From c158f374bd1d4c3172cc1f65baf078c63f3762a0 Mon Sep 17 00:00:00 2001 From: Stephan Raue Date: Tue, 15 Apr 2014 05:32:11 +0200 Subject: [PATCH] projects/Cuboxi/patches/linux: add kernel upstream patches Signed-off-by: Stephan Raue --- .../linux/linux-000-patch-3.10.30-31.patch | 800 ++++ .../linux/linux-000-patch-3.10.31-32.patch | 2000 +++++++++ .../linux/linux-000-patch-3.10.32-33.patch | 3945 +++++++++++++++++ .../linux/linux-000-patch-3.10.33-34.patch | 2789 ++++++++++++ .../linux/linux-000-patch-3.10.34-35.patch | 996 +++++ .../linux/linux-000-patch-3.10.35-36.patch | 604 +++ .../linux/linux-000-patch-3.10.36-37.patch | 1555 +++++++ 7 files changed, 12689 insertions(+) create mode 100644 projects/Cuboxi/patches/linux/linux-000-patch-3.10.30-31.patch create mode 100644 projects/Cuboxi/patches/linux/linux-000-patch-3.10.31-32.patch create mode 100644 projects/Cuboxi/patches/linux/linux-000-patch-3.10.32-33.patch create mode 100644 projects/Cuboxi/patches/linux/linux-000-patch-3.10.33-34.patch create mode 100644 projects/Cuboxi/patches/linux/linux-000-patch-3.10.34-35.patch create mode 100644 projects/Cuboxi/patches/linux/linux-000-patch-3.10.35-36.patch create mode 100644 projects/Cuboxi/patches/linux/linux-000-patch-3.10.36-37.patch diff --git a/projects/Cuboxi/patches/linux/linux-000-patch-3.10.30-31.patch b/projects/Cuboxi/patches/linux/linux-000-patch-3.10.30-31.patch new file mode 100644 index 0000000000..7501f8b5f0 --- /dev/null +++ b/projects/Cuboxi/patches/linux/linux-000-patch-3.10.30-31.patch @@ -0,0 +1,800 @@ +diff --git a/Makefile b/Makefile +index 18016a55dbd3..56b93edbbe4e 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 10 +-SUBLEVEL = 30 ++SUBLEVEL = 31 + EXTRAVERSION = + NAME = TOSSUG Baby Fish + +diff --git a/arch/arm64/include/asm/cacheflush.h b/arch/arm64/include/asm/cacheflush.h +index 3300cbd18a89..0c13554965b8 100644 +--- a/arch/arm64/include/asm/cacheflush.h ++++ b/arch/arm64/include/asm/cacheflush.h +@@ -116,6 +116,7 @@ extern void flush_dcache_page(struct page *); + static inline void __flush_icache_all(void) + { + asm("ic ialluis"); ++ dsb(); + } + + #define flush_dcache_mmap_lock(mapping) \ +diff --git a/arch/arm64/kernel/vdso.c b/arch/arm64/kernel/vdso.c +index 6a389dc1bd49..0ea7a22bcdf2 100644 +--- a/arch/arm64/kernel/vdso.c ++++ b/arch/arm64/kernel/vdso.c +@@ -235,6 +235,8 @@ void update_vsyscall(struct timekeeper *tk) + vdso_data->use_syscall = use_syscall; + vdso_data->xtime_coarse_sec = xtime_coarse.tv_sec; + vdso_data->xtime_coarse_nsec = xtime_coarse.tv_nsec; ++ vdso_data->wtm_clock_sec = tk->wall_to_monotonic.tv_sec; ++ vdso_data->wtm_clock_nsec = tk->wall_to_monotonic.tv_nsec; + + if (!use_syscall) { + vdso_data->cs_cycle_last = tk->clock->cycle_last; +@@ -242,8 +244,6 @@ void update_vsyscall(struct timekeeper *tk) + vdso_data->xtime_clock_nsec = tk->xtime_nsec; + vdso_data->cs_mult = tk->mult; + vdso_data->cs_shift = tk->shift; +- vdso_data->wtm_clock_sec = tk->wall_to_monotonic.tv_sec; +- vdso_data->wtm_clock_nsec = tk->wall_to_monotonic.tv_nsec; + } + + smp_wmb(); +diff --git a/arch/arm64/kernel/vdso/Makefile b/arch/arm64/kernel/vdso/Makefile +index d8064af42e62..6d20b7d162d8 100644 +--- a/arch/arm64/kernel/vdso/Makefile ++++ b/arch/arm64/kernel/vdso/Makefile +@@ -48,7 +48,7 @@ $(obj-vdso): %.o: %.S + + # Actual build commands + quiet_cmd_vdsold = VDSOL $@ +- cmd_vdsold = $(CC) $(c_flags) -Wl,-T $^ -o $@ ++ cmd_vdsold = $(CC) $(c_flags) -Wl,-n -Wl,-T $^ -o $@ + quiet_cmd_vdsoas = VDSOA $@ + cmd_vdsoas = $(CC) $(a_flags) -c -o $@ $< + +diff --git a/arch/arm64/kernel/vdso/gettimeofday.S b/arch/arm64/kernel/vdso/gettimeofday.S +index f0a6d10b5211..fe652ffd34c2 100644 +--- a/arch/arm64/kernel/vdso/gettimeofday.S ++++ b/arch/arm64/kernel/vdso/gettimeofday.S +@@ -103,6 +103,8 @@ ENTRY(__kernel_clock_gettime) + bl __do_get_tspec + seqcnt_check w9, 1b + ++ mov x30, x2 ++ + cmp w0, #CLOCK_MONOTONIC + b.ne 6f + +@@ -118,6 +120,9 @@ ENTRY(__kernel_clock_gettime) + ccmp w0, #CLOCK_MONOTONIC_COARSE, #0x4, ne + b.ne 8f + ++ /* xtime_coarse_nsec is already right-shifted */ ++ mov x12, #0 ++ + /* Get coarse timespec. */ + adr vdso_data, _vdso_data + 3: seqcnt_acquire +@@ -156,7 +161,7 @@ ENTRY(__kernel_clock_gettime) + lsr x11, x11, x12 + stp x10, x11, [x1, #TSPEC_TV_SEC] + mov x0, xzr +- ret x2 ++ ret + 7: + mov x30, x2 + 8: /* Syscall fallback. */ +diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c +index 80a369eab637..ba7477efad5c 100644 +--- a/arch/arm64/mm/mmu.c ++++ b/arch/arm64/mm/mmu.c +@@ -203,10 +203,18 @@ static void __init alloc_init_pmd(pud_t *pud, unsigned long addr, + do { + next = pmd_addr_end(addr, end); + /* try section mapping first */ +- if (((addr | next | phys) & ~SECTION_MASK) == 0) ++ if (((addr | next | phys) & ~SECTION_MASK) == 0) { ++ pmd_t old_pmd =*pmd; + set_pmd(pmd, __pmd(phys | prot_sect_kernel)); +- else ++ /* ++ * Check for previous table entries created during ++ * boot (__create_page_tables) and flush them. ++ */ ++ if (!pmd_none(old_pmd)) ++ flush_tlb_all(); ++ } else { + alloc_init_pte(pmd, addr, next, __phys_to_pfn(phys)); ++ } + phys += next - addr; + } while (pmd++, addr = next, addr != end); + } +diff --git a/arch/s390/crypto/aes_s390.c b/arch/s390/crypto/aes_s390.c +index 94e20dd2729f..2a245b55bb71 100644 +--- a/arch/s390/crypto/aes_s390.c ++++ b/arch/s390/crypto/aes_s390.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + #include "crypt_s390.h" + + #define AES_KEYLEN_128 1 +@@ -32,6 +33,7 @@ + #define AES_KEYLEN_256 4 + + static u8 *ctrblk; ++static DEFINE_SPINLOCK(ctrblk_lock); + static char keylen_flag; + + struct s390_aes_ctx { +@@ -756,43 +758,67 @@ static int ctr_aes_set_key(struct crypto_tfm *tfm, const u8 *in_key, + return aes_set_key(tfm, in_key, key_len); + } + ++static unsigned int __ctrblk_init(u8 *ctrptr, unsigned int nbytes) ++{ ++ unsigned int i, n; ++ ++ /* only use complete blocks, max. PAGE_SIZE */ ++ n = (nbytes > PAGE_SIZE) ? PAGE_SIZE : nbytes & ~(AES_BLOCK_SIZE - 1); ++ for (i = AES_BLOCK_SIZE; i < n; i += AES_BLOCK_SIZE) { ++ memcpy(ctrptr + i, ctrptr + i - AES_BLOCK_SIZE, ++ AES_BLOCK_SIZE); ++ crypto_inc(ctrptr + i, AES_BLOCK_SIZE); ++ } ++ return n; ++} ++ + static int ctr_aes_crypt(struct blkcipher_desc *desc, long func, + struct s390_aes_ctx *sctx, struct blkcipher_walk *walk) + { + int ret = blkcipher_walk_virt_block(desc, walk, AES_BLOCK_SIZE); +- unsigned int i, n, nbytes; +- u8 buf[AES_BLOCK_SIZE]; +- u8 *out, *in; ++ unsigned int n, nbytes; ++ u8 buf[AES_BLOCK_SIZE], ctrbuf[AES_BLOCK_SIZE]; ++ u8 *out, *in, *ctrptr = ctrbuf; + + if (!walk->nbytes) + return ret; + +- memcpy(ctrblk, walk->iv, AES_BLOCK_SIZE); ++ if (spin_trylock(&ctrblk_lock)) ++ ctrptr = ctrblk; ++ ++ memcpy(ctrptr, walk->iv, AES_BLOCK_SIZE); + while ((nbytes = walk->nbytes) >= AES_BLOCK_SIZE) { + out = walk->dst.virt.addr; + in = walk->src.virt.addr; + while (nbytes >= AES_BLOCK_SIZE) { +- /* only use complete blocks, max. PAGE_SIZE */ +- n = (nbytes > PAGE_SIZE) ? PAGE_SIZE : +- nbytes & ~(AES_BLOCK_SIZE - 1); +- for (i = AES_BLOCK_SIZE; i < n; i += AES_BLOCK_SIZE) { +- memcpy(ctrblk + i, ctrblk + i - AES_BLOCK_SIZE, +- AES_BLOCK_SIZE); +- crypto_inc(ctrblk + i, AES_BLOCK_SIZE); +- } +- ret = crypt_s390_kmctr(func, sctx->key, out, in, n, ctrblk); +- if (ret < 0 || ret != n) ++ if (ctrptr == ctrblk) ++ n = __ctrblk_init(ctrptr, nbytes); ++ else ++ n = AES_BLOCK_SIZE; ++ ret = crypt_s390_kmctr(func, sctx->key, out, in, ++ n, ctrptr); ++ if (ret < 0 || ret != n) { ++ if (ctrptr == ctrblk) ++ spin_unlock(&ctrblk_lock); + return -EIO; ++ } + if (n > AES_BLOCK_SIZE) +- memcpy(ctrblk, ctrblk + n - AES_BLOCK_SIZE, ++ memcpy(ctrptr, ctrptr + n - AES_BLOCK_SIZE, + AES_BLOCK_SIZE); +- crypto_inc(ctrblk, AES_BLOCK_SIZE); ++ crypto_inc(ctrptr, AES_BLOCK_SIZE); + out += n; + in += n; + nbytes -= n; + } + ret = blkcipher_walk_done(desc, walk, nbytes); + } ++ if (ctrptr == ctrblk) { ++ if (nbytes) ++ memcpy(ctrbuf, ctrptr, AES_BLOCK_SIZE); ++ else ++ memcpy(walk->iv, ctrptr, AES_BLOCK_SIZE); ++ spin_unlock(&ctrblk_lock); ++ } + /* + * final block may be < AES_BLOCK_SIZE, copy only nbytes + */ +@@ -800,14 +826,15 @@ static int ctr_aes_crypt(struct blkcipher_desc *desc, long func, + out = walk->dst.virt.addr; + in = walk->src.virt.addr; + ret = crypt_s390_kmctr(func, sctx->key, buf, in, +- AES_BLOCK_SIZE, ctrblk); ++ AES_BLOCK_SIZE, ctrbuf); + if (ret < 0 || ret != AES_BLOCK_SIZE) + return -EIO; + memcpy(out, buf, nbytes); +- crypto_inc(ctrblk, AES_BLOCK_SIZE); ++ crypto_inc(ctrbuf, AES_BLOCK_SIZE); + ret = blkcipher_walk_done(desc, walk, 0); ++ memcpy(walk->iv, ctrbuf, AES_BLOCK_SIZE); + } +- memcpy(walk->iv, ctrblk, AES_BLOCK_SIZE); ++ + return ret; + } + +diff --git a/arch/s390/crypto/des_s390.c b/arch/s390/crypto/des_s390.c +index bcca01c9989d..2d96e68febb2 100644 +--- a/arch/s390/crypto/des_s390.c ++++ b/arch/s390/crypto/des_s390.c +@@ -25,6 +25,7 @@ + #define DES3_KEY_SIZE (3 * DES_KEY_SIZE) + + static u8 *ctrblk; ++static DEFINE_SPINLOCK(ctrblk_lock); + + struct s390_des_ctx { + u8 iv[DES_BLOCK_SIZE]; +@@ -105,29 +106,35 @@ static int ecb_desall_crypt(struct blkcipher_desc *desc, long func, + } + + static int cbc_desall_crypt(struct blkcipher_desc *desc, long func, +- u8 *iv, struct blkcipher_walk *walk) ++ struct blkcipher_walk *walk) + { ++ struct s390_des_ctx *ctx = crypto_blkcipher_ctx(desc->tfm); + int ret = blkcipher_walk_virt(desc, walk); + unsigned int nbytes = walk->nbytes; ++ struct { ++ u8 iv[DES_BLOCK_SIZE]; ++ u8 key[DES3_KEY_SIZE]; ++ } param; + + if (!nbytes) + goto out; + +- memcpy(iv, walk->iv, DES_BLOCK_SIZE); ++ memcpy(param.iv, walk->iv, DES_BLOCK_SIZE); ++ memcpy(param.key, ctx->key, DES3_KEY_SIZE); + do { + /* only use complete blocks */ + unsigned int n = nbytes & ~(DES_BLOCK_SIZE - 1); + u8 *out = walk->dst.virt.addr; + u8 *in = walk->src.virt.addr; + +- ret = crypt_s390_kmc(func, iv, out, in, n); ++ ret = crypt_s390_kmc(func, ¶m, out, in, n); + if (ret < 0 || ret != n) + return -EIO; + + nbytes &= DES_BLOCK_SIZE - 1; + ret = blkcipher_walk_done(desc, walk, nbytes); + } while ((nbytes = walk->nbytes)); +- memcpy(walk->iv, iv, DES_BLOCK_SIZE); ++ memcpy(walk->iv, param.iv, DES_BLOCK_SIZE); + + out: + return ret; +@@ -179,22 +186,20 @@ static int cbc_des_encrypt(struct blkcipher_desc *desc, + struct scatterlist *dst, struct scatterlist *src, + unsigned int nbytes) + { +- struct s390_des_ctx *ctx = crypto_blkcipher_ctx(desc->tfm); + struct blkcipher_walk walk; + + blkcipher_walk_init(&walk, dst, src, nbytes); +- return cbc_desall_crypt(desc, KMC_DEA_ENCRYPT, ctx->iv, &walk); ++ return cbc_desall_crypt(desc, KMC_DEA_ENCRYPT, &walk); + } + + static int cbc_des_decrypt(struct blkcipher_desc *desc, + struct scatterlist *dst, struct scatterlist *src, + unsigned int nbytes) + { +- struct s390_des_ctx *ctx = crypto_blkcipher_ctx(desc->tfm); + struct blkcipher_walk walk; + + blkcipher_walk_init(&walk, dst, src, nbytes); +- return cbc_desall_crypt(desc, KMC_DEA_DECRYPT, ctx->iv, &walk); ++ return cbc_desall_crypt(desc, KMC_DEA_DECRYPT, &walk); + } + + static struct crypto_alg cbc_des_alg = { +@@ -327,22 +332,20 @@ static int cbc_des3_encrypt(struct blkcipher_desc *desc, + struct scatterlist *dst, struct scatterlist *src, + unsigned int nbytes) + { +- struct s390_des_ctx *ctx = crypto_blkcipher_ctx(desc->tfm); + struct blkcipher_walk walk; + + blkcipher_walk_init(&walk, dst, src, nbytes); +- return cbc_desall_crypt(desc, KMC_TDEA_192_ENCRYPT, ctx->iv, &walk); ++ return cbc_desall_crypt(desc, KMC_TDEA_192_ENCRYPT, &walk); + } + + static int cbc_des3_decrypt(struct blkcipher_desc *desc, + struct scatterlist *dst, struct scatterlist *src, + unsigned int nbytes) + { +- struct s390_des_ctx *ctx = crypto_blkcipher_ctx(desc->tfm); + struct blkcipher_walk walk; + + blkcipher_walk_init(&walk, dst, src, nbytes); +- return cbc_desall_crypt(desc, KMC_TDEA_192_DECRYPT, ctx->iv, &walk); ++ return cbc_desall_crypt(desc, KMC_TDEA_192_DECRYPT, &walk); + } + + static struct crypto_alg cbc_des3_alg = { +@@ -366,54 +369,80 @@ static struct crypto_alg cbc_des3_alg = { + } + }; + ++static unsigned int __ctrblk_init(u8 *ctrptr, unsigned int nbytes) ++{ ++ unsigned int i, n; ++ ++ /* align to block size, max. PAGE_SIZE */ ++ n = (nbytes > PAGE_SIZE) ? PAGE_SIZE : nbytes & ~(DES_BLOCK_SIZE - 1); ++ for (i = DES_BLOCK_SIZE; i < n; i += DES_BLOCK_SIZE) { ++ memcpy(ctrptr + i, ctrptr + i - DES_BLOCK_SIZE, DES_BLOCK_SIZE); ++ crypto_inc(ctrptr + i, DES_BLOCK_SIZE); ++ } ++ return n; ++} ++ + static int ctr_desall_crypt(struct blkcipher_desc *desc, long func, +- struct s390_des_ctx *ctx, struct blkcipher_walk *walk) ++ struct s390_des_ctx *ctx, ++ struct blkcipher_walk *walk) + { + int ret = blkcipher_walk_virt_block(desc, walk, DES_BLOCK_SIZE); +- unsigned int i, n, nbytes; +- u8 buf[DES_BLOCK_SIZE]; +- u8 *out, *in; ++ unsigned int n, nbytes; ++ u8 buf[DES_BLOCK_SIZE], ctrbuf[DES_BLOCK_SIZE]; ++ u8 *out, *in, *ctrptr = ctrbuf; ++ ++ if (!walk->nbytes) ++ return ret; + +- memcpy(ctrblk, walk->iv, DES_BLOCK_SIZE); ++ if (spin_trylock(&ctrblk_lock)) ++ ctrptr = ctrblk; ++ ++ memcpy(ctrptr, walk->iv, DES_BLOCK_SIZE); + while ((nbytes = walk->nbytes) >= DES_BLOCK_SIZE) { + out = walk->dst.virt.addr; + in = walk->src.virt.addr; + while (nbytes >= DES_BLOCK_SIZE) { +- /* align to block size, max. PAGE_SIZE */ +- n = (nbytes > PAGE_SIZE) ? PAGE_SIZE : +- nbytes & ~(DES_BLOCK_SIZE - 1); +- for (i = DES_BLOCK_SIZE; i < n; i += DES_BLOCK_SIZE) { +- memcpy(ctrblk + i, ctrblk + i - DES_BLOCK_SIZE, +- DES_BLOCK_SIZE); +- crypto_inc(ctrblk + i, DES_BLOCK_SIZE); +- } +- ret = crypt_s390_kmctr(func, ctx->key, out, in, n, ctrblk); +- if (ret < 0 || ret != n) ++ if (ctrptr == ctrblk) ++ n = __ctrblk_init(ctrptr, nbytes); ++ else ++ n = DES_BLOCK_SIZE; ++ ret = crypt_s390_kmctr(func, ctx->key, out, in, ++ n, ctrptr); ++ if (ret < 0 || ret != n) { ++ if (ctrptr == ctrblk) ++ spin_unlock(&ctrblk_lock); + return -EIO; ++ } + if (n > DES_BLOCK_SIZE) +- memcpy(ctrblk, ctrblk + n - DES_BLOCK_SIZE, ++ memcpy(ctrptr, ctrptr + n - DES_BLOCK_SIZE, + DES_BLOCK_SIZE); +- crypto_inc(ctrblk, DES_BLOCK_SIZE); ++ crypto_inc(ctrptr, DES_BLOCK_SIZE); + out += n; + in += n; + nbytes -= n; + } + ret = blkcipher_walk_done(desc, walk, nbytes); + } +- ++ if (ctrptr == ctrblk) { ++ if (nbytes) ++ memcpy(ctrbuf, ctrptr, DES_BLOCK_SIZE); ++ else ++ memcpy(walk->iv, ctrptr, DES_BLOCK_SIZE); ++ spin_unlock(&ctrblk_lock); ++ } + /* final block may be < DES_BLOCK_SIZE, copy only nbytes */ + if (nbytes) { + out = walk->dst.virt.addr; + in = walk->src.virt.addr; + ret = crypt_s390_kmctr(func, ctx->key, buf, in, +- DES_BLOCK_SIZE, ctrblk); ++ DES_BLOCK_SIZE, ctrbuf); + if (ret < 0 || ret != DES_BLOCK_SIZE) + return -EIO; + memcpy(out, buf, nbytes); +- crypto_inc(ctrblk, DES_BLOCK_SIZE); ++ crypto_inc(ctrbuf, DES_BLOCK_SIZE); + ret = blkcipher_walk_done(desc, walk, 0); ++ memcpy(walk->iv, ctrbuf, DES_BLOCK_SIZE); + } +- memcpy(walk->iv, ctrblk, DES_BLOCK_SIZE); + return ret; + } + +diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c +index 32d37d9a7787..f187806dfc18 100644 +--- a/arch/x86/kernel/cpu/intel.c ++++ b/arch/x86/kernel/cpu/intel.c +@@ -628,7 +628,7 @@ static void __cpuinit intel_tlb_flushall_shift_set(struct cpuinfo_x86 *c) + tlb_flushall_shift = 5; + break; + case 0x63a: /* Ivybridge */ +- tlb_flushall_shift = 1; ++ tlb_flushall_shift = 2; + break; + default: + tlb_flushall_shift = 6; +diff --git a/drivers/infiniband/hw/qib/qib_user_sdma.c b/drivers/infiniband/hw/qib/qib_user_sdma.c +index 82442085cbe6..573b4601d5b9 100644 +--- a/drivers/infiniband/hw/qib/qib_user_sdma.c ++++ b/drivers/infiniband/hw/qib/qib_user_sdma.c +@@ -284,8 +284,7 @@ static int qib_user_sdma_pin_pages(const struct qib_devdata *dd, + int j; + int ret; + +- ret = get_user_pages(current, current->mm, addr, +- npages, 0, 1, pages, NULL); ++ ret = get_user_pages_fast(addr, npages, 0, pages); + + if (ret != npages) { + int i; +@@ -830,10 +829,7 @@ int qib_user_sdma_writev(struct qib_ctxtdata *rcd, + while (dim) { + const int mxp = 8; + +- down_write(¤t->mm->mmap_sem); + ret = qib_user_sdma_queue_pkts(dd, pq, &list, iov, dim, mxp); +- up_write(¤t->mm->mmap_sem); +- + if (ret <= 0) + goto done_unlock; + else { +diff --git a/drivers/irqchip/irq-armada-370-xp.c b/drivers/irqchip/irq-armada-370-xp.c +index bb328a366122..a51ee009ed83 100644 +--- a/drivers/irqchip/irq-armada-370-xp.c ++++ b/drivers/irqchip/irq-armada-370-xp.c +@@ -229,7 +229,7 @@ armada_370_xp_handle_irq(struct pt_regs *regs) + ARMADA_370_XP_IN_DRBEL_CAUSE_OFFS) + & IPI_DOORBELL_MASK; + +- writel(~IPI_DOORBELL_MASK, per_cpu_int_base + ++ writel(~ipimask, per_cpu_int_base + + ARMADA_370_XP_IN_DRBEL_CAUSE_OFFS); + + /* Handle all pending doorbells */ +diff --git a/drivers/media/usb/dvb-usb-v2/af9035.c b/drivers/media/usb/dvb-usb-v2/af9035.c +index 46f05ad529f9..2e93ba5598c4 100644 +--- a/drivers/media/usb/dvb-usb-v2/af9035.c ++++ b/drivers/media/usb/dvb-usb-v2/af9035.c +@@ -1517,6 +1517,8 @@ static const struct usb_device_id af9035_id_table[] = { + &af9035_props, "TerraTec Cinergy T Stick Dual RC (rev. 2)", NULL) }, + { DVB_USB_DEVICE(USB_VID_LEADTEK, 0x6a05, + &af9035_props, "Leadtek WinFast DTV Dongle Dual", NULL) }, ++ { DVB_USB_DEVICE(USB_VID_HAUPPAUGE, 0xf900, ++ &af9035_props, "Hauppauge WinTV-MiniStick 2", NULL) }, + { } + }; + MODULE_DEVICE_TABLE(usb, af9035_id_table); +diff --git a/drivers/media/usb/dvb-usb-v2/mxl111sf-tuner.h b/drivers/media/usb/dvb-usb-v2/mxl111sf-tuner.h +index 90f583e5d6a6..a8f65d88c9e7 100644 +--- a/drivers/media/usb/dvb-usb-v2/mxl111sf-tuner.h ++++ b/drivers/media/usb/dvb-usb-v2/mxl111sf-tuner.h +@@ -68,7 +68,7 @@ struct dvb_frontend *mxl111sf_tuner_attach(struct dvb_frontend *fe, + #else + static inline + struct dvb_frontend *mxl111sf_tuner_attach(struct dvb_frontend *fe, +- struct mxl111sf_state *mxl_state ++ struct mxl111sf_state *mxl_state, + struct mxl111sf_tuner_config *cfg) + { + printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __func__); +diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c +index 5327f35d9b5c..bb7ee9cb00b1 100644 +--- a/drivers/pinctrl/core.c ++++ b/drivers/pinctrl/core.c +@@ -807,7 +807,9 @@ static struct pinctrl *create_pinctrl(struct device *dev) + kref_init(&p->users); + + /* Add the pinctrl handle to the global list */ ++ mutex_lock(&pinctrl_list_mutex); + list_add_tail(&p->node, &pinctrl_list); ++ mutex_unlock(&pinctrl_list_mutex); + + return p; + } +diff --git a/drivers/pinctrl/vt8500/pinctrl-wmt.c b/drivers/pinctrl/vt8500/pinctrl-wmt.c +index 70d986e04afb..8b54b5da00c0 100644 +--- a/drivers/pinctrl/vt8500/pinctrl-wmt.c ++++ b/drivers/pinctrl/vt8500/pinctrl-wmt.c +@@ -276,7 +276,20 @@ static int wmt_pctl_dt_node_to_map_pull(struct wmt_pinctrl_data *data, + if (!configs) + return -ENOMEM; + +- configs[0] = pull; ++ switch (pull) { ++ case 0: ++ configs[0] = PIN_CONFIG_BIAS_DISABLE; ++ break; ++ case 1: ++ configs[0] = PIN_CONFIG_BIAS_PULL_DOWN; ++ break; ++ case 2: ++ configs[0] = PIN_CONFIG_BIAS_PULL_UP; ++ break; ++ default: ++ configs[0] = PIN_CONFIG_BIAS_DISABLE; ++ dev_err(data->dev, "invalid pull state %d - disabling\n", pull); ++ } + + map->type = PIN_MAP_TYPE_CONFIGS_PIN; + map->data.configs.group_or_pin = data->groups[group]; +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index 0bcee78cde16..25e6a8e1014e 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -2655,7 +2655,7 @@ static int btrfs_finish_ordered_io(struct btrfs_ordered_extent *ordered_extent) + EXTENT_DEFRAG, 1, cached_state); + if (ret) { + u64 last_snapshot = btrfs_root_last_snapshot(&root->root_item); +- if (last_snapshot >= BTRFS_I(inode)->generation) ++ if (0 && last_snapshot >= BTRFS_I(inode)->generation) + /* the inode is shared */ + new = record_old_file_extents(inode, ordered_extent); + +diff --git a/fs/buffer.c b/fs/buffer.c +index d2a4d1bb2d57..75964d734444 100644 +--- a/fs/buffer.c ++++ b/fs/buffer.c +@@ -620,14 +620,16 @@ EXPORT_SYMBOL(mark_buffer_dirty_inode); + static void __set_page_dirty(struct page *page, + struct address_space *mapping, int warn) + { +- spin_lock_irq(&mapping->tree_lock); ++ unsigned long flags; ++ ++ spin_lock_irqsave(&mapping->tree_lock, flags); + if (page->mapping) { /* Race with truncate? */ + WARN_ON_ONCE(warn && !PageUptodate(page)); + account_page_dirtied(page, mapping); + radix_tree_tag_set(&mapping->page_tree, + page_index(page), PAGECACHE_TAG_DIRTY); + } +- spin_unlock_irq(&mapping->tree_lock); ++ spin_unlock_irqrestore(&mapping->tree_lock, flags); + __mark_inode_dirty(mapping->host, I_DIRTY_PAGES); + } + +diff --git a/lib/Makefile b/lib/Makefile +index c55a037a354e..9efe480b975e 100644 +--- a/lib/Makefile ++++ b/lib/Makefile +@@ -45,6 +45,7 @@ lib-$(CONFIG_RWSEM_GENERIC_SPINLOCK) += rwsem-spinlock.o + lib-$(CONFIG_RWSEM_XCHGADD_ALGORITHM) += rwsem.o + lib-$(CONFIG_PERCPU_RWSEM) += percpu-rwsem.o + ++GCOV_PROFILE_hweight.o := n + CFLAGS_hweight.o = $(subst $(quote),,$(CONFIG_ARCH_HWEIGHT_CFLAGS)) + obj-$(CONFIG_GENERIC_HWEIGHT) += hweight.o + +diff --git a/mm/hugetlb.c b/mm/hugetlb.c +index 40ad2c6e0ca9..aa3b9a63394b 100644 +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -21,6 +21,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -517,9 +518,15 @@ static struct page *dequeue_huge_page_node(struct hstate *h, int nid) + { + struct page *page; + +- if (list_empty(&h->hugepage_freelists[nid])) ++ list_for_each_entry(page, &h->hugepage_freelists[nid], lru) ++ if (!is_migrate_isolate_page(page)) ++ break; ++ /* ++ * if 'non-isolated free hugepage' not found on the list, ++ * the allocation fails. ++ */ ++ if (&h->hugepage_freelists[nid] == &page->lru) + return NULL; +- page = list_entry(h->hugepage_freelists[nid].next, struct page, lru); + list_move(&page->lru, &h->hugepage_activelist); + set_page_refcounted(page); + h->free_huge_pages--; +diff --git a/mm/memory-failure.c b/mm/memory-failure.c +index 3b4120e38d48..f2a591d87d00 100644 +--- a/mm/memory-failure.c ++++ b/mm/memory-failure.c +@@ -1421,7 +1421,8 @@ static int __get_any_page(struct page *p, unsigned long pfn, int flags) + + /* + * Isolate the page, so that it doesn't get reallocated if it +- * was free. ++ * was free. This flag should be kept set until the source page ++ * is freed and PG_hwpoison on it is set. + */ + set_migratetype_isolate(p, true); + /* +@@ -1444,7 +1445,6 @@ static int __get_any_page(struct page *p, unsigned long pfn, int flags) + /* Not a free page */ + ret = 1; + } +- unset_migratetype_isolate(p, MIGRATE_MOVABLE); + unlock_memory_hotplug(); + return ret; + } +@@ -1511,7 +1511,6 @@ static int soft_offline_huge_page(struct page *page, int flags) + atomic_long_inc(&num_poisoned_pages); + } + } +- /* keep elevated page count for bad page */ + return ret; + } + +@@ -1576,7 +1575,7 @@ int soft_offline_page(struct page *page, int flags) + atomic_long_inc(&num_poisoned_pages); + } + } +- /* keep elevated page count for bad page */ ++ unset_migratetype_isolate(page, MIGRATE_MOVABLE); + return ret; + } + +@@ -1642,7 +1641,22 @@ static int __soft_offline_page(struct page *page, int flags) + if (ret > 0) + ret = -EIO; + } else { ++ /* ++ * After page migration succeeds, the source page can ++ * be trapped in pagevec and actual freeing is delayed. ++ * Freeing code works differently based on PG_hwpoison, ++ * so there's a race. We need to make sure that the ++ * source page should be freed back to buddy before ++ * setting PG_hwpoison. ++ */ ++ if (!is_free_buddy_page(page)) ++ lru_add_drain_all(); ++ if (!is_free_buddy_page(page)) ++ drain_all_pages(); + SetPageHWPoison(page); ++ if (!is_free_buddy_page(page)) ++ pr_info("soft offline: %#lx: page leaked\n", ++ pfn); + atomic_long_inc(&num_poisoned_pages); + } + } else { +diff --git a/mm/page-writeback.c b/mm/page-writeback.c +index 5a06d4cb9a3d..73cbc5dc150b 100644 +--- a/mm/page-writeback.c ++++ b/mm/page-writeback.c +@@ -2026,11 +2026,12 @@ int __set_page_dirty_nobuffers(struct page *page) + if (!TestSetPageDirty(page)) { + struct address_space *mapping = page_mapping(page); + struct address_space *mapping2; ++ unsigned long flags; + + if (!mapping) + return 1; + +- spin_lock_irq(&mapping->tree_lock); ++ spin_lock_irqsave(&mapping->tree_lock, flags); + mapping2 = page_mapping(page); + if (mapping2) { /* Race with truncate? */ + BUG_ON(mapping2 != mapping); +@@ -2039,7 +2040,7 @@ int __set_page_dirty_nobuffers(struct page *page) + radix_tree_tag_set(&mapping->page_tree, + page_index(page), PAGECACHE_TAG_DIRTY); + } +- spin_unlock_irq(&mapping->tree_lock); ++ spin_unlock_irqrestore(&mapping->tree_lock, flags); + if (mapping->host) { + /* !PageAnon && !swapper_space */ + __mark_inode_dirty(mapping->host, I_DIRTY_PAGES); +diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c +index b4feecc3fe01..18caa16de27b 100644 +--- a/security/selinux/ss/services.c ++++ b/security/selinux/ss/services.c +@@ -1231,6 +1231,10 @@ static int security_context_to_sid_core(const char *scontext, u32 scontext_len, + struct context context; + int rc = 0; + ++ /* An empty security context is never valid. */ ++ if (!scontext_len) ++ return -EINVAL; ++ + if (!ss_initialized) { + int i; + +diff --git a/sound/pci/hda/patch_analog.c b/sound/pci/hda/patch_analog.c +index a7b07f72c9dd..5a6527668c07 100644 +--- a/sound/pci/hda/patch_analog.c ++++ b/sound/pci/hda/patch_analog.c +@@ -1680,6 +1680,7 @@ static int ad1983_parse_auto_config(struct hda_codec *codec) + return err; + spec = codec->spec; + ++ spec->gen.mixer_nid = 0x0e; + spec->gen.beep_nid = 0x10; + set_beep_amp(spec, 0x10, 0, HDA_OUTPUT); + err = ad198x_parse_auto_config(codec); +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 4b06e0a64392..87a03aca1b2e 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -1765,6 +1765,7 @@ enum { + ALC889_FIXUP_IMAC91_VREF, + ALC889_FIXUP_MBA11_VREF, + ALC889_FIXUP_MBA21_VREF, ++ ALC889_FIXUP_MP11_VREF, + ALC882_FIXUP_INV_DMIC, + ALC882_FIXUP_NO_PRIMARY_HP, + ALC887_FIXUP_ASUS_BASS, +@@ -2119,6 +2120,12 @@ static const struct hda_fixup alc882_fixups[] = { + .chained = true, + .chain_id = ALC889_FIXUP_MBP_VREF, + }, ++ [ALC889_FIXUP_MP11_VREF] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc889_fixup_mba11_vref, ++ .chained = true, ++ .chain_id = ALC885_FIXUP_MACPRO_GPIO, ++ }, + [ALC882_FIXUP_INV_DMIC] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc_fixup_inv_dmic_0x12, +@@ -2176,7 +2183,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = { + SND_PCI_QUIRK(0x106b, 0x00a0, "MacBookPro 3,1", ALC889_FIXUP_MBP_VREF), + SND_PCI_QUIRK(0x106b, 0x00a1, "Macbook", ALC889_FIXUP_MBP_VREF), + SND_PCI_QUIRK(0x106b, 0x00a4, "MacbookPro 4,1", ALC889_FIXUP_MBP_VREF), +- SND_PCI_QUIRK(0x106b, 0x0c00, "Mac Pro", ALC885_FIXUP_MACPRO_GPIO), ++ SND_PCI_QUIRK(0x106b, 0x0c00, "Mac Pro", ALC889_FIXUP_MP11_VREF), + SND_PCI_QUIRK(0x106b, 0x1000, "iMac 24", ALC885_FIXUP_MACPRO_GPIO), + SND_PCI_QUIRK(0x106b, 0x2800, "AppleTV", ALC885_FIXUP_MACPRO_GPIO), + SND_PCI_QUIRK(0x106b, 0x2c00, "MacbookPro rev3", ALC889_FIXUP_MBP_VREF), +diff --git a/sound/usb/Kconfig b/sound/usb/Kconfig +index 225dfd737265..ba2664200d14 100644 +--- a/sound/usb/Kconfig ++++ b/sound/usb/Kconfig +@@ -14,6 +14,7 @@ config SND_USB_AUDIO + select SND_HWDEP + select SND_RAWMIDI + select SND_PCM ++ select BITREVERSE + help + Say Y here to include support for USB audio and USB MIDI + devices. diff --git a/projects/Cuboxi/patches/linux/linux-000-patch-3.10.31-32.patch b/projects/Cuboxi/patches/linux/linux-000-patch-3.10.31-32.patch new file mode 100644 index 0000000000..c78c44c772 --- /dev/null +++ b/projects/Cuboxi/patches/linux/linux-000-patch-3.10.31-32.patch @@ -0,0 +1,2000 @@ +diff --git a/Makefile b/Makefile +index 56b93edbbe4e..aab192446f50 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 10 +-SUBLEVEL = 31 ++SUBLEVEL = 32 + EXTRAVERSION = + NAME = TOSSUG Baby Fish + +diff --git a/arch/s390/kernel/head64.S b/arch/s390/kernel/head64.S +index b9e25ae2579c..d7c00507568a 100644 +--- a/arch/s390/kernel/head64.S ++++ b/arch/s390/kernel/head64.S +@@ -59,7 +59,7 @@ ENTRY(startup_continue) + .quad 0 # cr12: tracing off + .quad 0 # cr13: home space segment table + .quad 0xc0000000 # cr14: machine check handling off +- .quad 0 # cr15: linkage stack operations ++ .quad .Llinkage_stack # cr15: linkage stack operations + .Lpcmsk:.quad 0x0000000180000000 + .L4malign:.quad 0xffffffffffc00000 + .Lscan2g:.quad 0x80000000 + 0x20000 - 8 # 2GB + 128K - 8 +@@ -67,12 +67,15 @@ ENTRY(startup_continue) + .Lparmaddr: + .quad PARMAREA + .align 64 +-.Lduct: .long 0,0,0,0,.Lduald,0,0,0 ++.Lduct: .long 0,.Laste,.Laste,0,.Lduald,0,0,0 + .long 0,0,0,0,0,0,0,0 ++.Laste: .quad 0,0xffffffffffffffff,0,0,0,0,0,0 + .align 128 + .Lduald:.rept 8 + .long 0x80000000,0,0,0 # invalid access-list entries + .endr ++.Llinkage_stack: ++ .long 0,0,0x89000000,0,0,0,0x8a000000,0 + + ENTRY(_ehead) + +diff --git a/arch/s390/mm/page-states.c b/arch/s390/mm/page-states.c +index a90d45e9dfb0..27c50f4d90cb 100644 +--- a/arch/s390/mm/page-states.c ++++ b/arch/s390/mm/page-states.c +@@ -12,6 +12,8 @@ + #include + #include + #include ++#include ++#include + + #define ESSA_SET_STABLE 1 + #define ESSA_SET_UNUSED 2 +@@ -41,6 +43,14 @@ void __init cmma_init(void) + + if (!cmma_flag) + return; ++ /* ++ * Disable CMM for dump, otherwise the tprot based memory ++ * detection can fail because of unstable pages. ++ */ ++ if (OLDMEM_BASE || ipl_info.type == IPL_TYPE_FCP_DUMP) { ++ cmma_flag = 0; ++ return; ++ } + asm volatile( + " .insn rrf,0xb9ab0000,%1,%1,0,0\n" + "0: la %0,0\n" +diff --git a/arch/x86/include/asm/xen/page.h b/arch/x86/include/asm/xen/page.h +index 6aef9fbc09b7..b913915e8e63 100644 +--- a/arch/x86/include/asm/xen/page.h ++++ b/arch/x86/include/asm/xen/page.h +@@ -79,30 +79,38 @@ static inline int phys_to_machine_mapping_valid(unsigned long pfn) + return get_phys_to_machine(pfn) != INVALID_P2M_ENTRY; + } + +-static inline unsigned long mfn_to_pfn(unsigned long mfn) ++static inline unsigned long mfn_to_pfn_no_overrides(unsigned long mfn) + { + unsigned long pfn; +- int ret = 0; ++ int ret; + + if (xen_feature(XENFEAT_auto_translated_physmap)) + return mfn; + +- if (unlikely(mfn >= machine_to_phys_nr)) { +- pfn = ~0; +- goto try_override; +- } +- pfn = 0; ++ if (unlikely(mfn >= machine_to_phys_nr)) ++ return ~0; ++ + /* + * The array access can fail (e.g., device space beyond end of RAM). + * In such cases it doesn't matter what we return (we return garbage), + * but we must handle the fault without crashing! + */ + ret = __get_user(pfn, &machine_to_phys_mapping[mfn]); +-try_override: +- /* ret might be < 0 if there are no entries in the m2p for mfn */ + if (ret < 0) +- pfn = ~0; +- else if (get_phys_to_machine(pfn) != mfn) ++ return ~0; ++ ++ return pfn; ++} ++ ++static inline unsigned long mfn_to_pfn(unsigned long mfn) ++{ ++ unsigned long pfn; ++ ++ if (xen_feature(XENFEAT_auto_translated_physmap)) ++ return mfn; ++ ++ pfn = mfn_to_pfn_no_overrides(mfn); ++ if (get_phys_to_machine(pfn) != mfn) { + /* + * If this appears to be a foreign mfn (because the pfn + * doesn't map back to the mfn), then check the local override +@@ -111,6 +119,7 @@ try_override: + * m2p_find_override_pfn returns ~0 if it doesn't find anything. + */ + pfn = m2p_find_override_pfn(mfn, ~0); ++ } + + /* + * pfn is ~0 if there are no entries in the m2p for mfn or if the +diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c +index 22018f70a671..deeb48d9459b 100644 +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -284,8 +284,13 @@ static __always_inline void setup_smap(struct cpuinfo_x86 *c) + raw_local_save_flags(eflags); + BUG_ON(eflags & X86_EFLAGS_AC); + +- if (cpu_has(c, X86_FEATURE_SMAP)) ++ if (cpu_has(c, X86_FEATURE_SMAP)) { ++#ifdef CONFIG_X86_SMAP + set_in_cr4(X86_CR4_SMAP); ++#else ++ clear_in_cr4(X86_CR4_SMAP); ++#endif ++ } + } + + /* +diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c +index d4bdd253fea7..e6253195a301 100644 +--- a/arch/x86/kernel/ftrace.c ++++ b/arch/x86/kernel/ftrace.c +@@ -77,8 +77,7 @@ within(unsigned long addr, unsigned long start, unsigned long end) + return addr >= start && addr < end; + } + +-static int +-do_ftrace_mod_code(unsigned long ip, const void *new_code) ++static unsigned long text_ip_addr(unsigned long ip) + { + /* + * On x86_64, kernel text mappings are mapped read-only with +@@ -91,7 +90,7 @@ do_ftrace_mod_code(unsigned long ip, const void *new_code) + if (within(ip, (unsigned long)_text, (unsigned long)_etext)) + ip = (unsigned long)__va(__pa_symbol(ip)); + +- return probe_kernel_write((void *)ip, new_code, MCOUNT_INSN_SIZE); ++ return ip; + } + + static const unsigned char *ftrace_nop_replace(void) +@@ -123,8 +122,10 @@ ftrace_modify_code_direct(unsigned long ip, unsigned const char *old_code, + if (memcmp(replaced, old_code, MCOUNT_INSN_SIZE) != 0) + return -EINVAL; + ++ ip = text_ip_addr(ip); ++ + /* replace the text with the new text */ +- if (do_ftrace_mod_code(ip, new_code)) ++ if (probe_kernel_write((void *)ip, new_code, MCOUNT_INSN_SIZE)) + return -EPERM; + + sync_core(); +@@ -221,37 +222,51 @@ int ftrace_modify_call(struct dyn_ftrace *rec, unsigned long old_addr, + return -EINVAL; + } + +-int ftrace_update_ftrace_func(ftrace_func_t func) ++static unsigned long ftrace_update_func; ++ ++static int update_ftrace_func(unsigned long ip, void *new) + { +- unsigned long ip = (unsigned long)(&ftrace_call); +- unsigned char old[MCOUNT_INSN_SIZE], *new; ++ unsigned char old[MCOUNT_INSN_SIZE]; + int ret; + +- memcpy(old, &ftrace_call, MCOUNT_INSN_SIZE); +- new = ftrace_call_replace(ip, (unsigned long)func); ++ memcpy(old, (void *)ip, MCOUNT_INSN_SIZE); ++ ++ ftrace_update_func = ip; ++ /* Make sure the breakpoints see the ftrace_update_func update */ ++ smp_wmb(); + + /* See comment above by declaration of modifying_ftrace_code */ + atomic_inc(&modifying_ftrace_code); + + ret = ftrace_modify_code(ip, old, new); + ++ atomic_dec(&modifying_ftrace_code); ++ ++ return ret; ++} ++ ++int ftrace_update_ftrace_func(ftrace_func_t func) ++{ ++ unsigned long ip = (unsigned long)(&ftrace_call); ++ unsigned char *new; ++ int ret; ++ ++ new = ftrace_call_replace(ip, (unsigned long)func); ++ ret = update_ftrace_func(ip, new); ++ + /* Also update the regs callback function */ + if (!ret) { + ip = (unsigned long)(&ftrace_regs_call); +- memcpy(old, &ftrace_regs_call, MCOUNT_INSN_SIZE); + new = ftrace_call_replace(ip, (unsigned long)func); +- ret = ftrace_modify_code(ip, old, new); ++ ret = update_ftrace_func(ip, new); + } + +- atomic_dec(&modifying_ftrace_code); +- + return ret; + } + + static int is_ftrace_caller(unsigned long ip) + { +- if (ip == (unsigned long)(&ftrace_call) || +- ip == (unsigned long)(&ftrace_regs_call)) ++ if (ip == ftrace_update_func) + return 1; + + return 0; +@@ -677,45 +692,41 @@ int __init ftrace_dyn_arch_init(void *data) + #ifdef CONFIG_DYNAMIC_FTRACE + extern void ftrace_graph_call(void); + +-static int ftrace_mod_jmp(unsigned long ip, +- int old_offset, int new_offset) ++static unsigned char *ftrace_jmp_replace(unsigned long ip, unsigned long addr) + { +- unsigned char code[MCOUNT_INSN_SIZE]; ++ static union ftrace_code_union calc; + +- if (probe_kernel_read(code, (void *)ip, MCOUNT_INSN_SIZE)) +- return -EFAULT; ++ /* Jmp not a call (ignore the .e8) */ ++ calc.e8 = 0xe9; ++ calc.offset = ftrace_calc_offset(ip + MCOUNT_INSN_SIZE, addr); + +- if (code[0] != 0xe9 || old_offset != *(int *)(&code[1])) +- return -EINVAL; ++ /* ++ * ftrace external locks synchronize the access to the static variable. ++ */ ++ return calc.code; ++} + +- *(int *)(&code[1]) = new_offset; ++static int ftrace_mod_jmp(unsigned long ip, void *func) ++{ ++ unsigned char *new; + +- if (do_ftrace_mod_code(ip, &code)) +- return -EPERM; ++ new = ftrace_jmp_replace(ip, (unsigned long)func); + +- return 0; ++ return update_ftrace_func(ip, new); + } + + int ftrace_enable_ftrace_graph_caller(void) + { + unsigned long ip = (unsigned long)(&ftrace_graph_call); +- int old_offset, new_offset; + +- old_offset = (unsigned long)(&ftrace_stub) - (ip + MCOUNT_INSN_SIZE); +- new_offset = (unsigned long)(&ftrace_graph_caller) - (ip + MCOUNT_INSN_SIZE); +- +- return ftrace_mod_jmp(ip, old_offset, new_offset); ++ return ftrace_mod_jmp(ip, &ftrace_graph_caller); + } + + int ftrace_disable_ftrace_graph_caller(void) + { + unsigned long ip = (unsigned long)(&ftrace_graph_call); +- int old_offset, new_offset; +- +- old_offset = (unsigned long)(&ftrace_graph_caller) - (ip + MCOUNT_INSN_SIZE); +- new_offset = (unsigned long)(&ftrace_stub) - (ip + MCOUNT_INSN_SIZE); + +- return ftrace_mod_jmp(ip, old_offset, new_offset); ++ return ftrace_mod_jmp(ip, &ftrace_stub); + } + + #endif /* !CONFIG_DYNAMIC_FTRACE */ +diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c +index 654be4ae3047..c1e9e4cbbd76 100644 +--- a/arch/x86/mm/fault.c ++++ b/arch/x86/mm/fault.c +@@ -989,6 +989,12 @@ static int fault_in_kernel_space(unsigned long address) + + static inline bool smap_violation(int error_code, struct pt_regs *regs) + { ++ if (!IS_ENABLED(CONFIG_X86_SMAP)) ++ return false; ++ ++ if (!static_cpu_has(X86_FEATURE_SMAP)) ++ return false; ++ + if (error_code & PF_USER) + return false; + +@@ -1091,11 +1097,9 @@ __do_page_fault(struct pt_regs *regs, unsigned long error_code) + if (unlikely(error_code & PF_RSVD)) + pgtable_bad(regs, error_code, address); + +- if (static_cpu_has(X86_FEATURE_SMAP)) { +- if (unlikely(smap_violation(error_code, regs))) { +- bad_area_nosemaphore(regs, error_code, address); +- return; +- } ++ if (unlikely(smap_violation(error_code, regs))) { ++ bad_area_nosemaphore(regs, error_code, address); ++ return; + } + + perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, address); +diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c +index 95fb2aa5927e..156344448d19 100644 +--- a/arch/x86/xen/p2m.c ++++ b/arch/x86/xen/p2m.c +@@ -878,7 +878,6 @@ int m2p_add_override(unsigned long mfn, struct page *page, + unsigned long uninitialized_var(address); + unsigned level; + pte_t *ptep = NULL; +- int ret = 0; + + pfn = page_to_pfn(page); + if (!PageHighMem(page)) { +@@ -925,8 +924,8 @@ int m2p_add_override(unsigned long mfn, struct page *page, + * frontend pages while they are being shared with the backend, + * because mfn_to_pfn (that ends up being called by GUPF) will + * return the backend pfn rather than the frontend pfn. */ +- ret = __get_user(pfn, &machine_to_phys_mapping[mfn]); +- if (ret == 0 && get_phys_to_machine(pfn) == mfn) ++ pfn = mfn_to_pfn_no_overrides(mfn); ++ if (get_phys_to_machine(pfn) == mfn) + set_phys_to_machine(pfn, FOREIGN_FRAME(mfn)); + + return 0; +@@ -941,7 +940,6 @@ int m2p_remove_override(struct page *page, + unsigned long uninitialized_var(address); + unsigned level; + pte_t *ptep = NULL; +- int ret = 0; + + pfn = page_to_pfn(page); + mfn = get_phys_to_machine(pfn); +@@ -1019,8 +1017,8 @@ int m2p_remove_override(struct page *page, + * the original pfn causes mfn_to_pfn(mfn) to return the frontend + * pfn again. */ + mfn &= ~FOREIGN_FRAME_BIT; +- ret = __get_user(pfn, &machine_to_phys_mapping[mfn]); +- if (ret == 0 && get_phys_to_machine(pfn) == FOREIGN_FRAME(mfn) && ++ pfn = mfn_to_pfn_no_overrides(mfn); ++ if (get_phys_to_machine(pfn) == FOREIGN_FRAME(mfn) && + m2p_find_override(mfn) == NULL) + set_phys_to_machine(pfn, mfn); + +diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c +index a1e58e19d0cc..570c9a5c4d3f 100644 +--- a/arch/x86/xen/smp.c ++++ b/arch/x86/xen/smp.c +@@ -245,6 +245,15 @@ static void __init xen_smp_prepare_boot_cpu(void) + old memory can be recycled */ + make_lowmem_page_readwrite(xen_initial_gdt); + ++#ifdef CONFIG_X86_32 ++ /* ++ * Xen starts us with XEN_FLAT_RING1_DS, but linux code ++ * expects __USER_DS ++ */ ++ loadsegment(ds, __USER_DS); ++ loadsegment(es, __USER_DS); ++#endif ++ + xen_filter_cpu_maps(); + xen_setup_vcpu_info_placement(); + } +diff --git a/block/blk-lib.c b/block/blk-lib.c +index d6f50d572565..9a32f5868fb9 100644 +--- a/block/blk-lib.c ++++ b/block/blk-lib.c +@@ -121,6 +121,14 @@ int blkdev_issue_discard(struct block_device *bdev, sector_t sector, + + atomic_inc(&bb.done); + submit_bio(type, bio); ++ ++ /* ++ * We can loop for a long time in here, if someone does ++ * full device discards (like mkfs). Be nice and allow ++ * us to schedule out to avoid softlocking if preempt ++ * is disabled. ++ */ ++ cond_resched(); + } + blk_finish_plug(&plug); + +diff --git a/block/blk.h b/block/blk.h +index e837b8f619b7..b3bdeb36f361 100644 +--- a/block/blk.h ++++ b/block/blk.h +@@ -96,7 +96,7 @@ static inline struct request *__elv_next_request(struct request_queue *q) + q->flush_queue_delayed = 1; + return NULL; + } +- if (unlikely(blk_queue_dying(q)) || ++ if (unlikely(blk_queue_bypass(q)) || + !q->elevator->type->ops.elevator_dispatch_fn(q, 0)) + return NULL; + } +diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c +index 69b45fc97276..1735b0d17e29 100644 +--- a/drivers/block/xen-blkfront.c ++++ b/drivers/block/xen-blkfront.c +@@ -1518,13 +1518,16 @@ static void blkback_changed(struct xenbus_device *dev, + case XenbusStateReconfiguring: + case XenbusStateReconfigured: + case XenbusStateUnknown: +- case XenbusStateClosed: + break; + + case XenbusStateConnected: + blkfront_connect(info); + break; + ++ case XenbusStateClosed: ++ if (dev->state == XenbusStateClosed) ++ break; ++ /* Missed the backend's Closing state -- fallthrough */ + case XenbusStateClosing: + blkfront_closing(info); + break; +diff --git a/drivers/char/raw.c b/drivers/char/raw.c +index f3223aac4df1..6e8d65e9b1d3 100644 +--- a/drivers/char/raw.c ++++ b/drivers/char/raw.c +@@ -190,7 +190,7 @@ static int bind_get(int number, dev_t *dev) + struct raw_device_data *rawdev; + struct block_device *bdev; + +- if (number <= 0 || number >= MAX_RAW_MINORS) ++ if (number <= 0 || number >= max_raw_minors) + return -EINVAL; + + rawdev = &raw_devices[number]; +diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c +index 89e109022d78..a9d98cdd11f4 100644 +--- a/drivers/edac/edac_mc.c ++++ b/drivers/edac/edac_mc.c +@@ -559,7 +559,8 @@ static void edac_mc_workq_function(struct work_struct *work_req) + * + * called with the mem_ctls_mutex held + */ +-static void edac_mc_workq_setup(struct mem_ctl_info *mci, unsigned msec) ++static void edac_mc_workq_setup(struct mem_ctl_info *mci, unsigned msec, ++ bool init) + { + edac_dbg(0, "\n"); + +@@ -567,7 +568,9 @@ static void edac_mc_workq_setup(struct mem_ctl_info *mci, unsigned msec) + if (mci->op_state != OP_RUNNING_POLL) + return; + +- INIT_DELAYED_WORK(&mci->work, edac_mc_workq_function); ++ if (init) ++ INIT_DELAYED_WORK(&mci->work, edac_mc_workq_function); ++ + mod_delayed_work(edac_workqueue, &mci->work, msecs_to_jiffies(msec)); + } + +@@ -601,7 +604,7 @@ static void edac_mc_workq_teardown(struct mem_ctl_info *mci) + * user space has updated our poll period value, need to + * reset our workq delays + */ +-void edac_mc_reset_delay_period(int value) ++void edac_mc_reset_delay_period(unsigned long value) + { + struct mem_ctl_info *mci; + struct list_head *item; +@@ -611,7 +614,7 @@ void edac_mc_reset_delay_period(int value) + list_for_each(item, &mc_devices) { + mci = list_entry(item, struct mem_ctl_info, link); + +- edac_mc_workq_setup(mci, (unsigned long) value); ++ edac_mc_workq_setup(mci, value, false); + } + + mutex_unlock(&mem_ctls_mutex); +@@ -782,7 +785,7 @@ int edac_mc_add_mc(struct mem_ctl_info *mci) + /* This instance is NOW RUNNING */ + mci->op_state = OP_RUNNING_POLL; + +- edac_mc_workq_setup(mci, edac_mc_get_poll_msec()); ++ edac_mc_workq_setup(mci, edac_mc_get_poll_msec(), true); + } else { + mci->op_state = OP_RUNNING_INTERRUPT; + } +diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c +index c4d700a577d2..88cd940ece63 100644 +--- a/drivers/edac/edac_mc_sysfs.c ++++ b/drivers/edac/edac_mc_sysfs.c +@@ -52,16 +52,20 @@ int edac_mc_get_poll_msec(void) + + static int edac_set_poll_msec(const char *val, struct kernel_param *kp) + { +- long l; ++ unsigned long l; + int ret; + + if (!val) + return -EINVAL; + +- ret = strict_strtol(val, 0, &l); +- if (ret == -EINVAL || ((int)l != l)) ++ ret = kstrtoul(val, 0, &l); ++ if (ret) ++ return ret; ++ ++ if (l < 1000) + return -EINVAL; +- *((int *)kp->arg) = l; ++ ++ *((unsigned long *)kp->arg) = l; + + /* notify edac_mc engine to reset the poll period */ + edac_mc_reset_delay_period(l); +diff --git a/drivers/edac/edac_module.h b/drivers/edac/edac_module.h +index 3d139c6e7fe3..f2118bfcf8df 100644 +--- a/drivers/edac/edac_module.h ++++ b/drivers/edac/edac_module.h +@@ -52,7 +52,7 @@ extern void edac_device_workq_setup(struct edac_device_ctl_info *edac_dev, + extern void edac_device_workq_teardown(struct edac_device_ctl_info *edac_dev); + extern void edac_device_reset_delay_period(struct edac_device_ctl_info + *edac_dev, unsigned long value); +-extern void edac_mc_reset_delay_period(int value); ++extern void edac_mc_reset_delay_period(unsigned long value); + + extern void *edac_align_ptr(void **p, unsigned size, int n_elems); + +diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c +index 1b8c3707bf42..4cf21ec1abe3 100644 +--- a/drivers/gpu/drm/radeon/r600.c ++++ b/drivers/gpu/drm/radeon/r600.c +@@ -4509,6 +4509,10 @@ restart_ih: + break; + } + break; ++ case 124: /* UVD */ ++ DRM_DEBUG("IH: UVD int: 0x%08x\n", src_data); ++ radeon_fence_process(rdev, R600_RING_TYPE_UVD_INDEX); ++ break; + case 176: /* CP_INT in ring buffer */ + case 177: /* CP_INT in IB1 */ + case 178: /* CP_INT in IB2 */ +diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c +index 3cf38ff09e70..03add5d5542e 100644 +--- a/drivers/gpu/drm/radeon/si.c ++++ b/drivers/gpu/drm/radeon/si.c +@@ -5159,6 +5159,10 @@ restart_ih: + break; + } + break; ++ case 124: /* UVD */ ++ DRM_DEBUG("IH: UVD int: 0x%08x\n", src_data); ++ radeon_fence_process(rdev, R600_RING_TYPE_UVD_INDEX); ++ break; + case 146: + case 147: + dev_err(rdev->dev, "GPU fault detected: %d 0x%08x\n", src_id, src_data); +diff --git a/drivers/hv/connection.c b/drivers/hv/connection.c +index 253a74ba245c..d4fac934b220 100644 +--- a/drivers/hv/connection.c ++++ b/drivers/hv/connection.c +@@ -67,7 +67,6 @@ static int vmbus_negotiate_version(struct vmbus_channel_msginfo *msginfo, + int ret = 0; + struct vmbus_channel_initiate_contact *msg; + unsigned long flags; +- int t; + + init_completion(&msginfo->waitevent); + +@@ -102,15 +101,7 @@ static int vmbus_negotiate_version(struct vmbus_channel_msginfo *msginfo, + } + + /* Wait for the connection response */ +- t = wait_for_completion_timeout(&msginfo->waitevent, 5*HZ); +- if (t == 0) { +- spin_lock_irqsave(&vmbus_connection.channelmsg_lock, +- flags); +- list_del(&msginfo->msglistentry); +- spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, +- flags); +- return -ETIMEDOUT; +- } ++ wait_for_completion(&msginfo->waitevent); + + spin_lock_irqsave(&vmbus_connection.channelmsg_lock, flags); + list_del(&msginfo->msglistentry); +diff --git a/drivers/hwmon/ntc_thermistor.c b/drivers/hwmon/ntc_thermistor.c +index d6d640a733d5..9297164a23a5 100644 +--- a/drivers/hwmon/ntc_thermistor.c ++++ b/drivers/hwmon/ntc_thermistor.c +@@ -145,7 +145,7 @@ struct ntc_data { + static int ntc_adc_iio_read(struct ntc_thermistor_platform_data *pdata) + { + struct iio_channel *channel = pdata->chan; +- unsigned int result; ++ s64 result; + int val, ret; + + ret = iio_read_channel_raw(channel, &val); +@@ -155,10 +155,10 @@ static int ntc_adc_iio_read(struct ntc_thermistor_platform_data *pdata) + } + + /* unit: mV */ +- result = pdata->pullup_uv * val; ++ result = pdata->pullup_uv * (s64) val; + result >>= 12; + +- return result; ++ return (int)result; + } + + static const struct of_device_id ntc_match[] = { +diff --git a/drivers/iio/imu/adis16400.h b/drivers/iio/imu/adis16400.h +index 2f8f9d632386..0916bf6b6c31 100644 +--- a/drivers/iio/imu/adis16400.h ++++ b/drivers/iio/imu/adis16400.h +@@ -189,6 +189,7 @@ enum { + ADIS16300_SCAN_INCLI_X, + ADIS16300_SCAN_INCLI_Y, + ADIS16400_SCAN_ADC, ++ ADIS16400_SCAN_TIMESTAMP, + }; + + #ifdef CONFIG_IIO_BUFFER +diff --git a/drivers/iio/imu/adis16400_core.c b/drivers/iio/imu/adis16400_core.c +index e58c529aacdf..d6ece2d17dec 100644 +--- a/drivers/iio/imu/adis16400_core.c ++++ b/drivers/iio/imu/adis16400_core.c +@@ -632,7 +632,7 @@ static const struct iio_chan_spec adis16400_channels[] = { + ADIS16400_MAGN_CHAN(Z, ADIS16400_ZMAGN_OUT, 14), + ADIS16400_TEMP_CHAN(ADIS16400_TEMP_OUT, 12), + ADIS16400_AUX_ADC_CHAN(ADIS16400_AUX_ADC, 12), +- IIO_CHAN_SOFT_TIMESTAMP(12) ++ IIO_CHAN_SOFT_TIMESTAMP(ADIS16400_SCAN_TIMESTAMP), + }; + + static const struct iio_chan_spec adis16448_channels[] = { +@@ -659,7 +659,7 @@ static const struct iio_chan_spec adis16448_channels[] = { + }, + }, + ADIS16400_TEMP_CHAN(ADIS16448_TEMP_OUT, 12), +- IIO_CHAN_SOFT_TIMESTAMP(11) ++ IIO_CHAN_SOFT_TIMESTAMP(ADIS16400_SCAN_TIMESTAMP), + }; + + static const struct iio_chan_spec adis16350_channels[] = { +@@ -677,7 +677,7 @@ static const struct iio_chan_spec adis16350_channels[] = { + ADIS16400_MOD_TEMP_CHAN(X, ADIS16350_XTEMP_OUT, 12), + ADIS16400_MOD_TEMP_CHAN(Y, ADIS16350_YTEMP_OUT, 12), + ADIS16400_MOD_TEMP_CHAN(Z, ADIS16350_ZTEMP_OUT, 12), +- IIO_CHAN_SOFT_TIMESTAMP(11) ++ IIO_CHAN_SOFT_TIMESTAMP(ADIS16400_SCAN_TIMESTAMP), + }; + + static const struct iio_chan_spec adis16300_channels[] = { +@@ -690,7 +690,7 @@ static const struct iio_chan_spec adis16300_channels[] = { + ADIS16400_AUX_ADC_CHAN(ADIS16300_AUX_ADC, 12), + ADIS16400_INCLI_CHAN(X, ADIS16300_PITCH_OUT, 13), + ADIS16400_INCLI_CHAN(Y, ADIS16300_ROLL_OUT, 13), +- IIO_CHAN_SOFT_TIMESTAMP(14) ++ IIO_CHAN_SOFT_TIMESTAMP(ADIS16400_SCAN_TIMESTAMP), + }; + + static const struct iio_chan_spec adis16334_channels[] = { +@@ -701,7 +701,7 @@ static const struct iio_chan_spec adis16334_channels[] = { + ADIS16400_ACCEL_CHAN(Y, ADIS16400_YACCL_OUT, 14), + ADIS16400_ACCEL_CHAN(Z, ADIS16400_ZACCL_OUT, 14), + ADIS16400_TEMP_CHAN(ADIS16350_XTEMP_OUT, 12), +- IIO_CHAN_SOFT_TIMESTAMP(8) ++ IIO_CHAN_SOFT_TIMESTAMP(ADIS16400_SCAN_TIMESTAMP), + }; + + static struct attribute *adis16400_attributes[] = { +diff --git a/drivers/infiniband/hw/qib/qib_iba7322.c b/drivers/infiniband/hw/qib/qib_iba7322.c +index bd8cb0f89ef1..14103ffb4839 100644 +--- a/drivers/infiniband/hw/qib/qib_iba7322.c ++++ b/drivers/infiniband/hw/qib/qib_iba7322.c +@@ -2287,6 +2287,11 @@ static int qib_7322_bringup_serdes(struct qib_pportdata *ppd) + qib_write_kreg_port(ppd, krp_ibcctrl_a, ppd->cpspec->ibcctrl_a); + qib_write_kreg(dd, kr_scratch, 0ULL); + ++ /* ensure previous Tx parameters are not still forced */ ++ qib_write_kreg_port(ppd, krp_tx_deemph_override, ++ SYM_MASK(IBSD_TX_DEEMPHASIS_OVERRIDE_0, ++ reset_tx_deemphasis_override)); ++ + if (qib_compat_ddr_negotiate) { + ppd->cpspec->ibdeltainprog = 1; + ppd->cpspec->ibsymsnap = read_7322_creg32_port(ppd, +diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c +index afaa5d425e9a..e73740b55aea 100644 +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -1854,11 +1854,15 @@ static int process_checks(struct r1bio *r1_bio) + for (i = 0; i < conf->raid_disks * 2; i++) { + int j; + int size; ++ int uptodate; + struct bio *b = r1_bio->bios[i]; + if (b->bi_end_io != end_sync_read) + continue; +- /* fixup the bio for reuse */ ++ /* fixup the bio for reuse, but preserve BIO_UPTODATE */ ++ uptodate = test_bit(BIO_UPTODATE, &b->bi_flags); + bio_reset(b); ++ if (!uptodate) ++ clear_bit(BIO_UPTODATE, &b->bi_flags); + b->bi_vcnt = vcnt; + b->bi_size = r1_bio->sectors << 9; + b->bi_sector = r1_bio->sector + +@@ -1891,11 +1895,14 @@ static int process_checks(struct r1bio *r1_bio) + int j; + struct bio *pbio = r1_bio->bios[primary]; + struct bio *sbio = r1_bio->bios[i]; ++ int uptodate = test_bit(BIO_UPTODATE, &sbio->bi_flags); + + if (sbio->bi_end_io != end_sync_read) + continue; ++ /* Now we can 'fixup' the BIO_UPTODATE flag */ ++ set_bit(BIO_UPTODATE, &sbio->bi_flags); + +- if (test_bit(BIO_UPTODATE, &sbio->bi_flags)) { ++ if (uptodate) { + for (j = vcnt; j-- ; ) { + struct page *p, *s; + p = pbio->bi_io_vec[j].bv_page; +@@ -1910,7 +1917,7 @@ static int process_checks(struct r1bio *r1_bio) + if (j >= 0) + atomic64_add(r1_bio->sectors, &mddev->resync_mismatches); + if (j < 0 || (test_bit(MD_RECOVERY_CHECK, &mddev->recovery) +- && test_bit(BIO_UPTODATE, &sbio->bi_flags))) { ++ && uptodate)) { + /* No need to write to this device. */ + sbio->bi_end_io = NULL; + rdev_dec_pending(conf->mirrors[i].rdev, mddev); +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index 740e3f42bef8..5e3c25d4562c 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -5037,23 +5037,43 @@ raid5_size(struct mddev *mddev, sector_t sectors, int raid_disks) + return sectors * (raid_disks - conf->max_degraded); + } + ++static void free_scratch_buffer(struct r5conf *conf, struct raid5_percpu *percpu) ++{ ++ safe_put_page(percpu->spare_page); ++ kfree(percpu->scribble); ++ percpu->spare_page = NULL; ++ percpu->scribble = NULL; ++} ++ ++static int alloc_scratch_buffer(struct r5conf *conf, struct raid5_percpu *percpu) ++{ ++ if (conf->level == 6 && !percpu->spare_page) ++ percpu->spare_page = alloc_page(GFP_KERNEL); ++ if (!percpu->scribble) ++ percpu->scribble = kmalloc(conf->scribble_len, GFP_KERNEL); ++ ++ if (!percpu->scribble || (conf->level == 6 && !percpu->spare_page)) { ++ free_scratch_buffer(conf, percpu); ++ return -ENOMEM; ++ } ++ ++ return 0; ++} ++ + static void raid5_free_percpu(struct r5conf *conf) + { +- struct raid5_percpu *percpu; + unsigned long cpu; + + if (!conf->percpu) + return; + +- get_online_cpus(); +- for_each_possible_cpu(cpu) { +- percpu = per_cpu_ptr(conf->percpu, cpu); +- safe_put_page(percpu->spare_page); +- kfree(percpu->scribble); +- } + #ifdef CONFIG_HOTPLUG_CPU + unregister_cpu_notifier(&conf->cpu_notify); + #endif ++ ++ get_online_cpus(); ++ for_each_possible_cpu(cpu) ++ free_scratch_buffer(conf, per_cpu_ptr(conf->percpu, cpu)); + put_online_cpus(); + + free_percpu(conf->percpu); +@@ -5079,15 +5099,7 @@ static int raid456_cpu_notify(struct notifier_block *nfb, unsigned long action, + switch (action) { + case CPU_UP_PREPARE: + case CPU_UP_PREPARE_FROZEN: +- if (conf->level == 6 && !percpu->spare_page) +- percpu->spare_page = alloc_page(GFP_KERNEL); +- if (!percpu->scribble) +- percpu->scribble = kmalloc(conf->scribble_len, GFP_KERNEL); +- +- if (!percpu->scribble || +- (conf->level == 6 && !percpu->spare_page)) { +- safe_put_page(percpu->spare_page); +- kfree(percpu->scribble); ++ if (alloc_scratch_buffer(conf, percpu)) { + pr_err("%s: failed memory allocation for cpu%ld\n", + __func__, cpu); + return notifier_from_errno(-ENOMEM); +@@ -5095,10 +5107,7 @@ static int raid456_cpu_notify(struct notifier_block *nfb, unsigned long action, + break; + case CPU_DEAD: + case CPU_DEAD_FROZEN: +- safe_put_page(percpu->spare_page); +- kfree(percpu->scribble); +- percpu->spare_page = NULL; +- percpu->scribble = NULL; ++ free_scratch_buffer(conf, per_cpu_ptr(conf->percpu, cpu)); + break; + default: + break; +@@ -5110,40 +5119,29 @@ static int raid456_cpu_notify(struct notifier_block *nfb, unsigned long action, + static int raid5_alloc_percpu(struct r5conf *conf) + { + unsigned long cpu; +- struct page *spare_page; +- struct raid5_percpu __percpu *allcpus; +- void *scribble; +- int err; ++ int err = 0; + +- allcpus = alloc_percpu(struct raid5_percpu); +- if (!allcpus) ++ conf->percpu = alloc_percpu(struct raid5_percpu); ++ if (!conf->percpu) + return -ENOMEM; +- conf->percpu = allcpus; ++ ++#ifdef CONFIG_HOTPLUG_CPU ++ conf->cpu_notify.notifier_call = raid456_cpu_notify; ++ conf->cpu_notify.priority = 0; ++ err = register_cpu_notifier(&conf->cpu_notify); ++ if (err) ++ return err; ++#endif + + get_online_cpus(); +- err = 0; + for_each_present_cpu(cpu) { +- if (conf->level == 6) { +- spare_page = alloc_page(GFP_KERNEL); +- if (!spare_page) { +- err = -ENOMEM; +- break; +- } +- per_cpu_ptr(conf->percpu, cpu)->spare_page = spare_page; +- } +- scribble = kmalloc(conf->scribble_len, GFP_KERNEL); +- if (!scribble) { +- err = -ENOMEM; ++ err = alloc_scratch_buffer(conf, per_cpu_ptr(conf->percpu, cpu)); ++ if (err) { ++ pr_err("%s: failed memory allocation for cpu%ld\n", ++ __func__, cpu); + break; + } +- per_cpu_ptr(conf->percpu, cpu)->scribble = scribble; + } +-#ifdef CONFIG_HOTPLUG_CPU +- conf->cpu_notify.notifier_call = raid456_cpu_notify; +- conf->cpu_notify.priority = 0; +- if (err == 0) +- err = register_cpu_notifier(&conf->cpu_notify); +-#endif + put_online_cpus(); + + return err; +diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c +index e310ca6ed1a3..957fb36c7eb3 100644 +--- a/drivers/misc/mei/client.c ++++ b/drivers/misc/mei/client.c +@@ -799,7 +799,6 @@ void mei_cl_all_disconnect(struct mei_device *dev) + list_for_each_entry_safe(cl, next, &dev->file_list, link) { + cl->state = MEI_FILE_DISCONNECTED; + cl->mei_flow_ctrl_creds = 0; +- cl->read_cb = NULL; + cl->timer_count = 0; + } + } +@@ -829,8 +828,16 @@ void mei_cl_all_read_wakeup(struct mei_device *dev) + void mei_cl_all_write_clear(struct mei_device *dev) + { + struct mei_cl_cb *cb, *next; ++ struct list_head *list; + +- list_for_each_entry_safe(cb, next, &dev->write_list.list, list) { ++ list = &dev->write_list.list; ++ list_for_each_entry_safe(cb, next, list, list) { ++ list_del(&cb->list); ++ mei_io_cb_free(cb); ++ } ++ ++ list = &dev->write_waiting_list.list; ++ list_for_each_entry_safe(cb, next, list, list) { + list_del(&cb->list); + mei_io_cb_free(cb); + } +diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireless/ath/ar5523/ar5523.c +index 17d7fece35d2..57fc06e0f434 100644 +--- a/drivers/net/wireless/ath/ar5523/ar5523.c ++++ b/drivers/net/wireless/ath/ar5523/ar5523.c +@@ -1764,7 +1764,7 @@ static struct usb_device_id ar5523_id_table[] = { + AR5523_DEVICE_UX(0x2001, 0x3a04), /* Dlink / DWLAG122 */ + AR5523_DEVICE_UG(0x1690, 0x0712), /* Gigaset / AR5523 */ + AR5523_DEVICE_UG(0x1690, 0x0710), /* Gigaset / SMCWUSBTG */ +- AR5523_DEVICE_UG(0x129b, 0x160c), /* Gigaset / USB stick 108 ++ AR5523_DEVICE_UG(0x129b, 0x160b), /* Gigaset / USB stick 108 + (CyberTAN Technology) */ + AR5523_DEVICE_UG(0x16ab, 0x7801), /* Globalsun / AR5523_1 */ + AR5523_DEVICE_UX(0x16ab, 0x7811), /* Globalsun / AR5523_2 */ +diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c +index 21e7edc7207c..04b3822ef93a 100644 +--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c ++++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c +@@ -1331,21 +1331,22 @@ static void ath9k_htc_sta_rc_update(struct ieee80211_hw *hw, + struct ath_common *common = ath9k_hw_common(priv->ah); + struct ath9k_htc_target_rate trate; + ++ if (!(changed & IEEE80211_RC_SUPP_RATES_CHANGED)) ++ return; ++ + mutex_lock(&priv->mutex); + ath9k_htc_ps_wakeup(priv); + +- if (changed & IEEE80211_RC_SUPP_RATES_CHANGED) { +- memset(&trate, 0, sizeof(struct ath9k_htc_target_rate)); +- ath9k_htc_setup_rate(priv, sta, &trate); +- if (!ath9k_htc_send_rate_cmd(priv, &trate)) +- ath_dbg(common, CONFIG, +- "Supported rates for sta: %pM updated, rate caps: 0x%X\n", +- sta->addr, be32_to_cpu(trate.capflags)); +- else +- ath_dbg(common, CONFIG, +- "Unable to update supported rates for sta: %pM\n", +- sta->addr); +- } ++ memset(&trate, 0, sizeof(struct ath9k_htc_target_rate)); ++ ath9k_htc_setup_rate(priv, sta, &trate); ++ if (!ath9k_htc_send_rate_cmd(priv, &trate)) ++ ath_dbg(common, CONFIG, ++ "Supported rates for sta: %pM updated, rate caps: 0x%X\n", ++ sta->addr, be32_to_cpu(trate.capflags)); ++ else ++ ath_dbg(common, CONFIG, ++ "Unable to update supported rates for sta: %pM\n", ++ sta->addr); + + ath9k_htc_ps_restore(priv); + mutex_unlock(&priv->mutex); +diff --git a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c +index 6199a0a597a6..a7cf535216c9 100644 +--- a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c ++++ b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c +@@ -180,6 +180,11 @@ static int iwl_init_channel_map(struct device *dev, const struct iwl_cfg *cfg, + + for (ch_idx = 0; ch_idx < IWL_NUM_CHANNELS; ch_idx++) { + ch_flags = __le16_to_cpup(nvm_ch_flags + ch_idx); ++ ++ if (ch_idx >= NUM_2GHZ_CHANNELS && ++ !data->sku_cap_band_52GHz_enable) ++ ch_flags &= ~NVM_CHANNEL_VALID; ++ + if (!(ch_flags & NVM_CHANNEL_VALID)) { + IWL_DEBUG_EEPROM(dev, + "Ch. %d Flags %x [%sGHz] - No traffic\n", +diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c +index 8e1f6c095a9e..b987dfb879df 100644 +--- a/drivers/net/wireless/iwlwifi/mvm/scan.c ++++ b/drivers/net/wireless/iwlwifi/mvm/scan.c +@@ -313,7 +313,8 @@ int iwl_mvm_scan_request(struct iwl_mvm *mvm, + + iwl_mvm_scan_fill_ssids(cmd, req); + +- cmd->tx_cmd.tx_flags = cpu_to_le32(TX_CMD_FLG_SEQ_CTL); ++ cmd->tx_cmd.tx_flags = cpu_to_le32(TX_CMD_FLG_SEQ_CTL | ++ TX_CMD_FLG_BT_DIS); + cmd->tx_cmd.sta_id = mvm->aux_sta.sta_id; + cmd->tx_cmd.life_time = cpu_to_le32(TX_CMD_LIFE_TIME_INFINITE); + cmd->tx_cmd.rate_n_flags = +diff --git a/drivers/net/wireless/iwlwifi/mvm/utils.c b/drivers/net/wireless/iwlwifi/mvm/utils.c +index 687b34e387ac..0d9e08160fec 100644 +--- a/drivers/net/wireless/iwlwifi/mvm/utils.c ++++ b/drivers/net/wireless/iwlwifi/mvm/utils.c +@@ -401,6 +401,8 @@ void iwl_mvm_dump_nic_error_log(struct iwl_mvm *mvm) + mvm->status, table.valid); + } + ++ IWL_ERR(mvm, "Loaded firmware version: %s\n", mvm->fw->fw_version); ++ + trace_iwlwifi_dev_ucode_error(trans->dev, table.error_id, table.tsf_low, + table.data1, table.data2, table.data3, + table.blink1, table.blink2, table.ilink1, +diff --git a/drivers/of/address.c b/drivers/of/address.c +index 9e69b4f0d204..00bc55cc821c 100644 +--- a/drivers/of/address.c ++++ b/drivers/of/address.c +@@ -99,11 +99,12 @@ static unsigned int of_bus_default_get_flags(const __be32 *addr) + static int of_bus_pci_match(struct device_node *np) + { + /* ++ * "pciex" is PCI Express + * "vci" is for the /chaos bridge on 1st-gen PCI powermacs + * "ht" is hypertransport + */ +- return !strcmp(np->type, "pci") || !strcmp(np->type, "vci") || +- !strcmp(np->type, "ht"); ++ return !strcmp(np->type, "pci") || !strcmp(np->type, "pciex") || ++ !strcmp(np->type, "vci") || !strcmp(np->type, "ht"); + } + + static void of_bus_pci_count_cells(struct device_node *np, +diff --git a/drivers/power/max17040_battery.c b/drivers/power/max17040_battery.c +index c7ff6d67f158..0fbac861080d 100644 +--- a/drivers/power/max17040_battery.c ++++ b/drivers/power/max17040_battery.c +@@ -148,7 +148,7 @@ static void max17040_get_online(struct i2c_client *client) + { + struct max17040_chip *chip = i2c_get_clientdata(client); + +- if (chip->pdata->battery_online) ++ if (chip->pdata && chip->pdata->battery_online) + chip->online = chip->pdata->battery_online(); + else + chip->online = 1; +@@ -158,7 +158,8 @@ static void max17040_get_status(struct i2c_client *client) + { + struct max17040_chip *chip = i2c_get_clientdata(client); + +- if (!chip->pdata->charger_online || !chip->pdata->charger_enable) { ++ if (!chip->pdata || !chip->pdata->charger_online ++ || !chip->pdata->charger_enable) { + chip->status = POWER_SUPPLY_STATUS_UNKNOWN; + return; + } +diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c +index ca99ac9295cf..32b7bb111eb6 100644 +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -584,9 +584,7 @@ static void spi_pump_messages(struct kthread_work *work) + ret = master->transfer_one_message(master, master->cur_msg); + if (ret) { + dev_err(&master->dev, +- "failed to transfer one message from queue: %d\n", ret); +- master->cur_msg->status = ret; +- spi_finalize_current_message(master); ++ "failed to transfer one message from queue\n"); + return; + } + } +diff --git a/drivers/staging/comedi/drivers/adv_pci1710.c b/drivers/staging/comedi/drivers/adv_pci1710.c +index f847bbc175e7..acb66a9513cf 100644 +--- a/drivers/staging/comedi/drivers/adv_pci1710.c ++++ b/drivers/staging/comedi/drivers/adv_pci1710.c +@@ -489,6 +489,7 @@ static int pci171x_insn_write_ao(struct comedi_device *dev, + struct comedi_insn *insn, unsigned int *data) + { + struct pci1710_private *devpriv = dev->private; ++ unsigned int val; + int n, chan, range, ofs; + + chan = CR_CHAN(insn->chanspec); +@@ -504,11 +505,14 @@ static int pci171x_insn_write_ao(struct comedi_device *dev, + outw(devpriv->da_ranges, dev->iobase + PCI171x_DAREF); + ofs = PCI171x_DA1; + } ++ val = devpriv->ao_data[chan]; + +- for (n = 0; n < insn->n; n++) +- outw(data[n], dev->iobase + ofs); ++ for (n = 0; n < insn->n; n++) { ++ val = data[n]; ++ outw(val, dev->iobase + ofs); ++ } + +- devpriv->ao_data[chan] = data[n]; ++ devpriv->ao_data[chan] = val; + + return n; + +@@ -678,6 +682,7 @@ static int pci1720_insn_write_ao(struct comedi_device *dev, + struct comedi_insn *insn, unsigned int *data) + { + struct pci1710_private *devpriv = dev->private; ++ unsigned int val; + int n, rangereg, chan; + + chan = CR_CHAN(insn->chanspec); +@@ -687,13 +692,15 @@ static int pci1720_insn_write_ao(struct comedi_device *dev, + outb(rangereg, dev->iobase + PCI1720_RANGE); + devpriv->da_ranges = rangereg; + } ++ val = devpriv->ao_data[chan]; + + for (n = 0; n < insn->n; n++) { +- outw(data[n], dev->iobase + PCI1720_DA0 + (chan << 1)); ++ val = data[n]; ++ outw(val, dev->iobase + PCI1720_DA0 + (chan << 1)); + outb(0, dev->iobase + PCI1720_SYNCOUT); /* update outputs */ + } + +- devpriv->ao_data[chan] = data[n]; ++ devpriv->ao_data[chan] = val; + + return n; + } +diff --git a/drivers/staging/iio/adc/ad799x_core.c b/drivers/staging/iio/adc/ad799x_core.c +index 8dc97b36e05a..b0cb2de93050 100644 +--- a/drivers/staging/iio/adc/ad799x_core.c ++++ b/drivers/staging/iio/adc/ad799x_core.c +@@ -644,7 +644,8 @@ static int ad799x_probe(struct i2c_client *client, + return 0; + + error_free_irq: +- free_irq(client->irq, indio_dev); ++ if (client->irq > 0) ++ free_irq(client->irq, indio_dev); + error_cleanup_ring: + ad799x_ring_cleanup(indio_dev); + error_disable_reg: +diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c +index 642239015b46..3ee7217e25b2 100644 +--- a/drivers/tty/n_gsm.c ++++ b/drivers/tty/n_gsm.c +@@ -1089,6 +1089,7 @@ static void gsm_control_modem(struct gsm_mux *gsm, u8 *data, int clen) + { + unsigned int addr = 0; + unsigned int modem = 0; ++ unsigned int brk = 0; + struct gsm_dlci *dlci; + int len = clen; + u8 *dp = data; +@@ -1115,6 +1116,16 @@ static void gsm_control_modem(struct gsm_mux *gsm, u8 *data, int clen) + if (len == 0) + return; + } ++ len--; ++ if (len > 0) { ++ while (gsm_read_ea(&brk, *dp++) == 0) { ++ len--; ++ if (len == 0) ++ return; ++ } ++ modem <<= 7; ++ modem |= (brk & 0x7f); ++ } + tty = tty_port_tty_get(&dlci->port); + gsm_process_modem(tty, dlci, modem, clen); + if (tty) { +diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c +index 740202d8a5c4..0d1b3757cfb6 100644 +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -1164,6 +1164,8 @@ static void csi_J(struct vc_data *vc, int vpar) + scr_memsetw(vc->vc_screenbuf, vc->vc_video_erase_char, + vc->vc_screenbuf_size >> 1); + set_origin(vc); ++ if (CON_IS_VISIBLE(vc)) ++ update_screen(vc); + /* fall through */ + case 2: /* erase whole display */ + count = vc->vc_cols * vc->vc_rows; +diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c +index d3aa353908aa..d53547d2e4c7 100644 +--- a/drivers/usb/core/hcd.c ++++ b/drivers/usb/core/hcd.c +@@ -1010,7 +1010,6 @@ static int register_root_hub(struct usb_hcd *hcd) + dev_name(&usb_dev->dev), retval); + return retval; + } +- usb_dev->lpm_capable = usb_device_supports_lpm(usb_dev); + } + + retval = usb_new_device (usb_dev); +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index e604645a1290..3a2eb4cc8959 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -135,7 +135,7 @@ struct usb_hub *usb_hub_to_struct_hub(struct usb_device *hdev) + return usb_get_intfdata(hdev->actconfig->interface[0]); + } + +-int usb_device_supports_lpm(struct usb_device *udev) ++static int usb_device_supports_lpm(struct usb_device *udev) + { + /* USB 2.1 (and greater) devices indicate LPM support through + * their USB 2.0 Extended Capabilities BOS descriptor. +@@ -156,11 +156,6 @@ int usb_device_supports_lpm(struct usb_device *udev) + "Power management will be impacted.\n"); + return 0; + } +- +- /* udev is root hub */ +- if (!udev->parent) +- return 1; +- + if (udev->parent->lpm_capable) + return 1; + +diff --git a/drivers/usb/core/usb.h b/drivers/usb/core/usb.h +index c49383669cd8..823857767a16 100644 +--- a/drivers/usb/core/usb.h ++++ b/drivers/usb/core/usb.h +@@ -35,7 +35,6 @@ extern int usb_get_device_descriptor(struct usb_device *dev, + unsigned int size); + extern int usb_get_bos_descriptor(struct usb_device *dev); + extern void usb_release_bos_descriptor(struct usb_device *dev); +-extern int usb_device_supports_lpm(struct usb_device *udev); + extern char *usb_cache_string(struct usb_device *udev, int index); + extern int usb_set_configuration(struct usb_device *dev, int configuration); + extern int usb_choose_configuration(struct usb_device *udev); +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index 089248c1d597..b7446a69d2a9 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -155,6 +155,7 @@ static struct usb_device_id id_table_combined [] = { + { USB_DEVICE(FTDI_VID, FTDI_CANUSB_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_CANDAPTER_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_NXTCAM_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_EV3CON_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_0_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_1_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_2_PID) }, +@@ -194,6 +195,8 @@ static struct usb_device_id id_table_combined [] = { + { USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_IOBOARD_PID) }, + { USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_MINI_IOBOARD_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_SPROG_II) }, ++ { USB_DEVICE(FTDI_VID, FTDI_TAGSYS_LP101_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_TAGSYS_P200X_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_LENZ_LIUSB_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_XF_632_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_XF_634_PID) }, +diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h +index a7019d1e3058..1e2d369df86e 100644 +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -50,6 +50,7 @@ + #define TI_XDS100V2_PID 0xa6d0 + + #define FTDI_NXTCAM_PID 0xABB8 /* NXTCam for Mindstorms NXT */ ++#define FTDI_EV3CON_PID 0xABB9 /* Mindstorms EV3 Console Adapter */ + + /* US Interface Navigator (http://www.usinterface.com/) */ + #define FTDI_USINT_CAT_PID 0xb810 /* Navigator CAT and 2nd PTT lines */ +@@ -363,6 +364,12 @@ + /* Sprog II (Andrew Crosland's SprogII DCC interface) */ + #define FTDI_SPROG_II 0xF0C8 + ++/* ++ * Two of the Tagsys RFID Readers ++ */ ++#define FTDI_TAGSYS_LP101_PID 0xF0E9 /* Tagsys L-P101 RFID*/ ++#define FTDI_TAGSYS_P200X_PID 0xF0EE /* Tagsys Medio P200x RFID*/ ++ + /* an infrared receiver for user access control with IR tags */ + #define FTDI_PIEGROUP_PID 0xF208 /* Product Id */ + +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 5c86f57e4afa..216d20affba8 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1362,7 +1362,8 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1267, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1268, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1269, 0xff, 0xff, 0xff) }, +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1270, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1270, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&net_intf5_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1271, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1272, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1273, 0xff, 0xff, 0xff) }, +diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c +index c65437cfd4a2..968a40201e5f 100644 +--- a/drivers/usb/serial/qcserial.c ++++ b/drivers/usb/serial/qcserial.c +@@ -139,6 +139,9 @@ static const struct usb_device_id id_table[] = { + {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x901c, 0)}, /* Sierra Wireless EM7700 Device Management */ + {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x901c, 2)}, /* Sierra Wireless EM7700 NMEA */ + {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x901c, 3)}, /* Sierra Wireless EM7700 Modem */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9051, 0)}, /* Netgear AirCard 340U Device Management */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9051, 2)}, /* Netgear AirCard 340U NMEA */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9051, 3)}, /* Netgear AirCard 340U Modem */ + + { } /* Terminating entry */ + }; +diff --git a/drivers/usb/storage/Kconfig b/drivers/usb/storage/Kconfig +index 8470e1b114f2..1dd0604d1911 100644 +--- a/drivers/usb/storage/Kconfig ++++ b/drivers/usb/storage/Kconfig +@@ -18,7 +18,9 @@ config USB_STORAGE + + This option depends on 'SCSI' support being enabled, but you + probably also need 'SCSI device support: SCSI disk support' +- (BLK_DEV_SD) for most USB storage devices. ++ (BLK_DEV_SD) for most USB storage devices. Some devices also ++ will require 'Probe all LUNs on each SCSI device' ++ (SCSI_MULTI_LUN). + + To compile this driver as a module, choose M here: the + module will be called usb-storage. +diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c +index 5db153260827..bb7bf198caab 100644 +--- a/drivers/usb/storage/scsiglue.c ++++ b/drivers/usb/storage/scsiglue.c +@@ -78,6 +78,8 @@ static const char* host_info(struct Scsi_Host *host) + + static int slave_alloc (struct scsi_device *sdev) + { ++ struct us_data *us = host_to_us(sdev->host); ++ + /* + * Set the INQUIRY transfer length to 36. We don't use any of + * the extra data and many devices choke if asked for more or +@@ -102,6 +104,10 @@ static int slave_alloc (struct scsi_device *sdev) + */ + blk_queue_update_dma_alignment(sdev->request_queue, (512 - 1)); + ++ /* Tell the SCSI layer if we know there is more than one LUN */ ++ if (us->protocol == USB_PR_BULK && us->max_lun > 0) ++ sdev->sdev_bflags |= BLIST_FORCELUN; ++ + return 0; + } + +diff --git a/drivers/usb/storage/unusual_cypress.h b/drivers/usb/storage/unusual_cypress.h +index 65a6a75066a8..82e8ed0324e3 100644 +--- a/drivers/usb/storage/unusual_cypress.h ++++ b/drivers/usb/storage/unusual_cypress.h +@@ -31,7 +31,7 @@ UNUSUAL_DEV( 0x04b4, 0x6831, 0x0000, 0x9999, + "Cypress ISD-300LP", + USB_SC_CYP_ATACB, USB_PR_DEVICE, NULL, 0), + +-UNUSUAL_DEV( 0x14cd, 0x6116, 0x0000, 0x0219, ++UNUSUAL_DEV( 0x14cd, 0x6116, 0x0160, 0x0160, + "Super Top", + "USB 2.0 SATA BRIDGE", + USB_SC_CYP_ATACB, USB_PR_DEVICE, NULL, 0), +diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h +index ad06255c2ade..adbeb255616a 100644 +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -1455,6 +1455,13 @@ UNUSUAL_DEV( 0x0f88, 0x042e, 0x0100, 0x0100, + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_FIX_CAPACITY ), + ++/* Reported by Moritz Moeller-Herrmann */ ++UNUSUAL_DEV( 0x0fca, 0x8004, 0x0201, 0x0201, ++ "Research In Motion", ++ "BlackBerry Bold 9000", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_MAX_SECTORS_64 ), ++ + /* Reported by Michael Stattmann */ + UNUSUAL_DEV( 0x0fce, 0xd008, 0x0000, 0x0000, + "Sony Ericsson", +diff --git a/drivers/vme/bridges/vme_ca91cx42.c b/drivers/vme/bridges/vme_ca91cx42.c +index 64bfea314429..8ca1030675a6 100644 +--- a/drivers/vme/bridges/vme_ca91cx42.c ++++ b/drivers/vme/bridges/vme_ca91cx42.c +@@ -880,7 +880,7 @@ static ssize_t ca91cx42_master_read(struct vme_master_resource *image, + if (done == count) + goto out; + } +- if ((uintptr_t)addr & 0x2) { ++ if ((uintptr_t)(addr + done) & 0x2) { + if ((count - done) < 2) { + *(u8 *)(buf + done) = ioread8(addr + done); + done += 1; +@@ -934,7 +934,7 @@ static ssize_t ca91cx42_master_write(struct vme_master_resource *image, + if (done == count) + goto out; + } +- if ((uintptr_t)addr & 0x2) { ++ if ((uintptr_t)(addr + done) & 0x2) { + if ((count - done) < 2) { + iowrite8(*(u8 *)(buf + done), addr + done); + done += 1; +diff --git a/drivers/vme/bridges/vme_tsi148.c b/drivers/vme/bridges/vme_tsi148.c +index 9c1aa4dc39c9..63424060b04f 100644 +--- a/drivers/vme/bridges/vme_tsi148.c ++++ b/drivers/vme/bridges/vme_tsi148.c +@@ -1283,7 +1283,7 @@ static ssize_t tsi148_master_read(struct vme_master_resource *image, void *buf, + if (done == count) + goto out; + } +- if ((uintptr_t)addr & 0x2) { ++ if ((uintptr_t)(addr + done) & 0x2) { + if ((count - done) < 2) { + *(u8 *)(buf + done) = ioread8(addr + done); + done += 1; +@@ -1365,7 +1365,7 @@ static ssize_t tsi148_master_write(struct vme_master_resource *image, void *buf, + if (done == count) + goto out; + } +- if ((uintptr_t)addr & 0x2) { ++ if ((uintptr_t)(addr + done) & 0x2) { + if ((count - done) < 2) { + iowrite8(*(u8 *)(buf + done), addr + done); + done += 1; +diff --git a/fs/bio-integrity.c b/fs/bio-integrity.c +index 45e944fe52a6..8dccf73025b3 100644 +--- a/fs/bio-integrity.c ++++ b/fs/bio-integrity.c +@@ -114,6 +114,14 @@ void bio_integrity_free(struct bio *bio) + } + EXPORT_SYMBOL(bio_integrity_free); + ++static inline unsigned int bip_integrity_vecs(struct bio_integrity_payload *bip) ++{ ++ if (bip->bip_slab == BIO_POOL_NONE) ++ return BIP_INLINE_VECS; ++ ++ return bvec_nr_vecs(bip->bip_slab); ++} ++ + /** + * bio_integrity_add_page - Attach integrity metadata + * @bio: bio to update +@@ -129,7 +137,7 @@ int bio_integrity_add_page(struct bio *bio, struct page *page, + struct bio_integrity_payload *bip = bio->bi_integrity; + struct bio_vec *iv; + +- if (bip->bip_vcnt >= bvec_nr_vecs(bip->bip_slab)) { ++ if (bip->bip_vcnt >= bip_integrity_vecs(bip)) { + printk(KERN_ERR "%s: bip_vec full\n", __func__); + return 0; + } +diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c +index 51f5e0ee7237..494b68349667 100644 +--- a/fs/cifs/cifsacl.c ++++ b/fs/cifs/cifsacl.c +@@ -1027,15 +1027,30 @@ id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64 nmode, + __u32 secdesclen = 0; + struct cifs_ntsd *pntsd = NULL; /* acl obtained from server */ + struct cifs_ntsd *pnntsd = NULL; /* modified acl to be sent to server */ ++ struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb); ++ struct tcon_link *tlink = cifs_sb_tlink(cifs_sb); ++ struct cifs_tcon *tcon; ++ ++ if (IS_ERR(tlink)) ++ return PTR_ERR(tlink); ++ tcon = tlink_tcon(tlink); + + cifs_dbg(NOISY, "set ACL from mode for %s\n", path); + + /* Get the security descriptor */ +- pntsd = get_cifs_acl(CIFS_SB(inode->i_sb), inode, path, &secdesclen); ++ ++ if (tcon->ses->server->ops->get_acl == NULL) { ++ cifs_put_tlink(tlink); ++ return -EOPNOTSUPP; ++ } ++ ++ pntsd = tcon->ses->server->ops->get_acl(cifs_sb, inode, path, ++ &secdesclen); + if (IS_ERR(pntsd)) { + rc = PTR_ERR(pntsd); + cifs_dbg(VFS, "%s: error %d getting sec desc\n", __func__, rc); +- goto out; ++ cifs_put_tlink(tlink); ++ return rc; + } + + /* +@@ -1048,6 +1063,7 @@ id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64 nmode, + pnntsd = kmalloc(secdesclen, GFP_KERNEL); + if (!pnntsd) { + kfree(pntsd); ++ cifs_put_tlink(tlink); + return -ENOMEM; + } + +@@ -1056,14 +1072,18 @@ id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64 nmode, + + cifs_dbg(NOISY, "build_sec_desc rc: %d\n", rc); + ++ if (tcon->ses->server->ops->set_acl == NULL) ++ rc = -EOPNOTSUPP; ++ + if (!rc) { + /* Set the security descriptor */ +- rc = set_cifs_acl(pnntsd, secdesclen, inode, path, aclflag); ++ rc = tcon->ses->server->ops->set_acl(pnntsd, secdesclen, inode, ++ path, aclflag); + cifs_dbg(NOISY, "set_cifs_acl rc: %d\n", rc); + } ++ cifs_put_tlink(tlink); + + kfree(pnntsd); + kfree(pntsd); +-out: + return rc; + } +diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h +index ea3a0b3018a5..e2c2d96491fa 100644 +--- a/fs/cifs/cifsglob.h ++++ b/fs/cifs/cifsglob.h +@@ -370,6 +370,16 @@ struct smb_version_operations { + void (*new_lease_key)(struct cifs_fid *fid); + int (*calc_signature)(struct smb_rqst *rqst, + struct TCP_Server_Info *server); ++ ssize_t (*query_all_EAs)(const unsigned int, struct cifs_tcon *, ++ const unsigned char *, const unsigned char *, char *, ++ size_t, const struct nls_table *, int); ++ int (*set_EA)(const unsigned int, struct cifs_tcon *, const char *, ++ const char *, const void *, const __u16, ++ const struct nls_table *, int); ++ struct cifs_ntsd * (*get_acl)(struct cifs_sb_info *, struct inode *, ++ const char *, u32 *); ++ int (*set_acl)(struct cifs_ntsd *, __u32, struct inode *, const char *, ++ int); + }; + + struct smb_version_values { +diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c +index 449b6cf09b09..9d463501348f 100644 +--- a/fs/cifs/inode.c ++++ b/fs/cifs/inode.c +@@ -490,10 +490,15 @@ static int cifs_sfu_mode(struct cifs_fattr *fattr, const unsigned char *path, + return PTR_ERR(tlink); + tcon = tlink_tcon(tlink); + +- rc = CIFSSMBQAllEAs(xid, tcon, path, "SETFILEBITS", +- ea_value, 4 /* size of buf */, cifs_sb->local_nls, +- cifs_sb->mnt_cifs_flags & +- CIFS_MOUNT_MAP_SPECIAL_CHR); ++ if (tcon->ses->server->ops->query_all_EAs == NULL) { ++ cifs_put_tlink(tlink); ++ return -EOPNOTSUPP; ++ } ++ ++ rc = tcon->ses->server->ops->query_all_EAs(xid, tcon, path, ++ "SETFILEBITS", ea_value, 4 /* size of buf */, ++ cifs_sb->local_nls, ++ cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR); + cifs_put_tlink(tlink); + if (rc < 0) + return (int)rc; +diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c +index 3efdb9d5c0b8..4885a40f3210 100644 +--- a/fs/cifs/smb1ops.c ++++ b/fs/cifs/smb1ops.c +@@ -948,6 +948,14 @@ struct smb_version_operations smb1_operations = { + .mand_lock = cifs_mand_lock, + .mand_unlock_range = cifs_unlock_range, + .push_mand_locks = cifs_push_mandatory_locks, ++#ifdef CONFIG_CIFS_XATTR ++ .query_all_EAs = CIFSSMBQAllEAs, ++ .set_EA = CIFSSMBSetEA, ++#endif /* CIFS_XATTR */ ++#ifdef CONFIG_CIFS_ACL ++ .get_acl = get_cifs_acl, ++ .set_acl = set_cifs_acl, ++#endif /* CIFS_ACL */ + }; + + struct smb_version_values smb1_values = { +diff --git a/fs/cifs/xattr.c b/fs/cifs/xattr.c +index 09afda4cc58e..5ac836a86b18 100644 +--- a/fs/cifs/xattr.c ++++ b/fs/cifs/xattr.c +@@ -82,9 +82,11 @@ int cifs_removexattr(struct dentry *direntry, const char *ea_name) + goto remove_ea_exit; + + ea_name += XATTR_USER_PREFIX_LEN; /* skip past user. prefix */ +- rc = CIFSSMBSetEA(xid, pTcon, full_path, ea_name, NULL, +- (__u16)0, cifs_sb->local_nls, +- cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR); ++ if (pTcon->ses->server->ops->set_EA) ++ rc = pTcon->ses->server->ops->set_EA(xid, pTcon, ++ full_path, ea_name, NULL, (__u16)0, ++ cifs_sb->local_nls, cifs_sb->mnt_cifs_flags & ++ CIFS_MOUNT_MAP_SPECIAL_CHR); + } + remove_ea_exit: + kfree(full_path); +@@ -149,18 +151,22 @@ int cifs_setxattr(struct dentry *direntry, const char *ea_name, + cifs_dbg(FYI, "attempt to set cifs inode metadata\n"); + + ea_name += XATTR_USER_PREFIX_LEN; /* skip past user. prefix */ +- rc = CIFSSMBSetEA(xid, pTcon, full_path, ea_name, ea_value, +- (__u16)value_size, cifs_sb->local_nls, +- cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR); ++ if (pTcon->ses->server->ops->set_EA) ++ rc = pTcon->ses->server->ops->set_EA(xid, pTcon, ++ full_path, ea_name, ea_value, (__u16)value_size, ++ cifs_sb->local_nls, cifs_sb->mnt_cifs_flags & ++ CIFS_MOUNT_MAP_SPECIAL_CHR); + } else if (strncmp(ea_name, XATTR_OS2_PREFIX, XATTR_OS2_PREFIX_LEN) + == 0) { + if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_XATTR) + goto set_ea_exit; + + ea_name += XATTR_OS2_PREFIX_LEN; /* skip past os2. prefix */ +- rc = CIFSSMBSetEA(xid, pTcon, full_path, ea_name, ea_value, +- (__u16)value_size, cifs_sb->local_nls, +- cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR); ++ if (pTcon->ses->server->ops->set_EA) ++ rc = pTcon->ses->server->ops->set_EA(xid, pTcon, ++ full_path, ea_name, ea_value, (__u16)value_size, ++ cifs_sb->local_nls, cifs_sb->mnt_cifs_flags & ++ CIFS_MOUNT_MAP_SPECIAL_CHR); + } else if (strncmp(ea_name, CIFS_XATTR_CIFS_ACL, + strlen(CIFS_XATTR_CIFS_ACL)) == 0) { + #ifdef CONFIG_CIFS_ACL +@@ -170,8 +176,12 @@ int cifs_setxattr(struct dentry *direntry, const char *ea_name, + rc = -ENOMEM; + } else { + memcpy(pacl, ea_value, value_size); +- rc = set_cifs_acl(pacl, value_size, +- direntry->d_inode, full_path, CIFS_ACL_DACL); ++ if (pTcon->ses->server->ops->set_acl) ++ rc = pTcon->ses->server->ops->set_acl(pacl, ++ value_size, direntry->d_inode, ++ full_path, CIFS_ACL_DACL); ++ else ++ rc = -EOPNOTSUPP; + if (rc == 0) /* force revalidate of the inode */ + CIFS_I(direntry->d_inode)->time = 0; + kfree(pacl); +@@ -272,17 +282,21 @@ ssize_t cifs_getxattr(struct dentry *direntry, const char *ea_name, + /* revalidate/getattr then populate from inode */ + } /* BB add else when above is implemented */ + ea_name += XATTR_USER_PREFIX_LEN; /* skip past user. prefix */ +- rc = CIFSSMBQAllEAs(xid, pTcon, full_path, ea_name, ea_value, +- buf_size, cifs_sb->local_nls, +- cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR); ++ if (pTcon->ses->server->ops->query_all_EAs) ++ rc = pTcon->ses->server->ops->query_all_EAs(xid, pTcon, ++ full_path, ea_name, ea_value, buf_size, ++ cifs_sb->local_nls, cifs_sb->mnt_cifs_flags & ++ CIFS_MOUNT_MAP_SPECIAL_CHR); + } else if (strncmp(ea_name, XATTR_OS2_PREFIX, XATTR_OS2_PREFIX_LEN) == 0) { + if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_XATTR) + goto get_ea_exit; + + ea_name += XATTR_OS2_PREFIX_LEN; /* skip past os2. prefix */ +- rc = CIFSSMBQAllEAs(xid, pTcon, full_path, ea_name, ea_value, +- buf_size, cifs_sb->local_nls, +- cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR); ++ if (pTcon->ses->server->ops->query_all_EAs) ++ rc = pTcon->ses->server->ops->query_all_EAs(xid, pTcon, ++ full_path, ea_name, ea_value, buf_size, ++ cifs_sb->local_nls, cifs_sb->mnt_cifs_flags & ++ CIFS_MOUNT_MAP_SPECIAL_CHR); + } else if (strncmp(ea_name, POSIX_ACL_XATTR_ACCESS, + strlen(POSIX_ACL_XATTR_ACCESS)) == 0) { + #ifdef CONFIG_CIFS_POSIX +@@ -313,8 +327,11 @@ ssize_t cifs_getxattr(struct dentry *direntry, const char *ea_name, + u32 acllen; + struct cifs_ntsd *pacl; + +- pacl = get_cifs_acl(cifs_sb, direntry->d_inode, +- full_path, &acllen); ++ if (pTcon->ses->server->ops->get_acl == NULL) ++ goto get_ea_exit; /* rc already EOPNOTSUPP */ ++ ++ pacl = pTcon->ses->server->ops->get_acl(cifs_sb, ++ direntry->d_inode, full_path, &acllen); + if (IS_ERR(pacl)) { + rc = PTR_ERR(pacl); + cifs_dbg(VFS, "%s: error %zd getting sec desc\n", +@@ -400,11 +417,12 @@ ssize_t cifs_listxattr(struct dentry *direntry, char *data, size_t buf_size) + /* if proc/fs/cifs/streamstoxattr is set then + search server for EAs or streams to + returns as xattrs */ +- rc = CIFSSMBQAllEAs(xid, pTcon, full_path, NULL, data, +- buf_size, cifs_sb->local_nls, +- cifs_sb->mnt_cifs_flags & +- CIFS_MOUNT_MAP_SPECIAL_CHR); + ++ if (pTcon->ses->server->ops->query_all_EAs) ++ rc = pTcon->ses->server->ops->query_all_EAs(xid, pTcon, ++ full_path, NULL, data, buf_size, ++ cifs_sb->local_nls, cifs_sb->mnt_cifs_flags & ++ CIFS_MOUNT_MAP_SPECIAL_CHR); + list_ea_exit: + kfree(full_path); + free_xid(xid); +diff --git a/fs/file.c b/fs/file.c +index 4a78f981557a..9de20265a78c 100644 +--- a/fs/file.c ++++ b/fs/file.c +@@ -34,7 +34,7 @@ static void *alloc_fdmem(size_t size) + * vmalloc() if the allocation size will be considered "large" by the VM. + */ + if (size <= (PAGE_SIZE << PAGE_ALLOC_COSTLY_ORDER)) { +- void *data = kmalloc(size, GFP_KERNEL|__GFP_NOWARN); ++ void *data = kmalloc(size, GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY); + if (data != NULL) + return data; + } +diff --git a/fs/lockd/svclock.c b/fs/lockd/svclock.c +index 8ebd3f551e0c..ffc4045fc62e 100644 +--- a/fs/lockd/svclock.c ++++ b/fs/lockd/svclock.c +@@ -767,6 +767,7 @@ nlmsvc_grant_blocked(struct nlm_block *block) + struct nlm_file *file = block->b_file; + struct nlm_lock *lock = &block->b_call->a_args.lock; + int error; ++ loff_t fl_start, fl_end; + + dprintk("lockd: grant blocked lock %p\n", block); + +@@ -784,9 +785,16 @@ nlmsvc_grant_blocked(struct nlm_block *block) + } + + /* Try the lock operation again */ ++ /* vfs_lock_file() can mangle fl_start and fl_end, but we need ++ * them unchanged for the GRANT_MSG ++ */ + lock->fl.fl_flags |= FL_SLEEP; ++ fl_start = lock->fl.fl_start; ++ fl_end = lock->fl.fl_end; + error = vfs_lock_file(file->f_file, F_SETLK, &lock->fl, NULL); + lock->fl.fl_flags &= ~FL_SLEEP; ++ lock->fl.fl_start = fl_start; ++ lock->fl.fl_end = fl_end; + + switch (error) { + case 0: +diff --git a/include/linux/compiler-gcc4.h b/include/linux/compiler-gcc4.h +index ded429966c1f..2507fd2a1eb4 100644 +--- a/include/linux/compiler-gcc4.h ++++ b/include/linux/compiler-gcc4.h +@@ -75,11 +75,7 @@ + * + * (asm goto is automatically volatile - the naming reflects this.) + */ +-#if GCC_VERSION <= 40801 +-# define asm_volatile_goto(x...) do { asm goto(x); asm (""); } while (0) +-#else +-# define asm_volatile_goto(x...) do { asm goto(x); } while (0) +-#endif ++#define asm_volatile_goto(x...) do { asm goto(x); asm (""); } while (0) + + #ifdef CONFIG_ARCH_USE_BUILTIN_BSWAP + #if GCC_VERSION >= 40400 +diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c +index 192a302d6cfd..8ab8e9390297 100644 +--- a/kernel/irq/irqdesc.c ++++ b/kernel/irq/irqdesc.c +@@ -274,6 +274,7 @@ struct irq_desc *irq_to_desc(unsigned int irq) + { + return (irq < NR_IRQS) ? irq_desc + irq : NULL; + } ++EXPORT_SYMBOL(irq_to_desc); + + static void free_desc(unsigned int irq) + { +diff --git a/kernel/time/jiffies.c b/kernel/time/jiffies.c +index 7a925ba456fb..a6a5bf53e86d 100644 +--- a/kernel/time/jiffies.c ++++ b/kernel/time/jiffies.c +@@ -51,7 +51,13 @@ + * HZ shrinks, so values greater than 8 overflow 32bits when + * HZ=100. + */ ++#if HZ < 34 ++#define JIFFIES_SHIFT 6 ++#elif HZ < 67 ++#define JIFFIES_SHIFT 7 ++#else + #define JIFFIES_SHIFT 8 ++#endif + + static cycle_t jiffies_read(struct clocksource *cs) + { +diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c +index 52d4827cf2d4..f681da32a2ff 100644 +--- a/kernel/time/tick-broadcast.c ++++ b/kernel/time/tick-broadcast.c +@@ -745,6 +745,7 @@ out: + static void tick_broadcast_clear_oneshot(int cpu) + { + cpumask_clear_cpu(cpu, tick_broadcast_oneshot_mask); ++ cpumask_clear_cpu(cpu, tick_broadcast_pending_mask); + } + + static void tick_broadcast_init_next_event(struct cpumask *mask, +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index e444ff88f0a4..fd12cc56371f 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -2396,6 +2396,13 @@ __rb_reserve_next(struct ring_buffer_per_cpu *cpu_buffer, + write &= RB_WRITE_MASK; + tail = write - length; + ++ /* ++ * If this is the first commit on the page, then it has the same ++ * timestamp as the page itself. ++ */ ++ if (!tail) ++ delta = 0; ++ + /* See if we shot pass the end of this buffer page */ + if (unlikely(write > BUF_PAGE_SIZE)) + return rb_move_tail(cpu_buffer, length, tail, +diff --git a/mm/memory-failure.c b/mm/memory-failure.c +index f2a591d87d00..e386beefc994 100644 +--- a/mm/memory-failure.c ++++ b/mm/memory-failure.c +@@ -943,8 +943,10 @@ static int hwpoison_user_mappings(struct page *p, unsigned long pfn, + * to it. Similarly, page lock is shifted. + */ + if (hpage != p) { +- put_page(hpage); +- get_page(p); ++ if (!(flags & MF_COUNT_INCREASED)) { ++ put_page(hpage); ++ get_page(p); ++ } + lock_page(p); + unlock_page(hpage); + *hpagep = p; +diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c +index 18687f1fca75..e922bf3f422c 100644 +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -975,8 +975,10 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev, + IEEE80211_P2P_OPPPS_ENABLE_BIT; + + err = ieee80211_assign_beacon(sdata, ¶ms->beacon); +- if (err < 0) ++ if (err < 0) { ++ ieee80211_vif_release_channel(sdata); + return err; ++ } + changed |= err; + + err = drv_start_ap(sdata->local, sdata); +@@ -985,6 +987,7 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev, + if (old) + kfree_rcu(old, rcu_head); + RCU_INIT_POINTER(sdata->u.ap.beacon, NULL); ++ ieee80211_vif_release_channel(sdata); + return err; + } + +@@ -2476,6 +2479,24 @@ static int ieee80211_start_roc_work(struct ieee80211_local *local, + INIT_DELAYED_WORK(&roc->work, ieee80211_sw_roc_work); + INIT_LIST_HEAD(&roc->dependents); + ++ /* ++ * cookie is either the roc cookie (for normal roc) ++ * or the SKB (for mgmt TX) ++ */ ++ if (!txskb) { ++ /* local->mtx protects this */ ++ local->roc_cookie_counter++; ++ roc->cookie = local->roc_cookie_counter; ++ /* wow, you wrapped 64 bits ... more likely a bug */ ++ if (WARN_ON(roc->cookie == 0)) { ++ roc->cookie = 1; ++ local->roc_cookie_counter++; ++ } ++ *cookie = roc->cookie; ++ } else { ++ *cookie = (unsigned long)txskb; ++ } ++ + /* if there's one pending or we're scanning, queue this one */ + if (!list_empty(&local->roc_list) || + local->scanning || local->radar_detect_enabled) +@@ -2610,24 +2631,6 @@ static int ieee80211_start_roc_work(struct ieee80211_local *local, + if (!queued) + list_add_tail(&roc->list, &local->roc_list); + +- /* +- * cookie is either the roc cookie (for normal roc) +- * or the SKB (for mgmt TX) +- */ +- if (!txskb) { +- /* local->mtx protects this */ +- local->roc_cookie_counter++; +- roc->cookie = local->roc_cookie_counter; +- /* wow, you wrapped 64 bits ... more likely a bug */ +- if (WARN_ON(roc->cookie == 0)) { +- roc->cookie = 1; +- local->roc_cookie_counter++; +- } +- *cookie = roc->cookie; +- } else { +- *cookie = (unsigned long)txskb; +- } +- + return 0; + } + +diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c +index cc65cdddb047..fe9d6e7b904b 100644 +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -854,7 +854,7 @@ static int ieee80211_fragment(struct ieee80211_tx_data *tx, + } + + /* adjust first fragment's length */ +- skb->len = hdrlen + per_fragm; ++ skb_trim(skb, hdrlen + per_fragm); + return 0; + } + +diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c +index 45f9a3377dcd..4319a3824727 100644 +--- a/scripts/mod/file2alias.c ++++ b/scripts/mod/file2alias.c +@@ -208,8 +208,8 @@ static void do_usb_entry(void *symval, + range_lo < 0x9 ? "[%X-9" : "[%X", + range_lo); + sprintf(alias + strlen(alias), +- range_hi > 0xA ? "a-%X]" : "%X]", +- range_lo); ++ range_hi > 0xA ? "A-%X]" : "%X]", ++ range_hi); + } + } + if (bcdDevice_initial_digits < (sizeof(bcdDevice_lo) * 2 - 1)) +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 87a03aca1b2e..e0bdcb3ecf0e 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -3700,6 +3700,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x8398, "ASUS P1005", ALC269_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x1043, 0x83ce, "ASUS P1005", ALC269_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x1043, 0x8516, "ASUS X101CH", ALC269_FIXUP_ASUS_X101), ++ SND_PCI_QUIRK(0x104d, 0x90b5, "Sony VAIO Pro 11", ALC286_FIXUP_SONY_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x104d, 0x90b6, "Sony VAIO Pro 13", ALC286_FIXUP_SONY_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x104d, 0x9073, "Sony VAIO", ALC275_FIXUP_SONY_VAIO_GPIO2), + SND_PCI_QUIRK(0x104d, 0x907b, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ), +diff --git a/virt/kvm/coalesced_mmio.c b/virt/kvm/coalesced_mmio.c +index 88b2fe3ddf42..00d86427af0f 100644 +--- a/virt/kvm/coalesced_mmio.c ++++ b/virt/kvm/coalesced_mmio.c +@@ -154,17 +154,13 @@ int kvm_vm_ioctl_register_coalesced_mmio(struct kvm *kvm, + list_add_tail(&dev->list, &kvm->coalesced_zones); + mutex_unlock(&kvm->slots_lock); + +- return ret; ++ return 0; + + out_free_dev: + mutex_unlock(&kvm->slots_lock); +- + kfree(dev); + +- if (dev == NULL) +- return -ENXIO; +- +- return 0; ++ return ret; + } + + int kvm_vm_ioctl_unregister_coalesced_mmio(struct kvm *kvm, diff --git a/projects/Cuboxi/patches/linux/linux-000-patch-3.10.32-33.patch b/projects/Cuboxi/patches/linux/linux-000-patch-3.10.32-33.patch new file mode 100644 index 0000000000..72ea66ab84 --- /dev/null +++ b/projects/Cuboxi/patches/linux/linux-000-patch-3.10.32-33.patch @@ -0,0 +1,3945 @@ +diff --git a/Makefile b/Makefile +index aab192446f50..1e602eb906fa 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 10 +-SUBLEVEL = 32 ++SUBLEVEL = 33 + EXTRAVERSION = + NAME = TOSSUG Baby Fish + +diff --git a/arch/arm/include/asm/cacheflush.h b/arch/arm/include/asm/cacheflush.h +index 17d0ae8672fa..a25e62d2de6e 100644 +--- a/arch/arm/include/asm/cacheflush.h ++++ b/arch/arm/include/asm/cacheflush.h +@@ -212,6 +212,7 @@ extern void copy_to_user_page(struct vm_area_struct *, struct page *, + static inline void __flush_icache_all(void) + { + __flush_icache_preferred(); ++ dsb(); + } + + /* +diff --git a/arch/arm/include/asm/spinlock.h b/arch/arm/include/asm/spinlock.h +index 6220e9fdf4c7..dd64cc6f9cba 100644 +--- a/arch/arm/include/asm/spinlock.h ++++ b/arch/arm/include/asm/spinlock.h +@@ -97,19 +97,22 @@ static inline void arch_spin_lock(arch_spinlock_t *lock) + + static inline int arch_spin_trylock(arch_spinlock_t *lock) + { +- unsigned long tmp; ++ unsigned long contended, res; + u32 slock; + +- __asm__ __volatile__( +-" ldrex %0, [%2]\n" +-" subs %1, %0, %0, ror #16\n" +-" addeq %0, %0, %3\n" +-" strexeq %1, %0, [%2]" +- : "=&r" (slock), "=&r" (tmp) +- : "r" (&lock->slock), "I" (1 << TICKET_SHIFT) +- : "cc"); +- +- if (tmp == 0) { ++ do { ++ __asm__ __volatile__( ++ " ldrex %0, [%3]\n" ++ " mov %2, #0\n" ++ " subs %1, %0, %0, ror #16\n" ++ " addeq %0, %0, %4\n" ++ " strexeq %2, %0, [%3]" ++ : "=&r" (slock), "=&r" (contended), "=r" (res) ++ : "r" (&lock->slock), "I" (1 << TICKET_SHIFT) ++ : "cc"); ++ } while (res); ++ ++ if (!contended) { + smp_mb(); + return 1; + } else { +@@ -165,17 +168,20 @@ static inline void arch_write_lock(arch_rwlock_t *rw) + + static inline int arch_write_trylock(arch_rwlock_t *rw) + { +- unsigned long tmp; +- +- __asm__ __volatile__( +-" ldrex %0, [%1]\n" +-" teq %0, #0\n" +-" strexeq %0, %2, [%1]" +- : "=&r" (tmp) +- : "r" (&rw->lock), "r" (0x80000000) +- : "cc"); +- +- if (tmp == 0) { ++ unsigned long contended, res; ++ ++ do { ++ __asm__ __volatile__( ++ " ldrex %0, [%2]\n" ++ " mov %1, #0\n" ++ " teq %0, #0\n" ++ " strexeq %1, %3, [%2]" ++ : "=&r" (contended), "=&r" (res) ++ : "r" (&rw->lock), "r" (0x80000000) ++ : "cc"); ++ } while (res); ++ ++ if (!contended) { + smp_mb(); + return 1; + } else { +@@ -251,18 +257,26 @@ static inline void arch_read_unlock(arch_rwlock_t *rw) + + static inline int arch_read_trylock(arch_rwlock_t *rw) + { +- unsigned long tmp, tmp2 = 1; +- +- __asm__ __volatile__( +-" ldrex %0, [%2]\n" +-" adds %0, %0, #1\n" +-" strexpl %1, %0, [%2]\n" +- : "=&r" (tmp), "+r" (tmp2) +- : "r" (&rw->lock) +- : "cc"); +- +- smp_mb(); +- return tmp2 == 0; ++ unsigned long contended, res; ++ ++ do { ++ __asm__ __volatile__( ++ " ldrex %0, [%2]\n" ++ " mov %1, #0\n" ++ " adds %0, %0, #1\n" ++ " strexpl %1, %0, [%2]" ++ : "=&r" (contended), "=&r" (res) ++ : "r" (&rw->lock) ++ : "cc"); ++ } while (res); ++ ++ /* If the lock is negative, then it is already held for write. */ ++ if (contended < 0x80000000) { ++ smp_mb(); ++ return 1; ++ } else { ++ return 0; ++ } + } + + /* read_can_lock - would read_trylock() succeed? */ +diff --git a/arch/arm/mach-omap2/gpmc.c b/arch/arm/mach-omap2/gpmc.c +index 6c4da1254f53..55bcb77c623e 100644 +--- a/arch/arm/mach-omap2/gpmc.c ++++ b/arch/arm/mach-omap2/gpmc.c +@@ -1335,7 +1335,7 @@ static void __maybe_unused gpmc_read_timings_dt(struct device_node *np, + of_property_read_bool(np, "gpmc,time-para-granularity"); + } + +-#ifdef CONFIG_MTD_NAND ++#if IS_ENABLED(CONFIG_MTD_NAND) + + static const char * const nand_ecc_opts[] = { + [OMAP_ECC_HAMMING_CODE_DEFAULT] = "sw", +@@ -1391,7 +1391,7 @@ static int gpmc_probe_nand_child(struct platform_device *pdev, + } + #endif + +-#ifdef CONFIG_MTD_ONENAND ++#if IS_ENABLED(CONFIG_MTD_ONENAND) + static int gpmc_probe_onenand_child(struct platform_device *pdev, + struct device_node *child) + { +diff --git a/arch/arm/mach-tegra/common.c b/arch/arm/mach-tegra/common.c +index 9f852c6fe5b9..d5ebcd0bb622 100644 +--- a/arch/arm/mach-tegra/common.c ++++ b/arch/arm/mach-tegra/common.c +@@ -22,6 +22,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -80,10 +81,20 @@ void tegra_assert_system_reset(char mode, const char *cmd) + static void __init tegra_init_cache(void) + { + #ifdef CONFIG_CACHE_L2X0 ++ static const struct of_device_id pl310_ids[] __initconst = { ++ { .compatible = "arm,pl310-cache", }, ++ {} ++ }; ++ ++ struct device_node *np; + int ret; + void __iomem *p = IO_ADDRESS(TEGRA_ARM_PERIF_BASE) + 0x3000; + u32 aux_ctrl, cache_type; + ++ np = of_find_matching_node(NULL, pl310_ids); ++ if (!np) ++ return; ++ + cache_type = readl(p + L2X0_CACHE_TYPE); + aux_ctrl = (cache_type & 0x700) << (17-8); + aux_ctrl |= 0x7C400001; +diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c +index ef3e0f3aac96..6c9d7054d997 100644 +--- a/arch/arm/mm/dma-mapping.c ++++ b/arch/arm/mm/dma-mapping.c +@@ -1311,7 +1311,7 @@ static void *arm_iommu_alloc_attrs(struct device *dev, size_t size, + *handle = DMA_ERROR_CODE; + size = PAGE_ALIGN(size); + +- if (gfp & GFP_ATOMIC) ++ if (!(gfp & __GFP_WAIT)) + return __iommu_alloc_atomic(dev, size, handle); + + pages = __iommu_alloc_buffer(dev, size, gfp, attrs); +diff --git a/arch/arm/mm/proc-v6.S b/arch/arm/mm/proc-v6.S +index 919405e20b80..d07352819580 100644 +--- a/arch/arm/mm/proc-v6.S ++++ b/arch/arm/mm/proc-v6.S +@@ -206,7 +206,6 @@ __v6_setup: + mcr p15, 0, r0, c7, c14, 0 @ clean+invalidate D cache + mcr p15, 0, r0, c7, c5, 0 @ invalidate I cache + mcr p15, 0, r0, c7, c15, 0 @ clean+invalidate cache +- mcr p15, 0, r0, c7, c10, 4 @ drain write buffer + #ifdef CONFIG_MMU + mcr p15, 0, r0, c8, c7, 0 @ invalidate I + D TLBs + mcr p15, 0, r0, c2, c0, 2 @ TTB control register +@@ -216,6 +215,8 @@ __v6_setup: + ALT_UP(orr r8, r8, #TTB_FLAGS_UP) + mcr p15, 0, r8, c2, c0, 1 @ load TTB1 + #endif /* CONFIG_MMU */ ++ mcr p15, 0, r0, c7, c10, 4 @ drain write buffer and ++ @ complete invalidations + adr r5, v6_crval + ldmia r5, {r5, r6} + #ifdef CONFIG_CPU_ENDIAN_BE8 +diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S +index 5fbccee5f644..19da84172cc3 100644 +--- a/arch/arm/mm/proc-v7.S ++++ b/arch/arm/mm/proc-v7.S +@@ -329,7 +329,6 @@ __v7_setup: + + 3: mov r10, #0 + mcr p15, 0, r10, c7, c5, 0 @ I+BTB cache invalidate +- dsb + #ifdef CONFIG_MMU + mcr p15, 0, r10, c8, c7, 0 @ invalidate I + D TLBs + v7_ttb_setup r10, r4, r8, r5 @ TTBCR, TTBRx setup +@@ -338,6 +337,7 @@ __v7_setup: + mcr p15, 0, r5, c10, c2, 0 @ write PRRR + mcr p15, 0, r6, c10, c2, 1 @ write NMRR + #endif ++ dsb @ Complete invalidations + #ifndef CONFIG_ARM_THUMBEE + mrc p15, 0, r0, c0, c1, 0 @ read ID_PFR0 for ThumbEE + and r0, r0, #(0xf << 12) @ ThumbEE enabled field +diff --git a/arch/arm64/kernel/stacktrace.c b/arch/arm64/kernel/stacktrace.c +index d25459ff57fc..048334bb2651 100644 +--- a/arch/arm64/kernel/stacktrace.c ++++ b/arch/arm64/kernel/stacktrace.c +@@ -48,7 +48,11 @@ int unwind_frame(struct stackframe *frame) + + frame->sp = fp + 0x10; + frame->fp = *(unsigned long *)(fp); +- frame->pc = *(unsigned long *)(fp + 8); ++ /* ++ * -4 here because we care about the PC at time of bl, ++ * not where the return will go. ++ */ ++ frame->pc = *(unsigned long *)(fp + 8) - 4; + + return 0; + } +diff --git a/arch/avr32/Makefile b/arch/avr32/Makefile +index 22fb66590dcd..dba48a5d5bb9 100644 +--- a/arch/avr32/Makefile ++++ b/arch/avr32/Makefile +@@ -11,7 +11,7 @@ all: uImage vmlinux.elf + + KBUILD_DEFCONFIG := atstk1002_defconfig + +-KBUILD_CFLAGS += -pipe -fno-builtin -mno-pic ++KBUILD_CFLAGS += -pipe -fno-builtin -mno-pic -D__linux__ + KBUILD_AFLAGS += -mrelax -mno-pic + KBUILD_CFLAGS_MODULE += -mno-relax + LDFLAGS_vmlinux += --relax +diff --git a/arch/avr32/boards/mimc200/fram.c b/arch/avr32/boards/mimc200/fram.c +index 9764a1a1073e..c1466a872b9c 100644 +--- a/arch/avr32/boards/mimc200/fram.c ++++ b/arch/avr32/boards/mimc200/fram.c +@@ -11,6 +11,7 @@ + #define FRAM_VERSION "1.0" + + #include ++#include + #include + #include + #include +diff --git a/arch/powerpc/kernel/crash_dump.c b/arch/powerpc/kernel/crash_dump.c +index 9ec3fe174cba..555ae67e4086 100644 +--- a/arch/powerpc/kernel/crash_dump.c ++++ b/arch/powerpc/kernel/crash_dump.c +@@ -108,17 +108,19 @@ ssize_t copy_oldmem_page(unsigned long pfn, char *buf, + size_t csize, unsigned long offset, int userbuf) + { + void *vaddr; ++ phys_addr_t paddr; + + if (!csize) + return 0; + + csize = min_t(size_t, csize, PAGE_SIZE); ++ paddr = pfn << PAGE_SHIFT; + +- if ((min_low_pfn < pfn) && (pfn < max_pfn)) { +- vaddr = __va(pfn << PAGE_SHIFT); ++ if (memblock_is_region_memory(paddr, csize)) { ++ vaddr = __va(paddr); + csize = copy_oldmem_vaddr(vaddr, buf, csize, offset, userbuf); + } else { +- vaddr = __ioremap(pfn << PAGE_SHIFT, PAGE_SIZE, 0); ++ vaddr = __ioremap(paddr, PAGE_SIZE, 0); + csize = copy_oldmem_vaddr(vaddr, buf, csize, offset, userbuf); + iounmap(vaddr); + } +diff --git a/arch/powerpc/platforms/pseries/hotplug-cpu.c b/arch/powerpc/platforms/pseries/hotplug-cpu.c +index 217ca5c75b20..2882d614221f 100644 +--- a/arch/powerpc/platforms/pseries/hotplug-cpu.c ++++ b/arch/powerpc/platforms/pseries/hotplug-cpu.c +@@ -34,12 +34,7 @@ + #include "offline_states.h" + + /* This version can't take the spinlock, because it never returns */ +-static struct rtas_args rtas_stop_self_args = { +- .token = RTAS_UNKNOWN_SERVICE, +- .nargs = 0, +- .nret = 1, +- .rets = &rtas_stop_self_args.args[0], +-}; ++static int rtas_stop_self_token = RTAS_UNKNOWN_SERVICE; + + static DEFINE_PER_CPU(enum cpu_state_vals, preferred_offline_state) = + CPU_STATE_OFFLINE; +@@ -92,15 +87,20 @@ void set_default_offline_state(int cpu) + + static void rtas_stop_self(void) + { +- struct rtas_args *args = &rtas_stop_self_args; ++ struct rtas_args args = { ++ .token = cpu_to_be32(rtas_stop_self_token), ++ .nargs = 0, ++ .nret = 1, ++ .rets = &args.args[0], ++ }; + + local_irq_disable(); + +- BUG_ON(args->token == RTAS_UNKNOWN_SERVICE); ++ BUG_ON(rtas_stop_self_token == RTAS_UNKNOWN_SERVICE); + + printk("cpu %u (hwid %u) Ready to die...\n", + smp_processor_id(), hard_smp_processor_id()); +- enter_rtas(__pa(args)); ++ enter_rtas(__pa(&args)); + + panic("Alas, I survived.\n"); + } +@@ -391,10 +391,10 @@ static int __init pseries_cpu_hotplug_init(void) + } + } + +- rtas_stop_self_args.token = rtas_token("stop-self"); ++ rtas_stop_self_token = rtas_token("stop-self"); + qcss_tok = rtas_token("query-cpu-stopped-state"); + +- if (rtas_stop_self_args.token == RTAS_UNKNOWN_SERVICE || ++ if (rtas_stop_self_token == RTAS_UNKNOWN_SERVICE || + qcss_tok == RTAS_UNKNOWN_SERVICE) { + printk(KERN_INFO "CPU Hotplug not supported by firmware " + "- disabling.\n"); +diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c +index 1025f3c99d20..a69b67d968d4 100644 +--- a/arch/x86/kernel/cpu/perf_event.c ++++ b/arch/x86/kernel/cpu/perf_event.c +@@ -1165,6 +1165,9 @@ static void x86_pmu_del(struct perf_event *event, int flags) + for (i = 0; i < cpuc->n_events; i++) { + if (event == cpuc->event_list[i]) { + ++ if (i >= cpuc->n_events - cpuc->n_added) ++ --cpuc->n_added; ++ + if (x86_pmu.put_event_constraints) + x86_pmu.put_event_constraints(cpuc, event); + +diff --git a/arch/x86/kernel/pci-dma.c b/arch/x86/kernel/pci-dma.c +index 872079a67e4d..f7d0672481fd 100644 +--- a/arch/x86/kernel/pci-dma.c ++++ b/arch/x86/kernel/pci-dma.c +@@ -100,8 +100,10 @@ void *dma_generic_alloc_coherent(struct device *dev, size_t size, + flag |= __GFP_ZERO; + again: + page = NULL; +- if (!(flag & GFP_ATOMIC)) ++ /* CMA can be used only in the context which permits sleeping */ ++ if (flag & __GFP_WAIT) + page = dma_alloc_from_contiguous(dev, count, get_order(size)); ++ /* fallback */ + if (!page) + page = alloc_pages_node(dev_to_node(dev), flag, get_order(size)); + if (!page) +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 1bd6ea07d7d3..1be0a9e75d1f 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -5982,7 +5982,7 @@ static int complete_emulated_mmio(struct kvm_vcpu *vcpu) + frag->len -= len; + } + +- if (vcpu->mmio_cur_fragment == vcpu->mmio_nr_fragments) { ++ if (vcpu->mmio_cur_fragment >= vcpu->mmio_nr_fragments) { + vcpu->mmio_needed = 0; + if (vcpu->mmio_is_write) + return 1; +diff --git a/arch/xtensa/include/asm/traps.h b/arch/xtensa/include/asm/traps.h +index 917488a0ab00..f2faa58f9a43 100644 +--- a/arch/xtensa/include/asm/traps.h ++++ b/arch/xtensa/include/asm/traps.h +@@ -22,25 +22,37 @@ extern void do_unhandled(struct pt_regs *regs, unsigned long exccause); + + static inline void spill_registers(void) + { +- ++#if XCHAL_NUM_AREGS > 16 + __asm__ __volatile__ ( +- "movi a14, "__stringify((1 << PS_EXCM_BIT) | LOCKLEVEL)"\n\t" +- "mov a12, a0\n\t" +- "rsr a13, sar\n\t" +- "xsr a14, ps\n\t" +- "movi a0, _spill_registers\n\t" +- "rsync\n\t" +- "callx0 a0\n\t" +- "mov a0, a12\n\t" +- "wsr a13, sar\n\t" +- "wsr a14, ps\n\t" +- : : +-#if defined(CONFIG_FRAME_POINTER) +- : "a2", "a3", "a4", "a11", "a12", "a13", "a14", "a15", ++ " call12 1f\n" ++ " _j 2f\n" ++ " retw\n" ++ " .align 4\n" ++ "1:\n" ++ " _entry a1, 48\n" ++ " addi a12, a0, 3\n" ++#if XCHAL_NUM_AREGS > 32 ++ " .rept (" __stringify(XCHAL_NUM_AREGS) " - 32) / 12\n" ++ " _entry a1, 48\n" ++ " mov a12, a0\n" ++ " .endr\n" ++#endif ++ " _entry a1, 48\n" ++#if XCHAL_NUM_AREGS % 12 == 0 ++ " mov a8, a8\n" ++#elif XCHAL_NUM_AREGS % 12 == 4 ++ " mov a12, a12\n" ++#elif XCHAL_NUM_AREGS % 12 == 8 ++ " mov a4, a4\n" ++#endif ++ " retw\n" ++ "2:\n" ++ : : : "a12", "a13", "memory"); + #else +- : "a2", "a3", "a4", "a7", "a11", "a12", "a13", "a14", "a15", ++ __asm__ __volatile__ ( ++ " mov a12, a12\n" ++ : : : "memory"); + #endif +- "memory"); + } + + #endif /* _XTENSA_TRAPS_H */ +diff --git a/arch/xtensa/kernel/entry.S b/arch/xtensa/kernel/entry.S +index 5082507d5631..aa7f9add7d77 100644 +--- a/arch/xtensa/kernel/entry.S ++++ b/arch/xtensa/kernel/entry.S +@@ -1912,6 +1912,43 @@ ENTRY(system_call) + + ENDPROC(system_call) + ++/* ++ * Spill live registers on the kernel stack macro. ++ * ++ * Entry condition: ps.woe is set, ps.excm is cleared ++ * Exit condition: windowstart has single bit set ++ * May clobber: a12, a13 ++ */ ++ .macro spill_registers_kernel ++ ++#if XCHAL_NUM_AREGS > 16 ++ call12 1f ++ _j 2f ++ retw ++ .align 4 ++1: ++ _entry a1, 48 ++ addi a12, a0, 3 ++#if XCHAL_NUM_AREGS > 32 ++ .rept (XCHAL_NUM_AREGS - 32) / 12 ++ _entry a1, 48 ++ mov a12, a0 ++ .endr ++#endif ++ _entry a1, 48 ++#if XCHAL_NUM_AREGS % 12 == 0 ++ mov a8, a8 ++#elif XCHAL_NUM_AREGS % 12 == 4 ++ mov a12, a12 ++#elif XCHAL_NUM_AREGS % 12 == 8 ++ mov a4, a4 ++#endif ++ retw ++2: ++#else ++ mov a12, a12 ++#endif ++ .endm + + /* + * Task switch. +@@ -1924,21 +1961,20 @@ ENTRY(_switch_to) + + entry a1, 16 + +- mov a12, a2 # preserve 'prev' (a2) +- mov a13, a3 # and 'next' (a3) ++ mov a10, a2 # preserve 'prev' (a2) ++ mov a11, a3 # and 'next' (a3) + + l32i a4, a2, TASK_THREAD_INFO + l32i a5, a3, TASK_THREAD_INFO + +- save_xtregs_user a4 a6 a8 a9 a10 a11 THREAD_XTREGS_USER ++ save_xtregs_user a4 a6 a8 a9 a12 a13 THREAD_XTREGS_USER + +- s32i a0, a12, THREAD_RA # save return address +- s32i a1, a12, THREAD_SP # save stack pointer ++ s32i a0, a10, THREAD_RA # save return address ++ s32i a1, a10, THREAD_SP # save stack pointer + + /* Disable ints while we manipulate the stack pointer. */ + +- movi a14, (1 << PS_EXCM_BIT) | LOCKLEVEL +- xsr a14, ps ++ rsil a14, LOCKLEVEL + rsr a3, excsave1 + rsync + s32i a3, a3, EXC_TABLE_FIXUP /* enter critical section */ +@@ -1953,7 +1989,7 @@ ENTRY(_switch_to) + + /* Flush register file. */ + +- call0 _spill_registers # destroys a3, a4, and SAR ++ spill_registers_kernel + + /* Set kernel stack (and leave critical section) + * Note: It's save to set it here. The stack will not be overwritten +@@ -1969,13 +2005,13 @@ ENTRY(_switch_to) + + /* restore context of the task 'next' */ + +- l32i a0, a13, THREAD_RA # restore return address +- l32i a1, a13, THREAD_SP # restore stack pointer ++ l32i a0, a11, THREAD_RA # restore return address ++ l32i a1, a11, THREAD_SP # restore stack pointer + +- load_xtregs_user a5 a6 a8 a9 a10 a11 THREAD_XTREGS_USER ++ load_xtregs_user a5 a6 a8 a9 a12 a13 THREAD_XTREGS_USER + + wsr a14, ps +- mov a2, a12 # return 'prev' ++ mov a2, a10 # return 'prev' + rsync + + retw +diff --git a/drivers/acpi/pci_irq.c b/drivers/acpi/pci_irq.c +index 41c5e1b799ef..f658e0948703 100644 +--- a/drivers/acpi/pci_irq.c ++++ b/drivers/acpi/pci_irq.c +@@ -432,6 +432,7 @@ int acpi_pci_irq_enable(struct pci_dev *dev) + pin_name(pin)); + } + ++ kfree(entry); + return 0; + } + +diff --git a/drivers/acpi/processor_throttling.c b/drivers/acpi/processor_throttling.c +index e7dd2c1fee79..5e47d7bf4745 100644 +--- a/drivers/acpi/processor_throttling.c ++++ b/drivers/acpi/processor_throttling.c +@@ -59,6 +59,12 @@ struct throttling_tstate { + int target_state; /* target T-state */ + }; + ++struct acpi_processor_throttling_arg { ++ struct acpi_processor *pr; ++ int target_state; ++ bool force; ++}; ++ + #define THROTTLING_PRECHANGE (1) + #define THROTTLING_POSTCHANGE (2) + +@@ -1063,16 +1069,24 @@ static int acpi_processor_set_throttling_ptc(struct acpi_processor *pr, + return 0; + } + ++static long acpi_processor_throttling_fn(void *data) ++{ ++ struct acpi_processor_throttling_arg *arg = data; ++ struct acpi_processor *pr = arg->pr; ++ ++ return pr->throttling.acpi_processor_set_throttling(pr, ++ arg->target_state, arg->force); ++} ++ + int acpi_processor_set_throttling(struct acpi_processor *pr, + int state, bool force) + { +- cpumask_var_t saved_mask; + int ret = 0; + unsigned int i; + struct acpi_processor *match_pr; + struct acpi_processor_throttling *p_throttling; ++ struct acpi_processor_throttling_arg arg; + struct throttling_tstate t_state; +- cpumask_var_t online_throttling_cpus; + + if (!pr) + return -EINVAL; +@@ -1083,14 +1097,6 @@ int acpi_processor_set_throttling(struct acpi_processor *pr, + if ((state < 0) || (state > (pr->throttling.state_count - 1))) + return -EINVAL; + +- if (!alloc_cpumask_var(&saved_mask, GFP_KERNEL)) +- return -ENOMEM; +- +- if (!alloc_cpumask_var(&online_throttling_cpus, GFP_KERNEL)) { +- free_cpumask_var(saved_mask); +- return -ENOMEM; +- } +- + if (cpu_is_offline(pr->id)) { + /* + * the cpu pointed by pr->id is offline. Unnecessary to change +@@ -1099,17 +1105,15 @@ int acpi_processor_set_throttling(struct acpi_processor *pr, + return -ENODEV; + } + +- cpumask_copy(saved_mask, ¤t->cpus_allowed); + t_state.target_state = state; + p_throttling = &(pr->throttling); +- cpumask_and(online_throttling_cpus, cpu_online_mask, +- p_throttling->shared_cpu_map); ++ + /* + * The throttling notifier will be called for every + * affected cpu in order to get one proper T-state. + * The notifier event is THROTTLING_PRECHANGE. + */ +- for_each_cpu(i, online_throttling_cpus) { ++ for_each_cpu_and(i, cpu_online_mask, p_throttling->shared_cpu_map) { + t_state.cpu = i; + acpi_processor_throttling_notifier(THROTTLING_PRECHANGE, + &t_state); +@@ -1121,21 +1125,18 @@ int acpi_processor_set_throttling(struct acpi_processor *pr, + * it can be called only for the cpu pointed by pr. + */ + if (p_throttling->shared_type == DOMAIN_COORD_TYPE_SW_ANY) { +- /* FIXME: use work_on_cpu() */ +- if (set_cpus_allowed_ptr(current, cpumask_of(pr->id))) { +- /* Can't migrate to the pr->id CPU. Exit */ +- ret = -ENODEV; +- goto exit; +- } +- ret = p_throttling->acpi_processor_set_throttling(pr, +- t_state.target_state, force); ++ arg.pr = pr; ++ arg.target_state = state; ++ arg.force = force; ++ ret = work_on_cpu(pr->id, acpi_processor_throttling_fn, &arg); + } else { + /* + * When the T-state coordination is SW_ALL or HW_ALL, + * it is necessary to set T-state for every affected + * cpus. + */ +- for_each_cpu(i, online_throttling_cpus) { ++ for_each_cpu_and(i, cpu_online_mask, ++ p_throttling->shared_cpu_map) { + match_pr = per_cpu(processors, i); + /* + * If the pointer is invalid, we will report the +@@ -1156,13 +1157,12 @@ int acpi_processor_set_throttling(struct acpi_processor *pr, + "on CPU %d\n", i)); + continue; + } +- t_state.cpu = i; +- /* FIXME: use work_on_cpu() */ +- if (set_cpus_allowed_ptr(current, cpumask_of(i))) +- continue; +- ret = match_pr->throttling. +- acpi_processor_set_throttling( +- match_pr, t_state.target_state, force); ++ ++ arg.pr = match_pr; ++ arg.target_state = state; ++ arg.force = force; ++ ret = work_on_cpu(pr->id, acpi_processor_throttling_fn, ++ &arg); + } + } + /* +@@ -1171,17 +1171,12 @@ int acpi_processor_set_throttling(struct acpi_processor *pr, + * affected cpu to update the T-states. + * The notifier event is THROTTLING_POSTCHANGE + */ +- for_each_cpu(i, online_throttling_cpus) { ++ for_each_cpu_and(i, cpu_online_mask, p_throttling->shared_cpu_map) { + t_state.cpu = i; + acpi_processor_throttling_notifier(THROTTLING_POSTCHANGE, + &t_state); + } +- /* restore the previous state */ +- /* FIXME: use work_on_cpu() */ +- set_cpus_allowed_ptr(current, saved_mask); +-exit: +- free_cpumask_var(online_throttling_cpus); +- free_cpumask_var(saved_mask); ++ + return ret; + } + +diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c +index 055dfdfd7348..82a01cc45f9c 100644 +--- a/drivers/acpi/video.c ++++ b/drivers/acpi/video.c +@@ -733,6 +733,7 @@ acpi_video_init_brightness(struct acpi_video_device *device) + union acpi_object *o; + struct acpi_video_device_brightness *br = NULL; + int result = -EINVAL; ++ u32 value; + + if (!ACPI_SUCCESS(acpi_video_device_lcd_query_levels(device, &obj))) { + ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Could not query available " +@@ -763,7 +764,12 @@ acpi_video_init_brightness(struct acpi_video_device *device) + printk(KERN_ERR PREFIX "Invalid data\n"); + continue; + } +- br->levels[count] = (u32) o->integer.value; ++ value = (u32) o->integer.value; ++ /* Skip duplicate entries */ ++ if (count > 2 && br->levels[count - 1] == value) ++ continue; ++ ++ br->levels[count] = value; + + if (br->levels[count] > max_level) + max_level = br->levels[count]; +diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c +index 3f1794f4a8bf..4942058402a4 100644 +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -61,6 +61,7 @@ enum board_ids { + /* board IDs by feature in alphabetical order */ + board_ahci, + board_ahci_ign_iferr, ++ board_ahci_noncq, + board_ahci_nosntf, + board_ahci_yes_fbs, + +@@ -119,6 +120,13 @@ static const struct ata_port_info ahci_port_info[] = { + .udma_mask = ATA_UDMA6, + .port_ops = &ahci_ops, + }, ++ [board_ahci_noncq] = { ++ AHCI_HFLAGS (AHCI_HFLAG_NO_NCQ), ++ .flags = AHCI_FLAG_COMMON, ++ .pio_mask = ATA_PIO4, ++ .udma_mask = ATA_UDMA6, ++ .port_ops = &ahci_ops, ++ }, + [board_ahci_nosntf] = { + AHCI_HFLAGS (AHCI_HFLAG_NO_SNTF), + .flags = AHCI_FLAG_COMMON, +@@ -450,6 +458,12 @@ static const struct pci_device_id ahci_pci_tbl[] = { + { PCI_VDEVICE(ASMEDIA, 0x0611), board_ahci }, /* ASM1061 */ + { PCI_VDEVICE(ASMEDIA, 0x0612), board_ahci }, /* ASM1062 */ + ++ /* ++ * Samsung SSDs found on some macbooks. NCQ times out. ++ * https://bugzilla.kernel.org/show_bug.cgi?id=60731 ++ */ ++ { PCI_VDEVICE(SAMSUNG, 0x1600), board_ahci_noncq }, ++ + /* Enmotus */ + { PCI_DEVICE(0x1c44, 0x8000), board_ahci }, + +diff --git a/drivers/ata/libata-pmp.c b/drivers/ata/libata-pmp.c +index 20fd337a5731..7ccc084bf1df 100644 +--- a/drivers/ata/libata-pmp.c ++++ b/drivers/ata/libata-pmp.c +@@ -447,8 +447,11 @@ static void sata_pmp_quirks(struct ata_port *ap) + * otherwise. Don't try hard to recover it. + */ + ap->pmp_link[ap->nr_pmp_links - 1].flags |= ATA_LFLAG_NO_RETRY; +- } else if (vendor == 0x197b && devid == 0x2352) { +- /* chip found in Thermaltake BlackX Duet, jmicron JMB350? */ ++ } else if (vendor == 0x197b && (devid == 0x2352 || devid == 0x0325)) { ++ /* ++ * 0x2352: found in Thermaltake BlackX Duet, jmicron JMB350? ++ * 0x0325: jmicron JMB394. ++ */ + ata_for_each_link(link, ap, EDGE) { + /* SRST breaks detection and disks get misclassified + * LPM disabled to avoid potential problems +diff --git a/drivers/ata/sata_sil.c b/drivers/ata/sata_sil.c +index 0ae3ca4bf5c0..dd1faa564eb2 100644 +--- a/drivers/ata/sata_sil.c ++++ b/drivers/ata/sata_sil.c +@@ -157,6 +157,7 @@ static const struct sil_drivelist { + { "ST380011ASL", SIL_QUIRK_MOD15WRITE }, + { "ST3120022ASL", SIL_QUIRK_MOD15WRITE }, + { "ST3160021ASL", SIL_QUIRK_MOD15WRITE }, ++ { "TOSHIBA MK2561GSYN", SIL_QUIRK_MOD15WRITE }, + { "Maxtor 4D060H3", SIL_QUIRK_UDMA5MAX }, + { } + }; +diff --git a/drivers/cpufreq/powernow-k8.c b/drivers/cpufreq/powernow-k8.c +index b828efe4b2f8..9b963ceba5c4 100644 +--- a/drivers/cpufreq/powernow-k8.c ++++ b/drivers/cpufreq/powernow-k8.c +@@ -1100,7 +1100,7 @@ static int __cpuinit powernowk8_cpu_init(struct cpufreq_policy *pol) + { + struct powernow_k8_data *data; + struct init_on_cpu init_on_cpu; +- int rc; ++ int rc, cpu; + + smp_call_function_single(pol->cpu, check_supported_cpu, &rc, 1); + if (rc) +@@ -1169,7 +1169,9 @@ static int __cpuinit powernowk8_cpu_init(struct cpufreq_policy *pol) + pr_debug("cpu_init done, current fid 0x%x, vid 0x%x\n", + data->currfid, data->currvid); + +- per_cpu(powernow_data, pol->cpu) = data; ++ /* Point all the CPUs in this policy to the same data */ ++ for_each_cpu(cpu, pol->cpus) ++ per_cpu(powernow_data, cpu) = data; + + return 0; + +@@ -1184,6 +1186,7 @@ err_out: + static int powernowk8_cpu_exit(struct cpufreq_policy *pol) + { + struct powernow_k8_data *data = per_cpu(powernow_data, pol->cpu); ++ int cpu; + + if (!data) + return -EINVAL; +@@ -1194,7 +1197,8 @@ static int powernowk8_cpu_exit(struct cpufreq_policy *pol) + + kfree(data->powernow_table); + kfree(data); +- per_cpu(powernow_data, pol->cpu) = NULL; ++ for_each_cpu(cpu, pol->cpus) ++ per_cpu(powernow_data, cpu) = NULL; + + return 0; + } +diff --git a/drivers/dma/ioat/dma.c b/drivers/dma/ioat/dma.c +index 17a2393b3e25..533e1874e1d6 100644 +--- a/drivers/dma/ioat/dma.c ++++ b/drivers/dma/ioat/dma.c +@@ -77,7 +77,8 @@ static irqreturn_t ioat_dma_do_interrupt(int irq, void *data) + attnstatus = readl(instance->reg_base + IOAT_ATTNSTATUS_OFFSET); + for_each_set_bit(bit, &attnstatus, BITS_PER_LONG) { + chan = ioat_chan_by_index(instance, bit); +- tasklet_schedule(&chan->cleanup_task); ++ if (test_bit(IOAT_RUN, &chan->state)) ++ tasklet_schedule(&chan->cleanup_task); + } + + writeb(intrctrl, instance->reg_base + IOAT_INTRCTRL_OFFSET); +@@ -93,7 +94,8 @@ static irqreturn_t ioat_dma_do_interrupt_msix(int irq, void *data) + { + struct ioat_chan_common *chan = data; + +- tasklet_schedule(&chan->cleanup_task); ++ if (test_bit(IOAT_RUN, &chan->state)) ++ tasklet_schedule(&chan->cleanup_task); + + return IRQ_HANDLED; + } +@@ -116,7 +118,6 @@ void ioat_init_channel(struct ioatdma_device *device, struct ioat_chan_common *c + chan->timer.function = device->timer_fn; + chan->timer.data = data; + tasklet_init(&chan->cleanup_task, device->cleanup_fn, data); +- tasklet_disable(&chan->cleanup_task); + } + + /** +@@ -354,13 +355,49 @@ static int ioat1_dma_alloc_chan_resources(struct dma_chan *c) + writel(((u64) chan->completion_dma) >> 32, + chan->reg_base + IOAT_CHANCMP_OFFSET_HIGH); + +- tasklet_enable(&chan->cleanup_task); ++ set_bit(IOAT_RUN, &chan->state); + ioat1_dma_start_null_desc(ioat); /* give chain to dma device */ + dev_dbg(to_dev(chan), "%s: allocated %d descriptors\n", + __func__, ioat->desccount); + return ioat->desccount; + } + ++void ioat_stop(struct ioat_chan_common *chan) ++{ ++ struct ioatdma_device *device = chan->device; ++ struct pci_dev *pdev = device->pdev; ++ int chan_id = chan_num(chan); ++ struct msix_entry *msix; ++ ++ /* 1/ stop irq from firing tasklets ++ * 2/ stop the tasklet from re-arming irqs ++ */ ++ clear_bit(IOAT_RUN, &chan->state); ++ ++ /* flush inflight interrupts */ ++ switch (device->irq_mode) { ++ case IOAT_MSIX: ++ msix = &device->msix_entries[chan_id]; ++ synchronize_irq(msix->vector); ++ break; ++ case IOAT_MSI: ++ case IOAT_INTX: ++ synchronize_irq(pdev->irq); ++ break; ++ default: ++ break; ++ } ++ ++ /* flush inflight timers */ ++ del_timer_sync(&chan->timer); ++ ++ /* flush inflight tasklet runs */ ++ tasklet_kill(&chan->cleanup_task); ++ ++ /* final cleanup now that everything is quiesced and can't re-arm */ ++ device->cleanup_fn((unsigned long) &chan->common); ++} ++ + /** + * ioat1_dma_free_chan_resources - release all the descriptors + * @chan: the channel to be cleaned +@@ -379,9 +416,7 @@ static void ioat1_dma_free_chan_resources(struct dma_chan *c) + if (ioat->desccount == 0) + return; + +- tasklet_disable(&chan->cleanup_task); +- del_timer_sync(&chan->timer); +- ioat1_cleanup(ioat); ++ ioat_stop(chan); + + /* Delay 100ms after reset to allow internal DMA logic to quiesce + * before removing DMA descriptor resources. +@@ -526,8 +561,11 @@ ioat1_dma_prep_memcpy(struct dma_chan *c, dma_addr_t dma_dest, + static void ioat1_cleanup_event(unsigned long data) + { + struct ioat_dma_chan *ioat = to_ioat_chan((void *) data); ++ struct ioat_chan_common *chan = &ioat->base; + + ioat1_cleanup(ioat); ++ if (!test_bit(IOAT_RUN, &chan->state)) ++ return; + writew(IOAT_CHANCTRL_RUN, ioat->base.reg_base + IOAT_CHANCTRL_OFFSET); + } + +diff --git a/drivers/dma/ioat/dma.h b/drivers/dma/ioat/dma.h +index 54fb7b9ff9aa..a1d78847e5a5 100644 +--- a/drivers/dma/ioat/dma.h ++++ b/drivers/dma/ioat/dma.h +@@ -370,6 +370,7 @@ bool ioat_cleanup_preamble(struct ioat_chan_common *chan, + void ioat_kobject_add(struct ioatdma_device *device, struct kobj_type *type); + void ioat_kobject_del(struct ioatdma_device *device); + int ioat_dma_setup_interrupts(struct ioatdma_device *device); ++void ioat_stop(struct ioat_chan_common *chan); + extern const struct sysfs_ops ioat_sysfs_ops; + extern struct ioat_sysfs_entry ioat_version_attr; + extern struct ioat_sysfs_entry ioat_cap_attr; +diff --git a/drivers/dma/ioat/dma_v2.c b/drivers/dma/ioat/dma_v2.c +index b925e1b1d139..1cd761026d84 100644 +--- a/drivers/dma/ioat/dma_v2.c ++++ b/drivers/dma/ioat/dma_v2.c +@@ -190,8 +190,11 @@ static void ioat2_cleanup(struct ioat2_dma_chan *ioat) + void ioat2_cleanup_event(unsigned long data) + { + struct ioat2_dma_chan *ioat = to_ioat2_chan((void *) data); ++ struct ioat_chan_common *chan = &ioat->base; + + ioat2_cleanup(ioat); ++ if (!test_bit(IOAT_RUN, &chan->state)) ++ return; + writew(IOAT_CHANCTRL_RUN, ioat->base.reg_base + IOAT_CHANCTRL_OFFSET); + } + +@@ -553,10 +556,10 @@ int ioat2_alloc_chan_resources(struct dma_chan *c) + ioat->issued = 0; + ioat->tail = 0; + ioat->alloc_order = order; ++ set_bit(IOAT_RUN, &chan->state); + spin_unlock_bh(&ioat->prep_lock); + spin_unlock_bh(&chan->cleanup_lock); + +- tasklet_enable(&chan->cleanup_task); + ioat2_start_null_desc(ioat); + + /* check that we got off the ground */ +@@ -566,7 +569,6 @@ int ioat2_alloc_chan_resources(struct dma_chan *c) + } while (i++ < 20 && !is_ioat_active(status) && !is_ioat_idle(status)); + + if (is_ioat_active(status) || is_ioat_idle(status)) { +- set_bit(IOAT_RUN, &chan->state); + return 1 << ioat->alloc_order; + } else { + u32 chanerr = readl(chan->reg_base + IOAT_CHANERR_OFFSET); +@@ -809,11 +811,8 @@ void ioat2_free_chan_resources(struct dma_chan *c) + if (!ioat->ring) + return; + +- tasklet_disable(&chan->cleanup_task); +- del_timer_sync(&chan->timer); +- device->cleanup_fn((unsigned long) c); ++ ioat_stop(chan); + device->reset_hw(chan); +- clear_bit(IOAT_RUN, &chan->state); + + spin_lock_bh(&chan->cleanup_lock); + spin_lock_bh(&ioat->prep_lock); +diff --git a/drivers/dma/ioat/dma_v3.c b/drivers/dma/ioat/dma_v3.c +index fa43a42ccc86..38b94b393c6c 100644 +--- a/drivers/dma/ioat/dma_v3.c ++++ b/drivers/dma/ioat/dma_v3.c +@@ -635,8 +635,11 @@ static void ioat3_cleanup(struct ioat2_dma_chan *ioat) + static void ioat3_cleanup_event(unsigned long data) + { + struct ioat2_dma_chan *ioat = to_ioat2_chan((void *) data); ++ struct ioat_chan_common *chan = &ioat->base; + + ioat3_cleanup(ioat); ++ if (!test_bit(IOAT_RUN, &chan->state)) ++ return; + writew(IOAT_CHANCTRL_RUN, ioat->base.reg_base + IOAT_CHANCTRL_OFFSET); + } + +diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c +index 71bf4ec300ea..ca78044df4b5 100644 +--- a/drivers/dma/ste_dma40.c ++++ b/drivers/dma/ste_dma40.c +@@ -1587,6 +1587,7 @@ static void dma_tasklet(unsigned long data) + struct d40_chan *d40c = (struct d40_chan *) data; + struct d40_desc *d40d; + unsigned long flags; ++ bool callback_active; + dma_async_tx_callback callback; + void *callback_param; + +@@ -1614,6 +1615,7 @@ static void dma_tasklet(unsigned long data) + } + + /* Callback to client */ ++ callback_active = !!(d40d->txd.flags & DMA_PREP_INTERRUPT); + callback = d40d->txd.callback; + callback_param = d40d->txd.callback_param; + +@@ -1636,7 +1638,7 @@ static void dma_tasklet(unsigned long data) + + spin_unlock_irqrestore(&d40c->lock, flags); + +- if (callback && (d40d->txd.flags & DMA_PREP_INTERRUPT)) ++ if (callback_active && callback) + callback(callback_param); + + return; +diff --git a/drivers/edac/i7300_edac.c b/drivers/edac/i7300_edac.c +index 9004c64b169e..841eee387478 100644 +--- a/drivers/edac/i7300_edac.c ++++ b/drivers/edac/i7300_edac.c +@@ -943,33 +943,35 @@ static int i7300_get_devices(struct mem_ctl_info *mci) + + /* Attempt to 'get' the MCH register we want */ + pdev = NULL; +- while (!pvt->pci_dev_16_1_fsb_addr_map || +- !pvt->pci_dev_16_2_fsb_err_regs) { +- pdev = pci_get_device(PCI_VENDOR_ID_INTEL, +- PCI_DEVICE_ID_INTEL_I7300_MCH_ERR, pdev); +- if (!pdev) { +- /* End of list, leave */ +- i7300_printk(KERN_ERR, +- "'system address,Process Bus' " +- "device not found:" +- "vendor 0x%x device 0x%x ERR funcs " +- "(broken BIOS?)\n", +- PCI_VENDOR_ID_INTEL, +- PCI_DEVICE_ID_INTEL_I7300_MCH_ERR); +- goto error; +- } +- ++ while ((pdev = pci_get_device(PCI_VENDOR_ID_INTEL, ++ PCI_DEVICE_ID_INTEL_I7300_MCH_ERR, ++ pdev))) { + /* Store device 16 funcs 1 and 2 */ + switch (PCI_FUNC(pdev->devfn)) { + case 1: +- pvt->pci_dev_16_1_fsb_addr_map = pdev; ++ if (!pvt->pci_dev_16_1_fsb_addr_map) ++ pvt->pci_dev_16_1_fsb_addr_map = ++ pci_dev_get(pdev); + break; + case 2: +- pvt->pci_dev_16_2_fsb_err_regs = pdev; ++ if (!pvt->pci_dev_16_2_fsb_err_regs) ++ pvt->pci_dev_16_2_fsb_err_regs = ++ pci_dev_get(pdev); + break; + } + } + ++ if (!pvt->pci_dev_16_1_fsb_addr_map || ++ !pvt->pci_dev_16_2_fsb_err_regs) { ++ /* At least one device was not found */ ++ i7300_printk(KERN_ERR, ++ "'system address,Process Bus' device not found:" ++ "vendor 0x%x device 0x%x ERR funcs (broken BIOS?)\n", ++ PCI_VENDOR_ID_INTEL, ++ PCI_DEVICE_ID_INTEL_I7300_MCH_ERR); ++ goto error; ++ } ++ + edac_dbg(1, "System Address, processor bus- PCI Bus ID: %s %x:%x\n", + pci_name(pvt->pci_dev_16_0_fsb_ctlr), + pvt->pci_dev_16_0_fsb_ctlr->vendor, +diff --git a/drivers/edac/i7core_edac.c b/drivers/edac/i7core_edac.c +index 0ec3e95a12cd..271818a5a33a 100644 +--- a/drivers/edac/i7core_edac.c ++++ b/drivers/edac/i7core_edac.c +@@ -1334,14 +1334,19 @@ static int i7core_get_onedevice(struct pci_dev **prev, + * is at addr 8086:2c40, instead of 8086:2c41. So, we need + * to probe for the alternate address in case of failure + */ +- if (dev_descr->dev_id == PCI_DEVICE_ID_INTEL_I7_NONCORE && !pdev) ++ if (dev_descr->dev_id == PCI_DEVICE_ID_INTEL_I7_NONCORE && !pdev) { ++ pci_dev_get(*prev); /* pci_get_device will put it */ + pdev = pci_get_device(PCI_VENDOR_ID_INTEL, + PCI_DEVICE_ID_INTEL_I7_NONCORE_ALT, *prev); ++ } + +- if (dev_descr->dev_id == PCI_DEVICE_ID_INTEL_LYNNFIELD_NONCORE && !pdev) ++ if (dev_descr->dev_id == PCI_DEVICE_ID_INTEL_LYNNFIELD_NONCORE && ++ !pdev) { ++ pci_dev_get(*prev); /* pci_get_device will put it */ + pdev = pci_get_device(PCI_VENDOR_ID_INTEL, + PCI_DEVICE_ID_INTEL_LYNNFIELD_NONCORE_ALT, + *prev); ++ } + + if (!pdev) { + if (*prev) { +diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c b/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c +index 5680d3eb11ca..4b7d4343f4ac 100644 +--- a/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c ++++ b/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c +@@ -1112,7 +1112,7 @@ nv50_disp_intr_unk20_2(struct nv50_disp_priv *priv, int head) + if (conf != ~0) { + if (outp.location == 0 && outp.type == DCB_OUTPUT_DP) { + u32 soff = (ffs(outp.or) - 1) * 0x08; +- u32 ctrl = nv_rd32(priv, 0x610798 + soff); ++ u32 ctrl = nv_rd32(priv, 0x610794 + soff); + u32 datarate; + + switch ((ctrl & 0x000f0000) >> 16) { +diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c +index 383f4e6ea9d1..4598a6afea1e 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_drm.c ++++ b/drivers/gpu/drm/nouveau/nouveau_drm.c +@@ -339,6 +339,8 @@ nouveau_drm_load(struct drm_device *dev, unsigned long flags) + if (ret) + goto fail_device; + ++ dev->irq_enabled = true; ++ + /* workaround an odd issue on nvc1 by disabling the device's + * nosnoop capability. hopefully won't cause issues until a + * better fix is found - assuming there is one... +@@ -426,6 +428,7 @@ nouveau_drm_remove(struct pci_dev *pdev) + struct nouveau_drm *drm = nouveau_drm(dev); + struct nouveau_object *device; + ++ dev->irq_enabled = false; + device = drm->client.base.device; + drm_put_dev(dev); + +diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c +index 50684dc6ffdf..a56d0199e334 100644 +--- a/drivers/gpu/drm/radeon/atombios_crtc.c ++++ b/drivers/gpu/drm/radeon/atombios_crtc.c +@@ -1661,6 +1661,20 @@ static int radeon_atom_pick_pll(struct drm_crtc *crtc) + return ATOM_PPLL1; + DRM_ERROR("unable to allocate a PPLL\n"); + return ATOM_PPLL_INVALID; ++ } else if (ASIC_IS_DCE41(rdev)) { ++ /* Don't share PLLs on DCE4.1 chips */ ++ if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(radeon_crtc->encoder))) { ++ if (rdev->clock.dp_extclk) ++ /* skip PPLL programming if using ext clock */ ++ return ATOM_PPLL_INVALID; ++ } ++ pll_in_use = radeon_get_pll_use_mask(crtc); ++ if (!(pll_in_use & (1 << ATOM_PPLL1))) ++ return ATOM_PPLL1; ++ if (!(pll_in_use & (1 << ATOM_PPLL2))) ++ return ATOM_PPLL2; ++ DRM_ERROR("unable to allocate a PPLL\n"); ++ return ATOM_PPLL_INVALID; + } else if (ASIC_IS_DCE4(rdev)) { + /* in DP mode, the DP ref clock can come from PPLL, DCPLL, or ext clock, + * depending on the asic: +@@ -1688,7 +1702,7 @@ static int radeon_atom_pick_pll(struct drm_crtc *crtc) + if (pll != ATOM_PPLL_INVALID) + return pll; + } +- } else if (!ASIC_IS_DCE41(rdev)) { /* Don't share PLLs on DCE4.1 chips */ ++ } else { + /* use the same PPLL for all monitors with the same clock */ + pll = radeon_get_shared_nondp_ppll(crtc); + if (pll != ATOM_PPLL_INVALID) +diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c +index d96070bf8388..cbb06d7c89b5 100644 +--- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c ++++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c +@@ -215,7 +215,8 @@ static int radeon_atpx_verify_interface(struct radeon_atpx *atpx) + memcpy(&output, info->buffer.pointer, size); + + /* TODO: check version? */ +- printk("ATPX version %u\n", output.version); ++ printk("ATPX version %u, functions 0x%08x\n", ++ output.version, output.function_bits); + + radeon_atpx_parse_functions(&atpx->functions, output.function_bits); + +diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c +index 7e292d899209..1113e8f69137 100644 +--- a/drivers/gpu/drm/radeon/radeon_kms.c ++++ b/drivers/gpu/drm/radeon/radeon_kms.c +@@ -485,6 +485,10 @@ int radeon_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv) + + radeon_vm_init(rdev, &fpriv->vm); + ++ r = radeon_bo_reserve(rdev->ring_tmp_bo.bo, false); ++ if (r) ++ return r; ++ + /* map the ib pool buffer read only into + * virtual address space */ + bo_va = radeon_vm_bo_add(rdev, &fpriv->vm, +@@ -492,6 +496,8 @@ int radeon_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv) + r = radeon_vm_bo_set_addr(rdev, bo_va, RADEON_VA_IB_OFFSET, + RADEON_VM_PAGE_READABLE | + RADEON_VM_PAGE_SNOOPED); ++ ++ radeon_bo_unreserve(rdev->ring_tmp_bo.bo); + if (r) { + radeon_vm_fini(rdev, &fpriv->vm); + kfree(fpriv); +diff --git a/drivers/hwmon/max1668.c b/drivers/hwmon/max1668.c +index a7626358c95d..029b65e6c589 100644 +--- a/drivers/hwmon/max1668.c ++++ b/drivers/hwmon/max1668.c +@@ -243,7 +243,7 @@ static ssize_t set_temp_min(struct device *dev, + data->temp_min[index] = clamp_val(temp/1000, -128, 127); + if (i2c_smbus_write_byte_data(client, + MAX1668_REG_LIML_WR(index), +- data->temp_max[index])) ++ data->temp_min[index])) + count = -EIO; + mutex_unlock(&data->update_lock); + +diff --git a/drivers/iio/gyro/Kconfig b/drivers/iio/gyro/Kconfig +index 6be4628faffe..107cafcb89da 100644 +--- a/drivers/iio/gyro/Kconfig ++++ b/drivers/iio/gyro/Kconfig +@@ -50,7 +50,7 @@ config IIO_ST_GYRO_3AXIS + select IIO_ST_GYRO_BUFFER if (IIO_TRIGGERED_BUFFER) + help + Say yes here to build support for STMicroelectronics gyroscopes: +- L3G4200D, LSM330DL, L3GD20, L3GD20H, LSM330DLC, L3G4IS, LSM330. ++ L3G4200D, LSM330DL, L3GD20, LSM330DLC, L3G4IS, LSM330. + + This driver can also be built as a module. If so, will be created + these modules: +diff --git a/drivers/iio/gyro/st_gyro.h b/drivers/iio/gyro/st_gyro.h +index 3ad9907bb154..25ee236b1bb2 100644 +--- a/drivers/iio/gyro/st_gyro.h ++++ b/drivers/iio/gyro/st_gyro.h +@@ -19,7 +19,6 @@ + #define LSM330DL_GYRO_DEV_NAME "lsm330dl_gyro" + #define LSM330DLC_GYRO_DEV_NAME "lsm330dlc_gyro" + #define L3GD20_GYRO_DEV_NAME "l3gd20" +-#define L3GD20H_GYRO_DEV_NAME "l3gd20h" + #define L3G4IS_GYRO_DEV_NAME "l3g4is_ui" + #define LSM330_GYRO_DEV_NAME "lsm330_gyro" + +diff --git a/drivers/iio/gyro/st_gyro_core.c b/drivers/iio/gyro/st_gyro_core.c +index fa9b24219987..1fabc3ffe7ee 100644 +--- a/drivers/iio/gyro/st_gyro_core.c ++++ b/drivers/iio/gyro/st_gyro_core.c +@@ -162,11 +162,10 @@ static const struct st_sensors st_gyro_sensors[] = { + .wai = ST_GYRO_2_WAI_EXP, + .sensors_supported = { + [0] = L3GD20_GYRO_DEV_NAME, +- [1] = L3GD20H_GYRO_DEV_NAME, +- [2] = LSM330D_GYRO_DEV_NAME, +- [3] = LSM330DLC_GYRO_DEV_NAME, +- [4] = L3G4IS_GYRO_DEV_NAME, +- [5] = LSM330_GYRO_DEV_NAME, ++ [1] = LSM330D_GYRO_DEV_NAME, ++ [2] = LSM330DLC_GYRO_DEV_NAME, ++ [3] = L3G4IS_GYRO_DEV_NAME, ++ [4] = LSM330_GYRO_DEV_NAME, + }, + .ch = (struct iio_chan_spec *)st_gyro_16bit_channels, + .odr = { +diff --git a/drivers/iio/gyro/st_gyro_i2c.c b/drivers/iio/gyro/st_gyro_i2c.c +index 8a310500573d..c1755ce2da30 100644 +--- a/drivers/iio/gyro/st_gyro_i2c.c ++++ b/drivers/iio/gyro/st_gyro_i2c.c +@@ -61,7 +61,6 @@ static const struct i2c_device_id st_gyro_id_table[] = { + { LSM330DL_GYRO_DEV_NAME }, + { LSM330DLC_GYRO_DEV_NAME }, + { L3GD20_GYRO_DEV_NAME }, +- { L3GD20H_GYRO_DEV_NAME }, + { L3G4IS_GYRO_DEV_NAME }, + { LSM330_GYRO_DEV_NAME }, + {}, +diff --git a/drivers/iio/gyro/st_gyro_spi.c b/drivers/iio/gyro/st_gyro_spi.c +index f3540390eb22..b37fc9e07706 100644 +--- a/drivers/iio/gyro/st_gyro_spi.c ++++ b/drivers/iio/gyro/st_gyro_spi.c +@@ -60,7 +60,6 @@ static const struct spi_device_id st_gyro_id_table[] = { + { LSM330DL_GYRO_DEV_NAME }, + { LSM330DLC_GYRO_DEV_NAME }, + { L3GD20_GYRO_DEV_NAME }, +- { L3GD20H_GYRO_DEV_NAME }, + { L3G4IS_GYRO_DEV_NAME }, + { LSM330_GYRO_DEV_NAME }, + {}, +diff --git a/drivers/input/misc/arizona-haptics.c b/drivers/input/misc/arizona-haptics.c +index 7a04f54ef961..e7e12a5f5c2d 100644 +--- a/drivers/input/misc/arizona-haptics.c ++++ b/drivers/input/misc/arizona-haptics.c +@@ -77,16 +77,14 @@ static void arizona_haptics_work(struct work_struct *work) + return; + } + ++ mutex_unlock(dapm_mutex); ++ + ret = snd_soc_dapm_sync(arizona->dapm); + if (ret != 0) { + dev_err(arizona->dev, "Failed to sync DAPM: %d\n", + ret); +- mutex_unlock(dapm_mutex); + return; + } +- +- mutex_unlock(dapm_mutex); +- + } else { + /* This disable sequence will be a noop if already enabled */ + mutex_lock_nested(dapm_mutex, SND_SOC_DAPM_CLASS_RUNTIME); +@@ -99,16 +97,15 @@ static void arizona_haptics_work(struct work_struct *work) + return; + } + ++ mutex_unlock(dapm_mutex); ++ + ret = snd_soc_dapm_sync(arizona->dapm); + if (ret != 0) { + dev_err(arizona->dev, "Failed to sync DAPM: %d\n", + ret); +- mutex_unlock(dapm_mutex); + return; + } + +- mutex_unlock(dapm_mutex); +- + ret = regmap_update_bits(arizona->regmap, + ARIZONA_HAPTICS_CONTROL_1, + ARIZONA_HAP_CTRL_MASK, +diff --git a/drivers/irqchip/irq-metag-ext.c b/drivers/irqchip/irq-metag-ext.c +index 92c41ab4dbfd..2cb474ad8809 100644 +--- a/drivers/irqchip/irq-metag-ext.c ++++ b/drivers/irqchip/irq-metag-ext.c +@@ -515,7 +515,7 @@ static int meta_intc_set_affinity(struct irq_data *data, + * one cpu (the interrupt code doesn't support it), so we just + * pick the first cpu we find in 'cpumask'. + */ +- cpu = cpumask_any(cpumask); ++ cpu = cpumask_any_and(cpumask, cpu_online_mask); + thread = cpu_2_hwthread_id[cpu]; + + metag_out32(TBI_TRIG_VEC(TBID_SIGNUM_TR2(thread)), vec_addr); +diff --git a/drivers/irqchip/irq-metag.c b/drivers/irqchip/irq-metag.c +index 8e94d7a3b20d..c16c186d97d3 100644 +--- a/drivers/irqchip/irq-metag.c ++++ b/drivers/irqchip/irq-metag.c +@@ -201,7 +201,7 @@ static int metag_internal_irq_set_affinity(struct irq_data *data, + * one cpu (the interrupt code doesn't support it), so we just + * pick the first cpu we find in 'cpumask'. + */ +- cpu = cpumask_any(cpumask); ++ cpu = cpumask_any_and(cpumask, cpu_online_mask); + thread = cpu_2_hwthread_id[cpu]; + + metag_out32(TBI_TRIG_VEC(TBID_SIGNUM_TR1(thread)), +diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c +index eb7ddb20fd48..0ba21b0f3972 100644 +--- a/drivers/md/dm-mpath.c ++++ b/drivers/md/dm-mpath.c +@@ -1608,8 +1608,11 @@ static int multipath_ioctl(struct dm_target *ti, unsigned int cmd, + /* + * Only pass ioctls through if the device sizes match exactly. + */ +- if (!r && ti->len != i_size_read(bdev->bd_inode) >> SECTOR_SHIFT) +- r = scsi_verify_blk_ioctl(NULL, cmd); ++ if (!bdev || ti->len != i_size_read(bdev->bd_inode) >> SECTOR_SHIFT) { ++ int err = scsi_verify_blk_ioctl(NULL, cmd); ++ if (err) ++ r = err; ++ } + + if (r == -ENOTCONN && !fatal_signal_pending(current)) + queue_work(kmultipathd, &m->process_queued_ios); +diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c +index 33ac3be2e836..5f49d704f275 100644 +--- a/drivers/md/dm-thin-metadata.c ++++ b/drivers/md/dm-thin-metadata.c +@@ -1489,6 +1489,23 @@ bool dm_thin_changed_this_transaction(struct dm_thin_device *td) + return r; + } + ++bool dm_pool_changed_this_transaction(struct dm_pool_metadata *pmd) ++{ ++ bool r = false; ++ struct dm_thin_device *td, *tmp; ++ ++ down_read(&pmd->root_lock); ++ list_for_each_entry_safe(td, tmp, &pmd->thin_devices, list) { ++ if (td->changed) { ++ r = td->changed; ++ break; ++ } ++ } ++ up_read(&pmd->root_lock); ++ ++ return r; ++} ++ + bool dm_thin_aborted_changes(struct dm_thin_device *td) + { + bool r; +diff --git a/drivers/md/dm-thin-metadata.h b/drivers/md/dm-thin-metadata.h +index 125c09444019..8f4d62baf09b 100644 +--- a/drivers/md/dm-thin-metadata.h ++++ b/drivers/md/dm-thin-metadata.h +@@ -161,6 +161,8 @@ int dm_thin_remove_block(struct dm_thin_device *td, dm_block_t block); + */ + bool dm_thin_changed_this_transaction(struct dm_thin_device *td); + ++bool dm_pool_changed_this_transaction(struct dm_pool_metadata *pmd); ++ + bool dm_thin_aborted_changes(struct dm_thin_device *td); + + int dm_thin_get_highest_mapped_block(struct dm_thin_device *td, +diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c +index 73c76c565a4d..901aac27e522 100644 +--- a/drivers/md/dm-thin.c ++++ b/drivers/md/dm-thin.c +@@ -1344,7 +1344,8 @@ static void process_deferred_bios(struct pool *pool) + bio_list_init(&pool->deferred_flush_bios); + spin_unlock_irqrestore(&pool->lock, flags); + +- if (bio_list_empty(&bios) && !need_commit_due_to_time(pool)) ++ if (bio_list_empty(&bios) && ++ !(dm_pool_changed_this_transaction(pool->pmd) && need_commit_due_to_time(pool))) + return; + + if (commit_or_fallback(pool)) { +@@ -2783,6 +2784,7 @@ static int thin_ctr(struct dm_target *ti, unsigned argc, char **argv) + + if (get_pool_mode(tc->pool) == PM_FAIL) { + ti->error = "Couldn't open thin device, Pool is in fail mode"; ++ r = -EINVAL; + goto bad_thin_open; + } + +@@ -2794,7 +2796,7 @@ static int thin_ctr(struct dm_target *ti, unsigned argc, char **argv) + + r = dm_set_target_max_io_len(ti, tc->pool->sectors_per_block); + if (r) +- goto bad_thin_open; ++ goto bad_target_max_io_len; + + ti->num_flush_bios = 1; + ti->flush_supported = true; +@@ -2815,6 +2817,8 @@ static int thin_ctr(struct dm_target *ti, unsigned argc, char **argv) + + return 0; + ++bad_target_max_io_len: ++ dm_pool_close_thin_device(tc->td); + bad_thin_open: + __pool_dec(tc->pool); + bad_pool_lookup: +diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c +index 957fb36c7eb3..0bb2aa2c6fb0 100644 +--- a/drivers/misc/mei/client.c ++++ b/drivers/misc/mei/client.c +@@ -664,7 +664,6 @@ int mei_cl_read_start(struct mei_cl *cl, size_t length) + goto err; + + cb->fop_type = MEI_FOP_READ; +- cl->read_cb = cb; + if (dev->hbuf_is_ready) { + dev->hbuf_is_ready = false; + if (mei_hbm_cl_flow_control_req(dev, cl)) { +@@ -675,6 +674,9 @@ int mei_cl_read_start(struct mei_cl *cl, size_t length) + } else { + list_add_tail(&cb->list, &dev->ctrl_wr_list.list); + } ++ ++ cl->read_cb = cb; ++ + return rets; + err: + mei_io_cb_free(cb); +diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c +index 390061d09693..00c6c089b935 100644 +--- a/drivers/net/bonding/bond_3ad.c ++++ b/drivers/net/bonding/bond_3ad.c +@@ -1854,8 +1854,6 @@ void bond_3ad_initiate_agg_selection(struct bonding *bond, int timeout) + BOND_AD_INFO(bond).agg_select_timer = timeout; + } + +-static u16 aggregator_identifier; +- + /** + * bond_3ad_initialize - initialize a bond's 802.3ad parameters and structures + * @bond: bonding struct to work on +@@ -1869,7 +1867,7 @@ void bond_3ad_initialize(struct bonding *bond, u16 tick_resolution) + if (MAC_ADDRESS_COMPARE(&(BOND_AD_INFO(bond).system.sys_mac_addr), + bond->dev->dev_addr)) { + +- aggregator_identifier = 0; ++ BOND_AD_INFO(bond).aggregator_identifier = 0; + + BOND_AD_INFO(bond).system.sys_priority = 0xFFFF; + BOND_AD_INFO(bond).system.sys_mac_addr = *((struct mac_addr *)bond->dev->dev_addr); +@@ -1940,7 +1938,7 @@ int bond_3ad_bind_slave(struct slave *slave) + ad_initialize_agg(aggregator); + + aggregator->aggregator_mac_address = *((struct mac_addr *)bond->dev->dev_addr); +- aggregator->aggregator_identifier = (++aggregator_identifier); ++ aggregator->aggregator_identifier = ++BOND_AD_INFO(bond).aggregator_identifier; + aggregator->slave = slave; + aggregator->is_active = 0; + aggregator->num_of_ports = 0; +diff --git a/drivers/net/bonding/bond_3ad.h b/drivers/net/bonding/bond_3ad.h +index 5d91ad0cc041..1f081c89753f 100644 +--- a/drivers/net/bonding/bond_3ad.h ++++ b/drivers/net/bonding/bond_3ad.h +@@ -253,6 +253,7 @@ struct ad_system { + struct ad_bond_info { + struct ad_system system; /* 802.3ad system structure */ + u32 agg_select_timer; // Timer to select aggregator after all adapter's hand shakes ++ u16 aggregator_identifier; + }; + + struct ad_slave_info { +diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c +index 1870c4731a57..539239d8e9ab 100644 +--- a/drivers/net/can/dev.c ++++ b/drivers/net/can/dev.c +@@ -324,19 +324,10 @@ void can_put_echo_skb(struct sk_buff *skb, struct net_device *dev, + } + + if (!priv->echo_skb[idx]) { +- struct sock *srcsk = skb->sk; + +- if (atomic_read(&skb->users) != 1) { +- struct sk_buff *old_skb = skb; +- +- skb = skb_clone(old_skb, GFP_ATOMIC); +- kfree_skb(old_skb); +- if (!skb) +- return; +- } else +- skb_orphan(skb); +- +- skb->sk = srcsk; ++ skb = can_create_echo_skb(skb); ++ if (!skb) ++ return; + + /* make settings for echo to reduce code in irq context */ + skb->protocol = htons(ETH_P_CAN); +diff --git a/drivers/net/can/janz-ican3.c b/drivers/net/can/janz-ican3.c +index c4bc1d2e2033..b08383f485a5 100644 +--- a/drivers/net/can/janz-ican3.c ++++ b/drivers/net/can/janz-ican3.c +@@ -19,6 +19,7 @@ + #include + #include + #include ++#include + #include + + #include +@@ -1134,20 +1135,9 @@ static void ican3_handle_message(struct ican3_dev *mod, struct ican3_msg *msg) + */ + static void ican3_put_echo_skb(struct ican3_dev *mod, struct sk_buff *skb) + { +- struct sock *srcsk = skb->sk; +- +- if (atomic_read(&skb->users) != 1) { +- struct sk_buff *old_skb = skb; +- +- skb = skb_clone(old_skb, GFP_ATOMIC); +- kfree_skb(old_skb); +- if (!skb) +- return; +- } else { +- skb_orphan(skb); +- } +- +- skb->sk = srcsk; ++ skb = can_create_echo_skb(skb); ++ if (!skb) ++ return; + + /* save this skb for tx interrupt echo handling */ + skb_queue_tail(&mod->echoq, skb); +diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c +index 4b2d5ed62b11..cc3df8aebb87 100644 +--- a/drivers/net/can/usb/kvaser_usb.c ++++ b/drivers/net/can/usb/kvaser_usb.c +@@ -474,6 +474,8 @@ static int kvaser_usb_get_card_info(struct kvaser_usb *dev) + return err; + + dev->nchannels = msg.u.cardinfo.nchannels; ++ if (dev->nchannels > MAX_NET_DEVICES) ++ return -EINVAL; + + return 0; + } +diff --git a/drivers/net/can/vcan.c b/drivers/net/can/vcan.c +index 0a2a5ee79a17..4e94057ef5cf 100644 +--- a/drivers/net/can/vcan.c ++++ b/drivers/net/can/vcan.c +@@ -46,6 +46,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -109,25 +110,23 @@ static netdev_tx_t vcan_tx(struct sk_buff *skb, struct net_device *dev) + stats->rx_packets++; + stats->rx_bytes += cfd->len; + } +- kfree_skb(skb); ++ consume_skb(skb); + return NETDEV_TX_OK; + } + + /* perform standard echo handling for CAN network interfaces */ + + if (loop) { +- struct sock *srcsk = skb->sk; + +- skb = skb_share_check(skb, GFP_ATOMIC); ++ skb = can_create_echo_skb(skb); + if (!skb) + return NETDEV_TX_OK; + + /* receive with packet counting */ +- skb->sk = srcsk; + vcan_rx(skb, dev); + } else { + /* no looped packets => no counting */ +- kfree_skb(skb); ++ consume_skb(skb); + } + return NETDEV_TX_OK; + } +diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c +index 11ae0811e4bf..68e9dc453e11 100644 +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -13777,12 +13777,12 @@ static int tg3_change_mtu(struct net_device *dev, int new_mtu) + + tg3_netif_stop(tp); + ++ tg3_set_mtu(dev, tp, new_mtu); ++ + tg3_full_lock(tp, 1); + + tg3_halt(tp, RESET_KIND_SHUTDOWN, 1); + +- tg3_set_mtu(dev, tp, new_mtu); +- + /* Reset PHY, otherwise the read DMA engine will be in a mode that + * breaks all requests to 256 bytes. + */ +diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c +index ad5d1e4384db..97b5de7aebdb 100644 +--- a/drivers/net/usb/asix_devices.c ++++ b/drivers/net/usb/asix_devices.c +@@ -915,7 +915,8 @@ static const struct driver_info ax88178_info = { + .status = asix_status, + .link_reset = ax88178_link_reset, + .reset = ax88178_reset, +- .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_LINK_INTR, ++ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_LINK_INTR | ++ FLAG_MULTI_PACKET, + .rx_fixup = asix_rx_fixup_common, + .tx_fixup = asix_tx_fixup, + }; +diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c +index cea1f3d0311b..d33c3ae2fcea 100644 +--- a/drivers/net/usb/ax88179_178a.c ++++ b/drivers/net/usb/ax88179_178a.c +@@ -1109,6 +1109,10 @@ static int ax88179_rx_fixup(struct usbnet *dev, struct sk_buff *skb) + u16 hdr_off; + u32 *pkt_hdr; + ++ /* This check is no longer done by usbnet */ ++ if (skb->len < dev->net->hard_header_len) ++ return 0; ++ + skb_trim(skb, skb->len - 4); + memcpy(&rx_hdr, skb_tail_pointer(skb), 4); + le32_to_cpus(&rx_hdr); +diff --git a/drivers/net/usb/gl620a.c b/drivers/net/usb/gl620a.c +index a7e3f4e55bf3..82ab61d62804 100644 +--- a/drivers/net/usb/gl620a.c ++++ b/drivers/net/usb/gl620a.c +@@ -86,6 +86,10 @@ static int genelink_rx_fixup(struct usbnet *dev, struct sk_buff *skb) + u32 size; + u32 count; + ++ /* This check is no longer done by usbnet */ ++ if (skb->len < dev->net->hard_header_len) ++ return 0; ++ + header = (struct gl_header *) skb->data; + + // get the packet count of the received skb +diff --git a/drivers/net/usb/mcs7830.c b/drivers/net/usb/mcs7830.c +index 03832d3780aa..9237c45883cd 100644 +--- a/drivers/net/usb/mcs7830.c ++++ b/drivers/net/usb/mcs7830.c +@@ -529,8 +529,9 @@ static int mcs7830_rx_fixup(struct usbnet *dev, struct sk_buff *skb) + { + u8 status; + +- if (skb->len == 0) { +- dev_err(&dev->udev->dev, "unexpected empty rx frame\n"); ++ /* This check is no longer done by usbnet */ ++ if (skb->len < dev->net->hard_header_len) { ++ dev_err(&dev->udev->dev, "unexpected tiny rx frame\n"); + return 0; + } + +diff --git a/drivers/net/usb/net1080.c b/drivers/net/usb/net1080.c +index 93e0716a118c..7f4a3a41c4f8 100644 +--- a/drivers/net/usb/net1080.c ++++ b/drivers/net/usb/net1080.c +@@ -366,6 +366,10 @@ static int net1080_rx_fixup(struct usbnet *dev, struct sk_buff *skb) + struct nc_trailer *trailer; + u16 hdr_len, packet_len; + ++ /* This check is no longer done by usbnet */ ++ if (skb->len < dev->net->hard_header_len) ++ return 0; ++ + if (!(skb->len & 0x01)) { + netdev_dbg(dev->net, "rx framesize %d range %d..%d mtu %d\n", + skb->len, dev->net->hard_header_len, dev->hard_mtu, +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index 34a081f1527f..37d9785974fc 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -80,10 +80,10 @@ static int qmi_wwan_rx_fixup(struct usbnet *dev, struct sk_buff *skb) + { + __be16 proto; + +- /* usbnet rx_complete guarantees that skb->len is at least +- * hard_header_len, so we can inspect the dest address without +- * checking skb->len +- */ ++ /* This check is no longer done by usbnet */ ++ if (skb->len < dev->net->hard_header_len) ++ return 0; ++ + switch (skb->data[0] & 0xf0) { + case 0x40: + proto = htons(ETH_P_IP); +@@ -709,6 +709,7 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x1199, 0x68a2, 8)}, /* Sierra Wireless MC7710 in QMI mode */ + {QMI_FIXED_INTF(0x1199, 0x68a2, 19)}, /* Sierra Wireless MC7710 in QMI mode */ + {QMI_FIXED_INTF(0x1199, 0x901c, 8)}, /* Sierra Wireless EM7700 */ ++ {QMI_FIXED_INTF(0x1199, 0x9051, 8)}, /* Netgear AirCard 340U */ + {QMI_FIXED_INTF(0x1bbb, 0x011e, 4)}, /* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */ + {QMI_FIXED_INTF(0x2357, 0x0201, 4)}, /* TP-LINK HSUPA Modem MA180 */ + {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */ +diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c +index cc49aac70224..691fca4e4c2d 100644 +--- a/drivers/net/usb/rndis_host.c ++++ b/drivers/net/usb/rndis_host.c +@@ -494,6 +494,10 @@ EXPORT_SYMBOL_GPL(rndis_unbind); + */ + int rndis_rx_fixup(struct usbnet *dev, struct sk_buff *skb) + { ++ /* This check is no longer done by usbnet */ ++ if (skb->len < dev->net->hard_header_len) ++ return 0; ++ + /* peripheral may have batched packets to us... */ + while (likely(skb->len)) { + struct rndis_data_hdr *hdr = (void *)skb->data; +diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c +index 66ebbacf066f..12afae0451e6 100644 +--- a/drivers/net/usb/smsc75xx.c ++++ b/drivers/net/usb/smsc75xx.c +@@ -2108,6 +2108,10 @@ static void smsc75xx_rx_csum_offload(struct usbnet *dev, struct sk_buff *skb, + + static int smsc75xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb) + { ++ /* This check is no longer done by usbnet */ ++ if (skb->len < dev->net->hard_header_len) ++ return 0; ++ + while (skb->len > 0) { + u32 rx_cmd_a, rx_cmd_b, align_count, size; + struct sk_buff *ax_skb; +diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c +index 3f38ba868f61..9375b8c6410b 100644 +--- a/drivers/net/usb/smsc95xx.c ++++ b/drivers/net/usb/smsc95xx.c +@@ -1725,6 +1725,10 @@ static void smsc95xx_rx_csum_offload(struct sk_buff *skb) + + static int smsc95xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb) + { ++ /* This check is no longer done by usbnet */ ++ if (skb->len < dev->net->hard_header_len) ++ return 0; ++ + while (skb->len > 0) { + u32 header, align_count; + struct sk_buff *ax_skb; +diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c +index 28f16ed6422d..f6dce4765de4 100644 +--- a/drivers/net/usb/usbnet.c ++++ b/drivers/net/usb/usbnet.c +@@ -517,17 +517,19 @@ static inline void rx_process (struct usbnet *dev, struct sk_buff *skb) + } + // else network stack removes extra byte if we forced a short packet + +- if (skb->len) { +- /* all data was already cloned from skb inside the driver */ +- if (dev->driver_info->flags & FLAG_MULTI_PACKET) +- dev_kfree_skb_any(skb); +- else +- usbnet_skb_return(dev, skb); ++ /* all data was already cloned from skb inside the driver */ ++ if (dev->driver_info->flags & FLAG_MULTI_PACKET) ++ goto done; ++ ++ if (skb->len < ETH_HLEN) { ++ dev->net->stats.rx_errors++; ++ dev->net->stats.rx_length_errors++; ++ netif_dbg(dev, rx_err, dev->net, "rx length %d\n", skb->len); ++ } else { ++ usbnet_skb_return(dev, skb); + return; + } + +- netif_dbg(dev, rx_err, dev->net, "drop\n"); +- dev->net->stats.rx_errors++; + done: + skb_queue_tail(&dev->done, skb); + } +@@ -549,13 +551,6 @@ static void rx_complete (struct urb *urb) + switch (urb_status) { + /* success */ + case 0: +- if (skb->len < dev->net->hard_header_len) { +- state = rx_cleanup; +- dev->net->stats.rx_errors++; +- dev->net->stats.rx_length_errors++; +- netif_dbg(dev, rx_err, dev->net, +- "rx length %d\n", skb->len); +- } + break; + + /* stalls need manual reset. this is rare ... except that +diff --git a/drivers/net/wireless/rtl818x/rtl8187/rtl8187.h b/drivers/net/wireless/rtl818x/rtl8187/rtl8187.h +index e19a20a8e955..ecd1ac424047 100644 +--- a/drivers/net/wireless/rtl818x/rtl8187/rtl8187.h ++++ b/drivers/net/wireless/rtl818x/rtl8187/rtl8187.h +@@ -15,6 +15,8 @@ + #ifndef RTL8187_H + #define RTL8187_H + ++#include ++ + #include "rtl818x.h" + #include "leds.h" + +@@ -139,7 +141,10 @@ struct rtl8187_priv { + u8 aifsn[4]; + u8 rfkill_mask; + struct { +- __le64 buf; ++ union { ++ __le64 buf; ++ u8 dummy1[L1_CACHE_BYTES]; ++ } ____cacheline_aligned; + struct sk_buff_head queue; + } b_tx_status; /* This queue is used by both -b and non-b devices */ + struct mutex io_mutex; +@@ -147,7 +152,8 @@ struct rtl8187_priv { + u8 bits8; + __le16 bits16; + __le32 bits32; +- } *io_dmabuf; ++ u8 dummy2[L1_CACHE_BYTES]; ++ } *io_dmabuf ____cacheline_aligned; + bool rfkill_off; + u16 seqno; + }; +diff --git a/drivers/net/wireless/rtlwifi/ps.c b/drivers/net/wireless/rtlwifi/ps.c +index 71e917db8338..ace1a087fe8a 100644 +--- a/drivers/net/wireless/rtlwifi/ps.c ++++ b/drivers/net/wireless/rtlwifi/ps.c +@@ -48,7 +48,7 @@ bool rtl_ps_enable_nic(struct ieee80211_hw *hw) + + /*<2> Enable Adapter */ + if (rtlpriv->cfg->ops->hw_init(hw)) +- return 1; ++ return false; + RT_CLEAR_PS_LEVEL(ppsc, RT_RF_OFF_LEVL_HALT_NIC); + + /*<3> Enable Interrupt */ +diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c +index a82b30a1996c..2eb0b38384dd 100644 +--- a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c +@@ -937,14 +937,26 @@ int rtl92ce_hw_init(struct ieee80211_hw *hw) + bool is92c; + int err; + u8 tmp_u1b; ++ unsigned long flags; + + rtlpci->being_init_adapter = true; ++ ++ /* Since this function can take a very long time (up to 350 ms) ++ * and can be called with irqs disabled, reenable the irqs ++ * to let the other devices continue being serviced. ++ * ++ * It is safe doing so since our own interrupts will only be enabled ++ * in a subsequent step. ++ */ ++ local_save_flags(flags); ++ local_irq_enable(); ++ + rtlpriv->intf_ops->disable_aspm(hw); + rtstatus = _rtl92ce_init_mac(hw); + if (!rtstatus) { + RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "Init MAC failed\n"); + err = 1; +- return err; ++ goto exit; + } + + err = rtl92c_download_fw(hw); +@@ -952,7 +964,7 @@ int rtl92ce_hw_init(struct ieee80211_hw *hw) + RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, + "Failed to download FW. Init HW without FW now..\n"); + err = 1; +- return err; ++ goto exit; + } + + rtlhal->last_hmeboxnum = 0; +@@ -1032,6 +1044,8 @@ int rtl92ce_hw_init(struct ieee80211_hw *hw) + RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE, "under 1.5V\n"); + } + rtl92c_dm_init(hw); ++exit: ++ local_irq_restore(flags); + rtlpci->being_init_adapter = false; + return err; + } +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index a899d8bb190d..0bb7bfd49bf6 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -1119,6 +1119,8 @@ EXPORT_SYMBOL_GPL(pci_load_and_free_saved_state); + static int do_pci_enable_device(struct pci_dev *dev, int bars) + { + int err; ++ u16 cmd; ++ u8 pin; + + err = pci_set_power_state(dev, PCI_D0); + if (err < 0 && err != -EIO) +@@ -1128,6 +1130,14 @@ static int do_pci_enable_device(struct pci_dev *dev, int bars) + return err; + pci_fixup_device(pci_fixup_enable, dev); + ++ pci_read_config_byte(dev, PCI_INTERRUPT_PIN, &pin); ++ if (pin) { ++ pci_read_config_word(dev, PCI_COMMAND, &cmd); ++ if (cmd & PCI_COMMAND_INTX_DISABLE) ++ pci_write_config_word(dev, PCI_COMMAND, ++ cmd & ~PCI_COMMAND_INTX_DISABLE); ++ } ++ + return 0; + } + +diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c +index fcdc22306cab..f033b191a022 100644 +--- a/drivers/scsi/qla2xxx/qla_target.c ++++ b/drivers/scsi/qla2xxx/qla_target.c +@@ -3339,7 +3339,8 @@ restart: + ql_dbg(ql_dbg_tgt_mgt, vha, 0xf02c, + "SRR cmd %p (se_cmd %p, tag %d, op %x), " + "sg_cnt=%d, offset=%d", cmd, &cmd->se_cmd, cmd->tag, +- se_cmd->t_task_cdb[0], cmd->sg_cnt, cmd->offset); ++ se_cmd->t_task_cdb ? se_cmd->t_task_cdb[0] : 0, ++ cmd->sg_cnt, cmd->offset); + + qlt_handle_srr(vha, sctio, imm); + +diff --git a/drivers/staging/android/binder.c b/drivers/staging/android/binder.c +index 1567ac296b39..0fce5fc9923b 100644 +--- a/drivers/staging/android/binder.c ++++ b/drivers/staging/android/binder.c +@@ -2902,7 +2902,7 @@ static int binder_node_release(struct binder_node *node, int refs) + refs++; + + if (!ref->death) +- goto out; ++ continue; + + death++; + +@@ -2915,7 +2915,6 @@ static int binder_node_release(struct binder_node *node, int refs) + BUG(); + } + +-out: + binder_debug(BINDER_DEBUG_DEAD_BINDER, + "node %d now dead, refs %d, death %d\n", + node->debug_id, refs, death); +diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c +index b501346484ae..f1cab425163f 100644 +--- a/drivers/usb/chipidea/udc.c ++++ b/drivers/usb/chipidea/udc.c +@@ -103,7 +103,7 @@ static int hw_ep_flush(struct ci13xxx *ci, int num, int dir) + + do { + /* flush any pending transfer */ +- hw_write(ci, OP_ENDPTFLUSH, BIT(n), BIT(n)); ++ hw_write(ci, OP_ENDPTFLUSH, ~0, BIT(n)); + while (hw_read(ci, OP_ENDPTFLUSH, BIT(n))) + cpu_relax(); + } while (hw_read(ci, OP_ENDPTSTAT, BIT(n))); +@@ -203,7 +203,7 @@ static int hw_ep_prime(struct ci13xxx *ci, int num, int dir, int is_ctrl) + if (is_ctrl && dir == RX && hw_read(ci, OP_ENDPTSETUPSTAT, BIT(num))) + return -EAGAIN; + +- hw_write(ci, OP_ENDPTPRIME, BIT(n), BIT(n)); ++ hw_write(ci, OP_ENDPTPRIME, ~0, BIT(n)); + + while (hw_read(ci, OP_ENDPTPRIME, BIT(n))) + cpu_relax(); +diff --git a/drivers/usb/gadget/bcm63xx_udc.c b/drivers/usb/gadget/bcm63xx_udc.c +index fd24cb4540a4..5396709cdc07 100644 +--- a/drivers/usb/gadget/bcm63xx_udc.c ++++ b/drivers/usb/gadget/bcm63xx_udc.c +@@ -361,24 +361,30 @@ static inline void usb_dma_writel(struct bcm63xx_udc *udc, u32 val, u32 off) + bcm_writel(val, udc->iudma_regs + off); + } + +-static inline u32 usb_dmac_readl(struct bcm63xx_udc *udc, u32 off) ++static inline u32 usb_dmac_readl(struct bcm63xx_udc *udc, u32 off, int chan) + { +- return bcm_readl(udc->iudma_regs + IUDMA_DMAC_OFFSET + off); ++ return bcm_readl(udc->iudma_regs + IUDMA_DMAC_OFFSET + off + ++ (ENETDMA_CHAN_WIDTH * chan)); + } + +-static inline void usb_dmac_writel(struct bcm63xx_udc *udc, u32 val, u32 off) ++static inline void usb_dmac_writel(struct bcm63xx_udc *udc, u32 val, u32 off, ++ int chan) + { +- bcm_writel(val, udc->iudma_regs + IUDMA_DMAC_OFFSET + off); ++ bcm_writel(val, udc->iudma_regs + IUDMA_DMAC_OFFSET + off + ++ (ENETDMA_CHAN_WIDTH * chan)); + } + +-static inline u32 usb_dmas_readl(struct bcm63xx_udc *udc, u32 off) ++static inline u32 usb_dmas_readl(struct bcm63xx_udc *udc, u32 off, int chan) + { +- return bcm_readl(udc->iudma_regs + IUDMA_DMAS_OFFSET + off); ++ return bcm_readl(udc->iudma_regs + IUDMA_DMAS_OFFSET + off + ++ (ENETDMA_CHAN_WIDTH * chan)); + } + +-static inline void usb_dmas_writel(struct bcm63xx_udc *udc, u32 val, u32 off) ++static inline void usb_dmas_writel(struct bcm63xx_udc *udc, u32 val, u32 off, ++ int chan) + { +- bcm_writel(val, udc->iudma_regs + IUDMA_DMAS_OFFSET + off); ++ bcm_writel(val, udc->iudma_regs + IUDMA_DMAS_OFFSET + off + ++ (ENETDMA_CHAN_WIDTH * chan)); + } + + static inline void set_clocks(struct bcm63xx_udc *udc, bool is_enabled) +@@ -639,7 +645,7 @@ static void iudma_write(struct bcm63xx_udc *udc, struct iudma_ch *iudma, + } while (!last_bd); + + usb_dmac_writel(udc, ENETDMAC_CHANCFG_EN_MASK, +- ENETDMAC_CHANCFG_REG(iudma->ch_idx)); ++ ENETDMAC_CHANCFG_REG, iudma->ch_idx); + } + + /** +@@ -695,9 +701,9 @@ static void iudma_reset_channel(struct bcm63xx_udc *udc, struct iudma_ch *iudma) + bcm63xx_fifo_reset_ep(udc, max(0, iudma->ep_num)); + + /* stop DMA, then wait for the hardware to wrap up */ +- usb_dmac_writel(udc, 0, ENETDMAC_CHANCFG_REG(ch_idx)); ++ usb_dmac_writel(udc, 0, ENETDMAC_CHANCFG_REG, ch_idx); + +- while (usb_dmac_readl(udc, ENETDMAC_CHANCFG_REG(ch_idx)) & ++ while (usb_dmac_readl(udc, ENETDMAC_CHANCFG_REG, ch_idx) & + ENETDMAC_CHANCFG_EN_MASK) { + udelay(1); + +@@ -714,10 +720,10 @@ static void iudma_reset_channel(struct bcm63xx_udc *udc, struct iudma_ch *iudma) + dev_warn(udc->dev, "forcibly halting IUDMA channel %d\n", + ch_idx); + usb_dmac_writel(udc, ENETDMAC_CHANCFG_BUFHALT_MASK, +- ENETDMAC_CHANCFG_REG(ch_idx)); ++ ENETDMAC_CHANCFG_REG, ch_idx); + } + } +- usb_dmac_writel(udc, ~0, ENETDMAC_IR_REG(ch_idx)); ++ usb_dmac_writel(udc, ~0, ENETDMAC_IR_REG, ch_idx); + + /* don't leave "live" HW-owned entries for the next guy to step on */ + for (d = iudma->bd_ring; d <= iudma->end_bd; d++) +@@ -729,11 +735,11 @@ static void iudma_reset_channel(struct bcm63xx_udc *udc, struct iudma_ch *iudma) + + /* set up IRQs, UBUS burst size, and BD base for this channel */ + usb_dmac_writel(udc, ENETDMAC_IR_BUFDONE_MASK, +- ENETDMAC_IRMASK_REG(ch_idx)); +- usb_dmac_writel(udc, 8, ENETDMAC_MAXBURST_REG(ch_idx)); ++ ENETDMAC_IRMASK_REG, ch_idx); ++ usb_dmac_writel(udc, 8, ENETDMAC_MAXBURST_REG, ch_idx); + +- usb_dmas_writel(udc, iudma->bd_ring_dma, ENETDMAS_RSTART_REG(ch_idx)); +- usb_dmas_writel(udc, 0, ENETDMAS_SRAM2_REG(ch_idx)); ++ usb_dmas_writel(udc, iudma->bd_ring_dma, ENETDMAS_RSTART_REG, ch_idx); ++ usb_dmas_writel(udc, 0, ENETDMAS_SRAM2_REG, ch_idx); + } + + /** +@@ -2036,7 +2042,7 @@ static irqreturn_t bcm63xx_udc_data_isr(int irq, void *dev_id) + spin_lock(&udc->lock); + + usb_dmac_writel(udc, ENETDMAC_IR_BUFDONE_MASK, +- ENETDMAC_IR_REG(iudma->ch_idx)); ++ ENETDMAC_IR_REG, iudma->ch_idx); + bep = iudma->bep; + rc = iudma_read(udc, iudma); + +@@ -2176,18 +2182,18 @@ static int bcm63xx_iudma_dbg_show(struct seq_file *s, void *p) + seq_printf(s, " [ep%d]:\n", + max_t(int, iudma_defaults[ch_idx].ep_num, 0)); + seq_printf(s, " cfg: %08x; irqstat: %08x; irqmask: %08x; maxburst: %08x\n", +- usb_dmac_readl(udc, ENETDMAC_CHANCFG_REG(ch_idx)), +- usb_dmac_readl(udc, ENETDMAC_IR_REG(ch_idx)), +- usb_dmac_readl(udc, ENETDMAC_IRMASK_REG(ch_idx)), +- usb_dmac_readl(udc, ENETDMAC_MAXBURST_REG(ch_idx))); ++ usb_dmac_readl(udc, ENETDMAC_CHANCFG_REG, ch_idx), ++ usb_dmac_readl(udc, ENETDMAC_IR_REG, ch_idx), ++ usb_dmac_readl(udc, ENETDMAC_IRMASK_REG, ch_idx), ++ usb_dmac_readl(udc, ENETDMAC_MAXBURST_REG, ch_idx)); + +- sram2 = usb_dmas_readl(udc, ENETDMAS_SRAM2_REG(ch_idx)); +- sram3 = usb_dmas_readl(udc, ENETDMAS_SRAM3_REG(ch_idx)); ++ sram2 = usb_dmas_readl(udc, ENETDMAS_SRAM2_REG, ch_idx); ++ sram3 = usb_dmas_readl(udc, ENETDMAS_SRAM3_REG, ch_idx); + seq_printf(s, " base: %08x; index: %04x_%04x; desc: %04x_%04x %08x\n", +- usb_dmas_readl(udc, ENETDMAS_RSTART_REG(ch_idx)), ++ usb_dmas_readl(udc, ENETDMAS_RSTART_REG, ch_idx), + sram2 >> 16, sram2 & 0xffff, + sram3 >> 16, sram3 & 0xffff, +- usb_dmas_readl(udc, ENETDMAS_SRAM4_REG(ch_idx))); ++ usb_dmas_readl(udc, ENETDMAS_SRAM4_REG, ch_idx)); + seq_printf(s, " desc: %d/%d used", iudma->n_bds_used, + iudma->n_bds); + +diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c +index 246e124e6ac5..4518b8189a9e 100644 +--- a/drivers/usb/host/ehci-hcd.c ++++ b/drivers/usb/host/ehci-hcd.c +@@ -686,8 +686,15 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd) + struct ehci_hcd *ehci = hcd_to_ehci (hcd); + u32 status, masked_status, pcd_status = 0, cmd; + int bh; ++ unsigned long flags; + +- spin_lock (&ehci->lock); ++ /* ++ * For threadirqs option we use spin_lock_irqsave() variant to prevent ++ * deadlock with ehci hrtimer callback, because hrtimer callbacks run ++ * in interrupt context even when threadirqs is specified. We can go ++ * back to spin_lock() variant when hrtimer callbacks become threaded. ++ */ ++ spin_lock_irqsave(&ehci->lock, flags); + + status = ehci_readl(ehci, &ehci->regs->status); + +@@ -705,7 +712,7 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd) + + /* Shared IRQ? */ + if (!masked_status || unlikely(ehci->rh_state == EHCI_RH_HALTED)) { +- spin_unlock(&ehci->lock); ++ spin_unlock_irqrestore(&ehci->lock, flags); + return IRQ_NONE; + } + +@@ -823,7 +830,7 @@ dead: + + if (bh) + ehci_work (ehci); +- spin_unlock (&ehci->lock); ++ spin_unlock_irqrestore(&ehci->lock, flags); + if (pcd_status) + usb_hcd_poll_rh_status(hcd); + return IRQ_HANDLED; +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index b7446a69d2a9..b83da38bc915 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -910,6 +910,8 @@ static struct usb_device_id id_table_combined [] = { + /* Crucible Devices */ + { USB_DEVICE(FTDI_VID, FTDI_CT_COMET_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_Z3X_PID) }, ++ /* Cressi Devices */ ++ { USB_DEVICE(FTDI_VID, FTDI_CRESSI_PID) }, + { }, /* Optional parameter entry */ + { } /* Terminating entry */ + }; +diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h +index 1e2d369df86e..e599fbfcde5f 100644 +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -1320,3 +1320,9 @@ + * Manufacturer: Smart GSM Team + */ + #define FTDI_Z3X_PID 0x0011 ++ ++/* ++ * Product: Cressi PC Interface ++ * Manufacturer: Cressi ++ */ ++#define FTDI_CRESSI_PID 0x87d0 +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 216d20affba8..68fc9fe65936 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1526,7 +1526,8 @@ static const struct usb_device_id option_ids[] = { + /* Cinterion */ + { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_E) }, + { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_P) }, +- { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8) }, ++ { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8), ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX) }, + { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PLXX), + .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, +diff --git a/fs/attr.c b/fs/attr.c +index 1449adb14ef6..8dd5825ec708 100644 +--- a/fs/attr.c ++++ b/fs/attr.c +@@ -182,11 +182,6 @@ int notify_change(struct dentry * dentry, struct iattr * attr) + return -EPERM; + } + +- if ((ia_valid & ATTR_SIZE) && IS_I_VERSION(inode)) { +- if (attr->ia_size != inode->i_size) +- inode_inc_iversion(inode); +- } +- + if ((ia_valid & ATTR_MODE)) { + umode_t amode = attr->ia_mode; + /* Flag setting protected by i_mutex */ +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index 25e6a8e1014e..8fcd2424e7f9 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -4527,8 +4527,12 @@ static int btrfs_setsize(struct inode *inode, struct iattr *attr) + * these flags set. For all other operations the VFS set these flags + * explicitly if it wants a timestamp update. + */ +- if (newsize != oldsize && (!(mask & (ATTR_CTIME | ATTR_MTIME)))) +- inode->i_ctime = inode->i_mtime = current_fs_time(inode->i_sb); ++ if (newsize != oldsize) { ++ inode_inc_iversion(inode); ++ if (!(mask & (ATTR_CTIME | ATTR_MTIME))) ++ inode->i_ctime = inode->i_mtime = ++ current_fs_time(inode->i_sb); ++ } + + if (newsize > oldsize) { + truncate_pagecache(inode, oldsize, newsize); +diff --git a/fs/cifs/file.c b/fs/cifs/file.c +index c2934f8701da..8b0c656f2ab2 100644 +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -2353,7 +2353,7 @@ cifs_iovec_write(struct file *file, const struct iovec *iov, + unsigned long nr_segs, loff_t *poffset) + { + unsigned long nr_pages, i; +- size_t copied, len, cur_len; ++ size_t bytes, copied, len, cur_len; + ssize_t total_written = 0; + loff_t offset; + struct iov_iter it; +@@ -2408,14 +2408,45 @@ cifs_iovec_write(struct file *file, const struct iovec *iov, + + save_len = cur_len; + for (i = 0; i < nr_pages; i++) { +- copied = min_t(const size_t, cur_len, PAGE_SIZE); ++ bytes = min_t(const size_t, cur_len, PAGE_SIZE); + copied = iov_iter_copy_from_user(wdata->pages[i], &it, +- 0, copied); ++ 0, bytes); + cur_len -= copied; + iov_iter_advance(&it, copied); ++ /* ++ * If we didn't copy as much as we expected, then that ++ * may mean we trod into an unmapped area. Stop copying ++ * at that point. On the next pass through the big ++ * loop, we'll likely end up getting a zero-length ++ * write and bailing out of it. ++ */ ++ if (copied < bytes) ++ break; + } + cur_len = save_len - cur_len; + ++ /* ++ * If we have no data to send, then that probably means that ++ * the copy above failed altogether. That's most likely because ++ * the address in the iovec was bogus. Set the rc to -EFAULT, ++ * free anything we allocated and bail out. ++ */ ++ if (!cur_len) { ++ for (i = 0; i < nr_pages; i++) ++ put_page(wdata->pages[i]); ++ kfree(wdata); ++ rc = -EFAULT; ++ break; ++ } ++ ++ /* ++ * i + 1 now represents the number of pages we actually used in ++ * the copy phase above. Bring nr_pages down to that, and free ++ * any pages that we didn't use. ++ */ ++ for ( ; nr_pages > i + 1; nr_pages--) ++ put_page(wdata->pages[nr_pages - 1]); ++ + wdata->sync_mode = WB_SYNC_ALL; + wdata->nr_pages = nr_pages; + wdata->offset = (__u64)offset; +diff --git a/fs/cifs/smb2glob.h b/fs/cifs/smb2glob.h +index 7c0e2143e775..cc592ef6584a 100644 +--- a/fs/cifs/smb2glob.h ++++ b/fs/cifs/smb2glob.h +@@ -55,4 +55,7 @@ + #define SMB2_NTLMV2_SESSKEY_SIZE (16) + #define SMB2_HMACSHA256_SIZE (32) + ++/* Maximum buffer size value we can send with 1 credit */ ++#define SMB2_MAX_BUFFER_SIZE 65536 ++ + #endif /* _SMB2_GLOB_H */ +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index f2e76f3b0c61..e2756bb40b4d 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -181,11 +181,8 @@ smb2_negotiate_wsize(struct cifs_tcon *tcon, struct smb_vol *volume_info) + /* start with specified wsize, or default */ + wsize = volume_info->wsize ? volume_info->wsize : CIFS_DEFAULT_IOSIZE; + wsize = min_t(unsigned int, wsize, server->max_write); +- /* +- * limit write size to 2 ** 16, because we don't support multicredit +- * requests now. +- */ +- wsize = min_t(unsigned int, wsize, 2 << 15); ++ /* set it to the maximum buffer size value we can send with 1 credit */ ++ wsize = min_t(unsigned int, wsize, SMB2_MAX_BUFFER_SIZE); + + return wsize; + } +@@ -199,11 +196,8 @@ smb2_negotiate_rsize(struct cifs_tcon *tcon, struct smb_vol *volume_info) + /* start with specified rsize, or default */ + rsize = volume_info->rsize ? volume_info->rsize : CIFS_DEFAULT_IOSIZE; + rsize = min_t(unsigned int, rsize, server->max_read); +- /* +- * limit write size to 2 ** 16, because we don't support multicredit +- * requests now. +- */ +- rsize = min_t(unsigned int, rsize, 2 << 15); ++ /* set it to the maximum buffer size value we can send with 1 credit */ ++ rsize = min_t(unsigned int, rsize, SMB2_MAX_BUFFER_SIZE); + + return rsize; + } +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 2b95ce2b54e8..c7a6fd87bb6e 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -408,6 +408,9 @@ SMB2_negotiate(const unsigned int xid, struct cifs_ses *ses) + server->dialect = le16_to_cpu(rsp->DialectRevision); + + server->maxBuf = le32_to_cpu(rsp->MaxTransactSize); ++ /* set it to the maximum buffer size value we can send with 1 credit */ ++ server->maxBuf = min_t(unsigned int, le32_to_cpu(rsp->MaxTransactSize), ++ SMB2_MAX_BUFFER_SIZE); + server->max_read = le32_to_cpu(rsp->MaxReadSize); + server->max_write = le32_to_cpu(rsp->MaxWriteSize); + /* BB Do we need to validate the SecurityMode? */ +diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h +index 7bb2e2e55123..790b14c5f262 100644 +--- a/fs/ext4/ext4.h ++++ b/fs/ext4/ext4.h +@@ -774,6 +774,8 @@ do { \ + if (EXT4_FITS_IN_INODE(raw_inode, einode, xtime)) \ + (einode)->xtime.tv_sec = \ + (signed)le32_to_cpu((raw_inode)->xtime); \ ++ else \ ++ (einode)->xtime.tv_sec = 0; \ + if (EXT4_FITS_IN_INODE(raw_inode, einode, xtime ## _extra)) \ + ext4_decode_extra_time(&(einode)->xtime, \ + raw_inode->xtime ## _extra); \ +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index cb2bdc7ccb05..21dff8f236f6 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -4704,6 +4704,10 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr) + if (attr->ia_size > sbi->s_bitmap_maxbytes) + return -EFBIG; + } ++ ++ if (IS_I_VERSION(inode) && attr->ia_size != inode->i_size) ++ inode_inc_iversion(inode); ++ + if (S_ISREG(inode->i_mode) && + (attr->ia_size < inode->i_size)) { + if (ext4_should_order_data(inode)) { +diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c +index c0427e2f6648..42624a995b00 100644 +--- a/fs/ext4/ioctl.c ++++ b/fs/ext4/ioctl.c +@@ -145,7 +145,7 @@ static long swap_inode_boot_loader(struct super_block *sb, + handle = ext4_journal_start(inode_bl, EXT4_HT_MOVE_EXTENTS, 2); + if (IS_ERR(handle)) { + err = -EINVAL; +- goto swap_boot_out; ++ goto journal_err_out; + } + + /* Protect extent tree against block allocations via delalloc */ +@@ -203,6 +203,7 @@ static long swap_inode_boot_loader(struct super_block *sb, + + ext4_double_up_write_data_sem(inode, inode_bl); + ++journal_err_out: + ext4_inode_resume_unlocked_dio(inode); + ext4_inode_resume_unlocked_dio(inode_bl); + +diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c +index 49d3c01eabf8..c503850a61a8 100644 +--- a/fs/ext4/resize.c ++++ b/fs/ext4/resize.c +@@ -238,6 +238,7 @@ static int ext4_alloc_group_tables(struct super_block *sb, + ext4_group_t group; + ext4_group_t last_group; + unsigned overhead; ++ __u16 uninit_mask = (flexbg_size > 1) ? ~EXT4_BG_BLOCK_UNINIT : ~0; + + BUG_ON(flex_gd->count == 0 || group_data == NULL); + +@@ -261,7 +262,7 @@ next_group: + src_group++; + for (; src_group <= last_group; src_group++) { + overhead = ext4_group_overhead_blocks(sb, src_group); +- if (overhead != 0) ++ if (overhead == 0) + last_blk += group_data[src_group - group].blocks_count; + else + break; +@@ -275,8 +276,7 @@ next_group: + group = ext4_get_group_number(sb, start_blk - 1); + group -= group_data[0].group; + group_data[group].free_blocks_count--; +- if (flexbg_size > 1) +- flex_gd->bg_flags[group] &= ~EXT4_BG_BLOCK_UNINIT; ++ flex_gd->bg_flags[group] &= uninit_mask; + } + + /* Allocate inode bitmaps */ +@@ -287,22 +287,30 @@ next_group: + group = ext4_get_group_number(sb, start_blk - 1); + group -= group_data[0].group; + group_data[group].free_blocks_count--; +- if (flexbg_size > 1) +- flex_gd->bg_flags[group] &= ~EXT4_BG_BLOCK_UNINIT; ++ flex_gd->bg_flags[group] &= uninit_mask; + } + + /* Allocate inode tables */ + for (; it_index < flex_gd->count; it_index++) { +- if (start_blk + EXT4_SB(sb)->s_itb_per_group > last_blk) ++ unsigned int itb = EXT4_SB(sb)->s_itb_per_group; ++ ext4_fsblk_t next_group_start; ++ ++ if (start_blk + itb > last_blk) + goto next_group; + group_data[it_index].inode_table = start_blk; +- group = ext4_get_group_number(sb, start_blk - 1); ++ group = ext4_get_group_number(sb, start_blk); ++ next_group_start = ext4_group_first_block_no(sb, group + 1); + group -= group_data[0].group; +- group_data[group].free_blocks_count -= +- EXT4_SB(sb)->s_itb_per_group; +- if (flexbg_size > 1) +- flex_gd->bg_flags[group] &= ~EXT4_BG_BLOCK_UNINIT; + ++ if (start_blk + itb > next_group_start) { ++ flex_gd->bg_flags[group + 1] &= uninit_mask; ++ overhead = start_blk + itb - next_group_start; ++ group_data[group + 1].free_blocks_count -= overhead; ++ itb -= overhead; ++ } ++ ++ group_data[group].free_blocks_count -= itb; ++ flex_gd->bg_flags[group] &= uninit_mask; + start_blk += EXT4_SB(sb)->s_itb_per_group; + } + +@@ -396,7 +404,7 @@ static int set_flexbg_block_bitmap(struct super_block *sb, handle_t *handle, + start = ext4_group_first_block_no(sb, group); + group -= flex_gd->groups[0].group; + +- count2 = sb->s_blocksize * 8 - (block - start); ++ count2 = EXT4_BLOCKS_PER_GROUP(sb) - (block - start); + if (count2 > count) + count2 = count; + +@@ -615,7 +623,7 @@ handle_ib: + if (err) + goto out; + count = group_table_count[j]; +- start = group_data[i].block_bitmap; ++ start = (&group_data[i].block_bitmap)[j]; + block = start; + } + +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index e4923b6a9e39..a7a5f7ea74db 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -3592,16 +3592,22 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + for (i = 0; i < 4; i++) + sbi->s_hash_seed[i] = le32_to_cpu(es->s_hash_seed[i]); + sbi->s_def_hash_version = es->s_def_hash_version; +- i = le32_to_cpu(es->s_flags); +- if (i & EXT2_FLAGS_UNSIGNED_HASH) +- sbi->s_hash_unsigned = 3; +- else if ((i & EXT2_FLAGS_SIGNED_HASH) == 0) { ++ if (EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX)) { ++ i = le32_to_cpu(es->s_flags); ++ if (i & EXT2_FLAGS_UNSIGNED_HASH) ++ sbi->s_hash_unsigned = 3; ++ else if ((i & EXT2_FLAGS_SIGNED_HASH) == 0) { + #ifdef __CHAR_UNSIGNED__ +- es->s_flags |= cpu_to_le32(EXT2_FLAGS_UNSIGNED_HASH); +- sbi->s_hash_unsigned = 3; ++ if (!(sb->s_flags & MS_RDONLY)) ++ es->s_flags |= ++ cpu_to_le32(EXT2_FLAGS_UNSIGNED_HASH); ++ sbi->s_hash_unsigned = 3; + #else +- es->s_flags |= cpu_to_le32(EXT2_FLAGS_SIGNED_HASH); ++ if (!(sb->s_flags & MS_RDONLY)) ++ es->s_flags |= ++ cpu_to_le32(EXT2_FLAGS_SIGNED_HASH); + #endif ++ } + } + + /* Handle clustersize */ +diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c +index 3e64169ef527..38802d683969 100644 +--- a/fs/quota/dquot.c ++++ b/fs/quota/dquot.c +@@ -581,9 +581,17 @@ int dquot_scan_active(struct super_block *sb, + dqstats_inc(DQST_LOOKUPS); + dqput(old_dquot); + old_dquot = dquot; +- ret = fn(dquot, priv); +- if (ret < 0) +- goto out; ++ /* ++ * ->release_dquot() can be racing with us. Our reference ++ * protects us from new calls to it so just wait for any ++ * outstanding call and recheck the DQ_ACTIVE_B after that. ++ */ ++ wait_on_dquot(dquot); ++ if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) { ++ ret = fn(dquot, priv); ++ if (ret < 0) ++ goto out; ++ } + spin_lock(&dq_list_lock); + /* We are safe to continue now because our dquot could not + * be moved out of the inuse list while we hold the reference */ +diff --git a/include/linux/can/skb.h b/include/linux/can/skb.h +index 2f0543f7510c..f9bbbb472663 100644 +--- a/include/linux/can/skb.h ++++ b/include/linux/can/skb.h +@@ -11,7 +11,9 @@ + #define CAN_SKB_H + + #include ++#include + #include ++#include + + /* + * The struct can_skb_priv is used to transport additional information along +@@ -42,4 +44,40 @@ static inline void can_skb_reserve(struct sk_buff *skb) + skb_reserve(skb, sizeof(struct can_skb_priv)); + } + ++static inline void can_skb_destructor(struct sk_buff *skb) ++{ ++ sock_put(skb->sk); ++} ++ ++static inline void can_skb_set_owner(struct sk_buff *skb, struct sock *sk) ++{ ++ if (sk) { ++ sock_hold(sk); ++ skb->destructor = can_skb_destructor; ++ skb->sk = sk; ++ } ++} ++ ++/* ++ * returns an unshared skb owned by the original sock to be echo'ed back ++ */ ++static inline struct sk_buff *can_create_echo_skb(struct sk_buff *skb) ++{ ++ if (skb_shared(skb)) { ++ struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC); ++ ++ if (likely(nskb)) { ++ can_skb_set_owner(nskb, skb->sk); ++ consume_skb(skb); ++ return nskb; ++ } else { ++ kfree_skb(skb); ++ return NULL; ++ } ++ } ++ ++ /* we can assume to have an unshared skb with proper owner */ ++ return skb; ++} ++ + #endif /* CAN_SKB_H */ +diff --git a/include/linux/ipc_namespace.h b/include/linux/ipc_namespace.h +index f6c82de12541..d6ad91f26038 100644 +--- a/include/linux/ipc_namespace.h ++++ b/include/linux/ipc_namespace.h +@@ -119,9 +119,7 @@ extern int mq_init_ns(struct ipc_namespace *ns); + * the new maximum will handle anyone else. I may have to revisit this + * in the future. + */ +-#define MIN_QUEUESMAX 1 + #define DFLT_QUEUESMAX 256 +-#define HARD_QUEUESMAX 1024 + #define MIN_MSGMAX 1 + #define DFLT_MSG 10U + #define DFLT_MSGMAX 10 +diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h +index abf7756eaf9e..4d2e0418ab5a 100644 +--- a/include/linux/netdevice.h ++++ b/include/linux/netdevice.h +@@ -2761,7 +2761,12 @@ void netdev_change_features(struct net_device *dev); + void netif_stacked_transfer_operstate(const struct net_device *rootdev, + struct net_device *dev); + +-netdev_features_t netif_skb_features(struct sk_buff *skb); ++netdev_features_t netif_skb_dev_features(struct sk_buff *skb, ++ const struct net_device *dev); ++static inline netdev_features_t netif_skb_features(struct sk_buff *skb) ++{ ++ return netif_skb_dev_features(skb, skb->dev); ++} + + static inline bool net_gso_ok(netdev_features_t features, int gso_type) + { +diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h +index ded45ec6b22b..478120ae34e5 100644 +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -2488,6 +2488,8 @@ extern int skb_shift(struct sk_buff *tgt, struct sk_buff *skb, + extern struct sk_buff *skb_segment(struct sk_buff *skb, + netdev_features_t features); + ++unsigned int skb_gso_transport_seglen(const struct sk_buff *skb); ++ + static inline void *skb_header_pointer(const struct sk_buff *skb, int offset, + int len, void *buffer) + { +@@ -2911,5 +2913,22 @@ static inline bool skb_head_is_locked(const struct sk_buff *skb) + { + return !skb->head_frag || skb_cloned(skb); + } ++ ++/** ++ * skb_gso_network_seglen - Return length of individual segments of a gso packet ++ * ++ * @skb: GSO skb ++ * ++ * skb_gso_network_seglen is used to determine the real size of the ++ * individual segments, including Layer3 (IP, IPv6) and L4 headers (TCP/UDP). ++ * ++ * The MAC/L2 header is not accounted for. ++ */ ++static inline unsigned int skb_gso_network_seglen(const struct sk_buff *skb) ++{ ++ unsigned int hdr_len = skb_transport_header(skb) - ++ skb_network_header(skb); ++ return hdr_len + skb_gso_transport_seglen(skb); ++} + #endif /* __KERNEL__ */ + #endif /* _LINUX_SKBUFF_H */ +diff --git a/ipc/mq_sysctl.c b/ipc/mq_sysctl.c +index 383d638340b8..5bb8bfe67149 100644 +--- a/ipc/mq_sysctl.c ++++ b/ipc/mq_sysctl.c +@@ -22,6 +22,16 @@ static void *get_mq(ctl_table *table) + return which; + } + ++static int proc_mq_dointvec(ctl_table *table, int write, ++ void __user *buffer, size_t *lenp, loff_t *ppos) ++{ ++ struct ctl_table mq_table; ++ memcpy(&mq_table, table, sizeof(mq_table)); ++ mq_table.data = get_mq(table); ++ ++ return proc_dointvec(&mq_table, write, buffer, lenp, ppos); ++} ++ + static int proc_mq_dointvec_minmax(ctl_table *table, int write, + void __user *buffer, size_t *lenp, loff_t *ppos) + { +@@ -33,12 +43,10 @@ static int proc_mq_dointvec_minmax(ctl_table *table, int write, + lenp, ppos); + } + #else ++#define proc_mq_dointvec NULL + #define proc_mq_dointvec_minmax NULL + #endif + +-static int msg_queues_limit_min = MIN_QUEUESMAX; +-static int msg_queues_limit_max = HARD_QUEUESMAX; +- + static int msg_max_limit_min = MIN_MSGMAX; + static int msg_max_limit_max = HARD_MSGMAX; + +@@ -51,9 +59,7 @@ static ctl_table mq_sysctls[] = { + .data = &init_ipc_ns.mq_queues_max, + .maxlen = sizeof(int), + .mode = 0644, +- .proc_handler = proc_mq_dointvec_minmax, +- .extra1 = &msg_queues_limit_min, +- .extra2 = &msg_queues_limit_max, ++ .proc_handler = proc_mq_dointvec, + }, + { + .procname = "msg_max", +diff --git a/ipc/mqueue.c b/ipc/mqueue.c +index ae1996d3c539..bb0248fc5187 100644 +--- a/ipc/mqueue.c ++++ b/ipc/mqueue.c +@@ -433,9 +433,9 @@ static int mqueue_create(struct inode *dir, struct dentry *dentry, + error = -EACCES; + goto out_unlock; + } +- if (ipc_ns->mq_queues_count >= HARD_QUEUESMAX || +- (ipc_ns->mq_queues_count >= ipc_ns->mq_queues_max && +- !capable(CAP_SYS_RESOURCE))) { ++ ++ if (ipc_ns->mq_queues_count >= ipc_ns->mq_queues_max && ++ !capable(CAP_SYS_RESOURCE)) { + error = -ENOSPC; + goto out_unlock; + } +diff --git a/kernel/events/core.c b/kernel/events/core.c +index e76e4959908c..f8eb2b154bdb 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -7421,14 +7421,14 @@ static void perf_pmu_rotate_stop(struct pmu *pmu) + static void __perf_event_exit_context(void *__info) + { + struct perf_event_context *ctx = __info; +- struct perf_event *event, *tmp; ++ struct perf_event *event; + + perf_pmu_rotate_stop(ctx->pmu); + +- list_for_each_entry_safe(event, tmp, &ctx->pinned_groups, group_entry) +- __perf_remove_from_context(event); +- list_for_each_entry_safe(event, tmp, &ctx->flexible_groups, group_entry) ++ rcu_read_lock(); ++ list_for_each_entry_rcu(event, &ctx->event_list, event_entry) + __perf_remove_from_context(event); ++ rcu_read_unlock(); + } + + static void perf_event_exit_cpu_context(int cpu) +@@ -7452,11 +7452,11 @@ static void perf_event_exit_cpu(int cpu) + { + struct swevent_htable *swhash = &per_cpu(swevent_htable, cpu); + ++ perf_event_exit_cpu_context(cpu); ++ + mutex_lock(&swhash->hlist_mutex); + swevent_hlist_release(swhash); + mutex_unlock(&swhash->hlist_mutex); +- +- perf_event_exit_cpu_context(cpu); + } + #else + static inline void perf_event_exit_cpu(int cpu) { } +diff --git a/kernel/workqueue.c b/kernel/workqueue.c +index 68086a34b8ef..db7a6ac7c0a8 100644 +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -1823,6 +1823,12 @@ static void destroy_worker(struct worker *worker) + if (worker->flags & WORKER_IDLE) + pool->nr_idle--; + ++ /* ++ * Once WORKER_DIE is set, the kworker may destroy itself at any ++ * point. Pin to ensure the task stays until we're done with it. ++ */ ++ get_task_struct(worker->task); ++ + list_del_init(&worker->entry); + worker->flags |= WORKER_DIE; + +@@ -1831,6 +1837,7 @@ static void destroy_worker(struct worker *worker) + spin_unlock_irq(&pool->lock); + + kthread_stop(worker->task); ++ put_task_struct(worker->task); + kfree(worker); + + spin_lock_irq(&pool->lock); +diff --git a/mm/memcontrol.c b/mm/memcontrol.c +index 134e2106f467..6115b2bbd6ea 100644 +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -1220,7 +1220,7 @@ struct mem_cgroup *mem_cgroup_iter(struct mem_cgroup *root, + if (dead_count == iter->last_dead_count) { + smp_rmb(); + last_visited = iter->last_visited; +- if (last_visited && ++ if (last_visited && last_visited != root && + !css_tryget(&last_visited->css)) + last_visited = NULL; + } +@@ -1229,7 +1229,7 @@ struct mem_cgroup *mem_cgroup_iter(struct mem_cgroup *root, + memcg = __mem_cgroup_iter_next(root, last_visited); + + if (reclaim) { +- if (last_visited) ++ if (last_visited && last_visited != root) + css_put(&last_visited->css); + + iter->last_visited = memcg; +diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c +index 990afab2be1b..c76a4388a5d7 100644 +--- a/net/9p/trans_virtio.c ++++ b/net/9p/trans_virtio.c +@@ -340,7 +340,10 @@ static int p9_get_mapped_pages(struct virtio_chan *chan, + int count = nr_pages; + while (nr_pages) { + s = rest_of_page(data); +- pages[index++] = kmap_to_page(data); ++ if (is_vmalloc_addr(data)) ++ pages[index++] = vmalloc_to_page(data); ++ else ++ pages[index++] = kmap_to_page(data); + data += s; + nr_pages--; + } +diff --git a/net/can/af_can.c b/net/can/af_can.c +index c4e50852c9f4..f59859a3f562 100644 +--- a/net/can/af_can.c ++++ b/net/can/af_can.c +@@ -57,6 +57,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -290,7 +291,7 @@ int can_send(struct sk_buff *skb, int loop) + return -ENOMEM; + } + +- newskb->sk = skb->sk; ++ can_skb_set_owner(newskb, skb->sk); + newskb->ip_summed = CHECKSUM_UNNECESSARY; + newskb->pkt_type = PACKET_BROADCAST; + } +diff --git a/net/can/bcm.c b/net/can/bcm.c +index 8f113e6ff327..35cf02d92766 100644 +--- a/net/can/bcm.c ++++ b/net/can/bcm.c +@@ -268,7 +268,7 @@ static void bcm_can_tx(struct bcm_op *op) + + /* send with loopback */ + skb->dev = dev; +- skb->sk = op->sk; ++ can_skb_set_owner(skb, op->sk); + can_send(skb, 1); + + /* update statistics */ +@@ -1223,7 +1223,7 @@ static int bcm_tx_send(struct msghdr *msg, int ifindex, struct sock *sk) + + can_skb_prv(skb)->ifindex = dev->ifindex; + skb->dev = dev; +- skb->sk = sk; ++ can_skb_set_owner(skb, sk); + err = can_send(skb, 1); /* send with loopback */ + dev_put(dev); + +diff --git a/net/core/dev.c b/net/core/dev.c +index 1283c8442e99..a0e55ffc03c9 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -2374,7 +2374,7 @@ EXPORT_SYMBOL(netdev_rx_csum_fault); + * 2. No high memory really exists on this machine. + */ + +-static int illegal_highdma(struct net_device *dev, struct sk_buff *skb) ++static int illegal_highdma(const struct net_device *dev, struct sk_buff *skb) + { + #ifdef CONFIG_HIGHMEM + int i; +@@ -2454,46 +2454,51 @@ static int dev_gso_segment(struct sk_buff *skb, netdev_features_t features) + } + + static netdev_features_t harmonize_features(struct sk_buff *skb, +- __be16 protocol, netdev_features_t features) ++ __be16 protocol, ++ const struct net_device *dev, ++ netdev_features_t features) + { + if (skb->ip_summed != CHECKSUM_NONE && + !can_checksum_protocol(features, protocol)) { + features &= ~NETIF_F_ALL_CSUM; +- } else if (illegal_highdma(skb->dev, skb)) { ++ } else if (illegal_highdma(dev, skb)) { + features &= ~NETIF_F_SG; + } + + return features; + } + +-netdev_features_t netif_skb_features(struct sk_buff *skb) ++netdev_features_t netif_skb_dev_features(struct sk_buff *skb, ++ const struct net_device *dev) + { + __be16 protocol = skb->protocol; +- netdev_features_t features = skb->dev->features; ++ netdev_features_t features = dev->features; + +- if (skb_shinfo(skb)->gso_segs > skb->dev->gso_max_segs) ++ if (skb_shinfo(skb)->gso_segs > dev->gso_max_segs) + features &= ~NETIF_F_GSO_MASK; + + if (protocol == htons(ETH_P_8021Q) || protocol == htons(ETH_P_8021AD)) { + struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data; + protocol = veh->h_vlan_encapsulated_proto; + } else if (!vlan_tx_tag_present(skb)) { +- return harmonize_features(skb, protocol, features); ++ return harmonize_features(skb, protocol, dev, features); + } + +- features &= (skb->dev->vlan_features | NETIF_F_HW_VLAN_CTAG_TX | ++ features &= (dev->vlan_features | NETIF_F_HW_VLAN_CTAG_TX | + NETIF_F_HW_VLAN_STAG_TX); + + if (protocol != htons(ETH_P_8021Q) && protocol != htons(ETH_P_8021AD)) { +- return harmonize_features(skb, protocol, features); ++ return harmonize_features(skb, protocol, dev, features); + } else { + features &= NETIF_F_SG | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST | + NETIF_F_GEN_CSUM | NETIF_F_HW_VLAN_CTAG_TX | + NETIF_F_HW_VLAN_STAG_TX; +- return harmonize_features(skb, protocol, features); ++ return harmonize_features(skb, protocol, dev, features); + } ++ ++ return harmonize_features(skb, protocol, dev, features); + } +-EXPORT_SYMBOL(netif_skb_features); ++EXPORT_SYMBOL(netif_skb_dev_features); + + /* + * Returns true if either: +diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c +index 0e9131195eb0..55e08e2de3a1 100644 +--- a/net/core/fib_rules.c ++++ b/net/core/fib_rules.c +@@ -720,6 +720,13 @@ static int fib_rules_event(struct notifier_block *this, unsigned long event, + attach_rules(&ops->rules_list, dev); + break; + ++ case NETDEV_CHANGENAME: ++ list_for_each_entry(ops, &net->rules_ops, list) { ++ detach_rules(&ops->rules_list, dev); ++ attach_rules(&ops->rules_list, dev); ++ } ++ break; ++ + case NETDEV_UNREGISTER: + list_for_each_entry(ops, &net->rules_ops, list) + detach_rules(&ops->rules_list, dev); +diff --git a/net/core/netpoll.c b/net/core/netpoll.c +index 27f33f25cda8..433a1051d323 100644 +--- a/net/core/netpoll.c ++++ b/net/core/netpoll.c +@@ -948,6 +948,7 @@ int netpoll_parse_options(struct netpoll *np, char *opt) + { + char *cur=opt, *delim; + int ipv6; ++ bool ipversion_set = false; + + if (*cur != '@') { + if ((delim = strchr(cur, '@')) == NULL) +@@ -960,6 +961,7 @@ int netpoll_parse_options(struct netpoll *np, char *opt) + cur++; + + if (*cur != '/') { ++ ipversion_set = true; + if ((delim = strchr(cur, '/')) == NULL) + goto parse_failed; + *delim = 0; +@@ -1002,7 +1004,7 @@ int netpoll_parse_options(struct netpoll *np, char *opt) + ipv6 = netpoll_parse_ip_addr(cur, &np->remote_ip); + if (ipv6 < 0) + goto parse_failed; +- else if (np->ipv6 != (bool)ipv6) ++ else if (ipversion_set && np->ipv6 != (bool)ipv6) + goto parse_failed; + else + np->ipv6 = (bool)ipv6; +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index 20ee14d0a8a9..79143b7af7e5 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -47,6 +47,8 @@ + #include + #include + #include ++#include ++#include + #include + #ifdef CONFIG_NET_CLS_ACT + #include +@@ -3471,3 +3473,26 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from, + return true; + } + EXPORT_SYMBOL(skb_try_coalesce); ++ ++/** ++ * skb_gso_transport_seglen - Return length of individual segments of a gso packet ++ * ++ * @skb: GSO skb ++ * ++ * skb_gso_transport_seglen is used to determine the real size of the ++ * individual segments, including Layer4 headers (TCP/UDP). ++ * ++ * The MAC/L2 or network (IP, IPv6) headers are not accounted for. ++ */ ++unsigned int skb_gso_transport_seglen(const struct sk_buff *skb) ++{ ++ const struct skb_shared_info *shinfo = skb_shinfo(skb); ++ unsigned int hdr_len; ++ ++ if (likely(shinfo->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6))) ++ hdr_len = tcp_hdrlen(skb); ++ else ++ hdr_len = sizeof(struct udphdr); ++ return hdr_len + shinfo->gso_size; ++} ++EXPORT_SYMBOL_GPL(skb_gso_transport_seglen); +diff --git a/net/core/sock.c b/net/core/sock.c +index 50a345e5a26f..3ba527074f7f 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -1814,7 +1814,7 @@ bool sk_page_frag_refill(struct sock *sk, struct page_frag *pfrag) + gfp_t gfp = sk->sk_allocation; + + if (order) +- gfp |= __GFP_COMP | __GFP_NOWARN; ++ gfp |= __GFP_COMP | __GFP_NOWARN | __GFP_NORETRY; + pfrag->page = alloc_pages(gfp, order); + if (likely(pfrag->page)) { + pfrag->offset = 0; +diff --git a/net/ieee802154/6lowpan.c b/net/ieee802154/6lowpan.c +index 31b127e8086b..ca118e8cb141 100644 +--- a/net/ieee802154/6lowpan.c ++++ b/net/ieee802154/6lowpan.c +@@ -1173,7 +1173,27 @@ static struct header_ops lowpan_header_ops = { + .create = lowpan_header_create, + }; + ++static struct lock_class_key lowpan_tx_busylock; ++static struct lock_class_key lowpan_netdev_xmit_lock_key; ++ ++static void lowpan_set_lockdep_class_one(struct net_device *dev, ++ struct netdev_queue *txq, ++ void *_unused) ++{ ++ lockdep_set_class(&txq->_xmit_lock, ++ &lowpan_netdev_xmit_lock_key); ++} ++ ++ ++static int lowpan_dev_init(struct net_device *dev) ++{ ++ netdev_for_each_tx_queue(dev, lowpan_set_lockdep_class_one, NULL); ++ dev->qdisc_tx_busylock = &lowpan_tx_busylock; ++ return 0; ++} ++ + static const struct net_device_ops lowpan_netdev_ops = { ++ .ndo_init = lowpan_dev_init, + .ndo_start_xmit = lowpan_xmit, + .ndo_set_mac_address = lowpan_set_address, + }; +diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c +index 9e38217c3931..e40eef4ac697 100644 +--- a/net/ipv4/devinet.c ++++ b/net/ipv4/devinet.c +@@ -1433,7 +1433,8 @@ static size_t inet_nlmsg_size(void) + + nla_total_size(4) /* IFA_ADDRESS */ + + nla_total_size(4) /* IFA_LOCAL */ + + nla_total_size(4) /* IFA_BROADCAST */ +- + nla_total_size(IFNAMSIZ); /* IFA_LABEL */ ++ + nla_total_size(IFNAMSIZ) /* IFA_LABEL */ ++ + nla_total_size(sizeof(struct ifa_cacheinfo)); /* IFA_CACHEINFO */ + } + + static inline u32 cstamp_delta(unsigned long cstamp) +diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c +index 694de3b7aebf..98d7e53d2afd 100644 +--- a/net/ipv4/ip_forward.c ++++ b/net/ipv4/ip_forward.c +@@ -39,6 +39,71 @@ + #include + #include + ++static bool ip_may_fragment(const struct sk_buff *skb) ++{ ++ return unlikely((ip_hdr(skb)->frag_off & htons(IP_DF)) == 0) || ++ !skb->local_df; ++} ++ ++static bool ip_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu) ++{ ++ if (skb->len <= mtu || skb->local_df) ++ return false; ++ ++ if (skb_is_gso(skb) && skb_gso_network_seglen(skb) <= mtu) ++ return false; ++ ++ return true; ++} ++ ++static bool ip_gso_exceeds_dst_mtu(const struct sk_buff *skb) ++{ ++ unsigned int mtu; ++ ++ if (skb->local_df || !skb_is_gso(skb)) ++ return false; ++ ++ mtu = dst_mtu(skb_dst(skb)); ++ ++ /* if seglen > mtu, do software segmentation for IP fragmentation on ++ * output. DF bit cannot be set since ip_forward would have sent ++ * icmp error. ++ */ ++ return skb_gso_network_seglen(skb) > mtu; ++} ++ ++/* called if GSO skb needs to be fragmented on forward */ ++static int ip_forward_finish_gso(struct sk_buff *skb) ++{ ++ struct dst_entry *dst = skb_dst(skb); ++ netdev_features_t features; ++ struct sk_buff *segs; ++ int ret = 0; ++ ++ features = netif_skb_dev_features(skb, dst->dev); ++ segs = skb_gso_segment(skb, features & ~NETIF_F_GSO_MASK); ++ if (IS_ERR(segs)) { ++ kfree_skb(skb); ++ return -ENOMEM; ++ } ++ ++ consume_skb(skb); ++ ++ do { ++ struct sk_buff *nskb = segs->next; ++ int err; ++ ++ segs->next = NULL; ++ err = dst_output(segs); ++ ++ if (err && ret == 0) ++ ret = err; ++ segs = nskb; ++ } while (segs); ++ ++ return ret; ++} ++ + static int ip_forward_finish(struct sk_buff *skb) + { + struct ip_options *opt = &(IPCB(skb)->opt); +@@ -49,6 +114,9 @@ static int ip_forward_finish(struct sk_buff *skb) + if (unlikely(opt->optlen)) + ip_forward_options(skb); + ++ if (ip_gso_exceeds_dst_mtu(skb)) ++ return ip_forward_finish_gso(skb); ++ + return dst_output(skb); + } + +@@ -88,8 +156,7 @@ int ip_forward(struct sk_buff *skb) + if (opt->is_strictroute && rt->rt_uses_gateway) + goto sr_failed; + +- if (unlikely(skb->len > dst_mtu(&rt->dst) && !skb_is_gso(skb) && +- (ip_hdr(skb)->frag_off & htons(IP_DF))) && !skb->local_df) { ++ if (!ip_may_fragment(skb) && ip_exceeds_mtu(skb, dst_mtu(&rt->dst))) { + IP_INC_STATS(dev_net(rt->dst.dev), IPSTATS_MIB_FRAGFAILS); + icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, + htonl(dst_mtu(&rt->dst))); +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index f6c6ab14da41..1a362f375e67 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -1544,6 +1544,7 @@ static int __mkroute_input(struct sk_buff *skb, + rth->rt_gateway = 0; + rth->rt_uses_gateway = 0; + INIT_LIST_HEAD(&rth->rt_uncached); ++ RT_CACHE_STAT_INC(in_slow_tot); + + rth->dst.input = ip_forward; + rth->dst.output = ip_output; +@@ -1645,8 +1646,6 @@ static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr, + if (err != 0) + goto no_route; + +- RT_CACHE_STAT_INC(in_slow_tot); +- + if (res.type == RTN_BROADCAST) + goto brd_input; + +@@ -1715,6 +1714,7 @@ local_input: + rth->rt_gateway = 0; + rth->rt_uses_gateway = 0; + INIT_LIST_HEAD(&rth->rt_uncached); ++ RT_CACHE_STAT_INC(in_slow_tot); + if (res.type == RTN_UNREACHABLE) { + rth->dst.input= ip_error; + rth->dst.error= -err; +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 5560abfe6d30..d2df17940e07 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -686,7 +686,8 @@ static void tcp_tsq_handler(struct sock *sk) + if ((1 << sk->sk_state) & + (TCPF_ESTABLISHED | TCPF_FIN_WAIT1 | TCPF_CLOSING | + TCPF_CLOSE_WAIT | TCPF_LAST_ACK)) +- tcp_write_xmit(sk, tcp_current_mss(sk), 0, 0, GFP_ATOMIC); ++ tcp_write_xmit(sk, tcp_current_mss(sk), tcp_sk(sk)->nonagle, ++ 0, GFP_ATOMIC); + } + /* + * One tasklest per cpu tries to send more skbs. +@@ -1875,7 +1876,15 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle, + + if (atomic_read(&sk->sk_wmem_alloc) > limit) { + set_bit(TSQ_THROTTLED, &tp->tsq_flags); +- break; ++ /* It is possible TX completion already happened ++ * before we set TSQ_THROTTLED, so we must ++ * test again the condition. ++ * We abuse smp_mb__after_clear_bit() because ++ * there is no smp_mb__after_set_bit() yet ++ */ ++ smp_mb__after_clear_bit(); ++ if (atomic_read(&sk->sk_wmem_alloc) > limit) ++ break; + } + + limit = mss_now; +diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c +index b98b8e06739e..98a262b759ae 100644 +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -345,6 +345,20 @@ static inline int ip6_forward_finish(struct sk_buff *skb) + return dst_output(skb); + } + ++static bool ip6_pkt_too_big(const struct sk_buff *skb, unsigned int mtu) ++{ ++ if (skb->len <= mtu || skb->local_df) ++ return false; ++ ++ if (IP6CB(skb)->frag_max_size && IP6CB(skb)->frag_max_size > mtu) ++ return true; ++ ++ if (skb_is_gso(skb) && skb_gso_network_seglen(skb) <= mtu) ++ return false; ++ ++ return true; ++} ++ + int ip6_forward(struct sk_buff *skb) + { + struct dst_entry *dst = skb_dst(skb); +@@ -467,8 +481,7 @@ int ip6_forward(struct sk_buff *skb) + if (mtu < IPV6_MIN_MTU) + mtu = IPV6_MIN_MTU; + +- if ((!skb->local_df && skb->len > mtu && !skb_is_gso(skb)) || +- (IP6CB(skb)->frag_max_size && IP6CB(skb)->frag_max_size > mtu)) { ++ if (ip6_pkt_too_big(skb, mtu)) { + /* Again, force OUTPUT device used as source address */ + skb->dev = dst->dev; + icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index 79bc251042ba..8554e5eebaeb 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -71,6 +71,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -1384,11 +1385,19 @@ SCTP_STATIC int sctp_setsockopt_connectx(struct sock* sk, + /* + * New (hopefully final) interface for the API. + * We use the sctp_getaddrs_old structure so that use-space library +- * can avoid any unnecessary allocations. The only defferent part ++ * can avoid any unnecessary allocations. The only different part + * is that we store the actual length of the address buffer into the +- * addrs_num structure member. That way we can re-use the existing ++ * addrs_num structure member. That way we can re-use the existing + * code. + */ ++#ifdef CONFIG_COMPAT ++struct compat_sctp_getaddrs_old { ++ sctp_assoc_t assoc_id; ++ s32 addr_num; ++ compat_uptr_t addrs; /* struct sockaddr * */ ++}; ++#endif ++ + SCTP_STATIC int sctp_getsockopt_connectx3(struct sock* sk, int len, + char __user *optval, + int __user *optlen) +@@ -1397,16 +1406,30 @@ SCTP_STATIC int sctp_getsockopt_connectx3(struct sock* sk, int len, + sctp_assoc_t assoc_id = 0; + int err = 0; + +- if (len < sizeof(param)) +- return -EINVAL; ++#ifdef CONFIG_COMPAT ++ if (is_compat_task()) { ++ struct compat_sctp_getaddrs_old param32; + +- if (copy_from_user(¶m, optval, sizeof(param))) +- return -EFAULT; ++ if (len < sizeof(param32)) ++ return -EINVAL; ++ if (copy_from_user(¶m32, optval, sizeof(param32))) ++ return -EFAULT; + +- err = __sctp_setsockopt_connectx(sk, +- (struct sockaddr __user *)param.addrs, +- param.addr_num, &assoc_id); ++ param.assoc_id = param32.assoc_id; ++ param.addr_num = param32.addr_num; ++ param.addrs = compat_ptr(param32.addrs); ++ } else ++#endif ++ { ++ if (len < sizeof(param)) ++ return -EINVAL; ++ if (copy_from_user(¶m, optval, sizeof(param))) ++ return -EFAULT; ++ } + ++ err = __sctp_setsockopt_connectx(sk, (struct sockaddr __user *) ++ param.addrs, param.addr_num, ++ &assoc_id); + if (err == 0 || err == -EINPROGRESS) { + if (copy_to_user(optval, &assoc_id, sizeof(assoc_id))) + return -EFAULT; +diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c +index 8a0e04d0928a..fc47165dc254 100644 +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -502,6 +502,7 @@ static int xs_nospace(struct rpc_task *task) + struct rpc_rqst *req = task->tk_rqstp; + struct rpc_xprt *xprt = req->rq_xprt; + struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt); ++ struct sock *sk = transport->inet; + int ret = -EAGAIN; + + dprintk("RPC: %5u xmit incomplete (%u left of %u)\n", +@@ -519,7 +520,7 @@ static int xs_nospace(struct rpc_task *task) + * window size + */ + set_bit(SOCK_NOSPACE, &transport->sock->flags); +- transport->inet->sk_write_pending++; ++ sk->sk_write_pending++; + /* ...and wait for more buffer space */ + xprt_wait_for_buffer_space(task, xs_nospace_callback); + } +@@ -529,6 +530,9 @@ static int xs_nospace(struct rpc_task *task) + } + + spin_unlock_bh(&xprt->transport_lock); ++ ++ /* Race breaker in case memory is freed before above code is called */ ++ sk->sk_write_space(sk); + return ret; + } + +diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c +index 142a59f39796..bcdca73033f3 100644 +--- a/security/selinux/ss/policydb.c ++++ b/security/selinux/ss/policydb.c +@@ -3258,10 +3258,10 @@ static int filename_write_helper(void *key, void *data, void *ptr) + if (rc) + return rc; + +- buf[0] = ft->stype; +- buf[1] = ft->ttype; +- buf[2] = ft->tclass; +- buf[3] = otype->otype; ++ buf[0] = cpu_to_le32(ft->stype); ++ buf[1] = cpu_to_le32(ft->ttype); ++ buf[2] = cpu_to_le32(ft->tclass); ++ buf[3] = cpu_to_le32(otype->otype); + + rc = put_entry(buf, sizeof(u32), 4, fp); + if (rc) +diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c +index 90ff7a3f72df..01fefbe29e4a 100644 +--- a/sound/pci/hda/patch_ca0132.c ++++ b/sound/pci/hda/patch_ca0132.c +@@ -2662,60 +2662,6 @@ static bool dspload_wait_loaded(struct hda_codec *codec) + } + + /* +- * PCM stuffs +- */ +-static void ca0132_setup_stream(struct hda_codec *codec, hda_nid_t nid, +- u32 stream_tag, +- int channel_id, int format) +-{ +- unsigned int oldval, newval; +- +- if (!nid) +- return; +- +- snd_printdd( +- "ca0132_setup_stream: NID=0x%x, stream=0x%x, " +- "channel=%d, format=0x%x\n", +- nid, stream_tag, channel_id, format); +- +- /* update the format-id if changed */ +- oldval = snd_hda_codec_read(codec, nid, 0, +- AC_VERB_GET_STREAM_FORMAT, +- 0); +- if (oldval != format) { +- msleep(20); +- snd_hda_codec_write(codec, nid, 0, +- AC_VERB_SET_STREAM_FORMAT, +- format); +- } +- +- oldval = snd_hda_codec_read(codec, nid, 0, AC_VERB_GET_CONV, 0); +- newval = (stream_tag << 4) | channel_id; +- if (oldval != newval) { +- snd_hda_codec_write(codec, nid, 0, +- AC_VERB_SET_CHANNEL_STREAMID, +- newval); +- } +-} +- +-static void ca0132_cleanup_stream(struct hda_codec *codec, hda_nid_t nid) +-{ +- unsigned int val; +- +- if (!nid) +- return; +- +- snd_printdd(KERN_INFO "ca0132_cleanup_stream: NID=0x%x\n", nid); +- +- val = snd_hda_codec_read(codec, nid, 0, AC_VERB_GET_CONV, 0); +- if (!val) +- return; +- +- snd_hda_codec_write(codec, nid, 0, AC_VERB_SET_STREAM_FORMAT, 0); +- snd_hda_codec_write(codec, nid, 0, AC_VERB_SET_CHANNEL_STREAMID, 0); +-} +- +-/* + * PCM callbacks + */ + static int ca0132_playback_pcm_prepare(struct hda_pcm_stream *hinfo, +@@ -2726,7 +2672,7 @@ static int ca0132_playback_pcm_prepare(struct hda_pcm_stream *hinfo, + { + struct ca0132_spec *spec = codec->spec; + +- ca0132_setup_stream(codec, spec->dacs[0], stream_tag, 0, format); ++ snd_hda_codec_setup_stream(codec, spec->dacs[0], stream_tag, 0, format); + + return 0; + } +@@ -2745,7 +2691,7 @@ static int ca0132_playback_pcm_cleanup(struct hda_pcm_stream *hinfo, + if (spec->effects_switch[PLAY_ENHANCEMENT - EFFECT_START_NID]) + msleep(50); + +- ca0132_cleanup_stream(codec, spec->dacs[0]); ++ snd_hda_codec_cleanup_stream(codec, spec->dacs[0]); + + return 0; + } +@@ -2822,10 +2768,8 @@ static int ca0132_capture_pcm_prepare(struct hda_pcm_stream *hinfo, + unsigned int format, + struct snd_pcm_substream *substream) + { +- struct ca0132_spec *spec = codec->spec; +- +- ca0132_setup_stream(codec, spec->adcs[substream->number], +- stream_tag, 0, format); ++ snd_hda_codec_setup_stream(codec, hinfo->nid, ++ stream_tag, 0, format); + + return 0; + } +@@ -2839,7 +2783,7 @@ static int ca0132_capture_pcm_cleanup(struct hda_pcm_stream *hinfo, + if (spec->dsp_state == DSP_DOWNLOADING) + return 0; + +- ca0132_cleanup_stream(codec, hinfo->nid); ++ snd_hda_codec_cleanup_stream(codec, hinfo->nid); + return 0; + } + +@@ -4742,6 +4686,8 @@ static int patch_ca0132(struct hda_codec *codec) + return err; + + codec->patch_ops = ca0132_patch_ops; ++ codec->pcm_format_first = 1; ++ codec->no_sticky_stream = 1; + + return 0; + } +diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c +index dc4833f47a2b..0c521b7752b2 100644 +--- a/sound/pci/hda/patch_sigmatel.c ++++ b/sound/pci/hda/patch_sigmatel.c +@@ -83,6 +83,7 @@ enum { + STAC_DELL_M6_BOTH, + STAC_DELL_EQ, + STAC_ALIENWARE_M17X, ++ STAC_92HD89XX_HP_FRONT_JACK, + STAC_92HD73XX_MODELS + }; + +@@ -97,6 +98,7 @@ enum { + STAC_92HD83XXX_HP_LED, + STAC_92HD83XXX_HP_INV_LED, + STAC_92HD83XXX_HP_MIC_LED, ++ STAC_HP_LED_GPIO10, + STAC_92HD83XXX_HEADSET_JACK, + STAC_92HD83XXX_HP, + STAC_HP_ENVY_BASS, +@@ -1775,6 +1777,12 @@ static const struct hda_pintbl intel_dg45id_pin_configs[] = { + {} + }; + ++static const struct hda_pintbl stac92hd89xx_hp_front_jack_pin_configs[] = { ++ { 0x0a, 0x02214030 }, ++ { 0x0b, 0x02A19010 }, ++ {} ++}; ++ + static void stac92hd73xx_fixup_ref(struct hda_codec *codec, + const struct hda_fixup *fix, int action) + { +@@ -1893,6 +1901,10 @@ static const struct hda_fixup stac92hd73xx_fixups[] = { + [STAC_92HD73XX_NO_JD] = { + .type = HDA_FIXUP_FUNC, + .v.func = stac92hd73xx_fixup_no_jd, ++ }, ++ [STAC_92HD89XX_HP_FRONT_JACK] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = stac92hd89xx_hp_front_jack_pin_configs, + } + }; + +@@ -1953,6 +1965,8 @@ static const struct snd_pci_quirk stac92hd73xx_fixup_tbl[] = { + "Alienware M17x", STAC_ALIENWARE_M17X), + SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0490, + "Alienware M17x R3", STAC_DELL_EQ), ++ SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x2b17, ++ "unknown HP", STAC_92HD89XX_HP_FRONT_JACK), + {} /* terminator */ + }; + +@@ -2094,6 +2108,17 @@ static void stac92hd83xxx_fixup_hp_mic_led(struct hda_codec *codec, + spec->mic_mute_led_gpio = 0x08; /* GPIO3 */ + } + ++static void stac92hd83xxx_fixup_hp_led_gpio10(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ struct sigmatel_spec *spec = codec->spec; ++ ++ if (action == HDA_FIXUP_ACT_PRE_PROBE) { ++ spec->gpio_led = 0x10; /* GPIO4 */ ++ spec->default_polarity = 0; ++ } ++} ++ + static void stac92hd83xxx_fixup_headset_jack(struct hda_codec *codec, + const struct hda_fixup *fix, int action) + { +@@ -2160,6 +2185,12 @@ static const struct hda_fixup stac92hd83xxx_fixups[] = { + .chained = true, + .chain_id = STAC_92HD83XXX_HP, + }, ++ [STAC_HP_LED_GPIO10] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = stac92hd83xxx_fixup_hp_led_gpio10, ++ .chained = true, ++ .chain_id = STAC_92HD83XXX_HP, ++ }, + [STAC_92HD83XXX_HEADSET_JACK] = { + .type = HDA_FIXUP_FUNC, + .v.func = stac92hd83xxx_fixup_headset_jack, +@@ -2231,6 +2262,8 @@ static const struct snd_pci_quirk stac92hd83xxx_fixup_tbl[] = { + "HP", STAC_92HD83XXX_HP_cNB11_INTQUAD), + SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x1888, + "HP Envy Spectre", STAC_HP_ENVY_BASS), ++ SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x1899, ++ "HP Folio 13", STAC_HP_LED_GPIO10), + SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x18df, + "HP Folio", STAC_92HD83XXX_HP_MIC_LED), + SND_PCI_QUIRK_MASK(PCI_VENDOR_ID_HP, 0xff00, 0x1900, +diff --git a/sound/soc/codecs/da732x.c b/sound/soc/codecs/da732x.c +index dc0284dc9e6f..76fdf0a598bc 100644 +--- a/sound/soc/codecs/da732x.c ++++ b/sound/soc/codecs/da732x.c +@@ -1268,11 +1268,23 @@ static struct snd_soc_dai_driver da732x_dai[] = { + }, + }; + ++static bool da732x_volatile(struct device *dev, unsigned int reg) ++{ ++ switch (reg) { ++ case DA732X_REG_HPL_DAC_OFF_CNTL: ++ case DA732X_REG_HPR_DAC_OFF_CNTL: ++ return true; ++ default: ++ return false; ++ } ++} ++ + static const struct regmap_config da732x_regmap = { + .reg_bits = 8, + .val_bits = 8, + + .max_register = DA732X_MAX_REG, ++ .volatile_reg = da732x_volatile, + .reg_defaults = da732x_reg_cache, + .num_reg_defaults = ARRAY_SIZE(da732x_reg_cache), + .cache_type = REGCACHE_RBTREE, +diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c +index 8d14a76c7249..819c90fe021f 100644 +--- a/sound/soc/codecs/max98090.c ++++ b/sound/soc/codecs/max98090.c +@@ -1755,16 +1755,6 @@ static int max98090_set_bias_level(struct snd_soc_codec *codec, + + switch (level) { + case SND_SOC_BIAS_ON: +- if (codec->dapm.bias_level == SND_SOC_BIAS_OFF) { +- ret = regcache_sync(max98090->regmap); +- +- if (ret != 0) { +- dev_err(codec->dev, +- "Failed to sync cache: %d\n", ret); +- return ret; +- } +- } +- + if (max98090->jack_state == M98090_JACK_STATE_HEADSET) { + /* + * Set to normal bias level. +@@ -1778,6 +1768,16 @@ static int max98090_set_bias_level(struct snd_soc_codec *codec, + break; + + case SND_SOC_BIAS_STANDBY: ++ if (codec->dapm.bias_level == SND_SOC_BIAS_OFF) { ++ ret = regcache_sync(max98090->regmap); ++ if (ret != 0) { ++ dev_err(codec->dev, ++ "Failed to sync cache: %d\n", ret); ++ return ret; ++ } ++ } ++ break; ++ + case SND_SOC_BIAS_OFF: + /* Set internal pull-up to lowest power mode */ + snd_soc_update_bits(codec, M98090_REG_JACK_DETECT, +diff --git a/sound/soc/codecs/sta32x.c b/sound/soc/codecs/sta32x.c +index cfb55fe35e98..8517e70bc24b 100644 +--- a/sound/soc/codecs/sta32x.c ++++ b/sound/soc/codecs/sta32x.c +@@ -187,42 +187,42 @@ static const unsigned int sta32x_limiter_drc_release_tlv[] = { + 13, 16, TLV_DB_SCALE_ITEM(-1500, 300, 0), + }; + +-static const struct soc_enum sta32x_drc_ac_enum = +- SOC_ENUM_SINGLE(STA32X_CONFD, STA32X_CONFD_DRC_SHIFT, +- 2, sta32x_drc_ac); +-static const struct soc_enum sta32x_auto_eq_enum = +- SOC_ENUM_SINGLE(STA32X_AUTO1, STA32X_AUTO1_AMEQ_SHIFT, +- 3, sta32x_auto_eq_mode); +-static const struct soc_enum sta32x_auto_gc_enum = +- SOC_ENUM_SINGLE(STA32X_AUTO1, STA32X_AUTO1_AMGC_SHIFT, +- 4, sta32x_auto_gc_mode); +-static const struct soc_enum sta32x_auto_xo_enum = +- SOC_ENUM_SINGLE(STA32X_AUTO2, STA32X_AUTO2_XO_SHIFT, +- 16, sta32x_auto_xo_mode); +-static const struct soc_enum sta32x_preset_eq_enum = +- SOC_ENUM_SINGLE(STA32X_AUTO3, STA32X_AUTO3_PEQ_SHIFT, +- 32, sta32x_preset_eq_mode); +-static const struct soc_enum sta32x_limiter_ch1_enum = +- SOC_ENUM_SINGLE(STA32X_C1CFG, STA32X_CxCFG_LS_SHIFT, +- 3, sta32x_limiter_select); +-static const struct soc_enum sta32x_limiter_ch2_enum = +- SOC_ENUM_SINGLE(STA32X_C2CFG, STA32X_CxCFG_LS_SHIFT, +- 3, sta32x_limiter_select); +-static const struct soc_enum sta32x_limiter_ch3_enum = +- SOC_ENUM_SINGLE(STA32X_C3CFG, STA32X_CxCFG_LS_SHIFT, +- 3, sta32x_limiter_select); +-static const struct soc_enum sta32x_limiter1_attack_rate_enum = +- SOC_ENUM_SINGLE(STA32X_L1AR, STA32X_LxA_SHIFT, +- 16, sta32x_limiter_attack_rate); +-static const struct soc_enum sta32x_limiter2_attack_rate_enum = +- SOC_ENUM_SINGLE(STA32X_L2AR, STA32X_LxA_SHIFT, +- 16, sta32x_limiter_attack_rate); +-static const struct soc_enum sta32x_limiter1_release_rate_enum = +- SOC_ENUM_SINGLE(STA32X_L1AR, STA32X_LxR_SHIFT, +- 16, sta32x_limiter_release_rate); +-static const struct soc_enum sta32x_limiter2_release_rate_enum = +- SOC_ENUM_SINGLE(STA32X_L2AR, STA32X_LxR_SHIFT, +- 16, sta32x_limiter_release_rate); ++static SOC_ENUM_SINGLE_DECL(sta32x_drc_ac_enum, ++ STA32X_CONFD, STA32X_CONFD_DRC_SHIFT, ++ sta32x_drc_ac); ++static SOC_ENUM_SINGLE_DECL(sta32x_auto_eq_enum, ++ STA32X_AUTO1, STA32X_AUTO1_AMEQ_SHIFT, ++ sta32x_auto_eq_mode); ++static SOC_ENUM_SINGLE_DECL(sta32x_auto_gc_enum, ++ STA32X_AUTO1, STA32X_AUTO1_AMGC_SHIFT, ++ sta32x_auto_gc_mode); ++static SOC_ENUM_SINGLE_DECL(sta32x_auto_xo_enum, ++ STA32X_AUTO2, STA32X_AUTO2_XO_SHIFT, ++ sta32x_auto_xo_mode); ++static SOC_ENUM_SINGLE_DECL(sta32x_preset_eq_enum, ++ STA32X_AUTO3, STA32X_AUTO3_PEQ_SHIFT, ++ sta32x_preset_eq_mode); ++static SOC_ENUM_SINGLE_DECL(sta32x_limiter_ch1_enum, ++ STA32X_C1CFG, STA32X_CxCFG_LS_SHIFT, ++ sta32x_limiter_select); ++static SOC_ENUM_SINGLE_DECL(sta32x_limiter_ch2_enum, ++ STA32X_C2CFG, STA32X_CxCFG_LS_SHIFT, ++ sta32x_limiter_select); ++static SOC_ENUM_SINGLE_DECL(sta32x_limiter_ch3_enum, ++ STA32X_C3CFG, STA32X_CxCFG_LS_SHIFT, ++ sta32x_limiter_select); ++static SOC_ENUM_SINGLE_DECL(sta32x_limiter1_attack_rate_enum, ++ STA32X_L1AR, STA32X_LxA_SHIFT, ++ sta32x_limiter_attack_rate); ++static SOC_ENUM_SINGLE_DECL(sta32x_limiter2_attack_rate_enum, ++ STA32X_L2AR, STA32X_LxA_SHIFT, ++ sta32x_limiter_attack_rate); ++static SOC_ENUM_SINGLE_DECL(sta32x_limiter1_release_rate_enum, ++ STA32X_L1AR, STA32X_LxR_SHIFT, ++ sta32x_limiter_release_rate); ++static SOC_ENUM_SINGLE_DECL(sta32x_limiter2_release_rate_enum, ++ STA32X_L2AR, STA32X_LxR_SHIFT, ++ sta32x_limiter_release_rate); + + /* byte array controls for setting biquad, mixer, scaling coefficients; + * for biquads all five coefficients need to be set in one go, +@@ -331,7 +331,7 @@ static int sta32x_sync_coef_shadow(struct snd_soc_codec *codec) + + static int sta32x_cache_sync(struct snd_soc_codec *codec) + { +- struct sta32x_priv *sta32x = codec->control_data; ++ struct sta32x_priv *sta32x = snd_soc_codec_get_drvdata(codec); + unsigned int mute; + int rc; + +@@ -432,7 +432,7 @@ SOC_SINGLE_TLV("Treble Tone Control", STA32X_TONE, STA32X_TONE_TTC_SHIFT, 15, 0, + SOC_ENUM("Limiter1 Attack Rate (dB/ms)", sta32x_limiter1_attack_rate_enum), + SOC_ENUM("Limiter2 Attack Rate (dB/ms)", sta32x_limiter2_attack_rate_enum), + SOC_ENUM("Limiter1 Release Rate (dB/ms)", sta32x_limiter1_release_rate_enum), +-SOC_ENUM("Limiter2 Release Rate (dB/ms)", sta32x_limiter1_release_rate_enum), ++SOC_ENUM("Limiter2 Release Rate (dB/ms)", sta32x_limiter2_release_rate_enum), + + /* depending on mode, the attack/release thresholds have + * two different enum definitions; provide both +diff --git a/sound/soc/codecs/wm8770.c b/sound/soc/codecs/wm8770.c +index 89a18d82f303..5bce21013485 100644 +--- a/sound/soc/codecs/wm8770.c ++++ b/sound/soc/codecs/wm8770.c +@@ -196,8 +196,8 @@ static const char *ain_text[] = { + "AIN5", "AIN6", "AIN7", "AIN8" + }; + +-static const struct soc_enum ain_enum = +- SOC_ENUM_DOUBLE(WM8770_ADCMUX, 0, 4, 8, ain_text); ++static SOC_ENUM_DOUBLE_DECL(ain_enum, ++ WM8770_ADCMUX, 0, 4, ain_text); + + static const struct snd_kcontrol_new ain_mux = + SOC_DAPM_ENUM("Capture Mux", ain_enum); +diff --git a/sound/soc/codecs/wm8958-dsp2.c b/sound/soc/codecs/wm8958-dsp2.c +index b0710d817a65..754f88e1fdab 100644 +--- a/sound/soc/codecs/wm8958-dsp2.c ++++ b/sound/soc/codecs/wm8958-dsp2.c +@@ -153,7 +153,7 @@ static int wm8958_dsp2_fw(struct snd_soc_codec *codec, const char *name, + + data32 &= 0xffffff; + +- wm8994_bulk_write(codec->control_data, ++ wm8994_bulk_write(wm8994->wm8994, + data32 & 0xffffff, + block_len / 2, + (void *)(data + 8)); +diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c +index cc2dd1f0decb..0339d464791a 100644 +--- a/sound/usb/mixer_maps.c ++++ b/sound/usb/mixer_maps.c +@@ -322,6 +322,11 @@ static struct usbmix_name_map hercules_usb51_map[] = { + { 0 } /* terminator */ + }; + ++static const struct usbmix_name_map kef_x300a_map[] = { ++ { 10, NULL }, /* firmware locks up (?) when we try to access this FU */ ++ { 0 } ++}; ++ + /* + * Control map entries + */ +@@ -409,6 +414,10 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = { + .id = USB_ID(0x200c, 0x1018), + .map = ebox44_map, + }, ++ { ++ .id = USB_ID(0x27ac, 0x1000), ++ .map = kef_x300a_map, ++ }, + { 0 } /* terminator */ + }; + diff --git a/projects/Cuboxi/patches/linux/linux-000-patch-3.10.33-34.patch b/projects/Cuboxi/patches/linux/linux-000-patch-3.10.33-34.patch new file mode 100644 index 0000000000..41066cf2e3 --- /dev/null +++ b/projects/Cuboxi/patches/linux/linux-000-patch-3.10.33-34.patch @@ -0,0 +1,2789 @@ +diff --git a/Makefile b/Makefile +index 1e602eb906fa..571a1bf14868 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 10 +-SUBLEVEL = 33 ++SUBLEVEL = 34 + EXTRAVERSION = + NAME = TOSSUG Baby Fish + +diff --git a/arch/arm/include/asm/spinlock.h b/arch/arm/include/asm/spinlock.h +index dd64cc6f9cba..b07c09e5a0ac 100644 +--- a/arch/arm/include/asm/spinlock.h ++++ b/arch/arm/include/asm/spinlock.h +@@ -107,7 +107,7 @@ static inline int arch_spin_trylock(arch_spinlock_t *lock) + " subs %1, %0, %0, ror #16\n" + " addeq %0, %0, %4\n" + " strexeq %2, %0, [%3]" +- : "=&r" (slock), "=&r" (contended), "=r" (res) ++ : "=&r" (slock), "=&r" (contended), "=&r" (res) + : "r" (&lock->slock), "I" (1 << TICKET_SHIFT) + : "cc"); + } while (res); +diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c +index b4b1d397592b..eb83bcc70ec8 100644 +--- a/arch/arm/kernel/setup.c ++++ b/arch/arm/kernel/setup.c +@@ -530,6 +530,7 @@ void __init dump_machine_table(void) + int __init arm_add_memory(phys_addr_t start, phys_addr_t size) + { + struct membank *bank = &meminfo.bank[meminfo.nr_banks]; ++ u64 aligned_start; + + if (meminfo.nr_banks >= NR_BANKS) { + printk(KERN_CRIT "NR_BANKS too low, " +@@ -542,10 +543,16 @@ int __init arm_add_memory(phys_addr_t start, phys_addr_t size) + * Size is appropriately rounded down, start is rounded up. + */ + size -= start & ~PAGE_MASK; +- bank->start = PAGE_ALIGN(start); ++ aligned_start = PAGE_ALIGN(start); + +-#ifndef CONFIG_ARM_LPAE +- if (bank->start + size < bank->start) { ++#ifndef CONFIG_ARCH_PHYS_ADDR_T_64BIT ++ if (aligned_start > ULONG_MAX) { ++ printk(KERN_CRIT "Ignoring memory at 0x%08llx outside " ++ "32-bit physical address space\n", (long long)start); ++ return -EINVAL; ++ } ++ ++ if (aligned_start + size > ULONG_MAX) { + printk(KERN_CRIT "Truncating memory at 0x%08llx to fit in " + "32-bit physical address space\n", (long long)start); + /* +@@ -553,10 +560,25 @@ int __init arm_add_memory(phys_addr_t start, phys_addr_t size) + * 32 bits, we use ULONG_MAX as the upper limit rather than 4GB. + * This means we lose a page after masking. + */ +- size = ULONG_MAX - bank->start; ++ size = ULONG_MAX - aligned_start; + } + #endif + ++ if (aligned_start < PHYS_OFFSET) { ++ if (aligned_start + size <= PHYS_OFFSET) { ++ pr_info("Ignoring memory below PHYS_OFFSET: 0x%08llx-0x%08llx\n", ++ aligned_start, aligned_start + size); ++ return -EINVAL; ++ } ++ ++ pr_info("Ignoring memory below PHYS_OFFSET: 0x%08llx-0x%08llx\n", ++ aligned_start, (u64)PHYS_OFFSET); ++ ++ size -= PHYS_OFFSET - aligned_start; ++ aligned_start = PHYS_OFFSET; ++ } ++ ++ bank->start = aligned_start; + bank->size = size & ~(phys_addr_t)(PAGE_SIZE - 1); + + /* +diff --git a/arch/arm/mach-sa1100/include/mach/collie.h b/arch/arm/mach-sa1100/include/mach/collie.h +index f33679d2d3ee..50e1d850ee2e 100644 +--- a/arch/arm/mach-sa1100/include/mach/collie.h ++++ b/arch/arm/mach-sa1100/include/mach/collie.h +@@ -13,6 +13,8 @@ + #ifndef __ASM_ARCH_COLLIE_H + #define __ASM_ARCH_COLLIE_H + ++#include "hardware.h" /* Gives GPIO_MAX */ ++ + extern void locomolcd_power(int on); + + #define COLLIE_SCOOP_GPIO_BASE (GPIO_MAX + 1) +diff --git a/arch/mips/include/asm/mipsregs.h b/arch/mips/include/asm/mipsregs.h +index 87e6207b05e4..3d0074e10595 100644 +--- a/arch/mips/include/asm/mipsregs.h ++++ b/arch/mips/include/asm/mipsregs.h +@@ -14,6 +14,7 @@ + #define _ASM_MIPSREGS_H + + #include ++#include + #include + #include + +diff --git a/arch/powerpc/kernel/reloc_64.S b/arch/powerpc/kernel/reloc_64.S +index b47a0e1ab001..c712ecec13ba 100644 +--- a/arch/powerpc/kernel/reloc_64.S ++++ b/arch/powerpc/kernel/reloc_64.S +@@ -81,6 +81,7 @@ _GLOBAL(relocate) + + 6: blr + ++.balign 8 + p_dyn: .llong __dynamic_start - 0b + p_rela: .llong __rela_dyn_start - 0b + p_st: .llong _stext - 0b +diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S +index 73afd11799ca..df63cae573e0 100644 +--- a/arch/x86/kernel/head_32.S ++++ b/arch/x86/kernel/head_32.S +@@ -566,6 +566,10 @@ ENDPROC(early_idt_handlers) + /* This is global to keep gas from relaxing the jumps */ + ENTRY(early_idt_handler) + cld ++ ++ cmpl $2,(%esp) # X86_TRAP_NMI ++ je is_nmi # Ignore NMI ++ + cmpl $2,%ss:early_recursion_flag + je hlt_loop + incl %ss:early_recursion_flag +@@ -616,8 +620,9 @@ ex_entry: + pop %edx + pop %ecx + pop %eax +- addl $8,%esp /* drop vector number and error code */ + decl %ss:early_recursion_flag ++is_nmi: ++ addl $8,%esp /* drop vector number and error code */ + iret + ENDPROC(early_idt_handler) + +diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S +index a8368608ab41..f2a9a2aa98f3 100644 +--- a/arch/x86/kernel/head_64.S ++++ b/arch/x86/kernel/head_64.S +@@ -343,6 +343,9 @@ early_idt_handlers: + ENTRY(early_idt_handler) + cld + ++ cmpl $2,(%rsp) # X86_TRAP_NMI ++ je is_nmi # Ignore NMI ++ + cmpl $2,early_recursion_flag(%rip) + jz 1f + incl early_recursion_flag(%rip) +@@ -405,8 +408,9 @@ ENTRY(early_idt_handler) + popq %rdx + popq %rcx + popq %rax +- addq $16,%rsp # drop vector number and error code + decl early_recursion_flag(%rip) ++is_nmi: ++ addq $16,%rsp # drop vector number and error code + INTERRUPT_RETURN + ENDPROC(early_idt_handler) + +diff --git a/arch/x86/kernel/i387.c b/arch/x86/kernel/i387.c +index f7ea30dce238..b03ff1842547 100644 +--- a/arch/x86/kernel/i387.c ++++ b/arch/x86/kernel/i387.c +@@ -86,10 +86,19 @@ EXPORT_SYMBOL(__kernel_fpu_begin); + + void __kernel_fpu_end(void) + { +- if (use_eager_fpu()) +- math_state_restore(); +- else ++ if (use_eager_fpu()) { ++ /* ++ * For eager fpu, most the time, tsk_used_math() is true. ++ * Restore the user math as we are done with the kernel usage. ++ * At few instances during thread exit, signal handling etc, ++ * tsk_used_math() is false. Those few places will take proper ++ * actions, so we don't need to restore the math here. ++ */ ++ if (likely(tsk_used_math(current))) ++ math_state_restore(); ++ } else { + stts(); ++ } + } + EXPORT_SYMBOL(__kernel_fpu_end); + +diff --git a/arch/x86/kernel/quirks.c b/arch/x86/kernel/quirks.c +index 04ee1e2e4c02..52dbf1e400dc 100644 +--- a/arch/x86/kernel/quirks.c ++++ b/arch/x86/kernel/quirks.c +@@ -529,7 +529,7 @@ static void quirk_amd_nb_node(struct pci_dev *dev) + return; + + pci_read_config_dword(nb_ht, 0x60, &val); +- node = val & 7; ++ node = pcibus_to_node(dev->bus) | (val & 7); + /* + * Some hardware may return an invalid node ID, + * so check it first: +diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c +index a14a6eaf871d..765210d4d925 100644 +--- a/arch/x86/kvm/svm.c ++++ b/arch/x86/kvm/svm.c +@@ -2985,10 +2985,8 @@ static int cr8_write_interception(struct vcpu_svm *svm) + u8 cr8_prev = kvm_get_cr8(&svm->vcpu); + /* instruction emulation calls kvm_set_cr8() */ + r = cr_interception(svm); +- if (irqchip_in_kernel(svm->vcpu.kvm)) { +- clr_cr_intercept(svm, INTERCEPT_CR8_WRITE); ++ if (irqchip_in_kernel(svm->vcpu.kvm)) + return r; +- } + if (cr8_prev <= kvm_get_cr8(&svm->vcpu)) + return r; + kvm_run->exit_reason = KVM_EXIT_SET_TPR; +@@ -3550,6 +3548,8 @@ static void update_cr8_intercept(struct kvm_vcpu *vcpu, int tpr, int irr) + if (is_guest_mode(vcpu) && (vcpu->arch.hflags & HF_VINTR_MASK)) + return; + ++ clr_cr_intercept(svm, INTERCEPT_CR8_WRITE); ++ + if (irr == -1) + return; + +diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c +index 3322b47ab7ca..c2dd598e25a2 100644 +--- a/drivers/acpi/resource.c ++++ b/drivers/acpi/resource.c +@@ -77,18 +77,24 @@ bool acpi_dev_resource_memory(struct acpi_resource *ares, struct resource *res) + switch (ares->type) { + case ACPI_RESOURCE_TYPE_MEMORY24: + memory24 = &ares->data.memory24; ++ if (!memory24->address_length) ++ return false; + acpi_dev_get_memresource(res, memory24->minimum, + memory24->address_length, + memory24->write_protect); + break; + case ACPI_RESOURCE_TYPE_MEMORY32: + memory32 = &ares->data.memory32; ++ if (!memory32->address_length) ++ return false; + acpi_dev_get_memresource(res, memory32->minimum, + memory32->address_length, + memory32->write_protect); + break; + case ACPI_RESOURCE_TYPE_FIXED_MEMORY32: + fixed_memory32 = &ares->data.fixed_memory32; ++ if (!fixed_memory32->address_length) ++ return false; + acpi_dev_get_memresource(res, fixed_memory32->address, + fixed_memory32->address_length, + fixed_memory32->write_protect); +@@ -144,12 +150,16 @@ bool acpi_dev_resource_io(struct acpi_resource *ares, struct resource *res) + switch (ares->type) { + case ACPI_RESOURCE_TYPE_IO: + io = &ares->data.io; ++ if (!io->address_length) ++ return false; + acpi_dev_get_ioresource(res, io->minimum, + io->address_length, + io->io_decode); + break; + case ACPI_RESOURCE_TYPE_FIXED_IO: + fixed_io = &ares->data.fixed_io; ++ if (!fixed_io->address_length) ++ return false; + acpi_dev_get_ioresource(res, fixed_io->address, + fixed_io->address_length, + ACPI_DECODE_10); +diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c +index 9c1a435d10e6..035920f2ab4d 100644 +--- a/drivers/acpi/sleep.c ++++ b/drivers/acpi/sleep.c +@@ -78,6 +78,17 @@ static int acpi_sleep_prepare(u32 acpi_state) + return 0; + } + ++static bool acpi_sleep_state_supported(u8 sleep_state) ++{ ++ acpi_status status; ++ u8 type_a, type_b; ++ ++ status = acpi_get_sleep_type_data(sleep_state, &type_a, &type_b); ++ return ACPI_SUCCESS(status) && (!acpi_gbl_reduced_hardware ++ || (acpi_gbl_FADT.sleep_control.address ++ && acpi_gbl_FADT.sleep_status.address)); ++} ++ + #ifdef CONFIG_ACPI_SLEEP + static u32 acpi_target_sleep_state = ACPI_STATE_S0; + +@@ -600,15 +611,9 @@ static void acpi_sleep_suspend_setup(void) + { + int i; + +- for (i = ACPI_STATE_S1; i < ACPI_STATE_S4; i++) { +- acpi_status status; +- u8 type_a, type_b; +- +- status = acpi_get_sleep_type_data(i, &type_a, &type_b); +- if (ACPI_SUCCESS(status)) { ++ for (i = ACPI_STATE_S1; i < ACPI_STATE_S4; i++) ++ if (acpi_sleep_state_supported(i)) + sleep_states[i] = 1; +- } +- } + + suspend_set_ops(old_suspend_ordering ? + &acpi_suspend_ops_old : &acpi_suspend_ops); +@@ -739,11 +744,7 @@ static const struct platform_hibernation_ops acpi_hibernation_ops_old = { + + static void acpi_sleep_hibernate_setup(void) + { +- acpi_status status; +- u8 type_a, type_b; +- +- status = acpi_get_sleep_type_data(ACPI_STATE_S4, &type_a, &type_b); +- if (ACPI_FAILURE(status)) ++ if (!acpi_sleep_state_supported(ACPI_STATE_S4)) + return; + + hibernation_set_ops(old_suspend_ordering ? +@@ -792,8 +793,6 @@ static void acpi_power_off(void) + + int __init acpi_sleep_init(void) + { +- acpi_status status; +- u8 type_a, type_b; + char supported[ACPI_S_STATE_COUNT * 3 + 1]; + char *pos = supported; + int i; +@@ -808,8 +807,7 @@ int __init acpi_sleep_init(void) + acpi_sleep_suspend_setup(); + acpi_sleep_hibernate_setup(); + +- status = acpi_get_sleep_type_data(ACPI_STATE_S5, &type_a, &type_b); +- if (ACPI_SUCCESS(status)) { ++ if (acpi_sleep_state_supported(ACPI_STATE_S5)) { + sleep_states[ACPI_STATE_S5] = 1; + pm_power_off_prepare = acpi_power_off_prepare; + pm_power_off = acpi_power_off; +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index 15518fda2d2a..8b8cbe9bcb92 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -4152,6 +4152,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { + + /* Seagate Momentus SpinPoint M8 seem to have FPMDA_AA issues */ + { "ST1000LM024 HN-M101MBB", "2AR10001", ATA_HORKAGE_BROKEN_FPDMA_AA }, ++ { "ST1000LM024 HN-M101MBB", "2BA30001", ATA_HORKAGE_BROKEN_FPDMA_AA }, + + /* Blacklist entries taken from Silicon Image 3124/3132 + Windows driver .inf file - also several Linux problem reports */ +diff --git a/drivers/firewire/core-device.c b/drivers/firewire/core-device.c +index 664a6ff0a823..392ad513dc04 100644 +--- a/drivers/firewire/core-device.c ++++ b/drivers/firewire/core-device.c +@@ -895,7 +895,7 @@ static int lookup_existing_device(struct device *dev, void *data) + old->config_rom_retries = 0; + fw_notice(card, "rediscovered device %s\n", dev_name(dev)); + +- PREPARE_DELAYED_WORK(&old->work, fw_device_update); ++ old->workfn = fw_device_update; + fw_schedule_device_work(old, 0); + + if (current_node == card->root_node) +@@ -1054,7 +1054,7 @@ static void fw_device_init(struct work_struct *work) + if (atomic_cmpxchg(&device->state, + FW_DEVICE_INITIALIZING, + FW_DEVICE_RUNNING) == FW_DEVICE_GONE) { +- PREPARE_DELAYED_WORK(&device->work, fw_device_shutdown); ++ device->workfn = fw_device_shutdown; + fw_schedule_device_work(device, SHUTDOWN_DELAY); + } else { + fw_notice(card, "created device %s: GUID %08x%08x, S%d00\n", +@@ -1175,13 +1175,20 @@ static void fw_device_refresh(struct work_struct *work) + dev_name(&device->device), fw_rcode_string(ret)); + gone: + atomic_set(&device->state, FW_DEVICE_GONE); +- PREPARE_DELAYED_WORK(&device->work, fw_device_shutdown); ++ device->workfn = fw_device_shutdown; + fw_schedule_device_work(device, SHUTDOWN_DELAY); + out: + if (node_id == card->root_node->node_id) + fw_schedule_bm_work(card, 0); + } + ++static void fw_device_workfn(struct work_struct *work) ++{ ++ struct fw_device *device = container_of(to_delayed_work(work), ++ struct fw_device, work); ++ device->workfn(work); ++} ++ + void fw_node_event(struct fw_card *card, struct fw_node *node, int event) + { + struct fw_device *device; +@@ -1231,7 +1238,8 @@ void fw_node_event(struct fw_card *card, struct fw_node *node, int event) + * power-up after getting plugged in. We schedule the + * first config rom scan half a second after bus reset. + */ +- INIT_DELAYED_WORK(&device->work, fw_device_init); ++ device->workfn = fw_device_init; ++ INIT_DELAYED_WORK(&device->work, fw_device_workfn); + fw_schedule_device_work(device, INITIAL_DELAY); + break; + +@@ -1247,7 +1255,7 @@ void fw_node_event(struct fw_card *card, struct fw_node *node, int event) + if (atomic_cmpxchg(&device->state, + FW_DEVICE_RUNNING, + FW_DEVICE_INITIALIZING) == FW_DEVICE_RUNNING) { +- PREPARE_DELAYED_WORK(&device->work, fw_device_refresh); ++ device->workfn = fw_device_refresh; + fw_schedule_device_work(device, + device->is_local ? 0 : INITIAL_DELAY); + } +@@ -1262,7 +1270,7 @@ void fw_node_event(struct fw_card *card, struct fw_node *node, int event) + smp_wmb(); /* update node_id before generation */ + device->generation = card->generation; + if (atomic_read(&device->state) == FW_DEVICE_RUNNING) { +- PREPARE_DELAYED_WORK(&device->work, fw_device_update); ++ device->workfn = fw_device_update; + fw_schedule_device_work(device, 0); + } + break; +@@ -1287,7 +1295,7 @@ void fw_node_event(struct fw_card *card, struct fw_node *node, int event) + device = node->data; + if (atomic_xchg(&device->state, + FW_DEVICE_GONE) == FW_DEVICE_RUNNING) { +- PREPARE_DELAYED_WORK(&device->work, fw_device_shutdown); ++ device->workfn = fw_device_shutdown; + fw_schedule_device_work(device, + list_empty(&card->link) ? 0 : SHUTDOWN_DELAY); + } +diff --git a/drivers/firewire/net.c b/drivers/firewire/net.c +index 815b0fcbe918..7bdb6fe63236 100644 +--- a/drivers/firewire/net.c ++++ b/drivers/firewire/net.c +@@ -929,8 +929,6 @@ static void fwnet_write_complete(struct fw_card *card, int rcode, + if (rcode == RCODE_COMPLETE) { + fwnet_transmit_packet_done(ptask); + } else { +- fwnet_transmit_packet_failed(ptask); +- + if (printk_timed_ratelimit(&j, 1000) || rcode != last_rcode) { + dev_err(&ptask->dev->netdev->dev, + "fwnet_write_complete failed: %x (skipped %d)\n", +@@ -938,8 +936,10 @@ static void fwnet_write_complete(struct fw_card *card, int rcode, + + errors_skipped = 0; + last_rcode = rcode; +- } else ++ } else { + errors_skipped++; ++ } ++ fwnet_transmit_packet_failed(ptask); + } + } + +diff --git a/drivers/firewire/sbp2.c b/drivers/firewire/sbp2.c +index 47674b913843..1b1c37dd830b 100644 +--- a/drivers/firewire/sbp2.c ++++ b/drivers/firewire/sbp2.c +@@ -146,6 +146,7 @@ struct sbp2_logical_unit { + */ + int generation; + int retries; ++ work_func_t workfn; + struct delayed_work work; + bool has_sdev; + bool blocked; +@@ -864,7 +865,7 @@ static void sbp2_login(struct work_struct *work) + /* set appropriate retry limit(s) in BUSY_TIMEOUT register */ + sbp2_set_busy_timeout(lu); + +- PREPARE_DELAYED_WORK(&lu->work, sbp2_reconnect); ++ lu->workfn = sbp2_reconnect; + sbp2_agent_reset(lu); + + /* This was a re-login. */ +@@ -918,7 +919,7 @@ static void sbp2_login(struct work_struct *work) + * If a bus reset happened, sbp2_update will have requeued + * lu->work already. Reset the work from reconnect to login. + */ +- PREPARE_DELAYED_WORK(&lu->work, sbp2_login); ++ lu->workfn = sbp2_login; + } + + static void sbp2_reconnect(struct work_struct *work) +@@ -952,7 +953,7 @@ static void sbp2_reconnect(struct work_struct *work) + lu->retries++ >= 5) { + dev_err(tgt_dev(tgt), "failed to reconnect\n"); + lu->retries = 0; +- PREPARE_DELAYED_WORK(&lu->work, sbp2_login); ++ lu->workfn = sbp2_login; + } + sbp2_queue_work(lu, DIV_ROUND_UP(HZ, 5)); + +@@ -972,6 +973,13 @@ static void sbp2_reconnect(struct work_struct *work) + sbp2_conditionally_unblock(lu); + } + ++static void sbp2_lu_workfn(struct work_struct *work) ++{ ++ struct sbp2_logical_unit *lu = container_of(to_delayed_work(work), ++ struct sbp2_logical_unit, work); ++ lu->workfn(work); ++} ++ + static int sbp2_add_logical_unit(struct sbp2_target *tgt, int lun_entry) + { + struct sbp2_logical_unit *lu; +@@ -998,7 +1006,8 @@ static int sbp2_add_logical_unit(struct sbp2_target *tgt, int lun_entry) + lu->blocked = false; + ++tgt->dont_block; + INIT_LIST_HEAD(&lu->orb_list); +- INIT_DELAYED_WORK(&lu->work, sbp2_login); ++ lu->workfn = sbp2_login; ++ INIT_DELAYED_WORK(&lu->work, sbp2_lu_workfn); + + list_add_tail(&lu->link, &tgt->lu_list); + return 0; +diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c +index 4c81e9faa635..1f7f3ce875c8 100644 +--- a/drivers/gpu/drm/radeon/atombios_encoders.c ++++ b/drivers/gpu/drm/radeon/atombios_encoders.c +@@ -1281,7 +1281,7 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action, uint8_t + } + if (is_dp) + args.v5.ucLaneNum = dp_lane_count; +- else if (radeon_encoder->pixel_clock > 165000) ++ else if (radeon_dig_monitor_is_duallink(encoder, radeon_encoder->pixel_clock)) + args.v5.ucLaneNum = 8; + else + args.v5.ucLaneNum = 4; +diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c +index 8697abd7b173..0ac0a88860a4 100644 +--- a/drivers/gpu/drm/ttm/ttm_bo.c ++++ b/drivers/gpu/drm/ttm/ttm_bo.c +@@ -498,9 +498,11 @@ static int ttm_bo_handle_move_mem(struct ttm_buffer_object *bo, + + moved: + if (bo->evicted) { +- ret = bdev->driver->invalidate_caches(bdev, bo->mem.placement); +- if (ret) +- pr_err("Can not flush read caches\n"); ++ if (bdev->driver->invalidate_caches) { ++ ret = bdev->driver->invalidate_caches(bdev, bo->mem.placement); ++ if (ret) ++ pr_err("Can not flush read caches\n"); ++ } + bo->evicted = false; + } + +diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c +index 6fc283a041d6..588a5eca63d8 100644 +--- a/drivers/infiniband/ulp/isert/ib_isert.c ++++ b/drivers/infiniband/ulp/isert/ib_isert.c +@@ -392,8 +392,8 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event) + isert_conn->state = ISER_CONN_INIT; + INIT_LIST_HEAD(&isert_conn->conn_accept_node); + init_completion(&isert_conn->conn_login_comp); +- init_waitqueue_head(&isert_conn->conn_wait); +- init_waitqueue_head(&isert_conn->conn_wait_comp_err); ++ init_completion(&isert_conn->conn_wait); ++ init_completion(&isert_conn->conn_wait_comp_err); + kref_init(&isert_conn->conn_kref); + kref_get(&isert_conn->conn_kref); + mutex_init(&isert_conn->conn_mutex); +@@ -550,11 +550,11 @@ isert_disconnect_work(struct work_struct *work) + + pr_debug("isert_disconnect_work(): >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n"); + mutex_lock(&isert_conn->conn_mutex); +- isert_conn->state = ISER_CONN_DOWN; ++ if (isert_conn->state == ISER_CONN_UP) ++ isert_conn->state = ISER_CONN_TERMINATING; + + if (isert_conn->post_recv_buf_count == 0 && + atomic_read(&isert_conn->post_send_buf_count) == 0) { +- pr_debug("Calling wake_up(&isert_conn->conn_wait);\n"); + mutex_unlock(&isert_conn->conn_mutex); + goto wake_up; + } +@@ -574,7 +574,7 @@ isert_disconnect_work(struct work_struct *work) + mutex_unlock(&isert_conn->conn_mutex); + + wake_up: +- wake_up(&isert_conn->conn_wait); ++ complete(&isert_conn->conn_wait); + isert_put_conn(isert_conn); + } + +@@ -1213,7 +1213,7 @@ isert_put_cmd(struct isert_cmd *isert_cmd) + case ISCSI_OP_SCSI_CMD: + spin_lock_bh(&conn->cmd_lock); + if (!list_empty(&cmd->i_conn_node)) +- list_del(&cmd->i_conn_node); ++ list_del_init(&cmd->i_conn_node); + spin_unlock_bh(&conn->cmd_lock); + + if (cmd->data_direction == DMA_TO_DEVICE) +@@ -1225,7 +1225,7 @@ isert_put_cmd(struct isert_cmd *isert_cmd) + case ISCSI_OP_SCSI_TMFUNC: + spin_lock_bh(&conn->cmd_lock); + if (!list_empty(&cmd->i_conn_node)) +- list_del(&cmd->i_conn_node); ++ list_del_init(&cmd->i_conn_node); + spin_unlock_bh(&conn->cmd_lock); + + transport_generic_free_cmd(&cmd->se_cmd, 0); +@@ -1234,7 +1234,7 @@ isert_put_cmd(struct isert_cmd *isert_cmd) + case ISCSI_OP_NOOP_OUT: + spin_lock_bh(&conn->cmd_lock); + if (!list_empty(&cmd->i_conn_node)) +- list_del(&cmd->i_conn_node); ++ list_del_init(&cmd->i_conn_node); + spin_unlock_bh(&conn->cmd_lock); + + /* +@@ -1308,6 +1308,7 @@ isert_completion_rdma_read(struct iser_tx_desc *tx_desc, + } + + cmd->write_data_done = se_cmd->data_length; ++ wr->send_wr_num = 0; + + pr_debug("isert_do_rdma_read_comp, calling target_execute_cmd\n"); + spin_lock_bh(&cmd->istate_lock); +@@ -1348,7 +1349,7 @@ isert_do_control_comp(struct work_struct *work) + pr_debug("Calling iscsit_logout_post_handler >>>>>>>>>>>>>>\n"); + /* + * Call atomic_dec(&isert_conn->post_send_buf_count) +- * from isert_free_conn() ++ * from isert_wait_conn() + */ + isert_conn->logout_posted = true; + iscsit_logout_post_handler(cmd, cmd->conn); +@@ -1367,6 +1368,7 @@ isert_response_completion(struct iser_tx_desc *tx_desc, + struct ib_device *ib_dev) + { + struct iscsi_cmd *cmd = &isert_cmd->iscsi_cmd; ++ struct isert_rdma_wr *wr = &isert_cmd->rdma_wr; + + if (cmd->i_state == ISTATE_SEND_TASKMGTRSP || + cmd->i_state == ISTATE_SEND_LOGOUTRSP || +@@ -1377,7 +1379,7 @@ isert_response_completion(struct iser_tx_desc *tx_desc, + queue_work(isert_comp_wq, &isert_cmd->comp_work); + return; + } +- atomic_dec(&isert_conn->post_send_buf_count); ++ atomic_sub(wr->send_wr_num + 1, &isert_conn->post_send_buf_count); + + cmd->i_state = ISTATE_SENT_STATUS; + isert_completion_put(tx_desc, isert_cmd, ib_dev); +@@ -1415,7 +1417,7 @@ isert_send_completion(struct iser_tx_desc *tx_desc, + case ISER_IB_RDMA_READ: + pr_debug("isert_send_completion: Got ISER_IB_RDMA_READ:\n"); + +- atomic_dec(&isert_conn->post_send_buf_count); ++ atomic_sub(wr->send_wr_num, &isert_conn->post_send_buf_count); + isert_completion_rdma_read(tx_desc, isert_cmd); + break; + default: +@@ -1426,31 +1428,38 @@ isert_send_completion(struct iser_tx_desc *tx_desc, + } + + static void +-isert_cq_comp_err(struct iser_tx_desc *tx_desc, struct isert_conn *isert_conn) ++isert_cq_tx_comp_err(struct iser_tx_desc *tx_desc, struct isert_conn *isert_conn) + { + struct ib_device *ib_dev = isert_conn->conn_cm_id->device; ++ struct isert_cmd *isert_cmd = tx_desc->isert_cmd; + +- if (tx_desc) { +- struct isert_cmd *isert_cmd = tx_desc->isert_cmd; ++ if (!isert_cmd) ++ isert_unmap_tx_desc(tx_desc, ib_dev); ++ else ++ isert_completion_put(tx_desc, isert_cmd, ib_dev); ++} + +- if (!isert_cmd) +- isert_unmap_tx_desc(tx_desc, ib_dev); +- else +- isert_completion_put(tx_desc, isert_cmd, ib_dev); ++static void ++isert_cq_rx_comp_err(struct isert_conn *isert_conn) ++{ ++ struct iscsi_conn *conn = isert_conn->conn; ++ ++ if (isert_conn->post_recv_buf_count) ++ return; ++ ++ if (conn->sess) { ++ target_sess_cmd_list_set_waiting(conn->sess->se_sess); ++ target_wait_for_sess_cmds(conn->sess->se_sess); + } + +- if (isert_conn->post_recv_buf_count == 0 && +- atomic_read(&isert_conn->post_send_buf_count) == 0) { +- pr_debug("isert_cq_comp_err >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n"); +- pr_debug("Calling wake_up from isert_cq_comp_err\n"); ++ while (atomic_read(&isert_conn->post_send_buf_count)) ++ msleep(3000); + +- mutex_lock(&isert_conn->conn_mutex); +- if (isert_conn->state != ISER_CONN_DOWN) +- isert_conn->state = ISER_CONN_TERMINATING; +- mutex_unlock(&isert_conn->conn_mutex); ++ mutex_lock(&isert_conn->conn_mutex); ++ isert_conn->state = ISER_CONN_DOWN; ++ mutex_unlock(&isert_conn->conn_mutex); + +- wake_up(&isert_conn->conn_wait_comp_err); +- } ++ complete(&isert_conn->conn_wait_comp_err); + } + + static void +@@ -1475,7 +1484,7 @@ isert_cq_tx_work(struct work_struct *work) + pr_debug("TX wc.status != IB_WC_SUCCESS >>>>>>>>>>>>>>\n"); + pr_debug("TX wc.status: 0x%08x\n", wc.status); + atomic_dec(&isert_conn->post_send_buf_count); +- isert_cq_comp_err(tx_desc, isert_conn); ++ isert_cq_tx_comp_err(tx_desc, isert_conn); + } + } + +@@ -1517,7 +1526,7 @@ isert_cq_rx_work(struct work_struct *work) + pr_debug("RX wc.status: 0x%08x\n", wc.status); + + isert_conn->post_recv_buf_count--; +- isert_cq_comp_err(NULL, isert_conn); ++ isert_cq_rx_comp_err(isert_conn); + } + } + +@@ -1827,12 +1836,12 @@ isert_put_datain(struct iscsi_conn *conn, struct iscsi_cmd *cmd) + isert_init_tx_hdrs(isert_conn, &isert_cmd->tx_desc); + isert_init_send_wr(isert_cmd, &isert_cmd->tx_desc.send_wr); + +- atomic_inc(&isert_conn->post_send_buf_count); ++ atomic_add(wr->send_wr_num + 1, &isert_conn->post_send_buf_count); + + rc = ib_post_send(isert_conn->conn_qp, wr->send_wr, &wr_failed); + if (rc) { + pr_warn("ib_post_send() failed for IB_WR_RDMA_WRITE\n"); +- atomic_dec(&isert_conn->post_send_buf_count); ++ atomic_sub(wr->send_wr_num + 1, &isert_conn->post_send_buf_count); + } + pr_debug("Posted RDMA_WRITE + Response for iSER Data READ\n"); + return 1; +@@ -1935,12 +1944,12 @@ isert_get_dataout(struct iscsi_conn *conn, struct iscsi_cmd *cmd, bool recovery) + data_left -= data_len; + } + +- atomic_inc(&isert_conn->post_send_buf_count); ++ atomic_add(wr->send_wr_num, &isert_conn->post_send_buf_count); + + rc = ib_post_send(isert_conn->conn_qp, wr->send_wr, &wr_failed); + if (rc) { + pr_warn("ib_post_send() failed for IB_WR_RDMA_READ\n"); +- atomic_dec(&isert_conn->post_send_buf_count); ++ atomic_sub(wr->send_wr_num, &isert_conn->post_send_buf_count); + } + pr_debug("Posted RDMA_READ memory for ISER Data WRITE\n"); + return 0; +@@ -2218,22 +2227,11 @@ isert_free_np(struct iscsi_np *np) + kfree(isert_np); + } + +-static int isert_check_state(struct isert_conn *isert_conn, int state) +-{ +- int ret; +- +- mutex_lock(&isert_conn->conn_mutex); +- ret = (isert_conn->state == state); +- mutex_unlock(&isert_conn->conn_mutex); +- +- return ret; +-} +- +-static void isert_free_conn(struct iscsi_conn *conn) ++static void isert_wait_conn(struct iscsi_conn *conn) + { + struct isert_conn *isert_conn = conn->context; + +- pr_debug("isert_free_conn: Starting \n"); ++ pr_debug("isert_wait_conn: Starting \n"); + /* + * Decrement post_send_buf_count for special case when called + * from isert_do_control_comp() -> iscsit_logout_post_handler() +@@ -2243,38 +2241,29 @@ static void isert_free_conn(struct iscsi_conn *conn) + atomic_dec(&isert_conn->post_send_buf_count); + + if (isert_conn->conn_cm_id && isert_conn->state != ISER_CONN_DOWN) { +- pr_debug("Calling rdma_disconnect from isert_free_conn\n"); ++ pr_debug("Calling rdma_disconnect from isert_wait_conn\n"); + rdma_disconnect(isert_conn->conn_cm_id); + } + /* + * Only wait for conn_wait_comp_err if the isert_conn made it + * into full feature phase.. + */ +- if (isert_conn->state == ISER_CONN_UP) { +- pr_debug("isert_free_conn: Before wait_event comp_err %d\n", +- isert_conn->state); +- mutex_unlock(&isert_conn->conn_mutex); +- +- wait_event(isert_conn->conn_wait_comp_err, +- (isert_check_state(isert_conn, ISER_CONN_TERMINATING))); +- +- wait_event(isert_conn->conn_wait, +- (isert_check_state(isert_conn, ISER_CONN_DOWN))); +- +- isert_put_conn(isert_conn); +- return; +- } + if (isert_conn->state == ISER_CONN_INIT) { + mutex_unlock(&isert_conn->conn_mutex); +- isert_put_conn(isert_conn); + return; + } +- pr_debug("isert_free_conn: wait_event conn_wait %d\n", +- isert_conn->state); ++ if (isert_conn->state == ISER_CONN_UP) ++ isert_conn->state = ISER_CONN_TERMINATING; + mutex_unlock(&isert_conn->conn_mutex); + +- wait_event(isert_conn->conn_wait, +- (isert_check_state(isert_conn, ISER_CONN_DOWN))); ++ wait_for_completion(&isert_conn->conn_wait_comp_err); ++ ++ wait_for_completion(&isert_conn->conn_wait); ++} ++ ++static void isert_free_conn(struct iscsi_conn *conn) ++{ ++ struct isert_conn *isert_conn = conn->context; + + isert_put_conn(isert_conn); + } +@@ -2286,6 +2275,7 @@ static struct iscsit_transport iser_target_transport = { + .iscsit_setup_np = isert_setup_np, + .iscsit_accept_np = isert_accept_np, + .iscsit_free_np = isert_free_np, ++ .iscsit_wait_conn = isert_wait_conn, + .iscsit_free_conn = isert_free_conn, + .iscsit_alloc_cmd = isert_alloc_cmd, + .iscsit_get_login_rx = isert_get_login_rx, +diff --git a/drivers/infiniband/ulp/isert/ib_isert.h b/drivers/infiniband/ulp/isert/ib_isert.h +index 5795c82a2306..b9d6cc6917cf 100644 +--- a/drivers/infiniband/ulp/isert/ib_isert.h ++++ b/drivers/infiniband/ulp/isert/ib_isert.h +@@ -103,8 +103,8 @@ struct isert_conn { + struct isert_device *conn_device; + struct work_struct conn_logout_work; + struct mutex conn_mutex; +- wait_queue_head_t conn_wait; +- wait_queue_head_t conn_wait_comp_err; ++ struct completion conn_wait; ++ struct completion conn_wait_comp_err; + struct kref conn_kref; + }; + +diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c +index 516f9c922bb2..1a75869d3a82 100644 +--- a/drivers/md/dm-cache-target.c ++++ b/drivers/md/dm-cache-target.c +@@ -861,12 +861,13 @@ static void issue_copy_real(struct dm_cache_migration *mg) + int r; + struct dm_io_region o_region, c_region; + struct cache *cache = mg->cache; ++ sector_t cblock = from_cblock(mg->cblock); + + o_region.bdev = cache->origin_dev->bdev; + o_region.count = cache->sectors_per_block; + + c_region.bdev = cache->cache_dev->bdev; +- c_region.sector = from_cblock(mg->cblock) * cache->sectors_per_block; ++ c_region.sector = cblock * cache->sectors_per_block; + c_region.count = cache->sectors_per_block; + + if (mg->writeback || mg->demote) { +@@ -2174,20 +2175,18 @@ static int cache_map(struct dm_target *ti, struct bio *bio) + bool discarded_block; + struct dm_bio_prison_cell *cell; + struct policy_result lookup_result; +- struct per_bio_data *pb; ++ struct per_bio_data *pb = init_per_bio_data(bio, pb_data_size); + +- if (from_oblock(block) > from_oblock(cache->origin_blocks)) { ++ if (unlikely(from_oblock(block) >= from_oblock(cache->origin_blocks))) { + /* + * This can only occur if the io goes to a partial block at + * the end of the origin device. We don't cache these. + * Just remap to the origin and carry on. + */ +- remap_to_origin_clear_discard(cache, bio, block); ++ remap_to_origin(cache, bio); + return DM_MAPIO_REMAPPED; + } + +- pb = init_per_bio_data(bio, pb_data_size); +- + if (bio->bi_rw & (REQ_FLUSH | REQ_FUA | REQ_DISCARD)) { + defer_bio(cache, bio); + return DM_MAPIO_SUBMITTED; +diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c +index f63169d6af26..6d388cff8455 100644 +--- a/drivers/net/can/flexcan.c ++++ b/drivers/net/can/flexcan.c +@@ -862,7 +862,7 @@ static int flexcan_open(struct net_device *dev) + /* start chip and queuing */ + err = flexcan_chip_start(dev); + if (err) +- goto out_close; ++ goto out_free_irq; + + can_led_event(dev, CAN_LED_EVENT_OPEN); + +@@ -871,6 +871,8 @@ static int flexcan_open(struct net_device *dev) + + return 0; + ++ out_free_irq: ++ free_irq(dev->irq, dev); + out_close: + close_candev(dev); + out: +diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c +index 68e9dc453e11..e27d5c839be5 100644 +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -6687,8 +6687,7 @@ static int tg3_rx(struct tg3_napi *tnapi, int budget) + + work_mask |= opaque_key; + +- if ((desc->err_vlan & RXD_ERR_MASK) != 0 && +- (desc->err_vlan != RXD_ERR_ODD_NIBBLE_RCVD_MII)) { ++ if (desc->err_vlan & RXD_ERR_MASK) { + drop_it: + tg3_recycle_rx(tnapi, tpr, opaque_key, + desc_idx, *post_ptr); +diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h +index ff6e30eeae35..046059c56713 100644 +--- a/drivers/net/ethernet/broadcom/tg3.h ++++ b/drivers/net/ethernet/broadcom/tg3.h +@@ -2587,7 +2587,11 @@ struct tg3_rx_buffer_desc { + #define RXD_ERR_TOO_SMALL 0x00400000 + #define RXD_ERR_NO_RESOURCES 0x00800000 + #define RXD_ERR_HUGE_FRAME 0x01000000 +-#define RXD_ERR_MASK 0xffff0000 ++ ++#define RXD_ERR_MASK (RXD_ERR_BAD_CRC | RXD_ERR_COLLISION | \ ++ RXD_ERR_LINK_LOST | RXD_ERR_PHY_DECODE | \ ++ RXD_ERR_MAC_ABRT | RXD_ERR_TOO_SMALL | \ ++ RXD_ERR_NO_RESOURCES | RXD_ERR_HUGE_FRAME) + + u32 reserved; + u32 opaque; +diff --git a/drivers/net/ethernet/sfc/ptp.c b/drivers/net/ethernet/sfc/ptp.c +index 9a95abf2dedf..540ad16d7807 100644 +--- a/drivers/net/ethernet/sfc/ptp.c ++++ b/drivers/net/ethernet/sfc/ptp.c +@@ -1319,6 +1319,13 @@ void efx_ptp_event(struct efx_nic *efx, efx_qword_t *ev) + struct efx_ptp_data *ptp = efx->ptp_data; + int code = EFX_QWORD_FIELD(*ev, MCDI_EVENT_CODE); + ++ if (!ptp) { ++ if (net_ratelimit()) ++ netif_warn(efx, drv, efx->net_dev, ++ "Received PTP event but PTP not set up\n"); ++ return; ++ } ++ + if (!ptp->enabled) + return; + +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index a0c05e07feeb..2835bfe151b1 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -1597,7 +1597,8 @@ static int virtnet_probe(struct virtio_device *vdev) + /* If we can receive ANY GSO packets, we must allocate large ones. */ + if (virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO4) || + virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO6) || +- virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_ECN)) ++ virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_ECN) || ++ virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_UFO)) + vi->big_packets = true; + + if (virtio_has_feature(vdev, VIRTIO_NET_F_MRG_RXBUF)) +diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c +index 55a62cae2cb4..d0815855d877 100644 +--- a/drivers/net/vmxnet3/vmxnet3_drv.c ++++ b/drivers/net/vmxnet3/vmxnet3_drv.c +@@ -1741,11 +1741,20 @@ vmxnet3_netpoll(struct net_device *netdev) + { + struct vmxnet3_adapter *adapter = netdev_priv(netdev); + +- if (adapter->intr.mask_mode == VMXNET3_IMM_ACTIVE) +- vmxnet3_disable_all_intrs(adapter); +- +- vmxnet3_do_poll(adapter, adapter->rx_queue[0].rx_ring[0].size); +- vmxnet3_enable_all_intrs(adapter); ++ switch (adapter->intr.type) { ++#ifdef CONFIG_PCI_MSI ++ case VMXNET3_IT_MSIX: { ++ int i; ++ for (i = 0; i < adapter->num_rx_queues; i++) ++ vmxnet3_msix_rx(0, &adapter->rx_queue[i]); ++ break; ++ } ++#endif ++ case VMXNET3_IT_MSI: ++ default: ++ vmxnet3_intr(0, adapter->netdev); ++ break; ++ } + + } + #endif /* CONFIG_NET_POLL_CONTROLLER */ +diff --git a/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h b/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h +index 999ab08c34e6..4ae3cf7283ea 100644 +--- a/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h ++++ b/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h +@@ -56,7 +56,7 @@ static const u32 ar9462_2p0_baseband_postamble[][5] = { + {0x00009e14, 0x37b95d5e, 0x37b9605e, 0x3236605e, 0x32365a5e}, + {0x00009e18, 0x00000000, 0x00000000, 0x00000000, 0x00000000}, + {0x00009e1c, 0x0001cf9c, 0x0001cf9c, 0x00021f9c, 0x00021f9c}, +- {0x00009e20, 0x000003b5, 0x000003b5, 0x000003ce, 0x000003ce}, ++ {0x00009e20, 0x000003a5, 0x000003a5, 0x000003a5, 0x000003a5}, + {0x00009e2c, 0x0000001c, 0x0000001c, 0x00000021, 0x00000021}, + {0x00009e3c, 0xcf946220, 0xcf946220, 0xcfd5c782, 0xcfd5c282}, + {0x00009e44, 0x62321e27, 0x62321e27, 0xfe291e27, 0xfe291e27}, +@@ -95,7 +95,7 @@ static const u32 ar9462_2p0_baseband_postamble[][5] = { + {0x0000ae04, 0x001c0000, 0x001c0000, 0x001c0000, 0x00100000}, + {0x0000ae18, 0x00000000, 0x00000000, 0x00000000, 0x00000000}, + {0x0000ae1c, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c}, +- {0x0000ae20, 0x000001b5, 0x000001b5, 0x000001ce, 0x000001ce}, ++ {0x0000ae20, 0x000001a6, 0x000001a6, 0x000001aa, 0x000001aa}, + {0x0000b284, 0x00000000, 0x00000000, 0x00000550, 0x00000550}, + }; + +diff --git a/drivers/net/wireless/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/iwlwifi/dvm/mac80211.c +index e04f3da1ccb3..e9d09f19f856 100644 +--- a/drivers/net/wireless/iwlwifi/dvm/mac80211.c ++++ b/drivers/net/wireless/iwlwifi/dvm/mac80211.c +@@ -739,6 +739,24 @@ static int iwlagn_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, + return ret; + } + ++static inline bool iwl_enable_rx_ampdu(const struct iwl_cfg *cfg) ++{ ++ if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_RXAGG) ++ return false; ++ return true; ++} ++ ++static inline bool iwl_enable_tx_ampdu(const struct iwl_cfg *cfg) ++{ ++ if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_TXAGG) ++ return false; ++ if (iwlwifi_mod_params.disable_11n & IWL_ENABLE_HT_TXAGG) ++ return true; ++ ++ /* disabled by default */ ++ return false; ++} ++ + static int iwlagn_mac_ampdu_action(struct ieee80211_hw *hw, + struct ieee80211_vif *vif, + enum ieee80211_ampdu_mlme_action action, +@@ -760,7 +778,7 @@ static int iwlagn_mac_ampdu_action(struct ieee80211_hw *hw, + + switch (action) { + case IEEE80211_AMPDU_RX_START: +- if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_RXAGG) ++ if (!iwl_enable_rx_ampdu(priv->cfg)) + break; + IWL_DEBUG_HT(priv, "start Rx\n"); + ret = iwl_sta_rx_agg_start(priv, sta, tid, *ssn); +@@ -772,7 +790,7 @@ static int iwlagn_mac_ampdu_action(struct ieee80211_hw *hw, + case IEEE80211_AMPDU_TX_START: + if (!priv->trans->ops->txq_enable) + break; +- if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_TXAGG) ++ if (!iwl_enable_tx_ampdu(priv->cfg)) + break; + IWL_DEBUG_HT(priv, "start Tx\n"); + ret = iwlagn_tx_agg_start(priv, vif, sta, tid, ssn); +diff --git a/drivers/net/wireless/iwlwifi/dvm/sta.c b/drivers/net/wireless/iwlwifi/dvm/sta.c +index c3c13ce96eb0..e800002d6158 100644 +--- a/drivers/net/wireless/iwlwifi/dvm/sta.c ++++ b/drivers/net/wireless/iwlwifi/dvm/sta.c +@@ -590,6 +590,7 @@ void iwl_deactivate_station(struct iwl_priv *priv, const u8 sta_id, + sizeof(priv->tid_data[sta_id][tid])); + + priv->stations[sta_id].used &= ~IWL_STA_DRIVER_ACTIVE; ++ priv->stations[sta_id].used &= ~IWL_STA_UCODE_INPROGRESS; + + priv->num_stations--; + +diff --git a/drivers/net/wireless/iwlwifi/dvm/tx.c b/drivers/net/wireless/iwlwifi/dvm/tx.c +index 20e65d3cc3bd..2b5dbff9eadb 100644 +--- a/drivers/net/wireless/iwlwifi/dvm/tx.c ++++ b/drivers/net/wireless/iwlwifi/dvm/tx.c +@@ -1322,8 +1322,6 @@ int iwlagn_rx_reply_compressed_ba(struct iwl_priv *priv, + struct iwl_compressed_ba_resp *ba_resp = (void *)pkt->data; + struct iwl_ht_agg *agg; + struct sk_buff_head reclaimed_skbs; +- struct ieee80211_tx_info *info; +- struct ieee80211_hdr *hdr; + struct sk_buff *skb; + int sta_id; + int tid; +@@ -1410,22 +1408,28 @@ int iwlagn_rx_reply_compressed_ba(struct iwl_priv *priv, + freed = 0; + + skb_queue_walk(&reclaimed_skbs, skb) { +- hdr = (struct ieee80211_hdr *)skb->data; ++ struct ieee80211_hdr *hdr = (void *)skb->data; ++ struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); + + if (ieee80211_is_data_qos(hdr->frame_control)) + freed++; + else + WARN_ON_ONCE(1); + +- info = IEEE80211_SKB_CB(skb); + iwl_trans_free_tx_cmd(priv->trans, info->driver_data[1]); + ++ memset(&info->status, 0, sizeof(info->status)); ++ /* Packet was transmitted successfully, failures come as single ++ * frames because before failing a frame the firmware transmits ++ * it without aggregation at least once. ++ */ ++ info->flags |= IEEE80211_TX_STAT_ACK; ++ + if (freed == 1) { + /* this is the first skb we deliver in this batch */ + /* put the rate scaling data there */ + info = IEEE80211_SKB_CB(skb); + memset(&info->status, 0, sizeof(info->status)); +- info->flags |= IEEE80211_TX_STAT_ACK; + info->flags |= IEEE80211_TX_STAT_AMPDU; + info->status.ampdu_ack_len = ba_resp->txed_2_done; + info->status.ampdu_len = ba_resp->txed; +diff --git a/drivers/net/wireless/iwlwifi/iwl-drv.c b/drivers/net/wireless/iwlwifi/iwl-drv.c +index 40fed1f511e2..96050e6c3d57 100644 +--- a/drivers/net/wireless/iwlwifi/iwl-drv.c ++++ b/drivers/net/wireless/iwlwifi/iwl-drv.c +@@ -1211,7 +1211,7 @@ module_param_named(swcrypto, iwlwifi_mod_params.sw_crypto, int, S_IRUGO); + MODULE_PARM_DESC(swcrypto, "using crypto in software (default 0 [hardware])"); + module_param_named(11n_disable, iwlwifi_mod_params.disable_11n, uint, S_IRUGO); + MODULE_PARM_DESC(11n_disable, +- "disable 11n functionality, bitmap: 1: full, 2: agg TX, 4: agg RX"); ++ "disable 11n functionality, bitmap: 1: full, 2: disable agg TX, 4: disable agg RX, 8 enable agg TX"); + module_param_named(amsdu_size_8K, iwlwifi_mod_params.amsdu_size_8K, + int, S_IRUGO); + MODULE_PARM_DESC(amsdu_size_8K, "enable 8K amsdu size (default 0)"); +diff --git a/drivers/net/wireless/iwlwifi/iwl-modparams.h b/drivers/net/wireless/iwlwifi/iwl-modparams.h +index d6f6c37c09fd..e99bc55046e5 100644 +--- a/drivers/net/wireless/iwlwifi/iwl-modparams.h ++++ b/drivers/net/wireless/iwlwifi/iwl-modparams.h +@@ -79,9 +79,12 @@ enum iwl_power_level { + IWL_POWER_NUM + }; + +-#define IWL_DISABLE_HT_ALL BIT(0) +-#define IWL_DISABLE_HT_TXAGG BIT(1) +-#define IWL_DISABLE_HT_RXAGG BIT(2) ++enum iwl_disable_11n { ++ IWL_DISABLE_HT_ALL = BIT(0), ++ IWL_DISABLE_HT_TXAGG = BIT(1), ++ IWL_DISABLE_HT_RXAGG = BIT(2), ++ IWL_ENABLE_HT_TXAGG = BIT(3), ++}; + + /** + * struct iwl_mod_params +@@ -90,7 +93,7 @@ enum iwl_power_level { + * + * @sw_crypto: using hardware encryption, default = 0 + * @disable_11n: disable 11n capabilities, default = 0, +- * use IWL_DISABLE_HT_* constants ++ * use IWL_[DIS,EN]ABLE_HT_* constants + * @amsdu_size_8K: enable 8K amsdu size, default = 0 + * @restart_fw: restart firmware, default = 1 + * @plcp_check: enable plcp health check, default = true +diff --git a/drivers/net/wireless/iwlwifi/mvm/bt-coex.c b/drivers/net/wireless/iwlwifi/mvm/bt-coex.c +index 810bfa5f6de0..9649f511bd5b 100644 +--- a/drivers/net/wireless/iwlwifi/mvm/bt-coex.c ++++ b/drivers/net/wireless/iwlwifi/mvm/bt-coex.c +@@ -523,8 +523,11 @@ void iwl_mvm_bt_rssi_event(struct iwl_mvm *mvm, struct ieee80211_vif *vif, + + mutex_lock(&mvm->mutex); + +- /* Rssi update while not associated ?! */ +- if (WARN_ON_ONCE(mvmvif->ap_sta_id == IWL_MVM_STATION_COUNT)) ++ /* ++ * Rssi update while not associated - can happen since the statistics ++ * are handled asynchronously ++ */ ++ if (mvmvif->ap_sta_id == IWL_MVM_STATION_COUNT) + goto out_unlock; + + /* No open connection - reports should be disabled */ +diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c +index f7545e06ce2a..88b9c0964696 100644 +--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c ++++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c +@@ -278,6 +278,24 @@ static void iwl_mvm_mac_tx(struct ieee80211_hw *hw, + ieee80211_free_txskb(hw, skb); + } + ++static inline bool iwl_enable_rx_ampdu(const struct iwl_cfg *cfg) ++{ ++ if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_RXAGG) ++ return false; ++ return true; ++} ++ ++static inline bool iwl_enable_tx_ampdu(const struct iwl_cfg *cfg) ++{ ++ if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_TXAGG) ++ return false; ++ if (iwlwifi_mod_params.disable_11n & IWL_ENABLE_HT_TXAGG) ++ return true; ++ ++ /* enabled by default */ ++ return true; ++} ++ + static int iwl_mvm_mac_ampdu_action(struct ieee80211_hw *hw, + struct ieee80211_vif *vif, + enum ieee80211_ampdu_mlme_action action, +@@ -297,7 +315,7 @@ static int iwl_mvm_mac_ampdu_action(struct ieee80211_hw *hw, + + switch (action) { + case IEEE80211_AMPDU_RX_START: +- if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_RXAGG) { ++ if (!iwl_enable_rx_ampdu(mvm->cfg)) { + ret = -EINVAL; + break; + } +@@ -307,7 +325,7 @@ static int iwl_mvm_mac_ampdu_action(struct ieee80211_hw *hw, + ret = iwl_mvm_sta_rx_agg(mvm, sta, tid, 0, false); + break; + case IEEE80211_AMPDU_TX_START: +- if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_TXAGG) { ++ if (!iwl_enable_tx_ampdu(mvm->cfg)) { + ret = -EINVAL; + break; + } +diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c +index a2e6112e91e9..4ec8385e4307 100644 +--- a/drivers/net/wireless/iwlwifi/mvm/tx.c ++++ b/drivers/net/wireless/iwlwifi/mvm/tx.c +@@ -819,16 +819,12 @@ int iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb, + struct iwl_mvm_ba_notif *ba_notif = (void *)pkt->data; + struct sk_buff_head reclaimed_skbs; + struct iwl_mvm_tid_data *tid_data; +- struct ieee80211_tx_info *info; + struct ieee80211_sta *sta; + struct iwl_mvm_sta *mvmsta; +- struct ieee80211_hdr *hdr; + struct sk_buff *skb; + int sta_id, tid, freed; +- + /* "flow" corresponds to Tx queue */ + u16 scd_flow = le16_to_cpu(ba_notif->scd_flow); +- + /* "ssn" is start of block-ack Tx window, corresponds to index + * (in Tx queue's circular buffer) of first TFD/frame in window */ + u16 ba_resp_scd_ssn = le16_to_cpu(ba_notif->scd_ssn); +@@ -885,22 +881,26 @@ int iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb, + freed = 0; + + skb_queue_walk(&reclaimed_skbs, skb) { +- hdr = (struct ieee80211_hdr *)skb->data; ++ struct ieee80211_hdr *hdr = (void *)skb->data; ++ struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); + + if (ieee80211_is_data_qos(hdr->frame_control)) + freed++; + else + WARN_ON_ONCE(1); + +- info = IEEE80211_SKB_CB(skb); + iwl_trans_free_tx_cmd(mvm->trans, info->driver_data[1]); + ++ memset(&info->status, 0, sizeof(info->status)); ++ /* Packet was transmitted successfully, failures come as single ++ * frames because before failing a frame the firmware transmits ++ * it without aggregation at least once. ++ */ ++ info->flags |= IEEE80211_TX_STAT_ACK; ++ + if (freed == 1) { + /* this is the first skb we deliver in this batch */ + /* put the rate scaling data there */ +- info = IEEE80211_SKB_CB(skb); +- memset(&info->status, 0, sizeof(info->status)); +- info->flags |= IEEE80211_TX_STAT_ACK; + info->flags |= IEEE80211_TX_STAT_AMPDU; + info->status.ampdu_ack_len = ba_notif->txed_2_done; + info->status.ampdu_len = ba_notif->txed; +diff --git a/drivers/net/wireless/mwifiex/11ac.c b/drivers/net/wireless/mwifiex/11ac.c +index 5e0eec4d71c7..5d9a8084665d 100644 +--- a/drivers/net/wireless/mwifiex/11ac.c ++++ b/drivers/net/wireless/mwifiex/11ac.c +@@ -189,8 +189,7 @@ int mwifiex_cmd_append_11ac_tlv(struct mwifiex_private *priv, + vht_cap->header.len = + cpu_to_le16(sizeof(struct ieee80211_vht_cap)); + memcpy((u8 *)vht_cap + sizeof(struct mwifiex_ie_types_header), +- (u8 *)bss_desc->bcn_vht_cap + +- sizeof(struct ieee_types_header), ++ (u8 *)bss_desc->bcn_vht_cap, + le16_to_cpu(vht_cap->header.len)); + + mwifiex_fill_vht_cap_tlv(priv, vht_cap, bss_desc->bss_band); +diff --git a/drivers/net/wireless/mwifiex/11n.c b/drivers/net/wireless/mwifiex/11n.c +index 41e9d25a2d8e..2658c8cda443 100644 +--- a/drivers/net/wireless/mwifiex/11n.c ++++ b/drivers/net/wireless/mwifiex/11n.c +@@ -307,8 +307,7 @@ mwifiex_cmd_append_11n_tlv(struct mwifiex_private *priv, + ht_cap->header.len = + cpu_to_le16(sizeof(struct ieee80211_ht_cap)); + memcpy((u8 *) ht_cap + sizeof(struct mwifiex_ie_types_header), +- (u8 *) bss_desc->bcn_ht_cap + +- sizeof(struct ieee_types_header), ++ (u8 *)bss_desc->bcn_ht_cap, + le16_to_cpu(ht_cap->header.len)); + + mwifiex_fill_cap_info(priv, radio_type, ht_cap); +diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c +index 20c9c4c7b0b2..801c709656f9 100644 +--- a/drivers/net/wireless/mwifiex/pcie.c ++++ b/drivers/net/wireless/mwifiex/pcie.c +@@ -1195,6 +1195,12 @@ static int mwifiex_pcie_process_recv_data(struct mwifiex_adapter *adapter) + rd_index = card->rxbd_rdptr & reg->rx_mask; + skb_data = card->rx_buf_list[rd_index]; + ++ /* If skb allocation was failed earlier for Rx packet, ++ * rx_buf_list[rd_index] would have been left with a NULL. ++ */ ++ if (!skb_data) ++ return -ENOMEM; ++ + MWIFIEX_SKB_PACB(skb_data, &buf_pa); + pci_unmap_single(card->dev, buf_pa, MWIFIEX_RX_DATA_BUF_SIZE, + PCI_DMA_FROMDEVICE); +@@ -1509,6 +1515,14 @@ static int mwifiex_pcie_process_cmd_complete(struct mwifiex_adapter *adapter) + if (adapter->ps_state == PS_STATE_SLEEP_CFM) { + mwifiex_process_sleep_confirm_resp(adapter, skb->data, + skb->len); ++ mwifiex_pcie_enable_host_int(adapter); ++ if (mwifiex_write_reg(adapter, ++ PCIE_CPU_INT_EVENT, ++ CPU_INTR_SLEEP_CFM_DONE)) { ++ dev_warn(adapter->dev, ++ "Write register failed\n"); ++ return -1; ++ } + while (reg->sleep_cookie && (count++ < 10) && + mwifiex_pcie_ok_to_access_hw(adapter)) + usleep_range(50, 60); +@@ -1979,23 +1993,9 @@ static void mwifiex_interrupt_status(struct mwifiex_adapter *adapter) + adapter->int_status |= pcie_ireg; + spin_unlock_irqrestore(&adapter->int_lock, flags); + +- if (pcie_ireg & HOST_INTR_CMD_DONE) { +- if ((adapter->ps_state == PS_STATE_SLEEP_CFM) || +- (adapter->ps_state == PS_STATE_SLEEP)) { +- mwifiex_pcie_enable_host_int(adapter); +- if (mwifiex_write_reg(adapter, +- PCIE_CPU_INT_EVENT, +- CPU_INTR_SLEEP_CFM_DONE) +- ) { +- dev_warn(adapter->dev, +- "Write register failed\n"); +- return; +- +- } +- } +- } else if (!adapter->pps_uapsd_mode && +- adapter->ps_state == PS_STATE_SLEEP && +- mwifiex_pcie_ok_to_access_hw(adapter)) { ++ if (!adapter->pps_uapsd_mode && ++ adapter->ps_state == PS_STATE_SLEEP && ++ mwifiex_pcie_ok_to_access_hw(adapter)) { + /* Potentially for PCIe we could get other + * interrupts like shared. Don't change power + * state until cookie is set */ +diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c +index 50b2fe53219d..470347a0a729 100644 +--- a/drivers/net/wireless/mwifiex/scan.c ++++ b/drivers/net/wireless/mwifiex/scan.c +@@ -2040,12 +2040,12 @@ mwifiex_save_curr_bcn(struct mwifiex_private *priv) + curr_bss->ht_info_offset); + + if (curr_bss->bcn_vht_cap) +- curr_bss->bcn_ht_cap = (void *)(curr_bss->beacon_buf + +- curr_bss->vht_cap_offset); ++ curr_bss->bcn_vht_cap = (void *)(curr_bss->beacon_buf + ++ curr_bss->vht_cap_offset); + + if (curr_bss->bcn_vht_oper) +- curr_bss->bcn_ht_oper = (void *)(curr_bss->beacon_buf + +- curr_bss->vht_info_offset); ++ curr_bss->bcn_vht_oper = (void *)(curr_bss->beacon_buf + ++ curr_bss->vht_info_offset); + + if (curr_bss->bcn_bss_co_2040) + curr_bss->bcn_bss_co_2040 = +diff --git a/drivers/net/wireless/mwifiex/usb.c b/drivers/net/wireless/mwifiex/usb.c +index b7adf3d46463..923e348dda70 100644 +--- a/drivers/net/wireless/mwifiex/usb.c ++++ b/drivers/net/wireless/mwifiex/usb.c +@@ -511,13 +511,6 @@ static int mwifiex_usb_resume(struct usb_interface *intf) + MWIFIEX_BSS_ROLE_ANY), + MWIFIEX_ASYNC_CMD); + +-#ifdef CONFIG_PM +- /* Resume handler may be called due to remote wakeup, +- * force to exit suspend anyway +- */ +- usb_disable_autosuspend(card->udev); +-#endif /* CONFIG_PM */ +- + return 0; + } + +@@ -576,7 +569,6 @@ static struct usb_driver mwifiex_usb_driver = { + .id_table = mwifiex_usb_table, + .suspend = mwifiex_usb_suspend, + .resume = mwifiex_usb_resume, +- .supports_autosuspend = 1, + }; + + static int mwifiex_usb_tx_init(struct mwifiex_adapter *adapter) +diff --git a/drivers/net/wireless/mwifiex/wmm.c b/drivers/net/wireless/mwifiex/wmm.c +index ae31e8df44d7..80f72f6b6d56 100644 +--- a/drivers/net/wireless/mwifiex/wmm.c ++++ b/drivers/net/wireless/mwifiex/wmm.c +@@ -556,7 +556,8 @@ mwifiex_clean_txrx(struct mwifiex_private *priv) + mwifiex_wmm_delete_all_ralist(priv); + memcpy(tos_to_tid, ac_to_tid, sizeof(tos_to_tid)); + +- if (priv->adapter->if_ops.clean_pcie_ring) ++ if (priv->adapter->if_ops.clean_pcie_ring && ++ !priv->adapter->surprise_removed) + priv->adapter->if_ops.clean_pcie_ring(priv->adapter); + spin_unlock_irqrestore(&priv->wmm.ra_list_spinlock, flags); + } +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index 0bb7bfd49bf6..f30acaa84037 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -1130,6 +1130,9 @@ static int do_pci_enable_device(struct pci_dev *dev, int bars) + return err; + pci_fixup_device(pci_fixup_enable, dev); + ++ if (dev->msi_enabled || dev->msix_enabled) ++ return 0; ++ + pci_read_config_byte(dev, PCI_INTERRUPT_PIN, &pin); + if (pin) { + pci_read_config_word(dev, PCI_COMMAND, &cmd); +diff --git a/drivers/pnp/pnpacpi/rsparser.c b/drivers/pnp/pnpacpi/rsparser.c +index 9847ab163829..a8b7466196ee 100644 +--- a/drivers/pnp/pnpacpi/rsparser.c ++++ b/drivers/pnp/pnpacpi/rsparser.c +@@ -183,9 +183,7 @@ static acpi_status pnpacpi_allocated_resource(struct acpi_resource *res, + struct resource r; + int i, flags; + +- if (acpi_dev_resource_memory(res, &r) +- || acpi_dev_resource_io(res, &r) +- || acpi_dev_resource_address_space(res, &r) ++ if (acpi_dev_resource_address_space(res, &r) + || acpi_dev_resource_ext_address_space(res, &r)) { + pnp_add_resource(dev, &r); + return AE_OK; +@@ -217,6 +215,17 @@ static acpi_status pnpacpi_allocated_resource(struct acpi_resource *res, + } + + switch (res->type) { ++ case ACPI_RESOURCE_TYPE_MEMORY24: ++ case ACPI_RESOURCE_TYPE_MEMORY32: ++ case ACPI_RESOURCE_TYPE_FIXED_MEMORY32: ++ if (acpi_dev_resource_memory(res, &r)) ++ pnp_add_resource(dev, &r); ++ break; ++ case ACPI_RESOURCE_TYPE_IO: ++ case ACPI_RESOURCE_TYPE_FIXED_IO: ++ if (acpi_dev_resource_io(res, &r)) ++ pnp_add_resource(dev, &r); ++ break; + case ACPI_RESOURCE_TYPE_DMA: + dma = &res->data.dma; + if (dma->channel_count > 0 && dma->channels[0] != (u8) -1) +diff --git a/drivers/rapidio/devices/tsi721.h b/drivers/rapidio/devices/tsi721.h +index b4b0d83f9ef6..7061ac0ad428 100644 +--- a/drivers/rapidio/devices/tsi721.h ++++ b/drivers/rapidio/devices/tsi721.h +@@ -678,6 +678,7 @@ struct tsi721_bdma_chan { + struct list_head free_list; + dma_cookie_t completed_cookie; + struct tasklet_struct tasklet; ++ bool active; + }; + + #endif /* CONFIG_RAPIDIO_DMA_ENGINE */ +diff --git a/drivers/rapidio/devices/tsi721_dma.c b/drivers/rapidio/devices/tsi721_dma.c +index 502663f5f7c6..91245f5dbe81 100644 +--- a/drivers/rapidio/devices/tsi721_dma.c ++++ b/drivers/rapidio/devices/tsi721_dma.c +@@ -206,8 +206,8 @@ void tsi721_bdma_handler(struct tsi721_bdma_chan *bdma_chan) + { + /* Disable BDMA channel interrupts */ + iowrite32(0, bdma_chan->regs + TSI721_DMAC_INTE); +- +- tasklet_schedule(&bdma_chan->tasklet); ++ if (bdma_chan->active) ++ tasklet_schedule(&bdma_chan->tasklet); + } + + #ifdef CONFIG_PCI_MSI +@@ -562,7 +562,7 @@ static int tsi721_alloc_chan_resources(struct dma_chan *dchan) + } + #endif /* CONFIG_PCI_MSI */ + +- tasklet_enable(&bdma_chan->tasklet); ++ bdma_chan->active = true; + tsi721_bdma_interrupt_enable(bdma_chan, 1); + + return bdma_chan->bd_num - 1; +@@ -576,9 +576,7 @@ err_out: + static void tsi721_free_chan_resources(struct dma_chan *dchan) + { + struct tsi721_bdma_chan *bdma_chan = to_tsi721_chan(dchan); +-#ifdef CONFIG_PCI_MSI + struct tsi721_device *priv = to_tsi721(dchan->device); +-#endif + LIST_HEAD(list); + + dev_dbg(dchan->device->dev, "%s: Entry\n", __func__); +@@ -589,14 +587,25 @@ static void tsi721_free_chan_resources(struct dma_chan *dchan) + BUG_ON(!list_empty(&bdma_chan->active_list)); + BUG_ON(!list_empty(&bdma_chan->queue)); + +- tasklet_disable(&bdma_chan->tasklet); ++ tsi721_bdma_interrupt_enable(bdma_chan, 0); ++ bdma_chan->active = false; ++ ++#ifdef CONFIG_PCI_MSI ++ if (priv->flags & TSI721_USING_MSIX) { ++ synchronize_irq(priv->msix[TSI721_VECT_DMA0_DONE + ++ bdma_chan->id].vector); ++ synchronize_irq(priv->msix[TSI721_VECT_DMA0_INT + ++ bdma_chan->id].vector); ++ } else ++#endif ++ synchronize_irq(priv->pdev->irq); ++ ++ tasklet_kill(&bdma_chan->tasklet); + + spin_lock_bh(&bdma_chan->lock); + list_splice_init(&bdma_chan->free_list, &list); + spin_unlock_bh(&bdma_chan->lock); + +- tsi721_bdma_interrupt_enable(bdma_chan, 0); +- + #ifdef CONFIG_PCI_MSI + if (priv->flags & TSI721_USING_MSIX) { + free_irq(priv->msix[TSI721_VECT_DMA0_DONE + +@@ -790,6 +799,7 @@ int tsi721_register_dma(struct tsi721_device *priv) + bdma_chan->dchan.cookie = 1; + bdma_chan->dchan.chan_id = i; + bdma_chan->id = i; ++ bdma_chan->active = false; + + spin_lock_init(&bdma_chan->lock); + +@@ -799,7 +809,6 @@ int tsi721_register_dma(struct tsi721_device *priv) + + tasklet_init(&bdma_chan->tasklet, tsi721_dma_tasklet, + (unsigned long)bdma_chan); +- tasklet_disable(&bdma_chan->tasklet); + list_add_tail(&bdma_chan->dchan.device_node, + &mport->dma.channels); + } +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index 815d6df8bd5f..c59cc6ed7adb 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -919,6 +919,8 @@ static int machine_constraints_voltage(struct regulator_dev *rdev, + return 0; + } + ++static int _regulator_do_enable(struct regulator_dev *rdev); ++ + /** + * set_machine_constraints - sets regulator constraints + * @rdev: regulator source +@@ -975,10 +977,9 @@ static int set_machine_constraints(struct regulator_dev *rdev, + /* If the constraints say the regulator should be on at this point + * and we have control then make sure it is enabled. + */ +- if ((rdev->constraints->always_on || rdev->constraints->boot_on) && +- ops->enable) { +- ret = ops->enable(rdev); +- if (ret < 0) { ++ if (rdev->constraints->always_on || rdev->constraints->boot_on) { ++ ret = _regulator_do_enable(rdev); ++ if (ret < 0 && ret != -EINVAL) { + rdev_err(rdev, "failed to enable\n"); + goto out; + } +@@ -3790,9 +3791,8 @@ int regulator_suspend_finish(void) + struct regulator_ops *ops = rdev->desc->ops; + + mutex_lock(&rdev->mutex); +- if ((rdev->use_count > 0 || rdev->constraints->always_on) && +- ops->enable) { +- error = ops->enable(rdev); ++ if (rdev->use_count > 0 || rdev->constraints->always_on) { ++ error = _regulator_do_enable(rdev); + if (error) + ret = error; + } else { +diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c +index d72a9216ee2e..e91ec8cd9b09 100644 +--- a/drivers/s390/block/dasd.c ++++ b/drivers/s390/block/dasd.c +@@ -2879,12 +2879,12 @@ static int dasd_alloc_queue(struct dasd_block *block) + + elevator_exit(block->request_queue->elevator); + block->request_queue->elevator = NULL; ++ mutex_lock(&block->request_queue->sysfs_lock); + rc = elevator_init(block->request_queue, "deadline"); +- if (rc) { ++ if (rc) + blk_cleanup_queue(block->request_queue); +- return rc; +- } +- return 0; ++ mutex_unlock(&block->request_queue->sysfs_lock); ++ return rc; + } + + /* +diff --git a/drivers/scsi/isci/host.h b/drivers/scsi/isci/host.h +index 4911310a38f5..22a9bb1abae1 100644 +--- a/drivers/scsi/isci/host.h ++++ b/drivers/scsi/isci/host.h +@@ -311,9 +311,8 @@ static inline struct Scsi_Host *to_shost(struct isci_host *ihost) + } + + #define for_each_isci_host(id, ihost, pdev) \ +- for (id = 0, ihost = to_pci_info(pdev)->hosts[id]; \ +- id < ARRAY_SIZE(to_pci_info(pdev)->hosts) && ihost; \ +- ihost = to_pci_info(pdev)->hosts[++id]) ++ for (id = 0; id < SCI_MAX_CONTROLLERS && \ ++ (ihost = to_pci_info(pdev)->hosts[id]); id++) + + static inline void wait_for_start(struct isci_host *ihost) + { +diff --git a/drivers/scsi/isci/port_config.c b/drivers/scsi/isci/port_config.c +index cd962da4a57a..5017bde3b366 100644 +--- a/drivers/scsi/isci/port_config.c ++++ b/drivers/scsi/isci/port_config.c +@@ -615,13 +615,6 @@ static void sci_apc_agent_link_up(struct isci_host *ihost, + SCIC_SDS_APC_WAIT_LINK_UP_NOTIFICATION); + } else { + /* the phy is already the part of the port */ +- u32 port_state = iport->sm.current_state_id; +- +- /* if the PORT'S state is resetting then the link up is from +- * port hard reset in this case, we need to tell the port +- * that link up is recieved +- */ +- BUG_ON(port_state != SCI_PORT_RESETTING); + port_agent->phy_ready_mask |= 1 << phy_index; + sci_port_link_up(iport, iphy); + } +diff --git a/drivers/scsi/isci/task.c b/drivers/scsi/isci/task.c +index 0d30ca849e8f..5d6fda72d659 100644 +--- a/drivers/scsi/isci/task.c ++++ b/drivers/scsi/isci/task.c +@@ -801,7 +801,7 @@ int isci_task_I_T_nexus_reset(struct domain_device *dev) + /* XXX: need to cleanup any ireqs targeting this + * domain_device + */ +- ret = TMF_RESP_FUNC_COMPLETE; ++ ret = -ENODEV; + goto out; + } + +diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h +index c32efc753229..799c266b0bb5 100644 +--- a/drivers/scsi/qla2xxx/qla_def.h ++++ b/drivers/scsi/qla2xxx/qla_def.h +@@ -2980,8 +2980,7 @@ struct qla_hw_data { + IS_QLA25XX(ha) || IS_QLA81XX(ha) || \ + IS_QLA82XX(ha) || IS_QLA83XX(ha)) + #define IS_MSIX_NACK_CAPABLE(ha) (IS_QLA81XX(ha) || IS_QLA83XX(ha)) +-#define IS_NOPOLLING_TYPE(ha) ((IS_QLA25XX(ha) || IS_QLA81XX(ha) || \ +- IS_QLA83XX(ha)) && (ha)->flags.msix_enabled) ++#define IS_NOPOLLING_TYPE(ha) (IS_QLA81XX(ha) && (ha)->flags.msix_enabled) + #define IS_FAC_REQUIRED(ha) (IS_QLA81XX(ha) || IS_QLA83XX(ha)) + #define IS_NOCACHE_VPD_TYPE(ha) (IS_QLA81XX(ha) || IS_QLA83XX(ha)) + #define IS_ALOGIO_CAPABLE(ha) (IS_QLA23XX(ha) || IS_FWI2_CAPABLE(ha)) +diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c +index fb7437dd5b7a..91b76cea3e3c 100644 +--- a/drivers/scsi/storvsc_drv.c ++++ b/drivers/scsi/storvsc_drv.c +@@ -1189,6 +1189,9 @@ static void storvsc_device_destroy(struct scsi_device *sdevice) + { + struct stor_mem_pools *memp = sdevice->hostdata; + ++ if (!memp) ++ return; ++ + mempool_destroy(memp->request_mempool); + kmem_cache_destroy(memp->request_pool); + kfree(memp); +diff --git a/drivers/spi/spi-ath79.c b/drivers/spi/spi-ath79.c +index e504b7636058..23f1ba6e9ccf 100644 +--- a/drivers/spi/spi-ath79.c ++++ b/drivers/spi/spi-ath79.c +@@ -132,9 +132,9 @@ static int ath79_spi_setup_cs(struct spi_device *spi) + + flags = GPIOF_DIR_OUT; + if (spi->mode & SPI_CS_HIGH) +- flags |= GPIOF_INIT_HIGH; +- else + flags |= GPIOF_INIT_LOW; ++ else ++ flags |= GPIOF_INIT_HIGH; + + status = gpio_request_one(cdata->gpio, flags, + dev_name(&spi->dev)); +diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c +index 5b07fd156bd7..5232ac7b0745 100644 +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -3653,7 +3653,7 @@ iscsit_immediate_queue(struct iscsi_conn *conn, struct iscsi_cmd *cmd, int state + break; + case ISTATE_REMOVE: + spin_lock_bh(&conn->cmd_lock); +- list_del(&cmd->i_conn_node); ++ list_del_init(&cmd->i_conn_node); + spin_unlock_bh(&conn->cmd_lock); + + iscsit_free_cmd(cmd, false); +@@ -4099,7 +4099,7 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn) + spin_lock_bh(&conn->cmd_lock); + list_for_each_entry_safe(cmd, cmd_tmp, &conn->conn_cmd_list, i_conn_node) { + +- list_del(&cmd->i_conn_node); ++ list_del_init(&cmd->i_conn_node); + spin_unlock_bh(&conn->cmd_lock); + + iscsit_increment_maxcmdsn(cmd, sess); +@@ -4144,6 +4144,10 @@ int iscsit_close_connection( + iscsit_stop_timers_for_cmds(conn); + iscsit_stop_nopin_response_timer(conn); + iscsit_stop_nopin_timer(conn); ++ ++ if (conn->conn_transport->iscsit_wait_conn) ++ conn->conn_transport->iscsit_wait_conn(conn); ++ + iscsit_free_queue_reqs_for_conn(conn); + + /* +diff --git a/drivers/target/iscsi/iscsi_target_erl2.c b/drivers/target/iscsi/iscsi_target_erl2.c +index 45a5afd5ea13..0d2d013076c4 100644 +--- a/drivers/target/iscsi/iscsi_target_erl2.c ++++ b/drivers/target/iscsi/iscsi_target_erl2.c +@@ -140,7 +140,7 @@ void iscsit_free_connection_recovery_entires(struct iscsi_session *sess) + list_for_each_entry_safe(cmd, cmd_tmp, + &cr->conn_recovery_cmd_list, i_conn_node) { + +- list_del(&cmd->i_conn_node); ++ list_del_init(&cmd->i_conn_node); + cmd->conn = NULL; + spin_unlock(&cr->conn_recovery_cmd_lock); + iscsit_free_cmd(cmd, true); +@@ -162,7 +162,7 @@ void iscsit_free_connection_recovery_entires(struct iscsi_session *sess) + list_for_each_entry_safe(cmd, cmd_tmp, + &cr->conn_recovery_cmd_list, i_conn_node) { + +- list_del(&cmd->i_conn_node); ++ list_del_init(&cmd->i_conn_node); + cmd->conn = NULL; + spin_unlock(&cr->conn_recovery_cmd_lock); + iscsit_free_cmd(cmd, true); +@@ -218,7 +218,7 @@ int iscsit_remove_cmd_from_connection_recovery( + } + cr = cmd->cr; + +- list_del(&cmd->i_conn_node); ++ list_del_init(&cmd->i_conn_node); + return --cr->cmd_count; + } + +@@ -299,7 +299,7 @@ int iscsit_discard_unacknowledged_ooo_cmdsns_for_conn(struct iscsi_conn *conn) + if (!(cmd->cmd_flags & ICF_OOO_CMDSN)) + continue; + +- list_del(&cmd->i_conn_node); ++ list_del_init(&cmd->i_conn_node); + + spin_unlock_bh(&conn->cmd_lock); + iscsit_free_cmd(cmd, true); +@@ -337,7 +337,7 @@ int iscsit_prepare_cmds_for_realligance(struct iscsi_conn *conn) + /* + * Only perform connection recovery on ISCSI_OP_SCSI_CMD or + * ISCSI_OP_NOOP_OUT opcodes. For all other opcodes call +- * list_del(&cmd->i_conn_node); to release the command to the ++ * list_del_init(&cmd->i_conn_node); to release the command to the + * session pool and remove it from the connection's list. + * + * Also stop the DataOUT timer, which will be restarted after +@@ -353,7 +353,7 @@ int iscsit_prepare_cmds_for_realligance(struct iscsi_conn *conn) + " CID: %hu\n", cmd->iscsi_opcode, + cmd->init_task_tag, cmd->cmd_sn, conn->cid); + +- list_del(&cmd->i_conn_node); ++ list_del_init(&cmd->i_conn_node); + spin_unlock_bh(&conn->cmd_lock); + iscsit_free_cmd(cmd, true); + spin_lock_bh(&conn->cmd_lock); +@@ -373,7 +373,7 @@ int iscsit_prepare_cmds_for_realligance(struct iscsi_conn *conn) + */ + if (!(cmd->cmd_flags & ICF_OOO_CMDSN) && !cmd->immediate_cmd && + iscsi_sna_gte(cmd->cmd_sn, conn->sess->exp_cmd_sn)) { +- list_del(&cmd->i_conn_node); ++ list_del_init(&cmd->i_conn_node); + spin_unlock_bh(&conn->cmd_lock); + iscsit_free_cmd(cmd, true); + spin_lock_bh(&conn->cmd_lock); +@@ -395,7 +395,7 @@ int iscsit_prepare_cmds_for_realligance(struct iscsi_conn *conn) + + cmd->sess = conn->sess; + +- list_del(&cmd->i_conn_node); ++ list_del_init(&cmd->i_conn_node); + spin_unlock_bh(&conn->cmd_lock); + + iscsit_free_all_datain_reqs(cmd); +diff --git a/drivers/target/iscsi/iscsi_target_tpg.c b/drivers/target/iscsi/iscsi_target_tpg.c +index 439260b7d87f..f31b4c5cdf3f 100644 +--- a/drivers/target/iscsi/iscsi_target_tpg.c ++++ b/drivers/target/iscsi/iscsi_target_tpg.c +@@ -138,7 +138,7 @@ struct iscsi_portal_group *iscsit_get_tpg_from_np( + list_for_each_entry(tpg, &tiqn->tiqn_tpg_list, tpg_list) { + + spin_lock(&tpg->tpg_state_lock); +- if (tpg->tpg_state == TPG_STATE_FREE) { ++ if (tpg->tpg_state != TPG_STATE_ACTIVE) { + spin_unlock(&tpg->tpg_state_lock); + continue; + } +diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c +index 548d1996590f..652438325197 100644 +--- a/drivers/usb/core/config.c ++++ b/drivers/usb/core/config.c +@@ -718,6 +718,10 @@ int usb_get_configuration(struct usb_device *dev) + result = -ENOMEM; + goto err; + } ++ ++ if (dev->quirks & USB_QUIRK_DELAY_INIT) ++ msleep(100); ++ + result = usb_get_descriptor(dev, USB_DT_CONFIG, cfgno, + bigbuffer, length); + if (result < 0) { +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index 01fe36273f3b..1053eb651b2f 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -46,6 +46,10 @@ static const struct usb_device_id usb_quirk_list[] = { + /* Microsoft LifeCam-VX700 v2.0 */ + { USB_DEVICE(0x045e, 0x0770), .driver_info = USB_QUIRK_RESET_RESUME }, + ++ /* Logitech HD Pro Webcams C920 and C930e */ ++ { USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT }, ++ { USB_DEVICE(0x046d, 0x0843), .driver_info = USB_QUIRK_DELAY_INIT }, ++ + /* Logitech Quickcam Fusion */ + { USB_DEVICE(0x046d, 0x08c1), .driver_info = USB_QUIRK_RESET_RESUME }, + +diff --git a/fs/bio-integrity.c b/fs/bio-integrity.c +index 8dccf73025b3..433c3b828e1d 100644 +--- a/fs/bio-integrity.c ++++ b/fs/bio-integrity.c +@@ -458,7 +458,7 @@ static int bio_integrity_verify(struct bio *bio) + bix.disk_name = bio->bi_bdev->bd_disk->disk_name; + bix.sector_size = bi->sector_size; + +- bio_for_each_segment(bv, bio, i) { ++ bio_for_each_segment_all(bv, bio, i) { + void *kaddr = kmap_atomic(bv->bv_page); + bix.data_buf = kaddr + bv->bv_offset; + bix.data_size = bv->bv_len; +diff --git a/fs/btrfs/compression.c b/fs/btrfs/compression.c +index b189bd1e7a3e..ce7067881d36 100644 +--- a/fs/btrfs/compression.c ++++ b/fs/btrfs/compression.c +@@ -1009,6 +1009,8 @@ int btrfs_decompress_buf2page(char *buf, unsigned long buf_start, + bytes = min(bytes, working_bytes); + kaddr = kmap_atomic(page_out); + memcpy(kaddr + *pg_offset, buf + buf_offset, bytes); ++ if (*pg_index == (vcnt - 1) && *pg_offset == 0) ++ memset(kaddr + bytes, 0, PAGE_CACHE_SIZE - bytes); + kunmap_atomic(kaddr); + flush_dcache_page(page_out); + +diff --git a/fs/namei.c b/fs/namei.c +index cccaf77e76c5..1211ee5a1cb3 100644 +--- a/fs/namei.c ++++ b/fs/namei.c +@@ -3655,6 +3655,7 @@ retry: + out_dput: + done_path_create(&new_path, new_dentry); + if (retry_estale(error, how)) { ++ path_put(&old_path); + how |= LOOKUP_REVAL; + goto retry; + } +diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c +index 57db3244f4d9..4b49a8c6ccad 100644 +--- a/fs/nfs/delegation.c ++++ b/fs/nfs/delegation.c +@@ -656,16 +656,19 @@ int nfs_async_inode_return_delegation(struct inode *inode, + + rcu_read_lock(); + delegation = rcu_dereference(NFS_I(inode)->delegation); ++ if (delegation == NULL) ++ goto out_enoent; + +- if (!clp->cl_mvops->match_stateid(&delegation->stateid, stateid)) { +- rcu_read_unlock(); +- return -ENOENT; +- } ++ if (!clp->cl_mvops->match_stateid(&delegation->stateid, stateid)) ++ goto out_enoent; + nfs_mark_return_delegation(server, delegation); + rcu_read_unlock(); + + nfs_delegation_run_state_manager(clp); + return 0; ++out_enoent: ++ rcu_read_unlock(); ++ return -ENOENT; + } + + static struct inode * +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 26e71bdb5b33..1ae7dd5956c5 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -3607,8 +3607,9 @@ static bool nfs4_stateid_is_current(nfs4_stateid *stateid, + { + nfs4_stateid current_stateid; + +- if (nfs4_set_rw_stateid(¤t_stateid, ctx, l_ctx, fmode)) +- return false; ++ /* If the current stateid represents a lost lock, then exit */ ++ if (nfs4_set_rw_stateid(¤t_stateid, ctx, l_ctx, fmode) == -EIO) ++ return true; + return nfs4_stateid_match(stateid, ¤t_stateid); + } + +diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c +index ff54014a24ec..46387e49aa46 100644 +--- a/fs/ocfs2/file.c ++++ b/fs/ocfs2/file.c +@@ -2374,8 +2374,8 @@ out_dio: + + if (((file->f_flags & O_DSYNC) && !direct_io) || IS_SYNC(inode) || + ((file->f_flags & O_DIRECT) && !direct_io)) { +- ret = filemap_fdatawrite_range(file->f_mapping, pos, +- pos + count - 1); ++ ret = filemap_fdatawrite_range(file->f_mapping, *ppos, ++ *ppos + count - 1); + if (ret < 0) + written = ret; + +@@ -2388,8 +2388,8 @@ out_dio: + } + + if (!ret) +- ret = filemap_fdatawait_range(file->f_mapping, pos, +- pos + count - 1); ++ ret = filemap_fdatawait_range(file->f_mapping, *ppos, ++ *ppos + count - 1); + } + + /* +diff --git a/fs/ocfs2/quota_global.c b/fs/ocfs2/quota_global.c +index 332a281f217e..e49b4f1cb26b 100644 +--- a/fs/ocfs2/quota_global.c ++++ b/fs/ocfs2/quota_global.c +@@ -717,6 +717,12 @@ static int ocfs2_release_dquot(struct dquot *dquot) + */ + if (status < 0) + mlog_errno(status); ++ /* ++ * Clear dq_off so that we search for the structure in quota file next ++ * time we acquire it. The structure might be deleted and reallocated ++ * elsewhere by another node while our dquot structure is on freelist. ++ */ ++ dquot->dq_off = 0; + clear_bit(DQ_ACTIVE_B, &dquot->dq_flags); + out_trans: + ocfs2_commit_trans(osb, handle); +@@ -756,16 +762,17 @@ static int ocfs2_acquire_dquot(struct dquot *dquot) + status = ocfs2_lock_global_qf(info, 1); + if (status < 0) + goto out; +- if (!test_bit(DQ_READ_B, &dquot->dq_flags)) { +- status = ocfs2_qinfo_lock(info, 0); +- if (status < 0) +- goto out_dq; +- status = qtree_read_dquot(&info->dqi_gi, dquot); +- ocfs2_qinfo_unlock(info, 0); +- if (status < 0) +- goto out_dq; +- } +- set_bit(DQ_READ_B, &dquot->dq_flags); ++ status = ocfs2_qinfo_lock(info, 0); ++ if (status < 0) ++ goto out_dq; ++ /* ++ * We always want to read dquot structure from disk because we don't ++ * know what happened with it while it was on freelist. ++ */ ++ status = qtree_read_dquot(&info->dqi_gi, dquot); ++ ocfs2_qinfo_unlock(info, 0); ++ if (status < 0) ++ goto out_dq; + + OCFS2_DQUOT(dquot)->dq_use_count++; + OCFS2_DQUOT(dquot)->dq_origspace = dquot->dq_dqb.dqb_curspace; +diff --git a/fs/ocfs2/quota_local.c b/fs/ocfs2/quota_local.c +index 27fe7ee4874c..d0f323da0b5c 100644 +--- a/fs/ocfs2/quota_local.c ++++ b/fs/ocfs2/quota_local.c +@@ -1303,10 +1303,6 @@ int ocfs2_local_release_dquot(handle_t *handle, struct dquot *dquot) + ocfs2_journal_dirty(handle, od->dq_chunk->qc_headerbh); + + out: +- /* Clear the read bit so that next time someone uses this +- * dquot he reads fresh info from disk and allocates local +- * dquot structure */ +- clear_bit(DQ_READ_B, &dquot->dq_flags); + return status; + } + +diff --git a/fs/proc/base.c b/fs/proc/base.c +index c3834dad09b3..de12b8128b95 100644 +--- a/fs/proc/base.c ++++ b/fs/proc/base.c +@@ -1825,6 +1825,7 @@ static int proc_map_files_get_link(struct dentry *dentry, struct path *path) + if (rc) + goto out_mmput; + ++ rc = -ENOENT; + down_read(&mm->mmap_sem); + vma = find_exact_vma(mm, vm_start, vm_end); + if (vma && vma->vm_file) { +diff --git a/include/linux/firewire.h b/include/linux/firewire.h +index 217e4b42b7c8..5d838bf10cbd 100644 +--- a/include/linux/firewire.h ++++ b/include/linux/firewire.h +@@ -200,6 +200,7 @@ struct fw_device { + unsigned irmc:1; + unsigned bc_implemented:2; + ++ work_func_t workfn; + struct delayed_work work; + struct fw_attribute_group attribute_group; + }; +diff --git a/include/linux/jiffies.h b/include/linux/jiffies.h +index 8fb8edf12417..7b5d4a8ab199 100644 +--- a/include/linux/jiffies.h ++++ b/include/linux/jiffies.h +@@ -101,13 +101,13 @@ static inline u64 get_jiffies_64(void) + #define time_after(a,b) \ + (typecheck(unsigned long, a) && \ + typecheck(unsigned long, b) && \ +- ((long)(b) - (long)(a) < 0)) ++ ((long)((b) - (a)) < 0)) + #define time_before(a,b) time_after(b,a) + + #define time_after_eq(a,b) \ + (typecheck(unsigned long, a) && \ + typecheck(unsigned long, b) && \ +- ((long)(a) - (long)(b) >= 0)) ++ ((long)((a) - (b)) >= 0)) + #define time_before_eq(a,b) time_after_eq(b,a) + + /* +@@ -130,13 +130,13 @@ static inline u64 get_jiffies_64(void) + #define time_after64(a,b) \ + (typecheck(__u64, a) && \ + typecheck(__u64, b) && \ +- ((__s64)(b) - (__s64)(a) < 0)) ++ ((__s64)((b) - (a)) < 0)) + #define time_before64(a,b) time_after64(b,a) + + #define time_after_eq64(a,b) \ + (typecheck(__u64, a) && \ + typecheck(__u64, b) && \ +- ((__s64)(a) - (__s64)(b) >= 0)) ++ ((__s64)((a) - (b)) >= 0)) + #define time_before_eq64(a,b) time_after_eq64(b,a) + + /* +diff --git a/include/linux/tracepoint.h b/include/linux/tracepoint.h +index f8e084d0fc77..ba605015c4d8 100644 +--- a/include/linux/tracepoint.h ++++ b/include/linux/tracepoint.h +@@ -60,6 +60,12 @@ struct tp_module { + unsigned int num_tracepoints; + struct tracepoint * const *tracepoints_ptrs; + }; ++bool trace_module_has_bad_taint(struct module *mod); ++#else ++static inline bool trace_module_has_bad_taint(struct module *mod) ++{ ++ return false; ++} + #endif /* CONFIG_MODULES */ + + struct tracepoint_iter { +diff --git a/include/net/tcp.h b/include/net/tcp.h +index 3fc77e90624a..6f87f0873843 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -1308,7 +1308,8 @@ struct tcp_fastopen_request { + /* Fast Open cookie. Size 0 means a cookie request */ + struct tcp_fastopen_cookie cookie; + struct msghdr *data; /* data in MSG_FASTOPEN */ +- u16 copied; /* queued in tcp_connect() */ ++ size_t size; ++ int copied; /* queued in tcp_connect() */ + }; + void tcp_free_fastopen_req(struct tcp_sock *tp); + +diff --git a/include/target/iscsi/iscsi_transport.h b/include/target/iscsi/iscsi_transport.h +index c5aade523863..4a5f00e2e6cd 100644 +--- a/include/target/iscsi/iscsi_transport.h ++++ b/include/target/iscsi/iscsi_transport.h +@@ -11,6 +11,7 @@ struct iscsit_transport { + int (*iscsit_setup_np)(struct iscsi_np *, struct __kernel_sockaddr_storage *); + int (*iscsit_accept_np)(struct iscsi_np *, struct iscsi_conn *); + void (*iscsit_free_np)(struct iscsi_np *); ++ void (*iscsit_wait_conn)(struct iscsi_conn *); + void (*iscsit_free_conn)(struct iscsi_conn *); + struct iscsi_cmd *(*iscsit_alloc_cmd)(struct iscsi_conn *, gfp_t); + int (*iscsit_get_login_rx)(struct iscsi_conn *, struct iscsi_login *); +diff --git a/ipc/msg.c b/ipc/msg.c +index 558aa91186b6..52770bfde2a5 100644 +--- a/ipc/msg.c ++++ b/ipc/msg.c +@@ -885,6 +885,8 @@ long do_msgrcv(int msqid, void __user *buf, size_t bufsz, long msgtyp, int msgfl + return -EINVAL; + + if (msgflg & MSG_COPY) { ++ if ((msgflg & MSG_EXCEPT) || !(msgflg & IPC_NOWAIT)) ++ return -EINVAL; + copy = prepare_copy(buf, min_t(size_t, bufsz, ns->msg_ctlmax)); + if (IS_ERR(copy)) + return PTR_ERR(copy); +diff --git a/kernel/cpuset.c b/kernel/cpuset.c +index d313870dcd02..d9dd521ddd6b 100644 +--- a/kernel/cpuset.c ++++ b/kernel/cpuset.c +@@ -2422,9 +2422,9 @@ int __cpuset_node_allowed_softwall(int node, gfp_t gfp_mask) + + task_lock(current); + cs = nearest_hardwall_ancestor(task_cs(current)); ++ allowed = node_isset(node, cs->mems_allowed); + task_unlock(current); + +- allowed = node_isset(node, cs->mems_allowed); + mutex_unlock(&callback_mutex); + return allowed; + } +diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c +index dc4db3228dcd..9bd5c8a6c8ee 100644 +--- a/kernel/irq/manage.c ++++ b/kernel/irq/manage.c +@@ -802,8 +802,7 @@ static irqreturn_t irq_thread_fn(struct irq_desc *desc, + + static void wake_threads_waitq(struct irq_desc *desc) + { +- if (atomic_dec_and_test(&desc->threads_active) && +- waitqueue_active(&desc->wait_for_threads)) ++ if (atomic_dec_and_test(&desc->threads_active)) + wake_up(&desc->wait_for_threads); + } + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 305ef886219e..c7ab8eab5427 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -5862,15 +5862,15 @@ static void switched_from_fair(struct rq *rq, struct task_struct *p) + struct cfs_rq *cfs_rq = cfs_rq_of(se); + + /* +- * Ensure the task's vruntime is normalized, so that when its ++ * Ensure the task's vruntime is normalized, so that when it's + * switched back to the fair class the enqueue_entity(.flags=0) will + * do the right thing. + * +- * If it was on_rq, then the dequeue_entity(.flags=0) will already +- * have normalized the vruntime, if it was !on_rq, then only when ++ * If it's on_rq, then the dequeue_entity(.flags=0) will already ++ * have normalized the vruntime, if it's !on_rq, then only when + * the task is sleeping will it still have non-normalized vruntime. + */ +- if (!se->on_rq && p->state != TASK_RUNNING) { ++ if (!p->on_rq && p->state != TASK_RUNNING) { + /* + * Fix up our vruntime so that the current sleep doesn't + * cause 'unlimited' sleep bonus. +diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c +index f681da32a2ff..19ee339a1d0d 100644 +--- a/kernel/time/tick-broadcast.c ++++ b/kernel/time/tick-broadcast.c +@@ -594,6 +594,13 @@ again: + cpumask_clear(tick_broadcast_force_mask); + + /* ++ * Sanity check. Catch the case where we try to broadcast to ++ * offline cpus. ++ */ ++ if (WARN_ON_ONCE(!cpumask_subset(tmpmask, cpu_online_mask))) ++ cpumask_and(tmpmask, tmpmask, cpu_online_mask); ++ ++ /* + * Wakeup the cpus which have an expired event. + */ + tick_do_broadcast(tmpmask); +@@ -834,10 +841,12 @@ void tick_shutdown_broadcast_oneshot(unsigned int *cpup) + raw_spin_lock_irqsave(&tick_broadcast_lock, flags); + + /* +- * Clear the broadcast mask flag for the dead cpu, but do not +- * stop the broadcast device! ++ * Clear the broadcast masks for the dead cpu, but do not stop ++ * the broadcast device! + */ + cpumask_clear_cpu(cpu, tick_broadcast_oneshot_mask); ++ cpumask_clear_cpu(cpu, tick_broadcast_pending_mask); ++ cpumask_clear_cpu(cpu, tick_broadcast_force_mask); + + raw_spin_unlock_irqrestore(&tick_broadcast_lock, flags); + } +diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c +index 3d18aadef493..2f4b185bfc23 100644 +--- a/kernel/trace/trace_events.c ++++ b/kernel/trace/trace_events.c +@@ -1860,6 +1860,16 @@ static void trace_module_add_events(struct module *mod) + struct ftrace_module_file_ops *file_ops = NULL; + struct ftrace_event_call **call, **start, **end; + ++ if (!mod->num_trace_events) ++ return; ++ ++ /* Don't add infrastructure for mods without tracepoints */ ++ if (trace_module_has_bad_taint(mod)) { ++ pr_err("%s: module has bad taint, not creating trace events\n", ++ mod->name); ++ return; ++ } ++ + start = mod->trace_events; + end = mod->trace_events + mod->num_trace_events; + +diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c +index 29f26540e9c9..031cc5655a51 100644 +--- a/kernel/tracepoint.c ++++ b/kernel/tracepoint.c +@@ -631,6 +631,11 @@ void tracepoint_iter_reset(struct tracepoint_iter *iter) + EXPORT_SYMBOL_GPL(tracepoint_iter_reset); + + #ifdef CONFIG_MODULES ++bool trace_module_has_bad_taint(struct module *mod) ++{ ++ return mod->taints & ~((1 << TAINT_OOT_MODULE) | (1 << TAINT_CRAP)); ++} ++ + static int tracepoint_module_coming(struct module *mod) + { + struct tp_module *tp_mod, *iter; +@@ -641,7 +646,7 @@ static int tracepoint_module_coming(struct module *mod) + * module headers (for forced load), to make sure we don't cause a crash. + * Staging and out-of-tree GPL modules are fine. + */ +- if (mod->taints & ~((1 << TAINT_OOT_MODULE) | (1 << TAINT_CRAP))) ++ if (trace_module_has_bad_taint(mod)) + return 0; + mutex_lock(&tracepoints_mutex); + tp_mod = kmalloc(sizeof(struct tp_module), GFP_KERNEL); +diff --git a/mm/compaction.c b/mm/compaction.c +index 9a3e351da29b..18a90b4d0bfc 100644 +--- a/mm/compaction.c ++++ b/mm/compaction.c +@@ -252,7 +252,6 @@ static unsigned long isolate_freepages_block(struct compact_control *cc, + { + int nr_scanned = 0, total_isolated = 0; + struct page *cursor, *valid_page = NULL; +- unsigned long nr_strict_required = end_pfn - blockpfn; + unsigned long flags; + bool locked = false; + +@@ -265,11 +264,12 @@ static unsigned long isolate_freepages_block(struct compact_control *cc, + + nr_scanned++; + if (!pfn_valid_within(blockpfn)) +- continue; ++ goto isolate_fail; ++ + if (!valid_page) + valid_page = page; + if (!PageBuddy(page)) +- continue; ++ goto isolate_fail; + + /* + * The zone lock must be held to isolate freepages. +@@ -290,12 +290,10 @@ static unsigned long isolate_freepages_block(struct compact_control *cc, + + /* Recheck this is a buddy page under lock */ + if (!PageBuddy(page)) +- continue; ++ goto isolate_fail; + + /* Found a free page, break it into order-0 pages */ + isolated = split_free_page(page); +- if (!isolated && strict) +- break; + total_isolated += isolated; + for (i = 0; i < isolated; i++) { + list_add(&page->lru, freelist); +@@ -306,7 +304,15 @@ static unsigned long isolate_freepages_block(struct compact_control *cc, + if (isolated) { + blockpfn += isolated - 1; + cursor += isolated - 1; ++ continue; + } ++ ++isolate_fail: ++ if (strict) ++ break; ++ else ++ continue; ++ + } + + trace_mm_compaction_isolate_freepages(nr_scanned, total_isolated); +@@ -316,7 +322,7 @@ static unsigned long isolate_freepages_block(struct compact_control *cc, + * pages requested were isolated. If there were any failures, 0 is + * returned and CMA will fail. + */ +- if (strict && nr_strict_required > total_isolated) ++ if (strict && blockpfn < end_pfn) + total_isolated = 0; + + if (locked) +diff --git a/mm/memcontrol.c b/mm/memcontrol.c +index 6115b2bbd6ea..f45e21ab9cea 100644 +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -6326,9 +6326,23 @@ static void mem_cgroup_invalidate_reclaim_iterators(struct mem_cgroup *memcg) + static void mem_cgroup_css_offline(struct cgroup *cont) + { + struct mem_cgroup *memcg = mem_cgroup_from_cont(cont); ++ struct cgroup *iter; + + mem_cgroup_invalidate_reclaim_iterators(memcg); ++ ++ /* ++ * This requires that offlining is serialized. Right now that is ++ * guaranteed because css_killed_work_fn() holds the cgroup_mutex. ++ */ ++ rcu_read_lock(); ++ cgroup_for_each_descendant_post(iter, cont) { ++ rcu_read_unlock(); ++ mem_cgroup_reparent_charges(mem_cgroup_from_cont(iter)); ++ rcu_read_lock(); ++ } ++ rcu_read_unlock(); + mem_cgroup_reparent_charges(memcg); ++ + mem_cgroup_destroy_all_caches(memcg); + } + +diff --git a/net/core/neighbour.c b/net/core/neighbour.c +index 49aeab86f317..b49e8bafab17 100644 +--- a/net/core/neighbour.c ++++ b/net/core/neighbour.c +@@ -764,9 +764,6 @@ static void neigh_periodic_work(struct work_struct *work) + nht = rcu_dereference_protected(tbl->nht, + lockdep_is_held(&tbl->lock)); + +- if (atomic_read(&tbl->entries) < tbl->gc_thresh1) +- goto out; +- + /* + * periodically recompute ReachableTime from random function + */ +@@ -779,6 +776,9 @@ static void neigh_periodic_work(struct work_struct *work) + neigh_rand_reach_time(p->base_reachable_time); + } + ++ if (atomic_read(&tbl->entries) < tbl->gc_thresh1) ++ goto out; ++ + for (i = 0 ; i < (1 << nht->hash_shift); i++) { + np = &nht->hash_buckets[i]; + +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 1a2e249cef49..39bdb14b3214 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -1001,7 +1001,8 @@ void tcp_free_fastopen_req(struct tcp_sock *tp) + } + } + +-static int tcp_sendmsg_fastopen(struct sock *sk, struct msghdr *msg, int *size) ++static int tcp_sendmsg_fastopen(struct sock *sk, struct msghdr *msg, ++ int *copied, size_t size) + { + struct tcp_sock *tp = tcp_sk(sk); + int err, flags; +@@ -1016,11 +1017,12 @@ static int tcp_sendmsg_fastopen(struct sock *sk, struct msghdr *msg, int *size) + if (unlikely(tp->fastopen_req == NULL)) + return -ENOBUFS; + tp->fastopen_req->data = msg; ++ tp->fastopen_req->size = size; + + flags = (msg->msg_flags & MSG_DONTWAIT) ? O_NONBLOCK : 0; + err = __inet_stream_connect(sk->sk_socket, msg->msg_name, + msg->msg_namelen, flags); +- *size = tp->fastopen_req->copied; ++ *copied = tp->fastopen_req->copied; + tcp_free_fastopen_req(tp); + return err; + } +@@ -1040,7 +1042,7 @@ int tcp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg, + + flags = msg->msg_flags; + if (flags & MSG_FASTOPEN) { +- err = tcp_sendmsg_fastopen(sk, msg, &copied_syn); ++ err = tcp_sendmsg_fastopen(sk, msg, &copied_syn, size); + if (err == -EINPROGRESS && copied_syn > 0) + goto out; + else if (err) +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index d2df17940e07..6da3d94a114b 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -2892,7 +2892,12 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn) + space = __tcp_mtu_to_mss(sk, inet_csk(sk)->icsk_pmtu_cookie) - + MAX_TCP_OPTION_SPACE; + +- syn_data = skb_copy_expand(syn, skb_headroom(syn), space, ++ space = min_t(size_t, space, fo->size); ++ ++ /* limit to order-0 allocations */ ++ space = min_t(size_t, space, SKB_MAX_HEAD(MAX_TCP_HEADER)); ++ ++ syn_data = skb_copy_expand(syn, MAX_TCP_HEADER, space, + sk->sk_allocation); + if (syn_data == NULL) + goto fallback; +diff --git a/net/ipv6/exthdrs_core.c b/net/ipv6/exthdrs_core.c +index c5e83fae4df4..51af9d0d019a 100644 +--- a/net/ipv6/exthdrs_core.c ++++ b/net/ipv6/exthdrs_core.c +@@ -212,7 +212,7 @@ int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset, + found = (nexthdr == target); + + if ((!ipv6_ext_hdr(nexthdr)) || nexthdr == NEXTHDR_NONE) { +- if (target < 0) ++ if (target < 0 || found) + break; + return -ENOENT; + } +diff --git a/net/ipv6/udp_offload.c b/net/ipv6/udp_offload.c +index 3696aa28784a..2f65b022627b 100644 +--- a/net/ipv6/udp_offload.c ++++ b/net/ipv6/udp_offload.c +@@ -108,7 +108,7 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb, + fptr = (struct frag_hdr *)(skb_network_header(skb) + unfrag_ip6hlen); + fptr->nexthdr = nexthdr; + fptr->reserved = 0; +- ipv6_select_ident(fptr, (struct rt6_info *)skb_dst(skb)); ++ fptr->identification = skb_shinfo(skb)->ip6_frag_id; + + /* Fragment the skb. ipv6 header and the remaining fields of the + * fragment header are updated in ipv6_gso_segment() +diff --git a/net/mac80211/mesh_ps.c b/net/mac80211/mesh_ps.c +index 3b7bfc01ee36..ddda201832b3 100644 +--- a/net/mac80211/mesh_ps.c ++++ b/net/mac80211/mesh_ps.c +@@ -36,6 +36,7 @@ static struct sk_buff *mps_qos_null_get(struct sta_info *sta) + sdata->vif.addr); + nullfunc->frame_control = fc; + nullfunc->duration_id = 0; ++ nullfunc->seq_ctrl = 0; + /* no address resolution for this frame -> set addr 1 immediately */ + memcpy(nullfunc->addr1, sta->sta.addr, ETH_ALEN); + memset(skb_put(skb, 2), 0, 2); /* append QoS control field */ +diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c +index 5b4328dcbe4e..49bc2246bd86 100644 +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -310,6 +310,7 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata, + switch (vht_oper->chan_width) { + case IEEE80211_VHT_CHANWIDTH_USE_HT: + vht_chandef.width = chandef->width; ++ vht_chandef.center_freq1 = chandef->center_freq1; + break; + case IEEE80211_VHT_CHANWIDTH_80MHZ: + vht_chandef.width = NL80211_CHAN_WIDTH_80; +@@ -359,6 +360,28 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata, + ret = 0; + + out: ++ /* ++ * When tracking the current AP, don't do any further checks if the ++ * new chandef is identical to the one we're currently using for the ++ * connection. This keeps us from playing ping-pong with regulatory, ++ * without it the following can happen (for example): ++ * - connect to an AP with 80 MHz, world regdom allows 80 MHz ++ * - AP advertises regdom US ++ * - CRDA loads regdom US with 80 MHz prohibited (old database) ++ * - the code below detects an unsupported channel, downgrades, and ++ * we disconnect from the AP in the caller ++ * - disconnect causes CRDA to reload world regdomain and the game ++ * starts anew. ++ * (see https://bugzilla.kernel.org/show_bug.cgi?id=70881) ++ * ++ * It seems possible that there are still scenarios with CSA or real ++ * bandwidth changes where a this could happen, but those cases are ++ * less common and wouldn't completely prevent using the AP. ++ */ ++ if (tracking && ++ cfg80211_chandef_identical(chandef, &sdata->vif.bss_conf.chandef)) ++ return ret; ++ + /* don't print the message below for VHT mismatch if VHT is disabled */ + if (ret & IEEE80211_STA_DISABLE_VHT) + vht_chandef = *chandef; +diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c +index 11216bc13b27..0418777c361f 100644 +--- a/net/mac80211/sta_info.c ++++ b/net/mac80211/sta_info.c +@@ -339,6 +339,7 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata, + return NULL; + + spin_lock_init(&sta->lock); ++ spin_lock_init(&sta->ps_lock); + INIT_WORK(&sta->drv_unblock_wk, sta_unblock); + INIT_WORK(&sta->ampdu_mlme.work, ieee80211_ba_session_work); + mutex_init(&sta->ampdu_mlme.mtx); +@@ -1045,6 +1046,8 @@ void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta) + + skb_queue_head_init(&pending); + ++ /* sync with ieee80211_tx_h_unicast_ps_buf */ ++ spin_lock(&sta->ps_lock); + /* Send all buffered frames to the station */ + for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) { + int count = skb_queue_len(&pending), tmp; +@@ -1064,6 +1067,7 @@ void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta) + } + + ieee80211_add_pending_skbs_fn(local, &pending, clear_sta_ps_flags, sta); ++ spin_unlock(&sta->ps_lock); + + local->total_ps_buffered -= buffered; + +@@ -1110,6 +1114,7 @@ static void ieee80211_send_null_response(struct ieee80211_sub_if_data *sdata, + memcpy(nullfunc->addr1, sta->sta.addr, ETH_ALEN); + memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN); + memcpy(nullfunc->addr3, sdata->vif.addr, ETH_ALEN); ++ nullfunc->seq_ctrl = 0; + + skb->priority = tid; + skb_set_queue_mapping(skb, ieee802_1d_to_ac[tid]); +diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h +index adc30045f99e..3184b2b2853c 100644 +--- a/net/mac80211/sta_info.h ++++ b/net/mac80211/sta_info.h +@@ -244,6 +244,7 @@ struct sta_ampdu_mlme { + * @drv_unblock_wk: used for driver PS unblocking + * @listen_interval: listen interval of this station, when we're acting as AP + * @_flags: STA flags, see &enum ieee80211_sta_info_flags, do not use directly ++ * @ps_lock: used for powersave (when mac80211 is the AP) related locking + * @ps_tx_buf: buffers (per AC) of frames to transmit to this station + * when it leaves power saving state or polls + * @tx_filtered: buffers (per AC) of frames we already tried to +@@ -324,10 +325,8 @@ struct sta_info { + /* use the accessors defined below */ + unsigned long _flags; + +- /* +- * STA powersave frame queues, no more than the internal +- * locking required. +- */ ++ /* STA powersave lock and frame queues */ ++ spinlock_t ps_lock; + struct sk_buff_head ps_tx_buf[IEEE80211_NUM_ACS]; + struct sk_buff_head tx_filtered[IEEE80211_NUM_ACS]; + unsigned long driver_buffered_tids; +diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c +index fe9d6e7b904b..6d5791d735f3 100644 +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -461,6 +461,20 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx) + sta->sta.addr, sta->sta.aid, ac); + if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER) + purge_old_ps_buffers(tx->local); ++ ++ /* sync with ieee80211_sta_ps_deliver_wakeup */ ++ spin_lock(&sta->ps_lock); ++ /* ++ * STA woke up the meantime and all the frames on ps_tx_buf have ++ * been queued to pending queue. No reordering can happen, go ++ * ahead and Tx the packet. ++ */ ++ if (!test_sta_flag(sta, WLAN_STA_PS_STA) && ++ !test_sta_flag(sta, WLAN_STA_PS_DRIVER)) { ++ spin_unlock(&sta->ps_lock); ++ return TX_CONTINUE; ++ } ++ + if (skb_queue_len(&sta->ps_tx_buf[ac]) >= STA_MAX_TX_BUFFER) { + struct sk_buff *old = skb_dequeue(&sta->ps_tx_buf[ac]); + ps_dbg(tx->sdata, +@@ -474,6 +488,7 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx) + info->control.vif = &tx->sdata->vif; + info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING; + skb_queue_tail(&sta->ps_tx_buf[ac], tx->skb); ++ spin_unlock(&sta->ps_lock); + + if (!timer_pending(&local->sta_cleanup)) + mod_timer(&local->sta_cleanup, +diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c +index afba19cb6f87..a282fddf8b00 100644 +--- a/net/mac80211/wme.c ++++ b/net/mac80211/wme.c +@@ -153,6 +153,11 @@ u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata, + return IEEE80211_AC_BE; + } + ++ if (skb->protocol == sdata->control_port_protocol) { ++ skb->priority = 7; ++ return ieee80211_downgrade_queue(sdata, skb); ++ } ++ + /* use the data classifier to determine what 802.1d tag the + * data frame has */ + skb->priority = cfg80211_classify8021d(skb); +diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c +index de1a0138317f..7ceb25ba85b8 100644 +--- a/net/sctp/sm_statefuns.c ++++ b/net/sctp/sm_statefuns.c +@@ -765,6 +765,13 @@ sctp_disposition_t sctp_sf_do_5_1D_ce(struct net *net, + struct sctp_chunk auth; + sctp_ierror_t ret; + ++ /* Make sure that we and the peer are AUTH capable */ ++ if (!net->sctp.auth_enable || !new_asoc->peer.auth_capable) { ++ kfree_skb(chunk->auth_chunk); ++ sctp_association_free(new_asoc); ++ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); ++ } ++ + /* set-up our fake chunk so that we can process it */ + auth.skb = chunk->auth_chunk; + auth.asoc = chunk->asoc; +diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c +index 3ca7927520b0..94d334781554 100644 +--- a/net/unix/af_unix.c ++++ b/net/unix/af_unix.c +@@ -160,9 +160,8 @@ static inline void unix_set_secdata(struct scm_cookie *scm, struct sk_buff *skb) + + static inline unsigned int unix_hash_fold(__wsum n) + { +- unsigned int hash = (__force unsigned int)n; ++ unsigned int hash = (__force unsigned int)csum_fold(n); + +- hash ^= hash>>16; + hash ^= hash>>8; + return hash&(UNIX_HASH_SIZE-1); + } +diff --git a/sound/pci/hda/patch_analog.c b/sound/pci/hda/patch_analog.c +index 5a6527668c07..290e09825b82 100644 +--- a/sound/pci/hda/patch_analog.c ++++ b/sound/pci/hda/patch_analog.c +@@ -3667,6 +3667,7 @@ static int ad1884_parse_auto_config(struct hda_codec *codec) + spec = codec->spec; + + spec->gen.mixer_nid = 0x20; ++ spec->gen.mixer_merge_nid = 0x21; + spec->gen.beep_nid = 0x10; + set_beep_amp(spec, 0x10, 0, HDA_OUTPUT); + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index e0bdcb3ecf0e..34548589f419 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -3648,6 +3648,7 @@ static const struct hda_fixup alc269_fixups[] = { + }; + + static const struct snd_pci_quirk alc269_fixup_tbl[] = { ++ SND_PCI_QUIRK(0x1025, 0x0283, "Acer TravelMate 8371", ALC269_FIXUP_INV_DMIC), + SND_PCI_QUIRK(0x1025, 0x029b, "Acer 1810TZ", ALC269_FIXUP_INV_DMIC), + SND_PCI_QUIRK(0x1025, 0x0349, "Acer AOD260", ALC269_FIXUP_INV_DMIC), + SND_PCI_QUIRK(0x1028, 0x05bd, "Dell", ALC269_FIXUP_DELL2_MIC_NO_PRESENCE), +diff --git a/sound/pci/oxygen/xonar_dg.c b/sound/pci/oxygen/xonar_dg.c +index 77acd790ea47..eb7ad7706205 100644 +--- a/sound/pci/oxygen/xonar_dg.c ++++ b/sound/pci/oxygen/xonar_dg.c +@@ -294,6 +294,16 @@ static int output_switch_put(struct snd_kcontrol *ctl, + oxygen_write16_masked(chip, OXYGEN_GPIO_DATA, + data->output_sel == 1 ? GPIO_HP_REAR : 0, + GPIO_HP_REAR); ++ oxygen_write8_masked(chip, OXYGEN_PLAY_ROUTING, ++ data->output_sel == 0 ? ++ OXYGEN_PLAY_MUTE01 : ++ OXYGEN_PLAY_MUTE23 | ++ OXYGEN_PLAY_MUTE45 | ++ OXYGEN_PLAY_MUTE67, ++ OXYGEN_PLAY_MUTE01 | ++ OXYGEN_PLAY_MUTE23 | ++ OXYGEN_PLAY_MUTE45 | ++ OXYGEN_PLAY_MUTE67); + } + mutex_unlock(&chip->mutex); + return changed; +@@ -596,7 +606,7 @@ struct oxygen_model model_xonar_dg = { + .model_data_size = sizeof(struct dg), + .device_config = PLAYBACK_0_TO_I2S | + PLAYBACK_1_TO_SPDIF | +- CAPTURE_0_FROM_I2S_2 | ++ CAPTURE_0_FROM_I2S_1 | + CAPTURE_1_FROM_SPDIF, + .dac_channels_pcm = 6, + .dac_channels_mixer = 0, +diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c +index 95558ef4a7a0..be4db47cb2d9 100644 +--- a/sound/usb/mixer.c ++++ b/sound/usb/mixer.c +@@ -883,6 +883,7 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval, + } + break; + ++ case USB_ID(0x046d, 0x0807): /* Logitech Webcam C500 */ + case USB_ID(0x046d, 0x0808): + case USB_ID(0x046d, 0x0809): + case USB_ID(0x046d, 0x081b): /* HD Webcam c310 */ diff --git a/projects/Cuboxi/patches/linux/linux-000-patch-3.10.34-35.patch b/projects/Cuboxi/patches/linux/linux-000-patch-3.10.34-35.patch new file mode 100644 index 0000000000..0930bacf27 --- /dev/null +++ b/projects/Cuboxi/patches/linux/linux-000-patch-3.10.34-35.patch @@ -0,0 +1,996 @@ +diff --git a/Makefile b/Makefile +index 571a1bf14868..06b31fce1ff5 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 10 +-SUBLEVEL = 34 ++SUBLEVEL = 35 + EXTRAVERSION = + NAME = TOSSUG Baby Fish + +diff --git a/arch/arm/include/asm/outercache.h b/arch/arm/include/asm/outercache.h +index 12f71a190422..f94784f0e3a6 100644 +--- a/arch/arm/include/asm/outercache.h ++++ b/arch/arm/include/asm/outercache.h +@@ -37,10 +37,10 @@ struct outer_cache_fns { + void (*resume)(void); + }; + +-#ifdef CONFIG_OUTER_CACHE +- + extern struct outer_cache_fns outer_cache; + ++#ifdef CONFIG_OUTER_CACHE ++ + static inline void outer_inv_range(phys_addr_t start, phys_addr_t end) + { + if (outer_cache.inv_range) +diff --git a/arch/arm/mach-highbank/highbank.c b/arch/arm/mach-highbank/highbank.c +index 5ed19e88874b..35d1029d7c9d 100644 +--- a/arch/arm/mach-highbank/highbank.c ++++ b/arch/arm/mach-highbank/highbank.c +@@ -65,14 +65,12 @@ void highbank_set_cpu_jump(int cpu, void *jump_addr) + HB_JUMP_TABLE_PHYS(cpu) + 15); + } + +-#ifdef CONFIG_CACHE_L2X0 + static void highbank_l2x0_disable(void) + { + outer_flush_all(); + /* Disable PL310 L2 Cache controller */ + highbank_smc1(0x102, 0x0); + } +-#endif + + static void __init highbank_init_irq(void) + { +@@ -81,12 +79,13 @@ static void __init highbank_init_irq(void) + if (of_find_compatible_node(NULL, NULL, "arm,cortex-a9")) + highbank_scu_map_io(); + +-#ifdef CONFIG_CACHE_L2X0 + /* Enable PL310 L2 Cache controller */ +- highbank_smc1(0x102, 0x1); +- l2x0_of_init(0, ~0UL); +- outer_cache.disable = highbank_l2x0_disable; +-#endif ++ if (IS_ENABLED(CONFIG_CACHE_L2X0) && ++ of_find_compatible_node(NULL, NULL, "arm,pl310-cache")) { ++ highbank_smc1(0x102, 0x1); ++ l2x0_of_init(0, ~0UL); ++ outer_cache.disable = highbank_l2x0_disable; ++ } + } + + static void __init highbank_timer_init(void) +diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c +index 004cc87b781c..711c649f80b7 100644 +--- a/arch/x86/kvm/mmu.c ++++ b/arch/x86/kvm/mmu.c +@@ -2585,6 +2585,9 @@ static int __direct_map(struct kvm_vcpu *vcpu, gpa_t v, int write, + int emulate = 0; + gfn_t pseudo_gfn; + ++ if (!VALID_PAGE(vcpu->arch.mmu.root_hpa)) ++ return 0; ++ + for_each_shadow_entry(vcpu, (u64)gfn << PAGE_SHIFT, iterator) { + if (iterator.level == level) { + mmu_set_spte(vcpu, iterator.sptep, ACC_ALL, +@@ -2748,6 +2751,9 @@ static bool fast_page_fault(struct kvm_vcpu *vcpu, gva_t gva, int level, + bool ret = false; + u64 spte = 0ull; + ++ if (!VALID_PAGE(vcpu->arch.mmu.root_hpa)) ++ return false; ++ + if (!page_fault_can_be_fast(vcpu, error_code)) + return false; + +@@ -3139,6 +3145,9 @@ static u64 walk_shadow_page_get_mmio_spte(struct kvm_vcpu *vcpu, u64 addr) + struct kvm_shadow_walk_iterator iterator; + u64 spte = 0ull; + ++ if (!VALID_PAGE(vcpu->arch.mmu.root_hpa)) ++ return spte; ++ + walk_shadow_page_lockless_begin(vcpu); + for_each_shadow_entry_lockless(vcpu, addr, iterator, spte) + if (!is_shadow_present_pte(spte)) +@@ -4329,6 +4338,9 @@ int kvm_mmu_get_spte_hierarchy(struct kvm_vcpu *vcpu, u64 addr, u64 sptes[4]) + u64 spte; + int nr_sptes = 0; + ++ if (!VALID_PAGE(vcpu->arch.mmu.root_hpa)) ++ return nr_sptes; ++ + walk_shadow_page_lockless_begin(vcpu); + for_each_shadow_entry_lockless(vcpu, addr, iterator, spte) { + sptes[iterator.level-1] = spte; +diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h +index da20860b457a..7e6090e13237 100644 +--- a/arch/x86/kvm/paging_tmpl.h ++++ b/arch/x86/kvm/paging_tmpl.h +@@ -423,6 +423,9 @@ static int FNAME(fetch)(struct kvm_vcpu *vcpu, gva_t addr, + if (FNAME(gpte_changed)(vcpu, gw, top_level)) + goto out_gpte_changed; + ++ if (!VALID_PAGE(vcpu->arch.mmu.root_hpa)) ++ goto out_gpte_changed; ++ + for (shadow_walk_init(&it, vcpu, addr); + shadow_walk_okay(&it) && it.level > gw->level; + shadow_walk_next(&it)) { +@@ -671,6 +674,11 @@ static void FNAME(invlpg)(struct kvm_vcpu *vcpu, gva_t gva) + */ + mmu_topup_memory_caches(vcpu); + ++ if (!VALID_PAGE(vcpu->arch.mmu.root_hpa)) { ++ WARN_ON(1); ++ return; ++ } ++ + spin_lock(&vcpu->kvm->mmu_lock); + for_each_shadow_entry(vcpu, gva, iterator) { + level = iterator.level; +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index 5402c94ab768..7cdafb6dc705 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -7133,8 +7133,8 @@ static void vmx_free_vcpu(struct kvm_vcpu *vcpu) + struct vcpu_vmx *vmx = to_vmx(vcpu); + + free_vpid(vmx); +- free_nested(vmx); + free_loaded_vmcs(vmx->loaded_vmcs); ++ free_nested(vmx); + kfree(vmx->guest_msrs); + kvm_vcpu_uninit(vcpu); + kmem_cache_free(kvm_vcpu_cache, vmx); +diff --git a/arch/x86/net/bpf_jit.S b/arch/x86/net/bpf_jit.S +index 877b9a1b2152..01495755701b 100644 +--- a/arch/x86/net/bpf_jit.S ++++ b/arch/x86/net/bpf_jit.S +@@ -140,7 +140,7 @@ bpf_slow_path_byte_msh: + push %r9; \ + push SKBDATA; \ + /* rsi already has offset */ \ +- mov $SIZE,%ecx; /* size */ \ ++ mov $SIZE,%edx; /* size */ \ + call bpf_internal_load_pointer_neg_helper; \ + test %rax,%rax; \ + pop SKBDATA; \ +diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c +index 1e8e42fb03a4..1fb1a7b5a754 100644 +--- a/drivers/input/mouse/elantech.c ++++ b/drivers/input/mouse/elantech.c +@@ -486,6 +486,7 @@ static void elantech_input_sync_v4(struct psmouse *psmouse) + unsigned char *packet = psmouse->packet; + + input_report_key(dev, BTN_LEFT, packet[0] & 0x01); ++ input_report_key(dev, BTN_RIGHT, packet[0] & 0x02); + input_mt_report_pointer_emulation(dev, true); + input_sync(dev); + } +@@ -954,6 +955,44 @@ static int elantech_get_resolution_v4(struct psmouse *psmouse, + } + + /* ++ * Advertise INPUT_PROP_BUTTONPAD for clickpads. The testing of bit 12 in ++ * fw_version for this is based on the following fw_version & caps table: ++ * ++ * Laptop-model: fw_version: caps: buttons: ++ * Acer S3 0x461f00 10, 13, 0e clickpad ++ * Acer S7-392 0x581f01 50, 17, 0d clickpad ++ * Acer V5-131 0x461f02 01, 16, 0c clickpad ++ * Acer V5-551 0x461f00 ? clickpad ++ * Asus K53SV 0x450f01 78, 15, 0c 2 hw buttons ++ * Asus G46VW 0x460f02 00, 18, 0c 2 hw buttons ++ * Asus G750JX 0x360f00 00, 16, 0c 2 hw buttons ++ * Asus UX31 0x361f00 20, 15, 0e clickpad ++ * Asus UX32VD 0x361f02 00, 15, 0e clickpad ++ * Avatar AVIU-145A2 0x361f00 ? clickpad ++ * Gigabyte U2442 0x450f01 58, 17, 0c 2 hw buttons ++ * Lenovo L430 0x350f02 b9, 15, 0c 2 hw buttons (*) ++ * Samsung NF210 0x150b00 78, 14, 0a 2 hw buttons ++ * Samsung NP770Z5E 0x575f01 10, 15, 0f clickpad ++ * Samsung NP700Z5B 0x361f06 21, 15, 0f clickpad ++ * Samsung NP900X3E-A02 0x575f03 ? clickpad ++ * Samsung NP-QX410 0x851b00 19, 14, 0c clickpad ++ * Samsung RC512 0x450f00 08, 15, 0c 2 hw buttons ++ * Samsung RF710 0x450f00 ? 2 hw buttons ++ * System76 Pangolin 0x250f01 ? 2 hw buttons ++ * (*) + 3 trackpoint buttons ++ */ ++static void elantech_set_buttonpad_prop(struct psmouse *psmouse) ++{ ++ struct input_dev *dev = psmouse->dev; ++ struct elantech_data *etd = psmouse->private; ++ ++ if (etd->fw_version & 0x001000) { ++ __set_bit(INPUT_PROP_BUTTONPAD, dev->propbit); ++ __clear_bit(BTN_RIGHT, dev->keybit); ++ } ++} ++ ++/* + * Set the appropriate event bits for the input subsystem + */ + static int elantech_set_input_params(struct psmouse *psmouse) +@@ -996,6 +1035,8 @@ static int elantech_set_input_params(struct psmouse *psmouse) + __set_bit(INPUT_PROP_SEMI_MT, dev->propbit); + /* fall through */ + case 3: ++ if (etd->hw_version == 3) ++ elantech_set_buttonpad_prop(psmouse); + input_set_abs_params(dev, ABS_X, x_min, x_max, 0, 0); + input_set_abs_params(dev, ABS_Y, y_min, y_max, 0, 0); + if (etd->reports_pressure) { +@@ -1017,9 +1058,7 @@ static int elantech_set_input_params(struct psmouse *psmouse) + */ + psmouse_warn(psmouse, "couldn't query resolution data.\n"); + } +- /* v4 is clickpad, with only one button. */ +- __set_bit(INPUT_PROP_BUTTONPAD, dev->propbit); +- __clear_bit(BTN_RIGHT, dev->keybit); ++ elantech_set_buttonpad_prop(psmouse); + __set_bit(BTN_TOOL_QUADTAP, dev->keybit); + /* For X to recognize me as touchpad. */ + input_set_abs_params(dev, ABS_X, x_min, x_max, 0, 0); +diff --git a/drivers/input/tablet/wacom_sys.c b/drivers/input/tablet/wacom_sys.c +index aaf23aeae2ea..3d838c0b495d 100644 +--- a/drivers/input/tablet/wacom_sys.c ++++ b/drivers/input/tablet/wacom_sys.c +@@ -339,7 +339,7 @@ static int wacom_parse_hid(struct usb_interface *intf, + struct usb_device *dev = interface_to_usbdev(intf); + char limit = 0; + /* result has to be defined as int for some devices */ +- int result = 0; ++ int result = 0, touch_max = 0; + int i = 0, usage = WCM_UNDEFINED, finger = 0, pen = 0; + unsigned char *report; + +@@ -386,7 +386,8 @@ static int wacom_parse_hid(struct usb_interface *intf, + if (usage == WCM_DESKTOP) { + if (finger) { + features->device_type = BTN_TOOL_FINGER; +- ++ /* touch device at least supports one touch point */ ++ touch_max = 1; + switch (features->type) { + case TABLETPC2FG: + features->pktlen = WACOM_PKGLEN_TPC2FG; +@@ -539,6 +540,8 @@ static int wacom_parse_hid(struct usb_interface *intf, + } + + out: ++ if (!features->touch_max && touch_max) ++ features->touch_max = touch_max; + result = 0; + kfree(report); + return result; +diff --git a/drivers/media/pci/cx18/cx18-driver.c b/drivers/media/pci/cx18/cx18-driver.c +index 13c9718a5ace..16e89f026bca 100644 +--- a/drivers/media/pci/cx18/cx18-driver.c ++++ b/drivers/media/pci/cx18/cx18-driver.c +@@ -327,13 +327,16 @@ void cx18_read_eeprom(struct cx18 *cx, struct tveeprom *tv) + struct i2c_client *c; + u8 eedata[256]; + ++ memset(tv, 0, sizeof(*tv)); ++ + c = kzalloc(sizeof(*c), GFP_KERNEL); ++ if (!c) ++ return; + + strlcpy(c->name, "cx18 tveeprom tmp", sizeof(c->name)); + c->adapter = &cx->i2c_adap[0]; + c->addr = 0xa0 >> 1; + +- memset(tv, 0, sizeof(*tv)); + if (tveeprom_read(c, eedata, sizeof(eedata))) + goto ret; + +diff --git a/drivers/media/usb/dvb-usb/cxusb.c b/drivers/media/usb/dvb-usb/cxusb.c +index 20e345d9fe8f..a1c641e18362 100644 +--- a/drivers/media/usb/dvb-usb/cxusb.c ++++ b/drivers/media/usb/dvb-usb/cxusb.c +@@ -149,6 +149,7 @@ static int cxusb_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], + int num) + { + struct dvb_usb_device *d = i2c_get_adapdata(adap); ++ int ret; + int i; + + if (mutex_lock_interruptible(&d->i2c_mutex) < 0) +@@ -173,7 +174,8 @@ static int cxusb_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], + if (1 + msg[i].len > sizeof(ibuf)) { + warn("i2c rd: len=%d is too big!\n", + msg[i].len); +- return -EOPNOTSUPP; ++ ret = -EOPNOTSUPP; ++ goto unlock; + } + obuf[0] = 0; + obuf[1] = msg[i].len; +@@ -193,12 +195,14 @@ static int cxusb_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], + if (3 + msg[i].len > sizeof(obuf)) { + warn("i2c wr: len=%d is too big!\n", + msg[i].len); +- return -EOPNOTSUPP; ++ ret = -EOPNOTSUPP; ++ goto unlock; + } + if (1 + msg[i + 1].len > sizeof(ibuf)) { + warn("i2c rd: len=%d is too big!\n", + msg[i + 1].len); +- return -EOPNOTSUPP; ++ ret = -EOPNOTSUPP; ++ goto unlock; + } + obuf[0] = msg[i].len; + obuf[1] = msg[i+1].len; +@@ -223,7 +227,8 @@ static int cxusb_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], + if (2 + msg[i].len > sizeof(obuf)) { + warn("i2c wr: len=%d is too big!\n", + msg[i].len); +- return -EOPNOTSUPP; ++ ret = -EOPNOTSUPP; ++ goto unlock; + } + obuf[0] = msg[i].addr; + obuf[1] = msg[i].len; +@@ -237,8 +242,14 @@ static int cxusb_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], + } + } + ++ if (i == num) ++ ret = num; ++ else ++ ret = -EREMOTEIO; ++ ++unlock: + mutex_unlock(&d->i2c_mutex); +- return i == num ? num : -EREMOTEIO; ++ return ret; + } + + static u32 cxusb_i2c_func(struct i2c_adapter *adapter) +diff --git a/drivers/media/usb/dvb-usb/dw2102.c b/drivers/media/usb/dvb-usb/dw2102.c +index 71b22f5a05ce..4170a45d17e0 100644 +--- a/drivers/media/usb/dvb-usb/dw2102.c ++++ b/drivers/media/usb/dvb-usb/dw2102.c +@@ -301,6 +301,7 @@ static int dw2102_serit_i2c_transfer(struct i2c_adapter *adap, + static int dw2102_earda_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], int num) + { + struct dvb_usb_device *d = i2c_get_adapdata(adap); ++ int ret; + + if (!d) + return -ENODEV; +@@ -316,7 +317,8 @@ static int dw2102_earda_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg ms + if (2 + msg[1].len > sizeof(ibuf)) { + warn("i2c rd: len=%d is too big!\n", + msg[1].len); +- return -EOPNOTSUPP; ++ ret = -EOPNOTSUPP; ++ goto unlock; + } + + obuf[0] = msg[0].addr << 1; +@@ -340,7 +342,8 @@ static int dw2102_earda_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg ms + if (2 + msg[0].len > sizeof(obuf)) { + warn("i2c wr: len=%d is too big!\n", + msg[1].len); +- return -EOPNOTSUPP; ++ ret = -EOPNOTSUPP; ++ goto unlock; + } + + obuf[0] = msg[0].addr << 1; +@@ -357,7 +360,8 @@ static int dw2102_earda_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg ms + if (2 + msg[0].len > sizeof(obuf)) { + warn("i2c wr: len=%d is too big!\n", + msg[1].len); +- return -EOPNOTSUPP; ++ ret = -EOPNOTSUPP; ++ goto unlock; + } + + obuf[0] = msg[0].addr << 1; +@@ -386,15 +390,17 @@ static int dw2102_earda_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg ms + + break; + } ++ ret = num; + ++unlock: + mutex_unlock(&d->i2c_mutex); +- return num; ++ return ret; + } + + static int dw2104_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], int num) + { + struct dvb_usb_device *d = i2c_get_adapdata(adap); +- int len, i, j; ++ int len, i, j, ret; + + if (!d) + return -ENODEV; +@@ -430,7 +436,8 @@ static int dw2104_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], i + if (2 + msg[j].len > sizeof(ibuf)) { + warn("i2c rd: len=%d is too big!\n", + msg[j].len); +- return -EOPNOTSUPP; ++ ret = -EOPNOTSUPP; ++ goto unlock; + } + + dw210x_op_rw(d->udev, 0xc3, +@@ -466,7 +473,8 @@ static int dw2104_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], i + if (2 + msg[j].len > sizeof(obuf)) { + warn("i2c wr: len=%d is too big!\n", + msg[j].len); +- return -EOPNOTSUPP; ++ ret = -EOPNOTSUPP; ++ goto unlock; + } + + obuf[0] = msg[j].addr << 1; +@@ -481,15 +489,18 @@ static int dw2104_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], i + } + + } ++ ret = num; + ++unlock: + mutex_unlock(&d->i2c_mutex); +- return num; ++ return ret; + } + + static int dw3101_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], + int num) + { + struct dvb_usb_device *d = i2c_get_adapdata(adap); ++ int ret; + int i; + + if (!d) +@@ -506,7 +517,8 @@ static int dw3101_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], + if (2 + msg[1].len > sizeof(ibuf)) { + warn("i2c rd: len=%d is too big!\n", + msg[1].len); +- return -EOPNOTSUPP; ++ ret = -EOPNOTSUPP; ++ goto unlock; + } + obuf[0] = msg[0].addr << 1; + obuf[1] = msg[0].len; +@@ -530,7 +542,8 @@ static int dw3101_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], + if (2 + msg[0].len > sizeof(obuf)) { + warn("i2c wr: len=%d is too big!\n", + msg[0].len); +- return -EOPNOTSUPP; ++ ret = -EOPNOTSUPP; ++ goto unlock; + } + obuf[0] = msg[0].addr << 1; + obuf[1] = msg[0].len; +@@ -556,9 +569,11 @@ static int dw3101_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], + msg[i].flags == 0 ? ">>>" : "<<<"); + debug_dump(msg[i].buf, msg[i].len, deb_xfer); + } ++ ret = num; + ++unlock: + mutex_unlock(&d->i2c_mutex); +- return num; ++ return ret; + } + + static int s6x0_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], +@@ -566,7 +581,7 @@ static int s6x0_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], + { + struct dvb_usb_device *d = i2c_get_adapdata(adap); + struct usb_device *udev; +- int len, i, j; ++ int len, i, j, ret; + + if (!d) + return -ENODEV; +@@ -618,7 +633,8 @@ static int s6x0_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], + if (msg[j].len > sizeof(ibuf)) { + warn("i2c rd: len=%d is too big!\n", + msg[j].len); +- return -EOPNOTSUPP; ++ ret = -EOPNOTSUPP; ++ goto unlock; + } + + dw210x_op_rw(d->udev, 0x91, 0, 0, +@@ -652,7 +668,8 @@ static int s6x0_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], + if (2 + msg[j].len > sizeof(obuf)) { + warn("i2c wr: len=%d is too big!\n", + msg[j].len); +- return -EOPNOTSUPP; ++ ret = -EOPNOTSUPP; ++ goto unlock; + } + + obuf[0] = msg[j + 1].len; +@@ -671,7 +688,8 @@ static int s6x0_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], + if (2 + msg[j].len > sizeof(obuf)) { + warn("i2c wr: len=%d is too big!\n", + msg[j].len); +- return -EOPNOTSUPP; ++ ret = -EOPNOTSUPP; ++ goto unlock; + } + obuf[0] = msg[j].len + 1; + obuf[1] = (msg[j].addr << 1); +@@ -685,9 +703,11 @@ static int s6x0_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], + } + } + } ++ ret = num; + ++unlock: + mutex_unlock(&d->i2c_mutex); +- return num; ++ return ret; + } + + static int su3000_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], +diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel/e100.c +index d2bea3f07c73..69d3f59f8728 100644 +--- a/drivers/net/ethernet/intel/e100.c ++++ b/drivers/net/ethernet/intel/e100.c +@@ -3039,7 +3039,7 @@ static void __e100_shutdown(struct pci_dev *pdev, bool *enable_wake) + *enable_wake = false; + } + +- pci_disable_device(pdev); ++ pci_clear_master(pdev); + } + + static int __e100_power_off(struct pci_dev *pdev, bool wake) +diff --git a/drivers/net/wireless/p54/txrx.c b/drivers/net/wireless/p54/txrx.c +index f95de0d16216..1de59b0f8fa8 100644 +--- a/drivers/net/wireless/p54/txrx.c ++++ b/drivers/net/wireless/p54/txrx.c +@@ -587,7 +587,7 @@ static void p54_rx_stats(struct p54_common *priv, struct sk_buff *skb) + chan = priv->curchan; + if (chan) { + struct survey_info *survey = &priv->survey[chan->hw_value]; +- survey->noise = clamp_t(s8, priv->noise, -128, 127); ++ survey->noise = clamp(priv->noise, -128, 127); + survey->channel_time = priv->survey_raw.active; + survey->channel_time_tx = priv->survey_raw.tx; + survey->channel_time_busy = priv->survey_raw.tx + +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index c59cc6ed7adb..a86d12326137 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -1712,8 +1712,6 @@ static int _regulator_do_disable(struct regulator_dev *rdev) + + trace_regulator_disable_complete(rdev_get_name(rdev)); + +- _notifier_call_chain(rdev, REGULATOR_EVENT_DISABLE, +- NULL); + return 0; + } + +@@ -1737,6 +1735,8 @@ static int _regulator_disable(struct regulator_dev *rdev) + rdev_err(rdev, "failed to disable\n"); + return ret; + } ++ _notifier_call_chain(rdev, REGULATOR_EVENT_DISABLE, ++ NULL); + } + + rdev->use_count = 0; +@@ -1789,20 +1789,16 @@ static int _regulator_force_disable(struct regulator_dev *rdev) + { + int ret = 0; + +- /* force disable */ +- if (rdev->desc->ops->disable) { +- /* ah well, who wants to live forever... */ +- ret = rdev->desc->ops->disable(rdev); +- if (ret < 0) { +- rdev_err(rdev, "failed to force disable\n"); +- return ret; +- } +- /* notify other consumers that power has been forced off */ +- _notifier_call_chain(rdev, REGULATOR_EVENT_FORCE_DISABLE | +- REGULATOR_EVENT_DISABLE, NULL); ++ ret = _regulator_do_disable(rdev); ++ if (ret < 0) { ++ rdev_err(rdev, "failed to force disable\n"); ++ return ret; + } + +- return ret; ++ _notifier_call_chain(rdev, REGULATOR_EVENT_FORCE_DISABLE | ++ REGULATOR_EVENT_DISABLE, NULL); ++ ++ return 0; + } + + /** +@@ -3788,8 +3784,6 @@ int regulator_suspend_finish(void) + + mutex_lock(®ulator_list_mutex); + list_for_each_entry(rdev, ®ulator_list, list) { +- struct regulator_ops *ops = rdev->desc->ops; +- + mutex_lock(&rdev->mutex); + if (rdev->use_count > 0 || rdev->constraints->always_on) { + error = _regulator_do_enable(rdev); +@@ -3798,12 +3792,10 @@ int regulator_suspend_finish(void) + } else { + if (!has_full_constraints) + goto unlock; +- if (!ops->disable) +- goto unlock; + if (!_regulator_is_enabled(rdev)) + goto unlock; + +- error = ops->disable(rdev); ++ error = _regulator_do_disable(rdev); + if (error) + ret = error; + } +@@ -3993,7 +3985,7 @@ static int __init regulator_init_complete(void) + ops = rdev->desc->ops; + c = rdev->constraints; + +- if (!ops->disable || (c && c->always_on)) ++ if (c && c->always_on) + continue; + + mutex_lock(&rdev->mutex); +@@ -4014,7 +4006,7 @@ static int __init regulator_init_complete(void) + /* We log since this may kill the system if it + * goes wrong. */ + rdev_info(rdev, "disabling\n"); +- ret = ops->disable(rdev); ++ ret = _regulator_do_disable(rdev); + if (ret != 0) { + rdev_err(rdev, "couldn't disable: %d\n", ret); + } +diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c +index 159e3c6d92b9..3581416a24d8 100644 +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -113,6 +113,11 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) + xhci_dbg(xhci, "QUIRK: Resetting on resume\n"); + xhci->quirks |= XHCI_TRUST_TX_LENGTH; + } ++ if (pdev->vendor == PCI_VENDOR_ID_RENESAS && ++ pdev->device == 0x0015 && ++ pdev->subsystem_vendor == PCI_VENDOR_ID_SAMSUNG && ++ pdev->subsystem_device == 0xc0cd) ++ xhci->quirks |= XHCI_RESET_ON_RESUME; + if (pdev->vendor == PCI_VENDOR_ID_VIA) + xhci->quirks |= XHCI_RESET_ON_RESUME; + } +diff --git a/include/linux/ceph/osd_client.h b/include/linux/ceph/osd_client.h +index 8f47625a0661..4fb6a8938957 100644 +--- a/include/linux/ceph/osd_client.h ++++ b/include/linux/ceph/osd_client.h +@@ -138,6 +138,7 @@ struct ceph_osd_request { + __le64 *r_request_pool; + void *r_request_pgid; + __le32 *r_request_attempts; ++ bool r_paused; + struct ceph_eversion *r_request_reassert_version; + + int r_result; +diff --git a/include/linux/ftrace_event.h b/include/linux/ftrace_event.h +index 120d57a1c3a5..b5e36017acd7 100644 +--- a/include/linux/ftrace_event.h ++++ b/include/linux/ftrace_event.h +@@ -325,10 +325,6 @@ enum { + FILTER_TRACE_FN, + }; + +-#define EVENT_STORAGE_SIZE 128 +-extern struct mutex event_storage_mutex; +-extern char event_storage[EVENT_STORAGE_SIZE]; +- + extern int trace_event_raw_init(struct ftrace_event_call *call); + extern int trace_define_field(struct ftrace_event_call *call, const char *type, + const char *name, int offset, int size, +diff --git a/include/trace/ftrace.h b/include/trace/ftrace.h +index 66dba42128d7..dbb47418df81 100644 +--- a/include/trace/ftrace.h ++++ b/include/trace/ftrace.h +@@ -299,15 +299,12 @@ static struct trace_event_functions ftrace_event_type_funcs_##call = { \ + #undef __array + #define __array(type, item, len) \ + do { \ +- mutex_lock(&event_storage_mutex); \ ++ char *type_str = #type"["__stringify(len)"]"; \ + BUILD_BUG_ON(len > MAX_FILTER_STR_VAL); \ +- snprintf(event_storage, sizeof(event_storage), \ +- "%s[%d]", #type, len); \ +- ret = trace_define_field(event_call, event_storage, #item, \ ++ ret = trace_define_field(event_call, type_str, #item, \ + offsetof(typeof(field), item), \ + sizeof(field.item), \ + is_signed_type(type), FILTER_OTHER); \ +- mutex_unlock(&event_storage_mutex); \ + if (ret) \ + return ret; \ + } while (0); +diff --git a/kernel/sched/auto_group.c b/kernel/sched/auto_group.c +index 64de5f8b0c9e..4a073539c58e 100644 +--- a/kernel/sched/auto_group.c ++++ b/kernel/sched/auto_group.c +@@ -77,8 +77,6 @@ static inline struct autogroup *autogroup_create(void) + if (IS_ERR(tg)) + goto out_free; + +- sched_online_group(tg, &root_task_group); +- + kref_init(&ag->kref); + init_rwsem(&ag->lock); + ag->id = atomic_inc_return(&autogroup_seq_nr); +@@ -98,6 +96,7 @@ static inline struct autogroup *autogroup_create(void) + #endif + tg->autogroup = ag; + ++ sched_online_group(tg, &root_task_group); + return ag; + + out_free: +diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c +index 2f4b185bfc23..001b349af939 100644 +--- a/kernel/trace/trace_events.c ++++ b/kernel/trace/trace_events.c +@@ -27,12 +27,6 @@ + + DEFINE_MUTEX(event_mutex); + +-DEFINE_MUTEX(event_storage_mutex); +-EXPORT_SYMBOL_GPL(event_storage_mutex); +- +-char event_storage[EVENT_STORAGE_SIZE]; +-EXPORT_SYMBOL_GPL(event_storage); +- + LIST_HEAD(ftrace_events); + static LIST_HEAD(ftrace_common_fields); + +diff --git a/kernel/trace/trace_export.c b/kernel/trace/trace_export.c +index d21a74670088..d7d0b50b1b70 100644 +--- a/kernel/trace/trace_export.c ++++ b/kernel/trace/trace_export.c +@@ -95,15 +95,12 @@ static void __always_unused ____ftrace_check_##name(void) \ + #undef __array + #define __array(type, item, len) \ + do { \ ++ char *type_str = #type"["__stringify(len)"]"; \ + BUILD_BUG_ON(len > MAX_FILTER_STR_VAL); \ +- mutex_lock(&event_storage_mutex); \ +- snprintf(event_storage, sizeof(event_storage), \ +- "%s[%d]", #type, len); \ +- ret = trace_define_field(event_call, event_storage, #item, \ ++ ret = trace_define_field(event_call, type_str, #item, \ + offsetof(typeof(field), item), \ + sizeof(field.item), \ + is_signed_type(type), filter_type); \ +- mutex_unlock(&event_storage_mutex); \ + if (ret) \ + return ret; \ + } while (0); +diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c +index bc0016e3e5ac..3663a305daf7 100644 +--- a/net/ceph/osd_client.c ++++ b/net/ceph/osd_client.c +@@ -1225,6 +1225,22 @@ void ceph_osdc_set_request_linger(struct ceph_osd_client *osdc, + EXPORT_SYMBOL(ceph_osdc_set_request_linger); + + /* ++ * Returns whether a request should be blocked from being sent ++ * based on the current osdmap and osd_client settings. ++ * ++ * Caller should hold map_sem for read. ++ */ ++static bool __req_should_be_paused(struct ceph_osd_client *osdc, ++ struct ceph_osd_request *req) ++{ ++ bool pauserd = ceph_osdmap_flag(osdc->osdmap, CEPH_OSDMAP_PAUSERD); ++ bool pausewr = ceph_osdmap_flag(osdc->osdmap, CEPH_OSDMAP_PAUSEWR) || ++ ceph_osdmap_flag(osdc->osdmap, CEPH_OSDMAP_FULL); ++ return (req->r_flags & CEPH_OSD_FLAG_READ && pauserd) || ++ (req->r_flags & CEPH_OSD_FLAG_WRITE && pausewr); ++} ++ ++/* + * Pick an osd (the first 'up' osd in the pg), allocate the osd struct + * (as needed), and set the request r_osd appropriately. If there is + * no up osd, set r_osd to NULL. Move the request to the appropriate list +@@ -1241,6 +1257,7 @@ static int __map_request(struct ceph_osd_client *osdc, + int acting[CEPH_PG_MAX_SIZE]; + int o = -1, num = 0; + int err; ++ bool was_paused; + + dout("map_request %p tid %lld\n", req, req->r_tid); + err = ceph_calc_ceph_pg(&pgid, req->r_oid, osdc->osdmap, +@@ -1257,12 +1274,18 @@ static int __map_request(struct ceph_osd_client *osdc, + num = err; + } + ++ was_paused = req->r_paused; ++ req->r_paused = __req_should_be_paused(osdc, req); ++ if (was_paused && !req->r_paused) ++ force_resend = 1; ++ + if ((!force_resend && + req->r_osd && req->r_osd->o_osd == o && + req->r_sent >= req->r_osd->o_incarnation && + req->r_num_pg_osds == num && + memcmp(req->r_pg_osds, acting, sizeof(acting[0])*num) == 0) || +- (req->r_osd == NULL && o == -1)) ++ (req->r_osd == NULL && o == -1) || ++ req->r_paused) + return 0; /* no change */ + + dout("map_request tid %llu pgid %lld.%x osd%d (was osd%d)\n", +@@ -1606,14 +1629,17 @@ static void reset_changed_osds(struct ceph_osd_client *osdc) + * + * Caller should hold map_sem for read. + */ +-static void kick_requests(struct ceph_osd_client *osdc, int force_resend) ++static void kick_requests(struct ceph_osd_client *osdc, bool force_resend, ++ bool force_resend_writes) + { + struct ceph_osd_request *req, *nreq; + struct rb_node *p; + int needmap = 0; + int err; ++ bool force_resend_req; + +- dout("kick_requests %s\n", force_resend ? " (force resend)" : ""); ++ dout("kick_requests %s %s\n", force_resend ? " (force resend)" : "", ++ force_resend_writes ? " (force resend writes)" : ""); + mutex_lock(&osdc->request_mutex); + for (p = rb_first(&osdc->requests); p; ) { + req = rb_entry(p, struct ceph_osd_request, r_node); +@@ -1638,7 +1664,10 @@ static void kick_requests(struct ceph_osd_client *osdc, int force_resend) + continue; + } + +- err = __map_request(osdc, req, force_resend); ++ force_resend_req = force_resend || ++ (force_resend_writes && ++ req->r_flags & CEPH_OSD_FLAG_WRITE); ++ err = __map_request(osdc, req, force_resend_req); + if (err < 0) + continue; /* error */ + if (req->r_osd == NULL) { +@@ -1658,7 +1687,8 @@ static void kick_requests(struct ceph_osd_client *osdc, int force_resend) + r_linger_item) { + dout("linger req=%p req->r_osd=%p\n", req, req->r_osd); + +- err = __map_request(osdc, req, force_resend); ++ err = __map_request(osdc, req, ++ force_resend || force_resend_writes); + dout("__map_request returned %d\n", err); + if (err == 0) + continue; /* no change and no osd was specified */ +@@ -1700,6 +1730,7 @@ void ceph_osdc_handle_map(struct ceph_osd_client *osdc, struct ceph_msg *msg) + struct ceph_osdmap *newmap = NULL, *oldmap; + int err; + struct ceph_fsid fsid; ++ bool was_full; + + dout("handle_map have %u\n", osdc->osdmap ? osdc->osdmap->epoch : 0); + p = msg->front.iov_base; +@@ -1713,6 +1744,8 @@ void ceph_osdc_handle_map(struct ceph_osd_client *osdc, struct ceph_msg *msg) + + down_write(&osdc->map_sem); + ++ was_full = ceph_osdmap_flag(osdc->osdmap, CEPH_OSDMAP_FULL); ++ + /* incremental maps */ + ceph_decode_32_safe(&p, end, nr_maps, bad); + dout(" %d inc maps\n", nr_maps); +@@ -1737,7 +1770,10 @@ void ceph_osdc_handle_map(struct ceph_osd_client *osdc, struct ceph_msg *msg) + ceph_osdmap_destroy(osdc->osdmap); + osdc->osdmap = newmap; + } +- kick_requests(osdc, 0); ++ was_full = was_full || ++ ceph_osdmap_flag(osdc->osdmap, ++ CEPH_OSDMAP_FULL); ++ kick_requests(osdc, 0, was_full); + } else { + dout("ignoring incremental map %u len %d\n", + epoch, maplen); +@@ -1780,7 +1816,10 @@ void ceph_osdc_handle_map(struct ceph_osd_client *osdc, struct ceph_msg *msg) + skipped_map = 1; + ceph_osdmap_destroy(oldmap); + } +- kick_requests(osdc, skipped_map); ++ was_full = was_full || ++ ceph_osdmap_flag(osdc->osdmap, ++ CEPH_OSDMAP_FULL); ++ kick_requests(osdc, skipped_map, was_full); + } + p += maplen; + nr_maps--; +@@ -1797,7 +1836,9 @@ done: + * we find out when we are no longer full and stop returning + * ENOSPC. + */ +- if (ceph_osdmap_flag(osdc->osdmap, CEPH_OSDMAP_FULL)) ++ if (ceph_osdmap_flag(osdc->osdmap, CEPH_OSDMAP_FULL) || ++ ceph_osdmap_flag(osdc->osdmap, CEPH_OSDMAP_PAUSERD) || ++ ceph_osdmap_flag(osdc->osdmap, CEPH_OSDMAP_PAUSEWR)) + ceph_monc_request_next_osdmap(&osdc->client->monc); + + mutex_lock(&osdc->request_mutex); +diff --git a/scripts/package/builddeb b/scripts/package/builddeb +index acb86507828a..3001ec5ae07d 100644 +--- a/scripts/package/builddeb ++++ b/scripts/package/builddeb +@@ -62,7 +62,7 @@ create_package() { + fi + + # Create the package +- dpkg-gencontrol -isp $forcearch -p$pname -P"$pdir" ++ dpkg-gencontrol -isp $forcearch -Vkernel:debarch="${debarch:-$(dpkg --print-architecture)}" -p$pname -P"$pdir" + dpkg --build "$pdir" .. + } + +@@ -252,15 +252,14 @@ mkdir -p "$destdir" + (cd $objtree; tar -c -f - -T "$objtree/debian/hdrobjfiles") | (cd $destdir; tar -xf -) + ln -sf "/usr/src/linux-headers-$version" "$kernel_headers_dir/lib/modules/$version/build" + rm -f "$objtree/debian/hdrsrcfiles" "$objtree/debian/hdrobjfiles" +-arch=$(dpkg --print-architecture) + + cat <> debian/control + + Package: $kernel_headers_packagename + Provides: linux-headers, linux-headers-2.6 +-Architecture: $arch +-Description: Linux kernel headers for $KERNELRELEASE on $arch +- This package provides kernel header files for $KERNELRELEASE on $arch ++Architecture: any ++Description: Linux kernel headers for $KERNELRELEASE on \${kernel:debarch} ++ This package provides kernel header files for $KERNELRELEASE on \${kernel:debarch} + . + This is useful for people who need to build external modules + EOF +diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c +index 19799931c51d..3fdf998ad057 100644 +--- a/sound/core/compress_offload.c ++++ b/sound/core/compress_offload.c +@@ -133,7 +133,7 @@ static int snd_compr_open(struct inode *inode, struct file *f) + kfree(data); + } + snd_card_unref(compr->card); +- return 0; ++ return ret; + } + + static int snd_compr_free(struct inode *inode, struct file *f) +diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c +index 819c90fe021f..4fdcc1cefc25 100644 +--- a/sound/soc/codecs/max98090.c ++++ b/sound/soc/codecs/max98090.c +@@ -336,6 +336,7 @@ static bool max98090_readable_register(struct device *dev, unsigned int reg) + case M98090_REG_RECORD_TDM_SLOT: + case M98090_REG_SAMPLE_RATE: + case M98090_REG_DMIC34_BIQUAD_BASE ... M98090_REG_DMIC34_BIQUAD_BASE + 0x0E: ++ case M98090_REG_REVISION_ID: + return true; + default: + return false; diff --git a/projects/Cuboxi/patches/linux/linux-000-patch-3.10.35-36.patch b/projects/Cuboxi/patches/linux/linux-000-patch-3.10.35-36.patch new file mode 100644 index 0000000000..8fd7280c73 --- /dev/null +++ b/projects/Cuboxi/patches/linux/linux-000-patch-3.10.35-36.patch @@ -0,0 +1,604 @@ +diff --git a/Makefile b/Makefile +index 06b31fce1ff5..b5f4ef30f6e6 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 10 +-SUBLEVEL = 35 ++SUBLEVEL = 36 + EXTRAVERSION = + NAME = TOSSUG Baby Fish + +diff --git a/arch/x86/include/asm/topology.h b/arch/x86/include/asm/topology.h +index 095b21507b6a..60bd2748a7c9 100644 +--- a/arch/x86/include/asm/topology.h ++++ b/arch/x86/include/asm/topology.h +@@ -119,9 +119,10 @@ static inline void setup_node_to_cpumask_map(void) { } + + extern const struct cpumask *cpu_coregroup_mask(int cpu); + +-#ifdef ENABLE_TOPO_DEFINES + #define topology_physical_package_id(cpu) (cpu_data(cpu).phys_proc_id) + #define topology_core_id(cpu) (cpu_data(cpu).cpu_core_id) ++ ++#ifdef ENABLE_TOPO_DEFINES + #define topology_core_cpumask(cpu) (per_cpu(cpu_core_map, cpu)) + #define topology_thread_cpumask(cpu) (per_cpu(cpu_sibling_map, cpu)) + +diff --git a/drivers/block/aoe/aoecmd.c b/drivers/block/aoe/aoecmd.c +index fc803ecbbce4..31262732db23 100644 +--- a/drivers/block/aoe/aoecmd.c ++++ b/drivers/block/aoe/aoecmd.c +@@ -899,7 +899,7 @@ bio_pageinc(struct bio *bio) + * but this has never been seen here. + */ + if (unlikely(PageCompound(page))) +- if (compound_trans_head(page) != page) { ++ if (compound_head(page) != page) { + pr_crit("page tail used for block I/O\n"); + BUG(); + } +diff --git a/drivers/input/mouse/cypress_ps2.c b/drivers/input/mouse/cypress_ps2.c +index 888a81a7ea3d..0aaea7ad6cee 100644 +--- a/drivers/input/mouse/cypress_ps2.c ++++ b/drivers/input/mouse/cypress_ps2.c +@@ -410,7 +410,6 @@ static int cypress_set_input_params(struct input_dev *input, + __clear_bit(REL_X, input->relbit); + __clear_bit(REL_Y, input->relbit); + +- __set_bit(INPUT_PROP_BUTTONPAD, input->propbit); + __set_bit(EV_KEY, input->evbit); + __set_bit(BTN_LEFT, input->keybit); + __set_bit(BTN_RIGHT, input->keybit); +diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c +index b2420ae19e14..c69c81608f43 100644 +--- a/drivers/input/mouse/synaptics.c ++++ b/drivers/input/mouse/synaptics.c +@@ -265,11 +265,22 @@ static int synaptics_identify(struct psmouse *psmouse) + * Read touchpad resolution and maximum reported coordinates + * Resolution is left zero if touchpad does not support the query + */ ++ ++static const int *quirk_min_max; ++ + static int synaptics_resolution(struct psmouse *psmouse) + { + struct synaptics_data *priv = psmouse->private; + unsigned char resp[3]; + ++ if (quirk_min_max) { ++ priv->x_min = quirk_min_max[0]; ++ priv->x_max = quirk_min_max[1]; ++ priv->y_min = quirk_min_max[2]; ++ priv->y_max = quirk_min_max[3]; ++ return 0; ++ } ++ + if (SYN_ID_MAJOR(priv->identity) < 4) + return 0; + +@@ -1485,10 +1496,54 @@ static const struct dmi_system_id __initconst olpc_dmi_table[] = { + { } + }; + ++static const struct dmi_system_id min_max_dmi_table[] __initconst = { ++#if defined(CONFIG_DMI) ++ { ++ /* Lenovo ThinkPad Helix */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad Helix"), ++ }, ++ .driver_data = (int []){1024, 5052, 2258, 4832}, ++ }, ++ { ++ /* Lenovo ThinkPad X240 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X240"), ++ }, ++ .driver_data = (int []){1232, 5710, 1156, 4696}, ++ }, ++ { ++ /* Lenovo ThinkPad T440s */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T440"), ++ }, ++ .driver_data = (int []){1024, 5112, 2024, 4832}, ++ }, ++ { ++ /* Lenovo ThinkPad T540p */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T540"), ++ }, ++ .driver_data = (int []){1024, 5056, 2058, 4832}, ++ }, ++#endif ++ { } ++}; ++ + void __init synaptics_module_init(void) + { ++ const struct dmi_system_id *min_max_dmi; ++ + impaired_toshiba_kbc = dmi_check_system(toshiba_dmi_table); + broken_olpc_ec = dmi_check_system(olpc_dmi_table); ++ ++ min_max_dmi = dmi_first_match(min_max_dmi_table); ++ if (min_max_dmi) ++ quirk_min_max = min_max_dmi->driver_data; + } + + static int __synaptics_init(struct psmouse *psmouse, bool absolute_mode) +diff --git a/drivers/input/mousedev.c b/drivers/input/mousedev.c +index 4c842c320c2e..b604564dec5c 100644 +--- a/drivers/input/mousedev.c ++++ b/drivers/input/mousedev.c +@@ -67,7 +67,6 @@ struct mousedev { + struct device dev; + struct cdev cdev; + bool exist; +- bool is_mixdev; + + struct list_head mixdev_node; + bool opened_by_mixdev; +@@ -77,6 +76,9 @@ struct mousedev { + int old_x[4], old_y[4]; + int frac_dx, frac_dy; + unsigned long touch; ++ ++ int (*open_device)(struct mousedev *mousedev); ++ void (*close_device)(struct mousedev *mousedev); + }; + + enum mousedev_emul { +@@ -116,9 +118,6 @@ static unsigned char mousedev_imex_seq[] = { 0xf3, 200, 0xf3, 200, 0xf3, 80 }; + static struct mousedev *mousedev_mix; + static LIST_HEAD(mousedev_mix_list); + +-static void mixdev_open_devices(void); +-static void mixdev_close_devices(void); +- + #define fx(i) (mousedev->old_x[(mousedev->pkt_count - (i)) & 03]) + #define fy(i) (mousedev->old_y[(mousedev->pkt_count - (i)) & 03]) + +@@ -428,9 +427,7 @@ static int mousedev_open_device(struct mousedev *mousedev) + if (retval) + return retval; + +- if (mousedev->is_mixdev) +- mixdev_open_devices(); +- else if (!mousedev->exist) ++ if (!mousedev->exist) + retval = -ENODEV; + else if (!mousedev->open++) { + retval = input_open_device(&mousedev->handle); +@@ -446,9 +443,7 @@ static void mousedev_close_device(struct mousedev *mousedev) + { + mutex_lock(&mousedev->mutex); + +- if (mousedev->is_mixdev) +- mixdev_close_devices(); +- else if (mousedev->exist && !--mousedev->open) ++ if (mousedev->exist && !--mousedev->open) + input_close_device(&mousedev->handle); + + mutex_unlock(&mousedev->mutex); +@@ -459,21 +454,29 @@ static void mousedev_close_device(struct mousedev *mousedev) + * stream. Note that this function is called with mousedev_mix->mutex + * held. + */ +-static void mixdev_open_devices(void) ++static int mixdev_open_devices(struct mousedev *mixdev) + { +- struct mousedev *mousedev; ++ int error; ++ ++ error = mutex_lock_interruptible(&mixdev->mutex); ++ if (error) ++ return error; + +- if (mousedev_mix->open++) +- return; ++ if (!mixdev->open++) { ++ struct mousedev *mousedev; + +- list_for_each_entry(mousedev, &mousedev_mix_list, mixdev_node) { +- if (!mousedev->opened_by_mixdev) { +- if (mousedev_open_device(mousedev)) +- continue; ++ list_for_each_entry(mousedev, &mousedev_mix_list, mixdev_node) { ++ if (!mousedev->opened_by_mixdev) { ++ if (mousedev_open_device(mousedev)) ++ continue; + +- mousedev->opened_by_mixdev = true; ++ mousedev->opened_by_mixdev = true; ++ } + } + } ++ ++ mutex_unlock(&mixdev->mutex); ++ return 0; + } + + /* +@@ -481,19 +484,22 @@ static void mixdev_open_devices(void) + * device. Note that this function is called with mousedev_mix->mutex + * held. + */ +-static void mixdev_close_devices(void) ++static void mixdev_close_devices(struct mousedev *mixdev) + { +- struct mousedev *mousedev; ++ mutex_lock(&mixdev->mutex); + +- if (--mousedev_mix->open) +- return; ++ if (!--mixdev->open) { ++ struct mousedev *mousedev; + +- list_for_each_entry(mousedev, &mousedev_mix_list, mixdev_node) { +- if (mousedev->opened_by_mixdev) { +- mousedev->opened_by_mixdev = false; +- mousedev_close_device(mousedev); ++ list_for_each_entry(mousedev, &mousedev_mix_list, mixdev_node) { ++ if (mousedev->opened_by_mixdev) { ++ mousedev->opened_by_mixdev = false; ++ mousedev_close_device(mousedev); ++ } + } + } ++ ++ mutex_unlock(&mixdev->mutex); + } + + +@@ -522,7 +528,7 @@ static int mousedev_release(struct inode *inode, struct file *file) + mousedev_detach_client(mousedev, client); + kfree(client); + +- mousedev_close_device(mousedev); ++ mousedev->close_device(mousedev); + + return 0; + } +@@ -550,7 +556,7 @@ static int mousedev_open(struct inode *inode, struct file *file) + client->mousedev = mousedev; + mousedev_attach_client(mousedev, client); + +- error = mousedev_open_device(mousedev); ++ error = mousedev->open_device(mousedev); + if (error) + goto err_free_client; + +@@ -861,16 +867,21 @@ static struct mousedev *mousedev_create(struct input_dev *dev, + + if (mixdev) { + dev_set_name(&mousedev->dev, "mice"); ++ ++ mousedev->open_device = mixdev_open_devices; ++ mousedev->close_device = mixdev_close_devices; + } else { + int dev_no = minor; + /* Normalize device number if it falls into legacy range */ + if (dev_no < MOUSEDEV_MINOR_BASE + MOUSEDEV_MINORS) + dev_no -= MOUSEDEV_MINOR_BASE; + dev_set_name(&mousedev->dev, "mouse%d", dev_no); ++ ++ mousedev->open_device = mousedev_open_device; ++ mousedev->close_device = mousedev_close_device; + } + + mousedev->exist = true; +- mousedev->is_mixdev = mixdev; + mousedev->handle.dev = input_get_device(dev); + mousedev->handle.name = dev_name(&mousedev->dev); + mousedev->handle.handler = handler; +@@ -919,7 +930,7 @@ static void mousedev_destroy(struct mousedev *mousedev) + device_del(&mousedev->dev); + mousedev_cleanup(mousedev); + input_free_minor(MINOR(mousedev->dev.devt)); +- if (!mousedev->is_mixdev) ++ if (mousedev != mousedev_mix) + input_unregister_handle(&mousedev->handle); + put_device(&mousedev->dev); + } +diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c +index 254f255204f9..a602aeeb3acb 100644 +--- a/drivers/net/ethernet/marvell/mvneta.c ++++ b/drivers/net/ethernet/marvell/mvneta.c +@@ -119,7 +119,7 @@ + #define MVNETA_GMAC_MAX_RX_SIZE_MASK 0x7ffc + #define MVNETA_GMAC0_PORT_ENABLE BIT(0) + #define MVNETA_GMAC_CTRL_2 0x2c08 +-#define MVNETA_GMAC2_PSC_ENABLE BIT(3) ++#define MVNETA_GMAC2_PCS_ENABLE BIT(3) + #define MVNETA_GMAC2_PORT_RGMII BIT(4) + #define MVNETA_GMAC2_PORT_RESET BIT(6) + #define MVNETA_GMAC_STATUS 0x2c10 +@@ -655,7 +655,7 @@ static void mvneta_port_sgmii_config(struct mvneta_port *pp) + u32 val; + + val = mvreg_read(pp, MVNETA_GMAC_CTRL_2); +- val |= MVNETA_GMAC2_PSC_ENABLE; ++ val |= MVNETA_GMAC2_PCS_ENABLE; + mvreg_write(pp, MVNETA_GMAC_CTRL_2, val); + } + +diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c +index 6f3fbc48a6c7..22080eb6aff6 100644 +--- a/drivers/vfio/vfio_iommu_type1.c ++++ b/drivers/vfio/vfio_iommu_type1.c +@@ -138,12 +138,12 @@ static bool is_invalid_reserved_pfn(unsigned long pfn) + if (pfn_valid(pfn)) { + bool reserved; + struct page *tail = pfn_to_page(pfn); +- struct page *head = compound_trans_head(tail); ++ struct page *head = compound_head(tail); + reserved = !!(PageReserved(head)); + if (head != tail) { + /* + * "head" is not a dangling pointer +- * (compound_trans_head takes care of that) ++ * (compound_head takes care of that) + * but the hugepage may have been split + * from under us (and we may not hold a + * reference count on the head page so it can +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index 21dff8f236f6..f9e11df768d5 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -38,6 +38,7 @@ + #include + #include + #include ++#include + + #include "ext4_jbd2.h" + #include "xattr.h" +@@ -4044,18 +4045,20 @@ int ext4_get_inode_loc(struct inode *inode, struct ext4_iloc *iloc) + void ext4_set_inode_flags(struct inode *inode) + { + unsigned int flags = EXT4_I(inode)->i_flags; ++ unsigned int new_fl = 0; + +- inode->i_flags &= ~(S_SYNC|S_APPEND|S_IMMUTABLE|S_NOATIME|S_DIRSYNC); + if (flags & EXT4_SYNC_FL) +- inode->i_flags |= S_SYNC; ++ new_fl |= S_SYNC; + if (flags & EXT4_APPEND_FL) +- inode->i_flags |= S_APPEND; ++ new_fl |= S_APPEND; + if (flags & EXT4_IMMUTABLE_FL) +- inode->i_flags |= S_IMMUTABLE; ++ new_fl |= S_IMMUTABLE; + if (flags & EXT4_NOATIME_FL) +- inode->i_flags |= S_NOATIME; ++ new_fl |= S_NOATIME; + if (flags & EXT4_DIRSYNC_FL) +- inode->i_flags |= S_DIRSYNC; ++ new_fl |= S_DIRSYNC; ++ set_mask_bits(&inode->i_flags, ++ S_SYNC|S_APPEND|S_IMMUTABLE|S_NOATIME|S_DIRSYNC, new_fl); + } + + /* Propagate flags from i_flags to EXT4_I(inode)->i_flags */ +diff --git a/fs/proc/page.c b/fs/proc/page.c +index b8730d9ebaee..2a8cc94bb641 100644 +--- a/fs/proc/page.c ++++ b/fs/proc/page.c +@@ -121,7 +121,7 @@ u64 stable_page_flags(struct page *page) + * just checks PG_head/PG_tail, so we need to check PageLRU to make + * sure a given page is a thp, not a non-huge compound page. + */ +- else if (PageTransCompound(page) && PageLRU(compound_trans_head(page))) ++ else if (PageTransCompound(page) && PageLRU(compound_head(page))) + u |= 1 << KPF_THP; + + /* +diff --git a/include/linux/bitops.h b/include/linux/bitops.h +index a3b6b82108b9..c1dde8e00d25 100644 +--- a/include/linux/bitops.h ++++ b/include/linux/bitops.h +@@ -185,6 +185,21 @@ static inline unsigned long __ffs64(u64 word) + + #ifdef __KERNEL__ + ++#ifndef set_mask_bits ++#define set_mask_bits(ptr, _mask, _bits) \ ++({ \ ++ const typeof(*ptr) mask = (_mask), bits = (_bits); \ ++ typeof(*ptr) old, new; \ ++ \ ++ do { \ ++ old = ACCESS_ONCE(*ptr); \ ++ new = (old & ~mask) | bits; \ ++ } while (cmpxchg(ptr, old, new) != old); \ ++ \ ++ new; \ ++}) ++#endif ++ + #ifndef find_last_bit + /** + * find_last_bit - find the last set bit in a memory region +diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h +index 528454c2caa9..a193bb3e4138 100644 +--- a/include/linux/huge_mm.h ++++ b/include/linux/huge_mm.h +@@ -159,23 +159,6 @@ static inline int hpage_nr_pages(struct page *page) + return HPAGE_PMD_NR; + return 1; + } +-static inline struct page *compound_trans_head(struct page *page) +-{ +- if (PageTail(page)) { +- struct page *head; +- head = page->first_page; +- smp_rmb(); +- /* +- * head may be a dangling pointer. +- * __split_huge_page_refcount clears PageTail before +- * overwriting first_page, so if PageTail is still +- * there it means the head pointer isn't dangling. +- */ +- if (PageTail(page)) +- return head; +- } +- return page; +-} + + extern int do_huge_pmd_numa_page(struct mm_struct *mm, struct vm_area_struct *vma, + unsigned long addr, pmd_t pmd, pmd_t *pmdp); +@@ -205,7 +188,6 @@ static inline int split_huge_page(struct page *page) + do { } while (0) + #define split_huge_page_pmd_mm(__mm, __address, __pmd) \ + do { } while (0) +-#define compound_trans_head(page) compound_head(page) + static inline int hugepage_madvise(struct vm_area_struct *vma, + unsigned long *vm_flags, int advice) + { +diff --git a/include/linux/mm.h b/include/linux/mm.h +index 3bf21c3502d0..a9a48309f045 100644 +--- a/include/linux/mm.h ++++ b/include/linux/mm.h +@@ -361,8 +361,18 @@ static inline void compound_unlock_irqrestore(struct page *page, + + static inline struct page *compound_head(struct page *page) + { +- if (unlikely(PageTail(page))) +- return page->first_page; ++ if (unlikely(PageTail(page))) { ++ struct page *head = page->first_page; ++ ++ /* ++ * page->first_page may be a dangling pointer to an old ++ * compound page, so recheck that it is still a tail ++ * page before returning. ++ */ ++ smp_rmb(); ++ if (likely(PageTail(page))) ++ return head; ++ } + return page; + } + +diff --git a/mm/ksm.c b/mm/ksm.c +index b6afe0c440d8..784d1e4bc385 100644 +--- a/mm/ksm.c ++++ b/mm/ksm.c +@@ -444,7 +444,7 @@ static void break_cow(struct rmap_item *rmap_item) + static struct page *page_trans_compound_anon(struct page *page) + { + if (PageTransCompound(page)) { +- struct page *head = compound_trans_head(page); ++ struct page *head = compound_head(page); + /* + * head may actually be splitted and freed from under + * us but it's ok here. +diff --git a/mm/memory-failure.c b/mm/memory-failure.c +index e386beefc994..59c62fa75c5a 100644 +--- a/mm/memory-failure.c ++++ b/mm/memory-failure.c +@@ -1544,7 +1544,7 @@ int soft_offline_page(struct page *page, int flags) + { + int ret; + unsigned long pfn = page_to_pfn(page); +- struct page *hpage = compound_trans_head(page); ++ struct page *hpage = compound_head(page); + + if (PageHWPoison(page)) { + pr_info("soft offline: %#lx page already poisoned\n", pfn); +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index 2ee0fd313f03..0ab02fb8e9b1 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -360,9 +360,11 @@ void prep_compound_page(struct page *page, unsigned long order) + __SetPageHead(page); + for (i = 1; i < nr_pages; i++) { + struct page *p = page + i; +- __SetPageTail(p); + set_page_count(p, 0); + p->first_page = page; ++ /* Make sure p->first_page is always valid for PageTail() */ ++ smp_wmb(); ++ __SetPageTail(p); + } + } + +diff --git a/mm/swap.c b/mm/swap.c +index ea58dbde788e..4e35f3ff0427 100644 +--- a/mm/swap.c ++++ b/mm/swap.c +@@ -81,7 +81,7 @@ static void put_compound_page(struct page *page) + { + if (unlikely(PageTail(page))) { + /* __split_huge_page_refcount can run under us */ +- struct page *page_head = compound_trans_head(page); ++ struct page *page_head = compound_head(page); + + if (likely(page != page_head && + get_page_unless_zero(page_head))) { +@@ -219,7 +219,7 @@ bool __get_page_tail(struct page *page) + */ + unsigned long flags; + bool got = false; +- struct page *page_head = compound_trans_head(page); ++ struct page *page_head = compound_head(page); + + if (likely(page != page_head && get_page_unless_zero(page_head))) { + /* Ref to put_compound_page() comment. */ +diff --git a/net/netfilter/nf_conntrack_proto_dccp.c b/net/netfilter/nf_conntrack_proto_dccp.c +index a99b6c3427b0..59359bec328a 100644 +--- a/net/netfilter/nf_conntrack_proto_dccp.c ++++ b/net/netfilter/nf_conntrack_proto_dccp.c +@@ -428,7 +428,7 @@ static bool dccp_new(struct nf_conn *ct, const struct sk_buff *skb, + const char *msg; + u_int8_t state; + +- dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &dh); ++ dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh); + BUG_ON(dh == NULL); + + state = dccp_state_table[CT_DCCP_ROLE_CLIENT][dh->dccph_type][CT_DCCP_NONE]; +@@ -486,7 +486,7 @@ static int dccp_packet(struct nf_conn *ct, const struct sk_buff *skb, + u_int8_t type, old_state, new_state; + enum ct_dccp_roles role; + +- dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &dh); ++ dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh); + BUG_ON(dh == NULL); + type = dh->dccph_type; + +@@ -577,7 +577,7 @@ static int dccp_error(struct net *net, struct nf_conn *tmpl, + unsigned int cscov; + const char *msg; + +- dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &dh); ++ dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh); + if (dh == NULL) { + msg = "nf_ct_dccp: short packet "; + goto out_invalid; +diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c +index eb99458f5b68..8cf1cd2fadaa 100644 +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -105,12 +105,12 @@ bool kvm_is_mmio_pfn(pfn_t pfn) + if (pfn_valid(pfn)) { + int reserved; + struct page *tail = pfn_to_page(pfn); +- struct page *head = compound_trans_head(tail); ++ struct page *head = compound_head(tail); + reserved = PageReserved(head); + if (head != tail) { + /* + * "head" is not a dangling pointer +- * (compound_trans_head takes care of that) ++ * (compound_head takes care of that) + * but the hugepage may have been splitted + * from under us (and we may not hold a + * reference count on the head page so it can diff --git a/projects/Cuboxi/patches/linux/linux-000-patch-3.10.36-37.patch b/projects/Cuboxi/patches/linux/linux-000-patch-3.10.36-37.patch new file mode 100644 index 0000000000..945f9839c4 --- /dev/null +++ b/projects/Cuboxi/patches/linux/linux-000-patch-3.10.36-37.patch @@ -0,0 +1,1555 @@ +diff --git a/Makefile b/Makefile +index b5f4ef30f6e6..bd9fb5b72fc0 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 10 +-SUBLEVEL = 36 ++SUBLEVEL = 37 + EXTRAVERSION = + NAME = TOSSUG Baby Fish + +diff --git a/arch/arc/boot/dts/nsimosci.dts b/arch/arc/boot/dts/nsimosci.dts +index ea16d782af58..4f31b2eb5cdf 100644 +--- a/arch/arc/boot/dts/nsimosci.dts ++++ b/arch/arc/boot/dts/nsimosci.dts +@@ -11,13 +11,16 @@ + + / { + compatible = "snps,nsimosci"; +- clock-frequency = <80000000>; /* 80 MHZ */ ++ clock-frequency = <20000000>; /* 20 MHZ */ + #address-cells = <1>; + #size-cells = <1>; + interrupt-parent = <&intc>; + + chosen { +- bootargs = "console=tty0 consoleblank=0"; ++ /* this is for console on PGU */ ++ /* bootargs = "console=tty0 consoleblank=0"; */ ++ /* this is for console on serial */ ++ bootargs = "earlycon=uart8250,mmio32,0xc0000000,115200n8 console=ttyS0,115200n8 consoleblank=0 debug"; + }; + + aliases { +@@ -44,15 +47,14 @@ + }; + + uart0: serial@c0000000 { +- compatible = "snps,dw-apb-uart"; ++ compatible = "ns8250"; + reg = <0xc0000000 0x2000>; + interrupts = <11>; +- #clock-frequency = <80000000>; + clock-frequency = <3686400>; + baud = <115200>; + reg-shift = <2>; + reg-io-width = <4>; +- status = "okay"; ++ no-loopback-test = <1>; + }; + + pgu0: pgu@c9000000 { +diff --git a/arch/arc/configs/nsimosci_defconfig b/arch/arc/configs/nsimosci_defconfig +index 446c96c24eff..00788e741ce7 100644 +--- a/arch/arc/configs/nsimosci_defconfig ++++ b/arch/arc/configs/nsimosci_defconfig +@@ -54,6 +54,7 @@ CONFIG_SERIO_ARC_PS2=y + CONFIG_SERIAL_8250=y + CONFIG_SERIAL_8250_CONSOLE=y + CONFIG_SERIAL_8250_DW=y ++CONFIG_SERIAL_OF_PLATFORM=y + CONFIG_SERIAL_ARC=y + CONFIG_SERIAL_ARC_CONSOLE=y + # CONFIG_HW_RANDOM is not set +diff --git a/arch/m68k/Kconfig b/arch/m68k/Kconfig +index 821170e5f6ed..b969eea4e237 100644 +--- a/arch/m68k/Kconfig ++++ b/arch/m68k/Kconfig +@@ -16,6 +16,7 @@ config M68K + select FPU if MMU + select ARCH_WANT_IPC_PARSE_VERSION + select ARCH_USES_GETTIMEOFFSET if MMU && !COLDFIRE ++ select HAVE_FUTEX_CMPXCHG if MMU && FUTEX + select HAVE_MOD_ARCH_SPECIFIC + select MODULES_USE_ELF_REL + select MODULES_USE_ELF_RELA +diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig +index 97dcbea97a1c..d8d6eeca56b0 100644 +--- a/arch/s390/Kconfig ++++ b/arch/s390/Kconfig +@@ -116,6 +116,7 @@ config S390 + select HAVE_FUNCTION_GRAPH_TRACER + select HAVE_FUNCTION_TRACER + select HAVE_FUNCTION_TRACE_MCOUNT_TEST ++ select HAVE_FUTEX_CMPXCHG if FUTEX + select HAVE_KERNEL_BZIP2 + select HAVE_KERNEL_GZIP + select HAVE_KERNEL_LZMA +diff --git a/arch/x86/crypto/ghash-clmulni-intel_asm.S b/arch/x86/crypto/ghash-clmulni-intel_asm.S +index 586f41aac361..185fad49d86f 100644 +--- a/arch/x86/crypto/ghash-clmulni-intel_asm.S ++++ b/arch/x86/crypto/ghash-clmulni-intel_asm.S +@@ -24,10 +24,6 @@ + .align 16 + .Lbswap_mask: + .octa 0x000102030405060708090a0b0c0d0e0f +-.Lpoly: +- .octa 0xc2000000000000000000000000000001 +-.Ltwo_one: +- .octa 0x00000001000000000000000000000001 + + #define DATA %xmm0 + #define SHASH %xmm1 +@@ -134,28 +130,3 @@ ENTRY(clmul_ghash_update) + .Lupdate_just_ret: + ret + ENDPROC(clmul_ghash_update) +- +-/* +- * void clmul_ghash_setkey(be128 *shash, const u8 *key); +- * +- * Calculate hash_key << 1 mod poly +- */ +-ENTRY(clmul_ghash_setkey) +- movaps .Lbswap_mask, BSWAP +- movups (%rsi), %xmm0 +- PSHUFB_XMM BSWAP %xmm0 +- movaps %xmm0, %xmm1 +- psllq $1, %xmm0 +- psrlq $63, %xmm1 +- movaps %xmm1, %xmm2 +- pslldq $8, %xmm1 +- psrldq $8, %xmm2 +- por %xmm1, %xmm0 +- # reduction +- pshufd $0b00100100, %xmm2, %xmm1 +- pcmpeqd .Ltwo_one, %xmm1 +- pand .Lpoly, %xmm1 +- pxor %xmm1, %xmm0 +- movups %xmm0, (%rdi) +- ret +-ENDPROC(clmul_ghash_setkey) +diff --git a/arch/x86/crypto/ghash-clmulni-intel_glue.c b/arch/x86/crypto/ghash-clmulni-intel_glue.c +index 6759dd1135be..d785cf2c529c 100644 +--- a/arch/x86/crypto/ghash-clmulni-intel_glue.c ++++ b/arch/x86/crypto/ghash-clmulni-intel_glue.c +@@ -30,8 +30,6 @@ void clmul_ghash_mul(char *dst, const be128 *shash); + void clmul_ghash_update(char *dst, const char *src, unsigned int srclen, + const be128 *shash); + +-void clmul_ghash_setkey(be128 *shash, const u8 *key); +- + struct ghash_async_ctx { + struct cryptd_ahash *cryptd_tfm; + }; +@@ -58,13 +56,23 @@ static int ghash_setkey(struct crypto_shash *tfm, + const u8 *key, unsigned int keylen) + { + struct ghash_ctx *ctx = crypto_shash_ctx(tfm); ++ be128 *x = (be128 *)key; ++ u64 a, b; + + if (keylen != GHASH_BLOCK_SIZE) { + crypto_shash_set_flags(tfm, CRYPTO_TFM_RES_BAD_KEY_LEN); + return -EINVAL; + } + +- clmul_ghash_setkey(&ctx->shash, key); ++ /* perform multiplication by 'x' in GF(2^128) */ ++ a = be64_to_cpu(x->a); ++ b = be64_to_cpu(x->b); ++ ++ ctx->shash.a = (__be64)((b << 1) | (a >> 63)); ++ ctx->shash.b = (__be64)((a << 1) | (b >> 63)); ++ ++ if (a >> 63) ++ ctx->shash.b ^= cpu_to_be64(0xc2); + + return 0; + } +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index 648554742a99..66f6cf5064ec 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -46,6 +46,7 @@ static DEFINE_PER_CPU(struct cpufreq_policy *, cpufreq_cpu_data); + static DEFINE_PER_CPU(char[CPUFREQ_NAME_LEN], cpufreq_cpu_governor); + #endif + static DEFINE_RWLOCK(cpufreq_driver_lock); ++static DEFINE_MUTEX(cpufreq_governor_lock); + + /* + * cpu_policy_rwsem is a per CPU reader-writer semaphore designed to cure +@@ -1563,6 +1564,21 @@ static int __cpufreq_governor(struct cpufreq_policy *policy, + + pr_debug("__cpufreq_governor for CPU %u, event %u\n", + policy->cpu, event); ++ ++ mutex_lock(&cpufreq_governor_lock); ++ if ((!policy->governor_enabled && (event == CPUFREQ_GOV_STOP)) || ++ (policy->governor_enabled && (event == CPUFREQ_GOV_START))) { ++ mutex_unlock(&cpufreq_governor_lock); ++ return -EBUSY; ++ } ++ ++ if (event == CPUFREQ_GOV_STOP) ++ policy->governor_enabled = false; ++ else if (event == CPUFREQ_GOV_START) ++ policy->governor_enabled = true; ++ ++ mutex_unlock(&cpufreq_governor_lock); ++ + ret = policy->governor->governor(policy, event); + + if (!ret) { +@@ -1570,6 +1586,14 @@ static int __cpufreq_governor(struct cpufreq_policy *policy, + policy->governor->initialized++; + else if (event == CPUFREQ_GOV_POLICY_EXIT) + policy->governor->initialized--; ++ } else { ++ /* Restore original values */ ++ mutex_lock(&cpufreq_governor_lock); ++ if (event == CPUFREQ_GOV_STOP) ++ policy->governor_enabled = true; ++ else if (event == CPUFREQ_GOV_START) ++ policy->governor_enabled = false; ++ mutex_unlock(&cpufreq_governor_lock); + } + + /* we keep one module reference alive for +diff --git a/drivers/cpufreq/cpufreq_governor.c b/drivers/cpufreq/cpufreq_governor.c +index a86ff72141f3..28a0b32c73b3 100644 +--- a/drivers/cpufreq/cpufreq_governor.c ++++ b/drivers/cpufreq/cpufreq_governor.c +@@ -177,6 +177,9 @@ void gov_queue_work(struct dbs_data *dbs_data, struct cpufreq_policy *policy, + { + int i; + ++ if (!policy->governor_enabled) ++ return; ++ + if (!all_cpus) { + __gov_queue_work(smp_processor_id(), dbs_data, delay); + } else { +diff --git a/drivers/cpufreq/powernow-k6.c b/drivers/cpufreq/powernow-k6.c +index ea0222a45b7b..b07ca0d3f56a 100644 +--- a/drivers/cpufreq/powernow-k6.c ++++ b/drivers/cpufreq/powernow-k6.c +@@ -26,41 +26,108 @@ + static unsigned int busfreq; /* FSB, in 10 kHz */ + static unsigned int max_multiplier; + ++static unsigned int param_busfreq = 0; ++static unsigned int param_max_multiplier = 0; ++ ++module_param_named(max_multiplier, param_max_multiplier, uint, S_IRUGO); ++MODULE_PARM_DESC(max_multiplier, "Maximum multiplier (allowed values: 20 30 35 40 45 50 55 60)"); ++ ++module_param_named(bus_frequency, param_busfreq, uint, S_IRUGO); ++MODULE_PARM_DESC(bus_frequency, "Bus frequency in kHz"); + + /* Clock ratio multiplied by 10 - see table 27 in AMD#23446 */ + static struct cpufreq_frequency_table clock_ratio[] = { +- {45, /* 000 -> 4.5x */ 0}, ++ {60, /* 110 -> 6.0x */ 0}, ++ {55, /* 011 -> 5.5x */ 0}, + {50, /* 001 -> 5.0x */ 0}, ++ {45, /* 000 -> 4.5x */ 0}, + {40, /* 010 -> 4.0x */ 0}, +- {55, /* 011 -> 5.5x */ 0}, +- {20, /* 100 -> 2.0x */ 0}, +- {30, /* 101 -> 3.0x */ 0}, +- {60, /* 110 -> 6.0x */ 0}, + {35, /* 111 -> 3.5x */ 0}, ++ {30, /* 101 -> 3.0x */ 0}, ++ {20, /* 100 -> 2.0x */ 0}, + {0, CPUFREQ_TABLE_END} + }; + ++static const u8 index_to_register[8] = { 6, 3, 1, 0, 2, 7, 5, 4 }; ++static const u8 register_to_index[8] = { 3, 2, 4, 1, 7, 6, 0, 5 }; ++ ++static const struct { ++ unsigned freq; ++ unsigned mult; ++} usual_frequency_table[] = { ++ { 400000, 40 }, // 100 * 4 ++ { 450000, 45 }, // 100 * 4.5 ++ { 475000, 50 }, // 95 * 5 ++ { 500000, 50 }, // 100 * 5 ++ { 506250, 45 }, // 112.5 * 4.5 ++ { 533500, 55 }, // 97 * 5.5 ++ { 550000, 55 }, // 100 * 5.5 ++ { 562500, 50 }, // 112.5 * 5 ++ { 570000, 60 }, // 95 * 6 ++ { 600000, 60 }, // 100 * 6 ++ { 618750, 55 }, // 112.5 * 5.5 ++ { 660000, 55 }, // 120 * 5.5 ++ { 675000, 60 }, // 112.5 * 6 ++ { 720000, 60 }, // 120 * 6 ++}; ++ ++#define FREQ_RANGE 3000 + + /** + * powernow_k6_get_cpu_multiplier - returns the current FSB multiplier + * +- * Returns the current setting of the frequency multiplier. Core clock ++ * Returns the current setting of the frequency multiplier. Core clock + * speed is frequency of the Front-Side Bus multiplied with this value. + */ + static int powernow_k6_get_cpu_multiplier(void) + { +- u64 invalue = 0; ++ unsigned long invalue = 0; + u32 msrval; + ++ local_irq_disable(); ++ + msrval = POWERNOW_IOPORT + 0x1; + wrmsr(MSR_K6_EPMR, msrval, 0); /* enable the PowerNow port */ + invalue = inl(POWERNOW_IOPORT + 0x8); + msrval = POWERNOW_IOPORT + 0x0; + wrmsr(MSR_K6_EPMR, msrval, 0); /* disable it again */ + +- return clock_ratio[(invalue >> 5)&7].index; ++ local_irq_enable(); ++ ++ return clock_ratio[register_to_index[(invalue >> 5)&7]].index; + } + ++static void powernow_k6_set_cpu_multiplier(unsigned int best_i) ++{ ++ unsigned long outvalue, invalue; ++ unsigned long msrval; ++ unsigned long cr0; ++ ++ /* we now need to transform best_i to the BVC format, see AMD#23446 */ ++ ++ /* ++ * The processor doesn't respond to inquiry cycles while changing the ++ * frequency, so we must disable cache. ++ */ ++ local_irq_disable(); ++ cr0 = read_cr0(); ++ write_cr0(cr0 | X86_CR0_CD); ++ wbinvd(); ++ ++ outvalue = (1<<12) | (1<<10) | (1<<9) | (index_to_register[best_i]<<5); ++ ++ msrval = POWERNOW_IOPORT + 0x1; ++ wrmsr(MSR_K6_EPMR, msrval, 0); /* enable the PowerNow port */ ++ invalue = inl(POWERNOW_IOPORT + 0x8); ++ invalue = invalue & 0x1f; ++ outvalue = outvalue | invalue; ++ outl(outvalue, (POWERNOW_IOPORT + 0x8)); ++ msrval = POWERNOW_IOPORT + 0x0; ++ wrmsr(MSR_K6_EPMR, msrval, 0); /* disable it again */ ++ ++ write_cr0(cr0); ++ local_irq_enable(); ++} + + /** + * powernow_k6_set_state - set the PowerNow! multiplier +@@ -71,8 +138,6 @@ static int powernow_k6_get_cpu_multiplier(void) + static void powernow_k6_set_state(struct cpufreq_policy *policy, + unsigned int best_i) + { +- unsigned long outvalue = 0, invalue = 0; +- unsigned long msrval; + struct cpufreq_freqs freqs; + + if (clock_ratio[best_i].index > max_multiplier) { +@@ -85,18 +150,7 @@ static void powernow_k6_set_state(struct cpufreq_policy *policy, + + cpufreq_notify_transition(policy, &freqs, CPUFREQ_PRECHANGE); + +- /* we now need to transform best_i to the BVC format, see AMD#23446 */ +- +- outvalue = (1<<12) | (1<<10) | (1<<9) | (best_i<<5); +- +- msrval = POWERNOW_IOPORT + 0x1; +- wrmsr(MSR_K6_EPMR, msrval, 0); /* enable the PowerNow port */ +- invalue = inl(POWERNOW_IOPORT + 0x8); +- invalue = invalue & 0xf; +- outvalue = outvalue | invalue; +- outl(outvalue , (POWERNOW_IOPORT + 0x8)); +- msrval = POWERNOW_IOPORT + 0x0; +- wrmsr(MSR_K6_EPMR, msrval, 0); /* disable it again */ ++ powernow_k6_set_cpu_multiplier(best_i); + + cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE); + +@@ -141,18 +195,57 @@ static int powernow_k6_target(struct cpufreq_policy *policy, + return 0; + } + +- + static int powernow_k6_cpu_init(struct cpufreq_policy *policy) + { + unsigned int i, f; + int result; ++ unsigned khz; + + if (policy->cpu != 0) + return -ENODEV; + +- /* get frequencies */ +- max_multiplier = powernow_k6_get_cpu_multiplier(); +- busfreq = cpu_khz / max_multiplier; ++ max_multiplier = 0; ++ khz = cpu_khz; ++ for (i = 0; i < ARRAY_SIZE(usual_frequency_table); i++) { ++ if (khz >= usual_frequency_table[i].freq - FREQ_RANGE && ++ khz <= usual_frequency_table[i].freq + FREQ_RANGE) { ++ khz = usual_frequency_table[i].freq; ++ max_multiplier = usual_frequency_table[i].mult; ++ break; ++ } ++ } ++ if (param_max_multiplier) { ++ for (i = 0; (clock_ratio[i].frequency != CPUFREQ_TABLE_END); i++) { ++ if (clock_ratio[i].index == param_max_multiplier) { ++ max_multiplier = param_max_multiplier; ++ goto have_max_multiplier; ++ } ++ } ++ printk(KERN_ERR "powernow-k6: invalid max_multiplier parameter, valid parameters 20, 30, 35, 40, 45, 50, 55, 60\n"); ++ return -EINVAL; ++ } ++ ++ if (!max_multiplier) { ++ printk(KERN_WARNING "powernow-k6: unknown frequency %u, cannot determine current multiplier\n", khz); ++ printk(KERN_WARNING "powernow-k6: use module parameters max_multiplier and bus_frequency\n"); ++ return -EOPNOTSUPP; ++ } ++ ++have_max_multiplier: ++ param_max_multiplier = max_multiplier; ++ ++ if (param_busfreq) { ++ if (param_busfreq >= 50000 && param_busfreq <= 150000) { ++ busfreq = param_busfreq / 10; ++ goto have_busfreq; ++ } ++ printk(KERN_ERR "powernow-k6: invalid bus_frequency parameter, allowed range 50000 - 150000 kHz\n"); ++ return -EINVAL; ++ } ++ ++ busfreq = khz / max_multiplier; ++have_busfreq: ++ param_busfreq = busfreq * 10; + + /* table init */ + for (i = 0; (clock_ratio[i].frequency != CPUFREQ_TABLE_END); i++) { +@@ -164,7 +257,7 @@ static int powernow_k6_cpu_init(struct cpufreq_policy *policy) + } + + /* cpuinfo and default policy values */ +- policy->cpuinfo.transition_latency = 200000; ++ policy->cpuinfo.transition_latency = 500000; + policy->cur = busfreq * max_multiplier; + + result = cpufreq_frequency_table_cpuinfo(policy, clock_ratio); +diff --git a/drivers/cpuidle/driver.c b/drivers/cpuidle/driver.c +index 8dfaaae94444..2253271b3fac 100644 +--- a/drivers/cpuidle/driver.c ++++ b/drivers/cpuidle/driver.c +@@ -251,7 +251,8 @@ struct cpuidle_driver *cpuidle_driver_ref(void) + spin_lock(&cpuidle_driver_lock); + + drv = cpuidle_get_driver(); +- drv->refcnt++; ++ if (drv) ++ drv->refcnt++; + + spin_unlock(&cpuidle_driver_lock); + return drv; +diff --git a/drivers/isdn/isdnloop/isdnloop.c b/drivers/isdn/isdnloop/isdnloop.c +index 02125e6a9109..5a4da94aefb0 100644 +--- a/drivers/isdn/isdnloop/isdnloop.c ++++ b/drivers/isdn/isdnloop/isdnloop.c +@@ -518,9 +518,9 @@ static isdnloop_stat isdnloop_cmd_table[] = + static void + isdnloop_fake_err(isdnloop_card *card) + { +- char buf[60]; ++ char buf[64]; + +- sprintf(buf, "E%s", card->omsg); ++ snprintf(buf, sizeof(buf), "E%s", card->omsg); + isdnloop_fake(card, buf, -1); + isdnloop_fake(card, "NAK", -1); + } +@@ -903,6 +903,8 @@ isdnloop_parse_cmd(isdnloop_card *card) + case 7: + /* 0x;EAZ */ + p += 3; ++ if (strlen(p) >= sizeof(card->eazlist[0])) ++ break; + strcpy(card->eazlist[ch - 1], p); + break; + case 8: +@@ -1070,6 +1072,12 @@ isdnloop_start(isdnloop_card *card, isdnloop_sdef *sdefp) + return -EBUSY; + if (copy_from_user((char *) &sdef, (char *) sdefp, sizeof(sdef))) + return -EFAULT; ++ ++ for (i = 0; i < 3; i++) { ++ if (!memchr(sdef.num[i], 0, sizeof(sdef.num[i]))) ++ return -EINVAL; ++ } ++ + spin_lock_irqsave(&card->isdnloop_lock, flags); + switch (sdef.ptype) { + case ISDN_PTYPE_EURO: +@@ -1127,7 +1135,7 @@ isdnloop_command(isdn_ctrl *c, isdnloop_card *card) + { + ulong a; + int i; +- char cbuf[60]; ++ char cbuf[80]; + isdn_ctrl cmd; + isdnloop_cdef cdef; + +@@ -1192,7 +1200,6 @@ isdnloop_command(isdn_ctrl *c, isdnloop_card *card) + break; + if ((c->arg & 255) < ISDNLOOP_BCH) { + char *p; +- char dial[50]; + char dcode[4]; + + a = c->arg; +@@ -1204,10 +1211,10 @@ isdnloop_command(isdn_ctrl *c, isdnloop_card *card) + } else + /* Normal Dial */ + strcpy(dcode, "CAL"); +- strcpy(dial, p); +- sprintf(cbuf, "%02d;D%s_R%s,%02d,%02d,%s\n", (int) (a + 1), +- dcode, dial, c->parm.setup.si1, +- c->parm.setup.si2, c->parm.setup.eazmsn); ++ snprintf(cbuf, sizeof(cbuf), ++ "%02d;D%s_R%s,%02d,%02d,%s\n", (int) (a + 1), ++ dcode, p, c->parm.setup.si1, ++ c->parm.setup.si2, c->parm.setup.eazmsn); + i = isdnloop_writecmd(cbuf, strlen(cbuf), 0, card); + } + break; +diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c +index e27d5c839be5..4a0db617ab64 100644 +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -17308,8 +17308,6 @@ static int tg3_init_one(struct pci_dev *pdev, + + tg3_init_bufmgr_config(tp); + +- features |= NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_HW_VLAN_CTAG_RX; +- + /* 5700 B0 chips do not support checksumming correctly due + * to hardware bugs. + */ +@@ -17341,7 +17339,8 @@ static int tg3_init_one(struct pci_dev *pdev, + features |= NETIF_F_TSO_ECN; + } + +- dev->features |= features; ++ dev->features |= features | NETIF_F_HW_VLAN_CTAG_TX | ++ NETIF_F_HW_VLAN_CTAG_RX; + dev->vlan_features |= features; + + /* +diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c +index f6dce4765de4..3d50e7db141e 100644 +--- a/drivers/net/usb/usbnet.c ++++ b/drivers/net/usb/usbnet.c +@@ -727,14 +727,12 @@ EXPORT_SYMBOL_GPL(usbnet_unlink_rx_urbs); + // precondition: never called in_interrupt + static void usbnet_terminate_urbs(struct usbnet *dev) + { +- DECLARE_WAIT_QUEUE_HEAD_ONSTACK(unlink_wakeup); + DECLARE_WAITQUEUE(wait, current); + int temp; + + /* ensure there are no more active urbs */ +- add_wait_queue(&unlink_wakeup, &wait); ++ add_wait_queue(&dev->wait, &wait); + set_current_state(TASK_UNINTERRUPTIBLE); +- dev->wait = &unlink_wakeup; + temp = unlink_urbs(dev, &dev->txq) + + unlink_urbs(dev, &dev->rxq); + +@@ -748,15 +746,14 @@ static void usbnet_terminate_urbs(struct usbnet *dev) + "waited for %d urb completions\n", temp); + } + set_current_state(TASK_RUNNING); +- dev->wait = NULL; +- remove_wait_queue(&unlink_wakeup, &wait); ++ remove_wait_queue(&dev->wait, &wait); + } + + int usbnet_stop (struct net_device *net) + { + struct usbnet *dev = netdev_priv(net); + struct driver_info *info = dev->driver_info; +- int retval; ++ int retval, pm; + + clear_bit(EVENT_DEV_OPEN, &dev->flags); + netif_stop_queue (net); +@@ -766,6 +763,8 @@ int usbnet_stop (struct net_device *net) + net->stats.rx_packets, net->stats.tx_packets, + net->stats.rx_errors, net->stats.tx_errors); + ++ /* to not race resume */ ++ pm = usb_autopm_get_interface(dev->intf); + /* allow minidriver to stop correctly (wireless devices to turn off + * radio etc) */ + if (info->stop) { +@@ -792,6 +791,9 @@ int usbnet_stop (struct net_device *net) + dev->flags = 0; + del_timer_sync (&dev->delay); + tasklet_kill (&dev->bh); ++ if (!pm) ++ usb_autopm_put_interface(dev->intf); ++ + if (info->manage_power && + !test_and_clear_bit(EVENT_NO_RUNTIME_PM, &dev->flags)) + info->manage_power(dev, 0); +@@ -1360,11 +1362,12 @@ static void usbnet_bh (unsigned long param) + /* restart RX again after disabling due to high error rate */ + clear_bit(EVENT_RX_KILL, &dev->flags); + +- // waiting for all pending urbs to complete? +- if (dev->wait) { +- if ((dev->txq.qlen + dev->rxq.qlen + dev->done.qlen) == 0) { +- wake_up (dev->wait); +- } ++ /* waiting for all pending urbs to complete? ++ * only then can we forgo submitting anew ++ */ ++ if (waitqueue_active(&dev->wait)) { ++ if (dev->txq.qlen + dev->rxq.qlen + dev->done.qlen == 0) ++ wake_up_all(&dev->wait); + + // or are we maybe short a few urbs? + } else if (netif_running (dev->net) && +@@ -1502,6 +1505,7 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod) + dev->driver_name = name; + dev->msg_enable = netif_msg_init (msg_level, NETIF_MSG_DRV + | NETIF_MSG_PROBE | NETIF_MSG_LINK); ++ init_waitqueue_head(&dev->wait); + skb_queue_head_init (&dev->rxq); + skb_queue_head_init (&dev->txq); + skb_queue_head_init (&dev->done); +@@ -1694,9 +1698,10 @@ int usbnet_resume (struct usb_interface *intf) + spin_unlock_irq(&dev->txq.lock); + + if (test_bit(EVENT_DEV_OPEN, &dev->flags)) { +- /* handle remote wakeup ASAP */ +- if (!dev->wait && +- netif_device_present(dev->net) && ++ /* handle remote wakeup ASAP ++ * we cannot race against stop ++ */ ++ if (netif_device_present(dev->net) && + !timer_pending(&dev->delay) && + !test_bit(EVENT_RX_HALT, &dev->flags)) + rx_alloc_submit(dev, GFP_NOIO); +diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c +index 054489fdf54a..9673edfff451 100644 +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -845,6 +845,9 @@ static int arp_reduce(struct net_device *dev, struct sk_buff *skb) + + neigh_release(n); + ++ if (reply == NULL) ++ goto out; ++ + skb_reset_mac_header(reply); + __skb_pull(reply, skb_network_offset(reply)); + reply->ip_summed = CHECKSUM_UNNECESSARY; +diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c +index 36efb418c26f..70b830f6c4bf 100644 +--- a/drivers/net/xen-netback/netback.c ++++ b/drivers/net/xen-netback/netback.c +@@ -347,8 +347,8 @@ static bool start_new_rx_buffer(int offset, unsigned long size, int head) + * into multiple copies tend to give large frags their + * own buffers as before. + */ +- if ((offset + size > MAX_BUFFER_OFFSET) && +- (size <= MAX_BUFFER_OFFSET) && offset && !head) ++ BUG_ON(size > MAX_BUFFER_OFFSET); ++ if ((offset + size > MAX_BUFFER_OFFSET) && offset && !head) + return true; + + return false; +diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c +index d6a518ce4d6d..c7fdabd0e5d3 100644 +--- a/drivers/vhost/net.c ++++ b/drivers/vhost/net.c +@@ -513,9 +513,13 @@ static int get_rx_bufs(struct vhost_virtqueue *vq, + r = -ENOBUFS; + goto err; + } +- d = vhost_get_vq_desc(vq->dev, vq, vq->iov + seg, ++ r = vhost_get_vq_desc(vq->dev, vq, vq->iov + seg, + ARRAY_SIZE(vq->iov) - seg, &out, + &in, log, log_num); ++ if (unlikely(r < 0)) ++ goto err; ++ ++ d = r; + if (d == vq->num) { + r = 0; + goto err; +@@ -540,6 +544,12 @@ static int get_rx_bufs(struct vhost_virtqueue *vq, + *iovcount = seg; + if (unlikely(log)) + *log_num = nlogs; ++ ++ /* Detect overrun */ ++ if (unlikely(datalen > 0)) { ++ r = UIO_MAXIOV + 1; ++ goto err; ++ } + return headcount; + err: + vhost_discard_vq_desc(vq, headcount); +@@ -595,6 +605,14 @@ static void handle_rx(struct vhost_net *net) + /* On error, stop handling until the next kick. */ + if (unlikely(headcount < 0)) + break; ++ /* On overrun, truncate and discard */ ++ if (unlikely(headcount > UIO_MAXIOV)) { ++ msg.msg_iovlen = 1; ++ err = sock->ops->recvmsg(NULL, sock, &msg, ++ 1, MSG_DONTWAIT | MSG_TRUNC); ++ pr_debug("Discarded rx packet: len %zd\n", sock_len); ++ continue; ++ } + /* OK, now we need to know about added descriptors. */ + if (!headcount) { + if (unlikely(vhost_enable_notify(&net->dev, vq))) { +diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h +index 037d36ae63e5..1a81b7470bc4 100644 +--- a/include/linux/cpufreq.h ++++ b/include/linux/cpufreq.h +@@ -107,6 +107,7 @@ struct cpufreq_policy { + unsigned int policy; /* see above */ + struct cpufreq_governor *governor; /* see below */ + void *governor_data; ++ bool governor_enabled; /* governor start/stop flag */ + + struct work_struct update; /* if update_policy() needs to be + * called, but you're in IRQ context */ +diff --git a/include/linux/futex.h b/include/linux/futex.h +index b0d95cac826e..6435f46d6e13 100644 +--- a/include/linux/futex.h ++++ b/include/linux/futex.h +@@ -55,7 +55,11 @@ union futex_key { + #ifdef CONFIG_FUTEX + extern void exit_robust_list(struct task_struct *curr); + extern void exit_pi_state_list(struct task_struct *curr); ++#ifdef CONFIG_HAVE_FUTEX_CMPXCHG ++#define futex_cmpxchg_enabled 1 ++#else + extern int futex_cmpxchg_enabled; ++#endif + #else + static inline void exit_robust_list(struct task_struct *curr) + { +diff --git a/include/linux/usb/usbnet.h b/include/linux/usb/usbnet.h +index f18d64129f99..123b21bef1b4 100644 +--- a/include/linux/usb/usbnet.h ++++ b/include/linux/usb/usbnet.h +@@ -30,7 +30,7 @@ struct usbnet { + struct driver_info *driver_info; + const char *driver_name; + void *driver_priv; +- wait_queue_head_t *wait; ++ wait_queue_head_t wait; + struct mutex phy_mutex; + unsigned char suspend_count; + unsigned char pkt_cnt, pkt_err; +diff --git a/include/net/sock.h b/include/net/sock.h +index cec4c723db9a..8f32b779bc83 100644 +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -1437,6 +1437,11 @@ static inline void sk_wmem_free_skb(struct sock *sk, struct sk_buff *skb) + */ + #define sock_owned_by_user(sk) ((sk)->sk_lock.owned) + ++static inline void sock_release_ownership(struct sock *sk) ++{ ++ sk->sk_lock.owned = 0; ++} ++ + /* + * Macro so as to not evaluate some arguments when + * lockdep is not enabled. +diff --git a/init/Kconfig b/init/Kconfig +index 2d9b83104dcf..5d6febaea56d 100644 +--- a/init/Kconfig ++++ b/init/Kconfig +@@ -1365,6 +1365,13 @@ config FUTEX + support for "fast userspace mutexes". The resulting kernel may not + run glibc-based applications correctly. + ++config HAVE_FUTEX_CMPXCHG ++ bool ++ help ++ Architectures should select this if futex_atomic_cmpxchg_inatomic() ++ is implemented and always working. This removes a couple of runtime ++ checks. ++ + config EPOLL + bool "Enable eventpoll support" if EXPERT + default y +diff --git a/kernel/futex.c b/kernel/futex.c +index a283b3041072..3bc18bf48d0c 100644 +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -67,7 +67,9 @@ + + #include "rtmutex_common.h" + ++#ifndef CONFIG_HAVE_FUTEX_CMPXCHG + int __read_mostly futex_cmpxchg_enabled; ++#endif + + #define FUTEX_HASHBITS (CONFIG_BASE_SMALL ? 4 : 8) + +@@ -2729,10 +2731,10 @@ SYSCALL_DEFINE6(futex, u32 __user *, uaddr, int, op, u32, val, + return do_futex(uaddr, op, val, tp, uaddr2, val2, val3); + } + +-static int __init futex_init(void) ++static void __init futex_detect_cmpxchg(void) + { ++#ifndef CONFIG_HAVE_FUTEX_CMPXCHG + u32 curval; +- int i; + + /* + * This will fail and we want it. Some arch implementations do +@@ -2746,6 +2748,14 @@ static int __init futex_init(void) + */ + if (cmpxchg_futex_value_locked(&curval, NULL, 0, 0) == -EFAULT) + futex_cmpxchg_enabled = 1; ++#endif ++} ++ ++static int __init futex_init(void) ++{ ++ int i; ++ ++ futex_detect_cmpxchg(); + + for (i = 0; i < ARRAY_SIZE(futex_queues); i++) { + plist_head_init(&futex_queues[i].chain); +diff --git a/lib/nlattr.c b/lib/nlattr.c +index 18eca7809b08..fc6754720ced 100644 +--- a/lib/nlattr.c ++++ b/lib/nlattr.c +@@ -303,9 +303,15 @@ int nla_memcmp(const struct nlattr *nla, const void *data, + */ + int nla_strcmp(const struct nlattr *nla, const char *str) + { +- int len = strlen(str) + 1; +- int d = nla_len(nla) - len; ++ int len = strlen(str); ++ char *buf = nla_data(nla); ++ int attrlen = nla_len(nla); ++ int d; + ++ if (attrlen > 0 && buf[attrlen - 1] == '\0') ++ attrlen--; ++ ++ d = attrlen - len; + if (d == 0) + d = memcmp(nla_data(nla), str, len); + +diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c +index 9424f3718ea7..86abb2e59aea 100644 +--- a/net/8021q/vlan.c ++++ b/net/8021q/vlan.c +@@ -305,9 +305,11 @@ static void vlan_sync_address(struct net_device *dev, + static void vlan_transfer_features(struct net_device *dev, + struct net_device *vlandev) + { ++ struct vlan_dev_priv *vlan = vlan_dev_priv(vlandev); ++ + vlandev->gso_max_size = dev->gso_max_size; + +- if (dev->features & NETIF_F_HW_VLAN_CTAG_TX) ++ if (vlan_hw_offload_capable(dev->features, vlan->vlan_proto)) + vlandev->hard_header_len = dev->hard_header_len; + else + vlandev->hard_header_len = dev->hard_header_len + VLAN_HLEN; +diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c +index 4af64afc7022..cf35f383db4c 100644 +--- a/net/8021q/vlan_dev.c ++++ b/net/8021q/vlan_dev.c +@@ -557,6 +557,9 @@ static int vlan_passthru_hard_header(struct sk_buff *skb, struct net_device *dev + struct vlan_dev_priv *vlan = vlan_dev_priv(dev); + struct net_device *real_dev = vlan->real_dev; + ++ if (saddr == NULL) ++ saddr = dev->dev_addr; ++ + return dev_hard_header(skb, real_dev, type, daddr, saddr, len); + } + +@@ -608,7 +611,8 @@ static int vlan_dev_init(struct net_device *dev) + #endif + + dev->needed_headroom = real_dev->needed_headroom; +- if (real_dev->features & NETIF_F_HW_VLAN_CTAG_TX) { ++ if (vlan_hw_offload_capable(real_dev->features, ++ vlan_dev_priv(dev)->vlan_proto)) { + dev->header_ops = &vlan_passthru_header_ops; + dev->hard_header_len = real_dev->hard_header_len; + } else { +diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c +index 2a180a380181..81de0106528b 100644 +--- a/net/bridge/br_multicast.c ++++ b/net/bridge/br_multicast.c +@@ -1176,6 +1176,12 @@ static int br_ip6_multicast_query(struct net_bridge *br, + + br_multicast_query_received(br, port, !ipv6_addr_any(&ip6h->saddr)); + ++ /* RFC2710+RFC3810 (MLDv1+MLDv2) require link-local source addresses */ ++ if (!(ipv6_addr_type(&ip6h->saddr) & IPV6_ADDR_LINKLOCAL)) { ++ err = -EINVAL; ++ goto out; ++ } ++ + if (skb->len == sizeof(*mld)) { + if (!pskb_may_pull(skb, sizeof(*mld))) { + err = -EINVAL; +diff --git a/net/core/netpoll.c b/net/core/netpoll.c +index 433a1051d323..e861438d5454 100644 +--- a/net/core/netpoll.c ++++ b/net/core/netpoll.c +@@ -745,7 +745,7 @@ static bool pkt_is_ns(struct sk_buff *skb) + struct nd_msg *msg; + struct ipv6hdr *hdr; + +- if (skb->protocol != htons(ETH_P_ARP)) ++ if (skb->protocol != htons(ETH_P_IPV6)) + return false; + if (!pskb_may_pull(skb, sizeof(struct ipv6hdr) + sizeof(struct nd_msg))) + return false; +diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c +index fd01eca52a13..4c3087dffe78 100644 +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -1973,12 +1973,13 @@ EXPORT_SYMBOL(rtmsg_ifinfo); + static int nlmsg_populate_fdb_fill(struct sk_buff *skb, + struct net_device *dev, + u8 *addr, u32 pid, u32 seq, +- int type, unsigned int flags) ++ int type, unsigned int flags, ++ int nlflags) + { + struct nlmsghdr *nlh; + struct ndmsg *ndm; + +- nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), NLM_F_MULTI); ++ nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), nlflags); + if (!nlh) + return -EMSGSIZE; + +@@ -2016,7 +2017,7 @@ static void rtnl_fdb_notify(struct net_device *dev, u8 *addr, int type) + if (!skb) + goto errout; + +- err = nlmsg_populate_fdb_fill(skb, dev, addr, 0, 0, type, NTF_SELF); ++ err = nlmsg_populate_fdb_fill(skb, dev, addr, 0, 0, type, NTF_SELF, 0); + if (err < 0) { + kfree_skb(skb); + goto errout; +@@ -2249,7 +2250,8 @@ static int nlmsg_populate_fdb(struct sk_buff *skb, + + err = nlmsg_populate_fdb_fill(skb, dev, ha->addr, + portid, seq, +- RTM_NEWNEIGH, NTF_SELF); ++ RTM_NEWNEIGH, NTF_SELF, ++ NLM_F_MULTI); + if (err < 0) + return err; + skip: +diff --git a/net/core/sock.c b/net/core/sock.c +index 3ba527074f7f..d743099250f4 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -2309,10 +2309,13 @@ void release_sock(struct sock *sk) + if (sk->sk_backlog.tail) + __release_sock(sk); + ++ /* Warning : release_cb() might need to release sk ownership, ++ * ie call sock_release_ownership(sk) before us. ++ */ + if (sk->sk_prot->release_cb) + sk->sk_prot->release_cb(sk); + +- sk->sk_lock.owned = 0; ++ sock_release_ownership(sk); + if (waitqueue_active(&sk->sk_lock.wq)) + wake_up(&sk->sk_lock.wq); + spin_unlock_bh(&sk->sk_lock.slock); +diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c +index 7e06641e36ae..af02a39175e3 100644 +--- a/net/ipv4/inet_fragment.c ++++ b/net/ipv4/inet_fragment.c +@@ -211,7 +211,7 @@ int inet_frag_evictor(struct netns_frags *nf, struct inet_frags *f, bool force) + } + + work = frag_mem_limit(nf) - nf->low_thresh; +- while (work > 0) { ++ while (work > 0 || force) { + spin_lock(&nf->lru_lock); + + if (list_empty(&nf->lru_list)) { +@@ -283,9 +283,10 @@ static struct inet_frag_queue *inet_frag_intern(struct netns_frags *nf, + + atomic_inc(&qp->refcnt); + hlist_add_head(&qp->list, &hb->chain); ++ inet_frag_lru_add(nf, qp); + spin_unlock(&hb->chain_lock); + read_unlock(&f->lock); +- inet_frag_lru_add(nf, qp); ++ + return qp; + } + +diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c +index 7dbad6835843..49797ed0917c 100644 +--- a/net/ipv4/ipmr.c ++++ b/net/ipv4/ipmr.c +@@ -2255,13 +2255,14 @@ int ipmr_get_route(struct net *net, struct sk_buff *skb, + } + + static int ipmr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb, +- u32 portid, u32 seq, struct mfc_cache *c, int cmd) ++ u32 portid, u32 seq, struct mfc_cache *c, int cmd, ++ int flags) + { + struct nlmsghdr *nlh; + struct rtmsg *rtm; + int err; + +- nlh = nlmsg_put(skb, portid, seq, cmd, sizeof(*rtm), NLM_F_MULTI); ++ nlh = nlmsg_put(skb, portid, seq, cmd, sizeof(*rtm), flags); + if (nlh == NULL) + return -EMSGSIZE; + +@@ -2329,7 +2330,7 @@ static void mroute_netlink_event(struct mr_table *mrt, struct mfc_cache *mfc, + if (skb == NULL) + goto errout; + +- err = ipmr_fill_mroute(mrt, skb, 0, 0, mfc, cmd); ++ err = ipmr_fill_mroute(mrt, skb, 0, 0, mfc, cmd, 0); + if (err < 0) + goto errout; + +@@ -2368,7 +2369,8 @@ static int ipmr_rtm_dumproute(struct sk_buff *skb, struct netlink_callback *cb) + if (ipmr_fill_mroute(mrt, skb, + NETLINK_CB(cb->skb).portid, + cb->nlh->nlmsg_seq, +- mfc, RTM_NEWROUTE) < 0) ++ mfc, RTM_NEWROUTE, ++ NLM_F_MULTI) < 0) + goto done; + next_entry: + e++; +@@ -2382,7 +2384,8 @@ next_entry: + if (ipmr_fill_mroute(mrt, skb, + NETLINK_CB(cb->skb).portid, + cb->nlh->nlmsg_seq, +- mfc, RTM_NEWROUTE) < 0) { ++ mfc, RTM_NEWROUTE, ++ NLM_F_MULTI) < 0) { + spin_unlock_bh(&mfc_unres_lock); + goto done; + } +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 6da3d94a114b..4a4e8746d1b2 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -755,6 +755,17 @@ void tcp_release_cb(struct sock *sk) + if (flags & (1UL << TCP_TSQ_DEFERRED)) + tcp_tsq_handler(sk); + ++ /* Here begins the tricky part : ++ * We are called from release_sock() with : ++ * 1) BH disabled ++ * 2) sk_lock.slock spinlock held ++ * 3) socket owned by us (sk->sk_lock.owned == 1) ++ * ++ * But following code is meant to be called from BH handlers, ++ * so we should keep BH disabled, but early release socket ownership ++ */ ++ sock_release_ownership(sk); ++ + if (flags & (1UL << TCP_WRITE_TIMER_DEFERRED)) { + tcp_write_timer_handler(sk); + __sock_put(sk); +diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c +index b78a3ee93d52..7bcdd0df68db 100644 +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -1111,8 +1111,11 @@ retry: + * Lifetime is greater than REGEN_ADVANCE time units. In particular, + * an implementation must not create a temporary address with a zero + * Preferred Lifetime. ++ * Use age calculation as in addrconf_verify to avoid unnecessary ++ * temporary addresses being generated. + */ +- if (tmp_prefered_lft <= regen_advance) { ++ age = (now - tmp_tstamp + ADDRCONF_TIMER_FUZZ_MINUS) / HZ; ++ if (tmp_prefered_lft <= regen_advance + age) { + in6_ifa_put(ifp); + in6_dev_put(idev); + ret = -1; +diff --git a/net/ipv6/exthdrs_offload.c b/net/ipv6/exthdrs_offload.c +index cf77f3abfd06..447a7fbd1bb6 100644 +--- a/net/ipv6/exthdrs_offload.c ++++ b/net/ipv6/exthdrs_offload.c +@@ -25,11 +25,11 @@ int __init ipv6_exthdrs_offload_init(void) + int ret; + + ret = inet6_add_offload(&rthdr_offload, IPPROTO_ROUTING); +- if (!ret) ++ if (ret) + goto out; + + ret = inet6_add_offload(&dstopt_offload, IPPROTO_DSTOPTS); +- if (!ret) ++ if (ret) + goto out_rt; + + out: +diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c +index 70e704d49007..2dee1d9d7305 100644 +--- a/net/ipv6/icmp.c ++++ b/net/ipv6/icmp.c +@@ -508,7 +508,7 @@ static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info) + np->tclass, NULL, &fl6, (struct rt6_info *)dst, + MSG_DONTWAIT, np->dontfrag); + if (err) { +- ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTERRORS); ++ ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTERRORS); + ip6_flush_pending_frames(sk); + } else { + err = icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr, +diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c +index 98a262b759ae..32fb114b86bb 100644 +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -1108,21 +1108,19 @@ static void ip6_append_data_mtu(unsigned int *mtu, + unsigned int fragheaderlen, + struct sk_buff *skb, + struct rt6_info *rt, +- bool pmtuprobe) ++ unsigned int orig_mtu) + { + if (!(rt->dst.flags & DST_XFRM_TUNNEL)) { + if (skb == NULL) { + /* first fragment, reserve header_len */ +- *mtu = *mtu - rt->dst.header_len; ++ *mtu = orig_mtu - rt->dst.header_len; + + } else { + /* + * this fragment is not first, the headers + * space is regarded as data space. + */ +- *mtu = min(*mtu, pmtuprobe ? +- rt->dst.dev->mtu : +- dst_mtu(rt->dst.path)); ++ *mtu = orig_mtu; + } + *maxfraglen = ((*mtu - fragheaderlen) & ~7) + + fragheaderlen - sizeof(struct frag_hdr); +@@ -1139,7 +1137,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to, + struct ipv6_pinfo *np = inet6_sk(sk); + struct inet_cork *cork; + struct sk_buff *skb, *skb_prev = NULL; +- unsigned int maxfraglen, fragheaderlen, mtu; ++ unsigned int maxfraglen, fragheaderlen, mtu, orig_mtu; + int exthdrlen; + int dst_exthdrlen; + int hh_len; +@@ -1221,6 +1219,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to, + dst_exthdrlen = 0; + mtu = cork->fragsize; + } ++ orig_mtu = mtu; + + hh_len = LL_RESERVED_SPACE(rt->dst.dev); + +@@ -1300,8 +1299,7 @@ alloc_new_skb: + if (skb == NULL || skb_prev == NULL) + ip6_append_data_mtu(&mtu, &maxfraglen, + fragheaderlen, skb, rt, +- np->pmtudisc == +- IPV6_PMTUDISC_PROBE); ++ orig_mtu); + + skb_prev = skb; + +@@ -1556,8 +1554,8 @@ int ip6_push_pending_frames(struct sock *sk) + if (proto == IPPROTO_ICMPV6) { + struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb)); + +- ICMP6MSGOUT_INC_STATS_BH(net, idev, icmp6_hdr(skb)->icmp6_type); +- ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTMSGS); ++ ICMP6MSGOUT_INC_STATS(net, idev, icmp6_hdr(skb)->icmp6_type); ++ ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS); + } + + err = ip6_local_out(skb); +diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c +index 9f44ebc17759..2c84072b1da7 100644 +--- a/net/ipv6/ip6mr.c ++++ b/net/ipv6/ip6mr.c +@@ -2351,13 +2351,14 @@ int ip6mr_get_route(struct net *net, + } + + static int ip6mr_fill_mroute(struct mr6_table *mrt, struct sk_buff *skb, +- u32 portid, u32 seq, struct mfc6_cache *c, int cmd) ++ u32 portid, u32 seq, struct mfc6_cache *c, int cmd, ++ int flags) + { + struct nlmsghdr *nlh; + struct rtmsg *rtm; + int err; + +- nlh = nlmsg_put(skb, portid, seq, cmd, sizeof(*rtm), NLM_F_MULTI); ++ nlh = nlmsg_put(skb, portid, seq, cmd, sizeof(*rtm), flags); + if (nlh == NULL) + return -EMSGSIZE; + +@@ -2425,7 +2426,7 @@ static void mr6_netlink_event(struct mr6_table *mrt, struct mfc6_cache *mfc, + if (skb == NULL) + goto errout; + +- err = ip6mr_fill_mroute(mrt, skb, 0, 0, mfc, cmd); ++ err = ip6mr_fill_mroute(mrt, skb, 0, 0, mfc, cmd, 0); + if (err < 0) + goto errout; + +@@ -2464,7 +2465,8 @@ static int ip6mr_rtm_dumproute(struct sk_buff *skb, struct netlink_callback *cb) + if (ip6mr_fill_mroute(mrt, skb, + NETLINK_CB(cb->skb).portid, + cb->nlh->nlmsg_seq, +- mfc, RTM_NEWROUTE) < 0) ++ mfc, RTM_NEWROUTE, ++ NLM_F_MULTI) < 0) + goto done; + next_entry: + e++; +@@ -2478,7 +2480,8 @@ next_entry: + if (ip6mr_fill_mroute(mrt, skb, + NETLINK_CB(cb->skb).portid, + cb->nlh->nlmsg_seq, +- mfc, RTM_NEWROUTE) < 0) { ++ mfc, RTM_NEWROUTE, ++ NLM_F_MULTI) < 0) { + spin_unlock_bh(&mfc_unres_lock); + goto done; + } +diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c +index 952eaed38808..734aec059ffd 100644 +--- a/net/ipv6/mcast.c ++++ b/net/ipv6/mcast.c +@@ -1439,11 +1439,12 @@ static void mld_sendpack(struct sk_buff *skb) + dst_output); + out: + if (!err) { +- ICMP6MSGOUT_INC_STATS_BH(net, idev, ICMPV6_MLD2_REPORT); +- ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTMSGS); +- IP6_UPD_PO_STATS_BH(net, idev, IPSTATS_MIB_OUTMCAST, payload_len); +- } else +- IP6_INC_STATS_BH(net, idev, IPSTATS_MIB_OUTDISCARDS); ++ ICMP6MSGOUT_INC_STATS(net, idev, ICMPV6_MLD2_REPORT); ++ ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS); ++ IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUTMCAST, payload_len); ++ } else { ++ IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS); ++ } + + rcu_read_unlock(); + return; +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 6c389300f4e9..3fde3e977862 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -1428,7 +1428,7 @@ int ip6_route_add(struct fib6_config *cfg) + if (!table) + goto out; + +- rt = ip6_dst_alloc(net, NULL, DST_NOCOUNT, table); ++ rt = ip6_dst_alloc(net, NULL, (cfg->fc_flags & RTF_ADDRCONF) ? 0 : DST_NOCOUNT, table); + + if (!rt) { + err = -ENOMEM; +diff --git a/net/rds/iw.c b/net/rds/iw.c +index 7826d46baa70..589935661d66 100644 +--- a/net/rds/iw.c ++++ b/net/rds/iw.c +@@ -239,7 +239,8 @@ static int rds_iw_laddr_check(__be32 addr) + ret = rdma_bind_addr(cm_id, (struct sockaddr *)&sin); + /* due to this, we will claim to support IB devices unless we + check node_type. */ +- if (ret || cm_id->device->node_type != RDMA_NODE_RNIC) ++ if (ret || !cm_id->device || ++ cm_id->device->node_type != RDMA_NODE_RNIC) + ret = -EADDRNOTAVAIL; + + rdsdebug("addr %pI4 ret %d node type %d\n", +diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c +index cf579e71cff0..673921cfb97e 100644 +--- a/net/sctp/sm_make_chunk.c ++++ b/net/sctp/sm_make_chunk.c +@@ -1403,8 +1403,8 @@ static void sctp_chunk_destroy(struct sctp_chunk *chunk) + BUG_ON(!list_empty(&chunk->list)); + list_del_init(&chunk->transmitted_list); + +- /* Free the chunk skb data and the SCTP_chunk stub itself. */ +- dev_kfree_skb(chunk->skb); ++ consume_skb(chunk->skb); ++ consume_skb(chunk->auth_chunk); + + SCTP_DBG_OBJCNT_DEC(chunk); + kmem_cache_free(sctp_chunk_cachep, chunk); +diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c +index 7ceb25ba85b8..9973079401c4 100644 +--- a/net/sctp/sm_statefuns.c ++++ b/net/sctp/sm_statefuns.c +@@ -767,7 +767,6 @@ sctp_disposition_t sctp_sf_do_5_1D_ce(struct net *net, + + /* Make sure that we and the peer are AUTH capable */ + if (!net->sctp.auth_enable || !new_asoc->peer.auth_capable) { +- kfree_skb(chunk->auth_chunk); + sctp_association_free(new_asoc); + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); + } +@@ -782,10 +781,6 @@ sctp_disposition_t sctp_sf_do_5_1D_ce(struct net *net, + auth.transport = chunk->transport; + + ret = sctp_sf_authenticate(net, ep, new_asoc, type, &auth); +- +- /* We can now safely free the auth_chunk clone */ +- kfree_skb(chunk->auth_chunk); +- + if (ret != SCTP_IERROR_NO_ERROR) { + sctp_association_free(new_asoc); + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); +diff --git a/net/socket.c b/net/socket.c +index ac72efc3d965..fc90b4f0da3c 100644 +--- a/net/socket.c ++++ b/net/socket.c +@@ -1964,6 +1964,10 @@ static int copy_msghdr_from_user(struct msghdr *kmsg, + { + if (copy_from_user(kmsg, umsg, sizeof(struct msghdr))) + return -EFAULT; ++ ++ if (kmsg->msg_namelen < 0) ++ return -EINVAL; ++ + if (kmsg->msg_namelen > sizeof(struct sockaddr_storage)) + kmsg->msg_namelen = sizeof(struct sockaddr_storage); + return 0; +diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c +index 94d334781554..75e198d029d2 100644 +--- a/net/unix/af_unix.c ++++ b/net/unix/af_unix.c +@@ -1792,8 +1792,11 @@ static int unix_dgram_recvmsg(struct kiocb *iocb, struct socket *sock, + goto out; + + err = mutex_lock_interruptible(&u->readlock); +- if (err) { +- err = sock_intr_errno(sock_rcvtimeo(sk, noblock)); ++ if (unlikely(err)) { ++ /* recvmsg() in non blocking mode is supposed to return -EAGAIN ++ * sk_rcvtimeo is not honored by mutex_lock_interruptible() ++ */ ++ err = noblock ? -EAGAIN : -ERESTARTSYS; + goto out; + } + +@@ -1913,6 +1916,7 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock, + struct unix_sock *u = unix_sk(sk); + struct sockaddr_un *sunaddr = msg->msg_name; + int copied = 0; ++ int noblock = flags & MSG_DONTWAIT; + int check_creds = 0; + int target; + int err = 0; +@@ -1928,7 +1932,7 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock, + goto out; + + target = sock_rcvlowat(sk, flags&MSG_WAITALL, size); +- timeo = sock_rcvtimeo(sk, flags&MSG_DONTWAIT); ++ timeo = sock_rcvtimeo(sk, noblock); + + /* Lock the socket to prevent queue disordering + * while sleeps in memcpy_tomsg +@@ -1940,8 +1944,11 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock, + } + + err = mutex_lock_interruptible(&u->readlock); +- if (err) { +- err = sock_intr_errno(timeo); ++ if (unlikely(err)) { ++ /* recvmsg() in non blocking mode is supposed to return -EAGAIN ++ * sk_rcvtimeo is not honored by mutex_lock_interruptible() ++ */ ++ err = noblock ? -EAGAIN : -ERESTARTSYS; + goto out; + } + +diff --git a/scripts/Makefile.headersinst b/scripts/Makefile.headersinst +index 182084d728c8..8ccf83056a7a 100644 +--- a/scripts/Makefile.headersinst ++++ b/scripts/Makefile.headersinst +@@ -47,18 +47,24 @@ header-y := $(filter-out $(generic-y), $(header-y)) + all-files := $(header-y) $(genhdr-y) $(wrapper-files) + output-files := $(addprefix $(installdir)/, $(all-files)) + +-input-files := $(foreach hdr, $(header-y), \ ++input-files1 := $(foreach hdr, $(header-y), \ + $(if $(wildcard $(srcdir)/$(hdr)), \ +- $(wildcard $(srcdir)/$(hdr)), \ ++ $(wildcard $(srcdir)/$(hdr))) \ ++ ) ++input-files1-name := $(notdir $(input-files1)) ++input-files2 := $(foreach hdr, $(header-y), \ ++ $(if $(wildcard $(srcdir)/$(hdr)),, \ + $(if $(wildcard $(oldsrcdir)/$(hdr)), \ + $(wildcard $(oldsrcdir)/$(hdr)), \ + $(error Missing UAPI file $(srcdir)/$(hdr))) \ +- )) \ +- $(foreach hdr, $(genhdr-y), \ ++ )) ++input-files2-name := $(notdir $(input-files2)) ++input-files3 := $(foreach hdr, $(genhdr-y), \ + $(if $(wildcard $(gendir)/$(hdr)), \ + $(wildcard $(gendir)/$(hdr)), \ + $(error Missing generated UAPI file $(gendir)/$(hdr)) \ + )) ++input-files3-name := $(notdir $(input-files3)) + + # Work out what needs to be removed + oldheaders := $(patsubst $(installdir)/%,%,$(wildcard $(installdir)/*.h)) +@@ -72,7 +78,9 @@ printdir = $(patsubst $(INSTALL_HDR_PATH)/%/,%,$(dir $@)) + quiet_cmd_install = INSTALL $(printdir) ($(words $(all-files))\ + file$(if $(word 2, $(all-files)),s)) + cmd_install = \ +- $(CONFIG_SHELL) $< $(installdir) $(input-files); \ ++ $(CONFIG_SHELL) $< $(installdir) $(srcdir) $(input-files1-name); \ ++ $(CONFIG_SHELL) $< $(installdir) $(oldsrcdir) $(input-files2-name); \ ++ $(CONFIG_SHELL) $< $(installdir) $(gendir) $(input-files3-name); \ + for F in $(wrapper-files); do \ + echo "\#include " > $(installdir)/$$F; \ + done; \ +@@ -98,7 +106,7 @@ __headersinst: $(subdirs) $(install-file) + @: + + targets += $(install-file) +-$(install-file): scripts/headers_install.sh $(input-files) FORCE ++$(install-file): scripts/headers_install.sh $(input-files1) $(input-files2) $(input-files3) FORCE + $(if $(unwanted),$(call cmd,remove),) + $(if $(wildcard $(dir $@)),,$(shell mkdir -p $(dir $@))) + $(call if_changed,install) +diff --git a/scripts/headers_install.sh b/scripts/headers_install.sh +index 643764f53ea7..5de5660cb708 100644 +--- a/scripts/headers_install.sh ++++ b/scripts/headers_install.sh +@@ -2,7 +2,7 @@ + + if [ $# -lt 1 ] + then +- echo "Usage: headers_install.sh OUTDIR [FILES...] ++ echo "Usage: headers_install.sh OUTDIR SRCDIR [FILES...] + echo + echo "Prepares kernel header files for use by user space, by removing" + echo "all compiler.h definitions and #includes, removing any" +@@ -10,6 +10,7 @@ then + echo "asm/inline/volatile keywords." + echo + echo "OUTDIR: directory to write each userspace header FILE to." ++ echo "SRCDIR: source directory where files are picked." + echo "FILES: list of header files to operate on." + + exit 1 +@@ -19,6 +20,8 @@ fi + + OUTDIR="$1" + shift ++SRCDIR="$1" ++shift + + # Iterate through files listed on command line + +@@ -34,7 +37,7 @@ do + -e 's/(^|[^a-zA-Z0-9])__packed([^a-zA-Z0-9_]|$)/\1__attribute__((packed))\2/g' \ + -e 's/(^|[ \t(])(inline|asm|volatile)([ \t(]|$)/\1__\2__\3/g' \ + -e 's@#(ifndef|define|endif[ \t]*/[*])[ \t]*_UAPI@#\1 @' \ +- "$i" > "$OUTDIR/$FILE.sed" || exit 1 ++ "$SRCDIR/$i" > "$OUTDIR/$FILE.sed" || exit 1 + scripts/unifdef -U__KERNEL__ -D__EXPORTED_HEADERS__ "$OUTDIR/$FILE.sed" \ + > "$OUTDIR/$FILE" + [ $? -gt 1 ] && exit 1 +diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c +index a7096e130c04..70d4a8a7f21c 100644 +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -1361,15 +1361,33 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent + isec->sid = sbsec->sid; + + if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) { +- if (opt_dentry) { +- isec->sclass = inode_mode_to_security_class(inode->i_mode); +- rc = selinux_proc_get_sid(opt_dentry, +- isec->sclass, +- &sid); +- if (rc) +- goto out_unlock; +- isec->sid = sid; +- } ++ /* We must have a dentry to determine the label on ++ * procfs inodes */ ++ if (opt_dentry) ++ /* Called from d_instantiate or ++ * d_splice_alias. */ ++ dentry = dget(opt_dentry); ++ else ++ /* Called from selinux_complete_init, try to ++ * find a dentry. */ ++ dentry = d_find_alias(inode); ++ /* ++ * This can be hit on boot when a file is accessed ++ * before the policy is loaded. When we load policy we ++ * may find inodes that have no dentry on the ++ * sbsec->isec_head list. No reason to complain as ++ * these will get fixed up the next time we go through ++ * inode_doinit() with a dentry, before these inodes ++ * could be used again by userspace. ++ */ ++ if (!dentry) ++ goto out_unlock; ++ isec->sclass = inode_mode_to_security_class(inode->i_mode); ++ rc = selinux_proc_get_sid(dentry, isec->sclass, &sid); ++ dput(dentry); ++ if (rc) ++ goto out_unlock; ++ isec->sid = sid; + } + break; + }