From e6e010999e6464edc842c9adfa133b65fb036c93 Mon Sep 17 00:00:00 2001 From: Stephan Raue Date: Fri, 11 Jul 2014 05:26:25 +0200 Subject: [PATCH] projects/Cuboxi/patches/linux: add upstream patches Signed-off-by: Stephan Raue --- .../linux/linux-000-patch-3.10.40-41.patch | 3336 +++++++++++++++ .../linux/linux-000-patch-3.10.41-42.patch | 3808 +++++++++++++++++ .../linux/linux-000-patch-3.10.42-43.patch | 1387 ++++++ .../linux/linux-000-patch-3.10.43-44.patch | 755 ++++ .../linux/linux-000-patch-3.10.44-45.patch | 2642 ++++++++++++ .../linux/linux-000-patch-3.10.45-46.patch | 2568 +++++++++++ .../linux/linux-000-patch-3.10.46-47.patch | 1412 ++++++ .../linux/linux-000-patch-3.10.47-48.patch | 1525 +++++++ 8 files changed, 17433 insertions(+) create mode 100644 projects/Cuboxi/patches/linux/linux-000-patch-3.10.40-41.patch create mode 100644 projects/Cuboxi/patches/linux/linux-000-patch-3.10.41-42.patch create mode 100644 projects/Cuboxi/patches/linux/linux-000-patch-3.10.42-43.patch create mode 100644 projects/Cuboxi/patches/linux/linux-000-patch-3.10.43-44.patch create mode 100644 projects/Cuboxi/patches/linux/linux-000-patch-3.10.44-45.patch create mode 100644 projects/Cuboxi/patches/linux/linux-000-patch-3.10.45-46.patch create mode 100644 projects/Cuboxi/patches/linux/linux-000-patch-3.10.46-47.patch create mode 100644 projects/Cuboxi/patches/linux/linux-000-patch-3.10.47-48.patch diff --git a/projects/Cuboxi/patches/linux/linux-000-patch-3.10.40-41.patch b/projects/Cuboxi/patches/linux/linux-000-patch-3.10.40-41.patch new file mode 100644 index 0000000000..43809f3da2 --- /dev/null +++ b/projects/Cuboxi/patches/linux/linux-000-patch-3.10.40-41.patch @@ -0,0 +1,3336 @@ +diff --git a/Makefile b/Makefile +index b2285cababb0..370cc01afb07 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 10 +-SUBLEVEL = 40 ++SUBLEVEL = 41 + EXTRAVERSION = + NAME = TOSSUG Baby Fish + +diff --git a/arch/arm/configs/multi_v7_defconfig b/arch/arm/configs/multi_v7_defconfig +index 2e67a272df70..9ce8ba1a1433 100644 +--- a/arch/arm/configs/multi_v7_defconfig ++++ b/arch/arm/configs/multi_v7_defconfig +@@ -1,6 +1,7 @@ + CONFIG_EXPERIMENTAL=y + CONFIG_NO_HZ=y + CONFIG_HIGH_RES_TIMERS=y ++CONFIG_BLK_DEV_INITRD=y + CONFIG_ARCH_MVEBU=y + CONFIG_MACH_ARMADA_370=y + CONFIG_ARCH_SIRF=y +@@ -22,6 +23,7 @@ CONFIG_AEABI=y + CONFIG_HIGHMEM=y + CONFIG_HIGHPTE=y + CONFIG_ARM_APPENDED_DTB=y ++CONFIG_ARM_ATAG_DTB_COMPAT=y + CONFIG_VFP=y + CONFIG_NEON=y + CONFIG_NET=y +diff --git a/arch/parisc/kernel/syscall_table.S b/arch/parisc/kernel/syscall_table.S +index 0c9107285e66..10a0c2aad8cf 100644 +--- a/arch/parisc/kernel/syscall_table.S ++++ b/arch/parisc/kernel/syscall_table.S +@@ -392,7 +392,7 @@ + ENTRY_COMP(vmsplice) + ENTRY_COMP(move_pages) /* 295 */ + ENTRY_SAME(getcpu) +- ENTRY_SAME(epoll_pwait) ++ ENTRY_COMP(epoll_pwait) + ENTRY_COMP(statfs64) + ENTRY_COMP(fstatfs64) + ENTRY_COMP(kexec_load) /* 300 */ +diff --git a/arch/powerpc/lib/crtsavres.S b/arch/powerpc/lib/crtsavres.S +index b2c68ce139ae..a5b30c71a8d3 100644 +--- a/arch/powerpc/lib/crtsavres.S ++++ b/arch/powerpc/lib/crtsavres.S +@@ -231,6 +231,87 @@ _GLOBAL(_rest32gpr_31_x) + mr 1,11 + blr + ++#ifdef CONFIG_ALTIVEC ++/* Called with r0 pointing just beyond the end of the vector save area. */ ++ ++_GLOBAL(_savevr_20) ++ li r11,-192 ++ stvx vr20,r11,r0 ++_GLOBAL(_savevr_21) ++ li r11,-176 ++ stvx vr21,r11,r0 ++_GLOBAL(_savevr_22) ++ li r11,-160 ++ stvx vr22,r11,r0 ++_GLOBAL(_savevr_23) ++ li r11,-144 ++ stvx vr23,r11,r0 ++_GLOBAL(_savevr_24) ++ li r11,-128 ++ stvx vr24,r11,r0 ++_GLOBAL(_savevr_25) ++ li r11,-112 ++ stvx vr25,r11,r0 ++_GLOBAL(_savevr_26) ++ li r11,-96 ++ stvx vr26,r11,r0 ++_GLOBAL(_savevr_27) ++ li r11,-80 ++ stvx vr27,r11,r0 ++_GLOBAL(_savevr_28) ++ li r11,-64 ++ stvx vr28,r11,r0 ++_GLOBAL(_savevr_29) ++ li r11,-48 ++ stvx vr29,r11,r0 ++_GLOBAL(_savevr_30) ++ li r11,-32 ++ stvx vr30,r11,r0 ++_GLOBAL(_savevr_31) ++ li r11,-16 ++ stvx vr31,r11,r0 ++ blr ++ ++_GLOBAL(_restvr_20) ++ li r11,-192 ++ lvx vr20,r11,r0 ++_GLOBAL(_restvr_21) ++ li r11,-176 ++ lvx vr21,r11,r0 ++_GLOBAL(_restvr_22) ++ li r11,-160 ++ lvx vr22,r11,r0 ++_GLOBAL(_restvr_23) ++ li r11,-144 ++ lvx vr23,r11,r0 ++_GLOBAL(_restvr_24) ++ li r11,-128 ++ lvx vr24,r11,r0 ++_GLOBAL(_restvr_25) ++ li r11,-112 ++ lvx vr25,r11,r0 ++_GLOBAL(_restvr_26) ++ li r11,-96 ++ lvx vr26,r11,r0 ++_GLOBAL(_restvr_27) ++ li r11,-80 ++ lvx vr27,r11,r0 ++_GLOBAL(_restvr_28) ++ li r11,-64 ++ lvx vr28,r11,r0 ++_GLOBAL(_restvr_29) ++ li r11,-48 ++ lvx vr29,r11,r0 ++_GLOBAL(_restvr_30) ++ li r11,-32 ++ lvx vr30,r11,r0 ++_GLOBAL(_restvr_31) ++ li r11,-16 ++ lvx vr31,r11,r0 ++ blr ++ ++#endif /* CONFIG_ALTIVEC */ ++ + #else /* CONFIG_PPC64 */ + + .section ".text.save.restore","ax",@progbits +@@ -356,6 +437,111 @@ _restgpr0_31: + mtlr r0 + blr + ++#ifdef CONFIG_ALTIVEC ++/* Called with r0 pointing just beyond the end of the vector save area. */ ++ ++.globl _savevr_20 ++_savevr_20: ++ li r12,-192 ++ stvx vr20,r12,r0 ++.globl _savevr_21 ++_savevr_21: ++ li r12,-176 ++ stvx vr21,r12,r0 ++.globl _savevr_22 ++_savevr_22: ++ li r12,-160 ++ stvx vr22,r12,r0 ++.globl _savevr_23 ++_savevr_23: ++ li r12,-144 ++ stvx vr23,r12,r0 ++.globl _savevr_24 ++_savevr_24: ++ li r12,-128 ++ stvx vr24,r12,r0 ++.globl _savevr_25 ++_savevr_25: ++ li r12,-112 ++ stvx vr25,r12,r0 ++.globl _savevr_26 ++_savevr_26: ++ li r12,-96 ++ stvx vr26,r12,r0 ++.globl _savevr_27 ++_savevr_27: ++ li r12,-80 ++ stvx vr27,r12,r0 ++.globl _savevr_28 ++_savevr_28: ++ li r12,-64 ++ stvx vr28,r12,r0 ++.globl _savevr_29 ++_savevr_29: ++ li r12,-48 ++ stvx vr29,r12,r0 ++.globl _savevr_30 ++_savevr_30: ++ li r12,-32 ++ stvx vr30,r12,r0 ++.globl _savevr_31 ++_savevr_31: ++ li r12,-16 ++ stvx vr31,r12,r0 ++ blr ++ ++.globl _restvr_20 ++_restvr_20: ++ li r12,-192 ++ lvx vr20,r12,r0 ++.globl _restvr_21 ++_restvr_21: ++ li r12,-176 ++ lvx vr21,r12,r0 ++.globl _restvr_22 ++_restvr_22: ++ li r12,-160 ++ lvx vr22,r12,r0 ++.globl _restvr_23 ++_restvr_23: ++ li r12,-144 ++ lvx vr23,r12,r0 ++.globl _restvr_24 ++_restvr_24: ++ li r12,-128 ++ lvx vr24,r12,r0 ++.globl _restvr_25 ++_restvr_25: ++ li r12,-112 ++ lvx vr25,r12,r0 ++.globl _restvr_26 ++_restvr_26: ++ li r12,-96 ++ lvx vr26,r12,r0 ++.globl _restvr_27 ++_restvr_27: ++ li r12,-80 ++ lvx vr27,r12,r0 ++.globl _restvr_28 ++_restvr_28: ++ li r12,-64 ++ lvx vr28,r12,r0 ++.globl _restvr_29 ++_restvr_29: ++ li r12,-48 ++ lvx vr29,r12,r0 ++.globl _restvr_30 ++_restvr_30: ++ li r12,-32 ++ lvx vr30,r12,r0 ++.globl _restvr_31 ++_restvr_31: ++ li r12,-16 ++ lvx vr31,r12,r0 ++ blr ++ ++#endif /* CONFIG_ALTIVEC */ ++ + #endif /* CONFIG_PPC64 */ + + #endif +diff --git a/block/blk-core.c b/block/blk-core.c +index 2c66daba44dd..5a750b18172e 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -2299,7 +2299,7 @@ bool blk_update_request(struct request *req, int error, unsigned int nr_bytes) + if (!req->bio) + return false; + +- trace_block_rq_complete(req->q, req); ++ trace_block_rq_complete(req->q, req, nr_bytes); + + /* + * For fs requests, rq is just carrier of independent bio's +diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c +index c421fa528518..1e89a3dd3d51 100644 +--- a/drivers/block/rbd.c ++++ b/drivers/block/rbd.c +@@ -2278,7 +2278,7 @@ out_partial: + rbd_obj_request_put(obj_request); + out_unwind: + for_each_obj_request_safe(img_request, obj_request, next_obj_request) +- rbd_obj_request_put(obj_request); ++ rbd_img_obj_request_del(img_request, obj_request); + + return -ENOMEM; + } +diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c +index afb701ec90ca..0f3e3047e29c 100644 +--- a/drivers/firewire/ohci.c ++++ b/drivers/firewire/ohci.c +@@ -271,6 +271,7 @@ static inline struct fw_ohci *fw_ohci(struct fw_card *card) + + static char ohci_driver_name[] = KBUILD_MODNAME; + ++#define PCI_VENDOR_ID_PINNACLE_SYSTEMS 0x11bd + #define PCI_DEVICE_ID_AGERE_FW643 0x5901 + #define PCI_DEVICE_ID_CREATIVE_SB1394 0x4001 + #define PCI_DEVICE_ID_JMICRON_JMB38X_FW 0x2380 +@@ -278,17 +279,15 @@ static char ohci_driver_name[] = KBUILD_MODNAME; + #define PCI_DEVICE_ID_TI_TSB12LV26 0x8020 + #define PCI_DEVICE_ID_TI_TSB82AA2 0x8025 + #define PCI_DEVICE_ID_VIA_VT630X 0x3044 +-#define PCI_VENDOR_ID_PINNACLE_SYSTEMS 0x11bd + #define PCI_REV_ID_VIA_VT6306 0x46 + +-#define QUIRK_CYCLE_TIMER 1 +-#define QUIRK_RESET_PACKET 2 +-#define QUIRK_BE_HEADERS 4 +-#define QUIRK_NO_1394A 8 +-#define QUIRK_NO_MSI 16 +-#define QUIRK_TI_SLLZ059 32 +-#define QUIRK_IR_WAKE 64 +-#define QUIRK_PHY_LCTRL_TIMEOUT 128 ++#define QUIRK_CYCLE_TIMER 0x1 ++#define QUIRK_RESET_PACKET 0x2 ++#define QUIRK_BE_HEADERS 0x4 ++#define QUIRK_NO_1394A 0x8 ++#define QUIRK_NO_MSI 0x10 ++#define QUIRK_TI_SLLZ059 0x20 ++#define QUIRK_IR_WAKE 0x40 + + /* In case of multiple matches in ohci_quirks[], only the first one is used. */ + static const struct { +@@ -301,10 +300,7 @@ static const struct { + QUIRK_BE_HEADERS}, + + {PCI_VENDOR_ID_ATT, PCI_DEVICE_ID_AGERE_FW643, 6, +- QUIRK_PHY_LCTRL_TIMEOUT | QUIRK_NO_MSI}, +- +- {PCI_VENDOR_ID_ATT, PCI_ANY_ID, PCI_ANY_ID, +- QUIRK_PHY_LCTRL_TIMEOUT}, ++ QUIRK_NO_MSI}, + + {PCI_VENDOR_ID_CREATIVE, PCI_DEVICE_ID_CREATIVE_SB1394, PCI_ANY_ID, + QUIRK_RESET_PACKET}, +@@ -351,7 +347,6 @@ MODULE_PARM_DESC(quirks, "Chip quirks (default = 0" + ", disable MSI = " __stringify(QUIRK_NO_MSI) + ", TI SLLZ059 erratum = " __stringify(QUIRK_TI_SLLZ059) + ", IR wake unreliable = " __stringify(QUIRK_IR_WAKE) +- ", phy LCtrl timeout = " __stringify(QUIRK_PHY_LCTRL_TIMEOUT) + ")"); + + #define OHCI_PARAM_DEBUG_AT_AR 1 +@@ -2293,9 +2288,6 @@ static int ohci_enable(struct fw_card *card, + * TI TSB82AA2 + TSB81BA3(A) cards signal LPS enabled early but + * cannot actually use the phy at that time. These need tens of + * millisecods pause between LPS write and first phy access too. +- * +- * But do not wait for 50msec on Agere/LSI cards. Their phy +- * arbitration state machine may time out during such a long wait. + */ + + reg_write(ohci, OHCI1394_HCControlSet, +@@ -2303,11 +2295,8 @@ static int ohci_enable(struct fw_card *card, + OHCI1394_HCControl_postedWriteEnable); + flush_writes(ohci); + +- if (!(ohci->quirks & QUIRK_PHY_LCTRL_TIMEOUT)) ++ for (lps = 0, i = 0; !lps && i < 3; i++) { + msleep(50); +- +- for (lps = 0, i = 0; !lps && i < 150; i++) { +- msleep(1); + lps = reg_read(ohci, OHCI1394_HCControlSet) & + OHCI1394_HCControl_LPS; + } +diff --git a/drivers/gpu/drm/qxl/qxl_ttm.c b/drivers/gpu/drm/qxl/qxl_ttm.c +index 489cb8cece4d..3401eb86786c 100644 +--- a/drivers/gpu/drm/qxl/qxl_ttm.c ++++ b/drivers/gpu/drm/qxl/qxl_ttm.c +@@ -431,6 +431,7 @@ static int qxl_sync_obj_flush(void *sync_obj) + + static void qxl_sync_obj_unref(void **sync_obj) + { ++ *sync_obj = NULL; + } + + static void *qxl_sync_obj_ref(void *sync_obj) +diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c +index eb18bb7af1cc..06ccfe477650 100644 +--- a/drivers/gpu/drm/radeon/radeon_display.c ++++ b/drivers/gpu/drm/radeon/radeon_display.c +@@ -729,6 +729,7 @@ int radeon_ddc_get_modes(struct radeon_connector *radeon_connector) + if (radeon_connector->edid) { + drm_mode_connector_update_edid_property(&radeon_connector->base, radeon_connector->edid); + ret = drm_add_edid_modes(&radeon_connector->base, radeon_connector->edid); ++ drm_edid_to_eld(&radeon_connector->base, radeon_connector->edid); + return ret; + } + drm_mode_connector_update_edid_property(&radeon_connector->base, NULL); +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +index 394e6476105b..da068bd13f92 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +@@ -834,14 +834,36 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv, + SVGA3dCmdSurfaceDMA dma; + } *cmd; + int ret; ++ SVGA3dCmdSurfaceDMASuffix *suffix; ++ uint32_t bo_size; + + cmd = container_of(header, struct vmw_dma_cmd, header); ++ suffix = (SVGA3dCmdSurfaceDMASuffix *)((unsigned long) &cmd->dma + ++ header->size - sizeof(*suffix)); ++ ++ /* Make sure device and verifier stays in sync. */ ++ if (unlikely(suffix->suffixSize != sizeof(*suffix))) { ++ DRM_ERROR("Invalid DMA suffix size.\n"); ++ return -EINVAL; ++ } ++ + ret = vmw_translate_guest_ptr(dev_priv, sw_context, + &cmd->dma.guest.ptr, + &vmw_bo); + if (unlikely(ret != 0)) + return ret; + ++ /* Make sure DMA doesn't cross BO boundaries. */ ++ bo_size = vmw_bo->base.num_pages * PAGE_SIZE; ++ if (unlikely(cmd->dma.guest.ptr.offset > bo_size)) { ++ DRM_ERROR("Invalid DMA offset.\n"); ++ return -EINVAL; ++ } ++ ++ bo_size -= cmd->dma.guest.ptr.offset; ++ if (unlikely(suffix->maximumOffset > bo_size)) ++ suffix->maximumOffset = bo_size; ++ + ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface, + user_surface_converter, &cmd->dma.host.sid, + NULL); +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c +index ed5ce2a41bbf..021b5227e783 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c +@@ -147,7 +147,7 @@ static int vmw_fb_check_var(struct fb_var_screeninfo *var, + } + + if (!vmw_kms_validate_mode_vram(vmw_priv, +- info->fix.line_length, ++ var->xres * var->bits_per_pixel/8, + var->yoffset + var->yres)) { + DRM_ERROR("Requested geom can not fit in framebuffer\n"); + return -EINVAL; +@@ -162,6 +162,8 @@ static int vmw_fb_set_par(struct fb_info *info) + struct vmw_private *vmw_priv = par->vmw_priv; + int ret; + ++ info->fix.line_length = info->var.xres * info->var.bits_per_pixel/8; ++ + ret = vmw_kms_write_svga(vmw_priv, info->var.xres, info->var.yres, + info->fix.line_length, + par->bpp, par->depth); +@@ -177,6 +179,7 @@ static int vmw_fb_set_par(struct fb_info *info) + vmw_write(vmw_priv, SVGA_REG_DISPLAY_POSITION_Y, info->var.yoffset); + vmw_write(vmw_priv, SVGA_REG_DISPLAY_WIDTH, info->var.xres); + vmw_write(vmw_priv, SVGA_REG_DISPLAY_HEIGHT, info->var.yres); ++ vmw_write(vmw_priv, SVGA_REG_BYTES_PER_LINE, info->fix.line_length); + vmw_write(vmw_priv, SVGA_REG_DISPLAY_ID, SVGA_ID_INVALID); + } + +diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c +index e73740b55aea..75771b2077c0 100644 +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -94,6 +94,7 @@ static void * r1buf_pool_alloc(gfp_t gfp_flags, void *data) + struct pool_info *pi = data; + struct r1bio *r1_bio; + struct bio *bio; ++ int need_pages; + int i, j; + + r1_bio = r1bio_pool_alloc(gfp_flags, pi); +@@ -116,15 +117,15 @@ static void * r1buf_pool_alloc(gfp_t gfp_flags, void *data) + * RESYNC_PAGES for each bio. + */ + if (test_bit(MD_RECOVERY_REQUESTED, &pi->mddev->recovery)) +- j = pi->raid_disks; ++ need_pages = pi->raid_disks; + else +- j = 1; +- while(j--) { ++ need_pages = 1; ++ for (j = 0; j < need_pages; j++) { + bio = r1_bio->bios[j]; + bio->bi_vcnt = RESYNC_PAGES; + + if (bio_alloc_pages(bio, gfp_flags)) +- goto out_free_bio; ++ goto out_free_pages; + } + /* If not user-requests, copy the page pointers to all bios */ + if (!test_bit(MD_RECOVERY_REQUESTED, &pi->mddev->recovery)) { +@@ -138,6 +139,14 @@ static void * r1buf_pool_alloc(gfp_t gfp_flags, void *data) + + return r1_bio; + ++out_free_pages: ++ while (--j >= 0) { ++ struct bio_vec *bv; ++ ++ bio_for_each_segment_all(bv, r1_bio->bios[j], i) ++ __free_page(bv->bv_page); ++ } ++ + out_free_bio: + while (++j < pi->raid_disks) + bio_put(r1_bio->bios[j]); +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index 8395b0992a89..b143ce91e081 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -4995,6 +4995,7 @@ static int __init bonding_init(void) + out: + return res; + err: ++ bond_destroy_debugfs(); + rtnl_link_unregister(&bond_link_ops); + err_link: + unregister_pernet_subsys(&bond_net_ops); +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c +index 32a9609cc98b..fd50781e996c 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c +@@ -1038,9 +1038,6 @@ static void bnx2x_set_one_vlan_mac_e1h(struct bnx2x *bp, + ETH_VLAN_FILTER_CLASSIFY, config); + } + +-#define list_next_entry(pos, member) \ +- list_entry((pos)->member.next, typeof(*(pos)), member) +- + /** + * bnx2x_vlan_mac_restore - reconfigure next MAC/VLAN/VLAN-MAC element + * +diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c +index 4a0db617ab64..4942ddf9c8ae 100644 +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -12073,7 +12073,9 @@ static int tg3_set_ringparam(struct net_device *dev, struct ethtool_ringparam *e + if (tg3_flag(tp, MAX_RXPEND_64) && + tp->rx_pending > 63) + tp->rx_pending = 63; +- tp->rx_jumbo_pending = ering->rx_jumbo_pending; ++ ++ if (tg3_flag(tp, JUMBO_RING_ENABLE)) ++ tp->rx_jumbo_pending = ering->rx_jumbo_pending; + + for (i = 0; i < tp->irq_max; i++) + tp->napi[i].tx_pending = ering->tx_pending; +diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c +index 06eba6e480c9..c12aeaee22fa 100644 +--- a/drivers/net/macvlan.c ++++ b/drivers/net/macvlan.c +@@ -261,11 +261,9 @@ static int macvlan_queue_xmit(struct sk_buff *skb, struct net_device *dev) + const struct macvlan_dev *vlan = netdev_priv(dev); + const struct macvlan_port *port = vlan->port; + const struct macvlan_dev *dest; +- __u8 ip_summed = skb->ip_summed; + + if (vlan->mode == MACVLAN_MODE_BRIDGE) { + const struct ethhdr *eth = (void *)skb->data; +- skb->ip_summed = CHECKSUM_UNNECESSARY; + + /* send to other bridge ports directly */ + if (is_multicast_ether_addr(eth->h_dest)) { +@@ -283,7 +281,6 @@ static int macvlan_queue_xmit(struct sk_buff *skb, struct net_device *dev) + } + + xmit_world: +- skb->ip_summed = ip_summed; + skb->dev = vlan->lowerdev; + return dev_queue_xmit(skb); + } +@@ -423,8 +420,10 @@ static void macvlan_change_rx_flags(struct net_device *dev, int change) + struct macvlan_dev *vlan = netdev_priv(dev); + struct net_device *lowerdev = vlan->lowerdev; + +- if (change & IFF_ALLMULTI) +- dev_set_allmulti(lowerdev, dev->flags & IFF_ALLMULTI ? 1 : -1); ++ if (dev->flags & IFF_UP) { ++ if (change & IFF_ALLMULTI) ++ dev_set_allmulti(lowerdev, dev->flags & IFF_ALLMULTI ? 1 : -1); ++ } + } + + static void macvlan_set_mac_lists(struct net_device *dev) +diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c +index 25ba7eca9a13..7cabe4583904 100644 +--- a/drivers/net/usb/cdc_mbim.c ++++ b/drivers/net/usb/cdc_mbim.c +@@ -120,6 +120,16 @@ static void cdc_mbim_unbind(struct usbnet *dev, struct usb_interface *intf) + cdc_ncm_unbind(dev, intf); + } + ++/* verify that the ethernet protocol is IPv4 or IPv6 */ ++static bool is_ip_proto(__be16 proto) ++{ ++ switch (proto) { ++ case htons(ETH_P_IP): ++ case htons(ETH_P_IPV6): ++ return true; ++ } ++ return false; ++} + + static struct sk_buff *cdc_mbim_tx_fixup(struct usbnet *dev, struct sk_buff *skb, gfp_t flags) + { +@@ -128,6 +138,7 @@ static struct sk_buff *cdc_mbim_tx_fixup(struct usbnet *dev, struct sk_buff *skb + struct cdc_ncm_ctx *ctx = info->ctx; + __le32 sign = cpu_to_le32(USB_CDC_MBIM_NDP16_IPS_SIGN); + u16 tci = 0; ++ bool is_ip; + u8 *c; + + if (!ctx) +@@ -137,25 +148,32 @@ static struct sk_buff *cdc_mbim_tx_fixup(struct usbnet *dev, struct sk_buff *skb + if (skb->len <= ETH_HLEN) + goto error; + ++ /* Some applications using e.g. packet sockets will ++ * bypass the VLAN acceleration and create tagged ++ * ethernet frames directly. We primarily look for ++ * the accelerated out-of-band tag, but fall back if ++ * required ++ */ ++ skb_reset_mac_header(skb); ++ if (vlan_get_tag(skb, &tci) < 0 && skb->len > VLAN_ETH_HLEN && ++ __vlan_get_tag(skb, &tci) == 0) { ++ is_ip = is_ip_proto(vlan_eth_hdr(skb)->h_vlan_encapsulated_proto); ++ skb_pull(skb, VLAN_ETH_HLEN); ++ } else { ++ is_ip = is_ip_proto(eth_hdr(skb)->h_proto); ++ skb_pull(skb, ETH_HLEN); ++ } ++ + /* mapping VLANs to MBIM sessions: + * no tag => IPS session <0> + * 1 - 255 => IPS session + * 256 - 511 => DSS session + * 512 - 4095 => unsupported, drop + */ +- vlan_get_tag(skb, &tci); +- + switch (tci & 0x0f00) { + case 0x0000: /* VLAN ID 0 - 255 */ +- /* verify that datagram is IPv4 or IPv6 */ +- skb_reset_mac_header(skb); +- switch (eth_hdr(skb)->h_proto) { +- case htons(ETH_P_IP): +- case htons(ETH_P_IPV6): +- break; +- default: ++ if (!is_ip) + goto error; +- } + c = (u8 *)&sign; + c[3] = tci; + break; +@@ -169,7 +187,6 @@ static struct sk_buff *cdc_mbim_tx_fixup(struct usbnet *dev, struct sk_buff *skb + "unsupported tci=0x%04x\n", tci); + goto error; + } +- skb_pull(skb, ETH_HLEN); + } + + spin_lock_bh(&ctx->mtx); +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index 37d9785974fc..7be4860ccfd7 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -649,9 +649,26 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x05c6, 0x920d, 5)}, + {QMI_FIXED_INTF(0x12d1, 0x140c, 1)}, /* Huawei E173 */ + {QMI_FIXED_INTF(0x12d1, 0x14ac, 1)}, /* Huawei E1820 */ ++ {QMI_FIXED_INTF(0x16d8, 0x6003, 0)}, /* CMOTech 6003 */ ++ {QMI_FIXED_INTF(0x16d8, 0x6007, 0)}, /* CMOTech CHE-628S */ ++ {QMI_FIXED_INTF(0x16d8, 0x6008, 0)}, /* CMOTech CMU-301 */ ++ {QMI_FIXED_INTF(0x16d8, 0x6280, 0)}, /* CMOTech CHU-628 */ ++ {QMI_FIXED_INTF(0x16d8, 0x7001, 0)}, /* CMOTech CHU-720S */ ++ {QMI_FIXED_INTF(0x16d8, 0x7002, 0)}, /* CMOTech 7002 */ ++ {QMI_FIXED_INTF(0x16d8, 0x7003, 4)}, /* CMOTech CHU-629K */ ++ {QMI_FIXED_INTF(0x16d8, 0x7004, 3)}, /* CMOTech 7004 */ ++ {QMI_FIXED_INTF(0x16d8, 0x7006, 5)}, /* CMOTech CGU-629 */ ++ {QMI_FIXED_INTF(0x16d8, 0x700a, 4)}, /* CMOTech CHU-629S */ ++ {QMI_FIXED_INTF(0x16d8, 0x7211, 0)}, /* CMOTech CHU-720I */ ++ {QMI_FIXED_INTF(0x16d8, 0x7212, 0)}, /* CMOTech 7212 */ ++ {QMI_FIXED_INTF(0x16d8, 0x7213, 0)}, /* CMOTech 7213 */ ++ {QMI_FIXED_INTF(0x16d8, 0x7251, 1)}, /* CMOTech 7251 */ ++ {QMI_FIXED_INTF(0x16d8, 0x7252, 1)}, /* CMOTech 7252 */ ++ {QMI_FIXED_INTF(0x16d8, 0x7253, 1)}, /* CMOTech 7253 */ + {QMI_FIXED_INTF(0x19d2, 0x0002, 1)}, + {QMI_FIXED_INTF(0x19d2, 0x0012, 1)}, + {QMI_FIXED_INTF(0x19d2, 0x0017, 3)}, ++ {QMI_FIXED_INTF(0x19d2, 0x0019, 3)}, /* ONDA MT689DC */ + {QMI_FIXED_INTF(0x19d2, 0x0021, 4)}, + {QMI_FIXED_INTF(0x19d2, 0x0025, 1)}, + {QMI_FIXED_INTF(0x19d2, 0x0031, 4)}, +@@ -698,6 +715,7 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x19d2, 0x1255, 3)}, + {QMI_FIXED_INTF(0x19d2, 0x1255, 4)}, + {QMI_FIXED_INTF(0x19d2, 0x1256, 4)}, ++ {QMI_FIXED_INTF(0x19d2, 0x1270, 5)}, /* ZTE MF667 */ + {QMI_FIXED_INTF(0x19d2, 0x1401, 2)}, + {QMI_FIXED_INTF(0x19d2, 0x1402, 2)}, /* ZTE MF60 */ + {QMI_FIXED_INTF(0x19d2, 0x1424, 2)}, +@@ -708,12 +726,28 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x114f, 0x68a2, 8)}, /* Sierra Wireless MC7750 */ + {QMI_FIXED_INTF(0x1199, 0x68a2, 8)}, /* Sierra Wireless MC7710 in QMI mode */ + {QMI_FIXED_INTF(0x1199, 0x68a2, 19)}, /* Sierra Wireless MC7710 in QMI mode */ ++ {QMI_FIXED_INTF(0x1199, 0x68c0, 8)}, /* Sierra Wireless MC73xx */ ++ {QMI_FIXED_INTF(0x1199, 0x68c0, 10)}, /* Sierra Wireless MC73xx */ ++ {QMI_FIXED_INTF(0x1199, 0x68c0, 11)}, /* Sierra Wireless MC73xx */ + {QMI_FIXED_INTF(0x1199, 0x901c, 8)}, /* Sierra Wireless EM7700 */ ++ {QMI_FIXED_INTF(0x1199, 0x901f, 8)}, /* Sierra Wireless EM7355 */ ++ {QMI_FIXED_INTF(0x1199, 0x9041, 8)}, /* Sierra Wireless MC7305/MC7355 */ + {QMI_FIXED_INTF(0x1199, 0x9051, 8)}, /* Netgear AirCard 340U */ + {QMI_FIXED_INTF(0x1bbb, 0x011e, 4)}, /* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */ ++ {QMI_FIXED_INTF(0x1bbb, 0x0203, 2)}, /* Alcatel L800MA */ + {QMI_FIXED_INTF(0x2357, 0x0201, 4)}, /* TP-LINK HSUPA Modem MA180 */ ++ {QMI_FIXED_INTF(0x2357, 0x9000, 4)}, /* TP-LINK MA260 */ + {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */ +- {QMI_FIXED_INTF(0x1e2d, 0x12d1, 4)}, /* Cinterion PLxx */ ++ {QMI_FIXED_INTF(0x1bc7, 0x1201, 2)}, /* Telit LE920 */ ++ {QMI_FIXED_INTF(0x0b3c, 0xc005, 6)}, /* Olivetti Olicard 200 */ ++ {QMI_FIXED_INTF(0x0b3c, 0xc00b, 4)}, /* Olivetti Olicard 500 */ ++ {QMI_FIXED_INTF(0x1e2d, 0x0060, 4)}, /* Cinterion PLxx */ ++ {QMI_FIXED_INTF(0x1e2d, 0x0053, 4)}, /* Cinterion PHxx,PXxx */ ++ {QMI_FIXED_INTF(0x413c, 0x81a2, 8)}, /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card */ ++ {QMI_FIXED_INTF(0x413c, 0x81a3, 8)}, /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card */ ++ {QMI_FIXED_INTF(0x413c, 0x81a4, 8)}, /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */ ++ {QMI_FIXED_INTF(0x413c, 0x81a8, 8)}, /* Dell Wireless 5808 Gobi(TM) 4G LTE Mobile Broadband Card */ ++ {QMI_FIXED_INTF(0x413c, 0x81a9, 8)}, /* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card */ + + /* 4. Gobi 1000 devices */ + {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)}, /* Acer Gobi Modem Device */ +@@ -747,6 +781,7 @@ static const struct usb_device_id products[] = { + {QMI_GOBI_DEVICE(0x05c6, 0x9265)}, /* Asus Gobi 2000 Modem device (VR305) */ + {QMI_GOBI_DEVICE(0x05c6, 0x9235)}, /* Top Global Gobi 2000 Modem device (VR306) */ + {QMI_GOBI_DEVICE(0x05c6, 0x9275)}, /* iRex Technologies Gobi 2000 Modem device (VR307) */ ++ {QMI_GOBI_DEVICE(0x0af0, 0x8120)}, /* Option GTM681W */ + {QMI_GOBI_DEVICE(0x1199, 0x68a5)}, /* Sierra Wireless Modem */ + {QMI_GOBI_DEVICE(0x1199, 0x68a9)}, /* Sierra Wireless Modem */ + {QMI_GOBI_DEVICE(0x1199, 0x9001)}, /* Sierra Wireless Gobi 2000 Modem device (VT773) */ +@@ -760,7 +795,6 @@ static const struct usb_device_id products[] = { + {QMI_GOBI_DEVICE(0x1199, 0x9009)}, /* Sierra Wireless Gobi 2000 Modem device (VT773) */ + {QMI_GOBI_DEVICE(0x1199, 0x900a)}, /* Sierra Wireless Gobi 2000 Modem device (VT773) */ + {QMI_GOBI_DEVICE(0x1199, 0x9011)}, /* Sierra Wireless Gobi 2000 Modem device (MC8305) */ +- {QMI_FIXED_INTF(0x1199, 0x9011, 5)}, /* alternate interface number!? */ + {QMI_GOBI_DEVICE(0x16d8, 0x8002)}, /* CMDTech Gobi 2000 Modem device (VU922) */ + {QMI_GOBI_DEVICE(0x05c6, 0x9205)}, /* Gobi 2000 Modem device */ + {QMI_GOBI_DEVICE(0x1199, 0x9013)}, /* Sierra Wireless Gobi 3000 Modem device (MC8355) */ +diff --git a/drivers/scsi/megaraid/megaraid_mm.c b/drivers/scsi/megaraid/megaraid_mm.c +index 25506c777381..9bec1717047e 100644 +--- a/drivers/scsi/megaraid/megaraid_mm.c ++++ b/drivers/scsi/megaraid/megaraid_mm.c +@@ -486,6 +486,8 @@ mimd_to_kioc(mimd_t __user *umimd, mraid_mmadp_t *adp, uioc_t *kioc) + + pthru32->dataxferaddr = kioc->buf_paddr; + if (kioc->data_dir & UIOC_WR) { ++ if (pthru32->dataxferlen > kioc->xferlen) ++ return -EINVAL; + if (copy_from_user(kioc->buf_vaddr, kioc->user_data, + pthru32->dataxferlen)) { + return (-EFAULT); +diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c +index 3e58b2245f1f..859240408f9e 100644 +--- a/drivers/scsi/scsi_scan.c ++++ b/drivers/scsi/scsi_scan.c +@@ -320,6 +320,7 @@ static void scsi_target_destroy(struct scsi_target *starget) + struct Scsi_Host *shost = dev_to_shost(dev->parent); + unsigned long flags; + ++ starget->state = STARGET_DEL; + transport_destroy_device(dev); + spin_lock_irqsave(shost->host_lock, flags); + if (shost->hostt->target_destroy) +@@ -371,6 +372,37 @@ static struct scsi_target *__scsi_find_target(struct device *parent, + } + + /** ++ * scsi_target_reap_ref_release - remove target from visibility ++ * @kref: the reap_ref in the target being released ++ * ++ * Called on last put of reap_ref, which is the indication that no device ++ * under this target is visible anymore, so render the target invisible in ++ * sysfs. Note: we have to be in user context here because the target reaps ++ * should be done in places where the scsi device visibility is being removed. ++ */ ++static void scsi_target_reap_ref_release(struct kref *kref) ++{ ++ struct scsi_target *starget ++ = container_of(kref, struct scsi_target, reap_ref); ++ ++ /* ++ * if we get here and the target is still in the CREATED state that ++ * means it was allocated but never made visible (because a scan ++ * turned up no LUNs), so don't call device_del() on it. ++ */ ++ if (starget->state != STARGET_CREATED) { ++ transport_remove_device(&starget->dev); ++ device_del(&starget->dev); ++ } ++ scsi_target_destroy(starget); ++} ++ ++static void scsi_target_reap_ref_put(struct scsi_target *starget) ++{ ++ kref_put(&starget->reap_ref, scsi_target_reap_ref_release); ++} ++ ++/** + * scsi_alloc_target - allocate a new or find an existing target + * @parent: parent of the target (need not be a scsi host) + * @channel: target channel number (zero if no channels) +@@ -392,7 +424,7 @@ static struct scsi_target *scsi_alloc_target(struct device *parent, + + shost->transportt->target_size; + struct scsi_target *starget; + struct scsi_target *found_target; +- int error; ++ int error, ref_got; + + starget = kzalloc(size, GFP_KERNEL); + if (!starget) { +@@ -401,7 +433,7 @@ static struct scsi_target *scsi_alloc_target(struct device *parent, + } + dev = &starget->dev; + device_initialize(dev); +- starget->reap_ref = 1; ++ kref_init(&starget->reap_ref); + dev->parent = get_device(parent); + dev_set_name(dev, "target%d:%d:%d", shost->host_no, channel, id); + dev->bus = &scsi_bus_type; +@@ -441,29 +473,36 @@ static struct scsi_target *scsi_alloc_target(struct device *parent, + return starget; + + found: +- found_target->reap_ref++; ++ /* ++ * release routine already fired if kref is zero, so if we can still ++ * take the reference, the target must be alive. If we can't, it must ++ * be dying and we need to wait for a new target ++ */ ++ ref_got = kref_get_unless_zero(&found_target->reap_ref); ++ + spin_unlock_irqrestore(shost->host_lock, flags); +- if (found_target->state != STARGET_DEL) { ++ if (ref_got) { + put_device(dev); + return found_target; + } +- /* Unfortunately, we found a dying target; need to +- * wait until it's dead before we can get a new one */ ++ /* ++ * Unfortunately, we found a dying target; need to wait until it's ++ * dead before we can get a new one. There is an anomaly here. We ++ * *should* call scsi_target_reap() to balance the kref_get() of the ++ * reap_ref above. However, since the target being released, it's ++ * already invisible and the reap_ref is irrelevant. If we call ++ * scsi_target_reap() we might spuriously do another device_del() on ++ * an already invisible target. ++ */ + put_device(&found_target->dev); +- flush_scheduled_work(); ++ /* ++ * length of time is irrelevant here, we just want to yield the CPU ++ * for a tick to avoid busy waiting for the target to die. ++ */ ++ msleep(1); + goto retry; + } + +-static void scsi_target_reap_usercontext(struct work_struct *work) +-{ +- struct scsi_target *starget = +- container_of(work, struct scsi_target, ew.work); +- +- transport_remove_device(&starget->dev); +- device_del(&starget->dev); +- scsi_target_destroy(starget); +-} +- + /** + * scsi_target_reap - check to see if target is in use and destroy if not + * @starget: target to be checked +@@ -474,28 +513,13 @@ static void scsi_target_reap_usercontext(struct work_struct *work) + */ + void scsi_target_reap(struct scsi_target *starget) + { +- struct Scsi_Host *shost = dev_to_shost(starget->dev.parent); +- unsigned long flags; +- enum scsi_target_state state; +- int empty = 0; +- +- spin_lock_irqsave(shost->host_lock, flags); +- state = starget->state; +- if (--starget->reap_ref == 0 && list_empty(&starget->devices)) { +- empty = 1; +- starget->state = STARGET_DEL; +- } +- spin_unlock_irqrestore(shost->host_lock, flags); +- +- if (!empty) +- return; +- +- BUG_ON(state == STARGET_DEL); +- if (state == STARGET_CREATED) +- scsi_target_destroy(starget); +- else +- execute_in_process_context(scsi_target_reap_usercontext, +- &starget->ew); ++ /* ++ * serious problem if this triggers: STARGET_DEL is only set in the if ++ * the reap_ref drops to zero, so we're trying to do another final put ++ * on an already released kref ++ */ ++ BUG_ON(starget->state == STARGET_DEL); ++ scsi_target_reap_ref_put(starget); + } + + /** +@@ -1527,6 +1551,10 @@ struct scsi_device *__scsi_add_device(struct Scsi_Host *shost, uint channel, + } + mutex_unlock(&shost->scan_mutex); + scsi_autopm_put_target(starget); ++ /* ++ * paired with scsi_alloc_target(). Target will be destroyed unless ++ * scsi_probe_and_add_lun made an underlying device visible ++ */ + scsi_target_reap(starget); + put_device(&starget->dev); + +@@ -1607,8 +1635,10 @@ static void __scsi_scan_target(struct device *parent, unsigned int channel, + + out_reap: + scsi_autopm_put_target(starget); +- /* now determine if the target has any children at all +- * and if not, nuke it */ ++ /* ++ * paired with scsi_alloc_target(): determine if the target has ++ * any children at all and if not, nuke it ++ */ + scsi_target_reap(starget); + + put_device(&starget->dev); +diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c +index 931a7d954203..9e2dd478dd15 100644 +--- a/drivers/scsi/scsi_sysfs.c ++++ b/drivers/scsi/scsi_sysfs.c +@@ -332,17 +332,14 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work) + { + struct scsi_device *sdev; + struct device *parent; +- struct scsi_target *starget; + struct list_head *this, *tmp; + unsigned long flags; + + sdev = container_of(work, struct scsi_device, ew.work); + + parent = sdev->sdev_gendev.parent; +- starget = to_scsi_target(parent); + + spin_lock_irqsave(sdev->host->host_lock, flags); +- starget->reap_ref++; + list_del(&sdev->siblings); + list_del(&sdev->same_target_siblings); + list_del(&sdev->starved_entry); +@@ -362,8 +359,6 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work) + /* NULL queue means the device can't be used */ + sdev->request_queue = NULL; + +- scsi_target_reap(scsi_target(sdev)); +- + kfree(sdev->inquiry); + kfree(sdev); + +@@ -978,6 +973,13 @@ void __scsi_remove_device(struct scsi_device *sdev) + sdev->host->hostt->slave_destroy(sdev); + transport_destroy_device(dev); + ++ /* ++ * Paired with the kref_get() in scsi_sysfs_initialize(). We have ++ * remoed sysfs visibility from the device, so make the target ++ * invisible if this was the last device underneath it. ++ */ ++ scsi_target_reap(scsi_target(sdev)); ++ + put_device(dev); + } + +@@ -1040,7 +1042,7 @@ void scsi_remove_target(struct device *dev) + continue; + if (starget->dev.parent == dev || &starget->dev == dev) { + /* assuming new targets arrive at the end */ +- starget->reap_ref++; ++ kref_get(&starget->reap_ref); + spin_unlock_irqrestore(shost->host_lock, flags); + if (last) + scsi_target_reap(last); +@@ -1124,6 +1126,12 @@ void scsi_sysfs_device_initialize(struct scsi_device *sdev) + list_add_tail(&sdev->same_target_siblings, &starget->devices); + list_add_tail(&sdev->siblings, &shost->__devices); + spin_unlock_irqrestore(shost->host_lock, flags); ++ /* ++ * device can now only be removed via __scsi_remove_device() so hold ++ * the target. Target will be held in CREATED state until something ++ * beneath it becomes visible (in which case it moves to RUNNING) ++ */ ++ kref_get(&starget->reap_ref); + } + + int scsi_is_sdev_device(const struct device *dev) +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index 81f59e8b7521..89cce1a32059 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -1574,13 +1574,27 @@ static const struct usb_device_id acm_ids[] = { + }, + /* Motorola H24 HSPA module: */ + { USB_DEVICE(0x22b8, 0x2d91) }, /* modem */ +- { USB_DEVICE(0x22b8, 0x2d92) }, /* modem + diagnostics */ +- { USB_DEVICE(0x22b8, 0x2d93) }, /* modem + AT port */ +- { USB_DEVICE(0x22b8, 0x2d95) }, /* modem + AT port + diagnostics */ +- { USB_DEVICE(0x22b8, 0x2d96) }, /* modem + NMEA */ +- { USB_DEVICE(0x22b8, 0x2d97) }, /* modem + diagnostics + NMEA */ +- { USB_DEVICE(0x22b8, 0x2d99) }, /* modem + AT port + NMEA */ +- { USB_DEVICE(0x22b8, 0x2d9a) }, /* modem + AT port + diagnostics + NMEA */ ++ { USB_DEVICE(0x22b8, 0x2d92), /* modem + diagnostics */ ++ .driver_info = NO_UNION_NORMAL, /* handle only modem interface */ ++ }, ++ { USB_DEVICE(0x22b8, 0x2d93), /* modem + AT port */ ++ .driver_info = NO_UNION_NORMAL, /* handle only modem interface */ ++ }, ++ { USB_DEVICE(0x22b8, 0x2d95), /* modem + AT port + diagnostics */ ++ .driver_info = NO_UNION_NORMAL, /* handle only modem interface */ ++ }, ++ { USB_DEVICE(0x22b8, 0x2d96), /* modem + NMEA */ ++ .driver_info = NO_UNION_NORMAL, /* handle only modem interface */ ++ }, ++ { USB_DEVICE(0x22b8, 0x2d97), /* modem + diagnostics + NMEA */ ++ .driver_info = NO_UNION_NORMAL, /* handle only modem interface */ ++ }, ++ { USB_DEVICE(0x22b8, 0x2d99), /* modem + AT port + NMEA */ ++ .driver_info = NO_UNION_NORMAL, /* handle only modem interface */ ++ }, ++ { USB_DEVICE(0x22b8, 0x2d9a), /* modem + AT port + diagnostics + NMEA */ ++ .driver_info = NO_UNION_NORMAL, /* handle only modem interface */ ++ }, + + { USB_DEVICE(0x0572, 0x1329), /* Hummingbird huc56s (Conexant) */ + .driver_info = NO_UNION_NORMAL, /* union descriptor misplaced on +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index c90d960e091b..ded751ca104a 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -104,6 +104,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x10C4, 0x8218) }, /* Lipowsky Industrie Elektronik GmbH, HARP-1 */ + { USB_DEVICE(0x10C4, 0x822B) }, /* Modem EDGE(GSM) Comander 2 */ + { USB_DEVICE(0x10C4, 0x826B) }, /* Cygnal Integrated Products, Inc., Fasttrax GPS demonstration module */ ++ { USB_DEVICE(0x10C4, 0x8281) }, /* Nanotec Plug & Drive */ + { USB_DEVICE(0x10C4, 0x8293) }, /* Telegesis ETRX2USB */ + { USB_DEVICE(0x10C4, 0x82F9) }, /* Procyon AVS */ + { USB_DEVICE(0x10C4, 0x8341) }, /* Siemens MC35PU GPRS Modem */ +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index b83da38bc915..2c635bd9c185 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -912,6 +912,39 @@ static struct usb_device_id id_table_combined [] = { + { USB_DEVICE(FTDI_VID, FTDI_Z3X_PID) }, + /* Cressi Devices */ + { USB_DEVICE(FTDI_VID, FTDI_CRESSI_PID) }, ++ /* Brainboxes Devices */ ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_001_PID) }, ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_012_PID) }, ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_023_PID) }, ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_034_PID) }, ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_101_PID) }, ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_1_PID) }, ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_2_PID) }, ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_3_PID) }, ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_4_PID) }, ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_5_PID) }, ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_6_PID) }, ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_7_PID) }, ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_8_PID) }, ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_257_PID) }, ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_1_PID) }, ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_2_PID) }, ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_3_PID) }, ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_4_PID) }, ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_313_PID) }, ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_324_PID) }, ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_346_1_PID) }, ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_346_2_PID) }, ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_357_PID) }, ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_606_1_PID) }, ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_606_2_PID) }, ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_606_3_PID) }, ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_701_1_PID) }, ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_701_2_PID) }, ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_1_PID) }, ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_2_PID) }, ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_3_PID) }, ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_4_PID) }, + { }, /* Optional parameter entry */ + { } /* Terminating entry */ + }; +diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h +index e599fbfcde5f..993c93df6874 100644 +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -1326,3 +1326,40 @@ + * Manufacturer: Cressi + */ + #define FTDI_CRESSI_PID 0x87d0 ++ ++/* ++ * Brainboxes devices ++ */ ++#define BRAINBOXES_VID 0x05d1 ++#define BRAINBOXES_VX_001_PID 0x1001 /* VX-001 ExpressCard 1 Port RS232 */ ++#define BRAINBOXES_VX_012_PID 0x1002 /* VX-012 ExpressCard 2 Port RS232 */ ++#define BRAINBOXES_VX_023_PID 0x1003 /* VX-023 ExpressCard 1 Port RS422/485 */ ++#define BRAINBOXES_VX_034_PID 0x1004 /* VX-034 ExpressCard 2 Port RS422/485 */ ++#define BRAINBOXES_US_101_PID 0x1011 /* US-101 1xRS232 */ ++#define BRAINBOXES_US_324_PID 0x1013 /* US-324 1xRS422/485 1Mbaud */ ++#define BRAINBOXES_US_606_1_PID 0x2001 /* US-606 6 Port RS232 Serial Port 1 and 2 */ ++#define BRAINBOXES_US_606_2_PID 0x2002 /* US-606 6 Port RS232 Serial Port 3 and 4 */ ++#define BRAINBOXES_US_606_3_PID 0x2003 /* US-606 6 Port RS232 Serial Port 4 and 6 */ ++#define BRAINBOXES_US_701_1_PID 0x2011 /* US-701 4xRS232 1Mbaud Port 1 and 2 */ ++#define BRAINBOXES_US_701_2_PID 0x2012 /* US-701 4xRS422 1Mbaud Port 3 and 4 */ ++#define BRAINBOXES_US_279_1_PID 0x2021 /* US-279 8xRS422 1Mbaud Port 1 and 2 */ ++#define BRAINBOXES_US_279_2_PID 0x2022 /* US-279 8xRS422 1Mbaud Port 3 and 4 */ ++#define BRAINBOXES_US_279_3_PID 0x2023 /* US-279 8xRS422 1Mbaud Port 5 and 6 */ ++#define BRAINBOXES_US_279_4_PID 0x2024 /* US-279 8xRS422 1Mbaud Port 7 and 8 */ ++#define BRAINBOXES_US_346_1_PID 0x3011 /* US-346 4xRS422/485 1Mbaud Port 1 and 2 */ ++#define BRAINBOXES_US_346_2_PID 0x3012 /* US-346 4xRS422/485 1Mbaud Port 3 and 4 */ ++#define BRAINBOXES_US_257_PID 0x5001 /* US-257 2xRS232 1Mbaud */ ++#define BRAINBOXES_US_313_PID 0x6001 /* US-313 2xRS422/485 1Mbaud */ ++#define BRAINBOXES_US_357_PID 0x7001 /* US_357 1xRS232/422/485 */ ++#define BRAINBOXES_US_842_1_PID 0x8001 /* US-842 8xRS422/485 1Mbaud Port 1 and 2 */ ++#define BRAINBOXES_US_842_2_PID 0x8002 /* US-842 8xRS422/485 1Mbaud Port 3 and 4 */ ++#define BRAINBOXES_US_842_3_PID 0x8003 /* US-842 8xRS422/485 1Mbaud Port 5 and 6 */ ++#define BRAINBOXES_US_842_4_PID 0x8004 /* US-842 8xRS422/485 1Mbaud Port 7 and 8 */ ++#define BRAINBOXES_US_160_1_PID 0x9001 /* US-160 16xRS232 1Mbaud Port 1 and 2 */ ++#define BRAINBOXES_US_160_2_PID 0x9002 /* US-160 16xRS232 1Mbaud Port 3 and 4 */ ++#define BRAINBOXES_US_160_3_PID 0x9003 /* US-160 16xRS232 1Mbaud Port 5 and 6 */ ++#define BRAINBOXES_US_160_4_PID 0x9004 /* US-160 16xRS232 1Mbaud Port 7 and 8 */ ++#define BRAINBOXES_US_160_5_PID 0x9005 /* US-160 16xRS232 1Mbaud Port 9 and 10 */ ++#define BRAINBOXES_US_160_6_PID 0x9006 /* US-160 16xRS232 1Mbaud Port 11 and 12 */ ++#define BRAINBOXES_US_160_7_PID 0x9007 /* US-160 16xRS232 1Mbaud Port 13 and 14 */ ++#define BRAINBOXES_US_160_8_PID 0x9008 /* US-160 16xRS232 1Mbaud Port 15 and 16 */ +diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c +index 1be6ba7bee27..c5c9cbf107d1 100644 +--- a/drivers/usb/serial/io_ti.c ++++ b/drivers/usb/serial/io_ti.c +@@ -29,6 +29,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -284,7 +285,7 @@ static int read_download_mem(struct usb_device *dev, int start_address, + { + int status = 0; + __u8 read_length; +- __be16 be_start_address; ++ u16 be_start_address; + + dev_dbg(&dev->dev, "%s - @ %x for %d\n", __func__, start_address, length); + +@@ -300,10 +301,14 @@ static int read_download_mem(struct usb_device *dev, int start_address, + if (read_length > 1) { + dev_dbg(&dev->dev, "%s - @ %x for %d\n", __func__, start_address, read_length); + } +- be_start_address = cpu_to_be16(start_address); ++ /* ++ * NOTE: Must use swab as wIndex is sent in little-endian ++ * byte order regardless of host byte order. ++ */ ++ be_start_address = swab16((u16)start_address); + status = ti_vread_sync(dev, UMPC_MEMORY_READ, + (__u16)address_type, +- (__force __u16)be_start_address, ++ be_start_address, + buffer, read_length); + + if (status) { +@@ -400,7 +405,7 @@ static int write_i2c_mem(struct edgeport_serial *serial, + struct device *dev = &serial->serial->dev->dev; + int status = 0; + int write_length; +- __be16 be_start_address; ++ u16 be_start_address; + + /* We can only send a maximum of 1 aligned byte page at a time */ + +@@ -415,11 +420,16 @@ static int write_i2c_mem(struct edgeport_serial *serial, + __func__, start_address, write_length); + usb_serial_debug_data(dev, __func__, write_length, buffer); + +- /* Write first page */ +- be_start_address = cpu_to_be16(start_address); ++ /* ++ * Write first page. ++ * ++ * NOTE: Must use swab as wIndex is sent in little-endian byte order ++ * regardless of host byte order. ++ */ ++ be_start_address = swab16((u16)start_address); + status = ti_vsend_sync(serial->serial->dev, + UMPC_MEMORY_WRITE, (__u16)address_type, +- (__force __u16)be_start_address, ++ be_start_address, + buffer, write_length); + if (status) { + dev_dbg(dev, "%s - ERROR %d\n", __func__, status); +@@ -442,11 +452,16 @@ static int write_i2c_mem(struct edgeport_serial *serial, + __func__, start_address, write_length); + usb_serial_debug_data(dev, __func__, write_length, buffer); + +- /* Write next page */ +- be_start_address = cpu_to_be16(start_address); ++ /* ++ * Write next page. ++ * ++ * NOTE: Must use swab as wIndex is sent in little-endian byte ++ * order regardless of host byte order. ++ */ ++ be_start_address = swab16((u16)start_address); + status = ti_vsend_sync(serial->serial->dev, UMPC_MEMORY_WRITE, + (__u16)address_type, +- (__force __u16)be_start_address, ++ be_start_address, + buffer, write_length); + if (status) { + dev_err(dev, "%s - ERROR %d\n", __func__, status); +@@ -593,8 +608,8 @@ static int get_descriptor_addr(struct edgeport_serial *serial, + if (rom_desc->Type == desc_type) + return start_address; + +- start_address = start_address + sizeof(struct ti_i2c_desc) +- + rom_desc->Size; ++ start_address = start_address + sizeof(struct ti_i2c_desc) + ++ le16_to_cpu(rom_desc->Size); + + } while ((start_address < TI_MAX_I2C_SIZE) && rom_desc->Type); + +@@ -607,7 +622,7 @@ static int valid_csum(struct ti_i2c_desc *rom_desc, __u8 *buffer) + __u16 i; + __u8 cs = 0; + +- for (i = 0; i < rom_desc->Size; i++) ++ for (i = 0; i < le16_to_cpu(rom_desc->Size); i++) + cs = (__u8)(cs + buffer[i]); + + if (cs != rom_desc->CheckSum) { +@@ -661,7 +676,7 @@ static int check_i2c_image(struct edgeport_serial *serial) + break; + + if ((start_address + sizeof(struct ti_i2c_desc) + +- rom_desc->Size) > TI_MAX_I2C_SIZE) { ++ le16_to_cpu(rom_desc->Size)) > TI_MAX_I2C_SIZE) { + status = -ENODEV; + dev_dbg(dev, "%s - structure too big, erroring out.\n", __func__); + break; +@@ -676,7 +691,8 @@ static int check_i2c_image(struct edgeport_serial *serial) + /* Read the descriptor data */ + status = read_rom(serial, start_address + + sizeof(struct ti_i2c_desc), +- rom_desc->Size, buffer); ++ le16_to_cpu(rom_desc->Size), ++ buffer); + if (status) + break; + +@@ -685,7 +701,7 @@ static int check_i2c_image(struct edgeport_serial *serial) + break; + } + start_address = start_address + sizeof(struct ti_i2c_desc) + +- rom_desc->Size; ++ le16_to_cpu(rom_desc->Size); + + } while ((rom_desc->Type != I2C_DESC_TYPE_ION) && + (start_address < TI_MAX_I2C_SIZE)); +@@ -724,7 +740,7 @@ static int get_manuf_info(struct edgeport_serial *serial, __u8 *buffer) + + /* Read the descriptor data */ + status = read_rom(serial, start_address+sizeof(struct ti_i2c_desc), +- rom_desc->Size, buffer); ++ le16_to_cpu(rom_desc->Size), buffer); + if (status) + goto exit; + +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 68fc9fe65936..f213ee978516 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -234,8 +234,31 @@ static void option_instat_callback(struct urb *urb); + #define QUALCOMM_VENDOR_ID 0x05C6 + + #define CMOTECH_VENDOR_ID 0x16d8 +-#define CMOTECH_PRODUCT_6008 0x6008 +-#define CMOTECH_PRODUCT_6280 0x6280 ++#define CMOTECH_PRODUCT_6001 0x6001 ++#define CMOTECH_PRODUCT_CMU_300 0x6002 ++#define CMOTECH_PRODUCT_6003 0x6003 ++#define CMOTECH_PRODUCT_6004 0x6004 ++#define CMOTECH_PRODUCT_6005 0x6005 ++#define CMOTECH_PRODUCT_CGU_628A 0x6006 ++#define CMOTECH_PRODUCT_CHE_628S 0x6007 ++#define CMOTECH_PRODUCT_CMU_301 0x6008 ++#define CMOTECH_PRODUCT_CHU_628 0x6280 ++#define CMOTECH_PRODUCT_CHU_628S 0x6281 ++#define CMOTECH_PRODUCT_CDU_680 0x6803 ++#define CMOTECH_PRODUCT_CDU_685A 0x6804 ++#define CMOTECH_PRODUCT_CHU_720S 0x7001 ++#define CMOTECH_PRODUCT_7002 0x7002 ++#define CMOTECH_PRODUCT_CHU_629K 0x7003 ++#define CMOTECH_PRODUCT_7004 0x7004 ++#define CMOTECH_PRODUCT_7005 0x7005 ++#define CMOTECH_PRODUCT_CGU_629 0x7006 ++#define CMOTECH_PRODUCT_CHU_629S 0x700a ++#define CMOTECH_PRODUCT_CHU_720I 0x7211 ++#define CMOTECH_PRODUCT_7212 0x7212 ++#define CMOTECH_PRODUCT_7213 0x7213 ++#define CMOTECH_PRODUCT_7251 0x7251 ++#define CMOTECH_PRODUCT_7252 0x7252 ++#define CMOTECH_PRODUCT_7253 0x7253 + + #define TELIT_VENDOR_ID 0x1bc7 + #define TELIT_PRODUCT_UC864E 0x1003 +@@ -243,6 +266,7 @@ static void option_instat_callback(struct urb *urb); + #define TELIT_PRODUCT_CC864_DUAL 0x1005 + #define TELIT_PRODUCT_CC864_SINGLE 0x1006 + #define TELIT_PRODUCT_DE910_DUAL 0x1010 ++#define TELIT_PRODUCT_UE910_V2 0x1012 + #define TELIT_PRODUCT_LE920 0x1200 + + /* ZTE PRODUCTS */ +@@ -286,6 +310,7 @@ static void option_instat_callback(struct urb *urb); + #define ALCATEL_PRODUCT_X060S_X200 0x0000 + #define ALCATEL_PRODUCT_X220_X500D 0x0017 + #define ALCATEL_PRODUCT_L100V 0x011e ++#define ALCATEL_PRODUCT_L800MA 0x0203 + + #define PIRELLI_VENDOR_ID 0x1266 + #define PIRELLI_PRODUCT_C100_1 0x1002 +@@ -348,6 +373,7 @@ static void option_instat_callback(struct urb *urb); + #define OLIVETTI_PRODUCT_OLICARD100 0xc000 + #define OLIVETTI_PRODUCT_OLICARD145 0xc003 + #define OLIVETTI_PRODUCT_OLICARD200 0xc005 ++#define OLIVETTI_PRODUCT_OLICARD500 0xc00b + + /* Celot products */ + #define CELOT_VENDOR_ID 0x211f +@@ -501,6 +527,10 @@ static const struct option_blacklist_info huawei_cdc12_blacklist = { + .reserved = BIT(1) | BIT(2), + }; + ++static const struct option_blacklist_info net_intf0_blacklist = { ++ .reserved = BIT(0), ++}; ++ + static const struct option_blacklist_info net_intf1_blacklist = { + .reserved = BIT(1), + }; +@@ -1034,13 +1064,53 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */ + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */ + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */ +- { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6280) }, /* BP3-USB & BP3-EXT HSDPA */ +- { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6008) }, ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) }, ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) }, ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6003), ++ .driver_info = (kernel_ulong_t)&net_intf0_blacklist }, ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6004) }, ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6005) }, ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CGU_628A) }, ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHE_628S), ++ .driver_info = (kernel_ulong_t)&net_intf0_blacklist }, ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_301), ++ .driver_info = (kernel_ulong_t)&net_intf0_blacklist }, ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_628), ++ .driver_info = (kernel_ulong_t)&net_intf0_blacklist }, ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_628S) }, ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CDU_680) }, ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CDU_685A) }, ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_720S), ++ .driver_info = (kernel_ulong_t)&net_intf0_blacklist }, ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7002), ++ .driver_info = (kernel_ulong_t)&net_intf0_blacklist }, ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_629K), ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7004), ++ .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7005) }, ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CGU_629), ++ .driver_info = (kernel_ulong_t)&net_intf5_blacklist }, ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_629S), ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_720I), ++ .driver_info = (kernel_ulong_t)&net_intf0_blacklist }, ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7212), ++ .driver_info = (kernel_ulong_t)&net_intf0_blacklist }, ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7213), ++ .driver_info = (kernel_ulong_t)&net_intf0_blacklist }, ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7251), ++ .driver_info = (kernel_ulong_t)&net_intf1_blacklist }, ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7252), ++ .driver_info = (kernel_ulong_t)&net_intf1_blacklist }, ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7253), ++ .driver_info = (kernel_ulong_t)&net_intf1_blacklist }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864E) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864G) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_DUAL) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_SINGLE) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_DE910_DUAL) }, ++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UE910_V2) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920), + .driver_info = (kernel_ulong_t)&telit_le920_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */ +@@ -1498,6 +1568,8 @@ static const struct usb_device_id option_ids[] = { + .driver_info = (kernel_ulong_t)&net_intf5_blacklist }, + { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_L100V), + .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, ++ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_L800MA), ++ .driver_info = (kernel_ulong_t)&net_intf2_blacklist }, + { USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) }, + { USB_DEVICE(TLAYTECH_VENDOR_ID, TLAYTECH_PRODUCT_TEU800) }, + { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14), +@@ -1543,6 +1615,9 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD200), + .driver_info = (kernel_ulong_t)&net_intf6_blacklist + }, ++ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD500), ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist ++ }, + { USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */ + { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/ + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM600) }, +diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c +index 968a40201e5f..7ed681a714a5 100644 +--- a/drivers/usb/serial/qcserial.c ++++ b/drivers/usb/serial/qcserial.c +@@ -136,9 +136,18 @@ static const struct usb_device_id id_table[] = { + {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x68a2, 0)}, /* Sierra Wireless MC7710 Device Management */ + {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x68a2, 2)}, /* Sierra Wireless MC7710 NMEA */ + {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x68a2, 3)}, /* Sierra Wireless MC7710 Modem */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x68c0, 0)}, /* Sierra Wireless MC73xx Device Management */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x68c0, 2)}, /* Sierra Wireless MC73xx NMEA */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x68c0, 3)}, /* Sierra Wireless MC73xx Modem */ + {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x901c, 0)}, /* Sierra Wireless EM7700 Device Management */ + {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x901c, 2)}, /* Sierra Wireless EM7700 NMEA */ + {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x901c, 3)}, /* Sierra Wireless EM7700 Modem */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x901f, 0)}, /* Sierra Wireless EM7355 Device Management */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x901f, 2)}, /* Sierra Wireless EM7355 NMEA */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x901f, 3)}, /* Sierra Wireless EM7355 Modem */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9041, 0)}, /* Sierra Wireless MC7305/MC7355 Device Management */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9041, 2)}, /* Sierra Wireless MC7305/MC7355 NMEA */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9041, 3)}, /* Sierra Wireless MC7305/MC7355 Modem */ + {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9051, 0)}, /* Netgear AirCard 340U Device Management */ + {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9051, 2)}, /* Netgear AirCard 340U NMEA */ + {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9051, 3)}, /* Netgear AirCard 340U Modem */ +diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c +index 8894665cd610..2df566c0e9e8 100644 +--- a/drivers/usb/serial/sierra.c ++++ b/drivers/usb/serial/sierra.c +@@ -291,7 +291,6 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x0f3d, 0x68A3), /* Airprime/Sierra Wireless Direct IP modems */ + .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist + }, +- { USB_DEVICE(0x413C, 0x08133) }, /* Dell Computer Corp. Wireless 5720 VZW Mobile Broadband (EVDO Rev-A) Minicard GPS Port */ + + { } + }; +diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c +index 5f6b1ff9d29e..c1032d42b9d5 100644 +--- a/drivers/usb/serial/usb-serial.c ++++ b/drivers/usb/serial/usb-serial.c +@@ -1367,10 +1367,12 @@ static int usb_serial_register(struct usb_serial_driver *driver) + static void usb_serial_deregister(struct usb_serial_driver *device) + { + pr_info("USB Serial deregistering driver %s\n", device->description); ++ + mutex_lock(&table_lock); + list_del(&device->driver_list); +- usb_serial_bus_deregister(device); + mutex_unlock(&table_lock); ++ ++ usb_serial_bus_deregister(device); + } + + /** +diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c +index db0cf536de18..11952b6dc224 100644 +--- a/drivers/usb/serial/usb_wwan.c ++++ b/drivers/usb/serial/usb_wwan.c +@@ -470,6 +470,9 @@ int usb_wwan_port_probe(struct usb_serial_port *port) + int err; + int i; + ++ if (!port->bulk_in_size || !port->bulk_out_size) ++ return -ENODEV; ++ + portdata = kzalloc(sizeof(*portdata), GFP_KERNEL); + if (!portdata) + return -ENOMEM; +@@ -477,9 +480,6 @@ int usb_wwan_port_probe(struct usb_serial_port *port) + init_usb_anchor(&portdata->delayed); + + for (i = 0; i < N_IN_URB; i++) { +- if (!port->bulk_in_size) +- break; +- + buffer = (u8 *)__get_free_page(GFP_KERNEL); + if (!buffer) + goto bail_out_error; +@@ -493,9 +493,6 @@ int usb_wwan_port_probe(struct usb_serial_port *port) + } + + for (i = 0; i < N_OUT_URB; i++) { +- if (!port->bulk_out_size) +- break; +- + buffer = kmalloc(OUT_BUFLEN, GFP_KERNEL); + if (!buffer) + goto bail_out_error2; +diff --git a/drivers/video/tgafb.c b/drivers/video/tgafb.c +index ba77f753649c..a78ca6a01094 100644 +--- a/drivers/video/tgafb.c ++++ b/drivers/video/tgafb.c +@@ -188,6 +188,8 @@ tgafb_check_var(struct fb_var_screeninfo *var, struct fb_info *info) + + if (var->xres_virtual != var->xres || var->yres_virtual != var->yres) + return -EINVAL; ++ if (var->xres * var->yres * (var->bits_per_pixel >> 3) > info->fix.smem_len) ++ return -EINVAL; + if (var->nonstd) + return -EINVAL; + if (1000000000 / var->pixclock > TGA_PLL_MAX_FREQ) +@@ -268,6 +270,7 @@ tgafb_set_par(struct fb_info *info) + par->yres = info->var.yres; + par->pll_freq = pll_freq = 1000000000 / info->var.pixclock; + par->bits_per_pixel = info->var.bits_per_pixel; ++ info->fix.line_length = par->xres * (par->bits_per_pixel >> 3); + + tga_type = par->tga_type; + +@@ -1314,6 +1317,7 @@ tgafb_init_fix(struct fb_info *info) + int tga_bus_tc = TGA_BUS_TC(par->dev); + u8 tga_type = par->tga_type; + const char *tga_type_name = NULL; ++ unsigned memory_size; + + switch (tga_type) { + case TGA_TYPE_8PLANE: +@@ -1321,21 +1325,25 @@ tgafb_init_fix(struct fb_info *info) + tga_type_name = "Digital ZLXp-E1"; + if (tga_bus_tc) + tga_type_name = "Digital ZLX-E1"; ++ memory_size = 2097152; + break; + case TGA_TYPE_24PLANE: + if (tga_bus_pci) + tga_type_name = "Digital ZLXp-E2"; + if (tga_bus_tc) + tga_type_name = "Digital ZLX-E2"; ++ memory_size = 8388608; + break; + case TGA_TYPE_24PLUSZ: + if (tga_bus_pci) + tga_type_name = "Digital ZLXp-E3"; + if (tga_bus_tc) + tga_type_name = "Digital ZLX-E3"; ++ memory_size = 16777216; + break; + default: + tga_type_name = "Unknown"; ++ memory_size = 16777216; + break; + } + +@@ -1347,9 +1355,8 @@ tgafb_init_fix(struct fb_info *info) + ? FB_VISUAL_PSEUDOCOLOR + : FB_VISUAL_DIRECTCOLOR); + +- info->fix.line_length = par->xres * (par->bits_per_pixel >> 3); + info->fix.smem_start = (size_t) par->tga_fb_base; +- info->fix.smem_len = info->fix.line_length * par->yres; ++ info->fix.smem_len = memory_size; + info->fix.mmio_start = (size_t) par->tga_regs_base; + info->fix.mmio_len = 512; + +@@ -1473,6 +1480,9 @@ static int tgafb_register(struct device *dev) + modedb_tga = &modedb_tc; + modedbsize_tga = 1; + } ++ ++ tgafb_init_fix(info); ++ + ret = fb_find_mode(&info->var, info, + mode_option ? mode_option : mode_option_tga, + modedb_tga, modedbsize_tga, NULL, +@@ -1490,7 +1500,6 @@ static int tgafb_register(struct device *dev) + } + + tgafb_set_par(info); +- tgafb_init_fix(info); + + if (register_framebuffer(info) < 0) { + printk(KERN_ERR "tgafb: Could not register framebuffer\n"); +diff --git a/fs/file_table.c b/fs/file_table.c +index 485dc0eddd67..54a34be444f9 100644 +--- a/fs/file_table.c ++++ b/fs/file_table.c +@@ -211,10 +211,10 @@ static void drop_file_write_access(struct file *file) + struct dentry *dentry = file->f_path.dentry; + struct inode *inode = dentry->d_inode; + +- put_write_access(inode); +- + if (special_file(inode->i_mode)) + return; ++ ++ put_write_access(inode); + if (file_check_writeable(file) != 0) + return; + __mnt_drop_write(mnt); +diff --git a/fs/open.c b/fs/open.c +index 8c741002f947..86092bde31f4 100644 +--- a/fs/open.c ++++ b/fs/open.c +@@ -628,23 +628,12 @@ out: + static inline int __get_file_write_access(struct inode *inode, + struct vfsmount *mnt) + { +- int error; +- error = get_write_access(inode); ++ int error = get_write_access(inode); + if (error) + return error; +- /* +- * Do not take mount writer counts on +- * special files since no writes to +- * the mount itself will occur. +- */ +- if (!special_file(inode->i_mode)) { +- /* +- * Balanced in __fput() +- */ +- error = __mnt_want_write(mnt); +- if (error) +- put_write_access(inode); +- } ++ error = __mnt_want_write(mnt); ++ if (error) ++ put_write_access(inode); + return error; + } + +@@ -677,12 +666,11 @@ static int do_dentry_open(struct file *f, + + path_get(&f->f_path); + inode = f->f_inode = f->f_path.dentry->d_inode; +- if (f->f_mode & FMODE_WRITE) { ++ if (f->f_mode & FMODE_WRITE && !special_file(inode->i_mode)) { + error = __get_file_write_access(inode, f->f_path.mnt); + if (error) + goto cleanup_file; +- if (!special_file(inode->i_mode)) +- file_take_write(f); ++ file_take_write(f); + } + + f->f_mapping = inode->i_mapping; +@@ -723,7 +711,6 @@ cleanup_all: + fops_put(f->f_op); + file_sb_list_del(f); + if (f->f_mode & FMODE_WRITE) { +- put_write_access(inode); + if (!special_file(inode->i_mode)) { + /* + * We don't consider this a real +@@ -731,6 +718,7 @@ cleanup_all: + * because it all happenend right + * here, so just reset the state. + */ ++ put_write_access(inode); + file_reset_write(f); + __mnt_drop_write(f->f_path.mnt); + } +diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h +index b58268a5ddd4..17bccd3a4b03 100644 +--- a/include/asm-generic/pgtable.h ++++ b/include/asm-generic/pgtable.h +@@ -620,32 +620,47 @@ static inline int pmd_numa(pmd_t pmd) + #ifndef pte_mknonnuma + static inline pte_t pte_mknonnuma(pte_t pte) + { +- pte = pte_clear_flags(pte, _PAGE_NUMA); +- return pte_set_flags(pte, _PAGE_PRESENT|_PAGE_ACCESSED); ++ pteval_t val = pte_val(pte); ++ ++ val &= ~_PAGE_NUMA; ++ val |= (_PAGE_PRESENT|_PAGE_ACCESSED); ++ return __pte(val); + } + #endif + + #ifndef pmd_mknonnuma + static inline pmd_t pmd_mknonnuma(pmd_t pmd) + { +- pmd = pmd_clear_flags(pmd, _PAGE_NUMA); +- return pmd_set_flags(pmd, _PAGE_PRESENT|_PAGE_ACCESSED); ++ pmdval_t val = pmd_val(pmd); ++ ++ val &= ~_PAGE_NUMA; ++ val |= (_PAGE_PRESENT|_PAGE_ACCESSED); ++ ++ return __pmd(val); + } + #endif + + #ifndef pte_mknuma + static inline pte_t pte_mknuma(pte_t pte) + { +- pte = pte_set_flags(pte, _PAGE_NUMA); +- return pte_clear_flags(pte, _PAGE_PRESENT); ++ pteval_t val = pte_val(pte); ++ ++ val &= ~_PAGE_PRESENT; ++ val |= _PAGE_NUMA; ++ ++ return __pte(val); + } + #endif + + #ifndef pmd_mknuma + static inline pmd_t pmd_mknuma(pmd_t pmd) + { +- pmd = pmd_set_flags(pmd, _PAGE_NUMA); +- return pmd_clear_flags(pmd, _PAGE_PRESENT); ++ pmdval_t val = pmd_val(pmd); ++ ++ val &= ~_PAGE_PRESENT; ++ val |= _PAGE_NUMA; ++ ++ return __pmd(val); + } + #endif + #else +diff --git a/include/linux/list.h b/include/linux/list.h +index b83e5657365a..83a9576f479f 100644 +--- a/include/linux/list.h ++++ b/include/linux/list.h +@@ -373,6 +373,22 @@ static inline void list_splice_tail_init(struct list_head *list, + (!list_empty(ptr) ? list_first_entry(ptr, type, member) : NULL) + + /** ++ * list_next_entry - get the next element in list ++ * @pos: the type * to cursor ++ * @member: the name of the list_struct within the struct. ++ */ ++#define list_next_entry(pos, member) \ ++ list_entry((pos)->member.next, typeof(*(pos)), member) ++ ++/** ++ * list_prev_entry - get the prev element in list ++ * @pos: the type * to cursor ++ * @member: the name of the list_struct within the struct. ++ */ ++#define list_prev_entry(pos, member) \ ++ list_entry((pos)->member.prev, typeof(*(pos)), member) ++ ++/** + * list_for_each - iterate over a list + * @pos: the &struct list_head to use as a loop cursor. + * @head: the head for your list. +diff --git a/include/linux/sock_diag.h b/include/linux/sock_diag.h +index 54f91d35e5fd..302ab805b0bb 100644 +--- a/include/linux/sock_diag.h ++++ b/include/linux/sock_diag.h +@@ -23,7 +23,7 @@ int sock_diag_check_cookie(void *sk, __u32 *cookie); + void sock_diag_save_cookie(void *sk, __u32 *cookie); + + int sock_diag_put_meminfo(struct sock *sk, struct sk_buff *skb, int attr); +-int sock_diag_put_filterinfo(struct user_namespace *user_ns, struct sock *sk, ++int sock_diag_put_filterinfo(struct sock *sk, + struct sk_buff *skb, int attrtype); + + #endif +diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h +index b906f4a131a4..8d977b343647 100644 +--- a/include/net/ip6_route.h ++++ b/include/net/ip6_route.h +@@ -32,6 +32,11 @@ struct route_info { + #define RT6_LOOKUP_F_SRCPREF_PUBLIC 0x00000010 + #define RT6_LOOKUP_F_SRCPREF_COA 0x00000020 + ++/* We do not (yet ?) support IPv6 jumbograms (RFC 2675) ++ * Unlike IPv4, hdr->seg_len doesn't include the IPv6 header ++ */ ++#define IP6_MAX_MTU (0xFFFF + sizeof(struct ipv6hdr)) ++ + /* + * rt6_srcprefs2flags() and rt6_flags2srcprefs() translate + * between IPV6_ADDR_PREFERENCES socket option values +diff --git a/include/net/netfilter/nf_conntrack_extend.h b/include/net/netfilter/nf_conntrack_extend.h +index 331310851cfb..86dd7dd3d617 100644 +--- a/include/net/netfilter/nf_conntrack_extend.h ++++ b/include/net/netfilter/nf_conntrack_extend.h +@@ -41,8 +41,8 @@ enum nf_ct_ext_id { + /* Extensions: optional stuff which isn't permanently in struct. */ + struct nf_ct_ext { + struct rcu_head rcu; +- u8 offset[NF_CT_EXT_NUM]; +- u8 len; ++ u16 offset[NF_CT_EXT_NUM]; ++ u16 len; + char data[0]; + }; + +diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h +index 1bd4c4144fe8..da6b9a01ff75 100644 +--- a/include/net/sctp/structs.h ++++ b/include/net/sctp/structs.h +@@ -1252,6 +1252,7 @@ struct sctp_endpoint { + /* SCTP-AUTH: endpoint shared keys */ + struct list_head endpoint_shared_keys; + __u16 active_key_id; ++ __u8 auth_enable; + }; + + /* Recover the outter endpoint structure. */ +@@ -1280,7 +1281,8 @@ struct sctp_endpoint *sctp_endpoint_is_match(struct sctp_endpoint *, + int sctp_has_association(struct net *net, const union sctp_addr *laddr, + const union sctp_addr *paddr); + +-int sctp_verify_init(struct net *net, const struct sctp_association *asoc, ++int sctp_verify_init(struct net *net, const struct sctp_endpoint *ep, ++ const struct sctp_association *asoc, + sctp_cid_t, sctp_init_chunk_t *peer_init, + struct sctp_chunk *chunk, struct sctp_chunk **err_chunk); + int sctp_process_init(struct sctp_association *, struct sctp_chunk *chunk, +diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h +index cc645876d147..cc92ef3df62e 100644 +--- a/include/scsi/scsi_device.h ++++ b/include/scsi/scsi_device.h +@@ -248,7 +248,7 @@ struct scsi_target { + struct list_head siblings; + struct list_head devices; + struct device dev; +- unsigned int reap_ref; /* protected by the host lock */ ++ struct kref reap_ref; /* last put renders target invisible */ + unsigned int channel; + unsigned int id; /* target id ... replace + * scsi_device.id eventually */ +@@ -272,7 +272,6 @@ struct scsi_target { + #define SCSI_DEFAULT_TARGET_BLOCKED 3 + + char scsi_level; +- struct execute_work ew; + enum scsi_target_state state; + void *hostdata; /* available to low-level driver */ + unsigned long starget_data[0]; /* for the transport */ +diff --git a/include/trace/events/block.h b/include/trace/events/block.h +index 60ae7c3db912..2e96e2bb1529 100644 +--- a/include/trace/events/block.h ++++ b/include/trace/events/block.h +@@ -132,6 +132,7 @@ DEFINE_EVENT(block_rq_with_error, block_rq_requeue, + * block_rq_complete - block IO operation completed by device driver + * @q: queue containing the block operation request + * @rq: block operations request ++ * @nr_bytes: number of completed bytes + * + * The block_rq_complete tracepoint event indicates that some portion + * of operation request has been completed by the device driver. If +@@ -139,11 +140,37 @@ DEFINE_EVENT(block_rq_with_error, block_rq_requeue, + * do for the request. If @rq->bio is non-NULL then there is + * additional work required to complete the request. + */ +-DEFINE_EVENT(block_rq_with_error, block_rq_complete, ++TRACE_EVENT(block_rq_complete, + +- TP_PROTO(struct request_queue *q, struct request *rq), ++ TP_PROTO(struct request_queue *q, struct request *rq, ++ unsigned int nr_bytes), + +- TP_ARGS(q, rq) ++ TP_ARGS(q, rq, nr_bytes), ++ ++ TP_STRUCT__entry( ++ __field( dev_t, dev ) ++ __field( sector_t, sector ) ++ __field( unsigned int, nr_sector ) ++ __field( int, errors ) ++ __array( char, rwbs, RWBS_LEN ) ++ __dynamic_array( char, cmd, blk_cmd_buf_len(rq) ) ++ ), ++ ++ TP_fast_assign( ++ __entry->dev = rq->rq_disk ? disk_devt(rq->rq_disk) : 0; ++ __entry->sector = blk_rq_pos(rq); ++ __entry->nr_sector = nr_bytes >> 9; ++ __entry->errors = rq->errors; ++ ++ blk_fill_rwbs(__entry->rwbs, rq->cmd_flags, nr_bytes); ++ blk_dump_cmd(__get_str(cmd), rq); ++ ), ++ ++ TP_printk("%d,%d %s (%s) %llu + %u [%d]", ++ MAJOR(__entry->dev), MINOR(__entry->dev), ++ __entry->rwbs, __get_str(cmd), ++ (unsigned long long)__entry->sector, ++ __entry->nr_sector, __entry->errors) + ); + + DECLARE_EVENT_CLASS(block_rq, +diff --git a/kernel/events/core.c b/kernel/events/core.c +index f8eb2b154bdb..ac9b8cce3df2 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -2016,9 +2016,6 @@ static void __perf_event_sync_stat(struct perf_event *event, + perf_event_update_userpage(next_event); + } + +-#define list_next_entry(pos, member) \ +- list_entry(pos->member.next, typeof(*pos), member) +- + static void perf_event_sync_stat(struct perf_event_context *ctx, + struct perf_event_context *next_ctx) + { +diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c +index b8b8560bfb95..686417ba5cd1 100644 +--- a/kernel/trace/blktrace.c ++++ b/kernel/trace/blktrace.c +@@ -685,6 +685,7 @@ void blk_trace_shutdown(struct request_queue *q) + * blk_add_trace_rq - Add a trace for a request oriented action + * @q: queue the io is for + * @rq: the source request ++ * @nr_bytes: number of completed bytes + * @what: the action + * + * Description: +@@ -692,7 +693,7 @@ void blk_trace_shutdown(struct request_queue *q) + * + **/ + static void blk_add_trace_rq(struct request_queue *q, struct request *rq, +- u32 what) ++ unsigned int nr_bytes, u32 what) + { + struct blk_trace *bt = q->blk_trace; + +@@ -701,11 +702,11 @@ static void blk_add_trace_rq(struct request_queue *q, struct request *rq, + + if (rq->cmd_type == REQ_TYPE_BLOCK_PC) { + what |= BLK_TC_ACT(BLK_TC_PC); +- __blk_add_trace(bt, 0, blk_rq_bytes(rq), rq->cmd_flags, ++ __blk_add_trace(bt, 0, nr_bytes, rq->cmd_flags, + what, rq->errors, rq->cmd_len, rq->cmd); + } else { + what |= BLK_TC_ACT(BLK_TC_FS); +- __blk_add_trace(bt, blk_rq_pos(rq), blk_rq_bytes(rq), ++ __blk_add_trace(bt, blk_rq_pos(rq), nr_bytes, + rq->cmd_flags, what, rq->errors, 0, NULL); + } + } +@@ -713,33 +714,34 @@ static void blk_add_trace_rq(struct request_queue *q, struct request *rq, + static void blk_add_trace_rq_abort(void *ignore, + struct request_queue *q, struct request *rq) + { +- blk_add_trace_rq(q, rq, BLK_TA_ABORT); ++ blk_add_trace_rq(q, rq, blk_rq_bytes(rq), BLK_TA_ABORT); + } + + static void blk_add_trace_rq_insert(void *ignore, + struct request_queue *q, struct request *rq) + { +- blk_add_trace_rq(q, rq, BLK_TA_INSERT); ++ blk_add_trace_rq(q, rq, blk_rq_bytes(rq), BLK_TA_INSERT); + } + + static void blk_add_trace_rq_issue(void *ignore, + struct request_queue *q, struct request *rq) + { +- blk_add_trace_rq(q, rq, BLK_TA_ISSUE); ++ blk_add_trace_rq(q, rq, blk_rq_bytes(rq), BLK_TA_ISSUE); + } + + static void blk_add_trace_rq_requeue(void *ignore, + struct request_queue *q, + struct request *rq) + { +- blk_add_trace_rq(q, rq, BLK_TA_REQUEUE); ++ blk_add_trace_rq(q, rq, blk_rq_bytes(rq), BLK_TA_REQUEUE); + } + + static void blk_add_trace_rq_complete(void *ignore, + struct request_queue *q, +- struct request *rq) ++ struct request *rq, ++ unsigned int nr_bytes) + { +- blk_add_trace_rq(q, rq, BLK_TA_COMPLETE); ++ blk_add_trace_rq(q, rq, nr_bytes, BLK_TA_COMPLETE); + } + + /** +diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c +index 031cc5655a51..63630aef3bd3 100644 +--- a/kernel/tracepoint.c ++++ b/kernel/tracepoint.c +@@ -641,6 +641,9 @@ static int tracepoint_module_coming(struct module *mod) + struct tp_module *tp_mod, *iter; + int ret = 0; + ++ if (!mod->num_tracepoints) ++ return 0; ++ + /* + * We skip modules that taint the kernel, especially those with different + * module headers (for forced load), to make sure we don't cause a crash. +@@ -684,6 +687,9 @@ static int tracepoint_module_going(struct module *mod) + { + struct tp_module *pos; + ++ if (!mod->num_tracepoints) ++ return 0; ++ + mutex_lock(&tracepoints_mutex); + tracepoint_update_probe_range(mod->tracepoints_ptrs, + mod->tracepoints_ptrs + mod->num_tracepoints); +diff --git a/mm/hugetlb.c b/mm/hugetlb.c +index 8a7f27b42131..de73c9d144e1 100644 +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -1100,6 +1100,7 @@ static void return_unused_surplus_pages(struct hstate *h, + while (nr_pages--) { + if (!free_pool_huge_page(h, &node_states[N_MEMORY], 1)) + break; ++ cond_resched_lock(&hugetlb_lock); + } + } + +diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c +index cf35f383db4c..698e922f41ea 100644 +--- a/net/8021q/vlan_dev.c ++++ b/net/8021q/vlan_dev.c +@@ -512,10 +512,48 @@ static void vlan_dev_change_rx_flags(struct net_device *dev, int change) + } + } + ++static int vlan_calculate_locking_subclass(struct net_device *real_dev) ++{ ++ int subclass = 0; ++ ++ while (is_vlan_dev(real_dev)) { ++ subclass++; ++ real_dev = vlan_dev_priv(real_dev)->real_dev; ++ } ++ ++ return subclass; ++} ++ ++static void vlan_dev_mc_sync(struct net_device *to, struct net_device *from) ++{ ++ int err = 0, subclass; ++ ++ subclass = vlan_calculate_locking_subclass(to); ++ ++ spin_lock_nested(&to->addr_list_lock, subclass); ++ err = __hw_addr_sync(&to->mc, &from->mc, to->addr_len); ++ if (!err) ++ __dev_set_rx_mode(to); ++ spin_unlock(&to->addr_list_lock); ++} ++ ++static void vlan_dev_uc_sync(struct net_device *to, struct net_device *from) ++{ ++ int err = 0, subclass; ++ ++ subclass = vlan_calculate_locking_subclass(to); ++ ++ spin_lock_nested(&to->addr_list_lock, subclass); ++ err = __hw_addr_sync(&to->uc, &from->uc, to->addr_len); ++ if (!err) ++ __dev_set_rx_mode(to); ++ spin_unlock(&to->addr_list_lock); ++} ++ + static void vlan_dev_set_rx_mode(struct net_device *vlan_dev) + { +- dev_mc_sync(vlan_dev_priv(vlan_dev)->real_dev, vlan_dev); +- dev_uc_sync(vlan_dev_priv(vlan_dev)->real_dev, vlan_dev); ++ vlan_dev_mc_sync(vlan_dev_priv(vlan_dev)->real_dev, vlan_dev); ++ vlan_dev_uc_sync(vlan_dev_priv(vlan_dev)->real_dev, vlan_dev); + } + + /* +@@ -624,9 +662,7 @@ static int vlan_dev_init(struct net_device *dev) + + SET_NETDEV_DEVTYPE(dev, &vlan_type); + +- if (is_vlan_dev(real_dev)) +- subclass = 1; +- ++ subclass = vlan_calculate_locking_subclass(dev); + vlan_dev_set_lockdep_class(dev, subclass); + + vlan_dev_priv(dev)->vlan_pcpu_stats = alloc_percpu(struct vlan_pcpu_stats); +diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c +index 828e2bcc1f52..0a3bc82782cf 100644 +--- a/net/bridge/br_input.c ++++ b/net/bridge/br_input.c +@@ -71,7 +71,7 @@ int br_handle_frame_finish(struct sk_buff *skb) + goto drop; + + if (!br_allowed_ingress(p->br, nbp_get_vlan_info(p), skb, &vid)) +- goto drop; ++ goto out; + + /* insert into forwarding database after filtering to avoid spoofing */ + br = p->br; +diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c +index 06873e80a432..f16e9e487750 100644 +--- a/net/bridge/br_netlink.c ++++ b/net/bridge/br_netlink.c +@@ -438,6 +438,20 @@ static int br_validate(struct nlattr *tb[], struct nlattr *data[]) + return 0; + } + ++static int br_dev_newlink(struct net *src_net, struct net_device *dev, ++ struct nlattr *tb[], struct nlattr *data[]) ++{ ++ struct net_bridge *br = netdev_priv(dev); ++ ++ if (tb[IFLA_ADDRESS]) { ++ spin_lock_bh(&br->lock); ++ br_stp_change_bridge_id(br, nla_data(tb[IFLA_ADDRESS])); ++ spin_unlock_bh(&br->lock); ++ } ++ ++ return register_netdevice(dev); ++} ++ + static size_t br_get_link_af_size(const struct net_device *dev) + { + struct net_port_vlans *pv; +@@ -466,6 +480,7 @@ struct rtnl_link_ops br_link_ops __read_mostly = { + .priv_size = sizeof(struct net_bridge), + .setup = br_dev_setup, + .validate = br_validate, ++ .newlink = br_dev_newlink, + .dellink = br_dev_delete, + }; + +diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c +index 9a9ffe7e4019..d8deb8bda736 100644 +--- a/net/bridge/br_vlan.c ++++ b/net/bridge/br_vlan.c +@@ -202,7 +202,7 @@ bool br_allowed_ingress(struct net_bridge *br, struct net_port_vlans *v, + * rejected. + */ + if (!v) +- return false; ++ goto drop; + + if (br_vlan_get_tag(skb, vid)) { + u16 pvid = br_get_pvid(v); +@@ -212,7 +212,7 @@ bool br_allowed_ingress(struct net_bridge *br, struct net_port_vlans *v, + * traffic belongs to. + */ + if (pvid == VLAN_N_VID) +- return false; ++ goto drop; + + /* PVID is set on this port. Any untagged ingress + * frame is considered to belong to this vlan. +@@ -224,7 +224,8 @@ bool br_allowed_ingress(struct net_bridge *br, struct net_port_vlans *v, + /* Frame had a valid vlan tag. See if vlan is allowed */ + if (test_bit(*vid, v->vlan_bitmap)) + return true; +- ++drop: ++ kfree_skb(skb); + return false; + } + +diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c +index 3d110c4fc787..6651a7797d46 100644 +--- a/net/bridge/netfilter/ebtables.c ++++ b/net/bridge/netfilter/ebtables.c +@@ -1044,10 +1044,9 @@ static int do_replace_finish(struct net *net, struct ebt_replace *repl, + if (repl->num_counters && + copy_to_user(repl->counters, counterstmp, + repl->num_counters * sizeof(struct ebt_counter))) { +- ret = -EFAULT; ++ /* Silent error, can't fail, new table is already in place */ ++ net_warn_ratelimited("ebtables: counters copy to user failed while replacing table\n"); + } +- else +- ret = 0; + + /* decrease module count and free resources */ + EBT_ENTRY_ITERATE(table->entries, table->entries_size, +diff --git a/net/core/dev.c b/net/core/dev.c +index a0e55ffc03c9..56383a3e5d71 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -3898,6 +3898,7 @@ static void napi_reuse_skb(struct napi_struct *napi, struct sk_buff *skb) + skb->vlan_tci = 0; + skb->dev = napi->dev; + skb->skb_iif = 0; ++ skb->truesize = SKB_TRUESIZE(skb_end_offset(skb)); + + napi->skb = skb; + } +@@ -4634,6 +4635,7 @@ void __dev_set_rx_mode(struct net_device *dev) + if (ops->ndo_set_rx_mode) + ops->ndo_set_rx_mode(dev); + } ++EXPORT_SYMBOL(__dev_set_rx_mode); + + void dev_set_rx_mode(struct net_device *dev) + { +diff --git a/net/core/filter.c b/net/core/filter.c +index 52f01229ee01..c6c18d8a2d88 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -355,6 +355,8 @@ load_b: + + if (skb_is_nonlinear(skb)) + return 0; ++ if (skb->len < sizeof(struct nlattr)) ++ return 0; + if (A > skb->len - sizeof(struct nlattr)) + return 0; + +@@ -371,11 +373,13 @@ load_b: + + if (skb_is_nonlinear(skb)) + return 0; ++ if (skb->len < sizeof(struct nlattr)) ++ return 0; + if (A > skb->len - sizeof(struct nlattr)) + return 0; + + nla = (struct nlattr *)&skb->data[A]; +- if (nla->nla_len > A - skb->len) ++ if (nla->nla_len > skb->len - A) + return 0; + + nla = nla_find_nested(nla, X); +diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c +index 4c3087dffe78..87ec574ffac8 100644 +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -714,7 +714,8 @@ static inline int rtnl_vfinfo_size(const struct net_device *dev, + return 0; + } + +-static size_t rtnl_port_size(const struct net_device *dev) ++static size_t rtnl_port_size(const struct net_device *dev, ++ u32 ext_filter_mask) + { + size_t port_size = nla_total_size(4) /* PORT_VF */ + + nla_total_size(PORT_PROFILE_MAX) /* PORT_PROFILE */ +@@ -730,7 +731,8 @@ static size_t rtnl_port_size(const struct net_device *dev) + size_t port_self_size = nla_total_size(sizeof(struct nlattr)) + + port_size; + +- if (!dev->netdev_ops->ndo_get_vf_port || !dev->dev.parent) ++ if (!dev->netdev_ops->ndo_get_vf_port || !dev->dev.parent || ++ !(ext_filter_mask & RTEXT_FILTER_VF)) + return 0; + if (dev_num_vf(dev->dev.parent)) + return port_self_size + vf_ports_size + +@@ -765,7 +767,7 @@ static noinline size_t if_nlmsg_size(const struct net_device *dev, + + nla_total_size(ext_filter_mask + & RTEXT_FILTER_VF ? 4 : 0) /* IFLA_NUM_VF */ + + rtnl_vfinfo_size(dev, ext_filter_mask) /* IFLA_VFINFO_LIST */ +- + rtnl_port_size(dev) /* IFLA_VF_PORTS + IFLA_PORT_SELF */ ++ + rtnl_port_size(dev, ext_filter_mask) /* IFLA_VF_PORTS + IFLA_PORT_SELF */ + + rtnl_link_get_size(dev) /* IFLA_LINKINFO */ + + rtnl_link_get_af_size(dev); /* IFLA_AF_SPEC */ + } +@@ -826,11 +828,13 @@ static int rtnl_port_self_fill(struct sk_buff *skb, struct net_device *dev) + return 0; + } + +-static int rtnl_port_fill(struct sk_buff *skb, struct net_device *dev) ++static int rtnl_port_fill(struct sk_buff *skb, struct net_device *dev, ++ u32 ext_filter_mask) + { + int err; + +- if (!dev->netdev_ops->ndo_get_vf_port || !dev->dev.parent) ++ if (!dev->netdev_ops->ndo_get_vf_port || !dev->dev.parent || ++ !(ext_filter_mask & RTEXT_FILTER_VF)) + return 0; + + err = rtnl_port_self_fill(skb, dev); +@@ -985,7 +989,7 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev, + nla_nest_end(skb, vfinfo); + } + +- if (rtnl_port_fill(skb, dev)) ++ if (rtnl_port_fill(skb, dev, ext_filter_mask)) + goto nla_put_failure; + + if (dev->rtnl_link_ops) { +@@ -1039,6 +1043,7 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb) + struct hlist_head *head; + struct nlattr *tb[IFLA_MAX+1]; + u32 ext_filter_mask = 0; ++ int err; + + s_h = cb->args[0]; + s_idx = cb->args[1]; +@@ -1059,11 +1064,17 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb) + hlist_for_each_entry_rcu(dev, head, index_hlist) { + if (idx < s_idx) + goto cont; +- if (rtnl_fill_ifinfo(skb, dev, RTM_NEWLINK, +- NETLINK_CB(cb->skb).portid, +- cb->nlh->nlmsg_seq, 0, +- NLM_F_MULTI, +- ext_filter_mask) <= 0) ++ err = rtnl_fill_ifinfo(skb, dev, RTM_NEWLINK, ++ NETLINK_CB(cb->skb).portid, ++ cb->nlh->nlmsg_seq, 0, ++ NLM_F_MULTI, ++ ext_filter_mask); ++ /* If we ran out of room on the first message, ++ * we're in trouble ++ */ ++ WARN_ON((err == -EMSGSIZE) && (skb->len == 0)); ++ ++ if (err <= 0) + goto out; + + nl_dump_check_consistent(cb, nlmsg_hdr(skb)); +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index 79143b7af7e5..66f722b5052a 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -3487,12 +3487,14 @@ EXPORT_SYMBOL(skb_try_coalesce); + unsigned int skb_gso_transport_seglen(const struct sk_buff *skb) + { + const struct skb_shared_info *shinfo = skb_shinfo(skb); +- unsigned int hdr_len; + + if (likely(shinfo->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6))) +- hdr_len = tcp_hdrlen(skb); +- else +- hdr_len = sizeof(struct udphdr); +- return hdr_len + shinfo->gso_size; ++ return tcp_hdrlen(skb) + shinfo->gso_size; ++ ++ /* UFO sets gso_size to the size of the fragmentation ++ * payload, i.e. the size of the L4 (UDP) header is already ++ * accounted for. ++ */ ++ return shinfo->gso_size; + } + EXPORT_SYMBOL_GPL(skb_gso_transport_seglen); +diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c +index a0e9cf6379de..6a7fae228634 100644 +--- a/net/core/sock_diag.c ++++ b/net/core/sock_diag.c +@@ -49,7 +49,7 @@ int sock_diag_put_meminfo(struct sock *sk, struct sk_buff *skb, int attrtype) + } + EXPORT_SYMBOL_GPL(sock_diag_put_meminfo); + +-int sock_diag_put_filterinfo(struct user_namespace *user_ns, struct sock *sk, ++int sock_diag_put_filterinfo(struct sock *sk, + struct sk_buff *skb, int attrtype) + { + struct nlattr *attr; +@@ -57,7 +57,7 @@ int sock_diag_put_filterinfo(struct user_namespace *user_ns, struct sock *sk, + unsigned int len; + int err = 0; + +- if (!ns_capable(user_ns, CAP_NET_ADMIN)) { ++ if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) { + nla_reserve(skb, attrtype, 0); + return 0; + } +diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c +index 8f6cb7a87cd6..9c3979a50804 100644 +--- a/net/ipv4/fib_semantics.c ++++ b/net/ipv4/fib_semantics.c +@@ -818,13 +818,13 @@ struct fib_info *fib_create_info(struct fib_config *cfg) + fi = kzalloc(sizeof(*fi)+nhs*sizeof(struct fib_nh), GFP_KERNEL); + if (fi == NULL) + goto failure; ++ fib_info_cnt++; + if (cfg->fc_mx) { + fi->fib_metrics = kzalloc(sizeof(u32) * RTAX_MAX, GFP_KERNEL); + if (!fi->fib_metrics) + goto failure; + } else + fi->fib_metrics = (u32 *) dst_default_metrics; +- fib_info_cnt++; + + fi->fib_net = hold_net(net); + fi->fib_protocol = cfg->fc_protocol; +diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c +index 98d7e53d2afd..bd1c5baf69be 100644 +--- a/net/ipv4/ip_forward.c ++++ b/net/ipv4/ip_forward.c +@@ -42,12 +42,12 @@ + static bool ip_may_fragment(const struct sk_buff *skb) + { + return unlikely((ip_hdr(skb)->frag_off & htons(IP_DF)) == 0) || +- !skb->local_df; ++ skb->local_df; + } + + static bool ip_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu) + { +- if (skb->len <= mtu || skb->local_df) ++ if (skb->len <= mtu) + return false; + + if (skb_is_gso(skb) && skb_gso_network_seglen(skb) <= mtu) +diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c +index 828b2e8631e7..fae5a8459538 100644 +--- a/net/ipv4/ip_gre.c ++++ b/net/ipv4/ip_gre.c +@@ -652,6 +652,7 @@ static const struct net_device_ops ipgre_netdev_ops = { + static void ipgre_tunnel_setup(struct net_device *dev) + { + dev->netdev_ops = &ipgre_netdev_ops; ++ dev->type = ARPHRD_IPGRE; + ip_tunnel_setup(dev, ipgre_net_id); + } + +@@ -690,7 +691,6 @@ static int ipgre_tunnel_init(struct net_device *dev) + memcpy(dev->dev_addr, &iph->saddr, 4); + memcpy(dev->broadcast, &iph->daddr, 4); + +- dev->type = ARPHRD_IPGRE; + dev->flags = IFF_NOARP; + dev->priv_flags &= ~IFF_XMIT_DST_RELEASE; + dev->addr_len = 4; +diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c +index feb19db62359..4ec34275160b 100644 +--- a/net/ipv4/ip_vti.c ++++ b/net/ipv4/ip_vti.c +@@ -579,9 +579,9 @@ static void vti_dev_free(struct net_device *dev) + static void vti_tunnel_setup(struct net_device *dev) + { + dev->netdev_ops = &vti_netdev_ops; ++ dev->type = ARPHRD_TUNNEL; + dev->destructor = vti_dev_free; + +- dev->type = ARPHRD_TUNNEL; + dev->hard_header_len = LL_MAX_HEADER + sizeof(struct iphdr); + dev->mtu = ETH_DATA_LEN; + dev->flags = IFF_NOARP; +diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c +index 85a4f21aac1a..c8abe31961ed 100644 +--- a/net/ipv4/netfilter/arp_tables.c ++++ b/net/ipv4/netfilter/arp_tables.c +@@ -1039,8 +1039,10 @@ static int __do_replace(struct net *net, const char *name, + + xt_free_table_info(oldinfo); + if (copy_to_user(counters_ptr, counters, +- sizeof(struct xt_counters) * num_counters) != 0) +- ret = -EFAULT; ++ sizeof(struct xt_counters) * num_counters) != 0) { ++ /* Silent error, can't fail, new table is already in place */ ++ net_warn_ratelimited("arptables: counters copy to user failed while replacing table\n"); ++ } + vfree(counters); + xt_table_unlock(t); + return ret; +diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c +index d23118d95ff9..651c10774d58 100644 +--- a/net/ipv4/netfilter/ip_tables.c ++++ b/net/ipv4/netfilter/ip_tables.c +@@ -1226,8 +1226,10 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks, + + xt_free_table_info(oldinfo); + if (copy_to_user(counters_ptr, counters, +- sizeof(struct xt_counters) * num_counters) != 0) +- ret = -EFAULT; ++ sizeof(struct xt_counters) * num_counters) != 0) { ++ /* Silent error, can't fail, new table is already in place */ ++ net_warn_ratelimited("iptables: counters copy to user failed while replacing table\n"); ++ } + vfree(counters); + xt_table_unlock(t); + return ret; +diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c +index 8cae28f5c3cf..aa857a4a06a8 100644 +--- a/net/ipv4/ping.c ++++ b/net/ipv4/ping.c +@@ -204,26 +204,33 @@ static int ping_init_sock(struct sock *sk) + { + struct net *net = sock_net(sk); + kgid_t group = current_egid(); +- struct group_info *group_info = get_current_groups(); +- int i, j, count = group_info->ngroups; ++ struct group_info *group_info; ++ int i, j, count; + kgid_t low, high; ++ int ret = 0; + + inet_get_ping_group_range_net(net, &low, &high); + if (gid_lte(low, group) && gid_lte(group, high)) + return 0; + ++ group_info = get_current_groups(); ++ count = group_info->ngroups; + for (i = 0; i < group_info->nblocks; i++) { + int cp_count = min_t(int, NGROUPS_PER_BLOCK, count); + for (j = 0; j < cp_count; j++) { + kgid_t gid = group_info->blocks[i][j]; + if (gid_lte(low, gid) && gid_lte(gid, high)) +- return 0; ++ goto out_release_group; + } + + count -= cp_count; + } + +- return -EACCES; ++ ret = -EACCES; ++ ++out_release_group: ++ put_group_info(group_info); ++ return ret; + } + + static void ping_close(struct sock *sk, long timeout) +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index 1a362f375e67..7256eef088b2 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -1478,7 +1478,7 @@ static int __mkroute_input(struct sk_buff *skb, + struct in_device *out_dev; + unsigned int flags = 0; + bool do_cache; +- u32 itag; ++ u32 itag = 0; + + /* get a working reference to the output device */ + out_dev = __in_dev_get_rcu(FIB_RES_DEV(*res)); +@@ -2306,7 +2306,7 @@ static int rt_fill_info(struct net *net, __be32 dst, __be32 src, + } + } else + #endif +- if (nla_put_u32(skb, RTA_IIF, rt->rt_iif)) ++ if (nla_put_u32(skb, RTA_IIF, skb->dev->ifindex)) + goto nla_put_failure; + } + +diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c +index b6ae92a51f58..894b7cea5d7b 100644 +--- a/net/ipv4/tcp_cubic.c ++++ b/net/ipv4/tcp_cubic.c +@@ -408,7 +408,7 @@ static void bictcp_acked(struct sock *sk, u32 cnt, s32 rtt_us) + ratio -= ca->delayed_ack >> ACK_RATIO_SHIFT; + ratio += cnt; + +- ca->delayed_ack = min(ratio, ACK_RATIO_LIMIT); ++ ca->delayed_ack = clamp(ratio, 1U, ACK_RATIO_LIMIT); + } + + /* Some calls are for duplicates without timetamps */ +diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c +index 9c06ecb6556e..009c9620f442 100644 +--- a/net/ipv6/ip6_fib.c ++++ b/net/ipv6/ip6_fib.c +@@ -1418,7 +1418,7 @@ static int fib6_walk_continue(struct fib6_walker_t *w) + + if (w->skip) { + w->skip--; +- continue; ++ goto skip; + } + + err = w->func(w); +@@ -1428,6 +1428,7 @@ static int fib6_walk_continue(struct fib6_walker_t *w) + w->count++; + continue; + } ++skip: + w->state = FWS_U; + case FWS_U: + if (fn == w->root) +diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c +index 1f9a1a5b61f4..7dca7c43fdf1 100644 +--- a/net/ipv6/ip6_gre.c ++++ b/net/ipv6/ip6_gre.c +@@ -1549,6 +1549,15 @@ static int ip6gre_changelink(struct net_device *dev, struct nlattr *tb[], + return 0; + } + ++static void ip6gre_dellink(struct net_device *dev, struct list_head *head) ++{ ++ struct net *net = dev_net(dev); ++ struct ip6gre_net *ign = net_generic(net, ip6gre_net_id); ++ ++ if (dev != ign->fb_tunnel_dev) ++ unregister_netdevice_queue(dev, head); ++} ++ + static size_t ip6gre_get_size(const struct net_device *dev) + { + return +@@ -1626,6 +1635,7 @@ static struct rtnl_link_ops ip6gre_link_ops __read_mostly = { + .validate = ip6gre_tunnel_validate, + .newlink = ip6gre_newlink, + .changelink = ip6gre_changelink, ++ .dellink = ip6gre_dellink, + .get_size = ip6gre_get_size, + .fill_info = ip6gre_fill_info, + }; +diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c +index 32fb114b86bb..ffa8d295c56c 100644 +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -347,12 +347,16 @@ static inline int ip6_forward_finish(struct sk_buff *skb) + + static bool ip6_pkt_too_big(const struct sk_buff *skb, unsigned int mtu) + { +- if (skb->len <= mtu || skb->local_df) ++ if (skb->len <= mtu) + return false; + ++ /* ipv6 conntrack defrag sets max_frag_size + local_df */ + if (IP6CB(skb)->frag_max_size && IP6CB(skb)->frag_max_size > mtu) + return true; + ++ if (skb->local_df) ++ return false; ++ + if (skb_is_gso(skb) && skb_gso_network_seglen(skb) <= mtu) + return false; + +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index f21cf476b00c..73d7f68da557 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -1531,7 +1531,7 @@ static int ip6_tnl_validate(struct nlattr *tb[], struct nlattr *data[]) + { + u8 proto; + +- if (!data) ++ if (!data || !data[IFLA_IPTUN_PROTO]) + return 0; + + proto = nla_get_u8(data[IFLA_IPTUN_PROTO]); +diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c +index 44400c216dc6..89a4e4ddd8bb 100644 +--- a/net/ipv6/netfilter/ip6_tables.c ++++ b/net/ipv6/netfilter/ip6_tables.c +@@ -1236,8 +1236,10 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks, + + xt_free_table_info(oldinfo); + if (copy_to_user(counters_ptr, counters, +- sizeof(struct xt_counters) * num_counters) != 0) +- ret = -EFAULT; ++ sizeof(struct xt_counters) * num_counters) != 0) { ++ /* Silent error, can't fail, new table is already in place */ ++ net_warn_ratelimited("ip6tables: counters copy to user failed while replacing table\n"); ++ } + vfree(counters); + xt_table_unlock(t); + return ret; +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 3fde3e977862..b2614b22622b 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -1236,7 +1236,7 @@ static unsigned int ip6_mtu(const struct dst_entry *dst) + unsigned int mtu = dst_metric_raw(dst, RTAX_MTU); + + if (mtu) +- return mtu; ++ goto out; + + mtu = IPV6_MIN_MTU; + +@@ -1246,7 +1246,8 @@ static unsigned int ip6_mtu(const struct dst_entry *dst) + mtu = idev->cnf.mtu6; + rcu_read_unlock(); + +- return mtu; ++out: ++ return min_t(unsigned int, mtu, IP6_MAX_MTU); + } + + static struct dst_entry *icmp6_dst_gc_list; +diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c +index 44441c0c5037..9a0e5874e73e 100644 +--- a/net/l2tp/l2tp_ppp.c ++++ b/net/l2tp/l2tp_ppp.c +@@ -754,9 +754,9 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, + session->deref = pppol2tp_session_sock_put; + + /* If PMTU discovery was enabled, use the MTU that was discovered */ +- dst = sk_dst_get(sk); ++ dst = sk_dst_get(tunnel->sock); + if (dst != NULL) { +- u32 pmtu = dst_mtu(__sk_dst_get(sk)); ++ u32 pmtu = dst_mtu(__sk_dst_get(tunnel->sock)); + if (pmtu != 0) + session->mtu = session->mru = pmtu - + PPPOL2TP_HEADER_OVERHEAD; +diff --git a/net/packet/diag.c b/net/packet/diag.c +index a9584a2f6d69..ec8b6e8a80b1 100644 +--- a/net/packet/diag.c ++++ b/net/packet/diag.c +@@ -171,7 +171,7 @@ static int sk_diag_fill(struct sock *sk, struct sk_buff *skb, + goto out_nlmsg_trim; + + if ((req->pdiag_show & PACKET_SHOW_FILTER) && +- sock_diag_put_filterinfo(user_ns, sk, skb, PACKET_DIAG_FILTER)) ++ sock_diag_put_filterinfo(sk, skb, PACKET_DIAG_FILTER)) + goto out_nlmsg_trim; + + return nlmsg_end(skb, nlh); +diff --git a/net/sctp/auth.c b/net/sctp/auth.c +index ba1dfc3f8def..7a19117254db 100644 +--- a/net/sctp/auth.c ++++ b/net/sctp/auth.c +@@ -393,14 +393,13 @@ nomem: + */ + int sctp_auth_asoc_init_active_key(struct sctp_association *asoc, gfp_t gfp) + { +- struct net *net = sock_net(asoc->base.sk); + struct sctp_auth_bytes *secret; + struct sctp_shared_key *ep_key; + + /* If we don't support AUTH, or peer is not capable + * we don't need to do anything. + */ +- if (!net->sctp.auth_enable || !asoc->peer.auth_capable) ++ if (!asoc->ep->auth_enable || !asoc->peer.auth_capable) + return 0; + + /* If the key_id is non-zero and we couldn't find an +@@ -447,16 +446,16 @@ struct sctp_shared_key *sctp_auth_get_shkey( + */ + int sctp_auth_init_hmacs(struct sctp_endpoint *ep, gfp_t gfp) + { +- struct net *net = sock_net(ep->base.sk); + struct crypto_hash *tfm = NULL; + __u16 id; + +- /* if the transforms are already allocted, we are done */ +- if (!net->sctp.auth_enable) { ++ /* If AUTH extension is disabled, we are done */ ++ if (!ep->auth_enable) { + ep->auth_hmacs = NULL; + return 0; + } + ++ /* If the transforms are already allocated, we are done */ + if (ep->auth_hmacs) + return 0; + +@@ -677,12 +676,10 @@ static int __sctp_auth_cid(sctp_cid_t chunk, struct sctp_chunks_param *param) + /* Check if peer requested that this chunk is authenticated */ + int sctp_auth_send_cid(sctp_cid_t chunk, const struct sctp_association *asoc) + { +- struct net *net; + if (!asoc) + return 0; + +- net = sock_net(asoc->base.sk); +- if (!net->sctp.auth_enable || !asoc->peer.auth_capable) ++ if (!asoc->ep->auth_enable || !asoc->peer.auth_capable) + return 0; + + return __sctp_auth_cid(chunk, asoc->peer.peer_chunks); +@@ -691,12 +688,10 @@ int sctp_auth_send_cid(sctp_cid_t chunk, const struct sctp_association *asoc) + /* Check if we requested that peer authenticate this chunk. */ + int sctp_auth_recv_cid(sctp_cid_t chunk, const struct sctp_association *asoc) + { +- struct net *net; + if (!asoc) + return 0; + +- net = sock_net(asoc->base.sk); +- if (!net->sctp.auth_enable) ++ if (!asoc->ep->auth_enable) + return 0; + + return __sctp_auth_cid(chunk, +diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c +index 5fbd7bc6bb11..e09f906514db 100644 +--- a/net/sctp/endpointola.c ++++ b/net/sctp/endpointola.c +@@ -75,7 +75,8 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep, + if (!ep->digest) + return NULL; + +- if (net->sctp.auth_enable) { ++ ep->auth_enable = net->sctp.auth_enable; ++ if (ep->auth_enable) { + /* Allocate space for HMACS and CHUNKS authentication + * variables. There are arrays that we encode directly + * into parameters to make the rest of the operations easier. +diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c +index eaee00c61139..5a3c1c0a84a1 100644 +--- a/net/sctp/protocol.c ++++ b/net/sctp/protocol.c +@@ -498,8 +498,13 @@ static void sctp_v4_get_dst(struct sctp_transport *t, union sctp_addr *saddr, + continue; + if ((laddr->state == SCTP_ADDR_SRC) && + (AF_INET == laddr->a.sa.sa_family)) { +- fl4->saddr = laddr->a.v4.sin_addr.s_addr; + fl4->fl4_sport = laddr->a.v4.sin_port; ++ flowi4_update_output(fl4, ++ asoc->base.sk->sk_bound_dev_if, ++ RT_CONN_FLAGS(asoc->base.sk), ++ daddr->v4.sin_addr.s_addr, ++ laddr->a.v4.sin_addr.s_addr); ++ + rt = ip_route_output_key(sock_net(sk), fl4); + if (!IS_ERR(rt)) { + dst = &rt->dst; +diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c +index 673921cfb97e..87e244be899a 100644 +--- a/net/sctp/sm_make_chunk.c ++++ b/net/sctp/sm_make_chunk.c +@@ -199,6 +199,7 @@ struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc, + gfp_t gfp, int vparam_len) + { + struct net *net = sock_net(asoc->base.sk); ++ struct sctp_endpoint *ep = asoc->ep; + sctp_inithdr_t init; + union sctp_params addrs; + size_t chunksize; +@@ -258,7 +259,7 @@ struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc, + chunksize += vparam_len; + + /* Account for AUTH related parameters */ +- if (net->sctp.auth_enable) { ++ if (ep->auth_enable) { + /* Add random parameter length*/ + chunksize += sizeof(asoc->c.auth_random); + +@@ -343,7 +344,7 @@ struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc, + } + + /* Add SCTP-AUTH chunks to the parameter list */ +- if (net->sctp.auth_enable) { ++ if (ep->auth_enable) { + sctp_addto_chunk(retval, sizeof(asoc->c.auth_random), + asoc->c.auth_random); + if (auth_hmacs) +@@ -1995,7 +1996,7 @@ static void sctp_process_ext_param(struct sctp_association *asoc, + /* if the peer reports AUTH, assume that he + * supports AUTH. + */ +- if (net->sctp.auth_enable) ++ if (asoc->ep->auth_enable) + asoc->peer.auth_capable = 1; + break; + case SCTP_CID_ASCONF: +@@ -2087,6 +2088,7 @@ static sctp_ierror_t sctp_process_unk_param(const struct sctp_association *asoc, + * SCTP_IERROR_NO_ERROR - continue with the chunk + */ + static sctp_ierror_t sctp_verify_param(struct net *net, ++ const struct sctp_endpoint *ep, + const struct sctp_association *asoc, + union sctp_params param, + sctp_cid_t cid, +@@ -2137,7 +2139,7 @@ static sctp_ierror_t sctp_verify_param(struct net *net, + goto fallthrough; + + case SCTP_PARAM_RANDOM: +- if (!net->sctp.auth_enable) ++ if (!ep->auth_enable) + goto fallthrough; + + /* SCTP-AUTH: Secion 6.1 +@@ -2154,7 +2156,7 @@ static sctp_ierror_t sctp_verify_param(struct net *net, + break; + + case SCTP_PARAM_CHUNKS: +- if (!net->sctp.auth_enable) ++ if (!ep->auth_enable) + goto fallthrough; + + /* SCTP-AUTH: Section 3.2 +@@ -2170,7 +2172,7 @@ static sctp_ierror_t sctp_verify_param(struct net *net, + break; + + case SCTP_PARAM_HMAC_ALGO: +- if (!net->sctp.auth_enable) ++ if (!ep->auth_enable) + goto fallthrough; + + hmacs = (struct sctp_hmac_algo_param *)param.p; +@@ -2204,10 +2206,9 @@ fallthrough: + } + + /* Verify the INIT packet before we process it. */ +-int sctp_verify_init(struct net *net, const struct sctp_association *asoc, +- sctp_cid_t cid, +- sctp_init_chunk_t *peer_init, +- struct sctp_chunk *chunk, ++int sctp_verify_init(struct net *net, const struct sctp_endpoint *ep, ++ const struct sctp_association *asoc, sctp_cid_t cid, ++ sctp_init_chunk_t *peer_init, struct sctp_chunk *chunk, + struct sctp_chunk **errp) + { + union sctp_params param; +@@ -2250,8 +2251,8 @@ int sctp_verify_init(struct net *net, const struct sctp_association *asoc, + + /* Verify all the variable length parameters */ + sctp_walk_params(param, peer_init, init_hdr.params) { +- +- result = sctp_verify_param(net, asoc, param, cid, chunk, errp); ++ result = sctp_verify_param(net, ep, asoc, param, cid, ++ chunk, errp); + switch (result) { + case SCTP_IERROR_ABORT: + case SCTP_IERROR_NOMEM: +@@ -2483,6 +2484,7 @@ static int sctp_process_param(struct sctp_association *asoc, + struct sctp_af *af; + union sctp_addr_param *addr_param; + struct sctp_transport *t; ++ struct sctp_endpoint *ep = asoc->ep; + + /* We maintain all INIT parameters in network byte order all the + * time. This allows us to not worry about whether the parameters +@@ -2623,7 +2625,7 @@ do_addr_param: + goto fall_through; + + case SCTP_PARAM_RANDOM: +- if (!net->sctp.auth_enable) ++ if (!ep->auth_enable) + goto fall_through; + + /* Save peer's random parameter */ +@@ -2636,7 +2638,7 @@ do_addr_param: + break; + + case SCTP_PARAM_HMAC_ALGO: +- if (!net->sctp.auth_enable) ++ if (!ep->auth_enable) + goto fall_through; + + /* Save peer's HMAC list */ +@@ -2652,7 +2654,7 @@ do_addr_param: + break; + + case SCTP_PARAM_CHUNKS: +- if (!net->sctp.auth_enable) ++ if (!ep->auth_enable) + goto fall_through; + + asoc->peer.peer_chunks = kmemdup(param.p, +diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c +index 9973079401c4..6eb26403de6a 100644 +--- a/net/sctp/sm_statefuns.c ++++ b/net/sctp/sm_statefuns.c +@@ -364,7 +364,7 @@ sctp_disposition_t sctp_sf_do_5_1B_init(struct net *net, + + /* Verify the INIT chunk before processing it. */ + err_chunk = NULL; +- if (!sctp_verify_init(net, asoc, chunk->chunk_hdr->type, ++ if (!sctp_verify_init(net, ep, asoc, chunk->chunk_hdr->type, + (sctp_init_chunk_t *)chunk->chunk_hdr, chunk, + &err_chunk)) { + /* This chunk contains fatal error. It is to be discarded. +@@ -531,7 +531,7 @@ sctp_disposition_t sctp_sf_do_5_1C_ack(struct net *net, + + /* Verify the INIT chunk before processing it. */ + err_chunk = NULL; +- if (!sctp_verify_init(net, asoc, chunk->chunk_hdr->type, ++ if (!sctp_verify_init(net, ep, asoc, chunk->chunk_hdr->type, + (sctp_init_chunk_t *)chunk->chunk_hdr, chunk, + &err_chunk)) { + +@@ -1437,7 +1437,7 @@ static sctp_disposition_t sctp_sf_do_unexpected_init( + + /* Verify the INIT chunk before processing it. */ + err_chunk = NULL; +- if (!sctp_verify_init(net, asoc, chunk->chunk_hdr->type, ++ if (!sctp_verify_init(net, ep, asoc, chunk->chunk_hdr->type, + (sctp_init_chunk_t *)chunk->chunk_hdr, chunk, + &err_chunk)) { + /* This chunk contains fatal error. It is to be discarded. +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index 8554e5eebaeb..dfb9b133e662 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -3318,10 +3318,10 @@ static int sctp_setsockopt_auth_chunk(struct sock *sk, + char __user *optval, + unsigned int optlen) + { +- struct net *net = sock_net(sk); ++ struct sctp_endpoint *ep = sctp_sk(sk)->ep; + struct sctp_authchunk val; + +- if (!net->sctp.auth_enable) ++ if (!ep->auth_enable) + return -EACCES; + + if (optlen != sizeof(struct sctp_authchunk)) +@@ -3338,7 +3338,7 @@ static int sctp_setsockopt_auth_chunk(struct sock *sk, + } + + /* add this chunk id to the endpoint */ +- return sctp_auth_ep_add_chunkid(sctp_sk(sk)->ep, val.sauth_chunk); ++ return sctp_auth_ep_add_chunkid(ep, val.sauth_chunk); + } + + /* +@@ -3351,12 +3351,12 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk, + char __user *optval, + unsigned int optlen) + { +- struct net *net = sock_net(sk); ++ struct sctp_endpoint *ep = sctp_sk(sk)->ep; + struct sctp_hmacalgo *hmacs; + u32 idents; + int err; + +- if (!net->sctp.auth_enable) ++ if (!ep->auth_enable) + return -EACCES; + + if (optlen < sizeof(struct sctp_hmacalgo)) +@@ -3373,7 +3373,7 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk, + goto out; + } + +- err = sctp_auth_ep_set_hmacs(sctp_sk(sk)->ep, hmacs); ++ err = sctp_auth_ep_set_hmacs(ep, hmacs); + out: + kfree(hmacs); + return err; +@@ -3389,12 +3389,12 @@ static int sctp_setsockopt_auth_key(struct sock *sk, + char __user *optval, + unsigned int optlen) + { +- struct net *net = sock_net(sk); ++ struct sctp_endpoint *ep = sctp_sk(sk)->ep; + struct sctp_authkey *authkey; + struct sctp_association *asoc; + int ret; + +- if (!net->sctp.auth_enable) ++ if (!ep->auth_enable) + return -EACCES; + + if (optlen <= sizeof(struct sctp_authkey)) +@@ -3415,7 +3415,7 @@ static int sctp_setsockopt_auth_key(struct sock *sk, + goto out; + } + +- ret = sctp_auth_set_key(sctp_sk(sk)->ep, asoc, authkey); ++ ret = sctp_auth_set_key(ep, asoc, authkey); + out: + kzfree(authkey); + return ret; +@@ -3431,11 +3431,11 @@ static int sctp_setsockopt_active_key(struct sock *sk, + char __user *optval, + unsigned int optlen) + { +- struct net *net = sock_net(sk); ++ struct sctp_endpoint *ep = sctp_sk(sk)->ep; + struct sctp_authkeyid val; + struct sctp_association *asoc; + +- if (!net->sctp.auth_enable) ++ if (!ep->auth_enable) + return -EACCES; + + if (optlen != sizeof(struct sctp_authkeyid)) +@@ -3447,8 +3447,7 @@ static int sctp_setsockopt_active_key(struct sock *sk, + if (!asoc && val.scact_assoc_id && sctp_style(sk, UDP)) + return -EINVAL; + +- return sctp_auth_set_active_key(sctp_sk(sk)->ep, asoc, +- val.scact_keynumber); ++ return sctp_auth_set_active_key(ep, asoc, val.scact_keynumber); + } + + /* +@@ -3460,11 +3459,11 @@ static int sctp_setsockopt_del_key(struct sock *sk, + char __user *optval, + unsigned int optlen) + { +- struct net *net = sock_net(sk); ++ struct sctp_endpoint *ep = sctp_sk(sk)->ep; + struct sctp_authkeyid val; + struct sctp_association *asoc; + +- if (!net->sctp.auth_enable) ++ if (!ep->auth_enable) + return -EACCES; + + if (optlen != sizeof(struct sctp_authkeyid)) +@@ -3476,8 +3475,7 @@ static int sctp_setsockopt_del_key(struct sock *sk, + if (!asoc && val.scact_assoc_id && sctp_style(sk, UDP)) + return -EINVAL; + +- return sctp_auth_del_key_id(sctp_sk(sk)->ep, asoc, +- val.scact_keynumber); ++ return sctp_auth_del_key_id(ep, asoc, val.scact_keynumber); + + } + +@@ -5368,16 +5366,16 @@ static int sctp_getsockopt_maxburst(struct sock *sk, int len, + static int sctp_getsockopt_hmac_ident(struct sock *sk, int len, + char __user *optval, int __user *optlen) + { +- struct net *net = sock_net(sk); ++ struct sctp_endpoint *ep = sctp_sk(sk)->ep; + struct sctp_hmacalgo __user *p = (void __user *)optval; + struct sctp_hmac_algo_param *hmacs; + __u16 data_len = 0; + u32 num_idents; + +- if (!net->sctp.auth_enable) ++ if (!ep->auth_enable) + return -EACCES; + +- hmacs = sctp_sk(sk)->ep->auth_hmacs_list; ++ hmacs = ep->auth_hmacs_list; + data_len = ntohs(hmacs->param_hdr.length) - sizeof(sctp_paramhdr_t); + + if (len < sizeof(struct sctp_hmacalgo) + data_len) +@@ -5398,11 +5396,11 @@ static int sctp_getsockopt_hmac_ident(struct sock *sk, int len, + static int sctp_getsockopt_active_key(struct sock *sk, int len, + char __user *optval, int __user *optlen) + { +- struct net *net = sock_net(sk); ++ struct sctp_endpoint *ep = sctp_sk(sk)->ep; + struct sctp_authkeyid val; + struct sctp_association *asoc; + +- if (!net->sctp.auth_enable) ++ if (!ep->auth_enable) + return -EACCES; + + if (len < sizeof(struct sctp_authkeyid)) +@@ -5417,7 +5415,7 @@ static int sctp_getsockopt_active_key(struct sock *sk, int len, + if (asoc) + val.scact_keynumber = asoc->active_key_id; + else +- val.scact_keynumber = sctp_sk(sk)->ep->active_key_id; ++ val.scact_keynumber = ep->active_key_id; + + len = sizeof(struct sctp_authkeyid); + if (put_user(len, optlen)) +@@ -5431,7 +5429,7 @@ static int sctp_getsockopt_active_key(struct sock *sk, int len, + static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len, + char __user *optval, int __user *optlen) + { +- struct net *net = sock_net(sk); ++ struct sctp_endpoint *ep = sctp_sk(sk)->ep; + struct sctp_authchunks __user *p = (void __user *)optval; + struct sctp_authchunks val; + struct sctp_association *asoc; +@@ -5439,7 +5437,7 @@ static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len, + u32 num_chunks = 0; + char __user *to; + +- if (!net->sctp.auth_enable) ++ if (!ep->auth_enable) + return -EACCES; + + if (len < sizeof(struct sctp_authchunks)) +@@ -5475,7 +5473,7 @@ num: + static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len, + char __user *optval, int __user *optlen) + { +- struct net *net = sock_net(sk); ++ struct sctp_endpoint *ep = sctp_sk(sk)->ep; + struct sctp_authchunks __user *p = (void __user *)optval; + struct sctp_authchunks val; + struct sctp_association *asoc; +@@ -5483,7 +5481,7 @@ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len, + u32 num_chunks = 0; + char __user *to; + +- if (!net->sctp.auth_enable) ++ if (!ep->auth_enable) + return -EACCES; + + if (len < sizeof(struct sctp_authchunks)) +@@ -5500,7 +5498,7 @@ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len, + if (asoc) + ch = (struct sctp_chunks_param*)asoc->c.auth_chunks; + else +- ch = sctp_sk(sk)->ep->auth_chunk_list; ++ ch = ep->auth_chunk_list; + + if (!ch) + goto num; +@@ -6582,6 +6580,46 @@ static void __sctp_write_space(struct sctp_association *asoc) + } + } + ++static void sctp_wake_up_waiters(struct sock *sk, ++ struct sctp_association *asoc) ++{ ++ struct sctp_association *tmp = asoc; ++ ++ /* We do accounting for the sndbuf space per association, ++ * so we only need to wake our own association. ++ */ ++ if (asoc->ep->sndbuf_policy) ++ return __sctp_write_space(asoc); ++ ++ /* If association goes down and is just flushing its ++ * outq, then just normally notify others. ++ */ ++ if (asoc->base.dead) ++ return sctp_write_space(sk); ++ ++ /* Accounting for the sndbuf space is per socket, so we ++ * need to wake up others, try to be fair and in case of ++ * other associations, let them have a go first instead ++ * of just doing a sctp_write_space() call. ++ * ++ * Note that we reach sctp_wake_up_waiters() only when ++ * associations free up queued chunks, thus we are under ++ * lock and the list of associations on a socket is ++ * guaranteed not to change. ++ */ ++ for (tmp = list_next_entry(tmp, asocs); 1; ++ tmp = list_next_entry(tmp, asocs)) { ++ /* Manually skip the head element. */ ++ if (&tmp->asocs == &((sctp_sk(sk))->ep->asocs)) ++ continue; ++ /* Wake up association. */ ++ __sctp_write_space(tmp); ++ /* We've reached the end. */ ++ if (tmp == asoc) ++ break; ++ } ++} ++ + /* Do accounting for the sndbuf space. + * Decrement the used sndbuf space of the corresponding association by the + * data size which was just transmitted(freed). +@@ -6609,7 +6647,7 @@ static void sctp_wfree(struct sk_buff *skb) + sk_mem_uncharge(sk, skb->truesize); + + sock_wfree(skb); +- __sctp_write_space(asoc); ++ sctp_wake_up_waiters(sk, asoc); + + sctp_association_put(asoc); + } +diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c +index bf3c6e8fc401..fe0ba7488bdf 100644 +--- a/net/sctp/sysctl.c ++++ b/net/sctp/sysctl.c +@@ -65,8 +65,11 @@ extern int sysctl_sctp_wmem[3]; + static int proc_sctp_do_hmac_alg(ctl_table *ctl, + int write, + void __user *buffer, size_t *lenp, +- + loff_t *ppos); ++static int proc_sctp_do_auth(struct ctl_table *ctl, int write, ++ void __user *buffer, size_t *lenp, ++ loff_t *ppos); ++ + static ctl_table sctp_table[] = { + { + .procname = "sctp_mem", +@@ -267,7 +270,7 @@ static ctl_table sctp_net_table[] = { + .data = &init_net.sctp.auth_enable, + .maxlen = sizeof(int), + .mode = 0644, +- .proc_handler = proc_dointvec, ++ .proc_handler = proc_sctp_do_auth, + }, + { + .procname = "addr_scope_policy", +@@ -348,6 +351,37 @@ static int proc_sctp_do_hmac_alg(ctl_table *ctl, + return ret; + } + ++static int proc_sctp_do_auth(struct ctl_table *ctl, int write, ++ void __user *buffer, size_t *lenp, ++ loff_t *ppos) ++{ ++ struct net *net = current->nsproxy->net_ns; ++ struct ctl_table tbl; ++ int new_value, ret; ++ ++ memset(&tbl, 0, sizeof(struct ctl_table)); ++ tbl.maxlen = sizeof(unsigned int); ++ ++ if (write) ++ tbl.data = &new_value; ++ else ++ tbl.data = &net->sctp.auth_enable; ++ ++ ret = proc_dointvec(&tbl, write, buffer, lenp, ppos); ++ ++ if (write) { ++ struct sock *sk = net->sctp.ctl_sock; ++ ++ net->sctp.auth_enable = new_value; ++ /* Update the value in the control socket */ ++ lock_sock(sk); ++ sctp_sk(sk)->ep->auth_enable = new_value; ++ release_sock(sk); ++ } ++ ++ return ret; ++} ++ + int sctp_sysctl_net_register(struct net *net) + { + struct ctl_table *table; +diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c +index a4be8e112bb6..a2c361c86e75 100644 +--- a/scripts/mod/modpost.c ++++ b/scripts/mod/modpost.c +@@ -573,12 +573,16 @@ static int ignore_undef_symbol(struct elf_info *info, const char *symname) + if (strncmp(symname, "_restgpr_", sizeof("_restgpr_") - 1) == 0 || + strncmp(symname, "_savegpr_", sizeof("_savegpr_") - 1) == 0 || + strncmp(symname, "_rest32gpr_", sizeof("_rest32gpr_") - 1) == 0 || +- strncmp(symname, "_save32gpr_", sizeof("_save32gpr_") - 1) == 0) ++ strncmp(symname, "_save32gpr_", sizeof("_save32gpr_") - 1) == 0 || ++ strncmp(symname, "_restvr_", sizeof("_restvr_") - 1) == 0 || ++ strncmp(symname, "_savevr_", sizeof("_savevr_") - 1) == 0) + return 1; + if (info->hdr->e_machine == EM_PPC64) + /* Special register function linked on all modules during final link of .ko */ + if (strncmp(symname, "_restgpr0_", sizeof("_restgpr0_") - 1) == 0 || +- strncmp(symname, "_savegpr0_", sizeof("_savegpr0_") - 1) == 0) ++ strncmp(symname, "_savegpr0_", sizeof("_savegpr0_") - 1) == 0 || ++ strncmp(symname, "_restvr_", sizeof("_restvr_") - 1) == 0 || ++ strncmp(symname, "_savevr_", sizeof("_savevr_") - 1) == 0) + return 1; + /* Do not ignore this symbol */ + return 0; diff --git a/projects/Cuboxi/patches/linux/linux-000-patch-3.10.41-42.patch b/projects/Cuboxi/patches/linux/linux-000-patch-3.10.41-42.patch new file mode 100644 index 0000000000..a6a5328a0e --- /dev/null +++ b/projects/Cuboxi/patches/linux/linux-000-patch-3.10.41-42.patch @@ -0,0 +1,3808 @@ +diff --git a/Documentation/i2c/busses/i2c-i801 b/Documentation/i2c/busses/i2c-i801 +index d29dea0f3232..babe2ef16139 100644 +--- a/Documentation/i2c/busses/i2c-i801 ++++ b/Documentation/i2c/busses/i2c-i801 +@@ -25,6 +25,8 @@ Supported adapters: + * Intel Avoton (SOC) + * Intel Wellsburg (PCH) + * Intel Coleto Creek (PCH) ++ * Intel Wildcat Point-LP (PCH) ++ * Intel BayTrail (SOC) + Datasheets: Publicly available at the Intel website + + On Intel Patsburg and later chipsets, both the normal host SMBus controller +diff --git a/Documentation/input/elantech.txt b/Documentation/input/elantech.txt +index 5602eb71ad5d..e1ae127ed099 100644 +--- a/Documentation/input/elantech.txt ++++ b/Documentation/input/elantech.txt +@@ -504,9 +504,12 @@ byte 5: + * reg_10 + + bit 7 6 5 4 3 2 1 0 +- 0 0 0 0 0 0 0 A ++ 0 0 0 0 R F T A + + A: 1 = enable absolute tracking ++ T: 1 = enable two finger mode auto correct ++ F: 1 = disable ABS Position Filter ++ R: 1 = enable real hardware resolution + + 6.2 Native absolute mode 6 byte packet format + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +diff --git a/Documentation/ja_JP/HOWTO b/Documentation/ja_JP/HOWTO +index 050d37fe6d40..46ed73593465 100644 +--- a/Documentation/ja_JP/HOWTO ++++ b/Documentation/ja_JP/HOWTO +@@ -315,7 +315,7 @@ Andrew Morton が Linux-kernel メーリングリストにカーネルリリー + もし、2.6.x.y カーネルが存在しない場合には、番号が一番大きい 2.6.x が + 最新の安定版カーネルです。 + +-2.6.x.y は "stable" チーム でメンテされており、必 ++2.6.x.y は "stable" チーム でメンテされており、必 + 要に応じてリリースされます。通常のリリース期間は 2週間毎ですが、差し迫っ + た問題がなければもう少し長くなることもあります。セキュリティ関連の問題 + の場合はこれに対してだいたいの場合、すぐにリリースがされます。 +diff --git a/Documentation/ja_JP/stable_kernel_rules.txt b/Documentation/ja_JP/stable_kernel_rules.txt +index 14265837c4ce..9dbda9b5d21e 100644 +--- a/Documentation/ja_JP/stable_kernel_rules.txt ++++ b/Documentation/ja_JP/stable_kernel_rules.txt +@@ -50,16 +50,16 @@ linux-2.6.29/Documentation/stable_kernel_rules.txt + + -stable ツリーにパッチを送付する手続き- + +- - 上記の規則に従っているかを確認した後に、stable@kernel.org にパッチ ++ - 上記の規則に従っているかを確認した後に、stable@vger.kernel.org にパッチ + を送る。 + - 送信者はパッチがキューに受け付けられた際には ACK を、却下された場合 + には NAK を受け取る。この反応は開発者たちのスケジュールによって、数 + 日かかる場合がある。 + - もし受け取られたら、パッチは他の開発者たちと関連するサブシステムの + メンテナーによるレビューのために -stable キューに追加される。 +- - パッチに stable@kernel.org のアドレスが付加されているときには、それ ++ - パッチに stable@vger.kernel.org のアドレスが付加されているときには、それ + が Linus のツリーに入る時に自動的に stable チームに email される。 +- - セキュリティパッチはこのエイリアス (stable@kernel.org) に送られるべ ++ - セキュリティパッチはこのエイリアス (stable@vger.kernel.org) に送られるべ + きではなく、代わりに security@kernel.org のアドレスに送られる。 + + レビューサイクル- +diff --git a/Documentation/zh_CN/HOWTO b/Documentation/zh_CN/HOWTO +index 7fba5aab9ef9..7599eb38b764 100644 +--- a/Documentation/zh_CN/HOWTO ++++ b/Documentation/zh_CN/HOWTO +@@ -237,7 +237,7 @@ kernel.org网站的pub/linux/kernel/v2.6/目录下找到它。它的开发遵循 + 如果没有2.6.x.y版本内核存在，那么最新的2.6.x版本内核就相当于是当前的稳定 + 版内核。 + +-2.6.x.y版本由“稳定版”小组（邮件地址）维护，一般隔周发 ++2.6.x.y版本由“稳定版”小组（邮件地址）维护，一般隔周发 + 布新版本。 + + 内核源码中的Documentation/stable_kernel_rules.txt文件具体描述了可被稳定 +diff --git a/Documentation/zh_CN/stable_kernel_rules.txt b/Documentation/zh_CN/stable_kernel_rules.txt +index b5b9b0ab02fd..26ea5ed7cd9c 100644 +--- a/Documentation/zh_CN/stable_kernel_rules.txt ++++ b/Documentation/zh_CN/stable_kernel_rules.txt +@@ -42,7 +42,7 @@ Documentation/stable_kernel_rules.txt 的中文翻译 + + 向稳定版代码树提交补丁的过程： + +- - 在确认了补丁符合以上的规则后，将补丁发送到stable@kernel.org。 ++ - 在确认了补丁符合以上的规则后，将补丁发送到stable@vger.kernel.org。 + - 如果补丁被接受到队列里，发送者会收到一个ACK回复，如果没有被接受，收 + 到的是NAK回复。回复需要几天的时间，这取决于开发者的时间安排。 + - 被接受的补丁会被加到稳定版本队列里，等待其他开发者的审查。 +diff --git a/Makefile b/Makefile +index 370cc01afb07..4634015fed68 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 10 +-SUBLEVEL = 41 ++SUBLEVEL = 42 + EXTRAVERSION = + NAME = TOSSUG Baby Fish + +diff --git a/arch/arm/boot/dts/imx53.dtsi b/arch/arm/boot/dts/imx53.dtsi +index eb83aa039b8b..e524316998f4 100644 +--- a/arch/arm/boot/dts/imx53.dtsi ++++ b/arch/arm/boot/dts/imx53.dtsi +@@ -71,7 +71,7 @@ + ipu: ipu@18000000 { + #crtc-cells = <1>; + compatible = "fsl,imx53-ipu"; +- reg = <0x18000000 0x080000000>; ++ reg = <0x18000000 0x08000000>; + interrupts = <11 10>; + clocks = <&clks 59>, <&clks 110>, <&clks 61>; + clock-names = "bus", "di0", "di1"; +diff --git a/arch/arm/kernel/crash_dump.c b/arch/arm/kernel/crash_dump.c +index 90c50d4b43f7..5d1286d51154 100644 +--- a/arch/arm/kernel/crash_dump.c ++++ b/arch/arm/kernel/crash_dump.c +@@ -39,7 +39,7 @@ ssize_t copy_oldmem_page(unsigned long pfn, char *buf, + if (!csize) + return 0; + +- vaddr = ioremap(pfn << PAGE_SHIFT, PAGE_SIZE); ++ vaddr = ioremap(__pfn_to_phys(pfn), PAGE_SIZE); + if (!vaddr) + return -ENOMEM; + +diff --git a/arch/metag/include/asm/barrier.h b/arch/metag/include/asm/barrier.h +index c90bfc6bf648..e355a4c10968 100644 +--- a/arch/metag/include/asm/barrier.h ++++ b/arch/metag/include/asm/barrier.h +@@ -15,6 +15,7 @@ static inline void wr_fence(void) + volatile int *flushptr = (volatile int *) LINSYSEVENT_WR_FENCE; + barrier(); + *flushptr = 0; ++ barrier(); + } + + #else /* CONFIG_METAG_META21 */ +@@ -35,6 +36,7 @@ static inline void wr_fence(void) + *flushptr = 0; + *flushptr = 0; + *flushptr = 0; ++ barrier(); + } + + #endif /* !CONFIG_METAG_META21 */ +@@ -68,6 +70,7 @@ static inline void fence(void) + volatile int *flushptr = (volatile int *) LINSYSEVENT_WR_ATOMIC_UNLOCK; + barrier(); + *flushptr = 0; ++ barrier(); + } + #define smp_mb() fence() + #define smp_rmb() fence() +diff --git a/arch/metag/include/asm/processor.h b/arch/metag/include/asm/processor.h +index 9b029a7911c3..579e3d93a5ca 100644 +--- a/arch/metag/include/asm/processor.h ++++ b/arch/metag/include/asm/processor.h +@@ -22,6 +22,8 @@ + /* Add an extra page of padding at the top of the stack for the guard page. */ + #define STACK_TOP (TASK_SIZE - PAGE_SIZE) + #define STACK_TOP_MAX STACK_TOP ++/* Maximum virtual space for stack */ ++#define STACK_SIZE_MAX (1 << 28) /* 256 MB */ + + /* This decides where the kernel will search for a free chunk of vm + * space during mmap's. +diff --git a/arch/mips/cavium-octeon/octeon-irq.c b/arch/mips/cavium-octeon/octeon-irq.c +index a22f06a6f7ca..45c1a6caa206 100644 +--- a/arch/mips/cavium-octeon/octeon-irq.c ++++ b/arch/mips/cavium-octeon/octeon-irq.c +@@ -635,7 +635,7 @@ static void octeon_irq_cpu_offline_ciu(struct irq_data *data) + cpumask_clear(&new_affinity); + cpumask_set_cpu(cpumask_first(cpu_online_mask), &new_affinity); + } +- __irq_set_affinity_locked(data, &new_affinity); ++ irq_set_affinity_locked(data, &new_affinity, false); + } + + static int octeon_irq_ciu_set_affinity(struct irq_data *data, +diff --git a/arch/mips/lantiq/dts/easy50712.dts b/arch/mips/lantiq/dts/easy50712.dts +index fac1f5b178eb..143b8a37b5e4 100644 +--- a/arch/mips/lantiq/dts/easy50712.dts ++++ b/arch/mips/lantiq/dts/easy50712.dts +@@ -8,6 +8,7 @@ + }; + + memory@0 { ++ device_type = "memory"; + reg = <0x0 0x2000000>; + }; + +diff --git a/arch/mips/ralink/dts/mt7620a_eval.dts b/arch/mips/ralink/dts/mt7620a_eval.dts +index 35eb874ab7f1..709f58132f5c 100644 +--- a/arch/mips/ralink/dts/mt7620a_eval.dts ++++ b/arch/mips/ralink/dts/mt7620a_eval.dts +@@ -7,6 +7,7 @@ + model = "Ralink MT7620A evaluation board"; + + memory@0 { ++ device_type = "memory"; + reg = <0x0 0x2000000>; + }; + +diff --git a/arch/mips/ralink/dts/rt2880_eval.dts b/arch/mips/ralink/dts/rt2880_eval.dts +index 322d7002595b..0a685db093d4 100644 +--- a/arch/mips/ralink/dts/rt2880_eval.dts ++++ b/arch/mips/ralink/dts/rt2880_eval.dts +@@ -7,6 +7,7 @@ + model = "Ralink RT2880 evaluation board"; + + memory@0 { ++ device_type = "memory"; + reg = <0x8000000 0x2000000>; + }; + +diff --git a/arch/mips/ralink/dts/rt3052_eval.dts b/arch/mips/ralink/dts/rt3052_eval.dts +index 0ac73ea28198..ec9e9a035541 100644 +--- a/arch/mips/ralink/dts/rt3052_eval.dts ++++ b/arch/mips/ralink/dts/rt3052_eval.dts +@@ -7,6 +7,7 @@ + model = "Ralink RT3052 evaluation board"; + + memory@0 { ++ device_type = "memory"; + reg = <0x0 0x2000000>; + }; + +diff --git a/arch/mips/ralink/dts/rt3883_eval.dts b/arch/mips/ralink/dts/rt3883_eval.dts +index 2fa6b330bf4f..e8df21a5d10d 100644 +--- a/arch/mips/ralink/dts/rt3883_eval.dts ++++ b/arch/mips/ralink/dts/rt3883_eval.dts +@@ -7,6 +7,7 @@ + model = "Ralink RT3883 evaluation board"; + + memory@0 { ++ device_type = "memory"; + reg = <0x0 0x2000000>; + }; + +diff --git a/arch/parisc/include/asm/processor.h b/arch/parisc/include/asm/processor.h +index cc2290a3cace..c6ee86542fec 100644 +--- a/arch/parisc/include/asm/processor.h ++++ b/arch/parisc/include/asm/processor.h +@@ -53,6 +53,8 @@ + #define STACK_TOP TASK_SIZE + #define STACK_TOP_MAX DEFAULT_TASK_SIZE + ++#define STACK_SIZE_MAX (1 << 30) /* 1 GB */ ++ + #endif + + #ifndef __ASSEMBLY__ +diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile +index 967fd23ace78..56a4a5d205af 100644 +--- a/arch/powerpc/Makefile ++++ b/arch/powerpc/Makefile +@@ -97,7 +97,9 @@ CFLAGS-$(CONFIG_POWER7_CPU) += $(call cc-option,-mcpu=power7) + + CFLAGS-$(CONFIG_TUNE_CELL) += $(call cc-option,-mtune=cell) + +-KBUILD_CPPFLAGS += -Iarch/$(ARCH) ++asinstr := $(call as-instr,lis 9$(comma)foo@high,-DHAVE_AS_ATHIGH=1) ++ ++KBUILD_CPPFLAGS += -Iarch/$(ARCH) $(asinstr) + KBUILD_AFLAGS += -Iarch/$(ARCH) + KBUILD_CFLAGS += -msoft-float -pipe -Iarch/$(ARCH) $(CFLAGS-y) + CPP = $(CC) -E $(KBUILD_CFLAGS) +diff --git a/arch/powerpc/include/asm/ppc_asm.h b/arch/powerpc/include/asm/ppc_asm.h +index 2f1b6c5f8174..22cee04a47fc 100644 +--- a/arch/powerpc/include/asm/ppc_asm.h ++++ b/arch/powerpc/include/asm/ppc_asm.h +@@ -390,11 +390,16 @@ n: + * ld rY,ADDROFF(name)(rX) + */ + #ifdef __powerpc64__ ++#ifdef HAVE_AS_ATHIGH ++#define __AS_ATHIGH high ++#else ++#define __AS_ATHIGH h ++#endif + #define LOAD_REG_IMMEDIATE(reg,expr) \ + lis reg,(expr)@highest; \ + ori reg,reg,(expr)@higher; \ + rldicr reg,reg,32,31; \ +- oris reg,reg,(expr)@h; \ ++ oris reg,reg,(expr)@__AS_ATHIGH; \ + ori reg,reg,(expr)@l; + + #define LOAD_REG_ADDR(reg,name) \ +diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c +index 1e1c995ddacc..d55357ee9028 100644 +--- a/arch/powerpc/kernel/process.c ++++ b/arch/powerpc/kernel/process.c +@@ -948,6 +948,16 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src) + flush_altivec_to_thread(src); + flush_vsx_to_thread(src); + flush_spe_to_thread(src); ++ /* ++ * Flush TM state out so we can copy it. __switch_to_tm() does this ++ * flush but it removes the checkpointed state from the current CPU and ++ * transitions the CPU out of TM mode. Hence we need to call ++ * tm_recheckpoint_new_task() (on the same task) to restore the ++ * checkpointed state back and the TM mode. ++ */ ++ __switch_to_tm(src); ++ tm_recheckpoint_new_task(src); ++ + *dst = *src; + return 0; + } +diff --git a/arch/s390/crypto/aes_s390.c b/arch/s390/crypto/aes_s390.c +index 2a245b55bb71..fd104db9cea1 100644 +--- a/arch/s390/crypto/aes_s390.c ++++ b/arch/s390/crypto/aes_s390.c +@@ -818,6 +818,9 @@ static int ctr_aes_crypt(struct blkcipher_desc *desc, long func, + else + memcpy(walk->iv, ctrptr, AES_BLOCK_SIZE); + spin_unlock(&ctrblk_lock); ++ } else { ++ if (!nbytes) ++ memcpy(walk->iv, ctrptr, AES_BLOCK_SIZE); + } + /* + * final block may be < AES_BLOCK_SIZE, copy only nbytes +diff --git a/arch/s390/crypto/des_s390.c b/arch/s390/crypto/des_s390.c +index 2d96e68febb2..f2d6cccddcf8 100644 +--- a/arch/s390/crypto/des_s390.c ++++ b/arch/s390/crypto/des_s390.c +@@ -429,6 +429,9 @@ static int ctr_desall_crypt(struct blkcipher_desc *desc, long func, + else + memcpy(walk->iv, ctrptr, DES_BLOCK_SIZE); + spin_unlock(&ctrblk_lock); ++ } else { ++ if (!nbytes) ++ memcpy(walk->iv, ctrptr, DES_BLOCK_SIZE); + } + /* final block may be < DES_BLOCK_SIZE, copy only nbytes */ + if (nbytes) { +diff --git a/arch/x86/include/asm/hugetlb.h b/arch/x86/include/asm/hugetlb.h +index a8091216963b..68c05398bba9 100644 +--- a/arch/x86/include/asm/hugetlb.h ++++ b/arch/x86/include/asm/hugetlb.h +@@ -52,6 +52,7 @@ static inline pte_t huge_ptep_get_and_clear(struct mm_struct *mm, + static inline void huge_ptep_clear_flush(struct vm_area_struct *vma, + unsigned long addr, pte_t *ptep) + { ++ ptep_clear_flush(vma, addr, ptep); + } + + static inline int huge_pte_none(pte_t pte) +diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c +index af1d14a9ebda..dcbbaa165bde 100644 +--- a/arch/x86/kernel/ldt.c ++++ b/arch/x86/kernel/ldt.c +@@ -20,6 +20,8 @@ + #include + #include + ++int sysctl_ldt16 = 0; ++ + #ifdef CONFIG_SMP + static void flush_ldt(void *current_mm) + { +@@ -234,7 +236,7 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode) + * IRET leaking the high bits of the kernel stack address. + */ + #ifdef CONFIG_X86_64 +- if (!ldt_info.seg_32bit) { ++ if (!ldt_info.seg_32bit && !sysctl_ldt16) { + error = -EINVAL; + goto out_unlock; + } +diff --git a/arch/x86/vdso/vdso32-setup.c b/arch/x86/vdso/vdso32-setup.c +index 0faad646f5fd..0f134c7cfc24 100644 +--- a/arch/x86/vdso/vdso32-setup.c ++++ b/arch/x86/vdso/vdso32-setup.c +@@ -41,6 +41,7 @@ enum { + #ifdef CONFIG_X86_64 + #define vdso_enabled sysctl_vsyscall32 + #define arch_setup_additional_pages syscall32_setup_pages ++extern int sysctl_ldt16; + #endif + + /* +@@ -380,6 +381,13 @@ static ctl_table abi_table2[] = { + .mode = 0644, + .proc_handler = proc_dointvec + }, ++ { ++ .procname = "ldt16", ++ .data = &sysctl_ldt16, ++ .maxlen = sizeof(int), ++ .mode = 0644, ++ .proc_handler = proc_dointvec ++ }, + {} + }; + +diff --git a/crypto/crypto_wq.c b/crypto/crypto_wq.c +index adad92a44ba2..2f1b8d12952a 100644 +--- a/crypto/crypto_wq.c ++++ b/crypto/crypto_wq.c +@@ -33,7 +33,7 @@ static void __exit crypto_wq_exit(void) + destroy_workqueue(kcrypto_wq); + } + +-module_init(crypto_wq_init); ++subsys_initcall(crypto_wq_init); + module_exit(crypto_wq_exit); + + MODULE_LICENSE("GPL"); +diff --git a/drivers/acpi/blacklist.c b/drivers/acpi/blacklist.c +index cb9629638def..76da257cfc28 100644 +--- a/drivers/acpi/blacklist.c ++++ b/drivers/acpi/blacklist.c +@@ -327,6 +327,19 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = { + DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T500"), + }, + }, ++ /* ++ * Without this this EEEpc exports a non working WMI interface, with ++ * this it exports a working "good old" eeepc_laptop interface, fixing ++ * both brightness control, and rfkill not working. ++ */ ++ { ++ .callback = dmi_enable_osi_linux, ++ .ident = "Asus EEE PC 1015PX", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "1015PX"), ++ }, ++ }, + {} + }; + +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index 9cf616b5210b..bf00fbcde8ad 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -6300,6 +6300,8 @@ int ata_host_activate(struct ata_host *host, int irq, + static void ata_port_detach(struct ata_port *ap) + { + unsigned long flags; ++ struct ata_link *link; ++ struct ata_device *dev; + + if (!ap->ops->error_handler) + goto skip_eh; +@@ -6319,6 +6321,13 @@ static void ata_port_detach(struct ata_port *ap) + cancel_delayed_work_sync(&ap->hotplug_task); + + skip_eh: ++ /* clean up zpodd on port removal */ ++ ata_for_each_link(link, ap, HOST_FIRST) { ++ ata_for_each_dev(dev, link, ALL) { ++ if (zpodd_dev_enabled(dev)) ++ zpodd_exit(dev); ++ } ++ } + if (ap->pmp_link) { + int i; + for (i = 0; i < SATA_PMP_MAX_PORTS; i++) +diff --git a/drivers/ata/pata_at91.c b/drivers/ata/pata_at91.c +index 033f3f4c20ad..fa288597f01b 100644 +--- a/drivers/ata/pata_at91.c ++++ b/drivers/ata/pata_at91.c +@@ -408,12 +408,13 @@ static int pata_at91_probe(struct platform_device *pdev) + + host->private_data = info; + +- return ata_host_activate(host, gpio_is_valid(irq) ? gpio_to_irq(irq) : 0, +- gpio_is_valid(irq) ? ata_sff_interrupt : NULL, +- irq_flags, &pata_at91_sht); ++ ret = ata_host_activate(host, gpio_is_valid(irq) ? gpio_to_irq(irq) : 0, ++ gpio_is_valid(irq) ? ata_sff_interrupt : NULL, ++ irq_flags, &pata_at91_sht); ++ if (ret) ++ goto err_put; + +- if (!ret) +- return 0; ++ return 0; + + err_put: + clk_put(info->mck); +diff --git a/drivers/base/dd.c b/drivers/base/dd.c +index 06051767393f..8a8d611f2021 100644 +--- a/drivers/base/dd.c ++++ b/drivers/base/dd.c +@@ -52,6 +52,7 @@ static DEFINE_MUTEX(deferred_probe_mutex); + static LIST_HEAD(deferred_probe_pending_list); + static LIST_HEAD(deferred_probe_active_list); + static struct workqueue_struct *deferred_wq; ++static atomic_t deferred_trigger_count = ATOMIC_INIT(0); + + /** + * deferred_probe_work_func() - Retry probing devices in the active list. +@@ -135,6 +136,17 @@ static bool driver_deferred_probe_enable = false; + * This functions moves all devices from the pending list to the active + * list and schedules the deferred probe workqueue to process them. It + * should be called anytime a driver is successfully bound to a device. ++ * ++ * Note, there is a race condition in multi-threaded probe. In the case where ++ * more than one device is probing at the same time, it is possible for one ++ * probe to complete successfully while another is about to defer. If the second ++ * depends on the first, then it will get put on the pending list after the ++ * trigger event has already occured and will be stuck there. ++ * ++ * The atomic 'deferred_trigger_count' is used to determine if a successful ++ * trigger has occurred in the midst of probing a driver. If the trigger count ++ * changes in the midst of a probe, then deferred processing should be triggered ++ * again. + */ + static void driver_deferred_probe_trigger(void) + { +@@ -147,6 +159,7 @@ static void driver_deferred_probe_trigger(void) + * into the active list so they can be retried by the workqueue + */ + mutex_lock(&deferred_probe_mutex); ++ atomic_inc(&deferred_trigger_count); + list_splice_tail_init(&deferred_probe_pending_list, + &deferred_probe_active_list); + mutex_unlock(&deferred_probe_mutex); +@@ -265,6 +278,7 @@ static DECLARE_WAIT_QUEUE_HEAD(probe_waitqueue); + static int really_probe(struct device *dev, struct device_driver *drv) + { + int ret = 0; ++ int local_trigger_count = atomic_read(&deferred_trigger_count); + + atomic_inc(&probe_count); + pr_debug("bus: '%s': %s: probing driver %s with device %s\n", +@@ -310,6 +324,9 @@ probe_failed: + /* Driver requested deferred probing */ + dev_info(dev, "Driver %s requests probe deferral\n", drv->name); + driver_deferred_probe_add(dev); ++ /* Did a trigger occur while probing? Need to re-trigger if yes */ ++ if (local_trigger_count != atomic_read(&deferred_trigger_count)) ++ driver_deferred_probe_trigger(); + } else if (ret != -ENODEV && ret != -ENXIO) { + /* driver matched but the probe failed */ + printk(KERN_WARNING +diff --git a/drivers/base/topology.c b/drivers/base/topology.c +index ae989c57cd5e..bcd19886fa1a 100644 +--- a/drivers/base/topology.c ++++ b/drivers/base/topology.c +@@ -40,8 +40,7 @@ + static ssize_t show_##name(struct device *dev, \ + struct device_attribute *attr, char *buf) \ + { \ +- unsigned int cpu = dev->id; \ +- return sprintf(buf, "%d\n", topology_##name(cpu)); \ ++ return sprintf(buf, "%d\n", topology_##name(dev->id)); \ + } + + #if defined(topology_thread_cpumask) || defined(topology_core_cpumask) || \ +diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c +index 1735b0d17e29..ddd9a098bc67 100644 +--- a/drivers/block/xen-blkfront.c ++++ b/drivers/block/xen-blkfront.c +@@ -104,7 +104,7 @@ struct blkfront_info + struct work_struct work; + struct gnttab_free_callback callback; + struct blk_shadow shadow[BLK_RING_SIZE]; +- struct list_head persistent_gnts; ++ struct list_head grants; + unsigned int persistent_gnts_c; + unsigned long shadow_free; + unsigned int feature_flush; +@@ -175,15 +175,17 @@ static int fill_grant_buffer(struct blkfront_info *info, int num) + if (!gnt_list_entry) + goto out_of_memory; + +- granted_page = alloc_page(GFP_NOIO); +- if (!granted_page) { +- kfree(gnt_list_entry); +- goto out_of_memory; ++ if (info->feature_persistent) { ++ granted_page = alloc_page(GFP_NOIO); ++ if (!granted_page) { ++ kfree(gnt_list_entry); ++ goto out_of_memory; ++ } ++ gnt_list_entry->pfn = page_to_pfn(granted_page); + } + +- gnt_list_entry->pfn = page_to_pfn(granted_page); + gnt_list_entry->gref = GRANT_INVALID_REF; +- list_add(&gnt_list_entry->node, &info->persistent_gnts); ++ list_add(&gnt_list_entry->node, &info->grants); + i++; + } + +@@ -191,9 +193,10 @@ static int fill_grant_buffer(struct blkfront_info *info, int num) + + out_of_memory: + list_for_each_entry_safe(gnt_list_entry, n, +- &info->persistent_gnts, node) { ++ &info->grants, node) { + list_del(&gnt_list_entry->node); +- __free_page(pfn_to_page(gnt_list_entry->pfn)); ++ if (info->feature_persistent) ++ __free_page(pfn_to_page(gnt_list_entry->pfn)); + kfree(gnt_list_entry); + i--; + } +@@ -202,14 +205,14 @@ out_of_memory: + } + + static struct grant *get_grant(grant_ref_t *gref_head, ++ unsigned long pfn, + struct blkfront_info *info) + { + struct grant *gnt_list_entry; + unsigned long buffer_mfn; + +- BUG_ON(list_empty(&info->persistent_gnts)); +- gnt_list_entry = list_first_entry(&info->persistent_gnts, struct grant, +- node); ++ BUG_ON(list_empty(&info->grants)); ++ gnt_list_entry = list_first_entry(&info->grants, struct grant, node); + list_del(&gnt_list_entry->node); + + if (gnt_list_entry->gref != GRANT_INVALID_REF) { +@@ -220,6 +223,10 @@ static struct grant *get_grant(grant_ref_t *gref_head, + /* Assign a gref to this page */ + gnt_list_entry->gref = gnttab_claim_grant_reference(gref_head); + BUG_ON(gnt_list_entry->gref == -ENOSPC); ++ if (!info->feature_persistent) { ++ BUG_ON(!pfn); ++ gnt_list_entry->pfn = pfn; ++ } + buffer_mfn = pfn_to_mfn(gnt_list_entry->pfn); + gnttab_grant_foreign_access_ref(gnt_list_entry->gref, + info->xbdev->otherend_id, +@@ -430,12 +437,12 @@ static int blkif_queue_request(struct request *req) + fsect = sg->offset >> 9; + lsect = fsect + (sg->length >> 9) - 1; + +- gnt_list_entry = get_grant(&gref_head, info); ++ gnt_list_entry = get_grant(&gref_head, page_to_pfn(sg_page(sg)), info); + ref = gnt_list_entry->gref; + + info->shadow[id].grants_used[i] = gnt_list_entry; + +- if (rq_data_dir(req)) { ++ if (rq_data_dir(req) && info->feature_persistent) { + char *bvec_data; + void *shared_data; + +@@ -828,16 +835,17 @@ static void blkif_free(struct blkfront_info *info, int suspend) + blk_stop_queue(info->rq); + + /* Remove all persistent grants */ +- if (!list_empty(&info->persistent_gnts)) { ++ if (!list_empty(&info->grants)) { + list_for_each_entry_safe(persistent_gnt, n, +- &info->persistent_gnts, node) { ++ &info->grants, node) { + list_del(&persistent_gnt->node); + if (persistent_gnt->gref != GRANT_INVALID_REF) { + gnttab_end_foreign_access(persistent_gnt->gref, + 0, 0UL); + info->persistent_gnts_c--; + } +- __free_page(pfn_to_page(persistent_gnt->pfn)); ++ if (info->feature_persistent) ++ __free_page(pfn_to_page(persistent_gnt->pfn)); + kfree(persistent_gnt); + } + } +@@ -874,7 +882,7 @@ static void blkif_completion(struct blk_shadow *s, struct blkfront_info *info, + + nseg = s->req.u.rw.nr_segments; + +- if (bret->operation == BLKIF_OP_READ) { ++ if (bret->operation == BLKIF_OP_READ && info->feature_persistent) { + /* + * Copy the data received from the backend into the bvec. + * Since bv_offset can be different than 0, and bv_len different +@@ -894,9 +902,30 @@ static void blkif_completion(struct blk_shadow *s, struct blkfront_info *info, + } + } + /* Add the persistent grant into the list of free grants */ +- for (i = 0; i < s->req.u.rw.nr_segments; i++) { +- list_add(&s->grants_used[i]->node, &info->persistent_gnts); +- info->persistent_gnts_c++; ++ for (i = 0; i < nseg; i++) { ++ if (gnttab_query_foreign_access(s->grants_used[i]->gref)) { ++ /* ++ * If the grant is still mapped by the backend (the ++ * backend has chosen to make this grant persistent) ++ * we add it at the head of the list, so it will be ++ * reused first. ++ */ ++ if (!info->feature_persistent) ++ pr_alert_ratelimited("backed has not unmapped grant: %u\n", ++ s->grants_used[i]->gref); ++ list_add(&s->grants_used[i]->node, &info->grants); ++ info->persistent_gnts_c++; ++ } else { ++ /* ++ * If the grant is not mapped by the backend we end the ++ * foreign access and add it to the tail of the list, ++ * so it will not be picked again unless we run out of ++ * persistent grants. ++ */ ++ gnttab_end_foreign_access(s->grants_used[i]->gref, 0, 0UL); ++ s->grants_used[i]->gref = GRANT_INVALID_REF; ++ list_add_tail(&s->grants_used[i]->node, &info->grants); ++ } + } + } + +@@ -1034,12 +1063,6 @@ static int setup_blkring(struct xenbus_device *dev, + for (i = 0; i < BLK_RING_SIZE; i++) + sg_init_table(info->shadow[i].sg, BLKIF_MAX_SEGMENTS_PER_REQUEST); + +- /* Allocate memory for grants */ +- err = fill_grant_buffer(info, BLK_RING_SIZE * +- BLKIF_MAX_SEGMENTS_PER_REQUEST); +- if (err) +- goto fail; +- + err = xenbus_grant_ring(dev, virt_to_mfn(info->ring.sring)); + if (err < 0) { + free_page((unsigned long)sring); +@@ -1198,7 +1221,7 @@ static int blkfront_probe(struct xenbus_device *dev, + spin_lock_init(&info->io_lock); + info->xbdev = dev; + info->vdevice = vdevice; +- INIT_LIST_HEAD(&info->persistent_gnts); ++ INIT_LIST_HEAD(&info->grants); + info->persistent_gnts_c = 0; + info->connected = BLKIF_STATE_DISCONNECTED; + INIT_WORK(&info->work, blkif_restart_queue); +@@ -1227,7 +1250,8 @@ static int blkif_recover(struct blkfront_info *info) + int i; + struct blkif_request *req; + struct blk_shadow *copy; +- int j; ++ unsigned int persistent; ++ int j, rc; + + /* Stage 1: Make a safe copy of the shadow state. */ + copy = kmemdup(info->shadow, sizeof(info->shadow), +@@ -1242,6 +1266,24 @@ static int blkif_recover(struct blkfront_info *info) + info->shadow_free = info->ring.req_prod_pvt; + info->shadow[BLK_RING_SIZE-1].req.u.rw.id = 0x0fffffff; + ++ /* Check if the backend supports persistent grants */ ++ rc = xenbus_gather(XBT_NIL, info->xbdev->otherend, ++ "feature-persistent", "%u", &persistent, ++ NULL); ++ if (rc) ++ info->feature_persistent = 0; ++ else ++ info->feature_persistent = persistent; ++ ++ /* Allocate memory for grants */ ++ rc = fill_grant_buffer(info, BLK_RING_SIZE * ++ BLKIF_MAX_SEGMENTS_PER_REQUEST); ++ if (rc) { ++ xenbus_dev_fatal(info->xbdev, rc, "setting grant buffer failed"); ++ kfree(copy); ++ return rc; ++ } ++ + /* Stage 3: Find pending requests and requeue them. */ + for (i = 0; i < BLK_RING_SIZE; i++) { + /* Not in use? */ +@@ -1306,8 +1348,12 @@ static int blkfront_resume(struct xenbus_device *dev) + blkif_free(info, info->connected == BLKIF_STATE_CONNECTED); + + err = talk_to_blkback(dev, info); +- if (info->connected == BLKIF_STATE_SUSPENDED && !err) +- err = blkif_recover(info); ++ ++ /* ++ * We have to wait for the backend to switch to ++ * connected state, since we want to read which ++ * features it supports. ++ */ + + return err; + } +@@ -1411,9 +1457,16 @@ static void blkfront_connect(struct blkfront_info *info) + sectors); + set_capacity(info->gd, sectors); + revalidate_disk(info->gd); ++ return; + +- /* fall through */ + case BLKIF_STATE_SUSPENDED: ++ /* ++ * If we are recovering from suspension, we need to wait ++ * for the backend to announce it's features before ++ * reconnecting, we need to know if the backend supports ++ * persistent grants. ++ */ ++ blkif_recover(info); + return; + + default: +@@ -1481,6 +1534,14 @@ static void blkfront_connect(struct blkfront_info *info) + else + info->feature_persistent = persistent; + ++ /* Allocate memory for grants */ ++ err = fill_grant_buffer(info, BLK_RING_SIZE * ++ BLKIF_MAX_SEGMENTS_PER_REQUEST); ++ if (err) { ++ xenbus_dev_fatal(info->xbdev, err, "setting grant buffer failed"); ++ return; ++ } ++ + err = xlvbd_alloc_gendisk(sectors, info, binfo, sector_size); + if (err) { + xenbus_dev_fatal(info->xbdev, err, "xlvbd_add at %s", +diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c +index 0a327f4154a2..2acabdaecec8 100644 +--- a/drivers/bluetooth/ath3k.c ++++ b/drivers/bluetooth/ath3k.c +@@ -82,6 +82,7 @@ static struct usb_device_id ath3k_table[] = { + { USB_DEVICE(0x04CA, 0x3004) }, + { USB_DEVICE(0x04CA, 0x3005) }, + { USB_DEVICE(0x04CA, 0x3006) }, ++ { USB_DEVICE(0x04CA, 0x3007) }, + { USB_DEVICE(0x04CA, 0x3008) }, + { USB_DEVICE(0x13d3, 0x3362) }, + { USB_DEVICE(0x0CF3, 0xE004) }, +@@ -124,6 +125,7 @@ static struct usb_device_id ath3k_blist_tbl[] = { + { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 }, +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 58491f1b2799..45aa8e760124 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -146,6 +146,7 @@ static struct usb_device_id blacklist_table[] = { + { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 }, +diff --git a/drivers/bus/mvebu-mbus.c b/drivers/bus/mvebu-mbus.c +index 8740f46b4d0d..5dcc8305abd1 100644 +--- a/drivers/bus/mvebu-mbus.c ++++ b/drivers/bus/mvebu-mbus.c +@@ -250,12 +250,6 @@ static int mvebu_mbus_window_conflicts(struct mvebu_mbus_state *mbus, + */ + if ((u64)base < wend && end > wbase) + return 0; +- +- /* +- * Check if target/attribute conflicts +- */ +- if (target == wtarget && attr == wattr) +- return 0; + } + + return 1; +diff --git a/drivers/char/ipmi/ipmi_kcs_sm.c b/drivers/char/ipmi/ipmi_kcs_sm.c +index e53fc24c6af3..e1ddcf938519 100644 +--- a/drivers/char/ipmi/ipmi_kcs_sm.c ++++ b/drivers/char/ipmi/ipmi_kcs_sm.c +@@ -251,8 +251,9 @@ static inline int check_obf(struct si_sm_data *kcs, unsigned char status, + if (!GET_STATUS_OBF(status)) { + kcs->obf_timeout -= time; + if (kcs->obf_timeout < 0) { +- start_error_recovery(kcs, "OBF not ready in time"); +- return 1; ++ kcs->obf_timeout = OBF_RETRY_TIMEOUT; ++ start_error_recovery(kcs, "OBF not ready in time"); ++ return 1; + } + return 0; + } +diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c +index af4b23ffc5a6..40b3f756f904 100644 +--- a/drivers/char/ipmi/ipmi_si_intf.c ++++ b/drivers/char/ipmi/ipmi_si_intf.c +@@ -244,6 +244,9 @@ struct smi_info { + /* The timer for this si. */ + struct timer_list si_timer; + ++ /* This flag is set, if the timer is running (timer_pending() isn't enough) */ ++ bool timer_running; ++ + /* The time (in jiffies) the last timeout occurred at. */ + unsigned long last_timeout_jiffies; + +@@ -427,6 +430,13 @@ static void start_clear_flags(struct smi_info *smi_info) + smi_info->si_state = SI_CLEARING_FLAGS; + } + ++static void smi_mod_timer(struct smi_info *smi_info, unsigned long new_val) ++{ ++ smi_info->last_timeout_jiffies = jiffies; ++ mod_timer(&smi_info->si_timer, new_val); ++ smi_info->timer_running = true; ++} ++ + /* + * When we have a situtaion where we run out of memory and cannot + * allocate messages, we just leave them in the BMC and run the system +@@ -439,8 +449,7 @@ static inline void disable_si_irq(struct smi_info *smi_info) + start_disable_irq(smi_info); + smi_info->interrupt_disabled = 1; + if (!atomic_read(&smi_info->stop_operation)) +- mod_timer(&smi_info->si_timer, +- jiffies + SI_TIMEOUT_JIFFIES); ++ smi_mod_timer(smi_info, jiffies + SI_TIMEOUT_JIFFIES); + } + } + +@@ -900,15 +909,7 @@ static void sender(void *send_info, + list_add_tail(&msg->link, &smi_info->xmit_msgs); + + if (smi_info->si_state == SI_NORMAL && smi_info->curr_msg == NULL) { +- /* +- * last_timeout_jiffies is updated here to avoid +- * smi_timeout() handler passing very large time_diff +- * value to smi_event_handler() that causes +- * the send command to abort. +- */ +- smi_info->last_timeout_jiffies = jiffies; +- +- mod_timer(&smi_info->si_timer, jiffies + SI_TIMEOUT_JIFFIES); ++ smi_mod_timer(smi_info, jiffies + SI_TIMEOUT_JIFFIES); + + if (smi_info->thread) + wake_up_process(smi_info->thread); +@@ -997,6 +998,17 @@ static int ipmi_thread(void *data) + + spin_lock_irqsave(&(smi_info->si_lock), flags); + smi_result = smi_event_handler(smi_info, 0); ++ ++ /* ++ * If the driver is doing something, there is a possible ++ * race with the timer. If the timer handler see idle, ++ * and the thread here sees something else, the timer ++ * handler won't restart the timer even though it is ++ * required. So start it here if necessary. ++ */ ++ if (smi_result != SI_SM_IDLE && !smi_info->timer_running) ++ smi_mod_timer(smi_info, jiffies + SI_TIMEOUT_JIFFIES); ++ + spin_unlock_irqrestore(&(smi_info->si_lock), flags); + busy_wait = ipmi_thread_busy_wait(smi_result, smi_info, + &busy_until); +@@ -1066,10 +1078,6 @@ static void smi_timeout(unsigned long data) + * SI_USEC_PER_JIFFY); + smi_result = smi_event_handler(smi_info, time_diff); + +- spin_unlock_irqrestore(&(smi_info->si_lock), flags); +- +- smi_info->last_timeout_jiffies = jiffies_now; +- + if ((smi_info->irq) && (!smi_info->interrupt_disabled)) { + /* Running with interrupts, only do long timeouts. */ + timeout = jiffies + SI_TIMEOUT_JIFFIES; +@@ -1091,7 +1099,10 @@ static void smi_timeout(unsigned long data) + + do_mod_timer: + if (smi_result != SI_SM_IDLE) +- mod_timer(&(smi_info->si_timer), timeout); ++ smi_mod_timer(smi_info, timeout); ++ else ++ smi_info->timer_running = false; ++ spin_unlock_irqrestore(&(smi_info->si_lock), flags); + } + + static irqreturn_t si_irq_handler(int irq, void *data) +@@ -1139,8 +1150,7 @@ static int smi_start_processing(void *send_info, + + /* Set up the timer that drives the interface. */ + setup_timer(&new_smi->si_timer, smi_timeout, (long)new_smi); +- new_smi->last_timeout_jiffies = jiffies; +- mod_timer(&new_smi->si_timer, jiffies + SI_TIMEOUT_JIFFIES); ++ smi_mod_timer(new_smi, jiffies + SI_TIMEOUT_JIFFIES); + + /* + * Check if the user forcefully enabled the daemon. +diff --git a/drivers/clk/versatile/clk-vexpress-osc.c b/drivers/clk/versatile/clk-vexpress-osc.c +index 256c8be74df8..8b8798bb93f3 100644 +--- a/drivers/clk/versatile/clk-vexpress-osc.c ++++ b/drivers/clk/versatile/clk-vexpress-osc.c +@@ -102,7 +102,7 @@ void __init vexpress_osc_of_setup(struct device_node *node) + + osc = kzalloc(sizeof(*osc), GFP_KERNEL); + if (!osc) +- goto error; ++ return; + + osc->func = vexpress_config_func_get_by_node(node); + if (!osc->func) { +diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c +index 662fcc065821..b7960185919d 100644 +--- a/drivers/clocksource/exynos_mct.c ++++ b/drivers/clocksource/exynos_mct.c +@@ -429,8 +429,6 @@ static int __cpuinit exynos4_local_timer_setup(struct clock_event_device *evt) + evt->set_mode = exynos4_tick_set_mode; + evt->features = CLOCK_EVT_FEAT_PERIODIC | CLOCK_EVT_FEAT_ONESHOT; + evt->rating = 450; +- clockevents_config_and_register(evt, clk_rate / (TICK_BASE_CNT + 1), +- 0xf, 0x7fffffff); + + exynos4_mct_write(TICK_BASE_CNT, mevt->base + MCT_L_TCNTB_OFFSET); + +@@ -448,6 +446,8 @@ static int __cpuinit exynos4_local_timer_setup(struct clock_event_device *evt) + } else { + enable_percpu_irq(mct_irqs[MCT_L0_IRQ], 0); + } ++ clockevents_config_and_register(evt, clk_rate / (TICK_BASE_CNT + 1), ++ 0xf, 0x7fffffff); + + return 0; + } +diff --git a/drivers/crypto/caam/error.c b/drivers/crypto/caam/error.c +index 9f25f5296029..0eabd81e1a90 100644 +--- a/drivers/crypto/caam/error.c ++++ b/drivers/crypto/caam/error.c +@@ -16,9 +16,13 @@ + char *tmp; \ + \ + tmp = kmalloc(sizeof(format) + max_alloc, GFP_ATOMIC); \ +- sprintf(tmp, format, param); \ +- strcat(str, tmp); \ +- kfree(tmp); \ ++ if (likely(tmp)) { \ ++ sprintf(tmp, format, param); \ ++ strcat(str, tmp); \ ++ kfree(tmp); \ ++ } else { \ ++ strcat(str, "kmalloc failure in SPRINTFCAT"); \ ++ } \ + } + + static void report_jump_idx(u32 status, char *outstr) +diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c +index 54ae96f7bec6..8814b0dbfc4f 100644 +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -9123,15 +9123,6 @@ void intel_modeset_init(struct drm_device *dev) + intel_disable_fbc(dev); + } + +-static void +-intel_connector_break_all_links(struct intel_connector *connector) +-{ +- connector->base.dpms = DRM_MODE_DPMS_OFF; +- connector->base.encoder = NULL; +- connector->encoder->connectors_active = false; +- connector->encoder->base.crtc = NULL; +-} +- + static void intel_enable_pipe_a(struct drm_device *dev) + { + struct intel_connector *connector; +@@ -9213,8 +9204,17 @@ static void intel_sanitize_crtc(struct intel_crtc *crtc) + if (connector->encoder->base.crtc != &crtc->base) + continue; + +- intel_connector_break_all_links(connector); ++ connector->base.dpms = DRM_MODE_DPMS_OFF; ++ connector->base.encoder = NULL; + } ++ /* multiple connectors may have the same encoder: ++ * handle them and break crtc link separately */ ++ list_for_each_entry(connector, &dev->mode_config.connector_list, ++ base.head) ++ if (connector->encoder->base.crtc == &crtc->base) { ++ connector->encoder->base.crtc = NULL; ++ connector->encoder->connectors_active = false; ++ } + + WARN_ON(crtc->active); + crtc->base.enabled = false; +@@ -9285,6 +9285,8 @@ static void intel_sanitize_encoder(struct intel_encoder *encoder) + drm_get_encoder_name(&encoder->base)); + encoder->disable(encoder); + } ++ encoder->base.crtc = NULL; ++ encoder->connectors_active = false; + + /* Inconsistent output/port/pipe state happens presumably due to + * a bug in one of the get_hw_state functions. Or someplace else +@@ -9295,8 +9297,8 @@ static void intel_sanitize_encoder(struct intel_encoder *encoder) + base.head) { + if (connector->encoder != encoder) + continue; +- +- intel_connector_break_all_links(connector); ++ connector->base.dpms = DRM_MODE_DPMS_OFF; ++ connector->base.encoder = NULL; + } + } + /* Enabled encoders without active connectors will be fixed in +diff --git a/drivers/gpu/drm/nouveau/core/subdev/therm/fan.c b/drivers/gpu/drm/nouveau/core/subdev/therm/fan.c +index c728380d3d62..ea19acd20784 100644 +--- a/drivers/gpu/drm/nouveau/core/subdev/therm/fan.c ++++ b/drivers/gpu/drm/nouveau/core/subdev/therm/fan.c +@@ -54,8 +54,10 @@ nouveau_fan_update(struct nouveau_fan *fan, bool immediate, int target) + + /* check that we're not already at the target duty cycle */ + duty = fan->get(therm); +- if (duty == target) +- goto done; ++ if (duty == target) { ++ spin_unlock_irqrestore(&fan->lock, flags); ++ return 0; ++ } + + /* smooth out the fanspeed increase/decrease */ + if (!immediate && duty >= 0) { +@@ -73,8 +75,15 @@ nouveau_fan_update(struct nouveau_fan *fan, bool immediate, int target) + + nv_debug(therm, "FAN update: %d\n", duty); + ret = fan->set(therm, duty); +- if (ret) +- goto done; ++ if (ret) { ++ spin_unlock_irqrestore(&fan->lock, flags); ++ return ret; ++ } ++ ++ /* fan speed updated, drop the fan lock before grabbing the ++ * alarm-scheduling lock and risking a deadlock ++ */ ++ spin_unlock_irqrestore(&fan->lock, flags); + + /* schedule next fan update, if not at target speed already */ + if (list_empty(&fan->alarm.head) && target != duty) { +@@ -92,8 +101,6 @@ nouveau_fan_update(struct nouveau_fan *fan, bool immediate, int target) + ptimer->alarm(ptimer, delay * 1000 * 1000, &fan->alarm); + } + +-done: +- spin_unlock_irqrestore(&fan->lock, flags); + return ret; + } + +diff --git a/drivers/gpu/drm/nouveau/nouveau_acpi.c b/drivers/gpu/drm/nouveau/nouveau_acpi.c +index d97f20069d3e..5cec3a0c6c85 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_acpi.c ++++ b/drivers/gpu/drm/nouveau/nouveau_acpi.c +@@ -372,9 +372,6 @@ bool nouveau_acpi_rom_supported(struct pci_dev *pdev) + acpi_status status; + acpi_handle dhandle, rom_handle; + +- if (!nouveau_dsm_priv.dsm_detected && !nouveau_dsm_priv.optimus_detected) +- return false; +- + dhandle = DEVICE_ACPI_HANDLE(&pdev->dev); + if (!dhandle) + return false; +diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c +index cbb06d7c89b5..8c44ef57864b 100644 +--- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c ++++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c +@@ -523,6 +523,13 @@ static bool radeon_atpx_detect(void) + has_atpx |= (radeon_atpx_pci_probe_handle(pdev) == true); + } + ++ /* some newer PX laptops mark the dGPU as a non-VGA display device */ ++ while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_OTHER << 8, pdev)) != NULL) { ++ vga_count++; ++ ++ has_atpx |= (radeon_atpx_pci_probe_handle(pdev) == true); ++ } ++ + if (has_atpx && vga_count == 2) { + acpi_get_name(radeon_atpx_priv.atpx.handle, ACPI_FULL_PATHNAME, &buffer); + printk(KERN_INFO "VGA switcheroo: detected switching method %s handle\n", +diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c +index 21d2d5280fc1..5715429279fb 100644 +--- a/drivers/gpu/drm/radeon/radeon_uvd.c ++++ b/drivers/gpu/drm/radeon/radeon_uvd.c +@@ -449,6 +449,10 @@ static int radeon_uvd_cs_reloc(struct radeon_cs_parser *p, + cmd = radeon_get_ib_value(p, p->idx) >> 1; + + if (cmd < 0x4) { ++ if (end <= start) { ++ DRM_ERROR("invalid reloc offset %X!\n", offset); ++ return -EINVAL; ++ } + if ((end - start) < buf_sizes[cmd]) { + DRM_ERROR("buffer to small (%d / %d)!\n", + (unsigned)(end - start), buf_sizes[cmd]); +diff --git a/drivers/gpu/host1x/hw/intr_hw.c b/drivers/gpu/host1x/hw/intr_hw.c +index b592eef1efcb..b083509325e4 100644 +--- a/drivers/gpu/host1x/hw/intr_hw.c ++++ b/drivers/gpu/host1x/hw/intr_hw.c +@@ -48,7 +48,7 @@ static irqreturn_t syncpt_thresh_isr(int irq, void *dev_id) + unsigned long reg; + int i, id; + +- for (i = 0; i <= BIT_WORD(host->info->nb_pts); i++) { ++ for (i = 0; i < DIV_ROUND_UP(host->info->nb_pts, 32); i++) { + reg = host1x_sync_readl(host, + HOST1X_SYNC_SYNCPT_THRESH_CPU0_INT_STATUS(i)); + for_each_set_bit(id, ®, BITS_PER_LONG) { +@@ -65,7 +65,7 @@ static void _host1x_intr_disable_all_syncpt_intrs(struct host1x *host) + { + u32 i; + +- for (i = 0; i <= BIT_WORD(host->info->nb_pts); ++i) { ++ for (i = 0; i < DIV_ROUND_UP(host->info->nb_pts, 32); ++i) { + host1x_sync_writel(host, 0xffffffffu, + HOST1X_SYNC_SYNCPT_THRESH_INT_DISABLE(i)); + host1x_sync_writel(host, 0xffffffffu, +diff --git a/drivers/hv/connection.c b/drivers/hv/connection.c +index d4fac934b220..fd02cb79a99c 100644 +--- a/drivers/hv/connection.c ++++ b/drivers/hv/connection.c +@@ -55,6 +55,9 @@ static __u32 vmbus_get_next_version(__u32 current_version) + case (VERSION_WIN8): + return VERSION_WIN7; + ++ case (VERSION_WIN8_1): ++ return VERSION_WIN8; ++ + case (VERSION_WS2008): + default: + return VERSION_INVAL; +@@ -80,6 +83,9 @@ static int vmbus_negotiate_version(struct vmbus_channel_msginfo *msginfo, + (void *)((unsigned long)vmbus_connection.monitor_pages + + PAGE_SIZE)); + ++ if (version == VERSION_WIN8_1) ++ msg->target_vcpu = hv_context.vp_index[smp_processor_id()]; ++ + /* + * Add to list before we send the request since we may + * receive the response before returning from this routine +diff --git a/drivers/hwmon/emc1403.c b/drivers/hwmon/emc1403.c +index 142e1cb8dea7..361f50b221bd 100644 +--- a/drivers/hwmon/emc1403.c ++++ b/drivers/hwmon/emc1403.c +@@ -162,7 +162,7 @@ static ssize_t store_hyst(struct device *dev, + if (retval < 0) + goto fail; + +- hyst = val - retval * 1000; ++ hyst = retval * 1000 - val; + hyst = DIV_ROUND_CLOSEST(hyst, 1000); + if (hyst < 0 || hyst > 255) { + retval = -ERANGE; +@@ -295,7 +295,7 @@ static int emc1403_detect(struct i2c_client *client, + } + + id = i2c_smbus_read_byte_data(client, THERMAL_REVISION_REG); +- if (id != 0x01) ++ if (id < 0x01 || id > 0x04) + return -ENODEV; + + return 0; +diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig +index 49423e913459..d4fe13ee543e 100644 +--- a/drivers/i2c/busses/Kconfig ++++ b/drivers/i2c/busses/Kconfig +@@ -109,6 +109,8 @@ config I2C_I801 + Avoton (SOC) + Wellsburg (PCH) + Coleto Creek (PCH) ++ Wildcat Point-LP (PCH) ++ BayTrail (SOC) + + This driver can also be built as a module. If so, the module + will be called i2c-i801. +diff --git a/drivers/i2c/busses/i2c-designware-core.c b/drivers/i2c/busses/i2c-designware-core.c +index c41ca6354fc5..f24a7385260a 100644 +--- a/drivers/i2c/busses/i2c-designware-core.c ++++ b/drivers/i2c/busses/i2c-designware-core.c +@@ -380,6 +380,9 @@ static void i2c_dw_xfer_init(struct dw_i2c_dev *dev) + ic_con &= ~DW_IC_CON_10BITADDR_MASTER; + dw_writel(dev, ic_con, DW_IC_CON); + ++ /* enforce disabled interrupts (due to HW issues) */ ++ i2c_dw_disable_int(dev); ++ + /* Enable the adapter */ + __i2c_dw_enable(dev, true); + +diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c +index 4ebceed6bc66..783fa75e13ae 100644 +--- a/drivers/i2c/busses/i2c-i801.c ++++ b/drivers/i2c/busses/i2c-i801.c +@@ -59,6 +59,8 @@ + Wellsburg (PCH) MS 0x8d7e 32 hard yes yes yes + Wellsburg (PCH) MS 0x8d7f 32 hard yes yes yes + Coleto Creek (PCH) 0x23b0 32 hard yes yes yes ++ Wildcat Point-LP (PCH) 0x9ca2 32 hard yes yes yes ++ BayTrail (SOC) 0x0f12 32 hard yes yes yes + + Features supported by this driver: + Software PEC no +@@ -161,6 +163,7 @@ + STATUS_ERROR_FLAGS) + + /* Older devices have their ID defined in */ ++#define PCI_DEVICE_ID_INTEL_BAYTRAIL_SMBUS 0x0f12 + #define PCI_DEVICE_ID_INTEL_COUGARPOINT_SMBUS 0x1c22 + #define PCI_DEVICE_ID_INTEL_PATSBURG_SMBUS 0x1d22 + /* Patsburg also has three 'Integrated Device Function' SMBus controllers */ +@@ -178,6 +181,7 @@ + #define PCI_DEVICE_ID_INTEL_WELLSBURG_SMBUS_MS1 0x8d7e + #define PCI_DEVICE_ID_INTEL_WELLSBURG_SMBUS_MS2 0x8d7f + #define PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_SMBUS 0x9c22 ++#define PCI_DEVICE_ID_INTEL_WILDCATPOINT_LP_SMBUS 0x9ca2 + + struct i801_mux_config { + char *gpio_chip; +@@ -820,6 +824,8 @@ static DEFINE_PCI_DEVICE_TABLE(i801_ids) = { + { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_WELLSBURG_SMBUS_MS1) }, + { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_WELLSBURG_SMBUS_MS2) }, + { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_COLETOCREEK_SMBUS) }, ++ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_WILDCATPOINT_LP_SMBUS) }, ++ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BAYTRAIL_SMBUS) }, + { 0, } + }; + +diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c +index 4ba4a95b6b26..8a806f5c40cf 100644 +--- a/drivers/i2c/busses/i2c-rcar.c ++++ b/drivers/i2c/busses/i2c-rcar.c +@@ -541,6 +541,12 @@ static int rcar_i2c_master_xfer(struct i2c_adapter *adap, + + ret = -EINVAL; + for (i = 0; i < num; i++) { ++ /* This HW can't send STOP after address phase */ ++ if (msgs[i].len == 0) { ++ ret = -EOPNOTSUPP; ++ break; ++ } ++ + /*-------------- spin lock -----------------*/ + spin_lock_irqsave(&priv->lock, flags); + +@@ -605,7 +611,8 @@ static int rcar_i2c_master_xfer(struct i2c_adapter *adap, + + static u32 rcar_i2c_func(struct i2c_adapter *adap) + { +- return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL; ++ /* This HW can't do SMBUS_QUICK and NOSTART */ ++ return I2C_FUNC_I2C | (I2C_FUNC_SMBUS_EMUL & ~I2C_FUNC_SMBUS_QUICK); + } + + static const struct i2c_algorithm rcar_i2c_algo = { +diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c +index cab1c91b75a3..a72aad9561b0 100644 +--- a/drivers/i2c/busses/i2c-s3c2410.c ++++ b/drivers/i2c/busses/i2c-s3c2410.c +@@ -1204,10 +1204,10 @@ static int s3c24xx_i2c_resume(struct device *dev) + struct platform_device *pdev = to_platform_device(dev); + struct s3c24xx_i2c *i2c = platform_get_drvdata(pdev); + +- i2c->suspended = 0; + clk_prepare_enable(i2c->clk); + s3c24xx_i2c_init(i2c); + clk_disable_unprepare(i2c->clk); ++ i2c->suspended = 0; + + return 0; + } +diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c +index fe4c61e219f3..111ac381b40b 100644 +--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c ++++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c +@@ -660,6 +660,7 @@ static int inv_mpu_probe(struct i2c_client *client, + { + struct inv_mpu6050_state *st; + struct iio_dev *indio_dev; ++ struct inv_mpu6050_platform_data *pdata; + int result; + + if (!i2c_check_functionality(client->adapter, +@@ -675,8 +676,10 @@ static int inv_mpu_probe(struct i2c_client *client, + } + st = iio_priv(indio_dev); + st->client = client; +- st->plat_data = *(struct inv_mpu6050_platform_data +- *)dev_get_platdata(&client->dev); ++ pdata = (struct inv_mpu6050_platform_data ++ *)dev_get_platdata(&client->dev); ++ if (pdata) ++ st->plat_data = *pdata; + /* power is turned on inside check chip type*/ + result = inv_check_and_setup_chip(st, id); + if (result) +diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c +index ce6c603a3cc9..988e29d18bb4 100644 +--- a/drivers/infiniband/ulp/isert/ib_isert.c ++++ b/drivers/infiniband/ulp/isert/ib_isert.c +@@ -27,6 +27,7 @@ + #include + #include + #include ++#include + + #include "isert_proto.h" + #include "ib_isert.h" +@@ -459,11 +460,11 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event) + goto out_conn_dev; + + mutex_lock(&isert_np->np_accept_mutex); +- list_add_tail(&isert_np->np_accept_list, &isert_conn->conn_accept_node); ++ list_add_tail(&isert_conn->conn_accept_node, &isert_np->np_accept_list); + mutex_unlock(&isert_np->np_accept_mutex); + +- pr_debug("isert_connect_request() waking up np_accept_wq: %p\n", np); +- wake_up(&isert_np->np_accept_wq); ++ pr_debug("isert_connect_request() up np_sem np: %p\n", np); ++ up(&isert_np->np_sem); + return 0; + + out_conn_dev: +@@ -2042,7 +2043,7 @@ isert_setup_np(struct iscsi_np *np, + pr_err("Unable to allocate struct isert_np\n"); + return -ENOMEM; + } +- init_waitqueue_head(&isert_np->np_accept_wq); ++ sema_init(&isert_np->np_sem, 0); + mutex_init(&isert_np->np_accept_mutex); + INIT_LIST_HEAD(&isert_np->np_accept_list); + init_completion(&isert_np->np_login_comp); +@@ -2091,18 +2092,6 @@ out: + } + + static int +-isert_check_accept_queue(struct isert_np *isert_np) +-{ +- int empty; +- +- mutex_lock(&isert_np->np_accept_mutex); +- empty = list_empty(&isert_np->np_accept_list); +- mutex_unlock(&isert_np->np_accept_mutex); +- +- return empty; +-} +- +-static int + isert_rdma_accept(struct isert_conn *isert_conn) + { + struct rdma_cm_id *cm_id = isert_conn->conn_cm_id; +@@ -2186,16 +2175,14 @@ isert_accept_np(struct iscsi_np *np, struct iscsi_conn *conn) + int max_accept = 0, ret; + + accept_wait: +- ret = wait_event_interruptible(isert_np->np_accept_wq, +- !isert_check_accept_queue(isert_np) || +- np->np_thread_state == ISCSI_NP_THREAD_RESET); ++ ret = down_interruptible(&isert_np->np_sem); + if (max_accept > 5) + return -ENODEV; + + spin_lock_bh(&np->np_thread_lock); + if (np->np_thread_state == ISCSI_NP_THREAD_RESET) { + spin_unlock_bh(&np->np_thread_lock); +- pr_err("ISCSI_NP_THREAD_RESET for isert_accept_np\n"); ++ pr_debug("ISCSI_NP_THREAD_RESET for isert_accept_np\n"); + return -ENODEV; + } + spin_unlock_bh(&np->np_thread_lock); +diff --git a/drivers/infiniband/ulp/isert/ib_isert.h b/drivers/infiniband/ulp/isert/ib_isert.h +index b9d6cc6917cf..dfe4a2ebef0d 100644 +--- a/drivers/infiniband/ulp/isert/ib_isert.h ++++ b/drivers/infiniband/ulp/isert/ib_isert.h +@@ -131,7 +131,7 @@ struct isert_device { + }; + + struct isert_np { +- wait_queue_head_t np_accept_wq; ++ struct semaphore np_sem; + struct rdma_cm_id *np_cm_id; + struct mutex np_accept_mutex; + struct list_head np_accept_list; +diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c +index 2626773ff29b..2dd1d0dd4f7d 100644 +--- a/drivers/input/keyboard/atkbd.c ++++ b/drivers/input/keyboard/atkbd.c +@@ -243,6 +243,12 @@ static void (*atkbd_platform_fixup)(struct atkbd *, const void *data); + static void *atkbd_platform_fixup_data; + static unsigned int (*atkbd_platform_scancode_fixup)(struct atkbd *, unsigned int); + ++/* ++ * Certain keyboards to not like ATKBD_CMD_RESET_DIS and stop responding ++ * to many commands until full reset (ATKBD_CMD_RESET_BAT) is performed. ++ */ ++static bool atkbd_skip_deactivate; ++ + static ssize_t atkbd_attr_show_helper(struct device *dev, char *buf, + ssize_t (*handler)(struct atkbd *, char *)); + static ssize_t atkbd_attr_set_helper(struct device *dev, const char *buf, size_t count, +@@ -768,7 +774,8 @@ static int atkbd_probe(struct atkbd *atkbd) + * Make sure nothing is coming from the keyboard and disturbs our + * internal state. + */ +- atkbd_deactivate(atkbd); ++ if (!atkbd_skip_deactivate) ++ atkbd_deactivate(atkbd); + + return 0; + } +@@ -1638,6 +1645,12 @@ static int __init atkbd_setup_scancode_fixup(const struct dmi_system_id *id) + return 1; + } + ++static int __init atkbd_deactivate_fixup(const struct dmi_system_id *id) ++{ ++ atkbd_skip_deactivate = true; ++ return 1; ++} ++ + static const struct dmi_system_id atkbd_dmi_quirk_table[] __initconst = { + { + .matches = { +@@ -1775,6 +1788,20 @@ static const struct dmi_system_id atkbd_dmi_quirk_table[] __initconst = { + .callback = atkbd_setup_scancode_fixup, + .driver_data = atkbd_oqo_01plus_scancode_fixup, + }, ++ { ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LG Electronics"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "LW25-B7HV"), ++ }, ++ .callback = atkbd_deactivate_fixup, ++ }, ++ { ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LG Electronics"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "P1-J273B"), ++ }, ++ .callback = atkbd_deactivate_fixup, ++ }, + { } + }; + +diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c +index 1fb1a7b5a754..76f1d37ac0ff 100644 +--- a/drivers/input/mouse/elantech.c ++++ b/drivers/input/mouse/elantech.c +@@ -11,6 +11,7 @@ + */ + + #include ++#include + #include + #include + #include +@@ -801,7 +802,11 @@ static int elantech_set_absolute_mode(struct psmouse *psmouse) + break; + + case 3: +- etd->reg_10 = 0x0b; ++ if (etd->set_hw_resolution) ++ etd->reg_10 = 0x0b; ++ else ++ etd->reg_10 = 0x03; ++ + if (elantech_write_reg(psmouse, 0x10, etd->reg_10)) + rc = -1; + +@@ -1301,6 +1306,22 @@ static int elantech_reconnect(struct psmouse *psmouse) + } + + /* ++ * Some hw_version 3 models go into error state when we try to set bit 3 of r10 ++ */ ++static const struct dmi_system_id no_hw_res_dmi_table[] = { ++#if defined(CONFIG_DMI) && defined(CONFIG_X86) ++ { ++ /* Gigabyte U2442 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "U2442"), ++ }, ++ }, ++#endif ++ { } ++}; ++ ++/* + * determine hardware version and set some properties according to it. + */ + static int elantech_set_properties(struct elantech_data *etd) +@@ -1351,6 +1372,9 @@ static int elantech_set_properties(struct elantech_data *etd) + etd->reports_pressure = true; + } + ++ /* Enable real hardware resolution on hw_version 3 ? */ ++ etd->set_hw_resolution = !dmi_check_system(no_hw_res_dmi_table); ++ + return 0; + } + +diff --git a/drivers/input/mouse/elantech.h b/drivers/input/mouse/elantech.h +index 46db3be45ac9..c1c15ab6872d 100644 +--- a/drivers/input/mouse/elantech.h ++++ b/drivers/input/mouse/elantech.h +@@ -129,6 +129,7 @@ struct elantech_data { + bool paritycheck; + bool jumpy_cursor; + bool reports_pressure; ++ bool set_hw_resolution; + unsigned char hw_version; + unsigned int fw_version; + unsigned int single_finger_reports; +diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c +index d60c9b7ad1b8..f36f7b88f260 100644 +--- a/drivers/input/mouse/synaptics.c ++++ b/drivers/input/mouse/synaptics.c +@@ -1552,7 +1552,7 @@ static const struct dmi_system_id min_max_dmi_table[] __initconst = { + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T540"), + }, +- .driver_data = (int []){1024, 5056, 2058, 4832}, ++ .driver_data = (int []){1024, 5112, 2024, 4832}, + }, + { + /* Lenovo ThinkPad L540 */ +@@ -1563,6 +1563,14 @@ static const struct dmi_system_id min_max_dmi_table[] __initconst = { + .driver_data = (int []){1024, 5112, 2024, 4832}, + }, + { ++ /* Lenovo ThinkPad W540 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad W540"), ++ }, ++ .driver_data = (int []){1024, 5112, 2024, 4832}, ++ }, ++ { + /* Lenovo Yoga S1 */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), +diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c +index a3c338942f10..6f849cbcac6f 100644 +--- a/drivers/iommu/amd_iommu.c ++++ b/drivers/iommu/amd_iommu.c +@@ -3959,7 +3959,7 @@ static struct irq_remap_table *get_irq_table(u16 devid, bool ioapic) + iommu_flush_dte(iommu, devid); + if (devid != alias) { + irq_lookup_table[alias] = table; +- set_dte_irq_entry(devid, table); ++ set_dte_irq_entry(alias, table); + iommu_flush_dte(iommu, alias); + } + +diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c +index 19ceaa60e0f4..4e11218d644e 100644 +--- a/drivers/irqchip/irq-gic.c ++++ b/drivers/irqchip/irq-gic.c +@@ -246,10 +246,14 @@ static int gic_set_affinity(struct irq_data *d, const struct cpumask *mask_val, + bool force) + { + void __iomem *reg = gic_dist_base(d) + GIC_DIST_TARGET + (gic_irq(d) & ~3); +- unsigned int shift = (gic_irq(d) % 4) * 8; +- unsigned int cpu = cpumask_any_and(mask_val, cpu_online_mask); ++ unsigned int cpu, shift = (gic_irq(d) % 4) * 8; + u32 val, mask, bit; + ++ if (!force) ++ cpu = cpumask_any_and(mask_val, cpu_online_mask); ++ else ++ cpu = cpumask_first(mask_val); ++ + if (cpu >= NR_GIC_CPU_IF || cpu >= nr_cpu_ids) + return -EINVAL; + +diff --git a/drivers/leds/leds-pwm.c b/drivers/leds/leds-pwm.c +index faf52c005e8c..5d64b2431415 100644 +--- a/drivers/leds/leds-pwm.c ++++ b/drivers/leds/leds-pwm.c +@@ -82,6 +82,15 @@ static inline size_t sizeof_pwm_leds_priv(int num_leds) + (sizeof(struct led_pwm_data) * num_leds); + } + ++static void led_pwm_cleanup(struct led_pwm_priv *priv) ++{ ++ while (priv->num_leds--) { ++ led_classdev_unregister(&priv->leds[priv->num_leds].cdev); ++ if (priv->leds[priv->num_leds].can_sleep) ++ cancel_work_sync(&priv->leds[priv->num_leds].work); ++ } ++} ++ + static struct led_pwm_priv *led_pwm_create_of(struct platform_device *pdev) + { + struct device_node *node = pdev->dev.of_node; +@@ -139,8 +148,7 @@ static struct led_pwm_priv *led_pwm_create_of(struct platform_device *pdev) + + return priv; + err: +- while (priv->num_leds--) +- led_classdev_unregister(&priv->leds[priv->num_leds].cdev); ++ led_pwm_cleanup(priv); + + return NULL; + } +@@ -200,8 +208,8 @@ static int led_pwm_probe(struct platform_device *pdev) + return 0; + + err: +- while (i--) +- led_classdev_unregister(&priv->leds[i].cdev); ++ priv->num_leds = i; ++ led_pwm_cleanup(priv); + + return ret; + } +@@ -209,13 +217,8 @@ err: + static int led_pwm_remove(struct platform_device *pdev) + { + struct led_pwm_priv *priv = platform_get_drvdata(pdev); +- int i; + +- for (i = 0; i < priv->num_leds; i++) { +- led_classdev_unregister(&priv->leds[i].cdev); +- if (priv->leds[i].can_sleep) +- cancel_work_sync(&priv->leds[i].work); +- } ++ led_pwm_cleanup(priv); + + return 0; + } +diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c +index 6d2d41ae9e32..5177ba54559b 100644 +--- a/drivers/md/dm-crypt.c ++++ b/drivers/md/dm-crypt.c +@@ -18,7 +18,6 @@ + #include + #include + #include +-#include + #include + #include + #include +@@ -44,6 +43,7 @@ struct convert_context { + unsigned int idx_out; + sector_t cc_sector; + atomic_t cc_pending; ++ struct ablkcipher_request *req; + }; + + /* +@@ -105,15 +105,7 @@ struct iv_lmk_private { + enum flags { DM_CRYPT_SUSPENDED, DM_CRYPT_KEY_VALID }; + + /* +- * Duplicated per-CPU state for cipher. +- */ +-struct crypt_cpu { +- struct ablkcipher_request *req; +-}; +- +-/* +- * The fields in here must be read only after initialization, +- * changing state should be in crypt_cpu. ++ * The fields in here must be read only after initialization. + */ + struct crypt_config { + struct dm_dev *dev; +@@ -143,12 +135,6 @@ struct crypt_config { + sector_t iv_offset; + unsigned int iv_size; + +- /* +- * Duplicated per cpu state. Access through +- * per_cpu_ptr() only. +- */ +- struct crypt_cpu __percpu *cpu; +- + /* ESSIV: struct crypto_cipher *essiv_tfm */ + void *iv_private; + struct crypto_ablkcipher **tfms; +@@ -184,11 +170,6 @@ static void clone_init(struct dm_crypt_io *, struct bio *); + static void kcryptd_queue_crypt(struct dm_crypt_io *io); + static u8 *iv_of_dmreq(struct crypt_config *cc, struct dm_crypt_request *dmreq); + +-static struct crypt_cpu *this_crypt_config(struct crypt_config *cc) +-{ +- return this_cpu_ptr(cc->cpu); +-} +- + /* + * Use this to access cipher attributes that are the same for each CPU. + */ +@@ -738,16 +719,15 @@ static void kcryptd_async_done(struct crypto_async_request *async_req, + static void crypt_alloc_req(struct crypt_config *cc, + struct convert_context *ctx) + { +- struct crypt_cpu *this_cc = this_crypt_config(cc); + unsigned key_index = ctx->cc_sector & (cc->tfms_count - 1); + +- if (!this_cc->req) +- this_cc->req = mempool_alloc(cc->req_pool, GFP_NOIO); ++ if (!ctx->req) ++ ctx->req = mempool_alloc(cc->req_pool, GFP_NOIO); + +- ablkcipher_request_set_tfm(this_cc->req, cc->tfms[key_index]); +- ablkcipher_request_set_callback(this_cc->req, ++ ablkcipher_request_set_tfm(ctx->req, cc->tfms[key_index]); ++ ablkcipher_request_set_callback(ctx->req, + CRYPTO_TFM_REQ_MAY_BACKLOG | CRYPTO_TFM_REQ_MAY_SLEEP, +- kcryptd_async_done, dmreq_of_req(cc, this_cc->req)); ++ kcryptd_async_done, dmreq_of_req(cc, ctx->req)); + } + + /* +@@ -756,7 +736,6 @@ static void crypt_alloc_req(struct crypt_config *cc, + static int crypt_convert(struct crypt_config *cc, + struct convert_context *ctx) + { +- struct crypt_cpu *this_cc = this_crypt_config(cc); + int r; + + atomic_set(&ctx->cc_pending, 1); +@@ -768,7 +747,7 @@ static int crypt_convert(struct crypt_config *cc, + + atomic_inc(&ctx->cc_pending); + +- r = crypt_convert_block(cc, ctx, this_cc->req); ++ r = crypt_convert_block(cc, ctx, ctx->req); + + switch (r) { + /* async */ +@@ -777,7 +756,7 @@ static int crypt_convert(struct crypt_config *cc, + INIT_COMPLETION(ctx->restart); + /* fall through*/ + case -EINPROGRESS: +- this_cc->req = NULL; ++ ctx->req = NULL; + ctx->cc_sector++; + continue; + +@@ -876,6 +855,7 @@ static struct dm_crypt_io *crypt_io_alloc(struct crypt_config *cc, + io->sector = sector; + io->error = 0; + io->base_io = NULL; ++ io->ctx.req = NULL; + atomic_set(&io->io_pending, 0); + + return io; +@@ -901,6 +881,8 @@ static void crypt_dec_pending(struct dm_crypt_io *io) + if (!atomic_dec_and_test(&io->io_pending)) + return; + ++ if (io->ctx.req) ++ mempool_free(io->ctx.req, cc->req_pool); + mempool_free(io, cc->io_pool); + + if (likely(!base_io)) +@@ -1326,8 +1308,6 @@ static int crypt_wipe_key(struct crypt_config *cc) + static void crypt_dtr(struct dm_target *ti) + { + struct crypt_config *cc = ti->private; +- struct crypt_cpu *cpu_cc; +- int cpu; + + ti->private = NULL; + +@@ -1339,13 +1319,6 @@ static void crypt_dtr(struct dm_target *ti) + if (cc->crypt_queue) + destroy_workqueue(cc->crypt_queue); + +- if (cc->cpu) +- for_each_possible_cpu(cpu) { +- cpu_cc = per_cpu_ptr(cc->cpu, cpu); +- if (cpu_cc->req) +- mempool_free(cpu_cc->req, cc->req_pool); +- } +- + crypt_free_tfms(cc); + + if (cc->bs) +@@ -1364,9 +1337,6 @@ static void crypt_dtr(struct dm_target *ti) + if (cc->dev) + dm_put_device(ti, cc->dev); + +- if (cc->cpu) +- free_percpu(cc->cpu); +- + kzfree(cc->cipher); + kzfree(cc->cipher_string); + +@@ -1421,13 +1391,6 @@ static int crypt_ctr_cipher(struct dm_target *ti, + if (tmp) + DMWARN("Ignoring unexpected additional cipher options"); + +- cc->cpu = __alloc_percpu(sizeof(*(cc->cpu)), +- __alignof__(struct crypt_cpu)); +- if (!cc->cpu) { +- ti->error = "Cannot allocate per cpu state"; +- goto bad_mem; +- } +- + /* + * For compatibility with the original dm-crypt mapping format, if + * only the cipher name is supplied, use cbc-plain. +diff --git a/drivers/md/md.c b/drivers/md/md.c +index a2dda416c9cb..00a99fe797d4 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -8481,7 +8481,8 @@ static int md_notify_reboot(struct notifier_block *this, + if (mddev_trylock(mddev)) { + if (mddev->pers) + __md_stop_writes(mddev); +- mddev->safemode = 2; ++ if (mddev->persistent) ++ mddev->safemode = 2; + mddev_unlock(mddev); + } + need_delay = 1; +diff --git a/drivers/media/i2c/ov7670.c b/drivers/media/i2c/ov7670.c +index 617ad3fff4aa..3ead3a83f04a 100644 +--- a/drivers/media/i2c/ov7670.c ++++ b/drivers/media/i2c/ov7670.c +@@ -1110,7 +1110,7 @@ static int ov7670_enum_framesizes(struct v4l2_subdev *sd, + * windows that fall outside that. + */ + for (i = 0; i < n_win_sizes; i++) { +- struct ov7670_win_size *win = &info->devtype->win_sizes[index]; ++ struct ov7670_win_size *win = &info->devtype->win_sizes[i]; + if (info->min_width && win->width < info->min_width) + continue; + if (info->min_height && win->height < info->min_height) +diff --git a/drivers/media/media-device.c b/drivers/media/media-device.c +index 1957c0df08fd..79715f9feb0a 100644 +--- a/drivers/media/media-device.c ++++ b/drivers/media/media-device.c +@@ -93,6 +93,7 @@ static long media_device_enum_entities(struct media_device *mdev, + struct media_entity *ent; + struct media_entity_desc u_ent; + ++ memset(&u_ent, 0, sizeof(u_ent)); + if (copy_from_user(&u_ent.id, &uent->id, sizeof(u_ent.id))) + return -EFAULT; + +diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c +index 1d7dbd5c0fba..3e8ef11f67aa 100644 +--- a/drivers/media/platform/omap3isp/isp.c ++++ b/drivers/media/platform/omap3isp/isp.c +@@ -2249,6 +2249,7 @@ static int isp_probe(struct platform_device *pdev) + ret = iommu_attach_device(isp->domain, &pdev->dev); + if (ret) { + dev_err(&pdev->dev, "can't attach iommu device: %d\n", ret); ++ ret = -EPROBE_DEFER; + goto free_domain; + } + +@@ -2287,6 +2288,7 @@ detach_dev: + iommu_detach_device(isp->domain, &pdev->dev); + free_domain: + iommu_domain_free(isp->domain); ++ isp->domain = NULL; + error_isp: + isp_xclk_cleanup(isp); + omap3isp_put(isp); +diff --git a/drivers/media/tuners/fc2580.c b/drivers/media/tuners/fc2580.c +index 3aecaf465094..f0c9c42867de 100644 +--- a/drivers/media/tuners/fc2580.c ++++ b/drivers/media/tuners/fc2580.c +@@ -195,7 +195,7 @@ static int fc2580_set_params(struct dvb_frontend *fe) + + f_ref = 2UL * priv->cfg->clock / r_val; + n_val = div_u64_rem(f_vco, f_ref, &k_val); +- k_val_reg = 1UL * k_val * (1 << 20) / f_ref; ++ k_val_reg = div_u64(1ULL * k_val * (1 << 20), f_ref); + + ret = fc2580_wr_reg(priv, 0x18, r18_val | ((k_val_reg >> 16) & 0xff)); + if (ret < 0) +@@ -348,8 +348,8 @@ static int fc2580_set_params(struct dvb_frontend *fe) + if (ret < 0) + goto err; + +- ret = fc2580_wr_reg(priv, 0x37, 1UL * priv->cfg->clock * \ +- fc2580_if_filter_lut[i].mul / 1000000000); ++ ret = fc2580_wr_reg(priv, 0x37, div_u64(1ULL * priv->cfg->clock * ++ fc2580_if_filter_lut[i].mul, 1000000000)); + if (ret < 0) + goto err; + +diff --git a/drivers/media/tuners/fc2580_priv.h b/drivers/media/tuners/fc2580_priv.h +index be38a9e637e0..646c99452136 100644 +--- a/drivers/media/tuners/fc2580_priv.h ++++ b/drivers/media/tuners/fc2580_priv.h +@@ -22,6 +22,7 @@ + #define FC2580_PRIV_H + + #include "fc2580.h" ++#include + + struct fc2580_reg_val { + u8 reg; +diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c +index f56b729581e7..e2b0a0969ebb 100644 +--- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c ++++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c +@@ -178,6 +178,9 @@ struct v4l2_create_buffers32 { + + static int __get_v4l2_format32(struct v4l2_format *kp, struct v4l2_format32 __user *up) + { ++ if (get_user(kp->type, &up->type)) ++ return -EFAULT; ++ + switch (kp->type) { + case V4L2_BUF_TYPE_VIDEO_CAPTURE: + case V4L2_BUF_TYPE_VIDEO_OUTPUT: +@@ -204,17 +207,16 @@ static int __get_v4l2_format32(struct v4l2_format *kp, struct v4l2_format32 __us + + static int get_v4l2_format32(struct v4l2_format *kp, struct v4l2_format32 __user *up) + { +- if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_format32)) || +- get_user(kp->type, &up->type)) +- return -EFAULT; ++ if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_format32))) ++ return -EFAULT; + return __get_v4l2_format32(kp, up); + } + + static int get_v4l2_create32(struct v4l2_create_buffers *kp, struct v4l2_create_buffers32 __user *up) + { + if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_create_buffers32)) || +- copy_from_user(kp, up, offsetof(struct v4l2_create_buffers32, format.fmt))) +- return -EFAULT; ++ copy_from_user(kp, up, offsetof(struct v4l2_create_buffers32, format))) ++ return -EFAULT; + return __get_v4l2_format32(&kp->format, &up->format); + } + +diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c +index e752f5d4995d..0c9b2f1c6939 100644 +--- a/drivers/net/wireless/ath/ath9k/xmit.c ++++ b/drivers/net/wireless/ath/ath9k/xmit.c +@@ -1255,14 +1255,16 @@ void ath_tx_aggr_sleep(struct ieee80211_sta *sta, struct ath_softc *sc, + for (tidno = 0, tid = &an->tid[tidno]; + tidno < IEEE80211_NUM_TIDS; tidno++, tid++) { + +- if (!tid->sched) +- continue; +- + ac = tid->ac; + txq = ac->txq; + + ath_txq_lock(sc, txq); + ++ if (!tid->sched) { ++ ath_txq_unlock(sc, txq); ++ continue; ++ } ++ + buffered = !skb_queue_empty(&tid->buf_q); + + tid->sched = false; +diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c +index 3a6544710c8a..8e8543cfe489 100644 +--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c ++++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c +@@ -426,6 +426,12 @@ static int brcms_ops_start(struct ieee80211_hw *hw) + bool blocked; + int err; + ++ if (!wl->ucode.bcm43xx_bomminor) { ++ err = brcms_request_fw(wl, wl->wlc->hw->d11core); ++ if (err) ++ return -ENOENT; ++ } ++ + ieee80211_wake_queues(hw); + spin_lock_bh(&wl->lock); + blocked = brcms_rfkill_set_hw_state(wl); +@@ -433,14 +439,6 @@ static int brcms_ops_start(struct ieee80211_hw *hw) + if (!blocked) + wiphy_rfkill_stop_polling(wl->pub->ieee_hw->wiphy); + +- if (!wl->ucode.bcm43xx_bomminor) { +- err = brcms_request_fw(wl, wl->wlc->hw->d11core); +- if (err) { +- brcms_remove(wl->wlc->hw->d11core); +- return -ENOENT; +- } +- } +- + spin_lock_bh(&wl->lock); + /* avoid acknowledging frames before a non-monitor device is added */ + wl->mute_tx = true; +diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c +index f8cff1f0b6b7..2b724fc4e306 100644 +--- a/drivers/net/wireless/rt2x00/rt2x00mac.c ++++ b/drivers/net/wireless/rt2x00/rt2x00mac.c +@@ -623,20 +623,18 @@ void rt2x00mac_bss_info_changed(struct ieee80211_hw *hw, + bss_conf->bssid); + + /* +- * Update the beacon. This is only required on USB devices. PCI +- * devices fetch beacons periodically. +- */ +- if (changes & BSS_CHANGED_BEACON && rt2x00_is_usb(rt2x00dev)) +- rt2x00queue_update_beacon(rt2x00dev, vif); +- +- /* + * Start/stop beaconing. + */ + if (changes & BSS_CHANGED_BEACON_ENABLED) { + if (!bss_conf->enable_beacon && intf->enable_beacon) { +- rt2x00queue_clear_beacon(rt2x00dev, vif); + rt2x00dev->intf_beaconing--; + intf->enable_beacon = false; ++ /* ++ * Clear beacon in the H/W for this vif. This is needed ++ * to disable beaconing on this particular interface ++ * and keep it running on other interfaces. ++ */ ++ rt2x00queue_clear_beacon(rt2x00dev, vif); + + if (rt2x00dev->intf_beaconing == 0) { + /* +@@ -647,11 +645,15 @@ void rt2x00mac_bss_info_changed(struct ieee80211_hw *hw, + rt2x00queue_stop_queue(rt2x00dev->bcn); + mutex_unlock(&intf->beacon_skb_mutex); + } +- +- + } else if (bss_conf->enable_beacon && !intf->enable_beacon) { + rt2x00dev->intf_beaconing++; + intf->enable_beacon = true; ++ /* ++ * Upload beacon to the H/W. This is only required on ++ * USB devices. PCI devices fetch beacons periodically. ++ */ ++ if (rt2x00_is_usb(rt2x00dev)) ++ rt2x00queue_update_beacon(rt2x00dev, vif); + + if (rt2x00dev->intf_beaconing == 1) { + /* +diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c +index 324aa581938e..c3f2b55501ae 100644 +--- a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c +@@ -1001,7 +1001,7 @@ int rtl92cu_hw_init(struct ieee80211_hw *hw) + err = _rtl92cu_init_mac(hw); + if (err) { + RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "init mac failed!\n"); +- return err; ++ goto exit; + } + err = rtl92c_download_fw(hw); + if (err) { +diff --git a/drivers/pci/hotplug/shpchp_ctrl.c b/drivers/pci/hotplug/shpchp_ctrl.c +index 58499277903a..6efc2ec5e4db 100644 +--- a/drivers/pci/hotplug/shpchp_ctrl.c ++++ b/drivers/pci/hotplug/shpchp_ctrl.c +@@ -282,8 +282,8 @@ static int board_added(struct slot *p_slot) + return WRONG_BUS_FREQUENCY; + } + +- bsp = ctrl->pci_dev->bus->cur_bus_speed; +- msp = ctrl->pci_dev->bus->max_bus_speed; ++ bsp = ctrl->pci_dev->subordinate->cur_bus_speed; ++ msp = ctrl->pci_dev->subordinate->max_bus_speed; + + /* Check if there are other slots or devices on the same bus */ + if (!list_empty(&ctrl->pci_dev->subordinate->devices)) +diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c +index 660b109487ae..8032917b6636 100644 +--- a/drivers/target/target_core_device.c ++++ b/drivers/target/target_core_device.c +@@ -796,10 +796,10 @@ int se_dev_set_emulate_write_cache(struct se_device *dev, int flag) + pr_err("emulate_write_cache not supported for pSCSI\n"); + return -EINVAL; + } +- if (dev->transport->get_write_cache) { +- pr_warn("emulate_write_cache cannot be changed when underlying" +- " HW reports WriteCacheEnabled, ignoring request\n"); +- return 0; ++ if (flag && ++ dev->transport->get_write_cache) { ++ pr_err("emulate_write_cache not supported for this device\n"); ++ return -EINVAL; + } + + dev->dev_attrib.emulate_write_cache = flag; +diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c +index b167665b7de2..d8c06a3d391e 100644 +--- a/drivers/tty/serial/8250/8250_core.c ++++ b/drivers/tty/serial/8250/8250_core.c +@@ -1520,7 +1520,7 @@ int serial8250_handle_irq(struct uart_port *port, unsigned int iir) + status = serial8250_rx_chars(up, status); + } + serial8250_modem_status(up); +- if (status & UART_LSR_THRE) ++ if (!up->dma && (status & UART_LSR_THRE)) + serial8250_tx_chars(up); + + spin_unlock_irqrestore(&port->lock, flags); +diff --git a/drivers/tty/serial/8250/8250_dma.c b/drivers/tty/serial/8250/8250_dma.c +index 7046769608d4..ab9096dc3849 100644 +--- a/drivers/tty/serial/8250/8250_dma.c ++++ b/drivers/tty/serial/8250/8250_dma.c +@@ -20,12 +20,15 @@ static void __dma_tx_complete(void *param) + struct uart_8250_port *p = param; + struct uart_8250_dma *dma = p->dma; + struct circ_buf *xmit = &p->port.state->xmit; +- +- dma->tx_running = 0; ++ unsigned long flags; + + dma_sync_single_for_cpu(dma->txchan->device->dev, dma->tx_addr, + UART_XMIT_SIZE, DMA_TO_DEVICE); + ++ spin_lock_irqsave(&p->port.lock, flags); ++ ++ dma->tx_running = 0; ++ + xmit->tail += dma->tx_size; + xmit->tail &= UART_XMIT_SIZE - 1; + p->port.icount.tx += dma->tx_size; +@@ -35,6 +38,8 @@ static void __dma_tx_complete(void *param) + + if (!uart_circ_empty(xmit) && !uart_tx_stopped(&p->port)) + serial8250_tx_dma(p); ++ ++ spin_unlock_irqrestore(&p->port.lock, flags); + } + + static void __dma_rx_complete(void *param) +diff --git a/drivers/usb/gadget/at91_udc.c b/drivers/usb/gadget/at91_udc.c +index 073b938f9135..55e96131753e 100644 +--- a/drivers/usb/gadget/at91_udc.c ++++ b/drivers/usb/gadget/at91_udc.c +@@ -1703,16 +1703,6 @@ static int at91udc_probe(struct platform_device *pdev) + return -ENODEV; + } + +- if (pdev->num_resources != 2) { +- DBG("invalid num_resources\n"); +- return -ENODEV; +- } +- if ((pdev->resource[0].flags != IORESOURCE_MEM) +- || (pdev->resource[1].flags != IORESOURCE_IRQ)) { +- DBG("invalid resource type\n"); +- return -ENODEV; +- } +- + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + if (!res) + return -ENXIO; +diff --git a/drivers/usb/host/ehci-fsl.c b/drivers/usb/host/ehci-fsl.c +index 3c0a49a298dd..bfcf38383f74 100644 +--- a/drivers/usb/host/ehci-fsl.c ++++ b/drivers/usb/host/ehci-fsl.c +@@ -261,7 +261,8 @@ static int ehci_fsl_setup_phy(struct usb_hcd *hcd, + break; + } + +- if (pdata->have_sysif_regs && pdata->controller_ver && ++ if (pdata->have_sysif_regs && ++ pdata->controller_ver > FSL_USB_VER_1_6 && + (phy_mode == FSL_USB2_PHY_ULPI)) { + /* check PHY_CLK_VALID to get phy clk valid */ + if (!spin_event_timeout(in_be32(non_ehci + FSL_SOC_USB_CTRL) & +diff --git a/drivers/usb/host/ohci-hub.c b/drivers/usb/host/ohci-hub.c +index 60ff4220e8b4..cd908066fde9 100644 +--- a/drivers/usb/host/ohci-hub.c ++++ b/drivers/usb/host/ohci-hub.c +@@ -90,6 +90,24 @@ __acquires(ohci->lock) + dl_done_list (ohci); + finish_unlinks (ohci, ohci_frame_no(ohci)); + ++ /* ++ * Some controllers don't handle "global" suspend properly if ++ * there are unsuspended ports. For these controllers, put all ++ * the enabled ports into suspend before suspending the root hub. ++ */ ++ if (ohci->flags & OHCI_QUIRK_GLOBAL_SUSPEND) { ++ __hc32 __iomem *portstat = ohci->regs->roothub.portstatus; ++ int i; ++ unsigned temp; ++ ++ for (i = 0; i < ohci->num_ports; (++i, ++portstat)) { ++ temp = ohci_readl(ohci, portstat); ++ if ((temp & (RH_PS_PES | RH_PS_PSS)) == ++ RH_PS_PES) ++ ohci_writel(ohci, RH_PS_PSS, portstat); ++ } ++ } ++ + /* maybe resume can wake root hub */ + if (ohci_to_hcd(ohci)->self.root_hub->do_remote_wakeup || autostop) { + ohci->hc_control |= OHCI_CTRL_RWE; +diff --git a/drivers/usb/host/ohci-pci.c b/drivers/usb/host/ohci-pci.c +index ef6782bd1fa9..67af8eef6537 100644 +--- a/drivers/usb/host/ohci-pci.c ++++ b/drivers/usb/host/ohci-pci.c +@@ -172,6 +172,7 @@ static int ohci_quirk_amd700(struct usb_hcd *hcd) + pci_dev_put(amd_smbus_dev); + amd_smbus_dev = NULL; + ++ ohci->flags |= OHCI_QUIRK_GLOBAL_SUSPEND; + return 0; + } + +diff --git a/drivers/usb/host/ohci.h b/drivers/usb/host/ohci.h +index d3299143d9e2..f2521f3185d2 100644 +--- a/drivers/usb/host/ohci.h ++++ b/drivers/usb/host/ohci.h +@@ -405,6 +405,8 @@ struct ohci_hcd { + #define OHCI_QUIRK_HUB_POWER 0x100 /* distrust firmware power/oc setup */ + #define OHCI_QUIRK_AMD_PLL 0x200 /* AMD PLL quirk*/ + #define OHCI_QUIRK_AMD_PREFETCH 0x400 /* pre-fetch for ISO transfer */ ++#define OHCI_QUIRK_GLOBAL_SUSPEND 0x800 /* must suspend ports */ ++ + // there are also chip quirks/bugs in init logic + + struct work_struct nec_work; /* Worker for NEC quirk */ +diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c +index 7ed681a714a5..6c0a542e8ec1 100644 +--- a/drivers/usb/serial/qcserial.c ++++ b/drivers/usb/serial/qcserial.c +@@ -151,6 +151,21 @@ static const struct usb_device_id id_table[] = { + {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9051, 0)}, /* Netgear AirCard 340U Device Management */ + {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9051, 2)}, /* Netgear AirCard 340U NMEA */ + {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9051, 3)}, /* Netgear AirCard 340U Modem */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a2, 0)}, /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card Device Management */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a2, 2)}, /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card NMEA */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a2, 3)}, /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card Modem */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a3, 0)}, /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card Device Management */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a3, 2)}, /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card NMEA */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a3, 3)}, /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card Modem */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a4, 0)}, /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card Device Management */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a4, 2)}, /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card NMEA */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a4, 3)}, /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card Modem */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a8, 0)}, /* Dell Wireless 5808 Gobi(TM) 4G LTE Mobile Broadband Card Device Management */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a8, 2)}, /* Dell Wireless 5808 Gobi(TM) 4G LTE Mobile Broadband Card NMEA */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a8, 3)}, /* Dell Wireless 5808 Gobi(TM) 4G LTE Mobile Broadband Card Modem */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a9, 0)}, /* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card Device Management */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a9, 2)}, /* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card NMEA */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a9, 3)}, /* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card Modem */ + + { } /* Terminating entry */ + }; +diff --git a/drivers/usb/storage/shuttle_usbat.c b/drivers/usb/storage/shuttle_usbat.c +index 4ef2a80728f7..008d805c3d21 100644 +--- a/drivers/usb/storage/shuttle_usbat.c ++++ b/drivers/usb/storage/shuttle_usbat.c +@@ -1851,7 +1851,7 @@ static int usbat_probe(struct usb_interface *intf, + us->transport_name = "Shuttle USBAT"; + us->transport = usbat_flash_transport; + us->transport_reset = usb_stor_CB_reset; +- us->max_lun = 1; ++ us->max_lun = 0; + + result = usb_stor_probe2(us); + return result; +diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h +index adbeb255616a..042c83b01046 100644 +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -234,6 +234,20 @@ UNUSUAL_DEV( 0x0421, 0x0495, 0x0370, 0x0370, + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_MAX_SECTORS_64 ), + ++/* Reported by Daniele Forsi */ ++UNUSUAL_DEV( 0x0421, 0x04b9, 0x0350, 0x0350, ++ "Nokia", ++ "5300", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_MAX_SECTORS_64 ), ++ ++/* Patch submitted by Victor A. Santos */ ++UNUSUAL_DEV( 0x0421, 0x05af, 0x0742, 0x0742, ++ "Nokia", ++ "305", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_MAX_SECTORS_64), ++ + /* Patch submitted by Mikhail Zolotaryov */ + UNUSUAL_DEV( 0x0421, 0x06aa, 0x1110, 0x1110, + "Nokia", +diff --git a/fs/exec.c b/fs/exec.c +index bb60cda5ee30..dd6aa61c8548 100644 +--- a/fs/exec.c ++++ b/fs/exec.c +@@ -654,10 +654,10 @@ int setup_arg_pages(struct linux_binprm *bprm, + unsigned long rlim_stack; + + #ifdef CONFIG_STACK_GROWSUP +- /* Limit stack size to 1GB */ ++ /* Limit stack size */ + stack_base = rlimit_max(RLIMIT_STACK); +- if (stack_base > (1 << 30)) +- stack_base = 1 << 30; ++ if (stack_base > STACK_SIZE_MAX) ++ stack_base = STACK_SIZE_MAX; + + /* Make sure we didn't let the argument array grow too large. */ + if (vma->vm_end - vma->vm_start > stack_base) +diff --git a/fs/nfsd/nfs4acl.c b/fs/nfsd/nfs4acl.c +index 8a50b3c18093..e15bcbd5043c 100644 +--- a/fs/nfsd/nfs4acl.c ++++ b/fs/nfsd/nfs4acl.c +@@ -385,8 +385,10 @@ sort_pacl(struct posix_acl *pacl) + * by uid/gid. */ + int i, j; + +- if (pacl->a_count <= 4) +- return; /* no users or groups */ ++ /* no users or groups */ ++ if (!pacl || pacl->a_count <= 4) ++ return; ++ + i = 1; + while (pacl->a_entries[i].e_tag == ACL_USER) + i++; +@@ -513,13 +515,12 @@ posix_state_to_acl(struct posix_acl_state *state, unsigned int flags) + + /* + * ACLs with no ACEs are treated differently in the inheritable +- * and effective cases: when there are no inheritable ACEs, we +- * set a zero-length default posix acl: ++ * and effective cases: when there are no inheritable ACEs, ++ * calls ->set_acl with a NULL ACL structure. + */ +- if (state->empty && (flags & NFS4_ACL_TYPE_DEFAULT)) { +- pacl = posix_acl_alloc(0, GFP_KERNEL); +- return pacl ? pacl : ERR_PTR(-ENOMEM); +- } ++ if (state->empty && (flags & NFS4_ACL_TYPE_DEFAULT)) ++ return NULL; ++ + /* + * When there are no effective ACEs, the following will end + * up setting a 3-element effective posix ACL with all +diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c +index 442509285ca9..ae6a50b7a617 100644 +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -1081,6 +1081,18 @@ static struct nfs4_client *alloc_client(struct xdr_netobj name) + return NULL; + } + clp->cl_name.len = name.len; ++ INIT_LIST_HEAD(&clp->cl_sessions); ++ idr_init(&clp->cl_stateids); ++ atomic_set(&clp->cl_refcount, 0); ++ clp->cl_cb_state = NFSD4_CB_UNKNOWN; ++ INIT_LIST_HEAD(&clp->cl_idhash); ++ INIT_LIST_HEAD(&clp->cl_openowners); ++ INIT_LIST_HEAD(&clp->cl_delegations); ++ INIT_LIST_HEAD(&clp->cl_lru); ++ INIT_LIST_HEAD(&clp->cl_callbacks); ++ INIT_LIST_HEAD(&clp->cl_revoked); ++ spin_lock_init(&clp->cl_lock); ++ rpc_init_wait_queue(&clp->cl_cb_waitq, "Backchannel slot table"); + return clp; + } + +@@ -1098,6 +1110,7 @@ free_client(struct nfs4_client *clp) + WARN_ON_ONCE(atomic_read(&ses->se_ref)); + free_session(ses); + } ++ rpc_destroy_wait_queue(&clp->cl_cb_waitq); + free_svc_cred(&clp->cl_cred); + kfree(clp->cl_name.data); + idr_destroy(&clp->cl_stateids); +@@ -1315,7 +1328,6 @@ static struct nfs4_client *create_client(struct xdr_netobj name, + if (clp == NULL) + return NULL; + +- INIT_LIST_HEAD(&clp->cl_sessions); + ret = copy_cred(&clp->cl_cred, &rqstp->rq_cred); + if (ret) { + spin_lock(&nn->client_lock); +@@ -1323,20 +1335,9 @@ static struct nfs4_client *create_client(struct xdr_netobj name, + spin_unlock(&nn->client_lock); + return NULL; + } +- idr_init(&clp->cl_stateids); +- atomic_set(&clp->cl_refcount, 0); +- clp->cl_cb_state = NFSD4_CB_UNKNOWN; +- INIT_LIST_HEAD(&clp->cl_idhash); +- INIT_LIST_HEAD(&clp->cl_openowners); +- INIT_LIST_HEAD(&clp->cl_delegations); +- INIT_LIST_HEAD(&clp->cl_lru); +- INIT_LIST_HEAD(&clp->cl_callbacks); +- INIT_LIST_HEAD(&clp->cl_revoked); +- spin_lock_init(&clp->cl_lock); + nfsd4_init_callback(&clp->cl_cb_null); + clp->cl_time = get_seconds(); + clear_bit(0, &clp->cl_cb_slot_busy); +- rpc_init_wait_queue(&clp->cl_cb_waitq, "Backchannel slot table"); + copy_verf(clp, verf); + rpc_copy_addr((struct sockaddr *) &clp->cl_addr, sa); + gen_confirm(clp); +@@ -3598,9 +3599,16 @@ out: + static __be32 + nfsd4_free_lock_stateid(struct nfs4_ol_stateid *stp) + { +- if (check_for_locks(stp->st_file, lockowner(stp->st_stateowner))) ++ struct nfs4_lockowner *lo = lockowner(stp->st_stateowner); ++ ++ if (check_for_locks(stp->st_file, lo)) + return nfserr_locks_held; +- release_lock_stateid(stp); ++ /* ++ * Currently there's a 1-1 lock stateid<->lockowner ++ * correspondance, and we have to delete the lockowner when we ++ * delete the lock stateid: ++ */ ++ unhash_lockowner(lo); + return nfs_ok; + } + +@@ -4044,6 +4052,10 @@ static bool same_lockowner_ino(struct nfs4_lockowner *lo, struct inode *inode, c + + if (!same_owner_str(&lo->lo_owner, owner, clid)) + return false; ++ if (list_empty(&lo->lo_owner.so_stateids)) { ++ WARN_ON_ONCE(1); ++ return false; ++ } + lst = list_first_entry(&lo->lo_owner.so_stateids, + struct nfs4_ol_stateid, st_perstateowner); + return lst->st_file->fi_inode == inode; +diff --git a/fs/posix_acl.c b/fs/posix_acl.c +index 8bd2135b7f82..3542f1f814e2 100644 +--- a/fs/posix_acl.c ++++ b/fs/posix_acl.c +@@ -158,6 +158,12 @@ posix_acl_equiv_mode(const struct posix_acl *acl, umode_t *mode_p) + umode_t mode = 0; + int not_equiv = 0; + ++ /* ++ * A null ACL can always be presented as mode bits. ++ */ ++ if (!acl) ++ return 0; ++ + FOREACH_ACL_ENTRY(pa, acl, pe) { + switch (pa->e_tag) { + case ACL_USER_OBJ: +diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h +index 99d0fbcbaf79..7a13848d635c 100644 +--- a/include/linux/ftrace.h ++++ b/include/linux/ftrace.h +@@ -524,6 +524,7 @@ static inline int ftrace_modify_call(struct dyn_ftrace *rec, unsigned long old_a + extern int ftrace_arch_read_dyn_info(char *buf, int size); + + extern int skip_trace(unsigned long ip); ++extern void ftrace_module_init(struct module *mod); + + extern void ftrace_disable_daemon(void); + extern void ftrace_enable_daemon(void); +@@ -533,6 +534,7 @@ static inline int ftrace_force_update(void) { return 0; } + static inline void ftrace_disable_daemon(void) { } + static inline void ftrace_enable_daemon(void) { } + static inline void ftrace_release_mod(struct module *mod) {} ++static inline void ftrace_module_init(struct module *mod) {} + static inline int register_ftrace_command(struct ftrace_func_command *cmd) + { + return -EINVAL; +diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h +index c2559847d7ee..422eac8538fd 100644 +--- a/include/linux/hyperv.h ++++ b/include/linux/hyperv.h +@@ -483,15 +483,18 @@ hv_get_ringbuffer_availbytes(struct hv_ring_buffer_info *rbi, + * 0 . 13 (Windows Server 2008) + * 1 . 1 (Windows 7) + * 2 . 4 (Windows 8) ++ * 3 . 0 (Windows 8 R2) + */ + + #define VERSION_WS2008 ((0 << 16) | (13)) + #define VERSION_WIN7 ((1 << 16) | (1)) + #define VERSION_WIN8 ((2 << 16) | (4)) ++#define VERSION_WIN8_1 ((3 << 16) | (0)) ++ + + #define VERSION_INVAL -1 + +-#define VERSION_CURRENT VERSION_WIN8 ++#define VERSION_CURRENT VERSION_WIN8_1 + + /* Make maximum size of pipe payload of 16K */ + #define MAX_PIPE_DATA_PAYLOAD (sizeof(u8) * 16384) +@@ -894,7 +897,7 @@ struct vmbus_channel_relid_released { + struct vmbus_channel_initiate_contact { + struct vmbus_channel_message_header header; + u32 vmbus_version_requested; +- u32 padding2; ++ u32 target_vcpu; /* The VCPU the host should respond to */ + u64 interrupt_page; + u64 monitor_page1; + u64 monitor_page2; +diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h +index 5fa5afeeb759..6de0f2c14ec0 100644 +--- a/include/linux/interrupt.h ++++ b/include/linux/interrupt.h +@@ -239,7 +239,40 @@ static inline int check_wakeup_irqs(void) { return 0; } + + extern cpumask_var_t irq_default_affinity; + +-extern int irq_set_affinity(unsigned int irq, const struct cpumask *cpumask); ++/* Internal implementation. Use the helpers below */ ++extern int __irq_set_affinity(unsigned int irq, const struct cpumask *cpumask, ++ bool force); ++ ++/** ++ * irq_set_affinity - Set the irq affinity of a given irq ++ * @irq: Interrupt to set affinity ++ * @mask: cpumask ++ * ++ * Fails if cpumask does not contain an online CPU ++ */ ++static inline int ++irq_set_affinity(unsigned int irq, const struct cpumask *cpumask) ++{ ++ return __irq_set_affinity(irq, cpumask, false); ++} ++ ++/** ++ * irq_force_affinity - Force the irq affinity of a given irq ++ * @irq: Interrupt to set affinity ++ * @mask: cpumask ++ * ++ * Same as irq_set_affinity, but without checking the mask against ++ * online cpus. ++ * ++ * Solely for low level cpu hotplug code, where we need to make per ++ * cpu interrupts affine before the cpu becomes online. ++ */ ++static inline int ++irq_force_affinity(unsigned int irq, const struct cpumask *cpumask) ++{ ++ return __irq_set_affinity(irq, cpumask, true); ++} ++ + extern int irq_can_set_affinity(unsigned int irq); + extern int irq_select_affinity(unsigned int irq); + +@@ -275,6 +308,11 @@ static inline int irq_set_affinity(unsigned int irq, const struct cpumask *m) + return -EINVAL; + } + ++static inline int irq_force_affinity(unsigned int irq, const struct cpumask *cpumask) ++{ ++ return 0; ++} ++ + static inline int irq_can_set_affinity(unsigned int irq) + { + return 0; +diff --git a/include/linux/irq.h b/include/linux/irq.h +index bc4e06611958..d591bfe1475b 100644 +--- a/include/linux/irq.h ++++ b/include/linux/irq.h +@@ -375,7 +375,8 @@ extern void remove_percpu_irq(unsigned int irq, struct irqaction *act); + + extern void irq_cpu_online(void); + extern void irq_cpu_offline(void); +-extern int __irq_set_affinity_locked(struct irq_data *data, const struct cpumask *cpumask); ++extern int irq_set_affinity_locked(struct irq_data *data, ++ const struct cpumask *cpumask, bool force); + + #ifdef CONFIG_GENERIC_HARDIRQS + +diff --git a/include/trace/events/module.h b/include/trace/events/module.h +index 161932737416..ca298c7157ae 100644 +--- a/include/trace/events/module.h ++++ b/include/trace/events/module.h +@@ -78,7 +78,7 @@ DECLARE_EVENT_CLASS(module_refcnt, + + TP_fast_assign( + __entry->ip = ip; +- __entry->refcnt = __this_cpu_read(mod->refptr->incs) + __this_cpu_read(mod->refptr->decs); ++ __entry->refcnt = __this_cpu_read(mod->refptr->incs) - __this_cpu_read(mod->refptr->decs); + __assign_str(name, mod->name); + ), + +diff --git a/include/uapi/drm/tegra_drm.h b/include/uapi/drm/tegra_drm.h +index 6e132a2f7420..86b1f9942d0a 100644 +--- a/include/uapi/drm/tegra_drm.h ++++ b/include/uapi/drm/tegra_drm.h +@@ -103,7 +103,6 @@ struct drm_tegra_submit { + __u32 num_waitchks; + __u32 waitchk_mask; + __u32 timeout; +- __u32 pad; + __u64 syncpts; + __u64 cmdbufs; + __u64 relocs; +diff --git a/kernel/futex.c b/kernel/futex.c +index 3bc18bf48d0c..625a4e659e7a 100644 +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -592,6 +592,55 @@ void exit_pi_state_list(struct task_struct *curr) + raw_spin_unlock_irq(&curr->pi_lock); + } + ++/* ++ * We need to check the following states: ++ * ++ * Waiter | pi_state | pi->owner | uTID | uODIED | ? ++ * ++ * [1] NULL | --- | --- | 0 | 0/1 | Valid ++ * [2] NULL | --- | --- | >0 | 0/1 | Valid ++ * ++ * [3] Found | NULL | -- | Any | 0/1 | Invalid ++ * ++ * [4] Found | Found | NULL | 0 | 1 | Valid ++ * [5] Found | Found | NULL | >0 | 1 | Invalid ++ * ++ * [6] Found | Found | task | 0 | 1 | Valid ++ * ++ * [7] Found | Found | NULL | Any | 0 | Invalid ++ * ++ * [8] Found | Found | task | ==taskTID | 0/1 | Valid ++ * [9] Found | Found | task | 0 | 0 | Invalid ++ * [10] Found | Found | task | !=taskTID | 0/1 | Invalid ++ * ++ * [1] Indicates that the kernel can acquire the futex atomically. We ++ * came came here due to a stale FUTEX_WAITERS/FUTEX_OWNER_DIED bit. ++ * ++ * [2] Valid, if TID does not belong to a kernel thread. If no matching ++ * thread is found then it indicates that the owner TID has died. ++ * ++ * [3] Invalid. The waiter is queued on a non PI futex ++ * ++ * [4] Valid state after exit_robust_list(), which sets the user space ++ * value to FUTEX_WAITERS | FUTEX_OWNER_DIED. ++ * ++ * [5] The user space value got manipulated between exit_robust_list() ++ * and exit_pi_state_list() ++ * ++ * [6] Valid state after exit_pi_state_list() which sets the new owner in ++ * the pi_state but cannot access the user space value. ++ * ++ * [7] pi_state->owner can only be NULL when the OWNER_DIED bit is set. ++ * ++ * [8] Owner and user space value match ++ * ++ * [9] There is no transient state which sets the user space TID to 0 ++ * except exit_robust_list(), but this is indicated by the ++ * FUTEX_OWNER_DIED bit. See [4] ++ * ++ * [10] There is no transient state which leaves owner and user space ++ * TID out of sync. ++ */ + static int + lookup_pi_state(u32 uval, struct futex_hash_bucket *hb, + union futex_key *key, struct futex_pi_state **ps) +@@ -607,12 +656,13 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb, + plist_for_each_entry_safe(this, next, head, list) { + if (match_futex(&this->key, key)) { + /* +- * Another waiter already exists - bump up +- * the refcount and return its pi_state: ++ * Sanity check the waiter before increasing ++ * the refcount and attaching to it. + */ + pi_state = this->pi_state; + /* +- * Userspace might have messed up non-PI and PI futexes ++ * Userspace might have messed up non-PI and ++ * PI futexes [3] + */ + if (unlikely(!pi_state)) + return -EINVAL; +@@ -620,34 +670,70 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb, + WARN_ON(!atomic_read(&pi_state->refcount)); + + /* +- * When pi_state->owner is NULL then the owner died +- * and another waiter is on the fly. pi_state->owner +- * is fixed up by the task which acquires +- * pi_state->rt_mutex. +- * +- * We do not check for pid == 0 which can happen when +- * the owner died and robust_list_exit() cleared the +- * TID. ++ * Handle the owner died case: + */ +- if (pid && pi_state->owner) { ++ if (uval & FUTEX_OWNER_DIED) { ++ /* ++ * exit_pi_state_list sets owner to NULL and ++ * wakes the topmost waiter. The task which ++ * acquires the pi_state->rt_mutex will fixup ++ * owner. ++ */ ++ if (!pi_state->owner) { ++ /* ++ * No pi state owner, but the user ++ * space TID is not 0. Inconsistent ++ * state. [5] ++ */ ++ if (pid) ++ return -EINVAL; ++ /* ++ * Take a ref on the state and ++ * return. [4] ++ */ ++ goto out_state; ++ } ++ + /* +- * Bail out if user space manipulated the +- * futex value. ++ * If TID is 0, then either the dying owner ++ * has not yet executed exit_pi_state_list() ++ * or some waiter acquired the rtmutex in the ++ * pi state, but did not yet fixup the TID in ++ * user space. ++ * ++ * Take a ref on the state and return. [6] + */ +- if (pid != task_pid_vnr(pi_state->owner)) ++ if (!pid) ++ goto out_state; ++ } else { ++ /* ++ * If the owner died bit is not set, ++ * then the pi_state must have an ++ * owner. [7] ++ */ ++ if (!pi_state->owner) + return -EINVAL; + } + ++ /* ++ * Bail out if user space manipulated the ++ * futex value. If pi state exists then the ++ * owner TID must be the same as the user ++ * space TID. [9/10] ++ */ ++ if (pid != task_pid_vnr(pi_state->owner)) ++ return -EINVAL; ++ ++ out_state: + atomic_inc(&pi_state->refcount); + *ps = pi_state; +- + return 0; + } + } + + /* + * We are the first waiter - try to look up the real owner and attach +- * the new pi_state to it, but bail out when TID = 0 ++ * the new pi_state to it, but bail out when TID = 0 [1] + */ + if (!pid) + return -ESRCH; +@@ -655,6 +741,11 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb, + if (!p) + return -ESRCH; + ++ if (!p->mm) { ++ put_task_struct(p); ++ return -EPERM; ++ } ++ + /* + * We need to look at the task state flags to figure out, + * whether the task is exiting. To protect against the do_exit +@@ -675,6 +766,9 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb, + return ret; + } + ++ /* ++ * No existing pi state. First waiter. [2] ++ */ + pi_state = alloc_pi_state(); + + /* +@@ -746,10 +840,18 @@ retry: + return -EDEADLK; + + /* +- * Surprise - we got the lock. Just return to userspace: ++ * Surprise - we got the lock, but we do not trust user space at all. + */ +- if (unlikely(!curval)) +- return 1; ++ if (unlikely(!curval)) { ++ /* ++ * We verify whether there is kernel state for this ++ * futex. If not, we can safely assume, that the 0 -> ++ * TID transition is correct. If state exists, we do ++ * not bother to fixup the user space state as it was ++ * corrupted already. ++ */ ++ return futex_top_waiter(hb, key) ? -EINVAL : 1; ++ } + + uval = curval; + +@@ -879,6 +981,7 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this) + struct task_struct *new_owner; + struct futex_pi_state *pi_state = this->pi_state; + u32 uninitialized_var(curval), newval; ++ int ret = 0; + + if (!pi_state) + return -EINVAL; +@@ -902,23 +1005,19 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this) + new_owner = this->task; + + /* +- * We pass it to the next owner. (The WAITERS bit is always +- * kept enabled while there is PI state around. We must also +- * preserve the owner died bit.) ++ * We pass it to the next owner. The WAITERS bit is always ++ * kept enabled while there is PI state around. We cleanup the ++ * owner died bit, because we are the owner. + */ +- if (!(uval & FUTEX_OWNER_DIED)) { +- int ret = 0; ++ newval = FUTEX_WAITERS | task_pid_vnr(new_owner); + +- newval = FUTEX_WAITERS | task_pid_vnr(new_owner); +- +- if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval)) +- ret = -EFAULT; +- else if (curval != uval) +- ret = -EINVAL; +- if (ret) { +- raw_spin_unlock(&pi_state->pi_mutex.wait_lock); +- return ret; +- } ++ if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval)) ++ ret = -EFAULT; ++ else if (curval != uval) ++ ret = -EINVAL; ++ if (ret) { ++ raw_spin_unlock(&pi_state->pi_mutex.wait_lock); ++ return ret; + } + + raw_spin_lock_irq(&pi_state->owner->pi_lock); +@@ -1197,7 +1296,7 @@ void requeue_pi_wake_futex(struct futex_q *q, union futex_key *key, + * + * Return: + * 0 - failed to acquire the lock atomically; +- * 1 - acquired the lock; ++ * >0 - acquired the lock, return value is vpid of the top_waiter + * <0 - error + */ + static int futex_proxy_trylock_atomic(u32 __user *pifutex, +@@ -1208,7 +1307,7 @@ static int futex_proxy_trylock_atomic(u32 __user *pifutex, + { + struct futex_q *top_waiter = NULL; + u32 curval; +- int ret; ++ int ret, vpid; + + if (get_futex_value_locked(&curval, pifutex)) + return -EFAULT; +@@ -1236,11 +1335,13 @@ static int futex_proxy_trylock_atomic(u32 __user *pifutex, + * the contended case or if set_waiters is 1. The pi_state is returned + * in ps in contended cases. + */ ++ vpid = task_pid_vnr(top_waiter->task); + ret = futex_lock_pi_atomic(pifutex, hb2, key2, ps, top_waiter->task, + set_waiters); +- if (ret == 1) ++ if (ret == 1) { + requeue_pi_wake_futex(top_waiter, key2, hb2); +- ++ return vpid; ++ } + return ret; + } + +@@ -1272,10 +1373,16 @@ static int futex_requeue(u32 __user *uaddr1, unsigned int flags, + struct futex_hash_bucket *hb1, *hb2; + struct plist_head *head1; + struct futex_q *this, *next; +- u32 curval2; + + if (requeue_pi) { + /* ++ * Requeue PI only works on two distinct uaddrs. This ++ * check is only valid for private futexes. See below. ++ */ ++ if (uaddr1 == uaddr2) ++ return -EINVAL; ++ ++ /* + * requeue_pi requires a pi_state, try to allocate it now + * without any locks in case it fails. + */ +@@ -1313,6 +1420,15 @@ retry: + if (unlikely(ret != 0)) + goto out_put_key1; + ++ /* ++ * The check above which compares uaddrs is not sufficient for ++ * shared futexes. We need to compare the keys: ++ */ ++ if (requeue_pi && match_futex(&key1, &key2)) { ++ ret = -EINVAL; ++ goto out_put_keys; ++ } ++ + hb1 = hash_futex(&key1); + hb2 = hash_futex(&key2); + +@@ -1358,16 +1474,25 @@ retry_private: + * At this point the top_waiter has either taken uaddr2 or is + * waiting on it. If the former, then the pi_state will not + * exist yet, look it up one more time to ensure we have a +- * reference to it. ++ * reference to it. If the lock was taken, ret contains the ++ * vpid of the top waiter task. + */ +- if (ret == 1) { ++ if (ret > 0) { + WARN_ON(pi_state); + drop_count++; + task_count++; +- ret = get_futex_value_locked(&curval2, uaddr2); +- if (!ret) +- ret = lookup_pi_state(curval2, hb2, &key2, +- &pi_state); ++ /* ++ * If we acquired the lock, then the user ++ * space value of uaddr2 should be vpid. It ++ * cannot be changed by the top waiter as it ++ * is blocked on hb2 lock if it tries to do ++ * so. If something fiddled with it behind our ++ * back the pi state lookup might unearth ++ * it. So we rather use the known value than ++ * rereading and handing potential crap to ++ * lookup_pi_state. ++ */ ++ ret = lookup_pi_state(ret, hb2, &key2, &pi_state); + } + + switch (ret) { +@@ -2137,9 +2262,10 @@ retry: + /* + * To avoid races, try to do the TID -> 0 atomic transition + * again. If it succeeds then we can return without waking +- * anyone else up: ++ * anyone else up. We only try this if neither the waiters nor ++ * the owner died bit are set. + */ +- if (!(uval & FUTEX_OWNER_DIED) && ++ if (!(uval & ~FUTEX_TID_MASK) && + cmpxchg_futex_value_locked(&uval, uaddr, vpid, 0)) + goto pi_faulted; + /* +@@ -2171,11 +2297,9 @@ retry: + /* + * No waiters - kernel unlocks the futex: + */ +- if (!(uval & FUTEX_OWNER_DIED)) { +- ret = unlock_futex_pi(uaddr, uval); +- if (ret == -EFAULT) +- goto pi_faulted; +- } ++ ret = unlock_futex_pi(uaddr, uval); ++ if (ret == -EFAULT) ++ goto pi_faulted; + + out_unlock: + spin_unlock(&hb->lock); +@@ -2334,6 +2458,15 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags, + if (ret) + goto out_key2; + ++ /* ++ * The check above which compares uaddrs is not sufficient for ++ * shared futexes. We need to compare the keys: ++ */ ++ if (match_futex(&q.key, &key2)) { ++ ret = -EINVAL; ++ goto out_put_keys; ++ } ++ + /* Queue the futex_q, drop the hb lock, wait for wakeup. */ + futex_wait_queue_me(hb, &q, to); + +diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c +index 2288fbdada16..aadf4b7a607c 100644 +--- a/kernel/hrtimer.c ++++ b/kernel/hrtimer.c +@@ -245,6 +245,11 @@ again: + goto again; + } + timer->base = new_base; ++ } else { ++ if (cpu != this_cpu && hrtimer_check_target(timer, new_base)) { ++ cpu = this_cpu; ++ goto again; ++ } + } + return new_base; + } +@@ -580,6 +585,23 @@ hrtimer_force_reprogram(struct hrtimer_cpu_base *cpu_base, int skip_equal) + + cpu_base->expires_next.tv64 = expires_next.tv64; + ++ /* ++ * If a hang was detected in the last timer interrupt then we ++ * leave the hang delay active in the hardware. We want the ++ * system to make progress. That also prevents the following ++ * scenario: ++ * T1 expires 50ms from now ++ * T2 expires 5s from now ++ * ++ * T1 is removed, so this code is called and would reprogram ++ * the hardware to 5s from now. Any hrtimer_start after that ++ * will not reprogram the hardware due to hang_detected being ++ * set. So we'd effectivly block all timers until the T2 event ++ * fires. ++ */ ++ if (cpu_base->hang_detected) ++ return; ++ + if (cpu_base->expires_next.tv64 != KTIME_MAX) + tick_program_event(cpu_base->expires_next, 1); + } +@@ -977,11 +999,8 @@ int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim, + /* Remove an active timer from the queue: */ + ret = remove_hrtimer(timer, base); + +- /* Switch the timer base, if necessary: */ +- new_base = switch_hrtimer_base(timer, base, mode & HRTIMER_MODE_PINNED); +- + if (mode & HRTIMER_MODE_REL) { +- tim = ktime_add_safe(tim, new_base->get_time()); ++ tim = ktime_add_safe(tim, base->get_time()); + /* + * CONFIG_TIME_LOW_RES is a temporary way for architectures + * to signal that they simply return xtime in +@@ -996,6 +1015,9 @@ int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim, + + hrtimer_set_expires_range_ns(timer, tim, delta_ns); + ++ /* Switch the timer base, if necessary: */ ++ new_base = switch_hrtimer_base(timer, base, mode & HRTIMER_MODE_PINNED); ++ + timer_stats_hrtimer_set_start_info(timer); + + leftmost = enqueue_hrtimer(timer, new_base); +diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c +index 9bd5c8a6c8ee..8815abfdf2cb 100644 +--- a/kernel/irq/manage.c ++++ b/kernel/irq/manage.c +@@ -150,7 +150,7 @@ int irq_do_set_affinity(struct irq_data *data, const struct cpumask *mask, + struct irq_chip *chip = irq_data_get_irq_chip(data); + int ret; + +- ret = chip->irq_set_affinity(data, mask, false); ++ ret = chip->irq_set_affinity(data, mask, force); + switch (ret) { + case IRQ_SET_MASK_OK: + cpumask_copy(data->affinity, mask); +@@ -162,7 +162,8 @@ int irq_do_set_affinity(struct irq_data *data, const struct cpumask *mask, + return ret; + } + +-int __irq_set_affinity_locked(struct irq_data *data, const struct cpumask *mask) ++int irq_set_affinity_locked(struct irq_data *data, const struct cpumask *mask, ++ bool force) + { + struct irq_chip *chip = irq_data_get_irq_chip(data); + struct irq_desc *desc = irq_data_to_desc(data); +@@ -172,7 +173,7 @@ int __irq_set_affinity_locked(struct irq_data *data, const struct cpumask *mask) + return -EINVAL; + + if (irq_can_move_pcntxt(data)) { +- ret = irq_do_set_affinity(data, mask, false); ++ ret = irq_do_set_affinity(data, mask, force); + } else { + irqd_set_move_pending(data); + irq_copy_pending(desc, mask); +@@ -187,13 +188,7 @@ int __irq_set_affinity_locked(struct irq_data *data, const struct cpumask *mask) + return ret; + } + +-/** +- * irq_set_affinity - Set the irq affinity of a given irq +- * @irq: Interrupt to set affinity +- * @mask: cpumask +- * +- */ +-int irq_set_affinity(unsigned int irq, const struct cpumask *mask) ++int __irq_set_affinity(unsigned int irq, const struct cpumask *mask, bool force) + { + struct irq_desc *desc = irq_to_desc(irq); + unsigned long flags; +@@ -203,7 +198,7 @@ int irq_set_affinity(unsigned int irq, const struct cpumask *mask) + return -EINVAL; + + raw_spin_lock_irqsave(&desc->lock, flags); +- ret = __irq_set_affinity_locked(irq_desc_get_irq_data(desc), mask); ++ ret = irq_set_affinity_locked(irq_desc_get_irq_data(desc), mask, force); + raw_spin_unlock_irqrestore(&desc->lock, flags); + return ret; + } +diff --git a/kernel/module.c b/kernel/module.c +index fa53db8aadeb..10a3af821d28 100644 +--- a/kernel/module.c ++++ b/kernel/module.c +@@ -3279,6 +3279,9 @@ static int load_module(struct load_info *info, const char __user *uargs, + + dynamic_debug_setup(info->debug, info->num_debug); + ++ /* Ftrace init must be called in the MODULE_STATE_UNFORMED state */ ++ ftrace_module_init(mod); ++ + /* Finally it's fully formed, ready to start executing. */ + err = complete_formation(mod, info); + if (err) +diff --git a/kernel/timer.c b/kernel/timer.c +index 15bc1b41021d..20f45ea6f5a4 100644 +--- a/kernel/timer.c ++++ b/kernel/timer.c +@@ -822,7 +822,7 @@ unsigned long apply_slack(struct timer_list *timer, unsigned long expires) + + bit = find_last_bit(&mask, BITS_PER_LONG); + +- mask = (1 << bit) - 1; ++ mask = (1UL << bit) - 1; + + expires_limit = expires_limit & ~(mask); + +diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c +index 4b93b8412252..797d3b91a30b 100644 +--- a/kernel/trace/ftrace.c ++++ b/kernel/trace/ftrace.c +@@ -4222,16 +4222,11 @@ static void ftrace_init_module(struct module *mod, + ftrace_process_locs(mod, start, end); + } + +-static int ftrace_module_notify_enter(struct notifier_block *self, +- unsigned long val, void *data) ++void ftrace_module_init(struct module *mod) + { +- struct module *mod = data; +- +- if (val == MODULE_STATE_COMING) +- ftrace_init_module(mod, mod->ftrace_callsites, +- mod->ftrace_callsites + +- mod->num_ftrace_callsites); +- return 0; ++ ftrace_init_module(mod, mod->ftrace_callsites, ++ mod->ftrace_callsites + ++ mod->num_ftrace_callsites); + } + + static int ftrace_module_notify_exit(struct notifier_block *self, +@@ -4245,11 +4240,6 @@ static int ftrace_module_notify_exit(struct notifier_block *self, + return 0; + } + #else +-static int ftrace_module_notify_enter(struct notifier_block *self, +- unsigned long val, void *data) +-{ +- return 0; +-} + static int ftrace_module_notify_exit(struct notifier_block *self, + unsigned long val, void *data) + { +@@ -4257,11 +4247,6 @@ static int ftrace_module_notify_exit(struct notifier_block *self, + } + #endif /* CONFIG_MODULES */ + +-struct notifier_block ftrace_module_enter_nb = { +- .notifier_call = ftrace_module_notify_enter, +- .priority = INT_MAX, /* Run before anything that can use kprobes */ +-}; +- + struct notifier_block ftrace_module_exit_nb = { + .notifier_call = ftrace_module_notify_exit, + .priority = INT_MIN, /* Run after anything that can remove kprobes */ +@@ -4298,10 +4283,6 @@ void __init ftrace_init(void) + __start_mcount_loc, + __stop_mcount_loc); + +- ret = register_module_notifier(&ftrace_module_enter_nb); +- if (ret) +- pr_warning("Failed to register trace ftrace module enter notifier\n"); +- + ret = register_module_notifier(&ftrace_module_exit_nb); + if (ret) + pr_warning("Failed to register trace ftrace module exit notifier\n"); +diff --git a/kernel/workqueue.c b/kernel/workqueue.c +index db7a6ac7c0a8..652f36dd40de 100644 +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -1881,6 +1881,12 @@ static void send_mayday(struct work_struct *work) + + /* mayday mayday mayday */ + if (list_empty(&pwq->mayday_node)) { ++ /* ++ * If @pwq is for an unbound wq, its base ref may be put at ++ * any time due to an attribute change. Pin @pwq until the ++ * rescuer is done with it. ++ */ ++ get_pwq(pwq); + list_add_tail(&pwq->mayday_node, &wq->maydays); + wake_up_process(wq->rescuer->task); + } +@@ -2356,6 +2362,7 @@ static int rescuer_thread(void *__rescuer) + struct worker *rescuer = __rescuer; + struct workqueue_struct *wq = rescuer->rescue_wq; + struct list_head *scheduled = &rescuer->scheduled; ++ bool should_stop; + + set_user_nice(current, RESCUER_NICE_LEVEL); + +@@ -2367,11 +2374,15 @@ static int rescuer_thread(void *__rescuer) + repeat: + set_current_state(TASK_INTERRUPTIBLE); + +- if (kthread_should_stop()) { +- __set_current_state(TASK_RUNNING); +- rescuer->task->flags &= ~PF_WQ_WORKER; +- return 0; +- } ++ /* ++ * By the time the rescuer is requested to stop, the workqueue ++ * shouldn't have any work pending, but @wq->maydays may still have ++ * pwq(s) queued. This can happen by non-rescuer workers consuming ++ * all the work items before the rescuer got to them. Go through ++ * @wq->maydays processing before acting on should_stop so that the ++ * list is always empty on exit. ++ */ ++ should_stop = kthread_should_stop(); + + /* see whether any pwq is asking for help */ + spin_lock_irq(&wq_mayday_lock); +@@ -2403,6 +2414,12 @@ repeat: + process_scheduled_works(rescuer); + + /* ++ * Put the reference grabbed by send_mayday(). @pool won't ++ * go away while we're holding its lock. ++ */ ++ put_pwq(pwq); ++ ++ /* + * Leave this pool. If keep_working() is %true, notify a + * regular worker; otherwise, we end up with 0 concurrency + * and stalling the execution. +@@ -2417,6 +2434,12 @@ repeat: + + spin_unlock_irq(&wq_mayday_lock); + ++ if (should_stop) { ++ __set_current_state(TASK_RUNNING); ++ rescuer->task->flags &= ~PF_WQ_WORKER; ++ return 0; ++ } ++ + /* rescuers should never participate in concurrency management */ + WARN_ON_ONCE(!(rescuer->flags & WORKER_NOT_RUNNING)); + schedule(); +@@ -4043,7 +4066,8 @@ static void wq_update_unbound_numa(struct workqueue_struct *wq, int cpu, + if (!pwq) { + pr_warning("workqueue: allocation failed while updating NUMA affinity of \"%s\"\n", + wq->name); +- goto out_unlock; ++ mutex_lock(&wq->mutex); ++ goto use_dfl_pwq; + } + + /* +diff --git a/mm/memory-failure.c b/mm/memory-failure.c +index 59c62fa75c5a..4254eb021583 100644 +--- a/mm/memory-failure.c ++++ b/mm/memory-failure.c +@@ -1083,15 +1083,16 @@ int memory_failure(unsigned long pfn, int trapno, int flags) + return 0; + } else if (PageHuge(hpage)) { + /* +- * Check "just unpoisoned", "filter hit", and +- * "race with other subpage." ++ * Check "filter hit" and "race with other subpage." + */ + lock_page(hpage); +- if (!PageHWPoison(hpage) +- || (hwpoison_filter(p) && TestClearPageHWPoison(p)) +- || (p != hpage && TestSetPageHWPoison(hpage))) { +- atomic_long_sub(nr_pages, &num_poisoned_pages); +- return 0; ++ if (PageHWPoison(hpage)) { ++ if ((hwpoison_filter(p) && TestClearPageHWPoison(p)) ++ || (p != hpage && TestSetPageHWPoison(hpage))) { ++ atomic_long_sub(nr_pages, &num_poisoned_pages); ++ unlock_page(hpage); ++ return 0; ++ } + } + set_page_hwpoison_huge_page(hpage); + res = dequeue_hwpoisoned_huge_page(hpage); +diff --git a/mm/memory.c b/mm/memory.c +index 4b60011907d7..ebe0f285c0e7 100644 +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -1937,12 +1937,17 @@ int fixup_user_fault(struct task_struct *tsk, struct mm_struct *mm, + unsigned long address, unsigned int fault_flags) + { + struct vm_area_struct *vma; ++ vm_flags_t vm_flags; + int ret; + + vma = find_extend_vma(mm, address); + if (!vma || address < vma->vm_start) + return -EFAULT; + ++ vm_flags = (fault_flags & FAULT_FLAG_WRITE) ? VM_WRITE : VM_READ; ++ if (!(vm_flags & vma->vm_flags)) ++ return -EFAULT; ++ + ret = handle_mm_fault(mm, vma, address, fault_flags); + if (ret & VM_FAULT_ERROR) { + if (ret & VM_FAULT_OOM) +diff --git a/mm/mremap.c b/mm/mremap.c +index 463a25705ac6..2201d060c31b 100644 +--- a/mm/mremap.c ++++ b/mm/mremap.c +@@ -175,10 +175,17 @@ unsigned long move_page_tables(struct vm_area_struct *vma, + break; + if (pmd_trans_huge(*old_pmd)) { + int err = 0; +- if (extent == HPAGE_PMD_SIZE) ++ if (extent == HPAGE_PMD_SIZE) { ++ VM_BUG_ON(vma->vm_file || !vma->anon_vma); ++ /* See comment in move_ptes() */ ++ if (need_rmap_locks) ++ anon_vma_lock_write(vma->anon_vma); + err = move_huge_pmd(vma, new_vma, old_addr, + new_addr, old_end, + old_pmd, new_pmd); ++ if (need_rmap_locks) ++ anon_vma_unlock_write(vma->anon_vma); ++ } + if (err > 0) { + need_flush = true; + continue; +diff --git a/mm/percpu.c b/mm/percpu.c +index 8c8e08f3a692..25e2ea52db82 100644 +--- a/mm/percpu.c ++++ b/mm/percpu.c +@@ -612,7 +612,7 @@ static struct pcpu_chunk *pcpu_alloc_chunk(void) + chunk->map = pcpu_mem_zalloc(PCPU_DFL_MAP_ALLOC * + sizeof(chunk->map[0])); + if (!chunk->map) { +- kfree(chunk); ++ pcpu_mem_free(chunk, pcpu_chunk_struct_size); + return NULL; + } + +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index 6c7f36379722..4c51c055d00f 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -652,14 +652,17 @@ static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type) + if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) { + struct hci_cp_auth_requested cp; + +- /* encrypt must be pending if auth is also pending */ +- set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags); +- + cp.handle = cpu_to_le16(conn->handle); + hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED, + sizeof(cp), &cp); ++ ++ /* If we're already encrypted set the REAUTH_PEND flag, ++ * otherwise set the ENCRYPT_PEND. ++ */ + if (conn->key_type != 0xff) + set_bit(HCI_CONN_REAUTH_PEND, &conn->flags); ++ else ++ set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags); + } + + return 0; +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index cfca44f8d048..ab2ec7c414cb 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -3051,6 +3051,12 @@ static void hci_key_refresh_complete_evt(struct hci_dev *hdev, + if (!conn) + goto unlock; + ++ /* For BR/EDR the necessary steps are taken through the ++ * auth_complete event. ++ */ ++ if (conn->type != LE_LINK) ++ goto unlock; ++ + if (!ev->status) + conn->sec_level = conn->pending_sec_level; + +diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c +index eb0a46a49bd4..b9d7df175700 100644 +--- a/net/ceph/messenger.c ++++ b/net/ceph/messenger.c +@@ -556,7 +556,7 @@ static int ceph_tcp_sendmsg(struct socket *sock, struct kvec *iov, + return r; + } + +-static int ceph_tcp_sendpage(struct socket *sock, struct page *page, ++static int __ceph_tcp_sendpage(struct socket *sock, struct page *page, + int offset, size_t size, bool more) + { + int flags = MSG_DONTWAIT | MSG_NOSIGNAL | (more ? MSG_MORE : MSG_EOR); +@@ -569,6 +569,24 @@ static int ceph_tcp_sendpage(struct socket *sock, struct page *page, + return ret; + } + ++static int ceph_tcp_sendpage(struct socket *sock, struct page *page, ++ int offset, size_t size, bool more) ++{ ++ int ret; ++ struct kvec iov; ++ ++ /* sendpage cannot properly handle pages with page_count == 0, ++ * we need to fallback to sendmsg if that's the case */ ++ if (page_count(page) >= 1) ++ return __ceph_tcp_sendpage(sock, page, offset, size, more); ++ ++ iov.iov_base = kmap(page) + offset; ++ iov.iov_len = size; ++ ret = ceph_tcp_sendmsg(sock, &iov, 1, size, more); ++ kunmap(page); ++ ++ return ret; ++} + + /* + * Shutdown/close the socket for the given connection. +diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h +index 92ef04c72c51..845563b81a0f 100644 +--- a/net/mac80211/ieee80211_i.h ++++ b/net/mac80211/ieee80211_i.h +@@ -311,6 +311,7 @@ struct ieee80211_roc_work { + + bool started, abort, hw_begun, notified; + bool to_be_freed; ++ bool on_channel; + + unsigned long hw_start_time; + +@@ -1270,6 +1271,7 @@ void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata); + void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata); + void ieee80211_mgd_conn_tx_status(struct ieee80211_sub_if_data *sdata, + __le16 fc, bool acked); ++void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata); + void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata); + + /* IBSS code */ +diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c +index 49bc2246bd86..fc94937cd7b3 100644 +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -3754,6 +3754,32 @@ static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata) + } + + #ifdef CONFIG_PM ++void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata) ++{ ++ struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; ++ u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN]; ++ ++ mutex_lock(&ifmgd->mtx); ++ ++ if (ifmgd->auth_data) { ++ /* ++ * If we are trying to authenticate while suspending, cfg80211 ++ * won't know and won't actually abort those attempts, thus we ++ * need to do that ourselves. ++ */ ++ ieee80211_send_deauth_disassoc(sdata, ++ ifmgd->auth_data->bss->bssid, ++ IEEE80211_STYPE_DEAUTH, ++ WLAN_REASON_DEAUTH_LEAVING, ++ false, frame_buf); ++ ieee80211_destroy_auth_data(sdata, false); ++ cfg80211_send_deauth(sdata->dev, frame_buf, ++ IEEE80211_DEAUTH_FRAME_LEN); ++ } ++ ++ mutex_unlock(&ifmgd->mtx); ++} ++ + void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata) + { + struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; +diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c +index 11d3f227e11e..0427a58b4397 100644 +--- a/net/mac80211/offchannel.c ++++ b/net/mac80211/offchannel.c +@@ -333,7 +333,7 @@ void ieee80211_sw_roc_work(struct work_struct *work) + container_of(work, struct ieee80211_roc_work, work.work); + struct ieee80211_sub_if_data *sdata = roc->sdata; + struct ieee80211_local *local = sdata->local; +- bool started; ++ bool started, on_channel; + + mutex_lock(&local->mtx); + +@@ -354,14 +354,24 @@ void ieee80211_sw_roc_work(struct work_struct *work) + if (!roc->started) { + struct ieee80211_roc_work *dep; + +- /* start this ROC */ +- ieee80211_offchannel_stop_vifs(local); ++ WARN_ON(local->use_chanctx); ++ ++ /* If actually operating on the desired channel (with at least ++ * 20 MHz channel width) don't stop all the operations but still ++ * treat it as though the ROC operation started properly, so ++ * other ROC operations won't interfere with this one. ++ */ ++ roc->on_channel = roc->chan == local->_oper_chandef.chan; + +- /* switch channel etc */ ++ /* start this ROC */ + ieee80211_recalc_idle(local); + +- local->tmp_channel = roc->chan; +- ieee80211_hw_config(local, 0); ++ if (!roc->on_channel) { ++ ieee80211_offchannel_stop_vifs(local); ++ ++ local->tmp_channel = roc->chan; ++ ieee80211_hw_config(local, 0); ++ } + + /* tell userspace or send frame */ + ieee80211_handle_roc_started(roc); +@@ -380,9 +390,10 @@ void ieee80211_sw_roc_work(struct work_struct *work) + finish: + list_del(&roc->list); + started = roc->started; ++ on_channel = roc->on_channel; + ieee80211_roc_notify_destroy(roc, !roc->abort); + +- if (started) { ++ if (started && !on_channel) { + ieee80211_flush_queues(local, NULL); + + local->tmp_channel = NULL; +diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c +index 340126204343..efb510e6f206 100644 +--- a/net/mac80211/pm.c ++++ b/net/mac80211/pm.c +@@ -101,10 +101,18 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan) + + /* remove all interfaces that were created in the driver */ + list_for_each_entry(sdata, &local->interfaces, list) { +- if (!ieee80211_sdata_running(sdata) || +- sdata->vif.type == NL80211_IFTYPE_AP_VLAN || +- sdata->vif.type == NL80211_IFTYPE_MONITOR) ++ if (!ieee80211_sdata_running(sdata)) + continue; ++ switch (sdata->vif.type) { ++ case NL80211_IFTYPE_AP_VLAN: ++ case NL80211_IFTYPE_MONITOR: ++ continue; ++ case NL80211_IFTYPE_STATION: ++ ieee80211_mgd_quiesce(sdata); ++ break; ++ default: ++ break; ++ } + + drv_remove_interface(local, sdata); + } +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index 5f055d7ee85b..1800db643a16 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -3856,6 +3856,9 @@ static DEFINE_PCI_DEVICE_TABLE(azx_ids) = { + /* Lynx Point */ + { PCI_DEVICE(0x8086, 0x8c20), + .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH }, ++ /* 9 Series */ ++ { PCI_DEVICE(0x8086, 0x8ca0), ++ .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH }, + /* Wellsburg */ + { PCI_DEVICE(0x8086, 0x8d20), + .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH }, +diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c +index e3cd86514cea..1ae1f8bd9c36 100644 +--- a/sound/soc/codecs/wm8962.c ++++ b/sound/soc/codecs/wm8962.c +@@ -153,6 +153,7 @@ static struct reg_default wm8962_reg[] = { + { 40, 0x0000 }, /* R40 - SPKOUTL volume */ + { 41, 0x0000 }, /* R41 - SPKOUTR volume */ + ++ { 49, 0x0010 }, /* R49 - Class D Control 1 */ + { 51, 0x0003 }, /* R51 - Class D Control 2 */ + + { 56, 0x0506 }, /* R56 - Clocking 4 */ +@@ -794,7 +795,6 @@ static bool wm8962_volatile_register(struct device *dev, unsigned int reg) + case WM8962_ALC2: + case WM8962_THERMAL_SHUTDOWN_STATUS: + case WM8962_ADDITIONAL_CONTROL_4: +- case WM8962_CLASS_D_CONTROL_1: + case WM8962_DC_SERVO_6: + case WM8962_INTERRUPT_STATUS_1: + case WM8962_INTERRUPT_STATUS_2: +@@ -2901,13 +2901,22 @@ static int wm8962_set_fll(struct snd_soc_codec *codec, int fll_id, int source, + static int wm8962_mute(struct snd_soc_dai *dai, int mute) + { + struct snd_soc_codec *codec = dai->codec; +- int val; ++ int val, ret; + + if (mute) +- val = WM8962_DAC_MUTE; ++ val = WM8962_DAC_MUTE | WM8962_DAC_MUTE_ALT; + else + val = 0; + ++ /** ++ * The DAC mute bit is mirrored in two registers, update both to keep ++ * the register cache consistent. ++ */ ++ ret = snd_soc_update_bits(codec, WM8962_CLASS_D_CONTROL_1, ++ WM8962_DAC_MUTE_ALT, val); ++ if (ret < 0) ++ return ret; ++ + return snd_soc_update_bits(codec, WM8962_ADC_DAC_CONTROL_1, + WM8962_DAC_MUTE, val); + } +diff --git a/sound/soc/codecs/wm8962.h b/sound/soc/codecs/wm8962.h +index a1a5d5294c19..910aafd09d21 100644 +--- a/sound/soc/codecs/wm8962.h ++++ b/sound/soc/codecs/wm8962.h +@@ -1954,6 +1954,10 @@ + #define WM8962_SPKOUTL_ENA_MASK 0x0040 /* SPKOUTL_ENA */ + #define WM8962_SPKOUTL_ENA_SHIFT 6 /* SPKOUTL_ENA */ + #define WM8962_SPKOUTL_ENA_WIDTH 1 /* SPKOUTL_ENA */ ++#define WM8962_DAC_MUTE_ALT 0x0010 /* DAC_MUTE */ ++#define WM8962_DAC_MUTE_ALT_MASK 0x0010 /* DAC_MUTE */ ++#define WM8962_DAC_MUTE_ALT_SHIFT 4 /* DAC_MUTE */ ++#define WM8962_DAC_MUTE_ALT_WIDTH 1 /* DAC_MUTE */ + #define WM8962_SPKOUTL_PGA_MUTE 0x0002 /* SPKOUTL_PGA_MUTE */ + #define WM8962_SPKOUTL_PGA_MUTE_MASK 0x0002 /* SPKOUTL_PGA_MUTE */ + #define WM8962_SPKOUTL_PGA_MUTE_SHIFT 1 /* SPKOUTL_PGA_MUTE */ +diff --git a/sound/usb/card.h b/sound/usb/card.h +index bf2889a2cae5..82c2d80c8228 100644 +--- a/sound/usb/card.h ++++ b/sound/usb/card.h +@@ -90,6 +90,7 @@ struct snd_usb_endpoint { + unsigned int curframesize; /* current packet size in frames (for capture) */ + unsigned int syncmaxsize; /* sync endpoint packet size */ + unsigned int fill_max:1; /* fill max packet size always */ ++ unsigned int udh01_fb_quirk:1; /* corrupted feedback data */ + unsigned int datainterval; /* log_2 of data packet interval */ + unsigned int syncinterval; /* P for adaptive mode, 0 otherwise */ + unsigned char silence_value; +diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c +index 659950e5b94f..308c02b2a597 100644 +--- a/sound/usb/endpoint.c ++++ b/sound/usb/endpoint.c +@@ -467,6 +467,10 @@ struct snd_usb_endpoint *snd_usb_add_endpoint(struct snd_usb_audio *chip, + ep->syncinterval = 3; + + ep->syncmaxsize = le16_to_cpu(get_endpoint(alts, 1)->wMaxPacketSize); ++ ++ if (chip->usb_id == USB_ID(0x0644, 0x8038) /* TEAC UD-H01 */ && ++ ep->syncmaxsize == 4) ++ ep->udh01_fb_quirk = 1; + } + + list_add_tail(&ep->list, &chip->ep_list); +@@ -1075,7 +1079,16 @@ void snd_usb_handle_sync_urb(struct snd_usb_endpoint *ep, + if (f == 0) + return; + +- if (unlikely(ep->freqshift == INT_MIN)) { ++ if (unlikely(sender->udh01_fb_quirk)) { ++ /* ++ * The TEAC UD-H01 firmware sometimes changes the feedback value ++ * by +/- 0x1.0000. ++ */ ++ if (f < ep->freqn - 0x8000) ++ f += 0x10000; ++ else if (f > ep->freqn + 0x8000) ++ f -= 0x10000; ++ } else if (unlikely(ep->freqshift == INT_MIN)) { + /* + * The first time we see a feedback value, determine its format + * by shifting it left or right until it matches the nominal diff --git a/projects/Cuboxi/patches/linux/linux-000-patch-3.10.42-43.patch b/projects/Cuboxi/patches/linux/linux-000-patch-3.10.42-43.patch new file mode 100644 index 0000000000..145ab2a290 --- /dev/null +++ b/projects/Cuboxi/patches/linux/linux-000-patch-3.10.42-43.patch @@ -0,0 +1,1387 @@ +diff --git a/Documentation/DocBook/media/Makefile b/Documentation/DocBook/media/Makefile +index f9fd615427fb..1d27f0a1abd1 100644 +--- a/Documentation/DocBook/media/Makefile ++++ b/Documentation/DocBook/media/Makefile +@@ -195,7 +195,7 @@ DVB_DOCUMENTED = \ + # + + install_media_images = \ +- $(Q)cp $(OBJIMGFILES) $(MEDIA_SRC_DIR)/v4l/*.svg $(MEDIA_OBJ_DIR)/media_api ++ $(Q)-cp $(OBJIMGFILES) $(MEDIA_SRC_DIR)/v4l/*.svg $(MEDIA_OBJ_DIR)/media_api + + $(MEDIA_OBJ_DIR)/%: $(MEDIA_SRC_DIR)/%.b64 + $(Q)base64 -d $< >$@ +diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt +index 9b34b1685078..8d90c42e5db6 100644 +--- a/Documentation/sysctl/kernel.txt ++++ b/Documentation/sysctl/kernel.txt +@@ -438,6 +438,32 @@ This file shows up if CONFIG_DEBUG_STACKOVERFLOW is enabled. + + ============================================================== + ++perf_cpu_time_max_percent: ++ ++Hints to the kernel how much CPU time it should be allowed to ++use to handle perf sampling events. If the perf subsystem ++is informed that its samples are exceeding this limit, it ++will drop its sampling frequency to attempt to reduce its CPU ++usage. ++ ++Some perf sampling happens in NMIs. If these samples ++unexpectedly take too long to execute, the NMIs can become ++stacked up next to each other so much that nothing else is ++allowed to execute. ++ ++0: disable the mechanism. Do not monitor or correct perf's ++ sampling rate no matter how CPU time it takes. ++ ++1-100: attempt to throttle perf's sample rate to this ++ percentage of CPU. Note: the kernel calculates an ++ "expected" length of each sample event. 100 here means ++ 100% of that expected length. Even if this is set to ++ 100, you may still see sample throttling if this ++ length is exceeded. Set to 0 if you truly do not care ++ how much CPU is consumed. ++ ++============================================================== ++ + + pid_max: + +diff --git a/Makefile b/Makefile +index 4634015fed68..9cf513828341 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 10 +-SUBLEVEL = 42 ++SUBLEVEL = 43 + EXTRAVERSION = + NAME = TOSSUG Baby Fish + +diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h +index 7e1f76027f66..20e1c994669e 100644 +--- a/arch/arm/include/asm/uaccess.h ++++ b/arch/arm/include/asm/uaccess.h +@@ -164,8 +164,9 @@ extern int __put_user_8(void *, unsigned long long); + #define __put_user_check(x,p) \ + ({ \ + unsigned long __limit = current_thread_info()->addr_limit - 1; \ ++ const typeof(*(p)) __user *__tmp_p = (p); \ + register const typeof(*(p)) __r2 asm("r2") = (x); \ +- register const typeof(*(p)) __user *__p asm("r0") = (p);\ ++ register const typeof(*(p)) __user *__p asm("r0") = __tmp_p; \ + register unsigned long __l asm("r1") = __limit; \ + register int __e asm("r0"); \ + switch (sizeof(*(__p))) { \ +diff --git a/arch/arm/kernel/perf_event.c b/arch/arm/kernel/perf_event.c +index e19edc6f2d15..ace0ce8f6641 100644 +--- a/arch/arm/kernel/perf_event.c ++++ b/arch/arm/kernel/perf_event.c +@@ -303,11 +303,18 @@ static irqreturn_t armpmu_dispatch_irq(int irq, void *dev) + struct arm_pmu *armpmu = (struct arm_pmu *) dev; + struct platform_device *plat_device = armpmu->plat_device; + struct arm_pmu_platdata *plat = dev_get_platdata(&plat_device->dev); ++ int ret; ++ u64 start_clock, finish_clock; + ++ start_clock = sched_clock(); + if (plat && plat->handle_irq) +- return plat->handle_irq(irq, dev, armpmu->handle_irq); ++ ret = plat->handle_irq(irq, dev, armpmu->handle_irq); + else +- return armpmu->handle_irq(irq, dev); ++ ret = armpmu->handle_irq(irq, dev); ++ finish_clock = sched_clock(); ++ ++ perf_sample_event_took(finish_clock - start_clock); ++ return ret; + } + + static void +diff --git a/arch/arm/mach-imx/devices/platform-ipu-core.c b/arch/arm/mach-imx/devices/platform-ipu-core.c +index fc4dd7cedc11..6bd7c3f37ac0 100644 +--- a/arch/arm/mach-imx/devices/platform-ipu-core.c ++++ b/arch/arm/mach-imx/devices/platform-ipu-core.c +@@ -77,7 +77,7 @@ struct platform_device *__init imx_alloc_mx3_camera( + + pdev = platform_device_alloc("mx3-camera", 0); + if (!pdev) +- goto err; ++ return ERR_PTR(-ENOMEM); + + pdev->dev.dma_mask = kmalloc(sizeof(*pdev->dev.dma_mask), GFP_KERNEL); + if (!pdev->dev.dma_mask) +diff --git a/arch/arm/mach-omap2/cclock3xxx_data.c b/arch/arm/mach-omap2/cclock3xxx_data.c +index 45cd26430d1f..da6d407c21cd 100644 +--- a/arch/arm/mach-omap2/cclock3xxx_data.c ++++ b/arch/arm/mach-omap2/cclock3xxx_data.c +@@ -418,7 +418,8 @@ static struct clk_hw_omap dpll4_m5x2_ck_hw = { + .clkdm_name = "dpll4_clkdm", + }; + +-DEFINE_STRUCT_CLK(dpll4_m5x2_ck, dpll4_m5x2_ck_parent_names, dpll4_m5x2_ck_ops); ++DEFINE_STRUCT_CLK_FLAGS(dpll4_m5x2_ck, dpll4_m5x2_ck_parent_names, ++ dpll4_m5x2_ck_ops, CLK_SET_RATE_PARENT); + + static struct clk dpll4_m5x2_ck_3630 = { + .name = "dpll4_m5x2_ck", +diff --git a/arch/arm/mach-omap2/cpuidle44xx.c b/arch/arm/mach-omap2/cpuidle44xx.c +index c443f2e97e10..f98410a257e3 100644 +--- a/arch/arm/mach-omap2/cpuidle44xx.c ++++ b/arch/arm/mach-omap2/cpuidle44xx.c +@@ -14,6 +14,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -80,6 +81,7 @@ static int omap_enter_idle_coupled(struct cpuidle_device *dev, + int index) + { + struct idle_statedata *cx = state_ptr + index; ++ int cpu_id = smp_processor_id(); + + /* + * CPU0 has to wait and stay ON until CPU1 is OFF state. +@@ -104,6 +106,8 @@ static int omap_enter_idle_coupled(struct cpuidle_device *dev, + } + } + ++ clockevents_notify(CLOCK_EVT_NOTIFY_BROADCAST_ENTER, &cpu_id); ++ + /* + * Call idle CPU PM enter notifier chain so that + * VFP and per CPU interrupt context is saved. +@@ -147,6 +151,8 @@ static int omap_enter_idle_coupled(struct cpuidle_device *dev, + (cx->mpu_logic_state == PWRDM_POWER_OFF)) + cpu_cluster_pm_exit(); + ++ clockevents_notify(CLOCK_EVT_NOTIFY_BROADCAST_EXIT, &cpu_id); ++ + fail: + cpuidle_coupled_parallel_barrier(dev, &abort_barrier); + cpu_done[dev->cpu] = false; +@@ -154,6 +160,16 @@ fail: + return index; + } + ++/* ++ * For each cpu, setup the broadcast timer because local timers ++ * stops for the states above C1. ++ */ ++static void omap_setup_broadcast_timer(void *arg) ++{ ++ int cpu = smp_processor_id(); ++ clockevents_notify(CLOCK_EVT_NOTIFY_BROADCAST_ON, &cpu); ++} ++ + static struct cpuidle_driver omap4_idle_driver = { + .name = "omap4_idle", + .owner = THIS_MODULE, +@@ -171,8 +187,7 @@ static struct cpuidle_driver omap4_idle_driver = { + /* C2 - CPU0 OFF + CPU1 OFF + MPU CSWR */ + .exit_latency = 328 + 440, + .target_residency = 960, +- .flags = CPUIDLE_FLAG_TIME_VALID | CPUIDLE_FLAG_COUPLED | +- CPUIDLE_FLAG_TIMER_STOP, ++ .flags = CPUIDLE_FLAG_TIME_VALID | CPUIDLE_FLAG_COUPLED, + .enter = omap_enter_idle_coupled, + .name = "C2", + .desc = "CPUx OFF, MPUSS CSWR", +@@ -181,8 +196,7 @@ static struct cpuidle_driver omap4_idle_driver = { + /* C3 - CPU0 OFF + CPU1 OFF + MPU OSWR */ + .exit_latency = 460 + 518, + .target_residency = 1100, +- .flags = CPUIDLE_FLAG_TIME_VALID | CPUIDLE_FLAG_COUPLED | +- CPUIDLE_FLAG_TIMER_STOP, ++ .flags = CPUIDLE_FLAG_TIME_VALID | CPUIDLE_FLAG_COUPLED, + .enter = omap_enter_idle_coupled, + .name = "C3", + .desc = "CPUx OFF, MPUSS OSWR", +@@ -213,5 +227,8 @@ int __init omap4_idle_init(void) + if (!cpu_clkdm[0] || !cpu_clkdm[1]) + return -ENODEV; + ++ /* Configure the broadcast timer on each cpu */ ++ on_each_cpu(omap_setup_broadcast_timer, NULL, 1); ++ + return cpuidle_register(&omap4_idle_driver, cpu_online_mask); + } +diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c +index a69b67d968d4..123d9e2271dc 100644 +--- a/arch/x86/kernel/cpu/perf_event.c ++++ b/arch/x86/kernel/cpu/perf_event.c +@@ -1252,10 +1252,20 @@ void perf_events_lapic_init(void) + static int __kprobes + perf_event_nmi_handler(unsigned int cmd, struct pt_regs *regs) + { ++ int ret; ++ u64 start_clock; ++ u64 finish_clock; ++ + if (!atomic_read(&active_events)) + return NMI_DONE; + +- return x86_pmu.handle_irq(regs); ++ start_clock = local_clock(); ++ ret = x86_pmu.handle_irq(regs); ++ finish_clock = local_clock(); ++ ++ perf_sample_event_took(finish_clock - start_clock); ++ ++ return ret; + } + + struct event_constraint emptyconstraint; +diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c +index 117ce3813681..6416d0d07394 100644 +--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c ++++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c +@@ -635,9 +635,9 @@ i915_gem_execbuffer_relocate_slow(struct drm_device *dev, + * relocations were valid. + */ + for (j = 0; j < exec[i].relocation_count; j++) { +- if (copy_to_user(&user_relocs[j].presumed_offset, +- &invalid_offset, +- sizeof(invalid_offset))) { ++ if (__copy_to_user(&user_relocs[j].presumed_offset, ++ &invalid_offset, ++ sizeof(invalid_offset))) { + ret = -EFAULT; + mutex_lock(&dev->struct_mutex); + goto err; +@@ -1151,18 +1151,21 @@ i915_gem_execbuffer(struct drm_device *dev, void *data, + + ret = i915_gem_do_execbuffer(dev, data, file, &exec2, exec2_list); + if (!ret) { ++ struct drm_i915_gem_exec_object __user *user_exec_list = ++ to_user_ptr(args->buffers_ptr); ++ + /* Copy the new buffer offsets back to the user's exec list. */ +- for (i = 0; i < args->buffer_count; i++) +- exec_list[i].offset = exec2_list[i].offset; +- /* ... and back out to userspace */ +- ret = copy_to_user(to_user_ptr(args->buffers_ptr), +- exec_list, +- sizeof(*exec_list) * args->buffer_count); +- if (ret) { +- ret = -EFAULT; +- DRM_DEBUG("failed to copy %d exec entries " +- "back to user (%d)\n", +- args->buffer_count, ret); ++ for (i = 0; i < args->buffer_count; i++) { ++ ret = __copy_to_user(&user_exec_list[i].offset, ++ &exec2_list[i].offset, ++ sizeof(user_exec_list[i].offset)); ++ if (ret) { ++ ret = -EFAULT; ++ DRM_DEBUG("failed to copy %d exec entries " ++ "back to user (%d)\n", ++ args->buffer_count, ret); ++ break; ++ } + } + } + +@@ -1208,14 +1211,21 @@ i915_gem_execbuffer2(struct drm_device *dev, void *data, + ret = i915_gem_do_execbuffer(dev, data, file, args, exec2_list); + if (!ret) { + /* Copy the new buffer offsets back to the user's exec list. */ +- ret = copy_to_user(to_user_ptr(args->buffers_ptr), +- exec2_list, +- sizeof(*exec2_list) * args->buffer_count); +- if (ret) { +- ret = -EFAULT; +- DRM_DEBUG("failed to copy %d exec entries " +- "back to user (%d)\n", +- args->buffer_count, ret); ++ struct drm_i915_gem_exec_object2 *user_exec_list = ++ to_user_ptr(args->buffers_ptr); ++ int i; ++ ++ for (i = 0; i < args->buffer_count; i++) { ++ ret = __copy_to_user(&user_exec_list[i].offset, ++ &exec2_list[i].offset, ++ sizeof(user_exec_list[i].offset)); ++ if (ret) { ++ ret = -EFAULT; ++ DRM_DEBUG("failed to copy %d exec entries " ++ "back to user\n", ++ args->buffer_count); ++ break; ++ } + } + } + +diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/nvd0.c b/drivers/gpu/drm/nouveau/core/engine/disp/nvd0.c +index 019eacd8a68f..9ee40042fa3a 100644 +--- a/drivers/gpu/drm/nouveau/core/engine/disp/nvd0.c ++++ b/drivers/gpu/drm/nouveau/core/engine/disp/nvd0.c +@@ -679,7 +679,7 @@ exec_clkcmp(struct nv50_disp_priv *priv, int head, int id, + } + + if (outp == 8) +- return false; ++ return conf; + + data = exec_lookup(priv, head, outp, ctrl, dcb, &ver, &hdr, &cnt, &len, &info1); + if (data == 0x0000) +diff --git a/drivers/gpu/drm/radeon/radeon_bios.c b/drivers/gpu/drm/radeon/radeon_bios.c +index 061b227dae0c..b131520521e4 100644 +--- a/drivers/gpu/drm/radeon/radeon_bios.c ++++ b/drivers/gpu/drm/radeon/radeon_bios.c +@@ -196,6 +196,20 @@ static bool radeon_atrm_get_bios(struct radeon_device *rdev) + } + } + ++ if (!found) { ++ while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_OTHER << 8, pdev)) != NULL) { ++ dhandle = ACPI_HANDLE(&pdev->dev); ++ if (!dhandle) ++ continue; ++ ++ status = acpi_get_handle(dhandle, "ATRM", &atrm_handle); ++ if (!ACPI_FAILURE(status)) { ++ found = true; ++ break; ++ } ++ } ++ } ++ + if (!found) + return false; + +diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c +index 1424ccde2377..f83727915787 100644 +--- a/drivers/gpu/drm/radeon/radeon_object.c ++++ b/drivers/gpu/drm/radeon/radeon_object.c +@@ -582,22 +582,30 @@ int radeon_bo_fault_reserve_notify(struct ttm_buffer_object *bo) + rbo = container_of(bo, struct radeon_bo, tbo); + radeon_bo_check_tiling(rbo, 0, 0); + rdev = rbo->rdev; +- if (bo->mem.mem_type == TTM_PL_VRAM) { +- size = bo->mem.num_pages << PAGE_SHIFT; +- offset = bo->mem.start << PAGE_SHIFT; +- if ((offset + size) > rdev->mc.visible_vram_size) { +- /* hurrah the memory is not visible ! */ +- radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_VRAM); +- rbo->placement.lpfn = rdev->mc.visible_vram_size >> PAGE_SHIFT; +- r = ttm_bo_validate(bo, &rbo->placement, false, false); +- if (unlikely(r != 0)) +- return r; +- offset = bo->mem.start << PAGE_SHIFT; +- /* this should not happen */ +- if ((offset + size) > rdev->mc.visible_vram_size) +- return -EINVAL; +- } ++ if (bo->mem.mem_type != TTM_PL_VRAM) ++ return 0; ++ ++ size = bo->mem.num_pages << PAGE_SHIFT; ++ offset = bo->mem.start << PAGE_SHIFT; ++ if ((offset + size) <= rdev->mc.visible_vram_size) ++ return 0; ++ ++ /* hurrah the memory is not visible ! */ ++ radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_VRAM); ++ rbo->placement.lpfn = rdev->mc.visible_vram_size >> PAGE_SHIFT; ++ r = ttm_bo_validate(bo, &rbo->placement, false, false); ++ if (unlikely(r == -ENOMEM)) { ++ radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_GTT); ++ return ttm_bo_validate(bo, &rbo->placement, false, false); ++ } else if (unlikely(r != 0)) { ++ return r; + } ++ ++ offset = bo->mem.start << PAGE_SHIFT; ++ /* this should never happen */ ++ if ((offset + size) > rdev->mc.visible_vram_size) ++ return -EINVAL; ++ + return 0; + } + +diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig +index df064e8cd9dc..f25f29835b3e 100644 +--- a/drivers/hwmon/Kconfig ++++ b/drivers/hwmon/Kconfig +@@ -944,7 +944,7 @@ config SENSORS_NCT6775 + + config SENSORS_NTC_THERMISTOR + tristate "NTC thermistor support" +- depends on (!OF && !IIO) || (OF && IIO) ++ depends on !OF || IIO=n || IIO + help + This driver supports NTC thermistors sensor reading and its + interpretation. The driver can also monitor the temperature and +diff --git a/drivers/hwmon/ntc_thermistor.c b/drivers/hwmon/ntc_thermistor.c +index 9297164a23a5..c64d3d497c50 100644 +--- a/drivers/hwmon/ntc_thermistor.c ++++ b/drivers/hwmon/ntc_thermistor.c +@@ -44,6 +44,7 @@ struct ntc_compensation { + unsigned int ohm; + }; + ++/* Order matters, ntc_match references the entries by index */ + static const struct platform_device_id ntc_thermistor_id[] = { + { "ncp15wb473", TYPE_NCPXXWB473 }, + { "ncp18wb473", TYPE_NCPXXWB473 }, +@@ -141,7 +142,7 @@ struct ntc_data { + char name[PLATFORM_NAME_SIZE]; + }; + +-#ifdef CONFIG_OF ++#if defined(CONFIG_OF) && IS_ENABLED(CONFIG_IIO) + static int ntc_adc_iio_read(struct ntc_thermistor_platform_data *pdata) + { + struct iio_channel *channel = pdata->chan; +@@ -163,15 +164,15 @@ static int ntc_adc_iio_read(struct ntc_thermistor_platform_data *pdata) + + static const struct of_device_id ntc_match[] = { + { .compatible = "ntc,ncp15wb473", +- .data = &ntc_thermistor_id[TYPE_NCPXXWB473] }, ++ .data = &ntc_thermistor_id[0] }, + { .compatible = "ntc,ncp18wb473", +- .data = &ntc_thermistor_id[TYPE_NCPXXWB473] }, ++ .data = &ntc_thermistor_id[1] }, + { .compatible = "ntc,ncp21wb473", +- .data = &ntc_thermistor_id[TYPE_NCPXXWB473] }, ++ .data = &ntc_thermistor_id[2] }, + { .compatible = "ntc,ncp03wb473", +- .data = &ntc_thermistor_id[TYPE_NCPXXWB473] }, ++ .data = &ntc_thermistor_id[3] }, + { .compatible = "ntc,ncp15wl333", +- .data = &ntc_thermistor_id[TYPE_NCPXXWL333] }, ++ .data = &ntc_thermistor_id[4] }, + { }, + }; + MODULE_DEVICE_TABLE(of, ntc_match); +@@ -223,6 +224,8 @@ ntc_thermistor_parse_dt(struct platform_device *pdev) + return NULL; + } + ++#define ntc_match NULL ++ + static void ntc_iio_channel_release(struct ntc_thermistor_platform_data *pdata) + { } + #endif +diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c +index 988e29d18bb4..bae20f8bb034 100644 +--- a/drivers/infiniband/ulp/isert/ib_isert.c ++++ b/drivers/infiniband/ulp/isert/ib_isert.c +@@ -965,6 +965,8 @@ sequence_cmd: + + if (!rc && dump_payload == false && unsol_data) + iscsit_set_unsoliticed_dataout(cmd); ++ else if (dump_payload && imm_data) ++ target_put_sess_cmd(conn->sess->se_sess, &cmd->se_cmd); + + return 0; + } +diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c +index 1a75869d3a82..677973641d2b 100644 +--- a/drivers/md/dm-cache-target.c ++++ b/drivers/md/dm-cache-target.c +@@ -1954,6 +1954,8 @@ static int cache_create(struct cache_args *ca, struct cache **result) + ti->num_discard_bios = 1; + ti->discards_supported = true; + ti->discard_zeroes_data_unsupported = true; ++ /* Discard bios must be split on a block boundary */ ++ ti->split_discard_bios = true; + + cache->features = ca->features; + ti->per_bio_data_size = get_per_bio_data_size(cache); +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 00a99fe797d4..963fa59be9b3 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -7338,8 +7338,10 @@ void md_do_sync(struct md_thread *thread) + /* just incase thread restarts... */ + if (test_bit(MD_RECOVERY_DONE, &mddev->recovery)) + return; +- if (mddev->ro) /* never try to sync a read-only array */ ++ if (mddev->ro) {/* never try to sync a read-only array */ ++ set_bit(MD_RECOVERY_INTR, &mddev->recovery); + return; ++ } + + if (test_bit(MD_RECOVERY_SYNC, &mddev->recovery)) { + if (test_bit(MD_RECOVERY_CHECK, &mddev->recovery)) +@@ -7788,6 +7790,7 @@ void md_check_recovery(struct mddev *mddev) + /* There is no thread, but we need to call + * ->spare_active and clear saved_raid_disk + */ ++ set_bit(MD_RECOVERY_INTR, &mddev->recovery); + md_reap_sync_thread(mddev); + clear_bit(MD_RECOVERY_NEEDED, &mddev->recovery); + goto unlock; +diff --git a/drivers/staging/comedi/drivers/ni_daq_700.c b/drivers/staging/comedi/drivers/ni_daq_700.c +index d067ef70e194..5e80d428e544 100644 +--- a/drivers/staging/comedi/drivers/ni_daq_700.c ++++ b/drivers/staging/comedi/drivers/ni_daq_700.c +@@ -127,6 +127,8 @@ static int daq700_ai_rinsn(struct comedi_device *dev, + /* write channel to multiplexer */ + /* set mask scan bit high to disable scanning */ + outb(chan | 0x80, dev->iobase + CMD_R1); ++ /* mux needs 2us to really settle [Fred Brooks]. */ ++ udelay(2); + + /* convert n samples */ + for (n = 0; n < insn->n; n++) { +diff --git a/drivers/staging/speakup/main.c b/drivers/staging/speakup/main.c +index 6c7b55c2947d..e70a48e3b376 100644 +--- a/drivers/staging/speakup/main.c ++++ b/drivers/staging/speakup/main.c +@@ -2219,6 +2219,7 @@ static void __exit speakup_exit(void) + unregister_keyboard_notifier(&keyboard_notifier_block); + unregister_vt_notifier(&vt_notifier_block); + speakup_unregister_devsynth(); ++ speakup_cancel_paste(); + del_timer(&cursor_timer); + kthread_stop(speakup_task); + speakup_task = NULL; +diff --git a/drivers/staging/speakup/selection.c b/drivers/staging/speakup/selection.c +index f0fb00392d6b..f67941e78e4a 100644 +--- a/drivers/staging/speakup/selection.c ++++ b/drivers/staging/speakup/selection.c +@@ -4,6 +4,8 @@ + #include + #include /* for dev_warn */ + #include ++#include ++#include + + #include "speakup.h" + +@@ -121,20 +123,24 @@ int speakup_set_selection(struct tty_struct *tty) + return 0; + } + +-/* TODO: move to some helper thread, probably. That'd fix having to check for +- * in_atomic(). */ +-int speakup_paste_selection(struct tty_struct *tty) ++struct speakup_paste_work { ++ struct work_struct work; ++ struct tty_struct *tty; ++}; ++ ++static void __speakup_paste_selection(struct work_struct *work) + { ++ struct speakup_paste_work *spw = ++ container_of(work, struct speakup_paste_work, work); ++ struct tty_struct *tty = xchg(&spw->tty, NULL); + struct vc_data *vc = (struct vc_data *) tty->driver_data; + int pasted = 0, count; + DECLARE_WAITQUEUE(wait, current); ++ + add_wait_queue(&vc->paste_wait, &wait); + while (sel_buffer && sel_buffer_lth > pasted) { + set_current_state(TASK_INTERRUPTIBLE); + if (test_bit(TTY_THROTTLED, &tty->flags)) { +- if (in_atomic()) +- /* if we are in an interrupt handler, abort */ +- break; + schedule(); + continue; + } +@@ -146,6 +152,26 @@ int speakup_paste_selection(struct tty_struct *tty) + } + remove_wait_queue(&vc->paste_wait, &wait); + current->state = TASK_RUNNING; ++ tty_kref_put(tty); ++} ++ ++static struct speakup_paste_work speakup_paste_work = { ++ .work = __WORK_INITIALIZER(speakup_paste_work.work, ++ __speakup_paste_selection) ++}; ++ ++int speakup_paste_selection(struct tty_struct *tty) ++{ ++ if (cmpxchg(&speakup_paste_work.tty, NULL, tty) != NULL) ++ return -EBUSY; ++ ++ tty_kref_get(tty); ++ schedule_work_on(WORK_CPU_UNBOUND, &speakup_paste_work.work); + return 0; + } + ++void speakup_cancel_paste(void) ++{ ++ cancel_work_sync(&speakup_paste_work.work); ++ tty_kref_put(speakup_paste_work.tty); ++} +diff --git a/drivers/staging/speakup/speakup.h b/drivers/staging/speakup/speakup.h +index 0126f714821a..74fe72429b2d 100644 +--- a/drivers/staging/speakup/speakup.h ++++ b/drivers/staging/speakup/speakup.h +@@ -77,6 +77,7 @@ extern void synth_buffer_clear(void); + extern void speakup_clear_selection(void); + extern int speakup_set_selection(struct tty_struct *tty); + extern int speakup_paste_selection(struct tty_struct *tty); ++extern void speakup_cancel_paste(void); + extern void speakup_register_devsynth(void); + extern void speakup_unregister_devsynth(void); + extern void synth_write(const char *buf, size_t count); +diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c +index 4ed35231e552..2cdd5079ae78 100644 +--- a/drivers/usb/core/driver.c ++++ b/drivers/usb/core/driver.c +@@ -1754,10 +1754,13 @@ int usb_runtime_suspend(struct device *dev) + if (status == -EAGAIN || status == -EBUSY) + usb_mark_last_busy(udev); + +- /* The PM core reacts badly unless the return code is 0, +- * -EAGAIN, or -EBUSY, so always return -EBUSY on an error. ++ /* ++ * The PM core reacts badly unless the return code is 0, ++ * -EAGAIN, or -EBUSY, so always return -EBUSY on an error ++ * (except for root hubs, because they don't suspend through ++ * an upstream port like other USB devices). + */ +- if (status != 0) ++ if (status != 0 && udev->parent) + return -EBUSY; + return status; + } +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index a036e03ae1b3..46efdca96952 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -1683,8 +1683,19 @@ static int hub_probe(struct usb_interface *intf, const struct usb_device_id *id) + */ + pm_runtime_set_autosuspend_delay(&hdev->dev, 0); + +- /* Hubs have proper suspend/resume support. */ +- usb_enable_autosuspend(hdev); ++ /* ++ * Hubs have proper suspend/resume support, except for root hubs ++ * where the controller driver doesn't have bus_suspend and ++ * bus_resume methods. ++ */ ++ if (hdev->parent) { /* normal device */ ++ usb_enable_autosuspend(hdev); ++ } else { /* root hub */ ++ const struct hc_driver *drv = bus_to_hcd(hdev->bus)->driver; ++ ++ if (drv->bus_suspend && drv->bus_resume) ++ usb_enable_autosuspend(hdev); ++ } + + if (hdev->level == MAX_TOPO_LEVEL) { + dev_err(&intf->dev, +diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c +index f2e57a1112c9..d007f0920126 100644 +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -1794,6 +1794,16 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci) + kfree(cur_cd); + } + ++ num_ports = HCS_MAX_PORTS(xhci->hcs_params1); ++ for (i = 0; i < num_ports; i++) { ++ struct xhci_interval_bw_table *bwt = &xhci->rh_bw[i].bw_table; ++ for (j = 0; j < XHCI_MAX_INTERVAL; j++) { ++ struct list_head *ep = &bwt->interval_bw[j].endpoints; ++ while (!list_empty(ep)) ++ list_del_init(ep->next); ++ } ++ } ++ + for (i = 1; i < MAX_HC_SLOTS; ++i) + xhci_free_virt_device(xhci, i); + +@@ -1834,16 +1844,6 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci) + if (!xhci->rh_bw) + goto no_bw; + +- num_ports = HCS_MAX_PORTS(xhci->hcs_params1); +- for (i = 0; i < num_ports; i++) { +- struct xhci_interval_bw_table *bwt = &xhci->rh_bw[i].bw_table; +- for (j = 0; j < XHCI_MAX_INTERVAL; j++) { +- struct list_head *ep = &bwt->interval_bw[j].endpoints; +- while (!list_empty(ep)) +- list_del_init(ep->next); +- } +- } +- + for (i = 0; i < num_ports; i++) { + struct xhci_tt_bw_info *tt, *n; + list_for_each_entry_safe(tt, n, &xhci->rh_bw[i].tts, tt_list) { +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index 2c635bd9c185..b9e663ac9a35 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -583,6 +583,8 @@ static struct usb_device_id id_table_combined [] = { + { USB_DEVICE(FTDI_VID, FTDI_TAVIR_STK500_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_TIAO_UMPA_PID), + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, ++ { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID), ++ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + /* + * ELV devices: + */ +diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h +index 993c93df6874..500474c48f4b 100644 +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -538,6 +538,11 @@ + */ + #define FTDI_TIAO_UMPA_PID 0x8a98 /* TIAO/DIYGADGET USB Multi-Protocol Adapter */ + ++/* ++ * NovaTech product ids (FTDI_VID) ++ */ ++#define FTDI_NT_ORIONLXM_PID 0x7c90 /* OrionLXm Substation Automation Platform */ ++ + + /********************************/ + /** third-party VID/PID combos **/ +diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c +index c5c9cbf107d1..8cd6479a8b43 100644 +--- a/drivers/usb/serial/io_ti.c ++++ b/drivers/usb/serial/io_ti.c +@@ -835,7 +835,7 @@ static int build_i2c_fw_hdr(__u8 *header, struct device *dev) + firmware_rec = (struct ti_i2c_firmware_rec*)i2c_header->Data; + + i2c_header->Type = I2C_DESC_TYPE_FIRMWARE_BLANK; +- i2c_header->Size = (__u16)buffer_size; ++ i2c_header->Size = cpu_to_le16(buffer_size); + i2c_header->CheckSum = cs; + firmware_rec->Ver_Major = OperationalMajorVersion; + firmware_rec->Ver_Minor = OperationalMinorVersion; +diff --git a/drivers/usb/serial/io_usbvend.h b/drivers/usb/serial/io_usbvend.h +index 51f83fbb73bb..6f6a856bc37c 100644 +--- a/drivers/usb/serial/io_usbvend.h ++++ b/drivers/usb/serial/io_usbvend.h +@@ -594,7 +594,7 @@ struct edge_boot_descriptor { + + struct ti_i2c_desc { + __u8 Type; // Type of descriptor +- __u16 Size; // Size of data only not including header ++ __le16 Size; // Size of data only not including header + __u8 CheckSum; // Checksum (8 bit sum of data only) + __u8 Data[0]; // Data starts here + } __attribute__((packed)); +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index f213ee978516..948a19f0cdf7 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -161,6 +161,7 @@ static void option_instat_callback(struct urb *urb); + #define NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_FULLSPEED 0x9000 + #define NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_HIGHSPEED 0x9001 + #define NOVATELWIRELESS_PRODUCT_E362 0x9010 ++#define NOVATELWIRELESS_PRODUCT_E371 0x9011 + #define NOVATELWIRELESS_PRODUCT_G2 0xA010 + #define NOVATELWIRELESS_PRODUCT_MC551 0xB001 + +@@ -1012,6 +1013,7 @@ static const struct usb_device_id option_ids[] = { + /* Novatel Ovation MC551 a.k.a. Verizon USB551L */ + { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC551, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_E362, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_E371, 0xff, 0xff, 0xff) }, + + { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01) }, + { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01A) }, +diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h +index c5b6dbf9c2fc..229a757e1c13 100644 +--- a/include/linux/perf_event.h ++++ b/include/linux/perf_event.h +@@ -695,10 +695,17 @@ static inline void perf_callchain_store(struct perf_callchain_entry *entry, u64 + extern int sysctl_perf_event_paranoid; + extern int sysctl_perf_event_mlock; + extern int sysctl_perf_event_sample_rate; ++extern int sysctl_perf_cpu_time_max_percent; ++ ++extern void perf_sample_event_took(u64 sample_len_ns); + + extern int perf_proc_update_handler(struct ctl_table *table, int write, + void __user *buffer, size_t *lenp, + loff_t *ppos); ++extern int perf_cpu_time_max_percent_handler(struct ctl_table *table, int write, ++ void __user *buffer, size_t *lenp, ++ loff_t *ppos); ++ + + static inline bool perf_paranoid_tracepoint_raw(void) + { +diff --git a/include/uapi/linux/usb/Kbuild b/include/uapi/linux/usb/Kbuild +index 6cb4ea826834..4cc4d6e7e523 100644 +--- a/include/uapi/linux/usb/Kbuild ++++ b/include/uapi/linux/usb/Kbuild +@@ -1,6 +1,7 @@ + # UAPI Header export list + header-y += audio.h + header-y += cdc.h ++header-y += cdc-wdm.h + header-y += ch11.h + header-y += ch9.h + header-y += functionfs.h +diff --git a/include/uapi/linux/usb/cdc-wdm.h b/include/uapi/linux/usb/cdc-wdm.h +index f03134feebd6..0dc132e75030 100644 +--- a/include/uapi/linux/usb/cdc-wdm.h ++++ b/include/uapi/linux/usb/cdc-wdm.h +@@ -9,6 +9,8 @@ + #ifndef _UAPI__LINUX_USB_CDC_WDM_H + #define _UAPI__LINUX_USB_CDC_WDM_H + ++#include ++ + /* + * This IOCTL is used to retrieve the wMaxCommand for the device, + * defining the message limit for both reading and writing. +diff --git a/kernel/cpu.c b/kernel/cpu.c +index 198a38883e64..bc255e25d5dd 100644 +--- a/kernel/cpu.c ++++ b/kernel/cpu.c +@@ -698,10 +698,12 @@ void set_cpu_present(unsigned int cpu, bool present) + + void set_cpu_online(unsigned int cpu, bool online) + { +- if (online) ++ if (online) { + cpumask_set_cpu(cpu, to_cpumask(cpu_online_bits)); +- else ++ cpumask_set_cpu(cpu, to_cpumask(cpu_active_bits)); ++ } else { + cpumask_clear_cpu(cpu, to_cpumask(cpu_online_bits)); ++ } + } + + void set_cpu_active(unsigned int cpu, bool active) +diff --git a/kernel/events/core.c b/kernel/events/core.c +index ac9b8cce3df2..459b94c94721 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -165,25 +165,109 @@ int sysctl_perf_event_mlock __read_mostly = 512 + (PAGE_SIZE / 1024); /* 'free' + /* + * max perf event sample rate + */ +-#define DEFAULT_MAX_SAMPLE_RATE 100000 +-int sysctl_perf_event_sample_rate __read_mostly = DEFAULT_MAX_SAMPLE_RATE; +-static int max_samples_per_tick __read_mostly = +- DIV_ROUND_UP(DEFAULT_MAX_SAMPLE_RATE, HZ); ++#define DEFAULT_MAX_SAMPLE_RATE 100000 ++#define DEFAULT_SAMPLE_PERIOD_NS (NSEC_PER_SEC / DEFAULT_MAX_SAMPLE_RATE) ++#define DEFAULT_CPU_TIME_MAX_PERCENT 25 ++ ++int sysctl_perf_event_sample_rate __read_mostly = DEFAULT_MAX_SAMPLE_RATE; ++ ++static int max_samples_per_tick __read_mostly = DIV_ROUND_UP(DEFAULT_MAX_SAMPLE_RATE, HZ); ++static int perf_sample_period_ns __read_mostly = DEFAULT_SAMPLE_PERIOD_NS; ++ ++static atomic_t perf_sample_allowed_ns __read_mostly = ++ ATOMIC_INIT( DEFAULT_SAMPLE_PERIOD_NS * DEFAULT_CPU_TIME_MAX_PERCENT / 100); ++ ++void update_perf_cpu_limits(void) ++{ ++ u64 tmp = perf_sample_period_ns; ++ ++ tmp *= sysctl_perf_cpu_time_max_percent; ++ do_div(tmp, 100); ++ atomic_set(&perf_sample_allowed_ns, tmp); ++} + + int perf_proc_update_handler(struct ctl_table *table, int write, + void __user *buffer, size_t *lenp, + loff_t *ppos) + { +- int ret = proc_dointvec(table, write, buffer, lenp, ppos); ++ int ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos); + + if (ret || !write) + return ret; + + max_samples_per_tick = DIV_ROUND_UP(sysctl_perf_event_sample_rate, HZ); ++ perf_sample_period_ns = NSEC_PER_SEC / sysctl_perf_event_sample_rate; ++ update_perf_cpu_limits(); ++ ++ return 0; ++} ++ ++int sysctl_perf_cpu_time_max_percent __read_mostly = DEFAULT_CPU_TIME_MAX_PERCENT; ++ ++int perf_cpu_time_max_percent_handler(struct ctl_table *table, int write, ++ void __user *buffer, size_t *lenp, ++ loff_t *ppos) ++{ ++ int ret = proc_dointvec(table, write, buffer, lenp, ppos); ++ ++ if (ret || !write) ++ return ret; ++ ++ update_perf_cpu_limits(); + + return 0; + } + ++/* ++ * perf samples are done in some very critical code paths (NMIs). ++ * If they take too much CPU time, the system can lock up and not ++ * get any real work done. This will drop the sample rate when ++ * we detect that events are taking too long. ++ */ ++#define NR_ACCUMULATED_SAMPLES 128 ++DEFINE_PER_CPU(u64, running_sample_length); ++ ++void perf_sample_event_took(u64 sample_len_ns) ++{ ++ u64 avg_local_sample_len; ++ u64 local_samples_len; ++ ++ if (atomic_read(&perf_sample_allowed_ns) == 0) ++ return; ++ ++ /* decay the counter by 1 average sample */ ++ local_samples_len = __get_cpu_var(running_sample_length); ++ local_samples_len -= local_samples_len/NR_ACCUMULATED_SAMPLES; ++ local_samples_len += sample_len_ns; ++ __get_cpu_var(running_sample_length) = local_samples_len; ++ ++ /* ++ * note: this will be biased artifically low until we have ++ * seen NR_ACCUMULATED_SAMPLES. Doing it this way keeps us ++ * from having to maintain a count. ++ */ ++ avg_local_sample_len = local_samples_len/NR_ACCUMULATED_SAMPLES; ++ ++ if (avg_local_sample_len <= atomic_read(&perf_sample_allowed_ns)) ++ return; ++ ++ if (max_samples_per_tick <= 1) ++ return; ++ ++ max_samples_per_tick = DIV_ROUND_UP(max_samples_per_tick, 2); ++ sysctl_perf_event_sample_rate = max_samples_per_tick * HZ; ++ perf_sample_period_ns = NSEC_PER_SEC / sysctl_perf_event_sample_rate; ++ ++ printk_ratelimited(KERN_WARNING ++ "perf samples too long (%lld > %d), lowering " ++ "kernel.perf_event_max_sample_rate to %d\n", ++ avg_local_sample_len, ++ atomic_read(&perf_sample_allowed_ns), ++ sysctl_perf_event_sample_rate); ++ ++ update_perf_cpu_limits(); ++} ++ + static atomic64_t perf_event_id; + + static void cpu_ctx_sched_out(struct perf_cpu_context *cpuctx, +@@ -1237,6 +1321,11 @@ group_sched_out(struct perf_event *group_event, + cpuctx->exclusive = 0; + } + ++struct remove_event { ++ struct perf_event *event; ++ bool detach_group; ++}; ++ + /* + * Cross CPU call to remove a performance event + * +@@ -1245,12 +1334,15 @@ group_sched_out(struct perf_event *group_event, + */ + static int __perf_remove_from_context(void *info) + { +- struct perf_event *event = info; ++ struct remove_event *re = info; ++ struct perf_event *event = re->event; + struct perf_event_context *ctx = event->ctx; + struct perf_cpu_context *cpuctx = __get_cpu_context(ctx); + + raw_spin_lock(&ctx->lock); + event_sched_out(event, cpuctx, ctx); ++ if (re->detach_group) ++ perf_group_detach(event); + list_del_event(event, ctx); + if (!ctx->nr_events && cpuctx->task_ctx == ctx) { + ctx->is_active = 0; +@@ -1275,10 +1367,14 @@ static int __perf_remove_from_context(void *info) + * When called from perf_event_exit_task, it's OK because the + * context has been detached from its task. + */ +-static void perf_remove_from_context(struct perf_event *event) ++static void perf_remove_from_context(struct perf_event *event, bool detach_group) + { + struct perf_event_context *ctx = event->ctx; + struct task_struct *task = ctx->task; ++ struct remove_event re = { ++ .event = event, ++ .detach_group = detach_group, ++ }; + + lockdep_assert_held(&ctx->mutex); + +@@ -1287,12 +1383,12 @@ static void perf_remove_from_context(struct perf_event *event) + * Per cpu events are removed via an smp call and + * the removal is always successful. + */ +- cpu_function_call(event->cpu, __perf_remove_from_context, event); ++ cpu_function_call(event->cpu, __perf_remove_from_context, &re); + return; + } + + retry: +- if (!task_function_call(task, __perf_remove_from_context, event)) ++ if (!task_function_call(task, __perf_remove_from_context, &re)) + return; + + raw_spin_lock_irq(&ctx->lock); +@@ -1309,6 +1405,8 @@ retry: + * Since the task isn't running, its safe to remove the event, us + * holding the ctx->lock ensures the task won't get scheduled in. + */ ++ if (detach_group) ++ perf_group_detach(event); + list_del_event(event, ctx); + raw_spin_unlock_irq(&ctx->lock); + } +@@ -3015,10 +3113,7 @@ int perf_event_release_kernel(struct perf_event *event) + * to trigger the AB-BA case. + */ + mutex_lock_nested(&ctx->mutex, SINGLE_DEPTH_NESTING); +- raw_spin_lock_irq(&ctx->lock); +- perf_group_detach(event); +- raw_spin_unlock_irq(&ctx->lock); +- perf_remove_from_context(event); ++ perf_remove_from_context(event, true); + mutex_unlock(&ctx->mutex); + + free_event(event); +@@ -5044,6 +5139,9 @@ struct swevent_htable { + + /* Recursion avoidance in each contexts */ + int recursion[PERF_NR_CONTEXTS]; ++ ++ /* Keeps track of cpu being initialized/exited */ ++ bool online; + }; + + static DEFINE_PER_CPU(struct swevent_htable, swevent_htable); +@@ -5290,8 +5388,14 @@ static int perf_swevent_add(struct perf_event *event, int flags) + hwc->state = !(flags & PERF_EF_START); + + head = find_swevent_head(swhash, event); +- if (WARN_ON_ONCE(!head)) ++ if (!head) { ++ /* ++ * We can race with cpu hotplug code. Do not ++ * WARN if the cpu just got unplugged. ++ */ ++ WARN_ON_ONCE(swhash->online); + return -EINVAL; ++ } + + hlist_add_head_rcu(&event->hlist_entry, head); + +@@ -6581,6 +6685,9 @@ SYSCALL_DEFINE5(perf_event_open, + if (attr.freq) { + if (attr.sample_freq > sysctl_perf_event_sample_rate) + return -EINVAL; ++ } else { ++ if (attr.sample_period & (1ULL << 63)) ++ return -EINVAL; + } + + /* +@@ -6727,7 +6834,7 @@ SYSCALL_DEFINE5(perf_event_open, + struct perf_event_context *gctx = group_leader->ctx; + + mutex_lock(&gctx->mutex); +- perf_remove_from_context(group_leader); ++ perf_remove_from_context(group_leader, false); + + /* + * Removing from the context ends up with disabled +@@ -6737,7 +6844,7 @@ SYSCALL_DEFINE5(perf_event_open, + perf_event__state_init(group_leader); + list_for_each_entry(sibling, &group_leader->sibling_list, + group_entry) { +- perf_remove_from_context(sibling); ++ perf_remove_from_context(sibling, false); + perf_event__state_init(sibling); + put_ctx(gctx); + } +@@ -6867,7 +6974,7 @@ void perf_pmu_migrate_context(struct pmu *pmu, int src_cpu, int dst_cpu) + mutex_lock(&src_ctx->mutex); + list_for_each_entry_safe(event, tmp, &src_ctx->event_list, + event_entry) { +- perf_remove_from_context(event); ++ perf_remove_from_context(event, false); + put_ctx(src_ctx); + list_add(&event->event_entry, &events); + } +@@ -6927,13 +7034,7 @@ __perf_event_exit_task(struct perf_event *child_event, + struct perf_event_context *child_ctx, + struct task_struct *child) + { +- if (child_event->parent) { +- raw_spin_lock_irq(&child_ctx->lock); +- perf_group_detach(child_event); +- raw_spin_unlock_irq(&child_ctx->lock); +- } +- +- perf_remove_from_context(child_event); ++ perf_remove_from_context(child_event, !!child_event->parent); + + /* + * It can happen that the parent exits first, and has events +@@ -7395,6 +7496,7 @@ static void __cpuinit perf_event_init_cpu(int cpu) + struct swevent_htable *swhash = &per_cpu(swevent_htable, cpu); + + mutex_lock(&swhash->hlist_mutex); ++ swhash->online = true; + if (swhash->hlist_refcount > 0) { + struct swevent_hlist *hlist; + +@@ -7417,14 +7519,14 @@ static void perf_pmu_rotate_stop(struct pmu *pmu) + + static void __perf_event_exit_context(void *__info) + { ++ struct remove_event re = { .detach_group = false }; + struct perf_event_context *ctx = __info; +- struct perf_event *event; + + perf_pmu_rotate_stop(ctx->pmu); + + rcu_read_lock(); +- list_for_each_entry_rcu(event, &ctx->event_list, event_entry) +- __perf_remove_from_context(event); ++ list_for_each_entry_rcu(re.event, &ctx->event_list, event_entry) ++ __perf_remove_from_context(&re); + rcu_read_unlock(); + } + +@@ -7452,6 +7554,7 @@ static void perf_event_exit_cpu(int cpu) + perf_event_exit_cpu_context(cpu); + + mutex_lock(&swhash->hlist_mutex); ++ swhash->online = false; + swevent_hlist_release(swhash); + mutex_unlock(&swhash->hlist_mutex); + } +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index b4308d7da339..2672eca82a2b 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -5270,7 +5270,6 @@ static int __cpuinit sched_cpu_active(struct notifier_block *nfb, + unsigned long action, void *hcpu) + { + switch (action & ~CPU_TASKS_FROZEN) { +- case CPU_STARTING: + case CPU_DOWN_FAILED: + set_cpu_active((long)hcpu, true); + return NOTIFY_OK; +diff --git a/kernel/sched/cpupri.c b/kernel/sched/cpupri.c +index 1095e878a46f..b3f0a2783369 100644 +--- a/kernel/sched/cpupri.c ++++ b/kernel/sched/cpupri.c +@@ -70,8 +70,7 @@ int cpupri_find(struct cpupri *cp, struct task_struct *p, + int idx = 0; + int task_pri = convert_prio(p->prio); + +- if (task_pri >= MAX_RT_PRIO) +- return 0; ++ BUG_ON(task_pri >= CPUPRI_NR_PRIORITIES); + + for (idx = 0; idx < task_pri; idx++) { + struct cpupri_vec *vec = &cp->pri_to_cpu[idx]; +diff --git a/kernel/sched/cputime.c b/kernel/sched/cputime.c +index 1101d92635c3..c23a8fd36149 100644 +--- a/kernel/sched/cputime.c ++++ b/kernel/sched/cputime.c +@@ -326,50 +326,50 @@ out: + * softirq as those do not count in task exec_runtime any more. + */ + static void irqtime_account_process_tick(struct task_struct *p, int user_tick, +- struct rq *rq) ++ struct rq *rq, int ticks) + { +- cputime_t one_jiffy_scaled = cputime_to_scaled(cputime_one_jiffy); ++ cputime_t scaled = cputime_to_scaled(cputime_one_jiffy); ++ u64 cputime = (__force u64) cputime_one_jiffy; + u64 *cpustat = kcpustat_this_cpu->cpustat; + + if (steal_account_process_tick()) + return; + ++ cputime *= ticks; ++ scaled *= ticks; ++ + if (irqtime_account_hi_update()) { +- cpustat[CPUTIME_IRQ] += (__force u64) cputime_one_jiffy; ++ cpustat[CPUTIME_IRQ] += cputime; + } else if (irqtime_account_si_update()) { +- cpustat[CPUTIME_SOFTIRQ] += (__force u64) cputime_one_jiffy; ++ cpustat[CPUTIME_SOFTIRQ] += cputime; + } else if (this_cpu_ksoftirqd() == p) { + /* + * ksoftirqd time do not get accounted in cpu_softirq_time. + * So, we have to handle it separately here. + * Also, p->stime needs to be updated for ksoftirqd. + */ +- __account_system_time(p, cputime_one_jiffy, one_jiffy_scaled, +- CPUTIME_SOFTIRQ); ++ __account_system_time(p, cputime, scaled, CPUTIME_SOFTIRQ); + } else if (user_tick) { +- account_user_time(p, cputime_one_jiffy, one_jiffy_scaled); ++ account_user_time(p, cputime, scaled); + } else if (p == rq->idle) { +- account_idle_time(cputime_one_jiffy); ++ account_idle_time(cputime); + } else if (p->flags & PF_VCPU) { /* System time or guest time */ +- account_guest_time(p, cputime_one_jiffy, one_jiffy_scaled); ++ account_guest_time(p, cputime, scaled); + } else { +- __account_system_time(p, cputime_one_jiffy, one_jiffy_scaled, +- CPUTIME_SYSTEM); ++ __account_system_time(p, cputime, scaled, CPUTIME_SYSTEM); + } + } + + static void irqtime_account_idle_ticks(int ticks) + { +- int i; + struct rq *rq = this_rq(); + +- for (i = 0; i < ticks; i++) +- irqtime_account_process_tick(current, 0, rq); ++ irqtime_account_process_tick(current, 0, rq, ticks); + } + #else /* CONFIG_IRQ_TIME_ACCOUNTING */ + static inline void irqtime_account_idle_ticks(int ticks) {} + static inline void irqtime_account_process_tick(struct task_struct *p, int user_tick, +- struct rq *rq) {} ++ struct rq *rq, int nr_ticks) {} + #endif /* CONFIG_IRQ_TIME_ACCOUNTING */ + + /* +@@ -464,7 +464,7 @@ void account_process_tick(struct task_struct *p, int user_tick) + return; + + if (sched_clock_irqtime) { +- irqtime_account_process_tick(p, user_tick, rq); ++ irqtime_account_process_tick(p, user_tick, rq, 1); + return; + } + +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index ed6c01626acd..9469f4c61a30 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -1049,6 +1049,16 @@ static struct ctl_table kern_table[] = { + .maxlen = sizeof(sysctl_perf_event_sample_rate), + .mode = 0644, + .proc_handler = perf_proc_update_handler, ++ .extra1 = &one, ++ }, ++ { ++ .procname = "perf_cpu_time_max_percent", ++ .data = &sysctl_perf_cpu_time_max_percent, ++ .maxlen = sizeof(sysctl_perf_cpu_time_max_percent), ++ .mode = 0644, ++ .proc_handler = perf_cpu_time_max_percent_handler, ++ .extra1 = &zero, ++ .extra2 = &one_hundred, + }, + #endif + #ifdef CONFIG_KMEMCHECK +diff --git a/mm/memory-failure.c b/mm/memory-failure.c +index 4254eb021583..4f8548abd6ee 100644 +--- a/mm/memory-failure.c ++++ b/mm/memory-failure.c +@@ -1153,6 +1153,8 @@ int memory_failure(unsigned long pfn, int trapno, int flags) + */ + if (!PageHWPoison(p)) { + printk(KERN_ERR "MCE %#lx: just unpoisoned\n", pfn); ++ atomic_long_sub(nr_pages, &num_poisoned_pages); ++ put_page(hpage); + res = 0; + goto out; + } +diff --git a/mm/rmap.c b/mm/rmap.c +index fbf0040a7342..b730a4409be6 100644 +--- a/mm/rmap.c ++++ b/mm/rmap.c +@@ -1675,10 +1675,9 @@ void __put_anon_vma(struct anon_vma *anon_vma) + { + struct anon_vma *root = anon_vma->root; + ++ anon_vma_free(anon_vma); + if (root != anon_vma && atomic_dec_and_test(&root->refcount)) + anon_vma_free(root); +- +- anon_vma_free(anon_vma); + } + + #ifdef CONFIG_MIGRATION +diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c +index 95f3f1da0d7f..d38e6a8d8b9f 100644 +--- a/net/ipv6/netfilter.c ++++ b/net/ipv6/netfilter.c +@@ -30,13 +30,15 @@ int ip6_route_me_harder(struct sk_buff *skb) + .daddr = iph->daddr, + .saddr = iph->saddr, + }; ++ int err; + + dst = ip6_route_output(net, skb->sk, &fl6); +- if (dst->error) { ++ err = dst->error; ++ if (err) { + IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES); + LIMIT_NETDEBUG(KERN_DEBUG "ip6_route_me_harder: No more route.\n"); + dst_release(dst); +- return dst->error; ++ return err; + } + + /* Drop old route. */ +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 7de7cf1ec852..0923f09df503 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -1590,12 +1590,10 @@ static const struct hda_fixup alc260_fixups[] = { + [ALC260_FIXUP_COEF] = { + .type = HDA_FIXUP_VERBS, + .v.verbs = (const struct hda_verb[]) { +- { 0x20, AC_VERB_SET_COEF_INDEX, 0x07 }, +- { 0x20, AC_VERB_SET_PROC_COEF, 0x3040 }, ++ { 0x1a, AC_VERB_SET_COEF_INDEX, 0x07 }, ++ { 0x1a, AC_VERB_SET_PROC_COEF, 0x3040 }, + { } + }, +- .chained = true, +- .chain_id = ALC260_FIXUP_HP_PIN_0F, + }, + [ALC260_FIXUP_GPIO1] = { + .type = HDA_FIXUP_VERBS, +@@ -1610,8 +1608,8 @@ static const struct hda_fixup alc260_fixups[] = { + [ALC260_FIXUP_REPLACER] = { + .type = HDA_FIXUP_VERBS, + .v.verbs = (const struct hda_verb[]) { +- { 0x20, AC_VERB_SET_COEF_INDEX, 0x07 }, +- { 0x20, AC_VERB_SET_PROC_COEF, 0x3050 }, ++ { 0x1a, AC_VERB_SET_COEF_INDEX, 0x07 }, ++ { 0x1a, AC_VERB_SET_PROC_COEF, 0x3050 }, + { } + }, + .chained = true, +diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c +index 07b1a3ad3e24..63b6f8c8edf2 100644 +--- a/tools/perf/util/evsel.c ++++ b/tools/perf/util/evsel.c +@@ -1514,7 +1514,7 @@ int perf_evsel__open_strerror(struct perf_evsel *evsel, + switch (err) { + case EPERM: + case EACCES: +- return scnprintf(msg, size, "%s", ++ return scnprintf(msg, size, + "You may not have permission to collect %sstats.\n" + "Consider tweaking /proc/sys/kernel/perf_event_paranoid:\n" + " -1 - Not paranoid at all\n" diff --git a/projects/Cuboxi/patches/linux/linux-000-patch-3.10.43-44.patch b/projects/Cuboxi/patches/linux/linux-000-patch-3.10.43-44.patch new file mode 100644 index 0000000000..e5cce8f6ff --- /dev/null +++ b/projects/Cuboxi/patches/linux/linux-000-patch-3.10.43-44.patch @@ -0,0 +1,755 @@ +diff --git a/Makefile b/Makefile +index 9cf513828341..e55476c4aef0 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 10 +-SUBLEVEL = 43 ++SUBLEVEL = 44 + EXTRAVERSION = + NAME = TOSSUG Baby Fish + +diff --git a/arch/arm/boot/dts/armada-xp-gp.dts b/arch/arm/boot/dts/armada-xp-gp.dts +index 76db557adbe7..f97550420fcc 100644 +--- a/arch/arm/boot/dts/armada-xp-gp.dts ++++ b/arch/arm/boot/dts/armada-xp-gp.dts +@@ -124,7 +124,7 @@ + /* Device Bus parameters are required */ + + /* Read parameters */ +- devbus,bus-width = <8>; ++ devbus,bus-width = <16>; + devbus,turn-off-ps = <60000>; + devbus,badr-skew-ps = <0>; + devbus,acc-first-ps = <124000>; +diff --git a/arch/arm/boot/dts/armada-xp-openblocks-ax3-4.dts b/arch/arm/boot/dts/armada-xp-openblocks-ax3-4.dts +index fdea75c73411..9746d0e7fcb4 100644 +--- a/arch/arm/boot/dts/armada-xp-openblocks-ax3-4.dts ++++ b/arch/arm/boot/dts/armada-xp-openblocks-ax3-4.dts +@@ -152,7 +152,7 @@ + /* Device Bus parameters are required */ + + /* Read parameters */ +- devbus,bus-width = <8>; ++ devbus,bus-width = <16>; + devbus,turn-off-ps = <60000>; + devbus,badr-skew-ps = <0>; + devbus,acc-first-ps = <124000>; +diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c +index 4942058402a4..b0d33d9533aa 100644 +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -444,10 +444,14 @@ static const struct pci_device_id ahci_pci_tbl[] = { + .driver_data = board_ahci_yes_fbs }, /* 88se9172 */ + { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9192), + .driver_data = board_ahci_yes_fbs }, /* 88se9172 on some Gigabyte */ ++ { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x91a0), ++ .driver_data = board_ahci_yes_fbs }, + { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x91a3), + .driver_data = board_ahci_yes_fbs }, + { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9230), + .driver_data = board_ahci_yes_fbs }, ++ { PCI_DEVICE(PCI_VENDOR_ID_TTI, 0x0642), ++ .driver_data = board_ahci_yes_fbs }, + + /* Promise */ + { PCI_VDEVICE(PROMISE, 0x3f20), board_ahci }, /* PDC42819 */ +diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c +index bae20f8bb034..144999918022 100644 +--- a/drivers/infiniband/ulp/isert/ib_isert.c ++++ b/drivers/infiniband/ulp/isert/ib_isert.c +@@ -382,6 +382,14 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event) + struct ib_device *ib_dev = cma_id->device; + int ret = 0; + ++ spin_lock_bh(&np->np_thread_lock); ++ if (!np->enabled) { ++ spin_unlock_bh(&np->np_thread_lock); ++ pr_debug("iscsi_np is not enabled, reject connect request\n"); ++ return rdma_reject(cma_id, NULL, 0); ++ } ++ spin_unlock_bh(&np->np_thread_lock); ++ + pr_debug("Entering isert_connect_request cma_id: %p, context: %p\n", + cma_id, cma_id->context); + +diff --git a/drivers/misc/mei/hw-me.c b/drivers/misc/mei/hw-me.c +index 1bf3f8b5ce3a..06311c5ada36 100644 +--- a/drivers/misc/mei/hw-me.c ++++ b/drivers/misc/mei/hw-me.c +@@ -183,6 +183,7 @@ static void mei_me_hw_reset(struct mei_device *dev, bool intr_enable) + else + hcsr &= ~H_IE; + ++ dev->recvd_hw_ready = false; + mei_me_reg_write(hw, H_CSR, hcsr); + + if (dev->dev_state == MEI_DEV_POWER_DOWN) +@@ -233,10 +234,7 @@ static bool mei_me_hw_is_ready(struct mei_device *dev) + static int mei_me_hw_ready_wait(struct mei_device *dev) + { + int err; +- if (mei_me_hw_is_ready(dev)) +- return 0; + +- dev->recvd_hw_ready = false; + mutex_unlock(&dev->device_lock); + err = wait_event_interruptible_timeout(dev->wait_hw_ready, + dev->recvd_hw_ready, +diff --git a/drivers/net/ethernet/mellanox/mlx4/en_cq.c b/drivers/net/ethernet/mellanox/mlx4/en_cq.c +index 1e6c594d6d04..58c18d3a4880 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/en_cq.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_cq.c +@@ -55,7 +55,6 @@ int mlx4_en_create_cq(struct mlx4_en_priv *priv, + + cq->ring = ring; + cq->is_tx = mode; +- spin_lock_init(&cq->lock); + + err = mlx4_alloc_hwq_res(mdev->dev, &cq->wqres, + cq->buf_size, 2 * PAGE_SIZE); +diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +index 89c47ea84b50..063f3f4d4867 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +@@ -1190,15 +1190,11 @@ static void mlx4_en_netpoll(struct net_device *dev) + { + struct mlx4_en_priv *priv = netdev_priv(dev); + struct mlx4_en_cq *cq; +- unsigned long flags; + int i; + + for (i = 0; i < priv->rx_ring_num; i++) { + cq = &priv->rx_cq[i]; +- spin_lock_irqsave(&cq->lock, flags); +- napi_synchronize(&cq->napi); +- mlx4_en_process_rx_cq(dev, cq, 0); +- spin_unlock_irqrestore(&cq->lock, flags); ++ napi_schedule(&cq->napi); + } + } + #endif +diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h +index b1d7657b2bf5..628e1f9355a8 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h ++++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h +@@ -299,7 +299,6 @@ struct mlx4_en_cq { + struct mlx4_cq mcq; + struct mlx4_hwq_resources wqres; + int ring; +- spinlock_t lock; + struct net_device *dev; + struct napi_struct napi; + int size; +diff --git a/drivers/scsi/megaraid/megaraid_sas.h b/drivers/scsi/megaraid/megaraid_sas.h +index 684cc343cf09..b52121358385 100644 +--- a/drivers/scsi/megaraid/megaraid_sas.h ++++ b/drivers/scsi/megaraid/megaraid_sas.h +@@ -1295,7 +1295,6 @@ struct megasas_instance { + u32 *reply_queue; + dma_addr_t reply_queue_h; + +- unsigned long base_addr; + struct megasas_register_set __iomem *reg_set; + + struct megasas_pd_list pd_list[MEGASAS_MAX_PD]; +diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c +index b3e5c1787876..4956c99ed90e 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_base.c ++++ b/drivers/scsi/megaraid/megaraid_sas_base.c +@@ -3461,6 +3461,7 @@ static int megasas_init_fw(struct megasas_instance *instance) + u32 max_sectors_1; + u32 max_sectors_2; + u32 tmp_sectors, msix_enable; ++ resource_size_t base_addr; + struct megasas_register_set __iomem *reg_set; + struct megasas_ctrl_info *ctrl_info; + unsigned long bar_list; +@@ -3469,14 +3470,14 @@ static int megasas_init_fw(struct megasas_instance *instance) + /* Find first memory bar */ + bar_list = pci_select_bars(instance->pdev, IORESOURCE_MEM); + instance->bar = find_first_bit(&bar_list, sizeof(unsigned long)); +- instance->base_addr = pci_resource_start(instance->pdev, instance->bar); + if (pci_request_selected_regions(instance->pdev, instance->bar, + "megasas: LSI")) { + printk(KERN_DEBUG "megasas: IO memory region busy!\n"); + return -EBUSY; + } + +- instance->reg_set = ioremap_nocache(instance->base_addr, 8192); ++ base_addr = pci_resource_start(instance->pdev, instance->bar); ++ instance->reg_set = ioremap_nocache(base_addr, 8192); + + if (!instance->reg_set) { + printk(KERN_DEBUG "megasas: Failed to map IO mem\n"); +diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c +index 58c479d13b57..68dbd88babbd 100644 +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -460,6 +460,7 @@ int iscsit_del_np(struct iscsi_np *np) + spin_lock_bh(&np->np_thread_lock); + np->np_exports--; + if (np->np_exports) { ++ np->enabled = true; + spin_unlock_bh(&np->np_thread_lock); + return 0; + } +diff --git a/drivers/target/iscsi/iscsi_target_core.h b/drivers/target/iscsi/iscsi_target_core.h +index 8907dcdc0db9..e117870eb445 100644 +--- a/drivers/target/iscsi/iscsi_target_core.h ++++ b/drivers/target/iscsi/iscsi_target_core.h +@@ -760,6 +760,7 @@ struct iscsi_np { + int np_ip_proto; + int np_sock_type; + enum np_thread_state_table np_thread_state; ++ bool enabled; + enum iscsi_timer_flags_table np_login_timer_flags; + u32 np_exports; + enum np_flags_table np_flags; +diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c +index bc788c52b6cc..0d6c3dd25679 100644 +--- a/drivers/target/iscsi/iscsi_target_login.c ++++ b/drivers/target/iscsi/iscsi_target_login.c +@@ -250,6 +250,28 @@ static void iscsi_login_set_conn_values( + mutex_unlock(&auth_id_lock); + } + ++static __printf(2, 3) int iscsi_change_param_sprintf( ++ struct iscsi_conn *conn, ++ const char *fmt, ...) ++{ ++ va_list args; ++ unsigned char buf[64]; ++ ++ memset(buf, 0, sizeof buf); ++ ++ va_start(args, fmt); ++ vsnprintf(buf, sizeof buf, fmt, args); ++ va_end(args); ++ ++ if (iscsi_change_param_value(buf, conn->param_list, 0) < 0) { ++ iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR, ++ ISCSI_LOGIN_STATUS_NO_RESOURCES); ++ return -1; ++ } ++ ++ return 0; ++} ++ + /* + * This is the leading connection of a new session, + * or session reinstatement. +@@ -339,7 +361,6 @@ static int iscsi_login_zero_tsih_s2( + { + struct iscsi_node_attrib *na; + struct iscsi_session *sess = conn->sess; +- unsigned char buf[32]; + bool iser = false; + + sess->tpg = conn->tpg; +@@ -380,26 +401,16 @@ static int iscsi_login_zero_tsih_s2( + * + * In our case, we have already located the struct iscsi_tiqn at this point. + */ +- memset(buf, 0, 32); +- sprintf(buf, "TargetPortalGroupTag=%hu", ISCSI_TPG_S(sess)->tpgt); +- if (iscsi_change_param_value(buf, conn->param_list, 0) < 0) { +- iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR, +- ISCSI_LOGIN_STATUS_NO_RESOURCES); ++ if (iscsi_change_param_sprintf(conn, "TargetPortalGroupTag=%hu", sess->tpg->tpgt)) + return -1; +- } + + /* + * Workaround for Initiators that have broken connection recovery logic. + * + * "We would really like to get rid of this." Linux-iSCSI.org team + */ +- memset(buf, 0, 32); +- sprintf(buf, "ErrorRecoveryLevel=%d", na->default_erl); +- if (iscsi_change_param_value(buf, conn->param_list, 0) < 0) { +- iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR, +- ISCSI_LOGIN_STATUS_NO_RESOURCES); ++ if (iscsi_change_param_sprintf(conn, "ErrorRecoveryLevel=%d", na->default_erl)) + return -1; +- } + + if (iscsi_login_disable_FIM_keys(conn->param_list, conn) < 0) + return -1; +@@ -411,12 +422,9 @@ static int iscsi_login_zero_tsih_s2( + unsigned long mrdsl, off; + int rc; + +- sprintf(buf, "RDMAExtensions=Yes"); +- if (iscsi_change_param_value(buf, conn->param_list, 0) < 0) { +- iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR, +- ISCSI_LOGIN_STATUS_NO_RESOURCES); ++ if (iscsi_change_param_sprintf(conn, "RDMAExtensions=Yes")) + return -1; +- } ++ + /* + * Make MaxRecvDataSegmentLength PAGE_SIZE aligned for + * Immediate Data + Unsolicitied Data-OUT if necessary.. +@@ -446,12 +454,8 @@ static int iscsi_login_zero_tsih_s2( + pr_warn("Aligning ISER MaxRecvDataSegmentLength: %lu down" + " to PAGE_SIZE\n", mrdsl); + +- sprintf(buf, "MaxRecvDataSegmentLength=%lu\n", mrdsl); +- if (iscsi_change_param_value(buf, conn->param_list, 0) < 0) { +- iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR, +- ISCSI_LOGIN_STATUS_NO_RESOURCES); ++ if (iscsi_change_param_sprintf(conn, "MaxRecvDataSegmentLength=%lu\n", mrdsl)) + return -1; +- } + } + + return 0; +@@ -984,6 +988,7 @@ int iscsi_target_setup_login_socket( + } + + np->np_transport = t; ++ np->enabled = true; + return 0; + } + +diff --git a/drivers/target/iscsi/iscsi_target_tpg.c b/drivers/target/iscsi/iscsi_target_tpg.c +index f31b4c5cdf3f..75a4e83842c2 100644 +--- a/drivers/target/iscsi/iscsi_target_tpg.c ++++ b/drivers/target/iscsi/iscsi_target_tpg.c +@@ -175,13 +175,16 @@ void iscsit_put_tpg(struct iscsi_portal_group *tpg) + + static void iscsit_clear_tpg_np_login_thread( + struct iscsi_tpg_np *tpg_np, +- struct iscsi_portal_group *tpg) ++ struct iscsi_portal_group *tpg, ++ bool shutdown) + { + if (!tpg_np->tpg_np) { + pr_err("struct iscsi_tpg_np->tpg_np is NULL!\n"); + return; + } + ++ if (shutdown) ++ tpg_np->tpg_np->enabled = false; + iscsit_reset_np_thread(tpg_np->tpg_np, tpg_np, tpg); + } + +@@ -197,7 +200,7 @@ void iscsit_clear_tpg_np_login_threads( + continue; + } + spin_unlock(&tpg->tpg_np_lock); +- iscsit_clear_tpg_np_login_thread(tpg_np, tpg); ++ iscsit_clear_tpg_np_login_thread(tpg_np, tpg, false); + spin_lock(&tpg->tpg_np_lock); + } + spin_unlock(&tpg->tpg_np_lock); +@@ -520,7 +523,7 @@ static int iscsit_tpg_release_np( + struct iscsi_portal_group *tpg, + struct iscsi_np *np) + { +- iscsit_clear_tpg_np_login_thread(tpg_np, tpg); ++ iscsit_clear_tpg_np_login_thread(tpg_np, tpg, true); + + pr_debug("CORE[%s] - Removed Network Portal: %s:%hu,%hu on %s\n", + tpg->tpg_tiqn->tiqn, np->np_ip, np->np_port, tpg->tpgt, +diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c +index f608fbc14a27..df58a67f81e0 100644 +--- a/drivers/target/target_core_alua.c ++++ b/drivers/target/target_core_alua.c +@@ -409,7 +409,16 @@ static inline int core_alua_state_standby( + case REPORT_LUNS: + case RECEIVE_DIAGNOSTIC: + case SEND_DIAGNOSTIC: ++ case READ_CAPACITY: + return 0; ++ case SERVICE_ACTION_IN: ++ switch (cdb[1] & 0x1f) { ++ case SAI_READ_CAPACITY_16: ++ return 0; ++ default: ++ *alua_ascq = ASCQ_04H_ALUA_TG_PT_STANDBY; ++ return 1; ++ } + case MAINTENANCE_IN: + switch (cdb[1] & 0x1f) { + case MI_REPORT_TARGET_PGS: +diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c +index 4a8bd36d3958..8cda4080b597 100644 +--- a/drivers/target/target_core_configfs.c ++++ b/drivers/target/target_core_configfs.c +@@ -2034,6 +2034,11 @@ static ssize_t target_core_alua_tg_pt_gp_store_attr_alua_access_state( + " tg_pt_gp ID: %hu\n", tg_pt_gp->tg_pt_gp_valid_id); + return -EINVAL; + } ++ if (!(dev->dev_flags & DF_CONFIGURED)) { ++ pr_err("Unable to set alua_access_state while device is" ++ " not configured\n"); ++ return -ENODEV; ++ } + + ret = strict_strtoul(page, 0, &tmp); + if (ret < 0) { +diff --git a/fs/attr.c b/fs/attr.c +index 8dd5825ec708..66fa6251c398 100644 +--- a/fs/attr.c ++++ b/fs/attr.c +@@ -50,14 +50,14 @@ int inode_change_ok(const struct inode *inode, struct iattr *attr) + if ((ia_valid & ATTR_UID) && + (!uid_eq(current_fsuid(), inode->i_uid) || + !uid_eq(attr->ia_uid, inode->i_uid)) && +- !inode_capable(inode, CAP_CHOWN)) ++ !capable_wrt_inode_uidgid(inode, CAP_CHOWN)) + return -EPERM; + + /* Make sure caller can chgrp. */ + if ((ia_valid & ATTR_GID) && + (!uid_eq(current_fsuid(), inode->i_uid) || + (!in_group_p(attr->ia_gid) && !gid_eq(attr->ia_gid, inode->i_gid))) && +- !inode_capable(inode, CAP_CHOWN)) ++ !capable_wrt_inode_uidgid(inode, CAP_CHOWN)) + return -EPERM; + + /* Make sure a caller can chmod. */ +@@ -67,7 +67,7 @@ int inode_change_ok(const struct inode *inode, struct iattr *attr) + /* Also check the setgid bit! */ + if (!in_group_p((ia_valid & ATTR_GID) ? attr->ia_gid : + inode->i_gid) && +- !inode_capable(inode, CAP_FSETID)) ++ !capable_wrt_inode_uidgid(inode, CAP_FSETID)) + attr->ia_mode &= ~S_ISGID; + } + +@@ -160,7 +160,7 @@ void setattr_copy(struct inode *inode, const struct iattr *attr) + umode_t mode = attr->ia_mode; + + if (!in_group_p(inode->i_gid) && +- !inode_capable(inode, CAP_FSETID)) ++ !capable_wrt_inode_uidgid(inode, CAP_FSETID)) + mode &= ~S_ISGID; + inode->i_mode = mode; + } +diff --git a/fs/inode.c b/fs/inode.c +index 00d5fc3b86e1..1b300a06b8be 100644 +--- a/fs/inode.c ++++ b/fs/inode.c +@@ -1837,14 +1837,18 @@ EXPORT_SYMBOL(inode_init_owner); + * inode_owner_or_capable - check current task permissions to inode + * @inode: inode being checked + * +- * Return true if current either has CAP_FOWNER to the inode, or +- * owns the file. ++ * Return true if current either has CAP_FOWNER in a namespace with the ++ * inode owner uid mapped, or owns the file. + */ + bool inode_owner_or_capable(const struct inode *inode) + { ++ struct user_namespace *ns; ++ + if (uid_eq(current_fsuid(), inode->i_uid)) + return true; +- if (inode_capable(inode, CAP_FOWNER)) ++ ++ ns = current_user_ns(); ++ if (ns_capable(ns, CAP_FOWNER) && kuid_has_mapping(ns, inode->i_uid)) + return true; + return false; + } +diff --git a/fs/namei.c b/fs/namei.c +index 1211ee5a1cb3..6ac16a37ded2 100644 +--- a/fs/namei.c ++++ b/fs/namei.c +@@ -321,10 +321,11 @@ int generic_permission(struct inode *inode, int mask) + + if (S_ISDIR(inode->i_mode)) { + /* DACs are overridable for directories */ +- if (inode_capable(inode, CAP_DAC_OVERRIDE)) ++ if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE)) + return 0; + if (!(mask & MAY_WRITE)) +- if (inode_capable(inode, CAP_DAC_READ_SEARCH)) ++ if (capable_wrt_inode_uidgid(inode, ++ CAP_DAC_READ_SEARCH)) + return 0; + return -EACCES; + } +@@ -334,7 +335,7 @@ int generic_permission(struct inode *inode, int mask) + * at least one exec bit set. + */ + if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO)) +- if (inode_capable(inode, CAP_DAC_OVERRIDE)) ++ if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE)) + return 0; + + /* +@@ -342,7 +343,7 @@ int generic_permission(struct inode *inode, int mask) + */ + mask &= MAY_READ | MAY_WRITE | MAY_EXEC; + if (mask == MAY_READ) +- if (inode_capable(inode, CAP_DAC_READ_SEARCH)) ++ if (capable_wrt_inode_uidgid(inode, CAP_DAC_READ_SEARCH)) + return 0; + + return -EACCES; +@@ -2199,7 +2200,7 @@ static inline int check_sticky(struct inode *dir, struct inode *inode) + return 0; + if (uid_eq(dir->i_uid, fsuid)) + return 0; +- return !inode_capable(inode, CAP_FOWNER); ++ return !capable_wrt_inode_uidgid(inode, CAP_FOWNER); + } + + /* +diff --git a/include/linux/capability.h b/include/linux/capability.h +index d9a4f7f40f32..15f90929fb51 100644 +--- a/include/linux/capability.h ++++ b/include/linux/capability.h +@@ -211,7 +211,7 @@ extern bool has_ns_capability_noaudit(struct task_struct *t, + extern bool capable(int cap); + extern bool ns_capable(struct user_namespace *ns, int cap); + extern bool nsown_capable(int cap); +-extern bool inode_capable(const struct inode *inode, int cap); ++extern bool capable_wrt_inode_uidgid(const struct inode *inode, int cap); + extern bool file_ns_capable(const struct file *file, struct user_namespace *ns, int cap); + + /* audit system wants to get cap info from files as well */ +diff --git a/kernel/auditsc.c b/kernel/auditsc.c +index 9845cb32b60a..03a3af8538bd 100644 +--- a/kernel/auditsc.c ++++ b/kernel/auditsc.c +@@ -733,6 +733,22 @@ static enum audit_state audit_filter_task(struct task_struct *tsk, char **key) + return AUDIT_BUILD_CONTEXT; + } + ++static int audit_in_mask(const struct audit_krule *rule, unsigned long val) ++{ ++ int word, bit; ++ ++ if (val > 0xffffffff) ++ return false; ++ ++ word = AUDIT_WORD(val); ++ if (word >= AUDIT_BITMASK_SIZE) ++ return false; ++ ++ bit = AUDIT_BIT(val); ++ ++ return rule->mask[word] & bit; ++} ++ + /* At syscall entry and exit time, this filter is called if the + * audit_state is not low enough that auditing cannot take place, but is + * also not high enough that we already know we have to write an audit +@@ -750,11 +766,8 @@ static enum audit_state audit_filter_syscall(struct task_struct *tsk, + + rcu_read_lock(); + if (!list_empty(list)) { +- int word = AUDIT_WORD(ctx->major); +- int bit = AUDIT_BIT(ctx->major); +- + list_for_each_entry_rcu(e, list, list) { +- if ((e->rule.mask[word] & bit) == bit && ++ if (audit_in_mask(&e->rule, ctx->major) && + audit_filter_rules(tsk, &e->rule, ctx, NULL, + &state, false)) { + rcu_read_unlock(); +@@ -774,20 +787,16 @@ static enum audit_state audit_filter_syscall(struct task_struct *tsk, + static int audit_filter_inode_name(struct task_struct *tsk, + struct audit_names *n, + struct audit_context *ctx) { +- int word, bit; + int h = audit_hash_ino((u32)n->ino); + struct list_head *list = &audit_inode_hash[h]; + struct audit_entry *e; + enum audit_state state; + +- word = AUDIT_WORD(ctx->major); +- bit = AUDIT_BIT(ctx->major); +- + if (list_empty(list)) + return 0; + + list_for_each_entry_rcu(e, list, list) { +- if ((e->rule.mask[word] & bit) == bit && ++ if (audit_in_mask(&e->rule, ctx->major) && + audit_filter_rules(tsk, &e->rule, ctx, n, &state, false)) { + ctx->current_state = state; + return 1; +diff --git a/kernel/capability.c b/kernel/capability.c +index f6c2ce5701e1..d52eecc0942b 100644 +--- a/kernel/capability.c ++++ b/kernel/capability.c +@@ -445,22 +445,18 @@ bool nsown_capable(int cap) + } + + /** +- * inode_capable - Check superior capability over inode ++ * capable_wrt_inode_uidgid - Check nsown_capable and uid and gid mapped + * @inode: The inode in question + * @cap: The capability in question + * +- * Return true if the current task has the given superior capability +- * targeted at it's own user namespace and that the given inode is owned +- * by the current user namespace or a child namespace. +- * +- * Currently we check to see if an inode is owned by the current +- * user namespace by seeing if the inode's owner maps into the +- * current user namespace. +- * ++ * Return true if the current task has the given capability targeted at ++ * its own user namespace and that the given inode's uid and gid are ++ * mapped into the current user namespace. + */ +-bool inode_capable(const struct inode *inode, int cap) ++bool capable_wrt_inode_uidgid(const struct inode *inode, int cap) + { + struct user_namespace *ns = current_user_ns(); + +- return ns_capable(ns, cap) && kuid_has_mapping(ns, inode->i_uid); ++ return ns_capable(ns, cap) && kuid_has_mapping(ns, inode->i_uid) && ++ kgid_has_mapping(ns, inode->i_gid); + } +diff --git a/mm/compaction.c b/mm/compaction.c +index 18a90b4d0bfc..fb797a32362f 100644 +--- a/mm/compaction.c ++++ b/mm/compaction.c +@@ -657,17 +657,21 @@ static void isolate_freepages(struct zone *zone, + struct compact_control *cc) + { + struct page *page; +- unsigned long high_pfn, low_pfn, pfn, z_end_pfn, end_pfn; ++ unsigned long high_pfn, low_pfn, pfn, z_end_pfn; + int nr_freepages = cc->nr_freepages; + struct list_head *freelist = &cc->freepages; + + /* + * Initialise the free scanner. The starting point is where we last +- * scanned from (or the end of the zone if starting). The low point +- * is the end of the pageblock the migration scanner is using. ++ * successfully isolated from, zone-cached value, or the end of the ++ * zone when isolating for the first time. We need this aligned to ++ * the pageblock boundary, because we do pfn -= pageblock_nr_pages ++ * in the for loop. ++ * The low boundary is the end of the pageblock the migration scanner ++ * is using. + */ +- pfn = cc->free_pfn; +- low_pfn = cc->migrate_pfn + pageblock_nr_pages; ++ pfn = cc->free_pfn & ~(pageblock_nr_pages-1); ++ low_pfn = ALIGN(cc->migrate_pfn + 1, pageblock_nr_pages); + + /* + * Take care that if the migration scanner is at the end of the zone +@@ -683,9 +687,10 @@ static void isolate_freepages(struct zone *zone, + * pages on cc->migratepages. We stop searching if the migrate + * and free page scanners meet or enough free pages are isolated. + */ +- for (; pfn > low_pfn && cc->nr_migratepages > nr_freepages; ++ for (; pfn >= low_pfn && cc->nr_migratepages > nr_freepages; + pfn -= pageblock_nr_pages) { + unsigned long isolated; ++ unsigned long end_pfn; + + if (!pfn_valid(pfn)) + continue; +@@ -713,13 +718,10 @@ static void isolate_freepages(struct zone *zone, + isolated = 0; + + /* +- * As pfn may not start aligned, pfn+pageblock_nr_page +- * may cross a MAX_ORDER_NR_PAGES boundary and miss +- * a pfn_valid check. Ensure isolate_freepages_block() +- * only scans within a pageblock ++ * Take care when isolating in last pageblock of a zone which ++ * ends in the middle of a pageblock. + */ +- end_pfn = ALIGN(pfn + 1, pageblock_nr_pages); +- end_pfn = min(end_pfn, z_end_pfn); ++ end_pfn = min(pfn + pageblock_nr_pages, z_end_pfn); + isolated = isolate_freepages_block(cc, pfn, end_pfn, + freelist, false); + nr_freepages += isolated; +@@ -738,7 +740,14 @@ static void isolate_freepages(struct zone *zone, + /* split_free_page does not map the pages */ + map_pages(freelist); + +- cc->free_pfn = high_pfn; ++ /* ++ * If we crossed the migrate scanner, we want to keep it that way ++ * so that compact_finished() may detect this ++ */ ++ if (pfn < low_pfn) ++ cc->free_pfn = max(pfn, zone->zone_start_pfn); ++ else ++ cc->free_pfn = high_pfn; + cc->nr_freepages = nr_freepages; + } + +@@ -947,6 +956,14 @@ static int compact_zone(struct zone *zone, struct compact_control *cc) + } + + /* ++ * Clear pageblock skip if there were failures recently and compaction ++ * is about to be retried after being deferred. kswapd does not do ++ * this reset as it'll reset the cached information when going to sleep. ++ */ ++ if (compaction_restarting(zone, cc->order) && !current_is_kswapd()) ++ __reset_isolation_suitable(zone); ++ ++ /* + * Setup to move all movable pages to the end of the zone. Used cached + * information on where the scanners should start but check that it + * is initialised by ensuring the values are within zone boundaries. +@@ -962,14 +979,6 @@ static int compact_zone(struct zone *zone, struct compact_control *cc) + zone->compact_cached_migrate_pfn = cc->migrate_pfn; + } + +- /* +- * Clear pageblock skip if there were failures recently and compaction +- * is about to be retried after being deferred. kswapd does not do +- * this reset as it'll reset the cached information when going to sleep. +- */ +- if (compaction_restarting(zone, cc->order) && !current_is_kswapd()) +- __reset_isolation_suitable(zone); +- + migrate_prep_local(); + + while ((ret = compact_finished(zone, cc)) == COMPACT_CONTINUE) { +@@ -1003,7 +1012,11 @@ static int compact_zone(struct zone *zone, struct compact_control *cc) + if (err) { + putback_movable_pages(&cc->migratepages); + cc->nr_migratepages = 0; +- if (err == -ENOMEM) { ++ /* ++ * migrate_pages() may return -ENOMEM when scanners meet ++ * and we want compact_finished() to detect it ++ */ ++ if (err == -ENOMEM && cc->free_pfn > cc->migrate_pfn) { + ret = COMPACT_PARTIAL; + goto out; + } +diff --git a/net/ipv4/netfilter/nf_defrag_ipv4.c b/net/ipv4/netfilter/nf_defrag_ipv4.c +index 742815518b0f..4cfb3bd1677c 100644 +--- a/net/ipv4/netfilter/nf_defrag_ipv4.c ++++ b/net/ipv4/netfilter/nf_defrag_ipv4.c +@@ -22,7 +22,6 @@ + #endif + #include + +-/* Returns new sk_buff, or NULL */ + static int nf_ct_ipv4_gather_frags(struct sk_buff *skb, u_int32_t user) + { + int err; +@@ -33,8 +32,10 @@ static int nf_ct_ipv4_gather_frags(struct sk_buff *skb, u_int32_t user) + err = ip_defrag(skb, user); + local_bh_enable(); + +- if (!err) ++ if (!err) { + ip_send_check(ip_hdr(skb)); ++ skb->local_df = 1; ++ } + + return err; + } diff --git a/projects/Cuboxi/patches/linux/linux-000-patch-3.10.44-45.patch b/projects/Cuboxi/patches/linux/linux-000-patch-3.10.44-45.patch new file mode 100644 index 0000000000..839b58ee00 --- /dev/null +++ b/projects/Cuboxi/patches/linux/linux-000-patch-3.10.44-45.patch @@ -0,0 +1,2642 @@ +diff --git a/Makefile b/Makefile +index e55476c4aef0..8a63ca1db77a 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 10 +-SUBLEVEL = 44 ++SUBLEVEL = 45 + EXTRAVERSION = + NAME = TOSSUG Baby Fish + +diff --git a/arch/arm/mach-at91/sysirq_mask.c b/arch/arm/mach-at91/sysirq_mask.c +index 2ba694f9626b..f8bc3511a8c8 100644 +--- a/arch/arm/mach-at91/sysirq_mask.c ++++ b/arch/arm/mach-at91/sysirq_mask.c +@@ -25,24 +25,28 @@ + + #include "generic.h" + +-#define AT91_RTC_IDR 0x24 /* Interrupt Disable Register */ +-#define AT91_RTC_IMR 0x28 /* Interrupt Mask Register */ ++#define AT91_RTC_IDR 0x24 /* Interrupt Disable Register */ ++#define AT91_RTC_IMR 0x28 /* Interrupt Mask Register */ ++#define AT91_RTC_IRQ_MASK 0x1f /* Available IRQs mask */ + + void __init at91_sysirq_mask_rtc(u32 rtc_base) + { + void __iomem *base; +- u32 mask; + + base = ioremap(rtc_base, 64); + if (!base) + return; + +- mask = readl_relaxed(base + AT91_RTC_IMR); +- if (mask) { +- pr_info("AT91: Disabling rtc irq\n"); +- writel_relaxed(mask, base + AT91_RTC_IDR); +- (void)readl_relaxed(base + AT91_RTC_IMR); /* flush */ +- } ++ /* ++ * sam9x5 SoCs have the following errata: ++ * "RTC: Interrupt Mask Register cannot be used ++ * Interrupt Mask Register read always returns 0." ++ * ++ * Hence we're not relying on IMR values to disable ++ * interrupts. ++ */ ++ writel_relaxed(AT91_RTC_IRQ_MASK, base + AT91_RTC_IDR); ++ (void)readl_relaxed(base + AT91_RTC_IMR); /* flush */ + + iounmap(base); + } +diff --git a/arch/mips/kvm/kvm_mips.c b/arch/mips/kvm/kvm_mips.c +index dd203e59e6fd..426345ac6f6e 100644 +--- a/arch/mips/kvm/kvm_mips.c ++++ b/arch/mips/kvm/kvm_mips.c +@@ -299,7 +299,7 @@ struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm, unsigned int id) + if (cpu_has_veic || cpu_has_vint) { + size = 0x200 + VECTORSPACING * 64; + } else { +- size = 0x200; ++ size = 0x4000; + } + + /* Save Linux EBASE */ +diff --git a/arch/sparc/net/bpf_jit_comp.c b/arch/sparc/net/bpf_jit_comp.c +index fd95862c65aa..224fc0c71b8a 100644 +--- a/arch/sparc/net/bpf_jit_comp.c ++++ b/arch/sparc/net/bpf_jit_comp.c +@@ -83,9 +83,9 @@ static void bpf_flush_icache(void *start_, void *end_) + #define BNE (F2(0, 2) | CONDNE) + + #ifdef CONFIG_SPARC64 +-#define BNE_PTR (F2(0, 1) | CONDNE | (2 << 20)) ++#define BE_PTR (F2(0, 1) | CONDE | (2 << 20)) + #else +-#define BNE_PTR BNE ++#define BE_PTR BE + #endif + + #define SETHI(K, REG) \ +@@ -600,7 +600,7 @@ void bpf_jit_compile(struct sk_filter *fp) + case BPF_S_ANC_IFINDEX: + emit_skb_loadptr(dev, r_A); + emit_cmpi(r_A, 0); +- emit_branch(BNE_PTR, cleanup_addr + 4); ++ emit_branch(BE_PTR, cleanup_addr + 4); + emit_nop(); + emit_load32(r_A, struct net_device, ifindex, r_A); + break; +@@ -613,7 +613,7 @@ void bpf_jit_compile(struct sk_filter *fp) + case BPF_S_ANC_HATYPE: + emit_skb_loadptr(dev, r_A); + emit_cmpi(r_A, 0); +- emit_branch(BNE_PTR, cleanup_addr + 4); ++ emit_branch(BE_PTR, cleanup_addr + 4); + emit_nop(); + emit_load16(r_A, struct net_device, type, r_A); + break; +diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c +index 61d9fed5eb31..279d093524b4 100644 +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -370,6 +370,8 @@ static inline void apic_clear_irr(int vec, struct kvm_lapic *apic) + + static inline void apic_set_isr(int vec, struct kvm_lapic *apic) + { ++ /* Note that we never get here with APIC virtualization enabled. */ ++ + if (!__apic_test_and_set_vector(vec, apic->regs + APIC_ISR)) + ++apic->isr_count; + BUG_ON(apic->isr_count > MAX_APIC_VECTOR); +@@ -381,12 +383,48 @@ static inline void apic_set_isr(int vec, struct kvm_lapic *apic) + apic->highest_isr_cache = vec; + } + ++static inline int apic_find_highest_isr(struct kvm_lapic *apic) ++{ ++ int result; ++ ++ /* ++ * Note that isr_count is always 1, and highest_isr_cache ++ * is always -1, with APIC virtualization enabled. ++ */ ++ if (!apic->isr_count) ++ return -1; ++ if (likely(apic->highest_isr_cache != -1)) ++ return apic->highest_isr_cache; ++ ++ result = find_highest_vector(apic->regs + APIC_ISR); ++ ASSERT(result == -1 || result >= 16); ++ ++ return result; ++} ++ + static inline void apic_clear_isr(int vec, struct kvm_lapic *apic) + { +- if (__apic_test_and_clear_vector(vec, apic->regs + APIC_ISR)) ++ struct kvm_vcpu *vcpu; ++ if (!__apic_test_and_clear_vector(vec, apic->regs + APIC_ISR)) ++ return; ++ ++ vcpu = apic->vcpu; ++ ++ /* ++ * We do get here for APIC virtualization enabled if the guest ++ * uses the Hyper-V APIC enlightenment. In this case we may need ++ * to trigger a new interrupt delivery by writing the SVI field; ++ * on the other hand isr_count and highest_isr_cache are unused ++ * and must be left alone. ++ */ ++ if (unlikely(kvm_apic_vid_enabled(vcpu->kvm))) ++ kvm_x86_ops->hwapic_isr_update(vcpu->kvm, ++ apic_find_highest_isr(apic)); ++ else { + --apic->isr_count; +- BUG_ON(apic->isr_count < 0); +- apic->highest_isr_cache = -1; ++ BUG_ON(apic->isr_count < 0); ++ apic->highest_isr_cache = -1; ++ } + } + + int kvm_lapic_find_highest_irr(struct kvm_vcpu *vcpu) +@@ -466,22 +504,6 @@ static void pv_eoi_clr_pending(struct kvm_vcpu *vcpu) + __clear_bit(KVM_APIC_PV_EOI_PENDING, &vcpu->arch.apic_attention); + } + +-static inline int apic_find_highest_isr(struct kvm_lapic *apic) +-{ +- int result; +- +- /* Note that isr_count is always 1 with vid enabled */ +- if (!apic->isr_count) +- return -1; +- if (likely(apic->highest_isr_cache != -1)) +- return apic->highest_isr_cache; +- +- result = find_highest_vector(apic->regs + APIC_ISR); +- ASSERT(result == -1 || result >= 16); +- +- return result; +-} +- + void kvm_apic_update_tmr(struct kvm_vcpu *vcpu, u32 *tmr) + { + struct kvm_lapic *apic = vcpu->arch.apic; +@@ -1619,6 +1641,8 @@ int kvm_get_apic_interrupt(struct kvm_vcpu *vcpu) + int vector = kvm_apic_has_interrupt(vcpu); + struct kvm_lapic *apic = vcpu->arch.apic; + ++ /* Note that we never get here with APIC virtualization enabled. */ ++ + if (vector == -1) + return -1; + +diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c +index 1512e41cd93d..43665d0d0905 100644 +--- a/crypto/crypto_user.c ++++ b/crypto/crypto_user.c +@@ -466,7 +466,7 @@ static int crypto_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh) + type -= CRYPTO_MSG_BASE; + link = &crypto_dispatch[type]; + +- if (!capable(CAP_NET_ADMIN)) ++ if (!netlink_capable(skb, CAP_NET_ADMIN)) + return -EPERM; + + if ((type == (CRYPTO_MSG_GETALG - CRYPTO_MSG_BASE) && +diff --git a/drivers/connector/cn_proc.c b/drivers/connector/cn_proc.c +index 18c5b9b16645..3165811e2407 100644 +--- a/drivers/connector/cn_proc.c ++++ b/drivers/connector/cn_proc.c +@@ -369,7 +369,7 @@ static void cn_proc_mcast_ctl(struct cn_msg *msg, + return; + + /* Can only change if privileged. */ +- if (!capable(CAP_NET_ADMIN)) { ++ if (!__netlink_ns_capable(nsp, &init_user_ns, CAP_NET_ADMIN)) { + err = EPERM; + goto out; + } +diff --git a/drivers/hv/hv_balloon.c b/drivers/hv/hv_balloon.c +index deb5c25305af..694173f662d1 100644 +--- a/drivers/hv/hv_balloon.c ++++ b/drivers/hv/hv_balloon.c +@@ -19,6 +19,7 @@ + #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + + #include ++#include + #include + #include + #include +@@ -459,6 +460,11 @@ static bool do_hot_add; + */ + static uint pressure_report_delay = 45; + ++/* ++ * The last time we posted a pressure report to host. ++ */ ++static unsigned long last_post_time; ++ + module_param(hot_add, bool, (S_IRUGO | S_IWUSR)); + MODULE_PARM_DESC(hot_add, "If set attempt memory hot_add"); + +@@ -542,6 +548,7 @@ struct hv_dynmem_device { + + static struct hv_dynmem_device dm_device; + ++static void post_status(struct hv_dynmem_device *dm); + #ifdef CONFIG_MEMORY_HOTPLUG + + static void hv_bring_pgs_online(unsigned long start_pfn, unsigned long size) +@@ -612,7 +619,7 @@ static void hv_mem_hot_add(unsigned long start, unsigned long size, + * have not been "onlined" within the allowed time. + */ + wait_for_completion_timeout(&dm_device.ol_waitevent, 5*HZ); +- ++ post_status(&dm_device); + } + + return; +@@ -951,11 +958,17 @@ static void post_status(struct hv_dynmem_device *dm) + { + struct dm_status status; + struct sysinfo val; ++ unsigned long now = jiffies; ++ unsigned long last_post = last_post_time; + + if (pressure_report_delay > 0) { + --pressure_report_delay; + return; + } ++ ++ if (!time_after(now, (last_post_time + HZ))) ++ return; ++ + si_meminfo(&val); + memset(&status, 0, sizeof(struct dm_status)); + status.hdr.type = DM_STATUS_REPORT; +@@ -983,6 +996,14 @@ static void post_status(struct hv_dynmem_device *dm) + if (status.hdr.trans_id != atomic_read(&trans_id)) + return; + ++ /* ++ * If the last post time that we sampled has changed, ++ * we have raced, don't post the status. ++ */ ++ if (last_post != last_post_time) ++ return; ++ ++ last_post_time = jiffies; + vmbus_sendpacket(dm->dev->channel, &status, + sizeof(struct dm_status), + (unsigned long)NULL, +@@ -1117,7 +1138,7 @@ static void balloon_up(struct work_struct *dummy) + + if (ret == -EAGAIN) + msleep(20); +- ++ post_status(&dm_device); + } while (ret == -EAGAIN); + + if (ret) { +@@ -1144,8 +1165,10 @@ static void balloon_down(struct hv_dynmem_device *dm, + struct dm_unballoon_response resp; + int i; + +- for (i = 0; i < range_count; i++) ++ for (i = 0; i < range_count; i++) { + free_balloon_pages(dm, &range_array[i]); ++ post_status(&dm_device); ++ } + + if (req->more_pages == 1) + return; +diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c +index e5b88d5d3b59..14fdaf0f9d23 100644 +--- a/drivers/iio/adc/at91_adc.c ++++ b/drivers/iio/adc/at91_adc.c +@@ -161,12 +161,11 @@ static int at91_adc_channel_init(struct iio_dev *idev) + return idev->num_channels; + } + +-static u8 at91_adc_get_trigger_value_by_name(struct iio_dev *idev, ++static int at91_adc_get_trigger_value_by_name(struct iio_dev *idev, + struct at91_adc_trigger *triggers, + const char *trigger_name) + { + struct at91_adc_state *st = iio_priv(idev); +- u8 value = 0; + int i; + + for (i = 0; i < st->trigger_number; i++) { +@@ -179,15 +178,16 @@ static u8 at91_adc_get_trigger_value_by_name(struct iio_dev *idev, + return -ENOMEM; + + if (strcmp(trigger_name, name) == 0) { +- value = triggers[i].value; + kfree(name); +- break; ++ if (triggers[i].value == 0) ++ return -EINVAL; ++ return triggers[i].value; + } + + kfree(name); + } + +- return value; ++ return -EINVAL; + } + + static int at91_adc_configure_trigger(struct iio_trigger *trig, bool state) +@@ -197,14 +197,14 @@ static int at91_adc_configure_trigger(struct iio_trigger *trig, bool state) + struct iio_buffer *buffer = idev->buffer; + struct at91_adc_reg_desc *reg = st->registers; + u32 status = at91_adc_readl(st, reg->trigger_register); +- u8 value; ++ int value; + u8 bit; + + value = at91_adc_get_trigger_value_by_name(idev, + st->trigger_list, + idev->trig->name); +- if (value == 0) +- return -EINVAL; ++ if (value < 0) ++ return value; + + if (state) { + st->buffer = kmalloc(idev->scan_bytes, GFP_KERNEL); +diff --git a/drivers/iio/adc/max1363.c b/drivers/iio/adc/max1363.c +index 9e6da72ad823..b2b5dcbf7122 100644 +--- a/drivers/iio/adc/max1363.c ++++ b/drivers/iio/adc/max1363.c +@@ -1214,8 +1214,8 @@ static const struct max1363_chip_info max1363_chip_info_tbl[] = { + .num_modes = ARRAY_SIZE(max1238_mode_list), + .default_mode = s0to11, + .info = &max1238_info, +- .channels = max1238_channels, +- .num_channels = ARRAY_SIZE(max1238_channels), ++ .channels = max1038_channels, ++ .num_channels = ARRAY_SIZE(max1038_channels), + }, + [max11605] = { + .bits = 8, +@@ -1224,8 +1224,8 @@ static const struct max1363_chip_info max1363_chip_info_tbl[] = { + .num_modes = ARRAY_SIZE(max1238_mode_list), + .default_mode = s0to11, + .info = &max1238_info, +- .channels = max1238_channels, +- .num_channels = ARRAY_SIZE(max1238_channels), ++ .channels = max1038_channels, ++ .num_channels = ARRAY_SIZE(max1038_channels), + }, + [max11606] = { + .bits = 10, +@@ -1274,8 +1274,8 @@ static const struct max1363_chip_info max1363_chip_info_tbl[] = { + .num_modes = ARRAY_SIZE(max1238_mode_list), + .default_mode = s0to11, + .info = &max1238_info, +- .channels = max1238_channels, +- .num_channels = ARRAY_SIZE(max1238_channels), ++ .channels = max1138_channels, ++ .num_channels = ARRAY_SIZE(max1138_channels), + }, + [max11611] = { + .bits = 10, +@@ -1284,8 +1284,8 @@ static const struct max1363_chip_info max1363_chip_info_tbl[] = { + .num_modes = ARRAY_SIZE(max1238_mode_list), + .default_mode = s0to11, + .info = &max1238_info, +- .channels = max1238_channels, +- .num_channels = ARRAY_SIZE(max1238_channels), ++ .channels = max1138_channels, ++ .num_channels = ARRAY_SIZE(max1138_channels), + }, + [max11612] = { + .bits = 12, +diff --git a/drivers/iio/magnetometer/ak8975.c b/drivers/iio/magnetometer/ak8975.c +index af6c320a534e..53f829004a03 100644 +--- a/drivers/iio/magnetometer/ak8975.c ++++ b/drivers/iio/magnetometer/ak8975.c +@@ -276,8 +276,6 @@ static int ak8975_read_axis(struct iio_dev *indio_dev, int index, int *val) + { + struct ak8975_data *data = iio_priv(indio_dev); + struct i2c_client *client = data->client; +- u16 meas_reg; +- s16 raw; + int ret; + + mutex_lock(&data->lock); +@@ -322,16 +320,11 @@ static int ak8975_read_axis(struct iio_dev *indio_dev, int index, int *val) + dev_err(&client->dev, "Read axis data fails\n"); + goto exit; + } +- meas_reg = ret; + + mutex_unlock(&data->lock); + +- /* Endian conversion of the measured values. */ +- raw = (s16) (le16_to_cpu(meas_reg)); +- + /* Clamp to valid range. */ +- raw = clamp_t(s16, raw, -4096, 4095); +- *val = raw; ++ *val = clamp_t(s16, ret, -4096, 4095); + return IIO_VAL_INT; + + exit: +diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c +index 1b195fc7f411..3fb2643d05b4 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/main.c ++++ b/drivers/net/ethernet/mellanox/mlx4/main.c +@@ -2129,13 +2129,8 @@ static int __mlx4_init_one(struct pci_dev *pdev, int pci_dev_data) + /* Allow large DMA segments, up to the firmware limit of 1 GB */ + dma_set_max_seg_size(&pdev->dev, 1024 * 1024 * 1024); + +- priv = kzalloc(sizeof(*priv), GFP_KERNEL); +- if (!priv) { +- err = -ENOMEM; +- goto err_release_regions; +- } +- +- dev = &priv->dev; ++ dev = pci_get_drvdata(pdev); ++ priv = mlx4_priv(dev); + dev->pdev = pdev; + INIT_LIST_HEAD(&priv->ctx_list); + spin_lock_init(&priv->ctx_lock); +@@ -2300,8 +2295,7 @@ slave_start: + mlx4_sense_init(dev); + mlx4_start_sense(dev); + +- priv->pci_dev_data = pci_dev_data; +- pci_set_drvdata(pdev, dev); ++ priv->removed = 0; + + return 0; + +@@ -2367,84 +2361,110 @@ err_disable_pdev: + + static int mlx4_init_one(struct pci_dev *pdev, const struct pci_device_id *id) + { ++ struct mlx4_priv *priv; ++ struct mlx4_dev *dev; ++ + printk_once(KERN_INFO "%s", mlx4_version); + ++ priv = kzalloc(sizeof(*priv), GFP_KERNEL); ++ if (!priv) ++ return -ENOMEM; ++ ++ dev = &priv->dev; ++ pci_set_drvdata(pdev, dev); ++ priv->pci_dev_data = id->driver_data; ++ + return __mlx4_init_one(pdev, id->driver_data); + } + +-static void mlx4_remove_one(struct pci_dev *pdev) ++static void __mlx4_remove_one(struct pci_dev *pdev) + { + struct mlx4_dev *dev = pci_get_drvdata(pdev); + struct mlx4_priv *priv = mlx4_priv(dev); ++ int pci_dev_data; + int p; + +- if (dev) { +- /* in SRIOV it is not allowed to unload the pf's +- * driver while there are alive vf's */ +- if (mlx4_is_master(dev)) { +- if (mlx4_how_many_lives_vf(dev)) +- printk(KERN_ERR "Removing PF when there are assigned VF's !!!\n"); +- } +- mlx4_stop_sense(dev); +- mlx4_unregister_device(dev); ++ if (priv->removed) ++ return; + +- for (p = 1; p <= dev->caps.num_ports; p++) { +- mlx4_cleanup_port_info(&priv->port[p]); +- mlx4_CLOSE_PORT(dev, p); +- } ++ pci_dev_data = priv->pci_dev_data; + +- if (mlx4_is_master(dev)) +- mlx4_free_resource_tracker(dev, +- RES_TR_FREE_SLAVES_ONLY); +- +- mlx4_cleanup_counters_table(dev); +- mlx4_cleanup_mcg_table(dev); +- mlx4_cleanup_qp_table(dev); +- mlx4_cleanup_srq_table(dev); +- mlx4_cleanup_cq_table(dev); +- mlx4_cmd_use_polling(dev); +- mlx4_cleanup_eq_table(dev); +- mlx4_cleanup_mr_table(dev); +- mlx4_cleanup_xrcd_table(dev); +- mlx4_cleanup_pd_table(dev); ++ /* in SRIOV it is not allowed to unload the pf's ++ * driver while there are alive vf's */ ++ if (mlx4_is_master(dev)) { ++ if (mlx4_how_many_lives_vf(dev)) ++ printk(KERN_ERR "Removing PF when there are assigned VF's !!!\n"); ++ } ++ mlx4_stop_sense(dev); ++ mlx4_unregister_device(dev); + +- if (mlx4_is_master(dev)) +- mlx4_free_resource_tracker(dev, +- RES_TR_FREE_STRUCTS_ONLY); +- +- iounmap(priv->kar); +- mlx4_uar_free(dev, &priv->driver_uar); +- mlx4_cleanup_uar_table(dev); +- if (!mlx4_is_slave(dev)) +- mlx4_clear_steering(dev); +- mlx4_free_eq_table(dev); +- if (mlx4_is_master(dev)) +- mlx4_multi_func_cleanup(dev); +- mlx4_close_hca(dev); +- if (mlx4_is_slave(dev)) +- mlx4_multi_func_cleanup(dev); +- mlx4_cmd_cleanup(dev); +- +- if (dev->flags & MLX4_FLAG_MSI_X) +- pci_disable_msix(pdev); +- if (dev->flags & MLX4_FLAG_SRIOV) { +- mlx4_warn(dev, "Disabling SR-IOV\n"); +- pci_disable_sriov(pdev); +- } ++ for (p = 1; p <= dev->caps.num_ports; p++) { ++ mlx4_cleanup_port_info(&priv->port[p]); ++ mlx4_CLOSE_PORT(dev, p); ++ } ++ ++ if (mlx4_is_master(dev)) ++ mlx4_free_resource_tracker(dev, ++ RES_TR_FREE_SLAVES_ONLY); ++ ++ mlx4_cleanup_counters_table(dev); ++ mlx4_cleanup_qp_table(dev); ++ mlx4_cleanup_srq_table(dev); ++ mlx4_cleanup_cq_table(dev); ++ mlx4_cmd_use_polling(dev); ++ mlx4_cleanup_eq_table(dev); ++ mlx4_cleanup_mcg_table(dev); ++ mlx4_cleanup_mr_table(dev); ++ mlx4_cleanup_xrcd_table(dev); ++ mlx4_cleanup_pd_table(dev); + +- if (!mlx4_is_slave(dev)) +- mlx4_free_ownership(dev); ++ if (mlx4_is_master(dev)) ++ mlx4_free_resource_tracker(dev, ++ RES_TR_FREE_STRUCTS_ONLY); + +- kfree(dev->caps.qp0_tunnel); +- kfree(dev->caps.qp0_proxy); +- kfree(dev->caps.qp1_tunnel); +- kfree(dev->caps.qp1_proxy); ++ iounmap(priv->kar); ++ mlx4_uar_free(dev, &priv->driver_uar); ++ mlx4_cleanup_uar_table(dev); ++ if (!mlx4_is_slave(dev)) ++ mlx4_clear_steering(dev); ++ mlx4_free_eq_table(dev); ++ if (mlx4_is_master(dev)) ++ mlx4_multi_func_cleanup(dev); ++ mlx4_close_hca(dev); ++ if (mlx4_is_slave(dev)) ++ mlx4_multi_func_cleanup(dev); ++ mlx4_cmd_cleanup(dev); + +- kfree(priv); +- pci_release_regions(pdev); +- pci_disable_device(pdev); +- pci_set_drvdata(pdev, NULL); ++ if (dev->flags & MLX4_FLAG_MSI_X) ++ pci_disable_msix(pdev); ++ if (dev->flags & MLX4_FLAG_SRIOV) { ++ mlx4_warn(dev, "Disabling SR-IOV\n"); ++ pci_disable_sriov(pdev); + } ++ ++ if (!mlx4_is_slave(dev)) ++ mlx4_free_ownership(dev); ++ ++ kfree(dev->caps.qp0_tunnel); ++ kfree(dev->caps.qp0_proxy); ++ kfree(dev->caps.qp1_tunnel); ++ kfree(dev->caps.qp1_proxy); ++ ++ pci_release_regions(pdev); ++ pci_disable_device(pdev); ++ memset(priv, 0, sizeof(*priv)); ++ priv->pci_dev_data = pci_dev_data; ++ priv->removed = 1; ++} ++ ++static void mlx4_remove_one(struct pci_dev *pdev) ++{ ++ struct mlx4_dev *dev = pci_get_drvdata(pdev); ++ struct mlx4_priv *priv = mlx4_priv(dev); ++ ++ __mlx4_remove_one(pdev); ++ kfree(priv); ++ pci_set_drvdata(pdev, NULL); + } + + int mlx4_restart_one(struct pci_dev *pdev) +@@ -2454,7 +2474,7 @@ int mlx4_restart_one(struct pci_dev *pdev) + int pci_dev_data; + + pci_dev_data = priv->pci_dev_data; +- mlx4_remove_one(pdev); ++ __mlx4_remove_one(pdev); + return __mlx4_init_one(pdev, pci_dev_data); + } + +@@ -2509,7 +2529,7 @@ MODULE_DEVICE_TABLE(pci, mlx4_pci_table); + static pci_ers_result_t mlx4_pci_err_detected(struct pci_dev *pdev, + pci_channel_state_t state) + { +- mlx4_remove_one(pdev); ++ __mlx4_remove_one(pdev); + + return state == pci_channel_io_perm_failure ? + PCI_ERS_RESULT_DISCONNECT : PCI_ERS_RESULT_NEED_RESET; +@@ -2517,7 +2537,11 @@ static pci_ers_result_t mlx4_pci_err_detected(struct pci_dev *pdev, + + static pci_ers_result_t mlx4_pci_slot_reset(struct pci_dev *pdev) + { +- int ret = __mlx4_init_one(pdev, 0); ++ struct mlx4_dev *dev = pci_get_drvdata(pdev); ++ struct mlx4_priv *priv = mlx4_priv(dev); ++ int ret; ++ ++ ret = __mlx4_init_one(pdev, priv->pci_dev_data); + + return ret ? PCI_ERS_RESULT_DISCONNECT : PCI_ERS_RESULT_RECOVERED; + } +diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4.h b/drivers/net/ethernet/mellanox/mlx4/mlx4.h +index df15bb6631cc..da4f0002fd27 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h ++++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h +@@ -743,6 +743,7 @@ struct mlx4_priv { + spinlock_t ctx_lock; + + int pci_dev_data; ++ int removed; + + struct list_head pgdir_list; + struct mutex pgdir_mutex; +diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c +index c12aeaee22fa..155ef4bbde91 100644 +--- a/drivers/net/macvlan.c ++++ b/drivers/net/macvlan.c +@@ -961,7 +961,6 @@ static int macvlan_device_event(struct notifier_block *unused, + list_for_each_entry_safe(vlan, next, &port->vlans, list) + vlan->dev->rtnl_link_ops->dellink(vlan->dev, &list_kill); + unregister_netdevice_many(&list_kill); +- list_del(&list_kill); + break; + case NETDEV_PRE_TYPE_CHANGE: + /* Forbid underlaying device to change its type. */ +diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c +index fe3fd77821bf..12222290c802 100644 +--- a/drivers/net/team/team.c ++++ b/drivers/net/team/team.c +@@ -1542,6 +1542,7 @@ static int team_change_mtu(struct net_device *dev, int new_mtu) + * to traverse list in reverse under rcu_read_lock + */ + mutex_lock(&team->lock); ++ team->port_mtu_change_allowed = true; + list_for_each_entry(port, &team->port_list, list) { + err = dev_set_mtu(port->dev, new_mtu); + if (err) { +@@ -1550,6 +1551,7 @@ static int team_change_mtu(struct net_device *dev, int new_mtu) + goto unwind; + } + } ++ team->port_mtu_change_allowed = false; + mutex_unlock(&team->lock); + + dev->mtu = new_mtu; +@@ -1559,6 +1561,7 @@ static int team_change_mtu(struct net_device *dev, int new_mtu) + unwind: + list_for_each_entry_continue_reverse(port, &team->port_list, list) + dev_set_mtu(port->dev, dev->mtu); ++ team->port_mtu_change_allowed = false; + mutex_unlock(&team->lock); + + return err; +@@ -2678,7 +2681,9 @@ static int team_device_event(struct notifier_block *unused, + break; + case NETDEV_CHANGEMTU: + /* Forbid to change mtu of underlaying device */ +- return NOTIFY_BAD; ++ if (!port->team->port_mtu_change_allowed) ++ return NOTIFY_BAD; ++ break; + case NETDEV_PRE_TYPE_CHANGE: + /* Forbid to change type of underlaying device */ + return NOTIFY_BAD; +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index 7be4860ccfd7..6fb0082b3308 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -739,7 +739,12 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x2357, 0x9000, 4)}, /* TP-LINK MA260 */ + {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */ + {QMI_FIXED_INTF(0x1bc7, 0x1201, 2)}, /* Telit LE920 */ +- {QMI_FIXED_INTF(0x0b3c, 0xc005, 6)}, /* Olivetti Olicard 200 */ ++ {QMI_FIXED_INTF(0x0b3c, 0xc000, 4)}, /* Olivetti Olicard 100 */ ++ {QMI_FIXED_INTF(0x0b3c, 0xc001, 4)}, /* Olivetti Olicard 120 */ ++ {QMI_FIXED_INTF(0x0b3c, 0xc002, 4)}, /* Olivetti Olicard 140 */ ++ {QMI_FIXED_INTF(0x0b3c, 0xc004, 6)}, /* Olivetti Olicard 155 */ ++ {QMI_FIXED_INTF(0x0b3c, 0xc005, 6)}, /* Olivetti Olicard 200 */ ++ {QMI_FIXED_INTF(0x0b3c, 0xc00a, 6)}, /* Olivetti Olicard 160 */ + {QMI_FIXED_INTF(0x0b3c, 0xc00b, 4)}, /* Olivetti Olicard 500 */ + {QMI_FIXED_INTF(0x1e2d, 0x0060, 4)}, /* Cinterion PLxx */ + {QMI_FIXED_INTF(0x1e2d, 0x0053, 4)}, /* Cinterion PHxx,PXxx */ +diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c +index 9673edfff451..fcbd4eee52cc 100644 +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -1314,7 +1314,7 @@ static void vxlan_setup(struct net_device *dev) + + eth_hw_addr_random(dev); + ether_setup(dev); +- dev->hard_header_len = ETH_HLEN + VXLAN_HEADROOM; ++ dev->needed_headroom = ETH_HLEN + VXLAN_HEADROOM; + + dev->netdev_ops = &vxlan_netdev_ops; + dev->destructor = vxlan_free; +@@ -1454,7 +1454,7 @@ static int vxlan_newlink(struct net *net, struct net_device *dev, + dev->mtu = lowerdev->mtu - VXLAN_HEADROOM; + + /* update header length based on lower device */ +- dev->hard_header_len = lowerdev->hard_header_len + ++ dev->needed_headroom = lowerdev->hard_header_len + + VXLAN_HEADROOM; + } + +diff --git a/drivers/rtc/rtc-at91rm9200.c b/drivers/rtc/rtc-at91rm9200.c +index 1237c2173c6d..e51cc5fec98a 100644 +--- a/drivers/rtc/rtc-at91rm9200.c ++++ b/drivers/rtc/rtc-at91rm9200.c +@@ -49,6 +49,7 @@ struct at91_rtc_config { + + static const struct at91_rtc_config *at91_rtc_config; + static DECLARE_COMPLETION(at91_rtc_updated); ++static DECLARE_COMPLETION(at91_rtc_upd_rdy); + static unsigned int at91_alarm_year = AT91_RTC_EPOCH; + static void __iomem *at91_rtc_regs; + static int irq; +@@ -162,6 +163,8 @@ static int at91_rtc_settime(struct device *dev, struct rtc_time *tm) + 1900 + tm->tm_year, tm->tm_mon, tm->tm_mday, + tm->tm_hour, tm->tm_min, tm->tm_sec); + ++ wait_for_completion(&at91_rtc_upd_rdy); ++ + /* Stop Time/Calendar from counting */ + cr = at91_rtc_read(AT91_RTC_CR); + at91_rtc_write(AT91_RTC_CR, cr | AT91_RTC_UPDCAL | AT91_RTC_UPDTIM); +@@ -184,7 +187,9 @@ static int at91_rtc_settime(struct device *dev, struct rtc_time *tm) + + /* Restart Time/Calendar */ + cr = at91_rtc_read(AT91_RTC_CR); ++ at91_rtc_write(AT91_RTC_SCCR, AT91_RTC_SECEV); + at91_rtc_write(AT91_RTC_CR, cr & ~(AT91_RTC_UPDCAL | AT91_RTC_UPDTIM)); ++ at91_rtc_write_ier(AT91_RTC_SECEV); + + return 0; + } +@@ -291,8 +296,10 @@ static irqreturn_t at91_rtc_interrupt(int irq, void *dev_id) + if (rtsr) { /* this interrupt is shared! Is it ours? */ + if (rtsr & AT91_RTC_ALARM) + events |= (RTC_AF | RTC_IRQF); +- if (rtsr & AT91_RTC_SECEV) +- events |= (RTC_UF | RTC_IRQF); ++ if (rtsr & AT91_RTC_SECEV) { ++ complete(&at91_rtc_upd_rdy); ++ at91_rtc_write_idr(AT91_RTC_SECEV); ++ } + if (rtsr & AT91_RTC_ACKUPD) + complete(&at91_rtc_updated); + +@@ -415,6 +422,11 @@ static int __init at91_rtc_probe(struct platform_device *pdev) + } + platform_set_drvdata(pdev, rtc); + ++ /* enable SECEV interrupt in order to initialize at91_rtc_upd_rdy ++ * completion. ++ */ ++ at91_rtc_write_ier(AT91_RTC_SECEV); ++ + dev_info(&pdev->dev, "AT91 Real Time Clock driver.\n"); + return 0; + +diff --git a/drivers/scsi/scsi_netlink.c b/drivers/scsi/scsi_netlink.c +index fe30ea94ffe6..109802f776ed 100644 +--- a/drivers/scsi/scsi_netlink.c ++++ b/drivers/scsi/scsi_netlink.c +@@ -77,7 +77,7 @@ scsi_nl_rcv_msg(struct sk_buff *skb) + goto next_msg; + } + +- if (!capable(CAP_SYS_ADMIN)) { ++ if (!netlink_capable(skb, CAP_SYS_ADMIN)) { + err = -EPERM; + goto next_msg; + } +diff --git a/drivers/staging/iio/light/tsl2x7x_core.c b/drivers/staging/iio/light/tsl2x7x_core.c +index c99f890cc6c6..64c73adfa3b0 100644 +--- a/drivers/staging/iio/light/tsl2x7x_core.c ++++ b/drivers/staging/iio/light/tsl2x7x_core.c +@@ -672,9 +672,13 @@ static int tsl2x7x_chip_on(struct iio_dev *indio_dev) + chip->tsl2x7x_config[TSL2X7X_PRX_COUNT] = + chip->tsl2x7x_settings.prox_pulse_count; + chip->tsl2x7x_config[TSL2X7X_PRX_MINTHRESHLO] = +- chip->tsl2x7x_settings.prox_thres_low; ++ (chip->tsl2x7x_settings.prox_thres_low) & 0xFF; ++ chip->tsl2x7x_config[TSL2X7X_PRX_MINTHRESHHI] = ++ (chip->tsl2x7x_settings.prox_thres_low >> 8) & 0xFF; + chip->tsl2x7x_config[TSL2X7X_PRX_MAXTHRESHLO] = +- chip->tsl2x7x_settings.prox_thres_high; ++ (chip->tsl2x7x_settings.prox_thres_high) & 0xFF; ++ chip->tsl2x7x_config[TSL2X7X_PRX_MAXTHRESHHI] = ++ (chip->tsl2x7x_settings.prox_thres_high >> 8) & 0xFF; + + /* and make sure we're not already on */ + if (chip->tsl2x7x_chip_status == TSL2X7X_CHIP_WORKING) { +diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c +index 130a1e4f96a1..3c9a8dfd1c2e 100644 +--- a/drivers/target/iscsi/iscsi_target_auth.c ++++ b/drivers/target/iscsi/iscsi_target_auth.c +@@ -316,6 +316,16 @@ static int chap_server_compute_md5( + goto out; + } + /* ++ * During mutual authentication, the CHAP_C generated by the ++ * initiator must not match the original CHAP_C generated by ++ * the target. ++ */ ++ if (!memcmp(challenge_binhex, chap->challenge, CHAP_CHALLENGE_LENGTH)) { ++ pr_err("initiator CHAP_C matches target CHAP_C, failing" ++ " login attempt\n"); ++ goto out; ++ } ++ /* + * Generate CHAP_N and CHAP_R for mutual authentication. + */ + tfm = crypto_alloc_hash("md5", 0, CRYPTO_ALG_ASYNC); +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index 89cce1a32059..fbf3f11aed2c 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -122,13 +122,23 @@ static void acm_release_minor(struct acm *acm) + static int acm_ctrl_msg(struct acm *acm, int request, int value, + void *buf, int len) + { +- int retval = usb_control_msg(acm->dev, usb_sndctrlpipe(acm->dev, 0), ++ int retval; ++ ++ retval = usb_autopm_get_interface(acm->control); ++ if (retval) ++ return retval; ++ ++ retval = usb_control_msg(acm->dev, usb_sndctrlpipe(acm->dev, 0), + request, USB_RT_ACM, value, + acm->control->altsetting[0].desc.bInterfaceNumber, + buf, len, 5000); ++ + dev_dbg(&acm->control->dev, + "%s - rq 0x%02x, val %#x, len %#x, result %d\n", + __func__, request, value, len, retval); ++ ++ usb_autopm_put_interface(acm->control); ++ + return retval < 0 ? retval : 0; + } + +@@ -233,12 +243,9 @@ static int acm_write_start(struct acm *acm, int wbn) + acm->susp_count); + usb_autopm_get_interface_async(acm->control); + if (acm->susp_count) { +- if (!acm->delayed_wb) +- acm->delayed_wb = wb; +- else +- usb_autopm_put_interface_async(acm->control); ++ usb_anchor_urb(wb->urb, &acm->delayed); + spin_unlock_irqrestore(&acm->write_lock, flags); +- return 0; /* A white lie */ ++ return 0; + } + usb_mark_last_busy(acm->dev); + +@@ -516,6 +523,7 @@ static int acm_port_activate(struct tty_port *port, struct tty_struct *tty) + { + struct acm *acm = container_of(port, struct acm, port); + int retval = -ENODEV; ++ int i; + + dev_dbg(&acm->control->dev, "%s\n", __func__); + +@@ -564,6 +572,8 @@ static int acm_port_activate(struct tty_port *port, struct tty_struct *tty) + return 0; + + error_submit_read_urbs: ++ for (i = 0; i < acm->rx_buflimit; i++) ++ usb_kill_urb(acm->read_urbs[i]); + acm->ctrlout = 0; + acm_set_control(acm, acm->ctrlout); + error_set_control: +@@ -591,21 +601,35 @@ static void acm_port_destruct(struct tty_port *port) + static void acm_port_shutdown(struct tty_port *port) + { + struct acm *acm = container_of(port, struct acm, port); ++ struct urb *urb; ++ struct acm_wb *wb; + int i; ++ int pm_err; + + dev_dbg(&acm->control->dev, "%s\n", __func__); + + mutex_lock(&acm->mutex); + if (!acm->disconnected) { +- usb_autopm_get_interface(acm->control); ++ pm_err = usb_autopm_get_interface(acm->control); + acm_set_control(acm, acm->ctrlout = 0); ++ ++ for (;;) { ++ urb = usb_get_from_anchor(&acm->delayed); ++ if (!urb) ++ break; ++ wb = urb->context; ++ wb->use = 0; ++ usb_autopm_put_interface_async(acm->control); ++ } ++ + usb_kill_urb(acm->ctrlurb); + for (i = 0; i < ACM_NW; i++) + usb_kill_urb(acm->wb[i].urb); + for (i = 0; i < acm->rx_buflimit; i++) + usb_kill_urb(acm->read_urbs[i]); + acm->control->needs_remote_wakeup = 0; +- usb_autopm_put_interface(acm->control); ++ if (!pm_err) ++ usb_autopm_put_interface(acm->control); + } + mutex_unlock(&acm->mutex); + } +@@ -1190,6 +1214,7 @@ made_compressed_probe: + acm->bInterval = epread->bInterval; + tty_port_init(&acm->port); + acm->port.ops = &acm_port_ops; ++ init_usb_anchor(&acm->delayed); + + buf = usb_alloc_coherent(usb_dev, ctrlsize, GFP_KERNEL, &acm->ctrl_dma); + if (!buf) { +@@ -1434,18 +1459,15 @@ static int acm_suspend(struct usb_interface *intf, pm_message_t message) + struct acm *acm = usb_get_intfdata(intf); + int cnt; + ++ spin_lock_irq(&acm->read_lock); ++ spin_lock(&acm->write_lock); + if (PMSG_IS_AUTO(message)) { +- int b; +- +- spin_lock_irq(&acm->write_lock); +- b = acm->transmitting; +- spin_unlock_irq(&acm->write_lock); +- if (b) ++ if (acm->transmitting) { ++ spin_unlock(&acm->write_lock); ++ spin_unlock_irq(&acm->read_lock); + return -EBUSY; ++ } + } +- +- spin_lock_irq(&acm->read_lock); +- spin_lock(&acm->write_lock); + cnt = acm->susp_count++; + spin_unlock(&acm->write_lock); + spin_unlock_irq(&acm->read_lock); +@@ -1453,8 +1475,7 @@ static int acm_suspend(struct usb_interface *intf, pm_message_t message) + if (cnt) + return 0; + +- if (test_bit(ASYNCB_INITIALIZED, &acm->port.flags)) +- stop_data_traffic(acm); ++ stop_data_traffic(acm); + + return 0; + } +@@ -1462,29 +1483,24 @@ static int acm_suspend(struct usb_interface *intf, pm_message_t message) + static int acm_resume(struct usb_interface *intf) + { + struct acm *acm = usb_get_intfdata(intf); +- struct acm_wb *wb; ++ struct urb *urb; + int rv = 0; +- int cnt; + + spin_lock_irq(&acm->read_lock); +- acm->susp_count -= 1; +- cnt = acm->susp_count; +- spin_unlock_irq(&acm->read_lock); ++ spin_lock(&acm->write_lock); + +- if (cnt) +- return 0; ++ if (--acm->susp_count) ++ goto out; + + if (test_bit(ASYNCB_INITIALIZED, &acm->port.flags)) { +- rv = usb_submit_urb(acm->ctrlurb, GFP_NOIO); +- +- spin_lock_irq(&acm->write_lock); +- if (acm->delayed_wb) { +- wb = acm->delayed_wb; +- acm->delayed_wb = NULL; +- spin_unlock_irq(&acm->write_lock); +- acm_start_wb(acm, wb); +- } else { +- spin_unlock_irq(&acm->write_lock); ++ rv = usb_submit_urb(acm->ctrlurb, GFP_ATOMIC); ++ ++ for (;;) { ++ urb = usb_get_from_anchor(&acm->delayed); ++ if (!urb) ++ break; ++ ++ acm_start_wb(acm, urb->context); + } + + /* +@@ -1492,12 +1508,14 @@ static int acm_resume(struct usb_interface *intf) + * do the write path at all cost + */ + if (rv < 0) +- goto err_out; ++ goto out; + +- rv = acm_submit_read_urbs(acm, GFP_NOIO); ++ rv = acm_submit_read_urbs(acm, GFP_ATOMIC); + } ++out: ++ spin_unlock(&acm->write_lock); ++ spin_unlock_irq(&acm->read_lock); + +-err_out: + return rv; + } + +diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h +index 0f76e4af600e..1683ac161cf6 100644 +--- a/drivers/usb/class/cdc-acm.h ++++ b/drivers/usb/class/cdc-acm.h +@@ -117,7 +117,7 @@ struct acm { + unsigned int throttled:1; /* actually throttled */ + unsigned int throttle_req:1; /* throttle requested */ + u8 bInterval; +- struct acm_wb *delayed_wb; /* write queued for a device about to be woken */ ++ struct usb_anchor delayed; /* writes queued for a device about to be woken */ + }; + + #define CDC_DATA_INTERFACE_TYPE 0x0a +diff --git a/include/linux/if_team.h b/include/linux/if_team.h +index 16fae6436d0e..25b8b15197b0 100644 +--- a/include/linux/if_team.h ++++ b/include/linux/if_team.h +@@ -193,6 +193,7 @@ struct team { + bool user_carrier_enabled; + bool queue_override_enabled; + struct list_head *qom_lists; /* array of queue override mapping lists */ ++ bool port_mtu_change_allowed; + long mode_priv[TEAM_MODE_PRIV_LONGS]; + }; + +diff --git a/include/linux/netlink.h b/include/linux/netlink.h +index 6358da5eeee8..9516dad45109 100644 +--- a/include/linux/netlink.h ++++ b/include/linux/netlink.h +@@ -16,9 +16,10 @@ static inline struct nlmsghdr *nlmsg_hdr(const struct sk_buff *skb) + } + + enum netlink_skb_flags { +- NETLINK_SKB_MMAPED = 0x1, /* Packet data is mmaped */ +- NETLINK_SKB_TX = 0x2, /* Packet was sent by userspace */ +- NETLINK_SKB_DELIVERED = 0x4, /* Packet was delivered */ ++ NETLINK_SKB_MMAPED = 0x1, /* Packet data is mmaped */ ++ NETLINK_SKB_TX = 0x2, /* Packet was sent by userspace */ ++ NETLINK_SKB_DELIVERED = 0x4, /* Packet was delivered */ ++ NETLINK_SKB_DST = 0x8, /* Dst set in sendto or sendmsg */ + }; + + struct netlink_skb_parms { +@@ -144,4 +145,11 @@ static inline int netlink_dump_start(struct sock *ssk, struct sk_buff *skb, + return __netlink_dump_start(ssk, skb, nlh, control); + } + ++bool __netlink_ns_capable(const struct netlink_skb_parms *nsp, ++ struct user_namespace *ns, int cap); ++bool netlink_ns_capable(const struct sk_buff *skb, ++ struct user_namespace *ns, int cap); ++bool netlink_capable(const struct sk_buff *skb, int cap); ++bool netlink_net_capable(const struct sk_buff *skb, int cap); ++ + #endif /* __LINUX_NETLINK_H */ +diff --git a/include/linux/sock_diag.h b/include/linux/sock_diag.h +index 302ab805b0bb..46cca4c06848 100644 +--- a/include/linux/sock_diag.h ++++ b/include/linux/sock_diag.h +@@ -23,7 +23,7 @@ int sock_diag_check_cookie(void *sk, __u32 *cookie); + void sock_diag_save_cookie(void *sk, __u32 *cookie); + + int sock_diag_put_meminfo(struct sock *sk, struct sk_buff *skb, int attr); +-int sock_diag_put_filterinfo(struct sock *sk, ++int sock_diag_put_filterinfo(bool may_report_filterinfo, struct sock *sk, + struct sk_buff *skb, int attrtype); + + #endif +diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h +index 53f464d7cddc..6ca347a0717e 100644 +--- a/include/net/inetpeer.h ++++ b/include/net/inetpeer.h +@@ -178,16 +178,9 @@ static inline void inet_peer_refcheck(const struct inet_peer *p) + /* can be called with or without local BH being disabled */ + static inline int inet_getid(struct inet_peer *p, int more) + { +- int old, new; + more++; + inet_peer_refcheck(p); +- do { +- old = atomic_read(&p->ip_id_count); +- new = old + more; +- if (!new) +- new = 1; +- } while (atomic_cmpxchg(&p->ip_id_count, old, new) != old); +- return new; ++ return atomic_add_return(more, &p->ip_id_count) - more; + } + + #endif /* _NET_INETPEER_H */ +diff --git a/include/net/sock.h b/include/net/sock.h +index 8f32b779bc83..72f710d2f75a 100644 +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -2248,6 +2248,11 @@ extern void sock_enable_timestamp(struct sock *sk, int flag); + extern int sock_get_timestamp(struct sock *, struct timeval __user *); + extern int sock_get_timestampns(struct sock *, struct timespec __user *); + ++bool sk_ns_capable(const struct sock *sk, ++ struct user_namespace *user_ns, int cap); ++bool sk_capable(const struct sock *sk, int cap); ++bool sk_net_capable(const struct sock *sk, int cap); ++ + /* + * Enable debug/info messages + */ +diff --git a/include/sound/core.h b/include/sound/core.h +index 5bfe5136441c..97cd9c3592f7 100644 +--- a/include/sound/core.h ++++ b/include/sound/core.h +@@ -120,6 +120,8 @@ struct snd_card { + int user_ctl_count; /* count of all user controls */ + struct list_head controls; /* all controls for this card */ + struct list_head ctl_files; /* active control files */ ++ struct mutex user_ctl_lock; /* protects user controls against ++ concurrent access */ + + struct snd_info_entry *proc_root; /* root for soundcard specific files */ + struct snd_info_entry *proc_id; /* the card id */ +diff --git a/include/uapi/sound/compress_offload.h b/include/uapi/sound/compress_offload.h +index 5759810e1c1b..21eed488783f 100644 +--- a/include/uapi/sound/compress_offload.h ++++ b/include/uapi/sound/compress_offload.h +@@ -80,7 +80,7 @@ struct snd_compr_tstamp { + struct snd_compr_avail { + __u64 avail; + struct snd_compr_tstamp tstamp; +-}; ++} __attribute__((packed)); + + enum snd_compr_direction { + SND_COMPRESS_PLAYBACK = 0, +diff --git a/kernel/audit.c b/kernel/audit.c +index 6def25f1b351..a6c632757e57 100644 +--- a/kernel/audit.c ++++ b/kernel/audit.c +@@ -593,13 +593,13 @@ static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type) + case AUDIT_TTY_SET: + case AUDIT_TRIM: + case AUDIT_MAKE_EQUIV: +- if (!capable(CAP_AUDIT_CONTROL)) ++ if (!netlink_capable(skb, CAP_AUDIT_CONTROL)) + err = -EPERM; + break; + case AUDIT_USER: + case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG: + case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2: +- if (!capable(CAP_AUDIT_WRITE)) ++ if (!netlink_capable(skb, CAP_AUDIT_WRITE)) + err = -EPERM; + break; + default: /* bad msg */ +diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c +index 4251374578bc..67f7a2d2efbc 100644 +--- a/kernel/time/tick-sched.c ++++ b/kernel/time/tick-sched.c +@@ -720,8 +720,10 @@ static bool can_stop_idle_tick(int cpu, struct tick_sched *ts) + return false; + } + +- if (unlikely(ts->nohz_mode == NOHZ_MODE_INACTIVE)) ++ if (unlikely(ts->nohz_mode == NOHZ_MODE_INACTIVE)) { ++ ts->sleep_length = (ktime_t) { .tv64 = NSEC_PER_SEC/HZ }; + return false; ++ } + + if (need_resched()) + return false; +diff --git a/lib/lzo/lzo1x_decompress_safe.c b/lib/lzo/lzo1x_decompress_safe.c +index 569985d522d5..8563081e8da3 100644 +--- a/lib/lzo/lzo1x_decompress_safe.c ++++ b/lib/lzo/lzo1x_decompress_safe.c +@@ -19,11 +19,31 @@ + #include + #include "lzodefs.h" + +-#define HAVE_IP(x) ((size_t)(ip_end - ip) >= (size_t)(x)) +-#define HAVE_OP(x) ((size_t)(op_end - op) >= (size_t)(x)) +-#define NEED_IP(x) if (!HAVE_IP(x)) goto input_overrun +-#define NEED_OP(x) if (!HAVE_OP(x)) goto output_overrun +-#define TEST_LB(m_pos) if ((m_pos) < out) goto lookbehind_overrun ++#define HAVE_IP(t, x) \ ++ (((size_t)(ip_end - ip) >= (size_t)(t + x)) && \ ++ (((t + x) >= t) && ((t + x) >= x))) ++ ++#define HAVE_OP(t, x) \ ++ (((size_t)(op_end - op) >= (size_t)(t + x)) && \ ++ (((t + x) >= t) && ((t + x) >= x))) ++ ++#define NEED_IP(t, x) \ ++ do { \ ++ if (!HAVE_IP(t, x)) \ ++ goto input_overrun; \ ++ } while (0) ++ ++#define NEED_OP(t, x) \ ++ do { \ ++ if (!HAVE_OP(t, x)) \ ++ goto output_overrun; \ ++ } while (0) ++ ++#define TEST_LB(m_pos) \ ++ do { \ ++ if ((m_pos) < out) \ ++ goto lookbehind_overrun; \ ++ } while (0) + + int lzo1x_decompress_safe(const unsigned char *in, size_t in_len, + unsigned char *out, size_t *out_len) +@@ -58,14 +78,14 @@ int lzo1x_decompress_safe(const unsigned char *in, size_t in_len, + while (unlikely(*ip == 0)) { + t += 255; + ip++; +- NEED_IP(1); ++ NEED_IP(1, 0); + } + t += 15 + *ip++; + } + t += 3; + copy_literal_run: + #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) +- if (likely(HAVE_IP(t + 15) && HAVE_OP(t + 15))) { ++ if (likely(HAVE_IP(t, 15) && HAVE_OP(t, 15))) { + const unsigned char *ie = ip + t; + unsigned char *oe = op + t; + do { +@@ -81,8 +101,8 @@ copy_literal_run: + } else + #endif + { +- NEED_OP(t); +- NEED_IP(t + 3); ++ NEED_OP(t, 0); ++ NEED_IP(t, 3); + do { + *op++ = *ip++; + } while (--t > 0); +@@ -95,7 +115,7 @@ copy_literal_run: + m_pos -= t >> 2; + m_pos -= *ip++ << 2; + TEST_LB(m_pos); +- NEED_OP(2); ++ NEED_OP(2, 0); + op[0] = m_pos[0]; + op[1] = m_pos[1]; + op += 2; +@@ -119,10 +139,10 @@ copy_literal_run: + while (unlikely(*ip == 0)) { + t += 255; + ip++; +- NEED_IP(1); ++ NEED_IP(1, 0); + } + t += 31 + *ip++; +- NEED_IP(2); ++ NEED_IP(2, 0); + } + m_pos = op - 1; + next = get_unaligned_le16(ip); +@@ -137,10 +157,10 @@ copy_literal_run: + while (unlikely(*ip == 0)) { + t += 255; + ip++; +- NEED_IP(1); ++ NEED_IP(1, 0); + } + t += 7 + *ip++; +- NEED_IP(2); ++ NEED_IP(2, 0); + } + next = get_unaligned_le16(ip); + ip += 2; +@@ -154,7 +174,7 @@ copy_literal_run: + #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) + if (op - m_pos >= 8) { + unsigned char *oe = op + t; +- if (likely(HAVE_OP(t + 15))) { ++ if (likely(HAVE_OP(t, 15))) { + do { + COPY8(op, m_pos); + op += 8; +@@ -164,7 +184,7 @@ copy_literal_run: + m_pos += 8; + } while (op < oe); + op = oe; +- if (HAVE_IP(6)) { ++ if (HAVE_IP(6, 0)) { + state = next; + COPY4(op, ip); + op += next; +@@ -172,7 +192,7 @@ copy_literal_run: + continue; + } + } else { +- NEED_OP(t); ++ NEED_OP(t, 0); + do { + *op++ = *m_pos++; + } while (op < oe); +@@ -181,7 +201,7 @@ copy_literal_run: + #endif + { + unsigned char *oe = op + t; +- NEED_OP(t); ++ NEED_OP(t, 0); + op[0] = m_pos[0]; + op[1] = m_pos[1]; + op += 2; +@@ -194,15 +214,15 @@ match_next: + state = next; + t = next; + #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) +- if (likely(HAVE_IP(6) && HAVE_OP(4))) { ++ if (likely(HAVE_IP(6, 0) && HAVE_OP(4, 0))) { + COPY4(op, ip); + op += t; + ip += t; + } else + #endif + { +- NEED_IP(t + 3); +- NEED_OP(t); ++ NEED_IP(t, 3); ++ NEED_OP(t, 0); + while (t > 0) { + *op++ = *ip++; + t--; +diff --git a/lib/nlattr.c b/lib/nlattr.c +index fc6754720ced..10ad042d01be 100644 +--- a/lib/nlattr.c ++++ b/lib/nlattr.c +@@ -201,8 +201,8 @@ int nla_parse(struct nlattr **tb, int maxtype, const struct nlattr *head, + } + + if (unlikely(rem > 0)) +- printk(KERN_WARNING "netlink: %d bytes leftover after parsing " +- "attributes.\n", rem); ++ pr_warn_ratelimited("netlink: %d bytes leftover after parsing attributes in process `%s'.\n", ++ rem, current->comm); + + err = 0; + errout: +diff --git a/net/can/gw.c b/net/can/gw.c +index 3ee690e8c7d3..de25455b4e3e 100644 +--- a/net/can/gw.c ++++ b/net/can/gw.c +@@ -784,7 +784,7 @@ static int cgw_create_job(struct sk_buff *skb, struct nlmsghdr *nlh) + struct cgw_job *gwj; + int err = 0; + +- if (!capable(CAP_NET_ADMIN)) ++ if (!netlink_capable(skb, CAP_NET_ADMIN)) + return -EPERM; + + if (nlmsg_len(nlh) < sizeof(*r)) +@@ -876,7 +876,7 @@ static int cgw_remove_job(struct sk_buff *skb, struct nlmsghdr *nlh) + struct can_can_gw ccgw; + int err = 0; + +- if (!capable(CAP_NET_ADMIN)) ++ if (!netlink_capable(skb, CAP_NET_ADMIN)) + return -EPERM; + + if (nlmsg_len(nlh) < sizeof(*r)) +diff --git a/net/core/dev.c b/net/core/dev.c +index 56383a3e5d71..cca7ae0ba915 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -5827,6 +5827,9 @@ EXPORT_SYMBOL(unregister_netdevice_queue); + /** + * unregister_netdevice_many - unregister many devices + * @head: list of devices ++ * ++ * Note: As most callers use a stack allocated list_head, ++ * we force a list_del() to make sure stack wont be corrupted later. + */ + void unregister_netdevice_many(struct list_head *head) + { +@@ -5836,6 +5839,7 @@ void unregister_netdevice_many(struct list_head *head) + rollback_registered_many(head); + list_for_each_entry(dev, head, unreg_list) + net_set_todo(dev); ++ list_del(head); + } + } + EXPORT_SYMBOL(unregister_netdevice_many); +@@ -6252,7 +6256,6 @@ static void __net_exit default_device_exit_batch(struct list_head *net_list) + } + } + unregister_netdevice_many(&dev_kill_list); +- list_del(&dev_kill_list); + rtnl_unlock(); + } + +diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c +index 87ec574ffac8..ae43dd807bb2 100644 +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -1044,6 +1044,7 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb) + struct nlattr *tb[IFLA_MAX+1]; + u32 ext_filter_mask = 0; + int err; ++ int hdrlen; + + s_h = cb->args[0]; + s_idx = cb->args[1]; +@@ -1051,8 +1052,17 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb) + rcu_read_lock(); + cb->seq = net->dev_base_seq; + +- if (nlmsg_parse(cb->nlh, sizeof(struct ifinfomsg), tb, IFLA_MAX, +- ifla_policy) >= 0) { ++ /* A hack to preserve kernel<->userspace interface. ++ * The correct header is ifinfomsg. It is consistent with rtnl_getlink. ++ * However, before Linux v3.9 the code here assumed rtgenmsg and that's ++ * what iproute2 < v3.9.0 used. ++ * We can detect the old iproute2. Even including the IFLA_EXT_MASK ++ * attribute, its netlink message is shorter than struct ifinfomsg. ++ */ ++ hdrlen = nlmsg_len(cb->nlh) < sizeof(struct ifinfomsg) ? ++ sizeof(struct rtgenmsg) : sizeof(struct ifinfomsg); ++ ++ if (nlmsg_parse(cb->nlh, hdrlen, tb, IFLA_MAX, ifla_policy) >= 0) { + + if (tb[IFLA_EXT_MASK]) + ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]); +@@ -1294,7 +1304,8 @@ static int do_set_master(struct net_device *dev, int ifindex) + return 0; + } + +-static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm, ++static int do_setlink(const struct sk_buff *skb, ++ struct net_device *dev, struct ifinfomsg *ifm, + struct nlattr **tb, char *ifname, int modified) + { + const struct net_device_ops *ops = dev->netdev_ops; +@@ -1306,7 +1317,7 @@ static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm, + err = PTR_ERR(net); + goto errout; + } +- if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) { ++ if (!netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN)) { + err = -EPERM; + goto errout; + } +@@ -1560,7 +1571,7 @@ static int rtnl_setlink(struct sk_buff *skb, struct nlmsghdr *nlh) + if (err < 0) + goto errout; + +- err = do_setlink(dev, ifm, tb, ifname, 0); ++ err = do_setlink(skb, dev, ifm, tb, ifname, 0); + errout: + return err; + } +@@ -1600,7 +1611,6 @@ static int rtnl_dellink(struct sk_buff *skb, struct nlmsghdr *nlh) + + ops->dellink(dev, &list_kill); + unregister_netdevice_many(&list_kill); +- list_del(&list_kill); + return 0; + } + +@@ -1678,7 +1688,8 @@ err: + } + EXPORT_SYMBOL(rtnl_create_link); + +-static int rtnl_group_changelink(struct net *net, int group, ++static int rtnl_group_changelink(const struct sk_buff *skb, ++ struct net *net, int group, + struct ifinfomsg *ifm, + struct nlattr **tb) + { +@@ -1687,7 +1698,7 @@ static int rtnl_group_changelink(struct net *net, int group, + + for_each_netdev(net, dev) { + if (dev->group == group) { +- err = do_setlink(dev, ifm, tb, NULL, 0); ++ err = do_setlink(skb, dev, ifm, tb, NULL, 0); + if (err < 0) + return err; + } +@@ -1789,12 +1800,12 @@ replay: + modified = 1; + } + +- return do_setlink(dev, ifm, tb, ifname, modified); ++ return do_setlink(skb, dev, ifm, tb, ifname, modified); + } + + if (!(nlh->nlmsg_flags & NLM_F_CREATE)) { + if (ifm->ifi_index == 0 && tb[IFLA_GROUP]) +- return rtnl_group_changelink(net, ++ return rtnl_group_changelink(skb, net, + nla_get_u32(tb[IFLA_GROUP]), + ifm, tb); + return -ENODEV; +@@ -1906,9 +1917,13 @@ static u16 rtnl_calcit(struct sk_buff *skb, struct nlmsghdr *nlh) + struct nlattr *tb[IFLA_MAX+1]; + u32 ext_filter_mask = 0; + u16 min_ifinfo_dump_size = 0; ++ int hdrlen; ++ ++ /* Same kernel<->userspace interface hack as in rtnl_dump_ifinfo. */ ++ hdrlen = nlmsg_len(nlh) < sizeof(struct ifinfomsg) ? ++ sizeof(struct rtgenmsg) : sizeof(struct ifinfomsg); + +- if (nlmsg_parse(nlh, sizeof(struct ifinfomsg), tb, IFLA_MAX, +- ifla_policy) >= 0) { ++ if (nlmsg_parse(nlh, hdrlen, tb, IFLA_MAX, ifla_policy) >= 0) { + if (tb[IFLA_EXT_MASK]) + ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]); + } +@@ -2179,7 +2194,7 @@ static int rtnl_fdb_del(struct sk_buff *skb, struct nlmsghdr *nlh) + int err = -EINVAL; + __u8 *addr; + +- if (!capable(CAP_NET_ADMIN)) ++ if (!netlink_capable(skb, CAP_NET_ADMIN)) + return -EPERM; + + err = nlmsg_parse(nlh, sizeof(*ndm), tb, NDA_MAX, NULL); +@@ -2635,7 +2650,7 @@ static int rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh) + sz_idx = type>>2; + kind = type&3; + +- if (kind != 2 && !ns_capable(net->user_ns, CAP_NET_ADMIN)) ++ if (kind != 2 && !netlink_net_capable(skb, CAP_NET_ADMIN)) + return -EPERM; + + if (kind == 2 && nlh->nlmsg_flags&NLM_F_DUMP) { +diff --git a/net/core/sock.c b/net/core/sock.c +index d743099250f4..af65d17517b8 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -142,6 +142,55 @@ + static DEFINE_MUTEX(proto_list_mutex); + static LIST_HEAD(proto_list); + ++/** ++ * sk_ns_capable - General socket capability test ++ * @sk: Socket to use a capability on or through ++ * @user_ns: The user namespace of the capability to use ++ * @cap: The capability to use ++ * ++ * Test to see if the opener of the socket had when the socket was ++ * created and the current process has the capability @cap in the user ++ * namespace @user_ns. ++ */ ++bool sk_ns_capable(const struct sock *sk, ++ struct user_namespace *user_ns, int cap) ++{ ++ return file_ns_capable(sk->sk_socket->file, user_ns, cap) && ++ ns_capable(user_ns, cap); ++} ++EXPORT_SYMBOL(sk_ns_capable); ++ ++/** ++ * sk_capable - Socket global capability test ++ * @sk: Socket to use a capability on or through ++ * @cap: The global capbility to use ++ * ++ * Test to see if the opener of the socket had when the socket was ++ * created and the current process has the capability @cap in all user ++ * namespaces. ++ */ ++bool sk_capable(const struct sock *sk, int cap) ++{ ++ return sk_ns_capable(sk, &init_user_ns, cap); ++} ++EXPORT_SYMBOL(sk_capable); ++ ++/** ++ * sk_net_capable - Network namespace socket capability test ++ * @sk: Socket to use a capability on or through ++ * @cap: The capability to use ++ * ++ * Test to see if the opener of the socket had when the socke was created ++ * and the current process has the capability @cap over the network namespace ++ * the socket is a member of. ++ */ ++bool sk_net_capable(const struct sock *sk, int cap) ++{ ++ return sk_ns_capable(sk, sock_net(sk)->user_ns, cap); ++} ++EXPORT_SYMBOL(sk_net_capable); ++ ++ + #ifdef CONFIG_MEMCG_KMEM + int mem_cgroup_sockets_init(struct mem_cgroup *memcg, struct cgroup_subsys *ss) + { +diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c +index 6a7fae228634..c38e7a2b5a8e 100644 +--- a/net/core/sock_diag.c ++++ b/net/core/sock_diag.c +@@ -49,7 +49,7 @@ int sock_diag_put_meminfo(struct sock *sk, struct sk_buff *skb, int attrtype) + } + EXPORT_SYMBOL_GPL(sock_diag_put_meminfo); + +-int sock_diag_put_filterinfo(struct sock *sk, ++int sock_diag_put_filterinfo(bool may_report_filterinfo, struct sock *sk, + struct sk_buff *skb, int attrtype) + { + struct nlattr *attr; +@@ -57,7 +57,7 @@ int sock_diag_put_filterinfo(struct sock *sk, + unsigned int len; + int err = 0; + +- if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) { ++ if (!may_report_filterinfo) { + nla_reserve(skb, attrtype, 0); + return 0; + } +diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c +index 40d5829ed36a..1074ffb6d533 100644 +--- a/net/dcb/dcbnl.c ++++ b/net/dcb/dcbnl.c +@@ -1670,7 +1670,7 @@ static int dcb_doit(struct sk_buff *skb, struct nlmsghdr *nlh) + struct nlmsghdr *reply_nlh = NULL; + const struct reply_func *fn; + +- if ((nlh->nlmsg_type == RTM_SETDCB) && !capable(CAP_NET_ADMIN)) ++ if ((nlh->nlmsg_type == RTM_SETDCB) && !netlink_capable(skb, CAP_NET_ADMIN)) + return -EPERM; + + ret = nlmsg_parse(nlh, sizeof(*dcb), tb, DCB_ATTR_MAX, +diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c +index 7d9197063ebb..b5e52100a89a 100644 +--- a/net/decnet/dn_dev.c ++++ b/net/decnet/dn_dev.c +@@ -573,7 +573,7 @@ static int dn_nl_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh) + struct dn_ifaddr __rcu **ifap; + int err = -EINVAL; + +- if (!capable(CAP_NET_ADMIN)) ++ if (!netlink_capable(skb, CAP_NET_ADMIN)) + return -EPERM; + + if (!net_eq(net, &init_net)) +@@ -617,7 +617,7 @@ static int dn_nl_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh) + struct dn_ifaddr *ifa; + int err; + +- if (!capable(CAP_NET_ADMIN)) ++ if (!netlink_capable(skb, CAP_NET_ADMIN)) + return -EPERM; + + if (!net_eq(net, &init_net)) +diff --git a/net/decnet/dn_fib.c b/net/decnet/dn_fib.c +index 57dc159245ec..d332aefb0846 100644 +--- a/net/decnet/dn_fib.c ++++ b/net/decnet/dn_fib.c +@@ -505,7 +505,7 @@ static int dn_fib_rtm_delroute(struct sk_buff *skb, struct nlmsghdr *nlh) + struct nlattr *attrs[RTA_MAX+1]; + int err; + +- if (!capable(CAP_NET_ADMIN)) ++ if (!netlink_capable(skb, CAP_NET_ADMIN)) + return -EPERM; + + if (!net_eq(net, &init_net)) +@@ -530,7 +530,7 @@ static int dn_fib_rtm_newroute(struct sk_buff *skb, struct nlmsghdr *nlh) + struct nlattr *attrs[RTA_MAX+1]; + int err; + +- if (!capable(CAP_NET_ADMIN)) ++ if (!netlink_capable(skb, CAP_NET_ADMIN)) + return -EPERM; + + if (!net_eq(net, &init_net)) +diff --git a/net/decnet/netfilter/dn_rtmsg.c b/net/decnet/netfilter/dn_rtmsg.c +index 2a7efe388344..f3dc69a41d63 100644 +--- a/net/decnet/netfilter/dn_rtmsg.c ++++ b/net/decnet/netfilter/dn_rtmsg.c +@@ -107,7 +107,7 @@ static inline void dnrmg_receive_user_skb(struct sk_buff *skb) + if (nlh->nlmsg_len < sizeof(*nlh) || skb->len < nlh->nlmsg_len) + return; + +- if (!capable(CAP_NET_ADMIN)) ++ if (!netlink_capable(skb, CAP_NET_ADMIN)) + RCV_SKB_FAIL(-EPERM); + + /* Eventually we might send routing messages too */ +diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c +index 19e36376d2a0..5f3dc1df04bf 100644 +--- a/net/ipv4/datagram.c ++++ b/net/ipv4/datagram.c +@@ -86,18 +86,26 @@ out: + } + EXPORT_SYMBOL(ip4_datagram_connect); + ++/* Because UDP xmit path can manipulate sk_dst_cache without holding ++ * socket lock, we need to use sk_dst_set() here, ++ * even if we own the socket lock. ++ */ + void ip4_datagram_release_cb(struct sock *sk) + { + const struct inet_sock *inet = inet_sk(sk); + const struct ip_options_rcu *inet_opt; + __be32 daddr = inet->inet_daddr; ++ struct dst_entry *dst; + struct flowi4 fl4; + struct rtable *rt; + +- if (! __sk_dst_get(sk) || __sk_dst_check(sk, 0)) +- return; +- + rcu_read_lock(); ++ ++ dst = __sk_dst_get(sk); ++ if (!dst || !dst->obsolete || dst->ops->check(dst, 0)) { ++ rcu_read_unlock(); ++ return; ++ } + inet_opt = rcu_dereference(inet->inet_opt); + if (inet_opt && inet_opt->opt.srr) + daddr = inet_opt->opt.faddr; +@@ -105,8 +113,10 @@ void ip4_datagram_release_cb(struct sock *sk) + inet->inet_saddr, inet->inet_dport, + inet->inet_sport, sk->sk_protocol, + RT_CONN_FLAGS(sk), sk->sk_bound_dev_if); +- if (!IS_ERR(rt)) +- __sk_dst_set(sk, &rt->dst); ++ ++ dst = !IS_ERR(rt) ? &rt->dst : NULL; ++ sk_dst_set(sk, dst); ++ + rcu_read_unlock(); + } + EXPORT_SYMBOL_GPL(ip4_datagram_release_cb); +diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c +index f5cc7b331511..897b784e9c05 100644 +--- a/net/ipv4/ipip.c ++++ b/net/ipv4/ipip.c +@@ -149,13 +149,13 @@ static int ipip_err(struct sk_buff *skb, u32 info) + + if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) { + ipv4_update_pmtu(skb, dev_net(skb->dev), info, +- t->dev->ifindex, 0, IPPROTO_IPIP, 0); ++ t->parms.link, 0, IPPROTO_IPIP, 0); + err = 0; + goto out; + } + + if (type == ICMP_REDIRECT) { +- ipv4_redirect(skb, dev_net(skb->dev), t->dev->ifindex, 0, ++ ipv4_redirect(skb, dev_net(skb->dev), t->parms.link, 0, + IPPROTO_IPIP, 0); + err = 0; + goto out; +@@ -483,4 +483,5 @@ static void __exit ipip_fini(void) + module_init(ipip_init); + module_exit(ipip_fini); + MODULE_LICENSE("GPL"); ++MODULE_ALIAS_RTNL_LINK("ipip"); + MODULE_ALIAS_NETDEV("tunl0"); +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index e15d330919af..ba7d2b7ad9f9 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -2720,13 +2720,12 @@ static void tcp_process_loss(struct sock *sk, int flag, bool is_dupack) + bool recovered = !before(tp->snd_una, tp->high_seq); + + if (tp->frto) { /* F-RTO RFC5682 sec 3.1 (sack enhanced version). */ +- if (flag & FLAG_ORIG_SACK_ACKED) { +- /* Step 3.b. A timeout is spurious if not all data are +- * lost, i.e., never-retransmitted data are (s)acked. +- */ +- tcp_try_undo_loss(sk, true); ++ /* Step 3.b. A timeout is spurious if not all data are ++ * lost, i.e., never-retransmitted data are (s)acked. ++ */ ++ if (tcp_try_undo_loss(sk, flag & FLAG_ORIG_SACK_ACKED)) + return; +- } ++ + if (after(tp->snd_nxt, tp->high_seq) && + (flag & FLAG_DATA_SACKED || is_dupack)) { + tp->frto = 0; /* Loss was real: 2nd part of step 3.a */ +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index 73d7f68da557..a0ecdf596f2f 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -61,6 +61,7 @@ + MODULE_AUTHOR("Ville Nuorvala"); + MODULE_DESCRIPTION("IPv6 tunneling device"); + MODULE_LICENSE("GPL"); ++MODULE_ALIAS_RTNL_LINK("ip6tnl"); + MODULE_ALIAS_NETDEV("ip6tnl0"); + + #ifdef IP6_TNL_DEBUG +diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c +index c2e73e647e44..3d2c81a66d6a 100644 +--- a/net/ipv6/output_core.c ++++ b/net/ipv6/output_core.c +@@ -9,7 +9,7 @@ + void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt) + { + static atomic_t ipv6_fragmentation_id; +- int old, new; ++ int ident; + + #if IS_ENABLED(CONFIG_IPV6) + if (rt && !(rt->dst.flags & DST_NOPEER)) { +@@ -25,13 +25,8 @@ void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt) + } + } + #endif +- do { +- old = atomic_read(&ipv6_fragmentation_id); +- new = old + 1; +- if (!new) +- new = 1; +- } while (atomic_cmpxchg(&ipv6_fragmentation_id, old, new) != old); +- fhdr->identification = htonl(new); ++ ident = atomic_inc_return(&ipv6_fragmentation_id); ++ fhdr->identification = htonl(ident); + } + EXPORT_SYMBOL(ipv6_select_ident); + +diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c +index 620d326e8fdd..540d58921007 100644 +--- a/net/ipv6/sit.c ++++ b/net/ipv6/sit.c +@@ -530,12 +530,12 @@ static int ipip6_err(struct sk_buff *skb, u32 info) + + if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) { + ipv4_update_pmtu(skb, dev_net(skb->dev), info, +- t->dev->ifindex, 0, IPPROTO_IPV6, 0); ++ t->parms.link, 0, IPPROTO_IPV6, 0); + err = 0; + goto out; + } + if (type == ICMP_REDIRECT) { +- ipv4_redirect(skb, dev_net(skb->dev), t->dev->ifindex, 0, ++ ipv4_redirect(skb, dev_net(skb->dev), t->parms.link, 0, + IPPROTO_IPV6, 0); + err = 0; + goto out; +@@ -1654,4 +1654,5 @@ xfrm_tunnel_failed: + module_init(sit_init); + module_exit(sit_cleanup); + MODULE_LICENSE("GPL"); ++MODULE_ALIAS_RTNL_LINK("sit"); + MODULE_ALIAS_NETDEV("sit0"); +diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c +index 514e90f470bf..2c64ab27b515 100644 +--- a/net/mac80211/iface.c ++++ b/net/mac80211/iface.c +@@ -1746,7 +1746,6 @@ void ieee80211_remove_interfaces(struct ieee80211_local *local) + } + mutex_unlock(&local->iflist_mtx); + unregister_netdevice_many(&unreg_list); +- list_del(&unreg_list); + + list_for_each_entry_safe(sdata, tmp, &wdev_list, list) { + list_del(&sdata->list); +diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c +index 572d87dc116f..0a03662bfbef 100644 +--- a/net/netfilter/nfnetlink.c ++++ b/net/netfilter/nfnetlink.c +@@ -147,7 +147,7 @@ static int nfnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh) + const struct nfnetlink_subsystem *ss; + int type, err; + +- if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) ++ if (!netlink_net_capable(skb, CAP_NET_ADMIN)) + return -EPERM; + + /* All the messages must at least contain nfgenmsg */ +diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c +index c9c2a8441d32..be34adde692f 100644 +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -1219,7 +1219,74 @@ retry: + return err; + } + +-static inline int netlink_capable(const struct socket *sock, unsigned int flag) ++/** ++ * __netlink_ns_capable - General netlink message capability test ++ * @nsp: NETLINK_CB of the socket buffer holding a netlink command from userspace. ++ * @user_ns: The user namespace of the capability to use ++ * @cap: The capability to use ++ * ++ * Test to see if the opener of the socket we received the message ++ * from had when the netlink socket was created and the sender of the ++ * message has has the capability @cap in the user namespace @user_ns. ++ */ ++bool __netlink_ns_capable(const struct netlink_skb_parms *nsp, ++ struct user_namespace *user_ns, int cap) ++{ ++ return ((nsp->flags & NETLINK_SKB_DST) || ++ file_ns_capable(nsp->sk->sk_socket->file, user_ns, cap)) && ++ ns_capable(user_ns, cap); ++} ++EXPORT_SYMBOL(__netlink_ns_capable); ++ ++/** ++ * netlink_ns_capable - General netlink message capability test ++ * @skb: socket buffer holding a netlink command from userspace ++ * @user_ns: The user namespace of the capability to use ++ * @cap: The capability to use ++ * ++ * Test to see if the opener of the socket we received the message ++ * from had when the netlink socket was created and the sender of the ++ * message has has the capability @cap in the user namespace @user_ns. ++ */ ++bool netlink_ns_capable(const struct sk_buff *skb, ++ struct user_namespace *user_ns, int cap) ++{ ++ return __netlink_ns_capable(&NETLINK_CB(skb), user_ns, cap); ++} ++EXPORT_SYMBOL(netlink_ns_capable); ++ ++/** ++ * netlink_capable - Netlink global message capability test ++ * @skb: socket buffer holding a netlink command from userspace ++ * @cap: The capability to use ++ * ++ * Test to see if the opener of the socket we received the message ++ * from had when the netlink socket was created and the sender of the ++ * message has has the capability @cap in all user namespaces. ++ */ ++bool netlink_capable(const struct sk_buff *skb, int cap) ++{ ++ return netlink_ns_capable(skb, &init_user_ns, cap); ++} ++EXPORT_SYMBOL(netlink_capable); ++ ++/** ++ * netlink_net_capable - Netlink network namespace message capability test ++ * @skb: socket buffer holding a netlink command from userspace ++ * @cap: The capability to use ++ * ++ * Test to see if the opener of the socket we received the message ++ * from had when the netlink socket was created and the sender of the ++ * message has has the capability @cap over the network namespace of ++ * the socket we received the message from. ++ */ ++bool netlink_net_capable(const struct sk_buff *skb, int cap) ++{ ++ return netlink_ns_capable(skb, sock_net(skb->sk)->user_ns, cap); ++} ++EXPORT_SYMBOL(netlink_net_capable); ++ ++static inline int netlink_allowed(const struct socket *sock, unsigned int flag) + { + return (nl_table[sock->sk->sk_protocol].flags & flag) || + ns_capable(sock_net(sock->sk)->user_ns, CAP_NET_ADMIN); +@@ -1287,7 +1354,7 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr, + + /* Only superuser is allowed to listen multicasts */ + if (nladdr->nl_groups) { +- if (!netlink_capable(sock, NL_CFG_F_NONROOT_RECV)) ++ if (!netlink_allowed(sock, NL_CFG_F_NONROOT_RECV)) + return -EPERM; + err = netlink_realloc_groups(sk); + if (err) +@@ -1349,7 +1416,7 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr, + return -EINVAL; + + /* Only superuser is allowed to send multicasts */ +- if (nladdr->nl_groups && !netlink_capable(sock, NL_CFG_F_NONROOT_SEND)) ++ if (nladdr->nl_groups && !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND)) + return -EPERM; + + if (!nlk->portid) +@@ -1921,7 +1988,7 @@ static int netlink_setsockopt(struct socket *sock, int level, int optname, + break; + case NETLINK_ADD_MEMBERSHIP: + case NETLINK_DROP_MEMBERSHIP: { +- if (!netlink_capable(sock, NL_CFG_F_NONROOT_RECV)) ++ if (!netlink_allowed(sock, NL_CFG_F_NONROOT_RECV)) + return -EPERM; + err = netlink_realloc_groups(sk); + if (err) +@@ -2053,6 +2120,7 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock, + struct sk_buff *skb; + int err; + struct scm_cookie scm; ++ u32 netlink_skb_flags = 0; + + if (msg->msg_flags&MSG_OOB) + return -EOPNOTSUPP; +@@ -2072,8 +2140,9 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock, + dst_group = ffs(addr->nl_groups); + err = -EPERM; + if ((dst_group || dst_portid) && +- !netlink_capable(sock, NL_CFG_F_NONROOT_SEND)) ++ !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND)) + goto out; ++ netlink_skb_flags |= NETLINK_SKB_DST; + } else { + dst_portid = nlk->dst_portid; + dst_group = nlk->dst_group; +@@ -2103,6 +2172,7 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock, + NETLINK_CB(skb).portid = nlk->portid; + NETLINK_CB(skb).dst_group = dst_group; + NETLINK_CB(skb).creds = siocb->scm->creds; ++ NETLINK_CB(skb).flags = netlink_skb_flags; + + err = -EFAULT; + if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) { +diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c +index 393f17eea1a2..ade434b8abd8 100644 +--- a/net/netlink/genetlink.c ++++ b/net/netlink/genetlink.c +@@ -592,7 +592,7 @@ static int genl_family_rcv_msg(struct genl_family *family, + return -EOPNOTSUPP; + + if ((ops->flags & GENL_ADMIN_PERM) && +- !capable(CAP_NET_ADMIN)) ++ !netlink_capable(skb, CAP_NET_ADMIN)) + return -EPERM; + + if (nlh->nlmsg_flags & NLM_F_DUMP) { +diff --git a/net/packet/diag.c b/net/packet/diag.c +index ec8b6e8a80b1..674b0a65df6c 100644 +--- a/net/packet/diag.c ++++ b/net/packet/diag.c +@@ -127,6 +127,7 @@ static int pdiag_put_fanout(struct packet_sock *po, struct sk_buff *nlskb) + + static int sk_diag_fill(struct sock *sk, struct sk_buff *skb, + struct packet_diag_req *req, ++ bool may_report_filterinfo, + struct user_namespace *user_ns, + u32 portid, u32 seq, u32 flags, int sk_ino) + { +@@ -171,7 +172,8 @@ static int sk_diag_fill(struct sock *sk, struct sk_buff *skb, + goto out_nlmsg_trim; + + if ((req->pdiag_show & PACKET_SHOW_FILTER) && +- sock_diag_put_filterinfo(sk, skb, PACKET_DIAG_FILTER)) ++ sock_diag_put_filterinfo(may_report_filterinfo, sk, skb, ++ PACKET_DIAG_FILTER)) + goto out_nlmsg_trim; + + return nlmsg_end(skb, nlh); +@@ -187,9 +189,11 @@ static int packet_diag_dump(struct sk_buff *skb, struct netlink_callback *cb) + struct packet_diag_req *req; + struct net *net; + struct sock *sk; ++ bool may_report_filterinfo; + + net = sock_net(skb->sk); + req = nlmsg_data(cb->nlh); ++ may_report_filterinfo = netlink_net_capable(cb->skb, CAP_NET_ADMIN); + + mutex_lock(&net->packet.sklist_lock); + sk_for_each(sk, &net->packet.sklist) { +@@ -199,6 +203,7 @@ static int packet_diag_dump(struct sk_buff *skb, struct netlink_callback *cb) + goto next; + + if (sk_diag_fill(sk, skb, req, ++ may_report_filterinfo, + sk_user_ns(NETLINK_CB(cb->skb).sk), + NETLINK_CB(cb->skb).portid, + cb->nlh->nlmsg_seq, NLM_F_MULTI, +diff --git a/net/phonet/pn_netlink.c b/net/phonet/pn_netlink.c +index dc15f4300808..b64151ade6b3 100644 +--- a/net/phonet/pn_netlink.c ++++ b/net/phonet/pn_netlink.c +@@ -70,10 +70,10 @@ static int addr_doit(struct sk_buff *skb, struct nlmsghdr *nlh) + int err; + u8 pnaddr; + +- if (!capable(CAP_NET_ADMIN)) ++ if (!netlink_capable(skb, CAP_NET_ADMIN)) + return -EPERM; + +- if (!capable(CAP_SYS_ADMIN)) ++ if (!netlink_capable(skb, CAP_SYS_ADMIN)) + return -EPERM; + + ASSERT_RTNL(); +@@ -233,10 +233,10 @@ static int route_doit(struct sk_buff *skb, struct nlmsghdr *nlh) + int err; + u8 dst; + +- if (!capable(CAP_NET_ADMIN)) ++ if (!netlink_capable(skb, CAP_NET_ADMIN)) + return -EPERM; + +- if (!capable(CAP_SYS_ADMIN)) ++ if (!netlink_capable(skb, CAP_SYS_ADMIN)) + return -EPERM; + + ASSERT_RTNL(); +diff --git a/net/sched/act_api.c b/net/sched/act_api.c +index fd7072827a40..15d46b9166de 100644 +--- a/net/sched/act_api.c ++++ b/net/sched/act_api.c +@@ -989,7 +989,7 @@ static int tc_ctl_action(struct sk_buff *skb, struct nlmsghdr *n) + u32 portid = skb ? NETLINK_CB(skb).portid : 0; + int ret = 0, ovr = 0; + +- if ((n->nlmsg_type != RTM_GETACTION) && !capable(CAP_NET_ADMIN)) ++ if ((n->nlmsg_type != RTM_GETACTION) && !netlink_capable(skb, CAP_NET_ADMIN)) + return -EPERM; + + ret = nlmsg_parse(n, sizeof(struct tcamsg), tca, TCA_ACT_MAX, NULL); +diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c +index 8e118af90973..2ea40d1877a6 100644 +--- a/net/sched/cls_api.c ++++ b/net/sched/cls_api.c +@@ -138,7 +138,7 @@ static int tc_ctl_tfilter(struct sk_buff *skb, struct nlmsghdr *n) + int err; + int tp_created = 0; + +- if ((n->nlmsg_type != RTM_GETTFILTER) && !capable(CAP_NET_ADMIN)) ++ if ((n->nlmsg_type != RTM_GETTFILTER) && !netlink_capable(skb, CAP_NET_ADMIN)) + return -EPERM; + + replay: +diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c +index 51b968d3febb..2d2f07945c85 100644 +--- a/net/sched/sch_api.c ++++ b/net/sched/sch_api.c +@@ -1024,7 +1024,7 @@ static int tc_get_qdisc(struct sk_buff *skb, struct nlmsghdr *n) + struct Qdisc *p = NULL; + int err; + +- if ((n->nlmsg_type != RTM_GETQDISC) && !capable(CAP_NET_ADMIN)) ++ if ((n->nlmsg_type != RTM_GETQDISC) && !netlink_capable(skb, CAP_NET_ADMIN)) + return -EPERM; + + err = nlmsg_parse(n, sizeof(*tcm), tca, TCA_MAX, NULL); +@@ -1091,7 +1091,7 @@ static int tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n) + struct Qdisc *q, *p; + int err; + +- if (!capable(CAP_NET_ADMIN)) ++ if (!netlink_capable(skb, CAP_NET_ADMIN)) + return -EPERM; + + replay: +@@ -1431,7 +1431,7 @@ static int tc_ctl_tclass(struct sk_buff *skb, struct nlmsghdr *n) + u32 qid; + int err; + +- if ((n->nlmsg_type != RTM_GETTCLASS) && !capable(CAP_NET_ADMIN)) ++ if ((n->nlmsg_type != RTM_GETTCLASS) && !netlink_capable(skb, CAP_NET_ADMIN)) + return -EPERM; + + err = nlmsg_parse(n, sizeof(*tcm), tca, TCA_MAX, NULL); +diff --git a/net/sctp/associola.c b/net/sctp/associola.c +index 91cfd8f94a19..229b3c3fb6c9 100644 +--- a/net/sctp/associola.c ++++ b/net/sctp/associola.c +@@ -387,7 +387,7 @@ void sctp_association_free(struct sctp_association *asoc) + /* Only real associations count against the endpoint, so + * don't bother for if this is a temporary association. + */ +- if (!asoc->temp) { ++ if (!list_empty(&asoc->asocs)) { + list_del(&asoc->asocs); + + /* Decrement the backlog value for a TCP-style listening +diff --git a/net/tipc/netlink.c b/net/tipc/netlink.c +index 8bcd4985d0fb..1e6081fb6078 100644 +--- a/net/tipc/netlink.c ++++ b/net/tipc/netlink.c +@@ -47,7 +47,7 @@ static int handle_cmd(struct sk_buff *skb, struct genl_info *info) + int hdr_space = nlmsg_total_size(GENL_HDRLEN + TIPC_GENL_HDRLEN); + u16 cmd; + +- if ((req_userhdr->cmd & 0xC000) && (!capable(CAP_NET_ADMIN))) ++ if ((req_userhdr->cmd & 0xC000) && (!netlink_capable(skb, CAP_NET_ADMIN))) + cmd = TIPC_CMD_NOT_NET_ADMIN; + else + cmd = req_userhdr->cmd; +diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c +index 3f565e495ac6..7a70a5a5671a 100644 +--- a/net/xfrm/xfrm_user.c ++++ b/net/xfrm/xfrm_user.c +@@ -2362,7 +2362,7 @@ static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh) + link = &xfrm_dispatch[type]; + + /* All operations require privileges, even GET */ +- if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) ++ if (!netlink_net_capable(skb, CAP_NET_ADMIN)) + return -EPERM; + + if ((type == (XFRM_MSG_GETSA - XFRM_MSG_BASE) || +diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c +index cdbde1762189..b9b2bebeb350 100644 +--- a/security/integrity/evm/evm_main.c ++++ b/security/integrity/evm/evm_main.c +@@ -275,12 +275,20 @@ static int evm_protect_xattr(struct dentry *dentry, const char *xattr_name, + * @xattr_value: pointer to the new extended attribute value + * @xattr_value_len: pointer to the new extended attribute value length + * +- * Updating 'security.evm' requires CAP_SYS_ADMIN privileges and that +- * the current value is valid. ++ * Before allowing the 'security.evm' protected xattr to be updated, ++ * verify the existing value is valid. As only the kernel should have ++ * access to the EVM encrypted key needed to calculate the HMAC, prevent ++ * userspace from writing HMAC value. Writing 'security.evm' requires ++ * requires CAP_SYS_ADMIN privileges. + */ + int evm_inode_setxattr(struct dentry *dentry, const char *xattr_name, + const void *xattr_value, size_t xattr_value_len) + { ++ const struct evm_ima_xattr_data *xattr_data = xattr_value; ++ ++ if ((strcmp(xattr_name, XATTR_NAME_EVM) == 0) ++ && (xattr_data->type == EVM_XATTR_HMAC)) ++ return -EPERM; + return evm_protect_xattr(dentry, xattr_name, xattr_value, + xattr_value_len); + } +diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c +index a02e0791cf15..9da974c0f958 100644 +--- a/security/integrity/ima/ima_crypto.c ++++ b/security/integrity/ima/ima_crypto.c +@@ -24,6 +24,36 @@ + + static struct crypto_shash *ima_shash_tfm; + ++/** ++ * ima_kernel_read - read file content ++ * ++ * This is a function for reading file content instead of kernel_read(). ++ * It does not perform locking checks to ensure it cannot be blocked. ++ * It does not perform security checks because it is irrelevant for IMA. ++ * ++ */ ++static int ima_kernel_read(struct file *file, loff_t offset, ++ char *addr, unsigned long count) ++{ ++ mm_segment_t old_fs; ++ char __user *buf = addr; ++ ssize_t ret; ++ ++ if (!(file->f_mode & FMODE_READ)) ++ return -EBADF; ++ if (!file->f_op->read && !file->f_op->aio_read) ++ return -EINVAL; ++ ++ old_fs = get_fs(); ++ set_fs(get_ds()); ++ if (file->f_op->read) ++ ret = file->f_op->read(file, buf, count, &offset); ++ else ++ ret = do_sync_read(file, buf, count, &offset); ++ set_fs(old_fs); ++ return ret; ++} ++ + int ima_init_crypto(void) + { + long rc; +@@ -70,7 +100,7 @@ int ima_calc_file_hash(struct file *file, char *digest) + while (offset < i_size) { + int rbuf_len; + +- rbuf_len = kernel_read(file, offset, rbuf, PAGE_SIZE); ++ rbuf_len = ima_kernel_read(file, offset, rbuf, PAGE_SIZE); + if (rbuf_len < 0) { + rc = rbuf_len; + break; +diff --git a/sound/core/control.c b/sound/core/control.c +index d8aa206e8bde..98a29b26c5f4 100644 +--- a/sound/core/control.c ++++ b/sound/core/control.c +@@ -289,6 +289,10 @@ static bool snd_ctl_remove_numid_conflict(struct snd_card *card, + { + struct snd_kcontrol *kctl; + ++ /* Make sure that the ids assigned to the control do not wrap around */ ++ if (card->last_numid >= UINT_MAX - count) ++ card->last_numid = 0; ++ + list_for_each_entry(kctl, &card->controls, list) { + if (kctl->id.numid < card->last_numid + 1 + count && + kctl->id.numid + kctl->count > card->last_numid + 1) { +@@ -331,6 +335,7 @@ int snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol) + { + struct snd_ctl_elem_id id; + unsigned int idx; ++ unsigned int count; + int err = -EINVAL; + + if (! kcontrol) +@@ -338,6 +343,9 @@ int snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol) + if (snd_BUG_ON(!card || !kcontrol->info)) + goto error; + id = kcontrol->id; ++ if (id.index > UINT_MAX - kcontrol->count) ++ goto error; ++ + down_write(&card->controls_rwsem); + if (snd_ctl_find_id(card, &id)) { + up_write(&card->controls_rwsem); +@@ -359,8 +367,9 @@ int snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol) + card->controls_count += kcontrol->count; + kcontrol->id.numid = card->last_numid + 1; + card->last_numid += kcontrol->count; ++ count = kcontrol->count; + up_write(&card->controls_rwsem); +- for (idx = 0; idx < kcontrol->count; idx++, id.index++, id.numid++) ++ for (idx = 0; idx < count; idx++, id.index++, id.numid++) + snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_ADD, &id); + return 0; + +@@ -389,6 +398,7 @@ int snd_ctl_replace(struct snd_card *card, struct snd_kcontrol *kcontrol, + bool add_on_replace) + { + struct snd_ctl_elem_id id; ++ unsigned int count; + unsigned int idx; + struct snd_kcontrol *old; + int ret; +@@ -424,8 +434,9 @@ add: + card->controls_count += kcontrol->count; + kcontrol->id.numid = card->last_numid + 1; + card->last_numid += kcontrol->count; ++ count = kcontrol->count; + up_write(&card->controls_rwsem); +- for (idx = 0; idx < kcontrol->count; idx++, id.index++, id.numid++) ++ for (idx = 0; idx < count; idx++, id.index++, id.numid++) + snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_ADD, &id); + return 0; + +@@ -898,9 +909,9 @@ static int snd_ctl_elem_write(struct snd_card *card, struct snd_ctl_file *file, + result = kctl->put(kctl, control); + } + if (result > 0) { ++ struct snd_ctl_elem_id id = control->id; + up_read(&card->controls_rwsem); +- snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE, +- &control->id); ++ snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE, &id); + return 0; + } + } +@@ -992,6 +1003,7 @@ static int snd_ctl_elem_unlock(struct snd_ctl_file *file, + + struct user_element { + struct snd_ctl_elem_info info; ++ struct snd_card *card; + void *elem_data; /* element data */ + unsigned long elem_data_size; /* size of element data in bytes */ + void *tlv_data; /* TLV data */ +@@ -1035,7 +1047,9 @@ static int snd_ctl_elem_user_get(struct snd_kcontrol *kcontrol, + { + struct user_element *ue = kcontrol->private_data; + ++ mutex_lock(&ue->card->user_ctl_lock); + memcpy(&ucontrol->value, ue->elem_data, ue->elem_data_size); ++ mutex_unlock(&ue->card->user_ctl_lock); + return 0; + } + +@@ -1044,10 +1058,12 @@ static int snd_ctl_elem_user_put(struct snd_kcontrol *kcontrol, + { + int change; + struct user_element *ue = kcontrol->private_data; +- ++ ++ mutex_lock(&ue->card->user_ctl_lock); + change = memcmp(&ucontrol->value, ue->elem_data, ue->elem_data_size) != 0; + if (change) + memcpy(ue->elem_data, &ucontrol->value, ue->elem_data_size); ++ mutex_unlock(&ue->card->user_ctl_lock); + return change; + } + +@@ -1067,19 +1083,32 @@ static int snd_ctl_elem_user_tlv(struct snd_kcontrol *kcontrol, + new_data = memdup_user(tlv, size); + if (IS_ERR(new_data)) + return PTR_ERR(new_data); ++ mutex_lock(&ue->card->user_ctl_lock); + change = ue->tlv_data_size != size; + if (!change) + change = memcmp(ue->tlv_data, new_data, size); + kfree(ue->tlv_data); + ue->tlv_data = new_data; + ue->tlv_data_size = size; ++ mutex_unlock(&ue->card->user_ctl_lock); + } else { +- if (! ue->tlv_data_size || ! ue->tlv_data) +- return -ENXIO; +- if (size < ue->tlv_data_size) +- return -ENOSPC; ++ int ret = 0; ++ ++ mutex_lock(&ue->card->user_ctl_lock); ++ if (!ue->tlv_data_size || !ue->tlv_data) { ++ ret = -ENXIO; ++ goto err_unlock; ++ } ++ if (size < ue->tlv_data_size) { ++ ret = -ENOSPC; ++ goto err_unlock; ++ } + if (copy_to_user(tlv, ue->tlv_data, ue->tlv_data_size)) +- return -EFAULT; ++ ret = -EFAULT; ++err_unlock: ++ mutex_unlock(&ue->card->user_ctl_lock); ++ if (ret) ++ return ret; + } + return change; + } +@@ -1137,8 +1166,6 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file, + struct user_element *ue; + int idx, err; + +- if (!replace && card->user_ctl_count >= MAX_USER_CONTROLS) +- return -ENOMEM; + if (info->count < 1) + return -EINVAL; + access = info->access == 0 ? SNDRV_CTL_ELEM_ACCESS_READWRITE : +@@ -1147,21 +1174,16 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file, + SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE)); + info->id.numid = 0; + memset(&kctl, 0, sizeof(kctl)); +- down_write(&card->controls_rwsem); +- _kctl = snd_ctl_find_id(card, &info->id); +- err = 0; +- if (_kctl) { +- if (replace) +- err = snd_ctl_remove(card, _kctl); +- else +- err = -EBUSY; +- } else { +- if (replace) +- err = -ENOENT; ++ ++ if (replace) { ++ err = snd_ctl_remove_user_ctl(file, &info->id); ++ if (err) ++ return err; + } +- up_write(&card->controls_rwsem); +- if (err < 0) +- return err; ++ ++ if (card->user_ctl_count >= MAX_USER_CONTROLS) ++ return -ENOMEM; ++ + memcpy(&kctl.id, &info->id, sizeof(info->id)); + kctl.count = info->owner ? info->owner : 1; + access |= SNDRV_CTL_ELEM_ACCESS_USER; +@@ -1211,6 +1233,7 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file, + ue = kzalloc(sizeof(struct user_element) + private_size, GFP_KERNEL); + if (ue == NULL) + return -ENOMEM; ++ ue->card = card; + ue->info = *info; + ue->info.access = 0; + ue->elem_data = (char *)ue + sizeof(*ue); +@@ -1322,8 +1345,9 @@ static int snd_ctl_tlv_ioctl(struct snd_ctl_file *file, + } + err = kctl->tlv.c(kctl, op_flag, tlv.length, _tlv->tlv); + if (err > 0) { ++ struct snd_ctl_elem_id id = kctl->id; + up_read(&card->controls_rwsem); +- snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_TLV, &kctl->id); ++ snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_TLV, &id); + return 0; + } + } else { +diff --git a/sound/core/init.c b/sound/core/init.c +index 6ef06400dfc8..27791a58e448 100644 +--- a/sound/core/init.c ++++ b/sound/core/init.c +@@ -208,6 +208,7 @@ int snd_card_create(int idx, const char *xid, + INIT_LIST_HEAD(&card->devices); + init_rwsem(&card->controls_rwsem); + rwlock_init(&card->ctl_files_rwlock); ++ mutex_init(&card->user_ctl_lock); + INIT_LIST_HEAD(&card->controls); + INIT_LIST_HEAD(&card->ctl_files); + spin_lock_init(&card->files_lock); +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 0923f09df503..0b85e857f1c7 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -3356,6 +3356,7 @@ enum { + ALC269_FIXUP_STEREO_DMIC, + ALC269_FIXUP_QUANTA_MUTE, + ALC269_FIXUP_LIFEBOOK, ++ ALC269_FIXUP_LIFEBOOK_EXTMIC, + ALC269_FIXUP_AMIC, + ALC269_FIXUP_DMIC, + ALC269VB_FIXUP_AMIC, +@@ -3463,6 +3464,13 @@ static const struct hda_fixup alc269_fixups[] = { + .chained = true, + .chain_id = ALC269_FIXUP_QUANTA_MUTE + }, ++ [ALC269_FIXUP_LIFEBOOK_EXTMIC] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x19, 0x01a1903c }, /* headset mic, with jack detect */ ++ { } ++ }, ++ }, + [ALC269_FIXUP_AMIC] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl[]) { +@@ -3713,6 +3721,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1025, 0x0742, "Acer AO756", ALC271_FIXUP_HP_GATE_MIC_JACK), + SND_PCI_QUIRK_VENDOR(0x1025, "Acer Aspire", ALC271_FIXUP_DMIC), + SND_PCI_QUIRK(0x10cf, 0x1475, "Lifebook", ALC269_FIXUP_LIFEBOOK), ++ SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC), + SND_PCI_QUIRK(0x17aa, 0x20f2, "Thinkpad SL410/510", ALC269_FIXUP_SKU_IGNORE), + SND_PCI_QUIRK(0x17aa, 0x215e, "Thinkpad L512", ALC269_FIXUP_SKU_IGNORE), + SND_PCI_QUIRK(0x17aa, 0x21b8, "Thinkpad Edge 14", ALC269_FIXUP_SKU_IGNORE), +@@ -4664,6 +4673,7 @@ static const struct hda_codec_preset snd_hda_preset_realtek[] = { + { .id = 0x10ec0670, .name = "ALC670", .patch = patch_alc662 }, + { .id = 0x10ec0671, .name = "ALC671", .patch = patch_alc662 }, + { .id = 0x10ec0680, .name = "ALC680", .patch = patch_alc680 }, ++ { .id = 0x10ec0867, .name = "ALC891", .patch = patch_alc882 }, + { .id = 0x10ec0880, .name = "ALC880", .patch = patch_alc880 }, + { .id = 0x10ec0882, .name = "ALC882", .patch = patch_alc882 }, + { .id = 0x10ec0883, .name = "ALC883", .patch = patch_alc882 }, +diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c +index 4fdcc1cefc25..9b7746c9546f 100644 +--- a/sound/soc/codecs/max98090.c ++++ b/sound/soc/codecs/max98090.c +@@ -255,6 +255,7 @@ static struct reg_default max98090_reg[] = { + static bool max98090_volatile_register(struct device *dev, unsigned int reg) + { + switch (reg) { ++ case M98090_REG_SOFTWARE_RESET: + case M98090_REG_DEVICE_STATUS: + case M98090_REG_JACK_STATUS: + case M98090_REG_REVISION_ID: +@@ -2343,6 +2344,8 @@ static int max98090_runtime_resume(struct device *dev) + + regcache_cache_only(max98090->regmap, false); + ++ max98090_reset(max98090); ++ + regcache_sync(max98090->regmap); + + return 0; diff --git a/projects/Cuboxi/patches/linux/linux-000-patch-3.10.45-46.patch b/projects/Cuboxi/patches/linux/linux-000-patch-3.10.45-46.patch new file mode 100644 index 0000000000..2c609049d0 --- /dev/null +++ b/projects/Cuboxi/patches/linux/linux-000-patch-3.10.45-46.patch @@ -0,0 +1,2568 @@ +diff --git a/Makefile b/Makefile +index 8a63ca1db77a..c226f110181d 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 10 +-SUBLEVEL = 45 ++SUBLEVEL = 46 + EXTRAVERSION = + NAME = TOSSUG Baby Fish + +diff --git a/arch/arm/kernel/stacktrace.c b/arch/arm/kernel/stacktrace.c +index af4e8c8a5422..6582c4adc182 100644 +--- a/arch/arm/kernel/stacktrace.c ++++ b/arch/arm/kernel/stacktrace.c +@@ -83,13 +83,16 @@ static int save_trace(struct stackframe *frame, void *d) + return trace->nr_entries >= trace->max_entries; + } + +-void save_stack_trace_tsk(struct task_struct *tsk, struct stack_trace *trace) ++/* This must be noinline to so that our skip calculation works correctly */ ++static noinline void __save_stack_trace(struct task_struct *tsk, ++ struct stack_trace *trace, unsigned int nosched) + { + struct stack_trace_data data; + struct stackframe frame; + + data.trace = trace; + data.skip = trace->skip; ++ data.no_sched_functions = nosched; + + if (tsk != current) { + #ifdef CONFIG_SMP +@@ -102,7 +105,6 @@ void save_stack_trace_tsk(struct task_struct *tsk, struct stack_trace *trace) + trace->entries[trace->nr_entries++] = ULONG_MAX; + return; + #else +- data.no_sched_functions = 1; + frame.fp = thread_saved_fp(tsk); + frame.sp = thread_saved_sp(tsk); + frame.lr = 0; /* recovered from the stack */ +@@ -111,11 +113,12 @@ void save_stack_trace_tsk(struct task_struct *tsk, struct stack_trace *trace) + } else { + register unsigned long current_sp asm ("sp"); + +- data.no_sched_functions = 0; ++ /* We don't want this function nor the caller */ ++ data.skip += 2; + frame.fp = (unsigned long)__builtin_frame_address(0); + frame.sp = current_sp; + frame.lr = (unsigned long)__builtin_return_address(0); +- frame.pc = (unsigned long)save_stack_trace_tsk; ++ frame.pc = (unsigned long)__save_stack_trace; + } + + walk_stackframe(&frame, save_trace, &data); +@@ -123,9 +126,14 @@ void save_stack_trace_tsk(struct task_struct *tsk, struct stack_trace *trace) + trace->entries[trace->nr_entries++] = ULONG_MAX; + } + ++void save_stack_trace_tsk(struct task_struct *tsk, struct stack_trace *trace) ++{ ++ __save_stack_trace(tsk, trace, 1); ++} ++ + void save_stack_trace(struct stack_trace *trace) + { +- save_stack_trace_tsk(current, trace); ++ __save_stack_trace(current, trace, 0); + } + EXPORT_SYMBOL_GPL(save_stack_trace); + #endif +diff --git a/arch/arm/mach-omap1/board-h2.c b/arch/arm/mach-omap1/board-h2.c +index 0dac3d239e32..d712c5172237 100644 +--- a/arch/arm/mach-omap1/board-h2.c ++++ b/arch/arm/mach-omap1/board-h2.c +@@ -379,7 +379,7 @@ static struct omap_usb_config h2_usb_config __initdata = { + /* usb1 has a Mini-AB port and external isp1301 transceiver */ + .otg = 2, + +-#ifdef CONFIG_USB_GADGET_OMAP ++#if IS_ENABLED(CONFIG_USB_OMAP) + .hmc_mode = 19, /* 0:host(off) 1:dev|otg 2:disabled */ + /* .hmc_mode = 21,*/ /* 0:host(off) 1:dev(loopback) 2:host(loopback) */ + #elif defined(CONFIG_USB_OHCI_HCD) || defined(CONFIG_USB_OHCI_HCD_MODULE) +diff --git a/arch/arm/mach-omap1/board-h3.c b/arch/arm/mach-omap1/board-h3.c +index 816ecd13f81e..bfed4f928663 100644 +--- a/arch/arm/mach-omap1/board-h3.c ++++ b/arch/arm/mach-omap1/board-h3.c +@@ -366,7 +366,7 @@ static struct omap_usb_config h3_usb_config __initdata = { + /* usb1 has a Mini-AB port and external isp1301 transceiver */ + .otg = 2, + +-#ifdef CONFIG_USB_GADGET_OMAP ++#if IS_ENABLED(CONFIG_USB_OMAP) + .hmc_mode = 19, /* 0:host(off) 1:dev|otg 2:disabled */ + #elif defined(CONFIG_USB_OHCI_HCD) || defined(CONFIG_USB_OHCI_HCD_MODULE) + /* NONSTANDARD CABLE NEEDED (B-to-Mini-B) */ +diff --git a/arch/arm/mach-omap1/board-innovator.c b/arch/arm/mach-omap1/board-innovator.c +index bd5f02e9c354..c49ce83cc1eb 100644 +--- a/arch/arm/mach-omap1/board-innovator.c ++++ b/arch/arm/mach-omap1/board-innovator.c +@@ -312,7 +312,7 @@ static struct omap_usb_config h2_usb_config __initdata = { + /* usb1 has a Mini-AB port and external isp1301 transceiver */ + .otg = 2, + +-#ifdef CONFIG_USB_GADGET_OMAP ++#if IS_ENABLED(CONFIG_USB_OMAP) + .hmc_mode = 19, /* 0:host(off) 1:dev|otg 2:disabled */ + /* .hmc_mode = 21,*/ /* 0:host(off) 1:dev(loopback) 2:host(loopback) */ + #elif defined(CONFIG_USB_OHCI_HCD) || defined(CONFIG_USB_OHCI_HCD_MODULE) +diff --git a/arch/arm/mach-omap1/board-osk.c b/arch/arm/mach-omap1/board-osk.c +index a7ce69286688..006fbb5f9654 100644 +--- a/arch/arm/mach-omap1/board-osk.c ++++ b/arch/arm/mach-omap1/board-osk.c +@@ -280,7 +280,7 @@ static struct omap_usb_config osk_usb_config __initdata = { + * be used, with a NONSTANDARD gender-bending cable/dongle, as + * a peripheral. + */ +-#ifdef CONFIG_USB_GADGET_OMAP ++#if IS_ENABLED(CONFIG_USB_OMAP) + .register_dev = 1, + .hmc_mode = 0, + #else +diff --git a/arch/arm/mm/proc-v7-3level.S b/arch/arm/mm/proc-v7-3level.S +index 6ba4bd9118f2..6f3b0476b729 100644 +--- a/arch/arm/mm/proc-v7-3level.S ++++ b/arch/arm/mm/proc-v7-3level.S +@@ -56,6 +56,14 @@ ENTRY(cpu_v7_switch_mm) + mov pc, lr + ENDPROC(cpu_v7_switch_mm) + ++#ifdef __ARMEB__ ++#define rl r3 ++#define rh r2 ++#else ++#define rl r2 ++#define rh r3 ++#endif ++ + /* + * cpu_v7_set_pte_ext(ptep, pte) + * +@@ -65,13 +73,13 @@ ENDPROC(cpu_v7_switch_mm) + */ + ENTRY(cpu_v7_set_pte_ext) + #ifdef CONFIG_MMU +- tst r2, #L_PTE_VALID ++ tst rl, #L_PTE_VALID + beq 1f +- tst r3, #1 << (57 - 32) @ L_PTE_NONE +- bicne r2, #L_PTE_VALID ++ tst rh, #1 << (57 - 32) @ L_PTE_NONE ++ bicne rl, #L_PTE_VALID + bne 1f +- tst r3, #1 << (55 - 32) @ L_PTE_DIRTY +- orreq r2, #L_PTE_RDONLY ++ tst rh, #1 << (55 - 32) @ L_PTE_DIRTY ++ orreq rl, #L_PTE_RDONLY + 1: strd r2, r3, [r0] + ALT_SMP(W(nop)) + ALT_UP (mcr p15, 0, r0, c7, c10, 1) @ flush_pte +diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c +index 5341534b6d04..85536688f753 100644 +--- a/arch/arm64/kernel/ptrace.c ++++ b/arch/arm64/kernel/ptrace.c +@@ -872,6 +872,7 @@ static int compat_ptrace_write_user(struct task_struct *tsk, compat_ulong_t off, + compat_ulong_t val) + { + int ret; ++ mm_segment_t old_fs = get_fs(); + + if (off & 3 || off >= COMPAT_USER_SZ) + return -EIO; +@@ -879,10 +880,13 @@ static int compat_ptrace_write_user(struct task_struct *tsk, compat_ulong_t off, + if (off >= sizeof(compat_elf_gregset_t)) + return 0; + ++ set_fs(KERNEL_DS); + ret = copy_regset_from_user(tsk, &user_aarch32_view, + REGSET_COMPAT_GPR, off, + sizeof(compat_ulong_t), + &val); ++ set_fs(old_fs); ++ + return ret; + } + +diff --git a/arch/s390/include/asm/lowcore.h b/arch/s390/include/asm/lowcore.h +index bbf8141408cd..2bed4f02a558 100644 +--- a/arch/s390/include/asm/lowcore.h ++++ b/arch/s390/include/asm/lowcore.h +@@ -142,9 +142,9 @@ struct _lowcore { + __u8 pad_0x02fc[0x0300-0x02fc]; /* 0x02fc */ + + /* Interrupt response block */ +- __u8 irb[64]; /* 0x0300 */ ++ __u8 irb[96]; /* 0x0300 */ + +- __u8 pad_0x0340[0x0e00-0x0340]; /* 0x0340 */ ++ __u8 pad_0x0360[0x0e00-0x0360]; /* 0x0360 */ + + /* + * 0xe00 contains the address of the IPL Parameter Information +@@ -288,12 +288,13 @@ struct _lowcore { + __u8 pad_0x03a0[0x0400-0x03a0]; /* 0x03a0 */ + + /* Interrupt response block. */ +- __u8 irb[64]; /* 0x0400 */ ++ __u8 irb[96]; /* 0x0400 */ ++ __u8 pad_0x0460[0x0480-0x0460]; /* 0x0460 */ + + /* Per cpu primary space access list */ +- __u32 paste[16]; /* 0x0440 */ ++ __u32 paste[16]; /* 0x0480 */ + +- __u8 pad_0x0480[0x0e00-0x0480]; /* 0x0480 */ ++ __u8 pad_0x04c0[0x0e00-0x04c0]; /* 0x04c0 */ + + /* + * 0xe00 contains the address of the IPL Parameter Information +diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S +index 94e52cf064b0..ac6328176097 100644 +--- a/arch/x86/kernel/entry_32.S ++++ b/arch/x86/kernel/entry_32.S +@@ -434,9 +434,10 @@ sysenter_past_esp: + jnz sysenter_audit + sysenter_do_call: + cmpl $(NR_syscalls), %eax +- jae syscall_badsys ++ jae sysenter_badsys + call *sys_call_table(,%eax,4) + movl %eax,PT_EAX(%esp) ++sysenter_after_call: + LOCKDEP_SYS_EXIT + DISABLE_INTERRUPTS(CLBR_ANY) + TRACE_IRQS_OFF +@@ -554,11 +555,6 @@ ENTRY(iret_exc) + + CFI_RESTORE_STATE + ldt_ss: +- larl PT_OLDSS(%esp), %eax +- jnz restore_nocheck +- testl $0x00400000, %eax # returning to 32bit stack? +- jnz restore_nocheck # allright, normal return +- + #ifdef CONFIG_PARAVIRT + /* + * The kernel can't run on a non-flat stack if paravirt mode +@@ -691,7 +687,12 @@ END(syscall_fault) + + syscall_badsys: + movl $-ENOSYS,PT_EAX(%esp) +- jmp resume_userspace ++ jmp syscall_exit ++END(syscall_badsys) ++ ++sysenter_badsys: ++ movl $-ENOSYS,PT_EAX(%esp) ++ jmp sysenter_after_call + END(syscall_badsys) + CFI_ENDPROC + /* +diff --git a/arch/x86/syscalls/syscall_64.tbl b/arch/x86/syscalls/syscall_64.tbl +index 38ae65dfd14f..63a899304d27 100644 +--- a/arch/x86/syscalls/syscall_64.tbl ++++ b/arch/x86/syscalls/syscall_64.tbl +@@ -212,10 +212,10 @@ + 203 common sched_setaffinity sys_sched_setaffinity + 204 common sched_getaffinity sys_sched_getaffinity + 205 64 set_thread_area +-206 common io_setup sys_io_setup ++206 64 io_setup sys_io_setup + 207 common io_destroy sys_io_destroy + 208 common io_getevents sys_io_getevents +-209 common io_submit sys_io_submit ++209 64 io_submit sys_io_submit + 210 common io_cancel sys_io_cancel + 211 64 get_thread_area + 212 common lookup_dcookie sys_lookup_dcookie +@@ -356,3 +356,5 @@ + 540 x32 process_vm_writev compat_sys_process_vm_writev + 541 x32 setsockopt compat_sys_setsockopt + 542 x32 getsockopt compat_sys_getsockopt ++543 x32 io_setup compat_sys_io_setup ++544 x32 io_submit compat_sys_io_submit +diff --git a/drivers/acpi/acpica/utstring.c b/drivers/acpi/acpica/utstring.c +index b3e36a81aa4d..ca6d2acafa66 100644 +--- a/drivers/acpi/acpica/utstring.c ++++ b/drivers/acpi/acpica/utstring.c +@@ -349,7 +349,7 @@ void acpi_ut_print_string(char *string, u8 max_length) + } + + acpi_os_printf("\""); +- for (i = 0; string[i] && (i < max_length); i++) { ++ for (i = 0; (i < max_length) && string[i]; i++) { + + /* Escape sequences */ + +diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c +index ccba6e46cfb3..b62207a87430 100644 +--- a/drivers/acpi/bus.c ++++ b/drivers/acpi/bus.c +@@ -57,6 +57,12 @@ EXPORT_SYMBOL(acpi_root_dir); + + + #ifdef CONFIG_X86 ++#ifdef CONFIG_ACPI_CUSTOM_DSDT ++static inline int set_copy_dsdt(const struct dmi_system_id *id) ++{ ++ return 0; ++} ++#else + static int set_copy_dsdt(const struct dmi_system_id *id) + { + printk(KERN_NOTICE "%s detected - " +@@ -64,6 +70,7 @@ static int set_copy_dsdt(const struct dmi_system_id *id) + acpi_gbl_copy_dsdt_locally = 1; + return 0; + } ++#endif + + static struct dmi_system_id dsdt_dmi_table[] __initdata = { + /* +diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c +index bc68a440d432..c4d2f0e48685 100644 +--- a/drivers/bluetooth/hci_ldisc.c ++++ b/drivers/bluetooth/hci_ldisc.c +@@ -118,10 +118,6 @@ static inline struct sk_buff *hci_uart_dequeue(struct hci_uart *hu) + + int hci_uart_tx_wakeup(struct hci_uart *hu) + { +- struct tty_struct *tty = hu->tty; +- struct hci_dev *hdev = hu->hdev; +- struct sk_buff *skb; +- + if (test_and_set_bit(HCI_UART_SENDING, &hu->tx_state)) { + set_bit(HCI_UART_TX_WAKEUP, &hu->tx_state); + return 0; +@@ -129,6 +125,22 @@ int hci_uart_tx_wakeup(struct hci_uart *hu) + + BT_DBG(""); + ++ schedule_work(&hu->write_work); ++ ++ return 0; ++} ++ ++static void hci_uart_write_work(struct work_struct *work) ++{ ++ struct hci_uart *hu = container_of(work, struct hci_uart, write_work); ++ struct tty_struct *tty = hu->tty; ++ struct hci_dev *hdev = hu->hdev; ++ struct sk_buff *skb; ++ ++ /* REVISIT: should we cope with bad skbs or ->write() returning ++ * and error value ? ++ */ ++ + restart: + clear_bit(HCI_UART_TX_WAKEUP, &hu->tx_state); + +@@ -153,7 +165,6 @@ restart: + goto restart; + + clear_bit(HCI_UART_SENDING, &hu->tx_state); +- return 0; + } + + static void hci_uart_init_work(struct work_struct *work) +@@ -289,6 +300,7 @@ static int hci_uart_tty_open(struct tty_struct *tty) + tty->receive_room = 65536; + + INIT_WORK(&hu->init_ready, hci_uart_init_work); ++ INIT_WORK(&hu->write_work, hci_uart_write_work); + + spin_lock_init(&hu->rx_lock); + +@@ -326,6 +338,8 @@ static void hci_uart_tty_close(struct tty_struct *tty) + if (hdev) + hci_uart_close(hdev); + ++ cancel_work_sync(&hu->write_work); ++ + if (test_and_clear_bit(HCI_UART_PROTO_SET, &hu->flags)) { + if (hdev) { + if (test_bit(HCI_UART_REGISTERED, &hu->flags)) +diff --git a/drivers/bluetooth/hci_uart.h b/drivers/bluetooth/hci_uart.h +index fffa61ff5cb1..12df101ca942 100644 +--- a/drivers/bluetooth/hci_uart.h ++++ b/drivers/bluetooth/hci_uart.h +@@ -68,6 +68,7 @@ struct hci_uart { + unsigned long hdev_flags; + + struct work_struct init_ready; ++ struct work_struct write_work; + + struct hci_uart_proto *proto; + void *priv; +diff --git a/drivers/char/applicom.c b/drivers/char/applicom.c +index 974321a2508d..14790304b84b 100644 +--- a/drivers/char/applicom.c ++++ b/drivers/char/applicom.c +@@ -345,7 +345,6 @@ out: + free_irq(apbs[i].irq, &dummy); + iounmap(apbs[i].RamIO); + } +- pci_disable_device(dev); + return ret; + } + +diff --git a/drivers/extcon/extcon-max8997.c b/drivers/extcon/extcon-max8997.c +index 67d6738d85a0..09f4a9374cf5 100644 +--- a/drivers/extcon/extcon-max8997.c ++++ b/drivers/extcon/extcon-max8997.c +@@ -712,7 +712,7 @@ static int max8997_muic_probe(struct platform_device *pdev) + goto err_irq; + } + +- if (pdata->muic_pdata) { ++ if (pdata && pdata->muic_pdata) { + struct max8997_muic_platform_data *muic_pdata + = pdata->muic_pdata; + +diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c +index c4e5cdfa5d24..81d0e6e1f754 100644 +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -796,7 +796,17 @@ struct hid_report *hid_validate_values(struct hid_device *hid, + * ->numbered being checked, which may not always be the case when + * drivers go to access report values. + */ +- report = hid->report_enum[type].report_id_hash[id]; ++ if (id == 0) { ++ /* ++ * Validating on id 0 means we should examine the first ++ * report in the list. ++ */ ++ report = list_entry( ++ hid->report_enum[type].report_list.next, ++ struct hid_report, list); ++ } else { ++ report = hid->report_enum[type].report_id_hash[id]; ++ } + if (!report) { + hid_err(hid, "missing %s %u\n", hid_report_names[type], id); + return NULL; +diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c +index 144999918022..0e93152384f0 100644 +--- a/drivers/infiniband/ulp/isert/ib_isert.c ++++ b/drivers/infiniband/ulp/isert/ib_isert.c +@@ -572,14 +572,12 @@ isert_disconnect_work(struct work_struct *work) + isert_put_conn(isert_conn); + return; + } +- if (!isert_conn->logout_posted) { +- pr_debug("Calling rdma_disconnect for !logout_posted from" +- " isert_disconnect_work\n"); ++ ++ if (isert_conn->disconnect) { ++ /* Send DREQ/DREP towards our initiator */ + rdma_disconnect(isert_conn->conn_cm_id); +- mutex_unlock(&isert_conn->conn_mutex); +- iscsit_cause_connection_reinstatement(isert_conn->conn, 0); +- goto wake_up; + } ++ + mutex_unlock(&isert_conn->conn_mutex); + + wake_up: +@@ -588,10 +586,11 @@ wake_up: + } + + static void +-isert_disconnected_handler(struct rdma_cm_id *cma_id) ++isert_disconnected_handler(struct rdma_cm_id *cma_id, bool disconnect) + { + struct isert_conn *isert_conn = (struct isert_conn *)cma_id->context; + ++ isert_conn->disconnect = disconnect; + INIT_WORK(&isert_conn->conn_logout_work, isert_disconnect_work); + schedule_work(&isert_conn->conn_logout_work); + } +@@ -600,29 +599,28 @@ static int + isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event) + { + int ret = 0; ++ bool disconnect = false; + + pr_debug("isert_cma_handler: event %d status %d conn %p id %p\n", + event->event, event->status, cma_id->context, cma_id); + + switch (event->event) { + case RDMA_CM_EVENT_CONNECT_REQUEST: +- pr_debug("RDMA_CM_EVENT_CONNECT_REQUEST: >>>>>>>>>>>>>>>\n"); + ret = isert_connect_request(cma_id, event); + break; + case RDMA_CM_EVENT_ESTABLISHED: +- pr_debug("RDMA_CM_EVENT_ESTABLISHED >>>>>>>>>>>>>>\n"); + isert_connected_handler(cma_id); + break; +- case RDMA_CM_EVENT_DISCONNECTED: +- pr_debug("RDMA_CM_EVENT_DISCONNECTED: >>>>>>>>>>>>>>\n"); +- isert_disconnected_handler(cma_id); +- break; +- case RDMA_CM_EVENT_DEVICE_REMOVAL: +- case RDMA_CM_EVENT_ADDR_CHANGE: ++ case RDMA_CM_EVENT_ADDR_CHANGE: /* FALLTHRU */ ++ case RDMA_CM_EVENT_DISCONNECTED: /* FALLTHRU */ ++ case RDMA_CM_EVENT_DEVICE_REMOVAL: /* FALLTHRU */ ++ disconnect = true; ++ case RDMA_CM_EVENT_TIMEWAIT_EXIT: /* FALLTHRU */ ++ isert_disconnected_handler(cma_id, disconnect); + break; + case RDMA_CM_EVENT_CONNECT_ERROR: + default: +- pr_err("Unknown RDMA CMA event: %d\n", event->event); ++ pr_err("Unhandled RDMA CMA event: %d\n", event->event); + break; + } + +@@ -1371,11 +1369,8 @@ isert_do_control_comp(struct work_struct *work) + break; + case ISTATE_SEND_LOGOUTRSP: + pr_debug("Calling iscsit_logout_post_handler >>>>>>>>>>>>>>\n"); +- /* +- * Call atomic_dec(&isert_conn->post_send_buf_count) +- * from isert_wait_conn() +- */ +- isert_conn->logout_posted = true; ++ ++ atomic_dec(&isert_conn->post_send_buf_count); + iscsit_logout_post_handler(cmd, cmd->conn); + break; + default: +@@ -1483,6 +1478,8 @@ isert_cq_rx_comp_err(struct isert_conn *isert_conn) + isert_conn->state = ISER_CONN_DOWN; + mutex_unlock(&isert_conn->conn_mutex); + ++ iscsit_cause_connection_reinstatement(isert_conn->conn, 0); ++ + complete(&isert_conn->conn_wait_comp_err); + } + +@@ -2190,9 +2187,14 @@ accept_wait: + return -ENODEV; + + spin_lock_bh(&np->np_thread_lock); +- if (np->np_thread_state == ISCSI_NP_THREAD_RESET) { ++ if (np->np_thread_state >= ISCSI_NP_THREAD_RESET) { + spin_unlock_bh(&np->np_thread_lock); +- pr_debug("ISCSI_NP_THREAD_RESET for isert_accept_np\n"); ++ pr_debug("np_thread_state %d for isert_accept_np\n", ++ np->np_thread_state); ++ /** ++ * No point in stalling here when np_thread ++ * is in state RESET/SHUTDOWN/EXIT - bail ++ **/ + return -ENODEV; + } + spin_unlock_bh(&np->np_thread_lock); +@@ -2242,15 +2244,9 @@ static void isert_wait_conn(struct iscsi_conn *conn) + struct isert_conn *isert_conn = conn->context; + + pr_debug("isert_wait_conn: Starting \n"); +- /* +- * Decrement post_send_buf_count for special case when called +- * from isert_do_control_comp() -> iscsit_logout_post_handler() +- */ +- mutex_lock(&isert_conn->conn_mutex); +- if (isert_conn->logout_posted) +- atomic_dec(&isert_conn->post_send_buf_count); + +- if (isert_conn->conn_cm_id && isert_conn->state != ISER_CONN_DOWN) { ++ mutex_lock(&isert_conn->conn_mutex); ++ if (isert_conn->conn_cm_id) { + pr_debug("Calling rdma_disconnect from isert_wait_conn\n"); + rdma_disconnect(isert_conn->conn_cm_id); + } +@@ -2336,6 +2332,7 @@ destroy_rx_wq: + + static void __exit isert_exit(void) + { ++ flush_scheduled_work(); + kmem_cache_destroy(isert_cmd_cache); + destroy_workqueue(isert_comp_wq); + destroy_workqueue(isert_rx_wq); +diff --git a/drivers/infiniband/ulp/isert/ib_isert.h b/drivers/infiniband/ulp/isert/ib_isert.h +index dfe4a2ebef0d..032f65abee36 100644 +--- a/drivers/infiniband/ulp/isert/ib_isert.h ++++ b/drivers/infiniband/ulp/isert/ib_isert.h +@@ -78,7 +78,6 @@ struct isert_device; + + struct isert_conn { + enum iser_conn_state state; +- bool logout_posted; + int post_recv_buf_count; + atomic_t post_send_buf_count; + u32 responder_resources; +@@ -106,6 +105,7 @@ struct isert_conn { + struct completion conn_wait; + struct completion conn_wait_comp_err; + struct kref conn_kref; ++ bool disconnect; + }; + + #define ISERT_MAX_CQ 64 +diff --git a/drivers/media/pci/ivtv/ivtv-alsa-pcm.c b/drivers/media/pci/ivtv/ivtv-alsa-pcm.c +index e1863dbf4edc..7a9b98bc208b 100644 +--- a/drivers/media/pci/ivtv/ivtv-alsa-pcm.c ++++ b/drivers/media/pci/ivtv/ivtv-alsa-pcm.c +@@ -159,6 +159,12 @@ static int snd_ivtv_pcm_capture_open(struct snd_pcm_substream *substream) + + /* Instruct the CX2341[56] to start sending packets */ + snd_ivtv_lock(itvsc); ++ ++ if (ivtv_init_on_first_open(itv)) { ++ snd_ivtv_unlock(itvsc); ++ return -ENXIO; ++ } ++ + s = &itv->streams[IVTV_ENC_STREAM_TYPE_PCM]; + + v4l2_fh_init(&item.fh, s->vdev); +diff --git a/drivers/media/usb/stk1160/stk1160-core.c b/drivers/media/usb/stk1160/stk1160-core.c +index 34a26e0cfe77..03504dcf3c52 100644 +--- a/drivers/media/usb/stk1160/stk1160-core.c ++++ b/drivers/media/usb/stk1160/stk1160-core.c +@@ -67,17 +67,25 @@ int stk1160_read_reg(struct stk1160 *dev, u16 reg, u8 *value) + { + int ret; + int pipe = usb_rcvctrlpipe(dev->udev, 0); ++ u8 *buf; + + *value = 0; ++ ++ buf = kmalloc(sizeof(u8), GFP_KERNEL); ++ if (!buf) ++ return -ENOMEM; + ret = usb_control_msg(dev->udev, pipe, 0x00, + USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, +- 0x00, reg, value, sizeof(u8), HZ); ++ 0x00, reg, buf, sizeof(u8), HZ); + if (ret < 0) { + stk1160_err("read failed on reg 0x%x (%d)\n", + reg, ret); ++ kfree(buf); + return ret; + } + ++ *value = *buf; ++ kfree(buf); + return 0; + } + +diff --git a/drivers/media/usb/stk1160/stk1160.h b/drivers/media/usb/stk1160/stk1160.h +index 05b05b160e1e..abdea484c998 100644 +--- a/drivers/media/usb/stk1160/stk1160.h ++++ b/drivers/media/usb/stk1160/stk1160.h +@@ -143,7 +143,6 @@ struct stk1160 { + int num_alt; + + struct stk1160_isoc_ctl isoc_ctl; +- char urb_buf[255]; /* urb control msg buffer */ + + /* frame properties */ + int width; /* current frame width */ +diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c +index e1c5bf3ea112..c081812ac5c0 100644 +--- a/drivers/media/usb/uvc/uvc_video.c ++++ b/drivers/media/usb/uvc/uvc_video.c +@@ -361,6 +361,14 @@ static int uvc_commit_video(struct uvc_streaming *stream, + * Clocks and timestamps + */ + ++static inline void uvc_video_get_ts(struct timespec *ts) ++{ ++ if (uvc_clock_param == CLOCK_MONOTONIC) ++ ktime_get_ts(ts); ++ else ++ ktime_get_real_ts(ts); ++} ++ + static void + uvc_video_clock_decode(struct uvc_streaming *stream, struct uvc_buffer *buf, + const __u8 *data, int len) +@@ -420,7 +428,7 @@ uvc_video_clock_decode(struct uvc_streaming *stream, struct uvc_buffer *buf, + stream->clock.last_sof = dev_sof; + + host_sof = usb_get_current_frame_number(stream->dev->udev); +- ktime_get_ts(&ts); ++ uvc_video_get_ts(&ts); + + /* The UVC specification allows device implementations that can't obtain + * the USB frame number to keep their own frame counters as long as they +@@ -1010,10 +1018,7 @@ static int uvc_video_decode_start(struct uvc_streaming *stream, + return -ENODATA; + } + +- if (uvc_clock_param == CLOCK_MONOTONIC) +- ktime_get_ts(&ts); +- else +- ktime_get_real_ts(&ts); ++ uvc_video_get_ts(&ts); + + buf->buf.v4l2_buf.sequence = stream->sequence; + buf->buf.v4l2_buf.timestamp.tv_sec = ts.tv_sec; +diff --git a/drivers/net/can/sja1000/peak_pci.c b/drivers/net/can/sja1000/peak_pci.c +index 6b6f0ad75090..7042f5faddd7 100644 +--- a/drivers/net/can/sja1000/peak_pci.c ++++ b/drivers/net/can/sja1000/peak_pci.c +@@ -551,7 +551,7 @@ static int peak_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + { + struct sja1000_priv *priv; + struct peak_pci_chan *chan; +- struct net_device *dev; ++ struct net_device *dev, *prev_dev; + void __iomem *cfg_base, *reg_base; + u16 sub_sys_id, icr; + int i, err, channels; +@@ -687,11 +687,13 @@ failure_remove_channels: + writew(0x0, cfg_base + PITA_ICR + 2); + + chan = NULL; +- for (dev = pci_get_drvdata(pdev); dev; dev = chan->prev_dev) { +- unregister_sja1000dev(dev); +- free_sja1000dev(dev); ++ for (dev = pci_get_drvdata(pdev); dev; dev = prev_dev) { + priv = netdev_priv(dev); + chan = priv->priv; ++ prev_dev = chan->prev_dev; ++ ++ unregister_sja1000dev(dev); ++ free_sja1000dev(dev); + } + + /* free any PCIeC resources too */ +@@ -725,10 +727,12 @@ static void peak_pci_remove(struct pci_dev *pdev) + + /* Loop over all registered devices */ + while (1) { ++ struct net_device *prev_dev = chan->prev_dev; ++ + dev_info(&pdev->dev, "removing device %s\n", dev->name); + unregister_sja1000dev(dev); + free_sja1000dev(dev); +- dev = chan->prev_dev; ++ dev = prev_dev; + + if (!dev) { + /* do that only for first channel */ +diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c +index d1a769f35f9d..b1ab3a4956a5 100644 +--- a/drivers/net/ethernet/ti/cpsw.c ++++ b/drivers/net/ethernet/ti/cpsw.c +@@ -1547,6 +1547,10 @@ static int cpsw_probe_dt(struct cpsw_platform_data *data, + mdio_node = of_find_node_by_phandle(be32_to_cpup(parp)); + phyid = be32_to_cpup(parp+1); + mdio = of_find_device_by_node(mdio_node); ++ if (!mdio) { ++ pr_err("Missing mdio platform device\n"); ++ return -EINVAL; ++ } + snprintf(slave_data->phy_id, sizeof(slave_data->phy_id), + PHY_ID_FMT, mdio->name, phyid); + +diff --git a/drivers/staging/tidspbridge/core/dsp-clock.c b/drivers/staging/tidspbridge/core/dsp-clock.c +index 2f084e181d39..a1aca4416ca7 100644 +--- a/drivers/staging/tidspbridge/core/dsp-clock.c ++++ b/drivers/staging/tidspbridge/core/dsp-clock.c +@@ -226,7 +226,7 @@ int dsp_clk_enable(enum dsp_clk_id clk_id) + case GPT_CLK: + status = omap_dm_timer_start(timer[clk_id - 1]); + break; +-#ifdef CONFIG_OMAP_MCBSP ++#ifdef CONFIG_SND_OMAP_SOC_MCBSP + case MCBSP_CLK: + omap_mcbsp_request(MCBSP_ID(clk_id)); + omap2_mcbsp_set_clks_src(MCBSP_ID(clk_id), MCBSP_CLKS_PAD_SRC); +@@ -302,7 +302,7 @@ int dsp_clk_disable(enum dsp_clk_id clk_id) + case GPT_CLK: + status = omap_dm_timer_stop(timer[clk_id - 1]); + break; +-#ifdef CONFIG_OMAP_MCBSP ++#ifdef CONFIG_SND_OMAP_SOC_MCBSP + case MCBSP_CLK: + omap2_mcbsp_set_clks_src(MCBSP_ID(clk_id), MCBSP_CLKS_PRCM_SRC); + omap_mcbsp_free(MCBSP_ID(clk_id)); +diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c +index 68dbd88babbd..72663ba228dc 100644 +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -4151,8 +4151,6 @@ int iscsit_close_connection( + if (conn->conn_transport->iscsit_wait_conn) + conn->conn_transport->iscsit_wait_conn(conn); + +- iscsit_free_queue_reqs_for_conn(conn); +- + /* + * During Connection recovery drop unacknowledged out of order + * commands for this connection, and prepare the other commands +@@ -4169,6 +4167,7 @@ int iscsit_close_connection( + iscsit_clear_ooo_cmdsns_for_conn(conn); + iscsit_release_commands_from_conn(conn); + } ++ iscsit_free_queue_reqs_for_conn(conn); + + /* + * Handle decrementing session or connection usage count if +diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c +index 0d6c3dd25679..e14e105acff8 100644 +--- a/drivers/target/iscsi/iscsi_target_login.c ++++ b/drivers/target/iscsi/iscsi_target_login.c +@@ -597,13 +597,8 @@ static int iscsi_login_non_zero_tsih_s2( + * + * In our case, we have already located the struct iscsi_tiqn at this point. + */ +- memset(buf, 0, 32); +- sprintf(buf, "TargetPortalGroupTag=%hu", ISCSI_TPG_S(sess)->tpgt); +- if (iscsi_change_param_value(buf, conn->param_list, 0) < 0) { +- iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR, +- ISCSI_LOGIN_STATUS_NO_RESOURCES); ++ if (iscsi_change_param_sprintf(conn, "TargetPortalGroupTag=%hu", sess->tpg->tpgt)) + return -1; +- } + + return iscsi_login_disable_FIM_keys(conn->param_list, conn); + } +diff --git a/drivers/target/target_core_rd.c b/drivers/target/target_core_rd.c +index 0921a64b5550..5c3b6778c22a 100644 +--- a/drivers/target/target_core_rd.c ++++ b/drivers/target/target_core_rd.c +@@ -174,7 +174,7 @@ static int rd_build_device_space(struct rd_dev *rd_dev) + - 1; + + for (j = 0; j < sg_per_table; j++) { +- pg = alloc_pages(GFP_KERNEL, 0); ++ pg = alloc_pages(GFP_KERNEL | __GFP_ZERO, 0); + if (!pg) { + pr_err("Unable to allocate scatterlist" + " pages for struct rd_dev_sg_table\n"); +diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c +index bbc5b0ee2bdc..0ef75fb0ecba 100644 +--- a/drivers/target/target_core_sbc.c ++++ b/drivers/target/target_core_sbc.c +@@ -63,7 +63,7 @@ sbc_emulate_readcapacity(struct se_cmd *cmd) + transport_kunmap_data_sg(cmd); + } + +- target_complete_cmd(cmd, GOOD); ++ target_complete_cmd_with_length(cmd, GOOD, 8); + return 0; + } + +@@ -101,7 +101,7 @@ sbc_emulate_readcapacity_16(struct se_cmd *cmd) + transport_kunmap_data_sg(cmd); + } + +- target_complete_cmd(cmd, GOOD); ++ target_complete_cmd_with_length(cmd, GOOD, 32); + return 0; + } + +diff --git a/drivers/target/target_core_spc.c b/drivers/target/target_core_spc.c +index 9fabbf7214cd..34254b2ec466 100644 +--- a/drivers/target/target_core_spc.c ++++ b/drivers/target/target_core_spc.c +@@ -628,6 +628,7 @@ spc_emulate_inquiry(struct se_cmd *cmd) + unsigned char buf[SE_INQUIRY_BUF]; + sense_reason_t ret; + int p; ++ int len = 0; + + memset(buf, 0, SE_INQUIRY_BUF); + +@@ -645,6 +646,7 @@ spc_emulate_inquiry(struct se_cmd *cmd) + } + + ret = spc_emulate_inquiry_std(cmd, buf); ++ len = buf[4] + 5; + goto out; + } + +@@ -652,6 +654,7 @@ spc_emulate_inquiry(struct se_cmd *cmd) + if (cdb[2] == evpd_handlers[p].page) { + buf[1] = cdb[2]; + ret = evpd_handlers[p].emulate(cmd, buf); ++ len = get_unaligned_be16(&buf[2]) + 4; + goto out; + } + } +@@ -667,7 +670,7 @@ out: + } + + if (!ret) +- target_complete_cmd(cmd, GOOD); ++ target_complete_cmd_with_length(cmd, GOOD, len); + return ret; + } + +@@ -985,7 +988,7 @@ set_length: + transport_kunmap_data_sg(cmd); + } + +- target_complete_cmd(cmd, GOOD); ++ target_complete_cmd_with_length(cmd, GOOD, length); + return 0; + } + +@@ -1162,7 +1165,7 @@ done: + buf[3] = (lun_count & 0xff); + transport_kunmap_data_sg(cmd); + +- target_complete_cmd(cmd, GOOD); ++ target_complete_cmd_with_length(cmd, GOOD, 8 + lun_count * 8); + return 0; + } + EXPORT_SYMBOL(spc_emulate_report_luns); +diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c +index 21e315874a54..6866d86e8663 100644 +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -488,7 +488,7 @@ static int transport_cmd_check_stop(struct se_cmd *cmd, bool remove_from_lists) + + spin_unlock_irqrestore(&cmd->t_state_lock, flags); + +- complete(&cmd->t_transport_stop_comp); ++ complete_all(&cmd->t_transport_stop_comp); + return 1; + } + +@@ -617,7 +617,7 @@ void target_complete_cmd(struct se_cmd *cmd, u8 scsi_status) + if (cmd->transport_state & CMD_T_ABORTED && + cmd->transport_state & CMD_T_STOP) { + spin_unlock_irqrestore(&cmd->t_state_lock, flags); +- complete(&cmd->t_transport_stop_comp); ++ complete_all(&cmd->t_transport_stop_comp); + return; + } else if (cmd->transport_state & CMD_T_FAILED) { + INIT_WORK(&cmd->work, target_complete_failure_work); +@@ -633,6 +633,23 @@ void target_complete_cmd(struct se_cmd *cmd, u8 scsi_status) + } + EXPORT_SYMBOL(target_complete_cmd); + ++void target_complete_cmd_with_length(struct se_cmd *cmd, u8 scsi_status, int length) ++{ ++ if (scsi_status == SAM_STAT_GOOD && length < cmd->data_length) { ++ if (cmd->se_cmd_flags & SCF_UNDERFLOW_BIT) { ++ cmd->residual_count += cmd->data_length - length; ++ } else { ++ cmd->se_cmd_flags |= SCF_UNDERFLOW_BIT; ++ cmd->residual_count = cmd->data_length - length; ++ } ++ ++ cmd->data_length = length; ++ } ++ ++ target_complete_cmd(cmd, scsi_status); ++} ++EXPORT_SYMBOL(target_complete_cmd_with_length); ++ + static void target_add_to_state_list(struct se_cmd *cmd) + { + struct se_device *dev = cmd->se_dev; +@@ -1688,7 +1705,7 @@ void target_execute_cmd(struct se_cmd *cmd) + cmd->se_tfo->get_task_tag(cmd)); + + spin_unlock_irq(&cmd->t_state_lock); +- complete(&cmd->t_transport_stop_comp); ++ complete_all(&cmd->t_transport_stop_comp); + return; + } + +@@ -2877,6 +2894,12 @@ static void target_tmr_work(struct work_struct *work) + int transport_generic_handle_tmr( + struct se_cmd *cmd) + { ++ unsigned long flags; ++ ++ spin_lock_irqsave(&cmd->t_state_lock, flags); ++ cmd->transport_state |= CMD_T_ACTIVE; ++ spin_unlock_irqrestore(&cmd->t_state_lock, flags); ++ + INIT_WORK(&cmd->work, target_tmr_work); + queue_work(cmd->se_dev->tmr_wq, &cmd->work); + return 0; +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index 69948ad39837..d868b62c1a16 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -604,6 +604,10 @@ static int __dwc3_gadget_ep_disable(struct dwc3_ep *dep) + + dwc3_remove_requests(dwc, dep); + ++ /* make sure HW endpoint isn't stalled */ ++ if (dep->flags & DWC3_EP_STALL) ++ __dwc3_gadget_ep_set_halt(dep, 0); ++ + reg = dwc3_readl(dwc->regs, DWC3_DALEPENA); + reg &= ~DWC3_DALEPENA_EP(dep->number); + dwc3_writel(dwc->regs, DWC3_DALEPENA, reg); +diff --git a/drivers/usb/gadget/inode.c b/drivers/usb/gadget/inode.c +index 570c005062ab..42a30903d4fd 100644 +--- a/drivers/usb/gadget/inode.c ++++ b/drivers/usb/gadget/inode.c +@@ -1509,7 +1509,7 @@ gadgetfs_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) + } + break; + +-#ifndef CONFIG_USB_GADGET_PXA25X ++#ifndef CONFIG_USB_PXA25X + /* PXA automagically handles this request too */ + case USB_REQ_GET_CONFIGURATION: + if (ctrl->bRequestType != 0x80) +diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c +index 4c338ec03a07..9cfe3af3101a 100644 +--- a/drivers/usb/host/pci-quirks.c ++++ b/drivers/usb/host/pci-quirks.c +@@ -555,6 +555,14 @@ static const struct dmi_system_id ehci_dmi_nohandoff_table[] = { + DMI_MATCH(DMI_BIOS_VERSION, "Lucid-"), + }, + }, ++ { ++ /* HASEE E200 */ ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "HASEE"), ++ DMI_MATCH(DMI_BOARD_NAME, "E210"), ++ DMI_MATCH(DMI_BIOS_VERSION, "6.00"), ++ }, ++ }, + { } + }; + +@@ -564,9 +572,14 @@ static void ehci_bios_handoff(struct pci_dev *pdev, + { + int try_handoff = 1, tried_handoff = 0; + +- /* The Pegatron Lucid tablet sporadically waits for 98 seconds trying +- * the handoff on its unused controller. Skip it. */ +- if (pdev->vendor == 0x8086 && pdev->device == 0x283a) { ++ /* ++ * The Pegatron Lucid tablet sporadically waits for 98 seconds trying ++ * the handoff on its unused controller. Skip it. ++ * ++ * The HASEE E200 hangs when the semaphore is set (bugzilla #77021). ++ */ ++ if (pdev->vendor == 0x8086 && (pdev->device == 0x283a || ++ pdev->device == 0x27cc)) { + if (dmi_check_system(ehci_dmi_nohandoff_table)) + try_handoff = 0; + } +diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c +index 8b4ca1cb450a..98438b90838f 100644 +--- a/drivers/usb/misc/usbtest.c ++++ b/drivers/usb/misc/usbtest.c +@@ -7,9 +7,10 @@ + #include + #include + #include +- ++#include + #include + ++#define SIMPLE_IO_TIMEOUT 10000 /* in milliseconds */ + + /*-------------------------------------------------------------------------*/ + +@@ -366,6 +367,7 @@ static int simple_io( + int max = urb->transfer_buffer_length; + struct completion completion; + int retval = 0; ++ unsigned long expire; + + urb->context = &completion; + while (retval == 0 && iterations-- > 0) { +@@ -378,9 +380,15 @@ static int simple_io( + if (retval != 0) + break; + +- /* NOTE: no timeouts; can't be broken out of by interrupt */ +- wait_for_completion(&completion); +- retval = urb->status; ++ expire = msecs_to_jiffies(SIMPLE_IO_TIMEOUT); ++ if (!wait_for_completion_timeout(&completion, expire)) { ++ usb_kill_urb(urb); ++ retval = (urb->status == -ENOENT ? ++ -ETIMEDOUT : urb->status); ++ } else { ++ retval = urb->status; ++ } ++ + urb->dev = udev; + if (retval == 0 && usb_pipein(urb->pipe)) + retval = simple_check_buf(tdev, urb); +@@ -476,6 +484,14 @@ alloc_sglist(int nents, int max, int vary) + return sg; + } + ++static void sg_timeout(unsigned long _req) ++{ ++ struct usb_sg_request *req = (struct usb_sg_request *) _req; ++ ++ req->status = -ETIMEDOUT; ++ usb_sg_cancel(req); ++} ++ + static int perform_sglist( + struct usbtest_dev *tdev, + unsigned iterations, +@@ -487,6 +503,9 @@ static int perform_sglist( + { + struct usb_device *udev = testdev_to_usbdev(tdev); + int retval = 0; ++ struct timer_list sg_timer; ++ ++ setup_timer_on_stack(&sg_timer, sg_timeout, (unsigned long) req); + + while (retval == 0 && iterations-- > 0) { + retval = usb_sg_init(req, udev, pipe, +@@ -497,7 +516,10 @@ static int perform_sglist( + + if (retval) + break; ++ mod_timer(&sg_timer, jiffies + ++ msecs_to_jiffies(SIMPLE_IO_TIMEOUT)); + usb_sg_wait(req); ++ del_timer_sync(&sg_timer); + retval = req->status; + + /* FIXME check resulting data pattern */ +@@ -1149,6 +1171,11 @@ static int unlink1(struct usbtest_dev *dev, int pipe, int size, int async) + urb->context = &completion; + urb->complete = unlink1_callback; + ++ if (usb_pipeout(urb->pipe)) { ++ simple_fill_buf(urb); ++ urb->transfer_flags |= URB_ZERO_PACKET; ++ } ++ + /* keep the endpoint busy. there are lots of hc/hcd-internal + * states, and testing should get to all of them over time. + * +@@ -1279,6 +1306,11 @@ static int unlink_queued(struct usbtest_dev *dev, int pipe, unsigned num, + unlink_queued_callback, &ctx); + ctx.urbs[i]->transfer_dma = buf_dma; + ctx.urbs[i]->transfer_flags = URB_NO_TRANSFER_DMA_MAP; ++ ++ if (usb_pipeout(ctx.urbs[i]->pipe)) { ++ simple_fill_buf(ctx.urbs[i]); ++ ctx.urbs[i]->transfer_flags |= URB_ZERO_PACKET; ++ } + } + + /* Submit all the URBs and then unlink URBs num - 4 and num - 2. */ +diff --git a/drivers/usb/phy/phy-isp1301-omap.c b/drivers/usb/phy/phy-isp1301-omap.c +index ae481afcb3ec..9201feb97e9e 100644 +--- a/drivers/usb/phy/phy-isp1301-omap.c ++++ b/drivers/usb/phy/phy-isp1301-omap.c +@@ -1299,7 +1299,7 @@ isp1301_set_host(struct usb_otg *otg, struct usb_bus *host) + return isp1301_otg_enable(isp); + return 0; + +-#elif !defined(CONFIG_USB_GADGET_OMAP) ++#elif !IS_ENABLED(CONFIG_USB_OMAP) + // FIXME update its refcount + otg->host = host; + +diff --git a/drivers/usb/serial/bus.c b/drivers/usb/serial/bus.c +index 3c4db6d196c6..7229b265870a 100644 +--- a/drivers/usb/serial/bus.c ++++ b/drivers/usb/serial/bus.c +@@ -98,13 +98,19 @@ static int usb_serial_device_remove(struct device *dev) + struct usb_serial_port *port; + int retval = 0; + int minor; ++ int autopm_err; + + port = to_usb_serial_port(dev); + if (!port) + return -ENODEV; + +- /* make sure suspend/resume doesn't race against port_remove */ +- usb_autopm_get_interface(port->serial->interface); ++ /* ++ * Make sure suspend/resume doesn't race against port_remove. ++ * ++ * Note that no further runtime PM callbacks will be made if ++ * autopm_get fails. ++ */ ++ autopm_err = usb_autopm_get_interface(port->serial->interface); + + minor = port->number; + tty_unregister_device(usb_serial_tty_driver, minor); +@@ -118,7 +124,9 @@ static int usb_serial_device_remove(struct device *dev) + dev_info(dev, "%s converter now disconnected from ttyUSB%d\n", + driver->description, minor); + +- usb_autopm_put_interface(port->serial->interface); ++ if (!autopm_err) ++ usb_autopm_put_interface(port->serial->interface); ++ + return retval; + } + +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 948a19f0cdf7..70ede84f4f6b 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1925,6 +1925,7 @@ static int option_send_setup(struct usb_serial_port *port) + struct option_private *priv = intfdata->private; + struct usb_wwan_port_private *portdata; + int val = 0; ++ int res; + + portdata = usb_get_serial_port_data(port); + +@@ -1933,9 +1934,17 @@ static int option_send_setup(struct usb_serial_port *port) + if (portdata->rts_state) + val |= 0x02; + +- return usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0), ++ res = usb_autopm_get_interface(serial->interface); ++ if (res) ++ return res; ++ ++ res = usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0), + 0x22, 0x21, val, priv->bInterfaceNumber, NULL, + 0, USB_CTRL_SET_TIMEOUT); ++ ++ usb_autopm_put_interface(serial->interface); ++ ++ return res; + } + + MODULE_AUTHOR(DRIVER_AUTHOR); +diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c +index 6c0a542e8ec1..43d93dbf7d71 100644 +--- a/drivers/usb/serial/qcserial.c ++++ b/drivers/usb/serial/qcserial.c +@@ -145,12 +145,33 @@ static const struct usb_device_id id_table[] = { + {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x901f, 0)}, /* Sierra Wireless EM7355 Device Management */ + {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x901f, 2)}, /* Sierra Wireless EM7355 NMEA */ + {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x901f, 3)}, /* Sierra Wireless EM7355 Modem */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9040, 0)}, /* Sierra Wireless Modem Device Management */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9040, 2)}, /* Sierra Wireless Modem NMEA */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9040, 3)}, /* Sierra Wireless Modem Modem */ + {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9041, 0)}, /* Sierra Wireless MC7305/MC7355 Device Management */ + {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9041, 2)}, /* Sierra Wireless MC7305/MC7355 NMEA */ + {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9041, 3)}, /* Sierra Wireless MC7305/MC7355 Modem */ + {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9051, 0)}, /* Netgear AirCard 340U Device Management */ + {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9051, 2)}, /* Netgear AirCard 340U NMEA */ + {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9051, 3)}, /* Netgear AirCard 340U Modem */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9053, 0)}, /* Sierra Wireless Modem Device Management */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9053, 2)}, /* Sierra Wireless Modem NMEA */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9053, 3)}, /* Sierra Wireless Modem Modem */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9054, 0)}, /* Sierra Wireless Modem Device Management */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9054, 2)}, /* Sierra Wireless Modem NMEA */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9054, 3)}, /* Sierra Wireless Modem Modem */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9055, 0)}, /* Netgear AirCard 341U Device Management */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9055, 2)}, /* Netgear AirCard 341U NMEA */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9055, 3)}, /* Netgear AirCard 341U Modem */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9056, 0)}, /* Sierra Wireless Modem Device Management */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9056, 2)}, /* Sierra Wireless Modem NMEA */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9056, 3)}, /* Sierra Wireless Modem Modem */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9060, 0)}, /* Sierra Wireless Modem Device Management */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9060, 2)}, /* Sierra Wireless Modem NMEA */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9060, 3)}, /* Sierra Wireless Modem Modem */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9061, 0)}, /* Sierra Wireless Modem Device Management */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9061, 2)}, /* Sierra Wireless Modem NMEA */ ++ {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9061, 3)}, /* Sierra Wireless Modem Modem */ + {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a2, 0)}, /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card Device Management */ + {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a2, 2)}, /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card NMEA */ + {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a2, 3)}, /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card Modem */ +diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c +index 2df566c0e9e8..4e4590854123 100644 +--- a/drivers/usb/serial/sierra.c ++++ b/drivers/usb/serial/sierra.c +@@ -58,6 +58,7 @@ struct sierra_intf_private { + spinlock_t susp_lock; + unsigned int suspended:1; + int in_flight; ++ unsigned int open_ports; + }; + + static int sierra_set_power_state(struct usb_device *udev, __u16 swiState) +@@ -767,6 +768,7 @@ static void sierra_close(struct usb_serial_port *port) + struct usb_serial *serial = port->serial; + struct sierra_port_private *portdata; + struct sierra_intf_private *intfdata = port->serial->private; ++ struct urb *urb; + + portdata = usb_get_serial_port_data(port); + +@@ -775,7 +777,6 @@ static void sierra_close(struct usb_serial_port *port) + + mutex_lock(&serial->disc_mutex); + if (!serial->disconnected) { +- serial->interface->needs_remote_wakeup = 0; + /* odd error handling due to pm counters */ + if (!usb_autopm_get_interface(serial->interface)) + sierra_send_setup(port); +@@ -786,8 +787,22 @@ static void sierra_close(struct usb_serial_port *port) + mutex_unlock(&serial->disc_mutex); + spin_lock_irq(&intfdata->susp_lock); + portdata->opened = 0; ++ if (--intfdata->open_ports == 0) ++ serial->interface->needs_remote_wakeup = 0; + spin_unlock_irq(&intfdata->susp_lock); + ++ for (;;) { ++ urb = usb_get_from_anchor(&portdata->delayed); ++ if (!urb) ++ break; ++ kfree(urb->transfer_buffer); ++ usb_free_urb(urb); ++ usb_autopm_put_interface_async(serial->interface); ++ spin_lock(&portdata->lock); ++ portdata->outstanding_urbs--; ++ spin_unlock(&portdata->lock); ++ } ++ + sierra_stop_rx_urbs(port); + for (i = 0; i < portdata->num_in_urbs; i++) { + sierra_release_urb(portdata->in_urbs[i]); +@@ -824,23 +839,29 @@ static int sierra_open(struct tty_struct *tty, struct usb_serial_port *port) + usb_sndbulkpipe(serial->dev, endpoint) | USB_DIR_IN); + + err = sierra_submit_rx_urbs(port, GFP_KERNEL); +- if (err) { +- /* get rid of everything as in close */ +- sierra_close(port); +- /* restore balance for autopm */ +- if (!serial->disconnected) +- usb_autopm_put_interface(serial->interface); +- return err; +- } ++ if (err) ++ goto err_submit; ++ + sierra_send_setup(port); + +- serial->interface->needs_remote_wakeup = 1; + spin_lock_irq(&intfdata->susp_lock); + portdata->opened = 1; ++ if (++intfdata->open_ports == 1) ++ serial->interface->needs_remote_wakeup = 1; + spin_unlock_irq(&intfdata->susp_lock); + usb_autopm_put_interface(serial->interface); + + return 0; ++ ++err_submit: ++ sierra_stop_rx_urbs(port); ++ ++ for (i = 0; i < portdata->num_in_urbs; i++) { ++ sierra_release_urb(portdata->in_urbs[i]); ++ portdata->in_urbs[i] = NULL; ++ } ++ ++ return err; + } + + +@@ -936,6 +957,7 @@ static int sierra_port_remove(struct usb_serial_port *port) + struct sierra_port_private *portdata; + + portdata = usb_get_serial_port_data(port); ++ usb_set_serial_port_data(port, NULL); + kfree(portdata); + + return 0; +@@ -952,6 +974,8 @@ static void stop_read_write_urbs(struct usb_serial *serial) + for (i = 0; i < serial->num_ports; ++i) { + port = serial->port[i]; + portdata = usb_get_serial_port_data(port); ++ if (!portdata) ++ continue; + sierra_stop_rx_urbs(port); + usb_kill_anchored_urbs(&portdata->active); + } +@@ -994,6 +1018,9 @@ static int sierra_resume(struct usb_serial *serial) + port = serial->port[i]; + portdata = usb_get_serial_port_data(port); + ++ if (!portdata) ++ continue; ++ + while ((urb = usb_get_from_anchor(&portdata->delayed))) { + usb_anchor_urb(urb, &portdata->active); + intfdata->in_flight++; +@@ -1001,8 +1028,12 @@ static int sierra_resume(struct usb_serial *serial) + if (err < 0) { + intfdata->in_flight--; + usb_unanchor_urb(urb); +- usb_scuttle_anchored_urbs(&portdata->delayed); +- break; ++ kfree(urb->transfer_buffer); ++ usb_free_urb(urb); ++ spin_lock(&portdata->lock); ++ portdata->outstanding_urbs--; ++ spin_unlock(&portdata->lock); ++ continue; + } + } + +diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c +index 11952b6dc224..36f6b6a56907 100644 +--- a/drivers/usb/serial/usb_wwan.c ++++ b/drivers/usb/serial/usb_wwan.c +@@ -228,8 +228,10 @@ int usb_wwan_write(struct tty_struct *tty, struct usb_serial_port *port, + usb_pipeendpoint(this_urb->pipe), i); + + err = usb_autopm_get_interface_async(port->serial->interface); +- if (err < 0) ++ if (err < 0) { ++ clear_bit(i, &portdata->out_busy); + break; ++ } + + /* send the data */ + memcpy(this_urb->transfer_buffer, buf, todo); +@@ -386,6 +388,14 @@ int usb_wwan_open(struct tty_struct *tty, struct usb_serial_port *port) + portdata = usb_get_serial_port_data(port); + intfdata = serial->private; + ++ if (port->interrupt_in_urb) { ++ err = usb_submit_urb(port->interrupt_in_urb, GFP_KERNEL); ++ if (err) { ++ dev_dbg(&port->dev, "%s: submit int urb failed: %d\n", ++ __func__, err); ++ } ++ } ++ + /* Start reading from the IN endpoint */ + for (i = 0; i < N_IN_URB; i++) { + urb = portdata->in_urbs[i]; +@@ -412,12 +422,26 @@ int usb_wwan_open(struct tty_struct *tty, struct usb_serial_port *port) + } + EXPORT_SYMBOL(usb_wwan_open); + ++static void unbusy_queued_urb(struct urb *urb, ++ struct usb_wwan_port_private *portdata) ++{ ++ int i; ++ ++ for (i = 0; i < N_OUT_URB; i++) { ++ if (urb == portdata->out_urbs[i]) { ++ clear_bit(i, &portdata->out_busy); ++ break; ++ } ++ } ++} ++ + void usb_wwan_close(struct usb_serial_port *port) + { + int i; + struct usb_serial *serial = port->serial; + struct usb_wwan_port_private *portdata; + struct usb_wwan_intf_private *intfdata = port->serial->private; ++ struct urb *urb; + + portdata = usb_get_serial_port_data(port); + +@@ -426,10 +450,19 @@ void usb_wwan_close(struct usb_serial_port *port) + portdata->opened = 0; + spin_unlock_irq(&intfdata->susp_lock); + ++ for (;;) { ++ urb = usb_get_from_anchor(&portdata->delayed); ++ if (!urb) ++ break; ++ unbusy_queued_urb(urb, portdata); ++ usb_autopm_put_interface_async(serial->interface); ++ } ++ + for (i = 0; i < N_IN_URB; i++) + usb_kill_urb(portdata->in_urbs[i]); + for (i = 0; i < N_OUT_URB; i++) + usb_kill_urb(portdata->out_urbs[i]); ++ usb_kill_urb(port->interrupt_in_urb); + + /* balancing - important as an error cannot be handled*/ + usb_autopm_get_interface_no_resume(serial->interface); +@@ -467,7 +500,6 @@ int usb_wwan_port_probe(struct usb_serial_port *port) + struct usb_wwan_port_private *portdata; + struct urb *urb; + u8 *buffer; +- int err; + int i; + + if (!port->bulk_in_size || !port->bulk_out_size) +@@ -507,13 +539,6 @@ int usb_wwan_port_probe(struct usb_serial_port *port) + + usb_set_serial_port_data(port, portdata); + +- if (port->interrupt_in_urb) { +- err = usb_submit_urb(port->interrupt_in_urb, GFP_KERNEL); +- if (err) +- dev_dbg(&port->dev, "%s: submit irq_in urb failed %d\n", +- __func__, err); +- } +- + return 0; + + bail_out_error2: +@@ -581,44 +606,29 @@ static void stop_read_write_urbs(struct usb_serial *serial) + int usb_wwan_suspend(struct usb_serial *serial, pm_message_t message) + { + struct usb_wwan_intf_private *intfdata = serial->private; +- int b; + ++ spin_lock_irq(&intfdata->susp_lock); + if (PMSG_IS_AUTO(message)) { +- spin_lock_irq(&intfdata->susp_lock); +- b = intfdata->in_flight; +- spin_unlock_irq(&intfdata->susp_lock); +- +- if (b) ++ if (intfdata->in_flight) { ++ spin_unlock_irq(&intfdata->susp_lock); + return -EBUSY; ++ } + } +- +- spin_lock_irq(&intfdata->susp_lock); + intfdata->suspended = 1; + spin_unlock_irq(&intfdata->susp_lock); ++ + stop_read_write_urbs(serial); + + return 0; + } + EXPORT_SYMBOL(usb_wwan_suspend); + +-static void unbusy_queued_urb(struct urb *urb, struct usb_wwan_port_private *portdata) +-{ +- int i; +- +- for (i = 0; i < N_OUT_URB; i++) { +- if (urb == portdata->out_urbs[i]) { +- clear_bit(i, &portdata->out_busy); +- break; +- } +- } +-} +- +-static void play_delayed(struct usb_serial_port *port) ++static int play_delayed(struct usb_serial_port *port) + { + struct usb_wwan_intf_private *data; + struct usb_wwan_port_private *portdata; + struct urb *urb; +- int err; ++ int err = 0; + + portdata = usb_get_serial_port_data(port); + data = port->serial->private; +@@ -635,6 +645,8 @@ static void play_delayed(struct usb_serial_port *port) + break; + } + } ++ ++ return err; + } + + int usb_wwan_resume(struct usb_serial *serial) +@@ -644,54 +656,51 @@ int usb_wwan_resume(struct usb_serial *serial) + struct usb_wwan_intf_private *intfdata = serial->private; + struct usb_wwan_port_private *portdata; + struct urb *urb; +- int err = 0; +- +- /* get the interrupt URBs resubmitted unconditionally */ +- for (i = 0; i < serial->num_ports; i++) { +- port = serial->port[i]; +- if (!port->interrupt_in_urb) { +- dev_dbg(&port->dev, "%s: No interrupt URB for port\n", __func__); +- continue; +- } +- err = usb_submit_urb(port->interrupt_in_urb, GFP_NOIO); +- dev_dbg(&port->dev, "Submitted interrupt URB for port (result %d)\n", err); +- if (err < 0) { +- dev_err(&port->dev, "%s: Error %d for interrupt URB\n", +- __func__, err); +- goto err_out; +- } +- } ++ int err; ++ int err_count = 0; + ++ spin_lock_irq(&intfdata->susp_lock); + for (i = 0; i < serial->num_ports; i++) { + /* walk all ports */ + port = serial->port[i]; + portdata = usb_get_serial_port_data(port); + + /* skip closed ports */ +- spin_lock_irq(&intfdata->susp_lock); +- if (!portdata || !portdata->opened) { +- spin_unlock_irq(&intfdata->susp_lock); ++ if (!portdata || !portdata->opened) + continue; ++ ++ if (port->interrupt_in_urb) { ++ err = usb_submit_urb(port->interrupt_in_urb, ++ GFP_ATOMIC); ++ if (err) { ++ dev_err(&port->dev, ++ "%s: submit int urb failed: %d\n", ++ __func__, err); ++ err_count++; ++ } + } + ++ err = play_delayed(port); ++ if (err) ++ err_count++; ++ + for (j = 0; j < N_IN_URB; j++) { + urb = portdata->in_urbs[j]; + err = usb_submit_urb(urb, GFP_ATOMIC); + if (err < 0) { + dev_err(&port->dev, "%s: Error %d for bulk URB %d\n", + __func__, err, i); +- spin_unlock_irq(&intfdata->susp_lock); +- goto err_out; ++ err_count++; + } + } +- play_delayed(port); +- spin_unlock_irq(&intfdata->susp_lock); + } +- spin_lock_irq(&intfdata->susp_lock); + intfdata->suspended = 0; + spin_unlock_irq(&intfdata->susp_lock); +-err_out: +- return err; ++ ++ if (err_count) ++ return -EIO; ++ ++ return 0; + } + EXPORT_SYMBOL(usb_wwan_resume); + #endif +diff --git a/drivers/video/matrox/matroxfb_base.h b/drivers/video/matrox/matroxfb_base.h +index 556d96ce40bf..89a8a89a5eb2 100644 +--- a/drivers/video/matrox/matroxfb_base.h ++++ b/drivers/video/matrox/matroxfb_base.h +@@ -698,7 +698,7 @@ void matroxfb_unregister_driver(struct matroxfb_driver* drv); + + #define mga_fifo(n) do {} while ((mga_inl(M_FIFOSTATUS) & 0xFF) < (n)) + +-#define WaitTillIdle() do {} while (mga_inl(M_STATUS) & 0x10000) ++#define WaitTillIdle() do { mga_inl(M_STATUS); do {} while (mga_inl(M_STATUS) & 0x10000); } while (0) + + /* code speedup */ + #ifdef CONFIG_FB_MATROX_MILLENIUM +diff --git a/fs/aio.c b/fs/aio.c +index ebd06fd0de89..ded94c4fa30d 100644 +--- a/fs/aio.c ++++ b/fs/aio.c +@@ -310,7 +310,6 @@ static void free_ioctx(struct kioctx *ctx) + + avail = (head <= ctx->tail ? ctx->tail : ctx->nr_events) - head; + +- atomic_sub(avail, &ctx->reqs_active); + head += avail; + head %= ctx->nr_events; + } +@@ -678,6 +677,7 @@ void aio_complete(struct kiocb *iocb, long res, long res2) + put_rq: + /* everything turned out well, dispose of the aiocb. */ + aio_put_req(iocb); ++ atomic_dec(&ctx->reqs_active); + + /* + * We have to order our ring_info tail store above and test +@@ -717,6 +717,8 @@ static long aio_read_events_ring(struct kioctx *ctx, + if (head == ctx->tail) + goto out; + ++ head %= ctx->nr_events; ++ + while (ret < nr) { + long avail; + struct io_event *ev; +@@ -755,8 +757,6 @@ static long aio_read_events_ring(struct kioctx *ctx, + flush_dcache_page(ctx->ring_pages[0]); + + pr_debug("%li h%u t%u\n", ret, head, ctx->tail); +- +- atomic_sub(ret, &ctx->reqs_active); + out: + mutex_unlock(&ctx->ring_lock); + +diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c +index 290e347b6db3..d85f90c92bb4 100644 +--- a/fs/btrfs/backref.c ++++ b/fs/btrfs/backref.c +@@ -1347,9 +1347,10 @@ int extent_from_logical(struct btrfs_fs_info *fs_info, u64 logical, + * returns <0 on error + */ + static int __get_extent_inline_ref(unsigned long *ptr, struct extent_buffer *eb, +- struct btrfs_extent_item *ei, u32 item_size, +- struct btrfs_extent_inline_ref **out_eiref, +- int *out_type) ++ struct btrfs_key *key, ++ struct btrfs_extent_item *ei, u32 item_size, ++ struct btrfs_extent_inline_ref **out_eiref, ++ int *out_type) + { + unsigned long end; + u64 flags; +@@ -1359,19 +1360,26 @@ static int __get_extent_inline_ref(unsigned long *ptr, struct extent_buffer *eb, + /* first call */ + flags = btrfs_extent_flags(eb, ei); + if (flags & BTRFS_EXTENT_FLAG_TREE_BLOCK) { +- info = (struct btrfs_tree_block_info *)(ei + 1); +- *out_eiref = +- (struct btrfs_extent_inline_ref *)(info + 1); ++ if (key->type == BTRFS_METADATA_ITEM_KEY) { ++ /* a skinny metadata extent */ ++ *out_eiref = ++ (struct btrfs_extent_inline_ref *)(ei + 1); ++ } else { ++ WARN_ON(key->type != BTRFS_EXTENT_ITEM_KEY); ++ info = (struct btrfs_tree_block_info *)(ei + 1); ++ *out_eiref = ++ (struct btrfs_extent_inline_ref *)(info + 1); ++ } + } else { + *out_eiref = (struct btrfs_extent_inline_ref *)(ei + 1); + } + *ptr = (unsigned long)*out_eiref; +- if ((void *)*ptr >= (void *)ei + item_size) ++ if ((unsigned long)(*ptr) >= (unsigned long)ei + item_size) + return -ENOENT; + } + + end = (unsigned long)ei + item_size; +- *out_eiref = (struct btrfs_extent_inline_ref *)*ptr; ++ *out_eiref = (struct btrfs_extent_inline_ref *)(*ptr); + *out_type = btrfs_extent_inline_ref_type(eb, *out_eiref); + + *ptr += btrfs_extent_inline_ref_size(*out_type); +@@ -1390,8 +1398,8 @@ static int __get_extent_inline_ref(unsigned long *ptr, struct extent_buffer *eb, + * <0 on error. + */ + int tree_backref_for_extent(unsigned long *ptr, struct extent_buffer *eb, +- struct btrfs_extent_item *ei, u32 item_size, +- u64 *out_root, u8 *out_level) ++ struct btrfs_key *key, struct btrfs_extent_item *ei, ++ u32 item_size, u64 *out_root, u8 *out_level) + { + int ret; + int type; +@@ -1402,8 +1410,8 @@ int tree_backref_for_extent(unsigned long *ptr, struct extent_buffer *eb, + return 1; + + while (1) { +- ret = __get_extent_inline_ref(ptr, eb, ei, item_size, +- &eiref, &type); ++ ret = __get_extent_inline_ref(ptr, eb, key, ei, item_size, ++ &eiref, &type); + if (ret < 0) + return ret; + +diff --git a/fs/btrfs/backref.h b/fs/btrfs/backref.h +index 0f446d7ca2c0..526d09e70c93 100644 +--- a/fs/btrfs/backref.h ++++ b/fs/btrfs/backref.h +@@ -42,8 +42,8 @@ int extent_from_logical(struct btrfs_fs_info *fs_info, u64 logical, + u64 *flags); + + int tree_backref_for_extent(unsigned long *ptr, struct extent_buffer *eb, +- struct btrfs_extent_item *ei, u32 item_size, +- u64 *out_root, u8 *out_level); ++ struct btrfs_key *key, struct btrfs_extent_item *ei, ++ u32 item_size, u64 *out_root, u8 *out_level); + + int iterate_extent_inodes(struct btrfs_fs_info *fs_info, + u64 extent_item_objectid, +diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c +index 4354b9127713..abecce399354 100644 +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -3518,6 +3518,11 @@ int close_ctree(struct btrfs_root *root) + + btrfs_free_block_groups(fs_info); + ++ /* ++ * we must make sure there is not any read request to ++ * submit after we stopping all workers. ++ */ ++ invalidate_inode_pages2(fs_info->btree_inode->i_mapping); + btrfs_stop_all_workers(fs_info); + + del_fs_roots(fs_info); +diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c +index e7e7afb4a872..84ceff6abbc1 100644 +--- a/fs/btrfs/extent_io.c ++++ b/fs/btrfs/extent_io.c +@@ -1624,6 +1624,7 @@ again: + * shortening the size of the delalloc range we're searching + */ + free_extent_state(cached_state); ++ cached_state = NULL; + if (!loops) { + unsigned long offset = (*start) & (PAGE_CACHE_SIZE - 1); + max_bytes = PAGE_CACHE_SIZE - offset; +@@ -2356,7 +2357,7 @@ int end_extent_writepage(struct page *page, int err, u64 start, u64 end) + { + int uptodate = (err == 0); + struct extent_io_tree *tree; +- int ret; ++ int ret = 0; + + tree = &BTRFS_I(page->mapping->host)->io_tree; + +@@ -2370,6 +2371,8 @@ int end_extent_writepage(struct page *page, int err, u64 start, u64 end) + if (!uptodate) { + ClearPageUptodate(page); + SetPageError(page); ++ ret = ret < 0 ? ret : -EIO; ++ mapping_set_error(page->mapping, ret); + } + return 0; + } +diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c +index e53009657f0e..0cbe95dc8113 100644 +--- a/fs/btrfs/free-space-cache.c ++++ b/fs/btrfs/free-space-cache.c +@@ -835,7 +835,7 @@ int load_free_space_cache(struct btrfs_fs_info *fs_info, + + if (!matched) { + __btrfs_remove_free_space_cache(ctl); +- btrfs_err(fs_info, "block group %llu has wrong amount of free space", ++ btrfs_warn(fs_info, "block group %llu has wrong amount of free space", + block_group->key.objectid); + ret = -1; + } +@@ -847,7 +847,7 @@ out: + spin_unlock(&block_group->lock); + ret = 0; + +- btrfs_err(fs_info, "failed to load free space cache for block group %llu", ++ btrfs_warn(fs_info, "failed to load free space cache for block group %llu, rebuild it now", + block_group->key.objectid); + } + +diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c +index eb84c2db1aca..e4f69e3b78b9 100644 +--- a/fs/btrfs/scrub.c ++++ b/fs/btrfs/scrub.c +@@ -545,8 +545,9 @@ static void scrub_print_warning(const char *errstr, struct scrub_block *sblock) + + if (flags & BTRFS_EXTENT_FLAG_TREE_BLOCK) { + do { +- ret = tree_backref_for_extent(&ptr, eb, ei, item_size, +- &ref_root, &ref_level); ++ ret = tree_backref_for_extent(&ptr, eb, &found_key, ei, ++ item_size, &ref_root, ++ &ref_level); + printk_in_rcu(KERN_WARNING + "btrfs: %s at logical %llu on dev %s, " + "sector %llu: metadata %s (level %d) in tree " +diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c +index 256a9a46d544..414c1b9eb896 100644 +--- a/fs/btrfs/send.c ++++ b/fs/btrfs/send.c +@@ -1550,6 +1550,10 @@ static int lookup_dir_item_inode(struct btrfs_root *root, + goto out; + } + btrfs_dir_item_key_to_cpu(path->nodes[0], di, &key); ++ if (key.type == BTRFS_ROOT_ITEM_KEY) { ++ ret = -ENOENT; ++ goto out; ++ } + *found_inode = key.objectid; + *found_type = btrfs_dir_type(path->nodes[0], di); + +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index b6c23c4abae2..7fc774639a78 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -1384,6 +1384,22 @@ out: + return ret; + } + ++/* ++ * Function to update ctime/mtime for a given device path. ++ * Mainly used for ctime/mtime based probe like libblkid. ++ */ ++static void update_dev_time(char *path_name) ++{ ++ struct file *filp; ++ ++ filp = filp_open(path_name, O_RDWR, 0); ++ if (!filp) ++ return; ++ file_update_time(filp); ++ filp_close(filp, NULL); ++ return; ++} ++ + static int btrfs_rm_dev_item(struct btrfs_root *root, + struct btrfs_device *device) + { +@@ -1612,11 +1628,12 @@ int btrfs_rm_device(struct btrfs_root *root, char *device_path) + struct btrfs_fs_devices *fs_devices; + fs_devices = root->fs_info->fs_devices; + while (fs_devices) { +- if (fs_devices->seed == cur_devices) ++ if (fs_devices->seed == cur_devices) { ++ fs_devices->seed = cur_devices->seed; + break; ++ } + fs_devices = fs_devices->seed; + } +- fs_devices->seed = cur_devices->seed; + cur_devices->seed = NULL; + lock_chunks(root); + __btrfs_close_devices(cur_devices); +@@ -1642,10 +1659,14 @@ int btrfs_rm_device(struct btrfs_root *root, char *device_path) + + ret = 0; + +- /* Notify udev that device has changed */ +- if (bdev) ++ if (bdev) { ++ /* Notify udev that device has changed */ + btrfs_kobject_uevent(bdev, KOBJ_CHANGE); + ++ /* Update ctime/mtime for device path for libblkid */ ++ update_dev_time(device_path); ++ } ++ + error_brelse: + brelse(bh); + if (bdev) +@@ -1817,7 +1838,6 @@ static int btrfs_prepare_sprout(struct btrfs_root *root) + fs_devices->seeding = 0; + fs_devices->num_devices = 0; + fs_devices->open_devices = 0; +- fs_devices->total_devices = 0; + fs_devices->seed = seed_devices; + + generate_random_uuid(fs_devices->fsid); +@@ -2089,6 +2109,8 @@ int btrfs_init_new_device(struct btrfs_root *root, char *device_path) + ret = btrfs_commit_transaction(trans, root); + } + ++ /* Update ctime/mtime for libblkid */ ++ update_dev_time(device_path); + return ret; + + error_trans: +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index fba960ee26de..16bb6591561b 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -3116,7 +3116,7 @@ ext4_mb_normalize_request(struct ext4_allocation_context *ac, + } + BUG_ON(start + size <= ac->ac_o_ex.fe_logical && + start > ac->ac_o_ex.fe_logical); +- BUG_ON(size <= 0 || size > EXT4_CLUSTERS_PER_GROUP(ac->ac_sb)); ++ BUG_ON(size <= 0 || size > EXT4_BLOCKS_PER_GROUP(ac->ac_sb)); + + /* now prepare goal request */ + +diff --git a/fs/ext4/page-io.c b/fs/ext4/page-io.c +index 4acf1f78881b..b12a4427aedc 100644 +--- a/fs/ext4/page-io.c ++++ b/fs/ext4/page-io.c +@@ -384,6 +384,17 @@ int ext4_bio_write_page(struct ext4_io_submit *io, + ClearPageError(page); + + /* ++ * Comments copied from block_write_full_page_endio: ++ * ++ * The page straddles i_size. It must be zeroed out on each and every ++ * writepage invocation because it may be mmapped. "A file is mapped ++ * in multiples of the page size. For a file that is not a multiple of ++ * the page size, the remaining memory is zeroed when mapped, and ++ * writes to that region are not written out to the file." ++ */ ++ if (len < PAGE_CACHE_SIZE) ++ zero_user_segment(page, len, PAGE_CACHE_SIZE); ++ /* + * In the first loop we prepare and mark buffers to submit. We have to + * mark all buffers in the page before submitting so that + * end_page_writeback() cannot be called from ext4_bio_end_io() when IO +@@ -394,19 +405,6 @@ int ext4_bio_write_page(struct ext4_io_submit *io, + do { + block_start = bh_offset(bh); + if (block_start >= len) { +- /* +- * Comments copied from block_write_full_page_endio: +- * +- * The page straddles i_size. It must be zeroed out on +- * each and every writepage invocation because it may +- * be mmapped. "A file is mapped in multiples of the +- * page size. For a file that is not a multiple of +- * the page size, the remaining memory is zeroed when +- * mapped, and writes to that region are not written +- * out to the file." +- */ +- zero_user_segment(page, block_start, +- block_start + blocksize); + clear_buffer_dirty(bh); + set_buffer_uptodate(bh); + continue; +diff --git a/include/linux/irqdesc.h b/include/linux/irqdesc.h +index 623325e2ff97..078bc2fc74ff 100644 +--- a/include/linux/irqdesc.h ++++ b/include/linux/irqdesc.h +@@ -27,6 +27,8 @@ struct irq_desc; + * @irq_count: stats field to detect stalled irqs + * @last_unhandled: aging timer for unhandled count + * @irqs_unhandled: stats field for spurious unhandled interrupts ++ * @threads_handled: stats field for deferred spurious detection of threaded handlers ++ * @threads_handled_last: comparator field for deferred spurious detection of theraded handlers + * @lock: locking for SMP + * @affinity_hint: hint to user space for preferred irq affinity + * @affinity_notify: context for notification of affinity changes +@@ -52,6 +54,8 @@ struct irq_desc { + unsigned int irq_count; /* For detecting broken IRQs */ + unsigned long last_unhandled; /* Aging timer for unhandled count */ + unsigned int irqs_unhandled; ++ atomic_t threads_handled; ++ int threads_handled_last; + raw_spinlock_t lock; + struct cpumask *percpu_enabled; + #ifdef CONFIG_SMP +diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h +index 89573a33ab3c..2e99b8e08770 100644 +--- a/include/linux/ptrace.h ++++ b/include/linux/ptrace.h +@@ -5,6 +5,7 @@ + #include /* For struct task_struct. */ + #include /* for IS_ERR_VALUE */ + #include /* For BUG_ON. */ ++#include /* For task_active_pid_ns. */ + #include + + /* +@@ -129,6 +130,37 @@ static inline void ptrace_event(int event, unsigned long message) + } + + /** ++ * ptrace_event_pid - possibly stop for a ptrace event notification ++ * @event: %PTRACE_EVENT_* value to report ++ * @pid: process identifier for %PTRACE_GETEVENTMSG to return ++ * ++ * Check whether @event is enabled and, if so, report @event and @pid ++ * to the ptrace parent. @pid is reported as the pid_t seen from the ++ * the ptrace parent's pid namespace. ++ * ++ * Called without locks. ++ */ ++static inline void ptrace_event_pid(int event, struct pid *pid) ++{ ++ /* ++ * FIXME: There's a potential race if a ptracer in a different pid ++ * namespace than parent attaches between computing message below and ++ * when we acquire tasklist_lock in ptrace_stop(). If this happens, ++ * the ptracer will get a bogus pid from PTRACE_GETEVENTMSG. ++ */ ++ unsigned long message = 0; ++ struct pid_namespace *ns; ++ ++ rcu_read_lock(); ++ ns = task_active_pid_ns(rcu_dereference(current->parent)); ++ if (ns) ++ message = pid_nr_ns(pid, ns); ++ rcu_read_unlock(); ++ ++ ptrace_event(event, message); ++} ++ ++/** + * ptrace_init_task - initialize ptrace state for a new child + * @child: new child task + * @ptrace: true if child should be ptrace'd by parent's tracer +diff --git a/include/target/target_core_backend.h b/include/target/target_core_backend.h +index ffa2696d64dc..a63529ab9fd7 100644 +--- a/include/target/target_core_backend.h ++++ b/include/target/target_core_backend.h +@@ -50,6 +50,7 @@ int transport_subsystem_register(struct se_subsystem_api *); + void transport_subsystem_release(struct se_subsystem_api *); + + void target_complete_cmd(struct se_cmd *, u8); ++void target_complete_cmd_with_length(struct se_cmd *, u8, int); + + sense_reason_t spc_parse_cdb(struct se_cmd *cmd, unsigned int *size); + sense_reason_t spc_emulate_report_luns(struct se_cmd *cmd); +diff --git a/kernel/fork.c b/kernel/fork.c +index ff7be9dac4c1..270c1dab674a 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -1607,10 +1607,12 @@ long do_fork(unsigned long clone_flags, + */ + if (!IS_ERR(p)) { + struct completion vfork; ++ struct pid *pid; + + trace_sched_process_fork(current, p); + +- nr = task_pid_vnr(p); ++ pid = get_task_pid(p, PIDTYPE_PID); ++ nr = pid_vnr(pid); + + if (clone_flags & CLONE_PARENT_SETTID) + put_user(nr, parent_tidptr); +@@ -1625,12 +1627,14 @@ long do_fork(unsigned long clone_flags, + + /* forking complete and child started to run, tell ptracer */ + if (unlikely(trace)) +- ptrace_event(trace, nr); ++ ptrace_event_pid(trace, pid); + + if (clone_flags & CLONE_VFORK) { + if (!wait_for_vfork_done(p, &vfork)) +- ptrace_event(PTRACE_EVENT_VFORK_DONE, nr); ++ ptrace_event_pid(PTRACE_EVENT_VFORK_DONE, pid); + } ++ ++ put_pid(pid); + } else { + nr = PTR_ERR(p); + } +diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c +index 8815abfdf2cb..a79d267b64ec 100644 +--- a/kernel/irq/manage.c ++++ b/kernel/irq/manage.c +@@ -861,8 +861,8 @@ static int irq_thread(void *data) + irq_thread_check_affinity(desc, action); + + action_ret = handler_fn(desc, action); +- if (!noirqdebug) +- note_interrupt(action->irq, desc, action_ret); ++ if (action_ret == IRQ_HANDLED) ++ atomic_inc(&desc->threads_handled); + + wake_threads_waitq(desc); + } +diff --git a/kernel/irq/spurious.c b/kernel/irq/spurious.c +index 7b5f012bde9d..febcee3c2aa9 100644 +--- a/kernel/irq/spurious.c ++++ b/kernel/irq/spurious.c +@@ -265,21 +265,119 @@ try_misrouted_irq(unsigned int irq, struct irq_desc *desc, + return action && (action->flags & IRQF_IRQPOLL); + } + ++#define SPURIOUS_DEFERRED 0x80000000 ++ + void note_interrupt(unsigned int irq, struct irq_desc *desc, + irqreturn_t action_ret) + { + if (desc->istate & IRQS_POLL_INPROGRESS) + return; + +- /* we get here again via the threaded handler */ +- if (action_ret == IRQ_WAKE_THREAD) +- return; +- + if (bad_action_ret(action_ret)) { + report_bad_irq(irq, desc, action_ret); + return; + } + ++ /* ++ * We cannot call note_interrupt from the threaded handler ++ * because we need to look at the compound of all handlers ++ * (primary and threaded). Aside of that in the threaded ++ * shared case we have no serialization against an incoming ++ * hardware interrupt while we are dealing with a threaded ++ * result. ++ * ++ * So in case a thread is woken, we just note the fact and ++ * defer the analysis to the next hardware interrupt. ++ * ++ * The threaded handlers store whether they sucessfully ++ * handled an interrupt and we check whether that number ++ * changed versus the last invocation. ++ * ++ * We could handle all interrupts with the delayed by one ++ * mechanism, but for the non forced threaded case we'd just ++ * add pointless overhead to the straight hardirq interrupts ++ * for the sake of a few lines less code. ++ */ ++ if (action_ret & IRQ_WAKE_THREAD) { ++ /* ++ * There is a thread woken. Check whether one of the ++ * shared primary handlers returned IRQ_HANDLED. If ++ * not we defer the spurious detection to the next ++ * interrupt. ++ */ ++ if (action_ret == IRQ_WAKE_THREAD) { ++ int handled; ++ /* ++ * We use bit 31 of thread_handled_last to ++ * denote the deferred spurious detection ++ * active. No locking necessary as ++ * thread_handled_last is only accessed here ++ * and we have the guarantee that hard ++ * interrupts are not reentrant. ++ */ ++ if (!(desc->threads_handled_last & SPURIOUS_DEFERRED)) { ++ desc->threads_handled_last |= SPURIOUS_DEFERRED; ++ return; ++ } ++ /* ++ * Check whether one of the threaded handlers ++ * returned IRQ_HANDLED since the last ++ * interrupt happened. ++ * ++ * For simplicity we just set bit 31, as it is ++ * set in threads_handled_last as well. So we ++ * avoid extra masking. And we really do not ++ * care about the high bits of the handled ++ * count. We just care about the count being ++ * different than the one we saw before. ++ */ ++ handled = atomic_read(&desc->threads_handled); ++ handled |= SPURIOUS_DEFERRED; ++ if (handled != desc->threads_handled_last) { ++ action_ret = IRQ_HANDLED; ++ /* ++ * Note: We keep the SPURIOUS_DEFERRED ++ * bit set. We are handling the ++ * previous invocation right now. ++ * Keep it for the current one, so the ++ * next hardware interrupt will ++ * account for it. ++ */ ++ desc->threads_handled_last = handled; ++ } else { ++ /* ++ * None of the threaded handlers felt ++ * responsible for the last interrupt ++ * ++ * We keep the SPURIOUS_DEFERRED bit ++ * set in threads_handled_last as we ++ * need to account for the current ++ * interrupt as well. ++ */ ++ action_ret = IRQ_NONE; ++ } ++ } else { ++ /* ++ * One of the primary handlers returned ++ * IRQ_HANDLED. So we don't care about the ++ * threaded handlers on the same line. Clear ++ * the deferred detection bit. ++ * ++ * In theory we could/should check whether the ++ * deferred bit is set and take the result of ++ * the previous run into account here as ++ * well. But it's really not worth the ++ * trouble. If every other interrupt is ++ * handled we never trigger the spurious ++ * detector. And if this is just the one out ++ * of 100k unhandled ones which is handled ++ * then we merily delay the spurious detection ++ * by one hard interrupt. Not a real problem. ++ */ ++ desc->threads_handled_last &= ~SPURIOUS_DEFERRED; ++ } ++ } ++ + if (unlikely(action_ret == IRQ_NONE)) { + /* + * If we are seeing only the odd spurious IRQ caused by +diff --git a/lib/idr.c b/lib/idr.c +index cca4b9302a71..a3bfde8ad60e 100644 +--- a/lib/idr.c ++++ b/lib/idr.c +@@ -250,7 +250,7 @@ static int sub_alloc(struct idr *idp, int *starting_id, struct idr_layer **pa, + id = (id | ((1 << (IDR_BITS * l)) - 1)) + 1; + + /* if already at the top layer, we need to grow */ +- if (id >= 1 << (idp->layers * IDR_BITS)) { ++ if (id > idr_max(idp->layers)) { + *starting_id = id; + return -EAGAIN; + } +@@ -829,12 +829,10 @@ void *idr_replace(struct idr *idp, void *ptr, int id) + if (!p) + return ERR_PTR(-EINVAL); + +- n = (p->layer+1) * IDR_BITS; +- +- if (id >= (1 << n)) ++ if (id > idr_max(p->layer + 1)) + return ERR_PTR(-EINVAL); + +- n -= IDR_BITS; ++ n = p->layer * IDR_BITS; + while ((n > 0) && p) { + p = p->ary[(id >> n) & IDR_MASK]; + n -= IDR_BITS; +diff --git a/mm/memory-failure.c b/mm/memory-failure.c +index 4f8548abd6ee..603f1fa1b7a3 100644 +--- a/mm/memory-failure.c ++++ b/mm/memory-failure.c +@@ -208,9 +208,9 @@ static int kill_proc(struct task_struct *t, unsigned long addr, int trapno, + #endif + si.si_addr_lsb = compound_trans_order(compound_head(page)) + PAGE_SHIFT; + +- if ((flags & MF_ACTION_REQUIRED) && t == current) { ++ if ((flags & MF_ACTION_REQUIRED) && t->mm == current->mm) { + si.si_code = BUS_MCEERR_AR; +- ret = force_sig_info(SIGBUS, &si, t); ++ ret = force_sig_info(SIGBUS, &si, current); + } else { + /* + * Don't use force here, it's convenient if the signal +@@ -382,10 +382,12 @@ static void kill_procs(struct list_head *to_kill, int forcekill, int trapno, + } + } + +-static int task_early_kill(struct task_struct *tsk) ++static int task_early_kill(struct task_struct *tsk, int force_early) + { + if (!tsk->mm) + return 0; ++ if (force_early) ++ return 1; + if (tsk->flags & PF_MCE_PROCESS) + return !!(tsk->flags & PF_MCE_EARLY); + return sysctl_memory_failure_early_kill; +@@ -395,7 +397,7 @@ static int task_early_kill(struct task_struct *tsk) + * Collect processes when the error hit an anonymous page. + */ + static void collect_procs_anon(struct page *page, struct list_head *to_kill, +- struct to_kill **tkc) ++ struct to_kill **tkc, int force_early) + { + struct vm_area_struct *vma; + struct task_struct *tsk; +@@ -411,7 +413,7 @@ static void collect_procs_anon(struct page *page, struct list_head *to_kill, + for_each_process (tsk) { + struct anon_vma_chain *vmac; + +- if (!task_early_kill(tsk)) ++ if (!task_early_kill(tsk, force_early)) + continue; + anon_vma_interval_tree_foreach(vmac, &av->rb_root, + pgoff, pgoff) { +@@ -430,7 +432,7 @@ static void collect_procs_anon(struct page *page, struct list_head *to_kill, + * Collect processes when the error hit a file mapped page. + */ + static void collect_procs_file(struct page *page, struct list_head *to_kill, +- struct to_kill **tkc) ++ struct to_kill **tkc, int force_early) + { + struct vm_area_struct *vma; + struct task_struct *tsk; +@@ -441,7 +443,7 @@ static void collect_procs_file(struct page *page, struct list_head *to_kill, + for_each_process(tsk) { + pgoff_t pgoff = page->index << (PAGE_CACHE_SHIFT - PAGE_SHIFT); + +- if (!task_early_kill(tsk)) ++ if (!task_early_kill(tsk, force_early)) + continue; + + vma_interval_tree_foreach(vma, &mapping->i_mmap, pgoff, +@@ -467,7 +469,8 @@ static void collect_procs_file(struct page *page, struct list_head *to_kill, + * First preallocate one tokill structure outside the spin locks, + * so that we can kill at least one process reasonably reliable. + */ +-static void collect_procs(struct page *page, struct list_head *tokill) ++static void collect_procs(struct page *page, struct list_head *tokill, ++ int force_early) + { + struct to_kill *tk; + +@@ -478,9 +481,9 @@ static void collect_procs(struct page *page, struct list_head *tokill) + if (!tk) + return; + if (PageAnon(page)) +- collect_procs_anon(page, tokill, &tk); ++ collect_procs_anon(page, tokill, &tk, force_early); + else +- collect_procs_file(page, tokill, &tk); ++ collect_procs_file(page, tokill, &tk, force_early); + kfree(tk); + } + +@@ -965,7 +968,7 @@ static int hwpoison_user_mappings(struct page *p, unsigned long pfn, + * there's nothing that can be done. + */ + if (kill) +- collect_procs(ppage, &tokill); ++ collect_procs(ppage, &tokill, flags & MF_ACTION_REQUIRED); + + ret = try_to_unmap(ppage, ttu); + if (ret != SWAP_SUCCESS) +diff --git a/mm/rmap.c b/mm/rmap.c +index b730a4409be6..705bfc8e6fcd 100644 +--- a/mm/rmap.c ++++ b/mm/rmap.c +@@ -103,6 +103,7 @@ static inline void anon_vma_free(struct anon_vma *anon_vma) + * LOCK should suffice since the actual taking of the lock must + * happen _before_ what follows. + */ ++ might_sleep(); + if (rwsem_is_locked(&anon_vma->root->rwsem)) { + anon_vma_lock_write(anon_vma); + anon_vma_unlock_write(anon_vma); +@@ -426,8 +427,9 @@ struct anon_vma *page_get_anon_vma(struct page *page) + * above cannot corrupt). + */ + if (!page_mapped(page)) { ++ rcu_read_unlock(); + put_anon_vma(anon_vma); +- anon_vma = NULL; ++ return NULL; + } + out: + rcu_read_unlock(); +@@ -477,9 +479,9 @@ struct anon_vma *page_lock_anon_vma_read(struct page *page) + } + + if (!page_mapped(page)) { ++ rcu_read_unlock(); + put_anon_vma(anon_vma); +- anon_vma = NULL; +- goto out; ++ return NULL; + } + + /* we pinned the anon_vma, its safe to sleep */ +diff --git a/mm/vmscan.c b/mm/vmscan.c +index 43ddef3cf44f..4e89500391dc 100644 +--- a/mm/vmscan.c ++++ b/mm/vmscan.c +@@ -2286,10 +2286,17 @@ static bool pfmemalloc_watermark_ok(pg_data_t *pgdat) + + for (i = 0; i <= ZONE_NORMAL; i++) { + zone = &pgdat->node_zones[i]; ++ if (!populated_zone(zone)) ++ continue; ++ + pfmemalloc_reserve += min_wmark_pages(zone); + free_pages += zone_page_state(zone, NR_FREE_PAGES); + } + ++ /* If there are no reserves (unexpected config) then do not throttle */ ++ if (!pfmemalloc_reserve) ++ return true; ++ + wmark_ok = free_pages > pfmemalloc_reserve / 2; + + /* kswapd must be awake if processes are being throttled */ +@@ -2314,9 +2321,9 @@ static bool pfmemalloc_watermark_ok(pg_data_t *pgdat) + static bool throttle_direct_reclaim(gfp_t gfp_mask, struct zonelist *zonelist, + nodemask_t *nodemask) + { ++ struct zoneref *z; + struct zone *zone; +- int high_zoneidx = gfp_zone(gfp_mask); +- pg_data_t *pgdat; ++ pg_data_t *pgdat = NULL; + + /* + * Kernel threads should not be throttled as they may be indirectly +@@ -2335,10 +2342,34 @@ static bool throttle_direct_reclaim(gfp_t gfp_mask, struct zonelist *zonelist, + if (fatal_signal_pending(current)) + goto out; + +- /* Check if the pfmemalloc reserves are ok */ +- first_zones_zonelist(zonelist, high_zoneidx, NULL, &zone); +- pgdat = zone->zone_pgdat; +- if (pfmemalloc_watermark_ok(pgdat)) ++ /* ++ * Check if the pfmemalloc reserves are ok by finding the first node ++ * with a usable ZONE_NORMAL or lower zone. The expectation is that ++ * GFP_KERNEL will be required for allocating network buffers when ++ * swapping over the network so ZONE_HIGHMEM is unusable. ++ * ++ * Throttling is based on the first usable node and throttled processes ++ * wait on a queue until kswapd makes progress and wakes them. There ++ * is an affinity then between processes waking up and where reclaim ++ * progress has been made assuming the process wakes on the same node. ++ * More importantly, processes running on remote nodes will not compete ++ * for remote pfmemalloc reserves and processes on different nodes ++ * should make reasonable progress. ++ */ ++ for_each_zone_zonelist_nodemask(zone, z, zonelist, ++ gfp_mask, nodemask) { ++ if (zone_idx(zone) > ZONE_NORMAL) ++ continue; ++ ++ /* Throttle based on the first usable node */ ++ pgdat = zone->zone_pgdat; ++ if (pfmemalloc_watermark_ok(pgdat)) ++ goto out; ++ break; ++ } ++ ++ /* If no zone was usable by the allocation flags then do not throttle */ ++ if (!pgdat) + goto out; + + /* Account for the throttling */ +@@ -3059,7 +3090,10 @@ static int kswapd(void *p) + } + } + ++ tsk->flags &= ~(PF_MEMALLOC | PF_SWAPWRITE | PF_KSWAPD); + current->reclaim_state = NULL; ++ lockdep_clear_current_reclaim_state(); ++ + return 0; + } + +diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c +index 36fed40c162c..302d29b3744d 100644 +--- a/net/bluetooth/l2cap_sock.c ++++ b/net/bluetooth/l2cap_sock.c +@@ -949,13 +949,16 @@ static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan) + /* Check for backlog size */ + if (sk_acceptq_is_full(parent)) { + BT_DBG("backlog full %d", parent->sk_ack_backlog); ++ release_sock(parent); + return NULL; + } + + sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP, + GFP_ATOMIC); +- if (!sk) ++ if (!sk) { ++ release_sock(parent); + return NULL; ++ } + + bt_sock_reclassify_lock(sk, BTPROTO_L2CAP); + +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index 66f722b5052a..9f84a5f7404d 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -2844,6 +2844,8 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features) + skb_shinfo(nskb)->tx_flags = skb_shinfo(skb)->tx_flags & SKBTX_SHARED_FRAG; + + while (pos < offset + len && i < nfrags) { ++ if (unlikely(skb_orphan_frags(skb, GFP_ATOMIC))) ++ goto err; + *frag = skb_shinfo(skb)->frags[i]; + __skb_frag_ref(frag); + size = skb_frag_size(frag); +diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c +index 276aa86f366b..215e9b008db6 100644 +--- a/net/iucv/af_iucv.c ++++ b/net/iucv/af_iucv.c +@@ -1829,7 +1829,7 @@ static void iucv_callback_txdone(struct iucv_path *path, + spin_lock_irqsave(&list->lock, flags); + + while (list_skb != (struct sk_buff *)list) { +- if (msg->tag != IUCV_SKB_CB(list_skb)->tag) { ++ if (msg->tag == IUCV_SKB_CB(list_skb)->tag) { + this = list_skb; + break; + } diff --git a/projects/Cuboxi/patches/linux/linux-000-patch-3.10.46-47.patch b/projects/Cuboxi/patches/linux/linux-000-patch-3.10.46-47.patch new file mode 100644 index 0000000000..6bbab457c6 --- /dev/null +++ b/projects/Cuboxi/patches/linux/linux-000-patch-3.10.46-47.patch @@ -0,0 +1,1412 @@ +diff --git a/Documentation/SubmittingPatches b/Documentation/SubmittingPatches +index 6e97e73d87b5..4dbba7e100a1 100644 +--- a/Documentation/SubmittingPatches ++++ b/Documentation/SubmittingPatches +@@ -131,6 +131,20 @@ If you cannot condense your patch set into a smaller set of patches, + then only post say 15 or so at a time and wait for review and integration. + + ++If your patch fixes a bug in a specific commit, e.g. you found an issue using ++git-bisect, please use the 'Fixes:' tag with the first 12 characters of the ++SHA-1 ID, and the one line summary. ++Example: ++ ++ Fixes: e21d2170f366 ("video: remove unnecessary platform_set_drvdata()") ++ ++The following git-config settings can be used to add a pretty format for ++outputting the above style in the git log or git show commands ++ ++ [core] ++ abbrev = 12 ++ [pretty] ++ fixes = Fixes: %h (\"%s\") + + 4) Style check your changes. + +@@ -420,7 +434,7 @@ person it names. This tag documents that potentially interested parties + have been included in the discussion + + +-14) Using Reported-by:, Tested-by:, Reviewed-by: and Suggested-by: ++14) Using Reported-by:, Tested-by:, Reviewed-by:, Suggested-by: and Fixes: + + If this patch fixes a problem reported by somebody else, consider adding a + Reported-by: tag to credit the reporter for their contribution. Please +@@ -475,6 +489,12 @@ idea was not posted in a public forum. That said, if we diligently credit our + idea reporters, they will, hopefully, be inspired to help us again in the + future. + ++A Fixes: tag indicates that the patch fixes an issue in a previous commit. It ++is used to make it easy to determine where a bug originated, which can help ++review a bug fix. This tag also assists the stable kernel team in determining ++which stable kernel versions should receive your fix. This is the preferred ++method for indicating a bug fixed by the patch. See #2 above for more details. ++ + + 15) The canonical patch format + +diff --git a/Makefile b/Makefile +index c226f110181d..6a3b46d1863c 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 10 +-SUBLEVEL = 46 ++SUBLEVEL = 47 + EXTRAVERSION = + NAME = TOSSUG Baby Fish + +diff --git a/arch/mips/kernel/irq-msc01.c b/arch/mips/kernel/irq-msc01.c +index fab40f7d2e03..ac9facc08694 100644 +--- a/arch/mips/kernel/irq-msc01.c ++++ b/arch/mips/kernel/irq-msc01.c +@@ -131,7 +131,7 @@ void __init init_msc_irqs(unsigned long icubase, unsigned int irqbase, msc_irqma + + board_bind_eic_interrupt = &msc_bind_eic_interrupt; + +- for (; nirq >= 0; nirq--, imp++) { ++ for (; nirq > 0; nirq--, imp++) { + int n = imp->im_irq; + + switch (imp->im_type) { +diff --git a/arch/mips/kvm/kvm_mips.c b/arch/mips/kvm/kvm_mips.c +index 426345ac6f6e..2c7b3ade8ec0 100644 +--- a/arch/mips/kvm/kvm_mips.c ++++ b/arch/mips/kvm/kvm_mips.c +@@ -149,9 +149,7 @@ void kvm_mips_free_vcpus(struct kvm *kvm) + if (kvm->arch.guest_pmap[i] != KVM_INVALID_PAGE) + kvm_mips_release_pfn_clean(kvm->arch.guest_pmap[i]); + } +- +- if (kvm->arch.guest_pmap) +- kfree(kvm->arch.guest_pmap); ++ kfree(kvm->arch.guest_pmap); + + kvm_for_each_vcpu(i, vcpu, kvm) { + kvm_arch_vcpu_free(vcpu); +@@ -384,12 +382,9 @@ void kvm_arch_vcpu_free(struct kvm_vcpu *vcpu) + + kvm_mips_dump_stats(vcpu); + +- if (vcpu->arch.guest_ebase) +- kfree(vcpu->arch.guest_ebase); +- +- if (vcpu->arch.kseg0_commpage) +- kfree(vcpu->arch.kseg0_commpage); +- ++ kfree(vcpu->arch.guest_ebase); ++ kfree(vcpu->arch.kseg0_commpage); ++ kfree(vcpu); + } + + void kvm_arch_vcpu_destroy(struct kvm_vcpu *vcpu) +diff --git a/arch/powerpc/include/asm/systbl.h b/arch/powerpc/include/asm/systbl.h +index 43523fe0d8b4..05fcdd826829 100644 +--- a/arch/powerpc/include/asm/systbl.h ++++ b/arch/powerpc/include/asm/systbl.h +@@ -190,7 +190,7 @@ SYSCALL_SPU(getcwd) + SYSCALL_SPU(capget) + SYSCALL_SPU(capset) + COMPAT_SYS(sigaltstack) +-COMPAT_SYS_SPU(sendfile) ++SYSX_SPU(sys_sendfile64,compat_sys_sendfile,sys_sendfile) + SYSCALL(ni_syscall) + SYSCALL(ni_syscall) + PPC_SYS(vfork) +diff --git a/arch/powerpc/include/uapi/asm/cputable.h b/arch/powerpc/include/uapi/asm/cputable.h +index 5b7657959faa..de2c0e4ee1aa 100644 +--- a/arch/powerpc/include/uapi/asm/cputable.h ++++ b/arch/powerpc/include/uapi/asm/cputable.h +@@ -41,5 +41,6 @@ + #define PPC_FEATURE2_EBB 0x10000000 + #define PPC_FEATURE2_ISEL 0x08000000 + #define PPC_FEATURE2_TAR 0x04000000 ++#define PPC_FEATURE2_VEC_CRYPTO 0x02000000 + + #endif /* _UAPI__ASM_POWERPC_CPUTABLE_H */ +diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c +index 2a45d0f04385..b2dc45522850 100644 +--- a/arch/powerpc/kernel/cputable.c ++++ b/arch/powerpc/kernel/cputable.c +@@ -105,7 +105,8 @@ extern void __restore_cpu_e6500(void); + PPC_FEATURE_PSERIES_PERFMON_COMPAT) + #define COMMON_USER2_POWER8 (PPC_FEATURE2_ARCH_2_07 | \ + PPC_FEATURE2_HTM_COMP | PPC_FEATURE2_DSCR | \ +- PPC_FEATURE2_ISEL | PPC_FEATURE2_TAR) ++ PPC_FEATURE2_ISEL | PPC_FEATURE2_TAR | \ ++ PPC_FEATURE2_VEC_CRYPTO) + #define COMMON_USER_PA6T (COMMON_USER_PPC64 | PPC_FEATURE_PA6T |\ + PPC_FEATURE_TRUE_LE | \ + PPC_FEATURE_HAS_ALTIVEC_COMP) +diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c +index 5fc29ad7e26f..57fd5c1e8e89 100644 +--- a/arch/powerpc/kernel/time.c ++++ b/arch/powerpc/kernel/time.c +@@ -512,7 +512,7 @@ void timer_interrupt(struct pt_regs * regs) + + __get_cpu_var(irq_stat).timer_irqs++; + +-#if defined(CONFIG_PPC32) && defined(CONFIG_PMAC) ++#if defined(CONFIG_PPC32) && defined(CONFIG_PPC_PMAC) + if (atomic_read(&ppc_n_lost_interrupts) != 0) + do_IRQ(regs); + #endif +diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c +index e15c521846ca..08490ecc465e 100644 +--- a/arch/powerpc/lib/sstep.c ++++ b/arch/powerpc/lib/sstep.c +@@ -1395,7 +1395,7 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr) + regs->gpr[rd] = byterev_4(val); + goto ldst_done; + +-#ifdef CONFIG_PPC_CPU ++#ifdef CONFIG_PPC_FPU + case 535: /* lfsx */ + case 567: /* lfsux */ + if (!(regs->msr & MSR_FP)) +diff --git a/arch/powerpc/platforms/pseries/eeh_pseries.c b/arch/powerpc/platforms/pseries/eeh_pseries.c +index b456b157d33d..68f97d5a4679 100644 +--- a/arch/powerpc/platforms/pseries/eeh_pseries.c ++++ b/arch/powerpc/platforms/pseries/eeh_pseries.c +@@ -400,6 +400,7 @@ static int pseries_eeh_get_state(struct eeh_pe *pe, int *state) + } else { + result = EEH_STATE_NOT_SUPPORT; + } ++ break; + default: + result = EEH_STATE_NOT_SUPPORT; + } +diff --git a/arch/x86/include/asm/ptrace.h b/arch/x86/include/asm/ptrace.h +index 942a08623a1a..68e9f007cd4a 100644 +--- a/arch/x86/include/asm/ptrace.h ++++ b/arch/x86/include/asm/ptrace.h +@@ -232,6 +232,22 @@ static inline unsigned long regs_get_kernel_stack_nth(struct pt_regs *regs, + + #define ARCH_HAS_USER_SINGLE_STEP_INFO + ++/* ++ * When hitting ptrace_stop(), we cannot return using SYSRET because ++ * that does not restore the full CPU state, only a minimal set. The ++ * ptracer can change arbitrary register values, which is usually okay ++ * because the usual ptrace stops run off the signal delivery path which ++ * forces IRET; however, ptrace_event() stops happen in arbitrary places ++ * in the kernel and don't force IRET path. ++ * ++ * So force IRET path after a ptrace stop. ++ */ ++#define arch_ptrace_stop_needed(code, info) \ ++({ \ ++ set_thread_flag(TIF_NOTIFY_RESUME); \ ++ false; \ ++}) ++ + struct user_desc; + extern int do_get_thread_area(struct task_struct *p, int idx, + struct user_desc __user *info); +diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c +index 6e514583aa76..0d94e09221d9 100644 +--- a/drivers/block/mtip32xx/mtip32xx.c ++++ b/drivers/block/mtip32xx/mtip32xx.c +@@ -1493,6 +1493,37 @@ static inline void ata_swap_string(u16 *buf, unsigned int len) + be16_to_cpus(&buf[i]); + } + ++static void mtip_set_timeout(struct driver_data *dd, ++ struct host_to_dev_fis *fis, ++ unsigned int *timeout, u8 erasemode) ++{ ++ switch (fis->command) { ++ case ATA_CMD_DOWNLOAD_MICRO: ++ *timeout = 120000; /* 2 minutes */ ++ break; ++ case ATA_CMD_SEC_ERASE_UNIT: ++ case 0xFC: ++ if (erasemode) ++ *timeout = ((*(dd->port->identify + 90) * 2) * 60000); ++ else ++ *timeout = ((*(dd->port->identify + 89) * 2) * 60000); ++ break; ++ case ATA_CMD_STANDBYNOW1: ++ *timeout = 120000; /* 2 minutes */ ++ break; ++ case 0xF7: ++ case 0xFA: ++ *timeout = 60000; /* 60 seconds */ ++ break; ++ case ATA_CMD_SMART: ++ *timeout = 15000; /* 15 seconds */ ++ break; ++ default: ++ *timeout = MTIP_IOCTL_COMMAND_TIMEOUT_MS; ++ break; ++ } ++} ++ + /* + * Request the device identity information. + * +@@ -1602,6 +1633,7 @@ static int mtip_standby_immediate(struct mtip_port *port) + int rv; + struct host_to_dev_fis fis; + unsigned long start; ++ unsigned int timeout; + + /* Build the FIS. */ + memset(&fis, 0, sizeof(struct host_to_dev_fis)); +@@ -1609,6 +1641,8 @@ static int mtip_standby_immediate(struct mtip_port *port) + fis.opts = 1 << 7; + fis.command = ATA_CMD_STANDBYNOW1; + ++ mtip_set_timeout(port->dd, &fis, &timeout, 0); ++ + start = jiffies; + rv = mtip_exec_internal_command(port, + &fis, +@@ -1617,7 +1651,7 @@ static int mtip_standby_immediate(struct mtip_port *port) + 0, + 0, + GFP_ATOMIC, +- 15000); ++ timeout); + dbg_printk(MTIP_DRV_NAME "Time taken to complete standby cmd: %d ms\n", + jiffies_to_msecs(jiffies - start)); + if (rv) +@@ -2156,36 +2190,6 @@ static unsigned int implicit_sector(unsigned char command, + } + return rv; + } +-static void mtip_set_timeout(struct driver_data *dd, +- struct host_to_dev_fis *fis, +- unsigned int *timeout, u8 erasemode) +-{ +- switch (fis->command) { +- case ATA_CMD_DOWNLOAD_MICRO: +- *timeout = 120000; /* 2 minutes */ +- break; +- case ATA_CMD_SEC_ERASE_UNIT: +- case 0xFC: +- if (erasemode) +- *timeout = ((*(dd->port->identify + 90) * 2) * 60000); +- else +- *timeout = ((*(dd->port->identify + 89) * 2) * 60000); +- break; +- case ATA_CMD_STANDBYNOW1: +- *timeout = 120000; /* 2 minutes */ +- break; +- case 0xF7: +- case 0xFA: +- *timeout = 60000; /* 60 seconds */ +- break; +- case ATA_CMD_SMART: +- *timeout = 15000; /* 15 seconds */ +- break; +- default: +- *timeout = MTIP_IOCTL_COMMAND_TIMEOUT_MS; +- break; +- } +-} + + /* + * Executes a taskfile +@@ -4284,6 +4288,57 @@ static DEFINE_HANDLER(5); + static DEFINE_HANDLER(6); + static DEFINE_HANDLER(7); + ++static void mtip_disable_link_opts(struct driver_data *dd, struct pci_dev *pdev) ++{ ++ int pos; ++ unsigned short pcie_dev_ctrl; ++ ++ pos = pci_find_capability(pdev, PCI_CAP_ID_EXP); ++ if (pos) { ++ pci_read_config_word(pdev, ++ pos + PCI_EXP_DEVCTL, ++ &pcie_dev_ctrl); ++ if (pcie_dev_ctrl & (1 << 11) || ++ pcie_dev_ctrl & (1 << 4)) { ++ dev_info(&dd->pdev->dev, ++ "Disabling ERO/No-Snoop on bridge device %04x:%04x\n", ++ pdev->vendor, pdev->device); ++ pcie_dev_ctrl &= ~(PCI_EXP_DEVCTL_NOSNOOP_EN | ++ PCI_EXP_DEVCTL_RELAX_EN); ++ pci_write_config_word(pdev, ++ pos + PCI_EXP_DEVCTL, ++ pcie_dev_ctrl); ++ } ++ } ++} ++ ++static void mtip_fix_ero_nosnoop(struct driver_data *dd, struct pci_dev *pdev) ++{ ++ /* ++ * This workaround is specific to AMD/ATI chipset with a PCI upstream ++ * device with device id 0x5aXX ++ */ ++ if (pdev->bus && pdev->bus->self) { ++ if (pdev->bus->self->vendor == PCI_VENDOR_ID_ATI && ++ ((pdev->bus->self->device & 0xff00) == 0x5a00)) { ++ mtip_disable_link_opts(dd, pdev->bus->self); ++ } else { ++ /* Check further up the topology */ ++ struct pci_dev *parent_dev = pdev->bus->self; ++ if (parent_dev->bus && ++ parent_dev->bus->parent && ++ parent_dev->bus->parent->self && ++ parent_dev->bus->parent->self->vendor == ++ PCI_VENDOR_ID_ATI && ++ (parent_dev->bus->parent->self->device & ++ 0xff00) == 0x5a00) { ++ mtip_disable_link_opts(dd, ++ parent_dev->bus->parent->self); ++ } ++ } ++ } ++} ++ + /* + * Called for each supported PCI device detected. + * +@@ -4435,6 +4490,8 @@ static int mtip_pci_probe(struct pci_dev *pdev, + goto block_initialize_err; + } + ++ mtip_fix_ero_nosnoop(dd, pdev); ++ + /* Initialize the block layer. */ + rv = mtip_block_initialize(dd); + if (rv < 0) { +@@ -4727,13 +4784,13 @@ static int __init mtip_init(void) + */ + static void __exit mtip_exit(void) + { +- debugfs_remove_recursive(dfs_parent); +- + /* Release the allocated major block device number. */ + unregister_blkdev(mtip_major, MTIP_DRV_NAME); + + /* Unregister the PCI driver. */ + pci_unregister_driver(&mtip_pci_driver); ++ ++ debugfs_remove_recursive(dfs_parent); + } + + MODULE_AUTHOR("Micron Technology, Inc"); +diff --git a/drivers/extcon/extcon-max77693.c b/drivers/extcon/extcon-max77693.c +index b56bdaa27d4b..9966fc0a527f 100644 +--- a/drivers/extcon/extcon-max77693.c ++++ b/drivers/extcon/extcon-max77693.c +@@ -1180,7 +1180,7 @@ static int max77693_muic_probe(struct platform_device *pdev) + + + /* Initialize MUIC register by using platform data or default data */ +- if (pdata->muic_data) { ++ if (pdata && pdata->muic_data) { + init_data = pdata->muic_data->init_data; + num_init_data = pdata->muic_data->num_init_data; + } else { +@@ -1213,7 +1213,7 @@ static int max77693_muic_probe(struct platform_device *pdev) + = init_data[i].data; + } + +- if (pdata->muic_data) { ++ if (pdata && pdata->muic_data) { + struct max77693_muic_platform_data *muic_pdata = pdata->muic_data; + + /* +diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c +index f0d588f8859e..1acb99100556 100644 +--- a/drivers/infiniband/core/user_mad.c ++++ b/drivers/infiniband/core/user_mad.c +@@ -98,7 +98,7 @@ struct ib_umad_port { + + struct ib_umad_device { + int start_port, end_port; +- struct kref ref; ++ struct kobject kobj; + struct ib_umad_port port[0]; + }; + +@@ -134,14 +134,18 @@ static DECLARE_BITMAP(dev_map, IB_UMAD_MAX_PORTS); + static void ib_umad_add_one(struct ib_device *device); + static void ib_umad_remove_one(struct ib_device *device); + +-static void ib_umad_release_dev(struct kref *ref) ++static void ib_umad_release_dev(struct kobject *kobj) + { + struct ib_umad_device *dev = +- container_of(ref, struct ib_umad_device, ref); ++ container_of(kobj, struct ib_umad_device, kobj); + + kfree(dev); + } + ++static struct kobj_type ib_umad_dev_ktype = { ++ .release = ib_umad_release_dev, ++}; ++ + static int hdr_size(struct ib_umad_file *file) + { + return file->use_pkey_index ? sizeof (struct ib_user_mad_hdr) : +@@ -780,27 +784,19 @@ static int ib_umad_open(struct inode *inode, struct file *filp) + { + struct ib_umad_port *port; + struct ib_umad_file *file; +- int ret; ++ int ret = -ENXIO; + + port = container_of(inode->i_cdev, struct ib_umad_port, cdev); +- if (port) +- kref_get(&port->umad_dev->ref); +- else +- return -ENXIO; + + mutex_lock(&port->file_mutex); + +- if (!port->ib_dev) { +- ret = -ENXIO; ++ if (!port->ib_dev) + goto out; +- } + ++ ret = -ENOMEM; + file = kzalloc(sizeof *file, GFP_KERNEL); +- if (!file) { +- kref_put(&port->umad_dev->ref, ib_umad_release_dev); +- ret = -ENOMEM; ++ if (!file) + goto out; +- } + + mutex_init(&file->mutex); + spin_lock_init(&file->send_lock); +@@ -814,6 +810,13 @@ static int ib_umad_open(struct inode *inode, struct file *filp) + list_add_tail(&file->port_list, &port->file_list); + + ret = nonseekable_open(inode, filp); ++ if (ret) { ++ list_del(&file->port_list); ++ kfree(file); ++ goto out; ++ } ++ ++ kobject_get(&port->umad_dev->kobj); + + out: + mutex_unlock(&port->file_mutex); +@@ -852,7 +855,7 @@ static int ib_umad_close(struct inode *inode, struct file *filp) + mutex_unlock(&file->port->file_mutex); + + kfree(file); +- kref_put(&dev->ref, ib_umad_release_dev); ++ kobject_put(&dev->kobj); + + return 0; + } +@@ -880,10 +883,6 @@ static int ib_umad_sm_open(struct inode *inode, struct file *filp) + int ret; + + port = container_of(inode->i_cdev, struct ib_umad_port, sm_cdev); +- if (port) +- kref_get(&port->umad_dev->ref); +- else +- return -ENXIO; + + if (filp->f_flags & O_NONBLOCK) { + if (down_trylock(&port->sm_sem)) { +@@ -898,17 +897,27 @@ static int ib_umad_sm_open(struct inode *inode, struct file *filp) + } + + ret = ib_modify_port(port->ib_dev, port->port_num, 0, &props); +- if (ret) { +- up(&port->sm_sem); +- goto fail; +- } ++ if (ret) ++ goto err_up_sem; + + filp->private_data = port; + +- return nonseekable_open(inode, filp); ++ ret = nonseekable_open(inode, filp); ++ if (ret) ++ goto err_clr_sm_cap; ++ ++ kobject_get(&port->umad_dev->kobj); ++ ++ return 0; ++ ++err_clr_sm_cap: ++ swap(props.set_port_cap_mask, props.clr_port_cap_mask); ++ ib_modify_port(port->ib_dev, port->port_num, 0, &props); ++ ++err_up_sem: ++ up(&port->sm_sem); + + fail: +- kref_put(&port->umad_dev->ref, ib_umad_release_dev); + return ret; + } + +@@ -927,7 +936,7 @@ static int ib_umad_sm_close(struct inode *inode, struct file *filp) + + up(&port->sm_sem); + +- kref_put(&port->umad_dev->ref, ib_umad_release_dev); ++ kobject_put(&port->umad_dev->kobj); + + return ret; + } +@@ -995,6 +1004,7 @@ static int find_overflow_devnum(void) + } + + static int ib_umad_init_port(struct ib_device *device, int port_num, ++ struct ib_umad_device *umad_dev, + struct ib_umad_port *port) + { + int devnum; +@@ -1027,6 +1037,7 @@ static int ib_umad_init_port(struct ib_device *device, int port_num, + + cdev_init(&port->cdev, &umad_fops); + port->cdev.owner = THIS_MODULE; ++ port->cdev.kobj.parent = &umad_dev->kobj; + kobject_set_name(&port->cdev.kobj, "umad%d", port->dev_num); + if (cdev_add(&port->cdev, base, 1)) + goto err_cdev; +@@ -1045,6 +1056,7 @@ static int ib_umad_init_port(struct ib_device *device, int port_num, + base += IB_UMAD_MAX_PORTS; + cdev_init(&port->sm_cdev, &umad_sm_fops); + port->sm_cdev.owner = THIS_MODULE; ++ port->sm_cdev.kobj.parent = &umad_dev->kobj; + kobject_set_name(&port->sm_cdev.kobj, "issm%d", port->dev_num); + if (cdev_add(&port->sm_cdev, base, 1)) + goto err_sm_cdev; +@@ -1138,7 +1150,7 @@ static void ib_umad_add_one(struct ib_device *device) + if (!umad_dev) + return; + +- kref_init(&umad_dev->ref); ++ kobject_init(&umad_dev->kobj, &ib_umad_dev_ktype); + + umad_dev->start_port = s; + umad_dev->end_port = e; +@@ -1146,7 +1158,8 @@ static void ib_umad_add_one(struct ib_device *device) + for (i = s; i <= e; ++i) { + umad_dev->port[i - s].umad_dev = umad_dev; + +- if (ib_umad_init_port(device, i, &umad_dev->port[i - s])) ++ if (ib_umad_init_port(device, i, umad_dev, ++ &umad_dev->port[i - s])) + goto err; + } + +@@ -1158,7 +1171,7 @@ err: + while (--i >= s) + ib_umad_kill_port(&umad_dev->port[i - s]); + +- kref_put(&umad_dev->ref, ib_umad_release_dev); ++ kobject_put(&umad_dev->kobj); + } + + static void ib_umad_remove_one(struct ib_device *device) +@@ -1172,7 +1185,7 @@ static void ib_umad_remove_one(struct ib_device *device) + for (i = 0; i <= umad_dev->end_port - umad_dev->start_port; ++i) + ib_umad_kill_port(&umad_dev->port[i]); + +- kref_put(&umad_dev->ref, ib_umad_release_dev); ++ kobject_put(&umad_dev->kobj); + } + + static char *umad_devnode(struct device *dev, umode_t *mode) +diff --git a/drivers/infiniband/hw/ipath/ipath_diag.c b/drivers/infiniband/hw/ipath/ipath_diag.c +index e2f9a51f4a38..45802e97332e 100644 +--- a/drivers/infiniband/hw/ipath/ipath_diag.c ++++ b/drivers/infiniband/hw/ipath/ipath_diag.c +@@ -346,6 +346,10 @@ static ssize_t ipath_diagpkt_write(struct file *fp, + ret = -EFAULT; + goto bail; + } ++ dp.len = odp.len; ++ dp.unit = odp.unit; ++ dp.data = odp.data; ++ dp.pbc_wd = 0; + } else { + ret = -EINVAL; + goto bail; +diff --git a/drivers/infiniband/hw/qib/qib_mad.c b/drivers/infiniband/hw/qib/qib_mad.c +index ccb119143d20..1dd9fcbb7c9a 100644 +--- a/drivers/infiniband/hw/qib/qib_mad.c ++++ b/drivers/infiniband/hw/qib/qib_mad.c +@@ -1028,7 +1028,7 @@ static int set_pkeys(struct qib_devdata *dd, u8 port, u16 *pkeys) + + event.event = IB_EVENT_PKEY_CHANGE; + event.device = &dd->verbs_dev.ibdev; +- event.element.port_num = 1; ++ event.element.port_num = port; + ib_dispatch_event(&event); + } + return 0; +diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c +index 793ac5dcee71..1954daac0b59 100644 +--- a/drivers/infiniband/ulp/srp/ib_srp.c ++++ b/drivers/infiniband/ulp/srp/ib_srp.c +@@ -1409,6 +1409,12 @@ err_unmap: + err_iu: + srp_put_tx_iu(target, iu, SRP_IU_CMD); + ++ /* ++ * Avoid that the loops that iterate over the request ring can ++ * encounter a dangling SCSI command pointer. ++ */ ++ req->scmnd = NULL; ++ + spin_lock_irqsave(&target->lock, flags); + list_add(&req->list, &target->free_reqs); + +diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c +index 76f1d37ac0ff..1913301df08f 100644 +--- a/drivers/input/mouse/elantech.c ++++ b/drivers/input/mouse/elantech.c +@@ -473,8 +473,15 @@ static void elantech_report_absolute_v3(struct psmouse *psmouse, + input_report_key(dev, BTN_TOOL_FINGER, fingers == 1); + input_report_key(dev, BTN_TOOL_DOUBLETAP, fingers == 2); + input_report_key(dev, BTN_TOOL_TRIPLETAP, fingers == 3); +- input_report_key(dev, BTN_LEFT, packet[0] & 0x01); +- input_report_key(dev, BTN_RIGHT, packet[0] & 0x02); ++ ++ /* For clickpads map both buttons to BTN_LEFT */ ++ if (etd->fw_version & 0x001000) { ++ input_report_key(dev, BTN_LEFT, packet[0] & 0x03); ++ } else { ++ input_report_key(dev, BTN_LEFT, packet[0] & 0x01); ++ input_report_key(dev, BTN_RIGHT, packet[0] & 0x02); ++ } ++ + input_report_abs(dev, ABS_PRESSURE, pres); + input_report_abs(dev, ABS_TOOL_WIDTH, width); + +@@ -484,10 +491,17 @@ static void elantech_report_absolute_v3(struct psmouse *psmouse, + static void elantech_input_sync_v4(struct psmouse *psmouse) + { + struct input_dev *dev = psmouse->dev; ++ struct elantech_data *etd = psmouse->private; + unsigned char *packet = psmouse->packet; + +- input_report_key(dev, BTN_LEFT, packet[0] & 0x01); +- input_report_key(dev, BTN_RIGHT, packet[0] & 0x02); ++ /* For clickpads map both buttons to BTN_LEFT */ ++ if (etd->fw_version & 0x001000) { ++ input_report_key(dev, BTN_LEFT, packet[0] & 0x03); ++ } else { ++ input_report_key(dev, BTN_LEFT, packet[0] & 0x01); ++ input_report_key(dev, BTN_RIGHT, packet[0] & 0x02); ++ } ++ + input_mt_report_pointer_emulation(dev, true); + input_sync(dev); + } +@@ -805,7 +819,7 @@ static int elantech_set_absolute_mode(struct psmouse *psmouse) + if (etd->set_hw_resolution) + etd->reg_10 = 0x0b; + else +- etd->reg_10 = 0x03; ++ etd->reg_10 = 0x01; + + if (elantech_write_reg(psmouse, 0x10, etd->reg_10)) + rc = -1; +@@ -1306,7 +1320,8 @@ static int elantech_reconnect(struct psmouse *psmouse) + } + + /* +- * Some hw_version 3 models go into error state when we try to set bit 3 of r10 ++ * Some hw_version 3 models go into error state when we try to set ++ * bit 3 and/or bit 1 of r10. + */ + static const struct dmi_system_id no_hw_res_dmi_table[] = { + #if defined(CONFIG_DMI) && defined(CONFIG_X86) +diff --git a/drivers/misc/mei/hw-me.c b/drivers/misc/mei/hw-me.c +index 06311c5ada36..297cc10a26da 100644 +--- a/drivers/misc/mei/hw-me.c ++++ b/drivers/misc/mei/hw-me.c +@@ -164,6 +164,9 @@ static void mei_me_hw_reset_release(struct mei_device *dev) + hcsr |= H_IG; + hcsr &= ~H_RST; + mei_hcsr_set(hw, hcsr); ++ ++ /* complete this write before we set host ready on another CPU */ ++ mmiowb(); + } + /** + * mei_me_hw_reset - resets fw via mei csr register. +@@ -186,7 +189,19 @@ static void mei_me_hw_reset(struct mei_device *dev, bool intr_enable) + dev->recvd_hw_ready = false; + mei_me_reg_write(hw, H_CSR, hcsr); + +- if (dev->dev_state == MEI_DEV_POWER_DOWN) ++ /* ++ * Host reads the H_CSR once to ensure that the ++ * posted write to H_CSR completes. ++ */ ++ hcsr = mei_hcsr_read(hw); ++ ++ if ((hcsr & H_RST) == 0) ++ dev_warn(&dev->pdev->dev, "H_RST is not set = 0x%08X", hcsr); ++ ++ if ((hcsr & H_RDY) == H_RDY) ++ dev_warn(&dev->pdev->dev, "H_RDY is not cleared 0x%08X", hcsr); ++ ++ if (intr_enable == false) + mei_me_hw_reset_release(dev); + + dev_dbg(&dev->pdev->dev, "current HCSR = 0x%08x.\n", mei_hcsr_read(hw)); +@@ -202,6 +217,7 @@ static void mei_me_hw_reset(struct mei_device *dev, bool intr_enable) + static void mei_me_host_set_ready(struct mei_device *dev) + { + struct mei_me_hw *hw = to_me_hw(dev); ++ hw->host_hw_state = mei_hcsr_read(hw); + hw->host_hw_state |= H_IE | H_IG | H_RDY; + mei_hcsr_set(hw, hw->host_hw_state); + } +@@ -494,19 +510,15 @@ irqreturn_t mei_me_irq_thread_handler(int irq, void *dev_id) + /* check if we need to start the dev */ + if (!mei_host_is_ready(dev)) { + if (mei_hw_is_ready(dev)) { ++ mei_me_hw_reset_release(dev); + dev_dbg(&dev->pdev->dev, "we need to start the dev.\n"); + + dev->recvd_hw_ready = true; + wake_up_interruptible(&dev->wait_hw_ready); +- +- mutex_unlock(&dev->device_lock); +- return IRQ_HANDLED; + } else { +- dev_dbg(&dev->pdev->dev, "Reset Completed.\n"); +- mei_me_hw_reset_release(dev); +- mutex_unlock(&dev->device_lock); +- return IRQ_HANDLED; ++ dev_dbg(&dev->pdev->dev, "Spurious Interrupt\n"); + } ++ goto end; + } + /* check slots available for reading */ + slots = mei_count_full_read_slots(dev); +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index f30acaa84037..d6ceb2e45c59 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -3659,7 +3659,7 @@ int pci_set_vga_state(struct pci_dev *dev, bool decode, + u16 cmd; + int rc; + +- WARN_ON((flags & PCI_VGA_STATE_CHANGE_DECODES) & (command_bits & ~(PCI_COMMAND_IO|PCI_COMMAND_MEMORY))); ++ WARN_ON((flags & PCI_VGA_STATE_CHANGE_DECODES) && (command_bits & ~(PCI_COMMAND_IO|PCI_COMMAND_MEMORY))); + + /* ARCH specific VGA enables */ + rc = pci_set_vga_state_arch(dev, decode, command_bits, flags); +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index df4655c5c138..4510279e28dc 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -2930,6 +2930,7 @@ static void disable_igfx_irq(struct pci_dev *dev) + } + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0102, disable_igfx_irq); + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x010a, disable_igfx_irq); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0152, disable_igfx_irq); + + /* + * Some devices may pass our check in pci_intx_mask_supported if +diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c +index 72663ba228dc..799f84e686b5 100644 +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -1313,7 +1313,7 @@ iscsit_check_dataout_hdr(struct iscsi_conn *conn, unsigned char *buf, + if (cmd->data_direction != DMA_TO_DEVICE) { + pr_err("Command ITT: 0x%08x received DataOUT for a" + " NON-WRITE command.\n", cmd->init_task_tag); +- return iscsit_reject_cmd(cmd, ISCSI_REASON_PROTOCOL_ERROR, buf); ++ return iscsit_dump_data_payload(conn, payload_length, 1); + } + se_cmd = &cmd->se_cmd; + iscsit_mod_dataout_timer(cmd); +diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c +index 77dad2474c8c..c9790f6fdd89 100644 +--- a/drivers/target/iscsi/iscsi_target_util.c ++++ b/drivers/target/iscsi/iscsi_target_util.c +@@ -1288,6 +1288,8 @@ int iscsit_tx_login_rsp(struct iscsi_conn *conn, u8 status_class, u8 status_deta + login->login_failed = 1; + iscsit_collect_login_stats(conn, status_class, status_detail); + ++ memset(&login->rsp[0], 0, ISCSI_HDR_LEN); ++ + hdr = (struct iscsi_login_rsp *)&login->rsp[0]; + hdr->opcode = ISCSI_OP_LOGIN_RSP; + hdr->status_class = status_class; +diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c +index 8032917b6636..68398753eb82 100644 +--- a/drivers/target/target_core_device.c ++++ b/drivers/target/target_core_device.c +@@ -614,6 +614,7 @@ void core_dev_unexport( + dev->export_count--; + spin_unlock(&hba->device_lock); + ++ lun->lun_sep = NULL; + lun->lun_se_dev = NULL; + } + +diff --git a/drivers/watchdog/ath79_wdt.c b/drivers/watchdog/ath79_wdt.c +index 37cb09b27b63..c97a47ca8971 100644 +--- a/drivers/watchdog/ath79_wdt.c ++++ b/drivers/watchdog/ath79_wdt.c +@@ -20,6 +20,7 @@ + #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + + #include ++#include + #include + #include + #include +@@ -91,6 +92,15 @@ static inline void ath79_wdt_keepalive(void) + static inline void ath79_wdt_enable(void) + { + ath79_wdt_keepalive(); ++ ++ /* ++ * Updating the TIMER register requires a few microseconds ++ * on the AR934x SoCs at least. Use a small delay to ensure ++ * that the TIMER register is updated within the hardware ++ * before enabling the watchdog. ++ */ ++ udelay(2); ++ + ath79_wdt_wr(WDOG_REG_CTRL, WDOG_CTRL_ACTION_FCR); + /* flush write */ + ath79_wdt_rr(WDOG_REG_CTRL); +diff --git a/drivers/watchdog/sp805_wdt.c b/drivers/watchdog/sp805_wdt.c +index 8872642505c0..e42118213ba5 100644 +--- a/drivers/watchdog/sp805_wdt.c ++++ b/drivers/watchdog/sp805_wdt.c +@@ -60,7 +60,6 @@ + * @adev: amba device structure of wdt + * @status: current status of wdt + * @load_val: load value to be set for current timeout +- * @timeout: current programmed timeout + */ + struct sp805_wdt { + struct watchdog_device wdd; +@@ -69,7 +68,6 @@ struct sp805_wdt { + struct clk *clk; + struct amba_device *adev; + unsigned int load_val; +- unsigned int timeout; + }; + + static bool nowayout = WATCHDOG_NOWAYOUT; +@@ -99,7 +97,7 @@ static int wdt_setload(struct watchdog_device *wdd, unsigned int timeout) + spin_lock(&wdt->lock); + wdt->load_val = load; + /* roundup timeout to closest positive integer value */ +- wdt->timeout = div_u64((load + 1) * 2 + (rate / 2), rate); ++ wdd->timeout = div_u64((load + 1) * 2 + (rate / 2), rate); + spin_unlock(&wdt->lock); + + return 0; +diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c +index c1c7a9d78722..cd4b9073dd20 100644 +--- a/fs/nfs/inode.c ++++ b/fs/nfs/inode.c +@@ -1382,18 +1382,20 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr) + inode->i_version = fattr->change_attr; + } + } else if (server->caps & NFS_CAP_CHANGE_ATTR) +- invalid |= save_cache_validity; ++ nfsi->cache_validity |= save_cache_validity; + + if (fattr->valid & NFS_ATTR_FATTR_MTIME) { + memcpy(&inode->i_mtime, &fattr->mtime, sizeof(inode->i_mtime)); + } else if (server->caps & NFS_CAP_MTIME) +- invalid |= save_cache_validity & (NFS_INO_INVALID_ATTR ++ nfsi->cache_validity |= save_cache_validity & ++ (NFS_INO_INVALID_ATTR + | NFS_INO_REVAL_FORCED); + + if (fattr->valid & NFS_ATTR_FATTR_CTIME) { + memcpy(&inode->i_ctime, &fattr->ctime, sizeof(inode->i_ctime)); + } else if (server->caps & NFS_CAP_CTIME) +- invalid |= save_cache_validity & (NFS_INO_INVALID_ATTR ++ nfsi->cache_validity |= save_cache_validity & ++ (NFS_INO_INVALID_ATTR + | NFS_INO_REVAL_FORCED); + + /* Check if our cached file size is stale */ +@@ -1416,7 +1418,8 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr) + (long long)new_isize); + } + } else +- invalid |= save_cache_validity & (NFS_INO_INVALID_ATTR ++ nfsi->cache_validity |= save_cache_validity & ++ (NFS_INO_INVALID_ATTR + | NFS_INO_REVAL_PAGECACHE + | NFS_INO_REVAL_FORCED); + +@@ -1424,7 +1427,8 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr) + if (fattr->valid & NFS_ATTR_FATTR_ATIME) + memcpy(&inode->i_atime, &fattr->atime, sizeof(inode->i_atime)); + else if (server->caps & NFS_CAP_ATIME) +- invalid |= save_cache_validity & (NFS_INO_INVALID_ATIME ++ nfsi->cache_validity |= save_cache_validity & ++ (NFS_INO_INVALID_ATIME + | NFS_INO_REVAL_FORCED); + + if (fattr->valid & NFS_ATTR_FATTR_MODE) { +@@ -1435,7 +1439,8 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr) + invalid |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL; + } + } else if (server->caps & NFS_CAP_MODE) +- invalid |= save_cache_validity & (NFS_INO_INVALID_ATTR ++ nfsi->cache_validity |= save_cache_validity & ++ (NFS_INO_INVALID_ATTR + | NFS_INO_INVALID_ACCESS + | NFS_INO_INVALID_ACL + | NFS_INO_REVAL_FORCED); +@@ -1446,7 +1451,8 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr) + inode->i_uid = fattr->uid; + } + } else if (server->caps & NFS_CAP_OWNER) +- invalid |= save_cache_validity & (NFS_INO_INVALID_ATTR ++ nfsi->cache_validity |= save_cache_validity & ++ (NFS_INO_INVALID_ATTR + | NFS_INO_INVALID_ACCESS + | NFS_INO_INVALID_ACL + | NFS_INO_REVAL_FORCED); +@@ -1457,7 +1463,8 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr) + inode->i_gid = fattr->gid; + } + } else if (server->caps & NFS_CAP_OWNER_GROUP) +- invalid |= save_cache_validity & (NFS_INO_INVALID_ATTR ++ nfsi->cache_validity |= save_cache_validity & ++ (NFS_INO_INVALID_ATTR + | NFS_INO_INVALID_ACCESS + | NFS_INO_INVALID_ACL + | NFS_INO_REVAL_FORCED); +@@ -1470,7 +1477,8 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr) + set_nlink(inode, fattr->nlink); + } + } else if (server->caps & NFS_CAP_NLINK) +- invalid |= save_cache_validity & (NFS_INO_INVALID_ATTR ++ nfsi->cache_validity |= save_cache_validity & ++ (NFS_INO_INVALID_ATTR + | NFS_INO_REVAL_FORCED); + + if (fattr->valid & NFS_ATTR_FATTR_SPACE_USED) { +diff --git a/fs/nfs/nfs4filelayout.c b/fs/nfs/nfs4filelayout.c +index 22d10623f5ee..b039f7f26d95 100644 +--- a/fs/nfs/nfs4filelayout.c ++++ b/fs/nfs/nfs4filelayout.c +@@ -1300,7 +1300,7 @@ filelayout_alloc_layout_hdr(struct inode *inode, gfp_t gfp_flags) + struct nfs4_filelayout *flo; + + flo = kzalloc(sizeof(*flo), gfp_flags); +- return &flo->generic_hdr; ++ return flo != NULL ? &flo->generic_hdr : NULL; + } + + static void +diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c +index ae6a50b7a617..bdff771057d3 100644 +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -3608,7 +3608,7 @@ nfsd4_free_lock_stateid(struct nfs4_ol_stateid *stp) + * correspondance, and we have to delete the lockowner when we + * delete the lock stateid: + */ +- unhash_lockowner(lo); ++ release_lockowner(lo); + return nfs_ok; + } + +diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c +index 5188a38fef06..d4890a96421e 100644 +--- a/fs/nfsd/nfs4xdr.c ++++ b/fs/nfsd/nfs4xdr.c +@@ -2035,8 +2035,8 @@ nfsd4_encode_fattr(struct svc_fh *fhp, struct svc_export *exp, + err = vfs_getattr(&path, &stat); + if (err) + goto out_nfserr; +- if ((bmval0 & (FATTR4_WORD0_FILES_FREE | FATTR4_WORD0_FILES_TOTAL | +- FATTR4_WORD0_MAXNAME)) || ++ if ((bmval0 & (FATTR4_WORD0_FILES_AVAIL | FATTR4_WORD0_FILES_FREE | ++ FATTR4_WORD0_FILES_TOTAL | FATTR4_WORD0_MAXNAME)) || + (bmval1 & (FATTR4_WORD1_SPACE_AVAIL | FATTR4_WORD1_SPACE_FREE | + FATTR4_WORD1_SPACE_TOTAL))) { + err = vfs_statfs(&path, &statfs); +diff --git a/fs/nfsd/nfscache.c b/fs/nfsd/nfscache.c +index ec8d97ddc635..e5e4675b7e75 100644 +--- a/fs/nfsd/nfscache.c ++++ b/fs/nfsd/nfscache.c +@@ -129,13 +129,6 @@ nfsd_reply_cache_alloc(void) + } + + static void +-nfsd_reply_cache_unhash(struct svc_cacherep *rp) +-{ +- hlist_del_init(&rp->c_hash); +- list_del_init(&rp->c_lru); +-} +- +-static void + nfsd_reply_cache_free_locked(struct svc_cacherep *rp) + { + if (rp->c_type == RC_REPLBUFF && rp->c_replvec.iov_base) { +@@ -228,13 +221,6 @@ hash_refile(struct svc_cacherep *rp) + hlist_add_head(&rp->c_hash, cache_hash + hash_32(rp->c_xid, maskbits)); + } + +-static inline bool +-nfsd_cache_entry_expired(struct svc_cacherep *rp) +-{ +- return rp->c_state != RC_INPROG && +- time_after(jiffies, rp->c_timestamp + RC_EXPIRE); +-} +- + /* + * Walk the LRU list and prune off entries that are older than RC_EXPIRE. + * Also prune the oldest ones when the total exceeds the max number of entries. +@@ -245,8 +231,14 @@ prune_cache_entries(void) + struct svc_cacherep *rp, *tmp; + + list_for_each_entry_safe(rp, tmp, &lru_head, c_lru) { +- if (!nfsd_cache_entry_expired(rp) && +- num_drc_entries <= max_drc_entries) ++ /* ++ * Don't free entries attached to calls that are still ++ * in-progress, but do keep scanning the list. ++ */ ++ if (rp->c_state == RC_INPROG) ++ continue; ++ if (num_drc_entries <= max_drc_entries && ++ time_before(jiffies, rp->c_timestamp + RC_EXPIRE)) + break; + nfsd_reply_cache_free_locked(rp); + } +@@ -402,22 +394,8 @@ nfsd_cache_lookup(struct svc_rqst *rqstp) + + /* + * Since the common case is a cache miss followed by an insert, +- * preallocate an entry. First, try to reuse the first entry on the LRU +- * if it works, then go ahead and prune the LRU list. ++ * preallocate an entry. + */ +- spin_lock(&cache_lock); +- if (!list_empty(&lru_head)) { +- rp = list_first_entry(&lru_head, struct svc_cacherep, c_lru); +- if (nfsd_cache_entry_expired(rp) || +- num_drc_entries >= max_drc_entries) { +- nfsd_reply_cache_unhash(rp); +- prune_cache_entries(); +- goto search_cache; +- } +- } +- +- /* No expired ones available, allocate a new one. */ +- spin_unlock(&cache_lock); + rp = nfsd_reply_cache_alloc(); + spin_lock(&cache_lock); + if (likely(rp)) { +@@ -425,7 +403,9 @@ nfsd_cache_lookup(struct svc_rqst *rqstp) + drc_mem_usage += sizeof(*rp); + } + +-search_cache: ++ /* go ahead and prune the cache */ ++ prune_cache_entries(); ++ + found = nfsd_cache_search(rqstp, csum); + if (found) { + if (likely(rp)) +@@ -439,15 +419,6 @@ search_cache: + goto out; + } + +- /* +- * We're keeping the one we just allocated. Are we now over the +- * limit? Prune one off the tip of the LRU in trade for the one we +- * just allocated if so. +- */ +- if (num_drc_entries >= max_drc_entries) +- nfsd_reply_cache_free_locked(list_first_entry(&lru_head, +- struct svc_cacherep, c_lru)); +- + nfsdstats.rcmisses++; + rqstp->rq_cacherep = rp; + rp->c_state = RC_INPROG; +diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c +index f844533792ee..36166443bc45 100644 +--- a/fs/reiserfs/inode.c ++++ b/fs/reiserfs/inode.c +@@ -3211,8 +3211,14 @@ int reiserfs_setattr(struct dentry *dentry, struct iattr *attr) + attr->ia_size != i_size_read(inode)) { + error = inode_newsize_ok(inode, attr->ia_size); + if (!error) { ++ /* ++ * Could race against reiserfs_file_release ++ * if called from NFS, so take tailpack mutex. ++ */ ++ mutex_lock(&REISERFS_I(inode)->tailpack); + truncate_setsize(inode, attr->ia_size); +- reiserfs_vfs_truncate_file(inode); ++ reiserfs_truncate_file(inode, 1); ++ mutex_unlock(&REISERFS_I(inode)->tailpack); + } + } + +diff --git a/fs/ubifs/file.c b/fs/ubifs/file.c +index 14374530784c..881324c08430 100644 +--- a/fs/ubifs/file.c ++++ b/fs/ubifs/file.c +@@ -1524,8 +1524,7 @@ static int ubifs_vm_page_mkwrite(struct vm_area_struct *vma, + } + + wait_for_stable_page(page); +- unlock_page(page); +- return 0; ++ return VM_FAULT_LOCKED; + + out_unlock: + unlock_page(page); +diff --git a/fs/ubifs/shrinker.c b/fs/ubifs/shrinker.c +index 9e1d05666fed..e0a7a764a903 100644 +--- a/fs/ubifs/shrinker.c ++++ b/fs/ubifs/shrinker.c +@@ -128,7 +128,6 @@ static int shrink_tnc(struct ubifs_info *c, int nr, int age, int *contention) + freed = ubifs_destroy_tnc_subtree(znode); + atomic_long_sub(freed, &ubifs_clean_zn_cnt); + atomic_long_sub(freed, &c->clean_zn_cnt); +- ubifs_assert(atomic_long_read(&c->clean_zn_cnt) >= 0); + total_freed += freed; + znode = zprev; + } +diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h +index 2e99b8e08770..bb980ae6d9d3 100644 +--- a/include/linux/ptrace.h ++++ b/include/linux/ptrace.h +@@ -337,6 +337,9 @@ static inline void user_single_step_siginfo(struct task_struct *tsk, + * calling arch_ptrace_stop() when it would be superfluous. For example, + * if the thread has not been back to user mode since the last stop, the + * thread state might indicate that nothing needs to be done. ++ * ++ * This is guaranteed to be invoked once before a task stops for ptrace and ++ * may include arch-specific operations necessary prior to a ptrace stop. + */ + #define arch_ptrace_stop_needed(code, info) (0) + #endif +diff --git a/include/trace/syscall.h b/include/trace/syscall.h +index 84bc4197e736..0a5b4952aa30 100644 +--- a/include/trace/syscall.h ++++ b/include/trace/syscall.h +@@ -4,6 +4,7 @@ + #include + #include + #include ++#include + + #include + +@@ -31,4 +32,18 @@ struct syscall_metadata { + struct ftrace_event_call *exit_event; + }; + ++#if defined(CONFIG_TRACEPOINTS) && defined(CONFIG_HAVE_SYSCALL_TRACEPOINTS) ++static inline void syscall_tracepoint_update(struct task_struct *p) ++{ ++ if (test_thread_flag(TIF_SYSCALL_TRACEPOINT)) ++ set_tsk_thread_flag(p, TIF_SYSCALL_TRACEPOINT); ++ else ++ clear_tsk_thread_flag(p, TIF_SYSCALL_TRACEPOINT); ++} ++#else ++static inline void syscall_tracepoint_update(struct task_struct *p) ++{ ++} ++#endif ++ + #endif /* _TRACE_SYSCALL_H */ +diff --git a/kernel/fork.c b/kernel/fork.c +index 270c1dab674a..814363a69b80 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -1479,7 +1479,9 @@ static struct task_struct *copy_process(unsigned long clone_flags, + + total_forks++; + spin_unlock(¤t->sighand->siglock); ++ syscall_tracepoint_update(p); + write_unlock_irq(&tasklist_lock); ++ + proc_fork_connector(p); + cgroup_post_fork(p); + if (clone_flags & CLONE_THREAD) +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 6dbdf277c8fe..60f49637b4d5 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -1400,12 +1400,12 @@ static void tracing_stop_tr(struct trace_array *tr) + + void trace_stop_cmdline_recording(void); + +-static void trace_save_cmdline(struct task_struct *tsk) ++static int trace_save_cmdline(struct task_struct *tsk) + { + unsigned pid, idx; + + if (!tsk->pid || unlikely(tsk->pid > PID_MAX_DEFAULT)) +- return; ++ return 0; + + /* + * It's not the end of the world if we don't get +@@ -1414,7 +1414,7 @@ static void trace_save_cmdline(struct task_struct *tsk) + * so if we miss here, then better luck next time. + */ + if (!arch_spin_trylock(&trace_cmdline_lock)) +- return; ++ return 0; + + idx = map_pid_to_cmdline[tsk->pid]; + if (idx == NO_CMDLINE_MAP) { +@@ -1439,6 +1439,8 @@ static void trace_save_cmdline(struct task_struct *tsk) + memcpy(&saved_cmdlines[idx], tsk->comm, TASK_COMM_LEN); + + arch_spin_unlock(&trace_cmdline_lock); ++ ++ return 1; + } + + void trace_find_cmdline(int pid, char comm[]) +@@ -1480,9 +1482,8 @@ void tracing_record_cmdline(struct task_struct *tsk) + if (!__this_cpu_read(trace_cmdline_save)) + return; + +- __this_cpu_write(trace_cmdline_save, false); +- +- trace_save_cmdline(tsk); ++ if (trace_save_cmdline(tsk)) ++ __this_cpu_write(trace_cmdline_save, false); + } + + void +diff --git a/net/ipv4/netfilter/ipt_ULOG.c b/net/ipv4/netfilter/ipt_ULOG.c +index 32b0e978c8e0..f8629c04f35b 100644 +--- a/net/ipv4/netfilter/ipt_ULOG.c ++++ b/net/ipv4/netfilter/ipt_ULOG.c +@@ -220,6 +220,7 @@ static void ipt_ulog_packet(struct net *net, + ub->qlen++; + + pm = nlmsg_data(nlh); ++ memset(pm, 0, sizeof(*pm)); + + /* We might not have a timestamp, get one */ + if (skb->tstamp.tv64 == 0) +@@ -238,8 +239,6 @@ static void ipt_ulog_packet(struct net *net, + } + else if (loginfo->prefix[0] != '\0') + strncpy(pm->prefix, loginfo->prefix, sizeof(pm->prefix)); +- else +- *(pm->prefix) = '\0'; + + if (in && in->hard_header_len > 0 && + skb->mac_header != skb->network_header && +@@ -251,13 +250,9 @@ static void ipt_ulog_packet(struct net *net, + + if (in) + strncpy(pm->indev_name, in->name, sizeof(pm->indev_name)); +- else +- pm->indev_name[0] = '\0'; + + if (out) + strncpy(pm->outdev_name, out->name, sizeof(pm->outdev_name)); +- else +- pm->outdev_name[0] = '\0'; + + /* copy_len <= skb->len, so can't fail. */ + if (skb_copy_bits(skb, 0, pm->payload, copy_len) < 0) +diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c +index 21a3a475d7cd..663042e84e81 100644 +--- a/net/netfilter/ipvs/ip_vs_core.c ++++ b/net/netfilter/ipvs/ip_vs_core.c +@@ -1384,15 +1384,19 @@ ip_vs_in_icmp(struct sk_buff *skb, int *related, unsigned int hooknum) + + if (ipip) { + __be32 info = ic->un.gateway; ++ __u8 type = ic->type; ++ __u8 code = ic->code; + + /* Update the MTU */ + if (ic->type == ICMP_DEST_UNREACH && + ic->code == ICMP_FRAG_NEEDED) { + struct ip_vs_dest *dest = cp->dest; + u32 mtu = ntohs(ic->un.frag.mtu); ++ __be16 frag_off = cih->frag_off; + + /* Strip outer IP and ICMP, go to IPIP header */ +- __skb_pull(skb, ihl + sizeof(_icmph)); ++ if (pskb_pull(skb, ihl + sizeof(_icmph)) == NULL) ++ goto ignore_ipip; + offset2 -= ihl + sizeof(_icmph); + skb_reset_network_header(skb); + IP_VS_DBG(12, "ICMP for IPIP %pI4->%pI4: mtu=%u\n", +@@ -1400,7 +1404,7 @@ ip_vs_in_icmp(struct sk_buff *skb, int *related, unsigned int hooknum) + ipv4_update_pmtu(skb, dev_net(skb->dev), + mtu, 0, 0, 0, 0); + /* Client uses PMTUD? */ +- if (!(cih->frag_off & htons(IP_DF))) ++ if (!(frag_off & htons(IP_DF))) + goto ignore_ipip; + /* Prefer the resulting PMTU */ + if (dest) { +@@ -1419,12 +1423,13 @@ ip_vs_in_icmp(struct sk_buff *skb, int *related, unsigned int hooknum) + /* Strip outer IP, ICMP and IPIP, go to IP header of + * original request. + */ +- __skb_pull(skb, offset2); ++ if (pskb_pull(skb, offset2) == NULL) ++ goto ignore_ipip; + skb_reset_network_header(skb); + IP_VS_DBG(12, "Sending ICMP for %pI4->%pI4: t=%u, c=%u, i=%u\n", + &ip_hdr(skb)->saddr, &ip_hdr(skb)->daddr, +- ic->type, ic->code, ntohl(info)); +- icmp_send(skb, ic->type, ic->code, info); ++ type, code, ntohl(info)); ++ icmp_send(skb, type, code, info); + /* ICMP can be shorter but anyways, account it */ + ip_vs_out_stats(cp, skb); + +diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c +index 80a6640f329b..b9aad4723a9d 100644 +--- a/net/sunrpc/svc_xprt.c ++++ b/net/sunrpc/svc_xprt.c +@@ -730,6 +730,8 @@ static int svc_handle_xprt(struct svc_rqst *rqstp, struct svc_xprt *xprt) + newxpt = xprt->xpt_ops->xpo_accept(xprt); + if (newxpt) + svc_add_new_temp_xprt(serv, newxpt); ++ else ++ module_put(xprt->xpt_class->xcl_owner); + } else if (xprt->xpt_ops->xpo_has_wspace(xprt)) { + /* XPT_DATA|XPT_DEFERRED case: */ + dprintk("svc: server %p, pool %u, transport %p, inuse=%d\n", +diff --git a/scripts/recordmcount.h b/scripts/recordmcount.h +index 9d1421e63ff8..49b582a225b0 100644 +--- a/scripts/recordmcount.h ++++ b/scripts/recordmcount.h +@@ -163,11 +163,11 @@ static int mcount_adjust = 0; + + static int MIPS_is_fake_mcount(Elf_Rel const *rp) + { +- static Elf_Addr old_r_offset; ++ static Elf_Addr old_r_offset = ~(Elf_Addr)0; + Elf_Addr current_r_offset = _w(rp->r_offset); + int is_fake; + +- is_fake = old_r_offset && ++ is_fake = (old_r_offset != ~(Elf_Addr)0) && + (current_r_offset - old_r_offset == MIPS_FAKEMCOUNT_OFFSET); + old_r_offset = current_r_offset; + diff --git a/projects/Cuboxi/patches/linux/linux-000-patch-3.10.47-48.patch b/projects/Cuboxi/patches/linux/linux-000-patch-3.10.47-48.patch new file mode 100644 index 0000000000..1da735f08f --- /dev/null +++ b/projects/Cuboxi/patches/linux/linux-000-patch-3.10.47-48.patch @@ -0,0 +1,1525 @@ +diff --git a/Makefile b/Makefile +index 6a3b46d1863c..f7e5680740f9 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 10 +-SUBLEVEL = 47 ++SUBLEVEL = 48 + EXTRAVERSION = + NAME = TOSSUG Baby Fish + +diff --git a/arch/arm/mach-omap2/mux.c b/arch/arm/mach-omap2/mux.c +index f82cf878d6af..94c2f6d17dae 100644 +--- a/arch/arm/mach-omap2/mux.c ++++ b/arch/arm/mach-omap2/mux.c +@@ -183,8 +183,10 @@ static int __init _omap_mux_get_by_name(struct omap_mux_partition *partition, + m0_entry = mux->muxnames[0]; + + /* First check for full name in mode0.muxmode format */ +- if (mode0_len && strncmp(muxname, m0_entry, mode0_len)) +- continue; ++ if (mode0_len) ++ if (strncmp(muxname, m0_entry, mode0_len) || ++ (strlen(m0_entry) != mode0_len)) ++ continue; + + /* Then check for muxmode only */ + for (i = 0; i < OMAP_MUX_NR_MODES; i++) { +diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S +index 6ad781b21c08..7cd589ebca2a 100644 +--- a/arch/arm64/kernel/entry.S ++++ b/arch/arm64/kernel/entry.S +@@ -275,7 +275,6 @@ el1_sp_pc: + * Stack or PC alignment exception handling + */ + mrs x0, far_el1 +- mov x1, x25 + mov x2, sp + b do_sp_pc_abort + el1_undef: +diff --git a/arch/unicore32/mm/alignment.c b/arch/unicore32/mm/alignment.c +index de7dc5fdd58b..24e836023e6c 100644 +--- a/arch/unicore32/mm/alignment.c ++++ b/arch/unicore32/mm/alignment.c +@@ -21,6 +21,7 @@ + #include + #include + ++#include + #include + #include + +diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h +index 3741c653767c..8b320722de7a 100644 +--- a/arch/x86/include/asm/kvm_host.h ++++ b/arch/x86/include/asm/kvm_host.h +@@ -92,7 +92,7 @@ + #define KVM_REFILL_PAGES 25 + #define KVM_MAX_CPUID_ENTRIES 80 + #define KVM_NR_FIXED_MTRR_REGION 88 +-#define KVM_NR_VAR_MTRR 8 ++#define KVM_NR_VAR_MTRR 10 + + #define ASYNC_PF_PER_VCPU 64 + +@@ -445,7 +445,7 @@ struct kvm_vcpu_arch { + bool nmi_injected; /* Trying to inject an NMI this entry */ + + struct mtrr_state_type mtrr_state; +- u32 pat; ++ u64 pat; + + int switch_db_regs; + unsigned long db[KVM_NR_DB_REGS]; +diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c +index 1e89a3dd3d51..07caf44d5755 100644 +--- a/drivers/block/rbd.c ++++ b/drivers/block/rbd.c +@@ -1385,6 +1385,14 @@ static bool obj_request_exists_test(struct rbd_obj_request *obj_request) + return test_bit(OBJ_REQ_EXISTS, &obj_request->flags) != 0; + } + ++static bool obj_request_overlaps_parent(struct rbd_obj_request *obj_request) ++{ ++ struct rbd_device *rbd_dev = obj_request->img_request->rbd_dev; ++ ++ return obj_request->img_offset < ++ round_up(rbd_dev->parent_overlap, rbd_obj_bytes(&rbd_dev->header)); ++} ++ + static void rbd_obj_request_get(struct rbd_obj_request *obj_request) + { + dout("%s: obj %p (was %d)\n", __func__, obj_request, +@@ -1401,6 +1409,13 @@ static void rbd_obj_request_put(struct rbd_obj_request *obj_request) + kref_put(&obj_request->kref, rbd_obj_request_destroy); + } + ++static void rbd_img_request_get(struct rbd_img_request *img_request) ++{ ++ dout("%s: img %p (was %d)\n", __func__, img_request, ++ atomic_read(&img_request->kref.refcount)); ++ kref_get(&img_request->kref); ++} ++ + static bool img_request_child_test(struct rbd_img_request *img_request); + static void rbd_parent_request_destroy(struct kref *kref); + static void rbd_img_request_destroy(struct kref *kref); +@@ -2154,6 +2169,7 @@ static void rbd_img_obj_callback(struct rbd_obj_request *obj_request) + img_request->next_completion = which; + out: + spin_unlock_irq(&img_request->completion_lock); ++ rbd_img_request_put(img_request); + + if (!more) + rbd_img_request_complete(img_request); +@@ -2250,6 +2266,7 @@ static int rbd_img_request_fill(struct rbd_img_request *img_request, + goto out_partial; + obj_request->osd_req = osd_req; + obj_request->callback = rbd_img_obj_callback; ++ rbd_img_request_get(img_request); + + osd_req_op_extent_init(osd_req, 0, opcode, offset, length, + 0, 0); +@@ -2673,7 +2690,7 @@ static int rbd_img_obj_request_submit(struct rbd_obj_request *obj_request) + */ + if (!img_request_write_test(img_request) || + !img_request_layered_test(img_request) || +- rbd_dev->parent_overlap <= obj_request->img_offset || ++ !obj_request_overlaps_parent(obj_request) || + ((known = obj_request_known_test(obj_request)) && + obj_request_exists_test(obj_request))) { + +diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c +index a56d0199e334..971dd8795b68 100644 +--- a/drivers/gpu/drm/radeon/atombios_crtc.c ++++ b/drivers/gpu/drm/radeon/atombios_crtc.c +@@ -839,14 +839,16 @@ static void atombios_crtc_program_pll(struct drm_crtc *crtc, + args.v5.ucMiscInfo = 0; /* HDMI depth, etc. */ + if (ss_enabled && (ss->type & ATOM_EXTERNAL_SS_MASK)) + args.v5.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_REF_DIV_SRC; +- switch (bpc) { +- case 8: +- default: +- args.v5.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_HDMI_24BPP; +- break; +- case 10: +- args.v5.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_HDMI_30BPP; +- break; ++ if (encoder_mode == ATOM_ENCODER_MODE_HDMI) { ++ switch (bpc) { ++ case 8: ++ default: ++ args.v5.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_HDMI_24BPP; ++ break; ++ case 10: ++ args.v5.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_HDMI_30BPP; ++ break; ++ } + } + args.v5.ucTransmitterID = encoder_id; + args.v5.ucEncoderMode = encoder_mode; +@@ -861,20 +863,22 @@ static void atombios_crtc_program_pll(struct drm_crtc *crtc, + args.v6.ucMiscInfo = 0; /* HDMI depth, etc. */ + if (ss_enabled && (ss->type & ATOM_EXTERNAL_SS_MASK)) + args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_REF_DIV_SRC; +- switch (bpc) { +- case 8: +- default: +- args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_24BPP; +- break; +- case 10: +- args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_30BPP; +- break; +- case 12: +- args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_36BPP; +- break; +- case 16: +- args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_48BPP; +- break; ++ if (encoder_mode == ATOM_ENCODER_MODE_HDMI) { ++ switch (bpc) { ++ case 8: ++ default: ++ args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_24BPP; ++ break; ++ case 10: ++ args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_30BPP; ++ break; ++ case 12: ++ args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_36BPP; ++ break; ++ case 16: ++ args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_48BPP; ++ break; ++ } + } + args.v6.ucTransmitterID = encoder_id; + args.v6.ucEncoderMode = encoder_mode; +diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c +index 16023986d301..4c05f2b015cf 100644 +--- a/drivers/gpu/drm/radeon/atombios_dp.c ++++ b/drivers/gpu/drm/radeon/atombios_dp.c +@@ -384,6 +384,19 @@ static int dp_get_max_dp_pix_clock(int link_rate, + + /***** radeon specific DP functions *****/ + ++static int radeon_dp_get_max_link_rate(struct drm_connector *connector, ++ u8 dpcd[DP_DPCD_SIZE]) ++{ ++ int max_link_rate; ++ ++ if (radeon_connector_is_dp12_capable(connector)) ++ max_link_rate = min(drm_dp_max_link_rate(dpcd), 540000); ++ else ++ max_link_rate = min(drm_dp_max_link_rate(dpcd), 270000); ++ ++ return max_link_rate; ++} ++ + /* First get the min lane# when low rate is used according to pixel clock + * (prefer low rate), second check max lane# supported by DP panel, + * if the max lane# < low rate lane# then use max lane# instead. +@@ -393,7 +406,7 @@ static int radeon_dp_get_dp_lane_number(struct drm_connector *connector, + int pix_clock) + { + int bpp = convert_bpc_to_bpp(radeon_get_monitor_bpc(connector)); +- int max_link_rate = drm_dp_max_link_rate(dpcd); ++ int max_link_rate = radeon_dp_get_max_link_rate(connector, dpcd); + int max_lane_num = drm_dp_max_lane_count(dpcd); + int lane_num; + int max_dp_pix_clock; +@@ -431,7 +444,7 @@ static int radeon_dp_get_dp_link_clock(struct drm_connector *connector, + return 540000; + } + +- return drm_dp_max_link_rate(dpcd); ++ return radeon_dp_get_max_link_rate(connector, dpcd); + } + + static u8 radeon_dp_encoder_service(struct radeon_device *rdev, +diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c +index 1f7f3ce875c8..5802d7486354 100644 +--- a/drivers/gpu/drm/radeon/atombios_encoders.c ++++ b/drivers/gpu/drm/radeon/atombios_encoders.c +@@ -1877,8 +1877,11 @@ atombios_set_encoder_crtc_source(struct drm_encoder *encoder) + args.v2.ucEncodeMode = ATOM_ENCODER_MODE_CRT; + else + args.v2.ucEncodeMode = atombios_get_encoder_mode(encoder); +- } else ++ } else if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT)) { ++ args.v2.ucEncodeMode = ATOM_ENCODER_MODE_LVDS; ++ } else { + args.v2.ucEncodeMode = atombios_get_encoder_mode(encoder); ++ } + switch (radeon_encoder->encoder_id) { + case ENCODER_OBJECT_ID_INTERNAL_UNIPHY: + case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1: +diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c +index 5a87c9fc78d3..fc604fc75797 100644 +--- a/drivers/gpu/drm/radeon/radeon_connectors.c ++++ b/drivers/gpu/drm/radeon/radeon_connectors.c +@@ -1345,7 +1345,7 @@ bool radeon_connector_is_dp12_capable(struct drm_connector *connector) + struct radeon_device *rdev = dev->dev_private; + + if (ASIC_IS_DCE5(rdev) && +- (rdev->clock.dp_extclk >= 53900) && ++ (rdev->clock.default_dispclk >= 53900) && + radeon_connector_encoder_is_hbr2(connector)) { + return true; + } +diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c +index fe36f1d9496d..60af3cda587b 100644 +--- a/drivers/gpu/drm/radeon/radeon_cs.c ++++ b/drivers/gpu/drm/radeon/radeon_cs.c +@@ -96,6 +96,12 @@ static int radeon_cs_parser_relocs(struct radeon_cs_parser *p) + uint32_t domain = r->write_domain ? + r->write_domain : r->read_domains; + ++ if (domain & RADEON_GEM_DOMAIN_CPU) { ++ DRM_ERROR("RADEON_GEM_DOMAIN_CPU is not valid " ++ "for command submission\n"); ++ return -EINVAL; ++ } ++ + p->relocs[i].lobj.domain = domain; + if (domain == RADEON_GEM_DOMAIN_VRAM) + domain |= RADEON_GEM_DOMAIN_GTT; +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c +index 021b5227e783..1b0f34bd3a03 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c +@@ -179,7 +179,6 @@ static int vmw_fb_set_par(struct fb_info *info) + vmw_write(vmw_priv, SVGA_REG_DISPLAY_POSITION_Y, info->var.yoffset); + vmw_write(vmw_priv, SVGA_REG_DISPLAY_WIDTH, info->var.xres); + vmw_write(vmw_priv, SVGA_REG_DISPLAY_HEIGHT, info->var.yres); +- vmw_write(vmw_priv, SVGA_REG_BYTES_PER_LINE, info->fix.line_length); + vmw_write(vmw_priv, SVGA_REG_DISPLAY_ID, SVGA_ID_INVALID); + } + +diff --git a/drivers/hwmon/ina2xx.c b/drivers/hwmon/ina2xx.c +index 4958b2f89dce..371c1ee233b7 100644 +--- a/drivers/hwmon/ina2xx.c ++++ b/drivers/hwmon/ina2xx.c +@@ -147,7 +147,8 @@ static int ina2xx_get_value(struct ina2xx_data *data, u8 reg) + + switch (reg) { + case INA2XX_SHUNT_VOLTAGE: +- val = DIV_ROUND_CLOSEST(data->regs[reg], ++ /* signed register */ ++ val = DIV_ROUND_CLOSEST((s16)data->regs[reg], + data->config->shunt_div); + break; + case INA2XX_BUS_VOLTAGE: +@@ -159,8 +160,8 @@ static int ina2xx_get_value(struct ina2xx_data *data, u8 reg) + val = data->regs[reg] * data->config->power_lsb; + break; + case INA2XX_CURRENT: +- /* LSB=1mA (selected). Is in mA */ +- val = data->regs[reg]; ++ /* signed register, LSB=1mA (selected), in mA */ ++ val = (s16)data->regs[reg]; + break; + default: + /* programmer goofed */ +diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c +index 0cf5f8e06cfc..1e8e94d4db7d 100644 +--- a/drivers/iio/inkern.c ++++ b/drivers/iio/inkern.c +@@ -183,7 +183,7 @@ static struct iio_channel *of_iio_channel_get_by_name(struct device_node *np, + else if (name && index >= 0) { + pr_err("ERROR: could not get IIO channel %s:%s(%i)\n", + np->full_name, name ? name : "", index); +- return chan; ++ return NULL; + } + + /* +@@ -193,8 +193,9 @@ static struct iio_channel *of_iio_channel_get_by_name(struct device_node *np, + */ + np = np->parent; + if (np && !of_get_property(np, "io-channel-ranges", NULL)) +- break; ++ return NULL; + } ++ + return chan; + } + +@@ -317,6 +318,7 @@ struct iio_channel *iio_channel_get(struct device *dev, + if (channel != NULL) + return channel; + } ++ + return iio_channel_get_sys(name, channel_name); + } + EXPORT_SYMBOL_GPL(iio_channel_get); +diff --git a/drivers/irqchip/spear-shirq.c b/drivers/irqchip/spear-shirq.c +index 8527743b5cef..391b9cea73ed 100644 +--- a/drivers/irqchip/spear-shirq.c ++++ b/drivers/irqchip/spear-shirq.c +@@ -125,7 +125,7 @@ static struct spear_shirq spear320_shirq_ras2 = { + }; + + static struct spear_shirq spear320_shirq_ras3 = { +- .irq_nr = 3, ++ .irq_nr = 7, + .irq_bit_off = 0, + .invalid_irq = 1, + .regs = { +diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c +index 7d0ac0a6e724..86a2a5e3b26b 100644 +--- a/drivers/md/dm-thin.c ++++ b/drivers/md/dm-thin.c +@@ -2647,7 +2647,8 @@ static void set_discard_limits(struct pool_c *pt, struct queue_limits *limits) + */ + if (pt->adjusted_pf.discard_passdown) { + data_limits = &bdev_get_queue(pt->data_dev->bdev)->limits; +- limits->discard_granularity = data_limits->discard_granularity; ++ limits->discard_granularity = max(data_limits->discard_granularity, ++ pool->sectors_per_block << SECTOR_SHIFT); + } else + limits->discard_granularity = pool->sectors_per_block << SECTOR_SHIFT; + } +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 963fa59be9b3..aaf77b07bb72 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -7447,6 +7447,19 @@ void md_do_sync(struct md_thread *thread) + rdev->recovery_offset < j) + j = rdev->recovery_offset; + rcu_read_unlock(); ++ ++ /* If there is a bitmap, we need to make sure all ++ * writes that started before we added a spare ++ * complete before we start doing a recovery. ++ * Otherwise the write might complete and (via ++ * bitmap_endwrite) set a bit in the bitmap after the ++ * recovery has checked that bit and skipped that ++ * region. ++ */ ++ if (mddev->bitmap) { ++ mddev->pers->quiesce(mddev, 1); ++ mddev->pers->quiesce(mddev, 0); ++ } + } + + printk(KERN_INFO "md: %s of RAID array %s\n", desc, mdname(mddev)); +diff --git a/drivers/mmc/host/rtsx_pci_sdmmc.c b/drivers/mmc/host/rtsx_pci_sdmmc.c +index ad13f4240c49..7ffb5cba30a9 100644 +--- a/drivers/mmc/host/rtsx_pci_sdmmc.c ++++ b/drivers/mmc/host/rtsx_pci_sdmmc.c +@@ -247,6 +247,9 @@ static void sd_send_cmd_get_rsp(struct realtek_pci_sdmmc *host, + case MMC_RSP_R1: + rsp_type = SD_RSP_TYPE_R1; + break; ++ case MMC_RSP_R1 & ~MMC_RSP_CRC: ++ rsp_type = SD_RSP_TYPE_R1 | SD_NO_CHECK_CRC7; ++ break; + case MMC_RSP_R1B: + rsp_type = SD_RSP_TYPE_R1b; + break; +diff --git a/drivers/mtd/nand/fsl_elbc_nand.c b/drivers/mtd/nand/fsl_elbc_nand.c +index 20657209a472..c31d183820c5 100644 +--- a/drivers/mtd/nand/fsl_elbc_nand.c ++++ b/drivers/mtd/nand/fsl_elbc_nand.c +@@ -725,6 +725,19 @@ static int fsl_elbc_write_page(struct mtd_info *mtd, struct nand_chip *chip, + return 0; + } + ++/* ECC will be calculated automatically, and errors will be detected in ++ * waitfunc. ++ */ ++static int fsl_elbc_write_subpage(struct mtd_info *mtd, struct nand_chip *chip, ++ uint32_t offset, uint32_t data_len, ++ const uint8_t *buf, int oob_required) ++{ ++ fsl_elbc_write_buf(mtd, buf, mtd->writesize); ++ fsl_elbc_write_buf(mtd, chip->oob_poi, mtd->oobsize); ++ ++ return 0; ++} ++ + static int fsl_elbc_chip_init(struct fsl_elbc_mtd *priv) + { + struct fsl_lbc_ctrl *ctrl = priv->ctrl; +@@ -763,6 +776,7 @@ static int fsl_elbc_chip_init(struct fsl_elbc_mtd *priv) + + chip->ecc.read_page = fsl_elbc_read_page; + chip->ecc.write_page = fsl_elbc_write_page; ++ chip->ecc.write_subpage = fsl_elbc_write_subpage; + + /* If CS Base Register selects full hardware ECC then use it */ + if ((in_be32(&lbc->bank[priv->bank].br) & BR_DECC) == +diff --git a/drivers/mtd/nand/omap2.c b/drivers/mtd/nand/omap2.c +index 81b80af55872..8c4eb287bbdb 100644 +--- a/drivers/mtd/nand/omap2.c ++++ b/drivers/mtd/nand/omap2.c +@@ -1463,7 +1463,7 @@ static int omap_elm_correct_data(struct mtd_info *mtd, u_char *data, + + /* Check if any error reported */ + if (!is_error_reported) +- return 0; ++ return stat; + + /* Decode BCH error using ELM module */ + elm_decode_bch_error_page(info->elm_dev, ecc_vec, err_vec); +diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c +index e85d34b76039..ebcce00ce067 100644 +--- a/drivers/net/wireless/b43/xmit.c ++++ b/drivers/net/wireless/b43/xmit.c +@@ -810,9 +810,13 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr) + break; + case B43_PHYTYPE_G: + status.band = IEEE80211_BAND_2GHZ; +- /* chanid is the radio channel cookie value as used +- * to tune the radio. */ +- status.freq = chanid + 2400; ++ /* Somewhere between 478.104 and 508.1084 firmware for G-PHY ++ * has been modified to be compatible with N-PHY and others. ++ */ ++ if (dev->fw.rev >= 508) ++ status.freq = ieee80211_channel_to_frequency(chanid, status.band); ++ else ++ status.freq = chanid + 2400; + break; + case B43_PHYTYPE_N: + case B43_PHYTYPE_LP: +diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c +index 4088dd5e9244..ff04135d37af 100644 +--- a/drivers/net/wireless/iwlwifi/pcie/trans.c ++++ b/drivers/net/wireless/iwlwifi/pcie/trans.c +@@ -339,6 +339,7 @@ static int iwl_pcie_prepare_card_hw(struct iwl_trans *trans) + { + int ret; + int t = 0; ++ int iter; + + IWL_DEBUG_INFO(trans, "iwl_trans_prepare_card_hw enter\n"); + +@@ -347,18 +348,23 @@ static int iwl_pcie_prepare_card_hw(struct iwl_trans *trans) + if (ret >= 0) + return 0; + +- /* If HW is not ready, prepare the conditions to check again */ +- iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG, +- CSR_HW_IF_CONFIG_REG_PREPARE); ++ for (iter = 0; iter < 10; iter++) { ++ /* If HW is not ready, prepare the conditions to check again */ ++ iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG, ++ CSR_HW_IF_CONFIG_REG_PREPARE); ++ ++ do { ++ ret = iwl_pcie_set_hw_ready(trans); ++ if (ret >= 0) ++ return 0; + +- do { +- ret = iwl_pcie_set_hw_ready(trans); +- if (ret >= 0) +- return 0; ++ usleep_range(200, 1000); ++ t += 200; ++ } while (t < 150000); ++ msleep(25); ++ } + +- usleep_range(200, 1000); +- t += 200; +- } while (t < 150000); ++ IWL_DEBUG_INFO(trans, "got NIC after %d iterations\n", iter); + + return ret; + } +diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c +index 77e45b223d15..d582febbfba2 100644 +--- a/drivers/net/wireless/rt2x00/rt2500pci.c ++++ b/drivers/net/wireless/rt2x00/rt2500pci.c +@@ -1684,8 +1684,13 @@ static int rt2500pci_init_eeprom(struct rt2x00_dev *rt2x00dev) + /* + * Detect if this device has an hardware controlled radio. + */ +- if (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_HARDWARE_RADIO)) ++ if (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_HARDWARE_RADIO)) { + __set_bit(CAPABILITY_HW_BUTTON, &rt2x00dev->cap_flags); ++ /* ++ * On this device RFKILL initialized during probe does not work. ++ */ ++ __set_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags); ++ } + + /* + * Check if the BBP tuning should be enabled. +diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h +index 7510723a8c37..1e716ff0f19e 100644 +--- a/drivers/net/wireless/rt2x00/rt2x00.h ++++ b/drivers/net/wireless/rt2x00/rt2x00.h +@@ -708,6 +708,7 @@ enum rt2x00_capability_flags { + REQUIRE_SW_SEQNO, + REQUIRE_HT_TX_DESC, + REQUIRE_PS_AUTOWAKE, ++ REQUIRE_DELAYED_RFKILL, + + /* + * Capabilities +diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c +index a2889d1cfe37..e22942bc2bb1 100644 +--- a/drivers/net/wireless/rt2x00/rt2x00dev.c ++++ b/drivers/net/wireless/rt2x00/rt2x00dev.c +@@ -1128,9 +1128,10 @@ static void rt2x00lib_uninitialize(struct rt2x00_dev *rt2x00dev) + return; + + /* +- * Unregister extra components. ++ * Stop rfkill polling. + */ +- rt2x00rfkill_unregister(rt2x00dev); ++ if (test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags)) ++ rt2x00rfkill_unregister(rt2x00dev); + + /* + * Allow the HW to uninitialize. +@@ -1168,6 +1169,12 @@ static int rt2x00lib_initialize(struct rt2x00_dev *rt2x00dev) + + set_bit(DEVICE_STATE_INITIALIZED, &rt2x00dev->flags); + ++ /* ++ * Start rfkill polling. ++ */ ++ if (test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags)) ++ rt2x00rfkill_register(rt2x00dev); ++ + return 0; + } + +@@ -1363,7 +1370,12 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev) + rt2x00link_register(rt2x00dev); + rt2x00leds_register(rt2x00dev); + rt2x00debug_register(rt2x00dev); +- rt2x00rfkill_register(rt2x00dev); ++ ++ /* ++ * Start rfkill polling. ++ */ ++ if (!test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags)) ++ rt2x00rfkill_register(rt2x00dev); + + return 0; + +@@ -1379,6 +1391,12 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev) + clear_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags); + + /* ++ * Stop rfkill polling. ++ */ ++ if (!test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags)) ++ rt2x00rfkill_unregister(rt2x00dev); ++ ++ /* + * Disable radio. + */ + rt2x00lib_disable_radio(rt2x00dev); +diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c +index 2b724fc4e306..c03748dafd49 100644 +--- a/drivers/net/wireless/rt2x00/rt2x00mac.c ++++ b/drivers/net/wireless/rt2x00/rt2x00mac.c +@@ -489,6 +489,8 @@ int rt2x00mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, + crypto.cipher = rt2x00crypto_key_to_cipher(key); + if (crypto.cipher == CIPHER_NONE) + return -EOPNOTSUPP; ++ if (crypto.cipher == CIPHER_TKIP && rt2x00_is_usb(rt2x00dev)) ++ return -EOPNOTSUPP; + + crypto.cmd = cmd; + +diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c +index d0fa4b6c551f..c62b3e5d44bd 100644 +--- a/drivers/scsi/ibmvscsi/ibmvscsi.c ++++ b/drivers/scsi/ibmvscsi/ibmvscsi.c +@@ -185,6 +185,11 @@ static struct viosrp_crq *crq_queue_next_crq(struct crq_queue *queue) + if (crq->valid & 0x80) { + if (++queue->cur == queue->size) + queue->cur = 0; ++ ++ /* Ensure the read of the valid bit occurs before reading any ++ * other bits of the CRQ entry ++ */ ++ rmb(); + } else + crq = NULL; + spin_unlock_irqrestore(&queue->lock, flags); +@@ -203,6 +208,11 @@ static int ibmvscsi_send_crq(struct ibmvscsi_host_data *hostdata, + { + struct vio_dev *vdev = to_vio_dev(hostdata->dev); + ++ /* ++ * Ensure the command buffer is flushed to memory before handing it ++ * over to the VIOS to prevent it from fetching any stale data. ++ */ ++ mb(); + return plpar_hcall_norets(H_SEND_CRQ, vdev->unit_address, word1, word2); + } + +@@ -794,7 +804,8 @@ static void purge_requests(struct ibmvscsi_host_data *hostdata, int error_code) + evt->hostdata->dev); + if (evt->cmnd_done) + evt->cmnd_done(evt->cmnd); +- } else if (evt->done) ++ } else if (evt->done && evt->crq.format != VIOSRP_MAD_FORMAT && ++ evt->iu.srp.login_req.opcode != SRP_LOGIN_REQ) + evt->done(evt); + free_event_struct(&evt->hostdata->pool, evt); + spin_lock_irqsave(hostdata->host->host_lock, flags); +diff --git a/drivers/scsi/sym53c8xx_2/sym_hipd.c b/drivers/scsi/sym53c8xx_2/sym_hipd.c +index d92fe4037e94..6b349e301869 100644 +--- a/drivers/scsi/sym53c8xx_2/sym_hipd.c ++++ b/drivers/scsi/sym53c8xx_2/sym_hipd.c +@@ -3000,7 +3000,11 @@ sym_dequeue_from_squeue(struct sym_hcb *np, int i, int target, int lun, int task + if ((target == -1 || cp->target == target) && + (lun == -1 || cp->lun == lun) && + (task == -1 || cp->tag == task)) { ++#ifdef SYM_OPT_HANDLE_DEVICE_QUEUEING + sym_set_cam_status(cp->cmd, DID_SOFT_ERROR); ++#else ++ sym_set_cam_status(cp->cmd, DID_REQUEUE); ++#endif + sym_remque(&cp->link_ccbq); + sym_insque_tail(&cp->link_ccbq, &np->comp_ccbq); + } +diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c +index 95a5d73e675c..11f5326f449f 100644 +--- a/drivers/scsi/virtio_scsi.c ++++ b/drivers/scsi/virtio_scsi.c +@@ -270,6 +270,16 @@ static void virtscsi_req_done(struct virtqueue *vq) + virtscsi_vq_done(vscsi, req_vq, virtscsi_complete_cmd); + }; + ++static void virtscsi_poll_requests(struct virtio_scsi *vscsi) ++{ ++ int i, num_vqs; ++ ++ num_vqs = vscsi->num_queues; ++ for (i = 0; i < num_vqs; i++) ++ virtscsi_vq_done(vscsi, &vscsi->req_vqs[i], ++ virtscsi_complete_cmd); ++} ++ + static void virtscsi_complete_free(struct virtio_scsi *vscsi, void *buf) + { + struct virtio_scsi_cmd *cmd = buf; +@@ -288,6 +298,8 @@ static void virtscsi_ctrl_done(struct virtqueue *vq) + virtscsi_vq_done(vscsi, &vscsi->ctrl_vq, virtscsi_complete_free); + }; + ++static void virtscsi_handle_event(struct work_struct *work); ++ + static int virtscsi_kick_event(struct virtio_scsi *vscsi, + struct virtio_scsi_event_node *event_node) + { +@@ -295,6 +307,7 @@ static int virtscsi_kick_event(struct virtio_scsi *vscsi, + struct scatterlist sg; + unsigned long flags; + ++ INIT_WORK(&event_node->work, virtscsi_handle_event); + sg_init_one(&sg, &event_node->event, sizeof(struct virtio_scsi_event)); + + spin_lock_irqsave(&vscsi->event_vq.vq_lock, flags); +@@ -412,7 +425,6 @@ static void virtscsi_complete_event(struct virtio_scsi *vscsi, void *buf) + { + struct virtio_scsi_event_node *event_node = buf; + +- INIT_WORK(&event_node->work, virtscsi_handle_event); + schedule_work(&event_node->work); + } + +@@ -602,6 +614,18 @@ static int virtscsi_tmf(struct virtio_scsi *vscsi, struct virtio_scsi_cmd *cmd) + cmd->resp.tmf.response == VIRTIO_SCSI_S_FUNCTION_SUCCEEDED) + ret = SUCCESS; + ++ /* ++ * The spec guarantees that all requests related to the TMF have ++ * been completed, but the callback might not have run yet if ++ * we're using independent interrupts (e.g. MSI). Poll the ++ * virtqueues once. ++ * ++ * In the abort case, sc->scsi_done will do nothing, because ++ * the block layer must have detected a timeout and as a result ++ * REQ_ATOM_COMPLETE has been set. ++ */ ++ virtscsi_poll_requests(vscsi); ++ + out: + mempool_free(cmd, virtscsi_cmd_pool); + return ret; +diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c +index 5d880917850f..345b5ddcb1a0 100644 +--- a/drivers/tty/serial/8250/8250_dw.c ++++ b/drivers/tty/serial/8250/8250_dw.c +@@ -54,58 +54,100 @@ + + + struct dw8250_data { +- int last_lcr; ++ int last_mcr; + int line; + struct clk *clk; + }; + ++static inline int dw8250_modify_msr(struct uart_port *p, int offset, int value) ++{ ++ struct dw8250_data *d = p->private_data; ++ ++ /* If reading MSR, report CTS asserted when auto-CTS/RTS enabled */ ++ if (offset == UART_MSR && d->last_mcr & UART_MCR_AFE) { ++ value |= UART_MSR_CTS; ++ value &= ~UART_MSR_DCTS; ++ } ++ ++ return value; ++} ++ ++static void dw8250_force_idle(struct uart_port *p) ++{ ++ serial8250_clear_and_reinit_fifos(container_of ++ (p, struct uart_8250_port, port)); ++ (void)p->serial_in(p, UART_RX); ++} ++ + static void dw8250_serial_out(struct uart_port *p, int offset, int value) + { + struct dw8250_data *d = p->private_data; + +- if (offset == UART_LCR) +- d->last_lcr = value; ++ if (offset == UART_MCR) ++ d->last_mcr = value; ++ ++ writeb(value, p->membase + (offset << p->regshift)); + +- offset <<= p->regshift; +- writeb(value, p->membase + offset); ++ /* Make sure LCR write wasn't ignored */ ++ if (offset == UART_LCR) { ++ int tries = 1000; ++ while (tries--) { ++ unsigned int lcr = p->serial_in(p, UART_LCR); ++ if ((value & ~UART_LCR_SPAR) == (lcr & ~UART_LCR_SPAR)) ++ return; ++ dw8250_force_idle(p); ++ writeb(value, p->membase + (UART_LCR << p->regshift)); ++ } ++ dev_err(p->dev, "Couldn't set LCR to %d\n", value); ++ } + } + + static unsigned int dw8250_serial_in(struct uart_port *p, int offset) + { +- offset <<= p->regshift; ++ unsigned int value = readb(p->membase + (offset << p->regshift)); + +- return readb(p->membase + offset); ++ return dw8250_modify_msr(p, offset, value); + } + + static void dw8250_serial_out32(struct uart_port *p, int offset, int value) + { + struct dw8250_data *d = p->private_data; + +- if (offset == UART_LCR) +- d->last_lcr = value; ++ if (offset == UART_MCR) ++ d->last_mcr = value; + +- offset <<= p->regshift; +- writel(value, p->membase + offset); ++ writel(value, p->membase + (offset << p->regshift)); ++ ++ /* Make sure LCR write wasn't ignored */ ++ if (offset == UART_LCR) { ++ int tries = 1000; ++ while (tries--) { ++ unsigned int lcr = p->serial_in(p, UART_LCR); ++ if ((value & ~UART_LCR_SPAR) == (lcr & ~UART_LCR_SPAR)) ++ return; ++ dw8250_force_idle(p); ++ writel(value, p->membase + (UART_LCR << p->regshift)); ++ } ++ dev_err(p->dev, "Couldn't set LCR to %d\n", value); ++ } + } + + static unsigned int dw8250_serial_in32(struct uart_port *p, int offset) + { +- offset <<= p->regshift; ++ unsigned int value = readl(p->membase + (offset << p->regshift)); + +- return readl(p->membase + offset); ++ return dw8250_modify_msr(p, offset, value); + } + + static int dw8250_handle_irq(struct uart_port *p) + { +- struct dw8250_data *d = p->private_data; + unsigned int iir = p->serial_in(p, UART_IIR); + + if (serial8250_handle_irq(p, iir)) { + return 1; + } else if ((iir & UART_IIR_BUSY) == UART_IIR_BUSY) { +- /* Clear the USR and write the LCR again. */ ++ /* Clear the USR */ + (void)p->serial_in(p, DW_UART_USR); +- p->serial_out(p, UART_LCR, d->last_lcr); + + return 1; + } +diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c +index b6e9d917221e..84219f656051 100644 +--- a/drivers/usb/gadget/f_fs.c ++++ b/drivers/usb/gadget/f_fs.c +@@ -1389,11 +1389,13 @@ static int functionfs_bind(struct ffs_data *ffs, struct usb_composite_dev *cdev) + ffs->ep0req->context = ffs; + + lang = ffs->stringtabs; +- for (lang = ffs->stringtabs; *lang; ++lang) { +- struct usb_string *str = (*lang)->strings; +- int id = first_id; +- for (; str->s; ++id, ++str) +- str->id = id; ++ if (lang) { ++ for (; *lang; ++lang) { ++ struct usb_string *str = (*lang)->strings; ++ int id = first_id; ++ for (; str->s; ++id, ++str) ++ str->id = id; ++ } + } + + ffs->gadget = cdev->gadget; +diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c +index bcfb08e41eb6..fe42cae6d1ef 100644 +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -3590,7 +3590,7 @@ static unsigned int xhci_get_burst_count(struct xhci_hcd *xhci, + return 0; + + max_burst = urb->ep->ss_ep_comp.bMaxBurst; +- return roundup(total_packet_count, max_burst + 1) - 1; ++ return DIV_ROUND_UP(total_packet_count, max_burst + 1) - 1; + } + + /* +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 4b46de842175..9a7088bc634d 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -960,7 +960,7 @@ int xhci_suspend(struct xhci_hcd *xhci) + */ + int xhci_resume(struct xhci_hcd *xhci, bool hibernated) + { +- u32 command, temp = 0; ++ u32 command, temp = 0, status; + struct usb_hcd *hcd = xhci_to_hcd(xhci); + struct usb_hcd *secondary_hcd; + int retval = 0; +@@ -1084,8 +1084,12 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated) + + done: + if (retval == 0) { +- usb_hcd_resume_root_hub(hcd); +- usb_hcd_resume_root_hub(xhci->shared_hcd); ++ /* Resume root hubs only when have pending events. */ ++ status = readl(&xhci->op_regs->status); ++ if (status & STS_EINT) { ++ usb_hcd_resume_root_hub(hcd); ++ usb_hcd_resume_root_hub(xhci->shared_hcd); ++ } + } + + /* +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index b9e663ac9a35..3e315de9bbd4 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -1577,14 +1577,17 @@ static void ftdi_set_max_packet_size(struct usb_serial_port *port) + struct usb_device *udev = serial->dev; + + struct usb_interface *interface = serial->interface; +- struct usb_endpoint_descriptor *ep_desc = &interface->cur_altsetting->endpoint[1].desc; ++ struct usb_endpoint_descriptor *ep_desc; + + unsigned num_endpoints; +- int i; ++ unsigned i; + + num_endpoints = interface->cur_altsetting->desc.bNumEndpoints; + dev_info(&udev->dev, "Number of endpoints %d\n", num_endpoints); + ++ if (!num_endpoints) ++ return; ++ + /* NOTE: some customers have programmed FT232R/FT245R devices + * with an endpoint size of 0 - not good. In this case, we + * want to override the endpoint descriptor setting and use a +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 70ede84f4f6b..e25e8ca09fe2 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -352,6 +352,9 @@ static void option_instat_callback(struct urb *urb); + /* Zoom */ + #define ZOOM_PRODUCT_4597 0x9607 + ++/* SpeedUp SU9800 usb 3g modem */ ++#define SPEEDUP_PRODUCT_SU9800 0x9800 ++ + /* Haier products */ + #define HAIER_VENDOR_ID 0x201e + #define HAIER_PRODUCT_CE100 0x2009 +@@ -372,8 +375,12 @@ static void option_instat_callback(struct urb *urb); + /* Olivetti products */ + #define OLIVETTI_VENDOR_ID 0x0b3c + #define OLIVETTI_PRODUCT_OLICARD100 0xc000 ++#define OLIVETTI_PRODUCT_OLICARD120 0xc001 ++#define OLIVETTI_PRODUCT_OLICARD140 0xc002 + #define OLIVETTI_PRODUCT_OLICARD145 0xc003 ++#define OLIVETTI_PRODUCT_OLICARD155 0xc004 + #define OLIVETTI_PRODUCT_OLICARD200 0xc005 ++#define OLIVETTI_PRODUCT_OLICARD160 0xc00a + #define OLIVETTI_PRODUCT_OLICARD500 0xc00b + + /* Celot products */ +@@ -1577,6 +1584,7 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14), + .driver_info = (kernel_ulong_t)&four_g_w14_blacklist + }, ++ { USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, SPEEDUP_PRODUCT_SU9800, 0xff) }, + { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) }, + { USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) }, + { USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) }, +@@ -1611,15 +1619,21 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDMNET) }, + { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, /* HC28 enumerates with Siemens or Cinterion VID depending on FW revision */ + { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) }, +- +- { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) }, ++ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100), ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, ++ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD120), ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, ++ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD140), ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD145) }, ++ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD155), ++ .driver_info = (kernel_ulong_t)&net_intf6_blacklist }, + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD200), +- .driver_info = (kernel_ulong_t)&net_intf6_blacklist +- }, ++ .driver_info = (kernel_ulong_t)&net_intf6_blacklist }, ++ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD160), ++ .driver_info = (kernel_ulong_t)&net_intf6_blacklist }, + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD500), +- .driver_info = (kernel_ulong_t)&net_intf4_blacklist +- }, ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */ + { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/ + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM600) }, +diff --git a/drivers/video/fb-puv3.c b/drivers/video/fb-puv3.c +index 27fc956166fa..520112531eb0 100644 +--- a/drivers/video/fb-puv3.c ++++ b/drivers/video/fb-puv3.c +@@ -18,8 +18,10 @@ + #include + #include + #include ++#include + + #include ++#include + #include + + /* Platform_data reserved for unifb registers. */ +diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c +index 0227b45ef00a..15e9505aa35f 100644 +--- a/fs/cifs/cifs_unicode.c ++++ b/fs/cifs/cifs_unicode.c +@@ -290,7 +290,8 @@ int + cifsConvertToUTF16(__le16 *target, const char *source, int srclen, + const struct nls_table *cp, int mapChars) + { +- int i, j, charlen; ++ int i, charlen; ++ int j = 0; + char src_char; + __le16 dst_char; + wchar_t tmp; +@@ -298,12 +299,11 @@ cifsConvertToUTF16(__le16 *target, const char *source, int srclen, + if (!mapChars) + return cifs_strtoUTF16(target, source, PATH_MAX, cp); + +- for (i = 0, j = 0; i < srclen; j++) { ++ for (i = 0; i < srclen; j++) { + src_char = source[i]; + charlen = 1; + switch (src_char) { + case 0: +- put_unaligned(0, &target[j]); + goto ctoUTF16_out; + case ':': + dst_char = cpu_to_le16(UNI_COLON); +@@ -350,6 +350,7 @@ cifsConvertToUTF16(__le16 *target, const char *source, int srclen, + } + + ctoUTF16_out: ++ put_unaligned(0, &target[j]); /* Null terminate target unicode string */ + return j; + } + +diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c +index b8d5d351e24f..589061469687 100644 +--- a/fs/ext4/indirect.c ++++ b/fs/ext4/indirect.c +@@ -390,7 +390,13 @@ static int ext4_alloc_branch(handle_t *handle, struct inode *inode, + return 0; + failed: + for (; i >= 0; i--) { +- if (i != indirect_blks && branch[i].bh) ++ /* ++ * We want to ext4_forget() only freshly allocated indirect ++ * blocks. Buffer for new_blocks[i-1] is at branch[i].bh and ++ * buffer at branch[0].bh is indirect block / inode already ++ * existing before ext4_alloc_branch() was called. ++ */ ++ if (i > 0 && i != indirect_blks && branch[i].bh) + ext4_forget(handle, 1, inode, branch[i].bh, + branch[i].bh->b_blocknr); + ext4_free_blocks(handle, inode, NULL, new_blocks[i], +@@ -1325,16 +1331,24 @@ static int free_hole_blocks(handle_t *handle, struct inode *inode, + blk = *i_data; + if (level > 0) { + ext4_lblk_t first2; ++ ext4_lblk_t count2; ++ + bh = sb_bread(inode->i_sb, le32_to_cpu(blk)); + if (!bh) { + EXT4_ERROR_INODE_BLOCK(inode, le32_to_cpu(blk), + "Read failure"); + return -EIO; + } +- first2 = (first > offset) ? first - offset : 0; ++ if (first > offset) { ++ first2 = first - offset; ++ count2 = count; ++ } else { ++ first2 = 0; ++ count2 = count - (offset - first); ++ } + ret = free_hole_blocks(handle, inode, bh, + (__le32 *)bh->b_data, level - 1, +- first2, count - offset, ++ first2, count2, + inode->i_sb->s_blocksize >> 2); + if (ret) { + brelse(bh); +diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c +index f7d7d04674fb..0f9ce13972d0 100644 +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -576,15 +576,6 @@ nfsd4_create(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, + + switch (create->cr_type) { + case NF4LNK: +- /* ugh! we have to null-terminate the linktext, or +- * vfs_symlink() will choke. it is always safe to +- * null-terminate by brute force, since at worst we +- * will overwrite the first byte of the create namelen +- * in the XDR buffer, which has already been extracted +- * during XDR decode. +- */ +- create->cr_linkname[create->cr_linklen] = 0; +- + status = nfsd_symlink(rqstp, &cstate->current_fh, + create->cr_name, create->cr_namelen, + create->cr_linkname, create->cr_linklen, +diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c +index d4890a96421e..9b45f0666cfc 100644 +--- a/fs/nfsd/nfs4xdr.c ++++ b/fs/nfsd/nfs4xdr.c +@@ -553,7 +553,18 @@ nfsd4_decode_create(struct nfsd4_compoundargs *argp, struct nfsd4_create *create + READ_BUF(4); + READ32(create->cr_linklen); + READ_BUF(create->cr_linklen); +- SAVEMEM(create->cr_linkname, create->cr_linklen); ++ /* ++ * The VFS will want a null-terminated string, and ++ * null-terminating in place isn't safe since this might ++ * end on a page boundary: ++ */ ++ create->cr_linkname = ++ kmalloc(create->cr_linklen + 1, GFP_KERNEL); ++ if (!create->cr_linkname) ++ return nfserr_jukebox; ++ memcpy(create->cr_linkname, p, create->cr_linklen); ++ create->cr_linkname[create->cr_linklen] = '\0'; ++ defer_free(argp, kfree, create->cr_linkname); + break; + case NF4BLK: + case NF4CHR: +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 60f49637b4d5..21920add7972 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -1306,7 +1306,6 @@ void tracing_start(void) + + arch_spin_unlock(&ftrace_max_lock); + +- ftrace_start(); + out: + raw_spin_unlock_irqrestore(&global_trace.start_lock, flags); + } +@@ -1353,7 +1352,6 @@ void tracing_stop(void) + struct ring_buffer *buffer; + unsigned long flags; + +- ftrace_stop(); + raw_spin_lock_irqsave(&global_trace.start_lock, flags); + if (global_trace.stop_count++) + goto out; +diff --git a/mm/hugetlb.c b/mm/hugetlb.c +index de73c9d144e1..dbc949c409c7 100644 +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -2328,6 +2328,31 @@ static void set_huge_ptep_writable(struct vm_area_struct *vma, + update_mmu_cache(vma, address, ptep); + } + ++static int is_hugetlb_entry_migration(pte_t pte) ++{ ++ swp_entry_t swp; ++ ++ if (huge_pte_none(pte) || pte_present(pte)) ++ return 0; ++ swp = pte_to_swp_entry(pte); ++ if (non_swap_entry(swp) && is_migration_entry(swp)) ++ return 1; ++ else ++ return 0; ++} ++ ++static int is_hugetlb_entry_hwpoisoned(pte_t pte) ++{ ++ swp_entry_t swp; ++ ++ if (huge_pte_none(pte) || pte_present(pte)) ++ return 0; ++ swp = pte_to_swp_entry(pte); ++ if (non_swap_entry(swp) && is_hwpoison_entry(swp)) ++ return 1; ++ else ++ return 0; ++} + + int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src, + struct vm_area_struct *vma) +@@ -2355,10 +2380,26 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src, + + spin_lock(&dst->page_table_lock); + spin_lock_nested(&src->page_table_lock, SINGLE_DEPTH_NESTING); +- if (!huge_pte_none(huge_ptep_get(src_pte))) { ++ entry = huge_ptep_get(src_pte); ++ if (huge_pte_none(entry)) { /* skip none entry */ ++ ; ++ } else if (unlikely(is_hugetlb_entry_migration(entry) || ++ is_hugetlb_entry_hwpoisoned(entry))) { ++ swp_entry_t swp_entry = pte_to_swp_entry(entry); ++ ++ if (is_write_migration_entry(swp_entry) && cow) { ++ /* ++ * COW mappings require pages in both ++ * parent and child to be set to read. ++ */ ++ make_migration_entry_read(&swp_entry); ++ entry = swp_entry_to_pte(swp_entry); ++ set_huge_pte_at(src, addr, src_pte, entry); ++ } ++ set_huge_pte_at(dst, addr, dst_pte, entry); ++ } else { + if (cow) + huge_ptep_set_wrprotect(src, addr, src_pte); +- entry = huge_ptep_get(src_pte); + ptepage = pte_page(entry); + get_page(ptepage); + page_dup_rmap(ptepage); +@@ -2373,32 +2414,6 @@ nomem: + return -ENOMEM; + } + +-static int is_hugetlb_entry_migration(pte_t pte) +-{ +- swp_entry_t swp; +- +- if (huge_pte_none(pte) || pte_present(pte)) +- return 0; +- swp = pte_to_swp_entry(pte); +- if (non_swap_entry(swp) && is_migration_entry(swp)) +- return 1; +- else +- return 0; +-} +- +-static int is_hugetlb_entry_hwpoisoned(pte_t pte) +-{ +- swp_entry_t swp; +- +- if (huge_pte_none(pte) || pte_present(pte)) +- return 0; +- swp = pte_to_swp_entry(pte); +- if (non_swap_entry(swp) && is_hwpoison_entry(swp)) +- return 1; +- else +- return 0; +-} +- + void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma, + unsigned long start, unsigned long end, + struct page *ref_page) +diff --git a/mm/mempolicy.c b/mm/mempolicy.c +index 6c2dace665aa..1124d5fc06e9 100644 +--- a/mm/mempolicy.c ++++ b/mm/mempolicy.c +@@ -608,19 +608,18 @@ static unsigned long change_prot_numa(struct vm_area_struct *vma, + * If pagelist != NULL then isolate pages from the LRU and + * put them on the pagelist. + */ +-static struct vm_area_struct * ++static int + check_range(struct mm_struct *mm, unsigned long start, unsigned long end, + const nodemask_t *nodes, unsigned long flags, void *private) + { +- int err; +- struct vm_area_struct *first, *vma, *prev; +- ++ int err = 0; ++ struct vm_area_struct *vma, *prev; + +- first = find_vma(mm, start); +- if (!first) +- return ERR_PTR(-EFAULT); ++ vma = find_vma(mm, start); ++ if (!vma) ++ return -EFAULT; + prev = NULL; +- for (vma = first; vma && vma->vm_start < end; vma = vma->vm_next) { ++ for (; vma && vma->vm_start < end; vma = vma->vm_next) { + unsigned long endvma = vma->vm_end; + + if (endvma > end) +@@ -630,9 +629,9 @@ check_range(struct mm_struct *mm, unsigned long start, unsigned long end, + + if (!(flags & MPOL_MF_DISCONTIG_OK)) { + if (!vma->vm_next && vma->vm_end < end) +- return ERR_PTR(-EFAULT); ++ return -EFAULT; + if (prev && prev->vm_end < vma->vm_start) +- return ERR_PTR(-EFAULT); ++ return -EFAULT; + } + + if (is_vm_hugetlb_page(vma)) +@@ -649,15 +648,13 @@ check_range(struct mm_struct *mm, unsigned long start, unsigned long end, + + err = check_pgd_range(vma, start, endvma, nodes, + flags, private); +- if (err) { +- first = ERR_PTR(err); ++ if (err) + break; +- } + } + next: + prev = vma; + } +- return first; ++ return err; + } + + /* +@@ -1138,16 +1135,17 @@ out: + + /* + * Allocate a new page for page migration based on vma policy. +- * Start assuming that page is mapped by vma pointed to by @private. ++ * Start by assuming the page is mapped by the same vma as contains @start. + * Search forward from there, if not. N.B., this assumes that the + * list of pages handed to migrate_pages()--which is how we get here-- + * is in virtual address order. + */ +-static struct page *new_vma_page(struct page *page, unsigned long private, int **x) ++static struct page *new_page(struct page *page, unsigned long start, int **x) + { +- struct vm_area_struct *vma = (struct vm_area_struct *)private; ++ struct vm_area_struct *vma; + unsigned long uninitialized_var(address); + ++ vma = find_vma(current->mm, start); + while (vma) { + address = page_address_in_vma(page, vma); + if (address != -EFAULT) +@@ -1173,7 +1171,7 @@ int do_migrate_pages(struct mm_struct *mm, const nodemask_t *from, + return -ENOSYS; + } + +-static struct page *new_vma_page(struct page *page, unsigned long private, int **x) ++static struct page *new_page(struct page *page, unsigned long start, int **x) + { + return NULL; + } +@@ -1183,7 +1181,6 @@ static long do_mbind(unsigned long start, unsigned long len, + unsigned short mode, unsigned short mode_flags, + nodemask_t *nmask, unsigned long flags) + { +- struct vm_area_struct *vma; + struct mm_struct *mm = current->mm; + struct mempolicy *new; + unsigned long end; +@@ -1249,11 +1246,9 @@ static long do_mbind(unsigned long start, unsigned long len, + if (err) + goto mpol_out; + +- vma = check_range(mm, start, end, nmask, ++ err = check_range(mm, start, end, nmask, + flags | MPOL_MF_INVERT, &pagelist); +- +- err = PTR_ERR(vma); /* maybe ... */ +- if (!IS_ERR(vma)) ++ if (!err) + err = mbind_range(mm, start, end, new); + + if (!err) { +@@ -1261,9 +1256,8 @@ static long do_mbind(unsigned long start, unsigned long len, + + if (!list_empty(&pagelist)) { + WARN_ON_ONCE(flags & MPOL_MF_LAZY); +- nr_failed = migrate_pages(&pagelist, new_vma_page, +- (unsigned long)vma, +- MIGRATE_SYNC, MR_MEMPOLICY_MBIND); ++ nr_failed = migrate_pages(&pagelist, new_page, ++ start, MIGRATE_SYNC, MR_MEMPOLICY_MBIND); + if (nr_failed) + putback_lru_pages(&pagelist); + } +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index 4c51c055d00f..8e7290aea8f8 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -659,7 +659,7 @@ static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type) + /* If we're already encrypted set the REAUTH_PEND flag, + * otherwise set the ENCRYPT_PEND. + */ +- if (conn->key_type != 0xff) ++ if (conn->link_mode & HCI_LM_ENCRYPT) + set_bit(HCI_CONN_REAUTH_PEND, &conn->flags); + else + set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags); +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index ab2ec7c414cb..5daf7ab26710 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -3218,8 +3218,11 @@ static void hci_user_confirm_request_evt(struct hci_dev *hdev, + + /* If we're not the initiators request authorization to + * proceed from user space (mgmt_user_confirm with +- * confirm_hint set to 1). */ +- if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags)) { ++ * confirm_hint set to 1). The exception is if neither ++ * side had MITM in which case we do auto-accept. ++ */ ++ if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ++ (loc_mitm || rem_mitm)) { + BT_DBG("Confirming auto-accept as acceptor"); + confirm_hint = 1; + goto confirm; +diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c +index f8ecbc70293d..8208a13a9837 100644 +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -2333,8 +2333,13 @@ static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev, + } + + if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) { +- /* Continue with pairing via SMP */ ++ /* Continue with pairing via SMP. The hdev lock must be ++ * released as SMP may try to recquire it for crypto ++ * purposes. ++ */ ++ hci_dev_unlock(hdev); + err = smp_user_confirm_reply(conn, mgmt_op, passkey); ++ hci_dev_lock(hdev); + + if (!err) + err = cmd_complete(sk, hdev->id, mgmt_op, +diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c +index 14abcf44f974..2d5b4f65c519 100644 +--- a/net/mac80211/debugfs_netdev.c ++++ b/net/mac80211/debugfs_netdev.c +@@ -34,8 +34,7 @@ static ssize_t ieee80211_if_read( + ssize_t ret = -EINVAL; + + read_lock(&dev_base_lock); +- if (sdata->dev->reg_state == NETREG_REGISTERED) +- ret = (*format)(sdata, buf, sizeof(buf)); ++ ret = (*format)(sdata, buf, sizeof(buf)); + read_unlock(&dev_base_lock); + + if (ret >= 0) +@@ -62,8 +61,7 @@ static ssize_t ieee80211_if_write( + + ret = -ENODEV; + rtnl_lock(); +- if (sdata->dev->reg_state == NETREG_REGISTERED) +- ret = (*write)(sdata, buf, count); ++ ret = (*write)(sdata, buf, count); + rtnl_unlock(); + + return ret; +diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c +index 0418777c361f..557a5760f9f6 100644 +--- a/net/mac80211/sta_info.c ++++ b/net/mac80211/sta_info.c +@@ -270,6 +270,7 @@ void sta_info_free(struct ieee80211_local *local, struct sta_info *sta) + + sta_dbg(sta->sdata, "Destroyed STA %pM\n", sta->sta.addr); + ++ kfree(rcu_dereference_raw(sta->sta.rates)); + kfree(sta); + } + +diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c +index 93b6e32cfead..0d7a872dab36 100644 +--- a/sound/usb/pcm.c ++++ b/sound/usb/pcm.c +@@ -1420,7 +1420,8 @@ static void retire_playback_urb(struct snd_usb_substream *subs, + * on two reads of a counter updated every ms. + */ + if (abs(est_delay - subs->last_delay) * 1000 > runtime->rate * 2) +- snd_printk(KERN_DEBUG "delay: estimated %d, actual %d\n", ++ dev_dbg_ratelimited(&subs->dev->dev, ++ "delay: estimated %d, actual %d\n", + est_delay, subs->last_delay); + + if (!subs->running) { +diff --git a/tools/usb/ffs-test.c b/tools/usb/ffs-test.c +index fe1e66b6ef40..a87e99f37c52 100644 +--- a/tools/usb/ffs-test.c ++++ b/tools/usb/ffs-test.c +@@ -116,8 +116,8 @@ static const struct { + .header = { + .magic = cpu_to_le32(FUNCTIONFS_DESCRIPTORS_MAGIC), + .length = cpu_to_le32(sizeof descriptors), +- .fs_count = 3, +- .hs_count = 3, ++ .fs_count = cpu_to_le32(3), ++ .hs_count = cpu_to_le32(3), + }, + .fs_descs = { + .intf = {