From d1fc76c23d01db9a33bf33c0f25650acc31da613 Mon Sep 17 00:00:00 2001 From: Stephan Raue Date: Fri, 16 May 2014 13:55:21 +0200 Subject: [PATCH] projects/Cuboxi/patches/linux: add kernel upstream patches Signed-off-by: Stephan Raue --- .../linux/linux-000-patch-3.10.38-39.patch | 2695 +++++++++++++++++ .../linux/linux-000-patch-3.10.39-40.patch | 2267 ++++++++++++++ 2 files changed, 4962 insertions(+) create mode 100644 projects/Cuboxi/patches/linux/linux-000-patch-3.10.38-39.patch create mode 100644 projects/Cuboxi/patches/linux/linux-000-patch-3.10.39-40.patch diff --git a/projects/Cuboxi/patches/linux/linux-000-patch-3.10.38-39.patch b/projects/Cuboxi/patches/linux/linux-000-patch-3.10.38-39.patch new file mode 100644 index 0000000000..c81283d8f6 --- /dev/null +++ b/projects/Cuboxi/patches/linux/linux-000-patch-3.10.38-39.patch @@ -0,0 +1,2695 @@ +diff --git a/Documentation/video4linux/gspca.txt b/Documentation/video4linux/gspca.txt +index 1e6b6531bbcc..d2ba80bb7af5 100644 +--- a/Documentation/video4linux/gspca.txt ++++ b/Documentation/video4linux/gspca.txt +@@ -55,6 +55,7 @@ zc3xx 0458:700f Genius VideoCam Web V2 + sonixj 0458:7025 Genius Eye 311Q + sn9c20x 0458:7029 Genius Look 320s + sonixj 0458:702e Genius Slim 310 NB ++sn9c20x 0458:7045 Genius Look 1320 V2 + sn9c20x 0458:704a Genius Slim 1320 + sn9c20x 0458:704c Genius i-Look 1321 + sn9c20x 045e:00f4 LifeCam VX-6000 (SN9C20x + OV9650) +diff --git a/Makefile b/Makefile +index bd51b50a567b..1e07514be6f8 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 10 +-SUBLEVEL = 38 ++SUBLEVEL = 39 + EXTRAVERSION = + NAME = TOSSUG Baby Fish + +diff --git a/arch/arm/boot/dts/armada-370-xp.dtsi b/arch/arm/boot/dts/armada-370-xp.dtsi +index 4d12d2347c15..ddd068bb1457 100644 +--- a/arch/arm/boot/dts/armada-370-xp.dtsi ++++ b/arch/arm/boot/dts/armada-370-xp.dtsi +@@ -92,6 +92,7 @@ + #size-cells = <0>; + compatible = "marvell,orion-mdio"; + reg = <0x72004 0x4>; ++ clocks = <&gateclk 4>; + }; + + ethernet@70000 { +diff --git a/arch/arm/boot/dts/exynos5250-arndale.dts b/arch/arm/boot/dts/exynos5250-arndale.dts +index 02cfc76d002f..b64cb43a7295 100644 +--- a/arch/arm/boot/dts/exynos5250-arndale.dts ++++ b/arch/arm/boot/dts/exynos5250-arndale.dts +@@ -263,6 +263,7 @@ + regulator-name = "vdd_g3d"; + regulator-min-microvolt = <1000000>; + regulator-max-microvolt = <1000000>; ++ regulator-always-on; + regulator-boot-on; + op_mode = <1>; + }; +diff --git a/arch/arm/include/asm/div64.h b/arch/arm/include/asm/div64.h +index fe92ccf1d0b0..a66061aef29c 100644 +--- a/arch/arm/include/asm/div64.h ++++ b/arch/arm/include/asm/div64.h +@@ -156,7 +156,7 @@ + /* Select the best insn combination to perform the */ \ + /* actual __m * __n / (__p << 64) operation. */ \ + if (!__c) { \ +- asm ( "umull %Q0, %R0, %1, %Q2\n\t" \ ++ asm ( "umull %Q0, %R0, %Q1, %Q2\n\t" \ + "mov %Q0, #0" \ + : "=&r" (__res) \ + : "r" (__m), "r" (__n) \ +diff --git a/arch/arm/include/asm/futex.h b/arch/arm/include/asm/futex.h +index e42cf597f6e6..2aff798fbef4 100644 +--- a/arch/arm/include/asm/futex.h ++++ b/arch/arm/include/asm/futex.h +@@ -3,11 +3,6 @@ + + #ifdef __KERNEL__ + +-#if defined(CONFIG_CPU_USE_DOMAINS) && defined(CONFIG_SMP) +-/* ARM doesn't provide unprivileged exclusive memory accessors */ +-#include +-#else +- + #include + #include + #include +@@ -164,6 +159,5 @@ futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr) + return ret; + } + +-#endif /* !(CPU_USE_DOMAINS && SMP) */ + #endif /* __KERNEL__ */ + #endif /* _ASM_ARM_FUTEX_H */ +diff --git a/arch/arm/include/asm/io.h b/arch/arm/include/asm/io.h +index 652b56086de7..d070741b2b37 100644 +--- a/arch/arm/include/asm/io.h ++++ b/arch/arm/include/asm/io.h +@@ -130,16 +130,16 @@ static inline u32 __raw_readl(const volatile void __iomem *addr) + */ + extern void __iomem *__arm_ioremap_pfn_caller(unsigned long, unsigned long, + size_t, unsigned int, void *); +-extern void __iomem *__arm_ioremap_caller(unsigned long, size_t, unsigned int, ++extern void __iomem *__arm_ioremap_caller(phys_addr_t, size_t, unsigned int, + void *); + + extern void __iomem *__arm_ioremap_pfn(unsigned long, unsigned long, size_t, unsigned int); +-extern void __iomem *__arm_ioremap(unsigned long, size_t, unsigned int); +-extern void __iomem *__arm_ioremap_exec(unsigned long, size_t, bool cached); ++extern void __iomem *__arm_ioremap(phys_addr_t, size_t, unsigned int); ++extern void __iomem *__arm_ioremap_exec(phys_addr_t, size_t, bool cached); + extern void __iounmap(volatile void __iomem *addr); + extern void __arm_iounmap(volatile void __iomem *addr); + +-extern void __iomem * (*arch_ioremap_caller)(unsigned long, size_t, ++extern void __iomem * (*arch_ioremap_caller)(phys_addr_t, size_t, + unsigned int, void *); + extern void (*arch_iounmap)(volatile void __iomem *); + +diff --git a/arch/arm/include/asm/pgtable-2level.h b/arch/arm/include/asm/pgtable-2level.h +index f97ee02386ee..c98c9c89b95c 100644 +--- a/arch/arm/include/asm/pgtable-2level.h ++++ b/arch/arm/include/asm/pgtable-2level.h +@@ -140,6 +140,7 @@ + #define L_PTE_MT_DEV_NONSHARED (_AT(pteval_t, 0x0c) << 2) /* 1100 */ + #define L_PTE_MT_DEV_WC (_AT(pteval_t, 0x09) << 2) /* 1001 */ + #define L_PTE_MT_DEV_CACHED (_AT(pteval_t, 0x0b) << 2) /* 1011 */ ++#define L_PTE_MT_VECTORS (_AT(pteval_t, 0x0f) << 2) /* 1111 */ + #define L_PTE_MT_MASK (_AT(pteval_t, 0x0f) << 2) + + #ifndef __ASSEMBLY__ +diff --git a/arch/arm/include/asm/unistd.h b/arch/arm/include/asm/unistd.h +index 141baa3f9a72..cbd61977c996 100644 +--- a/arch/arm/include/asm/unistd.h ++++ b/arch/arm/include/asm/unistd.h +@@ -48,6 +48,5 @@ + */ + #define __IGNORE_fadvise64_64 + #define __IGNORE_migrate_pages +-#define __IGNORE_kcmp + + #endif /* __ASM_ARM_UNISTD_H */ +diff --git a/arch/arm/kernel/machine_kexec.c b/arch/arm/kernel/machine_kexec.c +index 163b160c69e9..c3ef920823b6 100644 +--- a/arch/arm/kernel/machine_kexec.c ++++ b/arch/arm/kernel/machine_kexec.c +@@ -169,3 +169,10 @@ void machine_kexec(struct kimage *image) + + soft_restart(reboot_code_buffer_phys); + } ++ ++void arch_crash_save_vmcoreinfo(void) ++{ ++#ifdef CONFIG_ARM_LPAE ++ VMCOREINFO_CONFIG(ARM_LPAE); ++#endif ++} +diff --git a/arch/arm/mach-ebsa110/core.c b/arch/arm/mach-ebsa110/core.c +index b13cc74114db..8a53f346cdb3 100644 +--- a/arch/arm/mach-ebsa110/core.c ++++ b/arch/arm/mach-ebsa110/core.c +@@ -116,7 +116,7 @@ static void __init ebsa110_map_io(void) + iotable_init(ebsa110_io_desc, ARRAY_SIZE(ebsa110_io_desc)); + } + +-static void __iomem *ebsa110_ioremap_caller(unsigned long cookie, size_t size, ++static void __iomem *ebsa110_ioremap_caller(phys_addr_t cookie, size_t size, + unsigned int flags, void *caller) + { + return (void __iomem *)cookie; +diff --git a/arch/arm/mach-imx/mm-imx3.c b/arch/arm/mach-imx/mm-imx3.c +index e0e69a682174..eed32ca0b8ab 100644 +--- a/arch/arm/mach-imx/mm-imx3.c ++++ b/arch/arm/mach-imx/mm-imx3.c +@@ -65,7 +65,7 @@ static void imx3_idle(void) + : "=r" (reg)); + } + +-static void __iomem *imx3_ioremap_caller(unsigned long phys_addr, size_t size, ++static void __iomem *imx3_ioremap_caller(phys_addr_t phys_addr, size_t size, + unsigned int mtype, void *caller) + { + if (mtype == MT_DEVICE) { +diff --git a/arch/arm/mach-iop13xx/io.c b/arch/arm/mach-iop13xx/io.c +index 183dc8b5511b..faaf7d4482c5 100644 +--- a/arch/arm/mach-iop13xx/io.c ++++ b/arch/arm/mach-iop13xx/io.c +@@ -23,7 +23,7 @@ + + #include "pci.h" + +-static void __iomem *__iop13xx_ioremap_caller(unsigned long cookie, ++static void __iomem *__iop13xx_ioremap_caller(phys_addr_t cookie, + size_t size, unsigned int mtype, void *caller) + { + void __iomem * retval; +diff --git a/arch/arm/mach-ixp4xx/common.c b/arch/arm/mach-ixp4xx/common.c +index 6600cff6bd92..d7223b3b81f3 100644 +--- a/arch/arm/mach-ixp4xx/common.c ++++ b/arch/arm/mach-ixp4xx/common.c +@@ -559,7 +559,7 @@ void ixp4xx_restart(char mode, const char *cmd) + * fallback to the default. + */ + +-static void __iomem *ixp4xx_ioremap_caller(unsigned long addr, size_t size, ++static void __iomem *ixp4xx_ioremap_caller(phys_addr_t addr, size_t size, + unsigned int mtype, void *caller) + { + if (!is_pci_memory(addr)) +diff --git a/arch/arm/mach-msm/common.h b/arch/arm/mach-msm/common.h +index ce8215a269e5..421cf7751a80 100644 +--- a/arch/arm/mach-msm/common.h ++++ b/arch/arm/mach-msm/common.h +@@ -23,7 +23,7 @@ extern void msm_map_msm8x60_io(void); + extern void msm_map_msm8960_io(void); + extern void msm_map_qsd8x50_io(void); + +-extern void __iomem *__msm_ioremap_caller(unsigned long phys_addr, size_t size, ++extern void __iomem *__msm_ioremap_caller(phys_addr_t phys_addr, size_t size, + unsigned int mtype, void *caller); + + extern struct smp_operations msm_smp_ops; +diff --git a/arch/arm/mach-msm/io.c b/arch/arm/mach-msm/io.c +index 123ef9cbce1b..fd65b6d42cde 100644 +--- a/arch/arm/mach-msm/io.c ++++ b/arch/arm/mach-msm/io.c +@@ -172,7 +172,7 @@ void __init msm_map_msm7x30_io(void) + } + #endif /* CONFIG_ARCH_MSM7X30 */ + +-void __iomem *__msm_ioremap_caller(unsigned long phys_addr, size_t size, ++void __iomem *__msm_ioremap_caller(phys_addr_t phys_addr, size_t size, + unsigned int mtype, void *caller) + { + if (mtype == MT_DEVICE) { +diff --git a/arch/arm/mach-omap2/irq.c b/arch/arm/mach-omap2/irq.c +index e022a869bff2..6037a9a01ed5 100644 +--- a/arch/arm/mach-omap2/irq.c ++++ b/arch/arm/mach-omap2/irq.c +@@ -222,6 +222,7 @@ void __init ti81xx_init_irq(void) + static inline void omap_intc_handle_irq(void __iomem *base_addr, struct pt_regs *regs) + { + u32 irqnr; ++ int handled_irq = 0; + + do { + irqnr = readl_relaxed(base_addr + 0x98); +@@ -249,8 +250,15 @@ out: + if (irqnr) { + irqnr = irq_find_mapping(domain, irqnr); + handle_IRQ(irqnr, regs); ++ handled_irq = 1; + } + } while (irqnr); ++ ++ /* If an irq is masked or deasserted while active, we will ++ * keep ending up here with no irq handled. So remove it from ++ * the INTC with an ack.*/ ++ if (!handled_irq) ++ omap_ack_irq(NULL); + } + + asmlinkage void __exception_irq_entry omap2_intc_handle_irq(struct pt_regs *regs) +diff --git a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c +index 9f6238c9dfc9..8691c8cbe2c7 100644 +--- a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c ++++ b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c +@@ -1955,7 +1955,7 @@ static struct omap_hwmod_irq_info omap3xxx_usb_host_hs_irqs[] = { + static struct omap_hwmod omap3xxx_usb_host_hs_hwmod = { + .name = "usb_host_hs", + .class = &omap3xxx_usb_host_hs_hwmod_class, +- .clkdm_name = "l3_init_clkdm", ++ .clkdm_name = "usbhost_clkdm", + .mpu_irqs = omap3xxx_usb_host_hs_irqs, + .main_clk = "usbhost_48m_fck", + .prcm = { +@@ -2040,7 +2040,7 @@ static struct omap_hwmod_irq_info omap3xxx_usb_tll_hs_irqs[] = { + static struct omap_hwmod omap3xxx_usb_tll_hs_hwmod = { + .name = "usb_tll_hs", + .class = &omap3xxx_usb_tll_hs_hwmod_class, +- .clkdm_name = "l3_init_clkdm", ++ .clkdm_name = "core_l4_clkdm", + .mpu_irqs = omap3xxx_usb_tll_hs_irqs, + .main_clk = "usbtll_fck", + .prcm = { +diff --git a/arch/arm/mach-omap2/pm.h b/arch/arm/mach-omap2/pm.h +index 7bdd22afce69..d4d0fce325c7 100644 +--- a/arch/arm/mach-omap2/pm.h ++++ b/arch/arm/mach-omap2/pm.h +@@ -103,7 +103,7 @@ static inline void enable_omap3630_toggle_l2_on_restore(void) { } + + #define PM_OMAP4_ROM_SMP_BOOT_ERRATUM_GICD (1 << 0) + +-#if defined(CONFIG_ARCH_OMAP4) ++#if defined(CONFIG_PM) && defined(CONFIG_ARCH_OMAP4) + extern u16 pm44xx_errata; + #define IS_PM44XX_ERRATUM(id) (pm44xx_errata & (id)) + #else +diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig +index 08c9fe917d1f..c21082d664ed 100644 +--- a/arch/arm/mm/Kconfig ++++ b/arch/arm/mm/Kconfig +@@ -436,7 +436,6 @@ config CPU_32v5 + + config CPU_32v6 + bool +- select CPU_USE_DOMAINS if CPU_V6 && MMU + select TLS_REG_EMUL if !CPU_32v6K && !MMU + + config CPU_32v6K +@@ -651,7 +650,7 @@ config ARM_VIRT_EXT + + config SWP_EMULATE + bool "Emulate SWP/SWPB instructions" +- depends on !CPU_USE_DOMAINS && CPU_V7 ++ depends on CPU_V7 + default y if SMP + select HAVE_PROC_CPU if PROC_FS + help +diff --git a/arch/arm/mm/ioremap.c b/arch/arm/mm/ioremap.c +index 04d9006eab1f..f123d6eb074b 100644 +--- a/arch/arm/mm/ioremap.c ++++ b/arch/arm/mm/ioremap.c +@@ -331,10 +331,10 @@ void __iomem * __arm_ioremap_pfn_caller(unsigned long pfn, + return (void __iomem *) (offset + addr); + } + +-void __iomem *__arm_ioremap_caller(unsigned long phys_addr, size_t size, ++void __iomem *__arm_ioremap_caller(phys_addr_t phys_addr, size_t size, + unsigned int mtype, void *caller) + { +- unsigned long last_addr; ++ phys_addr_t last_addr; + unsigned long offset = phys_addr & ~PAGE_MASK; + unsigned long pfn = __phys_to_pfn(phys_addr); + +@@ -367,12 +367,12 @@ __arm_ioremap_pfn(unsigned long pfn, unsigned long offset, size_t size, + } + EXPORT_SYMBOL(__arm_ioremap_pfn); + +-void __iomem * (*arch_ioremap_caller)(unsigned long, size_t, ++void __iomem * (*arch_ioremap_caller)(phys_addr_t, size_t, + unsigned int, void *) = + __arm_ioremap_caller; + + void __iomem * +-__arm_ioremap(unsigned long phys_addr, size_t size, unsigned int mtype) ++__arm_ioremap(phys_addr_t phys_addr, size_t size, unsigned int mtype) + { + return arch_ioremap_caller(phys_addr, size, mtype, + __builtin_return_address(0)); +@@ -387,7 +387,7 @@ EXPORT_SYMBOL(__arm_ioremap); + * CONFIG_GENERIC_ALLOCATOR for allocating external memory. + */ + void __iomem * +-__arm_ioremap_exec(unsigned long phys_addr, size_t size, bool cached) ++__arm_ioremap_exec(phys_addr_t phys_addr, size_t size, bool cached) + { + unsigned int mtype; + +diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c +index daf336fe0be8..fb3c446af9e5 100644 +--- a/arch/arm/mm/mmu.c ++++ b/arch/arm/mm/mmu.c +@@ -459,6 +459,16 @@ static void __init build_mem_type_table(void) + hyp_device_pgprot = s2_device_pgprot = mem_types[MT_DEVICE].prot_pte; + + /* ++ * We don't use domains on ARMv6 (since this causes problems with ++ * v6/v7 kernels), so we must use a separate memory type for user ++ * r/o, kernel r/w to map the vectors page. ++ */ ++#ifndef CONFIG_ARM_LPAE ++ if (cpu_arch == CPU_ARCH_ARMv6) ++ vecs_pgprot |= L_PTE_MT_VECTORS; ++#endif ++ ++ /* + * ARMv6 and above have extended page tables. + */ + if (cpu_arch >= CPU_ARCH_ARMv6 && (cr & CR_XP)) { +diff --git a/arch/arm/mm/nommu.c b/arch/arm/mm/nommu.c +index eb5293a69a84..7fe0524a5449 100644 +--- a/arch/arm/mm/nommu.c ++++ b/arch/arm/mm/nommu.c +@@ -87,16 +87,16 @@ void __iomem *__arm_ioremap_pfn_caller(unsigned long pfn, unsigned long offset, + return __arm_ioremap_pfn(pfn, offset, size, mtype); + } + +-void __iomem *__arm_ioremap(unsigned long phys_addr, size_t size, ++void __iomem *__arm_ioremap(phys_addr_t phys_addr, size_t size, + unsigned int mtype) + { + return (void __iomem *)phys_addr; + } + EXPORT_SYMBOL(__arm_ioremap); + +-void __iomem * (*arch_ioremap_caller)(unsigned long, size_t, unsigned int, void *); ++void __iomem * (*arch_ioremap_caller)(phys_addr_t, size_t, unsigned int, void *); + +-void __iomem *__arm_ioremap_caller(unsigned long phys_addr, size_t size, ++void __iomem *__arm_ioremap_caller(phys_addr_t phys_addr, size_t size, + unsigned int mtype, void *caller) + { + return __arm_ioremap(phys_addr, size, mtype); +diff --git a/arch/arm/mm/proc-macros.S b/arch/arm/mm/proc-macros.S +index e3c48a3fe063..ee1d80593958 100644 +--- a/arch/arm/mm/proc-macros.S ++++ b/arch/arm/mm/proc-macros.S +@@ -112,13 +112,9 @@ + * 100x 1 0 1 r/o no acc + * 10x0 1 0 1 r/o no acc + * 1011 0 0 1 r/w no acc +- * 110x 0 1 0 r/w r/o +- * 11x0 0 1 0 r/w r/o +- * 1111 0 1 1 r/w r/w +- * +- * If !CONFIG_CPU_USE_DOMAINS, the following permissions are changed: + * 110x 1 1 1 r/o r/o + * 11x0 1 1 1 r/o r/o ++ * 1111 0 1 1 r/w r/w + */ + .macro armv6_mt_table pfx + \pfx\()_mt_table: +@@ -137,7 +133,7 @@ + .long PTE_EXT_TEX(2) @ L_PTE_MT_DEV_NONSHARED + .long 0x00 @ unused + .long 0x00 @ unused +- .long 0x00 @ unused ++ .long PTE_CACHEABLE | PTE_BUFFERABLE | PTE_EXT_APX @ L_PTE_MT_VECTORS + .endm + + .macro armv6_set_pte_ext pfx +@@ -158,24 +154,21 @@ + + tst r1, #L_PTE_USER + orrne r3, r3, #PTE_EXT_AP1 +-#ifdef CONFIG_CPU_USE_DOMAINS +- @ allow kernel read/write access to read-only user pages + tstne r3, #PTE_EXT_APX +- bicne r3, r3, #PTE_EXT_APX | PTE_EXT_AP0 +-#endif ++ ++ @ user read-only -> kernel read-only ++ bicne r3, r3, #PTE_EXT_AP0 + + tst r1, #L_PTE_XN + orrne r3, r3, #PTE_EXT_XN + +- orr r3, r3, r2 ++ eor r3, r3, r2 + + tst r1, #L_PTE_YOUNG + tstne r1, #L_PTE_PRESENT + moveq r3, #0 +-#ifndef CONFIG_CPU_USE_DOMAINS + tstne r1, #L_PTE_NONE + movne r3, #0 +-#endif + + str r3, [r0] + mcr p15, 0, r0, c7, c10, 1 @ flush_pte +diff --git a/arch/arm/mm/proc-v7-2level.S b/arch/arm/mm/proc-v7-2level.S +index b3997c70af32..bb20ba0f7bc7 100644 +--- a/arch/arm/mm/proc-v7-2level.S ++++ b/arch/arm/mm/proc-v7-2level.S +@@ -90,21 +90,14 @@ ENTRY(cpu_v7_set_pte_ext) + + tst r1, #L_PTE_USER + orrne r3, r3, #PTE_EXT_AP1 +-#ifdef CONFIG_CPU_USE_DOMAINS +- @ allow kernel read/write access to read-only user pages +- tstne r3, #PTE_EXT_APX +- bicne r3, r3, #PTE_EXT_APX | PTE_EXT_AP0 +-#endif + + tst r1, #L_PTE_XN + orrne r3, r3, #PTE_EXT_XN + + tst r1, #L_PTE_YOUNG + tstne r1, #L_PTE_VALID +-#ifndef CONFIG_CPU_USE_DOMAINS + eorne r1, r1, #L_PTE_NONE + tstne r1, #L_PTE_NONE +-#endif + moveq r3, #0 + + ARM( str r3, [r0, #2048]! ) +diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h +index e9a1a1d81892..3a710d7b14ce 100644 +--- a/arch/arm64/include/asm/pgtable.h ++++ b/arch/arm64/include/asm/pgtable.h +@@ -161,7 +161,7 @@ static inline void set_pte_at(struct mm_struct *mm, unsigned long addr, + pte_t *ptep, pte_t pte) + { + if (pte_valid_user(pte)) { +- if (pte_exec(pte)) ++ if (!pte_special(pte) && pte_exec(pte)) + __sync_icache_dcache(pte, addr); + if (!pte_dirty(pte)) + pte = pte_wrprotect(pte); +@@ -182,11 +182,11 @@ static inline void set_pte_at(struct mm_struct *mm, unsigned long addr, + * Mark the prot value as uncacheable and unbufferable. + */ + #define pgprot_noncached(prot) \ +- __pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_DEVICE_nGnRnE)) ++ __pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_DEVICE_nGnRnE) | PTE_PXN | PTE_UXN) + #define pgprot_writecombine(prot) \ +- __pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_NORMAL_NC)) ++ __pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_NORMAL_NC) | PTE_PXN | PTE_UXN) + #define pgprot_dmacoherent(prot) \ +- __pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_NORMAL_NC)) ++ __pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_NORMAL_NC) | PTE_PXN | PTE_UXN) + #define __HAVE_PHYS_MEM_ACCESS_PROT + struct file; + extern pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn, +diff --git a/arch/s390/include/asm/ccwdev.h b/arch/s390/include/asm/ccwdev.h +index f201af8be580..31b5ca8f8c3d 100644 +--- a/arch/s390/include/asm/ccwdev.h ++++ b/arch/s390/include/asm/ccwdev.h +@@ -219,7 +219,7 @@ extern void ccw_device_get_id(struct ccw_device *, struct ccw_dev_id *); + #define to_ccwdev(n) container_of(n, struct ccw_device, dev) + #define to_ccwdrv(n) container_of(n, struct ccw_driver, driver) + +-extern struct ccw_device *ccw_device_probe_console(void); ++extern struct ccw_device *ccw_device_probe_console(struct ccw_driver *); + extern void ccw_device_wait_idle(struct ccw_device *); + extern int ccw_device_force_console(struct ccw_device *); + +diff --git a/arch/sh/kernel/dumpstack.c b/arch/sh/kernel/dumpstack.c +index b959f5592604..8dfe645bcc4b 100644 +--- a/arch/sh/kernel/dumpstack.c ++++ b/arch/sh/kernel/dumpstack.c +@@ -115,7 +115,7 @@ static int print_trace_stack(void *data, char *name) + */ + static void print_trace_address(void *data, unsigned long addr, int reliable) + { +- printk(data); ++ printk("%s", (char *)data); + printk_address(addr, reliable); + } + +diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c +index d606463aa6d6..1308beed7abe 100644 +--- a/arch/x86/boot/compressed/eboot.c ++++ b/arch/x86/boot/compressed/eboot.c +@@ -865,6 +865,9 @@ fail: + * Because the x86 boot code expects to be passed a boot_params we + * need to create one ourselves (usually the bootloader would create + * one for us). ++ * ++ * The caller is responsible for filling out ->code32_start in the ++ * returned boot_params. + */ + struct boot_params *make_boot_params(void *handle, efi_system_table_t *_table) + { +@@ -921,8 +924,6 @@ struct boot_params *make_boot_params(void *handle, efi_system_table_t *_table) + hdr->vid_mode = 0xffff; + hdr->boot_flag = 0xAA55; + +- hdr->code32_start = (__u64)(unsigned long)image->image_base; +- + hdr->type_of_loader = 0x21; + + /* Convert unicode cmdline to ascii */ +diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S +index 1e3184f6072f..abb988a54c69 100644 +--- a/arch/x86/boot/compressed/head_32.S ++++ b/arch/x86/boot/compressed/head_32.S +@@ -50,6 +50,13 @@ ENTRY(efi_pe_entry) + pushl %eax + pushl %esi + pushl %ecx ++ ++ call reloc ++reloc: ++ popl %ecx ++ subl reloc, %ecx ++ movl %ecx, BP_code32_start(%eax) ++ + sub $0x4, %esp + + ENTRY(efi_stub_entry) +@@ -63,12 +70,7 @@ ENTRY(efi_stub_entry) + hlt + jmp 1b + 2: +- call 3f +-3: +- popl %eax +- subl $3b, %eax +- subl BP_pref_address(%esi), %eax +- add BP_code32_start(%esi), %eax ++ movl BP_code32_start(%esi), %eax + leal preferred_addr(%eax), %eax + jmp *%eax + +diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S +index 16f24e6dad79..92059b8f3f7b 100644 +--- a/arch/x86/boot/compressed/head_64.S ++++ b/arch/x86/boot/compressed/head_64.S +@@ -217,6 +217,8 @@ ENTRY(efi_pe_entry) + cmpq $0,%rax + je 1f + mov %rax, %rdx ++ leaq startup_32(%rip), %rax ++ movl %eax, BP_code32_start(%rdx) + popq %rsi + popq %rdi + +@@ -230,12 +232,7 @@ ENTRY(efi_stub_entry) + hlt + jmp 1b + 2: +- call 3f +-3: +- popq %rax +- subq $3b, %rax +- subq BP_pref_address(%rsi), %rax +- add BP_code32_start(%esi), %eax ++ movl BP_code32_start(%esi), %eax + leaq preferred_addr(%rax), %rax + jmp *%rax + +diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c +index e6253195a301..1ffc32dbe450 100644 +--- a/arch/x86/kernel/ftrace.c ++++ b/arch/x86/kernel/ftrace.c +@@ -659,8 +659,8 @@ ftrace_modify_code(unsigned long ip, unsigned const char *old_code, + ret = -EPERM; + goto out; + } +- run_sync(); + out: ++ run_sync(); + return ret; + + fail_update: +diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c +index ebc987398923..af1d14a9ebda 100644 +--- a/arch/x86/kernel/ldt.c ++++ b/arch/x86/kernel/ldt.c +@@ -229,6 +229,17 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode) + } + } + ++ /* ++ * On x86-64 we do not support 16-bit segments due to ++ * IRET leaking the high bits of the kernel stack address. ++ */ ++#ifdef CONFIG_X86_64 ++ if (!ldt_info.seg_32bit) { ++ error = -EINVAL; ++ goto out_unlock; ++ } ++#endif ++ + fill_ldt(&ldt, &ldt_info); + if (oldmode) + ldt.avl = 0; +diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c +index 20dd52a2f92f..6e514583aa76 100644 +--- a/drivers/block/mtip32xx/mtip32xx.c ++++ b/drivers/block/mtip32xx/mtip32xx.c +@@ -4040,6 +4040,7 @@ skip_create_disk: + blk_queue_max_hw_sectors(dd->queue, 0xffff); + blk_queue_max_segment_size(dd->queue, 0x400000); + blk_queue_io_min(dd->queue, 4096); ++ blk_queue_bounce_limit(dd->queue, dd->pdev->dma_mask); + + /* + * write back cache is not supported in the device. FUA depends on +diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c +index aaadd32f9f0d..d344cf3ac9e3 100644 +--- a/drivers/iio/industrialio-buffer.c ++++ b/drivers/iio/industrialio-buffer.c +@@ -119,7 +119,8 @@ static ssize_t iio_scan_el_show(struct device *dev, + int ret; + struct iio_dev *indio_dev = dev_to_iio_dev(dev); + +- ret = test_bit(to_iio_dev_attr(attr)->address, ++ /* Ensure ret is 0 or 1. */ ++ ret = !!test_bit(to_iio_dev_attr(attr)->address, + indio_dev->buffer->scan_mask); + + return sprintf(buf, "%d\n", ret); +@@ -762,7 +763,8 @@ int iio_scan_mask_query(struct iio_dev *indio_dev, + if (!buffer->scan_mask) + return 0; + +- return test_bit(bit, buffer->scan_mask); ++ /* Ensure return value is 0 or 1. */ ++ return !!test_bit(bit, buffer->scan_mask); + }; + EXPORT_SYMBOL_GPL(iio_scan_mask_query); + +diff --git a/drivers/infiniband/hw/ehca/ehca_cq.c b/drivers/infiniband/hw/ehca/ehca_cq.c +index 212150c25ea0..8cc837537768 100644 +--- a/drivers/infiniband/hw/ehca/ehca_cq.c ++++ b/drivers/infiniband/hw/ehca/ehca_cq.c +@@ -283,6 +283,7 @@ struct ib_cq *ehca_create_cq(struct ib_device *device, int cqe, int comp_vector, + (my_cq->galpas.user.fw_handle & (PAGE_SIZE - 1)); + if (ib_copy_to_udata(udata, &resp, sizeof(resp))) { + ehca_err(device, "Copy to udata failed."); ++ cq = ERR_PTR(-EFAULT); + goto create_cq_exit4; + } + } +diff --git a/drivers/infiniband/hw/ipath/ipath_diag.c b/drivers/infiniband/hw/ipath/ipath_diag.c +index 714293b78518..e2f9a51f4a38 100644 +--- a/drivers/infiniband/hw/ipath/ipath_diag.c ++++ b/drivers/infiniband/hw/ipath/ipath_diag.c +@@ -326,7 +326,7 @@ static ssize_t ipath_diagpkt_write(struct file *fp, + size_t count, loff_t *off) + { + u32 __iomem *piobuf; +- u32 plen, clen, pbufn; ++ u32 plen, pbufn, maxlen_reserve; + struct ipath_diag_pkt odp; + struct ipath_diag_xpkt dp; + u32 *tmpbuf = NULL; +@@ -335,51 +335,29 @@ static ssize_t ipath_diagpkt_write(struct file *fp, + u64 val; + u32 l_state, lt_state; /* LinkState, LinkTrainingState */ + +- if (count < sizeof(odp)) { +- ret = -EINVAL; +- goto bail; +- } + + if (count == sizeof(dp)) { + if (copy_from_user(&dp, data, sizeof(dp))) { + ret = -EFAULT; + goto bail; + } +- } else if (copy_from_user(&odp, data, sizeof(odp))) { +- ret = -EFAULT; ++ } else if (count == sizeof(odp)) { ++ if (copy_from_user(&odp, data, sizeof(odp))) { ++ ret = -EFAULT; ++ goto bail; ++ } ++ } else { ++ ret = -EINVAL; + goto bail; + } + +- /* +- * Due to padding/alignment issues (lessened with new struct) +- * the old and new structs are the same length. We need to +- * disambiguate them, which we can do because odp.len has never +- * been less than the total of LRH+BTH+DETH so far, while +- * dp.unit (same offset) unit is unlikely to get that high. +- * Similarly, dp.data, the pointer to user at the same offset +- * as odp.unit, is almost certainly at least one (512byte)page +- * "above" NULL. The if-block below can be omitted if compatibility +- * between a new driver and older diagnostic code is unimportant. +- * compatibility the other direction (new diags, old driver) is +- * handled in the diagnostic code, with a warning. +- */ +- if (dp.unit >= 20 && dp.data < 512) { +- /* very probable version mismatch. Fix it up */ +- memcpy(&odp, &dp, sizeof(odp)); +- /* We got a legacy dp, copy elements to dp */ +- dp.unit = odp.unit; +- dp.data = odp.data; +- dp.len = odp.len; +- dp.pbc_wd = 0; /* Indicate we need to compute PBC wd */ +- } +- + /* send count must be an exact number of dwords */ + if (dp.len & 3) { + ret = -EINVAL; + goto bail; + } + +- clen = dp.len >> 2; ++ plen = dp.len >> 2; + + dd = ipath_lookup(dp.unit); + if (!dd || !(dd->ipath_flags & IPATH_PRESENT) || +@@ -422,16 +400,22 @@ static ssize_t ipath_diagpkt_write(struct file *fp, + goto bail; + } + +- /* need total length before first word written */ +- /* +1 word is for the qword padding */ +- plen = sizeof(u32) + dp.len; +- +- if ((plen + 4) > dd->ipath_ibmaxlen) { ++ /* ++ * need total length before first word written, plus 2 Dwords. One Dword ++ * is for padding so we get the full user data when not aligned on ++ * a word boundary. The other Dword is to make sure we have room for the ++ * ICRC which gets tacked on later. ++ */ ++ maxlen_reserve = 2 * sizeof(u32); ++ if (dp.len > dd->ipath_ibmaxlen - maxlen_reserve) { + ipath_dbg("Pkt len 0x%x > ibmaxlen %x\n", +- plen - 4, dd->ipath_ibmaxlen); ++ dp.len, dd->ipath_ibmaxlen); + ret = -EINVAL; +- goto bail; /* before writing pbc */ ++ goto bail; + } ++ ++ plen = sizeof(u32) + dp.len; ++ + tmpbuf = vmalloc(plen); + if (!tmpbuf) { + dev_info(&dd->pcidev->dev, "Unable to allocate tmp buffer, " +@@ -473,11 +457,11 @@ static ssize_t ipath_diagpkt_write(struct file *fp, + */ + if (dd->ipath_flags & IPATH_PIO_FLUSH_WC) { + ipath_flush_wc(); +- __iowrite32_copy(piobuf + 2, tmpbuf, clen - 1); ++ __iowrite32_copy(piobuf + 2, tmpbuf, plen - 1); + ipath_flush_wc(); +- __raw_writel(tmpbuf[clen - 1], piobuf + clen + 1); ++ __raw_writel(tmpbuf[plen - 1], piobuf + plen + 1); + } else +- __iowrite32_copy(piobuf + 2, tmpbuf, clen); ++ __iowrite32_copy(piobuf + 2, tmpbuf, plen); + + ipath_flush_wc(); + +diff --git a/drivers/infiniband/hw/mthca/mthca_provider.c b/drivers/infiniband/hw/mthca/mthca_provider.c +index 5b71d43bd89c..42dde06fdb91 100644 +--- a/drivers/infiniband/hw/mthca/mthca_provider.c ++++ b/drivers/infiniband/hw/mthca/mthca_provider.c +@@ -695,6 +695,7 @@ static struct ib_cq *mthca_create_cq(struct ib_device *ibdev, int entries, + + if (context && ib_copy_to_udata(udata, &cq->cqn, sizeof (__u32))) { + mthca_free_cq(to_mdev(ibdev), cq); ++ err = -EFAULT; + goto err_free; + } + +diff --git a/drivers/infiniband/hw/nes/nes_verbs.c b/drivers/infiniband/hw/nes/nes_verbs.c +index 8f67fe2e91e6..7510a3c80757 100644 +--- a/drivers/infiniband/hw/nes/nes_verbs.c ++++ b/drivers/infiniband/hw/nes/nes_verbs.c +@@ -1186,7 +1186,7 @@ static struct ib_qp *nes_create_qp(struct ib_pd *ibpd, + nes_free_resource(nesadapter, nesadapter->allocated_qps, qp_num); + kfree(nesqp->allocated_buffer); + nes_debug(NES_DBG_QP, "ib_copy_from_udata() Failed \n"); +- return NULL; ++ return ERR_PTR(-EFAULT); + } + if (req.user_wqe_buffers) { + virt_wqs = 1; +diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c +index 6c66a728a37f..64953dfa9d8a 100644 +--- a/drivers/infiniband/ulp/srpt/ib_srpt.c ++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c +@@ -1078,6 +1078,7 @@ static void srpt_unmap_sg_to_ib_sge(struct srpt_rdma_ch *ch, + static int srpt_map_sg_to_ib_sge(struct srpt_rdma_ch *ch, + struct srpt_send_ioctx *ioctx) + { ++ struct ib_device *dev = ch->sport->sdev->device; + struct se_cmd *cmd; + struct scatterlist *sg, *sg_orig; + int sg_cnt; +@@ -1124,7 +1125,7 @@ static int srpt_map_sg_to_ib_sge(struct srpt_rdma_ch *ch, + + db = ioctx->rbufs; + tsize = cmd->data_length; +- dma_len = sg_dma_len(&sg[0]); ++ dma_len = ib_sg_dma_len(dev, &sg[0]); + riu = ioctx->rdma_ius; + + /* +@@ -1155,7 +1156,8 @@ static int srpt_map_sg_to_ib_sge(struct srpt_rdma_ch *ch, + ++j; + if (j < count) { + sg = sg_next(sg); +- dma_len = sg_dma_len(sg); ++ dma_len = ib_sg_dma_len( ++ dev, sg); + } + } + } else { +@@ -1192,8 +1194,8 @@ static int srpt_map_sg_to_ib_sge(struct srpt_rdma_ch *ch, + tsize = cmd->data_length; + riu = ioctx->rdma_ius; + sg = sg_orig; +- dma_len = sg_dma_len(&sg[0]); +- dma_addr = sg_dma_address(&sg[0]); ++ dma_len = ib_sg_dma_len(dev, &sg[0]); ++ dma_addr = ib_sg_dma_address(dev, &sg[0]); + + /* this second loop is really mapped sg_addres to rdma_iu->ib_sge */ + for (i = 0, j = 0; +@@ -1216,8 +1218,10 @@ static int srpt_map_sg_to_ib_sge(struct srpt_rdma_ch *ch, + ++j; + if (j < count) { + sg = sg_next(sg); +- dma_len = sg_dma_len(sg); +- dma_addr = sg_dma_address(sg); ++ dma_len = ib_sg_dma_len( ++ dev, sg); ++ dma_addr = ib_sg_dma_address( ++ dev, sg); + } + } + } else { +diff --git a/drivers/media/dvb-frontends/m88rs2000.c b/drivers/media/dvb-frontends/m88rs2000.c +index 02699c111019..c7a1c8eba475 100644 +--- a/drivers/media/dvb-frontends/m88rs2000.c ++++ b/drivers/media/dvb-frontends/m88rs2000.c +@@ -712,6 +712,22 @@ static int m88rs2000_get_frontend(struct dvb_frontend *fe) + return 0; + } + ++static int m88rs2000_get_tune_settings(struct dvb_frontend *fe, ++ struct dvb_frontend_tune_settings *tune) ++{ ++ struct dtv_frontend_properties *c = &fe->dtv_property_cache; ++ ++ if (c->symbol_rate > 3000000) ++ tune->min_delay_ms = 2000; ++ else ++ tune->min_delay_ms = 3000; ++ ++ tune->step_size = c->symbol_rate / 16000; ++ tune->max_drift = c->symbol_rate / 2000; ++ ++ return 0; ++} ++ + static int m88rs2000_i2c_gate_ctrl(struct dvb_frontend *fe, int enable) + { + struct m88rs2000_state *state = fe->demodulator_priv; +@@ -743,7 +759,7 @@ static struct dvb_frontend_ops m88rs2000_ops = { + .symbol_rate_tolerance = 500, /* ppm */ + .caps = FE_CAN_FEC_1_2 | FE_CAN_FEC_2_3 | FE_CAN_FEC_3_4 | + FE_CAN_FEC_5_6 | FE_CAN_FEC_7_8 | +- FE_CAN_QPSK | ++ FE_CAN_QPSK | FE_CAN_INVERSION_AUTO | + FE_CAN_FEC_AUTO + }, + +@@ -763,6 +779,7 @@ static struct dvb_frontend_ops m88rs2000_ops = { + + .set_frontend = m88rs2000_set_frontend, + .get_frontend = m88rs2000_get_frontend, ++ .get_tune_settings = m88rs2000_get_tune_settings, + }; + + struct dvb_frontend *m88rs2000_attach(const struct m88rs2000_config *config, +diff --git a/drivers/media/pci/saa7134/saa7134-cards.c b/drivers/media/pci/saa7134/saa7134-cards.c +index d45e7f6ff332..e87a734637a9 100644 +--- a/drivers/media/pci/saa7134/saa7134-cards.c ++++ b/drivers/media/pci/saa7134/saa7134-cards.c +@@ -8045,8 +8045,8 @@ int saa7134_board_init2(struct saa7134_dev *dev) + break; + } /* switch() */ + +- /* initialize tuner */ +- if (TUNER_ABSENT != dev->tuner_type) { ++ /* initialize tuner (don't do this when resuming) */ ++ if (!dev->insuspend && TUNER_ABSENT != dev->tuner_type) { + int has_demod = (dev->tda9887_conf & TDA9887_PRESENT); + + /* Note: radio tuner address is always filled in, +diff --git a/drivers/media/platform/omap3isp/isppreview.c b/drivers/media/platform/omap3isp/isppreview.c +index cd8831aebdeb..e2e4610d5550 100644 +--- a/drivers/media/platform/omap3isp/isppreview.c ++++ b/drivers/media/platform/omap3isp/isppreview.c +@@ -1079,6 +1079,7 @@ static void preview_config_input_format(struct isp_prev_device *prev, + */ + static void preview_config_input_size(struct isp_prev_device *prev, u32 active) + { ++ const struct v4l2_mbus_framefmt *format = &prev->formats[PREV_PAD_SINK]; + struct isp_device *isp = to_isp_device(prev); + unsigned int sph = prev->crop.left; + unsigned int eph = prev->crop.left + prev->crop.width - 1; +@@ -1086,6 +1087,14 @@ static void preview_config_input_size(struct isp_prev_device *prev, u32 active) + unsigned int elv = prev->crop.top + prev->crop.height - 1; + u32 features; + ++ if (format->code != V4L2_MBUS_FMT_Y8_1X8 && ++ format->code != V4L2_MBUS_FMT_Y10_1X10) { ++ sph -= 2; ++ eph += 2; ++ slv -= 2; ++ elv += 2; ++ } ++ + features = (prev->params.params[0].features & active) + | (prev->params.params[1].features & ~active); + +diff --git a/drivers/media/usb/em28xx/em28xx-dvb.c b/drivers/media/usb/em28xx/em28xx-dvb.c +index b22f8fed8127..c4d669648dc7 100644 +--- a/drivers/media/usb/em28xx/em28xx-dvb.c ++++ b/drivers/media/usb/em28xx/em28xx-dvb.c +@@ -673,7 +673,8 @@ static void pctv_520e_init(struct em28xx *dev) + static int em28xx_pctv_290e_set_lna(struct dvb_frontend *fe) + { + struct dtv_frontend_properties *c = &fe->dtv_property_cache; +- struct em28xx *dev = fe->dvb->priv; ++ struct em28xx_i2c_bus *i2c_bus = fe->dvb->priv; ++ struct em28xx *dev = i2c_bus->dev; + #ifdef CONFIG_GPIOLIB + struct em28xx_dvb *dvb = dev->dvb; + int ret; +diff --git a/drivers/media/usb/gspca/sn9c20x.c b/drivers/media/usb/gspca/sn9c20x.c +index ead9a1f58513..8b59e5d37bae 100644 +--- a/drivers/media/usb/gspca/sn9c20x.c ++++ b/drivers/media/usb/gspca/sn9c20x.c +@@ -2394,6 +2394,7 @@ static const struct usb_device_id device_table[] = { + {USB_DEVICE(0x045e, 0x00f4), SN9C20X(OV9650, 0x30, 0)}, + {USB_DEVICE(0x145f, 0x013d), SN9C20X(OV7660, 0x21, 0)}, + {USB_DEVICE(0x0458, 0x7029), SN9C20X(HV7131R, 0x11, 0)}, ++ {USB_DEVICE(0x0458, 0x7045), SN9C20X(MT9M112, 0x5d, LED_REVERSE)}, + {USB_DEVICE(0x0458, 0x704a), SN9C20X(MT9M112, 0x5d, 0)}, + {USB_DEVICE(0x0458, 0x704c), SN9C20X(MT9M112, 0x5d, 0)}, + {USB_DEVICE(0xa168, 0x0610), SN9C20X(HV7131R, 0x11, 0)}, +diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c +index 3394c3432011..e1c5bf3ea112 100644 +--- a/drivers/media/usb/uvc/uvc_video.c ++++ b/drivers/media/usb/uvc/uvc_video.c +@@ -1846,7 +1846,25 @@ int uvc_video_enable(struct uvc_streaming *stream, int enable) + + if (!enable) { + uvc_uninit_video(stream, 1); +- usb_set_interface(stream->dev->udev, stream->intfnum, 0); ++ if (stream->intf->num_altsetting > 1) { ++ usb_set_interface(stream->dev->udev, ++ stream->intfnum, 0); ++ } else { ++ /* UVC doesn't specify how to inform a bulk-based device ++ * when the video stream is stopped. Windows sends a ++ * CLEAR_FEATURE(HALT) request to the video streaming ++ * bulk endpoint, mimic the same behaviour. ++ */ ++ unsigned int epnum = stream->header.bEndpointAddress ++ & USB_ENDPOINT_NUMBER_MASK; ++ unsigned int dir = stream->header.bEndpointAddress ++ & USB_ENDPOINT_DIR_MASK; ++ unsigned int pipe; ++ ++ pipe = usb_sndbulkpipe(stream->dev->udev, epnum) | dir; ++ usb_clear_halt(stream->dev->udev, pipe); ++ } ++ + uvc_queue_enable(&stream->queue, 0); + uvc_video_clock_cleanup(stream); + return 0; +diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c +index f1295519f285..f56b729581e7 100644 +--- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c ++++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c +@@ -787,8 +787,8 @@ static int put_v4l2_subdev_edid32(struct v4l2_subdev_edid *kp, struct v4l2_subde + #define VIDIOC_DQBUF32 _IOWR('V', 17, struct v4l2_buffer32) + #define VIDIOC_ENUMSTD32 _IOWR('V', 25, struct v4l2_standard32) + #define VIDIOC_ENUMINPUT32 _IOWR('V', 26, struct v4l2_input32) +-#define VIDIOC_SUBDEV_G_EDID32 _IOWR('V', 63, struct v4l2_subdev_edid32) +-#define VIDIOC_SUBDEV_S_EDID32 _IOWR('V', 64, struct v4l2_subdev_edid32) ++#define VIDIOC_SUBDEV_G_EDID32 _IOWR('V', 40, struct v4l2_subdev_edid32) ++#define VIDIOC_SUBDEV_S_EDID32 _IOWR('V', 41, struct v4l2_subdev_edid32) + #define VIDIOC_TRY_FMT32 _IOWR('V', 64, struct v4l2_format32) + #define VIDIOC_G_EXT_CTRLS32 _IOWR('V', 71, struct v4l2_ext_controls32) + #define VIDIOC_S_EXT_CTRLS32 _IOWR('V', 72, struct v4l2_ext_controls32) +diff --git a/drivers/mfd/88pm860x-core.c b/drivers/mfd/88pm860x-core.c +index 31ca55548ef9..30cf7eef2a8f 100644 +--- a/drivers/mfd/88pm860x-core.c ++++ b/drivers/mfd/88pm860x-core.c +@@ -1179,12 +1179,18 @@ static int pm860x_probe(struct i2c_client *client, + chip->companion_addr = pdata->companion_addr; + chip->companion = i2c_new_dummy(chip->client->adapter, + chip->companion_addr); ++ if (!chip->companion) { ++ dev_err(&client->dev, ++ "Failed to allocate I2C companion device\n"); ++ return -ENODEV; ++ } + chip->regmap_companion = regmap_init_i2c(chip->companion, + &pm860x_regmap_config); + if (IS_ERR(chip->regmap_companion)) { + ret = PTR_ERR(chip->regmap_companion); + dev_err(&chip->companion->dev, + "Failed to allocate register map: %d\n", ret); ++ i2c_unregister_device(chip->companion); + return ret; + } + i2c_set_clientdata(chip->companion, chip); +diff --git a/drivers/mfd/max77686.c b/drivers/mfd/max77686.c +index 8290c2382395..1b6f45a14109 100644 +--- a/drivers/mfd/max77686.c ++++ b/drivers/mfd/max77686.c +@@ -121,6 +121,10 @@ static int max77686_i2c_probe(struct i2c_client *i2c, + dev_info(max77686->dev, "device found\n"); + + max77686->rtc = i2c_new_dummy(i2c->adapter, I2C_ADDR_RTC); ++ if (!max77686->rtc) { ++ dev_err(max77686->dev, "Failed to allocate I2C device for RTC\n"); ++ return -ENODEV; ++ } + i2c_set_clientdata(max77686->rtc, max77686); + + max77686_irq_init(max77686); +diff --git a/drivers/mfd/max77693.c b/drivers/mfd/max77693.c +index 9e60fed5ff82..299970f99588 100644 +--- a/drivers/mfd/max77693.c ++++ b/drivers/mfd/max77693.c +@@ -149,9 +149,18 @@ static int max77693_i2c_probe(struct i2c_client *i2c, + dev_info(max77693->dev, "device ID: 0x%x\n", reg_data); + + max77693->muic = i2c_new_dummy(i2c->adapter, I2C_ADDR_MUIC); ++ if (!max77693->muic) { ++ dev_err(max77693->dev, "Failed to allocate I2C device for MUIC\n"); ++ return -ENODEV; ++ } + i2c_set_clientdata(max77693->muic, max77693); + + max77693->haptic = i2c_new_dummy(i2c->adapter, I2C_ADDR_HAPTIC); ++ if (!max77693->haptic) { ++ dev_err(max77693->dev, "Failed to allocate I2C device for Haptic\n"); ++ ret = -ENODEV; ++ goto err_i2c_haptic; ++ } + i2c_set_clientdata(max77693->haptic, max77693); + + /* +@@ -187,8 +196,9 @@ err_mfd: + max77693_irq_exit(max77693); + err_irq: + err_regmap_muic: +- i2c_unregister_device(max77693->muic); + i2c_unregister_device(max77693->haptic); ++err_i2c_haptic: ++ i2c_unregister_device(max77693->muic); + return ret; + } + +diff --git a/drivers/mfd/max8925-i2c.c b/drivers/mfd/max8925-i2c.c +index 92bbebd31598..c94d3337bdfd 100644 +--- a/drivers/mfd/max8925-i2c.c ++++ b/drivers/mfd/max8925-i2c.c +@@ -180,9 +180,18 @@ static int max8925_probe(struct i2c_client *client, + mutex_init(&chip->io_lock); + + chip->rtc = i2c_new_dummy(chip->i2c->adapter, RTC_I2C_ADDR); ++ if (!chip->rtc) { ++ dev_err(chip->dev, "Failed to allocate I2C device for RTC\n"); ++ return -ENODEV; ++ } + i2c_set_clientdata(chip->rtc, chip); + + chip->adc = i2c_new_dummy(chip->i2c->adapter, ADC_I2C_ADDR); ++ if (!chip->adc) { ++ dev_err(chip->dev, "Failed to allocate I2C device for ADC\n"); ++ i2c_unregister_device(chip->rtc); ++ return -ENODEV; ++ } + i2c_set_clientdata(chip->adc, chip); + + device_init_wakeup(&client->dev, 1); +diff --git a/drivers/mfd/max8997.c b/drivers/mfd/max8997.c +index 14714058f2d2..ea1defbcf2cb 100644 +--- a/drivers/mfd/max8997.c ++++ b/drivers/mfd/max8997.c +@@ -218,10 +218,26 @@ static int max8997_i2c_probe(struct i2c_client *i2c, + mutex_init(&max8997->iolock); + + max8997->rtc = i2c_new_dummy(i2c->adapter, I2C_ADDR_RTC); ++ if (!max8997->rtc) { ++ dev_err(max8997->dev, "Failed to allocate I2C device for RTC\n"); ++ return -ENODEV; ++ } + i2c_set_clientdata(max8997->rtc, max8997); ++ + max8997->haptic = i2c_new_dummy(i2c->adapter, I2C_ADDR_HAPTIC); ++ if (!max8997->haptic) { ++ dev_err(max8997->dev, "Failed to allocate I2C device for Haptic\n"); ++ ret = -ENODEV; ++ goto err_i2c_haptic; ++ } + i2c_set_clientdata(max8997->haptic, max8997); ++ + max8997->muic = i2c_new_dummy(i2c->adapter, I2C_ADDR_MUIC); ++ if (!max8997->muic) { ++ dev_err(max8997->dev, "Failed to allocate I2C device for MUIC\n"); ++ ret = -ENODEV; ++ goto err_i2c_muic; ++ } + i2c_set_clientdata(max8997->muic, max8997); + + pm_runtime_set_active(max8997->dev); +@@ -248,7 +264,9 @@ static int max8997_i2c_probe(struct i2c_client *i2c, + err_mfd: + mfd_remove_devices(max8997->dev); + i2c_unregister_device(max8997->muic); ++err_i2c_muic: + i2c_unregister_device(max8997->haptic); ++err_i2c_haptic: + i2c_unregister_device(max8997->rtc); + err: + kfree(max8997); +diff --git a/drivers/mfd/max8998.c b/drivers/mfd/max8998.c +index d7218cc90945..8381a76c69c0 100644 +--- a/drivers/mfd/max8998.c ++++ b/drivers/mfd/max8998.c +@@ -152,6 +152,10 @@ static int max8998_i2c_probe(struct i2c_client *i2c, + mutex_init(&max8998->iolock); + + max8998->rtc = i2c_new_dummy(i2c->adapter, RTC_I2C_ADDR); ++ if (!max8998->rtc) { ++ dev_err(&i2c->dev, "Failed to allocate I2C device for RTC\n"); ++ return -ENODEV; ++ } + i2c_set_clientdata(max8998->rtc, max8998); + + max8998_irq_init(max8998); +diff --git a/drivers/mfd/sec-core.c b/drivers/mfd/sec-core.c +index 77ee26ef5941..81cfe8817fe0 100644 +--- a/drivers/mfd/sec-core.c ++++ b/drivers/mfd/sec-core.c +@@ -199,6 +199,10 @@ static int sec_pmic_probe(struct i2c_client *i2c, + } + + sec_pmic->rtc = i2c_new_dummy(i2c->adapter, RTC_I2C_ADDR); ++ if (!sec_pmic->rtc) { ++ dev_err(&i2c->dev, "Failed to allocate I2C for RTC\n"); ++ return -ENODEV; ++ } + i2c_set_clientdata(sec_pmic->rtc, sec_pmic); + + if (pdata && pdata->cfg_pmic_irq) +diff --git a/drivers/mfd/tps65910.c b/drivers/mfd/tps65910.c +index d79277204835..de87eafbeb05 100644 +--- a/drivers/mfd/tps65910.c ++++ b/drivers/mfd/tps65910.c +@@ -254,8 +254,10 @@ static int tps65910_irq_init(struct tps65910 *tps65910, int irq, + ret = regmap_add_irq_chip(tps65910->regmap, tps65910->chip_irq, + IRQF_ONESHOT, pdata->irq_base, + tps6591x_irqs_chip, &tps65910->irq_data); +- if (ret < 0) ++ if (ret < 0) { + dev_warn(tps65910->dev, "Failed to add irq_chip %d\n", ret); ++ tps65910->chip_irq = 0; ++ } + return ret; + } + +diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h +index 66f411a6e8ea..cabc04383685 100644 +--- a/drivers/misc/mei/hw-me-regs.h ++++ b/drivers/misc/mei/hw-me-regs.h +@@ -115,6 +115,11 @@ + #define MEI_DEV_ID_LPT_HR 0x8CBA /* Lynx Point H Refresh */ + + #define MEI_DEV_ID_WPT_LP 0x9CBA /* Wildcat Point LP */ ++ ++/* Host Firmware Status Registers in PCI Config Space */ ++#define PCI_CFG_HFS_1 0x40 ++#define PCI_CFG_HFS_2 0x48 ++ + /* + * MEI HW Section + */ +diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c +index 371c65ae6be6..3c9e257982e3 100644 +--- a/drivers/misc/mei/pci-me.c ++++ b/drivers/misc/mei/pci-me.c +@@ -105,15 +105,31 @@ static bool mei_me_quirk_probe(struct pci_dev *pdev, + const struct pci_device_id *ent) + { + u32 reg; +- if (ent->device == MEI_DEV_ID_PBG_1) { +- pci_read_config_dword(pdev, 0x48, ®); +- /* make sure that bit 9 is up and bit 10 is down */ +- if ((reg & 0x600) == 0x200) { +- dev_info(&pdev->dev, "Device doesn't have valid ME Interface\n"); +- return false; +- } ++ /* Cougar Point || Patsburg */ ++ if (ent->device == MEI_DEV_ID_CPT_1 || ++ ent->device == MEI_DEV_ID_PBG_1) { ++ pci_read_config_dword(pdev, PCI_CFG_HFS_2, ®); ++ /* make sure that bit 9 (NM) is up and bit 10 (DM) is down */ ++ if ((reg & 0x600) == 0x200) ++ goto no_mei; + } ++ ++ /* Lynx Point */ ++ if (ent->device == MEI_DEV_ID_LPT_H || ++ ent->device == MEI_DEV_ID_LPT_W || ++ ent->device == MEI_DEV_ID_LPT_HR) { ++ /* Read ME FW Status check for SPS Firmware */ ++ pci_read_config_dword(pdev, PCI_CFG_HFS_1, ®); ++ /* if bits [19:16] = 15, running SPS Firmware */ ++ if ((reg & 0xf0000) == 0xf0000) ++ goto no_mei; ++ } ++ + return true; ++ ++no_mei: ++ dev_info(&pdev->dev, "Device doesn't have valid ME Interface\n"); ++ return false; + } + /** + * mei_probe - Device Initialization Routine +diff --git a/drivers/s390/char/con3215.c b/drivers/s390/char/con3215.c +index eb5d22795c47..bb86494e2b7b 100644 +--- a/drivers/s390/char/con3215.c ++++ b/drivers/s390/char/con3215.c +@@ -922,7 +922,7 @@ static int __init con3215_init(void) + raw3215_freelist = req; + } + +- cdev = ccw_device_probe_console(); ++ cdev = ccw_device_probe_console(&raw3215_ccw_driver); + if (IS_ERR(cdev)) + return -ENODEV; + +diff --git a/drivers/s390/char/con3270.c b/drivers/s390/char/con3270.c +index 699fd3e363df..bb6b0df50b33 100644 +--- a/drivers/s390/char/con3270.c ++++ b/drivers/s390/char/con3270.c +@@ -576,7 +576,6 @@ static struct console con3270 = { + static int __init + con3270_init(void) + { +- struct ccw_device *cdev; + struct raw3270 *rp; + void *cbuf; + int i; +@@ -591,10 +590,7 @@ con3270_init(void) + cpcmd("TERM AUTOCR OFF", NULL, 0, NULL); + } + +- cdev = ccw_device_probe_console(); +- if (IS_ERR(cdev)) +- return -ENODEV; +- rp = raw3270_setup_console(cdev); ++ rp = raw3270_setup_console(); + if (IS_ERR(rp)) + return PTR_ERR(rp); + +diff --git a/drivers/s390/char/raw3270.c b/drivers/s390/char/raw3270.c +index 24a08e8f19e1..651d1f5da7c4 100644 +--- a/drivers/s390/char/raw3270.c ++++ b/drivers/s390/char/raw3270.c +@@ -776,16 +776,24 @@ raw3270_setup_device(struct ccw_device *cdev, struct raw3270 *rp, char *ascebc) + } + + #ifdef CONFIG_TN3270_CONSOLE ++/* Tentative definition - see below for actual definition. */ ++static struct ccw_driver raw3270_ccw_driver; ++ + /* + * Setup 3270 device configured as console. + */ +-struct raw3270 __init *raw3270_setup_console(struct ccw_device *cdev) ++struct raw3270 __init *raw3270_setup_console(void) + { ++ struct ccw_device *cdev; + unsigned long flags; + struct raw3270 *rp; + char *ascebc; + int rc; + ++ cdev = ccw_device_probe_console(&raw3270_ccw_driver); ++ if (IS_ERR(cdev)) ++ return ERR_CAST(cdev); ++ + rp = kzalloc(sizeof(struct raw3270), GFP_KERNEL | GFP_DMA); + ascebc = kzalloc(256, GFP_KERNEL); + rc = raw3270_setup_device(cdev, rp, ascebc); +diff --git a/drivers/s390/char/raw3270.h b/drivers/s390/char/raw3270.h +index 7b73ff8c1bd7..359276a88396 100644 +--- a/drivers/s390/char/raw3270.h ++++ b/drivers/s390/char/raw3270.h +@@ -190,7 +190,7 @@ raw3270_put_view(struct raw3270_view *view) + wake_up(&raw3270_wait_queue); + } + +-struct raw3270 *raw3270_setup_console(struct ccw_device *cdev); ++struct raw3270 *raw3270_setup_console(void); + void raw3270_wait_cons_dev(struct raw3270 *); + + /* Notifier for device addition/removal */ +diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c +index 1ab5f6c36d9b..8d04a9a88cc4 100644 +--- a/drivers/s390/cio/device.c ++++ b/drivers/s390/cio/device.c +@@ -1610,7 +1610,7 @@ out_unlock: + return rc; + } + +-struct ccw_device *ccw_device_probe_console(void) ++struct ccw_device *ccw_device_probe_console(struct ccw_driver *drv) + { + struct io_subchannel_private *io_priv; + struct ccw_device *cdev; +@@ -1632,6 +1632,7 @@ struct ccw_device *ccw_device_probe_console(void) + kfree(io_priv); + return cdev; + } ++ cdev->drv = drv; + set_io_private(sch, io_priv); + ret = ccw_device_console_enable(cdev, sch); + if (ret) { +diff --git a/drivers/scsi/arcmsr/arcmsr_hba.c b/drivers/scsi/arcmsr/arcmsr_hba.c +index 278c9fa62067..1822cb9ec623 100644 +--- a/drivers/scsi/arcmsr/arcmsr_hba.c ++++ b/drivers/scsi/arcmsr/arcmsr_hba.c +@@ -2501,16 +2501,15 @@ static int arcmsr_polling_ccbdone(struct AdapterControlBlock *acb, + static int arcmsr_iop_confirm(struct AdapterControlBlock *acb) + { + uint32_t cdb_phyaddr, cdb_phyaddr_hi32; +- dma_addr_t dma_coherent_handle; ++ + /* + ******************************************************************** + ** here we need to tell iop 331 our freeccb.HighPart + ** if freeccb.HighPart is not zero + ******************************************************************** + */ +- dma_coherent_handle = acb->dma_coherent_handle; +- cdb_phyaddr = (uint32_t)(dma_coherent_handle); +- cdb_phyaddr_hi32 = (uint32_t)((cdb_phyaddr >> 16) >> 16); ++ cdb_phyaddr = lower_32_bits(acb->dma_coherent_handle); ++ cdb_phyaddr_hi32 = upper_32_bits(acb->dma_coherent_handle); + acb->cdb_phyaddr_hi32 = cdb_phyaddr_hi32; + /* + *********************************************************************** +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c +index ad72c1d85111..66c495d21016 100644 +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -2553,7 +2553,7 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id) + ha->flags.enable_64bit_addressing ? "enable" : + "disable"); + ret = qla2x00_mem_alloc(ha, req_length, rsp_length, &req, &rsp); +- if (!ret) { ++ if (ret) { + ql_log_pci(ql_log_fatal, pdev, 0x0031, + "Failed to allocate memory for adapter, aborting.\n"); + +@@ -3458,10 +3458,10 @@ qla2x00_mem_alloc(struct qla_hw_data *ha, uint16_t req_len, uint16_t rsp_len, + else { + qla2x00_set_reserved_loop_ids(ha); + ql_dbg_pci(ql_dbg_init, ha->pdev, 0x0123, +- "loop_id_map=%p. \n", ha->loop_id_map); ++ "loop_id_map=%p.\n", ha->loop_id_map); + } + +- return 1; ++ return 0; + + fail_async_pd: + dma_pool_free(ha->s_dma_pool, ha->ex_init_cb, ha->ex_init_cb_dma); +diff --git a/drivers/staging/rtl8712/rtl871x_recv.c b/drivers/staging/rtl8712/rtl871x_recv.c +index 23ec684b60e1..274c359279ef 100644 +--- a/drivers/staging/rtl8712/rtl871x_recv.c ++++ b/drivers/staging/rtl8712/rtl871x_recv.c +@@ -254,7 +254,7 @@ union recv_frame *r8712_portctrl(struct _adapter *adapter, + struct sta_info *psta; + struct sta_priv *pstapriv; + union recv_frame *prtnframe; +- u16 ether_type = 0; ++ u16 ether_type; + + pstapriv = &adapter->stapriv; + ptr = get_recvframe_data(precv_frame); +@@ -263,15 +263,14 @@ union recv_frame *r8712_portctrl(struct _adapter *adapter, + psta = r8712_get_stainfo(pstapriv, psta_addr); + auth_alg = adapter->securitypriv.AuthAlgrthm; + if (auth_alg == 2) { ++ /* get ether_type */ ++ ptr = ptr + pfhdr->attrib.hdrlen + LLC_HEADER_SIZE; ++ memcpy(ðer_type, ptr, 2); ++ ether_type = ntohs((unsigned short)ether_type); ++ + if ((psta != NULL) && (psta->ieee8021x_blocked)) { + /* blocked + * only accept EAPOL frame */ +- prtnframe = precv_frame; +- /*get ether_type */ +- ptr = ptr + pfhdr->attrib.hdrlen + +- pfhdr->attrib.iv_len + LLC_HEADER_SIZE; +- memcpy(ðer_type, ptr, 2); +- ether_type = ntohs((unsigned short)ether_type); + if (ether_type == 0x888e) + prtnframe = precv_frame; + else { +diff --git a/drivers/staging/serqt_usb2/serqt_usb2.c b/drivers/staging/serqt_usb2/serqt_usb2.c +index 8a6e5ea476e1..380d9d707109 100644 +--- a/drivers/staging/serqt_usb2/serqt_usb2.c ++++ b/drivers/staging/serqt_usb2/serqt_usb2.c +@@ -725,7 +725,7 @@ static int qt_startup(struct usb_serial *serial) + goto startup_error; + } + +- switch (serial->dev->descriptor.idProduct) { ++ switch (le16_to_cpu(serial->dev->descriptor.idProduct)) { + case QUATECH_DSU100: + case QUATECH_QSU100: + case QUATECH_ESU100A: +diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c +index 5232ac7b0745..58c479d13b57 100644 +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -2454,6 +2454,7 @@ static void iscsit_build_conn_drop_async_message(struct iscsi_conn *conn) + { + struct iscsi_cmd *cmd; + struct iscsi_conn *conn_p; ++ bool found = false; + + /* + * Only send a Asynchronous Message on connections whos network +@@ -2462,11 +2463,12 @@ static void iscsit_build_conn_drop_async_message(struct iscsi_conn *conn) + list_for_each_entry(conn_p, &conn->sess->sess_conn_list, conn_list) { + if (conn_p->conn_state == TARG_CONN_STATE_LOGGED_IN) { + iscsit_inc_conn_usage_count(conn_p); ++ found = true; + break; + } + } + +- if (!conn_p) ++ if (!found) + return; + + cmd = iscsit_allocate_cmd(conn_p, GFP_ATOMIC); +diff --git a/drivers/target/tcm_fc/tfc_sess.c b/drivers/target/tcm_fc/tfc_sess.c +index 4859505ae2ed..639fdb395fb7 100644 +--- a/drivers/target/tcm_fc/tfc_sess.c ++++ b/drivers/target/tcm_fc/tfc_sess.c +@@ -68,6 +68,7 @@ static struct ft_tport *ft_tport_create(struct fc_lport *lport) + + if (tport) { + tport->tpg = tpg; ++ tpg->tport = tport; + return tport; + } + +diff --git a/drivers/tty/hvc/hvc_console.c b/drivers/tty/hvc/hvc_console.c +index eb255e807c06..a2a2645b296c 100644 +--- a/drivers/tty/hvc/hvc_console.c ++++ b/drivers/tty/hvc/hvc_console.c +@@ -31,6 +31,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -70,6 +71,9 @@ static struct task_struct *hvc_task; + /* Picks up late kicks after list walk but before schedule() */ + static int hvc_kicked; + ++/* hvc_init is triggered from hvc_alloc, i.e. only when actually used */ ++static atomic_t hvc_needs_init __read_mostly = ATOMIC_INIT(-1); ++ + static int hvc_init(void); + + #ifdef CONFIG_MAGIC_SYSRQ +@@ -842,7 +846,7 @@ struct hvc_struct *hvc_alloc(uint32_t vtermno, int data, + int i; + + /* We wait until a driver actually comes along */ +- if (!hvc_driver) { ++ if (atomic_inc_not_zero(&hvc_needs_init)) { + int err = hvc_init(); + if (err) + return ERR_PTR(err); +diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c +index 6eab440e1542..4ed35231e552 100644 +--- a/drivers/usb/core/driver.c ++++ b/drivers/usb/core/driver.c +@@ -953,8 +953,7 @@ EXPORT_SYMBOL_GPL(usb_deregister); + * it doesn't support pre_reset/post_reset/reset_resume or + * because it doesn't support suspend/resume. + * +- * The caller must hold @intf's device's lock, but not its pm_mutex +- * and not @intf->dev.sem. ++ * The caller must hold @intf's device's lock, but not @intf's lock. + */ + void usb_forced_unbind_intf(struct usb_interface *intf) + { +@@ -967,16 +966,37 @@ void usb_forced_unbind_intf(struct usb_interface *intf) + intf->needs_binding = 1; + } + ++/* ++ * Unbind drivers for @udev's marked interfaces. These interfaces have ++ * the needs_binding flag set, for example by usb_resume_interface(). ++ * ++ * The caller must hold @udev's device lock. ++ */ ++static void unbind_marked_interfaces(struct usb_device *udev) ++{ ++ struct usb_host_config *config; ++ int i; ++ struct usb_interface *intf; ++ ++ config = udev->actconfig; ++ if (config) { ++ for (i = 0; i < config->desc.bNumInterfaces; ++i) { ++ intf = config->interface[i]; ++ if (intf->dev.driver && intf->needs_binding) ++ usb_forced_unbind_intf(intf); ++ } ++ } ++} ++ + /* Delayed forced unbinding of a USB interface driver and scan + * for rebinding. + * +- * The caller must hold @intf's device's lock, but not its pm_mutex +- * and not @intf->dev.sem. ++ * The caller must hold @intf's device's lock, but not @intf's lock. + * + * Note: Rebinds will be skipped if a system sleep transition is in + * progress and the PM "complete" callback hasn't occurred yet. + */ +-void usb_rebind_intf(struct usb_interface *intf) ++static void usb_rebind_intf(struct usb_interface *intf) + { + int rc; + +@@ -993,68 +1013,66 @@ void usb_rebind_intf(struct usb_interface *intf) + } + } + +-#ifdef CONFIG_PM +- +-/* Unbind drivers for @udev's interfaces that don't support suspend/resume +- * There is no check for reset_resume here because it can be determined +- * only during resume whether reset_resume is needed. ++/* ++ * Rebind drivers to @udev's marked interfaces. These interfaces have ++ * the needs_binding flag set. + * + * The caller must hold @udev's device lock. + */ +-static void unbind_no_pm_drivers_interfaces(struct usb_device *udev) ++static void rebind_marked_interfaces(struct usb_device *udev) + { + struct usb_host_config *config; + int i; + struct usb_interface *intf; +- struct usb_driver *drv; + + config = udev->actconfig; + if (config) { + for (i = 0; i < config->desc.bNumInterfaces; ++i) { + intf = config->interface[i]; +- +- if (intf->dev.driver) { +- drv = to_usb_driver(intf->dev.driver); +- if (!drv->suspend || !drv->resume) +- usb_forced_unbind_intf(intf); +- } ++ if (intf->needs_binding) ++ usb_rebind_intf(intf); + } + } + } + +-/* Unbind drivers for @udev's interfaces that failed to support reset-resume. +- * These interfaces have the needs_binding flag set by usb_resume_interface(). ++/* ++ * Unbind all of @udev's marked interfaces and then rebind all of them. ++ * This ordering is necessary because some drivers claim several interfaces ++ * when they are first probed. + * + * The caller must hold @udev's device lock. + */ +-static void unbind_no_reset_resume_drivers_interfaces(struct usb_device *udev) ++void usb_unbind_and_rebind_marked_interfaces(struct usb_device *udev) + { +- struct usb_host_config *config; +- int i; +- struct usb_interface *intf; +- +- config = udev->actconfig; +- if (config) { +- for (i = 0; i < config->desc.bNumInterfaces; ++i) { +- intf = config->interface[i]; +- if (intf->dev.driver && intf->needs_binding) +- usb_forced_unbind_intf(intf); +- } +- } ++ unbind_marked_interfaces(udev); ++ rebind_marked_interfaces(udev); + } + +-static void do_rebind_interfaces(struct usb_device *udev) ++#ifdef CONFIG_PM ++ ++/* Unbind drivers for @udev's interfaces that don't support suspend/resume ++ * There is no check for reset_resume here because it can be determined ++ * only during resume whether reset_resume is needed. ++ * ++ * The caller must hold @udev's device lock. ++ */ ++static void unbind_no_pm_drivers_interfaces(struct usb_device *udev) + { + struct usb_host_config *config; + int i; + struct usb_interface *intf; ++ struct usb_driver *drv; + + config = udev->actconfig; + if (config) { + for (i = 0; i < config->desc.bNumInterfaces; ++i) { + intf = config->interface[i]; +- if (intf->needs_binding) +- usb_rebind_intf(intf); ++ ++ if (intf->dev.driver) { ++ drv = to_usb_driver(intf->dev.driver); ++ if (!drv->suspend || !drv->resume) ++ usb_forced_unbind_intf(intf); ++ } + } + } + } +@@ -1379,7 +1397,7 @@ int usb_resume_complete(struct device *dev) + * whose needs_binding flag is set + */ + if (udev->state != USB_STATE_NOTATTACHED) +- do_rebind_interfaces(udev); ++ rebind_marked_interfaces(udev); + return 0; + } + +@@ -1401,7 +1419,7 @@ int usb_resume(struct device *dev, pm_message_t msg) + pm_runtime_disable(dev); + pm_runtime_set_active(dev); + pm_runtime_enable(dev); +- unbind_no_reset_resume_drivers_interfaces(udev); ++ unbind_marked_interfaces(udev); + } + + /* Avoid PM error messages for devices disconnected while suspended +diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c +index caeb8d6d39fb..4676917e2b1f 100644 +--- a/drivers/usb/core/hcd-pci.c ++++ b/drivers/usb/core/hcd-pci.c +@@ -75,7 +75,7 @@ static void for_each_companion(struct pci_dev *pdev, struct usb_hcd *hcd, + PCI_SLOT(companion->devfn) != slot) + continue; + companion_hcd = pci_get_drvdata(companion); +- if (!companion_hcd) ++ if (!companion_hcd || !companion_hcd->self.root_hub) + continue; + fn(pdev, hcd, companion, companion_hcd); + } +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index 3a2eb4cc8959..a036e03ae1b3 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -5252,10 +5252,11 @@ int usb_reset_device(struct usb_device *udev) + else if (cintf->condition == + USB_INTERFACE_BOUND) + rebind = 1; ++ if (rebind) ++ cintf->needs_binding = 1; + } +- if (ret == 0 && rebind) +- usb_rebind_intf(cintf); + } ++ usb_unbind_and_rebind_marked_interfaces(udev); + } + + usb_autosuspend_device(udev); +diff --git a/drivers/usb/core/usb.h b/drivers/usb/core/usb.h +index 823857767a16..0923add72b59 100644 +--- a/drivers/usb/core/usb.h ++++ b/drivers/usb/core/usb.h +@@ -55,7 +55,7 @@ extern int usb_match_one_id_intf(struct usb_device *dev, + extern int usb_match_device(struct usb_device *dev, + const struct usb_device_id *id); + extern void usb_forced_unbind_intf(struct usb_interface *intf); +-extern void usb_rebind_intf(struct usb_interface *intf); ++extern void usb_unbind_and_rebind_marked_interfaces(struct usb_device *udev); + + extern int usb_hub_claim_port(struct usb_device *hdev, unsigned port, + struct dev_state *owner); +diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h +index 27dad993b007..7ab3c9985253 100644 +--- a/drivers/usb/dwc3/core.h ++++ b/drivers/usb/dwc3/core.h +@@ -836,15 +836,15 @@ struct dwc3_event_depevt { + * 12 - VndrDevTstRcved + * @reserved15_12: Reserved, not used + * @event_info: Information about this event +- * @reserved31_24: Reserved, not used ++ * @reserved31_25: Reserved, not used + */ + struct dwc3_event_devt { + u32 one_bit:1; + u32 device_event:7; + u32 type:4; + u32 reserved15_12:4; +- u32 event_info:8; +- u32 reserved31_24:8; ++ u32 event_info:9; ++ u32 reserved31_25:7; + } __packed; + + /** +diff --git a/drivers/usb/gadget/tcm_usb_gadget.c b/drivers/usb/gadget/tcm_usb_gadget.c +index 7cacd6ae818e..e4d8d79a4993 100644 +--- a/drivers/usb/gadget/tcm_usb_gadget.c ++++ b/drivers/usb/gadget/tcm_usb_gadget.c +@@ -1614,7 +1614,7 @@ static struct se_wwn *usbg_make_tport( + return ERR_PTR(-ENOMEM); + } + tport->tport_wwpn = wwpn; +- snprintf(tport->tport_name, sizeof(tport->tport_name), wnn_name); ++ snprintf(tport->tport_name, sizeof(tport->tport_name), "%s", wnn_name); + return &tport->tport_wwn; + } + +diff --git a/drivers/usb/gadget/zero.c b/drivers/usb/gadget/zero.c +index 0deb9d6cde26..d31814c7238f 100644 +--- a/drivers/usb/gadget/zero.c ++++ b/drivers/usb/gadget/zero.c +@@ -280,7 +280,7 @@ static int __init zero_bind(struct usb_composite_dev *cdev) + ss_opts->isoc_interval = gzero_options.isoc_interval; + ss_opts->isoc_maxpacket = gzero_options.isoc_maxpacket; + ss_opts->isoc_mult = gzero_options.isoc_mult; +- ss_opts->isoc_maxburst = gzero_options.isoc_maxpacket; ++ ss_opts->isoc_maxburst = gzero_options.isoc_maxburst; + ss_opts->bulk_buflen = gzero_options.bulk_buflen; + + func_ss = usb_get_function(func_inst_ss); +diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c +index 3581416a24d8..a736d82695cb 100644 +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -114,9 +114,7 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) + xhci->quirks |= XHCI_TRUST_TX_LENGTH; + } + if (pdev->vendor == PCI_VENDOR_ID_RENESAS && +- pdev->device == 0x0015 && +- pdev->subsystem_vendor == PCI_VENDOR_ID_SAMSUNG && +- pdev->subsystem_device == 0xc0cd) ++ pdev->device == 0x0015) + xhci->quirks |= XHCI_RESET_ON_RESUME; + if (pdev->vendor == PCI_VENDOR_ID_VIA) + xhci->quirks |= XHCI_RESET_ON_RESUME; +@@ -161,6 +159,10 @@ static int xhci_pci_probe(struct pci_dev *dev, const struct pci_device_id *id) + struct usb_hcd *hcd; + + driver = (struct hc_driver *)id->driver_data; ++ ++ /* Prevent runtime suspending between USB-2 and USB-3 initialization */ ++ pm_runtime_get_noresume(&dev->dev); ++ + /* Register the USB 2.0 roothub. + * FIXME: USB core must know to register the USB 2.0 roothub first. + * This is sort of silly, because we could just set the HCD driver flags +@@ -170,7 +172,7 @@ static int xhci_pci_probe(struct pci_dev *dev, const struct pci_device_id *id) + retval = usb_hcd_pci_probe(dev, id); + + if (retval) +- return retval; ++ goto put_runtime_pm; + + /* USB 2.0 roothub is stored in the PCI device now. */ + hcd = dev_get_drvdata(&dev->dev); +@@ -199,12 +201,17 @@ static int xhci_pci_probe(struct pci_dev *dev, const struct pci_device_id *id) + if (xhci->quirks & XHCI_LPM_SUPPORT) + hcd_to_bus(xhci->shared_hcd)->root_hub->lpm_capable = 1; + ++ /* USB-2 and USB-3 roothubs initialized, allow runtime pm suspend */ ++ pm_runtime_put_noidle(&dev->dev); ++ + return 0; + + put_usb3_hcd: + usb_put_hcd(xhci->shared_hcd); + dealloc_usb2_hcd: + usb_hcd_pci_remove(dev); ++put_runtime_pm: ++ pm_runtime_put_noidle(&dev->dev); + return retval; + } + +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index a90819b83224..4b46de842175 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -394,16 +394,16 @@ static int xhci_try_enable_msi(struct usb_hcd *hcd) + + #else + +-static int xhci_try_enable_msi(struct usb_hcd *hcd) ++static inline int xhci_try_enable_msi(struct usb_hcd *hcd) + { + return 0; + } + +-static void xhci_cleanup_msix(struct xhci_hcd *xhci) ++static inline void xhci_cleanup_msix(struct xhci_hcd *xhci) + { + } + +-static void xhci_msix_sync_irqs(struct xhci_hcd *xhci) ++static inline void xhci_msix_sync_irqs(struct xhci_hcd *xhci) + { + } + +diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c +index 37a261a6bb6a..da0caf3f4b27 100644 +--- a/drivers/usb/musb/musb_core.c ++++ b/drivers/usb/musb/musb_core.c +@@ -440,7 +440,6 @@ void musb_hnp_stop(struct musb *musb) + static irqreturn_t musb_stage0_irq(struct musb *musb, u8 int_usb, + u8 devctl) + { +- struct usb_otg *otg = musb->xceiv->otg; + irqreturn_t handled = IRQ_NONE; + + dev_dbg(musb->controller, "<== DevCtl=%02x, int_usb=0x%x\n", devctl, +@@ -655,7 +654,7 @@ static irqreturn_t musb_stage0_irq(struct musb *musb, u8 int_usb, + break; + case OTG_STATE_B_PERIPHERAL: + musb_g_suspend(musb); +- musb->is_active = otg->gadget->b_hnp_enable; ++ musb->is_active = musb->g.b_hnp_enable; + if (musb->is_active) { + musb->xceiv->state = OTG_STATE_B_WAIT_ACON; + dev_dbg(musb->controller, "HNP: Setting timer for b_ase0_brst\n"); +@@ -671,7 +670,7 @@ static irqreturn_t musb_stage0_irq(struct musb *musb, u8 int_usb, + break; + case OTG_STATE_A_HOST: + musb->xceiv->state = OTG_STATE_A_SUSPEND; +- musb->is_active = otg->host->b_hnp_enable; ++ musb->is_active = musb_to_hcd(musb)->self.b_hnp_enable; + break; + case OTG_STATE_B_HOST: + /* Transition to B_PERIPHERAL, see 6.8.2.6 p 44 */ +diff --git a/drivers/usb/phy/phy-ulpi.c b/drivers/usb/phy/phy-ulpi.c +index 217339dd7a90..17ea3f271bd8 100644 +--- a/drivers/usb/phy/phy-ulpi.c ++++ b/drivers/usb/phy/phy-ulpi.c +@@ -47,6 +47,8 @@ struct ulpi_info { + static struct ulpi_info ulpi_ids[] = { + ULPI_INFO(ULPI_ID(0x04cc, 0x1504), "NXP ISP1504"), + ULPI_INFO(ULPI_ID(0x0424, 0x0006), "SMSC USB331x"), ++ ULPI_INFO(ULPI_ID(0x0424, 0x0007), "SMSC USB3320"), ++ ULPI_INFO(ULPI_ID(0x0451, 0x1507), "TI TUSB1210"), + }; + + static int ulpi_set_otg_flags(struct usb_phy *phy) +diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c +index 4471f464ca26..a0b58e252073 100644 +--- a/drivers/usb/serial/pl2303.c ++++ b/drivers/usb/serial/pl2303.c +@@ -82,6 +82,9 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(YCCABLE_VENDOR_ID, YCCABLE_PRODUCT_ID) }, + { USB_DEVICE(SUPERIAL_VENDOR_ID, SUPERIAL_PRODUCT_ID) }, + { USB_DEVICE(HP_VENDOR_ID, HP_LD220_PRODUCT_ID) }, ++ { USB_DEVICE(HP_VENDOR_ID, HP_LD960_PRODUCT_ID) }, ++ { USB_DEVICE(HP_VENDOR_ID, HP_LCM220_PRODUCT_ID) }, ++ { USB_DEVICE(HP_VENDOR_ID, HP_LCM960_PRODUCT_ID) }, + { USB_DEVICE(CRESSI_VENDOR_ID, CRESSI_EDY_PRODUCT_ID) }, + { USB_DEVICE(ZEAGLE_VENDOR_ID, ZEAGLE_N2ITION3_PRODUCT_ID) }, + { USB_DEVICE(SONY_VENDOR_ID, SONY_QN3USB_PRODUCT_ID) }, +diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h +index c38b8c00c06f..42bc082896ac 100644 +--- a/drivers/usb/serial/pl2303.h ++++ b/drivers/usb/serial/pl2303.h +@@ -121,8 +121,11 @@ + #define SUPERIAL_VENDOR_ID 0x5372 + #define SUPERIAL_PRODUCT_ID 0x2303 + +-/* Hewlett-Packard LD220-HP POS Pole Display */ ++/* Hewlett-Packard POS Pole Displays */ + #define HP_VENDOR_ID 0x03f0 ++#define HP_LD960_PRODUCT_ID 0x0b39 ++#define HP_LCM220_PRODUCT_ID 0x3139 ++#define HP_LCM960_PRODUCT_ID 0x3239 + #define HP_LD220_PRODUCT_ID 0x3524 + + /* Cressi Edy (diving computer) PC interface */ +diff --git a/drivers/w1/w1_netlink.c b/drivers/w1/w1_netlink.c +index 40788c925d1c..73705aff53cb 100644 +--- a/drivers/w1/w1_netlink.c ++++ b/drivers/w1/w1_netlink.c +@@ -54,28 +54,29 @@ static void w1_send_slave(struct w1_master *dev, u64 rn) + struct w1_netlink_msg *hdr = (struct w1_netlink_msg *)(msg + 1); + struct w1_netlink_cmd *cmd = (struct w1_netlink_cmd *)(hdr + 1); + int avail; ++ u64 *data; + + /* update kernel slave list */ + w1_slave_found(dev, rn); + + avail = dev->priv_size - cmd->len; + +- if (avail > 8) { +- u64 *data = (void *)(cmd + 1) + cmd->len; ++ if (avail < 8) { ++ msg->ack++; ++ cn_netlink_send(msg, 0, GFP_KERNEL); + +- *data = rn; +- cmd->len += 8; +- hdr->len += 8; +- msg->len += 8; +- return; ++ msg->len = sizeof(struct w1_netlink_msg) + ++ sizeof(struct w1_netlink_cmd); ++ hdr->len = sizeof(struct w1_netlink_cmd); ++ cmd->len = 0; + } + +- msg->ack++; +- cn_netlink_send(msg, 0, GFP_KERNEL); ++ data = (void *)(cmd + 1) + cmd->len; + +- msg->len = sizeof(struct w1_netlink_msg) + sizeof(struct w1_netlink_cmd); +- hdr->len = sizeof(struct w1_netlink_cmd); +- cmd->len = 0; ++ *data = rn; ++ cmd->len += 8; ++ hdr->len += 8; ++ msg->len += 8; + } + + static int w1_process_search_command(struct w1_master *dev, struct cn_msg *msg, +diff --git a/fs/ext4/file.c b/fs/ext4/file.c +index b19f0a457f32..4635788e14bf 100644 +--- a/fs/ext4/file.c ++++ b/fs/ext4/file.c +@@ -82,7 +82,7 @@ ext4_unaligned_aio(struct inode *inode, const struct iovec *iov, + size_t count = iov_length(iov, nr_segs); + loff_t final_size = pos + count; + +- if (pos >= inode->i_size) ++ if (pos >= i_size_read(inode)) + return 0; + + if ((pos & blockmask) || (final_size & blockmask)) +diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c +index 1423c4816a47..298e9c8da364 100644 +--- a/fs/ext4/xattr.c ++++ b/fs/ext4/xattr.c +@@ -517,8 +517,8 @@ static void ext4_xattr_update_super_block(handle_t *handle, + } + + /* +- * Release the xattr block BH: If the reference count is > 1, decrement +- * it; otherwise free the block. ++ * Release the xattr block BH: If the reference count is > 1, decrement it; ++ * otherwise free the block. + */ + static void + ext4_xattr_release_block(handle_t *handle, struct inode *inode, +@@ -538,16 +538,31 @@ ext4_xattr_release_block(handle_t *handle, struct inode *inode, + if (ce) + mb_cache_entry_free(ce); + get_bh(bh); ++ unlock_buffer(bh); + ext4_free_blocks(handle, inode, bh, 0, 1, + EXT4_FREE_BLOCKS_METADATA | + EXT4_FREE_BLOCKS_FORGET); +- unlock_buffer(bh); + } else { + le32_add_cpu(&BHDR(bh)->h_refcount, -1); + if (ce) + mb_cache_entry_release(ce); ++ /* ++ * Beware of this ugliness: Releasing of xattr block references ++ * from different inodes can race and so we have to protect ++ * from a race where someone else frees the block (and releases ++ * its journal_head) before we are done dirtying the buffer. In ++ * nojournal mode this race is harmless and we actually cannot ++ * call ext4_handle_dirty_xattr_block() with locked buffer as ++ * that function can call sync_dirty_buffer() so for that case ++ * we handle the dirtying after unlocking the buffer. ++ */ ++ if (ext4_handle_valid(handle)) ++ error = ext4_handle_dirty_xattr_block(handle, inode, ++ bh); + unlock_buffer(bh); +- error = ext4_handle_dirty_xattr_block(handle, inode, bh); ++ if (!ext4_handle_valid(handle)) ++ error = ext4_handle_dirty_xattr_block(handle, inode, ++ bh); + if (IS_SYNC(inode)) + ext4_handle_sync(handle); + dquot_free_block(inode, EXT4_C2B(EXT4_SB(inode->i_sb), 1)); +diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c +index 7f05cd140de3..3eaa6e30a2dc 100644 +--- a/fs/nfsd/nfs4callback.c ++++ b/fs/nfsd/nfs4callback.c +@@ -637,9 +637,11 @@ static struct rpc_cred *get_backchannel_cred(struct nfs4_client *clp, struct rpc + + static int setup_callback_client(struct nfs4_client *clp, struct nfs4_cb_conn *conn, struct nfsd4_session *ses) + { ++ int maxtime = max_cb_time(clp->net); + struct rpc_timeout timeparms = { +- .to_initval = max_cb_time(clp->net), ++ .to_initval = maxtime, + .to_retries = 0, ++ .to_maxval = maxtime, + }; + struct rpc_create_args args = { + .net = clp->net, +diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c +index 27d74a294515..f7d7d04674fb 100644 +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -1307,6 +1307,12 @@ nfsd4_proc_compound(struct svc_rqst *rqstp, + /* If op is non-idempotent */ + if (opdesc->op_flags & OP_MODIFIES_SOMETHING) { + plen = opdesc->op_rsize_bop(rqstp, op); ++ /* ++ * If there's still another operation, make sure ++ * we'll have space to at least encode an error: ++ */ ++ if (resp->opcnt < args->opcnt) ++ plen += COMPOUND_ERR_SLACK_SPACE; + op->status = nfsd4_check_resp_size(resp, plen); + } + +@@ -1471,7 +1477,8 @@ static inline u32 nfsd4_setattr_rsize(struct svc_rqst *rqstp, struct nfsd4_op *o + + static inline u32 nfsd4_setclientid_rsize(struct svc_rqst *rqstp, struct nfsd4_op *op) + { +- return (op_encode_hdr_size + 2 + 1024) * sizeof(__be32); ++ return (op_encode_hdr_size + 2 + XDR_QUADLEN(NFS4_VERIFIER_SIZE)) * ++ sizeof(__be32); + } + + static inline u32 nfsd4_write_rsize(struct svc_rqst *rqstp, struct nfsd4_op *op) +diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c +index 316ec843dec2..442509285ca9 100644 +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -4958,7 +4958,6 @@ nfs4_state_destroy_net(struct net *net) + int i; + struct nfs4_client *clp = NULL; + struct nfsd_net *nn = net_generic(net, nfsd_net_id); +- struct rb_node *node, *tmp; + + for (i = 0; i < CLIENT_HASH_SIZE; i++) { + while (!list_empty(&nn->conf_id_hashtbl[i])) { +@@ -4967,13 +4966,11 @@ nfs4_state_destroy_net(struct net *net) + } + } + +- node = rb_first(&nn->unconf_name_tree); +- while (node != NULL) { +- tmp = node; +- node = rb_next(tmp); +- clp = rb_entry(tmp, struct nfs4_client, cl_namenode); +- rb_erase(tmp, &nn->unconf_name_tree); +- destroy_client(clp); ++ for (i = 0; i < CLIENT_HASH_SIZE; i++) { ++ while (!list_empty(&nn->unconf_id_hashtbl[i])) { ++ clp = list_entry(nn->unconf_id_hashtbl[i].next, struct nfs4_client, cl_idhash); ++ destroy_client(clp); ++ } + } + + kfree(nn->sessionid_hashtbl); +diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c +index 582321a978b0..5188a38fef06 100644 +--- a/fs/nfsd/nfs4xdr.c ++++ b/fs/nfsd/nfs4xdr.c +@@ -2401,6 +2401,8 @@ out_acl: + WRITE64(stat.ino); + } + if (bmval2 & FATTR4_WORD2_SUPPATTR_EXCLCREAT) { ++ if ((buflen -= 16) < 0) ++ goto out_resource; + WRITE32(3); + WRITE32(NFSD_SUPPATTR_EXCLCREAT_WORD0); + WRITE32(NFSD_SUPPATTR_EXCLCREAT_WORD1); +@@ -3382,6 +3384,9 @@ nfsd4_encode_test_stateid(struct nfsd4_compoundres *resp, __be32 nfserr, + struct nfsd4_test_stateid_id *stateid, *next; + __be32 *p; + ++ if (nfserr) ++ return nfserr; ++ + RESERVE_SPACE(4 + (4 * test_stateid->ts_num_ids)); + *p++ = htonl(test_stateid->ts_num_ids); + +diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c +index 7f555179bf81..f34d9de802ab 100644 +--- a/fs/nfsd/nfsctl.c ++++ b/fs/nfsd/nfsctl.c +@@ -699,6 +699,11 @@ static ssize_t __write_ports_addfd(char *buf, struct net *net) + if (err != 0 || fd < 0) + return -EINVAL; + ++ if (svc_alien_sock(net, fd)) { ++ printk(KERN_ERR "%s: socket net is different to NFSd's one\n", __func__); ++ return -EINVAL; ++ } ++ + err = nfsd_create_serv(net); + if (err != 0) + return err; +diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c +index 62fd6616801d..d9b298cbfe5c 100644 +--- a/fs/nfsd/vfs.c ++++ b/fs/nfsd/vfs.c +@@ -406,6 +406,7 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap, + umode_t ftype = 0; + __be32 err; + int host_err; ++ bool get_write_count; + int size_change = 0; + + if (iap->ia_valid & (ATTR_ATIME | ATTR_MTIME | ATTR_SIZE)) +@@ -413,10 +414,18 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap, + if (iap->ia_valid & ATTR_SIZE) + ftype = S_IFREG; + ++ /* Callers that do fh_verify should do the fh_want_write: */ ++ get_write_count = !fhp->fh_dentry; ++ + /* Get inode */ + err = fh_verify(rqstp, fhp, ftype, accmode); + if (err) + goto out; ++ if (get_write_count) { ++ host_err = fh_want_write(fhp); ++ if (host_err) ++ return nfserrno(host_err); ++ } + + dentry = fhp->fh_dentry; + inode = dentry->d_inode; +diff --git a/fs/ocfs2/buffer_head_io.c b/fs/ocfs2/buffer_head_io.c +index 5d18ad10c27f..4f66e007dae1 100644 +--- a/fs/ocfs2/buffer_head_io.c ++++ b/fs/ocfs2/buffer_head_io.c +@@ -90,7 +90,6 @@ int ocfs2_write_block(struct ocfs2_super *osb, struct buffer_head *bh, + * information for this bh as it's not marked locally + * uptodate. */ + ret = -EIO; +- put_bh(bh); + mlog_errno(ret); + } + +@@ -420,7 +419,6 @@ int ocfs2_write_super_or_backup(struct ocfs2_super *osb, + + if (!buffer_uptodate(bh)) { + ret = -EIO; +- put_bh(bh); + mlog_errno(ret); + } + +diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c +index e68588e6b1e8..9bd981cd3142 100644 +--- a/fs/ocfs2/dlm/dlmrecovery.c ++++ b/fs/ocfs2/dlm/dlmrecovery.c +@@ -540,7 +540,10 @@ master_here: + /* success! see if any other nodes need recovery */ + mlog(0, "DONE mastering recovery of %s:%u here(this=%u)!\n", + dlm->name, dlm->reco.dead_node, dlm->node_num); +- dlm_reset_recovery(dlm); ++ spin_lock(&dlm->spinlock); ++ __dlm_reset_recovery(dlm); ++ dlm->reco.state &= ~DLM_RECO_STATE_FINALIZE; ++ spin_unlock(&dlm->spinlock); + } + dlm_end_recovery(dlm); + +@@ -698,6 +701,14 @@ static int dlm_remaster_locks(struct dlm_ctxt *dlm, u8 dead_node) + if (all_nodes_done) { + int ret; + ++ /* Set this flag on recovery master to avoid ++ * a new recovery for another dead node start ++ * before the recovery is not done. That may ++ * cause recovery hung.*/ ++ spin_lock(&dlm->spinlock); ++ dlm->reco.state |= DLM_RECO_STATE_FINALIZE; ++ spin_unlock(&dlm->spinlock); ++ + /* all nodes are now in DLM_RECO_NODE_DATA_DONE state + * just send a finalize message to everyone and + * clean up */ +@@ -1751,13 +1762,13 @@ static int dlm_process_recovery_data(struct dlm_ctxt *dlm, + struct dlm_migratable_lockres *mres) + { + struct dlm_migratable_lock *ml; +- struct list_head *queue; ++ struct list_head *queue, *iter; + struct list_head *tmpq = NULL; + struct dlm_lock *newlock = NULL; + struct dlm_lockstatus *lksb = NULL; + int ret = 0; + int i, j, bad; +- struct dlm_lock *lock = NULL; ++ struct dlm_lock *lock; + u8 from = O2NM_MAX_NODES; + unsigned int added = 0; + __be64 c; +@@ -1792,14 +1803,16 @@ static int dlm_process_recovery_data(struct dlm_ctxt *dlm, + /* MIGRATION ONLY! */ + BUG_ON(!(mres->flags & DLM_MRES_MIGRATION)); + ++ lock = NULL; + spin_lock(&res->spinlock); + for (j = DLM_GRANTED_LIST; j <= DLM_BLOCKED_LIST; j++) { + tmpq = dlm_list_idx_to_ptr(res, j); +- list_for_each_entry(lock, tmpq, list) { +- if (lock->ml.cookie != ml->cookie) +- lock = NULL; +- else ++ list_for_each(iter, tmpq) { ++ lock = list_entry(iter, ++ struct dlm_lock, list); ++ if (lock->ml.cookie == ml->cookie) + break; ++ lock = NULL; + } + if (lock) + break; +@@ -2867,8 +2880,8 @@ int dlm_finalize_reco_handler(struct o2net_msg *msg, u32 len, void *data, + BUG(); + } + dlm->reco.state &= ~DLM_RECO_STATE_FINALIZE; ++ __dlm_reset_recovery(dlm); + spin_unlock(&dlm->spinlock); +- dlm_reset_recovery(dlm); + dlm_kick_recovery_thread(dlm); + break; + default: +diff --git a/fs/reiserfs/dir.c b/fs/reiserfs/dir.c +index 6c2d136561cb..2b96b59f75da 100644 +--- a/fs/reiserfs/dir.c ++++ b/fs/reiserfs/dir.c +@@ -128,6 +128,7 @@ int reiserfs_readdir_dentry(struct dentry *dentry, void *dirent, + char *d_name; + off_t d_off; + ino_t d_ino; ++ loff_t cur_pos = deh_offset(deh); + + if (!de_visible(deh)) + /* it is hidden entry */ +@@ -200,8 +201,9 @@ int reiserfs_readdir_dentry(struct dentry *dentry, void *dirent, + if (local_buf != small_buf) { + kfree(local_buf); + } +- // next entry should be looked for with such offset +- next_pos = deh_offset(deh) + 1; ++ ++ /* deh_offset(deh) may be invalid now. */ ++ next_pos = cur_pos + 1; + + if (item_moved(&tmp_ih, &path_to_entry)) { + set_cpu_key_k_offset(&pos_key, +diff --git a/fs/xfs/xfs_da_btree.c b/fs/xfs/xfs_da_btree.c +index eca6f9d8a263..79ddbaf93206 100644 +--- a/fs/xfs/xfs_da_btree.c ++++ b/fs/xfs/xfs_da_btree.c +@@ -1334,7 +1334,7 @@ xfs_da3_fixhashpath( + node = blk->bp->b_addr; + xfs_da3_node_hdr_from_disk(&nodehdr, node); + btree = xfs_da3_node_tree_p(node); +- if (be32_to_cpu(btree->hashval) == lasthash) ++ if (be32_to_cpu(btree[blk->index].hashval) == lasthash) + break; + blk->hashval = lasthash; + btree[blk->index].hashval = cpu_to_be32(lasthash); +diff --git a/include/linux/sunrpc/svcsock.h b/include/linux/sunrpc/svcsock.h +index 62fd1b756e99..947009ed5996 100644 +--- a/include/linux/sunrpc/svcsock.h ++++ b/include/linux/sunrpc/svcsock.h +@@ -56,6 +56,7 @@ int svc_recv(struct svc_rqst *, long); + int svc_send(struct svc_rqst *); + void svc_drop(struct svc_rqst *); + void svc_sock_update_bufs(struct svc_serv *serv); ++bool svc_alien_sock(struct net *net, int fd); + int svc_addsock(struct svc_serv *serv, const int fd, + char *name_return, const size_t len); + void svc_init_xprt_sock(void); +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index 9edcf456e0fc..ed6c01626acd 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -144,6 +144,11 @@ static int min_percpu_pagelist_fract = 8; + static int ngroups_max = NGROUPS_MAX; + static const int cap_last_cap = CAP_LAST_CAP; + ++/*this is needed for proc_doulongvec_minmax of sysctl_hung_task_timeout_secs */ ++#ifdef CONFIG_DETECT_HUNG_TASK ++static unsigned long hung_task_timeout_max = (LONG_MAX/HZ); ++#endif ++ + #ifdef CONFIG_INOTIFY_USER + #include + #endif +@@ -966,6 +971,7 @@ static struct ctl_table kern_table[] = { + .maxlen = sizeof(unsigned long), + .mode = 0644, + .proc_handler = proc_dohung_task_timeout_secs, ++ .extra2 = &hung_task_timeout_max, + }, + { + .procname = "hung_task_warnings", +diff --git a/mm/hugetlb.c b/mm/hugetlb.c +index aa3b9a63394b..8a7f27b42131 100644 +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -1487,6 +1487,7 @@ static unsigned long set_max_huge_pages(struct hstate *h, unsigned long count, + while (min_count < persistent_huge_pages(h)) { + if (!free_pool_huge_page(h, nodes_allowed, 0)) + break; ++ cond_resched_lock(&hugetlb_lock); + } + while (count < persistent_huge_pages(h)) { + if (!adjust_pool_surplus(h, nodes_allowed, 1)) +diff --git a/mm/mlock.c b/mm/mlock.c +index 79b7cf7d1bca..713e462c0776 100644 +--- a/mm/mlock.c ++++ b/mm/mlock.c +@@ -76,6 +76,7 @@ void clear_page_mlock(struct page *page) + */ + void mlock_vma_page(struct page *page) + { ++ /* Serialize with page migration */ + BUG_ON(!PageLocked(page)); + + if (!TestSetPageMlocked(page)) { +@@ -106,6 +107,7 @@ unsigned int munlock_vma_page(struct page *page) + { + unsigned int page_mask = 0; + ++ /* For try_to_munlock() and to serialize with page migration */ + BUG_ON(!PageLocked(page)); + + if (TestClearPageMlocked(page)) { +diff --git a/mm/rmap.c b/mm/rmap.c +index 3f6077461aea..fbf0040a7342 100644 +--- a/mm/rmap.c ++++ b/mm/rmap.c +@@ -1390,9 +1390,19 @@ static int try_to_unmap_cluster(unsigned long cursor, unsigned int *mapcount, + BUG_ON(!page || PageAnon(page)); + + if (locked_vma) { +- mlock_vma_page(page); /* no-op if already mlocked */ +- if (page == check_page) ++ if (page == check_page) { ++ /* we know we have check_page locked */ ++ mlock_vma_page(page); + ret = SWAP_MLOCK; ++ } else if (trylock_page(page)) { ++ /* ++ * If we can lock the page, perform mlock. ++ * Otherwise leave the page alone, it will be ++ * eventually encountered again later. ++ */ ++ mlock_vma_page(page); ++ unlock_page(page); ++ } + continue; /* don't unmap */ + } + +diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c +index 305374d4fb98..422759bae60d 100644 +--- a/net/sunrpc/svcsock.c ++++ b/net/sunrpc/svcsock.c +@@ -1393,6 +1393,22 @@ static struct svc_sock *svc_setup_socket(struct svc_serv *serv, + return svsk; + } + ++bool svc_alien_sock(struct net *net, int fd) ++{ ++ int err; ++ struct socket *sock = sockfd_lookup(fd, &err); ++ bool ret = false; ++ ++ if (!sock) ++ goto out; ++ if (sock_net(sock->sk) != net) ++ ret = true; ++ sockfd_put(sock); ++out: ++ return ret; ++} ++EXPORT_SYMBOL_GPL(svc_alien_sock); ++ + /** + * svc_addsock - add a listener socket to an RPC service + * @serv: pointer to RPC service to which to add a new listener +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 34548589f419..7de7cf1ec852 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -937,6 +937,7 @@ static int alc_codec_rename_from_preset(struct hda_codec *codec) + + static const struct snd_pci_quirk beep_white_list[] = { + SND_PCI_QUIRK(0x1043, 0x103c, "ASUS", 1), ++ SND_PCI_QUIRK(0x1043, 0x115d, "ASUS", 1), + SND_PCI_QUIRK(0x1043, 0x829f, "ASUS", 1), + SND_PCI_QUIRK(0x1043, 0x8376, "EeePC", 1), + SND_PCI_QUIRK(0x1043, 0x83ce, "EeePC", 1), +@@ -2858,8 +2859,9 @@ static void alc269_fixup_mic_mute_hook(void *private_data, int enabled) + + if (spec->mute_led_polarity) + enabled = !enabled; +- pinval = AC_PINCTL_IN_EN | +- (enabled ? AC_PINCTL_VREF_HIZ : AC_PINCTL_VREF_80); ++ pinval = snd_hda_codec_get_pin_target(codec, spec->mute_led_nid); ++ pinval &= ~AC_PINCTL_VREFEN; ++ pinval |= enabled ? AC_PINCTL_VREF_HIZ : AC_PINCTL_VREF_80; + if (spec->mute_led_nid) + snd_hda_set_pin_ctl_cache(codec, spec->mute_led_nid, pinval); + } +@@ -3901,6 +3903,7 @@ static int patch_alc269(struct hda_codec *codec) + spec->codec_variant = ALC269_TYPE_ALC284; + break; + case 0x10ec0286: ++ case 0x10ec0288: + spec->codec_variant = ALC269_TYPE_ALC286; + break; + case 0x10ec0255: +@@ -4643,6 +4646,7 @@ static const struct hda_codec_preset snd_hda_preset_realtek[] = { + { .id = 0x10ec0283, .name = "ALC283", .patch = patch_alc269 }, + { .id = 0x10ec0284, .name = "ALC284", .patch = patch_alc269 }, + { .id = 0x10ec0286, .name = "ALC286", .patch = patch_alc269 }, ++ { .id = 0x10ec0288, .name = "ALC288", .patch = patch_alc269 }, + { .id = 0x10ec0290, .name = "ALC290", .patch = patch_alc269 }, + { .id = 0x10ec0292, .name = "ALC292", .patch = patch_alc269 }, + { .id = 0x10ec0861, .rev = 0x100340, .name = "ALC660", +diff --git a/sound/pci/ice1712/ice1712.c b/sound/pci/ice1712/ice1712.c +index 806407a3973e..e6b70e35f628 100644 +--- a/sound/pci/ice1712/ice1712.c ++++ b/sound/pci/ice1712/ice1712.c +@@ -685,9 +685,10 @@ static snd_pcm_uframes_t snd_ice1712_playback_pointer(struct snd_pcm_substream * + if (!(snd_ice1712_read(ice, ICE1712_IREG_PBK_CTRL) & 1)) + return 0; + ptr = runtime->buffer_size - inw(ice->ddma_port + 4); ++ ptr = bytes_to_frames(substream->runtime, ptr); + if (ptr == runtime->buffer_size) + ptr = 0; +- return bytes_to_frames(substream->runtime, ptr); ++ return ptr; + } + + static snd_pcm_uframes_t snd_ice1712_playback_ds_pointer(struct snd_pcm_substream *substream) +@@ -704,9 +705,10 @@ static snd_pcm_uframes_t snd_ice1712_playback_ds_pointer(struct snd_pcm_substrea + addr = ICE1712_DSC_ADDR0; + ptr = snd_ice1712_ds_read(ice, substream->number * 2, addr) - + ice->playback_con_virt_addr[substream->number]; ++ ptr = bytes_to_frames(substream->runtime, ptr); + if (ptr == substream->runtime->buffer_size) + ptr = 0; +- return bytes_to_frames(substream->runtime, ptr); ++ return ptr; + } + + static snd_pcm_uframes_t snd_ice1712_capture_pointer(struct snd_pcm_substream *substream) +@@ -717,9 +719,10 @@ static snd_pcm_uframes_t snd_ice1712_capture_pointer(struct snd_pcm_substream *s + if (!(snd_ice1712_read(ice, ICE1712_IREG_CAP_CTRL) & 1)) + return 0; + ptr = inl(ICEREG(ice, CONCAP_ADDR)) - ice->capture_con_virt_addr; ++ ptr = bytes_to_frames(substream->runtime, ptr); + if (ptr == substream->runtime->buffer_size) + ptr = 0; +- return bytes_to_frames(substream->runtime, ptr); ++ return ptr; + } + + static const struct snd_pcm_hardware snd_ice1712_playback = { +@@ -1113,9 +1116,10 @@ static snd_pcm_uframes_t snd_ice1712_playback_pro_pointer(struct snd_pcm_substre + if (!(inl(ICEMT(ice, PLAYBACK_CONTROL)) & ICE1712_PLAYBACK_START)) + return 0; + ptr = ice->playback_pro_size - (inw(ICEMT(ice, PLAYBACK_SIZE)) << 2); ++ ptr = bytes_to_frames(substream->runtime, ptr); + if (ptr == substream->runtime->buffer_size) + ptr = 0; +- return bytes_to_frames(substream->runtime, ptr); ++ return ptr; + } + + static snd_pcm_uframes_t snd_ice1712_capture_pro_pointer(struct snd_pcm_substream *substream) +@@ -1126,9 +1130,10 @@ static snd_pcm_uframes_t snd_ice1712_capture_pro_pointer(struct snd_pcm_substrea + if (!(inl(ICEMT(ice, PLAYBACK_CONTROL)) & ICE1712_CAPTURE_START_SHADOW)) + return 0; + ptr = ice->capture_pro_size - (inw(ICEMT(ice, CAPTURE_SIZE)) << 2); ++ ptr = bytes_to_frames(substream->runtime, ptr); + if (ptr == substream->runtime->buffer_size) + ptr = 0; +- return bytes_to_frames(substream->runtime, ptr); ++ return ptr; + } + + static const struct snd_pcm_hardware snd_ice1712_playback_pro = { +diff --git a/sound/soc/codecs/cs42l51.c b/sound/soc/codecs/cs42l51.c +index 1e0fa3b5f79a..e1dfebbea650 100644 +--- a/sound/soc/codecs/cs42l51.c ++++ b/sound/soc/codecs/cs42l51.c +@@ -124,9 +124,8 @@ static int cs42l51_set_chan_mix(struct snd_kcontrol *kcontrol, + + static const DECLARE_TLV_DB_SCALE(adc_pcm_tlv, -5150, 50, 0); + static const DECLARE_TLV_DB_SCALE(tone_tlv, -1050, 150, 0); +-/* This is a lie. after -102 db, it stays at -102 */ +-/* maybe a range would be better */ +-static const DECLARE_TLV_DB_SCALE(aout_tlv, -11550, 50, 0); ++ ++static const DECLARE_TLV_DB_SCALE(aout_tlv, -10200, 50, 0); + + static const DECLARE_TLV_DB_SCALE(boost_tlv, 1600, 1600, 0); + static const char *chan_mix[] = { +@@ -141,7 +140,7 @@ static const struct soc_enum cs42l51_chan_mix = + static const struct snd_kcontrol_new cs42l51_snd_controls[] = { + SOC_DOUBLE_R_SX_TLV("PCM Playback Volume", + CS42L51_PCMA_VOL, CS42L51_PCMB_VOL, +- 6, 0x19, 0x7F, adc_pcm_tlv), ++ 0, 0x19, 0x7F, adc_pcm_tlv), + SOC_DOUBLE_R("PCM Playback Switch", + CS42L51_PCMA_VOL, CS42L51_PCMB_VOL, 7, 1, 1), + SOC_DOUBLE_R_SX_TLV("Analog Playback Volume", +@@ -149,7 +148,7 @@ static const struct snd_kcontrol_new cs42l51_snd_controls[] = { + 0, 0x34, 0xE4, aout_tlv), + SOC_DOUBLE_R_SX_TLV("ADC Mixer Volume", + CS42L51_ADCA_VOL, CS42L51_ADCB_VOL, +- 6, 0x19, 0x7F, adc_pcm_tlv), ++ 0, 0x19, 0x7F, adc_pcm_tlv), + SOC_DOUBLE_R("ADC Mixer Switch", + CS42L51_ADCA_VOL, CS42L51_ADCB_VOL, 7, 1, 1), + SOC_SINGLE("Playback Deemphasis Switch", CS42L51_DAC_CTL, 3, 1, 0), +diff --git a/sound/soc/codecs/cs42l52.c b/sound/soc/codecs/cs42l52.c +index ee25f325d65c..b99af6362de6 100644 +--- a/sound/soc/codecs/cs42l52.c ++++ b/sound/soc/codecs/cs42l52.c +@@ -350,7 +350,7 @@ static const char * const right_swap_text[] = { + static const unsigned int swap_values[] = { 0, 1, 3 }; + + static const struct soc_enum adca_swap_enum = +- SOC_VALUE_ENUM_SINGLE(CS42L52_ADC_PCM_MIXER, 2, 1, ++ SOC_VALUE_ENUM_SINGLE(CS42L52_ADC_PCM_MIXER, 2, 3, + ARRAY_SIZE(left_swap_text), + left_swap_text, + swap_values); +@@ -359,7 +359,7 @@ static const struct snd_kcontrol_new adca_mixer = + SOC_DAPM_ENUM("Route", adca_swap_enum); + + static const struct soc_enum pcma_swap_enum = +- SOC_VALUE_ENUM_SINGLE(CS42L52_ADC_PCM_MIXER, 6, 1, ++ SOC_VALUE_ENUM_SINGLE(CS42L52_ADC_PCM_MIXER, 6, 3, + ARRAY_SIZE(left_swap_text), + left_swap_text, + swap_values); +@@ -368,7 +368,7 @@ static const struct snd_kcontrol_new pcma_mixer = + SOC_DAPM_ENUM("Route", pcma_swap_enum); + + static const struct soc_enum adcb_swap_enum = +- SOC_VALUE_ENUM_SINGLE(CS42L52_ADC_PCM_MIXER, 0, 1, ++ SOC_VALUE_ENUM_SINGLE(CS42L52_ADC_PCM_MIXER, 0, 3, + ARRAY_SIZE(right_swap_text), + right_swap_text, + swap_values); +@@ -377,7 +377,7 @@ static const struct snd_kcontrol_new adcb_mixer = + SOC_DAPM_ENUM("Route", adcb_swap_enum); + + static const struct soc_enum pcmb_swap_enum = +- SOC_VALUE_ENUM_SINGLE(CS42L52_ADC_PCM_MIXER, 4, 1, ++ SOC_VALUE_ENUM_SINGLE(CS42L52_ADC_PCM_MIXER, 4, 3, + ARRAY_SIZE(right_swap_text), + right_swap_text, + swap_values); +diff --git a/sound/soc/codecs/cs42l73.c b/sound/soc/codecs/cs42l73.c +index 3b20c86cdb01..eade6e2d883d 100644 +--- a/sound/soc/codecs/cs42l73.c ++++ b/sound/soc/codecs/cs42l73.c +@@ -325,7 +325,7 @@ static const char * const cs42l73_mono_mix_texts[] = { + static const unsigned int cs42l73_mono_mix_values[] = { 0, 1, 2 }; + + static const struct soc_enum spk_asp_enum = +- SOC_VALUE_ENUM_SINGLE(CS42L73_MMIXCTL, 6, 1, ++ SOC_VALUE_ENUM_SINGLE(CS42L73_MMIXCTL, 6, 3, + ARRAY_SIZE(cs42l73_mono_mix_texts), + cs42l73_mono_mix_texts, + cs42l73_mono_mix_values); +@@ -343,7 +343,7 @@ static const struct snd_kcontrol_new spk_xsp_mixer = + SOC_DAPM_ENUM("Route", spk_xsp_enum); + + static const struct soc_enum esl_asp_enum = +- SOC_VALUE_ENUM_SINGLE(CS42L73_MMIXCTL, 2, 5, ++ SOC_VALUE_ENUM_SINGLE(CS42L73_MMIXCTL, 2, 3, + ARRAY_SIZE(cs42l73_mono_mix_texts), + cs42l73_mono_mix_texts, + cs42l73_mono_mix_values); +@@ -352,7 +352,7 @@ static const struct snd_kcontrol_new esl_asp_mixer = + SOC_DAPM_ENUM("Route", esl_asp_enum); + + static const struct soc_enum esl_xsp_enum = +- SOC_VALUE_ENUM_SINGLE(CS42L73_MMIXCTL, 0, 7, ++ SOC_VALUE_ENUM_SINGLE(CS42L73_MMIXCTL, 0, 3, + ARRAY_SIZE(cs42l73_mono_mix_texts), + cs42l73_mono_mix_texts, + cs42l73_mono_mix_values); diff --git a/projects/Cuboxi/patches/linux/linux-000-patch-3.10.39-40.patch b/projects/Cuboxi/patches/linux/linux-000-patch-3.10.39-40.patch new file mode 100644 index 0000000000..e31088c154 --- /dev/null +++ b/projects/Cuboxi/patches/linux/linux-000-patch-3.10.39-40.patch @@ -0,0 +1,2267 @@ +diff --git a/Makefile b/Makefile +index 1e07514be6f8..b2285cababb0 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 10 +-SUBLEVEL = 39 ++SUBLEVEL = 40 + EXTRAVERSION = + NAME = TOSSUG Baby Fish + +diff --git a/arch/arc/include/asm/irqflags.h b/arch/arc/include/asm/irqflags.h +index eac071668201..c29d56587bf0 100644 +--- a/arch/arc/include/asm/irqflags.h ++++ b/arch/arc/include/asm/irqflags.h +@@ -137,13 +137,6 @@ static inline void arch_unmask_irq(unsigned int irq) + flag \scratch + .endm + +-.macro IRQ_DISABLE_SAVE scratch, save +- lr \scratch, [status32] +- mov \save, \scratch /* Make a copy */ +- bic \scratch, \scratch, (STATUS_E1_MASK | STATUS_E2_MASK) +- flag \scratch +-.endm +- + .macro IRQ_ENABLE scratch + lr \scratch, [status32] + or \scratch, \scratch, (STATUS_E1_MASK | STATUS_E2_MASK) +diff --git a/arch/arc/kernel/entry.S b/arch/arc/kernel/entry.S +index 6dbe359c760d..6f3cd0fb4b54 100644 +--- a/arch/arc/kernel/entry.S ++++ b/arch/arc/kernel/entry.S +@@ -589,11 +589,7 @@ ARC_ENTRY ret_from_exception + ; Pre-{IRQ,Trap,Exception} K/U mode from pt_regs->status32 + ld r8, [sp, PT_status32] ; returning to User/Kernel Mode + +-#ifdef CONFIG_PREEMPT + bbit0 r8, STATUS_U_BIT, resume_kernel_mode +-#else +- bbit0 r8, STATUS_U_BIT, restore_regs +-#endif + + ; Before returning to User mode check-for-and-complete any pending work + ; such as rescheduling/signal-delivery etc. +@@ -653,10 +649,15 @@ resume_user_mode_begin: + b resume_user_mode_begin ; unconditionally back to U mode ret chks + ; for single exit point from this block + +-#ifdef CONFIG_PREEMPT +- + resume_kernel_mode: + ++ ; Disable Interrupts from this point on ++ ; CONFIG_PREEMPT: This is a must for preempt_schedule_irq() ++ ; !CONFIG_PREEMPT: To ensure restore_regs is intr safe ++ IRQ_DISABLE r9 ++ ++#ifdef CONFIG_PREEMPT ++ + ; Can't preempt if preemption disabled + GET_CURR_THR_INFO_FROM_SP r10 + ld r8, [r10, THREAD_INFO_PREEMPT_COUNT] +@@ -666,8 +667,6 @@ resume_kernel_mode: + ld r9, [r10, THREAD_INFO_FLAGS] + bbit0 r9, TIF_NEED_RESCHED, restore_regs + +- IRQ_DISABLE r9 +- + ; Invoke PREEMPTION + bl preempt_schedule_irq + +@@ -680,12 +679,11 @@ resume_kernel_mode: + ; + ; Restore the saved sys context (common exit-path for EXCPN/IRQ/Trap) + ; IRQ shd definitely not happen between now and rtie ++; All 2 entry points to here already disable interrupts + + restore_regs : + +- ; Disable Interrupts while restoring reg-file back +- ; XXX can this be optimised out +- IRQ_DISABLE_SAVE r9, r10 ;@r10 has prisitine (pre-disable) copy ++ lr r10, [status32] + + #ifdef CONFIG_ARC_CURR_IN_REG + ; Restore User R25 +diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c +index f0ef2f7d4ad7..5ef506c6f492 100644 +--- a/arch/arm/mm/mmap.c ++++ b/arch/arm/mm/mmap.c +@@ -204,13 +204,11 @@ int valid_phys_addr_range(phys_addr_t addr, size_t size) + } + + /* +- * We don't use supersection mappings for mmap() on /dev/mem, which +- * means that we can't map the memory area above the 4G barrier into +- * userspace. ++ * Do not allow /dev/mem mappings beyond the supported physical range. + */ + int valid_mmap_phys_addr_range(unsigned long pfn, size_t size) + { +- return !(pfn + (size >> PAGE_SHIFT) > 0x00100000); ++ return (pfn + (size >> PAGE_SHIFT)) <= (1 + (PHYS_MASK >> PAGE_SHIFT)); + } + + #ifdef CONFIG_STRICT_DEVMEM +diff --git a/arch/mips/kvm/kvm_mips_emul.c b/arch/mips/kvm/kvm_mips_emul.c +index 4b6274b47f33..e75ef8219caf 100644 +--- a/arch/mips/kvm/kvm_mips_emul.c ++++ b/arch/mips/kvm/kvm_mips_emul.c +@@ -1571,17 +1571,17 @@ kvm_mips_handle_ri(unsigned long cause, uint32_t *opc, + arch->gprs[rt] = kvm_read_c0_guest_userlocal(cop0); + #else + /* UserLocal not implemented */ +- er = kvm_mips_emulate_ri_exc(cause, opc, run, vcpu); ++ er = EMULATE_FAIL; + #endif + break; + + default: +- printk("RDHWR not supported\n"); ++ kvm_debug("RDHWR %#x not supported @ %p\n", rd, opc); + er = EMULATE_FAIL; + break; + } + } else { +- printk("Emulate RI not supported @ %p: %#x\n", opc, inst); ++ kvm_debug("Emulate RI not supported @ %p: %#x\n", opc, inst); + er = EMULATE_FAIL; + } + +@@ -1590,6 +1590,7 @@ kvm_mips_handle_ri(unsigned long cause, uint32_t *opc, + */ + if (er == EMULATE_FAIL) { + vcpu->arch.pc = curr_pc; ++ er = kvm_mips_emulate_ri_exc(cause, opc, run, vcpu); + } + return er; + } +diff --git a/arch/mips/power/hibernate.S b/arch/mips/power/hibernate.S +index 7e0277a1048f..32a7c828f073 100644 +--- a/arch/mips/power/hibernate.S ++++ b/arch/mips/power/hibernate.S +@@ -43,6 +43,7 @@ LEAF(swsusp_arch_resume) + bne t1, t3, 1b + PTR_L t0, PBE_NEXT(t0) + bnez t0, 0b ++ jal local_flush_tlb_all /* Avoid TLB mismatch after kernel resume */ + PTR_LA t0, saved_regs + PTR_L ra, PT_R31(t0) + PTR_L sp, PT_R29(t0) +diff --git a/arch/powerpc/include/asm/compat.h b/arch/powerpc/include/asm/compat.h +index 84fdf6857c31..ef22898daa93 100644 +--- a/arch/powerpc/include/asm/compat.h ++++ b/arch/powerpc/include/asm/compat.h +@@ -8,7 +8,11 @@ + #include + + #define COMPAT_USER_HZ 100 ++#ifdef __BIG_ENDIAN__ + #define COMPAT_UTS_MACHINE "ppc\0\0" ++#else ++#define COMPAT_UTS_MACHINE "ppcle\0\0" ++#endif + + typedef u32 compat_size_t; + typedef s32 compat_ssize_t; +diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h +index e1fb161252ef..795f67792ea9 100644 +--- a/arch/powerpc/include/asm/reg.h ++++ b/arch/powerpc/include/asm/reg.h +@@ -208,6 +208,7 @@ + #define SPRN_ACOP 0x1F /* Available Coprocessor Register */ + #define SPRN_TFIAR 0x81 /* Transaction Failure Inst Addr */ + #define SPRN_TEXASR 0x82 /* Transaction EXception & Summary */ ++#define TEXASR_FS __MASK(63-36) /* Transaction Failure Summary */ + #define SPRN_TEXASRU 0x83 /* '' '' '' Upper 32 */ + #define SPRN_TFHAR 0x80 /* Transaction Failure Handler Addr */ + #define SPRN_CTRLF 0x088 +diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c +index 7baa27b7abbe..1e1c995ddacc 100644 +--- a/arch/powerpc/kernel/process.c ++++ b/arch/powerpc/kernel/process.c +@@ -523,6 +523,31 @@ out_and_saveregs: + tm_save_sprs(thr); + } + ++extern void __tm_recheckpoint(struct thread_struct *thread, ++ unsigned long orig_msr); ++ ++void tm_recheckpoint(struct thread_struct *thread, ++ unsigned long orig_msr) ++{ ++ unsigned long flags; ++ ++ /* We really can't be interrupted here as the TEXASR registers can't ++ * change and later in the trecheckpoint code, we have a userspace R1. ++ * So let's hard disable over this region. ++ */ ++ local_irq_save(flags); ++ hard_irq_disable(); ++ ++ /* The TM SPRs are restored here, so that TEXASR.FS can be set ++ * before the trecheckpoint and no explosion occurs. ++ */ ++ tm_restore_sprs(thread); ++ ++ __tm_recheckpoint(thread, orig_msr); ++ ++ local_irq_restore(flags); ++} ++ + static inline void tm_recheckpoint_new_task(struct task_struct *new) + { + unsigned long msr; +@@ -541,13 +566,10 @@ static inline void tm_recheckpoint_new_task(struct task_struct *new) + if (!new->thread.regs) + return; + +- /* The TM SPRs are restored here, so that TEXASR.FS can be set +- * before the trecheckpoint and no explosion occurs. +- */ +- tm_restore_sprs(&new->thread); +- +- if (!MSR_TM_ACTIVE(new->thread.regs->msr)) ++ if (!MSR_TM_ACTIVE(new->thread.regs->msr)){ ++ tm_restore_sprs(&new->thread); + return; ++ } + msr = new->thread.tm_orig_msr; + /* Recheckpoint to restore original checkpointed register state. */ + TM_DEBUG("*** tm_recheckpoint of pid %d " +diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c +index 7e9dff80e1dc..81f929f026f2 100644 +--- a/arch/powerpc/kernel/signal_32.c ++++ b/arch/powerpc/kernel/signal_32.c +@@ -863,6 +863,8 @@ static long restore_tm_user_regs(struct pt_regs *regs, + * transactional versions should be loaded. + */ + tm_enable(); ++ /* Make sure the transaction is marked as failed */ ++ current->thread.tm_texasr |= TEXASR_FS; + /* This loads the checkpointed FP/VEC state, if used */ + tm_recheckpoint(¤t->thread, msr); + /* Get the top half of the MSR */ +diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c +index 35c20a1fb365..74d9615a6bb6 100644 +--- a/arch/powerpc/kernel/signal_64.c ++++ b/arch/powerpc/kernel/signal_64.c +@@ -513,6 +513,8 @@ static long restore_tm_sigcontexts(struct pt_regs *regs, + } + #endif + tm_enable(); ++ /* Make sure the transaction is marked as failed */ ++ current->thread.tm_texasr |= TEXASR_FS; + /* This loads the checkpointed FP/VEC state, if used */ + tm_recheckpoint(¤t->thread, msr); + +diff --git a/arch/powerpc/kernel/tm.S b/arch/powerpc/kernel/tm.S +index f2abb219a17b..1e43ed404b95 100644 +--- a/arch/powerpc/kernel/tm.S ++++ b/arch/powerpc/kernel/tm.S +@@ -296,7 +296,7 @@ dont_backup_fp: + * Call with IRQs off, stacks get all out of sync for + * some periods in here! + */ +-_GLOBAL(tm_recheckpoint) ++_GLOBAL(__tm_recheckpoint) + mfcr r5 + mflr r0 + std r5, 8(r1) +diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c +index 1919db6c0607..3bc6b7e43b24 100644 +--- a/arch/s390/net/bpf_jit_comp.c ++++ b/arch/s390/net/bpf_jit_comp.c +@@ -243,7 +243,6 @@ static void bpf_jit_noleaks(struct bpf_jit *jit, struct sock_filter *filter) + case BPF_S_LD_W_IND: + case BPF_S_LD_H_IND: + case BPF_S_LD_B_IND: +- case BPF_S_LDX_B_MSH: + case BPF_S_LD_IMM: + case BPF_S_LD_MEM: + case BPF_S_MISC_TXA: +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index 8b8cbe9bcb92..9cf616b5210b 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -4765,21 +4765,26 @@ void swap_buf_le16(u16 *buf, unsigned int buf_words) + static struct ata_queued_cmd *ata_qc_new(struct ata_port *ap) + { + struct ata_queued_cmd *qc = NULL; +- unsigned int i; ++ unsigned int i, tag; + + /* no command while frozen */ + if (unlikely(ap->pflags & ATA_PFLAG_FROZEN)) + return NULL; + +- /* the last tag is reserved for internal command. */ +- for (i = 0; i < ATA_MAX_QUEUE - 1; i++) +- if (!test_and_set_bit(i, &ap->qc_allocated)) { +- qc = __ata_qc_from_tag(ap, i); ++ for (i = 0; i < ATA_MAX_QUEUE; i++) { ++ tag = (i + ap->last_tag + 1) % ATA_MAX_QUEUE; ++ ++ /* the last tag is reserved for internal command. */ ++ if (tag == ATA_TAG_INTERNAL) ++ continue; ++ ++ if (!test_and_set_bit(tag, &ap->qc_allocated)) { ++ qc = __ata_qc_from_tag(ap, tag); ++ qc->tag = tag; ++ ap->last_tag = tag; + break; + } +- +- if (qc) +- qc->tag = i; ++ } + + return qc; + } +diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c +index 04ceb7e2fadd..eb3575b3fbf0 100644 +--- a/drivers/block/floppy.c ++++ b/drivers/block/floppy.c +@@ -3053,7 +3053,10 @@ static int raw_cmd_copyout(int cmd, void __user *param, + int ret; + + while (ptr) { +- ret = copy_to_user(param, ptr, sizeof(*ptr)); ++ struct floppy_raw_cmd cmd = *ptr; ++ cmd.next = NULL; ++ cmd.kernel_data = NULL; ++ ret = copy_to_user(param, &cmd, sizeof(cmd)); + if (ret) + return -EFAULT; + param += sizeof(struct floppy_raw_cmd); +@@ -3107,10 +3110,11 @@ loop: + return -ENOMEM; + *rcmd = ptr; + ret = copy_from_user(ptr, param, sizeof(*ptr)); +- if (ret) +- return -EFAULT; + ptr->next = NULL; + ptr->buffer_length = 0; ++ ptr->kernel_data = NULL; ++ if (ret) ++ return -EFAULT; + param += sizeof(struct floppy_raw_cmd); + if (ptr->cmd_count > 33) + /* the command may now also take up the space +@@ -3126,7 +3130,6 @@ loop: + for (i = 0; i < 16; i++) + ptr->reply[i] = 0; + ptr->resultcode = 0; +- ptr->kernel_data = NULL; + + if (ptr->flags & (FD_RAW_READ | FD_RAW_WRITE)) { + if (ptr->length <= 0) +diff --git a/drivers/gpio/gpio-mxs.c b/drivers/gpio/gpio-mxs.c +index f8e6af20dfbf..d599fc42ae8b 100644 +--- a/drivers/gpio/gpio-mxs.c ++++ b/drivers/gpio/gpio-mxs.c +@@ -214,7 +214,8 @@ static void __init mxs_gpio_init_gc(struct mxs_gpio_port *port, int irq_base) + ct->regs.ack = PINCTRL_IRQSTAT(port) + MXS_CLR; + ct->regs.mask = PINCTRL_IRQEN(port); + +- irq_setup_generic_chip(gc, IRQ_MSK(32), 0, IRQ_NOREQUEST, 0); ++ irq_setup_generic_chip(gc, IRQ_MSK(32), IRQ_GC_INIT_NESTED_LOCK, ++ IRQ_NOREQUEST, 0); + } + + static int mxs_gpio_to_irq(struct gpio_chip *gc, unsigned offset) +diff --git a/drivers/gpu/drm/cirrus/cirrus_drv.c b/drivers/gpu/drm/cirrus/cirrus_drv.c +index 8ecb601152ef..64bfc235021a 100644 +--- a/drivers/gpu/drm/cirrus/cirrus_drv.c ++++ b/drivers/gpu/drm/cirrus/cirrus_drv.c +@@ -11,6 +11,7 @@ + #include + #include + #include ++#include + + #include "cirrus_drv.h" + +@@ -75,6 +76,41 @@ static void cirrus_pci_remove(struct pci_dev *pdev) + drm_put_dev(dev); + } + ++static int cirrus_pm_suspend(struct device *dev) ++{ ++ struct pci_dev *pdev = to_pci_dev(dev); ++ struct drm_device *drm_dev = pci_get_drvdata(pdev); ++ struct cirrus_device *cdev = drm_dev->dev_private; ++ ++ drm_kms_helper_poll_disable(drm_dev); ++ ++ if (cdev->mode_info.gfbdev) { ++ console_lock(); ++ fb_set_suspend(cdev->mode_info.gfbdev->helper.fbdev, 1); ++ console_unlock(); ++ } ++ ++ return 0; ++} ++ ++static int cirrus_pm_resume(struct device *dev) ++{ ++ struct pci_dev *pdev = to_pci_dev(dev); ++ struct drm_device *drm_dev = pci_get_drvdata(pdev); ++ struct cirrus_device *cdev = drm_dev->dev_private; ++ ++ drm_helper_resume_force_mode(drm_dev); ++ ++ if (cdev->mode_info.gfbdev) { ++ console_lock(); ++ fb_set_suspend(cdev->mode_info.gfbdev->helper.fbdev, 0); ++ console_unlock(); ++ } ++ ++ drm_kms_helper_poll_enable(drm_dev); ++ return 0; ++} ++ + static const struct file_operations cirrus_driver_fops = { + .owner = THIS_MODULE, + .open = drm_open, +@@ -105,11 +141,17 @@ static struct drm_driver driver = { + .dumb_destroy = cirrus_dumb_destroy, + }; + ++static const struct dev_pm_ops cirrus_pm_ops = { ++ SET_SYSTEM_SLEEP_PM_OPS(cirrus_pm_suspend, ++ cirrus_pm_resume) ++}; ++ + static struct pci_driver cirrus_pci_driver = { + .name = DRIVER_NAME, + .id_table = pciidlist, + .probe = cirrus_pci_probe, + .remove = cirrus_pci_remove, ++ .driver.pm = &cirrus_pm_ops, + }; + + static int __init cirrus_init(void) +diff --git a/drivers/gpu/drm/cirrus/cirrus_mode.c b/drivers/gpu/drm/cirrus/cirrus_mode.c +index 379a47ea99f6..b86f68d8b726 100644 +--- a/drivers/gpu/drm/cirrus/cirrus_mode.c ++++ b/drivers/gpu/drm/cirrus/cirrus_mode.c +@@ -308,6 +308,9 @@ static int cirrus_crtc_mode_set(struct drm_crtc *crtc, + + WREG_HDR(hdr); + cirrus_crtc_do_set_base(crtc, old_fb, x, y, 0); ++ ++ /* Unblank (needed on S3 resume, vgabios doesn't do it then) */ ++ outb(0x20, 0x3c0); + return 0; + } + +diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c +index 58b4a53715cd..4a809969c5ac 100644 +--- a/drivers/gpu/drm/i915/intel_crt.c ++++ b/drivers/gpu/drm/i915/intel_crt.c +@@ -717,6 +717,14 @@ static const struct dmi_system_id intel_no_crt[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "ZGB"), + }, + }, ++ { ++ .callback = intel_no_crt_dmi_callback, ++ .ident = "DELL XPS 8700", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "XPS 8700"), ++ }, ++ }, + { } + }; + +diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c +index 588a5eca63d8..ce6c603a3cc9 100644 +--- a/drivers/infiniband/ulp/isert/ib_isert.c ++++ b/drivers/infiniband/ulp/isert/ib_isert.c +@@ -1201,7 +1201,7 @@ isert_unmap_cmd(struct isert_cmd *isert_cmd, struct isert_conn *isert_conn) + } + + static void +-isert_put_cmd(struct isert_cmd *isert_cmd) ++isert_put_cmd(struct isert_cmd *isert_cmd, bool comp_err) + { + struct iscsi_cmd *cmd = &isert_cmd->iscsi_cmd; + struct isert_conn *isert_conn = isert_cmd->conn; +@@ -1216,8 +1216,21 @@ isert_put_cmd(struct isert_cmd *isert_cmd) + list_del_init(&cmd->i_conn_node); + spin_unlock_bh(&conn->cmd_lock); + +- if (cmd->data_direction == DMA_TO_DEVICE) ++ if (cmd->data_direction == DMA_TO_DEVICE) { + iscsit_stop_dataout_timer(cmd); ++ /* ++ * Check for special case during comp_err where ++ * WRITE_PENDING has been handed off from core, ++ * but requires an extra target_put_sess_cmd() ++ * before transport_generic_free_cmd() below. ++ */ ++ if (comp_err && ++ cmd->se_cmd.t_state == TRANSPORT_WRITE_PENDING) { ++ struct se_cmd *se_cmd = &cmd->se_cmd; ++ ++ target_put_sess_cmd(se_cmd->se_sess, se_cmd); ++ } ++ } + + isert_unmap_cmd(isert_cmd, isert_conn); + transport_generic_free_cmd(&cmd->se_cmd, 0); +@@ -1271,7 +1284,7 @@ isert_unmap_tx_desc(struct iser_tx_desc *tx_desc, struct ib_device *ib_dev) + + static void + isert_completion_put(struct iser_tx_desc *tx_desc, struct isert_cmd *isert_cmd, +- struct ib_device *ib_dev) ++ struct ib_device *ib_dev, bool comp_err) + { + if (isert_cmd->sense_buf_dma != 0) { + pr_debug("Calling ib_dma_unmap_single for isert_cmd->sense_buf_dma\n"); +@@ -1281,7 +1294,7 @@ isert_completion_put(struct iser_tx_desc *tx_desc, struct isert_cmd *isert_cmd, + } + + isert_unmap_tx_desc(tx_desc, ib_dev); +- isert_put_cmd(isert_cmd); ++ isert_put_cmd(isert_cmd, comp_err); + } + + static void +@@ -1336,14 +1349,14 @@ isert_do_control_comp(struct work_struct *work) + iscsit_tmr_post_handler(cmd, cmd->conn); + + cmd->i_state = ISTATE_SENT_STATUS; +- isert_completion_put(&isert_cmd->tx_desc, isert_cmd, ib_dev); ++ isert_completion_put(&isert_cmd->tx_desc, isert_cmd, ib_dev, false); + break; + case ISTATE_SEND_REJECT: + pr_debug("Got isert_do_control_comp ISTATE_SEND_REJECT: >>>\n"); + atomic_dec(&isert_conn->post_send_buf_count); + + cmd->i_state = ISTATE_SENT_STATUS; +- isert_completion_put(&isert_cmd->tx_desc, isert_cmd, ib_dev); ++ isert_completion_put(&isert_cmd->tx_desc, isert_cmd, ib_dev, false); + break; + case ISTATE_SEND_LOGOUTRSP: + pr_debug("Calling iscsit_logout_post_handler >>>>>>>>>>>>>>\n"); +@@ -1382,7 +1395,7 @@ isert_response_completion(struct iser_tx_desc *tx_desc, + atomic_sub(wr->send_wr_num + 1, &isert_conn->post_send_buf_count); + + cmd->i_state = ISTATE_SENT_STATUS; +- isert_completion_put(tx_desc, isert_cmd, ib_dev); ++ isert_completion_put(tx_desc, isert_cmd, ib_dev, false); + } + + static void +@@ -1436,7 +1449,7 @@ isert_cq_tx_comp_err(struct iser_tx_desc *tx_desc, struct isert_conn *isert_conn + if (!isert_cmd) + isert_unmap_tx_desc(tx_desc, ib_dev); + else +- isert_completion_put(tx_desc, isert_cmd, ib_dev); ++ isert_completion_put(tx_desc, isert_cmd, ib_dev, true); + } + + static void +diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c +index c69c81608f43..d60c9b7ad1b8 100644 +--- a/drivers/input/mouse/synaptics.c ++++ b/drivers/input/mouse/synaptics.c +@@ -1515,6 +1515,22 @@ static const struct dmi_system_id min_max_dmi_table[] __initconst = { + .driver_data = (int []){1232, 5710, 1156, 4696}, + }, + { ++ /* Lenovo ThinkPad Edge E431 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad Edge E431"), ++ }, ++ .driver_data = (int []){1024, 5022, 2508, 4832}, ++ }, ++ { ++ /* Lenovo ThinkPad T431s */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T431"), ++ }, ++ .driver_data = (int []){1024, 5112, 2024, 4832}, ++ }, ++ { + /* Lenovo ThinkPad T440s */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), +@@ -1523,6 +1539,14 @@ static const struct dmi_system_id min_max_dmi_table[] __initconst = { + .driver_data = (int []){1024, 5112, 2024, 4832}, + }, + { ++ /* Lenovo ThinkPad L440 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad L440"), ++ }, ++ .driver_data = (int []){1024, 5112, 2024, 4832}, ++ }, ++ { + /* Lenovo ThinkPad T540p */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), +@@ -1530,6 +1554,32 @@ static const struct dmi_system_id min_max_dmi_table[] __initconst = { + }, + .driver_data = (int []){1024, 5056, 2058, 4832}, + }, ++ { ++ /* Lenovo ThinkPad L540 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad L540"), ++ }, ++ .driver_data = (int []){1024, 5112, 2024, 4832}, ++ }, ++ { ++ /* Lenovo Yoga S1 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, ++ "ThinkPad S1 Yoga"), ++ }, ++ .driver_data = (int []){1232, 5710, 1156, 4696}, ++ }, ++ { ++ /* Lenovo ThinkPad X1 Carbon Haswell (3rd generation) */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, ++ "ThinkPad X1 Carbon 2nd"), ++ }, ++ .driver_data = (int []){1024, 5112, 2024, 4832}, ++ }, + #endif + { } + }; +diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c +index 1af7255bbffb..a33e07f4222e 100644 +--- a/drivers/md/dm-cache-metadata.c ++++ b/drivers/md/dm-cache-metadata.c +@@ -511,8 +511,9 @@ static int __begin_transaction_flags(struct dm_cache_metadata *cmd, + disk_super = dm_block_data(sblock); + update_flags(disk_super, mutator); + read_superblock_fields(cmd, disk_super); ++ dm_bm_unlock(sblock); + +- return dm_bm_flush_and_unlock(cmd->bm, sblock); ++ return dm_bm_flush(cmd->bm); + } + + static int __begin_transaction(struct dm_cache_metadata *cmd) +diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c +index 901aac27e522..7d0ac0a6e724 100644 +--- a/drivers/md/dm-thin.c ++++ b/drivers/md/dm-thin.c +@@ -1322,9 +1322,9 @@ static void process_deferred_bios(struct pool *pool) + */ + if (ensure_next_mapping(pool)) { + spin_lock_irqsave(&pool->lock, flags); ++ bio_list_add(&pool->deferred_bios, bio); + bio_list_merge(&pool->deferred_bios, &bios); + spin_unlock_irqrestore(&pool->lock, flags); +- + break; + } + +diff --git a/drivers/md/persistent-data/dm-block-manager.c b/drivers/md/persistent-data/dm-block-manager.c +index 81b513890e2b..6372d0bea532 100644 +--- a/drivers/md/persistent-data/dm-block-manager.c ++++ b/drivers/md/persistent-data/dm-block-manager.c +@@ -595,25 +595,14 @@ int dm_bm_unlock(struct dm_block *b) + } + EXPORT_SYMBOL_GPL(dm_bm_unlock); + +-int dm_bm_flush_and_unlock(struct dm_block_manager *bm, +- struct dm_block *superblock) ++int dm_bm_flush(struct dm_block_manager *bm) + { +- int r; +- + if (bm->read_only) + return -EPERM; + +- r = dm_bufio_write_dirty_buffers(bm->bufio); +- if (unlikely(r)) { +- dm_bm_unlock(superblock); +- return r; +- } +- +- dm_bm_unlock(superblock); +- + return dm_bufio_write_dirty_buffers(bm->bufio); + } +-EXPORT_SYMBOL_GPL(dm_bm_flush_and_unlock); ++EXPORT_SYMBOL_GPL(dm_bm_flush); + + void dm_bm_set_read_only(struct dm_block_manager *bm) + { +diff --git a/drivers/md/persistent-data/dm-block-manager.h b/drivers/md/persistent-data/dm-block-manager.h +index be5bff61be28..f74c0462e5e4 100644 +--- a/drivers/md/persistent-data/dm-block-manager.h ++++ b/drivers/md/persistent-data/dm-block-manager.h +@@ -105,8 +105,7 @@ int dm_bm_unlock(struct dm_block *b); + * + * This method always blocks. + */ +-int dm_bm_flush_and_unlock(struct dm_block_manager *bm, +- struct dm_block *superblock); ++int dm_bm_flush(struct dm_block_manager *bm); + + /* + * Switches the bm to a read only mode. Once read-only mode +diff --git a/drivers/md/persistent-data/dm-transaction-manager.c b/drivers/md/persistent-data/dm-transaction-manager.c +index 81da1a26042e..3bc30a0ae3d6 100644 +--- a/drivers/md/persistent-data/dm-transaction-manager.c ++++ b/drivers/md/persistent-data/dm-transaction-manager.c +@@ -154,7 +154,7 @@ int dm_tm_pre_commit(struct dm_transaction_manager *tm) + if (r < 0) + return r; + +- return 0; ++ return dm_bm_flush(tm->bm); + } + EXPORT_SYMBOL_GPL(dm_tm_pre_commit); + +@@ -164,8 +164,9 @@ int dm_tm_commit(struct dm_transaction_manager *tm, struct dm_block *root) + return -EWOULDBLOCK; + + wipe_shadow_table(tm); ++ dm_bm_unlock(root); + +- return dm_bm_flush_and_unlock(tm->bm, root); ++ return dm_bm_flush(tm->bm); + } + EXPORT_SYMBOL_GPL(dm_tm_commit); + +diff --git a/drivers/md/persistent-data/dm-transaction-manager.h b/drivers/md/persistent-data/dm-transaction-manager.h +index b5b139076ca5..2772ed2a781a 100644 +--- a/drivers/md/persistent-data/dm-transaction-manager.h ++++ b/drivers/md/persistent-data/dm-transaction-manager.h +@@ -38,18 +38,17 @@ struct dm_transaction_manager *dm_tm_create_non_blocking_clone(struct dm_transac + /* + * We use a 2-phase commit here. + * +- * i) In the first phase the block manager is told to start flushing, and +- * the changes to the space map are written to disk. You should interrogate +- * your particular space map to get detail of its root node etc. to be +- * included in your superblock. ++ * i) Make all changes for the transaction *except* for the superblock. ++ * Then call dm_tm_pre_commit() to flush them to disk. + * +- * ii) @root will be committed last. You shouldn't use more than the +- * first 512 bytes of @root if you wish the transaction to survive a power +- * failure. You *must* have a write lock held on @root for both stage (i) +- * and (ii). The commit will drop the write lock. ++ * ii) Lock your superblock. Update. Then call dm_tm_commit() which will ++ * unlock the superblock and flush it. No other blocks should be updated ++ * during this period. Care should be taken to never unlock a partially ++ * updated superblock; perform any operations that could fail *before* you ++ * take the superblock lock. + */ + int dm_tm_pre_commit(struct dm_transaction_manager *tm); +-int dm_tm_commit(struct dm_transaction_manager *tm, struct dm_block *root); ++int dm_tm_commit(struct dm_transaction_manager *tm, struct dm_block *superblock); + + /* + * These methods are the only way to get hold of a writeable block. +diff --git a/drivers/mtd/nand/atmel_nand.c b/drivers/mtd/nand/atmel_nand.c +index 2d23d2929438..cc69e415df35 100644 +--- a/drivers/mtd/nand/atmel_nand.c ++++ b/drivers/mtd/nand/atmel_nand.c +@@ -1096,6 +1096,7 @@ static int __init atmel_pmecc_nand_init_params(struct platform_device *pdev, + goto err_pmecc_data_alloc; + } + ++ nand_chip->options |= NAND_NO_SUBPAGE_WRITE; + nand_chip->ecc.read_page = atmel_nand_pmecc_read_page; + nand_chip->ecc.write_page = atmel_nand_pmecc_write_page; + +diff --git a/drivers/mtd/nand/nuc900_nand.c b/drivers/mtd/nand/nuc900_nand.c +index cd6be2ed53a8..14203f3bb0cd 100644 +--- a/drivers/mtd/nand/nuc900_nand.c ++++ b/drivers/mtd/nand/nuc900_nand.c +@@ -225,7 +225,7 @@ static void nuc900_nand_enable(struct nuc900_nand *nand) + val = __raw_readl(nand->reg + REG_FMICSR); + + if (!(val & NAND_EN)) +- __raw_writel(val | NAND_EN, REG_FMICSR); ++ __raw_writel(val | NAND_EN, nand->reg + REG_FMICSR); + + val = __raw_readl(nand->reg + REG_SMCSR); + +diff --git a/drivers/mtd/sm_ftl.c b/drivers/mtd/sm_ftl.c +index f9d5615c5727..4b55cd45287b 100644 +--- a/drivers/mtd/sm_ftl.c ++++ b/drivers/mtd/sm_ftl.c +@@ -59,15 +59,12 @@ struct attribute_group *sm_create_sysfs_attributes(struct sm_ftl *ftl) + struct attribute_group *attr_group; + struct attribute **attributes; + struct sm_sysfs_attribute *vendor_attribute; ++ char *vendor; + +- int vendor_len = strnlen(ftl->cis_buffer + SM_CIS_VENDOR_OFFSET, +- SM_SMALL_PAGE - SM_CIS_VENDOR_OFFSET); +- +- char *vendor = kmalloc(vendor_len, GFP_KERNEL); ++ vendor = kstrndup(ftl->cis_buffer + SM_CIS_VENDOR_OFFSET, ++ SM_SMALL_PAGE - SM_CIS_VENDOR_OFFSET, GFP_KERNEL); + if (!vendor) + goto error1; +- memcpy(vendor, ftl->cis_buffer + SM_CIS_VENDOR_OFFSET, vendor_len); +- vendor[vendor_len] = 0; + + /* Initialize sysfs attributes */ + vendor_attribute = +@@ -78,7 +75,7 @@ struct attribute_group *sm_create_sysfs_attributes(struct sm_ftl *ftl) + sysfs_attr_init(&vendor_attribute->dev_attr.attr); + + vendor_attribute->data = vendor; +- vendor_attribute->len = vendor_len; ++ vendor_attribute->len = strlen(vendor); + vendor_attribute->dev_attr.attr.name = "vendor"; + vendor_attribute->dev_attr.attr.mode = S_IRUGO; + vendor_attribute->dev_attr.show = sm_attr_show; +diff --git a/drivers/net/wireless/b43/phy_n.c b/drivers/net/wireless/b43/phy_n.c +index 7c970d3ae358..80ecca3e1465 100644 +--- a/drivers/net/wireless/b43/phy_n.c ++++ b/drivers/net/wireless/b43/phy_n.c +@@ -5175,22 +5175,22 @@ static void b43_nphy_channel_setup(struct b43_wldev *dev, + int ch = new_channel->hw_value; + + u16 old_band_5ghz; +- u32 tmp32; ++ u16 tmp16; + + old_band_5ghz = + b43_phy_read(dev, B43_NPHY_BANDCTL) & B43_NPHY_BANDCTL_5GHZ; + if (new_channel->band == IEEE80211_BAND_5GHZ && !old_band_5ghz) { +- tmp32 = b43_read32(dev, B43_MMIO_PSM_PHY_HDR); +- b43_write32(dev, B43_MMIO_PSM_PHY_HDR, tmp32 | 4); ++ tmp16 = b43_read16(dev, B43_MMIO_PSM_PHY_HDR); ++ b43_write16(dev, B43_MMIO_PSM_PHY_HDR, tmp16 | 4); + b43_phy_set(dev, B43_PHY_B_BBCFG, 0xC000); +- b43_write32(dev, B43_MMIO_PSM_PHY_HDR, tmp32); ++ b43_write16(dev, B43_MMIO_PSM_PHY_HDR, tmp16); + b43_phy_set(dev, B43_NPHY_BANDCTL, B43_NPHY_BANDCTL_5GHZ); + } else if (new_channel->band == IEEE80211_BAND_2GHZ && old_band_5ghz) { + b43_phy_mask(dev, B43_NPHY_BANDCTL, ~B43_NPHY_BANDCTL_5GHZ); +- tmp32 = b43_read32(dev, B43_MMIO_PSM_PHY_HDR); +- b43_write32(dev, B43_MMIO_PSM_PHY_HDR, tmp32 | 4); ++ tmp16 = b43_read16(dev, B43_MMIO_PSM_PHY_HDR); ++ b43_write16(dev, B43_MMIO_PSM_PHY_HDR, tmp16 | 4); + b43_phy_mask(dev, B43_PHY_B_BBCFG, 0x3FFF); +- b43_write32(dev, B43_MMIO_PSM_PHY_HDR, tmp32); ++ b43_write16(dev, B43_MMIO_PSM_PHY_HDR, tmp16); + } + + b43_chantab_phy_upload(dev, e); +diff --git a/drivers/net/wireless/iwlwifi/dvm/main.c b/drivers/net/wireless/iwlwifi/dvm/main.c +index a8afc7bee545..c2b8e49d00d3 100644 +--- a/drivers/net/wireless/iwlwifi/dvm/main.c ++++ b/drivers/net/wireless/iwlwifi/dvm/main.c +@@ -252,13 +252,17 @@ static void iwl_bg_bt_runtime_config(struct work_struct *work) + struct iwl_priv *priv = + container_of(work, struct iwl_priv, bt_runtime_config); + ++ mutex_lock(&priv->mutex); + if (test_bit(STATUS_EXIT_PENDING, &priv->status)) +- return; ++ goto out; + + /* dont send host command if rf-kill is on */ + if (!iwl_is_ready_rf(priv)) +- return; ++ goto out; ++ + iwlagn_send_advance_bt_config(priv); ++out: ++ mutex_unlock(&priv->mutex); + } + + static void iwl_bg_bt_full_concurrency(struct work_struct *work) +diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c b/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c +index e06971be7df7..f923d8c9a296 100644 +--- a/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c +@@ -1025,9 +1025,20 @@ int rtl88ee_hw_init(struct ieee80211_hw *hw) + bool rtstatus = true; + int err = 0; + u8 tmp_u1b, u1byte; ++ unsigned long flags; + + RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "Rtl8188EE hw init\n"); + rtlpriv->rtlhal.being_init_adapter = true; ++ /* As this function can take a very long time (up to 350 ms) ++ * and can be called with irqs disabled, reenable the irqs ++ * to let the other devices continue being serviced. ++ * ++ * It is safe doing so since our own interrupts will only be enabled ++ * in a subsequent step. ++ */ ++ local_save_flags(flags); ++ local_irq_enable(); ++ + rtlpriv->intf_ops->disable_aspm(hw); + + tmp_u1b = rtl_read_byte(rtlpriv, REG_SYS_CLKR+1); +@@ -1043,7 +1054,7 @@ int rtl88ee_hw_init(struct ieee80211_hw *hw) + if (rtstatus != true) { + RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "Init MAC failed\n"); + err = 1; +- return err; ++ goto exit; + } + + err = rtl88e_download_fw(hw, false); +@@ -1051,8 +1062,7 @@ int rtl88ee_hw_init(struct ieee80211_hw *hw) + RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, + "Failed to download FW. Init HW without FW now..\n"); + err = 1; +- rtlhal->fw_ready = false; +- return err; ++ goto exit; + } else { + rtlhal->fw_ready = true; + } +@@ -1135,10 +1145,12 @@ int rtl88ee_hw_init(struct ieee80211_hw *hw) + } + rtl_write_byte(rtlpriv, REG_NAV_CTRL+2, ((30000+127)/128)); + rtl88e_dm_init(hw); ++exit: ++ local_irq_restore(flags); + rtlpriv->rtlhal.being_init_adapter = false; + RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "end of Rtl8188EE hw init %x\n", + err); +- return 0; ++ return err; + } + + static enum version_8188e _rtl88ee_read_chip_version(struct ieee80211_hw *hw) +diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c b/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c +index a8871d66d56a..ea4d014a2884 100644 +--- a/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c ++++ b/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c +@@ -293,7 +293,7 @@ static void _rtl88ee_translate_rx_signal_stuff(struct ieee80211_hw *hw, + u8 *psaddr; + __le16 fc; + u16 type, ufc; +- bool match_bssid, packet_toself, packet_beacon, addr; ++ bool match_bssid, packet_toself, packet_beacon = false, addr; + + tmp_buf = skb->data + pstatus->rx_drvinfo_size + pstatus->rx_bufshift; + +diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c +index 189ba124a8c6..324aa581938e 100644 +--- a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c +@@ -985,6 +985,17 @@ int rtl92cu_hw_init(struct ieee80211_hw *hw) + struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw)); + int err = 0; + static bool iqk_initialized; ++ unsigned long flags; ++ ++ /* As this function can take a very long time (up to 350 ms) ++ * and can be called with irqs disabled, reenable the irqs ++ * to let the other devices continue being serviced. ++ * ++ * It is safe doing so since our own interrupts will only be enabled ++ * in a subsequent step. ++ */ ++ local_save_flags(flags); ++ local_irq_enable(); + + rtlhal->hw_type = HARDWARE_TYPE_RTL8192CU; + err = _rtl92cu_init_mac(hw); +@@ -997,7 +1008,7 @@ int rtl92cu_hw_init(struct ieee80211_hw *hw) + RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, + "Failed to download FW. Init HW without FW now..\n"); + err = 1; +- return err; ++ goto exit; + } + rtlhal->last_hmeboxnum = 0; /* h2c */ + _rtl92cu_phy_param_tab_init(hw); +@@ -1034,6 +1045,8 @@ int rtl92cu_hw_init(struct ieee80211_hw *hw) + _InitPABias(hw); + _update_mac_setting(hw); + rtl92c_dm_init(hw); ++exit: ++ local_irq_restore(flags); + return err; + } + +diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/hw.c b/drivers/net/wireless/rtlwifi/rtl8192se/hw.c +index 4f461786a7eb..c471400fe8f0 100644 +--- a/drivers/net/wireless/rtlwifi/rtl8192se/hw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192se/hw.c +@@ -955,7 +955,7 @@ int rtl92se_hw_init(struct ieee80211_hw *hw) + struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw)); + struct rtl_efuse *rtlefuse = rtl_efuse(rtl_priv(hw)); + u8 tmp_byte = 0; +- ++ unsigned long flags; + bool rtstatus = true; + u8 tmp_u1b; + int err = false; +@@ -967,6 +967,16 @@ int rtl92se_hw_init(struct ieee80211_hw *hw) + + rtlpci->being_init_adapter = true; + ++ /* As this function can take a very long time (up to 350 ms) ++ * and can be called with irqs disabled, reenable the irqs ++ * to let the other devices continue being serviced. ++ * ++ * It is safe doing so since our own interrupts will only be enabled ++ * in a subsequent step. ++ */ ++ local_save_flags(flags); ++ local_irq_enable(); ++ + rtlpriv->intf_ops->disable_aspm(hw); + + /* 1. MAC Initialize */ +@@ -984,7 +994,8 @@ int rtl92se_hw_init(struct ieee80211_hw *hw) + RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, + "Failed to download FW. Init HW without FW now... " + "Please copy FW into /lib/firmware/rtlwifi\n"); +- return 1; ++ err = 1; ++ goto exit; + } + + /* After FW download, we have to reset MAC register */ +@@ -997,7 +1008,8 @@ int rtl92se_hw_init(struct ieee80211_hw *hw) + /* 3. Initialize MAC/PHY Config by MACPHY_reg.txt */ + if (!rtl92s_phy_mac_config(hw)) { + RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "MAC Config failed\n"); +- return rtstatus; ++ err = rtstatus; ++ goto exit; + } + + /* because last function modify RCR, so we update +@@ -1016,7 +1028,8 @@ int rtl92se_hw_init(struct ieee80211_hw *hw) + /* 4. Initialize BB After MAC Config PHY_reg.txt, AGC_Tab.txt */ + if (!rtl92s_phy_bb_config(hw)) { + RT_TRACE(rtlpriv, COMP_INIT, DBG_EMERG, "BB Config failed\n"); +- return rtstatus; ++ err = rtstatus; ++ goto exit; + } + + /* 5. Initiailze RF RAIO_A.txt RF RAIO_B.txt */ +@@ -1033,7 +1046,8 @@ int rtl92se_hw_init(struct ieee80211_hw *hw) + + if (!rtl92s_phy_rf_config(hw)) { + RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "RF Config failed\n"); +- return rtstatus; ++ err = rtstatus; ++ goto exit; + } + + /* After read predefined TXT, we must set BB/MAC/RF +@@ -1122,8 +1136,9 @@ int rtl92se_hw_init(struct ieee80211_hw *hw) + + rtlpriv->cfg->ops->led_control(hw, LED_CTL_POWER_ON); + rtl92s_dm_init(hw); ++exit: ++ local_irq_restore(flags); + rtlpci->being_init_adapter = false; +- + return err; + } + +diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c +index 7d0f2e20f1a2..c240b7591cf0 100644 +--- a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c +@@ -49,6 +49,12 @@ static u8 _rtl92se_map_hwqueue_to_fwqueue(struct sk_buff *skb, u8 skb_queue) + if (ieee80211_is_nullfunc(fc)) + return QSLT_HIGH; + ++ /* Kernel commit 1bf4bbb4024dcdab changed EAPOL packets to use ++ * queue V0 at priority 7; however, the RTL8192SE appears to have ++ * that queue at priority 6 ++ */ ++ if (skb->priority == 7) ++ return QSLT_VO; + return skb->priority; + } + +diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c b/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c +index c333dfd116b8..99f6bc5fa986 100644 +--- a/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c +@@ -880,14 +880,25 @@ int rtl8723ae_hw_init(struct ieee80211_hw *hw) + bool rtstatus = true; + int err; + u8 tmp_u1b; ++ unsigned long flags; + + rtlpriv->rtlhal.being_init_adapter = true; ++ /* As this function can take a very long time (up to 350 ms) ++ * and can be called with irqs disabled, reenable the irqs ++ * to let the other devices continue being serviced. ++ * ++ * It is safe doing so since our own interrupts will only be enabled ++ * in a subsequent step. ++ */ ++ local_save_flags(flags); ++ local_irq_enable(); ++ + rtlpriv->intf_ops->disable_aspm(hw); + rtstatus = _rtl8712e_init_mac(hw); + if (rtstatus != true) { + RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "Init MAC failed\n"); + err = 1; +- return err; ++ goto exit; + } + + err = rtl8723ae_download_fw(hw); +@@ -895,8 +906,7 @@ int rtl8723ae_hw_init(struct ieee80211_hw *hw) + RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, + "Failed to download FW. Init HW without FW now..\n"); + err = 1; +- rtlhal->fw_ready = false; +- return err; ++ goto exit; + } else { + rtlhal->fw_ready = true; + } +@@ -971,6 +981,8 @@ int rtl8723ae_hw_init(struct ieee80211_hw *hw) + RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE, "under 1.5V\n"); + } + rtl8723ae_dm_init(hw); ++exit: ++ local_irq_restore(flags); + rtlpriv->rtlhal.being_init_adapter = false; + return err; + } +diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c +index 8ea7d9b2c671..815e290a1afb 100644 +--- a/drivers/s390/cio/chsc.c ++++ b/drivers/s390/cio/chsc.c +@@ -500,18 +500,27 @@ static void chsc_process_sei_nt0(struct chsc_sei_nt0_area *sei_area) + + static void chsc_process_event_information(struct chsc_sei *sei, u64 ntsm) + { +- do { ++ static int ntsm_unsupported; ++ ++ while (true) { + memset(sei, 0, sizeof(*sei)); + sei->request.length = 0x0010; + sei->request.code = 0x000e; +- sei->ntsm = ntsm; ++ if (!ntsm_unsupported) ++ sei->ntsm = ntsm; + + if (chsc(sei)) + break; + + if (sei->response.code != 0x0001) { +- CIO_CRW_EVENT(2, "chsc: sei failed (rc=%04x)\n", +- sei->response.code); ++ CIO_CRW_EVENT(2, "chsc: sei failed (rc=%04x, ntsm=%llx)\n", ++ sei->response.code, sei->ntsm); ++ ++ if (sei->response.code == 3 && sei->ntsm) { ++ /* Fallback for old firmware. */ ++ ntsm_unsupported = 1; ++ continue; ++ } + break; + } + +@@ -527,7 +536,10 @@ static void chsc_process_event_information(struct chsc_sei *sei, u64 ntsm) + CIO_CRW_EVENT(2, "chsc: unhandled nt: %d\n", sei->nt); + break; + } +- } while (sei->u.nt0_area.flags & 0x80); ++ ++ if (!(sei->u.nt0_area.flags & 0x80)) ++ break; ++ } + } + + /* +diff --git a/drivers/scsi/mpt2sas/mpt2sas_scsih.c b/drivers/scsi/mpt2sas/mpt2sas_scsih.c +index 8dbe500c935d..fe76185cd79a 100644 +--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c ++++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c +@@ -8174,7 +8174,6 @@ _scsih_suspend(struct pci_dev *pdev, pm_message_t state) + + mpt2sas_base_free_resources(ioc); + pci_save_state(pdev); +- pci_disable_device(pdev); + pci_set_power_state(pdev, device_state); + return 0; + } +diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c +index b26f1a5cc0ec..95a5d73e675c 100644 +--- a/drivers/scsi/virtio_scsi.c ++++ b/drivers/scsi/virtio_scsi.c +@@ -751,8 +751,12 @@ static void __virtscsi_set_affinity(struct virtio_scsi *vscsi, bool affinity) + + vscsi->affinity_hint_set = true; + } else { +- for (i = 0; i < vscsi->num_queues; i++) ++ for (i = 0; i < vscsi->num_queues; i++) { ++ if (!vscsi->req_vqs[i].vq) ++ continue; ++ + virtqueue_set_affinity(vscsi->req_vqs[i].vq, -1); ++ } + + vscsi->affinity_hint_set = false; + } +diff --git a/drivers/tty/hvc/hvc_console.c b/drivers/tty/hvc/hvc_console.c +index a2a2645b296c..f179033eaa3e 100644 +--- a/drivers/tty/hvc/hvc_console.c ++++ b/drivers/tty/hvc/hvc_console.c +@@ -190,7 +190,7 @@ static struct tty_driver *hvc_console_device(struct console *c, int *index) + return hvc_driver; + } + +-static int __init hvc_console_setup(struct console *co, char *options) ++static int hvc_console_setup(struct console *co, char *options) + { + if (co->index < 0 || co->index >= MAX_NR_HVC_CONSOLES) + return -ENODEV; +diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c +index 6c7fe90ad72d..6cfe4019abc6 100644 +--- a/drivers/tty/n_tty.c ++++ b/drivers/tty/n_tty.c +@@ -2066,8 +2066,12 @@ static ssize_t n_tty_write(struct tty_struct *tty, struct file *file, + if (tty->ops->flush_chars) + tty->ops->flush_chars(tty); + } else { ++ struct n_tty_data *ldata = tty->disc_data; ++ + while (nr > 0) { ++ mutex_lock(&ldata->output_lock); + c = tty->ops->write(tty, b, nr); ++ mutex_unlock(&ldata->output_lock); + if (c < 0) { + retval = c; + goto break_out; +diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c +index d28d7afc128a..b167665b7de2 100644 +--- a/drivers/tty/serial/8250/8250_core.c ++++ b/drivers/tty/serial/8250/8250_core.c +@@ -555,7 +555,7 @@ static void serial8250_set_sleep(struct uart_8250_port *p, int sleep) + */ + if ((p->port.type == PORT_XR17V35X) || + (p->port.type == PORT_XR17D15X)) { +- serial_out(p, UART_EXAR_SLEEP, 0xff); ++ serial_out(p, UART_EXAR_SLEEP, sleep ? 0xff : 0); + return; + } + +diff --git a/drivers/video/aty/mach64_accel.c b/drivers/video/aty/mach64_accel.c +index e45833ce975b..182bd680141f 100644 +--- a/drivers/video/aty/mach64_accel.c ++++ b/drivers/video/aty/mach64_accel.c +@@ -4,6 +4,7 @@ + */ + + #include ++#include + #include + #include