diff options
| author |   Mike Pagano <mpagano@gentoo.org> | 2014-07-23 07:54:50 -0400 |
|---|---|---|
| committer | Mike Pagano <mpagano@gentoo.org> | 2014-07-23 07:54:50 -0400 |
| commit | c62d20cbbb36deb573e7d503be551423e612f2ff (patch) | |
| tree | 8b3d54f46ccf00d5cc3a77f3eefeed17cb94412e | |
| parent | Linux patch 3.12.24 (diff) | |
| download | linux-patches-c62d20cbbb36deb573e7d503be551423e612f2ff.tar.gz linux-patches-c62d20cbbb36deb573e7d503be551423e612f2ff.tar.bz2 linux-patches-c62d20cbbb36deb573e7d503be551423e612f2ff.zip | |
Linux patch 3.12.253.12-28
| -rw-r--r-- | 0000_README | 6 | ||||
| -rw-r--r-- | 1024_linux-3.12.25.patch | 5826 |
2 files changed, 5831 insertions, 1 deletions
diff --git a/0000_README b/0000_README index 312464b9..76b0ed4d 100644 --- a/0000_README +++ b/0000_README @@ -134,10 +134,14 @@ Patch: 1022_linux-3.12.23.patch From: http://www.kernel.org Desc: Linux 3.12.23 -Patch: 1022_linux-3.12.24.patch +Patch: 1023_linux-3.12.24.patch From: http://www.kernel.org Desc: Linux 3.12.24 +Patch: 1024_linux-3.12.25.patch +From: http://www.kernel.org +Desc: Linux 3.12.25 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1024_linux-3.12.25.patch b/1024_linux-3.12.25.patch new file mode 100644 index 00000000..122b2b55 --- /dev/null +++ b/1024_linux-3.12.25.patch @@ -0,0 +1,5826 @@ +diff --git a/Documentation/SubmittingPatches b/Documentation/SubmittingPatches +index 26b1e31d5a13..1ec219a14904 100644 +--- a/Documentation/SubmittingPatches ++++ b/Documentation/SubmittingPatches +@@ -119,6 +119,20 @@ Example: + platform_set_drvdata(), but left the variable "dev" unused, + delete it. + ++If your patch fixes a bug in a specific commit, e.g. you found an issue using ++git-bisect, please use the 'Fixes:' tag with the first 12 characters of the ++SHA-1 ID, and the one line summary. ++Example: ++ ++ Fixes: e21d2170f366 ("video: remove unnecessary platform_set_drvdata()") ++ ++The following git-config settings can be used to add a pretty format for ++outputting the above style in the git log or git show commands ++ ++ [core] ++ abbrev = 12 ++ [pretty] ++ fixes = Fixes: %h (\"%s\") + + 3) Separate your changes. + +@@ -430,7 +444,7 @@ person it names. This tag documents that potentially interested parties + have been included in the discussion + + +-14) Using Reported-by:, Tested-by:, Reviewed-by: and Suggested-by: ++14) Using Reported-by:, Tested-by:, Reviewed-by:, Suggested-by: and Fixes: + + If this patch fixes a problem reported by somebody else, consider adding a + Reported-by: tag to credit the reporter for their contribution. Please +@@ -485,6 +499,12 @@ idea was not posted in a public forum. That said, if we diligently credit our + idea reporters, they will, hopefully, be inspired to help us again in the + future. + ++A Fixes: tag indicates that the patch fixes an issue in a previous commit. It ++is used to make it easy to determine where a bug originated, which can help ++review a bug fix. This tag also assists the stable kernel team in determining ++which stable kernel versions should receive your fix. This is the preferred ++method for indicating a bug fixed by the patch. See #2 above for more details. ++ + + 15) The canonical patch format + +diff --git a/Documentation/sysctl/vm.txt b/Documentation/sysctl/vm.txt +index 79a797eb3e87..138fe437bba0 100644 +--- a/Documentation/sysctl/vm.txt ++++ b/Documentation/sysctl/vm.txt +@@ -664,7 +664,8 @@ The batch value of each per cpu pagelist is also updated as a result. It is + set to pcp->high/4. The upper limit of batch is (PAGE_SHIFT * 8) + + The initial value is zero. Kernel does not use this value at boot time to set +-the high water marks for each per cpu page list. ++the high water marks for each per cpu page list. If the user writes '0' to this ++sysctl, it will revert to this default behavior. + + ============================================================== + +diff --git a/Makefile b/Makefile +index b887aa84c80d..4d25b56bf81c 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 12 +-SUBLEVEL = 24 ++SUBLEVEL = 25 + EXTRAVERSION = + NAME = One Giant Leap for Frogkind + +diff --git a/arch/arm/mach-omap2/mux.c b/arch/arm/mach-omap2/mux.c +index f82cf878d6af..94c2f6d17dae 100644 +--- a/arch/arm/mach-omap2/mux.c ++++ b/arch/arm/mach-omap2/mux.c +@@ -183,8 +183,10 @@ static int __init _omap_mux_get_by_name(struct omap_mux_partition *partition, + m0_entry = mux->muxnames[0]; + + /* First check for full name in mode0.muxmode format */ +- if (mode0_len && strncmp(muxname, m0_entry, mode0_len)) +- continue; ++ if (mode0_len) ++ if (strncmp(muxname, m0_entry, mode0_len) || ++ (strlen(m0_entry) != mode0_len)) ++ continue; + + /* Then check for muxmode only */ + for (i = 0; i < OMAP_MUX_NR_MODES; i++) { +diff --git a/arch/arm64/include/asm/memory.h b/arch/arm64/include/asm/memory.h +index 20925bcf4e2a..e1134d04e07e 100644 +--- a/arch/arm64/include/asm/memory.h ++++ b/arch/arm64/include/asm/memory.h +@@ -51,6 +51,8 @@ + #define TASK_SIZE_32 UL(0x100000000) + #define TASK_SIZE (test_thread_flag(TIF_32BIT) ? \ + TASK_SIZE_32 : TASK_SIZE_64) ++#define TASK_SIZE_OF(tsk) (test_tsk_thread_flag(tsk, TIF_32BIT) ? \ ++ TASK_SIZE_32 : TASK_SIZE_64) + #else + #define TASK_SIZE TASK_SIZE_64 + #endif /* CONFIG_COMPAT */ +diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S +index 3881fd115ebb..028a1b91e2b3 100644 +--- a/arch/arm64/kernel/entry.S ++++ b/arch/arm64/kernel/entry.S +@@ -275,7 +275,6 @@ el1_sp_pc: + * Stack or PC alignment exception handling + */ + mrs x0, far_el1 +- mov x1, x25 + mov x2, sp + b do_sp_pc_abort + el1_undef: +diff --git a/arch/arm64/mm/flush.c b/arch/arm64/mm/flush.c +index e4193e3adc7f..0d64089d28b5 100644 +--- a/arch/arm64/mm/flush.c ++++ b/arch/arm64/mm/flush.c +@@ -79,7 +79,8 @@ void __sync_icache_dcache(pte_t pte, unsigned long addr) + return; + + if (!test_and_set_bit(PG_dcache_clean, &page->flags)) { +- __flush_dcache_area(page_address(page), PAGE_SIZE); ++ __flush_dcache_area(page_address(page), ++ PAGE_SIZE << compound_order(page)); + __flush_icache_all(); + } else if (icache_is_aivivt()) { + __flush_icache_all(); +diff --git a/arch/mips/kernel/irq-msc01.c b/arch/mips/kernel/irq-msc01.c +index fab40f7d2e03..ac9facc08694 100644 +--- a/arch/mips/kernel/irq-msc01.c ++++ b/arch/mips/kernel/irq-msc01.c +@@ -131,7 +131,7 @@ void __init init_msc_irqs(unsigned long icubase, unsigned int irqbase, msc_irqma + + board_bind_eic_interrupt = &msc_bind_eic_interrupt; + +- for (; nirq >= 0; nirq--, imp++) { ++ for (; nirq > 0; nirq--, imp++) { + int n = imp->im_irq; + + switch (imp->im_type) { +diff --git a/arch/mips/kvm/kvm_mips.c b/arch/mips/kvm/kvm_mips.c +index b31153969946..3f3e5b2b2f38 100644 +--- a/arch/mips/kvm/kvm_mips.c ++++ b/arch/mips/kvm/kvm_mips.c +@@ -149,9 +149,7 @@ void kvm_mips_free_vcpus(struct kvm *kvm) + if (kvm->arch.guest_pmap[i] != KVM_INVALID_PAGE) + kvm_mips_release_pfn_clean(kvm->arch.guest_pmap[i]); + } +- +- if (kvm->arch.guest_pmap) +- kfree(kvm->arch.guest_pmap); ++ kfree(kvm->arch.guest_pmap); + + kvm_for_each_vcpu(i, vcpu, kvm) { + kvm_arch_vcpu_free(vcpu); +@@ -388,12 +386,9 @@ void kvm_arch_vcpu_free(struct kvm_vcpu *vcpu) + + kvm_mips_dump_stats(vcpu); + +- if (vcpu->arch.guest_ebase) +- kfree(vcpu->arch.guest_ebase); +- +- if (vcpu->arch.kseg0_commpage) +- kfree(vcpu->arch.kseg0_commpage); +- ++ kfree(vcpu->arch.guest_ebase); ++ kfree(vcpu->arch.kseg0_commpage); ++ kfree(vcpu); + } + + void kvm_arch_vcpu_destroy(struct kvm_vcpu *vcpu) +diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig +index 38f3b7e47ec5..d5d026b6d237 100644 +--- a/arch/powerpc/Kconfig ++++ b/arch/powerpc/Kconfig +@@ -395,7 +395,7 @@ config KEXEC + config CRASH_DUMP + bool "Build a kdump crash kernel" + depends on PPC64 || 6xx || FSL_BOOKE || (44x && !SMP) +- select RELOCATABLE if PPC64 || 44x ++ select RELOCATABLE if (PPC64 && !COMPILE_TEST) || 44x + select DYNAMIC_MEMSTART if FSL_BOOKE + help + Build a kernel suitable for use as a kdump capture kernel. +@@ -985,6 +985,7 @@ endmenu + if PPC64 + config RELOCATABLE + bool "Build a relocatable kernel" ++ depends on !COMPILE_TEST + select NONSTATIC_KERNEL + help + This builds a kernel image that is capable of running anywhere +diff --git a/arch/powerpc/include/asm/perf_event_server.h b/arch/powerpc/include/asm/perf_event_server.h +index 3fd2f1b6f906..cefc7b4f4fb1 100644 +--- a/arch/powerpc/include/asm/perf_event_server.h ++++ b/arch/powerpc/include/asm/perf_event_server.h +@@ -60,8 +60,7 @@ struct power_pmu { + #define PPMU_SIAR_VALID 0x00000010 /* Processor has SIAR Valid bit */ + #define PPMU_HAS_SSLOT 0x00000020 /* Has sampled slot in MMCRA */ + #define PPMU_HAS_SIER 0x00000040 /* Has SIER */ +-#define PPMU_BHRB 0x00000080 /* has BHRB feature enabled */ +-#define PPMU_EBB 0x00000100 /* supports event based branch */ ++#define PPMU_ARCH_207S 0x00000080 /* PMC is architecture v2.07S */ + + /* + * Values for flags to get_alternatives() +diff --git a/arch/powerpc/include/asm/switch_to.h b/arch/powerpc/include/asm/switch_to.h +index 2be5618cdec6..06d63a3c1a88 100644 +--- a/arch/powerpc/include/asm/switch_to.h ++++ b/arch/powerpc/include/asm/switch_to.h +@@ -85,6 +85,8 @@ static inline void clear_task_ebb(struct task_struct *t) + { + #ifdef CONFIG_PPC_BOOK3S_64 + /* EBB perf events are not inherited, so clear all EBB state. */ ++ t->thread.ebbrr = 0; ++ t->thread.ebbhr = 0; + t->thread.bescr = 0; + t->thread.mmcr2 = 0; + t->thread.mmcr0 = 0; +diff --git a/arch/powerpc/include/asm/systbl.h b/arch/powerpc/include/asm/systbl.h +index 43523fe0d8b4..05fcdd826829 100644 +--- a/arch/powerpc/include/asm/systbl.h ++++ b/arch/powerpc/include/asm/systbl.h +@@ -190,7 +190,7 @@ SYSCALL_SPU(getcwd) + SYSCALL_SPU(capget) + SYSCALL_SPU(capset) + COMPAT_SYS(sigaltstack) +-COMPAT_SYS_SPU(sendfile) ++SYSX_SPU(sys_sendfile64,compat_sys_sendfile,sys_sendfile) + SYSCALL(ni_syscall) + SYSCALL(ni_syscall) + PPC_SYS(vfork) +diff --git a/arch/powerpc/include/uapi/asm/cputable.h b/arch/powerpc/include/uapi/asm/cputable.h +index 5b7657959faa..de2c0e4ee1aa 100644 +--- a/arch/powerpc/include/uapi/asm/cputable.h ++++ b/arch/powerpc/include/uapi/asm/cputable.h +@@ -41,5 +41,6 @@ + #define PPC_FEATURE2_EBB 0x10000000 + #define PPC_FEATURE2_ISEL 0x08000000 + #define PPC_FEATURE2_TAR 0x04000000 ++#define PPC_FEATURE2_VEC_CRYPTO 0x02000000 + + #endif /* _UAPI__ASM_POWERPC_CPUTABLE_H */ +diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c +index 597d954e5860..c5d3d023363a 100644 +--- a/arch/powerpc/kernel/cputable.c ++++ b/arch/powerpc/kernel/cputable.c +@@ -105,7 +105,8 @@ extern void __restore_cpu_e6500(void); + PPC_FEATURE_PSERIES_PERFMON_COMPAT) + #define COMMON_USER2_POWER8 (PPC_FEATURE2_ARCH_2_07 | \ + PPC_FEATURE2_HTM_COMP | PPC_FEATURE2_DSCR | \ +- PPC_FEATURE2_ISEL | PPC_FEATURE2_TAR) ++ PPC_FEATURE2_ISEL | PPC_FEATURE2_TAR | \ ++ PPC_FEATURE2_VEC_CRYPTO) + #define COMMON_USER_PA6T (COMMON_USER_PPC64 | PPC_FEATURE_PA6T |\ + PPC_FEATURE_TRUE_LE | \ + PPC_FEATURE_HAS_ALTIVEC_COMP) +diff --git a/arch/powerpc/kernel/legacy_serial.c b/arch/powerpc/kernel/legacy_serial.c +index 22e88dd2f34a..a531358f971e 100644 +--- a/arch/powerpc/kernel/legacy_serial.c ++++ b/arch/powerpc/kernel/legacy_serial.c +@@ -48,6 +48,9 @@ static struct __initdata of_device_id legacy_serial_parents[] = { + static unsigned int legacy_serial_count; + static int legacy_serial_console = -1; + ++static const upf_t legacy_port_flags = UPF_BOOT_AUTOCONF | UPF_SKIP_TEST | ++ UPF_SHARE_IRQ | UPF_FIXED_PORT; ++ + static unsigned int tsi_serial_in(struct uart_port *p, int offset) + { + unsigned int tmp; +@@ -153,8 +156,6 @@ static int __init add_legacy_soc_port(struct device_node *np, + { + u64 addr; + const __be32 *addrp; +- upf_t flags = UPF_BOOT_AUTOCONF | UPF_SKIP_TEST | UPF_SHARE_IRQ +- | UPF_FIXED_PORT; + struct device_node *tsi = of_get_parent(np); + + /* We only support ports that have a clock frequency properly +@@ -185,9 +186,11 @@ static int __init add_legacy_soc_port(struct device_node *np, + * IO port value. It will be fixed up later along with the irq + */ + if (tsi && !strcmp(tsi->type, "tsi-bridge")) +- return add_legacy_port(np, -1, UPIO_TSI, addr, addr, NO_IRQ, flags, 0); ++ return add_legacy_port(np, -1, UPIO_TSI, addr, addr, ++ NO_IRQ, legacy_port_flags, 0); + else +- return add_legacy_port(np, -1, UPIO_MEM, addr, addr, NO_IRQ, flags, 0); ++ return add_legacy_port(np, -1, UPIO_MEM, addr, addr, ++ NO_IRQ, legacy_port_flags, 0); + } + + static int __init add_legacy_isa_port(struct device_node *np, +@@ -233,7 +236,7 @@ static int __init add_legacy_isa_port(struct device_node *np, + + /* Add port, irq will be dealt with later */ + return add_legacy_port(np, index, UPIO_PORT, be32_to_cpu(reg[1]), +- taddr, NO_IRQ, UPF_BOOT_AUTOCONF, 0); ++ taddr, NO_IRQ, legacy_port_flags, 0); + + } + +@@ -306,7 +309,7 @@ static int __init add_legacy_pci_port(struct device_node *np, + * IO port value. It will be fixed up later along with the irq + */ + return add_legacy_port(np, index, iotype, base, addr, NO_IRQ, +- UPF_BOOT_AUTOCONF, np != pci_dev); ++ legacy_port_flags, np != pci_dev); + } + #endif + +diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c +index 3d261c071fc8..5b86d6a47a1a 100644 +--- a/arch/powerpc/kernel/setup-common.c ++++ b/arch/powerpc/kernel/setup-common.c +@@ -458,9 +458,17 @@ void __init smp_setup_cpu_maps(void) + } + + for (j = 0; j < nthreads && cpu < nr_cpu_ids; j++) { ++ bool avail; ++ + DBG(" thread %d -> cpu %d (hard id %d)\n", + j, cpu, be32_to_cpu(intserv[j])); +- set_cpu_present(cpu, true); ++ ++ avail = of_device_is_available(dn); ++ if (!avail) ++ avail = !of_property_match_string(dn, ++ "enable-method", "spin-table"); ++ ++ set_cpu_present(cpu, avail); + set_hard_smp_processor_id(cpu, be32_to_cpu(intserv[j])); + set_cpu_possible(cpu, true); + cpu++; +diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c +index b3b144121cc9..62e7f22e57d5 100644 +--- a/arch/powerpc/kernel/time.c ++++ b/arch/powerpc/kernel/time.c +@@ -512,7 +512,7 @@ void timer_interrupt(struct pt_regs * regs) + + __get_cpu_var(irq_stat).timer_irqs++; + +-#if defined(CONFIG_PPC32) && defined(CONFIG_PMAC) ++#if defined(CONFIG_PPC32) && defined(CONFIG_PPC_PMAC) + if (atomic_read(&ppc_n_lost_interrupts) != 0) + do_IRQ(regs); + #endif +diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c +index b1faa1593c90..aec4dbf5a5cc 100644 +--- a/arch/powerpc/lib/sstep.c ++++ b/arch/powerpc/lib/sstep.c +@@ -1397,7 +1397,7 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr) + regs->gpr[rd] = byterev_4(val); + goto ldst_done; + +-#ifdef CONFIG_PPC_CPU ++#ifdef CONFIG_PPC_FPU + case 535: /* lfsx */ + case 567: /* lfsux */ + if (!(regs->msr & MSR_FP)) +diff --git a/arch/powerpc/mm/hash_utils_64.c b/arch/powerpc/mm/hash_utils_64.c +index bde8b5589755..503a5d005622 100644 +--- a/arch/powerpc/mm/hash_utils_64.c ++++ b/arch/powerpc/mm/hash_utils_64.c +@@ -947,6 +947,22 @@ void hash_failure_debug(unsigned long ea, unsigned long access, + trap, vsid, ssize, psize, lpsize, pte); + } + ++static void check_paca_psize(unsigned long ea, struct mm_struct *mm, ++ int psize, bool user_region) ++{ ++ if (user_region) { ++ if (psize != get_paca_psize(ea)) { ++ get_paca()->context = mm->context; ++ slb_flush_and_rebolt(); ++ } ++ } else if (get_paca()->vmalloc_sllp != ++ mmu_psize_defs[mmu_vmalloc_psize].sllp) { ++ get_paca()->vmalloc_sllp = ++ mmu_psize_defs[mmu_vmalloc_psize].sllp; ++ slb_vmalloc_update(); ++ } ++} ++ + /* Result code is: + * 0 - handled + * 1 - normal page fault +@@ -1068,6 +1084,8 @@ int hash_page(unsigned long ea, unsigned long access, unsigned long trap) + WARN_ON(1); + } + #endif ++ check_paca_psize(ea, mm, psize, user_region); ++ + goto bail; + } + +@@ -1108,17 +1126,8 @@ int hash_page(unsigned long ea, unsigned long access, unsigned long trap) + #endif + } + } +- if (user_region) { +- if (psize != get_paca_psize(ea)) { +- get_paca()->context = mm->context; +- slb_flush_and_rebolt(); +- } +- } else if (get_paca()->vmalloc_sllp != +- mmu_psize_defs[mmu_vmalloc_psize].sllp) { +- get_paca()->vmalloc_sllp = +- mmu_psize_defs[mmu_vmalloc_psize].sllp; +- slb_vmalloc_update(); +- } ++ ++ check_paca_psize(ea, mm, psize, user_region); + #endif /* CONFIG_PPC_64K_PAGES */ + + #ifdef CONFIG_PPC_HAS_HASH_64K +diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c +index 29b89e863d7c..57a8ff90ed60 100644 +--- a/arch/powerpc/perf/core-book3s.c ++++ b/arch/powerpc/perf/core-book3s.c +@@ -483,7 +483,7 @@ static bool is_ebb_event(struct perf_event *event) + * check that the PMU supports EBB, meaning those that don't can still + * use bit 63 of the event code for something else if they wish. + */ +- return (ppmu->flags & PPMU_EBB) && ++ return (ppmu->flags & PPMU_ARCH_207S) && + ((event->attr.config >> PERF_EVENT_CONFIG_EBB_SHIFT) & 1); + } + +@@ -851,7 +851,22 @@ static void power_pmu_read(struct perf_event *event) + } while (local64_cmpxchg(&event->hw.prev_count, prev, val) != prev); + + local64_add(delta, &event->count); +- local64_sub(delta, &event->hw.period_left); ++ ++ /* ++ * A number of places program the PMC with (0x80000000 - period_left). ++ * We never want period_left to be less than 1 because we will program ++ * the PMC with a value >= 0x800000000 and an edge detected PMC will ++ * roll around to 0 before taking an exception. We have seen this ++ * on POWER8. ++ * ++ * To fix this, clamp the minimum value of period_left to 1. ++ */ ++ do { ++ prev = local64_read(&event->hw.period_left); ++ val = prev - delta; ++ if (val < 1) ++ val = 1; ++ } while (local64_cmpxchg(&event->hw.period_left, prev, val) != prev); + } + + /* +@@ -1149,6 +1164,9 @@ static void power_pmu_enable(struct pmu *pmu) + mb(); + write_mmcr0(cpuhw, mmcr0); + ++ if (ppmu->flags & PPMU_ARCH_207S) ++ mtspr(SPRN_MMCR2, 0); ++ + /* + * Enable instruction sampling if necessary + */ +@@ -1547,7 +1565,7 @@ static int power_pmu_event_init(struct perf_event *event) + + if (has_branch_stack(event)) { + /* PMU has BHRB enabled */ +- if (!(ppmu->flags & PPMU_BHRB)) ++ if (!(ppmu->flags & PPMU_ARCH_207S)) + return -EOPNOTSUPP; + } + +diff --git a/arch/powerpc/perf/power8-pmu.c b/arch/powerpc/perf/power8-pmu.c +index a3f7abd2f13f..79b7e200c0e7 100644 +--- a/arch/powerpc/perf/power8-pmu.c ++++ b/arch/powerpc/perf/power8-pmu.c +@@ -608,7 +608,7 @@ static struct power_pmu power8_pmu = { + .get_constraint = power8_get_constraint, + .get_alternatives = power8_get_alternatives, + .disable_pmc = power8_disable_pmc, +- .flags = PPMU_HAS_SSLOT | PPMU_HAS_SIER | PPMU_BHRB | PPMU_EBB, ++ .flags = PPMU_HAS_SSLOT | PPMU_HAS_SIER | PPMU_ARCH_207S, + .n_generic = ARRAY_SIZE(power8_generic_events), + .generic_events = power8_generic_events, + .attr_groups = power8_pmu_attr_groups, +diff --git a/arch/powerpc/platforms/pseries/eeh_pseries.c b/arch/powerpc/platforms/pseries/eeh_pseries.c +index 7fbc25b1813f..74448701b636 100644 +--- a/arch/powerpc/platforms/pseries/eeh_pseries.c ++++ b/arch/powerpc/platforms/pseries/eeh_pseries.c +@@ -461,6 +461,7 @@ static int pseries_eeh_get_state(struct eeh_pe *pe, int *state) + } else { + result = EEH_STATE_NOT_SUPPORT; + } ++ break; + default: + result = EEH_STATE_NOT_SUPPORT; + } +diff --git a/arch/x86/crypto/sha512_ssse3_glue.c b/arch/x86/crypto/sha512_ssse3_glue.c +index f30cd10293f0..8626b03e83b7 100644 +--- a/arch/x86/crypto/sha512_ssse3_glue.c ++++ b/arch/x86/crypto/sha512_ssse3_glue.c +@@ -141,7 +141,7 @@ static int sha512_ssse3_final(struct shash_desc *desc, u8 *out) + + /* save number of bits */ + bits[1] = cpu_to_be64(sctx->count[0] << 3); +- bits[0] = cpu_to_be64(sctx->count[1] << 3) | sctx->count[0] >> 61; ++ bits[0] = cpu_to_be64(sctx->count[1] << 3 | sctx->count[0] >> 61); + + /* Pad out to 112 mod 128 and append length */ + index = sctx->count[0] & 0x7f; +diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h +index c76ff74a98f2..694851592399 100644 +--- a/arch/x86/include/asm/kvm_host.h ++++ b/arch/x86/include/asm/kvm_host.h +@@ -92,7 +92,7 @@ + #define KVM_REFILL_PAGES 25 + #define KVM_MAX_CPUID_ENTRIES 80 + #define KVM_NR_FIXED_MTRR_REGION 88 +-#define KVM_NR_VAR_MTRR 8 ++#define KVM_NR_VAR_MTRR 10 + + #define ASYNC_PF_PER_VCPU 64 + +@@ -455,7 +455,7 @@ struct kvm_vcpu_arch { + bool nmi_injected; /* Trying to inject an NMI this entry */ + + struct mtrr_state_type mtrr_state; +- u32 pat; ++ u64 pat; + + int switch_db_regs; + unsigned long db[KVM_NR_DB_REGS]; +diff --git a/arch/x86/include/asm/ptrace.h b/arch/x86/include/asm/ptrace.h +index 942a08623a1a..68e9f007cd4a 100644 +--- a/arch/x86/include/asm/ptrace.h ++++ b/arch/x86/include/asm/ptrace.h +@@ -232,6 +232,22 @@ static inline unsigned long regs_get_kernel_stack_nth(struct pt_regs *regs, + + #define ARCH_HAS_USER_SINGLE_STEP_INFO + ++/* ++ * When hitting ptrace_stop(), we cannot return using SYSRET because ++ * that does not restore the full CPU state, only a minimal set. The ++ * ptracer can change arbitrary register values, which is usually okay ++ * because the usual ptrace stops run off the signal delivery path which ++ * forces IRET; however, ptrace_event() stops happen in arbitrary places ++ * in the kernel and don't force IRET path. ++ * ++ * So force IRET path after a ptrace stop. ++ */ ++#define arch_ptrace_stop_needed(code, info) \ ++({ \ ++ set_thread_flag(TIF_NOTIFY_RESUME); \ ++ false; \ ++}) ++ + struct user_desc; + extern int do_get_thread_area(struct task_struct *p, int idx, + struct user_desc __user *info); +diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c +index 799580cabc78..94bd24771812 100644 +--- a/arch/x86/mm/ioremap.c ++++ b/arch/x86/mm/ioremap.c +@@ -50,6 +50,21 @@ int ioremap_change_attr(unsigned long vaddr, unsigned long size, + return err; + } + ++static int __ioremap_check_ram(unsigned long start_pfn, unsigned long nr_pages, ++ void *arg) ++{ ++ unsigned long i; ++ ++ for (i = 0; i < nr_pages; ++i) ++ if (pfn_valid(start_pfn + i) && ++ !PageReserved(pfn_to_page(start_pfn + i))) ++ return 1; ++ ++ WARN_ONCE(1, "ioremap on RAM pfn 0x%lx\n", start_pfn); ++ ++ return 0; ++} ++ + /* + * Remap an arbitrary physical address space into the kernel virtual + * address space. Needed when the kernel wants to access high addresses +@@ -93,14 +108,11 @@ static void __iomem *__ioremap_caller(resource_size_t phys_addr, + /* + * Don't allow anybody to remap normal RAM that we're using.. + */ ++ pfn = phys_addr >> PAGE_SHIFT; + last_pfn = last_addr >> PAGE_SHIFT; +- for (pfn = phys_addr >> PAGE_SHIFT; pfn <= last_pfn; pfn++) { +- int is_ram = page_is_ram(pfn); +- +- if (is_ram && pfn_valid(pfn) && !PageReserved(pfn_to_page(pfn))) +- return NULL; +- WARN_ON_ONCE(is_ram); +- } ++ if (walk_system_ram_range(pfn, last_pfn - pfn + 1, NULL, ++ __ioremap_check_ram) == 1) ++ return NULL; + + /* + * Mappings have to be page-aligned +diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c +index 4e491d9b5292..dd0dd2d4ceca 100644 +--- a/block/blk-cgroup.c ++++ b/block/blk-cgroup.c +@@ -80,7 +80,7 @@ static struct blkcg_gq *blkg_alloc(struct blkcg *blkcg, struct request_queue *q, + blkg->q = q; + INIT_LIST_HEAD(&blkg->q_node); + blkg->blkcg = blkcg; +- blkg->refcnt = 1; ++ atomic_set(&blkg->refcnt, 1); + + /* root blkg uses @q->root_rl, init rl only for !root blkgs */ + if (blkcg != &blkcg_root) { +@@ -399,11 +399,8 @@ void __blkg_release_rcu(struct rcu_head *rcu_head) + + /* release the blkcg and parent blkg refs this blkg has been holding */ + css_put(&blkg->blkcg->css); +- if (blkg->parent) { +- spin_lock_irq(blkg->q->queue_lock); ++ if (blkg->parent) + blkg_put(blkg->parent); +- spin_unlock_irq(blkg->q->queue_lock); +- } + + blkg_free(blkg); + } +diff --git a/block/blk-cgroup.h b/block/blk-cgroup.h +index 2e34c386d760..f1c1cfc92f41 100644 +--- a/block/blk-cgroup.h ++++ b/block/blk-cgroup.h +@@ -18,6 +18,7 @@ + #include <linux/seq_file.h> + #include <linux/radix-tree.h> + #include <linux/blkdev.h> ++#include <linux/atomic.h> + + /* Max limits for throttle policy */ + #define THROTL_IOPS_MAX UINT_MAX +@@ -104,7 +105,7 @@ struct blkcg_gq { + struct request_list rl; + + /* reference count */ +- int refcnt; ++ atomic_t refcnt; + + /* is this blkg online? protected by both blkcg and q locks */ + bool online; +@@ -253,13 +254,12 @@ static inline int blkg_path(struct blkcg_gq *blkg, char *buf, int buflen) + * blkg_get - get a blkg reference + * @blkg: blkg to get + * +- * The caller should be holding queue_lock and an existing reference. ++ * The caller should be holding an existing reference. + */ + static inline void blkg_get(struct blkcg_gq *blkg) + { +- lockdep_assert_held(blkg->q->queue_lock); +- WARN_ON_ONCE(!blkg->refcnt); +- blkg->refcnt++; ++ WARN_ON_ONCE(atomic_read(&blkg->refcnt) <= 0); ++ atomic_inc(&blkg->refcnt); + } + + void __blkg_release_rcu(struct rcu_head *rcu); +@@ -267,14 +267,11 @@ void __blkg_release_rcu(struct rcu_head *rcu); + /** + * blkg_put - put a blkg reference + * @blkg: blkg to put +- * +- * The caller should be holding queue_lock. + */ + static inline void blkg_put(struct blkcg_gq *blkg) + { +- lockdep_assert_held(blkg->q->queue_lock); +- WARN_ON_ONCE(blkg->refcnt <= 0); +- if (!--blkg->refcnt) ++ WARN_ON_ONCE(atomic_read(&blkg->refcnt) <= 0); ++ if (atomic_dec_and_test(&blkg->refcnt)) + call_rcu(&blkg->rcu_head, __blkg_release_rcu); + } + +diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c +index ffa5af4c221a..a59d3d3fbcdc 100644 +--- a/drivers/acpi/battery.c ++++ b/drivers/acpi/battery.c +@@ -34,6 +34,7 @@ + #include <linux/dmi.h> + #include <linux/slab.h> + #include <linux/suspend.h> ++#include <linux/delay.h> + #include <asm/unaligned.h> + + #ifdef CONFIG_ACPI_PROCFS_POWER +@@ -1071,6 +1072,28 @@ static struct dmi_system_id bat_dmi_table[] = { + {}, + }; + ++/* ++ * Some machines'(E,G Lenovo Z480) ECs are not stable ++ * during boot up and this causes battery driver fails to be ++ * probed due to failure of getting battery information ++ * from EC sometimes. After several retries, the operation ++ * may work. So add retry code here and 20ms sleep between ++ * every retries. ++ */ ++static int acpi_battery_update_retry(struct acpi_battery *battery) ++{ ++ int retry, ret; ++ ++ for (retry = 5; retry; retry--) { ++ ret = acpi_battery_update(battery); ++ if (!ret) ++ break; ++ ++ msleep(20); ++ } ++ return ret; ++} ++ + static int acpi_battery_add(struct acpi_device *device) + { + int result = 0; +@@ -1089,9 +1112,11 @@ static int acpi_battery_add(struct acpi_device *device) + mutex_init(&battery->sysfs_lock); + if (acpi_has_method(battery->device->handle, "_BIX")) + set_bit(ACPI_BATTERY_XINFO_PRESENT, &battery->flags); +- result = acpi_battery_update(battery); ++ ++ result = acpi_battery_update_retry(battery); + if (result) + goto fail; ++ + #ifdef CONFIG_ACPI_PROCFS_POWER + result = acpi_battery_add_fs(device); + #endif +diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c +index 51b700838f64..7171d52e12ca 100644 +--- a/drivers/acpi/ec.c ++++ b/drivers/acpi/ec.c +@@ -81,6 +81,9 @@ enum { + EC_FLAGS_BLOCKED, /* Transactions are blocked */ + }; + ++#define ACPI_EC_COMMAND_POLL 0x01 /* Available for command byte */ ++#define ACPI_EC_COMMAND_COMPLETE 0x02 /* Completed last byte */ ++ + /* ec.c is compiled in acpi namespace so this shows up as acpi.ec_delay param */ + static unsigned int ec_delay __read_mostly = ACPI_EC_DELAY; + module_param(ec_delay, uint, 0644); +@@ -116,7 +119,7 @@ struct transaction { + u8 ri; + u8 wlen; + u8 rlen; +- bool done; ++ u8 flags; + }; + + struct acpi_ec *boot_ec, *first_ec; +@@ -157,60 +160,74 @@ static inline void acpi_ec_write_data(struct acpi_ec *ec, u8 data) + outb(data, ec->data_addr); + } + +-static int ec_transaction_done(struct acpi_ec *ec) ++static int ec_transaction_completed(struct acpi_ec *ec) + { + unsigned long flags; + int ret = 0; + spin_lock_irqsave(&ec->lock, flags); +- if (!ec->curr || ec->curr->done) ++ if (ec->curr && (ec->curr->flags & ACPI_EC_COMMAND_COMPLETE)) + ret = 1; + spin_unlock_irqrestore(&ec->lock, flags); + return ret; + } + +-static void start_transaction(struct acpi_ec *ec) ++static bool advance_transaction(struct acpi_ec *ec) + { +- ec->curr->irq_count = ec->curr->wi = ec->curr->ri = 0; +- ec->curr->done = false; +- acpi_ec_write_cmd(ec, ec->curr->command); +-} +- +-static void advance_transaction(struct acpi_ec *ec, u8 status) +-{ +- unsigned long flags; + struct transaction *t; ++ u8 status; ++ bool wakeup = false; + +- spin_lock_irqsave(&ec->lock, flags); ++ pr_debug("===== %s =====\n", in_interrupt() ? "IRQ" : "TASK"); ++ status = acpi_ec_read_status(ec); + t = ec->curr; + if (!t) +- goto unlock; +- if (t->wlen > t->wi) { +- if ((status & ACPI_EC_FLAG_IBF) == 0) +- acpi_ec_write_data(ec, +- t->wdata[t->wi++]); +- else +- goto err; +- } else if (t->rlen > t->ri) { +- if ((status & ACPI_EC_FLAG_OBF) == 1) { +- t->rdata[t->ri++] = acpi_ec_read_data(ec); +- if (t->rlen == t->ri) +- t->done = true; ++ goto err; ++ if (t->flags & ACPI_EC_COMMAND_POLL) { ++ if (t->wlen > t->wi) { ++ if ((status & ACPI_EC_FLAG_IBF) == 0) ++ acpi_ec_write_data(ec, t->wdata[t->wi++]); ++ else ++ goto err; ++ } else if (t->rlen > t->ri) { ++ if ((status & ACPI_EC_FLAG_OBF) == 1) { ++ t->rdata[t->ri++] = acpi_ec_read_data(ec); ++ if (t->rlen == t->ri) { ++ t->flags |= ACPI_EC_COMMAND_COMPLETE; ++ wakeup = true; ++ } ++ } else ++ goto err; ++ } else if (t->wlen == t->wi && ++ (status & ACPI_EC_FLAG_IBF) == 0) { ++ t->flags |= ACPI_EC_COMMAND_COMPLETE; ++ wakeup = true; ++ } ++ return wakeup; ++ } else { ++ if ((status & ACPI_EC_FLAG_IBF) == 0) { ++ acpi_ec_write_cmd(ec, t->command); ++ t->flags |= ACPI_EC_COMMAND_POLL; + } else + goto err; +- } else if (t->wlen == t->wi && +- (status & ACPI_EC_FLAG_IBF) == 0) +- t->done = true; +- goto unlock; ++ return wakeup; ++ } + err: + /* + * If SCI bit is set, then don't think it's a false IRQ + * otherwise will take a not handled IRQ as a false one. + */ +- if (in_interrupt() && !(status & ACPI_EC_FLAG_SCI)) +- ++t->irq_count; ++ if (!(status & ACPI_EC_FLAG_SCI)) { ++ if (in_interrupt() && t) ++ ++t->irq_count; ++ } ++ return wakeup; ++} + +-unlock: +- spin_unlock_irqrestore(&ec->lock, flags); ++static void start_transaction(struct acpi_ec *ec) ++{ ++ ec->curr->irq_count = ec->curr->wi = ec->curr->ri = 0; ++ ec->curr->flags = 0; ++ (void)advance_transaction(ec); + } + + static int acpi_ec_sync_query(struct acpi_ec *ec, u8 *data); +@@ -235,15 +252,17 @@ static int ec_poll(struct acpi_ec *ec) + /* don't sleep with disabled interrupts */ + if (EC_FLAGS_MSI || irqs_disabled()) { + udelay(ACPI_EC_MSI_UDELAY); +- if (ec_transaction_done(ec)) ++ if (ec_transaction_completed(ec)) + return 0; + } else { + if (wait_event_timeout(ec->wait, +- ec_transaction_done(ec), ++ ec_transaction_completed(ec), + msecs_to_jiffies(1))) + return 0; + } +- advance_transaction(ec, acpi_ec_read_status(ec)); ++ spin_lock_irqsave(&ec->lock, flags); ++ (void)advance_transaction(ec); ++ spin_unlock_irqrestore(&ec->lock, flags); + } while (time_before(jiffies, delay)); + pr_debug(PREFIX "controller reset, restart transaction\n"); + spin_lock_irqsave(&ec->lock, flags); +@@ -275,23 +294,6 @@ static int acpi_ec_transaction_unlocked(struct acpi_ec *ec, + return ret; + } + +-static int ec_check_ibf0(struct acpi_ec *ec) +-{ +- u8 status = acpi_ec_read_status(ec); +- return (status & ACPI_EC_FLAG_IBF) == 0; +-} +- +-static int ec_wait_ibf0(struct acpi_ec *ec) +-{ +- unsigned long delay = jiffies + msecs_to_jiffies(ec_delay); +- /* interrupt wait manually if GPE mode is not active */ +- while (time_before(jiffies, delay)) +- if (wait_event_timeout(ec->wait, ec_check_ibf0(ec), +- msecs_to_jiffies(1))) +- return 0; +- return -ETIME; +-} +- + static int acpi_ec_transaction(struct acpi_ec *ec, struct transaction *t) + { + int status; +@@ -312,12 +314,6 @@ static int acpi_ec_transaction(struct acpi_ec *ec, struct transaction *t) + goto unlock; + } + } +- if (ec_wait_ibf0(ec)) { +- pr_err(PREFIX "input buffer is not empty, " +- "aborting transaction\n"); +- status = -ETIME; +- goto end; +- } + pr_debug(PREFIX "transaction start (cmd=0x%02x, addr=0x%02x)\n", + t->command, t->wdata ? t->wdata[0] : 0); + /* disable GPE during transaction if storm is detected */ +@@ -341,7 +337,6 @@ static int acpi_ec_transaction(struct acpi_ec *ec, struct transaction *t) + set_bit(EC_FLAGS_GPE_STORM, &ec->flags); + } + pr_debug(PREFIX "transaction end\n"); +-end: + if (ec->global_lock) + acpi_release_global_lock(glk); + unlock: +@@ -661,17 +656,14 @@ static int ec_check_sci(struct acpi_ec *ec, u8 state) + static u32 acpi_ec_gpe_handler(acpi_handle gpe_device, + u32 gpe_number, void *data) + { ++ unsigned long flags; + struct acpi_ec *ec = data; +- u8 status = acpi_ec_read_status(ec); + +- pr_debug(PREFIX "~~~> interrupt, status:0x%02x\n", status); +- +- advance_transaction(ec, status); +- if (ec_transaction_done(ec) && +- (acpi_ec_read_status(ec) & ACPI_EC_FLAG_IBF) == 0) { ++ spin_lock_irqsave(&ec->lock, flags); ++ if (advance_transaction(ec)) + wake_up(&ec->wait); +- ec_check_sci(ec, acpi_ec_read_status(ec)); +- } ++ spin_unlock_irqrestore(&ec->lock, flags); ++ ec_check_sci(ec, acpi_ec_read_status(ec)); + return ACPI_INTERRUPT_HANDLED | ACPI_REENABLE_GPE; + } + +diff --git a/drivers/base/dma-contiguous.c b/drivers/base/dma-contiguous.c +index 99802d6f3c60..e057744150ea 100644 +--- a/drivers/base/dma-contiguous.c ++++ b/drivers/base/dma-contiguous.c +@@ -155,13 +155,23 @@ static int __init cma_activate_area(struct cma *cma) + base_pfn = pfn; + for (j = pageblock_nr_pages; j; --j, pfn++) { + WARN_ON_ONCE(!pfn_valid(pfn)); ++ /* ++ * alloc_contig_range requires the pfn range ++ * specified to be in the same zone. Make this ++ * simple by forcing the entire CMA resv range ++ * to be in the same zone. ++ */ + if (page_zone(pfn_to_page(pfn)) != zone) +- return -EINVAL; ++ goto err; + } + init_cma_reserved_pageblock(pfn_to_page(base_pfn)); + } while (--i); + + return 0; ++ ++err: ++ kfree(cma->bitmap); ++ return -EINVAL; + } + + static struct cma cma_areas[MAX_CMA_AREAS]; +diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c +index 4d26c25aa9c5..560227b817fe 100644 +--- a/drivers/block/mtip32xx/mtip32xx.c ++++ b/drivers/block/mtip32xx/mtip32xx.c +@@ -1493,6 +1493,37 @@ static inline void ata_swap_string(u16 *buf, unsigned int len) + be16_to_cpus(&buf[i]); + } + ++static void mtip_set_timeout(struct driver_data *dd, ++ struct host_to_dev_fis *fis, ++ unsigned int *timeout, u8 erasemode) ++{ ++ switch (fis->command) { ++ case ATA_CMD_DOWNLOAD_MICRO: ++ *timeout = 120000; /* 2 minutes */ ++ break; ++ case ATA_CMD_SEC_ERASE_UNIT: ++ case 0xFC: ++ if (erasemode) ++ *timeout = ((*(dd->port->identify + 90) * 2) * 60000); ++ else ++ *timeout = ((*(dd->port->identify + 89) * 2) * 60000); ++ break; ++ case ATA_CMD_STANDBYNOW1: ++ *timeout = 120000; /* 2 minutes */ ++ break; ++ case 0xF7: ++ case 0xFA: ++ *timeout = 60000; /* 60 seconds */ ++ break; ++ case ATA_CMD_SMART: ++ *timeout = 15000; /* 15 seconds */ ++ break; ++ default: ++ *timeout = MTIP_IOCTL_COMMAND_TIMEOUT_MS; ++ break; ++ } ++} ++ + /* + * Request the device identity information. + * +@@ -1602,6 +1633,7 @@ static int mtip_standby_immediate(struct mtip_port *port) + int rv; + struct host_to_dev_fis fis; + unsigned long start; ++ unsigned int timeout; + + /* Build the FIS. */ + memset(&fis, 0, sizeof(struct host_to_dev_fis)); +@@ -1609,6 +1641,8 @@ static int mtip_standby_immediate(struct mtip_port *port) + fis.opts = 1 << 7; + fis.command = ATA_CMD_STANDBYNOW1; + ++ mtip_set_timeout(port->dd, &fis, &timeout, 0); ++ + start = jiffies; + rv = mtip_exec_internal_command(port, + &fis, +@@ -1617,7 +1651,7 @@ static int mtip_standby_immediate(struct mtip_port *port) + 0, + 0, + GFP_ATOMIC, +- 15000); ++ timeout); + dbg_printk(MTIP_DRV_NAME "Time taken to complete standby cmd: %d ms\n", + jiffies_to_msecs(jiffies - start)); + if (rv) +@@ -2156,36 +2190,6 @@ static unsigned int implicit_sector(unsigned char command, + } + return rv; + } +-static void mtip_set_timeout(struct driver_data *dd, +- struct host_to_dev_fis *fis, +- unsigned int *timeout, u8 erasemode) +-{ +- switch (fis->command) { +- case ATA_CMD_DOWNLOAD_MICRO: +- *timeout = 120000; /* 2 minutes */ +- break; +- case ATA_CMD_SEC_ERASE_UNIT: +- case 0xFC: +- if (erasemode) +- *timeout = ((*(dd->port->identify + 90) * 2) * 60000); +- else +- *timeout = ((*(dd->port->identify + 89) * 2) * 60000); +- break; +- case ATA_CMD_STANDBYNOW1: +- *timeout = 120000; /* 2 minutes */ +- break; +- case 0xF7: +- case 0xFA: +- *timeout = 60000; /* 60 seconds */ +- break; +- case ATA_CMD_SMART: +- *timeout = 15000; /* 15 seconds */ +- break; +- default: +- *timeout = MTIP_IOCTL_COMMAND_TIMEOUT_MS; +- break; +- } +-} + + /* + * Executes a taskfile +@@ -4285,6 +4289,57 @@ static DEFINE_HANDLER(5); + static DEFINE_HANDLER(6); + static DEFINE_HANDLER(7); + ++static void mtip_disable_link_opts(struct driver_data *dd, struct pci_dev *pdev) ++{ ++ int pos; ++ unsigned short pcie_dev_ctrl; ++ ++ pos = pci_find_capability(pdev, PCI_CAP_ID_EXP); ++ if (pos) { ++ pci_read_config_word(pdev, ++ pos + PCI_EXP_DEVCTL, ++ &pcie_dev_ctrl); ++ if (pcie_dev_ctrl & (1 << 11) || ++ pcie_dev_ctrl & (1 << 4)) { ++ dev_info(&dd->pdev->dev, ++ "Disabling ERO/No-Snoop on bridge device %04x:%04x\n", ++ pdev->vendor, pdev->device); ++ pcie_dev_ctrl &= ~(PCI_EXP_DEVCTL_NOSNOOP_EN | ++ PCI_EXP_DEVCTL_RELAX_EN); ++ pci_write_config_word(pdev, ++ pos + PCI_EXP_DEVCTL, ++ pcie_dev_ctrl); ++ } ++ } ++} ++ ++static void mtip_fix_ero_nosnoop(struct driver_data *dd, struct pci_dev *pdev) ++{ ++ /* ++ * This workaround is specific to AMD/ATI chipset with a PCI upstream ++ * device with device id 0x5aXX ++ */ ++ if (pdev->bus && pdev->bus->self) { ++ if (pdev->bus->self->vendor == PCI_VENDOR_ID_ATI && ++ ((pdev->bus->self->device & 0xff00) == 0x5a00)) { ++ mtip_disable_link_opts(dd, pdev->bus->self); ++ } else { ++ /* Check further up the topology */ ++ struct pci_dev *parent_dev = pdev->bus->self; ++ if (parent_dev->bus && ++ parent_dev->bus->parent && ++ parent_dev->bus->parent->self && ++ parent_dev->bus->parent->self->vendor == ++ PCI_VENDOR_ID_ATI && ++ (parent_dev->bus->parent->self->device & ++ 0xff00) == 0x5a00) { ++ mtip_disable_link_opts(dd, ++ parent_dev->bus->parent->self); ++ } ++ } ++ } ++} ++ + /* + * Called for each supported PCI device detected. + * +@@ -4436,6 +4491,8 @@ static int mtip_pci_probe(struct pci_dev *pdev, + goto block_initialize_err; + } + ++ mtip_fix_ero_nosnoop(dd, pdev); ++ + /* Initialize the block layer. */ + rv = mtip_block_initialize(dd); + if (rv < 0) { +@@ -4728,13 +4785,13 @@ static int __init mtip_init(void) + */ + static void __exit mtip_exit(void) + { +- debugfs_remove_recursive(dfs_parent); +- + /* Release the allocated major block device number. */ + unregister_blkdev(mtip_major, MTIP_DRV_NAME); + + /* Unregister the PCI driver. */ + pci_unregister_driver(&mtip_pci_driver); ++ ++ debugfs_remove_recursive(dfs_parent); + } + + MODULE_AUTHOR("Micron Technology, Inc"); +diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c +index db60c91804c3..aeeb62e0981a 100644 +--- a/drivers/block/rbd.c ++++ b/drivers/block/rbd.c +@@ -1379,6 +1379,14 @@ static bool obj_request_exists_test(struct rbd_obj_request *obj_request) + return test_bit(OBJ_REQ_EXISTS, &obj_request->flags) != 0; + } + ++static bool obj_request_overlaps_parent(struct rbd_obj_request *obj_request) ++{ ++ struct rbd_device *rbd_dev = obj_request->img_request->rbd_dev; ++ ++ return obj_request->img_offset < ++ round_up(rbd_dev->parent_overlap, rbd_obj_bytes(&rbd_dev->header)); ++} ++ + static void rbd_obj_request_get(struct rbd_obj_request *obj_request) + { + dout("%s: obj %p (was %d)\n", __func__, obj_request, +@@ -1395,6 +1403,13 @@ static void rbd_obj_request_put(struct rbd_obj_request *obj_request) + kref_put(&obj_request->kref, rbd_obj_request_destroy); + } + ++static void rbd_img_request_get(struct rbd_img_request *img_request) ++{ ++ dout("%s: img %p (was %d)\n", __func__, img_request, ++ atomic_read(&img_request->kref.refcount)); ++ kref_get(&img_request->kref); ++} ++ + static bool img_request_child_test(struct rbd_img_request *img_request); + static void rbd_parent_request_destroy(struct kref *kref); + static void rbd_img_request_destroy(struct kref *kref); +@@ -2148,6 +2163,7 @@ static void rbd_img_obj_callback(struct rbd_obj_request *obj_request) + img_request->next_completion = which; + out: + spin_unlock_irq(&img_request->completion_lock); ++ rbd_img_request_put(img_request); + + if (!more) + rbd_img_request_complete(img_request); +@@ -2244,6 +2260,7 @@ static int rbd_img_request_fill(struct rbd_img_request *img_request, + goto out_partial; + obj_request->osd_req = osd_req; + obj_request->callback = rbd_img_obj_callback; ++ rbd_img_request_get(img_request); + + osd_req_op_extent_init(osd_req, 0, opcode, offset, length, + 0, 0); +@@ -2666,7 +2683,7 @@ static int rbd_img_obj_request_submit(struct rbd_obj_request *obj_request) + */ + if (!img_request_write_test(img_request) || + !img_request_layered_test(img_request) || +- rbd_dev->parent_overlap <= obj_request->img_offset || ++ !obj_request_overlaps_parent(obj_request) || + ((known = obj_request_known_test(obj_request)) && + obj_request_exists_test(obj_request))) { + +diff --git a/drivers/clk/clk-s2mps11.c b/drivers/clk/clk-s2mps11.c +index aa21299ec7d2..bea59229a037 100644 +--- a/drivers/clk/clk-s2mps11.c ++++ b/drivers/clk/clk-s2mps11.c +@@ -190,16 +190,13 @@ static int s2mps11_clk_probe(struct platform_device *pdev) + goto err_reg; + } + +- s2mps11_clk->lookup = devm_kzalloc(&pdev->dev, +- sizeof(struct clk_lookup), GFP_KERNEL); ++ s2mps11_clk->lookup = clkdev_alloc(s2mps11_clk->clk, ++ s2mps11_name(s2mps11_clk), NULL); + if (!s2mps11_clk->lookup) { + ret = -ENOMEM; + goto err_lup; + } + +- s2mps11_clk->lookup->con_id = s2mps11_name(s2mps11_clk); +- s2mps11_clk->lookup->clk = s2mps11_clk->clk; +- + clkdev_add(s2mps11_clk->lookup); + } + +diff --git a/drivers/clk/spear/spear3xx_clock.c b/drivers/clk/spear/spear3xx_clock.c +index c2d204315546..125eba86c844 100644 +--- a/drivers/clk/spear/spear3xx_clock.c ++++ b/drivers/clk/spear/spear3xx_clock.c +@@ -211,7 +211,7 @@ static inline void spear310_clk_init(void) { } + /* array of all spear 320 clock lookups */ + #ifdef CONFIG_MACH_SPEAR320 + +-#define SPEAR320_CONTROL_REG (soc_config_base + 0x0000) ++#define SPEAR320_CONTROL_REG (soc_config_base + 0x0010) + #define SPEAR320_EXT_CTRL_REG (soc_config_base + 0x0018) + + #define SPEAR320_UARTX_PCLK_MASK 0x1 +diff --git a/drivers/cpufreq/Makefile b/drivers/cpufreq/Makefile +index ad5866c2ada0..c2df33ba23c2 100644 +--- a/drivers/cpufreq/Makefile ++++ b/drivers/cpufreq/Makefile +@@ -50,7 +50,7 @@ obj-$(CONFIG_ARM_BIG_LITTLE_CPUFREQ) += arm_big_little.o + # LITTLE drivers, so that it is probed last. + obj-$(CONFIG_ARM_DT_BL_CPUFREQ) += arm_big_little_dt.o + +-obj-$(CONFIG_ARCH_DAVINCI_DA850) += davinci-cpufreq.o ++obj-$(CONFIG_ARCH_DAVINCI) += davinci-cpufreq.o + obj-$(CONFIG_UX500_SOC_DB8500) += dbx500-cpufreq.o + obj-$(CONFIG_ARM_EXYNOS_CPUFREQ) += exynos-cpufreq.o + obj-$(CONFIG_ARM_EXYNOS4210_CPUFREQ) += exynos4210-cpufreq.o +diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c +index d5dc567efd96..f033fadb58e6 100644 +--- a/drivers/cpufreq/intel_pstate.c ++++ b/drivers/cpufreq/intel_pstate.c +@@ -550,6 +550,7 @@ static int intel_pstate_init_cpu(unsigned int cpunum) + + cpu = all_cpu_data[cpunum]; + ++ cpu->cpu = cpunum; + intel_pstate_get_cpu_pstates(cpu); + if (!cpu->pstate.current_pstate) { + all_cpu_data[cpunum] = NULL; +@@ -557,7 +558,6 @@ static int intel_pstate_init_cpu(unsigned int cpunum) + return -ENODATA; + } + +- cpu->cpu = cpunum; + cpu->pstate_policy = + (struct pstate_adjust_policy *)id->driver_data; + init_timer_deferrable(&cpu->timer); +diff --git a/drivers/gpu/drm/i915/i915_gem_stolen.c b/drivers/gpu/drm/i915/i915_gem_stolen.c +index c60cdf9e581e..5cd69a7cc241 100644 +--- a/drivers/gpu/drm/i915/i915_gem_stolen.c ++++ b/drivers/gpu/drm/i915/i915_gem_stolen.c +@@ -74,6 +74,50 @@ static unsigned long i915_stolen_to_physical(struct drm_device *dev) + if (base == 0) + return 0; + ++ /* make sure we don't clobber the GTT if it's within stolen memory */ ++ if (INTEL_INFO(dev)->gen <= 4 && !IS_G33(dev) && !IS_G4X(dev)) { ++ struct { ++ u32 start, end; ++ } stolen[2] = { ++ { .start = base, .end = base + dev_priv->gtt.stolen_size, }, ++ { .start = base, .end = base + dev_priv->gtt.stolen_size, }, ++ }; ++ u64 gtt_start, gtt_end; ++ ++ gtt_start = I915_READ(PGTBL_CTL); ++ if (IS_GEN4(dev)) ++ gtt_start = (gtt_start & PGTBL_ADDRESS_LO_MASK) | ++ (gtt_start & PGTBL_ADDRESS_HI_MASK) << 28; ++ else ++ gtt_start &= PGTBL_ADDRESS_LO_MASK; ++ gtt_end = gtt_start + gtt_total_entries(dev_priv->gtt) * 4; ++ ++ if (gtt_start >= stolen[0].start && gtt_start < stolen[0].end) ++ stolen[0].end = gtt_start; ++ if (gtt_end > stolen[1].start && gtt_end <= stolen[1].end) ++ stolen[1].start = gtt_end; ++ ++ /* pick the larger of the two chunks */ ++ if (stolen[0].end - stolen[0].start > ++ stolen[1].end - stolen[1].start) { ++ base = stolen[0].start; ++ dev_priv->gtt.stolen_size = stolen[0].end - stolen[0].start; ++ } else { ++ base = stolen[1].start; ++ dev_priv->gtt.stolen_size = stolen[1].end - stolen[1].start; ++ } ++ ++ if (stolen[0].start != stolen[1].start || ++ stolen[0].end != stolen[1].end) { ++ DRM_DEBUG_KMS("GTT within stolen memory at 0x%llx-0x%llx\n", ++ (unsigned long long) gtt_start, ++ (unsigned long long) gtt_end - 1); ++ DRM_DEBUG_KMS("Stolen memory adjusted to 0x%x-0x%x\n", ++ base, base + (u32) dev_priv->gtt.stolen_size - 1); ++ } ++ } ++ ++ + /* Verify that nothing else uses this physical address. Stolen + * memory should be reserved by the BIOS and hidden from the + * kernel. So if the region is already marked as busy, something +diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h +index 375abe708268..998f774b5fff 100644 +--- a/drivers/gpu/drm/i915/i915_reg.h ++++ b/drivers/gpu/drm/i915/i915_reg.h +@@ -570,6 +570,9 @@ + /* + * Instruction and interrupt control regs + */ ++#define PGTBL_CTL 0x02020 ++#define PGTBL_ADDRESS_LO_MASK 0xfffff000 /* bits [31:12] */ ++#define PGTBL_ADDRESS_HI_MASK 0x000000f0 /* bits [35:32] (gen4) */ + #define PGTBL_ER 0x02024 + #define RENDER_RING_BASE 0x02000 + #define BSD_RING_BASE 0x04000 +diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c +index dcb652a6f924..ba8742ab85ee 100644 +--- a/drivers/gpu/drm/radeon/atombios_crtc.c ++++ b/drivers/gpu/drm/radeon/atombios_crtc.c +@@ -859,14 +859,16 @@ static void atombios_crtc_program_pll(struct drm_crtc *crtc, + args.v5.ucMiscInfo = 0; /* HDMI depth, etc. */ + if (ss_enabled && (ss->type & ATOM_EXTERNAL_SS_MASK)) + args.v5.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_REF_DIV_SRC; +- switch (bpc) { +- case 8: +- default: +- args.v5.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_HDMI_24BPP; +- break; +- case 10: +- args.v5.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_HDMI_30BPP; +- break; ++ if (encoder_mode == ATOM_ENCODER_MODE_HDMI) { ++ switch (bpc) { ++ case 8: ++ default: ++ args.v5.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_HDMI_24BPP; ++ break; ++ case 10: ++ args.v5.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_HDMI_30BPP; ++ break; ++ } + } + args.v5.ucTransmitterID = encoder_id; + args.v5.ucEncoderMode = encoder_mode; +@@ -881,20 +883,22 @@ static void atombios_crtc_program_pll(struct drm_crtc *crtc, + args.v6.ucMiscInfo = 0; /* HDMI depth, etc. */ + if (ss_enabled && (ss->type & ATOM_EXTERNAL_SS_MASK)) + args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_REF_DIV_SRC; +- switch (bpc) { +- case 8: +- default: +- args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_24BPP; +- break; +- case 10: +- args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_30BPP; +- break; +- case 12: +- args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_36BPP; +- break; +- case 16: +- args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_48BPP; +- break; ++ if (encoder_mode == ATOM_ENCODER_MODE_HDMI) { ++ switch (bpc) { ++ case 8: ++ default: ++ args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_24BPP; ++ break; ++ case 10: ++ args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_30BPP; ++ break; ++ case 12: ++ args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_36BPP; ++ break; ++ case 16: ++ args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_48BPP; ++ break; ++ } + } + args.v6.ucTransmitterID = encoder_id; + args.v6.ucEncoderMode = encoder_mode; +diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c +index 00885417ffff..4601969be373 100644 +--- a/drivers/gpu/drm/radeon/atombios_dp.c ++++ b/drivers/gpu/drm/radeon/atombios_dp.c +@@ -384,6 +384,19 @@ static int dp_get_max_dp_pix_clock(int link_rate, + + /***** radeon specific DP functions *****/ + ++static int radeon_dp_get_max_link_rate(struct drm_connector *connector, ++ u8 dpcd[DP_DPCD_SIZE]) ++{ ++ int max_link_rate; ++ ++ if (radeon_connector_is_dp12_capable(connector)) ++ max_link_rate = min(drm_dp_max_link_rate(dpcd), 540000); ++ else ++ max_link_rate = min(drm_dp_max_link_rate(dpcd), 270000); ++ ++ return max_link_rate; ++} ++ + /* First get the min lane# when low rate is used according to pixel clock + * (prefer low rate), second check max lane# supported by DP panel, + * if the max lane# < low rate lane# then use max lane# instead. +@@ -393,7 +406,7 @@ static int radeon_dp_get_dp_lane_number(struct drm_connector *connector, + int pix_clock) + { + int bpp = convert_bpc_to_bpp(radeon_get_monitor_bpc(connector)); +- int max_link_rate = drm_dp_max_link_rate(dpcd); ++ int max_link_rate = radeon_dp_get_max_link_rate(connector, dpcd); + int max_lane_num = drm_dp_max_lane_count(dpcd); + int lane_num; + int max_dp_pix_clock; +@@ -431,7 +444,7 @@ static int radeon_dp_get_dp_link_clock(struct drm_connector *connector, + return 540000; + } + +- return drm_dp_max_link_rate(dpcd); ++ return radeon_dp_get_max_link_rate(connector, dpcd); + } + + static u8 radeon_dp_encoder_service(struct radeon_device *rdev, +diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c +index 7bb7074a131f..583345636d4b 100644 +--- a/drivers/gpu/drm/radeon/atombios_encoders.c ++++ b/drivers/gpu/drm/radeon/atombios_encoders.c +@@ -1910,8 +1910,11 @@ atombios_set_encoder_crtc_source(struct drm_encoder *encoder) + args.v2.ucEncodeMode = ATOM_ENCODER_MODE_CRT; + else + args.v2.ucEncodeMode = atombios_get_encoder_mode(encoder); +- } else ++ } else if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT)) { ++ args.v2.ucEncodeMode = ATOM_ENCODER_MODE_LVDS; ++ } else { + args.v2.ucEncodeMode = atombios_get_encoder_mode(encoder); ++ } + switch (radeon_encoder->encoder_id) { + case ENCODER_OBJECT_ID_INTERNAL_UNIPHY: + case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1: +diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c +index 79682ff51b63..78e25d2e2fc4 100644 +--- a/drivers/gpu/drm/radeon/ci_dpm.c ++++ b/drivers/gpu/drm/radeon/ci_dpm.c +@@ -1130,7 +1130,7 @@ static int ci_stop_dpm(struct radeon_device *rdev) + tmp &= ~GLOBAL_PWRMGT_EN; + WREG32_SMC(GENERAL_PWRMGT, tmp); + +- tmp = RREG32(SCLK_PWRMGT_CNTL); ++ tmp = RREG32_SMC(SCLK_PWRMGT_CNTL); + tmp &= ~DYNAMIC_PM_EN; + WREG32_SMC(SCLK_PWRMGT_CNTL, tmp); + +diff --git a/drivers/gpu/drm/radeon/cikd.h b/drivers/gpu/drm/radeon/cikd.h +index 70e88498a1fd..9c8ef204a3cb 100644 +--- a/drivers/gpu/drm/radeon/cikd.h ++++ b/drivers/gpu/drm/radeon/cikd.h +@@ -1695,12 +1695,12 @@ + #define EOP_TC_WB_ACTION_EN (1 << 15) /* L2 */ + #define EOP_TCL1_ACTION_EN (1 << 16) + #define EOP_TC_ACTION_EN (1 << 17) /* L2 */ ++#define EOP_TCL2_VOLATILE (1 << 24) + #define EOP_CACHE_POLICY(x) ((x) << 25) + /* 0 - LRU + * 1 - Stream + * 2 - Bypass + */ +-#define EOP_TCL2_VOLATILE (1 << 27) + #define DATA_SEL(x) ((x) << 29) + /* 0 - discard + * 1 - send low 32bit data +diff --git a/drivers/gpu/drm/radeon/cypress_dpm.c b/drivers/gpu/drm/radeon/cypress_dpm.c +index 91bb470de0a3..7143783fb237 100644 +--- a/drivers/gpu/drm/radeon/cypress_dpm.c ++++ b/drivers/gpu/drm/radeon/cypress_dpm.c +@@ -1549,7 +1549,7 @@ int cypress_populate_smc_voltage_tables(struct radeon_device *rdev, + + table->voltageMaskTable.highMask[RV770_SMC_VOLTAGEMASK_VDDCI] = 0; + table->voltageMaskTable.lowMask[RV770_SMC_VOLTAGEMASK_VDDCI] = +- cpu_to_be32(eg_pi->vddc_voltage_table.mask_low); ++ cpu_to_be32(eg_pi->vddci_voltage_table.mask_low); + } + + return 0; +diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c +index e1b2470d3443..4564bb1ab837 100644 +--- a/drivers/gpu/drm/radeon/evergreen.c ++++ b/drivers/gpu/drm/radeon/evergreen.c +@@ -188,7 +188,7 @@ static const u32 evergreen_golden_registers[] = + 0x8c1c, 0xffffffff, 0x00001010, + 0x28350, 0xffffffff, 0x00000000, + 0xa008, 0xffffffff, 0x00010000, +- 0x5cc, 0xffffffff, 0x00000001, ++ 0x5c4, 0xffffffff, 0x00000001, + 0x9508, 0xffffffff, 0x00000002, + 0x913c, 0x0000000f, 0x0000000a + }; +@@ -475,7 +475,7 @@ static const u32 cedar_golden_registers[] = + 0x8c1c, 0xffffffff, 0x00001010, + 0x28350, 0xffffffff, 0x00000000, + 0xa008, 0xffffffff, 0x00010000, +- 0x5cc, 0xffffffff, 0x00000001, ++ 0x5c4, 0xffffffff, 0x00000001, + 0x9508, 0xffffffff, 0x00000002 + }; + +@@ -634,7 +634,7 @@ static const u32 juniper_mgcg_init[] = + static const u32 supersumo_golden_registers[] = + { + 0x5eb4, 0xffffffff, 0x00000002, +- 0x5cc, 0xffffffff, 0x00000001, ++ 0x5c4, 0xffffffff, 0x00000001, + 0x7030, 0xffffffff, 0x00000011, + 0x7c30, 0xffffffff, 0x00000011, + 0x6104, 0x01000300, 0x00000000, +@@ -718,7 +718,7 @@ static const u32 sumo_golden_registers[] = + static const u32 wrestler_golden_registers[] = + { + 0x5eb4, 0xffffffff, 0x00000002, +- 0x5cc, 0xffffffff, 0x00000001, ++ 0x5c4, 0xffffffff, 0x00000001, + 0x7030, 0xffffffff, 0x00000011, + 0x7c30, 0xffffffff, 0x00000011, + 0x6104, 0x01000300, 0x00000000, +diff --git a/drivers/gpu/drm/radeon/ni_dpm.c b/drivers/gpu/drm/radeon/ni_dpm.c +index db0fa617e2f5..85f36e702595 100644 +--- a/drivers/gpu/drm/radeon/ni_dpm.c ++++ b/drivers/gpu/drm/radeon/ni_dpm.c +@@ -1319,7 +1319,7 @@ static void ni_populate_smc_voltage_tables(struct radeon_device *rdev, + + table->voltageMaskTable.highMask[NISLANDS_SMC_VOLTAGEMASK_VDDCI] = 0; + table->voltageMaskTable.lowMask[NISLANDS_SMC_VOLTAGEMASK_VDDCI] = +- cpu_to_be32(eg_pi->vddc_voltage_table.mask_low); ++ cpu_to_be32(eg_pi->vddci_voltage_table.mask_low); + } + } + +diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c +index 64565732cb98..fe90b3e28d88 100644 +--- a/drivers/gpu/drm/radeon/radeon_connectors.c ++++ b/drivers/gpu/drm/radeon/radeon_connectors.c +@@ -1360,7 +1360,7 @@ bool radeon_connector_is_dp12_capable(struct drm_connector *connector) + struct radeon_device *rdev = dev->dev_private; + + if (ASIC_IS_DCE5(rdev) && +- (rdev->clock.dp_extclk >= 53900) && ++ (rdev->clock.default_dispclk >= 53900) && + radeon_connector_encoder_is_hbr2(connector)) { + return true; + } +diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c +index b2b8b38f0319..ed9a997c99a3 100644 +--- a/drivers/gpu/drm/radeon/radeon_cs.c ++++ b/drivers/gpu/drm/radeon/radeon_cs.c +@@ -97,6 +97,12 @@ static int radeon_cs_parser_relocs(struct radeon_cs_parser *p) + uint32_t domain = r->write_domain ? + r->write_domain : r->read_domains; + ++ if (domain & RADEON_GEM_DOMAIN_CPU) { ++ DRM_ERROR("RADEON_GEM_DOMAIN_CPU is not valid " ++ "for command submission\n"); ++ return -EINVAL; ++ } ++ + p->relocs[i].lobj.domain = domain; + if (domain == RADEON_GEM_DOMAIN_VRAM) + domain |= RADEON_GEM_DOMAIN_GTT; +diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c +index 6acba8017b9a..e0daa4fdb073 100644 +--- a/drivers/gpu/drm/radeon/rs600.c ++++ b/drivers/gpu/drm/radeon/rs600.c +@@ -582,8 +582,10 @@ int rs600_gart_set_page(struct radeon_device *rdev, int i, uint64_t addr) + return -EINVAL; + } + addr = addr & 0xFFFFFFFFFFFFF000ULL; +- addr |= R600_PTE_VALID | R600_PTE_SYSTEM | R600_PTE_SNOOPED; +- addr |= R600_PTE_READABLE | R600_PTE_WRITEABLE; ++ if (addr != rdev->dummy_page.addr) ++ addr |= R600_PTE_VALID | R600_PTE_READABLE | ++ R600_PTE_WRITEABLE; ++ addr |= R600_PTE_SYSTEM | R600_PTE_SNOOPED; + writeq(addr, ptr + (i * 8)); + return 0; + } +diff --git a/drivers/gpu/drm/radeon/rv770_dpm.c b/drivers/gpu/drm/radeon/rv770_dpm.c +index a239b30aaf9d..890cf1710253 100644 +--- a/drivers/gpu/drm/radeon/rv770_dpm.c ++++ b/drivers/gpu/drm/radeon/rv770_dpm.c +@@ -2328,12 +2328,6 @@ void rv770_get_engine_memory_ss(struct radeon_device *rdev) + pi->mclk_ss = radeon_atombios_get_asic_ss_info(rdev, &ss, + ASIC_INTERNAL_MEMORY_SS, 0); + +- /* disable ss, causes hangs on some cayman boards */ +- if (rdev->family == CHIP_CAYMAN) { +- pi->sclk_ss = false; +- pi->mclk_ss = false; +- } +- + if (pi->sclk_ss || pi->mclk_ss) + pi->dynamic_ss = true; + else +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c +index 021b5227e783..1b0f34bd3a03 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c +@@ -179,7 +179,6 @@ static int vmw_fb_set_par(struct fb_info *info) + vmw_write(vmw_priv, SVGA_REG_DISPLAY_POSITION_Y, info->var.yoffset); + vmw_write(vmw_priv, SVGA_REG_DISPLAY_WIDTH, info->var.xres); + vmw_write(vmw_priv, SVGA_REG_DISPLAY_HEIGHT, info->var.yres); +- vmw_write(vmw_priv, SVGA_REG_BYTES_PER_LINE, info->fix.line_length); + vmw_write(vmw_priv, SVGA_REG_DISPLAY_ID, SVGA_ID_INVALID); + } + +diff --git a/drivers/gpu/vga/vga_switcheroo.c b/drivers/gpu/vga/vga_switcheroo.c +index ec0ae2d1686a..6866448083b2 100644 +--- a/drivers/gpu/vga/vga_switcheroo.c ++++ b/drivers/gpu/vga/vga_switcheroo.c +@@ -623,7 +623,8 @@ static int vga_switcheroo_runtime_suspend(struct device *dev) + ret = dev->bus->pm->runtime_suspend(dev); + if (ret) + return ret; +- ++ if (vgasr_priv.handler->switchto) ++ vgasr_priv.handler->switchto(VGA_SWITCHEROO_IGD); + vga_switcheroo_power_switch(pdev, VGA_SWITCHEROO_OFF); + return 0; + } +diff --git a/drivers/hv/connection.c b/drivers/hv/connection.c +index 8dd98d4fc124..59ef4e7afdd7 100644 +--- a/drivers/hv/connection.c ++++ b/drivers/hv/connection.c +@@ -320,9 +320,13 @@ static void process_chn_event(u32 relid) + */ + + do { +- hv_begin_read(&channel->inbound); ++ if (read_state) ++ hv_begin_read(&channel->inbound); + channel->onchannel_callback(arg); +- bytes_to_read = hv_end_read(&channel->inbound); ++ if (read_state) ++ bytes_to_read = hv_end_read(&channel->inbound); ++ else ++ bytes_to_read = 0; + } while (read_state && (bytes_to_read != 0)); + } else { + pr_err("no channel callback for relid - %u\n", relid); +diff --git a/drivers/hwmon/adm1021.c b/drivers/hwmon/adm1021.c +index 29dd9f746dfa..233b374334ed 100644 +--- a/drivers/hwmon/adm1021.c ++++ b/drivers/hwmon/adm1021.c +@@ -185,7 +185,7 @@ static ssize_t set_temp_max(struct device *dev, + struct i2c_client *client = to_i2c_client(dev); + struct adm1021_data *data = i2c_get_clientdata(client); + long temp; +- int err; ++ int reg_val, err; + + err = kstrtol(buf, 10, &temp); + if (err) +@@ -193,10 +193,11 @@ static ssize_t set_temp_max(struct device *dev, + temp /= 1000; + + mutex_lock(&data->update_lock); +- data->temp_max[index] = clamp_val(temp, -128, 127); ++ reg_val = clamp_val(temp, -128, 127); ++ data->temp_max[index] = reg_val * 1000; + if (!read_only) + i2c_smbus_write_byte_data(client, ADM1021_REG_TOS_W(index), +- data->temp_max[index]); ++ reg_val); + mutex_unlock(&data->update_lock); + + return count; +@@ -210,7 +211,7 @@ static ssize_t set_temp_min(struct device *dev, + struct i2c_client *client = to_i2c_client(dev); + struct adm1021_data *data = i2c_get_clientdata(client); + long temp; +- int err; ++ int reg_val, err; + + err = kstrtol(buf, 10, &temp); + if (err) +@@ -218,10 +219,11 @@ static ssize_t set_temp_min(struct device *dev, + temp /= 1000; + + mutex_lock(&data->update_lock); +- data->temp_min[index] = clamp_val(temp, -128, 127); ++ reg_val = clamp_val(temp, -128, 127); ++ data->temp_min[index] = reg_val * 1000; + if (!read_only) + i2c_smbus_write_byte_data(client, ADM1021_REG_THYST_W(index), +- data->temp_min[index]); ++ reg_val); + mutex_unlock(&data->update_lock); + + return count; +diff --git a/drivers/hwmon/adm1029.c b/drivers/hwmon/adm1029.c +index 9ee5e066423b..39441e5d922c 100644 +--- a/drivers/hwmon/adm1029.c ++++ b/drivers/hwmon/adm1029.c +@@ -232,6 +232,9 @@ static ssize_t set_fan_div(struct device *dev, + /* Update the value */ + reg = (reg & 0x3F) | (val << 6); + ++ /* Update the cache */ ++ data->fan_div[attr->index] = reg; ++ + /* Write value */ + i2c_smbus_write_byte_data(client, + ADM1029_REG_FAN_DIV[attr->index], reg); +diff --git a/drivers/hwmon/adm1031.c b/drivers/hwmon/adm1031.c +index 253ea396106d..bdceca0d7e22 100644 +--- a/drivers/hwmon/adm1031.c ++++ b/drivers/hwmon/adm1031.c +@@ -365,6 +365,7 @@ set_auto_temp_min(struct device *dev, struct device_attribute *attr, + if (ret) + return ret; + ++ val = clamp_val(val, 0, 127000); + mutex_lock(&data->update_lock); + data->auto_temp[nr] = AUTO_TEMP_MIN_TO_REG(val, data->auto_temp[nr]); + adm1031_write_value(client, ADM1031_REG_AUTO_TEMP(nr), +@@ -394,6 +395,7 @@ set_auto_temp_max(struct device *dev, struct device_attribute *attr, + if (ret) + return ret; + ++ val = clamp_val(val, 0, 127000); + mutex_lock(&data->update_lock); + data->temp_max[nr] = AUTO_TEMP_MAX_TO_REG(val, data->auto_temp[nr], + data->pwm[nr]); +@@ -696,7 +698,7 @@ static ssize_t set_temp_min(struct device *dev, struct device_attribute *attr, + if (ret) + return ret; + +- val = clamp_val(val, -55000, nr == 0 ? 127750 : 127875); ++ val = clamp_val(val, -55000, 127000); + mutex_lock(&data->update_lock); + data->temp_min[nr] = TEMP_TO_REG(val); + adm1031_write_value(client, ADM1031_REG_TEMP_MIN(nr), +@@ -717,7 +719,7 @@ static ssize_t set_temp_max(struct device *dev, struct device_attribute *attr, + if (ret) + return ret; + +- val = clamp_val(val, -55000, nr == 0 ? 127750 : 127875); ++ val = clamp_val(val, -55000, 127000); + mutex_lock(&data->update_lock); + data->temp_max[nr] = TEMP_TO_REG(val); + adm1031_write_value(client, ADM1031_REG_TEMP_MAX(nr), +@@ -738,7 +740,7 @@ static ssize_t set_temp_crit(struct device *dev, struct device_attribute *attr, + if (ret) + return ret; + +- val = clamp_val(val, -55000, nr == 0 ? 127750 : 127875); ++ val = clamp_val(val, -55000, 127000); + mutex_lock(&data->update_lock); + data->temp_crit[nr] = TEMP_TO_REG(val); + adm1031_write_value(client, ADM1031_REG_TEMP_CRIT(nr), +diff --git a/drivers/hwmon/amc6821.c b/drivers/hwmon/amc6821.c +index eea817296513..9f2be3dd28f3 100644 +--- a/drivers/hwmon/amc6821.c ++++ b/drivers/hwmon/amc6821.c +@@ -704,7 +704,7 @@ static SENSOR_DEVICE_ATTR(temp1_max_alarm, S_IRUGO, + get_temp_alarm, NULL, IDX_TEMP1_MAX); + static SENSOR_DEVICE_ATTR(temp1_crit_alarm, S_IRUGO, + get_temp_alarm, NULL, IDX_TEMP1_CRIT); +-static SENSOR_DEVICE_ATTR(temp2_input, S_IRUGO | S_IWUSR, ++static SENSOR_DEVICE_ATTR(temp2_input, S_IRUGO, + get_temp, NULL, IDX_TEMP2_INPUT); + static SENSOR_DEVICE_ATTR(temp2_min, S_IRUGO | S_IWUSR, get_temp, + set_temp, IDX_TEMP2_MIN); +diff --git a/drivers/hwmon/emc2103.c b/drivers/hwmon/emc2103.c +index 2c137b26acb4..5790246a7e1d 100644 +--- a/drivers/hwmon/emc2103.c ++++ b/drivers/hwmon/emc2103.c +@@ -250,9 +250,7 @@ static ssize_t set_temp_min(struct device *dev, struct device_attribute *da, + if (result < 0) + return result; + +- val = DIV_ROUND_CLOSEST(val, 1000); +- if ((val < -63) || (val > 127)) +- return -EINVAL; ++ val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), -63, 127); + + mutex_lock(&data->update_lock); + data->temp_min[nr] = val; +@@ -274,9 +272,7 @@ static ssize_t set_temp_max(struct device *dev, struct device_attribute *da, + if (result < 0) + return result; + +- val = DIV_ROUND_CLOSEST(val, 1000); +- if ((val < -63) || (val > 127)) +- return -EINVAL; ++ val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), -63, 127); + + mutex_lock(&data->update_lock); + data->temp_max[nr] = val; +@@ -390,15 +386,14 @@ static ssize_t set_fan_target(struct device *dev, struct device_attribute *da, + { + struct emc2103_data *data = emc2103_update_device(dev); + struct i2c_client *client = to_i2c_client(dev); +- long rpm_target; ++ unsigned long rpm_target; + +- int result = kstrtol(buf, 10, &rpm_target); ++ int result = kstrtoul(buf, 10, &rpm_target); + if (result < 0) + return result; + + /* Datasheet states 16384 as maximum RPM target (table 3.2) */ +- if ((rpm_target < 0) || (rpm_target > 16384)) +- return -EINVAL; ++ rpm_target = clamp_val(rpm_target, 0, 16384); + + mutex_lock(&data->update_lock); + +diff --git a/drivers/hwmon/ina2xx.c b/drivers/hwmon/ina2xx.c +index 70a39a8ac016..554f5c3fe5c4 100644 +--- a/drivers/hwmon/ina2xx.c ++++ b/drivers/hwmon/ina2xx.c +@@ -148,7 +148,8 @@ static int ina2xx_get_value(struct ina2xx_data *data, u8 reg) + + switch (reg) { + case INA2XX_SHUNT_VOLTAGE: +- val = DIV_ROUND_CLOSEST(data->regs[reg], ++ /* signed register */ ++ val = DIV_ROUND_CLOSEST((s16)data->regs[reg], + data->config->shunt_div); + break; + case INA2XX_BUS_VOLTAGE: +@@ -160,8 +161,8 @@ static int ina2xx_get_value(struct ina2xx_data *data, u8 reg) + val = data->regs[reg] * data->config->power_lsb; + break; + case INA2XX_CURRENT: +- /* LSB=1mA (selected). Is in mA */ +- val = data->regs[reg]; ++ /* signed register, LSB=1mA (selected), in mA */ ++ val = (s16)data->regs[reg]; + break; + default: + /* programmer goofed */ +diff --git a/drivers/iio/adc/ti_am335x_adc.c b/drivers/iio/adc/ti_am335x_adc.c +index a952538a1a8b..b9ed661293a7 100644 +--- a/drivers/iio/adc/ti_am335x_adc.c ++++ b/drivers/iio/adc/ti_am335x_adc.c +@@ -155,7 +155,7 @@ static int tiadc_read_raw(struct iio_dev *indio_dev, + if (time_after(jiffies, timeout)) + return -EAGAIN; + } +- map_val = chan->channel + TOTAL_CHANNELS; ++ map_val = adc_dev->channel_step[chan->scan_index]; + + /* + * When the sub-system is first enabled, +diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c +index 0cf5f8e06cfc..1e8e94d4db7d 100644 +--- a/drivers/iio/inkern.c ++++ b/drivers/iio/inkern.c +@@ -183,7 +183,7 @@ static struct iio_channel *of_iio_channel_get_by_name(struct device_node *np, + else if (name && index >= 0) { + pr_err("ERROR: could not get IIO channel %s:%s(%i)\n", + np->full_name, name ? name : "", index); +- return chan; ++ return NULL; + } + + /* +@@ -193,8 +193,9 @@ static struct iio_channel *of_iio_channel_get_by_name(struct device_node *np, + */ + np = np->parent; + if (np && !of_get_property(np, "io-channel-ranges", NULL)) +- break; ++ return NULL; + } ++ + return chan; + } + +@@ -317,6 +318,7 @@ struct iio_channel *iio_channel_get(struct device *dev, + if (channel != NULL) + return channel; + } ++ + return iio_channel_get_sys(name, channel_name); + } + EXPORT_SYMBOL_GPL(iio_channel_get); +diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c +index f0d588f8859e..1acb99100556 100644 +--- a/drivers/infiniband/core/user_mad.c ++++ b/drivers/infiniband/core/user_mad.c +@@ -98,7 +98,7 @@ struct ib_umad_port { + + struct ib_umad_device { + int start_port, end_port; +- struct kref ref; ++ struct kobject kobj; + struct ib_umad_port port[0]; + }; + +@@ -134,14 +134,18 @@ static DECLARE_BITMAP(dev_map, IB_UMAD_MAX_PORTS); + static void ib_umad_add_one(struct ib_device *device); + static void ib_umad_remove_one(struct ib_device *device); + +-static void ib_umad_release_dev(struct kref *ref) ++static void ib_umad_release_dev(struct kobject *kobj) + { + struct ib_umad_device *dev = +- container_of(ref, struct ib_umad_device, ref); ++ container_of(kobj, struct ib_umad_device, kobj); + + kfree(dev); + } + ++static struct kobj_type ib_umad_dev_ktype = { ++ .release = ib_umad_release_dev, ++}; ++ + static int hdr_size(struct ib_umad_file *file) + { + return file->use_pkey_index ? sizeof (struct ib_user_mad_hdr) : +@@ -780,27 +784,19 @@ static int ib_umad_open(struct inode *inode, struct file *filp) + { + struct ib_umad_port *port; + struct ib_umad_file *file; +- int ret; ++ int ret = -ENXIO; + + port = container_of(inode->i_cdev, struct ib_umad_port, cdev); +- if (port) +- kref_get(&port->umad_dev->ref); +- else +- return -ENXIO; + + mutex_lock(&port->file_mutex); + +- if (!port->ib_dev) { +- ret = -ENXIO; ++ if (!port->ib_dev) + goto out; +- } + ++ ret = -ENOMEM; + file = kzalloc(sizeof *file, GFP_KERNEL); +- if (!file) { +- kref_put(&port->umad_dev->ref, ib_umad_release_dev); +- ret = -ENOMEM; ++ if (!file) + goto out; +- } + + mutex_init(&file->mutex); + spin_lock_init(&file->send_lock); +@@ -814,6 +810,13 @@ static int ib_umad_open(struct inode *inode, struct file *filp) + list_add_tail(&file->port_list, &port->file_list); + + ret = nonseekable_open(inode, filp); ++ if (ret) { ++ list_del(&file->port_list); ++ kfree(file); ++ goto out; ++ } ++ ++ kobject_get(&port->umad_dev->kobj); + + out: + mutex_unlock(&port->file_mutex); +@@ -852,7 +855,7 @@ static int ib_umad_close(struct inode *inode, struct file *filp) + mutex_unlock(&file->port->file_mutex); + + kfree(file); +- kref_put(&dev->ref, ib_umad_release_dev); ++ kobject_put(&dev->kobj); + + return 0; + } +@@ -880,10 +883,6 @@ static int ib_umad_sm_open(struct inode *inode, struct file *filp) + int ret; + + port = container_of(inode->i_cdev, struct ib_umad_port, sm_cdev); +- if (port) +- kref_get(&port->umad_dev->ref); +- else +- return -ENXIO; + + if (filp->f_flags & O_NONBLOCK) { + if (down_trylock(&port->sm_sem)) { +@@ -898,17 +897,27 @@ static int ib_umad_sm_open(struct inode *inode, struct file *filp) + } + + ret = ib_modify_port(port->ib_dev, port->port_num, 0, &props); +- if (ret) { +- up(&port->sm_sem); +- goto fail; +- } ++ if (ret) ++ goto err_up_sem; + + filp->private_data = port; + +- return nonseekable_open(inode, filp); ++ ret = nonseekable_open(inode, filp); ++ if (ret) ++ goto err_clr_sm_cap; ++ ++ kobject_get(&port->umad_dev->kobj); ++ ++ return 0; ++ ++err_clr_sm_cap: ++ swap(props.set_port_cap_mask, props.clr_port_cap_mask); ++ ib_modify_port(port->ib_dev, port->port_num, 0, &props); ++ ++err_up_sem: ++ up(&port->sm_sem); + + fail: +- kref_put(&port->umad_dev->ref, ib_umad_release_dev); + return ret; + } + +@@ -927,7 +936,7 @@ static int ib_umad_sm_close(struct inode *inode, struct file *filp) + + up(&port->sm_sem); + +- kref_put(&port->umad_dev->ref, ib_umad_release_dev); ++ kobject_put(&port->umad_dev->kobj); + + return ret; + } +@@ -995,6 +1004,7 @@ static int find_overflow_devnum(void) + } + + static int ib_umad_init_port(struct ib_device *device, int port_num, ++ struct ib_umad_device *umad_dev, + struct ib_umad_port *port) + { + int devnum; +@@ -1027,6 +1037,7 @@ static int ib_umad_init_port(struct ib_device *device, int port_num, + + cdev_init(&port->cdev, &umad_fops); + port->cdev.owner = THIS_MODULE; ++ port->cdev.kobj.parent = &umad_dev->kobj; + kobject_set_name(&port->cdev.kobj, "umad%d", port->dev_num); + if (cdev_add(&port->cdev, base, 1)) + goto err_cdev; +@@ -1045,6 +1056,7 @@ static int ib_umad_init_port(struct ib_device *device, int port_num, + base += IB_UMAD_MAX_PORTS; + cdev_init(&port->sm_cdev, &umad_sm_fops); + port->sm_cdev.owner = THIS_MODULE; ++ port->sm_cdev.kobj.parent = &umad_dev->kobj; + kobject_set_name(&port->sm_cdev.kobj, "issm%d", port->dev_num); + if (cdev_add(&port->sm_cdev, base, 1)) + goto err_sm_cdev; +@@ -1138,7 +1150,7 @@ static void ib_umad_add_one(struct ib_device *device) + if (!umad_dev) + return; + +- kref_init(&umad_dev->ref); ++ kobject_init(&umad_dev->kobj, &ib_umad_dev_ktype); + + umad_dev->start_port = s; + umad_dev->end_port = e; +@@ -1146,7 +1158,8 @@ static void ib_umad_add_one(struct ib_device *device) + for (i = s; i <= e; ++i) { + umad_dev->port[i - s].umad_dev = umad_dev; + +- if (ib_umad_init_port(device, i, &umad_dev->port[i - s])) ++ if (ib_umad_init_port(device, i, umad_dev, ++ &umad_dev->port[i - s])) + goto err; + } + +@@ -1158,7 +1171,7 @@ err: + while (--i >= s) + ib_umad_kill_port(&umad_dev->port[i - s]); + +- kref_put(&umad_dev->ref, ib_umad_release_dev); ++ kobject_put(&umad_dev->kobj); + } + + static void ib_umad_remove_one(struct ib_device *device) +@@ -1172,7 +1185,7 @@ static void ib_umad_remove_one(struct ib_device *device) + for (i = 0; i <= umad_dev->end_port - umad_dev->start_port; ++i) + ib_umad_kill_port(&umad_dev->port[i]); + +- kref_put(&umad_dev->ref, ib_umad_release_dev); ++ kobject_put(&umad_dev->kobj); + } + + static char *umad_devnode(struct device *dev, umode_t *mode) +diff --git a/drivers/infiniband/hw/ipath/ipath_diag.c b/drivers/infiniband/hw/ipath/ipath_diag.c +index e2f9a51f4a38..45802e97332e 100644 +--- a/drivers/infiniband/hw/ipath/ipath_diag.c ++++ b/drivers/infiniband/hw/ipath/ipath_diag.c +@@ -346,6 +346,10 @@ static ssize_t ipath_diagpkt_write(struct file *fp, + ret = -EFAULT; + goto bail; + } ++ dp.len = odp.len; ++ dp.unit = odp.unit; ++ dp.data = odp.data; ++ dp.pbc_wd = 0; + } else { + ret = -EINVAL; + goto bail; +diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c +index 344ab03948a3..706833ab7e7e 100644 +--- a/drivers/infiniband/hw/mlx5/cq.c ++++ b/drivers/infiniband/hw/mlx5/cq.c +@@ -32,6 +32,7 @@ + + #include <linux/kref.h> + #include <rdma/ib_umem.h> ++#include <rdma/ib_user_verbs.h> + #include "mlx5_ib.h" + #include "user.h" + +@@ -518,14 +519,24 @@ static int create_cq_user(struct mlx5_ib_dev *dev, struct ib_udata *udata, + int *cqe_size, int *index, int *inlen) + { + struct mlx5_ib_create_cq ucmd; ++ size_t ucmdlen; + int page_shift; + int npages; + int ncont; + int err; + +- if (ib_copy_from_udata(&ucmd, udata, sizeof(ucmd))) ++ ucmdlen = ++ (udata->inlen - sizeof(struct ib_uverbs_cmd_hdr) < ++ sizeof(ucmd)) ? (sizeof(ucmd) - ++ sizeof(ucmd.reserved)) : sizeof(ucmd); ++ ++ if (ib_copy_from_udata(&ucmd, udata, ucmdlen)) + return -EFAULT; + ++ if (ucmdlen == sizeof(ucmd) && ++ ucmd.reserved != 0) ++ return -EINVAL; ++ + if (ucmd.cqe_size != 64 && ucmd.cqe_size != 128) + return -EINVAL; + +diff --git a/drivers/infiniband/hw/mlx5/srq.c b/drivers/infiniband/hw/mlx5/srq.c +index 0aa478bc291a..47a1f0a9c926 100644 +--- a/drivers/infiniband/hw/mlx5/srq.c ++++ b/drivers/infiniband/hw/mlx5/srq.c +@@ -35,6 +35,7 @@ + #include <linux/mlx5/srq.h> + #include <linux/slab.h> + #include <rdma/ib_umem.h> ++#include <rdma/ib_user_verbs.h> + + #include "mlx5_ib.h" + #include "user.h" +@@ -78,16 +79,27 @@ static int create_srq_user(struct ib_pd *pd, struct mlx5_ib_srq *srq, + { + struct mlx5_ib_dev *dev = to_mdev(pd->device); + struct mlx5_ib_create_srq ucmd; ++ size_t ucmdlen; + int err; + int npages; + int page_shift; + int ncont; + u32 offset; + +- if (ib_copy_from_udata(&ucmd, udata, sizeof(ucmd))) { ++ ucmdlen = ++ (udata->inlen - sizeof(struct ib_uverbs_cmd_hdr) < ++ sizeof(ucmd)) ? (sizeof(ucmd) - ++ sizeof(ucmd.reserved)) : sizeof(ucmd); ++ ++ if (ib_copy_from_udata(&ucmd, udata, ucmdlen)) { + mlx5_ib_dbg(dev, "failed copy udata\n"); + return -EFAULT; + } ++ ++ if (ucmdlen == sizeof(ucmd) && ++ ucmd.reserved != 0) ++ return -EINVAL; ++ + srq->wq_sig = !!(ucmd.flags & MLX5_SRQ_FLAG_SIGNATURE); + + srq->umem = ib_umem_get(pd->uobject->context, ucmd.buf_addr, buf_size, +diff --git a/drivers/infiniband/hw/mlx5/user.h b/drivers/infiniband/hw/mlx5/user.h +index a886de3e593c..84fea5d00cd2 100644 +--- a/drivers/infiniband/hw/mlx5/user.h ++++ b/drivers/infiniband/hw/mlx5/user.h +@@ -84,6 +84,7 @@ struct mlx5_ib_create_cq { + __u64 buf_addr; + __u64 db_addr; + __u32 cqe_size; ++ __u32 reserved; /* explicit padding (optional on i386) */ + }; + + struct mlx5_ib_create_cq_resp { +@@ -99,6 +100,7 @@ struct mlx5_ib_create_srq { + __u64 buf_addr; + __u64 db_addr; + __u32 flags; ++ __u32 reserved; /* explicit padding (optional on i386) */ + }; + + struct mlx5_ib_create_srq_resp { +diff --git a/drivers/infiniband/hw/qib/qib_mad.c b/drivers/infiniband/hw/qib/qib_mad.c +index ccb119143d20..1dd9fcbb7c9a 100644 +--- a/drivers/infiniband/hw/qib/qib_mad.c ++++ b/drivers/infiniband/hw/qib/qib_mad.c +@@ -1028,7 +1028,7 @@ static int set_pkeys(struct qib_devdata *dd, u8 port, u16 *pkeys) + + event.event = IB_EVENT_PKEY_CHANGE; + event.device = &dd->verbs_dev.ibdev; +- event.element.port_num = 1; ++ event.element.port_num = port; + ib_dispatch_event(&event); + } + return 0; +diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c +index 17b58f4f0681..024fa025a7ab 100644 +--- a/drivers/infiniband/ulp/srp/ib_srp.c ++++ b/drivers/infiniband/ulp/srp/ib_srp.c +@@ -1412,6 +1412,12 @@ err_unmap: + err_iu: + srp_put_tx_iu(target, iu, SRP_IU_CMD); + ++ /* ++ * Avoid that the loops that iterate over the request ring can ++ * encounter a dangling SCSI command pointer. ++ */ ++ req->scmnd = NULL; ++ + spin_lock_irqsave(&target->lock, flags); + list_add(&req->list, &target->free_reqs); + +diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c +index 230cdcf8e6fe..233516aff595 100644 +--- a/drivers/input/mouse/elantech.c ++++ b/drivers/input/mouse/elantech.c +@@ -473,8 +473,15 @@ static void elantech_report_absolute_v3(struct psmouse *psmouse, + input_report_key(dev, BTN_TOOL_FINGER, fingers == 1); + input_report_key(dev, BTN_TOOL_DOUBLETAP, fingers == 2); + input_report_key(dev, BTN_TOOL_TRIPLETAP, fingers == 3); +- input_report_key(dev, BTN_LEFT, packet[0] & 0x01); +- input_report_key(dev, BTN_RIGHT, packet[0] & 0x02); ++ ++ /* For clickpads map both buttons to BTN_LEFT */ ++ if (etd->fw_version & 0x001000) { ++ input_report_key(dev, BTN_LEFT, packet[0] & 0x03); ++ } else { ++ input_report_key(dev, BTN_LEFT, packet[0] & 0x01); ++ input_report_key(dev, BTN_RIGHT, packet[0] & 0x02); ++ } ++ + input_report_abs(dev, ABS_PRESSURE, pres); + input_report_abs(dev, ABS_TOOL_WIDTH, width); + +@@ -484,10 +491,17 @@ static void elantech_report_absolute_v3(struct psmouse *psmouse, + static void elantech_input_sync_v4(struct psmouse *psmouse) + { + struct input_dev *dev = psmouse->dev; ++ struct elantech_data *etd = psmouse->private; + unsigned char *packet = psmouse->packet; + +- input_report_key(dev, BTN_LEFT, packet[0] & 0x01); +- input_report_key(dev, BTN_RIGHT, packet[0] & 0x02); ++ /* For clickpads map both buttons to BTN_LEFT */ ++ if (etd->fw_version & 0x001000) { ++ input_report_key(dev, BTN_LEFT, packet[0] & 0x03); ++ } else { ++ input_report_key(dev, BTN_LEFT, packet[0] & 0x01); ++ input_report_key(dev, BTN_RIGHT, packet[0] & 0x02); ++ } ++ + input_mt_report_pointer_emulation(dev, true); + input_sync(dev); + } +@@ -835,7 +849,7 @@ static int elantech_set_absolute_mode(struct psmouse *psmouse) + if (etd->set_hw_resolution) + etd->reg_10 = 0x0b; + else +- etd->reg_10 = 0x03; ++ etd->reg_10 = 0x01; + + if (elantech_write_reg(psmouse, 0x10, etd->reg_10)) + rc = -1; +@@ -1336,7 +1350,8 @@ static int elantech_reconnect(struct psmouse *psmouse) + } + + /* +- * Some hw_version 3 models go into error state when we try to set bit 3 of r10 ++ * Some hw_version 3 models go into error state when we try to set ++ * bit 3 and/or bit 1 of r10. + */ + static const struct dmi_system_id no_hw_res_dmi_table[] = { + #if defined(CONFIG_DMI) && defined(CONFIG_X86) +diff --git a/drivers/irqchip/spear-shirq.c b/drivers/irqchip/spear-shirq.c +index 8527743b5cef..391b9cea73ed 100644 +--- a/drivers/irqchip/spear-shirq.c ++++ b/drivers/irqchip/spear-shirq.c +@@ -125,7 +125,7 @@ static struct spear_shirq spear320_shirq_ras2 = { + }; + + static struct spear_shirq spear320_shirq_ras3 = { +- .irq_nr = 3, ++ .irq_nr = 7, + .irq_bit_off = 0, + .invalid_irq = 1, + .regs = { +diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c +index 2a20986a2fec..e60c2eaea7bb 100644 +--- a/drivers/md/dm-io.c ++++ b/drivers/md/dm-io.c +@@ -10,6 +10,7 @@ + #include <linux/device-mapper.h> + + #include <linux/bio.h> ++#include <linux/completion.h> + #include <linux/mempool.h> + #include <linux/module.h> + #include <linux/sched.h> +@@ -32,7 +33,7 @@ struct dm_io_client { + struct io { + unsigned long error_bits; + atomic_t count; +- struct task_struct *sleeper; ++ struct completion *wait; + struct dm_io_client *client; + io_notify_fn callback; + void *context; +@@ -121,8 +122,8 @@ static void dec_count(struct io *io, unsigned int region, int error) + invalidate_kernel_vmap_range(io->vma_invalidate_address, + io->vma_invalidate_size); + +- if (io->sleeper) +- wake_up_process(io->sleeper); ++ if (io->wait) ++ complete(io->wait); + + else { + unsigned long r = io->error_bits; +@@ -385,6 +386,7 @@ static int sync_io(struct dm_io_client *client, unsigned int num_regions, + */ + volatile char io_[sizeof(struct io) + __alignof__(struct io) - 1]; + struct io *io = (struct io *)PTR_ALIGN(&io_, __alignof__(struct io)); ++ DECLARE_COMPLETION_ONSTACK(wait); + + if (num_regions > 1 && (rw & RW_MASK) != WRITE) { + WARN_ON(1); +@@ -393,7 +395,7 @@ static int sync_io(struct dm_io_client *client, unsigned int num_regions, + + io->error_bits = 0; + atomic_set(&io->count, 1); /* see dispatch_io() */ +- io->sleeper = current; ++ io->wait = &wait; + io->client = client; + + io->vma_invalidate_address = dp->vma_invalidate_address; +@@ -401,15 +403,7 @@ static int sync_io(struct dm_io_client *client, unsigned int num_regions, + + dispatch_io(rw, num_regions, where, dp, io, 1); + +- while (1) { +- set_current_state(TASK_UNINTERRUPTIBLE); +- +- if (!atomic_read(&io->count)) +- break; +- +- io_schedule(); +- } +- set_current_state(TASK_RUNNING); ++ wait_for_completion_io(&wait); + + if (error_bits) + *error_bits = io->error_bits; +@@ -432,7 +426,7 @@ static int async_io(struct dm_io_client *client, unsigned int num_regions, + io = mempool_alloc(client->pool, GFP_NOIO); + io->error_bits = 0; + atomic_set(&io->count, 1); /* see dispatch_io() */ +- io->sleeper = NULL; ++ io->wait = NULL; + io->client = client; + io->callback = fn; + io->context = context; +diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c +index e4cc196634c1..f8c36d30eca8 100644 +--- a/drivers/md/dm-thin.c ++++ b/drivers/md/dm-thin.c +@@ -2695,7 +2695,8 @@ static void set_discard_limits(struct pool_c *pt, struct queue_limits *limits) + */ + if (pt->adjusted_pf.discard_passdown) { + data_limits = &bdev_get_queue(pt->data_dev->bdev)->limits; +- limits->discard_granularity = data_limits->discard_granularity; ++ limits->discard_granularity = max(data_limits->discard_granularity, ++ pool->sectors_per_block << SECTOR_SHIFT); + } else + limits->discard_granularity = pool->sectors_per_block << SECTOR_SHIFT; + } +diff --git a/drivers/md/md.c b/drivers/md/md.c +index c98e681fc9fc..bf030d4b09a7 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -7484,6 +7484,19 @@ void md_do_sync(struct md_thread *thread) + rdev->recovery_offset < j) + j = rdev->recovery_offset; + rcu_read_unlock(); ++ ++ /* If there is a bitmap, we need to make sure all ++ * writes that started before we added a spare ++ * complete before we start doing a recovery. ++ * Otherwise the write might complete and (via ++ * bitmap_endwrite) set a bit in the bitmap after the ++ * recovery has checked that bit and skipped that ++ * region. ++ */ ++ if (mddev->bitmap) { ++ mddev->pers->quiesce(mddev, 1); ++ mddev->pers->quiesce(mddev, 0); ++ } + } + + printk(KERN_INFO "md: %s of RAID array %s\n", desc, mdname(mddev)); +diff --git a/drivers/mmc/host/rtsx_pci_sdmmc.c b/drivers/mmc/host/rtsx_pci_sdmmc.c +index 375a880e0c5f..54e8ba45c3ad 100644 +--- a/drivers/mmc/host/rtsx_pci_sdmmc.c ++++ b/drivers/mmc/host/rtsx_pci_sdmmc.c +@@ -246,6 +246,9 @@ static void sd_send_cmd_get_rsp(struct realtek_pci_sdmmc *host, + case MMC_RSP_R1: + rsp_type = SD_RSP_TYPE_R1; + break; ++ case MMC_RSP_R1 & ~MMC_RSP_CRC: ++ rsp_type = SD_RSP_TYPE_R1 | SD_NO_CHECK_CRC7; ++ break; + case MMC_RSP_R1B: + rsp_type = SD_RSP_TYPE_R1b; + break; +diff --git a/drivers/mtd/nand/fsl_elbc_nand.c b/drivers/mtd/nand/fsl_elbc_nand.c +index 20657209a472..c31d183820c5 100644 +--- a/drivers/mtd/nand/fsl_elbc_nand.c ++++ b/drivers/mtd/nand/fsl_elbc_nand.c +@@ -725,6 +725,19 @@ static int fsl_elbc_write_page(struct mtd_info *mtd, struct nand_chip *chip, + return 0; + } + ++/* ECC will be calculated automatically, and errors will be detected in ++ * waitfunc. ++ */ ++static int fsl_elbc_write_subpage(struct mtd_info *mtd, struct nand_chip *chip, ++ uint32_t offset, uint32_t data_len, ++ const uint8_t *buf, int oob_required) ++{ ++ fsl_elbc_write_buf(mtd, buf, mtd->writesize); ++ fsl_elbc_write_buf(mtd, chip->oob_poi, mtd->oobsize); ++ ++ return 0; ++} ++ + static int fsl_elbc_chip_init(struct fsl_elbc_mtd *priv) + { + struct fsl_lbc_ctrl *ctrl = priv->ctrl; +@@ -763,6 +776,7 @@ static int fsl_elbc_chip_init(struct fsl_elbc_mtd *priv) + + chip->ecc.read_page = fsl_elbc_read_page; + chip->ecc.write_page = fsl_elbc_write_page; ++ chip->ecc.write_subpage = fsl_elbc_write_subpage; + + /* If CS Base Register selects full hardware ECC then use it */ + if ((in_be32(&lbc->bank[priv->bank].br) & BR_DECC) == +diff --git a/drivers/mtd/nand/omap2.c b/drivers/mtd/nand/omap2.c +index 4ecf0e5fd484..0332d0b2d73a 100644 +--- a/drivers/mtd/nand/omap2.c ++++ b/drivers/mtd/nand/omap2.c +@@ -1463,7 +1463,7 @@ static int omap_elm_correct_data(struct mtd_info *mtd, u_char *data, + + /* Check if any error reported */ + if (!is_error_reported) +- return 0; ++ return stat; + + /* Decode BCH error using ELM module */ + elm_decode_bch_error_page(info->elm_dev, ecc_vec, err_vec); +diff --git a/drivers/net/ethernet/allwinner/sun4i-emac.c b/drivers/net/ethernet/allwinner/sun4i-emac.c +index 46dfb1378c17..81576c6c31e0 100644 +--- a/drivers/net/ethernet/allwinner/sun4i-emac.c ++++ b/drivers/net/ethernet/allwinner/sun4i-emac.c +@@ -726,6 +726,7 @@ static int emac_open(struct net_device *dev) + + ret = emac_mdio_probe(dev); + if (ret < 0) { ++ free_irq(dev->irq, dev); + netdev_err(dev, "cannot probe MDIO bus\n"); + return ret; + } +diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c +index e85d34b76039..ebcce00ce067 100644 +--- a/drivers/net/wireless/b43/xmit.c ++++ b/drivers/net/wireless/b43/xmit.c +@@ -810,9 +810,13 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr) + break; + case B43_PHYTYPE_G: + status.band = IEEE80211_BAND_2GHZ; +- /* chanid is the radio channel cookie value as used +- * to tune the radio. */ +- status.freq = chanid + 2400; ++ /* Somewhere between 478.104 and 508.1084 firmware for G-PHY ++ * has been modified to be compatible with N-PHY and others. ++ */ ++ if (dev->fw.rev >= 508) ++ status.freq = ieee80211_channel_to_frequency(chanid, status.band); ++ else ++ status.freq = chanid + 2400; + break; + case B43_PHYTYPE_N: + case B43_PHYTYPE_LP: +diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c +index 7bdaf06b8f5a..dc875f4befef 100644 +--- a/drivers/net/wireless/iwlwifi/pcie/trans.c ++++ b/drivers/net/wireless/iwlwifi/pcie/trans.c +@@ -345,6 +345,7 @@ static int iwl_pcie_prepare_card_hw(struct iwl_trans *trans) + { + int ret; + int t = 0; ++ int iter; + + IWL_DEBUG_INFO(trans, "iwl_trans_prepare_card_hw enter\n"); + +@@ -353,18 +354,23 @@ static int iwl_pcie_prepare_card_hw(struct iwl_trans *trans) + if (ret >= 0) + return 0; + +- /* If HW is not ready, prepare the conditions to check again */ +- iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG, +- CSR_HW_IF_CONFIG_REG_PREPARE); ++ for (iter = 0; iter < 10; iter++) { ++ /* If HW is not ready, prepare the conditions to check again */ ++ iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG, ++ CSR_HW_IF_CONFIG_REG_PREPARE); ++ ++ do { ++ ret = iwl_pcie_set_hw_ready(trans); ++ if (ret >= 0) ++ return 0; + +- do { +- ret = iwl_pcie_set_hw_ready(trans); +- if (ret >= 0) +- return 0; ++ usleep_range(200, 1000); ++ t += 200; ++ } while (t < 150000); ++ msleep(25); ++ } + +- usleep_range(200, 1000); +- t += 200; +- } while (t < 150000); ++ IWL_DEBUG_INFO(trans, "got NIC after %d iterations\n", iter); + + return ret; + } +diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c +index 0ac5c589ddce..13f557a44a62 100644 +--- a/drivers/net/wireless/rt2x00/rt2500pci.c ++++ b/drivers/net/wireless/rt2x00/rt2500pci.c +@@ -1684,8 +1684,13 @@ static int rt2500pci_init_eeprom(struct rt2x00_dev *rt2x00dev) + /* + * Detect if this device has an hardware controlled radio. + */ +- if (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_HARDWARE_RADIO)) ++ if (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_HARDWARE_RADIO)) { + __set_bit(CAPABILITY_HW_BUTTON, &rt2x00dev->cap_flags); ++ /* ++ * On this device RFKILL initialized during probe does not work. ++ */ ++ __set_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags); ++ } + + /* + * Check if the BBP tuning should be enabled. +diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h +index fe4c572db52c..89dbf2db93da 100644 +--- a/drivers/net/wireless/rt2x00/rt2x00.h ++++ b/drivers/net/wireless/rt2x00/rt2x00.h +@@ -705,6 +705,7 @@ enum rt2x00_capability_flags { + REQUIRE_SW_SEQNO, + REQUIRE_HT_TX_DESC, + REQUIRE_PS_AUTOWAKE, ++ REQUIRE_DELAYED_RFKILL, + + /* + * Capabilities +diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c +index f12e909cbb48..6ccfa0a671e7 100644 +--- a/drivers/net/wireless/rt2x00/rt2x00dev.c ++++ b/drivers/net/wireless/rt2x00/rt2x00dev.c +@@ -1128,9 +1128,10 @@ static void rt2x00lib_uninitialize(struct rt2x00_dev *rt2x00dev) + return; + + /* +- * Unregister extra components. ++ * Stop rfkill polling. + */ +- rt2x00rfkill_unregister(rt2x00dev); ++ if (test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags)) ++ rt2x00rfkill_unregister(rt2x00dev); + + /* + * Allow the HW to uninitialize. +@@ -1168,6 +1169,12 @@ static int rt2x00lib_initialize(struct rt2x00_dev *rt2x00dev) + + set_bit(DEVICE_STATE_INITIALIZED, &rt2x00dev->flags); + ++ /* ++ * Start rfkill polling. ++ */ ++ if (test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags)) ++ rt2x00rfkill_register(rt2x00dev); ++ + return 0; + } + +@@ -1377,7 +1384,12 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev) + rt2x00link_register(rt2x00dev); + rt2x00leds_register(rt2x00dev); + rt2x00debug_register(rt2x00dev); +- rt2x00rfkill_register(rt2x00dev); ++ ++ /* ++ * Start rfkill polling. ++ */ ++ if (!test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags)) ++ rt2x00rfkill_register(rt2x00dev); + + return 0; + +@@ -1393,6 +1405,12 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev) + clear_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags); + + /* ++ * Stop rfkill polling. ++ */ ++ if (!test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags)) ++ rt2x00rfkill_unregister(rt2x00dev); ++ ++ /* + * Disable radio. + */ + rt2x00lib_disable_radio(rt2x00dev); +diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c +index 2b724fc4e306..c03748dafd49 100644 +--- a/drivers/net/wireless/rt2x00/rt2x00mac.c ++++ b/drivers/net/wireless/rt2x00/rt2x00mac.c +@@ -489,6 +489,8 @@ int rt2x00mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, + crypto.cipher = rt2x00crypto_key_to_cipher(key); + if (crypto.cipher == CIPHER_NONE) + return -EOPNOTSUPP; ++ if (crypto.cipher == CIPHER_TKIP && rt2x00_is_usb(rt2x00dev)) ++ return -EOPNOTSUPP; + + crypto.cmd = cmd; + +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index 9fc3f1f4557b..4108166ffdf4 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -4135,7 +4135,7 @@ int pci_set_vga_state(struct pci_dev *dev, bool decode, + u16 cmd; + int rc; + +- WARN_ON((flags & PCI_VGA_STATE_CHANGE_DECODES) & (command_bits & ~(PCI_COMMAND_IO|PCI_COMMAND_MEMORY))); ++ WARN_ON((flags & PCI_VGA_STATE_CHANGE_DECODES) && (command_bits & ~(PCI_COMMAND_IO|PCI_COMMAND_MEMORY))); + + /* ARCH specific VGA enables */ + rc = pci_set_vga_state_arch(dev, decode, command_bits, flags); +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index f6c31fabf3af..3af18b94d0d3 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -2953,6 +2953,7 @@ static void disable_igfx_irq(struct pci_dev *dev) + } + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0102, disable_igfx_irq); + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x010a, disable_igfx_irq); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0152, disable_igfx_irq); + + /* + * Some devices may pass our check in pci_intx_mask_supported if +diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c +index fa764406df68..c5bb0e0a36b9 100644 +--- a/drivers/scsi/ibmvscsi/ibmvscsi.c ++++ b/drivers/scsi/ibmvscsi/ibmvscsi.c +@@ -185,6 +185,11 @@ static struct viosrp_crq *crq_queue_next_crq(struct crq_queue *queue) + if (crq->valid & 0x80) { + if (++queue->cur == queue->size) + queue->cur = 0; ++ ++ /* Ensure the read of the valid bit occurs before reading any ++ * other bits of the CRQ entry ++ */ ++ rmb(); + } else + crq = NULL; + spin_unlock_irqrestore(&queue->lock, flags); +@@ -203,6 +208,11 @@ static int ibmvscsi_send_crq(struct ibmvscsi_host_data *hostdata, + { + struct vio_dev *vdev = to_vio_dev(hostdata->dev); + ++ /* ++ * Ensure the command buffer is flushed to memory before handing it ++ * over to the VIOS to prevent it from fetching any stale data. ++ */ ++ mb(); + return plpar_hcall_norets(H_SEND_CRQ, vdev->unit_address, word1, word2); + } + +@@ -797,7 +807,8 @@ static void purge_requests(struct ibmvscsi_host_data *hostdata, int error_code) + evt->hostdata->dev); + if (evt->cmnd_done) + evt->cmnd_done(evt->cmnd); +- } else if (evt->done) ++ } else if (evt->done && evt->crq.format != VIOSRP_MAD_FORMAT && ++ evt->iu.srp.login_req.opcode != SRP_LOGIN_REQ) + evt->done(evt); + free_event_struct(&evt->hostdata->pool, evt); + spin_lock_irqsave(hostdata->host->host_lock, flags); +diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c +index 83e591b60193..9ba3642cb19e 100644 +--- a/drivers/scsi/scsi_error.c ++++ b/drivers/scsi/scsi_error.c +@@ -143,7 +143,7 @@ enum blk_eh_timer_return scsi_times_out(struct request *req) + else if (host->hostt->eh_timed_out) + rtn = host->hostt->eh_timed_out(scmd); + +- scmd->result |= DID_TIME_OUT << 16; ++ set_host_byte(scmd, DID_TIME_OUT); + + if (unlikely(rtn == BLK_EH_NOT_HANDLED && + !scsi_eh_scmd_add(scmd, SCSI_EH_CANCEL_CMD))) +diff --git a/drivers/scsi/sym53c8xx_2/sym_hipd.c b/drivers/scsi/sym53c8xx_2/sym_hipd.c +index d92fe4037e94..6b349e301869 100644 +--- a/drivers/scsi/sym53c8xx_2/sym_hipd.c ++++ b/drivers/scsi/sym53c8xx_2/sym_hipd.c +@@ -3000,7 +3000,11 @@ sym_dequeue_from_squeue(struct sym_hcb *np, int i, int target, int lun, int task + if ((target == -1 || cp->target == target) && + (lun == -1 || cp->lun == lun) && + (task == -1 || cp->tag == task)) { ++#ifdef SYM_OPT_HANDLE_DEVICE_QUEUEING + sym_set_cam_status(cp->cmd, DID_SOFT_ERROR); ++#else ++ sym_set_cam_status(cp->cmd, DID_REQUEUE); ++#endif + sym_remque(&cp->link_ccbq); + sym_insque_tail(&cp->link_ccbq, &np->comp_ccbq); + } +diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c +index 95a5d73e675c..11f5326f449f 100644 +--- a/drivers/scsi/virtio_scsi.c ++++ b/drivers/scsi/virtio_scsi.c +@@ -270,6 +270,16 @@ static void virtscsi_req_done(struct virtqueue *vq) + virtscsi_vq_done(vscsi, req_vq, virtscsi_complete_cmd); + }; + ++static void virtscsi_poll_requests(struct virtio_scsi *vscsi) ++{ ++ int i, num_vqs; ++ ++ num_vqs = vscsi->num_queues; ++ for (i = 0; i < num_vqs; i++) ++ virtscsi_vq_done(vscsi, &vscsi->req_vqs[i], ++ virtscsi_complete_cmd); ++} ++ + static void virtscsi_complete_free(struct virtio_scsi *vscsi, void *buf) + { + struct virtio_scsi_cmd *cmd = buf; +@@ -288,6 +298,8 @@ static void virtscsi_ctrl_done(struct virtqueue *vq) + virtscsi_vq_done(vscsi, &vscsi->ctrl_vq, virtscsi_complete_free); + }; + ++static void virtscsi_handle_event(struct work_struct *work); ++ + static int virtscsi_kick_event(struct virtio_scsi *vscsi, + struct virtio_scsi_event_node *event_node) + { +@@ -295,6 +307,7 @@ static int virtscsi_kick_event(struct virtio_scsi *vscsi, + struct scatterlist sg; + unsigned long flags; + ++ INIT_WORK(&event_node->work, virtscsi_handle_event); + sg_init_one(&sg, &event_node->event, sizeof(struct virtio_scsi_event)); + + spin_lock_irqsave(&vscsi->event_vq.vq_lock, flags); +@@ -412,7 +425,6 @@ static void virtscsi_complete_event(struct virtio_scsi *vscsi, void *buf) + { + struct virtio_scsi_event_node *event_node = buf; + +- INIT_WORK(&event_node->work, virtscsi_handle_event); + schedule_work(&event_node->work); + } + +@@ -602,6 +614,18 @@ static int virtscsi_tmf(struct virtio_scsi *vscsi, struct virtio_scsi_cmd *cmd) + cmd->resp.tmf.response == VIRTIO_SCSI_S_FUNCTION_SUCCEEDED) + ret = SUCCESS; + ++ /* ++ * The spec guarantees that all requests related to the TMF have ++ * been completed, but the callback might not have run yet if ++ * we're using independent interrupts (e.g. MSI). Poll the ++ * virtqueues once. ++ * ++ * In the abort case, sc->scsi_done will do nothing, because ++ * the block layer must have detected a timeout and as a result ++ * REQ_ATOM_COMPLETE has been set. ++ */ ++ virtscsi_poll_requests(vscsi); ++ + out: + mempool_free(cmd, virtscsi_cmd_pool); + return ret; +diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c +index f99162542df2..d2ff40680208 100644 +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -1305,7 +1305,7 @@ iscsit_check_dataout_hdr(struct iscsi_conn *conn, unsigned char *buf, + if (cmd->data_direction != DMA_TO_DEVICE) { + pr_err("Command ITT: 0x%08x received DataOUT for a" + " NON-WRITE command.\n", cmd->init_task_tag); +- return iscsit_reject_cmd(cmd, ISCSI_REASON_PROTOCOL_ERROR, buf); ++ return iscsit_dump_data_payload(conn, payload_length, 1); + } + se_cmd = &cmd->se_cmd; + iscsit_mod_dataout_timer(cmd); +diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c +index f140a0eac985..8d44bec42e95 100644 +--- a/drivers/target/iscsi/iscsi_target_login.c ++++ b/drivers/target/iscsi/iscsi_target_login.c +@@ -1198,7 +1198,7 @@ old_sess_out: + static int __iscsi_target_login_thread(struct iscsi_np *np) + { + u8 *buffer, zero_tsih = 0; +- int ret = 0, rc, stop; ++ int ret = 0, rc; + struct iscsi_conn *conn = NULL; + struct iscsi_login *login; + struct iscsi_portal_group *tpg = NULL; +@@ -1212,6 +1212,9 @@ static int __iscsi_target_login_thread(struct iscsi_np *np) + if (np->np_thread_state == ISCSI_NP_THREAD_RESET) { + np->np_thread_state = ISCSI_NP_THREAD_ACTIVE; + complete(&np->np_restart_comp); ++ } else if (np->np_thread_state == ISCSI_NP_THREAD_SHUTDOWN) { ++ spin_unlock_bh(&np->np_thread_lock); ++ goto exit; + } else { + np->np_thread_state = ISCSI_NP_THREAD_ACTIVE; + } +@@ -1404,10 +1407,8 @@ old_sess_out: + } + + out: +- stop = kthread_should_stop(); +- /* Wait for another socket.. */ +- if (!stop) +- return 1; ++ return 1; ++ + exit: + iscsi_stop_login_thread_timer(np); + spin_lock_bh(&np->np_thread_lock); +@@ -1424,7 +1425,7 @@ int iscsi_target_login_thread(void *arg) + + allow_signal(SIGINT); + +- while (!kthread_should_stop()) { ++ while (1) { + ret = __iscsi_target_login_thread(np); + /* + * We break and exit here unless another sock_accept() call +diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c +index 1039de499bc6..658c9c77ec04 100644 +--- a/drivers/target/iscsi/iscsi_target_util.c ++++ b/drivers/target/iscsi/iscsi_target_util.c +@@ -1294,6 +1294,8 @@ int iscsit_tx_login_rsp(struct iscsi_conn *conn, u8 status_class, u8 status_deta + login->login_failed = 1; + iscsit_collect_login_stats(conn, status_class, status_detail); + ++ memset(&login->rsp[0], 0, ISCSI_HDR_LEN); ++ + hdr = (struct iscsi_login_rsp *)&login->rsp[0]; + hdr->opcode = ISCSI_OP_LOGIN_RSP; + hdr->status_class = status_class; +diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c +index e31ec5cf0c36..c7a3c5e2b1b3 100644 +--- a/drivers/target/target_core_device.c ++++ b/drivers/target/target_core_device.c +@@ -617,6 +617,7 @@ void core_dev_unexport( + dev->export_count--; + spin_unlock(&hba->device_lock); + ++ lun->lun_sep = NULL; + lun->lun_se_dev = NULL; + } + +diff --git a/drivers/thermal/thermal_hwmon.c b/drivers/thermal/thermal_hwmon.c +index fdb07199d9c2..1967bee4f076 100644 +--- a/drivers/thermal/thermal_hwmon.c ++++ b/drivers/thermal/thermal_hwmon.c +@@ -140,6 +140,12 @@ thermal_hwmon_lookup_temp(const struct thermal_hwmon_device *hwmon, + return NULL; + } + ++static bool thermal_zone_crit_temp_valid(struct thermal_zone_device *tz) ++{ ++ unsigned long temp; ++ return tz->ops->get_crit_temp && !tz->ops->get_crit_temp(tz, &temp); ++} ++ + int thermal_add_hwmon_sysfs(struct thermal_zone_device *tz) + { + struct thermal_hwmon_device *hwmon; +@@ -189,21 +195,18 @@ int thermal_add_hwmon_sysfs(struct thermal_zone_device *tz) + if (result) + goto free_temp_mem; + +- if (tz->ops->get_crit_temp) { +- unsigned long temperature; +- if (!tz->ops->get_crit_temp(tz, &temperature)) { +- snprintf(temp->temp_crit.name, +- sizeof(temp->temp_crit.name), ++ if (thermal_zone_crit_temp_valid(tz)) { ++ snprintf(temp->temp_crit.name, ++ sizeof(temp->temp_crit.name), + "temp%d_crit", hwmon->count); +- temp->temp_crit.attr.attr.name = temp->temp_crit.name; +- temp->temp_crit.attr.attr.mode = 0444; +- temp->temp_crit.attr.show = temp_crit_show; +- sysfs_attr_init(&temp->temp_crit.attr.attr); +- result = device_create_file(hwmon->device, +- &temp->temp_crit.attr); +- if (result) +- goto unregister_input; +- } ++ temp->temp_crit.attr.attr.name = temp->temp_crit.name; ++ temp->temp_crit.attr.attr.mode = 0444; ++ temp->temp_crit.attr.show = temp_crit_show; ++ sysfs_attr_init(&temp->temp_crit.attr.attr); ++ result = device_create_file(hwmon->device, ++ &temp->temp_crit.attr); ++ if (result) ++ goto unregister_input; + } + + mutex_lock(&thermal_hwmon_list_lock); +@@ -250,7 +253,7 @@ void thermal_remove_hwmon_sysfs(struct thermal_zone_device *tz) + } + + device_remove_file(hwmon->device, &temp->temp_input.attr); +- if (tz->ops->get_crit_temp) ++ if (thermal_zone_crit_temp_valid(tz)) + device_remove_file(hwmon->device, &temp->temp_crit.attr); + + mutex_lock(&thermal_hwmon_list_lock); +diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c +index bd73dc25b41d..eac1b0d5b463 100644 +--- a/drivers/tty/n_tty.c ++++ b/drivers/tty/n_tty.c +@@ -1210,15 +1210,16 @@ static void n_tty_receive_parity_error(struct tty_struct *tty, unsigned char c) + { + struct n_tty_data *ldata = tty->disc_data; + +- if (I_IGNPAR(tty)) +- return; +- if (I_PARMRK(tty)) { +- put_tty_queue('\377', ldata); +- put_tty_queue('\0', ldata); +- put_tty_queue(c, ldata); +- } else if (I_INPCK(tty)) +- put_tty_queue('\0', ldata); +- else ++ if (I_INPCK(tty)) { ++ if (I_IGNPAR(tty)) ++ return; ++ if (I_PARMRK(tty)) { ++ put_tty_queue('\377', ldata); ++ put_tty_queue('\0', ldata); ++ put_tty_queue(c, ldata); ++ } else ++ put_tty_queue('\0', ldata); ++ } else + put_tty_queue(c, ldata); + wake_up_interruptible(&tty->read_wait); + } +diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c +index bf9d2ac9c9ed..04c8772639d3 100644 +--- a/drivers/tty/serial/8250/8250_core.c ++++ b/drivers/tty/serial/8250/8250_core.c +@@ -2356,7 +2356,7 @@ serial8250_do_set_termios(struct uart_port *port, struct ktermios *termios, + port->read_status_mask = UART_LSR_OE | UART_LSR_THRE | UART_LSR_DR; + if (termios->c_iflag & INPCK) + port->read_status_mask |= UART_LSR_FE | UART_LSR_PE; +- if (termios->c_iflag & (BRKINT | PARMRK)) ++ if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK)) + port->read_status_mask |= UART_LSR_BI; + + /* +diff --git a/drivers/tty/serial/altera_uart.c b/drivers/tty/serial/altera_uart.c +index 501667e3e3f5..323376668b72 100644 +--- a/drivers/tty/serial/altera_uart.c ++++ b/drivers/tty/serial/altera_uart.c +@@ -185,6 +185,12 @@ static void altera_uart_set_termios(struct uart_port *port, + uart_update_timeout(port, termios->c_cflag, baud); + altera_uart_writel(port, baudclk, ALTERA_UART_DIVISOR_REG); + spin_unlock_irqrestore(&port->lock, flags); ++ ++ /* ++ * FIXME: port->read_status_mask and port->ignore_status_mask ++ * need to be initialized based on termios settings for ++ * INPCK, IGNBRK, IGNPAR, PARMRK, BRKINT ++ */ + } + + static void altera_uart_rx_chars(struct altera_uart *pp) +diff --git a/drivers/tty/serial/amba-pl010.c b/drivers/tty/serial/amba-pl010.c +index 8b90f0b6dfdf..40bff818b947 100644 +--- a/drivers/tty/serial/amba-pl010.c ++++ b/drivers/tty/serial/amba-pl010.c +@@ -420,7 +420,7 @@ pl010_set_termios(struct uart_port *port, struct ktermios *termios, + uap->port.read_status_mask = UART01x_RSR_OE; + if (termios->c_iflag & INPCK) + uap->port.read_status_mask |= UART01x_RSR_FE | UART01x_RSR_PE; +- if (termios->c_iflag & (BRKINT | PARMRK)) ++ if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK)) + uap->port.read_status_mask |= UART01x_RSR_BE; + + /* +diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c +index 1440d0b4a7bc..a976ba99a006 100644 +--- a/drivers/tty/serial/amba-pl011.c ++++ b/drivers/tty/serial/amba-pl011.c +@@ -1731,7 +1731,7 @@ pl011_set_termios(struct uart_port *port, struct ktermios *termios, + port->read_status_mask = UART011_DR_OE | 255; + if (termios->c_iflag & INPCK) + port->read_status_mask |= UART011_DR_FE | UART011_DR_PE; +- if (termios->c_iflag & (BRKINT | PARMRK)) ++ if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK)) + port->read_status_mask |= UART011_DR_BE; + + /* +diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c +index 41bb8387e80d..3b301a7ec662 100644 +--- a/drivers/tty/serial/atmel_serial.c ++++ b/drivers/tty/serial/atmel_serial.c +@@ -1794,7 +1794,7 @@ static void atmel_set_termios(struct uart_port *port, struct ktermios *termios, + port->read_status_mask = ATMEL_US_OVRE; + if (termios->c_iflag & INPCK) + port->read_status_mask |= (ATMEL_US_FRAME | ATMEL_US_PARE); +- if (termios->c_iflag & (BRKINT | PARMRK)) ++ if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK)) + port->read_status_mask |= ATMEL_US_RXBRK; + + if (atmel_use_pdc_rx(port)) +diff --git a/drivers/tty/serial/bcm63xx_uart.c b/drivers/tty/serial/bcm63xx_uart.c +index 649d5129c4b4..88b07adedaef 100644 +--- a/drivers/tty/serial/bcm63xx_uart.c ++++ b/drivers/tty/serial/bcm63xx_uart.c +@@ -568,7 +568,7 @@ static void bcm_uart_set_termios(struct uart_port *port, + port->read_status_mask |= UART_FIFO_FRAMEERR_MASK; + port->read_status_mask |= UART_FIFO_PARERR_MASK; + } +- if (new->c_iflag & (BRKINT)) ++ if (new->c_iflag & (IGNBRK | BRKINT)) + port->read_status_mask |= UART_FIFO_BRKDET_MASK; + + port->ignore_status_mask = 0; +diff --git a/drivers/tty/serial/bfin_uart.c b/drivers/tty/serial/bfin_uart.c +index 3c75e8e04028..8d3046909c23 100644 +--- a/drivers/tty/serial/bfin_uart.c ++++ b/drivers/tty/serial/bfin_uart.c +@@ -833,7 +833,7 @@ bfin_serial_set_termios(struct uart_port *port, struct ktermios *termios, + port->read_status_mask = OE; + if (termios->c_iflag & INPCK) + port->read_status_mask |= (FE | PE); +- if (termios->c_iflag & (BRKINT | PARMRK)) ++ if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK)) + port->read_status_mask |= BI; + + /* +diff --git a/drivers/tty/serial/dz.c b/drivers/tty/serial/dz.c +index 2f2b2e538a54..cdbbc788230a 100644 +--- a/drivers/tty/serial/dz.c ++++ b/drivers/tty/serial/dz.c +@@ -625,7 +625,7 @@ static void dz_set_termios(struct uart_port *uport, struct ktermios *termios, + dport->port.read_status_mask = DZ_OERR; + if (termios->c_iflag & INPCK) + dport->port.read_status_mask |= DZ_FERR | DZ_PERR; +- if (termios->c_iflag & (BRKINT | PARMRK)) ++ if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK)) + dport->port.read_status_mask |= DZ_BREAK; + + /* characters to ignore */ +diff --git a/drivers/tty/serial/efm32-uart.c b/drivers/tty/serial/efm32-uart.c +index 0eb5b5673ede..948f17b6b497 100644 +--- a/drivers/tty/serial/efm32-uart.c ++++ b/drivers/tty/serial/efm32-uart.c +@@ -407,7 +407,7 @@ static void efm32_uart_set_termios(struct uart_port *port, + if (new->c_iflag & INPCK) + port->read_status_mask |= + UARTn_RXDATAX_FERR | UARTn_RXDATAX_PERR; +- if (new->c_iflag & (BRKINT | PARMRK)) ++ if (new->c_iflag & (IGNBRK | BRKINT | PARMRK)) + port->read_status_mask |= SW_UARTn_RXDATAX_BERR; + + port->ignore_status_mask = 0; +diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c +index 8978dc9a58b7..175f123f4f09 100644 +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -496,7 +496,7 @@ lpuart_set_termios(struct uart_port *port, struct ktermios *termios, + sport->port.read_status_mask = 0; + if (termios->c_iflag & INPCK) + sport->port.read_status_mask |= (UARTSR1_FE | UARTSR1_PE); +- if (termios->c_iflag & (BRKINT | PARMRK)) ++ if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK)) + sport->port.read_status_mask |= UARTSR1_FE; + + /* characters to ignore */ +diff --git a/drivers/tty/serial/ip22zilog.c b/drivers/tty/serial/ip22zilog.c +index cb3c81eb0996..a90f4089d080 100644 +--- a/drivers/tty/serial/ip22zilog.c ++++ b/drivers/tty/serial/ip22zilog.c +@@ -850,7 +850,7 @@ ip22zilog_convert_to_zs(struct uart_ip22zilog_port *up, unsigned int cflag, + up->port.read_status_mask = Rx_OVR; + if (iflag & INPCK) + up->port.read_status_mask |= CRC_ERR | PAR_ERR; +- if (iflag & (BRKINT | PARMRK)) ++ if (iflag & (IGNBRK | BRKINT | PARMRK)) + up->port.read_status_mask |= BRK_ABRT; + + up->port.ignore_status_mask = 0; +diff --git a/drivers/tty/serial/m32r_sio.c b/drivers/tty/serial/m32r_sio.c +index 9cd9b4eba9fc..68f2c53e0b54 100644 +--- a/drivers/tty/serial/m32r_sio.c ++++ b/drivers/tty/serial/m32r_sio.c +@@ -737,7 +737,7 @@ static void m32r_sio_set_termios(struct uart_port *port, + up->port.read_status_mask = UART_LSR_OE | UART_LSR_THRE | UART_LSR_DR; + if (termios->c_iflag & INPCK) + up->port.read_status_mask |= UART_LSR_FE | UART_LSR_PE; +- if (termios->c_iflag & (BRKINT | PARMRK)) ++ if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK)) + up->port.read_status_mask |= UART_LSR_BI; + + /* +diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c +index b2e707aa603a..518364311b75 100644 +--- a/drivers/tty/serial/max310x.c ++++ b/drivers/tty/serial/max310x.c +@@ -842,7 +842,7 @@ static void max310x_set_termios(struct uart_port *port, + if (termios->c_iflag & INPCK) + port->read_status_mask |= MAX310X_LSR_RXPAR_BIT | + MAX310X_LSR_FRERR_BIT; +- if (termios->c_iflag & (BRKINT | PARMRK)) ++ if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK)) + port->read_status_mask |= MAX310X_LSR_RXBRK_BIT; + + /* Set status ignore mask */ +diff --git a/drivers/tty/serial/mcf.c b/drivers/tty/serial/mcf.c +index 0edfaf8cd269..a6f085717f94 100644 +--- a/drivers/tty/serial/mcf.c ++++ b/drivers/tty/serial/mcf.c +@@ -248,6 +248,12 @@ static void mcf_set_termios(struct uart_port *port, struct ktermios *termios, + mr1 |= MCFUART_MR1_PARITYNONE; + } + ++ /* ++ * FIXME: port->read_status_mask and port->ignore_status_mask ++ * need to be initialized based on termios settings for ++ * INPCK, IGNBRK, IGNPAR, PARMRK, BRKINT ++ */ ++ + if (termios->c_cflag & CSTOPB) + mr2 |= MCFUART_MR2_STOP2; + else +diff --git a/drivers/tty/serial/mfd.c b/drivers/tty/serial/mfd.c +index d3db042f649e..81ad559ee9cb 100644 +--- a/drivers/tty/serial/mfd.c ++++ b/drivers/tty/serial/mfd.c +@@ -975,7 +975,7 @@ serial_hsu_set_termios(struct uart_port *port, struct ktermios *termios, + up->port.read_status_mask = UART_LSR_OE | UART_LSR_THRE | UART_LSR_DR; + if (termios->c_iflag & INPCK) + up->port.read_status_mask |= UART_LSR_FE | UART_LSR_PE; +- if (termios->c_iflag & (BRKINT | PARMRK)) ++ if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK)) + up->port.read_status_mask |= UART_LSR_BI; + + /* Characters to ignore */ +diff --git a/drivers/tty/serial/mpsc.c b/drivers/tty/serial/mpsc.c +index 8d702677acc5..76749f404b68 100644 +--- a/drivers/tty/serial/mpsc.c ++++ b/drivers/tty/serial/mpsc.c +@@ -1458,7 +1458,7 @@ static void mpsc_set_termios(struct uart_port *port, struct ktermios *termios, + pi->port.read_status_mask |= SDMA_DESC_CMDSTAT_PE + | SDMA_DESC_CMDSTAT_FR; + +- if (termios->c_iflag & (BRKINT | PARMRK)) ++ if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK)) + pi->port.read_status_mask |= SDMA_DESC_CMDSTAT_BR; + + /* Characters/events to ignore */ +diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c +index b5d779cd3c2b..c0f2b3e5452f 100644 +--- a/drivers/tty/serial/msm_serial.c ++++ b/drivers/tty/serial/msm_serial.c +@@ -570,7 +570,7 @@ static void msm_set_termios(struct uart_port *port, struct ktermios *termios, + port->read_status_mask = 0; + if (termios->c_iflag & INPCK) + port->read_status_mask |= UART_SR_PAR_FRAME_ERR; +- if (termios->c_iflag & (BRKINT | PARMRK)) ++ if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK)) + port->read_status_mask |= UART_SR_RX_BREAK; + + uart_update_timeout(port, termios->c_cflag, baud); +diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c +index 10e9d70b5c40..ea96c39b387d 100644 +--- a/drivers/tty/serial/mxs-auart.c ++++ b/drivers/tty/serial/mxs-auart.c +@@ -600,7 +600,7 @@ static void mxs_auart_settermios(struct uart_port *u, + + if (termios->c_iflag & INPCK) + u->read_status_mask |= AUART_STAT_PERR; +- if (termios->c_iflag & (BRKINT | PARMRK)) ++ if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK)) + u->read_status_mask |= AUART_STAT_BERR; + + /* +diff --git a/drivers/tty/serial/netx-serial.c b/drivers/tty/serial/netx-serial.c +index 0a4dd70d29eb..7a6745601d4e 100644 +--- a/drivers/tty/serial/netx-serial.c ++++ b/drivers/tty/serial/netx-serial.c +@@ -419,7 +419,7 @@ netx_set_termios(struct uart_port *port, struct ktermios *termios, + } + + port->read_status_mask = 0; +- if (termios->c_iflag & (BRKINT | PARMRK)) ++ if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK)) + port->read_status_mask |= SR_BE; + if (termios->c_iflag & INPCK) + port->read_status_mask |= SR_PE | SR_FE; +diff --git a/drivers/tty/serial/pmac_zilog.c b/drivers/tty/serial/pmac_zilog.c +index 5ba30e078236..409d7ad0ac75 100644 +--- a/drivers/tty/serial/pmac_zilog.c ++++ b/drivers/tty/serial/pmac_zilog.c +@@ -1090,7 +1090,7 @@ static void pmz_convert_to_zs(struct uart_pmac_port *uap, unsigned int cflag, + uap->port.read_status_mask = Rx_OVR; + if (iflag & INPCK) + uap->port.read_status_mask |= CRC_ERR | PAR_ERR; +- if (iflag & (BRKINT | PARMRK)) ++ if (iflag & (IGNBRK | BRKINT | PARMRK)) + uap->port.read_status_mask |= BRK_ABRT; + + uap->port.ignore_status_mask = 0; +diff --git a/drivers/tty/serial/pnx8xxx_uart.c b/drivers/tty/serial/pnx8xxx_uart.c +index de6c05c63683..2ba24a45c97f 100644 +--- a/drivers/tty/serial/pnx8xxx_uart.c ++++ b/drivers/tty/serial/pnx8xxx_uart.c +@@ -477,7 +477,7 @@ pnx8xxx_set_termios(struct uart_port *port, struct ktermios *termios, + sport->port.read_status_mask |= + FIFO_TO_SM(PNX8XXX_UART_FIFO_RXFE) | + FIFO_TO_SM(PNX8XXX_UART_FIFO_RXPAR); +- if (termios->c_iflag & (BRKINT | PARMRK)) ++ if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK)) + sport->port.read_status_mask |= + ISTAT_TO_SM(PNX8XXX_UART_INT_BREAK); + +diff --git a/drivers/tty/serial/pxa.c b/drivers/tty/serial/pxa.c +index f9f20f383760..fc3f308cd6c1 100644 +--- a/drivers/tty/serial/pxa.c ++++ b/drivers/tty/serial/pxa.c +@@ -492,7 +492,7 @@ serial_pxa_set_termios(struct uart_port *port, struct ktermios *termios, + up->port.read_status_mask = UART_LSR_OE | UART_LSR_THRE | UART_LSR_DR; + if (termios->c_iflag & INPCK) + up->port.read_status_mask |= UART_LSR_FE | UART_LSR_PE; +- if (termios->c_iflag & (BRKINT | PARMRK)) ++ if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK)) + up->port.read_status_mask |= UART_LSR_BI; + + /* +diff --git a/drivers/tty/serial/sb1250-duart.c b/drivers/tty/serial/sb1250-duart.c +index a7cdec2962dd..771f361c47ea 100644 +--- a/drivers/tty/serial/sb1250-duart.c ++++ b/drivers/tty/serial/sb1250-duart.c +@@ -596,7 +596,7 @@ static void sbd_set_termios(struct uart_port *uport, struct ktermios *termios, + if (termios->c_iflag & INPCK) + uport->read_status_mask |= M_DUART_FRM_ERR | + M_DUART_PARITY_ERR; +- if (termios->c_iflag & (BRKINT | PARMRK)) ++ if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK)) + uport->read_status_mask |= M_DUART_RCVD_BRK; + + uport->ignore_status_mask = 0; +diff --git a/drivers/tty/serial/sccnxp.c b/drivers/tty/serial/sccnxp.c +index 49e9bbfe6cab..0ea128a76b1b 100644 +--- a/drivers/tty/serial/sccnxp.c ++++ b/drivers/tty/serial/sccnxp.c +@@ -667,7 +667,7 @@ static void sccnxp_set_termios(struct uart_port *port, + port->read_status_mask = SR_OVR; + if (termios->c_iflag & INPCK) + port->read_status_mask |= SR_PE | SR_FE; +- if (termios->c_iflag & (BRKINT | PARMRK)) ++ if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK)) + port->read_status_mask |= SR_BRK; + + /* Set status ignore mask */ +diff --git a/drivers/tty/serial/serial_ks8695.c b/drivers/tty/serial/serial_ks8695.c +index e1caa99e3d3b..5c79bdab985d 100644 +--- a/drivers/tty/serial/serial_ks8695.c ++++ b/drivers/tty/serial/serial_ks8695.c +@@ -437,7 +437,7 @@ static void ks8695uart_set_termios(struct uart_port *port, struct ktermios *term + port->read_status_mask = URLS_URROE; + if (termios->c_iflag & INPCK) + port->read_status_mask |= (URLS_URFE | URLS_URPE); +- if (termios->c_iflag & (BRKINT | PARMRK)) ++ if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK)) + port->read_status_mask |= URLS_URBI; + + /* +diff --git a/drivers/tty/serial/serial_txx9.c b/drivers/tty/serial/serial_txx9.c +index 440a962412da..ce13f42814a3 100644 +--- a/drivers/tty/serial/serial_txx9.c ++++ b/drivers/tty/serial/serial_txx9.c +@@ -702,7 +702,7 @@ serial_txx9_set_termios(struct uart_port *port, struct ktermios *termios, + TXX9_SIDISR_TDIS | TXX9_SIDISR_RDIS; + if (termios->c_iflag & INPCK) + up->port.read_status_mask |= TXX9_SIDISR_UFER | TXX9_SIDISR_UPER; +- if (termios->c_iflag & (BRKINT | PARMRK)) ++ if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK)) + up->port.read_status_mask |= TXX9_SIDISR_UBRK; + + /* +diff --git a/drivers/tty/serial/sirfsoc_uart.c b/drivers/tty/serial/sirfsoc_uart.c +index a72c33f8e263..6904818d3424 100644 +--- a/drivers/tty/serial/sirfsoc_uart.c ++++ b/drivers/tty/serial/sirfsoc_uart.c +@@ -897,7 +897,7 @@ static void sirfsoc_uart_set_termios(struct uart_port *port, + if (termios->c_iflag & INPCK) + port->read_status_mask |= uint_en->sirfsoc_frm_err_en; + } +- if (termios->c_iflag & (BRKINT | PARMRK)) ++ if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK)) + port->read_status_mask |= uint_en->sirfsoc_rxd_brk_en; + if (sirfport->uart_reg->uart_type == SIRF_REAL_UART) { + if (termios->c_iflag & IGNPAR) +diff --git a/drivers/tty/serial/st-asc.c b/drivers/tty/serial/st-asc.c +index 21e6e84c0df8..0ee31755cb5a 100644 +--- a/drivers/tty/serial/st-asc.c ++++ b/drivers/tty/serial/st-asc.c +@@ -547,7 +547,7 @@ static void asc_set_termios(struct uart_port *port, struct ktermios *termios, + ascport->port.read_status_mask = ASC_RXBUF_DUMMY_OE; + if (termios->c_iflag & INPCK) + ascport->port.read_status_mask |= ASC_RXBUF_FE | ASC_RXBUF_PE; +- if (termios->c_iflag & (BRKINT | PARMRK)) ++ if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK)) + ascport->port.read_status_mask |= ASC_RXBUF_DUMMY_BE; + + /* +diff --git a/drivers/tty/serial/sunsab.c b/drivers/tty/serial/sunsab.c +index 5d6136b2a04a..2fee558f2b13 100644 +--- a/drivers/tty/serial/sunsab.c ++++ b/drivers/tty/serial/sunsab.c +@@ -719,7 +719,7 @@ static void sunsab_convert_to_sab(struct uart_sunsab_port *up, unsigned int cfla + if (iflag & INPCK) + up->port.read_status_mask |= (SAB82532_ISR0_PERR | + SAB82532_ISR0_FERR); +- if (iflag & (BRKINT | PARMRK)) ++ if (iflag & (IGNBRK | BRKINT | PARMRK)) + up->port.read_status_mask |= (SAB82532_ISR1_BRK << 8); + + /* +diff --git a/drivers/tty/serial/sunsu.c b/drivers/tty/serial/sunsu.c +index 699cc1b5f6aa..c41a5b8b717f 100644 +--- a/drivers/tty/serial/sunsu.c ++++ b/drivers/tty/serial/sunsu.c +@@ -834,7 +834,7 @@ sunsu_change_speed(struct uart_port *port, unsigned int cflag, + up->port.read_status_mask = UART_LSR_OE | UART_LSR_THRE | UART_LSR_DR; + if (iflag & INPCK) + up->port.read_status_mask |= UART_LSR_FE | UART_LSR_PE; +- if (iflag & (BRKINT | PARMRK)) ++ if (iflag & (IGNBRK | BRKINT | PARMRK)) + up->port.read_status_mask |= UART_LSR_BI; + + /* +diff --git a/drivers/tty/serial/sunzilog.c b/drivers/tty/serial/sunzilog.c +index 135a15203532..ed92578eba4e 100644 +--- a/drivers/tty/serial/sunzilog.c ++++ b/drivers/tty/serial/sunzilog.c +@@ -915,7 +915,7 @@ sunzilog_convert_to_zs(struct uart_sunzilog_port *up, unsigned int cflag, + up->port.read_status_mask = Rx_OVR; + if (iflag & INPCK) + up->port.read_status_mask |= CRC_ERR | PAR_ERR; +- if (iflag & (BRKINT | PARMRK)) ++ if (iflag & (IGNBRK | BRKINT | PARMRK)) + up->port.read_status_mask |= BRK_ABRT; + + up->port.ignore_status_mask = 0; +diff --git a/drivers/tty/serial/ucc_uart.c b/drivers/tty/serial/ucc_uart.c +index 88317482b81f..37df3897cb5a 100644 +--- a/drivers/tty/serial/ucc_uart.c ++++ b/drivers/tty/serial/ucc_uart.c +@@ -934,7 +934,7 @@ static void qe_uart_set_termios(struct uart_port *port, + port->read_status_mask = BD_SC_EMPTY | BD_SC_OV; + if (termios->c_iflag & INPCK) + port->read_status_mask |= BD_SC_FR | BD_SC_PR; +- if (termios->c_iflag & (BRKINT | PARMRK)) ++ if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK)) + port->read_status_mask |= BD_SC_BR; + + /* +diff --git a/drivers/tty/serial/vr41xx_siu.c b/drivers/tty/serial/vr41xx_siu.c +index a63c14bc9a24..db0c8a4ab03e 100644 +--- a/drivers/tty/serial/vr41xx_siu.c ++++ b/drivers/tty/serial/vr41xx_siu.c +@@ -559,7 +559,7 @@ static void siu_set_termios(struct uart_port *port, struct ktermios *new, + port->read_status_mask = UART_LSR_THRE | UART_LSR_OE | UART_LSR_DR; + if (c_iflag & INPCK) + port->read_status_mask |= UART_LSR_FE | UART_LSR_PE; +- if (c_iflag & (BRKINT | PARMRK)) ++ if (c_iflag & (IGNBRK | BRKINT | PARMRK)) + port->read_status_mask |= UART_LSR_BI; + + port->ignore_status_mask = 0; +diff --git a/drivers/tty/serial/zs.c b/drivers/tty/serial/zs.c +index 6a169877109b..2b65bb7ffb8a 100644 +--- a/drivers/tty/serial/zs.c ++++ b/drivers/tty/serial/zs.c +@@ -923,7 +923,7 @@ static void zs_set_termios(struct uart_port *uport, struct ktermios *termios, + uport->read_status_mask = Rx_OVR; + if (termios->c_iflag & INPCK) + uport->read_status_mask |= FRM_ERR | PAR_ERR; +- if (termios->c_iflag & (BRKINT | PARMRK)) ++ if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK)) + uport->read_status_mask |= Rx_BRK; + + uport->ignore_status_mask = 0; +diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c +index 938426ae30de..a18c2cfafe6d 100644 +--- a/drivers/usb/chipidea/udc.c ++++ b/drivers/usb/chipidea/udc.c +@@ -1325,6 +1325,7 @@ static int ep_dequeue(struct usb_ep *ep, struct usb_request *req) + struct ci_hw_ep *hwep = container_of(ep, struct ci_hw_ep, ep); + struct ci_hw_req *hwreq = container_of(req, struct ci_hw_req, req); + unsigned long flags; ++ struct td_node *node, *tmpnode; + + if (ep == NULL || req == NULL || hwreq->req.status != -EALREADY || + hwep->ep.desc == NULL || list_empty(&hwreq->queue) || +@@ -1335,6 +1336,12 @@ static int ep_dequeue(struct usb_ep *ep, struct usb_request *req) + + hw_ep_flush(hwep->ci, hwep->num, hwep->dir); + ++ list_for_each_entry_safe(node, tmpnode, &hwreq->tds, td) { ++ dma_pool_free(hwep->td_pool, node->ptr, node->dma); ++ list_del(&node->td); ++ kfree(node); ++ } ++ + /* pop request */ + list_del_init(&hwreq->queue); + +diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c +index 44cf775a8627..c3067f4f213a 100644 +--- a/drivers/usb/gadget/f_fs.c ++++ b/drivers/usb/gadget/f_fs.c +@@ -1389,11 +1389,13 @@ static int functionfs_bind(struct ffs_data *ffs, struct usb_composite_dev *cdev) + ffs->ep0req->context = ffs; + + lang = ffs->stringtabs; +- for (lang = ffs->stringtabs; *lang; ++lang) { +- struct usb_string *str = (*lang)->strings; +- int id = first_id; +- for (; str->s; ++id, ++str) +- str->id = id; ++ if (lang) { ++ for (; *lang; ++lang) { ++ struct usb_string *str = (*lang)->strings; ++ int id = first_id; ++ for (; str->s; ++id, ++str) ++ str->id = id; ++ } + } + + ffs->gadget = cdev->gadget; +diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c +index 1dbfb52dbcd6..6118e292d5df 100644 +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -3633,7 +3633,7 @@ static unsigned int xhci_get_burst_count(struct xhci_hcd *xhci, + return 0; + + max_burst = urb->ep->ss_ep_comp.bMaxBurst; +- return roundup(total_packet_count, max_burst + 1) - 1; ++ return DIV_ROUND_UP(total_packet_count, max_burst + 1) - 1; + } + + /* +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 01aa4c9fa558..e3d12f164430 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -926,7 +926,7 @@ int xhci_suspend(struct xhci_hcd *xhci) + */ + int xhci_resume(struct xhci_hcd *xhci, bool hibernated) + { +- u32 command, temp = 0; ++ u32 command, temp = 0, status; + struct usb_hcd *hcd = xhci_to_hcd(xhci); + struct usb_hcd *secondary_hcd; + int retval = 0; +@@ -1045,8 +1045,12 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated) + + done: + if (retval == 0) { +- usb_hcd_resume_root_hub(hcd); +- usb_hcd_resume_root_hub(xhci->shared_hcd); ++ /* Resume root hubs only when have pending events. */ ++ status = readl(&xhci->op_regs->status); ++ if (status & STS_EINT) { ++ usb_hcd_resume_root_hub(hcd); ++ usb_hcd_resume_root_hub(xhci->shared_hcd); ++ } + } + + /* +diff --git a/drivers/usb/musb/musb_am335x.c b/drivers/usb/musb/musb_am335x.c +index 41ac5b5b57ce..83b97dc409dc 100644 +--- a/drivers/usb/musb/musb_am335x.c ++++ b/drivers/usb/musb/musb_am335x.c +@@ -20,21 +20,6 @@ err: + return ret; + } + +-static int of_remove_populated_child(struct device *dev, void *d) +-{ +- struct platform_device *pdev = to_platform_device(dev); +- +- of_device_unregister(pdev); +- return 0; +-} +- +-static int am335x_child_remove(struct platform_device *pdev) +-{ +- device_for_each_child(&pdev->dev, NULL, of_remove_populated_child); +- pm_runtime_disable(&pdev->dev); +- return 0; +-} +- + static const struct of_device_id am335x_child_of_match[] = { + { .compatible = "ti,am33xx-usb" }, + { }, +@@ -43,13 +28,17 @@ MODULE_DEVICE_TABLE(of, am335x_child_of_match); + + static struct platform_driver am335x_child_driver = { + .probe = am335x_child_probe, +- .remove = am335x_child_remove, + .driver = { + .name = "am335x-usb-childs", + .of_match_table = of_match_ptr(am335x_child_of_match), + }, + }; + +-module_platform_driver(am335x_child_driver); ++static int __init am335x_child_init(void) ++{ ++ return platform_driver_register(&am335x_child_driver); ++} ++module_init(am335x_child_init); ++ + MODULE_DESCRIPTION("AM33xx child devices"); + MODULE_LICENSE("GPL v2"); +diff --git a/drivers/usb/musb/musb_cppi41.c b/drivers/usb/musb/musb_cppi41.c +index 0c593afc3185..cc319305c022 100644 +--- a/drivers/usb/musb/musb_cppi41.c ++++ b/drivers/usb/musb/musb_cppi41.c +@@ -266,7 +266,7 @@ static void cppi41_dma_callback(void *private_data) + } + list_add_tail(&cppi41_channel->tx_check, + &controller->early_tx_list); +- if (!hrtimer_active(&controller->early_tx)) { ++ if (!hrtimer_is_queued(&controller->early_tx)) { + hrtimer_start_range_ns(&controller->early_tx, + ktime_set(0, 140 * NSEC_PER_USEC), + 40 * NSEC_PER_USEC, +diff --git a/drivers/usb/musb/ux500.c b/drivers/usb/musb/ux500.c +index 59256b12f746..8264256271f8 100644 +--- a/drivers/usb/musb/ux500.c ++++ b/drivers/usb/musb/ux500.c +@@ -275,7 +275,6 @@ static int ux500_probe(struct platform_device *pdev) + musb->dev.parent = &pdev->dev; + musb->dev.dma_mask = &pdev->dev.coherent_dma_mask; + musb->dev.coherent_dma_mask = pdev->dev.coherent_dma_mask; +- musb->dev.of_node = pdev->dev.of_node; + + glue->dev = &pdev->dev; + glue->musb = musb; +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index 71873cafb9d3..1db213a6e843 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -153,6 +153,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */ + { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */ + { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */ ++ { USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */ + { USB_DEVICE(0x1BE3, 0x07A6) }, /* WAGO 750-923 USB Service Cable */ + { USB_DEVICE(0x1E29, 0x0102) }, /* Festo CPX-USB */ + { USB_DEVICE(0x1E29, 0x0501) }, /* Festo CMSP */ +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index 503c89e18187..e0bf8ee1f976 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -721,7 +721,8 @@ static struct usb_device_id id_table_combined [] = { + { USB_DEVICE(FTDI_VID, FTDI_ACG_HFDUAL_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_YEI_SERVOCENTER31_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_THORLABS_PID) }, +- { USB_DEVICE(TESTO_VID, TESTO_USB_INTERFACE_PID) }, ++ { USB_DEVICE(TESTO_VID, TESTO_1_PID) }, ++ { USB_DEVICE(TESTO_VID, TESTO_3_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_GAMMA_SCOUT_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_TACTRIX_OPENPORT_13M_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_TACTRIX_OPENPORT_13S_PID) }, +@@ -945,6 +946,8 @@ static struct usb_device_id id_table_combined [] = { + { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_2_PID) }, + { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_3_PID) }, + { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_4_PID) }, ++ /* Infineon Devices */ ++ { USB_DEVICE_INTERFACE_NUMBER(INFINEON_VID, INFINEON_TRIBOARD_PID, 1) }, + { } /* Terminating entry */ + }; + +@@ -1567,14 +1570,17 @@ static void ftdi_set_max_packet_size(struct usb_serial_port *port) + struct usb_device *udev = serial->dev; + + struct usb_interface *interface = serial->interface; +- struct usb_endpoint_descriptor *ep_desc = &interface->cur_altsetting->endpoint[1].desc; ++ struct usb_endpoint_descriptor *ep_desc; + + unsigned num_endpoints; +- int i; ++ unsigned i; + + num_endpoints = interface->cur_altsetting->desc.bNumEndpoints; + dev_info(&udev->dev, "Number of endpoints %d\n", num_endpoints); + ++ if (!num_endpoints) ++ return; ++ + /* NOTE: some customers have programmed FT232R/FT245R devices + * with an endpoint size of 0 - not good. In this case, we + * want to override the endpoint descriptor setting and use a +diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h +index 500474c48f4b..c4777bc6aee0 100644 +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -584,6 +584,12 @@ + #define RATOC_PRODUCT_ID_USB60F 0xb020 + + /* ++ * Infineon Technologies ++ */ ++#define INFINEON_VID 0x058b ++#define INFINEON_TRIBOARD_PID 0x0028 /* DAS JTAG TriBoard TC1798 V1.0 */ ++ ++/* + * Acton Research Corp. + */ + #define ACTON_VID 0x0647 /* Vendor ID */ +@@ -798,7 +804,8 @@ + * Submitted by Colin Leroy + */ + #define TESTO_VID 0x128D +-#define TESTO_USB_INTERFACE_PID 0x0001 ++#define TESTO_1_PID 0x0001 ++#define TESTO_3_PID 0x0003 + + /* + * Mobility Electronics products. +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 70ede84f4f6b..9da566a3f5c8 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -352,6 +352,9 @@ static void option_instat_callback(struct urb *urb); + /* Zoom */ + #define ZOOM_PRODUCT_4597 0x9607 + ++/* SpeedUp SU9800 usb 3g modem */ ++#define SPEEDUP_PRODUCT_SU9800 0x9800 ++ + /* Haier products */ + #define HAIER_VENDOR_ID 0x201e + #define HAIER_PRODUCT_CE100 0x2009 +@@ -372,8 +375,12 @@ static void option_instat_callback(struct urb *urb); + /* Olivetti products */ + #define OLIVETTI_VENDOR_ID 0x0b3c + #define OLIVETTI_PRODUCT_OLICARD100 0xc000 ++#define OLIVETTI_PRODUCT_OLICARD120 0xc001 ++#define OLIVETTI_PRODUCT_OLICARD140 0xc002 + #define OLIVETTI_PRODUCT_OLICARD145 0xc003 ++#define OLIVETTI_PRODUCT_OLICARD155 0xc004 + #define OLIVETTI_PRODUCT_OLICARD200 0xc005 ++#define OLIVETTI_PRODUCT_OLICARD160 0xc00a + #define OLIVETTI_PRODUCT_OLICARD500 0xc00b + + /* Celot products */ +@@ -1480,6 +1487,8 @@ static const struct usb_device_id option_ids[] = { + .driver_info = (kernel_ulong_t)&net_intf2_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1426, 0xff, 0xff, 0xff), /* ZTE MF91 */ + .driver_info = (kernel_ulong_t)&net_intf2_blacklist }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1428, 0xff, 0xff, 0xff), /* Telewell TW-LTE 4G v2 */ ++ .driver_info = (kernel_ulong_t)&net_intf2_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1533, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1534, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1535, 0xff, 0xff, 0xff) }, +@@ -1577,6 +1586,7 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14), + .driver_info = (kernel_ulong_t)&four_g_w14_blacklist + }, ++ { USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, SPEEDUP_PRODUCT_SU9800, 0xff) }, + { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) }, + { USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) }, + { USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) }, +@@ -1611,15 +1621,21 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDMNET) }, + { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, /* HC28 enumerates with Siemens or Cinterion VID depending on FW revision */ + { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) }, +- +- { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) }, ++ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100), ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, ++ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD120), ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, ++ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD140), ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD145) }, ++ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD155), ++ .driver_info = (kernel_ulong_t)&net_intf6_blacklist }, + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD200), +- .driver_info = (kernel_ulong_t)&net_intf6_blacklist +- }, ++ .driver_info = (kernel_ulong_t)&net_intf6_blacklist }, ++ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD160), ++ .driver_info = (kernel_ulong_t)&net_intf6_blacklist }, + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD500), +- .driver_info = (kernel_ulong_t)&net_intf4_blacklist +- }, ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */ + { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/ + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM600) }, +diff --git a/drivers/watchdog/ath79_wdt.c b/drivers/watchdog/ath79_wdt.c +index 37cb09b27b63..c97a47ca8971 100644 +--- a/drivers/watchdog/ath79_wdt.c ++++ b/drivers/watchdog/ath79_wdt.c +@@ -20,6 +20,7 @@ + #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + + #include <linux/bitops.h> ++#include <linux/delay.h> + #include <linux/errno.h> + #include <linux/fs.h> + #include <linux/init.h> +@@ -91,6 +92,15 @@ static inline void ath79_wdt_keepalive(void) + static inline void ath79_wdt_enable(void) + { + ath79_wdt_keepalive(); ++ ++ /* ++ * Updating the TIMER register requires a few microseconds ++ * on the AR934x SoCs at least. Use a small delay to ensure ++ * that the TIMER register is updated within the hardware ++ * before enabling the watchdog. ++ */ ++ udelay(2); ++ + ath79_wdt_wr(WDOG_REG_CTRL, WDOG_CTRL_ACTION_FCR); + /* flush write */ + ath79_wdt_rr(WDOG_REG_CTRL); +diff --git a/drivers/watchdog/kempld_wdt.c b/drivers/watchdog/kempld_wdt.c +index 5c3d4df63e68..22b9a036b3e1 100644 +--- a/drivers/watchdog/kempld_wdt.c ++++ b/drivers/watchdog/kempld_wdt.c +@@ -163,7 +163,7 @@ static int kempld_wdt_set_stage_timeout(struct kempld_wdt_data *wdt_data, + kempld_get_mutex(pld); + stage_cfg = kempld_read8(pld, KEMPLD_WDT_STAGE_CFG(stage->id)); + stage_cfg &= ~STAGE_CFG_PRESCALER_MASK; +- stage_cfg |= STAGE_CFG_SET_PRESCALER(prescaler); ++ stage_cfg |= STAGE_CFG_SET_PRESCALER(PRESCALER_21); + kempld_write8(pld, KEMPLD_WDT_STAGE_CFG(stage->id), stage_cfg); + kempld_write32(pld, KEMPLD_WDT_STAGE_TIMEOUT(stage->id), + stage_timeout); +diff --git a/drivers/watchdog/sp805_wdt.c b/drivers/watchdog/sp805_wdt.c +index 58df98aec122..2cf02ffbf9d8 100644 +--- a/drivers/watchdog/sp805_wdt.c ++++ b/drivers/watchdog/sp805_wdt.c +@@ -60,7 +60,6 @@ + * @adev: amba device structure of wdt + * @status: current status of wdt + * @load_val: load value to be set for current timeout +- * @timeout: current programmed timeout + */ + struct sp805_wdt { + struct watchdog_device wdd; +@@ -69,7 +68,6 @@ struct sp805_wdt { + struct clk *clk; + struct amba_device *adev; + unsigned int load_val; +- unsigned int timeout; + }; + + static bool nowayout = WATCHDOG_NOWAYOUT; +@@ -99,7 +97,7 @@ static int wdt_setload(struct watchdog_device *wdd, unsigned int timeout) + spin_lock(&wdt->lock); + wdt->load_val = load; + /* roundup timeout to closest positive integer value */ +- wdt->timeout = div_u64((load + 1) * 2 + (rate / 2), rate); ++ wdd->timeout = div_u64((load + 1) * 2 + (rate / 2), rate); + spin_unlock(&wdt->lock); + + return 0; +diff --git a/fs/aio.c b/fs/aio.c +index 0abde33de70e..e609e15f36b9 100644 +--- a/fs/aio.c ++++ b/fs/aio.c +@@ -1066,9 +1066,6 @@ static long aio_read_events_ring(struct kioctx *ctx, + head %= ctx->nr_events; + tail %= ctx->nr_events; + +- head %= ctx->nr_events; +- tail %= ctx->nr_events; +- + while (ret < nr) { + long avail; + struct io_event *ev; +diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c +index 0227b45ef00a..15e9505aa35f 100644 +--- a/fs/cifs/cifs_unicode.c ++++ b/fs/cifs/cifs_unicode.c +@@ -290,7 +290,8 @@ int + cifsConvertToUTF16(__le16 *target, const char *source, int srclen, + const struct nls_table *cp, int mapChars) + { +- int i, j, charlen; ++ int i, charlen; ++ int j = 0; + char src_char; + __le16 dst_char; + wchar_t tmp; +@@ -298,12 +299,11 @@ cifsConvertToUTF16(__le16 *target, const char *source, int srclen, + if (!mapChars) + return cifs_strtoUTF16(target, source, PATH_MAX, cp); + +- for (i = 0, j = 0; i < srclen; j++) { ++ for (i = 0; i < srclen; j++) { + src_char = source[i]; + charlen = 1; + switch (src_char) { + case 0: +- put_unaligned(0, &target[j]); + goto ctoUTF16_out; + case ':': + dst_char = cpu_to_le16(UNI_COLON); +@@ -350,6 +350,7 @@ cifsConvertToUTF16(__le16 *target, const char *source, int srclen, + } + + ctoUTF16_out: ++ put_unaligned(0, &target[j]); /* Null terminate target unicode string */ + return j; + } + +diff --git a/fs/ext4/extents_status.c b/fs/ext4/extents_status.c +index 3981ff783950..171b9fa0f27a 100644 +--- a/fs/ext4/extents_status.c ++++ b/fs/ext4/extents_status.c +@@ -962,10 +962,10 @@ retry: + continue; + } + +- if (ei->i_es_lru_nr == 0 || ei == locked_ei) ++ if (ei->i_es_lru_nr == 0 || ei == locked_ei || ++ !write_trylock(&ei->i_es_lock)) + continue; + +- write_lock(&ei->i_es_lock); + shrunk = __es_try_to_reclaim_extents(ei, nr_to_scan); + if (ei->i_es_lru_nr == 0) + list_del_init(&ei->i_es_lru); +diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c +index 137193ff389b..5b5971c20af1 100644 +--- a/fs/ext4/ialloc.c ++++ b/fs/ext4/ialloc.c +@@ -851,6 +851,13 @@ got: + goto out; + } + ++ BUFFER_TRACE(group_desc_bh, "get_write_access"); ++ err = ext4_journal_get_write_access(handle, group_desc_bh); ++ if (err) { ++ ext4_std_error(sb, err); ++ goto out; ++ } ++ + /* We may have to initialize the block bitmap if it isn't already */ + if (ext4_has_group_desc_csum(sb) && + gdp->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT)) { +@@ -887,13 +894,6 @@ got: + } + } + +- BUFFER_TRACE(group_desc_bh, "get_write_access"); +- err = ext4_journal_get_write_access(handle, group_desc_bh); +- if (err) { +- ext4_std_error(sb, err); +- goto out; +- } +- + /* Update the relevant bg descriptor fields */ + if (ext4_has_group_desc_csum(sb)) { + int free; +diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c +index 594009f5f523..e6574d7b6642 100644 +--- a/fs/ext4/indirect.c ++++ b/fs/ext4/indirect.c +@@ -389,7 +389,13 @@ static int ext4_alloc_branch(handle_t *handle, struct inode *inode, + return 0; + failed: + for (; i >= 0; i--) { +- if (i != indirect_blks && branch[i].bh) ++ /* ++ * We want to ext4_forget() only freshly allocated indirect ++ * blocks. Buffer for new_blocks[i-1] is at branch[i].bh and ++ * buffer at branch[0].bh is indirect block / inode already ++ * existing before ext4_alloc_branch() was called. ++ */ ++ if (i > 0 && i != indirect_blks && branch[i].bh) + ext4_forget(handle, 1, inode, branch[i].bh, + branch[i].bh->b_blocknr); + ext4_free_blocks(handle, inode, NULL, new_blocks[i], +@@ -1312,16 +1318,24 @@ static int free_hole_blocks(handle_t *handle, struct inode *inode, + blk = *i_data; + if (level > 0) { + ext4_lblk_t first2; ++ ext4_lblk_t count2; ++ + bh = sb_bread(inode->i_sb, le32_to_cpu(blk)); + if (!bh) { + EXT4_ERROR_INODE_BLOCK(inode, le32_to_cpu(blk), + "Read failure"); + return -EIO; + } +- first2 = (first > offset) ? first - offset : 0; ++ if (first > offset) { ++ first2 = first - offset; ++ count2 = count; ++ } else { ++ first2 = 0; ++ count2 = count - (offset - first); ++ } + ret = free_hole_blocks(handle, inode, bh, + (__le32 *)bh->b_data, level - 1, +- first2, count - offset, ++ first2, count2, + inode->i_sb->s_blocksize >> 2); + if (ret) { + brelse(bh); +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index 08ddfdac955c..502f0fd71470 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -751,8 +751,8 @@ void ext4_mb_generate_buddy(struct super_block *sb, + + if (free != grp->bb_free) { + ext4_grp_locked_error(sb, group, 0, 0, +- "%u clusters in bitmap, %u in gd; " +- "block bitmap corrupt.", ++ "block bitmap and bg descriptor " ++ "inconsistent: %u vs %u free clusters", + free, grp->bb_free); + /* + * If we intend to continue, we consider group descriptor +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index d9711dc42164..9afc4ba21611 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -1500,8 +1500,6 @@ static int handle_mount_opt(struct super_block *sb, char *opt, int token, + arg = JBD2_DEFAULT_MAX_COMMIT_AGE; + sbi->s_commit_interval = HZ * arg; + } else if (token == Opt_max_batch_time) { +- if (arg == 0) +- arg = EXT4_DEF_MAX_BATCH_TIME; + sbi->s_max_batch_time = arg; + } else if (token == Opt_min_batch_time) { + sbi->s_min_batch_time = arg; +@@ -2762,10 +2760,11 @@ static void print_daily_error_info(unsigned long arg) + es = sbi->s_es; + + if (es->s_error_count) +- ext4_msg(sb, KERN_NOTICE, "error count: %u", ++ /* fsck newer than v1.41.13 is needed to clean this condition. */ ++ ext4_msg(sb, KERN_NOTICE, "error count since last fsck: %u", + le32_to_cpu(es->s_error_count)); + if (es->s_first_error_time) { +- printk(KERN_NOTICE "EXT4-fs (%s): initial error at %u: %.*s:%d", ++ printk(KERN_NOTICE "EXT4-fs (%s): initial error at time %u: %.*s:%d", + sb->s_id, le32_to_cpu(es->s_first_error_time), + (int) sizeof(es->s_first_error_func), + es->s_first_error_func, +@@ -2779,7 +2778,7 @@ static void print_daily_error_info(unsigned long arg) + printk("\n"); + } + if (es->s_last_error_time) { +- printk(KERN_NOTICE "EXT4-fs (%s): last error at %u: %.*s:%d", ++ printk(KERN_NOTICE "EXT4-fs (%s): last error at time %u: %.*s:%d", + sb->s_id, le32_to_cpu(es->s_last_error_time), + (int) sizeof(es->s_last_error_func), + es->s_last_error_func, +diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c +index 7272cc6977ec..ab3815c856dc 100644 +--- a/fs/jbd2/transaction.c ++++ b/fs/jbd2/transaction.c +@@ -1590,9 +1590,12 @@ int jbd2_journal_stop(handle_t *handle) + * to perform a synchronous write. We do this to detect the + * case where a single process is doing a stream of sync + * writes. No point in waiting for joiners in that case. ++ * ++ * Setting max_batch_time to 0 disables this completely. + */ + pid = current->pid; +- if (handle->h_sync && journal->j_last_sync_writer != pid) { ++ if (handle->h_sync && journal->j_last_sync_writer != pid && ++ journal->j_max_batch_time) { + u64 commit_time, trans_time; + + journal->j_last_sync_writer = pid; +diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c +index fdeeb28f287b..7f5799d098fd 100644 +--- a/fs/nfs/inode.c ++++ b/fs/nfs/inode.c +@@ -1540,18 +1540,20 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr) + inode->i_version = fattr->change_attr; + } + } else if (server->caps & NFS_CAP_CHANGE_ATTR) +- invalid |= save_cache_validity; ++ nfsi->cache_validity |= save_cache_validity; + + if (fattr->valid & NFS_ATTR_FATTR_MTIME) { + memcpy(&inode->i_mtime, &fattr->mtime, sizeof(inode->i_mtime)); + } else if (server->caps & NFS_CAP_MTIME) +- invalid |= save_cache_validity & (NFS_INO_INVALID_ATTR ++ nfsi->cache_validity |= save_cache_validity & ++ (NFS_INO_INVALID_ATTR + | NFS_INO_REVAL_FORCED); + + if (fattr->valid & NFS_ATTR_FATTR_CTIME) { + memcpy(&inode->i_ctime, &fattr->ctime, sizeof(inode->i_ctime)); + } else if (server->caps & NFS_CAP_CTIME) +- invalid |= save_cache_validity & (NFS_INO_INVALID_ATTR ++ nfsi->cache_validity |= save_cache_validity & ++ (NFS_INO_INVALID_ATTR + | NFS_INO_REVAL_FORCED); + + /* Check if our cached file size is stale */ +@@ -1574,7 +1576,8 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr) + (long long)new_isize); + } + } else +- invalid |= save_cache_validity & (NFS_INO_INVALID_ATTR ++ nfsi->cache_validity |= save_cache_validity & ++ (NFS_INO_INVALID_ATTR + | NFS_INO_REVAL_PAGECACHE + | NFS_INO_REVAL_FORCED); + +@@ -1582,7 +1585,8 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr) + if (fattr->valid & NFS_ATTR_FATTR_ATIME) + memcpy(&inode->i_atime, &fattr->atime, sizeof(inode->i_atime)); + else if (server->caps & NFS_CAP_ATIME) +- invalid |= save_cache_validity & (NFS_INO_INVALID_ATIME ++ nfsi->cache_validity |= save_cache_validity & ++ (NFS_INO_INVALID_ATIME + | NFS_INO_REVAL_FORCED); + + if (fattr->valid & NFS_ATTR_FATTR_MODE) { +@@ -1593,7 +1597,8 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr) + invalid |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL; + } + } else if (server->caps & NFS_CAP_MODE) +- invalid |= save_cache_validity & (NFS_INO_INVALID_ATTR ++ nfsi->cache_validity |= save_cache_validity & ++ (NFS_INO_INVALID_ATTR + | NFS_INO_INVALID_ACCESS + | NFS_INO_INVALID_ACL + | NFS_INO_REVAL_FORCED); +@@ -1604,7 +1609,8 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr) + inode->i_uid = fattr->uid; + } + } else if (server->caps & NFS_CAP_OWNER) +- invalid |= save_cache_validity & (NFS_INO_INVALID_ATTR ++ nfsi->cache_validity |= save_cache_validity & ++ (NFS_INO_INVALID_ATTR + | NFS_INO_INVALID_ACCESS + | NFS_INO_INVALID_ACL + | NFS_INO_REVAL_FORCED); +@@ -1615,7 +1621,8 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr) + inode->i_gid = fattr->gid; + } + } else if (server->caps & NFS_CAP_OWNER_GROUP) +- invalid |= save_cache_validity & (NFS_INO_INVALID_ATTR ++ nfsi->cache_validity |= save_cache_validity & ++ (NFS_INO_INVALID_ATTR + | NFS_INO_INVALID_ACCESS + | NFS_INO_INVALID_ACL + | NFS_INO_REVAL_FORCED); +@@ -1628,7 +1635,8 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr) + set_nlink(inode, fattr->nlink); + } + } else if (server->caps & NFS_CAP_NLINK) +- invalid |= save_cache_validity & (NFS_INO_INVALID_ATTR ++ nfsi->cache_validity |= save_cache_validity & ++ (NFS_INO_INVALID_ATTR + | NFS_INO_REVAL_FORCED); + + if (fattr->valid & NFS_ATTR_FATTR_SPACE_USED) { +diff --git a/fs/nfs/nfs4filelayout.c b/fs/nfs/nfs4filelayout.c +index 394b0a0c54bf..3c27659aba7b 100644 +--- a/fs/nfs/nfs4filelayout.c ++++ b/fs/nfs/nfs4filelayout.c +@@ -1330,7 +1330,7 @@ filelayout_alloc_layout_hdr(struct inode *inode, gfp_t gfp_flags) + struct nfs4_filelayout *flo; + + flo = kzalloc(sizeof(*flo), gfp_flags); +- return &flo->generic_hdr; ++ return flo != NULL ? &flo->generic_hdr : NULL; + } + + static void +diff --git a/fs/nfs/super.c b/fs/nfs/super.c +index a03b9c6f9489..64940b5286db 100644 +--- a/fs/nfs/super.c ++++ b/fs/nfs/super.c +@@ -2197,6 +2197,7 @@ nfs_remount(struct super_block *sb, int *flags, char *raw_data) + data->timeo = 10U * nfss->client->cl_timeout->to_initval / HZ; + data->nfs_server.port = nfss->port; + data->nfs_server.addrlen = nfss->nfs_client->cl_addrlen; ++ data->net = current->nsproxy->net_ns; + memcpy(&data->nfs_server.address, &nfss->nfs_client->cl_addr, + data->nfs_server.addrlen); + +diff --git a/fs/nfs/write.c b/fs/nfs/write.c +index c6aa89f92558..3a1b1d1a27ce 100644 +--- a/fs/nfs/write.c ++++ b/fs/nfs/write.c +@@ -913,12 +913,14 @@ static bool nfs_write_pageuptodate(struct page *page, struct inode *inode) + + if (nfs_have_delegated_attributes(inode)) + goto out; +- if (nfsi->cache_validity & (NFS_INO_INVALID_DATA|NFS_INO_REVAL_PAGECACHE)) ++ if (nfsi->cache_validity & NFS_INO_REVAL_PAGECACHE) + return false; + smp_rmb(); + if (test_bit(NFS_INO_INVALIDATING, &nfsi->flags)) + return false; + out: ++ if (nfsi->cache_validity & NFS_INO_INVALID_DATA) ++ return false; + return PageUptodate(page) != 0; + } + +diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c +index b9e784486729..08c8e023c157 100644 +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -610,15 +610,6 @@ nfsd4_create(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, + + switch (create->cr_type) { + case NF4LNK: +- /* ugh! we have to null-terminate the linktext, or +- * vfs_symlink() will choke. it is always safe to +- * null-terminate by brute force, since at worst we +- * will overwrite the first byte of the create namelen +- * in the XDR buffer, which has already been extracted +- * during XDR decode. +- */ +- create->cr_linkname[create->cr_linklen] = 0; +- + status = nfsd_symlink(rqstp, &cstate->current_fh, + create->cr_name, create->cr_namelen, + create->cr_linkname, create->cr_linklen, +diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c +index 4ab5ff492ca1..42c8c8aeb465 100644 +--- a/fs/nfsd/nfs4xdr.c ++++ b/fs/nfsd/nfs4xdr.c +@@ -594,7 +594,18 @@ nfsd4_decode_create(struct nfsd4_compoundargs *argp, struct nfsd4_create *create + READ_BUF(4); + READ32(create->cr_linklen); + READ_BUF(create->cr_linklen); +- SAVEMEM(create->cr_linkname, create->cr_linklen); ++ /* ++ * The VFS will want a null-terminated string, and ++ * null-terminating in place isn't safe since this might ++ * end on a page boundary: ++ */ ++ create->cr_linkname = ++ kmalloc(create->cr_linklen + 1, GFP_KERNEL); ++ if (!create->cr_linkname) ++ return nfserr_jukebox; ++ memcpy(create->cr_linkname, p, create->cr_linklen); ++ create->cr_linkname[create->cr_linklen] = '\0'; ++ defer_free(argp, kfree, create->cr_linkname); + break; + case NF4BLK: + case NF4CHR: +@@ -2113,8 +2124,8 @@ nfsd4_encode_fattr(struct svc_fh *fhp, struct svc_export *exp, + err = vfs_getattr(&path, &stat); + if (err) + goto out_nfserr; +- if ((bmval0 & (FATTR4_WORD0_FILES_FREE | FATTR4_WORD0_FILES_TOTAL | +- FATTR4_WORD0_MAXNAME)) || ++ if ((bmval0 & (FATTR4_WORD0_FILES_AVAIL | FATTR4_WORD0_FILES_FREE | ++ FATTR4_WORD0_FILES_TOTAL | FATTR4_WORD0_MAXNAME)) || + (bmval1 & (FATTR4_WORD1_SPACE_AVAIL | FATTR4_WORD1_SPACE_FREE | + FATTR4_WORD1_SPACE_TOTAL))) { + err = vfs_statfs(&path, &statfs); +diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c +index ad62bdbb451e..1e4cf9d73130 100644 +--- a/fs/reiserfs/inode.c ++++ b/fs/reiserfs/inode.c +@@ -3220,8 +3220,14 @@ int reiserfs_setattr(struct dentry *dentry, struct iattr *attr) + attr->ia_size != i_size_read(inode)) { + error = inode_newsize_ok(inode, attr->ia_size); + if (!error) { ++ /* ++ * Could race against reiserfs_file_release ++ * if called from NFS, so take tailpack mutex. ++ */ ++ mutex_lock(&REISERFS_I(inode)->tailpack); + truncate_setsize(inode, attr->ia_size); +- reiserfs_vfs_truncate_file(inode); ++ reiserfs_truncate_file(inode, 1); ++ mutex_unlock(&REISERFS_I(inode)->tailpack); + } + } + +diff --git a/fs/ubifs/file.c b/fs/ubifs/file.c +index 123c79b7261e..b56eb6275744 100644 +--- a/fs/ubifs/file.c ++++ b/fs/ubifs/file.c +@@ -1525,8 +1525,7 @@ static int ubifs_vm_page_mkwrite(struct vm_area_struct *vma, + } + + wait_for_stable_page(page); +- unlock_page(page); +- return 0; ++ return VM_FAULT_LOCKED; + + out_unlock: + unlock_page(page); +diff --git a/fs/ubifs/shrinker.c b/fs/ubifs/shrinker.c +index f35135e28e96..9a9fb94a41c6 100644 +--- a/fs/ubifs/shrinker.c ++++ b/fs/ubifs/shrinker.c +@@ -128,7 +128,6 @@ static int shrink_tnc(struct ubifs_info *c, int nr, int age, int *contention) + freed = ubifs_destroy_tnc_subtree(znode); + atomic_long_sub(freed, &ubifs_clean_zn_cnt); + atomic_long_sub(freed, &c->clean_zn_cnt); +- ubifs_assert(atomic_long_read(&c->clean_zn_cnt) >= 0); + total_freed += freed; + znode = zprev; + } +diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h +index 077904c8b70d..cc79eff4a1ad 100644 +--- a/include/linux/ptrace.h ++++ b/include/linux/ptrace.h +@@ -334,6 +334,9 @@ static inline void user_single_step_siginfo(struct task_struct *tsk, + * calling arch_ptrace_stop() when it would be superfluous. For example, + * if the thread has not been back to user mode since the last stop, the + * thread state might indicate that nothing needs to be done. ++ * ++ * This is guaranteed to be invoked once before a task stops for ptrace and ++ * may include arch-specific operations necessary prior to a ptrace stop. + */ + #define arch_ptrace_stop_needed(code, info) (0) + #endif +diff --git a/include/linux/ring_buffer.h b/include/linux/ring_buffer.h +index d69cf637a15a..49a4d6f59108 100644 +--- a/include/linux/ring_buffer.h ++++ b/include/linux/ring_buffer.h +@@ -97,7 +97,7 @@ __ring_buffer_alloc(unsigned long size, unsigned flags, struct lock_class_key *k + __ring_buffer_alloc((size), (flags), &__key); \ + }) + +-void ring_buffer_wait(struct ring_buffer *buffer, int cpu); ++int ring_buffer_wait(struct ring_buffer *buffer, int cpu); + int ring_buffer_poll_wait(struct ring_buffer *buffer, int cpu, + struct file *filp, poll_table *poll_table); + +diff --git a/include/trace/syscall.h b/include/trace/syscall.h +index fed853f3d7aa..9674145e2f6a 100644 +--- a/include/trace/syscall.h ++++ b/include/trace/syscall.h +@@ -4,6 +4,7 @@ + #include <linux/tracepoint.h> + #include <linux/unistd.h> + #include <linux/ftrace_event.h> ++#include <linux/thread_info.h> + + #include <asm/ptrace.h> + +@@ -32,4 +33,18 @@ struct syscall_metadata { + struct ftrace_event_call *exit_event; + }; + ++#if defined(CONFIG_TRACEPOINTS) && defined(CONFIG_HAVE_SYSCALL_TRACEPOINTS) ++static inline void syscall_tracepoint_update(struct task_struct *p) ++{ ++ if (test_thread_flag(TIF_SYSCALL_TRACEPOINT)) ++ set_tsk_thread_flag(p, TIF_SYSCALL_TRACEPOINT); ++ else ++ clear_tsk_thread_flag(p, TIF_SYSCALL_TRACEPOINT); ++} ++#else ++static inline void syscall_tracepoint_update(struct task_struct *p) ++{ ++} ++#endif ++ + #endif /* _TRACE_SYSCALL_H */ +diff --git a/kernel/cpuset.c b/kernel/cpuset.c +index 5ae9f950e024..0b29c52479a6 100644 +--- a/kernel/cpuset.c ++++ b/kernel/cpuset.c +@@ -1236,7 +1236,13 @@ done: + + int current_cpuset_is_being_rebound(void) + { +- return task_cs(current) == cpuset_being_rebound; ++ int ret; ++ ++ rcu_read_lock(); ++ ret = task_cs(current) == cpuset_being_rebound; ++ rcu_read_unlock(); ++ ++ return ret; + } + + static int update_relax_domain_level(struct cpuset *cs, s64 val) +diff --git a/kernel/fork.c b/kernel/fork.c +index c873bd081e09..143962949bed 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -1490,7 +1490,9 @@ static struct task_struct *copy_process(unsigned long clone_flags, + + total_forks++; + spin_unlock(¤t->sighand->siglock); ++ syscall_tracepoint_update(p); + write_unlock_irq(&tasklist_lock); ++ + proc_fork_connector(p); + cgroup_post_fork(p); + if (clone_flags & CLONE_THREAD) +diff --git a/kernel/rtmutex-debug.h b/kernel/rtmutex-debug.h +index 14193d596d78..ab29b6a22669 100644 +--- a/kernel/rtmutex-debug.h ++++ b/kernel/rtmutex-debug.h +@@ -31,3 +31,8 @@ static inline int debug_rt_mutex_detect_deadlock(struct rt_mutex_waiter *waiter, + { + return (waiter != NULL); + } ++ ++static inline void rt_mutex_print_deadlock(struct rt_mutex_waiter *w) ++{ ++ debug_rt_mutex_print_deadlock(w); ++} +diff --git a/kernel/rtmutex.c b/kernel/rtmutex.c +index 0dd6aec1cb6a..51a83343df68 100644 +--- a/kernel/rtmutex.c ++++ b/kernel/rtmutex.c +@@ -82,6 +82,47 @@ static inline void mark_rt_mutex_waiters(struct rt_mutex *lock) + owner = *p; + } while (cmpxchg(p, owner, owner | RT_MUTEX_HAS_WAITERS) != owner); + } ++ ++/* ++ * Safe fastpath aware unlock: ++ * 1) Clear the waiters bit ++ * 2) Drop lock->wait_lock ++ * 3) Try to unlock the lock with cmpxchg ++ */ ++static inline bool unlock_rt_mutex_safe(struct rt_mutex *lock) ++ __releases(lock->wait_lock) ++{ ++ struct task_struct *owner = rt_mutex_owner(lock); ++ ++ clear_rt_mutex_waiters(lock); ++ raw_spin_unlock(&lock->wait_lock); ++ /* ++ * If a new waiter comes in between the unlock and the cmpxchg ++ * we have two situations: ++ * ++ * unlock(wait_lock); ++ * lock(wait_lock); ++ * cmpxchg(p, owner, 0) == owner ++ * mark_rt_mutex_waiters(lock); ++ * acquire(lock); ++ * or: ++ * ++ * unlock(wait_lock); ++ * lock(wait_lock); ++ * mark_rt_mutex_waiters(lock); ++ * ++ * cmpxchg(p, owner, 0) != owner ++ * enqueue_waiter(); ++ * unlock(wait_lock); ++ * lock(wait_lock); ++ * wake waiter(); ++ * unlock(wait_lock); ++ * lock(wait_lock); ++ * acquire(lock); ++ */ ++ return rt_mutex_cmpxchg(lock, owner, NULL); ++} ++ + #else + # define rt_mutex_cmpxchg(l,c,n) (0) + static inline void mark_rt_mutex_waiters(struct rt_mutex *lock) +@@ -89,6 +130,17 @@ static inline void mark_rt_mutex_waiters(struct rt_mutex *lock) + lock->owner = (struct task_struct *) + ((unsigned long)lock->owner | RT_MUTEX_HAS_WAITERS); + } ++ ++/* ++ * Simple slow path only version: lock->owner is protected by lock->wait_lock. ++ */ ++static inline bool unlock_rt_mutex_safe(struct rt_mutex *lock) ++ __releases(lock->wait_lock) ++{ ++ lock->owner = NULL; ++ raw_spin_unlock(&lock->wait_lock); ++ return true; ++} + #endif + + /* +@@ -142,27 +194,36 @@ static void rt_mutex_adjust_prio(struct task_struct *task) + */ + int max_lock_depth = 1024; + ++static inline struct rt_mutex *task_blocked_on_lock(struct task_struct *p) ++{ ++ return p->pi_blocked_on ? p->pi_blocked_on->lock : NULL; ++} ++ + /* + * Adjust the priority chain. Also used for deadlock detection. + * Decreases task's usage by one - may thus free the task. + * +- * @task: the task owning the mutex (owner) for which a chain walk is probably +- * needed ++ * @task: the task owning the mutex (owner) for which a chain walk is ++ * probably needed + * @deadlock_detect: do we have to carry out deadlock detection? +- * @orig_lock: the mutex (can be NULL if we are walking the chain to recheck +- * things for a task that has just got its priority adjusted, and +- * is waiting on a mutex) ++ * @orig_lock: the mutex (can be NULL if we are walking the chain to recheck ++ * things for a task that has just got its priority adjusted, and ++ * is waiting on a mutex) ++ * @next_lock: the mutex on which the owner of @orig_lock was blocked before ++ * we dropped its pi_lock. Is never dereferenced, only used for ++ * comparison to detect lock chain changes. + * @orig_waiter: rt_mutex_waiter struct for the task that has just donated +- * its priority to the mutex owner (can be NULL in the case +- * depicted above or if the top waiter is gone away and we are +- * actually deboosting the owner) +- * @top_task: the current top waiter ++ * its priority to the mutex owner (can be NULL in the case ++ * depicted above or if the top waiter is gone away and we are ++ * actually deboosting the owner) ++ * @top_task: the current top waiter + * + * Returns 0 or -EDEADLK. + */ + static int rt_mutex_adjust_prio_chain(struct task_struct *task, + int deadlock_detect, + struct rt_mutex *orig_lock, ++ struct rt_mutex *next_lock, + struct rt_mutex_waiter *orig_waiter, + struct task_struct *top_task) + { +@@ -196,7 +257,7 @@ static int rt_mutex_adjust_prio_chain(struct task_struct *task, + } + put_task_struct(task); + +- return deadlock_detect ? -EDEADLK : 0; ++ return -EDEADLK; + } + retry: + /* +@@ -221,13 +282,32 @@ static int rt_mutex_adjust_prio_chain(struct task_struct *task, + goto out_unlock_pi; + + /* ++ * We dropped all locks after taking a refcount on @task, so ++ * the task might have moved on in the lock chain or even left ++ * the chain completely and blocks now on an unrelated lock or ++ * on @orig_lock. ++ * ++ * We stored the lock on which @task was blocked in @next_lock, ++ * so we can detect the chain change. ++ */ ++ if (next_lock != waiter->lock) ++ goto out_unlock_pi; ++ ++ /* + * Drop out, when the task has no waiters. Note, + * top_waiter can be NULL, when we are in the deboosting + * mode! + */ +- if (top_waiter && (!task_has_pi_waiters(task) || +- top_waiter != task_top_pi_waiter(task))) +- goto out_unlock_pi; ++ if (top_waiter) { ++ if (!task_has_pi_waiters(task)) ++ goto out_unlock_pi; ++ /* ++ * If deadlock detection is off, we stop here if we ++ * are not the top pi waiter of the task. ++ */ ++ if (!detect_deadlock && top_waiter != task_top_pi_waiter(task)) ++ goto out_unlock_pi; ++ } + + /* + * When deadlock detection is off then we check, if further +@@ -243,11 +323,16 @@ static int rt_mutex_adjust_prio_chain(struct task_struct *task, + goto retry; + } + +- /* Deadlock detection */ ++ /* ++ * Deadlock detection. If the lock is the same as the original ++ * lock which caused us to walk the lock chain or if the ++ * current lock is owned by the task which initiated the chain ++ * walk, we detected a deadlock. ++ */ + if (lock == orig_lock || rt_mutex_owner(lock) == top_task) { + debug_rt_mutex_deadlock(deadlock_detect, orig_waiter, lock); + raw_spin_unlock(&lock->wait_lock); +- ret = deadlock_detect ? -EDEADLK : 0; ++ ret = -EDEADLK; + goto out_unlock_pi; + } + +@@ -294,11 +379,26 @@ static int rt_mutex_adjust_prio_chain(struct task_struct *task, + __rt_mutex_adjust_prio(task); + } + ++ /* ++ * Check whether the task which owns the current lock is pi ++ * blocked itself. If yes we store a pointer to the lock for ++ * the lock chain change detection above. After we dropped ++ * task->pi_lock next_lock cannot be dereferenced anymore. ++ */ ++ next_lock = task_blocked_on_lock(task); ++ + raw_spin_unlock_irqrestore(&task->pi_lock, flags); + + top_waiter = rt_mutex_top_waiter(lock); + raw_spin_unlock(&lock->wait_lock); + ++ /* ++ * We reached the end of the lock chain. Stop right here. No ++ * point to go back just to figure that out. ++ */ ++ if (!next_lock) ++ goto out_put_task; ++ + if (!detect_deadlock && waiter != top_waiter) + goto out_put_task; + +@@ -409,8 +509,21 @@ static int task_blocks_on_rt_mutex(struct rt_mutex *lock, + { + struct task_struct *owner = rt_mutex_owner(lock); + struct rt_mutex_waiter *top_waiter = waiter; +- unsigned long flags; ++ struct rt_mutex *next_lock; + int chain_walk = 0, res; ++ unsigned long flags; ++ ++ /* ++ * Early deadlock detection. We really don't want the task to ++ * enqueue on itself just to untangle the mess later. It's not ++ * only an optimization. We drop the locks, so another waiter ++ * can come in before the chain walk detects the deadlock. So ++ * the other will detect the deadlock and return -EDEADLOCK, ++ * which is wrong, as the other waiter is not in a deadlock ++ * situation. ++ */ ++ if (owner == task) ++ return -EDEADLK; + + raw_spin_lock_irqsave(&task->pi_lock, flags); + __rt_mutex_adjust_prio(task); +@@ -431,20 +544,28 @@ static int task_blocks_on_rt_mutex(struct rt_mutex *lock, + if (!owner) + return 0; + ++ raw_spin_lock_irqsave(&owner->pi_lock, flags); + if (waiter == rt_mutex_top_waiter(lock)) { +- raw_spin_lock_irqsave(&owner->pi_lock, flags); + plist_del(&top_waiter->pi_list_entry, &owner->pi_waiters); + plist_add(&waiter->pi_list_entry, &owner->pi_waiters); + + __rt_mutex_adjust_prio(owner); + if (owner->pi_blocked_on) + chain_walk = 1; +- raw_spin_unlock_irqrestore(&owner->pi_lock, flags); +- } +- else if (debug_rt_mutex_detect_deadlock(waiter, detect_deadlock)) ++ } else if (debug_rt_mutex_detect_deadlock(waiter, detect_deadlock)) { + chain_walk = 1; ++ } ++ ++ /* Store the lock on which owner is blocked or NULL */ ++ next_lock = task_blocked_on_lock(owner); + +- if (!chain_walk) ++ raw_spin_unlock_irqrestore(&owner->pi_lock, flags); ++ /* ++ * Even if full deadlock detection is on, if the owner is not ++ * blocked itself, we can avoid finding this out in the chain ++ * walk. ++ */ ++ if (!chain_walk || !next_lock) + return 0; + + /* +@@ -456,8 +577,8 @@ static int task_blocks_on_rt_mutex(struct rt_mutex *lock, + + raw_spin_unlock(&lock->wait_lock); + +- res = rt_mutex_adjust_prio_chain(owner, detect_deadlock, lock, waiter, +- task); ++ res = rt_mutex_adjust_prio_chain(owner, detect_deadlock, lock, ++ next_lock, waiter, task); + + raw_spin_lock(&lock->wait_lock); + +@@ -467,7 +588,8 @@ static int task_blocks_on_rt_mutex(struct rt_mutex *lock, + /* + * Wake up the next waiter on the lock. + * +- * Remove the top waiter from the current tasks waiter list and wake it up. ++ * Remove the top waiter from the current tasks pi waiter list and ++ * wake it up. + * + * Called with lock->wait_lock held. + */ +@@ -488,10 +610,23 @@ static void wakeup_next_waiter(struct rt_mutex *lock) + */ + plist_del(&waiter->pi_list_entry, ¤t->pi_waiters); + +- rt_mutex_set_owner(lock, NULL); ++ /* ++ * As we are waking up the top waiter, and the waiter stays ++ * queued on the lock until it gets the lock, this lock ++ * obviously has waiters. Just set the bit here and this has ++ * the added benefit of forcing all new tasks into the ++ * slow path making sure no task of lower priority than ++ * the top waiter can steal this lock. ++ */ ++ lock->owner = (void *) RT_MUTEX_HAS_WAITERS; + + raw_spin_unlock_irqrestore(¤t->pi_lock, flags); + ++ /* ++ * It's safe to dereference waiter as it cannot go away as ++ * long as we hold lock->wait_lock. The waiter task needs to ++ * acquire it in order to dequeue the waiter. ++ */ + wake_up_process(waiter->task); + } + +@@ -506,8 +641,8 @@ static void remove_waiter(struct rt_mutex *lock, + { + int first = (waiter == rt_mutex_top_waiter(lock)); + struct task_struct *owner = rt_mutex_owner(lock); ++ struct rt_mutex *next_lock = NULL; + unsigned long flags; +- int chain_walk = 0; + + raw_spin_lock_irqsave(¤t->pi_lock, flags); + plist_del(&waiter->list_entry, &lock->wait_list); +@@ -531,15 +666,15 @@ static void remove_waiter(struct rt_mutex *lock, + } + __rt_mutex_adjust_prio(owner); + +- if (owner->pi_blocked_on) +- chain_walk = 1; ++ /* Store the lock on which owner is blocked or NULL */ ++ next_lock = task_blocked_on_lock(owner); + + raw_spin_unlock_irqrestore(&owner->pi_lock, flags); + } + + WARN_ON(!plist_node_empty(&waiter->pi_list_entry)); + +- if (!chain_walk) ++ if (!next_lock) + return; + + /* gets dropped in rt_mutex_adjust_prio_chain()! */ +@@ -547,7 +682,7 @@ static void remove_waiter(struct rt_mutex *lock, + + raw_spin_unlock(&lock->wait_lock); + +- rt_mutex_adjust_prio_chain(owner, 0, lock, NULL, current); ++ rt_mutex_adjust_prio_chain(owner, 0, lock, next_lock, NULL, current); + + raw_spin_lock(&lock->wait_lock); + } +@@ -560,6 +695,7 @@ static void remove_waiter(struct rt_mutex *lock, + void rt_mutex_adjust_pi(struct task_struct *task) + { + struct rt_mutex_waiter *waiter; ++ struct rt_mutex *next_lock; + unsigned long flags; + + raw_spin_lock_irqsave(&task->pi_lock, flags); +@@ -569,12 +705,13 @@ void rt_mutex_adjust_pi(struct task_struct *task) + raw_spin_unlock_irqrestore(&task->pi_lock, flags); + return; + } +- ++ next_lock = waiter->lock; + raw_spin_unlock_irqrestore(&task->pi_lock, flags); + + /* gets dropped in rt_mutex_adjust_prio_chain()! */ + get_task_struct(task); +- rt_mutex_adjust_prio_chain(task, 0, NULL, NULL, task); ++ ++ rt_mutex_adjust_prio_chain(task, 0, NULL, next_lock, NULL, task); + } + + /** +@@ -626,6 +763,26 @@ __rt_mutex_slowlock(struct rt_mutex *lock, int state, + return ret; + } + ++static void rt_mutex_handle_deadlock(int res, int detect_deadlock, ++ struct rt_mutex_waiter *w) ++{ ++ /* ++ * If the result is not -EDEADLOCK or the caller requested ++ * deadlock detection, nothing to do here. ++ */ ++ if (res != -EDEADLOCK || detect_deadlock) ++ return; ++ ++ /* ++ * Yell lowdly and stop the task right here. ++ */ ++ rt_mutex_print_deadlock(w); ++ while (1) { ++ set_current_state(TASK_INTERRUPTIBLE); ++ schedule(); ++ } ++} ++ + /* + * Slow path lock function: + */ +@@ -663,8 +820,10 @@ rt_mutex_slowlock(struct rt_mutex *lock, int state, + + set_current_state(TASK_RUNNING); + +- if (unlikely(ret)) ++ if (unlikely(ret)) { + remove_waiter(lock, &waiter); ++ rt_mutex_handle_deadlock(ret, detect_deadlock, &waiter); ++ } + + /* + * try_to_take_rt_mutex() sets the waiter bit +@@ -720,12 +879,49 @@ rt_mutex_slowunlock(struct rt_mutex *lock) + + rt_mutex_deadlock_account_unlock(current); + +- if (!rt_mutex_has_waiters(lock)) { +- lock->owner = NULL; +- raw_spin_unlock(&lock->wait_lock); +- return; ++ /* ++ * We must be careful here if the fast path is enabled. If we ++ * have no waiters queued we cannot set owner to NULL here ++ * because of: ++ * ++ * foo->lock->owner = NULL; ++ * rtmutex_lock(foo->lock); <- fast path ++ * free = atomic_dec_and_test(foo->refcnt); ++ * rtmutex_unlock(foo->lock); <- fast path ++ * if (free) ++ * kfree(foo); ++ * raw_spin_unlock(foo->lock->wait_lock); ++ * ++ * So for the fastpath enabled kernel: ++ * ++ * Nothing can set the waiters bit as long as we hold ++ * lock->wait_lock. So we do the following sequence: ++ * ++ * owner = rt_mutex_owner(lock); ++ * clear_rt_mutex_waiters(lock); ++ * raw_spin_unlock(&lock->wait_lock); ++ * if (cmpxchg(&lock->owner, owner, 0) == owner) ++ * return; ++ * goto retry; ++ * ++ * The fastpath disabled variant is simple as all access to ++ * lock->owner is serialized by lock->wait_lock: ++ * ++ * lock->owner = NULL; ++ * raw_spin_unlock(&lock->wait_lock); ++ */ ++ while (!rt_mutex_has_waiters(lock)) { ++ /* Drops lock->wait_lock ! */ ++ if (unlock_rt_mutex_safe(lock) == true) ++ return; ++ /* Relock the rtmutex and try again */ ++ raw_spin_lock(&lock->wait_lock); + } + ++ /* ++ * The wakeup next waiter path does not suffer from the above ++ * race. See the comments there. ++ */ + wakeup_next_waiter(lock); + + raw_spin_unlock(&lock->wait_lock); +@@ -972,7 +1168,8 @@ int rt_mutex_start_proxy_lock(struct rt_mutex *lock, + return 1; + } + +- ret = task_blocks_on_rt_mutex(lock, waiter, task, detect_deadlock); ++ /* We enforce deadlock detection for futexes */ ++ ret = task_blocks_on_rt_mutex(lock, waiter, task, 1); + + if (ret && !rt_mutex_owner(lock)) { + /* +diff --git a/kernel/rtmutex.h b/kernel/rtmutex.h +index a1a1dd06421d..f6a1f3c133b1 100644 +--- a/kernel/rtmutex.h ++++ b/kernel/rtmutex.h +@@ -24,3 +24,8 @@ + #define debug_rt_mutex_print_deadlock(w) do { } while (0) + #define debug_rt_mutex_detect_deadlock(w,d) (d) + #define debug_rt_mutex_reset_waiter(w) do { } while (0) ++ ++static inline void rt_mutex_print_deadlock(struct rt_mutex_waiter *w) ++{ ++ WARN(1, "rtmutex deadlock detected\n"); ++} +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index 2a9db916c3f5..167741003616 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -138,7 +138,6 @@ static unsigned long dirty_bytes_min = 2 * PAGE_SIZE; + /* this is needed for the proc_dointvec_minmax for [fs_]overflow UID and GID */ + static int maxolduid = 65535; + static int minolduid; +-static int min_percpu_pagelist_fract = 8; + + static int ngroups_max = NGROUPS_MAX; + static const int cap_last_cap = CAP_LAST_CAP; +@@ -1287,7 +1286,7 @@ static struct ctl_table vm_table[] = { + .maxlen = sizeof(percpu_pagelist_fraction), + .mode = 0644, + .proc_handler = percpu_pagelist_fraction_sysctl_handler, +- .extra1 = &min_percpu_pagelist_fract, ++ .extra1 = &zero, + }, + #ifdef CONFIG_MMU + { +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index 0e337eedb909..15c4ae203885 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -543,7 +543,7 @@ static void rb_wake_up_waiters(struct irq_work *work) + * as data is added to any of the @buffer's cpu buffers. Otherwise + * it will wait for data to be added to a specific cpu buffer. + */ +-void ring_buffer_wait(struct ring_buffer *buffer, int cpu) ++int ring_buffer_wait(struct ring_buffer *buffer, int cpu) + { + struct ring_buffer_per_cpu *cpu_buffer; + DEFINE_WAIT(wait); +@@ -557,6 +557,8 @@ void ring_buffer_wait(struct ring_buffer *buffer, int cpu) + if (cpu == RING_BUFFER_ALL_CPUS) + work = &buffer->irq_work; + else { ++ if (!cpumask_test_cpu(cpu, buffer->cpumask)) ++ return -ENODEV; + cpu_buffer = buffer->buffers[cpu]; + work = &cpu_buffer->irq_work; + } +@@ -591,6 +593,7 @@ void ring_buffer_wait(struct ring_buffer *buffer, int cpu) + schedule(); + + finish_wait(&work->waiters, &wait); ++ return 0; + } + + /** +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 138077b1a607..5e9cb157d31e 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -1044,13 +1044,13 @@ update_max_tr_single(struct trace_array *tr, struct task_struct *tsk, int cpu) + } + #endif /* CONFIG_TRACER_MAX_TRACE */ + +-static void default_wait_pipe(struct trace_iterator *iter) ++static int default_wait_pipe(struct trace_iterator *iter) + { + /* Iterators are static, they should be filled or empty */ + if (trace_buffer_iter(iter, iter->cpu_file)) +- return; ++ return 0; + +- ring_buffer_wait(iter->trace_buffer->buffer, iter->cpu_file); ++ return ring_buffer_wait(iter->trace_buffer->buffer, iter->cpu_file); + } + + #ifdef CONFIG_FTRACE_STARTUP_TEST +@@ -1323,7 +1323,6 @@ void tracing_start(void) + + arch_spin_unlock(&ftrace_max_lock); + +- ftrace_start(); + out: + raw_spin_unlock_irqrestore(&global_trace.start_lock, flags); + } +@@ -1370,7 +1369,6 @@ void tracing_stop(void) + struct ring_buffer *buffer; + unsigned long flags; + +- ftrace_stop(); + raw_spin_lock_irqsave(&global_trace.start_lock, flags); + if (global_trace.stop_count++) + goto out; +@@ -1417,12 +1415,12 @@ static void tracing_stop_tr(struct trace_array *tr) + + void trace_stop_cmdline_recording(void); + +-static void trace_save_cmdline(struct task_struct *tsk) ++static int trace_save_cmdline(struct task_struct *tsk) + { + unsigned pid, idx; + + if (!tsk->pid || unlikely(tsk->pid > PID_MAX_DEFAULT)) +- return; ++ return 0; + + /* + * It's not the end of the world if we don't get +@@ -1431,7 +1429,7 @@ static void trace_save_cmdline(struct task_struct *tsk) + * so if we miss here, then better luck next time. + */ + if (!arch_spin_trylock(&trace_cmdline_lock)) +- return; ++ return 0; + + idx = map_pid_to_cmdline[tsk->pid]; + if (idx == NO_CMDLINE_MAP) { +@@ -1456,6 +1454,8 @@ static void trace_save_cmdline(struct task_struct *tsk) + memcpy(&saved_cmdlines[idx], tsk->comm, TASK_COMM_LEN); + + arch_spin_unlock(&trace_cmdline_lock); ++ ++ return 1; + } + + void trace_find_cmdline(int pid, char comm[]) +@@ -1497,9 +1497,8 @@ void tracing_record_cmdline(struct task_struct *tsk) + if (!__this_cpu_read(trace_cmdline_save)) + return; + +- __this_cpu_write(trace_cmdline_save, false); +- +- trace_save_cmdline(tsk); ++ if (trace_save_cmdline(tsk)) ++ __this_cpu_write(trace_cmdline_save, false); + } + + void +@@ -4060,17 +4059,19 @@ tracing_poll_pipe(struct file *filp, poll_table *poll_table) + * + * Anyway, this is really very primitive wakeup. + */ +-void poll_wait_pipe(struct trace_iterator *iter) ++int poll_wait_pipe(struct trace_iterator *iter) + { + set_current_state(TASK_INTERRUPTIBLE); + /* sleep for 100 msecs, and try again. */ + schedule_timeout(HZ / 10); ++ return 0; + } + + /* Must be called with trace_types_lock mutex held. */ + static int tracing_wait_pipe(struct file *filp) + { + struct trace_iterator *iter = filp->private_data; ++ int ret; + + while (trace_empty(iter)) { + +@@ -4080,10 +4081,13 @@ static int tracing_wait_pipe(struct file *filp) + + mutex_unlock(&iter->mutex); + +- iter->trace->wait_pipe(iter); ++ ret = iter->trace->wait_pipe(iter); + + mutex_lock(&iter->mutex); + ++ if (ret) ++ return ret; ++ + if (signal_pending(current)) + return -EINTR; + +@@ -5017,8 +5021,12 @@ tracing_buffers_read(struct file *filp, char __user *ubuf, + goto out_unlock; + } + mutex_unlock(&trace_types_lock); +- iter->trace->wait_pipe(iter); ++ ret = iter->trace->wait_pipe(iter); + mutex_lock(&trace_types_lock); ++ if (ret) { ++ size = ret; ++ goto out_unlock; ++ } + if (signal_pending(current)) { + size = -EINTR; + goto out_unlock; +@@ -5230,8 +5238,10 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos, + goto out; + } + mutex_unlock(&trace_types_lock); +- iter->trace->wait_pipe(iter); ++ ret = iter->trace->wait_pipe(iter); + mutex_lock(&trace_types_lock); ++ if (ret) ++ goto out; + if (signal_pending(current)) { + ret = -EINTR; + goto out; +diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h +index 10c86fb7a2b4..7e8be3e50f83 100644 +--- a/kernel/trace/trace.h ++++ b/kernel/trace/trace.h +@@ -334,7 +334,7 @@ struct tracer { + void (*stop)(struct trace_array *tr); + void (*open)(struct trace_iterator *iter); + void (*pipe_open)(struct trace_iterator *iter); +- void (*wait_pipe)(struct trace_iterator *iter); ++ int (*wait_pipe)(struct trace_iterator *iter); + void (*close)(struct trace_iterator *iter); + void (*pipe_close)(struct trace_iterator *iter); + ssize_t (*read)(struct trace_iterator *iter, +@@ -549,7 +549,7 @@ void trace_init_global_iter(struct trace_iterator *iter); + + void tracing_iter_reset(struct trace_iterator *iter, int cpu); + +-void poll_wait_pipe(struct trace_iterator *iter); ++int poll_wait_pipe(struct trace_iterator *iter); + + void tracing_sched_switch_trace(struct trace_array *tr, + struct task_struct *prev, +diff --git a/kernel/workqueue.c b/kernel/workqueue.c +index cea58300f650..3fafbbb31927 100644 +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -3412,6 +3412,7 @@ int workqueue_sysfs_register(struct workqueue_struct *wq) + } + } + ++ dev_set_uevent_suppress(&wq_dev->dev, false); + kobject_uevent(&wq_dev->dev.kobj, KOBJ_ADD); + return 0; + } +@@ -5028,7 +5029,7 @@ static void __init wq_numa_init(void) + BUG_ON(!tbl); + + for_each_node(node) +- BUG_ON(!alloc_cpumask_var_node(&tbl[node], GFP_KERNEL, ++ BUG_ON(!zalloc_cpumask_var_node(&tbl[node], GFP_KERNEL, + node_online(node) ? node : NUMA_NO_NODE)); + + for_each_possible_cpu(cpu) { +diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c +index b74da447e81e..7a85967060a5 100644 +--- a/lib/lz4/lz4_decompress.c ++++ b/lib/lz4/lz4_decompress.c +@@ -192,6 +192,8 @@ static int lz4_uncompress_unknownoutputsize(const char *source, char *dest, + int s = 255; + while ((ip < iend) && (s == 255)) { + s = *ip++; ++ if (unlikely(length > (size_t)(length + s))) ++ goto _output_error; + length += s; + } + } +@@ -232,6 +234,8 @@ static int lz4_uncompress_unknownoutputsize(const char *source, char *dest, + if (length == ML_MASK) { + while (ip < iend) { + int s = *ip++; ++ if (unlikely(length > (size_t)(length + s))) ++ goto _output_error; + length += s; + if (s == 255) + continue; +@@ -284,7 +288,7 @@ static int lz4_uncompress_unknownoutputsize(const char *source, char *dest, + + /* write overflow error detected */ + _output_error: +- return (int) (-(((char *) ip) - source)); ++ return -1; + } + + int lz4_decompress(const unsigned char *src, size_t *src_len, +diff --git a/mm/mempolicy.c b/mm/mempolicy.c +index a005cc9f6f18..0437f3595b32 100644 +--- a/mm/mempolicy.c ++++ b/mm/mempolicy.c +@@ -653,19 +653,18 @@ static unsigned long change_prot_numa(struct vm_area_struct *vma, + * @nodes and @flags,) it's isolated and queued to the pagelist which is + * passed via @private.) + */ +-static struct vm_area_struct * ++static int + queue_pages_range(struct mm_struct *mm, unsigned long start, unsigned long end, + const nodemask_t *nodes, unsigned long flags, void *private) + { +- int err; +- struct vm_area_struct *first, *vma, *prev; +- ++ int err = 0; ++ struct vm_area_struct *vma, *prev; + +- first = find_vma(mm, start); +- if (!first) +- return ERR_PTR(-EFAULT); ++ vma = find_vma(mm, start); ++ if (!vma) ++ return -EFAULT; + prev = NULL; +- for (vma = first; vma && vma->vm_start < end; vma = vma->vm_next) { ++ for (; vma && vma->vm_start < end; vma = vma->vm_next) { + unsigned long endvma = vma->vm_end; + + if (endvma > end) +@@ -675,9 +674,9 @@ queue_pages_range(struct mm_struct *mm, unsigned long start, unsigned long end, + + if (!(flags & MPOL_MF_DISCONTIG_OK)) { + if (!vma->vm_next && vma->vm_end < end) +- return ERR_PTR(-EFAULT); ++ return -EFAULT; + if (prev && prev->vm_end < vma->vm_start) +- return ERR_PTR(-EFAULT); ++ return -EFAULT; + } + + if (flags & MPOL_MF_LAZY) { +@@ -691,15 +690,13 @@ queue_pages_range(struct mm_struct *mm, unsigned long start, unsigned long end, + + err = queue_pages_pgd_range(vma, start, endvma, nodes, + flags, private); +- if (err) { +- first = ERR_PTR(err); ++ if (err) + break; +- } + } + next: + prev = vma; + } +- return first; ++ return err; + } + + /* +@@ -1184,16 +1181,17 @@ out: + + /* + * Allocate a new page for page migration based on vma policy. +- * Start assuming that page is mapped by vma pointed to by @private. ++ * Start by assuming the page is mapped by the same vma as contains @start. + * Search forward from there, if not. N.B., this assumes that the + * list of pages handed to migrate_pages()--which is how we get here-- + * is in virtual address order. + */ +-static struct page *new_vma_page(struct page *page, unsigned long private, int **x) ++static struct page *new_page(struct page *page, unsigned long start, int **x) + { +- struct vm_area_struct *vma = (struct vm_area_struct *)private; ++ struct vm_area_struct *vma; + unsigned long uninitialized_var(address); + ++ vma = find_vma(current->mm, start); + while (vma) { + address = page_address_in_vma(page, vma); + if (address != -EFAULT) +@@ -1223,7 +1221,7 @@ int do_migrate_pages(struct mm_struct *mm, const nodemask_t *from, + return -ENOSYS; + } + +-static struct page *new_vma_page(struct page *page, unsigned long private, int **x) ++static struct page *new_page(struct page *page, unsigned long start, int **x) + { + return NULL; + } +@@ -1233,7 +1231,6 @@ static long do_mbind(unsigned long start, unsigned long len, + unsigned short mode, unsigned short mode_flags, + nodemask_t *nmask, unsigned long flags) + { +- struct vm_area_struct *vma; + struct mm_struct *mm = current->mm; + struct mempolicy *new; + unsigned long end; +@@ -1299,11 +1296,9 @@ static long do_mbind(unsigned long start, unsigned long len, + if (err) + goto mpol_out; + +- vma = queue_pages_range(mm, start, end, nmask, ++ err = queue_pages_range(mm, start, end, nmask, + flags | MPOL_MF_INVERT, &pagelist); +- +- err = PTR_ERR(vma); /* maybe ... */ +- if (!IS_ERR(vma)) ++ if (!err) + err = mbind_range(mm, start, end, new); + + if (!err) { +@@ -1311,9 +1306,8 @@ static long do_mbind(unsigned long start, unsigned long len, + + if (!list_empty(&pagelist)) { + WARN_ON_ONCE(flags & MPOL_MF_LAZY); +- nr_failed = migrate_pages(&pagelist, new_vma_page, +- (unsigned long)vma, +- MIGRATE_SYNC, MR_MEMPOLICY_MBIND); ++ nr_failed = migrate_pages(&pagelist, new_page, ++ start, MIGRATE_SYNC, MR_MEMPOLICY_MBIND); + if (nr_failed) + putback_movable_pages(&pagelist); + } +@@ -2152,7 +2146,6 @@ struct mempolicy *__mpol_dup(struct mempolicy *old) + } else + *new = *old; + +- rcu_read_lock(); + if (current_cpuset_is_being_rebound()) { + nodemask_t mems = cpuset_mems_allowed(current); + if (new->flags & MPOL_F_REBINDING) +@@ -2160,7 +2153,6 @@ struct mempolicy *__mpol_dup(struct mempolicy *old) + else + mpol_rebind_policy(new, &mems, MPOL_REBIND_ONCE); + } +- rcu_read_unlock(); + atomic_set(&new->refcnt, 1); + return new; + } +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index a6bf980f5dd0..6e0a9cf8d02a 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -69,6 +69,7 @@ + + /* prevent >1 _updater_ of zone percpu pageset ->high and ->batch fields */ + static DEFINE_MUTEX(pcp_batch_high_lock); ++#define MIN_PERCPU_PAGELIST_FRACTION (8) + + #ifdef CONFIG_USE_PERCPU_NUMA_NODE_ID + DEFINE_PER_CPU(int, numa_node); +@@ -784,9 +785,21 @@ void __init init_cma_reserved_pageblock(struct page *page) + set_page_count(p, 0); + } while (++p, --i); + +- set_page_refcounted(page); + set_pageblock_migratetype(page, MIGRATE_CMA); +- __free_pages(page, pageblock_order); ++ ++ if (pageblock_order >= MAX_ORDER) { ++ i = pageblock_nr_pages; ++ p = page; ++ do { ++ set_page_refcounted(p); ++ __free_pages(p, MAX_ORDER - 1); ++ p += MAX_ORDER_NR_PAGES; ++ } while (i -= MAX_ORDER_NR_PAGES); ++ } else { ++ set_page_refcounted(page); ++ __free_pages(page, pageblock_order); ++ } ++ + adjust_managed_page_count(page, pageblock_nr_pages); + } + #endif +@@ -4079,7 +4092,7 @@ static void __meminit zone_init_free_lists(struct zone *zone) + memmap_init_zone((size), (nid), (zone), (start_pfn), MEMMAP_EARLY) + #endif + +-static int __meminit zone_batchsize(struct zone *zone) ++static int zone_batchsize(struct zone *zone) + { + #ifdef CONFIG_MMU + int batch; +@@ -4195,8 +4208,8 @@ static void pageset_set_high(struct per_cpu_pageset *p, + pageset_update(&p->pcp, high, batch); + } + +-static void __meminit pageset_set_high_and_batch(struct zone *zone, +- struct per_cpu_pageset *pcp) ++static void pageset_set_high_and_batch(struct zone *zone, ++ struct per_cpu_pageset *pcp) + { + if (percpu_pagelist_fraction) + pageset_set_high(pcp, +@@ -5789,23 +5802,38 @@ int percpu_pagelist_fraction_sysctl_handler(ctl_table *table, int write, + void __user *buffer, size_t *length, loff_t *ppos) + { + struct zone *zone; +- unsigned int cpu; ++ int old_percpu_pagelist_fraction; + int ret; + ++ mutex_lock(&pcp_batch_high_lock); ++ old_percpu_pagelist_fraction = percpu_pagelist_fraction; ++ + ret = proc_dointvec_minmax(table, write, buffer, length, ppos); +- if (!write || (ret < 0)) +- return ret; ++ if (!write || ret < 0) ++ goto out; ++ ++ /* Sanity checking to avoid pcp imbalance */ ++ if (percpu_pagelist_fraction && ++ percpu_pagelist_fraction < MIN_PERCPU_PAGELIST_FRACTION) { ++ percpu_pagelist_fraction = old_percpu_pagelist_fraction; ++ ret = -EINVAL; ++ goto out; ++ } ++ ++ /* No change? */ ++ if (percpu_pagelist_fraction == old_percpu_pagelist_fraction) ++ goto out; + +- mutex_lock(&pcp_batch_high_lock); + for_each_populated_zone(zone) { +- unsigned long high; +- high = zone->managed_pages / percpu_pagelist_fraction; ++ unsigned int cpu; ++ + for_each_possible_cpu(cpu) +- pageset_set_high(per_cpu_ptr(zone->pageset, cpu), +- high); ++ pageset_set_high_and_batch(zone, ++ per_cpu_ptr(zone->pageset, cpu)); + } ++out: + mutex_unlock(&pcp_batch_high_lock); +- return 0; ++ return ret; + } + + int hashdist = HASHDIST_DEFAULT; +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index 2eeb6643d78a..729f516ecd63 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -47,6 +47,10 @@ static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb) + smp_mb__after_clear_bit(); /* wake_up_bit advises about this barrier */ + wake_up_bit(&hdev->flags, HCI_INQUIRY); + ++ hci_dev_lock(hdev); ++ hci_discovery_set_state(hdev, DISCOVERY_STOPPED); ++ hci_dev_unlock(hdev); ++ + hci_conn_check_pending(hdev); + } + +@@ -3164,8 +3168,11 @@ static void hci_user_confirm_request_evt(struct hci_dev *hdev, + + /* If we're not the initiators request authorization to + * proceed from user space (mgmt_user_confirm with +- * confirm_hint set to 1). */ +- if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags)) { ++ * confirm_hint set to 1). The exception is if neither ++ * side had MITM in which case we do auto-accept. ++ */ ++ if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ++ (loc_mitm || rem_mitm)) { + BT_DBG("Confirming auto-accept as acceptor"); + confirm_hint = 1; + goto confirm; +diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c +index 07c9aea21244..a3a81d96314b 100644 +--- a/net/bluetooth/l2cap_sock.c ++++ b/net/bluetooth/l2cap_sock.c +@@ -631,11 +631,6 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, + + /*change security for LE channels */ + if (chan->scid == L2CAP_CID_ATT) { +- if (!conn->hcon->out) { +- err = -EINVAL; +- break; +- } +- + if (smp_conn_security(conn->hcon, sec.level)) + break; + sk->sk_state = BT_CONFIG; +diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c +index fedc5399d465..211fffb5dca8 100644 +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -2319,8 +2319,13 @@ static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev, + } + + if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) { +- /* Continue with pairing via SMP */ ++ /* Continue with pairing via SMP. The hdev lock must be ++ * released as SMP may try to recquire it for crypto ++ * purposes. ++ */ ++ hci_dev_unlock(hdev); + err = smp_user_confirm_reply(conn, mgmt_op, passkey); ++ hci_dev_lock(hdev); + + if (!err) + err = cmd_complete(sk, hdev->id, mgmt_op, +diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c +index cafe614ef93d..8e41f0163c5a 100644 +--- a/net/mac80211/debugfs_netdev.c ++++ b/net/mac80211/debugfs_netdev.c +@@ -34,8 +34,7 @@ static ssize_t ieee80211_if_read( + ssize_t ret = -EINVAL; + + read_lock(&dev_base_lock); +- if (sdata->dev->reg_state == NETREG_REGISTERED) +- ret = (*format)(sdata, buf, sizeof(buf)); ++ ret = (*format)(sdata, buf, sizeof(buf)); + read_unlock(&dev_base_lock); + + if (ret >= 0) +@@ -62,8 +61,7 @@ static ssize_t ieee80211_if_write( + + ret = -ENODEV; + rtnl_lock(); +- if (sdata->dev->reg_state == NETREG_REGISTERED) +- ret = (*write)(sdata, buf, count); ++ ret = (*write)(sdata, buf, count); + rtnl_unlock(); + + return ret; +diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c +index a12afe77bb26..f69cac4bf39f 100644 +--- a/net/mac80211/ibss.c ++++ b/net/mac80211/ibss.c +@@ -1203,6 +1203,7 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata, + sdata->u.ibss.privacy = params->privacy; + sdata->u.ibss.control_port = params->control_port; + sdata->u.ibss.basic_rates = params->basic_rates; ++ sdata->u.ibss.last_scan_completed = jiffies; + + /* fix basic_rates if channel does not support these rates */ + rate_flags = ieee80211_chandef_rate_flags(¶ms->chandef); +diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c +index db41c190e76d..37025725c369 100644 +--- a/net/mac80211/sta_info.c ++++ b/net/mac80211/sta_info.c +@@ -271,6 +271,7 @@ void sta_info_free(struct ieee80211_local *local, struct sta_info *sta) + + sta_dbg(sta->sdata, "Destroyed STA %pM\n", sta->sta.addr); + ++ kfree(rcu_dereference_raw(sta->sta.rates)); + kfree(sta); + } + +diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c +index 3581736446d5..e2d38e5318d4 100644 +--- a/net/netfilter/ipvs/ip_vs_core.c ++++ b/net/netfilter/ipvs/ip_vs_core.c +@@ -1392,15 +1392,19 @@ ip_vs_in_icmp(struct sk_buff *skb, int *related, unsigned int hooknum) + + if (ipip) { + __be32 info = ic->un.gateway; ++ __u8 type = ic->type; ++ __u8 code = ic->code; + + /* Update the MTU */ + if (ic->type == ICMP_DEST_UNREACH && + ic->code == ICMP_FRAG_NEEDED) { + struct ip_vs_dest *dest = cp->dest; + u32 mtu = ntohs(ic->un.frag.mtu); ++ __be16 frag_off = cih->frag_off; + + /* Strip outer IP and ICMP, go to IPIP header */ +- __skb_pull(skb, ihl + sizeof(_icmph)); ++ if (pskb_pull(skb, ihl + sizeof(_icmph)) == NULL) ++ goto ignore_ipip; + offset2 -= ihl + sizeof(_icmph); + skb_reset_network_header(skb); + IP_VS_DBG(12, "ICMP for IPIP %pI4->%pI4: mtu=%u\n", +@@ -1408,7 +1412,7 @@ ip_vs_in_icmp(struct sk_buff *skb, int *related, unsigned int hooknum) + ipv4_update_pmtu(skb, dev_net(skb->dev), + mtu, 0, 0, 0, 0); + /* Client uses PMTUD? */ +- if (!(cih->frag_off & htons(IP_DF))) ++ if (!(frag_off & htons(IP_DF))) + goto ignore_ipip; + /* Prefer the resulting PMTU */ + if (dest) { +@@ -1427,12 +1431,13 @@ ip_vs_in_icmp(struct sk_buff *skb, int *related, unsigned int hooknum) + /* Strip outer IP, ICMP and IPIP, go to IP header of + * original request. + */ +- __skb_pull(skb, offset2); ++ if (pskb_pull(skb, offset2) == NULL) ++ goto ignore_ipip; + skb_reset_network_header(skb); + IP_VS_DBG(12, "Sending ICMP for %pI4->%pI4: t=%u, c=%u, i=%u\n", + &ip_hdr(skb)->saddr, &ip_hdr(skb)->daddr, +- ic->type, ic->code, ntohl(info)); +- icmp_send(skb, ic->type, ic->code, info); ++ type, code, ntohl(info)); ++ icmp_send(skb, type, code, info); + /* ICMP can be shorter but anyways, account it */ + ip_vs_out_stats(cp, skb); + +diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c +index a3df9bddc4f7..f9568654ffd2 100644 +--- a/net/netfilter/ipvs/ip_vs_ctl.c ++++ b/net/netfilter/ipvs/ip_vs_ctl.c +@@ -3765,6 +3765,7 @@ static void __net_exit ip_vs_control_net_cleanup_sysctl(struct net *net) + cancel_delayed_work_sync(&ipvs->defense_work); + cancel_work_sync(&ipvs->defense_work.work); + unregister_net_sysctl_table(ipvs->sysctl_hdr); ++ ip_vs_stop_estimator(net, &ipvs->tot_stats); + } + + #else +@@ -3825,7 +3826,6 @@ void __net_exit ip_vs_control_net_cleanup(struct net *net) + */ + rcu_barrier(); + ip_vs_trash_cleanup(net); +- ip_vs_stop_estimator(net, &ipvs->tot_stats); + ip_vs_control_net_cleanup_sysctl(net); + remove_proc_entry("ip_vs_stats_percpu", net->proc_net); + remove_proc_entry("ip_vs_stats", net->proc_net); +diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c +index 6f0f4f7f68a5..13deb61737f8 100644 +--- a/net/netfilter/nf_nat_core.c ++++ b/net/netfilter/nf_nat_core.c +@@ -491,6 +491,39 @@ static int nf_nat_proto_remove(struct nf_conn *i, void *data) + return i->status & IPS_NAT_MASK ? 1 : 0; + } + ++static int nf_nat_proto_clean(struct nf_conn *ct, void *data) ++{ ++ struct nf_conn_nat *nat = nfct_nat(ct); ++ ++ if (nf_nat_proto_remove(ct, data)) ++ return 1; ++ ++ if (!nat || !nat->ct) ++ return 0; ++ ++ /* This netns is being destroyed, and conntrack has nat null binding. ++ * Remove it from bysource hash, as the table will be freed soon. ++ * ++ * Else, when the conntrack is destoyed, nf_nat_cleanup_conntrack() ++ * will delete entry from already-freed table. ++ */ ++ if (!del_timer(&ct->timeout)) ++ return 1; ++ ++ spin_lock_bh(&nf_nat_lock); ++ hlist_del_rcu(&nat->bysource); ++ ct->status &= ~IPS_NAT_DONE_MASK; ++ nat->ct = NULL; ++ spin_unlock_bh(&nf_nat_lock); ++ ++ add_timer(&ct->timeout); ++ ++ /* don't delete conntrack. Although that would make things a lot ++ * simpler, we'd end up flushing all conntracks on nat rmmod. ++ */ ++ return 0; ++} ++ + static void nf_nat_l4proto_clean(u8 l3proto, u8 l4proto) + { + struct nf_nat_proto_clean clean = { +@@ -753,7 +786,7 @@ static void __net_exit nf_nat_net_exit(struct net *net) + { + struct nf_nat_proto_clean clean = {}; + +- nf_ct_iterate_cleanup(net, &nf_nat_proto_remove, &clean, 0, 0); ++ nf_ct_iterate_cleanup(net, nf_nat_proto_clean, &clean, 0, 0); + synchronize_rcu(); + nf_ct_free_hashtable(net->ct.nat_bysource, net->ct.nat_htable_size); + } +diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c +index 80a6640f329b..b9aad4723a9d 100644 +--- a/net/sunrpc/svc_xprt.c ++++ b/net/sunrpc/svc_xprt.c +@@ -730,6 +730,8 @@ static int svc_handle_xprt(struct svc_rqst *rqstp, struct svc_xprt *xprt) + newxpt = xprt->xpt_ops->xpo_accept(xprt); + if (newxpt) + svc_add_new_temp_xprt(serv, newxpt); ++ else ++ module_put(xprt->xpt_class->xcl_owner); + } else if (xprt->xpt_ops->xpo_has_wspace(xprt)) { + /* XPT_DATA|XPT_DEFERRED case: */ + dprintk("svc: server %p, pool %u, transport %p, inuse=%d\n", +diff --git a/scripts/recordmcount.h b/scripts/recordmcount.h +index 9d1421e63ff8..49b582a225b0 100644 +--- a/scripts/recordmcount.h ++++ b/scripts/recordmcount.h +@@ -163,11 +163,11 @@ static int mcount_adjust = 0; + + static int MIPS_is_fake_mcount(Elf_Rel const *rp) + { +- static Elf_Addr old_r_offset; ++ static Elf_Addr old_r_offset = ~(Elf_Addr)0; + Elf_Addr current_r_offset = _w(rp->r_offset); + int is_fake; + +- is_fake = old_r_offset && ++ is_fake = (old_r_offset != ~(Elf_Addr)0) && + (current_r_offset - old_r_offset == MIPS_FAKEMCOUNT_OFFSET); + old_r_offset = current_r_offset; + +diff --git a/sound/usb/card.c b/sound/usb/card.c +index 64952e2d3ed1..fda227e3bbac 100644 +--- a/sound/usb/card.c ++++ b/sound/usb/card.c +@@ -307,6 +307,11 @@ static int snd_usb_create_streams(struct snd_usb_audio *chip, int ctrlif) + + static int snd_usb_audio_free(struct snd_usb_audio *chip) + { ++ struct list_head *p, *n; ++ ++ list_for_each_safe(p, n, &chip->ep_list) ++ snd_usb_endpoint_free(p); ++ + mutex_destroy(&chip->mutex); + kfree(chip); + return 0; +@@ -583,7 +588,7 @@ static void snd_usb_audio_disconnect(struct usb_device *dev, + struct snd_usb_audio *chip) + { + struct snd_card *card; +- struct list_head *p, *n; ++ struct list_head *p; + + if (chip == (void *)-1L) + return; +@@ -596,14 +601,16 @@ static void snd_usb_audio_disconnect(struct usb_device *dev, + mutex_lock(®ister_mutex); + chip->num_interfaces--; + if (chip->num_interfaces <= 0) { ++ struct snd_usb_endpoint *ep; ++ + snd_card_disconnect(card); + /* release the pcm resources */ + list_for_each(p, &chip->pcm_list) { + snd_usb_stream_disconnect(p); + } + /* release the endpoint resources */ +- list_for_each_safe(p, n, &chip->ep_list) { +- snd_usb_endpoint_free(p); ++ list_for_each_entry(ep, &chip->ep_list, list) { ++ snd_usb_endpoint_release(ep); + } + /* release the midi resources */ + list_for_each(p, &chip->midi_list) { +diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c +index ba106c6c2d3a..b0a0f2028319 100644 +--- a/sound/usb/endpoint.c ++++ b/sound/usb/endpoint.c +@@ -960,19 +960,30 @@ int snd_usb_endpoint_deactivate(struct snd_usb_endpoint *ep) + } + + /** ++ * snd_usb_endpoint_release: Tear down an snd_usb_endpoint ++ * ++ * @ep: the endpoint to release ++ * ++ * This function does not care for the endpoint's use count but will tear ++ * down all the streaming URBs immediately. ++ */ ++void snd_usb_endpoint_release(struct snd_usb_endpoint *ep) ++{ ++ release_urbs(ep, 1); ++} ++ ++/** + * snd_usb_endpoint_free: Free the resources of an snd_usb_endpoint + * + * @ep: the list header of the endpoint to free + * +- * This function does not care for the endpoint's use count but will tear +- * down all the streaming URBs immediately and free all resources. ++ * This free all resources of the given ep. + */ + void snd_usb_endpoint_free(struct list_head *head) + { + struct snd_usb_endpoint *ep; + + ep = list_entry(head, struct snd_usb_endpoint, list); +- release_urbs(ep, 1); + kfree(ep); + } + +diff --git a/sound/usb/endpoint.h b/sound/usb/endpoint.h +index 2287adf5ca59..fe65a38ba387 100644 +--- a/sound/usb/endpoint.h ++++ b/sound/usb/endpoint.h +@@ -21,6 +21,7 @@ void snd_usb_endpoint_stop(struct snd_usb_endpoint *ep); + void snd_usb_endpoint_sync_pending_stop(struct snd_usb_endpoint *ep); + int snd_usb_endpoint_activate(struct snd_usb_endpoint *ep); + int snd_usb_endpoint_deactivate(struct snd_usb_endpoint *ep); ++void snd_usb_endpoint_release(struct snd_usb_endpoint *ep); + void snd_usb_endpoint_free(struct list_head *head); + + int snd_usb_endpoint_implicit_feedback_sink(struct snd_usb_endpoint *ep); +diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c +index b375d58871e7..98ca3540514f 100644 +--- a/sound/usb/pcm.c ++++ b/sound/usb/pcm.c +@@ -1492,7 +1492,8 @@ static void retire_playback_urb(struct snd_usb_substream *subs, + * on two reads of a counter updated every ms. + */ + if (abs(est_delay - subs->last_delay) * 1000 > runtime->rate * 2) +- snd_printk(KERN_DEBUG "delay: estimated %d, actual %d\n", ++ dev_dbg_ratelimited(&subs->dev->dev, ++ "delay: estimated %d, actual %d\n", + est_delay, subs->last_delay); + + if (!subs->running) { +diff --git a/tools/usb/ffs-test.c b/tools/usb/ffs-test.c +index fe1e66b6ef40..a87e99f37c52 100644 +--- a/tools/usb/ffs-test.c ++++ b/tools/usb/ffs-test.c +@@ -116,8 +116,8 @@ static const struct { + .header = { + .magic = cpu_to_le32(FUNCTIONFS_DESCRIPTORS_MAGIC), + .length = cpu_to_le32(sizeof descriptors), +- .fs_count = 3, +- .hs_count = 3, ++ .fs_count = cpu_to_le32(3), ++ .hs_count = cpu_to_le32(3), + }, + .fs_descs = { + .intf = { |