From 1be502fc6bcccc3b7d1115481f7795dc729195cf Mon Sep 17 00:00:00 2001 From: Stephan Raue Date: Mon, 6 Oct 2014 16:00:10 +0200 Subject: [PATCH] projects/Cuboxi/patches/linux: add upstream patch Signed-off-by: Stephan Raue --- .../linux/linux-000-patch-3.14.19-20.patch | 7387 +++++++++++++++++ 1 file changed, 7387 insertions(+) create mode 100644 projects/Cuboxi/patches/linux/linux-000-patch-3.14.19-20.patch diff --git a/projects/Cuboxi/patches/linux/linux-000-patch-3.14.19-20.patch b/projects/Cuboxi/patches/linux/linux-000-patch-3.14.19-20.patch new file mode 100644 index 0000000000..e3560ed49f --- /dev/null +++ b/projects/Cuboxi/patches/linux/linux-000-patch-3.14.19-20.patch @@ -0,0 +1,7387 @@ +diff --git a/Documentation/devicetree/bindings/interrupt-controller/interrupts.txt b/Documentation/devicetree/bindings/interrupt-controller/interrupts.txt +index 1486497a24c1..ce6a1a072028 100644 +--- a/Documentation/devicetree/bindings/interrupt-controller/interrupts.txt ++++ b/Documentation/devicetree/bindings/interrupt-controller/interrupts.txt +@@ -4,11 +4,13 @@ Specifying interrupt information for devices + 1) Interrupt client nodes + ------------------------- + +-Nodes that describe devices which generate interrupts must contain an either an +-"interrupts" property or an "interrupts-extended" property. These properties +-contain a list of interrupt specifiers, one per output interrupt. The format of +-the interrupt specifier is determined by the interrupt controller to which the +-interrupts are routed; see section 2 below for details. ++Nodes that describe devices which generate interrupts must contain an ++"interrupts" property, an "interrupts-extended" property, or both. If both are ++present, the latter should take precedence; the former may be provided simply ++for compatibility with software that does not recognize the latter. These ++properties contain a list of interrupt specifiers, one per output interrupt. The ++format of the interrupt specifier is determined by the interrupt controller to ++which the interrupts are routed; see section 2 below for details. + + Example: + interrupt-parent = <&intc1>; +diff --git a/Makefile b/Makefile +index b1746b486646..beb7e6f0803b 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 14 +-SUBLEVEL = 19 ++SUBLEVEL = 20 + EXTRAVERSION = + NAME = Remembering Coco + +diff --git a/arch/arm/boot/dts/dra7-evm.dts b/arch/arm/boot/dts/dra7-evm.dts +index 904dcf5973f3..9381754b35cc 100644 +--- a/arch/arm/boot/dts/dra7-evm.dts ++++ b/arch/arm/boot/dts/dra7-evm.dts +@@ -50,13 +50,13 @@ + + mcspi1_pins: pinmux_mcspi1_pins { + pinctrl-single,pins = < +- 0x3a4 (PIN_INPUT | MUX_MODE0) /* spi2_clk */ +- 0x3a8 (PIN_INPUT | MUX_MODE0) /* spi2_d1 */ +- 0x3ac (PIN_INPUT | MUX_MODE0) /* spi2_d0 */ +- 0x3b0 (PIN_INPUT_SLEW | MUX_MODE0) /* spi2_cs0 */ +- 0x3b4 (PIN_INPUT_SLEW | MUX_MODE0) /* spi2_cs1 */ +- 0x3b8 (PIN_INPUT_SLEW | MUX_MODE6) /* spi2_cs2 */ +- 0x3bc (PIN_INPUT_SLEW | MUX_MODE6) /* spi2_cs3 */ ++ 0x3a4 (PIN_INPUT | MUX_MODE0) /* spi1_sclk */ ++ 0x3a8 (PIN_INPUT | MUX_MODE0) /* spi1_d1 */ ++ 0x3ac (PIN_INPUT | MUX_MODE0) /* spi1_d0 */ ++ 0x3b0 (PIN_INPUT_SLEW | MUX_MODE0) /* spi1_cs0 */ ++ 0x3b4 (PIN_INPUT_SLEW | MUX_MODE0) /* spi1_cs1 */ ++ 0x3b8 (PIN_INPUT_SLEW | MUX_MODE6) /* spi1_cs2.hdmi1_hpd */ ++ 0x3bc (PIN_INPUT_SLEW | MUX_MODE6) /* spi1_cs3.hdmi1_cec */ + >; + }; + +diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi +index 1fd75aa4639d..767f0e376f4d 100644 +--- a/arch/arm/boot/dts/dra7.dtsi ++++ b/arch/arm/boot/dts/dra7.dtsi +@@ -178,7 +178,7 @@ + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; +- #interrupt-cells = <1>; ++ #interrupt-cells = <2>; + }; + + gpio2: gpio@48055000 { +@@ -189,7 +189,7 @@ + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; +- #interrupt-cells = <1>; ++ #interrupt-cells = <2>; + }; + + gpio3: gpio@48057000 { +@@ -200,7 +200,7 @@ + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; +- #interrupt-cells = <1>; ++ #interrupt-cells = <2>; + }; + + gpio4: gpio@48059000 { +@@ -211,7 +211,7 @@ + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; +- #interrupt-cells = <1>; ++ #interrupt-cells = <2>; + }; + + gpio5: gpio@4805b000 { +@@ -222,7 +222,7 @@ + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; +- #interrupt-cells = <1>; ++ #interrupt-cells = <2>; + }; + + gpio6: gpio@4805d000 { +@@ -233,7 +233,7 @@ + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; +- #interrupt-cells = <1>; ++ #interrupt-cells = <2>; + }; + + gpio7: gpio@48051000 { +@@ -244,7 +244,7 @@ + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; +- #interrupt-cells = <1>; ++ #interrupt-cells = <2>; + }; + + gpio8: gpio@48053000 { +@@ -255,7 +255,7 @@ + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; +- #interrupt-cells = <1>; ++ #interrupt-cells = <2>; + }; + + uart1: serial@4806a000 { +diff --git a/arch/arm/include/asm/tls.h b/arch/arm/include/asm/tls.h +index 83259b873333..5f833f7adba1 100644 +--- a/arch/arm/include/asm/tls.h ++++ b/arch/arm/include/asm/tls.h +@@ -1,6 +1,9 @@ + #ifndef __ASMARM_TLS_H + #define __ASMARM_TLS_H + ++#include ++#include ++ + #ifdef __ASSEMBLY__ + #include + .macro switch_tls_none, base, tp, tpuser, tmp1, tmp2 +@@ -50,6 +53,49 @@ + #endif + + #ifndef __ASSEMBLY__ ++ ++static inline void set_tls(unsigned long val) ++{ ++ struct thread_info *thread; ++ ++ thread = current_thread_info(); ++ ++ thread->tp_value[0] = val; ++ ++ /* ++ * This code runs with preemption enabled and therefore must ++ * be reentrant with respect to switch_tls. ++ * ++ * We need to ensure ordering between the shadow state and the ++ * hardware state, so that we don't corrupt the hardware state ++ * with a stale shadow state during context switch. ++ * ++ * If we're preempted here, switch_tls will load TPIDRURO from ++ * thread_info upon resuming execution and the following mcr ++ * is merely redundant. ++ */ ++ barrier(); ++ ++ if (!tls_emu) { ++ if (has_tls_reg) { ++ asm("mcr p15, 0, %0, c13, c0, 3" ++ : : "r" (val)); ++ } else { ++#ifdef CONFIG_KUSER_HELPERS ++ /* ++ * User space must never try to access this ++ * directly. Expect your app to break ++ * eventually if you do so. The user helper ++ * at 0xffff0fe0 must be used instead. (see ++ * entry-armv.S for details) ++ */ ++ *((unsigned int *)0xffff0ff0) = val; ++#endif ++ } ++ ++ } ++} ++ + static inline unsigned long get_tpuser(void) + { + unsigned long reg = 0; +@@ -59,5 +105,23 @@ static inline unsigned long get_tpuser(void) + + return reg; + } ++ ++static inline void set_tpuser(unsigned long val) ++{ ++ /* Since TPIDRURW is fully context-switched (unlike TPIDRURO), ++ * we need not update thread_info. ++ */ ++ if (has_tls_reg && !tls_emu) { ++ asm("mcr p15, 0, %0, c13, c0, 2" ++ : : "r" (val)); ++ } ++} ++ ++static inline void flush_tls(void) ++{ ++ set_tls(0); ++ set_tpuser(0); ++} ++ + #endif + #endif /* __ASMARM_TLS_H */ +diff --git a/arch/arm/kernel/irq.c b/arch/arm/kernel/irq.c +index 9723d17b8f38..1e782bdeee49 100644 +--- a/arch/arm/kernel/irq.c ++++ b/arch/arm/kernel/irq.c +@@ -163,7 +163,7 @@ static bool migrate_one_irq(struct irq_desc *desc) + c = irq_data_get_irq_chip(d); + if (!c->irq_set_affinity) + pr_debug("IRQ%u: unable to set affinity\n", d->irq); +- else if (c->irq_set_affinity(d, affinity, true) == IRQ_SET_MASK_OK && ret) ++ else if (c->irq_set_affinity(d, affinity, false) == IRQ_SET_MASK_OK && ret) + cpumask_copy(d->affinity, affinity); + + return ret; +diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c +index 92f7b15dd221..5f6e650ec9ab 100644 +--- a/arch/arm/kernel/process.c ++++ b/arch/arm/kernel/process.c +@@ -334,6 +334,8 @@ void flush_thread(void) + memset(&tsk->thread.debug, 0, sizeof(struct debug_info)); + memset(&thread->fpstate, 0, sizeof(union fp_state)); + ++ flush_tls(); ++ + thread_notify(THREAD_NOTIFY_FLUSH, thread); + } + +diff --git a/arch/arm/kernel/thumbee.c b/arch/arm/kernel/thumbee.c +index 7b8403b76666..80f0d69205e7 100644 +--- a/arch/arm/kernel/thumbee.c ++++ b/arch/arm/kernel/thumbee.c +@@ -45,7 +45,7 @@ static int thumbee_notifier(struct notifier_block *self, unsigned long cmd, void + + switch (cmd) { + case THREAD_NOTIFY_FLUSH: +- thread->thumbee_state = 0; ++ teehbr_write(0); + break; + case THREAD_NOTIFY_SWITCH: + current_thread_info()->thumbee_state = teehbr_read(); +diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c +index 172ee18ff124..9265b8bb529a 100644 +--- a/arch/arm/kernel/traps.c ++++ b/arch/arm/kernel/traps.c +@@ -578,7 +578,6 @@ do_cache_op(unsigned long start, unsigned long end, int flags) + #define NR(x) ((__ARM_NR_##x) - __ARM_NR_BASE) + asmlinkage int arm_syscall(int no, struct pt_regs *regs) + { +- struct thread_info *thread = current_thread_info(); + siginfo_t info; + + if ((no >> 16) != (__ARM_NR_BASE>> 16)) +@@ -629,21 +628,7 @@ asmlinkage int arm_syscall(int no, struct pt_regs *regs) + return regs->ARM_r0; + + case NR(set_tls): +- thread->tp_value[0] = regs->ARM_r0; +- if (tls_emu) +- return 0; +- if (has_tls_reg) { +- asm ("mcr p15, 0, %0, c13, c0, 3" +- : : "r" (regs->ARM_r0)); +- } else { +- /* +- * User space must never try to access this directly. +- * Expect your app to break eventually if you do so. +- * The user helper at 0xffff0fe0 must be used instead. +- * (see entry-armv.S for details) +- */ +- *((unsigned int *)0xffff0ff0) = regs->ARM_r0; +- } ++ set_tls(regs->ARM_r0); + return 0; + + #ifdef CONFIG_NEEDS_SYSCALL_FOR_CMPXCHG +diff --git a/arch/arm/kvm/handle_exit.c b/arch/arm/kvm/handle_exit.c +index 0de91fc6de0f..ec4fa868a7ba 100644 +--- a/arch/arm/kvm/handle_exit.c ++++ b/arch/arm/kvm/handle_exit.c +@@ -89,6 +89,8 @@ static int kvm_handle_wfx(struct kvm_vcpu *vcpu, struct kvm_run *run) + else + kvm_vcpu_block(vcpu); + ++ kvm_skip_instr(vcpu, kvm_vcpu_trap_il_is32bit(vcpu)); ++ + return 1; + } + +diff --git a/arch/arm/kvm/init.S b/arch/arm/kvm/init.S +index 1b9844d369cc..ee4f7447a1d3 100644 +--- a/arch/arm/kvm/init.S ++++ b/arch/arm/kvm/init.S +@@ -98,6 +98,10 @@ __do_hyp_init: + mrc p15, 0, r0, c10, c2, 1 + mcr p15, 4, r0, c10, c2, 1 + ++ @ Invalidate the stale TLBs from Bootloader ++ mcr p15, 4, r0, c8, c7, 0 @ TLBIALLH ++ dsb ish ++ + @ Set the HSCTLR to: + @ - ARM/THUMB exceptions: Kernel config (Thumb-2 kernel) + @ - Endianness: Kernel config +diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c +index c914b0052fb9..4551efd28f8d 100644 +--- a/arch/arm/mach-omap2/omap_hwmod.c ++++ b/arch/arm/mach-omap2/omap_hwmod.c +@@ -3349,6 +3349,9 @@ int __init omap_hwmod_register_links(struct omap_hwmod_ocp_if **ois) + if (!ois) + return 0; + ++ if (ois[0] == NULL) /* Empty list */ ++ return 0; ++ + if (!linkspace) { + if (_alloc_linkspace(ois)) { + pr_err("omap_hwmod: could not allocate link space\n"); +diff --git a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c +index 810c205d668b..2e35ff99f60e 100644 +--- a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c ++++ b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c +@@ -35,6 +35,7 @@ + #include "i2c.h" + #include "mmc.h" + #include "wd_timer.h" ++#include "soc.h" + + /* Base offset for all DRA7XX interrupts external to MPUSS */ + #define DRA7XX_IRQ_GIC_START 32 +@@ -2707,7 +2708,6 @@ static struct omap_hwmod_ocp_if *dra7xx_hwmod_ocp_ifs[] __initdata = { + &dra7xx_l4_per3__usb_otg_ss1, + &dra7xx_l4_per3__usb_otg_ss2, + &dra7xx_l4_per3__usb_otg_ss3, +- &dra7xx_l4_per3__usb_otg_ss4, + &dra7xx_l3_main_1__vcp1, + &dra7xx_l4_per2__vcp1, + &dra7xx_l3_main_1__vcp2, +@@ -2716,8 +2716,26 @@ static struct omap_hwmod_ocp_if *dra7xx_hwmod_ocp_ifs[] __initdata = { + NULL, + }; + ++static struct omap_hwmod_ocp_if *dra74x_hwmod_ocp_ifs[] __initdata = { ++ &dra7xx_l4_per3__usb_otg_ss4, ++ NULL, ++}; ++ ++static struct omap_hwmod_ocp_if *dra72x_hwmod_ocp_ifs[] __initdata = { ++ NULL, ++}; ++ + int __init dra7xx_hwmod_init(void) + { ++ int ret; ++ + omap_hwmod_init(); +- return omap_hwmod_register_links(dra7xx_hwmod_ocp_ifs); ++ ret = omap_hwmod_register_links(dra7xx_hwmod_ocp_ifs); ++ ++ if (!ret && soc_is_dra74x()) ++ return omap_hwmod_register_links(dra74x_hwmod_ocp_ifs); ++ else if (!ret && soc_is_dra72x()) ++ return omap_hwmod_register_links(dra72x_hwmod_ocp_ifs); ++ ++ return ret; + } +diff --git a/arch/arm/mach-omap2/soc.h b/arch/arm/mach-omap2/soc.h +index 076bd90a6ce0..8a9be09d9f38 100644 +--- a/arch/arm/mach-omap2/soc.h ++++ b/arch/arm/mach-omap2/soc.h +@@ -245,6 +245,8 @@ IS_AM_SUBCLASS(437x, 0x437) + #define soc_is_omap54xx() 0 + #define soc_is_omap543x() 0 + #define soc_is_dra7xx() 0 ++#define soc_is_dra74x() 0 ++#define soc_is_dra72x() 0 + + #if defined(MULTI_OMAP2) + # if defined(CONFIG_ARCH_OMAP2) +@@ -393,7 +395,11 @@ IS_OMAP_TYPE(3430, 0x3430) + + #if defined(CONFIG_SOC_DRA7XX) + #undef soc_is_dra7xx ++#undef soc_is_dra74x ++#undef soc_is_dra72x + #define soc_is_dra7xx() (of_machine_is_compatible("ti,dra7")) ++#define soc_is_dra74x() (of_machine_is_compatible("ti,dra74")) ++#define soc_is_dra72x() (of_machine_is_compatible("ti,dra72")) + #endif + + /* Various silicon revisions for omap2 */ +diff --git a/arch/arm/mm/abort-ev6.S b/arch/arm/mm/abort-ev6.S +index 3815a8262af0..8c48c5c22a33 100644 +--- a/arch/arm/mm/abort-ev6.S ++++ b/arch/arm/mm/abort-ev6.S +@@ -17,12 +17,6 @@ + */ + .align 5 + ENTRY(v6_early_abort) +-#ifdef CONFIG_CPU_V6 +- sub r1, sp, #4 @ Get unused stack location +- strex r0, r1, [r1] @ Clear the exclusive monitor +-#elif defined(CONFIG_CPU_32v6K) +- clrex +-#endif + mrc p15, 0, r1, c5, c0, 0 @ get FSR + mrc p15, 0, r0, c6, c0, 0 @ get FAR + /* +diff --git a/arch/arm/mm/abort-ev7.S b/arch/arm/mm/abort-ev7.S +index 703375277ba6..4812ad054214 100644 +--- a/arch/arm/mm/abort-ev7.S ++++ b/arch/arm/mm/abort-ev7.S +@@ -13,12 +13,6 @@ + */ + .align 5 + ENTRY(v7_early_abort) +- /* +- * The effect of data aborts on on the exclusive access monitor are +- * UNPREDICTABLE. Do a CLREX to clear the state +- */ +- clrex +- + mrc p15, 0, r1, c5, c0, 0 @ get FSR + mrc p15, 0, r0, c6, c0, 0 @ get FAR + +diff --git a/arch/arm/mm/alignment.c b/arch/arm/mm/alignment.c +index 924036473b16..d301662b7b32 100644 +--- a/arch/arm/mm/alignment.c ++++ b/arch/arm/mm/alignment.c +@@ -40,6 +40,7 @@ + * This code is not portable to processors with late data abort handling. + */ + #define CODING_BITS(i) (i & 0x0e000000) ++#define COND_BITS(i) (i & 0xf0000000) + + #define LDST_I_BIT(i) (i & (1 << 26)) /* Immediate constant */ + #define LDST_P_BIT(i) (i & (1 << 24)) /* Preindex */ +@@ -817,6 +818,8 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs) + break; + + case 0x04000000: /* ldr or str immediate */ ++ if (COND_BITS(instr) == 0xf0000000) /* NEON VLDn, VSTn */ ++ goto bad; + offset.un = OFFSET_BITS(instr); + handler = do_alignment_ldrstr; + break; +diff --git a/arch/arm64/include/asm/hw_breakpoint.h b/arch/arm64/include/asm/hw_breakpoint.h +index d064047612b1..52b484b6aa1a 100644 +--- a/arch/arm64/include/asm/hw_breakpoint.h ++++ b/arch/arm64/include/asm/hw_breakpoint.h +@@ -79,7 +79,6 @@ static inline void decode_ctrl_reg(u32 reg, + */ + #define ARM_MAX_BRP 16 + #define ARM_MAX_WRP 16 +-#define ARM_MAX_HBP_SLOTS (ARM_MAX_BRP + ARM_MAX_WRP) + + /* Virtual debug register bases. */ + #define AARCH64_DBG_REG_BVR 0 +diff --git a/arch/arm64/kernel/irq.c b/arch/arm64/kernel/irq.c +index 0f08dfd69ebc..dfa6e3e74fdd 100644 +--- a/arch/arm64/kernel/irq.c ++++ b/arch/arm64/kernel/irq.c +@@ -97,19 +97,15 @@ static bool migrate_one_irq(struct irq_desc *desc) + if (irqd_is_per_cpu(d) || !cpumask_test_cpu(smp_processor_id(), affinity)) + return false; + +- if (cpumask_any_and(affinity, cpu_online_mask) >= nr_cpu_ids) ++ if (cpumask_any_and(affinity, cpu_online_mask) >= nr_cpu_ids) { ++ affinity = cpu_online_mask; + ret = true; ++ } + +- /* +- * when using forced irq_set_affinity we must ensure that the cpu +- * being offlined is not present in the affinity mask, it may be +- * selected as the target CPU otherwise +- */ +- affinity = cpu_online_mask; + c = irq_data_get_irq_chip(d); + if (!c->irq_set_affinity) + pr_debug("IRQ%u: unable to set affinity\n", d->irq); +- else if (c->irq_set_affinity(d, affinity, true) == IRQ_SET_MASK_OK && ret) ++ else if (c->irq_set_affinity(d, affinity, false) == IRQ_SET_MASK_OK && ret) + cpumask_copy(d->affinity, affinity); + + return ret; +diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c +index 1c0a9be2ffa8..6e7e579c629d 100644 +--- a/arch/arm64/kernel/process.c ++++ b/arch/arm64/kernel/process.c +@@ -187,9 +187,27 @@ void exit_thread(void) + { + } + ++static void tls_thread_flush(void) ++{ ++ asm ("msr tpidr_el0, xzr"); ++ ++ if (is_compat_task()) { ++ current->thread.tp_value = 0; ++ ++ /* ++ * We need to ensure ordering between the shadow state and the ++ * hardware state, so that we don't corrupt the hardware state ++ * with a stale shadow state during context switch. ++ */ ++ barrier(); ++ asm ("msr tpidrro_el0, xzr"); ++ } ++} ++ + void flush_thread(void) + { + fpsimd_flush_thread(); ++ tls_thread_flush(); + flush_ptrace_hw_breakpoint(current); + } + +diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c +index 7a50b86464cc..b1269dac1289 100644 +--- a/arch/arm64/kernel/ptrace.c ++++ b/arch/arm64/kernel/ptrace.c +@@ -81,7 +81,8 @@ static void ptrace_hbptriggered(struct perf_event *bp, + break; + } + } +- for (i = ARM_MAX_BRP; i < ARM_MAX_HBP_SLOTS && !bp; ++i) { ++ ++ for (i = 0; i < ARM_MAX_WRP; ++i) { + if (current->thread.debug.hbp_watch[i] == bp) { + info.si_errno = -((i << 1) + 1); + break; +diff --git a/arch/arm64/kernel/sys_compat.c b/arch/arm64/kernel/sys_compat.c +index 26e9c4eeaba8..78039927c807 100644 +--- a/arch/arm64/kernel/sys_compat.c ++++ b/arch/arm64/kernel/sys_compat.c +@@ -79,6 +79,12 @@ long compat_arm_syscall(struct pt_regs *regs) + + case __ARM_NR_compat_set_tls: + current->thread.tp_value = regs->regs[0]; ++ ++ /* ++ * Protect against register corruption from context switch. ++ * See comment in tls_thread_flush. ++ */ ++ barrier(); + asm ("msr tpidrro_el0, %0" : : "r" (regs->regs[0])); + return 0; + +diff --git a/arch/arm64/kvm/handle_exit.c b/arch/arm64/kvm/handle_exit.c +index 7bc41eab4c64..fd9aeba99683 100644 +--- a/arch/arm64/kvm/handle_exit.c ++++ b/arch/arm64/kvm/handle_exit.c +@@ -62,6 +62,8 @@ static int kvm_handle_wfx(struct kvm_vcpu *vcpu, struct kvm_run *run) + else + kvm_vcpu_block(vcpu); + ++ kvm_skip_instr(vcpu, kvm_vcpu_trap_il_is32bit(vcpu)); ++ + return 1; + } + +diff --git a/arch/arm64/kvm/hyp-init.S b/arch/arm64/kvm/hyp-init.S +index 2b0244d65c16..12e26f358c31 100644 +--- a/arch/arm64/kvm/hyp-init.S ++++ b/arch/arm64/kvm/hyp-init.S +@@ -74,6 +74,10 @@ __do_hyp_init: + msr mair_el2, x4 + isb + ++ /* Invalidate the stale TLBs from Bootloader */ ++ tlbi alle2 ++ dsb sy ++ + mrs x4, sctlr_el2 + and x4, x4, #SCTLR_EL2_EE // preserve endianness of EL2 + ldr x5, =SCTLR_EL2_FLAGS +diff --git a/arch/mips/boot/compressed/decompress.c b/arch/mips/boot/compressed/decompress.c +index c00c4ddf4514..5244cecf1e45 100644 +--- a/arch/mips/boot/compressed/decompress.c ++++ b/arch/mips/boot/compressed/decompress.c +@@ -13,6 +13,7 @@ + + #include + #include ++#include + + #include + +diff --git a/arch/mips/kernel/mcount.S b/arch/mips/kernel/mcount.S +index 539b6294b613..8f89ff4ed524 100644 +--- a/arch/mips/kernel/mcount.S ++++ b/arch/mips/kernel/mcount.S +@@ -123,7 +123,11 @@ NESTED(_mcount, PT_SIZE, ra) + nop + #endif + b ftrace_stub ++#ifdef CONFIG_32BIT ++ addiu sp, sp, 8 ++#else + nop ++#endif + + static_trace: + MCOUNT_SAVE_REGS +@@ -133,6 +137,9 @@ static_trace: + move a1, AT /* arg2: parent's return address */ + + MCOUNT_RESTORE_REGS ++#ifdef CONFIG_32BIT ++ addiu sp, sp, 8 ++#endif + .globl ftrace_stub + ftrace_stub: + RETURN_BACK +@@ -177,6 +184,11 @@ NESTED(ftrace_graph_caller, PT_SIZE, ra) + jal prepare_ftrace_return + nop + MCOUNT_RESTORE_REGS ++#ifndef CONFIG_DYNAMIC_FTRACE ++#ifdef CONFIG_32BIT ++ addiu sp, sp, 8 ++#endif ++#endif + RETURN_BACK + END(ftrace_graph_caller) + +diff --git a/arch/parisc/Makefile b/arch/parisc/Makefile +index 7187664034c3..5db8882f732c 100644 +--- a/arch/parisc/Makefile ++++ b/arch/parisc/Makefile +@@ -48,7 +48,12 @@ cflags-y := -pipe + + # These flags should be implied by an hppa-linux configuration, but they + # are not in gcc 3.2. +-cflags-y += -mno-space-regs -mfast-indirect-calls ++cflags-y += -mno-space-regs ++ ++# -mfast-indirect-calls is only relevant for 32-bit kernels. ++ifndef CONFIG_64BIT ++cflags-y += -mfast-indirect-calls ++endif + + # Currently we save and restore fpregs on all kernel entry/interruption paths. + # If that gets optimized, we might need to disable the use of fpregs in the +diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S +index 838786011037..7ef22e3387e0 100644 +--- a/arch/parisc/kernel/syscall.S ++++ b/arch/parisc/kernel/syscall.S +@@ -74,7 +74,7 @@ ENTRY(linux_gateway_page) + /* ADDRESS 0xb0 to 0xb8, lws uses two insns for entry */ + /* Light-weight-syscall entry must always be located at 0xb0 */ + /* WARNING: Keep this number updated with table size changes */ +-#define __NR_lws_entries (2) ++#define __NR_lws_entries (3) + + lws_entry: + gate lws_start, %r0 /* increase privilege */ +@@ -502,7 +502,7 @@ lws_exit: + + + /*************************************************** +- Implementing CAS as an atomic operation: ++ Implementing 32bit CAS as an atomic operation: + + %r26 - Address to examine + %r25 - Old value to check (old) +@@ -659,6 +659,230 @@ cas_action: + ASM_EXCEPTIONTABLE_ENTRY(2b-linux_gateway_page, 3b-linux_gateway_page) + + ++ /*************************************************** ++ New CAS implementation which uses pointers and variable size ++ information. The value pointed by old and new MUST NOT change ++ while performing CAS. The lock only protect the value at %r26. ++ ++ %r26 - Address to examine ++ %r25 - Pointer to the value to check (old) ++ %r24 - Pointer to the value to set (new) ++ %r23 - Size of the variable (0/1/2/3 for 8/16/32/64 bit) ++ %r28 - Return non-zero on failure ++ %r21 - Kernel error code ++ ++ %r21 has the following meanings: ++ ++ EAGAIN - CAS is busy, ldcw failed, try again. ++ EFAULT - Read or write failed. ++ ++ Scratch: r20, r22, r28, r29, r1, fr4 (32bit for 64bit CAS only) ++ ++ ****************************************************/ ++ ++ /* ELF32 Process entry path */ ++lws_compare_and_swap_2: ++#ifdef CONFIG_64BIT ++ /* Clip the input registers */ ++ depdi 0, 31, 32, %r26 ++ depdi 0, 31, 32, %r25 ++ depdi 0, 31, 32, %r24 ++ depdi 0, 31, 32, %r23 ++#endif ++ ++ /* Check the validity of the size pointer */ ++ subi,>>= 4, %r23, %r0 ++ b,n lws_exit_nosys ++ ++ /* Jump to the functions which will load the old and new values into ++ registers depending on the their size */ ++ shlw %r23, 2, %r29 ++ blr %r29, %r0 ++ nop ++ ++ /* 8bit load */ ++4: ldb 0(%sr3,%r25), %r25 ++ b cas2_lock_start ++5: ldb 0(%sr3,%r24), %r24 ++ nop ++ nop ++ nop ++ nop ++ nop ++ ++ /* 16bit load */ ++6: ldh 0(%sr3,%r25), %r25 ++ b cas2_lock_start ++7: ldh 0(%sr3,%r24), %r24 ++ nop ++ nop ++ nop ++ nop ++ nop ++ ++ /* 32bit load */ ++8: ldw 0(%sr3,%r25), %r25 ++ b cas2_lock_start ++9: ldw 0(%sr3,%r24), %r24 ++ nop ++ nop ++ nop ++ nop ++ nop ++ ++ /* 64bit load */ ++#ifdef CONFIG_64BIT ++10: ldd 0(%sr3,%r25), %r25 ++11: ldd 0(%sr3,%r24), %r24 ++#else ++ /* Load new value into r22/r23 - high/low */ ++10: ldw 0(%sr3,%r25), %r22 ++11: ldw 4(%sr3,%r25), %r23 ++ /* Load new value into fr4 for atomic store later */ ++12: flddx 0(%sr3,%r24), %fr4 ++#endif ++ ++cas2_lock_start: ++ /* Load start of lock table */ ++ ldil L%lws_lock_start, %r20 ++ ldo R%lws_lock_start(%r20), %r28 ++ ++ /* Extract four bits from r26 and hash lock (Bits 4-7) */ ++ extru %r26, 27, 4, %r20 ++ ++ /* Find lock to use, the hash is either one of 0 to ++ 15, multiplied by 16 (keep it 16-byte aligned) ++ and add to the lock table offset. */ ++ shlw %r20, 4, %r20 ++ add %r20, %r28, %r20 ++ ++ rsm PSW_SM_I, %r0 /* Disable interrupts */ ++ /* COW breaks can cause contention on UP systems */ ++ LDCW 0(%sr2,%r20), %r28 /* Try to acquire the lock */ ++ cmpb,<>,n %r0, %r28, cas2_action /* Did we get it? */ ++cas2_wouldblock: ++ ldo 2(%r0), %r28 /* 2nd case */ ++ ssm PSW_SM_I, %r0 ++ b lws_exit /* Contended... */ ++ ldo -EAGAIN(%r0), %r21 /* Spin in userspace */ ++ ++ /* ++ prev = *addr; ++ if ( prev == old ) ++ *addr = new; ++ return prev; ++ */ ++ ++ /* NOTES: ++ This all works becuse intr_do_signal ++ and schedule both check the return iasq ++ and see that we are on the kernel page ++ so this process is never scheduled off ++ or is ever sent any signal of any sort, ++ thus it is wholly atomic from usrspaces ++ perspective ++ */ ++cas2_action: ++ /* Jump to the correct function */ ++ blr %r29, %r0 ++ /* Set %r28 as non-zero for now */ ++ ldo 1(%r0),%r28 ++ ++ /* 8bit CAS */ ++13: ldb,ma 0(%sr3,%r26), %r29 ++ sub,= %r29, %r25, %r0 ++ b,n cas2_end ++14: stb,ma %r24, 0(%sr3,%r26) ++ b cas2_end ++ copy %r0, %r28 ++ nop ++ nop ++ ++ /* 16bit CAS */ ++15: ldh,ma 0(%sr3,%r26), %r29 ++ sub,= %r29, %r25, %r0 ++ b,n cas2_end ++16: sth,ma %r24, 0(%sr3,%r26) ++ b cas2_end ++ copy %r0, %r28 ++ nop ++ nop ++ ++ /* 32bit CAS */ ++17: ldw,ma 0(%sr3,%r26), %r29 ++ sub,= %r29, %r25, %r0 ++ b,n cas2_end ++18: stw,ma %r24, 0(%sr3,%r26) ++ b cas2_end ++ copy %r0, %r28 ++ nop ++ nop ++ ++ /* 64bit CAS */ ++#ifdef CONFIG_64BIT ++19: ldd,ma 0(%sr3,%r26), %r29 ++ sub,= %r29, %r25, %r0 ++ b,n cas2_end ++20: std,ma %r24, 0(%sr3,%r26) ++ copy %r0, %r28 ++#else ++ /* Compare first word */ ++19: ldw,ma 0(%sr3,%r26), %r29 ++ sub,= %r29, %r22, %r0 ++ b,n cas2_end ++ /* Compare second word */ ++20: ldw,ma 4(%sr3,%r26), %r29 ++ sub,= %r29, %r23, %r0 ++ b,n cas2_end ++ /* Perform the store */ ++21: fstdx %fr4, 0(%sr3,%r26) ++ copy %r0, %r28 ++#endif ++ ++cas2_end: ++ /* Free lock */ ++ stw,ma %r20, 0(%sr2,%r20) ++ /* Enable interrupts */ ++ ssm PSW_SM_I, %r0 ++ /* Return to userspace, set no error */ ++ b lws_exit ++ copy %r0, %r21 ++ ++22: ++ /* Error occurred on load or store */ ++ /* Free lock */ ++ stw %r20, 0(%sr2,%r20) ++ ssm PSW_SM_I, %r0 ++ ldo 1(%r0),%r28 ++ b lws_exit ++ ldo -EFAULT(%r0),%r21 /* set errno */ ++ nop ++ nop ++ nop ++ ++ /* Exception table entries, for the load and store, return EFAULT. ++ Each of the entries must be relocated. */ ++ ASM_EXCEPTIONTABLE_ENTRY(4b-linux_gateway_page, 22b-linux_gateway_page) ++ ASM_EXCEPTIONTABLE_ENTRY(5b-linux_gateway_page, 22b-linux_gateway_page) ++ ASM_EXCEPTIONTABLE_ENTRY(6b-linux_gateway_page, 22b-linux_gateway_page) ++ ASM_EXCEPTIONTABLE_ENTRY(7b-linux_gateway_page, 22b-linux_gateway_page) ++ ASM_EXCEPTIONTABLE_ENTRY(8b-linux_gateway_page, 22b-linux_gateway_page) ++ ASM_EXCEPTIONTABLE_ENTRY(9b-linux_gateway_page, 22b-linux_gateway_page) ++ ASM_EXCEPTIONTABLE_ENTRY(10b-linux_gateway_page, 22b-linux_gateway_page) ++ ASM_EXCEPTIONTABLE_ENTRY(11b-linux_gateway_page, 22b-linux_gateway_page) ++ ASM_EXCEPTIONTABLE_ENTRY(13b-linux_gateway_page, 22b-linux_gateway_page) ++ ASM_EXCEPTIONTABLE_ENTRY(14b-linux_gateway_page, 22b-linux_gateway_page) ++ ASM_EXCEPTIONTABLE_ENTRY(15b-linux_gateway_page, 22b-linux_gateway_page) ++ ASM_EXCEPTIONTABLE_ENTRY(16b-linux_gateway_page, 22b-linux_gateway_page) ++ ASM_EXCEPTIONTABLE_ENTRY(17b-linux_gateway_page, 22b-linux_gateway_page) ++ ASM_EXCEPTIONTABLE_ENTRY(18b-linux_gateway_page, 22b-linux_gateway_page) ++ ASM_EXCEPTIONTABLE_ENTRY(19b-linux_gateway_page, 22b-linux_gateway_page) ++ ASM_EXCEPTIONTABLE_ENTRY(20b-linux_gateway_page, 22b-linux_gateway_page) ++#ifndef CONFIG_64BIT ++ ASM_EXCEPTIONTABLE_ENTRY(12b-linux_gateway_page, 22b-linux_gateway_page) ++ ASM_EXCEPTIONTABLE_ENTRY(21b-linux_gateway_page, 22b-linux_gateway_page) ++#endif ++ + /* Make sure nothing else is placed on this page */ + .align PAGE_SIZE + END(linux_gateway_page) +@@ -675,8 +899,9 @@ ENTRY(end_linux_gateway_page) + /* Light-weight-syscall table */ + /* Start of lws table. */ + ENTRY(lws_table) +- LWS_ENTRY(compare_and_swap32) /* 0 - ELF32 Atomic compare and swap */ +- LWS_ENTRY(compare_and_swap64) /* 1 - ELF64 Atomic compare and swap */ ++ LWS_ENTRY(compare_and_swap32) /* 0 - ELF32 Atomic 32bit CAS */ ++ LWS_ENTRY(compare_and_swap64) /* 1 - ELF64 Atomic 32bit CAS */ ++ LWS_ENTRY(compare_and_swap_2) /* 2 - ELF32 Atomic 64bit CAS */ + END(lws_table) + /* End of lws table */ + +diff --git a/arch/powerpc/include/asm/ptrace.h b/arch/powerpc/include/asm/ptrace.h +index 279b80f3bb29..c0c61fa9cd9e 100644 +--- a/arch/powerpc/include/asm/ptrace.h ++++ b/arch/powerpc/include/asm/ptrace.h +@@ -47,6 +47,12 @@ + STACK_FRAME_OVERHEAD + KERNEL_REDZONE_SIZE) + #define STACK_FRAME_MARKER 12 + ++#if defined(_CALL_ELF) && _CALL_ELF == 2 ++#define STACK_FRAME_MIN_SIZE 32 ++#else ++#define STACK_FRAME_MIN_SIZE STACK_FRAME_OVERHEAD ++#endif ++ + /* Size of dummy stack frame allocated when calling signal handler. */ + #define __SIGNAL_FRAMESIZE 128 + #define __SIGNAL_FRAMESIZE32 64 +@@ -60,6 +66,7 @@ + #define STACK_FRAME_REGS_MARKER ASM_CONST(0x72656773) + #define STACK_INT_FRAME_SIZE (sizeof(struct pt_regs) + STACK_FRAME_OVERHEAD) + #define STACK_FRAME_MARKER 2 ++#define STACK_FRAME_MIN_SIZE STACK_FRAME_OVERHEAD + + /* Size of stack frame allocated when calling signal handler. */ + #define __SIGNAL_FRAMESIZE 64 +diff --git a/arch/powerpc/include/asm/spinlock.h b/arch/powerpc/include/asm/spinlock.h +index 35aa339410bd..4dbe072eecbe 100644 +--- a/arch/powerpc/include/asm/spinlock.h ++++ b/arch/powerpc/include/asm/spinlock.h +@@ -61,6 +61,7 @@ static __always_inline int arch_spin_value_unlocked(arch_spinlock_t lock) + + static inline int arch_spin_is_locked(arch_spinlock_t *lock) + { ++ smp_mb(); + return !arch_spin_value_unlocked(*lock); + } + +diff --git a/arch/powerpc/lib/locks.c b/arch/powerpc/lib/locks.c +index 0c9c8d7d0734..170a0346f756 100644 +--- a/arch/powerpc/lib/locks.c ++++ b/arch/powerpc/lib/locks.c +@@ -70,12 +70,16 @@ void __rw_yield(arch_rwlock_t *rw) + + void arch_spin_unlock_wait(arch_spinlock_t *lock) + { ++ smp_mb(); ++ + while (lock->slock) { + HMT_low(); + if (SHARED_PROCESSOR) + __spin_yield(lock); + } + HMT_medium(); ++ ++ smp_mb(); + } + + EXPORT_SYMBOL(arch_spin_unlock_wait); +diff --git a/arch/powerpc/perf/callchain.c b/arch/powerpc/perf/callchain.c +index 74d1e780748b..2396dda282cd 100644 +--- a/arch/powerpc/perf/callchain.c ++++ b/arch/powerpc/perf/callchain.c +@@ -35,7 +35,7 @@ static int valid_next_sp(unsigned long sp, unsigned long prev_sp) + return 0; /* must be 16-byte aligned */ + if (!validate_sp(sp, current, STACK_FRAME_OVERHEAD)) + return 0; +- if (sp >= prev_sp + STACK_FRAME_OVERHEAD) ++ if (sp >= prev_sp + STACK_FRAME_MIN_SIZE) + return 1; + /* + * sp could decrease when we jump off an interrupt stack +diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c +index 3584ed9b20a1..e309c5c41158 100644 +--- a/arch/s390/mm/pgtable.c ++++ b/arch/s390/mm/pgtable.c +@@ -810,11 +810,21 @@ int set_guest_storage_key(struct mm_struct *mm, unsigned long addr, + pte_t *ptep; + + down_read(&mm->mmap_sem); ++retry: + ptep = get_locked_pte(current->mm, addr, &ptl); + if (unlikely(!ptep)) { + up_read(&mm->mmap_sem); + return -EFAULT; + } ++ if (!(pte_val(*ptep) & _PAGE_INVALID) && ++ (pte_val(*ptep) & _PAGE_PROTECT)) { ++ pte_unmap_unlock(*ptep, ptl); ++ if (fixup_user_fault(current, mm, addr, FAULT_FLAG_WRITE)) { ++ up_read(&mm->mmap_sem); ++ return -EFAULT; ++ } ++ goto retry; ++ } + + new = old = pgste_get_lock(ptep); + pgste_val(new) &= ~(PGSTE_GR_BIT | PGSTE_GC_BIT | +diff --git a/arch/x86/boot/compressed/aslr.c b/arch/x86/boot/compressed/aslr.c +index 4dbf967da50d..6cfcf2a2eb93 100644 +--- a/arch/x86/boot/compressed/aslr.c ++++ b/arch/x86/boot/compressed/aslr.c +@@ -183,12 +183,27 @@ static void mem_avoid_init(unsigned long input, unsigned long input_size, + static bool mem_avoid_overlap(struct mem_vector *img) + { + int i; ++ struct setup_data *ptr; + + for (i = 0; i < MEM_AVOID_MAX; i++) { + if (mem_overlaps(img, &mem_avoid[i])) + return true; + } + ++ /* Avoid all entries in the setup_data linked list. */ ++ ptr = (struct setup_data *)(unsigned long)real_mode->hdr.setup_data; ++ while (ptr) { ++ struct mem_vector avoid; ++ ++ avoid.start = (u64)ptr; ++ avoid.size = sizeof(*ptr) + ptr->len; ++ ++ if (mem_overlaps(img, &avoid)) ++ return true; ++ ++ ptr = (struct setup_data *)(unsigned long)ptr->next; ++ } ++ + return false; + } + +diff --git a/arch/x86/include/asm/fixmap.h b/arch/x86/include/asm/fixmap.h +index 7252cd339175..6762a55b798a 100644 +--- a/arch/x86/include/asm/fixmap.h ++++ b/arch/x86/include/asm/fixmap.h +@@ -123,14 +123,14 @@ enum fixed_addresses { + __end_of_permanent_fixed_addresses, + + /* +- * 256 temporary boot-time mappings, used by early_ioremap(), ++ * 512 temporary boot-time mappings, used by early_ioremap(), + * before ioremap() is functional. + * +- * If necessary we round it up to the next 256 pages boundary so ++ * If necessary we round it up to the next 512 pages boundary so + * that we can have a single pgd entry and a single pte table: + */ + #define NR_FIX_BTMAPS 64 +-#define FIX_BTMAPS_SLOTS 4 ++#define FIX_BTMAPS_SLOTS 8 + #define TOTAL_FIX_BTMAPS (NR_FIX_BTMAPS * FIX_BTMAPS_SLOTS) + FIX_BTMAP_END = + (__end_of_permanent_fixed_addresses ^ +diff --git a/arch/x86/include/asm/pgtable_64.h b/arch/x86/include/asm/pgtable_64.h +index e22c1dbf7feb..d869931bde62 100644 +--- a/arch/x86/include/asm/pgtable_64.h ++++ b/arch/x86/include/asm/pgtable_64.h +@@ -19,6 +19,7 @@ extern pud_t level3_ident_pgt[512]; + extern pmd_t level2_kernel_pgt[512]; + extern pmd_t level2_fixmap_pgt[512]; + extern pmd_t level2_ident_pgt[512]; ++extern pte_t level1_fixmap_pgt[512]; + extern pgd_t init_level4_pgt[]; + + #define swapper_pg_dir init_level4_pgt +diff --git a/arch/x86/kernel/cpu/perf_event_intel_rapl.c b/arch/x86/kernel/cpu/perf_event_intel_rapl.c +index 5ad35ad94d0f..95700e52061d 100644 +--- a/arch/x86/kernel/cpu/perf_event_intel_rapl.c ++++ b/arch/x86/kernel/cpu/perf_event_intel_rapl.c +@@ -511,6 +511,7 @@ static int rapl_cpu_prepare(int cpu) + struct rapl_pmu *pmu = per_cpu(rapl_pmu, cpu); + int phys_id = topology_physical_package_id(cpu); + u64 ms; ++ u64 msr_rapl_power_unit_bits; + + if (pmu) + return 0; +@@ -518,6 +519,9 @@ static int rapl_cpu_prepare(int cpu) + if (phys_id < 0) + return -1; + ++ if (!rdmsrl_safe(MSR_RAPL_POWER_UNIT, &msr_rapl_power_unit_bits)) ++ return -1; ++ + pmu = kzalloc_node(sizeof(*pmu), GFP_KERNEL, cpu_to_node(cpu)); + if (!pmu) + return -1; +@@ -531,8 +535,7 @@ static int rapl_cpu_prepare(int cpu) + * + * we cache in local PMU instance + */ +- rdmsrl(MSR_RAPL_POWER_UNIT, pmu->hw_unit); +- pmu->hw_unit = (pmu->hw_unit >> 8) & 0x1FULL; ++ pmu->hw_unit = (msr_rapl_power_unit_bits >> 8) & 0x1FULL; + pmu->pmu = &rapl_pmu_class; + + /* +@@ -649,7 +652,9 @@ static int __init rapl_pmu_init(void) + get_online_cpus(); + + for_each_online_cpu(cpu) { +- rapl_cpu_prepare(cpu); ++ ret = rapl_cpu_prepare(cpu); ++ if (ret) ++ goto out; + rapl_cpu_init(cpu); + } + +@@ -672,6 +677,7 @@ static int __init rapl_pmu_init(void) + hweight32(rapl_cntr_mask), + ktime_to_ms(pmu->timer_interval)); + ++out: + put_online_cpus(); + + return 0; +diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c +index 395be6d8bbde..682876533ed9 100644 +--- a/arch/x86/kernel/smpboot.c ++++ b/arch/x86/kernel/smpboot.c +@@ -1287,6 +1287,9 @@ static void remove_siblinginfo(int cpu) + + for_each_cpu(sibling, cpu_sibling_mask(cpu)) + cpumask_clear_cpu(cpu, cpu_sibling_mask(sibling)); ++ for_each_cpu(sibling, cpu_llc_shared_mask(cpu)) ++ cpumask_clear_cpu(cpu, cpu_llc_shared_mask(sibling)); ++ cpumask_clear(cpu_llc_shared_mask(cpu)); + cpumask_clear(cpu_sibling_mask(cpu)); + cpumask_clear(cpu_core_mask(cpu)); + c->phys_proc_id = 0; +diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c +index 2423ef04ffea..c83da6fb2dee 100644 +--- a/arch/x86/xen/mmu.c ++++ b/arch/x86/xen/mmu.c +@@ -1866,12 +1866,11 @@ static void __init check_pt_base(unsigned long *pt_base, unsigned long *pt_end, + * + * We can construct this by grafting the Xen provided pagetable into + * head_64.S's preconstructed pagetables. We copy the Xen L2's into +- * level2_ident_pgt, level2_kernel_pgt and level2_fixmap_pgt. This +- * means that only the kernel has a physical mapping to start with - +- * but that's enough to get __va working. We need to fill in the rest +- * of the physical mapping once some sort of allocator has been set +- * up. +- * NOTE: for PVH, the page tables are native. ++ * level2_ident_pgt, and level2_kernel_pgt. This means that only the ++ * kernel has a physical mapping to start with - but that's enough to ++ * get __va working. We need to fill in the rest of the physical ++ * mapping once some sort of allocator has been set up. NOTE: for ++ * PVH, the page tables are native. + */ + void __init xen_setup_kernel_pagetable(pgd_t *pgd, unsigned long max_pfn) + { +@@ -1902,8 +1901,11 @@ void __init xen_setup_kernel_pagetable(pgd_t *pgd, unsigned long max_pfn) + /* L3_i[0] -> level2_ident_pgt */ + convert_pfn_mfn(level3_ident_pgt); + /* L3_k[510] -> level2_kernel_pgt +- * L3_i[511] -> level2_fixmap_pgt */ ++ * L3_k[511] -> level2_fixmap_pgt */ + convert_pfn_mfn(level3_kernel_pgt); ++ ++ /* L3_k[511][506] -> level1_fixmap_pgt */ ++ convert_pfn_mfn(level2_fixmap_pgt); + } + /* We get [511][511] and have Xen's version of level2_kernel_pgt */ + l3 = m2v(pgd[pgd_index(__START_KERNEL_map)].pgd); +@@ -1913,21 +1915,15 @@ void __init xen_setup_kernel_pagetable(pgd_t *pgd, unsigned long max_pfn) + addr[1] = (unsigned long)l3; + addr[2] = (unsigned long)l2; + /* Graft it onto L4[272][0]. Note that we creating an aliasing problem: +- * Both L4[272][0] and L4[511][511] have entries that point to the same ++ * Both L4[272][0] and L4[511][510] have entries that point to the same + * L2 (PMD) tables. Meaning that if you modify it in __va space + * it will be also modified in the __ka space! (But if you just + * modify the PMD table to point to other PTE's or none, then you + * are OK - which is what cleanup_highmap does) */ + copy_page(level2_ident_pgt, l2); +- /* Graft it onto L4[511][511] */ ++ /* Graft it onto L4[511][510] */ + copy_page(level2_kernel_pgt, l2); + +- /* Get [511][510] and graft that in level2_fixmap_pgt */ +- l3 = m2v(pgd[pgd_index(__START_KERNEL_map + PMD_SIZE)].pgd); +- l2 = m2v(l3[pud_index(__START_KERNEL_map + PMD_SIZE)].pud); +- copy_page(level2_fixmap_pgt, l2); +- /* Note that we don't do anything with level1_fixmap_pgt which +- * we don't need. */ + if (!xen_feature(XENFEAT_auto_translated_physmap)) { + /* Make pagetable pieces RO */ + set_page_prot(init_level4_pgt, PAGE_KERNEL_RO); +@@ -1937,6 +1933,7 @@ void __init xen_setup_kernel_pagetable(pgd_t *pgd, unsigned long max_pfn) + set_page_prot(level2_ident_pgt, PAGE_KERNEL_RO); + set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO); + set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO); ++ set_page_prot(level1_fixmap_pgt, PAGE_KERNEL_RO); + + /* Pin down new L4 */ + pin_pagetable_pfn(MMUEXT_PIN_L4_TABLE, +diff --git a/arch/xtensa/include/asm/pgtable.h b/arch/xtensa/include/asm/pgtable.h +index 216446295ada..51230ba97bef 100644 +--- a/arch/xtensa/include/asm/pgtable.h ++++ b/arch/xtensa/include/asm/pgtable.h +@@ -67,7 +67,12 @@ + #define VMALLOC_START 0xC0000000 + #define VMALLOC_END 0xC7FEFFFF + #define TLBTEMP_BASE_1 0xC7FF0000 +-#define TLBTEMP_BASE_2 0xC7FF8000 ++#define TLBTEMP_BASE_2 (TLBTEMP_BASE_1 + DCACHE_WAY_SIZE) ++#if 2 * DCACHE_WAY_SIZE > ICACHE_WAY_SIZE ++#define TLBTEMP_SIZE (2 * DCACHE_WAY_SIZE) ++#else ++#define TLBTEMP_SIZE ICACHE_WAY_SIZE ++#endif + + /* + * For the Xtensa architecture, the PTE layout is as follows: +diff --git a/arch/xtensa/include/asm/uaccess.h b/arch/xtensa/include/asm/uaccess.h +index fd686dc45d1a..c7211e7e182d 100644 +--- a/arch/xtensa/include/asm/uaccess.h ++++ b/arch/xtensa/include/asm/uaccess.h +@@ -52,7 +52,12 @@ + */ + .macro get_fs ad, sp + GET_CURRENT(\ad,\sp) ++#if THREAD_CURRENT_DS > 1020 ++ addi \ad, \ad, TASK_THREAD ++ l32i \ad, \ad, THREAD_CURRENT_DS - TASK_THREAD ++#else + l32i \ad, \ad, THREAD_CURRENT_DS ++#endif + .endm + + /* +diff --git a/arch/xtensa/include/uapi/asm/ioctls.h b/arch/xtensa/include/uapi/asm/ioctls.h +index b4cb1100c0fb..a47909f0c34b 100644 +--- a/arch/xtensa/include/uapi/asm/ioctls.h ++++ b/arch/xtensa/include/uapi/asm/ioctls.h +@@ -28,17 +28,17 @@ + #define TCSETSW 0x5403 + #define TCSETSF 0x5404 + +-#define TCGETA _IOR('t', 23, struct termio) +-#define TCSETA _IOW('t', 24, struct termio) +-#define TCSETAW _IOW('t', 25, struct termio) +-#define TCSETAF _IOW('t', 28, struct termio) ++#define TCGETA 0x80127417 /* _IOR('t', 23, struct termio) */ ++#define TCSETA 0x40127418 /* _IOW('t', 24, struct termio) */ ++#define TCSETAW 0x40127419 /* _IOW('t', 25, struct termio) */ ++#define TCSETAF 0x4012741C /* _IOW('t', 28, struct termio) */ + + #define TCSBRK _IO('t', 29) + #define TCXONC _IO('t', 30) + #define TCFLSH _IO('t', 31) + +-#define TIOCSWINSZ _IOW('t', 103, struct winsize) +-#define TIOCGWINSZ _IOR('t', 104, struct winsize) ++#define TIOCSWINSZ 0x40087467 /* _IOW('t', 103, struct winsize) */ ++#define TIOCGWINSZ 0x80087468 /* _IOR('t', 104, struct winsize) */ + #define TIOCSTART _IO('t', 110) /* start output, like ^Q */ + #define TIOCSTOP _IO('t', 111) /* stop output, like ^S */ + #define TIOCOUTQ _IOR('t', 115, int) /* output queue size */ +@@ -88,7 +88,6 @@ + #define TIOCSETD _IOW('T', 35, int) + #define TIOCGETD _IOR('T', 36, int) + #define TCSBRKP _IOW('T', 37, int) /* Needed for POSIX tcsendbreak()*/ +-#define TIOCTTYGSTRUCT _IOR('T', 38, struct tty_struct) /* For debugging only*/ + #define TIOCSBRK _IO('T', 39) /* BSD compatibility */ + #define TIOCCBRK _IO('T', 40) /* BSD compatibility */ + #define TIOCGSID _IOR('T', 41, pid_t) /* Return the session ID of FD*/ +@@ -114,8 +113,10 @@ + #define TIOCSERGETLSR _IOR('T', 89, unsigned int) /* Get line status reg. */ + /* ioctl (fd, TIOCSERGETLSR, &result) where result may be as below */ + # define TIOCSER_TEMT 0x01 /* Transmitter physically empty */ +-#define TIOCSERGETMULTI _IOR('T', 90, struct serial_multiport_struct) /* Get multiport config */ +-#define TIOCSERSETMULTI _IOW('T', 91, struct serial_multiport_struct) /* Set multiport config */ ++#define TIOCSERGETMULTI 0x80a8545a /* Get multiport config */ ++ /* _IOR('T', 90, struct serial_multiport_struct) */ ++#define TIOCSERSETMULTI 0x40a8545b /* Set multiport config */ ++ /* _IOW('T', 91, struct serial_multiport_struct) */ + + #define TIOCMIWAIT _IO('T', 92) /* wait for a change on serial input line(s) */ + #define TIOCGICOUNT 0x545D /* read serial port inline interrupt counts */ +diff --git a/arch/xtensa/kernel/entry.S b/arch/xtensa/kernel/entry.S +index ef7f4990722b..a06b7efaae82 100644 +--- a/arch/xtensa/kernel/entry.S ++++ b/arch/xtensa/kernel/entry.S +@@ -1001,9 +1001,8 @@ ENTRY(fast_syscall_xtensa) + movi a7, 4 # sizeof(unsigned int) + access_ok a3, a7, a0, a2, .Leac # a0: scratch reg, a2: sp + +- addi a6, a6, -1 # assuming SYS_XTENSA_ATOMIC_SET = 1 +- _bgeui a6, SYS_XTENSA_COUNT - 1, .Lill +- _bnei a6, SYS_XTENSA_ATOMIC_CMP_SWP - 1, .Lnswp ++ _bgeui a6, SYS_XTENSA_COUNT, .Lill ++ _bnei a6, SYS_XTENSA_ATOMIC_CMP_SWP, .Lnswp + + /* Fall through for ATOMIC_CMP_SWP. */ + +@@ -1015,27 +1014,26 @@ TRY s32i a5, a3, 0 # different, modify value + l32i a7, a2, PT_AREG7 # restore a7 + l32i a0, a2, PT_AREG0 # restore a0 + movi a2, 1 # and return 1 +- addi a6, a6, 1 # restore a6 (really necessary?) + rfe + + 1: l32i a7, a2, PT_AREG7 # restore a7 + l32i a0, a2, PT_AREG0 # restore a0 + movi a2, 0 # return 0 (note that we cannot set +- addi a6, a6, 1 # restore a6 (really necessary?) + rfe + + .Lnswp: /* Atomic set, add, and exg_add. */ + + TRY l32i a7, a3, 0 # orig ++ addi a6, a6, -SYS_XTENSA_ATOMIC_SET + add a0, a4, a7 # + arg + moveqz a0, a4, a6 # set ++ addi a6, a6, SYS_XTENSA_ATOMIC_SET + TRY s32i a0, a3, 0 # write new value + + mov a0, a2 + mov a2, a7 + l32i a7, a0, PT_AREG7 # restore a7 + l32i a0, a0, PT_AREG0 # restore a0 +- addi a6, a6, 1 # restore a6 (really necessary?) + rfe + + CATCH +@@ -1044,7 +1042,7 @@ CATCH + movi a2, -EFAULT + rfe + +-.Lill: l32i a7, a2, PT_AREG0 # restore a7 ++.Lill: l32i a7, a2, PT_AREG7 # restore a7 + l32i a0, a2, PT_AREG0 # restore a0 + movi a2, -EINVAL + rfe +@@ -1565,7 +1563,7 @@ ENTRY(fast_second_level_miss) + rsr a0, excvaddr + bltu a0, a3, 2f + +- addi a1, a0, -(2 << (DCACHE_ALIAS_ORDER + PAGE_SHIFT)) ++ addi a1, a0, -TLBTEMP_SIZE + bgeu a1, a3, 2f + + /* Check if we have to restore an ITLB mapping. */ +@@ -1820,7 +1818,6 @@ ENTRY(_switch_to) + + entry a1, 16 + +- mov a10, a2 # preserve 'prev' (a2) + mov a11, a3 # and 'next' (a3) + + l32i a4, a2, TASK_THREAD_INFO +@@ -1828,8 +1825,14 @@ ENTRY(_switch_to) + + save_xtregs_user a4 a6 a8 a9 a12 a13 THREAD_XTREGS_USER + +- s32i a0, a10, THREAD_RA # save return address +- s32i a1, a10, THREAD_SP # save stack pointer ++#if THREAD_RA > 1020 || THREAD_SP > 1020 ++ addi a10, a2, TASK_THREAD ++ s32i a0, a10, THREAD_RA - TASK_THREAD # save return address ++ s32i a1, a10, THREAD_SP - TASK_THREAD # save stack pointer ++#else ++ s32i a0, a2, THREAD_RA # save return address ++ s32i a1, a2, THREAD_SP # save stack pointer ++#endif + + /* Disable ints while we manipulate the stack pointer. */ + +@@ -1870,7 +1873,6 @@ ENTRY(_switch_to) + load_xtregs_user a5 a6 a8 a9 a12 a13 THREAD_XTREGS_USER + + wsr a14, ps +- mov a2, a10 # return 'prev' + rsync + + retw +diff --git a/arch/xtensa/kernel/pci-dma.c b/arch/xtensa/kernel/pci-dma.c +index 2d9cc6dbfd78..e8b76b8e4b29 100644 +--- a/arch/xtensa/kernel/pci-dma.c ++++ b/arch/xtensa/kernel/pci-dma.c +@@ -49,9 +49,8 @@ dma_alloc_coherent(struct device *dev,size_t size,dma_addr_t *handle,gfp_t flag) + + /* We currently don't support coherent memory outside KSEG */ + +- if (ret < XCHAL_KSEG_CACHED_VADDR +- || ret >= XCHAL_KSEG_CACHED_VADDR + XCHAL_KSEG_SIZE) +- BUG(); ++ BUG_ON(ret < XCHAL_KSEG_CACHED_VADDR || ++ ret > XCHAL_KSEG_CACHED_VADDR + XCHAL_KSEG_SIZE - 1); + + + if (ret != 0) { +@@ -68,10 +67,11 @@ EXPORT_SYMBOL(dma_alloc_coherent); + void dma_free_coherent(struct device *hwdev, size_t size, + void *vaddr, dma_addr_t dma_handle) + { +- long addr=(long)vaddr+XCHAL_KSEG_CACHED_VADDR-XCHAL_KSEG_BYPASS_VADDR; ++ unsigned long addr = (unsigned long)vaddr + ++ XCHAL_KSEG_CACHED_VADDR - XCHAL_KSEG_BYPASS_VADDR; + +- if (addr < 0 || addr >= XCHAL_KSEG_SIZE) +- BUG(); ++ BUG_ON(addr < XCHAL_KSEG_CACHED_VADDR || ++ addr > XCHAL_KSEG_CACHED_VADDR + XCHAL_KSEG_SIZE - 1); + + free_pages(addr, get_order(size)); + } +diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c +index 744833b630c6..91c25f261c91 100644 +--- a/block/cfq-iosched.c ++++ b/block/cfq-iosched.c +@@ -1275,12 +1275,16 @@ __cfq_group_service_tree_add(struct cfq_rb_root *st, struct cfq_group *cfqg) + static void + cfq_update_group_weight(struct cfq_group *cfqg) + { +- BUG_ON(!RB_EMPTY_NODE(&cfqg->rb_node)); +- + if (cfqg->new_weight) { + cfqg->weight = cfqg->new_weight; + cfqg->new_weight = 0; + } ++} ++ ++static void ++cfq_update_group_leaf_weight(struct cfq_group *cfqg) ++{ ++ BUG_ON(!RB_EMPTY_NODE(&cfqg->rb_node)); + + if (cfqg->new_leaf_weight) { + cfqg->leaf_weight = cfqg->new_leaf_weight; +@@ -1299,7 +1303,7 @@ cfq_group_service_tree_add(struct cfq_rb_root *st, struct cfq_group *cfqg) + /* add to the service tree */ + BUG_ON(!RB_EMPTY_NODE(&cfqg->rb_node)); + +- cfq_update_group_weight(cfqg); ++ cfq_update_group_leaf_weight(cfqg); + __cfq_group_service_tree_add(st, cfqg); + + /* +@@ -1323,6 +1327,7 @@ cfq_group_service_tree_add(struct cfq_rb_root *st, struct cfq_group *cfqg) + */ + while ((parent = cfqg_parent(pos))) { + if (propagate) { ++ cfq_update_group_weight(pos); + propagate = !parent->nr_active++; + parent->children_weight += pos->weight; + } +diff --git a/block/genhd.c b/block/genhd.c +index 791f41943132..e6723bd4d7a1 100644 +--- a/block/genhd.c ++++ b/block/genhd.c +@@ -28,10 +28,10 @@ struct kobject *block_depr; + /* for extended dynamic devt allocation, currently only one major is used */ + #define NR_EXT_DEVT (1 << MINORBITS) + +-/* For extended devt allocation. ext_devt_mutex prevents look up ++/* For extended devt allocation. ext_devt_lock prevents look up + * results from going away underneath its user. + */ +-static DEFINE_MUTEX(ext_devt_mutex); ++static DEFINE_SPINLOCK(ext_devt_lock); + static DEFINE_IDR(ext_devt_idr); + + static struct device_type disk_type; +@@ -420,9 +420,13 @@ int blk_alloc_devt(struct hd_struct *part, dev_t *devt) + } + + /* allocate ext devt */ +- mutex_lock(&ext_devt_mutex); +- idx = idr_alloc(&ext_devt_idr, part, 0, NR_EXT_DEVT, GFP_KERNEL); +- mutex_unlock(&ext_devt_mutex); ++ idr_preload(GFP_KERNEL); ++ ++ spin_lock(&ext_devt_lock); ++ idx = idr_alloc(&ext_devt_idr, part, 0, NR_EXT_DEVT, GFP_NOWAIT); ++ spin_unlock(&ext_devt_lock); ++ ++ idr_preload_end(); + if (idx < 0) + return idx == -ENOSPC ? -EBUSY : idx; + +@@ -441,15 +445,13 @@ int blk_alloc_devt(struct hd_struct *part, dev_t *devt) + */ + void blk_free_devt(dev_t devt) + { +- might_sleep(); +- + if (devt == MKDEV(0, 0)) + return; + + if (MAJOR(devt) == BLOCK_EXT_MAJOR) { +- mutex_lock(&ext_devt_mutex); ++ spin_lock(&ext_devt_lock); + idr_remove(&ext_devt_idr, blk_mangle_minor(MINOR(devt))); +- mutex_unlock(&ext_devt_mutex); ++ spin_unlock(&ext_devt_lock); + } + } + +@@ -665,7 +667,6 @@ void del_gendisk(struct gendisk *disk) + sysfs_remove_link(block_depr, dev_name(disk_to_dev(disk))); + pm_runtime_set_memalloc_noio(disk_to_dev(disk), false); + device_del(disk_to_dev(disk)); +- blk_free_devt(disk_to_dev(disk)->devt); + } + EXPORT_SYMBOL(del_gendisk); + +@@ -690,13 +691,13 @@ struct gendisk *get_gendisk(dev_t devt, int *partno) + } else { + struct hd_struct *part; + +- mutex_lock(&ext_devt_mutex); ++ spin_lock(&ext_devt_lock); + part = idr_find(&ext_devt_idr, blk_mangle_minor(MINOR(devt))); + if (part && get_disk(part_to_disk(part))) { + *partno = part->partno; + disk = part_to_disk(part); + } +- mutex_unlock(&ext_devt_mutex); ++ spin_unlock(&ext_devt_lock); + } + + return disk; +@@ -1098,6 +1099,7 @@ static void disk_release(struct device *dev) + { + struct gendisk *disk = dev_to_disk(dev); + ++ blk_free_devt(dev->devt); + disk_release_events(disk); + kfree(disk->random); + disk_replace_part_tbl(disk, NULL); +diff --git a/block/partition-generic.c b/block/partition-generic.c +index 789cdea05893..0d9e5f97f0a8 100644 +--- a/block/partition-generic.c ++++ b/block/partition-generic.c +@@ -211,6 +211,7 @@ static const struct attribute_group *part_attr_groups[] = { + static void part_release(struct device *dev) + { + struct hd_struct *p = dev_to_part(dev); ++ blk_free_devt(dev->devt); + free_part_stats(p); + free_part_info(p); + kfree(p); +@@ -253,7 +254,6 @@ void delete_partition(struct gendisk *disk, int partno) + rcu_assign_pointer(ptbl->last_lookup, NULL); + kobject_put(part->holder_dir); + device_del(part_to_dev(part)); +- blk_free_devt(part_devt(part)); + + hd_struct_put(part); + } +diff --git a/block/partitions/aix.c b/block/partitions/aix.c +index 43be471d9b1d..0931f5136ab2 100644 +--- a/block/partitions/aix.c ++++ b/block/partitions/aix.c +@@ -253,7 +253,7 @@ int aix_partition(struct parsed_partitions *state) + continue; + } + lv_ix = be16_to_cpu(p->lv_ix) - 1; +- if (lv_ix > state->limit) { ++ if (lv_ix >= state->limit) { + cur_lv_ix = -1; + continue; + } +diff --git a/drivers/acpi/acpi_cmos_rtc.c b/drivers/acpi/acpi_cmos_rtc.c +index 84190ed89c04..aff69d9bfcbf 100644 +--- a/drivers/acpi/acpi_cmos_rtc.c ++++ b/drivers/acpi/acpi_cmos_rtc.c +@@ -35,7 +35,7 @@ acpi_cmos_rtc_space_handler(u32 function, acpi_physical_address address, + void *handler_context, void *region_context) + { + int i; +- u8 *value = (u8 *)&value64; ++ u8 *value = (u8 *)value64; + + if (address > 0xff || !value64) + return AE_BAD_PARAMETER; +diff --git a/drivers/acpi/acpica/aclocal.h b/drivers/acpi/acpica/aclocal.h +index d95ca5449ace..e6ab104afe42 100644 +--- a/drivers/acpi/acpica/aclocal.h ++++ b/drivers/acpi/acpica/aclocal.h +@@ -254,6 +254,7 @@ struct acpi_create_field_info { + u32 field_bit_position; + u32 field_bit_length; + u16 resource_length; ++ u16 pin_number_index; + u8 field_flags; + u8 attribute; + u8 field_type; +diff --git a/drivers/acpi/acpica/acobject.h b/drivers/acpi/acpica/acobject.h +index cc7ab6dd724e..a47cc78ffd4f 100644 +--- a/drivers/acpi/acpica/acobject.h ++++ b/drivers/acpi/acpica/acobject.h +@@ -263,6 +263,7 @@ struct acpi_object_region_field { + ACPI_OBJECT_COMMON_HEADER ACPI_COMMON_FIELD_INFO u16 resource_length; + union acpi_operand_object *region_obj; /* Containing op_region object */ + u8 *resource_buffer; /* resource_template for serial regions/fields */ ++ u16 pin_number_index; /* Index relative to previous Connection/Template */ + }; + + struct acpi_object_bank_field { +diff --git a/drivers/acpi/acpica/dsfield.c b/drivers/acpi/acpica/dsfield.c +index e7a57c554e84..9af55bd6c4d7 100644 +--- a/drivers/acpi/acpica/dsfield.c ++++ b/drivers/acpi/acpica/dsfield.c +@@ -360,6 +360,7 @@ acpi_ds_get_field_names(struct acpi_create_field_info *info, + */ + info->resource_buffer = NULL; + info->connection_node = NULL; ++ info->pin_number_index = 0; + + /* + * A Connection() is either an actual resource descriptor (buffer) +@@ -437,6 +438,7 @@ acpi_ds_get_field_names(struct acpi_create_field_info *info, + } + + info->field_bit_position += info->field_bit_length; ++ info->pin_number_index++; /* Index relative to previous Connection() */ + break; + + default: +diff --git a/drivers/acpi/acpica/evregion.c b/drivers/acpi/acpica/evregion.c +index 144cbb9b73bc..cd4b231ae760 100644 +--- a/drivers/acpi/acpica/evregion.c ++++ b/drivers/acpi/acpica/evregion.c +@@ -142,6 +142,7 @@ acpi_ev_address_space_dispatch(union acpi_operand_object *region_obj, + union acpi_operand_object *region_obj2; + void *region_context = NULL; + struct acpi_connection_info *context; ++ acpi_physical_address address; + + ACPI_FUNCTION_TRACE(ev_address_space_dispatch); + +@@ -231,25 +232,23 @@ acpi_ev_address_space_dispatch(union acpi_operand_object *region_obj, + /* We have everything we need, we can invoke the address space handler */ + + handler = handler_desc->address_space.handler; +- +- ACPI_DEBUG_PRINT((ACPI_DB_OPREGION, +- "Handler %p (@%p) Address %8.8X%8.8X [%s]\n", +- ®ion_obj->region.handler->address_space, handler, +- ACPI_FORMAT_NATIVE_UINT(region_obj->region.address + +- region_offset), +- acpi_ut_get_region_name(region_obj->region. +- space_id))); ++ address = (region_obj->region.address + region_offset); + + /* + * Special handling for generic_serial_bus and general_purpose_io: + * There are three extra parameters that must be passed to the + * handler via the context: +- * 1) Connection buffer, a resource template from Connection() op. +- * 2) Length of the above buffer. +- * 3) Actual access length from the access_as() op. ++ * 1) Connection buffer, a resource template from Connection() op ++ * 2) Length of the above buffer ++ * 3) Actual access length from the access_as() op ++ * ++ * In addition, for general_purpose_io, the Address and bit_width fields ++ * are defined as follows: ++ * 1) Address is the pin number index of the field (bit offset from ++ * the previous Connection) ++ * 2) bit_width is the actual bit length of the field (number of pins) + */ +- if (((region_obj->region.space_id == ACPI_ADR_SPACE_GSBUS) || +- (region_obj->region.space_id == ACPI_ADR_SPACE_GPIO)) && ++ if ((region_obj->region.space_id == ACPI_ADR_SPACE_GSBUS) && + context && field_obj) { + + /* Get the Connection (resource_template) buffer */ +@@ -258,6 +257,24 @@ acpi_ev_address_space_dispatch(union acpi_operand_object *region_obj, + context->length = field_obj->field.resource_length; + context->access_length = field_obj->field.access_length; + } ++ if ((region_obj->region.space_id == ACPI_ADR_SPACE_GPIO) && ++ context && field_obj) { ++ ++ /* Get the Connection (resource_template) buffer */ ++ ++ context->connection = field_obj->field.resource_buffer; ++ context->length = field_obj->field.resource_length; ++ context->access_length = field_obj->field.access_length; ++ address = field_obj->field.pin_number_index; ++ bit_width = field_obj->field.bit_length; ++ } ++ ++ ACPI_DEBUG_PRINT((ACPI_DB_OPREGION, ++ "Handler %p (@%p) Address %8.8X%8.8X [%s]\n", ++ ®ion_obj->region.handler->address_space, handler, ++ ACPI_FORMAT_NATIVE_UINT(address), ++ acpi_ut_get_region_name(region_obj->region. ++ space_id))); + + if (!(handler_desc->address_space.handler_flags & + ACPI_ADDR_HANDLER_DEFAULT_INSTALLED)) { +@@ -271,9 +288,7 @@ acpi_ev_address_space_dispatch(union acpi_operand_object *region_obj, + + /* Call the handler */ + +- status = handler(function, +- (region_obj->region.address + region_offset), +- bit_width, value, context, ++ status = handler(function, address, bit_width, value, context, + region_obj2->extra.region_context); + + if (ACPI_FAILURE(status)) { +diff --git a/drivers/acpi/acpica/exfield.c b/drivers/acpi/acpica/exfield.c +index cfd875243421..d36894a228b1 100644 +--- a/drivers/acpi/acpica/exfield.c ++++ b/drivers/acpi/acpica/exfield.c +@@ -178,6 +178,37 @@ acpi_ex_read_data_from_field(struct acpi_walk_state *walk_state, + buffer = &buffer_desc->integer.value; + } + ++ if ((obj_desc->common.type == ACPI_TYPE_LOCAL_REGION_FIELD) && ++ (obj_desc->field.region_obj->region.space_id == ++ ACPI_ADR_SPACE_GPIO)) { ++ /* ++ * For GPIO (general_purpose_io), the Address will be the bit offset ++ * from the previous Connection() operator, making it effectively a ++ * pin number index. The bit_length is the length of the field, which ++ * is thus the number of pins. ++ */ ++ ACPI_DEBUG_PRINT((ACPI_DB_BFIELD, ++ "GPIO FieldRead [FROM]: Pin %u Bits %u\n", ++ obj_desc->field.pin_number_index, ++ obj_desc->field.bit_length)); ++ ++ /* Lock entire transaction if requested */ ++ ++ acpi_ex_acquire_global_lock(obj_desc->common_field.field_flags); ++ ++ /* Perform the write */ ++ ++ status = acpi_ex_access_region(obj_desc, 0, ++ (u64 *)buffer, ACPI_READ); ++ acpi_ex_release_global_lock(obj_desc->common_field.field_flags); ++ if (ACPI_FAILURE(status)) { ++ acpi_ut_remove_reference(buffer_desc); ++ } else { ++ *ret_buffer_desc = buffer_desc; ++ } ++ return_ACPI_STATUS(status); ++ } ++ + ACPI_DEBUG_PRINT((ACPI_DB_BFIELD, + "FieldRead [TO]: Obj %p, Type %X, Buf %p, ByteLen %X\n", + obj_desc, obj_desc->common.type, buffer, +@@ -325,6 +356,42 @@ acpi_ex_write_data_to_field(union acpi_operand_object *source_desc, + + *result_desc = buffer_desc; + return_ACPI_STATUS(status); ++ } else if ((obj_desc->common.type == ACPI_TYPE_LOCAL_REGION_FIELD) && ++ (obj_desc->field.region_obj->region.space_id == ++ ACPI_ADR_SPACE_GPIO)) { ++ /* ++ * For GPIO (general_purpose_io), we will bypass the entire field ++ * mechanism and handoff the bit address and bit width directly to ++ * the handler. The Address will be the bit offset ++ * from the previous Connection() operator, making it effectively a ++ * pin number index. The bit_length is the length of the field, which ++ * is thus the number of pins. ++ */ ++ if (source_desc->common.type != ACPI_TYPE_INTEGER) { ++ return_ACPI_STATUS(AE_AML_OPERAND_TYPE); ++ } ++ ++ ACPI_DEBUG_PRINT((ACPI_DB_BFIELD, ++ "GPIO FieldWrite [FROM]: (%s:%X), Val %.8X [TO]: Pin %u Bits %u\n", ++ acpi_ut_get_type_name(source_desc->common. ++ type), ++ source_desc->common.type, ++ (u32)source_desc->integer.value, ++ obj_desc->field.pin_number_index, ++ obj_desc->field.bit_length)); ++ ++ buffer = &source_desc->integer.value; ++ ++ /* Lock entire transaction if requested */ ++ ++ acpi_ex_acquire_global_lock(obj_desc->common_field.field_flags); ++ ++ /* Perform the write */ ++ ++ status = acpi_ex_access_region(obj_desc, 0, ++ (u64 *)buffer, ACPI_WRITE); ++ acpi_ex_release_global_lock(obj_desc->common_field.field_flags); ++ return_ACPI_STATUS(status); + } + + /* Get a pointer to the data to be written */ +diff --git a/drivers/acpi/acpica/exprep.c b/drivers/acpi/acpica/exprep.c +index 5a588611ab48..8c88cfdec441 100644 +--- a/drivers/acpi/acpica/exprep.c ++++ b/drivers/acpi/acpica/exprep.c +@@ -484,6 +484,8 @@ acpi_status acpi_ex_prep_field_value(struct acpi_create_field_info *info) + obj_desc->field.resource_length = info->resource_length; + } + ++ obj_desc->field.pin_number_index = info->pin_number_index; ++ + /* Allow full data read from EC address space */ + + if ((obj_desc->field.region_obj->region.space_id == +diff --git a/drivers/acpi/container.c b/drivers/acpi/container.c +index 368f9ddb8480..e4a6f78f3bbc 100644 +--- a/drivers/acpi/container.c ++++ b/drivers/acpi/container.c +@@ -96,6 +96,13 @@ static void container_device_detach(struct acpi_device *adev) + device_unregister(dev); + } + ++static void container_device_online(struct acpi_device *adev) ++{ ++ struct device *dev = acpi_driver_data(adev); ++ ++ kobject_uevent(&dev->kobj, KOBJ_ONLINE); ++} ++ + static struct acpi_scan_handler container_handler = { + .ids = container_device_ids, + .attach = container_device_attach, +@@ -103,6 +110,7 @@ static struct acpi_scan_handler container_handler = { + .hotplug = { + .enabled = true, + .demand_offline = true, ++ .notify_online = container_device_online, + }, + }; + +diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c +index 92d5184e3654..493a342efa44 100644 +--- a/drivers/acpi/scan.c ++++ b/drivers/acpi/scan.c +@@ -106,7 +106,7 @@ static int create_modalias(struct acpi_device *acpi_dev, char *modalias, + list_for_each_entry(id, &acpi_dev->pnp.ids, list) { + count = snprintf(&modalias[len], size, "%s:", id->id); + if (count < 0) +- return EINVAL; ++ return -EINVAL; + if (count >= size) + return -ENOMEM; + len += count; +@@ -2068,6 +2068,9 @@ static void acpi_bus_attach(struct acpi_device *device) + ok: + list_for_each_entry(child, &device->children, node) + acpi_bus_attach(child); ++ ++ if (device->handler && device->handler->hotplug.notify_online) ++ device->handler->hotplug.notify_online(device); + } + + /** +diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c +index b54f8b3c7924..00663d60f6d4 100644 +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -306,6 +306,14 @@ static const struct pci_device_id ahci_pci_tbl[] = { + { PCI_VDEVICE(INTEL, 0x9c85), board_ahci }, /* Wildcat Point-LP RAID */ + { PCI_VDEVICE(INTEL, 0x9c87), board_ahci }, /* Wildcat Point-LP RAID */ + { PCI_VDEVICE(INTEL, 0x9c8f), board_ahci }, /* Wildcat Point-LP RAID */ ++ { PCI_VDEVICE(INTEL, 0x8c82), board_ahci }, /* 9 Series AHCI */ ++ { PCI_VDEVICE(INTEL, 0x8c83), board_ahci }, /* 9 Series AHCI */ ++ { PCI_VDEVICE(INTEL, 0x8c84), board_ahci }, /* 9 Series RAID */ ++ { PCI_VDEVICE(INTEL, 0x8c85), board_ahci }, /* 9 Series RAID */ ++ { PCI_VDEVICE(INTEL, 0x8c86), board_ahci }, /* 9 Series RAID */ ++ { PCI_VDEVICE(INTEL, 0x8c87), board_ahci }, /* 9 Series RAID */ ++ { PCI_VDEVICE(INTEL, 0x8c8e), board_ahci }, /* 9 Series RAID */ ++ { PCI_VDEVICE(INTEL, 0x8c8f), board_ahci }, /* 9 Series RAID */ + + /* JMicron 360/1/3/5/6, match class to avoid IDE function */ + { PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID, +@@ -443,6 +451,8 @@ static const struct pci_device_id ahci_pci_tbl[] = { + { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x917a), + .driver_data = board_ahci_yes_fbs }, /* 88se9172 */ + { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9172), ++ .driver_data = board_ahci_yes_fbs }, /* 88se9182 */ ++ { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9182), + .driver_data = board_ahci_yes_fbs }, /* 88se9172 */ + { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9192), + .driver_data = board_ahci_yes_fbs }, /* 88se9172 on some Gigabyte */ +diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c +index 6334c8d7c3f1..39f76b987c75 100644 +--- a/drivers/ata/ata_piix.c ++++ b/drivers/ata/ata_piix.c +@@ -340,6 +340,14 @@ static const struct pci_device_id piix_pci_tbl[] = { + { 0x8086, 0x0F21, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_byt }, + /* SATA Controller IDE (Coleto Creek) */ + { 0x8086, 0x23a6, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata }, ++ /* SATA Controller IDE (9 Series) */ ++ { 0x8086, 0x8c88, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_snb }, ++ /* SATA Controller IDE (9 Series) */ ++ { 0x8086, 0x8c89, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_snb }, ++ /* SATA Controller IDE (9 Series) */ ++ { 0x8086, 0x8c80, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb }, ++ /* SATA Controller IDE (9 Series) */ ++ { 0x8086, 0x8c81, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb }, + + { } /* terminate list */ + }; +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index f7616036663b..538574f98e22 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -4227,7 +4227,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { + { "Micron_M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, }, + { "Crucial_CT???M500SSD*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, }, + { "Micron_M550*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, }, +- { "Crucial_CT???M550SSD*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, }, ++ { "Crucial_CT*M550SSD*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, }, + + /* + * Some WD SATA-I drives spin up and down erratically when the link +diff --git a/drivers/ata/pata_scc.c b/drivers/ata/pata_scc.c +index f35f15f4d83e..f7badaa39eb6 100644 +--- a/drivers/ata/pata_scc.c ++++ b/drivers/ata/pata_scc.c +@@ -586,7 +586,7 @@ static int scc_wait_after_reset(struct ata_link *link, unsigned int devmask, + * Note: Original code is ata_bus_softreset(). + */ + +-static unsigned int scc_bus_softreset(struct ata_port *ap, unsigned int devmask, ++static int scc_bus_softreset(struct ata_port *ap, unsigned int devmask, + unsigned long deadline) + { + struct ata_ioports *ioaddr = &ap->ioaddr; +@@ -600,9 +600,7 @@ static unsigned int scc_bus_softreset(struct ata_port *ap, unsigned int devmask, + udelay(20); + out_be32(ioaddr->ctl_addr, ap->ctl); + +- scc_wait_after_reset(&ap->link, devmask, deadline); +- +- return 0; ++ return scc_wait_after_reset(&ap->link, devmask, deadline); + } + + /** +@@ -619,7 +617,8 @@ static int scc_softreset(struct ata_link *link, unsigned int *classes, + { + struct ata_port *ap = link->ap; + unsigned int slave_possible = ap->flags & ATA_FLAG_SLAVE_POSS; +- unsigned int devmask = 0, err_mask; ++ unsigned int devmask = 0; ++ int rc; + u8 err; + + DPRINTK("ENTER\n"); +@@ -635,9 +634,9 @@ static int scc_softreset(struct ata_link *link, unsigned int *classes, + + /* issue bus reset */ + DPRINTK("about to softreset, devmask=%x\n", devmask); +- err_mask = scc_bus_softreset(ap, devmask, deadline); +- if (err_mask) { +- ata_port_err(ap, "SRST failed (err_mask=0x%x)\n", err_mask); ++ rc = scc_bus_softreset(ap, devmask, deadline); ++ if (rc) { ++ ata_port_err(ap, "SRST failed (err_mask=0x%x)\n", rc); + return -EIO; + } + +diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c +index d4dd77134814..154e7a8c0a04 100644 +--- a/drivers/base/regmap/regcache.c ++++ b/drivers/base/regmap/regcache.c +@@ -701,7 +701,7 @@ int regcache_sync_block(struct regmap *map, void *block, + unsigned int block_base, unsigned int start, + unsigned int end) + { +- if (regmap_can_raw_write(map)) ++ if (regmap_can_raw_write(map) && !map->use_single_rw) + return regcache_sync_block_raw(map, block, cache_present, + block_base, start, end); + else +diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c +index 6a19515f8a45..2ea056c09aeb 100644 +--- a/drivers/base/regmap/regmap.c ++++ b/drivers/base/regmap/regmap.c +@@ -105,7 +105,7 @@ bool regmap_readable(struct regmap *map, unsigned int reg) + + bool regmap_volatile(struct regmap *map, unsigned int reg) + { +- if (!regmap_readable(map, reg)) ++ if (!map->format.format_write && !regmap_readable(map, reg)) + return false; + + if (map->volatile_reg) +diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c +index b94a311e5ab6..f9c4632d4dd3 100644 +--- a/drivers/clk/clk.c ++++ b/drivers/clk/clk.c +@@ -1487,6 +1487,7 @@ static struct clk *clk_propagate_rate_change(struct clk *clk, unsigned long even + static void clk_change_rate(struct clk *clk) + { + struct clk *child; ++ struct hlist_node *tmp; + unsigned long old_rate; + unsigned long best_parent_rate = 0; + bool skip_set_rate = false; +@@ -1525,7 +1526,11 @@ static void clk_change_rate(struct clk *clk) + if (clk->notifier_count && old_rate != clk->rate) + __clk_notify(clk, POST_RATE_CHANGE, old_rate, clk->rate); + +- hlist_for_each_entry(child, &clk->children, child_node) { ++ /* ++ * Use safe iteration, as change_rate can actually swap parents ++ * for certain clock types. ++ */ ++ hlist_for_each_entry_safe(child, tmp, &clk->children, child_node) { + /* Skip children who will be reparented to another clock */ + if (child->new_parent && child->new_parent != clk) + continue; +diff --git a/drivers/clk/qcom/mmcc-msm8960.c b/drivers/clk/qcom/mmcc-msm8960.c +index 9be47a829144..f3c95d648a53 100644 +--- a/drivers/clk/qcom/mmcc-msm8960.c ++++ b/drivers/clk/qcom/mmcc-msm8960.c +@@ -37,6 +37,8 @@ + #define P_PLL2 2 + #define P_PLL3 3 + ++#define F_MN(f, s, _m, _n) { .freq = f, .src = s, .m = _m, .n = _n } ++ + static u8 mmcc_pxo_pll8_pll2_map[] = { + [P_PXO] = 0, + [P_PLL8] = 2, +@@ -58,8 +60,8 @@ static u8 mmcc_pxo_pll8_pll2_pll3_map[] = { + + static const char *mmcc_pxo_pll8_pll2_pll3[] = { + "pxo", +- "pll2", + "pll8_vote", ++ "pll2", + "pll3", + }; + +@@ -709,18 +711,18 @@ static struct clk_branch csiphy2_timer_clk = { + }; + + static struct freq_tbl clk_tbl_gfx2d[] = { +- { 27000000, P_PXO, 1, 0 }, +- { 48000000, P_PLL8, 1, 8 }, +- { 54857000, P_PLL8, 1, 7 }, +- { 64000000, P_PLL8, 1, 6 }, +- { 76800000, P_PLL8, 1, 5 }, +- { 96000000, P_PLL8, 1, 4 }, +- { 128000000, P_PLL8, 1, 3 }, +- { 145455000, P_PLL2, 2, 11 }, +- { 160000000, P_PLL2, 1, 5 }, +- { 177778000, P_PLL2, 2, 9 }, +- { 200000000, P_PLL2, 1, 4 }, +- { 228571000, P_PLL2, 2, 7 }, ++ F_MN( 27000000, P_PXO, 1, 0), ++ F_MN( 48000000, P_PLL8, 1, 8), ++ F_MN( 54857000, P_PLL8, 1, 7), ++ F_MN( 64000000, P_PLL8, 1, 6), ++ F_MN( 76800000, P_PLL8, 1, 5), ++ F_MN( 96000000, P_PLL8, 1, 4), ++ F_MN(128000000, P_PLL8, 1, 3), ++ F_MN(145455000, P_PLL2, 2, 11), ++ F_MN(160000000, P_PLL2, 1, 5), ++ F_MN(177778000, P_PLL2, 2, 9), ++ F_MN(200000000, P_PLL2, 1, 4), ++ F_MN(228571000, P_PLL2, 2, 7), + { } + }; + +@@ -841,22 +843,22 @@ static struct clk_branch gfx2d1_clk = { + }; + + static struct freq_tbl clk_tbl_gfx3d[] = { +- { 27000000, P_PXO, 1, 0 }, +- { 48000000, P_PLL8, 1, 8 }, +- { 54857000, P_PLL8, 1, 7 }, +- { 64000000, P_PLL8, 1, 6 }, +- { 76800000, P_PLL8, 1, 5 }, +- { 96000000, P_PLL8, 1, 4 }, +- { 128000000, P_PLL8, 1, 3 }, +- { 145455000, P_PLL2, 2, 11 }, +- { 160000000, P_PLL2, 1, 5 }, +- { 177778000, P_PLL2, 2, 9 }, +- { 200000000, P_PLL2, 1, 4 }, +- { 228571000, P_PLL2, 2, 7 }, +- { 266667000, P_PLL2, 1, 3 }, +- { 300000000, P_PLL3, 1, 4 }, +- { 320000000, P_PLL2, 2, 5 }, +- { 400000000, P_PLL2, 1, 2 }, ++ F_MN( 27000000, P_PXO, 1, 0), ++ F_MN( 48000000, P_PLL8, 1, 8), ++ F_MN( 54857000, P_PLL8, 1, 7), ++ F_MN( 64000000, P_PLL8, 1, 6), ++ F_MN( 76800000, P_PLL8, 1, 5), ++ F_MN( 96000000, P_PLL8, 1, 4), ++ F_MN(128000000, P_PLL8, 1, 3), ++ F_MN(145455000, P_PLL2, 2, 11), ++ F_MN(160000000, P_PLL2, 1, 5), ++ F_MN(177778000, P_PLL2, 2, 9), ++ F_MN(200000000, P_PLL2, 1, 4), ++ F_MN(228571000, P_PLL2, 2, 7), ++ F_MN(266667000, P_PLL2, 1, 3), ++ F_MN(300000000, P_PLL3, 1, 4), ++ F_MN(320000000, P_PLL2, 2, 5), ++ F_MN(400000000, P_PLL2, 1, 2), + { } + }; + +@@ -896,7 +898,7 @@ static struct clk_dyn_rcg gfx3d_src = { + .hw.init = &(struct clk_init_data){ + .name = "gfx3d_src", + .parent_names = mmcc_pxo_pll8_pll2_pll3, +- .num_parents = 3, ++ .num_parents = 4, + .ops = &clk_dyn_rcg_ops, + }, + }, +@@ -994,7 +996,7 @@ static struct clk_rcg jpegd_src = { + .ns_reg = 0x00ac, + .p = { + .pre_div_shift = 12, +- .pre_div_width = 2, ++ .pre_div_width = 4, + }, + .s = { + .src_sel_shift = 0, +@@ -1114,7 +1116,7 @@ static struct clk_branch mdp_lut_clk = { + .enable_reg = 0x016c, + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ +- .parent_names = (const char *[]){ "mdp_clk" }, ++ .parent_names = (const char *[]){ "mdp_src" }, + .num_parents = 1, + .name = "mdp_lut_clk", + .ops = &clk_branch_ops, +@@ -1341,15 +1343,15 @@ static struct clk_branch hdmi_app_clk = { + }; + + static struct freq_tbl clk_tbl_vcodec[] = { +- { 27000000, P_PXO, 1, 0 }, +- { 32000000, P_PLL8, 1, 12 }, +- { 48000000, P_PLL8, 1, 8 }, +- { 54860000, P_PLL8, 1, 7 }, +- { 96000000, P_PLL8, 1, 4 }, +- { 133330000, P_PLL2, 1, 6 }, +- { 200000000, P_PLL2, 1, 4 }, +- { 228570000, P_PLL2, 2, 7 }, +- { 266670000, P_PLL2, 1, 3 }, ++ F_MN( 27000000, P_PXO, 1, 0), ++ F_MN( 32000000, P_PLL8, 1, 12), ++ F_MN( 48000000, P_PLL8, 1, 8), ++ F_MN( 54860000, P_PLL8, 1, 7), ++ F_MN( 96000000, P_PLL8, 1, 4), ++ F_MN(133330000, P_PLL2, 1, 6), ++ F_MN(200000000, P_PLL2, 1, 4), ++ F_MN(228570000, P_PLL2, 2, 7), ++ F_MN(266670000, P_PLL2, 1, 3), + { } + }; + +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index 153f4b92cc05..415923606164 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -1225,6 +1225,8 @@ err_get_freq: + per_cpu(cpufreq_cpu_data, j) = NULL; + write_unlock_irqrestore(&cpufreq_driver_lock, flags); + ++ up_write(&policy->rwsem); ++ + if (cpufreq_driver->exit) + cpufreq_driver->exit(policy); + err_set_policy_cpu: +diff --git a/drivers/dma/TODO b/drivers/dma/TODO +index 734ed0206cd5..b8045cd42ee1 100644 +--- a/drivers/dma/TODO ++++ b/drivers/dma/TODO +@@ -7,7 +7,6 @@ TODO for slave dma + - imx-dma + - imx-sdma + - mxs-dma.c +- - dw_dmac + - intel_mid_dma + 4. Check other subsystems for dma drivers and merge/move to dmaengine + 5. Remove dma_slave_config's dma direction. +diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c +index 01a200cd0189..b0972b3869c7 100644 +--- a/drivers/dma/dw/core.c ++++ b/drivers/dma/dw/core.c +@@ -279,6 +279,15 @@ static void dwc_dostart(struct dw_dma_chan *dwc, struct dw_desc *first) + channel_set_bit(dw, CH_EN, dwc->mask); + } + ++static void dwc_dostart_first_queued(struct dw_dma_chan *dwc) ++{ ++ if (list_empty(&dwc->queue)) ++ return; ++ ++ list_move(dwc->queue.next, &dwc->active_list); ++ dwc_dostart(dwc, dwc_first_active(dwc)); ++} ++ + /*----------------------------------------------------------------------*/ + + static void +@@ -335,10 +344,7 @@ static void dwc_complete_all(struct dw_dma *dw, struct dw_dma_chan *dwc) + * the completed ones. + */ + list_splice_init(&dwc->active_list, &list); +- if (!list_empty(&dwc->queue)) { +- list_move(dwc->queue.next, &dwc->active_list); +- dwc_dostart(dwc, dwc_first_active(dwc)); +- } ++ dwc_dostart_first_queued(dwc); + + spin_unlock_irqrestore(&dwc->lock, flags); + +@@ -467,10 +473,7 @@ static void dwc_scan_descriptors(struct dw_dma *dw, struct dw_dma_chan *dwc) + /* Try to continue after resetting the channel... */ + dwc_chan_disable(dw, dwc); + +- if (!list_empty(&dwc->queue)) { +- list_move(dwc->queue.next, &dwc->active_list); +- dwc_dostart(dwc, dwc_first_active(dwc)); +- } ++ dwc_dostart_first_queued(dwc); + spin_unlock_irqrestore(&dwc->lock, flags); + } + +@@ -677,17 +680,9 @@ static dma_cookie_t dwc_tx_submit(struct dma_async_tx_descriptor *tx) + * possible, perhaps even appending to those already submitted + * for DMA. But this is hard to do in a race-free manner. + */ +- if (list_empty(&dwc->active_list)) { +- dev_vdbg(chan2dev(tx->chan), "%s: started %u\n", __func__, +- desc->txd.cookie); +- list_add_tail(&desc->desc_node, &dwc->active_list); +- dwc_dostart(dwc, dwc_first_active(dwc)); +- } else { +- dev_vdbg(chan2dev(tx->chan), "%s: queued %u\n", __func__, +- desc->txd.cookie); + +- list_add_tail(&desc->desc_node, &dwc->queue); +- } ++ dev_vdbg(chan2dev(tx->chan), "%s: queued %u\n", __func__, desc->txd.cookie); ++ list_add_tail(&desc->desc_node, &dwc->queue); + + spin_unlock_irqrestore(&dwc->lock, flags); + +@@ -1092,9 +1087,12 @@ dwc_tx_status(struct dma_chan *chan, + static void dwc_issue_pending(struct dma_chan *chan) + { + struct dw_dma_chan *dwc = to_dw_dma_chan(chan); ++ unsigned long flags; + +- if (!list_empty(&dwc->queue)) +- dwc_scan_descriptors(to_dw_dma(chan->device), dwc); ++ spin_lock_irqsave(&dwc->lock, flags); ++ if (list_empty(&dwc->active_list)) ++ dwc_dostart_first_queued(dwc); ++ spin_unlock_irqrestore(&dwc->lock, flags); + } + + static int dwc_alloc_chan_resources(struct dma_chan *chan) +diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c +index 50535fd5a88d..d830b38e54f6 100644 +--- a/drivers/gpu/drm/ast/ast_main.c ++++ b/drivers/gpu/drm/ast/ast_main.c +@@ -100,7 +100,7 @@ static int ast_detect_chip(struct drm_device *dev) + } + ast->vga2_clone = false; + } else { +- ast->chip = 2000; ++ ast->chip = AST2000; + DRM_INFO("AST 2000 detected\n"); + } + } +diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c +index 3ecb332e7cfa..7410a507eacc 100644 +--- a/drivers/gpu/drm/i915/i915_gem.c ++++ b/drivers/gpu/drm/i915/i915_gem.c +@@ -1426,10 +1426,13 @@ unlock: + out: + switch (ret) { + case -EIO: +- /* If this -EIO is due to a gpu hang, give the reset code a +- * chance to clean up the mess. Otherwise return the proper +- * SIGBUS. */ +- if (i915_terminally_wedged(&dev_priv->gpu_error)) { ++ /* ++ * We eat errors when the gpu is terminally wedged to avoid ++ * userspace unduly crashing (gl has no provisions for mmaps to ++ * fail). But any other -EIO isn't ours (e.g. swap in failure) ++ * and so needs to be reported. ++ */ ++ if (!i915_terminally_wedged(&dev_priv->gpu_error)) { + ret = VM_FAULT_SIGBUS; + break; + } +diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c +index f22041973f3a..08105fddfd2a 100644 +--- a/drivers/gpu/drm/i915/intel_bios.c ++++ b/drivers/gpu/drm/i915/intel_bios.c +@@ -839,7 +839,7 @@ init_vbt_defaults(struct drm_i915_private *dev_priv) + } + } + +-static int __init intel_no_opregion_vbt_callback(const struct dmi_system_id *id) ++static int intel_no_opregion_vbt_callback(const struct dmi_system_id *id) + { + DRM_DEBUG_KMS("Falling back to manually reading VBT from " + "VBIOS ROM for %s\n", +diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c +index b19ddacbe19d..834847527982 100644 +--- a/drivers/gpu/drm/i915/intel_crt.c ++++ b/drivers/gpu/drm/i915/intel_crt.c +@@ -750,7 +750,7 @@ static const struct drm_encoder_funcs intel_crt_enc_funcs = { + .destroy = intel_encoder_destroy, + }; + +-static int __init intel_no_crt_dmi_callback(const struct dmi_system_id *id) ++static int intel_no_crt_dmi_callback(const struct dmi_system_id *id) + { + DRM_INFO("Skipping CRT initialization for %s\n", id->ident); + return 1; +diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c +index eb8f64b5fb85..67c9ff389989 100644 +--- a/drivers/gpu/drm/i915/intel_lvds.c ++++ b/drivers/gpu/drm/i915/intel_lvds.c +@@ -544,7 +544,7 @@ static const struct drm_encoder_funcs intel_lvds_enc_funcs = { + .destroy = intel_encoder_destroy, + }; + +-static int __init intel_no_lvds_dmi_callback(const struct dmi_system_id *id) ++static int intel_no_lvds_dmi_callback(const struct dmi_system_id *id) + { + DRM_INFO("Skipping LVDS initialization for %s\n", id->ident); + return 1; +diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c +index 31b36c5ac894..d488fc71ef49 100644 +--- a/drivers/gpu/drm/i915/intel_ringbuffer.c ++++ b/drivers/gpu/drm/i915/intel_ringbuffer.c +@@ -475,6 +475,9 @@ static int init_ring_common(struct intel_ring_buffer *ring) + } + } + ++ /* Enforce ordering by reading HEAD register back */ ++ I915_READ_HEAD(ring); ++ + /* Initialize the ring. This must happen _after_ we've cleared the ring + * registers with the above sequence (the readback of the HEAD registers + * also enforces ordering), otherwise the hw might lose the new ring +diff --git a/drivers/gpu/drm/i915/intel_tv.c b/drivers/gpu/drm/i915/intel_tv.c +index 365c7c47c46c..9c9606c8bb1a 100644 +--- a/drivers/gpu/drm/i915/intel_tv.c ++++ b/drivers/gpu/drm/i915/intel_tv.c +@@ -854,6 +854,10 @@ intel_enable_tv(struct intel_encoder *encoder) + struct drm_device *dev = encoder->base.dev; + struct drm_i915_private *dev_priv = dev->dev_private; + ++ /* Prevents vblank waits from timing out in intel_tv_detect_type() */ ++ intel_wait_for_vblank(encoder->base.dev, ++ to_intel_crtc(encoder->base.crtc)->pipe); ++ + I915_WRITE(TV_CTL, I915_READ(TV_CTL) | TV_ENC_ENABLE); + } + +diff --git a/drivers/gpu/drm/nouveau/nouveau_vga.c b/drivers/gpu/drm/nouveau/nouveau_vga.c +index 471347edc27e..a92fb01459c9 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_vga.c ++++ b/drivers/gpu/drm/nouveau/nouveau_vga.c +@@ -100,7 +100,16 @@ void + nouveau_vga_fini(struct nouveau_drm *drm) + { + struct drm_device *dev = drm->dev; ++ bool runtime = false; ++ ++ if (nouveau_runtime_pm == 1) ++ runtime = true; ++ if ((nouveau_runtime_pm == -1) && (nouveau_is_optimus() || nouveau_is_v1_dsm())) ++ runtime = true; ++ + vga_switcheroo_unregister_client(dev->pdev); ++ if (runtime && nouveau_is_v1_dsm() && !nouveau_is_optimus()) ++ vga_switcheroo_fini_domain_pm_ops(drm->dev->dev); + vga_client_register(dev->pdev, NULL, NULL, NULL); + } + +diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c +index 5fa854c84d62..543ba2d4a659 100644 +--- a/drivers/gpu/drm/radeon/ci_dpm.c ++++ b/drivers/gpu/drm/radeon/ci_dpm.c +@@ -851,6 +851,9 @@ static int ci_set_thermal_temperature_range(struct radeon_device *rdev, + WREG32_SMC(CG_THERMAL_CTRL, tmp); + #endif + ++ rdev->pm.dpm.thermal.min_temp = low_temp; ++ rdev->pm.dpm.thermal.max_temp = high_temp; ++ + return 0; + } + +@@ -922,7 +925,18 @@ static void ci_get_leakage_voltages(struct radeon_device *rdev) + pi->vddc_leakage.count = 0; + pi->vddci_leakage.count = 0; + +- if (radeon_atom_get_leakage_id_from_vbios(rdev, &leakage_id) == 0) { ++ if (rdev->pm.dpm.platform_caps & ATOM_PP_PLATFORM_CAP_EVV) { ++ for (i = 0; i < CISLANDS_MAX_LEAKAGE_COUNT; i++) { ++ virtual_voltage_id = ATOM_VIRTUAL_VOLTAGE_ID0 + i; ++ if (radeon_atom_get_voltage_evv(rdev, virtual_voltage_id, &vddc) != 0) ++ continue; ++ if (vddc != 0 && vddc != virtual_voltage_id) { ++ pi->vddc_leakage.actual_voltage[pi->vddc_leakage.count] = vddc; ++ pi->vddc_leakage.leakage_id[pi->vddc_leakage.count] = virtual_voltage_id; ++ pi->vddc_leakage.count++; ++ } ++ } ++ } else if (radeon_atom_get_leakage_id_from_vbios(rdev, &leakage_id) == 0) { + for (i = 0; i < CISLANDS_MAX_LEAKAGE_COUNT; i++) { + virtual_voltage_id = ATOM_VIRTUAL_VOLTAGE_ID0 + i; + if (radeon_atom_get_leakage_vddc_based_on_leakage_params(rdev, &vddc, &vddci, +diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c +index 7b3537c55c77..ab5c26575622 100644 +--- a/drivers/gpu/drm/radeon/cik.c ++++ b/drivers/gpu/drm/radeon/cik.c +@@ -4392,7 +4392,7 @@ struct bonaire_mqd + */ + static int cik_cp_compute_resume(struct radeon_device *rdev) + { +- int r, i, idx; ++ int r, i, j, idx; + u32 tmp; + bool use_doorbell = true; + u64 hqd_gpu_addr; +@@ -4511,7 +4511,7 @@ static int cik_cp_compute_resume(struct radeon_device *rdev) + mqd->queue_state.cp_hqd_pq_wptr= 0; + if (RREG32(CP_HQD_ACTIVE) & 1) { + WREG32(CP_HQD_DEQUEUE_REQUEST, 1); +- for (i = 0; i < rdev->usec_timeout; i++) { ++ for (j = 0; j < rdev->usec_timeout; j++) { + if (!(RREG32(CP_HQD_ACTIVE) & 1)) + break; + udelay(1); +@@ -5545,12 +5545,13 @@ static void cik_vm_decode_fault(struct radeon_device *rdev, + void cik_vm_flush(struct radeon_device *rdev, int ridx, struct radeon_vm *vm) + { + struct radeon_ring *ring = &rdev->ring[ridx]; ++ int usepfp = (ridx == RADEON_RING_TYPE_GFX_INDEX); + + if (vm == NULL) + return; + + radeon_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, 3)); +- radeon_ring_write(ring, (WRITE_DATA_ENGINE_SEL(0) | ++ radeon_ring_write(ring, (WRITE_DATA_ENGINE_SEL(usepfp) | + WRITE_DATA_DST_SEL(0))); + if (vm->id < 8) { + radeon_ring_write(ring, +@@ -5600,7 +5601,7 @@ void cik_vm_flush(struct radeon_device *rdev, int ridx, struct radeon_vm *vm) + radeon_ring_write(ring, 1 << vm->id); + + /* compute doesn't have PFP */ +- if (ridx == RADEON_RING_TYPE_GFX_INDEX) { ++ if (usepfp) { + /* sync PFP to ME, otherwise we might get invalid PFP reads */ + radeon_ring_write(ring, PACKET3(PACKET3_PFP_SYNC_ME, 0)); + radeon_ring_write(ring, 0x0); +diff --git a/drivers/gpu/drm/radeon/cik_sdma.c b/drivers/gpu/drm/radeon/cik_sdma.c +index aac8f487e6df..66ba713ba7d7 100644 +--- a/drivers/gpu/drm/radeon/cik_sdma.c ++++ b/drivers/gpu/drm/radeon/cik_sdma.c +@@ -461,13 +461,6 @@ int cik_sdma_resume(struct radeon_device *rdev) + { + int r; + +- /* Reset dma */ +- WREG32(SRBM_SOFT_RESET, SOFT_RESET_SDMA | SOFT_RESET_SDMA1); +- RREG32(SRBM_SOFT_RESET); +- udelay(50); +- WREG32(SRBM_SOFT_RESET, 0); +- RREG32(SRBM_SOFT_RESET); +- + r = cik_sdma_load_microcode(rdev); + if (r) + return r; +diff --git a/drivers/gpu/drm/radeon/ni_dma.c b/drivers/gpu/drm/radeon/ni_dma.c +index 7cf96b15377f..94fa49e974eb 100644 +--- a/drivers/gpu/drm/radeon/ni_dma.c ++++ b/drivers/gpu/drm/radeon/ni_dma.c +@@ -191,12 +191,6 @@ int cayman_dma_resume(struct radeon_device *rdev) + u32 reg_offset, wb_offset; + int i, r; + +- /* Reset dma */ +- WREG32(SRBM_SOFT_RESET, SOFT_RESET_DMA | SOFT_RESET_DMA1); +- RREG32(SRBM_SOFT_RESET); +- udelay(50); +- WREG32(SRBM_SOFT_RESET, 0); +- + for (i = 0; i < 2; i++) { + if (i == 0) { + ring = &rdev->ring[R600_RING_TYPE_DMA_INDEX]; +diff --git a/drivers/gpu/drm/radeon/r600_dma.c b/drivers/gpu/drm/radeon/r600_dma.c +index b2d4c91e6272..99495513f6b1 100644 +--- a/drivers/gpu/drm/radeon/r600_dma.c ++++ b/drivers/gpu/drm/radeon/r600_dma.c +@@ -124,15 +124,6 @@ int r600_dma_resume(struct radeon_device *rdev) + u32 rb_bufsz; + int r; + +- /* Reset dma */ +- if (rdev->family >= CHIP_RV770) +- WREG32(SRBM_SOFT_RESET, RV770_SOFT_RESET_DMA); +- else +- WREG32(SRBM_SOFT_RESET, SOFT_RESET_DMA); +- RREG32(SRBM_SOFT_RESET); +- udelay(50); +- WREG32(SRBM_SOFT_RESET, 0); +- + WREG32(DMA_SEM_INCOMPLETE_TIMER_CNTL, 0); + WREG32(DMA_SEM_WAIT_FAIL_TIMER_CNTL, 0); + +diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h +index 08e86f90c9a4..b837e9f9f8ce 100644 +--- a/drivers/gpu/drm/radeon/radeon.h ++++ b/drivers/gpu/drm/radeon/radeon.h +@@ -294,6 +294,9 @@ int radeon_atom_get_leakage_vddc_based_on_leakage_params(struct radeon_device *r + u16 *vddc, u16 *vddci, + u16 virtual_voltage_id, + u16 vbios_voltage_id); ++int radeon_atom_get_voltage_evv(struct radeon_device *rdev, ++ u16 virtual_voltage_id, ++ u16 *voltage); + int radeon_atom_round_to_true_voltage(struct radeon_device *rdev, + u8 voltage_type, + u16 nominal_voltage, +diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c +index 30844814c25a..e2de749327ad 100644 +--- a/drivers/gpu/drm/radeon/radeon_atombios.c ++++ b/drivers/gpu/drm/radeon/radeon_atombios.c +@@ -447,6 +447,13 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev, + } + } + ++ /* Fujitsu D3003-S2 board lists DVI-I as DVI-I and VGA */ ++ if ((dev->pdev->device == 0x9805) && ++ (dev->pdev->subsystem_vendor == 0x1734) && ++ (dev->pdev->subsystem_device == 0x11bd)) { ++ if (*connector_type == DRM_MODE_CONNECTOR_VGA) ++ return false; ++ } + + return true; + } +@@ -1955,7 +1962,7 @@ static const char *thermal_controller_names[] = { + "adm1032", + "adm1030", + "max6649", +- "lm64", ++ "lm63", /* lm64 */ + "f75375", + "asc7xxx", + }; +@@ -1966,7 +1973,7 @@ static const char *pp_lib_thermal_controller_names[] = { + "adm1032", + "adm1030", + "max6649", +- "lm64", ++ "lm63", /* lm64 */ + "f75375", + "RV6xx", + "RV770", +@@ -2273,19 +2280,31 @@ static void radeon_atombios_add_pplib_thermal_controller(struct radeon_device *r + (controller->ucFanParameters & + ATOM_PP_FANPARAMETERS_NOFAN) ? "without" : "with"); + rdev->pm.int_thermal_type = THERMAL_TYPE_KV; +- } else if ((controller->ucType == +- ATOM_PP_THERMALCONTROLLER_EXTERNAL_GPIO) || +- (controller->ucType == +- ATOM_PP_THERMALCONTROLLER_ADT7473_WITH_INTERNAL) || +- (controller->ucType == +- ATOM_PP_THERMALCONTROLLER_EMC2103_WITH_INTERNAL)) { +- DRM_INFO("Special thermal controller config\n"); ++ } else if (controller->ucType == ++ ATOM_PP_THERMALCONTROLLER_EXTERNAL_GPIO) { ++ DRM_INFO("External GPIO thermal controller %s fan control\n", ++ (controller->ucFanParameters & ++ ATOM_PP_FANPARAMETERS_NOFAN) ? "without" : "with"); ++ rdev->pm.int_thermal_type = THERMAL_TYPE_EXTERNAL_GPIO; ++ } else if (controller->ucType == ++ ATOM_PP_THERMALCONTROLLER_ADT7473_WITH_INTERNAL) { ++ DRM_INFO("ADT7473 with internal thermal controller %s fan control\n", ++ (controller->ucFanParameters & ++ ATOM_PP_FANPARAMETERS_NOFAN) ? "without" : "with"); ++ rdev->pm.int_thermal_type = THERMAL_TYPE_ADT7473_WITH_INTERNAL; ++ } else if (controller->ucType == ++ ATOM_PP_THERMALCONTROLLER_EMC2103_WITH_INTERNAL) { ++ DRM_INFO("EMC2103 with internal thermal controller %s fan control\n", ++ (controller->ucFanParameters & ++ ATOM_PP_FANPARAMETERS_NOFAN) ? "without" : "with"); ++ rdev->pm.int_thermal_type = THERMAL_TYPE_EMC2103_WITH_INTERNAL; + } else if (controller->ucType < ARRAY_SIZE(pp_lib_thermal_controller_names)) { + DRM_INFO("Possible %s thermal controller at 0x%02x %s fan control\n", + pp_lib_thermal_controller_names[controller->ucType], + controller->ucI2cAddress >> 1, + (controller->ucFanParameters & + ATOM_PP_FANPARAMETERS_NOFAN) ? "without" : "with"); ++ rdev->pm.int_thermal_type = THERMAL_TYPE_EXTERNAL; + i2c_bus = radeon_lookup_i2c_gpio(rdev, controller->ucI2cLine); + rdev->pm.i2c_bus = radeon_i2c_lookup(rdev, &i2c_bus); + if (rdev->pm.i2c_bus) { +@@ -3228,6 +3247,41 @@ int radeon_atom_get_leakage_vddc_based_on_leakage_params(struct radeon_device *r + return 0; + } + ++union get_voltage_info { ++ struct _GET_VOLTAGE_INFO_INPUT_PARAMETER_V1_2 in; ++ struct _GET_EVV_VOLTAGE_INFO_OUTPUT_PARAMETER_V1_2 evv_out; ++}; ++ ++int radeon_atom_get_voltage_evv(struct radeon_device *rdev, ++ u16 virtual_voltage_id, ++ u16 *voltage) ++{ ++ int index = GetIndexIntoMasterTable(COMMAND, GetVoltageInfo); ++ u32 entry_id; ++ u32 count = rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk.count; ++ union get_voltage_info args; ++ ++ for (entry_id = 0; entry_id < count; entry_id++) { ++ if (rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk.entries[entry_id].v == ++ virtual_voltage_id) ++ break; ++ } ++ ++ if (entry_id >= count) ++ return -EINVAL; ++ ++ args.in.ucVoltageType = VOLTAGE_TYPE_VDDC; ++ args.in.ucVoltageMode = ATOM_GET_VOLTAGE_EVV_VOLTAGE; ++ args.in.ulSCLKFreq = ++ cpu_to_le32(rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk.entries[entry_id].clk); ++ ++ atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); ++ ++ *voltage = le16_to_cpu(args.evv_out.usVoltageLevel); ++ ++ return 0; ++} ++ + int radeon_atom_get_voltage_gpio_settings(struct radeon_device *rdev, + u16 voltage_level, u8 voltage_type, + u32 *gpio_value, u32 *gpio_mask) +diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c +index 0bf6f4a2bb97..e39026cc7d07 100644 +--- a/drivers/gpu/drm/radeon/radeon_device.c ++++ b/drivers/gpu/drm/radeon/radeon_device.c +@@ -1314,7 +1314,7 @@ int radeon_device_init(struct radeon_device *rdev, + + r = radeon_init(rdev); + if (r) +- return r; ++ goto failed; + + r = radeon_ib_ring_tests(rdev); + if (r) +@@ -1334,7 +1334,7 @@ int radeon_device_init(struct radeon_device *rdev, + radeon_agp_disable(rdev); + r = radeon_init(rdev); + if (r) +- return r; ++ goto failed; + } + + if ((radeon_testing & 1)) { +@@ -1356,6 +1356,11 @@ int radeon_device_init(struct radeon_device *rdev, + DRM_INFO("radeon: acceleration disabled, skipping benchmarks\n"); + } + return 0; ++ ++failed: ++ if (runtime) ++ vga_switcheroo_fini_domain_pm_ops(rdev->dev); ++ return r; + } + + static void radeon_debugfs_remove_files(struct radeon_device *rdev); +@@ -1376,6 +1381,8 @@ void radeon_device_fini(struct radeon_device *rdev) + radeon_bo_evict_vram(rdev); + radeon_fini(rdev); + vga_switcheroo_unregister_client(rdev->pdev); ++ if (rdev->flags & RADEON_IS_PX) ++ vga_switcheroo_fini_domain_pm_ops(rdev->dev); + vga_client_register(rdev->pdev, NULL, NULL, NULL); + if (rdev->rio_mem) + pci_iounmap(rdev->pdev, rdev->rio_mem); +@@ -1600,7 +1607,6 @@ int radeon_gpu_reset(struct radeon_device *rdev) + radeon_save_bios_scratch_regs(rdev); + /* block TTM */ + resched = ttm_bo_lock_delayed_workqueue(&rdev->mman.bdev); +- radeon_pm_suspend(rdev); + radeon_suspend(rdev); + + for (i = 0; i < RADEON_NUM_RINGS; ++i) { +@@ -1646,9 +1652,24 @@ retry: + } + } + +- radeon_pm_resume(rdev); ++ if ((rdev->pm.pm_method == PM_METHOD_DPM) && rdev->pm.dpm_enabled) { ++ /* do dpm late init */ ++ r = radeon_pm_late_init(rdev); ++ if (r) { ++ rdev->pm.dpm_enabled = false; ++ DRM_ERROR("radeon_pm_late_init failed, disabling dpm\n"); ++ } ++ } else { ++ /* resume old pm late */ ++ radeon_pm_resume(rdev); ++ } ++ + drm_helper_resume_force_mode(rdev->ddev); + ++ /* set the power state here in case we are a PX system or headless */ ++ if ((rdev->pm.pm_method == PM_METHOD_DPM) && rdev->pm.dpm_enabled) ++ radeon_pm_compute_clocks(rdev); ++ + ttm_bo_unlock_delayed_workqueue(&rdev->mman.bdev, resched); + if (r) { + /* bad news, how to tell it to userspace ? */ +diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c +index ea34a31d3bc8..0bc9106ef435 100644 +--- a/drivers/gpu/drm/radeon/radeon_kms.c ++++ b/drivers/gpu/drm/radeon/radeon_kms.c +@@ -254,7 +254,14 @@ static int radeon_info_ioctl(struct drm_device *dev, void *data, struct drm_file + } + break; + case RADEON_INFO_ACCEL_WORKING2: +- *value = rdev->accel_working; ++ if (rdev->family == CHIP_HAWAII) { ++ if (rdev->accel_working) ++ *value = 2; ++ else ++ *value = 0; ++ } else { ++ *value = rdev->accel_working; ++ } + break; + case RADEON_INFO_TILING_CONFIG: + if (rdev->family >= CHIP_BONAIRE) +diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c +index f77d9d0d54b5..cfb513f933d5 100644 +--- a/drivers/gpu/drm/radeon/radeon_pm.c ++++ b/drivers/gpu/drm/radeon/radeon_pm.c +@@ -458,10 +458,6 @@ static ssize_t radeon_get_dpm_state(struct device *dev, + struct radeon_device *rdev = ddev->dev_private; + enum radeon_pm_state_type pm = rdev->pm.dpm.user_state; + +- if ((rdev->flags & RADEON_IS_PX) && +- (ddev->switch_power_state != DRM_SWITCH_POWER_ON)) +- return snprintf(buf, PAGE_SIZE, "off\n"); +- + return snprintf(buf, PAGE_SIZE, "%s\n", + (pm == POWER_STATE_TYPE_BATTERY) ? "battery" : + (pm == POWER_STATE_TYPE_BALANCED) ? "balanced" : "performance"); +@@ -475,11 +471,6 @@ static ssize_t radeon_set_dpm_state(struct device *dev, + struct drm_device *ddev = dev_get_drvdata(dev); + struct radeon_device *rdev = ddev->dev_private; + +- /* Can't set dpm state when the card is off */ +- if ((rdev->flags & RADEON_IS_PX) && +- (ddev->switch_power_state != DRM_SWITCH_POWER_ON)) +- return -EINVAL; +- + mutex_lock(&rdev->pm.mutex); + if (strncmp("battery", buf, strlen("battery")) == 0) + rdev->pm.dpm.user_state = POWER_STATE_TYPE_BATTERY; +@@ -493,7 +484,12 @@ static ssize_t radeon_set_dpm_state(struct device *dev, + goto fail; + } + mutex_unlock(&rdev->pm.mutex); +- radeon_pm_compute_clocks(rdev); ++ ++ /* Can't set dpm state when the card is off */ ++ if (!(rdev->flags & RADEON_IS_PX) || ++ (ddev->switch_power_state == DRM_SWITCH_POWER_ON)) ++ radeon_pm_compute_clocks(rdev); ++ + fail: + return count; + } +@@ -1276,10 +1272,6 @@ int radeon_pm_init(struct radeon_device *rdev) + case CHIP_RS780: + case CHIP_RS880: + case CHIP_RV770: +- case CHIP_BARTS: +- case CHIP_TURKS: +- case CHIP_CAICOS: +- case CHIP_CAYMAN: + /* DPM requires the RLC, RV770+ dGPU requires SMC */ + if (!rdev->rlc_fw) + rdev->pm.pm_method = PM_METHOD_PROFILE; +@@ -1303,6 +1295,10 @@ int radeon_pm_init(struct radeon_device *rdev) + case CHIP_PALM: + case CHIP_SUMO: + case CHIP_SUMO2: ++ case CHIP_BARTS: ++ case CHIP_TURKS: ++ case CHIP_CAICOS: ++ case CHIP_CAYMAN: + case CHIP_ARUBA: + case CHIP_TAHITI: + case CHIP_PITCAIRN: +diff --git a/drivers/gpu/drm/radeon/radeon_semaphore.c b/drivers/gpu/drm/radeon/radeon_semaphore.c +index 9006b32d5eed..eb7b60047e86 100644 +--- a/drivers/gpu/drm/radeon/radeon_semaphore.c ++++ b/drivers/gpu/drm/radeon/radeon_semaphore.c +@@ -34,7 +34,7 @@ + int radeon_semaphore_create(struct radeon_device *rdev, + struct radeon_semaphore **semaphore) + { +- uint32_t *cpu_addr; ++ uint64_t *cpu_addr; + int i, r; + + *semaphore = kmalloc(sizeof(struct radeon_semaphore), GFP_KERNEL); +diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c +index ea93393374df..559564c1dc97 100644 +--- a/drivers/gpu/drm/radeon/si.c ++++ b/drivers/gpu/drm/radeon/si.c +@@ -4810,7 +4810,7 @@ void si_vm_flush(struct radeon_device *rdev, int ridx, struct radeon_vm *vm) + + /* write new base address */ + radeon_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, 3)); +- radeon_ring_write(ring, (WRITE_DATA_ENGINE_SEL(0) | ++ radeon_ring_write(ring, (WRITE_DATA_ENGINE_SEL(1) | + WRITE_DATA_DST_SEL(0))); + + if (vm->id < 8) { +diff --git a/drivers/gpu/drm/radeon/trinity_dpm.c b/drivers/gpu/drm/radeon/trinity_dpm.c +index 2da0e17eb960..d9cfa09b2e3f 100644 +--- a/drivers/gpu/drm/radeon/trinity_dpm.c ++++ b/drivers/gpu/drm/radeon/trinity_dpm.c +@@ -1877,7 +1877,16 @@ int trinity_dpm_init(struct radeon_device *rdev) + for (i = 0; i < SUMO_MAX_HARDWARE_POWERLEVELS; i++) + pi->at[i] = TRINITY_AT_DFLT; + +- pi->enable_bapm = false; ++ /* There are stability issues reported on with ++ * bapm enabled when switching between AC and battery ++ * power. At the same time, some MSI boards hang ++ * if it's not enabled and dpm is enabled. Just enable ++ * it for MSI boards right now. ++ */ ++ if (rdev->pdev->subsystem_vendor == 0x1462) ++ pi->enable_bapm = true; ++ else ++ pi->enable_bapm = false; + pi->enable_nbps_policy = true; + pi->enable_sclk_ds = true; + pi->enable_gfx_power_gating = true; +diff --git a/drivers/gpu/drm/tilcdc/tilcdc_drv.c b/drivers/gpu/drm/tilcdc/tilcdc_drv.c +index 171a8203892c..0644429f8559 100644 +--- a/drivers/gpu/drm/tilcdc/tilcdc_drv.c ++++ b/drivers/gpu/drm/tilcdc/tilcdc_drv.c +@@ -122,6 +122,7 @@ static int tilcdc_unload(struct drm_device *dev) + struct tilcdc_drm_private *priv = dev->dev_private; + struct tilcdc_module *mod, *cur; + ++ drm_fbdev_cma_fini(priv->fbdev); + drm_kms_helper_poll_fini(dev); + drm_mode_config_cleanup(dev); + drm_vblank_cleanup(dev); +@@ -628,10 +629,10 @@ static int __init tilcdc_drm_init(void) + static void __exit tilcdc_drm_fini(void) + { + DBG("fini"); +- tilcdc_tfp410_fini(); +- tilcdc_slave_fini(); +- tilcdc_panel_fini(); + platform_driver_unregister(&tilcdc_platform_driver); ++ tilcdc_panel_fini(); ++ tilcdc_slave_fini(); ++ tilcdc_tfp410_fini(); + } + + late_initcall(tilcdc_drm_init); +diff --git a/drivers/gpu/drm/tilcdc/tilcdc_panel.c b/drivers/gpu/drm/tilcdc/tilcdc_panel.c +index 86c67329b605..b085dcc54fb5 100644 +--- a/drivers/gpu/drm/tilcdc/tilcdc_panel.c ++++ b/drivers/gpu/drm/tilcdc/tilcdc_panel.c +@@ -151,6 +151,7 @@ struct panel_connector { + static void panel_connector_destroy(struct drm_connector *connector) + { + struct panel_connector *panel_connector = to_panel_connector(connector); ++ drm_sysfs_connector_remove(connector); + drm_connector_cleanup(connector); + kfree(panel_connector); + } +@@ -285,10 +286,8 @@ static void panel_destroy(struct tilcdc_module *mod) + { + struct panel_module *panel_mod = to_panel_module(mod); + +- if (panel_mod->timings) { ++ if (panel_mod->timings) + display_timings_release(panel_mod->timings); +- kfree(panel_mod->timings); +- } + + tilcdc_module_cleanup(mod); + kfree(panel_mod->info); +diff --git a/drivers/gpu/drm/tilcdc/tilcdc_slave.c b/drivers/gpu/drm/tilcdc/tilcdc_slave.c +index 595068ba2d5e..2f83ffb7f37e 100644 +--- a/drivers/gpu/drm/tilcdc/tilcdc_slave.c ++++ b/drivers/gpu/drm/tilcdc/tilcdc_slave.c +@@ -166,6 +166,7 @@ struct slave_connector { + static void slave_connector_destroy(struct drm_connector *connector) + { + struct slave_connector *slave_connector = to_slave_connector(connector); ++ drm_sysfs_connector_remove(connector); + drm_connector_cleanup(connector); + kfree(slave_connector); + } +diff --git a/drivers/gpu/drm/tilcdc/tilcdc_tfp410.c b/drivers/gpu/drm/tilcdc/tilcdc_tfp410.c +index c38b56b268ac..ce75ac8de4f8 100644 +--- a/drivers/gpu/drm/tilcdc/tilcdc_tfp410.c ++++ b/drivers/gpu/drm/tilcdc/tilcdc_tfp410.c +@@ -167,6 +167,7 @@ struct tfp410_connector { + static void tfp410_connector_destroy(struct drm_connector *connector) + { + struct tfp410_connector *tfp410_connector = to_tfp410_connector(connector); ++ drm_sysfs_connector_remove(connector); + drm_connector_cleanup(connector); + kfree(tfp410_connector); + } +diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c +index 863bef9f9234..cf4bad2c1d59 100644 +--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c ++++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c +@@ -297,8 +297,10 @@ static void ttm_pool_update_free_locked(struct ttm_page_pool *pool, + * + * @pool: to free the pages from + * @free_all: If set to true will free all pages in pool ++ * @gfp: GFP flags. + **/ +-static int ttm_page_pool_free(struct ttm_page_pool *pool, unsigned nr_free) ++static int ttm_page_pool_free(struct ttm_page_pool *pool, unsigned nr_free, ++ gfp_t gfp) + { + unsigned long irq_flags; + struct page *p; +@@ -309,8 +311,7 @@ static int ttm_page_pool_free(struct ttm_page_pool *pool, unsigned nr_free) + if (NUM_PAGES_TO_ALLOC < nr_free) + npages_to_free = NUM_PAGES_TO_ALLOC; + +- pages_to_free = kmalloc(npages_to_free * sizeof(struct page *), +- GFP_KERNEL); ++ pages_to_free = kmalloc(npages_to_free * sizeof(struct page *), gfp); + if (!pages_to_free) { + pr_err("Failed to allocate memory for pool free operation\n"); + return 0; +@@ -382,32 +383,35 @@ out: + * + * XXX: (dchinner) Deadlock warning! + * +- * ttm_page_pool_free() does memory allocation using GFP_KERNEL. that means +- * this can deadlock when called a sc->gfp_mask that is not equal to +- * GFP_KERNEL. ++ * We need to pass sc->gfp_mask to ttm_page_pool_free(). + * + * This code is crying out for a shrinker per pool.... + */ + static unsigned long + ttm_pool_shrink_scan(struct shrinker *shrink, struct shrink_control *sc) + { +- static atomic_t start_pool = ATOMIC_INIT(0); ++ static DEFINE_MUTEX(lock); ++ static unsigned start_pool; + unsigned i; +- unsigned pool_offset = atomic_add_return(1, &start_pool); ++ unsigned pool_offset; + struct ttm_page_pool *pool; + int shrink_pages = sc->nr_to_scan; + unsigned long freed = 0; + +- pool_offset = pool_offset % NUM_POOLS; ++ if (!mutex_trylock(&lock)) ++ return SHRINK_STOP; ++ pool_offset = ++start_pool % NUM_POOLS; + /* select start pool in round robin fashion */ + for (i = 0; i < NUM_POOLS; ++i) { + unsigned nr_free = shrink_pages; + if (shrink_pages == 0) + break; + pool = &_manager->pools[(i + pool_offset)%NUM_POOLS]; +- shrink_pages = ttm_page_pool_free(pool, nr_free); ++ shrink_pages = ttm_page_pool_free(pool, nr_free, ++ sc->gfp_mask); + freed += nr_free - shrink_pages; + } ++ mutex_unlock(&lock); + return freed; + } + +@@ -706,7 +710,7 @@ static void ttm_put_pages(struct page **pages, unsigned npages, int flags, + } + spin_unlock_irqrestore(&pool->lock, irq_flags); + if (npages) +- ttm_page_pool_free(pool, npages); ++ ttm_page_pool_free(pool, npages, GFP_KERNEL); + } + + /* +@@ -846,7 +850,8 @@ void ttm_page_alloc_fini(void) + ttm_pool_mm_shrink_fini(_manager); + + for (i = 0; i < NUM_POOLS; ++i) +- ttm_page_pool_free(&_manager->pools[i], FREE_ALL_PAGES); ++ ttm_page_pool_free(&_manager->pools[i], FREE_ALL_PAGES, ++ GFP_KERNEL); + + kobject_put(&_manager->kobj); + _manager = NULL; +diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c +index fb8259f69839..ca65df144765 100644 +--- a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c ++++ b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c +@@ -411,8 +411,10 @@ static void ttm_dma_page_put(struct dma_pool *pool, struct dma_page *d_page) + * + * @pool: to free the pages from + * @nr_free: If set to true will free all pages in pool ++ * @gfp: GFP flags. + **/ +-static unsigned ttm_dma_page_pool_free(struct dma_pool *pool, unsigned nr_free) ++static unsigned ttm_dma_page_pool_free(struct dma_pool *pool, unsigned nr_free, ++ gfp_t gfp) + { + unsigned long irq_flags; + struct dma_page *dma_p, *tmp; +@@ -430,8 +432,7 @@ static unsigned ttm_dma_page_pool_free(struct dma_pool *pool, unsigned nr_free) + npages_to_free, nr_free); + } + #endif +- pages_to_free = kmalloc(npages_to_free * sizeof(struct page *), +- GFP_KERNEL); ++ pages_to_free = kmalloc(npages_to_free * sizeof(struct page *), gfp); + + if (!pages_to_free) { + pr_err("%s: Failed to allocate memory for pool free operation\n", +@@ -530,7 +531,7 @@ static void ttm_dma_free_pool(struct device *dev, enum pool_type type) + if (pool->type != type) + continue; + /* Takes a spinlock.. */ +- ttm_dma_page_pool_free(pool, FREE_ALL_PAGES); ++ ttm_dma_page_pool_free(pool, FREE_ALL_PAGES, GFP_KERNEL); + WARN_ON(((pool->npages_in_use + pool->npages_free) != 0)); + /* This code path is called after _all_ references to the + * struct device has been dropped - so nobody should be +@@ -983,7 +984,7 @@ void ttm_dma_unpopulate(struct ttm_dma_tt *ttm_dma, struct device *dev) + + /* shrink pool if necessary (only on !is_cached pools)*/ + if (npages) +- ttm_dma_page_pool_free(pool, npages); ++ ttm_dma_page_pool_free(pool, npages, GFP_KERNEL); + ttm->state = tt_unpopulated; + } + EXPORT_SYMBOL_GPL(ttm_dma_unpopulate); +@@ -993,10 +994,7 @@ EXPORT_SYMBOL_GPL(ttm_dma_unpopulate); + * + * XXX: (dchinner) Deadlock warning! + * +- * ttm_dma_page_pool_free() does GFP_KERNEL memory allocation, and so attention +- * needs to be paid to sc->gfp_mask to determine if this can be done or not. +- * GFP_KERNEL memory allocation in a GFP_ATOMIC reclaim context woul dbe really +- * bad. ++ * We need to pass sc->gfp_mask to ttm_dma_page_pool_free(). + * + * I'm getting sadder as I hear more pathetical whimpers about needing per-pool + * shrinkers +@@ -1004,9 +1002,9 @@ EXPORT_SYMBOL_GPL(ttm_dma_unpopulate); + static unsigned long + ttm_dma_pool_shrink_scan(struct shrinker *shrink, struct shrink_control *sc) + { +- static atomic_t start_pool = ATOMIC_INIT(0); ++ static unsigned start_pool; + unsigned idx = 0; +- unsigned pool_offset = atomic_add_return(1, &start_pool); ++ unsigned pool_offset; + unsigned shrink_pages = sc->nr_to_scan; + struct device_pools *p; + unsigned long freed = 0; +@@ -1014,8 +1012,11 @@ ttm_dma_pool_shrink_scan(struct shrinker *shrink, struct shrink_control *sc) + if (list_empty(&_manager->pools)) + return SHRINK_STOP; + +- mutex_lock(&_manager->lock); +- pool_offset = pool_offset % _manager->npools; ++ if (!mutex_trylock(&_manager->lock)) ++ return SHRINK_STOP; ++ if (!_manager->npools) ++ goto out; ++ pool_offset = ++start_pool % _manager->npools; + list_for_each_entry(p, &_manager->pools, pools) { + unsigned nr_free; + +@@ -1027,13 +1028,15 @@ ttm_dma_pool_shrink_scan(struct shrinker *shrink, struct shrink_control *sc) + if (++idx < pool_offset) + continue; + nr_free = shrink_pages; +- shrink_pages = ttm_dma_page_pool_free(p->pool, nr_free); ++ shrink_pages = ttm_dma_page_pool_free(p->pool, nr_free, ++ sc->gfp_mask); + freed += nr_free - shrink_pages; + + pr_debug("%s: (%s:%d) Asked to shrink %d, have %d more to go\n", + p->pool->dev_name, p->pool->name, current->pid, + nr_free, shrink_pages); + } ++out: + mutex_unlock(&_manager->lock); + return freed; + } +@@ -1044,7 +1047,8 @@ ttm_dma_pool_shrink_count(struct shrinker *shrink, struct shrink_control *sc) + struct device_pools *p; + unsigned long count = 0; + +- mutex_lock(&_manager->lock); ++ if (!mutex_trylock(&_manager->lock)) ++ return 0; + list_for_each_entry(p, &_manager->pools, pools) + count += p->pool->npages_free; + mutex_unlock(&_manager->lock); +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c +index 6ccd993e26bf..6eae14d2a3f7 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c +@@ -180,8 +180,9 @@ void vmw_fifo_release(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo) + + mutex_lock(&dev_priv->hw_mutex); + ++ vmw_write(dev_priv, SVGA_REG_SYNC, SVGA_SYNC_GENERIC); + while (vmw_read(dev_priv, SVGA_REG_BUSY) != 0) +- vmw_write(dev_priv, SVGA_REG_SYNC, SVGA_SYNC_GENERIC); ++ ; + + dev_priv->last_read_seqno = ioread32(fifo_mem + SVGA_FIFO_FENCE); + +diff --git a/drivers/gpu/vga/vga_switcheroo.c b/drivers/gpu/vga/vga_switcheroo.c +index 6866448083b2..37ac7b5dbd06 100644 +--- a/drivers/gpu/vga/vga_switcheroo.c ++++ b/drivers/gpu/vga/vga_switcheroo.c +@@ -660,6 +660,12 @@ int vga_switcheroo_init_domain_pm_ops(struct device *dev, struct dev_pm_domain * + } + EXPORT_SYMBOL(vga_switcheroo_init_domain_pm_ops); + ++void vga_switcheroo_fini_domain_pm_ops(struct device *dev) ++{ ++ dev->pm_domain = NULL; ++} ++EXPORT_SYMBOL(vga_switcheroo_fini_domain_pm_ops); ++ + static int vga_switcheroo_runtime_resume_hdmi_audio(struct device *dev) + { + struct pci_dev *pdev = to_pci_dev(dev); +diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c +index 0b14d3261531..5da115a6fd22 100644 +--- a/drivers/hid/hid-logitech-dj.c ++++ b/drivers/hid/hid-logitech-dj.c +@@ -687,7 +687,6 @@ static int logi_dj_raw_event(struct hid_device *hdev, + struct dj_receiver_dev *djrcv_dev = hid_get_drvdata(hdev); + struct dj_report *dj_report = (struct dj_report *) data; + unsigned long flags; +- bool report_processed = false; + + dbg_hid("%s, size:%d\n", __func__, size); + +@@ -714,34 +713,42 @@ static int logi_dj_raw_event(struct hid_device *hdev, + * device (via hid_input_report() ) and return 1 so hid-core does not do + * anything else with it. + */ ++ ++ /* case 1) */ ++ if (data[0] != REPORT_ID_DJ_SHORT) ++ return false; ++ + if ((dj_report->device_index < DJ_DEVICE_INDEX_MIN) || + (dj_report->device_index > DJ_DEVICE_INDEX_MAX)) { +- dev_err(&hdev->dev, "%s: invalid device index:%d\n", ++ /* ++ * Device index is wrong, bail out. ++ * This driver can ignore safely the receiver notifications, ++ * so ignore those reports too. ++ */ ++ if (dj_report->device_index != DJ_RECEIVER_INDEX) ++ dev_err(&hdev->dev, "%s: invalid device index:%d\n", + __func__, dj_report->device_index); + return false; + } + + spin_lock_irqsave(&djrcv_dev->lock, flags); +- if (dj_report->report_id == REPORT_ID_DJ_SHORT) { +- switch (dj_report->report_type) { +- case REPORT_TYPE_NOTIF_DEVICE_PAIRED: +- case REPORT_TYPE_NOTIF_DEVICE_UNPAIRED: +- logi_dj_recv_queue_notification(djrcv_dev, dj_report); +- break; +- case REPORT_TYPE_NOTIF_CONNECTION_STATUS: +- if (dj_report->report_params[CONNECTION_STATUS_PARAM_STATUS] == +- STATUS_LINKLOSS) { +- logi_dj_recv_forward_null_report(djrcv_dev, dj_report); +- } +- break; +- default: +- logi_dj_recv_forward_report(djrcv_dev, dj_report); ++ switch (dj_report->report_type) { ++ case REPORT_TYPE_NOTIF_DEVICE_PAIRED: ++ case REPORT_TYPE_NOTIF_DEVICE_UNPAIRED: ++ logi_dj_recv_queue_notification(djrcv_dev, dj_report); ++ break; ++ case REPORT_TYPE_NOTIF_CONNECTION_STATUS: ++ if (dj_report->report_params[CONNECTION_STATUS_PARAM_STATUS] == ++ STATUS_LINKLOSS) { ++ logi_dj_recv_forward_null_report(djrcv_dev, dj_report); + } +- report_processed = true; ++ break; ++ default: ++ logi_dj_recv_forward_report(djrcv_dev, dj_report); + } + spin_unlock_irqrestore(&djrcv_dev->lock, flags); + +- return report_processed; ++ return true; + } + + static int logi_dj_probe(struct hid_device *hdev, +diff --git a/drivers/hid/hid-logitech-dj.h b/drivers/hid/hid-logitech-dj.h +index 4a4000340ce1..daeb0aa4bee9 100644 +--- a/drivers/hid/hid-logitech-dj.h ++++ b/drivers/hid/hid-logitech-dj.h +@@ -27,6 +27,7 @@ + + #define DJ_MAX_PAIRED_DEVICES 6 + #define DJ_MAX_NUMBER_NOTIFICATIONS 8 ++#define DJ_RECEIVER_INDEX 0 + #define DJ_DEVICE_INDEX_MIN 1 + #define DJ_DEVICE_INDEX_MAX 6 + +diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c +index 3b43d1cfa936..991ba79cfc72 100644 +--- a/drivers/hid/hid-magicmouse.c ++++ b/drivers/hid/hid-magicmouse.c +@@ -290,6 +290,11 @@ static int magicmouse_raw_event(struct hid_device *hdev, + if (size < 4 || ((size - 4) % 9) != 0) + return 0; + npoints = (size - 4) / 9; ++ if (npoints > 15) { ++ hid_warn(hdev, "invalid size value (%d) for TRACKPAD_REPORT_ID\n", ++ size); ++ return 0; ++ } + msc->ntouches = 0; + for (ii = 0; ii < npoints; ii++) + magicmouse_emit_touch(msc, ii, data + ii * 9 + 4); +@@ -307,6 +312,11 @@ static int magicmouse_raw_event(struct hid_device *hdev, + if (size < 6 || ((size - 6) % 8) != 0) + return 0; + npoints = (size - 6) / 8; ++ if (npoints > 15) { ++ hid_warn(hdev, "invalid size value (%d) for MOUSE_REPORT_ID\n", ++ size); ++ return 0; ++ } + msc->ntouches = 0; + for (ii = 0; ii < npoints; ii++) + magicmouse_emit_touch(msc, ii, data + ii * 8 + 6); +diff --git a/drivers/hid/hid-picolcd_core.c b/drivers/hid/hid-picolcd_core.c +index acbb021065ec..020df3c2e8b4 100644 +--- a/drivers/hid/hid-picolcd_core.c ++++ b/drivers/hid/hid-picolcd_core.c +@@ -350,6 +350,12 @@ static int picolcd_raw_event(struct hid_device *hdev, + if (!data) + return 1; + ++ if (size > 64) { ++ hid_warn(hdev, "invalid size value (%d) for picolcd raw event\n", ++ size); ++ return 0; ++ } ++ + if (report->id == REPORT_KEY_STATE) { + if (data->input_keys) + ret = picolcd_raw_keypad(data, report, raw_data+1, size-1); +diff --git a/drivers/hwmon/ds1621.c b/drivers/hwmon/ds1621.c +index fc6f5d54e7f7..8890870309e4 100644 +--- a/drivers/hwmon/ds1621.c ++++ b/drivers/hwmon/ds1621.c +@@ -309,6 +309,7 @@ static ssize_t set_convrate(struct device *dev, struct device_attribute *da, + data->conf |= (resol << DS1621_REG_CONFIG_RESOL_SHIFT); + i2c_smbus_write_byte_data(client, DS1621_REG_CONF, data->conf); + data->update_interval = ds1721_convrates[resol]; ++ data->zbits = 7 - resol; + mutex_unlock(&data->update_lock); + + return count; +diff --git a/drivers/i2c/busses/i2c-at91.c b/drivers/i2c/busses/i2c-at91.c +index c56be739006b..11e9c7f9bf9b 100644 +--- a/drivers/i2c/busses/i2c-at91.c ++++ b/drivers/i2c/busses/i2c-at91.c +@@ -101,6 +101,7 @@ struct at91_twi_dev { + unsigned twi_cwgr_reg; + struct at91_twi_pdata *pdata; + bool use_dma; ++ bool recv_len_abort; + struct at91_twi_dma dma; + }; + +@@ -267,12 +268,24 @@ static void at91_twi_read_next_byte(struct at91_twi_dev *dev) + *dev->buf = at91_twi_read(dev, AT91_TWI_RHR) & 0xff; + --dev->buf_len; + ++ /* return if aborting, we only needed to read RHR to clear RXRDY*/ ++ if (dev->recv_len_abort) ++ return; ++ + /* handle I2C_SMBUS_BLOCK_DATA */ + if (unlikely(dev->msg->flags & I2C_M_RECV_LEN)) { +- dev->msg->flags &= ~I2C_M_RECV_LEN; +- dev->buf_len += *dev->buf; +- dev->msg->len = dev->buf_len + 1; +- dev_dbg(dev->dev, "received block length %d\n", dev->buf_len); ++ /* ensure length byte is a valid value */ ++ if (*dev->buf <= I2C_SMBUS_BLOCK_MAX && *dev->buf > 0) { ++ dev->msg->flags &= ~I2C_M_RECV_LEN; ++ dev->buf_len += *dev->buf; ++ dev->msg->len = dev->buf_len + 1; ++ dev_dbg(dev->dev, "received block length %d\n", ++ dev->buf_len); ++ } else { ++ /* abort and send the stop by reading one more byte */ ++ dev->recv_len_abort = true; ++ dev->buf_len = 1; ++ } + } + + /* send stop if second but last byte has been read */ +@@ -421,8 +434,8 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev) + } + } + +- ret = wait_for_completion_interruptible_timeout(&dev->cmd_complete, +- dev->adapter.timeout); ++ ret = wait_for_completion_io_timeout(&dev->cmd_complete, ++ dev->adapter.timeout); + if (ret == 0) { + dev_err(dev->dev, "controller timed out\n"); + at91_init_twi_bus(dev); +@@ -444,6 +457,12 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev) + ret = -EIO; + goto error; + } ++ if (dev->recv_len_abort) { ++ dev_err(dev->dev, "invalid smbus block length recvd\n"); ++ ret = -EPROTO; ++ goto error; ++ } ++ + dev_dbg(dev->dev, "transfer complete\n"); + + return 0; +@@ -500,6 +519,7 @@ static int at91_twi_xfer(struct i2c_adapter *adap, struct i2c_msg *msg, int num) + dev->buf_len = m_start->len; + dev->buf = m_start->buf; + dev->msg = m_start; ++ dev->recv_len_abort = false; + + ret = at91_do_twi_transfer(dev); + +diff --git a/drivers/i2c/busses/i2c-ismt.c b/drivers/i2c/busses/i2c-ismt.c +index 8ce4f517fc56..6e932d140573 100644 +--- a/drivers/i2c/busses/i2c-ismt.c ++++ b/drivers/i2c/busses/i2c-ismt.c +@@ -497,7 +497,7 @@ static int ismt_access(struct i2c_adapter *adap, u16 addr, + desc->wr_len_cmd = dma_size; + desc->control |= ISMT_DESC_BLK; + priv->dma_buffer[0] = command; +- memcpy(&priv->dma_buffer[1], &data->block[1], dma_size); ++ memcpy(&priv->dma_buffer[1], &data->block[1], dma_size - 1); + } else { + /* Block Read */ + dev_dbg(dev, "I2C_SMBUS_BLOCK_DATA: READ\n"); +@@ -525,7 +525,7 @@ static int ismt_access(struct i2c_adapter *adap, u16 addr, + desc->wr_len_cmd = dma_size; + desc->control |= ISMT_DESC_I2C; + priv->dma_buffer[0] = command; +- memcpy(&priv->dma_buffer[1], &data->block[1], dma_size); ++ memcpy(&priv->dma_buffer[1], &data->block[1], dma_size - 1); + } else { + /* i2c Block Read */ + dev_dbg(dev, "I2C_SMBUS_I2C_BLOCK_DATA: READ\n"); +diff --git a/drivers/i2c/busses/i2c-mv64xxx.c b/drivers/i2c/busses/i2c-mv64xxx.c +index d52d84937ad3..cf891752cc73 100644 +--- a/drivers/i2c/busses/i2c-mv64xxx.c ++++ b/drivers/i2c/busses/i2c-mv64xxx.c +@@ -748,8 +748,7 @@ mv64xxx_of_config(struct mv64xxx_i2c_data *drv_data, + } + tclk = clk_get_rate(drv_data->clk); + +- rc = of_property_read_u32(np, "clock-frequency", &bus_freq); +- if (rc) ++ if (of_property_read_u32(np, "clock-frequency", &bus_freq)) + bus_freq = 100000; /* 100kHz by default */ + + if (!mv64xxx_find_baud_factors(bus_freq, tclk, +diff --git a/drivers/iio/accel/bma180.c b/drivers/iio/accel/bma180.c +index fe83d04784c8..6f039c300141 100644 +--- a/drivers/iio/accel/bma180.c ++++ b/drivers/iio/accel/bma180.c +@@ -571,7 +571,7 @@ static int bma180_probe(struct i2c_client *client, + trig->ops = &bma180_trigger_ops; + iio_trigger_set_drvdata(trig, indio_dev); + data->trig = trig; +- indio_dev->trig = trig; ++ indio_dev->trig = iio_trigger_get(trig); + + ret = iio_trigger_register(trig); + if (ret) +diff --git a/drivers/iio/adc/ad_sigma_delta.c b/drivers/iio/adc/ad_sigma_delta.c +index 9a4e0e32a771..eb799a43aef0 100644 +--- a/drivers/iio/adc/ad_sigma_delta.c ++++ b/drivers/iio/adc/ad_sigma_delta.c +@@ -472,7 +472,7 @@ static int ad_sd_probe_trigger(struct iio_dev *indio_dev) + goto error_free_irq; + + /* select default trigger */ +- indio_dev->trig = sigma_delta->trig; ++ indio_dev->trig = iio_trigger_get(sigma_delta->trig); + + return 0; + +diff --git a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c +index 7dcf83998e6f..1be235b01934 100644 +--- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c ++++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c +@@ -99,7 +99,8 @@ int hid_sensor_setup_trigger(struct iio_dev *indio_dev, const char *name, + dev_err(&indio_dev->dev, "Trigger Register Failed\n"); + goto error_free_trig; + } +- indio_dev->trig = attrb->trigger = trig; ++ attrb->trigger = trig; ++ indio_dev->trig = iio_trigger_get(trig); + + return ret; + +diff --git a/drivers/iio/common/st_sensors/st_sensors_trigger.c b/drivers/iio/common/st_sensors/st_sensors_trigger.c +index 8fc3a97eb266..8d8ca6f1e16a 100644 +--- a/drivers/iio/common/st_sensors/st_sensors_trigger.c ++++ b/drivers/iio/common/st_sensors/st_sensors_trigger.c +@@ -49,7 +49,7 @@ int st_sensors_allocate_trigger(struct iio_dev *indio_dev, + dev_err(&indio_dev->dev, "failed to register iio trigger.\n"); + goto iio_trigger_register_error; + } +- indio_dev->trig = sdata->trig; ++ indio_dev->trig = iio_trigger_get(sdata->trig); + + return 0; + +diff --git a/drivers/iio/gyro/itg3200_buffer.c b/drivers/iio/gyro/itg3200_buffer.c +index e3b3c5084070..eef50e91f17c 100644 +--- a/drivers/iio/gyro/itg3200_buffer.c ++++ b/drivers/iio/gyro/itg3200_buffer.c +@@ -132,7 +132,7 @@ int itg3200_probe_trigger(struct iio_dev *indio_dev) + goto error_free_irq; + + /* select default trigger */ +- indio_dev->trig = st->trig; ++ indio_dev->trig = iio_trigger_get(st->trig); + + return 0; + +diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c +index 03b9372c1212..926fccea8de0 100644 +--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c ++++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c +@@ -135,7 +135,7 @@ int inv_mpu6050_probe_trigger(struct iio_dev *indio_dev) + ret = iio_trigger_register(st->trig); + if (ret) + goto error_free_irq; +- indio_dev->trig = st->trig; ++ indio_dev->trig = iio_trigger_get(st->trig); + + return 0; + +diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c +index 1e8e94d4db7d..4fc88e617acf 100644 +--- a/drivers/iio/inkern.c ++++ b/drivers/iio/inkern.c +@@ -178,7 +178,7 @@ static struct iio_channel *of_iio_channel_get_by_name(struct device_node *np, + index = of_property_match_string(np, "io-channel-names", + name); + chan = of_iio_channel_get(np, index); +- if (!IS_ERR(chan)) ++ if (!IS_ERR(chan) || PTR_ERR(chan) == -EPROBE_DEFER) + break; + else if (name && index >= 0) { + pr_err("ERROR: could not get IIO channel %s:%s(%i)\n", +diff --git a/drivers/iio/magnetometer/st_magn_core.c b/drivers/iio/magnetometer/st_magn_core.c +index 52bbcfa1e077..476aa132a192 100644 +--- a/drivers/iio/magnetometer/st_magn_core.c ++++ b/drivers/iio/magnetometer/st_magn_core.c +@@ -42,7 +42,8 @@ + #define ST_MAGN_FS_AVL_5600MG 5600 + #define ST_MAGN_FS_AVL_8000MG 8000 + #define ST_MAGN_FS_AVL_8100MG 8100 +-#define ST_MAGN_FS_AVL_10000MG 10000 ++#define ST_MAGN_FS_AVL_12000MG 12000 ++#define ST_MAGN_FS_AVL_16000MG 16000 + + /* CUSTOM VALUES FOR SENSOR 1 */ + #define ST_MAGN_1_WAI_EXP 0x3c +@@ -69,20 +70,20 @@ + #define ST_MAGN_1_FS_AVL_4700_VAL 0x05 + #define ST_MAGN_1_FS_AVL_5600_VAL 0x06 + #define ST_MAGN_1_FS_AVL_8100_VAL 0x07 +-#define ST_MAGN_1_FS_AVL_1300_GAIN_XY 1100 +-#define ST_MAGN_1_FS_AVL_1900_GAIN_XY 855 +-#define ST_MAGN_1_FS_AVL_2500_GAIN_XY 670 +-#define ST_MAGN_1_FS_AVL_4000_GAIN_XY 450 +-#define ST_MAGN_1_FS_AVL_4700_GAIN_XY 400 +-#define ST_MAGN_1_FS_AVL_5600_GAIN_XY 330 +-#define ST_MAGN_1_FS_AVL_8100_GAIN_XY 230 +-#define ST_MAGN_1_FS_AVL_1300_GAIN_Z 980 +-#define ST_MAGN_1_FS_AVL_1900_GAIN_Z 760 +-#define ST_MAGN_1_FS_AVL_2500_GAIN_Z 600 +-#define ST_MAGN_1_FS_AVL_4000_GAIN_Z 400 +-#define ST_MAGN_1_FS_AVL_4700_GAIN_Z 355 +-#define ST_MAGN_1_FS_AVL_5600_GAIN_Z 295 +-#define ST_MAGN_1_FS_AVL_8100_GAIN_Z 205 ++#define ST_MAGN_1_FS_AVL_1300_GAIN_XY 909 ++#define ST_MAGN_1_FS_AVL_1900_GAIN_XY 1169 ++#define ST_MAGN_1_FS_AVL_2500_GAIN_XY 1492 ++#define ST_MAGN_1_FS_AVL_4000_GAIN_XY 2222 ++#define ST_MAGN_1_FS_AVL_4700_GAIN_XY 2500 ++#define ST_MAGN_1_FS_AVL_5600_GAIN_XY 3030 ++#define ST_MAGN_1_FS_AVL_8100_GAIN_XY 4347 ++#define ST_MAGN_1_FS_AVL_1300_GAIN_Z 1020 ++#define ST_MAGN_1_FS_AVL_1900_GAIN_Z 1315 ++#define ST_MAGN_1_FS_AVL_2500_GAIN_Z 1666 ++#define ST_MAGN_1_FS_AVL_4000_GAIN_Z 2500 ++#define ST_MAGN_1_FS_AVL_4700_GAIN_Z 2816 ++#define ST_MAGN_1_FS_AVL_5600_GAIN_Z 3389 ++#define ST_MAGN_1_FS_AVL_8100_GAIN_Z 4878 + #define ST_MAGN_1_MULTIREAD_BIT false + + /* CUSTOM VALUES FOR SENSOR 2 */ +@@ -105,10 +106,12 @@ + #define ST_MAGN_2_FS_MASK 0x60 + #define ST_MAGN_2_FS_AVL_4000_VAL 0x00 + #define ST_MAGN_2_FS_AVL_8000_VAL 0x01 +-#define ST_MAGN_2_FS_AVL_10000_VAL 0x02 +-#define ST_MAGN_2_FS_AVL_4000_GAIN 430 +-#define ST_MAGN_2_FS_AVL_8000_GAIN 230 +-#define ST_MAGN_2_FS_AVL_10000_GAIN 230 ++#define ST_MAGN_2_FS_AVL_12000_VAL 0x02 ++#define ST_MAGN_2_FS_AVL_16000_VAL 0x03 ++#define ST_MAGN_2_FS_AVL_4000_GAIN 146 ++#define ST_MAGN_2_FS_AVL_8000_GAIN 292 ++#define ST_MAGN_2_FS_AVL_12000_GAIN 438 ++#define ST_MAGN_2_FS_AVL_16000_GAIN 584 + #define ST_MAGN_2_MULTIREAD_BIT false + #define ST_MAGN_2_OUT_X_L_ADDR 0x28 + #define ST_MAGN_2_OUT_Y_L_ADDR 0x2a +@@ -266,9 +269,14 @@ static const struct st_sensors st_magn_sensors[] = { + .gain = ST_MAGN_2_FS_AVL_8000_GAIN, + }, + [2] = { +- .num = ST_MAGN_FS_AVL_10000MG, +- .value = ST_MAGN_2_FS_AVL_10000_VAL, +- .gain = ST_MAGN_2_FS_AVL_10000_GAIN, ++ .num = ST_MAGN_FS_AVL_12000MG, ++ .value = ST_MAGN_2_FS_AVL_12000_VAL, ++ .gain = ST_MAGN_2_FS_AVL_12000_GAIN, ++ }, ++ [3] = { ++ .num = ST_MAGN_FS_AVL_16000MG, ++ .value = ST_MAGN_2_FS_AVL_16000_VAL, ++ .gain = ST_MAGN_2_FS_AVL_16000_GAIN, + }, + }, + }, +diff --git a/drivers/infiniband/core/uverbs_marshall.c b/drivers/infiniband/core/uverbs_marshall.c +index e7bee46868d1..abd97247443e 100644 +--- a/drivers/infiniband/core/uverbs_marshall.c ++++ b/drivers/infiniband/core/uverbs_marshall.c +@@ -140,5 +140,9 @@ void ib_copy_path_rec_from_user(struct ib_sa_path_rec *dst, + dst->packet_life_time = src->packet_life_time; + dst->preference = src->preference; + dst->packet_life_time_selector = src->packet_life_time_selector; ++ ++ memset(dst->smac, 0, sizeof(dst->smac)); ++ memset(dst->dmac, 0, sizeof(dst->dmac)); ++ dst->vlan_id = 0xffff; + } + EXPORT_SYMBOL(ib_copy_path_rec_from_user); +diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c +index f9c12e92fdd6..11f0606792bb 100644 +--- a/drivers/infiniband/hw/mlx4/main.c ++++ b/drivers/infiniband/hw/mlx4/main.c +@@ -1622,6 +1622,7 @@ static void mlx4_ib_get_dev_addr(struct net_device *dev, + struct inet6_dev *in6_dev; + union ib_gid *pgid; + struct inet6_ifaddr *ifp; ++ union ib_gid default_gid; + #endif + union ib_gid gid; + +@@ -1642,12 +1643,15 @@ static void mlx4_ib_get_dev_addr(struct net_device *dev, + in_dev_put(in_dev); + } + #if IS_ENABLED(CONFIG_IPV6) ++ mlx4_make_default_gid(dev, &default_gid); + /* IPv6 gids */ + in6_dev = in6_dev_get(dev); + if (in6_dev) { + read_lock_bh(&in6_dev->lock); + list_for_each_entry(ifp, &in6_dev->addr_list, if_list) { + pgid = (union ib_gid *)&ifp->addr; ++ if (!memcmp(pgid, &default_gid, sizeof(*pgid))) ++ continue; + update_gid_table(ibdev, port, pgid, 0, 0); + } + read_unlock_bh(&in6_dev->lock); +@@ -1723,31 +1727,34 @@ static void mlx4_ib_scan_netdevs(struct mlx4_ib_dev *ibdev) + port_state = (netif_running(curr_netdev) && netif_carrier_ok(curr_netdev)) ? + IB_PORT_ACTIVE : IB_PORT_DOWN; + mlx4_ib_set_default_gid(ibdev, curr_netdev, port); +- } else { +- reset_gid_table(ibdev, port); +- } +- /* if using bonding/team and a slave port is down, we don't the bond IP +- * based gids in the table since flows that select port by gid may get +- * the down port. +- */ +- if (curr_master && (port_state == IB_PORT_DOWN)) { +- reset_gid_table(ibdev, port); +- mlx4_ib_set_default_gid(ibdev, curr_netdev, port); +- } +- /* if bonding is used it is possible that we add it to masters +- * only after IP address is assigned to the net bonding +- * interface. +- */ +- if (curr_master && (old_master != curr_master)) { +- reset_gid_table(ibdev, port); +- mlx4_ib_set_default_gid(ibdev, curr_netdev, port); +- mlx4_ib_get_dev_addr(curr_master, ibdev, port); +- } ++ /* if using bonding/team and a slave port is down, we ++ * don't the bond IP based gids in the table since ++ * flows that select port by gid may get the down port. ++ */ ++ if (curr_master && (port_state == IB_PORT_DOWN)) { ++ reset_gid_table(ibdev, port); ++ mlx4_ib_set_default_gid(ibdev, ++ curr_netdev, port); ++ } ++ /* if bonding is used it is possible that we add it to ++ * masters only after IP address is assigned to the ++ * net bonding interface. ++ */ ++ if (curr_master && (old_master != curr_master)) { ++ reset_gid_table(ibdev, port); ++ mlx4_ib_set_default_gid(ibdev, ++ curr_netdev, port); ++ mlx4_ib_get_dev_addr(curr_master, ibdev, port); ++ } + +- if (!curr_master && (old_master != curr_master)) { ++ if (!curr_master && (old_master != curr_master)) { ++ reset_gid_table(ibdev, port); ++ mlx4_ib_set_default_gid(ibdev, ++ curr_netdev, port); ++ mlx4_ib_get_dev_addr(curr_netdev, ibdev, port); ++ } ++ } else { + reset_gid_table(ibdev, port); +- mlx4_ib_set_default_gid(ibdev, curr_netdev, port); +- mlx4_ib_get_dev_addr(curr_netdev, ibdev, port); + } + } + +diff --git a/drivers/infiniband/hw/qib/qib_debugfs.c b/drivers/infiniband/hw/qib/qib_debugfs.c +index 799a0c3bffc4..6abd3ed3cd51 100644 +--- a/drivers/infiniband/hw/qib/qib_debugfs.c ++++ b/drivers/infiniband/hw/qib/qib_debugfs.c +@@ -193,6 +193,7 @@ static void *_qp_stats_seq_start(struct seq_file *s, loff_t *pos) + struct qib_qp_iter *iter; + loff_t n = *pos; + ++ rcu_read_lock(); + iter = qib_qp_iter_init(s->private); + if (!iter) + return NULL; +@@ -224,7 +225,7 @@ static void *_qp_stats_seq_next(struct seq_file *s, void *iter_ptr, + + static void _qp_stats_seq_stop(struct seq_file *s, void *iter_ptr) + { +- /* nothing for now */ ++ rcu_read_unlock(); + } + + static int _qp_stats_seq_show(struct seq_file *s, void *iter_ptr) +diff --git a/drivers/infiniband/hw/qib/qib_qp.c b/drivers/infiniband/hw/qib/qib_qp.c +index 0cad0c40d742..6a71b2b41b27 100644 +--- a/drivers/infiniband/hw/qib/qib_qp.c ++++ b/drivers/infiniband/hw/qib/qib_qp.c +@@ -1324,7 +1324,6 @@ int qib_qp_iter_next(struct qib_qp_iter *iter) + struct qib_qp *pqp = iter->qp; + struct qib_qp *qp; + +- rcu_read_lock(); + for (; n < dev->qp_table_size; n++) { + if (pqp) + qp = rcu_dereference(pqp->next); +@@ -1332,18 +1331,11 @@ int qib_qp_iter_next(struct qib_qp_iter *iter) + qp = rcu_dereference(dev->qp_table[n]); + pqp = qp; + if (qp) { +- if (iter->qp) +- atomic_dec(&iter->qp->refcount); +- atomic_inc(&qp->refcount); +- rcu_read_unlock(); + iter->qp = qp; + iter->n = n; + return 0; + } + } +- rcu_read_unlock(); +- if (iter->qp) +- atomic_dec(&iter->qp->refcount); + return ret; + } + +diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c +index 156205a81523..c5c194c2e0b6 100644 +--- a/drivers/infiniband/ulp/isert/ib_isert.c ++++ b/drivers/infiniband/ulp/isert/ib_isert.c +@@ -511,7 +511,6 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event) + init_completion(&isert_conn->conn_wait); + init_completion(&isert_conn->conn_wait_comp_err); + kref_init(&isert_conn->conn_kref); +- kref_get(&isert_conn->conn_kref); + mutex_init(&isert_conn->conn_mutex); + spin_lock_init(&isert_conn->conn_lock); + INIT_LIST_HEAD(&isert_conn->conn_fr_pool); +@@ -663,7 +662,9 @@ isert_connect_release(struct isert_conn *isert_conn) + static void + isert_connected_handler(struct rdma_cm_id *cma_id) + { +- return; ++ struct isert_conn *isert_conn = cma_id->context; ++ ++ kref_get(&isert_conn->conn_kref); + } + + static void +@@ -715,7 +716,6 @@ isert_disconnect_work(struct work_struct *work) + + wake_up: + complete(&isert_conn->conn_wait); +- isert_put_conn(isert_conn); + } + + static void +@@ -2800,6 +2800,7 @@ static void isert_wait_conn(struct iscsi_conn *conn) + wait_for_completion(&isert_conn->conn_wait_comp_err); + + wait_for_completion(&isert_conn->conn_wait); ++ isert_put_conn(isert_conn); + } + + static void isert_free_conn(struct iscsi_conn *conn) +diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c +index 2dd1d0dd4f7d..6f5d79569136 100644 +--- a/drivers/input/keyboard/atkbd.c ++++ b/drivers/input/keyboard/atkbd.c +@@ -1791,14 +1791,6 @@ static const struct dmi_system_id atkbd_dmi_quirk_table[] __initconst = { + { + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "LG Electronics"), +- DMI_MATCH(DMI_PRODUCT_NAME, "LW25-B7HV"), +- }, +- .callback = atkbd_deactivate_fixup, +- }, +- { +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "LG Electronics"), +- DMI_MATCH(DMI_PRODUCT_NAME, "P1-J273B"), + }, + .callback = atkbd_deactivate_fixup, + }, +diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c +index 233516aff595..0b75b5764f31 100644 +--- a/drivers/input/mouse/elantech.c ++++ b/drivers/input/mouse/elantech.c +@@ -1253,6 +1253,13 @@ static bool elantech_is_signature_valid(const unsigned char *param) + if (param[1] == 0) + return true; + ++ /* ++ * Some models have a revision higher then 20. Meaning param[2] may ++ * be 10 or 20, skip the rates check for these. ++ */ ++ if (param[0] == 0x46 && (param[1] & 0xef) == 0x0f && param[2] < 40) ++ return true; ++ + for (i = 0; i < ARRAY_SIZE(rates); i++) + if (param[2] == rates[i]) + return false; +diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c +index ef9e0b8a9aa7..a50a2a7a43f7 100644 +--- a/drivers/input/mouse/synaptics.c ++++ b/drivers/input/mouse/synaptics.c +@@ -626,10 +626,61 @@ static int synaptics_parse_hw_state(const unsigned char buf[], + ((buf[0] & 0x04) >> 1) | + ((buf[3] & 0x04) >> 2)); + ++ if ((SYN_CAP_ADV_GESTURE(priv->ext_cap_0c) || ++ SYN_CAP_IMAGE_SENSOR(priv->ext_cap_0c)) && ++ hw->w == 2) { ++ synaptics_parse_agm(buf, priv, hw); ++ return 1; ++ } ++ ++ hw->x = (((buf[3] & 0x10) << 8) | ++ ((buf[1] & 0x0f) << 8) | ++ buf[4]); ++ hw->y = (((buf[3] & 0x20) << 7) | ++ ((buf[1] & 0xf0) << 4) | ++ buf[5]); ++ hw->z = buf[2]; ++ + hw->left = (buf[0] & 0x01) ? 1 : 0; + hw->right = (buf[0] & 0x02) ? 1 : 0; + +- if (SYN_CAP_CLICKPAD(priv->ext_cap_0c)) { ++ if (SYN_CAP_FORCEPAD(priv->ext_cap_0c)) { ++ /* ++ * ForcePads, like Clickpads, use middle button ++ * bits to report primary button clicks. ++ * Unfortunately they report primary button not ++ * only when user presses on the pad above certain ++ * threshold, but also when there are more than one ++ * finger on the touchpad, which interferes with ++ * out multi-finger gestures. ++ */ ++ if (hw->z == 0) { ++ /* No contacts */ ++ priv->press = priv->report_press = false; ++ } else if (hw->w >= 4 && ((buf[0] ^ buf[3]) & 0x01)) { ++ /* ++ * Single-finger touch with pressure above ++ * the threshold. If pressure stays long ++ * enough, we'll start reporting primary ++ * button. We rely on the device continuing ++ * sending data even if finger does not ++ * move. ++ */ ++ if (!priv->press) { ++ priv->press_start = jiffies; ++ priv->press = true; ++ } else if (time_after(jiffies, ++ priv->press_start + ++ msecs_to_jiffies(50))) { ++ priv->report_press = true; ++ } ++ } else { ++ priv->press = false; ++ } ++ ++ hw->left = priv->report_press; ++ ++ } else if (SYN_CAP_CLICKPAD(priv->ext_cap_0c)) { + /* + * Clickpad's button is transmitted as middle button, + * however, since it is primary button, we will report +@@ -648,21 +699,6 @@ static int synaptics_parse_hw_state(const unsigned char buf[], + hw->down = ((buf[0] ^ buf[3]) & 0x02) ? 1 : 0; + } + +- if ((SYN_CAP_ADV_GESTURE(priv->ext_cap_0c) || +- SYN_CAP_IMAGE_SENSOR(priv->ext_cap_0c)) && +- hw->w == 2) { +- synaptics_parse_agm(buf, priv, hw); +- return 1; +- } +- +- hw->x = (((buf[3] & 0x10) << 8) | +- ((buf[1] & 0x0f) << 8) | +- buf[4]); +- hw->y = (((buf[3] & 0x20) << 7) | +- ((buf[1] & 0xf0) << 4) | +- buf[5]); +- hw->z = buf[2]; +- + if (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) && + ((buf[0] ^ buf[3]) & 0x02)) { + switch (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) & ~0x01) { +diff --git a/drivers/input/mouse/synaptics.h b/drivers/input/mouse/synaptics.h +index e594af0b264b..fb2e076738ae 100644 +--- a/drivers/input/mouse/synaptics.h ++++ b/drivers/input/mouse/synaptics.h +@@ -78,6 +78,11 @@ + * 2 0x08 image sensor image sensor tracks 5 fingers, but only + * reports 2. + * 2 0x20 report min query 0x0f gives min coord reported ++ * 2 0x80 forcepad forcepad is a variant of clickpad that ++ * does not have physical buttons but rather ++ * uses pressure above certain threshold to ++ * report primary clicks. Forcepads also have ++ * clickpad bit set. + */ + #define SYN_CAP_CLICKPAD(ex0c) ((ex0c) & 0x100000) /* 1-button ClickPad */ + #define SYN_CAP_CLICKPAD2BTN(ex0c) ((ex0c) & 0x000100) /* 2-button ClickPad */ +@@ -86,6 +91,7 @@ + #define SYN_CAP_ADV_GESTURE(ex0c) ((ex0c) & 0x080000) + #define SYN_CAP_REDUCED_FILTERING(ex0c) ((ex0c) & 0x000400) + #define SYN_CAP_IMAGE_SENSOR(ex0c) ((ex0c) & 0x000800) ++#define SYN_CAP_FORCEPAD(ex0c) ((ex0c) & 0x008000) + + /* synaptics modes query bits */ + #define SYN_MODE_ABSOLUTE(m) ((m) & (1 << 7)) +@@ -177,6 +183,11 @@ struct synaptics_data { + */ + struct synaptics_hw_state agm; + bool agm_pending; /* new AGM packet received */ ++ ++ /* ForcePad handling */ ++ unsigned long press_start; ++ bool press; ++ bool report_press; + }; + + void synaptics_module_init(void); +diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h +index 381b20d4c561..f1da362c3e65 100644 +--- a/drivers/input/serio/i8042-x86ia64io.h ++++ b/drivers/input/serio/i8042-x86ia64io.h +@@ -458,6 +458,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv4 Notebook PC"), + }, + }, ++ { ++ /* Avatar AVIU-145A6 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Intel"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "IC4I"), ++ }, ++ }, + { } + }; + +@@ -601,6 +608,14 @@ static const struct dmi_system_id __initconst i8042_dmi_notimeout_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv4 Notebook PC"), + }, + }, ++ { ++ /* Fujitsu U574 laptop */ ++ /* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK U574"), ++ }, ++ }, + { } + }; + +diff --git a/drivers/input/serio/serport.c b/drivers/input/serio/serport.c +index 0cb7ef59071b..69175b825346 100644 +--- a/drivers/input/serio/serport.c ++++ b/drivers/input/serio/serport.c +@@ -21,6 +21,7 @@ + #include + #include + #include ++#include + + MODULE_AUTHOR("Vojtech Pavlik "); + MODULE_DESCRIPTION("Input device TTY line discipline"); +@@ -198,28 +199,55 @@ static ssize_t serport_ldisc_read(struct tty_struct * tty, struct file * file, u + return 0; + } + ++static void serport_set_type(struct tty_struct *tty, unsigned long type) ++{ ++ struct serport *serport = tty->disc_data; ++ ++ serport->id.proto = type & 0x000000ff; ++ serport->id.id = (type & 0x0000ff00) >> 8; ++ serport->id.extra = (type & 0x00ff0000) >> 16; ++} ++ + /* + * serport_ldisc_ioctl() allows to set the port protocol, and device ID + */ + +-static int serport_ldisc_ioctl(struct tty_struct * tty, struct file * file, unsigned int cmd, unsigned long arg) ++static int serport_ldisc_ioctl(struct tty_struct *tty, struct file *file, ++ unsigned int cmd, unsigned long arg) + { +- struct serport *serport = (struct serport*) tty->disc_data; +- unsigned long type; +- + if (cmd == SPIOCSTYPE) { ++ unsigned long type; ++ + if (get_user(type, (unsigned long __user *) arg)) + return -EFAULT; + +- serport->id.proto = type & 0x000000ff; +- serport->id.id = (type & 0x0000ff00) >> 8; +- serport->id.extra = (type & 0x00ff0000) >> 16; ++ serport_set_type(tty, type); ++ return 0; ++ } ++ ++ return -EINVAL; ++} ++ ++#ifdef CONFIG_COMPAT ++#define COMPAT_SPIOCSTYPE _IOW('q', 0x01, compat_ulong_t) ++static long serport_ldisc_compat_ioctl(struct tty_struct *tty, ++ struct file *file, ++ unsigned int cmd, unsigned long arg) ++{ ++ if (cmd == COMPAT_SPIOCSTYPE) { ++ void __user *uarg = compat_ptr(arg); ++ compat_ulong_t compat_type; ++ ++ if (get_user(compat_type, (compat_ulong_t __user *)uarg)) ++ return -EFAULT; + ++ serport_set_type(tty, compat_type); + return 0; + } + + return -EINVAL; + } ++#endif + + static void serport_ldisc_write_wakeup(struct tty_struct * tty) + { +@@ -243,6 +271,9 @@ static struct tty_ldisc_ops serport_ldisc = { + .close = serport_ldisc_close, + .read = serport_ldisc_read, + .ioctl = serport_ldisc_ioctl, ++#ifdef CONFIG_COMPAT ++ .compat_ioctl = serport_ldisc_compat_ioctl, ++#endif + .receive_buf = serport_ldisc_receive, + .write_wakeup = serport_ldisc_write_wakeup + }; +diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c +index 1d9ab39af29f..2ecac467f78f 100644 +--- a/drivers/iommu/arm-smmu.c ++++ b/drivers/iommu/arm-smmu.c +@@ -794,8 +794,11 @@ static void arm_smmu_init_context_bank(struct arm_smmu_domain *smmu_domain) + reg |= TTBCR_EAE | + (TTBCR_SH_IS << TTBCR_SH0_SHIFT) | + (TTBCR_RGN_WBWA << TTBCR_ORGN0_SHIFT) | +- (TTBCR_RGN_WBWA << TTBCR_IRGN0_SHIFT) | +- (TTBCR_SL0_LVL_1 << TTBCR_SL0_SHIFT); ++ (TTBCR_RGN_WBWA << TTBCR_IRGN0_SHIFT); ++ ++ if (!stage1) ++ reg |= (TTBCR_SL0_LVL_1 << TTBCR_SL0_SHIFT); ++ + writel_relaxed(reg, cb_base + ARM_SMMU_CB_TTBCR); + + /* MAIR0 (stage-1 only) */ +diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c +index 735e939a846d..2331543005b2 100644 +--- a/drivers/md/dm-cache-target.c ++++ b/drivers/md/dm-cache-target.c +@@ -890,8 +890,8 @@ static void migration_success_pre_commit(struct dm_cache_migration *mg) + struct cache *cache = mg->cache; + + if (mg->writeback) { +- cell_defer(cache, mg->old_ocell, false); + clear_dirty(cache, mg->old_oblock, mg->cblock); ++ cell_defer(cache, mg->old_ocell, false); + cleanup_migration(mg); + return; + +@@ -946,13 +946,13 @@ static void migration_success_post_commit(struct dm_cache_migration *mg) + } + + } else { ++ clear_dirty(cache, mg->new_oblock, mg->cblock); + if (mg->requeue_holder) + cell_defer(cache, mg->new_ocell, true); + else { + bio_endio(mg->new_ocell->holder, 0); + cell_defer(cache, mg->new_ocell, false); + } +- clear_dirty(cache, mg->new_oblock, mg->cblock); + cleanup_migration(mg); + } + } +diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c +index 53b213226c01..9533f835ce07 100644 +--- a/drivers/md/dm-crypt.c ++++ b/drivers/md/dm-crypt.c +@@ -1681,6 +1681,7 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv) + unsigned int key_size, opt_params; + unsigned long long tmpll; + int ret; ++ size_t iv_size_padding; + struct dm_arg_set as; + const char *opt_string; + char dummy; +@@ -1717,12 +1718,23 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv) + + cc->dmreq_start = sizeof(struct ablkcipher_request); + cc->dmreq_start += crypto_ablkcipher_reqsize(any_tfm(cc)); +- cc->dmreq_start = ALIGN(cc->dmreq_start, crypto_tfm_ctx_alignment()); +- cc->dmreq_start += crypto_ablkcipher_alignmask(any_tfm(cc)) & +- ~(crypto_tfm_ctx_alignment() - 1); ++ cc->dmreq_start = ALIGN(cc->dmreq_start, __alignof__(struct dm_crypt_request)); ++ ++ if (crypto_ablkcipher_alignmask(any_tfm(cc)) < CRYPTO_MINALIGN) { ++ /* Allocate the padding exactly */ ++ iv_size_padding = -(cc->dmreq_start + sizeof(struct dm_crypt_request)) ++ & crypto_ablkcipher_alignmask(any_tfm(cc)); ++ } else { ++ /* ++ * If the cipher requires greater alignment than kmalloc ++ * alignment, we don't know the exact position of the ++ * initialization vector. We must assume worst case. ++ */ ++ iv_size_padding = crypto_ablkcipher_alignmask(any_tfm(cc)); ++ } + + cc->req_pool = mempool_create_kmalloc_pool(MIN_IOS, cc->dmreq_start + +- sizeof(struct dm_crypt_request) + cc->iv_size); ++ sizeof(struct dm_crypt_request) + iv_size_padding + cc->iv_size); + if (!cc->req_pool) { + ti->error = "Cannot allocate crypt request mempool"; + goto bad; +diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c +index d7690f86fdb9..55de4f6f7eaf 100644 +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -540,11 +540,7 @@ static int read_balance(struct r1conf *conf, struct r1bio *r1_bio, int *max_sect + has_nonrot_disk = 0; + choose_next_idle = 0; + +- if (conf->mddev->recovery_cp < MaxSector && +- (this_sector + sectors >= conf->next_resync)) +- choose_first = 1; +- else +- choose_first = 0; ++ choose_first = (conf->mddev->recovery_cp < this_sector + sectors); + + for (disk = 0 ; disk < conf->raid_disks * 2 ; disk++) { + sector_t dist; +@@ -831,7 +827,7 @@ static void flush_pending_writes(struct r1conf *conf) + * there is no normal IO happeing. It must arrange to call + * lower_barrier when the particular background IO completes. + */ +-static void raise_barrier(struct r1conf *conf) ++static void raise_barrier(struct r1conf *conf, sector_t sector_nr) + { + spin_lock_irq(&conf->resync_lock); + +@@ -841,6 +837,7 @@ static void raise_barrier(struct r1conf *conf) + + /* block any new IO from starting */ + conf->barrier++; ++ conf->next_resync = sector_nr; + + /* For these conditions we must wait: + * A: while the array is in frozen state +@@ -849,14 +846,17 @@ static void raise_barrier(struct r1conf *conf) + * C: next_resync + RESYNC_SECTORS > start_next_window, meaning + * next resync will reach to the window which normal bios are + * handling. ++ * D: while there are any active requests in the current window. + */ + wait_event_lock_irq(conf->wait_barrier, + !conf->array_frozen && + conf->barrier < RESYNC_DEPTH && ++ conf->current_window_requests == 0 && + (conf->start_next_window >= + conf->next_resync + RESYNC_SECTORS), + conf->resync_lock); + ++ conf->nr_pending++; + spin_unlock_irq(&conf->resync_lock); + } + +@@ -866,6 +866,7 @@ static void lower_barrier(struct r1conf *conf) + BUG_ON(conf->barrier <= 0); + spin_lock_irqsave(&conf->resync_lock, flags); + conf->barrier--; ++ conf->nr_pending--; + spin_unlock_irqrestore(&conf->resync_lock, flags); + wake_up(&conf->wait_barrier); + } +@@ -877,12 +878,10 @@ static bool need_to_wait_for_sync(struct r1conf *conf, struct bio *bio) + if (conf->array_frozen || !bio) + wait = true; + else if (conf->barrier && bio_data_dir(bio) == WRITE) { +- if (conf->next_resync < RESYNC_WINDOW_SECTORS) +- wait = true; +- else if ((conf->next_resync - RESYNC_WINDOW_SECTORS +- >= bio_end_sector(bio)) || +- (conf->next_resync + NEXT_NORMALIO_DISTANCE +- <= bio->bi_iter.bi_sector)) ++ if ((conf->mddev->curr_resync_completed ++ >= bio_end_sector(bio)) || ++ (conf->next_resync + NEXT_NORMALIO_DISTANCE ++ <= bio->bi_iter.bi_sector)) + wait = false; + else + wait = true; +@@ -919,8 +918,8 @@ static sector_t wait_barrier(struct r1conf *conf, struct bio *bio) + } + + if (bio && bio_data_dir(bio) == WRITE) { +- if (conf->next_resync + NEXT_NORMALIO_DISTANCE +- <= bio->bi_iter.bi_sector) { ++ if (bio->bi_iter.bi_sector >= ++ conf->mddev->curr_resync_completed) { + if (conf->start_next_window == MaxSector) + conf->start_next_window = + conf->next_resync + +@@ -1186,6 +1185,7 @@ read_again: + atomic_read(&bitmap->behind_writes) == 0); + } + r1_bio->read_disk = rdisk; ++ r1_bio->start_next_window = 0; + + read_bio = bio_clone_mddev(bio, GFP_NOIO, mddev); + bio_trim(read_bio, r1_bio->sector - bio->bi_iter.bi_sector, +@@ -1548,8 +1548,13 @@ static void close_sync(struct r1conf *conf) + mempool_destroy(conf->r1buf_pool); + conf->r1buf_pool = NULL; + ++ spin_lock_irq(&conf->resync_lock); + conf->next_resync = 0; + conf->start_next_window = MaxSector; ++ conf->current_window_requests += ++ conf->next_window_requests; ++ conf->next_window_requests = 0; ++ spin_unlock_irq(&conf->resync_lock); + } + + static int raid1_spare_active(struct mddev *mddev) +@@ -2150,7 +2155,7 @@ static void fix_read_error(struct r1conf *conf, int read_disk, + d--; + rdev = conf->mirrors[d].rdev; + if (rdev && +- test_bit(In_sync, &rdev->flags)) ++ !test_bit(Faulty, &rdev->flags)) + r1_sync_page_io(rdev, sect, s, + conf->tmppage, WRITE); + } +@@ -2162,7 +2167,7 @@ static void fix_read_error(struct r1conf *conf, int read_disk, + d--; + rdev = conf->mirrors[d].rdev; + if (rdev && +- test_bit(In_sync, &rdev->flags)) { ++ !test_bit(Faulty, &rdev->flags)) { + if (r1_sync_page_io(rdev, sect, s, + conf->tmppage, READ)) { + atomic_add(s, &rdev->corrected_errors); +@@ -2541,9 +2546,8 @@ static sector_t sync_request(struct mddev *mddev, sector_t sector_nr, int *skipp + + bitmap_cond_end_sync(mddev->bitmap, sector_nr); + r1_bio = mempool_alloc(conf->r1buf_pool, GFP_NOIO); +- raise_barrier(conf); + +- conf->next_resync = sector_nr; ++ raise_barrier(conf, sector_nr); + + rcu_read_lock(); + /* +diff --git a/drivers/media/dvb-core/dvb-usb-ids.h b/drivers/media/dvb-core/dvb-usb-ids.h +index 80643ef9183f..fabe2fce9bc5 100644 +--- a/drivers/media/dvb-core/dvb-usb-ids.h ++++ b/drivers/media/dvb-core/dvb-usb-ids.h +@@ -279,6 +279,8 @@ + #define USB_PID_PCTV_400E 0x020f + #define USB_PID_PCTV_450E 0x0222 + #define USB_PID_PCTV_452E 0x021f ++#define USB_PID_PCTV_78E 0x025a ++#define USB_PID_PCTV_79E 0x0262 + #define USB_PID_REALTEK_RTL2831U 0x2831 + #define USB_PID_REALTEK_RTL2832U 0x2832 + #define USB_PID_TECHNOTREND_CONNECT_S2_3600 0x3007 +diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c +index 71c8570bd9ea..112394d138c9 100644 +--- a/drivers/media/i2c/adv7604.c ++++ b/drivers/media/i2c/adv7604.c +@@ -1984,7 +1984,7 @@ static int adv7604_log_status(struct v4l2_subdev *sd) + v4l2_info(sd, "HDCP keys read: %s%s\n", + (hdmi_read(sd, 0x04) & 0x20) ? "yes" : "no", + (hdmi_read(sd, 0x04) & 0x10) ? "ERROR" : ""); +- if (!is_hdmi(sd)) { ++ if (is_hdmi(sd)) { + bool audio_pll_locked = hdmi_read(sd, 0x04) & 0x01; + bool audio_sample_packet_detect = hdmi_read(sd, 0x18) & 0x01; + bool audio_mute = io_read(sd, 0x65) & 0x40; +diff --git a/drivers/media/pci/cx18/cx18-driver.c b/drivers/media/pci/cx18/cx18-driver.c +index 716bdc57fac6..83f5074706f9 100644 +--- a/drivers/media/pci/cx18/cx18-driver.c ++++ b/drivers/media/pci/cx18/cx18-driver.c +@@ -1091,6 +1091,7 @@ static int cx18_probe(struct pci_dev *pci_dev, + setup.addr = ADDR_UNSET; + setup.type = cx->options.tuner; + setup.mode_mask = T_ANALOG_TV; /* matches TV tuners */ ++ setup.config = NULL; + if (cx->options.radio > 0) + setup.mode_mask |= T_RADIO; + setup.tuner_callback = (setup.type == TUNER_XC2028) ? +diff --git a/drivers/media/usb/dvb-usb-v2/af9035.c b/drivers/media/usb/dvb-usb-v2/af9035.c +index 8ede8ea762e6..88228f735342 100644 +--- a/drivers/media/usb/dvb-usb-v2/af9035.c ++++ b/drivers/media/usb/dvb-usb-v2/af9035.c +@@ -1541,6 +1541,10 @@ static const struct usb_device_id af9035_id_table[] = { + &af9035_props, "Leadtek WinFast DTV Dongle Dual", NULL) }, + { DVB_USB_DEVICE(USB_VID_HAUPPAUGE, 0xf900, + &af9035_props, "Hauppauge WinTV-MiniStick 2", NULL) }, ++ { DVB_USB_DEVICE(USB_VID_PCTV, USB_PID_PCTV_78E, ++ &af9035_props, "PCTV 78e", RC_MAP_IT913X_V1) }, ++ { DVB_USB_DEVICE(USB_VID_PCTV, USB_PID_PCTV_79E, ++ &af9035_props, "PCTV 79e", RC_MAP_IT913X_V2) }, + { } + }; + MODULE_DEVICE_TABLE(usb, af9035_id_table); +diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c +index 1fc8334fc181..55e3075492da 100644 +--- a/drivers/net/ethernet/ibm/ibmveth.c ++++ b/drivers/net/ethernet/ibm/ibmveth.c +@@ -292,6 +292,18 @@ failure: + atomic_add(buffers_added, &(pool->available)); + } + ++/* ++ * The final 8 bytes of the buffer list is a counter of frames dropped ++ * because there was not a buffer in the buffer list capable of holding ++ * the frame. ++ */ ++static void ibmveth_update_rx_no_buffer(struct ibmveth_adapter *adapter) ++{ ++ __be64 *p = adapter->buffer_list_addr + 4096 - 8; ++ ++ adapter->rx_no_buffer = be64_to_cpup(p); ++} ++ + /* replenish routine */ + static void ibmveth_replenish_task(struct ibmveth_adapter *adapter) + { +@@ -307,8 +319,7 @@ static void ibmveth_replenish_task(struct ibmveth_adapter *adapter) + ibmveth_replenish_buffer_pool(adapter, pool); + } + +- adapter->rx_no_buffer = *(u64 *)(((char*)adapter->buffer_list_addr) + +- 4096 - 8); ++ ibmveth_update_rx_no_buffer(adapter); + } + + /* empty and free ana buffer pool - also used to do cleanup in error paths */ +@@ -698,8 +709,7 @@ static int ibmveth_close(struct net_device *netdev) + + free_irq(netdev->irq, netdev); + +- adapter->rx_no_buffer = *(u64 *)(((char *)adapter->buffer_list_addr) + +- 4096 - 8); ++ ibmveth_update_rx_no_buffer(adapter); + + ibmveth_cleanup(adapter); + +diff --git a/drivers/net/wireless/ath/carl9170/carl9170.h b/drivers/net/wireless/ath/carl9170/carl9170.h +index 8596aba34f96..237d0cda1bcb 100644 +--- a/drivers/net/wireless/ath/carl9170/carl9170.h ++++ b/drivers/net/wireless/ath/carl9170/carl9170.h +@@ -256,6 +256,7 @@ struct ar9170 { + atomic_t rx_work_urbs; + atomic_t rx_pool_urbs; + kernel_ulong_t features; ++ bool usb_ep_cmd_is_bulk; + + /* firmware settings */ + struct completion fw_load_wait; +diff --git a/drivers/net/wireless/ath/carl9170/usb.c b/drivers/net/wireless/ath/carl9170/usb.c +index ca115f33746f..bc931f6f1f0f 100644 +--- a/drivers/net/wireless/ath/carl9170/usb.c ++++ b/drivers/net/wireless/ath/carl9170/usb.c +@@ -621,9 +621,16 @@ int __carl9170_exec_cmd(struct ar9170 *ar, struct carl9170_cmd *cmd, + goto err_free; + } + +- usb_fill_int_urb(urb, ar->udev, usb_sndintpipe(ar->udev, +- AR9170_USB_EP_CMD), cmd, cmd->hdr.len + 4, +- carl9170_usb_cmd_complete, ar, 1); ++ if (ar->usb_ep_cmd_is_bulk) ++ usb_fill_bulk_urb(urb, ar->udev, ++ usb_sndbulkpipe(ar->udev, AR9170_USB_EP_CMD), ++ cmd, cmd->hdr.len + 4, ++ carl9170_usb_cmd_complete, ar); ++ else ++ usb_fill_int_urb(urb, ar->udev, ++ usb_sndintpipe(ar->udev, AR9170_USB_EP_CMD), ++ cmd, cmd->hdr.len + 4, ++ carl9170_usb_cmd_complete, ar, 1); + + if (free_buf) + urb->transfer_flags |= URB_FREE_BUFFER; +@@ -1032,9 +1039,10 @@ static void carl9170_usb_firmware_step2(const struct firmware *fw, + static int carl9170_usb_probe(struct usb_interface *intf, + const struct usb_device_id *id) + { ++ struct usb_endpoint_descriptor *ep; + struct ar9170 *ar; + struct usb_device *udev; +- int err; ++ int i, err; + + err = usb_reset_device(interface_to_usbdev(intf)); + if (err) +@@ -1050,6 +1058,21 @@ static int carl9170_usb_probe(struct usb_interface *intf, + ar->intf = intf; + ar->features = id->driver_info; + ++ /* We need to remember the type of endpoint 4 because it differs ++ * between high- and full-speed configuration. The high-speed ++ * configuration specifies it as interrupt and the full-speed ++ * configuration as bulk endpoint. This information is required ++ * later when sending urbs to that endpoint. ++ */ ++ for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; ++i) { ++ ep = &intf->cur_altsetting->endpoint[i].desc; ++ ++ if (usb_endpoint_num(ep) == AR9170_USB_EP_CMD && ++ usb_endpoint_dir_out(ep) && ++ usb_endpoint_type(ep) == USB_ENDPOINT_XFER_BULK) ++ ar->usb_ep_cmd_is_bulk = true; ++ } ++ + usb_set_intfdata(intf, ar); + SET_IEEE80211_DEV(ar->hw, &intf->dev); + +diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fweh.c b/drivers/net/wireless/brcm80211/brcmfmac/fweh.c +index fad77dd2a3a5..3f9cb894d001 100644 +--- a/drivers/net/wireless/brcm80211/brcmfmac/fweh.c ++++ b/drivers/net/wireless/brcm80211/brcmfmac/fweh.c +@@ -185,7 +185,13 @@ static void brcmf_fweh_handle_if_event(struct brcmf_pub *drvr, + ifevent->action, ifevent->ifidx, ifevent->bssidx, + ifevent->flags, ifevent->role); + +- if (ifevent->flags & BRCMF_E_IF_FLAG_NOIF) { ++ /* The P2P Device interface event must not be ignored ++ * contrary to what firmware tells us. The only way to ++ * distinguish the P2P Device is by looking at the ifidx ++ * and bssidx received. ++ */ ++ if (!(ifevent->ifidx == 0 && ifevent->bssidx == 1) && ++ (ifevent->flags & BRCMF_E_IF_FLAG_NOIF)) { + brcmf_dbg(EVENT, "event can be ignored\n"); + return; + } +@@ -210,12 +216,12 @@ static void brcmf_fweh_handle_if_event(struct brcmf_pub *drvr, + return; + } + +- if (ifevent->action == BRCMF_E_IF_CHANGE) ++ if (ifp && ifevent->action == BRCMF_E_IF_CHANGE) + brcmf_fws_reset_interface(ifp); + + err = brcmf_fweh_call_event_handler(ifp, emsg->event_code, emsg, data); + +- if (ifevent->action == BRCMF_E_IF_DEL) { ++ if (ifp && ifevent->action == BRCMF_E_IF_DEL) { + brcmf_fws_del_interface(ifp); + brcmf_del_if(drvr, ifevent->bssidx); + } +diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fweh.h b/drivers/net/wireless/brcm80211/brcmfmac/fweh.h +index 51b53a73d074..d26b47698f68 100644 +--- a/drivers/net/wireless/brcm80211/brcmfmac/fweh.h ++++ b/drivers/net/wireless/brcm80211/brcmfmac/fweh.h +@@ -167,6 +167,8 @@ enum brcmf_fweh_event_code { + #define BRCMF_E_IF_ROLE_STA 0 + #define BRCMF_E_IF_ROLE_AP 1 + #define BRCMF_E_IF_ROLE_WDS 2 ++#define BRCMF_E_IF_ROLE_P2P_GO 3 ++#define BRCMF_E_IF_ROLE_P2P_CLIENT 4 + + /** + * definitions for event packet validation. +diff --git a/drivers/net/wireless/iwlwifi/dvm/rxon.c b/drivers/net/wireless/iwlwifi/dvm/rxon.c +index c1e311341b74..503a81e58185 100644 +--- a/drivers/net/wireless/iwlwifi/dvm/rxon.c ++++ b/drivers/net/wireless/iwlwifi/dvm/rxon.c +@@ -1068,6 +1068,13 @@ int iwlagn_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *ctx) + /* recalculate basic rates */ + iwl_calc_basic_rates(priv, ctx); + ++ /* ++ * force CTS-to-self frames protection if RTS-CTS is not preferred ++ * one aggregation protection method ++ */ ++ if (!priv->hw_params.use_rts_for_aggregation) ++ ctx->staging.flags |= RXON_FLG_SELF_CTS_EN; ++ + if ((ctx->vif && ctx->vif->bss_conf.use_short_slot) || + !(ctx->staging.flags & RXON_FLG_BAND_24G_MSK)) + ctx->staging.flags |= RXON_FLG_SHORT_SLOT_MSK; +@@ -1473,6 +1480,11 @@ void iwlagn_bss_info_changed(struct ieee80211_hw *hw, + else + ctx->staging.flags &= ~RXON_FLG_TGG_PROTECT_MSK; + ++ if (bss_conf->use_cts_prot) ++ ctx->staging.flags |= RXON_FLG_SELF_CTS_EN; ++ else ++ ctx->staging.flags &= ~RXON_FLG_SELF_CTS_EN; ++ + memcpy(ctx->staging.bssid_addr, bss_conf->bssid, ETH_ALEN); + + if (vif->type == NL80211_IFTYPE_AP || +diff --git a/drivers/net/wireless/iwlwifi/iwl-config.h b/drivers/net/wireless/iwlwifi/iwl-config.h +index 1ced525157dc..b45d78f53f08 100644 +--- a/drivers/net/wireless/iwlwifi/iwl-config.h ++++ b/drivers/net/wireless/iwlwifi/iwl-config.h +@@ -119,6 +119,8 @@ enum iwl_led_mode { + #define IWL_LONG_WD_TIMEOUT 10000 + #define IWL_MAX_WD_TIMEOUT 120000 + ++#define IWL_DEFAULT_MAX_TX_POWER 22 ++ + /* Antenna presence definitions */ + #define ANT_NONE 0x0 + #define ANT_A BIT(0) +diff --git a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c +index 725e954d8475..3c3eb7842c62 100644 +--- a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c ++++ b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c +@@ -118,8 +118,6 @@ static const u8 iwl_nvm_channels[] = { + #define LAST_2GHZ_HT_PLUS 9 + #define LAST_5GHZ_HT 161 + +-#define DEFAULT_MAX_TX_POWER 16 +- + /* rate data (static) */ + static struct ieee80211_rate iwl_cfg80211_rates[] = { + { .bitrate = 1 * 10, .hw_value = 0, .hw_value_short = 0, }, +@@ -242,7 +240,7 @@ static int iwl_init_channel_map(struct device *dev, const struct iwl_cfg *cfg, + * Default value - highest tx power value. max_power + * is not used in mvm, and is used for backwards compatibility + */ +- channel->max_power = DEFAULT_MAX_TX_POWER; ++ channel->max_power = IWL_DEFAULT_MAX_TX_POWER; + is_5ghz = channel->band == IEEE80211_BAND_5GHZ; + IWL_DEBUG_EEPROM(dev, + "Ch. %d [%sGHz] %s%s%s%s%s%s(0x%02x %ddBm): Ad-Hoc %ssupported\n", +diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api.h b/drivers/net/wireless/iwlwifi/mvm/fw-api.h +index 989d7dbdca6c..d0a04779d734 100644 +--- a/drivers/net/wireless/iwlwifi/mvm/fw-api.h ++++ b/drivers/net/wireless/iwlwifi/mvm/fw-api.h +@@ -1415,14 +1415,14 @@ enum iwl_sf_scenario { + + /** + * Smart Fifo configuration command. +- * @state: smart fifo state, types listed in iwl_sf_sate. ++ * @state: smart fifo state, types listed in enum %iwl_sf_sate. + * @watermark: Minimum allowed availabe free space in RXF for transient state. + * @long_delay_timeouts: aging and idle timer values for each scenario + * in long delay state. + * @full_on_timeouts: timer values for each scenario in full on state. + */ + struct iwl_sf_cfg_cmd { +- enum iwl_sf_state state; ++ __le32 state; + __le32 watermark[SF_TRANSIENT_STATES_NUMBER]; + __le32 long_delay_timeouts[SF_NUM_SCENARIO][SF_NUM_TIMEOUT_TYPES]; + __le32 full_on_timeouts[SF_NUM_SCENARIO][SF_NUM_TIMEOUT_TYPES]; +diff --git a/drivers/net/wireless/iwlwifi/mvm/sf.c b/drivers/net/wireless/iwlwifi/mvm/sf.c +index 88809b2d1654..dab8fd13857a 100644 +--- a/drivers/net/wireless/iwlwifi/mvm/sf.c ++++ b/drivers/net/wireless/iwlwifi/mvm/sf.c +@@ -172,7 +172,7 @@ static int iwl_mvm_sf_config(struct iwl_mvm *mvm, u8 sta_id, + enum iwl_sf_state new_state) + { + struct iwl_sf_cfg_cmd sf_cmd = { +- .state = new_state, ++ .state = cpu_to_le32(new_state), + }; + struct ieee80211_sta *sta; + int ret = 0; +diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c +index 76ee486039d7..2ca62af3f81b 100644 +--- a/drivers/net/wireless/iwlwifi/mvm/tx.c ++++ b/drivers/net/wireless/iwlwifi/mvm/tx.c +@@ -173,10 +173,14 @@ static void iwl_mvm_set_tx_cmd_rate(struct iwl_mvm *mvm, + + /* + * for data packets, rate info comes from the table inside the fw. This +- * table is controlled by LINK_QUALITY commands ++ * table is controlled by LINK_QUALITY commands. Exclude ctrl port ++ * frames like EAPOLs which should be treated as mgmt frames. This ++ * avoids them being sent initially in high rates which increases the ++ * chances for completion of the 4-Way handshake. + */ + +- if (ieee80211_is_data(fc) && sta) { ++ if (ieee80211_is_data(fc) && sta && ++ !(info->control.flags & IEEE80211_TX_CTRL_PORT_CTRL_PROTO)) { + tx_cmd->initial_rate_index = 0; + tx_cmd->tx_flags |= cpu_to_le32(TX_CMD_FLG_STA_RATE); + return; +diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c +index c61311084d7e..f58316769159 100644 +--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c +@@ -317,6 +317,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = { + {RTL_USB_DEVICE(0x0bda, 0x5088, rtl92cu_hal_cfg)}, /*Thinkware-CC&C*/ + {RTL_USB_DEVICE(0x0df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/ + {RTL_USB_DEVICE(0x0df6, 0x005c, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/ ++ {RTL_USB_DEVICE(0x0df6, 0x0070, rtl92cu_hal_cfg)}, /*Sitecom - 150N */ + {RTL_USB_DEVICE(0x0df6, 0x0077, rtl92cu_hal_cfg)}, /*Sitecom-WLA2100V2*/ + {RTL_USB_DEVICE(0x0eb0, 0x9071, rtl92cu_hal_cfg)}, /*NO Brand - Etop*/ + {RTL_USB_DEVICE(0x4856, 0x0091, rtl92cu_hal_cfg)}, /*NetweeN - Feixun*/ +diff --git a/drivers/nfc/microread/microread.c b/drivers/nfc/microread/microread.c +index f868333271aa..963a4a5dc88e 100644 +--- a/drivers/nfc/microread/microread.c ++++ b/drivers/nfc/microread/microread.c +@@ -501,9 +501,13 @@ static void microread_target_discovered(struct nfc_hci_dev *hdev, u8 gate, + targets->sens_res = + be16_to_cpu(*(u16 *)&skb->data[MICROREAD_EMCF_A_ATQA]); + targets->sel_res = skb->data[MICROREAD_EMCF_A_SAK]; +- memcpy(targets->nfcid1, &skb->data[MICROREAD_EMCF_A_UID], +- skb->data[MICROREAD_EMCF_A_LEN]); + targets->nfcid1_len = skb->data[MICROREAD_EMCF_A_LEN]; ++ if (targets->nfcid1_len > sizeof(targets->nfcid1)) { ++ r = -EINVAL; ++ goto exit_free; ++ } ++ memcpy(targets->nfcid1, &skb->data[MICROREAD_EMCF_A_UID], ++ targets->nfcid1_len); + break; + case MICROREAD_GATE_ID_MREAD_ISO_A_3: + targets->supported_protocols = +@@ -511,9 +515,13 @@ static void microread_target_discovered(struct nfc_hci_dev *hdev, u8 gate, + targets->sens_res = + be16_to_cpu(*(u16 *)&skb->data[MICROREAD_EMCF_A3_ATQA]); + targets->sel_res = skb->data[MICROREAD_EMCF_A3_SAK]; +- memcpy(targets->nfcid1, &skb->data[MICROREAD_EMCF_A3_UID], +- skb->data[MICROREAD_EMCF_A3_LEN]); + targets->nfcid1_len = skb->data[MICROREAD_EMCF_A3_LEN]; ++ if (targets->nfcid1_len > sizeof(targets->nfcid1)) { ++ r = -EINVAL; ++ goto exit_free; ++ } ++ memcpy(targets->nfcid1, &skb->data[MICROREAD_EMCF_A3_UID], ++ targets->nfcid1_len); + break; + case MICROREAD_GATE_ID_MREAD_ISO_B: + targets->supported_protocols = NFC_PROTO_ISO14443_B_MASK; +diff --git a/drivers/of/irq.c b/drivers/of/irq.c +index ca0189308d72..48f20ff1add9 100644 +--- a/drivers/of/irq.c ++++ b/drivers/of/irq.c +@@ -301,16 +301,17 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar + /* Get the reg property (if any) */ + addr = of_get_property(device, "reg", NULL); + ++ /* Try the new-style interrupts-extended first */ ++ res = of_parse_phandle_with_args(device, "interrupts-extended", ++ "#interrupt-cells", index, out_irq); ++ if (!res) ++ return of_irq_parse_raw(addr, out_irq); ++ + /* Get the interrupts property */ + intspec = of_get_property(device, "interrupts", &intlen); +- if (intspec == NULL) { +- /* Try the new-style interrupts-extended */ +- res = of_parse_phandle_with_args(device, "interrupts-extended", +- "#interrupt-cells", index, out_irq); +- if (res) +- return -EINVAL; +- return of_irq_parse_raw(addr, out_irq); +- } ++ if (intspec == NULL) ++ return -EINVAL; ++ + intlen /= sizeof(*intspec); + + pr_debug(" intspec=%d intlen=%d\n", be32_to_cpup(intspec), intlen); +diff --git a/drivers/phy/phy-twl4030-usb.c b/drivers/phy/phy-twl4030-usb.c +index c3ace1db8136..aaac3594f83b 100644 +--- a/drivers/phy/phy-twl4030-usb.c ++++ b/drivers/phy/phy-twl4030-usb.c +@@ -34,6 +34,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -422,37 +423,55 @@ static void twl4030_phy_power(struct twl4030_usb *twl, int on) + } + } + +-static int twl4030_phy_power_off(struct phy *phy) ++static int twl4030_usb_runtime_suspend(struct device *dev) + { +- struct twl4030_usb *twl = phy_get_drvdata(phy); ++ struct twl4030_usb *twl = dev_get_drvdata(dev); + ++ dev_dbg(twl->dev, "%s\n", __func__); + if (twl->asleep) + return 0; + + twl4030_phy_power(twl, 0); + twl->asleep = 1; +- dev_dbg(twl->dev, "%s\n", __func__); ++ + return 0; + } + +-static void __twl4030_phy_power_on(struct twl4030_usb *twl) ++static int twl4030_usb_runtime_resume(struct device *dev) + { ++ struct twl4030_usb *twl = dev_get_drvdata(dev); ++ ++ dev_dbg(twl->dev, "%s\n", __func__); ++ if (!twl->asleep) ++ return 0; ++ + twl4030_phy_power(twl, 1); +- twl4030_i2c_access(twl, 1); +- twl4030_usb_set_mode(twl, twl->usb_mode); +- if (twl->usb_mode == T2_USB_MODE_ULPI) +- twl4030_i2c_access(twl, 0); ++ twl->asleep = 0; ++ ++ return 0; ++} ++ ++static int twl4030_phy_power_off(struct phy *phy) ++{ ++ struct twl4030_usb *twl = phy_get_drvdata(phy); ++ ++ dev_dbg(twl->dev, "%s\n", __func__); ++ pm_runtime_mark_last_busy(twl->dev); ++ pm_runtime_put_autosuspend(twl->dev); ++ ++ return 0; + } + + static int twl4030_phy_power_on(struct phy *phy) + { + struct twl4030_usb *twl = phy_get_drvdata(phy); + +- if (!twl->asleep) +- return 0; +- __twl4030_phy_power_on(twl); +- twl->asleep = 0; + dev_dbg(twl->dev, "%s\n", __func__); ++ pm_runtime_get_sync(twl->dev); ++ twl4030_i2c_access(twl, 1); ++ twl4030_usb_set_mode(twl, twl->usb_mode); ++ if (twl->usb_mode == T2_USB_MODE_ULPI) ++ twl4030_i2c_access(twl, 0); + + /* + * XXX When VBUS gets driven after musb goes to A mode, +@@ -558,9 +577,27 @@ static irqreturn_t twl4030_usb_irq(int irq, void *_twl) + * USB_LINK_VBUS state. musb_hdrc won't care until it + * starts to handle softconnect right. + */ ++ if ((status == OMAP_MUSB_VBUS_VALID) || ++ (status == OMAP_MUSB_ID_GROUND)) { ++ if (twl->asleep) ++ pm_runtime_get_sync(twl->dev); ++ } else { ++ if (!twl->asleep) { ++ pm_runtime_mark_last_busy(twl->dev); ++ pm_runtime_put_autosuspend(twl->dev); ++ } ++ } + omap_musb_mailbox(status); + } +- sysfs_notify(&twl->dev->kobj, NULL, "vbus"); ++ ++ /* don't schedule during sleep - irq works right then */ ++ if (status == OMAP_MUSB_ID_GROUND && !twl->asleep) { ++ cancel_delayed_work(&twl->id_workaround_work); ++ schedule_delayed_work(&twl->id_workaround_work, HZ); ++ } ++ ++ if (irq) ++ sysfs_notify(&twl->dev->kobj, NULL, "vbus"); + + return IRQ_HANDLED; + } +@@ -569,29 +606,8 @@ static void twl4030_id_workaround_work(struct work_struct *work) + { + struct twl4030_usb *twl = container_of(work, struct twl4030_usb, + id_workaround_work.work); +- enum omap_musb_vbus_id_status status; +- bool status_changed = false; +- +- status = twl4030_usb_linkstat(twl); +- +- spin_lock_irq(&twl->lock); +- if (status >= 0 && status != twl->linkstat) { +- twl->linkstat = status; +- status_changed = true; +- } +- spin_unlock_irq(&twl->lock); +- +- if (status_changed) { +- dev_dbg(twl->dev, "handle missing status change to %d\n", +- status); +- omap_musb_mailbox(status); +- } + +- /* don't schedule during sleep - irq works right then */ +- if (status == OMAP_MUSB_ID_GROUND && !twl->asleep) { +- cancel_delayed_work(&twl->id_workaround_work); +- schedule_delayed_work(&twl->id_workaround_work, HZ); +- } ++ twl4030_usb_irq(0, twl); + } + + static int twl4030_phy_init(struct phy *phy) +@@ -599,22 +615,17 @@ static int twl4030_phy_init(struct phy *phy) + struct twl4030_usb *twl = phy_get_drvdata(phy); + enum omap_musb_vbus_id_status status; + +- /* +- * Start in sleep state, we'll get called through set_suspend() +- * callback when musb is runtime resumed and it's time to start. +- */ +- __twl4030_phy_power(twl, 0); +- twl->asleep = 1; +- ++ pm_runtime_get_sync(twl->dev); + status = twl4030_usb_linkstat(twl); + twl->linkstat = status; + +- if (status == OMAP_MUSB_ID_GROUND || status == OMAP_MUSB_VBUS_VALID) { ++ if (status == OMAP_MUSB_ID_GROUND || status == OMAP_MUSB_VBUS_VALID) + omap_musb_mailbox(twl->linkstat); +- twl4030_phy_power_on(phy); +- } + + sysfs_notify(&twl->dev->kobj, NULL, "vbus"); ++ pm_runtime_mark_last_busy(twl->dev); ++ pm_runtime_put_autosuspend(twl->dev); ++ + return 0; + } + +@@ -650,6 +661,11 @@ static const struct phy_ops ops = { + .owner = THIS_MODULE, + }; + ++static const struct dev_pm_ops twl4030_usb_pm_ops = { ++ SET_RUNTIME_PM_OPS(twl4030_usb_runtime_suspend, ++ twl4030_usb_runtime_resume, NULL) ++}; ++ + static int twl4030_usb_probe(struct platform_device *pdev) + { + struct twl4030_usb_data *pdata = dev_get_platdata(&pdev->dev); +@@ -726,6 +742,11 @@ static int twl4030_usb_probe(struct platform_device *pdev) + + ATOMIC_INIT_NOTIFIER_HEAD(&twl->phy.notifier); + ++ pm_runtime_use_autosuspend(&pdev->dev); ++ pm_runtime_set_autosuspend_delay(&pdev->dev, 2000); ++ pm_runtime_enable(&pdev->dev); ++ pm_runtime_get_sync(&pdev->dev); ++ + /* Our job is to use irqs and status from the power module + * to keep the transceiver disabled when nothing's connected. + * +@@ -744,6 +765,9 @@ static int twl4030_usb_probe(struct platform_device *pdev) + return status; + } + ++ pm_runtime_mark_last_busy(&pdev->dev); ++ pm_runtime_put_autosuspend(twl->dev); ++ + dev_info(&pdev->dev, "Initialized TWL4030 USB module\n"); + return 0; + } +@@ -753,6 +777,7 @@ static int twl4030_usb_remove(struct platform_device *pdev) + struct twl4030_usb *twl = platform_get_drvdata(pdev); + int val; + ++ pm_runtime_get_sync(twl->dev); + cancel_delayed_work(&twl->id_workaround_work); + device_remove_file(twl->dev, &dev_attr_vbus); + +@@ -772,9 +797,8 @@ static int twl4030_usb_remove(struct platform_device *pdev) + + /* disable complete OTG block */ + twl4030_usb_clear_bits(twl, POWER_CTRL, POWER_CTRL_OTG_ENAB); +- +- if (!twl->asleep) +- twl4030_phy_power(twl, 0); ++ pm_runtime_mark_last_busy(twl->dev); ++ pm_runtime_put(twl->dev); + + return 0; + } +@@ -792,6 +816,7 @@ static struct platform_driver twl4030_usb_driver = { + .remove = twl4030_usb_remove, + .driver = { + .name = "twl4030_usb", ++ .pm = &twl4030_usb_pm_ops, + .owner = THIS_MODULE, + .of_match_table = of_match_ptr(twl4030_usb_id_table), + }, +diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c +index 40462415291e..454998669c2a 100644 +--- a/drivers/scsi/libiscsi.c ++++ b/drivers/scsi/libiscsi.c +@@ -717,11 +717,21 @@ __iscsi_conn_send_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr, + return NULL; + } + ++ if (data_size > ISCSI_DEF_MAX_RECV_SEG_LEN) { ++ iscsi_conn_printk(KERN_ERR, conn, "Invalid buffer len of %u for login task. Max len is %u\n", data_size, ISCSI_DEF_MAX_RECV_SEG_LEN); ++ return NULL; ++ } ++ + task = conn->login_task; + } else { + if (session->state != ISCSI_STATE_LOGGED_IN) + return NULL; + ++ if (data_size != 0) { ++ iscsi_conn_printk(KERN_ERR, conn, "Can not send data buffer of len %u for op 0x%x\n", data_size, opcode); ++ return NULL; ++ } ++ + BUG_ON(conn->c_stage == ISCSI_CONN_INITIAL_STAGE); + BUG_ON(conn->c_stage == ISCSI_CONN_STOPPED); + +diff --git a/drivers/spi/spi-dw-pci.c b/drivers/spi/spi-dw-pci.c +index 3f3dc1226edf..e14960470d8d 100644 +--- a/drivers/spi/spi-dw-pci.c ++++ b/drivers/spi/spi-dw-pci.c +@@ -62,6 +62,8 @@ static int spi_pci_probe(struct pci_dev *pdev, + if (ret) + return ret; + ++ dws->regs = pcim_iomap_table(pdev)[pci_bar]; ++ + dws->bus_num = 0; + dws->num_cs = 4; + dws->irq = pdev->irq; +diff --git a/drivers/spi/spi-omap2-mcspi.c b/drivers/spi/spi-omap2-mcspi.c +index a64f1557c156..b0059e7552b0 100644 +--- a/drivers/spi/spi-omap2-mcspi.c ++++ b/drivers/spi/spi-omap2-mcspi.c +@@ -321,7 +321,8 @@ static void omap2_mcspi_set_fifo(const struct spi_device *spi, + disable_fifo: + if (t->rx_buf != NULL) + chconf &= ~OMAP2_MCSPI_CHCONF_FFER; +- else ++ ++ if (t->tx_buf != NULL) + chconf &= ~OMAP2_MCSPI_CHCONF_FFET; + + mcspi_write_chconf0(spi, chconf); +diff --git a/drivers/staging/iio/meter/ade7758_trigger.c b/drivers/staging/iio/meter/ade7758_trigger.c +index 7a94ddd42f59..8c4f2896cd0d 100644 +--- a/drivers/staging/iio/meter/ade7758_trigger.c ++++ b/drivers/staging/iio/meter/ade7758_trigger.c +@@ -85,7 +85,7 @@ int ade7758_probe_trigger(struct iio_dev *indio_dev) + ret = iio_trigger_register(st->trig); + + /* select default trigger */ +- indio_dev->trig = st->trig; ++ indio_dev->trig = iio_trigger_get(st->trig); + if (ret) + goto error_free_irq; + +diff --git a/drivers/staging/imx-drm/ipuv3-plane.c b/drivers/staging/imx-drm/ipuv3-plane.c +index 34b642a12f8b..c70f1734b274 100644 +--- a/drivers/staging/imx-drm/ipuv3-plane.c ++++ b/drivers/staging/imx-drm/ipuv3-plane.c +@@ -277,7 +277,8 @@ static void ipu_plane_dpms(struct ipu_plane *ipu_plane, int mode) + + ipu_idmac_put(ipu_plane->ipu_ch); + ipu_dmfc_put(ipu_plane->dmfc); +- ipu_dp_put(ipu_plane->dp); ++ if (ipu_plane->dp) ++ ipu_dp_put(ipu_plane->dp); + } + } + +diff --git a/drivers/staging/lustre/lustre/Kconfig b/drivers/staging/lustre/lustre/Kconfig +index 209e4c7e6f8a..4f65ba1158bf 100644 +--- a/drivers/staging/lustre/lustre/Kconfig ++++ b/drivers/staging/lustre/lustre/Kconfig +@@ -57,4 +57,5 @@ config LUSTRE_TRANSLATE_ERRNOS + config LUSTRE_LLITE_LLOOP + tristate "Lustre virtual block device" + depends on LUSTRE_FS && BLOCK ++ depends on !PPC_64K_PAGES && !ARM64_64K_PAGES + default m +diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c +index f329ad294fc0..104f29e6b290 100644 +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -4513,6 +4513,7 @@ static void iscsit_logout_post_handler_diffcid( + { + struct iscsi_conn *l_conn; + struct iscsi_session *sess = conn->sess; ++ bool conn_found = false; + + if (!sess) + return; +@@ -4521,12 +4522,13 @@ static void iscsit_logout_post_handler_diffcid( + list_for_each_entry(l_conn, &sess->sess_conn_list, conn_list) { + if (l_conn->cid == cid) { + iscsit_inc_conn_usage_count(l_conn); ++ conn_found = true; + break; + } + } + spin_unlock_bh(&sess->conn_lock); + +- if (!l_conn) ++ if (!conn_found) + return; + + if (l_conn->sock) +diff --git a/drivers/target/iscsi/iscsi_target_parameters.c b/drivers/target/iscsi/iscsi_target_parameters.c +index 4d2e23fc76fd..43b7e6a616b8 100644 +--- a/drivers/target/iscsi/iscsi_target_parameters.c ++++ b/drivers/target/iscsi/iscsi_target_parameters.c +@@ -601,7 +601,7 @@ int iscsi_copy_param_list( + param_list = kzalloc(sizeof(struct iscsi_param_list), GFP_KERNEL); + if (!param_list) { + pr_err("Unable to allocate memory for struct iscsi_param_list.\n"); +- goto err_out; ++ return -1; + } + INIT_LIST_HEAD(¶m_list->param_list); + INIT_LIST_HEAD(¶m_list->extra_response_list); +diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c +index 483d324020a6..f30385385544 100644 +--- a/drivers/target/target_core_configfs.c ++++ b/drivers/target/target_core_configfs.c +@@ -2359,7 +2359,7 @@ static ssize_t target_core_alua_tg_pt_gp_store_attr_alua_support_##_name(\ + pr_err("Invalid value '%ld', must be '0' or '1'\n", tmp); \ + return -EINVAL; \ + } \ +- if (!tmp) \ ++ if (tmp) \ + t->_var |= _bit; \ + else \ + t->_var &= ~_bit; \ +diff --git a/drivers/tty/serial/8250/8250_dma.c b/drivers/tty/serial/8250/8250_dma.c +index ab9096dc3849..148ffe4c232f 100644 +--- a/drivers/tty/serial/8250/8250_dma.c ++++ b/drivers/tty/serial/8250/8250_dma.c +@@ -192,21 +192,28 @@ int serial8250_request_dma(struct uart_8250_port *p) + + dma->rx_buf = dma_alloc_coherent(dma->rxchan->device->dev, dma->rx_size, + &dma->rx_addr, GFP_KERNEL); +- if (!dma->rx_buf) { +- dma_release_channel(dma->rxchan); +- dma_release_channel(dma->txchan); +- return -ENOMEM; +- } ++ if (!dma->rx_buf) ++ goto err; + + /* TX buffer */ + dma->tx_addr = dma_map_single(dma->txchan->device->dev, + p->port.state->xmit.buf, + UART_XMIT_SIZE, + DMA_TO_DEVICE); ++ if (dma_mapping_error(dma->txchan->device->dev, dma->tx_addr)) { ++ dma_free_coherent(dma->rxchan->device->dev, dma->rx_size, ++ dma->rx_buf, dma->rx_addr); ++ goto err; ++ } + + dev_dbg_ratelimited(p->port.dev, "got both dma channels\n"); + + return 0; ++err: ++ dma_release_channel(dma->rxchan); ++ dma_release_channel(dma->txchan); ++ ++ return -ENOMEM; + } + EXPORT_SYMBOL_GPL(serial8250_request_dma); + +diff --git a/drivers/usb/chipidea/ci_hdrc_msm.c b/drivers/usb/chipidea/ci_hdrc_msm.c +index 2d51d852b474..ca1123d415c5 100644 +--- a/drivers/usb/chipidea/ci_hdrc_msm.c ++++ b/drivers/usb/chipidea/ci_hdrc_msm.c +@@ -20,13 +20,13 @@ + static void ci_hdrc_msm_notify_event(struct ci_hdrc *ci, unsigned event) + { + struct device *dev = ci->gadget.dev.parent; +- int val; + + switch (event) { + case CI_HDRC_CONTROLLER_RESET_EVENT: + dev_dbg(dev, "CI_HDRC_CONTROLLER_RESET_EVENT received\n"); + writel(0, USB_AHBBURST); + writel(0, USB_AHBMODE); ++ usb_phy_init(ci->transceiver); + break; + case CI_HDRC_CONTROLLER_STOPPED_EVENT: + dev_dbg(dev, "CI_HDRC_CONTROLLER_STOPPED_EVENT received\n"); +@@ -34,10 +34,7 @@ static void ci_hdrc_msm_notify_event(struct ci_hdrc *ci, unsigned event) + * Put the transceiver in non-driving mode. Otherwise host + * may not detect soft-disconnection. + */ +- val = usb_phy_io_read(ci->transceiver, ULPI_FUNC_CTRL); +- val &= ~ULPI_FUNC_CTRL_OPMODE_MASK; +- val |= ULPI_FUNC_CTRL_OPMODE_NONDRIVING; +- usb_phy_io_write(ci->transceiver, val, ULPI_FUNC_CTRL); ++ usb_phy_notify_disconnect(ci->transceiver, USB_SPEED_UNKNOWN); + break; + default: + dev_dbg(dev, "unknown ci_hdrc event\n"); +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index 6650df70bb35..263612ce1f62 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -4764,9 +4764,10 @@ static void hub_events(void) + + hub = list_entry(tmp, struct usb_hub, event_list); + kref_get(&hub->kref); ++ hdev = hub->hdev; ++ usb_get_dev(hdev); + spin_unlock_irq(&hub_event_lock); + +- hdev = hub->hdev; + hub_dev = hub->intfdev; + intf = to_usb_interface(hub_dev); + dev_dbg(hub_dev, "state %d ports %d chg %04x evt %04x\n", +@@ -4979,6 +4980,7 @@ static void hub_events(void) + usb_autopm_put_interface(intf); + loop_disconnected: + usb_unlock_device(hdev); ++ usb_put_dev(hdev); + kref_put(&hub->kref, hub_release); + + } /* end while (1) */ +diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c +index a49217ae3533..f074755372a0 100644 +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -583,12 +583,6 @@ static int dwc3_remove(struct platform_device *pdev) + { + struct dwc3 *dwc = platform_get_drvdata(pdev); + +- usb_phy_set_suspend(dwc->usb2_phy, 1); +- usb_phy_set_suspend(dwc->usb3_phy, 1); +- +- pm_runtime_put_sync(&pdev->dev); +- pm_runtime_disable(&pdev->dev); +- + dwc3_debugfs_exit(dwc); + + switch (dwc->dr_mode) { +@@ -609,8 +603,15 @@ static int dwc3_remove(struct platform_device *pdev) + + dwc3_event_buffers_cleanup(dwc); + dwc3_free_event_buffers(dwc); ++ ++ usb_phy_set_suspend(dwc->usb2_phy, 1); ++ usb_phy_set_suspend(dwc->usb3_phy, 1); ++ + dwc3_core_exit(dwc); + ++ pm_runtime_put_sync(&pdev->dev); ++ pm_runtime_disable(&pdev->dev); ++ + return 0; + } + +diff --git a/drivers/usb/dwc3/dwc3-omap.c b/drivers/usb/dwc3/dwc3-omap.c +index b269dbd47fc4..2a6841c95b64 100644 +--- a/drivers/usb/dwc3/dwc3-omap.c ++++ b/drivers/usb/dwc3/dwc3-omap.c +@@ -582,9 +582,9 @@ static int dwc3_omap_remove(struct platform_device *pdev) + if (omap->extcon_id_dev.edev) + extcon_unregister_interest(&omap->extcon_id_dev); + dwc3_omap_disable_irqs(omap); ++ device_for_each_child(&pdev->dev, NULL, dwc3_omap_remove_core); + pm_runtime_put_sync(&pdev->dev); + pm_runtime_disable(&pdev->dev); +- device_for_each_child(&pdev->dev, NULL, dwc3_omap_remove_core); + + return 0; + } +diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c +index 81cda09b47e3..488a30836c36 100644 +--- a/drivers/usb/host/ehci-hcd.c ++++ b/drivers/usb/host/ehci-hcd.c +@@ -965,8 +965,6 @@ rescan: + } + + qh->exception = 1; +- if (ehci->rh_state < EHCI_RH_RUNNING) +- qh->qh_state = QH_STATE_IDLE; + switch (qh->qh_state) { + case QH_STATE_LINKED: + WARN_ON(!list_empty(&qh->qtd_list)); +diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c +index 9992fbfec85f..93fe089cd51a 100644 +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -470,7 +470,8 @@ static void xhci_hub_report_usb2_link_state(u32 *status, u32 status_reg) + } + + /* Updates Link Status for super Speed port */ +-static void xhci_hub_report_usb3_link_state(u32 *status, u32 status_reg) ++static void xhci_hub_report_usb3_link_state(struct xhci_hcd *xhci, ++ u32 *status, u32 status_reg) + { + u32 pls = status_reg & PORT_PLS_MASK; + +@@ -509,7 +510,8 @@ static void xhci_hub_report_usb3_link_state(u32 *status, u32 status_reg) + * in which sometimes the port enters compliance mode + * caused by a delay on the host-device negotiation. + */ +- if (pls == USB_SS_PORT_LS_COMP_MOD) ++ if ((xhci->quirks & XHCI_COMP_MODE_QUIRK) && ++ (pls == USB_SS_PORT_LS_COMP_MOD)) + pls |= USB_PORT_STAT_CONNECTION; + } + +@@ -668,7 +670,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd, + } + /* Update Port Link State */ + if (hcd->speed == HCD_USB3) { +- xhci_hub_report_usb3_link_state(&status, raw_port_status); ++ xhci_hub_report_usb3_link_state(xhci, &status, raw_port_status); + /* + * Verify if all USB3 Ports Have entered U0 already. + * Delete Compliance Mode Timer if so. +diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c +index 4133a00461b1..9bce4f0e99be 100644 +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -1723,7 +1723,7 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci) + } + + num_ports = HCS_MAX_PORTS(xhci->hcs_params1); +- for (i = 0; i < num_ports; i++) { ++ for (i = 0; i < num_ports && xhci->rh_bw; i++) { + struct xhci_interval_bw_table *bwt = &xhci->rh_bw[i].bw_table; + for (j = 0; j < XHCI_MAX_INTERVAL; j++) { + struct list_head *ep = &bwt->interval_bw[j].endpoints; +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index ab831048e8a4..82b563fc4fd6 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -3928,13 +3928,21 @@ static int __maybe_unused xhci_change_max_exit_latency(struct xhci_hcd *xhci, + int ret; + + spin_lock_irqsave(&xhci->lock, flags); +- if (max_exit_latency == xhci->devs[udev->slot_id]->current_mel) { ++ ++ virt_dev = xhci->devs[udev->slot_id]; ++ ++ /* ++ * virt_dev might not exists yet if xHC resumed from hibernate (S4) and ++ * xHC was re-initialized. Exit latency will be set later after ++ * hub_port_finish_reset() is done and xhci->devs[] are re-allocated ++ */ ++ ++ if (!virt_dev || max_exit_latency == virt_dev->current_mel) { + spin_unlock_irqrestore(&xhci->lock, flags); + return 0; + } + + /* Attempt to issue an Evaluate Context command to change the MEL. */ +- virt_dev = xhci->devs[udev->slot_id]; + command = xhci->lpm_command; + ctrl_ctx = xhci_get_input_control_ctx(xhci, command->in_ctx); + if (!ctrl_ctx) { +diff --git a/drivers/usb/misc/sisusbvga/sisusb.c b/drivers/usb/misc/sisusbvga/sisusb.c +index de98906f786d..0aef801edbc1 100644 +--- a/drivers/usb/misc/sisusbvga/sisusb.c ++++ b/drivers/usb/misc/sisusbvga/sisusb.c +@@ -3248,6 +3248,7 @@ static const struct usb_device_id sisusb_table[] = { + { USB_DEVICE(0x0711, 0x0918) }, + { USB_DEVICE(0x0711, 0x0920) }, + { USB_DEVICE(0x0711, 0x0950) }, ++ { USB_DEVICE(0x0711, 0x5200) }, + { USB_DEVICE(0x182d, 0x021c) }, + { USB_DEVICE(0x182d, 0x0269) }, + { } +diff --git a/drivers/usb/phy/phy-tegra-usb.c b/drivers/usb/phy/phy-tegra-usb.c +index bbe4f8e6e8d7..8834b70c868c 100644 +--- a/drivers/usb/phy/phy-tegra-usb.c ++++ b/drivers/usb/phy/phy-tegra-usb.c +@@ -881,8 +881,8 @@ static int utmi_phy_probe(struct tegra_usb_phy *tegra_phy, + return -ENOMEM; + } + +- tegra_phy->config = devm_kzalloc(&pdev->dev, +- sizeof(*tegra_phy->config), GFP_KERNEL); ++ tegra_phy->config = devm_kzalloc(&pdev->dev, sizeof(*config), ++ GFP_KERNEL); + if (!tegra_phy->config) { + dev_err(&pdev->dev, + "unable to allocate memory for USB UTMIP config\n"); +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index 8b0f517abb6b..3614620e09e1 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -741,6 +741,7 @@ static const struct usb_device_id id_table_combined[] = { + { USB_DEVICE(FTDI_VID, FTDI_NDI_AURORA_SCU_PID), + .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk }, + { USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) }, ++ { USB_DEVICE(NOVITUS_VID, NOVITUS_BONO_E_PID) }, + { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_S03_PID) }, + { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_59_PID) }, + { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_57A_PID) }, +@@ -952,6 +953,8 @@ static const struct usb_device_id id_table_combined[] = { + { USB_DEVICE(FTDI_VID, FTDI_EKEY_CONV_USB_PID) }, + /* Infineon Devices */ + { USB_DEVICE_INTERFACE_NUMBER(INFINEON_VID, INFINEON_TRIBOARD_PID, 1) }, ++ /* GE Healthcare devices */ ++ { USB_DEVICE(GE_HEALTHCARE_VID, GE_HEALTHCARE_NEMO_TRACKER_PID) }, + { } /* Terminating entry */ + }; + +diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h +index 70b0b1d88ae9..5937b2d242f2 100644 +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -837,6 +837,12 @@ + #define TELLDUS_TELLSTICK_PID 0x0C30 /* RF control dongle 433 MHz using FT232RL */ + + /* ++ * NOVITUS printers ++ */ ++#define NOVITUS_VID 0x1a28 ++#define NOVITUS_BONO_E_PID 0x6010 ++ ++/* + * RT Systems programming cables for various ham radios + */ + #define RTSYSTEMS_VID 0x2100 /* Vendor ID */ +@@ -1385,3 +1391,9 @@ + * ekey biometric systems GmbH (http://ekey.net/) + */ + #define FTDI_EKEY_CONV_USB_PID 0xCB08 /* Converter USB */ ++ ++/* ++ * GE Healthcare devices ++ */ ++#define GE_HEALTHCARE_VID 0x1901 ++#define GE_HEALTHCARE_NEMO_TRACKER_PID 0x0015 +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 9da566a3f5c8..e47aabe0c760 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -275,8 +275,12 @@ static void option_instat_callback(struct urb *urb); + #define ZTE_PRODUCT_MF622 0x0001 + #define ZTE_PRODUCT_MF628 0x0015 + #define ZTE_PRODUCT_MF626 0x0031 +-#define ZTE_PRODUCT_MC2718 0xffe8 + #define ZTE_PRODUCT_AC2726 0xfff1 ++#define ZTE_PRODUCT_CDMA_TECH 0xfffe ++#define ZTE_PRODUCT_AC8710T 0xffff ++#define ZTE_PRODUCT_MC2718 0xffe8 ++#define ZTE_PRODUCT_AD3812 0xffeb ++#define ZTE_PRODUCT_MC2716 0xffed + + #define BENQ_VENDOR_ID 0x04a5 + #define BENQ_PRODUCT_H10 0x4068 +@@ -494,6 +498,10 @@ static void option_instat_callback(struct urb *urb); + #define INOVIA_VENDOR_ID 0x20a6 + #define INOVIA_SEW858 0x1105 + ++/* VIA Telecom */ ++#define VIATELECOM_VENDOR_ID 0x15eb ++#define VIATELECOM_PRODUCT_CDS7 0x0001 ++ + /* some devices interfaces need special handling due to a number of reasons */ + enum option_blacklist_reason { + OPTION_BLACKLIST_NONE = 0, +@@ -527,10 +535,18 @@ static const struct option_blacklist_info zte_k3765_z_blacklist = { + .reserved = BIT(4), + }; + ++static const struct option_blacklist_info zte_ad3812_z_blacklist = { ++ .sendsetup = BIT(0) | BIT(1) | BIT(2), ++}; ++ + static const struct option_blacklist_info zte_mc2718_z_blacklist = { + .sendsetup = BIT(1) | BIT(2) | BIT(3) | BIT(4), + }; + ++static const struct option_blacklist_info zte_mc2716_z_blacklist = { ++ .sendsetup = BIT(1) | BIT(2) | BIT(3), ++}; ++ + static const struct option_blacklist_info huawei_cdc12_blacklist = { + .reserved = BIT(1) | BIT(2), + }; +@@ -1070,6 +1086,7 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_INTERFACE_CLASS(BANDRICH_VENDOR_ID, BANDRICH_PRODUCT_1012, 0xff) }, + { USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC650) }, + { USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC680) }, ++ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6000)}, /* ZTE AC8700 */ + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */ + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */ + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */ +@@ -1544,13 +1561,18 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff93, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff94, 0xff, 0xff, 0xff) }, + +- /* NOTE: most ZTE CDMA devices should be driven by zte_ev, not option */ ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710T, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MC2718, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&zte_mc2718_z_blacklist }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AD3812, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&zte_ad3812_z_blacklist }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MC2716, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&zte_mc2716_z_blacklist }, + { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x01) }, + { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x05) }, + { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x86, 0x10) }, +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) }, + + { USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) }, + { USB_DEVICE(DLINK_VENDOR_ID, DLINK_PRODUCT_DWM_652) }, +@@ -1724,6 +1746,7 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ + { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) }, ++ { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) }, + { } /* Terminating entry */ + }; + MODULE_DEVICE_TABLE(usb, option_ids); +diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c +index b3d5a35c0d4b..e9bad928039f 100644 +--- a/drivers/usb/serial/pl2303.c ++++ b/drivers/usb/serial/pl2303.c +@@ -45,6 +45,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_GPRS) }, + { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_HCR331) }, + { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_MOTOROLA) }, ++ { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_ZTEK) }, + { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) }, + { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) }, + { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID) }, +diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h +index 42bc082896ac..71fd9da1d6e7 100644 +--- a/drivers/usb/serial/pl2303.h ++++ b/drivers/usb/serial/pl2303.h +@@ -22,6 +22,7 @@ + #define PL2303_PRODUCT_ID_GPRS 0x0609 + #define PL2303_PRODUCT_ID_HCR331 0x331a + #define PL2303_PRODUCT_ID_MOTOROLA 0x0307 ++#define PL2303_PRODUCT_ID_ZTEK 0xe1f1 + + #define ATEN_VENDOR_ID 0x0557 + #define ATEN_VENDOR_ID2 0x0547 +diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c +index 37480348e39b..74a9375a9bb5 100644 +--- a/drivers/usb/serial/sierra.c ++++ b/drivers/usb/serial/sierra.c +@@ -282,14 +282,19 @@ static const struct usb_device_id id_table[] = { + /* Sierra Wireless HSPA Non-Composite Device */ + { USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x6892, 0xFF, 0xFF, 0xFF)}, + { USB_DEVICE(0x1199, 0x6893) }, /* Sierra Wireless Device */ +- { USB_DEVICE(0x1199, 0x68A3), /* Sierra Wireless Direct IP modems */ ++ /* Sierra Wireless Direct IP modems */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x68A3, 0xFF, 0xFF, 0xFF), ++ .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist ++ }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x68AA, 0xFF, 0xFF, 0xFF), + .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist + }, + /* AT&T Direct IP LTE modems */ + { USB_DEVICE_AND_INTERFACE_INFO(0x0F3D, 0x68AA, 0xFF, 0xFF, 0xFF), + .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist + }, +- { USB_DEVICE(0x0f3d, 0x68A3), /* Airprime/Sierra Wireless Direct IP modems */ ++ /* Airprime/Sierra Wireless Direct IP modems */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x0F3D, 0x68A3, 0xFF, 0xFF, 0xFF), + .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist + }, + +diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c +index b169b0f9b3a2..9a08e18e09b9 100644 +--- a/drivers/usb/serial/usb-serial.c ++++ b/drivers/usb/serial/usb-serial.c +@@ -764,29 +764,39 @@ static int usb_serial_probe(struct usb_interface *interface, + if (usb_endpoint_is_bulk_in(endpoint)) { + /* we found a bulk in endpoint */ + dev_dbg(ddev, "found bulk in on endpoint %d\n", i); +- bulk_in_endpoint[num_bulk_in] = endpoint; +- ++num_bulk_in; ++ if (num_bulk_in < MAX_NUM_PORTS) { ++ bulk_in_endpoint[num_bulk_in] = endpoint; ++ ++num_bulk_in; ++ } + } + + if (usb_endpoint_is_bulk_out(endpoint)) { + /* we found a bulk out endpoint */ + dev_dbg(ddev, "found bulk out on endpoint %d\n", i); +- bulk_out_endpoint[num_bulk_out] = endpoint; +- ++num_bulk_out; ++ if (num_bulk_out < MAX_NUM_PORTS) { ++ bulk_out_endpoint[num_bulk_out] = endpoint; ++ ++num_bulk_out; ++ } + } + + if (usb_endpoint_is_int_in(endpoint)) { + /* we found a interrupt in endpoint */ + dev_dbg(ddev, "found interrupt in on endpoint %d\n", i); +- interrupt_in_endpoint[num_interrupt_in] = endpoint; +- ++num_interrupt_in; ++ if (num_interrupt_in < MAX_NUM_PORTS) { ++ interrupt_in_endpoint[num_interrupt_in] = ++ endpoint; ++ ++num_interrupt_in; ++ } + } + + if (usb_endpoint_is_int_out(endpoint)) { + /* we found an interrupt out endpoint */ + dev_dbg(ddev, "found interrupt out on endpoint %d\n", i); +- interrupt_out_endpoint[num_interrupt_out] = endpoint; +- ++num_interrupt_out; ++ if (num_interrupt_out < MAX_NUM_PORTS) { ++ interrupt_out_endpoint[num_interrupt_out] = ++ endpoint; ++ ++num_interrupt_out; ++ } + } + } + +@@ -809,8 +819,10 @@ static int usb_serial_probe(struct usb_interface *interface, + if (usb_endpoint_is_int_in(endpoint)) { + /* we found a interrupt in endpoint */ + dev_dbg(ddev, "found interrupt in for Prolific device on separate interface\n"); +- interrupt_in_endpoint[num_interrupt_in] = endpoint; +- ++num_interrupt_in; ++ if (num_interrupt_in < MAX_NUM_PORTS) { ++ interrupt_in_endpoint[num_interrupt_in] = endpoint; ++ ++num_interrupt_in; ++ } + } + } + } +@@ -850,6 +862,11 @@ static int usb_serial_probe(struct usb_interface *interface, + num_ports = type->num_ports; + } + ++ if (num_ports > MAX_NUM_PORTS) { ++ dev_warn(ddev, "too many ports requested: %d\n", num_ports); ++ num_ports = MAX_NUM_PORTS; ++ } ++ + serial->num_ports = num_ports; + serial->num_bulk_in = num_bulk_in; + serial->num_bulk_out = num_bulk_out; +diff --git a/drivers/usb/serial/zte_ev.c b/drivers/usb/serial/zte_ev.c +index e40ab739c4a6..c9bb107d5e5c 100644 +--- a/drivers/usb/serial/zte_ev.c ++++ b/drivers/usb/serial/zte_ev.c +@@ -272,28 +272,16 @@ static void zte_ev_usb_serial_close(struct usb_serial_port *port) + } + + static const struct usb_device_id id_table[] = { +- /* AC8710, AC8710T */ +- { USB_DEVICE_AND_INTERFACE_INFO(0x19d2, 0xffff, 0xff, 0xff, 0xff) }, +- /* AC8700 */ +- { USB_DEVICE_AND_INTERFACE_INFO(0x19d2, 0xfffe, 0xff, 0xff, 0xff) }, +- /* MG880 */ +- { USB_DEVICE(0x19d2, 0xfffd) }, +- { USB_DEVICE(0x19d2, 0xfffc) }, +- { USB_DEVICE(0x19d2, 0xfffb) }, +- /* AC8710_V3 */ ++ { USB_DEVICE(0x19d2, 0xffec) }, ++ { USB_DEVICE(0x19d2, 0xffee) }, + { USB_DEVICE(0x19d2, 0xfff6) }, + { USB_DEVICE(0x19d2, 0xfff7) }, + { USB_DEVICE(0x19d2, 0xfff8) }, + { USB_DEVICE(0x19d2, 0xfff9) }, +- { USB_DEVICE(0x19d2, 0xffee) }, +- /* AC2716, MC2716 */ +- { USB_DEVICE_AND_INTERFACE_INFO(0x19d2, 0xffed, 0xff, 0xff, 0xff) }, +- /* AD3812 */ +- { USB_DEVICE_AND_INTERFACE_INFO(0x19d2, 0xffeb, 0xff, 0xff, 0xff) }, +- { USB_DEVICE(0x19d2, 0xffec) }, +- { USB_DEVICE(0x05C6, 0x3197) }, +- { USB_DEVICE(0x05C6, 0x6000) }, +- { USB_DEVICE(0x05C6, 0x9008) }, ++ { USB_DEVICE(0x19d2, 0xfffb) }, ++ { USB_DEVICE(0x19d2, 0xfffc) }, ++ /* MG880 */ ++ { USB_DEVICE(0x19d2, 0xfffd) }, + { }, + }; + MODULE_DEVICE_TABLE(usb, id_table); +diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h +index 042c83b01046..7f625306ea80 100644 +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -101,6 +101,12 @@ UNUSUAL_DEV( 0x03f0, 0x4002, 0x0001, 0x0001, + "PhotoSmart R707", + USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_FIX_CAPACITY), + ++UNUSUAL_DEV( 0x03f3, 0x0001, 0x0000, 0x9999, ++ "Adaptec", ++ "USBConnect 2000", ++ USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_euscsi_init, ++ US_FL_SCM_MULT_TARG ), ++ + /* Reported by Sebastian Kapfer + * and Olaf Hering (different bcd's, same vendor/product) + * for USB floppies that need the SINGLE_LUN enforcement. +@@ -741,6 +747,12 @@ UNUSUAL_DEV( 0x059b, 0x0001, 0x0100, 0x0100, + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_SINGLE_LUN ), + ++UNUSUAL_DEV( 0x059b, 0x0040, 0x0100, 0x0100, ++ "Iomega", ++ "Jaz USB Adapter", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_SINGLE_LUN ), ++ + /* Reported by */ + UNUSUAL_DEV( 0x059f, 0x0643, 0x0000, 0x0000, + "LaCie", +@@ -1113,6 +1125,18 @@ UNUSUAL_DEV( 0x0851, 0x1543, 0x0200, 0x0200, + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_NOT_LOCKABLE), + ++UNUSUAL_DEV( 0x085a, 0x0026, 0x0100, 0x0133, ++ "Xircom", ++ "PortGear USB-SCSI (Mac USB Dock)", ++ USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_euscsi_init, ++ US_FL_SCM_MULT_TARG ), ++ ++UNUSUAL_DEV( 0x085a, 0x0028, 0x0100, 0x0133, ++ "Xircom", ++ "PortGear USB to SCSI Converter", ++ USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_euscsi_init, ++ US_FL_SCM_MULT_TARG ), ++ + /* Submitted by Jan De Luyck */ + UNUSUAL_DEV( 0x08bd, 0x1100, 0x0000, 0x0000, + "CITIZEN", +@@ -1945,6 +1969,14 @@ UNUSUAL_DEV( 0x152d, 0x2329, 0x0100, 0x0100, + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_IGNORE_RESIDUE | US_FL_SANE_SENSE ), + ++/* Entrega Technologies U1-SC25 (later Xircom PortGear PGSCSI) ++ * and Mac USB Dock USB-SCSI */ ++UNUSUAL_DEV( 0x1645, 0x0007, 0x0100, 0x0133, ++ "Entrega Technologies", ++ "USB to SCSI Converter", ++ USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_euscsi_init, ++ US_FL_SCM_MULT_TARG ), ++ + /* Reported by Robert Schedel + * Note: this is a 'super top' device like the above 14cd/6600 device */ + UNUSUAL_DEV( 0x1652, 0x6600, 0x0201, 0x0201, +@@ -1967,6 +1999,12 @@ UNUSUAL_DEV( 0x177f, 0x0400, 0x0000, 0x0000, + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_BULK_IGNORE_TAG | US_FL_MAX_SECTORS_64 ), + ++UNUSUAL_DEV( 0x1822, 0x0001, 0x0000, 0x9999, ++ "Ariston Technologies", ++ "iConnect USB to SCSI adapter", ++ USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_euscsi_init, ++ US_FL_SCM_MULT_TARG ), ++ + /* Reported by Hans de Goede + * These Appotech controllers are found in Picture Frames, they provide a + * (buggy) emulation of a cdrom drive which contains the windows software +diff --git a/drivers/uwb/lc-dev.c b/drivers/uwb/lc-dev.c +index 80079b8fed15..d0303f0dbe15 100644 +--- a/drivers/uwb/lc-dev.c ++++ b/drivers/uwb/lc-dev.c +@@ -431,16 +431,19 @@ void uwbd_dev_onair(struct uwb_rc *rc, struct uwb_beca_e *bce) + uwb_dev->mac_addr = *bce->mac_addr; + uwb_dev->dev_addr = bce->dev_addr; + dev_set_name(&uwb_dev->dev, "%s", macbuf); ++ ++ /* plug the beacon cache */ ++ bce->uwb_dev = uwb_dev; ++ uwb_dev->bce = bce; ++ uwb_bce_get(bce); /* released in uwb_dev_sys_release() */ ++ + result = uwb_dev_add(uwb_dev, &rc->uwb_dev.dev, rc); + if (result < 0) { + dev_err(dev, "new device %s: cannot instantiate device\n", + macbuf); + goto error_dev_add; + } +- /* plug the beacon cache */ +- bce->uwb_dev = uwb_dev; +- uwb_dev->bce = bce; +- uwb_bce_get(bce); /* released in uwb_dev_sys_release() */ ++ + dev_info(dev, "uwb device (mac %s dev %s) connected to %s %s\n", + macbuf, devbuf, rc->uwb_dev.dev.parent->bus->name, + dev_name(rc->uwb_dev.dev.parent)); +@@ -448,6 +451,8 @@ void uwbd_dev_onair(struct uwb_rc *rc, struct uwb_beca_e *bce) + return; + + error_dev_add: ++ bce->uwb_dev = NULL; ++ uwb_bce_put(bce); + kfree(uwb_dev); + return; + } +diff --git a/drivers/xen/manage.c b/drivers/xen/manage.c +index 624e8dc24532..602913d7ae03 100644 +--- a/drivers/xen/manage.c ++++ b/drivers/xen/manage.c +@@ -111,16 +111,11 @@ static void do_suspend(void) + + shutting_down = SHUTDOWN_SUSPEND; + +-#ifdef CONFIG_PREEMPT +- /* If the kernel is preemptible, we need to freeze all the processes +- to prevent them from being in the middle of a pagetable update +- during suspend. */ + err = freeze_processes(); + if (err) { + pr_err("%s: freeze failed %d\n", __func__, err); + goto out; + } +-#endif + + err = dpm_suspend_start(PMSG_FREEZE); + if (err) { +@@ -169,10 +164,8 @@ out_resume: + dpm_resume_end(si.cancelled ? PMSG_THAW : PMSG_RESTORE); + + out_thaw: +-#ifdef CONFIG_PREEMPT + thaw_processes(); + out: +-#endif + shutting_down = SHUTDOWN_INVALID; + } + #endif /* CONFIG_HIBERNATE_CALLBACKS */ +diff --git a/fs/aio.c b/fs/aio.c +index 6d68e01dc7ca..f45ddaa4fffa 100644 +--- a/fs/aio.c ++++ b/fs/aio.c +@@ -141,6 +141,7 @@ struct kioctx { + + struct { + unsigned tail; ++ unsigned completed_events; + spinlock_t completion_lock; + } ____cacheline_aligned_in_smp; + +@@ -796,6 +797,9 @@ void exit_aio(struct mm_struct *mm) + unsigned i = 0; + + while (1) { ++ struct completion requests_done = ++ COMPLETION_INITIALIZER_ONSTACK(requests_done); ++ + rcu_read_lock(); + table = rcu_dereference(mm->ioctx_table); + +@@ -823,7 +827,10 @@ void exit_aio(struct mm_struct *mm) + */ + ctx->mmap_size = 0; + +- kill_ioctx(mm, ctx, NULL); ++ kill_ioctx(mm, ctx, &requests_done); ++ ++ /* Wait until all IO for the context are done. */ ++ wait_for_completion(&requests_done); + } + } + +@@ -880,6 +887,68 @@ out: + return ret; + } + ++/* refill_reqs_available ++ * Updates the reqs_available reference counts used for tracking the ++ * number of free slots in the completion ring. This can be called ++ * from aio_complete() (to optimistically update reqs_available) or ++ * from aio_get_req() (the we're out of events case). It must be ++ * called holding ctx->completion_lock. ++ */ ++static void refill_reqs_available(struct kioctx *ctx, unsigned head, ++ unsigned tail) ++{ ++ unsigned events_in_ring, completed; ++ ++ /* Clamp head since userland can write to it. */ ++ head %= ctx->nr_events; ++ if (head <= tail) ++ events_in_ring = tail - head; ++ else ++ events_in_ring = ctx->nr_events - (head - tail); ++ ++ completed = ctx->completed_events; ++ if (events_in_ring < completed) ++ completed -= events_in_ring; ++ else ++ completed = 0; ++ ++ if (!completed) ++ return; ++ ++ ctx->completed_events -= completed; ++ put_reqs_available(ctx, completed); ++} ++ ++/* user_refill_reqs_available ++ * Called to refill reqs_available when aio_get_req() encounters an ++ * out of space in the completion ring. ++ */ ++static void user_refill_reqs_available(struct kioctx *ctx) ++{ ++ spin_lock_irq(&ctx->completion_lock); ++ if (ctx->completed_events) { ++ struct aio_ring *ring; ++ unsigned head; ++ ++ /* Access of ring->head may race with aio_read_events_ring() ++ * here, but that's okay since whether we read the old version ++ * or the new version, and either will be valid. The important ++ * part is that head cannot pass tail since we prevent ++ * aio_complete() from updating tail by holding ++ * ctx->completion_lock. Even if head is invalid, the check ++ * against ctx->completed_events below will make sure we do the ++ * safe/right thing. ++ */ ++ ring = kmap_atomic(ctx->ring_pages[0]); ++ head = ring->head; ++ kunmap_atomic(ring); ++ ++ refill_reqs_available(ctx, head, ctx->tail); ++ } ++ ++ spin_unlock_irq(&ctx->completion_lock); ++} ++ + /* aio_get_req + * Allocate a slot for an aio request. + * Returns NULL if no requests are free. +@@ -888,8 +957,11 @@ static inline struct kiocb *aio_get_req(struct kioctx *ctx) + { + struct kiocb *req; + +- if (!get_reqs_available(ctx)) +- return NULL; ++ if (!get_reqs_available(ctx)) { ++ user_refill_reqs_available(ctx); ++ if (!get_reqs_available(ctx)) ++ return NULL; ++ } + + req = kmem_cache_alloc(kiocb_cachep, GFP_KERNEL|__GFP_ZERO); + if (unlikely(!req)) +@@ -948,8 +1020,8 @@ void aio_complete(struct kiocb *iocb, long res, long res2) + struct kioctx *ctx = iocb->ki_ctx; + struct aio_ring *ring; + struct io_event *ev_page, *event; ++ unsigned tail, pos, head; + unsigned long flags; +- unsigned tail, pos; + + /* + * Special case handling for sync iocbs: +@@ -1010,10 +1082,14 @@ void aio_complete(struct kiocb *iocb, long res, long res2) + ctx->tail = tail; + + ring = kmap_atomic(ctx->ring_pages[0]); ++ head = ring->head; + ring->tail = tail; + kunmap_atomic(ring); + flush_dcache_page(ctx->ring_pages[0]); + ++ ctx->completed_events++; ++ if (ctx->completed_events > 1) ++ refill_reqs_available(ctx, head, tail); + spin_unlock_irqrestore(&ctx->completion_lock, flags); + + pr_debug("added to ring %p at [%u]\n", iocb, tail); +@@ -1028,7 +1104,6 @@ void aio_complete(struct kiocb *iocb, long res, long res2) + + /* everything turned out well, dispose of the aiocb. */ + kiocb_free(iocb); +- put_reqs_available(ctx, 1); + + /* + * We have to order our ring_info tail store above and test +@@ -1065,6 +1140,12 @@ static long aio_read_events_ring(struct kioctx *ctx, + tail = ring->tail; + kunmap_atomic(ring); + ++ /* ++ * Ensure that once we've read the current tail pointer, that ++ * we also see the events that were stored up to the tail. ++ */ ++ smp_rmb(); ++ + pr_debug("h%u t%u m%u\n", head, tail, ctx->nr_events); + + if (head == tail) +diff --git a/fs/buffer.c b/fs/buffer.c +index 27265a8b43c1..71e2d0ed8530 100644 +--- a/fs/buffer.c ++++ b/fs/buffer.c +@@ -1029,7 +1029,8 @@ grow_dev_page(struct block_device *bdev, sector_t block, + bh = page_buffers(page); + if (bh->b_size == size) { + end_block = init_page_buffers(page, bdev, +- index << sizebits, size); ++ (sector_t)index << sizebits, ++ size); + goto done; + } + if (!try_to_free_buffers(page)) +@@ -1050,7 +1051,8 @@ grow_dev_page(struct block_device *bdev, sector_t block, + */ + spin_lock(&inode->i_mapping->private_lock); + link_dev_buffers(page, bh); +- end_block = init_page_buffers(page, bdev, index << sizebits, size); ++ end_block = init_page_buffers(page, bdev, (sector_t)index << sizebits, ++ size); + spin_unlock(&inode->i_mapping->private_lock); + done: + ret = (block < end_block) ? 1 : -ENXIO; +diff --git a/fs/cifs/link.c b/fs/cifs/link.c +index 68559fd557fb..a5c2812ead68 100644 +--- a/fs/cifs/link.c ++++ b/fs/cifs/link.c +@@ -213,8 +213,12 @@ create_mf_symlink(const unsigned int xid, struct cifs_tcon *tcon, + if (rc) + goto out; + +- rc = tcon->ses->server->ops->create_mf_symlink(xid, tcon, cifs_sb, +- fromName, buf, &bytes_written); ++ if (tcon->ses->server->ops->create_mf_symlink) ++ rc = tcon->ses->server->ops->create_mf_symlink(xid, tcon, ++ cifs_sb, fromName, buf, &bytes_written); ++ else ++ rc = -EOPNOTSUPP; ++ + if (rc) + goto out; + +diff --git a/fs/eventpoll.c b/fs/eventpoll.c +index ead00467282d..f50d79eb52db 100644 +--- a/fs/eventpoll.c ++++ b/fs/eventpoll.c +@@ -1852,7 +1852,8 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd, + goto error_tgt_fput; + + /* Check if EPOLLWAKEUP is allowed */ +- ep_take_care_of_epollwakeup(&epds); ++ if (ep_op_has_event(op)) ++ ep_take_care_of_epollwakeup(&epds); + + /* + * We have to check that the file structure underneath the file descriptor +diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c +index 5c524180c98e..bc643b97423c 100644 +--- a/fs/gfs2/inode.c ++++ b/fs/gfs2/inode.c +@@ -606,8 +606,10 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry, + if (!IS_ERR(inode)) { + d = d_splice_alias(inode, dentry); + error = PTR_ERR(d); +- if (IS_ERR(d)) ++ if (IS_ERR(d)) { ++ inode = ERR_CAST(d); + goto fail_gunlock; ++ } + error = 0; + if (file) { + if (S_ISREG(inode->i_mode)) { +@@ -823,7 +825,6 @@ static struct dentry *__gfs2_lookup(struct inode *dir, struct dentry *dentry, + + d = d_splice_alias(inode, dentry); + if (IS_ERR(d)) { +- iput(inode); + gfs2_glock_dq_uninit(&gh); + return d; + } +diff --git a/fs/lockd/svc.c b/fs/lockd/svc.c +index 6bf06a07f3e0..223e1cb14345 100644 +--- a/fs/lockd/svc.c ++++ b/fs/lockd/svc.c +@@ -253,13 +253,11 @@ static int lockd_up_net(struct svc_serv *serv, struct net *net) + + error = make_socks(serv, net); + if (error < 0) +- goto err_socks; ++ goto err_bind; + set_grace_period(net); + dprintk("lockd_up_net: per-net data created; net=%p\n", net); + return 0; + +-err_socks: +- svc_rpcb_cleanup(serv, net); + err_bind: + ln->nlmsvc_users--; + return error; +diff --git a/fs/namei.c b/fs/namei.c +index d5a4faeb39a5..dd2f2c5bda55 100644 +--- a/fs/namei.c ++++ b/fs/namei.c +@@ -642,24 +642,22 @@ static int complete_walk(struct nameidata *nd) + + static __always_inline void set_root(struct nameidata *nd) + { +- if (!nd->root.mnt) +- get_fs_root(current->fs, &nd->root); ++ get_fs_root(current->fs, &nd->root); + } + + static int link_path_walk(const char *, struct nameidata *); + +-static __always_inline void set_root_rcu(struct nameidata *nd) ++static __always_inline unsigned set_root_rcu(struct nameidata *nd) + { +- if (!nd->root.mnt) { +- struct fs_struct *fs = current->fs; +- unsigned seq; ++ struct fs_struct *fs = current->fs; ++ unsigned seq, res; + +- do { +- seq = read_seqcount_begin(&fs->seq); +- nd->root = fs->root; +- nd->seq = __read_seqcount_begin(&nd->root.dentry->d_seq); +- } while (read_seqcount_retry(&fs->seq, seq)); +- } ++ do { ++ seq = read_seqcount_begin(&fs->seq); ++ nd->root = fs->root; ++ res = __read_seqcount_begin(&nd->root.dentry->d_seq); ++ } while (read_seqcount_retry(&fs->seq, seq)); ++ return res; + } + + static void path_put_conditional(struct path *path, struct nameidata *nd) +@@ -859,7 +857,8 @@ follow_link(struct path *link, struct nameidata *nd, void **p) + return PTR_ERR(s); + } + if (*s == '/') { +- set_root(nd); ++ if (!nd->root.mnt) ++ set_root(nd); + path_put(&nd->path); + nd->path = nd->root; + path_get(&nd->root); +@@ -1132,7 +1131,8 @@ static bool __follow_mount_rcu(struct nameidata *nd, struct path *path, + + static int follow_dotdot_rcu(struct nameidata *nd) + { +- set_root_rcu(nd); ++ if (!nd->root.mnt) ++ set_root_rcu(nd); + + while (1) { + if (nd->path.dentry == nd->root.dentry && +@@ -1244,7 +1244,8 @@ static void follow_mount(struct path *path) + + static void follow_dotdot(struct nameidata *nd) + { +- set_root(nd); ++ if (!nd->root.mnt) ++ set_root(nd); + + while(1) { + struct dentry *old = nd->path.dentry; +@@ -1842,7 +1843,7 @@ static int path_init(int dfd, const char *name, unsigned int flags, + if (*name=='/') { + if (flags & LOOKUP_RCU) { + rcu_read_lock(); +- set_root_rcu(nd); ++ nd->seq = set_root_rcu(nd); + } else { + set_root(nd); + path_get(&nd->root); +diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c +index 0e46d3d1b6cc..1abe4f55dea2 100644 +--- a/fs/nfs/nfs4client.c ++++ b/fs/nfs/nfs4client.c +@@ -482,6 +482,16 @@ int nfs40_walk_client_list(struct nfs_client *new, + + spin_lock(&nn->nfs_client_lock); + list_for_each_entry(pos, &nn->nfs_client_list, cl_share_link) { ++ ++ if (pos->rpc_ops != new->rpc_ops) ++ continue; ++ ++ if (pos->cl_proto != new->cl_proto) ++ continue; ++ ++ if (pos->cl_minorversion != new->cl_minorversion) ++ continue; ++ + /* If "pos" isn't marked ready, we can't trust the + * remaining fields in "pos" */ + if (pos->cl_cons_state > NFS_CS_READY) { +@@ -501,15 +511,6 @@ int nfs40_walk_client_list(struct nfs_client *new, + if (pos->cl_cons_state != NFS_CS_READY) + continue; + +- if (pos->rpc_ops != new->rpc_ops) +- continue; +- +- if (pos->cl_proto != new->cl_proto) +- continue; +- +- if (pos->cl_minorversion != new->cl_minorversion) +- continue; +- + if (pos->cl_clientid != new->cl_clientid) + continue; + +@@ -615,6 +616,16 @@ int nfs41_walk_client_list(struct nfs_client *new, + + spin_lock(&nn->nfs_client_lock); + list_for_each_entry(pos, &nn->nfs_client_list, cl_share_link) { ++ ++ if (pos->rpc_ops != new->rpc_ops) ++ continue; ++ ++ if (pos->cl_proto != new->cl_proto) ++ continue; ++ ++ if (pos->cl_minorversion != new->cl_minorversion) ++ continue; ++ + /* If "pos" isn't marked ready, we can't trust the + * remaining fields in "pos", especially the client + * ID and serverowner fields. Wait for CREATE_SESSION +@@ -640,15 +651,6 @@ int nfs41_walk_client_list(struct nfs_client *new, + if (pos->cl_cons_state != NFS_CS_READY) + continue; + +- if (pos->rpc_ops != new->rpc_ops) +- continue; +- +- if (pos->cl_proto != new->cl_proto) +- continue; +- +- if (pos->cl_minorversion != new->cl_minorversion) +- continue; +- + if (!nfs4_match_clientids(pos, new)) + continue; + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 17f91a72840b..2e9662ea5451 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -2558,23 +2558,23 @@ static void nfs4_close_prepare(struct rpc_task *task, void *data) + is_rdwr = test_bit(NFS_O_RDWR_STATE, &state->flags); + is_rdonly = test_bit(NFS_O_RDONLY_STATE, &state->flags); + is_wronly = test_bit(NFS_O_WRONLY_STATE, &state->flags); +- /* Calculate the current open share mode */ +- calldata->arg.fmode = 0; +- if (is_rdonly || is_rdwr) +- calldata->arg.fmode |= FMODE_READ; +- if (is_wronly || is_rdwr) +- calldata->arg.fmode |= FMODE_WRITE; + /* Calculate the change in open mode */ ++ calldata->arg.fmode = 0; + if (state->n_rdwr == 0) { +- if (state->n_rdonly == 0) { +- call_close |= is_rdonly || is_rdwr; +- calldata->arg.fmode &= ~FMODE_READ; +- } +- if (state->n_wronly == 0) { +- call_close |= is_wronly || is_rdwr; +- calldata->arg.fmode &= ~FMODE_WRITE; +- } +- } ++ if (state->n_rdonly == 0) ++ call_close |= is_rdonly; ++ else if (is_rdonly) ++ calldata->arg.fmode |= FMODE_READ; ++ if (state->n_wronly == 0) ++ call_close |= is_wronly; ++ else if (is_wronly) ++ calldata->arg.fmode |= FMODE_WRITE; ++ } else if (is_rdwr) ++ calldata->arg.fmode |= FMODE_READ|FMODE_WRITE; ++ ++ if (calldata->arg.fmode == 0) ++ call_close |= is_rdwr; ++ + if (!nfs4_valid_open_stateid(state)) + call_close = 0; + spin_unlock(&state->owner->so_lock); +diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c +index 7e350c562e0e..1e0bbae06ee7 100644 +--- a/fs/nilfs2/inode.c ++++ b/fs/nilfs2/inode.c +@@ -24,6 +24,7 @@ + #include + #include + #include ++#include + #include + #include + #include "nilfs.h" +@@ -219,10 +220,10 @@ static int nilfs_writepage(struct page *page, struct writeback_control *wbc) + + static int nilfs_set_page_dirty(struct page *page) + { ++ struct inode *inode = page->mapping->host; + int ret = __set_page_dirty_nobuffers(page); + + if (page_has_buffers(page)) { +- struct inode *inode = page->mapping->host; + unsigned nr_dirty = 0; + struct buffer_head *bh, *head; + +@@ -245,6 +246,10 @@ static int nilfs_set_page_dirty(struct page *page) + + if (nr_dirty) + nilfs_set_file_dirty(inode, nr_dirty); ++ } else if (ret) { ++ unsigned nr_dirty = 1 << (PAGE_CACHE_SHIFT - inode->i_blkbits); ++ ++ nilfs_set_file_dirty(inode, nr_dirty); + } + return ret; + } +diff --git a/fs/notify/fdinfo.c b/fs/notify/fdinfo.c +index 238a5930cb3c..9d7e2b9659cb 100644 +--- a/fs/notify/fdinfo.c ++++ b/fs/notify/fdinfo.c +@@ -42,7 +42,7 @@ static int show_mark_fhandle(struct seq_file *m, struct inode *inode) + { + struct { + struct file_handle handle; +- u8 pad[64]; ++ u8 pad[MAX_HANDLE_SZ]; + } f; + int size, ret, i; + +@@ -50,7 +50,7 @@ static int show_mark_fhandle(struct seq_file *m, struct inode *inode) + size = f.handle.handle_bytes >> 2; + + ret = exportfs_encode_inode_fh(inode, (struct fid *)f.handle.f_handle, &size, 0); +- if ((ret == 255) || (ret == -ENOSPC)) { ++ if ((ret == FILEID_INVALID) || (ret < 0)) { + WARN_ONCE(1, "Can't encode file handler for inotify: %d\n", ret); + return 0; + } +diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c +index af3f7aa73e13..1be3398c96f6 100644 +--- a/fs/ocfs2/dlm/dlmmaster.c ++++ b/fs/ocfs2/dlm/dlmmaster.c +@@ -650,12 +650,9 @@ void dlm_lockres_clear_refmap_bit(struct dlm_ctxt *dlm, + clear_bit(bit, res->refmap); + } + +- +-void dlm_lockres_grab_inflight_ref(struct dlm_ctxt *dlm, ++static void __dlm_lockres_grab_inflight_ref(struct dlm_ctxt *dlm, + struct dlm_lock_resource *res) + { +- assert_spin_locked(&res->spinlock); +- + res->inflight_locks++; + + mlog(0, "%s: res %.*s, inflight++: now %u, %ps()\n", dlm->name, +@@ -663,6 +660,13 @@ void dlm_lockres_grab_inflight_ref(struct dlm_ctxt *dlm, + __builtin_return_address(0)); + } + ++void dlm_lockres_grab_inflight_ref(struct dlm_ctxt *dlm, ++ struct dlm_lock_resource *res) ++{ ++ assert_spin_locked(&res->spinlock); ++ __dlm_lockres_grab_inflight_ref(dlm, res); ++} ++ + void dlm_lockres_drop_inflight_ref(struct dlm_ctxt *dlm, + struct dlm_lock_resource *res) + { +@@ -852,10 +856,8 @@ lookup: + /* finally add the lockres to its hash bucket */ + __dlm_insert_lockres(dlm, res); + +- /* Grab inflight ref to pin the resource */ +- spin_lock(&res->spinlock); +- dlm_lockres_grab_inflight_ref(dlm, res); +- spin_unlock(&res->spinlock); ++ /* since this lockres is new it doesn't not require the spinlock */ ++ __dlm_lockres_grab_inflight_ref(dlm, res); + + /* get an extra ref on the mle in case this is a BLOCK + * if so, the creator of the BLOCK may try to put the last +diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h +index e9c4f190ffae..ac46782c10d3 100644 +--- a/include/acpi/acpi_bus.h ++++ b/include/acpi/acpi_bus.h +@@ -118,6 +118,7 @@ struct acpi_device; + struct acpi_hotplug_profile { + struct kobject kobj; + int (*scan_dependent)(struct acpi_device *adev); ++ void (*notify_online)(struct acpi_device *adev); + bool enabled:1; + bool demand_offline:1; + }; +diff --git a/include/linux/iio/trigger.h b/include/linux/iio/trigger.h +index 369cf2cd5144..68f46cd5d514 100644 +--- a/include/linux/iio/trigger.h ++++ b/include/linux/iio/trigger.h +@@ -84,10 +84,12 @@ static inline void iio_trigger_put(struct iio_trigger *trig) + put_device(&trig->dev); + } + +-static inline void iio_trigger_get(struct iio_trigger *trig) ++static inline struct iio_trigger *iio_trigger_get(struct iio_trigger *trig) + { + get_device(&trig->dev); + __module_get(trig->ops->owner); ++ ++ return trig; + } + + /** +diff --git a/include/linux/seqlock.h b/include/linux/seqlock.h +index 535f158977b9..8cf350325dc6 100644 +--- a/include/linux/seqlock.h ++++ b/include/linux/seqlock.h +@@ -164,8 +164,6 @@ static inline unsigned read_seqcount_begin(const seqcount_t *s) + static inline unsigned raw_seqcount_begin(const seqcount_t *s) + { + unsigned ret = ACCESS_ONCE(s->sequence); +- +- seqcount_lockdep_reader_access(s); + smp_rmb(); + return ret & ~1; + } +diff --git a/include/linux/vga_switcheroo.h b/include/linux/vga_switcheroo.h +index 502073a53dd3..b483abd34493 100644 +--- a/include/linux/vga_switcheroo.h ++++ b/include/linux/vga_switcheroo.h +@@ -64,6 +64,7 @@ int vga_switcheroo_get_client_state(struct pci_dev *dev); + void vga_switcheroo_set_dynamic_switch(struct pci_dev *pdev, enum vga_switcheroo_state dynamic); + + int vga_switcheroo_init_domain_pm_ops(struct device *dev, struct dev_pm_domain *domain); ++void vga_switcheroo_fini_domain_pm_ops(struct device *dev); + int vga_switcheroo_init_domain_pm_optimus_hdmi_audio(struct device *dev, struct dev_pm_domain *domain); + #else + +@@ -82,6 +83,7 @@ static inline int vga_switcheroo_get_client_state(struct pci_dev *dev) { return + static inline void vga_switcheroo_set_dynamic_switch(struct pci_dev *pdev, enum vga_switcheroo_state dynamic) {} + + static inline int vga_switcheroo_init_domain_pm_ops(struct device *dev, struct dev_pm_domain *domain) { return -EINVAL; } ++static inline void vga_switcheroo_fini_domain_pm_ops(struct device *dev) {} + static inline int vga_switcheroo_init_domain_pm_optimus_hdmi_audio(struct device *dev, struct dev_pm_domain *domain) { return -EINVAL; } + + #endif +diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h +index 704f4f652d0a..6c62cfa25f1a 100644 +--- a/include/linux/workqueue.h ++++ b/include/linux/workqueue.h +@@ -452,7 +452,7 @@ __alloc_workqueue_key(const char *fmt, unsigned int flags, int max_active, + alloc_workqueue("%s", WQ_FREEZABLE | WQ_UNBOUND | WQ_MEM_RECLAIM, \ + 1, (name)) + #define create_singlethread_workqueue(name) \ +- alloc_workqueue("%s", WQ_UNBOUND | WQ_MEM_RECLAIM, 1, (name)) ++ alloc_ordered_workqueue("%s", WQ_MEM_RECLAIM, name) + + extern void destroy_workqueue(struct workqueue_struct *wq); + +diff --git a/include/net/regulatory.h b/include/net/regulatory.h +index b07cdc9fa454..f103f30122a1 100644 +--- a/include/net/regulatory.h ++++ b/include/net/regulatory.h +@@ -160,7 +160,7 @@ struct ieee80211_reg_rule { + struct ieee80211_regdomain { + struct rcu_head rcu_head; + u32 n_reg_rules; +- char alpha2[2]; ++ char alpha2[3]; + enum nl80211_dfs_regions dfs_region; + struct ieee80211_reg_rule reg_rules[]; + }; +diff --git a/include/uapi/linux/usb/functionfs.h b/include/uapi/linux/usb/functionfs.h +index 29e9c7aa9c66..f279394aafb0 100644 +--- a/include/uapi/linux/usb/functionfs.h ++++ b/include/uapi/linux/usb/functionfs.h +@@ -27,24 +27,18 @@ struct usb_endpoint_descriptor_no_audio { + __u8 bInterval; + } __attribute__((packed)); + +-/* Legacy format, deprecated as of 3.14. */ +-struct usb_functionfs_descs_head { +- __le32 magic; +- __le32 length; +- __le32 fs_count; +- __le32 hs_count; +-} __attribute__((packed, deprecated)); + + /* + * All numbers must be in little endian order. + */ + ++/* Legacy format, deprecated as of 3.14. */ + struct usb_functionfs_descs_head { + __le32 magic; + __le32 length; + __le32 fs_count; + __le32 hs_count; +-} __attribute__((packed)); ++} __attribute__((packed, deprecated)); + + /* + * Descriptors format: +diff --git a/include/uapi/linux/xattr.h b/include/uapi/linux/xattr.h +index c38355c1f3c9..1590c49cae57 100644 +--- a/include/uapi/linux/xattr.h ++++ b/include/uapi/linux/xattr.h +@@ -13,7 +13,7 @@ + #ifndef _UAPI_LINUX_XATTR_H + #define _UAPI_LINUX_XATTR_H + +-#ifdef __UAPI_DEF_XATTR ++#if __UAPI_DEF_XATTR + #define __USE_KERNEL_XATTR_DEFS + + #define XATTR_CREATE 0x1 /* set value, fail if attr already exists */ +diff --git a/kernel/cgroup.c b/kernel/cgroup.c +index 0c753ddd223b..550e2050d778 100644 +--- a/kernel/cgroup.c ++++ b/kernel/cgroup.c +@@ -3663,7 +3663,6 @@ static int pidlist_array_load(struct cgroup *cgrp, enum cgroup_filetype type, + + l = cgroup_pidlist_find_create(cgrp, type); + if (!l) { +- mutex_unlock(&cgrp->pidlist_mutex); + pidlist_free(array); + return -ENOMEM; + } +diff --git a/kernel/events/core.c b/kernel/events/core.c +index f774e9365a03..3a140ca37777 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -1516,6 +1516,11 @@ retry: + */ + if (ctx->is_active) { + raw_spin_unlock_irq(&ctx->lock); ++ /* ++ * Reload the task pointer, it might have been changed by ++ * a concurrent perf_event_context_sched_out(). ++ */ ++ task = ctx->task; + goto retry; + } + +@@ -1957,6 +1962,11 @@ retry: + */ + if (ctx->is_active) { + raw_spin_unlock_irq(&ctx->lock); ++ /* ++ * Reload the task pointer, it might have been changed by ++ * a concurrent perf_event_context_sched_out(). ++ */ ++ task = ctx->task; + goto retry; + } + +diff --git a/kernel/futex.c b/kernel/futex.c +index e3087afb7429..0b0dc02aabce 100644 +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -2614,6 +2614,7 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags, + * shared futexes. We need to compare the keys: + */ + if (match_futex(&q.key, &key2)) { ++ queue_unlock(hb); + ret = -EINVAL; + goto out_put_keys; + } +diff --git a/kernel/kcmp.c b/kernel/kcmp.c +index e30ac0fe61c3..0aa69ea1d8fd 100644 +--- a/kernel/kcmp.c ++++ b/kernel/kcmp.c +@@ -44,11 +44,12 @@ static long kptr_obfuscate(long v, int type) + */ + static int kcmp_ptr(void *v1, void *v2, enum kcmp_type type) + { +- long ret; ++ long t1, t2; + +- ret = kptr_obfuscate((long)v1, type) - kptr_obfuscate((long)v2, type); ++ t1 = kptr_obfuscate((long)v1, type); ++ t2 = kptr_obfuscate((long)v2, type); + +- return (ret < 0) | ((ret > 0) << 1); ++ return (t1 < t2) | ((t1 > t2) << 1); + } + + /* The caller must have pinned the task */ +diff --git a/kernel/power/main.c b/kernel/power/main.c +index 1d1bf630e6e9..3ae41cdd804a 100644 +--- a/kernel/power/main.c ++++ b/kernel/power/main.c +@@ -293,12 +293,12 @@ static ssize_t state_show(struct kobject *kobj, struct kobj_attribute *attr, + { + char *s = buf; + #ifdef CONFIG_SUSPEND +- int i; ++ suspend_state_t i; ++ ++ for (i = PM_SUSPEND_MIN; i < PM_SUSPEND_MAX; i++) ++ if (pm_states[i].state) ++ s += sprintf(s,"%s ", pm_states[i].label); + +- for (i = 0; i < PM_SUSPEND_MAX; i++) { +- if (pm_states[i] && valid_state(i)) +- s += sprintf(s,"%s ", pm_states[i]); +- } + #endif + #ifdef CONFIG_HIBERNATION + s += sprintf(s, "%s\n", "disk"); +@@ -314,7 +314,7 @@ static suspend_state_t decode_state(const char *buf, size_t n) + { + #ifdef CONFIG_SUSPEND + suspend_state_t state = PM_SUSPEND_MIN; +- const char * const *s; ++ struct pm_sleep_state *s; + #endif + char *p; + int len; +@@ -328,8 +328,9 @@ static suspend_state_t decode_state(const char *buf, size_t n) + + #ifdef CONFIG_SUSPEND + for (s = &pm_states[state]; state < PM_SUSPEND_MAX; s++, state++) +- if (*s && len == strlen(*s) && !strncmp(buf, *s, len)) +- return state; ++ if (s->state && len == strlen(s->label) ++ && !strncmp(buf, s->label, len)) ++ return s->state; + #endif + + return PM_SUSPEND_ON; +@@ -447,8 +448,8 @@ static ssize_t autosleep_show(struct kobject *kobj, + + #ifdef CONFIG_SUSPEND + if (state < PM_SUSPEND_MAX) +- return sprintf(buf, "%s\n", valid_state(state) ? +- pm_states[state] : "error"); ++ return sprintf(buf, "%s\n", pm_states[state].state ? ++ pm_states[state].label : "error"); + #endif + #ifdef CONFIG_HIBERNATION + return sprintf(buf, "disk\n"); +diff --git a/kernel/power/power.h b/kernel/power/power.h +index 7d4b7ffb3c1d..f770cad3666c 100644 +--- a/kernel/power/power.h ++++ b/kernel/power/power.h +@@ -175,17 +175,20 @@ extern void swsusp_show_speed(struct timeval *, struct timeval *, + unsigned int, char *); + + #ifdef CONFIG_SUSPEND ++struct pm_sleep_state { ++ const char *label; ++ suspend_state_t state; ++}; ++ + /* kernel/power/suspend.c */ +-extern const char *const pm_states[]; ++extern struct pm_sleep_state pm_states[]; + +-extern bool valid_state(suspend_state_t state); + extern int suspend_devices_and_enter(suspend_state_t state); + #else /* !CONFIG_SUSPEND */ + static inline int suspend_devices_and_enter(suspend_state_t state) + { + return -ENOSYS; + } +-static inline bool valid_state(suspend_state_t state) { return false; } + #endif /* !CONFIG_SUSPEND */ + + #ifdef CONFIG_PM_TEST_SUSPEND +diff --git a/kernel/power/suspend.c b/kernel/power/suspend.c +index 62ee437b5c7e..5455d5c3c149 100644 +--- a/kernel/power/suspend.c ++++ b/kernel/power/suspend.c +@@ -29,10 +29,10 @@ + + #include "power.h" + +-const char *const pm_states[PM_SUSPEND_MAX] = { +- [PM_SUSPEND_FREEZE] = "freeze", +- [PM_SUSPEND_STANDBY] = "standby", +- [PM_SUSPEND_MEM] = "mem", ++struct pm_sleep_state pm_states[PM_SUSPEND_MAX] = { ++ [PM_SUSPEND_FREEZE] = { .label = "freeze", .state = PM_SUSPEND_FREEZE }, ++ [PM_SUSPEND_STANDBY] = { .label = "standby", }, ++ [PM_SUSPEND_MEM] = { .label = "mem", }, + }; + + static const struct platform_suspend_ops *suspend_ops; +@@ -62,42 +62,34 @@ void freeze_wake(void) + } + EXPORT_SYMBOL_GPL(freeze_wake); + ++static bool valid_state(suspend_state_t state) ++{ ++ /* ++ * PM_SUSPEND_STANDBY and PM_SUSPEND_MEM states need low level ++ * support and need to be valid to the low level ++ * implementation, no valid callback implies that none are valid. ++ */ ++ return suspend_ops && suspend_ops->valid && suspend_ops->valid(state); ++} ++ + /** + * suspend_set_ops - Set the global suspend method table. + * @ops: Suspend operations to use. + */ + void suspend_set_ops(const struct platform_suspend_ops *ops) + { ++ suspend_state_t i; ++ + lock_system_sleep(); ++ + suspend_ops = ops; ++ for (i = PM_SUSPEND_STANDBY; i <= PM_SUSPEND_MEM; i++) ++ pm_states[i].state = valid_state(i) ? i : 0; ++ + unlock_system_sleep(); + } + EXPORT_SYMBOL_GPL(suspend_set_ops); + +-bool valid_state(suspend_state_t state) +-{ +- if (state == PM_SUSPEND_FREEZE) { +-#ifdef CONFIG_PM_DEBUG +- if (pm_test_level != TEST_NONE && +- pm_test_level != TEST_FREEZER && +- pm_test_level != TEST_DEVICES && +- pm_test_level != TEST_PLATFORM) { +- printk(KERN_WARNING "Unsupported pm_test mode for " +- "freeze state, please choose " +- "none/freezer/devices/platform.\n"); +- return false; +- } +-#endif +- return true; +- } +- /* +- * PM_SUSPEND_STANDBY and PM_SUSPEND_MEMORY states need lowlevel +- * support and need to be valid to the lowlevel +- * implementation, no valid callback implies that none are valid. +- */ +- return suspend_ops && suspend_ops->valid && suspend_ops->valid(state); +-} +- + /** + * suspend_valid_only_mem - Generic memory-only valid callback. + * +@@ -324,9 +316,17 @@ static int enter_state(suspend_state_t state) + { + int error; + +- if (!valid_state(state)) +- return -ENODEV; +- ++ if (state == PM_SUSPEND_FREEZE) { ++#ifdef CONFIG_PM_DEBUG ++ if (pm_test_level != TEST_NONE && pm_test_level <= TEST_CPUS) { ++ pr_warning("PM: Unsupported test mode for freeze state," ++ "please choose none/freezer/devices/platform.\n"); ++ return -EAGAIN; ++ } ++#endif ++ } else if (!valid_state(state)) { ++ return -EINVAL; ++ } + if (!mutex_trylock(&pm_mutex)) + return -EBUSY; + +@@ -337,7 +337,7 @@ static int enter_state(suspend_state_t state) + sys_sync(); + printk("done.\n"); + +- pr_debug("PM: Preparing system for %s sleep\n", pm_states[state]); ++ pr_debug("PM: Preparing system for %s sleep\n", pm_states[state].label); + error = suspend_prepare(state); + if (error) + goto Unlock; +@@ -345,7 +345,7 @@ static int enter_state(suspend_state_t state) + if (suspend_test(TEST_FREEZER)) + goto Finish; + +- pr_debug("PM: Entering %s sleep\n", pm_states[state]); ++ pr_debug("PM: Entering %s sleep\n", pm_states[state].label); + pm_restrict_gfp_mask(); + error = suspend_devices_and_enter(state); + pm_restore_gfp_mask(); +diff --git a/kernel/power/suspend_test.c b/kernel/power/suspend_test.c +index 9b2a1d58558d..269b097e78ea 100644 +--- a/kernel/power/suspend_test.c ++++ b/kernel/power/suspend_test.c +@@ -92,13 +92,13 @@ static void __init test_wakealarm(struct rtc_device *rtc, suspend_state_t state) + } + + if (state == PM_SUSPEND_MEM) { +- printk(info_test, pm_states[state]); ++ printk(info_test, pm_states[state].label); + status = pm_suspend(state); + if (status == -ENODEV) + state = PM_SUSPEND_STANDBY; + } + if (state == PM_SUSPEND_STANDBY) { +- printk(info_test, pm_states[state]); ++ printk(info_test, pm_states[state].label); + status = pm_suspend(state); + } + if (status < 0) +@@ -136,18 +136,16 @@ static char warn_bad_state[] __initdata = + + static int __init setup_test_suspend(char *value) + { +- unsigned i; ++ suspend_state_t i; + + /* "=mem" ==> "mem" */ + value++; +- for (i = 0; i < PM_SUSPEND_MAX; i++) { +- if (!pm_states[i]) +- continue; +- if (strcmp(pm_states[i], value) != 0) +- continue; +- test_state = (__force suspend_state_t) i; +- return 0; +- } ++ for (i = PM_SUSPEND_MIN; i < PM_SUSPEND_MAX; i++) ++ if (!strcmp(pm_states[i].label, value)) { ++ test_state = pm_states[i].state; ++ return 0; ++ } ++ + printk(warn_bad_state, value); + return 0; + } +@@ -164,8 +162,8 @@ static int __init test_suspend(void) + /* PM is initialized by now; is that state testable? */ + if (test_state == PM_SUSPEND_ON) + goto done; +- if (!valid_state(test_state)) { +- printk(warn_bad_state, pm_states[test_state]); ++ if (!pm_states[test_state].state) { ++ printk(warn_bad_state, pm_states[test_state].label); + goto done; + } + +diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c +index fe75444ae7ec..cd45a0727a16 100644 +--- a/kernel/time/alarmtimer.c ++++ b/kernel/time/alarmtimer.c +@@ -464,18 +464,26 @@ static enum alarmtimer_type clock2alarm(clockid_t clockid) + static enum alarmtimer_restart alarm_handle_timer(struct alarm *alarm, + ktime_t now) + { ++ unsigned long flags; + struct k_itimer *ptr = container_of(alarm, struct k_itimer, + it.alarm.alarmtimer); +- if (posix_timer_event(ptr, 0) != 0) +- ptr->it_overrun++; ++ enum alarmtimer_restart result = ALARMTIMER_NORESTART; ++ ++ spin_lock_irqsave(&ptr->it_lock, flags); ++ if ((ptr->it_sigev_notify & ~SIGEV_THREAD_ID) != SIGEV_NONE) { ++ if (posix_timer_event(ptr, 0) != 0) ++ ptr->it_overrun++; ++ } + + /* Re-add periodic timers */ + if (ptr->it.alarm.interval.tv64) { + ptr->it_overrun += alarm_forward(alarm, now, + ptr->it.alarm.interval); +- return ALARMTIMER_RESTART; ++ result = ALARMTIMER_RESTART; + } +- return ALARMTIMER_NORESTART; ++ spin_unlock_irqrestore(&ptr->it_lock, flags); ++ ++ return result; + } + + /** +@@ -541,18 +549,22 @@ static int alarm_timer_create(struct k_itimer *new_timer) + * @new_timer: k_itimer pointer + * @cur_setting: itimerspec data to fill + * +- * Copies the itimerspec data out from the k_itimer ++ * Copies out the current itimerspec data + */ + static void alarm_timer_get(struct k_itimer *timr, + struct itimerspec *cur_setting) + { +- memset(cur_setting, 0, sizeof(struct itimerspec)); ++ ktime_t relative_expiry_time = ++ alarm_expires_remaining(&(timr->it.alarm.alarmtimer)); ++ ++ if (ktime_to_ns(relative_expiry_time) > 0) { ++ cur_setting->it_value = ktime_to_timespec(relative_expiry_time); ++ } else { ++ cur_setting->it_value.tv_sec = 0; ++ cur_setting->it_value.tv_nsec = 0; ++ } + +- cur_setting->it_interval = +- ktime_to_timespec(timr->it.alarm.interval); +- cur_setting->it_value = +- ktime_to_timespec(timr->it.alarm.alarmtimer.node.expires); +- return; ++ cur_setting->it_interval = ktime_to_timespec(timr->it.alarm.interval); + } + + /** +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index a53f1bbc546b..773aba836e81 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -626,8 +626,22 @@ int ring_buffer_poll_wait(struct ring_buffer *buffer, int cpu, + work = &cpu_buffer->irq_work; + } + +- work->waiters_pending = true; + poll_wait(filp, &work->waiters, poll_table); ++ work->waiters_pending = true; ++ /* ++ * There's a tight race between setting the waiters_pending and ++ * checking if the ring buffer is empty. Once the waiters_pending bit ++ * is set, the next event will wake the task up, but we can get stuck ++ * if there's only a single event in. ++ * ++ * FIXME: Ideally, we need a memory barrier on the writer side as well, ++ * but adding a memory barrier to all events will cause too much of a ++ * performance hit in the fast path. We only need a memory barrier when ++ * the buffer goes from empty to having content. But as this race is ++ * extremely small, and it's not a problem if another event comes in, we ++ * will fix it later. ++ */ ++ smp_mb(); + + if ((cpu == RING_BUFFER_ALL_CPUS && !ring_buffer_empty(buffer)) || + (cpu != RING_BUFFER_ALL_CPUS && !ring_buffer_empty_cpu(buffer, cpu))) +diff --git a/mm/memblock.c b/mm/memblock.c +index 39a31e7f0045..0739dc1b4095 100644 +--- a/mm/memblock.c ++++ b/mm/memblock.c +@@ -183,8 +183,7 @@ phys_addr_t __init_memblock memblock_find_in_range_node(phys_addr_t size, + phys_addr_t align, phys_addr_t start, + phys_addr_t end, int nid) + { +- int ret; +- phys_addr_t kernel_end; ++ phys_addr_t kernel_end, ret; + + /* pump up @end */ + if (end == MEMBLOCK_ALLOC_ACCESSIBLE) +diff --git a/mm/memory.c b/mm/memory.c +index 2121d8b8db56..492e36f27f43 100644 +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -1120,7 +1120,7 @@ again: + addr) != page->index) { + pte_t ptfile = pgoff_to_pte(page->index); + if (pte_soft_dirty(ptent)) +- pte_file_mksoft_dirty(ptfile); ++ ptfile = pte_file_mksoft_dirty(ptfile); + set_pte_at(mm, addr, pte, ptfile); + } + if (PageAnon(page)) +diff --git a/mm/percpu-vm.c b/mm/percpu-vm.c +index 3707c71ae4cd..51108165f829 100644 +--- a/mm/percpu-vm.c ++++ b/mm/percpu-vm.c +@@ -108,7 +108,7 @@ static int pcpu_alloc_pages(struct pcpu_chunk *chunk, + int page_start, int page_end) + { + const gfp_t gfp = GFP_KERNEL | __GFP_HIGHMEM | __GFP_COLD; +- unsigned int cpu; ++ unsigned int cpu, tcpu; + int i; + + for_each_possible_cpu(cpu) { +@@ -116,14 +116,23 @@ static int pcpu_alloc_pages(struct pcpu_chunk *chunk, + struct page **pagep = &pages[pcpu_page_idx(cpu, i)]; + + *pagep = alloc_pages_node(cpu_to_node(cpu), gfp, 0); +- if (!*pagep) { +- pcpu_free_pages(chunk, pages, populated, +- page_start, page_end); +- return -ENOMEM; +- } ++ if (!*pagep) ++ goto err; + } + } + return 0; ++ ++err: ++ while (--i >= page_start) ++ __free_page(pages[pcpu_page_idx(cpu, i)]); ++ ++ for_each_possible_cpu(tcpu) { ++ if (tcpu == cpu) ++ break; ++ for (i = page_start; i < page_end; i++) ++ __free_page(pages[pcpu_page_idx(tcpu, i)]); ++ } ++ return -ENOMEM; + } + + /** +@@ -263,6 +272,7 @@ err: + __pcpu_unmap_pages(pcpu_chunk_addr(chunk, tcpu, page_start), + page_end - page_start); + } ++ pcpu_post_unmap_tlb_flush(chunk, page_start, page_end); + return err; + } + +diff --git a/mm/percpu.c b/mm/percpu.c +index a2a54a85f691..8cd4308471c3 100644 +--- a/mm/percpu.c ++++ b/mm/percpu.c +@@ -1917,6 +1917,8 @@ void __init setup_per_cpu_areas(void) + + if (pcpu_setup_first_chunk(ai, fc) < 0) + panic("Failed to initialize percpu areas."); ++ ++ pcpu_free_alloc_info(ai); + } + + #endif /* CONFIG_SMP */ +diff --git a/mm/shmem.c b/mm/shmem.c +index ff85863587ee..f0d698ba7d0f 100644 +--- a/mm/shmem.c ++++ b/mm/shmem.c +@@ -2143,8 +2143,10 @@ static int shmem_rename(struct inode *old_dir, struct dentry *old_dentry, struct + + if (new_dentry->d_inode) { + (void) shmem_unlink(new_dir, new_dentry); +- if (they_are_dirs) ++ if (they_are_dirs) { ++ drop_nlink(new_dentry->d_inode); + drop_nlink(old_dir); ++ } + } else if (they_are_dirs) { + drop_nlink(old_dir); + inc_nlink(new_dir); +diff --git a/mm/slab.c b/mm/slab.c +index 6dd8d5f3a3ac..ea854eb2388c 100644 +--- a/mm/slab.c ++++ b/mm/slab.c +@@ -2189,7 +2189,8 @@ static int __init_refok setup_cpu_cache(struct kmem_cache *cachep, gfp_t gfp) + int + __kmem_cache_create (struct kmem_cache *cachep, unsigned long flags) + { +- size_t left_over, freelist_size, ralign; ++ size_t left_over, freelist_size; ++ size_t ralign = BYTES_PER_WORD; + gfp_t gfp; + int err; + size_t size = cachep->size; +@@ -2222,14 +2223,6 @@ __kmem_cache_create (struct kmem_cache *cachep, unsigned long flags) + size &= ~(BYTES_PER_WORD - 1); + } + +- /* +- * Redzoning and user store require word alignment or possibly larger. +- * Note this will be overridden by architecture or caller mandated +- * alignment if either is greater than BYTES_PER_WORD. +- */ +- if (flags & SLAB_STORE_USER) +- ralign = BYTES_PER_WORD; +- + if (flags & SLAB_RED_ZONE) { + ralign = REDZONE_ALIGN; + /* If redzoning, ensure that the second redzone is suitably +diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c +index e6a84cb1a5e4..189eef014c4f 100644 +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -4240,8 +4240,7 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata, + rcu_read_unlock(); + + if (bss->wmm_used && bss->uapsd_supported && +- (sdata->local->hw.flags & IEEE80211_HW_SUPPORTS_UAPSD) && +- sdata->wmm_acm != 0xff) { ++ (sdata->local->hw.flags & IEEE80211_HW_SUPPORTS_UAPSD)) { + assoc_data->uapsd = true; + ifmgd->flags |= IEEE80211_STA_UAPSD_ENABLED; + } else { +diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c +index a8eb0a89326a..610e19c0e13f 100644 +--- a/net/netfilter/ipvs/ip_vs_conn.c ++++ b/net/netfilter/ipvs/ip_vs_conn.c +@@ -797,7 +797,6 @@ static void ip_vs_conn_expire(unsigned long data) + ip_vs_control_del(cp); + + if (cp->flags & IP_VS_CONN_F_NFCT) { +- ip_vs_conn_drop_conntrack(cp); + /* Do not access conntracks during subsys cleanup + * because nf_conntrack_find_get can not be used after + * conntrack cleanup for the net. +diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c +index 3d2d2c8108ca..27d3f40de3cd 100644 +--- a/net/netfilter/ipvs/ip_vs_core.c ++++ b/net/netfilter/ipvs/ip_vs_core.c +@@ -1906,7 +1906,7 @@ static struct nf_hook_ops ip_vs_ops[] __read_mostly = { + { + .hook = ip_vs_local_reply6, + .owner = THIS_MODULE, +- .pf = NFPROTO_IPV4, ++ .pf = NFPROTO_IPV6, + .hooknum = NF_INET_LOCAL_OUT, + .priority = NF_IP6_PRI_NAT_DST + 1, + }, +diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c +index 7f0e1cf2d7e8..1692e7534759 100644 +--- a/net/netfilter/ipvs/ip_vs_xmit.c ++++ b/net/netfilter/ipvs/ip_vs_xmit.c +@@ -967,8 +967,8 @@ ip_vs_tunnel_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp, + iph->nexthdr = IPPROTO_IPV6; + iph->payload_len = old_iph->payload_len; + be16_add_cpu(&iph->payload_len, sizeof(*old_iph)); +- iph->priority = old_iph->priority; + memset(&iph->flow_lbl, 0, sizeof(iph->flow_lbl)); ++ ipv6_change_dsfield(iph, 0, ipv6_get_dsfield(old_iph)); + iph->daddr = cp->daddr.in6; + iph->saddr = saddr; + iph->hop_limit = old_iph->hop_limit; +diff --git a/net/netfilter/xt_cgroup.c b/net/netfilter/xt_cgroup.c +index 9a8e77e7f8d4..ef5c75a5b200 100644 +--- a/net/netfilter/xt_cgroup.c ++++ b/net/netfilter/xt_cgroup.c +@@ -31,7 +31,7 @@ static int cgroup_mt_check(const struct xt_mtchk_param *par) + if (info->invert & ~1) + return -EINVAL; + +- return info->id ? 0 : -EINVAL; ++ return 0; + } + + static bool +diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c +index a3910fc2122b..47dc6836830a 100644 +--- a/net/netfilter/xt_hashlimit.c ++++ b/net/netfilter/xt_hashlimit.c +@@ -104,7 +104,7 @@ struct xt_hashlimit_htable { + spinlock_t lock; /* lock for list_head */ + u_int32_t rnd; /* random seed for hash */ + unsigned int count; /* number entries in table */ +- struct timer_list timer; /* timer for gc */ ++ struct delayed_work gc_work; + + /* seq_file stuff */ + struct proc_dir_entry *pde; +@@ -213,7 +213,7 @@ dsthash_free(struct xt_hashlimit_htable *ht, struct dsthash_ent *ent) + call_rcu_bh(&ent->rcu, dsthash_free_rcu); + ht->count--; + } +-static void htable_gc(unsigned long htlong); ++static void htable_gc(struct work_struct *work); + + static int htable_create(struct net *net, struct xt_hashlimit_mtinfo1 *minfo, + u_int8_t family) +@@ -273,9 +273,9 @@ static int htable_create(struct net *net, struct xt_hashlimit_mtinfo1 *minfo, + } + hinfo->net = net; + +- setup_timer(&hinfo->timer, htable_gc, (unsigned long)hinfo); +- hinfo->timer.expires = jiffies + msecs_to_jiffies(hinfo->cfg.gc_interval); +- add_timer(&hinfo->timer); ++ INIT_DEFERRABLE_WORK(&hinfo->gc_work, htable_gc); ++ queue_delayed_work(system_power_efficient_wq, &hinfo->gc_work, ++ msecs_to_jiffies(hinfo->cfg.gc_interval)); + + hlist_add_head(&hinfo->node, &hashlimit_net->htables); + +@@ -300,29 +300,30 @@ static void htable_selective_cleanup(struct xt_hashlimit_htable *ht, + { + unsigned int i; + +- /* lock hash table and iterate over it */ +- spin_lock_bh(&ht->lock); + for (i = 0; i < ht->cfg.size; i++) { + struct dsthash_ent *dh; + struct hlist_node *n; ++ ++ spin_lock_bh(&ht->lock); + hlist_for_each_entry_safe(dh, n, &ht->hash[i], node) { + if ((*select)(ht, dh)) + dsthash_free(ht, dh); + } ++ spin_unlock_bh(&ht->lock); ++ cond_resched(); + } +- spin_unlock_bh(&ht->lock); + } + +-/* hash table garbage collector, run by timer */ +-static void htable_gc(unsigned long htlong) ++static void htable_gc(struct work_struct *work) + { +- struct xt_hashlimit_htable *ht = (struct xt_hashlimit_htable *)htlong; ++ struct xt_hashlimit_htable *ht; ++ ++ ht = container_of(work, struct xt_hashlimit_htable, gc_work.work); + + htable_selective_cleanup(ht, select_gc); + +- /* re-add the timer accordingly */ +- ht->timer.expires = jiffies + msecs_to_jiffies(ht->cfg.gc_interval); +- add_timer(&ht->timer); ++ queue_delayed_work(system_power_efficient_wq, ++ &ht->gc_work, msecs_to_jiffies(ht->cfg.gc_interval)); + } + + static void htable_remove_proc_entry(struct xt_hashlimit_htable *hinfo) +@@ -341,7 +342,7 @@ static void htable_remove_proc_entry(struct xt_hashlimit_htable *hinfo) + + static void htable_destroy(struct xt_hashlimit_htable *hinfo) + { +- del_timer_sync(&hinfo->timer); ++ cancel_delayed_work_sync(&hinfo->gc_work); + htable_remove_proc_entry(hinfo); + htable_selective_cleanup(hinfo, select_all); + kfree(hinfo->name); +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index e6283464a8e6..df33156ecd2d 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -6796,6 +6796,9 @@ void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp) + struct nlattr *data = ((void **)skb->cb)[2]; + enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE; + ++ /* clear CB data for netlink core to own from now on */ ++ memset(skb->cb, 0, sizeof(skb->cb)); ++ + nla_nest_end(skb, data); + genlmsg_end(skb, hdr); + +@@ -9075,6 +9078,9 @@ int cfg80211_vendor_cmd_reply(struct sk_buff *skb) + void *hdr = ((void **)skb->cb)[1]; + struct nlattr *data = ((void **)skb->cb)[2]; + ++ /* clear CB data for netlink core to own from now on */ ++ memset(skb->cb, 0, sizeof(skb->cb)); ++ + if (WARN_ON(!rdev->cur_cmd_info)) { + kfree_skb(skb); + return -EINVAL; +diff --git a/sound/core/info.c b/sound/core/info.c +index e79baa11b60e..08070e1eefeb 100644 +--- a/sound/core/info.c ++++ b/sound/core/info.c +@@ -679,7 +679,7 @@ int snd_info_card_free(struct snd_card *card) + * snd_info_get_line - read one line from the procfs buffer + * @buffer: the procfs buffer + * @line: the buffer to store +- * @len: the max. buffer size - 1 ++ * @len: the max. buffer size + * + * Reads one line from the buffer and stores the string. + * +@@ -699,7 +699,7 @@ int snd_info_get_line(struct snd_info_buffer *buffer, char *line, int len) + buffer->stop = 1; + if (c == '\n') + break; +- if (len) { ++ if (len > 1) { + len--; + *line++ = c; + } +diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c +index a2104671f51d..e1ef106c8a6f 100644 +--- a/sound/core/pcm_lib.c ++++ b/sound/core/pcm_lib.c +@@ -1783,14 +1783,16 @@ static int snd_pcm_lib_ioctl_fifo_size(struct snd_pcm_substream *substream, + { + struct snd_pcm_hw_params *params = arg; + snd_pcm_format_t format; +- int channels, width; ++ int channels; ++ ssize_t frame_size; + + params->fifo_size = substream->runtime->hw.fifo_size; + if (!(substream->runtime->hw.info & SNDRV_PCM_INFO_FIFO_IN_FRAMES)) { + format = params_format(params); + channels = params_channels(params); +- width = snd_pcm_format_physical_width(format); +- params->fifo_size /= width * channels; ++ frame_size = snd_pcm_format_size(format, channels); ++ if (frame_size > 0) ++ params->fifo_size /= (unsigned)frame_size; + } + return 0; + } +diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c +index bcf91bea3317..ffc19464b978 100644 +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -3237,6 +3237,7 @@ enum { + CXT_FIXUP_HEADPHONE_MIC_PIN, + CXT_FIXUP_HEADPHONE_MIC, + CXT_FIXUP_GPIO1, ++ CXT_FIXUP_ASPIRE_DMIC, + CXT_FIXUP_THINKPAD_ACPI, + }; + +@@ -3397,6 +3398,12 @@ static const struct hda_fixup cxt_fixups[] = { + { } + }, + }, ++ [CXT_FIXUP_ASPIRE_DMIC] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = cxt_fixup_stereo_dmic, ++ .chained = true, ++ .chain_id = CXT_FIXUP_GPIO1, ++ }, + [CXT_FIXUP_THINKPAD_ACPI] = { + .type = HDA_FIXUP_FUNC, + .v.func = hda_fixup_thinkpad_acpi, +@@ -3410,7 +3417,7 @@ static const struct snd_pci_quirk cxt5051_fixups[] = { + + static const struct snd_pci_quirk cxt5066_fixups[] = { + SND_PCI_QUIRK(0x1025, 0x0543, "Acer Aspire One 522", CXT_FIXUP_STEREO_DMIC), +- SND_PCI_QUIRK(0x1025, 0x054c, "Acer Aspire 3830TG", CXT_FIXUP_GPIO1), ++ SND_PCI_QUIRK(0x1025, 0x054c, "Acer Aspire 3830TG", CXT_FIXUP_ASPIRE_DMIC), + SND_PCI_QUIRK(0x1043, 0x138d, "Asus", CXT_FIXUP_HEADPHONE_MIC_PIN), + SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400", CXT_PINCFG_LENOVO_TP410), + SND_PCI_QUIRK(0x17aa, 0x215e, "Lenovo T410", CXT_PINCFG_LENOVO_TP410), +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index b35dbe25a6e3..5d0058bd6259 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -327,6 +327,7 @@ static void alc_auto_init_amp(struct hda_codec *codec, int type) + case 0x10ec0885: + case 0x10ec0887: + /*case 0x10ec0889:*/ /* this causes an SPDIF problem */ ++ case 0x10ec0900: + alc889_coef_init(codec); + break; + case 0x10ec0888: +@@ -2330,6 +2331,7 @@ static int patch_alc882(struct hda_codec *codec) + switch (codec->vendor_id) { + case 0x10ec0882: + case 0x10ec0885: ++ case 0x10ec0900: + break; + default: + /* ALC883 and variants */ +diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c +index 978df990f27c..15270a2e71cc 100644 +--- a/sound/pci/hda/patch_sigmatel.c ++++ b/sound/pci/hda/patch_sigmatel.c +@@ -559,8 +559,8 @@ static void stac_init_power_map(struct hda_codec *codec) + if (snd_hda_jack_tbl_get(codec, nid)) + continue; + if (def_conf == AC_JACK_PORT_COMPLEX && +- !(spec->vref_mute_led_nid == nid || +- is_jack_detectable(codec, nid))) { ++ spec->vref_mute_led_nid != nid && ++ is_jack_detectable(codec, nid)) { + snd_hda_jack_detect_enable_callback(codec, nid, + STAC_PWR_EVENT, + jack_update_power); +@@ -4212,11 +4212,18 @@ static int stac_parse_auto_config(struct hda_codec *codec) + return err; + } + +- stac_init_power_map(codec); +- + return 0; + } + ++static int stac_build_controls(struct hda_codec *codec) ++{ ++ int err = snd_hda_gen_build_controls(codec); ++ ++ if (err < 0) ++ return err; ++ stac_init_power_map(codec); ++ return 0; ++} + + static int stac_init(struct hda_codec *codec) + { +@@ -4328,7 +4335,7 @@ static int stac_suspend(struct hda_codec *codec) + #endif /* CONFIG_PM */ + + static const struct hda_codec_ops stac_patch_ops = { +- .build_controls = snd_hda_gen_build_controls, ++ .build_controls = stac_build_controls, + .build_pcms = snd_hda_gen_build_pcms, + .init = stac_init, + .free = stac_free, +diff --git a/sound/soc/davinci/davinci-mcasp.c b/sound/soc/davinci/davinci-mcasp.c +index 670afa29e30d..7350ebbae642 100644 +--- a/sound/soc/davinci/davinci-mcasp.c ++++ b/sound/soc/davinci/davinci-mcasp.c +@@ -418,8 +418,17 @@ static int davinci_config_channel_size(struct davinci_mcasp *mcasp, + { + u32 fmt; + u32 tx_rotate = (word_length / 4) & 0x7; +- u32 rx_rotate = (32 - word_length) / 4; + u32 mask = (1ULL << word_length) - 1; ++ /* ++ * For captured data we should not rotate, inversion and masking is ++ * enoguh to get the data to the right position: ++ * Format data from bus after reverse (XRBUF) ++ * S16_LE: |LSB|MSB|xxx|xxx| |xxx|xxx|MSB|LSB| ++ * S24_3LE: |LSB|DAT|MSB|xxx| |xxx|MSB|DAT|LSB| ++ * S24_LE: |LSB|DAT|MSB|xxx| |xxx|MSB|DAT|LSB| ++ * S32_LE: |LSB|DAT|DAT|MSB| |MSB|DAT|DAT|LSB| ++ */ ++ u32 rx_rotate = 0; + + /* + * if s BCLK-to-LRCLK ratio has been configured via the set_clkdiv()