct dma_desc), +- &priv->dma_tx_phy, +- GFP_KERNEL); ++ (struct dma_desc *)dma_zalloc_coherent(priv->device, txsize * ++ sizeof(struct dma_desc), ++ &priv->dma_tx_phy, ++ GFP_KERNEL); + + if ((priv->dma_rx == NULL) || (priv->dma_tx == NULL)) { + pr_err("%s:ERROR allocating the DMA Tx/Rx desc\n", __func__); +diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c +index ef2605683de7..7e7bd1570526 100644 +--- a/drivers/net/wireless/ath/ath9k/main.c ++++ b/drivers/net/wireless/ath/ath9k/main.c +@@ -235,7 +235,7 @@ static bool ath_prepare_reset(struct ath_softc *sc, bool retry_tx, bool flush) + { + struct ath_hw *ah = sc->sc_ah; + struct ath_common *common = ath9k_hw_common(ah); +- bool ret; ++ bool ret = true; + + ieee80211_stop_queues(sc->hw); + +@@ -245,10 +245,13 @@ static bool ath_prepare_reset(struct ath_softc *sc, bool retry_tx, bool flush) + ath9k_debug_samp_bb_mac(sc); + ath9k_hw_disable_interrupts(ah); + +- ret = ath_drain_all_txq(sc, retry_tx); +- +- if (!ath_stoprecv(sc)) +- ret = false; ++ if (AR_SREV_9300_20_OR_LATER(ah)) { ++ ret &= ath_stoprecv(sc); ++ ret &= ath_drain_all_txq(sc, retry_tx); ++ } else { ++ ret &= ath_drain_all_txq(sc, retry_tx); ++ ret &= ath_stoprecv(sc); ++ } + + if (!flush) { + if (ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) +diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c +index d66e2980bc27..414ac49af480 100644 +--- a/drivers/net/wireless/rndis_wlan.c ++++ b/drivers/net/wireless/rndis_wlan.c +@@ -407,9 +407,9 @@ struct ndis_80211_pmkid { + #define CAP_MODE_80211G 4 + #define CAP_MODE_MASK 7 + +-#define WORK_LINK_UP (1<<0) +-#define WORK_LINK_DOWN (1<<1) +-#define WORK_SET_MULTICAST_LIST (1<<2) ++#define WORK_LINK_UP 0 ++#define WORK_LINK_DOWN 1 ++#define WORK_SET_MULTICAST_LIST 2 + + #define RNDIS_WLAN_ALG_NONE 0 + #define RNDIS_WLAN_ALG_WEP (1<<0) +diff --git a/drivers/pcmcia/topic.h b/drivers/pcmcia/topic.h +index 615a45a8fe86..582688fe7505 100644 +--- a/drivers/pcmcia/topic.h ++++ b/drivers/pcmcia/topic.h +@@ -104,6 +104,9 @@ + #define TOPIC_EXCA_IF_CONTROL 0x3e /* 8 bit */ + #define TOPIC_EXCA_IFC_33V_ENA 0x01 + ++#define TOPIC_PCI_CFG_PPBCN 0x3e /* 16-bit */ ++#define TOPIC_PCI_CFG_PPBCN_WBEN 0x0400 ++ + static void topic97_zoom_video(struct pcmcia_socket *sock, int onoff) + { + struct yenta_socket *socket = container_of(sock, struct yenta_socket, socket); +@@ -138,6 +141,7 @@ static int topic97_override(struct yenta_socket *socket) + static int topic95_override(struct yenta_socket *socket) + { + u8 fctrl; ++ u16 ppbcn; + + /* enable 3.3V support for 16bit cards */ + fctrl = exca_readb(socket, TOPIC_EXCA_IF_CONTROL); +@@ -146,6 +150,18 @@ static int topic95_override(struct yenta_socket *socket) + /* tell yenta to use exca registers to power 16bit cards */ + socket->flags |= YENTA_16BIT_POWER_EXCA | YENTA_16BIT_POWER_DF; + ++ /* Disable write buffers to prevent lockups under load with numerous ++ Cardbus cards, observed on Tecra 500CDT and reported elsewhere on the ++ net. This is not a power-on default according to the datasheet ++ but some BIOSes seem to set it. */ ++ if (pci_read_config_word(socket->dev, TOPIC_PCI_CFG_PPBCN, &ppbcn) == 0 ++ && socket->dev->revision <= 7 ++ && (ppbcn & TOPIC_PCI_CFG_PPBCN_WBEN)) { ++ ppbcn &= ~TOPIC_PCI_CFG_PPBCN_WBEN; ++ pci_write_config_word(socket->dev, TOPIC_PCI_CFG_PPBCN, ppbcn); ++ dev_info(&socket->dev->dev, "Disabled ToPIC95 Cardbus write buffers.\n"); ++ } ++ + return 0; + } + +diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c +index e6c08ee8d46c..3d6759179f1c 100644 +--- a/drivers/platform/x86/dell-laptop.c ++++ b/drivers/platform/x86/dell-laptop.c +@@ -216,7 +216,6 @@ static struct dmi_system_id __devinitdata dell_quirks[] = { + }; + + static struct calling_interface_buffer *buffer; +-static struct page *bufferpage; + static DEFINE_MUTEX(buffer_mutex); + + static int hwswitch_state; +@@ -714,11 +713,10 @@ static int __init dell_init(void) + * Allocate buffer below 4GB for SMI data--only 32-bit physical addr + * is passed to SMI handler. + */ +- bufferpage = alloc_page(GFP_KERNEL | GFP_DMA32); ++ buffer = (void *)__get_free_page(GFP_KERNEL | GFP_DMA32); + +- if (!bufferpage) ++ if (!buffer) + goto fail_buffer; +- buffer = page_address(bufferpage); + + ret = dell_setup_rfkill(); + +@@ -787,7 +785,7 @@ fail_backlight: + fail_filter: + dell_cleanup_rfkill(); + fail_rfkill: +- free_page((unsigned long)bufferpage); ++ free_page((unsigned long)buffer); + fail_buffer: + platform_device_del(platform_device); + fail_platform_device2: +diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c +index ac902f7a9baa..34e9fcfc63d6 100644 +--- a/drivers/platform/x86/ideapad-laptop.c ++++ b/drivers/platform/x86/ideapad-laptop.c +@@ -407,7 +407,8 @@ const struct ideapad_rfk_data ideapad_rfk_data[] = { + + static int ideapad_rfk_set(void *data, bool blocked) + { +- unsigned long opcode = (unsigned long)data; ++ unsigned long dev = (unsigned long)data; ++ int opcode = ideapad_rfk_data[dev].opcode; + + return write_ec_cmd(ideapad_handle, opcode, !blocked); + } +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index 0d71557cf7a3..c8f160db9d0e 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -749,7 +749,7 @@ static int suspend_prepare(struct regulator_dev *rdev, suspend_state_t state) + static void print_constraints(struct regulator_dev *rdev) + { + struct regulation_constraints *constraints = rdev->constraints; +- char buf[80] = ""; ++ char buf[160] = ""; + int count = 0; + int ret; + +diff --git a/drivers/scsi/ipr.h b/drivers/scsi/ipr.h +index 153b8bd91d1e..19ff8b2bbf36 100644 +--- a/drivers/scsi/ipr.h ++++ b/drivers/scsi/ipr.h +@@ -251,7 +251,7 @@ + #define IPR_RUNTIME_RESET 0x40000000 + + #define IPR_IPL_INIT_MIN_STAGE_TIME 5 +-#define IPR_IPL_INIT_DEFAULT_STAGE_TIME 15 ++#define IPR_IPL_INIT_DEFAULT_STAGE_TIME 30 + #define IPR_IPL_INIT_STAGE_UNKNOWN 0x0 + #define IPR_IPL_INIT_STAGE_TRANSOP 0xB0000000 + #define IPR_IPL_INIT_STAGE_MASK 0xff000000 +diff --git a/drivers/staging/rtl8712/rtl8712_recv.c b/drivers/staging/rtl8712/rtl8712_recv.c +index 887a80709ab8..549b8ab24d0f 100644 +--- a/drivers/staging/rtl8712/rtl8712_recv.c ++++ b/drivers/staging/rtl8712/rtl8712_recv.c +@@ -1074,7 +1074,8 @@ static int recvbuf2recvframe(struct _adapter *padapter, struct sk_buff *pskb) + /* for first fragment packet, driver need allocate 1536 + + * drvinfo_sz + RXDESC_SIZE to defrag packet. */ + if ((mf == 1) && (frag == 0)) +- alloc_sz = 1658;/*1658+6=1664, 1664 is 128 alignment.*/ ++ /*1658+6=1664, 1664 is 128 alignment.*/ ++ alloc_sz = max_t(u16, tmp_len, 1658); + else + alloc_sz = tmp_len; + /* 2 is for IP header 4 bytes alignment in QoS packet case. +diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c +index ff58d288c9c8..85c28e325c95 100644 +--- a/drivers/tty/serial/atmel_serial.c ++++ b/drivers/tty/serial/atmel_serial.c +@@ -229,8 +229,7 @@ void atmel_config_rs485(struct uart_port *port, struct serial_rs485 *rs485conf) + if (rs485conf->flags & SER_RS485_ENABLED) { + dev_dbg(port->dev, "Setting UART to RS485\n"); + atmel_port->tx_done_mask = ATMEL_US_TXEMPTY; +- if ((rs485conf->delay_rts_after_send) > 0) +- UART_PUT_TTGR(port, rs485conf->delay_rts_after_send); ++ UART_PUT_TTGR(port, rs485conf->delay_rts_after_send); + mode |= ATMEL_US_USMODE_RS485; + } else { + dev_dbg(port->dev, "Setting UART to RS232\n"); +@@ -305,9 +304,7 @@ static void atmel_set_mctrl(struct uart_port *port, u_int mctrl) + + if (atmel_port->rs485.flags & SER_RS485_ENABLED) { + dev_dbg(port->dev, "Setting UART to RS485\n"); +- if ((atmel_port->rs485.delay_rts_after_send) > 0) +- UART_PUT_TTGR(port, +- atmel_port->rs485.delay_rts_after_send); ++ UART_PUT_TTGR(port, atmel_port->rs485.delay_rts_after_send); + mode |= ATMEL_US_USMODE_RS485; + } else { + dev_dbg(port->dev, "Setting UART to RS232\n"); +@@ -1239,9 +1236,7 @@ static void atmel_set_termios(struct uart_port *port, struct ktermios *termios, + + if (atmel_port->rs485.flags & SER_RS485_ENABLED) { + dev_dbg(port->dev, "Setting UART to RS485\n"); +- if ((atmel_port->rs485.delay_rts_after_send) > 0) +- UART_PUT_TTGR(port, +- atmel_port->rs485.delay_rts_after_send); ++ UART_PUT_TTGR(port, atmel_port->rs485.delay_rts_after_send); + mode |= ATMEL_US_USMODE_RS485; + } else { + dev_dbg(port->dev, "Setting UART to RS232\n"); +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index 93f2538b16cc..62ea924dee1c 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -2176,9 +2176,6 @@ static unsigned hub_is_wusb(struct usb_hub *hub) + #define HUB_LONG_RESET_TIME 200 + #define HUB_RESET_TIMEOUT 800 + +-static int hub_port_reset(struct usb_hub *hub, int port1, +- struct usb_device *udev, unsigned int delay, bool warm); +- + /* Is a USB 3.0 port in the Inactive or Complinance Mode state? + * Port worm reset is required to recover + */ +@@ -2258,44 +2255,6 @@ delay: + return -EBUSY; + } + +-static void hub_port_finish_reset(struct usb_hub *hub, int port1, +- struct usb_device *udev, int *status) +-{ +- switch (*status) { +- case 0: +- /* TRSTRCY = 10 ms; plus some extra */ +- msleep(10 + 40); +- if (udev) { +- struct usb_hcd *hcd = bus_to_hcd(udev->bus); +- +- update_devnum(udev, 0); +- /* The xHC may think the device is already reset, +- * so ignore the status. +- */ +- if (hcd->driver->reset_device) +- hcd->driver->reset_device(hcd, udev); +- } +- /* FALL THROUGH */ +- case -ENOTCONN: +- case -ENODEV: +- clear_port_feature(hub->hdev, +- port1, USB_PORT_FEAT_C_RESET); +- if (hub_is_superspeed(hub->hdev)) { +- clear_port_feature(hub->hdev, port1, +- USB_PORT_FEAT_C_BH_PORT_RESET); +- clear_port_feature(hub->hdev, port1, +- USB_PORT_FEAT_C_PORT_LINK_STATE); +- clear_port_feature(hub->hdev, port1, +- USB_PORT_FEAT_C_CONNECTION); +- } +- if (udev) +- usb_set_device_state(udev, *status +- ? USB_STATE_NOTATTACHED +- : USB_STATE_DEFAULT); +- break; +- } +-} +- + /* Handle port reset and port warm(BH) reset (for USB3 protocol ports) */ + static int hub_port_reset(struct usb_hub *hub, int port1, + struct usb_device *udev, unsigned int delay, bool warm) +@@ -2318,13 +2277,9 @@ static int hub_port_reset(struct usb_hub *hub, int port1, + * If the caller hasn't explicitly requested a warm reset, + * double check and see if one is needed. + */ +- status = hub_port_status(hub, port1, +- &portstatus, &portchange); +- if (status < 0) +- goto done; +- +- if (hub_port_warm_reset_required(hub, portstatus)) +- warm = true; ++ if (hub_port_status(hub, port1, &portstatus, &portchange) == 0) ++ if (hub_port_warm_reset_required(hub, portstatus)) ++ warm = true; + } + + /* Reset the port */ +@@ -2347,11 +2302,19 @@ static int hub_port_reset(struct usb_hub *hub, int port1, + + /* Check for disconnect or reset */ + if (status == 0 || status == -ENOTCONN || status == -ENODEV) { +- hub_port_finish_reset(hub, port1, udev, &status); ++ clear_port_feature(hub->hdev, port1, ++ USB_PORT_FEAT_C_RESET); + + if (!hub_is_superspeed(hub->hdev)) + goto done; + ++ clear_port_feature(hub->hdev, port1, ++ USB_PORT_FEAT_C_BH_PORT_RESET); ++ clear_port_feature(hub->hdev, port1, ++ USB_PORT_FEAT_C_PORT_LINK_STATE); ++ clear_port_feature(hub->hdev, port1, ++ USB_PORT_FEAT_C_CONNECTION); ++ + /* + * If a USB 3.0 device migrates from reset to an error + * state, re-issue the warm reset. +@@ -2385,6 +2348,26 @@ static int hub_port_reset(struct usb_hub *hub, int port1, + port1); + + done: ++ if (status == 0) { ++ /* TRSTRCY = 10 ms; plus some extra */ ++ msleep(10 + 40); ++ if (udev) { ++ struct usb_hcd *hcd = bus_to_hcd(udev->bus); ++ ++ update_devnum(udev, 0); ++ /* The xHC may think the device is already reset, ++ * so ignore the status. ++ */ ++ if (hcd->driver->reset_device) ++ hcd->driver->reset_device(hcd, udev); ++ ++ usb_set_device_state(udev, USB_STATE_DEFAULT); ++ } ++ } else { ++ if (udev) ++ usb_set_device_state(udev, USB_STATE_NOTATTACHED); ++ } ++ + if (!hub_is_superspeed(hub->hdev)) + up_read(&ehci_cf_port_reset_rwsem); + +diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c +index 8a7a8ee176fa..a8714fd5ffe2 100644 +--- a/drivers/usb/dwc3/ep0.c ++++ b/drivers/usb/dwc3/ep0.c +@@ -644,6 +644,10 @@ static void dwc3_ep0_xfer_complete(struct dwc3 *dwc, + dev_vdbg(dwc->dev, "Status Phase\n"); + dwc3_ep0_complete_req(dwc, event); + break; ++ case USB_REQ_SET_INTERFACE: ++ dev_vdbg(dwc->dev, "USB_REQ_SET_INTERFACE\n"); ++ dwc->start_config_issued = false; ++ /* Fall through */ + default: + WARN(true, "UNKNOWN ep0state %d\n", dwc->ep0state); + } +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index b7f89268c0f4..b43c6f90b25f 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -301,6 +301,8 @@ int dwc3_send_gadget_ep_cmd(struct dwc3 *dwc, unsigned ep, + if (!(reg & DWC3_DEPCMD_CMDACT)) { + dev_vdbg(dwc->dev, "Command Complete --> %d\n", + DWC3_DEPCMD_STATUS(reg)); ++ if (DWC3_DEPCMD_STATUS(reg)) ++ return -EINVAL; + return 0; + } + +diff --git a/drivers/watchdog/omap_wdt.c b/drivers/watchdog/omap_wdt.c +index 8285d65cd207..c080be52f4e9 100644 +--- a/drivers/watchdog/omap_wdt.c ++++ b/drivers/watchdog/omap_wdt.c +@@ -152,6 +152,13 @@ static int omap_wdt_open(struct inode *inode, struct file *file) + + pm_runtime_get_sync(wdev->dev); + ++ /* ++ * Make sure the watchdog is disabled. This is unfortunately required ++ * because writing to various registers with the watchdog running has no ++ * effect. ++ */ ++ omap_wdt_disable(wdev); ++ + /* initialize prescaler */ + while (__raw_readl(base + OMAP_WATCHDOG_WPS) & 0x01) + cpu_relax(); +diff --git a/fs/dcache.c b/fs/dcache.c +index d071ea768057..03eb2c2a7e5b 100644 +--- a/fs/dcache.c ++++ b/fs/dcache.c +@@ -2518,6 +2518,8 @@ static int prepend_path(const struct path *path, + struct dentry *dentry = path->dentry; + struct vfsmount *vfsmnt = path->mnt; + struct mount *mnt = real_mount(vfsmnt); ++ char *orig_buffer = *buffer; ++ int orig_len = *buflen; + bool slash = false; + int error = 0; + +@@ -2525,6 +2527,14 @@ static int prepend_path(const struct path *path, + struct dentry * parent; + + if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) { ++ /* Escaped? */ ++ if (dentry != vfsmnt->mnt_root) { ++ *buffer = orig_buffer; ++ *buflen = orig_len; ++ slash = false; ++ error = 3; ++ goto global_root; ++ } + /* Global root? */ + if (!mnt_has_parent(mnt)) + goto global_root; +diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c +index 6dc6153dc462..f819837aa193 100644 +--- a/fs/ext4/indirect.c ++++ b/fs/ext4/indirect.c +@@ -705,7 +705,7 @@ int ext4_ind_map_blocks(handle_t *handle, struct inode *inode, + EXT4_FEATURE_RO_COMPAT_BIGALLOC)) { + EXT4_ERROR_INODE(inode, "Can't allocate blocks for " + "non-extent mapped inodes with bigalloc"); +- return -ENOSPC; ++ return -EUCLEAN; + } + + goal = ext4_find_goal(inode, map->m_lblk, partial); +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index 9e9db425c613..facf1cf46eee 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -1848,18 +1848,32 @@ static int __ext4_journalled_writepage(struct page *page, + page_bufs = page_buffers(page); + BUG_ON(!page_bufs); + walk_page_buffers(handle, page_bufs, 0, len, NULL, bget_one); +- /* As soon as we unlock the page, it can go away, but we have +- * references to buffers so we are safe */ ++ /* ++ * We need to release the page lock before we start the ++ * journal, so grab a reference so the page won't disappear ++ * out from under us. ++ */ ++ get_page(page); + unlock_page(page); + + handle = ext4_journal_start(inode, ext4_writepage_trans_blocks(inode)); + if (IS_ERR(handle)) { + ret = PTR_ERR(handle); +- goto out; ++ put_page(page); ++ goto out_no_pagelock; + } + + BUG_ON(!ext4_handle_valid(handle)); + ++ lock_page(page); ++ put_page(page); ++ if (page->mapping != mapping) { ++ /* The page got truncated from under us */ ++ ext4_journal_stop(handle); ++ ret = 0; ++ goto out; ++ } ++ + ret = walk_page_buffers(handle, page_bufs, 0, len, NULL, + do_journal_get_write_access); + +@@ -1875,6 +1889,8 @@ static int __ext4_journalled_writepage(struct page *page, + walk_page_buffers(handle, page_bufs, 0, len, NULL, bput_one); + ext4_set_inode_state(inode, EXT4_STATE_JDATA); + out: ++ unlock_page(page); ++out_no_pagelock: + return ret; + } + +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 92ea560efcc7..2e26a542c818 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -888,6 +888,7 @@ static void ext4_put_super(struct super_block *sb) + dump_orphan_list(sb, sbi); + J_ASSERT(list_empty(&sbi->s_orphan)); + ++ sync_blockdev(sb->s_bdev); + invalidate_bdev(sb->s_bdev); + if (sbi->journal_bdev && sbi->journal_bdev != sb->s_bdev) { + /* +diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c +index a5c8b343a156..d8bc0a881f9f 100644 +--- a/fs/fuse/inode.c ++++ b/fs/fuse/inode.c +@@ -981,6 +981,7 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent) + goto err_fput; + + fuse_conn_init(fc); ++ fc->release = fuse_free_conn; + + fc->dev = sb->s_dev; + fc->sb = sb; +@@ -995,7 +996,6 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent) + fc->dont_mask = 1; + sb->s_flags |= MS_POSIXACL; + +- fc->release = fuse_free_conn; + fc->flags = d.flags; + fc->user_id = d.user_id; + fc->group_id = d.group_id; +diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c +index c78841ee81cf..4fd78565988d 100644 +--- a/fs/jbd2/checkpoint.c ++++ b/fs/jbd2/checkpoint.c +@@ -440,7 +440,7 @@ int jbd2_cleanup_journal_tail(journal_t *journal) + unsigned long blocknr; + + if (is_journal_aborted(journal)) +- return 1; ++ return -EIO; + + if (!jbd2_journal_get_log_tail(journal, &first_tid, &blocknr)) + return 1; +@@ -455,10 +455,9 @@ int jbd2_cleanup_journal_tail(journal_t *journal) + * jbd2_cleanup_journal_tail() doesn't get called all that often. + */ + if (journal->j_flags & JBD2_BARRIER) +- blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL); ++ blkdev_issue_flush(journal->j_fs_dev, GFP_NOFS, NULL); + +- __jbd2_update_log_tail(journal, first_tid, blocknr); +- return 0; ++ return __jbd2_update_log_tail(journal, first_tid, blocknr); + } + + +@@ -468,14 +467,14 @@ int jbd2_cleanup_journal_tail(journal_t *journal) + * journal_clean_one_cp_list + * + * Find all the written-back checkpoint buffers in the given list and +- * release them. ++ * release them. If 'destroy' is set, clean all buffers unconditionally. + * + * Called with the journal locked. + * Called with j_list_lock held. + * Returns number of buffers reaped (for debug) + */ + +-static int journal_clean_one_cp_list(struct journal_head *jh, int *released) ++static int journal_clean_one_cp_list(struct journal_head *jh, int *released, bool destroy) + { + struct journal_head *last_jh; + struct journal_head *next_jh = jh; +@@ -489,7 +488,10 @@ static int journal_clean_one_cp_list(struct journal_head *jh, int *released) + do { + jh = next_jh; + next_jh = jh->b_cpnext; +- ret = __try_to_free_cp_buf(jh); ++ if (!destroy) ++ ret = __try_to_free_cp_buf(jh); ++ else ++ ret = __jbd2_journal_remove_checkpoint(jh) + 1; + if (ret) { + freed++; + if (ret == 2) { +@@ -515,12 +517,14 @@ static int journal_clean_one_cp_list(struct journal_head *jh, int *released) + * + * Find all the written-back checkpoint buffers in the journal and release them. + * ++ * If 'destroy' is set, release all buffers unconditionally. ++ * + * Called with the journal locked. + * Called with j_list_lock held. + * Returns number of buffers reaped (for debug) + */ + +-int __jbd2_journal_clean_checkpoint_list(journal_t *journal) ++int __jbd2_journal_clean_checkpoint_list(journal_t *journal, bool destroy) + { + transaction_t *transaction, *last_transaction, *next_transaction; + int ret = 0; +@@ -536,7 +540,7 @@ int __jbd2_journal_clean_checkpoint_list(journal_t *journal) + transaction = next_transaction; + next_transaction = transaction->t_cpnext; + ret += journal_clean_one_cp_list(transaction-> +- t_checkpoint_list, &released); ++ t_checkpoint_list, &released, destroy); + /* + * This function only frees up some memory if possible so we + * dont have an obligation to finish processing. Bail out if +@@ -552,7 +556,7 @@ int __jbd2_journal_clean_checkpoint_list(journal_t *journal) + * we can possibly see not yet submitted buffers on io_list + */ + ret += journal_clean_one_cp_list(transaction-> +- t_checkpoint_io_list, &released); ++ t_checkpoint_io_list, &released, destroy); + if (need_resched()) + goto out; + } while (transaction != last_transaction); +@@ -561,6 +565,28 @@ out: + } + + /* ++ * Remove buffers from all checkpoint lists as journal is aborted and we just ++ * need to free memory ++ */ ++void jbd2_journal_destroy_checkpoint(journal_t *journal) ++{ ++ /* ++ * We loop because __jbd2_journal_clean_checkpoint_list() may abort ++ * early due to a need of rescheduling. ++ */ ++ while (1) { ++ spin_lock(&journal->j_list_lock); ++ if (!journal->j_checkpoint_transactions) { ++ spin_unlock(&journal->j_list_lock); ++ break; ++ } ++ __jbd2_journal_clean_checkpoint_list(journal, true); ++ spin_unlock(&journal->j_list_lock); ++ cond_resched(); ++ } ++} ++ ++/* + * journal_remove_checkpoint: called after a buffer has been committed + * to disk (either by being write-back flushed to disk, or being + * committed to the log). +diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c +index a0dcbd62b180..259f28dfc652 100644 +--- a/fs/jbd2/commit.c ++++ b/fs/jbd2/commit.c +@@ -438,7 +438,7 @@ void jbd2_journal_commit_transaction(journal_t *journal) + * frees some memory + */ + spin_lock(&journal->j_list_lock); +- __jbd2_journal_clean_checkpoint_list(journal); ++ __jbd2_journal_clean_checkpoint_list(journal, false); + spin_unlock(&journal->j_list_lock); + + jbd_debug(3, "JBD2: commit phase 1\n"); +diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c +index f6974688e89f..a3279442bf30 100644 +--- a/fs/jbd2/journal.c ++++ b/fs/jbd2/journal.c +@@ -823,9 +823,10 @@ int jbd2_journal_get_log_tail(journal_t *journal, tid_t *tid, + * + * Requires j_checkpoint_mutex + */ +-void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block) ++int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block) + { + unsigned long freed; ++ int ret; + + BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex)); + +@@ -835,7 +836,10 @@ void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block) + * space and if we lose sb update during power failure we'd replay + * old transaction with possibly newly overwritten data. + */ +- jbd2_journal_update_sb_log_tail(journal, tid, block, WRITE_FUA); ++ ret = jbd2_journal_update_sb_log_tail(journal, tid, block, WRITE_FUA); ++ if (ret) ++ goto out; ++ + write_lock(&journal->j_state_lock); + freed = block - journal->j_tail; + if (block < journal->j_tail) +@@ -851,6 +855,9 @@ void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block) + journal->j_tail_sequence = tid; + journal->j_tail = block; + write_unlock(&journal->j_state_lock); ++ ++out: ++ return ret; + } + + /* +@@ -1264,7 +1271,7 @@ static int journal_reset(journal_t *journal) + return jbd2_journal_start_thread(journal); + } + +-static void jbd2_write_superblock(journal_t *journal, int write_op) ++static int jbd2_write_superblock(journal_t *journal, int write_op) + { + struct buffer_head *bh = journal->j_sb_buffer; + int ret; +@@ -1301,7 +1308,10 @@ static void jbd2_write_superblock(journal_t *journal, int write_op) + printk(KERN_ERR "JBD2: Error %d detected when updating " + "journal superblock for %s.\n", ret, + journal->j_devname); ++ jbd2_journal_abort(journal, ret); + } ++ ++ return ret; + } + + /** +@@ -1314,10 +1324,11 @@ static void jbd2_write_superblock(journal_t *journal, int write_op) + * Update a journal's superblock information about log tail and write it to + * disk, waiting for the IO to complete. + */ +-void jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid, ++int jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid, + unsigned long tail_block, int write_op) + { + journal_superblock_t *sb = journal->j_superblock; ++ int ret; + + BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex)); + jbd_debug(1, "JBD2: updating superblock (start %lu, seq %u)\n", +@@ -1326,13 +1337,18 @@ void jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid, + sb->s_sequence = cpu_to_be32(tail_tid); + sb->s_start = cpu_to_be32(tail_block); + +- jbd2_write_superblock(journal, write_op); ++ ret = jbd2_write_superblock(journal, write_op); ++ if (ret) ++ goto out; + + /* Log is no longer empty */ + write_lock(&journal->j_state_lock); + WARN_ON(!sb->s_sequence); + journal->j_flags &= ~JBD2_FLUSHED; + write_unlock(&journal->j_state_lock); ++ ++out: ++ return ret; + } + + /** +@@ -1575,8 +1591,17 @@ int jbd2_journal_destroy(journal_t *journal) + while (journal->j_checkpoint_transactions != NULL) { + spin_unlock(&journal->j_list_lock); + mutex_lock(&journal->j_checkpoint_mutex); +- jbd2_log_do_checkpoint(journal); ++ err = jbd2_log_do_checkpoint(journal); + mutex_unlock(&journal->j_checkpoint_mutex); ++ /* ++ * If checkpointing failed, just free the buffers to avoid ++ * looping forever ++ */ ++ if (err) { ++ jbd2_journal_destroy_checkpoint(journal); ++ spin_lock(&journal->j_list_lock); ++ break; ++ } + spin_lock(&journal->j_list_lock); + } + +@@ -1785,7 +1810,14 @@ int jbd2_journal_flush(journal_t *journal) + return -EIO; + + mutex_lock(&journal->j_checkpoint_mutex); +- jbd2_cleanup_journal_tail(journal); ++ if (!err) { ++ err = jbd2_cleanup_journal_tail(journal); ++ if (err < 0) { ++ mutex_unlock(&journal->j_checkpoint_mutex); ++ goto out; ++ } ++ err = 0; ++ } + + /* Finally, mark the journal as really needing no recovery. + * This sets s_start==0 in the underlying superblock, which is +@@ -1801,7 +1833,8 @@ int jbd2_journal_flush(journal_t *journal) + J_ASSERT(journal->j_head == journal->j_tail); + J_ASSERT(journal->j_tail_sequence == journal->j_transaction_sequence); + write_unlock(&journal->j_state_lock); +- return 0; ++out: ++ return err; + } + + /** +diff --git a/fs/namei.c b/fs/namei.c +index 9c4b9b811d7b..4fc034ffd209 100644 +--- a/fs/namei.c ++++ b/fs/namei.c +@@ -397,6 +397,24 @@ void path_put(struct path *path) + } + EXPORT_SYMBOL(path_put); + ++/** ++ * path_connected - Verify that a path->dentry is below path->mnt.mnt_root ++ * @path: nameidate to verify ++ * ++ * Rename can sometimes move a file or directory outside of a bind ++ * mount, path_connected allows those cases to be detected. ++ */ ++static bool path_connected(const struct path *path) ++{ ++ struct vfsmount *mnt = path->mnt; ++ ++ /* Only bind mounts can have disconnected paths */ ++ if (mnt->mnt_root == mnt->mnt_sb->s_root) ++ return true; ++ ++ return is_subdir(path->dentry, mnt->mnt_root); ++} ++ + /* + * Path walking has 2 modes, rcu-walk and ref-walk (see + * Documentation/filesystems/path-lookup.txt). In situations when we can't +@@ -945,6 +963,8 @@ static int follow_dotdot_rcu(struct nameidata *nd) + goto failed; + nd->path.dentry = parent; + nd->seq = seq; ++ if (unlikely(!path_connected(&nd->path))) ++ goto failed; + break; + } + if (!follow_up_rcu(&nd->path)) +@@ -1029,7 +1049,7 @@ static void follow_mount(struct path *path) + } + } + +-static void follow_dotdot(struct nameidata *nd) ++static int follow_dotdot(struct nameidata *nd) + { + if (!nd->root.mnt) + set_root(nd); +@@ -1045,6 +1065,10 @@ static void follow_dotdot(struct nameidata *nd) + /* rare case of legitimate dget_parent()... */ + nd->path.dentry = dget_parent(nd->path.dentry); + dput(old); ++ if (unlikely(!path_connected(&nd->path))) { ++ path_put(&nd->path); ++ return -ENOENT; ++ } + break; + } + if (!follow_up(&nd->path)) +@@ -1052,6 +1076,7 @@ static void follow_dotdot(struct nameidata *nd) + } + follow_mount(&nd->path); + nd->inode = nd->path.dentry->d_inode; ++ return 0; + } + + /* +@@ -1252,7 +1277,7 @@ static inline int handle_dots(struct nameidata *nd, int type) + if (follow_dotdot_rcu(nd)) + return -ECHILD; + } else +- follow_dotdot(nd); ++ return follow_dotdot(nd); + } + return 0; + } +diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c +index a77cc9a3ce55..e60bbe2ff5a8 100644 +--- a/fs/nfs/nfs3xdr.c ++++ b/fs/nfs/nfs3xdr.c +@@ -1333,7 +1333,7 @@ static void nfs3_xdr_enc_setacl3args(struct rpc_rqst *req, + if (args->npages != 0) + xdr_write_pages(xdr, args->pages, 0, args->len); + else +- xdr_reserve_space(xdr, NFS_ACL_INLINE_BUFSIZE); ++ xdr_reserve_space(xdr, args->len); + + error = nfsacl_encode(xdr->buf, base, args->inode, + (args->mask & NFS_ACL) ? +diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c +index c4600b59744a..282af88fedaa 100644 +--- a/fs/nfs/nfs4state.c ++++ b/fs/nfs/nfs4state.c +@@ -1279,6 +1279,8 @@ restart: + } + spin_unlock(&state->state_lock); + nfs4_put_open_state(state); ++ clear_bit(NFS_STATE_RECLAIM_NOGRACE, ++ &state->flags); + goto restart; + } + } +diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h +index 6d52429f80bc..0460073bb726 100644 +--- a/include/acpi/actypes.h ++++ b/include/acpi/actypes.h +@@ -495,6 +495,7 @@ typedef u64 acpi_integer; + #define ACPI_NO_ACPI_ENABLE 0x10 + #define ACPI_NO_DEVICE_INIT 0x20 + #define ACPI_NO_OBJECT_INIT 0x40 ++#define ACPI_NO_FACS_INIT 0x80 + + /* + * Initialization state +diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h +index 2ffbf9938a31..2179d78b6ea6 100644 +--- a/include/linux/jbd2.h ++++ b/include/linux/jbd2.h +@@ -974,15 +974,16 @@ extern struct journal_head * jbd2_journal_get_descriptor_buffer(journal_t *); + int jbd2_journal_next_log_block(journal_t *, unsigned long long *); + int jbd2_journal_get_log_tail(journal_t *journal, tid_t *tid, + unsigned long *block); +-void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block); ++int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block); + void jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block); + + /* Commit management */ + extern void jbd2_journal_commit_transaction(journal_t *); + + /* Checkpoint list management */ +-int __jbd2_journal_clean_checkpoint_list(journal_t *journal); ++int __jbd2_journal_clean_checkpoint_list(journal_t *journal, bool destroy); + int __jbd2_journal_remove_checkpoint(struct journal_head *); ++void jbd2_journal_destroy_checkpoint(journal_t *journal); + void __jbd2_journal_insert_checkpoint(struct journal_head *, transaction_t *); + + +@@ -1093,7 +1094,7 @@ extern int jbd2_journal_recover (journal_t *journal); + extern int jbd2_journal_wipe (journal_t *, int); + extern int jbd2_journal_skip_recovery (journal_t *); + extern void jbd2_journal_update_sb_errno(journal_t *); +-extern void jbd2_journal_update_sb_log_tail (journal_t *, tid_t, ++extern int jbd2_journal_update_sb_log_tail (journal_t *, tid_t, + unsigned long, int); + extern void __jbd2_journal_abort_hard (journal_t *); + extern void jbd2_journal_abort (journal_t *, int); +diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h +index 7ba3551a0414..845b40246413 100644 +--- a/include/linux/nfs_xdr.h ++++ b/include/linux/nfs_xdr.h +@@ -1061,7 +1061,7 @@ struct nfstime4 { + }; + + #ifdef CONFIG_NFS_V4_1 +-#define NFS4_EXCHANGE_ID_LEN (48) ++#define NFS4_EXCHANGE_ID_LEN (127) + struct nfs41_exchange_id_args { + struct nfs_client *client; + nfs4_verifier *verifier; +diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h +index 88949a994538..4ea0ec64eada 100644 +--- a/include/net/sctp/structs.h ++++ b/include/net/sctp/structs.h +@@ -209,6 +209,7 @@ extern struct sctp_globals { + struct list_head addr_waitq; + struct timer_list addr_wq_timer; + struct list_head auto_asconf_splist; ++ /* Lock that protects both addr_waitq and auto_asconf_splist */ + spinlock_t addr_wq_lock; + + /* Lock that protects the local_addr_list writers */ +@@ -355,6 +356,10 @@ struct sctp_sock { + atomic_t pd_mode; + /* Receive to here while partial delivery is in effect. */ + struct sk_buff_head pd_lobby; ++ ++ /* These must be the last fields, as they will skipped on copies, ++ * like on accept and peeloff operations ++ */ + struct list_head auto_asconf_list; + int do_auto_asconf; + }; +diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c +index 434f2b673d5b..34031a0ae53f 100644 +--- a/kernel/hrtimer.c ++++ b/kernel/hrtimer.c +@@ -853,6 +853,9 @@ u64 hrtimer_forward(struct hrtimer *timer, ktime_t now, ktime_t interval) + if (delta.tv64 < 0) + return 0; + ++ if (WARN_ON(timer->state & HRTIMER_STATE_ENQUEUED)) ++ return 0; ++ + if (interval.tv64 < timer->base->resolution.tv64) + interval.tv64 = timer->base->resolution.tv64; + +@@ -1265,11 +1268,14 @@ static void __run_hrtimer(struct hrtimer *timer, ktime_t *now) + * Note: We clear the CALLBACK bit after enqueue_hrtimer and + * we do not reprogramm the event hardware. Happens either in + * hrtimer_start_range_ns() or in hrtimer_interrupt() ++ * ++ * Note: Because we dropped the cpu_base->lock above, ++ * hrtimer_start_range_ns() can have popped in and enqueued the timer ++ * for us already. + */ +- if (restart != HRTIMER_NORESTART) { +- BUG_ON(timer->state != HRTIMER_STATE_CALLBACK); ++ if (restart != HRTIMER_NORESTART && ++ !(timer->state & HRTIMER_STATE_ENQUEUED)) + enqueue_hrtimer(timer, base); +- } + + WARN_ON_ONCE(!(timer->state & HRTIMER_STATE_CALLBACK)); + +diff --git a/kernel/rcutiny.c b/kernel/rcutiny.c +index 37a5444204d2..60a56f4331a6 100644 +--- a/kernel/rcutiny.c ++++ b/kernel/rcutiny.c +@@ -279,6 +279,11 @@ static void __rcu_process_callbacks(struct rcu_ctrlblk *rcp) + + /* Move the ready-to-invoke callbacks to a local list. */ + local_irq_save(flags); ++ if (rcp->donetail == &rcp->rcucblist) { ++ /* No callbacks ready, so just leave. */ ++ local_irq_restore(flags); ++ return; ++ } + RCU_TRACE(trace_rcu_batch_start(rcp->name, 0, rcp->qlen, -1)); + list = rcp->rcucblist; + rcp->rcucblist = *rcp->donetail; +diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c +index 3b04aec58700..096d774ac31c 100644 +--- a/kernel/trace/trace_events_filter.c ++++ b/kernel/trace/trace_events_filter.c +@@ -1044,6 +1044,9 @@ static void parse_init(struct filter_parse_state *ps, + + static char infix_next(struct filter_parse_state *ps) + { ++ if (!ps->infix.cnt) ++ return 0; ++ + ps->infix.cnt--; + + return ps->infix.string[ps->infix.tail++]; +@@ -1059,6 +1062,9 @@ static char infix_peek(struct filter_parse_state *ps) + + static void infix_advance(struct filter_parse_state *ps) + { ++ if (!ps->infix.cnt) ++ return; ++ + ps->infix.cnt--; + ps->infix.tail++; + } +@@ -1372,7 +1378,9 @@ static int check_preds(struct filter_parse_state *ps) + } + cnt--; + n_normal_preds++; +- WARN_ON_ONCE(cnt < 0); ++ /* all ops should have operands */ ++ if (cnt < 0) ++ break; + } + + if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) { +diff --git a/lib/bitmap.c b/lib/bitmap.c +index 6ccf2120b406..f62496a20f27 100644 +--- a/lib/bitmap.c ++++ b/lib/bitmap.c +@@ -603,12 +603,12 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen, + unsigned a, b; + int c, old_c, totaldigits; + const char __user __force *ubuf = (const char __user __force *)buf; +- int exp_digit, in_range; ++ int at_start, in_range; + + totaldigits = c = 0; + bitmap_zero(maskp, nmaskbits); + do { +- exp_digit = 1; ++ at_start = 1; + in_range = 0; + a = b = 0; + +@@ -637,11 +637,10 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen, + break; + + if (c == '-') { +- if (exp_digit || in_range) ++ if (at_start || in_range) + return -EINVAL; + b = 0; + in_range = 1; +- exp_digit = 1; + continue; + } + +@@ -651,16 +650,18 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen, + b = b * 10 + (c - '0'); + if (!in_range) + a = b; +- exp_digit = 0; ++ at_start = 0; + totaldigits++; + } + if (!(a <= b)) + return -EINVAL; + if (b >= nmaskbits) + return -ERANGE; +- while (a <= b) { +- set_bit(a, maskp); +- a++; ++ if (!at_start) { ++ while (a <= b) { ++ set_bit(a, maskp); ++ a++; ++ } + } + } while (buflen && c == ','); + return 0; +diff --git a/mm/kmemleak.c b/mm/kmemleak.c +index ad6ee88a3d48..c74827c5ba78 100644 +--- a/mm/kmemleak.c ++++ b/mm/kmemleak.c +@@ -193,6 +193,8 @@ static struct kmem_cache *scan_area_cache; + + /* set if tracing memory operations is enabled */ + static atomic_t kmemleak_enabled = ATOMIC_INIT(0); ++/* same as above but only for the kmemleak_free() callback */ ++static int kmemleak_free_enabled; + /* set in the late_initcall if there were no errors */ + static atomic_t kmemleak_initialized = ATOMIC_INIT(0); + /* enables or disables early logging of the memory operations */ +@@ -936,7 +938,7 @@ void __ref kmemleak_free(const void *ptr) + { + pr_debug("%s(0x%p)\n", __func__, ptr); + +- if (atomic_read(&kmemleak_enabled) && ptr && !IS_ERR(ptr)) ++ if (kmemleak_free_enabled && ptr && !IS_ERR(ptr)) + delete_object_full((unsigned long)ptr); + else if (atomic_read(&kmemleak_early_log)) + log_early(KMEMLEAK_FREE, ptr, 0, 0); +@@ -976,7 +978,7 @@ void __ref kmemleak_free_percpu(const void __percpu *ptr) + + pr_debug("%s(0x%p)\n", __func__, ptr); + +- if (atomic_read(&kmemleak_enabled) && ptr && !IS_ERR(ptr)) ++ if (kmemleak_free_enabled && ptr && !IS_ERR(ptr)) + for_each_possible_cpu(cpu) + delete_object_full((unsigned long)per_cpu_ptr(ptr, + cpu)); +@@ -1690,6 +1692,13 @@ static void kmemleak_do_cleanup(struct work_struct *work) + mutex_lock(&scan_mutex); + stop_scan_thread(); + ++ /* ++ * Once the scan thread has stopped, it is safe to no longer track ++ * object freeing. Ordering of the scan thread stopping and the memory ++ * accesses below is guaranteed by the kthread_stop() function. ++ */ ++ kmemleak_free_enabled = 0; ++ + if (cleanup) { + rcu_read_lock(); + list_for_each_entry_rcu(object, &object_list, object_list) +@@ -1717,6 +1726,8 @@ static void kmemleak_disable(void) + /* check whether it is too early for a kernel thread */ + if (atomic_read(&kmemleak_initialized)) + schedule_work(&cleanup_work); ++ else ++ kmemleak_free_enabled = 0; + + pr_info("Kernel memory leak detector disabled\n"); + } +@@ -1782,8 +1793,10 @@ void __init kmemleak_init(void) + if (atomic_read(&kmemleak_error)) { + local_irq_restore(flags); + return; +- } else ++ } else { + atomic_set(&kmemleak_enabled, 1); ++ kmemleak_free_enabled = 1; ++ } + local_irq_restore(flags); + + /* +diff --git a/net/9p/client.c b/net/9p/client.c +index b23a17c431c8..32df0a3de277 100644 +--- a/net/9p/client.c ++++ b/net/9p/client.c +@@ -833,7 +833,8 @@ static struct p9_req_t *p9_client_zc_rpc(struct p9_client *c, int8_t type, + if (err < 0) { + if (err == -EIO) + c->status = Disconnected; +- goto reterr; ++ if (err != -ERESTARTSYS) ++ goto reterr; + } + if (req->status == REQ_STATUS_ERROR) { + p9_debug(P9_DEBUG_ERROR, "req_status error %d\n", req->t_err); +diff --git a/net/bridge/br_ioctl.c b/net/bridge/br_ioctl.c +index 7222fe1d5460..ea0e15c7ea17 100644 +--- a/net/bridge/br_ioctl.c ++++ b/net/bridge/br_ioctl.c +@@ -246,9 +246,7 @@ static int old_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd) + if (!capable(CAP_NET_ADMIN)) + return -EPERM; + +- spin_lock_bh(&br->lock); + br_stp_set_bridge_priority(br, args[1]); +- spin_unlock_bh(&br->lock); + return 0; + + case BRCTL_SET_PORT_PRIORITY: +diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c +index a41051a1bca5..87ae8c30ab41 100644 +--- a/net/bridge/br_multicast.c ++++ b/net/bridge/br_multicast.c +@@ -36,6 +36,9 @@ + #define mlock_dereference(X, br) \ + rcu_dereference_protected(X, lockdep_is_held(&br->multicast_lock)) + ++static void br_multicast_add_router(struct net_bridge *br, ++ struct net_bridge_port *port); ++ + #if IS_ENABLED(CONFIG_IPV6) + static inline int ipv6_is_transient_multicast(const struct in6_addr *addr) + { +@@ -842,6 +845,8 @@ void br_multicast_enable_port(struct net_bridge_port *port) + goto out; + + __br_multicast_enable_port(port); ++ if (port->multicast_router == 2 && hlist_unhashed(&port->rlist)) ++ br_multicast_add_router(br, port); + + out: + spin_unlock(&br->multicast_lock); +diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c +index 2f100ccef86f..23ea15989d55 100644 +--- a/net/bridge/br_stp_if.c ++++ b/net/bridge/br_stp_if.c +@@ -242,12 +242,13 @@ bool br_stp_recalculate_bridge_id(struct net_bridge *br) + return true; + } + +-/* called under bridge lock */ ++/* Acquires and releases bridge lock */ + void br_stp_set_bridge_priority(struct net_bridge *br, u16 newprio) + { + struct net_bridge_port *p; + int wasroot; + ++ spin_lock_bh(&br->lock); + wasroot = br_is_root_bridge(br); + + list_for_each_entry(p, &br->port_list, list) { +@@ -265,6 +266,7 @@ void br_stp_set_bridge_priority(struct net_bridge *br, u16 newprio) + br_port_state_selection(br); + if (br_is_root_bridge(br) && !wasroot) + br_become_root_bridge(br); ++ spin_unlock_bh(&br->lock); + } + + /* called under bridge lock */ +diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c +index 7fbe21030f54..d4fbcb6268fd 100644 +--- a/net/ceph/osdmap.c ++++ b/net/ceph/osdmap.c +@@ -102,7 +102,7 @@ static int crush_decode_tree_bucket(void **p, void *end, + { + int j; + dout("crush_decode_tree_bucket %p to %p\n", *p, end); +- ceph_decode_32_safe(p, end, b->num_nodes, bad); ++ ceph_decode_8_safe(p, end, b->num_nodes, bad); + b->node_weights = kcalloc(b->num_nodes, sizeof(u32), GFP_NOFS); + if (b->node_weights == NULL) + return -ENOMEM; +diff --git a/net/core/pktgen.c b/net/core/pktgen.c +index 546b1334fad4..ffa5d5d172c5 100644 +--- a/net/core/pktgen.c ++++ b/net/core/pktgen.c +@@ -568,7 +568,7 @@ static int pktgen_if_show(struct seq_file *seq, void *v) + " dst_min: %s dst_max: %s\n", + pkt_dev->dst_min, pkt_dev->dst_max); + seq_printf(seq, +- " src_min: %s src_max: %s\n", ++ " src_min: %s src_max: %s\n", + pkt_dev->src_min, pkt_dev->src_max); + } + +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index dbe1715c629f..79c75e1d17ee 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -1169,16 +1169,6 @@ static void packet_sock_destruct(struct sock *sk) + sk_refcnt_debug_dec(sk); + } + +-static int fanout_rr_next(struct packet_fanout *f, unsigned int num) +-{ +- int x = atomic_read(&f->rr_cur) + 1; +- +- if (x >= num) +- x = 0; +- +- return x; +-} +- + static struct sock *fanout_demux_hash(struct packet_fanout *f, struct sk_buff *skb, unsigned int num) + { + u32 idx, hash = skb->rxhash; +@@ -1190,13 +1180,9 @@ static struct sock *fanout_demux_hash(struct packet_fanout *f, struct sk_buff *s + + static struct sock *fanout_demux_lb(struct packet_fanout *f, struct sk_buff *skb, unsigned int num) + { +- int cur, old; ++ unsigned int val = atomic_inc_return(&f->rr_cur); + +- cur = atomic_read(&f->rr_cur); +- while ((old = atomic_cmpxchg(&f->rr_cur, cur, +- fanout_rr_next(f, num))) != cur) +- cur = old; +- return f->arr[cur]; ++ return f->arr[val % num]; + } + + static struct sock *fanout_demux_cpu(struct packet_fanout *f, struct sk_buff *skb, unsigned int num) +@@ -1210,7 +1196,7 @@ static int packet_rcv_fanout(struct sk_buff *skb, struct net_device *dev, + struct packet_type *pt, struct net_device *orig_dev) + { + struct packet_fanout *f = pt->af_packet_priv; +- unsigned int num = f->num_members; ++ unsigned int num = ACCESS_ONCE(f->num_members); + struct packet_sock *po; + struct sock *sk; + +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index 0c0bd2fe9aca..bc7b5de49725 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -1539,8 +1539,10 @@ SCTP_STATIC void sctp_close(struct sock *sk, long timeout) + + /* Supposedly, no process has access to the socket, but + * the net layers still may. ++ * Also, sctp_destroy_sock() needs to be called with addr_wq_lock ++ * held and that should be grabbed before socket lock. + */ +- sctp_local_bh_disable(); ++ spin_lock_bh(&sctp_globals.addr_wq_lock); + sctp_bh_lock_sock(sk); + + /* Hold the sock, since sk_common_release() will put sock_put() +@@ -1550,7 +1552,7 @@ SCTP_STATIC void sctp_close(struct sock *sk, long timeout) + sk_common_release(sk); + + sctp_bh_unlock_sock(sk); +- sctp_local_bh_enable(); ++ spin_unlock_bh(&sctp_globals.addr_wq_lock); + + sock_put(sk); + +@@ -3492,6 +3494,7 @@ static int sctp_setsockopt_auto_asconf(struct sock *sk, char __user *optval, + if ((val && sp->do_auto_asconf) || (!val && !sp->do_auto_asconf)) + return 0; + ++ spin_lock_bh(&sctp_globals.addr_wq_lock); + if (val == 0 && sp->do_auto_asconf) { + list_del(&sp->auto_asconf_list); + sp->do_auto_asconf = 0; +@@ -3500,6 +3503,7 @@ static int sctp_setsockopt_auto_asconf(struct sock *sk, char __user *optval, + &sctp_auto_asconf_splist); + sp->do_auto_asconf = 1; + } ++ spin_unlock_bh(&sctp_globals.addr_wq_lock); + return 0; + } + +@@ -3935,18 +3939,28 @@ SCTP_STATIC int sctp_init_sock(struct sock *sk) + local_bh_disable(); + percpu_counter_inc(&sctp_sockets_allocated); + sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1); ++ ++ /* Nothing can fail after this block, otherwise ++ * sctp_destroy_sock() will be called without addr_wq_lock held ++ */ + if (sctp_default_auto_asconf) { ++ spin_lock(&sctp_globals.addr_wq_lock); + list_add_tail(&sp->auto_asconf_list, + &sctp_auto_asconf_splist); + sp->do_auto_asconf = 1; +- } else ++ spin_unlock(&sctp_globals.addr_wq_lock); ++ } else { + sp->do_auto_asconf = 0; ++ } ++ + local_bh_enable(); + + return 0; + } + +-/* Cleanup any SCTP per socket resources. */ ++/* Cleanup any SCTP per socket resources. Must be called with ++ * sctp_globals.addr_wq_lock held if sp->do_auto_asconf is true ++ */ + SCTP_STATIC void sctp_destroy_sock(struct sock *sk) + { + struct sctp_sock *sp; +@@ -6746,6 +6760,19 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk, + newinet->mc_list = NULL; + } + ++static inline void sctp_copy_descendant(struct sock *sk_to, ++ const struct sock *sk_from) ++{ ++ int ancestor_size = sizeof(struct inet_sock) + ++ sizeof(struct sctp_sock) - ++ offsetof(struct sctp_sock, auto_asconf_list); ++ ++ if (sk_from->sk_family == PF_INET6) ++ ancestor_size += sizeof(struct ipv6_pinfo); ++ ++ __inet_sk_copy_descendant(sk_to, sk_from, ancestor_size); ++} ++ + /* Populate the fields of the newsk from the oldsk and migrate the assoc + * and its messages to the newsk. + */ +@@ -6760,7 +6787,6 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk, + struct sk_buff *skb, *tmp; + struct sctp_ulpevent *event; + struct sctp_bind_hashbucket *head; +- struct list_head tmplist; + + /* Migrate socket buffer sizes and all the socket level options to the + * new socket. +@@ -6768,12 +6794,7 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk, + newsk->sk_sndbuf = oldsk->sk_sndbuf; + newsk->sk_rcvbuf = oldsk->sk_rcvbuf; + /* Brute force copy old sctp opt. */ +- if (oldsp->do_auto_asconf) { +- memcpy(&tmplist, &newsp->auto_asconf_list, sizeof(tmplist)); +- inet_sk_copy_descendant(newsk, oldsk); +- memcpy(&newsp->auto_asconf_list, &tmplist, sizeof(tmplist)); +- } else +- inet_sk_copy_descendant(newsk, oldsk); ++ sctp_copy_descendant(newsk, oldsk); + + /* Restore the ep value that was overwritten with the above structure + * copy. +diff --git a/net/sunrpc/backchannel_rqst.c b/net/sunrpc/backchannel_rqst.c +index 31def68a0f6e..617b955f4931 100644 +--- a/net/sunrpc/backchannel_rqst.c ++++ b/net/sunrpc/backchannel_rqst.c +@@ -60,7 +60,7 @@ static void xprt_free_allocation(struct rpc_rqst *req) + + dprintk("RPC: free allocations for req= %p\n", req); + BUG_ON(test_bit(RPC_BC_PA_IN_USE, &req->rq_bc_pa_state)); +- xbufp = &req->rq_private_buf; ++ xbufp = &req->rq_rcv_buf; + free_page((unsigned long)xbufp->head[0].iov_base); + xbufp = &req->rq_snd_buf; + free_page((unsigned long)xbufp->head[0].iov_base); +diff --git a/sound/soc/codecs/wm8737.c b/sound/soc/codecs/wm8737.c +index 4fe9d191e277..80460d2a170d 100644 +--- a/sound/soc/codecs/wm8737.c ++++ b/sound/soc/codecs/wm8737.c +@@ -484,7 +484,8 @@ static int wm8737_set_bias_level(struct snd_soc_codec *codec, + + /* Fast VMID ramp at 2*2.5k */ + snd_soc_update_bits(codec, WM8737_MISC_BIAS_CONTROL, +- WM8737_VMIDSEL_MASK, 0x4); ++ WM8737_VMIDSEL_MASK, ++ 2 << WM8737_VMIDSEL_SHIFT); + + /* Bring VMID up */ + snd_soc_update_bits(codec, WM8737_POWER_MANAGEMENT, +@@ -498,7 +499,8 @@ static int wm8737_set_bias_level(struct snd_soc_codec *codec, + + /* VMID at 2*300k */ + snd_soc_update_bits(codec, WM8737_MISC_BIAS_CONTROL, +- WM8737_VMIDSEL_MASK, 2); ++ WM8737_VMIDSEL_MASK, ++ 1 << WM8737_VMIDSEL_SHIFT); + + break; + +diff --git a/sound/soc/codecs/wm8903.h b/sound/soc/codecs/wm8903.h +index db949311c0f2..0bb4a647755d 100644 +--- a/sound/soc/codecs/wm8903.h ++++ b/sound/soc/codecs/wm8903.h +@@ -172,7 +172,7 @@ extern int wm8903_mic_detect(struct snd_soc_codec *codec, + #define WM8903_VMID_BUF_ENA_WIDTH 1 /* VMID_BUF_ENA */ + + #define WM8903_VMID_RES_50K 2 +-#define WM8903_VMID_RES_250K 3 ++#define WM8903_VMID_RES_250K 4 + #define WM8903_VMID_RES_5K 6 + + /* +diff --git a/sound/soc/codecs/wm8955.c b/sound/soc/codecs/wm8955.c +index 4696f6668259..07b78a9540a7 100644 +--- a/sound/soc/codecs/wm8955.c ++++ b/sound/soc/codecs/wm8955.c +@@ -298,7 +298,7 @@ static int wm8955_configure_clocking(struct snd_soc_codec *codec) + snd_soc_update_bits(codec, WM8955_PLL_CONTROL_2, + WM8955_K_17_9_MASK, + (pll.k >> 9) & WM8955_K_17_9_MASK); +- snd_soc_update_bits(codec, WM8955_PLL_CONTROL_2, ++ snd_soc_update_bits(codec, WM8955_PLL_CONTROL_3, + WM8955_K_8_0_MASK, + pll.k & WM8955_K_8_0_MASK); + if (pll.k) +diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c +index ed986e6d10c4..bd3c6ef8077a 100644 +--- a/sound/soc/codecs/wm8960.c ++++ b/sound/soc/codecs/wm8960.c +@@ -183,7 +183,7 @@ SOC_SINGLE("PCM Playback -6dB Switch", WM8960_DACCTL1, 7, 1, 0), + SOC_ENUM("ADC Polarity", wm8960_enum[0]), + SOC_SINGLE("ADC High Pass Filter Switch", WM8960_DACCTL1, 0, 1, 0), + +-SOC_ENUM("DAC Polarity", wm8960_enum[2]), ++SOC_ENUM("DAC Polarity", wm8960_enum[1]), + SOC_SINGLE_BOOL_EXT("DAC Deemphasis Switch", 0, + wm8960_get_deemph, wm8960_put_deemph), + diff --git a/patch/kernel/sun5i-default/0016-gpio.patch b/patch/kernel/sun5i-default/0016-gpio.patch new file mode 100644 index 0000000000..541b314c22 --- /dev/null +++ b/patch/kernel/sun5i-default/0016-gpio.patch @@ -0,0 +1,17 @@ +--- a/drivers/gpio/gpio-sunxi.c ++++ b/drivers/gpio/gpio-sunxi.c +@@ -182,11 +182,9 @@ static int sunxi_gpio_request(struct gpio_chip *chip, unsigned offset) + if ((offset > chip->ngpio - 1) || (offset < 0)) + return -EINVAL; + +- /* Set sysfs exported gpio name (example "gpio254_ph20") */ +- sprintf((char *)(chip->names[offset]), "gpio%d_p%c%d", +- offset+chip->base, +- 'a'+sgpio->data[offset].info.port-1, +- sgpio->data[offset].info.port_num); ++ /* Set sysfs exported gpio name (example "gpio254") */ ++ sprintf((char *)(chip->names[offset]), "gpio%d", ++ offset+chip->base); + + sgpio->data[offset].gpio_handler = gpio_request_ex("gpio_para", + sgpio->data[offset].pin_name); diff --git a/patch/kernel/sun5i-default/0017-dev-packaging.patch b/patch/kernel/sun5i-default/0017-dev-packaging.patch new file mode 100644 index 0000000000..39f15bf186 --- /dev/null +++ b/patch/kernel/sun5i-default/0017-dev-packaging.patch @@ -0,0 +1,282 @@ +diff --git a/scripts/package/builddeb b/scripts/package/builddeb +index ed7ccdc..4bda948 100644 +--- a/scripts/package/builddeb ++++ b/scripts/package/builddeb +@@ -35,15 +35,17 @@ create_package() { + sparc*) + debarch=sparc ;; + s390*) +- debarch=s390 ;; ++ debarch=s390$(grep -q CONFIG_64BIT=y $KCONFIG_CONFIG && echo x || true) ;; + ppc*) +- debarch=powerpc ;; ++ debarch=$(grep -q CPU_LITTLE_ENDIAN=y $KCONFIG_CONFIG && echo ppc64el || echo powerpc) ;; + parisc*) + debarch=hppa ;; + mips*) +- debarch=mips$(grep -q CPU_LITTLE_ENDIAN=y .config && echo el) ;; ++ debarch=mips$(grep -q CPU_LITTLE_ENDIAN=y $KCONFIG_CONFIG && echo el || true) ;; ++ arm64) ++ debarch=arm64 ;; + arm*) +- debarch=arm$(grep -q CONFIG_AEABI=y .config && echo el) ;; ++ debarch=arm$(grep -q CONFIG_AEABI=y $KCONFIG_CONFIG && echo el || true) ;; + *) + echo "" >&2 + echo "** ** ** WARNING ** ** **" >&2 +@@ -62,7 +64,7 @@ create_package() { + fi + + # Create the package +- dpkg-gencontrol -isp $forcearch -Vkernel:debarch="${debarch:-$(dpkg --print-architecture)}" -p$pname -P"$pdir" ++ dpkg-gencontrol $forcearch -Vkernel:debarch="${debarch:-$(dpkg --print-architecture)}" -p$pname -P"$pdir" + dpkg --build "$pdir" .. + } + +@@ -78,21 +80,39 @@ tmpdir="$objtree/debian/tmp" + fwdir="$objtree/debian/fwtmp" + kernel_headers_dir="$objtree/debian/hdrtmp" + libc_headers_dir="$objtree/debian/headertmp" +-packagename=linux-image-$version +-fwpackagename=linux-firmware-image +-kernel_headers_packagename=linux-headers-$version +-libc_headers_packagename=linux-libc-dev ++dbg_dir="$objtree/debian/dbgtmp" ++packagename=linux-image"$LOCALVERSION" ++fwpackagename=linux-firmware-image"$LOCALVERSION" ++kernel_headers_packagename=linux-headers"$LOCALVERSION" ++libc_headers_packagename=linux-libc-dev"$LOCALVERSION" ++dbg_packagename=$packagename-dbg + + if [ "$ARCH" = "um" ] ; then + packagename=user-mode-linux-$version + fi + ++# Not all arches have the same installed path in debian ++# XXX: have each arch Makefile export a variable of the canonical image install ++# path instead ++case $ARCH in ++um) ++ installed_image_path="usr/bin/linux-$version" ++ ;; ++parisc|mips|powerpc) ++ installed_image_path="boot/vmlinux-$version" ++ ;; ++*) ++ installed_image_path="boot/vmlinuz-$version" ++esac ++ ++BUILD_DEBUG="$(grep -s '^CONFIG_DEBUG_INFO=y' $KCONFIG_CONFIG || true)" ++ + # Setup the directory structure +-rm -rf "$tmpdir" "$fwdir" "$kernel_headers_dir" "$libc_headers_dir" ++rm -rf "$tmpdir" "$fwdir" "$kernel_headers_dir" "$libc_headers_dir" "$dbg_dir" + mkdir -m 755 -p "$tmpdir/DEBIAN" + mkdir -p "$tmpdir/lib" "$tmpdir/boot" "$tmpdir/usr/share/doc/$packagename" + mkdir -m 755 -p "$fwdir/DEBIAN" +-mkdir -p "$fwdir/lib" "$fwdir/usr/share/doc/$fwpackagename" ++mkdir -p "$fwdir/lib/firmware/" "$fwdir/usr/share/doc/$fwpackagename" + mkdir -m 755 -p "$libc_headers_dir/DEBIAN" + mkdir -p "$libc_headers_dir/usr/share/doc/$libc_headers_packagename" + mkdir -m 755 -p "$kernel_headers_dir/DEBIAN" +@@ -101,26 +121,29 @@ mkdir -p "$kernel_headers_dir/lib/modules/$version/" + if [ "$ARCH" = "um" ] ; then + mkdir -p "$tmpdir/usr/lib/uml/modules/$version" "$tmpdir/usr/bin" + fi ++if [ -n "$BUILD_DEBUG" ] ; then ++ mkdir -p "$dbg_dir/usr/share/doc/$dbg_packagename" ++ mkdir -m 755 -p "$dbg_dir/DEBIAN" ++fi + + # Build and install the kernel + if [ "$ARCH" = "um" ] ; then + $MAKE linux + cp System.map "$tmpdir/usr/lib/uml/modules/$version/System.map" +- cp .config "$tmpdir/usr/share/doc/$packagename/config" ++ cp $KCONFIG_CONFIG "$tmpdir/usr/share/doc/$packagename/config" + gzip "$tmpdir/usr/share/doc/$packagename/config" +- cp $KBUILD_IMAGE "$tmpdir/usr/bin/linux-$version" +-else ++else + cp System.map "$tmpdir/boot/System.map-$version" +- cp .config "$tmpdir/boot/config-$version" +- # Not all arches include the boot path in KBUILD_IMAGE +- if [ -e $KBUILD_IMAGE ]; then +- cp $KBUILD_IMAGE "$tmpdir/boot/vmlinuz-$version" +- else +- cp arch/$ARCH/boot/$KBUILD_IMAGE "$tmpdir/boot/vmlinuz-$version" +- fi ++ cp $KCONFIG_CONFIG "$tmpdir/boot/config-$version" ++fi ++# Not all arches include the boot path in KBUILD_IMAGE ++if [ -e $KBUILD_IMAGE ]; then ++ cp $KBUILD_IMAGE "$tmpdir/$installed_image_path" ++else ++ cp arch/$ARCH/boot/$KBUILD_IMAGE "$tmpdir/$installed_image_path" + fi + +-if grep -q '^CONFIG_MODULES=y' .config ; then ++if grep -q '^CONFIG_MODULES=y' $KCONFIG_CONFIG ; then + INSTALL_MOD_PATH="$tmpdir" $MAKE KBUILD_SRC= modules_install + rm -f "$tmpdir/lib/modules/$version/build" + rm -f "$tmpdir/lib/modules/$version/source" +@@ -128,17 +151,46 @@ if grep -q '^CONFIG_MODULES=y' .config ; then + mv "$tmpdir/lib/modules/$version"/* "$tmpdir/usr/lib/uml/modules/$version/" + rmdir "$tmpdir/lib/modules/$version" + fi ++ if [ -n "$BUILD_DEBUG" ] ; then ++ for module in $(find $tmpdir/lib/modules/ -name *.ko -printf '%P\n'); do ++ module=lib/modules/$module ++ mkdir -p $(dirname $dbg_dir/usr/lib/debug/$module) ++ # only keep debug symbols in the debug file ++ $OBJCOPY --only-keep-debug $tmpdir/$module $dbg_dir/usr/lib/debug/$module ++ # strip original module from debug symbols ++ $OBJCOPY --strip-debug $tmpdir/$module ++ # then add a link to those ++ $OBJCOPY --add-gnu-debuglink=$dbg_dir/usr/lib/debug/$module $tmpdir/$module ++ done ++ fi ++fi ++ ++if grep -q '^CONFIG_OF=y' $KCONFIG_CONFIG ; then ++ mkdir -p "$tmpdir/boot/dtb/$version" ++ INSTALL_DTBS_PATH="$tmpdir/boot/dtb/$version" $MAKE KBUILD_SRC= dtbs_install ++fi ++ ++if grep -q '^CONFIG_OF=y' $KCONFIG_CONFIG ; then ++ mkdir -p "$tmpdir/boot/dtb/$version" ++ INSTALL_DTBS_PATH="$tmpdir/boot/dtb/$version" $MAKE KBUILD_SRC= dtbs_install + fi + + if [ "$ARCH" != "um" ]; then + $MAKE headers_check KBUILD_SRC= +- $MAKE headers_install KBUILD_SRC= INSTALL_HDR_PATH="$libc_headers_dir/usr" ++ #$MAKE headers_install KBUILD_SRC= INSTALL_HDR_PATH="$libc_headers_dir/usr" + fi + + # Install the maintainer scripts + # Note: hook scripts under /etc/kernel are also executed by official Debian +-# kernel packages, as well as kernel packages built using make-kpkg ++# kernel packages, as well as kernel packages built using make-kpkg. ++# make-kpkg sets $INITRD to indicate whether an initramfs is wanted, and ++# so do we; recent versions of dracut and initramfs-tools will obey this. + debhookdir=${KDEB_HOOKDIR:-/etc/kernel} ++if grep -q '^CONFIG_BLK_DEV_INITRD=y' $KCONFIG_CONFIG; then ++ want_initrd=Yes ++else ++ want_initrd=No ++fi + for script in postinst postrm preinst prerm ; do + mkdir -p "$tmpdir$debhookdir/$script.d" + cat < "$tmpdir/DEBIAN/$script" +@@ -149,12 +201,38 @@ set -e + # Pass maintainer script parameters to hook scripts + export DEB_MAINT_PARAMS="\$*" + +-test -d $debhookdir/$script.d && run-parts --arg="$version" $debhookdir/$script.d ++# Tell initramfs builder whether it's wanted ++export INITRD=$want_initrd ++ ++test -d $debhookdir/$script.d && run-parts --arg="$version" --arg="/$installed_image_path" $debhookdir/$script.d + exit 0 + EOF + chmod 755 "$tmpdir/DEBIAN/$script" + done + ++## ++## Create sym link to kernel image ++## ++sed -e "s/exit 0//g" -i $tmpdir/DEBIAN/postinst ++cat >> $tmpdir/DEBIAN/postinst < /dev/null 2>&1 ++rm -f /$installed_image_path /boot/zImage ++else ++ln -sf /$installed_image_path /boot/zImage > /dev/null 2>&1 || mv /$installed_image_path /boot/zImage ++fi ++rm -f /boot/.next ++exit 0 ++EOT ++## ++## FAT install workaround ++## ++sed -e "s/exit 0//g" -i $tmpdir/DEBIAN/preinst ++cat >> $tmpdir/DEBIAN/preinst <> $tmpdir/DEBIAN/preinst ++ + # Try to determine maintainer and email values + if [ -n "$DEBEMAIL" ]; then + email=$DEBEMAIL +@@ -242,14 +320,17 @@ EOF + + fi + +-# Build header package +-(cd $srctree; find . -name Makefile -o -name Kconfig\* -o -name \*.pl > "$objtree/debian/hdrsrcfiles") +-(cd $srctree; find arch/$SRCARCH/include include scripts -type f >> "$objtree/debian/hdrsrcfiles") +-(cd $objtree; find .config Module.symvers include scripts -type f >> "$objtree/debian/hdrobjfiles") ++# Build kernel header package ++(cd $srctree; find . -name Makefile\* -o -name Kconfig\* -o -name \*.pl) > "$objtree/debian/hdrsrcfiles" ++(cd $srctree; find arch/$SRCARCH/include include scripts -type f) >> "$objtree/debian/hdrsrcfiles" ++(cd $srctree; find arch/$SRCARCH -name module.lds -o -name Kbuild.platforms -o -name Platform) >> "$objtree/debian/hdrsrcfiles" ++(cd $srctree; find $(find arch/$SRCARCH -name include -o -name scripts -type d) -type f) >> "$objtree/debian/hdrsrcfiles" ++(cd $objtree; find arch/$SRCARCH/include Module.symvers include scripts -type f) >> "$objtree/debian/hdrobjfiles" + destdir=$kernel_headers_dir/usr/src/linux-headers-$version + mkdir -p "$destdir" +-(cd $srctree; tar -c -f - -T "$objtree/debian/hdrsrcfiles") | (cd $destdir; tar -xf -) +-(cd $objtree; tar -c -f - -T "$objtree/debian/hdrobjfiles") | (cd $destdir; tar -xf -) ++(cd $srctree; tar -c -f - -T -) < "$objtree/debian/hdrsrcfiles" | (cd $destdir; tar -xf -) ++(cd $objtree; tar -c -f - -T -) < "$objtree/debian/hdrobjfiles" | (cd $destdir; tar -xf -) ++(cd $objtree; cp $KCONFIG_CONFIG $destdir/.config) # copy .config manually to be where it's expected to be + ln -sf "/usr/src/linux-headers-$version" "$kernel_headers_dir/lib/modules/$version/build" + rm -f "$objtree/debian/hdrsrcfiles" "$objtree/debian/hdrobjfiles" + +@@ -266,7 +347,8 @@ EOF + + # Do we have firmware? Move it out of the way and build it into a package. + if [ -e "$tmpdir/lib/firmware" ]; then +- mv "$tmpdir/lib/firmware" "$fwdir/lib/" ++ mv "$tmpdir/lib/firmware"/* "$fwdir/lib/firmware/" ++ rmdir "$tmpdir/lib/firmware" + + cat <> debian/control + +@@ -292,9 +374,35 @@ EOF + + if [ "$ARCH" != "um" ]; then + create_package "$kernel_headers_packagename" "$kernel_headers_dir" +- create_package "$libc_headers_packagename" "$libc_headers_dir" ++ #create_package "$libc_headers_packagename" "$libc_headers_dir" + fi + + create_package "$packagename" "$tmpdir" + ++if [ -n "$BUILD_DEBUG" ] ; then ++ # Build debug package ++ # Different tools want the image in different locations ++ # perf ++ mkdir -p $dbg_dir/usr/lib/debug/lib/modules/$version/ ++ cp vmlinux $dbg_dir/usr/lib/debug/lib/modules/$version/ ++ # systemtap ++ mkdir -p $dbg_dir/usr/lib/debug/boot/ ++ ln -s ../lib/modules/$version/vmlinux $dbg_dir/usr/lib/debug/boot/vmlinux-$version ++ # kdump-tools ++ ln -s lib/modules/$version/vmlinux $dbg_dir/usr/lib/debug/vmlinux-$version ++ ++ cat <> debian/control ++ ++Package: $dbg_packagename ++Section: debug ++Provides: linux-debug, linux-debug-$version ++Architecture: any ++Description: Linux kernel debugging symbols for $version ++ This package will come in handy if you need to debug the kernel. It provides ++ all the necessary debug symbols for the kernel and its modules. ++EOF ++ ++ create_package "$dbg_packagename" "$dbg_dir" ++fi ++ + exit 0 diff --git a/patch/kernel/sun5i-default/headers-packing-legacy.patch b/patch/kernel/sun5i-default/headers-packing-legacy.patch new file mode 100644 index 0000000000..31dc139320 --- /dev/null +++ b/patch/kernel/sun5i-default/headers-packing-legacy.patch @@ -0,0 +1,13 @@ +diff --git a/scripts/package/builddeb b/scripts/package/builddeb +index ed7ccdc..20a2d0f 100644 +--- a/scripts/package/builddeb ++++ b/scripts/package/builddeb +@@ -253,6 +253,8 @@ mkdir -p "$destdir" + ln -sf "/usr/src/linux-headers-$version" "$kernel_headers_dir/lib/modules/$version/build" + rm -f "$objtree/debian/hdrsrcfiles" "$objtree/debian/hdrobjfiles" + ++olddir="$(pwd)"; cd "$destdir"; make M=scripts clean; cd $olddir ++ + cat <> debian/control + + Package: $kernel_headers_packagename